diff --git a/6.1/target/linux/mediatek/image/filogic.mk b/6.1/target/linux/mediatek/image/filogic.mk
index 4d868165..c65ca2c8 100644
--- a/6.1/target/linux/mediatek/image/filogic.mk
+++ b/6.1/target/linux/mediatek/image/filogic.mk
@@ -239,6 +239,21 @@ define Device/glinet_gl-mt3000
 endef
 TARGET_DEVICES += glinet_gl-mt3000
 
+define Device/glinet_gl-mt6000
+  DEVICE_VENDOR := GL.iNet
+  DEVICE_MODEL := GL-MT6000
+  DEVICE_DTS := mt7986a-glinet-gl-mt6000
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := e2fsprogs f2fsck mkf2fs kmod-usb3 kmod-mt7986-firmware mt7986-wo-firmware
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-kernel | pad-to 32M | append-rootfs
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-gl-metadata
+  ARTIFACTS := preloader.bin bl31-uboot.fip
+  ARTIFACT/preloader.bin := mt7986-bl2 emmc-ddr4
+  ARTIFACT/bl31-uboot.fip := mt7986-bl31-uboot glinet_gl-mt6000
+endef
+TARGET_DEVICES += glinet_gl-mt6000
+
 define Device/h3c_magic-nx30-pro
   DEVICE_VENDOR := H3C
   DEVICE_MODEL := Magic NX30 Pro
diff --git a/6.12/include/kernel-6.12 b/6.12/include/kernel-6.12
new file mode 100644
index 00000000..69af3e25
--- /dev/null
+++ b/6.12/include/kernel-6.12
@@ -0,0 +1,2 @@
+LINUX_VERSION-6.12 = .14
+LINUX_KERNEL_HASH-6.12.14 = 9423f4bfb4d875417e39cb0b017b5499fea47da56119f0cd28a201735d898f14
\ No newline at end of file
diff --git a/6.12/include/kernel-defaults.mk b/6.12/include/kernel-defaults.mk
new file mode 100644
index 00000000..1cc23270
--- /dev/null
+++ b/6.12/include/kernel-defaults.mk
@@ -0,0 +1,195 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2006-2020 OpenWrt.org
+
+ifdef CONFIG_STRIP_KERNEL_EXPORTS
+  KERNEL_MAKEOPTS_IMAGE += \
+	EXTRA_LDSFLAGS="-I$(KERNEL_BUILD_DIR) -include symtab.h"
+endif
+
+INITRAMFS_EXTRA_FILES ?= $(GENERIC_PLATFORM_DIR)/image/initramfs-base-files.txt
+
+export HOST_EXTRACFLAGS=-I$(STAGING_DIR_HOST)/include
+
+# defined in quilt.mk
+Kernel/Patch:=$(Kernel/Patch/Default)
+
+ifneq (,$(findstring .xz,$(LINUX_SOURCE)))
+  LINUX_CAT:=xzcat
+else
+  LINUX_CAT:=$(STAGING_DIR_HOST)/bin/libdeflate-gzip -dc
+endif
+
+ifeq ($(strip $(CONFIG_EXTERNAL_KERNEL_TREE)),"")
+  ifeq ($(strip $(CONFIG_KERNEL_GIT_CLONE_URI)),"")
+    define Kernel/Prepare/Default
+	$(LINUX_CAT) $(DL_DIR)/$(LINUX_SOURCE) | $(TAR) -C $(KERNEL_BUILD_DIR) $(TAR_OPTIONS)
+	$(Kernel/Patch)
+	$(if $(QUILT),touch $(LINUX_DIR)/.quilt_used)
+    endef
+  else
+    define Kernel/Prepare/Default
+	$(LINUX_CAT) $(DL_DIR)/$(LINUX_SOURCE) | $(TAR) -C $(KERNEL_BUILD_DIR) $(TAR_OPTIONS)
+	$(Kernel/Patch)
+	$(if $(QUILT),touch $(LINUX_DIR)/.quilt_used)
+    endef
+  endif
+else
+  define Kernel/Prepare/Default
+	mkdir -p $(KERNEL_BUILD_DIR)
+	if [ -d $(LINUX_DIR) ]; then \
+		rmdir $(LINUX_DIR); \
+	fi
+	ln -s $(CONFIG_EXTERNAL_KERNEL_TREE) $(LINUX_DIR)
+	if [ -d $(LINUX_DIR)/user_headers ]; then \
+		rm -rf $(LINUX_DIR)/user_headers; \
+	fi
+  endef
+endif
+
+ifeq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),y)
+  ifeq ($(CONFIG_TARGET_ROOTFS_INITRAMFS_SEPARATE),y)
+    define Kernel/SetInitramfs/PreConfigure
+	grep -v -e CONFIG_BLK_DEV_INITRD $(LINUX_DIR)/.config.old > $(LINUX_DIR)/.config
+	echo 'CONFIG_BLK_DEV_INITRD=y' >> $(LINUX_DIR)/.config
+	echo 'CONFIG_INITRAMFS_SOURCE=""' >> $(LINUX_DIR)/.config
+    endef
+  else
+  ifeq ($(strip $(CONFIG_EXTERNAL_CPIO)),"")
+    define Kernel/SetInitramfs/PreConfigure
+	grep -v -e INITRAMFS -e CONFIG_RD_ -e CONFIG_BLK_DEV_INITRD $(LINUX_DIR)/.config.old > $(LINUX_DIR)/.config
+	echo 'CONFIG_BLK_DEV_INITRD=y' >> $(LINUX_DIR)/.config
+	echo 'CONFIG_INITRAMFS_SOURCE="$(strip $(TARGET_DIR) $(INITRAMFS_EXTRA_FILES))"' >> $(LINUX_DIR)/.config
+    endef
+  else
+    define Kernel/SetInitramfs/PreConfigure
+	grep -v INITRAMFS $(LINUX_DIR)/.config.old > $(LINUX_DIR)/.config
+	echo 'CONFIG_INITRAMFS_SOURCE="$(call qstrip,$(CONFIG_EXTERNAL_CPIO))"' >> $(LINUX_DIR)/.config
+    endef
+  endif
+endif
+
+  define Kernel/SetInitramfs
+	rm -f $(LINUX_DIR)/.config.prev
+	mv $(LINUX_DIR)/.config $(LINUX_DIR)/.config.old
+	$(call Kernel/SetInitramfs/PreConfigure)
+	echo "# CONFIG_INITRAMFS_PRESERVE_MTIME is not set" >> $(LINUX_DIR)/.config
+  ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS_SEPARATE),y)
+	echo 'CONFIG_INITRAMFS_ROOT_UID=$(shell id -u)' >> $(LINUX_DIR)/.config
+	echo 'CONFIG_INITRAMFS_ROOT_GID=$(shell id -g)' >> $(LINUX_DIR)/.config
+	echo "$(if $(CONFIG_TARGET_INITRAMFS_FORCE),CONFIG_INITRAMFS_FORCE=y,# CONFIG_INITRAMFS_FORCE is not set)" >> $(LINUX_DIR)/.config
+  else
+	echo "# CONFIG_INITRAMFS_FORCE is not set" >> $(LINUX_DIR)/.config
+  endif
+	echo "$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_NONE),CONFIG_INITRAMFS_COMPRESSION_NONE=y,# CONFIG_INITRAMFS_COMPRESSION_NONE is not set)" >> $(LINUX_DIR)/.config
+	echo -e "$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_GZIP),CONFIG_INITRAMFS_COMPRESSION_GZIP=y\nCONFIG_RD_GZIP=y,# CONFIG_INITRAMFS_COMPRESSION_GZIP is not set\n# CONFIG_RD_GZIP is not set)" >> $(LINUX_DIR)/.config
+	echo -e "$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_BZIP2),CONFIG_INITRAMFS_COMPRESSION_BZIP2=y\nCONFIG_RD_BZIP2=y,# CONFIG_INITRAMFS_COMPRESSION_BZIP2 is not set\n# CONFIG_RD_BZIP2 is not set)" >> $(LINUX_DIR)/.config
+	echo -e "$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_LZMA),CONFIG_INITRAMFS_COMPRESSION_LZMA=y\nCONFIG_RD_LZMA=y,# CONFIG_INITRAMFS_COMPRESSION_LZMA is not set\n# CONFIG_RD_LZMA is not set)" >> $(LINUX_DIR)/.config
+	echo -e "$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_LZO),CONFIG_INITRAMFS_COMPRESSION_LZO=y\nCONFIG_RD_LZO=y,# CONFIG_INITRAMFS_COMPRESSION_LZO is not set\n# CONFIG_RD_LZO is not set)" >> $(LINUX_DIR)/.config
+	echo -e "$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_XZ),CONFIG_INITRAMFS_COMPRESSION_XZ=y\nCONFIG_RD_XZ=y,# CONFIG_INITRAMFS_COMPRESSION_XZ is not set\n# CONFIG_RD_XZ is not set)" >> $(LINUX_DIR)/.config
+	echo -e "$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_LZ4),CONFIG_INITRAMFS_COMPRESSION_LZ4=y\nCONFIG_RD_LZ4=y,# CONFIG_INITRAMFS_COMPRESSION_LZ4 is not set\n# CONFIG_RD_LZ4 is not set)" >> $(LINUX_DIR)/.config
+	echo -e "$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_ZSTD),CONFIG_INITRAMFS_COMPRESSION_ZSTD=y\nCONFIG_RD_ZSTD=y,# CONFIG_INITRAMFS_COMPRESSION_ZSTD is not set\n# CONFIG_RD_ZSTD is not set)" >> $(LINUX_DIR)/.config
+  endef
+else
+endif
+
+define Kernel/SetNoInitramfs
+	mv $(LINUX_DIR)/.config.set $(LINUX_DIR)/.config.old
+	grep -v INITRAMFS $(LINUX_DIR)/.config.old > $(LINUX_DIR)/.config.set
+	echo 'CONFIG_INITRAMFS_SOURCE=""' >> $(LINUX_DIR)/.config.set
+	echo '# CONFIG_INITRAMFS_FORCE is not set' >> $(LINUX_DIR)/.config.set
+	echo "# CONFIG_INITRAMFS_PRESERVE_MTIME is not set" >> $(LINUX_DIR)/.config.set
+endef
+
+define Kernel/Configure/Default
+	rm -f $(LINUX_DIR)/localversion
+	$(LINUX_CONF_CMD) > $(LINUX_DIR)/.config.target
+# copy CONFIG_KERNEL_* settings over to .config.target
+	awk '/^(#[[:space:]]+)?CONFIG_KERNEL/{sub("CONFIG_KERNEL_","CONFIG_");print}' $(TOPDIR)/.config >> $(LINUX_DIR)/.config.target
+	echo "# CONFIG_KALLSYMS_EXTRA_PASS is not set" >> $(LINUX_DIR)/.config.target
+	echo "# CONFIG_KALLSYMS_ALL is not set" >> $(LINUX_DIR)/.config.target
+	echo "CONFIG_KALLSYMS_UNCOMPRESSED=y" >> $(LINUX_DIR)/.config.target
+	$(SCRIPT_DIR)/package-metadata.pl kconfig $(TMP_DIR)/.packageinfo $(TOPDIR)/.config $(KERNEL_PATCHVER) > $(LINUX_DIR)/.config.override
+	$(SCRIPT_DIR)/kconfig.pl 'm+' '+' $(LINUX_DIR)/.config.target /dev/null $(LINUX_DIR)/.config.override > $(LINUX_DIR)/.config.set
+	$(call Kernel/SetNoInitramfs)
+	rm -rf $(KERNEL_BUILD_DIR)/modules
+	cmp -s $(LINUX_DIR)/.config.set $(LINUX_DIR)/.config.prev || { \
+		cp $(LINUX_DIR)/.config.set $(LINUX_DIR)/.config; \
+		cp $(LINUX_DIR)/.config.set $(LINUX_DIR)/.config.prev; \
+	}
+	$(_SINGLE) [ -d $(LINUX_DIR)/user_headers ] || $(KERNEL_MAKE) $(if $(findstring uml,$(BOARD)),ARCH=$(ARCH)) INSTALL_HDR_PATH=$(LINUX_DIR)/user_headers headers_install
+	grep '=[ym]' $(LINUX_DIR)/.config.set | LC_ALL=C sort | $(MKHASH) md5 > $(LINUX_DIR)/.vermagic
+endef
+
+define Kernel/Configure/Initramfs
+	$(call Kernel/SetInitramfs)
+endef
+
+define Kernel/CompileModules/Default
+	rm -f $(LINUX_DIR)/vmlinux $(LINUX_DIR)/System.map
+	+$(KERNEL_MAKE) $(if $(KERNELNAME),$(KERNELNAME),all) modules
+	# If .config did not change, use the previous timestamp to avoid package rebuilds
+	cmp -s $(LINUX_DIR)/.config $(LINUX_DIR)/.config.modules.save && \
+		mv $(LINUX_DIR)/.config.modules.save $(LINUX_DIR)/.config; \
+	$(CP) $(LINUX_DIR)/.config $(LINUX_DIR)/.config.modules.save
+endef
+
+OBJCOPY_STRIP = -R .reginfo -R .notes -R .note -R .comment -R .mdebug -R .note.gnu.build-id
+
+# AMD64 shares the location with x86
+ifeq ($(LINUX_KARCH),x86_64)
+IMAGES_DIR:=../../x86/boot
+endif
+
+define Kernel/CopyImage
+	cmp -s $(LINUX_DIR)/vmlinux $(KERNEL_BUILD_DIR)/vmlinux$(1).debug || { \
+		$(KERNEL_CROSS)objcopy -O binary $(OBJCOPY_STRIP) -S $(LINUX_DIR)/vmlinux $(LINUX_KERNEL)$(1); \
+		$(KERNEL_CROSS)objcopy $(OBJCOPY_STRIP) -S $(LINUX_DIR)/vmlinux $(KERNEL_BUILD_DIR)/vmlinux$(1).elf; \
+		$(CP) $(LINUX_DIR)/vmlinux $(KERNEL_BUILD_DIR)/vmlinux$(1).debug; \
+		$(foreach k, \
+			$(if $(KERNEL_IMAGES),$(KERNEL_IMAGES),$(filter-out vmlinux dtbs,$(KERNELNAME))), \
+			$(CP) $(LINUX_DIR)/arch/$(LINUX_KARCH)/boot/$(IMAGES_DIR)/$(k) $(KERNEL_BUILD_DIR)/$(k)$(1); \
+		) \
+	}
+endef
+
+define Kernel/CompileImage/Default
+	rm -f $(TARGET_DIR)/init
+	+$(KERNEL_MAKE) $(KERNEL_MAKEOPTS_IMAGE) $(if $(KERNELNAME),$(KERNELNAME),all)
+	$(call Kernel/CopyImage)
+endef
+
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+define Kernel/CompileImage/Initramfs
+	$(call Kernel/Configure/Initramfs)
+	$(CP) $(GENERIC_PLATFORM_DIR)/other-files/init $(TARGET_DIR)/init
+	$(if $(SOURCE_DATE_EPOCH),touch -hcd "@$(SOURCE_DATE_EPOCH)" $(TARGET_DIR) $(TARGET_DIR)/init)
+	rm -rf $(KERNEL_BUILD_DIR)/linux-$(LINUX_VERSION)/usr/initramfs_data.cpio*
+ifeq ($(CONFIG_TARGET_ROOTFS_INITRAMFS_SEPARATE),y)
+ifneq ($(call qstrip,$(CONFIG_EXTERNAL_CPIO)),)
+	$(CP) $(CONFIG_EXTERNAL_CPIO) $(KERNEL_BUILD_DIR)/initrd.cpio
+else
+	( cd $(TARGET_DIR); find . | LC_ALL=C sort | $(STAGING_DIR_HOST)/bin/cpio --reproducible -o -H newc -R 0:0 > $(KERNEL_BUILD_DIR)/initrd.cpio )
+endif
+	$(if $(SOURCE_DATE_EPOCH),touch -hcd "@$(SOURCE_DATE_EPOCH)" $(KERNEL_BUILD_DIR)/initrd.cpio)
+	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_BZIP2),$(STAGING_DIR_HOST)/bin/bzip2 -9 -c < $(KERNEL_BUILD_DIR)/initrd.cpio > $(KERNEL_BUILD_DIR)/initrd.cpio.bzip2)
+	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_GZIP),$(STAGING_DIR_HOST)/bin/libdeflate-gzip -n -f -S .gzip -12 $(KERNEL_BUILD_DIR)/initrd.cpio)
+	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_LZ4),$(STAGING_DIR_HOST)/bin/lz4c -l -c1 -fz --favor-decSpeed $(KERNEL_BUILD_DIR)/initrd.cpio)
+	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_LZMA),$(STAGING_DIR_HOST)/bin/lzma e -lc1 -lp2 -pb2 $(KERNEL_BUILD_DIR)/initrd.cpio $(KERNEL_BUILD_DIR)/initrd.cpio.lzma)
+	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_LZO),$(STAGING_DIR_HOST)/bin/lzop -9 -f $(KERNEL_BUILD_DIR)/initrd.cpio)
+	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_XZ),$(STAGING_DIR_HOST)/bin/xz -T$(if $(filter 1,$(NPROC)),2,0) -9 -fz --check=crc32 $(KERNEL_BUILD_DIR)/initrd.cpio)
+	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_ZSTD),$(STAGING_DIR_HOST)/bin/zstd -T0 -f -o $(KERNEL_BUILD_DIR)/initrd.cpio.zstd $(KERNEL_BUILD_DIR)/initrd.cpio)
+endif
+	+$(KERNEL_MAKE) $(KERNEL_MAKEOPTS_IMAGE) $(if $(KERNELNAME),$(KERNELNAME),all)
+	$(call Kernel/CopyImage,-initramfs)
+endef
+else
+define Kernel/CompileImage/Initramfs
+endef
+endif
+
+define Kernel/Clean/Default
+	rm -f $(KERNEL_BUILD_DIR)/linux-$(LINUX_VERSION)/.configured
+	rm -f $(LINUX_KERNEL)
+	$(_SINGLE)$(MAKE) -C $(KERNEL_BUILD_DIR)/linux-$(LINUX_VERSION) clean
+endef
diff --git a/6.12/package/boot/uboot-envtools/files/mediatek_filogic b/6.12/package/boot/uboot-envtools/files/mediatek_filogic
new file mode 100644
index 00000000..6fea40f9
--- /dev/null
+++ b/6.12/package/boot/uboot-envtools/files/mediatek_filogic
@@ -0,0 +1,127 @@
+#
+# Copyright (C) 2021 OpenWrt.org
+#
+
+[ -e /etc/config/ubootenv ] && exit 0
+
+touch /etc/config/ubootenv
+
+. /lib/uboot-envtools.sh
+. /lib/functions.sh
+
+board=$(board_name)
+
+case "$board" in
+asus,rt-ax59u)
+	ubootenv_add_uci_config "/dev/mtd0" "0x100000" "0x20000" "0x20000"
+	;;
+bananapi,bpi-r3)
+	rootdev="$(cmdline_get_var root)"
+	rootdev="${rootdev##*/}"
+	rootdev="${rootdev%%p[0-9]*}"
+	case "$rootdev" in
+	mmc*)
+		local envdev=$(find_mmc_part "ubootenv" $rootdev)
+		ubootenv_add_uci_config "$envdev" "0x0" "0x40000" "0x40000" "1"
+		ubootenv_add_uci_config "$envdev" "0x40000" "0x40000" "0x40000" "1"
+		;;
+	mtd*)
+		local envdev=/dev/mtd$(find_mtd_index "u-boot-env")
+		ubootenv_add_uci_config "$envdev" "0x0" "0x20000" "0x20000" "1"
+		ubootenv_add_uci_config "$envdev" "0x20000" "0x20000" "0x20000" "1"
+		;;
+	ubi*)
+		. /lib/upgrade/nand.sh
+		local envubi=$(nand_find_ubi ubi)
+		local envdev=/dev/$(nand_find_volume $envubi ubootenv)
+		local envdev2=/dev/$(nand_find_volume $envubi ubootenv2)
+		ubootenv_add_uci_config "$envdev" "0x0" "0x1f000" "0x1f000" "1"
+		ubootenv_add_uci_config "$envdev2" "0x0" "0x1f000" "0x1f000" "1"
+		;;
+	esac
+	;;
+cmcc,rax3000m)
+	case "$(cmdline_get_var root)" in
+	/dev/mmc*)
+		local envdev=$(find_mmc_part "ubootenv" "mmcblk0")
+		ubootenv_add_uci_config "$envdev" "0x0" "0x40000" "0x40000" "1"
+		ubootenv_add_uci_config "$envdev" "0x40000" "0x40000" "0x40000" "1"
+		;;
+	*)
+		. /lib/upgrade/nand.sh
+		local envubi=$(nand_find_ubi ubi)
+		local envdev=/dev/$(nand_find_volume $envubi ubootenv)
+		local envdev2=/dev/$(nand_find_volume $envubi ubootenv2)
+		ubootenv_add_uci_config "$envdev" "0x0" "0x1f000" "0x1f000" "1"
+		ubootenv_add_uci_config "$envdev2" "0x0" "0x1f000" "0x1f000" "1"
+		;;
+	esac
+	;;
+cetron,ct3003|\
+netgear,wax220|\
+zbtlink,zbt-z8102ax|\
+z8102ax-128m|\
+z8102ax-64m|\
+zbtlink,zbt-z8103ax)
+	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x20000" "0x20000"
+	;;
+h3c,magic-nx30-pro|\
+jcg,q30-pro|\
+qihoo,360t7|\
+tplink,tl-xdr4288|\
+tplink,tl-xdr6086|\
+tplink,tl-xdr6088|\
+xiaomi,mi-router-ax3000t-ubootmod|\
+xiaomi,mi-router-wr30u-ubootmod|\
+xiaomi,redmi-router-ax6000-ubootmod)
+	. /lib/upgrade/nand.sh
+	local envubi=$(nand_find_ubi ubi)
+	local envdev=/dev/$(nand_find_volume $envubi ubootenv)
+	local envdev2=/dev/$(nand_find_volume $envubi ubootenv2)
+	ubootenv_add_uci_config "$envdev" "0x0" "0x1f000" "0x20000" "1"
+	ubootenv_add_uci_config "$envdev2" "0x0" "0x1f000" "0x20000" "1"
+	;;
+glinet,gl-mt2500|\
+glinet,gl-mt6000)
+	local envdev=$(find_mmc_part "u-boot-env")
+	ubootenv_add_uci_config "$envdev" "0x0" "0x80000"
+	;;
+glinet,gl-mt3000)
+	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x80000" "0x20000"
+	;;
+mercusys,mr90x-v1|\
+routerich,ax3000)
+	local envdev=/dev/mtd$(find_mtd_index "u-boot-env")
+	ubootenv_add_uci_config "$envdev" "0x0" "0x20000" "0x20000" "1"
+	;;
+ubnt,unifi-6-plus)
+	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x80000" "0x10000"
+	;;
+xiaomi,mi-router-ax3000t|\
+xiaomi,mi-router-wr30u-112m-nmbm|\
+xiaomi,mi-router-wr30u-stock|\
+xiaomi,redmi-router-ax6000-stock)
+	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x10000" "0x20000"
+	ubootenv_add_uci_sys_config "/dev/mtd2" "0x0" "0x10000" "0x20000"
+	;;
+zyxel,ex5601-t0)
+	local envdev=/dev/mtd$(find_mtd_index "u-boot-env")
+	ubootenv_add_uci_config "$envdev" "0x0" "0x20000" "0x40000" "2"
+	;;
+zyxel,ex5601-t0-ubootmod)
+        . /lib/upgrade/nand.sh
+        local envubi=$(nand_find_ubi ubi)
+        local envdev=/dev/$(nand_find_volume $envubi ubootenv)
+        local envdev2=/dev/$(nand_find_volume $envubi ubootenv2)
+        ubootenv_add_uci_config "$envdev" "0x0" "0x1f000" "0x20000" "1"
+        ubootenv_add_uci_config "$envdev2" "0x0" "0x1f000" "0x20000" "1"
+        ;;
+zyxel,ex5700-telenor)
+	ubootenv_add_uci_config "/dev/ubootenv" "0x0" "0x4000" "0x4000" "1"
+	;;
+esac
+
+config_load ubootenv
+config_foreach ubootenv_add_app_config
+
+exit 0
diff --git a/6.12/package/boot/uboot-mediatek/patches/900-add-z8102ax.patch b/6.12/package/boot/uboot-mediatek/patches/900-add-z8102ax.patch
new file mode 100644
index 00000000..00b90aad
--- /dev/null
+++ b/6.12/package/boot/uboot-mediatek/patches/900-add-z8102ax.patch
@@ -0,0 +1,1740 @@
+--- /dev/null	2023-07-22 18:52:45.112763009 +0200
++++ b/configs/mt7981b_zbtlink_zbt-z8102ax-128m_defconfig	2024-03-01 17:42:20.925929428 +0100
+@@ -0,0 +1,1737 @@
++#
++# Automatically generated file; DO NOT EDIT.
++# U-Boot 2023.07 Configuration
++#
++
++#
++#
++CONFIG_CREATE_ARCH_SYMLINK=y
++CONFIG_SYS_CACHE_SHIFT_6=y
++CONFIG_SYS_CACHELINE_SIZE=64
++CONFIG_LINKER_LIST_ALIGN=8
++# CONFIG_ARC is not set
++CONFIG_ARM=y
++# CONFIG_M68K is not set
++# CONFIG_MICROBLAZE is not set
++# CONFIG_MIPS is not set
++# CONFIG_NIOS2 is not set
++# CONFIG_PPC is not set
++# CONFIG_RISCV is not set
++# CONFIG_SANDBOX is not set
++# CONFIG_SH is not set
++# CONFIG_X86 is not set
++# CONFIG_XTENSA is not set
++CONFIG_SYS_ARCH="arm"
++CONFIG_SYS_CPU="armv8"
++CONFIG_SYS_SOC="mediatek"
++CONFIG_SYS_VENDOR="mediatek"
++CONFIG_SYS_BOARD="mt7981"
++CONFIG_SYS_CONFIG_NAME="mt7981"
++
++#
++# Skipping low level initialization functions
++#
++# CONFIG_SKIP_LOWLEVEL_INIT is not set
++# CONFIG_SKIP_LOWLEVEL_INIT_ONLY is not set
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
++CONFIG_SYS_NONCACHED_MEMORY=0x100000
++# CONFIG_SYS_ICACHE_OFF is not set
++# CONFIG_SYS_DCACHE_OFF is not set
++
++#
++# ARM architecture
++#
++CONFIG_ARM64=y
++CONFIG_ARM64_CRC32=y
++CONFIG_COUNTER_FREQUENCY=0
++CONFIG_POSITION_INDEPENDENT=y
++CONFIG_INIT_SP_RELATIVE=y
++CONFIG_SYS_INIT_SP_BSS_OFFSET=524288
++# CONFIG_GIC_V3_ITS is not set
++CONFIG_STATIC_RELA=y
++CONFIG_DMA_ADDR_T_64BIT=y
++CONFIG_GPIO_EXTRA_HEADER=y
++CONFIG_ARM_ASM_UNIFIED=y
++# CONFIG_SYS_ARM_CACHE_CP15 is not set
++# CONFIG_SYS_ARM_MMU is not set
++# CONFIG_SYS_ARM_MPU is not set
++CONFIG_SYS_ARM_ARCH=8
++CONFIG_SYS_ARM_CACHE_WRITEBACK=y
++# CONFIG_SYS_ARM_CACHE_WRITETHROUGH is not set
++# CONFIG_SYS_ARM_CACHE_WRITEALLOC is not set
++# CONFIG_ARCH_CPU_INIT is not set
++CONFIG_SYS_ARCH_TIMER=y
++CONFIG_ARM_SMCCC=y
++# CONFIG_SYS_L2_PL310 is not set
++# CONFIG_SPL_SYS_L2_PL310 is not set
++# CONFIG_SYS_L2CACHE_OFF is not set
++# CONFIG_ENABLE_ARM_SOC_BOOT0_HOOK is not set
++# CONFIG_USE_ARCH_MEMCPY is not set
++# CONFIG_USE_ARCH_MEMSET is not set
++CONFIG_ARM64_SUPPORT_AARCH32=y
++# CONFIG_ARCH_AT91 is not set
++# CONFIG_ARCH_DAVINCI is not set
++# CONFIG_ARCH_HISTB is not set
++# CONFIG_ARCH_KIRKWOOD is not set
++# CONFIG_ARCH_MVEBU is not set
++# CONFIG_ARCH_ORION5X is not set
++# CONFIG_TARGET_STV0991 is not set
++# CONFIG_ARCH_BCM283X is not set
++# CONFIG_ARCH_BCMSTB is not set
++# CONFIG_ARCH_BCMBCA is not set
++# CONFIG_TARGET_VEXPRESS_CA9X4 is not set
++# CONFIG_TARGET_BCMCYGNUS is not set
++# CONFIG_TARGET_BCMNS is not set
++# CONFIG_TARGET_BCMNS2 is not set
++# CONFIG_TARGET_BCMNS3 is not set
++# CONFIG_ARCH_EXYNOS is not set
++# CONFIG_ARCH_S5PC1XX is not set
++# CONFIG_ARCH_HIGHBANK is not set
++# CONFIG_ARCH_INTEGRATOR is not set
++# CONFIG_ARCH_IPQ40XX is not set
++# CONFIG_ARCH_KEYSTONE is not set
++# CONFIG_ARCH_K3 is not set
++# CONFIG_ARCH_OMAP2PLUS is not set
++# CONFIG_ARCH_MESON is not set
++CONFIG_ARCH_MEDIATEK=y
++# CONFIG_ARCH_LPC32XX is not set
++# CONFIG_ARCH_IMX8 is not set
++# CONFIG_ARCH_IMX8M is not set
++# CONFIG_ARCH_IMX8ULP is not set
++# CONFIG_ARCH_IMX9 is not set
++# CONFIG_ARCH_IMXRT is not set
++# CONFIG_ARCH_MX23 is not set
++# CONFIG_ARCH_MX28 is not set
++# CONFIG_ARCH_MX31 is not set
++# CONFIG_ARCH_MX7ULP is not set
++# CONFIG_ARCH_MX7 is not set
++# CONFIG_ARCH_MX6 is not set
++# CONFIG_ARCH_MX5 is not set
++# CONFIG_ARCH_NEXELL is not set
++# CONFIG_ARCH_NPCM is not set
++# CONFIG_ARCH_APPLE is not set
++# CONFIG_ARCH_OWL is not set
++# CONFIG_ARCH_QEMU is not set
++# CONFIG_ARCH_RMOBILE is not set
++# CONFIG_ARCH_SNAPDRAGON is not set
++# CONFIG_ARCH_SOCFPGA is not set
++# CONFIG_ARCH_SUNXI is not set
++# CONFIG_ARCH_U8500 is not set
++# CONFIG_ARCH_VERSAL is not set
++# CONFIG_ARCH_VERSAL_NET is not set
++# CONFIG_ARCH_VF610 is not set
++# CONFIG_ARCH_ZYNQ is not set
++# CONFIG_ARCH_ZYNQMP_R5 is not set
++# CONFIG_ARCH_ZYNQMP is not set
++# CONFIG_ARCH_TEGRA is not set
++# CONFIG_ARCH_VEXPRESS64 is not set
++# CONFIG_TARGET_CORSTONE1000 is not set
++# CONFIG_TARGET_TOTAL_COMPUTE is not set
++# CONFIG_TARGET_LS2080A_EMU is not set
++# CONFIG_TARGET_LS1088AQDS is not set
++# CONFIG_TARGET_LS2080AQDS is not set
++# CONFIG_TARGET_LS2080ARDB is not set
++# CONFIG_TARGET_LS2081ARDB is not set
++# CONFIG_TARGET_LX2160ARDB is not set
++# CONFIG_TARGET_LX2160AQDS is not set
++# CONFIG_TARGET_LX2162AQDS is not set
++# CONFIG_TARGET_HIKEY is not set
++# CONFIG_TARGET_HIKEY960 is not set
++# CONFIG_TARGET_POPLAR is not set
++# CONFIG_TARGET_LS1012AQDS is not set
++# CONFIG_TARGET_LS1012ARDB is not set
++# CONFIG_TARGET_LS1012A2G5RDB is not set
++# CONFIG_TARGET_LS1012AFRWY is not set
++# CONFIG_TARGET_LS1012AFRDM is not set
++# CONFIG_TARGET_LS1028AQDS is not set
++# CONFIG_TARGET_LS1028ARDB is not set
++# CONFIG_TARGET_LS1088ARDB is not set
++# CONFIG_TARGET_LS1021AQDS is not set
++# CONFIG_TARGET_LS1021ATWR is not set
++# CONFIG_TARGET_PG_WCOM_SELI8 is not set
++# CONFIG_TARGET_PG_WCOM_EXPU1 is not set
++# CONFIG_TARGET_LS1021ATSN is not set
++# CONFIG_TARGET_LS1021AIOT is not set
++# CONFIG_TARGET_LS1043AQDS is not set
++# CONFIG_TARGET_LS1043ARDB is not set
++# CONFIG_TARGET_LS1046AQDS is not set
++# CONFIG_TARGET_LS1046ARDB is not set
++# CONFIG_TARGET_LS1046AFRWY is not set
++# CONFIG_TARGET_SL28 is not set
++# CONFIG_TARGET_TEN64 is not set
++# CONFIG_ARCH_UNIPHIER is not set
++# CONFIG_ARCH_SYNQUACER is not set
++# CONFIG_ARCH_STM32 is not set
++# CONFIG_ARCH_STI is not set
++# CONFIG_ARCH_STM32MP is not set
++# CONFIG_ARCH_ROCKCHIP is not set
++# CONFIG_ARCH_OCTEONTX is not set
++# CONFIG_ARCH_OCTEONTX2 is not set
++# CONFIG_TARGET_THUNDERX_88XX is not set
++# CONFIG_ARCH_ASPEED is not set
++# CONFIG_TARGET_DURIAN is not set
++# CONFIG_TARGET_POMELO is not set
++# CONFIG_TARGET_PRESIDIO_ASIC is not set
++# CONFIG_TARGET_XENGUEST_ARM64 is not set
++# CONFIG_ARCH_GXP is not set
++# CONFIG_STATIC_MACH_TYPE is not set
++CONFIG_TEXT_BASE=0x41e00000
++CONFIG_SYS_MALLOC_LEN=0x400000
++CONFIG_SYS_MALLOC_F_LEN=0x4000
++CONFIG_NR_DRAM_BANKS=1
++CONFIG_ENV_SOURCE_FILE=""
++CONFIG_ENV_SIZE=0x80000
++CONFIG_ENV_OFFSET=0x300000
++CONFIG_DM_GPIO=y
++CONFIG_DEFAULT_DEVICE_TREE="mt7981-emmc-rfb"
++CONFIG_SYS_PROMPT="MT7981> "
++# CONFIG_OF_LIBFDT_OVERLAY is not set
++CONFIG_MULTI_DTB_FIT_UNCOMPRESS_SZ=0x8000
++CONFIG_DM_RESET=y
++CONFIG_SYS_MONITOR_LEN=0
++# CONFIG_MT8512 is not set
++# CONFIG_TARGET_MT7622 is not set
++# CONFIG_TARGET_MT7623 is not set
++# CONFIG_TARGET_MT7629 is not set
++CONFIG_TARGET_MT7981=y
++# CONFIG_TARGET_MT7986 is not set
++# CONFIG_TARGET_MT7988 is not set
++# CONFIG_TARGET_MT8183 is not set
++# CONFIG_TARGET_MT8512 is not set
++# CONFIG_TARGET_MT8516 is not set
++# CONFIG_TARGET_MT8518 is not set
++CONFIG_MTK_BROM_HEADER_INFO="media=snand;nandinfo=2k+64"
++CONFIG_ERR_PTR_OFFSET=0x0
++# CONFIG_SPL is not set
++CONFIG_BOOTSTAGE_STASH_ADDR=0
++CONFIG_DEBUG_UART_BASE=0x11002000
++CONFIG_DEBUG_UART_CLOCK=40000000
++# CONFIG_DEBUG_UART_BOARD_INIT is not set
++CONFIG_IDENT_STRING=""
++CONFIG_SYS_CLK_FREQ=0
++# CONFIG_CHIP_DIP_SCAN is not set
++# CONFIG_CMO_BY_VA_ONLY is not set
++# CONFIG_ARMV8_MULTIENTRY is not set
++# CONFIG_ARMV8_SET_SMPEN is not set
++# CONFIG_ARMV8_SWITCH_TO_EL1 is not set
++
++#
++# ARMv8 secure monitor firmware
++#
++# CONFIG_ARMV8_SEC_FIRMWARE_SUPPORT is not set
++CONFIG_PSCI_RESET=y
++# CONFIG_ARMV8_PSCI is not set
++# CONFIG_ARMV8_EA_EL3_FIRST is not set
++# CONFIG_ARMV8_CRYPTO is not set
++# CONFIG_CMD_DEKBLOB is not set
++# CONFIG_IMX_CAAM_DEK_ENCAP is not set
++# CONFIG_IMX_OPTEE_DEK_ENCAP is not set
++# CONFIG_IMX_SECO_DEK_ENCAP is not set
++# CONFIG_IMX_ELE_DEK_ENCAP is not set
++# CONFIG_CMD_HDMIDETECT is not set
++CONFIG_IMX_DCD_ADDR=0x00910000
++CONFIG_SYS_MEM_TOP_HIDE=0x0
++CONFIG_SYS_LOAD_ADDR=0x46000000
++
++#
++# ARM debug
++#
++CONFIG_BUILD_TARGET=""
++# CONFIG_SYS_PCI_64BIT is not set
++CONFIG_PCI=y
++CONFIG_FWU_NUM_BANKS=2
++CONFIG_FWU_NUM_IMAGES_PER_BANK=2
++CONFIG_DEBUG_UART=y
++# CONFIG_AHCI is not set
++# CONFIG_OF_BOARD_FIXUP is not set
++
++#
++# Functionality shared between NXP SoCs
++#
++# CONFIG_NXP_ESBC is not set
++
++#
++# MediaTek specific configurations
++#
++CONFIG_MEDIATEK_BOOTMENU=y
++CONFIG_MTK_BOOTMENU_DEFAULT=y
++# CONFIG_MTK_BOOTMENU_MTD is not set
++CONFIG_MTK_BOOTMENU_MMC=y
++CONFIG_MTK_BOOTMENU_MMC_DEV_INDEX=0
++CONFIG_MEDIATEK_BOOTMENU_COUNTDOWN=y
++CONFIG_MEDIATEK_BOOTMENU_DELAY=4
++# CONFIG_MTK_LOAD_FROM_SD is not set
++# CONFIG_MEDIATEK_LOAD_FROM_RAM is not set
++CONFIG_MTK_WEB_FAILSAFE=y
++CONFIG_MTK_WEB_FAILSAFE_AFTER_BOOT_FAILURE=y
++# CONFIG_MTK_UBI_SUPPORT is not set
++# CONFIG_MTK_SECURE_BOOT is not set
++CONFIG_MTK_DUAL_BOOT=y
++CONFIG_MTK_BOARDINFO=y
++CONFIG_MTK_FIP_SUPPORT=y
++CONFIG_MTK_UPGRADE_BL2_VERIFY=y
++CONFIG_MTK_UPGRADE_FIP_VERIFY=y
++CONFIG_MTK_UPGRADE_IMAGE_VERIFY=y
++# CONFIG_MTK_UPGRADE_IMAGE_ROOTFS_VERIFY is not set
++# CONFIG_ENABLE_NAND_NMBM is not set
++# CONFIG_MTK_MISC_CUSTOMIZED is not set
++
++#
++# General setup
++#
++CONFIG_LOCALVERSION=""
++CONFIG_LOCALVERSION_AUTO=y
++CONFIG_CC_IS_GCC=y
++CONFIG_GCC_VERSION=130201
++CONFIG_CLANG_VERSION=0
++CONFIG_CC_OPTIMIZE_FOR_SIZE=y
++# CONFIG_CC_OPTIMIZE_FOR_SPEED is not set
++# CONFIG_CC_OPTIMIZE_FOR_DEBUG is not set
++# CONFIG_OPTIMIZE_INLINING is not set
++CONFIG_ARCH_SUPPORTS_LTO=y
++# CONFIG_LTO is not set
++CONFIG_CC_HAS_ASM_INLINE=y
++# CONFIG_XEN is not set
++# CONFIG_ENV_VARS_UBOOT_CONFIG is not set
++# CONFIG_SYS_BOOT_GET_CMDLINE is not set
++# CONFIG_SYS_BOOT_GET_KBD is not set
++CONFIG_SYS_MALLOC_F=y
++# CONFIG_VALGRIND is not set
++CONFIG_EXPERT=y
++CONFIG_SYS_MALLOC_CLEAR_ON_INIT=y
++# CONFIG_SYS_MALLOC_DEFAULT_TO_INIT is not set
++# CONFIG_TOOLS_DEBUG is not set
++CONFIG_PHYS_64BIT=y
++CONFIG_FDT_64BIT=y
++# CONFIG_REMAKE_ELF is not set
++# CONFIG_HAS_BOARD_SIZE_LIMIT is not set
++# CONFIG_SYS_CUSTOM_LDSCRIPT is not set
++CONFIG_PLATFORM_ELFENTRY="_start"
++CONFIG_STACK_SIZE=0x1000000
++CONFIG_SYS_SRAM_BASE=0x0
++CONFIG_SYS_SRAM_SIZE=0x0
++# CONFIG_MP is not set
++# CONFIG_API is not set
++
++#
++# Boot options
++#
++
++#
++# Boot images
++#
++# CONFIG_ANDROID_BOOT_IMAGE is not set
++CONFIG_FIT=y
++# CONFIG_TIMESTAMP is not set
++# CONFIG_IMAGE_FORCED_VERIFY is not set
++CONFIG_FIT_EXTERNAL_OFFSET=0x0
++CONFIG_FIT_FULL_CHECK=y
++# CONFIG_FIT_SIGNATURE is not set
++# CONFIG_FIT_CIPHER is not set
++# CONFIG_FIT_VERBOSE is not set
++# CONFIG_FIT_BEST_MATCH is not set
++CONFIG_FIT_PRINT=y
++# CONFIG_SPL_LOAD_FIT_FULL is not set
++CONFIG_PXE_UTILS=y
++CONFIG_BOOTSTD=y
++# CONFIG_BOOTSTD_FULL is not set
++# CONFIG_BOOTSTD_DEFAULTS is not set
++CONFIG_BOOTSTD_BOOTCOMMAND=y
++CONFIG_BOOTMETH_GLOBAL=y
++CONFIG_BOOTMETH_EXTLINUX=y
++CONFIG_BOOTMETH_VBE=y
++CONFIG_BOOTMETH_VBE_REQUEST=y
++CONFIG_BOOTMETH_VBE_SIMPLE=y
++CONFIG_BOOTMETH_VBE_SIMPLE_OS=y
++# CONFIG_BOOTMETH_SCRIPT is not set
++CONFIG_LEGACY_IMAGE_FORMAT=y
++# CONFIG_SUPPORT_RAW_INITRD is not set
++# CONFIG_OF_BOARD_SETUP is not set
++# CONFIG_OF_SYSTEM_SETUP is not set
++# CONFIG_OF_STDOUT_VIA_ALIAS is not set
++CONFIG_HAVE_TEXT_BASE=y
++# CONFIG_DYNAMIC_SYS_CLK_FREQ is not set
++CONFIG_ARCH_FIXUP_FDT_MEMORY=y
++# CONFIG_CHROMEOS is not set
++# CONFIG_CHROMEOS_VBOOT is not set
++# CONFIG_RAMBOOT_PBL is not set
++CONFIG_SYS_BOOT_RAMDISK_HIGH=y
++# CONFIG_DISTRO_DEFAULTS is not set
++
++#
++# Boot timing
++#
++# CONFIG_BOOTSTAGE is not set
++CONFIG_BOOTSTAGE_STASH_SIZE=0x1000
++# CONFIG_SHOW_BOOT_PROGRESS is not set
++
++#
++# Boot media
++#
++# CONFIG_NAND_BOOT is not set
++# CONFIG_ONENAND_BOOT is not set
++# CONFIG_QSPI_BOOT is not set
++# CONFIG_SATA_BOOT is not set
++# CONFIG_SD_BOOT is not set
++# CONFIG_SD_BOOT_QSPI is not set
++# CONFIG_SPI_BOOT is not set
++
++#
++# Autoboot options
++#
++CONFIG_AUTOBOOT=y
++CONFIG_BOOTDELAY=2
++# CONFIG_AUTOBOOT_KEYED is not set
++# CONFIG_AUTOBOOT_USE_MENUKEY is not set
++CONFIG_AUTOBOOT_MENU_SHOW=y
++CONFIG_AUTOBOOT_MENU_MTK_SHOW=y
++# CONFIG_BOOTMENU_DISABLE_UBOOT_CONSOLE is not set
++# CONFIG_BOOT_RETRY is not set
++
++#
++# Image support
++#
++# CONFIG_IMAGE_PRE_LOAD is not set
++# CONFIG_USE_BOOTARGS is not set
++# CONFIG_BOOTARGS_SUBST is not set
++# CONFIG_USE_BOOTCOMMAND is not set
++# CONFIG_USE_PREBOOT is not set
++CONFIG_DEFAULT_FDT_FILE="mt7981-emmc-rfb"
++# CONFIG_SAVE_PREV_BL_FDT_ADDR is not set
++# CONFIG_SAVE_PREV_BL_INITRAMFS_START_ADDR is not set
++
++#
++# Configuration editor
++#
++# CONFIG_CEDIT is not set
++
++#
++# Console
++#
++CONFIG_MENU=y
++# CONFIG_CONSOLE_RECORD is not set
++# CONFIG_DISABLE_CONSOLE is not set
++CONFIG_LOGLEVEL=7
++# CONFIG_SILENT_CONSOLE is not set
++# CONFIG_SPL_SILENT_CONSOLE is not set
++# CONFIG_TPL_SILENT_CONSOLE is not set
++# CONFIG_PRE_CONSOLE_BUFFER is not set
++CONFIG_CONSOLE_FLUSH_SUPPORT=y
++# CONFIG_CONSOLE_MUX is not set
++# CONFIG_SYS_CONSOLE_IS_IN_ENV is not set
++# CONFIG_SYS_CONSOLE_OVERWRITE_ROUTINE is not set
++# CONFIG_SYS_CONSOLE_INFO_QUIET is not set
++# CONFIG_SYS_STDIO_DEREGISTER is not set
++# CONFIG_SPL_SYS_STDIO_DEREGISTER is not set
++# CONFIG_SYS_DEVICE_NULLDEV is not set
++
++#
++# Logging
++#
++CONFIG_LOG=y
++CONFIG_LOG_MAX_LEVEL=6
++CONFIG_LOG_DEFAULT_LEVEL=6
++CONFIG_LOG_CONSOLE=y
++# CONFIG_LOGF_FILE is not set
++# CONFIG_LOGF_LINE is not set
++# CONFIG_LOGF_FUNC is not set
++CONFIG_LOGF_FUNC_PAD=20
++# CONFIG_LOG_SYSLOG is not set
++# CONFIG_LOG_ERROR_RETURN is not set
++
++#
++# Init options
++#
++# CONFIG_BOARD_TYPES is not set
++CONFIG_DISPLAY_CPUINFO=y
++CONFIG_DISPLAY_BOARDINFO=y
++# CONFIG_DISPLAY_BOARDINFO_LATE is not set
++
++#
++# Start-up hooks
++#
++# CONFIG_CYCLIC is not set
++CONFIG_EVENT=y
++# CONFIG_EVENT_DEBUG is not set
++# CONFIG_ARCH_MISC_INIT is not set
++# CONFIG_BOARD_EARLY_INIT_F is not set
++# CONFIG_BOARD_EARLY_INIT_R is not set
++# CONFIG_BOARD_POSTCLK_INIT is not set
++# CONFIG_BOARD_LATE_INIT is not set
++# CONFIG_CLOCKS is not set
++# CONFIG_HWCONFIG is not set
++# CONFIG_LAST_STAGE_INIT is not set
++# CONFIG_MISC_INIT_R is not set
++# CONFIG_SYS_MALLOC_BOOTPARAMS is not set
++# CONFIG_ID_EEPROM is not set
++# CONFIG_PCI_INIT_R is not set
++# CONFIG_RESET_PHY_R is not set
++
++#
++# Security support
++#
++CONFIG_HASH=y
++# CONFIG_STACKPROTECTOR is not set
++# CONFIG_BOARD_RNG_SEED is not set
++
++#
++# Update support
++#
++# CONFIG_UPDATE_TFTP is not set
++# CONFIG_ANDROID_AB is not set
++
++#
++# Blob list
++#
++# CONFIG_BLOBLIST is not set
++CONFIG_SUPPORT_SPL=y
++# CONFIG_VPL is not set
++# CONFIG_FDT_SIMPLEFB is not set
++# CONFIG_FDT_NO_BOOTARGS_OVERRIDE is not set
++# CONFIG_BMP is not set
++CONFIG_POLLER=y
++
++#
++# Command line interface
++#
++CONFIG_CMDLINE=y
++CONFIG_HUSH_PARSER=y
++CONFIG_CMDLINE_EDITING=y
++# CONFIG_CMDLINE_PS_SUPPORT is not set
++CONFIG_AUTO_COMPLETE=y
++CONFIG_SYS_LONGHELP=y
++CONFIG_SYS_PROMPT_HUSH_PS2="> "
++CONFIG_SYS_MAXARGS=16
++CONFIG_SYS_CBSIZE=512
++CONFIG_SYS_PBSIZE=1049
++CONFIG_SYS_XTRACE=y
++
++#
++# Commands
++#
++
++#
++# Info commands
++#
++CONFIG_CMD_BDI=y
++# CONFIG_CMD_BDINFO_EXTRA is not set
++# CONFIG_CMD_CONFIG is not set
++CONFIG_CMD_CONSOLE=y
++# CONFIG_CMD_CPU is not set
++# CONFIG_CMD_LICENSE is not set
++# CONFIG_CMD_PMC is not set
++
++#
++# Boot commands
++#
++CONFIG_CMD_BOOTD=y
++CONFIG_CMD_BOOTM=y
++# CONFIG_CMD_BOOTDEV is not set
++CONFIG_CMD_BOOTFLOW=y
++# CONFIG_CMD_BOOTMETH is not set
++# CONFIG_CMD_BOOTZ is not set
++CONFIG_CMD_BOOTI=y
++CONFIG_BOOTM_LINUX=y
++# CONFIG_BOOTM_NETBSD is not set
++# CONFIG_BOOTM_OPENRTOS is not set
++# CONFIG_BOOTM_OSE is not set
++# CONFIG_BOOTM_PLAN9 is not set
++# CONFIG_BOOTM_RTEMS is not set
++# CONFIG_CMD_VBE is not set
++# CONFIG_BOOTM_VXWORKS is not set
++CONFIG_SYS_BOOTM_LEN=0x4000000
++CONFIG_CMD_BOOTMENU=y
++# CONFIG_CMD_ADTIMG is not set
++# CONFIG_CMD_ELF is not set
++CONFIG_CMD_FDT=y
++CONFIG_CMD_GO=y
++CONFIG_CMD_RUN=y
++CONFIG_CMD_IMI=y
++# CONFIG_CMD_IMLS is not set
++CONFIG_CMD_XIMG=y
++# CONFIG_CMD_XXD is not set
++# CONFIG_CMD_THOR_DOWNLOAD is not set
++# CONFIG_CMD_ZBOOT is not set
++
++#
++# Environment commands
++#
++# CONFIG_CMD_ASKENV is not set
++CONFIG_CMD_EXPORTENV=y
++CONFIG_CMD_IMPORTENV=y
++CONFIG_CMD_EDITENV=y
++# CONFIG_CMD_GREPENV is not set
++CONFIG_CMD_SAVEENV=y
++# CONFIG_CMD_ERASEENV is not set
++CONFIG_CMD_ENV_EXISTS=y
++# CONFIG_CMD_ENV_CALLBACK is not set
++# CONFIG_CMD_ENV_FLAGS is not set
++# CONFIG_CMD_NVEDIT_INDIRECT is not set
++# CONFIG_CMD_NVEDIT_INFO is not set
++# CONFIG_CMD_NVEDIT_LOAD is not set
++# CONFIG_CMD_NVEDIT_SELECT is not set
++
++#
++# Memory commands
++#
++# CONFIG_CMD_BINOP is not set
++# CONFIG_CMD_BLOBLIST is not set
++CONFIG_CMD_CRC32=y
++# CONFIG_CRC32_VERIFY is not set
++# CONFIG_CMD_EEPROM is not set
++# CONFIG_LOOPW is not set
++# CONFIG_CMD_MD5SUM is not set
++CONFIG_CMD_MEMINFO=y
++CONFIG_CMD_MEMORY=y
++# CONFIG_CMD_MEM_SEARCH is not set
++# CONFIG_CMD_MX_CYCLIC is not set
++CONFIG_CMD_RANDOM=y
++# CONFIG_CMD_MEMTEST is not set
++# CONFIG_CMD_SHA1SUM is not set
++# CONFIG_CMD_STRINGS is not set
++
++#
++# Compression commands
++#
++CONFIG_CMD_LZMADEC=y
++# CONFIG_CMD_UNLZ4 is not set
++# CONFIG_CMD_UNZIP is not set
++# CONFIG_CMD_ZIP is not set
++
++#
++# Device access commands
++#
++# CONFIG_CMD_ARMFLASH is not set
++# CONFIG_CMD_ADC is not set
++# CONFIG_CMD_BCB is not set
++# CONFIG_CMD_BIND is not set
++# CONFIG_CMD_CLK is not set
++# CONFIG_CMD_DEMO is not set
++# CONFIG_CMD_DFU is not set
++# CONFIG_CMD_DM is not set
++# CONFIG_CMD_FPGAD is not set
++# CONFIG_CMD_FUSE is not set
++CONFIG_CMD_GPIO=y
++CONFIG_CMD_GPIO_READ=y
++CONFIG_CMD_PWM=y
++CONFIG_CMD_GPT=y
++CONFIG_RANDOM_UUID=y
++CONFIG_CMD_GPT_RENAME=y
++# CONFIG_CMD_IDE is not set
++# CONFIG_CMD_IO is not set
++# CONFIG_CMD_IOTRACE is not set
++# CONFIG_CMD_I2C is not set
++CONFIG_CMD_LOADB=y
++# CONFIG_CMD_LOADM is not set
++CONFIG_CMD_LOADS=y
++# CONFIG_LOADS_ECHO is not set
++# CONFIG_CMD_SAVES is not set
++# CONFIG_SYS_LOADS_BAUD_CHANGE is not set
++CONFIG_CMD_LOADXY_TIMEOUT=90
++CONFIG_CMD_LSBLK=y
++# CONFIG_CMD_MBR is not set
++CONFIG_CMD_MMC=y
++# CONFIG_CMD_BKOPS_ENABLE is not set
++# CONFIG_CMD_MMC_SWRITE is not set
++# CONFIG_CMD_CLONE is not set
++# CONFIG_CMD_NAND_EXT is not set
++# CONFIG_CMD_OSD is not set
++CONFIG_CMD_PART=y
++CONFIG_CMD_PCI=y
++# CONFIG_CMD_PCI_MPS is not set
++CONFIG_CMD_PINMUX=y
++# CONFIG_CMD_POWEROFF is not set
++CONFIG_CMD_READ=y
++# CONFIG_CMD_SATA is not set
++# CONFIG_CMD_SDRAM is not set
++# CONFIG_CMD_TSI148 is not set
++# CONFIG_CMD_UNIVERSE is not set
++# CONFIG_CMD_USB_SDP is not set
++# CONFIG_CMD_WRITE is not set
++
++#
++# Shell scripting commands
++#
++# CONFIG_CMD_CAT is not set
++CONFIG_CMD_ECHO=y
++CONFIG_CMD_ITEST=y
++CONFIG_CMD_SOURCE=y
++CONFIG_CMD_SETEXPR=y
++# CONFIG_CMD_SETEXPR_FMT is not set
++
++#
++# Android support commands
++#
++CONFIG_CMD_NET=y
++CONFIG_CMD_BOOTP=y
++# CONFIG_CMD_DHCP is not set
++# CONFIG_BOOTP_MAY_FAIL is not set
++CONFIG_BOOTP_BOOTPATH=y
++# CONFIG_BOOTP_VENDOREX is not set
++# CONFIG_BOOTP_BOOTFILESIZE is not set
++CONFIG_BOOTP_DNS=y
++# CONFIG_BOOTP_DNS2 is not set
++CONFIG_BOOTP_GATEWAY=y
++CONFIG_BOOTP_HOSTNAME=y
++# CONFIG_BOOTP_PREFER_SERVERIP is not set
++CONFIG_BOOTP_SUBNETMASK=y
++# CONFIG_BOOTP_NISDOMAIN is not set
++# CONFIG_BOOTP_NTPSERVER is not set
++# CONFIG_CMD_PCAP is not set
++CONFIG_BOOTP_VCI_STRING="U-Boot.armv8"
++CONFIG_CMD_TFTPBOOT=y
++CONFIG_CMD_TFTPPUT=y
++# CONFIG_CMD_TFTPSRV is not set
++CONFIG_NET_TFTP_VARS=y
++# CONFIG_CMD_RARP is not set
++# CONFIG_CMD_NFS is not set
++# CONFIG_SYS_DISABLE_AUTOLOAD is not set
++# CONFIG_CMD_WGET is not set
++# CONFIG_CMD_MII is not set
++# CONFIG_CMD_MDIO is not set
++CONFIG_CMD_PING=y
++# CONFIG_CMD_CDP is not set
++# CONFIG_CMD_SNTP is not set
++# CONFIG_CMD_DNS is not set
++# CONFIG_CMD_LINK_LOCAL is not set
++# CONFIG_CMD_ETHSW is not set
++# CONFIG_CMD_PXE is not set
++# CONFIG_CMD_WOL is not set
++
++#
++# Misc commands
++#
++# CONFIG_CMD_2048 is not set
++# CONFIG_CMD_BSP is not set
++CONFIG_CMD_BLOCK_CACHE=y
++CONFIG_CMD_BUTTON=y
++# CONFIG_CMD_CACHE is not set
++# CONFIG_CMD_CONITRACE is not set
++# CONFIG_CMD_CLS is not set
++# CONFIG_CMD_EXCEPTION is not set
++# CONFIG_CMD_INI is not set
++# CONFIG_CMD_DATE is not set
++# CONFIG_CMD_TIME is not set
++# CONFIG_CMD_GETTIME is not set
++# CONFIG_CMD_PAUSE is not set
++CONFIG_CMD_SLEEP=y
++# CONFIG_CMD_TIMER is not set
++# CONFIG_CMD_SYSBOOT is not set
++# CONFIG_CMD_QFW is not set
++# CONFIG_CMD_PSTORE is not set
++# CONFIG_CMD_TERMINAL is not set
++# CONFIG_CMD_UUID is not set
++
++#
++# TI specific command line interface
++#
++# CONFIG_CMD_DDR3 is not set
++
++#
++# Power commands
++#
++# CONFIG_CMD_REGULATOR is not set
++
++#
++# Security commands
++#
++# CONFIG_CMD_AES is not set
++# CONFIG_CMD_BLOB is not set
++# CONFIG_CMD_HASH is not set
++# CONFIG_CMD_HVC is not set
++CONFIG_CMD_SMC=y
++
++#
++# Firmware commands
++#
++
++#
++# Filesystem commands
++#
++# CONFIG_CMD_BTRFS is not set
++# CONFIG_CMD_EROFS is not set
++# CONFIG_CMD_EXT2 is not set
++# CONFIG_CMD_EXT4 is not set
++CONFIG_CMD_FAT=y
++# CONFIG_CMD_SQUASHFS is not set
++CONFIG_CMD_FS_GENERIC=y
++# CONFIG_CMD_FS_UUID is not set
++# CONFIG_CMD_JFFS2 is not set
++# CONFIG_CMD_REISER is not set
++# CONFIG_CMD_ZFS is not set
++
++#
++# Debug commands
++#
++# CONFIG_CMD_DIAG is not set
++# CONFIG_CMD_EVENT is not set
++# CONFIG_CMD_LOG is not set
++# CONFIG_CMD_UBI is not set
++# CONFIG_MMC_SPEED_MODE_SET is not set
++CONFIG_CMD_GL_BTN=y
++# CONFIG_CMD_SHOW_MTD_LAYOUT is not set
++
++#
++# Partition Types
++#
++CONFIG_PARTITIONS=y
++# CONFIG_MAC_PARTITION is not set
++CONFIG_DOS_PARTITION=y
++# CONFIG_ISO_PARTITION is not set
++# CONFIG_AMIGA_PARTITION is not set
++CONFIG_EFI_PARTITION=y
++CONFIG_EFI_PARTITION_ENTRIES_NUMBERS=128
++CONFIG_EFI_PARTITION_ENTRIES_OFF=0
++CONFIG_PARTITION_UUIDS=y
++CONFIG_PARTITION_TYPE_GUID=y
++CONFIG_SUPPORT_OF_CONTROL=y
++
++#
++# Device Tree Control
++#
++CONFIG_OF_CONTROL=y
++CONFIG_OF_REAL=y
++# CONFIG_OF_LIVE is not set
++CONFIG_OF_SEPARATE=y
++# CONFIG_OF_EMBED is not set
++# CONFIG_OF_BOARD is not set
++# CONFIG_OF_OMIT_DTB is not set
++CONFIG_DEVICE_TREE_INCLUDES=""
++CONFIG_OF_LIST="mt7981-emmc-rfb"
++# CONFIG_MULTI_DTB_FIT is not set
++CONFIG_OF_TAG_MIGRATE=y
++# CONFIG_OF_DTB_PROPS_REMOVE is not set
++
++#
++# Environment
++#
++CONFIG_ENV_SUPPORT=y
++CONFIG_SAVEENV=y
++CONFIG_ENV_OVERWRITE=y
++CONFIG_ENV_MIN_ENTRIES=64
++CONFIG_ENV_MAX_ENTRIES=512
++# CONFIG_ENV_IS_NOWHERE is not set
++# CONFIG_ENV_IS_IN_EEPROM is not set
++# CONFIG_ENV_IS_IN_FAT is not set
++# CONFIG_ENV_IS_IN_EXT4 is not set
++# CONFIG_ENV_IS_IN_FLASH is not set
++CONFIG_ENV_IS_IN_MMC=y
++# CONFIG_ENV_IS_IN_NAND is not set
++# CONFIG_ENV_IS_IN_NVRAM is not set
++# CONFIG_ENV_IS_IN_ONENAND is not set
++# CONFIG_ENV_IS_IN_REMOTE is not set
++# CONFIG_SYS_REDUNDAND_ENVIRONMENT is not set
++# CONFIG_SYS_RELOC_GD_ENV_ADDR is not set
++CONFIG_SYS_MMC_ENV_DEV=0
++CONFIG_SYS_MMC_ENV_PART=0
++# CONFIG_USE_ENV_MMC_PARTITION is not set
++# CONFIG_ENV_MMC_USE_DT is not set
++# CONFIG_USE_DEFAULT_ENV_FILE is not set
++CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
++# CONFIG_ENV_IMPORT_FDT is not set
++# CONFIG_ENV_APPEND is not set
++# CONFIG_ENV_WRITEABLE_LIST is not set
++# CONFIG_ENV_ACCESS_IGNORE_FORCE is not set
++# CONFIG_USE_BOOTFILE is not set
++# CONFIG_USE_ENTERPRISEAUTHORIZATION is not set
++# CONFIG_USE_ETHPRIME is not set
++# CONFIG_USE_HOSTNAME is not set
++# CONFIG_VERSION_VARIABLE is not set
++CONFIG_NET=y
++CONFIG_ARP_TIMEOUT=5000
++CONFIG_NET_RETRY_COUNT=5
++# CONFIG_PROT_UDP is not set
++CONFIG_BOOTDEV_ETH=y
++# CONFIG_BOOTP_SEND_HOSTNAME is not set
++CONFIG_NET_RANDOM_ETHADDR=y
++# CONFIG_NETCONSOLE is not set
++# CONFIG_IP_DEFRAG is not set
++# CONFIG_SYS_FAULT_ECHO_LINK_DOWN is not set
++CONFIG_TFTP_BLOCKSIZE=1468
++# CONFIG_TFTP_PORT is not set
++CONFIG_TFTP_WINDOWSIZE=1
++# CONFIG_TFTP_TSIZE is not set
++# CONFIG_SERVERIP_FROM_PROXYDHCP is not set
++CONFIG_SERVERIP_FROM_PROXYDHCP_DELAY_MS=100
++# CONFIG_KEEP_SERVERADDR is not set
++# CONFIG_UDP_CHECKSUM is not set
++# CONFIG_BOOTP_SERVERIP is not set
++CONFIG_BOOTP_MAX_ROOT_PATH_LEN=64
++# CONFIG_USE_GATEWAYIP is not set
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_NETMASK=y
++CONFIG_NETMASK="255.255.255.0"
++# CONFIG_USE_ROOTPATH is not set
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.2"
++CONFIG_PROT_TCP=y
++# CONFIG_PROT_TCP_SACK is not set
++# CONFIG_IPV6 is not set
++CONFIG_MTK_TCP=y
++CONFIG_MTK_HTTPD=y
++# CONFIG_NET_FORCE_IPADDR is not set
++CONFIG_SYS_RX_ETH_BUFFER=4
++
++#
++# Device Drivers
++#
++
++#
++# Generic Driver Options
++#
++CONFIG_DM=y
++CONFIG_DM_WARN=y
++# CONFIG_DM_DEBUG is not set
++# CONFIG_DM_STATS is not set
++CONFIG_DM_DEVICE_REMOVE=y
++CONFIG_DM_STDIO=y
++CONFIG_DM_SEQ_ALIAS=y
++# CONFIG_DM_DMA is not set
++CONFIG_REGMAP=y
++CONFIG_SYSCON=y
++# CONFIG_DEVRES is not set
++CONFIG_SIMPLE_BUS=y
++# CONFIG_SIMPLE_BUS_CORRECT_RANGE is not set
++# CONFIG_SIMPLE_PM_BUS is not set
++CONFIG_OF_TRANSLATE=y
++# CONFIG_TRANSLATION_OFFSET is not set
++CONFIG_DM_DEV_READ_INLINE=y
++# CONFIG_OFNODE_MULTI_TREE is not set
++# CONFIG_BOUNCE_BUFFER is not set
++# CONFIG_ADC is not set
++# CONFIG_ADC_EXYNOS is not set
++# CONFIG_ADC_SANDBOX is not set
++# CONFIG_SARADC_MESON is not set
++# CONFIG_SARADC_ROCKCHIP is not set
++# CONFIG_ADC_IMX93 is not set
++# CONFIG_SATA is not set
++# CONFIG_SCSI_AHCI is not set
++
++#
++# SATA/SCSI device support
++#
++# CONFIG_AXI is not set
++
++#
++# Bus devices
++#
++CONFIG_BLK=y
++CONFIG_BLOCK_CACHE=y
++# CONFIG_BLKMAP is not set
++# CONFIG_EFI_MEDIA is not set
++# CONFIG_IDE is not set
++# CONFIG_LBA48 is not set
++# CONFIG_SYS_64BIT_LBA is not set
++# CONFIG_BOOTCOUNT_LIMIT is not set
++
++#
++# Button Support
++#
++CONFIG_BUTTON=y
++# CONFIG_BUTTON_ADC is not set
++CONFIG_BUTTON_GPIO=y
++
++#
++# Cache Controller drivers
++#
++# CONFIG_CACHE is not set
++# CONFIG_L2X0_CACHE is not set
++# CONFIG_V5L2_CACHE is not set
++# CONFIG_NCORE_CACHE is not set
++# CONFIG_SIFIVE_CCACHE is not set
++
++#
++# Clock
++#
++CONFIG_CLK=y
++# CONFIG_CLK_CCF is not set
++# CONFIG_CLK_CDCE9XX is not set
++# CONFIG_CLK_ICS8N3QV01 is not set
++# CONFIG_CLK_K210 is not set
++# CONFIG_CLK_MPC83XX is not set
++# CONFIG_CLK_XLNX_CLKWZRD is not set
++# CONFIG_CLK_AT91 is not set
++# CONFIG_CLK_RCAR is not set
++# CONFIG_CLK_RCAR_CPG_LIB is not set
++# CONFIG_CLK_SIFIVE is not set
++# CONFIG_CLK_TI_AM3_DPLL is not set
++# CONFIG_CLK_TI_CTRL is not set
++# CONFIG_CLK_TI_GATE is not set
++# CONFIG_CLK_K3 is not set
++CONFIG_CPU=y
++# CONFIG_CPU_IMX is not set
++
++#
++# Hardware crypto devices
++#
++# CONFIG_DM_HASH is not set
++# CONFIG_FSL_CAAM is not set
++CONFIG_CAAM_64BIT=y
++# CONFIG_SYS_FSL_SEC_BE is not set
++# CONFIG_SYS_FSL_SEC_LE is not set
++# CONFIG_NPCM_AES is not set
++# CONFIG_NPCM_SHA is not set
++# CONFIG_DDR_SPD is not set
++# CONFIG_IMX_SNPS_DDR_PHY is not set
++
++#
++# Demo for driver model
++#
++# CONFIG_DM_DEMO is not set
++
++#
++# DFU support
++#
++
++#
++# DMA Support
++#
++# CONFIG_DMA is not set
++# CONFIG_DMA_LPC32XX is not set
++# CONFIG_TI_EDMA3 is not set
++# CONFIG_DMA_LEGACY is not set
++
++#
++# Extcon Support
++#
++# CONFIG_EXTCON is not set
++
++#
++# Fastboot support
++#
++# CONFIG_UDP_FUNCTION_FASTBOOT is not set
++# CONFIG_TCP_FUNCTION_FASTBOOT is not set
++CONFIG_FIRMWARE=y
++CONFIG_ARM_PSCI_FW=y
++# CONFIG_ZYNQMP_FIRMWARE is not set
++# CONFIG_ARM_SMCCC_FEATURES is not set
++# CONFIG_SCMI_FIRMWARE is not set
++# CONFIG_DM_FUZZING_ENGINE is not set
++
++#
++# FPGA support
++#
++# CONFIG_FPGA_ALTERA is not set
++# CONFIG_FPGA_SOCFPGA is not set
++# CONFIG_FPGA_LATTICE is not set
++# CONFIG_FPGA_XILINX is not set
++# CONFIG_DM_FPGA is not set
++# CONFIG_FWU_MDATA is not set
++CONFIG_GPIO=y
++# CONFIG_GPIO_HOG is not set
++# CONFIG_DM_GPIO_LOOKUP_LABEL is not set
++# CONFIG_ALTERA_PIO is not set
++# CONFIG_BCM2835_GPIO is not set
++# CONFIG_DWAPB_GPIO is not set
++# CONFIG_AT91_GPIO is not set
++# CONFIG_ATMEL_PIO4 is not set
++# CONFIG_ASPEED_GPIO is not set
++# CONFIG_DA8XX_GPIO is not set
++# CONFIG_FXL6408_GPIO is not set
++# CONFIG_HIKEY_GPIO is not set
++# CONFIG_INTEL_BROADWELL_GPIO is not set
++# CONFIG_INTEL_GPIO is not set
++# CONFIG_INTEL_ICH6_GPIO is not set
++# CONFIG_IMX_RGPIO2P is not set
++# CONFIG_IPROC_GPIO is not set
++# CONFIG_HSDK_CREG_GPIO is not set
++# CONFIG_KIRKWOOD_GPIO is not set
++# CONFIG_LPC32XX_GPIO is not set
++# CONFIG_MAX7320_GPIO is not set
++# CONFIG_MCP230XX_GPIO is not set
++# CONFIG_MSM_GPIO is not set
++# CONFIG_MXC_GPIO is not set
++# CONFIG_MXS_GPIO is not set
++# CONFIG_NPCM_GPIO is not set
++# CONFIG_CMD_PCA953X is not set
++# CONFIG_PCF8575_GPIO is not set
++# CONFIG_ROCKCHIP_GPIO is not set
++# CONFIG_XILINX_GPIO is not set
++# CONFIG_TCA642X is not set
++# CONFIG_TEGRA_GPIO is not set
++# CONFIG_TEGRA186_GPIO is not set
++# CONFIG_VYBRID_GPIO is not set
++# CONFIG_SIFIVE_GPIO is not set
++# CONFIG_ZYNQ_GPIO is not set
++# CONFIG_DM_74X164 is not set
++# CONFIG_DM_PCA953X is not set
++# CONFIG_PCA953X is not set
++# CONFIG_MPC8XXX_GPIO is not set
++# CONFIG_MPC8XX_GPIO is not set
++# CONFIG_NX_GPIO is not set
++# CONFIG_NOMADIK_GPIO is not set
++# CONFIG_ZYNQMP_GPIO_MODEPIN is not set
++# CONFIG_SLG7XL45106_I2C_GPO is not set
++# CONFIG_TURRIS_OMNIA_MCU is not set
++# CONFIG_FTGPIO010 is not set
++# CONFIG_ADP5585_GPIO is not set
++
++#
++# Hardware Spinlock Support
++#
++# CONFIG_DM_HWSPINLOCK is not set
++CONFIG_I2C=y
++CONFIG_DM_I2C=y
++# CONFIG_SPL_SYS_I2C_LEGACY is not set
++# CONFIG_I2C_SET_DEFAULT_BUS_NUM is not set
++# CONFIG_DM_I2C_GPIO is not set
++# CONFIG_SYS_I2C_IPROC is not set
++# CONFIG_SYS_I2C_FSL is not set
++# CONFIG_SYS_I2C_CADENCE is not set
++# CONFIG_SYS_I2C_DW is not set
++# CONFIG_SYS_I2C_INTEL is not set
++# CONFIG_SYS_I2C_IMX_LPI2C is not set
++CONFIG_SYS_I2C_MTK=y
++# CONFIG_SYS_I2C_MICROCHIP is not set
++# CONFIG_SYS_I2C_MXC is not set
++# CONFIG_SYS_I2C_NEXELL is not set
++# CONFIG_SYS_I2C_NPCM is not set
++# CONFIG_SYS_I2C_OCORES is not set
++# CONFIG_SYS_I2C_ROCKCHIP is not set
++# CONFIG_SYS_I2C_SOFT is not set
++# CONFIG_SYS_I2C_MV is not set
++# CONFIG_SYS_I2C_MVTWSI is not set
++# CONFIG_SYS_I2C_XILINX_XIIC is not set
++# CONFIG_SYS_I2C_IHS is not set
++# CONFIG_I2C_MUX is not set
++CONFIG_INPUT=y
++# CONFIG_DM_KEYBOARD is not set
++# CONFIG_CROS_EC_KEYB is not set
++# CONFIG_TEGRA_KEYBOARD is not set
++# CONFIG_TWL4030_INPUT is not set
++
++#
++# IOMMU device drivers
++#
++# CONFIG_IOMMU is not set
++
++#
++# LED Support
++#
++# CONFIG_LED is not set
++# CONFIG_LED_STATUS is not set
++
++#
++# Mailbox Controller Support
++#
++# CONFIG_DM_MAILBOX is not set
++
++#
++# Memory Controller drivers
++#
++# CONFIG_MEMORY is not set
++# CONFIG_ATMEL_EBI is not set
++# CONFIG_MFD_ATMEL_SMC is not set
++
++#
++# Multifunction device drivers
++#
++# CONFIG_MISC is not set
++# CONFIG_NVMEM is not set
++# CONFIG_SPL_NVMEM is not set
++# CONFIG_SMSC_LPC47M is not set
++# CONFIG_SMSC_SIO1007 is not set
++# CONFIG_CROS_EC is not set
++# CONFIG_DS4510 is not set
++# CONFIG_FSL_SEC_MON is not set
++# CONFIG_IRQ is not set
++# CONFIG_NPCM_HOST is not set
++# CONFIG_NUVOTON_NCT6102D is not set
++# CONFIG_PWRSEQ is not set
++# CONFIG_PCA9551_LED is not set
++# CONFIG_TEST_DRV is not set
++# CONFIG_USB_HUB_USB251XB is not set
++# CONFIG_TWL4030_LED is not set
++# CONFIG_WINBOND_W83627 is not set
++# CONFIG_FS_LOADER is not set
++# CONFIG_SL28CPLD is not set
++
++#
++# MMC Host controller Support
++#
++CONFIG_MMC=y
++CONFIG_MMC_WRITE=y
++# CONFIG_MMC_BROKEN_CD is not set
++CONFIG_DM_MMC=y
++# CONFIG_ARM_PL180_MMCI is not set
++CONFIG_MMC_QUIRKS=y
++CONFIG_SYS_MMC_MAX_BLK_COUNT=65535
++CONFIG_MMC_HW_PARTITIONING=y
++# CONFIG_SUPPORT_EMMC_RPMB is not set
++CONFIG_SUPPORT_EMMC_BOOT=y
++# CONFIG_MMC_IO_VOLTAGE is not set
++# CONFIG_MMC_HS400_ES_SUPPORT is not set
++# CONFIG_MMC_HS400_SUPPORT is not set
++CONFIG_MMC_HS200_SUPPORT=y
++CONFIG_MMC_VERBOSE=y
++# CONFIG_MMC_TRACE is not set
++# CONFIG_MMC_DW is not set
++# CONFIG_MMC_MXC is not set
++# CONFIG_MMC_OMAP_HS is not set
++# CONFIG_MMC_SDHCI is not set
++# CONFIG_MMC_PITON is not set
++# CONFIG_STM32_SDMMC2 is not set
++# CONFIG_FTSDC010 is not set
++CONFIG_MMC_MTK=y
++# CONFIG_MMC_MTK_DEBUG is not set
++# CONFIG_FSL_ESDHC is not set
++# CONFIG_FSL_ESDHC_IMX is not set
++
++#
++# MTD Support
++#
++# CONFIG_MTD is not set
++# CONFIG_DM_MTD is not set
++# CONFIG_MTD_NOR_FLASH is not set
++# CONFIG_FLASH_CFI_DRIVER is not set
++# CONFIG_HBMC_AM654 is not set
++# CONFIG_SAMSUNG_ONENAND is not set
++# CONFIG_USE_SYS_MAX_FLASH_BANKS is not set
++# CONFIG_MTK_SPI_NAND is not set
++# CONFIG_MTD_RAW_NAND is not set
++# CONFIG_NMBM is not set
++
++#
++# SPI Flash Support
++#
++# CONFIG_SPI_FLASH is not set
++
++#
++# UBI support
++#
++# CONFIG_UBI_SILENCE_MSG is not set
++# CONFIG_MTD_UBI is not set
++# CONFIG_NVMXIP is not set
++# CONFIG_NVMXIP_QSPI is not set
++
++#
++# Multiplexer drivers
++#
++# CONFIG_MULTIPLEXER is not set
++# CONFIG_BITBANGMII is not set
++# CONFIG_MV88E6352_SWITCH is not set
++CONFIG_PHYLIB=y
++# CONFIG_PHY_ADDR_ENABLE is not set
++# CONFIG_B53_SWITCH is not set
++# CONFIG_MV88E61XX_SWITCH is not set
++# CONFIG_PHYLIB_10G is not set
++# CONFIG_PHY_ADIN is not set
++# CONFIG_PHY_AIROHA is not set
++# CONFIG_PHY_AQUANTIA is not set
++# CONFIG_PHY_ATHEROS is not set
++# CONFIG_SPL_PHY_ATHEROS is not set
++# CONFIG_PHY_BROADCOM is not set
++# CONFIG_PHY_CORTINA is not set
++# CONFIG_PHY_DAVICOM is not set
++# CONFIG_PHY_ET1011C is not set
++# CONFIG_PHY_LXT is not set
++# CONFIG_PHY_MARVELL is not set
++# CONFIG_PHY_MARVELL_10G is not set
++# CONFIG_PHY_MESON_GXL is not set
++# CONFIG_PHY_MICREL is not set
++# CONFIG_PHY_MOTORCOMM is not set
++# CONFIG_PHY_MSCC is not set
++# CONFIG_PHY_NATSEMI is not set
++# CONFIG_PHY_NXP_C45_TJA11XX is not set
++# CONFIG_PHY_NXP_TJA11XX is not set
++# CONFIG_PHY_REALTEK is not set
++# CONFIG_PHY_SMSC is not set
++# CONFIG_PHY_TERANETICS is not set
++# CONFIG_PHY_TI is not set
++# CONFIG_PHY_TI_DP83867 is not set
++# CONFIG_PHY_TI_DP83869 is not set
++# CONFIG_PHY_TI_GENERIC is not set
++# CONFIG_PHY_VITESSE is not set
++# CONFIG_PHY_XILINX is not set
++# CONFIG_PHY_XILINX_GMII2RGMII is not set
++# CONFIG_PHY_XWAY is not set
++# CONFIG_PHY_ETHERNET_ID is not set
++CONFIG_PHY_FIXED=y
++# CONFIG_PHY_NCSI is not set
++# CONFIG_FSL_MEMAC is not set
++CONFIG_PHY_RESET_DELAY=0
++# CONFIG_FSL_PFE is not set
++CONFIG_ETH=y
++CONFIG_DM_ETH=y
++# CONFIG_DM_MDIO is not set
++# CONFIG_DM_ETH_PHY is not set
++CONFIG_NETDEVICES=y
++# CONFIG_PHY_GIGE is not set
++# CONFIG_ALTERA_TSE is not set
++# CONFIG_BCM_SF2_ETH is not set
++# CONFIG_BCMGENET is not set
++# CONFIG_BNXT_ETH is not set
++# CONFIG_CALXEDA_XGMAC is not set
++# CONFIG_DRIVER_DM9000 is not set
++# CONFIG_DWC_ETH_QOS is not set
++# CONFIG_E1000 is not set
++# CONFIG_EEPRO100 is not set
++# CONFIG_ETH_DESIGNWARE is not set
++# CONFIG_ETH_DESIGNWARE_MESON8B is not set
++# CONFIG_ETHOC is not set
++# CONFIG_FMAN_ENET is not set
++# CONFIG_FTMAC100 is not set
++# CONFIG_FTGMAC100 is not set
++# CONFIG_MCFFEC is not set
++# CONFIG_FSLDMAFEC is not set
++# CONFIG_KS8851_MLL is not set
++# CONFIG_LITEETH is not set
++# CONFIG_MACB is not set
++# CONFIG_NET_NPCM750 is not set
++# CONFIG_PCH_GBE is not set
++# CONFIG_RGMII is not set
++# CONFIG_MII is not set
++# CONFIG_RMII is not set
++# CONFIG_PCNET is not set
++# CONFIG_QE_UEC is not set
++# CONFIG_RTL8139 is not set
++# CONFIG_RTL8169 is not set
++# CONFIG_SMC911X is not set
++# CONFIG_SUN7I_GMAC is not set
++# CONFIG_SUN4I_EMAC is not set
++# CONFIG_SUN8I_EMAC is not set
++# CONFIG_SH_ETHER is not set
++# CONFIG_DRIVER_TI_CPSW is not set
++# CONFIG_DRIVER_TI_EMAC is not set
++# CONFIG_DRIVER_TI_KEYSTONE_NET is not set
++# CONFIG_TULIP is not set
++# CONFIG_XILINX_AXIEMAC is not set
++# CONFIG_VSC7385_ENET is not set
++# CONFIG_XILINX_EMACLITE is not set
++# CONFIG_ZYNQ_GEM is not set
++# CONFIG_SYS_DPAA_QBMAN is not set
++# CONFIG_TSEC_ENET is not set
++CONFIG_MEDIATEK_ETH=y
++# CONFIG_HIGMACV300_ETH is not set
++# CONFIG_NVME is not set
++# CONFIG_NVME_APPLE is not set
++# CONFIG_NVME_PCI is not set
++# CONFIG_DM_PCI_COMPAT is not set
++CONFIG_PCI_PNP=y
++# CONFIG_SPL_PCI_PNP is not set
++# CONFIG_PCI_REGION_MULTI_ENTRY is not set
++# CONFIG_PCI_CONFIG_HOST_BRIDGE is not set
++# CONFIG_PCI_SRIOV is not set
++CONFIG_PCI_ENHANCED_ALLOCATION=y
++# CONFIG_PCI_ARID is not set
++# CONFIG_PCIE_ECAM_GENERIC is not set
++# CONFIG_PCIE_ECAM_SYNQUACER is not set
++# CONFIG_PCI_PHYTIUM is not set
++# CONFIG_PCIE_FSL is not set
++# CONFIG_PCI_MPC85XX is not set
++# CONFIG_PCI_XILINX is not set
++# CONFIG_PCIE_LAYERSCAPE_RC is not set
++# CONFIG_PCIE_LAYERSCAPE_EP is not set
++# CONFIG_PCIE_LAYERSCAPE_GEN4 is not set
++# CONFIG_PCIE_INTEL_FPGA is not set
++# CONFIG_PCIE_IPROC is not set
++# CONFIG_PCI_KEYSTONE is not set
++CONFIG_PCIE_MEDIATEK=y
++
++#
++# PCI Endpoint
++#
++# CONFIG_PCI_ENDPOINT is not set
++# CONFIG_X86_PCH7 is not set
++# CONFIG_X86_PCH9 is not set
++
++#
++# PHY Subsystem
++#
++# CONFIG_PHY is not set
++# CONFIG_MIPI_DPHY_HELPERS is not set
++
++#
++# Rockchip PHY driver
++#
++# CONFIG_PHY_CADENCE_SIERRA is not set
++# CONFIG_PHY_CADENCE_TORRENT is not set
++# CONFIG_MVEBU_COMPHY_SUPPORT is not set
++
++#
++# Pin controllers
++#
++CONFIG_PINCTRL=y
++CONFIG_PINCTRL_FULL=y
++CONFIG_PINCTRL_GENERIC=y
++CONFIG_PINMUX=y
++CONFIG_PINCONF=y
++CONFIG_PINCONF_RECURSIVE=y
++# CONFIG_PINCTRL_AT91 is not set
++# CONFIG_PINCTRL_AT91PIO4 is not set
++# CONFIG_PINCTRL_INTEL is not set
++# CONFIG_PINCTRL_QE is not set
++# CONFIG_PINCTRL_ROCKCHIP_RV1108 is not set
++# CONFIG_PINCTRL_SINGLE is not set
++# CONFIG_PINCTRL_STM32 is not set
++# CONFIG_PINCTRL_STMFX is not set
++# CONFIG_PINCTRL_K210 is not set
++CONFIG_PINCTRL_MTK=y
++# CONFIG_PINCTRL_MT7622 is not set
++# CONFIG_PINCTRL_MT7623 is not set
++# CONFIG_PINCTRL_MT7629 is not set
++CONFIG_PINCTRL_MT7981=y
++# CONFIG_PINCTRL_MT7986 is not set
++# CONFIG_PINCTRL_MT7988 is not set
++# CONFIG_PINCTRL_MT8512 is not set
++# CONFIG_PINCTRL_MT8516 is not set
++# CONFIG_PINCTRL_MT8518 is not set
++CONFIG_POWER=y
++# CONFIG_POWER_LEGACY is not set
++# CONFIG_ACPI_PMC is not set
++
++#
++# Power Domain Support
++#
++CONFIG_POWER_DOMAIN=y
++# CONFIG_APPLE_PMGR_POWER_DOMAIN is not set
++CONFIG_MTK_POWER_DOMAIN=y
++# CONFIG_DM_PMIC is not set
++# CONFIG_PMIC_TPS65217 is not set
++# CONFIG_POWER_TPS65218 is not set
++# CONFIG_POWER_TPS62362 is not set
++CONFIG_DM_REGULATOR=y
++# CONFIG_REGULATOR_PWM is not set
++CONFIG_DM_REGULATOR_COMMON=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_DM_REGULATOR_GPIO=y
++# CONFIG_DM_REGULATOR_PBIAS is not set
++# CONFIG_DM_REGULATOR_TPS62360 is not set
++# CONFIG_DM_REGULATOR_ANATOP is not set
++# CONFIG_DM_REGULATOR_SCMI is not set
++# CONFIG_TPS6586X_POWER is not set
++# CONFIG_POWER_MT6323 is not set
++CONFIG_DM_PWM=y
++# CONFIG_PWM_ASPEED is not set
++# CONFIG_PWM_CADENCE_TTC is not set
++# CONFIG_PWM_CROS_EC is not set
++# CONFIG_PWM_EXYNOS is not set
++# CONFIG_PWM_IMX is not set
++# CONFIG_PWM_MESON is not set
++CONFIG_PWM_MTK=y
++# CONFIG_PWM_ROCKCHIP is not set
++# CONFIG_PWM_SANDBOX is not set
++# CONFIG_PWM_SIFIVE is not set
++# CONFIG_PWM_TEGRA is not set
++# CONFIG_PWM_SUNXI is not set
++# CONFIG_U_QE is not set
++# CONFIG_RAM is not set
++
++#
++# Reboot Mode Support
++#
++# CONFIG_DM_REBOOT_MODE is not set
++
++#
++# Remote Processor drivers
++#
++
++#
++# Reset Controller Support
++#
++# CONFIG_RESET_AST2500 is not set
++# CONFIG_RESET_AST2600 is not set
++CONFIG_RESET_MEDIATEK=y
++# CONFIG_RESET_HISILICON is not set
++# CONFIG_RESET_SYSCON is not set
++# CONFIG_RESET_SCMI is not set
++# CONFIG_RESET_DRA7 is not set
++# CONFIG_DM_RNG is not set
++
++#
++# Real Time Clock
++#
++# CONFIG_DM_RTC is not set
++# CONFIG_RTC_ENABLE_32KHZ_OUTPUT is not set
++# CONFIG_RTC_DS1337 is not set
++# CONFIG_RTC_DS1338 is not set
++# CONFIG_RTC_DS1374 is not set
++# CONFIG_RTC_DS3231 is not set
++# CONFIG_RTC_PCF8563 is not set
++# CONFIG_RTC_PT7C4338 is not set
++# CONFIG_RTC_PL031 is not set
++# CONFIG_RTC_S35392A is not set
++# CONFIG_RTC_MC13XXX is not set
++# CONFIG_RTC_MC146818 is not set
++# CONFIG_RTC_M41T62 is not set
++# CONFIG_SCSI is not set
++# CONFIG_DM_SCSI is not set
++CONFIG_SERIAL=y
++CONFIG_BAUDRATE=115200
++CONFIG_REQUIRE_SERIAL_CONSOLE=y
++# CONFIG_SPECIFY_CONSOLE_INDEX is not set
++CONFIG_SERIAL_PRESENT=y
++CONFIG_DM_SERIAL=y
++# CONFIG_SERIAL_RX_BUFFER is not set
++# CONFIG_SERIAL_PUTS is not set
++# CONFIG_SERIAL_SEARCH_ALL is not set
++# CONFIG_SERIAL_PROBE_ALL is not set
++# CONFIG_VPL_DM_SERIAL is not set
++CONFIG_DEBUG_UART_MTK=y
++CONFIG_DEBUG_UART_SHIFT=0
++# CONFIG_DEBUG_UART_ANNOUNCE is not set
++# CONFIG_DEBUG_UART_SKIP_INIT is not set
++# CONFIG_ALTERA_JTAG_UART is not set
++# CONFIG_ALTERA_UART is not set
++# CONFIG_ARC_SERIAL is not set
++# CONFIG_ARM_DCC is not set
++# CONFIG_ATMEL_USART is not set
++# CONFIG_BCM6345_SERIAL is not set
++# CONFIG_COREBOOT_SERIAL is not set
++# CONFIG_CORTINA_UART is not set
++# CONFIG_FSL_LINFLEXUART is not set
++# CONFIG_FSL_LPUART is not set
++# CONFIG_MVEBU_A3700_UART is not set
++# CONFIG_MCFUART is not set
++# CONFIG_NULLDEV_SERIAL is not set
++# CONFIG_SYS_NS16550 is not set
++# CONFIG_PL01X_SERIAL is not set
++# CONFIG_ROCKCHIP_SERIAL is not set
++# CONFIG_XILINX_UARTLITE is not set
++# CONFIG_MSM_SERIAL is not set
++# CONFIG_MSM_GENI_SERIAL is not set
++# CONFIG_MXS_AUART_SERIAL is not set
++# CONFIG_OMAP_SERIAL is not set
++# CONFIG_SIFIVE_SERIAL is not set
++# CONFIG_ZYNQ_SERIAL is not set
++CONFIG_MTK_SERIAL=y
++# CONFIG_MT7620_SERIAL is not set
++# CONFIG_NPCM_SERIAL is not set
++# CONFIG_SMEM is not set
++
++#
++# Sound support
++#
++# CONFIG_SOUND is not set
++# CONFIG_SOUND_MAX98357A is not set
++
++#
++# SOC (System On Chip) specific Drivers
++#
++# CONFIG_SOC_DEVICE is not set
++# CONFIG_SOC_TI is not set
++# CONFIG_SPI is not set
++
++#
++# SPMI support
++#
++# CONFIG_SPMI is not set
++# CONFIG_SYSINFO is not set
++
++#
++# System reset device drivers
++#
++# CONFIG_SYSRESET is not set
++# CONFIG_TEE is not set
++# CONFIG_DM_THERMAL is not set
++
++#
++# Timer Support
++#
++CONFIG_TIMER=y
++# CONFIG_TIMER_EARLY is not set
++# CONFIG_ALTERA_TIMER is not set
++# CONFIG_ARM_TWD_TIMER is not set
++# CONFIG_AST_TIMER is not set
++# CONFIG_ATCPIT100_TIMER is not set
++# CONFIG_ATMEL_PIT_TIMER is not set
++# CONFIG_CADENCE_TTC_TIMER is not set
++# CONFIG_DESIGNWARE_APB_TIMER is not set
++# CONFIG_FTTMR010_TIMER is not set
++# CONFIG_GXP_TIMER is not set
++# CONFIG_MPC83XX_TIMER is not set
++# CONFIG_RENESAS_OSTM_TIMER is not set
++# CONFIG_NOMADIK_MTU_TIMER is not set
++# CONFIG_NPCM_TIMER is not set
++# CONFIG_OMAP_TIMER is not set
++# CONFIG_ORION_TIMER is not set
++# CONFIG_ROCKCHIP_TIMER is not set
++# CONFIG_ARM_GLOBAL_TIMER is not set
++# CONFIG_SP804_TIMER is not set
++# CONFIG_STM32_TIMER is not set
++# CONFIG_TEGRA_TIMER is not set
++CONFIG_MTK_TIMER=y
++# CONFIG_MCHP_PIT64B_TIMER is not set
++# CONFIG_IMX_GPT_TIMER is not set
++# CONFIG_XILINX_TIMER is not set
++
++#
++# TPM support
++#
++# CONFIG_USB is not set
++
++#
++# UFS Host Controller Support
++#
++# CONFIG_TI_J721E_UFS is not set
++
++#
++# Graphics support
++#
++# CONFIG_VIDEO is not set
++
++#
++# VirtIO Drivers
++#
++# CONFIG_VIRTIO_MMIO is not set
++# CONFIG_VIRTIO_PCI is not set
++# CONFIG_VIRTIO_PCI_LEGACY is not set
++
++#
++# 1-Wire support
++#
++# CONFIG_W1 is not set
++
++#
++# 1-wire EEPROM support
++#
++# CONFIG_W1_EEPROM is not set
++
++#
++# Watchdog Timer Support
++#
++# CONFIG_WATCHDOG is not set
++CONFIG_WATCHDOG_TIMEOUT_MSECS=60000
++# CONFIG_IMX_WATCHDOG is not set
++# CONFIG_ULP_WATCHDOG is not set
++# CONFIG_WDT is not set
++# CONFIG_PHYS_TO_BUS is not set
++
++#
++# File systems
++#
++# CONFIG_FS_BTRFS is not set
++# CONFIG_FS_CBFS is not set
++# CONFIG_FS_EXT4 is not set
++CONFIG_FS_FAT=y
++CONFIG_FAT_WRITE=y
++CONFIG_FS_FAT_MAX_CLUSTSIZE=65536
++# CONFIG_FS_JFFS2 is not set
++# CONFIG_UBIFS_SILENCE_MSG is not set
++# CONFIG_UBIFS_SILENCE_DEBUG_DUMP is not set
++# CONFIG_FS_CRAMFS is not set
++# CONFIG_YAFFS2 is not set
++# CONFIG_FS_SQUASHFS is not set
++# CONFIG_FS_EROFS is not set
++
++#
++# Library routines
++#
++# CONFIG_ADDR_MAP is not set
++# CONFIG_SYS_TIMER_COUNTS_DOWN is not set
++# CONFIG_PHYSMEM is not set
++# CONFIG_BCH is not set
++# CONFIG_CC_OPTIMIZE_LIBS_FOR_SPEED is not set
++CONFIG_CHARSET=y
++# CONFIG_DYNAMIC_CRC_TABLE is not set
++CONFIG_LIB_UUID=y
++# CONFIG_SEMIHOSTING is not set
++CONFIG_PRINTF=y
++CONFIG_SPRINTF=y
++CONFIG_STRTO=y
++CONFIG_SYS_HZ=1000
++# CONFIG_PANIC_HANG is not set
++CONFIG_REGEX=y
++CONFIG_LIB_RAND=y
++# CONFIG_LIB_HW_RAND is not set
++CONFIG_SUPPORT_ACPI=y
++# CONFIG_ACPI is not set
++# CONFIG_BITREVERSE is not set
++# CONFIG_TRACE is not set
++# CONFIG_CIRCBUF is not set
++# CONFIG_CMD_DHRYSTONE is not set
++
++#
++# Security support
++#
++# CONFIG_AES is not set
++# CONFIG_ECDSA is not set
++# CONFIG_RSA is not set
++# CONFIG_TPM is not set
++
++#
++# Android Verified Boot
++#
++
++#
++# Hashing Support
++#
++# CONFIG_BLAKE2 is not set
++CONFIG_SHA1=y
++CONFIG_SHA256=y
++# CONFIG_SHA512 is not set
++# CONFIG_SHA384 is not set
++# CONFIG_SHA_HW_ACCEL is not set
++CONFIG_MD5=y
++CONFIG_CRC8=y
++CONFIG_CRC32=y
++
++#
++# Compression Support
++#
++# CONFIG_LZ4 is not set
++CONFIG_LZMA=y
++# CONFIG_LZO is not set
++CONFIG_GZIP=y
++# CONFIG_ZLIB_UNCOMPRESS is not set
++# CONFIG_BZIP2 is not set
++CONFIG_ZLIB=y
++# CONFIG_ZSTD is not set
++CONFIG_VPL_LZMA=y
++# CONFIG_SPL_GZIP is not set
++# CONFIG_ERRNO_STR is not set
++CONFIG_HEXDUMP=y
++# CONFIG_GETOPT is not set
++CONFIG_OF_LIBFDT=y
++CONFIG_OF_LIBFDT_ASSUME_MASK=0
++CONFIG_SYS_FDT_PAD=0x3000
++
++#
++# System tables
++#
++# CONFIG_LIB_RATIONAL is not set
++# CONFIG_SMBIOS_PARSER is not set
++# CONFIG_EFI_LOADER is not set
++# CONFIG_OPTEE_LIB is not set
++# CONFIG_OPTEE_IMAGE is not set
++# CONFIG_BOOTM_OPTEE is not set
++# CONFIG_TEST_FDTDEC is not set
++CONFIG_LMB=y
++CONFIG_LMB_USE_MAX_REGIONS=y
++CONFIG_LMB_MAX_REGIONS=64
++# CONFIG_PHANDLE_CHECK_SEQ is not set
++
++#
++# FWU Multi Bank Updates
++#
++# CONFIG_POST is not set
++
++#
++# Unit tests
++#
++# CONFIG_UNIT_TEST is not set
++
++#
++# Tools options
++#
++CONFIG_MKIMAGE_DTC_PATH="dtc"
++CONFIG_TOOLS_CRC32=y
++CONFIG_TOOLS_LIBCRYPTO=y
++CONFIG_TOOLS_FIT=y
++CONFIG_TOOLS_FIT_FULL_CHECK=y
++CONFIG_TOOLS_FIT_PRINT=y
++CONFIG_TOOLS_FIT_RSASSA_PSS=y
++CONFIG_TOOLS_FIT_SIGNATURE=y
++CONFIG_TOOLS_FIT_SIGNATURE_MAX_SIZE=0x10000000
++CONFIG_TOOLS_FIT_VERBOSE=y
++CONFIG_TOOLS_MD5=y
++CONFIG_TOOLS_OF_LIBFDT=y
++CONFIG_TOOLS_SHA1=y
++CONFIG_TOOLS_SHA256=y
++CONFIG_TOOLS_SHA384=y
++CONFIG_TOOLS_SHA512=y
++# CONFIG_TOOLS_MKEFICAPSULE is not set
++# CONFIG_FSPI_CONF_HEADER is not set
++# CONFIG_TOOLS_MKFWUMDATA is not set
++CONFIG_WEBUI_FAILSAFE=y
diff --git a/6.12/package/kernel/gpio-button-hotplug/patches/999-fix-kernel-6.12.patch b/6.12/package/kernel/gpio-button-hotplug/patches/999-fix-kernel-6.12.patch
new file mode 100644
index 00000000..8438c883
--- /dev/null
+++ b/6.12/package/kernel/gpio-button-hotplug/patches/999-fix-kernel-6.12.patch
@@ -0,0 +1,26 @@
+diff --git a/package/kernel/gpio-button-hotplug/src/gpio-button-hotplug.c b/package/kernel/gpio-button-hotplug/src/gpio-button-hotplug.c
+index 1dd0ff2a1a1abf..8537a93d6a8d2f 100644
+--- a/package/kernel/gpio-button-hotplug/src/gpio-button-hotplug.c
++++ b/package/kernel/gpio-button-hotplug/src/gpio-button-hotplug.c
+@@ -674,7 +674,11 @@ static void gpio_keys_irq_close(struct gpio_keys_button_dev *bdev)
+ 	}
+ }
+ 
++#if LINUX_VERSION_CODE < KERNEL_VERSION(6,11,0)
+ static int gpio_keys_remove(struct platform_device *pdev)
++#else
++static void gpio_keys_remove(struct platform_device *pdev)
++#endif
+ {
+ 	struct gpio_keys_button_dev *bdev = platform_get_drvdata(pdev);
+ 
+@@ -685,7 +689,9 @@ static int gpio_keys_remove(struct platform_device *pdev)
+ 	else
+ 		gpio_keys_irq_close(bdev);
+ 
++#if LINUX_VERSION_CODE < KERNEL_VERSION(6,11,0)
+ 	return 0;
++#endif
+ }
+ 
+ static struct platform_driver gpio_keys_driver = {
diff --git a/6.12/package/kernel/gpio-nct5104d/patches/999-fix-kernel-6.12.patch b/6.12/package/kernel/gpio-nct5104d/patches/999-fix-kernel-6.12.patch
new file mode 100644
index 00000000..b088ca3e
--- /dev/null
+++ b/6.12/package/kernel/gpio-nct5104d/patches/999-fix-kernel-6.12.patch
@@ -0,0 +1,26 @@
+diff --git a/package/kernel/gpio-nct5104d/src/gpio-nct5104d.c b/package/kernel/gpio-nct5104d/src/gpio-nct5104d.c
+index eb1cf8494abe2..00dc4dcd9424f 100644
+--- a/package/kernel/gpio-nct5104d/src/gpio-nct5104d.c
++++ b/package/kernel/gpio-nct5104d/src/gpio-nct5104d.c
+@@ -300,7 +300,11 @@ static int nct5104d_gpio_probe(struct platform_device *pdev)
+ 	return err;
+ }
+ 
++#if LINUX_VERSION_CODE < KERNEL_VERSION(6,11,0)
+ static int nct5104d_gpio_remove(struct platform_device *pdev)
++#else
++static void nct5104d_gpio_remove(struct platform_device *pdev)
++#endif
+ {
+ 	int i;
+ 	struct nct5104d_gpio_data *data = platform_get_drvdata(pdev);
+@@ -311,7 +315,9 @@ static int nct5104d_gpio_remove(struct platform_device *pdev)
+ 		gpiochip_remove (&bank->chip);
+ 	}
+ 
++#if LINUX_VERSION_CODE < KERNEL_VERSION(6,11,0)
+ 	return 0;
++#endif
+ }
+ 
+ static int __init nct5104d_find(int addr, struct nct5104d_sio *sio)
diff --git a/6.12/package/kernel/linux/modules/fs.mk b/6.12/package/kernel/linux/modules/fs.mk
new file mode 100644
index 00000000..be5d322f
--- /dev/null
+++ b/6.12/package/kernel/linux/modules/fs.mk
@@ -0,0 +1,723 @@
+#
+# Copyright (C) 2006-2011 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+FS_MENU:=Filesystems
+
+define KernelPackage/fs-9p
+  SUBMENU:=$(FS_MENU)
+  TITLE:=Plan 9 Resource Sharing Support
+  DEPENDS:=+kmod-9pnet +LINUX_6_1:kmod-fs-netfs +LINUX_6_6:kmod-fs-netfs
+  KCONFIG:=\
+	CONFIG_9P_FS \
+	CONFIG_9P_FS_POSIX_ACL=n \
+	CONFIG_9P_FS_SECURITY=n \
+	CONFIG_9P_FSCACHE=n
+  FILES:=$(LINUX_DIR)/fs/9p/9p.ko
+  AUTOLOAD:=$(call AutoLoad,30,9p)
+endef
+
+define KernelPackage/fs-9p/description
+  Kernel module for Plan 9 Resource Sharing Support support
+endef
+
+$(eval $(call KernelPackage,fs-9p))
+
+
+define KernelPackage/fs-afs
+  SUBMENU:=$(FS_MENU)
+  TITLE:=Andrew FileSystem client
+  DEFAULT:=n
+  DEPENDS:=+kmod-rxrpc +kmod-dnsresolver +kmod-fs-fscache
+  KCONFIG:=\
+	CONFIG_AFS_FS=m \
+	CONFIG_AFS_DEBUG=n \
+	CONFIG_AFS_FSCACHE=y
+  FILES:=$(LINUX_DIR)/fs/afs/kafs.ko
+  AUTOLOAD:=$(call AutoLoad,30,kafs)
+endef
+
+define KernelPackage/fs-afs/description
+  Kernel module for Andrew FileSystem client support
+endef
+
+$(eval $(call KernelPackage,fs-afs))
+
+define KernelPackage/fs-autofs4
+  SUBMENU:=$(FS_MENU)
+  TITLE:=AUTOFS4 filesystem support
+  KCONFIG:= \
+	CONFIG_AUTOFS4_FS \
+	CONFIG_AUTOFS_FS
+  FILES:= \
+	$(LINUX_DIR)/fs/autofs/autofs4.ko
+  AUTOLOAD:=$(call AutoLoad,30,autofs4)
+endef
+
+define KernelPackage/fs-autofs4/description
+ Kernel module for AutoFS4 support
+endef
+
+$(eval $(call KernelPackage,fs-autofs4))
+
+
+define KernelPackage/fs-btrfs
+  SUBMENU:=$(FS_MENU)
+  TITLE:=BTRFS filesystem support
+  DEPENDS:=+kmod-lib-crc32c +kmod-lib-lzo +kmod-lib-zlib-inflate +kmod-lib-zlib-deflate +kmod-lib-raid6 +kmod-lib-xor +kmod-lib-zstd
+  KCONFIG:=\
+	CONFIG_BTRFS_FS \
+	CONFIG_BTRFS_FS_CHECK_INTEGRITY=n
+  FILES:=\
+	$(LINUX_DIR)/fs/btrfs/btrfs.ko
+  AUTOLOAD:=$(call AutoLoad,30,btrfs,1)
+endef
+
+define KernelPackage/fs-btrfs/description
+ Kernel module for BTRFS support
+endef
+
+$(eval $(call KernelPackage,fs-btrfs))
+
+
+define KernelPackage/fs-smbfs-common
+  SUBMENU:=$(FS_MENU)
+  TITLE:=SMBFS common dependencies support
+  HIDDEN:=1
+  DEPENDS:=+LINUX_6_6:kmod-fs-netfs +LINUX_6_6:kmod-nls-ucs2-utils
+  KCONFIG:=\
+	CONFIG_SMBFS_COMMON@lt6.1 \
+	CONFIG_SMBFS@ge6.1
+  FILES:= \
+	$(LINUX_DIR)/fs/smbfs_common/cifs_arc4.ko@lt6.1 \
+	$(LINUX_DIR)/fs/smbfs_common/cifs_md4.ko@lt6.1 \
+	$(LINUX_DIR)/fs/smb/common/cifs_arc4.ko@ge6.1 \
+	$(LINUX_DIR)/fs/smb/common/cifs_md4.ko@ge6.1
+endef
+
+define KernelPackage/fs-smbfs-common/description
+ Kernel module dependency for CIFS or SMB_SERVER support
+endef
+
+$(eval $(call KernelPackage,fs-smbfs-common))
+
+
+define KernelPackage/fs-cifs
+  SUBMENU:=$(FS_MENU)
+  TITLE:=CIFS support
+  KCONFIG:= \
+	CONFIG_CIFS \
+	CONFIG_CIFS_DFS_UPCALL=n \
+	CONFIG_CIFS_UPCALL=n
+  FILES:= \
+	$(LINUX_DIR)/fs/cifs/cifs.ko@lt6.1 \
+	$(LINUX_DIR)/fs/smb/client/cifs.ko@ge6.1
+  AUTOLOAD:=$(call AutoLoad,30,cifs)
+  $(call AddDepends/nls)
+  DEPENDS+= \
+    +kmod-fs-smbfs-common \
+    +kmod-crypto-md5 \
+    +kmod-crypto-sha256 \
+    +kmod-crypto-sha512 \
+    +kmod-crypto-cmac \
+    +kmod-crypto-hmac \
+    +kmod-crypto-aead \
+    +kmod-crypto-ccm \
+    +kmod-crypto-ecb \
+    +kmod-crypto-des \
+    +kmod-asn1-decoder \
+    +kmod-oid-registry \
+    +kmod-dnsresolver
+endef
+
+define KernelPackage/fs-cifs/description
+ Kernel module for CIFS support
+endef
+
+$(eval $(call KernelPackage,fs-cifs))
+
+
+define KernelPackage/fs-configfs
+  SUBMENU:=$(FS_MENU)
+  TITLE:=Configuration filesystem support
+  KCONFIG:= \
+	CONFIG_CONFIGFS_FS
+  FILES:=$(LINUX_DIR)/fs/configfs/configfs.ko
+  AUTOLOAD:=$(call AutoLoad,30,configfs)
+endef
+
+define KernelPackage/fs-configfs/description
+ Kernel module for configfs support
+endef
+
+$(eval $(call KernelPackage,fs-configfs))
+
+
+define KernelPackage/fs-cramfs
+  SUBMENU:=$(FS_MENU)
+  TITLE:=Compressed RAM/ROM filesystem support
+  DEPENDS:=+kmod-lib-zlib-inflate
+  KCONFIG:= \
+	CONFIG_CRAMFS
+  FILES:=$(LINUX_DIR)/fs/cramfs/cramfs.ko
+  AUTOLOAD:=$(call AutoLoad,30,cramfs)
+endef
+
+define KernelPackage/fs-cramfs/description
+ Kernel module for cramfs support
+endef
+
+$(eval $(call KernelPackage,fs-cramfs))
+
+
+define KernelPackage/fs-efivarfs
+  SUBMENU:=$(FS_MENU)
+  TITLE:=efivar filesystem support
+  KCONFIG:=CONFIG_EFIVAR_FS
+  FILES:=$(LINUX_DIR)/fs/efivarfs/efivarfs.ko
+  DEPENDS:=@(x86_64||x86)
+  AUTOLOAD:=$(call Autoload,90,efivarfs)
+endef
+
+define KernelPackage/fs-efivarfs/description
+  Kernel module to support efivarfs file system mountpoint.
+endef
+
+$(eval $(call KernelPackage,fs-efivarfs))
+
+
+define KernelPackage/fs-exfat
+  SUBMENU:=$(FS_MENU)
+  TITLE:=exFAT filesystem support
+  KCONFIG:= \
+	CONFIG_EXFAT_FS \
+	CONFIG_EXFAT_DEFAULT_IOCHARSET="utf8"
+  FILES:= $(LINUX_DIR)/fs/exfat/exfat.ko
+  AUTOLOAD:=$(call AutoLoad,30,exfat,1)
+  DEPENDS:=+kmod-nls-base
+endef
+
+define KernelPackage/fs-exfat/description
+ Kernel module for exFAT filesystem support
+endef
+
+$(eval $(call KernelPackage,fs-exfat))
+
+
+define KernelPackage/fs-exportfs
+  SUBMENU:=$(FS_MENU)
+  TITLE:=exportfs kernel server support
+  KCONFIG:=CONFIG_EXPORTFS
+  FILES=$(LINUX_DIR)/fs/exportfs/exportfs.ko
+  AUTOLOAD:=$(call AutoLoad,20,exportfs,1)
+endef
+
+define KernelPackage/fs-exportfs/description
+ Kernel module for exportfs. Needed for some other modules.
+endef
+
+$(eval $(call KernelPackage,fs-exportfs))
+
+
+define KernelPackage/fs-ext4
+  SUBMENU:=$(FS_MENU)
+  TITLE:=EXT4 filesystem support
+  DEPENDS := \
+    +kmod-lib-crc16 \
+    +kmod-crypto-hash \
+    +kmod-crypto-crc32c
+  KCONFIG:= \
+	CONFIG_EXT4_FS \
+	CONFIG_EXT4_ENCRYPTION=n \
+	CONFIG_JBD2
+  FILES:= \
+	$(LINUX_DIR)/fs/ext4/ext4.ko \
+	$(LINUX_DIR)/fs/jbd2/jbd2.ko \
+	$(LINUX_DIR)/fs/mbcache.ko
+  AUTOLOAD:=$(call AutoLoad,30,mbcache jbd2 ext4,1)
+endef
+
+define KernelPackage/fs-ext4/description
+ Kernel module for EXT4 filesystem support
+endef
+
+$(eval $(call KernelPackage,fs-ext4))
+
+
+define KernelPackage/fs-f2fs
+  SUBMENU:=$(FS_MENU)
+  TITLE:=F2FS filesystem support
+  DEPENDS:= +kmod-crypto-hash +kmod-crypto-crc32 +kmod-nls-base
+  KCONFIG:=CONFIG_F2FS_FS
+  FILES:=$(LINUX_DIR)/fs/f2fs/f2fs.ko
+  AUTOLOAD:=$(call AutoLoad,30,f2fs,1)
+endef
+
+define KernelPackage/fs-f2fs/description
+ Kernel module for F2FS filesystem support
+endef
+
+$(eval $(call KernelPackage,fs-f2fs))
+
+
+#define KernelPackage/fs-fscache
+#  SUBMENU:=$(FS_MENU)
+#  TITLE:=General filesystem local cache manager
+#  DEPENDS:=+kmod-fs-netfs
+#  KCONFIG:=\
+#	CONFIG_FSCACHE \
+#	CONFIG_FSCACHE_STATS=y \
+#	CONFIG_FSCACHE_HISTOGRAM=n \
+#	CONFIG_FSCACHE_DEBUG=n \
+#	CONFIG_FSCACHE_OBJECT_LIST=n \
+#	CONFIG_CACHEFILES \
+#	CONFIG_CACHEFILES_DEBUG=n \
+#	CONFIG_CACHEFILES_HISTOGRAM=n \
+#	CONFIG_CACHEFILES_ERROR_INJECTION=n@ge5.17 \
+#	CONFIG_CACHEFILES_ONDEMAND=n@ge5.19
+#  FILES:= \
+#	$(LINUX_DIR)/fs/fscache/fscache.ko \
+#	$(LINUX_DIR)/fs/cachefiles/cachefiles.ko
+#  AUTOLOAD:=$(call AutoLoad,29,fscache cachefiles)
+#endef
+
+#$(eval $(call KernelPackage,fs-fscache))
+
+
+define KernelPackage/fs-hfs
+  SUBMENU:=$(FS_MENU)
+  TITLE:=HFS filesystem support
+  DEPENDS:=+kmod-cdrom
+  KCONFIG:=CONFIG_HFS_FS
+  FILES:=$(LINUX_DIR)/fs/hfs/hfs.ko
+  AUTOLOAD:=$(call AutoLoad,30,hfs)
+  $(call AddDepends/nls)
+endef
+
+define KernelPackage/fs-hfs/description
+ Kernel module for HFS filesystem support
+endef
+
+$(eval $(call KernelPackage,fs-hfs))
+
+
+define KernelPackage/fs-hfsplus
+  SUBMENU:=$(FS_MENU)
+  TITLE:=HFS+ filesystem support
+  DEPENDS:=+kmod-cdrom
+  KCONFIG:=CONFIG_HFSPLUS_FS
+  FILES:=$(LINUX_DIR)/fs/hfsplus/hfsplus.ko
+  AUTOLOAD:=$(call AutoLoad,30,hfsplus)
+  $(call AddDepends/nls,utf8)
+endef
+
+define KernelPackage/fs-hfsplus/description
+ Kernel module for HFS+ filesystem support
+endef
+
+$(eval $(call KernelPackage,fs-hfsplus))
+
+
+define KernelPackage/fs-isofs
+  SUBMENU:=$(FS_MENU)
+  TITLE:=ISO9660 filesystem support
+  DEPENDS:=+kmod-lib-zlib-inflate +kmod-cdrom
+  KCONFIG:=CONFIG_ISO9660_FS CONFIG_JOLIET=y CONFIG_ZISOFS=n
+  FILES:=$(LINUX_DIR)/fs/isofs/isofs.ko
+  AUTOLOAD:=$(call AutoLoad,30,isofs)
+  $(call AddDepends/nls)
+endef
+
+define KernelPackage/fs-isofs/description
+ Kernel module for ISO9660 filesystem support
+endef
+
+$(eval $(call KernelPackage,fs-isofs))
+
+
+define KernelPackage/fs-jfs
+  SUBMENU:=$(FS_MENU)
+  TITLE:=JFS filesystem support
+  KCONFIG:=CONFIG_JFS_FS
+  FILES:=$(LINUX_DIR)/fs/jfs/jfs.ko
+  AUTOLOAD:=$(call AutoLoad,30,jfs,1)
+  DEPENDS:=+LINUX_6_6:kmod-nls-ucs2-utils
+  $(call AddDepends/nls)
+endef
+
+define KernelPackage/fs-jfs/description
+ Kernel module for JFS support
+endef
+
+$(eval $(call KernelPackage,fs-jfs))
+
+
+define KernelPackage/fs-ksmbd
+  SUBMENU:=$(FS_MENU)
+  TITLE:=SMB kernel server support
+  DEPENDS:= \
+	  +kmod-nls-base \
+	  +kmod-nls-utf8 \
+	  +kmod-crypto-md5 \
+	  +kmod-crypto-hmac \
+	  +kmod-crypto-ecb \
+	  +kmod-crypto-des \
+	  +kmod-crypto-sha256 \
+	  +kmod-crypto-cmac \
+	  +kmod-crypto-sha512 \
+	  +kmod-crypto-aead \
+	  +kmod-crypto-ccm \
+	  +kmod-crypto-gcm \
+	  +kmod-asn1-decoder \
+	  +kmod-oid-registry \
+	  +kmod-fs-smbfs-common
+  KCONFIG:= \
+	CONFIG_SMB_SERVER \
+	CONFIG_SMB_SERVER_SMBDIRECT=n \
+	CONFIG_SMB_SERVER_CHECK_CAP_NET_ADMIN=n \
+	CONFIG_SMB_SERVER_KERBEROS5=n
+  FILES:= \
+	 $(LINUX_DIR)/fs/ksmbd/ksmbd.ko@lt6.1 \
+	 $(LINUX_DIR)/fs/smb/server/ksmbd.ko@ge6.1
+  AUTOLOAD:=$(call AutoLoad,41,ksmbd)
+endef
+
+define KernelPackage/fs-ksmbd/description
+ Kernel module for SMB kernel server support
+endef
+
+$(eval $(call KernelPackage,fs-ksmbd))
+
+
+define KernelPackage/fs-minix
+  SUBMENU:=$(FS_MENU)
+  TITLE:=Minix filesystem support
+  KCONFIG:=CONFIG_MINIX_FS
+  FILES:=$(LINUX_DIR)/fs/minix/minix.ko
+  AUTOLOAD:=$(call AutoLoad,30,minix)
+endef
+
+define KernelPackage/fs-minix/description
+ Kernel module for Minix filesystem support
+endef
+
+$(eval $(call KernelPackage,fs-minix))
+
+
+define KernelPackage/fs-msdos
+  SUBMENU:=$(FS_MENU)
+  TITLE:=MSDOS filesystem support
+  DEPENDS:=+kmod-fs-vfat
+  KCONFIG:=CONFIG_MSDOS_FS
+  FILES:=$(LINUX_DIR)/fs/fat/msdos.ko
+  AUTOLOAD:=$(call AutoLoad,40,msdos)
+  $(call AddDepends/nls)
+endef
+
+define KernelPackage/fs-msdos/description
+ Kernel module for MSDOS filesystem support
+endef
+
+$(eval $(call KernelPackage,fs-msdos))
+
+
+define KernelPackage/fs-netfs
+  SUBMENU:=$(FS_MENU)
+  TITLE:=Network Filesystems support
+  KCONFIG:= CONFIG_NETFS_SUPPORT
+  FILES:=$(LINUX_DIR)/fs/netfs/netfs.ko
+  AUTOLOAD:=$(call AutoLoad,28,netfs)
+endef
+
+$(eval $(call KernelPackage,fs-netfs))
+
+
+define KernelPackage/fs-nfs
+  SUBMENU:=$(FS_MENU)
+  TITLE:=NFS filesystem client support
+  DEPENDS:=+kmod-fs-nfs-common +kmod-dnsresolver
+  KCONFIG:= \
+	CONFIG_NFS_FS \
+	CONFIG_NFS_USE_LEGACY_DNS=n \
+	CONFIG_NFS_USE_NEW_IDMAPPER=n
+  FILES:= \
+	$(LINUX_DIR)/fs/nfs/nfs.ko
+  AUTOLOAD:=$(call AutoLoad,40,nfs)
+endef
+
+define KernelPackage/fs-nfs/description
+ Kernel module for NFS client support
+endef
+
+$(eval $(call KernelPackage,fs-nfs))
+
+
+define KernelPackage/fs-nfs-common
+  SUBMENU:=$(FS_MENU)
+  TITLE:=Common NFS filesystem modules
+  DEPENDS:=+kmod-oid-registry
+  KCONFIG:= \
+	CONFIG_LOCKD \
+	CONFIG_SUNRPC \
+	CONFIG_GRACE_PERIOD \
+	CONFIG_NFS_V4=y \
+	CONFIG_NFS_V4_1=y \
+	CONFIG_NFS_V4_1_IMPLEMENTATION_ID_DOMAIN="kernel.org" \
+	CONFIG_NFS_V4_1_MIGRATION=n \
+	CONFIG_NFS_V4_2=y \
+	CONFIG_NFS_V4_2_READ_PLUS=n
+  FILES:= \
+	$(LINUX_DIR)/fs/lockd/lockd.ko \
+	$(LINUX_DIR)/net/sunrpc/sunrpc.ko \
+	$(LINUX_DIR)/fs/nfs_common/grace.ko
+  AUTOLOAD:=$(call AutoLoad,30,grace sunrpc lockd)
+endef
+
+$(eval $(call KernelPackage,fs-nfs-common))
+
+
+define KernelPackage/fs-nfs-common-rpcsec
+  SUBMENU:=$(FS_MENU)
+  TITLE:=NFS Secure RPC
+  DEPENDS:= \
+	+kmod-fs-nfs-common \
+	+kmod-crypto-des \
+	+kmod-crypto-cbc \
+	+kmod-crypto-cts \
+	+kmod-crypto-md5 \
+	+kmod-crypto-sha1 \
+	+kmod-crypto-hmac \
+	+kmod-crypto-ecb \
+	+kmod-crypto-arc4
+  KCONFIG:= \
+	CONFIG_SUNRPC_GSS \
+	CONFIG_RPCSEC_GSS_KRB5
+  FILES:= \
+	$(LINUX_DIR)/net/sunrpc/auth_gss/auth_rpcgss.ko \
+	$(LINUX_DIR)/net/sunrpc/auth_gss/rpcsec_gss_krb5.ko
+  AUTOLOAD:=$(call AutoLoad,31,auth_rpcgss rpcsec_gss_krb5)
+endef
+
+define KernelPackage/fs-nfs-common-rpcsec/description
+ Kernel modules for NFS Secure RPC
+endef
+
+$(eval $(call KernelPackage,fs-nfs-common-rpcsec))
+
+
+define KernelPackage/fs-nfs-v3
+  SUBMENU:=$(FS_MENU)
+  TITLE:=NFS3 filesystem client support
+  DEPENDS:=+kmod-fs-nfs
+  FILES:= \
+	$(LINUX_DIR)/fs/nfs/nfsv3.ko
+  AUTOLOAD:=$(call AutoLoad,41,nfsv3)
+endef
+
+define KernelPackage/fs-nfs-v3/description
+ Kernel module for NFS v3 client support
+endef
+
+$(eval $(call KernelPackage,fs-nfs-v3))
+
+
+define KernelPackage/fs-nfs-v4
+  SUBMENU:=$(FS_MENU)
+  TITLE:=NFS4 filesystem client support
+  DEPENDS:=+kmod-fs-nfs
+  KCONFIG:= \
+	CONFIG_NFS_V4=y
+  FILES:= \
+	$(LINUX_DIR)/fs/nfs/nfsv4.ko
+  AUTOLOAD:=$(call AutoLoad,41,nfsv4)
+endef
+
+define KernelPackage/fs-nfs-v4/description
+ Kernel module for NFS v4 client support
+endef
+
+$(eval $(call KernelPackage,fs-nfs-v4))
+
+
+define KernelPackage/fs-nfsd
+  SUBMENU:=$(FS_MENU)
+  TITLE:=NFS kernel server support
+  DEPENDS:=+kmod-fs-nfs-common +kmod-fs-exportfs +kmod-fs-nfs-common-rpcsec
+  KCONFIG:= \
+	CONFIG_NFSD \
+	CONFIG_NFSD_V4=y \
+	CONFIG_NFSD_V4_SECURITY_LABEL=n \
+	CONFIG_NFSD_BLOCKLAYOUT=n \
+	CONFIG_NFSD_SCSILAYOUT=n \
+	CONFIG_NFSD_FLEXFILELAYOUT=n \
+	CONFIG_NFSD_FAULT_INJECTION=n \
+	CONFIG_NFSD_V4_2_INTER_SSC=n
+  FILES:=$(LINUX_DIR)/fs/nfsd/nfsd.ko
+  AUTOLOAD:=$(call AutoLoad,40,nfsd)
+endef
+
+define KernelPackage/fs-nfsd/description
+ Kernel module for NFS kernel server support
+endef
+
+$(eval $(call KernelPackage,fs-nfsd))
+
+
+#define KernelPackage/fs-ntfs
+#  SUBMENU:=$(FS_MENU)
+#  TITLE:=NTFS filesystem read-only (old driver) support
+#  KCONFIG:=CONFIG_NTFS_FS
+#  FILES:=$(LINUX_DIR)/fs/ntfs/ntfs.ko
+#  AUTOLOAD:=$(call AutoLoad,30,ntfs)
+#  $(call AddDepends/nls)
+#endef
+
+#define KernelPackage/fs-ntfs/description
+# Kernel module for limited NTFS filesystem support. Support for writing
+# is extremely limited and disabled as a result.
+#endef
+
+#$(eval $(call KernelPackage,fs-ntfs))
+
+
+define KernelPackage/fs-ntfs3
+  SUBMENU:=$(FS_MENU)
+  TITLE:=NTFS filesystem read & write (new driver) support
+  KCONFIG:= CONFIG_NTFS3_FS CONFIG_NTFS3_FS_POSIX_ACL=y
+  FILES:=$(LINUX_DIR)/fs/ntfs3/ntfs3.ko
+  $(call AddDepends/nls)
+  AUTOLOAD:=$(call AutoLoad,80,ntfs3)
+endef
+
+define KernelPackage/fs-ntfs3/description
+ Kernel module for fully functional NTFS filesystem support. It allows
+ reading as well as writing.
+
+ It supports NTFS versions up to 3.1.
+endef
+
+$(eval $(call KernelPackage,fs-ntfs3))
+
+
+define KernelPackage/fs-reiserfs
+  SUBMENU:=$(FS_MENU)
+  TITLE:=ReiserFS filesystem support
+  KCONFIG:=CONFIG_REISERFS_FS
+  FILES:=$(LINUX_DIR)/fs/reiserfs/reiserfs.ko
+  AUTOLOAD:=$(call AutoLoad,30,reiserfs,1)
+endef
+
+define KernelPackage/fs-reiserfs/description
+ Kernel module for ReiserFS support
+endef
+
+$(eval $(call KernelPackage,fs-reiserfs))
+
+
+define KernelPackage/fs-squashfs
+  SUBMENU:=$(FS_MENU)
+  TITLE:=SquashFS 4.0 filesystem support
+  KCONFIG:=CONFIG_SQUASHFS \
+	CONFIG_SQUASHFS_XZ=y
+  FILES:=$(LINUX_DIR)/fs/squashfs/squashfs.ko
+  AUTOLOAD:=$(call AutoLoad,30,squashfs,1)
+endef
+
+define KernelPackage/fs-squashfs/description
+ Kernel module for SquashFS 4.0 support
+endef
+
+$(eval $(call KernelPackage,fs-squashfs))
+
+
+define KernelPackage/fs-udf
+  SUBMENU:=$(FS_MENU)
+  TITLE:=UDF filesystem support
+  KCONFIG:=CONFIG_UDF_FS
+  FILES:=$(LINUX_DIR)/fs/udf/udf.ko
+  AUTOLOAD:=$(call AutoLoad,30,udf)
+  DEPENDS:=+kmod-lib-crc-itu-t +kmod-cdrom
+  $(call AddDepends/nls)
+endef
+
+define KernelPackage/fs-udf/description
+ Kernel module for UDF filesystem support
+endef
+
+$(eval $(call KernelPackage,fs-udf))
+
+
+define KernelPackage/fs-vfat
+  SUBMENU:=$(FS_MENU)
+  TITLE:=VFAT filesystem support
+  KCONFIG:= \
+	CONFIG_FAT_FS \
+	CONFIG_VFAT_FS
+  FILES:= \
+	$(LINUX_DIR)/fs/fat/fat.ko \
+	$(LINUX_DIR)/fs/fat/vfat.ko
+  AUTOLOAD:=$(call AutoLoad,30,fat vfat,1)
+  $(call AddDepends/nls,cp437 iso8859-1 utf8)
+endef
+
+define KernelPackage/fs-vfat/description
+ Kernel module for VFAT filesystem support
+endef
+
+$(eval $(call KernelPackage,fs-vfat))
+
+
+define KernelPackage/fs-xfs
+  SUBMENU:=$(FS_MENU)
+  TITLE:=XFS filesystem support
+  KCONFIG:=CONFIG_XFS_FS
+  DEPENDS:= +kmod-fs-exportfs +kmod-lib-crc32c
+  FILES:=$(LINUX_DIR)/fs/xfs/xfs.ko
+  AUTOLOAD:=$(call AutoLoad,30,xfs,1)
+endef
+
+define KernelPackage/fs-xfs/description
+ Kernel module for XFS support
+endef
+
+$(eval $(call KernelPackage,fs-xfs))
+
+
+define KernelPackage/fuse
+  SUBMENU:=$(FS_MENU)
+  TITLE:=FUSE (Filesystem in Userspace) support
+  KCONFIG:= CONFIG_FUSE_FS
+  FILES:=$(LINUX_DIR)/fs/fuse/fuse.ko
+  AUTOLOAD:=$(call AutoLoad,80,fuse)
+endef
+
+define KernelPackage/fuse/description
+ Kernel module for userspace filesystem support
+endef
+
+$(eval $(call KernelPackage,fuse))
+
+
+define KernelPackage/pstore
+  SUBMENU:=$(FS_MENU)
+  TITLE:=Pstore file system
+  DEFAULT:=m if ALL_KMODS
+  KCONFIG:= \
+	CONFIG_PSTORE \
+	CONFIG_PSTORE_COMPRESS=y \
+	CONFIG_PSTORE_COMPRESS_DEFAULT="deflate" \
+	CONFIG_PSTORE_DEFLATE_COMPRESS=y \
+	CONFIG_PSTORE_DEFLATE_COMPRESS_DEFAULT=y
+  FILES:= $(LINUX_DIR)/fs/pstore/pstore.ko
+  AUTOLOAD:=$(call AutoLoad,30,pstore,1)
+  DEPENDS:=+LINUX_6_6:kmod-lib-zlib-deflate +LINUX_6_6:kmod-lib-zlib-inflate
+endef
+
+define KernelPackage/pstore/description
+ Kernel module for pstore filesystem support
+endef
+
+$(eval $(call KernelPackage,pstore))
diff --git a/6.12/package/kernel/linux/modules/other.mk b/6.12/package/kernel/linux/modules/other.mk
new file mode 100644
index 00000000..e04840df
--- /dev/null
+++ b/6.12/package/kernel/linux/modules/other.mk
@@ -0,0 +1,1153 @@
+#
+# Copyright (C) 2006-2015 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+OTHER_MENU:=Other modules
+
+WATCHDOG_DIR:=watchdog
+
+
+define KernelPackage/6lowpan
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=6LoWPAN shared code
+  KCONFIG:= \
+	CONFIG_6LOWPAN \
+	CONFIG_6LOWPAN_NHC=n
+  FILES:=$(LINUX_DIR)/net/6lowpan/6lowpan.ko
+  AUTOLOAD:=$(call AutoProbe,6lowpan)
+endef
+
+define KernelPackage/6lowpan/description
+  Shared 6lowpan code for IEEE 802.15.4 and Bluetooth.
+endef
+
+$(eval $(call KernelPackage,6lowpan))
+
+
+define KernelPackage/bluetooth
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Bluetooth support
+  DEPENDS:=@USB_SUPPORT +kmod-usb-core +kmod-crypto-hash +kmod-crypto-ecb +kmod-lib-crc16 +kmod-hid +kmod-crypto-cmac +kmod-regmap-core +kmod-crypto-ecdh
+  KCONFIG:= \
+	CONFIG_BT \
+	CONFIG_BT_BREDR=y \
+	CONFIG_BT_DEBUGFS=n \
+	CONFIG_BT_LE=y \
+	CONFIG_BT_RFCOMM \
+	CONFIG_BT_BNEP \
+	CONFIG_BT_HCIBTUSB \
+	CONFIG_BT_HCIBTUSB_BCM=n \
+	CONFIG_BT_HCIBTUSB_MTK=y \
+	CONFIG_BT_HCIBTUSB_RTL=y \
+	CONFIG_BT_HCIUART \
+	CONFIG_BT_HCIUART_BCM=n \
+	CONFIG_BT_HCIUART_INTEL=n \
+	CONFIG_BT_HCIUART_H4 \
+	CONFIG_BT_HCIUART_NOKIA=n \
+	CONFIG_BT_HIDP
+  $(call AddDepends/rfkill)
+  FILES:= \
+	$(LINUX_DIR)/net/bluetooth/bluetooth.ko \
+	$(LINUX_DIR)/net/bluetooth/rfcomm/rfcomm.ko \
+	$(LINUX_DIR)/net/bluetooth/bnep/bnep.ko \
+	$(LINUX_DIR)/net/bluetooth/hidp/hidp.ko \
+	$(LINUX_DIR)/drivers/bluetooth/hci_uart.ko \
+	$(LINUX_DIR)/drivers/bluetooth/btusb.ko \
+	$(LINUX_DIR)/drivers/bluetooth/btintel.ko \
+	$(LINUX_DIR)/drivers/bluetooth/btrtl.ko \
+	$(LINUX_DIR)/drivers/bluetooth/btmtk.ko@ge5.17
+  AUTOLOAD:=$(call AutoProbe,bluetooth rfcomm bnep hidp hci_uart btusb)
+endef
+
+define KernelPackage/bluetooth/description
+ Kernel support for Bluetooth devices
+endef
+
+$(eval $(call KernelPackage,bluetooth))
+
+define KernelPackage/ath3k
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=ATH3K Kernel Module support
+  DEPENDS:=+kmod-bluetooth +ar3k-firmware
+  KCONFIG:= \
+	CONFIG_BT_ATH3K \
+	CONFIG_BT_HCIUART_ATH3K=y
+  FILES:= \
+	$(LINUX_DIR)/drivers/bluetooth/ath3k.ko
+  AUTOLOAD:=$(call AutoProbe,ath3k)
+endef
+
+define KernelPackage/ath3k/description
+ Kernel support for ATH3K Module
+endef
+
+$(eval $(call KernelPackage,ath3k))
+
+
+define KernelPackage/bluetooth-6lowpan
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Bluetooth 6LoWPAN support
+  DEPENDS:=+kmod-6lowpan +kmod-bluetooth
+  KCONFIG:=CONFIG_BT_6LOWPAN
+  FILES:=$(LINUX_DIR)/net/bluetooth/bluetooth_6lowpan.ko
+  AUTOLOAD:=$(call AutoProbe,bluetooth_6lowpan)
+endef
+
+define KernelPackage/bluetooth-6lowpan/description
+ Kernel support for 6LoWPAN over Bluetooth Low Energy devices
+endef
+
+$(eval $(call KernelPackage,bluetooth-6lowpan))
+
+
+define KernelPackage/btmrvl
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Marvell Bluetooth Kernel Module support
+  DEPENDS:=+kmod-mmc +kmod-bluetooth +mwifiex-sdio-firmware
+  KCONFIG:= \
+	CONFIG_BT_MRVL \
+	CONFIG_BT_MRVL_SDIO
+  FILES:= \
+	$(LINUX_DIR)/drivers/bluetooth/btmrvl.ko \
+	$(LINUX_DIR)/drivers/bluetooth/btmrvl_sdio.ko
+  AUTOLOAD:=$(call AutoProbe,btmrvl btmrvl_sdio)
+endef
+
+define KernelPackage/btmrvl/description
+ Kernel support for Marvell SDIO Bluetooth Module
+endef
+
+$(eval $(call KernelPackage,btmrvl))
+
+
+define KernelPackage/btsdio
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Bluetooth HCI SDIO driver
+  DEPENDS:=+kmod-bluetooth +kmod-mmc
+  KCONFIG:= \
+	CONFIG_BT_HCIBTSDIO
+  FILES:= \
+	$(LINUX_DIR)/drivers/bluetooth/btsdio.ko
+  AUTOLOAD:=$(call AutoProbe,btsdio)
+endef
+
+define KernelPackage/btsdio/description
+ Kernel support for Bluetooth device with SDIO interface
+endef
+
+$(eval $(call KernelPackage,btsdio))
+
+
+#define KernelPackage/dma-buf
+#  SUBMENU:=$(OTHER_MENU)
+#  TITLE:=DMA shared buffer support
+#  HIDDEN:=1
+#  KCONFIG:=CONFIG_DMA_SHARED_BUFFER
+#  ifeq ($(strip $(CONFIG_EXTERNAL_KERNEL_TREE)),"")
+#    ifeq ($(strip $(CONFIG_KERNEL_GIT_CLONE_URI)),"")
+#      FILES:=$(LINUX_DIR)/drivers/dma-buf/dma-shared-buffer.ko
+#    endif
+#  endif
+#  AUTOLOAD:=$(call AutoLoad,20,dma-shared-buffer)
+#endef
+#$(eval $(call KernelPackage,dma-buf))
+
+
+define KernelPackage/eeprom-93cx6
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=EEPROM 93CX6 support
+  KCONFIG:=CONFIG_EEPROM_93CX6
+  FILES:=$(LINUX_DIR)/drivers/misc/eeprom/eeprom_93cx6.ko
+  AUTOLOAD:=$(call AutoLoad,20,eeprom_93cx6)
+endef
+
+define KernelPackage/eeprom-93cx6/description
+ Kernel module for EEPROM 93CX6 support
+endef
+
+$(eval $(call KernelPackage,eeprom-93cx6))
+
+
+define KernelPackage/eeprom-at24
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=EEPROM AT24 support
+  KCONFIG:=CONFIG_EEPROM_AT24
+  DEPENDS:=+kmod-i2c-core +kmod-regmap-i2c
+  FILES:=$(LINUX_DIR)/drivers/misc/eeprom/at24.ko
+  AUTOLOAD:=$(call AutoProbe,at24)
+endef
+
+define KernelPackage/eeprom-at24/description
+ Kernel module for most I2C EEPROMs
+endef
+
+$(eval $(call KernelPackage,eeprom-at24))
+
+
+define KernelPackage/eeprom-at25
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=EEPROM AT25 support
+  KCONFIG:=CONFIG_EEPROM_AT25
+  FILES:=$(LINUX_DIR)/drivers/misc/eeprom/at25.ko
+  AUTOLOAD:=$(call AutoProbe,at25)
+endef
+
+define KernelPackage/eeprom-at25/description
+ Kernel module for most SPI EEPROMs
+endef
+
+$(eval $(call KernelPackage,eeprom-at25))
+
+
+define KernelPackage/google-firmware
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Google firmware drivers (Coreboot, VPD, Memconsole)
+  KCONFIG:= \
+	CONFIG_GOOGLE_FIRMWARE=y \
+	CONFIG_GOOGLE_COREBOOT_TABLE \
+	CONFIG_GOOGLE_MEMCONSOLE \
+	CONFIG_GOOGLE_MEMCONSOLE_COREBOOT \
+	CONFIG_GOOGLE_VPD
+  FILES:= \
+	  $(LINUX_DIR)/drivers/firmware/google/coreboot_table.ko \
+	  $(LINUX_DIR)/drivers/firmware/google/memconsole.ko \
+	  $(LINUX_DIR)/drivers/firmware/google/memconsole-coreboot.ko \
+	  $(LINUX_DIR)/drivers/firmware/google/vpd-sysfs.ko
+  AUTOLOAD:=$(call AutoProbe,coreboot_table memconsole-coreboot vpd-sysfs)
+endef
+
+define KernelPackage/google-firmware/description
+  Kernel modules for Google firmware drivers. Useful for examining firmware and
+  boot details on devices using a Google bootloader based on Coreboot. Provides
+  files like /sys/firmware/log and /sys/firmware/vpd.
+endef
+
+$(eval $(call KernelPackage,google-firmware))
+
+
+define KernelPackage/lkdtm
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Linux Kernel Dump Test Tool Module
+  KCONFIG:=CONFIG_LKDTM
+  FILES:=$(LINUX_DIR)/drivers/misc/lkdtm/lkdtm.ko
+  AUTOLOAD:=$(call AutoProbe,lkdtm)
+endef
+
+define KernelPackage/lkdtm/description
+ This module enables testing of the different dumping mechanisms by inducing
+ system failures at predefined crash points.
+endef
+
+$(eval $(call KernelPackage,lkdtm))
+
+
+define KernelPackage/mlx_wdt
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Mellanox Watchdog
+  DEPENDS:=@TARGET_x86 +kmod-regmap-core
+  KCONFIG:= \
+	CONFIG_MELLANOX_PLATFORM=y \
+	CONFIG_MLX_WDT
+  FILES:=$(LINUX_DIR)/drivers/watchdog/mlx_wdt.ko
+  AUTOLOAD:=$(call AutoProbe,mlx_wdt)
+endef
+
+define KernelPackage/mlx_wdt/description
+  This is the driver for the hardware watchdog on Mellanox systems.
+  This driver can be used together with the watchdog daemon.
+  It can also watch your kernel to make sure it doesn't freeze,
+  and if it does, it reboots your system after a certain amount of
+  time.
+endef
+
+$(eval $(call KernelPackage,mlx_wdt))
+
+
+define KernelPackage/mlxreg
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Mellanox platform register access
+  DEPENDS:=@TARGET_x86 +kmod-i2c-mux-mlxcpld
+  KCONFIG:= \
+	CONFIG_MELLANOX_PLATFORM=y \
+	CONFIG_MLX_PLATFORM \
+	CONFIG_MLXREG_HOTPLUG \
+	CONFIG_MLXREG_IO \
+	CONFIG_SENSORS_MLXREG_FAN \
+	CONFIG_LEDS_MLXREG
+  FILES:= \
+	$(LINUX_DIR)/drivers/platform/x86/mlx-platform.ko \
+	$(LINUX_DIR)/drivers/platform/mellanox/mlxreg-hotplug.ko \
+	$(LINUX_DIR)/drivers/platform/mellanox/mlxreg-io.ko \
+	$(LINUX_DIR)/drivers/hwmon/mlxreg-fan.ko \
+	$(LINUX_DIR)/drivers/leds/leds-mlxreg.ko
+  AUTOLOAD:=$(call AutoProbe,mlx-platform mlxreg-hotplug mlxreg-io mlxreg-fan leds-mlxreg)
+endef
+
+define KernelPackage/mlxreg/description
+  Allows access to Mellanox programmable device register
+  space through sysfs interface. The sets of registers for sysfs access
+  are defined per system type bases and include the registers related
+  to system resets operation, system reset causes monitoring and some
+  kinds of mux selection.
+endef
+
+$(eval $(call KernelPackage,mlxreg))
+
+
+define KernelPackage/mlxreg-lc
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Mellanox line card platform support
+  DEPENDS:=kmod-mlxreg +kmod-regmap-i2c
+  KCONFIG:=CONFIG_MLXREG_LC
+  FILES:=$(LINUX_DIR)/drivers/platform/mellanox/mlxreg-lc.ko
+  AUTOLOAD:=$(call AutoProbe,mlxreg-lc)
+endef
+
+define KernelPackage/mlxreg-lc/description
+  Provides support for the Mellanox MSN4800-XX line cards,
+  which are the part of MSN4800 Ethernet modular switch systems.
+endef
+
+$(eval $(call KernelPackage,mlxreg-lc))
+
+
+define KernelPackage/mlxreg-sn2201
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Nvidia SN2201 platform support
+  DEPENDS:=kmod-mlxreg +kmod-regmap-i2c
+  KCONFIG:=CONFIG_NVSW_SN2201
+  FILES:=$(LINUX_DIR)/drivers/platform/mellanox/nvsw-sn2201.ko
+  AUTOLOAD:=$(call AutoProbe,nvsw-sn2201)
+endef
+
+define KernelPackage/mlxreg-sn2201/description
+  Provides support for the Nvidia SN2201 platform.
+endef
+
+$(eval $(call KernelPackage,mlxreg-sn2201))
+
+
+define KernelPackage/pinctrl-mcp23s08
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Microchip MCP23xxx I/O expander
+  HIDDEN:=1
+  DEPENDS:=@GPIO_SUPPORT +kmod-regmap-core
+  KCONFIG:=CONFIG_PINCTRL_MCP23S08
+  FILES:=$(LINUX_DIR)/drivers/pinctrl/pinctrl-mcp23s08.ko
+  AUTOLOAD:=$(call AutoLoad,40,pinctrl-mcp23s08)
+endef
+
+define KernelPackage/pinctrl-mcp23s08/description
+  Kernel module for Microchip MCP23xxx I/O expander
+endef
+
+$(eval $(call KernelPackage,pinctrl-mcp23s08))
+
+
+define KernelPackage/pinctrl-mcp23s08-i2c
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Microchip MCP23xxx I/O expander (I2C)
+  DEPENDS:=@GPIO_SUPPORT \
+	+kmod-pinctrl-mcp23s08 \
+	+kmod-i2c-core \
+	+kmod-regmap-i2c
+  KCONFIG:=CONFIG_PINCTRL_MCP23S08_I2C
+  FILES:=$(LINUX_DIR)/drivers/pinctrl/pinctrl-mcp23s08_i2c.ko
+  AUTOLOAD:=$(call AutoLoad,40,pinctrl-mcp23s08-i2c)
+endef
+
+define KernelPackage/pinctrl-mcp23s08-i2c/description
+  Kernel module for Microchip MCP23xxx I/O expander via I2C
+endef
+
+$(eval $(call KernelPackage,pinctrl-mcp23s08-i2c))
+
+
+define KernelPackage/pinctrl-mcp23s08-spi
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Microchip MCP23xxx I/O expander (SPI)
+  DEPENDS:=@GPIO_SUPPORT +kmod-pinctrl-mcp23s08
+  KCONFIG:=CONFIG_PINCTRL_MCP23S08_SPI
+  FILES:=$(LINUX_DIR)/drivers/pinctrl/pinctrl-mcp23s08_spi.ko
+  AUTOLOAD:=$(call AutoLoad,40,pinctrl-mcp23s08-spi)
+endef
+
+define KernelPackage/pinctrl-mcp23s08-spi/description
+  Kernel module for Microchip MCP23xxx I/O expander via SPI
+endef
+
+$(eval $(call KernelPackage,pinctrl-mcp23s08-spi))
+
+
+define KernelPackage/ppdev
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Parallel port support
+  KCONFIG:= \
+	CONFIG_PARPORT \
+	CONFIG_PPDEV
+  FILES:= \
+	$(LINUX_DIR)/drivers/parport/parport.ko \
+	$(LINUX_DIR)/drivers/char/ppdev.ko
+  AUTOLOAD:=$(call AutoLoad,50,parport ppdev)
+endef
+
+$(eval $(call KernelPackage,ppdev))
+
+
+define KernelPackage/parport-pc
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Parallel port interface (PC-style) support
+  DEPENDS:=+kmod-ppdev
+  KCONFIG:= \
+	CONFIG_KS0108=n \
+	CONFIG_PARPORT_PC \
+	CONFIG_PARPORT_1284=y \
+	CONFIG_PARPORT_PC_FIFO=y \
+	CONFIG_PARPORT_PC_PCMCIA=n \
+	CONFIG_PARPORT_PC_SUPERIO=y \
+	CONFIG_PARPORT_SERIAL=n \
+	CONFIG_PARIDE=n \
+	CONFIG_SCSI_IMM=n \
+	CONFIG_SCSI_PPA=n
+  FILES:= \
+	$(LINUX_DIR)/drivers/parport/parport_pc.ko
+  AUTOLOAD:=$(call AutoLoad,51,parport_pc)
+endef
+
+$(eval $(call KernelPackage,parport-pc))
+
+
+define KernelPackage/lp
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Parallel port line printer device support
+  DEPENDS:=+kmod-ppdev
+  KCONFIG:= \
+	CONFIG_PRINTER
+  FILES:= \
+	$(LINUX_DIR)/drivers/char/lp.ko
+  AUTOLOAD:=$(call AutoLoad,52,lp)
+endef
+
+$(eval $(call KernelPackage,lp))
+
+
+define KernelPackage/mmc
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=MMC/SD Card Support
+  DEPENDS:=@!TARGET_uml
+  KCONFIG:= \
+	CONFIG_MMC \
+	CONFIG_MMC_BLOCK \
+	CONFIG_MMC_DEBUG=n \
+	CONFIG_MMC_UNSAFE_RESUME=n \
+	CONFIG_MMC_TIFM_SD=n \
+	CONFIG_MMC_WBSD=n \
+	CONFIG_SDIO_UART=n
+  FILES:= \
+	$(LINUX_DIR)/drivers/mmc/core/mmc_core.ko \
+	$(LINUX_DIR)/drivers/mmc/core/mmc_block.ko
+  AUTOLOAD:=$(call AutoProbe,mmc_core mmc_block,1)
+endef
+
+define KernelPackage/mmc/description
+ Kernel support for MMC/SD cards
+endef
+
+$(eval $(call KernelPackage,mmc))
+
+
+define KernelPackage/sdhci
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Secure Digital Host Controller Interface support
+  DEPENDS:=+kmod-mmc
+  KCONFIG:= \
+	CONFIG_MMC_SDHCI \
+	CONFIG_MMC_SDHCI_PLTFM \
+	CONFIG_MMC_SDHCI_PCI=n
+  FILES:= \
+	$(LINUX_DIR)/drivers/mmc/host/sdhci.ko \
+	$(LINUX_DIR)/drivers/mmc/host/sdhci-pltfm.ko
+
+  AUTOLOAD:=$(call AutoProbe,sdhci-pltfm,1)
+endef
+
+define KernelPackage/sdhci/description
+ Kernel support for SDHCI Hosts
+endef
+
+$(eval $(call KernelPackage,sdhci))
+
+
+define KernelPackage/rfkill
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=RF switch subsystem support
+  DEPENDS:=@USE_RFKILL +kmod-input-core
+  KCONFIG:= \
+    CONFIG_RFKILL_FULL \
+    CONFIG_RFKILL_INPUT=y \
+    CONFIG_RFKILL_LEDS=y
+  FILES:= \
+    $(LINUX_DIR)/net/rfkill/rfkill.ko
+  AUTOLOAD:=$(call AutoLoad,20,rfkill)
+endef
+
+define KernelPackage/rfkill/description
+ Say Y here if you want to have control over RF switches
+ found on many WiFi and Bluetooth cards
+endef
+
+$(eval $(call KernelPackage,rfkill))
+
+
+define KernelPackage/softdog
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Software watchdog driver
+  KCONFIG:=CONFIG_SOFT_WATCHDOG \
+  	CONFIG_SOFT_WATCHDOG_PRETIMEOUT=n
+  FILES:=$(LINUX_DIR)/drivers/$(WATCHDOG_DIR)/softdog.ko
+  AUTOLOAD:=$(call AutoLoad,50,softdog,1)
+endef
+
+define KernelPackage/softdog/description
+ Software watchdog driver
+endef
+
+$(eval $(call KernelPackage,softdog))
+
+
+define KernelPackage/ssb
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Silicon Sonics Backplane glue code
+  DEPENDS:=@PCI_SUPPORT @!TARGET_bcm47xx @!TARGET_bcm63xx
+  KCONFIG:=\
+	CONFIG_SSB \
+	CONFIG_SSB_B43_PCI_BRIDGE=y \
+	CONFIG_SSB_DRIVER_MIPS=n \
+	CONFIG_SSB_DRIVER_PCICORE=y \
+	CONFIG_SSB_DRIVER_PCICORE_POSSIBLE=y \
+	CONFIG_SSB_FALLBACK_SPROM=y \
+	CONFIG_SSB_PCIHOST=y \
+	CONFIG_SSB_PCIHOST_POSSIBLE=y \
+	CONFIG_SSB_POSSIBLE=y \
+	CONFIG_SSB_SPROM=y \
+	CONFIG_SSB_SILENT=y
+  FILES:=$(LINUX_DIR)/drivers/ssb/ssb.ko
+  AUTOLOAD:=$(call AutoLoad,18,ssb,1)
+endef
+
+define KernelPackage/ssb/description
+ Silicon Sonics Backplane glue code.
+endef
+
+$(eval $(call KernelPackage,ssb))
+
+
+define KernelPackage/bcma
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=BCMA support
+  DEPENDS:=@PCI_SUPPORT @!TARGET_bcm47xx @!TARGET_bcm53xx
+  KCONFIG:=\
+	CONFIG_BCMA \
+	CONFIG_BCMA_POSSIBLE=y \
+	CONFIG_BCMA_BLOCKIO=y \
+	CONFIG_BCMA_FALLBACK_SPROM=y \
+	CONFIG_BCMA_HOST_PCI_POSSIBLE=y \
+	CONFIG_BCMA_HOST_PCI=y \
+	CONFIG_BCMA_HOST_SOC=n \
+	CONFIG_BCMA_DRIVER_MIPS=n \
+	CONFIG_BCMA_DRIVER_PCI_HOSTMODE=n \
+	CONFIG_BCMA_DRIVER_GMAC_CMN=n \
+	CONFIG_BCMA_DEBUG=n
+  FILES:=$(LINUX_DIR)/drivers/bcma/bcma.ko
+  AUTOLOAD:=$(call AutoLoad,29,bcma)
+endef
+
+define KernelPackage/bcma/description
+ Bus driver for Broadcom specific Advanced Microcontroller Bus Architecture
+endef
+
+$(eval $(call KernelPackage,bcma))
+
+
+define KernelPackage/mfd
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Multifunction device drivers
+  HIDDEN:=1
+  KCONFIG:=CONFIG_MFD_CORE
+  FILES:=$(LINUX_DIR)/drivers/mfd/mfd-core.ko
+  AUTOLOAD:=$(call AutoLoad,10,mfd-core)
+endef
+
+$(eval $(call KernelPackage,mfd))
+
+
+define KernelPackage/mtdtests
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=MTD subsystem tests
+  KCONFIG:=CONFIG_MTD_TESTS
+  FILES:=\
+	$(LINUX_DIR)/drivers/mtd/tests/mtd_nandbiterrs.ko \
+	$(LINUX_DIR)/drivers/mtd/tests/mtd_nandecctest.ko \
+	$(LINUX_DIR)/drivers/mtd/tests/mtd_oobtest.ko \
+	$(LINUX_DIR)/drivers/mtd/tests/mtd_pagetest.ko \
+	$(LINUX_DIR)/drivers/mtd/tests/mtd_readtest.ko \
+	$(LINUX_DIR)/drivers/mtd/tests/mtd_speedtest.ko \
+	$(LINUX_DIR)/drivers/mtd/tests/mtd_stresstest.ko \
+	$(LINUX_DIR)/drivers/mtd/tests/mtd_subpagetest.ko \
+	$(LINUX_DIR)/drivers/mtd/tests/mtd_test.ko@ge6.1 \
+	$(LINUX_DIR)/drivers/mtd/tests/mtd_torturetest.ko
+endef
+
+define KernelPackage/mtdtests/description
+ Kernel modules for MTD subsystem/driver testing
+endef
+
+$(eval $(call KernelPackage,mtdtests))
+
+
+define KernelPackage/mtdoops
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Log panic/oops to an MTD buffer
+  KCONFIG:=CONFIG_MTD_OOPS
+  FILES:=$(LINUX_DIR)/drivers/mtd/mtdoops.ko
+endef
+
+define KernelPackage/mtdoops/description
+ Kernel modules for Log panic/oops to an MTD buffer
+endef
+
+$(eval $(call KernelPackage,mtdoops))
+
+
+define KernelPackage/mtdram
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Test MTD driver using RAM
+  KCONFIG:=CONFIG_MTD_MTDRAM \
+    CONFIG_MTDRAM_TOTAL_SIZE=4096 \
+    CONFIG_MTDRAM_ERASE_SIZE=128
+  FILES:=$(LINUX_DIR)/drivers/mtd/devices/mtdram.ko
+endef
+
+define KernelPackage/mtdram/description
+  Test MTD driver using RAM
+endef
+
+$(eval $(call KernelPackage,mtdram))
+
+
+define KernelPackage/ramoops
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Ramoops (pstore-ram)
+  DEFAULT:=m if ALL_KMODS
+  KCONFIG:=CONFIG_PSTORE_RAM \
+	CONFIG_PSTORE_CONSOLE=y
+  DEPENDS:=+kmod-pstore +kmod-reed-solomon
+  FILES:= $(LINUX_DIR)/fs/pstore/ramoops.ko
+  AUTOLOAD:=$(call AutoLoad,30,ramoops,1)
+endef
+
+define KernelPackage/ramoops/description
+ Kernel module for pstore-ram (ramoops) crash log storage
+endef
+
+$(eval $(call KernelPackage,ramoops))
+
+
+define KernelPackage/reed-solomon
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Reed-Solomon error correction
+  DEFAULT:=m if ALL_KMODS
+  KCONFIG:=CONFIG_REED_SOLOMON \
+	CONFIG_REED_SOLOMON_DEC8=y \
+	CONFIG_REED_SOLOMON_ENC8=y
+  FILES:= $(LINUX_DIR)/lib/reed_solomon/reed_solomon.ko
+  AUTOLOAD:=$(call AutoLoad,30,reed_solomon,1)
+endef
+
+define KernelPackage/reed-solomon/description
+ Kernel module for Reed-Solomon error correction
+endef
+
+$(eval $(call KernelPackage,reed-solomon))
+
+
+define KernelPackage/serial-8250
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=8250 UARTs
+  KCONFIG:= CONFIG_SERIAL_8250 \
+	CONFIG_SERIAL_8250_PCI \
+	CONFIG_SERIAL_8250_NR_UARTS=16 \
+	CONFIG_SERIAL_8250_RUNTIME_UARTS=16 \
+	CONFIG_SERIAL_8250_EXTENDED=y \
+	CONFIG_SERIAL_8250_MANY_PORTS=y \
+	CONFIG_SERIAL_8250_SHARE_IRQ=y \
+	CONFIG_SERIAL_8250_DETECT_IRQ=n \
+	CONFIG_SERIAL_8250_RSA=n
+  FILES:= \
+	$(LINUX_DIR)/drivers/tty/serial/8250/8250.ko \
+	$(LINUX_DIR)/drivers/tty/serial/8250/8250_base.ko \
+	$(if $(CONFIG_PCI),$(LINUX_DIR)/drivers/tty/serial/8250/8250_pci.ko) \
+	$(if $(CONFIG_GPIOLIB),$(LINUX_DIR)/drivers/tty/serial/serial_mctrl_gpio.ko)
+  AUTOLOAD:=$(call AutoProbe,8250 8250_base 8250_pci)
+endef
+
+define KernelPackage/serial-8250/description
+ Kernel module for 8250 UART based serial ports
+endef
+
+$(eval $(call KernelPackage,serial-8250))
+
+
+define KernelPackage/serial-8250-exar
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Exar 8250 UARTs
+  KCONFIG:= CONFIG_SERIAL_8250_EXAR
+  FILES:=$(LINUX_DIR)/drivers/tty/serial/8250/8250_exar.ko
+  AUTOLOAD:=$(call AutoProbe,8250 8250_base 8250_exar)
+  DEPENDS:=@PCI_SUPPORT +kmod-serial-8250
+endef
+
+define KernelPackage/serial-8250-exar/description
+ Kernel module for Exar serial ports
+endef
+
+$(eval $(call KernelPackage,serial-8250-exar))
+
+
+define KernelPackage/regmap-core
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Generic register map support
+  HIDDEN:=1
+  KCONFIG:=CONFIG_REGMAP
+ifneq ($(wildcard $(LINUX_DIR)/drivers/base/regmap/regmap-core.ko),)
+  FILES:=$(LINUX_DIR)/drivers/base/regmap/regmap-core.ko
+endif
+endef
+
+define KernelPackage/regmap-core/description
+ Generic register map support
+endef
+
+$(eval $(call KernelPackage,regmap-core))
+
+
+define KernelPackage/regmap-spi
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=SPI register map support
+  DEPENDS:=+kmod-regmap-core
+  HIDDEN:=1
+  KCONFIG:=CONFIG_REGMAP_SPI \
+	   CONFIG_SPI=y
+  FILES:=$(LINUX_DIR)/drivers/base/regmap/regmap-spi.ko
+endef
+
+define KernelPackage/regmap-spi/description
+ SPI register map support
+endef
+
+$(eval $(call KernelPackage,regmap-spi))
+
+
+define KernelPackage/regmap-i2c
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=I2C register map support
+  DEPENDS:=+kmod-regmap-core +kmod-i2c-core
+  HIDDEN:=1
+  KCONFIG:=CONFIG_REGMAP_I2C
+  FILES:=$(LINUX_DIR)/drivers/base/regmap/regmap-i2c.ko
+endef
+
+define KernelPackage/regmap-i2c/description
+ I2C register map support
+endef
+
+$(eval $(call KernelPackage,regmap-i2c))
+
+
+define KernelPackage/regmap-mmio
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=MMIO register map support
+  DEPENDS:=+kmod-regmap-core
+  HIDDEN:=1
+  KCONFIG:=CONFIG_REGMAP_MMIO
+  FILES:=$(LINUX_DIR)/drivers/base/regmap/regmap-mmio.ko
+endef
+
+define KernelPackage/regmap-mmio/description
+ MMIO register map support
+endef
+
+$(eval $(call KernelPackage,regmap-mmio))
+
+
+define KernelPackage/ikconfig
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Kernel configuration via /proc/config.gz
+  KCONFIG:=CONFIG_IKCONFIG \
+	   CONFIG_IKCONFIG_PROC=y
+  FILES:=$(LINUX_DIR)/kernel/configs.ko
+  AUTOLOAD:=$(call AutoLoad,70,configs)
+endef
+
+define KernelPackage/ikconfig/description
+ Kernel configuration via /proc/config.gz
+endef
+
+$(eval $(call KernelPackage,ikconfig))
+
+
+define KernelPackage/zram
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=ZRAM
+  KCONFIG:= \
+	CONFIG_ZSMALLOC \
+	CONFIG_ZRAM \
+	CONFIG_ZRAM_DEBUG=n \
+	CONFIG_ZRAM_WRITEBACK=n \
+	CONFIG_ZSMALLOC_STAT=n
+  FILES:= \
+	$(LINUX_DIR)/mm/zsmalloc.ko \
+	$(LINUX_DIR)/drivers/block/zram/zram.ko
+  AUTOLOAD:=$(call AutoLoad,20,zsmalloc zram)
+endef
+
+define KernelPackage/zram/description
+ Compressed RAM block device support
+endef
+
+define KernelPackage/zram/config
+  if PACKAGE_kmod-zram
+    choice
+      prompt "ZRAM Default compressor"
+      default ZRAM_DEF_COMP_LZORLE
+
+    config ZRAM_DEF_COMP_LZORLE
+            bool "lzo-rle"
+            select PACKAGE_kmod-lib-lzo
+
+    config ZRAM_DEF_COMP_LZO
+            bool "lzo"
+            select PACKAGE_kmod-lib-lzo
+
+    config ZRAM_DEF_COMP_LZ4
+            bool "lz4"
+            select PACKAGE_kmod-lib-lz4
+
+    config ZRAM_DEF_COMP_LZ4HC
+            bool "lz4-hc"
+            select PACKAGE_kmod-lib-lz4hc
+
+    config ZRAM_DEF_COMP_ZSTD
+            bool "zstd"
+            select PACKAGE_kmod-lib-zstd
+
+    endchoice
+  endif
+endef
+
+$(eval $(call KernelPackage,zram))
+
+define KernelPackage/pps
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=PPS support
+  KCONFIG:=CONFIG_PPS
+  FILES:=$(LINUX_DIR)/drivers/pps/pps_core.ko
+  AUTOLOAD:=$(call AutoLoad,17,pps_core,1)
+endef
+
+define KernelPackage/pps/description
+ PPS (Pulse Per Second) is a special pulse provided by some GPS
+ antennae. Userland can use it to get a high-precision time
+ reference.
+endef
+
+$(eval $(call KernelPackage,pps))
+
+
+define KernelPackage/pps-gpio
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=PPS client using GPIO
+  DEPENDS:=+kmod-pps
+  KCONFIG:=CONFIG_PPS_CLIENT_GPIO
+  FILES:=$(LINUX_DIR)/drivers/pps/clients/pps-gpio.ko
+  AUTOLOAD:=$(call AutoLoad,18,pps-gpio,1)
+endef
+
+define KernelPackage/pps-gpio/description
+ Support for a PPS source using GPIO. To be useful you must
+ also register a platform device specifying the GPIO pin and
+ other options, usually in your board setup.
+endef
+
+$(eval $(call KernelPackage,pps-gpio))
+
+
+define KernelPackage/pps-ldisc
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=PPS line discipline
+  DEPENDS:=+kmod-pps
+  KCONFIG:=CONFIG_PPS_CLIENT_LDISC
+  FILES:=$(LINUX_DIR)/drivers/pps/clients/pps-ldisc.ko
+  AUTOLOAD:=$(call AutoLoad,18,pps-ldisc,1)
+endef
+
+define KernelPackage/pps-ldisc/description
+ Support for a PPS source connected with the CD (Carrier
+ Detect) pin of your serial port.
+endef
+
+$(eval $(call KernelPackage,pps-ldisc))
+
+
+define KernelPackage/ptp
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=PTP clock support
+  DEPENDS:=+kmod-pps
+  KCONFIG:= \
+	CONFIG_PTP_1588_CLOCK \
+	CONFIG_NET_PTP_CLASSIFY=y
+  FILES:=$(LINUX_DIR)/drivers/ptp/ptp.ko
+  AUTOLOAD:=$(call AutoLoad,18,ptp,1)
+endef
+
+define KernelPackage/ptp/description
+ The IEEE 1588 standard defines a method to precisely
+ synchronize distributed clocks over Ethernet networks.
+endef
+
+$(eval $(call KernelPackage,ptp))
+
+
+define KernelPackage/ptp-qoriq
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Freescale QorIQ PTP support
+  DEPENDS:=@(TARGET_mpc85xx||TARGET_qoriq) +kmod-ptp
+  KCONFIG:=CONFIG_PTP_1588_CLOCK_QORIQ
+  FILES:=$(LINUX_DIR)/drivers/ptp/ptp-qoriq.ko
+  AUTOLOAD:=$(call AutoProbe,ptp-qoriq)
+endef
+
+
+define KernelPackage/ptp-qoriq/description
+ Kernel module for IEEE 1588 support for Freescale
+ QorIQ Ethernet drivers
+endef
+
+$(eval $(call KernelPackage,ptp-qoriq))
+
+define KernelPackage/random-core
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Hardware Random Number Generator Core support
+  KCONFIG:=CONFIG_HW_RANDOM
+  FILES:=$(LINUX_DIR)/drivers/char/hw_random/rng-core.ko
+endef
+
+define KernelPackage/random-core/description
+ Kernel module for the HW random number generator core infrastructure
+endef
+
+$(eval $(call KernelPackage,random-core))
+
+
+define KernelPackage/thermal
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Thermal driver
+  DEPENDS:=+kmod-hwmon-core
+  HIDDEN:=1
+  KCONFIG:= \
+	CONFIG_THERMAL=y \
+	CONFIG_THERMAL_OF=y \
+	CONFIG_CPU_THERMAL=y \
+	CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y \
+	CONFIG_THERMAL_DEFAULT_GOV_FAIR_SHARE=n \
+	CONFIG_THERMAL_DEFAULT_GOV_USER_SPACE=n \
+	CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0 \
+	CONFIG_THERMAL_GOV_FAIR_SHARE=n \
+	CONFIG_THERMAL_GOV_STEP_WISE=y \
+	CONFIG_THERMAL_GOV_USER_SPACE=n \
+	CONFIG_THERMAL_HWMON=y \
+	CONFIG_THERMAL_EMULATION=n
+endef
+
+define KernelPackage/thermal/description
+ Thermal driver offers a generic mechanism for thermal management.
+ Usually it's made up of one or more thermal zone and cooling device.
+endef
+
+$(eval $(call KernelPackage,thermal))
+
+
+define KernelPackage/echo
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Line Echo Canceller
+  KCONFIG:=CONFIG_ECHO
+  FILES:=$(LINUX_DIR)/drivers/misc/echo/echo.ko
+  AUTOLOAD:=$(call AutoLoad,50,echo)
+endef
+
+define KernelPackage/echo/description
+ This driver provides line echo cancelling support for mISDN and
+ DAHDI drivers
+endef
+
+$(eval $(call KernelPackage,echo))
+
+
+define KernelPackage/keys-encrypted
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=encrypted keys on kernel keyring
+  DEPENDS:=@KERNEL_KEYS +kmod-crypto-cbc +kmod-crypto-hmac +kmod-crypto-rng \
+           +kmod-crypto-sha256 +kmod-keys-trusted
+  KCONFIG:=CONFIG_ENCRYPTED_KEYS
+  FILES:=$(LINUX_DIR)/security/keys/encrypted-keys/encrypted-keys.ko
+  AUTOLOAD:=$(call AutoLoad,01,encrypted-keys,1)
+endef
+
+define KernelPackage/keys-encrypted/description
+	This module provides support for create/encrypting/decrypting keys
+	in the kernel.  Encrypted keys are kernel generated random numbers,
+	which are encrypted/decrypted with a 'master' symmetric key. The
+	'master' key can be either a trusted-key or user-key type.
+	Userspace only ever sees/stores encrypted blobs.
+endef
+
+$(eval $(call KernelPackage,keys-encrypted))
+
+
+define KernelPackage/keys-trusted
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=TPM trusted keys on kernel keyring
+  DEPENDS:=@KERNEL_KEYS +kmod-crypto-hash +kmod-crypto-hmac +kmod-crypto-sha1 +kmod-tpm
+  KCONFIG:=CONFIG_TRUSTED_KEYS
+  FILES:= $(LINUX_DIR)/security/keys/trusted-keys/trusted.ko
+  AUTOLOAD:=$(call AutoLoad,01,trusted-keys,1)
+endef
+
+define KernelPackage/keys-trusted/description
+	This module provides support for creating, sealing, and unsealing
+	keys in the kernel. Trusted keys are random number symmetric keys,
+	generated and RSA-sealed by the TPM. The TPM only unseals the keys,
+	if the boot PCRs and other criteria match.  Userspace will only ever
+	see encrypted blobs.
+endef
+
+$(eval $(call KernelPackage,keys-trusted))
+
+
+define KernelPackage/tpm
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=TPM Hardware Support
+  DEPENDS:= +kmod-random-core +kmod-asn1-decoder \
+	  +kmod-asn1-encoder +kmod-oid-registry
+  KCONFIG:= CONFIG_TCG_TPM
+  FILES:= $(LINUX_DIR)/drivers/char/tpm/tpm.ko
+  AUTOLOAD:=$(call AutoLoad,10,tpm,1)
+endef
+
+define KernelPackage/tpm/description
+	This enables TPM Hardware Support.
+endef
+
+$(eval $(call KernelPackage,tpm))
+
+define KernelPackage/tpm-tis
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=TPM TIS 1.2 Interface / TPM 2.0 FIFO Interface
+	DEPENDS:= @TARGET_x86 +kmod-tpm
+  KCONFIG:= CONFIG_TCG_TIS
+  FILES:= \
+	$(LINUX_DIR)/drivers/char/tpm/tpm_tis.ko \
+	$(LINUX_DIR)/drivers/char/tpm/tpm_tis_core.ko
+  AUTOLOAD:=$(call AutoLoad,20,tpm_tis,1)
+endef
+
+define KernelPackage/tpm-tis/description
+	If you have a TPM security chip that is compliant with the
+	TCG TIS 1.2 TPM specification (TPM1.2) or the TCG PTP FIFO
+	specification (TPM2.0) say Yes and it will be accessible from
+	within Linux.
+endef
+
+$(eval $(call KernelPackage,tpm-tis))
+
+define KernelPackage/tpm-i2c-atmel
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=TPM I2C Atmel Support
+  DEPENDS:= +kmod-tpm +kmod-i2c-core
+  KCONFIG:= CONFIG_TCG_TIS_I2C_ATMEL
+  FILES:= $(LINUX_DIR)/drivers/char/tpm/tpm_i2c_atmel.ko
+  AUTOLOAD:=$(call AutoLoad,40,tpm_i2c_atmel,1)
+endef
+
+define KernelPackage/tpm-i2c-atmel/description
+	This enables the TPM Interface Specification 1.2 Interface (I2C - Atmel)
+endef
+
+$(eval $(call KernelPackage,tpm-i2c-atmel))
+
+define KernelPackage/tpm-i2c-infineon
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:= TPM I2C Infineon driver
+  DEPENDS:= +kmod-tpm +kmod-i2c-core
+  KCONFIG:= CONFIG_TCG_TIS_I2C_INFINEON
+  FILES:= $(LINUX_DIR)/drivers/char/tpm/tpm_i2c_infineon.ko
+  AUTOLOAD:= $(call AutoLoad,40,tpm_i2c_infineon,1)
+endef
+
+define KernelPackage/tpm-i2c-infineon/description
+	This enables the TPM Interface Specification 1.2 Interface (I2C - Infineon)
+endef
+
+$(eval $(call KernelPackage,tpm-i2c-infineon))
+
+
+define KernelPackage/i6300esb-wdt
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Intel 6300ESB Timer/Watchdog
+  DEPENDS:=@PCI_SUPPORT @!SMALL_FLASH
+  KCONFIG:=CONFIG_I6300ESB_WDT \
+	   CONFIG_WATCHDOG_CORE=y
+  FILES:=$(LINUX_DIR)/drivers/$(WATCHDOG_DIR)/i6300esb.ko
+  AUTOLOAD:=$(call AutoLoad,50,i6300esb,1)
+endef
+
+define KernelPackage/i6300esb-wdt/description
+  Kernel module for the watchdog timer built into the Intel
+  6300ESB controller hub. Also used by QEMU/libvirt.
+endef
+
+$(eval $(call KernelPackage,i6300esb-wdt))
+
+
+define KernelPackage/mhi-bus
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=MHI bus
+  KCONFIG:=CONFIG_MHI_BUS \
+           CONFIG_MHI_BUS_DEBUG=y
+  FILES:=$(LINUX_DIR)/drivers/bus/mhi/host/mhi.ko
+  AUTOLOAD:=$(call AutoProbe,mhi)
+endef
+
+define KernelPackage/mhi-bus/description
+  Kernel module for the Qualcomm MHI bus.
+endef
+
+$(eval $(call KernelPackage,mhi-bus))
+
+define KernelPackage/mhi-pci-generic
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=MHI PCI controller driver
+  DEPENDS:=@PCI_SUPPORT +kmod-mhi-bus
+  KCONFIG:=CONFIG_MHI_BUS_PCI_GENERIC
+  FILES:=$(LINUX_DIR)/drivers/bus/mhi/host/mhi_pci_generic.ko
+  AUTOLOAD:=$(call AutoProbe,mhi_pci_generic)
+endef
+
+define KernelPackage/mhi-pci-generic/description
+  Kernel module for the MHI PCI controller driver.
+endef
+
+$(eval $(call KernelPackage,mhi-pci-generic))
diff --git a/6.12/package/kernel/linux/modules/video.mk b/6.12/package/kernel/linux/modules/video.mk
new file mode 100644
index 00000000..d28bb012
--- /dev/null
+++ b/6.12/package/kernel/linux/modules/video.mk
@@ -0,0 +1,1269 @@
+#
+# Copyright (C) 2009 David Cooper <dave@kupesoft.com>
+# Copyright (C) 2006-2010 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+VIDEO_MENU:=Video Support
+
+V4L2_DIR=v4l2-core
+V4L2_USB_DIR=usb
+V4L2_MEM2MEM_DIR=platform
+
+#
+# Video Display
+#
+
+define KernelPackage/acpi-video
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=ACPI Extensions For Display Adapters
+  DEPENDS:=@TARGET_x86||TARGET_loongarch64 +kmod-backlight
+  HIDDEN:=1
+  KCONFIG:=CONFIG_ACPI_VIDEO
+  FILES:=$(LINUX_DIR)/drivers/acpi/video.ko
+  AUTOLOAD:=$(call AutoProbe,video)
+endef
+
+define KernelPackage/acpi-video/description
+  Kernel support for integrated graphics devices.
+endef
+
+define KernelPackage/acpi-video/x86
+  KCONFIG+=CONFIG_ACPI_WMI
+  FILES+=$(LINUX_DIR)/drivers/platform/x86/wmi.ko
+  AUTOLOAD:=$(call AutoProbe,wmi video)
+endef
+
+$(eval $(call KernelPackage,acpi-video))
+
+define KernelPackage/backlight
+	SUBMENU:=$(VIDEO_MENU)
+	TITLE:=Backlight support
+	DEPENDS:=@DISPLAY_SUPPORT
+	HIDDEN:=1
+	KCONFIG:=CONFIG_BACKLIGHT_CLASS_DEVICE \
+		CONFIG_BACKLIGHT_LCD_SUPPORT=y \
+		CONFIG_LCD_CLASS_DEVICE=n \
+		CONFIG_BACKLIGHT_GENERIC=n \
+		CONFIG_BACKLIGHT_ADP8860=n \
+		CONFIG_BACKLIGHT_ADP8870=n \
+		CONFIG_BACKLIGHT_OT200=n \
+		CONFIG_BACKLIGHT_PM8941_WLED=n
+	FILES:=$(LINUX_DIR)/drivers/video/backlight/backlight.ko
+	AUTOLOAD:=$(call AutoProbe,video backlight)
+endef
+
+define KernelPackage/backlight/description
+	Kernel module for Backlight support.
+endef
+
+$(eval $(call KernelPackage,backlight))
+
+define KernelPackage/backlight-pwm
+	SUBMENU:=$(VIDEO_MENU)
+	TITLE:=PWM Backlight support
+	DEPENDS:=+kmod-backlight
+	KCONFIG:=CONFIG_BACKLIGHT_PWM
+	FILES:=$(LINUX_DIR)/drivers/video/backlight/pwm_bl.ko
+	AUTOLOAD:=$(call AutoProbe,video pwm_bl)
+endef
+
+define KernelPackage/backlight-pwm/description
+	Kernel module for PWM based Backlight support.
+endef
+
+$(eval $(call KernelPackage,backlight-pwm))
+
+
+#define KernelPackage/fb
+#  SUBMENU:=$(VIDEO_MENU)
+#  TITLE:=Framebuffer and framebuffer console support
+#  DEPENDS:=@DISPLAY_SUPPORT
+#  KCONFIG:= \
+#	CONFIG_FB \
+#	CONFIG_FB_DEVICE=y \
+#	CONFIG_FB_MXS=n \
+#	CONFIG_FB_SM750=n \
+#	CONFIG_FRAMEBUFFER_CONSOLE=y \
+#	CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y \
+#	CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y \
+#	CONFIG_FONTS=y \
+#	CONFIG_FONT_8x8=y \
+#	CONFIG_FONT_8x16=y \
+#	CONFIG_FONT_6x11=n \
+#	CONFIG_FONT_7x14=n \
+#	CONFIG_FONT_PEARL_8x8=n \
+#	CONFIG_FONT_ACORN_8x8=n \
+#	CONFIG_FONT_MINI_4x6=n \
+#	CONFIG_FONT_6x10=n \
+#	CONFIG_FONT_SUN8x16=n \
+#	CONFIG_FONT_SUN12x22=n \
+#	CONFIG_FONT_10x18=n \
+#	CONFIG_VT=y \
+#	CONFIG_CONSOLE_TRANSLATIONS=y \
+#	CONFIG_VT_CONSOLE=y \
+#	CONFIG_VT_HW_CONSOLE_BINDING=y
+#  FILES:=$(LINUX_DIR)/drivers/video/fbdev/core/fb.ko \
+#	$(LINUX_DIR)/lib/fonts/font.ko \
+#	$(LINUX_DIR)/drivers/video/fbdev/core/fb_io_fops.ko@ge6.6
+#  AUTOLOAD:=$(call AutoLoad,06,fb font)
+#endef
+
+#define KernelPackage/fb/description
+# Kernel support for framebuffers and framebuffer console.
+#endef
+
+#define KernelPackage/fb/x86
+#  FILES+=$(LINUX_DIR)/arch/x86/video/fbdev.ko
+#  AUTOLOAD:=$(call AutoLoad,06,fbdev fb font)
+#endef
+
+#$(eval $(call KernelPackage,fb))
+
+
+define KernelPackage/fb-cfb-fillrect
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=Framebuffer software rectangle filling support
+  DEPENDS:=+kmod-fb
+  KCONFIG:=CONFIG_FB_CFB_FILLRECT
+  FILES:=$(LINUX_DIR)/drivers/video/fbdev/core/cfbfillrect.ko
+  AUTOLOAD:=$(call AutoLoad,07,cfbfillrect)
+endef
+
+define KernelPackage/fb-cfb-fillrect/description
+ Kernel support for software rectangle filling
+endef
+
+$(eval $(call KernelPackage,fb-cfb-fillrect))
+
+
+define KernelPackage/fb-cfb-copyarea
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=Framebuffer software copy area support
+  DEPENDS:=+kmod-fb
+  KCONFIG:=CONFIG_FB_CFB_COPYAREA
+  FILES:=$(LINUX_DIR)/drivers/video/fbdev/core/cfbcopyarea.ko
+  AUTOLOAD:=$(call AutoLoad,07,cfbcopyarea)
+endef
+
+define KernelPackage/fb-cfb-copyarea/description
+ Kernel support for software copy area
+endef
+
+$(eval $(call KernelPackage,fb-cfb-copyarea))
+
+define KernelPackage/fb-cfb-imgblt
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=Framebuffer software image blit support
+  DEPENDS:=+kmod-fb
+  KCONFIG:=CONFIG_FB_CFB_IMAGEBLIT
+  FILES:=$(LINUX_DIR)/drivers/video/fbdev/core/cfbimgblt.ko
+  AUTOLOAD:=$(call AutoLoad,07,cfbimgblt)
+endef
+
+define KernelPackage/fb-cfb-imgblt/description
+ Kernel support for software image blitting
+endef
+
+$(eval $(call KernelPackage,fb-cfb-imgblt))
+
+
+define KernelPackage/fb-sys-fops
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=Framebuffer software sys ops support
+  DEPENDS:=+kmod-fb
+  KCONFIG:=CONFIG_FB_SYS_FOPS
+  FILES:=$(LINUX_DIR)/drivers/video/fbdev/core/fb_sys_fops.ko
+  AUTOLOAD:=$(call AutoLoad,07,fb_sys_fops)
+endef
+
+define KernelPackage/fb-sys-fops/description
+ Kernel support for framebuffer sys ops
+endef
+
+$(eval $(call KernelPackage,fb-sys-fops))
+
+
+define KernelPackage/fb-sys-ram
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=Framebuffer in system RAM support
+  DEPENDS:=+kmod-fb
+  KCONFIG:= \
+	CONFIG_FB_SYS_COPYAREA \
+	CONFIG_FB_SYS_FILLRECT \
+	CONFIG_FB_SYS_IMAGEBLIT
+  FILES:= \
+	$(LINUX_DIR)/drivers/video/fbdev/core/syscopyarea.ko \
+	$(LINUX_DIR)/drivers/video/fbdev/core/sysfillrect.ko \
+	$(LINUX_DIR)/drivers/video/fbdev/core/sysimgblt.ko
+  AUTOLOAD:=$(call AutoLoad,07,syscopyarea sysfillrect sysimgblt)
+endef
+
+define KernelPackage/fb-sys-ram/description
+ Kernel support for framebuffers in system RAM
+endef
+
+$(eval $(call KernelPackage,fb-sys-ram))
+
+
+define KernelPackage/fb-tft
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=Support for small TFT LCD display modules
+  DEPENDS:= \
+	  @GPIO_SUPPORT +kmod-backlight \
+	  +kmod-fb +kmod-fb-sys-fops +kmod-fb-sys-ram +kmod-spi-bitbang
+  KCONFIG:= \
+       CONFIG_FB_BACKLIGHT=y \
+       CONFIG_FB_DEFERRED_IO=y \
+       CONFIG_FB_TFT
+  FILES:= \
+       $(LINUX_DIR)/drivers/staging/fbtft/fbtft.ko
+  AUTOLOAD:=$(call AutoLoad,08,fbtft)
+endef
+
+define KernelPackage/fb-tft/description
+  Support for small TFT LCD display modules
+endef
+
+$(eval $(call KernelPackage,fb-tft))
+
+
+define KernelPackage/fb-tft-ili9486
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=FB driver for the ILI9486 LCD Controller
+  DEPENDS:=+kmod-fb-tft
+  KCONFIG:=CONFIG_FB_TFT_ILI9486
+  FILES:=$(LINUX_DIR)/drivers/staging/fbtft/fb_ili9486.ko
+  AUTOLOAD:=$(call AutoLoad,09,fb_ili9486)
+endef
+
+define KernelPackage/fb-tft-ili9486/description
+  FB driver for the ILI9486 LCD Controller
+endef
+
+$(eval $(call KernelPackage,fb-tft-ili9486))
+
+
+define KernelPackage/drm
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=Direct Rendering Manager (DRM) support
+  HIDDEN:=1
+  DEPENDS:=+kmod-dma-buf +kmod-i2c-core +PACKAGE_kmod-backlight:kmod-backlight \
+	+kmod-fb
+  KCONFIG:=CONFIG_DRM
+  FILES:= \
+	$(LINUX_DIR)/drivers/gpu/drm/drm.ko \
+	$(LINUX_DIR)/drivers/gpu/drm/drm_panel_orientation_quirks.ko
+  AUTOLOAD:=$(call AutoLoad,05,drm)
+endef
+
+define KernelPackage/drm/description
+  Direct Rendering Manager (DRM) core support
+endef
+
+$(eval $(call KernelPackage,drm))
+
+define KernelPackage/drm-buddy
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=A page based buddy allocator
+  DEPENDS:=@DISPLAY_SUPPORT +kmod-drm @LINUX_6_1||LINUX_6_6
+  KCONFIG:=CONFIG_DRM_BUDDY
+  FILES:= $(LINUX_DIR)/drivers/gpu/drm/drm_buddy.ko
+  AUTOLOAD:=$(call AutoProbe,drm_buddy)
+endef
+
+define KernelPackage/drm-buddy/description
+  A page based buddy allocator
+endef
+
+$(eval $(call KernelPackage,drm-buddy))
+
+define KernelPackage/drm-display-helper
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=DRM helpers for display adapters drivers
+  DEPENDS:=@DISPLAY_SUPPORT +kmod-drm-kms-helper @LINUX_6_1||LINUX_6_6
+  KCONFIG:=CONFIG_DRM_DISPLAY_HELPER
+  FILES:=$(LINUX_DIR)/drivers/gpu/drm/display/drm_display_helper.ko
+  AUTOLOAD:=$(call AutoProbe,drm_display_helper)
+endef
+
+define KernelPackage/drm-display-helper/description
+  DRM helpers for display adapters drivers.
+endef
+
+$(eval $(call KernelPackage,drm-display-helper))
+
+define KernelPackage/drm-exec
+  SUBMENU:=$(VIDEO_MENU)
+  HIDDEN:=1
+  TITLE:=Execution context for command submissions
+  DEPENDS:=@DISPLAY_SUPPORT +kmod-drm @LINUX_6_6
+  KCONFIG:=CONFIG_DRM_EXEC
+  FILES:=$(LINUX_DIR)/drivers/gpu/drm/drm_exec.ko
+  AUTOLOAD:=$(call AutoProbe,drm_exec)
+endef
+
+define KernelPackage/drm-exec/description
+  Execution context for command submissions.
+endef
+
+$(eval $(call KernelPackage,drm-exec))
+
+define KernelPackage/drm-ttm
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=GPU memory management subsystem
+  DEPENDS:=@DISPLAY_SUPPORT +kmod-drm
+  KCONFIG:=CONFIG_DRM_TTM
+  FILES:=$(LINUX_DIR)/drivers/gpu/drm/ttm/ttm.ko
+  AUTOLOAD:=$(call AutoProbe,ttm)
+endef
+
+define KernelPackage/drm-ttm/description
+  GPU memory management subsystem for devices with multiple GPU memory types.
+  Will be enabled automatically if a device driver uses it.
+endef
+
+$(eval $(call KernelPackage,drm-ttm))
+
+
+define KernelPackage/drm-ttm-helper
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=Helpers for ttm-based gem objects
+  HIDDEN:=1
+  DEPENDS:=@DISPLAY_SUPPORT +kmod-drm-ttm
+  KCONFIG:=CONFIG_DRM_TTM_HELPER
+  FILES:=$(LINUX_DIR)/drivers/gpu/drm/drm_ttm_helper.ko
+  AUTOLOAD:=$(call AutoProbe,drm_ttm_helper)
+endef
+
+$(eval $(call KernelPackage,drm-ttm-helper))
+
+
+define KernelPackage/drm-kms-helper
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=CRTC helpers for KMS drivers
+  DEPENDS:=@DISPLAY_SUPPORT +kmod-drm +kmod-fb +kmod-fb-sys-fops +kmod-fb-cfb-copyarea \
+	+kmod-fb-cfb-fillrect +kmod-fb-cfb-imgblt +kmod-fb-sys-ram
+  KCONFIG:= \
+    CONFIG_DRM_KMS_HELPER \
+    CONFIG_DRM_KMS_FB_HELPER=y
+  FILES:=$(LINUX_DIR)/drivers/gpu/drm/drm_kms_helper.ko
+  AUTOLOAD:=$(call AutoProbe,drm_kms_helper)
+endef
+
+define KernelPackage/drm-kms-helper/description
+  CRTC helpers for KMS drivers.
+endef
+
+$(eval $(call KernelPackage,drm-kms-helper))
+
+define KernelPackage/drm-suballoc-helper
+  SUBMENU:=$(VIDEO_MENU)
+  HIDDEN:=1
+  TITLE:=DRM suballocation helper
+  DEPENDS:=@DISPLAY_SUPPORT +kmod-drm @LINUX_6_6
+  KCONFIG:=CONFIG_DRM_SUBALLOC_HELPER
+  FILES:=$(LINUX_DIR)/drivers/gpu/drm/drm_suballoc_helper.ko
+  AUTOLOAD:=$(call AutoProbe,drm_suballoc_helper)
+endef
+
+define KernelPackage/drm-suballoc-helper/description
+  DRM suballocation helper.
+endef
+
+$(eval $(call KernelPackage,drm-suballoc-helper))
+
+define KernelPackage/drm-amdgpu
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=AMDGPU DRM support
+  DEPENDS:=@TARGET_x86||TARGET_loongarch64 @DISPLAY_SUPPORT +kmod-backlight +kmod-drm-ttm \
+	+kmod-drm-ttm-helper +kmod-drm-kms-helper +kmod-i2c-algo-bit +amdgpu-firmware \
+	+kmod-drm-display-helper +kmod-drm-buddy +kmod-acpi-video \
+	+LINUX_6_6:kmod-drm-exec +LINUX_6_6:kmod-drm-suballoc-helper
+  KCONFIG:=CONFIG_DRM_AMDGPU \
+	CONFIG_DRM_AMDGPU_SI=y \
+	CONFIG_DRM_AMDGPU_CIK=y \
+	CONFIG_DRM_AMD_DC=y \
+	CONFIG_DEBUG_KERNEL_DC=n
+  FILES:=$(LINUX_DIR)/drivers/gpu/drm/amd/amdgpu/amdgpu.ko \
+	$(LINUX_DIR)/drivers/gpu/drm/scheduler/gpu-sched.ko \
+	$(LINUX_DIR)/drivers/gpu/drm/amd/amdxcp/amdxcp.ko@ge6.5
+  AUTOLOAD:=$(call AutoProbe,amdgpu)
+endef
+
+define KernelPackage/drm-amdgpu/description
+  Direct Rendering Manager (DRM) support for AMDGPU Cards
+endef
+
+define KernelPackage/drm-amdgpu/loongarch64
+  KCONFIG+=CONFIG_DRM_AMDGPU_USERPTR=y \
+	CONFIG_DRM_AMD_DC=y \
+	CONFIG_DRM_AMD_DC_FP=y \
+	CONFIG_DRM_AMD_DC_SI=y
+endef
+
+$(eval $(call KernelPackage,drm-amdgpu))
+
+
+define KernelPackage/drm-imx
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=Freescale i.MX DRM support
+  DEPENDS:=@TARGET_imx +kmod-drm-kms-helper
+  KCONFIG:=CONFIG_DRM_IMX \
+	CONFIG_DRM_FBDEV_EMULATION=y \
+	CONFIG_DRM_FBDEV_OVERALLOC=100 \
+	CONFIG_IMX_IPUV3_CORE \
+	CONFIG_RESET_CONTROLLER=y \
+	CONFIG_DRM_IMX_IPUV3 \
+	CONFIG_IMX_IPUV3 \
+	CONFIG_DRM_GEM_CMA_HELPER=y \
+	CONFIG_DRM_KMS_CMA_HELPER=y \
+	CONFIG_DRM_IMX_FB_HELPER \
+	CONFIG_DRM_IMX_PARALLEL_DISPLAY=n \
+	CONFIG_DRM_IMX_TVE=n \
+	CONFIG_DRM_IMX_LDB=n \
+	CONFIG_DRM_IMX_HDMI=n
+  FILES:= \
+	$(LINUX_DIR)/drivers/gpu/drm/imx/imxdrm.ko@lt6.6 \
+	$(LINUX_DIR)/drivers/gpu/drm/imx/ipuv3/imxdrm.ko@ge6.6 \
+	$(LINUX_DIR)/drivers/gpu/drm/drm_dma_helper.ko@ge6.1 \
+	$(LINUX_DIR)/drivers/gpu/ipu-v3/imx-ipu-v3.ko
+  AUTOLOAD:=$(call AutoLoad,08,imxdrm imx-ipu-v3 imx-ipuv3-crtc)
+endef
+
+define KernelPackage/drm-imx/description
+  Direct Rendering Manager (DRM) support for Freescale i.MX
+endef
+
+$(eval $(call KernelPackage,drm-imx))
+
+define KernelPackage/drm-imx-hdmi
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=Freescale i.MX HDMI DRM support
+  DEPENDS:=+kmod-sound-core kmod-drm-imx kmod-drm-display-helper
+  KCONFIG:=CONFIG_DRM_IMX_HDMI \
+	CONFIG_DRM_DW_HDMI_AHB_AUDIO \
+	CONFIG_DRM_DW_HDMI_I2S_AUDIO
+  FILES:= \
+	$(LINUX_DIR)/drivers/gpu/drm/bridge/synopsys/dw-hdmi.ko \
+	$(LINUX_DIR)/drivers/gpu/drm/bridge/synopsys/dw-hdmi-ahb-audio.ko \
+	$(LINUX_DIR)/drivers/gpu/drm/imx/dw_hdmi-imx.ko@lt6.6 \
+	$(LINUX_DIR)/drivers/gpu/drm/imx/ipuv3/dw_hdmi-imx.ko@ge6.6
+  AUTOLOAD:=$(call AutoLoad,08,dw-hdmi dw-hdmi-ahb-audio.ko dw_hdmi-imx)
+endef
+
+define KernelPackage/drm-imx-hdmi/description
+  Direct Rendering Manager (DRM) support for Freescale i.MX HDMI
+endef
+
+$(eval $(call KernelPackage,drm-imx-hdmi))
+
+define KernelPackage/drm-imx-ldb
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=Freescale i.MX LVDS DRM support
+  DEPENDS:=@(TARGET_imx&&TARGET_imx_cortexa9) +kmod-backlight kmod-drm-imx
+  KCONFIG:=CONFIG_DRM_IMX_LDB \
+	CONFIG_DRM_PANEL_SIMPLE \
+	CONFIG_DRM_PANEL=y \
+	CONFIG_DRM_PANEL_SAMSUNG_LD9040=n \
+	CONFIG_DRM_PANEL_SAMSUNG_S6E8AA0=n \
+	CONFIG_DRM_PANEL_LG_LG4573=n \
+	CONFIG_DRM_PANEL_LD9040=n \
+	CONFIG_DRM_PANEL_LVDS=n \
+	CONFIG_DRM_PANEL_S6E8AA0=n \
+	CONFIG_DRM_PANEL_SITRONIX_ST7789V=n
+  FILES:=$(LINUX_DIR)/drivers/gpu/drm/imx/imx-ldb.ko@lt6.6 \
+	$(LINUX_DIR)/drivers/gpu/drm/imx/ipuv3/imx-ldb.ko@ge6.6 \
+	$(LINUX_DIR)/drivers/gpu/drm/panel/panel-simple.ko \
+	$(LINUX_DIR)/drivers/gpu/drm/drm_dp_aux_bus.ko@lt6.1
+  AUTOLOAD:=$(call AutoLoad,08,imx-ldb)
+endef
+
+define KernelPackage/drm-imx-ldb/description
+  Direct Rendering Manager (DRM) support for Freescale i.MX LVDS
+endef
+
+$(eval $(call KernelPackage,drm-imx-ldb))
+
+define KernelPackage/drm-radeon
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=Radeon DRM support
+  DEPENDS:=@TARGET_x86 @DISPLAY_SUPPORT +kmod-backlight +kmod-drm-kms-helper \
+	+kmod-drm-ttm +kmod-drm-ttm-helper +kmod-i2c-algo-bit +radeon-firmware \
+	+kmod-drm-display-helper +kmod-acpi-video +LINUX_6_6:kmod-drm-suballoc-helper
+  KCONFIG:=CONFIG_DRM_RADEON
+  FILES:=$(LINUX_DIR)/drivers/gpu/drm/radeon/radeon.ko
+  AUTOLOAD:=$(call AutoProbe,radeon)
+endef
+
+define KernelPackage/drm-radeon/description
+  Direct Rendering Manager (DRM) support for Radeon Cards
+endef
+
+$(eval $(call KernelPackage,drm-radeon))
+
+#
+# Video Capture
+#
+
+define KernelPackage/video-core
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE=Video4Linux support
+  DEPENDS:=+PACKAGE_kmod-i2c-core:kmod-i2c-core
+  KCONFIG:= \
+	CONFIG_MEDIA_SUPPORT \
+	CONFIG_MEDIA_CAMERA_SUPPORT=y \
+	CONFIG_VIDEO_DEV \
+	CONFIG_V4L_PLATFORM_DRIVERS=y \
+	CONFIG_MEDIA_PLATFORM_DRIVERS=y@ge6.1
+  FILES:= \
+	$(LINUX_DIR)/drivers/media/$(V4L2_DIR)/videodev.ko
+  AUTOLOAD:=$(call AutoLoad,60,videodev)
+endef
+
+define KernelPackage/video-core/description
+ Kernel modules for Video4Linux support
+endef
+
+$(eval $(call KernelPackage,video-core))
+
+
+define AddDepends/video
+  SUBMENU:=$(VIDEO_MENU)
+  DEPENDS+=kmod-video-core $(1)
+endef
+
+define AddDepends/camera
+$(AddDepends/video)
+  KCONFIG+=CONFIG_MEDIA_USB_SUPPORT=y \
+	 CONFIG_MEDIA_CAMERA_SUPPORT=y
+endef
+
+define AddDepends/framegrabber
+$(AddDepends/video)
+  KCONFIG+=CONFIG_MEDIA_PCI_SUPPORT=y
+endef
+
+define KernelPackage/video-videobuf2
+  TITLE:=videobuf2 lib
+  DEPENDS:=+kmod-dma-buf
+  KCONFIG:= \
+	CONFIG_VIDEOBUF2_CORE \
+	CONFIG_VIDEOBUF2_MEMOPS \
+	CONFIG_VIDEOBUF2_V4L2 \
+	CONFIG_VIDEOBUF2_VMALLOC
+  FILES:= \
+	$(LINUX_DIR)/drivers/media/common/videobuf2/videobuf2-common.ko \
+	$(LINUX_DIR)/drivers/media/common/videobuf2/videobuf2-v4l2.ko \
+	$(LINUX_DIR)/drivers/media/common/videobuf2/videobuf2-memops.ko \
+	$(LINUX_DIR)/drivers/media/common/videobuf2/videobuf2-vmalloc.ko
+  AUTOLOAD:=$(call AutoLoad,65,videobuf2-core videobuf-v4l2 videobuf2-memops videobuf2-vmalloc)
+  $(call AddDepends/video)
+endef
+
+define KernelPackage/video-videobuf2/description
+ Kernel modules that implements three basic types of media buffers.
+endef
+
+$(eval $(call KernelPackage,video-videobuf2))
+
+
+define KernelPackage/video-cpia2
+  TITLE:=CPIA2 video driver
+  DEPENDS:=@USB_SUPPORT +kmod-usb-core @LINUX_5_15
+  KCONFIG:=CONFIG_VIDEO_CPIA2
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/cpia2/cpia2.ko
+  AUTOLOAD:=$(call AutoProbe,cpia2)
+  $(call AddDepends/camera)
+endef
+
+define KernelPackage/video-cpia2/description
+ Kernel modules for supporting CPIA2 USB based cameras
+endef
+
+$(eval $(call KernelPackage,video-cpia2))
+
+
+define KernelPackage/video-pwc
+  TITLE:=Philips USB webcam support
+  DEPENDS:=@USB_SUPPORT +kmod-usb-core +kmod-video-videobuf2
+  KCONFIG:= \
+	CONFIG_USB_PWC \
+	CONFIG_USB_PWC_DEBUG=n
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/pwc/pwc.ko
+  AUTOLOAD:=$(call AutoProbe,pwc)
+  $(call AddDepends/camera)
+endef
+
+define KernelPackage/video-pwc/description
+ Kernel modules for supporting Philips USB based cameras
+endef
+
+$(eval $(call KernelPackage,video-pwc))
+
+
+define KernelPackage/video-uvc
+  TITLE:=USB Video Class (UVC) support
+  DEPENDS:=@USB_SUPPORT +kmod-usb-core +kmod-video-videobuf2 +kmod-input-core
+  KCONFIG:= CONFIG_USB_VIDEO_CLASS CONFIG_UVC_COMMON@ge6.3
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/uvc/uvcvideo.ko \
+	$(LINUX_DIR)/drivers/media/common/uvc.ko@ge6.3
+  AUTOLOAD:=$(call AutoProbe,uvc@ge6.3 uvcvideo)
+  $(call AddDepends/camera)
+endef
+
+define KernelPackage/video-uvc/description
+ Kernel modules for supporting USB Video Class (UVC) devices
+endef
+
+$(eval $(call KernelPackage,video-uvc))
+
+
+define KernelPackage/video-gspca-core
+  MENU:=1
+  TITLE:=GSPCA webcam core support framework
+  DEPENDS:=@USB_SUPPORT +kmod-usb-core +kmod-input-core +kmod-video-videobuf2
+  KCONFIG:=CONFIG_USB_GSPCA
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_main.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_main)
+  $(call AddDepends/camera)
+endef
+
+define KernelPackage/video-gspca-core/description
+ Kernel modules for supporting GSPCA based webcam devices. Note this is just
+ the core of the driver, please select a submodule that supports your webcam.
+endef
+
+$(eval $(call KernelPackage,video-gspca-core))
+
+
+define AddDepends/camera-gspca
+  SUBMENU:=$(VIDEO_MENU)
+  DEPENDS+=kmod-video-gspca-core $(1)
+endef
+
+
+define KernelPackage/video-gspca-conex
+  TITLE:=conex webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_CONEX
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_conex.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_conex)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-conex/description
+ The Conexant Camera Driver (conex) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-conex))
+
+
+define KernelPackage/video-gspca-etoms
+  TITLE:=etoms webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_ETOMS
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_etoms.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_etoms)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-etoms/description
+ The Etoms USB Camera Driver (etoms) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-etoms))
+
+
+define KernelPackage/video-gspca-finepix
+  TITLE:=finepix webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_FINEPIX
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_finepix.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_finepix)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-finepix/description
+ The Fujifilm FinePix USB V4L2 driver (finepix) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-finepix))
+
+
+define KernelPackage/video-gspca-mars
+  TITLE:=mars webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_MARS
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_mars.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_mars)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-mars/description
+ The Mars USB Camera Driver (mars) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-mars))
+
+
+define KernelPackage/video-gspca-mr97310a
+  TITLE:=mr97310a webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_MR97310A
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_mr97310a.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_mr97310a)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-mr97310a/description
+ The Mars-Semi MR97310A USB Camera Driver (mr97310a) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-mr97310a))
+
+
+define KernelPackage/video-gspca-ov519
+  TITLE:=ov519 webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_OV519
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_ov519.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_ov519)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-ov519/description
+ The OV519 USB Camera Driver (ov519) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-ov519))
+
+
+define KernelPackage/video-gspca-ov534
+  TITLE:=ov534 webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_OV534
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_ov534.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_ov534)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-ov534/description
+ The OV534 USB Camera Driver (ov534) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-ov534))
+
+
+define KernelPackage/video-gspca-ov534-9
+  TITLE:=ov534-9 webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_OV534_9
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_ov534_9.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_ov534_9)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-ov534-9/description
+ The OV534-9 USB Camera Driver (ov534_9) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-ov534-9))
+
+
+define KernelPackage/video-gspca-pac207
+  TITLE:=pac207 webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_PAC207
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_pac207.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_pac207)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-pac207/description
+ The Pixart PAC207 USB Camera Driver (pac207) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-pac207))
+
+
+define KernelPackage/video-gspca-pac7311
+  TITLE:=pac7311 webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_PAC7311
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_pac7311.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_pac7311)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-pac7311/description
+ The Pixart PAC7311 USB Camera Driver (pac7311) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-pac7311))
+
+
+define KernelPackage/video-gspca-se401
+  TITLE:=se401 webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_SE401
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_se401.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_se401)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-se401/description
+ The SE401 USB Camera Driver kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-se401))
+
+
+define KernelPackage/video-gspca-sn9c20x
+  TITLE:=sn9c20x webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_SN9C20X
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_sn9c20x.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_sn9c20x)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-sn9c20x/description
+ The SN9C20X USB Camera Driver (sn9c20x) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-sn9c20x))
+
+
+define KernelPackage/video-gspca-sonixb
+  TITLE:=sonixb webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_SONIXB
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_sonixb.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_sonixb)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-sonixb/description
+ The SONIX Bayer USB Camera Driver (sonixb) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-sonixb))
+
+
+define KernelPackage/video-gspca-sonixj
+  TITLE:=sonixj webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_SONIXJ
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_sonixj.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_sonixj)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-sonixj/description
+ The SONIX JPEG USB Camera Driver (sonixj) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-sonixj))
+
+
+define KernelPackage/video-gspca-spca500
+  TITLE:=spca500 webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_SPCA500
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_spca500.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_spca500)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-spca500/description
+ The SPCA500 USB Camera Driver (spca500) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-spca500))
+
+
+define KernelPackage/video-gspca-spca501
+  TITLE:=spca501 webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_SPCA501
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_spca501.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_spca501)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-spca501/description
+ The SPCA501 USB Camera Driver (spca501) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-spca501))
+
+
+define KernelPackage/video-gspca-spca505
+  TITLE:=spca505 webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_SPCA505
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_spca505.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_spca505)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-spca505/description
+ The SPCA505 USB Camera Driver (spca505) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-spca505))
+
+
+define KernelPackage/video-gspca-spca506
+  TITLE:=spca506 webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_SPCA506
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_spca506.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_spca506)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-spca506/description
+ The SPCA506 USB Camera Driver (spca506) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-spca506))
+
+
+define KernelPackage/video-gspca-spca508
+  TITLE:=spca508 webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_SPCA508
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_spca508.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_spca508)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-spca508/description
+ The SPCA508 USB Camera Driver (spca508) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-spca508))
+
+
+define KernelPackage/video-gspca-spca561
+  TITLE:=spca561 webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_SPCA561
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_spca561.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_spca561)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-spca561/description
+ The SPCA561 USB Camera Driver (spca561) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-spca561))
+
+
+define KernelPackage/video-gspca-sq905
+  TITLE:=sq905 webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_SQ905
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_sq905.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_sq905)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-sq905/description
+ The SQ Technologies SQ905 based USB Camera Driver (sq905) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-sq905))
+
+
+define KernelPackage/video-gspca-sq905c
+  TITLE:=sq905c webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_SQ905C
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_sq905c.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_sq905c)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-sq905c/description
+ The SQ Technologies SQ905C based USB Camera Driver (sq905c) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-sq905c))
+
+
+define KernelPackage/video-gspca-sq930x
+  TITLE:=sq930x webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_SQ930X
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_sq930x.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_sq930x)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-sq930x/description
+ The SQ Technologies SQ930X based USB Camera Driver (sq930x) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-sq930x))
+
+
+define KernelPackage/video-gspca-stk014
+  TITLE:=stk014 webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_STK014
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_stk014.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_stk014)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-stk014/description
+ The Syntek DV4000 (STK014) USB Camera Driver (stk014) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-stk014))
+
+
+define KernelPackage/video-gspca-sunplus
+  TITLE:=sunplus webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_SUNPLUS
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_sunplus.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_sunplus)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-sunplus/description
+ The SUNPLUS USB Camera Driver (sunplus) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-sunplus))
+
+
+define KernelPackage/video-gspca-t613
+  TITLE:=t613 webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_T613
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_t613.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_t613)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-t613/description
+ The T613 (JPEG Compliance) USB Camera Driver (t613) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-t613))
+
+
+define KernelPackage/video-gspca-tv8532
+  TITLE:=tv8532 webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_TV8532
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_tv8532.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_tv8532)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-tv8532/description
+ The TV8532 USB Camera Driver (tv8532) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-tv8532))
+
+
+define KernelPackage/video-gspca-vc032x
+  TITLE:=vc032x webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_VC032X
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_vc032x.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_vc032x)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-vc032x/description
+ The VC032X USB Camera Driver (vc032x) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-vc032x))
+
+
+define KernelPackage/video-gspca-zc3xx
+  TITLE:=zc3xx webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_ZC3XX
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_zc3xx.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_zc3xx)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-zc3xx/description
+ The ZC3XX USB Camera Driver (zc3xx) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-zc3xx))
+
+
+define KernelPackage/video-gspca-m5602
+  TITLE:=m5602 webcam support
+  KCONFIG:=CONFIG_USB_M5602
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/m5602/gspca_m5602.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_m5602)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-m5602/description
+ The ALi USB m5602 Camera Driver (m5602) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-m5602))
+
+
+define KernelPackage/video-gspca-stv06xx
+  TITLE:=stv06xx webcam support
+  KCONFIG:=CONFIG_USB_STV06XX
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/stv06xx/gspca_stv06xx.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_stv06xx)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-stv06xx/description
+ The STV06XX USB Camera Driver (stv06xx) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-stv06xx))
+
+
+define KernelPackage/video-gspca-gl860
+  TITLE:=gl860 webcam support
+  KCONFIG:=CONFIG_USB_GL860
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gl860/gspca_gl860.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_gl860)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-gl860/description
+ The GL860 USB Camera Driver (gl860) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-gl860))
+
+
+define KernelPackage/video-gspca-jeilinj
+  TITLE:=jeilinj webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_JEILINJ
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_jeilinj.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_jeilinj)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-jeilinj/description
+ The JEILINJ USB Camera Driver (jeilinj) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-jeilinj))
+
+
+define KernelPackage/video-gspca-konica
+  TITLE:=konica webcam support
+  KCONFIG:=CONFIG_USB_GSPCA_KONICA
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_USB_DIR)/gspca/gspca_konica.ko
+  AUTOLOAD:=$(call AutoProbe,gspca_konica)
+  $(call AddDepends/camera-gspca)
+endef
+
+define KernelPackage/video-gspca-konica/description
+ The Konica USB Camera Driver (konica) kernel module
+endef
+
+$(eval $(call KernelPackage,video-gspca-konica))
+
+#
+# Video Processing
+#
+
+define KernelPackage/video-mem2mem
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=Memory 2 Memory device support
+  HIDDEN:=1
+  DEPENDS:=+kmod-video-videobuf2
+  KCONFIG:= \
+    CONFIG_V4L_MEM2MEM_DRIVERS=y \
+    CONFIG_V4L2_MEM2MEM_DEV
+  FILES:= $(LINUX_DIR)/drivers/media/$(V4L2_DIR)/v4l2-mem2mem.ko
+  AUTOLOAD:=$(call AutoLoad,66,v4l2-mem2mem)
+  $(call AddDepends/video)
+endef
+
+define KernelPackage/video-mem2mem/description
+  Memory 2 memory device support
+endef
+
+$(eval $(call KernelPackage,video-mem2mem))
+
+define KernelPackage/video-dma-contig
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=Video DMA support
+  HIDDEN:=1
+  DEPENDS:=+kmod-video-videobuf2
+  KCONFIG:=CONFIG_VIDEOBUF2_DMA_CONTIG
+  FILES:=$(LINUX_DIR)/drivers/media/common/videobuf2/videobuf2-dma-contig.ko
+  AUTOLOAD:=$(call AutoLoad,66,videobuf2-dma-contig)
+  $(call AddDepends/video)
+endef
+
+define KernelPackage/video-dma-contig/description
+  Video DMA support Contig
+endef
+
+
+$(eval $(call KernelPackage,video-dma-contig))
+
+define KernelPackage/video-dma-sg
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=Video DMA support
+  HIDDEN:=1
+  DEPENDS:=+kmod-video-videobuf2
+  KCONFIG:=CONFIG_VIDEOBUF2_DMA_SG
+  FILES:=$(LINUX_DIR)/drivers/media/common/videobuf2/videobuf2-dma-sg.ko
+  AUTOLOAD:=$(call AutoLoad,66,videobuf2-dma-sg)
+  $(call AddDepends/video)
+endef
+
+define KernelPackage/video-dma-sg/description
+  Video DMA support SG
+endef
+
+$(eval $(call KernelPackage,video-dma-sg))
+
+define KernelPackage/video-coda
+  TITLE:=i.MX VPU support
+  DEPENDS:=@(TARGET_imx&&TARGET_imx_cortexa9) +kmod-video-mem2mem +kmod-video-dma-contig
+  KCONFIG:= \
+  	CONFIG_VIDEO_CODA \
+  	CONFIG_VIDEO_IMX_VDOA
+  FILES:= \
+  	$(LINUX_DIR)/drivers/media/$(V4L2_MEM2MEM_DIR)/coda/coda-vpu.ko@lt6.1 \
+  	$(LINUX_DIR)/drivers/media/$(V4L2_MEM2MEM_DIR)/chips-media/coda-vpu.ko@ge6.1 \
+  	$(LINUX_DIR)/drivers/media/$(V4L2_MEM2MEM_DIR)/coda/imx-vdoa.ko@lt6.1 \
+  	$(LINUX_DIR)/drivers/media/$(V4L2_MEM2MEM_DIR)/chips-media/imx-vdoa.ko@ge6.1 \
+ 	$(LINUX_DIR)/drivers/media/$(V4L2_DIR)/v4l2-jpeg.ko
+  AUTOLOAD:=$(call AutoProbe,coda-vpu imx-vdoa v4l2-jpeg)
+  $(call AddDepends/video)
+endef
+
+define KernelPackage/video-coda/description
+ The i.MX Video Processing Unit (VPU) kernel module
+endef
+
+$(eval $(call KernelPackage,video-coda))
+
+define KernelPackage/video-pxp
+  TITLE:=i.MX PXP support
+  DEPENDS:=@TARGET_imx +kmod-video-mem2mem +kmod-video-dma-contig
+  KCONFIG:= CONFIG_VIDEO_IMX_PXP
+  FILES:= $(LINUX_DIR)/drivers/media/$(V4L2_MEM2MEM_DIR)/imx-pxp.ko@lt6.1 \
+	$(LINUX_DIR)/drivers/media/platform/nxp/imx-pxp.ko@ge6.1
+  AUTOLOAD:=$(call AutoProbe,imx-pxp)
+  $(call AddDepends/video)
+endef
+
+define KernelPackage/video-pxp/description
+ The i.MX Pixel Pipeline (PXP) kernel module
+ This enables hardware accelerated support for image
+ Colour Conversion, Scaling and Rotation
+endef
+
+$(eval $(call KernelPackage,video-pxp))
+
+define KernelPackage/video-tw686x
+  TITLE:=TW686x support
+  DEPENDS:=@PCIE_SUPPORT +kmod-video-dma-contig +kmod-video-dma-sg +kmod-sound-core
+  KCONFIG:= CONFIG_VIDEO_TW686X
+  FILES:= $(LINUX_DIR)/drivers/media/pci/tw686x/tw686x.ko
+  AUTOLOAD:=$(call AutoProbe,tw686x)
+  MODPARAMS.tw686x:=dma_mode=contig
+  $(call AddDepends/framegrabber)
+endef
+
+define KernelPackage/video-tw686x/description
+ The Intersil/Techwell TW686x kernel module
+endef
+
+$(eval $(call KernelPackage,video-tw686x))
diff --git a/6.12/package/kernel/mac80211/patches/ath9k/551-ath9k_ubnt_uap_plus_hsr.patch b/6.12/package/kernel/mac80211/patches/ath9k/551-ath9k_ubnt_uap_plus_hsr.patch
new file mode 100644
index 00000000..1a8073d0
--- /dev/null
+++ b/6.12/package/kernel/mac80211/patches/ath9k/551-ath9k_ubnt_uap_plus_hsr.patch
@@ -0,0 +1,403 @@
+--- a/drivers/net/wireless/ath/ath9k/channel.c
++++ b/drivers/net/wireless/ath/ath9k/channel.c
+@@ -15,6 +15,7 @@
+  */
+ 
+ #include "ath9k.h"
++#include "hsr.h"
+ 
+ /* Set/change channels.  If the channel is really being changed, it's done
+  * by reseting the chip.  To accomplish this we must first cleanup any pending
+@@ -22,6 +23,7 @@
+  */
+ static int ath_set_channel(struct ath_softc *sc)
+ {
++	struct device_node *np = sc->dev->of_node;
+ 	struct ath_hw *ah = sc->sc_ah;
+ 	struct ath_common *common = ath9k_hw_common(ah);
+ 	struct ieee80211_hw *hw = sc->hw;
+@@ -42,6 +44,11 @@ static int ath_set_channel(struct ath_so
+ 	ath_dbg(common, CONFIG, "Set channel: %d MHz width: %d\n",
+ 		chan->center_freq, chandef->width);
+ 
++	if (of_property_read_bool(np, "ubnt,hsr")) {
++		ath9k_hsr_enable(ah, chandef->width, chan->center_freq);
++		ath9k_hsr_status(ah);
++	}
++
+ 	/* update survey stats for the old channel before switching */
+ 	spin_lock_irqsave(&common->cc_lock, flags);
+ 	ath_update_survey_stats(sc);
+--- /dev/null
++++ b/drivers/net/wireless/ath/ath9k/hsr.c
+@@ -0,0 +1,247 @@
++/*
++ *
++ * The MIT License (MIT)
++ *
++ * Copyright (c) 2015 Kirill Berezin
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * of this software and associated documentation files (the "Software"), to deal
++ * in the Software without restriction, including without limitation the rights
++ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
++ * copies of the Software, and to permit persons to whom the Software is
++ * furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in
++ * all copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
++ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
++ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
++ * SOFTWARE.
++ *
++ */
++
++#include <linux/io.h>
++#include <linux/slab.h>
++#include <linux/module.h>
++#include <linux/time.h>
++#include <linux/bitops.h>
++#include <linux/etherdevice.h>
++#include <linux/rtnetlink.h>
++#include <linux/unaligned.h>
++
++#include "hw.h"
++#include "ath9k.h"
++
++#define HSR_GPIO_CSN 8
++#define HSR_GPIO_CLK 6
++#define HSR_GPIO_DOUT 7
++#define HSR_GPIO_DIN 5
++
++/* delays are in useconds */
++#define HSR_DELAY_HALF_TICK 100
++#define HSR_DELAY_PRE_WRITE 75
++#define HSR_DELAY_FINAL 20000
++#define HSR_DELAY_TRAILING 200
++
++void ath9k_hsr_init(struct ath_hw *ah)
++{
++	ath9k_hw_gpio_request_in(ah, HSR_GPIO_DIN, NULL);
++	ath9k_hw_gpio_request_out(ah, HSR_GPIO_CSN, NULL,
++				  AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
++	ath9k_hw_gpio_request_out(ah, HSR_GPIO_CLK, NULL,
++				  AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
++	ath9k_hw_gpio_request_out(ah, HSR_GPIO_DOUT, NULL,
++				  AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
++
++	ath9k_hw_set_gpio(ah, HSR_GPIO_CSN, 1);
++	ath9k_hw_set_gpio(ah, HSR_GPIO_CLK, 0);
++	ath9k_hw_set_gpio(ah, HSR_GPIO_DOUT, 0);
++
++	udelay(HSR_DELAY_TRAILING);
++}
++
++static u32 ath9k_hsr_write_byte(struct ath_hw *ah, int delay, u32 value)
++{
++	struct ath_common *common = ath9k_hw_common(ah);
++	int i;
++	u32 rval = 0;
++
++	udelay(delay);
++
++	ath9k_hw_set_gpio(ah, HSR_GPIO_CLK, 0);
++	udelay(HSR_DELAY_HALF_TICK);
++
++	ath9k_hw_set_gpio(ah, HSR_GPIO_CSN, 0);
++	udelay(HSR_DELAY_HALF_TICK);
++
++	for (i = 0; i < 8; ++i) {
++		rval = rval << 1;
++
++		/* pattern is left to right, that is 7-th bit runs first */
++		ath9k_hw_set_gpio(ah, HSR_GPIO_DOUT, (value >> (7 - i)) & 0x1);
++		udelay(HSR_DELAY_HALF_TICK);
++
++		ath9k_hw_set_gpio(ah, HSR_GPIO_CLK, 1);
++		udelay(HSR_DELAY_HALF_TICK);
++
++		rval |= ath9k_hw_gpio_get(ah, HSR_GPIO_DIN);
++
++		ath9k_hw_set_gpio(ah, HSR_GPIO_CLK, 0);
++		udelay(HSR_DELAY_HALF_TICK);
++	}
++
++	ath9k_hw_set_gpio(ah, HSR_GPIO_CSN, 1);
++	udelay(HSR_DELAY_HALF_TICK);
++
++	ath_dbg(common, CONFIG, "ath9k_hsr_write_byte: write byte %d return value is %d %c\n",
++		value, rval, rval > 32 ? rval : '-');
++
++	return rval & 0xff;
++}
++
++static int ath9k_hsr_write_a_chain(struct ath_hw *ah, char *chain, int items)
++{
++	int status = 0;
++	int i = 0;
++	int err;
++
++	/* a preamble */
++	ath9k_hsr_write_byte(ah, HSR_DELAY_PRE_WRITE, 0);
++	status = ath9k_hsr_write_byte(ah, HSR_DELAY_PRE_WRITE, 0);
++
++	/* clear HSR's reply buffer */
++	if (status) {
++		int loop = 0;
++
++		for (loop = 0; (loop < 42) && status; ++loop)
++			status = ath9k_hsr_write_byte(ah, HSR_DELAY_PRE_WRITE,
++						      0);
++
++		if (loop >= 42) {
++			ATH_DBG_WARN(1,
++				     "ath9k_hsr_write_a_chain: can't clear an output buffer after a 42 cycles.\n");
++			return -1;
++		}
++	}
++
++	for (i = 0; (i < items) && (chain[i] != 0); ++i)
++		ath9k_hsr_write_byte(ah, HSR_DELAY_PRE_WRITE, (u32)chain[i]);
++
++	ath9k_hsr_write_byte(ah, HSR_DELAY_PRE_WRITE, 0);
++	mdelay(HSR_DELAY_FINAL / 1000);
++
++	/* reply */
++	memset(chain, 0, items);
++
++	ath9k_hsr_write_byte(ah, HSR_DELAY_PRE_WRITE, 0);
++	udelay(HSR_DELAY_TRAILING);
++
++	for (i = 0; i < (items - 1); ++i) {
++		u32 ret;
++
++		ret = ath9k_hsr_write_byte(ah, HSR_DELAY_PRE_WRITE, 0);
++		if (ret != 0)
++			chain[i] = (char)ret;
++		else
++			break;
++
++		udelay(HSR_DELAY_TRAILING);
++	}
++
++	if (i <= 1)
++		return 0;
++
++	err = kstrtoint(chain + 1, 10, &i);
++	if (err)
++		return err;
++
++	return i;
++}
++
++int ath9k_hsr_disable(struct ath_hw *ah)
++{
++	char cmd[10] = {'b', '4', '0', 0, 0, 0, 0, 0, 0, 0};
++	int ret;
++
++	ret = ath9k_hsr_write_a_chain(ah, cmd, sizeof(cmd));
++	if ((ret > 0) && (*cmd == 'B'))
++		return 0;
++
++	return -1;
++}
++
++int ath9k_hsr_enable(struct ath_hw *ah, int bw, int fq)
++{
++	char cmd[10];
++	int ret;
++
++	/* Bandwidth argument is 0 sometimes. Assume default 802.11bgn
++	 * 20MHz on invalid values
++	 */
++	if ((bw != 5) && (bw != 10) && (bw != 20) && (bw != 40))
++		bw = 20;
++
++	memset(cmd, 0, sizeof(cmd));
++	*cmd = 'b';
++	snprintf(cmd + 1, 3, "%02d", bw);
++
++	ret = ath9k_hsr_write_a_chain(ah, cmd, sizeof(cmd));
++	if ((*cmd != 'B') || (ret != bw)) {
++		ATH_DBG_WARN(1,
++			     "ath9k_hsr_enable: failed changing bandwidth -> set (%d,%d) reply (%d, %d)\n",
++			     'b', bw, *cmd, ret);
++		return -1;
++	}
++
++	memset(cmd, 0, sizeof(cmd));
++	*cmd = 'x';
++	ret = ath9k_hsr_write_a_chain(ah, cmd, sizeof(cmd));
++	if (*cmd != 'X') {
++		ATH_DBG_WARN(1,
++			     "ath9k_hsr_enable: failed 'x' command -> reply (%d, %d)\n",
++			     *cmd, ret);
++		return -1;
++	}
++
++	memset(cmd, 0, sizeof(cmd));
++	*cmd = 'm';
++	ret = ath9k_hsr_write_a_chain(ah, cmd, sizeof(cmd));
++	if (*cmd != 'M') {
++		ATH_DBG_WARN(1,
++			     "ath9k_hsr_enable: failed 'm' command -> reply (%d, %d)\n",
++			     *cmd, ret);
++		return  -1;
++	}
++
++	memset(cmd, 0, sizeof(cmd));
++	*cmd = 'f';
++	snprintf(cmd + 1, 6, "%05d", fq);
++	ret = ath9k_hsr_write_a_chain(ah, cmd, sizeof(cmd));
++	if ((*cmd != 'F') && (ret != fq)) {
++		ATH_DBG_WARN(1,
++			     "ath9k_hsr_enable: failed set frequency -> reply (%d, %d)\n",
++			     *cmd, ret);
++		return -1;
++	}
++
++	return 0;
++}
++
++int ath9k_hsr_status(struct ath_hw *ah)
++{
++	char cmd[10] = {'s', 0, 0, 0, 0, 0, 0, 0, 0, 0};
++	int ret;
++
++	ret = ath9k_hsr_write_a_chain(ah, cmd, sizeof(cmd));
++	if (*cmd != 'S') {
++		ATH_DBG_WARN(1, "ath9k_hsr_status: returned %d,%d\n", *cmd,
++			     ret);
++		return -1;
++	}
++
++	return 0;
++}
+--- /dev/null
++++ b/drivers/net/wireless/ath/ath9k/hsr.h
+@@ -0,0 +1,48 @@
++/*
++ * The MIT License (MIT)
++ *
++ * Copyright (c) 2015 Kirill Berezin
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * of this software and associated documentation files (the "Software"), to deal
++ * in the Software without restriction, including without limitation the rights
++ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
++ * copies of the Software, and to permit persons to whom the Software is
++ * furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in
++ * all copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
++ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
++ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
++ * SOFTWARE.
++ */
++
++#ifndef HSR_H
++#define HSR_H
++
++#ifdef CPTCFG_ATH9K_UBNTHSR
++
++void ath9k_hsr_init(struct ath_hw *ah);
++int ath9k_hsr_disable(struct ath_hw *ah);
++int ath9k_hsr_enable(struct ath_hw *ah, int bw, int fq);
++int ath9k_hsr_status(struct ath_hw *ah);
++
++#else
++static inline void ath9k_hsr_init(struct ath_hw *ah) {}
++
++static inline int ath9k_hsr_enable(struct ath_hw *ah, int bw, int fq)
++{
++	return 0;
++}
++
++static inline int ath9k_hsr_disable(struct ath_hw *ah) { return 0; }
++static inline int ath9k_hsr_status(struct ath_hw *ah) { return 0; }
++
++#endif
++
++#endif /* HSR_H */
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -18,6 +18,7 @@
+ #include <linux/delay.h>
+ #include "ath9k.h"
+ #include "btcoex.h"
++#include "hsr.h"
+ 
+ static void ath9k_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 			u32 queues, bool drop);
+@@ -658,6 +659,7 @@ void ath_reset_work(struct work_struct *
+ static int ath9k_start(struct ieee80211_hw *hw)
+ {
+ 	struct ath_softc *sc = hw->priv;
++	struct device_node *np = sc->dev->of_node;
+ 	struct ath_hw *ah = sc->sc_ah;
+ 	struct ath_common *common = ath9k_hw_common(ah);
+ 	struct ieee80211_channel *curchan = sc->cur_chan->chandef.chan;
+@@ -736,6 +738,11 @@ static int ath9k_start(struct ieee80211_
+ 					  AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
+ 	}
+ 
++	if (of_property_read_bool(np, "ubnt,hsr")) {
++		ath9k_hsr_init(ah);
++		ath9k_hsr_disable(ah);
++	}
++
+ 	/*
+ 	 * Reset key cache to sane defaults (all entries cleared) instead of
+ 	 * semi-random values after suspend/resume.
+--- a/drivers/net/wireless/ath/ath9k/Makefile
++++ b/drivers/net/wireless/ath/ath9k/Makefile
+@@ -17,6 +17,7 @@ ath9k-$(CPTCFG_ATH9K_DFS_CERTIFIED) += d
+ ath9k-$(CPTCFG_ATH9K_TX99) += tx99.o
+ ath9k-$(CPTCFG_ATH9K_WOW) += wow.o
+ ath9k-$(CPTCFG_ATH9K_HWRNG) += rng.o
++ath9k-$(CPTCFG_ATH9K_UBNTHSR) += hsr.o
+ 
+ ath9k-$(CPTCFG_ATH9K_DEBUGFS) += debug.o
+ 
+--- a/local-symbols
++++ b/local-symbols
+@@ -121,6 +121,7 @@ ATH9K_WOW=
+ ATH9K_RFKILL=
+ ATH9K_CHANNEL_CONTEXT=
+ ATH9K_PCOEM=
++ATH9K_UBNTHSR=
+ ATH9K_PCI_NO_EEPROM=
+ ATH9K_HTC=
+ ATH9K_HTC_DEBUGFS=
+--- a/drivers/net/wireless/ath/ath9k/Kconfig
++++ b/drivers/net/wireless/ath/ath9k/Kconfig
+@@ -58,6 +58,19 @@ config ATH9K_AHB
+ 	  Say Y, if you have a SoC with a compatible built-in
+ 	  wireless MAC. Say N if unsure.
+ 
++config ATH9K_UBNTHSR
++	bool "Ubiquiti UniFi Outdoor Plus HSR support"
++	depends on ATH9K
++	---help---
++	  This options enables code to control the HSR RF
++	  filter in the receive path of the Ubiquiti UniFi
++	  Outdoor Plus access point.
++
++	  Say Y if you want to use the access point. The
++	  code will only be used if the device is detected,
++	  so it does not harm other setup other than occupying
++	  a bit of memory.
++
+ config ATH9K_DEBUGFS
+ 	bool "Atheros ath9k debugging"
+ 	depends on ATH9K && DEBUG_FS && MAC80211_DEBUGFS
diff --git a/6.12/package/kernel/mac80211/patches/ath9k/999-ath9k_kernel-6.11.patch b/6.12/package/kernel/mac80211/patches/ath9k/999-ath9k_kernel-6.11.patch
new file mode 100644
index 00000000..9d763488
--- /dev/null
+++ b/6.12/package/kernel/mac80211/patches/ath9k/999-ath9k_kernel-6.11.patch
@@ -0,0 +1,11 @@
+--- a/drivers/net/wireless/ath/ath9k/gpio.c	2024-09-16 14:38:11.938379419 +0200
++++ b/drivers/net/wireless/ath/ath9k/gpio.c	2024-09-16 14:38:30.390115635 +0200
+@@ -111,7 +111,7 @@
+ 	gc->gchip.get = ath9k_gpio_pin_get;
+ 	gc->gchip.set = ath9k_gpio_pin_set;
+ 
+-	if (gpiochip_add(&gc->gchip)) {
++	if (gpiochip_add_data(&gc->gchip, NULL)) {
+ 		kfree(gc);
+ 		return;
+ 	}
diff --git a/6.12/package/kernel/mac80211/patches/rt2x00/999-rt2x00-fix-compilation.patch b/6.12/package/kernel/mac80211/patches/rt2x00/999-rt2x00-fix-compilation.patch
new file mode 100644
index 00000000..63a798b0
--- /dev/null
+++ b/6.12/package/kernel/mac80211/patches/rt2x00/999-rt2x00-fix-compilation.patch
@@ -0,0 +1,19 @@
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h	2024-07-03 20:09:49.622279338 +0200
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h	2024-07-03 20:10:26.157677785 +0200
+@@ -294,4 +294,5 @@
+ 			       unsigned short *rxwi_size);
+ void rt2800_pre_reset_hw(struct rt2x00_dev *rt2x00dev);
+ 
++void rt6352_enable_pa_pin(struct rt2x00_dev *rt2x00dev, int enable);
+ #endif /* RT2800LIB_H */
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h	2024-11-05 16:54:09.625006944 +0100
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h	2024-11-05 16:54:26.280764117 +0100
+@@ -1504,6 +1504,8 @@
+ 			     u32 *tx, u32 *tx_max, u32 *rx, u32 *rx_max);
+ bool rt2x00mac_tx_frames_pending(struct ieee80211_hw *hw);
+ 
++int rt2x00lib_read_eeprom(struct rt2x00_dev *rt2x00dev);
++
+ /*
+  * Driver allocation handlers.
+  */
diff --git a/6.12/package/kernel/mwlwifi/patches/999-fix-compilation.patch b/6.12/package/kernel/mwlwifi/patches/999-fix-compilation.patch
new file mode 100644
index 00000000..a0a553c3
--- /dev/null
+++ b/6.12/package/kernel/mwlwifi/patches/999-fix-compilation.patch
@@ -0,0 +1,38 @@
+--- a/debugfs.c	2024-09-06 11:08:19.656939190 +0200
++++ b/debugfs.c	2024-09-06 11:09:04.772324072 +0200
+@@ -331,15 +331,19 @@
+ 				     size_t count, loff_t *ppos)
+ {
+ 	struct mwl_priv *priv = (struct mwl_priv *)file->private_data;
++#if defined AARCH64
+ 	struct pcie_priv *pcie_priv = priv->hif.priv;
+ 	unsigned long flags;
++#endif
+ 	unsigned long page = get_zeroed_page(GFP_KERNEL);
+ 	int tx_num = 4, rx_num = 4;
+ 	char *p = (char *)page;
+ 	int len = 0, size = PAGE_SIZE;
+ 	ssize_t ret;
+ 	const struct hostcmd_get_hw_spec *get_hw_spec;
++#if defined AARCH64
+ 	int i;
++#endif
+ 
+ 	if (!p)
+ 		return -ENOMEM;
+@@ -359,6 +359,7 @@
+ 	len += scnprintf(p + len, size - len,
+ 			 "num_wcb: %d\n", le32_to_cpu(get_hw_spec->num_wcb));
+ 
++#if defined AARCH64
+ 	if (priv->chip_type == MWL8864) {
+ 		len += scnprintf(p + len, size - len,
+ 			 "-----------------------=>  address| address|qlen|fw_desc_cnt\n");
+@@ -370,6 +371,7 @@
+ 				"wcb_base[%2d]: %x => %8x|%8p|%4d|%d\n", i, get_hw_spec->wcb_base[i], *((unsigned int *)le32_to_cpu(get_hw_spec->wcb_base[i])),(void *)*((unsigned int *)le32_to_cpu(get_hw_spec->wcb_base[i])),skb_queue_len(&pcie_priv->txq[i + 1]),pcie_priv->fw_desc_cnt[i + 1]);
+ 		spin_unlock_irqrestore(&pcie_priv->tx_desc_lock, flags);
+ 	}
++#endif
+ 
+ 	len += scnprintf(p + len, size - len,
+ 			 "num_mcast_addr: %X\n", le16_to_cpu(get_hw_spec->num_mcast_addr));
diff --git a/6.12/package/kernel/nat46/Makefile b/6.12/package/kernel/nat46/Makefile
new file mode 100644
index 00000000..12b376f8
--- /dev/null
+++ b/6.12/package/kernel/nat46/Makefile
@@ -0,0 +1,34 @@
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/kernel.mk
+
+PKG_NAME:=nat46
+
+PKG_SOURCE_URL:=https://github.com/ayourtch/nat46.git
+PKG_SOURCE_DATE:=2024-07-02
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_VERSION:=f367088db99c9235e16dea8164eb82cbd0d299ba
+
+PKG_MAINTAINER:=Hans Dedecker <dedeckeh@gmail.com>
+PKG_LICENSE:=GPL-2.0
+
+include $(INCLUDE_DIR)/package.mk
+
+define KernelPackage/nat46
+  DEPENDS:=@IPV6 +kmod-nf-conntrack6
+  TITLE:=Stateless NAT46 translation kernel module
+  SECTION:=kernel
+  SUBMENU:=Network Support
+  FILES:=$(PKG_BUILD_DIR)/nat46/modules/nat46.ko
+  AUTOLOAD:=$(call AutoLoad,33,nat46)
+endef
+
+include $(INCLUDE_DIR)/kernel-defaults.mk
+
+define Build/Compile
+	$(KERNEL_MAKE) M="$(PKG_BUILD_DIR)/nat46/modules" \
+		MODFLAGS="-DMODULE -mlong-calls" \
+		EXTRA_CFLAGS="-DNAT46_VERSION=\\\"$(PKG_SOURCE_VERSION)\\\"" \
+		modules
+endef
+
+$(eval $(call KernelPackage,nat46))
diff --git a/6.12/package/kernel/nat46/patches/001-fix-kernel-6.10.patch b/6.12/package/kernel/nat46/patches/001-fix-kernel-6.10.patch
new file mode 100644
index 00000000..03e052bc
--- /dev/null
+++ b/6.12/package/kernel/nat46/patches/001-fix-kernel-6.10.patch
@@ -0,0 +1,99 @@
+--- a/nat46/modules/nat46-netdev.c	2024-08-14 16:36:59.249437588 +0200
++++ b/nat46/modules/nat46-netdev.c	2024-08-14 16:39:28.523016026 +0200
+@@ -193,7 +193,6 @@
+ 		return NULL;
+ 	}
+ 
+-	read_lock(&dev_base_lock);
+ 	dev = first_net_device(net);
+ 	while (dev) {
+ 		if((0 == strcmp(dev->name, name)) && is_nat46(dev)) {
+@@ -205,7 +204,6 @@
+ 		}
+ 		dev = next_net_device(dev);
+ 	}
+-	read_unlock(&dev_base_lock);
+ 	return out;
+ }
+ 
+@@ -300,7 +298,6 @@
+ 
+ void nat64_show_all_configs(struct net *net, struct seq_file *m) {
+         struct net_device *dev;
+-	read_lock(&dev_base_lock);
+ 	dev = first_net_device(net);
+ 	while (dev) {
+ 		if(is_nat46(dev)) {
+@@ -323,7 +320,6 @@
+ 		}
+ 		dev = next_net_device(dev);
+ 	}
+-	read_unlock(&dev_base_lock);
+ 
+ }
+ 
+@@ -331,7 +327,6 @@
+         struct net_device *dev;
+         struct net_device *nat46dev;
+ 	do {
+-		read_lock(&dev_base_lock);
+ 		nat46dev = NULL;
+ 		dev = first_net_device(net);
+ 		while (dev) {
+@@ -340,7 +335,6 @@
+ 			}
+ 			dev = next_net_device(dev);
+ 		}
+-		read_unlock(&dev_base_lock);
+ 		if(nat46dev) {
+ 			nat46_netdev_destroy(nat46dev);
+ 		}
+--- a/nat46/modules/nat46-netdev.h	2024-08-14 16:39:50.726655831 +0200
++++ b/nat46/modules/nat46-netdev.h	2024-08-14 16:40:25.954084361 +0200
+@@ -25,4 +25,5 @@
+ void nat64_show_all_configs(struct net *net, struct seq_file *m);
+ void nat46_netdev_count_xmit(struct sk_buff *skb, struct net_device *dev);
+ void *netdev_nat46_instance(struct net_device *dev);
+-
++int nat46_netdev_create(struct net *net, char *basename, struct net_device **dev);
++void nat46_netdev_destroy(struct net_device *dev);
+--- a/nat46/modules/nat46-core.h	2024-08-14 16:44:24.686211571 +0200
++++ b/nat46/modules/nat46-core.h	2024-08-14 16:50:42.464086457 +0200
+@@ -82,4 +82,37 @@
+ nat46_instance_t *alloc_nat46_instance(int npairs, nat46_instance_t *old, int from_ipair, int to_ipair, int remove_ipair);
+ void release_nat46_instance(nat46_instance_t *nat46);
+ 
++void nat46debug_dump(nat46_instance_t *nat46, int level, void *addr, int len);
++int try_parse_ipv6_prefix(struct in6_addr *pref, int *pref_len, char *arg);
++int try_parse_ipv4_prefix(u32 *v4addr, int *pref_len, char *arg);
++int try_parse_rule_arg(nat46_xlate_rule_t *rule, char *arg_name, char **ptail);
++char *xlate_style_to_string(nat46_xlate_style_t style);
++void xlate_v4_to_nat64(nat46_instance_t *nat46, nat46_xlate_rule_t *rule, void *pipv4, void *pipv6);
++int xlate_nat64_to_v4(nat46_instance_t *nat46, nat46_xlate_rule_t *rule, void *pipv6, void *pipv4);
++int xlate_map_v4_to_v6(nat46_instance_t *nat46, nat46_xlate_rule_t *rule, void *pipv4, void *pipv6, uint16_t *pl4id, int map_version);
++int xlate_map_v6_to_v4(nat46_instance_t *nat46, nat46_xlate_rule_t *rule, void *pipv6, void *pipv4, int version);
++int xlate_v4_to_v6(nat46_instance_t *nat46, nat46_xlate_rule_t *rule, void *pipv4, void *pipv6, uint16_t *pl4id);
++int xlate_v6_to_v4(nat46_instance_t *nat46, nat46_xlate_rule_t *rule, void *pipv6, void *pipv4);
++__sum16 csum16_upd(__sum16 csum, u16 old, u16 new);
++__sum16 csum_tcpudp_remagic(__be32 saddr, __be32 daddr, u32 len, unsigned char proto, u16 csum);
++__sum16 csum_ipv6_unmagic(nat46_instance_t *nat46, const struct in6_addr *saddr, const struct in6_addr *daddr, __u32 len, unsigned short proto, __sum16 csum);
++void update_icmp6_type_code(nat46_instance_t *nat46, struct icmp6hdr *icmp6h, u8 type, u8 code);
++u16 get_next_ip_id(void);
++u16 fold_ipv6_frag_id(u32 v6id);
++void *add_offset(void *ptr, u16 offset);
++void *get_next_header_ptr6(void *pv6, int v6_len);
++void fill_v4hdr_from_v6hdr(struct iphdr * iph, struct ipv6hdr *ip6h, __u32 v4saddr, __u32 v4daddr, __u16 id, __u16 frag_off, __u16 proto, int l3_payload_len);
++u16 unchecksum16(void *p, int count, u16 csum);
++u16 rechecksum16(void *p, int count, u16 csum);
++int is_last_pair_in_group(nat46_xlate_rulepair_t *apair);
++void pairs_xlate_v6_to_v4_inner(nat46_instance_t *nat46, struct ipv6hdr *ip6h, __u32 *pv4saddr, __u32 *pv4daddr);
++int xlate_payload6_to4(nat46_instance_t *nat46, void *pv6, void *ptrans_hdr, int v6_len, u16 *ul_sum, int *ptailTruncSize);
++u8 *icmp_parameter_ptr(struct icmphdr *icmph);
++u32 *icmp6_parameter_ptr(struct icmp6hdr *icmp6h);
++int ip6_input_not_interested(nat46_instance_t *nat46, struct ipv6hdr *ip6h, struct sk_buff *old_skb);
++int pairs_xlate_v6_to_v4_outer(nat46_instance_t *nat46, struct ipv6hdr *ip6h, uint16_t proto, __u32 *pv4saddr, __u32 *pv4daddr);
++void ip6_update_csum(struct sk_buff * skb, struct ipv6hdr * ip6hdr, int do_atomic_frag);
++int ip4_input_not_interested(nat46_instance_t *nat46, struct iphdr *iph, struct sk_buff *old_skb);
++int pairs_xlate_v4_to_v6_outer(nat46_instance_t *nat46, struct iphdr *hdr4, uint16_t *sport, uint16_t *dport, void *v6saddr, void *v6daddr);
++int is_valid_nat46(nat46_instance_t *nat46);
+ #endif
diff --git a/6.12/package/kernel/nat46/patches/002-fix-kernel-6.11.patch b/6.12/package/kernel/nat46/patches/002-fix-kernel-6.11.patch
new file mode 100644
index 00000000..244c6da1
--- /dev/null
+++ b/6.12/package/kernel/nat46/patches/002-fix-kernel-6.11.patch
@@ -0,0 +1,10 @@
+--- a/nat46/modules/nat46-netdev.c	2024-09-13 09:39:48.960815094 +0200
++++ b/nat46/modules/nat46-netdev.c	2024-09-13 09:40:11.128500472 +0200
+@@ -110,7 +110,6 @@
+ 	dev->hard_header_len = 0;
+ 	dev->addr_len = 0;
+ 	dev->mtu = 16384; /* iptables does reassembly. Rather than using ETH_DATA_LEN, let's try to get as much mileage as we can with the Linux stack */
+-	dev->features = NETIF_F_NETNS_LOCAL;
+ 	dev->flags = IFF_NOARP | IFF_POINTOPOINT;
+ }
+ 
diff --git a/6.12/package/kernel/qca-nss-dp/patches/0012-nss-dp-disable-warnings-to-support-linux-6.12.patch b/6.12/package/kernel/qca-nss-dp/patches/0012-nss-dp-disable-warnings-to-support-linux-6.12.patch
new file mode 100644
index 00000000..305d62ee
--- /dev/null
+++ b/6.12/package/kernel/qca-nss-dp/patches/0012-nss-dp-disable-warnings-to-support-linux-6.12.patch
@@ -0,0 +1,20 @@
+From 078b67683613d8f066a2955802b46a4b27eb642e Mon Sep 17 00:00:00 2001
+From: Mantas Pucka <mantas@8devices.com>
+Date: Tue, 10 Dec 2024 13:24:39 +0200
+Subject: [PATCH 16/17] nss-dp: disable warnings to support linux-6.12
+
+Linux 6.12 adds these new warnings which become build errors
+
+Signed-off-by: Mantas Pucka <mantas@8devices.com>
+---
+ Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/Makefile
++++ b/Makefile
+@@ -90,4 +90,5 @@ endif
+ 
+ ccflags-y += $(NSS_DP_INCLUDE)
+ ccflags-y += -Wall -Werror
++ccflags-y += -Wno-missing-prototypes -Wno-missing-declarations
+ ccflags-y += -DEDMA_DEBUG_LEVEL=2
diff --git a/6.12/package/kernel/qca-nss-dp/patches/0013-nss-dp-adapt-to-linux-6.12-API.patch b/6.12/package/kernel/qca-nss-dp/patches/0013-nss-dp-adapt-to-linux-6.12-API.patch
new file mode 100644
index 00000000..772541f7
--- /dev/null
+++ b/6.12/package/kernel/qca-nss-dp/patches/0013-nss-dp-adapt-to-linux-6.12-API.patch
@@ -0,0 +1,74 @@
+From cdfdb0fd6407bb3a3a3c7bf9602d40928d950641 Mon Sep 17 00:00:00 2001
+From: Mantas Pucka <mantas@8devices.com>
+Date: Tue, 10 Dec 2024 13:32:04 +0200
+Subject: [PATCH 17/18] nss-dp: adapt to linux 6.12 API
+
+Add compatibility with 6.12
+
+Signed-off-by: Mantas Pucka <mantas@8devices.com>
+---
+ nss_dp_main.c     | 10 ++++------
+ 2 files changed, 10 insertions(+), 8 deletions(-)
+
+--- a/nss_dp_main.c
++++ b/nss_dp_main.c
+@@ -34,6 +34,10 @@
+ #if (LINUX_VERSION_CODE > KERNEL_VERSION(6, 6, 0))
+ #include <net/netdev_rx_queue.h>
+ #endif
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 12, 0))
++#include <net/rps.h>
++#include <net/hotdata.h>
++#endif
+ #if defined(NSS_DP_MAC_POLL_SUPPORT)
+ #include <init/ssdk_init.h>
+ #endif
+@@ -496,14 +500,22 @@ static int nss_dp_rx_flow_steer(struct n
+ 	rxflow = &flow_table->flows[hash & flow_table->mask];
+ 	rxcpu = (uint32_t)rxflow->cpu;
+ 
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 12, 0))
++	sock_flow_table = rcu_dereference(net_hotdata.rps_sock_flow_table);
++#else
+ 	sock_flow_table = rcu_dereference(rps_sock_flow_table);
++#endif
+ 	if (!sock_flow_table) {
+ 		netdev_dbg(netdev, "Global RPS flow table not found\n");
+ 		return -EINVAL;
+ 	}
+ 
+ 	rfscpu = sock_flow_table->ents[hash & sock_flow_table->mask];
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 12, 0))
++	rfscpu &= net_hotdata.rps_cpu_mask;
++#else
+ 	rfscpu &= rps_cpu_mask;
++#endif
+ 
+ 	if (rxcpu == rfscpu)
+ 		return 0;
+@@ -998,6 +1010,13 @@ static int nss_dp_remove(struct platform
+ 	return 0;
+ }
+ 
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6,12,0)
++static void nss_dp_remove_new(struct platform_device *pdev)
++{
++	nss_dp_remove(pdev);
++}
++#endif
++
+ static struct of_device_id nss_dp_dt_ids[] = {
+ 	{ .compatible = "qcom,nss-dp" },
+ 	{},
+@@ -1006,7 +1025,11 @@ MODULE_DEVICE_TABLE(of, nss_dp_dt_ids);
+ 
+ static struct platform_driver nss_dp_drv = {
+ 	.probe = nss_dp_probe,
++#if LINUX_VERSION_CODE < KERNEL_VERSION(6,12,0)
+ 	.remove = nss_dp_remove,
++#else
++	.remove_new = nss_dp_remove_new,
++#endif
+ 	.driver = {
+ 		   .name = "nss-dp",
+ 		   .owner = THIS_MODULE,
diff --git a/6.12/package/kernel/qca-nss-dp/patches/0014-nss-dp-update-EEE-support-for-6.12.patch b/6.12/package/kernel/qca-nss-dp/patches/0014-nss-dp-update-EEE-support-for-6.12.patch
new file mode 100644
index 00000000..5003e99a
--- /dev/null
+++ b/6.12/package/kernel/qca-nss-dp/patches/0014-nss-dp-update-EEE-support-for-6.12.patch
@@ -0,0 +1,155 @@
+From cdfdb0fd6407bb3a3a3c7bf9602d40928d950641 Mon Sep 17 00:00:00 2001
+From: Mantas Pucka <mantas@8devices.com>
+Date: Tue, 10 Dec 2024 13:32:04 +0200
+Subject: [PATCH 18/18] nss-dp: update EEE support for 6.12
+
+Linux 6.12 changed API for EEE link modes
+
+Signed-off-by: Mantas Pucka <mantas@8devices.com>
+---
+ nss_dp_ethtools.c |  8 ++++++--
+ 2 files changed, 10 insertions(+), 8 deletions(-)
+
+--- a/nss_dp_ethtools.c
++++ b/nss_dp_ethtools.c
+@@ -206,6 +206,7 @@ static int32_t nss_dp_set_pauseparam(str
+  * nss_dp_fal_to_ethtool_linkmode_xlate()
+  *	Translate linkmode from FAL type to ethtool type.
+  */
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 12, 0))
+ static inline void nss_dp_fal_to_ethtool_linkmode_xlate(uint32_t *xlate_to, uint32_t *xlate_from)
+ {
+ 	uint32_t pos;
+@@ -243,12 +244,26 @@ static inline void nss_dp_fal_to_ethtool
+ 		*xlate_from &= (~(1 << (pos - 1)));
+ 	}
+ }
++#else
++static inline void nss_dp_fal_to_ethtool_linkmode_xlate(unsigned long *to, uint32_t from)
++{
++	linkmode_mod_bit(ETHTOOL_LINK_MODE_10baseT_Full_BIT, to, from & FAL_PHY_EEE_10BASE_T);
++	linkmode_mod_bit(ETHTOOL_LINK_MODE_100baseT_Full_BIT, to, from & FAL_PHY_EEE_100BASE_T);
++	linkmode_mod_bit(ETHTOOL_LINK_MODE_1000baseT_Full_BIT, to, from & FAL_PHY_EEE_1000BASE_T);
++	linkmode_mod_bit(ETHTOOL_LINK_MODE_2500baseX_Full_BIT, to, from & FAL_PHY_EEE_2500BASE_T);
++	linkmode_mod_bit(ETHTOOL_LINK_MODE_10000baseT_Full_BIT, to, from & FAL_PHY_EEE_10000BASE_T);
++}
++#endif
+ 
+ /*
+  * nss_dp_get_eee()
+  *	Get EEE settings.
+  */
+-static int32_t nss_dp_get_eee(struct net_device *netdev, struct ethtool_eee *eee)
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 12, 0))
++static int nss_dp_get_eee(struct net_device *netdev, struct ethtool_eee *eee)
++#else
++static int nss_dp_get_eee(struct net_device *netdev, struct ethtool_keee *eee)
++#endif
+ {
+ 	struct nss_dp_dev *dp_priv = (struct nss_dp_dev *)netdev_priv(netdev);
+ 	fal_port_eee_cfg_t port_eee_cfg;
+@@ -266,9 +281,15 @@ static int32_t nss_dp_get_eee(struct net
+ 	/*
+ 	 * Translate the FAL linkmode types to ethtool linkmode types.
+ 	 */
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 12, 0))
+ 	nss_dp_fal_to_ethtool_linkmode_xlate(&eee->supported, &port_eee_cfg.capability);
+ 	nss_dp_fal_to_ethtool_linkmode_xlate(&eee->advertised, &port_eee_cfg.advertisement);
+ 	nss_dp_fal_to_ethtool_linkmode_xlate(&eee->lp_advertised, &port_eee_cfg.link_partner_advertisement);
++#else
++	nss_dp_fal_to_ethtool_linkmode_xlate(eee->supported, port_eee_cfg.capability);
++	nss_dp_fal_to_ethtool_linkmode_xlate(eee->advertised, port_eee_cfg.advertisement);
++	nss_dp_fal_to_ethtool_linkmode_xlate(eee->lp_advertised, port_eee_cfg.link_partner_advertisement);
++#endif
+ 	eee->eee_enabled = port_eee_cfg.enable;
+ 	eee->eee_active = port_eee_cfg.eee_status;
+ 	eee->tx_lpi_enabled = port_eee_cfg.lpi_tx_enable;
+@@ -281,11 +302,15 @@ static int32_t nss_dp_get_eee(struct net
+  * nss_dp_set_eee()
+  *	Set EEE settings.
+  */
+-static int32_t nss_dp_set_eee(struct net_device *netdev, struct ethtool_eee *eee)
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 12, 0))
++static int nss_dp_set_eee(struct net_device *netdev, struct ethtool_eee *eee)
++#else
++static int nss_dp_set_eee(struct net_device *netdev, struct ethtool_keee *eee)
++#endif
+ {
+ 	struct nss_dp_dev *dp_priv = (struct nss_dp_dev *)netdev_priv(netdev);
+ 	fal_port_eee_cfg_t port_eee_cfg, port_eee_cur_cfg;
+-	uint32_t port_id, pos;
++	uint32_t port_id;
+ 	sw_error_t ret;
+ 
+ 	memset(&port_eee_cfg, 0, sizeof(fal_port_eee_cfg_t));
+@@ -306,8 +331,9 @@ static int32_t nss_dp_set_eee(struct net
+ 	/*
+ 	 * Translate the ethtool speed types to FAL speed types.
+ 	 */
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 12, 0))
+ 	while (eee->advertised) {
+-		pos = ffs(eee->advertised);
++		uint32_t pos = ffs(eee->advertised);
+ 		switch (1 << (pos - 1)) {
+ 		case ADVERTISED_10baseT_Full:
+ 			if (port_eee_cur_cfg.capability & FAL_PHY_EEE_10BASE_T) {
+@@ -361,6 +387,48 @@ static int32_t nss_dp_set_eee(struct net
+ 
+ 		eee->advertised &= (~(1 << (pos - 1)));
+ 	}
++#else
++	if (linkmode_test_bit(ETHTOOL_LINK_MODE_10baseT_Full_BIT, eee->advertised)) {
++		if (port_eee_cur_cfg.capability & FAL_PHY_EEE_10BASE_T) {
++			port_eee_cfg.advertisement |= FAL_PHY_EEE_10BASE_T;
++		} else {
++			netdev_dbg(netdev, "Advertised value 10baseT_Full is not supported\n");
++			return -EIO;
++		}
++	}
++	if (linkmode_test_bit(ETHTOOL_LINK_MODE_100baseT_Full_BIT, eee->advertised)) {
++		if (port_eee_cur_cfg.capability & FAL_PHY_EEE_100BASE_T) {
++			port_eee_cfg.advertisement |= FAL_PHY_EEE_100BASE_T;
++		} else {
++			netdev_dbg(netdev, "Advertised value 100baseT_Full is not supported\n");
++			return -EIO;
++		}
++	}
++	if (linkmode_test_bit(ETHTOOL_LINK_MODE_1000baseT_Full_BIT, eee->advertised)) {
++		if (port_eee_cur_cfg.capability & FAL_PHY_EEE_1000BASE_T) {
++			port_eee_cfg.advertisement |= FAL_PHY_EEE_1000BASE_T;
++		} else {
++			netdev_dbg(netdev, "Advertised value 1000baseT_Full is not supported\n");
++			return -EIO;
++		}
++	}
++	if (linkmode_test_bit(ETHTOOL_LINK_MODE_2500baseX_Full_BIT, eee->advertised)) {
++		if (port_eee_cur_cfg.capability & FAL_PHY_EEE_2500BASE_T) {
++			port_eee_cfg.advertisement |= FAL_PHY_EEE_2500BASE_T;
++		} else {
++			netdev_dbg(netdev, "Advertised value 2500baseX_Full is not supported\n");
++			return -EIO;
++		}
++	}
++	if (linkmode_test_bit(ETHTOOL_LINK_MODE_10000baseT_Full_BIT, eee->advertised)) {
++		if (port_eee_cur_cfg.capability & FAL_PHY_EEE_10000BASE_T) {
++			port_eee_cfg.advertisement |= FAL_PHY_EEE_10000BASE_T;
++		} else {
++			netdev_dbg(netdev, "Advertised value 1000baseT_Full is not supported\n");
++			return -EIO;
++		}
++	}
++#endif
+ 
+ 	port_eee_cfg.lpi_tx_enable = eee->tx_lpi_enabled;
+ 	port_eee_cfg.lpi_sleep_timer = eee->tx_lpi_timer;
+@@ -482,8 +550,10 @@ struct ethtool_ops nss_dp_ethtool_ops =
+ #endif
+ 	.get_pauseparam = &nss_dp_get_pauseparam,
+ 	.set_pauseparam = &nss_dp_set_pauseparam,
++
+ 	.get_eee = &nss_dp_get_eee,
+ 	.set_eee = &nss_dp_set_eee,
++
+ 	.get_priv_flags = nss_dp_get_priv_flags,
+ 	.set_priv_flags = nss_dp_set_priv_flags,
+ };
diff --git a/6.12/package/kernel/qca-ssdk/patches/104-ssdk-replace-deprecated-strlcpy-with-strscpy.patch b/6.12/package/kernel/qca-ssdk/patches/104-ssdk-replace-deprecated-strlcpy-with-strscpy.patch
new file mode 100644
index 00000000..9c8056a0
--- /dev/null
+++ b/6.12/package/kernel/qca-ssdk/patches/104-ssdk-replace-deprecated-strlcpy-with-strscpy.patch
@@ -0,0 +1,72 @@
+From ef91390278b98b48adf65e6d3b772ddecfc4f6b0 Mon Sep 17 00:00:00 2001
+From: Mantas Pucka <mantas@8devices.com>
+Date: Tue, 10 Dec 2024 13:05:30 +0200
+Subject: [PATCH 7/9] ssdk: replace deprecated strlcpy() with strscpy()
+
+Since linux-6.12 strlcpy() is no longer available
+
+Signed-off-by: Mantas Pucka <mantas@8devices.com>
+---
+ src/shell_lib/shell_io.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/src/shell_lib/shell_io.c
++++ b/src/shell_lib/shell_io.c
+@@ -951,16 +951,16 @@ cmd_sscanf(const char *buf, const char *
+ 	if(buf[0] == '0' && (buf[1] == 'x' || buf[1] == 'X'))
+ 	{
+ 		if(!fmt)
+-			strlcpy(fmt_tmp, "%x", sizeof(fmt_tmp));
++			strscpy(fmt_tmp, "%x", sizeof(fmt_tmp));
+ 		else
+ 		{
+ 			if(strspn(fmt, "%lLxXhH") != strlen(fmt))
+ 				return SW_BAD_VALUE;
+ 			if(fmt[0] == '%' && ((fmt[1] == 'l' || fmt[1] == 'L') &&
+ 				(fmt[2] == 'l' || fmt[2] == 'L')))
+-				strlcpy(fmt_tmp, "%llx", sizeof(fmt_tmp));
++				strscpy(fmt_tmp, "%llx", sizeof(fmt_tmp));
+ 			else
+-				strlcpy(fmt_tmp, fmt, sizeof(fmt_tmp));
++				strscpy(fmt_tmp, fmt, sizeof(fmt_tmp));
+ 		}
+ 	}
+ 	else
+@@ -968,16 +968,16 @@ cmd_sscanf(const char *buf, const char *
+ 		if(strspn(buf, "1234567890") != strlen(buf))
+ 			return SW_BAD_VALUE;
+ 		if(!fmt)
+-			strlcpy(fmt_tmp, "%d", sizeof(fmt_tmp));
++			strscpy(fmt_tmp, "%d", sizeof(fmt_tmp));
+ 		else
+ 		{
+ 			if(strspn(fmt, "%lLdD") != strlen(fmt))
+ 				return SW_BAD_VALUE;
+ 			if(fmt[0] == '%' && ((fmt[1] == 'l' || fmt[1] == 'L') &&
+ 				(fmt[2] == 'l' || fmt[2] == 'L')))
+-				strlcpy(fmt_tmp, "%lld", sizeof(fmt_tmp));
++				strscpy(fmt_tmp, "%lld", sizeof(fmt_tmp));
+ 			else
+-				strlcpy(fmt_tmp, fmt, sizeof(fmt_tmp));
++				strscpy(fmt_tmp, fmt, sizeof(fmt_tmp));
+ 		}
+ 	}
+ 	if(sscanf(buf, fmt_tmp, arg_val) != 1)
+@@ -2736,7 +2736,7 @@ cmd_data_check_portmap(char *cmdstr, fal
+         return SW_OK;
+     }
+ 
+-    strlcpy(tmp_str, cmdstr, sizeof(tmp_str));
++    strscpy(tmp_str, cmdstr, sizeof(tmp_str));
+     tmp = (void *) strsep(&cmdstr, ",");
+     while (tmp)
+     {
+@@ -12818,7 +12818,7 @@ cmd_data_check_tunnel_encap_entry(char *
+ 						break;
+ 					}
+ 					/* copy 2 chars from cmd */
+-					strlcpy(cmd_byte, cmd, sizeof(cmd_byte));
++					strscpy(cmd_byte, cmd, sizeof(cmd_byte));
+ 					sscanf(cmd_byte, "%hhx",
+ 						&(entry.pkt_header.pkt_header_data[bytes]));
+ 					cmd += 2;
diff --git a/6.12/package/kernel/qca-ssdk/patches/105-ssdk-disable-warnings-to-support-linux-6.12.patch b/6.12/package/kernel/qca-ssdk/patches/105-ssdk-disable-warnings-to-support-linux-6.12.patch
new file mode 100644
index 00000000..2ff87c55
--- /dev/null
+++ b/6.12/package/kernel/qca-ssdk/patches/105-ssdk-disable-warnings-to-support-linux-6.12.patch
@@ -0,0 +1,25 @@
+From 85c328ef31f3da7b2dab82c5a1c8559295620f76 Mon Sep 17 00:00:00 2001
+From: Mantas Pucka <mantas@8devices.com>
+Date: Tue, 10 Dec 2024 13:10:07 +0200
+Subject: [PATCH 8/9] ssdk: disable warnings to support linux-6.12
+
+Linux 6.12 adds these new warnings which become build errors with
+default -Werror.
+
+Signed-off-by: Mantas Pucka <mantas@8devices.com>
+---
+ make/linux_opt.mk | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/make/linux_opt.mk
++++ b/make/linux_opt.mk
+@@ -314,6 +314,9 @@ endif
+ 
+ MODULE_CFLAG += $(OPT_FLAG) -Wall -DVERSION=\"$(VERSION)\" -DBUILD_DATE=\"$(BUILD_DATE)\" -DOS=\"$(OS)\" -D"KBUILD_STR(s)=\#s"
+ 
++# Linux 6.12 compatibility
++MODULE_CFLAG += -Wno-missing-prototypes -Wno-missing-declarations -Wno-discarded-qualifiers
++
+ MODULE_INC += -I$(PRJ_PATH)/include \
+                    -I$(PRJ_PATH)/include/common \
+                    -I$(PRJ_PATH)/include/api \
diff --git a/6.12/package/kernel/qca-ssdk/patches/106-ssdk-add-missing-include.patch b/6.12/package/kernel/qca-ssdk/patches/106-ssdk-add-missing-include.patch
new file mode 100644
index 00000000..c1036f1d
--- /dev/null
+++ b/6.12/package/kernel/qca-ssdk/patches/106-ssdk-add-missing-include.patch
@@ -0,0 +1,22 @@
+From 01e7ad1b785b0662e9a2f41cb7dffbcea35ed0c1 Mon Sep 17 00:00:00 2001
+From: Mantas Pucka <mantas@8devices.com>
+Date: Tue, 10 Dec 2024 13:13:16 +0200
+Subject: [PATCH 9/9] ssdk: add missing include
+
+Fixes build with linux 6.12
+
+Signed-off-by: Mantas Pucka <mantas@8devices.com>
+---
+ src/init/ssdk_dts.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/src/init/ssdk_dts.c
++++ b/src/init/ssdk_dts.c
+@@ -38,6 +38,7 @@
+ #include <linux/of.h>
+ #include <linux/of_mdio.h>
+ #include <linux/of_platform.h>
++#include <linux/platform_device.h>
+ 
+ static ssdk_dt_global_t ssdk_dt_global = {0};
+ #ifdef HPPE
diff --git a/6.12/package/kernel/qca-ssdk/patches/200-allow-parallel-build.patch b/6.12/package/kernel/qca-ssdk/patches/200-allow-parallel-build.patch
new file mode 100644
index 00000000..2bef6b2a
--- /dev/null
+++ b/6.12/package/kernel/qca-ssdk/patches/200-allow-parallel-build.patch
@@ -0,0 +1,50 @@
+--- a/Makefile
++++ b/Makefile
+@@ -1,17 +1,19 @@
+-include ./config
+-
+ ifndef PRJ_PATH
+   PRJ_PATH=$(shell pwd)
+ endif
+ export PRJ_PATH
+ 
+-include ./make/config.mk
+-include ./make/tools.mk
+-include ./make/$(OS)_opt.mk
++include $(PRJ_PATH)/config
++
++include $(PRJ_PATH)/make/config.mk
++include $(PRJ_PATH)/make/tools.mk
++include $(PRJ_PATH)/make/$(OS)_opt.mk
+ 
+ SUB_DIR=$(patsubst %/, %, $(dir $(wildcard src/*/Makefile)))
+ SUB_LIB=$(subst src/, , $(SUB_DIR))
+ 
++include $(PRJ_PATH)/Makefile.modules
++
+ ####################################################################
+ # 			SSDK-Style Makefile
+ ####################################################################
+@@ -27,11 +29,7 @@ all: $(BIN_DIR) kslib
+ # 			LNX Modules-Style Makefile
+ ####################################################################
+ modules: $(BIN_DIR) kslib_c
+-	mkdir -p ./temp/;cp * ./temp -a;cd ./temp;cp ../Makefile.modules ./Makefile;
+-	make -C $(SYS_PATH) M=$(PRJ_PATH)/temp $(LNX_MAKEOPTS) modules
+-	cp $(PRJ_PATH)/temp/Module.symvers $(PRJ_PATH)/Module.symvers;
+-	cp temp/*.ko build/bin;
+-	rm -Rf ./temp/*.o ./temp/*.ko ./temp/*.a
++	@$(MAKE) -C $(SYS_PATH) M=$(PRJ_PATH) $(LNX_MAKEOPTS) modules
+ 	@echo "---Build [SSDK-$(VERSION)] at $(BUILD_DATE) finished."
+ 
+ kslib_c:
+--- a/make/linux_opt.mk
++++ b/make/linux_opt.mk
+@@ -785,6 +785,6 @@ LOCAL_CFLAGS += $(CPU_CFLAG) -D"KBUILD_M
+ ####################################################################
+ # 			cflags for LNX Modules-Style Makefile
+ ####################################################################
+-LNX_LOCAL_CFLAGS += $(MODULE_INC) $(MODULE_CFLAG) ${EXTRA_INC} -DFALLTHROUGH
++LNX_LOCAL_CFLAGS = $(MODULE_INC) $(MODULE_CFLAG) ${EXTRA_INC} -DFALLTHROUGH
+ export LNX_LOCAL_CFLAGS
+ 
diff --git a/6.12/package/kernel/ubootenv-nvram/patches/010-make-ubootenv_remove-return-void-for-linux-6.12.patch b/6.12/package/kernel/ubootenv-nvram/patches/010-make-ubootenv_remove-return-void-for-linux-6.12.patch
new file mode 100644
index 00000000..c23f6395
--- /dev/null
+++ b/6.12/package/kernel/ubootenv-nvram/patches/010-make-ubootenv_remove-return-void-for-linux-6.12.patch
@@ -0,0 +1,42 @@
+--- a/ubootenv-nvram.c
++++ b/ubootenv-nvram.c
+@@ -13,6 +13,7 @@
+ #include <linux/of.h>
+ #include <linux/of_reserved_mem.h>
+ #include <linux/platform_device.h>
++#include <linux/version.h>
+ 
+ #define NAME "ubootenv"
+ 
+@@ -132,18 +133,30 @@ static int ubootenv_probe(struct platfor
+ 	return misc_register(&data->misc);
+ }
+ 
+-static int ubootenv_remove(struct platform_device *pdev)
++static
++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 11, 0)
++int
++#else
++void
++#endif
++ubootenv_remove(struct platform_device *pdev)
+ {
+ 	struct ubootenv_drvdata *data = platform_get_drvdata(pdev);
+ 
+ 	data->env = NULL;
+ 	misc_deregister(&data->misc);
++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 11, 0)
+ 	return 0;
++#endif
+ }
+ 
+ static struct platform_driver ubootenv_driver = {
+ 	.probe = ubootenv_probe,
++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 11, 0)
+ 	.remove = ubootenv_remove,
++#else
++	.remove_new = ubootenv_remove,
++#endif
+ 	.driver = {
+ 		.name           = NAME,
+ 		.owner          = THIS_MODULE,
diff --git a/6.12/package/libs/libnftnl/Makefile b/6.12/package/libs/libnftnl/Makefile
new file mode 100644
index 00000000..038ed1bf
--- /dev/null
+++ b/6.12/package/libs/libnftnl/Makefile
@@ -0,0 +1,76 @@
+#
+# Copyright (C) 2014 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=libnftnl
+PKG_CPE_ID:=cpe:/a:netfilter:libnftnl
+PKG_VERSION:=1.2.6
+PKG_RELEASE:=2
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
+PKG_SOURCE_URL:=https://netfilter.org/projects/$(PKG_NAME)/files
+PKG_HASH:=ceeaea2cd92147da19f13a35a7f1a4bc2767ff897e838e4b479cf54b59c777f4
+
+PKG_MAINTAINER:=Steven Barth <steven@midlink.org>
+PKG_LICENSE:=GPL-2.0-or-later
+PKG_LICENSE_FILES:=COPYING
+
+PKG_INSTALL:=1
+PKG_BUILD_PARALLEL:=1
+PKG_BUILD_FLAGS:=lto
+PKG_FIXUP:=autoreconf
+
+include $(INCLUDE_DIR)/package.mk
+
+DISABLE_NLS:=
+
+define Package/libnftnl
+  SECTION:=libs
+  CATEGORY:=Libraries
+  DEPENDS:=+libmnl
+  TITLE:=Low-level netlink library for the nf_tables subsystem
+  URL:=http://www.netfilter.org/projects/libnftnl
+  ABI_VERSION:=11
+endef
+
+define Package/libnftnl/description
+ libnftnl is a userspace library providing a low-level netlink
+ programming interface (API) to the in-kernel nf_tables subsystem.
+endef
+
+TARGET_CFLAGS += $(FPIC)
+
+CONFIGURE_ARGS += \
+	--enable-static \
+	--enable-shared
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include/libnftnl
+	$(CP) \
+		$(PKG_INSTALL_DIR)/usr/include/libnftnl/*.h \
+		$(1)/usr/include/libnftnl/
+
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) \
+		$(PKG_INSTALL_DIR)/usr/lib/libnftnl.{so*,a,la} \
+		$(1)/usr/lib/
+
+	$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
+	$(CP) \
+		$(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libnftnl.pc \
+		$(1)/usr/lib/pkgconfig/
+endef
+
+define Package/libnftnl/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) \
+		$(PKG_INSTALL_DIR)/usr/lib/libnftnl.so.* \
+		$(1)/usr/lib/
+endef
+
+$(eval $(call BuildPackage,libnftnl))
diff --git a/6.12/package/libs/libnftnl/patches/999-01-libnftnl-add-fullcone-expression-support.patch b/6.12/package/libs/libnftnl/patches/999-01-libnftnl-add-fullcone-expression-support.patch
new file mode 100644
index 00000000..0e8b349c
--- /dev/null
+++ b/6.12/package/libs/libnftnl/patches/999-01-libnftnl-add-fullcone-expression-support.patch
@@ -0,0 +1,254 @@
+From 6c39f04febd7cfdbd474233379416babcd0fc341 Mon Sep 17 00:00:00 2001
+From: Syrone Wong <wong.syrone@gmail.com>
+Date: Fri, 8 Apr 2022 23:52:11 +0800
+Subject: [PATCH] libnftnl: add fullcone expression support
+
+Signed-off-by: Syrone Wong <wong.syrone@gmail.com>
+---
+ include/libnftnl/expr.h             |   6 +
+ include/linux/netfilter/nf_tables.h |  16 +++
+ src/Makefile.am                     |   1 +
+ src/expr/fullcone.c                 | 167 ++++++++++++++++++++++++++++
+ src/expr_ops.c                      |   2 +
+ 5 files changed, 192 insertions(+)
+ create mode 100644 src/expr/fullcone.c
+
+--- a/include/libnftnl/expr.h
++++ b/include/libnftnl/expr.h
+@@ -245,6 +245,12 @@ enum {
+ };
+ 
+ enum {
++	NFTNL_EXPR_FULLCONE_FLAGS		= NFTNL_EXPR_BASE,
++	NFTNL_EXPR_FULLCONE_REG_PROTO_MIN,
++	NFTNL_EXPR_FULLCONE_REG_PROTO_MAX,
++};
++
++enum {
+ 	NFTNL_EXPR_REDIR_REG_PROTO_MIN	= NFTNL_EXPR_BASE,
+ 	NFTNL_EXPR_REDIR_REG_PROTO_MAX,
+ 	NFTNL_EXPR_REDIR_FLAGS,
+--- a/include/linux/netfilter/nf_tables.h
++++ b/include/linux/netfilter/nf_tables.h
+@@ -1434,6 +1434,22 @@ enum nft_masq_attributes {
+ #define NFTA_MASQ_MAX		(__NFTA_MASQ_MAX - 1)
+ 
+ /**
++ * enum nft_fullcone_attributes - nf_tables fullcone expression attributes
++ *
++ * @NFTA_FULLCONE_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32)
++ * @NFTA_FULLCONE_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
++ * @NFTA_FULLCONE_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
++ */
++enum nft_fullcone_attributes {
++	NFTA_FULLCONE_UNSPEC,
++	NFTA_FULLCONE_FLAGS,
++	NFTA_FULLCONE_REG_PROTO_MIN,
++	NFTA_FULLCONE_REG_PROTO_MAX,
++	__NFTA_FULLCONE_MAX
++};
++#define NFTA_FULLCONE_MAX		(__NFTA_FULLCONE_MAX - 1)
++
++/**
+  * enum nft_redir_attributes - nf_tables redirect expression netlink attributes
+  *
+  * @NFTA_REDIR_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -54,6 +54,7 @@ libnftnl_la_SOURCES = utils.c		\
+ 		      expr/target.c	\
+ 		      expr/tunnel.c	\
+ 		      expr/masq.c	\
++		      expr/fullcone.c	\
+ 		      expr/redir.c	\
+ 		      expr/hash.c	\
+ 		      expr/socket.c	\
+--- /dev/null
++++ b/src/expr/fullcone.c
+@@ -0,0 +1,168 @@
++/*
++ * (C) 2022 wongsyrone
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published
++ * by the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ */
++
++#include <stdio.h>
++#include <stdint.h>
++#include <arpa/inet.h>
++#include <errno.h>
++#include <inttypes.h>
++
++#include <linux/netfilter/nf_tables.h>
++
++#include "internal.h"
++#include <libmnl/libmnl.h>
++#include <libnftnl/expr.h>
++#include <libnftnl/rule.h>
++
++struct nftnl_expr_fullcone {
++	uint32_t		flags;
++	enum nft_registers	sreg_proto_min;
++	enum nft_registers	sreg_proto_max;
++};
++
++static int
++nftnl_expr_fullcone_set(struct nftnl_expr *e, uint16_t type,
++		       const void *data, uint32_t data_len)
++{
++	struct nftnl_expr_fullcone *fullcone = nftnl_expr_data(e);
++
++	switch (type) {
++	case NFTNL_EXPR_FULLCONE_FLAGS:
++		memcpy(&fullcone->flags, data, sizeof(fullcone->flags));
++		break;
++	case NFTNL_EXPR_FULLCONE_REG_PROTO_MIN:
++		memcpy(&fullcone->sreg_proto_min, data, sizeof(fullcone->sreg_proto_min));
++		break;
++	case NFTNL_EXPR_FULLCONE_REG_PROTO_MAX:
++		memcpy(&fullcone->sreg_proto_max, data, sizeof(fullcone->sreg_proto_max));
++		break;
++	default:
++		return -1;
++	}
++	return 0;
++}
++
++static const void *
++nftnl_expr_fullcone_get(const struct nftnl_expr *e, uint16_t type,
++		       uint32_t *data_len)
++{
++	struct nftnl_expr_fullcone *fullcone = nftnl_expr_data(e);
++
++	switch (type) {
++	case NFTNL_EXPR_FULLCONE_FLAGS:
++		*data_len = sizeof(fullcone->flags);
++		return &fullcone->flags;
++	case NFTNL_EXPR_FULLCONE_REG_PROTO_MIN:
++		*data_len = sizeof(fullcone->sreg_proto_min);
++		return &fullcone->sreg_proto_min;
++	case NFTNL_EXPR_FULLCONE_REG_PROTO_MAX:
++		*data_len = sizeof(fullcone->sreg_proto_max);
++		return &fullcone->sreg_proto_max;
++	}
++	return NULL;
++}
++
++static int nftnl_expr_fullcone_cb(const struct nlattr *attr, void *data)
++{
++	const struct nlattr **tb = data;
++	int type = mnl_attr_get_type(attr);
++
++	if (mnl_attr_type_valid(attr, NFTA_FULLCONE_MAX) < 0)
++		return MNL_CB_OK;
++
++	switch (type) {
++	case NFTA_FULLCONE_REG_PROTO_MIN:
++	case NFTA_FULLCONE_REG_PROTO_MAX:
++	case NFTA_FULLCONE_FLAGS:
++		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
++			abi_breakage();
++		break;
++	}
++
++	tb[type] = attr;
++	return MNL_CB_OK;
++}
++
++static void
++nftnl_expr_fullcone_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
++{
++	struct nftnl_expr_fullcone *fullcone = nftnl_expr_data(e);
++
++	if (e->flags & (1 << NFTNL_EXPR_FULLCONE_FLAGS))
++		mnl_attr_put_u32(nlh, NFTA_FULLCONE_FLAGS, htobe32(fullcone->flags));
++	if (e->flags & (1 << NFTNL_EXPR_FULLCONE_REG_PROTO_MIN))
++		mnl_attr_put_u32(nlh, NFTA_FULLCONE_REG_PROTO_MIN,
++				 htobe32(fullcone->sreg_proto_min));
++	if (e->flags & (1 << NFTNL_EXPR_FULLCONE_REG_PROTO_MAX))
++		mnl_attr_put_u32(nlh, NFTA_FULLCONE_REG_PROTO_MAX,
++				 htobe32(fullcone->sreg_proto_max));
++}
++
++static int
++nftnl_expr_fullcone_parse(struct nftnl_expr *e, struct nlattr *attr)
++{
++	struct nftnl_expr_fullcone *fullcone = nftnl_expr_data(e);
++	struct nlattr *tb[NFTA_FULLCONE_MAX+1] = {};
++
++	if (mnl_attr_parse_nested(attr, nftnl_expr_fullcone_cb, tb) < 0)
++		return -1;
++
++	if (tb[NFTA_FULLCONE_FLAGS]) {
++		fullcone->flags = be32toh(mnl_attr_get_u32(tb[NFTA_FULLCONE_FLAGS]));
++		e->flags |= (1 << NFTNL_EXPR_FULLCONE_FLAGS);
++        }
++	if (tb[NFTA_FULLCONE_REG_PROTO_MIN]) {
++		fullcone->sreg_proto_min =
++			be32toh(mnl_attr_get_u32(tb[NFTA_FULLCONE_REG_PROTO_MIN]));
++		e->flags |= (1 << NFTNL_EXPR_FULLCONE_REG_PROTO_MIN);
++	}
++	if (tb[NFTA_FULLCONE_REG_PROTO_MAX]) {
++		fullcone->sreg_proto_max =
++			be32toh(mnl_attr_get_u32(tb[NFTA_FULLCONE_REG_PROTO_MAX]));
++		e->flags |= (1 << NFTNL_EXPR_FULLCONE_REG_PROTO_MAX);
++	}
++
++	return 0;
++}
++
++static int nftnl_expr_fullcone_snprintf(char *buf, size_t remain,
++				    uint32_t flags, const struct nftnl_expr *e)
++{
++	struct nftnl_expr_fullcone *fullcone = nftnl_expr_data(e);
++	int offset = 0, ret = 0;
++
++	if (e->flags & (1 << NFTNL_EXPR_FULLCONE_REG_PROTO_MIN)) {
++		ret = snprintf(buf + offset, remain, "proto_min reg %u ",
++			       fullcone->sreg_proto_min);
++		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
++	}
++	if (e->flags & (1 << NFTNL_EXPR_FULLCONE_REG_PROTO_MAX)) {
++		ret = snprintf(buf + offset, remain, "proto_max reg %u ",
++			       fullcone->sreg_proto_max);
++		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
++	}
++	if (e->flags & (1 << NFTNL_EXPR_FULLCONE_FLAGS)) {
++		ret = snprintf(buf + offset, remain, "flags 0x%x ", fullcone->flags);
++		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
++	}
++
++	return offset;
++}
++
++struct expr_ops expr_ops_fullcone = {
++	.name		= "fullcone",
++	.alloc_len	= sizeof(struct nftnl_expr_fullcone),
++	.max_attr	= NFTA_FULLCONE_MAX,
++	.set		= nftnl_expr_fullcone_set,
++	.get		= nftnl_expr_fullcone_get,
++	.parse		= nftnl_expr_fullcone_parse,
++	.build		= nftnl_expr_fullcone_build,
++	.output		= nftnl_expr_fullcone_snprintf,
++};
++
+--- a/src/expr_ops.c
++++ b/src/expr_ops.c
+@@ -19,6 +19,7 @@ extern struct expr_ops expr_ops_limit;
+ extern struct expr_ops expr_ops_log;
+ extern struct expr_ops expr_ops_lookup;
+ extern struct expr_ops expr_ops_masq;
++extern struct expr_ops expr_ops_fullcone;
+ extern struct expr_ops expr_ops_match;
+ extern struct expr_ops expr_ops_meta;
+ extern struct expr_ops expr_ops_ng;
+@@ -63,6 +64,7 @@ static struct expr_ops *expr_ops[] = {
+ 	&expr_ops_log,
+ 	&expr_ops_lookup,
+ 	&expr_ops_masq,
++	&expr_ops_fullcone,
+ 	&expr_ops_match,
+ 	&expr_ops_meta,
+ 	&expr_ops_ng,
diff --git a/6.12/package/libs/libpcap/patches/999-fix-compilation.patch b/6.12/package/libs/libpcap/patches/999-fix-compilation.patch
new file mode 100644
index 00000000..c4a7b1bf
--- /dev/null
+++ b/6.12/package/libs/libpcap/patches/999-fix-compilation.patch
@@ -0,0 +1,11 @@
+--- a/CMakeLists.txt	2024-10-08 08:04:55.220966217 +0200
++++ b/CMakeLists.txt	2024-10-08 08:09:03.593429433 +0200
+@@ -350,7 +350,7 @@
+     if(NOT ${CMAKE_C_COMPILER} MATCHES "clang*")
+         set(C_ADDITIONAL_FLAGS "${C_ADDITIONAL_FLAGS} /utf-8")
+     endif(NOT ${CMAKE_C_COMPILER} MATCHES "clang*")
+-else(MSVC)
++elseif(FALSE)
+     #
+     # For checking if a compiler flag works, failing if it doesn't,
+     # and adding it otherwise.
diff --git a/6.12/package/network/config/firewall4/patches/000-kernel-version.patch b/6.12/package/network/config/firewall4/patches/000-kernel-version.patch
new file mode 100644
index 00000000..759586d2
--- /dev/null
+++ b/6.12/package/network/config/firewall4/patches/000-kernel-version.patch
@@ -0,0 +1,34 @@
+From e10fccfeb45e49cbad3a1d05f3029504b742f514 Mon Sep 17 00:00:00 2001
+From: Mieczyslaw Nalewaj <namiltd@yahoo.com>
+Date: Wed, 20 Nov 2024 18:16:08 +0100
+Subject: [PATCH] firewall4: fix reading kernel version
+
+Fix reading kernel version for kernels with revision 0 e.g. 6.12
+Repair incorrect shift of the revision number causing incorrect value for > 256.
+
+Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
+---
+ .../firewall4/patches/000-kernel-version.patch     | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+ create mode 100644 package/network/config/firewall4/patches/000-kernel-version.patch
+
+diff --git a/package/network/config/firewall4/patches/000-kernel-version.patch b/package/network/config/firewall4/patches/000-kernel-version.patch
+new file mode 100644
+index 00000000000000..e997f693f0bc2e
+--- /dev/null
++++ b/package/network/config/firewall4/patches/000-kernel-version.patch
+@@ -0,0 +1,14 @@
++--- a/root/usr/share/ucode/fw4.uc
+++++ b/root/usr/share/ucode/fw4.uc
++@@ -496,9 +496,9 @@ return {
++ 		    v = 0;
++ 
++ 		if (fd) {
++-		    let m = match(fd.read("line"), /^Linux version ([0-9]+)\.([0-9]+)\.([0-9]+)/);
+++		    let m = match(fd.read("line"), /^Linux version ([0-9]+)\.([0-9]+)(\.([0-9]+))?/);
++ 
++-		    v = m ? (+m[1] << 24) | (+m[2] << 16) | (+m[3] << 8) : 0;
+++		    v = m ? (+m[1] << 24) | (+m[2] << 16) | (+m[4]) : 0;
++ 		    fd.close();
++ 		}
++ 
diff --git a/6.12/package/network/config/firewall4/patches/990-unconditionally-allow-ct-status-dnat.patch b/6.12/package/network/config/firewall4/patches/990-unconditionally-allow-ct-status-dnat.patch
new file mode 100644
index 00000000..6ca5d232
--- /dev/null
+++ b/6.12/package/network/config/firewall4/patches/990-unconditionally-allow-ct-status-dnat.patch
@@ -0,0 +1,22 @@
+--- a/root/usr/share/firewall4/templates/ruleset.uc	2023-07-28 18:55:05.492297782 +0200
++++ b/root/usr/share/firewall4/templates/ruleset.uc	2023-07-28 18:58:52.300598623 +0200
+@@ -218,9 +218,7 @@
+ {%  for (let rule in fw4.rules(`input_${zone.name}`)): %}
+ 		{%+ include("rule.uc", { fw4, rule }) %}
+ {%  endfor %}
+-{%  if (zone.dflags.dnat): %}
+ 		ct status dnat accept comment "!fw4: Accept port redirections"
+-{%  endif %}
+ {%  fw4.includes('chain-append', `input_${zone.name}`) %}
+ 		jump {{ zone.input }}_from_{{ zone.name }}
+ 	}
+@@ -239,9 +237,7 @@
+ {%  for (let rule in fw4.rules(`forward_${zone.name}`)): %}
+ 		{%+ include("rule.uc", { fw4, rule }) %}
+ {%  endfor %}
+-{%  if (zone.dflags.dnat): %}
+ 		ct status dnat accept comment "!fw4: Accept port forwards"
+-{%  endif %}
+ {%  fw4.includes('chain-append', `forward_${zone.name}`) %}
+ 		jump {{ zone.forward }}_to_{{ zone.name }}
+ {%  if (fw4.forward_policy() != "accept" && (zone.log & 1)): %}
diff --git a/6.12/package/network/config/firewall4/patches/999-01-firewall4-add-fullcone-support.patch b/6.12/package/network/config/firewall4/patches/999-01-firewall4-add-fullcone-support.patch
new file mode 100644
index 00000000..aad83c53
--- /dev/null
+++ b/6.12/package/network/config/firewall4/patches/999-01-firewall4-add-fullcone-support.patch
@@ -0,0 +1,248 @@
+From d4081c498ddca184578903fe5199d390bbc0707b Mon Sep 17 00:00:00 2001
+From: Syrone Wong <wong.syrone@gmail.com>
+Date: Sat, 9 Apr 2022 13:24:19 +0800
+Subject: [PATCH] firewall4: add fullcone support
+
+fullcone is drop-in replacement of masq for non-udp traffic
+
+add runtime fullcone rule check, disable it globally if fullcone expr is
+invalid
+
+defaults.fullcone is the global switch, while zone.fullcone4 and
+zone.fullcone6 are switches for IPv4 and IPv6 respectively, most
+IPv6 traffic do NOT need this FullCone NAT functionality.
+---
+ root/etc/config/firewall                      |  3 +
+ root/usr/share/firewall4/templates/ruleset.uc | 16 +++-
+ .../firewall4/templates/zone-fullcone.uc      |  4 +
+ root/usr/share/ucode/fw4.uc                   | 76 ++++++++++++++++++-
+ 4 files changed, 96 insertions(+), 3 deletions(-)
+ create mode 100644 root/usr/share/firewall4/templates/zone-fullcone.uc
+
+diff --git a/root/etc/config/firewall b/root/etc/config/firewall
+index b9a4647..7187723 100644
+--- a/root/etc/config/firewall
++++ b/root/etc/config/firewall
+@@ -5,6 +5,7 @@ config defaults
+ 	option forward		REJECT
+ # Uncomment this line to disable ipv6 rules
+ #	option disable_ipv6	1
++	option fullcone '0'
+ 
+ config zone
+ 	option name		lan
+@@ -20,6 +21,8 @@ config zone
+ 	option input		REJECT
+ 	option output		ACCEPT
+ 	option forward		REJECT
++	option fullcone4 '0'
++	option fullcone6 '0'
+ 	option masq		1
+ 	option mtu_fix		1
+ 
+diff --git a/root/usr/share/firewall4/templates/ruleset.uc b/root/usr/share/firewall4/templates/ruleset.uc
+index eaa1f04..e29eae6 100644
+--- a/root/usr/share/firewall4/templates/ruleset.uc
++++ b/root/usr/share/firewall4/templates/ruleset.uc
+@@ -310,6 +310,12 @@ table inet fw4 {
+ {%   for (let redirect in fw4.redirects(`dstnat_${zone.name}`)): %}
+ 		{%+ include("redirect.uc", { fw4, redirect }) %}
+ {%   endfor %}
++{%   if (zone.fullcone4): %}
++		{%+ include("zone-fullcone.uc", { fw4, zone, family: 4, direction: "dstnat" }) %}
++{%   endif %}
++{%   if (zone.fullcone6): %}
++		{%+ include("zone-fullcone.uc", { fw4, zone, family: 6, direction: "dstnat" }) %}
++{%   endif %}
+ {%   fw4.includes('chain-append', `dstnat_${zone.name}`) %}
+ 	}
+ 
+@@ -320,20 +326,26 @@ table inet fw4 {
+ {%   for (let redirect in fw4.redirects(`srcnat_${zone.name}`)): %}
+ 		{%+ include("redirect.uc", { fw4, redirect }) %}
+ {%   endfor %}
+-{%   if (zone.masq): %}
++{%   if (zone.masq && !zone.fullcone4): %}
+ {%    for (let saddrs in zone.masq4_src_subnets): %}
+ {%     for (let daddrs in zone.masq4_dest_subnets): %}
+ 		{%+ include("zone-masq.uc", { fw4, zone, family: 4, saddrs, daddrs }) %}
+ {%     endfor %}
+ {%    endfor %}
+ {%   endif %}
+-{%   if (zone.masq6): %}
++{%   if (zone.masq6 && !zone.fullcone6): %}
+ {%    for (let saddrs in zone.masq6_src_subnets): %}
+ {%     for (let daddrs in zone.masq6_dest_subnets): %}
+ 		{%+ include("zone-masq.uc", { fw4, zone, family: 6, saddrs, daddrs }) %}
+ {%     endfor %}
+ {%    endfor %}
+ {%   endif %}
++{%   if (zone.fullcone4): %}
++		{%+ include("zone-fullcone.uc", { fw4, zone, family: 4, direction: "srcnat" }) %}
++{%   endif %}
++{%   if (zone.fullcone6): %}
++		{%+ include("zone-fullcone.uc", { fw4, zone, family: 6, direction: "srcnat" }) %}
++{%   endif %}
+ {%   fw4.includes('chain-append', `srcnat_${zone.name}`) %}
+ 	}
+ 
+diff --git a/root/usr/share/firewall4/templates/zone-fullcone.uc b/root/usr/share/firewall4/templates/zone-fullcone.uc
+new file mode 100644
+index 0000000..77d9806
+--- /dev/null
++++ b/root/usr/share/firewall4/templates/zone-fullcone.uc
+@@ -0,0 +1,4 @@
++{# /usr/share/firewall4/templates/zone-fullcone.uc #}
++		meta nfproto {{ fw4.nfproto(family) }} fullcone comment "!fw4: Handle {{
++		zone.name
++}} {{ fw4.nfproto(family, true) }} fullcone NAT {{ direction }} traffic"
+diff --git a/root/usr/share/ucode/fw4.uc b/root/usr/share/ucode/fw4.uc
+index 1b4764c..c5716da 100644
+--- a/root/usr/share/ucode/fw4.uc
++++ b/root/usr/share/ucode/fw4.uc
+@@ -1,3 +1,5 @@
++// /usr/share/ucode/fw4.uc
++
+ const fs = require("fs");
+ const uci = require("uci");
+ const ubus = require("ubus");
+@@ -428,6 +430,25 @@ function nft_try_hw_offload(devices) {
+ 	return (rc == 0);
+ }
+ 
++function nft_try_fullcone() {
++	let nft_test =
++		'add table inet fw4-fullcone-test; ' +
++		'add chain inet fw4-fullcone-test dstnat { ' +
++			'type nat hook prerouting priority -100; policy accept; ' +
++			'fullcone; ' +
++		'}; ' +
++		'add chain inet fw4-fullcone-test srcnat { ' +
++			'type nat hook postrouting priority -100; policy accept; ' +
++			'fullcone; ' +
++		'}; ';
++	let cmd = sprintf("/usr/sbin/nft -c '%s' 2>/dev/null", replace(nft_test, "'", "'\\''"));
++	let ok = system(cmd) == 0;
++	//if (!ok) {
++	//	warn("nft_try_fullcone: cmd "+ cmd + "\n");
++	//}
++	return ok;
++}
++
+ 
+ return {
+ 	read_kernel_version: function() {
+@@ -765,6 +786,18 @@ return {
+ 			warn(`[!] ${msg}\n`);
+ 	},
+ 
++	myinfo: function(fmt, ...args) {
++		if (getenv("QUIET"))
++			return;
++
++		let msg = sprintf(fmt, ...args);
++
++		if (getenv("TTY"))
++			warn(`\033[32m${msg}\033[m\n`);
++		else
++			warn(`[I] ${msg}\n`);
++	},
++
+ 	get: function(sid, opt) {
+ 		return this.cursor.get("firewall", sid, opt);
+ 	},
+@@ -946,6 +979,21 @@ return {
+ 		}
+ 	},
+ 
++	myinfo_section: function(s, msg) {
++		if (s[".name"]) {
++			if (s.name)
++				this.myinfo("Section %s (%s) %s", this.section_id(s[".name"]), s.name, msg);
++			else
++				this.myinfo("Section %s %s", this.section_id(s[".name"]), msg);
++		}
++		else {
++			if (s.name)
++				this.myinfo("ubus %s (%s) %s", s.type || "rule", s.name, msg);
++			else
++				this.myinfo("ubus %s %s", s.type || "rule", msg);
++		}
++	},
++
+ 	parse_policy: function(val) {
+ 		return this.parse_enum(val, [
+ 			"accept",
+@@ -1385,6 +1433,7 @@ return {
+ 			"dnat",
+ 			"snat",
+ 			"masquerade",
++			"fullcone",
+ 			"accept",
+ 			"reject",
+ 			"drop"
+@@ -1852,6 +1901,7 @@ return {
+ 		}
+ 
+ 		let defs = this.parse_options(data, {
++			fullcone: [ "bool", "0" ],
+ 			input: [ "policy", "drop" ],
+ 			output: [ "policy", "drop" ],
+ 			forward: [ "policy", "drop" ],
+@@ -1884,6 +1934,11 @@ return {
+ 
+ 		delete defs.syn_flood;
+ 
++		if (!nft_try_fullcone()) {
++			delete defs.fullcone;
++			//warn("nft_try_fullcone failed, disable fullcone globally\n");
++		}
++
+ 		this.state.defaults = defs;
+ 	},
+ 
+@@ -1908,6 +1963,8 @@ return {
+ 			masq_dest: [ "network", null, PARSE_LIST ],
+ 
+ 			masq6: [ "bool" ],
++			fullcone4: [ "bool", "0" ],
++			fullcone6: [ "bool", "0" ],
+ 
+ 			extra: [ "string", null, UNSUPPORTED ],
+ 			extra_src: [ "string", null, UNSUPPORTED ],
+@@ -1940,6 +1997,18 @@ return {
+ 			}
+ 		}
+ 
++		if (this.state.defaults && !this.state.defaults.fullcone) {
++			//this.warn_section(data, "fullcone in defaults not enabled, ignore zone fullcone settings");
++			zone.fullcone4 = false;
++			zone.fullcone6 = false;
++		}
++		if (zone.fullcone4) {
++			this.myinfo_section(data, "IPv4 fullcone enabled for zone '" + zone.name + "'");
++		}
++		if (zone.fullcone6) {
++			this.myinfo_section(data, "IPv6 fullcone enabled for zone '" + zone.name + "'");
++		}
++
+ 		if (zone.mtu_fix && this.kernel < 0x040a0000) {
+ 			this.warn_section(data, "option 'mtu_fix' requires kernel 4.10 or later");
+ 			return;
+@@ -2110,10 +2179,15 @@ return {
+ 		zone.related_subnets = related_subnets;
+ 		zone.related_physdevs = related_physdevs;
+ 
++		if (zone.fullcone4 || zone.fullcone6) {
++			zone.dflags.snat = true;
++			zone.dflags.dnat = true;
++		}
++
+ 		if (zone.masq || zone.masq6)
+ 			zone.dflags.snat = true;
+ 
+-		if ((zone.auto_helper && !(zone.masq || zone.masq6)) || length(zone.helper)) {
++		if ((zone.auto_helper && !(zone.masq || zone.masq6 || zone.fullcone4 || zone.fullcone6)) || length(zone.helper)) {
+ 			zone.dflags.helper = true;
+ 
+ 			for (let helper in (length(zone.helper) ? zone.helper : this.state.helpers)) {
diff --git a/6.12/package/network/config/firewall4/patches/999-10-forward-rules-in-prerouting.patch b/6.12/package/network/config/firewall4/patches/999-10-forward-rules-in-prerouting.patch
new file mode 100644
index 00000000..3810a121
--- /dev/null
+++ b/6.12/package/network/config/firewall4/patches/999-10-forward-rules-in-prerouting.patch
@@ -0,0 +1,17 @@
+--- a/root/usr/share/firewall4/templates/ruleset.uc.old
++++ b/root/usr/share/firewall4/templates/ruleset.uc
+@@ -181,7 +181,14 @@
+ 
+ 	chain prerouting {
+ 		type filter hook prerouting priority filter; policy accept;
++{% for (let rule in fw4.rules("forward")): %}
++		{%+ include("rule.uc", { fw4, zone: (rule.src?.zone?.log_limit ? rule.src.zone : rule.dest?.zone), rule }) %}
++{% endfor %}
++
+ {% for (let zone in fw4.zones()): %}
++{%  for (let rule in fw4.rules(`forward_${zone.name}`)): %}
++		{%+ include("rule.uc", { fw4, zone, rule }) %}
++{%  endfor %}
+ {%  if (zone.dflags.helper): %}
+ {%   for (let rule in zone.match_rules): %}
+ {%    let devices_pos = fw4.filter_loopback_devs(rule.devices_pos, false); %}
diff --git a/6.12/package/network/services/dnsmasq/files/dnsmasq.init b/6.12/package/network/services/dnsmasq/files/dnsmasq.init
new file mode 100755
index 00000000..540da7bb
--- /dev/null
+++ b/6.12/package/network/services/dnsmasq/files/dnsmasq.init
@@ -0,0 +1,1347 @@
+#!/bin/sh /etc/rc.common
+# Copyright (C) 2007-2012 OpenWrt.org
+
+START=19
+
+USE_PROCD=1
+PROG=/usr/sbin/dnsmasq
+
+ADD_LOCAL_DOMAIN=1
+ADD_LOCAL_HOSTNAME=1
+ADD_WAN_FQDN=0
+ADD_LOCAL_FQDN=""
+
+BASECONFIGFILE="/var/etc/dnsmasq.conf"
+BASEHOSTFILE="/tmp/hosts/dhcp"
+TRUSTANCHORSFILE="/usr/share/dnsmasq/trust-anchors.conf"
+TIMEVALIDFILE="/var/state/dnsmasqsec"
+BASEDHCPSTAMPFILE="/var/run/dnsmasq"
+DHCPBOGUSHOSTNAMEFILE="/usr/share/dnsmasq/dhcpbogushostname.conf"
+RFC6761FILE="/usr/share/dnsmasq/rfc6761.conf"
+DHCPSCRIPT="/usr/lib/dnsmasq/dhcp-script.sh"
+DHCPSCRIPT_DEPENDS="/usr/share/libubox/jshn.sh /usr/bin/jshn /bin/ubus"
+
+DNSMASQ_DHCP_VER=4
+
+dnsmasq_ignore_opt() {
+	local opt="$1"
+
+	if [ -z "$dnsmasq_features" ]; then
+		dnsmasq_features="$(dnsmasq --version | grep -m1 'Compile time options:' | cut -d: -f2) "
+		[ "${dnsmasq_features#* DHCP }" = "$dnsmasq_features" ] || dnsmasq_has_dhcp=1
+		[ "${dnsmasq_features#* DHCPv6 }" = "$dnsmasq_features" ] || dnsmasq_has_dhcp6=1
+		[ "${dnsmasq_features#* DNSSEC }" = "$dnsmasq_features" ] || dnsmasq_has_dnssec=1
+		[ "${dnsmasq_features#* TFTP }" = "$dnsmasq_features" ] || dnsmasq_has_tftp=1
+		[ "${dnsmasq_features#* ipset }" = "$dnsmasq_features" ] || dnsmasq_has_ipset=1
+		[ "${dnsmasq_features#* nftset }" = "$dnsmasq_features" ] || dnsmasq_has_nftset=1
+	fi
+
+	case "$opt" in
+		dhcp-duid|\
+		ra-param)
+			[ -z "$dnsmasq_has_dhcp6" ] ;;
+		dhcp-*|\
+		bootp-*|\
+		pxe-*)
+			[ -z "$dnsmasq_has_dhcp" ] ;;
+		dnssec*|\
+		trust-anchor)
+			if [ -z "$dnsmasq_has_dnssec" ]; then
+				echo "dnsmasq: \"$opt\" requested, but dnssec support is not available" >&2
+				exit 1
+			fi
+			return 1
+			;;
+		tftp-*)
+			[ -z "$dnsmasq_has_tftp" ] ;;
+		ipset)
+			[ -z "$dnsmasq_has_ipset" ] ;;
+		nftset)
+			[ -z "$dnsmasq_has_nftset" ] ;;
+		*)
+			return 1
+	esac
+}
+
+xappend() {
+	local value="${1#--}"
+	local opt="${value%%=*}"
+
+	if ! dnsmasq_ignore_opt "$opt"; then
+		echo "$value" >>$CONFIGFILE_TMP
+	fi
+}
+
+hex_to_hostid() {
+	local var="$1"
+	local hex="${2#0x}" # strip optional "0x" prefix
+
+	if [ -n "${hex//[0-9a-fA-F]/}" ]; then
+		# is invalid hex literal
+		return 1
+	fi
+
+	# convert into host id
+	export "$var=$(
+		printf "%0x:%0x" \
+		$(((0x$hex >> 16) % 65536)) \
+		$(( 0x$hex        % 65536))
+		)"
+
+	return 0
+}
+
+dhcp_calc() {
+	local ip="$1"
+	local res=0
+
+	while [ -n "$ip" ]; do
+		part="${ip%%.*}"
+		res="$(($res * 256))"
+		res="$(($res + $part))"
+		[ "${ip%.*}" != "$ip" ] && ip="${ip#*.}" || ip=
+	done
+	echo "$res"
+}
+
+dhcp_check() {
+	local ifname="$1"
+	local stamp="${BASEDHCPSTAMPFILE_CFG}.${ifname}.dhcp"
+	local rv=0
+
+	[ -s "$stamp" ] && return $(cat "$stamp")
+
+	# If interface is down, skip it.
+	# The init script will be called again once the link is up
+	case "$(devstatus "$ifname" | jsonfilter -e @.up)" in
+		false) return 1;;
+	esac
+
+	udhcpc -n -q -s /bin/true -t 1 -i "$ifname" >&- && rv=1 || rv=0
+
+	echo $rv > "$stamp"
+	return $rv
+}
+
+log_once() {
+	pidof dnsmasq >/dev/null || \
+		logger -t dnsmasq "$@"
+}
+
+has_handler() {
+	local file
+
+	for file in /etc/hotplug.d/dhcp/* /etc/hotplug.d/tftp/* /etc/hotplug.d/neigh/*; do
+		[ -f "$file" ] && return 0
+	done
+
+	return 1
+}
+
+append_bool() {
+	local section="$1"
+	local option="$2"
+	local value="$3"
+	local default="$4"
+	local _loctmp
+	[ -z "$default" ] && default="0"
+	config_get_bool _loctmp "$section" "$option" "$default"
+	[ $_loctmp -gt 0 ] && xappend "$value"
+}
+
+append_parm() {
+	local section="$1"
+	local option="$2"
+	local switch="$3"
+	local default="$4"
+	local _loctmp
+	config_get _loctmp "$section" "$option" "$default"
+	[ -z "$_loctmp" ] && return 0
+	xappend "$switch=$_loctmp"
+}
+
+append_server() {
+	xappend "--server=$1"
+}
+
+append_rev_server() {
+	xappend "--rev-server=$1"
+}
+
+append_address() {
+	xappend "--address=$1"
+}
+
+append_connmark_allowlist() {
+	xappend "--connmark-allowlist=$1"
+}
+
+append_interface() {
+	network_get_device ifname "$1" || ifname="$1"
+	xappend "--interface=$ifname"
+}
+
+append_listenaddress() {
+	xappend "--listen-address=$1"
+}
+
+append_notinterface() {
+	network_get_device ifname "$1" || ifname="$1"
+	xappend "--except-interface=$ifname"
+}
+
+ismounted() {
+	local filename="$1"
+	local dirname
+	for dirname in $EXTRA_MOUNT ; do
+		case "$filename" in
+			"${dirname}/"* | "${dirname}" )
+				return 0
+				;;
+		esac
+	done
+
+	return 1
+}
+
+append_extramount() {
+	ismounted "$1" || append EXTRA_MOUNT "$1"
+}
+
+append_addnhosts() {
+	append_extramount "$1"
+	xappend "--addn-hosts=$1"
+}
+
+append_bogusnxdomain() {
+	xappend "--bogus-nxdomain=$1"
+}
+
+append_pxe_service() {
+	xappend "--pxe-service=$1"
+}
+
+append_interface_name() {
+	xappend "--interface-name=$1,$2"
+}
+
+filter_dnsmasq() {
+	local cfg="$1" func="$2" match_cfg="$3" found_cfg
+
+	# use entry when no instance entry set, or if it matches
+	config_get found_cfg "$cfg" "instance"
+	if [ -z "$found_cfg" ] || [ "$found_cfg" = "$match_cfg" ]; then
+		$func $cfg
+	fi
+}
+
+dhcp_subscrid_add() {
+	local cfg="$1"
+
+	config_get networkid "$cfg" networkid
+	[ -n "$networkid" ] || return 0
+
+	config_get subscriberid "$cfg" subscriberid
+	[ -n "$subscriberid" ] || return 0
+
+	xappend "--dhcp-subscrid=set:$networkid,$subscriberid"
+
+	config_get_bool force "$cfg" force 0
+
+	dhcp_option_add "$cfg" "$networkid" "$force"
+}
+
+dhcp_remoteid_add() {
+	local cfg="$1"
+
+	config_get networkid "$cfg" networkid
+	[ -n "$networkid" ] || return 0
+
+	config_get remoteid "$cfg" remoteid
+	[ -n "$remoteid" ] || return 0
+
+	xappend "--dhcp-remoteid=set:$networkid,$remoteid"
+
+	config_get_bool force "$cfg" force 0
+
+	dhcp_option_add "$cfg" "$networkid" "$force"
+}
+
+dhcp_circuitid_add() {
+	# TODO: DHCPV6 does not have circuitid; catch "option6:"
+	local cfg="$1"
+
+	config_get networkid "$cfg" networkid
+	[ -n "$networkid" ] || return 0
+
+	config_get circuitid "$cfg" circuitid
+	[ -n "$circuitid" ] || return 0
+
+	xappend "--dhcp-circuitid=set:$networkid,$circuitid"
+
+	config_get_bool force "$cfg" force 0
+
+	dhcp_option_add "$cfg" "$networkid" "$force"
+}
+
+dhcp_userclass_add() {
+	local cfg="$1"
+
+	config_get networkid "$cfg" networkid
+	[ -n "$networkid" ] || return 0
+
+	config_get userclass "$cfg" userclass
+	[ -n "$userclass" ] || return 0
+
+	xappend "--dhcp-userclass=set:$networkid,$userclass"
+
+	config_get_bool force "$cfg" force 0
+
+	dhcp_option_add "$cfg" "$networkid" "$force"
+}
+
+dhcp_vendorclass_add() {
+	# TODO: DHCPV6 vendor class has stricter definitions; catch? fixup?
+	local cfg="$1"
+
+	config_get networkid "$cfg" networkid
+	[ -n "$networkid" ] || return 0
+
+	config_get vendorclass "$cfg" vendorclass
+	[ -n "$vendorclass" ] || return 0
+
+	xappend "--dhcp-vendorclass=set:$networkid,$vendorclass"
+
+	config_get_bool force "$cfg" force 0
+
+	dhcp_option_add "$cfg" "$networkid" "$force"
+}
+
+dhcp_match_add() {
+	local cfg="$1"
+
+	config_get networkid "$cfg" networkid
+	[ -n "$networkid" ] || return 0
+
+	config_get match "$cfg" match
+	[ -n "$match" ] || return 0
+
+	xappend "--dhcp-match=set:$networkid,$match"
+
+	config_get_bool force "$cfg" force 0
+
+	dhcp_option_add "$cfg" "$networkid" "$force"
+}
+
+dhcp_host_add() {
+	local cfg="$1"
+	local hosttag nametime addrs duids macs tags mtags
+
+	config_get_bool force "$cfg" force 0
+
+	config_get networkid "$cfg" networkid
+	[ -n "$networkid" ] && dhcp_option_add "$cfg" "$networkid" "$force"
+
+	config_get_bool enable "$cfg" enable 1
+	[ "$enable" = "0" ] && return 0
+
+	config_get name "$cfg" name
+	config_get ip "$cfg" ip
+	config_get hostid "$cfg" hostid
+
+	[ -z "$ip" ] && [ -z "$name" ] && [ -z "$hostid" ] && return 0
+
+	config_get_bool dns "$cfg" dns 0
+	[ "$dns" = "1" ] && [ -n "$ip" ] && [ -n "$name" ] && {
+		echo "$ip $name${DOMAIN:+.$DOMAIN}" >> $HOSTFILE_TMP
+	}
+
+	config_get mac "$cfg" mac
+	config_get duid "$cfg" duid
+	config_get tag "$cfg" tag
+
+	add_tag() {
+		mtags="${mtags}tag:$1,"
+	}
+	config_list_foreach "$cfg" match_tag add_tag
+
+	if [ -n "$mac" ]; then
+		# --dhcp-host=00:20:e0:3b:13:af,192.168.0.199,lap
+		# many MAC are possible to track a laptop ON/OFF dock
+		for m in $mac; do append macs "$m" ","; done
+	fi
+
+	if [ $DNSMASQ_DHCP_VER -eq 6 ] && [ -n "$duid" ]; then
+		# --dhcp-host=id:00:03:00:01:12:00:00:01:02:03,[::beef],lap
+		# one (virtual) machine gets one DUID per RFC3315
+		duids="id:${duid// */}"
+	fi
+
+	if [ -z "$macs" ] && [ -z "$duids" ]; then
+		# --dhcp-host=lap,192.168.0.199,[::beef]
+		[ -n "$name" ] || return 0
+		macs="$name"
+		name=""
+	fi
+
+	if [ -n "$hostid" ]; then
+		hex_to_hostid hostid "$hostid"
+	fi
+
+	if [ -n "$tag" ]; then
+		for t in $tag; do append tags "$t" ",set:"; done
+	fi
+
+	config_get_bool broadcast "$cfg" broadcast 0
+	config_get leasetime "$cfg" leasetime
+
+	[ "$broadcast" = "0" ] && broadcast= || broadcast=",set:needs-broadcast"
+
+	hosttag="${networkid:+,set:${networkid}}${tags:+,set:${tags}}$broadcast"
+	nametime="${name:+,$name}${leasetime:+,$leasetime}"
+
+	if [ $DNSMASQ_DHCP_VER -eq 6 ]; then
+		addrs="${ip:+,$ip}${hostid:+,[::$hostid]}"
+		xappend "--dhcp-host=$mtags$macs${duids:+,$duids}$hosttag$addrs$nametime"
+	else
+		xappend "--dhcp-host=$mtags$macs$hosttag${ip:+,$ip}$nametime"
+	fi
+}
+
+dhcp_this_host_add() {
+	local net="$1"
+	local ifname="$2"
+	local mode="$3"
+	local routerstub routername ifdashname
+	local lanaddr lanaddr6 lanaddrs6 ulaprefix
+
+	if [ "$mode" -gt 0 ] ; then
+		ifdashname="${ifname//./-}"
+		routerstub="$( md5sum /etc/os-release )"
+		routerstub="router-${routerstub// */}"
+		routername="$( uci_get system @system[0] hostname $routerstub )"
+
+		if [ "$mode" -gt 1 ] ; then
+			if [ "$mode" -gt 2 ] ; then
+				if [ "$mode" -gt 3 ] ; then
+					append_interface_name "$ifdashname.$routername.$DOMAIN" "$ifname"
+				fi
+
+				append_interface_name "$routername.$DOMAIN" "$ifname"
+			fi
+
+			# All IP addresses discovered by dnsmasq will be labeled (except fe80::)
+			append_interface_name "$routername" "$ifname"
+
+		else
+			# This uses a static host file entry for only limited addresses.
+			# Use dnsmasq option "--expandhosts" to enable FQDN on host files.
+			ulaprefix="$(uci_get network @globals[0] ula_prefix)"
+			network_get_ipaddr lanaddr "$net"
+			network_get_ipaddrs6 lanaddrs6 "$net"
+
+			if [ -n "$lanaddr" ] ; then
+				dhcp_domain_add "" "$routername" "$lanaddr"
+			fi
+
+			if [ -n "$ulaprefix" ] && [ -n "$lanaddrs6" ] ; then
+				for lanaddr6 in $lanaddrs6 ; do
+					case "$lanaddr6" in
+					"${ulaprefix%%:/*}"*)
+						dhcp_domain_add "" "$routername" "$lanaddr6"
+						;;
+					esac
+				done
+			fi
+		fi
+	fi
+}
+
+dhcp_tag_add() {
+	# NOTE: dnsmasq has explicit "option6:" prefix for DHCPv6 so no collisions
+	local cfg="$1"
+
+	tag="$cfg"
+
+	[ -n "$tag" ] || return 0
+
+	config_get_bool force "$cfg" force 0
+	[ "$force" = "0" ] && force=
+
+	config_get option "$cfg" dhcp_option
+	for o in $option; do
+		xappend "--dhcp-option${force:+-force}=tag:$tag,$o"
+	done
+}
+
+dhcp_mac_add() {
+	local cfg="$1"
+
+	config_get networkid "$cfg" networkid
+	[ -n "$networkid" ] || return 0
+
+	config_get mac "$cfg" mac
+	[ -n "$mac" ] || return 0
+
+	xappend "--dhcp-mac=$networkid,$mac"
+
+	dhcp_option_add "$cfg" "$networkid"
+}
+
+dhcp_boot_add() {
+	# TODO: BOOTURL is different between DHCPv4 and DHCPv6
+	local cfg="$1"
+
+	config_get networkid "$cfg" networkid
+
+	config_get filename "$cfg" filename
+	[ -n "$filename" ] || return 0
+
+	config_get servername "$cfg" servername
+	config_get serveraddress "$cfg" serveraddress
+
+	[ -n "$serveraddress" ] && [ ! -n "$servername" ] && return 0
+
+	xappend "--dhcp-boot=${networkid:+tag:$networkid,}${filename}${servername:+,$servername}${serveraddress:+,$serveraddress}"
+
+	config_get_bool force "$cfg" force 0
+
+	dhcp_option_add "$cfg" "$networkid" "$force"
+}
+
+dhcp_add() {
+	local cfg="$1"
+	local dhcp6range="::"
+	local nettag
+	local tags
+
+	config_get net "$cfg" interface
+	[ -n "$net" ] || return 0
+
+	config_get networkid "$cfg" networkid
+	[ -n "$networkid" ] || networkid="$net"
+
+	network_get_device ifname "$net" || return 0
+
+	[ "$cachelocal" = "0" ] && network_get_dnsserver dnsserver "$net" && {
+		DNS_SERVERS="$DNS_SERVERS $dnsserver"
+	}
+
+	append_bool "$cfg" ignore "--no-dhcp-interface=$ifname" && {
+		# Many ISP do not have useful names for DHCP customers (your WAN).
+		dhcp_this_host_add "$net" "$ifname" "$ADD_WAN_FQDN"
+		return 0
+	}
+
+	network_get_subnet subnet "$net" || return 0
+	network_get_protocol proto "$net" || return 0
+
+	# Do not support non-static interfaces for now
+	[ static = "$proto" ] || return 0
+
+	ipaddr="${subnet%%/*}"
+	prefix_or_netmask="${subnet##*/}"
+
+	# Override interface netmask with dhcp config if applicable
+	config_get netmask "$cfg" netmask
+
+	[ -n "$netmask" ] && prefix_or_netmask="$netmask"
+
+	#check for an already active dhcp server on the interface, unless 'force' is set
+	config_get_bool force "$cfg" force 0
+	[ $force -gt 0 ] || dhcp_check "$ifname" || {
+		logger -t dnsmasq \
+			"found already running DHCP-server on interface '$ifname'" \
+			"refusing to start, use 'option force 1' to override"
+		return 0
+	}
+
+	config_get start "$cfg" start 100
+	config_get limit "$cfg" limit 150
+	config_get leasetime "$cfg" leasetime 12h
+	config_get options "$cfg" options
+	config_get_bool dynamicdhcp "$cfg" dynamicdhcp 1
+	config_get_bool dynamicdhcpv4 "$cfg" dynamicdhcpv4 $dynamicdhcp
+	config_get_bool dynamicdhcpv6 "$cfg" dynamicdhcpv6 $dynamicdhcp
+
+	config_get dhcpv4 "$cfg" dhcpv4
+	config_get dhcpv6 "$cfg" dhcpv6
+
+	config_get ra "$cfg" ra
+	config_get ra_management "$cfg" ra_management
+	config_get ra_preference "$cfg" ra_preference
+	config_get dns "$cfg" dns
+	config_get dns_sl "$cfg" domain
+
+	config_list_foreach "$cfg" "interface_name" append_interface_name "$ifname"
+
+	# Put the router host name on this DHCP served interface address(es)
+	dhcp_this_host_add "$net" "$ifname" "$ADD_LOCAL_FQDN"
+
+	start="$( dhcp_calc "$start" )"
+
+	add_tag() {
+		tags="${tags}tag:$1,"
+	}
+	config_list_foreach "$cfg" tag add_tag
+
+	nettag="${networkid:+set:${networkid},}"
+
+	# make sure the DHCP range is not empty
+	if [ "$dhcpv4" != "disabled" ] && ipcalc "$ipaddr/$prefix_or_netmask" "$start" "$limit" ; then
+		[ "$dynamicdhcpv4" = "0" ] && END="static"
+
+		xappend "--dhcp-range=$tags$nettag$START,$END,$NETMASK,$leasetime${options:+ $options}"
+	fi
+
+	if [ "$dynamicdhcpv6" = "0" ] ; then
+		dhcp6range="::,static"
+	else
+		dhcp6range="::1000,::ffff"
+	fi
+
+
+	if [ $DNSMASQ_DHCP_VER -eq 6 ] && [ "$ra" = "server" ] ; then
+		# Note: dnsmasq cannot just be a DHCPv6 server (all-in-1)
+		# and let some other machine(s) send RA pointing to it.
+
+		case $ra_preference in
+		*high*)
+			xappend "--ra-param=$ifname,high,0,7200"
+			;;
+		*low*)
+			xappend "--ra-param=$ifname,low,0,7200"
+			;;
+		*)
+			# Send UNSOLICITED RA at default interval and live for 2 hours.
+			# TODO: convert flexible lease time into route life time (only seconds).
+			xappend "--ra-param=$ifname,0,7200"
+			;;
+		esac
+
+		if [ "$dhcpv6" = "disabled" ] ; then
+			ra_management="3"
+		fi
+
+
+		case $ra_management in
+		0)
+			# SLACC with DCHP for extended options
+			xappend "--dhcp-range=$nettag::,constructor:$ifname,ra-stateless,ra-names"
+			;;
+		2)
+			# DHCP address and RA only for management redirection
+			xappend "--dhcp-range=$nettag$dhcp6range,constructor:$ifname,$leasetime"
+			;;
+		3)
+			# SLAAC only but dnsmasq attempts to link HOSTNAME, DHCPv4 MAC, and SLAAC
+			xappend "--dhcp-range=$nettag::,constructor:$ifname,ra-only,ra-names"
+			;;
+		*)
+			# SLAAC and full DHCP
+			xappend "--dhcp-range=$nettag$dhcp6range,constructor:$ifname,slaac,ra-names,$leasetime"
+			;;
+		esac
+
+		if [ -n "$dns" ]; then
+			dnss=""
+			for d in $dns; do append dnss "[$d]" ","; done
+		else
+			dnss="[::]"
+		fi
+
+		dhcp_option_append "option6:dns-server,$dnss" "$networkid"
+
+		if [ -n "$dns_sl" ]; then
+			ddssl=""
+			for dd in $dns_sl; do append ddssl "$dd" ","; done
+		fi
+
+		dhcp_option_append "option6:domain-search,$ddssl" "$networkid"
+	fi
+
+	dhcp_option_add "$cfg" "$networkid" 0
+	dhcp_option_add "$cfg" "$networkid" 2
+}
+
+dhcp_option_append() {
+	local option="$1"
+	local networkid="$2"
+	local force="$3"
+
+	xappend "--dhcp-option${force:+-force}=${networkid:+$networkid,}$option"
+}
+
+dhcp_option_add() {
+	# NOTE: dnsmasq has explicit "option6:" prefix for DHCPv6 so no collisions
+	local cfg="$1"
+	local networkid="$2"
+	local force="$3"
+	local opt="dhcp_option"
+
+	[ "$force" = "0" ] && force=
+	[ "$force" = "2" ] && opt="dhcp_option_force"
+
+	local list_len
+	config_get list_len "$cfg" "${opt}_LENGTH"
+
+	if [ -n "$list_len" ]; then
+		config_list_foreach "$cfg" "$opt" dhcp_option_append "$networkid" "$force"
+	else
+		config_get dhcp_option "$cfg" "$opt"
+
+		[ -n "$dhcp_option" ] && echo "Warning: the 'option $opt' syntax is deprecated, use 'list $opt'" >&2
+
+		local option
+		for option in $dhcp_option; do
+			dhcp_option_append "$option" "$networkid" "$force"
+		done
+	fi
+}
+
+dhcp_domain_add() {
+	local cfg="$1"
+	local ip name names record
+
+	config_get names "$cfg" name "$2"
+	[ -n "$names" ] || return 0
+
+	config_get ip "$cfg" ip "$3"
+	[ -n "$ip" ] || return 0
+
+	for name in $names; do
+		record="${record:+$record }$name"
+	done
+
+	echo "$ip $record" >> $HOSTFILE_TMP
+}
+
+dhcp_srv_add() {
+	local cfg="$1"
+
+	config_get srv "$cfg" srv
+	[ -n "$srv" ] || return 0
+
+	config_get target "$cfg" target
+	[ -n "$target" ] || return 0
+
+	config_get port "$cfg" port
+	[ -n "$port" ] || return 0
+
+	config_get class "$cfg" class
+	config_get weight "$cfg" weight
+
+	local service="$srv,$target,$port${class:+,$class${weight:+,$weight}}"
+
+	xappend "--srv-host=$service"
+}
+
+dhcp_mx_add() {
+	local cfg="$1"
+	local domain relay pref
+
+	config_get domain "$cfg" domain
+	[ -n "$domain" ] || return 0
+
+	config_get relay "$cfg" relay
+	[ -n "$relay" ] || return 0
+
+	config_get pref "$cfg" pref 0
+
+	local service="$domain,$relay,$pref"
+
+	xappend "--mx-host=$service"
+}
+
+dhcp_cname_add() {
+	local cfg="$1"
+	local cname target
+
+	config_get cname "$cfg" cname
+	[ -n "$cname" ] || return 0
+
+	config_get target "$cfg" target
+	[ -n "$target" ] || return 0
+
+	xappend "--cname=${cname},${target}"
+}
+
+dhcp_hostrecord_add() {
+	local cfg="$1"
+	local names addresses record val
+
+	config_get names "$cfg" name "$2"
+	if [ -z "$names" ]; then
+		return 0
+	fi
+
+	config_get addresses "$cfg" ip "$3"
+	if [ -z "$addresses" ]; then
+		return 0
+	fi
+
+	for val in $names $addresses; do
+		record="${record:+$record,}$val"
+	done
+
+	xappend "--host-record=$record"
+}
+
+dhcp_relay_add() {
+	local cfg="$1"
+	local local_addr server_addr interface
+
+	config_get local_addr "$cfg" local_addr
+	[ -n "$local_addr" ] || return 0
+
+	config_get server_addr "$cfg" server_addr
+	[ -n "$server_addr" ] || return 0
+
+	config_get interface "$cfg" interface
+	if [ -z "$interface" ]; then
+		xappend "--dhcp-relay=$local_addr,$server_addr"
+	else
+		network_get_device ifname "$interface" || return
+		xappend "--dhcp-relay=$local_addr,$server_addr,$ifname"
+	fi
+}
+
+dnsmasq_ipset_add() {
+	local cfg="$1"
+	local ipsets nftsets domains
+
+	add_ipset() {
+		ipsets="${ipsets:+$ipsets,}$1"
+	}
+
+	add_nftset() {
+		local IFS=,
+		for set in $1; do
+			local fam="$family"
+			[ -n "$fam" ] || fam=$(echo "$set" | sed -nre \
+				's#^.*[^0-9]([46])$|^.*[-_]([46])[-_].*$|^([46])[^0-9].*$#\1\2\3#p')
+			[ -n "$fam" ] || \
+				fam=$(nft -t list set "$table_family" "$table" "$set" 2>&1 | sed -nre \
+				's#^\t\ttype .*\bipv([46])_addr\b.*$#\1#p')
+
+			[ -n "$fam" ] || \
+				logger -t dnsmasq "Cannot infer address family from non-existent nftables set '$set'"
+
+			nftsets="${nftsets:+$nftsets,}${fam:+$fam#}$table_family#$table#$set"
+		done
+	}
+
+	add_domain() {
+		# leading '/' is expected
+		domains="$domains/$1"
+		if [ "$(echo $domains | wc -m)" -gt 600 ]; then
+			xappend "--ipset=$domains/$ipsets"
+			xappend "--nftset=$domains/$nftsets"
+			domains=""
+		fi
+	}
+
+	config_get table "$cfg" table 'fw4'
+	config_get table_family "$cfg" table_family 'inet'
+	if [ "$table_family" = "ip" ] ; then
+		family="4"
+	elif [ "$table_family" = "ip6" ] ; then
+		family="6"
+	else
+		config_get family "$cfg" family
+	fi
+
+	config_list_foreach "$cfg" "name" add_ipset
+	config_list_foreach "$cfg" "name" add_nftset
+	config_list_foreach "$cfg" "domain" add_domain
+
+	if [ -z "$ipsets" ] || [ -z "$nftsets" ] || [ -z "$domains" ]; then
+		return 0
+	fi
+
+	xappend "--ipset=$domains/$ipsets"
+	xappend "--nftset=$domains/$nftsets"
+}
+
+dnsmasq_start()
+{
+	local cfg="$1"
+	local disabled user_dhcpscript logfacility
+	local resolvfile resolvdir localuse=1
+
+	config_get_bool disabled "$cfg" disabled 0
+	[ "$disabled" -gt 0 ] && return 0
+
+	# reset list of DOMAINS, DNS servers and EXTRA mounts (for each dnsmasq instance)
+	DNS_SERVERS=""
+	DOMAIN=""
+	EXTRA_MOUNT=""
+	CONFIGFILE="${BASECONFIGFILE}.${cfg}"
+	CONFIGFILE_TMP="${CONFIGFILE}.$$"
+	HOSTFILE="${BASEHOSTFILE}.${cfg}"
+	HOSTFILE_TMP="${HOSTFILE}.$$"
+	HOSTFILE_DIR="$(dirname "$HOSTFILE")"
+	BASEDHCPSTAMPFILE_CFG="${BASEDHCPSTAMPFILE}.${cfg}"
+
+	# before we can call xappend
+	umask u=rwx,g=rx,o=rx
+	mkdir -p /var/run/dnsmasq/
+	mkdir -p $(dirname $CONFIGFILE)
+	mkdir -p "$HOSTFILE_DIR"
+	mkdir -p /var/lib/misc
+	chown dnsmasq:dnsmasq /var/run/dnsmasq
+
+	echo "# auto-generated config file from /etc/config/dhcp" > $CONFIGFILE_TMP
+	echo "# auto-generated config file from /etc/config/dhcp" > $HOSTFILE_TMP
+
+	local dnsmasqconffile="/etc/dnsmasq.${cfg}.conf"
+	if [ ! -r "$dnsmasqconffile" ]; then
+		dnsmasqconffile=/etc/dnsmasq.conf
+	fi
+
+	# if we did this last, we could override auto-generated config
+	[ -f "${dnsmasqconffile}" ] && {
+		xappend "--conf-file=${dnsmasqconffile}"
+	}
+
+	$PROG --version | grep -osqE "^Compile time options:.* DHCPv6( |$)" && DHCPv6CAPABLE=1 || DHCPv6CAPABLE=0
+
+
+	if [ -x /usr/sbin/odhcpd ] && [ -x /etc/init.d/odhcpd ] ; then
+		local odhcpd_is_main odhcpd_is_enabled
+		config_get odhcpd_is_main odhcpd maindhcp 0
+		/etc/init.d/odhcpd enabled && odhcpd_is_enabled=1 || odhcpd_is_enabled=0
+
+
+		if [ "$odhcpd_is_enabled" -eq 0 ] && [ "$DHCPv6CAPABLE" -eq 1 ] ; then
+			# DHCP V4 and V6 in DNSMASQ
+			DNSMASQ_DHCP_VER=6
+		elif [ "$odhcpd_is_main" -gt 0 ] ; then
+			# ODHCPD is doing it all
+			DNSMASQ_DHCP_VER=0
+		else
+			# You have ODHCPD but use DNSMASQ for DHCPV4
+			DNSMASQ_DHCP_VER=4
+		fi
+
+	elif [ "$DHCPv6CAPABLE" -eq 1 ] ; then
+		# DHCP V4 and V6 in DNSMASQ
+		DNSMASQ_DHCP_VER=6
+	else
+		DNSMASQ_DHCP_VER=4
+	fi
+
+	# Allow DHCP/DHCPv6 to be handled by ISC DHCPD
+	if [ -x /usr/sbin/dhcpd ] ; then
+		if [ -x /etc/init.d/dhcpd ] ; then
+			/etc/init.d/dhcpd enabled && DNSMASQ_DHCP_VER=0
+		fi
+		if [ -x /etc/init.d/dhcpd6 ] && [ "$DNSMASQ_DHCP_VER" -gt 0 ] ; then
+			/etc/init.d/dhcpd6 enabled && DNSMASQ_DHCP_VER=4
+		fi
+	fi
+
+	append_bool "$cfg" authoritative "--dhcp-authoritative"
+	append_bool "$cfg" nodaemon "--no-daemon"
+	append_bool "$cfg" domainneeded "--domain-needed"
+	append_bool "$cfg" filterwin2k "--filterwin2k"
+	append_bool "$cfg" nohosts "--no-hosts"
+	append_bool "$cfg" nonegcache "--no-negcache"
+	append_bool "$cfg" strictorder "--strict-order"
+	append_bool "$cfg" logqueries "--log-queries=extra"
+	append_bool "$cfg" noresolv "--no-resolv"
+	append_bool "$cfg" localise_queries "--localise-queries"
+	append_bool "$cfg" readethers "--read-ethers"
+
+	local instance_name="dnsmasq.$cfg"
+	if [ "$cfg" = "$DEFAULT_INSTANCE" ]; then
+		instance_name="dnsmasq"
+	fi
+	config_get_bool dbus "$cfg" "dbus" 0
+	[ $dbus -gt 0 ] && xappend "--enable-dbus=uk.org.thekelleys.$instance_name"
+	config_get_bool ubus "$cfg" "ubus" 1
+	[ $ubus -gt 0 ] && xappend "--enable-ubus=$instance_name"
+
+	append_bool "$cfg" expandhosts "--expand-hosts"
+	config_get tftp_root "$cfg" "tftp_root"
+	[ -n "$tftp_root" ] && mkdir -p "$tftp_root" && append_bool "$cfg" enable_tftp "--enable-tftp"
+	append_bool "$cfg" tftp_no_fail "--tftp-no-fail"
+	append_bool "$cfg" nonwildcard "--bind-dynamic" 1
+	append_bool "$cfg" fqdn "--dhcp-fqdn"
+	append_bool "$cfg" proxydnssec "--proxy-dnssec"
+	append_bool "$cfg" localservice "--local-service"
+	append_bool "$cfg" logdhcp "--log-dhcp"
+	append_bool "$cfg" quietdhcp "--quiet-dhcp"
+	append_bool "$cfg" sequential_ip "--dhcp-sequential-ip"
+	append_bool "$cfg" allservers "--all-servers"
+	append_bool "$cfg" noping "--no-ping"
+	append_bool "$cfg" rapidcommit "--dhcp-rapid-commit"
+	append_bool "$cfg" scriptarp "--script-arp"
+
+	append_bool "$cfg" filter_aaaa "--filter-AAAA"
+	append_bool "$cfg" filter_a "--filter-A"
+
+	append_parm "$cfg" logfacility "--log-facility"
+	config_get logfacility "$cfg" "logfacility"
+	append_parm "$cfg" cachesize "--cache-size"
+	append_parm "$cfg" dnsforwardmax "--dns-forward-max"
+	append_parm "$cfg" port "--port"
+	append_parm "$cfg" ednspacket_max "--edns-packet-max"
+	append_parm "$cfg" dhcpleasemax "--dhcp-lease-max"
+	append_parm "$cfg" "queryport" "--query-port"
+	append_parm "$cfg" "minport" "--min-port"
+	append_parm "$cfg" "maxport" "--max-port"
+	append_parm "$cfg" "domain" "--domain"
+	append_parm "$cfg" "local" "--local"
+	config_list_foreach "$cfg" "listen_address" append_listenaddress
+	config_list_foreach "$cfg" "server" append_server
+	config_list_foreach "$cfg" "rev_server" append_rev_server
+	config_list_foreach "$cfg" "address" append_address
+
+	local connmark_allowlist_enable
+	config_get connmark_allowlist_enable "$cfg" connmark_allowlist_enable 0
+	[ "$connmark_allowlist_enable" -gt 0 ] && {
+		append_parm "$cfg" "connmark_allowlist_enable" "--connmark-allowlist-enable"
+		config_list_foreach "$cfg" "connmark_allowlist" append_connmark_allowlist
+	}
+
+	[ -n "$BOOT" ] || {
+		config_list_foreach "$cfg" "interface" append_interface
+		config_list_foreach "$cfg" "notinterface" append_notinterface
+	}
+	config_get_bool ignore_hosts_dir "$cfg" ignore_hosts_dir 0
+	if [ "$ignore_hosts_dir" = "1" ]; then
+		xappend "--addn-hosts=$HOSTFILE"
+		append EXTRA_MOUNT "$HOSTFILE"
+	else
+		xappend "--addn-hosts=$HOSTFILE_DIR"
+		append EXTRA_MOUNT "$HOSTFILE_DIR"
+	fi
+	config_list_foreach "$cfg" "addnhosts" append_addnhosts
+	config_list_foreach "$cfg" "bogusnxdomain" append_bogusnxdomain
+	append_parm "$cfg" "leasefile" "--dhcp-leasefile" "/tmp/dhcp.leases"
+
+	local serversfile
+	config_get serversfile "$cfg" "serversfile"
+	[ -n "$serversfile" ] && {
+		xappend "--servers-file=$serversfile"
+		append EXTRA_MOUNT "$serversfile"
+	}
+
+	append_parm "$cfg" "tftp_root" "--tftp-root"
+	append_parm "$cfg" "dhcp_boot" "--dhcp-boot"
+	append_parm "$cfg" "local_ttl" "--local-ttl"
+	append_parm "$cfg" "max_ttl" "--max-ttl"
+	append_parm "$cfg" "min_cache_ttl" "--min-cache-ttl"
+	append_parm "$cfg" "max_cache_ttl" "--max-cache-ttl"
+	append_parm "$cfg" "pxe_prompt" "--pxe-prompt"
+	append_parm "$cfg" "tftp_unique_root" "--tftp-unique-root"
+	config_list_foreach "$cfg" "pxe_service" append_pxe_service
+	config_get DOMAIN "$cfg" domain
+
+	config_get_bool ADD_LOCAL_DOMAIN "$cfg" add_local_domain 1
+	config_get_bool ADD_LOCAL_HOSTNAME "$cfg" add_local_hostname 1
+	config_get ADD_LOCAL_FQDN "$cfg" add_local_fqdn ""
+	config_get ADD_WAN_FQDN "$cfg" add_wan_fqdn 0
+
+	if [ -z "$ADD_LOCAL_FQDN" ] ; then
+		# maintain support for previous UCI
+		ADD_LOCAL_FQDN="$ADD_LOCAL_HOSTNAME"
+	fi
+
+	config_get user_dhcpscript $cfg dhcpscript
+	if has_handler || [ -n "$user_dhcpscript" ]; then
+		xappend "--dhcp-script=$DHCPSCRIPT"
+		xappend "--script-arp"
+	fi
+
+	config_get leasefile $cfg leasefile "/tmp/dhcp.leases"
+	[ -n "$leasefile" ] && [ ! -e "$leasefile" ] && touch "$leasefile"
+	config_get_bool cachelocal "$cfg" cachelocal 1
+
+	config_get_bool noresolv "$cfg" noresolv 0
+	if [ "$noresolv" != "1" ]; then
+		config_get resolvfile "$cfg" resolvfile /tmp/resolv.conf.d/resolv.conf.auto
+		[ -n "$resolvfile" ] && [ ! -e "$resolvfile" ] && touch "$resolvfile"
+		xappend "--resolv-file=$resolvfile"
+		[ "$resolvfile" != "/tmp/resolv.conf.d/resolv.conf.auto" ] && localuse=0
+		resolvdir="$(dirname "$resolvfile")"
+	fi
+	config_get_bool localuse "$cfg" localuse "$localuse"
+
+	config_get hostsfile "$cfg" dhcphostsfile
+	[ -e "$hostsfile" ] && xappend "--dhcp-hostsfile=$hostsfile"
+
+	local rebind
+	config_get_bool rebind "$cfg" rebind_protection 1
+	[ $rebind -gt 0 ] && {
+		log_once \
+			"DNS rebinding protection is active," \
+			"will discard upstream RFC1918 responses!"
+		xappend "--stop-dns-rebind"
+
+		local rebind_localhost
+		config_get_bool rebind_localhost "$cfg" rebind_localhost 0
+		[ $rebind_localhost -gt 0 ] && {
+			log_once "Allowing 127.0.0.0/8 responses"
+			xappend "--rebind-localhost-ok"
+		}
+
+		append_rebind_domain() {
+			log_once "Allowing RFC1918 responses for domain $1"
+			xappend "--rebind-domain-ok=$1"
+		}
+
+		config_list_foreach "$cfg" rebind_domain append_rebind_domain
+	}
+
+	config_get_bool dnssec "$cfg" dnssec 0
+	[ "$dnssec" -gt 0 ] && {
+		xappend "--conf-file=$TRUSTANCHORSFILE"
+		xappend "--dnssec"
+		[ -x /etc/init.d/sysntpd ] && {
+			if /etc/init.d/sysntpd enabled || [ "$(uci_get system.ntp.enabled)" = "1" ] ; then
+				[ -f "$TIMEVALIDFILE" ] || xappend "--dnssec-no-timecheck"
+			fi
+		}
+		config_get_bool dnsseccheckunsigned "$cfg" dnsseccheckunsigned 1
+		[ "$dnsseccheckunsigned" -eq 0 ] && xappend "--dnssec-check-unsigned=no"
+	}
+
+	config_get addmac "$cfg" addmac 0
+	[ "$addmac" != "0" ] && {
+		[ "$addmac" = "1" ] && addmac=
+		xappend "--add-mac${addmac:+="$addmac"}"
+	}
+
+	dhcp_option_add "$cfg" "" 0
+	dhcp_option_add "$cfg" "" 2
+
+	xappend "--dhcp-broadcast=tag:needs-broadcast"
+
+
+	config_get dnsmasqconfdir "$cfg" confdir "/tmp/dnsmasq.d"
+	xappend "--conf-dir=$dnsmasqconfdir"
+	dnsmasqconfdir="${dnsmasqconfdir%%,*}"
+	[ ! -d "$dnsmasqconfdir" ] && mkdir -p $dnsmasqconfdir
+	xappend "--user=dnsmasq"
+	xappend "--group=dnsmasq"
+	echo >> $CONFIGFILE_TMP
+
+	config_get_bool enable_tftp "$cfg" enable_tftp 0
+	[ "$enable_tftp" -gt 0 ] && {
+		config_get tftp_root "$cfg" tftp_root
+		append EXTRA_MOUNT $tftp_root
+	}
+
+	config_foreach filter_dnsmasq host dhcp_host_add "$cfg"
+	echo >> $CONFIGFILE_TMP
+
+	config_get_bool dhcpbogushostname "$cfg" dhcpbogushostname 1
+	[ "$dhcpbogushostname" -gt 0 ] && {
+		xappend "--dhcp-ignore-names=tag:dhcp_bogus_hostname"
+		[ -r "$DHCPBOGUSHOSTNAMEFILE" ] && xappend "--conf-file=$DHCPBOGUSHOSTNAMEFILE"
+	}
+
+	config_foreach filter_dnsmasq boot dhcp_boot_add "$cfg"
+	config_foreach filter_dnsmasq mac dhcp_mac_add "$cfg"
+	config_foreach filter_dnsmasq tag dhcp_tag_add "$cfg"
+	config_foreach filter_dnsmasq vendorclass dhcp_vendorclass_add "$cfg"
+	config_foreach filter_dnsmasq userclass dhcp_userclass_add "$cfg"
+	config_foreach filter_dnsmasq circuitid dhcp_circuitid_add "$cfg"
+	config_foreach filter_dnsmasq remoteid dhcp_remoteid_add "$cfg"
+	config_foreach filter_dnsmasq subscrid dhcp_subscrid_add "$cfg"
+	config_foreach filter_dnsmasq match dhcp_match_add "$cfg"
+	config_foreach filter_dnsmasq domain dhcp_domain_add "$cfg"
+	config_foreach filter_dnsmasq hostrecord dhcp_hostrecord_add "$cfg"
+	[ -n "$BOOT" ] || config_foreach filter_dnsmasq relay dhcp_relay_add "$cfg"
+
+	echo >> $CONFIGFILE_TMP
+	config_foreach filter_dnsmasq srvhost dhcp_srv_add "$cfg"
+	config_foreach filter_dnsmasq mxhost dhcp_mx_add "$cfg"
+	echo >> $CONFIGFILE_TMP
+
+	config_get_bool boguspriv "$cfg" boguspriv 1
+	[ "$boguspriv" -gt 0 ] && {
+		xappend "--bogus-priv"
+		[ -r "$RFC6761FILE" ] && xappend "--conf-file=$RFC6761FILE"
+	}
+
+	if [ "$DNSMASQ_DHCP_VER" -gt 4 ] ; then
+		# Enable RA feature for when/if it is constructed,
+		# and RA is selected per interface pool (RA, DHCP, or both),
+		# but no one (should) want RA broadcast in syslog
+		[ -n "$BOOT" ] || config_foreach filter_dnsmasq dhcp dhcp_add "$cfg"
+		xappend "--enable-ra"
+		xappend "--quiet-ra"
+		append_bool "$cfg" quietdhcp "--quiet-dhcp6"
+
+	elif [ "$DNSMASQ_DHCP_VER" -gt 0 ] ; then
+		[ -n "$BOOT" ] || config_foreach filter_dnsmasq dhcp dhcp_add "$cfg"
+	fi
+
+
+	echo >> $CONFIGFILE_TMP
+	config_foreach filter_dnsmasq cname dhcp_cname_add "$cfg"
+	echo >> $CONFIGFILE_TMP
+
+	echo >> $CONFIGFILE_TMP
+	config_foreach filter_dnsmasq ipset dnsmasq_ipset_add "$cfg"
+	echo >> $CONFIGFILE_TMP
+
+	mv -f $CONFIGFILE_TMP $CONFIGFILE
+	mv -f $HOSTFILE_TMP $HOSTFILE
+
+	[ "$localuse" -gt 0 ] && {
+		rm -f /tmp/resolv.conf
+		[ $ADD_LOCAL_DOMAIN -eq 1 ] && [ -n "$DOMAIN" ] && {
+			echo "search $DOMAIN" >> /tmp/resolv.conf
+		}
+		DNS_SERVERS="$DNS_SERVERS 127.0.0.1"
+		[ -e /proc/sys/net/ipv6 ] && DNS_SERVERS="$DNS_SERVERS ::1"
+		for DNS_SERVER in $DNS_SERVERS ; do
+			echo "nameserver $DNS_SERVER" >> /tmp/resolv.conf
+		done
+	}
+
+	config_list_foreach "$cfg" addnmount append_extramount
+
+	procd_open_instance $cfg
+	procd_set_param command $PROG -C $CONFIGFILE -k -x /var/run/dnsmasq/dnsmasq."${cfg}".pid
+	procd_set_param file $CONFIGFILE
+	[ -n "$user_dhcpscript" ] && procd_set_param env USER_DHCPSCRIPT="$user_dhcpscript"
+	procd_set_param respawn
+
+	local instance_ifc instance_netdev
+	config_get instance_ifc "$cfg" interface
+	[ -n "$instance_ifc" ] && network_get_device instance_netdev "$instance_ifc" &&
+		[ -n "$instance_netdev" ] && procd_set_param netdev $instance_netdev
+
+	procd_add_jail dnsmasq ubus log
+	procd_add_jail_mount $CONFIGFILE $DHCPBOGUSHOSTNAMEFILE $DHCPSCRIPT $DHCPSCRIPT_DEPENDS
+	procd_add_jail_mount $EXTRA_MOUNT $RFC6761FILE $TRUSTANCHORSFILE
+	procd_add_jail_mount $dnsmasqconffile $dnsmasqconfdir $resolvdir $user_dhcpscript
+	procd_add_jail_mount /etc/passwd /etc/group /etc/TZ /etc/hosts /etc/ethers
+	procd_add_jail_mount_rw /var/run/dnsmasq/ $leasefile
+	case "$logfacility" in */*)
+		[ ! -e "$logfacility" ] && touch "$logfacility"
+		procd_add_jail_mount_rw "$logfacility"
+	esac
+	[ -e "$hostsfile" ] && procd_add_jail_mount $hostsfile
+
+	procd_close_instance
+}
+
+dnsmasq_stop()
+{
+	local cfg="$1"
+	local noresolv resolvfile localuse=1
+
+	config_get_bool noresolv "$cfg" noresolv 0
+	config_get resolvfile "$cfg" "resolvfile"
+
+	[ "$noresolv" = 0 ] && [ "$resolvfile" != "/tmp/resolv.conf.d/resolv.conf.auto" ] && localuse=0
+	config_get_bool localuse "$cfg" localuse "$localuse"
+	[ "$localuse" -gt 0 ] && ln -sf "/tmp/resolv.conf.d/resolv.conf.auto" /tmp/resolv.conf
+
+	rm -f ${BASEDHCPSTAMPFILE}.${cfg}.*.dhcp
+}
+
+add_interface_trigger()
+{
+	local interface ifname ignore
+
+	config_get interface "$1" interface
+	config_get_bool ignore "$1" ignore 0
+	network_get_device ifname "$interface" || ignore=0
+
+	[ -n "$interface" ] && [ $ignore -eq 0 ] && procd_add_interface_trigger "interface.*" "$interface" /etc/init.d/dnsmasq reload
+}
+
+service_triggers()
+{
+	procd_add_reload_trigger "dhcp" "system"
+
+	config_load dhcp
+	config_foreach add_interface_trigger dhcp
+	config_foreach add_interface_trigger relay
+}
+
+boot()
+{
+	BOOT=1
+	start "$@"
+}
+
+start_service() {
+	local instance="$1"
+	local instance_found=0
+	local first_instance=""
+
+	. /lib/functions/network.sh
+
+	config_cb() {
+		local type="$1"
+		local name="$2"
+		if [ "$type" = "dnsmasq" ]; then
+			if [ -n "$instance" ] && [ "$instance" = "$name" ]; then
+				instance_found=1
+			fi
+			if [ -z "$DEFAULT_INSTANCE" ]; then
+				local disabled
+				config_get_bool disabled "$name" disabled 0
+				if [ "$disabled" -eq 0 ]; then
+					# First enabled section will be assigned default instance name.
+					# Unnamed sections get precedence over named sections.
+					if expr "$cfg" : 'cfg[0-9a-f]*$' >/dev/null = "9"; then # See uci_fixup_section.
+						DEFAULT_INSTANCE="$name" # Unnamed config section.
+					elif [ -z "$first_instance" ]; then
+						first_instance="$name"
+					fi
+				fi
+			fi
+		fi
+	}
+
+	DEFAULT_INSTANCE=""
+	config_load dhcp
+	if [ -z "$DEFAULT_INSTANCE" ]; then
+		DEFAULT_INSTANCE="$first_instance" # No unnamed config section was found.
+	fi
+
+	if [ -n "$instance" ]; then
+		[ "$instance_found" -gt 0 ] || return
+		dnsmasq_start "$instance"
+	else
+		config_foreach dnsmasq_start dnsmasq
+	fi
+}
+
+reload_service() {
+	rc_procd start_service "$@"
+	procd_send_signal dnsmasq "$@"
+}
+
+stop_service() {
+	local instance="$1"
+	local instance_found=0
+
+	config_cb() {
+		local type="$1"
+		local name="$2"
+		if [ "$type" = "dnsmasq" ]; then
+			if [ -n "$instance" ] && [ "$instance" = "$name" ]; then
+				instance_found=1
+			fi
+		fi
+	}
+
+	config_load dhcp
+
+	if [ -n "$instance" ]; then
+		[ "$instance_found" -gt 0 ] || return
+		dnsmasq_stop "$instance"
+	else
+		config_foreach dnsmasq_stop dnsmasq
+	fi
+}
diff --git a/6.12/package/network/utils/nftables/Makefile b/6.12/package/network/utils/nftables/Makefile
new file mode 100644
index 00000000..55a6a4bc
--- /dev/null
+++ b/6.12/package/network/utils/nftables/Makefile
@@ -0,0 +1,85 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2015 OpenWrt.org
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=nftables
+PKG_VERSION:=1.0.7
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
+PKG_SOURCE_URL:=https://netfilter.org/projects/$(PKG_NAME)/files
+PKG_HASH:=c12ac941fff9adaedf17367d5ce213789b98a0d314277bc22b3d71e10891f412
+
+PKG_MAINTAINER:=
+PKG_LICENSE:=GPL-2.0
+PKG_LICENSE_FILES:=COPYING
+
+PKG_FIXUP:=autoreconf
+PKG_INSTALL:=1
+
+PKG_BUILD_FLAGS:=lto
+
+include $(INCLUDE_DIR)/package.mk
+
+DISABLE_NLS:=
+
+CONFIGURE_ARGS += \
+        --disable-debug \
+        --disable-man-doc \
+        --with-mini-gmp \
+        --without-cli \
+        --disable-python
+
+define Package/nftables/Default
+  SECTION:=net
+  CATEGORY:=Network
+  SUBMENU:=Firewall
+  TITLE:=nftables userspace utility
+  DEPENDS:=+kmod-nft-core +libnftnl
+  URL:=http://netfilter.org/projects/nftables/
+  PROVIDES:=nftables
+endef
+
+define Package/nftables-nojson
+  $(Package/nftables/Default)
+  TITLE+= no JSON support
+  VARIANT:=nojson
+  DEFAULT_VARIANT:=1
+  CONFLICTS:=nftables-json
+endef
+
+define Package/nftables-json
+  $(Package/nftables/Default)
+  TITLE+= with JSON support
+  VARIANT:=json
+  DEPENDS+=+jansson
+endef
+
+ifeq ($(BUILD_VARIANT),json)
+  CONFIGURE_ARGS += --with-json
+endif
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/lib $(1)/usr/include
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/*.so* $(1)/usr/lib/
+	$(CP) $(PKG_INSTALL_DIR)/usr/include/nftables $(1)/usr/include/
+	$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libnftables.pc \
+		$(1)/usr/lib/pkgconfig/
+endef
+
+define Package/nftables/install/Default
+	$(INSTALL_DIR) $(1)/usr/sbin
+	$(CP) $(PKG_INSTALL_DIR)/usr/sbin/nft $(1)/usr/sbin/
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/*.so* $(1)/usr/lib/
+endef
+
+Package/nftables-nojson/install = $(Package/nftables/install/Default)
+Package/nftables-json/install = $(Package/nftables/install/Default)
+
+$(eval $(call BuildPackage,nftables-nojson))
+$(eval $(call BuildPackage,nftables-json))
diff --git a/6.12/package/network/utils/nftables/patches/002-nftables-add-fullcone-expression-support.patch b/6.12/package/network/utils/nftables/patches/002-nftables-add-fullcone-expression-support.patch
new file mode 100644
index 00000000..8a7c57e4
--- /dev/null
+++ b/6.12/package/network/utils/nftables/patches/002-nftables-add-fullcone-expression-support.patch
@@ -0,0 +1,223 @@
+From 58c89e8768711a959fdc6e953df3ea2254ff93c1 Mon Sep 17 00:00:00 2001
+From: Syrone Wong <wong.syrone@gmail.com>
+Date: Sat, 9 Apr 2022 00:38:51 +0800
+Subject: [PATCH] nftables: add fullcone expression support
+
+Signed-off-by: Syrone Wong <wong.syrone@gmail.com>
+---
+ include/linux/netfilter/nf_tables.h | 16 ++++++++++
+ include/statement.h                 |  1 +
+ src/netlink_delinearize.c           | 48 +++++++++++++++++++++++++++++
+ src/netlink_linearize.c             |  7 +++++
+ src/parser_bison.y                  | 28 +++++++++++++++--
+ src/scanner.l                       |  1 +
+ src/statement.c                     |  1 +
+ 7 files changed, 100 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
+index 75df968..beab9d8 100644
+--- a/include/linux/netfilter/nf_tables.h
++++ b/include/linux/netfilter/nf_tables.h
+@@ -1409,6 +1409,22 @@ enum nft_masq_attributes {
+ };
+ #define NFTA_MASQ_MAX		(__NFTA_MASQ_MAX - 1)
+ 
++/**
++ * enum nft_fullcone_attributes - nf_tables fullcone expression attributes
++ *
++ * @NFTA_FULLCONE_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32)
++ * @NFTA_FULLCONE_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
++ * @NFTA_FULLCONE_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
++ */
++enum nft_fullcone_attributes {
++	NFTA_FULLCONE_UNSPEC,
++	NFTA_FULLCONE_FLAGS,
++	NFTA_FULLCONE_REG_PROTO_MIN,
++	NFTA_FULLCONE_REG_PROTO_MAX,
++	__NFTA_FULLCONE_MAX
++};
++#define NFTA_FULLCONE_MAX		(__NFTA_FULLCONE_MAX - 1)
++
+ /**
+  * enum nft_redir_attributes - nf_tables redirect expression netlink attributes
+  *
+diff --git a/include/statement.h b/include/statement.h
+index 2a2d300..cbd48dd 100644
+--- a/include/statement.h
++++ b/include/statement.h
+@@ -122,6 +122,7 @@ enum nft_nat_etypes {
+ 	__NFT_NAT_SNAT = NFT_NAT_SNAT,
+ 	__NFT_NAT_DNAT = NFT_NAT_DNAT,
+ 	NFT_NAT_MASQ,
++	NFT_NAT_FULLCONE,
+ 	NFT_NAT_REDIR,
+ };
+ 
+diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
+index 068c3bb..8513113 100644
+--- a/src/netlink_delinearize.c
++++ b/src/netlink_delinearize.c
+@@ -1369,6 +1369,53 @@ static void netlink_parse_masq(struct netlink_parse_ctx *ctx,
+ 	stmt_free(stmt);
+ }
+ 
++static void netlink_parse_fullcone(struct netlink_parse_ctx *ctx,
++			       const struct location *loc,
++			       const struct nftnl_expr *nle)
++{
++	enum nft_registers reg1, reg2;
++	struct expr *proto;
++	struct stmt *stmt;
++	uint32_t flags = 0;
++
++	if (nftnl_expr_is_set(nle, NFTNL_EXPR_FULLCONE_FLAGS))
++		flags = nftnl_expr_get_u32(nle, NFTNL_EXPR_FULLCONE_FLAGS);
++
++	stmt = nat_stmt_alloc(loc, NFT_NAT_FULLCONE);
++	stmt->nat.flags = flags;
++
++	reg1 = netlink_parse_register(nle, NFTNL_EXPR_FULLCONE_REG_PROTO_MIN);
++	if (reg1) {
++		proto = netlink_get_register(ctx, loc, reg1);
++		if (proto == NULL) {
++			netlink_error(ctx, loc,
++				      "fullcone statement has no proto expression");
++			goto out_err;
++		}
++		expr_set_type(proto, &inet_service_type, BYTEORDER_BIG_ENDIAN);
++		stmt->nat.proto = proto;
++	}
++
++	reg2 = netlink_parse_register(nle, NFTNL_EXPR_FULLCONE_REG_PROTO_MAX);
++	if (reg2 && reg2 != reg1) {
++		proto = netlink_get_register(ctx, loc, reg2);
++		if (proto == NULL) {
++			netlink_error(ctx, loc,
++				      "fullcone statement has no proto expression");
++			goto out_err;
++		}
++		expr_set_type(proto, &inet_service_type, BYTEORDER_BIG_ENDIAN);
++		if (stmt->nat.proto != NULL)
++			proto = range_expr_alloc(loc, stmt->nat.proto, proto);
++		stmt->nat.proto = proto;
++	}
++
++	ctx->stmt = stmt;
++	return;
++out_err:
++	stmt_free(stmt);
++}
++
+ static void netlink_parse_redir(struct netlink_parse_ctx *ctx,
+ 				const struct location *loc,
+ 				const struct nftnl_expr *nle)
+@@ -1787,6 +1834,7 @@ static const struct expr_handler netlink_parsers[] = {
+ 	{ .name = "tproxy",	.parse = netlink_parse_tproxy },
+ 	{ .name = "notrack",	.parse = netlink_parse_notrack },
+ 	{ .name = "masq",	.parse = netlink_parse_masq },
++	{ .name = "fullcone",	.parse = netlink_parse_fullcone },
+ 	{ .name = "redir",	.parse = netlink_parse_redir },
+ 	{ .name = "dup",	.parse = netlink_parse_dup },
+ 	{ .name = "queue",	.parse = netlink_parse_queue },
+diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c
+index c8bbcb7..505eafa 100644
+--- a/src/netlink_linearize.c
++++ b/src/netlink_linearize.c
+@@ -1140,6 +1140,13 @@ static void netlink_gen_nat_stmt(struct netlink_linearize_ctx *ctx,
+ 		nftnl_reg_pmin = NFTNL_EXPR_MASQ_REG_PROTO_MIN;
+ 		nftnl_reg_pmax = NFTNL_EXPR_MASQ_REG_PROTO_MAX;
+ 		break;
++	case NFT_NAT_FULLCONE:
++		nle = alloc_nft_expr("fullcone");
++
++		nftnl_flag_attr = NFTNL_EXPR_FULLCONE_FLAGS;
++		nftnl_reg_pmin = NFTNL_EXPR_FULLCONE_REG_PROTO_MIN;
++		nftnl_reg_pmax = NFTNL_EXPR_FULLCONE_REG_PROTO_MAX;
++		break;
+ 	case NFT_NAT_REDIR:
+ 		nle = alloc_nft_expr("redir");
+ 
+diff --git a/src/parser_bison.y b/src/parser_bison.y
+index ca5c488..ec9fc9b 100644
+--- a/src/parser_bison.y
++++ b/src/parser_bison.y
+@@ -571,6 +571,7 @@ int nft_lex(void *, void *, void *);
+ %token SNAT			"snat"
+ %token DNAT			"dnat"
+ %token MASQUERADE		"masquerade"
++%token FULLCONE		"fullcone"
+ %token REDIRECT			"redirect"
+ %token RANDOM			"random"
+ %token FULLY_RANDOM		"fully-random"
+@@ -703,8 +704,8 @@ int nft_lex(void *, void *, void *);
+ %type <val>			limit_burst_pkts limit_burst_bytes limit_mode limit_bytes time_unit quota_mode
+ %type <stmt>			reject_stmt reject_stmt_alloc
+ %destructor { stmt_free($$); }	reject_stmt reject_stmt_alloc
+-%type <stmt>			nat_stmt nat_stmt_alloc masq_stmt masq_stmt_alloc redir_stmt redir_stmt_alloc
+-%destructor { stmt_free($$); }	nat_stmt nat_stmt_alloc masq_stmt masq_stmt_alloc redir_stmt redir_stmt_alloc
++%type <stmt>			nat_stmt nat_stmt_alloc masq_stmt masq_stmt_alloc fullcone_stmt fullcone_stmt_alloc redir_stmt redir_stmt_alloc
++%destructor { stmt_free($$); }	nat_stmt nat_stmt_alloc masq_stmt masq_stmt_alloc fullcone_stmt fullcone_stmt_alloc redir_stmt redir_stmt_alloc
+ %type <val>			nf_nat_flags nf_nat_flag offset_opt
+ %type <stmt>			tproxy_stmt
+ %destructor { stmt_free($$); }	tproxy_stmt
+@@ -2853,6 +2854,7 @@ stmt			:	verdict_stmt
+ 			|	queue_stmt
+ 			|	ct_stmt
+ 			|	masq_stmt	close_scope_nat
++			|	fullcone_stmt	close_scope_nat
+ 			|	redir_stmt	close_scope_nat
+ 			|	dup_stmt	close_scope_dup
+ 			|	fwd_stmt	close_scope_fwd
+@@ -3753,6 +3755,28 @@ masq_stmt_args		:	TO 	COLON	stmt_expr
+ 			}
+ 			;
+ 
++fullcone_stmt		:	fullcone_stmt_alloc		fullcone_stmt_args
++			|	fullcone_stmt_alloc
++			;
++
++fullcone_stmt_alloc		:	FULLCONE	{ $$ = nat_stmt_alloc(&@$, NFT_NAT_FULLCONE); }
++			;
++
++fullcone_stmt_args		:	TO 	COLON	stmt_expr
++			{
++				$<stmt>0->nat.proto = $3;
++			}
++			|	TO 	COLON	stmt_expr	nf_nat_flags
++			{
++				$<stmt>0->nat.proto = $3;
++				$<stmt>0->nat.flags = $4;
++			}
++			|	nf_nat_flags
++			{
++				$<stmt>0->nat.flags = $1;
++			}
++			;
++
+ redir_stmt		:	redir_stmt_alloc	redir_stmt_arg
+ 			|	redir_stmt_alloc
+ 			;
+diff --git a/src/scanner.l b/src/scanner.l
+index 2154281..c389860 100644
+--- a/src/scanner.l
++++ b/src/scanner.l
+@@ -453,6 +453,7 @@ addrstring	({macaddr}|{ip4addr}|{ip6addr})
+ "snat"			{ scanner_push_start_cond(yyscanner, SCANSTATE_STMT_NAT); return SNAT; }
+ "dnat"			{ scanner_push_start_cond(yyscanner, SCANSTATE_STMT_NAT); return DNAT; }
+ "masquerade"		{ scanner_push_start_cond(yyscanner, SCANSTATE_STMT_NAT); return MASQUERADE; }
++"fullcone"		{ scanner_push_start_cond(yyscanner, SCANSTATE_STMT_NAT); return FULLCONE; }
+ "redirect"		{ scanner_push_start_cond(yyscanner, SCANSTATE_STMT_NAT); return REDIRECT; }
+ "random"		{ return RANDOM; }
+ <SCANSTATE_STMT_NAT>{
+diff --git a/src/statement.c b/src/statement.c
+index 30caf9c..f4866c2 100644
+--- a/src/statement.c
++++ b/src/statement.c
+@@ -650,6 +650,7 @@ const char *nat_etype2str(enum nft_nat_etypes type)
+ 		[NFT_NAT_SNAT]	= "snat",
+ 		[NFT_NAT_DNAT]	= "dnat",
+ 		[NFT_NAT_MASQ]	= "masquerade",
++		[NFT_NAT_FULLCONE] = "fullcone",
+ 		[NFT_NAT_REDIR]	= "redirect",
+ 	};
+ 
diff --git a/6.12/package/system/apk/patches/0090-remove-test.patch b/6.12/package/system/apk/patches/0090-remove-test.patch
new file mode 100644
index 00000000..a88fe792
--- /dev/null
+++ b/6.12/package/system/apk/patches/0090-remove-test.patch
@@ -0,0 +1,7 @@
+--- a/meson.build	2024-12-06 09:22:04.231554103 +0100
++++ b/meson.build	2024-12-06 09:22:10.239461416 +0100
+@@ -45,4 +45,3 @@
+ if(lua_dep.found())
+ 	subdir('lua')
+ endif
+-subdir('test')
diff --git a/6.12/target/linux/bcm27xx/bcm2708/config-6.12 b/6.12/target/linux/bcm27xx/bcm2708/config-6.12
new file mode 100644
index 00000000..68ccc71e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/bcm2708/config-6.12
@@ -0,0 +1,379 @@
+# CONFIG_AIO is not set
+CONFIG_ALIGNMENT_TRAP=y
+# CONFIG_AMD_QDMA is not set
+CONFIG_APERTURE_HELPERS=y
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_BCM=y
+CONFIG_ARCH_BCM2835=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
+CONFIG_ARCH_MMAP_RND_BITS=16
+CONFIG_ARCH_MMAP_RND_BITS_MAX=16
+CONFIG_ARCH_MMAP_RND_BITS_MIN=8
+CONFIG_ARCH_MULTIPLATFORM=y
+CONFIG_ARCH_MULTI_V6=y
+CONFIG_ARCH_MULTI_V6_V7=y
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARM=y
+CONFIG_ARM_CPU_SUSPEND=y
+# CONFIG_ARM_DEBUG_WX is not set
+CONFIG_ARM_ERRATA_411920=y
+CONFIG_ARM_HAS_GROUP_RELOCS=y
+CONFIG_ARM_L1_CACHE_SHIFT=5
+# CONFIG_ARM_MHU_V2 is not set
+CONFIG_ARM_PAN=y
+CONFIG_ARM_PATCH_PHYS_VIRT=y
+CONFIG_ARM_RASPBERRYPI_CPUFREQ=y
+CONFIG_ARM_THUMB=y
+CONFIG_ARM_TIMER_SP804=y
+CONFIG_ARM_UNWIND=y
+CONFIG_AUTO_ZRELADDR=y
+# CONFIG_BATTERY_MAX1720X is not set
+CONFIG_BCM2708_VCMEM=y
+# CONFIG_BCM2711_THERMAL is not set
+CONFIG_BCM2835_FAST_MEMCPY=y
+CONFIG_BCM2835_MBOX=y
+CONFIG_BCM2835_POWER=y
+# CONFIG_BCM2835_SMI is not set
+CONFIG_BCM2835_THERMAL=y
+CONFIG_BCM2835_TIMER=y
+CONFIG_BCM2835_VCHIQ=y
+# CONFIG_BCM2835_VCHIQ_MMAL is not set
+CONFIG_BCM2835_WDT=y
+CONFIG_BCM_VCIO=y
+# CONFIG_BCM_VC_SM_CMA is not set
+CONFIG_BCM_VIDEOCORE=y
+CONFIG_BINFMT_FLAT_ARGVP_ENVP_ON_STACK=y
+# CONFIG_BLK_DEV_INITRD is not set
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_PM=y
+CONFIG_BRCMSTB_L2_IRQ=y
+CONFIG_BRCM_CHAR_DRIVERS=y
+CONFIG_BUFFER_HEAD=y
+# CONFIG_CACHE_L2X0 is not set
+CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
+CONFIG_CLKSRC_MMIO=y
+CONFIG_CLK_BCM2711_DVP=y
+CONFIG_CLK_BCM2835=y
+CONFIG_CLK_RASPBERRYPI=y
+CONFIG_CMA=y
+CONFIG_CMA_ALIGNMENT=8
+CONFIG_CMA_AREAS=7
+# CONFIG_CMA_DEBUGFS is not set
+CONFIG_CMA_SIZE_MBYTES=5
+# CONFIG_CMA_SIZE_SEL_MAX is not set
+CONFIG_CMA_SIZE_SEL_MBYTES=y
+# CONFIG_CMA_SIZE_SEL_MIN is not set
+# CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set
+# CONFIG_CMA_SYSFS is not set
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONFIGFS_FS=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_CONTIG_ALLOC=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_CPUFREQ_DT_PLATDEV=y
+CONFIG_CPU_32v6=y
+CONFIG_CPU_32v6K=y
+CONFIG_CPU_ABRT_EV6=y
+# CONFIG_CPU_BIG_ENDIAN is not set
+CONFIG_CPU_CACHE_V6=y
+CONFIG_CPU_CACHE_VIPT=y
+CONFIG_CPU_COPY_V6=y
+CONFIG_CPU_CP15=y
+CONFIG_CPU_CP15_MMU=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_GOV_ATTR_SET=y
+CONFIG_CPU_FREQ_GOV_COMMON=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_HAS_ASID=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_LADDER=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_PABRT_V6=y
+CONFIG_CPU_PM=y
+CONFIG_CPU_THUMB_CAPABLE=y
+CONFIG_CPU_TLB_V6=y
+CONFIG_CPU_V6K=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_CRC32=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CURRENT_POINTER_IN_TPIDRURO=y
+CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_LL_INCLUDE="mach/debug-macro.S"
+CONFIG_DMABUF_HEAPS=y
+CONFIG_DMABUF_HEAPS_CMA=y
+CONFIG_DMABUF_HEAPS_SYSTEM=y
+CONFIG_DMADEVICES=y
+CONFIG_DMA_BCM2708=y
+CONFIG_DMA_BCM2835=y
+CONFIG_DMA_CMA=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_OF=y
+CONFIG_DMA_OPS_HELPERS=y
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_DMA_VIRTUAL_CHANNELS=y
+CONFIG_DNOTIFY=y
+# CONFIG_DP83TG720_PHY is not set
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_EDAC_ATOMIC_SCRUB=y
+CONFIG_EXT4_FS=y
+CONFIG_EXTCON=y
+CONFIG_F2FS_FS=y
+CONFIG_FB=y
+CONFIG_FB_BCM2708=y
+CONFIG_FB_CFB_COPYAREA=y
+CONFIG_FB_CFB_FILLRECT=y
+CONFIG_FB_CFB_IMAGEBLIT=y
+CONFIG_FB_CORE=y
+CONFIG_FB_DEVICE=y
+CONFIG_FB_IOMEM_FOPS=y
+CONFIG_FB_IOMEM_HELPERS=y
+# CONFIG_FB_RPISENSE is not set
+CONFIG_FB_SIMPLE=y
+CONFIG_FIQ=y
+CONFIG_FIXED_PHY=y
+CONFIG_FONT_8x16=y
+CONFIG_FONT_8x8=y
+CONFIG_FONT_SUPPORT=y
+CONFIG_FORCE_NR_CPUS=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+# CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY is not set
+CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
+CONFIG_FREEZER=y
+CONFIG_FS_MBCACHE=y
+# CONFIG_FUEL_GAUGE_MM8013 is not set
+CONFIG_FUNCTION_ALIGNMENT=0
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_CACHE=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_MULTI_HANDLER=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GPIOLIB_IRQCHIP=y
+# CONFIG_GPIO_BCM_VIRT is not set
+# CONFIG_GPIO_PWM is not set
+CONFIG_GPIO_RASPBERRYPI_EXP=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_BCM2835=y
+CONFIG_HZ_FIXED=0
+# CONFIG_HZ_PERIODIC is not set
+CONFIG_I2C=y
+# CONFIG_I2C_BCM2708 is not set
+CONFIG_I2C_BOARDINFO=y
+# CONFIG_I2C_DESIGNWARE_CORE is not set
+CONFIG_INPUT=y
+CONFIG_INPUT_MOUSEDEV=y
+# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+CONFIG_IRQSTACKS=y
+CONFIG_JBD2=y
+CONFIG_KERNEL_GZIP=y
+# CONFIG_KERNEL_XZ is not set
+CONFIG_LEDS_GPIO=y
+# CONFIG_LEDS_KTD202X is not set
+# CONFIG_LEDS_NCP5623 is not set
+CONFIG_LEDS_PWM=y
+CONFIG_LEDS_TRIGGER_ACTPWR=y
+CONFIG_LEDS_TRIGGER_INPUT=y
+# CONFIG_LEDS_TRIGGER_INPUT_EVENTS is not set
+CONFIG_LOGO=y
+CONFIG_LOGO_LINUX_CLUT224=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+CONFIG_MAC_PARTITION=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0x1f6
+CONFIG_MAILBOX=y
+# CONFIG_MAILBOX_TEST is not set
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEDIA_CAMERA_SUPPORT=y
+CONFIG_MEDIA_CONTROLLER=y
+CONFIG_MEDIA_PLATFORM_DRIVERS=y
+CONFIG_MEDIA_PLATFORM_SUPPORT=y
+CONFIG_MEDIA_SUPPORT=y
+CONFIG_MEDIA_SUPPORT_FILTER=y
+CONFIG_MEMORY_ISOLATION=y
+# CONFIG_MFD_88PM886_PMIC is not set
+# CONFIG_MFD_ADP5585 is not set
+CONFIG_MFD_CORE=y
+# CONFIG_MFD_CS40L50_I2C is not set
+# CONFIG_MFD_CS40L50_SPI is not set
+# CONFIG_MFD_RASPBERRYPI_POE_HAT is not set
+# CONFIG_MFD_ROHM_BD96801 is not set
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGHT_HAVE_CACHE_L2X0=y
+CONFIG_MMC=y
+# CONFIG_MMC_BCM2835 is not set
+CONFIG_MMC_BCM2835_DMA=y
+CONFIG_MMC_BCM2835_MMC=y
+CONFIG_MMC_BCM2835_PIO_DMA_BARRIER=2
+CONFIG_MMC_BCM2835_SDHOST=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_HSQ=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MODULES_USE_ELF_REL=y
+# CONFIG_MTD is not set
+CONFIG_NEED_PER_CPU_KM=y
+CONFIG_NET_DEVMEM=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NLS=y
+CONFIG_NLS_ASCII=y
+CONFIG_NOP_USB_XCEIV=y
+CONFIG_NO_HZ=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NVMEM=y
+CONFIG_NVMEM_LAYOUTS=y
+CONFIG_NVMEM_RASPBERRYPI_OTP=y
+CONFIG_OF_CONFIGFS=y
+CONFIG_OF_DYNAMIC=y
+CONFIG_OF_MDIO=y
+CONFIG_OF_OVERLAY=y
+CONFIG_OF_RESOLVE=y
+CONFIG_OLD_SIGACTION=y
+CONFIG_OLD_SIGSUSPEND3=y
+CONFIG_PAGE_OFFSET=0xC0000000
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLIB_LEDS=y
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_AW9523 is not set
+# CONFIG_PINCTRL_BCM2712 is not set
+CONFIG_PINCTRL_BCM2835=y
+# CONFIG_PINCTRL_RP1 is not set
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_GENERIC_DOMAINS=y
+CONFIG_PM_GENERIC_DOMAINS_OF=y
+CONFIG_PM_GENERIC_DOMAINS_SLEEP=y
+CONFIG_PM_OPP=y
+CONFIG_PM_SLEEP=y
+CONFIG_PRINTK_TIME=y
+# CONFIG_PTP_1588_CLOCK_FC3W is not set
+# CONFIG_PTP_1588_CLOCK_IDT82P33 is not set
+# CONFIG_PTP_1588_CLOCK_IDTCM is not set
+CONFIG_PWM=y
+CONFIG_PWM_BCM2835=y
+# CONFIG_PWM_GPIO is not set
+# CONFIG_PWM_RP1 is not set
+CONFIG_RASPBERRYPI_FIRMWARE=y
+CONFIG_RASPBERRYPI_GPIOMEM=y
+CONFIG_RASPBERRYPI_POWER=y
+# CONFIG_RAVE_SP_CORE is not set
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+# CONFIG_REGULATOR_MAX77503 is not set
+# CONFIG_REGULATOR_NETLINK_EVENTS is not set
+# CONFIG_REGULATOR_RASPBERRYPI_TOUCHSCREEN_V2 is not set
+CONFIG_RESET_CONTROLLER=y
+# CONFIG_RESET_GPIO is not set
+# CONFIG_RESET_RASPBERRYPI is not set
+CONFIG_RESET_SIMPLE=y
+# CONFIG_RPI_POE_POWER is not set
+# CONFIG_RPMB is not set
+# CONFIG_RTC_DRV_MAX31335 is not set
+# CONFIG_RTC_DRV_RX8111 is not set
+# CONFIG_RTC_DRV_SD2405AL is not set
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+# CONFIG_SCSI_LOWLEVEL is not set
+# CONFIG_SCSI_PROC_FS is not set
+# CONFIG_SENSORS_CHIPCAP2 is not set
+# CONFIG_SENSORS_LTC2991 is not set
+# CONFIG_SENSORS_LTC4282 is not set
+# CONFIG_SENSORS_POWERZ is not set
+# CONFIG_SENSORS_PT5161L is not set
+# CONFIG_SENSORS_SPD5118 is not set
+CONFIG_SERIAL_8250_BCM2835AUX=y
+# CONFIG_SERIAL_8250_DMA is not set
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_NR_UARTS=1
+CONFIG_SERIAL_8250_RUNTIME_UARTS=0
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_DEV_BUS=y
+# CONFIG_SERIAL_DEV_CTRL_TTYPORT is not set
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SG_POOL=y
+CONFIG_SMSC_PHY=y
+# CONFIG_STRIP_ASM_SYMS is not set
+CONFIG_SUSPEND=y
+CONFIG_SUSPEND_FREEZER=y
+CONFIG_SWPHY=y
+CONFIG_SYS_SUPPORTS_APM_EMULATION=y
+# CONFIG_TEXTSEARCH is not set
+CONFIG_THERMAL=y
+# CONFIG_THERMAL_CORE_TESTING is not set
+# CONFIG_THERMAL_DEBUGFS is not set
+CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
+CONFIG_THERMAL_GOV_STEP_WISE=y
+CONFIG_THERMAL_OF=y
+CONFIG_TINY_SRCU=y
+CONFIG_UEVENT_HELPER_PATH=""
+# CONFIG_UID16 is not set
+CONFIG_UNCOMPRESS_INCLUDE="debug/uncompress.h"
+CONFIG_UNWINDER_ARM=y
+CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+CONFIG_USB_COMMON=y
+CONFIG_USB_DEFAULT_AUTHORIZATION_MODE=1
+CONFIG_USB_DWCOTG=y
+CONFIG_USB_NET_DRIVERS=y
+CONFIG_USB_NET_SMSC95XX=y
+# CONFIG_USB_ONBOARD_DEV is not set
+CONFIG_USB_PHY=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USB_UAS=y
+CONFIG_USB_USBNET=y
+CONFIG_USE_OF=y
+CONFIG_VCHIQ_CDEV=y
+CONFIG_VFP=y
+CONFIG_VIDEO=y
+# CONFIG_VIDEO_AD5398 is not set
+# CONFIG_VIDEO_BCM2835_UNICAM is not set
+# CONFIG_VIDEO_BCM2835_UNICAM_LEGACY is not set
+# CONFIG_VIDEO_BU64754 is not set
+# CONFIG_VIDEO_CODEC_BCM2835 is not set
+CONFIG_VIDEO_DEV=y
+# CONFIG_VIDEO_IRS1125 is not set
+# CONFIG_VIDEO_ISP_BCM2835 is not set
+# CONFIG_VIDEO_MAX96714 is not set
+# CONFIG_VIDEO_MAX96717 is not set
+# CONFIG_VIDEO_RASPBERRYPI_PISP_BE is not set
+# CONFIG_VIDEO_RP1_CFE is not set
+# CONFIG_VIDEO_THP7312 is not set
+CONFIG_VIDEO_V4L2_I2C=y
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+CONFIG_VT_CONSOLE_SLEEP=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_XZ_DEC_ARM=y
+CONFIG_ZBOOT_ROM_BSS=0x0
+CONFIG_ZBOOT_ROM_TEXT=0x0
diff --git a/6.12/target/linux/bcm27xx/bcm2709/config-6.12 b/6.12/target/linux/bcm27xx/bcm2709/config-6.12
new file mode 100644
index 00000000..0329efb2
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/bcm2709/config-6.12
@@ -0,0 +1,457 @@
+# CONFIG_AIO is not set
+CONFIG_ALIGNMENT_TRAP=y
+# CONFIG_AMD_QDMA is not set
+CONFIG_APERTURE_HELPERS=y
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_BCM=y
+CONFIG_ARCH_BCM2835=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
+CONFIG_ARCH_MMAP_RND_BITS=16
+CONFIG_ARCH_MMAP_RND_BITS_MAX=16
+CONFIG_ARCH_MMAP_RND_BITS_MIN=8
+CONFIG_ARCH_MULTIPLATFORM=y
+CONFIG_ARCH_MULTI_V6_V7=y
+CONFIG_ARCH_MULTI_V7=y
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX=y
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX_DEFAULT=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARM=y
+CONFIG_ARM_CPU_SUSPEND=y
+# CONFIG_ARM_DEBUG_WX is not set
+CONFIG_ARM_HAS_GROUP_RELOCS=y
+CONFIG_ARM_L1_CACHE_SHIFT=6
+CONFIG_ARM_L1_CACHE_SHIFT_6=y
+CONFIG_ARM_LPAE=y
+# CONFIG_ARM_MHU_V2 is not set
+CONFIG_ARM_PAN=y
+CONFIG_ARM_PATCH_IDIV=y
+CONFIG_ARM_PATCH_PHYS_VIRT=y
+CONFIG_ARM_RASPBERRYPI_CPUFREQ=y
+CONFIG_ARM_THUMB=y
+CONFIG_ARM_TIMER_SP804=y
+CONFIG_ARM_UNWIND=y
+CONFIG_ARM_VIRT_EXT=y
+CONFIG_ASSOCIATIVE_ARRAY=y
+CONFIG_AUTO_ZRELADDR=y
+# CONFIG_BATTERY_MAX1720X is not set
+CONFIG_BCM2708_VCMEM=y
+CONFIG_BCM2711_THERMAL=y
+CONFIG_BCM2835_MBOX=y
+CONFIG_BCM2835_POWER=y
+# CONFIG_BCM2835_SMI is not set
+CONFIG_BCM2835_THERMAL=y
+CONFIG_BCM2835_TIMER=y
+CONFIG_BCM2835_VCHIQ=y
+# CONFIG_BCM2835_VCHIQ_MMAL is not set
+CONFIG_BCM2835_WDT=y
+CONFIG_BCM7XXX_PHY=y
+CONFIG_BCMGENET=y
+CONFIG_BCM_NET_PHYLIB=y
+CONFIG_BCM_VCIO=y
+# CONFIG_BCM_VC_SM_CMA is not set
+CONFIG_BCM_VIDEOCORE=y
+CONFIG_BINFMT_FLAT_ARGVP_ENVP_ON_STACK=y
+# CONFIG_BLK_DEV_INITRD is not set
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_PM=y
+CONFIG_BOUNCE=y
+CONFIG_BRCMSTB_L2_IRQ=y
+CONFIG_BRCM_CHAR_DRIVERS=y
+CONFIG_BROADCOM_PHY=y
+CONFIG_BUFFER_HEAD=y
+# CONFIG_CACHE_L2X0 is not set
+CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
+CONFIG_CLKSRC_MMIO=y
+CONFIG_CLK_BCM2711_DVP=y
+CONFIG_CLK_BCM2835=y
+CONFIG_CLK_RASPBERRYPI=y
+CONFIG_CMA=y
+CONFIG_CMA_ALIGNMENT=8
+CONFIG_CMA_AREAS=7
+# CONFIG_CMA_DEBUGFS is not set
+CONFIG_CMA_SIZE_MBYTES=5
+# CONFIG_CMA_SIZE_SEL_MAX is not set
+CONFIG_CMA_SIZE_SEL_MBYTES=y
+# CONFIG_CMA_SIZE_SEL_MIN is not set
+# CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set
+# CONFIG_CMA_SYSFS is not set
+# CONFIG_COMMON_CLK_RP1 is not set
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONFIGFS_FS=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_CONTIG_ALLOC=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_CPUFREQ_DT_PLATDEV=y
+CONFIG_CPU_32v6K=y
+CONFIG_CPU_32v7=y
+CONFIG_CPU_ABRT_EV7=y
+# CONFIG_CPU_BIG_ENDIAN is not set
+CONFIG_CPU_CACHE_V7=y
+CONFIG_CPU_CACHE_VIPT=y
+CONFIG_CPU_COPY_V6=y
+CONFIG_CPU_CP15=y
+CONFIG_CPU_CP15_MMU=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_GOV_ATTR_SET=y
+CONFIG_CPU_FREQ_GOV_COMMON=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_HAS_ASID=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_LADDER=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_PABRT_V7=y
+CONFIG_CPU_PM=y
+CONFIG_CPU_SPECTRE=y
+CONFIG_CPU_THUMB_CAPABLE=y
+CONFIG_CPU_TLB_V7=y
+CONFIG_CPU_TTBR0_PAN=y
+CONFIG_CPU_V7=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_CRC32=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_CTS=y
+CONFIG_CRYPTO_DRBG=y
+CONFIG_CRYPTO_DRBG_HMAC=y
+CONFIG_CRYPTO_DRBG_MENU=y
+CONFIG_CRYPTO_GENIV=y
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_JITTERENTROPY=y
+CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKS=64
+CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE=32
+CONFIG_CRYPTO_JITTERENTROPY_OSR=1
+CONFIG_CRYPTO_LIB_SHA256=y
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_RNG_DEFAULT=y
+CONFIG_CRYPTO_SEQIV=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA3=y
+CONFIG_CRYPTO_SHA512=y
+CONFIG_CRYPTO_XTS=y
+CONFIG_CURRENT_POINTER_IN_TPIDRURO=y
+CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_LL_INCLUDE="mach/debug-macro.S"
+CONFIG_DMABUF_HEAPS=y
+CONFIG_DMABUF_HEAPS_CMA=y
+CONFIG_DMABUF_HEAPS_SYSTEM=y
+CONFIG_DMADEVICES=y
+CONFIG_DMA_BCM2708=y
+CONFIG_DMA_BCM2835=y
+CONFIG_DMA_CMA=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_OF=y
+CONFIG_DMA_OPS_HELPERS=y
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_DMA_VIRTUAL_CHANNELS=y
+CONFIG_DNOTIFY=y
+# CONFIG_DP83TG720_PHY is not set
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_EDAC_ATOMIC_SCRUB=y
+CONFIG_EXT4_FS=y
+CONFIG_EXTCON=y
+CONFIG_F2FS_FS=y
+CONFIG_FB=y
+CONFIG_FB_BCM2708=y
+CONFIG_FB_CFB_COPYAREA=y
+CONFIG_FB_CFB_FILLRECT=y
+CONFIG_FB_CFB_IMAGEBLIT=y
+CONFIG_FB_CORE=y
+CONFIG_FB_DEVICE=y
+CONFIG_FB_IOMEM_FOPS=y
+CONFIG_FB_IOMEM_HELPERS=y
+# CONFIG_FB_RPISENSE is not set
+CONFIG_FB_SIMPLE=y
+CONFIG_FIQ=y
+CONFIG_FIXED_PHY=y
+CONFIG_FONT_8x16=y
+CONFIG_FONT_8x8=y
+CONFIG_FONT_SUPPORT=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+# CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY is not set
+CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
+CONFIG_FREEZER=y
+CONFIG_FS_ENCRYPTION=y
+CONFIG_FS_ENCRYPTION_ALGS=y
+CONFIG_FS_MBCACHE=y
+# CONFIG_FUEL_GAUGE_MM8013 is not set
+CONFIG_FUNCTION_ALIGNMENT=0
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_CACHE=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_MIGRATION=y
+CONFIG_GENERIC_IRQ_MULTI_HANDLER=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_VDSO_32=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_BCM_VIRT=y
+# CONFIG_GPIO_PWM is not set
+CONFIG_GPIO_RASPBERRYPI_EXP=y
+# CONFIG_HARDEN_BRANCH_HISTORY is not set
+# CONFIG_HARDEN_BRANCH_PREDICTOR is not set
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HAVE_SMP=y
+CONFIG_HIGHMEM=y
+CONFIG_HIGHPTE=y
+CONFIG_HOTPLUG_CORE_SYNC=y
+CONFIG_HOTPLUG_CORE_SYNC_DEAD=y
+CONFIG_HOTPLUG_CPU=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_BCM2835=y
+CONFIG_HW_RANDOM_IPROC_RNG200=y
+CONFIG_HZ_FIXED=0
+# CONFIG_HZ_PERIODIC is not set
+CONFIG_I2C=y
+# CONFIG_I2C_BCM2708 is not set
+CONFIG_I2C_BOARDINFO=y
+# CONFIG_I2C_DESIGNWARE_CORE is not set
+# CONFIG_IDPF is not set
+CONFIG_INPUT=y
+CONFIG_INPUT_MOUSEDEV=y
+# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+CONFIG_IRQSTACKS=y
+CONFIG_JBD2=y
+# CONFIG_KEBA_CP500 is not set
+CONFIG_KEYS=y
+CONFIG_KMAP_LOCAL=y
+CONFIG_KMAP_LOCAL_NON_LINEAR_PTE_ARRAY=y
+CONFIG_LEDS_GPIO=y
+# CONFIG_LEDS_KTD202X is not set
+# CONFIG_LEDS_NCP5623 is not set
+CONFIG_LEDS_PWM=y
+CONFIG_LEDS_TRIGGER_ACTPWR=y
+CONFIG_LEDS_TRIGGER_INPUT=y
+# CONFIG_LEDS_TRIGGER_INPUT_EVENTS is not set
+CONFIG_LOGO=y
+CONFIG_LOGO_LINUX_CLUT224=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+CONFIG_MAC_PARTITION=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0x1f6
+CONFIG_MAILBOX=y
+# CONFIG_MAILBOX_TEST is not set
+CONFIG_MDIO_BCM_UNIMAC=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEDIA_CAMERA_SUPPORT=y
+CONFIG_MEDIA_CONTROLLER=y
+CONFIG_MEDIA_PLATFORM_DRIVERS=y
+CONFIG_MEDIA_PLATFORM_SUPPORT=y
+CONFIG_MEDIA_SUPPORT=y
+CONFIG_MEDIA_SUPPORT_FILTER=y
+CONFIG_MEMORY_ISOLATION=y
+# CONFIG_MFD_88PM886_PMIC is not set
+# CONFIG_MFD_ADP5585 is not set
+CONFIG_MFD_CORE=y
+# CONFIG_MFD_CS40L50_I2C is not set
+# CONFIG_MFD_RASPBERRYPI_POE_HAT is not set
+# CONFIG_MFD_ROHM_BD96801 is not set
+# CONFIG_MFD_RP1 is not set
+CONFIG_MFD_SYSCON=y
+CONFIG_MICROCHIP_PHY=y
+CONFIG_MIGHT_HAVE_CACHE_L2X0=y
+CONFIG_MMC=y
+# CONFIG_MMC_BCM2835 is not set
+CONFIG_MMC_BCM2835_DMA=y
+CONFIG_MMC_BCM2835_MMC=y
+CONFIG_MMC_BCM2835_PIO_DMA_BARRIER=2
+CONFIG_MMC_BCM2835_SDHOST=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_HSQ=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_IO_ACCESSORS=y
+CONFIG_MMC_SDHCI_IPROC=y
+# CONFIG_MMC_SDHCI_PCI is not set
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MODULES_USE_ELF_REL=y
+# CONFIG_MTD is not set
+CONFIG_NEED_SRCU_NMI_SAFE=y
+CONFIG_NEON=y
+CONFIG_NET_DEVMEM=y
+CONFIG_NET_PTP_CLASSIFY=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NLS=y
+CONFIG_NLS_ASCII=y
+CONFIG_NOP_USB_XCEIV=y
+CONFIG_NO_HZ=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NR_CPUS=4
+CONFIG_NVMEM=y
+CONFIG_NVMEM_LAYOUTS=y
+CONFIG_NVMEM_RASPBERRYPI_OTP=y
+CONFIG_OF_CONFIGFS=y
+CONFIG_OF_DYNAMIC=y
+CONFIG_OF_MDIO=y
+CONFIG_OF_OVERLAY=y
+CONFIG_OF_RESOLVE=y
+CONFIG_OLD_SIGACTION=y
+CONFIG_OLD_SIGSUSPEND3=y
+CONFIG_PAGE_OFFSET=0xC0000000
+CONFIG_PCI=y
+CONFIG_PCIEAER=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCIE_BRCMSTB=y
+CONFIG_PCIE_PME=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DOMAINS_GENERIC=y
+CONFIG_PCI_MSI=y
+# CONFIG_PCI_NPEM is not set
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=3
+CONFIG_PHYLIB=y
+CONFIG_PHYLIB_LEDS=y
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_AW9523 is not set
+# CONFIG_PINCTRL_BCM2712 is not set
+CONFIG_PINCTRL_BCM2835=y
+# CONFIG_PINCTRL_RP1 is not set
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_GENERIC_DOMAINS=y
+CONFIG_PM_GENERIC_DOMAINS_OF=y
+CONFIG_PM_GENERIC_DOMAINS_SLEEP=y
+CONFIG_PM_OPP=y
+CONFIG_PM_SLEEP=y
+CONFIG_PM_SLEEP_SMP=y
+CONFIG_PPS=y
+CONFIG_PRINTK_TIME=y
+CONFIG_PTP_1588_CLOCK=y
+# CONFIG_PTP_1588_CLOCK_FC3W is not set
+CONFIG_PWM=y
+CONFIG_PWM_BCM2835=y
+# CONFIG_PWM_GPIO is not set
+# CONFIG_PWM_RP1 is not set
+CONFIG_RAS=y
+CONFIG_RASPBERRYPI_FIRMWARE=y
+CONFIG_RASPBERRYPI_GPIOMEM=y
+CONFIG_RASPBERRYPI_POWER=y
+# CONFIG_RAVE_SP_CORE is not set
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_GPIO=y
+# CONFIG_REGULATOR_MAX77503 is not set
+# CONFIG_REGULATOR_NETLINK_EVENTS is not set
+CONFIG_RESET_CONTROLLER=y
+# CONFIG_RESET_GPIO is not set
+CONFIG_RESET_RASPBERRYPI=y
+CONFIG_RESET_SIMPLE=y
+# CONFIG_RPI_POE_POWER is not set
+# CONFIG_RPMB is not set
+# CONFIG_RTASE is not set
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+# CONFIG_SCSI_LOWLEVEL is not set
+# CONFIG_SCSI_PROC_FS is not set
+# CONFIG_SENSORS_CHIPCAP2 is not set
+# CONFIG_SENSORS_LTC2991 is not set
+# CONFIG_SENSORS_LTC4282 is not set
+# CONFIG_SENSORS_POWERZ is not set
+# CONFIG_SENSORS_PT5161L is not set
+# CONFIG_SENSORS_SPD5118 is not set
+CONFIG_SERIAL_8250_BCM2835AUX=y
+# CONFIG_SERIAL_8250_DMA is not set
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_NR_UARTS=1
+CONFIG_SERIAL_8250_RUNTIME_UARTS=0
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_DEV_BUS=y
+# CONFIG_SERIAL_DEV_CTRL_TTYPORT is not set
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SG_POOL=y
+CONFIG_SMP_ON_UP=y
+CONFIG_SMSC_PHY=y
+# CONFIG_STRIP_ASM_SYMS is not set
+CONFIG_SUSPEND=y
+CONFIG_SUSPEND_FREEZER=y
+CONFIG_SWPHY=y
+CONFIG_SWP_EMULATE=y
+CONFIG_SYS_SUPPORTS_APM_EMULATION=y
+# CONFIG_TEHUTI_TN40 is not set
+# CONFIG_TEXTSEARCH is not set
+CONFIG_THERMAL=y
+# CONFIG_THERMAL_CORE_TESTING is not set
+# CONFIG_THERMAL_DEBUGFS is not set
+CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
+CONFIG_THERMAL_GOV_STEP_WISE=y
+CONFIG_THERMAL_OF=y
+# CONFIG_UCLAMP_TASK is not set
+CONFIG_UEVENT_HELPER_PATH=""
+# CONFIG_UID16 is not set
+CONFIG_UNCOMPRESS_INCLUDE="debug/uncompress.h"
+CONFIG_UNWINDER_ARM=y
+CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+CONFIG_USB_COMMON=y
+CONFIG_USB_DEFAULT_AUTHORIZATION_MODE=1
+CONFIG_USB_DWCOTG=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_LAN78XX=y
+CONFIG_USB_NET_DRIVERS=y
+CONFIG_USB_NET_SMSC95XX=y
+# CONFIG_USB_ONBOARD_DEV is not set
+CONFIG_USB_PCI=y
+# CONFIG_USB_PCI_AMD is not set
+CONFIG_USB_PHY=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USB_UAS=y
+# CONFIG_USB_UHCI_HCD is not set
+CONFIG_USB_USBNET=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_PCI=y
+CONFIG_USB_XHCI_PLATFORM=y
+CONFIG_USE_OF=y
+CONFIG_VCHIQ_CDEV=y
+CONFIG_VFP=y
+CONFIG_VFPv3=y
+CONFIG_VIDEO=y
+# CONFIG_VIDEO_AD5398 is not set
+# CONFIG_VIDEO_BCM2835_UNICAM is not set
+# CONFIG_VIDEO_BCM2835_UNICAM_LEGACY is not set
+# CONFIG_VIDEO_BU64754 is not set
+# CONFIG_VIDEO_CODEC_BCM2835 is not set
+CONFIG_VIDEO_DEV=y
+# CONFIG_VIDEO_IRS1125 is not set
+# CONFIG_VIDEO_ISP_BCM2835 is not set
+# CONFIG_VIDEO_MAX96714 is not set
+# CONFIG_VIDEO_MAX96717 is not set
+# CONFIG_VIDEO_RP1_CFE is not set
+# CONFIG_VIDEO_THP7312 is not set
+CONFIG_VIDEO_V4L2_I2C=y
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+CONFIG_VT_CONSOLE_SLEEP=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_XZ_DEC_ARM=y
+CONFIG_ZBOOT_ROM_BSS=0
+CONFIG_ZBOOT_ROM_TEXT=0
diff --git a/6.12/target/linux/bcm27xx/bcm2710/config-6.12 b/6.12/target/linux/bcm27xx/bcm2710/config-6.12
new file mode 100644
index 00000000..4f9ae5c7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/bcm2710/config-6.12
@@ -0,0 +1,380 @@
+# CONFIG_AIO is not set
+# CONFIG_AMD_QDMA is not set
+CONFIG_APERTURE_HELPERS=y
+CONFIG_ARCH_BCM=y
+CONFIG_ARCH_BCM2835=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARM64_ERRATUM_819472=y
+CONFIG_ARM64_ERRATUM_824069=y
+CONFIG_ARM64_ERRATUM_826319=y
+CONFIG_ARM64_ERRATUM_827319=y
+CONFIG_ARM64_ERRATUM_832075=y
+CONFIG_ARM64_ERRATUM_843419=y
+CONFIG_ARM64_HW_AFDBM=y
+CONFIG_ARM64_PTR_AUTH=y
+CONFIG_ARM64_PTR_AUTH_KERNEL=y
+CONFIG_ARM64_SVE=y
+CONFIG_ARM64_WORKAROUND_CLEAN_CACHE=y
+CONFIG_ARM_ARCH_TIMER_OOL_WORKAROUND=y
+CONFIG_ARM_GIC_V2M=y
+# CONFIG_ARM_MHU_V2 is not set
+# CONFIG_ARM_MHU_V3 is not set
+CONFIG_ARM_RASPBERRYPI_CPUFREQ=y
+CONFIG_ARM_TIMER_SP804=y
+CONFIG_ASSOCIATIVE_ARRAY=y
+# CONFIG_BATTERY_MAX1720X is not set
+CONFIG_BCM2708_VCMEM=y
+# CONFIG_BCM2711_THERMAL is not set
+CONFIG_BCM2835_MBOX=y
+CONFIG_BCM2835_POWER=y
+# CONFIG_BCM2835_SMI is not set
+CONFIG_BCM2835_THERMAL=y
+CONFIG_BCM2835_VCHIQ=y
+# CONFIG_BCM2835_VCHIQ_MMAL is not set
+CONFIG_BCM2835_WDT=y
+CONFIG_BCM_VCIO=y
+# CONFIG_BCM_VC_SM_CMA is not set
+CONFIG_BCM_VIDEOCORE=y
+# CONFIG_BLK_DEV_INITRD is not set
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_PM=y
+CONFIG_BRCMSTB_L2_IRQ=y
+CONFIG_BRCM_CHAR_DRIVERS=y
+CONFIG_BUFFER_HEAD=y
+CONFIG_CAVIUM_ERRATUM_22375=y
+CONFIG_CAVIUM_ERRATUM_23154=y
+CONFIG_CAVIUM_ERRATUM_27456=y
+CONFIG_CLKSRC_MMIO=y
+CONFIG_CLK_BCM2711_DVP=y
+CONFIG_CLK_BCM2835=y
+CONFIG_CLK_RASPBERRYPI=y
+CONFIG_CMA=y
+CONFIG_CMA_ALIGNMENT=8
+CONFIG_CMA_AREAS=7
+# CONFIG_CMA_DEBUGFS is not set
+CONFIG_CMA_SIZE_MBYTES=5
+# CONFIG_CMA_SIZE_SEL_MAX is not set
+CONFIG_CMA_SIZE_SEL_MBYTES=y
+# CONFIG_CMA_SIZE_SEL_MIN is not set
+# CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set
+# CONFIG_CMA_SYSFS is not set
+# CONFIG_COMMON_CLK_RP1 is not set
+CONFIG_COMMON_CLK_XGENE=y
+CONFIG_CONFIGFS_FS=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_CONTIG_ALLOC=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_CPUFREQ_DT_PLATDEV=y
+# CONFIG_CPU_BIG_ENDIAN is not set
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_GOV_ATTR_SET=y
+CONFIG_CPU_FREQ_GOV_COMMON=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_LADDER=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_PM=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_AES_ARM64=y
+CONFIG_CRYPTO_AES_ARM64_BS=y
+CONFIG_CRYPTO_AES_ARM64_NEON_BLK=y
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_CRC32=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_CRYPTD=y
+CONFIG_CRYPTO_CTS=y
+CONFIG_CRYPTO_DRBG=y
+CONFIG_CRYPTO_DRBG_HMAC=y
+CONFIG_CRYPTO_DRBG_MENU=y
+CONFIG_CRYPTO_GENIV=y
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_JITTERENTROPY=y
+CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKS=64
+CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE=32
+CONFIG_CRYPTO_JITTERENTROPY_OSR=1
+CONFIG_CRYPTO_LIB_SHA256=y
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_RNG_DEFAULT=y
+CONFIG_CRYPTO_SEQIV=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA256_ARM64=y
+CONFIG_CRYPTO_SHA3=y
+CONFIG_CRYPTO_SHA512=y
+CONFIG_CRYPTO_SHA512_ARM64=y
+CONFIG_CRYPTO_XTS=y
+CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DMABUF_HEAPS=y
+CONFIG_DMABUF_HEAPS_CMA=y
+CONFIG_DMABUF_HEAPS_SYSTEM=y
+CONFIG_DMADEVICES=y
+CONFIG_DMA_BCM2708=y
+CONFIG_DMA_BCM2835=y
+CONFIG_DMA_CMA=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_OF=y
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_DMA_VIRTUAL_CHANNELS=y
+CONFIG_DNOTIFY=y
+# CONFIG_DP83TG720_PHY is not set
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_EXT4_FS=y
+CONFIG_EXTCON=y
+CONFIG_F2FS_FS=y
+CONFIG_FB=y
+CONFIG_FB_BCM2708=y
+CONFIG_FB_CFB_COPYAREA=y
+CONFIG_FB_CFB_FILLRECT=y
+CONFIG_FB_CFB_IMAGEBLIT=y
+CONFIG_FB_CORE=y
+CONFIG_FB_DEVICE=y
+CONFIG_FB_IOMEM_FOPS=y
+CONFIG_FB_IOMEM_HELPERS=y
+# CONFIG_FB_RPISENSE is not set
+CONFIG_FB_SIMPLE=y
+CONFIG_FIXED_PHY=y
+CONFIG_FONT_8x16=y
+CONFIG_FONT_8x8=y
+CONFIG_FONT_SUPPORT=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+# CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY is not set
+CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
+CONFIG_FREEZER=y
+CONFIG_FSL_ERRATUM_A008585=y
+CONFIG_FS_ENCRYPTION=y
+CONFIG_FS_ENCRYPTION_ALGS=y
+CONFIG_FS_MBCACHE=y
+# CONFIG_FUEL_GAUGE_MM8013 is not set
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_CACHE=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_MIGRATION=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_BCM_VIRT=y
+# CONFIG_GPIO_PWM is not set
+CONFIG_GPIO_RASPBERRYPI_EXP=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HOTPLUG_CORE_SYNC=y
+CONFIG_HOTPLUG_CORE_SYNC_DEAD=y
+CONFIG_HOTPLUG_CPU=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_BCM2835=y
+# CONFIG_HZ_PERIODIC is not set
+CONFIG_I2C=y
+# CONFIG_I2C_BCM2708 is not set
+CONFIG_I2C_BOARDINFO=y
+# CONFIG_I2C_DESIGNWARE_CORE is not set
+# CONFIG_IDPF is not set
+CONFIG_INPUT=y
+CONFIG_INPUT_MOUSEDEV=y
+# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+CONFIG_JBD2=y
+# CONFIG_KEBA_CP500 is not set
+CONFIG_KEYS=y
+CONFIG_LEDS_GPIO=y
+# CONFIG_LEDS_KTD202X is not set
+# CONFIG_LEDS_NCP5623 is not set
+CONFIG_LEDS_PWM=y
+CONFIG_LEDS_TRIGGER_ACTPWR=y
+CONFIG_LEDS_TRIGGER_INPUT=y
+# CONFIG_LEDS_TRIGGER_INPUT_EVENTS is not set
+CONFIG_LOGO=y
+CONFIG_LOGO_LINUX_CLUT224=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+CONFIG_MAC_PARTITION=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0x1f6
+CONFIG_MAILBOX=y
+# CONFIG_MAILBOX_TEST is not set
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEDIA_CAMERA_SUPPORT=y
+CONFIG_MEDIA_CONTROLLER=y
+CONFIG_MEDIA_PLATFORM_DRIVERS=y
+CONFIG_MEDIA_PLATFORM_SUPPORT=y
+CONFIG_MEDIA_SUPPORT=y
+CONFIG_MEDIA_SUPPORT_FILTER=y
+CONFIG_MEMORY_ISOLATION=y
+# CONFIG_MFD_88PM886_PMIC is not set
+# CONFIG_MFD_ADP5585 is not set
+CONFIG_MFD_CORE=y
+# CONFIG_MFD_CS40L50_I2C is not set
+# CONFIG_MFD_RASPBERRYPI_POE_HAT is not set
+# CONFIG_MFD_ROHM_BD96801 is not set
+# CONFIG_MFD_RP1 is not set
+CONFIG_MFD_SYSCON=y
+CONFIG_MICROCHIP_PHY=y
+# CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY is not set
+CONFIG_MMC=y
+# CONFIG_MMC_BCM2835 is not set
+CONFIG_MMC_BCM2835_DMA=y
+CONFIG_MMC_BCM2835_MMC=y
+CONFIG_MMC_BCM2835_PIO_DMA_BARRIER=2
+CONFIG_MMC_BCM2835_SDHOST=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_HSQ=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_IO_ACCESSORS=y
+CONFIG_MMC_SDHCI_IPROC=y
+# CONFIG_MMC_SDHCI_PCI is not set
+CONFIG_MMC_SDHCI_PLTFM=y
+# CONFIG_MTD is not set
+CONFIG_NET_DEVMEM=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NLS=y
+CONFIG_NLS_ASCII=y
+CONFIG_NOP_USB_XCEIV=y
+CONFIG_NO_HZ=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NR_CPUS=4
+CONFIG_NVMEM=y
+CONFIG_NVMEM_LAYOUTS=y
+CONFIG_NVMEM_RASPBERRYPI_OTP=y
+# CONFIG_OCTEON_EP_VF is not set
+CONFIG_OF_CONFIGFS=y
+CONFIG_OF_DYNAMIC=y
+CONFIG_OF_MDIO=y
+CONFIG_OF_OVERLAY=y
+CONFIG_OF_RESOLVE=y
+CONFIG_PCI=y
+# CONFIG_PCIE_BRCMSTB is not set
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DOMAINS_GENERIC=y
+CONFIG_PCI_MSI=y
+# CONFIG_PCI_NPEM is not set
+CONFIG_PHYLIB=y
+CONFIG_PHYLIB_LEDS=y
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_AW9523 is not set
+# CONFIG_PINCTRL_BCM2712 is not set
+CONFIG_PINCTRL_BCM2835=y
+# CONFIG_PINCTRL_RP1 is not set
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_GENERIC_DOMAINS=y
+CONFIG_PM_GENERIC_DOMAINS_OF=y
+CONFIG_PM_GENERIC_DOMAINS_SLEEP=y
+CONFIG_PM_OPP=y
+CONFIG_PM_SLEEP=y
+CONFIG_PM_SLEEP_SMP=y
+CONFIG_PRINTK_TIME=y
+CONFIG_PWM=y
+CONFIG_PWM_BCM2835=y
+# CONFIG_PWM_GPIO is not set
+# CONFIG_PWM_RP1 is not set
+CONFIG_RASPBERRYPI_FIRMWARE=y
+CONFIG_RASPBERRYPI_GPIOMEM=y
+CONFIG_RASPBERRYPI_POWER=y
+# CONFIG_RAVE_SP_CORE is not set
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_GPIO=y
+# CONFIG_REGULATOR_MAX77503 is not set
+# CONFIG_REGULATOR_NETLINK_EVENTS is not set
+CONFIG_RESET_CONTROLLER=y
+# CONFIG_RESET_GPIO is not set
+# CONFIG_RESET_RASPBERRYPI is not set
+CONFIG_RESET_SIMPLE=y
+# CONFIG_RPI_POE_POWER is not set
+# CONFIG_RPMB is not set
+# CONFIG_RTASE is not set
+CONFIG_RUSTC_SUPPORTS_ARM64=y
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+# CONFIG_SCSI_LOWLEVEL is not set
+# CONFIG_SCSI_PROC_FS is not set
+# CONFIG_SENSORS_CHIPCAP2 is not set
+# CONFIG_SENSORS_LTC2991 is not set
+# CONFIG_SENSORS_LTC4282 is not set
+# CONFIG_SENSORS_POWERZ is not set
+# CONFIG_SENSORS_PT5161L is not set
+# CONFIG_SENSORS_SPD5118 is not set
+CONFIG_SERIAL_8250_BCM2835AUX=y
+# CONFIG_SERIAL_8250_DMA is not set
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_NR_UARTS=1
+CONFIG_SERIAL_8250_RUNTIME_UARTS=0
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_DEV_BUS=y
+# CONFIG_SERIAL_DEV_CTRL_TTYPORT is not set
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SG_POOL=y
+CONFIG_SMSC_PHY=y
+# CONFIG_STRIP_ASM_SYMS is not set
+CONFIG_SUSPEND=y
+CONFIG_SUSPEND_FREEZER=y
+CONFIG_SWPHY=y
+# CONFIG_TEHUTI_TN40 is not set
+# CONFIG_TEXTSEARCH is not set
+CONFIG_THERMAL=y
+# CONFIG_THERMAL_CORE_TESTING is not set
+# CONFIG_THERMAL_DEBUGFS is not set
+CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
+CONFIG_THERMAL_GOV_STEP_WISE=y
+CONFIG_THERMAL_OF=y
+# CONFIG_UCLAMP_TASK is not set
+CONFIG_UEVENT_HELPER_PATH=""
+CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+CONFIG_USB_COMMON=y
+CONFIG_USB_DEFAULT_AUTHORIZATION_MODE=1
+CONFIG_USB_DWCOTG=y
+CONFIG_USB_LAN78XX=y
+CONFIG_USB_NET_DRIVERS=y
+CONFIG_USB_NET_SMSC95XX=y
+# CONFIG_USB_ONBOARD_DEV is not set
+CONFIG_USB_PHY=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USB_UAS=y
+CONFIG_USB_USBNET=y
+CONFIG_VCHIQ_CDEV=y
+CONFIG_VIDEO=y
+# CONFIG_VIDEO_AD5398 is not set
+# CONFIG_VIDEO_BCM2835_UNICAM is not set
+# CONFIG_VIDEO_BCM2835_UNICAM_LEGACY is not set
+# CONFIG_VIDEO_BU64754 is not set
+# CONFIG_VIDEO_CODEC_BCM2835 is not set
+CONFIG_VIDEO_DEV=y
+# CONFIG_VIDEO_IRS1125 is not set
+# CONFIG_VIDEO_ISP_BCM2835 is not set
+# CONFIG_VIDEO_MAX96714 is not set
+# CONFIG_VIDEO_MAX96717 is not set
+# CONFIG_VIDEO_RP1_CFE is not set
+# CONFIG_VIDEO_THP7312 is not set
+CONFIG_VIDEO_V4L2_I2C=y
+CONFIG_VMAP_STACK=y
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+CONFIG_VT_CONSOLE_SLEEP=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_XZ_DEC_ARM=y
diff --git a/6.12/target/linux/bcm27xx/bcm2711/config-6.12 b/6.12/target/linux/bcm27xx/bcm2711/config-6.12
new file mode 100644
index 00000000..ff1a170b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/bcm2711/config-6.12
@@ -0,0 +1,400 @@
+# CONFIG_AIO is not set
+# CONFIG_AMD_QDMA is not set
+CONFIG_APERTURE_HELPERS=y
+CONFIG_ARCH_BCM=y
+CONFIG_ARCH_BCM2835=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARM64_ERRATUM_1319367=y
+CONFIG_ARM64_HW_AFDBM=y
+CONFIG_ARM64_PTR_AUTH=y
+CONFIG_ARM64_PTR_AUTH_KERNEL=y
+CONFIG_ARM64_SVE=y
+CONFIG_ARM64_WORKAROUND_SPECULATIVE_AT=y
+CONFIG_ARM_ARCH_TIMER_OOL_WORKAROUND=y
+CONFIG_ARM_GIC_V2M=y
+# CONFIG_ARM_MHU_V2 is not set
+# CONFIG_ARM_MHU_V3 is not set
+CONFIG_ARM_RASPBERRYPI_CPUFREQ=y
+CONFIG_ARM_TIMER_SP804=y
+CONFIG_ASSOCIATIVE_ARRAY=y
+# CONFIG_BATTERY_MAX1720X is not set
+CONFIG_BCM2708_VCMEM=y
+CONFIG_BCM2711_THERMAL=y
+CONFIG_BCM2835_MBOX=y
+CONFIG_BCM2835_POWER=y
+# CONFIG_BCM2835_SMI is not set
+# CONFIG_BCM2835_THERMAL is not set
+CONFIG_BCM2835_VCHIQ=y
+# CONFIG_BCM2835_VCHIQ_MMAL is not set
+CONFIG_BCM2835_WDT=y
+CONFIG_BCM7XXX_PHY=y
+CONFIG_BCMGENET=y
+CONFIG_BCM_NET_PHYLIB=y
+CONFIG_BCM_VCIO=y
+# CONFIG_BCM_VC_SM_CMA is not set
+CONFIG_BCM_VIDEOCORE=y
+# CONFIG_BLK_DEV_INITRD is not set
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_PM=y
+CONFIG_BRCMSTB_L2_IRQ=y
+CONFIG_BRCM_CHAR_DRIVERS=y
+CONFIG_BROADCOM_PHY=y
+CONFIG_BUFFER_HEAD=y
+CONFIG_CAVIUM_ERRATUM_22375=y
+CONFIG_CAVIUM_ERRATUM_23154=y
+CONFIG_CAVIUM_ERRATUM_27456=y
+CONFIG_CLKSRC_MMIO=y
+CONFIG_CLK_BCM2711_DVP=y
+CONFIG_CLK_BCM2835=y
+CONFIG_CLK_RASPBERRYPI=y
+CONFIG_CMA=y
+CONFIG_CMA_ALIGNMENT=8
+CONFIG_CMA_AREAS=7
+# CONFIG_CMA_DEBUGFS is not set
+CONFIG_CMA_SIZE_MBYTES=5
+# CONFIG_CMA_SIZE_SEL_MAX is not set
+CONFIG_CMA_SIZE_SEL_MBYTES=y
+# CONFIG_CMA_SIZE_SEL_MIN is not set
+# CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set
+# CONFIG_CMA_SYSFS is not set
+# CONFIG_COMMON_CLK_RP1 is not set
+CONFIG_COMMON_CLK_XGENE=y
+CONFIG_CONFIGFS_FS=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_CONTIG_ALLOC=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_CPUFREQ_DT_PLATDEV=y
+# CONFIG_CPU_BIG_ENDIAN is not set
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_GOV_ATTR_SET=y
+CONFIG_CPU_FREQ_GOV_COMMON=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_LADDER=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_PM=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_AES_ARM64=y
+CONFIG_CRYPTO_AES_ARM64_BS=y
+CONFIG_CRYPTO_AES_ARM64_NEON_BLK=y
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_CRC32=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_CRYPTD=y
+CONFIG_CRYPTO_CTS=y
+CONFIG_CRYPTO_DRBG=y
+CONFIG_CRYPTO_DRBG_HMAC=y
+CONFIG_CRYPTO_DRBG_MENU=y
+CONFIG_CRYPTO_GENIV=y
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_JITTERENTROPY=y
+CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKS=64
+CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE=32
+CONFIG_CRYPTO_JITTERENTROPY_OSR=1
+CONFIG_CRYPTO_LIB_SHA256=y
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_RNG_DEFAULT=y
+CONFIG_CRYPTO_SEQIV=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA256_ARM64=y
+CONFIG_CRYPTO_SHA3=y
+CONFIG_CRYPTO_SHA512=y
+CONFIG_CRYPTO_SHA512_ARM64=y
+CONFIG_CRYPTO_XTS=y
+CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DMABUF_HEAPS=y
+CONFIG_DMABUF_HEAPS_CMA=y
+CONFIG_DMABUF_HEAPS_SYSTEM=y
+CONFIG_DMADEVICES=y
+CONFIG_DMA_BCM2708=y
+CONFIG_DMA_BCM2835=y
+CONFIG_DMA_CMA=y
+CONFIG_DMA_ENGINE=y
+# CONFIG_DMA_NUMA_CMA is not set
+CONFIG_DMA_OF=y
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_DMA_VIRTUAL_CHANNELS=y
+CONFIG_DNOTIFY=y
+# CONFIG_DP83TG720_PHY is not set
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_EXT4_FS=y
+CONFIG_EXTCON=y
+CONFIG_F2FS_FS=y
+CONFIG_FB=y
+CONFIG_FB_BCM2708=y
+CONFIG_FB_CFB_COPYAREA=y
+CONFIG_FB_CFB_FILLRECT=y
+CONFIG_FB_CFB_IMAGEBLIT=y
+CONFIG_FB_CORE=y
+CONFIG_FB_DEVICE=y
+CONFIG_FB_IOMEM_FOPS=y
+CONFIG_FB_IOMEM_HELPERS=y
+# CONFIG_FB_RPISENSE is not set
+CONFIG_FB_SIMPLE=y
+CONFIG_FIXED_PHY=y
+CONFIG_FONT_8x16=y
+CONFIG_FONT_8x8=y
+CONFIG_FONT_SUPPORT=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+# CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY is not set
+CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
+CONFIG_FREEZER=y
+CONFIG_FSL_ERRATUM_A008585=y
+CONFIG_FS_ENCRYPTION=y
+CONFIG_FS_ENCRYPTION_ALGS=y
+CONFIG_FS_MBCACHE=y
+# CONFIG_FUEL_GAUGE_MM8013 is not set
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_CACHE=y
+CONFIG_GENERIC_ARCH_NUMA=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_MIGRATION=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_BCM_VIRT=y
+# CONFIG_GPIO_PWM is not set
+CONFIG_GPIO_RASPBERRYPI_EXP=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HOTPLUG_CORE_SYNC=y
+CONFIG_HOTPLUG_CORE_SYNC_DEAD=y
+CONFIG_HOTPLUG_CPU=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_IPROC_RNG200=y
+# CONFIG_HZ_PERIODIC is not set
+CONFIG_I2C=y
+# CONFIG_I2C_BCM2708 is not set
+CONFIG_I2C_BOARDINFO=y
+# CONFIG_I2C_DESIGNWARE_CORE is not set
+# CONFIG_IDPF is not set
+CONFIG_INPUT=y
+CONFIG_INPUT_MOUSEDEV=y
+# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+CONFIG_JBD2=y
+# CONFIG_KEBA_CP500 is not set
+CONFIG_KEYS=y
+CONFIG_LEDS_GPIO=y
+# CONFIG_LEDS_KTD202X is not set
+# CONFIG_LEDS_NCP5623 is not set
+CONFIG_LEDS_PWM=y
+CONFIG_LEDS_TRIGGER_ACTPWR=y
+CONFIG_LEDS_TRIGGER_INPUT=y
+# CONFIG_LEDS_TRIGGER_INPUT_EVENTS is not set
+CONFIG_LOGO=y
+CONFIG_LOGO_LINUX_CLUT224=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+CONFIG_MAC_PARTITION=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0x1f6
+CONFIG_MAILBOX=y
+# CONFIG_MAILBOX_TEST is not set
+CONFIG_MDIO_BCM_UNIMAC=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEDIA_CAMERA_SUPPORT=y
+CONFIG_MEDIA_CONTROLLER=y
+CONFIG_MEDIA_PLATFORM_DRIVERS=y
+CONFIG_MEDIA_PLATFORM_SUPPORT=y
+CONFIG_MEDIA_SUPPORT=y
+CONFIG_MEDIA_SUPPORT_FILTER=y
+CONFIG_MEMORY_ISOLATION=y
+# CONFIG_MFD_88PM886_PMIC is not set
+# CONFIG_MFD_ADP5585 is not set
+CONFIG_MFD_CORE=y
+# CONFIG_MFD_CS40L50_I2C is not set
+# CONFIG_MFD_RASPBERRYPI_POE_HAT is not set
+# CONFIG_MFD_ROHM_BD96801 is not set
+# CONFIG_MFD_RP1 is not set
+CONFIG_MFD_SYSCON=y
+CONFIG_MMC=y
+# CONFIG_MMC_BCM2835 is not set
+CONFIG_MMC_BCM2835_DMA=y
+CONFIG_MMC_BCM2835_MMC=y
+CONFIG_MMC_BCM2835_PIO_DMA_BARRIER=2
+CONFIG_MMC_BCM2835_SDHOST=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_HSQ=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_IO_ACCESSORS=y
+CONFIG_MMC_SDHCI_IPROC=y
+# CONFIG_MMC_SDHCI_PCI is not set
+CONFIG_MMC_SDHCI_PLTFM=y
+# CONFIG_MTD is not set
+CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y
+CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK=y
+CONFIG_NET_DEVMEM=y
+CONFIG_NET_PTP_CLASSIFY=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NLS=y
+CONFIG_NLS_ASCII=y
+CONFIG_NODES_SHIFT=4
+CONFIG_NOP_USB_XCEIV=y
+CONFIG_NO_HZ=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NR_CPUS=4
+CONFIG_NUMA=y
+# CONFIG_NUMA_BALANCING is not set
+# CONFIG_NUMA_EMU is not set
+CONFIG_NUMA_MEMBLKS=y
+CONFIG_NVMEM=y
+CONFIG_NVMEM_LAYOUTS=y
+CONFIG_NVMEM_RASPBERRYPI_OTP=y
+# CONFIG_OCTEON_EP_VF is not set
+CONFIG_OF_CONFIGFS=y
+CONFIG_OF_DYNAMIC=y
+CONFIG_OF_MDIO=y
+CONFIG_OF_NUMA=y
+CONFIG_OF_OVERLAY=y
+CONFIG_OF_RESOLVE=y
+CONFIG_PCI=y
+CONFIG_PCIEAER=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCIE_BRCMSTB=y
+CONFIG_PCIE_PME=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DOMAINS_GENERIC=y
+CONFIG_PCI_MSI=y
+# CONFIG_PCI_NPEM is not set
+CONFIG_PHYLIB=y
+CONFIG_PHYLIB_LEDS=y
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_AW9523 is not set
+# CONFIG_PINCTRL_BCM2712 is not set
+CONFIG_PINCTRL_BCM2835=y
+# CONFIG_PINCTRL_RP1 is not set
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_GENERIC_DOMAINS=y
+CONFIG_PM_GENERIC_DOMAINS_OF=y
+CONFIG_PM_GENERIC_DOMAINS_SLEEP=y
+CONFIG_PM_OPP=y
+CONFIG_PM_SLEEP=y
+CONFIG_PM_SLEEP_SMP=y
+CONFIG_PPS=y
+CONFIG_PRINTK_TIME=y
+CONFIG_PTP_1588_CLOCK=y
+# CONFIG_PTP_1588_CLOCK_FC3W is not set
+CONFIG_PWM=y
+CONFIG_PWM_BCM2835=y
+# CONFIG_PWM_GPIO is not set
+# CONFIG_PWM_RP1 is not set
+CONFIG_RAS=y
+CONFIG_RASPBERRYPI_FIRMWARE=y
+CONFIG_RASPBERRYPI_GPIOMEM=y
+CONFIG_RASPBERRYPI_POWER=y
+# CONFIG_RAVE_SP_CORE is not set
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_GPIO=y
+# CONFIG_REGULATOR_MAX77503 is not set
+# CONFIG_REGULATOR_NETLINK_EVENTS is not set
+CONFIG_RESET_CONTROLLER=y
+# CONFIG_RESET_GPIO is not set
+CONFIG_RESET_RASPBERRYPI=y
+CONFIG_RESET_SIMPLE=y
+# CONFIG_RPI_POE_POWER is not set
+# CONFIG_RPMB is not set
+# CONFIG_RTASE is not set
+CONFIG_RUSTC_SUPPORTS_ARM64=y
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+# CONFIG_SCSI_LOWLEVEL is not set
+# CONFIG_SCSI_PROC_FS is not set
+# CONFIG_SENSORS_CHIPCAP2 is not set
+# CONFIG_SENSORS_LTC2991 is not set
+# CONFIG_SENSORS_LTC4282 is not set
+# CONFIG_SENSORS_POWERZ is not set
+# CONFIG_SENSORS_PT5161L is not set
+# CONFIG_SENSORS_SPD5118 is not set
+CONFIG_SERIAL_8250_BCM2835AUX=y
+# CONFIG_SERIAL_8250_DMA is not set
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_NR_UARTS=1
+CONFIG_SERIAL_8250_RUNTIME_UARTS=0
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_DEV_BUS=y
+# CONFIG_SERIAL_DEV_CTRL_TTYPORT is not set
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SG_POOL=y
+# CONFIG_STRIP_ASM_SYMS is not set
+CONFIG_SUSPEND=y
+CONFIG_SUSPEND_FREEZER=y
+CONFIG_SWPHY=y
+# CONFIG_TEHUTI_TN40 is not set
+# CONFIG_TEXTSEARCH is not set
+CONFIG_THERMAL=y
+# CONFIG_THERMAL_CORE_TESTING is not set
+# CONFIG_THERMAL_DEBUGFS is not set
+CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
+CONFIG_THERMAL_GOV_STEP_WISE=y
+CONFIG_THERMAL_OF=y
+# CONFIG_UCLAMP_TASK is not set
+CONFIG_UEVENT_HELPER_PATH=""
+CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+CONFIG_USB_COMMON=y
+CONFIG_USB_DEFAULT_AUTHORIZATION_MODE=1
+CONFIG_USB_DWCOTG=y
+CONFIG_USB_GADGET=y
+# CONFIG_USB_ONBOARD_DEV is not set
+CONFIG_USB_PCI=y
+# CONFIG_USB_PCI_AMD is not set
+CONFIG_USB_PHY=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USB_UAS=y
+# CONFIG_USB_UHCI_HCD is not set
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_PCI=y
+CONFIG_USB_XHCI_PLATFORM=y
+CONFIG_USE_PERCPU_NUMA_NODE_ID=y
+CONFIG_VCHIQ_CDEV=y
+CONFIG_VIDEO=y
+# CONFIG_VIDEO_AD5398 is not set
+# CONFIG_VIDEO_BCM2835_UNICAM is not set
+# CONFIG_VIDEO_BCM2835_UNICAM_LEGACY is not set
+# CONFIG_VIDEO_BU64754 is not set
+# CONFIG_VIDEO_CODEC_BCM2835 is not set
+CONFIG_VIDEO_DEV=y
+# CONFIG_VIDEO_IRS1125 is not set
+# CONFIG_VIDEO_ISP_BCM2835 is not set
+# CONFIG_VIDEO_MAX96714 is not set
+# CONFIG_VIDEO_MAX96717 is not set
+# CONFIG_VIDEO_RP1_CFE is not set
+# CONFIG_VIDEO_THP7312 is not set
+CONFIG_VIDEO_V4L2_I2C=y
+CONFIG_VMAP_STACK=y
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+CONFIG_VT_CONSOLE_SLEEP=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_XZ_DEC_ARM=y
diff --git a/6.12/target/linux/bcm27xx/bcm2712/config-6.12 b/6.12/target/linux/bcm27xx/bcm2712/config-6.12
new file mode 100644
index 00000000..61970fa7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/bcm2712/config-6.12
@@ -0,0 +1,529 @@
+# CONFIG_AIO is not set
+# CONFIG_AMD_QDMA is not set
+CONFIG_APERTURE_HELPERS=y
+CONFIG_ARCH_BCM=y
+CONFIG_ARCH_BCM2835=y
+CONFIG_ARCH_BRCMSTB=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARM64_ERRATUM_1165522=y
+CONFIG_ARM64_ERRATUM_1286807=y
+CONFIG_ARM64_ERRATUM_1463225=y
+CONFIG_ARM64_ERRATUM_3194386=y
+CONFIG_ARM64_HW_AFDBM=y
+CONFIG_ARM64_PTR_AUTH=y
+CONFIG_ARM64_PTR_AUTH_KERNEL=y
+CONFIG_ARM64_SVE=y
+CONFIG_ARM64_WORKAROUND_REPEAT_TLBI=y
+CONFIG_ARM64_WORKAROUND_SPECULATIVE_AT=y
+CONFIG_ARM_ARCH_TIMER_OOL_WORKAROUND=y
+CONFIG_ARM_BRCMSTB_AVS_CPUFREQ=y
+CONFIG_ARM_GIC_V2M=y
+# CONFIG_ARM_MHU_V2 is not set
+# CONFIG_ARM_MHU_V3 is not set
+# CONFIG_ARM_PL172_MPMC is not set
+CONFIG_ARM_RASPBERRYPI_CPUFREQ=y
+# CONFIG_ARM_SMMU is not set
+# CONFIG_ARM_SMMU_V3 is not set
+CONFIG_ARM_TIMER_SP804=y
+CONFIG_ASSOCIATIVE_ARRAY=y
+# CONFIG_BATTERY_MAX1720X is not set
+CONFIG_BCM2708_VCMEM=y
+CONFIG_BCM2711_THERMAL=y
+CONFIG_BCM2712_IOMMU=y
+CONFIG_BCM2712_MIP=y
+CONFIG_BCM2835_MBOX=y
+CONFIG_BCM2835_POWER=y
+CONFIG_BCM2835_SMI=y
+CONFIG_BCM2835_SMI_DEV=m
+CONFIG_BCM2835_THERMAL=y
+CONFIG_BCM2835_VCHIQ=y
+# CONFIG_BCM2835_VCHIQ_MMAL is not set
+CONFIG_BCM2835_WDT=y
+CONFIG_BCM7038_L1_IRQ=y
+CONFIG_BCM7120_L2_IRQ=y
+CONFIG_BCM7XXX_PHY=y
+CONFIG_BCMA=y
+CONFIG_BCMASP=y
+CONFIG_BCMA_BLOCKIO=y
+# CONFIG_BCMA_DEBUG is not set
+# CONFIG_BCMA_DRIVER_GMAC_CMN is not set
+CONFIG_BCMA_DRIVER_PCI=y
+CONFIG_BCMA_FALLBACK_SPROM=y
+CONFIG_BCMA_HOST_PCI=y
+CONFIG_BCMA_HOST_PCI_POSSIBLE=y
+# CONFIG_BCMA_HOST_SOC is not set
+CONFIG_BCMGENET=y
+CONFIG_BCM_NET_PHYLIB=y
+CONFIG_BCM_VCIO=y
+# CONFIG_BCM_VC_SM_CMA is not set
+CONFIG_BCM_VIDEOCORE=y
+# CONFIG_BLK_DEV_INITRD is not set
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_NVME=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_PM=y
+CONFIG_BRCMSTB_DPFE=y
+CONFIG_BRCMSTB_L2_IRQ=y
+CONFIG_BRCMSTB_MEMC=y
+# CONFIG_BRCMSTB_THERMAL is not set
+CONFIG_BRCM_CHAR_DRIVERS=y
+CONFIG_BRCM_USB_PINMAP=y
+CONFIG_BROADCOM_PHY=y
+CONFIG_BUFFER_HEAD=y
+CONFIG_CLKSRC_MMIO=y
+CONFIG_CLK_BCM2711_DVP=y
+CONFIG_CLK_BCM2835=y
+CONFIG_CLK_RASPBERRYPI=y
+CONFIG_CMA=y
+CONFIG_CMA_ALIGNMENT=8
+CONFIG_CMA_AREAS=7
+# CONFIG_CMA_DEBUGFS is not set
+CONFIG_CMA_SIZE_MBYTES=5
+# CONFIG_CMA_SIZE_SEL_MAX is not set
+CONFIG_CMA_SIZE_SEL_MBYTES=y
+# CONFIG_CMA_SIZE_SEL_MIN is not set
+# CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set
+# CONFIG_CMA_SYSFS is not set
+CONFIG_COMMON_CLK_RP1=y
+# CONFIG_COMMON_CLK_RP1_SDIO is not set
+CONFIG_COMMON_CLK_XGENE=y
+CONFIG_CONFIGFS_FS=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_CONTIG_ALLOC=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_CPUFREQ_DT_PLATDEV=y
+# CONFIG_CPU_BIG_ENDIAN is not set
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_GOV_ATTR_SET=y
+CONFIG_CPU_FREQ_GOV_COMMON=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_LADDER=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_PM=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_AES_ARM64=y
+CONFIG_CRYPTO_AES_ARM64_BS=y
+CONFIG_CRYPTO_AES_ARM64_CE=y
+CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
+CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
+CONFIG_CRYPTO_AES_ARM64_NEON_BLK=y
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_CRC32=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_CRYPTD=y
+CONFIG_CRYPTO_CTS=y
+CONFIG_CRYPTO_DRBG=y
+CONFIG_CRYPTO_DRBG_HMAC=y
+CONFIG_CRYPTO_DRBG_MENU=y
+CONFIG_CRYPTO_GENIV=y
+CONFIG_CRYPTO_GHASH_ARM64_CE=y
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_JITTERENTROPY=y
+CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKS=64
+CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE=32
+CONFIG_CRYPTO_JITTERENTROPY_OSR=1
+CONFIG_CRYPTO_LIB_SHA256=y
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_RNG_DEFAULT=y
+CONFIG_CRYPTO_SEQIV=y
+CONFIG_CRYPTO_SHA1=y
+CONFIG_CRYPTO_SHA1_ARM64_CE=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA256_ARM64=y
+CONFIG_CRYPTO_SHA2_ARM64_CE=y
+CONFIG_CRYPTO_SHA3=y
+CONFIG_CRYPTO_SHA3_ARM64=y
+CONFIG_CRYPTO_SHA512=y
+CONFIG_CRYPTO_SHA512_ARM64=y
+CONFIG_CRYPTO_SHA512_ARM64_CE=y
+CONFIG_CRYPTO_SM3=y
+CONFIG_CRYPTO_SM3_ARM64_CE=y
+CONFIG_CRYPTO_SM4=y
+CONFIG_CRYPTO_SM4_ARM64_CE=y
+CONFIG_CRYPTO_SM4_ARM64_CE_BLK=y
+CONFIG_CRYPTO_XTS=y
+CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DMABUF_HEAPS=y
+CONFIG_DMABUF_HEAPS_CMA=y
+CONFIG_DMABUF_HEAPS_SYSTEM=y
+CONFIG_DMADEVICES=y
+CONFIG_DMA_BCM2708=y
+CONFIG_DMA_BCM2835=y
+CONFIG_DMA_CMA=y
+CONFIG_DMA_ENGINE=y
+# CONFIG_DMA_NUMA_CMA is not set
+CONFIG_DMA_OF=y
+CONFIG_DMA_OPS_HELPERS=y
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_DMA_VIRTUAL_CHANNELS=y
+CONFIG_DNOTIFY=y
+# CONFIG_DP83TG720_PHY is not set
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_EXT4_FS=y
+CONFIG_EXTCON=y
+CONFIG_F2FS_FS=y
+CONFIG_FB=y
+CONFIG_FB_BCM2708=y
+CONFIG_FB_CFB_COPYAREA=y
+CONFIG_FB_CFB_FILLRECT=y
+CONFIG_FB_CFB_IMAGEBLIT=y
+CONFIG_FB_CORE=y
+CONFIG_FB_DEVICE=y
+CONFIG_FB_IOMEM_FOPS=y
+CONFIG_FB_IOMEM_HELPERS=y
+# CONFIG_FB_RPISENSE is not set
+CONFIG_FB_SIMPLE=y
+CONFIG_FIXED_PHY=y
+CONFIG_FONT_8x16=y
+CONFIG_FONT_8x8=y
+CONFIG_FONT_SUPPORT=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+# CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY is not set
+CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
+CONFIG_FREEZER=y
+CONFIG_FSL_ERRATUM_A008585=y
+CONFIG_FS_ENCRYPTION=y
+CONFIG_FS_ENCRYPTION_ALGS=y
+CONFIG_FS_MBCACHE=y
+# CONFIG_FUEL_GAUGE_MM8013 is not set
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_CACHE=y
+CONFIG_GENERIC_ARCH_NUMA=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_INJECTION=y
+CONFIG_GENERIC_IRQ_MIGRATION=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GLOB=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_BCM_VIRT=y
+CONFIG_GPIO_BRCMSTB=y
+CONFIG_GPIO_GENERIC=y
+# CONFIG_GPIO_PWM is not set
+CONFIG_GPIO_RASPBERRYPI_EXP=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HOTPLUG_CORE_SYNC=y
+CONFIG_HOTPLUG_CORE_SYNC_DEAD=y
+CONFIG_HOTPLUG_CPU=y
+CONFIG_HOTPLUG_PCI=y
+# CONFIG_HOTPLUG_PCI_CPCI is not set
+# CONFIG_HOTPLUG_PCI_PCIE is not set
+CONFIG_HOTPLUG_PCI_SHPC=y
+CONFIG_HWMON=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_IPROC_RNG200=y
+# CONFIG_HZ_PERIODIC is not set
+CONFIG_I2C=y
+CONFIG_I2C_ALGOBIT=y
+# CONFIG_I2C_BCM2708 is not set
+CONFIG_I2C_BCM2835=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_BRCMSTB=y
+CONFIG_I2C_DESIGNWARE_CORE=y
+CONFIG_I2C_DESIGNWARE_PLATFORM=y
+# CONFIG_IDPF is not set
+CONFIG_INPUT=y
+CONFIG_INPUT_MOUSEDEV=y
+# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+# CONFIG_IOMMUFD is not set
+CONFIG_IOMMU_API=y
+# CONFIG_IOMMU_DEBUGFS is not set
+# CONFIG_IOMMU_DEFAULT_DMA_LAZY is not set
+CONFIG_IOMMU_DEFAULT_DMA_STRICT=y
+# CONFIG_IOMMU_DEFAULT_PASSTHROUGH is not set
+CONFIG_IOMMU_DMA=y
+CONFIG_IOMMU_IOVA=y
+# CONFIG_IOMMU_IO_PGTABLE_ARMV7S is not set
+# CONFIG_IOMMU_IO_PGTABLE_DART is not set
+# CONFIG_IOMMU_IO_PGTABLE_LPAE is not set
+CONFIG_IOMMU_SUPPORT=y
+CONFIG_IRQ_MSI_IOMMU=y
+CONFIG_JBD2=y
+# CONFIG_KEBA_CP500 is not set
+CONFIG_KEYS=y
+CONFIG_LEDS_GPIO=y
+# CONFIG_LEDS_KTD202X is not set
+# CONFIG_LEDS_NCP5623 is not set
+CONFIG_LEDS_PWM=y
+CONFIG_LEDS_TRIGGER_ACTPWR=y
+CONFIG_LEDS_TRIGGER_INPUT=y
+# CONFIG_LEDS_TRIGGER_INPUT_EVENTS is not set
+CONFIG_LOGO=y
+CONFIG_LOGO_LINUX_CLUT224=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+CONFIG_MACB=y
+CONFIG_MACB_PCI=y
+CONFIG_MACB_USE_HWSTAMP=y
+CONFIG_MAC_PARTITION=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0x1f6
+CONFIG_MAILBOX=y
+# CONFIG_MAILBOX_TEST is not set
+# CONFIG_MBOX_RP1 is not set
+CONFIG_MDIO_BCM_UNIMAC=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MEDIA_CAMERA_SUPPORT=y
+CONFIG_MEDIA_CONTROLLER=y
+CONFIG_MEDIA_PLATFORM_DRIVERS=y
+CONFIG_MEDIA_PLATFORM_SUPPORT=y
+CONFIG_MEDIA_SUPPORT=y
+CONFIG_MEDIA_SUPPORT_FILTER=y
+CONFIG_MEMORY=y
+CONFIG_MEMORY_ISOLATION=y
+# CONFIG_MFD_88PM886_PMIC is not set
+# CONFIG_MFD_ADP5585 is not set
+CONFIG_MFD_CORE=y
+# CONFIG_MFD_CS40L50_I2C is not set
+# CONFIG_MFD_CS40L50_SPI is not set
+# CONFIG_MFD_RASPBERRYPI_POE_HAT is not set
+# CONFIG_MFD_ROHM_BD96801 is not set
+CONFIG_MFD_RP1=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MICROCHIP_PHY=y
+CONFIG_MMC=y
+# CONFIG_MMC_BCM2835 is not set
+CONFIG_MMC_BCM2835_DMA=y
+CONFIG_MMC_BCM2835_MMC=y
+CONFIG_MMC_BCM2835_PIO_DMA_BARRIER=2
+CONFIG_MMC_BCM2835_SDHOST=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_CQHCI=y
+CONFIG_MMC_HSQ=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_BRCMSTB=y
+CONFIG_MMC_SDHCI_IO_ACCESSORS=y
+CONFIG_MMC_SDHCI_IPROC=y
+CONFIG_MMC_SDHCI_OF_DWCMSHC=y
+# CONFIG_MMC_SDHCI_PCI is not set
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y
+CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK=y
+CONFIG_NEED_SG_DMA_FLAGS=y
+CONFIG_NET_DEVMEM=y
+CONFIG_NET_PTP_CLASSIFY=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NLS=y
+CONFIG_NLS_ASCII=y
+CONFIG_NODES_SHIFT=4
+CONFIG_NOP_USB_XCEIV=y
+CONFIG_NO_HZ=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NR_CPUS=4
+CONFIG_NUMA=y
+# CONFIG_NUMA_BALANCING is not set
+# CONFIG_NUMA_EMU is not set
+CONFIG_NUMA_MEMBLKS=y
+CONFIG_NVMEM=y
+CONFIG_NVMEM_LAYOUTS=y
+CONFIG_NVMEM_RASPBERRYPI_OTP=y
+CONFIG_NVME_CORE=y
+# CONFIG_NVME_HWMON is not set
+# CONFIG_NVME_MULTIPATH is not set
+# CONFIG_OCTEON_EP_VF is not set
+CONFIG_OF_CONFIGFS=y
+CONFIG_OF_DYNAMIC=y
+CONFIG_OF_IOMMU=y
+CONFIG_OF_MDIO=y
+CONFIG_OF_NUMA=y
+CONFIG_OF_OVERLAY=y
+CONFIG_OF_RESOLVE=y
+CONFIG_PCI=y
+CONFIG_PCIEAER=y
+CONFIG_PCIEAER_INJECT=y
+CONFIG_PCIEASPM=y
+# CONFIG_PCIEASPM_DEFAULT is not set
+# CONFIG_PCIEASPM_PERFORMANCE is not set
+CONFIG_PCIEASPM_POWERSAVE=y
+# CONFIG_PCIEASPM_POWER_SUPERSAVE is not set
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCIE_BRCMSTB=y
+CONFIG_PCIE_DPC=y
+CONFIG_PCIE_DW=y
+CONFIG_PCIE_DW_HOST=y
+CONFIG_PCIE_DW_PLAT=y
+CONFIG_PCIE_DW_PLAT_HOST=y
+CONFIG_PCIE_MICROCHIP_HOST=y
+CONFIG_PCIE_PLDA_HOST=y
+CONFIG_PCIE_PME=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DOMAINS_GENERIC=y
+CONFIG_PCI_ECAM=y
+CONFIG_PCI_HOST_COMMON=y
+CONFIG_PCI_HOST_GENERIC=y
+CONFIG_PCI_MSI=y
+# CONFIG_PCI_NPEM is not set
+CONFIG_PCI_STUB=y
+CONFIG_PHYLIB=y
+CONFIG_PHYLIB_LEDS=y
+CONFIG_PHYLINK=y
+# CONFIG_PHY_BRCM_SATA is not set
+CONFIG_PHY_BRCM_USB=y
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_AW9523 is not set
+CONFIG_PINCTRL_BCM2712=y
+CONFIG_PINCTRL_BCM2835=y
+CONFIG_PINCTRL_RP1=y
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_GENERIC_DOMAINS=y
+CONFIG_PM_GENERIC_DOMAINS_OF=y
+CONFIG_PM_GENERIC_DOMAINS_SLEEP=y
+CONFIG_PM_OPP=y
+CONFIG_PM_SLEEP=y
+CONFIG_PM_SLEEP_SMP=y
+CONFIG_POWER_RESET_GPIO=y
+CONFIG_PPS=y
+CONFIG_PRINTK_TIME=y
+CONFIG_PTP_1588_CLOCK=y
+# CONFIG_PTP_1588_CLOCK_FC3W is not set
+CONFIG_PWM=y
+CONFIG_PWM_BCM2835=y
+CONFIG_PWM_BRCMSTB=y
+# CONFIG_PWM_GPIO is not set
+CONFIG_PWM_RP1=y
+CONFIG_RAS=y
+CONFIG_RASPBERRYPI_FIRMWARE=y
+CONFIG_RASPBERRYPI_GPIOMEM=y
+CONFIG_RASPBERRYPI_POWER=y
+# CONFIG_RAVE_SP_CORE is not set
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_GPIO=y
+# CONFIG_REGULATOR_MAX77503 is not set
+# CONFIG_REGULATOR_NETLINK_EVENTS is not set
+# CONFIG_REGULATOR_RASPBERRYPI_TOUCHSCREEN_V2 is not set
+CONFIG_RESET_BRCMSTB=y
+CONFIG_RESET_BRCMSTB_RESCAL=y
+CONFIG_RESET_CONTROLLER=y
+# CONFIG_RESET_GPIO is not set
+CONFIG_RESET_RASPBERRYPI=y
+CONFIG_RESET_SIMPLE=y
+# CONFIG_RPI_POE_POWER is not set
+# CONFIG_RPMB is not set
+# CONFIG_RTASE is not set
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_DRV_BRCMSTB=y
+# CONFIG_RTC_DRV_MAX31335 is not set
+CONFIG_RTC_DRV_RPI=y
+# CONFIG_RTC_DRV_RX8111 is not set
+# CONFIG_RTC_DRV_SD2405AL is not set
+CONFIG_RTC_I2C_AND_SPI=y
+CONFIG_RUSTC_SUPPORTS_ARM64=y
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+# CONFIG_SCSI_LOWLEVEL is not set
+# CONFIG_SCSI_PROC_FS is not set
+# CONFIG_SENSORS_CHIPCAP2 is not set
+# CONFIG_SENSORS_LTC2991 is not set
+# CONFIG_SENSORS_LTC4282 is not set
+# CONFIG_SENSORS_POWERZ is not set
+# CONFIG_SENSORS_PT5161L is not set
+CONFIG_SENSORS_RASPBERRYPI_HWMON=y
+CONFIG_SENSORS_RP1_ADC=y
+# CONFIG_SENSORS_SPD5118 is not set
+CONFIG_SERIAL_8250_BCM2835AUX=y
+CONFIG_SERIAL_8250_BCM7271=y
+# CONFIG_SERIAL_8250_DMA is not set
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_NR_UARTS=1
+CONFIG_SERIAL_8250_RUNTIME_UARTS=0
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_DEV_BUS=y
+# CONFIG_SERIAL_DEV_CTRL_TTYPORT is not set
+CONFIG_SERIAL_OF_PLATFORM=y
+# CONFIG_SERIAL_RPI_FW is not set
+CONFIG_SG_POOL=y
+CONFIG_SMSC_PHY=y
+CONFIG_SOC_BRCMSTB=y
+CONFIG_SOC_BUS=y
+# CONFIG_STRIP_ASM_SYMS is not set
+CONFIG_SUSPEND=y
+CONFIG_SUSPEND_FREEZER=y
+CONFIG_SWPHY=y
+# CONFIG_TEHUTI_TN40 is not set
+# CONFIG_TEXTSEARCH is not set
+CONFIG_THERMAL=y
+# CONFIG_THERMAL_CORE_TESTING is not set
+# CONFIG_THERMAL_DEBUGFS is not set
+CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
+CONFIG_THERMAL_GOV_STEP_WISE=y
+CONFIG_THERMAL_OF=y
+# CONFIG_UCLAMP_TASK is not set
+CONFIG_UEVENT_HELPER_PATH=""
+CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+# CONFIG_USB_BRCMSTB is not set
+CONFIG_USB_COMMON=y
+CONFIG_USB_DEFAULT_AUTHORIZATION_MODE=1
+CONFIG_USB_DWC3=y
+# CONFIG_USB_DWC3_DUAL_ROLE is not set
+# CONFIG_USB_DWC3_GADGET is not set
+CONFIG_USB_DWC3_HOST=y
+CONFIG_USB_DWCOTG=y
+CONFIG_USB_GADGET=y
+# CONFIG_USB_HCD_BCMA is not set
+# CONFIG_USB_ONBOARD_DEV is not set
+CONFIG_USB_PCI=y
+# CONFIG_USB_PCI_AMD is not set
+CONFIG_USB_PHY=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USB_UAS=y
+# CONFIG_USB_UHCI_HCD is not set
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_PCI=y
+CONFIG_USB_XHCI_PLATFORM=y
+CONFIG_USE_PERCPU_NUMA_NODE_ID=y
+CONFIG_VCHIQ_CDEV=y
+CONFIG_VIDEO=y
+# CONFIG_VIDEO_AD5398 is not set
+# CONFIG_VIDEO_BCM2835_UNICAM is not set
+# CONFIG_VIDEO_BCM2835_UNICAM_LEGACY is not set
+# CONFIG_VIDEO_BU64754 is not set
+# CONFIG_VIDEO_CODEC_BCM2835 is not set
+CONFIG_VIDEO_DEV=y
+# CONFIG_VIDEO_IRS1125 is not set
+# CONFIG_VIDEO_ISP_BCM2835 is not set
+# CONFIG_VIDEO_MAX96714 is not set
+# CONFIG_VIDEO_MAX96717 is not set
+# CONFIG_VIDEO_MGB4 is not set
+# CONFIG_VIDEO_RASPBERRYPI_PISP_BE is not set
+# CONFIG_VIDEO_RP1_CFE is not set
+# CONFIG_VIDEO_THP7312 is not set
+CONFIG_VIDEO_V4L2_I2C=y
+CONFIG_VMAP_STACK=y
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+CONFIG_VT_CONSOLE_SLEEP=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_XZ_DEC_ARM=y
diff --git a/6.12/target/linux/bcm27xx/config-6.12 b/6.12/target/linux/bcm27xx/config-6.12
new file mode 100644
index 00000000..81e04c00
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/config-6.12
@@ -0,0 +1,259 @@
+CONFIG_64BIT=y
+# CONFIG_AF8133J is not set
+CONFIG_ARCH_BINFMT_ELF_EXTRA_PHDRS=y
+CONFIG_ARCH_CORRECT_STACKTRACE_ON_KRETPROBE=y
+CONFIG_ARCH_DEFAULT_KEXEC_IMAGE_VERIFY_SIG=y
+CONFIG_ARCH_DMA_ADDR_T_64BIT=y
+CONFIG_ARCH_FORCE_MAX_ORDER=10
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
+CONFIG_ARCH_MMAP_RND_BITS=18
+CONFIG_ARCH_MMAP_RND_BITS_MAX=18
+CONFIG_ARCH_MMAP_RND_BITS_MIN=18
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=11
+# CONFIG_ARCH_PENSANDO is not set
+CONFIG_ARCH_PKEY_BITS=3
+CONFIG_ARCH_PROC_KCORE_TEXT=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_STACKWALK=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARCH_USES_HIGH_VMA_FLAGS=y
+CONFIG_ARCH_WANTS_EXECMEM_LATE=y
+CONFIG_ARCH_WANTS_NO_INSTR=y
+CONFIG_ARCH_WANTS_THP_SWAP=y
+CONFIG_ARM64=y
+CONFIG_ARM64_4K_PAGES=y
+# CONFIG_ARM64_FORCE_52BIT is not set
+CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
+CONFIG_ARM64_LPA2=y
+CONFIG_ARM64_PA_BITS=52
+CONFIG_ARM64_PA_BITS_52=y
+CONFIG_ARM64_PLATFORM_DEVICES=y
+CONFIG_ARM64_POE=y
+CONFIG_ARM64_TAGGED_ADDR_ABI=y
+CONFIG_ARM64_VA_BITS=52
+# CONFIG_ARM64_VA_BITS_39 is not set
+CONFIG_ARM64_VA_BITS_52=y
+CONFIG_ARM_AMBA=y
+CONFIG_ARM_ARCH_TIMER=y
+CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
+CONFIG_ARM_GIC=y
+CONFIG_ARM_GIC_V3=y
+CONFIG_ARM_GIC_V3_ITS=y
+# CONFIG_ARM_NI is not set
+CONFIG_ARM_PSCI_FW=y
+CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y
+# CONFIG_BACKLIGHT_KTD2801 is not set
+# CONFIG_BACKLIGHT_LM3509 is not set
+# CONFIG_BACKLIGHT_MP3309C is not set
+# CONFIG_BACKLIGHT_RPI is not set
+# CONFIG_BASE_SMALL is not set
+# CONFIG_BCACHEFS_FS is not set
+# CONFIG_BCM2712_MIP is not set
+# CONFIG_BRCM_CHAR_DRIVERS is not set
+# CONFIG_BT_HCIUART_AML is not set
+CONFIG_BUILTIN_RETURN_ADDRESS_STRIPS_PAC=y
+CONFIG_CC_HAVE_SHADOW_CALL_STACK=y
+CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
+# CONFIG_COMPAT_32BIT_TIME is not set
+# CONFIG_COMPRESSED_INSTALL is not set
+CONFIG_CONTEXT_TRACKING=y
+CONFIG_CONTEXT_TRACKING_IDLE=y
+CONFIG_CPUMASK_OFFSTACK=y
+# CONFIG_CPUSETS_V1 is not set
+CONFIG_CPU_BIG_ENDIAN=y
+CONFIG_CPU_MITIGATIONS=y
+CONFIG_CPU_RMAP=y
+CONFIG_CRYPTO_ECB=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_GF128MUL=y
+CONFIG_CRYPTO_LIB_SHA1=y
+CONFIG_CRYPTO_LIB_UTILS=y
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_DEBUG_INFO=y
+CONFIG_DMA_DIRECT_REMAP=y
+CONFIG_DMA_NEED_SYNC=y
+# CONFIG_DRM_DISPLAY_DP_AUX_CEC is not set
+# CONFIG_DRM_DISPLAY_DP_AUX_CHARDEV is not set
+# CONFIG_DRM_PANEL_BOE_TH101MB31UIG002_28A is not set
+# CONFIG_DRM_PANEL_BOE_TV101WUM_LL2 is not set
+# CONFIG_DRM_PANEL_HIMAX_HX83102 is not set
+# CONFIG_DRM_PANEL_HIMAX_HX83112A is not set
+# CONFIG_DRM_PANEL_ILITEK_ILI9805 is not set
+# CONFIG_DRM_PANEL_ILITEK_ILI9806E is not set
+# CONFIG_DRM_PANEL_ILITEK_ILI9882T is not set
+# CONFIG_DRM_PANEL_JDI_LPM102A188A is not set
+# CONFIG_DRM_PANEL_LG_SW43408 is not set
+# CONFIG_DRM_PANEL_LINCOLNTECH_LCD197 is not set
+# CONFIG_DRM_PANEL_NOVATEK_NT36672E is not set
+# CONFIG_DRM_PANEL_RAYDIUM_RM692E5 is not set
+# CONFIG_DRM_PANEL_RAYDIUM_RM69380 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_S6E3FA7 is not set
+# CONFIG_DRM_PANEL_SYNAPTICS_R63353 is not set
+# CONFIG_DRM_PANEL_TPO_Y17P is not set
+# CONFIG_DRM_PANEL_WAVESHARE_TOUCHSCREEN is not set
+# CONFIG_DRM_PANIC is not set
+# CONFIG_DRM_PANTHOR is not set
+# CONFIG_DRM_POWERVR is not set
+# CONFIG_DRM_RP1_DPI is not set
+# CONFIG_DRM_RP1_DSI is not set
+# CONFIG_DRM_RP1_VEC is not set
+# CONFIG_DRM_XE is not set
+CONFIG_DTC=y
+# CONFIG_DWC_PCIE_PMU is not set
+CONFIG_EDAC_SUPPORT=y
+CONFIG_EXCLUSIVE_SYSTEM_RAM=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FRAME_POINTER=y
+CONFIG_FS_IOMAP=y
+CONFIG_FUNCTION_ALIGNMENT=4
+CONFIG_FUNCTION_ALIGNMENT_4B=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_FW_LOADER_SYSFS=y
+CONFIG_GCC_SUPPORTS_DYNAMIC_FTRACE_WITH_ARGS=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_ARCH_TOPOLOGY=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_DEVICES=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
+CONFIG_GENERIC_CSUM=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_GENERIC_IOREMAP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y
+CONFIG_GENERIC_MSI_IRQ=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GPIO_CDEV=y
+# CONFIG_GPIO_FSM is not set
+# CONFIG_GPIO_SLOPPY_LOGIC_ANALYZER is not set
+# CONFIG_GPIO_VIRTUSER is not set
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT=y
+CONFIG_HISILICON_ERRATUM_162100801=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MSI_LIB=y
+CONFIG_IRQ_WORK=y
+# CONFIG_LAN966X_OIC is not set
+# CONFIG_LEDS_LP5569 is not set
+# CONFIG_LEDS_TRIGGER_ACTPWR is not set
+# CONFIG_LEDS_TRIGGER_INPUT is not set
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_LRU_GEN_WALKS_MMU=y
+# CONFIG_LWQ_TEST is not set
+# CONFIG_MEDIA_PCI_HAILO is not set
+# CONFIG_MEMCG_V1 is not set
+# CONFIG_MEM_ALLOC_PROFILING is not set
+CONFIG_MIGRATION=y
+CONFIG_MMU_LAZY_TLB_REFCOUNT=y
+CONFIG_MODULES_USE_ELF_RELA=y
+# CONFIG_MODULE_COMPRESS is not set
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_SG_DMA_LENGTH=y
+# CONFIG_NETKIT is not set
+# CONFIG_NET_9P_USBG is not set
+CONFIG_NET_EGRESS=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_INGRESS=y
+CONFIG_NET_XGRESS=y
+CONFIG_NO_IOPORT_MAP=y
+CONFIG_NR_CPUS=512
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+# CONFIG_OF_CONFIGFS is not set
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_PADATA=y
+CONFIG_PAGE_POOL=y
+CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
+CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
+CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y
+CONFIG_PARTITION_PERCPU=y
+CONFIG_PER_VMA_LOCK=y
+# CONFIG_PFCP is not set
+CONFIG_PGTABLE_LEVELS=5
+CONFIG_PHYS_ADDR_T_64BIT=y
+CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y
+CONFIG_POWER_RESET=y
+# CONFIG_POWER_SEQUENCING is not set
+CONFIG_POWER_SUPPLY=y
+CONFIG_PREEMPT_NONE_BUILD=y
+# CONFIG_PREEMPT_RT is not set
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_RANDSTRUCT_NONE=y
+# CONFIG_RASPBERRYPI_GPIOMEM is not set
+CONFIG_RATIONAL=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RODATA_FULL_DEFAULT_ENABLED=y
+# CONFIG_RP1_PIO is not set
+CONFIG_RPS=y
+CONFIG_RWSEM_SPIN_ON_OWNER=y
+# CONFIG_SENSORS_ASUS_ROG_RYUJIN is not set
+CONFIG_SERIAL_8250_FSL=y
+CONFIG_SERIAL_MCTRL_GPIO=y
+# CONFIG_SERIAL_RPI_FW is not set
+CONFIG_SMP=y
+# CONFIG_SND_PIMIDI is not set
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOFTIRQ_ON_OWN_STACK=y
+CONFIG_SPARSEMEM=y
+CONFIG_SPARSEMEM_EXTREME=y
+CONFIG_SPARSEMEM_VMEMMAP=y
+CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
+CONFIG_SPARSE_IRQ=y
+# CONFIG_SPI_RP2040_GPIO_BRIDGE is not set
+CONFIG_SPLIT_PMD_PTLOCKS=y
+CONFIG_SPLIT_PTE_PTLOCKS=y
+CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU=y
+CONFIG_SWIOTLB=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+# CONFIG_TCP_AO is not set
+# CONFIG_TEST_FPU is not set
+# CONFIG_TEST_MULDIV64 is not set
+# CONFIG_TEST_OBJPOOL is not set
+CONFIG_THREAD_INFO_IN_TASK=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TOOLS_SUPPORT_RELR=y
+CONFIG_TRACE_IRQFLAGS_NMI_SUPPORT=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_UNMAP_KERNEL_AT_EL0=y
+CONFIG_USER_STACKTRACE_SUPPORT=y
+CONFIG_VDSO_GETRANDOM=y
+# CONFIG_W1_MASTER_UART is not set
+CONFIG_XPS=y
+CONFIG_XZ_DEC_BCJ=y
+CONFIG_ZONE_DMA32=y
diff --git a/6.12/target/linux/bcm27xx/image/Makefile b/6.12/target/linux/bcm27xx/image/Makefile
new file mode 100644
index 00000000..3a0ab2c1
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/image/Makefile
@@ -0,0 +1,223 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2012-2019 OpenWrt.org
+# Copyright (C) 2016-2017 LEDE project
+
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/image.mk
+
+FAT32_BLOCK_SIZE=1024
+FAT32_BLOCKS=$(shell echo $$(($(CONFIG_TARGET_KERNEL_PARTSIZE)*1024*1024/$(FAT32_BLOCK_SIZE))))
+
+define Build/Compile
+	$(CP) $(LINUX_DIR)/COPYING $(KDIR)/COPYING.linux
+endef
+
+### Image scripts ###
+define Build/boot-common
+	echo $(IMG_PART_SIGNATURE) > $@-partuuid.txt
+	sed \
+		-e 's#@ROOT@#PARTUUID=$(IMG_PART_SIGNATURE)-02#g' \
+		cmdline.txt > $@-cmdline.txt
+
+	rm -f $@.boot
+	mkfs.fat -n boot -C $@.boot $(FAT32_BLOCKS)
+	mcopy -i $@.boot $(KDIR)/COPYING.linux ::
+	mcopy -i $@.boot $(KDIR)/LICENCE.broadcom ::
+	mcopy -i $@.boot $@-cmdline.txt ::cmdline.txt
+	mcopy -i $@.boot config.txt ::
+	mcopy -i $@.boot distroconfig.txt ::
+	mcopy -i $@.boot $@-partuuid.txt ::partuuid.txt
+	mcopy -i $@.boot $(IMAGE_KERNEL) ::$(KERNEL_IMG)
+	$(foreach dts,$(shell echo $(DEVICE_DTS)),mcopy -i $@.boot $(DTS_DIR)/$(dts).dtb ::;)
+	mmd -i $@.boot ::/overlays
+	mcopy -i $@.boot $(DTS_DIR)/overlays/*.dtbo ::/overlays/
+	mcopy -i $@.boot $(DTS_DIR)/overlays/README ::/overlays/
+endef
+
+define Build/boot-2708
+	mcopy -i $@.boot $(KDIR)/bootcode.bin ::
+	mcopy -i $@.boot $(KDIR)/start.elf ::
+	mcopy -i $@.boot $(KDIR)/start_cd.elf ::
+	mcopy -i $@.boot $(KDIR)/start_x.elf ::
+	mcopy -i $@.boot $(KDIR)/fixup.dat ::
+	mcopy -i $@.boot $(KDIR)/fixup_cd.dat ::
+	mcopy -i $@.boot $(KDIR)/fixup_x.dat ::
+endef
+
+define Build/boot-2711
+	mcopy -i $@.boot $(KDIR)/start4.elf ::
+	mcopy -i $@.boot $(KDIR)/start4cd.elf ::
+	mcopy -i $@.boot $(KDIR)/start4x.elf ::
+	mcopy -i $@.boot $(KDIR)/fixup4.dat ::
+	mcopy -i $@.boot $(KDIR)/fixup4cd.dat ::
+	mcopy -i $@.boot $(KDIR)/fixup4x.dat ::
+endef
+
+define Build/sdcard-img
+	SIGNATURE="$(IMG_PART_SIGNATURE)" \
+	./gen_rpi_sdcard_img.sh $@ $@.boot $(IMAGE_ROOTFS) \
+		$(CONFIG_TARGET_KERNEL_PARTSIZE) $(CONFIG_TARGET_ROOTFS_PARTSIZE)
+endef
+
+### Devices ###
+define Device/Default
+  DEVICE_VENDOR := Raspberry Pi
+  KERNEL := kernel-bin
+  KERNEL_IMG := kernel.img
+  IMAGES := factory.img.gz sysupgrade.img.gz
+  IMAGE/sysupgrade.img.gz := boot-common | boot-2708 | sdcard-img | gzip | append-metadata
+  IMAGE/factory.img.gz := boot-common | boot-2708 | sdcard-img | gzip
+endef
+
+define Device/rpi
+  DEVICE_MODEL := A/A+/B/B+/CM/Zero/ZeroW
+  DEVICE_DTS := \
+	broadcom/bcm2708-rpi-b broadcom/bcm2708-rpi-b-rev1 broadcom/bcm2708-rpi-b-plus \
+	broadcom/bcm2708-rpi-cm \
+	broadcom/bcm2708-rpi-zero broadcom/bcm2708-rpi-zero-w
+  SUPPORTED_DEVICES := \
+	rpi-a rpi-a-plus \
+	rpi-b rpi-b-plus \
+	rpi-cm \
+	rpi-zero rpi-zero-w \
+	raspberrypi,model-a raspberrypi,model-a-plus \
+	raspberrypi,model-b raspberrypi,model-b-plus raspberrypi,model-b-rev2 \
+	raspberrypi,compute-module raspberrypi,compute-module-1 \
+	raspberrypi,model-zero raspberrypi,model-zero-w
+  DEVICE_PACKAGES := \
+	cypress-firmware-43430-sdio \
+	brcmfmac-nvram-43430-sdio \
+	kmod-brcmfmac wpad-basic-mbedtls
+endef
+ifeq ($(SUBTARGET),bcm2708)
+  TARGET_DEVICES += rpi
+endif
+
+define Device/rpi-2
+  DEVICE_MODEL := 2B/2B 1.2
+  DEVICE_VARIANT := (32bit)
+  DEVICE_ALT0_VENDOR := Raspberry Pi
+  DEVICE_ALT0_MODEL := 3A+/3B/3B+/CM3/Zero2/Zero2W
+  DEVICE_ALT0_VARIANT := (32bit)
+  DEVICE_ALT1_VENDOR := Raspberry Pi
+  DEVICE_ALT1_MODEL := 4B/400/CM4
+  DEVICE_ALT1_VARIANT := (32bit)
+  DEVICE_DTS := \
+	broadcom/bcm2709-rpi-2-b broadcom/bcm2710-rpi-2-b \
+	broadcom/bcm2710-rpi-3-b broadcom/bcm2710-rpi-3-b-plus \
+	broadcom/bcm2711-rpi-4-b broadcom/bcm2711-rpi-400 \
+	broadcom/bcm2710-rpi-cm3 broadcom/bcm2711-rpi-cm4 \
+	broadcom/bcm2710-rpi-zero-2 broadcom/bcm2710-rpi-zero-2-w
+  SUPPORTED_DEVICES := \
+	rpi-2-b \
+	rpi-3-a-plus \
+	rpi-3-b rpi-3-b-plus \
+	rpi-4-b rpi-400 \
+	rpi-cm \
+	rpi-zero-2 rpi-zero-2-w \
+	raspberrypi,2-model-b raspberrypi,2-model-b-rev2 \
+	raspberrypi,3-model-a-plus \
+	raspberrypi,3-model-b raspberrypi,3-model-b-plus \
+	raspberrypi,3-compute-module raspberrypi,compute-module-3 \
+	raspberrypi,400 raspberrypi,4-compute-module raspberrypi,4-model-b \
+	raspberrypi,model-zero-2 raspberrypi,model-zero-2-w
+  DEVICE_PACKAGES := \
+	cypress-firmware-43430-sdio \
+	brcmfmac-nvram-43430-sdio \
+	cypress-firmware-43455-sdio \
+	brcmfmac-nvram-43455-sdio \
+	kmod-brcmfmac wpad-basic-mbedtls
+  IMAGE/sysupgrade.img.gz := boot-common | boot-2708 | boot-2711 | sdcard-img | gzip | append-metadata
+  IMAGE/factory.img.gz := boot-common | boot-2708 | boot-2711 | sdcard-img | gzip
+endef
+ifeq ($(SUBTARGET),bcm2709)
+  TARGET_DEVICES += rpi-2
+endif
+
+define Device/rpi-3
+  DEVICE_MODEL := 3A+/3B/3B+/CM3/Zero2/Zero2W
+  DEVICE_VARIANT := (64bit)
+  DEVICE_ALT0_VENDOR := Raspberry Pi
+  DEVICE_ALT0_MODEL := 2B-1.2
+  DEVICE_ALT0_VARIANT := (64bit)
+  KERNEL_IMG := kernel8.img
+  DEVICE_DTS := \
+	broadcom/bcm2710-rpi-2-b \
+	broadcom/bcm2710-rpi-3-b broadcom/bcm2710-rpi-3-b-plus \
+	broadcom/bcm2710-rpi-cm3 \
+	broadcom/bcm2710-rpi-zero-2 broadcom/bcm2710-rpi-zero-2-w
+  SUPPORTED_DEVICES := \
+	rpi-3-a-plus \
+	rpi-3-b rpi-3-b-plus \
+	rpi-zero-2 rpi-zero-2-w \
+	raspberrypi,2-model-b-rev2 \
+	raspberrypi,3-model-a-plus \
+	raspberrypi,3-model-b raspberrypi,3-model-b-plus \
+	raspberrypi,3-compute-module raspberrypi,compute-module-3 \
+	raspberrypi,model-zero-2 raspberrypi,model-zero-2-w
+  DEVICE_PACKAGES := \
+	cypress-firmware-43430-sdio \
+	brcmfmac-nvram-43430-sdio \
+	cypress-firmware-43455-sdio \
+	brcmfmac-nvram-43455-sdio \
+	kmod-brcmfmac wpad-basic-mbedtls
+endef
+ifeq ($(SUBTARGET),bcm2710)
+  TARGET_DEVICES += rpi-3
+endif
+
+define Device/rpi-4
+  DEVICE_MODEL := 4B/400/CM4
+  DEVICE_VARIANT := (64bit)
+  KERNEL_IMG := kernel8.img
+  DEVICE_DTS := \
+	broadcom/bcm2711-rpi-400 \
+	broadcom/bcm2711-rpi-4-b \
+	broadcom/bcm2711-rpi-cm4 \
+	broadcom/bcm2711-rpi-cm4s \
+	broadcom/bcm2711-rpi-cm4-io
+  SUPPORTED_DEVICES := \
+	raspberrypi,400 \
+	raspberrypi,4-compute-module \
+	raspberrypi,4-model-b
+  DEVICE_PACKAGES := \
+	cypress-firmware-43455-sdio \
+	brcmfmac-nvram-43455-sdio \
+	kmod-brcmfmac wpad-basic-mbedtls \
+	kmod-usb-net-lan78xx \
+	kmod-r8169
+  IMAGE/sysupgrade.img.gz := boot-common | boot-2711 | sdcard-img | gzip | append-metadata
+  IMAGE/factory.img.gz := boot-common | boot-2711 | sdcard-img | gzip
+endef
+ifeq ($(SUBTARGET),bcm2711)
+  TARGET_DEVICES += rpi-4
+endif
+
+define Device/rpi-5
+  DEVICE_MODEL := 5/CM5
+  KERNEL_IMG := kernel_2712.img
+  DEVICE_DTS := \
+	broadcom/bcm2712-rpi-500 \
+	broadcom/bcm2712-rpi-5-b \
+	broadcom/bcm2712-rpi-cm5-cm4io \
+	broadcom/bcm2712-rpi-cm5-cm5io \
+	broadcom/bcm2712-rpi-cm5l-cm4io \
+	broadcom/bcm2712-rpi-cm5l-cm5io
+  SUPPORTED_DEVICES := \
+	raspberrypi,500 \
+	raspberrypi,5-compute-module \
+	raspberrypi,5-model-b
+  DEVICE_PACKAGES := \
+	cypress-firmware-43455-sdio \
+	brcmfmac-nvram-43455-sdio \
+	kmod-brcmfmac wpad-basic-mbedtls \
+	kmod-hwmon-pwmfan kmod-thermal
+  IMAGE/sysupgrade.img.gz := boot-common | sdcard-img | gzip | append-metadata
+  IMAGE/factory.img.gz := boot-common | sdcard-img | gzip
+endef
+ifeq ($(SUBTARGET),bcm2712)
+  TARGET_DEVICES += rpi-5
+endif
+
+$(eval $(call BuildImage))
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0004-Revert-spi-spidev-Fix-CS-polarity-if-GPIO-descriptor.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0004-Revert-spi-spidev-Fix-CS-polarity-if-GPIO-descriptor.patch
new file mode 100644
index 00000000..7795f60e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0004-Revert-spi-spidev-Fix-CS-polarity-if-GPIO-descriptor.patch
@@ -0,0 +1,22 @@
+From 99b87b80f2e12dfecaa0d63267769203ebb04d04 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 20 Apr 2020 13:41:10 +0100
+Subject: [PATCH 004/697] Revert "spi: spidev: Fix CS polarity if GPIO
+ descriptors are used"
+
+This reverts commit 83b2a8fe43bda0c11981ad6afa5dd0104d78be28.
+---
+ drivers/spi/spidev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -428,7 +428,7 @@ spidev_ioctl(struct file *filp, unsigned
+ 			}
+ 
+ 			if (ctlr->use_gpio_descriptors && spi_get_csgpiod(spi, 0))
+-				tmp |= SPI_CS_HIGH;
++				{ /*tmp |= SPI_CS_HIGH;*/ }
+ 
+ 			tmp |= spi->mode & ~SPI_MODE_MASK;
+ 			spi->mode = tmp & SPI_MODE_USER_MASK;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0005-Revert-net-bcmgenet-Request-APD-DLL-disable-and-IDDQ.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0005-Revert-net-bcmgenet-Request-APD-DLL-disable-and-IDDQ.patch
new file mode 100644
index 00000000..04bd164b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0005-Revert-net-bcmgenet-Request-APD-DLL-disable-and-IDDQ.patch
@@ -0,0 +1,29 @@
+From d1f6582242f7b5ee85a46b10c496957ee38e62b5 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 7 Mar 2022 16:18:55 +0000
+Subject: [PATCH 005/697] Revert "net: bcmgenet: Request APD, DLL disable and
+ IDDQ-SR"
+
+This reverts commit c3a4c69360ab43560f212eed326c9d8bde35b14c, which
+broke rebooting when network booting.
+
+See: https://github.com/raspberrypi/rpi-eeprom/issues/417
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/net/ethernet/broadcom/genet/bcmmii.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+@@ -304,9 +304,7 @@ int bcmgenet_mii_probe(struct net_device
+ 	struct device_node *dn = kdev->of_node;
+ 	phy_interface_t phy_iface = priv->phy_interface;
+ 	struct phy_device *phydev;
+-	u32 phy_flags = PHY_BRCM_AUTO_PWRDWN_ENABLE |
+-			PHY_BRCM_DIS_TXCRXC_NOENRGY |
+-			PHY_BRCM_IDDQ_SUSPEND;
++	u32 phy_flags = 0;
+ 	int ret;
+ 
+ 	/* Communicate the integrated PHY revision */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0006-Revert-Revert-xhci-add-quirk-for-host-controllers-th.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0006-Revert-Revert-xhci-add-quirk-for-host-controllers-th.patch
new file mode 100644
index 00000000..b3d402d6
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0006-Revert-Revert-xhci-add-quirk-for-host-controllers-th.patch
@@ -0,0 +1,69 @@
+From f7aff06f3804aef99910922397bf196cfaa5479e Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Mon, 31 Jul 2023 13:47:10 +0100
+Subject: [PATCH 006/697] Revert "Revert "xhci: add quirk for host controllers
+ that don't update endpoint DCS""
+
+This reverts commit 5bef4b3cb95a5b883dfec8b3ffc0d671323d55bb.
+
+We don't agree with upstream revert so undo it.
+---
+ drivers/usb/host/xhci-pci.c  |  4 +++-
+ drivers/usb/host/xhci-ring.c | 23 ++++++++++++++++++++++-
+ 2 files changed, 25 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -424,8 +424,10 @@ static void xhci_pci_quirks(struct devic
+ 			pdev->device == 0x3432)
+ 		xhci->quirks |= XHCI_BROKEN_STREAMS;
+ 
+-	if (pdev->vendor == PCI_VENDOR_ID_VIA && pdev->device == 0x3483)
++	if (pdev->vendor == PCI_VENDOR_ID_VIA && pdev->device == 0x3483) {
+ 		xhci->quirks |= XHCI_LPM_SUPPORT;
++		xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
++	}
+ 
+ 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+ 		pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI) {
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -637,8 +637,11 @@ static int xhci_move_dequeue_past_td(str
+ 	struct xhci_ring *ep_ring;
+ 	struct xhci_command *cmd;
+ 	struct xhci_segment *new_seg;
++	struct xhci_segment *halted_seg = NULL;
+ 	union xhci_trb *new_deq;
+ 	int new_cycle;
++	union xhci_trb *halted_trb;
++	int index = 0;
+ 	dma_addr_t addr;
+ 	u64 hw_dequeue;
+ 	bool cycle_found = false;
+@@ -657,7 +660,25 @@ static int xhci_move_dequeue_past_td(str
+ 	hw_dequeue = xhci_get_hw_deq(xhci, dev, ep_index, stream_id);
+ 	new_seg = ep_ring->deq_seg;
+ 	new_deq = ep_ring->dequeue;
+-	new_cycle = hw_dequeue & 0x1;
++
++	/*
++	 * Quirk: xHC write-back of the DCS field in the hardware dequeue
++	 * pointer is wrong - use the cycle state of the TRB pointed to by
++	 * the dequeue pointer.
++	 */
++	if (xhci->quirks & XHCI_EP_CTX_BROKEN_DCS &&
++	    !(ep->ep_state & EP_HAS_STREAMS))
++		halted_seg = trb_in_td(xhci, td, hw_dequeue & ~0xf, false);
++	if (halted_seg) {
++		index = ((dma_addr_t)(hw_dequeue & ~0xf) - halted_seg->dma) /
++			 sizeof(*halted_trb);
++		halted_trb = &halted_seg->trbs[index];
++		new_cycle = halted_trb->generic.field[3] & 0x1;
++		xhci_dbg(xhci, "Endpoint DCS = %d TRB index = %d cycle = %d\n",
++			 (u8)(hw_dequeue & 0x1), index, new_cycle);
++	} else {
++		new_cycle = hw_dequeue & 0x1;
++	}
+ 
+ 	/*
+ 	 * We want to find the pointer, segment and cycle state of the new trb
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0007-Revert-PCI-brcmstb-Configure-HW-CLKREQ-mode-appropri.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0007-Revert-PCI-brcmstb-Configure-HW-CLKREQ-mode-appropri.patch
new file mode 100644
index 00000000..d372dbf2
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0007-Revert-PCI-brcmstb-Configure-HW-CLKREQ-mode-appropri.patch
@@ -0,0 +1,156 @@
+From faa6f87df4d488431743607a8158f15bdcb2afdd Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Fri, 2 Feb 2024 13:04:00 +0000
+Subject: [PATCH 007/697] Revert "PCI: brcmstb: Configure HW CLKREQ# mode
+ appropriate for downstream device"
+
+This reverts commit e2596dcf1e9dfd5904d50f796c19b03c94a3b8b4.
+---
+ drivers/pci/controller/pcie-brcmstb.c | 100 +++-----------------------
+ 1 file changed, 10 insertions(+), 90 deletions(-)
+
+--- a/drivers/pci/controller/pcie-brcmstb.c
++++ b/drivers/pci/controller/pcie-brcmstb.c
+@@ -48,9 +48,6 @@
+ #define PCIE_RC_CFG_PRIV1_LINK_CAPABILITY			0x04dc
+ #define  PCIE_RC_CFG_PRIV1_LINK_CAPABILITY_ASPM_SUPPORT_MASK	0xc00
+ 
+-#define PCIE_RC_CFG_PRIV1_ROOT_CAP			0x4f8
+-#define  PCIE_RC_CFG_PRIV1_ROOT_CAP_L1SS_MODE_MASK	0xf8
+-
+ #define PCIE_RC_DL_MDIO_ADDR				0x1100
+ #define PCIE_RC_DL_MDIO_WR_DATA				0x1104
+ #define PCIE_RC_DL_MDIO_RD_DATA				0x1108
+@@ -127,12 +124,9 @@
+ 		PCIE_MISC_CPU_2_PCIE_MEM_WIN0_LIMIT_HI + ((win) * 8)
+ 
+ #define  PCIE_MISC_HARD_PCIE_HARD_DEBUG_CLKREQ_DEBUG_ENABLE_MASK	0x2
+-#define  PCIE_MISC_HARD_PCIE_HARD_DEBUG_L1SS_ENABLE_MASK		0x200000
+ #define  PCIE_MISC_HARD_PCIE_HARD_DEBUG_SERDES_IDDQ_MASK		0x08000000
+ #define  PCIE_BMIPS_MISC_HARD_PCIE_HARD_DEBUG_SERDES_IDDQ_MASK		0x00800000
+-#define  PCIE_CLKREQ_MASK \
+-	  (PCIE_MISC_HARD_PCIE_HARD_DEBUG_CLKREQ_DEBUG_ENABLE_MASK | \
+-	   PCIE_MISC_HARD_PCIE_HARD_DEBUG_L1SS_ENABLE_MASK)
++
+ 
+ #define PCIE_MISC_UBUS_BAR1_CONFIG_REMAP			0x40ac
+ #define  PCIE_MISC_UBUS_BAR1_CONFIG_REMAP_ACCESS_EN_MASK	BIT(0)
+@@ -1187,93 +1181,13 @@ static int brcm_pcie_setup(struct brcm_p
+ 	return 0;
+ }
+ 
+-/*
+- * This extends the timeout period for an access to an internal bus.  This
+- * access timeout may occur during L1SS sleep periods, even without the
+- * presence of a PCIe access.
+- */
+-static void brcm_extend_rbus_timeout(struct brcm_pcie *pcie)
+-{
+-	/* TIMEOUT register is two registers before RGR1_SW_INIT_1 */
+-	const unsigned int REG_OFFSET = PCIE_RGR1_SW_INIT_1(pcie) - 8;
+-	u32 timeout_us = 4000000; /* 4 seconds, our setting for L1SS */
+-
+-	/* 7712 does not have this (RGR1) timer */
+-	if (pcie->soc_base == BCM7712)
+-		return;
+-
+-	/* Each unit in timeout register is 1/216,000,000 seconds */
+-	writel(216 * timeout_us, pcie->base + REG_OFFSET);
+-}
+-
+-static void brcm_config_clkreq(struct brcm_pcie *pcie)
+-{
+-	static const char err_msg[] = "invalid 'brcm,clkreq-mode' DT string\n";
+-	const char *mode = "default";
+-	u32 clkreq_cntl;
+-	int ret, tmp;
+-
+-	ret = of_property_read_string(pcie->np, "brcm,clkreq-mode", &mode);
+-	if (ret && ret != -EINVAL) {
+-		dev_err(pcie->dev, err_msg);
+-		mode = "safe";
+-	}
+-
+-	/* Start out assuming safe mode (both mode bits cleared) */
+-	clkreq_cntl = readl(pcie->base + HARD_DEBUG(pcie));
+-	clkreq_cntl &= ~PCIE_CLKREQ_MASK;
+-
+-	if (strcmp(mode, "no-l1ss") == 0) {
+-		/*
+-		 * "no-l1ss" -- Provides Clock Power Management, L0s, and
+-		 * L1, but cannot provide L1 substate (L1SS) power
+-		 * savings. If the downstream device connected to the RC is
+-		 * L1SS capable AND the OS enables L1SS, all PCIe traffic
+-		 * may abruptly halt, potentially hanging the system.
+-		 */
+-		clkreq_cntl |= PCIE_MISC_HARD_PCIE_HARD_DEBUG_CLKREQ_DEBUG_ENABLE_MASK;
+-		/*
+-		 * We want to un-advertise L1 substates because if the OS
+-		 * tries to configure the controller into using L1 substate
+-		 * power savings it may fail or hang when the RC HW is in
+-		 * "no-l1ss" mode.
+-		 */
+-		tmp = readl(pcie->base + PCIE_RC_CFG_PRIV1_ROOT_CAP);
+-		u32p_replace_bits(&tmp, 2, PCIE_RC_CFG_PRIV1_ROOT_CAP_L1SS_MODE_MASK);
+-		writel(tmp, pcie->base + PCIE_RC_CFG_PRIV1_ROOT_CAP);
+-
+-	} else if (strcmp(mode, "default") == 0) {
+-		/*
+-		 * "default" -- Provides L0s, L1, and L1SS, but not
+-		 * compliant to provide Clock Power Management;
+-		 * specifically, may not be able to meet the Tclron max
+-		 * timing of 400ns as specified in "Dynamic Clock Control",
+-		 * section 3.2.5.2.2 of the PCIe spec.  This situation is
+-		 * atypical and should happen only with older devices.
+-		 */
+-		clkreq_cntl |= PCIE_MISC_HARD_PCIE_HARD_DEBUG_L1SS_ENABLE_MASK;
+-		brcm_extend_rbus_timeout(pcie);
+-
+-	} else {
+-		/*
+-		 * "safe" -- No power savings; refclk is driven by RC
+-		 * unconditionally.
+-		 */
+-		if (strcmp(mode, "safe") != 0)
+-			dev_err(pcie->dev, err_msg);
+-		mode = "safe";
+-	}
+-	writel(clkreq_cntl, pcie->base + HARD_DEBUG(pcie));
+-
+-	dev_info(pcie->dev, "clkreq-mode set to %s\n", mode);
+-}
+-
+ static int brcm_pcie_start_link(struct brcm_pcie *pcie)
+ {
+ 	struct device *dev = pcie->dev;
+ 	void __iomem *base = pcie->base;
+ 	u16 nlw, cls, lnksta;
+ 	bool ssc_good = false;
++	u32 tmp;
+ 	int ret, i;
+ 
+ 	/* Unassert the fundamental reset */
+@@ -1300,8 +1214,6 @@ static int brcm_pcie_start_link(struct b
+ 		return -ENODEV;
+ 	}
+ 
+-	brcm_config_clkreq(pcie);
+-
+ 	if (pcie->gen)
+ 		brcm_pcie_set_gen(pcie, pcie->gen);
+ 
+@@ -1320,6 +1232,14 @@ static int brcm_pcie_start_link(struct b
+ 		 pci_speed_string(pcie_link_speed[cls]), nlw,
+ 		 ssc_good ? "(SSC)" : "(!SSC)");
+ 
++	/*
++	 * Refclk from RC should be gated with CLKREQ# input when ASPM L0s,L1
++	 * is enabled => setting the CLKREQ_DEBUG_ENABLE field to 1.
++	 */
++	tmp = readl(base + PCIE_MISC_HARD_PCIE_HARD_DEBUG);
++	tmp |= PCIE_MISC_HARD_PCIE_HARD_DEBUG_CLKREQ_DEBUG_ENABLE_MASK;
++	writel(tmp, base + PCIE_MISC_HARD_PCIE_HARD_DEBUG);
++
+ 	return 0;
+ }
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0008-Revert-ARM-dts-bcm2711-Add-BCM2711-xHCI-support.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0008-Revert-ARM-dts-bcm2711-Add-BCM2711-xHCI-support.patch
new file mode 100644
index 00000000..7173d912
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0008-Revert-ARM-dts-bcm2711-Add-BCM2711-xHCI-support.patch
@@ -0,0 +1,52 @@
+From fee8daf3147a30ddbfe2ac759ee5b7481bace2ca Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Wed, 31 Jan 2024 19:47:39 +0000
+Subject: [PATCH 008/697] Revert "ARM: dts: bcm2711: Add BCM2711 xHCI support"
+
+This reverts commit 522c35e08b53f157ad3e51848caa861b258001e4.
+---
+ arch/arm/boot/dts/broadcom/bcm2711-rpi.dtsi |  5 -----
+ arch/arm/boot/dts/broadcom/bcm2711.dtsi     | 14 --------------
+ 2 files changed, 19 deletions(-)
+
+--- a/arch/arm/boot/dts/broadcom/bcm2711-rpi.dtsi
++++ b/arch/arm/boot/dts/broadcom/bcm2711-rpi.dtsi
+@@ -1,7 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ #include "bcm2835-rpi.dtsi"
+ 
+-#include <dt-bindings/power/raspberrypi-power.h>
+ #include <dt-bindings/reset/raspberrypi,firmware-reset.h>
+ 
+ / {
+@@ -101,7 +100,3 @@
+ &vchiq {
+ 	interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
+ };
+-
+-&xhci {
+-	power-domains = <&power RPI_POWER_DOMAIN_USB>;
+-};
+--- a/arch/arm/boot/dts/broadcom/bcm2711.dtsi
++++ b/arch/arm/boot/dts/broadcom/bcm2711.dtsi
+@@ -604,20 +604,6 @@
+ 			};
+ 		};
+ 
+-		xhci: usb@7e9c0000 {
+-			compatible = "brcm,bcm2711-xhci", "brcm,xhci-brcm-v2";
+-			reg = <0x0 0x7e9c0000 0x100000>;
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			interrupts = <GIC_SPI 176 IRQ_TYPE_LEVEL_HIGH>;
+-			/* DWC2 and this IP block share the same USB PHY,
+-			 * enabling both at the same time results in lockups.
+-			 * So keep this node disabled and let the bootloader
+-			 * decide which interface should be enabled.
+-			 */
+-			status = "disabled";
+-		};
+-
+ 		v3d: gpu@7ec00000 {
+ 			compatible = "brcm,2711-v3d";
+ 			reg = <0x0 0x7ec00000 0x4000>,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0009-Revert-usb-phy-generic-Get-the-vbus-supply.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0009-Revert-usb-phy-generic-Get-the-vbus-supply.patch
new file mode 100644
index 00000000..50c9e12c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0009-Revert-usb-phy-generic-Get-the-vbus-supply.patch
@@ -0,0 +1,26 @@
+From 3063c20ced293f1f214fa77b71adac0ce3385d81 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 28 Mar 2024 16:16:37 +0000
+Subject: [PATCH 009/697] Revert "usb: phy: generic: Get the vbus supply"
+
+This reverts commit 03e607cbb2931374db1825f371e9c7f28526d3f4.
+---
+ drivers/usb/phy/phy-generic.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+--- a/drivers/usb/phy/phy-generic.c
++++ b/drivers/usb/phy/phy-generic.c
+@@ -256,13 +256,6 @@ int usb_phy_gen_create_phy(struct device
+ 		return dev_err_probe(dev, PTR_ERR(nop->vcc),
+ 				     "could not get vcc regulator\n");
+ 
+-	nop->vbus_draw = devm_regulator_get_exclusive(dev, "vbus");
+-	if (PTR_ERR(nop->vbus_draw) == -ENODEV)
+-		nop->vbus_draw = NULL;
+-	if (IS_ERR(nop->vbus_draw))
+-		return dev_err_probe(dev, PTR_ERR(nop->vbus_draw),
+-				     "could not get vbus regulator\n");
+-
+ 	nop->dev		= dev;
+ 	nop->phy.dev		= nop->dev;
+ 	nop->phy.label		= "nop-xceiv";
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0010-raspberrypi-firmware-Update-mailbox-commands.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0010-raspberrypi-firmware-Update-mailbox-commands.patch
new file mode 100644
index 00000000..f1a546f9
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0010-raspberrypi-firmware-Update-mailbox-commands.patch
@@ -0,0 +1,102 @@
+From c1d90b3d7f207b203d8f8b32e02dbd1d7636cb6a Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Thu, 7 Apr 2022 18:23:07 +0100
+Subject: [PATCH 010/697] raspberrypi-firmware: Update mailbox commands
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ include/soc/bcm2835/raspberrypi-firmware.h | 28 +++++++++++++++++++++-
+ 1 file changed, 27 insertions(+), 1 deletion(-)
+
+--- a/include/soc/bcm2835/raspberrypi-firmware.h
++++ b/include/soc/bcm2835/raspberrypi-firmware.h
+@@ -36,6 +36,8 @@ struct rpi_firmware_property_tag_header
+ enum rpi_firmware_property_tag {
+ 	RPI_FIRMWARE_PROPERTY_END =                           0,
+ 	RPI_FIRMWARE_GET_FIRMWARE_REVISION =                  0x00000001,
++	RPI_FIRMWARE_GET_FIRMWARE_VARIANT =                   0x00000002,
++	RPI_FIRMWARE_GET_FIRMWARE_HASH =                      0x00000003,
+ 
+ 	RPI_FIRMWARE_SET_CURSOR_INFO =                        0x00008010,
+ 	RPI_FIRMWARE_SET_CURSOR_STATE =                       0x00008011,
+@@ -71,6 +73,7 @@ enum rpi_firmware_property_tag {
+ 	RPI_FIRMWARE_GET_DISPMANX_RESOURCE_MEM_HANDLE =       0x00030014,
+ 	RPI_FIRMWARE_GET_EDID_BLOCK =                         0x00030020,
+ 	RPI_FIRMWARE_GET_CUSTOMER_OTP =                       0x00030021,
++	RPI_FIRMWARE_GET_EDID_BLOCK_DISPLAY =                 0x00030023,
+ 	RPI_FIRMWARE_GET_DOMAIN_STATE =                       0x00030030,
+ 	RPI_FIRMWARE_GET_THROTTLED =                          0x00030046,
+ 	RPI_FIRMWARE_GET_CLOCK_MEASURED =                     0x00030047,
+@@ -89,8 +92,11 @@ enum rpi_firmware_property_tag {
+ 	RPI_FIRMWARE_GET_PERIPH_REG =                         0x00030045,
+ 	RPI_FIRMWARE_SET_PERIPH_REG =                         0x00038045,
+ 	RPI_FIRMWARE_GET_POE_HAT_VAL =                        0x00030049,
+-	RPI_FIRMWARE_SET_POE_HAT_VAL =                        0x00030050,
++	RPI_FIRMWARE_SET_POE_HAT_VAL =                        0x00038049,
++	RPI_FIRMWARE_SET_POE_HAT_VAL_OLD =                    0x00030050,
+ 	RPI_FIRMWARE_NOTIFY_XHCI_RESET =                      0x00030058,
++	RPI_FIRMWARE_GET_REBOOT_FLAGS =                       0x00030064,
++	RPI_FIRMWARE_SET_REBOOT_FLAGS =                       0x00038064,
+ 	RPI_FIRMWARE_NOTIFY_DISPLAY_DONE =                    0x00030066,
+ 
+ 	/* Dispmanx TAGS */
+@@ -105,9 +111,16 @@ enum rpi_firmware_property_tag {
+ 	RPI_FIRMWARE_FRAMEBUFFER_GET_VIRTUAL_OFFSET =         0x00040009,
+ 	RPI_FIRMWARE_FRAMEBUFFER_GET_OVERSCAN =               0x0004000a,
+ 	RPI_FIRMWARE_FRAMEBUFFER_GET_PALETTE =                0x0004000b,
++	RPI_FIRMWARE_FRAMEBUFFER_GET_LAYER =                  0x0004000c,
++	RPI_FIRMWARE_FRAMEBUFFER_GET_TRANSFORM =              0x0004000d,
++	RPI_FIRMWARE_FRAMEBUFFER_GET_VSYNC =                  0x0004000e,
+ 	RPI_FIRMWARE_FRAMEBUFFER_GET_TOUCHBUF =               0x0004000f,
+ 	RPI_FIRMWARE_FRAMEBUFFER_GET_GPIOVIRTBUF =            0x00040010,
+ 	RPI_FIRMWARE_FRAMEBUFFER_RELEASE =                    0x00048001,
++	RPI_FIRMWARE_FRAMEBUFFER_GET_DISPLAY_ID =             0x00040016,
++	RPI_FIRMWARE_FRAMEBUFFER_SET_DISPLAY_NUM =            0x00048013,
++	RPI_FIRMWARE_FRAMEBUFFER_GET_NUM_DISPLAYS =           0x00040013,
++	RPI_FIRMWARE_FRAMEBUFFER_GET_DISPLAY_SETTINGS =       0x00040014,
+ 	RPI_FIRMWARE_FRAMEBUFFER_TEST_PHYSICAL_WIDTH_HEIGHT = 0x00044003,
+ 	RPI_FIRMWARE_FRAMEBUFFER_TEST_VIRTUAL_WIDTH_HEIGHT =  0x00044004,
+ 	RPI_FIRMWARE_FRAMEBUFFER_TEST_DEPTH =                 0x00044005,
+@@ -116,22 +129,33 @@ enum rpi_firmware_property_tag {
+ 	RPI_FIRMWARE_FRAMEBUFFER_TEST_VIRTUAL_OFFSET =        0x00044009,
+ 	RPI_FIRMWARE_FRAMEBUFFER_TEST_OVERSCAN =              0x0004400a,
+ 	RPI_FIRMWARE_FRAMEBUFFER_TEST_PALETTE =               0x0004400b,
++	RPI_FIRMWARE_FRAMEBUFFER_TEST_LAYER =                 0x0004400c,
++	RPI_FIRMWARE_FRAMEBUFFER_TEST_TRANSFORM =             0x0004400d,
+ 	RPI_FIRMWARE_FRAMEBUFFER_TEST_VSYNC =                 0x0004400e,
+ 	RPI_FIRMWARE_FRAMEBUFFER_SET_PHYSICAL_WIDTH_HEIGHT =  0x00048003,
+ 	RPI_FIRMWARE_FRAMEBUFFER_SET_VIRTUAL_WIDTH_HEIGHT =   0x00048004,
+ 	RPI_FIRMWARE_FRAMEBUFFER_SET_DEPTH =                  0x00048005,
+ 	RPI_FIRMWARE_FRAMEBUFFER_SET_PIXEL_ORDER =            0x00048006,
+ 	RPI_FIRMWARE_FRAMEBUFFER_SET_ALPHA_MODE =             0x00048007,
++	RPI_FIRMWARE_FRAMEBUFFER_SET_PITCH =                  0x00048008,
+ 	RPI_FIRMWARE_FRAMEBUFFER_SET_VIRTUAL_OFFSET =         0x00048009,
+ 	RPI_FIRMWARE_FRAMEBUFFER_SET_OVERSCAN =               0x0004800a,
+ 	RPI_FIRMWARE_FRAMEBUFFER_SET_PALETTE =                0x0004800b,
++
+ 	RPI_FIRMWARE_FRAMEBUFFER_SET_TOUCHBUF =               0x0004801f,
+ 	RPI_FIRMWARE_FRAMEBUFFER_SET_GPIOVIRTBUF =            0x00048020,
+ 	RPI_FIRMWARE_FRAMEBUFFER_SET_VSYNC =                  0x0004800e,
++	RPI_FIRMWARE_FRAMEBUFFER_SET_LAYER =                  0x0004800c,
++	RPI_FIRMWARE_FRAMEBUFFER_SET_TRANSFORM =              0x0004800d,
+ 	RPI_FIRMWARE_FRAMEBUFFER_SET_BACKLIGHT =              0x0004800f,
+ 
+ 	RPI_FIRMWARE_VCHIQ_INIT =                             0x00048010,
+ 
++	RPI_FIRMWARE_SET_PLANE =                              0x00048015,
++	RPI_FIRMWARE_GET_DISPLAY_TIMING =                     0x00040017,
++	RPI_FIRMWARE_SET_TIMING =                             0x00048017,
++	RPI_FIRMWARE_GET_DISPLAY_CFG =                        0x00040018,
++	RPI_FIRMWARE_SET_DISPLAY_POWER =		      0x00048019,
+ 	RPI_FIRMWARE_GET_COMMAND_LINE =                       0x00050001,
+ 	RPI_FIRMWARE_GET_DMA_CHANNELS =                       0x00060001,
+ };
+@@ -155,6 +179,8 @@ enum rpi_firmware_clk_id {
+ 	RPI_FIRMWARE_NUM_CLK_ID,
+ };
+ 
++#define GET_DISPLAY_SETTINGS_PAYLOAD_SIZE 64
++
+ /**
+  * struct rpi_firmware_clk_rate_request - Firmware Request for a rate
+  * @id:	ID of the clock being queried
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0011-drm-atomic-Don-t-fixup-modes-that-haven-t-been-reset.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0011-drm-atomic-Don-t-fixup-modes-that-haven-t-been-reset.patch
new file mode 100644
index 00000000..5a0f1b3a
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0011-drm-atomic-Don-t-fixup-modes-that-haven-t-been-reset.patch
@@ -0,0 +1,24 @@
+From fce77d9309edd4d813e45ea2868a6a3307787193 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 7 Jan 2021 16:30:55 +0000
+Subject: [PATCH 011/697] drm/atomic: Don't fixup modes that haven't been reset
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/drm_atomic_helper.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/gpu/drm/drm_atomic_helper.c
++++ b/drivers/gpu/drm/drm_atomic_helper.c
+@@ -444,6 +444,11 @@ mode_fixup(struct drm_atomic_state *stat
+ 		new_crtc_state =
+ 			drm_atomic_get_new_crtc_state(state, new_conn_state->crtc);
+ 
++		if (!new_crtc_state->mode_changed &&
++		    !new_crtc_state->connectors_changed) {
++			continue;
++		}
++
+ 		/*
+ 		 * Each encoder has at most one connector (since we always steal
+ 		 * it away), so we won't call ->mode_fixup twice.
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0012-drm-Check-whether-the-gamma-lut-has-changed-before-u.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0012-drm-Check-whether-the-gamma-lut-has-changed-before-u.patch
new file mode 100644
index 00000000..808149b5
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0012-drm-Check-whether-the-gamma-lut-has-changed-before-u.patch
@@ -0,0 +1,30 @@
+From 6030529dd021bc882eb9ade9eec009c77c40316e Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 2 Nov 2021 16:01:36 +0000
+Subject: [PATCH 012/697] drm: Check whether the gamma lut has changed before
+ updating
+
+drm_crtc_legacy_gamma_set updates the gamma_lut blob unconditionally,
+which leads to unnecessary reprogramming of hardware.
+
+Check whether the blob contents has actually changed before
+signalling that it has been updated.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/drm_color_mgmt.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_color_mgmt.c
++++ b/drivers/gpu/drm/drm_color_mgmt.c
+@@ -330,7 +330,9 @@ static int drm_crtc_legacy_gamma_set(str
+ 	replaced = drm_property_replace_blob(&crtc_state->degamma_lut,
+ 					     use_gamma_lut ? NULL : blob);
+ 	replaced |= drm_property_replace_blob(&crtc_state->ctm, NULL);
+-	replaced |= drm_property_replace_blob(&crtc_state->gamma_lut,
++	if (!crtc_state->gamma_lut || !crtc_state->gamma_lut->data ||
++	    memcmp(crtc_state->gamma_lut->data, blob_data, blob->length))
++		replaced |= drm_property_replace_blob(&crtc_state->gamma_lut,
+ 					      use_gamma_lut ? blob : NULL);
+ 	crtc_state->color_mgmt_changed |= replaced;
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0013-drm-dsi-Document-the-meaning-and-spec-references-for.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0013-drm-dsi-Document-the-meaning-and-spec-references-for.patch
new file mode 100644
index 00000000..75f912e7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0013-drm-dsi-Document-the-meaning-and-spec-references-for.patch
@@ -0,0 +1,76 @@
+From 4d523d624f8ac39c56c431d411750c11492d5dbe Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 17 Dec 2021 13:36:52 +0000
+Subject: [PATCH 013/697] drm/dsi: Document the meaning and spec references for
+ MIPI_DSI_MODE_*
+
+The MIPI_DSI_MODE_* flags have fairly terse descriptions and no reference
+to the DSI specification as to their exact meaning. Usage has therefore
+been rather fluid.
+
+Extend the descriptions and provide references to the part of the
+MIPI DSI specification regarding what they mean.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ include/drm/drm_mipi_dsi.h | 38 ++++++++++++++++++++++++++------------
+ 1 file changed, 26 insertions(+), 12 deletions(-)
+
+--- a/include/drm/drm_mipi_dsi.h
++++ b/include/drm/drm_mipi_dsi.h
+@@ -114,29 +114,43 @@ struct mipi_dsi_host *of_find_mipi_dsi_h
+ 
+ /* DSI mode flags */
+ 
+-/* video mode */
++/* Video mode display.
++ * Not set denotes a command mode display.
++ */
+ #define MIPI_DSI_MODE_VIDEO		BIT(0)
+-/* video burst mode */
++/* Video burst mode.
++ * Link frequency to be configured via platform configuration.
++ * This should always be set in conjunction with MIPI_DSI_MODE_VIDEO.
++ * (DSI spec V1.1 8.11.4)
++ */
+ #define MIPI_DSI_MODE_VIDEO_BURST	BIT(1)
+-/* video pulse mode */
++/* Video pulse mode.
++ * Not set denotes sync event mode. (DSI spec V1.1 8.11.2)
++ */
+ #define MIPI_DSI_MODE_VIDEO_SYNC_PULSE	BIT(2)
+-/* enable auto vertical count mode */
++/* Enable auto vertical count mode */
+ #define MIPI_DSI_MODE_VIDEO_AUTO_VERT	BIT(3)
+-/* enable hsync-end packets in vsync-pulse and v-porch area */
++/* Enable hsync-end packets in vsync-pulse and v-porch area */
+ #define MIPI_DSI_MODE_VIDEO_HSE		BIT(4)
+-/* disable hfront-porch area */
++/* Transmit NULL packets or LP mode during hfront-porch area.
++ * Not set denotes sending a blanking packet instead. (DSI spec V1.1 8.11.1)
++ */
+ #define MIPI_DSI_MODE_VIDEO_NO_HFP	BIT(5)
+-/* disable hback-porch area */
++/* Transmit NULL packets or LP mode during hback-porch area.
++ * Not set denotes sending a blanking packet instead. (DSI spec V1.1 8.11.1)
++ */
+ #define MIPI_DSI_MODE_VIDEO_NO_HBP	BIT(6)
+-/* disable hsync-active area */
++/* Transmit NULL packets or LP mode during hsync-active area.
++ * Not set denotes sending a blanking packet instead. (DSI spec V1.1 8.11.1)
++ */
+ #define MIPI_DSI_MODE_VIDEO_NO_HSA	BIT(7)
+-/* flush display FIFO on vsync pulse */
++/* Flush display FIFO on vsync pulse */
+ #define MIPI_DSI_MODE_VSYNC_FLUSH	BIT(8)
+-/* disable EoT packets in HS mode */
++/* Disable EoT packets in HS mode. (DSI spec V1.1 8.1)  */
+ #define MIPI_DSI_MODE_NO_EOT_PACKET	BIT(9)
+-/* device supports non-continuous clock behavior (DSI spec 5.6.1) */
++/* Device supports non-continuous clock behavior (DSI spec V1.1 5.6.1) */
+ #define MIPI_DSI_CLOCK_NON_CONTINUOUS	BIT(10)
+-/* transmit data in low power */
++/* Transmit data in low power */
+ #define MIPI_DSI_MODE_LPM		BIT(11)
+ /* transmit data ending at the same time for all lanes within one hsync */
+ #define MIPI_DSI_HS_PKT_END_ALIGNED	BIT(12)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0014-drm-bridge-tc358762-Ignore-EPROBE_DEFER-when-logging.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0014-drm-bridge-tc358762-Ignore-EPROBE_DEFER-when-logging.patch
new file mode 100644
index 00000000..b96ffd59
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0014-drm-bridge-tc358762-Ignore-EPROBE_DEFER-when-logging.patch
@@ -0,0 +1,25 @@
+From 5be301d72c1923bf6fbcf43f6dea728f50702cee Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 20 Jan 2022 17:29:36 +0000
+Subject: [PATCH 014/697] drm/bridge: tc358762: Ignore EPROBE_DEFER when
+ logging errors
+
+mipi_dsi_attach can fail due to resources not being available
+yet, therefore do not log error messages should they occur.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/bridge/tc358762.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/bridge/tc358762.c
++++ b/drivers/gpu/drm/bridge/tc358762.c
+@@ -294,7 +294,7 @@ static int tc358762_probe(struct mipi_ds
+ 	ret = mipi_dsi_attach(dsi);
+ 	if (ret < 0) {
+ 		drm_bridge_remove(&ctx->bridge);
+-		dev_err(dev, "failed to attach dsi\n");
++		dev_err_probe(dev, ret, "failed to attach dsi\n");
+ 	}
+ 
+ 	return ret;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0015-drm-Add-chroma-siting-properties.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0015-drm-Add-chroma-siting-properties.patch
new file mode 100644
index 00000000..6f3fa858
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0015-drm-Add-chroma-siting-properties.patch
@@ -0,0 +1,170 @@
+From d234bb9caf5309340b7afdb7e8bf6f8ae346eab8 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Wed, 26 Jan 2022 15:58:13 +0000
+Subject: [PATCH 015/697] drm: Add chroma siting properties
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/gpu/drm/drm_atomic_state_helper.c | 14 +++++++++
+ drivers/gpu/drm/drm_atomic_uapi.c         |  8 +++++
+ drivers/gpu/drm/drm_color_mgmt.c          | 36 +++++++++++++++++++++++
+ include/drm/drm_color_mgmt.h              |  3 ++
+ include/drm/drm_plane.h                   | 35 ++++++++++++++++++++--
+ 5 files changed, 94 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/drm_atomic_state_helper.c
++++ b/drivers/gpu/drm/drm_atomic_state_helper.c
+@@ -267,6 +267,20 @@ void __drm_atomic_helper_plane_state_res
+ 			plane_state->color_range = val;
+ 	}
+ 
++	if (plane->chroma_siting_h_property) {
++		if (!drm_object_property_get_default_value(&plane->base,
++							   plane->chroma_siting_h_property,
++							   &val))
++			plane_state->chroma_siting_h = val;
++	}
++
++	if (plane->chroma_siting_v_property) {
++		if (!drm_object_property_get_default_value(&plane->base,
++							   plane->chroma_siting_v_property,
++							   &val))
++			plane_state->chroma_siting_v = val;
++	}
++
+ 	if (plane->zpos_property) {
+ 		if (!drm_object_property_get_default_value(&plane->base,
+ 							   plane->zpos_property,
+--- a/drivers/gpu/drm/drm_atomic_uapi.c
++++ b/drivers/gpu/drm/drm_atomic_uapi.c
+@@ -538,6 +538,10 @@ static int drm_atomic_plane_set_property
+ 		state->color_encoding = val;
+ 	} else if (property == plane->color_range_property) {
+ 		state->color_range = val;
++	} else if (property == plane->chroma_siting_h_property) {
++		state->chroma_siting_h = val;
++	} else if (property == plane->chroma_siting_v_property) {
++		state->chroma_siting_v = val;
+ 	} else if (property == config->prop_fb_damage_clips) {
+ 		ret = drm_property_replace_blob_from_id(dev,
+ 					&state->fb_damage_clips,
+@@ -620,6 +624,10 @@ drm_atomic_plane_get_property(struct drm
+ 		*val = state->color_encoding;
+ 	} else if (property == plane->color_range_property) {
+ 		*val = state->color_range;
++	} else if (property == plane->chroma_siting_h_property) {
++		*val = state->chroma_siting_h;
++	} else if (property == plane->chroma_siting_v_property) {
++		*val = state->chroma_siting_v;
+ 	} else if (property == config->prop_fb_damage_clips) {
+ 		*val = (state->fb_damage_clips) ?
+ 			state->fb_damage_clips->base.id : 0;
+--- a/drivers/gpu/drm/drm_color_mgmt.c
++++ b/drivers/gpu/drm/drm_color_mgmt.c
+@@ -591,6 +591,42 @@ int drm_plane_create_color_properties(st
+ EXPORT_SYMBOL(drm_plane_create_color_properties);
+ 
+ /**
++ * drm_plane_create_chroma_siting_properties - chroma siting related plane properties
++ * @plane: plane object
++ *
++ * Create and attach plane specific CHROMA_SITING
++ * properties to @plane.
++ */
++int drm_plane_create_chroma_siting_properties(struct drm_plane *plane,
++						int32_t default_chroma_siting_h,
++						int32_t default_chroma_siting_v)
++{
++	struct drm_device *dev = plane->dev;
++	struct drm_property *prop;
++
++	prop = drm_property_create_range(dev, 0, "CHROMA_SITING_H",
++					0, 1<<16);
++	if (!prop)
++		return -ENOMEM;
++	plane->chroma_siting_h_property = prop;
++	drm_object_attach_property(&plane->base, prop, default_chroma_siting_h);
++
++	prop = drm_property_create_range(dev, 0, "CHROMA_SITING_V",
++					0, 1<<16);
++	if (!prop)
++		return -ENOMEM;
++	plane->chroma_siting_v_property = prop;
++	drm_object_attach_property(&plane->base, prop, default_chroma_siting_v);
++
++	if (plane->state) {
++		plane->state->chroma_siting_h = default_chroma_siting_h;
++		plane->state->chroma_siting_v = default_chroma_siting_v;
++	}
++	return 0;
++}
++EXPORT_SYMBOL(drm_plane_create_chroma_siting_properties);
++
++/**
+  * drm_color_lut_check - check validity of lookup table
+  * @lut: property blob containing LUT to check
+  * @tests: bitmask of tests to run
+--- a/include/drm/drm_color_mgmt.h
++++ b/include/drm/drm_color_mgmt.h
+@@ -91,6 +91,9 @@ int drm_plane_create_color_properties(st
+ 				      enum drm_color_encoding default_encoding,
+ 				      enum drm_color_range default_range);
+ 
++int drm_plane_create_chroma_siting_properties(struct drm_plane *plane,
++						int32_t default_chroma_siting_h, int32_t default_chroma_siting_v);
++
+ /**
+  * enum drm_color_lut_tests - hw-specific LUT tests to perform
+  *
+--- a/include/drm/drm_plane.h
++++ b/include/drm/drm_plane.h
+@@ -184,6 +184,24 @@ struct drm_plane_state {
+ 	enum drm_color_range color_range;
+ 
+ 	/**
++	 * @chroma_siting_h:
++	 *
++	 * Location of chroma samples horizontally compared to luma
++	 * 0 means chroma is sited with left luma
++	 * 0x8000 is interstitial. 0x10000 is sited with right luma
++	 */
++	int32_t chroma_siting_h;
++
++	/**
++	 * @chroma_siting_v:
++	 *
++	 * Location of chroma samples vertically compared to luma
++	 * 0 means chroma is sited with top luma
++	 * 0x8000 is interstitial. 0x10000 is sited with bottom luma
++	 */
++	int32_t chroma_siting_v;
++
++	/**
+ 	 * @fb_damage_clips:
+ 	 *
+ 	 * Blob representing damage (area in plane framebuffer that changed
+@@ -783,9 +801,22 @@ struct drm_plane {
+ 	struct drm_property *hotspot_y_property;
+ 
+ 	/**
+-	 * @kmsg_panic: Used to register a panic notifier for this plane
++	 * @chroma_siting_h_property:
++	 *
++	 * Optional "CHROMA_SITING_H" property for specifying
++	 * chroma siting for YUV formats.
++	 * See drm_plane_create_chroma_siting_properties().
++	 */
++	struct drm_property *chroma_siting_h_property;
++
++	/**
++	 * @chroma_siting_v_property:
++	 *
++	 * Optional "CHROMA_SITING_V" property for specifying
++	 * chroma siting for YUV formats.
++	 * See drm_plane_create_chroma_siting_properties().
+ 	 */
+-	struct kmsg_dumper kmsg_panic;
++	struct drm_property *chroma_siting_v_property;
+ };
+ 
+ #define obj_to_plane(x) container_of(x, struct drm_plane, base)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0016-drm-atomic-helpers-remove-legacy_cursor_update-hacks.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0016-drm-atomic-helpers-remove-legacy_cursor_update-hacks.patch
new file mode 100644
index 00000000..f0814c06
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0016-drm-atomic-helpers-remove-legacy_cursor_update-hacks.patch
@@ -0,0 +1,121 @@
+From fa34363447ef39ae5b02c350ae2650cd4c1308f6 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Fri, 23 Oct 2020 14:39:23 +0200
+Subject: [PATCH 016/697] drm/atomic-helpers: remove legacy_cursor_update hacks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The stuff never really worked, and leads to lots of fun because it
+out-of-order frees atomic states. Which upsets KASAN, among other
+things.
+
+For async updates we now have a more solid solution with the
+->atomic_async_check and ->atomic_async_commit hooks. Support for that
+for msm and vc4 landed. nouveau and i915 have their own commit
+routines, doing something similar.
+
+For everyone else it's probably better to remove the use-after-free
+bug, and encourage folks to use the async support instead. The
+affected drivers which register a legacy cursor plane and don't either
+use the new async stuff or their own commit routine are: amdgpu,
+atmel, mediatek, qxl, rockchip, sti, sun4i, tegra, virtio, and vmwgfx.
+
+Inspired by an amdgpu bug report.
+
+v2: Drop RFC, I think with amdgpu converted over to use
+atomic_async_check/commit done in
+
+commit 674e78acae0dfb4beb56132e41cbae5b60f7d662
+Author: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Date:   Wed Dec 5 14:59:07 2018 -0500
+
+    drm/amd/display: Add fast path for cursor plane updates
+
+we don't have any driver anymore where we have userspace expecting
+solid legacy cursor support _and_ they are using the atomic helpers in
+their fully glory. So we can retire this.
+
+v3: Paper over msm and i915 regression. The complete_all is the only
+thing missing afaict.
+
+v4: Rebased on recent kernel, added extra link for vc4 bug.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=199425
+Link: https://lore.kernel.org/all/20220221134155.125447-9-maxime@cerno.tech/
+Cc: mikita.lipski@amd.com
+Cc: Michel Dänzer <michel@daenzer.net>
+Cc: harry.wentland@amd.com
+Cc: Rob Clark <robdclark@gmail.com>
+Cc: "Kazlauskas, Nicholas" <nicholas.kazlauskas@amd.com>
+Tested-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/drm_atomic_helper.c          | 13 -------------
+ drivers/gpu/drm/i915/display/intel_display.c | 13 +++++++++++++
+ drivers/gpu/drm/msm/msm_atomic.c             |  2 ++
+ 3 files changed, 15 insertions(+), 13 deletions(-)
+
+--- a/drivers/gpu/drm/drm_atomic_helper.c
++++ b/drivers/gpu/drm/drm_atomic_helper.c
+@@ -1656,13 +1656,6 @@ drm_atomic_helper_wait_for_vblanks(struc
+ 	int i, ret;
+ 	unsigned int crtc_mask = 0;
+ 
+-	 /*
+-	  * Legacy cursor ioctls are completely unsynced, and userspace
+-	  * relies on that (by doing tons of cursor updates).
+-	  */
+-	if (old_state->legacy_cursor_update)
+-		return;
+-
+ 	for_each_oldnew_crtc_in_state(old_state, crtc, old_crtc_state, new_crtc_state, i) {
+ 		if (!new_crtc_state->active)
+ 			continue;
+@@ -2311,12 +2304,6 @@ int drm_atomic_helper_setup_commit(struc
+ 			complete_all(&commit->flip_done);
+ 			continue;
+ 		}
+-
+-		/* Legacy cursor updates are fully unsynced. */
+-		if (state->legacy_cursor_update) {
+-			complete_all(&commit->flip_done);
+-			continue;
+-		}
+ 
+ 		if (!new_crtc_state->event) {
+ 			commit->event = kzalloc(sizeof(*commit->event),
+--- a/drivers/gpu/drm/i915/display/intel_display.c
++++ b/drivers/gpu/drm/i915/display/intel_display.c
+@@ -7648,6 +7648,19 @@ int intel_atomic_commit(struct drm_devic
+ 				state->base.legacy_cursor_update = false;
+ 	}
+ 
++	/*
++	 * FIXME: Cut over to (async) commit helpers instead of hand-rolling
++	 * everything.
++	 */
++	if (state->base.legacy_cursor_update) {
++		struct intel_crtc_state *new_crtc_state;
++		struct intel_crtc *crtc;
++		int i;
++
++		for_each_new_intel_crtc_in_state(state, crtc, new_crtc_state, i)
++			complete_all(&new_crtc_state->uapi.commit->flip_done);
++	}
++
+ 	ret = intel_atomic_prepare_commit(state);
+ 	if (ret) {
+ 		drm_dbg_atomic(&dev_priv->drm,
+--- a/drivers/gpu/drm/msm/msm_atomic.c
++++ b/drivers/gpu/drm/msm/msm_atomic.c
+@@ -242,6 +242,8 @@ void msm_atomic_commit_tail(struct drm_a
+ 		/* async updates are limited to single-crtc updates: */
+ 		WARN_ON(crtc_mask != drm_crtc_mask(async_crtc));
+ 
++		complete_all(&async_crtc->state->commit->flip_done);
++
+ 		/*
+ 		 * Start timer if we don't already have an update pending
+ 		 * on this crtc:
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0017-drm-atomic-If-margins-are-updated-update-all-planes.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0017-drm-atomic-If-margins-are-updated-update-all-planes.patch
new file mode 100644
index 00000000..ee130181
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0017-drm-atomic-If-margins-are-updated-update-all-planes.patch
@@ -0,0 +1,60 @@
+From 5350800c62c07a2f1e90332039a09d3be55b960b Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 1 Apr 2022 17:10:37 +0100
+Subject: [PATCH 017/697] drm/atomic: If margins are updated, update all
+ planes.
+
+Margins may be implemented by scaling the planes, but as there
+is no way of intercepting the set_property for a standard property,
+and all planes are checked in drm_atomic_check_only before the
+connectors, there's now way to add the planes into the state
+from the driver.
+
+If the margin properties change, add all corresponding planes to
+the state.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/drm_atomic_uapi.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/gpu/drm/drm_atomic_uapi.c
++++ b/drivers/gpu/drm/drm_atomic_uapi.c
+@@ -679,6 +679,7 @@ static int drm_atomic_connector_set_prop
+ {
+ 	struct drm_device *dev = connector->dev;
+ 	struct drm_mode_config *config = &dev->mode_config;
++	bool margins_updated = false;
+ 	bool replaced = false;
+ 	int ret;
+ 
+@@ -707,12 +708,16 @@ static int drm_atomic_connector_set_prop
+ 		state->tv.subconnector = val;
+ 	} else if (property == config->tv_left_margin_property) {
+ 		state->tv.margins.left = val;
++		margins_updated = true;
+ 	} else if (property == config->tv_right_margin_property) {
+ 		state->tv.margins.right = val;
++		margins_updated = true;
+ 	} else if (property == config->tv_top_margin_property) {
+ 		state->tv.margins.top = val;
++		margins_updated = true;
+ 	} else if (property == config->tv_bottom_margin_property) {
+ 		state->tv.margins.bottom = val;
++		margins_updated = true;
+ 	} else if (property == config->legacy_tv_mode_property) {
+ 		state->tv.legacy_mode = val;
+ 	} else if (property == config->tv_mode_property) {
+@@ -797,6 +802,12 @@ static int drm_atomic_connector_set_prop
+ 		return -EINVAL;
+ 	}
+ 
++	if (margins_updated && state->crtc) {
++		ret = drm_atomic_add_affected_planes(state->state, state->crtc);
++
++		return ret;
++	}
++
+ 	return 0;
+ }
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0018-arm64-setup-Fix-build-warning.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0018-arm64-setup-Fix-build-warning.patch
new file mode 100644
index 00000000..bafeb767
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0018-arm64-setup-Fix-build-warning.patch
@@ -0,0 +1,24 @@
+From 4cdcf8e2c3eb6acfce367b06f0e3a82529ad8a20 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Mon, 6 Jun 2022 11:02:16 +0200
+Subject: [PATCH 018/697] arm64: setup: Fix build warning
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ arch/arm64/kernel/setup.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/kernel/setup.c
++++ b/arch/arm64/kernel/setup.c
+@@ -214,9 +214,9 @@ static void __init request_standard_reso
+ 	size_t res_size;
+ 
+ 	kernel_code.start   = __pa_symbol(_stext);
+-	kernel_code.end     = __pa_symbol(__init_begin - 1);
++	kernel_code.end     = __pa_symbol(__init_begin) - 1;
+ 	kernel_data.start   = __pa_symbol(_sdata);
+-	kernel_data.end     = __pa_symbol(_end - 1);
++	kernel_data.end     = __pa_symbol(_end) - 1;
+ 	insert_resource(&iomem_resource, &kernel_code);
+ 	insert_resource(&iomem_resource, &kernel_data);
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0019-BCM2708-Add-core-Device-Tree-support.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0019-BCM2708-Add-core-Device-Tree-support.patch
new file mode 100644
index 00000000..d9774125
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0019-BCM2708-Add-core-Device-Tree-support.patch
@@ -0,0 +1,48839 @@
+From 5f6c0206488177a698f006686b693eec62f8fe42 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Mon, 30 Sep 2024 16:40:14 +0100
+Subject: [PATCH 019/697] BCM2708: Add core Device Tree support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Add the bare minimum needed to boot BCM2708 from a Device Tree.
+
+Signed-off-by: Noralf Tronnes <notro@tronnes.org>
+
+BCM2708: DT: change 'axi' nodename to 'soc'
+
+Change DT node named 'axi' to 'soc' so it matches ARCH_BCM2835.
+The VC4 bootloader fills in certain properties in the 'axi' subtree,
+but since this is part of an upstreaming effort, the name is changed.
+
+Signed-off-by: Noralf Tronnes notro@tronnes.org
+
+BCM2708_DT: Correct length of the peripheral space
+
+Use dts-dirs feature for overlays.
+
+The kernel makefiles have a dts-dirs target that is for vendor subdirectories.
+
+Using this fixes the install_dtbs target, which previously did not install the overlays.
+
+BCM270X_DT: configure I2S DMA channels
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+BCM270X_DT: switch to bcm2835-i2s
+
+I2S soundcard drivers with proper devicetree support (i.e. not linking
+to the cpu_dai/platform via name but to cpu/platform via of_node)
+will work out of the box without any modifications.
+
+When the kernel is compiled without devicetree support the platform
+code will instantiate the bcm2708-i2s driver and I2S soundcard drivers
+will link to it via name, as before.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+SDIO-overlay: add poll_once-boolean parameter
+
+Add paramter to toggle sdio-device-polling
+done every second or once at boot-time.
+
+Signed-off-by: Patrick Boettcher <patrick.boettcher@posteo.de>
+
+BCM270X_DT: Make mmc overlay compatible with current firmware
+
+The original DT overlay logic followed a merge-then-patch procedure,
+i.e. parameters are applied to the loaded overlay before the overlay
+is merged into the base DTB. This sequence has been changed to
+patch-then-merge, in order to support parameterised node names, and
+to protect against bad overlays. As a result, overrides (parameters)
+must only target labels in the overlay, but the overlay can obviously target nodes in the base DTB.
+
+mmc-overlay.dts (that switches back to the original mmc sdcard
+driver) is the only overlay violating that rule, and this patch
+fixes it.
+
+bcm270x_dt: Use the sdhost MMC controller by default
+
+The "mmc" overlay reverts to using the other controller.
+
+squash: Add cprman to dt
+
+BCM270X_DT: Use clk_core for I2C interfaces
+
+BCM270X_DT: Use bcm283x.dtsi, bcm2835.dtsi and bcm2836.dtsi
+
+The mainline Device Tree files are quite close to downstream now.
+Let's use bcm283x.dtsi, bcm2835.dtsi and bcm2836.dtsi as base files
+for our dts files.
+
+Mainline dts files are based on these files:
+
+          bcm2835-rpi.dtsi
+  bcm2835.dtsi    bcm2836.dtsi
+          bcm283x.dtsi
+
+Current downstream are based on these:
+
+  bcm2708.dtsi    bcm2709.dtsi    bcm2710.dtsi
+             bcm2708_common.dtsi
+
+This patch introduces this dependency:
+
+  bcm2708.dtsi    bcm2709.dtsi
+          bcm2708-rpi.dtsi
+          bcm270x.dtsi
+  bcm2835.dtsi    bcm2836.dtsi
+          bcm283x.dtsi
+
+And:
+          bcm2710.dtsi
+          bcm2708-rpi.dtsi
+          bcm270x.dtsi
+          bcm283x.dtsi
+
+bcm270x.dtsi contains the downstream bcm283x.dtsi diff.
+bcm2708-rpi.dtsi is the downstream version of bcm2835-rpi.dtsi.
+
+Other changes:
+- The led node has moved from /soc/leds to /leds. This is not a problem
+  since the label is used to reference it.
+- The clk_osc reg property changes from 6 to 3.
+- The gpu nodes has their interrupt property set in the base file.
+- the clocks label does not point to the /clocks node anymore, but
+  points to the cprman node. This is not a problem since the overlays
+  that use the clock node refer to it directly: target-path = "/clocks";
+- some nodes now have 2 labels since mainline and downstream differs in
+  this respect: cprman/clocks, spi0/spi, gpu/vc4.
+- some nodes doesn't have an explicit status = "okay" since they're not
+  disabled in the base file: watchdog and random.
+- gpiomem doesn't need an explicit status = "okay".
+- bcm2708-rpi-cm.dts got the hpd-gpios property from bcm2708_common.dtsi,
+  it's now set directly in that file.
+- bcm2709-rpi-2-b.dts has the timer node moved from /soc/timer to /timer.
+- Removed clock-frequency property on the bcm{2709,2710}.dtsi timer nodes.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+BCM270X_DT: Use raspberrypi-power to turn on USB power
+
+Use the raspberrypi-power driver to turn on USB power.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+BCM270X_DT: Add a .dtbo target, use for overlays
+
+Change the filenames and extensions to keep the pre-DDT style of
+overlay (<name>-overlay.dtb) distinct from new ones that use a
+different style of local fixups (<name>.dtbo), and to match other
+platforms.
+
+The RPi firmware uses the DDTK trailer atom to choose which type of
+overlay to use for each kernel.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+BCM270X_DT: Don't generate "linux,phandle" props
+
+The EPAPR standard says to use "phandle" properties to store phandles,
+rather than the deprecated "linux,phandle" version. By default, dtc
+generates both, but adding "-H epapr" causes it to only generate
+"phandle"s, saving some space and clutter.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+BCM270X_DT: Add overlay for enc28j60 on SPI2
+
+Works on SPI2 for compute module
+
+BCM270X_DT: Add midi-uart0 overlay
+
+MIDI requires 31.25kbaud, a baudrate unsupported by Linux. The
+midi-uart0 overlay configures uart0 (ttyAMA0) to use a fake clock
+so that requesting 38.4kbaud actually gets 31.25kbaud.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+BCM270X_DT: Add i2c-sensor overlay
+
+The i2c-sensor overlay is a container for various pressure and
+temperature sensors, currently bmp085 and bmp280. The standalone
+bmp085_i2c-sensor overlay is now deprecated.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+BCM270X_DT: overlays/*-overlay.dtb -> overlays/*.dtbo (#1752)
+
+We now create overlays as .dtbo files.
+
+build: support for .dtbo files for dtb overlays
+
+Kernel 4.4.6+ on RaspberryPi support .dtbo files for overlays, instead of .dtb.
+Patch the kernel, which has faulty rules to generate .dtbo the way yocto does
+
+Signed-off-by: Herve Jourdain <herve.jourdain@neuf.fr>
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+
+BCM270X: Drop position requirement for CMA in VC4 overlay.
+
+No longer necessary since 2aefcd576195a739a7a256099571c9c4a401005f,
+and will probably let peeople that want to choose a larger CMA
+allocation (particularly on pi0/1).
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+
+BCM270X_DT: RPi Device Tree tidy
+
+Use the upstream sdhost node, add thermal-zones, and factor out some
+common elements.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+kbuild: Silence unhelpful DTC warnings
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+BCM270X_DT: DT build rules no longer arch-specific
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+kbuild: Silence unavoidable dtc overlay warnings
+
+Much effort has been put into finding ways to avoid warnings from dtc
+about overlays, usually to do with the presence of #address-cells and
+size-cells, but not exclusively so. Since the issues being warned about
+are harmless, suppress the warnings to declutter the build output and
+to avoid alarming users.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+overlays: Suppress another dtc warning
+
+I'm sure the dtc warnings mean well, but overlays don't have enough
+context for the checkers to give meaningful results.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+overlays: Use dtbs-list for overlay installation
+
+Update the overlay build rules to use the dtbs-list mechanism. Also
+include the README, and don't set the executable bits.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/Makefile                    |    5 +
+ arch/arm/boot/dts/broadcom/Makefile           |   35 +
+ .../boot/dts/broadcom/bcm2708-rpi-b-plus.dts  |  210 +
+ .../boot/dts/broadcom/bcm2708-rpi-b-rev1.dts  |  223 +
+ arch/arm/boot/dts/broadcom/bcm2708-rpi-b.dts  |  198 +
+ .../arm/boot/dts/broadcom/bcm2708-rpi-bt.dtsi |   42 +
+ arch/arm/boot/dts/broadcom/bcm2708-rpi-cm.dts |  174 +
+ .../arm/boot/dts/broadcom/bcm2708-rpi-cm.dtsi |   23 +
+ .../boot/dts/broadcom/bcm2708-rpi-zero-w.dts  |  250 +
+ .../boot/dts/broadcom/bcm2708-rpi-zero.dts    |  189 +
+ arch/arm/boot/dts/broadcom/bcm2708-rpi.dtsi   |   63 +
+ arch/arm/boot/dts/broadcom/bcm2708.dtsi       |   19 +
+ .../arm/boot/dts/broadcom/bcm2709-rpi-2-b.dts |  204 +
+ .../arm/boot/dts/broadcom/bcm2709-rpi-cm2.dts |  215 +
+ arch/arm/boot/dts/broadcom/bcm2709-rpi.dtsi   |    8 +
+ arch/arm/boot/dts/broadcom/bcm2709.dtsi       |   29 +
+ arch/arm/boot/dts/broadcom/bcm270x-rpi.dtsi   |  201 +
+ arch/arm/boot/dts/broadcom/bcm270x.dtsi       |  264 +
+ .../arm/boot/dts/broadcom/bcm2710-rpi-2-b.dts |  204 +
+ .../dts/broadcom/bcm2710-rpi-3-b-plus.dts     |  295 +
+ .../arm/boot/dts/broadcom/bcm2710-rpi-3-b.dts |  293 +
+ .../arm/boot/dts/broadcom/bcm2710-rpi-cm3.dts |  215 +
+ .../dts/broadcom/bcm2710-rpi-zero-2-w.dts     |  257 +
+ .../boot/dts/broadcom/bcm2710-rpi-zero-2.dts  |    1 +
+ arch/arm/boot/dts/broadcom/bcm2710.dtsi       |   32 +
+ .../arm/boot/dts/broadcom/bcm2711-rpi-4-b.dts |  266 +-
+ .../arm/boot/dts/broadcom/bcm2711-rpi-400.dts |   49 +-
+ .../arm/boot/dts/broadcom/bcm2711-rpi-cm4.dts |  499 ++
+ .../boot/dts/broadcom/bcm2711-rpi-cm4s.dts    |  293 +
+ .../arm/boot/dts/broadcom/bcm2711-rpi-ds.dtsi |  562 ++
+ arch/arm/boot/dts/broadcom/bcm2711-rpi.dtsi   |   13 +
+ arch/arm/boot/dts/broadcom/bcm2711.dtsi       |    2 +-
+ .../arm/boot/dts/broadcom/bcm271x-rpi-bt.dtsi |   42 +
+ .../dts/broadcom/bcm283x-rpi-csi0-2lane.dtsi  |    4 +
+ .../dts/broadcom/bcm283x-rpi-csi1-2lane.dtsi  |    4 +
+ .../dts/broadcom/bcm283x-rpi-csi1-4lane.dtsi  |    4 +
+ .../broadcom/bcm283x-rpi-i2c0mux_0_28.dtsi    |    4 +
+ .../broadcom/bcm283x-rpi-i2c0mux_0_44.dtsi    |    4 +
+ arch/arm/boot/dts/broadcom/bcm283x.dtsi       |    8 +-
+ arch/arm/boot/dts/overlays/Makefile           |  349 ++
+ arch/arm/boot/dts/overlays/README             | 5558 +++++++++++++++++
+ .../arm/boot/dts/overlays/act-led-overlay.dts |   28 +
+ .../dts/overlays/adafruit-st7735r-overlay.dts |   83 +
+ .../boot/dts/overlays/adafruit18-overlay.dts  |   55 +
+ .../dts/overlays/adau1977-adc-overlay.dts     |   40 +
+ .../dts/overlays/adau7002-simple-overlay.dts  |   52 +
+ .../arm/boot/dts/overlays/ads1015-overlay.dts |   98 +
+ .../arm/boot/dts/overlays/ads1115-overlay.dts |  135 +
+ .../arm/boot/dts/overlays/ads7846-overlay.dts |   89 +
+ .../boot/dts/overlays/adv7282m-overlay.dts    |   73 +
+ .../boot/dts/overlays/adv728x-m-overlay.dts   |   37 +
+ .../overlays/akkordion-iqdacplus-overlay.dts  |   49 +
+ .../allo-boss-dac-pcm512x-audio-overlay.dts   |   61 +
+ .../overlays/allo-boss2-dac-audio-overlay.dts |   57 +
+ .../dts/overlays/allo-digione-overlay.dts     |   44 +
+ .../allo-katana-dac-audio-overlay.dts         |   58 +
+ .../allo-piano-dac-pcm512x-audio-overlay.dts  |   54 +
+ ...o-piano-dac-plus-pcm512x-audio-overlay.dts |   57 +
+ arch/arm/boot/dts/overlays/anyspi-overlay.dts |  205 +
+ .../boot/dts/overlays/apds9960-overlay.dts    |   55 +
+ .../boot/dts/overlays/applepi-dac-overlay.dts |   57 +
+ .../dts/overlays/arducam-64mp-overlay.dts     |   97 +
+ arch/arm/boot/dts/overlays/arducam-64mp.dtsi  |   34 +
+ .../overlays/arducam-pivariety-overlay.dts    |  100 +
+ .../boot/dts/overlays/at86rf233-overlay.dts   |   57 +
+ .../overlays/audioinjector-addons-overlay.dts |   60 +
+ .../audioinjector-bare-i2s-overlay.dts        |   50 +
+ ...dioinjector-isolated-soundcard-overlay.dts |   55 +
+ .../overlays/audioinjector-ultra-overlay.dts  |   71 +
+ .../audioinjector-wm8731-audio-overlay.dts    |   39 +
+ .../dts/overlays/audiosense-pi-overlay.dts    |   82 +
+ .../boot/dts/overlays/audremap-overlay.dts    |   38 +
+ .../boot/dts/overlays/balena-fin-overlay.dts  |  125 +
+ .../boot/dts/overlays/bcm2712d0-overlay.dts   |   75 +
+ .../dts/overlays/camera-mux-2port-overlay.dts |  545 ++
+ .../dts/overlays/camera-mux-4port-overlay.dts |  954 +++
+ .../arm/boot/dts/overlays/cap1106-overlay.dts |   52 +
+ .../boot/dts/overlays/chipcap2-overlay.dts    |   66 +
+ .../boot/dts/overlays/chipdip-dac-overlay.dts |   46 +
+ .../dts/overlays/cirrus-wm5102-overlay.dts    |  172 +
+ .../dts/overlays/cm-swap-i2c0-overlay.dts     |   27 +
+ arch/arm/boot/dts/overlays/cma-overlay.dts    |   36 +
+ .../crystalfontz-cfa050_pi_m-overlay.dts      |  124 +
+ .../dts/overlays/cutiepi-panel-overlay.dts    |  117 +
+ .../boot/dts/overlays/dacberry400-overlay.dts |   71 +
+ arch/arm/boot/dts/overlays/dht11-overlay.dts  |   48 +
+ .../dts/overlays/dionaudio-kiwi-overlay.dts   |   39 +
+ .../dts/overlays/dionaudio-loco-overlay.dts   |   39 +
+ .../overlays/dionaudio-loco-v2-overlay.dts    |   49 +
+ .../boot/dts/overlays/disable-bt-overlay.dts  |   59 +
+ .../dts/overlays/disable-bt-pi5-overlay.dts   |   17 +
+ .../dts/overlays/disable-emmc2-overlay.dts    |   13 +
+ .../dts/overlays/disable-wifi-overlay.dts     |   20 +
+ .../dts/overlays/disable-wifi-pi5-overlay.dts |   13 +
+ arch/arm/boot/dts/overlays/dpi18-overlay.dts  |   39 +
+ .../boot/dts/overlays/dpi18cpadhi-overlay.dts |   26 +
+ arch/arm/boot/dts/overlays/dpi24-overlay.dts  |   39 +
+ arch/arm/boot/dts/overlays/draws-overlay.dts  |  208 +
+ .../arm/boot/dts/overlays/dwc-otg-overlay.dts |   14 +
+ arch/arm/boot/dts/overlays/dwc2-overlay.dts   |   26 +
+ .../boot/dts/overlays/edt-ft5406-overlay.dts  |   46 +
+ arch/arm/boot/dts/overlays/edt-ft5406.dtsi    |   49 +
+ .../boot/dts/overlays/enc28j60-overlay.dts    |   53 +
+ .../dts/overlays/enc28j60-spi2-overlay.dts    |   47 +
+ .../arm/boot/dts/overlays/exc3000-overlay.dts |   48 +
+ arch/arm/boot/dts/overlays/fbtft-overlay.dts  |  611 ++
+ .../boot/dts/overlays/fe-pi-audio-overlay.dts |   70 +
+ .../boot/dts/overlays/fsm-demo-overlay.dts    |  104 +
+ arch/arm/boot/dts/overlays/gc9a01-overlay.dts |  151 +
+ .../boot/dts/overlays/ghost-amp-overlay.dts   |  145 +
+ arch/arm/boot/dts/overlays/goodix-overlay.dts |   46 +
+ .../googlevoicehat-soundcard-overlay.dts      |   49 +
+ .../dts/overlays/gpio-charger-overlay.dts     |   42 +
+ .../boot/dts/overlays/gpio-fan-overlay.dts    |   89 +
+ .../boot/dts/overlays/gpio-hog-overlay.dts    |   27 +
+ .../arm/boot/dts/overlays/gpio-ir-overlay.dts |   49 +
+ .../boot/dts/overlays/gpio-ir-tx-overlay.dts  |   36 +
+ .../boot/dts/overlays/gpio-key-overlay.dts    |   48 +
+ .../boot/dts/overlays/gpio-led-overlay.dts    |   97 +
+ .../overlays/gpio-no-bank0-irq-overlay.dts    |   14 +
+ .../boot/dts/overlays/gpio-no-irq-overlay.dts |   14 +
+ .../dts/overlays/gpio-poweroff-overlay.dts    |   39 +
+ .../dts/overlays/gpio-shutdown-overlay.dts    |   86 +
+ arch/arm/boot/dts/overlays/hat_map.dts        |  124 +
+ .../dts/overlays/hd44780-i2c-lcd-overlay.dts  |   57 +
+ .../boot/dts/overlays/hd44780-lcd-overlay.dts |   46 +
+ .../hdmi-backlight-hwhack-gpio-overlay.dts    |   47 +
+ .../dts/overlays/hifiberry-adc-overlay.dts    |   45 +
+ .../dts/overlays/hifiberry-adc8x-overlay.dts  |   50 +
+ .../dts/overlays/hifiberry-amp-overlay.dts    |   39 +
+ .../dts/overlays/hifiberry-amp100-overlay.dts |   67 +
+ .../dts/overlays/hifiberry-amp3-overlay.dts   |   57 +
+ .../overlays/hifiberry-amp4pro-overlay.dts    |   63 +
+ .../dts/overlays/hifiberry-dac-overlay.dts    |   34 +
+ .../dts/overlays/hifiberry-dac8x-overlay.dts  |   50 +
+ .../overlays/hifiberry-dacplus-overlay.dts    |   68 +
+ .../hifiberry-dacplus-pro-overlay.dts         |   64 +
+ .../hifiberry-dacplus-std-overlay.dts         |   65 +
+ .../overlays/hifiberry-dacplusadc-overlay.dts |   72 +
+ .../hifiberry-dacplusadcpro-overlay.dts       |   72 +
+ .../overlays/hifiberry-dacplusdsp-overlay.dts |   34 +
+ .../overlays/hifiberry-dacplushd-overlay.dts  |   94 +
+ .../dts/overlays/hifiberry-digi-overlay.dts   |   41 +
+ .../overlays/hifiberry-digi-pro-overlay.dts   |   43 +
+ .../boot/dts/overlays/highperi-overlay.dts    |   63 +
+ arch/arm/boot/dts/overlays/hy28a-overlay.dts  |   93 +
+ .../boot/dts/overlays/hy28b-2017-overlay.dts  |  152 +
+ arch/arm/boot/dts/overlays/hy28b-overlay.dts  |  148 +
+ .../boot/dts/overlays/i-sabre-q2m-overlay.dts |   39 +
+ .../boot/dts/overlays/i2c-bcm2708-overlay.dts |   13 +
+ .../arm/boot/dts/overlays/i2c-fan-overlay.dts |  108 +
+ .../boot/dts/overlays/i2c-gpio-overlay.dts    |   47 +
+ .../arm/boot/dts/overlays/i2c-mux-overlay.dts |  183 +
+ .../dts/overlays/i2c-pwm-pca9685a-overlay.dts |   61 +
+ .../arm/boot/dts/overlays/i2c-rtc-common.dtsi |  367 ++
+ .../dts/overlays/i2c-rtc-gpio-overlay.dts     |   31 +
+ .../arm/boot/dts/overlays/i2c-rtc-overlay.dts |   42 +
+ .../boot/dts/overlays/i2c-sensor-common.dtsi  |  696 +++
+ .../boot/dts/overlays/i2c-sensor-overlay.dts  |   42 +
+ arch/arm/boot/dts/overlays/i2c0-overlay.dts   |   83 +
+ .../boot/dts/overlays/i2c0-pi5-overlay.dts    |   34 +
+ arch/arm/boot/dts/overlays/i2c1-overlay.dts   |   44 +
+ .../boot/dts/overlays/i2c1-pi5-overlay.dts    |   34 +
+ .../boot/dts/overlays/i2c2-pi5-overlay.dts    |   21 +
+ arch/arm/boot/dts/overlays/i2c3-overlay.dts   |   34 +
+ .../boot/dts/overlays/i2c3-pi5-overlay.dts    |   22 +
+ arch/arm/boot/dts/overlays/i2c4-overlay.dts   |   34 +
+ arch/arm/boot/dts/overlays/i2c5-overlay.dts   |   34 +
+ arch/arm/boot/dts/overlays/i2c6-overlay.dts   |   34 +
+ .../arm/boot/dts/overlays/i2s-dac-overlay.dts |   34 +
+ .../dts/overlays/i2s-gpio28-31-overlay.dts    |   18 +
+ .../dts/overlays/i2s-master-dac-overlay.dts   |   50 +
+ .../boot/dts/overlays/ilitek251x-overlay.dts  |   45 +
+ arch/arm/boot/dts/overlays/imx219-overlay.dts |   95 +
+ arch/arm/boot/dts/overlays/imx219.dtsi        |   27 +
+ arch/arm/boot/dts/overlays/imx258-overlay.dts |  137 +
+ arch/arm/boot/dts/overlays/imx258.dtsi        |   27 +
+ arch/arm/boot/dts/overlays/imx290-overlay.dts |   32 +
+ .../boot/dts/overlays/imx290_327-overlay.dtsi |  118 +
+ arch/arm/boot/dts/overlays/imx290_327.dtsi    |   24 +
+ arch/arm/boot/dts/overlays/imx296-overlay.dts |  120 +
+ arch/arm/boot/dts/overlays/imx327-overlay.dts |   33 +
+ arch/arm/boot/dts/overlays/imx378-overlay.dts |   17 +
+ arch/arm/boot/dts/overlays/imx462-overlay.dts |   39 +
+ arch/arm/boot/dts/overlays/imx477-overlay.dts |   17 +
+ .../boot/dts/overlays/imx477_378-overlay.dtsi |   98 +
+ arch/arm/boot/dts/overlays/imx477_378.dtsi    |   24 +
+ arch/arm/boot/dts/overlays/imx500-overlay.dts |  122 +
+ .../boot/dts/overlays/imx500-pi5-overlay.dts  |  127 +
+ arch/arm/boot/dts/overlays/imx500.dtsi        |   28 +
+ arch/arm/boot/dts/overlays/imx519-overlay.dts |   99 +
+ arch/arm/boot/dts/overlays/imx519.dtsi        |   34 +
+ arch/arm/boot/dts/overlays/imx708-overlay.dts |  111 +
+ arch/arm/boot/dts/overlays/imx708.dtsi        |   35 +
+ .../interludeaudio-analog-overlay.dts         |   73 +
+ .../interludeaudio-digital-overlay.dts        |   49 +
+ .../dts/overlays/iqaudio-codec-overlay.dts    |   42 +
+ .../boot/dts/overlays/iqaudio-dac-overlay.dts |   46 +
+ .../dts/overlays/iqaudio-dacplus-overlay.dts  |   49 +
+ .../iqaudio-digi-wm8804-audio-overlay.dts     |   47 +
+ arch/arm/boot/dts/overlays/iqs550-overlay.dts |   59 +
+ .../arm/boot/dts/overlays/irs1125-overlay.dts |   97 +
+ .../dts/overlays/jedec-spi-nor-overlay.dts    |  136 +
+ .../dts/overlays/justboom-both-overlay.dts    |   65 +
+ .../dts/overlays/justboom-dac-overlay.dts     |   46 +
+ .../dts/overlays/justboom-digi-overlay.dts    |   41 +
+ .../arm/boot/dts/overlays/ltc294x-overlay.dts |   86 +
+ .../boot/dts/overlays/max98357a-overlay.dts   |   84 +
+ .../boot/dts/overlays/maxtherm-overlay.dts    |  186 +
+ .../boot/dts/overlays/mbed-dac-overlay.dts    |   64 +
+ .../boot/dts/overlays/mcp23017-overlay.dts    |  103 +
+ .../boot/dts/overlays/mcp23s17-overlay.dts    |  732 +++
+ .../dts/overlays/mcp2515-can0-overlay.dts     |   73 +
+ .../dts/overlays/mcp2515-can1-overlay.dts     |   73 +
+ .../arm/boot/dts/overlays/mcp2515-overlay.dts |  156 +
+ .../boot/dts/overlays/mcp251xfd-overlay.dts   |  226 +
+ .../arm/boot/dts/overlays/mcp3008-overlay.dts |  205 +
+ .../arm/boot/dts/overlays/mcp3202-overlay.dts |  205 +
+ .../arm/boot/dts/overlays/mcp342x-overlay.dts |  164 +
+ .../dts/overlays/media-center-overlay.dts     |   86 +
+ .../boot/dts/overlays/merus-amp-overlay.dts   |   59 +
+ .../boot/dts/overlays/midi-uart0-overlay.dts  |   36 +
+ .../dts/overlays/midi-uart0-pi5-overlay.dts   |   35 +
+ .../boot/dts/overlays/midi-uart1-overlay.dts  |   43 +
+ .../dts/overlays/midi-uart1-pi5-overlay.dts   |   35 +
+ .../boot/dts/overlays/midi-uart2-overlay.dts  |   37 +
+ .../dts/overlays/midi-uart2-pi5-overlay.dts   |   35 +
+ .../boot/dts/overlays/midi-uart3-overlay.dts  |   38 +
+ .../dts/overlays/midi-uart3-pi5-overlay.dts   |   35 +
+ .../boot/dts/overlays/midi-uart4-overlay.dts  |   38 +
+ .../dts/overlays/midi-uart4-pi5-overlay.dts   |   35 +
+ .../boot/dts/overlays/midi-uart5-overlay.dts  |   38 +
+ .../boot/dts/overlays/minipitft13-overlay.dts |   70 +
+ .../boot/dts/overlays/miniuart-bt-overlay.dts |   83 +
+ .../dts/overlays/mipi-dbi-spi-overlay.dts     |  175 +
+ .../boot/dts/overlays/mlx90640-overlay.dts    |   22 +
+ arch/arm/boot/dts/overlays/mmc-overlay.dts    |   46 +
+ .../arm/boot/dts/overlays/mz61581-overlay.dts |  117 +
+ arch/arm/boot/dts/overlays/ov2311-overlay.dts |   83 +
+ arch/arm/boot/dts/overlays/ov2311.dtsi        |   26 +
+ arch/arm/boot/dts/overlays/ov5647-overlay.dts |  100 +
+ arch/arm/boot/dts/overlays/ov5647.dtsi        |   25 +
+ .../arm/boot/dts/overlays/ov64a40-overlay.dts |   97 +
+ arch/arm/boot/dts/overlays/ov64a40.dtsi       |   34 +
+ arch/arm/boot/dts/overlays/ov7251-overlay.dts |   83 +
+ arch/arm/boot/dts/overlays/ov7251.dtsi        |   28 +
+ arch/arm/boot/dts/overlays/ov9281-overlay.dts |   84 +
+ arch/arm/boot/dts/overlays/ov9281.dtsi        |   27 +
+ arch/arm/boot/dts/overlays/overlay_map.dts    |  514 ++
+ .../arm/boot/dts/overlays/papirus-overlay.dts |   84 +
+ .../arm/boot/dts/overlays/pca953x-overlay.dts |  240 +
+ .../arm/boot/dts/overlays/pcf857x-overlay.dts |   32 +
+ .../dts/overlays/pcie-32bit-dma-overlay.dts   |   38 +
+ .../overlays/pcie-32bit-dma-pi5-overlay.dts   |   26 +
+ .../overlays/pciex1-compat-pi5-overlay.dts    |   60 +
+ arch/arm/boot/dts/overlays/pibell-overlay.dts |   81 +
+ .../dts/overlays/pifacedigital-overlay.dts    |  144 +
+ .../arm/boot/dts/overlays/pifi-40-overlay.dts |   50 +
+ .../boot/dts/overlays/pifi-dac-hd-overlay.dts |   49 +
+ .../dts/overlays/pifi-dac-zero-overlay.dts    |   49 +
+ .../dts/overlays/pifi-mini-210-overlay.dts    |   42 +
+ arch/arm/boot/dts/overlays/piglow-overlay.dts |   97 +
+ .../overlays/pineboards-hat-ai-overlay.dts    |   18 +
+ .../pineboards-hatdrive-poe-plus-overlay.dts  |   19 +
+ .../boot/dts/overlays/piscreen-overlay.dts    |  110 +
+ .../boot/dts/overlays/piscreen2r-overlay.dts  |  106 +
+ .../arm/boot/dts/overlays/pisound-overlay.dts |  118 +
+ .../boot/dts/overlays/pisound-pi5-overlay.dts |   31 +
+ .../arm/boot/dts/overlays/pitft22-overlay.dts |   71 +
+ .../overlays/pitft28-capacitive-overlay.dts   |   93 +
+ .../overlays/pitft28-resistive-overlay.dts    |  126 +
+ .../overlays/pitft35-resistive-overlay.dts    |  127 +
+ .../boot/dts/overlays/pps-gpio-overlay.dts    |   39 +
+ .../boot/dts/overlays/proto-codec-overlay.dts |   39 +
+ .../boot/dts/overlays/pwm-2chan-overlay.dts   |   48 +
+ .../boot/dts/overlays/pwm-gpio-overlay.dts    |   38 +
+ .../boot/dts/overlays/pwm-ir-tx-overlay.dts   |   40 +
+ arch/arm/boot/dts/overlays/pwm-overlay.dts    |   44 +
+ arch/arm/boot/dts/overlays/pwm1-overlay.dts   |   59 +
+ .../arm/boot/dts/overlays/qca7000-overlay.dts |   55 +
+ .../dts/overlays/qca7000-uart0-overlay.dts    |   46 +
+ .../arm/boot/dts/overlays/ramoops-overlay.dts |   25 +
+ .../boot/dts/overlays/ramoops-pi4-overlay.dts |   25 +
+ .../dts/overlays/rotary-encoder-overlay.dts   |   59 +
+ .../dts/overlays/rpi-backlight-overlay.dts    |   21 +
+ .../dts/overlays/rpi-codeczero-overlay.dts    |    9 +
+ .../boot/dts/overlays/rpi-dacplus-overlay.dts |   17 +
+ .../boot/dts/overlays/rpi-dacpro-overlay.dts  |   17 +
+ .../dts/overlays/rpi-digiampplus-overlay.dts  |   17 +
+ .../boot/dts/overlays/rpi-ft5406-overlay.dts  |   25 +
+ .../arm/boot/dts/overlays/rpi-poe-overlay.dts |  154 +
+ .../dts/overlays/rpi-poe-plus-overlay.dts     |   49 +
+ .../dts/overlays/rpi-rp2040-gpio-bridge.dtsi  |   21 +
+ .../boot/dts/overlays/rpi-sense-overlay.dts   |   69 +
+ .../dts/overlays/rpi-sense-v2-overlay.dts     |   69 +
+ arch/arm/boot/dts/overlays/rpi-tv-overlay.dts |   34 +
+ .../rra-digidac1-wm8741-audio-overlay.dts     |   49 +
+ .../boot/dts/overlays/sainsmart18-overlay.dts |   52 +
+ .../dts/overlays/sc16is750-i2c-overlay.dts    |   57 +
+ .../dts/overlays/sc16is750-spi0-overlay.dts   |   63 +
+ .../dts/overlays/sc16is752-i2c-overlay.dts    |   57 +
+ .../dts/overlays/sc16is752-spi0-overlay.dts   |   63 +
+ .../dts/overlays/sc16is752-spi1-overlay.dts   |   76 +
+ arch/arm/boot/dts/overlays/sdhost-overlay.dts |   38 +
+ arch/arm/boot/dts/overlays/sdio-overlay.dts   |   77 +
+ .../boot/dts/overlays/sdio-pi5-overlay.dts    |   24 +
+ .../overlays/seeed-can-fd-hat-v1-overlay.dts  |  138 +
+ .../overlays/seeed-can-fd-hat-v2-overlay.dts  |  117 +
+ .../boot/dts/overlays/sh1106-spi-overlay.dts  |   84 +
+ .../boot/dts/overlays/si446x-spi0-overlay.dts |   53 +
+ .../arm/boot/dts/overlays/smi-dev-overlay.dts |   20 +
+ .../boot/dts/overlays/smi-nand-overlay.dts    |   66 +
+ arch/arm/boot/dts/overlays/smi-overlay.dts    |   37 +
+ .../dts/overlays/spi-gpio35-39-overlay.dts    |   31 +
+ .../dts/overlays/spi-gpio40-45-overlay.dts    |   36 +
+ .../arm/boot/dts/overlays/spi-rtc-overlay.dts |   75 +
+ .../boot/dts/overlays/spi0-0cs-overlay.dts    |   39 +
+ .../boot/dts/overlays/spi0-1cs-overlay.dts    |   42 +
+ .../boot/dts/overlays/spi0-2cs-overlay.dts    |   37 +
+ .../boot/dts/overlays/spi1-1cs-overlay.dts    |   57 +
+ .../boot/dts/overlays/spi1-2cs-overlay.dts    |   69 +
+ .../boot/dts/overlays/spi1-3cs-overlay.dts    |   81 +
+ .../boot/dts/overlays/spi2-1cs-overlay.dts    |   57 +
+ .../dts/overlays/spi2-1cs-pi5-overlay.dts     |   33 +
+ .../boot/dts/overlays/spi2-2cs-overlay.dts    |   69 +
+ .../dts/overlays/spi2-2cs-pi5-overlay.dts     |   44 +
+ .../boot/dts/overlays/spi2-3cs-overlay.dts    |   81 +
+ .../boot/dts/overlays/spi3-1cs-overlay.dts    |   42 +
+ .../dts/overlays/spi3-1cs-pi5-overlay.dts     |   33 +
+ .../boot/dts/overlays/spi3-2cs-overlay.dts    |   54 +
+ .../dts/overlays/spi3-2cs-pi5-overlay.dts     |   44 +
+ .../boot/dts/overlays/spi4-1cs-overlay.dts    |   42 +
+ .../boot/dts/overlays/spi4-2cs-overlay.dts    |   54 +
+ .../boot/dts/overlays/spi5-1cs-overlay.dts    |   42 +
+ .../dts/overlays/spi5-1cs-pi5-overlay.dts     |   33 +
+ .../boot/dts/overlays/spi5-2cs-overlay.dts    |   54 +
+ .../dts/overlays/spi5-2cs-pi5-overlay.dts     |   44 +
+ .../boot/dts/overlays/spi6-1cs-overlay.dts    |   42 +
+ .../boot/dts/overlays/spi6-2cs-overlay.dts    |   54 +
+ .../arm/boot/dts/overlays/ssd1306-overlay.dts |   36 +
+ .../boot/dts/overlays/ssd1306-spi-overlay.dts |   85 +
+ .../boot/dts/overlays/ssd1327-spi-overlay.dts |   70 +
+ .../boot/dts/overlays/ssd1331-spi-overlay.dts |   83 +
+ .../boot/dts/overlays/ssd1351-spi-overlay.dts |   83 +
+ .../overlays/sunfounder-pipower3-overlay.dts  |   44 +
+ .../overlays/sunfounder-pironman5-overlay.dts |   55 +
+ .../dts/overlays/superaudioboard-overlay.dts  |   73 +
+ arch/arm/boot/dts/overlays/sx150x-overlay.dts | 1706 +++++
+ .../dts/overlays/tc358743-audio-overlay.dts   |   52 +
+ .../boot/dts/overlays/tc358743-overlay.dts    |  116 +
+ .../boot/dts/overlays/tinylcd35-overlay.dts   |  222 +
+ .../boot/dts/overlays/tpm-slb9670-overlay.dts |   44 +
+ .../boot/dts/overlays/tpm-slb9673-overlay.dts |   50 +
+ arch/arm/boot/dts/overlays/uart0-overlay.dts  |   32 +
+ .../boot/dts/overlays/uart0-pi5-overlay.dts   |   18 +
+ arch/arm/boot/dts/overlays/uart1-overlay.dts  |   38 +
+ .../boot/dts/overlays/uart1-pi5-overlay.dts   |   18 +
+ arch/arm/boot/dts/overlays/uart2-overlay.dts  |   25 +
+ .../boot/dts/overlays/uart2-pi5-overlay.dts   |   18 +
+ arch/arm/boot/dts/overlays/uart3-overlay.dts  |   25 +
+ .../boot/dts/overlays/uart3-pi5-overlay.dts   |   18 +
+ arch/arm/boot/dts/overlays/uart4-overlay.dts  |   25 +
+ .../boot/dts/overlays/uart4-pi5-overlay.dts   |   18 +
+ arch/arm/boot/dts/overlays/uart5-overlay.dts  |   25 +
+ arch/arm/boot/dts/overlays/udrc-overlay.dts   |  128 +
+ .../dts/overlays/ugreen-dabboard-overlay.dts  |   49 +
+ .../boot/dts/overlays/upstream-overlay.dts    |  101 +
+ .../dts/overlays/upstream-pi4-overlay.dts     |  137 +
+ .../dts/overlays/vc4-fkms-v3d-overlay.dts     |   46 +
+ .../dts/overlays/vc4-fkms-v3d-pi4-overlay.dts |   50 +
+ .../overlays/vc4-kms-dpi-generic-overlay.dts  |   82 +
+ .../dts/overlays/vc4-kms-dpi-hyperpixel.dtsi  |   94 +
+ .../vc4-kms-dpi-hyperpixel2r-overlay.dts      |  114 +
+ .../vc4-kms-dpi-hyperpixel4-overlay.dts       |   57 +
+ .../vc4-kms-dpi-hyperpixel4sq-overlay.dts     |   36 +
+ .../overlays/vc4-kms-dpi-panel-overlay.dts    |   69 +
+ arch/arm/boot/dts/overlays/vc4-kms-dpi.dtsi   |  111 +
+ .../overlays/vc4-kms-dsi-7inch-overlay.dts    |  124 +
+ .../overlays/vc4-kms-dsi-generic-overlay.dts  |  106 +
+ .../vc4-kms-dsi-ili9881-5inch-overlay.dts     |  122 +
+ .../vc4-kms-dsi-ili9881-7inch-overlay.dts     |  122 +
+ .../vc4-kms-dsi-lt070me05000-overlay.dts      |   69 +
+ .../vc4-kms-dsi-lt070me05000-v2-overlay.dts   |   64 +
+ .../vc4-kms-dsi-waveshare-800x480-overlay.dts |  119 +
+ .../vc4-kms-dsi-waveshare-panel-overlay.dts   |  133 +
+ .../overlays/vc4-kms-kippah-7inch-overlay.dts |   26 +
+ .../boot/dts/overlays/vc4-kms-v3d-overlay.dts |  124 +
+ .../dts/overlays/vc4-kms-v3d-pi4-overlay.dts  |  200 +
+ .../dts/overlays/vc4-kms-v3d-pi5-overlay.dts  |  147 +
+ .../dts/overlays/vc4-kms-vga666-overlay.dts   |  107 +
+ arch/arm/boot/dts/overlays/vga666-overlay.dts |   30 +
+ arch/arm/boot/dts/overlays/vl805-overlay.dts  |   18 +
+ .../arm/boot/dts/overlays/w1-gpio-overlay.dts |   40 +
+ .../boot/dts/overlays/w1-gpio-pi5-overlay.dts |   15 +
+ .../dts/overlays/w1-gpio-pullup-overlay.dts   |   42 +
+ .../overlays/w1-gpio-pullup-pi5-overlay.dts   |   15 +
+ arch/arm/boot/dts/overlays/w5500-overlay.dts  |   63 +
+ .../overlays/watterott-display-overlay.dts    |  150 +
+ .../waveshare-can-fd-hat-mode-a-overlay.dts   |  140 +
+ .../waveshare-can-fd-hat-mode-b-overlay.dts   |  103 +
+ .../arm/boot/dts/overlays/wittypi-overlay.dts |   44 +
+ .../dts/overlays/wm8960-soundcard-overlay.dts |   82 +
+ arch/arm64/boot/dts/Makefile                  |    2 +
+ arch/arm64/boot/dts/broadcom/Makefile         |   21 +
+ .../boot/dts/broadcom/bcm2710-rpi-2-b.dts     |    1 +
+ .../dts/broadcom/bcm2710-rpi-3-b-plus.dts     |    1 +
+ .../boot/dts/broadcom/bcm2710-rpi-3-b.dts     |    1 +
+ .../boot/dts/broadcom/bcm2710-rpi-cm3.dts     |    1 +
+ .../dts/broadcom/bcm2710-rpi-zero-2-w.dts     |    1 +
+ .../boot/dts/broadcom/bcm2710-rpi-zero-2.dts  |    1 +
+ .../boot/dts/broadcom/bcm2711-rpi-cm4.dts     |    1 +
+ .../boot/dts/broadcom/bcm2711-rpi-cm4s.dts    |    1 +
+ arch/arm64/boot/dts/broadcom/bcm2712-ds.dtsi  |  808 +++
+ .../boot/dts/broadcom/bcm2712-rpi-5-b.dts     |  682 +-
+ .../boot/dts/broadcom/bcm2712-rpi-500.dts     |  142 +
+ .../boot/dts/broadcom/bcm2712-rpi-cm4io.dtsi  |   28 +
+ .../dts/broadcom/bcm2712-rpi-cm5-cm4io.dts    |    5 +
+ .../dts/broadcom/bcm2712-rpi-cm5-cm5io.dts    |    5 +
+ .../boot/dts/broadcom/bcm2712-rpi-cm5.dtsi    |  712 +++
+ .../boot/dts/broadcom/bcm2712-rpi-cm5io.dtsi  |   14 +
+ .../dts/broadcom/bcm2712-rpi-cm5l-cm4io.dts   |    5 +
+ .../dts/broadcom/bcm2712-rpi-cm5l-cm5io.dts   |    5 +
+ .../boot/dts/broadcom/bcm2712-rpi-cm5l.dtsi   |   22 +
+ arch/arm64/boot/dts/broadcom/bcm2712-rpi.dtsi |  466 ++
+ .../boot/dts/broadcom/bcm2712d0-rpi-5-b.dts   |  107 +
+ arch/arm64/boot/dts/broadcom/rp1.dtsi         | 1291 ++++
+ arch/arm64/boot/dts/overlays                  |    1 +
+ include/dt-bindings/gpio/gpio-fsm.h           |   21 +
+ scripts/Makefile.build                        |   67 +-
+ scripts/Makefile.dtbinst                      |    9 +-
+ scripts/Makefile.lib                          |  156 +-
+ 431 files changed, 44814 insertions(+), 83 deletions(-)
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm2708-rpi-b-plus.dts
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm2708-rpi-b-rev1.dts
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm2708-rpi-b.dts
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm2708-rpi-bt.dtsi
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm2708-rpi-cm.dts
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm2708-rpi-cm.dtsi
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm2708-rpi-zero-w.dts
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm2708-rpi-zero.dts
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm2708-rpi.dtsi
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm2708.dtsi
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm2709-rpi-2-b.dts
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm2709-rpi-cm2.dts
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm2709-rpi.dtsi
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm2709.dtsi
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm270x-rpi.dtsi
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm270x.dtsi
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm2710-rpi-2-b.dts
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm2710-rpi-3-b-plus.dts
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm2710-rpi-3-b.dts
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm2710-rpi-cm3.dts
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm2710-rpi-zero-2-w.dts
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm2710-rpi-zero-2.dts
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm2710.dtsi
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm2711-rpi-cm4.dts
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm2711-rpi-cm4s.dts
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm2711-rpi-ds.dtsi
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm271x-rpi-bt.dtsi
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm283x-rpi-csi0-2lane.dtsi
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm283x-rpi-csi1-2lane.dtsi
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm283x-rpi-csi1-4lane.dtsi
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm283x-rpi-i2c0mux_0_28.dtsi
+ create mode 100644 arch/arm/boot/dts/broadcom/bcm283x-rpi-i2c0mux_0_44.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/Makefile
+ create mode 100644 arch/arm/boot/dts/overlays/README
+ create mode 100644 arch/arm/boot/dts/overlays/act-led-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/adafruit-st7735r-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/adafruit18-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/adau1977-adc-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/adau7002-simple-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ads1015-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ads1115-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ads7846-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/adv7282m-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/adv728x-m-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/akkordion-iqdacplus-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/allo-boss-dac-pcm512x-audio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/allo-boss2-dac-audio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/allo-digione-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/allo-katana-dac-audio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/allo-piano-dac-pcm512x-audio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/allo-piano-dac-plus-pcm512x-audio-overlay.dts
+ create mode 100755 arch/arm/boot/dts/overlays/anyspi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/apds9960-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/applepi-dac-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/arducam-64mp-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/arducam-64mp.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/arducam-pivariety-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/at86rf233-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/audioinjector-bare-i2s-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/audioinjector-isolated-soundcard-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/audioinjector-ultra-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/audioinjector-wm8731-audio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/audiosense-pi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/audremap-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/balena-fin-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/bcm2712d0-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/camera-mux-2port-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/camera-mux-4port-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/cap1106-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/chipcap2-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/chipdip-dac-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/cirrus-wm5102-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/cm-swap-i2c0-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/cma-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/crystalfontz-cfa050_pi_m-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/cutiepi-panel-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/dacberry400-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/dht11-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/dionaudio-kiwi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/dionaudio-loco-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/dionaudio-loco-v2-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/disable-bt-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/disable-bt-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/disable-emmc2-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/disable-wifi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/disable-wifi-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/dpi18-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/dpi18cpadhi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/dpi24-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/draws-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/dwc-otg-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/dwc2-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/edt-ft5406-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/edt-ft5406.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/enc28j60-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/enc28j60-spi2-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/exc3000-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/fbtft-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/fe-pi-audio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/fsm-demo-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/gc9a01-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ghost-amp-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/goodix-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/googlevoicehat-soundcard-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/gpio-charger-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/gpio-fan-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/gpio-hog-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/gpio-ir-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/gpio-ir-tx-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/gpio-key-overlay.dts
+ create mode 100755 arch/arm/boot/dts/overlays/gpio-led-overlay.dts
+ create mode 100755 arch/arm/boot/dts/overlays/gpio-no-bank0-irq-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/gpio-no-irq-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/gpio-poweroff-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/gpio-shutdown-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hat_map.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hd44780-i2c-lcd-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hd44780-lcd-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hdmi-backlight-hwhack-gpio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-adc-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-adc8x-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-amp-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-amp100-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-amp3-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-amp4pro-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-dac-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-dac8x-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-dacplus-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-dacplus-pro-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-dacplus-std-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-dacplusadc-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-dacplusadcpro-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-dacplusdsp-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-dacplushd-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-digi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hifiberry-digi-pro-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/highperi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hy28a-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hy28b-2017-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/hy28b-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i-sabre-q2m-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c-bcm2708-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c-fan-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c-gpio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c-mux-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c-rtc-common.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
+ create mode 100755 arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
+ create mode 100755 arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c0-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c0-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c1-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c1-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c2-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c3-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c3-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c4-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2c6-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2s-dac-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2s-gpio28-31-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/i2s-master-dac-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ilitek251x-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/imx219-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/imx219.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/imx258-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/imx258.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/imx290-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/imx290_327-overlay.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/imx290_327.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/imx296-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/imx327-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/imx378-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/imx462-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/imx477-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/imx477_378-overlay.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/imx477_378.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/imx500-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/imx500-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/imx500.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/imx519-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/imx519.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/imx708-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/imx708.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/interludeaudio-analog-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/interludeaudio-digital-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/iqaudio-codec-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/iqaudio-dac-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/iqaudio-dacplus-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/iqaudio-digi-wm8804-audio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/iqs550-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/irs1125-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/jedec-spi-nor-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/justboom-both-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/justboom-dac-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/justboom-digi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ltc294x-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/max98357a-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/maxtherm-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/mbed-dac-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/mcp23017-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/mcp23s17-overlay.dts
+ create mode 100755 arch/arm/boot/dts/overlays/mcp2515-can0-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/mcp2515-can1-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/mcp2515-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/mcp251xfd-overlay.dts
+ create mode 100755 arch/arm/boot/dts/overlays/mcp3008-overlay.dts
+ create mode 100755 arch/arm/boot/dts/overlays/mcp3202-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/mcp342x-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/media-center-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/merus-amp-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/midi-uart0-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/midi-uart0-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/midi-uart1-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/midi-uart1-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/midi-uart2-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/midi-uart2-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/midi-uart3-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/midi-uart3-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/midi-uart4-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/midi-uart4-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/midi-uart5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/minipitft13-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/miniuart-bt-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/mipi-dbi-spi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/mlx90640-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/mmc-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/mz61581-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ov2311-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ov2311.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/ov5647-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ov5647.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/ov64a40-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ov64a40.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/ov7251-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ov7251.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/ov9281-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ov9281.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/overlay_map.dts
+ create mode 100644 arch/arm/boot/dts/overlays/papirus-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pca953x-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pcf857x-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pcie-32bit-dma-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pcie-32bit-dma-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pciex1-compat-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pibell-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pifacedigital-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pifi-40-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pifi-dac-hd-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pifi-dac-zero-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pifi-mini-210-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/piglow-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pineboards-hat-ai-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pineboards-hatdrive-poe-plus-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/piscreen-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/piscreen2r-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pisound-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pisound-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pitft22-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pitft28-capacitive-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pitft28-resistive-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pitft35-resistive-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pps-gpio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/proto-codec-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pwm-2chan-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pwm-gpio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pwm-ir-tx-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pwm-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/pwm1-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/qca7000-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/qca7000-uart0-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ramoops-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ramoops-pi4-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rotary-encoder-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rpi-backlight-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rpi-codeczero-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rpi-dacplus-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rpi-dacpro-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rpi-digiampplus-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rpi-ft5406-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rpi-poe-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rpi-poe-plus-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rpi-rp2040-gpio-bridge.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/rpi-sense-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rpi-sense-v2-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rpi-tv-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/rra-digidac1-wm8741-audio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/sainsmart18-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/sc16is750-spi0-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/sc16is752-spi0-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/sc16is752-spi1-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/sdhost-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/sdio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/sdio-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/seeed-can-fd-hat-v1-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/seeed-can-fd-hat-v2-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/sh1106-spi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/si446x-spi0-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/smi-dev-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/smi-nand-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/smi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi-gpio35-39-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi-gpio40-45-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi-rtc-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi0-0cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi0-1cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi0-2cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi1-1cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi1-2cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi1-3cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi2-1cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi2-1cs-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi2-2cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi2-2cs-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi2-3cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi3-1cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi3-1cs-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi3-2cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi3-2cs-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi4-1cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi4-2cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi5-1cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi5-1cs-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi5-2cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi5-2cs-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi6-1cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/spi6-2cs-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ssd1306-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ssd1306-spi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ssd1327-spi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ssd1331-spi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ssd1351-spi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/sunfounder-pipower3-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/sunfounder-pironman5-overlay.dts
+ create mode 100755 arch/arm/boot/dts/overlays/superaudioboard-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/sx150x-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/tc358743-audio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/tc358743-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/tinylcd35-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/tpm-slb9670-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/tpm-slb9673-overlay.dts
+ create mode 100755 arch/arm/boot/dts/overlays/uart0-overlay.dts
+ create mode 100755 arch/arm/boot/dts/overlays/uart0-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/uart1-overlay.dts
+ create mode 100755 arch/arm/boot/dts/overlays/uart1-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/uart2-overlay.dts
+ create mode 100755 arch/arm/boot/dts/overlays/uart2-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/uart3-overlay.dts
+ create mode 100755 arch/arm/boot/dts/overlays/uart3-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/uart4-overlay.dts
+ create mode 100755 arch/arm/boot/dts/overlays/uart4-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/uart5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/udrc-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/ugreen-dabboard-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/upstream-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/upstream-pi4-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-fkms-v3d-pi4-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dpi-generic-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel2r-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel4-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel4sq-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dpi-panel-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dpi.dtsi
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dsi-7inch-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dsi-generic-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dsi-ili9881-5inch-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dsi-ili9881-7inch-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dsi-lt070me05000-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dsi-lt070me05000-v2-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dsi-waveshare-800x480-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-dsi-waveshare-panel-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-kippah-7inch-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-v3d-pi4-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-v3d-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-vga666-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vga666-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/vl805-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/w1-gpio-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/w1-gpio-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/w1-gpio-pullup-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/w1-gpio-pullup-pi5-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/w5500-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/watterott-display-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/waveshare-can-fd-hat-mode-a-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/waveshare-can-fd-hat-mode-b-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/wittypi-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/wm8960-soundcard-overlay.dts
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2710-rpi-2-b.dts
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b-plus.dts
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b.dts
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2710-rpi-cm3.dts
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2710-rpi-zero-2-w.dts
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2710-rpi-zero-2.dts
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2711-rpi-cm4.dts
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2711-rpi-cm4s.dts
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2712-ds.dtsi
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2712-rpi-500.dts
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm4io.dtsi
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5-cm4io.dts
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5-cm5io.dts
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5io.dtsi
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5l-cm4io.dts
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5l-cm5io.dts
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5l.dtsi
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2712-rpi.dtsi
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2712d0-rpi-5-b.dts
+ create mode 100644 arch/arm64/boot/dts/broadcom/rp1.dtsi
+ create mode 120000 arch/arm64/boot/dts/overlays
+ create mode 100644 include/dt-bindings/gpio/gpio-fsm.h
+
+diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
+index efe38eb25301..a2a407fb5b28 100644
+--- a/arch/arm/boot/dts/Makefile
++++ b/arch/arm/boot/dts/Makefile
+@@ -39,3 +39,8 @@ subdir-y += unisoc
+ subdir-y += vt8500
+ subdir-y += xen
+ subdir-y += xilinx
++
++targets += dtbs dtbs_install
++targets += $(dtb-y)
++
++subdir-y += overlays
+diff --git a/arch/arm/boot/dts/broadcom/Makefile b/arch/arm/boot/dts/broadcom/Makefile
+index 5881bcc95eba..79d83e8a214d 100644
+--- a/arch/arm/boot/dts/broadcom/Makefile
++++ b/arch/arm/boot/dts/broadcom/Makefile
+@@ -35,6 +35,41 @@ dtb-$(CONFIG_ARCH_BCM2835) += \
+ 	bcm2711-rpi-cm4-io.dtb \
+ 	bcm2835-rpi-zero.dtb \
+ 	bcm2835-rpi-zero-w.dtb
++
++DTC_FLAGS_bcm2708-rpi-b := -@
++DTC_FLAGS_bcm2708-rpi-b-rev1 := -@
++DTC_FLAGS_bcm2708-rpi-b-plus := -@
++DTC_FLAGS_bcm2708-rpi-cm := -@
++DTC_FLAGS_bcm2708-rpi-zero := -@
++DTC_FLAGS_bcm2708-rpi-zero-w := -@
++DTC_FLAGS_bcm2710-rpi-zero-2 := -@
++DTC_FLAGS_bcm2710-rpi-zero-2-w := -@
++DTC_FLAGS_bcm2709-rpi-2-b := -@
++DTC_FLAGS_bcm2710-rpi-2-b := -@
++DTC_FLAGS_bcm2710-rpi-3-b := -@
++DTC_FLAGS_bcm2710-rpi-3-b-plus := -@
++DTC_FLAGS_bcm2709-rpi-cm2 := -@
++DTC_FLAGS_bcm2710-rpi-cm3 := -@
++DTC_FLAGS_bcm2711-rpi-cm4 := -@
++DTC_FLAGS_bcm2711-rpi-cm4s := -@
++dtb-$(CONFIG_ARCH_BCM2835) += \
++        bcm2708-rpi-b.dtb \
++        bcm2708-rpi-b-rev1.dtb \
++        bcm2708-rpi-b-plus.dtb \
++        bcm2708-rpi-cm.dtb \
++        bcm2708-rpi-zero.dtb \
++        bcm2708-rpi-zero-w.dtb \
++        bcm2710-rpi-zero-2.dtb \
++        bcm2710-rpi-zero-2-w.dtb \
++        bcm2709-rpi-2-b.dtb \
++        bcm2710-rpi-2-b.dtb \
++        bcm2710-rpi-3-b.dtb \
++        bcm2710-rpi-3-b-plus.dtb \
++        bcm2709-rpi-cm2.dtb \
++        bcm2710-rpi-cm3.dtb \
++        bcm2711-rpi-cm4.dtb \
++        bcm2711-rpi-cm4s.dtb
++
+ dtb-$(CONFIG_ARCH_BCMBCA) += \
+ 	bcm947622.dtb \
+ 	bcm963138.dtb \
+diff --git a/arch/arm/boot/dts/broadcom/bcm2708-rpi-b-plus.dts b/arch/arm/boot/dts/broadcom/bcm2708-rpi-b-plus.dts
+new file mode 100644
+index 000000000000..ee72fdac6663
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm2708-rpi-b-plus.dts
+@@ -0,0 +1,210 @@
++/dts-v1/;
++
++#include "bcm2708.dtsi"
++#include "bcm2708-rpi.dtsi"
++#include "bcm283x-rpi-smsc9514.dtsi"
++#include "bcm283x-rpi-csi1-2lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_28.dtsi"
++#include "bcm283x-rpi-led-deprecated.dtsi"
++
++/ {
++	compatible = "raspberrypi,model-b-plus", "brcm,bcm2835";
++	model = "Raspberry Pi Model B+";
++};
++
++&gpio {
++	/*
++	 * Taken from Raspberry-Pi-B-Plus-V1.2-Schematics.pdf
++	 * RPI-BPLUS sheet 1
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "ID_SDA",
++			  "ID_SCL",
++			  "GPIO2",
++			  "GPIO3",
++			  "GPIO4",
++			  "GPIO5",
++			  "GPIO6",
++			  "GPIO7",
++			  "GPIO8",
++			  "GPIO9",
++			  "GPIO10",
++			  "GPIO11",
++			  "GPIO12",
++			  "GPIO13",
++			  "GPIO14",
++			  "GPIO15",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "SDA0",
++			  "SCL0",
++			  "NC", /* GPIO30 */
++			  "LAN_RUN", /* GPIO31 */
++			  "CAM_GPIO1", /* GPIO32 */
++			  "NC", /* GPIO33 */
++			  "NC", /* GPIO34 */
++			  "PWR_LOW_N", /* GPIO35 */
++			  "NC", /* GPIO36 */
++			  "NC", /* GPIO37 */
++			  "USB_LIMIT", /* GPIO38 */
++			  "NC", /* GPIO39 */
++			  "PWM0_OUT", /* GPIO40 */
++			  "CAM_GPIO0", /* GPIO41 */
++			  "NC", /* GPIO42 */
++			  "NC", /* GPIO43 */
++			  "ETH_CLK", /* GPIO44 */
++			  "PWM1_OUT", /* GPIO45 */
++			  "HDMI_HPD_N",
++			  "STATUS_LED",
++			  /* Used by SD Card */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins = <40 45>;
++		brcm,function = <4>;
++		brcm,pull = <0>;
++	};
++};
++
++&uart0 {
++	status = "okay";
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&led_act {
++	gpios = <&gpio 47 GPIO_ACTIVE_HIGH>;
++	default-state = "off";
++	linux,default-trigger = "mmc0";
++};
++
++&leds {
++	led_pwr: led-pwr {
++		label = "PWR";
++		gpios = <&gpio 35 GPIO_ACTIVE_HIGH>;
++		default-state = "off";
++		linux,default-trigger = "input";
++	};
++};
++
++&hdmi {
++	hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&cam1_reg {
++	gpio = <&gpio 41 GPIO_ACTIVE_HIGH>;
++};
++
++cam0_reg: &cam_dummy_reg {
++};
++
++i2c_arm: &i2c1 {
++};
++
++i2c_vc: &i2c0 {
++};
++
++i2c_csi_dsi0: &i2c0 {
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_headphones=1 snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_headphones=0 snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&led_act>,"gpios:4";
++		act_led_activelow = <&led_act>,"gpios:8";
++		act_led_trigger = <&led_act>,"linux,default-trigger";
++
++		pwr_led_gpio = <&led_pwr>,"gpios:4";
++		pwr_led_activelow = <&led_pwr>,"gpios:8";
++		pwr_led_trigger = <&led_pwr>,"linux,default-trigger";
++	};
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2708-rpi-b-rev1.dts b/arch/arm/boot/dts/broadcom/bcm2708-rpi-b-rev1.dts
+new file mode 100644
+index 000000000000..9301e345aea2
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm2708-rpi-b-rev1.dts
+@@ -0,0 +1,223 @@
++/dts-v1/;
++
++#include "bcm2708.dtsi"
++#include "bcm2708-rpi.dtsi"
++#include "bcm283x-rpi-smsc9512.dtsi"
++#include "bcm283x-rpi-csi1-2lane.dtsi"
++#include "bcm283x-rpi-led-deprecated.dtsi"
++
++/ {
++	compatible = "raspberrypi,model-b", "brcm,bcm2835";
++	model = "Raspberry Pi Model B";
++};
++
++&gpio {
++	/*
++	 * Taken from Raspberry-Pi-Rev-1.0-Model-AB-Schematics.pdf
++	 * RPI00021 sheet 02
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "SDA0",
++			  "SCL0",
++			  "SDA1",
++			  "SCL1",
++			  "GPIO_GCLK",
++			  "CAM_GPIO1",
++			  "LAN_RUN",
++			  "SPI_CE1_N",
++			  "SPI_CE0_N",
++			  "SPI_MISO",
++			  "SPI_MOSI",
++			  "SPI_SCLK",
++			  "NC", /* GPIO12 */
++			  "NC", /* GPIO13 */
++			  /* Serial port */
++			  "TXD0",
++			  "RXD0",
++			  "STATUS_LED_N",
++			  "GPIO17",
++			  "GPIO18",
++			  "NC", /* GPIO19 */
++			  "NC", /* GPIO20 */
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "NC", /* GPIO26 */
++			  "CAM_GPIO0",
++			  /* Binary number representing build/revision */
++			  "CONFIG0",
++			  "CONFIG1",
++			  "CONFIG2",
++			  "CONFIG3",
++			  "NC", /* GPIO32 */
++			  "NC", /* GPIO33 */
++			  "NC", /* GPIO34 */
++			  "NC", /* GPIO35 */
++			  "NC", /* GPIO36 */
++			  "NC", /* GPIO37 */
++			  "NC", /* GPIO38 */
++			  "NC", /* GPIO39 */
++			  "PWM0_OUT",
++			  "NC", /* GPIO41 */
++			  "NC", /* GPIO42 */
++			  "NC", /* GPIO43 */
++			  "NC", /* GPIO44 */
++			  "PWM1_OUT",
++			  "HDMI_HPD_P",
++			  "SD_CARD_DET",
++			  /* Used by SD Card */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <28 29 30 31>;
++		brcm,function = <6>; /* alt2 */
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins = <40 45>;
++		brcm,function = <4>;
++		brcm,pull = <0>;
++	};
++};
++
++&uart0 {
++	status = "okay";
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++/delete-node/ &i2c0mux;
++
++i2c0: &i2c0if {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c0_pins>;
++	clock-frequency = <100000>;
++};
++
++i2c_csi_dsi: &i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++/ {
++	aliases {
++		i2c0 = &i2c0;
++	};
++
++	/* Provide an i2c0mux label to avoid undefined symbols in overlays */
++	i2c0mux: i2c0mux {
++	};
++
++	__overrides__ {
++		i2c0 = <&i2c0>, "status";
++	};
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&led_act {
++	gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
++	default-state = "off";
++	linux,default-trigger = "mmc0";
++};
++
++&hdmi {
++	hpd-gpios = <&gpio 46 GPIO_ACTIVE_HIGH>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&cam1_reg {
++	gpio = <&gpio 27 GPIO_ACTIVE_HIGH>;
++};
++
++cam0_reg: &cam_dummy_reg {
++};
++
++i2c_arm: &i2c0 {
++};
++
++i2c_vc: &i2c1 {
++};
++
++i2c_csi_dsi0: &i2c0 {
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_headphones=1 snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_headphones=0 snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&led_act>,"gpios:4";
++		act_led_activelow = <&led_act>,"gpios:8";
++		act_led_trigger = <&led_act>,"linux,default-trigger";
++
++		i2c = <&i2c0>,"status";
++		i2c_arm = <&i2c0>,"status";
++		i2c_vc = <&i2c1>,"status";
++		i2c_baudrate = <&i2c0>,"clock-frequency:0";
++		i2c_arm_baudrate = <&i2c0>,"clock-frequency:0";
++		i2c_vc_baudrate = <&i2c1>,"clock-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2708-rpi-b.dts b/arch/arm/boot/dts/broadcom/bcm2708-rpi-b.dts
+new file mode 100644
+index 000000000000..b8459fd0f497
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm2708-rpi-b.dts
+@@ -0,0 +1,198 @@
++/dts-v1/;
++
++#include "bcm2708.dtsi"
++#include "bcm2708-rpi.dtsi"
++#include "bcm283x-rpi-smsc9512.dtsi"
++#include "bcm283x-rpi-csi1-2lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_28.dtsi"
++#include "bcm283x-rpi-led-deprecated.dtsi"
++
++/ {
++	compatible = "raspberrypi,model-b", "brcm,bcm2835";
++	model = "Raspberry Pi Model B";
++};
++
++&gpio {
++	/*
++	 * Taken from Raspberry-Pi-Rev-2.0-Model-AB-Schematics.pdf
++	 * RPI00022 sheet 02
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "SDA0",
++			  "SCL0",
++			  "SDA1",
++			  "SCL1",
++			  "GPIO_GCLK",
++			  "CAM_GPIO1",
++			  "LAN_RUN",
++			  "SPI_CE1_N",
++			  "SPI_CE0_N",
++			  "SPI_MISO",
++			  "SPI_MOSI",
++			  "SPI_SCLK",
++			  "NC", /* GPIO12 */
++			  "NC", /* GPIO13 */
++			  /* Serial port */
++			  "TXD0",
++			  "RXD0",
++			  "STATUS_LED_N",
++			  "GPIO17",
++			  "GPIO18",
++			  "NC", /* GPIO19 */
++			  "NC", /* GPIO20 */
++			  "CAM_GPIO0",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "NC", /* GPIO26 */
++			  "GPIO27",
++			  "GPIO28",
++			  "GPIO29",
++			  "GPIO30",
++			  "GPIO31",
++			  "NC", /* GPIO32 */
++			  "NC", /* GPIO33 */
++			  "NC", /* GPIO34 */
++			  "NC", /* GPIO35 */
++			  "NC", /* GPIO36 */
++			  "NC", /* GPIO37 */
++			  "NC", /* GPIO38 */
++			  "NC", /* GPIO39 */
++			  "PWM0_OUT",
++			  "NC", /* GPIO41 */
++			  "NC", /* GPIO42 */
++			  "NC", /* GPIO43 */
++			  "NC", /* GPIO44 */
++			  "PWM1_OUT",
++			  "HDMI_HPD_P",
++			  "SD_CARD_DET",
++			  /* Used by SD Card */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <28 29 30 31>;
++		brcm,function = <6>; /* alt2 */
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins = <40 45>;
++		brcm,function = <4>;
++		brcm,pull = <0>;
++	};
++};
++
++&uart0 {
++	status = "okay";
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&led_act {
++	gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
++	default-state = "off";
++	linux,default-trigger = "mmc0";
++};
++
++&hdmi {
++	hpd-gpios = <&gpio 46 GPIO_ACTIVE_HIGH>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&cam1_reg {
++	gpio = <&gpio 21 GPIO_ACTIVE_HIGH>;
++};
++
++cam0_reg: &cam_dummy_reg {
++};
++
++i2c_arm: &i2c1 {
++};
++
++i2c_vc: &i2c0 {
++};
++
++i2c_csi_dsi0: &i2c0 {
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_headphones=1 snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_headphones=0 snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&led_act>,"gpios:4";
++		act_led_activelow = <&led_act>,"gpios:8";
++		act_led_trigger = <&led_act>,"linux,default-trigger";
++	};
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2708-rpi-bt.dtsi b/arch/arm/boot/dts/broadcom/bcm2708-rpi-bt.dtsi
+new file mode 100644
+index 000000000000..87a6c00bd056
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm2708-rpi-bt.dtsi
+@@ -0,0 +1,42 @@
++// SPDX-License-Identifier: GPL-2.0
++
++&uart0 {
++	bt: bluetooth {
++		compatible = "brcm,bcm43438-bt";
++		max-speed = <3000000>;
++		shutdown-gpios = <&gpio 45 GPIO_ACTIVE_HIGH>;
++		local-bd-address = [ 00 00 00 00 00 00 ];
++		fallback-bd-address; // Don't override a valid address
++		status = "okay";
++	};
++};
++
++&uart1 {
++	minibt: bluetooth {
++		compatible = "brcm,bcm43438-bt";
++		max-speed = <230400>;
++		shutdown-gpios = <&gpio 45 GPIO_ACTIVE_HIGH>;
++		local-bd-address = [ 00 00 00 00 00 00 ];
++		fallback-bd-address; // Don't override a valid address
++		status = "disabled";
++	};
++};
++
++/ {
++	chosen {
++		bootargs = "coherent_pool=1M 8250.nr_uarts=1 snd_bcm2835.enable_headphones=0 cgroup_disable=memory";
++	};
++
++	aliases {
++		bluetooth = &bt;
++	};
++
++	__overrides__ {
++		bdaddr = <&bt>,"local-bd-address[",
++		       <&bt>,"fallback-bd-address?=0",
++		       <&minibt>,"local-bd-address[",
++		       <&minibt>,"fallback-bd-address?=0";
++		krnbt = <&bt>,"status";
++		krnbt_baudrate = <&bt>,"max-speed:0", <&minibt>,"max-speed:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2708-rpi-cm.dts b/arch/arm/boot/dts/broadcom/bcm2708-rpi-cm.dts
+new file mode 100644
+index 000000000000..fde85c8c7dca
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm2708-rpi-cm.dts
+@@ -0,0 +1,174 @@
++/dts-v1/;
++
++#include "bcm2708-rpi-cm.dtsi"
++#include "bcm283x-rpi-csi0-2lane.dtsi"
++#include "bcm283x-rpi-csi1-4lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_28.dtsi"
++
++/ {
++	compatible = "raspberrypi,compute-module", "brcm,bcm2835";
++	model = "Raspberry Pi Compute Module";
++};
++
++&cam1_reg {
++	gpio = <&gpio 3 GPIO_ACTIVE_HIGH>;
++	status = "disabled";
++};
++
++cam0_reg: &cam0_regulator {
++	gpio = <&gpio 31 GPIO_ACTIVE_HIGH>;
++};
++
++i2c_csi_dsi0: &i2c0 {
++};
++
++&uart0 {
++	status = "okay";
++};
++
++&gpio {
++	/*
++	 * This is based on the official GPU firmware DT blob.
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "GPIO0",
++			  "GPIO1",
++			  "GPIO2",
++			  "GPIO3",
++			  "GPIO4",
++			  "GPIO5",
++			  "GPIO6",
++			  "GPIO7",
++			  "GPIO8",
++			  "GPIO9",
++			  "GPIO10",
++			  "GPIO11",
++			  "GPIO12",
++			  "GPIO13",
++			  "GPIO14",
++			  "GPIO15",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "GPIO28",
++			  "GPIO29",
++			  "GPIO30",
++			  "GPIO31",
++			  "GPIO32",
++			  "GPIO33",
++			  "GPIO34",
++			  "GPIO35",
++			  "GPIO36",
++			  "GPIO37",
++			  "GPIO38",
++			  "GPIO39",
++			  "GPIO40",
++			  "GPIO41",
++			  "GPIO42",
++			  "GPIO43",
++			  "GPIO44",
++			  "GPIO45",
++			  "HDMI_HPD_N",
++			  /* Also used as ACT LED */
++			  "EMMC_EN_N",
++			  /* Used by eMMC */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins;
++		brcm,function;
++	};
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&hdmi {
++	hpd-gpios = <&gpio 46 GPIO_ACTIVE_HIGH>;
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2708-rpi-cm.dtsi b/arch/arm/boot/dts/broadcom/bcm2708-rpi-cm.dtsi
+new file mode 100644
+index 000000000000..8d3e42bfe4f0
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm2708-rpi-cm.dtsi
+@@ -0,0 +1,23 @@
++#include "bcm2708.dtsi"
++#include "bcm2708-rpi.dtsi"
++#include "bcm283x-rpi-led-deprecated.dtsi"
++
++&led_act {
++	gpios = <&gpio 47 GPIO_ACTIVE_HIGH>;
++	default-state = "off";
++	linux,default-trigger = "mmc0";
++};
++
++i2c_arm: &i2c1 {
++};
++
++i2c_vc: &i2c0 {
++};
++
++/ {
++	__overrides__ {
++		act_led_gpio = <&led_act>,"gpios:4";
++		act_led_activelow = <&led_act>,"gpios:8";
++		act_led_trigger = <&led_act>,"linux,default-trigger";
++	};
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2708-rpi-zero-w.dts b/arch/arm/boot/dts/broadcom/bcm2708-rpi-zero-w.dts
+new file mode 100644
+index 000000000000..f6d4e2c73df9
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm2708-rpi-zero-w.dts
+@@ -0,0 +1,250 @@
++/dts-v1/;
++
++#include "bcm2708.dtsi"
++#include "bcm2708-rpi.dtsi"
++#include "bcm283x-rpi-csi1-2lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_28.dtsi"
++#include "bcm2708-rpi-bt.dtsi"
++#include "bcm283x-rpi-led-deprecated.dtsi"
++
++/ {
++	compatible = "raspberrypi,model-zero-w", "brcm,bcm2835";
++	model = "Raspberry Pi Zero W";
++
++	aliases {
++		serial0 = &uart1;
++		serial1 = &uart0;
++		mmc1 = &mmcnr;
++	};
++};
++
++&gpio {
++	/*
++	 * This is based on the official GPU firmware DT blob.
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "ID_SDA",
++			  "ID_SCL",
++			  "GPIO2",
++			  "GPIO3",
++			  "GPIO4",
++			  "GPIO5",
++			  "GPIO6",
++			  "GPIO7",
++			  "GPIO8",
++			  "GPIO9",
++			  "GPIO10",
++			  "GPIO11",
++			  "GPIO12",
++			  "GPIO13",
++			  "GPIO14",
++			  "GPIO15",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "SDA0",
++			  "SCL0",
++			  /* Used by BT module */
++			  "CTS0",
++			  "RTS0",
++			  "TXD0",
++			  "RXD0",
++			  /* Used by Wifi */
++			  "SD1_CLK",
++			  "SD1_CMD",
++			  "SD1_DATA0",
++			  "SD1_DATA1",
++			  "SD1_DATA2",
++			  "SD1_DATA3",
++			  "CAM_GPIO1", /* GPIO40 */
++			  "WL_ON", /* GPIO41 */
++			  "NC", /* GPIO42 */
++			  "WIFI_CLK", /* GPIO43 */
++			  "CAM_GPIO0", /* GPIO44 */
++			  "BT_ON", /* GPIO45 */
++			  "HDMI_HPD_N",
++			  "STATUS_LED_N",
++			  /* Used by SD Card */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	sdio_pins: sdio_pins {
++		brcm,pins = <34 35 36 37 38 39>;
++		brcm,function = <7>; /* ALT3 = SD1 */
++		brcm,pull = <0 2 2 2 2 2>;
++	};
++
++	bt_pins: bt_pins {
++		brcm,pins = <43>;
++		brcm,function = <4>; /* alt0:GPCLK2 */
++		brcm,pull = <0>; /* none */
++	};
++
++	uart0_pins: uart0_pins {
++		brcm,pins = <30 31 32 33>;
++		brcm,function = <7>; /* alt3=UART0 */
++		brcm,pull = <2 0 0 2>; /* up none none up */
++	};
++
++	uart1_pins: uart1_pins {
++		brcm,pins;
++		brcm,function;
++		brcm,pull;
++	};
++
++	uart1_bt_pins: uart1_bt_pins {
++		brcm,pins = <32 33 30 31>;
++		brcm,function = <BCM2835_FSEL_ALT5>; /* alt5=UART1 */
++		brcm,pull = <0 2 2 0>;
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins = <>;
++		brcm,function = <>;
++	};
++};
++
++&mmcnr {
++	pinctrl-names = "default";
++	pinctrl-0 = <&sdio_pins>;
++	bus-width = <4>;
++	status = "okay";
++	#address-cells = <1>;
++	#size-cells = <0>;
++
++	brcmf: wifi@1 {
++		reg = <1>;
++		compatible = "brcm,bcm4329-fmac";
++	};
++};
++
++&uart0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart0_pins &bt_pins>;
++	status = "okay";
++};
++
++&uart1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart1_pins>;
++	status = "okay";
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&led_act {
++	gpios = <&gpio 47 GPIO_ACTIVE_LOW>;
++	default-state = "off";
++	linux,default-trigger = "actpwr";
++};
++
++&hdmi {
++	hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&cam1_reg {
++	gpio = <&gpio 44 GPIO_ACTIVE_HIGH>;
++};
++
++cam0_reg: &cam_dummy_reg {
++};
++
++i2c_arm: &i2c1 {};
++i2c_vc: &i2c0 {};
++i2c_csi_dsi0: &i2c0 {};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&led_act>,"gpios:4";
++		act_led_activelow = <&led_act>,"gpios:8";
++		act_led_trigger = <&led_act>,"linux,default-trigger";
++	};
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2708-rpi-zero.dts b/arch/arm/boot/dts/broadcom/bcm2708-rpi-zero.dts
+new file mode 100644
+index 000000000000..1721be8dbe20
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm2708-rpi-zero.dts
+@@ -0,0 +1,189 @@
++/dts-v1/;
++
++#include "bcm2708.dtsi"
++#include "bcm2708-rpi.dtsi"
++#include "bcm283x-rpi-csi1-2lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_28.dtsi"
++#include "bcm283x-rpi-led-deprecated.dtsi"
++
++/ {
++	compatible = "raspberrypi,model-zero", "brcm,bcm2835";
++	model = "Raspberry Pi Zero";
++};
++
++&gpio {
++	/*
++	 * This is based on the official GPU firmware DT blob.
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "ID_SDA",
++			  "ID_SCL",
++			  "GPIO2",
++			  "GPIO3",
++			  "GPIO4",
++			  "GPIO5",
++			  "GPIO6",
++			  "GPIO7",
++			  "GPIO8",
++			  "GPIO9",
++			  "GPIO10",
++			  "GPIO11",
++			  "GPIO12",
++			  "GPIO13",
++			  "GPIO14",
++			  "GPIO15",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "SDA0",
++			  "SCL0",
++			  "NC", /* GPIO30 */
++			  "NC", /* GPIO31 */
++			  "CAM_GPIO1", /* GPIO32 */
++			  "NC", /* GPIO33 */
++			  "NC", /* GPIO34 */
++			  "NC", /* GPIO35 */
++			  "NC", /* GPIO36 */
++			  "NC", /* GPIO37 */
++			  "NC", /* GPIO38 */
++			  "NC", /* GPIO39 */
++			  "NC", /* GPIO40 */
++			  "CAM_GPIO0", /* GPIO41 */
++			  "NC", /* GPIO42 */
++			  "NC", /* GPIO43 */
++			  "NC", /* GPIO44 */
++			  "NC", /* GPIO45 */
++			  "HDMI_HPD_N",
++			  "STATUS_LED_N",
++			  /* Used by SD Card */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins = <>;
++		brcm,function = <>;
++	};
++};
++
++&uart0 {
++	status = "okay";
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&led_act {
++	gpios = <&gpio 47 GPIO_ACTIVE_LOW>;
++	default-state = "off";
++	linux,default-trigger = "actpwr";
++};
++
++&hdmi {
++	hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&cam1_reg {
++	gpio = <&gpio 41 GPIO_ACTIVE_HIGH>;
++};
++
++cam0_reg: &cam_dummy_reg {
++};
++
++i2c_arm: &i2c1 {};
++i2c_vc: &i2c0 {};
++i2c_csi_dsi0: &i2c0 {};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&led_act>,"gpios:4";
++		act_led_activelow = <&led_act>,"gpios:8";
++		act_led_trigger = <&led_act>,"linux,default-trigger";
++	};
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2708-rpi.dtsi b/arch/arm/boot/dts/broadcom/bcm2708-rpi.dtsi
+new file mode 100644
+index 000000000000..f4aedb5c532b
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm2708-rpi.dtsi
+@@ -0,0 +1,63 @@
++/* Downstream modifications common to bcm2835, bcm2836, bcm2837 */
++
++#define i2c0 i2c0mux
++#include "bcm2835-rpi.dtsi"
++#undef i2c0
++#include "bcm270x-rpi.dtsi"
++
++/ {
++	memory@0 {
++		device_type = "memory";
++		reg = <0x0 0x0>;
++	};
++
++	aliases {
++		i2c2 = &i2c2;
++	};
++
++	__overrides__ {
++		hdmi = <&hdmi>,"status";
++		i2c2_iknowwhatimdoing = <&i2c2>,"status";
++		i2c2_baudrate = <&i2c2>,"clock-frequency:0";
++		nvmem_cust_rw = <&nvmem_cust>,"rw?";
++		sd = <&sdhost>,"status";
++		sd_poll_once = <&sdhost>,"non-removable?";
++	};
++};
++
++&soc {
++	nvmem {
++		compatible = "simple-bus";
++		#address-cells = <1>;
++		#size-cells = <1>;
++
++		nvmem_otp: nvmem_otp {
++			compatible = "raspberrypi,rpi-otp";
++			firmware = <&firmware>;
++			reg = <0 192>;
++			status = "okay";
++		};
++
++		nvmem_cust: nvmem_cust {
++			compatible = "raspberrypi,rpi-otp";
++			firmware = <&firmware>;
++			reg = <1 8>;
++			status = "okay";
++		};
++	};
++};
++
++&sdhost {
++	pinctrl-names = "default";
++	pinctrl-0 = <&sdhost_gpio48>;
++	status = "okay";
++};
++
++&hdmi {
++	power-domains = <&power RPI_POWER_DOMAIN_HDMI>;
++	status = "disabled";
++};
++
++&i2c2 {
++	status = "disabled";
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2708.dtsi b/arch/arm/boot/dts/broadcom/bcm2708.dtsi
+new file mode 100644
+index 000000000000..fdc7f2423bbe
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm2708.dtsi
+@@ -0,0 +1,19 @@
++#define i2c0 i2c0if
++#include "bcm2835.dtsi"
++#undef i2c0
++#include "bcm270x.dtsi"
++
++/ {
++	__overrides__ {
++		arm_freq;
++	};
++};
++
++&soc {
++	dma-ranges = <0x80000000 0x00000000 0x20000000>,
++		     <0x7e000000 0x20000000 0x02000000>;
++};
++
++&vc4 {
++	status = "disabled";
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2709-rpi-2-b.dts b/arch/arm/boot/dts/broadcom/bcm2709-rpi-2-b.dts
+new file mode 100644
+index 000000000000..7796e545da43
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm2709-rpi-2-b.dts
+@@ -0,0 +1,204 @@
++/dts-v1/;
++
++#include "bcm2709.dtsi"
++#include "bcm2709-rpi.dtsi"
++#include "bcm283x-rpi-smsc9514.dtsi"
++#include "bcm283x-rpi-csi1-2lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_28.dtsi"
++#include "bcm283x-rpi-led-deprecated.dtsi"
++
++/ {
++	compatible = "raspberrypi,2-model-b", "brcm,bcm2836";
++	model = "Raspberry Pi 2 Model B";
++};
++
++&gpio {
++	/*
++	 * Taken from rpi_SCH_2b_1p2_reduced.pdf and
++	 * the official GPU firmware DT blob.
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "ID_SDA",
++			  "ID_SCL",
++			  "GPIO2",
++			  "GPIO3",
++			  "GPIO4",
++			  "GPIO5",
++			  "GPIO6",
++			  "GPIO7",
++			  "GPIO8",
++			  "GPIO9",
++			  "GPIO10",
++			  "GPIO11",
++			  "GPIO12",
++			  "GPIO13",
++			  "GPIO14",
++			  "GPIO15",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "SDA0",
++			  "SCL0",
++			  "NC", /* GPIO30 */
++			  "LAN_RUN",
++			  "CAM_GPIO1",
++			  "NC", /* GPIO33 */
++			  "NC", /* GPIO34 */
++			  "PWR_LOW_N",
++			  "NC", /* GPIO36 */
++			  "NC", /* GPIO37 */
++			  "USB_LIMIT",
++			  "NC", /* GPIO39 */
++			  "PWM0_OUT",
++			  "CAM_GPIO0",
++			  "SMPS_SCL",
++			  "SMPS_SDA",
++			  "ETH_CLK",
++			  "PWM1_OUT",
++			  "HDMI_HPD_N",
++			  "STATUS_LED",
++			  /* Used by SD Card */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins = <40 45>;
++		brcm,function = <4>;
++		brcm,pull = <0>;
++	};
++};
++
++&uart0 {
++	status = "okay";
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&led_act {
++	gpios = <&gpio 47 GPIO_ACTIVE_HIGH>;
++	default-state = "off";
++	linux,default-trigger = "mmc0";
++};
++
++&leds {
++	led_pwr: led-pwr {
++		label = "PWR";
++		gpios = <&gpio 35 GPIO_ACTIVE_HIGH>;
++		default-state = "off";
++		linux,default-trigger = "input";
++	};
++};
++
++&hdmi {
++	hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&cam1_reg {
++	gpio = <&gpio 41 GPIO_ACTIVE_HIGH>;
++};
++
++cam0_reg: &cam_dummy_reg {
++};
++
++i2c_csi_dsi0: &i2c0 {
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_headphones=1 snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_headphones=0 snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&led_act>,"gpios:4";
++		act_led_activelow = <&led_act>,"gpios:8";
++		act_led_trigger = <&led_act>,"linux,default-trigger";
++
++		pwr_led_gpio = <&led_pwr>,"gpios:4";
++		pwr_led_activelow = <&led_pwr>,"gpios:8";
++		pwr_led_trigger = <&led_pwr>,"linux,default-trigger";
++	};
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2709-rpi-cm2.dts b/arch/arm/boot/dts/broadcom/bcm2709-rpi-cm2.dts
+new file mode 100644
+index 000000000000..36d00aa889a3
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm2709-rpi-cm2.dts
+@@ -0,0 +1,215 @@
++/dts-v1/;
++
++#include "bcm2709.dtsi"
++#include "bcm2709-rpi.dtsi"
++#include "bcm283x-rpi-csi0-2lane.dtsi"
++#include "bcm283x-rpi-csi1-4lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_28.dtsi"
++#include "bcm283x-rpi-led-deprecated.dtsi"
++
++/ {
++	compatible = "raspberrypi,2-compute-module", "brcm,bcm2836";
++	model = "Raspberry Pi Compute Module 2";
++};
++
++&cam1_reg {
++	gpio = <&gpio 2 GPIO_ACTIVE_HIGH>;
++	status = "disabled";
++};
++
++cam0_reg: &cam0_regulator {
++	gpio = <&gpio 30 GPIO_ACTIVE_HIGH>;
++};
++
++i2c_csi_dsi0: &i2c0 {
++};
++
++&uart0 {
++	status = "okay";
++};
++
++&gpio {
++	/*
++	 * This is based on the official GPU firmware DT blob.
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "GPIO0",
++			  "GPIO1",
++			  "GPIO2",
++			  "GPIO3",
++			  "GPIO4",
++			  "GPIO5",
++			  "GPIO6",
++			  "GPIO7",
++			  "GPIO8",
++			  "GPIO9",
++			  "GPIO10",
++			  "GPIO11",
++			  "GPIO12",
++			  "GPIO13",
++			  "GPIO14",
++			  "GPIO15",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "GPIO28",
++			  "GPIO29",
++			  "GPIO30",
++			  "GPIO31",
++			  "GPIO32",
++			  "GPIO33",
++			  "GPIO34",
++			  "GPIO35",
++			  "GPIO36",
++			  "GPIO37",
++			  "GPIO38",
++			  "GPIO39",
++			  "GPIO40",
++			  "GPIO41",
++			  "GPIO42",
++			  "GPIO43",
++			  "GPIO44",
++			  "GPIO45",
++			  "SMPS_SCL",
++			  "SMPS_SDA",
++			  /* Used by eMMC */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins;
++		brcm,function;
++	};
++};
++
++&firmware {
++	expgpio: expgpio {
++		compatible = "raspberrypi,firmware-gpio";
++		gpio-controller;
++		#gpio-cells = <2>;
++		gpio-line-names = "HDMI_HPD_N",
++				  "EMMC_EN_N",
++				  "NC",
++				  "NC",
++				  "NC",
++				  "NC",
++				  "NC",
++				  "NC";
++		status = "okay";
++	};
++
++	virtgpio: virtgpio {
++		compatible = "brcm,bcm2835-virtgpio";
++		gpio-controller;
++		#gpio-cells = <2>;
++		status = "okay";
++	};
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&led_act {
++	gpios = <&virtgpio 0 GPIO_ACTIVE_HIGH>;
++	default-state = "off";
++	linux,default-trigger = "mmc0";
++};
++
++&hdmi {
++	hpd-gpios = <&expgpio 0 GPIO_ACTIVE_LOW>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&led_act>,"gpios:4";
++		act_led_activelow = <&led_act>,"gpios:8";
++		act_led_trigger = <&led_act>,"linux,default-trigger";
++	};
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2709-rpi.dtsi b/arch/arm/boot/dts/broadcom/bcm2709-rpi.dtsi
+new file mode 100644
+index 000000000000..7335e7fbcb71
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm2709-rpi.dtsi
+@@ -0,0 +1,8 @@
++#include "bcm2708-rpi.dtsi"
++
++&vchiq {
++	compatible = "brcm,bcm2836-vchiq", "brcm,bcm2835-vchiq";
++};
++
++i2c_arm: &i2c1 {};
++i2c_vc: &i2c0 {};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2709.dtsi b/arch/arm/boot/dts/broadcom/bcm2709.dtsi
+new file mode 100644
+index 000000000000..868f65f922ff
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm2709.dtsi
+@@ -0,0 +1,29 @@
++#define i2c0 i2c0if
++#include "bcm2836.dtsi"
++#undef i2c0
++#include "bcm270x.dtsi"
++
++/ {
++	soc {
++		ranges = <0x7e000000 0x3f000000 0x01000000>,
++		         <0x40000000 0x40000000 0x00040000>;
++
++		dma-ranges = <0xc0000000 0x00000000 0x3f000000>,
++			     <0x7e000000 0x3f000000 0x01000000>;
++	};
++
++	__overrides__ {
++		arm_freq = <&v7_cpu0>, "clock-frequency:0",
++			   <&v7_cpu1>, "clock-frequency:0",
++			   <&v7_cpu2>, "clock-frequency:0",
++			   <&v7_cpu3>, "clock-frequency:0";
++	};
++};
++
++&system_timer {
++	status = "disabled";
++};
++
++&vc4 {
++	status = "disabled";
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm270x-rpi.dtsi b/arch/arm/boot/dts/broadcom/bcm270x-rpi.dtsi
+new file mode 100644
+index 000000000000..eeef9788d649
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm270x-rpi.dtsi
+@@ -0,0 +1,201 @@
++/* Downstream modifications to bcm2835-rpi.dtsi */
++
++/ {
++	aliases: aliases {
++		aux = &aux;
++		sound = &sound;
++		soc = &soc;
++		dma = &dma;
++		intc = &intc;
++		watchdog = &watchdog;
++		random = &random;
++		mailbox = &mailbox;
++		gpio = &gpio;
++		uart0 = &uart0;
++		uart1 = &uart1;
++		sdhost = &sdhost;
++		mmc = &mmc;
++		mmc1 = &mmc;
++		mmc0 = &sdhost;
++		i2s = &i2s;
++		i2c0 = &i2c0;
++		i2c1 = &i2c1;
++		i2c10 = &i2c_csi_dsi;
++		i2c = &i2c_arm;
++		spi0 = &spi0;
++		spi1 = &spi1;
++		spi2 = &spi2;
++		usb = &usb;
++		leds = &leds;
++		fb = &fb;
++		thermal = &thermal;
++		axiperf = &axiperf;
++	};
++
++	/* Define these notional regulators for use by overlays */
++	vdd_3v3_reg: fixedregulator_3v3 {
++		compatible = "regulator-fixed";
++		regulator-always-on;
++		regulator-max-microvolt = <3300000>;
++		regulator-min-microvolt = <3300000>;
++		regulator-name = "3v3";
++	};
++
++	vdd_5v0_reg: fixedregulator_5v0 {
++		compatible = "regulator-fixed";
++		regulator-always-on;
++		regulator-max-microvolt = <5000000>;
++		regulator-min-microvolt = <5000000>;
++		regulator-name = "5v0";
++	};
++
++	soc {
++		gpiomem {
++			compatible = "brcm,bcm2835-gpiomem";
++			reg = <0x7e200000 0x1000>;
++		};
++
++		fb: fb {
++			compatible = "brcm,bcm2708-fb";
++			firmware = <&firmware>;
++			status = "okay";
++		};
++
++		/* External sound card */
++		sound: sound {
++			status = "disabled";
++		};
++	};
++
++	__overrides__ {
++		cache_line_size;
++
++		uart0 = <&uart0>,"status";
++		uart1 = <&uart1>,"status";
++		i2s = <&i2s>,"status";
++		spi = <&spi0>,"status";
++		i2c0 = <&i2c0if>,"status",<&i2c0mux>,"status";
++		i2c1 = <&i2c1>,"status";
++		i2c = <&i2c1>,"status";
++		i2c_arm = <&i2c1>,"status";
++		i2c_vc = <&i2c0if>,"status",<&i2c0mux>,"status";
++		i2c0_baudrate = <&i2c0if>,"clock-frequency:0";
++		i2c1_baudrate = <&i2c1>,"clock-frequency:0";
++		i2c_baudrate = <&i2c1>,"clock-frequency:0";
++		i2c_arm_baudrate = <&i2c1>,"clock-frequency:0";
++		i2c_vc_baudrate = <&i2c0if>,"clock-frequency:0";
++
++		watchdog = <&watchdog>,"status";
++		random = <&random>,"status";
++		sd_overclock = <&sdhost>,"brcm,overclock-50:0";
++		sd_force_pio = <&sdhost>,"brcm,force-pio?";
++		sd_pio_limit = <&sdhost>,"brcm,pio-limit:0";
++		sd_debug     = <&sdhost>,"brcm,debug";
++		sdio_overclock = <&mmc>,"brcm,overclock-50:0",
++				 <&mmcnr>,"brcm,overclock-50:0";
++		axiperf      = <&axiperf>,"status";
++		drm_fb0_vc4 = <&aliases>, "drm-fb0=",&vc4;
++		drm_fb1_vc4 = <&aliases>, "drm-fb1=",&vc4;
++		drm_fb2_vc4 = <&aliases>, "drm-fb2=",&vc4;
++
++		cam1_sync = <&csi1>, "sync-gpios:0=", <&gpio>,
++			    <&csi1>, "sync-gpios:4",
++			    <&csi1>, "sync-gpios:8=", <GPIO_ACTIVE_HIGH>;
++		cam1_sync_inverted = <&csi1>, "sync-gpios:0=", <&gpio>,
++			    <&csi1>, "sync-gpios:4",
++			    <&csi1>, "sync-gpios:8=", <GPIO_ACTIVE_LOW>;
++		cam0_sync = <&csi0>, "sync-gpios:0=", <&gpio>,
++			    <&csi0>, "sync-gpios:4",
++			    <&csi0>, "sync-gpios:8=", <GPIO_ACTIVE_HIGH>;
++		cam0_sync_inverted = <&csi0>, "sync-gpios:0=", <&gpio>,
++			    <&csi0>, "sync-gpios:4",
++			    <&csi0>, "sync-gpios:8=", <GPIO_ACTIVE_LOW>;
++
++		cam0_reg = <&cam0_reg>,"status";
++		cam0_reg_gpio = <&cam0_reg>,"gpio:4",
++				<&cam0_reg>,"gpio:0=", <&gpio>;
++		cam1_reg = <&cam1_reg>,"status";
++		cam1_reg_gpio = <&cam1_reg>,"gpio:4",
++				<&cam1_reg>,"gpio:0=", <&gpio>;
++
++		strict_gpiod = <&chosen>, "bootargs=pinctrl_bcm2835.persist_gpio_outputs=n";
++	};
++};
++
++&uart0 {
++	skip-init;
++};
++
++&uart1 {
++	skip-init;
++};
++
++&txp {
++	status = "disabled";
++};
++
++&i2c0if {
++	status = "disabled";
++};
++
++&i2c0mux {
++	pinctrl-names = "i2c0", "i2c_csi_dsi";
++	/delete-property/ clock-frequency;
++	status = "disabled";
++};
++
++&i2c1 {
++	status = "disabled";
++};
++
++i2s_clk_producer: &i2s {};
++i2s_clk_consumer: &i2s {};
++
++&clocks {
++	firmware = <&firmware>;
++};
++
++&sdhci {
++	pinctrl-names = "default";
++	pinctrl-0 = <&emmc_gpio48>;
++	bus-width = <4>;
++};
++
++&cpu_thermal {
++	// Add some labels
++	thermal_trips: trips {
++		cpu-crit {
++			// Raise upstream limit of 90C
++			temperature = <110000>;
++		};
++	};
++	cooling_maps: cooling-maps {
++	};
++};
++
++&vec {
++	clocks = <&firmware_clocks 15>;
++	status = "disabled";
++};
++
++&firmware {
++	vcio: vcio {
++		compatible = "raspberrypi,vcio";
++	};
++};
++
++&vc4 {
++	raspberrypi,firmware = <&firmware>;
++};
++
++#ifndef BCM2711
++
++&hdmi {
++	reg-names = "hdmi",
++		    "hd";
++	clocks = <&firmware_clocks 9>,
++		 <&firmware_clocks 13>;
++	dmas = <&dma (17|(1<<27)|(1<<24))>;
++};
++
++#endif
+diff --git a/arch/arm/boot/dts/broadcom/bcm270x.dtsi b/arch/arm/boot/dts/broadcom/bcm270x.dtsi
+new file mode 100644
+index 000000000000..678bee7d96e7
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm270x.dtsi
+@@ -0,0 +1,264 @@
++/* Downstream bcm283x.dtsi diff */
++#include <dt-bindings/power/raspberrypi-power.h>
++
++/ {
++	chosen: chosen {
++		// Disable audio by default
++		bootargs = "coherent_pool=1M snd_bcm2835.enable_headphones=0 cgroup_disable=memory";
++		stdout-path = "serial0:115200n8";
++	};
++
++	soc: soc {
++		watchdog: watchdog@7e100000 {
++			/* Add label */
++		};
++
++		random: rng@7e104000 {
++			/* Add label */
++		};
++
++		spi0: spi@7e204000 {
++			/* Add label */
++		};
++
++#ifndef BCM2711
++		pixelvalve0: pixelvalve@7e206000 {
++			/* Add label */
++			status = "disabled";
++		};
++
++		pixelvalve1: pixelvalve@7e207000 {
++			/* Add label */
++			status = "disabled";
++		};
++#endif
++
++		/delete-node/ mmc@7e300000;
++
++		sdhci: mmc: mmc@7e300000 {
++			compatible = "brcm,bcm2835-mmc", "brcm,bcm2835-sdhci";
++			reg = <0x7e300000 0x100>;
++			interrupts = <2 30>;
++			clocks = <&clocks BCM2835_CLOCK_EMMC>;
++			dmas = <&dma 11>;
++			dma-names = "rx-tx";
++			brcm,overclock-50 = <0>;
++			status = "disabled";
++		};
++
++		/* A clone of mmc but with non-removable set */
++		mmcnr: mmcnr@7e300000 {
++			compatible = "brcm,bcm2835-mmc", "brcm,bcm2835-sdhci";
++			reg = <0x7e300000 0x100>;
++			interrupts = <2 30>;
++			clocks = <&clocks BCM2835_CLOCK_EMMC>;
++			dmas = <&dma 11>;
++			dma-names = "rx-tx";
++			brcm,overclock-50 = <0>;
++			non-removable;
++			status = "disabled";
++		};
++
++		hvs: hvs@7e400000 {
++			/* Add label */
++			status = "disabled";
++		};
++
++		firmwarekms: firmwarekms@7e600000 {
++			compatible = "raspberrypi,rpi-firmware-kms";
++			/* SMI interrupt reg */
++			reg = <0x7e600000 0x100>;
++			interrupts = <2 16>;
++			brcm,firmware = <&firmware>;
++			status = "disabled";
++		};
++
++		smi: smi@7e600000 {
++			compatible = "brcm,bcm2835-smi";
++			reg = <0x7e600000 0x100>;
++			interrupts = <2 16>;
++			clocks = <&clocks BCM2835_CLOCK_SMI>;
++			assigned-clocks = <&clocks BCM2835_CLOCK_SMI>;
++			assigned-clock-rates = <125000000>;
++			dmas = <&dma 4>;
++			dma-names = "rx-tx";
++			status = "disabled";
++		};
++
++#ifndef BCM2711
++		pixelvalve2: pixelvalve@7e807000 {
++			/* Add label */
++			status = "disabled";
++		};
++#endif
++
++		hdmi@7e902000 { /* hdmi */
++			status = "disabled";
++		};
++
++		usb@7e980000 { /* usb */
++			compatible = "brcm,bcm2708-usb";
++			reg = <0x7e980000 0x10000>,
++			      <0x7e006000 0x1000>;
++			interrupt-names = "usb",
++					  "soft";
++			interrupts = <1 9>,
++				     <2 0>;
++		};
++
++#ifndef BCM2711
++		v3d@7ec00000 { /* vd3 */
++			compatible = "brcm,vc4-v3d";
++			power-domains = <&power RPI_POWER_DOMAIN_V3D>;
++			status = "disabled";
++		};
++#endif
++
++		axiperf: axiperf {
++			compatible = "brcm,bcm2835-axiperf";
++			reg = <0x7e009800 0x100>,
++			      <0x7ee08000 0x100>;
++			firmware = <&firmware>;
++			status = "disabled";
++		};
++
++		i2c0mux: i2c0mux {
++			compatible = "i2c-mux-pinctrl";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			i2c-parent = <&i2c0if>;
++
++			status = "disabled";
++
++			i2c0: i2c@0 {
++				reg = <0>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++			};
++
++			i2c_csi_dsi: i2c@1 {
++				reg = <1>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++			};
++		};
++	};
++
++	cam1_reg: cam1_regulator {
++		compatible = "regulator-fixed";
++		regulator-name = "cam1-reg";
++		enable-active-high;
++		/* Needs to be enabled, as removing a regulator is very unsafe */
++		status = "okay";
++	};
++
++	cam1_clk: cam1_clk {
++		compatible = "fixed-clock";
++		#clock-cells = <0>;
++		status = "disabled";
++	};
++
++	cam0_regulator: cam0_regulator {
++		compatible = "regulator-fixed";
++		regulator-name = "cam0-reg";
++		enable-active-high;
++		status = "disabled";
++	};
++
++	cam0_clk: cam0_clk {
++		compatible = "fixed-clock";
++		#clock-cells = <0>;
++		status = "disabled";
++	};
++
++	cam_dummy_reg: cam_dummy_reg {
++		compatible = "regulator-fixed";
++		regulator-name = "cam-dummy-reg";
++		status = "okay";
++	};
++
++	__overrides__ {
++		cam0-pwdn-ctrl;
++		cam0-pwdn;
++		cam0-led-ctrl;
++		cam0-led;
++	};
++};
++
++&gpio {
++	interrupts = <2 17>, <2 18>;
++
++	dpi_18bit_cpadhi_gpio0: dpi_18bit_cpadhi_gpio0 {
++		brcm,pins = <0 1 2 3 4 5 6 7 8 9
++			     12 13 14 15 16 17
++			     20 21 22 23 24 25>;
++		brcm,function = <BCM2835_FSEL_ALT2>;
++		brcm,pull = <0>; /* no pull */
++	};
++	dpi_18bit_cpadhi_gpio2: dpi_18bit_cpadhi_gpio2 {
++		brcm,pins = <2 3 4 5 6 7 8 9
++			     12 13 14 15 16 17
++			     20 21 22 23 24 25>;
++		brcm,function = <BCM2835_FSEL_ALT2>;
++	};
++	dpi_18bit_gpio0: dpi_18bit_gpio0 {
++		brcm,pins = <0 1 2 3 4 5 6 7 8 9 10 11
++			     12 13 14 15 16 17 18 19
++			     20 21>;
++		brcm,function = <BCM2835_FSEL_ALT2>;
++	};
++	dpi_18bit_gpio2: dpi_18bit_gpio2 {
++		brcm,pins = <2 3 4 5 6 7 8 9 10 11
++			     12 13 14 15 16 17 18 19
++			     20 21>;
++		brcm,function = <BCM2835_FSEL_ALT2>;
++	};
++	dpi_16bit_gpio0: dpi_16bit_gpio0 {
++		brcm,pins = <0 1 2 3 4 5 6 7 8 9 10 11
++			     12 13 14 15 16 17 18 19>;
++		brcm,function = <BCM2835_FSEL_ALT2>;
++	};
++	dpi_16bit_gpio2: dpi_16bit_gpio2 {
++		brcm,pins = <2 3 4 5 6 7 8 9 10 11
++			     12 13 14 15 16 17 18 19>;
++		brcm,function = <BCM2835_FSEL_ALT2>;
++	};
++	dpi_16bit_cpadhi_gpio0: dpi_16bit_cpadhi_gpio0 {
++		brcm,pins = <0 1 2 3 4 5 6 7 8
++			     12 13 14 15 16 17
++			     20 21 22 23 24>;
++		brcm,function = <BCM2835_FSEL_ALT2>;
++	};
++	dpi_16bit_cpadhi_gpio2: dpi_16bit_cpadhi_gpio2 {
++		brcm,pins = <2 3 4 5 6 7 8
++			     12 13 14 15 16 17
++			     20 21 22 23 24>;
++		brcm,function = <BCM2835_FSEL_ALT2>;
++	};
++};
++
++&uart0 {
++	/* Enable CTS bug workaround */
++	cts-event-workaround;
++};
++
++&i2s {
++	#sound-dai-cells = <0>;
++	dmas = <&dma 2>, <&dma 3>;
++	dma-names = "tx", "rx";
++};
++
++&sdhost {
++	dmas = <&dma (13|(1<<29))>;
++	dma-names = "rx-tx";
++	bus-width = <4>;
++	brcm,overclock-50 = <0>;
++	brcm,pio-limit = <1>;
++	firmware = <&firmware>;
++};
++
++&spi0 {
++	dmas = <&dma 6>, <&dma 7>;
++	dma-names = "tx", "rx";
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2710-rpi-2-b.dts b/arch/arm/boot/dts/broadcom/bcm2710-rpi-2-b.dts
+new file mode 100644
+index 000000000000..ce48eb6073f0
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm2710-rpi-2-b.dts
+@@ -0,0 +1,204 @@
++/dts-v1/;
++
++#include "bcm2710.dtsi"
++#include "bcm2709-rpi.dtsi"
++#include "bcm283x-rpi-smsc9514.dtsi"
++#include "bcm283x-rpi-csi1-2lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_28.dtsi"
++#include "bcm283x-rpi-led-deprecated.dtsi"
++
++/ {
++	compatible = "raspberrypi,2-model-b-rev2", "brcm,bcm2837";
++	model = "Raspberry Pi 2 Model B rev 1.2";
++};
++
++&gpio {
++	/*
++	 * Taken from rpi_SCH_2b_1p2_reduced.pdf and
++	 * the official GPU firmware DT blob.
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "ID_SDA",
++			  "ID_SCL",
++			  "GPIO2",
++			  "GPIO3",
++			  "GPIO4",
++			  "GPIO5",
++			  "GPIO6",
++			  "GPIO7",
++			  "GPIO8",
++			  "GPIO9",
++			  "GPIO10",
++			  "GPIO11",
++			  "GPIO12",
++			  "GPIO13",
++			  "GPIO14",
++			  "GPIO15",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "SDA0",
++			  "SCL0",
++			  "NC", /* GPIO30 */
++			  "LAN_RUN",
++			  "CAM_GPIO1",
++			  "NC", /* GPIO33 */
++			  "NC", /* GPIO34 */
++			  "PWR_LOW_N",
++			  "NC", /* GPIO36 */
++			  "NC", /* GPIO37 */
++			  "USB_LIMIT",
++			  "NC", /* GPIO39 */
++			  "PWM0_OUT",
++			  "CAM_GPIO0",
++			  "SMPS_SCL",
++			  "SMPS_SDA",
++			  "ETH_CLK",
++			  "PWM1_OUT",
++			  "HDMI_HPD_N",
++			  "STATUS_LED",
++			  /* Used by SD Card */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins = <40 45>;
++		brcm,function = <4>;
++		brcm,pull = <0>;
++	};
++};
++
++&uart0 {
++	status = "okay";
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&led_act {
++	gpios = <&gpio 47 GPIO_ACTIVE_HIGH>;
++	default-state = "off";
++	linux,default-trigger = "mmc0";
++};
++
++&leds {
++	led_pwr: led-pwr {
++		label = "PWR";
++		gpios = <&gpio 35 GPIO_ACTIVE_HIGH>;
++		default-state = "off";
++		linux,default-trigger = "input";
++	};
++};
++
++&hdmi {
++	hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&cam1_reg {
++	gpio = <&gpio 41 GPIO_ACTIVE_HIGH>;
++};
++
++cam0_reg: &cam_dummy_reg {
++};
++
++i2c_csi_dsi0: &i2c0 {
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_headphones=1 snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_headphones=0 snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&led_act>,"gpios:4";
++		act_led_activelow = <&led_act>,"gpios:8";
++		act_led_trigger = <&led_act>,"linux,default-trigger";
++
++		pwr_led_gpio = <&led_pwr>,"gpios:4";
++		pwr_led_activelow = <&led_pwr>,"gpios:8";
++		pwr_led_trigger = <&led_pwr>,"linux,default-trigger";
++	};
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2710-rpi-3-b-plus.dts b/arch/arm/boot/dts/broadcom/bcm2710-rpi-3-b-plus.dts
+new file mode 100644
+index 000000000000..8973985e9902
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm2710-rpi-3-b-plus.dts
+@@ -0,0 +1,295 @@
++/dts-v1/;
++
++#include "bcm2710.dtsi"
++#include "bcm2709-rpi.dtsi"
++#include "bcm283x-rpi-lan7515.dtsi"
++#include "bcm283x-rpi-csi1-2lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_44.dtsi"
++#include "bcm271x-rpi-bt.dtsi"
++#include "bcm283x-rpi-led-deprecated.dtsi"
++
++/ {
++	compatible = "raspberrypi,3-model-b-plus", "brcm,bcm2837";
++	model = "Raspberry Pi 3 Model B+";
++
++	aliases {
++		serial0 = &uart1;
++		serial1 = &uart0;
++		mmc1 = &mmcnr;
++	};
++};
++
++&gpio {
++	/*
++	 * Taken from rpi_SCH_3bplus_1p0_reduced.pdf and
++	 * the official GPU firmware DT blob.
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "ID_SDA",
++			  "ID_SCL",
++			  "GPIO2",
++			  "GPIO3",
++			  "GPIO4",
++			  "GPIO5",
++			  "GPIO6",
++			  "GPIO7",
++			  "GPIO8",
++			  "GPIO9",
++			  "GPIO10",
++			  "GPIO11",
++			  "GPIO12",
++			  "GPIO13",
++			  "GPIO14",
++			  "GPIO15",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "HDMI_HPD_N",
++			  "STATUS_LED_G",
++			  /* Used by BT module */
++			  "CTS0",
++			  "RTS0",
++			  "TXD0",
++			  "RXD0",
++			  /* Used by Wifi */
++			  "SD1_CLK",
++			  "SD1_CMD",
++			  "SD1_DATA0",
++			  "SD1_DATA1",
++			  "SD1_DATA2",
++			  "SD1_DATA3",
++			  "PWM0_OUT",
++			  "PWM1_OUT",
++			  "ETH_CLK",
++			  "WIFI_CLK",
++			  "SDA0",
++			  "SCL0",
++			  "SMPS_SCL",
++			  "SMPS_SDA",
++			  /* Used by SD Card */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	sdio_pins: sdio_pins {
++		brcm,pins =     <34 35 36 37 38 39>;
++		brcm,function = <7>; // alt3 = SD1
++		brcm,pull =     <0 2 2 2 2 2>;
++	};
++
++	bt_pins: bt_pins {
++		brcm,pins = <43>;
++		brcm,function = <4>; /* alt0:GPCLK2 */
++		brcm,pull = <0>;
++	};
++
++	uart0_pins: uart0_pins {
++		brcm,pins = <32 33>;
++		brcm,function = <7>; /* alt3=UART0 */
++		brcm,pull = <0 2>;
++	};
++
++	uart1_pins: uart1_pins {
++		brcm,pins;
++		brcm,function;
++		brcm,pull;
++	};
++
++	uart1_bt_pins: uart1_bt_pins {
++		brcm,pins = <32 33 30 31>;
++		brcm,function = <BCM2835_FSEL_ALT5>; /* alt5=UART1 */
++		brcm,pull = <0 2 2 0>;
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins = <40 41>;
++		brcm,function = <4>;
++		brcm,pull = <0>;
++	};
++};
++
++&mmcnr {
++	pinctrl-names = "default";
++	pinctrl-0 = <&sdio_pins>;
++	bus-width = <4>;
++	status = "okay";
++	#address-cells = <1>;
++	#size-cells = <0>;
++
++	brcmf: wifi@1 {
++		reg = <1>;
++		compatible = "brcm,bcm4329-fmac";
++	};
++};
++
++&firmware {
++	expgpio: expgpio {
++		compatible = "raspberrypi,firmware-gpio";
++		gpio-controller;
++		#gpio-cells = <2>;
++		gpio-line-names = "BT_ON",
++				  "WL_ON",
++				  "PWR_LED_R",
++				  "LAN_RUN",
++				  "NC",
++				  "CAM_GPIO0",
++				  "CAM_GPIO1",
++				  "NC";
++		status = "okay";
++	};
++};
++
++&uart0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart0_pins &bt_pins>;
++	status = "okay";
++};
++
++&uart1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart1_pins>;
++	status = "okay";
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&led_act {
++	gpios = <&gpio 29 GPIO_ACTIVE_HIGH>;
++	default-state = "off";
++	linux,default-trigger = "mmc0";
++};
++
++&leds {
++	led_pwr: led-pwr {
++		label = "PWR";
++		gpios = <&expgpio 2 GPIO_ACTIVE_LOW>;
++		default-state = "off";
++		linux,default-trigger = "default-on";
++	};
++};
++
++&hdmi {
++	hpd-gpios = <&gpio 28 GPIO_ACTIVE_LOW>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&eth_phy {
++	microchip,eee-enabled;
++	microchip,tx-lpi-timer = <600>; /* non-aggressive*/
++	microchip,downshift-after = <2>;
++};
++
++&cam1_reg {
++	gpio = <&expgpio 5 GPIO_ACTIVE_HIGH>;
++};
++
++cam0_reg: &cam_dummy_reg {
++};
++
++i2c_csi_dsi0: &i2c0 {
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_headphones=1 snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_headphones=0 snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&led_act>,"gpios:4";
++		act_led_activelow = <&led_act>,"gpios:8";
++		act_led_trigger = <&led_act>,"linux,default-trigger";
++
++		pwr_led_gpio = <&led_pwr>,"gpios:4";
++		pwr_led_activelow = <&led_pwr>,"gpios:8";
++		pwr_led_trigger = <&led_pwr>,"linux,default-trigger";
++
++		eee = <&eth_phy>,"microchip,eee-enabled?";
++		tx_lpi_timer = <&eth_phy>,"microchip,tx-lpi-timer:0";
++		eth_led0 = <&eth_phy>,"microchip,led-modes:0";
++		eth_led1 = <&eth_phy>,"microchip,led-modes:4";
++		eth_downshift_after = <&eth_phy>,"microchip,downshift-after:0";
++		eth_max_speed = <&eth_phy>,"max-speed:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2710-rpi-3-b.dts b/arch/arm/boot/dts/broadcom/bcm2710-rpi-3-b.dts
+new file mode 100644
+index 000000000000..35e6e9900083
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm2710-rpi-3-b.dts
+@@ -0,0 +1,293 @@
++/dts-v1/;
++
++#include "bcm2710.dtsi"
++#include "bcm2709-rpi.dtsi"
++#include "bcm283x-rpi-smsc9514.dtsi"
++#include "bcm283x-rpi-csi1-2lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_44.dtsi"
++#include "bcm271x-rpi-bt.dtsi"
++#include "bcm283x-rpi-led-deprecated.dtsi"
++
++/ {
++	compatible = "raspberrypi,3-model-b", "brcm,bcm2837";
++	model = "Raspberry Pi 3 Model B";
++
++	aliases {
++		serial0 = &uart1;
++		serial1 = &uart0;
++		mmc1 = &mmcnr;
++	};
++};
++
++&gpio {
++	/*
++	 * Taken from rpi_SCH_3b_1p2_reduced.pdf and
++	 * the official GPU firmware DT blob.
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "ID_SDA",
++			  "ID_SCL",
++			  "GPIO2",
++			  "GPIO3",
++			  "GPIO4",
++			  "GPIO5",
++			  "GPIO6",
++			  "GPIO7",
++			  "GPIO8",
++			  "GPIO9",
++			  "GPIO10",
++			  "GPIO11",
++			  "GPIO12",
++			  "GPIO13",
++			  "GPIO14",
++			  "GPIO15",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "NC", /* GPIO 28 */
++			  "LAN_RUN_BOOT",
++			  /* Used by BT module */
++			  "CTS0",
++			  "RTS0",
++			  "TXD0",
++			  "RXD0",
++			  /* Used by Wifi */
++			  "SD1_CLK",
++			  "SD1_CMD",
++			  "SD1_DATA0",
++			  "SD1_DATA1",
++			  "SD1_DATA2",
++			  "SD1_DATA3",
++			  "PWM0_OUT",
++			  "PWM1_OUT",
++			  "ETH_CLK",
++			  "WIFI_CLK",
++			  "SDA0",
++			  "SCL0",
++			  "SMPS_SCL",
++			  "SMPS_SDA",
++			  /* Used by SD Card */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	sdio_pins: sdio_pins {
++		brcm,pins =     <34 35 36 37 38 39>;
++		brcm,function = <7>; // alt3 = SD1
++		brcm,pull =     <0 2 2 2 2 2>;
++	};
++
++	bt_pins: bt_pins {
++		brcm,pins = <43>;
++		brcm,function = <4>; /* alt0:GPCLK2 */
++		brcm,pull = <0>;
++	};
++
++	uart0_pins: uart0_pins {
++		brcm,pins = <32 33>;
++		brcm,function = <7>; /* alt3=UART0 */
++		brcm,pull = <0 2>;
++	};
++
++	uart1_pins: uart1_pins {
++		brcm,pins;
++		brcm,function;
++		brcm,pull;
++	};
++
++	uart1_bt_pins: uart1_bt_pins {
++		brcm,pins = <32 33>;
++		brcm,function = <BCM2835_FSEL_ALT5>; /* alt5=UART1 */
++		brcm,pull = <0 2>;
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins = <40 41>;
++		brcm,function = <4>;
++		brcm,pull = <0>;
++	};
++};
++
++&mmcnr {
++	pinctrl-names = "default";
++	pinctrl-0 = <&sdio_pins>;
++	bus-width = <4>;
++	status = "okay";
++	#address-cells = <1>;
++	#size-cells = <0>;
++
++	brcmf: wifi@1 {
++		reg = <1>;
++		compatible = "brcm,bcm4329-fmac";
++	};
++};
++
++&firmware {
++	expgpio: expgpio {
++		compatible = "raspberrypi,firmware-gpio";
++		gpio-controller;
++		#gpio-cells = <2>;
++		gpio-line-names = "BT_ON",
++				  "WL_ON",
++				  "STATUS_LED",
++				  "LAN_RUN",
++				  "HDMI_HPD_N",
++				  "CAM_GPIO0",
++				  "CAM_GPIO1",
++				  "PWR_LOW_N";
++		status = "okay";
++	};
++
++	virtgpio: virtgpio {
++		compatible = "brcm,bcm2835-virtgpio";
++		gpio-controller;
++		#gpio-cells = <2>;
++		status = "okay";
++	};
++};
++
++&uart0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart0_pins &bt_pins>;
++	status = "okay";
++};
++
++&uart1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart1_pins>;
++	status = "okay";
++};
++
++&bt {
++	max-speed = <921600>;
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&led_act {
++	gpios = <&virtgpio 0 GPIO_ACTIVE_HIGH>;
++	default-state = "off";
++	linux,default-trigger = "mmc0";
++};
++
++&leds {
++	led_pwr: led-pwr {
++		label = "PWR";
++		gpios = <&expgpio 7 GPIO_ACTIVE_HIGH>;
++		default-state = "off";
++		linux,default-trigger = "input";
++	};
++};
++
++&hdmi {
++	hpd-gpios = <&expgpio 4 GPIO_ACTIVE_LOW>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&cam1_reg {
++	gpio = <&expgpio 5 GPIO_ACTIVE_HIGH>;
++};
++
++cam0_reg: &cam_dummy_reg {
++};
++
++i2c_csi_dsi0: &i2c0 {
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_headphones=1 snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_headphones=0 snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&led_act>,"gpios:4";
++		act_led_activelow = <&led_act>,"gpios:8";
++		act_led_trigger = <&led_act>,"linux,default-trigger";
++
++		pwr_led_gpio = <&led_pwr>,"gpios:4";
++		pwr_led_activelow = <&led_pwr>,"gpios:8";
++		pwr_led_trigger = <&led_pwr>,"linux,default-trigger";
++	};
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2710-rpi-cm3.dts b/arch/arm/boot/dts/broadcom/bcm2710-rpi-cm3.dts
+new file mode 100644
+index 000000000000..0d6e9e61f877
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm2710-rpi-cm3.dts
+@@ -0,0 +1,215 @@
++/dts-v1/;
++
++#include "bcm2710.dtsi"
++#include "bcm2709-rpi.dtsi"
++#include "bcm283x-rpi-csi0-2lane.dtsi"
++#include "bcm283x-rpi-csi1-4lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_28.dtsi"
++#include "bcm283x-rpi-led-deprecated.dtsi"
++
++/ {
++	compatible = "raspberrypi,3-compute-module", "brcm,bcm2837";
++	model = "Raspberry Pi Compute Module 3";
++};
++
++&cam1_reg {
++	gpio = <&gpio 3 GPIO_ACTIVE_HIGH>;
++	status = "disabled";
++};
++
++cam0_reg: &cam0_regulator {
++	gpio = <&gpio 31 GPIO_ACTIVE_HIGH>;
++};
++
++i2c_csi_dsi0: &i2c0 {
++};
++
++&uart0 {
++	status = "okay";
++};
++
++&gpio {
++	/*
++	 * This is based on the official GPU firmware DT blob.
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "GPIO0",
++			  "GPIO1",
++			  "GPIO2",
++			  "GPIO3",
++			  "GPIO4",
++			  "GPIO5",
++			  "GPIO6",
++			  "GPIO7",
++			  "GPIO8",
++			  "GPIO9",
++			  "GPIO10",
++			  "GPIO11",
++			  "GPIO12",
++			  "GPIO13",
++			  "GPIO14",
++			  "GPIO15",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "GPIO28",
++			  "GPIO29",
++			  "GPIO30",
++			  "GPIO31",
++			  "GPIO32",
++			  "GPIO33",
++			  "GPIO34",
++			  "GPIO35",
++			  "GPIO36",
++			  "GPIO37",
++			  "GPIO38",
++			  "GPIO39",
++			  "GPIO40",
++			  "GPIO41",
++			  "GPIO42",
++			  "GPIO43",
++			  "GPIO44",
++			  "GPIO45",
++			  "SMPS_SCL",
++			  "SMPS_SDA",
++			  /* Used by eMMC */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins;
++		brcm,function;
++	};
++};
++
++&firmware {
++	expgpio: expgpio {
++		compatible = "raspberrypi,firmware-gpio";
++		gpio-controller;
++		#gpio-cells = <2>;
++		gpio-line-names = "HDMI_HPD_N",
++				  "EMMC_EN_N",
++				  "NC",
++				  "NC",
++				  "NC",
++				  "NC",
++				  "NC",
++				  "NC";
++		status = "okay";
++	};
++
++	virtgpio: virtgpio {
++		compatible = "brcm,bcm2835-virtgpio";
++		gpio-controller;
++		#gpio-cells = <2>;
++		status = "okay";
++	};
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&led_act {
++	gpios = <&virtgpio 0 GPIO_ACTIVE_HIGH>;
++	default-state = "off";
++	linux,default-trigger = "mmc0";
++};
++
++&hdmi {
++	hpd-gpios = <&expgpio 0 GPIO_ACTIVE_LOW>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&led_act>,"gpios:4";
++		act_led_activelow = <&led_act>,"gpios:8";
++		act_led_trigger = <&led_act>,"linux,default-trigger";
++	};
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2710-rpi-zero-2-w.dts b/arch/arm/boot/dts/broadcom/bcm2710-rpi-zero-2-w.dts
+new file mode 100644
+index 000000000000..16971e50229f
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm2710-rpi-zero-2-w.dts
+@@ -0,0 +1,257 @@
++/dts-v1/;
++
++#include "bcm2710.dtsi"
++#include "bcm2709-rpi.dtsi"
++#include "bcm283x-rpi-csi1-2lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_44.dtsi"
++#include "bcm2708-rpi-bt.dtsi"
++#include "bcm283x-rpi-led-deprecated.dtsi"
++
++/ {
++	compatible = "raspberrypi,model-zero-2-w", "brcm,bcm2837";
++	model = "Raspberry Pi Zero 2 W";
++
++	aliases {
++		serial0 = &uart1;
++		serial1 = &uart0;
++		mmc1 = &mmcnr;
++	};
++};
++
++&gpio {
++	/*
++	 * This is based on the official GPU firmware DT blob.
++	 *
++	 * Legend:
++	 * "NC" = not connected (no rail from the SoC)
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "ID_SDA",
++			  "ID_SCL",
++			  "GPIO2",
++			  "GPIO3",
++			  "GPIO4",
++			  "GPIO5",
++			  "GPIO6",
++			  "GPIO7",
++			  "GPIO8",
++			  "GPIO9",
++			  "GPIO10",
++			  "GPIO11",
++			  "GPIO12",
++			  "GPIO13",
++			  "GPIO14",
++			  "GPIO15",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "HDMI_HPD_N",
++			  "STATUS_LED_N",
++			  /* Used by BT module */
++			  "CTS0",
++			  "RTS0",
++			  "TXD0",
++			  "RXD0",
++			  /* Used by Wifi */
++			  "SD1_CLK",
++			  "SD1_CMD",
++			  "SD1_DATA0",
++			  "SD1_DATA1",
++			  "SD1_DATA2",
++			  "SD1_DATA3",
++			  "CAM_GPIO1", /* GPIO40 */
++			  "WL_ON", /* GPIO41 */
++			  "BT_ON", /* GPIO42 */
++			  "WIFI_CLK", /* GPIO43 */
++			  "SDA0", /* GPIO44 */
++			  "SCL0", /* GPIO45 */
++			  "SMPS_SCL", /* GPIO46 */
++			  "SMPS_SDA", /* GPIO47 */
++			  /* Used by SD Card */
++			  "SD_CLK_R",
++			  "SD_CMD_R",
++			  "SD_DATA0_R",
++			  "SD_DATA1_R",
++			  "SD_DATA2_R",
++			  "SD_DATA3_R";
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <1>; /* output */
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <4>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <4>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <4>; /* alt0 */
++	};
++
++	sdio_pins: sdio_pins {
++		brcm,pins =     <34 35 36 37 38 39>;
++		brcm,function = <7>; // alt3 = SD1
++		brcm,pull =     <0 2 2 2 2 2>;
++	};
++
++	bt_pins: bt_pins {
++		brcm,pins = <43>;
++		brcm,function = <4>; /* alt0:GPCLK2 */
++		brcm,pull = <0>;
++	};
++
++	uart0_pins: uart0_pins {
++		brcm,pins = <30 31 32 33>;
++		brcm,function = <7>; /* alt3=UART0 */
++		brcm,pull = <2 0 0 2>; /* up none none up */
++	};
++
++	uart1_pins: uart1_pins {
++		brcm,pins;
++		brcm,function;
++		brcm,pull;
++	};
++
++	uart1_bt_pins: uart1_bt_pins {
++		brcm,pins = <32 33 30 31>;
++		brcm,function = <BCM2835_FSEL_ALT5>; /* alt5=UART1 */
++		brcm,pull = <0 2 2 0>;
++	};
++
++	audio_pins: audio_pins {
++		brcm,pins = <>;
++		brcm,function = <>;
++	};
++};
++
++&mmcnr {
++	pinctrl-names = "default";
++	pinctrl-0 = <&sdio_pins>;
++	bus-width = <4>;
++	status = "okay";
++	#address-cells = <1>;
++	#size-cells = <0>;
++
++	brcmf: wifi@1 {
++		reg = <1>;
++		compatible = "brcm,bcm4329-fmac";
++	};
++};
++
++&uart0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart0_pins &bt_pins>;
++	status = "okay";
++};
++
++&uart1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart1_pins>;
++	status = "okay";
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2c2 {
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++&led_act {
++	gpios = <&gpio 29 GPIO_ACTIVE_LOW>;
++	default-state = "off";
++	linux,default-trigger = "actpwr";
++};
++
++&hdmi {
++	hpd-gpios = <&gpio 28 GPIO_ACTIVE_LOW>;
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&bt {
++	shutdown-gpios = <&gpio 42 GPIO_ACTIVE_HIGH>;
++};
++
++&minibt {
++	shutdown-gpios = <&gpio 42 GPIO_ACTIVE_HIGH>;
++};
++
++&cam1_reg {
++	gpio = <&gpio 40 GPIO_ACTIVE_HIGH>;
++};
++
++cam0_reg: &cam_dummy_reg {
++};
++
++i2c_csi_dsi0: &i2c0 {
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&led_act>,"gpios:4";
++		act_led_activelow = <&led_act>,"gpios:8";
++		act_led_trigger = <&led_act>,"linux,default-trigger";
++	};
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2710-rpi-zero-2.dts b/arch/arm/boot/dts/broadcom/bcm2710-rpi-zero-2.dts
+new file mode 100644
+index 000000000000..daa12bd30d6b
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm2710-rpi-zero-2.dts
+@@ -0,0 +1 @@
++#include "bcm2710-rpi-zero-2-w.dts"
+diff --git a/arch/arm/boot/dts/broadcom/bcm2710.dtsi b/arch/arm/boot/dts/broadcom/bcm2710.dtsi
+new file mode 100644
+index 000000000000..bdcdbb51fab8
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm2710.dtsi
+@@ -0,0 +1,32 @@
++#define i2c0 i2c0if
++#include "bcm2837.dtsi"
++#undef i2c0
++#include "bcm270x.dtsi"
++
++/ {
++	compatible = "brcm,bcm2837", "brcm,bcm2836";
++
++	arm-pmu {
++		compatible = "arm,cortex-a53-pmu", "arm,cortex-a7-pmu";
++	};
++
++	soc {
++		dma-ranges = <0xc0000000 0x00000000 0x3f000000>,
++			     <0x7e000000 0x3f000000 0x01000000>;
++	};
++
++	__overrides__ {
++		arm_freq = <&cpu0>, "clock-frequency:0",
++		       <&cpu1>, "clock-frequency:0",
++		       <&cpu2>, "clock-frequency:0",
++		       <&cpu3>, "clock-frequency:0";
++	};
++};
++
++&system_timer {
++	status = "disabled";
++};
++
++&vc4 {
++	status = "disabled";
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2711-rpi-4-b.dts b/arch/arm/boot/dts/broadcom/bcm2711-rpi-4-b.dts
+index 353bb50ce542..a4aae12775dc 100644
+--- a/arch/arm/boot/dts/broadcom/bcm2711-rpi-4-b.dts
++++ b/arch/arm/boot/dts/broadcom/bcm2711-rpi-4-b.dts
+@@ -1,11 +1,19 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /dts-v1/;
++#define BCM2711
++#define i2c0 i2c0if
+ #include "bcm2711.dtsi"
+ #include "bcm2711-rpi.dtsi"
++/delete-node/&i2c0mux;
+ #include "bcm283x-rpi-led-deprecated.dtsi"
+-#include "bcm283x-rpi-usb-peripheral.dtsi"
+ #include "bcm283x-rpi-wifi-bt.dtsi"
+ #include <dt-bindings/leds/common.h>
++#undef i2c0
++#include "bcm270x.dtsi"
++#define i2c0 i2c0mux
++#undef i2c0
++
++/delete-node/ &cam1_reg;
+ 
+ / {
+ 	compatible = "raspberrypi,4-model-b", "brcm,bcm2711";
+@@ -68,7 +76,7 @@ &expgpio {
+ 			  "VDD_SD_IO_SEL",
+ 			  "CAM_GPIO",		/*  5 */
+ 			  "SD_PWR_ON",
+-			  "";
++			  "SD_OC_N";
+ };
+ 
+ &gpio {
+@@ -82,21 +90,21 @@ &gpio {
+ 	 */
+ 	gpio-line-names = "ID_SDA",		/*  0 */
+ 			  "ID_SCL",
+-			  "SDA1",
+-			  "SCL1",
+-			  "GPIO_GCLK",
++			  "GPIO2",
++			  "GPIO3",
++			  "GPIO4",
+ 			  "GPIO5",		/*  5 */
+ 			  "GPIO6",
+-			  "SPI_CE1_N",
+-			  "SPI_CE0_N",
+-			  "SPI_MISO",
+-			  "SPI_MOSI",		/* 10 */
+-			  "SPI_SCLK",
++			  "GPIO7",
++			  "GPIO8",
++			  "GPIO9",
++			  "GPIO10",		/* 10 */
++			  "GPIO11",
+ 			  "GPIO12",
+ 			  "GPIO13",
+ 			  /* Serial port */
+-			  "TXD1",
+-			  "RXD1",		/* 15 */
++			  "GPIO14",
++			  "GPIO15",		/* 15 */
+ 			  "GPIO16",
+ 			  "GPIO17",
+ 			  "GPIO18",
+@@ -214,7 +222,7 @@ leds {
+ 			led@0 {
+ 				reg = <0>;
+ 				color = <LED_COLOR_ID_GREEN>;
+-				function = LED_FUNCTION_LAN;
++				function = "lan";//LED_FUNCTION_LAN;
+ 				default-state = "keep";
+ 			};
+ 
+@@ -222,7 +230,7 @@ led@0 {
+ 			led@1 {
+ 				reg = <1>;
+ 				color = <LED_COLOR_ID_AMBER>;
+-				function = LED_FUNCTION_LAN;
++				function = "lan";//LED_FUNCTION_LAN;
+ 				default-state = "keep";
+ 			};
+ 		};
+@@ -270,3 +278,233 @@ &vec {
+ &wifi_pwrseq {
+ 	reset-gpios = <&expgpio 1 GPIO_ACTIVE_LOW>;
+ };
++
++// =============================================
++// Downstream rpi- changes
++
++#include "bcm271x-rpi-bt.dtsi"
++
++/ {
++	soc {
++		/delete-node/ pixelvalve@7e807000;
++		/delete-node/ hdmi@7e902000;
++	};
++};
++
++&phy1 {
++	/delete-node/ leds;
++};
++
++#include "bcm2711-rpi-ds.dtsi"
++#include "bcm283x-rpi-csi1-2lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_44.dtsi"
++
++/ {
++	/delete-node/ wifi-pwrseq;
++};
++
++&mmcnr {
++	pinctrl-names = "default";
++	pinctrl-0 = <&sdio_pins>;
++	bus-width = <4>;
++	status = "okay";
++};
++
++&uart0 {
++	pinctrl-0 = <&uart0_pins &bt_pins>;
++	status = "okay";
++};
++
++&uart1 {
++	pinctrl-0 = <&uart1_pins>;
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&gpio {
++	gpio-line-names = "ID_SDA",
++			  "ID_SCL",
++			  "GPIO2",
++			  "GPIO3",
++			  "GPIO4",
++			  "GPIO5",
++			  "GPIO6",
++			  "GPIO7",
++			  "GPIO8",
++			  "GPIO9",
++			  "GPIO10",
++			  "GPIO11",
++			  "GPIO12",
++			  "GPIO13",
++			  "GPIO14",
++			  "GPIO15",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "RGMII_MDIO",
++			  "RGMIO_MDC",
++			  /* Used by BT module */
++			  "CTS0",		/* 30 */
++			  "RTS0",
++			  "TXD0",
++			  "RXD0",
++			  /* Used by Wifi */
++			  "SD1_CLK",
++			  "SD1_CMD",		/* 35 */
++			  "SD1_DATA0",
++			  "SD1_DATA1",
++			  "SD1_DATA2",
++			  "SD1_DATA3",
++			  /* Shared with SPI flash */
++			  "PWM0_MISO",		/* 40 */
++			  "PWM1_MOSI",
++			  "STATUS_LED_G_CLK",
++			  "SPIFLASH_CE_N",
++			  "SDA0",
++			  "SCL0",		/* 45 */
++			  "RGMII_RXCLK",
++			  "RGMII_RXCTL",
++			  "RGMII_RXD0",
++			  "RGMII_RXD1",
++			  "RGMII_RXD2",		/* 50 */
++			  "RGMII_RXD3",
++			  "RGMII_TXCLK",
++			  "RGMII_TXCTL",
++			  "RGMII_TXD0",
++			  "RGMII_TXD1",		/* 55 */
++			  "RGMII_TXD2",
++			  "RGMII_TXD3";
++
++	bt_pins: bt_pins {
++		brcm,pins = "-"; // non-empty to keep btuart happy, //4 = 0
++				 // to fool pinctrl
++		brcm,function = <0>;
++		brcm,pull = <2>;
++	};
++
++	uart0_pins: uart0_pins {
++		brcm,pins = <32 33>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++		brcm,pull = <0 2>;
++	};
++
++	uart1_pins: uart1_pins {
++		brcm,pins;
++		brcm,function;
++		brcm,pull;
++	};
++
++	uart1_bt_pins: uart1_bt_pins {
++		brcm,pins = <32 33 30 31>;
++		brcm,function = <BCM2835_FSEL_ALT5>; /* alt5=UART1 */
++		brcm,pull = <0 2 2 0>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++// =============================================
++// Board specific stuff here
++
++&sdhost {
++	status = "disabled";
++};
++
++&phy1 {
++	led-modes = <0x00 0x08>; /* link/activity link */
++};
++
++&gpio {
++	audio_pins: audio_pins {
++		brcm,pins = <40 41>;
++		brcm,function = <4>;
++		brcm,pull = <0>;
++	};
++};
++
++&led_act {
++	default-state = "off";
++	linux,default-trigger = "mmc0";
++};
++
++&led_pwr {
++	default-state = "off";
++};
++
++&pwm1 {
++	status = "disabled";
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&cam1_reg {
++	gpio = <&expgpio 5 GPIO_ACTIVE_HIGH>;
++};
++
++cam0_reg: &cam_dummy_reg {
++};
++
++i2c_csi_dsi0: &i2c0 {
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_headphones=1 snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_headphones=0 snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&led_act>,"gpios:4";
++		act_led_activelow = <&led_act>,"gpios:8";
++		act_led_trigger = <&led_act>,"linux,default-trigger";
++
++		pwr_led_gpio = <&led_pwr>,"gpios:4";
++		pwr_led_activelow = <&led_pwr>,"gpios:8";
++		pwr_led_trigger = <&led_pwr>,"linux,default-trigger";
++
++		eth_led0 = <&phy1>,"led-modes:0";
++		eth_led1 = <&phy1>,"led-modes:4";
++	};
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2711-rpi-400.dts b/arch/arm/boot/dts/broadcom/bcm2711-rpi-400.dts
+index ca9be91b4f36..553fb0e24696 100644
+--- a/arch/arm/boot/dts/broadcom/bcm2711-rpi-400.dts
++++ b/arch/arm/boot/dts/broadcom/bcm2711-rpi-400.dts
+@@ -37,8 +37,53 @@ &led_pwr {
+ 	gpios = <&gpio 42 GPIO_ACTIVE_HIGH>;
+ };
+ 
+-/delete-node/ &led_act;
+-
+ &pm {
+ 	/delete-property/ system-power-controller;
+ };
++
++// =============================================
++// Downstream rpi- changes
++
++/ {
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
++};
++
++&audio_pins {
++	brcm,pins = <>;
++	brcm,function = <>;
++};
++
++// Declare the LED but leave it disabled, in case a user wants to map it
++// to a GPIO on the header
++&led_act {
++	default-state = "off";
++	gpios = <&gpio 0 GPIO_ACTIVE_HIGH>;
++	status = "disabled";
++};
++
++&led_pwr {
++	default-state = "off";
++};
++
++&cam1_reg {
++	  /delete-property/ gpio;
++};
++
++cam0_reg: &cam_dummy_reg {
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&led_act>,"gpios:4",
++			       <&led_act>,"status=okay";
++		act_led_activelow = <&led_act>,"gpios:8";
++		act_led_trigger = <&led_act>,"linux,default-trigger";
++		pwr_led_gpio = <&led_pwr>,"gpios:4";
++		pwr_led_activelow = <&led_pwr>,"gpios:8";
++		pwr_led_trigger = <&led_pwr>,"linux,default-trigger";
++	};
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2711-rpi-cm4.dts b/arch/arm/boot/dts/broadcom/bcm2711-rpi-cm4.dts
+new file mode 100644
+index 000000000000..668e31d67cf8
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm2711-rpi-cm4.dts
+@@ -0,0 +1,499 @@
++// SPDX-License-Identifier: GPL-2.0
++/dts-v1/;
++#define BCM2711
++#define i2c0 i2c0if
++#include "bcm2711.dtsi"
++#include "bcm2711-rpi.dtsi"
++/delete-node/&i2c0mux;
++#include "bcm283x-rpi-led-deprecated.dtsi"
++#include "bcm283x-rpi-wifi-bt.dtsi"
++#undef i2c0
++#include "bcm270x.dtsi"
++#define i2c0 i2c0mux
++#undef i2c0
++
++/ {
++	compatible = "raspberrypi,4-compute-module", "brcm,bcm2711";
++	model = "Raspberry Pi Compute Module 4";
++
++	chosen {
++		/* 8250 auxiliary UART instead of pl011 */
++		stdout-path = "serial1:115200n8";
++	};
++
++	sd_io_1v8_reg: sd_io_1v8_reg {
++		compatible = "regulator-gpio";
++		regulator-name = "vdd-sd-io";
++		regulator-min-microvolt = <1800000>;
++		regulator-max-microvolt = <3300000>;
++		regulator-boot-on;
++		regulator-always-on;
++		regulator-settling-time-us = <5000>;
++		gpios = <&expgpio 4 GPIO_ACTIVE_HIGH>;
++		states = <1800000 0x1>,
++			 <3300000 0x0>;
++		status = "okay";
++	};
++
++	sd_vcc_reg: sd_vcc_reg {
++		compatible = "regulator-fixed";
++		regulator-name = "vcc-sd";
++		regulator-min-microvolt = <3300000>;
++		regulator-max-microvolt = <3300000>;
++		regulator-boot-on;
++		enable-active-high;
++		gpio = <&expgpio 6 GPIO_ACTIVE_HIGH>;
++	};
++};
++
++&bt {
++	shutdown-gpios = <&expgpio 0 GPIO_ACTIVE_HIGH>;
++};
++
++&ddc0 {
++	status = "okay";
++};
++
++&ddc1 {
++	status = "okay";
++};
++
++&expgpio {
++	gpio-line-names = "BT_ON",
++			  "WL_ON",
++			  "PWR_LED_OFF",
++			  "ANT1",
++			  "VDD_SD_IO_SEL",
++			  "CAM_GPIO",
++			  "SD_PWR_ON",
++			  "ANT2";
++
++	ant1: ant1 {
++		gpio-hog;
++		gpios = <3 GPIO_ACTIVE_HIGH>;
++		output-high;
++	};
++
++	ant2: ant2 {
++		gpio-hog;
++		gpios = <7 GPIO_ACTIVE_HIGH>;
++		output-low;
++	};
++};
++
++&gpio {
++	/*
++	 * Parts taken from rpi_SCH_4b_4p0_reduced.pdf and
++	 * the official GPU firmware DT blob.
++	 *
++	 * Legend:
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "ID_SDA",
++			  "ID_SCL",
++			  "SDA1",
++			  "SCL1",
++			  "GPIO_GCLK",
++			  "GPIO5",
++			  "GPIO6",
++			  "SPI_CE1_N",
++			  "SPI_CE0_N",
++			  "SPI_MISO",
++			  "SPI_MOSI",
++			  "SPI_SCLK",
++			  "GPIO12",
++			  "GPIO13",
++			  /* Serial port */
++			  "TXD1",
++			  "RXD1",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "RGMII_MDIO",
++			  "RGMIO_MDC",
++			  /* Used by BT module */
++			  "CTS0",
++			  "RTS0",
++			  "TXD0",
++			  "RXD0",
++			  /* Used by Wifi */
++			  "SD1_CLK",
++			  "SD1_CMD",
++			  "SD1_DATA0",
++			  "SD1_DATA1",
++			  "SD1_DATA2",
++			  "SD1_DATA3",
++			  /* Shared with SPI flash */
++			  "PWM0_MISO",
++			  "PWM1_MOSI",
++			  "STATUS_LED_G_CLK",
++			  "SPIFLASH_CE_N",
++			  "SDA0",
++			  "SCL0",
++			  "RGMII_RXCLK",
++			  "RGMII_RXCTL",
++			  "RGMII_RXD0",
++			  "RGMII_RXD1",
++			  "RGMII_RXD2",
++			  "RGMII_RXD3",
++			  "RGMII_TXCLK",
++			  "RGMII_TXCTL",
++			  "RGMII_TXD0",
++			  "RGMII_TXD1",
++			  "RGMII_TXD2",
++			  "RGMII_TXD3";
++};
++
++&hdmi0 {
++	status = "okay";
++};
++
++&hdmi1 {
++	status = "okay";
++};
++
++&led_act {
++	gpios = <&gpio 42 GPIO_ACTIVE_HIGH>;
++};
++
++&leds {
++	led_pwr: led-pwr {
++		label = "PWR";
++		gpios = <&expgpio 2 GPIO_ACTIVE_LOW>;
++		default-state = "keep";
++		linux,default-trigger = "default-on";
++	};
++};
++
++&pixelvalve0 {
++	status = "okay";
++};
++
++&pixelvalve1 {
++	status = "okay";
++};
++
++&pixelvalve2 {
++	status = "okay";
++};
++
++&pixelvalve4 {
++	status = "okay";
++};
++
++&pwm1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pwm1_0_gpio40 &pwm1_1_gpio41>;
++	status = "okay";
++};
++
++/* EMMC2 is used to drive the EMMC card */
++&emmc2 {
++	bus-width = <8>;
++	vqmmc-supply = <&sd_io_1v8_reg>;
++	vmmc-supply = <&sd_vcc_reg>;
++	broken-cd;
++	status = "okay";
++};
++
++&genet {
++	phy-handle = <&phy1>;
++	phy-mode = "rgmii-rxid";
++	status = "okay";
++};
++
++&genet_mdio {
++	phy1: ethernet-phy@0 {
++		/* No PHY interrupt */
++		reg = <0x0>;
++	};
++};
++
++&pcie0 {
++	pci@0,0 {
++		device_type = "pci";
++		#address-cells = <3>;
++		#size-cells = <2>;
++		ranges;
++
++		reg = <0 0 0 0 0>;
++	};
++};
++
++/* uart0 communicates with the BT module */
++&uart0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart0_ctsrts_gpio30 &uart0_gpio32>;
++	uart-has-rtscts;
++};
++
++/* uart1 is mapped to the pin header */
++&uart1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart1_gpio14>;
++	status = "okay";
++};
++
++&vc4 {
++	status = "okay";
++};
++
++&vec {
++	status = "disabled";
++};
++
++&wifi_pwrseq {
++	reset-gpios = <&expgpio 1 GPIO_ACTIVE_LOW>;
++};
++
++// =============================================
++// Downstream rpi- changes
++
++#include "bcm271x-rpi-bt.dtsi"
++
++/ {
++	soc {
++		/delete-node/ pixelvalve@7e807000;
++		/delete-node/ hdmi@7e902000;
++	};
++};
++
++#include "bcm2711-rpi-ds.dtsi"
++#include "bcm283x-rpi-csi0-2lane.dtsi"
++#include "bcm283x-rpi-csi1-4lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_44.dtsi"
++
++/ {
++	/delete-node/ wifi-pwrseq;
++};
++
++&mmcnr {
++	pinctrl-names = "default";
++	pinctrl-0 = <&sdio_pins>;
++	bus-width = <4>;
++	status = "okay";
++};
++
++&uart0 {
++	pinctrl-0 = <&uart0_pins &bt_pins>;
++	status = "okay";
++};
++
++&uart1 {
++	pinctrl-0 = <&uart1_pins>;
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&gpio {
++	gpio-line-names = "ID_SDA",
++			  "ID_SCL",
++			  "GPIO2",
++			  "GPIO3",
++			  "GPIO4",
++			  "GPIO5",
++			  "GPIO6",
++			  "GPIO7",
++			  "GPIO8",
++			  "GPIO9",
++			  "GPIO10",
++			  "GPIO11",
++			  "GPIO12",
++			  "GPIO13",
++			  "GPIO14",
++			  "GPIO15",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "RGMII_MDIO",
++			  "RGMIO_MDC",
++			  /* Used by BT module */
++			  "CTS0",
++			  "RTS0",
++			  "TXD0",
++			  "RXD0",
++			  /* Used by Wifi */
++			  "SD1_CLK",
++			  "SD1_CMD",
++			  "SD1_DATA0",
++			  "SD1_DATA1",
++			  "SD1_DATA2",
++			  "SD1_DATA3",
++			  /* Shared with SPI flash */
++			  "PWM0_MISO",
++			  "PWM1_MOSI",
++			  "STATUS_LED_G_CLK",
++			  "SPIFLASH_CE_N",
++			  "SDA0",
++			  "SCL0",
++			  "RGMII_RXCLK",
++			  "RGMII_RXCTL",
++			  "RGMII_RXD0",
++			  "RGMII_RXD1",
++			  "RGMII_RXD2",
++			  "RGMII_RXD3",
++			  "RGMII_TXCLK",
++			  "RGMII_TXCTL",
++			  "RGMII_TXD0",
++			  "RGMII_TXD1",
++			  "RGMII_TXD2",
++			  "RGMII_TXD3";
++
++	bt_pins: bt_pins {
++		brcm,pins = "-"; // non-empty to keep btuart happy, //4 = 0
++				 // to fool pinctrl
++		brcm,function = <0>;
++		brcm,pull = <2>;
++	};
++
++	uart0_pins: uart0_pins {
++		brcm,pins = <32 33>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++		brcm,pull = <0 2>;
++	};
++
++	uart1_pins: uart1_pins {
++		brcm,pins;
++		brcm,function;
++		brcm,pull;
++	};
++
++	uart1_bt_pins: uart1_bt_pins {
++		brcm,pins = <32 33 30 31>;
++		brcm,function = <BCM2835_FSEL_ALT5>; /* alt5=UART1 */
++		brcm,pull = <0 2 2 0>;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++// =============================================
++// Board specific stuff here
++
++&pcie0 {
++       brcm,enable-l1ss;
++};
++
++&sdhost {
++	status = "disabled";
++};
++
++&phy1 {
++	led-modes = <0x00 0x08>; /* link/activity link */
++};
++
++&gpio {
++	audio_pins: audio_pins {
++		brcm,pins = <>;
++		brcm,function = <>;
++	};
++};
++
++&led_act {
++	default-state = "off";
++	linux,default-trigger = "mmc0";
++};
++
++&led_pwr {
++	default-state = "off";
++};
++
++&pwm1 {
++	status = "disabled";
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++cam0_reg: &cam1_reg {
++	gpio = <&expgpio 5 GPIO_ACTIVE_HIGH>;
++};
++
++i2c_csi_dsi0: &i2c0 {
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&led_act>,"gpios:4";
++		act_led_activelow = <&led_act>,"gpios:8";
++		act_led_trigger = <&led_act>,"linux,default-trigger";
++
++		pwr_led_gpio = <&led_pwr>,"gpios:4";
++		pwr_led_activelow = <&led_pwr>,"gpios:8";
++		pwr_led_trigger = <&led_pwr>,"linux,default-trigger";
++
++		eth_led0 = <&phy1>,"led-modes:0";
++		eth_led1 = <&phy1>,"led-modes:4";
++
++		ant1 =  <&ant1>,"output-high?=on",
++			<&ant1>, "output-low?=off",
++			<&ant2>, "output-high?=off",
++			<&ant2>, "output-low?=on";
++		ant2 =  <&ant1>,"output-high?=off",
++			<&ant1>, "output-low?=on",
++			<&ant2>, "output-high?=on",
++			<&ant2>, "output-low?=off";
++		noant = <&ant1>,"output-high?=off",
++			<&ant1>, "output-low?=on",
++			<&ant2>, "output-high?=off",
++			<&ant2>, "output-low?=on";
++
++		pcie_tperst_clk_ms = <&pcie0>,"brcm,tperst-clk-ms:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2711-rpi-cm4s.dts b/arch/arm/boot/dts/broadcom/bcm2711-rpi-cm4s.dts
+new file mode 100644
+index 000000000000..badf2a2fc3e9
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm2711-rpi-cm4s.dts
+@@ -0,0 +1,293 @@
++// SPDX-License-Identifier: GPL-2.0
++/dts-v1/;
++#define BCM2711
++#define i2c0 i2c0if
++#include "bcm2711.dtsi"
++#include "bcm2711-rpi.dtsi"
++/delete-node/&i2c0mux;
++#include "bcm283x-rpi-led-deprecated.dtsi"
++#undef i2c0
++#include "bcm270x.dtsi"
++#define i2c0 i2c0mux
++#undef i2c0
++
++/ {
++	compatible = "raspberrypi,4-compute-module-s", "brcm,bcm2711";
++	model = "Raspberry Pi Compute Module 4S";
++};
++
++&ddc0 {
++	status = "okay";
++};
++
++&gpio {
++	/*
++	 * Parts taken from rpi_SCH_4b_4p0_reduced.pdf and
++	 * the official GPU firmware DT blob.
++	 *
++	 * Legend:
++	 * "FOO" = GPIO line named "FOO" on the schematic
++	 * "FOO_N" = GPIO line named "FOO" on schematic, active low
++	 */
++	gpio-line-names = "ID_SDA",
++			  "ID_SCL",
++			  "GPIO2",
++			  "GPIO3",
++			  "GPIO4",
++			  "GPIO5",
++			  "GPIO6",
++			  "GPIO7",
++			  "GPIO8",
++			  "GPIO9",
++			  "GPIO10",
++			  "GPIO11",
++			  "GPIO12",
++			  "GPIO13",
++			  "GPIO14",
++			  "GPIO15",
++			  "GPIO16",
++			  "GPIO17",
++			  "GPIO18",
++			  "GPIO19",
++			  "GPIO20",
++			  "GPIO21",
++			  "GPIO22",
++			  "GPIO23",
++			  "GPIO24",
++			  "GPIO25",
++			  "GPIO26",
++			  "GPIO27",
++			  "GPIO28",
++			  "GPIO29",
++			  "GPIO30",
++			  "GPIO31",
++			  "GPIO32",
++			  "GPIO33",
++			  "GPIO34",
++			  "GPIO35",
++			  "GPIO36",
++			  "GPIO37",
++			  "GPIO38",
++			  "GPIO39",
++			  "PWM0_MISO",
++			  "PWM1_MOSI",
++			  "GPIO42",
++			  "GPIO43",
++			  "GPIO44",
++			  "GPIO45";
++};
++
++&hdmi0 {
++	status = "okay";
++};
++
++&led_act {
++	gpios = <&virtgpio 0 GPIO_ACTIVE_HIGH>;
++};
++
++&pixelvalve0 {
++	status = "okay";
++};
++
++&pixelvalve1 {
++	status = "okay";
++};
++
++&pixelvalve2 {
++	status = "okay";
++};
++
++&pixelvalve4 {
++	status = "okay";
++};
++
++&pwm1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pwm1_0_gpio40 &pwm1_1_gpio41>;
++	status = "okay";
++};
++
++/* EMMC2 is used to drive the EMMC card */
++&emmc2 {
++	bus-width = <8>;
++	broken-cd;
++	status = "okay";
++};
++
++&pcie0 {
++	status = "disabled";
++};
++
++&vchiq {
++	interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
++};
++
++&vc4 {
++	status = "okay";
++};
++
++&vec {
++	status = "disabled";
++};
++
++// =============================================
++// Downstream rpi- changes
++
++#include "bcm2711-rpi-ds.dtsi"
++
++/ {
++	soc {
++		/delete-node/ pixelvalve@7e807000;
++		/delete-node/ hdmi@7e902000;
++	};
++};
++
++#include "bcm283x-rpi-csi0-2lane.dtsi"
++#include "bcm283x-rpi-csi1-4lane.dtsi"
++#include "bcm283x-rpi-i2c0mux_0_28.dtsi"
++
++/ {
++	chosen {
++		bootargs = "coherent_pool=1M snd_bcm2835.enable_headphones=0 cgroup_disable=memory numa_policy=interleave";
++	};
++
++	aliases {
++		serial0 = &uart0;
++		serial1 = &uart1;
++		/delete-property/ i2c20;
++		/delete-property/ i2c21;
++	};
++
++	/delete-node/ wifi-pwrseq;
++};
++
++&firmware {
++		virtgpio: virtgpio {
++			compatible = "brcm,bcm2835-virtgpio";
++			gpio-controller;
++			#gpio-cells = <2>;
++			status = "okay";
++		};
++};
++
++&uart0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart0_pins>;
++	status = "okay";
++};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1{
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++&gpio {
++	uart0_pins: uart0_pins {
++		brcm,pins;
++		brcm,function;
++		brcm,pull;
++	};
++};
++
++&i2c0if {
++	clock-frequency = <100000>;
++};
++
++&i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++&i2s {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s_pins>;
++};
++
++// =============================================
++// Board specific stuff here
++
++/* Enable USB in OTG-aware mode */
++&usb {
++	compatible = "brcm,bcm2835-usb";
++	dr_mode = "otg";
++	g-np-tx-fifo-size = <32>;
++	g-rx-fifo-size = <558>;
++	g-tx-fifo-size = <512 512 512 512 512 256 256>;
++	status = "okay";
++};
++
++&sdhost {
++	status = "disabled";
++};
++
++&gpio {
++	audio_pins: audio_pins {
++		brcm,pins = <>;
++		brcm,function = <>;
++	};
++};
++
++/* Permanently disable HDMI1 */
++&hdmi1 {
++	compatible = "disabled";
++};
++
++/* Permanently disable DDC1 */
++&ddc1 {
++	compatible = "disabled";
++};
++
++&led_act {
++	default-state = "off";
++	linux,default-trigger = "mmc0";
++};
++
++&pwm1 {
++	status = "disabled";
++};
++
++&vchiq {
++	pinctrl-names = "default";
++	pinctrl-0 = <&audio_pins>;
++};
++
++&cam1_reg {
++	gpio = <&gpio 3 GPIO_ACTIVE_HIGH>;
++	status = "disabled";
++};
++
++cam0_reg: &cam0_regulator {
++	gpio = <&gpio 31 GPIO_ACTIVE_HIGH>;
++	status = "disabled";
++};
++
++i2c_csi_dsi0: &i2c0 {
++};
++
++/ {
++	__overrides__ {
++		audio = <&chosen>,"bootargs{on='snd_bcm2835.enable_hdmi=1',off='snd_bcm2835.enable_hdmi=0'}";
++
++		act_led_gpio = <&led_act>,"gpios:4";
++		act_led_activelow = <&led_act>,"gpios:8";
++		act_led_trigger = <&led_act>,"linux,default-trigger";
++	};
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2711-rpi-ds.dtsi b/arch/arm/boot/dts/broadcom/bcm2711-rpi-ds.dtsi
+new file mode 100644
+index 000000000000..fd70dea32e3a
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm2711-rpi-ds.dtsi
+@@ -0,0 +1,562 @@
++// SPDX-License-Identifier: GPL-2.0
++#include "bcm270x-rpi.dtsi"
++
++/ {
++	chosen {
++		bootargs = "coherent_pool=1M 8250.nr_uarts=1 snd_bcm2835.enable_headphones=0 cgroup_disable=memory numa_policy=interleave";
++	};
++
++	__overrides__ {
++		arm_freq;
++		eee = <&chosen>,"bootargs{on='',off='genet.eee=N'}";
++		hdmi = <&hdmi0>,"status",
++		       <&hdmi1>,"status";
++		nvmem_cust_rw = <&nvmem_cust>,"rw?";
++		nvmem_priv_rw = <&nvmem_priv>,"rw?";
++		pcie = <&pcie0>,"status";
++		sd = <&emmc2>,"status";
++
++		sd_poll_once = <&emmc2>, "non-removable?";
++		spi_dma4 = <&spi0>, "dmas:0=", <&dma40>,
++			   <&spi0>, "dmas:8=", <&dma40>;
++		i2s_dma4 = <&i2s>, "dmas:0=", <&dma40>,
++			   <&i2s>, "dmas:8=", <&dma40>;
++	};
++
++	scb: scb {
++	     /* Add a label */
++	};
++
++	soc: soc {
++	     /* Add a label */
++	};
++
++	chosen {
++		stdout-path = "serial0:115200n8";
++	};
++
++	aliases {
++		uart2 = &uart2;
++		uart3 = &uart3;
++		uart4 = &uart4;
++		uart5 = &uart5;
++		serial0 = &uart1;
++		serial1 = &uart0;
++		serial2 = &uart2;
++		serial3 = &uart3;
++		serial4 = &uart4;
++		serial5 = &uart5;
++		mmc0 = &emmc2;
++		mmc1 = &mmcnr;
++		mmc2 = &sdhost;
++		i2c3 = &i2c3;
++		i2c4 = &i2c4;
++		i2c5 = &i2c5;
++		i2c6 = &i2c6;
++		i2c20 = &ddc0;
++		i2c21 = &ddc1;
++		spi3 = &spi3;
++		spi4 = &spi4;
++		spi5 = &spi5;
++		spi6 = &spi6;
++		/delete-property/ intc;
++	};
++
++	/*
++	 * Add a node with a dma-ranges value that exists only to be found
++	 * by of_dma_get_max_cpu_address, and hence limit the DMA zone.
++	 */
++	zone_dma {
++		#address-cells = <1>;
++		#size-cells = <1>;
++		dma-ranges = <0x0  0x0 0x0  0x40000000>;
++	};
++};
++
++&vc4 {
++	raspberrypi,firmware = <&firmware>;
++};
++
++&cma {
++	/* Limit cma to the lower 768MB to allow room for HIGHMEM on 32-bit */
++	alloc-ranges = <0x0 0x00000000 0x30000000>;
++};
++
++&soc {
++	/* Add the physical <-> DMA mapping for the I/O space */
++	dma-ranges = <0xc0000000  0x0 0x00000000  0x40000000>,
++		     <0x7c000000  0x0 0xfc000000  0x03800000>;
++	nvmem {
++		compatible = "simple-bus";
++		#address-cells = <1>;
++		#size-cells = <1>;
++
++		nvmem_otp: nvmem_otp {
++			compatible = "raspberrypi,rpi-otp";
++			firmware = <&firmware>;
++			reg = <0 166>;
++			status = "okay";
++		};
++
++		nvmem_cust: nvmem_cust {
++			compatible = "raspberrypi,rpi-otp";
++			firmware = <&firmware>;
++			reg = <1 8>;
++			status = "okay";
++		};
++
++		nvmem_priv: nvmem_priv {
++			compatible = "raspberrypi,rpi-otp";
++			firmware = <&firmware>;
++			reg = <3 8>;
++			status = "okay";
++		};
++	};
++};
++
++&scb {
++	#size-cells = <2>;
++
++	ranges = <0x0 0x7c000000  0x0 0xfc000000  0x0 0x03800000>,
++		 <0x0 0x40000000  0x0 0xff800000  0x0 0x00800000>,
++		 <0x6 0x00000000  0x6 0x00000000  0x0 0x40000000>,
++		 <0x0 0x00000000  0x0 0x00000000  0x0 0xfc000000>;
++	dma-ranges = <0x4 0x7c000000  0x0 0xfc000000  0x0 0x03800000>,
++		     <0x0 0x00000000  0x0 0x00000000  0x4 0x00000000>;
++
++	dma40: dma@7e007b00 {
++		compatible = "brcm,bcm2711-dma";
++		reg = <0x0 0x7e007b00  0x0 0x400>;
++		interrupts =
++			<GIC_SPI 89 IRQ_TYPE_LEVEL_HIGH>, /* dma4 11 */
++			<GIC_SPI 90 IRQ_TYPE_LEVEL_HIGH>, /* dma4 12 */
++			<GIC_SPI 91 IRQ_TYPE_LEVEL_HIGH>, /* dma4 13 */
++			<GIC_SPI 92 IRQ_TYPE_LEVEL_HIGH>; /* dma4 14 */
++		interrupt-names = "dma11",
++			"dma12",
++			"dma13",
++			"dma14";
++		#dma-cells = <1>;
++		brcm,dma-channel-mask = <0x7800>;
++	};
++
++	xhci: xhci@7e9c0000 {
++		compatible = "generic-xhci";
++		status = "disabled";
++		reg = <0x0 0x7e9c0000  0x0 0x100000>;
++		interrupts = <GIC_SPI 176 IRQ_TYPE_LEVEL_HIGH>;
++		power-domains = <&power RPI_POWER_DOMAIN_USB>;
++	};
++
++	codec@7eb10000 {
++		compatible = "raspberrypi,rpivid-vid-decoder";
++		reg = <0x0 0x7eb10000  0x0 0x1000>,  /* INTC */
++		      <0x0 0x7eb00000  0x0 0x10000>; /* HEVC */
++		reg-names = "intc",
++			    "hevc";
++		interrupts = <GIC_SPI 98 IRQ_TYPE_LEVEL_HIGH>;
++
++		clocks = <&firmware_clocks 11>;
++		clock-names = "hevc";
++	};
++};
++
++&pcie0 {
++	reg = <0x0 0x7d500000  0x0 0x9310>;
++	ranges = <0x02000000 0x0 0xc0000000 0x6 0x00000000
++		  0x0 0x40000000>;
++};
++
++&genet {
++	reg = <0x0 0x7d580000  0x0 0x10000>;
++};
++
++&dma40 {
++	/* The VPU firmware uses DMA channel 11 for VCHIQ */
++	brcm,dma-channel-mask = <0x7000>;
++};
++
++&vchiq {
++	compatible = "brcm,bcm2711-vchiq";
++};
++
++&firmwarekms {
++	compatible = "raspberrypi,rpi-firmware-kms-2711";
++	interrupts = <GIC_SPI 112 IRQ_TYPE_LEVEL_HIGH>;
++};
++
++&smi {
++	interrupts = <GIC_SPI 112 IRQ_TYPE_LEVEL_HIGH>;
++};
++
++&mmc {
++	interrupts = <GIC_SPI 126 IRQ_TYPE_LEVEL_HIGH>;
++};
++
++&mmcnr {
++	interrupts = <GIC_SPI 126 IRQ_TYPE_LEVEL_HIGH>;
++};
++
++&csi0 {
++	interrupts = <GIC_SPI 102 IRQ_TYPE_LEVEL_HIGH>;
++};
++
++&csi1 {
++	interrupts = <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>;
++};
++
++&random {
++	compatible = "brcm,bcm2711-rng200";
++	status = "okay";
++};
++
++&usb {
++	/* Enable the FIQ support */
++	reg = <0x7e980000 0x10000>,
++	      <0x7e00b200 0x200>;
++	interrupts = <GIC_SPI 73 IRQ_TYPE_LEVEL_HIGH>,
++		     <GIC_SPI 40 IRQ_TYPE_LEVEL_HIGH>;
++	status = "disabled";
++};
++
++&gpio {
++	interrupts = <GIC_SPI 113 IRQ_TYPE_LEVEL_HIGH>,
++		     <GIC_SPI 114 IRQ_TYPE_LEVEL_HIGH>;
++
++	spi0_pins: spi0_pins {
++		brcm,pins = <9 10 11>;
++		brcm,function = <BCM2835_FSEL_ALT0>;
++	};
++
++	spi0_cs_pins: spi0_cs_pins {
++		brcm,pins = <8 7>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	spi3_pins: spi3_pins {
++		brcm,pins = <1 2 3>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++	};
++
++	spi3_cs_pins: spi3_cs_pins {
++		brcm,pins = <0 24>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	spi4_pins: spi4_pins {
++		brcm,pins = <5 6 7>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++	};
++
++	spi4_cs_pins: spi4_cs_pins {
++		brcm,pins = <4 25>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	spi5_pins: spi5_pins {
++		brcm,pins = <13 14 15>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++	};
++
++	spi5_cs_pins: spi5_cs_pins {
++		brcm,pins = <12 26>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	spi6_pins: spi6_pins {
++		brcm,pins = <19 20 21>;
++		brcm,function = <BCM2835_FSEL_ALT3>;
++	};
++
++	spi6_cs_pins: spi6_cs_pins {
++		brcm,pins = <18 27>;
++		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++	};
++
++	i2c0_pins: i2c0 {
++		brcm,pins = <0 1>;
++		brcm,function = <BCM2835_FSEL_ALT0>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c1_pins: i2c1 {
++		brcm,pins = <2 3>;
++		brcm,function = <BCM2835_FSEL_ALT0>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c3_pins: i2c3 {
++		brcm,pins = <4 5>;
++		brcm,function = <BCM2835_FSEL_ALT5>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c4_pins: i2c4 {
++		brcm,pins = <8 9>;
++		brcm,function = <BCM2835_FSEL_ALT5>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c5_pins: i2c5 {
++		brcm,pins = <12 13>;
++		brcm,function = <BCM2835_FSEL_ALT5>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2c6_pins: i2c6 {
++		brcm,pins = <22 23>;
++		brcm,function = <BCM2835_FSEL_ALT5>;
++		brcm,pull = <BCM2835_PUD_UP>;
++	};
++
++	i2s_pins: i2s {
++		brcm,pins = <18 19 20 21>;
++		brcm,function = <BCM2835_FSEL_ALT0>;
++	};
++
++	sdio_pins: sdio_pins {
++		brcm,pins =     <34 35 36 37 38 39>;
++		brcm,function = <BCM2835_FSEL_ALT3>; // alt3 = SD1
++		brcm,pull =     <0 2 2 2 2 2>;
++	};
++
++	uart2_pins: uart2_pins {
++		brcm,pins = <0 1>;
++		brcm,function = <BCM2835_FSEL_ALT4>;
++		brcm,pull = <0 2>;
++	};
++
++	uart3_pins: uart3_pins {
++		brcm,pins = <4 5>;
++		brcm,function = <BCM2835_FSEL_ALT4>;
++		brcm,pull = <0 2>;
++	};
++
++	uart4_pins: uart4_pins {
++		brcm,pins = <8 9>;
++		brcm,function = <BCM2835_FSEL_ALT4>;
++		brcm,pull = <0 2>;
++	};
++
++	uart5_pins: uart5_pins {
++		brcm,pins = <12 13>;
++		brcm,function = <BCM2835_FSEL_ALT4>;
++		brcm,pull = <0 2>;
++	};
++};
++
++&emmc2 {
++	mmc-ddr-3_3v;
++};
++
++&vc4 {
++	status = "disabled";
++};
++
++&pixelvalve0 {
++	status = "disabled";
++};
++
++&pixelvalve1 {
++	status = "disabled";
++};
++
++&pixelvalve2 {
++	status = "disabled";
++};
++
++&pixelvalve3 {
++	status = "disabled";
++};
++
++&pixelvalve4 {
++	status = "disabled";
++};
++
++&hdmi0 {
++	reg = <0x7ef00700 0x300>,
++	      <0x7ef00300 0x200>,
++	      <0x7ef00f00 0x80>,
++	      <0x7ef00f80 0x80>,
++	      <0x7ef01b00 0x200>,
++	      <0x7ef01f00 0x400>,
++	      <0x7ef00200 0x80>,
++	      <0x7ef04300 0x100>,
++	      <0x7ef20000 0x100>,
++	      <0x7ef00100 0x30>;
++	reg-names = "hdmi",
++		    "dvp",
++		    "phy",
++		    "rm",
++		    "packet",
++		    "metadata",
++		    "csc",
++		    "cec",
++		    "hd",
++		    "intr2";
++	clocks = <&firmware_clocks 13>,
++		 <&firmware_clocks 14>,
++		 <&dvp 0>,
++		 <&clk_27MHz>;
++	dmas = <&dma40 (10|(1<<30)|(1<<24)|(10<<16)|(15<<20))>;
++	status = "disabled";
++};
++
++&ddc0 {
++	status = "disabled";
++};
++
++&hdmi1 {
++	reg = <0x7ef05700 0x300>,
++	      <0x7ef05300 0x200>,
++	      <0x7ef05f00 0x80>,
++	      <0x7ef05f80 0x80>,
++	      <0x7ef06b00 0x200>,
++	      <0x7ef06f00 0x400>,
++	      <0x7ef00280 0x80>,
++	      <0x7ef09300 0x100>,
++	      <0x7ef20000 0x100>,
++	      <0x7ef00100 0x30>;
++	reg-names = "hdmi",
++		    "dvp",
++		    "phy",
++		    "rm",
++		    "packet",
++		    "metadata",
++		    "csc",
++		    "cec",
++		    "hd",
++		    "intr2";
++	clocks = <&firmware_clocks 13>,
++		 <&firmware_clocks 14>,
++		 <&dvp 1>,
++		 <&clk_27MHz>;
++	dmas = <&dma40 (17|(1<<30)|(1<<24)|(10<<16)|(15<<20))>;
++	status = "disabled";
++};
++
++&ddc1 {
++	status = "disabled";
++};
++
++&dvp {
++	status = "disabled";
++};
++
++&vec {
++	clocks = <&firmware_clocks 15>;
++};
++
++&aon_intr {
++	interrupts = <GIC_SPI 96 IRQ_TYPE_EDGE_RISING>;
++	status = "disabled";
++};
++
++&system_timer {
++	status = "disabled";
++};
++
++&i2c0 {
++      /delete-property/ compatible;
++      /delete-property/ interrupts;
++};
++
++&i2c0if {
++	compatible = "brcm,bcm2711-i2c", "brcm,bcm2835-i2c";
++	interrupts = <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>;
++};
++
++i2c_arm: &i2c1 {};
++i2c_vc: &i2c0 {};
++
++&i2c3 {
++	pinctrl-0 = <&i2c3_pins>;
++	pinctrl-names = "default";
++};
++
++&i2c4 {
++	pinctrl-0 = <&i2c4_pins>;
++	pinctrl-names = "default";
++};
++
++&i2c5 {
++	pinctrl-0 = <&i2c5_pins>;
++	pinctrl-names = "default";
++};
++
++&i2c6 {
++	pinctrl-0 = <&i2c6_pins>;
++	pinctrl-names = "default";
++};
++
++&spi3 {
++	pinctrl-0 = <&spi3_pins &spi3_cs_pins>;
++	pinctrl-names = "default";
++};
++
++&spi4 {
++	pinctrl-0 = <&spi4_pins &spi4_cs_pins>;
++	pinctrl-names = "default";
++};
++
++&spi5 {
++	pinctrl-0 = <&spi5_pins &spi5_cs_pins>;
++	pinctrl-names = "default";
++};
++
++&spi6 {
++	pinctrl-0 = <&spi6_pins &spi6_cs_pins>;
++	pinctrl-names = "default";
++};
++
++&uart2 {
++	pinctrl-0 = <&uart2_pins>;
++	pinctrl-names = "default";
++};
++
++&uart3 {
++	pinctrl-0 = <&uart3_pins>;
++	pinctrl-names = "default";
++};
++
++&uart4 {
++	pinctrl-0 = <&uart4_pins>;
++	pinctrl-names = "default";
++};
++
++&uart5 {
++	pinctrl-0 = <&uart5_pins>;
++	pinctrl-names = "default";
++};
++
++&axiperf {
++	compatible = "brcm,bcm2711-axiperf";
++};
++
++/delete-node/ &v3d;
++
++/ {
++	v3dbus: v3dbus {
++		compatible = "simple-bus";
++		#address-cells = <1>;
++		#size-cells = <2>;
++		ranges = <0x7c500000  0x0 0xfc500000  0x0 0x03300000>,
++			 <0x40000000  0x0 0xff800000  0x0 0x00800000>;
++		dma-ranges = <0x00000000  0x0 0x00000000  0x4 0x00000000>;
++
++		v3d: v3d@7ec04000 {
++			compatible = "brcm,2711-v3d";
++			reg =
++			    <0x7ec00000  0x0 0x4000>,
++			    <0x7ec04000  0x0 0x4000>;
++			reg-names = "hub", "core0";
++
++			power-domains = <&pm BCM2835_POWER_DOMAIN_GRAFX_V3D>;
++			resets = <&pm BCM2835_RESET_V3D>;
++			clocks = <&firmware_clocks 5>;
++			clocks-names = "v3d";
++			interrupts = <GIC_SPI 74 IRQ_TYPE_LEVEL_HIGH>;
++			status = "disabled";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2711-rpi.dtsi b/arch/arm/boot/dts/broadcom/bcm2711-rpi.dtsi
+index c78ed064d166..da5f54e7dd24 100644
+--- a/arch/arm/boot/dts/broadcom/bcm2711-rpi.dtsi
++++ b/arch/arm/boot/dts/broadcom/bcm2711-rpi.dtsi
+@@ -15,6 +15,7 @@ aliases {
+ 		ethernet0 = &genet;
+ 		pcie0 = &pcie0;
+ 		blconfig = &blconfig;
++		blpubkey = &blpubkey;
+ 	};
+ 
+ 	i2c0mux: i2c-mux0 {
+@@ -91,6 +92,18 @@ blconfig: nvram@0 {
+ 		no-map;
+ 		status = "disabled";
+ 	};
++	/*
++	 * RPi4 will copy the binary public key blob (if present) from the bootloader
++	 * into memory for use by the OS.
++	 */
++	blpubkey: nvram@1 {
++		compatible = "raspberrypi,bootloader-public-key", "nvmem-rmem";
++		#address-cells = <1>;
++		#size-cells = <1>;
++		reg = <0x0 0x0 0x0>;
++		no-map;
++		status = "disabled";
++	};
+ };
+ 
+ &v3d {
+diff --git a/arch/arm/boot/dts/broadcom/bcm2711.dtsi b/arch/arm/boot/dts/broadcom/bcm2711.dtsi
+index 93174b596373..f24b518772dd 100644
+--- a/arch/arm/boot/dts/broadcom/bcm2711.dtsi
++++ b/arch/arm/boot/dts/broadcom/bcm2711.dtsi
+@@ -277,7 +277,7 @@ pwm1: pwm@7e20c800 {
+ 			reg = <0x7e20c800 0x28>;
+ 			clocks = <&clocks BCM2835_CLOCK_PWM>;
+ 			assigned-clocks = <&clocks BCM2835_CLOCK_PWM>;
+-			assigned-clock-rates = <10000000>;
++			assigned-clock-rates = <50000000>;
+ 			#pwm-cells = <3>;
+ 			status = "disabled";
+ 		};
+diff --git a/arch/arm/boot/dts/broadcom/bcm271x-rpi-bt.dtsi b/arch/arm/boot/dts/broadcom/bcm271x-rpi-bt.dtsi
+new file mode 100644
+index 000000000000..c77e280ccd16
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm271x-rpi-bt.dtsi
+@@ -0,0 +1,42 @@
++// SPDX-License-Identifier: GPL-2.0
++
++&uart0 {
++	bt: bluetooth {
++		compatible = "brcm,bcm43438-bt";
++		max-speed = <3000000>;
++		shutdown-gpios = <&expgpio 0 GPIO_ACTIVE_HIGH>;
++		local-bd-address = [ 00 00 00 00 00 00 ];
++		fallback-bd-address; // Don't override a valid address
++		status = "okay";
++	};
++};
++
++&uart1 {
++	minibt: bluetooth {
++		compatible = "brcm,bcm43438-bt";
++		max-speed = <230400>;
++		shutdown-gpios = <&expgpio 0 GPIO_ACTIVE_HIGH>;
++		local-bd-address = [ 00 00 00 00 00 00 ];
++		fallback-bd-address; // Don't override a valid address
++		status = "disabled";
++	};
++};
++
++/ {
++	chosen {
++		bootargs = "coherent_pool=1M 8250.nr_uarts=1 snd_bcm2835.enable_headphones=0 cgroup_disable=memory";
++	};
++
++	aliases {
++		bluetooth = &bt;
++	};
++
++	__overrides__ {
++		bdaddr = <&bt>,"local-bd-address[",
++		       <&bt>,"fallback-bd-address?=0",
++		       <&minibt>,"local-bd-address[",
++		       <&minibt>,"fallback-bd-address?=0";
++		krnbt = <&bt>,"status";
++		krnbt_baudrate = <&bt>,"max-speed:0", <&minibt>,"max-speed:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm283x-rpi-csi0-2lane.dtsi b/arch/arm/boot/dts/broadcom/bcm283x-rpi-csi0-2lane.dtsi
+new file mode 100644
+index 000000000000..6e4ce8622b47
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm283x-rpi-csi0-2lane.dtsi
+@@ -0,0 +1,4 @@
++// SPDX-License-Identifier: GPL-2.0-only
++&csi0 {
++	brcm,num-data-lanes = <2>;
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm283x-rpi-csi1-2lane.dtsi b/arch/arm/boot/dts/broadcom/bcm283x-rpi-csi1-2lane.dtsi
+new file mode 100644
+index 000000000000..6938f4daacdc
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm283x-rpi-csi1-2lane.dtsi
+@@ -0,0 +1,4 @@
++// SPDX-License-Identifier: GPL-2.0-only
++&csi1 {
++	brcm,num-data-lanes = <2>;
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm283x-rpi-csi1-4lane.dtsi b/arch/arm/boot/dts/broadcom/bcm283x-rpi-csi1-4lane.dtsi
+new file mode 100644
+index 000000000000..b37037437bee
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm283x-rpi-csi1-4lane.dtsi
+@@ -0,0 +1,4 @@
++// SPDX-License-Identifier: GPL-2.0-only
++&csi1 {
++	brcm,num-data-lanes = <4>;
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm283x-rpi-i2c0mux_0_28.dtsi b/arch/arm/boot/dts/broadcom/bcm283x-rpi-i2c0mux_0_28.dtsi
+new file mode 100644
+index 000000000000..38f0074bce3f
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm283x-rpi-i2c0mux_0_28.dtsi
+@@ -0,0 +1,4 @@
++&i2c0mux {
++	pinctrl-0 = <&i2c0_gpio0>;
++	pinctrl-1 = <&i2c0_gpio28>;
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm283x-rpi-i2c0mux_0_44.dtsi b/arch/arm/boot/dts/broadcom/bcm283x-rpi-i2c0mux_0_44.dtsi
+new file mode 100644
+index 000000000000..119946d878db
+--- /dev/null
++++ b/arch/arm/boot/dts/broadcom/bcm283x-rpi-i2c0mux_0_44.dtsi
+@@ -0,0 +1,4 @@
++&i2c0mux {
++	pinctrl-0 = <&i2c0_gpio0>;
++	pinctrl-1 = <&i2c0_gpio44>;
++};
+diff --git a/arch/arm/boot/dts/broadcom/bcm283x.dtsi b/arch/arm/boot/dts/broadcom/bcm283x.dtsi
+index 69b0919f1324..562c4e9d08cc 100644
+--- a/arch/arm/boot/dts/broadcom/bcm283x.dtsi
++++ b/arch/arm/boot/dts/broadcom/bcm283x.dtsi
+@@ -363,7 +363,7 @@ dsi0: dsi@7e209000 {
+ 			#size-cells = <0>;
+ 			#clock-cells = <1>;
+ 
+-			clocks = <&clocks BCM2835_PLLA_DSI0>,
++			clocks = <&clocks BCM2835_PLLD_DSI0>,
+ 				 <&clocks BCM2835_CLOCK_DSI0E>,
+ 				 <&clocks BCM2835_CLOCK_DSI0P>;
+ 			clock-names = "phy", "escape", "pixel";
+@@ -415,7 +415,7 @@ pwm: pwm@7e20c000 {
+ 			reg = <0x7e20c000 0x28>;
+ 			clocks = <&clocks BCM2835_CLOCK_PWM>;
+ 			assigned-clocks = <&clocks BCM2835_CLOCK_PWM>;
+-			assigned-clock-rates = <10000000>;
++			assigned-clock-rates = <50000000>;
+ 			#pwm-cells = <3>;
+ 			status = "disabled";
+ 		};
+@@ -502,6 +502,10 @@ usb: usb@7e980000 {
+ 	};
+ 
+ 	clocks {
++		compatible = "simple-bus";
++		#address-cells = <1>;
++		#size-cells = <0>;
++
+ 		/* The oscillator is the root of the clock tree. */
+ 		clk_osc: clk-osc {
+ 			compatible = "fixed-clock";
+diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
+new file mode 100644
+index 000000000000..5e43c52116c2
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -0,0 +1,349 @@
++# Overlays for the Raspberry Pi platform
++
++dtb-$(CONFIG_ARCH_BCM2835) += overlay_map.dtb hat_map.dtb README
++
++dtbo-$(CONFIG_ARCH_BCM2835) += \
++	act-led.dtbo \
++	adafruit-st7735r.dtbo \
++	adafruit18.dtbo \
++	adau1977-adc.dtbo \
++	adau7002-simple.dtbo \
++	ads1015.dtbo \
++	ads1115.dtbo \
++	ads7846.dtbo \
++	adv7282m.dtbo \
++	adv728x-m.dtbo \
++	akkordion-iqdacplus.dtbo \
++	allo-boss-dac-pcm512x-audio.dtbo \
++	allo-boss2-dac-audio.dtbo \
++	allo-digione.dtbo \
++	allo-katana-dac-audio.dtbo \
++	allo-piano-dac-pcm512x-audio.dtbo \
++	allo-piano-dac-plus-pcm512x-audio.dtbo \
++	anyspi.dtbo \
++	apds9960.dtbo \
++	applepi-dac.dtbo \
++	arducam-64mp.dtbo \
++	arducam-pivariety.dtbo \
++	at86rf233.dtbo \
++	audioinjector-addons.dtbo \
++	audioinjector-bare-i2s.dtbo \
++	audioinjector-isolated-soundcard.dtbo \
++	audioinjector-ultra.dtbo \
++	audioinjector-wm8731-audio.dtbo \
++	audiosense-pi.dtbo \
++	audremap.dtbo \
++	balena-fin.dtbo \
++	bcm2712d0.dtbo \
++	camera-mux-2port.dtbo \
++	camera-mux-4port.dtbo \
++	cap1106.dtbo \
++	chipcap2.dtbo \
++	chipdip-dac.dtbo \
++	cirrus-wm5102.dtbo \
++	cm-swap-i2c0.dtbo \
++	cma.dtbo \
++	crystalfontz-cfa050_pi_m.dtbo \
++	cutiepi-panel.dtbo \
++	dacberry400.dtbo \
++	dht11.dtbo \
++	dionaudio-kiwi.dtbo \
++	dionaudio-loco.dtbo \
++	dionaudio-loco-v2.dtbo \
++	disable-bt.dtbo \
++	disable-bt-pi5.dtbo \
++	disable-emmc2.dtbo \
++	disable-wifi.dtbo \
++	disable-wifi-pi5.dtbo \
++	dpi18.dtbo \
++	dpi18cpadhi.dtbo \
++	dpi24.dtbo \
++	draws.dtbo \
++	dwc-otg.dtbo \
++	dwc2.dtbo \
++	edt-ft5406.dtbo \
++	enc28j60.dtbo \
++	enc28j60-spi2.dtbo \
++	exc3000.dtbo \
++	fbtft.dtbo \
++	fe-pi-audio.dtbo \
++	fsm-demo.dtbo \
++	gc9a01.dtbo \
++	ghost-amp.dtbo \
++	goodix.dtbo \
++	googlevoicehat-soundcard.dtbo \
++	gpio-charger.dtbo \
++	gpio-fan.dtbo \
++	gpio-hog.dtbo \
++	gpio-ir.dtbo \
++	gpio-ir-tx.dtbo \
++	gpio-key.dtbo \
++	gpio-led.dtbo \
++	gpio-no-bank0-irq.dtbo \
++	gpio-no-irq.dtbo \
++	gpio-poweroff.dtbo \
++	gpio-shutdown.dtbo \
++	hd44780-i2c-lcd.dtbo \
++	hd44780-lcd.dtbo \
++	hdmi-backlight-hwhack-gpio.dtbo \
++	hifiberry-adc.dtbo \
++	hifiberry-adc8x.dtbo \
++	hifiberry-amp.dtbo \
++	hifiberry-amp100.dtbo \
++	hifiberry-amp3.dtbo \
++	hifiberry-amp4pro.dtbo \
++	hifiberry-dac.dtbo \
++	hifiberry-dac8x.dtbo \
++	hifiberry-dacplus.dtbo \
++	hifiberry-dacplus-pro.dtbo \
++	hifiberry-dacplus-std.dtbo \
++	hifiberry-dacplusadc.dtbo \
++	hifiberry-dacplusadcpro.dtbo \
++	hifiberry-dacplusdsp.dtbo \
++	hifiberry-dacplushd.dtbo \
++	hifiberry-digi.dtbo \
++	hifiberry-digi-pro.dtbo \
++	highperi.dtbo \
++	hy28a.dtbo \
++	hy28b.dtbo \
++	hy28b-2017.dtbo \
++	i-sabre-q2m.dtbo \
++	i2c-bcm2708.dtbo \
++	i2c-fan.dtbo \
++	i2c-gpio.dtbo \
++	i2c-mux.dtbo \
++	i2c-pwm-pca9685a.dtbo \
++	i2c-rtc.dtbo \
++	i2c-rtc-gpio.dtbo \
++	i2c-sensor.dtbo \
++	i2c0.dtbo \
++	i2c0-pi5.dtbo \
++	i2c1.dtbo \
++	i2c1-pi5.dtbo \
++	i2c2-pi5.dtbo \
++	i2c3.dtbo \
++	i2c3-pi5.dtbo \
++	i2c4.dtbo \
++	i2c5.dtbo \
++	i2c6.dtbo \
++	i2s-dac.dtbo \
++	i2s-gpio28-31.dtbo \
++	i2s-master-dac.dtbo \
++	ilitek251x.dtbo \
++	imx219.dtbo \
++	imx258.dtbo \
++	imx290.dtbo \
++	imx296.dtbo \
++	imx327.dtbo \
++	imx378.dtbo \
++	imx462.dtbo \
++	imx477.dtbo \
++	imx500.dtbo \
++	imx500-pi5.dtbo \
++	imx519.dtbo \
++	imx708.dtbo \
++	interludeaudio-analog.dtbo \
++	interludeaudio-digital.dtbo \
++	iqaudio-codec.dtbo \
++	iqaudio-dac.dtbo \
++	iqaudio-dacplus.dtbo \
++	iqaudio-digi-wm8804-audio.dtbo \
++	iqs550.dtbo \
++	irs1125.dtbo \
++	jedec-spi-nor.dtbo \
++	justboom-both.dtbo \
++	justboom-dac.dtbo \
++	justboom-digi.dtbo \
++	ltc294x.dtbo \
++	max98357a.dtbo \
++	maxtherm.dtbo \
++	mbed-dac.dtbo \
++	mcp23017.dtbo \
++	mcp23s17.dtbo \
++	mcp2515.dtbo \
++	mcp2515-can0.dtbo \
++	mcp2515-can1.dtbo \
++	mcp251xfd.dtbo \
++	mcp3008.dtbo \
++	mcp3202.dtbo \
++	mcp342x.dtbo \
++	media-center.dtbo \
++	merus-amp.dtbo \
++	midi-uart0.dtbo \
++	midi-uart0-pi5.dtbo \
++	midi-uart1.dtbo \
++	midi-uart1-pi5.dtbo \
++	midi-uart2.dtbo \
++	midi-uart2-pi5.dtbo \
++	midi-uart3.dtbo \
++	midi-uart3-pi5.dtbo \
++	midi-uart4.dtbo \
++	midi-uart4-pi5.dtbo \
++	midi-uart5.dtbo \
++	minipitft13.dtbo \
++	miniuart-bt.dtbo \
++	mipi-dbi-spi.dtbo \
++	mlx90640.dtbo \
++	mmc.dtbo \
++	mz61581.dtbo \
++	ov2311.dtbo \
++	ov5647.dtbo \
++	ov64a40.dtbo \
++	ov7251.dtbo \
++	ov9281.dtbo \
++	papirus.dtbo \
++	pca953x.dtbo \
++	pcf857x.dtbo \
++	pcie-32bit-dma.dtbo \
++	pcie-32bit-dma-pi5.dtbo \
++	pciex1-compat-pi5.dtbo \
++	pibell.dtbo \
++	pifacedigital.dtbo \
++	pifi-40.dtbo \
++	pifi-dac-hd.dtbo \
++	pifi-dac-zero.dtbo \
++	pifi-mini-210.dtbo \
++	piglow.dtbo \
++	pineboards-hat-ai.dtbo \
++	pineboards-hatdrive-poe-plus.dtbo \
++	piscreen.dtbo \
++	piscreen2r.dtbo \
++	pisound.dtbo \
++	pisound-pi5.dtbo \
++	pitft22.dtbo \
++	pitft28-capacitive.dtbo \
++	pitft28-resistive.dtbo \
++	pitft35-resistive.dtbo \
++	pps-gpio.dtbo \
++	proto-codec.dtbo \
++	pwm.dtbo \
++	pwm-2chan.dtbo \
++	pwm-gpio.dtbo \
++	pwm-ir-tx.dtbo \
++	pwm1.dtbo \
++	qca7000.dtbo \
++	qca7000-uart0.dtbo \
++	ramoops.dtbo \
++	ramoops-pi4.dtbo \
++	rotary-encoder.dtbo \
++	rpi-backlight.dtbo \
++	rpi-codeczero.dtbo \
++	rpi-dacplus.dtbo \
++	rpi-dacpro.dtbo \
++	rpi-digiampplus.dtbo \
++	rpi-ft5406.dtbo \
++	rpi-poe.dtbo \
++	rpi-poe-plus.dtbo \
++	rpi-sense.dtbo \
++	rpi-sense-v2.dtbo \
++	rpi-tv.dtbo \
++	rra-digidac1-wm8741-audio.dtbo \
++	sainsmart18.dtbo \
++	sc16is750-i2c.dtbo \
++	sc16is750-spi0.dtbo \
++	sc16is752-i2c.dtbo \
++	sc16is752-spi0.dtbo \
++	sc16is752-spi1.dtbo \
++	sdhost.dtbo \
++	sdio.dtbo \
++	sdio-pi5.dtbo \
++	seeed-can-fd-hat-v1.dtbo \
++	seeed-can-fd-hat-v2.dtbo \
++	sh1106-spi.dtbo \
++	si446x-spi0.dtbo \
++	smi.dtbo \
++	smi-dev.dtbo \
++	smi-nand.dtbo \
++	spi-gpio35-39.dtbo \
++	spi-gpio40-45.dtbo \
++	spi-rtc.dtbo \
++	spi0-0cs.dtbo \
++	spi0-1cs.dtbo \
++	spi0-2cs.dtbo \
++	spi1-1cs.dtbo \
++	spi1-2cs.dtbo \
++	spi1-3cs.dtbo \
++	spi2-1cs.dtbo \
++	spi2-1cs-pi5.dtbo \
++	spi2-2cs.dtbo \
++	spi2-2cs-pi5.dtbo \
++	spi2-3cs.dtbo \
++	spi3-1cs.dtbo \
++	spi3-1cs-pi5.dtbo \
++	spi3-2cs.dtbo \
++	spi3-2cs-pi5.dtbo \
++	spi4-1cs.dtbo \
++	spi4-2cs.dtbo \
++	spi5-1cs.dtbo \
++	spi5-1cs-pi5.dtbo \
++	spi5-2cs.dtbo \
++	spi5-2cs-pi5.dtbo \
++	spi6-1cs.dtbo \
++	spi6-2cs.dtbo \
++	ssd1306.dtbo \
++	ssd1306-spi.dtbo \
++	ssd1327-spi.dtbo \
++	ssd1331-spi.dtbo \
++	ssd1351-spi.dtbo \
++	sunfounder-pipower3.dtbo \
++	sunfounder-pironman5.dtbo \
++	superaudioboard.dtbo \
++	sx150x.dtbo \
++	tc358743.dtbo \
++	tc358743-audio.dtbo \
++	tinylcd35.dtbo \
++	tpm-slb9670.dtbo \
++	tpm-slb9673.dtbo \
++	uart0.dtbo \
++	uart0-pi5.dtbo \
++	uart1.dtbo \
++	uart1-pi5.dtbo \
++	uart2.dtbo \
++	uart2-pi5.dtbo \
++	uart3.dtbo \
++	uart3-pi5.dtbo \
++	uart4.dtbo \
++	uart4-pi5.dtbo \
++	uart5.dtbo \
++	udrc.dtbo \
++	ugreen-dabboard.dtbo \
++	upstream.dtbo \
++	upstream-pi4.dtbo \
++	vc4-fkms-v3d.dtbo \
++	vc4-fkms-v3d-pi4.dtbo \
++	vc4-kms-dpi-generic.dtbo \
++	vc4-kms-dpi-hyperpixel2r.dtbo \
++	vc4-kms-dpi-hyperpixel4.dtbo \
++	vc4-kms-dpi-hyperpixel4sq.dtbo \
++	vc4-kms-dpi-panel.dtbo \
++	vc4-kms-dsi-7inch.dtbo \
++	vc4-kms-dsi-generic.dtbo \
++	vc4-kms-dsi-ili9881-5inch.dtbo \
++	vc4-kms-dsi-ili9881-7inch.dtbo \
++	vc4-kms-dsi-lt070me05000.dtbo \
++	vc4-kms-dsi-lt070me05000-v2.dtbo \
++	vc4-kms-dsi-waveshare-800x480.dtbo \
++	vc4-kms-dsi-waveshare-panel.dtbo \
++	vc4-kms-kippah-7inch.dtbo \
++	vc4-kms-v3d.dtbo \
++	vc4-kms-v3d-pi4.dtbo \
++	vc4-kms-v3d-pi5.dtbo \
++	vc4-kms-vga666.dtbo \
++	vga666.dtbo \
++	vl805.dtbo \
++	w1-gpio.dtbo \
++	w1-gpio-pi5.dtbo \
++	w1-gpio-pullup.dtbo \
++	w1-gpio-pullup-pi5.dtbo \
++	w5500.dtbo \
++	watterott-display.dtbo \
++	waveshare-can-fd-hat-mode-a.dtbo \
++	waveshare-can-fd-hat-mode-b.dtbo \
++	wittypi.dtbo \
++	wm8960-soundcard.dtbo
++
++targets += dtbs dtbs_install
++targets += $(dtbo-y)
++
++always-y	:= $(dtbo-y)
++clean-files	:= *.dtbo
+diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
+new file mode 100644
+index 000000000000..be091ab98206
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/README
+@@ -0,0 +1,5558 @@
++Introduction
++============
++
++This directory contains Device Tree overlays. Device Tree makes it possible
++to support many hardware configurations with a single kernel and without the
++need to explicitly load or blacklist kernel modules. Note that this isn't a
++"pure" Device Tree configuration (c.f. MACH_BCM2835) - some on-board devices
++are still configured by the board support code, but the intention is to
++eventually reach that goal.
++
++On Raspberry Pi, Device Tree usage is controlled from /boot/config.txt. By
++default, the Raspberry Pi kernel boots with device tree enabled. You can
++completely disable DT usage (for now) by adding:
++
++    device_tree=
++
++to your config.txt, which should cause your Pi to revert to the old way of
++doing things after a reboot.
++
++In /boot you will find a .dtb for each base platform. This describes the
++hardware that is part of the Raspberry Pi board. The loader (start.elf and its
++siblings) selects the .dtb file appropriate for the platform by name, and reads
++it into memory. At this point, all of the optional interfaces (i2c, i2s, spi)
++are disabled, but they can be enabled using Device Tree parameters:
++
++    dtparam=i2c=on,i2s=on,spi=on
++
++However, this shouldn't be necessary in many use cases because loading an
++overlay that requires one of those interfaces will cause it to be enabled
++automatically, and it is advisable to only enable interfaces if they are
++needed.
++
++Configuring additional, optional hardware is done using Device Tree overlays
++(see below).
++
++GPIO numbering uses the hardware pin numbering scheme (aka BCM scheme) and
++not the physical pin numbers.
++
++raspi-config
++============
++
++The Advanced Options section of the raspi-config utility can enable and disable
++Device Tree use, as well as toggling the I2C and SPI interfaces. Note that it
++is possible to both enable an interface and blacklist the driver, if for some
++reason you should want to defer the loading.
++
++Modules
++=======
++
++As well as describing the hardware, Device Tree also gives enough information
++to allow suitable driver modules to be located and loaded, with the corollary
++that unneeded modules are not loaded. As a result it should be possible to
++remove lines from /etc/modules, and /etc/modprobe.d/raspi-blacklist.conf can
++have its contents deleted (or commented out).
++
++Using Overlays
++==============
++
++Overlays are loaded using the "dtoverlay" config.txt setting. As an example,
++consider I2C Real Time Clock drivers. In the pre-DT world these would be loaded
++by writing a magic string comprising a device identifier and an I2C address to
++a special file in /sys/class/i2c-adapter, having first loaded the driver for
++the I2C interface and the RTC device - something like this:
++
++    modprobe i2c-bcm2835
++    modprobe rtc-ds1307
++    echo ds1307 0x68 > /sys/class/i2c-adapter/i2c-1/new_device
++
++With DT enabled, this becomes a line in config.txt:
++
++    dtoverlay=i2c-rtc,ds1307
++
++This causes the file /boot/overlays/i2c-rtc.dtbo to be loaded and a "node"
++describing the DS1307 I2C device to be added to the Device Tree for the Pi. By
++default it usees address 0x68, but this can be modified with an additional DT
++parameter:
++
++    dtoverlay=i2c-rtc,ds1307,addr=0x68
++
++Parameters usually have default values, although certain parameters are
++mandatory. See the list of overlays below for a description of the parameters
++and their defaults.
++
++Making new Overlays based on existing Overlays
++==============================================
++
++Recent overlays have been designed in a more general way, so that they can be
++adapted to hardware by changing their parameters. When you have additional
++hardware with more than one device of a kind, you end up using the same overlay
++multiple times with other parameters, e.g.
++
++    # 2 CAN FD interfaces on spi but with different pins
++    dtoverlay=mcp251xfd,spi0-0,interrupt=25
++    dtoverlay=mcp251xfd,spi0-1,interrupt=24
++
++    # a realtime clock on i2c
++    dtoverlay=i2c-rtc,pcf85063
++
++While this approach does work, it requires knowledge about the hardware design.
++It is more feasible to simplify things for the end user by providing a single
++overlay as it is done the traditional way.
++
++A new overlay can be generated by using ovmerge utility.
++https://github.com/raspberrypi/utils/blob/master/ovmerge/ovmerge
++
++To generate an overlay for the above configuration we pass the configuration
++to ovmerge and add the -c flag.
++
++    ovmerge -c mcp251xfd-overlay.dts,spi0-0,interrupt=25 \
++               mcp251xfd-overlay.dts,spi0-1,interrupt=24 \
++               i2c-rtc-overlay.dts,pcf85063 \
++    >> merged-overlay.dts
++
++The -c option writes the command above as a comment into the overlay as
++a marker that this overlay is generated and how it was generated.
++After compiling the overlay it can be loaded in a single line.
++
++    dtoverlay=merged
++
++It does the same as the original configuration but without parameters.
++
++The Overlay and Parameter Reference
++===================================
++
++N.B. When editing this file, please preserve the indentation levels to make it
++simple to parse programmatically. NO HARD TABS.
++
++
++Name:   <The base DTB>
++Info:   Configures the base Raspberry Pi hardware
++Load:   <loaded automatically>
++Params:
++        act_led_trigger         Choose which activity the LED tracks.
++                                Use "heartbeat" for a nice load indicator.
++                                (default "mmc")
++
++        act_led_activelow       Set to "on" to invert the sense of the LED
++                                (default "off")
++                                N.B. For Pi 3B, 3B+, 3A+ and 4B, use the act-led
++                                overlay.
++
++        act_led_gpio            Set which GPIO to use for the activity LED
++                                (in case you want to connect it to an external
++                                device)
++                                (default "16" on a non-Plus board, "47" on a
++                                Plus or Pi 2)
++                                N.B. For Pi 3B, 3B+, 3A+ and 4B, use the act-led
++                                overlay.
++
++        ant1                    Select antenna 1 (default). CM4/5 only.
++
++        ant2                    Select antenna 2. CM4/5 only.
++
++        noant                   Disable both antennas. CM4/5 only.
++
++        audio                   Set to "on" to enable the onboard ALSA audio
++                                interface (default "off")
++
++        axiperf                 Set to "on" to enable the AXI bus performance
++                                monitors.
++                                See /sys/kernel/debug/raspberrypi_axi_monitor
++                                for the results.
++
++        bdaddr                  Set an alternative Bluetooth address (BDADDR).
++                                The value should be a 6-byte hexadecimal value,
++                                with or without colon separators, written least-
++                                significant-byte first. For example,
++                                bdaddr=06:05:04:03:02:01
++                                will set the BDADDR to 01:02:03:04:05:06.
++
++        button_debounce         Set the debounce delay (in ms) on the power/
++                                shutdown button (default 50ms)
++
++        cam0_reg                Controls CAM 0 regulator.
++                                Disabled by default on CM1 & 3.
++                                Enabled by default on all other boards.
++
++        cam0_reg_gpio           Set GPIO for CAM 0 regulator.
++                                NB override switches to the normal GPIO driver,
++                                even if the original was on the GPIO expander.
++
++        cam1_reg                Controls CAM 1 regulator.
++                                Disabled by default on CM1 & 3.
++                                Enabled by default on all other boards.
++
++        cam1_reg_gpio           Set GPIO for CAM 1 regulator.
++                                NB override switches to the normal GPIO driver,
++                                even if the original was on the GPIO expander.
++
++        cam0_sync               Enable a GPIO to reflect frame sync from CSI0,
++                                going high on frame start, and low on frame end.
++
++        cam0_sync_inverted      Enable a GPIO to reflect frame sync from CSI0
++                                going low on frame start, and high on frame end.
++
++        cam1_sync               Enable a GPIO to reflect frame sync from CSI1,
++                                going high on frame start, and low on frame end.
++
++        cam1_sync_inverted      Enable a GPIO to reflect frame sync from CSI1
++                                going low on frame start, and high on frame end.
++
++        cooling_fan             Enables the Pi 5 cooling fan (enabled
++                                automatically by the firmware)
++
++        drm_fb0_rp1_dpi         Assign /dev/fb0 to the RP1 DPI output
++
++        drm_fb0_rp1_dsi0        Assign /dev/fb0 to the RP1 DSI0 output
++
++        drm_fb0_rp1_dsi1        Assign /dev/fb0 to the RP1 DSI1 output
++
++        drm_fb0_vc4             Assign /dev/fb0 to the vc4 outputs
++
++        drm_fb1_rp1_dpi         Assign /dev/fb1 to the RP1 DPI output
++
++        drm_fb1_rp1_dsi0        Assign /dev/fb1 to the RP1 DSI0 output
++
++        drm_fb1_rp1_dsi1        Assign /dev/fb1 to the RP1 DSI1 output
++
++        drm_fb1_vc4             Assign /dev/fb1 to the vc4 outputs
++
++        drm_fb2_rp1_dpi         Assign /dev/fb2 to the RP1 DPI output
++
++        drm_fb2_rp1_dsi0        Assign /dev/fb2 to the RP1 DSI0 output
++
++        drm_fb2_rp1_dsi1        Assign /dev/fb2 to the RP1 DSI1 output
++
++        drm_fb2_vc4             Assign /dev/fb2 to the vc4 outputs
++
++        eee                     Enable Energy Efficient Ethernet support for
++                                compatible devices (default "on"). See also
++                                "tx_lpi_timer". Pi3B+ only.
++
++        eth_downshift_after     Set the number of auto-negotiation failures
++                                after which the 1000Mbps modes are disabled.
++                                Legal values are 2, 3, 4, 5 and 0, where
++                                0 means never downshift (default 2). Pi3B+ only.
++
++        eth_led0                Set mode of LED0 - amber on Pi3B+ (default "1"),
++                                green on Pi4/5 (default "0").
++                                The legal values are:
++
++                                Pi3B+
++
++                                0=link/activity          1=link1000/activity
++                                2=link100/activity       3=link10/activity
++                                4=link100/1000/activity  5=link10/1000/activity
++                                6=link10/100/activity    14=off    15=on
++
++                                Pi4/5
++
++                                0=Speed/Activity         1=Speed
++                                2=Flash activity         3=FDX
++                                4=Off                    5=On
++                                6=Alt                    7=Speed/Flash
++                                8=Link                   9=Activity
++
++        eth_led1                Set mode of LED1 - green on Pi3B+ (default "6"),
++                                amber on Pi4/5 (default "8"). See eth_led0 for
++                                legal values.
++
++        eth_max_speed           Set the maximum speed a link is allowed
++                                to negotiate. Legal values are 10, 100 and
++                                1000 (default 1000). Pi3B+ only.
++
++        fan_temp0               Temperature threshold (in millicelcius) for
++                                1st cooling level (default 50000). Pi5 only.
++        fan_temp0_hyst          Temperature hysteresis (in millicelcius) for
++                                1st cooling level (default 5000). Pi5 only.
++        fan_temp0_speed         Fan PWM setting for 1st cooling level (0-255,
++                                default 75). Pi5 only.
++        fan_temp1               Temperature threshold (in millicelcius) for
++                                2nd cooling level (default 60000). Pi5 only.
++        fan_temp1_hyst          Temperature hysteresis (in millicelcius) for
++                                2nd cooling level (default 5000). Pi5 only.
++        fan_temp1_speed         Fan PWM setting for 2nd cooling level (0-255,
++                                default 125). Pi5 only.
++        fan_temp2               Temperature threshold (in millicelcius) for
++                                3rd cooling level (default 67500). Pi5 only.
++        fan_temp2_hyst          Temperature hysteresis (in millicelcius) for
++                                3rd cooling level (default 5000). Pi5 only.
++        fan_temp2_speed         Fan PWM setting for 3rd cooling level (0-255,
++                                default 175). Pi5 only.
++        fan_temp3               Temperature threshold (in millicelcius) for
++                                4th cooling level (default 75000). Pi5 only.
++        fan_temp3_hyst          Temperature hysteresis (in millicelcius) for
++                                4th cooling level (default 5000). Pi5 only.
++        fan_temp3_speed         Fan PWM setting for 4th cooling level (0-255,
++                                default 250). Pi5 only.
++
++        hdmi                    Set to "off" to disable the HDMI interface
++                                (default "on")
++
++        i2c                     An alias for i2c_arm
++
++        i2c_arm                 Set to "on" to enable the ARM's i2c interface
++                                (default "off")
++
++        i2c_arm_baudrate        Set the baudrate of the ARM's i2c interface
++                                (default "100000")
++
++        i2c_baudrate            An alias for i2c_arm_baudrate
++
++        i2c_csi_dsi             Set to "on" to enable the i2c_csi_dsi interface
++
++        i2c_csi_dsi0            Set to "on" to enable the i2c_csi_dsi0 interface
++
++        i2c_csi_dsi1            Set to "on" to enable the i2c_csi_dsi1 interface
++
++        i2c_vc                  Set to "on" to enable the i2c interface
++                                usually reserved for the VideoCore processor
++                                (default "off")
++
++        i2c_vc_baudrate         Set the baudrate of the VideoCore i2c interface
++                                (default "100000")
++
++        i2s                     Set to "on" to enable the i2s interface
++                                (default "off")
++
++        i2s_dma4                Use to enable 40-bit DMA on the i2s interface
++                                (the assigned value doesn't matter)
++                                (2711 only)
++
++        krnbt                   Set to "off" to disable autoprobing of Bluetooth
++                                driver without need of hciattach/btattach
++                                (default "on")
++
++        krnbt_baudrate          Set the baudrate of the PL011 UART when used
++                                with krnbt=on
++
++        nvme                    Alias for "pciex1" (2712 only)
++
++        nvmem_cust_rw           Allow read/write access to customer otp
++
++        nvmem_mac_rw            Allow read/write access to mac addresses otp
++
++        nvmem_priv_rw           Allow read/write access to customer private otp
++
++        pcie                    Set to "off" to disable the PCIe interface
++                                (default "on")
++                                (2711 only, but not applicable on CM4S)
++                                N.B. USB-A ports on 4B are subsequently disabled
++
++        pcie_tperst_clk_ms      Add N milliseconds between PCIe reference clock
++                                activation and PERST# deassertion
++                                (CM4 and 2712, default "0")
++
++        pciex1                  Set to "on" to enable the external PCIe link
++                                (2712 only, default "off")
++
++        pciex1_gen              Sets the PCIe "GEN"/speed for the external PCIe
++                                link (2712 only, default "2")
++
++        pciex1_no_l0s           Set to "on" to disable ASPM L0s on the external
++                                PCIe link for devices that have broken
++                                implementations (2712 only, default "off")
++
++        pciex1_tperst_clk_ms    Alias for pcie_tperst_clk_ms
++                                (2712 only, default "0")
++
++        pwr_led_trigger
++        pwr_led_activelow
++        pwr_led_gpio
++                                As for act_led_*, but using the PWR LED.
++                                Not available on Model A/B boards.
++
++        random                  Set to "on" to enable the hardware random
++                                number generator (default "on")
++
++        rtc                     Set to "off" to disable the onboard Real Time
++                                Clock (2712 only, default "on")
++
++        rtc_bbat_vchg           Set the RTC backup battery charging voltage in
++                                microvolts. If set to 0 or not specified, the
++                                trickle charger is disabled.
++                                (2712 only, default "0")
++
++        sd                      Set to "off" to disable the SD card (or eMMC on
++                                non-lite SKU of CM4).
++                                (default "on")
++
++        sd_cqe                  Set to "off" to disable Command Queueing if you
++                                have an incompatible Class A2 SD card
++                                (Pi 5 only, default "on")
++
++        sd_overclock            Clock (in MHz) to use when the MMC framework
++                                requests 50MHz
++
++        sd_poll_once            Looks for a card once after booting. Useful
++                                for network booting scenarios to avoid the
++                                overhead of continuous polling. N.B. Using
++                                this option restricts the system to using a
++                                single card per boot (or none at all).
++                                (default off)
++
++        sd_force_pio            Disable DMA support for SD driver (default off)
++
++        sd_pio_limit            Number of blocks above which to use DMA for
++                                SD card (default 1)
++
++        sd_debug                Enable debug output from SD driver (default off)
++
++        sdio_overclock          Clock (in MHz) to use when the MMC framework
++                                requests 50MHz for the SDIO/WLAN interface.
++
++        spi                     Set to "on" to enable the spi interfaces
++                                (default "off")
++
++        spi_dma4                Use to enable 40-bit DMA on spi interfaces
++                                (the assigned value doesn't matter)
++                                (2711 only)
++
++        strict_gpiod            Return GPIOs to inputs when they are released.
++                                If using the gpiod utilities, it is necessary
++                                to keep a gpioset running (e.g. with
++                                --mode=wait) in order for an output value to
++                                persist.
++
++        suspend                 Make the power button trigger a suspend rather
++                                than a power-off (2712 only, default "off")
++
++        tx_lpi_timer            Set the delay in microseconds between going idle
++                                and entering the low power state (default 600).
++                                Requires EEE to be enabled - see "eee".
++
++        uart0                   Set to "off" to disable uart0 (default "on")
++
++        uart0_console           Move the kernel boot console to UART0 on pins
++                                6, 8 and 10 of the 40-way header (2712 only,
++                                default "off")
++
++        uart1                   Set to "on" or "off" to enable or disable uart1
++                                (default varies)
++
++        watchdog                Set to "on" to enable the hardware watchdog
++                                (default "off")
++
++        wifiaddr                Set an alternative WiFi MAC address.
++                                The value should be a 6-byte hexadecimal value,
++                                with or without colon separators, written in the
++                                natural (big-endian) order.
++
++        N.B. It is recommended to only enable those interfaces that are needed.
++        Leaving all interfaces enabled can lead to unwanted behaviour (i2c_vc
++        interfering with Pi Camera, I2S and SPI hogging GPIO pins, etc.)
++        Note also that i2c, i2c_arm and i2c_vc are aliases for the physical
++        interfaces i2c0 and i2c1. Use of the numeric variants is still possible
++        but deprecated because the ARM/VC assignments differ between board
++        revisions. The same board-specific mapping applies to i2c_baudrate,
++        and the other i2c baudrate parameters.
++
++
++Name:   act-led
++Info:   Pi 3B, 3B+, 3A+ and 4B use a GPIO expander to drive the LEDs which can
++        only be accessed from the VPU. There is a special driver for this with a
++        separate DT node, which has the unfortunate consequence of breaking the
++        act_led_gpio and act_led_activelow dtparams.
++        This overlay changes the GPIO controller back to the standard one and
++        restores the dtparams.
++Load:   dtoverlay=act-led,<param>=<val>
++Params: activelow               Set to "on" to invert the sense of the LED
++                                (default "off")
++
++        gpio                    Set which GPIO to use for the activity LED
++                                (in case you want to connect it to an external
++                                device)
++                                REQUIRED
++
++
++Name:   adafruit-st7735r
++Info:   Overlay for the SPI-connected Adafruit 1.8" 160x128 or 128x128 displays,
++        based on the ST7735R chip.
++        This overlay uses the newer DRM/KMS "Tiny" driver.
++Load:   dtoverlay=adafruit-st7735r,<param>=<val>
++Params: 128x128                 Select the 128x128 driver (default 160x128)
++        rotate                  Display rotation {0,90,180,270} (default 90)
++        speed                   SPI bus speed in Hz (default 4000000)
++        dc_pin                  GPIO pin for D/C (default 24)
++        reset_pin               GPIO pin for RESET (default 25)
++        led_pin                 GPIO used to control backlight (default 18)
++
++
++Name:   adafruit18
++Info:   Overlay for the SPI-connected Adafruit 1.8" display (based on the
++        ST7735R chip). It includes support for the "green tab" version.
++        This overlay uses the older fbtft driver.
++Load:   dtoverlay=adafruit18,<param>=<val>
++Params: green                   Use the adafruit18_green variant.
++        rotate                  Display rotation {0,90,180,270}
++        speed                   SPI bus speed in Hz (default 4000000)
++        fps                     Display frame rate in Hz
++        bgr                     Enable BGR mode (default off)
++        debug                   Debug output level {0-7}
++        dc_pin                  GPIO pin for D/C (default 24)
++        reset_pin               GPIO pin for RESET (default 25)
++        led_pin                 GPIO used to control backlight (default 18)
++
++
++Name:   adau1977-adc
++Info:   Overlay for activation of ADAU1977 ADC codec over I2C for control
++        and I2S for data.
++Load:   dtoverlay=adau1977-adc
++Params: <None>
++
++
++Name:   adau7002-simple
++Info:   Overlay for the activation of ADAU7002 stereo PDM to I2S converter.
++Load:   dtoverlay=adau7002-simple,<param>=<val>
++Params: card-name               Override the default, "adau7002", card name.
++
++
++Name:   ads1015
++Info:   Overlay for activation of Texas Instruments ADS1015 ADC over I2C
++Load:   dtoverlay=ads1015,<param>=<val>
++Params: addr                    I2C bus address of device. Set based on how the
++                                addr pin is wired. (default=0x48 assumes addr
++                                is pulled to GND)
++        cha_enable              Enable virtual channel a. (default=true)
++        cha_cfg                 Set the configuration for virtual channel a.
++                                (default=4 configures this channel for the
++                                voltage at A0 with respect to GND)
++        cha_datarate            Set the datarate (samples/sec) for this channel.
++                                (default=4 sets 1600 sps)
++        cha_gain                Set the gain of the Programmable Gain
++                                Amplifier for this channel. (default=2 sets the
++                                full scale of the channel to 2.048 Volts)
++
++        Channel (ch) parameters can be set for each enabled channel.
++        A maximum of 4 channels can be enabled (letters a thru d).
++        For more information refer to the device datasheet at:
++        http://www.ti.com/lit/ds/symlink/ads1015.pdf
++
++
++Name:   ads1115
++Info:   Texas Instruments ADS1115 ADC
++Load:   dtoverlay=ads1115,<param>[=<val>]
++Params: addr                    I2C bus address of device. Set based on how the
++                                addr pin is wired. (default=0x48 assumes addr
++                                is pulled to GND)
++        cha_enable              Enable virtual channel a.
++        cha_cfg                 Set the configuration for virtual channel a.
++                                (default=4 configures this channel for the
++                                voltage at A0 with respect to GND)
++        cha_datarate            Set the datarate (samples/sec) for this channel.
++                                (default=7 sets 860 sps)
++        cha_gain                Set the gain of the Programmable Gain
++                                Amplifier for this channel. (Default 1 sets the
++                                full scale of the channel to 4.096 Volts)
++        i2c0                    Choose the I2C0 bus on GPIOs 0&1
++        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++        i2c3                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++        i2c4                    Choose the I2C4 bus (configure with the i2c4
++                                overlay - BCM2711 only)
++        i2c5                    Choose the I2C5 bus (configure with the i2c5
++                                overlay - BCM2711 only)
++        i2c6                    Choose the I2C6 bus (configure with the i2c6
++                                overlay - BCM2711 only)
++
++        Channel parameters can be set for each enabled channel.
++        A maximum of 4 channels can be enabled (letters a thru d).
++        For more information refer to the device datasheet at:
++        http://www.ti.com/lit/ds/symlink/ads1115.pdf
++
++
++Name:   ads7846
++Info:   ADS7846 Touch controller
++Load:   dtoverlay=ads7846,<param>=<val>
++Params: cs                      SPI bus Chip Select (default 1)
++        speed                   SPI bus speed (default 2MHz, max 3.25MHz)
++        penirq                  GPIO used for PENIRQ. REQUIRED
++        penirq_pull             Set GPIO pull (default 0=none, 2=pullup)
++        swapxy                  Swap x and y axis
++        xmin                    Minimum value on the X axis (default 0)
++        ymin                    Minimum value on the Y axis (default 0)
++        xmax                    Maximum value on the X axis (default 4095)
++        ymax                    Maximum value on the Y axis (default 4095)
++        pmin                    Minimum reported pressure value (default 0)
++        pmax                    Maximum reported pressure value (default 65535)
++        xohms                   Touchpanel sensitivity (X-plate resistance)
++                                (default 400)
++
++        penirq is required and usually xohms (60-100) has to be set as well.
++        Apart from that, pmax (255) and swapxy are also common.
++        The rest of the calibration can be done with xinput-calibrator.
++        See: github.com/notro/fbtft/wiki/FBTFT-on-Raspian
++        Device Tree binding document:
++        www.kernel.org/doc/Documentation/devicetree/bindings/input/ads7846.txt
++
++
++Name:   adv7282m
++Info:   Analog Devices ADV7282M analogue video to CSI2 bridge.
++        Uses Unicam1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=adv7282m,<param>=<val>
++Params: addr                    Overrides the I2C address (default 0x21)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default off)
++
++
++Name:   adv728x-m
++Info:   Analog Devices ADV728[0|1|2]-M analogue video to CSI2 bridges.
++        This is a wrapper for adv7282m, and defaults to ADV7282M.
++Load:   dtoverlay=adv728x-m,<param>=<val>
++Params: addr                    Overrides the I2C address (default 0x21)
++        adv7280m                Select ADV7280-M.
++        adv7281m                Select ADV7281-M.
++        adv7281ma               Select ADV7281-MA.
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default off)
++
++
++Name:   akkordion-iqdacplus
++Info:   Configures the Digital Dreamtime Akkordion Music Player (based on the
++        OEM IQAudIO DAC+ or DAC Zero module).
++Load:   dtoverlay=akkordion-iqdacplus,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control. Enable with
++                                dtoverlay=akkordion-iqdacplus,24db_digital_gain
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24db_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++
++
++Name:   allo-boss-dac-pcm512x-audio
++Info:   Configures the Allo Boss DAC audio cards.
++Load:   dtoverlay=allo-boss-dac-pcm512x-audio,<param>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control. Enable with
++                                "dtoverlay=allo-boss-dac-pcm512x-audio,
++                                24db_digital_gain"
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24db_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++        slave                   Force Boss DAC into slave mode, using Pi a
++                                master for bit clock and frame clock. Enable
++                                with "dtoverlay=allo-boss-dac-pcm512x-audio,
++                                slave"
++
++
++Name:   allo-boss2-dac-audio
++Info:   Configures the Allo Boss2 DAC audio card
++Load:   dtoverlay=allo-boss2-dac-audio
++Params: <None>
++
++
++Name:   allo-digione
++Info:   Configures the Allo Digione audio card
++Load:   dtoverlay=allo-digione
++Params: <None>
++
++
++Name:   allo-katana-dac-audio
++Info:   Configures the Allo Katana DAC audio card
++Load:   dtoverlay=allo-katana-dac-audio
++Params: <None>
++
++
++Name:   allo-piano-dac-pcm512x-audio
++Info:   Configures the Allo Piano DAC (2.0/2.1) audio cards.
++        (NB. This initial support is for 2.0 channel audio ONLY! ie. stereo.
++        The subwoofer outputs on the Piano 2.1 are not currently supported!)
++Load:   dtoverlay=allo-piano-dac-pcm512x-audio,<param>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control.
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24db_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++
++
++Name:   allo-piano-dac-plus-pcm512x-audio
++Info:   Configures the Allo Piano DAC (2.1) audio cards.
++Load:   dtoverlay=allo-piano-dac-plus-pcm512x-audio,<param>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control.
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24db_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++        glb_mclk                This option is only with Kali board. If enabled,
++                                MCLK for Kali is used and PLL is disabled for
++                                better voice quality. (default Off)
++
++
++Name:   anyspi
++Info:   Universal device tree overlay for SPI devices
++
++        Just specify the SPI address and device name ("compatible" property).
++        This overlay lacks any device-specific parameter support!
++
++        For devices on spi1 or spi2, the interfaces should be enabled
++        with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
++
++        Examples:
++        1. SPI NOR flash on spi0.1, maximum SPI clock frequency 45MHz:
++            dtoverlay=anyspi:spi0-1,dev="jedec,spi-nor",speed=45000000
++        2. MCP3204 ADC on spi1.2, maximum SPI clock frequency 500kHz:
++            dtoverlay=anyspi:spi1-2,dev="microchip,mcp3204"
++Load:   dtoverlay=anyspi,<param>=<val>
++Params: spi<n>-<m>              Configure device at spi<n>, cs<m>
++                                (boolean, required)
++        dev                     Set device name to search compatible module
++                                (string, required)
++        speed                   Set SPI clock frequency in Hz
++                                (integer, optional, default 500000)
++
++
++Name:   apds9960
++Info:   Configures the AVAGO APDS9960 digital proximity, ambient light, RGB and
++        gesture sensor
++Load:   dtoverlay=apds9960,<param>=<val>
++Params: gpiopin                 GPIO used for INT (default 4)
++        noints                  Disable the interrupt GPIO line.
++
++
++Name:   applepi-dac
++Info:   Configures the Orchard Audio ApplePi-DAC audio card
++Load:   dtoverlay=applepi-dac
++Params: <None>
++
++
++Name:   arducam-64mp
++Info:   Arducam 64MP camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=arducam-64mp,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 0)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++        vcm                     Select lens driver state. Default is enabled,
++                                but vcm=off will disable.
++
++
++Name:   arducam-pivariety
++Info:   Arducam Pivariety camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=arducam-pivariety,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 0)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++
++
++Name:   at86rf233
++Info:   Configures the Atmel AT86RF233 802.15.4 low-power WPAN transceiver,
++        connected to spi0.0
++Load:   dtoverlay=at86rf233,<param>=<val>
++Params: interrupt               GPIO used for INT (default 23)
++        reset                   GPIO used for Reset (default 24)
++        sleep                   GPIO used for Sleep (default 25)
++        speed                   SPI bus speed in Hz (default 3000000)
++        trim                    Fine tuning of the internal capacitance
++                                arrays (0=+0pF, 15=+4.5pF, default 15)
++
++
++Name:   audioinjector-addons
++Info:   Configures the audioinjector.net audio add on soundcards
++Load:   dtoverlay=audioinjector-addons,<param>=<val>
++Params: non-stop-clocks         Keeps the clocks running even when the stream
++                                is paused or stopped (default off)
++
++
++Name:   audioinjector-bare-i2s
++Info:   Configures the audioinjector.net audio bare i2s soundcard
++Load:   dtoverlay=audioinjector-bare-i2s
++Params: <None>
++
++
++Name:   audioinjector-isolated-soundcard
++Info:   Configures the audioinjector.net isolated soundcard
++Load:   dtoverlay=audioinjector-isolated-soundcard
++Params: <None>
++
++
++Name:   audioinjector-ultra
++Info:   Configures the audioinjector.net ultra soundcard
++Load:   dtoverlay=audioinjector-ultra
++Params: <None>
++
++
++Name:   audioinjector-wm8731-audio
++Info:   Configures the audioinjector.net audio add on soundcard
++Load:   dtoverlay=audioinjector-wm8731-audio
++Params: <None>
++
++
++Name:   audiosense-pi
++Info:   Configures the audiosense-pi add on soundcard
++        For more information refer to
++        https://gitlab.com/kakar0t/audiosense-pi
++Load:   dtoverlay=audiosense-pi
++Params: <None>
++
++
++Name:   audremap
++Info:   Switches PWM sound output to GPIOs on the 40-pin header
++Load:   dtoverlay=audremap,<param>=<val>
++Params: swap_lr                 Reverse the channel allocation, which will also
++                                swap the audio jack outputs (default off)
++        enable_jack             Don't switch off the audio jack output. Does
++                                nothing on BCM2711 (default off)
++        pins_12_13              Select GPIOs 12 & 13 (default)
++        pins_18_19              Select GPIOs 18 & 19
++        pins_40_41              Select GPIOs 40 & 41 (not available on CM4, used
++                                for other purposes)
++        pins_40_45              Select GPIOs 40 & 45 (don't use on BCM2711 - the
++                                pins are on different controllers)
++
++
++Name:   balena-fin
++Info:   Overlay that enables WLAN, Bluetooth and the GPIO expander on the
++        balenaFin carrier board for the Raspberry Pi Compute Module 3/3+ Lite.
++Load:   dtoverlay=balena-fin
++Params: <None>
++
++
++Name:   bcm2712d0
++Info:   Overlay encapsulating the BCM2712 C0->D0 differences
++Load:   dtoverlay=bcm2712d0
++Params: <None>
++
++
++Name:   bmp085_i2c-sensor
++Info:   This overlay is now deprecated - see i2c-sensor
++Load:   <Deprecated>
++
++
++Name:   camera-mux-2port
++Info:   Configures a 2 port camera multiplexer
++        Note that currently ALL IMX290 modules share a common clock, therefore
++        all modules will need to have the same clock frequency.
++Load:   dtoverlay=camera-mux-2port,<param>=<val>
++Params: cam0-arducam-64mp       Select Arducam64MP for camera on port 0
++        cam0-imx219             Select IMX219 for camera on port 0
++        cam0-imx258             Select IMX258 for camera on port 0
++        cam0-imx290             Select IMX290 for camera on port 0
++        cam0-imx477             Select IMX477 for camera on port 0
++        cam0-imx519             Select IMX519 for camera on port 0
++        cam0-imx708             Select IMX708 for camera on port 0
++        cam0-ov2311             Select OV2311 for camera on port 0
++        cam0-ov5647             Select OV5647 for camera on port 0
++        cam0-ov64a40            Select OV64A40 for camera on port 0
++        cam0-ov7251             Select OV7251 for camera on port 0
++        cam0-ov9281             Select OV9281 for camera on port 0
++        cam0-imx290-clk-freq    Set clock frequency for an IMX290 on port 0
++        cam1-arducam-64mp       Select Arducam64MP for camera on port 1
++        cam1-imx219             Select IMX219 for camera on port 1
++        cam1-imx258             Select IMX258 for camera on port 1
++        cam1-imx290             Select IMX290 for camera on port 1
++        cam1-imx477             Select IMX477 for camera on port 1
++        cam1-imx519             Select IMX519 for camera on port 1
++        cam1-imx708             Select IMX708 for camera on port 1
++        cam1-ov2311             Select OV2311 for camera on port 1
++        cam1-ov5647             Select OV5647 for camera on port 1
++        cam1-ov64a40            Select OV64A40 for camera on port 1
++        cam1-ov7251             Select OV7251 for camera on port 1
++        cam1-ov9281             Select OV9281 for camera on port 1
++        cam1-imx290-clk-freq    Set clock frequency for an IMX290 on port 1
++        cam0-sync-source        Set camera on port 0 as vsync source
++        cam0-sync-sink          Set camera on port 0 as vsync sink
++        cam1-sync-source        Set camera on port 1 as vsync source
++        cam1-sync-sink          Set camera on port 1 as vsync sink
++
++        cam0                    Connect the mux to CAM0 port (default is CAM1)
++
++
++Name:   camera-mux-4port
++Info:   Configures a 4 port camera multiplexer
++        Note that currently ALL IMX290 modules share a common clock, therefore
++        all modules will need to have the same clock frequency.
++Load:   dtoverlay=camera-mux-4port,<param>=<val>
++Params: cam0-arducam-64mp       Select Arducam64MP for camera on port 0
++        cam0-imx219             Select IMX219 for camera on port 0
++        cam0-imx258             Select IMX258 for camera on port 0
++        cam0-imx290             Select IMX290 for camera on port 0
++        cam0-imx477             Select IMX477 for camera on port 0
++        cam0-imx519             Select IMX519 for camera on port 0
++        cam0-imx708             Select IMX708 for camera on port 0
++        cam0-ov2311             Select OV2311 for camera on port 0
++        cam0-ov5647             Select OV5647 for camera on port 0
++        cam0-ov64a40            Select OV64A40 for camera on port 0
++        cam0-ov7251             Select OV7251 for camera on port 0
++        cam0-ov9281             Select OV9281 for camera on port 0
++        cam0-imx290-clk-freq    Set clock frequency for an IMX290 on port 0
++        cam1-arducam-64mp       Select Arducam64MP for camera on port 1
++        cam1-imx219             Select IMX219 for camera on port 1
++        cam1-imx258             Select IMX258 for camera on port 1
++        cam1-imx290             Select IMX290 for camera on port 1
++        cam1-imx477             Select IMX477 for camera on port 1
++        cam1-imx519             Select IMX519 for camera on port 1
++        cam1-imx708             Select IMX708 for camera on port 1
++        cam1-ov2311             Select OV2311 for camera on port 1
++        cam1-ov5647             Select OV5647 for camera on port 1
++        cam1-ov64a40            Select OV64A40 for camera on port 1
++        cam1-ov7251             Select OV7251 for camera on port 1
++        cam1-ov9281             Select OV9281 for camera on port 1
++        cam1-imx290-clk-freq    Set clock frequency for an IMX290 on port 1
++        cam2-arducam-64mp       Select Arducam64MP for camera on port 2
++        cam2-imx219             Select IMX219 for camera on port 2
++        cam2-imx258             Select IMX258 for camera on port 2
++        cam2-imx290             Select IMX290 for camera on port 2
++        cam2-imx477             Select IMX477 for camera on port 2
++        cam2-imx519             Select IMX519 for camera on port 2
++        cam2-imx708             Select IMX708 for camera on port 2
++        cam2-ov2311             Select OV2311 for camera on port 2
++        cam2-ov5647             Select OV5647 for camera on port 2
++        cam2-ov64a40            Select OV64A40 for camera on port 2
++        cam2-ov7251             Select OV7251 for camera on port 2
++        cam2-ov9281             Select OV9281 for camera on port 2
++        cam2-imx290-clk-freq    Set clock frequency for an IMX290 on port 2
++        cam3-arducam-64mp       Select Arducam64MP for camera on port 3
++        cam3-imx219             Select IMX219 for camera on port 3
++        cam3-imx258             Select IMX258 for camera on port 3
++        cam3-imx290             Select IMX290 for camera on port 3
++        cam3-imx477             Select IMX477 for camera on port 3
++        cam3-imx519             Select IMX519 for camera on port 3
++        cam3-imx708             Select IMX708 for camera on port 3
++        cam3-ov2311             Select OV2311 for camera on port 3
++        cam3-ov5647             Select OV5647 for camera on port 3
++        cam3-ov64a40            Select OV64A40 for camera on port 3
++        cam3-ov7251             Select OV7251 for camera on port 3
++        cam3-ov9281             Select OV9281 for camera on port 3
++        cam3-imx290-clk-freq    Set clock frequency for an IMX290 on port 3
++        cam0-sync-source        Set camera on port 0 as vsync source
++        cam0-sync-sink          Set camera on port 0 as vsync sink
++        cam1-sync-source        Set camera on port 1 as vsync source
++        cam1-sync-sink          Set camera on port 1 as vsync sink
++        cam2-sync-source        Set camera on port 2 as vsync source
++        cam2-sync-sink          Set camera on port 2 as vsync sink
++        cam3-sync-source        Set camera on port 3 as vsync source
++        cam3-sync-sink          Set camera on port 3 as vsync sink
++
++        cam0                    Connect the mux to CAM0 port (default is CAM1)
++
++
++Name:   cap1106
++Info:   Enables the ability to use the cap1106 touch sensor as a keyboard
++Load:   dtoverlay=cap1106,<param>=<val>
++Params: int_pin                 GPIO pin for interrupt signal (default 23)
++
++
++Name:   chipcap2
++Info:   Enables the Chipcap 2 humidity and temperature sensor. This device
++        provides low and high humidity alarms and requires a 3V3 dedicated
++        regulator to operate.
++Load:   dtoverlay=chipcap2,<param>=<val>
++Params: ready_pin               GPIO pin for ready signal (default 4)
++
++        low_pin                 GPIO pin for low humidity signal (default 5)
++
++        high_pin                GPIO pin for high humidity signal (default 6)
++
++        reg_pin                 GPIO pin to control the dedicated regulator
++                                that powers the device (default 26)
++
++
++Name:   chipdip-dac
++Info:   Configures Chip Dip audio cards.
++Load:   dtoverlay=chipdip-dac
++Params: <None>
++
++
++Name:   cirrus-wm5102
++Info:   Configures the Cirrus Logic Audio Card
++Load:   dtoverlay=cirrus-wm5102
++Params: <None>
++
++
++Name:   cm-swap-i2c0
++Info:   Largely for Compute Modules 1&3 where the original instructions for
++        adding a camera used GPIOs 0&1 for CAM1 and 28&29 for CAM0, whilst all
++        other platforms use 28&29 (or 44&45) for CAM1.
++        The default assignment through using this overlay is for
++        i2c0 to use 28&29, and i2c10 (aka i2c_csi_dsi) to use 28&29, but the
++        overrides allow this to be changed.
++Load:   dtoverlay=cm-swap-i2c0,<param>=<val>
++Params: i2c0-gpio0              Use GPIOs 0&1 for i2c0
++        i2c0-gpio28             Use GPIOs 28&29 for i2c0 (default)
++        i2c0-gpio44             Use GPIOs 44&45 for i2c0
++        i2c10-gpio0             Use GPIOs 0&1 for i2c0 (default)
++        i2c10-gpio28            Use GPIOs 28&29 for i2c0
++        i2c10-gpio44            Use GPIOs 44&45 for i2c0
++
++
++Name:   cma
++Info:   Set custom CMA sizes, only use if you know what you are doing, might
++        clash with other overlays like vc4-fkms-v3d and vc4-kms-v3d.
++Load:   dtoverlay=cma,<param>=<val>
++Params: cma-512                 CMA is 512MB (needs 1GB)
++        cma-448                 CMA is 448MB (needs 1GB)
++        cma-384                 CMA is 384MB (needs 1GB)
++        cma-320                 CMA is 320MB (needs 1GB)
++        cma-256                 CMA is 256MB (needs 1GB)
++        cma-192                 CMA is 192MB (needs 1GB)
++        cma-128                 CMA is 128MB
++        cma-96                  CMA is 96MB
++        cma-64                  CMA is 64MB
++        cma-size                CMA size in bytes, 4MB aligned
++        cma-default             Use upstream's default value
++
++
++Name:   crystalfontz-cfa050_pi_m
++Info:   Configures the Crystalfontz CFA050-PI-M series of Raspberry Pi CM4
++        based modules using the CFA7201280A0_050Tx 7" TFT LCD displays,
++        with or without capacitive touch screen.
++        Requires use of vc4-kms-v3d.
++Load:   dtoverlay=crystalfontz-cfa050_pi_m,<param>=<val>
++Params: captouch                Enable capacitive touch display
++
++
++Name:   cutiepi-panel
++Info:   8" TFT LCD display and touch panel used by cutiepi.io
++Load:   dtoverlay=cutiepi-panel
++Params: <None>
++
++
++Name:   dacberry400
++Info:   Configures the dacberry400 add on soundcard
++Load:   dtoverlay=dacberry400
++Params: <None>
++
++
++Name:   dht11
++Info:   Overlay for the DHT11/DHT21/DHT22 humidity/temperature sensors
++        Also sometimes found with the part number(s) AM230x.
++Load:   dtoverlay=dht11,<param>=<val>
++Params: gpiopin                 GPIO connected to the sensor's DATA output.
++                                (default 4)
++
++
++Name:   dionaudio-kiwi
++Info:   Configures the Dion Audio KIWI STREAMER
++Load:   dtoverlay=dionaudio-kiwi
++Params: <None>
++
++
++Name:   dionaudio-loco
++Info:   Configures the Dion Audio LOCO DAC-AMP
++Load:   dtoverlay=dionaudio-loco
++Params: <None>
++
++
++Name:   dionaudio-loco-v2
++Info:   Configures the Dion Audio LOCO-V2 DAC-AMP
++Load:   dtoverlay=dionaudio-loco-v2,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control. Enable with
++                                "dtoverlay=hifiberry-dacplus,24db_digital_gain"
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24dB_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++
++
++Name:   disable-bt
++Info:   Disable onboard Bluetooth on Bluetooth-capable Raspberry Pis. On Pis
++        prior to Pi 5 this restores UART0/ttyAMA0 over GPIOs 14 & 15.
++Load:   dtoverlay=disable-bt
++Params: <None>
++
++
++Name:   disable-bt-pi5
++Info:   See disable-bt
++
++
++Name:   disable-emmc2
++Info:   Disable EMMC2 controller on BCM2711.
++        The allows the onboard EMMC storage on Compute Module 4 to be disabled
++        e.g. if a fault has occurred.
++Load:   dtoverlay=disable-emmc2
++Params: <None>
++
++
++Name:   disable-wifi
++Info:   Disable onboard WLAN on WiFi-capable Raspberry Pis.
++Load:   dtoverlay=disable-wifi
++Params: <None>
++
++
++Name:   disable-wifi-pi5
++Info:   See disable-wifi
++
++
++Name:   dpi18
++Info:   Overlay for a generic 18-bit DPI display
++        This uses GPIOs 0-21 (so no I2C, uart etc.), and activates the output
++        2-3 seconds after the kernel has started.
++Load:   dtoverlay=dpi18
++Params: <None>
++
++
++Name:   dpi18cpadhi
++Info:   Overlay for a generic 18-bit DPI display (in 'mode 6' connection scheme)
++        This uses GPIOs 0-9,12-17,20-25 (so no I2C, uart etc.), and activates
++        the output 3-3 seconds after the kernel has started.
++Load:   dtoverlay=dpi18cpadhi
++Params: <None>
++
++
++Name:   dpi24
++Info:   Overlay for a generic 24-bit DPI display
++        This uses GPIOs 0-27 (so no I2C, uart etc.), and activates the output
++        2-3 seconds after the kernel has started.
++Load:   dtoverlay=dpi24
++Params: <None>
++
++
++Name:   draws
++Info:   Configures the NW Digital Radio DRAWS Hat
++
++        The board includes an ADC to measure various board values and also
++        provides two analog user inputs on the expansion header.  The ADC
++        can be configured for various sample rates and gain values to adjust
++        the input range.  Tables describing the two parameters follow.
++
++        ADC Gain Values:
++            0 = +/- 6.144V
++            1 = +/- 4.096V
++            2 = +/- 2.048V
++            3 = +/- 1.024V
++            4 = +/- 0.512V
++            5 = +/- 0.256V
++            6 = +/- 0.256V
++            7 = +/- 0.256V
++
++        ADC Datarate Values:
++            0 = 128sps
++            1 = 250sps
++            2 = 490sps
++            3 = 920sps
++            4 = 1600sps (default)
++            5 = 2400sps
++            6 = 3300sps
++            7 = 3300sps
++Load:   dtoverlay=draws,<param>=<val>
++Params: draws_adc_ch4_gain      Sets the full scale resolution of the ADCs
++                                input voltage sensor (default 1)
++
++        draws_adc_ch4_datarate  Sets the datarate of the ADCs input voltage
++                                sensor
++
++        draws_adc_ch5_gain      Sets the full scale resolution of the ADCs
++                                5V rail voltage sensor (default 1)
++
++        draws_adc_ch5_datarate  Sets the datarate of the ADCs 4V rail voltage
++                                sensor
++
++        draws_adc_ch6_gain      Sets the full scale resolution of the ADCs
++                                AIN2 input (default 2)
++
++        draws_adc_ch6_datarate  Sets the datarate of the ADCs AIN2 input
++
++        draws_adc_ch7_gain      Sets the full scale resolution of the ADCs
++                                AIN3 input (default 2)
++
++        draws_adc_ch7_datarate  Sets the datarate of the ADCs AIN3 input
++
++        alsaname                Name of the ALSA audio device (default "draws")
++
++
++Name:   dwc-otg
++Info:   Selects the dwc_otg USB controller driver which has fiq support. This
++        is the default on all except the Pi Zero which defaults to dwc2.
++Load:   dtoverlay=dwc-otg
++Params: <None>
++
++
++Name:   dwc2
++Info:   Selects the dwc2 USB controller driver
++Load:   dtoverlay=dwc2,<param>=<val>
++Params: dr_mode                 Dual role mode: "host", "peripheral" or "otg"
++
++        g-rx-fifo-size          Size of rx fifo size in gadget mode
++
++        g-np-tx-fifo-size       Size of non-periodic tx fifo size in gadget
++                                mode
++
++
++[ The ds1307-rtc overlay has been deleted. See i2c-rtc. ]
++
++
++Name:   edt-ft5406
++Info:   Overlay for the EDT FT5406 touchscreen.
++        This works with the Raspberry Pi 7" touchscreen when not being polled
++        by the firmware.
++        By default the overlay uses the i2c_csi_dsi I2C interface, but this
++        can be overridden
++        You MUST use either "disable_touchscreen=1" or "ignore_lcd=1" in
++        config.txt to stop the firmware polling the touchscreen.
++Load:   dtoverlay=edt-ft5406,<param>=<val>
++Params: sizex                   Touchscreen size x (default 800)
++        sizey                   Touchscreen size y (default 480)
++        invx                    Touchscreen inverted x axis
++        invy                    Touchscreen inverted y axis
++        swapxy                  Touchscreen swapped x y axis
++        i2c0                    Choose the I2C0 bus on GPIOs 0&1
++        i2c1                    Choose the I2C1 bus on GPIOs 2&3
++        i2c3                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++        i2c4                    Choose the I2C4 bus (configure with the i2c4
++                                overlay - BCM2711 only)
++        i2c5                    Choose the I2C5 bus (configure with the i2c5
++                                overlay - BCM2711 only)
++        i2c6                    Choose the I2C6 bus (configure with the i2c6
++                                overlay - BCM2711 only)
++        addr                    Sets the address for the touch controller. Note
++                                that the device must be configured to use the
++                                specified address.
++
++
++Name:   enc28j60
++Info:   Overlay for the Microchip ENC28J60 Ethernet Controller on SPI0
++Load:   dtoverlay=enc28j60,<param>=<val>
++Params: int_pin                 GPIO used for INT (default 25)
++
++        speed                   SPI bus speed (default 12000000)
++
++
++Name:   enc28j60-spi2
++Info:   Overlay for the Microchip ENC28J60 Ethernet Controller on SPI2
++Load:   dtoverlay=enc28j60-spi2,<param>=<val>
++Params: int_pin                 GPIO used for INT (default 39)
++
++        speed                   SPI bus speed (default 12000000)
++
++
++Name:   exc3000
++Info:   Enables I2C connected EETI EXC3000 multiple touch controller using
++        GPIO 4 (pin 7 on GPIO header) for interrupt.
++Load:   dtoverlay=exc3000,<param>=<val>
++Params: interrupt               GPIO used for interrupt (default 4)
++        sizex                   Touchscreen size x (default 4096)
++        sizey                   Touchscreen size y (default 4096)
++        invx                    Touchscreen inverted x axis
++        invy                    Touchscreen inverted y axis
++        swapxy                  Touchscreen swapped x y axis
++
++
++Name:   fbtft
++Info:   Overlay for SPI-connected displays using the fbtft drivers.
++
++        This overlay seeks to replace the functionality provided by fbtft_device
++        which is now gone from the kernel.
++
++        Most displays from fbtft_device have been ported over.
++        Example:
++          dtoverlay=fbtft,spi0-0,rpi-display,reset_pin=23,dc_pin=24,led_pin=18,rotate=270
++
++        It is also possible to specify the controller (this will use the default
++        init sequence in the driver).
++        Example:
++          dtoverlay=fbtft,spi0-0,ili9341,bgr,reset_pin=23,dc_pin=24,led_pin=18,rotate=270
++
++        For devices on spi1 or spi2, the interfaces should be enabled
++        with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
++
++        The following features of fbtft_device have not been ported over:
++        - parallel bus is not supported
++        - the init property which overrides the controller initialization
++          sequence is not supported as a parameter due to memory limitations in
++          the bootloader responsible for applying the overlay.
++
++        See https://github.com/notro/fbtft/wiki/FBTFT-RPI-overlays for how to
++        create an overlay.
++
++Load:   dtoverlay=fbtft,<param>=<val>
++Params:
++        spi<n>-<m>              Configure device at spi<n>, cs<m>
++                                (boolean, required)
++        speed                   SPI bus speed in Hz (default 32000000)
++        cpha                    Shifted clock phase (CPHA) mode
++        cpol                    Inverse clock polarity (CPOL) mode
++
++        adafruit18              Adafruit 1.8
++        adafruit22              Adafruit 2.2 (old)
++        adafruit22a             Adafruit 2.2
++        adafruit28              Adafruit 2.8
++        adafruit13m             Adafruit 1.3 OLED
++        admatec_c-berry28       C-Berry28
++        dogs102                 EA DOGS102
++        er_tftm050_2            ER-TFTM070-2
++        er_tftm070_5            ER-TFTM070-5
++        ew24ha0                 EW24HA0
++        ew24ha0_9bit            EW24HA0 in 9-bit mode
++        freetronicsoled128      Freetronics OLED128
++        hy28a                   HY28A
++        hy28b                   HY28B
++        itdb28_spi              ITDB02-2.8 with SPI interface circuit
++        mi0283qt-2              Watterott MI0283QT-2
++        mi0283qt-9a             Watterott MI0283QT-9A
++        nokia3310               Nokia 3310
++        nokia3310a              Nokia 3310a
++        nokia5110               Nokia 5110
++        piscreen                PiScreen
++        pitft                   Adafruit PiTFT 2.8
++        pioled                  ILSoft OLED
++        rpi-display             Watterott rpi-display
++        sainsmart18             Sainsmart 1.8
++        sainsmart32_spi         Sainsmart 3.2 with SPI interfce circuit
++        tinylcd35               TinyLCD 3.5
++        tm022hdh26              Tianma TM022HDH26
++        tontec35_9481           Tontect 3.5 with ILI9481 controller
++        tontec35_9486           Tontect 3.5 with ILI9486 controller
++        waveshare32b            Waveshare 3.2
++        waveshare22             Waveshare 2.2
++
++        bd663474                BD663474 display controller
++        hx8340bn                HX8340BN display controller
++        hx8347d                 HX8347D display controller
++        hx8353d                 HX8353D display controller
++        hx8357d                 HX8357D display controller
++        ili9163                 ILI9163 display controller
++        ili9320                 ILI9320 display controller
++        ili9325                 ILI9325 display controller
++        ili9340                 ILI9340 display controller
++        ili9341                 ILI9341 display controller
++        ili9481                 ILI9481 display controller
++        ili9486                 ILI9486 display controller
++        pcd8544                 PCD8544 display controller
++        ra8875                  RA8875 display controller
++        s6d02a1                 S6D02A1 display controller
++        s6d1121                 S6D1121 display controller
++        seps525                 SEPS525 display controller
++        sh1106                  SH1106 display controller
++        ssd1289                 SSD1289 display controller
++        ssd1305                 SSD1305 display controller
++        ssd1306                 SSD1306 display controller
++        ssd1325                 SSD1325 display controller
++        ssd1331                 SSD1331 display controller
++        ssd1351                 SSD1351 display controller
++        st7735r                 ST7735R display controller
++        st7789v                 ST7789V display controller
++        tls8204                 TLS8204 display controller
++        uc1611                  UC1611 display controller
++        uc1701                  UC1701 display controller
++        upd161704               UPD161704 display controller
++
++        width                   Display width in pixels
++        height                  Display height in pixels
++        regwidth                Display controller register width (default is
++                                driver specific)
++        buswidth                Display bus interface width (default 8)
++        debug                   Debug output level {0-7}
++        rotate                  Display rotation {0, 90, 180, 270} (counter
++                                clockwise). Not supported by all drivers.
++        bgr                     Enable BGR mode (default off). Use if Red and
++                                Blue are swapped. Not supported by all drivers.
++        fps                     Frames per second (default 30). In effect this
++                                states how long the driver will wait after video
++                                memory has been changed until display update
++                                transfer is started.
++        txbuflen                Length of the FBTFT transmit buffer
++                                (default 4096)
++        startbyte               Sets the Start byte used by fb_ili9320,
++                                fb_ili9325 and fb_hx8347d. Common value is 0x70.
++        gamma                   String representation of Gamma Curve(s). Driver
++                                specific. Not supported by all drivers.
++        reset_pin               GPIO pin for RESET
++        dc_pin                  GPIO pin for D/C
++        led_pin                 GPIO pin for LED backlight
++
++
++Name:   fe-pi-audio
++Info:   Configures the Fe-Pi Audio Sound Card
++Load:   dtoverlay=fe-pi-audio
++Params: <None>
++
++
++Name:   fsm-demo
++Info:   A demonstration of the gpio-fsm driver. The GPIOs are chosen to work
++        nicely with a "traffic-light" display of red, amber and green LEDs on
++        GPIOs 7, 8 and 25 respectively.
++Load:   dtoverlay=fsm-demo,<param>=<val>
++Params: fsm_debug               Enable debug logging (default off)
++
++
++Name:   gc9a01
++Info:   Enables GalaxyCore's GC9A01 single chip driver based displays on
++        SPI0 as fb1, using GPIOs DC=25, RST=27 and BL=18 (physical
++        GPIO header pins 22, 13 and 12 respectively) in addition to the
++        SPI0 pins DIN=10, CLK=11 and CS=8 (physical GPIO header pins 19,
++        23 and 24 respectively).
++Load:   dtoverlay=gc9a01,<param>=<val>
++Params: speed                   Display SPI bus speed
++
++        rotate                  Display rotation {0,90,180,270}
++
++        width                   Width of the display
++
++        height                  Height of the display
++
++        fps                     Delay between frame updates
++
++        debug                   Debug output level {0-7}
++
++
++Name:   ghost-amp
++Info:   An overlay for the Ghost amplifier.
++Load:   dtoverlay=ghost-amp,<param>=<val>
++Params: fsm_debug               Enable debug logging of the GPIO FSM (default
++                                off)
++
++
++Name:   goodix
++Info:   Enables I2C connected Goodix gt9271 multiple touch controller using
++        GPIOs 4 and 17 (pins 7 and 11 on GPIO header) for interrupt and reset.
++Load:   dtoverlay=goodix,<param>=<val>
++Params: interrupt               GPIO used for interrupt (default 4)
++        reset                   GPIO used for reset (default 17)
++
++
++Name:   googlevoicehat-soundcard
++Info:   Configures the Google voiceHAT soundcard
++Load:   dtoverlay=googlevoicehat-soundcard
++Params: <None>
++
++
++Name:   gpio-charger
++Info:   This is a generic overlay for detecting charger with GPIO.
++Load:   dtoverlay=gpio-charger,<param>=<val>
++Params: gpio                    GPIO pin to trigger on (default 4)
++        active_low              When this is 1 (active low), a falling
++                                edge generates a charging event and a
++                                rising edge generates a discharging event.
++                                When this is 0 (active high), this is
++                                reversed. The default is 0 (active high)
++        gpio_pull               Desired pull-up/down state (off, down, up)
++                                Default is "down".
++        type                    Set a charger type for the pin. (Default: mains)
++
++
++Name:   gpio-fan
++Info:   Configure a GPIO pin to control a cooling fan.
++Load:   dtoverlay=gpio-fan,<param>=<val>
++Params: gpiopin                 GPIO used to control the fan (default 12)
++        temp                    Temperature at which the fan switches on, in
++                                millicelcius (default 55000)
++        hyst                    Temperature delta (in millicelcius) below
++                                temp at which the fan will drop to minrpm
++                                (default 10000)
++
++
++Name:   gpio-hog
++Info:   Activate a "hog" for a GPIO - request that the kernel configures it as
++        an output, driven low or high as indicated by the presence or absence
++        of the active_low parameter. Note that a hogged GPIO is not available
++        to other drivers or for gpioset/gpioget.
++Load:   dtoverlay=gpio-hog,<param>=<val>
++Params: gpio                    GPIO pin to hog (default 26)
++        active_low              If set, the hog drives the GPIO low (defaults
++                                to off - the GPIO is driven high)
++
++
++Name:   gpio-ir
++Info:   Use GPIO pin as rc-core style infrared receiver input. The rc-core-
++        based gpio_ir_recv driver maps received keys directly to a
++        /dev/input/event* device, all decoding is done by the kernel - LIRC is
++        not required! The key mapping and other decoding parameters can be
++        configured by "ir-keytable" tool.
++Load:   dtoverlay=gpio-ir,<param>=<val>
++Params: gpio_pin                Input pin number. Default is 18.
++
++        gpio_pull               Desired pull-up/down state (off, down, up)
++                                Default is "up".
++
++        invert                  "1" = invert the input (active-low signalling).
++                                "0" = non-inverted input (active-high
++                                signalling). Default is "1".
++
++        rc-map-name             Default rc keymap (can also be changed by
++                                ir-keytable), defaults to "rc-rc6-mce"
++
++
++Name:   gpio-ir-tx
++Info:   Use GPIO pin as bit-banged infrared transmitter output.
++        This is an alternative to "pwm-ir-tx". gpio-ir-tx doesn't require
++        a PWM so it can be used together with onboard analog audio.
++Load:   dtoverlay=gpio-ir-tx,<param>=<val>
++Params: gpio_pin                Output GPIO (default 18)
++
++        invert                  "1" = invert the output (make it active-low).
++                                Default is "0" (active-high).
++
++
++Name:   gpio-key
++Info:   This is a generic overlay for activating GPIO keypresses using
++        the gpio-keys library and this dtoverlay. Multiple keys can be
++        set up using multiple calls to the overlay for configuring
++        additional buttons or joysticks. You can see available keycodes
++        at https://github.com/torvalds/linux/blob/v4.12/include/uapi/
++        linux/input-event-codes.h#L64
++Load:   dtoverlay=gpio-key,<param>=<val>
++Params: gpio                    GPIO pin to trigger on (default 3)
++        active_low              When this is 1 (active low), a falling
++                                edge generates a key down event and a
++                                rising edge generates a key up event.
++                                When this is 0 (active high), this is
++                                reversed. The default is 1 (active low)
++        gpio_pull               Desired pull-up/down state (off, down, up)
++                                Default is "up". Note that the default pin
++                                (GPIO3) has an external pullup
++        label                   Set a label for the key
++        keycode                 Set the key code for the button
++
++
++
++Name:   gpio-led
++Info:   This is a generic overlay for activating LEDs (or any other component)
++        by a GPIO pin. Multiple LEDs can be set up using multiple calls to the
++        overlay. While there are many existing methods to activate LEDs on the
++        RPi, this method offers some advantages:
++        1) Does not require any userspace programs.
++        2) LEDs can be connected to the kernel's led-trigger framework,
++           and drive the LED based on triggers such as cpu load, heartbeat,
++           kernel panic, key input, timers and others.
++        3) LED can be tied to the input state of another GPIO pin.
++        4) The LED is setup early during the kernel boot process (useful
++           for cpu/heartbeat/panic triggers).
++
++        Typical electrical connection is:
++           RPI-GPIO.19  ->  LED  -> 300ohm resister  -> RPI-GND
++        The GPIO pin number can be changed with the 'gpio=' parameter.
++
++        To control an LED from userspace, write a 0 or 1 value:
++           echo 1 > /sys/class/leds/myled1/brightness
++        The 'myled1' name can be changed with the 'label=' parameter.
++
++        To connect the LED to a kernel trigger from userspace:
++           echo cpu > /sys/class/leds/myled1/trigger
++           echo heartbeat > /sys/class/leds/myled1/trigger
++           echo none > /sys/class/leds/myled1/trigger
++        To connect the LED to GPIO.26 pin (physical pin 37):
++           echo gpio > /sys/class/leds/myled1/trigger
++           echo 26 > /sys/class/leds/myled1/gpio
++        Available triggers:
++           cat /sys/class/leds/myled1/trigger
++
++        More information about the Linux kernel LED/Trigger system:
++           https://www.kernel.org/doc/Documentation/leds/leds-class.rst
++           https://www.kernel.org/doc/Documentation/leds/ledtrig-oneshot.rst
++Load:   dtoverlay=gpio-led,<param>=<val>
++Params: gpio                    GPIO pin connected to the LED (default 19)
++        label                   The label for this LED. It will appear under
++                                /sys/class/leds/<label> . Default 'myled1'.
++        trigger                 Set the led-trigger to connect to this LED.
++                                default 'none' (LED is user-controlled).
++                                Some possible triggers:
++                                 cpu - CPU load (all CPUs)
++                                 cpu0 - CPU load of first CPU.
++                                 mmc - disk activity (all disks)
++                                 panic - turn on on kernel panic
++                                 heartbeat - indicate system health
++                                 gpio - connect to a GPIO input pin (note:
++                                        currently the GPIO PIN can not be set
++                                        using overlay parameters, must be
++                                        done in userspace, see examples above.
++        active_low              Set to 1 to turn invert the LED control
++                                (writing 0 to /sys/class/leds/XXX/brightness
++                                will turn on the GPIO/LED). Default '0'.
++
++
++Name:   gpio-no-bank0-irq
++Info:   Use this overlay to disable GPIO interrupts for GPIOs in bank 0 (0-27),
++        which can be useful for UIO drivers.
++        N.B. Using this overlay will trigger a kernel WARN during booting, but
++        this can safely be ignored - the system should work as expected.
++Load:   dtoverlay=gpio-no-bank0-irq
++Params: <None>
++
++
++Name:   gpio-no-irq
++Info:   Use this overlay to disable all GPIO interrupts, which can be useful
++        for user-space GPIO edge detection systems.
++Load:   dtoverlay=gpio-no-irq
++Params: <None>
++
++
++Name:   gpio-poweroff
++Info:   Drives a GPIO high or low on poweroff (including halt). Using this
++        overlay interferes with the normal power-down sequence, preventing the
++        kernel from resetting the SoC (a necessary step in a normal power-off
++        or reboot). This also disables the ability to trigger a boot by driving
++        GPIO3 low.
++
++        The GPIO starts in an inactive state. At poweroff time it is driven
++        active for 100ms, then inactive for 100ms, then active again. It is
++        safe to remove the power at any point after the initial activation of
++        the GPIO.
++
++        Users of this overlay are required to provide an external mechanism to
++        switch off the power supply when signalled - failure to do so results
++        in a kernel BUG, increased power consumption and undefined behaviour.
++Load:   dtoverlay=gpio-poweroff,<param>=<val>
++Params: gpiopin                 GPIO for signalling (default 26)
++
++        active_low              Set if the power control device requires a
++                                high->low transition to trigger a power-down.
++                                Note that this will require the support of a
++                                custom dt-blob.bin to prevent a power-down
++                                during the boot process, and that a reboot
++                                will also cause the pin to go low.
++        input                   Set if the gpio pin should be configured as
++                                an input.
++        export                  Set to export the configured pin to sysfs
++        active_delay_ms         Initial GPIO active period (default 100)
++        inactive_delay_ms       Subsequent GPIO inactive period (default 100)
++        timeout_ms              Specify (in ms) how long the kernel waits for
++                                power-down before issuing a WARN (default 3000).
++
++
++Name:   gpio-shutdown
++Info:   Initiates a shutdown when GPIO pin changes. The given GPIO pin
++        is configured as an input key that generates KEY_POWER events.
++
++        This event is handled by systemd-logind by initiating a
++        shutdown. Systemd versions older than 225 need an udev rule
++        enable listening to the input device:
++
++                ACTION!="REMOVE", SUBSYSTEM=="input", KERNEL=="event*", \
++                        SUBSYSTEMS=="platform", DRIVERS=="gpio-keys", \
++                        ATTRS{keys}=="116", TAG+="power-switch"
++
++        Alternatively this event can be handled also on systems without
++        systemd, just by traditional SysV init daemon. KEY_POWER event
++        (keycode 116) needs to be mapped to KeyboardSignal on console
++        and then kb::kbrequest inittab action which is triggered by
++        KeyboardSignal from console can be configured to issue system
++        shutdown. Steps for this configuration are:
++
++            Add following lines to the /etc/console-setup/remap.inc file:
++
++                # Key Power as special keypress
++                keycode 116 = KeyboardSignal
++
++            Then add following lines to /etc/inittab file:
++
++                # Action on special keypress (Key Power)
++                kb::kbrequest:/sbin/shutdown -t1 -a -h -P now
++
++            And finally reload configuration by calling following commands:
++
++                # dpkg-reconfigure console-setup
++                # service console-setup reload
++                # init q
++
++        This overlay only handles shutdown. After shutdown, the system
++        can be powered up again by driving GPIO3 low. The default
++        configuration uses GPIO3 with a pullup, so if you connect a
++        button between GPIO3 and GND (pin 5 and 6 on the 40-pin header),
++        you get a shutdown and power-up button. Please note that
++        Raspberry Pi 1 Model B rev 1 uses GPIO1 instead of GPIO3.
++Load:   dtoverlay=gpio-shutdown,<param>=<val>
++Params: gpio_pin                GPIO pin to trigger on (default 3)
++                                For Raspberry Pi 1 Model B rev 1 set this
++                                explicitly to value 1, e.g.:
++
++                                    dtoverlay=gpio-shutdown,gpio_pin=1
++
++        active_low              When this is 1 (active low), a falling
++                                edge generates a key down event and a
++                                rising edge generates a key up event.
++                                When this is 0 (active high), this is
++                                reversed. The default is 1 (active low).
++
++        gpio_pull               Desired pull-up/down state (off, down, up)
++                                Default is "up".
++
++                                Note that the default pin (GPIO3) has an
++                                external pullup. Same applies for GPIO1
++                                on Raspberry Pi 1 Model B rev 1.
++
++        debounce                Specify the debounce interval in milliseconds
++                                (default 100)
++
++
++Name:   hd44780-i2c-lcd
++Info:   Configures an HD44780 compatible LCD display connected via a PCF8574 as
++        is often found as a backpack interface for these displays.
++Load:   dtoverlay=hd44780-i2c-lcd,<param>=<val>
++Params: addr                    I2C address of PCF8574
++        pin_d4                  GPIO pin for data pin D4 (default 4)
++
++        pin_d5                  GPIO pin for data pin D5 (default 5)
++
++        pin_d6                  GPIO pin for data pin D6 (default 6)
++
++        pin_d7                  GPIO pin for data pin D7 (default 7)
++
++        pin_en                  GPIO pin for "Enable" (default 2)
++
++        pin_rs                  GPIO pin for "Register Select" (default 0)
++
++        pin_rw                  GPIO pin for R/W select (default 1)
++
++        pin_bl                  GPIO pin for enabling/disabling the display
++                                backlight. (default 3)
++
++        display_height          Height of the display in characters (default 2)
++
++        display_width           Width of the display in characters (default 16)
++
++
++Name:   hd44780-lcd
++Info:   Configures an HD44780 compatible LCD display. Uses 4 gpio pins for
++        data, 2 gpio pins for enable and register select and 1 optional pin
++        for enabling/disabling the backlight display.
++Load:   dtoverlay=hd44780-lcd,<param>=<val>
++Params: pin_d4                  GPIO pin for data pin D4 (default 6)
++
++        pin_d5                  GPIO pin for data pin D5 (default 13)
++
++        pin_d6                  GPIO pin for data pin D6 (default 19)
++
++        pin_d7                  GPIO pin for data pin D7 (default 26)
++
++        pin_en                  GPIO pin for "Enable" (default 21)
++
++        pin_rs                  GPIO pin for "Register Select" (default 20)
++
++        pin_bl                  Optional pin for enabling/disabling the
++                                display backlight. (default disabled)
++
++        display_height          Height of the display in characters (default 2)
++
++        display_width           Width of the display in characters (default 16)
++
++
++Name:   hdmi-backlight-hwhack-gpio
++Info:   Devicetree overlay for GPIO based backlight on/off capability.
++        Use this if you have one of those HDMI displays whose backlight cannot
++        be controlled via DPMS over HDMI and plan to do a little soldering to
++        use an RPi gpio pin for on/off switching. See:
++        https://www.waveshare.com/wiki/7inch_HDMI_LCD_(C)#Backlight_Control
++Load:   dtoverlay=hdmi-backlight-hwhack-gpio,<param>=<val>
++Params: gpio_pin                GPIO pin used (default 17)
++        active_low              Set this to 1 if the display backlight is
++                                switched on when the wire goes low.
++                                Leave the default (value 0) if the backlight
++                                expects a high to switch it on.
++
++
++Name:   hifiberry-adc
++Info:   Configures the HifiBerry ADC audio card
++Load:   dtoverlay=hifiberry-adc,<param>=<val>
++Params: leds_off                If set to 'true' the onboard indicator LED
++                                is switched off at all times.
++
++
++Name:   hifiberry-adc8x
++Info:   Configures the HifiBerry ADC8X audio card (only on Pi5)
++Load:   dtoverlay=hifiberry-adc8x
++Params: <None>
++
++
++Name:   hifiberry-amp
++Info:   Configures the HifiBerry Amp and Amp+ audio cards
++Load:   dtoverlay=hifiberry-amp
++Params: <None>
++
++
++Name:   hifiberry-amp100
++Info:   Configures the HifiBerry AMP100 audio card
++Load:   dtoverlay=hifiberry-amp100,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control. Enable with
++                                "dtoverlay=hifiberry-amp100,24db_digital_gain"
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24dB_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++        slave                   Force AMP100 into slave mode, using Pi as
++                                master for bit clock and frame clock.
++        leds_off                If set to 'true' the onboard indicator LEDs
++                                are switched off at all times.
++        auto_mute               If set to 'true' the amplifier is automatically
++                                muted when the DAC is not playing.
++        mute_ext_ctl            The amplifier's HW mute control is enabled
++                                in ALSA mixer and set to <val>.
++                                Will be overwritten by ALSA user settings.
++
++
++Name:   hifiberry-amp3
++Info:   Configures the HifiBerry Amp3 audio card
++Load:   dtoverlay=hifiberry-amp3
++Params: <None>
++
++
++Name:   hifiberry-amp4pro
++Info:   Configures the HifiBerry AMP4 Pro audio card
++Load:   dtoverlay=hifiberry-amp4pro,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the TAS5756
++                                Digital volume control. Enable with
++                                "dtoverlay=hifiberry-amp4pro,24db_digital_gain"
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24dB_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++        slave                   Force the amp into slave mode, using Pi as
++                                master for bit clock and frame clock.
++        leds_off                If set to 'true' the onboard indicator LEDs
++                                are switched off at all times.
++        auto_mute               If set to 'true' the amplifier is automatically
++                                muted when it is not playing.
++        mute_ext_ctl            The amplifier's HW mute control is enabled
++                                in ALSA mixer and set to <val>.
++                                Will be overwritten by ALSA user settings.
++
++
++Name:   hifiberry-dac
++Info:   Configures the HifiBerry DAC audio cards
++Load:   dtoverlay=hifiberry-dac
++Params: <None>
++
++
++Name:   hifiberry-dac8x
++Info:   Configures the HifiBerry DAC8X audio cards (only on Pi5)
++Load:   dtoverlay=hifiberry-dac8x
++Params: <None>
++
++
++Name:   hifiberry-dacplus
++Info:   Configures the HifiBerry DAC+ audio card
++Load:   dtoverlay=hifiberry-dacplus,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control. Enable with
++                                "dtoverlay=hifiberry-dacplus,24db_digital_gain"
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24dB_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++        slave                   Force DAC+ into slave mode, using Pi as
++                                master for bit clock and frame clock.
++        leds_off                If set to 'true' the onboard indicator LEDs
++                                are switched off at all times.
++
++
++Name:   hifiberry-dacplus-pro
++Info:   Configures the HifiBerry DAC+ PRO audio card (onboard clocks)
++Load:   dtoverlay=hifiberry-dacplus-pro,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control. Enable with
++                                "dtoverlay=hifiberry-dacplus,24db_digital_gain"
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24dB_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++        leds_off                If set to 'true' the onboard indicator LEDs
++                                are switched off at all times.
++
++
++Name:   hifiberry-dacplus-std
++Info:   Configures the HifiBerry DAC+ standard audio card (no onboard clocks)
++Load:   dtoverlay=hifiberry-dacplus-std,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control. Enable with
++                                "dtoverlay=hifiberry-dacplus,24db_digital_gain"
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24dB_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++        leds_off                If set to 'true' the onboard indicator LEDs
++                                are switched off at all times.
++
++
++Name:   hifiberry-dacplusadc
++Info:   Configures the HifiBerry DAC+ADC audio card
++Load:   dtoverlay=hifiberry-dacplusadc,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control. Enable with
++                                "dtoverlay=hifiberry-dacplus,24db_digital_gain"
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24dB_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++        leds_off                If set to 'true' the onboard indicator LEDs
++                                are switched off at all times.
++
++
++Name:   hifiberry-dacplusadcpro
++Info:   Configures the HifiBerry DAC+ADC PRO audio card
++Load:   dtoverlay=hifiberry-dacplusadcpro,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control. Enable with
++                                "dtoverlay=hifiberry-dacplusadcpro,24db_digital_gain"
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24dB_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++        slave                   Force DAC+ADC Pro into slave mode, using Pi as
++                                master for bit clock and frame clock.
++        leds_off                If set to 'true' the onboard indicator LEDs
++                                are switched off at all times.
++
++
++Name:   hifiberry-dacplusdsp
++Info:   Configures the HifiBerry DAC+DSP audio card
++Load:   dtoverlay=hifiberry-dacplusdsp
++Params: <None>
++
++
++Name:   hifiberry-dacplushd
++Info:   Configures the HifiBerry DAC+ HD audio card
++Load:   dtoverlay=hifiberry-dacplushd
++Params: <None>
++
++
++Name:   hifiberry-digi
++Info:   Configures the HifiBerry Digi and Digi+ audio card
++Load:   dtoverlay=hifiberry-digi
++Params: <None>
++
++
++Name:   hifiberry-digi-pro
++Info:   Configures the HifiBerry Digi+ Pro and Digi2 Pro audio card
++Load:   dtoverlay=hifiberry-digi-pro
++Params: <None>
++
++
++Name:   highperi
++Info:   Enables "High Peripheral" mode
++Load:   dtoverlay=highperi
++Params: <None>
++
++
++Name:   hy28a
++Info:   HY28A - 2.8" TFT LCD Display Module by HAOYU Electronics
++        Default values match Texy's display shield
++Load:   dtoverlay=hy28a,<param>=<val>
++Params: speed                   Display SPI bus speed
++
++        rotate                  Display rotation {0,90,180,270}
++
++        fps                     Delay between frame updates
++
++        debug                   Debug output level {0-7}
++
++        xohms                   Touchpanel sensitivity (X-plate resistance)
++
++        resetgpio               GPIO used to reset controller
++
++        ledgpio                 GPIO used to control backlight
++
++
++Name:   hy28b
++Info:   HY28B - 2.8" TFT LCD Display Module by HAOYU Electronics
++        Default values match Texy's display shield
++Load:   dtoverlay=hy28b,<param>=<val>
++Params: speed                   Display SPI bus speed
++
++        rotate                  Display rotation {0,90,180,270}
++
++        fps                     Delay between frame updates
++
++        debug                   Debug output level {0-7}
++
++        xohms                   Touchpanel sensitivity (X-plate resistance)
++
++        resetgpio               GPIO used to reset controller
++
++        ledgpio                 GPIO used to control backlight
++
++
++Name:   hy28b-2017
++Info:   HY28B 2017 version - 2.8" TFT LCD Display Module by HAOYU Electronics
++        Default values match Texy's display shield
++Load:   dtoverlay=hy28b-2017,<param>=<val>
++Params: speed                   Display SPI bus speed
++
++        rotate                  Display rotation {0,90,180,270}
++
++        fps                     Delay between frame updates
++
++        debug                   Debug output level {0-7}
++
++        xohms                   Touchpanel sensitivity (X-plate resistance)
++
++        resetgpio               GPIO used to reset controller
++
++        ledgpio                 GPIO used to control backlight
++
++
++Name:   i-sabre-q2m
++Info:   Configures the Audiophonics I-SABRE Q2M DAC
++Load:   dtoverlay=i-sabre-q2m
++Params: <None>
++
++
++Name:   i2c-bcm2708
++Info:   Fall back to the i2c_bcm2708 driver for the i2c_arm bus.
++Load:   dtoverlay=i2c-bcm2708
++Params: <None>
++
++
++Name:   i2c-fan
++Info:   Adds support for a number of I2C fan controllers
++Load:   dtoverlay=i2c-fan,<param>=<val>
++Params: addr                    Sets the address for the fan controller. Note
++                                that the device must be configured to use the
++                                specified address.
++
++        i2c0                    Choose the I2C0 bus on GPIOs 0&1
++
++        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++
++        i2c3                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++
++        i2c4                    Choose the I2C4 bus (configure with the i2c4
++                                overlay - BCM2711 only)
++
++        i2c5                    Choose the I2C5 bus (configure with the i2c5
++                                overlay - BCM2711 only)
++
++        i2c6                    Choose the I2C6 bus (configure with the i2c6
++                                overlay - BCM2711 only)
++
++        minpwm                  PWM setting for the fan when the SoC is below
++                                mintemp (range 0-255. default 0)
++        maxpwm                  PWM setting for the fan when the SoC is above
++                                maxtemp (range 0-255. default 255)
++        midtemp                 Temperature (in millicelcius) at which the fan
++                                begins to speed up (default 50000)
++
++        midtemp_hyst            Temperature delta (in millicelcius) below
++                                mintemp at which the fan will drop to minrpm
++                                (default 2000)
++
++        maxtemp                 Temperature (in millicelcius) at which the fan
++                                will be held at maxrpm (default 70000)
++
++        maxtemp_hyst            Temperature delta (in millicelcius) below
++                                maxtemp at which the fan begins to slow down
++                                (default 2000)
++
++        emc2301                 Select the Microchip EMC230x controller family
++                                - EMC2301, EMC2302, EMC2303, EMC2305.
++
++
++Name:   i2c-gpio
++Info:   Adds support for software i2c controller on gpio pins
++Load:   dtoverlay=i2c-gpio,<param>=<val>
++Params: i2c_gpio_sda            GPIO used for I2C data (default "23")
++
++        i2c_gpio_scl            GPIO used for I2C clock (default "24")
++
++        i2c_gpio_delay_us       Clock delay in microseconds
++                                (default "2" = ~100kHz)
++
++        bus                     Set to a unique, non-zero value if wanting
++                                multiple i2c-gpio busses. If set, will be used
++                                as the preferred bus number (/dev/i2c-<n>). If
++                                not set, the default value is 0, but the bus
++                                number will be dynamically assigned - probably
++                                3.
++
++
++Name:   i2c-mux
++Info:   Adds support for a number of I2C bus multiplexers on i2c_arm
++Load:   dtoverlay=i2c-mux,<param>=<val>
++Params: pca9542                 Select the NXP PCA9542 device
++
++        pca9545                 Select the NXP PCA9545 device
++
++        pca9548                 Select the NXP PCA9548 device
++
++        addr                    Change I2C address of the device (default 0x70)
++
++        base                    Set an explicit base value for the channel bus
++                                numbers
++
++        i2c0                    Choose the I2C0 bus on GPIOs 0&1
++
++        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++
++        i2c3                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++
++        i2c4                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++
++        i2c5                    Choose the I2C5 bus (configure with the i2c4
++                                overlay - BCM2711 only)
++
++        i2c6                    Choose the I2C6 bus (configure with the i2c6
++                                overlay - BCM2711 only)
++
++        disconnect_on_idle      Force the mux to disconnect all child buses
++                                after every transaction.
++
++
++[ The i2c-mux-pca9548a overlay has been deleted. See i2c-mux. ]
++
++
++Name:   i2c-pwm-pca9685a
++Info:   Adds support for an NXP PCA9685A I2C PWM controller on i2c_arm
++Load:   dtoverlay=i2c-pwm-pca9685a,<param>=<val>
++Params: addr                    I2C address of PCA9685A (default 0x40)
++        i2c0                    Choose the I2C0 bus on GPIOs 0&1
++        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++        i2c3                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++        i2c4                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++        i2c5                    Choose the I2C5 bus (configure with the i2c4
++                                overlay - BCM2711 only)
++        i2c6                    Choose the I2C6 bus (configure with the i2c6
++                                overlay - BCM2711 only)
++
++
++Name:   i2c-rtc
++Info:   Adds support for a number of I2C Real Time Clock devices
++Load:   dtoverlay=i2c-rtc,<param>=<val>
++Params: abx80x                  Select one of the ABx80x family:
++                                  AB0801, AB0803, AB0804, AB0805,
++                                  AB1801, AB1803, AB1804, AB1805
++
++        bq32000                 Select the TI BQ32000 device
++
++        ds1307                  Select the DS1307 device
++
++        ds1339                  Select the DS1339 device
++
++        ds1340                  Select the DS1340 device
++
++        ds3231                  Select the DS3231 device
++
++        m41t62                  Select the M41T62 device
++
++        mcp7940x                Select the MCP7940x device
++
++        mcp7941x                Select the MCP7941x device
++
++        pcf2127                 Select the PCF2127 device
++
++        pcf2129                 Select the PCF2129 device
++
++        pcf2131                 Select the PCF2131 device
++
++        pcf85063                Select the PCF85063 device
++
++        pcf85063a               Select the PCF85063A device
++
++        pcf8523                 Select the PCF8523 device
++
++        pcf85363                Select the PCF85363 device
++
++        pcf8563                 Select the PCF8563 device
++
++        rv1805                  Select the Micro Crystal RV1805 device
++
++        rv3028                  Select the Micro Crystal RV3028 device
++
++        rv3032                  Select the Micro Crystal RV3032 device
++
++        rv8803                  Select the Micro Crystal RV8803 device
++
++        sd3078                  Select the ZXW Shenzhen whwave SD3078 device
++
++        s35390a                 Select the ABLIC S35390A device
++
++        i2c0                    Choose the I2C0 bus on GPIOs 0&1
++
++        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++
++        i2c3                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++
++        i2c4                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++
++        i2c5                    Choose the I2C5 bus (configure with the i2c4
++                                overlay - BCM2711 only)
++
++        i2c6                    Choose the I2C6 bus (configure with the i2c6
++                                overlay - BCM2711 only)
++
++        addr                    Sets the address for the RTC. Note that the
++                                device must be configured to use the specified
++                                address.
++
++        trickle-diode-disable   Do not use the internal trickle charger diode
++                                (BQ32000 only)
++
++        trickle-diode-type      Diode type for trickle charge - "standard" or
++                                "schottky" (ABx80x and RV1805 only)
++
++        trickle-resistor-ohms   Resistor value for trickle charge (DS1339,
++                                ABx80x, BQ32000, RV1805, RV3028, RV3032)
++
++        trickle-voltage-mv      Charge pump voltage for trickle charge (RV3032)
++
++        wakeup-source           Specify that the RTC can be used as a wakeup
++                                source
++
++        backup-switchover-mode  Backup power supply switch mode. Must be 0 for
++                                "Switchover disabled", 1 for "Direct Switching"
++                                (if Vdd < VBackup), 2 for "Standby
++                                Mode" (if Vdd < Vbackup,
++                                does not draw current) or 3 for
++                                "Level Switching" (if Vdd < Vbackup
++                                and Vdd < Vddsw and Vbackup > Vddsw)
++                                (RV3028, RV3032)
++
++
++Name:   i2c-rtc-gpio
++Info:   Adds support for a number of I2C Real Time Clock devices
++        using the software i2c controller
++Load:   dtoverlay=i2c-rtc-gpio,<param>=<val>
++Params: abx80x                  Select one of the ABx80x family:
++                                  AB0801, AB0803, AB0804, AB0805,
++                                  AB1801, AB1803, AB1804, AB1805
++
++        bq32000                 Select the TI BQ32000 device
++
++        ds1307                  Select the DS1307 device
++
++        ds1339                  Select the DS1339 device
++
++        ds1340                  Select the DS1340 device
++
++        ds3231                  Select the DS3231 device
++
++        m41t62                  Select the M41T62 device
++
++        mcp7940x                Select the MCP7940x device
++
++        mcp7941x                Select the MCP7941x device
++
++        pcf2127                 Select the PCF2127 device
++
++        pcf2129                 Select the PCF2129 device
++
++        pcf2131                 Select the PCF2131 device
++
++        pcf85063                Select the PCF85063 device
++
++        pcf85063a               Select the PCF85063A device
++
++        pcf8523                 Select the PCF8523 device
++
++        pcf85363                Select the PCF85363 device
++
++        pcf8563                 Select the PCF8563 device
++
++        rv1805                  Select the Micro Crystal RV1805 device
++
++        rv3028                  Select the Micro Crystal RV3028 device
++
++        rv3032                  Select the Micro Crystal RV3032 device
++
++        rv8803                  Select the Micro Crystal RV8803 device
++
++        sd3078                  Select the ZXW Shenzhen whwave SD3078 device
++
++        s35390a                 Select the ABLIC S35390A device
++
++        addr                    Sets the address for the RTC. Note that the
++                                device must be configured to use the specified
++                                address.
++
++        trickle-diode-disable   Do not use the internal trickle charger diode
++                                (BQ32000 only)
++
++        trickle-diode-type      Diode type for trickle charge - "standard" or
++                                "schottky" (ABx80x and RV1805 only)
++
++        trickle-resistor-ohms   Resistor value for trickle charge (DS1339,
++                                ABx80x, BQ32000, RV1805, RV3028, RV3032)
++
++        trickle-voltage-mv      Charge pump voltage for trickle charge (RV3032)
++
++        wakeup-source           Specify that the RTC can be used as a wakeup
++                                source
++
++        backup-switchover-mode  Backup power supply switch mode. Must be 0 for
++                                "Switchover disabled", 1 for "Direct Switching"
++                                (if Vdd < VBackup), 2 for "Standby
++                                Mode" (if Vdd < Vbackup,
++                                does not draw current) or 3 for
++                                "Level Switching" (if Vdd < Vbackup
++                                and Vdd < Vddsw and Vbackup > Vddsw)
++                                (RV3028, RV3032)
++
++        i2c_gpio_sda            GPIO used for I2C data (default "23")
++
++        i2c_gpio_scl            GPIO used for I2C clock (default "24")
++
++        i2c_gpio_delay_us       Clock delay in microseconds
++                                (default "2" = ~100kHz)
++
++
++Name:   i2c-sensor
++Info:   Adds support for a number of I2C barometric pressure, temperature,
++        light level and chemical sensors on i2c_arm
++Load:   dtoverlay=i2c-sensor,<param>=<val>
++Params: addr                    Set the address for the ADT7410, AS73211,
++                                AS7331, BH1750, BME280, BME680, BMP280, BMP380,
++                                CCS811, DS1621, HDC100X, HDC3020, JC42, LM75,
++                                MCP980x, MPU6050, MPU9250, MS5637, MS5803,
++                                MS5805, MS5837, MS8607, SHT3x or TMP102
++
++        adt7410                 Select the Analog Devices ADT7410 and ADT7420
++                                temperature sensors
++                                Valid address 0x48-0x4b, default 0x48
++
++        aht10                   Select the Aosong AHT10 temperature and humidity
++                                sensor
++
++        as73211                 Select the AMS AS73211 XYZ true color sensor
++                                Valid addresses 0x74-0x77, default 0x74
++
++        as7331                  Select the AMS AS7331 spectral UV sensor
++                                Valid addresses 0x74-0x77, default 0x74
++
++        bh1750                  Select the Rohm BH1750 ambient light sensor
++                                Valid addresses 0x23 or 0x5c, default 0x23
++
++        bme280                  Select the Bosch Sensortronic BME280
++                                Valid addresses 0x76-0x77, default 0x76
++
++        bme680                  Select the Bosch Sensortronic BME680
++                                Valid addresses 0x76-0x77, default 0x76
++
++        bmp085                  Select the Bosch Sensortronic BMP085
++
++        bmp180                  Select the Bosch Sensortronic BMP180
++
++        bmp280                  Select the Bosch Sensortronic BMP280
++                                Valid addresses 0x76-0x77, default 0x76
++
++        bmp380                  Select the Bosch Sensortronic BMP380
++                                Valid addresses 0x76-0x77, default 0x76
++
++        bno055                  Select the Bosch Sensortronic BNO055 IMU
++                                Valid address 0x28-0x29, default 0x29
++
++        ccs811                  Select the AMS CCS811 digital gas sensor
++                                Valid addresses 0x5a-0x5b, default 0x5b
++
++        ds1621                  Select the Dallas Semiconductors DS1621 temp
++                                sensor. Valid addresses 0x48-0x4f, default 0x48
++
++        hdc100x                 Select the Texas Instruments HDC100x temp sensor
++                                Valid addresses 0x40-0x43, default 0x40
++
++        hdc3020                 Select the Texas Instruments HDC3020 temp sensor
++                                Valid addresses 0x44-0x47, default 0x44
++
++        hts221                  Select the HTS221 temperature and humidity
++                                sensor
++
++        htu21                   Select the HTU21 temperature and humidity sensor
++
++        int_pin                 Set the GPIO to use for interrupts (as73211,
++                                as7331, hdc3020, hts221, max30102, mpu6050 and
++                                mpu9250 only)
++
++        jc42                    Select any of the many JEDEC JC42.4-compliant
++                                temperature sensors, including:
++                                  ADT7408, AT30TS00, CAT34TS02, CAT6095,
++                                  MAX6604, MCP9804, MCP9805, MCP9808,
++                                  MCP98242, MCP98243, MCP98244, MCP9843,
++                                  SE97, SE98, STTS424(E), STTS2002, STTS3000,
++                                  TSE2002, TSE2004, TS3000, and TS3001.
++                                The default address is 0x18.
++
++        lm75                    Select the Maxim LM75 temperature sensor
++                                Valid addresses 0x48-0x4f, default 0x4f
++
++        lm75addr                Deprecated - use addr parameter instead
++
++        max17040                Select the Maxim Integrated MAX17040 battery
++                                monitor
++
++        max30102                Select the Maxim Integrated MAX30102 heart-rate
++                                and blood-oxygen sensor
++
++        mcp980x                 Select the Maxim MCP980x range of temperature
++                                sensors (i.e. MCP9800, MCP9801, MCP9802 and
++                                MCP9803). N.B. For MCP9804, MCP9805 and MCP9808,
++                                use the "jc42" option.
++                                Valid addresses are 0x18-0x1f (default 0x18)
++
++        mpu6050                 Select the InvenSense MPU6050 IMU. Valid
++                                valid addresses are 0x68 and 0x69 (default 0x68)
++
++        mpu9250                 Select the InvenSense MPU9250 IMU. Valid
++                                valid addresses are 0x68 and 0x69 (default 0x68)
++
++        ms5637                  Select the Measurement Specialities MS5637
++                                pressure and temperature sensor.
++
++        ms5803                  Select the Measurement Specialities MS5803
++                                pressure and temperature sensor.
++
++        ms5805                  Select the Measurement Specialities MS5805
++                                pressure and temperature sensor.
++
++        ms5837                  Select the Measurement Specialities MS5837
++                                pressure and temperature sensor.
++
++        ms8607                  Select the Measurement Specialities MS8607
++                                pressure and temperature sensor.
++
++        no_timeout              Disable the SMBUS timeout. N.B. Only supported
++                                by some jc42 devices - using with an
++                                incompatible device can stop it from being
++                                activated.
++
++        reset_pin               GPIO to be used to reset the device (bno055
++                                only, disabled by default)
++
++        sht3x                   Select the Sensirion SHT3x temperature and
++                                humidity sensors. Valid addresses 0x44-0x45,
++                                default 0x44
++
++        sht4x                   Select the Sensirion SHT4x temperature and
++                                humidity sensors. Valid addresses 0x44-0x45,
++                                default 0x44
++
++        si7020                  Select the Silicon Labs Si7013/20/21 humidity/
++                                temperature sensor
++
++        sps30                   Select the Sensirion SPS30 particulate matter
++                                sensor. Fixed address 0x69.
++
++        sgp30                   Select the Sensirion SGP30 VOC sensor.
++                                Fixed address 0x58.
++
++        tmp102                  Select the Texas Instruments TMP102 temp sensor
++                                Valid addresses 0x48-0x4b, default 0x48
++
++        tsl4531                 Select the AMS TSL4531 digital ambient light
++                                sensor
++
++        veml6070                Select the Vishay VEML6070 ultraviolet light
++                                sensor
++
++        veml6075                Select the Vishay VEML6075 UVA and UVB light
++                                sensor
++
++        i2c0                    Choose the I2C0 bus on GPIOs 0&1
++
++        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++
++        i2c3                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++
++        i2c4                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++
++        i2c5                    Choose the I2C5 bus (configure with the i2c4
++                                overlay - BCM2711 only)
++
++        i2c6                    Choose the I2C6 bus (configure with the i2c6
++                                overlay - BCM2711 only)
++
++
++Name:   i2c0
++Info:   Change i2c0 pin usage. Not all pin combinations are usable on all
++        platforms - platforms other then Compute Modules can only use this
++        to disable transaction combining.
++        Do NOT use in conjunction with dtparam=i2c_vc=on. From the 5.4 kernel
++        onwards the base DT includes the use of i2c_mux_pinctrl to expose two
++        muxings of BSC0 - GPIOs 0&1, and whichever combination is used for the
++        camera and display connectors. This overlay disables that mux and
++        configures /dev/i2c0 to point at whichever set of pins is requested.
++        dtparam=i2c_vc=on will try and enable the mux, so combining the two
++        will cause conflicts.
++Load:   dtoverlay=i2c0,<param>=<val>
++Params: pins_0_1                Use pins 0 and 1 (default)
++        pins_28_29              Use pins 28 and 29
++        pins_44_45              Use pins 44 and 45
++        pins_46_47              Use pins 46 and 47
++        combine                 Allow transactions to be combined (default
++                                "yes")
++
++
++Name:   i2c0-bcm2708
++Info:   Deprecated, legacy version of i2c0.
++Load:   <Deprecated>
++
++
++Name:   i2c0-pi5
++Info:   Enable i2c0 (Pi 5 only)
++Load:   dtoverlay=i2c0-pi5,<param>=<val>
++Params: pins_0_1                Use GPIOs 0 and 1 (default)
++        pins_8_9                Use GPIOs 8 and 9
++        baudrate                Set the baudrate for the interface (default
++                                "100000")
++
++
++Name:   i2c1
++Info:   Change i2c1 pin usage. Not all pin combinations are usable on all
++        platforms - platforms other then Compute Modules can only use this
++        to disable transaction combining.
++Load:   dtoverlay=i2c1,<param>=<val>
++Params: pins_2_3                Use pins 2 and 3 (default)
++        pins_44_45              Use pins 44 and 45
++        combine                 Allow transactions to be combined (default
++                                "yes")
++
++
++Name:   i2c1-bcm2708
++Info:   Deprecated, legacy version of i2c1.
++Load:   <Deprecated>
++
++
++Name:   i2c1-pi5
++Info:   Enable i2c1 (Pi 5 only)
++Load:   dtoverlay=i2c1-pi5,<param>=<val>
++Params: pins_2_3                Use GPIOs 2 and 3 (default)
++        pins_10_11              Use GPIOs 10 and 11
++        baudrate                Set the baudrate for the interface (default
++                                "100000")
++
++
++Name:   i2c2-pi5
++Info:   Enable i2c2 (Pi 5 only)
++Load:   dtoverlay=i2c2-pi5,<param>=<val>
++Params: pins_4_5                Use GPIOs 4 and 5 (default)
++        pins_12_13              Use GPIOs 12 and 13
++        baudrate                Set the baudrate for the interface (default
++                                "100000")
++
++
++Name:   i2c3
++Info:   Enable the i2c3 bus. BCM2711 only.
++Load:   dtoverlay=i2c3,<param>
++Params: pins_2_3                Use GPIOs 2 and 3
++        pins_4_5                Use GPIOs 4 and 5 (default)
++        baudrate                Set the baudrate for the interface (default
++                                "100000")
++
++
++Name:   i2c3-pi5
++Info:   Enable i2c3 (Pi 5 only)
++Load:   dtoverlay=i2c3-pi5,<param>=<val>
++Params: pins_6_7                Use GPIOs 6 and 7 (default)
++        pins_14_15              Use GPIOs 14 and 15
++        pins_22_23              Use GPIOs 22 and 23
++        baudrate                Set the baudrate for the interface (default
++                                "100000")
++
++
++Name:   i2c4
++Info:   Enable the i2c4 bus. BCM2711 only.
++Load:   dtoverlay=i2c4,<param>
++Params: pins_6_7                Use GPIOs 6 and 7
++        pins_8_9                Use GPIOs 8 and 9 (default)
++        baudrate                Set the baudrate for the interface (default
++                                "100000")
++
++
++Name:   i2c5
++Info:   Enable the i2c5 bus. BCM2711 only.
++Load:   dtoverlay=i2c5,<param>
++Params: pins_10_11              Use GPIOs 10 and 11
++        pins_12_13              Use GPIOs 12 and 13 (default)
++        baudrate                Set the baudrate for the interface (default
++                                "100000")
++
++
++Name:   i2c6
++Info:   Enable the i2c6 bus. BCM2711 only.
++Load:   dtoverlay=i2c6,<param>
++Params: pins_0_1                Use GPIOs 0 and 1
++        pins_22_23              Use GPIOs 22 and 23 (default)
++        baudrate                Set the baudrate for the interface (default
++                                "100000")
++
++
++Name:   i2s-dac
++Info:   Configures any passive I2S DAC soundcard.
++Load:   dtoverlay=i2s-dac
++Params: <None>
++
++
++Name:   i2s-gpio28-31
++Info:   move I2S function block to GPIO 28 to 31
++Load:   dtoverlay=i2s-gpio28-31
++Params: <None>
++
++
++Name:   i2s-master-dac
++Info:   Configures a generic I2S DAC soundcard that acts as a clock master.
++Load:   dtoverlay=i2s-master-dac
++Params: <None>
++
++
++Name:   ilitek251x
++Info:   Enables I2C connected Ilitek 251x multiple touch controller using
++        GPIO 4 (pin 7 on GPIO header) for interrupt.
++Load:   dtoverlay=ilitek251x,<param>=<val>
++Params: interrupt               GPIO used for interrupt (default 4)
++        sizex                   Touchscreen size x, horizontal resolution of
++                                touchscreen (in pixels)
++        sizey                   Touchscreen size y, vertical resolution of
++                                touchscreen (in pixels)
++
++
++Name:   imx219
++Info:   Sony IMX219 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=imx219,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 180)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++        vcm                     Configure a VCM focus drive on the sensor.
++
++
++Name:   imx258
++Info:   Sony IMX258 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=imx258,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 180)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++        vcm                     Configure a VCM focus drive on the sensor.
++        4lane                   Enable 4 CSI2 lanes. This requires a Compute
++                                Module (1, 3, or 4).
++
++
++Name:   imx290
++Info:   Sony IMX290 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=imx290,<param>
++Params: 4lane                   Enable 4 CSI2 lanes. This requires a Compute
++                                Module (1, 3, or 4).
++        clock-frequency         Sets the clock frequency to match that used on
++                                the board.
++                                Modules from Vision Components use 37.125MHz
++                                (the default), whilst those from Innomaker use
++                                74.25MHz.
++        mono                    Denote that the module is a mono sensor.
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 0)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++
++
++Name:   imx296
++Info:   Sony IMX296 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=imx296,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 180)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++        clock-frequency         Sets the clock frequency to match that used on
++                                the board, which should be one of 54000000
++                                (the default), 37125000 or 74250000.
++        always-on               Leave the regulator powered up, to stop the
++                                camera clamping I/Os such as XTRIG to 0V.
++
++
++Name:   imx327
++Info:   Sony IMX327 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=imx327,<param>
++Params: 4lane                   Enable 4 CSI2 lanes. This requires a Compute
++                                Module (1, 3, or 4).
++        clock-frequency         Sets the clock frequency to match that used on
++                                the board.
++                                Modules from Vision Components use 37.125MHz
++                                (the default), whilst those from Innomaker use
++                                74.25MHz.
++        mono                    Denote that the module is a mono sensor.
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 0)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++
++
++Name:   imx378
++Info:   Sony IMX378 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=imx378,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 180)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++        always-on               Leave the regulator powered up, to stop the
++                                camera clamping I/Os such as XVS to 0V.
++        sync-source             Configure as vsync source
++        sync-sink               Configure as vsync sink
++
++
++Name:   imx462
++Info:   Sony IMX462 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=imx462,<param>
++Params: 4lane                   Enable 4 CSI2 lanes. This requires a Compute
++                                Module (1, 3, or 4).
++        clock-frequency         Sets the clock frequency to match that used on
++                                the board.
++                                Modules from Vision Components use 37.125MHz
++                                (the default), whilst those from Innomaker use
++                                74.25MHz.
++        mono                    Denote that the module is a mono sensor.
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 0)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++
++
++Name:   imx477
++Info:   Sony IMX477 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=imx477,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 180)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++        always-on               Leave the regulator powered up, to stop the
++                                camera clamping I/Os such as XVS to 0V.
++        sync-source             Configure as vsync source
++        sync-sink               Configure as vsync sink
++
++
++Name:   imx500
++Info:   Sony IMX500 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=imx500,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 0)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++        bypass-cache            Do save blocks of data to flash when using
++                                rp2040-gpio-bridge for SPI transfers.
++
++
++Name:   imx500-pi5
++Info:   See imx500 (this is the Pi 5 version)
++
++
++Name:   imx519
++Info:   Sony IMX519 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=imx519,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 0)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++        vcm                     Select lens driver state. Default is enabled,
++                                but vcm=off will disable.
++
++
++Name:   imx708
++Info:   Sony IMX708 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=imx708,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 180)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        vcm                     Select lens driver state. Default is enabled,
++                                but vcm=off will disable.
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++        link-frequency          Allowable link frequency values to use in Hz:
++                                450000000 (default), 447000000, 453000000.
++
++
++Name:   interludeaudio-analog
++Info:   Configures Interlude Audio Analog Hat audio card
++Load:   dtoverlay=interludeaudio-analog,<param>=<val>
++Params: gpiopin                 GPIO pin for codec reset
++
++
++Name:   interludeaudio-digital
++Info:   Configures Interlude Audio Digital Hat audio card
++Load:   dtoverlay=interludeaudio-digital
++Params: <None>
++
++
++Name:   iqaudio-codec
++Info:   Configures the IQaudio Codec audio card
++Load:   dtoverlay=iqaudio-codec
++Params: <None>
++
++
++Name:   iqaudio-dac
++Info:   Configures the IQaudio DAC audio card
++Load:   dtoverlay=iqaudio-dac,<param>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control. Enable with
++                                "dtoverlay=iqaudio-dac,24db_digital_gain"
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24db_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++
++
++Name:   iqaudio-dacplus
++Info:   Configures the IQaudio DAC+ audio card
++Load:   dtoverlay=iqaudio-dacplus,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control. Enable with
++                                "dtoverlay=iqaudio-dacplus,24db_digital_gain"
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24db_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++        auto_mute_amp           If specified, unmute/mute the IQaudIO amp when
++                                starting/stopping audio playback.
++        unmute_amp              If specified, unmute the IQaudIO amp once when
++                                the DAC driver module loads.
++
++
++Name:   iqaudio-digi-wm8804-audio
++Info:   Configures the IQAudIO Digi WM8804 audio card
++Load:   dtoverlay=iqaudio-digi-wm8804-audio,<param>=<val>
++Params: card_name               Override the default, "IQAudIODigi", card name.
++        dai_name                Override the default, "IQAudIO Digi", dai name.
++        dai_stream_name         Override the default, "IQAudIO Digi HiFi",
++                                dai stream name.
++
++
++Name:   iqs550
++Info:   Enables I2C connected Azoteq IQS550 trackpad/touchscreen controller
++        using GPIO 4 (pin 7 on GPIO header) for interrupt.
++Load:   dtoverlay=iqs550,<param>=<val>
++Params: interrupt               GPIO used for interrupt (default 4)
++        reset                   GPIO used for reset (optional)
++        sizex                   Touchscreen size x (default 800)
++        sizey                   Touchscreen size y (default 480)
++        invx                    Touchscreen inverted x axis
++        invy                    Touchscreen inverted y axis
++        swapxy                  Touchscreen swapped x y axis
++
++
++Name:   irs1125
++Info:   Infineon irs1125 TOF camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=irs1125,<param>=<val>
++Params: media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default off)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++
++
++Name:   jedec-spi-nor
++Info:   Adds support for JEDEC-compliant SPI NOR flash devices.  (Note: The
++        "jedec,spi-nor" kernel driver was formerly known as "m25p80".)
++Load:   dtoverlay=jedec-spi-nor,<param>=<val>
++Params: spi<n>-<m>              Enable flash device on SPI<n>, CS#<m>
++        fastr                   Add fast read capability to the flash device
++        speed                   Maximum SPI frequency (Hz)
++        flash-spi<n>-<m>        Same as spi<n>-<m> (deprecated)
++        flash-fastr-spi<n>-<m>  Same as spi<n>->m>,fastr (deprecated)
++
++
++Name:   justboom-both
++Info:   Simultaneous usage of an justboom-dac and justboom-digi based
++        card
++Load:   dtoverlay=justboom-both,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control. Enable with
++                                "dtoverlay=justboom-dac,24db_digital_gain"
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24dB_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++
++
++Name:   justboom-dac
++Info:   Configures the JustBoom DAC HAT, Amp HAT, DAC Zero and Amp Zero audio
++        cards
++Load:   dtoverlay=justboom-dac,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                Digital volume control. Enable with
++                                "dtoverlay=justboom-dac,24db_digital_gain"
++                                (The default behaviour is that the Digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24dB_digital_gain parameter, the Digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the Digital volume control is set to a value
++                                that does not result in clipping/distortion!)
++
++
++Name:   justboom-digi
++Info:   Configures the JustBoom Digi HAT and Digi Zero audio cards
++Load:   dtoverlay=justboom-digi
++Params: <None>
++
++
++Name:   lirc-rpi
++Info:   This overlay has been deprecated and removed - see gpio-ir
++Load:   <Deprecated>
++
++
++Name:   ltc294x
++Info:   Adds support for the ltc294x family of battery gauges
++Load:   dtoverlay=ltc294x,<param>=<val>
++Params: ltc2941                 Select the ltc2941 device
++
++        ltc2942                 Select the ltc2942 device
++
++        ltc2943                 Select the ltc2943 device
++
++        ltc2944                 Select the ltc2944 device
++
++        resistor-sense          The sense resistor value in milli-ohms.
++                                Can be a 32-bit negative value when the battery
++                                has been connected to the wrong end of the
++                                resistor.
++
++        prescaler-exponent      Range and accuracy of the gauge. The value is
++                                programmed into the chip only if it differs
++                                from the current setting.
++                                For LTC2941 only:
++                                - Default value is 128
++                                - the exponent is in the range 0-7 (default 7)
++                                See the datasheet for more information.
++
++
++Name:   max98357a
++Info:   Configures the Maxim MAX98357A I2S DAC
++Load:   dtoverlay=max98357a,<param>=<val>
++Params: no-sdmode               Driver does not manage the state of the DAC's
++                                SD_MODE pin (i.e. chip is always on).
++        sdmode-pin              integer, GPIO pin connected to the SD_MODE input
++                                of the DAC (default GPIO4 if parameter omitted).
++
++
++Name:   maxtherm
++Info:   Configure a MAX6675, MAX31855 or MAX31856 thermocouple as an IIO device.
++
++        For devices on spi1 or spi2, the interfaces should be enabled
++        with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
++        The overlay expects to disable the relevant spidev node, so also using
++        e.g. cs0_spidev=off is unnecessary.
++
++        Example:
++        MAX31855 on /dev/spidev0.0
++            dtoverlay=maxtherm,spi0-0,max31855
++        MAX31856 using a type J thermocouple on /dev/spidev2.1
++            dtoverlay=spi2-2cs
++            dtoverlay=maxtherm,spi2-1,max31856,type_j
++
++Load:   dtoverlay=maxtherm,<param>=<val>
++Params: spi<n>-<m>              Configure device at spi<n>, cs<m>
++                                (boolean, required)
++        max6675                 Enable support for the MAX6675 (default)
++        max31855                Enable support for the MAX31855
++        max31855e               Enable support for the MAX31855E
++        max31855j               Enable support for the MAX31855J
++        max31855k               Enable support for the MAX31855K
++        max31855n               Enable support for the MAX31855N
++        max31855r               Enable support for the MAX31855R
++        max31855s               Enable support for the MAX31855S
++        max31855t               Enable support for the MAX31855T
++        max31856                Enable support for the MAX31856 (with type K)
++        type_b                  Select a type B sensor for max31856
++        type_e                  Select a type E sensor for max31856
++        type_j                  Select a type J sensor for max31856
++        type_k                  Select a type K sensor for max31856
++        type_n                  Select a type N sensor for max31856
++        type_r                  Select a type R sensor for max31856
++        type_s                  Select a type S sensor for max31856
++        type_t                  Select a type T sensor for max31856
++
++
++Name:   mbed-dac
++Info:   Configures the mbed AudioCODEC (TLV320AIC23B)
++Load:   dtoverlay=mbed-dac
++Params: <None>
++
++
++Name:   mcp23017
++Info:   Configures the MCP23017 I2C GPIO expander
++Load:   dtoverlay=mcp23017,<param>=<val>
++Params: gpiopin                 Gpio pin connected to the INTA output of the
++                                MCP23017 (default: 4)
++
++        addr                    I2C address of the MCP23017 (default: 0x20)
++
++        mcp23008                Configure an MCP23008 instead.
++        noints                  Disable the interrupt GPIO line.
++        i2c0                    Choose the I2C0 bus on GPIOs 0&1
++        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++        i2c3                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++        i2c4                    Choose the I2C4 bus (configure with the i2c4
++                                overlay - BCM2711 only)
++        i2c5                    Choose the I2C5 bus (configure with the i2c5
++                                overlay - BCM2711 only)
++        i2c6                    Choose the I2C6 bus (configure with the i2c6
++                                overlay - BCM2711 only)
++
++
++Name:   mcp23s17
++Info:   Configures the MCP23S08/17 SPI GPIO expanders.
++        If devices are present on SPI1 or SPI2, those interfaces must be enabled
++        with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
++        If interrupts are enabled for a device on a given CS# on a SPI bus, that
++        device must be the only one present on that SPI bus/CS#.
++Load:   dtoverlay=mcp23s17,<param>=<val>
++Params: s08-spi<n>-<m>-present  4-bit integer, bitmap indicating MCP23S08
++                                devices present on SPI<n>, CS#<m>
++
++        s17-spi<n>-<m>-present  8-bit integer, bitmap indicating MCP23S17
++                                devices present on SPI<n>, CS#<m>
++
++        s08-spi<n>-<m>-int-gpio integer, enables interrupts on a single
++                                MCP23S08 device on SPI<n>, CS#<m>, specifies
++                                the GPIO pin to which INT output of MCP23S08
++                                is connected.
++
++        s17-spi<n>-<m>-int-gpio integer, enables mirrored interrupts on a
++                                single MCP23S17 device on SPI<n>, CS#<m>,
++                                specifies the GPIO pin to which either INTA
++                                or INTB output of MCP23S17 is connected.
++
++
++Name:   mcp2515
++Info:   Configures the MCP2515 CAN controller on spi0/1/2
++        For devices on spi1 or spi2, the interfaces should be enabled
++        with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
++Load:   dtoverlay=mcp2515,<param>=<val>
++Params: spi<n>-<m>              Configure device at spi<n>, cs<m>
++                                (boolean, required)
++
++        oscillator              Clock frequency for the CAN controller (Hz)
++
++        speed                   Maximum SPI frequence (Hz)
++
++        interrupt               GPIO for interrupt signal
++
++
++Name:   mcp2515-can0
++Info:   Configures the MCP2515 CAN controller on spi0.0
++Load:   dtoverlay=mcp2515-can0,<param>=<val>
++Params: oscillator              Clock frequency for the CAN controller (Hz)
++
++        spimaxfrequency         Maximum SPI frequence (Hz)
++
++        interrupt               GPIO for interrupt signal
++
++
++Name:   mcp2515-can1
++Info:   Configures the MCP2515 CAN controller on spi0.1
++Load:   dtoverlay=mcp2515-can1,<param>=<val>
++Params: oscillator              Clock frequency for the CAN controller (Hz)
++
++        spimaxfrequency         Maximum SPI frequence (Hz)
++
++        interrupt               GPIO for interrupt signal
++
++
++Name:   mcp251xfd
++Info:   Configures the MCP251XFD CAN controller family
++        For devices on spi1 or spi2, the interfaces should be enabled
++        with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
++Load:   dtoverlay=mcp251xfd,<param>=<val>
++Params: spi<n>-<m>              Configure device at spi<n>, cs<m>
++                                (boolean, required)
++
++        oscillator              Clock frequency for the CAN controller (Hz)
++
++        speed                   Maximum SPI frequence (Hz)
++
++        interrupt               GPIO for interrupt signal
++
++        rx_interrupt            GPIO for RX interrupt signal (nINT1) (optional)
++
++        xceiver_enable          GPIO for CAN transceiver enable (optional)
++
++        xceiver_active_high     specifiy if CAN transceiver enable pin is
++                                active high (optional, default: active low)
++
++
++Name:   mcp3008
++Info:   Configures MCP3008 A/D converters
++        For devices on spi1 or spi2, the interfaces should be enabled
++        with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
++Load:   dtoverlay=mcp3008,<param>[=<val>]
++Params: spi<n>-<m>-present      boolean, configure device at spi<n>, cs<m>
++        spi<n>-<m>-speed        integer, set the spi bus speed for this device
++
++
++Name:   mcp3202
++Info:   Configures MCP3202 A/D converters
++        For devices on spi1 or spi2, the interfaces should be enabled
++        with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
++Load:   dtoverlay=mcp3202,<param>[=<val>]
++Params: spi<n>-<m>-present      boolean, configure device at spi<n>, cs<m>
++        spi<n>-<m>-speed        integer, set the spi bus speed for this device
++
++
++Name:   mcp342x
++Info:   Overlay for activation of Microchip MCP3421-3428 ADCs over I2C
++Load:   dtoverlay=mcp342x,<param>=<val>
++Params: addr                    I2C bus address of device, for devices with
++                                addresses that are configurable, e.g. by
++                                hardware links (default=0x68)
++        mcp3421                 The device is an MCP3421
++        mcp3422                 The device is an MCP3422
++        mcp3423                 The device is an MCP3423
++        mcp3424                 The device is an MCP3424
++        mcp3425                 The device is an MCP3425
++        mcp3426                 The device is an MCP3426
++        mcp3427                 The device is an MCP3427
++        mcp3428                 The device is an MCP3428
++
++
++Name:   media-center
++Info:   Media Center HAT - 2.83" Touch Display + extras by Pi Supply
++Load:   dtoverlay=media-center,<param>=<val>
++Params: speed                   Display SPI bus speed
++        rotate                  Display rotation {0,90,180,270}
++        fps                     Delay between frame updates
++        xohms                   Touchpanel sensitivity (X-plate resistance)
++        swapxy                  Swap x and y axis
++        backlight               Change backlight GPIO pin {e.g. 12, 18}
++        debug                   "on" = enable additional debug messages
++                                (default "off")
++
++
++Name:   merus-amp
++Info:   Configures the merus-amp audio card
++Load:   dtoverlay=merus-amp
++Params: <None>
++
++
++Name:   midi-uart0
++Info:   Configures UART0 (ttyAMA0) so that a requested 38.4kbaud actually gets
++        31.25kbaud, the frequency required for MIDI
++Load:   dtoverlay=midi-uart0
++Params: <None>
++
++
++Name:   midi-uart0-pi5
++Info:   See midi-uart0 (this is the Pi 5 version)
++
++
++Name:   midi-uart1
++Info:   Configures UART1 (ttyS0) so that a requested 38.4kbaud actually gets
++        31.25kbaud, the frequency required for MIDI
++Load:   dtoverlay=midi-uart1
++Params: <None>
++
++
++Name:   midi-uart1-pi5
++Info:   See midi-uart1 (this is the Pi 5 version)
++
++
++Name:   midi-uart2
++Info:   Configures UART2 (ttyAMA2) so that a requested 38.4kbaud actually gets
++        31.25kbaud, the frequency required for MIDI
++Load:   dtoverlay=midi-uart2
++Params: <None>
++
++
++Name:   midi-uart2-pi5
++Info:   See midi-uart2 (this is the Pi 5 version)
++
++
++Name:   midi-uart3
++Info:   Configures UART3 (ttyAMA3) so that a requested 38.4kbaud actually gets
++        31.25kbaud, the frequency required for MIDI
++Load:   dtoverlay=midi-uart3
++Params: <None>
++
++
++Name:   midi-uart3-pi5
++Info:   See midi-uart3 (this is the Pi 5 version)
++
++
++Name:   midi-uart4
++Info:   Configures UART4 (ttyAMA4) so that a requested 38.4kbaud actually gets
++        31.25kbaud, the frequency required for MIDI
++Load:   dtoverlay=midi-uart4
++Params: <None>
++
++
++Name:   midi-uart4-pi5
++Info:   See midi-uart4 (this is the Pi 5 version)
++
++
++Name:   midi-uart5
++Info:   Configures UART5 (ttyAMA5) so that a requested 38.4kbaud actually gets
++        31.25kbaud, the frequency required for MIDI
++Load:   dtoverlay=midi-uart5
++Params: <None>
++
++
++Name:   minipitft13
++Info:   Overlay for AdaFruit Mini Pi 1.3" TFT via SPI using fbtft driver.
++Load:   dtoverlay=minipitft13,<param>=<val>
++Params: speed                   SPI bus speed (default 32000000)
++        rotate                  Display rotation (0, 90, 180 or 270; default 0)
++        width                   Display width (default 240)
++        height                  Display height (default 240)
++        fps                     Delay between frame updates (default 25)
++        debug                   Debug output level (0-7; default 0)
++
++
++Name:   miniuart-bt
++Info:   Switch the onboard Bluetooth function of a BT-equipped Raspberry Pi
++        to use the mini-UART (ttyS0) and restore UART0/ttyAMA0 over GPIOs 14 &
++        15. Note that this option uses a lower baudrate, and should only be used
++        with low-bandwidth peripherals.
++Load:   dtoverlay=miniuart-bt,<param>=<val>
++Params: krnbt                   Set to "off" to disable autoprobing of Bluetooth
++                                driver without need of hciattach/btattach
++
++
++Name:   mipi-dbi-spi
++Info:   Overlay for SPI-connected MIPI DBI displays using the panel-mipi-dbi
++        driver. The driver will load a file /lib/firmware/panel.bin containing
++        the initialisation commands.
++
++        Example:
++          dtoverlay=mipi-dbi-spi,spi0-0,speed=70000000
++          dtparam=width=320,height=240
++          dtparam=reset-gpio=23,dc-gpio=24
++          dtparam=backlight-gpio=18
++
++        Compared to fbtft panel-mipi-dbi runs pixel data at spi-max-frequency
++        and init commands at 10MHz. This makes it possible to push the envelope
++        without messing up the controller configuration due to command
++        transmission errors.
++
++        For devices on spi1 or spi2, the interfaces should be enabled
++        with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
++
++        See https://github.com/notro/panel-mipi-dbi/wiki for more info.
++
++Load:   dtoverlay=mipi-dbi-spi,<param>=<val>
++Params:
++        compatible              Set the compatible string to load a different
++                                firmware file. Both the panel compatible value
++                                used to load the firmware file and the value
++                                used to load the driver has to be set having a
++                                NUL (\0) separator between them.
++                                Example:
++                                dtparam=compatible=mypanel\0panel-mipi-dbi-spi
++        spi<n>-<m>              Configure device at spi<n>, cs<m>
++                                (boolean, required)
++        speed                   SPI bus speed in Hz (default 32000000)
++        cpha                    Shifted SPI clock phase (CPHA) mode
++        cpol                    Inverse SPI clock polarity (CPOL) mode
++        write-only              Controller is not readable
++                                (ie. MISO is not wired up).
++
++        width                   Panel width in pixels (required)
++        height                  Panel height in pixels (required)
++        width-mm                Panel width in mm
++        height-mm               Panel height in mm
++        x-offset                Panel x-offset in controller RAM
++        y-offset                Panel y-offset in controller RAM
++
++        clock-frequency         Panel clock frequency in Hz
++                                (optional, just informational).
++
++        reset-gpio              GPIO pin to be used for RESET
++        dc-gpio                 GPIO pin to be used for D/C
++
++        backlight-gpio          GPIO pin to be used for backlight control
++                                (default of none).
++        backlight-pwm           PWM channel to be used for backlight control
++                                (default of none). NB Disables audio headphone
++                                output as that also uses PWM.
++        backlight-pwm-chan      Choose channel on &pwm node for backlight
++                                control (default 0).
++        backlight-pwm-gpio      GPIO pin to be used for the PWM backlight. See
++                                pwm-2chan for valid options (default 18).
++        backlight-pwm-func      Pin function of GPIO used for the PWM backlight.
++                                See pwm-2chan for valid options (default 2).
++        backlight-def-brightness
++                                Set the default brightness. Normal range 1-16.
++                                (default 16).
++
++
++Name:   mlx90640
++Info:   Overlay for i2c connected mlx90640 thermal camera
++Load:   dtoverlay=mlx90640
++Params: <None>
++
++
++Name:   mmc
++Info:   Selects the bcm2835-mmc SD/MMC driver, optionally with overclock
++Load:   dtoverlay=mmc,<param>=<val>
++Params: overclock_50            Clock (in MHz) to use when the MMC framework
++                                requests 50MHz
++
++
++Name:   mpu6050
++Info:   This overlay has been deprecated - use "dtoverlay=i2c-sensor,mpu6050"
++        instead. Note that "int_pin" is the new name for the "interrupt"
++        parameter.
++Load:   <Deprecated>
++
++
++Name:   mz61581
++Info:   MZ61581 display by Tontec
++Load:   dtoverlay=mz61581,<param>=<val>
++Params: speed                   Display SPI bus speed
++
++        rotate                  Display rotation {0,90,180,270}
++
++        fps                     Delay between frame updates
++
++        txbuflen                Transmit buffer length (default 32768)
++
++        debug                   Debug output level {0-7}
++
++        xohms                   Touchpanel sensitivity (X-plate resistance)
++
++
++Name:   ov2311
++Info:   Omnivision OV2311 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=ov2311,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 0)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++
++
++Name:   ov5647
++Info:   Omnivision OV5647 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=ov5647,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 0)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++        vcm                     Configure a VCM focus drive on the sensor.
++
++
++Name:   ov64a40
++Info:   Arducam OV64A40 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=ov64a40,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 0)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++        vcm                     Select lens driver state. Default is enabled,
++                                but vcm=off will disable.
++        link-frequency          Allowable link frequency values to use in Hz:
++                                456000000 (default), 360000000
++
++
++Name:   ov7251
++Info:   Omnivision OV7251 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=ov7251,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 0)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default off)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++
++
++Name:   ov9281
++Info:   Omnivision OV9281 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=ov9281,<param>=<val>
++Params: rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 0)
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++
++
++Name:   papirus
++Info:   PaPiRus ePaper Screen by Pi Supply (both HAT and pHAT)
++Load:   dtoverlay=papirus,<param>=<val>
++Params: panel                   Display panel (required):
++                                1.44": e1144cs021
++                                2.0":  e2200cs021
++                                2.7":  e2271cs021
++
++        speed                   Display SPI bus speed
++
++
++Name:   pca953x
++Info:   TI PCA953x family of I2C GPIO expanders. Default is for NXP PCA9534.
++Load:   dtoverlay=pca953x,<param>=<val>
++Params: addr                    I2C address of expander. Default 0x20.
++        pca6416                 Select the NXP PCA6416 (16 bit)
++        pca9505                 Select the NXP PCA9505 (40 bit)
++        pca9535                 Select the NXP PCA9535 (16 bit)
++        pca9536                 Select the NXP PCA9536 or TI PCA9536 (4 bit)
++        pca9537                 Select the NXP PCA9537 (4 bit)
++        pca9538                 Select the NXP PCA9538 (8 bit)
++        pca9539                 Select the NXP PCA9539 (16 bit)
++        pca9554                 Select the NXP PCA9554 (8 bit)
++        pca9555                 Select the NXP PCA9555 (16 bit)
++        pca9556                 Select the NXP PCA9556 (8 bit)
++        pca9557                 Select the NXP PCA9557 (8 bit)
++        pca9574                 Select the NXP PCA9574 (8 bit)
++        pca9575                 Select the NXP PCA9575 (16 bit)
++        pca9698                 Select the NXP PCA9698 (40 bit)
++        pcal6416                Select the NXP PCAL6416 (16 bit)
++        pcal6524                Select the NXP PCAL6524 (24 bit)
++        pcal9555a               Select the NXP PCAL9555A (16 bit)
++        max7310                 Select the Maxim MAX7310 (8 bit)
++        max7312                 Select the Maxim MAX7312 (16 bit)
++        max7313                 Select the Maxim MAX7313 (16 bit)
++        max7315                 Select the Maxim MAX7315 (8 bit)
++        pca6107                 Select the TI PCA6107 (8 bit)
++        tca6408                 Select the TI TCA6408 (8 bit)
++        tca6416                 Select the TI TCA6416 (16 bit)
++        tca6424                 Select the TI TCA6424 (24 bit)
++        tca9539                 Select the TI TCA9539 (16 bit)
++        tca9554                 Select the TI TCA9554 (8 bit)
++        cat9554                 Select the Onnn CAT9554 (8 bit)
++        pca9654                 Select the Onnn PCA9654 (8 bit)
++        xra1202                 Select the Exar XRA1202 (8 bit)
++
++
++Name:   pcf857x
++Info:   NXP PCF857x family of I2C GPIO expanders.
++Load:   dtoverlay=pcf857x,<param>=<val>
++Params: addr                    I2C address of expander. Default
++                                depends on model selected.
++        pcf8574                 Select the NXP PCF8574 (8 bit)
++        pcf8574a                Select the NXP PCF8574A (8 bit)
++        pcf8575                 Select the NXP PCF8575 (16 bit)
++        pca8574                 Select the NXP PCA8574 (8 bit)
++
++
++Name:   pcie-32bit-dma
++Info:   Force PCIe config to support 32bit DMA addresses at the expense of
++        having to bounce buffers.
++Load:   dtoverlay=pcie-32bit-dma
++Params: <None>
++
++
++Name:   pcie-32bit-dma-pi5
++Info:   Force PCIe config to support 32bit DMA addresses at the expense of
++        having to bounce buffers (on the Pi 5).
++Load:   dtoverlay=pcie-32bit-dma-pi5
++Params: <None>
++
++
++Name:   pciex1-compat-pi5
++Info:   Compatibility features for pciex1 on Pi 5.
++Load:   dtoverlay=pciex1-compat-pi5,<param>=<val>
++Params: l1ss                    Enable ASPM L1 sub-state support
++        no-l0s                  Disable ASPM L0s
++        no-mip                  Revert to the MSI target in the RC, instead of
++                                the MSI-MIP peripheral. Use if a) more than 8
++                                interrupt vectors are required or b) the EP
++                                requires DMA and MSI addresses to be 32bit.
++        mmio-hi                 Move the start of outbound 32bit addresses to
++                                2GB and expand 64bit outbound space to 14GB.
++
++
++[ The pcf2127-rtc overlay has been deleted. See i2c-rtc. ]
++
++
++[ The pcf8523-rtc overlay has been deleted. See i2c-rtc. ]
++
++
++[ The pcf8563-rtc overlay has been deleted. See i2c-rtc. ]
++
++
++Name:   pi3-act-led
++Info:   This overlay has been renamed act-led, keeping pi3-act-led as an alias
++        for backwards compatibility.
++Load:   <Deprecated>
++
++
++Name:   pi3-disable-bt
++Info:   This overlay has been renamed disable-bt, keeping pi3-disable-bt as an
++        alias for backwards compatibility.
++Load:   <Deprecated>
++
++
++Name:   pi3-disable-wifi
++Info:   This overlay has been renamed disable-wifi, keeping pi3-disable-wifi as
++        an alias for backwards compatibility.
++Load:   <Deprecated>
++
++
++Name:   pi3-miniuart-bt
++Info:   This overlay has been renamed miniuart-bt, keeping pi3-miniuart-bt as
++        an alias for backwards compatibility.
++Load:   <Deprecated>
++
++
++Name:   pibell
++Info:   Configures the pibell audio card.
++Load:   dtoverlay=pibell,<param>=<val>
++Params: alsaname                Set the name as it appears in ALSA (default
++                                "PiBell")
++
++
++Name:   pifacedigital
++Info:   Configures the PiFace Digital mcp23s17 GPIO port expander.
++Load:   dtoverlay=pifacedigital,<param>=<val>
++Params: spi-present-mask        8-bit integer, bitmap indicating MCP23S17 SPI0
++                                CS0 address. PiFace Digital supports addresses
++                                0-3, which can be configured with JP1 and JP2.
++
++
++Name:   pifi-40
++Info:   Configures the PiFi 40W stereo amplifier
++Load:   dtoverlay=pifi-40
++Params: <None>
++
++
++Name:   pifi-dac-hd
++Info:   Configures the PiFi DAC HD
++Load:   dtoverlay=pifi-dac-hd
++Params: <None>
++
++
++Name:   pifi-dac-zero
++Info:   Configures the PiFi DAC Zero
++Load:   dtoverlay=pifi-dac-zero
++Params: <None>
++
++
++Name:   pifi-mini-210
++Info:   Configures the PiFi Mini stereo amplifier
++Load:   dtoverlay=pifi-mini-210
++Params: <None>
++
++
++Name:   piglow
++Info:   Configures the PiGlow by pimoroni.com
++Load:   dtoverlay=piglow
++Params: <None>
++
++
++Name:   pineboards-hat-ai
++Info:   Pineboards Hat Ai! overlay for the Google Coral Edge TPU
++Load:   dtoverlay=pineboards-hat-ai
++Params: <None>
++
++
++Name:   pineboards-hatdrive-poe-plus
++Info:   Configures the Pineboards HatDrive! PoE+
++Load:   dtoverlay=pineboards-hatdrive-poe-plus
++Params: <None>
++
++
++Name:   piscreen
++Info:   PiScreen display by OzzMaker.com
++Load:   dtoverlay=piscreen,<param>=<val>
++Params: speed                   Display SPI bus speed
++
++        rotate                  Display rotation {0,90,180,270}
++
++        fps                     Delay between frame updates
++
++        debug                   Debug output level {0-7}
++
++        xohms                   Touchpanel sensitivity (X-plate resistance)
++
++        drm                     Select the DRM/KMS driver instead of the FBTFT
++                                one
++
++        invx                    Touchscreen inverted x axis
++
++        invy                    Touchscreen inverted y axis
++
++        swapxy                  Touchscreen swapped x y axis
++
++
++Name:   piscreen2r
++Info:   PiScreen 2 with resistive TP display by OzzMaker.com
++Load:   dtoverlay=piscreen2r,<param>=<val>
++Params: speed                   Display SPI bus speed
++
++        rotate                  Display rotation {0,90,180,270}
++
++        fps                     Delay between frame updates
++
++        debug                   Debug output level {0-7}
++
++        xohms                   Touchpanel sensitivity (X-plate resistance)
++
++
++Name:   pisound
++Info:   Configures the Blokas Labs Pisound card
++Load:   dtoverlay=pisound
++Params: <None>
++
++
++Name:   pisound-pi5
++Info:   Pi 5 specific overlay override for Blokas Labs Pisound card, see pisound
++Load:   dtoverlay=pisound-pi5
++Params: <None>
++
++
++Name:   pitft22
++Info:   Adafruit PiTFT 2.2" screen
++Load:   dtoverlay=pitft22,<param>=<val>
++Params: speed                   Display SPI bus speed
++
++        rotate                  Display rotation {0,90,180,270}
++
++        fps                     Delay between frame updates
++
++        debug                   Debug output level {0-7}
++
++        drm                     Force the use of the mi0283qt DRM driver (by
++                                default the ili9340 framebuffer driver will
++                                be used in preference if available)
++
++
++Name:   pitft28-capacitive
++Info:   Adafruit PiTFT 2.8" capacitive touch screen
++Load:   dtoverlay=pitft28-capacitive,<param>=<val>
++Params: speed                   Display SPI bus speed
++
++        rotate                  Display rotation {0,90,180,270}
++
++        fps                     Delay between frame updates
++
++        debug                   Debug output level {0-7}
++
++        drm                     Force the use of the mi0283qt DRM driver (by
++                                default the ili9340 framebuffer driver will
++                                be used in preference if available)
++
++        touch-sizex             Touchscreen size x (default 240)
++
++        touch-sizey             Touchscreen size y (default 320)
++
++        touch-invx              Touchscreen inverted x axis
++
++        touch-invy              Touchscreen inverted y axis
++
++        touch-swapxy            Touchscreen swapped x y axis
++
++
++Name:   pitft28-resistive
++Info:   Adafruit PiTFT 2.8" resistive touch screen
++Load:   dtoverlay=pitft28-resistive,<param>=<val>
++Params: speed                   Display SPI bus speed
++
++        rotate                  Display rotation {0,90,180,270}
++
++        fps                     Delay between frame updates
++
++        debug                   Debug output level {0-7}
++
++        drm                     Force the use of the mi0283qt DRM driver (by
++                                default the ili9340 framebuffer driver will
++                                be used in preference if available)
++
++        touch-invx              Touchscreen inverted x axis
++
++        touch-invy              Touchscreen inverted y axis
++
++        touch-swapxy            Touchscreen swapped x y axis
++
++
++Name:   pitft35-resistive
++Info:   Adafruit PiTFT 3.5" resistive touch screen
++Load:   dtoverlay=pitft35-resistive,<param>=<val>
++Params: speed                   Display SPI bus speed
++
++        rotate                  Display rotation {0,90,180,270}
++
++        fps                     Delay between frame updates
++
++        debug                   Debug output level {0-7}
++
++        drm                     Force the use of the hx8357d DRM driver (by
++                                default the fb_hx8357d framebuffer driver will
++                                be used in preference if available)
++
++        touch-invx              Touchscreen inverted x axis
++
++        touch-invy              Touchscreen inverted y axis
++
++        touch-swapxy            Touchscreen swapped x y axis
++
++
++Name:   pps-gpio
++Info:   Configures the pps-gpio (pulse-per-second time signal via GPIO).
++Load:   dtoverlay=pps-gpio,<param>=<val>
++Params: gpiopin                 Input GPIO (default "18")
++        assert_falling_edge     When present, assert is indicated by a falling
++                                edge, rather than by a rising edge (default
++                                off)
++        capture_clear           Generate clear events on the trailing edge
++                                (default off)
++        pull                    Desired pull-up/down state (off, down, up)
++                                Default is "off".
++
++
++Name:   proto-codec
++Info:   Configures the PROTO Audio Codec card
++Load:   dtoverlay=proto-codec
++Params: <None>
++
++
++Name:   pwm
++Info:   Configures a single PWM channel
++        Legal pin,function combinations for each channel:
++          PWM0: 12,4(Alt0) 18,2(Alt5) 40,4(Alt0)            52,5(Alt1)
++          PWM1: 13,4(Alt0) 19,2(Alt5) 41,4(Alt0) 45,4(Alt0) 53,5(Alt1)
++        N.B.:
++          1) Pin 18 is the only one available on all platforms, and
++             it is the one used by the I2S audio interface.
++             Pins 12 and 13 might be better choices on an A+, B+ or Pi2.
++          2) The onboard analogue audio output uses both PWM channels.
++          3) So be careful mixing audio and PWM.
++          4) Currently the clock must have been enabled and configured
++             by other means.
++Load:   dtoverlay=pwm,<param>=<val>
++Params: pin                     Output pin (default 18) - see table
++        func                    Pin function (default 2 = Alt5) - see above
++        clock                   PWM clock frequency (informational)
++
++
++Name:   pwm-2chan
++Info:   Configures both PWM channels
++        Legal pin,function combinations for each channel:
++          PWM0: 12,4(Alt0) 18,2(Alt5) 40,4(Alt0)            52,5(Alt1)
++          PWM1: 13,4(Alt0) 19,2(Alt5) 41,4(Alt0) 45,4(Alt0) 53,5(Alt1)
++        N.B.:
++          1) Pin 18 is the only one available on all platforms, and
++             it is the one used by the I2S audio interface.
++             Pins 12 and 13 might be better choices on an A+, B+ or Pi2.
++          2) The onboard analogue audio output uses both PWM channels.
++          3) So be careful mixing audio and PWM.
++          4) Currently the clock must have been enabled and configured
++             by other means.
++Load:   dtoverlay=pwm-2chan,<param>=<val>
++Params: pin                     Output pin (default 18) - see table
++        pin2                    Output pin for other channel (default 19)
++        func                    Pin function (default 2 = Alt5) - see above
++        func2                   Function for pin2 (default 2 = Alt5)
++        clock                   PWM clock frequency (informational)
++
++
++Name:   pwm-gpio
++Info:   Configures the software PWM GPIO driver
++Load:   dtoverlay=pwm-gpio,<param>=<val>
++Params: gpio                    Output pin (default 4)
++
++
++Name:   pwm-ir-tx
++Info:   Use GPIO pin as pwm-assisted infrared transmitter output.
++        This is an alternative to "gpio-ir-tx". pwm-ir-tx makes use
++        of PWM0 to reduce the CPU load during transmission compared to
++        gpio-ir-tx which uses bit-banging.
++        Legal pin,function combinations are:
++          12,4(Alt0) 18,2(Alt5) 40,4(Alt0) 52,5(Alt1)
++Load:   dtoverlay=pwm-ir-tx,<param>=<val>
++Params: gpio_pin                Output GPIO (default 18)
++
++        func                    Pin function (default 2 = Alt5)
++
++
++Name:   pwm1
++Info:   Configures one or two PWM channel on PWM1 (BCM2711 only)
++        N.B.:
++          1) The onboard analogue audio output uses both PWM channels.
++          2) So be careful mixing audio and PWM.
++        Note that even when only one pin is enabled, both channels are available
++        from the PWM driver, so be careful to use the correct one.
++Load:   dtoverlay=pwm1,<param>=<val>
++Params: clock                   PWM clock frequency (informational)
++        pins_40                 Enable channel 0 (PWM1_0) on GPIO 40
++        pins_41                 Enable channel 1 (PWM1_1) on GPIO 41
++        pins_40_41              Enable channels 0 (PWM1_0) and 1 (PW1_1) on
++                                GPIOs 40 and 41 (default)
++        pull_up                 Enable pull-ups on the PWM pins (default)
++        pull_down               Enable pull-downs on the PWM pins
++        pull_off                Disable pulls on the PWM pins
++
++
++Name:   qca7000
++Info:   Evaluation Board for PLC Stamp micro
++        This uses spi0 and a separate GPIO interrupt to connect the QCA7000.
++Load:   dtoverlay=qca7000,<param>=<val>
++Params: int_pin                 GPIO pin for interrupt signal (default 23)
++
++        speed                   SPI bus speed (default 12 MHz)
++
++
++Name:   qca7000-uart0
++Info:   Evaluation Board for PLC Stamp micro (UART)
++        This uses uart0/ttyAMA0 over GPIOs 14 & 15 to connect the QCA7000.
++        But it requires disabling of onboard Bluetooth on
++        Pi 3B, 3B+, 3A+, 4B and Zero W.
++Load:   dtoverlay=qca7000-uart0,<param>=<val>
++Params: baudrate                Set the baudrate for the UART (default
++                                "115200")
++
++
++Name:   ramoops
++Info:   Enable the preservation of crash logs across a reboot. With
++        systemd-pstore enabled (as it is on Raspberry Pi OS) the crash logs
++        are moved to /var/lib/systemd/pstore/ on reboot.
++Load:   dtoverlay=ramoops,<param>=<val>
++Params: base-addr               Where to place the capture buffer (default
++                                0x0b000000)
++        total-size              How much memory to allocate altogether (in
++                                bytes - default 64kB)
++        record-size             How much space to use for each capture, i.e.
++                                total-size / record-size = number of captures
++                                (default 16kB)
++        console-size            Size of non-panic dmesg captures (default 0)
++
++
++Name:   ramoops-pi4
++Info:   The version of the ramoops overlay for the Pi 4 family. It should be
++        loaded automatically if dtoverlay=ramoops is specified on a Pi 4.
++Load:   dtoverlay=ramoops-pi4,<param>=<val>
++Params: base-addr               Where to place the capture buffer (default
++                                0x0b000000)
++        total-size              How much memory to allocate altogether (in
++                                bytes - default 64kB)
++        record-size             How much space to use for each capture, i.e.
++                                total-size / record-size = number of captures
++                                (default 16kB)
++        console-size            Size of non-panic dmesg captures (default 0)
++
++
++Name:   rotary-encoder
++Info:   Overlay for GPIO connected rotary encoder.
++Load:   dtoverlay=rotary-encoder,<param>=<val>
++Params: pin_a                   GPIO connected to rotary encoder channel A
++                                (default 4).
++        pin_b                   GPIO connected to rotary encoder channel B
++                                (default 17).
++        relative_axis           register a relative axis rather than an
++                                absolute one. Relative axis will only
++                                generate +1/-1 events on the input device,
++                                hence no steps need to be passed.
++        linux_axis              the input subsystem axis to map to this
++                                rotary encoder. Defaults to 0 (ABS_X / REL_X)
++        rollover                Automatic rollover when the rotary value
++                                becomes greater than the specified steps or
++                                smaller than 0. For absolute axis only.
++        steps-per-period        Number of steps (stable states) per period.
++                                The values have the following meaning:
++                                1: Full-period mode (default)
++                                2: Half-period mode
++                                4: Quarter-period mode
++        steps                   Number of steps in a full turnaround of the
++                                encoder. Only relevant for absolute axis.
++                                Defaults to 24 which is a typical value for
++                                such devices.
++        wakeup                  Boolean, rotary encoder can wake up the
++                                system.
++        encoding                String, the method used to encode steps.
++                                Supported are "gray" (the default and more
++                                common) and "binary".
++
++
++Name:   rpi-backlight
++Info:   Raspberry Pi official display backlight driver
++Load:   dtoverlay=rpi-backlight
++Params: <None>
++
++
++Name:   rpi-cirrus-wm5102
++Info:   This overlay has been renamed to cirrus-wm5102
++Load:   <Deprecated>
++
++
++Name:   rpi-codeczero
++Info:   Configures the Raspberry Pi Codec Zero sound card
++Load:   dtoverlay=rpi-codeczero
++Params: <None>
++
++
++Name:   rpi-dac
++Info:   This overlay has been renamed to i2s-dac.
++Load:   <Deprecated>
++
++
++Name:   rpi-dacplus
++Info:   Configures the Raspberry Pi DAC+ card
++Load:   dtoverlay=rpi-dacplus,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                digital volume control. Enable by adding
++                                "dtparam=24db_digital_gain" to config.txt
++                                before any "dtoverlay" lines.
++                                The default behaviour is that the digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24db_digital_gain parameter, the digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the digital volume control is set to a value
++                                that does not result in clipping/distortion!
++
++
++Name:   rpi-dacpro
++Info:   Configures the Raspberry Pi DAC Pro sound card
++Load:   dtoverlay=rpi-dacpro,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                digital volume control. Enable by adding
++                                "dtparam=24db_digital_gain" to config.txt
++                                before any "dtoverlay" lines.
++                                The default behaviour is that the digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24db_digital_gain parameter, the digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the digital volume control is set to a value
++                                that does not result in clipping/distortion!
++
++
++Name:   rpi-digiampplus
++Info:   Configures the Raspberry Pi DigiAMP+ sound card
++Load:   dtoverlay=rpi-digiampplus,<param>=<val>
++Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
++                                digital volume control. Enable by adding
++                                "dtparam=24db_digital_gain" to config.txt
++                                before any "dtoverlay" lines.
++                                The default behaviour is that the digital
++                                volume control is limited to a maximum of
++                                0dB. ie. it can attenuate but not provide
++                                gain. For most users, this will be desired
++                                as it will prevent clipping. By appending
++                                the 24db_digital_gain parameter, the digital
++                                volume control will allow up to 24dB of
++                                gain. If this parameter is enabled, it is the
++                                responsibility of the user to ensure that
++                                the digital volume control is set to a value
++                                that does not result in clipping/distortion!
++        auto_mute_amp           If specified, unmute/mute the DigiAMP+ when
++                                starting/stopping audio playback (default "on").
++        unmute_amp              If specified, unmute the DigiAMP+ amp once when
++                                the DAC driver module loads (default "off").
++
++
++Name:   rpi-display
++Info:   This overlay has been renamed to watterott-display
++Load:   <Deprecated>
++
++
++Name:   rpi-ft5406
++Info:   Official Raspberry Pi display touchscreen
++Load:   dtoverlay=rpi-ft5406,<param>=<val>
++Params: touchscreen-size-x      Touchscreen X resolution (default 800)
++        touchscreen-size-y      Touchscreen Y resolution (default 480);
++        touchscreen-inverted-x  Invert touchscreen X coordinates (default 0);
++        touchscreen-inverted-y  Invert touchscreen Y coordinates (default 0);
++        touchscreen-swapped-x-y Swap X and Y cordinates (default 0);
++
++
++Name:   rpi-poe
++Info:   Raspberry Pi PoE HAT fan
++Load:   dtoverlay=rpi-poe,<param>[=<val>]
++Params: poe_fan_temp0           Temperature (in millicelcius) at which the fan
++                                turns on (default 40000)
++        poe_fan_temp0_hyst      Temperature delta (in millicelcius) at which
++                                the fan turns off (default 2000)
++        poe_fan_temp1           Temperature (in millicelcius) at which the fan
++                                speeds up (default 45000)
++        poe_fan_temp1_hyst      Temperature delta (in millicelcius) at which
++                                the fan slows down (default 2000)
++        poe_fan_temp2           Temperature (in millicelcius) at which the fan
++                                speeds up (default 50000)
++        poe_fan_temp2_hyst      Temperature delta (in millicelcius) at which
++                                the fan slows down (default 2000)
++        poe_fan_temp3           Temperature (in millicelcius) at which the fan
++                                speeds up (default 55000)
++        poe_fan_temp3_hyst      Temperature delta (in millicelcius) at which
++                                the fan slows down (default 5000)
++        i2c                     Control the fan via Linux I2C drivers instead of
++                                the firmware.
++
++
++Name:   rpi-poe-plus
++Info:   Raspberry Pi PoE+ HAT fan
++Load:   dtoverlay=rpi-poe-plus,<param>[=<val>]
++Params: poe_fan_temp0           Temperature (in millicelcius) at which the fan
++                                turns on (default 40000)
++        poe_fan_temp0_hyst      Temperature delta (in millicelcius) at which
++                                the fan turns off (default 2000)
++        poe_fan_temp1           Temperature (in millicelcius) at which the fan
++                                speeds up (default 45000)
++        poe_fan_temp1_hyst      Temperature delta (in millicelcius) at which
++                                the fan slows down (default 2000)
++        poe_fan_temp2           Temperature (in millicelcius) at which the fan
++                                speeds up (default 50000)
++        poe_fan_temp2_hyst      Temperature delta (in millicelcius) at which
++                                the fan slows down (default 2000)
++        poe_fan_temp3           Temperature (in millicelcius) at which the fan
++                                speeds up (default 55000)
++        poe_fan_temp3_hyst      Temperature delta (in millicelcius) at which
++                                the fan slows down (default 5000)
++        i2c                     Control the fan via Linux I2C drivers instead of
++                                the firmware.
++
++
++Name:   rpi-proto
++Info:   This overlay has been renamed to proto-codec.
++Load:   <Deprecated>
++
++
++Name:   rpi-sense
++Info:   Raspberry Pi Sense HAT
++Load:   dtoverlay=rpi-sense
++Params: <None>
++
++
++Name:   rpi-sense-v2
++Info:   Raspberry Pi Sense HAT v2
++Load:   dtoverlay=rpi-sense-v2
++Params: <None>
++
++
++Name:   rpi-tv
++Info:   Raspberry Pi TV HAT
++Load:   dtoverlay=rpi-tv
++Params: <None>
++
++
++Name:   rpivid-v4l2
++Info:   This overlay has been deprecated and deleted as the V4L2 stateless
++        video decoder driver is enabled by default.
++Load:   <Deprecated>
++
++
++Name:   rra-digidac1-wm8741-audio
++Info:   Configures the Red Rocks Audio DigiDAC1 soundcard
++Load:   dtoverlay=rra-digidac1-wm8741-audio
++Params: <None>
++
++
++Name:   sainsmart18
++Info:   Overlay for the SPI-connected Sainsmart 1.8" display (based on the
++        ST7735R chip).
++Load:   dtoverlay=sainsmart18,<param>=<val>
++Params: rotate                  Display rotation {0,90,180,270}
++        speed                   SPI bus speed in Hz (default 4000000)
++        fps                     Display frame rate in Hz
++        bgr                     Enable BGR mode (default off)
++        debug                   Debug output level {0-7}
++        dc_pin                  GPIO pin for D/C (default 24)
++        reset_pin               GPIO pin for RESET (default 25)
++
++
++Name:   sc16is750-i2c
++Info:   Overlay for the NXP SC16IS750 UART with I2C Interface
++        Enables the chip on I2C1 at 0x48 (or the "addr" parameter value). To
++        select another address, please refer to table 10 in reference manual.
++Load:   dtoverlay=sc16is750-i2c,<param>=<val>
++Params: int_pin                 GPIO used for IRQ (default 24)
++        addr                    Address (default 0x48)
++        xtal                    On-board crystal frequency (default 14745600)
++
++
++Name:   sc16is750-spi0
++Info:   Overlay for the NXP SC16IS750 UART with SPI Interface
++        Enables the chip on SPI0.
++Load:   dtoverlay=sc16is750-spi0,<param>=<val>
++Params: int_pin                 GPIO used for IRQ (default 24)
++        xtal                    On-board crystal frequency (default 14745600)
++
++
++Name:   sc16is752-i2c
++Info:   Overlay for the NXP SC16IS752 dual UART with I2C Interface
++        Enables the chip on I2C1 at 0x48 (or the "addr" parameter value). To
++        select another address, please refer to table 10 in reference manual.
++Load:   dtoverlay=sc16is752-i2c,<param>=<val>
++Params: int_pin                 GPIO used for IRQ (default 24)
++        addr                    Address (default 0x48)
++        xtal                    On-board crystal frequency (default 14745600)
++
++
++Name:   sc16is752-spi0
++Info:   Overlay for the NXP SC16IS752 Dual UART with SPI Interface
++        Enables the chip on SPI0.
++Load:   dtoverlay=sc16is752-spi0,<param>=<val>
++Params: int_pin                 GPIO used for IRQ (default 24)
++        xtal                    On-board crystal frequency (default 14745600)
++
++
++Name:   sc16is752-spi1
++Info:   Overlay for the NXP SC16IS752 Dual UART with SPI Interface
++        Enables the chip on SPI1.
++        N.B.: spi1 is only accessible on devices with a 40pin header, eg:
++              A+, B+, Zero and PI2 B; as well as the Compute Module.
++
++Load:   dtoverlay=sc16is752-spi1,<param>=<val>
++Params: int_pin                 GPIO used for IRQ (default 24)
++        xtal                    On-board crystal frequency (default 14745600)
++
++
++Name:   sdhost
++Info:   Selects the bcm2835-sdhost SD/MMC driver, optionally with overclock.
++        N.B. This overlay is designed for situations where the mmc driver is
++        the default, so it disables the other (mmc) interface - this will kill
++        WLAN on a Pi3. If this isn't what you want, either use the sdtweak
++        overlay or the new sd_* dtparams of the base DTBs.
++Load:   dtoverlay=sdhost,<param>=<val>
++Params: overclock_50            Clock (in MHz) to use when the MMC framework
++                                requests 50MHz
++
++        force_pio               Disable DMA support (default off)
++
++        pio_limit               Number of blocks above which to use DMA
++                                (default 1)
++
++        debug                   Enable debug output (default off)
++
++
++Name:   sdio
++Info:   Selects the bcm2835-sdhost SD/MMC driver, optionally with overclock,
++        and enables SDIO via GPIOs 22-27. An example of use in 1-bit mode is
++        "dtoverlay=sdio,bus_width=1,gpios_22_25"
++Load:   dtoverlay=sdio,<param>=<val>
++Params: sdio_overclock          SDIO Clock (in MHz) to use when the MMC
++                                framework requests 50MHz
++
++        poll_once               Disable SDIO-device polling every second
++                                (default on: polling once at boot-time)
++
++        bus_width               Set the SDIO host bus width (default 4 bits)
++
++        gpios_22_25             Select GPIOs 22-25 for 1-bit mode. Must be used
++                                with bus_width=1. This replaces the sdio-1bit
++                                overlay, which is now deprecated.
++
++        gpios_34_37             Select GPIOs 34-37 for 1-bit mode. Must be used
++                                with bus_width=1.
++
++        gpios_34_39             Select GPIOs 34-39 for 4-bit mode. Must be used
++                                with bus_width=4 (the default).
++
++
++Name:   sdio-1bit
++Info:   This overlay is now deprecated. Use
++        "dtoverlay=sdio,bus_width=1,gpios_22_25" instead.
++Load:   <Deprecated>
++
++
++Name:   sdio-pi5
++Info:   Selects the rp1_mmc0 interface and enables it on GPIOs 22-27.
++        Pi 5 only.
++Load:   dtoverlay=sdio-pi5
++Params: <None>
++
++
++Name:   sdtweak
++Info:   This overlay is now deprecated. Use the sd_* dtparams in the
++        base DTB, e.g. "dtoverlay=sdtweak,poll_once" becomes
++        "dtparam=sd_poll_once".
++Load:   <Deprecated>
++
++
++Name:   seeed-can-fd-hat-v1
++Info:   Overlay for Seeed Studio CAN BUS FD HAT with two CAN FD
++        channels without RTC. Use this overlay if your HAT has no
++        battery holder.
++        https://www.seeedstudio.com/2-Channel-CAN-BUS-FD-Shield-for-Raspberry-Pi-p-4072.html
++Load:   dtoverlay=seeed-can-fd-hat-v1
++Params: <None>
++
++
++Name:   seeed-can-fd-hat-v2
++Info:   Overlay for Seeed Studio CAN BUS FD HAT with two CAN FD
++        channels and an RTC. Use this overlay if your HAT has a
++        battery holder.
++        https://www.seeedstudio.com/CAN-BUS-FD-HAT-for-Raspberry-Pi-p-4742.html
++Load:   dtoverlay=seeed-can-fd-hat-v2
++Params: <None>
++
++
++Name:   sh1106-spi
++Info:   Overlay for SH1106 OLED via SPI using fbtft staging driver.
++Load:   dtoverlay=sh1106-spi,<param>=<val>
++Params: speed                   SPI bus speed (default 4000000)
++        rotate                  Display rotation (0, 90, 180 or 270; default 0)
++        fps                     Delay between frame updates (default 25)
++        debug                   Debug output level (0-7; default 0)
++        dc_pin                  GPIO pin for D/C (default 24)
++        reset_pin               GPIO pin for RESET (default 25)
++        height                  Display height (32 or 64; default 64)
++
++
++Name:   si446x-spi0
++Info:   Overlay for Si446x UHF Transceiver via SPI using si446x driver.
++        The driver is currently out-of-tree at
++        https://github.com/sunipkmukherjee/silabs.git
++Load:   dtoverlay=si446x-spi0,<param>=<val>
++Params: speed                   SPI bus speed (default 4000000)
++        int_pin                 GPIO pin for interrupts (default 17)
++        reset_pin               GPIO pin for RESET (default 27)
++
++
++Name:   smi
++Info:   Enables the Secondary Memory Interface peripheral. Uses GPIOs 2-25!
++Load:   dtoverlay=smi
++Params: <None>
++
++
++Name:   smi-dev
++Info:   Enables the userspace interface for the SMI driver
++Load:   dtoverlay=smi-dev
++Params: <None>
++
++
++Name:   smi-nand
++Info:   Enables access to NAND flash via the SMI interface
++Load:   dtoverlay=smi-nand
++Params: <None>
++
++
++Name:   spi-gpio35-39
++Info:   Move SPI function block to GPIO 35 to 39
++Load:   dtoverlay=spi-gpio35-39
++Params: <None>
++
++
++Name:   spi-gpio40-45
++Info:   Move SPI function block to GPIOs 40 to 45
++Load:   dtoverlay=spi-gpio40-45
++Params: <None>
++
++
++Name:   spi-rtc
++Info:   Adds support for a number of SPI Real Time Clock devices
++Load:   dtoverlay=spi-rtc,<param>=<val>
++Params: ds3232                  Select the DS3232 device
++        ds3234                  Select the DS3234 device
++        pcf2123                 Select the PCF2123 device
++
++        spi0_0                  Use spi0.0 (default)
++        spi0_1                  Use spi0.1
++        spi1_0                  Use spi1.0
++        spi1_1                  Use spi1.1
++        spi2_0                  Use spi2.0
++        spi2_1                  Use spi2.1
++        cs_high                 This device requires an active-high CS
++
++
++Name:   spi0-0cs
++Info:   Don't claim any CS pins for SPI0. Requires a device with its chip
++        select permanently enabled, but frees a GPIO for e.g. a DPI display.
++Load:   dtoverlay=spi0-0cs,<param>=<val>
++Params: no_miso                 Don't claim and use the MISO pin (9), freeing
++                                it for other uses.
++
++
++Name:   spi0-1cs
++Info:   Only use one CS pin for SPI0
++Load:   dtoverlay=spi0-1cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 8)
++        no_miso                 Don't claim and use the MISO pin (9), freeing
++                                it for other uses.
++
++
++Name:   spi0-2cs
++Info:   Change the CS pins for SPI0
++Load:   dtoverlay=spi0-2cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 8)
++        cs1_pin                 GPIO pin for CS1 (default 7)
++        no_miso                 Don't claim and use the MISO pin (9), freeing
++                                it for other uses.
++
++
++Name:   spi0-cs
++Info:   This overlay has been renamed spi0-2cs, keeping spi0-cs as an
++        alias for backwards compatibility.
++Load:   <Deprecated>
++
++
++Name:   spi0-hw-cs
++Info:   This overlay has been deprecated and removed because it is no longer
++        necessary and has been seen to prevent spi0 from working.
++Load:   <Deprecated>
++
++
++Name:   spi1-1cs
++Info:   Enables spi1 with a single chip select (CS) line and associated spidev
++        dev node. The gpio pin number for the CS line and spidev device node
++        creation are configurable.
++        N.B.: spi1 is not accessible on old Pis without a 40-pin header.
++Load:   dtoverlay=spi1-1cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 18 - BCM SPI1_CE0).
++        cs0_spidev              Set to 'off' to stop the creation of a
++                                userspace device node /dev/spidev1.0 (default
++                                is 'on' or enabled).
++
++
++Name:   spi1-2cs
++Info:   Enables spi1 with two chip select (CS) lines and associated spidev
++        dev nodes. The gpio pin numbers for the CS lines and spidev device node
++        creation are configurable.
++        N.B.: spi1 is not accessible on old Pis without a 40-pin header.
++Load:   dtoverlay=spi1-2cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 18 - BCM SPI1_CE0).
++        cs1_pin                 GPIO pin for CS1 (default 17 - BCM SPI1_CE1).
++        cs0_spidev              Set to 'off' to stop the creation of a
++                                userspace device node /dev/spidev1.0 (default
++                                is 'on' or enabled).
++        cs1_spidev              Set to 'off' to stop the creation of a
++                                userspace device node /dev/spidev1.1 (default
++                                is 'on' or enabled).
++
++
++Name:   spi1-3cs
++Info:   Enables spi1 with three chip select (CS) lines and associated spidev
++        dev nodes. The gpio pin numbers for the CS lines and spidev device node
++        creation are configurable.
++        N.B.: spi1 is not accessible on old Pis without a 40-pin header.
++Load:   dtoverlay=spi1-3cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 18 - BCM SPI1_CE0).
++        cs1_pin                 GPIO pin for CS1 (default 17 - BCM SPI1_CE1).
++        cs2_pin                 GPIO pin for CS2 (default 16 - BCM SPI1_CE2).
++        cs0_spidev              Set to 'off' to stop the creation of a
++                                userspace device node /dev/spidev1.0 (default
++                                is 'on' or enabled).
++        cs1_spidev              Set to 'off' to stop the creation of a
++                                userspace device node /dev/spidev1.1 (default
++                                is 'on' or enabled).
++        cs2_spidev              Set to 'off' to stop the creation of a
++                                userspace device node /dev/spidev1.2 (default
++                                is 'on' or enabled).
++
++
++Name:   spi2-1cs
++Info:   Enables spi2 on GPIOs 40-42 with a single chip select (CS) line and
++        associated spidev dev node. The gpio pin number for the CS line and
++        spidev device node creation are configurable. spi2-2cs-pi5 is
++        substituted on a Pi 5.
++        N.B.: spi2 is only accessible with the Compute Module or Pi 5.
++Load:   dtoverlay=spi2-1cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 43 - BCM SPI2_CE0).
++        cs0_spidev              Set to 'off' to stop the creation of a
++                                userspace device node /dev/spidev2.0 (default
++                                is 'on' or enabled).
++
++
++Name:   spi2-1cs-pi5
++Info:   Enables spi2 on GPIOs 1-3 with a single chip select (CS) line and
++        associated spidev dev node. The gpio pin number for the CS line and
++        spidev device node creation are configurable. Pi 5 only.
++Load:   dtoverlay=spi2-1cs-pi5,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 0).
++        cs0_spidev              Set to 'off' to stop the creation of a
++                                userspace device node /dev/spidev2.0 (default
++                                is 'on' or enabled).
++
++
++Name:   spi2-2cs
++Info:   Enables spi2 on GPIOs 40-42 with two chip select (CS) lines and
++        associated spidev dev nodes. The gpio pin numbers for the CS lines and
++        spidev device node creation are configurable. spi2-2cs-pi5 is
++        substituted on a Pi 5.
++        N.B.: spi2 is only accessible with the Compute Module or Pi 5.
++Load:   dtoverlay=spi2-2cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 43 - BCM SPI2_CE0).
++        cs1_pin                 GPIO pin for CS1 (default 44 - BCM SPI2_CE1).
++        cs0_spidev              Set to 'off' to stop the creation of a
++                                userspace device node /dev/spidev2.0 (default
++                                is 'on' or enabled).
++        cs1_spidev              Set to 'off' to stop the creation of a
++                                userspace device node /dev/spidev2.1 (default
++                                is 'on' or enabled).
++
++
++Name:   spi2-2cs-pi5
++Info:   Enables spi2 on GPIOs 1-3 with two chip select (CS) lines and
++        associated spidev dev nodes. The gpio pin numbers for the CS lines and
++        spidev device node creation are configurable. Pi 5 only.
++Load:   dtoverlay=spi2-2cs-pi5,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 0).
++        cs1_pin                 GPIO pin for CS1 (default 24).
++        cs0_spidev              Set to 'off' to stop the creation of a
++                                userspace device node /dev/spidev2.0 (default
++                                is 'on' or enabled).
++        cs1_spidev              Set to 'off' to stop the creation of a
++                                userspace device node /dev/spidev2.1 (default
++                                is 'on' or enabled).
++
++
++Name:   spi2-3cs
++Info:   Enables spi2 on GPIOs 40-42 with three chip select (CS) lines and
++        associated spidev dev nodes. The gpio pin numbers for the CS lines and
++        spidev device node creation are configurable.
++        N.B.: spi2 is only accessible with the Compute Module or Pi 5.
++Load:   dtoverlay=spi2-3cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 43 - BCM SPI2_CE0).
++        cs1_pin                 GPIO pin for CS1 (default 44 - BCM SPI2_CE1).
++        cs2_pin                 GPIO pin for CS2 (default 45 - BCM SPI2_CE2).
++        cs0_spidev              Set to 'off' to stop the creation of a
++                                userspace device node /dev/spidev2.0 (default
++                                is 'on' or enabled).
++        cs1_spidev              Set to 'off' to stop the creation of a
++                                userspace device node /dev/spidev2.1 (default
++                                is 'on' or enabled).
++        cs2_spidev              Set to 'off' to stop the creation of a
++                                userspace device node /dev/spidev2.2 (default
++                                is 'on' or enabled).
++
++
++Name:   spi3-1cs
++Info:   Enables spi3 on GPIOs 1-3 with a single chip select (CS) line and
++        associated spidev dev node. The gpio pin number for the CS line and
++        spidev device node creation are configurable. BCM2711 only,
++        spi3-1cs-pi5 is substituted on Pi 5.
++Load:   dtoverlay=spi3-1cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 0 - BCM SPI3_CE0).
++        cs0_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev3.0 (default
++                                is 'on' or enabled).
++
++
++Name:   spi3-1cs-pi5
++Info:   Enables spi3 on GPIOs 5-7 with a single chip select (CS) line and
++        associated spidev dev node. The gpio pin number for the CS line and
++        spidev device node creation are configurable. Pi 5 only.
++Load:   dtoverlay=spi3-1cs-pi5,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 4).
++        cs0_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev3.0 (default
++                                is 'on' or enabled).
++
++
++Name:   spi3-2cs
++Info:   Enables spi3 on GPIO2 1-3 with two chip select (CS) lines and
++        associated spidev dev nodes. The gpio pin numbers for the CS lines and
++        spidev device node creation are configurable. BCM2711 only,
++        spi3-2cs-pi5 is substituted on Pi 5.
++Load:   dtoverlay=spi3-2cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 0 - BCM SPI3_CE0).
++        cs1_pin                 GPIO pin for CS1 (default 24 - BCM SPI3_CE1).
++        cs0_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev3.0 (default
++                                is 'on' or enabled).
++        cs1_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev3.1 (default
++                                is 'on' or enabled).
++
++
++Name:   spi3-2cs-pi5
++Info:   Enables spi3 on GPIOs 5-7 with two chip select (CS) lines and
++        associated spidev dev nodes. The gpio pin numbers for the CS lines and
++        spidev device node creation are configurable. Pi 5 only.
++Load:   dtoverlay=spi3-2cs-pi5,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 4).
++        cs1_pin                 GPIO pin for CS1 (default 25).
++        cs0_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev3.0 (default
++                                is 'on' or enabled).
++        cs1_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev3.1 (default
++                                is 'on' or enabled).
++
++
++Name:   spi4-1cs
++Info:   Enables spi4 on GPIOs 5-7 with a single chip select (CS) line and
++        associated spidev dev node. The gpio pin number for the CS line and
++        spidev device node creation are configurable. BCM2711 only.
++Load:   dtoverlay=spi4-1cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 4 - BCM SPI4_CE0).
++        cs0_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev4.0 (default
++                                is 'on' or enabled).
++
++
++Name:   spi4-2cs
++Info:   Enables spi4 on GPIOs 5-6 with two chip select (CS) lines and
++        associated spidev dev nodes. The gpio pin numbers for the CS lines and
++        spidev device node creation are configurable. BCM2711 only.
++Load:   dtoverlay=spi4-2cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 4 - BCM SPI4_CE0).
++        cs1_pin                 GPIO pin for CS1 (default 25 - BCM SPI4_CE1).
++        cs0_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev4.0 (default
++                                is 'on' or enabled).
++        cs1_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev4.1 (default
++                                is 'on' or enabled).
++
++
++Name:   spi5-1cs
++Info:   Enables spi5 on GPIOs 13-15 with a single chip select (CS) line and
++        associated spidev dev node. The gpio pin numbers for the CS lines and
++        spidev device node creation are configurable. BCM2711 and Pi 5.
++Load:   dtoverlay=spi5-1cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 12).
++        cs0_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev5.0 (default
++                                is 'on' or enabled).
++
++
++Name:   spi5-1cs-pi5
++Info:   See spi5-1cs
++
++
++Name:   spi5-2cs
++Info:   Enables spi5 on GPIOs 13-15 with two chip select (CS) lines and
++        associated spidev dev nodes. The gpio pin numbers for the CS lines and
++        spidev device node creation are configurable. BCM2711 and Pi 5.
++Load:   dtoverlay=spi5-2cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 12).
++        cs1_pin                 GPIO pin for CS1 (default 26).
++        cs0_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev5.0 (default
++                                is 'on' or enabled).
++        cs1_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev5.1 (default
++                                is 'on' or enabled).
++
++
++Name:   spi5-2cs-pi5
++Info:   See spi5-2cs
++
++
++Name:   spi6-1cs
++Info:   Enables spi6 with a single chip select (CS) line and associated spidev
++        dev node. The gpio pin number for the CS line and spidev device node
++        creation are configurable. BCM2711 only.
++Load:   dtoverlay=spi6-1cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 18 - BCM SPI6_CE0).
++        cs0_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev6.0 (default
++                                is 'on' or enabled).
++
++
++Name:   spi6-2cs
++Info:   Enables spi6 with two chip select (CS) lines and associated spidev
++        dev nodes. The gpio pin numbers for the CS lines and spidev device node
++        creation are configurable. BCM2711 only.
++Load:   dtoverlay=spi6-2cs,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 18 - BCM SPI6_CE0).
++        cs1_pin                 GPIO pin for CS1 (default 27 - BCM SPI6_CE1).
++        cs0_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev6.0 (default
++                                is 'on' or enabled).
++        cs1_spidev              Set to 'off' to prevent the creation of a
++                                userspace device node /dev/spidev6.1 (default
++                                is 'on' or enabled).
++
++
++Name:   ssd1306
++Info:   Overlay for activation of SSD1306 over I2C OLED display framebuffer.
++Load:   dtoverlay=ssd1306,<param>=<val>
++Params: address                 Location in display memory of first character.
++                                (default=0)
++        width                   Width of display. (default=128)
++        height                  Height of display. (default=64)
++        offset                  virtual channel a. (default=0)
++        normal                  Has no effect on displays tested. (default=not
++                                set)
++        sequential              Set this if every other scan line is missing.
++                                (default=not set)
++        remapped                Set this if display is garbled. (default=not
++                                set)
++        inverted                Set this if display is inverted and mirrored.
++                                (default=not set)
++
++        Examples:
++        Typical usage for 128x64 display: dtoverlay=ssd1306,inverted
++
++        Typical usage for 128x32 display: dtoverlay=ssd1306,inverted,sequential
++
++        i2c_baudrate=400000 will speed up the display.
++
++        i2c_baudrate=1000000 seems to work even though it's not officially
++        supported by the hardware, and is faster still.
++
++        For more information refer to the device datasheet at:
++        https://cdn-shop.adafruit.com/datasheets/SSD1306.pdf
++
++
++Name:   ssd1306-spi
++Info:   Overlay for SSD1306 OLED via SPI using fbtft staging driver.
++Load:   dtoverlay=ssd1306-spi,<param>=<val>
++Params: speed                   SPI bus speed (default 10000000)
++        rotate                  Display rotation (0, 90, 180 or 270; default 0)
++        fps                     Delay between frame updates (default 25)
++        debug                   Debug output level (0-7; default 0)
++        dc_pin                  GPIO pin for D/C (default 24)
++        reset_pin               GPIO pin for RESET (default 25)
++        height                  Display height (32 or 64; default 64)
++        inverted                Set this if display is inverted and mirrored.
++                                (default=not set)
++
++
++Name:   ssd1327-spi
++Info:   Overlay for SSD1327 OLED via SPI using the DRM ssd130x driver.
++Load:   dtoverlay=ssd1327-spi,<param>=<val>
++Params: speed                   SPI bus speed (default 4500000)
++        dc_pin                  GPIO pin for D/C (default 24)
++        reset_pin               GPIO pin for RESET (default 25)
++
++
++Name:   ssd1331-spi
++Info:   Overlay for SSD1331 OLED via SPI using fbtft staging driver.
++Load:   dtoverlay=ssd1331-spi,<param>=<val>
++Params: speed                   SPI bus speed (default 4500000)
++        rotate                  Display rotation (0, 90, 180 or 270; default 0)
++        fps                     Delay between frame updates (default 25)
++        debug                   Debug output level (0-7; default 0)
++        dc_pin                  GPIO pin for D/C (default 24)
++        reset_pin               GPIO pin for RESET (default 25)
++
++
++Name:   ssd1351-spi
++Info:   Overlay for SSD1351 OLED via SPI using fbtft staging driver.
++Load:   dtoverlay=ssd1351-spi,<param>=<val>
++Params: speed                   SPI bus speed (default 4500000)
++        rotate                  Display rotation (0, 90, 180 or 270; default 0)
++        fps                     Delay between frame updates (default 25)
++        debug                   Debug output level (0-7; default 0)
++        dc_pin                  GPIO pin for D/C (default 24)
++        reset_pin               GPIO pin for RESET (default 25)
++
++
++Name:   sunfounder-pipower3
++Info:   Overlay for SunFounder PiPower 3
++Load:   dtoverlay=sunfounder-pipower3,<param>=<val>
++Params: poweroff_pin            Change poweroff pin (default 26)
++
++
++Name:   sunfounder-pironman5
++Info:   Overlay for SunFounder Pironman 5
++Load:   dtoverlay=sunfounder-pironman5,<param>=<val>
++Params: ir                      Enable IR or not (on or off, default on)
++        ir_pins                 Change IR receiver pin (default 13)
++
++
++Name:   superaudioboard
++Info:   Configures the SuperAudioBoard sound card
++Load:   dtoverlay=superaudioboard,<param>=<val>
++Params: gpiopin                 GPIO pin for codec reset
++
++
++Name:   sx150x
++Info:   Configures the Semtech SX150X I2C GPIO expanders.
++Load:   dtoverlay=sx150x,<param>=<val>
++Params: sx150<x>-<n>-<m>        Enables SX150X device on I2C#<n> with slave
++                                address <m>. <x> may be 1-9. <n> may be 0 or 1.
++                                Permissible values of <m> (which is denoted in
++                                hex) depend on the device variant. For SX1501,
++                                SX1502, SX1504 and SX1505, <m> may be 20 or 21.
++                                For SX1503 and SX1506, <m> may be 20. For
++                                SX1507 and SX1509, <m> may be 3E, 3F, 70 or 71.
++                                For SX1508, <m> may be 20, 21, 22 or 23.
++
++        sx150<x>-<n>-<m>-int-gpio
++                                Integer, enables interrupts on SX150X device on
++                                I2C#<n> with slave address <m>, specifies
++                                the GPIO pin to which NINT output of SX150X is
++                                connected.
++
++
++Name:   tc358743
++Info:   Toshiba TC358743 HDMI to CSI-2 bridge chip.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants.
++Load:   dtoverlay=tc358743,<param>=<val>
++Params: 4lane                   Use 4 lanes (only applicable to Compute Modules
++                                CAM1 connector).
++
++        link-frequency          Set the link frequency. Only values of 297000000
++                                (574Mbit/s) and 486000000 (972Mbit/s - default)
++                                are supported by the driver.
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default off)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++
++
++Name:   tc358743-audio
++Info:   Used in combination with the tc358743-fast overlay to route the audio
++        from the TC358743 over I2S to the Pi.
++        Wiring is LRCK/WFS to GPIO 19, BCK/SCK to GPIO 18, and DATA/SD to GPIO
++        20.
++Load:   dtoverlay=tc358743-audio,<param>=<val>
++Params: card-name               Override the default, "tc358743", card name.
++
++
++Name:   tinylcd35
++Info:   3.5" Color TFT Display by www.tinylcd.com
++        Options: Touch, RTC, keypad
++Load:   dtoverlay=tinylcd35,<param>=<val>
++Params: speed                   Display SPI bus speed
++
++        rotate                  Display rotation {0,90,180,270}
++
++        fps                     Delay between frame updates
++
++        debug                   Debug output level {0-7}
++
++        touch                   Enable touch panel
++
++        touchgpio               Touch controller IRQ GPIO
++
++        xohms                   Touchpanel: Resistance of X-plate in ohms
++
++        rtc-pcf                 PCF8563 Real Time Clock
++
++        rtc-ds                  DS1307 Real Time Clock
++
++        keypad                  Enable keypad
++
++        Examples:
++            Display with touchpanel, PCF8563 RTC and keypad:
++                dtoverlay=tinylcd35,touch,rtc-pcf,keypad
++            Old touch display:
++                dtoverlay=tinylcd35,touch,touchgpio=3
++
++
++Name:   tpm-slb9670
++Info:   Enables support for Infineon SLB9670 Trusted Platform Module add-on
++        boards, which can be used as a secure key storage and hwrng,
++        available as "Iridium SLB9670" by Infineon and "LetsTrust TPM" by pi3g.
++Load:   dtoverlay=tpm-slb9670
++Params: <None>
++
++
++Name:   tpm-slb9673
++Info:   Enables support for Infineon SLB9673 Trusted Platform Module add-on
++        boards, which can be used as a secure key storage and hwrng
++        via the I2C protocol.
++Load:   dtoverlay=tpm-slb9673
++Params: <None>
++
++
++Name:   uart0
++Info:   Change the pin usage of uart0
++Load:   dtoverlay=uart0,<param>=<val>
++Params: txd0_pin                GPIO pin for TXD0 (14, 32 or 36 - default 14)
++
++        rxd0_pin                GPIO pin for RXD0 (15, 33 or 37 - default 15)
++
++        pin_func                Alternative pin function - 4(Alt0) for 14&15,
++                                7(Alt3) for 32&33, 6(Alt2) for 36&37
++
++
++Name:   uart0-pi5
++Info:   Enable uart 0 on GPIOs 14-15. Pi 5 only.
++Load:   dtoverlay=uart0-pi5,<param>
++Params: ctsrts                  Enable CTS/RTS on GPIOs 16-17 (default off)
++
++
++Name:   uart1
++Info:   Change the pin usage of uart1
++Load:   dtoverlay=uart1,<param>=<val>
++Params: txd1_pin                GPIO pin for TXD1 (14, 32 or 40 - default 14)
++
++        rxd1_pin                GPIO pin for RXD1 (15, 33 or 41 - default 15)
++
++
++Name:   uart1-pi5
++Info:   Enable uart 1 on GPIOs 0-1. Pi 5 only.
++Load:   dtoverlay=uart1-pi5,<param>
++Params: ctsrts                  Enable CTS/RTS on GPIOs 2-3 (default off)
++
++
++Name:   uart2
++Info:   Enable uart 2 on GPIOs 0-3. BCM2711 only.
++Load:   dtoverlay=uart2,<param>
++Params: ctsrts                  Enable CTS/RTS on GPIOs 2-3 (default off)
++
++
++Name:   uart2-pi5
++Info:   Enable uart 2 on GPIOs 4-5. Pi 5 only.
++Load:   dtoverlay=uart2-pi5,<param>
++Params: ctsrts                  Enable CTS/RTS on GPIOs 6-7 (default off)
++
++
++Name:   uart3
++Info:   Enable uart 3 on GPIOs 4-7. BCM2711 only.
++Load:   dtoverlay=uart3,<param>
++Params: ctsrts                  Enable CTS/RTS on GPIOs 6-7 (default off)
++
++
++Name:   uart3-pi5
++Info:   Enable uart 3 on GPIOs 8-9. Pi 5 only.
++Load:   dtoverlay=uart3-pi5,<param>
++Params: ctsrts                  Enable CTS/RTS on GPIOs 10-11 (default off)
++
++
++Name:   uart4
++Info:   Enable uart 4 on GPIOs 8-11. BCM2711 only.
++Load:   dtoverlay=uart4,<param>
++Params: ctsrts                  Enable CTS/RTS on GPIOs 10-11 (default off)
++
++
++Name:   uart4-pi5
++Info:   Enable uart 4 on GPIOs 12-13. Pi 5 only.
++Load:   dtoverlay=uart4-pi5,<param>
++Params: ctsrts                  Enable CTS/RTS on GPIOs 14-15 (default off)
++
++
++Name:   uart5
++Info:   Enable uart 5 on GPIOs 12-15. BCM2711 only.
++Load:   dtoverlay=uart5,<param>
++Params: ctsrts                  Enable CTS/RTS on GPIOs 14-15 (default off)
++
++
++Name:   udrc
++Info:   Configures the NW Digital Radio UDRC Hat
++Load:   dtoverlay=udrc,<param>=<val>
++Params: alsaname                Name of the ALSA audio device (default "udrc")
++
++
++Name:   ugreen-dabboard
++Info:   Configures the ugreen-dabboard I2S overlay
++        This is a simple overlay based on the simple-audio-card and the dmic
++        codec. It has the speciality that it is configured to use the codec
++        as a master I2S device. It works for example with the Si468x DAB
++        receiver on the uGreen DABBoard.
++Load:   dtoverlay=ugreen-dabboard,<param>=<val>
++Params: card-name               Override the default, "dabboard", card name.
++
++
++Name:   upstream
++Info:   Allow usage of downstream .dtb with upstream kernel. Comprises the
++        vc4-kms-v3d and dwc2 overlays.
++Load:   dtoverlay=upstream
++Params: <None>
++
++
++Name:   upstream-aux-interrupt
++Info:   This overlay has been deprecated and removed because it is no longer
++        necessary.
++Load:   <Deprecated>
++
++
++Name:   upstream-pi4
++Info:   Allow usage of downstream .dtb with upstream kernel on Pi 4. Comprises
++        the vc4-kms-v3d-pi4 and dwc2 overlays.
++Load:   dtoverlay=upstream-pi4
++Params: <None>
++
++
++Name:   vc4-fkms-v3d
++Info:   Enable the kernel DRM VC4 V3D driver on top of the dispmanx
++        display stack.
++        NB The firmware will not allow this overlay to load on a Pi with less
++        than 512MB as memory is too tight.
++Load:   dtoverlay=vc4-fkms-v3d,<param>
++Params: cma-512                 CMA is 512MB (needs 1GB)
++        cma-448                 CMA is 448MB (needs 1GB)
++        cma-384                 CMA is 384MB (needs 1GB)
++        cma-320                 CMA is 320MB (needs 1GB)
++        cma-256                 CMA is 256MB (needs 1GB)
++        cma-192                 CMA is 192MB (needs 1GB)
++        cma-128                 CMA is 128MB
++        cma-96                  CMA is 96MB
++        cma-64                  CMA is 64MB
++        cma-size                CMA size in bytes, 4MB aligned
++        cma-default             Use upstream's default value
++
++
++Name:   vc4-fkms-v3d-pi4
++Info:   Enable the kernel DRM VC4 V3D driver on top of the dispmanx
++        display stack.
++Load:   dtoverlay=vc4-fkms-v3d-pi4,<param>
++Params: cma-512                 CMA is 512MB (needs 1GB)
++        cma-448                 CMA is 448MB (needs 1GB)
++        cma-384                 CMA is 384MB (needs 1GB)
++        cma-320                 CMA is 320MB (needs 1GB)
++        cma-256                 CMA is 256MB (needs 1GB)
++        cma-192                 CMA is 192MB (needs 1GB)
++        cma-128                 CMA is 128MB
++        cma-96                  CMA is 96MB
++        cma-64                  CMA is 64MB
++        cma-size                CMA size in bytes, 4MB aligned
++        cma-default             Use upstream's default value
++
++
++Name:   vc4-kms-dpi-at056tn53v1
++Info:   This overlay is now deprecated - see vc4-kms-dpi-panel,at056tn53v1
++Load:   <Deprecated>
++
++
++Name:   vc4-kms-dpi-generic
++Info:   Enable a generic DPI display under KMS. Default timings are for the
++        Adafruit Kippah with 800x480 panel and RGB666 (GPIOs 0-21)
++        Requires vc4-kms-v3d to be loaded.
++Load:   dtoverlay=vc4-kms-dpi-generic,<param>=<val>
++Params: clock-frequency         Display clock frequency (Hz)
++        hactive                 Horizontal active pixels
++        hfp                     Horizontal front porch
++        hsync                   Horizontal sync pulse width
++        hbp                     Horizontal back porch
++        vactive                 Vertical active lines
++        vfp                     Vertical front porch
++        vsync                   Vertical sync pulse width
++        vbp                     Vertical back porch
++        hsync-invert            Horizontal sync active low
++        vsync-invert            Vertical sync active low
++        de-invert               Data Enable active low
++        pixclk-invert           Negative edge pixel clock
++        width-mm                Define the screen width in mm
++        height-mm               Define the screen height in mm
++        rgb565                  Change to RGB565 output on GPIOs 0-19
++        rgb565-padhi            Change to RGB565 output on GPIOs 0-8, 12-17, and
++                                20-24
++        bgr666                  Change to BGR666 output on GPIOs 0-21.
++        bgr666-padhi            Change to BGR666 output on GPIOs 0-9, 12-17, and
++                                20-25
++        rgb666-padhi            Change to RGB666 output on GPIOs 0-9, 12-17, and
++                                20-25
++        bgr888                  Change to BGR888 output on GPIOs 0-27
++        rgb888                  Change to RGB888 output on GPIOs 0-27
++        bus-format              Override the bus format for a MEDIA_BUS_FMT_*
++                                value. NB also overridden by rgbXXX overrides.
++        backlight-gpio          Defines a GPIO to be used for backlight control
++                                (default of none).
++        backlight-pwm           Defines a PWM channel to be used for backlight
++                                control (default of none). NB Disables audio
++                                headphone output as that also uses PWM.
++        backlight-pwm-chan      Choose channel on &pwm node for backlight
++                                control.
++                                (default 0).
++        backlight-pwm-gpio      GPIO pin to be used for the PWM backlight. See
++                                pwm-2chan for valid options.
++                                (default 18 - note this can only work with
++                                 rgb666-padhi).
++        backlight-pwm-func      Pin function of GPIO used for the PWM
++                                backlight.
++                                See pwm-2chan for valid options.
++                                (default 2).
++        backlight-def-brightness
++                                Set the default brightness. Normal range 1-16.
++                                (default 16).
++        rotate                  Display rotation {0,90,180,270} (default 0)
++        rgb-order               Allow override of RGB order from DPI.
++                                Options for vc4 are "rgb", "bgr", "grb", and
++                                "brg". Other values will be ignored.
++
++
++
++Name:   vc4-kms-dpi-hyperpixel2r
++Info:   Enable the KMS drivers for the Pimoroni HyperPixel2 Round DPI display.
++        Requires vc4-kms-v3d to be loaded.
++Load:   dtoverlay=vc4-kms-dpi-hyperpixel2r,<param>=<val>
++Params: disable-touch           Disables the touch controller
++        touchscreen-inverted-x  Inverts X direction of touch controller
++        touchscreen-inverted-y  Inverts Y direction of touch controller
++        touchscreen-swapped-x-y Swaps X & Y axes of touch controller
++        rotate                  Display rotation {0,90,180,270} (default 0)
++
++
++Name:   vc4-kms-dpi-hyperpixel4
++Info:   Enable the KMS drivers for the Pimoroni HyperPixel4 DPI display.
++        Requires vc4-kms-v3d to be loaded.
++Load:   dtoverlay=vc4-kms-dpi-hyperpixel4,<param>=<val>
++Params: disable-touch           Disables the touch controller
++        touchscreen-inverted-x  Inverts X direction of touch controller
++        touchscreen-inverted-y  Inverts Y direction of touch controller
++        touchscreen-swapped-x-y Swaps X & Y axes of touch controller
++        rotate                  Display rotation {0,90,180,270} (default 0)
++
++
++Name:   vc4-kms-dpi-hyperpixel4sq
++Info:   Enable the KMS drivers for the Pimoroni HyperPixel4 Square DPI display.
++        Requires vc4-kms-v3d to be loaded.
++Load:   dtoverlay=vc4-kms-dpi-hyperpixel4sq,<param>=<val>
++Params: disable-touch           Disables the touch controller
++        touchscreen-inverted-x  Inverts X direction of touch controller
++        touchscreen-inverted-y  Inverts Y direction of touch controller
++        touchscreen-swapped-x-y Swaps X & Y axes of touch controller
++        rotate                  Display rotation {0,90,180,270} (default 0)
++
++
++Name:   vc4-kms-dpi-panel
++Info:   Enable a preconfigured KMS DPI panel.
++        Requires vc4-kms-v3d to be loaded.
++Load:   dtoverlay=vc4-kms-dpi-panel,<param>=<val>
++Params: at056tn53v1             Enable an Innolux 5.6in VGA TFT
++        kippah-7inch            Enable an Adafruit Kippah with 7inch panel.
++        mzp280                  Enable a Geekworm MZP280 panel.
++        backlight-gpio          Defines a GPIO to be used for backlight control
++                                (default of none).
++        backlight-pwm           Defines a PWM channel to be used for backlight
++                                control (default of none). NB Disables audio
++                                headphone output as that also uses PWM.
++        backlight-pwm-chan      Choose channel on &pwm node for backlight
++                                control.
++                                (default 0).
++        backlight-pwm-gpio      GPIO pin to be used for the PWM backlight. See
++                                pwm-2chan for valid options.
++                                (default 18 - note this can only work with
++                                 rgb666-padhi).
++        backlight-pwm-func      Pin function of GPIO used for the PWM
++                                backlight.
++                                See pwm-2chan for valid options.
++                                (default 2).
++        backlight-def-brightness
++                                Set the default brightness. Normal range 1-16.
++                                (default 16).
++        rotate                  Display rotation {0,90,180,270} (default 0)
++
++
++Name:   vc4-kms-dsi-7inch
++Info:   Enable the Raspberry Pi DSI 7" screen.
++        Includes the edt-ft5406 for the touchscreen element.
++        Requires vc4-kms-v3d to be loaded.
++Load:   dtoverlay=vc4-kms-dsi-7inch,<param>=<val>
++Params: sizex                   Touchscreen size x (default 800)
++        sizey                   Touchscreen size y (default 480)
++        invx                    Touchscreen inverted x axis
++        invy                    Touchscreen inverted y axis
++        swapxy                  Touchscreen swapped x y axis
++        disable_touch           Disables the touch screen overlay driver
++        dsi0                    Use DSI0 and i2c_csi_dsi0 (rather than
++                                the default DSI1 and i2c_csi_dsi).
++
++
++Name:   vc4-kms-dsi-generic
++Info:   Enable a generic DSI display under KMS.
++        Default timings are for a 840x480 RGB888 panel.
++        Requires vc4-kms-v3d to be loaded.
++Load:   dtoverlay=vc4-kms-dsi-generic,<param>=<val>
++Params: clock-frequency         Display clock frequency (Hz)
++        hactive                 Horizontal active pixels
++        hfp                     Horizontal front porch
++        hsync                   Horizontal sync pulse width
++        hbp                     Horizontal back porch
++        vactive                 Vertical active lines
++        vfp                     Vertical front porch
++        vsync                   Vertical sync pulse width
++        vbp                     Vertical back porch
++        width-mm                Define the screen width in mm
++        height-mm               Define the screen height in mm
++        rgb565                  Change to RGB565 output
++        rgb666                  Change to RGB666 output
++        rgb666p                 Change to RGB666 output with pixel packing
++        rgb888                  Change to RGB888 output, this is the default
++        one-lane                Use one DSI lane for data transmission
++                                This is the default
++        two-lane                Use two DSI lanes for data transmission
++        three-lane              Use three DSI lanes for data transmission
++                                Only supported on Pi5 and CM
++        four-lane               Use four DSI lanes for data transmission
++                                Only supported on Pi5 and CM
++        dsi0                    Switch DSI port to DSI0
++                                Only supported on Pi5 and CM
++
++
++Name:   vc4-kms-dsi-ili9881-5inch
++Info:   Enable the Raspberry Pi 5" ILI9881 based touchscreen panel.
++        Requires vc4-kms-v3d to be loaded.
++Load:   dtoverlay=vc4-kms-dsi-ili9881-5inch,<param>
++Params: sizex                   Touchscreen size x (default 720)
++        sizey                   Touchscreen size y (default 1280)
++        invx                    Touchscreen inverted x axis
++        invy                    Touchscreen inverted y axis
++        swapxy                  Touchscreen swapped x y axis
++        disable_touch           Disables the touch screen overlay driver
++        dsi0                    Use DSI0 and i2c_csi_dsi0 (rather than
++                                the default DSI1 and i2c_csi_dsi).
++
++
++Name:   vc4-kms-dsi-ili9881-7inch
++Info:   Enable the Raspberry Pi 7" ILI9881 based touchscreen panel.
++        Requires vc4-kms-v3d to be loaded.
++Load:   dtoverlay=vc4-kms-dsi-ili9881-7inch,<param>
++Params: sizex                   Touchscreen size x (default 720)
++        sizey                   Touchscreen size y (default 1280)
++        invx                    Touchscreen inverted x axis
++        invy                    Touchscreen inverted y axis
++        swapxy                  Touchscreen swapped x y axis
++        disable_touch           Disables the touch screen overlay driver
++        dsi0                    Use DSI0 and i2c_csi_dsi0 (rather than
++                                the default DSI1 and i2c_csi_dsi).
++
++
++Name:   vc4-kms-dsi-lt070me05000
++Info:   Enable a JDI LT070ME05000 DSI display on DSI1.
++        Note that this is a 4 lane DSI device, so it will only work on a Compute
++        Module.
++        Requires vc4-kms-v3d to be loaded.
++Load:   dtoverlay=vc4-kms-dsi-lt070me05000,<param>
++Params: reset                   GPIO for the reset signal (default 17)
++        enable                  GPIO for the enable signal (default 4)
++        dcdc-en                 GPIO for the DC-DC converter enable (default 5)
++
++
++Name:   vc4-kms-dsi-lt070me05000-v2
++Info:   Enable a JDI LT070ME05000 DSI display on DSI1 using Harlab's V2
++        interface board.
++        Note that this is a 4 lane DSI device, so it will only work on a Compute
++        Module.
++        Requires vc4-kms-v3d to be loaded.
++Load:   dtoverlay=vc4-kms-dsi-lt070me05000-v2
++Params: <None>
++
++
++Name:   vc4-kms-dsi-waveshare-800x480
++Info:   Enable the Waveshare 4.3" 800x480 DSI screen.
++        It tries to look like the Pi 7" display, but won't accept some of the
++        timings.
++        Includes the edt-ft5406 for the touchscreen element.
++        Requires vc4-kms-v3d to be loaded.
++Load:   dtoverlay=vc4-kms-dsi-waveshare-800x480,<param>=<val>
++Params: sizex                   Touchscreen size x (default 800)
++        sizey                   Touchscreen size y (default 480)
++        invx                    Touchscreen inverted x axis
++        invy                    Touchscreen inverted y axis
++        swapxy                  Touchscreen swapped x y axis
++        disable_touch           Disables the touch screen overlay driver
++        dsi0                    Use DSI0 and i2c_csi_dsi0 (rather than
++                                the default DSI1 and i2c_csi_dsi).
++
++
++Name:   vc4-kms-dsi-waveshare-panel
++Info:   Enable a Waveshare DSI touchscreen
++        Includes the Goodix driver for the touchscreen element.
++        The default is for the display to be using the I2C0 option for control.
++        Use the i2c1 override if using the I2C1 wiring with jumper wires from
++        GPIOs 2&3 (pins 3&5).
++        invx/invy/swapxy should be used with caution as the panel specifier will
++        set the default inversions for that panel. Always use them after the
++        panel specifier, and be aware that you may need to set them as =0, not
++        just adding it.
++        Requires vc4-kms-v3d to be loaded.
++Load:   dtoverlay=vc4-kms-dsi-waveshare-panel,<param>=<val>
++Params: 2_8_inch                2.8" 480x640
++        3_4_inch                3.4" 800x800 round
++        4_0_inch                4.0" 480x800
++        4_0_inchC               4.0" 720x720
++        5_0_inch                5.0" 720x1280
++        6_25_inch               6.25" 720x1560
++        8_8_inch                8.8" 480x1920
++        7_0_inchC               7.0" C 1024x600
++        7_9_inch                7.9" 400x1280
++        8_0_inch                8.0" 1280x800
++        10_1_inch               10.1" 1280x800
++        11_9_inch               11.9" 320x1480
++        i2c1                    Use i2c-1 with jumper wires from GPIOs 2&3
++        disable_touch           Disable the touch controller
++        rotation                Set the panel orientation property
++        invx                    Touchscreen inverted x axis
++        invy                    Touchscreen inverted y axis
++        swapxy                  Touchscreen swapped x y axis
++        dsi0                    Use DSI0 and i2c_csi_dsi0 (rather than
++                                the default DSI1 and i2c_csi_dsi).
++
++
++Name:   vc4-kms-kippah-7inch
++Info:   This overlay is now deprecated - see vc4-kms-dpi-panel,kippah-7inch
++Load:   <Deprecated>
++
++
++Name:   vc4-kms-v3d
++Info:   Enable the kernel DRM VC4 HDMI/HVS/V3D driver.
++        NB The firmware will not allow this overlay to load on a Pi with less
++        than 512MB as memory is too tight.
++Load:   dtoverlay=vc4-kms-v3d,<param>
++Params: cma-512                 CMA is 512MB (needs 1GB)
++        cma-448                 CMA is 448MB (needs 1GB)
++        cma-384                 CMA is 384MB (needs 1GB)
++        cma-320                 CMA is 320MB (needs 1GB)
++        cma-256                 CMA is 256MB (needs 1GB)
++        cma-192                 CMA is 192MB (needs 1GB)
++        cma-128                 CMA is 128MB
++        cma-96                  CMA is 96MB
++        cma-64                  CMA is 64MB
++        cma-size                CMA size in bytes, 4MB aligned
++        cma-default             Use upstream's default value
++        audio                   Enable or disable audio over HDMI (default "on")
++        noaudio                 Disable all HDMI audio (default "off")
++        composite               Enable the composite output (default "off")
++                                N.B. Disables all other outputs on a Pi 4.
++        nohdmi                  Disable HDMI output
++
++
++Name:   vc4-kms-v3d-pi4
++Info:   Enable the kernel DRM VC4 HDMI/HVS/V3D driver for Pi4.
++Load:   dtoverlay=vc4-kms-v3d-pi4,<param>
++Params: cma-512                 CMA is 512MB
++        cma-448                 CMA is 448MB
++        cma-384                 CMA is 384MB
++        cma-320                 CMA is 320MB
++        cma-256                 CMA is 256MB
++        cma-192                 CMA is 192MB
++        cma-128                 CMA is 128MB
++        cma-96                  CMA is 96MB
++        cma-64                  CMA is 64MB
++        cma-size                CMA size in bytes, 4MB aligned
++        cma-default             Use upstream's default value
++        audio                   Enable or disable audio over HDMI0 (default
++                                "on")
++        audio1                  Enable or disable audio over HDMI1 (default
++                                "on")
++        noaudio                 Disable all HDMI audio (default "off")
++        composite               Enable the composite output (disables all other
++                                outputs)
++        nohdmi                  Disable both HDMI 0 & 1 outputs
++        nohdmi0                 Disable HDMI 0 output
++        nohdmi1                 Disable HDMI 1 output
++
++
++Name:   vc4-kms-v3d-pi5
++Info:   See vc4-kms-v3d-pi4 (this is the Pi 5 version)
++
++
++Name:   vc4-kms-vga666
++Info:   Enable the VGA666 (resistor ladder ADC) for the vc4-kms-v3d driver.
++        Requires vc4-kms-v3d to be loaded.
++Load:   dtoverlay=vc4-kms-vga666,<param>
++Params: ddc                     Enables GPIOs 0&1 as the I2C to read the EDID
++                                from the display. NB These are NOT 5V tolerant
++                                GPIOs, therefore level shifters are required.
++
++
++Name:   vga666
++Info:   Overlay for the Fen Logic VGA666 board
++        This uses GPIOs 2-21 (so no I2C), and activates the output 2-3 seconds
++        after the kernel has started.
++        NOT for use with vc4-kms-v3d.
++Load:   dtoverlay=vga666
++Params: <None>
++
++
++Name:   vl805
++Info:   Overlay to enable a VIA VL805 USB3 controller on CM4 carriers
++        Will be loaded automatically by up-to-date firmware if "VL805=1" is
++        set in the EEPROM config.
++Load:   dtoverlay=vl805
++Params: <None>
++
++
++Name:   w1-gpio
++Info:   Configures the w1-gpio Onewire interface module.
++        Use this overlay if you *don't* need a GPIO to drive an external pullup.
++Load:   dtoverlay=w1-gpio,<param>=<val>
++Params: gpiopin                 GPIO for I/O (default "4")
++        pullup                  Now enabled by default (ignored)
++
++
++Name:   w1-gpio-pi5
++Info:   See w1-gpio (this is the Pi 5 version)
++
++
++Name:   w1-gpio-pullup
++Info:   Configures the w1-gpio Onewire interface module.
++        Use this overlay if you *do* need a GPIO to drive an external pullup.
++Load:   dtoverlay=w1-gpio-pullup,<param>=<val>
++Params: gpiopin                 GPIO for I/O (default "4")
++        extpullup               GPIO for external pullup (default "5")
++        pullup                  Now enabled by default (ignored)
++
++
++Name:   w1-gpio-pullup-pi5
++Info:   See w1-gpio-pullup (this is the Pi 5 version)
++
++
++Name:   w5500
++Info:   Overlay for the Wiznet W5500 Ethernet Controller on SPI0
++Load:   dtoverlay=w5500,<param>=<val>
++Params: int_pin                 GPIO used for INT (default 25)
++
++        speed                   SPI bus speed (default 30000000)
++
++        cs                      SPI bus Chip Select (default 0)
++
++
++Name:   watterott-display
++Info:   Watterott RPi-Display - 2.8" Touch Display
++        Linux has 2 drivers that support this display and this overlay supports
++        both.
++
++        Examples:
++          fbtft/fb_ili9341: dtoverlay=watterott-display
++          drm/mi0283qt: dtoverlay=watterott-display,drm,backlight-pwm,rotate=180
++
++        Some notable differences with the DRM driver compared to fbtft:
++        - The display is turned on when it's first used and not on driver load
++          as with fbtft. So if nothing uses the display it stays off.
++        - Can run with a higher SPI clock increasing framerate. This is possible
++          since the driver avoids messing up the controller configuration due to
++          transmission errors by running config commands at 10MHz and only pixel
++          data at full speed (occasional pixel glitch might occur).
++        - PWM backlight is supported.
++
++Load:   dtoverlay=watterott-display,<param>=<val>
++Params: speed                   Display SPI bus speed
++        rotate                  Display rotation {0,90,180,270}
++        fps                     Delay between frame updates (fbtft only)
++        debug                   Debug output level {0-7} (fbtft only)
++        xohms                   Touchpanel sensitivity (X-plate resistance)
++        swapxy                  Swap x and y axis
++        backlight               Change backlight GPIO pin {e.g. 12, 18}
++                                (fbtft only)
++        drm                     Use DRM/KMS driver mi0283qt instead of fbtft.
++                                Set the SPI clock to 70MHz.
++                                This has to be the first parameter.
++        backlight-pwm           Use pwm for backlight (drm only). NB: Disables
++                                audio headphone output as that also uses PWM.
++
++
++Name:   waveshare-can-fd-hat-mode-a
++Info:   Overlay for the Waveshare 2-Channel Isolated CAN FD Expansion HAT
++        for Raspberry Pi, Multi Protections. Use this overlay when the
++        HAT is configured in Mode A (Default), with can0 on spi0.0
++        and can1 on spi1.0.
++        https://www.waveshare.com/2-ch-can-fd-hat.htm
++Load:   dtoverlay=waveshare-can-fd-hat-mode-a
++Params: <None>
++
++
++Name:   waveshare-can-fd-hat-mode-b
++Info:   Overlay for the Waveshare 2-Channel Isolated CAN FD Expansion HAT
++        for Raspberry Pi, Multi Protections. Use this overlay when the
++        HAT is configured in Mode B (requires hardware modification), with
++        can0 on spi0.0 and can1 on spi0.1.
++        https://www.waveshare.com/2-ch-can-fd-hat.htm
++Load:   dtoverlay=waveshare-can-fd-hat-mode-b
++Params: <None>
++
++
++Name:   wittypi
++Info:   Configures the wittypi RTC module.
++Load:   dtoverlay=wittypi,<param>=<val>
++Params: led_gpio                GPIO for LED (default "17")
++        led_trigger             Choose which activity the LED tracks (default
++                                "default-on")
++
++
++Name:   wm8960-soundcard
++Info:   Overlay for the Waveshare wm8960 soundcard
++Load:   dtoverlay=wm8960-soundcard,<param>=<val>
++Params: alsaname                Changes the card name in ALSA
++        compatible              Changes the codec compatibility
++
++
++Troubleshooting
++===============
++
++If you are experiencing problems that you think are DT-related, enable DT
++diagnostic output by adding this to /boot/config.txt:
++
++    dtdebug=on
++
++and rebooting. Then run:
++
++    sudo vcdbg log msg
++
++and look for relevant messages.
++
++Further reading
++===============
++
++This is only meant to be a quick introduction to the subject of Device Tree on
++Raspberry Pi. There is a more complete explanation here:
++
++http://www.raspberrypi.org/documentation/configuration/device-tree.md
+diff --git a/arch/arm/boot/dts/overlays/act-led-overlay.dts b/arch/arm/boot/dts/overlays/act-led-overlay.dts
+new file mode 100644
+index 000000000000..685e354923a0
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/act-led-overlay.dts
+@@ -0,0 +1,28 @@
++/dts-v1/;
++/plugin/;
++
++/* Pi3 uses a GPIO expander to drive the LEDs which can only be accessed
++   from the VPU. There is a special driver for this with a separate DT node,
++   which has the unfortunate consequence of breaking the act_led_gpio and
++   act_led_activelow dtparams.
++
++   This overlay changes the GPIO controller back to the standard one and
++   restores the dtparams.
++*/
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&led_act>;
++		frag0: __overlay__ {
++			gpios = <&gpio 0 0>;
++		};
++	};
++
++	__overrides__ {
++		gpio = <&frag0>,"gpios:4",
++		       <&frag0>,"status=okay";
++		activelow = <&frag0>,"gpios:8";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/adafruit-st7735r-overlay.dts b/arch/arm/boot/dts/overlays/adafruit-st7735r-overlay.dts
+new file mode 100644
+index 000000000000..6e69bd7fa031
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/adafruit-st7735r-overlay.dts
+@@ -0,0 +1,83 @@
++/*
++ * adafruit-st7735r-overlay.dts
++ *
++ * ST7735R based SPI LCD displays. Either
++ * Adafruit 1.8" 160x128
++ *   or
++ * Okaya 1.44" 128x128
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			adafruit_pins: adafruit_pins {
++				brcm,pins = <25 24>;
++				brcm,function = <1>; /* out */
++			};
++			backlight_pins: backlight_pins {
++				brcm,pins = <18>;
++				brcm,function = <1>; /* out */
++			};
++		};
++	};
++
++	fragment@2 {
++		target-path = "/";
++		__overlay__ {
++			af18_backlight: backlight {
++				compatible = "gpio-backlight";
++				gpios = <&gpio 18 GPIO_ACTIVE_HIGH>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&backlight_pins>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			af18: adafruit18@0 {
++				compatible = "jianda,jd-t18003-t01";
++				reg = <0>;
++				spi-max-frequency = <32000000>;
++				dc-gpios = <&gpio 24 GPIO_ACTIVE_HIGH>;
++				reset-gpios = <&gpio 25 GPIO_ACTIVE_HIGH>;
++				rotation = <90>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&adafruit_pins>;
++				backlight = <&af18_backlight>;
++			};
++		};
++	};
++
++	__overrides__ {
++		128x128 = <&af18>, "compatible=okaya,rh128128t";
++		speed = <&af18>,"spi-max-frequency:0";
++		rotate = <&af18>,"rotation:0";
++		dc_pin = <&af18>,"dc-gpios:4", <&adafruit_pins>,"brcm,pins:4";
++		reset_pin = <&af18>,"reset-gpios:4",
++			    <&adafruit_pins>,"brcm,pins:0";
++		led_pin = <&af18_backlight>,"gpios:4",
++			  <&backlight_pins>,"brcm,pins:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/adafruit18-overlay.dts b/arch/arm/boot/dts/overlays/adafruit18-overlay.dts
+new file mode 100644
+index 000000000000..e1ce94a8cd3e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/adafruit18-overlay.dts
+@@ -0,0 +1,55 @@
++/*
++ * Device Tree overlay for Adafruit 1.8" TFT LCD with ST7735R chip 160x128
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			af18: adafruit18@0 {
++				compatible = "fbtft,adafruit18";
++				reg = <0>;
++				pinctrl-names = "default";
++				spi-max-frequency = <40000000>;
++				rotate = <90>;
++				buswidth = <8>;
++				fps = <50>;
++				height = <160>;
++				width = <128>;
++				reset-gpios = <&gpio 25 1>;
++				dc-gpios = <&gpio 24 0>;
++				led-gpios = <&gpio 18 0>;
++				debug = <0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		green = <&af18>, "compatible=fbtft,adafruit18_green";
++		speed     = <&af18>,"spi-max-frequency:0";
++		rotate    = <&af18>,"rotate:0";
++		fps       = <&af18>,"fps:0";
++		bgr       = <&af18>,"bgr?";
++		debug     = <&af18>,"debug:0";
++		dc_pin    = <&af18>,"dc-gpios:4";
++		reset_pin = <&af18>,"reset-gpios:4";
++		led_pin   = <&af18>,"led-gpios:4";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/adau1977-adc-overlay.dts b/arch/arm/boot/dts/overlays/adau1977-adc-overlay.dts
+new file mode 100644
+index 000000000000..cf6d1ef3bfff
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/adau1977-adc-overlay.dts
+@@ -0,0 +1,40 @@
++// Definitions for ADAU1977 ADC
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++    
++	fragment@0 {
++		target = <&i2c1>;
++        	
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			
++			adau1977: codec@11 {
++                        	compatible = "adi,adau1977";
++                        	reg = <0x11>;
++                        	reset-gpios = <&gpio 5 0>;
++				AVDD-supply = <&vdd_3v3_reg>;
++                	};
++        	};
++	};
++
++	fragment@1 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "adi,adau1977-adc";
++			i2s-controller = <&i2s_clk_consumer>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/adau7002-simple-overlay.dts b/arch/arm/boot/dts/overlays/adau7002-simple-overlay.dts
+new file mode 100644
+index 000000000000..62e92bd8f952
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/adau7002-simple-overlay.dts
+@@ -0,0 +1,52 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++    compatible = "brcm,bcm2835";
++
++    fragment@0 {
++        target = <&i2s_clk_producer>;
++        __overlay__ {
++            status = "okay";
++        };
++    };
++
++    fragment@1 {
++        target-path = "/";
++        __overlay__ {
++                adau7002_codec: adau7002-codec {
++                #sound-dai-cells = <0>;
++                compatible = "adi,adau7002";
++/*                IOVDD-supply = <&supply>;*/
++                status = "okay";
++            };
++        };
++    };
++
++    fragment@2 {
++        target = <&sound>;
++            sound_overlay: __overlay__ {
++            compatible = "simple-audio-card";
++            simple-audio-card,format = "i2s";
++            simple-audio-card,name = "adau7002";
++            simple-audio-card,bitclock-slave = <&dailink0_slave>;
++            simple-audio-card,frame-slave = <&dailink0_slave>;
++            simple-audio-card,widgets =
++                    "Microphone", "Microphone Jack";
++            simple-audio-card,routing =
++                    "PDM_DAT", "Microphone Jack";
++            status = "okay";
++            simple-audio-card,cpu {
++                sound-dai = <&i2s_clk_producer>;
++            };
++            dailink0_slave: simple-audio-card,codec {
++                sound-dai = <&adau7002_codec>;
++            };
++        };
++    };
++
++
++    __overrides__ {
++        card-name = <&sound_overlay>,"simple-audio-card,name";
++    };
++};
+diff --git a/arch/arm/boot/dts/overlays/ads1015-overlay.dts b/arch/arm/boot/dts/overlays/ads1015-overlay.dts
+new file mode 100644
+index 000000000000..dc1764613a8b
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ads1015-overlay.dts
+@@ -0,0 +1,98 @@
++/*
++ * 2016 - Erik Sejr
++ */
++/dts-v1/;
++/plugin/;
++
++/ {
++    compatible = "brcm,bcm2835";
++    /* ----------- ADS1015 ------------ */
++    fragment@0 {
++        target = <&i2c_arm>;
++        __overlay__ {
++            #address-cells = <1>;
++            #size-cells = <0>;
++            status = "okay";
++            ads1015: ads1015@48 {
++                compatible = "ti,ads1015";
++                status = "okay";
++                #address-cells = <1>;
++                #size-cells = <0>;
++                reg = <0x48>;
++            };
++        };
++    };
++
++    fragment@1 {
++        target = <&ads1015>;
++        __overlay__ {
++            #address-cells = <1>;
++            #size-cells = <0>;
++            channel_a: channel_a {
++                reg = <4>;
++                ti,gain = <2>;
++                ti,datarate = <4>;
++            };
++        };
++    };
++
++    fragment@2 {
++        target = <&ads1015>;
++        __dormant__ {
++            #address-cells = <1>;
++            #size-cells = <0>;
++            channel_b: channel_b {
++                reg = <5>;
++                ti,gain = <2>;
++                ti,datarate = <4>;
++            };
++        };
++    };
++
++    fragment@3 {
++        target = <&ads1015>;
++        __dormant__ {
++            #address-cells = <1>;
++            #size-cells = <0>;
++            channel_c: channel_c {
++                reg = <6>;
++                ti,gain = <2>;
++                ti,datarate = <4>;
++            };
++        };
++    };
++
++    fragment@4 {
++        target = <&ads1015>;
++        __dormant__ {
++            #address-cells = <1>;
++            #size-cells = <0>;
++            channel_d: channel_d {
++                reg = <7>;
++                ti,gain = <2>;
++                ti,datarate = <4>;
++            };
++        };
++    };
++
++    __overrides__ {
++        addr =            <&ads1015>,"reg:0";
++        cha_enable =      <0>,"=1";
++        cha_cfg =         <&channel_a>,"reg:0";
++        cha_gain =        <&channel_a>,"ti,gain:0";
++        cha_datarate =    <&channel_a>,"ti,datarate:0";
++        chb_enable =      <0>,"=2";
++        chb_cfg =         <&channel_b>,"reg:0";
++        chb_gain =        <&channel_b>,"ti,gain:0";
++        chb_datarate =    <&channel_b>,"ti,datarate:0";
++        chc_enable =      <0>,"=3";
++        chc_cfg =         <&channel_c>,"reg:0";
++        chc_gain =        <&channel_c>,"ti,gain:0";
++        chc_datarate =    <&channel_c>,"ti,datarate:0";
++        chd_enable =      <0>,"=4";
++        chd_cfg =         <&channel_d>,"reg:0";
++        chd_gain =        <&channel_d>,"ti,gain:0";
++        chd_datarate =    <&channel_d>,"ti,datarate:0";
++   };
++
++};
+diff --git a/arch/arm/boot/dts/overlays/ads1115-overlay.dts b/arch/arm/boot/dts/overlays/ads1115-overlay.dts
+new file mode 100644
+index 000000000000..64ada16de9c7
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ads1115-overlay.dts
+@@ -0,0 +1,135 @@
++/*
++ * TI ADS1115 multi-channel ADC overlay
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&ads1115>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			channel_a: channel_a {
++				reg = <4>;
++				ti,gain = <1>;
++				ti,datarate = <7>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&ads1115>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			channel_b: channel_b {
++				reg = <5>;
++				ti,gain = <1>;
++				ti,datarate = <7>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&ads1115>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			channel_c: channel_c {
++				reg = <6>;
++				ti,gain = <1>;
++				ti,datarate = <7>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&ads1115>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			channel_d: channel_d {
++				reg = <7>;
++				ti,gain = <1>;
++				ti,datarate = <7>;
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&i2cbus>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ads1115: ads1115@48 {
++				compatible = "ti,ads1115";
++				status = "okay";
++				#address-cells = <1>;
++				#size-cells = <0>;
++				reg = <0x48>;
++			};
++		};
++	};
++
++	frag100: fragment@100 {
++		target = <&i2c1>;
++		i2cbus: __overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@101 {
++		target = <&i2c0if>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	fragment@102 {
++		target = <&i2c0mux>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		addr =            <&ads1115>,"reg:0";
++		cha_enable =      <0>,"=0";
++		cha_cfg =         <&channel_a>,"reg:0";
++		cha_gain =        <&channel_a>,"ti,gain:0";
++		cha_datarate =    <&channel_a>,"ti,datarate:0";
++		chb_enable =      <0>,"=1";
++		chb_cfg =         <&channel_b>,"reg:0";
++		chb_gain =        <&channel_b>,"ti,gain:0";
++		chb_datarate =    <&channel_b>,"ti,datarate:0";
++		chc_enable =      <0>,"=2";
++		chc_cfg =         <&channel_c>,"reg:0";
++		chc_gain =        <&channel_c>,"ti,gain:0";
++		chc_datarate =    <&channel_c>,"ti,datarate:0";
++		chd_enable =      <0>,"=3";
++		chd_cfg =         <&channel_d>,"reg:0";
++		chd_gain =        <&channel_d>,"ti,gain:0";
++		chd_datarate =    <&channel_d>,"ti,datarate:0";
++		i2c0 = <&frag100>, "target:0=",<&i2c0>;
++		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
++			      <0>,"+101+102";
++		i2c3 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c3";
++		i2c4 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c4";
++		i2c5 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c5";
++		i2c6 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c6";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/ads7846-overlay.dts b/arch/arm/boot/dts/overlays/ads7846-overlay.dts
+new file mode 100644
+index 000000000000..211a002c0b34
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ads7846-overlay.dts
+@@ -0,0 +1,89 @@
++/*
++ * Generic Device Tree overlay for the ADS7846 touch controller
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			ads7846_pins: ads7846_pins {
++				brcm,pins = <255>; /* illegal default value */
++				brcm,function = <0>; /* in */
++				brcm,pull = <0>; /* none */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			ads7846: ads7846@1 {
++				compatible = "ti,ads7846";
++				reg = <1>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&ads7846_pins>;
++
++				spi-max-frequency = <2000000>;
++				interrupts = <255 2>; /* high-to-low edge triggered */
++				interrupt-parent = <&gpio>;
++				pendown-gpio = <&gpio 255 1>;
++
++				/* driver defaults */
++				ti,x-min = /bits/ 16 <0>;
++				ti,y-min = /bits/ 16 <0>;
++				ti,x-max = /bits/ 16 <0x0FFF>;
++				ti,y-max = /bits/ 16 <0x0FFF>;
++				ti,pressure-min = /bits/ 16 <0>;
++				ti,pressure-max = /bits/ 16 <0xFFFF>;
++				ti,x-plate-ohms = /bits/ 16 <400>;
++			};
++		};
++	};
++	__overrides__ {
++		cs =     <&ads7846>,"reg:0";
++		speed =  <&ads7846>,"spi-max-frequency:0";
++		penirq = <&ads7846_pins>,"brcm,pins:0", /* REQUIRED */
++			 <&ads7846>,"interrupts:0",
++			 <&ads7846>,"pendown-gpio:4";
++		penirq_pull = <&ads7846_pins>,"brcm,pull:0";
++		swapxy = <&ads7846>,"ti,swap-xy?";
++		xmin =   <&ads7846>,"ti,x-min;0";
++		ymin =   <&ads7846>,"ti,y-min;0";
++		xmax =   <&ads7846>,"ti,x-max;0";
++		ymax =   <&ads7846>,"ti,y-max;0";
++		pmin =   <&ads7846>,"ti,pressure-min;0";
++		pmax =   <&ads7846>,"ti,pressure-max;0";
++		xohms =  <&ads7846>,"ti,x-plate-ohms;0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/adv7282m-overlay.dts b/arch/arm/boot/dts/overlays/adv7282m-overlay.dts
+new file mode 100644
+index 000000000000..a9eb75a30825
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/adv7282m-overlay.dts
+@@ -0,0 +1,73 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for Analog Devices ADV7282-M video to CSI2 bridge on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			adv728x: adv728x@21 {
++				compatible = "adi,adv7282-m";
++				reg = <0x21>;
++				status = "okay";
++				clock-frequency = <24000000>;
++				port {
++					adv728x_0: endpoint {
++						remote-endpoint = <&csi1_ep>;
++						clock-lanes = <0>;
++						data-lanes = <1>;
++						link-frequencies =
++							/bits/ 64 <297000000>;
++
++						mclk-frequency = <12000000>;
++					};
++				};
++			};
++		};
++	};
++	fragment@1 {
++		target = <&csi1>;
++		__overlay__ {
++			status = "okay";
++
++			port {
++				csi1_ep: endpoint {
++					remote-endpoint = <&adv728x_0>;
++					data-lanes = <1>;
++				};
++			};
++		};
++	};
++	fragment@2 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&csi1>;
++		__overlay__ {
++			compatible = "brcm,bcm2835-unicam-legacy";
++		};
++	};
++
++	__overrides__ {
++		addr = <&adv728x>,"reg:0";
++		media-controller = <0>,"!4";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/adv728x-m-overlay.dts b/arch/arm/boot/dts/overlays/adv728x-m-overlay.dts
+new file mode 100644
+index 000000000000..ea392e886984
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/adv728x-m-overlay.dts
+@@ -0,0 +1,37 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for Analog Devices ADV728[0|1|2]-M video to CSI2 bridges on VC
++// I2C bus
++
++#include "adv7282m-overlay.dts"
++
++/{
++	compatible = "brcm,bcm2835";
++
++	// Fragment numbers deliberately high to avoid conflicts with the
++	// included adv7282m overlay file.
++
++	fragment@101 {
++		target = <&adv728x>;
++		__dormant__ {
++			compatible = "adi,adv7280-m";
++		};
++	};
++	fragment@102 {
++		target = <&adv728x>;
++		__dormant__ {
++			compatible = "adi,adv7281-m";
++		};
++	};
++	fragment@103 {
++		target = <&adv728x>;
++		__dormant__ {
++			compatible = "adi,adv7281-ma";
++		};
++	};
++
++	__overrides__ {
++		adv7280m = <0>, "+101";
++		adv7281m = <0>, "+102";
++		adv7281ma = <0>, "+103";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/akkordion-iqdacplus-overlay.dts b/arch/arm/boot/dts/overlays/akkordion-iqdacplus-overlay.dts
+new file mode 100644
+index 000000000000..d867146bcb8f
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/akkordion-iqdacplus-overlay.dts
+@@ -0,0 +1,49 @@
++// Definitions for Digital Dreamtime Akkordion using IQaudIO DAC+ or DACZero
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm5122@4c {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4c>;
++				AVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				CPVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		frag2: __overlay__ {
++			compatible = "iqaudio,iqaudio-dac";
++			card_name = "Akkordion";
++			dai_name = "IQaudIO DAC";
++			dai_stream_name = "IQaudIO DAC HiFi";
++			i2s-controller = <&i2s_clk_producer>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain = <&frag2>,"iqaudio,24db_digital_gain?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/allo-boss-dac-pcm512x-audio-overlay.dts b/arch/arm/boot/dts/overlays/allo-boss-dac-pcm512x-audio-overlay.dts
+new file mode 100644
+index 000000000000..16806945890b
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/allo-boss-dac-pcm512x-audio-overlay.dts
+@@ -0,0 +1,61 @@
++/*
++ * Definitions for Allo Boss DAC board
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			boss_osc: boss_osc {
++				compatible = "allo,dac-clk";
++				#clock-cells = <0>;
++			};
++		};
++	};
++
++	frag1: fragment@1 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm5122@4d {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				clocks = <&boss_osc>;
++				reg = <0x4d>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		boss_dac: __overlay__ {
++			compatible = "allo,boss-dac";
++			i2s-controller = <&i2s_clk_consumer>;
++			mute-gpios = <&gpio 6 1>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain = <&boss_dac>,"allo,24db_digital_gain?";
++		slave = <&boss_dac>,"allo,slave?",
++			<&frag1>,"target:0=",<&i2s_clk_producer>,
++			<&boss_dac>,"i2s-controller:0=",<&i2s_clk_producer>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/allo-boss2-dac-audio-overlay.dts b/arch/arm/boot/dts/overlays/allo-boss2-dac-audio-overlay.dts
+new file mode 100644
+index 000000000000..feac2b091b36
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/allo-boss2-dac-audio-overlay.dts
+@@ -0,0 +1,57 @@
++/* * Definitions for Allo Boss2 DAC boards
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			#sound-dai-cells = <0>;
++			status = "okay";
++			cpu_port: port {
++				cpu_endpoint: endpoint {
++					remote-endpoint = <&codec_endpoint>;
++					bitclock-master = <&codec_endpoint>;
++					frame-master = <&codec_endpoint>;
++					dai-format = "i2s";
++				};
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			allo-cs43130@30 {
++				#sound-dai-cells = <0>;
++				compatible = "allo,allo-cs43198";
++				clock44-gpio = <&gpio 5 0>;
++				clock48-gpio = <&gpio 6 0>;
++				reg = <0x30>;
++				port {
++					codec_endpoint: endpoint {
++					remote-endpoint = <&cpu_endpoint>;
++					};
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		boss2_dac: __overlay__ {
++			compatible = "audio-graph-card";
++			label = "Allo Boss2";
++			dais = <&cpu_port>;
++			status = "okay";
++		};
++	};
++};
++
+diff --git a/arch/arm/boot/dts/overlays/allo-digione-overlay.dts b/arch/arm/boot/dts/overlays/allo-digione-overlay.dts
+new file mode 100644
+index 000000000000..61c3c2e9fbd8
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/allo-digione-overlay.dts
+@@ -0,0 +1,44 @@
++// Definitions for Allo DigiOne
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			wm8804@3b {
++				#sound-dai-cells = <0>;
++				compatible = "wlf,wm8804";
++				reg = <0x3b>;
++				PVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++				wlf,reset-gpio = <&gpio 17 0>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "allo,allo-digione";
++			i2s-controller = <&i2s_clk_consumer>;
++			status = "okay";
++			clock44-gpio = <&gpio 5 0>;
++			clock48-gpio = <&gpio 6 0>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/allo-katana-dac-audio-overlay.dts b/arch/arm/boot/dts/overlays/allo-katana-dac-audio-overlay.dts
+new file mode 100644
+index 000000000000..1ebb6bc6b907
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/allo-katana-dac-audio-overlay.dts
+@@ -0,0 +1,58 @@
++/*
++ * Definitions for Allo Katana DAC boards
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			#sound-dai-cells = <0>;
++			status = "okay";
++			cpu_port: port {
++				cpu_endpoint: endpoint {
++					remote-endpoint = <&codec_endpoint>;
++					bitclock-master = <&codec_endpoint>;
++					frame-master = <&codec_endpoint>;
++					dai-format = "i2s";
++				};
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			clock-frequency = <50000>;
++
++			allo-katana-codec@30 {
++				#sound-dai-cells = <0>;
++				compatible = "allo,allo-katana-codec";
++				reg = <0x30>;
++				port {
++					codec_endpoint: endpoint {
++					remote-endpoint = <&cpu_endpoint>;
++					};
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		katana_dac: __overlay__ {
++			compatible = "audio-graph-card";
++			label = "Allo Katana";
++			dais = <&cpu_port>;
++			status = "okay";
++		};
++	};
++};
++
+diff --git a/arch/arm/boot/dts/overlays/allo-piano-dac-pcm512x-audio-overlay.dts b/arch/arm/boot/dts/overlays/allo-piano-dac-pcm512x-audio-overlay.dts
+new file mode 100644
+index 000000000000..1b79ef1df2a1
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/allo-piano-dac-pcm512x-audio-overlay.dts
+@@ -0,0 +1,54 @@
++/*
++ * Definitions for Allo Piano DAC (2.0/2.1) boards
++ *
++ * NB. The Piano DAC 2.1 board contains 2x TI PCM5142 DAC's. One DAC is stereo
++ * (left/right) and the other provides a subwoofer output, using DSP on the
++ * chip for digital high/low pass crossover.
++ * The initial support for this hardware, that doesn't require any codec driver
++ * modifications, uses only one DAC chip for stereo (left/right) output, the
++ * chip with 0x4c slave address. The other chip at 0x4d is currently ignored!
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm5142@4c {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5142";
++				reg = <0x4c>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		piano_dac: __overlay__ {
++			compatible = "allo,piano-dac";
++			i2s-controller = <&i2s_clk_producer>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain =
++			<&piano_dac>,"allo,24db_digital_gain?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/allo-piano-dac-plus-pcm512x-audio-overlay.dts b/arch/arm/boot/dts/overlays/allo-piano-dac-plus-pcm512x-audio-overlay.dts
+new file mode 100644
+index 000000000000..d17c9c10df39
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/allo-piano-dac-plus-pcm512x-audio-overlay.dts
+@@ -0,0 +1,57 @@
++// Definitions for Piano DAC
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			allo_pcm5122_4c: pcm5122@4c {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4c>;
++				sound-name-prefix = "Main";
++				status = "okay";
++			};
++			allo_pcm5122_4d: pcm5122@4d {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4d>;
++				sound-name-prefix = "Sub";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		piano_dac: __overlay__ {
++			compatible = "allo,piano-dac-plus";
++			audio-codec = <&allo_pcm5122_4c &allo_pcm5122_4d>;
++			i2s-controller = <&i2s_clk_producer>;
++			mute1-gpios = <&gpio 6 1>;
++			mute2-gpios = <&gpio 25 1>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain =
++			<&piano_dac>,"allo,24db_digital_gain?";
++		glb_mclk =
++			<&piano_dac>,"allo,glb_mclk?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/anyspi-overlay.dts b/arch/arm/boot/dts/overlays/anyspi-overlay.dts
+new file mode 100755
+index 000000000000..87523dcca318
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/anyspi-overlay.dts
+@@ -0,0 +1,205 @@
++/*
++ * Universal device tree overlay for SPI devices
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev1>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target-path = "spi1/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target-path = "spi1/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@4 {
++		target-path = "spi1/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@5 {
++		target-path = "spi2/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@6 {
++		target-path = "spi2/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@7 {
++		target-path = "spi2/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@8 {
++		target = <&spi0>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			anyspi_00: anyspi@0 {
++				reg = <0>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	fragment@9 {
++		target = <&spi0>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			anyspi_01: anyspi@1 {
++				reg = <1>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	fragment@10 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			anyspi_10: anyspi@0 {
++				reg = <0>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	fragment@11 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			anyspi_11: anyspi@1 {
++				reg = <1>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	fragment@12 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			anyspi_12: anyspi@2 {
++				reg = <2>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	fragment@13 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			anyspi_20: anyspi@0 {
++				reg = <0>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	fragment@14 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			anyspi_21: anyspi@1 {
++				reg = <1>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	fragment@15 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			anyspi_22: anyspi@2 {
++				reg = <2>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	__overrides__ {
++		spi0-0 = <0>, "+0+8";
++		spi0-1 = <0>, "+1+9";
++		spi1-0 = <0>, "+2+10";
++		spi1-1 = <0>, "+3+11";
++		spi1-2 = <0>, "+4+12";
++		spi2-0 = <0>, "+5+13";
++		spi2-1 = <0>, "+6+14";
++		spi2-2 = <0>, "+7+15";
++		dev = <&anyspi_00>,"compatible",
++		      <&anyspi_01>,"compatible",
++		      <&anyspi_10>,"compatible",
++		      <&anyspi_11>,"compatible",
++		      <&anyspi_12>,"compatible",
++		      <&anyspi_20>,"compatible",
++		      <&anyspi_21>,"compatible",
++		      <&anyspi_22>,"compatible";
++		speed = <&anyspi_00>, "spi-max-frequency:0",
++		        <&anyspi_01>, "spi-max-frequency:0",
++		        <&anyspi_10>, "spi-max-frequency:0",
++		        <&anyspi_11>, "spi-max-frequency:0",
++		        <&anyspi_12>, "spi-max-frequency:0",
++		        <&anyspi_20>, "spi-max-frequency:0",
++		        <&anyspi_21>, "spi-max-frequency:0",
++		        <&anyspi_22>, "spi-max-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/apds9960-overlay.dts b/arch/arm/boot/dts/overlays/apds9960-overlay.dts
+new file mode 100644
+index 000000000000..bb18cca1ac66
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/apds9960-overlay.dts
+@@ -0,0 +1,55 @@
++// Definitions for APDS-9960 ambient light and gesture sensor
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c1>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			apds9960_pins: apds9960_pins@39 {
++				brcm,pins = <4>;
++				brcm,function = <0>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&apds9960>;
++		apds9960_irq: __overlay__ {
++			#interrupt-cells = <2>;
++			interrupt-parent = <&gpio>;
++			interrupts = <4 1>;
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			apds9960: apds@39 {
++				compatible = "avago,apds9960";
++				reg = <0x39>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		gpiopin = <&apds9960_pins>,"brcm,pins:0",
++				<&apds9960_irq>,"interrupts:0";
++		noints = <0>,"!1!2";
++	};
++};
++
+diff --git a/arch/arm/boot/dts/overlays/applepi-dac-overlay.dts b/arch/arm/boot/dts/overlays/applepi-dac-overlay.dts
+new file mode 100644
+index 000000000000..cb7649d3a613
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/applepi-dac-overlay.dts
+@@ -0,0 +1,57 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++    compatible = "brcm,bcm2835";
++
++    fragment@0 {
++        target = <&sound>;
++        __overlay__ {
++            compatible = "simple-audio-card";
++            simple-audio-card,name = "ApplePi-DAC";
++
++            status = "okay";
++
++            playback_link: simple-audio-card,dai-link@1 {
++                format = "i2s";
++
++                p_cpu_dai: cpu {
++                    sound-dai = <&i2s_clk_producer>;
++                    dai-tdm-slot-num = <2>;
++                    dai-tdm-slot-width = <32>;
++                };
++
++                p_codec_dai: codec {
++                    sound-dai = <&codec_out>;
++                };
++            };
++        };
++    };
++
++    fragment@1 {
++        target-path = "/";
++        __overlay__ {
++            codec_out: pcm1794a-codec {
++                #sound-dai-cells = <0>;
++                compatible = "ti,pcm1794a";
++                status = "okay";
++            };
++        };
++    };
++
++    fragment@2 {
++        target = <&i2s_clk_producer>;
++        __overlay__ {
++            #sound-dai-cells = <0>;
++            status = "okay";
++        };
++    };
++};
++
++/*
++   Written by: Leonid Ayzenshtat
++   Company: Orchard Audio (www.orchardaudio.com)
++
++   compile with:
++   dtc -@ -H epapr -O dtb -o ApplePi-DAC.dtbo -W no-unit_address_vs_reg ApplePi-DAC.dts
++*/
+diff --git a/arch/arm/boot/dts/overlays/arducam-64mp-overlay.dts b/arch/arm/boot/dts/overlays/arducam-64mp-overlay.dts
+new file mode 100644
+index 000000000000..3f3d7858f2fd
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/arducam-64mp-overlay.dts
+@@ -0,0 +1,97 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for Arducam 64MP camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	i2c_frag: fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			#include "arducam-64mp.dtsi"
++		};
++	};
++
++	csi_frag: fragment@1 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++
++			port{
++				csi_ep: endpoint{
++					remote-endpoint = <&cam_endpoint>;
++					clock-lanes = <0>;
++					data-lanes = <1 2>;
++					clock-noncontinuous;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@3 {
++		target = <&cam1_clk>;
++		__overlay__ {
++			clock-frequency = <24000000>;
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@5 {
++		target = <&cam_node>;
++		__overlay__ {
++			lens-focus = <&vcm_node>;
++		};
++	};
++
++	fragment@6 {
++		target = <&csi1>;
++		__dormant__ {
++			compatible = "brcm,bcm2835-unicam-legacy";
++		};
++	};
++
++	__overrides__ {
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
++		media-controller = <0>,"!6";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&cam_node>, "clocks:0=",<&cam0_clk>,
++		       <&cam_node>, "VANA-supply:0=",<&cam0_reg>,
++		       <&vcm_node>, "VDD-supply:0=", <&cam0_reg>;
++		vcm = <&vcm_node>, "status",
++		      <0>, "=5";
++	};
++};
++
++&cam_node {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
++
++&vcm_node {
++	status = "okay";
++};
+diff --git a/arch/arm/boot/dts/overlays/arducam-64mp.dtsi b/arch/arm/boot/dts/overlays/arducam-64mp.dtsi
+new file mode 100644
+index 000000000000..ed9f2e50c287
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/arducam-64mp.dtsi
+@@ -0,0 +1,34 @@
++// Fragment that configures a Arducam64MP
++
++cam_node: arducam_64mp@1a {
++	compatible = "arducam,64mp";
++	reg = <0x1a>;
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++	clock-names = "xclk";
++
++	VANA-supply = <&cam1_reg>;	/* 2.8v */
++	VDIG-supply = <&cam_dummy_reg>;	/* 1.8v */
++	VDDL-supply = <&cam_dummy_reg>;	/* 1.2v */
++
++	rotation = <0>;
++	orientation = <2>;
++
++	port {
++		cam_endpoint: endpoint {
++			clock-lanes = <0>;
++			data-lanes = <1 2>;
++			clock-noncontinuous;
++			link-frequencies =
++				/bits/ 64 <456000000>;
++		};
++	};
++};
++
++vcm_node: dw9817_arducam64mp@c {
++	compatible = "dongwoon,dw9817-vcm";
++	reg = <0x0c>;
++	status = "disabled";
++	VDD-supply = <&cam1_reg>;
++};
+diff --git a/arch/arm/boot/dts/overlays/arducam-pivariety-overlay.dts b/arch/arm/boot/dts/overlays/arducam-pivariety-overlay.dts
+new file mode 100644
+index 000000000000..752022786f70
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/arducam-pivariety-overlay.dts
+@@ -0,0 +1,100 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for Arducam Pivariety camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	i2c_frag: fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			arducam_pivariety: arducam_pivariety@c {
++				compatible = "arducam,arducam-pivariety";
++				reg = <0x0c>;
++				status = "okay";
++
++				clocks = <&cam1_clk>;
++				clock-names = "xclk";
++
++				VANA-supply = <&cam1_reg>;	/* 2.8v */
++				VDIG-supply = <&cam_dummy_reg>;	/* 1.8v */
++				VDDL-supply = <&cam_dummy_reg>;	/* 1.2v */
++
++				rotation = <0>;
++				orientation = <2>;
++
++				port {
++					arducam_pivariety_0: endpoint {
++						remote-endpoint = <&csi1_ep>;
++						clock-lanes = <0>;
++						data-lanes = <1 2>;
++						clock-noncontinuous;
++						link-frequencies =
++							/bits/ 64 <493500000>;
++					};
++				};
++			};
++		};
++	};
++
++	csi_frag: fragment@1 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++
++			port{
++				csi1_ep: endpoint{
++					remote-endpoint = <&arducam_pivariety_0>;
++					clock-lanes = <0>;
++					data-lanes = <1 2>;
++					clock-noncontinuous;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@3 {
++		target = <&cam1_clk>;
++		__overlay__ {
++			clock-frequency = <24000000>;
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@5 {
++		target = <&csi1>;
++		__dormant__ {
++			compatible = "brcm,bcm2835-unicam-legacy";
++		};
++	};
++
++	__overrides__ {
++		rotation = <&arducam_pivariety>,"rotation:0";
++		orientation = <&arducam_pivariety>,"orientation:0";
++		media-controller = <0>,"!5";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&arducam_pivariety>, "clocks:0=",<&cam0_clk>,
++		       <&arducam_pivariety>, "VANA-supply:0=",<&cam0_reg>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/at86rf233-overlay.dts b/arch/arm/boot/dts/overlays/at86rf233-overlay.dts
+new file mode 100644
+index 000000000000..5a3f4571ee78
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/at86rf233-overlay.dts
+@@ -0,0 +1,57 @@
++/dts-v1/;
++/plugin/;
++
++/* Overlay for Atmel AT86RF233 IEEE 802.15.4 WPAN transceiver on spi0.0 */
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			lowpan0: at86rf233@0 {
++				compatible = "atmel,at86rf233";
++				reg = <0>;
++				interrupt-parent = <&gpio>;
++				interrupts = <23 4>; /* active high */
++				reset-gpio = <&gpio 24 1>;
++				sleep-gpio = <&gpio 25 1>;
++				spi-max-frequency = <3000000>;
++				xtal-trim = /bits/ 8 <0xf>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			lowpan0_pins: lowpan0_pins {
++				brcm,pins = <23 24 25>;
++				brcm,function = <0 1 1>; /* in out out */
++			};
++		};
++	};
++
++	__overrides__ {
++		interrupt = <&lowpan0>, "interrupts:0",
++			<&lowpan0_pins>, "brcm,pins:0";
++		reset     = <&lowpan0>, "reset-gpio:4",
++			<&lowpan0_pins>, "brcm,pins:4";
++		sleep     = <&lowpan0>, "sleep-gpio:4",
++			<&lowpan0_pins>, "brcm,pins:8";
++		speed     = <&lowpan0>, "spi-max-frequency:0";
++		trim      = <&lowpan0>, "xtal-trim.0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts b/arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts
+new file mode 100644
+index 000000000000..af72ea0b706a
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts
+@@ -0,0 +1,60 @@
++// Definitions for audioinjector.net audio add on soundcard
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			cs42448_mclk: codec-mclk {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-frequency = <49152000>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			cs42448: cs42448@48 {
++				#sound-dai-cells = <0>;
++				compatible = "cirrus,cs42448";
++				reg = <0x48>;
++				clocks = <&cs42448_mclk>;
++				clock-names = "mclk";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		snd: __overlay__ {
++			compatible = "ai,audioinjector-octo-soundcard";
++			mult-gpios = <&gpio 27 0>, <&gpio 22 0>, <&gpio 23 0>,
++				     <&gpio 24 0>;
++			reset-gpios = <&gpio 5 0>;
++			i2s-controller = <&i2s_clk_producer>;
++			codec = <&cs42448>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		non-stop-clocks = <&snd>, "non-stop-clocks?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/audioinjector-bare-i2s-overlay.dts b/arch/arm/boot/dts/overlays/audioinjector-bare-i2s-overlay.dts
+new file mode 100644
+index 000000000000..a536fbb1a985
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/audioinjector-bare-i2s-overlay.dts
+@@ -0,0 +1,50 @@
++// Definitions for audioinjector.net audio soundcard
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			codec_bare: codec_bare {
++				compatible = "linux,spdif-dit";
++				#sound-dai-cells = <0>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "simple-audio-card";
++			i2s-controller = <&i2s_clk_producer>;
++			status = "okay";
++
++			simple-audio-card,name = "audioinjector-bare";
++			simple-audio-card,format = "i2s";
++
++			simple-audio-card,bitclock-master = <&dailink0_master>;
++			simple-audio-card,frame-master = <&dailink0_master>;
++
++			dailink0_master: simple-audio-card,cpu {
++				sound-dai = <&i2s_clk_producer>;
++				dai-tdm-slot-num = <2>;
++				dai-tdm-slot-width = <32>;
++			};
++
++			snd_codec: simple-audio-card,codec {
++					sound-dai = <&codec_bare>;
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/audioinjector-isolated-soundcard-overlay.dts b/arch/arm/boot/dts/overlays/audioinjector-isolated-soundcard-overlay.dts
+new file mode 100644
+index 000000000000..89faed778fcb
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/audioinjector-isolated-soundcard-overlay.dts
+@@ -0,0 +1,55 @@
++// Definitions for audioinjector.net audio isolated soundcard
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			cs4272_mclk: codec-mclk {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-frequency = <24576000>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			cs4272: cs4271@10 {
++				#sound-dai-cells = <0>;
++				compatible = "cirrus,cs4271";
++				reg = <0x10>;
++				reset-gpio = <&gpio 5 0>;
++				clocks = <&cs4272_mclk>;
++				clock-names = "mclk";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		snd: __overlay__ {
++			compatible = "ai,audioinjector-isolated-soundcard";
++			mute-gpios = <&gpio 17 0>;
++			i2s-controller = <&i2s_clk_consumer>;
++			codec = <&cs4272>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/audioinjector-ultra-overlay.dts b/arch/arm/boot/dts/overlays/audioinjector-ultra-overlay.dts
+new file mode 100644
+index 000000000000..ee79441187bd
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/audioinjector-ultra-overlay.dts
+@@ -0,0 +1,71 @@
++// Definitions for audioinjector.net audio add on soundcard
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			cs4265: cs4265@4e {
++				#sound-dai-cells = <0>;
++				compatible = "cirrus,cs4265";
++				reg = <0x4e>;
++				reset-gpios = <&gpio 5 0>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "simple-audio-card";
++			i2s-controller = <&i2s_clk_consumer>;
++			status = "okay";
++
++			simple-audio-card,name = "audioinjector-ultra";
++
++			simple-audio-card,widgets =
++				"Line", "OUTPUTS",
++				"Line", "INPUTS";
++
++			simple-audio-card,routing =
++				"OUTPUTS","LINEOUTL",
++				"OUTPUTS","LINEOUTR",
++				"OUTPUTS","SPDIFOUT",
++				"LINEINL","INPUTS",
++				"LINEINR","INPUTS",
++				"MICL","INPUTS",
++				"MICR","INPUTS";
++
++			simple-audio-card,format = "i2s";
++
++			simple-audio-card,bitclock-master = <&sound_master>;
++			simple-audio-card,frame-master = <&sound_master>;
++
++			simple-audio-card,cpu {
++				sound-dai = <&i2s_clk_consumer>;
++				dai-tdm-slot-num = <2>;
++				dai-tdm-slot-width = <32>;
++			};
++
++			sound_master: simple-audio-card,codec {
++				sound-dai = <&cs4265>;
++				system-clock-frequency = <12288000>;
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/audioinjector-wm8731-audio-overlay.dts b/arch/arm/boot/dts/overlays/audioinjector-wm8731-audio-overlay.dts
+new file mode 100644
+index 000000000000..417353b2798e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/audioinjector-wm8731-audio-overlay.dts
+@@ -0,0 +1,39 @@
++// Definitions for audioinjector.net audio add on soundcard
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			wm8731@1a {
++				#sound-dai-cells = <0>;
++				compatible = "wlf,wm8731";
++				reg = <0x1a>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "ai,audioinjector-pi-soundcard";
++			i2s-controller = <&i2s_clk_consumer>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/audiosense-pi-overlay.dts b/arch/arm/boot/dts/overlays/audiosense-pi-overlay.dts
+new file mode 100644
+index 000000000000..a89d38b2fe19
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/audiosense-pi-overlay.dts
+@@ -0,0 +1,82 @@
++// Definitions for audiosense add on soundcard
++/dts-v1/;
++/plugin/;
++#include <dt-bindings/pinctrl/bcm2835.h>
++#include <dt-bindings/gpio/gpio.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			codec_reg_1v8: codec-reg-1v8 {
++				compatible = "regulator-fixed";
++				regulator-name = "tlv320aic3204_1v8";
++				regulator-min-microvolt = <1800000>;
++				regulator-max-microvolt = <1800000>;
++				regulator-always-on;
++			};
++
++			/* audio external oscillator */
++			codec_osc: codec_osc {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-frequency = <12000000>;	/* 12 MHz */
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			codec_rst: codec-rst {
++				brcm,pins = <26>;
++				brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			codec: tlv320aic32x4@18 {
++				#sound-dai-cells = <0>;
++				compatible = "ti,tlv320aic32x4";
++				reg = <0x18>;
++
++				clocks = <&codec_osc>;
++				clock-names = "mclk";
++
++				iov-supply = <&vdd_3v3_reg>;
++				ldoin-supply = <&vdd_3v3_reg>;
++
++				gpio-controller;
++				#gpio-cells = <2>;
++				reset-gpios = <&gpio 26 GPIO_ACTIVE_HIGH>;
++
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "as,audiosense-pi";
++			i2s-controller = <&i2s_clk_consumer>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/audremap-overlay.dts b/arch/arm/boot/dts/overlays/audremap-overlay.dts
+new file mode 100644
+index 000000000000..95027c5c8f9e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/audremap-overlay.dts
+@@ -0,0 +1,38 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++        compatible = "brcm,bcm2835";
++
++        fragment@0 {
++                target = <&audio_pins>;
++                frag0: __overlay__ {
++                        brcm,pins = <12 13>;
++                        brcm,function = <4>; /* alt0 alt0 */
++                };
++        };
++
++	fragment@1 {
++		target = <&chosen>;
++		__overlay__  {
++			bootargs = "snd_bcm2835.enable_headphones=1";
++		};
++	};
++
++	__overrides__ {
++		swap_lr = <&frag0>, "swap_lr?";
++		enable_jack = <&frag0>, "enable_jack?";
++		pins_12_13 = <&frag0>,"brcm,pins:0=12",
++		             <&frag0>,"brcm,pins:4=13",
++			     <&frag0>,"brcm,function:0=4";
++		pins_18_19 = <&frag0>,"brcm,pins:0=18",
++		             <&frag0>,"brcm,pins:4=19",
++			     <&frag0>,"brcm,function:0=2";
++		pins_40_41 = <&frag0>,"brcm,pins:0=40",
++		             <&frag0>,"brcm,pins:4=41",
++			     <&frag0>,"brcm,function:0=4";
++		pins_40_45 = <&frag0>,"brcm,pins:0=40",
++		             <&frag0>,"brcm,pins:4=45",
++			     <&frag0>,"brcm,function:0=4";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/balena-fin-overlay.dts b/arch/arm/boot/dts/overlays/balena-fin-overlay.dts
+new file mode 100644
+index 000000000000..8fc22587e69c
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/balena-fin-overlay.dts
+@@ -0,0 +1,125 @@
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&mmcnr>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&sdio_pins>;
++			bus-width = <4>;
++			brcm,overclock-50 = <35>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			sdio_pins: sdio_ovl_pins {
++				brcm,pins = <34 35 36 37 38 39>;
++				brcm,function = <7>; /* ALT3 = SD1 */
++				brcm,pull = <0 2 2 2 2 2>;
++			};
++
++			power_ctrl_pins: power_ctrl_pins {
++				brcm,pins = <40>;
++				brcm,function = <1>; // out
++			};
++		};
++	};
++
++	fragment@2 {
++		target-path = "/";
++		__overlay__ {
++			// We should switch to mmc-pwrseq-sd8787 after making it
++			// compatible with sd8887
++			// Currently that module requires two GPIOs to function since it
++			// targets a slightly different chip
++			power_ctrl: power_ctrl {
++				compatible = "gpio-poweroff";
++				gpios = <&gpio 40 1>;
++				force;
++				pinctrl-names = "default";
++				pinctrl-0 = <&power_ctrl_pins>;
++			};
++
++			i2c_soft: i2c@0 {
++				compatible = "i2c-gpio";
++				gpios = <&gpio 43 (GPIO_ACTIVE_HIGH|GPIO_OPEN_DRAIN) /* sda */
++				         &gpio 42 (GPIO_ACTIVE_HIGH|GPIO_OPEN_DRAIN) /* scl */>;
++				i2c-gpio,delay-us = <5>;
++				i2c-gpio,scl-open-drain;
++				i2c-gpio,sda-open-drain;
++				#address-cells = <1>;
++				#size-cells = <0>;
++			};
++
++			sd8xxx-wlan {
++				drvdbg = <0x6>;
++				drv_mode = <0x1>;
++				cfg80211_wext = <0xf>;
++				sta_name = "wlan";
++				wfd_name = "p2p";
++				cal_data_cfg = "none";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c_soft>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			gpio_expander: gpio_expander@20 {
++				compatible = "nxp,pca9554";
++				gpio-controller;
++				#gpio-cells = <2>;
++				reg = <0x20>;
++				status = "okay";
++			};
++
++			// rtc clock
++			ds1307: ds1307@68 {
++				compatible = "dallas,ds1307";
++				reg = <0x68>;
++				status = "okay";
++			};
++
++			// RGB LEDs (>= v1.1.0)
++			pca9633: pca9633@62 {
++				compatible = "nxp,pca9633";
++				reg = <0x62>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				red@0 {
++					label = "red";
++					reg = <0>;
++					linux,default-trigger = "none";
++				};
++				green@1 {
++					label = "green";
++					reg = <1>;
++					linux,default-trigger = "none";
++				};
++				blue@2 {
++					label = "blue";
++					reg = <2>;
++					linux,default-trigger = "none";
++				};
++				unused@3 {
++					label = "unused";
++					reg = <3>;
++					linux,default-trigger = "none";
++				};
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/bcm2712d0-overlay.dts b/arch/arm/boot/dts/overlays/bcm2712d0-overlay.dts
+new file mode 100644
+index 000000000000..3ce844f4f113
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/bcm2712d0-overlay.dts
+@@ -0,0 +1,75 @@
++// SPDX-License-Identifier: GPL-2.0
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/interrupt-controller/irq.h>
++#include <dt-bindings/interrupt-controller/arm-gic.h>
++
++/ {
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&gio>;
++		__overlay__ {
++			brcm,gpio-bank-widths = <32 4>;
++		};
++	};
++
++	fragment@1 {
++		target = <&gio_aon>;
++		__overlay__ {
++			brcm,gpio-bank-widths = <15 6>;
++		};
++	};
++
++	fragment@2 {
++		target = <&pinctrl>;
++		__overlay__ {
++			compatible = "brcm,bcm2712d0-pinctrl";
++			reg = <0x7d504100 0x20>;
++		};
++	};
++
++	fragment@3 {
++		target = <&pinctrl_aon>;
++		__overlay__ {
++			compatible = "brcm,bcm2712d0-aon-pinctrl";
++			reg = <0x7d510700 0x1c>;
++		};
++	};
++
++	fragment@4 {
++		target = <&vc4>;
++		__overlay__ {
++			compatible = "brcm,bcm2712d0-vc6", "brcm,bcm2712-vc6";
++		};
++	};
++
++	fragment@5 {
++		target = <&uart10>;
++		__overlay__ {
++			interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>;
++		};
++	};
++
++	fragment@6 {
++		target = <&spi10>;
++		__overlay__ {
++			dmas = <&dma40 3>, <&dma40 4>;
++		};
++	};
++
++	fragment@7 {
++		target = <&hdmi0>;
++		__overlay__ {
++			dmas = <&dma40 (12|(1<<30)|(1<<24)|(10<<16)|(15<<20))>;
++		};
++	};
++
++	fragment@8 {
++		target = <&hdmi1>;
++		__overlay__ {
++			dmas = <&dma40 (13|(1<<30)|(1<<24)|(10<<16)|(15<<20))>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/camera-mux-2port-overlay.dts b/arch/arm/boot/dts/overlays/camera-mux-2port-overlay.dts
+new file mode 100644
+index 000000000000..97d1988dd984
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/camera-mux-2port-overlay.dts
+@@ -0,0 +1,545 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Overlay to configure a 2 port camera multiplexer
++//
++// Configuration is based on the Arducam Doubleplexer
++// which uses a PCA9543 I2C multiplexer to handle the
++// I2C, and GPIO 4 to control the MIPI mux, and GPIO 17
++// to enable the CSI-2 mux output (gpio-hog).
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	/* Fragments that complete the individual sensor fragments */
++	/* IMX290 */
++	fragment@0 {
++		target = <&imx290_0_ep>;
++		__overlay__ {
++			data-lanes = <1 2>;
++			link-frequencies =
++				/bits/ 64 <445500000 297000000>;
++		};
++	};
++
++	fragment@1 {
++		target = <&imx290_1_ep>;
++		__overlay__ {
++			data-lanes = <1 2>;
++			link-frequencies =
++				/bits/ 64 <445500000 297000000>;
++		};
++	};
++
++	/* IMX477 */
++	fragment@10 {
++		target = <&imx477_0>;
++		__overlay__ {
++			compatible = "sony,imx477";
++		};
++	};
++
++	fragment@11 {
++		target = <&imx477_1>;
++		__overlay__ {
++			compatible = "sony,imx477";
++		};
++	};
++
++	/* Additional fragments affecting the mux nodes */
++	fragment@100 {
++		target = <&mux_in0>;
++		__dormant__ {
++			data-lanes = <1>;
++		};
++	};
++	fragment@101 {
++		target = <&mux_in0>;
++		__overlay__ {
++			data-lanes = <1 2>;
++		};
++	};
++
++	fragment@102 {
++		target = <&mux_in1>;
++		__dormant__ {
++			data-lanes = <1>;
++		};
++	};
++	fragment@103 {
++		target = <&mux_in1>;
++		__overlay__ {
++			data-lanes = <1 2>;
++		};
++	};
++
++	/* Mux define */
++	i2c_frag: fragment@200 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pca@70 {
++				reg = <0x70>;
++				compatible = "nxp,pca9543";
++
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				i2c@0 {
++					reg = <0>;
++					#address-cells = <1>;
++					#size-cells = <0>;
++
++					#define cam_node arducam_64mp_0
++					#define cam_endpoint arducam_64mp_0_ep
++					#define vcm_node arducam_64mp_0_vcm
++					#define cam1_clk clk_24mhz
++					#include "arducam-64mp.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
++					#define cam_node imx219_0
++					#define cam_endpoint imx219_0_ep
++					#define cam1_clk clk_24mhz
++					#include "imx219.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx477_0
++					#define cam_endpoint imx477_0_ep
++					#define cam1_clk clk_24mhz
++					#include "imx477_378.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx519_0
++					#define cam_endpoint imx519_0_ep
++					#define vcm_node imx519_0_vcm
++					#define cam1_clk clk_24mhz
++					#include "imx519.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
++					#define cam_node imx708_0
++					#define cam_endpoint imx708_0_ep
++					#define vcm_node imx708_0_vcm
++					#define cam1_clk clk_24mhz
++					#include "imx708.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
++					#define cam_node ov5647_0
++					#define cam_endpoint ov5647_0_ep
++					#define cam1_clk clk_25mhz
++					#include "ov5647.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov7251_0
++					#define cam_endpoint ov7251_0_ep
++					#define cam1_clk clk_24mhz
++					#include "ov7251.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov9281_0
++					#define cam_endpoint ov9281_0_ep
++					#define cam1_clk clk_24mhz
++					#include "ov9281.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx258_0
++					#define cam_endpoint imx258_0_ep
++					#define cam1_clk clk_24mhz
++					#include "imx258.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx290_0
++					#define cam_endpoint imx290_0_ep
++					#define cam1_clk clk_imx290
++					#include "imx290_327.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov2311_0
++					#define cam_endpoint ov2311_0_ep
++					#define cam1_clk clk_24mhz
++					#include "ov2311.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov64a40_0
++					#define cam_endpoint ov64a40_0_ep
++					#define vcm_node ov64a40_0_vcm
++					#define cam1_clk clk_24mhz
++					#include "ov64a40.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++				};
++
++				i2c@1 {
++					reg = <1>;
++					#address-cells = <1>;
++					#size-cells = <0>;
++
++					#define cam_node arducam_64mp_1
++					#define cam_endpoint arducam_64mp_1_ep
++					#define vcm_node arducam_64mp_1_vcm
++					#define cam1_clk clk_24mhz
++					#include "arducam-64mp.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
++					#define cam_node imx219_1
++					#define cam_endpoint imx219_1_ep
++					#define cam1_clk clk_24mhz
++					#include "imx219.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx477_1
++					#define cam_endpoint imx477_1_ep
++					#define cam1_clk clk_24mhz
++					#include "imx477_378.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx519_1
++					#define cam_endpoint imx519_1_ep
++					#define vcm_node imx519_1_vcm
++					#define cam1_clk clk_24mhz
++					#include "imx519.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
++					#define cam_node imx708_1
++					#define cam_endpoint imx708_1_ep
++					#define vcm_node imx708_1_vcm
++					#define cam1_clk clk_24mhz
++					#include "imx708.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
++					#define cam_node ov5647_1
++					#define cam_endpoint ov5647_1_ep
++					#define cam1_clk clk_25mhz
++					#include "ov5647.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov7251_1
++					#define cam_endpoint ov7251_1_ep
++					#define cam1_clk clk_24mhz
++					#include "ov7251.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov9281_1
++					#define cam_endpoint ov9281_1_ep
++					#define cam1_clk clk_24mhz
++					#include "ov9281.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx258_1
++					#define cam_endpoint imx258_1_ep
++					#define cam1_clk clk_24mhz
++					#include "imx258.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx290_1
++					#define cam_endpoint imx290_1_ep
++					#define cam1_clk clk_imx290
++					#include "imx290_327.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov2311_1
++					#define cam_endpoint ov2311_1_ep
++					#define cam1_clk clk_24mhz
++					#include "ov2311.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov64a40_1
++					#define cam_endpoint ov64a40_1_ep
++					#define vcm_node ov64a40_1_vcm
++					#define cam1_clk clk_24mhz
++					#include "ov64a40.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++				};
++			};
++		};
++	};
++
++	csi_frag: fragment@201 {
++		target = <&csi1>;
++		__overlay__ {
++			status = "okay";
++
++			port {
++				csi1_ep: endpoint {
++					remote-endpoint = <&mux_out>;
++					clock-lanes = <0>;
++					data-lanes = <1 2>;
++				};
++			};
++		};
++	};
++
++	fragment@202 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@203 {
++		target-path="/";
++		__overlay__ {
++			mux: mux-controller {
++				compatible = "gpio-mux";
++				#mux-control-cells = <0>;
++
++				mux-gpios = <&gpio 4 GPIO_ACTIVE_HIGH>;
++			};
++
++			video-mux {
++				compatible = "video-mux";
++				mux-controls = <&mux>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				port@0 {
++					reg = <0>;
++
++					mux_in0: endpoint {
++						clock-lanes = <0>;
++					};
++				};
++
++				port@1 {
++					reg = <1>;
++
++					mux_in1: endpoint {
++						clock-lanes = <0>;
++					};
++				};
++
++				port@2 {
++					reg = <2>;
++
++					mux_out: endpoint {
++						remote-endpoint = <&csi1_ep>;
++						clock-lanes = <0>;
++					};
++				};
++			};
++
++			clk_24mhz: clk_24mhz {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++
++				clock-frequency = <24000000>;
++				status = "okay";
++			};
++
++			clk_25mhz: clk_25mhz {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++
++				clock-frequency = <25000000>;
++				status = "okay";
++			};
++
++			clk_imx290: clk_imx290 {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++
++				clock-frequency = <37125000>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@204 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@205 {
++		target = <&gpio>;
++		__overlay__ {
++			mipi_sw_oe_hog {
++				gpio-hog;
++				gpios = <17 GPIO_ACTIVE_LOW>;
++				output-high;
++			};
++		};
++	};
++
++	__overrides__ {
++		cam0-arducam-64mp = <&mux_in0>, "remote-endpoint:0=",<&arducam_64mp_0_ep>,
++				    <&arducam_64mp_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++				    <&mux_in0>, "clock-noncontinuous?",
++				    <&arducam_64mp_0>, "status=okay",
++				    <&arducam_64mp_0_vcm>, "status=okay",
++				    <&arducam_64mp_0>,"lens-focus:0=", <&arducam_64mp_0_vcm>;
++		cam0-imx219 = <&mux_in0>, "remote-endpoint:0=",<&imx219_0_ep>,
++			      <&imx219_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&mux_in0>, "clock-noncontinuous?",
++			      <&imx219_0>, "status=okay";
++		cam0-imx477 = <&mux_in0>, "remote-endpoint:0=",<&imx477_0_ep>,
++			      <&imx477_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&mux_in0>, "clock-noncontinuous?",
++			      <&imx477_0>, "status=okay";
++		cam0-imx519 = <&mux_in0>, "remote-endpoint:0=",<&imx519_0_ep>,
++			      <&imx519_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&mux_in0>, "clock-noncontinuous?",
++			      <&imx519_0>, "status=okay",
++				  <&imx519_0_vcm>, "status=okay",
++			      <&imx519_0>,"lens-focus:0=", <&imx519_0_vcm>;
++		cam0-imx708 = <&mux_in0>, "remote-endpoint:0=",<&imx708_0_ep>,
++			      <&imx708_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&mux_in0>, "clock-noncontinuous?",
++			      <&imx708_0>, "status=okay",
++			      <&imx708_0_vcm>, "status=okay",
++			      <&imx708_0>,"lens-focus:0=", <&imx708_0_vcm>;
++		cam0-ov5647 = <&mux_in0>, "remote-endpoint:0=",<&ov5647_0_ep>,
++			      <&ov5647_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&mux_in0>, "clock-noncontinuous?",
++			      <&ov5647_0>, "status=okay";
++		cam0-ov7251 = <&mux_in0>, "remote-endpoint:0=",<&ov7251_0_ep>,
++			      <&ov7251_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&ov7251_0>, "status=okay",
++			      <0>,"+100-101";
++		cam0-ov9281 = <&mux_in0>, "remote-endpoint:0=",<&ov9281_0_ep>,
++			      <&ov9281_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&ov9281_0>, "status=okay";
++		cam0-imx258 = <&mux_in0>, "remote-endpoint:0=",<&imx258_0_ep>,
++			      <&imx258_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&imx258_0>, "status=okay";
++		cam0-imx290 = <&mux_in0>, "remote-endpoint:0=",<&imx290_0_ep>,
++			      <&imx290_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&imx290_0>, "status=okay";
++		cam0-ov2311 = <&mux_in0>, "remote-endpoint:0=",<&ov2311_0_ep>,
++			      <&ov2311_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&ov2311_0>, "status=okay";
++		cam0-ov64a40 = <&mux_in0>, "remote-endpoint:0=",<&ov64a40_0_ep>,
++			      <&ov64a40_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&mux_in0>, "clock-noncontinuous?",
++			      <&ov64a40_0>, "status=okay",
++			      <&ov64a40_0_vcm>, "status=okay",
++			      <&ov64a40_0>,"lens-focus:0=", <&ov64a40_0_vcm>;
++
++		cam1-arducam-64mp = <&mux_in1>, "remote-endpoint:0=",<&arducam_64mp_1_ep>,
++				    <&arducam_64mp_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++				    <&mux_in1>, "clock-noncontinuous?",
++				    <&arducam_64mp_1>, "status=okay",
++				    <&arducam_64mp_1_vcm>, "status=okay",
++				    <&arducam_64mp_1>,"lens-focus:0=", <&arducam_64mp_1_vcm>;
++		cam1-imx219 = <&mux_in1>, "remote-endpoint:0=",<&imx219_1_ep>,
++			      <&imx219_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&mux_in1>, "clock-noncontinuous?",
++			      <&imx219_1>, "status=okay";
++		cam1-imx477 = <&mux_in1>, "remote-endpoint:0=",<&imx477_1_ep>,
++			      <&imx477_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&mux_in1>, "clock-noncontinuous?",
++			      <&imx477_1>, "status=okay";
++		cam1-imx519 = <&mux_in1>, "remote-endpoint:0=",<&imx519_1_ep>,
++			      <&imx519_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&mux_in1>, "clock-noncontinuous?",
++			      <&imx519_1>, "status=okay",
++			      <&imx519_1_vcm>, "status=okay",
++			      <&imx519_1>,"lens-focus:0=", <&imx519_1_vcm>;
++		cam1-imx708 = <&mux_in1>, "remote-endpoint:0=",<&imx708_1_ep>,
++			      <&imx708_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&mux_in1>, "clock-noncontinuous?",
++			      <&imx708_1>, "status=okay",
++			      <&imx708_1_vcm>, "status=okay",
++			      <&imx708_1>,"lens-focus:0=", <&imx708_1_vcm>;
++		cam1-ov5647 = <&mux_in1>, "remote-endpoint:0=",<&ov5647_1_ep>,
++			      <&ov5647_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&mux_in1>, "clock-noncontinuous?",
++			      <&ov5647_1>, "status=okay";
++		cam1-ov7251 = <&mux_in1>, "remote-endpoint:0=",<&ov7251_1_ep>,
++			      <&ov7251_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&ov7251_1>, "status=okay",
++			      <0>,"+102-103";
++		cam1-ov9281 = <&mux_in1>, "remote-endpoint:0=",<&ov9281_1_ep>,
++			      <&ov9281_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&ov9281_1>, "status=okay";
++		cam1-imx258 = <&mux_in1>, "remote-endpoint:0=",<&imx258_1_ep>,
++			      <&imx258_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&imx258_1>, "status=okay";
++		cam1-imx290 = <&mux_in1>, "remote-endpoint:0=",<&imx290_1_ep>,
++			      <&imx290_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&imx290_1>, "status=okay";
++		cam1-ov2311 = <&mux_in1>, "remote-endpoint:0=",<&ov2311_1_ep>,
++			      <&ov2311_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&ov2311_1>, "status=okay";
++		cam1-ov64a40 = <&mux_in1>, "remote-endpoint:0=",<&ov64a40_1_ep>,
++			      <&ov64a40_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&mux_in1>, "clock-noncontinuous?",
++			      <&ov64a40_1>, "status=okay",
++			      <&ov64a40_1_vcm>, "status=okay",
++			      <&ov64a40_1>,"lens-focus:0=", <&ov64a40_1_vcm>;
++
++		cam0-imx290-clk-freq = <&clk_imx290>,"clock-frequency:0",
++				       <&imx290_0>,"clock-frequency:0";
++		cam1-imx290-clk-freq = <&clk_imx290>,"clock-frequency:0",
++				       <&imx290_1>,"clock-frequency:0";
++
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&csi_frag>, "target:0=",<&csi0>;
++
++		cam0-sync-source = <&imx477_0>, "trigger-mode:0=1";
++		cam0-sync-sink = <&imx477_0>, "trigger-mode:0=2";
++		cam1-sync-source = <&imx477_1>, "trigger-mode:0=1";
++		cam1-sync-sink = <&imx477_1>, "trigger-mode:0=2";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/camera-mux-4port-overlay.dts b/arch/arm/boot/dts/overlays/camera-mux-4port-overlay.dts
+new file mode 100644
+index 000000000000..dbbb476f51e7
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/camera-mux-4port-overlay.dts
+@@ -0,0 +1,954 @@
++// SPDX-License-Identifier: GPL-2.0-only
++
++// Overlay to configure a 4 port camera multiplexer
++//
++// Configuration is based on the Arducam 4 channel multiplexer
++// which uses a PCA9543 I2C multiplexer to handle the
++// I2C, and GPIOs 4, 17, and 18 to control the MIPI muxes.
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	/* Fragments that complete the individual sensor fragments */
++	/* IMX290 */
++	fragment@0 {
++		target = <&imx290_0_ep>;
++		__overlay__ {
++			data-lanes = <1 2>;
++			link-frequencies =
++				/bits/ 64 <445500000 297000000>;
++		};
++	};
++
++	fragment@1 {
++		target = <&imx290_1_ep>;
++		__overlay__ {
++			data-lanes = <1 2>;
++			link-frequencies =
++				/bits/ 64 <445500000 297000000>;
++		};
++	};
++
++	fragment@2 {
++		target = <&imx290_2_ep>;
++		__overlay__ {
++			data-lanes = <1 2>;
++			link-frequencies =
++				/bits/ 64 <445500000 297000000>;
++		};
++	};
++
++	fragment@3 {
++		target = <&imx290_3_ep>;
++		__overlay__ {
++			data-lanes = <1 2>;
++			link-frequencies =
++				/bits/ 64 <445500000 297000000>;
++		};
++	};
++
++	/* IMX477 */
++	fragment@10 {
++		target = <&imx477_0>;
++		__overlay__ {
++			compatible = "sony,imx477";
++		};
++	};
++
++	fragment@11 {
++		target = <&imx477_1>;
++		__overlay__ {
++			compatible = "sony,imx477";
++		};
++	};
++
++	fragment@12 {
++		target = <&imx477_2>;
++		__overlay__ {
++			compatible = "sony,imx477";
++		};
++	};
++
++	fragment@13 {
++		target = <&imx477_3>;
++		__overlay__ {
++			compatible = "sony,imx477";
++		};
++	};
++
++	/* Additional fragments affecting the mux nodes */
++	fragment@100 {
++		target = <&mux_in0>;
++		__dormant__ {
++			data-lanes = <1>;
++		};
++	};
++	fragment@101 {
++		target = <&mux_in0>;
++		__overlay__ {
++			data-lanes = <1 2>;
++		};
++	};
++
++	fragment@102 {
++		target = <&mux_in1>;
++		__dormant__ {
++			data-lanes = <1>;
++		};
++	};
++	fragment@103 {
++		target = <&mux_in1>;
++		__overlay__ {
++			data-lanes = <1 2>;
++		};
++	};
++
++	fragment@104 {
++		target = <&mux_in2>;
++		__dormant__ {
++			data-lanes = <1>;
++		};
++	};
++	fragment@105 {
++		target = <&mux_in2>;
++		__overlay__ {
++			data-lanes = <1 2>;
++		};
++	};
++
++	fragment@106 {
++		target = <&mux_in3>;
++		__dormant__ {
++			data-lanes = <1>;
++		};
++	};
++	fragment@107 {
++		target = <&mux_in3>;
++		__overlay__ {
++			data-lanes = <1 2>;
++		};
++	};
++
++	/* Mux define */
++	i2c_frag: fragment@200 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pca@70 {
++				reg = <0x70>;
++				compatible = "nxp,pca9544";
++
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				i2c@0 {
++					reg = <0>;
++					#address-cells = <1>;
++					#size-cells = <0>;
++
++					#define cam_node arducam_64mp_0
++					#define cam_endpoint arducam_64mp_0_ep
++					#define vcm_node arducam_64mp_0_vcm
++					#define cam1_clk clk_24mhz
++					#include "arducam-64mp.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
++					#define cam_node imx219_0
++					#define cam_endpoint imx219_0_ep
++					#define cam1_clk clk_24mhz
++					#include "imx219.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx477_0
++					#define cam_endpoint imx477_0_ep
++					#define cam1_clk clk_24mhz
++					#include "imx477_378.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx519_0
++					#define cam_endpoint imx519_0_ep
++					#define vcm_node imx519_0_vcm
++					#define cam1_clk clk_24mhz
++					#include "imx519.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
++					#define cam_node imx708_0
++					#define cam_endpoint imx708_0_ep
++					#define vcm_node imx708_0_vcm
++					#define cam1_clk clk_24mhz
++					#include "imx708.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
++					#define cam_node ov5647_0
++					#define cam_endpoint ov5647_0_ep
++					#define cam1_clk clk_25mhz
++					#include "ov5647.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov7251_0
++					#define cam_endpoint ov7251_0_ep
++					#define cam1_clk clk_24mhz
++					#include "ov7251.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov9281_0
++					#define cam_endpoint ov9281_0_ep
++					#define cam1_clk clk_24mhz
++					#include "ov9281.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx258_0
++					#define cam_endpoint imx258_0_ep
++					#define cam1_clk clk_24mhz
++					#include "imx258.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx290_0
++					#define cam_endpoint imx290_0_ep
++					#define cam1_clk clk_imx290
++					#include "imx290_327.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov2311_0
++					#define cam_endpoint ov2311_0_ep
++					#define cam1_clk clk_24mhz
++					#include "ov2311.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov64a40_0
++					#define cam_endpoint ov64a40_0_ep
++					#define vcm_node ov64a40_0_vcm
++					#define cam1_clk clk_24mhz
++					#include "ov64a40.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++				};
++
++				i2c@1 {
++					reg = <1>;
++					#address-cells = <1>;
++					#size-cells = <0>;
++
++					#define cam_node arducam_64mp_1
++					#define cam_endpoint arducam_64mp_1_ep
++					#define vcm_node arducam_64mp_1_vcm
++					#define cam1_clk clk_24mhz
++					#include "arducam-64mp.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
++					#define cam_node imx219_1
++					#define cam_endpoint imx219_1_ep
++					#define cam1_clk clk_24mhz
++					#include "imx219.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx477_1
++					#define cam_endpoint imx477_1_ep
++					#define cam1_clk clk_24mhz
++					#include "imx477_378.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx519_1
++					#define cam_endpoint imx519_1_ep
++					#define vcm_node imx519_1_vcm
++					#define cam1_clk clk_24mhz
++					#include "imx519.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
++					#define cam_node imx708_1
++					#define cam_endpoint imx708_1_ep
++					#define vcm_node imx708_1_vcm
++					#define cam1_clk clk_24mhz
++					#include "imx708.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
++					#define cam_node ov5647_1
++					#define cam_endpoint ov5647_1_ep
++					#define cam1_clk clk_25mhz
++					#include "ov5647.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov7251_1
++					#define cam_endpoint ov7251_1_ep
++					#define cam1_clk clk_24mhz
++					#include "ov7251.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov9281_1
++					#define cam_endpoint ov9281_1_ep
++					#define cam1_clk clk_24mhz
++					#include "ov9281.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx258_1
++					#define cam_endpoint imx258_1_ep
++					#define cam1_clk clk_24mhz
++					#include "imx258.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx290_1
++					#define cam_endpoint imx290_1_ep
++					#define cam1_clk clk_imx290
++					#include "imx290_327.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov2311_1
++					#define cam_endpoint ov2311_1_ep
++					#define cam1_clk clk_24mhz
++					#include "ov2311.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov64a40_1
++					#define cam_endpoint ov64a40_1_ep
++					#define vcm_node ov64a40_1_vcm
++					#define cam1_clk clk_24mhz
++					#include "ov64a40.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++				};
++
++				i2c@2 {
++					reg = <2>;
++					#address-cells = <1>;
++					#size-cells = <0>;
++
++					#define cam_node arducam_64mp_2
++					#define cam_endpoint arducam_64mp_2_ep
++					#define vcm_node arducam_64mp_2_vcm
++					#define cam1_clk clk_24mhz
++					#include "arducam-64mp.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
++					#define cam_node imx219_2
++					#define cam_endpoint imx219_2_ep
++					#define cam1_clk clk_24mhz
++					#include "imx219.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx477_2
++					#define cam_endpoint imx477_2_ep
++					#define cam1_clk clk_24mhz
++					#include "imx477_378.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx519_2
++					#define cam_endpoint imx519_2_ep
++					#define vcm_node imx519_2_vcm
++					#define cam1_clk clk_24mhz
++					#include "imx519.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
++					#define cam_node imx708_2
++					#define cam_endpoint imx708_2_ep
++					#define vcm_node imx708_2_vcm
++					#define cam1_clk clk_24mhz
++					#include "imx708.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
++					#define cam_node ov5647_2
++					#define cam_endpoint ov5647_2_ep
++					#define cam1_clk clk_25mhz
++					#include "ov5647.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov7251_2
++					#define cam_endpoint ov7251_2_ep
++					#define cam1_clk clk_24mhz
++					#include "ov7251.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov9281_2
++					#define cam_endpoint ov9281_2_ep
++					#define cam1_clk clk_24mhz
++					#include "ov9281.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx258_2
++					#define cam_endpoint imx258_2_ep
++					#define cam1_clk clk_24mhz
++					#include "imx258.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx290_2
++					#define cam_endpoint imx290_2_ep
++					#define cam1_clk clk_imx290
++					#include "imx290_327.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov2311_2
++					#define cam_endpoint ov2311_2_ep
++					#define cam1_clk clk_24mhz
++					#include "ov2311.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov64a40_2
++					#define cam_endpoint ov64a40_2_ep
++					#define vcm_node ov64a40_2_vcm
++					#define cam1_clk clk_24mhz
++					#include "ov64a40.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++				};
++
++				i2c@3 {
++					reg = <3>;
++					#address-cells = <1>;
++					#size-cells = <0>;
++
++					#define cam_node arducam_64mp_3
++					#define cam_endpoint arducam_64mp_3_ep
++					#define vcm_node arducam_64mp_3_vcm
++					#define cam1_clk clk_24mhz
++					#include "arducam-64mp.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
++					#define cam_node imx219_3
++					#define cam_endpoint imx219_3_ep
++					#define cam1_clk clk_24mhz
++					#include "imx219.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx477_3
++					#define cam_endpoint imx477_3_ep
++					#define cam1_clk clk_24mhz
++					#include "imx477_378.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx519_3
++					#define cam_endpoint imx519_3_ep
++					#define vcm_node imx519_3_vcm
++					#define cam1_clk clk_24mhz
++					#include "imx519.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
++					#define cam_node imx708_3
++					#define cam_endpoint imx708_3_ep
++					#define vcm_node imx708_3_vcm
++					#define cam1_clk clk_24mhz
++					#include "imx708.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++
++					#define cam_node ov5647_3
++					#define cam_endpoint ov5647_3_ep
++					#define cam1_clk clk_25mhz
++					#include "ov5647.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov7251_3
++					#define cam_endpoint ov7251_3_ep
++					#define cam1_clk clk_24mhz
++					#include "ov7251.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov9281_3
++					#define cam_endpoint ov9281_3_ep
++					#define cam1_clk clk_24mhz
++					#include "ov9281.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx258_3
++					#define cam_endpoint imx258_3_ep
++					#define cam1_clk clk_24mhz
++					#include "imx258.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node imx290_3
++					#define cam_endpoint imx290_3_ep
++					#define cam1_clk clk_imx290
++					#include "imx290_327.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov2311_3
++					#define cam_endpoint ov2311_3_ep
++					#define cam1_clk clk_24mhz
++					#include "ov2311.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef cam1_clk
++
++					#define cam_node ov64a40_3
++					#define cam_endpoint ov64a40_3_ep
++					#define vcm_node ov64a40_3_vcm
++					#define cam1_clk clk_24mhz
++					#include "ov64a40.dtsi"
++					#undef cam_node
++					#undef cam_endpoint
++					#undef vcm_node
++					#undef cam1_clk
++				};
++			};
++		};
++	};
++
++	csi_frag: fragment@201 {
++		target = <&csi1>;
++		__overlay__ {
++			status = "okay";
++
++			port {
++				csi1_ep: endpoint {
++					remote-endpoint = <&mux_out>;
++					clock-lanes = <0>;
++					data-lanes = <1 2>;
++				};
++			};
++		};
++	};
++
++	fragment@202 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@203 {
++		target-path="/";
++		__overlay__ {
++			mux: mux-controller {
++				compatible = "gpio-mux";
++				#mux-control-cells = <0>;
++
++				/* SEL, En2, En1 */
++				mux-gpios = <&gpio 4 GPIO_ACTIVE_HIGH>,
++					    <&gpio 18 GPIO_ACTIVE_HIGH>,
++					    <&gpio 17 GPIO_ACTIVE_HIGH>;
++			};
++
++			video-mux {
++				compatible = "video-mux";
++				mux-controls = <&mux>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				/* GPIO mappings settings for selecting the different
++				 * camera connectors are not direct, hence port@ values
++				 * are not straight forward.
++				 */
++				port@2 {
++					/* Port A - GPIO 17 = 0, GPIO 18 = 1,GPIO 4 = 0 */
++					reg = <2>;
++
++					mux_in0: endpoint {
++						clock-lanes = <0>;
++					};
++				};
++
++				port@3 {
++					/* Port B - GPIO 17 = 0, GPIO 18 = 1,GPIO 4 = 1 */
++					reg = <3>;
++
++					mux_in1: endpoint {
++						clock-lanes = <0>;
++					};
++				};
++
++				port@4 {
++					/* Port C - GPIO 17 = 1, GPIO 18 = 0, GPIO 4 = 0 */
++					reg = <4>;
++
++					mux_in2: endpoint {
++						clock-lanes = <0>;
++					};
++				};
++
++				port@5 {
++					/* Port D - GPIO 17 = 1, GPIO 18 = 0, GPIO 4 = 1 */
++					reg = <5>;
++
++					mux_in3: endpoint {
++						clock-lanes = <0>;
++					};
++				};
++
++				port@6 {
++					/* Output port needs to be the highest port number */
++					reg = <6>;
++
++					mux_out: endpoint {
++						remote-endpoint = <&csi1_ep>;
++						clock-lanes = <0>;
++					};
++				};
++			};
++
++			clk_24mhz: clk_24mhz {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++
++				clock-frequency = <24000000>;
++				status = "okay";
++			};
++
++			clk_25mhz: clk_25mhz {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++
++				clock-frequency = <25000000>;
++				status = "okay";
++			};
++
++			clk_imx290: clk_imx290 {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++
++				clock-frequency = <37125000>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@204 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		cam0-arducam-64mp = <&mux_in0>, "remote-endpoint:0=",<&arducam_64mp_0_ep>,
++				    <&arducam_64mp_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++				    <&mux_in0>, "clock-noncontinuous?",
++				    <&arducam_64mp_0>, "status=okay",
++				    <&arducam_64mp_0_vcm>, "status=okay",
++				    <&arducam_64mp_0>,"lens-focus:0=", <&arducam_64mp_0_vcm>;
++		cam0-imx219 = <&mux_in0>, "remote-endpoint:0=",<&imx219_0_ep>,
++			      <&imx219_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&mux_in0>, "clock-noncontinuous?",
++			      <&imx219_0>, "status=okay";
++		cam0-imx477 = <&mux_in0>, "remote-endpoint:0=",<&imx477_0_ep>,
++			      <&imx477_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&mux_in0>, "clock-noncontinuous?",
++			      <&imx477_0>, "status=okay";
++		cam0-imx519 = <&mux_in0>, "remote-endpoint:0=",<&imx519_0_ep>,
++			      <&imx519_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&mux_in0>, "clock-noncontinuous?",
++			      <&imx519_0>, "status=okay",
++			      <&imx519_0_vcm>, "status=okay",
++			      <&imx519_0>,"lens-focus:0=", <&imx519_0_vcm>;
++		cam0-imx708 = <&mux_in0>, "remote-endpoint:0=",<&imx708_0_ep>,
++			      <&imx708_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&mux_in0>, "clock-noncontinuous?",
++			      <&imx708_0>, "status=okay",
++			      <&imx708_0_vcm>, "status=okay",
++			      <&imx708_0>,"lens-focus:0=", <&imx708_0_vcm>;
++		cam0-ov5647 = <&mux_in0>, "remote-endpoint:0=",<&ov5647_0_ep>,
++			      <&ov5647_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&mux_in0>, "clock-noncontinuous?",
++			      <&ov5647_0>, "status=okay";
++		cam0-ov7251 = <&mux_in0>, "remote-endpoint:0=",<&ov7251_0_ep>,
++			      <&ov7251_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&ov7251_0>, "status=okay",
++			      <0>,"+100-101";
++		cam0-ov9281 = <&mux_in0>, "remote-endpoint:0=",<&ov9281_0_ep>,
++			      <&ov9281_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&ov9281_0>, "status=okay";
++		cam0-imx258 = <&mux_in0>, "remote-endpoint:0=",<&imx258_0_ep>,
++			      <&imx258_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&imx258_0>, "status=okay";
++		cam0-imx290 = <&mux_in0>, "remote-endpoint:0=",<&imx290_0_ep>,
++			      <&imx290_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&imx290_0>, "status=okay";
++		cam0-ov2311 = <&mux_in0>, "remote-endpoint:0=",<&ov2311_0_ep>,
++			      <&ov2311_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&ov2311_0>, "status=okay";
++		cam0-ov64a40 = <&mux_in0>, "remote-endpoint:0=",<&ov64a40_0_ep>,
++			      <&ov64a40_0_ep>, "remote-endpoint:0=",<&mux_in0>,
++			      <&mux_in0>, "clock-noncontinuous?",
++			      <&ov64a40_0>, "status=okay",
++			      <&ov64a40_0_vcm>, "status=okay",
++			      <&ov64a40_0>,"lens-focus:0=", <&ov64a40_0_vcm>;
++
++		cam1-arducam-64mp = <&mux_in1>, "remote-endpoint:0=",<&arducam_64mp_1_ep>,
++				    <&arducam_64mp_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++				    <&mux_in1>, "clock-noncontinuous?",
++				    <&arducam_64mp_1>, "status=okay",
++				    <&arducam_64mp_1_vcm>, "status=okay",
++				    <&arducam_64mp_1>,"lens-focus:0=", <&arducam_64mp_1_vcm>;
++		cam1-imx219 = <&mux_in1>, "remote-endpoint:0=",<&imx219_1_ep>,
++			      <&imx219_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&mux_in1>, "clock-noncontinuous?",
++			      <&imx219_1>, "status=okay";
++		cam1-imx477 = <&mux_in1>, "remote-endpoint:0=",<&imx477_1_ep>,
++			      <&imx477_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&mux_in1>, "clock-noncontinuous?",
++			      <&imx477_1>, "status=okay";
++		cam1-imx519 = <&mux_in1>, "remote-endpoint:0=",<&imx519_1_ep>,
++			      <&imx519_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&mux_in1>, "clock-noncontinuous?",
++			      <&imx519_1>, "status=okay",
++			      <&imx519_1_vcm>, "status=okay",
++			      <&imx519_1>,"lens-focus:0=", <&imx519_1_vcm>;
++		cam1-imx708 = <&mux_in1>, "remote-endpoint:0=",<&imx708_1_ep>,
++			      <&imx708_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&mux_in1>, "clock-noncontinuous?",
++			      <&imx708_1>, "status=okay",
++			      <&imx708_1_vcm>, "status=okay",
++			      <&imx708_1>,"lens-focus:0=", <&imx708_1_vcm>;
++		cam1-ov5647 = <&mux_in1>, "remote-endpoint:0=",<&ov5647_1_ep>,
++			      <&ov5647_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&mux_in1>, "clock-noncontinuous?",
++			      <&ov5647_1>, "status=okay";
++		cam1-ov7251 = <&mux_in1>, "remote-endpoint:0=",<&ov7251_1_ep>,
++			      <&ov7251_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&ov7251_1>, "status=okay",
++			      <0>,"+102-103";
++		cam1-ov9281 = <&mux_in1>, "remote-endpoint:0=",<&ov9281_1_ep>,
++			      <&ov9281_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&ov9281_1>, "status=okay";
++		cam1-imx258 = <&mux_in1>, "remote-endpoint:0=",<&imx258_1_ep>,
++			      <&imx258_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&imx258_1>, "status=okay";
++		cam1-imx290 = <&mux_in1>, "remote-endpoint:0=",<&imx290_1_ep>,
++			      <&imx290_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&imx290_1>, "status=okay";
++		cam1-ov2311 = <&mux_in1>, "remote-endpoint:0=",<&ov2311_1_ep>,
++			      <&ov2311_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&ov2311_1>, "status=okay";
++		cam1-ov64a40 = <&mux_in1>, "remote-endpoint:0=",<&ov64a40_1_ep>,
++			      <&ov64a40_1_ep>, "remote-endpoint:0=",<&mux_in1>,
++			      <&mux_in1>, "clock-noncontinuous?",
++			      <&ov64a40_1>, "status=okay",
++			      <&ov64a40_1_vcm>, "status=okay",
++			      <&ov64a40_1>,"lens-focus:0=", <&ov64a40_1_vcm>;
++
++		cam2-arducam-64mp = <&mux_in2>, "remote-endpoint:0=",<&arducam_64mp_2_ep>,
++				    <&arducam_64mp_2_ep>, "remote-endpoint:0=",<&mux_in2>,
++				    <&mux_in2>, "clock-noncontinuous?",
++				    <&arducam_64mp_2>, "status=okay",
++				    <&arducam_64mp_2_vcm>, "status=okay",
++				    <&arducam_64mp_2>,"lens-focus:0=", <&arducam_64mp_2_vcm>;
++		cam2-imx219 = <&mux_in2>, "remote-endpoint:0=",<&imx219_2_ep>,
++			      <&imx219_2_ep>, "remote-endpoint:0=",<&mux_in2>,
++			      <&mux_in2>, "clock-noncontinuous?",
++			      <&imx219_2>, "status=okay";
++		cam2-imx477 = <&mux_in2>, "remote-endpoint:0=",<&imx477_2_ep>,
++			      <&imx477_2_ep>, "remote-endpoint:0=",<&mux_in2>,
++			      <&mux_in2>, "clock-noncontinuous?",
++			      <&imx477_2>, "status=okay";
++		cam2-imx519 = <&mux_in2>, "remote-endpoint:0=",<&imx519_2_ep>,
++			      <&imx519_2_ep>, "remote-endpoint:0=",<&mux_in2>,
++			      <&mux_in2>, "clock-noncontinuous?",
++			      <&imx519_2>, "status=okay",
++			      <&imx519_2_vcm>, "status=okay",
++			      <&imx519_2>,"lens-focus:0=", <&imx519_2_vcm>;
++		cam2-imx708 = <&mux_in2>, "remote-endpoint:0=",<&imx708_2_ep>,
++			      <&imx708_2_ep>, "remote-endpoint:0=",<&mux_in2>,
++			      <&mux_in2>, "clock-noncontinuous?",
++			      <&imx708_2>, "status=okay",
++			      <&imx708_2_vcm>, "status=okay",
++			      <&imx708_2>,"lens-focus:0=", <&imx708_2_vcm>;
++		cam2-ov5647 = <&mux_in2>, "remote-endpoint:0=",<&ov5647_2_ep>,
++			      <&ov5647_2_ep>, "remote-endpoint:0=",<&mux_in2>,
++			      <&mux_in2>, "clock-noncontinuous?",
++			      <&ov5647_2>, "status=okay";
++		cam2-ov7251 = <&mux_in2>, "remote-endpoint:0=",<&ov7251_2_ep>,
++			      <&ov7251_2_ep>, "remote-endpoint:0=",<&mux_in2>,
++			      <&ov7251_2>, "status=okay",
++			      <0>,"+104-105";
++		cam2-ov9281 = <&mux_in2>, "remote-endpoint:0=",<&ov9281_2_ep>,
++			      <&ov9281_2_ep>, "remote-endpoint:0=",<&mux_in2>,
++			      <&ov9281_2>, "status=okay";
++		cam2-imx258 = <&mux_in2>, "remote-endpoint:0=",<&imx258_2_ep>,
++			      <&imx258_2>, "status=okay",
++			      <&imx258_2>, "remote-endpoint:0=",<&mux_in2>;
++		cam2-imx290 = <&mux_in2>, "remote-endpoint:0=",<&imx290_2_ep>,
++			      <&imx290_2_ep>, "remote-endpoint:0=",<&mux_in2>,
++			      <&imx290_2>, "status=okay";
++		cam2-ov2311 = <&mux_in2>, "remote-endpoint:0=",<&ov2311_2_ep>,
++			      <&ov2311_2_ep>, "remote-endpoint:0=",<&mux_in2>,
++			      <&ov2311_2>, "status=okay";
++		cam2-ov64a40 = <&mux_in2>, "remote-endpoint:0=",<&ov64a40_2_ep>,
++			      <&ov64a40_2_ep>, "remote-endpoint:0=",<&mux_in2>,
++			      <&mux_in2>, "clock-noncontinuous?",
++			      <&ov64a40_2>, "status=okay",
++			      <&ov64a40_2_vcm>, "status=okay",
++			      <&ov64a40_2>,"lens-focus:0=", <&ov64a40_2_vcm>;
++
++		cam3-arducam-64mp = <&mux_in3>, "remote-endpoint:0=",<&arducam_64mp_3_ep>,
++				    <&arducam_64mp_3_ep>, "remote-endpoint:0=",<&mux_in3>,
++				    <&mux_in3>, "clock-noncontinuous?",
++				    <&arducam_64mp_3>, "status=okay",
++				    <&arducam_64mp_3_vcm>, "status=okay",
++				    <&arducam_64mp_3>,"lens-focus:0=", <&arducam_64mp_3_vcm>;
++		cam3-imx219 = <&mux_in3>, "remote-endpoint:0=",<&imx219_3_ep>,
++			      <&imx219_3_ep>, "remote-endpoint:0=",<&mux_in3>,
++			      <&mux_in3>, "clock-noncontinuous?",
++			      <&imx219_3>, "status=okay";
++		cam3-imx477 = <&mux_in3>, "remote-endpoint:0=",<&imx477_3_ep>,
++			      <&imx477_3_ep>, "remote-endpoint:0=",<&mux_in3>,
++			      <&mux_in3>, "clock-noncontinuous?",
++			      <&imx477_3>, "status=okay";
++		cam3-imx519 = <&mux_in3>, "remote-endpoint:0=",<&imx519_3_ep>,
++			      <&imx519_3_ep>, "remote-endpoint:0=",<&mux_in3>,
++			      <&mux_in3>, "clock-noncontinuous?",
++			      <&imx519_3>, "status=okay",
++			      <&imx519_3_vcm>, "status=okay",
++			      <&imx519_3>,"lens-focus:0=", <&imx519_3_vcm>;
++		cam3-imx708 = <&mux_in3>, "remote-endpoint:0=",<&imx708_3_ep>,
++			      <&imx708_3_ep>, "remote-endpoint:0=",<&mux_in3>,
++			      <&mux_in3>, "clock-noncontinuous?",
++			      <&imx708_3>, "status=okay",
++			      <&imx708_3_vcm>, "status=okay",
++			      <&imx708_3>,"lens-focus:0=", <&imx708_3_vcm>;
++		cam3-ov5647 = <&mux_in3>, "remote-endpoint:0=",<&ov5647_3_ep>,
++			      <&ov5647_3_ep>, "remote-endpoint:0=",<&mux_in3>,
++			      <&mux_in3>, "clock-noncontinuous?",
++			      <&ov5647_3>, "status=okay";
++		cam3-ov7251 = <&mux_in3>, "remote-endpoint:0=",<&ov7251_3_ep>,
++			      <&ov7251_3_ep>, "remote-endpoint:0=",<&mux_in3>,
++			      <&ov7251_3>, "status=okay",
++			      <0>,"+106-107";
++		cam3-ov9281 = <&mux_in3>, "remote-endpoint:0=",<&ov9281_3_ep>,
++			      <&ov9281_3_ep>, "remote-endpoint:0=",<&mux_in3>,
++			      <&ov9281_3>, "status=okay";
++		cam3-imx258 = <&mux_in3>, "remote-endpoint:0=",<&imx258_3_ep>,
++			      <&imx258_3_ep>, "remote-endpoint:0=",<&mux_in3>,
++			      <&imx258_3>, "status=okay";
++		cam3-imx290 = <&mux_in3>, "remote-endpoint:0=",<&imx290_3_ep>,
++			      <&imx290_3_ep>, "remote-endpoint:0=",<&mux_in3>,
++			      <&imx290_3>, "status=okay";
++		cam3-ov2311 = <&mux_in3>, "remote-endpoint:0=",<&ov2311_3_ep>,
++			      <&ov2311_3_ep>, "remote-endpoint:0=",<&mux_in3>,
++			      <&ov2311_3>, "status=okay";
++		cam3-ov64a40 = <&mux_in3>, "remote-endpoint:0=",<&ov64a40_3_ep>,
++			      <&ov64a40_3_ep>, "remote-endpoint:0=",<&mux_in3>,
++			      <&mux_in3>, "clock-noncontinuous?",
++			      <&ov64a40_3>, "status=okay",
++			      <&ov64a40_3_vcm>, "status=okay",
++			      <&ov64a40_3>,"lens-focus:0=", <&ov64a40_3_vcm>;
++
++		cam0-imx290-clk-freq = <&clk_imx290>,"clock-frequency:0",
++				       <&imx290_0>,"clock-frequency:0";
++		cam1-imx290-clk-freq = <&clk_imx290>,"clock-frequency:0",
++				       <&imx290_1>,"clock-frequency:0";
++		cam2-imx290-clk-freq = <&clk_imx290>,"clock-frequency:0",
++				       <&imx290_2>,"clock-frequency:0";
++		cam3-imx290-clk-freq = <&clk_imx290>,"clock-frequency:0",
++				       <&imx290_3>,"clock-frequency:0";
++
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&csi_frag>, "target:0=",<&csi0>;
++
++		cam0-sync-source = <&imx477_0>, "trigger-mode:0=1";
++		cam0-sync-sink = <&imx477_0>, "trigger-mode:0=2";
++		cam1-sync-source = <&imx477_1>, "trigger-mode:0=1";
++		cam1-sync-sink = <&imx477_1>, "trigger-mode:0=2";
++		cam2-sync-source = <&imx477_2>, "trigger-mode:0=1";
++		cam2-sync-sink = <&imx477_2>, "trigger-mode:0=2";
++		cam3-sync-source = <&imx477_3>, "trigger-mode:0=1";
++		cam3-sync-sink = <&imx477_3>, "trigger-mode:0=2";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/cap1106-overlay.dts b/arch/arm/boot/dts/overlays/cap1106-overlay.dts
+new file mode 100644
+index 000000000000..0a585e725f84
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/cap1106-overlay.dts
+@@ -0,0 +1,52 @@
++// Overlay for cap1106 from  Microchip Semiconductor
++// add CONFIG_KEYBOARD_CAP11XX=y
++
++/dts-v1/;
++/plugin/;
++
++/ {
++        compatible = "brcm,bcm2835";
++        fragment@0 {
++                target = <&i2c1>;
++                __overlay__{
++                        status = "okay";
++                        cap1106: cap1106@28 {
++                                compatible = "microchip,cap1106";
++                                pinctrl-0 = <&cap1106_pins>;
++                                pinctrl-names = "default";
++                                interrupt-parent = <&gpio>;
++                                interrupts = <4 2>;
++                                reg = <0x28>;
++                                autorepeat;
++                                microchip,sensor-gain = <2>;
++
++                                linux,keycodes = <2>,           /* KEY_1 */
++                                                <3>,            /* KEY_2 */
++                                                <4>,            /* KEY_3 */
++                                                <5>,            /* KEY_4 */
++                                                <6>,            /* KEY_5 */
++                                                <7>;            /* KEY_6 */
++
++                                #address-cells = <1>;
++                                #size-cells = <0>;
++                                status = "okay";
++
++                        };
++                };
++        };
++        fragment@1 {
++                target = <&gpio>;
++                __overlay__ {
++                        cap1106_pins: cap1106_pins {
++                                brcm,pins = <4>;
++                                brcm,function = <0>; /* in */
++                                brcm,pull = <0>; /* none */
++                        };
++                };
++        };
++
++        __overrides__ {
++                int_pin = <&cap1106>, "interrupts:0",
++                          <&cap1106_pins>, "brcm,pins:0";
++        };
++};
+diff --git a/arch/arm/boot/dts/overlays/chipcap2-overlay.dts b/arch/arm/boot/dts/overlays/chipcap2-overlay.dts
+new file mode 100644
+index 000000000000..e0b627e036cd
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/chipcap2-overlay.dts
+@@ -0,0 +1,66 @@
++/dts-v1/;
++/plugin/;
++
++/* Overlay for ChipCap 2 on i2c */
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/interrupt-controller/irq.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			chipcap2: chipcap2@28 {
++				compatible = "amphenol,cc2d23s";
++				reg = <0x28>;
++				interrupt-parent = <&gpio>;
++				interrupts = <4 IRQ_TYPE_EDGE_RISING>,
++					     <5 IRQ_TYPE_EDGE_RISING>,
++					     <6 IRQ_TYPE_EDGE_RISING>;
++				interrupt-names = "ready", "low", "high";
++				vdd-supply = <&chipcap2_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			chipcap2_pins: chipcap2_pins {
++				brcm,pins = <4 5 6 26>;
++				brcm,function = <0 0 0 1>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target-path = "/";
++		__overlay__ {
++			chipcap2_reg: chipcap2_reg {
++				compatible = "regulator-fixed";
++				regulator-name = "chipcap2_reg";
++				regulator-min-microvolt = <3300000>;
++				regulator-max-microvolt = <3300000>;
++				gpio = <&gpio 26 GPIO_ACTIVE_HIGH>;
++				enable-active-high;
++			};
++		};
++	};
++
++	__overrides__ {
++		ready_pin = <&chipcap2>, "interrupts:0",
++			    <&chipcap2_pins>, "brcm,pins:0";
++		low_pin = <&chipcap2>, "interrupts:8",
++			  <&chipcap2_pins>, "brcm,pins:4";
++		high_pin = <&chipcap2>, "interrupts:16",
++			   <&chipcap2_pins>, "brcm,pins:8";
++		reg_pin = <&chipcap2_reg>, "gpio:4",
++			  <&chipcap2_pins>, "brcm,pins:12";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/chipdip-dac-overlay.dts b/arch/arm/boot/dts/overlays/chipdip-dac-overlay.dts
+new file mode 100644
+index 000000000000..3ef7565a9312
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/chipdip-dac-overlay.dts
+@@ -0,0 +1,46 @@
++/*
++ * Device Tree overlay for ChipDip DAC
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			spdif-transmitter {
++				#address-cells = <0>;
++				#size-cells = <0>;
++				#sound-dai-cells = <0>;
++				compatible = "linux,spdif-dit";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "chipdip,chipdip-dac";
++			i2s-controller = <&i2s_clk_consumer>;
++			sr0-gpios = <&gpio 5 0>;
++			sr1-gpios = <&gpio 6 0>;
++			sr2-gpios = <&gpio 12 0>;
++			res0-gpios = <&gpio 24 0>;
++			res1-gpios = <&gpio 27 0>;
++			mute-gpios = <&gpio 4 0>;
++			sdwn-gpios = <&gpio 13 0>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/cirrus-wm5102-overlay.dts b/arch/arm/boot/dts/overlays/cirrus-wm5102-overlay.dts
+new file mode 100644
+index 000000000000..a82b422ba16e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/cirrus-wm5102-overlay.dts
+@@ -0,0 +1,172 @@
++// Definitions for the Cirrus Logic Audio Card
++/dts-v1/;
++/plugin/;
++#include <dt-bindings/pinctrl/bcm2835.h>
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/mfd/arizona.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			wlf_5102_pins: wlf_5102_pins {
++				brcm,pins = <17 22 27>;
++				brcm,function = <
++					BCM2835_FSEL_GPIO_OUT
++					BCM2835_FSEL_GPIO_OUT
++					BCM2835_FSEL_GPIO_IN
++				>;
++			};
++			wlf_8804_pins: wlf_8804_pins {
++				brcm,pins = <8>;
++				brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&spi0_cs_pins>;
++		__overlay__ {
++			brcm,pins = <7>;
++			brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++		};
++	};
++
++
++	fragment@3 {
++		target-path = "/";
++		__overlay__ {
++			rpi_cirrus_reg_1v8: rpi_cirrus_reg_1v8 {
++				compatible = "regulator-fixed";
++				regulator-name = "RPi-Cirrus 1v8";
++				regulator-min-microvolt = <1800000>;
++				regulator-max-microvolt = <1800000>;
++				regulator-always-on;
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@5 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@6 {
++		target = <&spi0>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			cs-gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
++
++			wm5102@0{
++				compatible = "wlf,wm5102";
++				reg = <0>;
++
++				pinctrl-names = "default";
++				pinctrl-0 = <&wlf_5102_pins>;
++
++				spi-max-frequency = <500000>;
++
++				interrupt-parent = <&gpio>;
++				interrupts = <27 8>;
++				interrupt-controller;
++				#interrupt-cells = <2>;
++
++				gpio-controller;
++				#gpio-cells = <2>;
++
++				LDOVDD-supply = <&rpi_cirrus_reg_1v8>;
++				AVDD-supply = <&rpi_cirrus_reg_1v8>;
++				DBVDD1-supply = <&rpi_cirrus_reg_1v8>;
++				DBVDD2-supply = <&vdd_3v3_reg>;
++				DBVDD3-supply = <&vdd_3v3_reg>;
++				CPVDD-supply = <&rpi_cirrus_reg_1v8>;
++				SPKVDDL-supply = <&vdd_5v0_reg>;
++				SPKVDDR-supply = <&vdd_5v0_reg>;
++				DCVDD-supply = <&arizona_ldo1>;
++
++				reset-gpios = <&gpio 17 GPIO_ACTIVE_HIGH>;
++				wlf,ldoena = <&gpio 22 GPIO_ACTIVE_HIGH>;
++				wlf,gpio-defaults = <
++					ARIZONA_GP_DEFAULT
++					ARIZONA_GP_DEFAULT
++					ARIZONA_GP_DEFAULT
++					ARIZONA_GP_DEFAULT
++					ARIZONA_GP_DEFAULT
++				>;
++				wlf,micd-configs = <0 1 0>;
++				wlf,dmic-ref = <
++					ARIZONA_DMIC_MICVDD
++					ARIZONA_DMIC_MICBIAS2
++					ARIZONA_DMIC_MICVDD
++					ARIZONA_DMIC_MICVDD
++				>;
++				wlf,inmode = <
++					ARIZONA_INMODE_DIFF
++					ARIZONA_INMODE_DMIC
++					ARIZONA_INMODE_SE
++					ARIZONA_INMODE_DIFF
++				>;
++				status = "okay";
++
++				arizona_ldo1: ldo1 {
++					regulator-name = "LDO1";
++					// default constraints as in
++					// arizona-ldo1.c
++					regulator-min-microvolt = <1200000>;
++					regulator-max-microvolt = <1800000>;
++				};
++			};
++		};
++	};
++
++	fragment@7 {
++		target = <&i2c1>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			wm8804@3b {
++				compatible = "wlf,wm8804";
++				reg = <0x3b>;
++				status = "okay";
++
++				pinctrl-names = "default";
++				pinctrl-0 = <&wlf_8804_pins>;
++
++				PVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				wlf,reset-gpio = <&gpio 8 GPIO_ACTIVE_HIGH>;
++			};
++		};
++	};
++
++	fragment@8 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "wlf,rpi-cirrus";
++			i2s-controller = <&i2s_clk_consumer>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/cm-swap-i2c0-overlay.dts b/arch/arm/boot/dts/overlays/cm-swap-i2c0-overlay.dts
+new file mode 100644
+index 000000000000..6b7f599f7611
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/cm-swap-i2c0-overlay.dts
+@@ -0,0 +1,27 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX708 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c0mux>;
++		i2c0mux_frag: __overlay__ {
++			pinctrl-0 = <&i2c0_gpio28>;
++			pinctrl-1 = <&i2c0_gpio0>;
++		};
++	};
++
++	__overrides__ {
++		i2c0-gpio0 = <&i2c0mux_frag>, "pinctrl-0:0=",<&i2c0_gpio0>;
++		i2c0-gpio28 = <&i2c0mux_frag>, "pinctrl-0:0=",<&i2c0_gpio28>;
++		i2c0-gpio44 = <&i2c0mux_frag>, "pinctrl-0:0=",<&i2c0_gpio44>;
++		i2c10-gpio0 = <&i2c0mux_frag>, "pinctrl-1:0=",<&i2c0_gpio0>;
++		i2c10-gpio28 = <&i2c0mux_frag>, "pinctrl-1:0=",<&i2c0_gpio28>;
++		i2c10-gpio44 = <&i2c0mux_frag>, "pinctrl-1:0=",<&i2c0_gpio44>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/cma-overlay.dts b/arch/arm/boot/dts/overlays/cma-overlay.dts
+new file mode 100644
+index 000000000000..1d87c599f909
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/cma-overlay.dts
+@@ -0,0 +1,36 @@
++/*
++ * cma.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&cma>;
++		frag0: __overlay__ {
++			/*
++			 * The default size when using this overlay is 256 MB
++			 * and should be kept as is for backwards
++			 * compatibility.
++			 */
++			size = <0x10000000>;
++		};
++	};
++
++	__overrides__ {
++		cma-512 = <&frag0>,"size:0=",<0x20000000>;
++		cma-448 = <&frag0>,"size:0=",<0x1c000000>;
++		cma-384 = <&frag0>,"size:0=",<0x18000000>;
++		cma-320 = <&frag0>,"size:0=",<0x14000000>;
++		cma-256 = <&frag0>,"size:0=",<0x10000000>;
++		cma-192 = <&frag0>,"size:0=",<0xC000000>;
++		cma-128 = <&frag0>,"size:0=",<0x8000000>;
++		cma-96  = <&frag0>,"size:0=",<0x6000000>;
++		cma-64  = <&frag0>,"size:0=",<0x4000000>;
++		cma-size = <&frag0>,"size:0"; /* in bytes, 4MB aligned */
++		cma-default = <0>,"-0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/crystalfontz-cfa050_pi_m-overlay.dts b/arch/arm/boot/dts/overlays/crystalfontz-cfa050_pi_m-overlay.dts
+new file mode 100644
+index 000000000000..544036589b66
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/crystalfontz-cfa050_pi_m-overlay.dts
+@@ -0,0 +1,124 @@
++/*
++ * crystalfontz-cfa050_pi_m-overlay.dts
++ * Configures the Crystalfontz CFA050-PI-M series of modules
++ * using CFAF7201280A0-050TC/TN panels with RaspberryPi CM4 DSI1
++ */
++/dts-v1/;
++/plugin/;
++/{
++// RaspberryPi CM4
++	compatible = "brcm,bcm2835";
++// PCF8574 I2C GPIO EXPANDER
++	fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			pcf8574a: pcf8574a@38 {
++				reg = <0x38>;
++				compatible = "nxp,pcf8574";
++				gpio-controller;
++				#gpio-cells = <2>;
++				ngpios = <8>;
++				gpio-line-names = "TFT_RESET", "TOUCH_RESET", "EXT_P2", "EXT_P3",
++					"EXT_P4", "EXT_P5", "EXT_P6", "EXT_P7";
++			};
++		};
++	};
++// LM3630a BACKLIGHT LED CONTROLLER
++	fragment@1 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			lm3630a: backlight@36 {
++				reg = <0x36>;
++				compatible = "ti,lm3630a";
++				#address-cells = <1>;
++				#size-cells = <0>;
++				led@0 {
++					reg = <0>;
++					led-sources = <0 1>;
++					label = "lcd-backlight";
++					default-brightness = <128>;
++					max-brightness = <255>;
++				};
++			};
++		};
++	};
++// CFAF7201280A0_050Tx TFT DSI PANEL
++	fragment@2 {
++		target = <&dsi1>;
++		__overlay__  {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			port {
++				dsi_out: endpoint {
++					remote-endpoint = <&panel_in>;
++				};
++			};
++			dsi_panel: dsi_panel@0 {
++				compatible = "crystalfontz,cfaf7201280a0_050tx";
++				reg = <0>;
++				reset-gpios = <&pcf8574a 0 1>;
++				backlight = <&lm3630a>;
++				fps = <60>;
++				port {
++					panel_in: endpoint {
++						remote-endpoint = <&dsi_out>;
++					};
++				};
++			};
++		};
++	};
++// rPI GPIO INPUT FOR TOUCH IC IRQ
++	fragment@3 {
++		target = <&gpio>;
++		__dormant__ {
++			gt928intpins: gt928intpins {
++				brcm,pins = <26>;
++				brcm,function = <0>;
++				brcm,pull = <1>;
++			};
++		};
++	};
++// GT928 TOUCH CONTROLLER IC
++	fragment@4 {
++		target = <&i2c_csi_dsi>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			gt928@5d {
++				compatible = "goodix,gt928";
++				reg = <0x5d>;
++				interrupt-parent = <&gpio>;
++				interrupts = <26 2>;
++				irq-gpios = <&gpio 26 0>;
++				reset-gpios = <&pcf8574a 1 1>;
++				touchscreen-inverted-x;
++				touchscreen-inverted-y;
++			};
++		};
++	};
++// PCF85063A RTC on I2C
++	fragment@5 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			pcf85063a@51 {
++				compatible = "nxp,pcf85063a";
++				reg = <0x51>;
++			};
++		};
++	};
++// CAPACITIVE TOUCH OPTION FOR TFT PANEL
++	__overrides__ {
++		captouch = <0>,"+3+4";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/cutiepi-panel-overlay.dts b/arch/arm/boot/dts/overlays/cutiepi-panel-overlay.dts
+new file mode 100644
+index 000000000000..d14c3698eb75
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/cutiepi-panel-overlay.dts
+@@ -0,0 +1,117 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++    compatible = "brcm,bcm2711";
++
++    fragment@0 {
++        target=<&dsi1>;
++
++        __overlay__ {
++            status = "okay";
++
++            #address-cells = <1>;
++            #size-cells = <0>;
++
++            port {
++                dsi1_out_port: endpoint {
++                    remote-endpoint = <&panel_dsi_in1>;
++                };
++            };
++
++            display1: panel@0 {
++                compatible = "nwe,nwe080";
++                reg=<0>;
++                backlight = <&rpi_backlight>;
++                reset-gpios = <&gpio 20 0>;
++                port {
++                    panel_dsi_in1: endpoint {
++                        remote-endpoint = <&dsi1_out_port>;
++                    };
++                };
++            };
++        };
++    };
++
++    fragment@1 {
++        target = <&gpio>;
++        __overlay__ {
++            pwm_pins: pwm_pins {
++                brcm,pins = <12>;
++                brcm,function = <4>; // ALT0
++            };
++        };
++    };
++
++    fragment@2 {
++        target = <&pwm>;
++        frag1: __overlay__ {
++            pinctrl-names = "default";
++            pinctrl-0 = <&pwm_pins>;
++            assigned-clock-rates = <1000000>;
++            status = "okay";
++        };
++    };
++
++    fragment@3 {
++        target-path = "/";
++        __overlay__ {
++            rpi_backlight: rpi_backlight {
++                compatible = "pwm-backlight";
++                brightness-levels = <0 6 8 12 16 24 32 40 48 64 96 128 160 192 224 255>;
++                default-brightness-level = <6>;
++                pwms = <&pwm 0 200000 0>;
++                power-supply = <&vdd_3v3_reg>;
++                status = "okay";
++            };
++        };
++    };
++
++    fragment@4 {
++        target = <&i2c6>;
++        frag0: __overlay__ {
++            status = "okay";
++            pinctrl-names = "default";
++            pinctrl-0 = <&i2c6_pins>;
++            clock-frequency = <100000>;
++        };
++    };
++
++    fragment@5 {
++        target = <&i2c6_pins>;
++        __overlay__ {
++            brcm,pins = <22 23>;
++        };
++    };
++
++    fragment@6 {
++            target = <&gpio>;
++            __overlay__ {
++                goodix_pins: goodix_pins {
++                    brcm,pins = <21 26>; // interrupt and reset
++                    brcm,function = <0 0>; // in
++                    brcm,pull = <2 2>; // pull-up
++                };
++            };
++    };
++
++    fragment@7 {
++        target = <&i2c6>;
++        __overlay__ {
++            #address-cells = <1>;
++            #size-cells = <0>;
++            status = "okay";
++
++            gt9xx: gt9xx@5d {
++                compatible = "goodix,gt9271"; 
++                reg = <0x5D>;
++                pinctrl-names = "default";
++                pinctrl-0 = <&goodix_pins>;
++                interrupt-parent = <&gpio>;
++                interrupts = <21 2>; // high-to-low edge triggered
++                irq-gpios = <&gpio 21 0>; 
++                reset-gpios = <&gpio 26 0>;
++            };
++        };
++    };
++};
+diff --git a/arch/arm/boot/dts/overlays/dacberry400-overlay.dts b/arch/arm/boot/dts/overlays/dacberry400-overlay.dts
+new file mode 100644
+index 000000000000..c9ac11db20de
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/dacberry400-overlay.dts
+@@ -0,0 +1,71 @@
++// Definitions for DACberry400
++/dts-v1/;
++/plugin/;
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			codec_1v8_reg: codec-1v8-reg {
++			compatible = "regulator-fixed";
++			regulator-name = "tlv320aic3104_1v8";
++			regulator-min-microvolt = <1800000>;
++			regulator-max-microvolt = <1800000>;
++			regulator-always-on;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			codec_rst: codec-rst {
++				brcm,pins = <26>;
++				brcm,function = <1>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			tlv320aic3104@18 {
++				#sound-dai-cells = <0>;
++				reg = <0x18>;
++
++				compatible = "ti,tlv320aic3x";
++				AVDD-supply = <&vdd_3v3_reg>;
++				DRVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&codec_1v8_reg>;
++				IOVDD-supply = <&codec_1v8_reg>;
++
++				gpio-controller;
++				reset-gpios = <&gpio 26 1>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "osaelectronics,dacberry400";
++			i2s-controller = <&i2s_clk_producer>;
++			status = "okay";
++		};
++	};
++};
++
++
+diff --git a/arch/arm/boot/dts/overlays/dht11-overlay.dts b/arch/arm/boot/dts/overlays/dht11-overlay.dts
+new file mode 100644
+index 000000000000..8b0fc6b7a3cb
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/dht11-overlay.dts
+@@ -0,0 +1,48 @@
++/*
++ * Overlay for the DHT11/21/22 humidity/temperature sensor modules.
++ */
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			dht11: dht11@4 {
++				compatible = "dht11";
++				pinctrl-names = "default";
++				pinctrl-0 = <&dht11_pins>;
++				gpios = <&gpio 4 0>;
++				status = "okay";
++				#io-channel-cells = <1>;
++			};
++
++			iio: iio-hwmon@4 {
++				compatible = "iio-hwmon";
++				status = "okay";
++				io-channels = <&dht11 0>, <&dht11 1>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			dht11_pins: dht11_pins@4 {
++				brcm,pins = <4>;
++				brcm,function = <0>; // in
++				brcm,pull = <0>; // off
++			};
++		};
++	};
++
++	__overrides__ {
++		gpiopin = <&dht11_pins>,"brcm,pins:0",
++			<&dht11_pins>, "reg:0",
++			<&dht11>,"gpios:4",
++			<&dht11>,"reg:0",
++			<&iio>,"reg:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/dionaudio-kiwi-overlay.dts b/arch/arm/boot/dts/overlays/dionaudio-kiwi-overlay.dts
+new file mode 100644
+index 000000000000..ab0144cd17dc
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/dionaudio-kiwi-overlay.dts
+@@ -0,0 +1,39 @@
++// Definitions for Dion Audio KIWI streamer
++
++/*
++ * PCM1794 DAC (in hardware mode).
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			pcm1794a-codec {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm1794a";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "dionaudio,dionaudio-kiwi";
++			i2s-controller = <&i2s_clk_producer>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/dionaudio-loco-overlay.dts b/arch/arm/boot/dts/overlays/dionaudio-loco-overlay.dts
+new file mode 100644
+index 000000000000..6f4a9c1a8243
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/dionaudio-loco-overlay.dts
+@@ -0,0 +1,39 @@
++// Definitions for Dion Audio LOCO DAC-AMP
++
++/*
++ * PCM5242 DAC (in hardware mode) and TPA3118 AMP.
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			pcm5102a-codec {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5102a";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "dionaudio,loco-pcm5242-tpa3118";
++			i2s-controller = <&i2s_clk_producer>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/dionaudio-loco-v2-overlay.dts b/arch/arm/boot/dts/overlays/dionaudio-loco-v2-overlay.dts
+new file mode 100644
+index 000000000000..975a844eb272
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/dionaudio-loco-v2-overlay.dts
+@@ -0,0 +1,49 @@
++/*
++ * Definitions for Dion Audio LOCO-V2 DAC-AMP
++ *  eg. dtoverlay=dionaudio-loco-v2
++ *
++ * PCM5242 DAC (in software mode) and TPA3255 AMP.
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&sound>;
++		frag0: __overlay__ {
++			compatible = "dionaudio,dionaudio-loco-v2";
++			i2s-controller = <&i2s_clk_producer>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm5122@4c {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4d>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain = <&frag0>,"dionaudio,24db_digital_gain?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/disable-bt-overlay.dts b/arch/arm/boot/dts/overlays/disable-bt-overlay.dts
+new file mode 100644
+index 000000000000..f3a8af1375f0
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/disable-bt-overlay.dts
+@@ -0,0 +1,59 @@
++/dts-v1/;
++/plugin/;
++
++/* Disable Bluetooth and restore UART0/ttyAMA0 over GPIOs 14 & 15. */
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&uart1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&uart0>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&uart0_pins>;
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&bt>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&uart0_pins>;
++		__overlay__ {
++			brcm,pins;
++			brcm,function;
++			brcm,pull;
++		};
++	};
++
++	fragment@4 {
++		target = <&bt_pins>;
++		__overlay__ {
++			brcm,pins;
++			brcm,function;
++			brcm,pull;
++		};
++	};
++
++	fragment@5 {
++		target-path = "/aliases";
++		__overlay__ {
++			serial0 = "/soc/serial@7e201000";
++			serial1 = "/soc/serial@7e215040";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/disable-bt-pi5-overlay.dts b/arch/arm/boot/dts/overlays/disable-bt-pi5-overlay.dts
+new file mode 100644
+index 000000000000..6e23b64d44e7
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/disable-bt-pi5-overlay.dts
+@@ -0,0 +1,17 @@
++/dts-v1/;
++/plugin/;
++
++/* Disable Bluetooth */
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&bluetooth>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/disable-emmc2-overlay.dts b/arch/arm/boot/dts/overlays/disable-emmc2-overlay.dts
+new file mode 100644
+index 000000000000..8cd1d7fa4a90
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/disable-emmc2-overlay.dts
+@@ -0,0 +1,13 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&emmc2>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/disable-wifi-overlay.dts b/arch/arm/boot/dts/overlays/disable-wifi-overlay.dts
+new file mode 100644
+index 000000000000..75e046463900
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/disable-wifi-overlay.dts
+@@ -0,0 +1,20 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&mmc>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&mmcnr>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/disable-wifi-pi5-overlay.dts b/arch/arm/boot/dts/overlays/disable-wifi-pi5-overlay.dts
+new file mode 100644
+index 000000000000..d5389c5dbb69
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/disable-wifi-pi5-overlay.dts
+@@ -0,0 +1,13 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&sdio2>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/dpi18-overlay.dts b/arch/arm/boot/dts/overlays/dpi18-overlay.dts
+new file mode 100644
+index 000000000000..4abe5be744db
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/dpi18-overlay.dts
+@@ -0,0 +1,39 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	// There is no DPI driver module, but we need a platform device
++	// node (that doesn't already use pinctrl) to hang the pinctrl
++	// reference on - leds will do
++
++	fragment@0 {
++		target = <&fb>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&dpi18_pins>;
++		};
++	};
++
++	fragment@1 {
++		target = <&vc4>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&dpi18_pins>;
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			dpi18_pins: dpi18_pins {
++				brcm,pins = <0 1 2 3 4 5 6 7 8 9 10 11
++					     12 13 14 15 16 17 18 19 20
++					     21>;
++				brcm,function = <6>; /* alt2 */
++				brcm,pull = <0>; /* no pull */
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/dpi18cpadhi-overlay.dts b/arch/arm/boot/dts/overlays/dpi18cpadhi-overlay.dts
+new file mode 100644
+index 000000000000..50c88a1ed299
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/dpi18cpadhi-overlay.dts
+@@ -0,0 +1,26 @@
++/*
++ * dpi18cpadhi-overlay.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&fb>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&dpi_18bit_cpadhi_gpio0>;
++		};
++	};
++
++	fragment@1 {
++		target = <&vc4>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&dpi_18bit_cpadhi_gpio0>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/dpi24-overlay.dts b/arch/arm/boot/dts/overlays/dpi24-overlay.dts
+new file mode 100644
+index 000000000000..44335cc81277
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/dpi24-overlay.dts
+@@ -0,0 +1,39 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	// There is no DPI driver module, but we need a platform device
++	// node (that doesn't already use pinctrl) to hang the pinctrl
++	// reference on - leds will do
++
++	fragment@0 {
++		target = <&fb>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&dpi24_pins>;
++		};
++	};
++
++	fragment@1 {
++		target = <&vc4>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&dpi24_pins>;
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			dpi24_pins: dpi24_pins {
++				brcm,pins = <0 1 2 3 4 5 6 7 8 9 10 11
++					     12 13 14 15 16 17 18 19 20
++					     21 22 23 24 25 26 27>;
++				brcm,function = <6>; /* alt2 */
++				brcm,pull = <0>; /* no pull */
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/draws-overlay.dts b/arch/arm/boot/dts/overlays/draws-overlay.dts
+new file mode 100644
+index 000000000000..b8801f583369
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/draws-overlay.dts
+@@ -0,0 +1,208 @@
++#include <dt-bindings/clock/bcm2835.h>
++/*
++ * Device tree overlay for the DRAWS Hardware
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++    compatible = "brcm,bcm2835";
++    fragment@0 {
++        target = <&i2s_clk_producer>;
++        __overlay__ {
++            status = "okay";
++        };
++    };
++
++    fragment@1 {
++        target-path = "/";
++        __overlay__ {
++            regulators {
++                compatible = "simple-bus";
++                #address-cells = <1>;
++                #size-cells = <0>;
++
++                udrc0_ldoin: udrc0_ldoin {
++                    compatible = "regulator-fixed";
++                    regulator-name = "ldoin";
++                    regulator-min-microvolt = <3300000>;
++                    regulator-max-microvolt = <3300000>;
++                    regulator-always-on;
++                };
++
++                sc16is752_clk: sc16is752_draws_clk {
++                    compatible = "fixed-clock";
++                    #clock-cells = <0>;
++                    clock-frequency = <1843200>;
++                };
++            };
++
++            pps: pps {
++                compatible = "pps-gpio";
++                pinctrl-names = "default";
++                pinctrl-0 = <&pps_pins>;
++                gpios = <&gpio 7 0>;
++                status = "okay";
++            };
++
++            iio-hwmon {
++                compatible = "iio-hwmon";
++                status = "okay";
++                io-channels = <&tla2024 4>, <&tla2024 5>, <&tla2024 6>,
++                              <&tla2024 7>;
++            };
++        };
++    };
++
++    fragment@2 {
++        target = <&i2c_arm>;
++        __overlay__ {
++            #address-cells = <1>;
++            #size-cells = <0>;
++            status = "okay";
++
++            tlv320aic32x4: tlv320aic32x4@18 {
++                compatible = "ti,tlv320aic32x4";
++                reg = <0x18>;
++                #sound-dai-cells = <0>;
++                status = "okay";
++
++                clocks = <&clocks BCM2835_CLOCK_GP0>;
++                clock-names = "mclk";
++                assigned-clocks = <&clocks BCM2835_CLOCK_GP0>;
++                assigned-clock-rates = <25000000>;
++
++                pinctrl-names = "default";
++                pinctrl-0 = <&gpclk0_pin &aic3204_reset>;
++
++                reset-gpios = <&gpio 13 0>;
++
++                iov-supply = <&udrc0_ldoin>;
++                ldoin-supply = <&udrc0_ldoin>;
++            };
++
++            sc16is752: sc16is752@50 {
++                compatible = "nxp,sc16is752";
++                reg = <0x50>;
++                clocks = <&sc16is752_clk>;
++                interrupt-parent = <&gpio>;
++                interrupts = <17 2>; /* IRQ_TYPE_EDGE_FALLING */
++
++                pinctrl-names = "default";
++                pinctrl-0 = <&sc16is752_irq>;
++            };
++
++            tla2024: tla2024@48 {
++                compatible = "ti,ads1015";
++                reg = <0x48>;
++                #address-cells = <1>;
++                #size-cells = <0>;
++                #io-channel-cells = <1>;
++
++                adc_ch4: channel@4 {
++                    reg = <4>;
++                    ti,gain = <1>;
++                    ti,datarate = <4>;
++                };
++
++                adc_ch5: channel@5 {
++                    reg = <5>;
++                    ti,gain = <1>;
++                    ti,datarate = <4>;
++                };
++
++                adc_ch6: channel@6 {
++                    reg = <6>;
++                    ti,gain = <2>;
++                    ti,datarate = <4>;
++                };
++
++                adc_ch7: channel@7 {
++                    reg = <7>;
++                    ti,gain = <2>;
++                    ti,datarate = <4>;
++                };
++            };
++        };
++    };
++
++    fragment@3 {
++        target = <&sound>;
++        snd: __overlay__ {
++            compatible = "simple-audio-card";
++            i2s-controller = <&i2s_clk_producer>;
++            status = "okay";
++
++            simple-audio-card,name = "draws";
++            simple-audio-card,format = "i2s";
++
++            simple-audio-card,bitclock-master = <&dailink0_master>;
++            simple-audio-card,frame-master = <&dailink0_master>;
++
++            simple-audio-card,widgets =
++                "Line", "Line In",
++                "Line", "Line Out";
++
++            simple-audio-card,routing =
++                "IN1_R", "Line In",
++                "IN1_L", "Line In",
++                "CM_L", "Line In",
++                "CM_R", "Line In",
++                "Line Out", "LOR",
++                "Line Out", "LOL";
++
++            dailink0_master: simple-audio-card,cpu {
++                sound-dai = <&i2s_clk_producer>;
++            };
++
++            simple-audio-card,codec {
++                sound-dai = <&tlv320aic32x4>;
++            };
++        };
++    };
++
++    fragment@4 {
++        target = <&gpio>;
++        __overlay__ {
++            gpclk0_pin: gpclk0_pin {
++                brcm,pins = <4>;
++                brcm,function = <4>;
++            };
++
++            aic3204_reset: aic3204_reset {
++                brcm,pins = <13>;
++                brcm,function = <1>;
++                brcm,pull = <1>;
++            };
++
++            aic3204_gpio: aic3204_gpio {
++                brcm,pins = <26>;
++            };
++
++            sc16is752_irq: sc16is752_irq {
++                brcm,pins = <17>;
++                brcm,function = <0>;
++                brcm,pull = <2>;
++            };
++
++            pps_pins: pps_pins {
++                brcm,pins = <7>;
++                brcm,function = <0>;
++                brcm,pull = <0>;
++            };
++        };
++    };
++
++    __overrides__ {
++        draws_adc_ch4_gain = <&adc_ch4>,"ti,gain:0";
++        draws_adc_ch4_datarate = <&adc_ch4>,"ti,datarate:0";
++        draws_adc_ch5_gain = <&adc_ch5>,"ti,gain:0";
++        draws_adc_ch5_datarate = <&adc_ch5>,"ti,datarate:0";
++        draws_adc_ch6_gain = <&adc_ch6>,"ti,gain:0";
++        draws_adc_ch6_datarate = <&adc_ch6>,"ti,datarate:0";
++        draws_adc_ch7_gain = <&adc_ch7>,"ti,gain:0";
++        draws_adc_ch7_datarate = <&adc_ch7>,"ti,datarate:0";
++        alsaname = <&snd>, "simple-audio-card,name";
++    };
++};
+diff --git a/arch/arm/boot/dts/overlays/dwc-otg-overlay.dts b/arch/arm/boot/dts/overlays/dwc-otg-overlay.dts
+new file mode 100644
+index 000000000000..78c5e9f85048
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/dwc-otg-overlay.dts
+@@ -0,0 +1,14 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&usb>;
++		__overlay__ {
++			compatible = "brcm,bcm2708-usb";
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/dwc2-overlay.dts b/arch/arm/boot/dts/overlays/dwc2-overlay.dts
+new file mode 100644
+index 000000000000..0d83e344ad97
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/dwc2-overlay.dts
+@@ -0,0 +1,26 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&usb>;
++		#address-cells = <1>;
++		#size-cells = <1>;
++		dwc2_usb: __overlay__ {
++			compatible = "brcm,bcm2835-usb";
++			dr_mode = "otg";
++			g-np-tx-fifo-size = <32>;
++			g-rx-fifo-size = <558>;
++			g-tx-fifo-size = <512 512 512 512 512 256 256>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		dr_mode = <&dwc2_usb>, "dr_mode";
++		g-np-tx-fifo-size = <&dwc2_usb>,"g-np-tx-fifo-size:0";
++		g-rx-fifo-size = <&dwc2_usb>,"g-rx-fifo-size:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/edt-ft5406-overlay.dts b/arch/arm/boot/dts/overlays/edt-ft5406-overlay.dts
+new file mode 100644
+index 000000000000..6e40c0ebb3bf
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/edt-ft5406-overlay.dts
+@@ -0,0 +1,46 @@
++/*
++ * Device Tree overlay for EDT 5406 touchscreen controller, as used on the
++ * Raspberry Pi 7" panel
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include "edt-ft5406.dtsi"
++
++/ {
++	fragment@0 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		i2c0 = <&ts_i2c_frag>,"target:0=",<&i2c0>;
++		i2c1 = <&ts_i2c_frag>, "target?=0",
++		       <&ts_i2c_frag>, "target-path=i2c1",
++		       <0>,"-0-1";
++		i2c3 = <&ts_i2c_frag>, "target?=0",
++		       <&ts_i2c_frag>, "target-path=i2c3",
++		       <0>,"-0-1";
++		i2c4 = <&ts_i2c_frag>, "target?=0",
++		       <&ts_i2c_frag>, "target-path=i2c4",
++		       <0>,"-0-1";
++		i2c5 = <&ts_i2c_frag>, "target?=0",
++		       <&ts_i2c_frag>, "target-path=i2c5",
++		       <0>,"-0-1";
++		i2c6 = <&ts_i2c_frag>, "target?=0",
++		       <&ts_i2c_frag>, "target-path=i2c6",
++		       <0>,"-0-1";
++		addr = <&ft5406>,"reg:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/edt-ft5406.dtsi b/arch/arm/boot/dts/overlays/edt-ft5406.dtsi
+new file mode 100644
+index 000000000000..16aa5cf91df5
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/edt-ft5406.dtsi
+@@ -0,0 +1,49 @@
++/*
++ * Device Tree overlay for an EDT FT5406 touchscreen
++ *
++ * Note that this is included from vc4-kms-dsi-7inch, hence the
++ * fragment numbers not starting at 0.
++ */
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@10 {
++		target = <&ft5406>;
++		__overlay__ {
++			touchscreen-inverted-x;
++		};
++	};
++
++	fragment@11 {
++		target = <&ft5406>;
++		__overlay__ {
++			touchscreen-inverted-y;
++		};
++	};
++
++	ts_i2c_frag: fragment@12 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ft5406: ts@38 {
++				compatible = "edt,edt-ft5506";
++				reg = <0x38>;
++
++				touchscreen-size-x = < 800 >;
++				touchscreen-size-y = < 480 >;
++			};
++		};
++	};
++
++	__overrides__ {
++		sizex = <&ft5406>,"touchscreen-size-x:0";
++		sizey = <&ft5406>,"touchscreen-size-y:0";
++		invx = <0>, "-10";
++		invy = <0>, "-11";
++		swapxy = <&ft5406>,"touchscreen-swapped-x-y?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/enc28j60-overlay.dts b/arch/arm/boot/dts/overlays/enc28j60-overlay.dts
+new file mode 100644
+index 000000000000..7af5c2e607ea
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/enc28j60-overlay.dts
+@@ -0,0 +1,53 @@
++// Overlay for the Microchip ENC28J60 Ethernet Controller
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			eth1: enc28j60@0{
++				compatible = "microchip,enc28j60";
++				reg = <0>; /* CE0 */
++				pinctrl-names = "default";
++				pinctrl-0 = <&eth1_pins>;
++				interrupt-parent = <&gpio>;
++				interrupts = <25 0x2>; /* falling edge */
++				spi-max-frequency = <12000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			eth1_pins: eth1_pins {
++				brcm,pins = <25>;
++				brcm,function = <0>; /* in */
++				brcm,pull = <0>; /* none */
++			};
++		};
++	};
++
++	__overrides__ {
++		int_pin = <&eth1>, "interrupts:0",
++		          <&eth1_pins>, "brcm,pins:0";
++		speed   = <&eth1>, "spi-max-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/enc28j60-spi2-overlay.dts b/arch/arm/boot/dts/overlays/enc28j60-spi2-overlay.dts
+new file mode 100644
+index 000000000000..17cb5b8fa485
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/enc28j60-spi2-overlay.dts
+@@ -0,0 +1,47 @@
++// Overlay for the Microchip ENC28J60 Ethernet Controller - SPI2 Compute Module
++// Interrupt pin: 39
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi2>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			eth1: enc28j60@0{
++				compatible = "microchip,enc28j60";
++				reg = <0>; /* CE0 */
++				pinctrl-names = "default";
++				pinctrl-0 = <&eth1_pins>;
++				interrupt-parent = <&gpio>;
++				interrupts = <39 0x2>; /* falling edge */
++				spi-max-frequency = <12000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			eth1_pins: eth1_pins {
++				brcm,pins = <39>;
++				brcm,function = <0>; /* in */
++				brcm,pull = <0>; /* none */
++			};
++		};
++	};
++
++	__overrides__ {
++		int_pin = <&eth1>, "interrupts:0",
++		          <&eth1_pins>, "brcm,pins:0";
++		speed   = <&eth1>, "spi-max-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/exc3000-overlay.dts b/arch/arm/boot/dts/overlays/exc3000-overlay.dts
+new file mode 100644
+index 000000000000..6f087fb20661
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/exc3000-overlay.dts
+@@ -0,0 +1,48 @@
++// Device tree overlay for I2C connected EETI EXC3000 multiple touch controller
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			exc3000_pins: exc3000_pins {
++				brcm,pins = <4>; // interrupt
++				brcm,function = <0>; // in
++				brcm,pull = <2>; // pull-up
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			exc3000: exc3000@2a {
++				compatible = "eeti,exc3000";
++				reg = <0x2a>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&exc3000_pins>;
++				interrupt-parent = <&gpio>;
++				interrupts = <4 8>; // active low level-sensitive
++				touchscreen-size-x = <4096>;
++				touchscreen-size-y = <4096>;
++			};
++		};
++	};
++
++	__overrides__ {
++		interrupt = <&exc3000_pins>,"brcm,pins:0",
++			<&exc3000>,"interrupts:0";
++		sizex = <&exc3000>,"touchscreen-size-x:0";
++		sizey = <&exc3000>,"touchscreen-size-y:0";
++		invx = <&exc3000>,"touchscreen-inverted-x?";
++		invy = <&exc3000>,"touchscreen-inverted-y?";
++		swapxy = <&exc3000>,"touchscreen-swapped-x-y?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/fbtft-overlay.dts b/arch/arm/boot/dts/overlays/fbtft-overlay.dts
+new file mode 100644
+index 000000000000..db45f8c53bcc
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/fbtft-overlay.dts
+@@ -0,0 +1,611 @@
++/*
++ * Device Tree overlay for fbtft drivers
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	/* adafruit18 */
++	fragment@0 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "sitronix,st7735r";
++			spi-max-frequency = <32000000>;
++			gamma = "02 1c 07 12 37 32 29 2d 29 25 2B 39 00 01 03 10\n03 1d 07 06 2E 2C 29 2D 2E 2E 37 3F 00 00 02 10";
++		};
++	};
++
++	/* adafruit22 */
++	fragment@1 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "himax,hx8340bn";
++			spi-max-frequency = <32000000>;
++			buswidth = <9>;
++			bgr;
++		};
++	};
++
++	/* adafruit22a */
++	fragment@2 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9340";
++			spi-max-frequency = <32000000>;
++			bgr;
++		};
++	};
++
++	/* adafruit28 */
++	fragment@3 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9341";
++			spi-max-frequency = <32000000>;
++			bgr;
++		};
++	};
++
++	/* adafruit13m */
++	fragment@4 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "solomon,ssd1306";
++			spi-max-frequency = <16000000>;
++		};
++	};
++
++	/* admatec_c-berry28 */
++	fragment@5 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "sitronix,st7789v";
++			spi-max-frequency = <48000000>;
++			init = <0x01000011
++				0x02000078
++				0x0100003A 0x05
++				0x010000B2 0x0C 0x0C 0x00 0x33 0x33
++				0x010000B7 0x35
++				0x010000C2 0x01 0xFF
++				0x010000C3 0x17
++				0x010000C4 0x20
++				0x010000BB 0x17
++				0x010000C5 0x20
++				0x010000D0 0xA4 0xA1
++				0x01000029>;
++			gamma = "D0 00 14 15 13 2C 42 43 4E 09 16 14 18 21\nD0 00 14 15 13 0B 43 55 53 0C 17 14 23 20";
++		};
++	};
++
++	/* dogs102 */
++	fragment@6 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "UltraChip,uc1701";
++			spi-max-frequency = <8000000>;
++			bgr;
++		};
++	};
++
++	/* er_tftm050_2 */
++	fragment@7 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "raio,ra8875";
++			spi-max-frequency = <5000000>;
++			spi-cpha;
++			spi-cpol;
++			width = <480>;
++			height = <272>;
++			bgr;
++		};
++	};
++
++	/* er_tftm070_5 */
++	fragment@8 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "raio,ra8875";
++			spi-max-frequency = <5000000>;
++			spi-cpha;
++			spi-cpol;
++			width = <800>;
++			height = <480>;
++			bgr;
++		};
++	};
++
++	/* ew24ha0 */
++	fragment@9 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ultrachip,uc1611";
++			spi-max-frequency = <32000000>;
++			spi-cpha;
++			spi-cpol;
++		};
++	};
++
++	/* ew24ha0_9bit */
++	fragment@10 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ultrachip,uc1611";
++			spi-max-frequency = <32000000>;
++			spi-cpha;
++			spi-cpol;
++			buswidth = <9>;
++		};
++	};
++
++	/* freetronicsoled128 */
++	fragment@11 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "solomon,ssd1351";
++			spi-max-frequency = <20000000>;
++			backlight = <2>; /* FBTFT_ONBOARD_BACKLIGHT */
++			bgr;
++		};
++	};
++
++	/* hy28a */
++	fragment@12 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9320";
++			spi-max-frequency = <32000000>;
++			spi-cpha;
++			spi-cpol;
++			startbyte = <0x70>;
++			bgr;
++		};
++	};
++
++	/* hy28b */
++	fragment@13 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9325";
++			spi-max-frequency = <48000000>;
++			spi-cpha;
++			spi-cpol;
++			init = <0x010000e7 0x0010
++				0x01000000 0x0001
++				0x01000001 0x0100
++				0x01000002 0x0700
++				0x01000003 0x1030
++				0x01000004 0x0000
++				0x01000008 0x0207
++				0x01000009 0x0000
++				0x0100000a 0x0000
++				0x0100000c 0x0001
++				0x0100000d 0x0000
++				0x0100000f 0x0000
++				0x01000010 0x0000
++				0x01000011 0x0007
++				0x01000012 0x0000
++				0x01000013 0x0000
++				0x02000032
++				0x01000010 0x1590
++				0x01000011 0x0227
++				0x02000032
++				0x01000012 0x009c
++				0x02000032
++				0x01000013 0x1900
++				0x01000029 0x0023
++				0x0100002b 0x000e
++				0x02000032
++				0x01000020 0x0000
++				0x01000021 0x0000
++				0x02000032
++				0x01000050 0x0000
++				0x01000051 0x00ef
++				0x01000052 0x0000
++				0x01000053 0x013f
++				0x01000060 0xa700
++				0x01000061 0x0001
++				0x0100006a 0x0000
++				0x01000080 0x0000
++				0x01000081 0x0000
++				0x01000082 0x0000
++				0x01000083 0x0000
++				0x01000084 0x0000
++				0x01000085 0x0000
++				0x01000090 0x0010
++				0x01000092 0x0000
++				0x01000093 0x0003
++				0x01000095 0x0110
++				0x01000097 0x0000
++				0x01000098 0x0000
++				0x01000007 0x0133
++				0x01000020 0x0000
++				0x01000021 0x0000
++				0x02000064>;
++			startbyte = <0x70>;
++			bgr;
++			fps = <50>;
++			gamma = "04 1F 4 7 7 0 7 7 6 0\n0F 00 1 7 4 0 0 0 6 7";
++		};
++	};
++
++	/* itdb28_spi */
++	fragment@14 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9325";
++			spi-max-frequency = <32000000>;
++			bgr;
++		};
++	};
++
++	/* mi0283qt-2 */
++	fragment@15 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "himax,hx8347d";
++			spi-max-frequency = <32000000>;
++			startbyte = <0x70>;
++			bgr;
++		};
++	};
++
++	/* mi0283qt-9a */
++	fragment@16 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9341";
++			spi-max-frequency = <32000000>;
++			buswidth = <9>;
++			bgr;
++		};
++	};
++
++	/* nokia3310 */
++	fragment@17 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "philips,pcd8544";
++			spi-max-frequency = <400000>;
++		};
++	};
++
++	/* nokia3310a */
++	fragment@18 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "teralane,tls8204";
++			spi-max-frequency = <1000000>;
++		};
++	};
++
++	/* nokia5110 */
++	fragment@19 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9163";
++			spi-max-frequency = <12000000>;
++			bgr;
++		};
++	};
++
++	/* piscreen */
++	fragment@20 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9486";
++			spi-max-frequency = <32000000>;
++			regwidth = <16>;
++			bgr;
++		};
++	};
++
++	/* pitft */
++	fragment@21 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9340";
++			spi-max-frequency = <32000000>;
++			init = <0x01000001
++				0x02000005
++				0x01000028
++				0x010000EF 0x03 0x80 0x02
++				0x010000CF 0x00 0xC1 0x30
++				0x010000ED 0x64 0x03 0x12 0x81
++				0x010000E8 0x85 0x00 0x78
++				0x010000CB 0x39 0x2C 0x00 0x34 0x02
++				0x010000F7 0x20
++				0x010000EA 0x00 0x00
++				0x010000C0 0x23
++				0x010000C1 0x10
++				0x010000C5 0x3E 0x28
++				0x010000C7 0x86
++				0x0100003A 0x55
++				0x010000B1 0x00 0x18
++				0x010000B6 0x08 0x82 0x27
++				0x010000F2 0x00
++				0x01000026 0x01
++				0x010000E0 0x0F 0x31 0x2B 0x0C 0x0E 0x08 0x4E 0xF1 0x37 0x07 0x10 0x03 0x0E 0x09 0x00
++				0x010000E1 0x00 0x0E 0x14 0x03 0x11 0x07 0x31 0xC1 0x48 0x08 0x0F 0x0C 0x31 0x36 0x0F
++				0x01000011
++				0x02000064
++				0x01000029
++				0x02000014>;
++			bgr;
++		};
++	};
++
++	/* pioled */
++	fragment@22 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "solomon,ssd1351";
++			spi-max-frequency = <20000000>;
++			bgr;
++			gamma = "0 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4";
++		};
++	};
++
++	/* rpi-display */
++	fragment@23 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9341";
++			spi-max-frequency = <32000000>;
++			bgr;
++		};
++	};
++
++	/* sainsmart18 */
++	fragment@24 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "sitronix,st7735r";
++			spi-max-frequency = <32000000>;
++		};
++	};
++
++	/* sainsmart32_spi */
++	fragment@25 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "solomon,ssd1289";
++			spi-max-frequency = <16000000>;
++			bgr;
++		};
++	};
++
++	/* tinylcd35 */
++	fragment@26 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "neosec,tinylcd";
++			spi-max-frequency = <32000000>;
++			bgr;
++		};
++	};
++
++	/* tm022hdh26 */
++	fragment@27 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9341";
++			spi-max-frequency = <32000000>;
++			bgr;
++		};
++	};
++
++	/* tontec35_9481 - boards before 02 July 2014 */
++	fragment@28 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9481";
++			spi-max-frequency = <128000000>;
++			spi-cpha;
++			spi-cpol;
++			bgr;
++		};
++	};
++
++	/* tontec35_9486 - boards after 02 July 2014 */
++	fragment@29 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9486";
++			spi-max-frequency = <128000000>;
++			spi-cpha;
++			spi-cpol;
++			bgr;
++		};
++	};
++
++	/* waveshare32b */
++	fragment@30 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "ilitek,ili9340";
++			spi-max-frequency = <48000000>;
++			init = <0x010000CB 0x39 0x2C 0x00 0x34 0x02
++				0x010000CF 0x00 0xC1 0x30
++				0x010000E8 0x85 0x00 0x78
++				0x010000EA 0x00 0x00
++				0x010000ED 0x64 0x03 0x12 0x81
++				0x010000F7 0x20
++				0x010000C0 0x23
++				0x010000C1 0x10
++				0x010000C5 0x3E 0x28
++				0x010000C7 0x86
++				0x01000036 0x28
++				0x0100003A 0x55
++				0x010000B1 0x00 0x18
++				0x010000B6 0x08 0x82 0x27
++				0x010000F2 0x00
++				0x01000026 0x01
++				0x010000E0 0x0F 0x31 0x2B 0x0C 0x0E 0x08 0x4E 0xF1 0x37 0x07 0x10 0x03 0x0E 0x09 0x00
++				0x010000E1 0x00 0x0E 0x14 0x03 0x11 0x07 0x31 0xC1 0x48 0x08 0x0F 0x0C 0x31 0x36 0x0F
++				0x01000011
++				0x02000078
++				0x01000029
++				0x0100002C>;
++			bgr;
++		};
++	};
++
++	/* waveshare22 */
++	fragment@31 {
++		target = <&display>;
++		__dormant__ {
++			compatible = "hitachi,bd663474";
++			spi-max-frequency = <32000000>;
++			spi-cpha;
++			spi-cpol;
++		};
++	};
++
++	spidev_fragment: fragment@100 {
++		target-path = "spi0/spidev@0";
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	display_fragment: fragment@101 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			display: display@0{
++				reg = <0>;
++				spi-max-frequency = <32000000>;
++				fps = <30>;
++				buswidth = <8>;
++			};
++		};
++	};
++
++	__overrides__ {
++		spi0-0        = <&display_fragment>, "target:0=",<&spi0>,
++				<&spidev_fragment>, "target-path=spi0/spidev@0",
++				<&display>, "reg:0=0";
++		spi0-1        = <&display_fragment>, "target:0=",<&spi0>,
++				<&spidev_fragment>, "target-path=spi0/spidev@1",
++				<&display>, "reg:0=1";
++		spi1-0        = <&display_fragment>, "target:0=",<&spi1>,
++				<&spidev_fragment>, "target-path=spi1/spidev@0",
++				<&display>, "reg:0=0";
++		spi1-1        = <&display_fragment>, "target:0=",<&spi1>,
++				<&spidev_fragment>, "target-path=spi1/spidev@1",
++				<&display>, "reg:0=1";
++		spi1-2        = <&display_fragment>, "target:0=",<&spi1>,
++				<&spidev_fragment>, "target-path=spi1/spidev@2",
++				<&display>, "reg:0=2";
++		spi2-0        = <&display_fragment>, "target:0=",<&spi2>,
++				<&spidev_fragment>, "target-path=spi2/spidev@0",
++				<&display>, "reg:0=0";
++		spi2-1        = <&display_fragment>, "target:0=",<&spi2>,
++				<&spidev_fragment>, "target-path=spi2/spidev@1",
++				<&display>, "reg:0=1";
++		spi2-2        = <&display_fragment>, "target:0=",<&spi2>,
++				<&spidev_fragment>, "target-path=spi2/spidev@2",
++				<&display>, "reg:0=2";
++
++		speed         = <&display>, "spi-max-frequency:0";
++		cpha          = <&display>, "spi-cpha?";
++		cpol          = <&display>, "spi-cpol?";
++
++		/* Displays */
++		adafruit18    = <0>, "+0";
++		adafruit22    = <0>, "+1";
++		adafruit22a   = <0>, "+2";
++		adafruit28    = <0>, "+3";
++		adafruit13m   = <0>, "+4";
++		admatec_c-berry28 = <0>, "+5";
++		dogs102       = <0>, "+6";
++		er_tftm050_2  = <0>, "+7";
++		er_tftm070_5  = <0>, "+8";
++		ew24ha0       = <0>, "+9";
++		ew24ha0_9bit  = <0>, "+10";
++		freetronicsoled128 = <0>, "+11";
++		hy28a         = <0>, "+12";
++		hy28b         = <0>, "+13";
++		itdb28_spi    = <0>, "+14";
++		mi0283qt-2    = <0>, "+15";
++		mi0283qt-9a   = <0>, "+16";
++		nokia3310     = <0>, "+17";
++		nokia3310a    = <0>, "+18";
++		nokia5110     = <0>, "+19";
++		piscreen      = <0>, "+20";
++		pitft         = <0>, "+21";
++		pioled        = <0>, "+22";
++		rpi-display   = <0>, "+23";
++		sainsmart18   = <0>, "+24";
++		sainsmart32_spi = <0>, "+25";
++		tinylcd35     = <0>, "+26";
++		tm022hdh26    = <0>, "+27";
++		tontec35_9481 = <0>, "+28";
++		tontec35_9486 = <0>, "+29";
++		waveshare32b  = <0>, "+30";
++		waveshare22   = <0>, "+31";
++
++		/* Controllers */
++		bd663474      = <&display>, "compatible=hitachi,bd663474";
++		hx8340bn      = <&display>, "compatible=himax,hx8340bn";
++		hx8347d       = <&display>, "compatible=himax,hx8347d";
++		hx8353d       = <&display>, "compatible=himax,hx8353d";
++		hx8357d       = <&display>, "compatible=himax,hx8357d";
++		ili9163       = <&display>, "compatible=ilitek,ili9163";
++		ili9320       = <&display>, "compatible=ilitek,ili9320";
++		ili9325       = <&display>, "compatible=ilitek,ili9325";
++		ili9340       = <&display>, "compatible=ilitek,ili9340";
++		ili9341       = <&display>, "compatible=ilitek,ili9341";
++		ili9481       = <&display>, "compatible=ilitek,ili9481";
++		ili9486       = <&display>, "compatible=ilitek,ili9486";
++		pcd8544       = <&display>, "compatible=philips,pcd8544";
++		ra8875        = <&display>, "compatible=raio,ra8875";
++		s6d02a1       = <&display>, "compatible=samsung,s6d02a1";
++		s6d1121       = <&display>, "compatible=samsung,s6d1121";
++		seps525       = <&display>, "compatible=syncoam,seps525";
++		sh1106        = <&display>, "compatible=sinowealth,sh1106";
++		ssd1289       = <&display>, "compatible=solomon,ssd1289";
++		ssd1305       = <&display>, "compatible=solomon,ssd1305";
++		ssd1306       = <&display>, "compatible=solomon,ssd1306";
++		ssd1325       = <&display>, "compatible=solomon,ssd1325";
++		ssd1331       = <&display>, "compatible=solomon,ssd1331";
++		ssd1351       = <&display>, "compatible=solomon,ssd1351";
++		st7735r       = <&display>, "compatible=sitronix,st7735r";
++		st7789v       = <&display>, "compatible=sitronix,st7789v";
++		tls8204       = <&display>, "compatible=teralane,tls8204";
++		uc1611        = <&display>, "compatible=ultrachip,uc1611";
++		uc1701        = <&display>, "compatible=UltraChip,uc1701";
++		upd161704     = <&display>, "compatible=nec,upd161704";
++
++		width         = <&display>, "width:0";
++		height        = <&display>, "height:0";
++		regwidth      = <&display>, "regwidth:0";
++		buswidth      = <&display>, "buswidth:0";
++		debug         = <&display>, "debug:0";
++		rotate        = <&display>, "rotate:0";
++		bgr           = <&display>, "bgr?";
++		fps           = <&display>, "fps:0";
++		txbuflen      = <&display>, "txbuflen:0";
++		startbyte     = <&display>, "startbyte:0";
++		gamma         = <&display>, "gamma";
++
++		reset_pin     = <&display>, "reset-gpios:0=", <&gpio>,
++				<&display>, "reset-gpios:4",
++				<&display>, "reset-gpios:8=1"; /* GPIO_ACTIVE_LOW */
++		dc_pin        = <&display>, "dc-gpios:0=", <&gpio>,
++				<&display>, "dc-gpios:4",
++				<&display>, "dc-gpios:8=0"; /* GPIO_ACTIVE_HIGH */
++		led_pin       = <&display>, "led-gpios:0=", <&gpio>,
++				<&display>, "led-gpios:4",
++				<&display>, "led-gpios:8=0"; /* GPIO_ACTIVE_HIGH */
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/fe-pi-audio-overlay.dts b/arch/arm/boot/dts/overlays/fe-pi-audio-overlay.dts
+new file mode 100644
+index 000000000000..10624fe4f5ac
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/fe-pi-audio-overlay.dts
+@@ -0,0 +1,70 @@
++// Definitions for Fe-Pi Audio
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			sgtl5000_mclk: sgtl5000_mclk {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-frequency = <12288000>;
++				clock-output-names = "sgtl5000-mclk";
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&soc>;
++		__overlay__ {
++			reg_1v8: reg_1v8@0 {
++				compatible = "regulator-fixed";
++				regulator-name = "1V8";
++				regulator-min-microvolt = <1800000>;
++				regulator-max-microvolt = <1800000>;
++				regulator-always-on;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			sgtl5000@a {
++				#sound-dai-cells = <0>;
++				compatible = "fsl,sgtl5000";
++				reg = <0x0a>;
++				clocks = <&sgtl5000_mclk>;
++				micbias-resistor-k-ohms = <2>;
++				micbias-voltage-m-volts = <3000>;
++				VDDA-supply = <&vdd_3v3_reg>;
++				VDDIO-supply = <&vdd_3v3_reg>;
++				VDDD-supply = <&reg_1v8>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "fe-pi,fe-pi-audio";
++			i2s-controller = <&i2s_clk_consumer>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/fsm-demo-overlay.dts b/arch/arm/boot/dts/overlays/fsm-demo-overlay.dts
+new file mode 100644
+index 000000000000..e9944f5cd258
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/fsm-demo-overlay.dts
+@@ -0,0 +1,104 @@
++// Demo overlay for the gpio-fsm driver
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio-fsm.h>
++
++#define BUTTON1 GF_IP(0)
++#define BUTTON2 GF_SW(0)
++#define RED   GF_OP(0) // GPIO7
++#define AMBER GF_OP(1) // GPIO8
++#define GREEN GF_OP(2) // GPIO25
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			fsm_demo: fsm-demo {
++				compatible = "rpi,gpio-fsm";
++
++				debug = <0>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				num-swgpios = <1>;
++				gpio-line-names = "button2";
++				input-gpios  = <&gpio 6 1>;  // BUTTON1 (active-low)
++				output-gpios = <&gpio 7 0>,  // RED
++					       <&gpio 8 0>,  // AMBER
++					       <&gpio 25 0>; // GREEN
++				shutdown-timeout-ms = <2000>;
++
++				start {
++					start_state;
++					set = <RED 1>, <AMBER 0>, <GREEN 0>;
++					start2 = <GF_DELAY 250>;
++				};
++
++				start2 {
++					set = <RED 0>, <AMBER 1>;
++					go = <GF_DELAY 250>;
++				};
++
++				go {
++					set = <RED 0>, <AMBER 0>, <GREEN 1>;
++					ready_wait = <BUTTON1 0>;
++					shutdown1 = <GF_SHUTDOWN 0>;
++				};
++
++				ready_wait {
++					// Clear the soft GPIO
++					set = <BUTTON2 0>;
++					ready = <GF_DELAY 1000>;
++					shutdown1 = <GF_SHUTDOWN 0>;
++				};
++
++				ready {
++					stopping = <BUTTON1 1>, <BUTTON2 1>;
++					shutdown1 = <GF_SHUTDOWN 0>;
++				};
++
++				stopping {
++					set = <GREEN 0>, <AMBER 1>;
++					stopped = <GF_DELAY 1000>;
++				};
++
++				stopped {
++					set = <AMBER 0>, <RED 1>;
++					get_set = <GF_DELAY 3000>;
++					shutdown1 = <GF_SHUTDOWN 0>;
++				};
++
++				get_set {
++					set = <AMBER 1>;
++					go = <GF_DELAY 1000>;
++				};
++
++				shutdown1 {
++					set = <RED 0>, <AMBER 0>, <GREEN 1>;
++					shutdown2 = <GF_SHUTDOWN 250>;
++				};
++
++				shutdown2 {
++					set = <AMBER 1>, <GREEN 0>;
++					shutdown3 = <GF_SHUTDOWN 250>;
++				};
++
++				shutdown3 {
++					set = <RED 1>, <AMBER 0>;
++					shutdown4 = <GF_SHUTDOWN 250>;
++				};
++
++				shutdown4 {
++					shutdown_state;
++					set = <RED 0>, <AMBER 0>, <GREEN 0>;
++				};
++			};
++	       };
++        };
++
++	__overrides__ {
++		fsm_debug = <&fsm_demo>,"debug:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/gc9a01-overlay.dts b/arch/arm/boot/dts/overlays/gc9a01-overlay.dts
+new file mode 100644
+index 000000000000..3d31030c5564
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/gc9a01-overlay.dts
+@@ -0,0 +1,151 @@
++/*
++    Device Tree overlay for Galaxycore GC9A01A single chip driver
++    for use on SPI TFT LCD, 240x240 65K RGB
++    Based on Galaxycore's GC9A01A datasheet Rev.1.0 (2019/07/02)
++    Copyright (C) 2022, Julianno F. C. Silva (@juliannojungle)
++
++    This program is free software: you can redistribute it and/or modify
++    it under the terms of the GNU Affero General Public License as published
++    by the Free Software Foundation, either version 3 of the License, or
++    (at your option) any later version.
++
++    This program is distributed in the hope that it will be useful,
++    but WITHOUT ANY WARRANTY; without even the implied warranty of
++    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++    GNU Affero General Public License for more details.
++
++    You should have received a copy of the GNU Affero General Public License
++    along with this program.  If not, see <https://www.gnu.org/licenses/agpl-3.0.html>.
++
++    Init sequence partially based on Waveshare team's Arduino LCD_Driver V1.0 (2020/12/09).
++
++    Permission is hereby granted, free of UBYTEge, to any person obtaining a copy
++    of this software and associated documnetation files (the "Software"), to deal
++    in the Software without restriction, including without limitation the rights
++    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
++    copies of the Software, and to permit persons to whom the Software is
++    furished to do so, subject to the following conditions:
++
++    The above copyright notice and this permission notice shall be included in
++    all copies or substantial portions of the Software.
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++    compatible = "brcm,bcm2835";
++
++    fragment@0 {
++        target = <&spidev0>;
++        __overlay__ {
++            status = "disabled";
++        };
++    };
++
++    fragment@1 {
++        target = <&gpio>;
++        __overlay__ {
++            gc9a01_pins: gc9a01_pins {
++                brcm,pins = <25 27>;
++                brcm,function = <1 1>; /* out */
++                brcm,pull = <0 0>; /* none */
++            };
++        };
++    };
++
++    fragment@2 {
++        target = <&spi0>;
++        __overlay__ {
++            /* needed to avoid dtc warning */
++            #address-cells = <1>;
++            #size-cells = <0>;
++            status = "okay";
++
++            gc9a01: gc9a01@0 {
++                compatible = "ilitek,ili9340";
++                reg = <0>;
++                pinctrl-names = "default";
++                pinctrl-0 = <&gc9a01_pins>;
++                reset-gpios = <&gpio 27 1>;
++                dc-gpios = <&gpio 25 0>;
++                led-gpios = <&gpio 18 0>;
++                spi-max-frequency = <40000000>;
++                buswidth = <8>;
++                width = <240>;
++                height = <240>;
++                rotate = <0>;
++                fps = <50>;
++                bgr;
++                debug = <0>;
++                init = <
++                    0x01000011 /* Sleep mode OFF */
++                    0x02000078 /* Delay 120ms */
++                    0x010000EF /* Inter register enable 2 */
++                    0x010000EB 0x14
++                    /* BEGIN set inter_command HIGH */
++                    0x010000FE /* Inter register enable 1 */
++                    0x010000EF /* Inter register enable 2 */
++                    /* END set inter_command HIGH */
++                    0x010000EB 0x14
++                    0x01000084 0x40
++                    0x01000085 0xFF
++                    0x01000086 0xFF
++                    0x01000087 0xFF
++                    0x01000088 0x0A
++                    0x01000089 0x21
++                    0x0100008A 0x00
++                    0x0100008B 0x80
++                    0x0100008C 0x01
++                    0x0100008D 0x01
++                    0x0100008E 0xFF
++                    0x0100008F 0xFF
++                    0x010000B6 0x00 0x00 /* Display function control */
++                    0x01000036 0x08 /* Memory access control */
++                    0x0100003A 0x05 /* Pixel format */
++                    0x01000090 0x08 0x08 0x08 0x08
++                    0x010000BD 0x06
++                    0x010000BC 0x00
++                    0x010000FF 0x60 0x01 0x04
++                    0x010000C3 0x13 /* Voltage regulator 1a */
++                    0x010000C4 0x13 /* Voltage regulator 1b */
++                    0x010000C9 0x22 /* Voltage regulator 2a */
++                    0x010000BE 0x11
++                    0x010000E1 0x10 0x0E
++                    0x010000DF 0x21 0x0c 0x02
++                    0x010000F0 0x45 0x09 0x08 0x08 0x26 0x2A /* Set gamma1 */
++                    0x010000F1 0x43 0x70 0x72 0x36 0x37 0x6F /* Set gamma2 */
++                    0x010000F2 0x45 0x09 0x08 0x08 0x26 0x2A /* Set gamma3 */
++                    0x010000F3 0x43 0x70 0x72 0x36 0x37 0x6F /* Set gamma4 */
++                    0x010000ED 0x1B 0x0B
++                    0x010000AE 0x77
++                    0x010000CD 0x63
++                    0x01000070 0x07 0x07 0x04 0x0E 0x0F 0x09 0x07 0x08 0x03
++                    0x010000E8 0x34 /* Frame rate */
++                    0x01000062 0x18 0x0D 0x71 0xED 0x70 0x70 0x18 0x0F 0x71 0xEF 0x70 0x70
++                    0x01000063 0x18 0x11 0x71 0xF1 0x70 0x70 0x18 0x13 0x71 0xF3 0x70 0x70
++                    0x01000064 0x28 0x29 0xF1 0x01 0xF1 0x00 0x07
++                    0x01000066 0x3C 0x00 0xCD 0x67 0x45 0x45 0x10 0x00 0x00 0x00
++                    0x01000067 0x00 0x3C 0x00 0x00 0x00 0x01 0x54 0x10 0x32 0x98
++                    0x01000074 0x10 0x85 0x80 0x00 0x00 0x4E 0x00
++                    0x01000098 0x3e 0x07
++                    0x01000035 /* Tearing effect ON */
++                    0x01000021 /* Display inversion ON */
++                    0x01000011 /* Sleep mode OFF */
++                    0x0200000C /* Delay 12ms */
++                    0x01000029 /* Display ON */
++                    0x02000014 /* Delay 20ms */
++                    >;
++            };
++        };
++    };
++
++    __overrides__ {
++        speed = <&gc9a01>,"spi-max-frequency:0";
++        rotate = <&gc9a01>,"rotate:0";
++        width = <&gc9a01>,"width:0";
++        height = <&gc9a01>,"height:0";
++        fps = <&gc9a01>,"fps:0";
++        debug = <&gc9a01>,"debug:0";
++    };
++};
+diff --git a/arch/arm/boot/dts/overlays/ghost-amp-overlay.dts b/arch/arm/boot/dts/overlays/ghost-amp-overlay.dts
+new file mode 100644
+index 000000000000..d2f1e9a888e0
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ghost-amp-overlay.dts
+@@ -0,0 +1,145 @@
++// Overlay for the PCM5122-based Ghost amplifier using gpio-fsm
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio-fsm.h>
++
++#define ENABLE   GF_SW(0)
++#define FAULT    GF_IP(0) // GPIO5
++#define RELAY1   GF_OP(0) // GPIO22
++#define RELAY2   GF_OP(1) // GPIO23
++#define RELAYSSR GF_OP(2) // GPIO24
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm5122@4c {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4c>;
++				AVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				CPVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		iqaudio_dac: __overlay__ {
++			compatible = "iqaudio,iqaudio-dac";
++			i2s-controller = <&i2s_clk_producer>;
++			mute-gpios = <&amp 0 0>;
++			iqaudio-dac,auto-mute-amp;
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target-path = "/";
++		__overlay__ {
++			amp: ghost-amp {
++				compatible = "rpi,gpio-fsm";
++				pinctrl-names = "default";
++				pinctrl-0 = <&ghost_amp_pins>;
++
++				debug = <0>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				num-swgpios = <1>;
++				gpio-line-names = "enable";
++				input-gpios  = <&gpio 5 1>;  // FAULT (active low)
++				output-gpios = <&gpio 22 0>, // RELAY1
++					       <&gpio 23 0>, // RELAY2
++					       <&gpio 24 0>; // RELAYSSR
++				shutdown-timeout-ms = <1000>;
++
++				amp_off {
++					start_state;
++					shutdown_state;
++
++					set = <RELAYSSR 0>,
++					      <RELAY2 0>,
++					      <RELAY1 0>;
++					amp_on_1 = <ENABLE 1>;
++					fault = <FAULT 1>;
++				};
++
++				amp_on_1 {
++					set = <RELAY1 1>;
++					amp_on_2 = <GF_DELAY 1000>;
++					amp_off = <GF_SHUTDOWN 0>;
++					fault = <FAULT 1>;
++				};
++
++				amp_on_2 {
++					set = <RELAY2 1>;
++					amp_on_wait = <ENABLE 0>;
++					amp_on = <GF_DELAY 1>;
++					fault = <FAULT 1>;
++				};
++
++				amp_on {
++					set = <RELAYSSR 1>;
++					amp_on_wait = <ENABLE 0>;
++					fault = <FAULT 1>;
++				};
++
++				amp_on_wait {
++					set = <RELAYSSR 0>;
++					amp_off_1 = <GF_DELAY (30*60*1000)>,
++						    <GF_SHUTDOWN 0>;
++					amp_on = <ENABLE 1>;
++					fault = <FAULT 1>;
++				};
++
++				amp_off_1 {
++					set = <RELAY2 0>;
++					amp_on = <ENABLE 1>;
++					amp_off = <GF_DELAY 100>;
++					fault = <FAULT 1>;
++				};
++
++				// Keep this a distinct state to prevent
++				// changes and for the diagnostic output
++				fault {
++					set = <RELAYSSR 0>,
++					      <RELAY2 0>,
++					      <RELAY1 0>;
++					amp_off = <FAULT 0>;
++					shutdown_state;
++				};
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&gpio>;
++		__overlay__ {
++			ghost_amp_pins: ghost_amp_pins {
++				brcm,pins = <5 22 23 24>;
++				brcm,function = <0 1 1 1>; /* in out out out */
++				brcm,pull = <2 0 0 0>; /* up none none none */
++			};
++		};
++	};
++
++	__overrides__ {
++		fsm_debug = <&amp>,"debug:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/goodix-overlay.dts b/arch/arm/boot/dts/overlays/goodix-overlay.dts
+new file mode 100644
+index 000000000000..8571527de49a
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/goodix-overlay.dts
+@@ -0,0 +1,46 @@
++// Device tree overlay for I2C connected Goodix gt9271 multiple touch controller
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			goodix_pins: goodix_pins {
++				brcm,pins = <4 17>; // interrupt and reset
++				brcm,function = <0 0>; // in
++				brcm,pull = <2 2>; // pull-up
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			gt9271: gt9271@14 {
++				compatible = "goodix,gt9271";
++				reg = <0x14>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&goodix_pins>;
++				interrupt-parent = <&gpio>;
++				interrupts = <4 2>; // high-to-low edge triggered
++				irq-gpios = <&gpio 4 0>; // Pin7 on GPIO header
++				reset-gpios = <&gpio 17 0>; // Pin11 on GPIO header
++			};
++		};
++	};
++
++	__overrides__ {
++		interrupt = <&goodix_pins>,"brcm,pins:0",
++			<&gt9271>,"interrupts:0",
++			<&gt9271>,"irq-gpios:4";
++		reset = <&goodix_pins>,"brcm,pins:4",
++			<&gt9271>,"reset-gpios:4";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/googlevoicehat-soundcard-overlay.dts b/arch/arm/boot/dts/overlays/googlevoicehat-soundcard-overlay.dts
+new file mode 100644
+index 000000000000..1063f1898562
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/googlevoicehat-soundcard-overlay.dts
+@@ -0,0 +1,49 @@
++// Definitions for Google voiceHAT v1 soundcard overlay
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			googlevoicehat_pins: googlevoicehat_pins {
++				brcm,pins = <16>;
++				brcm,function = <1>; /* out */
++				brcm,pull = <0>; /* up */
++			};
++		};
++	};
++
++
++	fragment@2 {
++		target-path = "/";
++		__overlay__ {
++			voicehat-codec {
++				#sound-dai-cells = <0>;
++				compatible = "google,voicehat";
++				pinctrl-names = "default";
++				pinctrl-0 = <&googlevoicehat_pins>;
++				sdmode-gpios= <&gpio 16 0>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "googlevoicehat,googlevoicehat-soundcard";
++			i2s-controller = <&i2s_clk_producer>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/gpio-charger-overlay.dts b/arch/arm/boot/dts/overlays/gpio-charger-overlay.dts
+new file mode 100644
+index 000000000000..2868aa06dd6d
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/gpio-charger-overlay.dts
+@@ -0,0 +1,42 @@
++// Definitions for gpio-charger module
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		// Configure the gpio pin controller
++		target = <&gpio>;
++		__overlay__ {
++			pin_state: charger_pins@0 {
++				brcm,pins = <4>; // gpio number
++				brcm,function = <0>; // 0 = input, 1 = output
++				brcm,pull = <1>; // 0 = none, 1 = pull down, 2 = pull up
++			};
++		};
++	};
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			charger: charger@0 {
++				compatible = "gpio-charger";
++				pinctrl-0 = <&pin_state>;
++				status = "okay";
++				gpios = <&gpio 4 0>;
++				charger-type = "mains";
++			};
++		};
++	};
++
++	__overrides__ {
++		gpio =       <&charger>,"reg:0",
++			     <&charger>,"gpios:4",
++			     <&pin_state>,"reg:0",
++			     <&pin_state>,"brcm,pins:0";
++		type =       <&charger>,"charger-type";
++		gpio_pull =  <&pin_state>,"brcm,pull:0";
++		active_low = <&charger>,"gpios:8";
++	};
++
++};
+diff --git a/arch/arm/boot/dts/overlays/gpio-fan-overlay.dts b/arch/arm/boot/dts/overlays/gpio-fan-overlay.dts
+new file mode 100644
+index 000000000000..17b77bb27931
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/gpio-fan-overlay.dts
+@@ -0,0 +1,89 @@
++/*
++ * Overlay for the Raspberry Pi GPIO Fan @ BCM GPIO12.
++ * References: 
++ *	- https://www.raspberrypi.org/forums/viewtopic.php?f=107&p=1367135#p1365084
++ *
++ * Optional parameters:
++ *	- "gpiopin"	- BCM number of the pin driving the fan, default 12 (GPIO12);
++ * 	- "temp"	- CPU temperature at which fan is started in millicelsius, default 55000;
++ *
++ * Requires:
++ *	- kernel configurations: CONFIG_SENSORS_GPIO_FAN=m;
++ *	- kernel rebuild;
++ *	- N-MOSFET connected to gpiopin, 2N7002-[https://en.wikipedia.org/wiki/2N7000];
++ *	- DC Fan connected to N-MOSFET Drain terminal, a 12V fan is working fine and quite silently;
++ *	  [https://www.tme.eu/en/details/ee40101s1-999-a/dc12v-fans/sunon/ee40101s1-1000u-999/]
++ *
++ *                   ┌─────────────────────┐
++ *                   │Fan negative terminal│
++ *                   └┬────────────────────┘
++ *                    │D
++ *             G   │──┘
++ * [GPIO12]──────┤ │<─┐  2N7002
++ *                 │──┤
++ *                    │S
++ *                   ─┴─
++ *                   GND
++ *
++ * Build:
++ * 	- `sudo dtc -W no-unit_address_vs_reg -@ -I dts -O dtb -o /boot/overlays/gpio-fan.dtbo gpio-fan-overlay.dts`
++ * Activate:
++ *	- sudo nano /boot/config.txt add "dtoverlay=gpio-fan" or "dtoverlay=gpio-fan,gpiopin=12,temp=45000"
++ *	 or
++ *	- sudo sh -c 'printf "\n# Enable PI GPIO-Fan Default\ndtoverlay=gpio-fan\n" >> /boot/config.txt'
++ *	- sudo sh -c 'printf "\n# Enable PI GPIO-Fan Custom\ndtoverlay=gpio-fan,gpiopin=12,temp=45000\n" >> /boot/config.txt'
++ *
++ */
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			fan0: gpio-fan@0 {
++				compatible = "gpio-fan";
++				gpios = <&gpio 12 0>;
++				gpio-fan,speed-map = <0    0>,
++									 <5000 1>;
++				#cooling-cells = <2>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&cpu_thermal>;
++		__overlay__ {
++			polling-delay = <2000>;	/* milliseconds */
++		};
++	};
++
++	fragment@2 {
++		target = <&thermal_trips>;
++		__overlay__ {
++			cpu_hot: trip-point@0 {
++				temperature = <55000>;	/* (millicelsius) Fan started at 55°C */
++				hysteresis = <10000>;	/* (millicelsius) Fan stopped at 45°C */
++				type = "active";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&cooling_maps>;
++		__overlay__ {
++			map0 {
++				trip = <&cpu_hot>;
++				cooling-device = <&fan0 1 1>;
++			};
++		};
++	};
++
++	__overrides__ {
++		gpiopin = <&fan0>,"gpios:4", <&fan0>,"brcm,pins:0";
++		temp = <&cpu_hot>,"temperature:0";
++		hyst = <&cpu_hot>,"hysteresis:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/gpio-hog-overlay.dts b/arch/arm/boot/dts/overlays/gpio-hog-overlay.dts
+new file mode 100644
+index 000000000000..c9e39046fed9
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/gpio-hog-overlay.dts
+@@ -0,0 +1,27 @@
++// Configure a "hog" on the specified GPIO
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			hog: hog@1a {
++			     gpio-hog;
++			     gpios = <26 GPIO_ACTIVE_HIGH>;
++			     output-high;
++			};
++		};
++	};
++
++	__overrides__ {
++		gpio =       <&hog>,"reg:0",
++		             <&hog>,"gpios:0";
++		active_low = <&hog>,"output-high!",
++			     <&hog>,"output-low?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/gpio-ir-overlay.dts b/arch/arm/boot/dts/overlays/gpio-ir-overlay.dts
+new file mode 100644
+index 000000000000..162b6ce07dc9
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/gpio-ir-overlay.dts
+@@ -0,0 +1,49 @@
++// Definitions for ir-gpio module
++/dts-v1/;
++/plugin/;
++
++/ {
++        compatible = "brcm,bcm2835";
++
++        fragment@0 {
++                target-path = "/";
++                __overlay__ {
++                        gpio_ir: ir-receiver@12 {
++                                compatible = "gpio-ir-receiver";
++                                pinctrl-names = "default";
++                                pinctrl-0 = <&gpio_ir_pins>;
++
++                                // pin number, high or low
++                                gpios = <&gpio 18 1>;
++
++                                // parameter for keymap name
++                                linux,rc-map-name = "rc-rc6-mce";
++
++                                status = "okay";
++                        };
++                };
++        };
++
++        fragment@1 {
++                target = <&gpio>;
++                __overlay__ {
++                        gpio_ir_pins: gpio_ir_pins@12 {
++                                brcm,pins = <18>;                       // pin 18
++                                brcm,function = <0>;                    // in
++                                brcm,pull = <2>;                        // up
++                        };
++                };
++        };
++
++        __overrides__ {
++                // parameters
++                gpio_pin =      <&gpio_ir>,"gpios:4",           // pin number
++                                <&gpio_ir>,"reg:0",
++                                <&gpio_ir_pins>,"brcm,pins:0",
++                                <&gpio_ir_pins>,"reg:0";
++                gpio_pull = <&gpio_ir_pins>,"brcm,pull:0";              // pull-up/down state
++                invert = <&gpio_ir>,"gpios:8";                          // 0 = active high input
++
++                rc-map-name = <&gpio_ir>,"linux,rc-map-name";           // default rc map
++        };
++};
+diff --git a/arch/arm/boot/dts/overlays/gpio-ir-tx-overlay.dts b/arch/arm/boot/dts/overlays/gpio-ir-tx-overlay.dts
+new file mode 100644
+index 000000000000..3625431b7560
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/gpio-ir-tx-overlay.dts
+@@ -0,0 +1,36 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			gpio_ir_tx_pins: gpio_ir_tx_pins@12 {
++				brcm,pins = <18>;
++				brcm,function = <1>;	// out
++			};
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			gpio_ir_tx: gpio-ir-transmitter@12 {
++				compatible = "gpio-ir-tx";
++				pinctrl-names = "default";
++				pinctrl-0 = <&gpio_ir_tx_pins>;
++				gpios = <&gpio 18 0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		gpio_pin = <&gpio_ir_tx>, "gpios:4",           	// pin number
++			   <&gpio_ir_tx>, "reg:0",
++			   <&gpio_ir_tx_pins>, "brcm,pins:0",
++			   <&gpio_ir_tx_pins>, "reg:0";
++		invert = <&gpio_ir_tx>, "gpios:8";		// 1 = active low
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/gpio-key-overlay.dts b/arch/arm/boot/dts/overlays/gpio-key-overlay.dts
+new file mode 100644
+index 000000000000..2e7253d1d0ab
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/gpio-key-overlay.dts
+@@ -0,0 +1,48 @@
++// Definitions for gpio-key module
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		// Configure the gpio pin controller
++		target = <&gpio>;
++		__overlay__ {
++			pin_state: button_pins@0 {
++				brcm,pins = <3>; // gpio number
++				brcm,function = <0>; // 0 = input, 1 = output
++				brcm,pull = <2>; // 0 = none, 1 = pull down, 2 = pull up
++			};
++		};
++	};
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			button: button@0 {
++				compatible = "gpio-keys";
++				pinctrl-names = "default";
++				pinctrl-0 = <&pin_state>;
++				status = "okay";
++
++				key: key {
++					linux,code = <116>;
++					gpios = <&gpio 3 1>;
++					label = "KEY_POWER";
++				};
++			};
++		};
++	};
++
++	__overrides__ {
++		gpio =       <&key>,"gpios:4",
++		             <&button>,"reg:0",
++		             <&pin_state>,"brcm,pins:0",
++		             <&pin_state>,"reg:0";
++		label =      <&key>,"label";
++		keycode =    <&key>,"linux,code:0";
++		gpio_pull =  <&pin_state>,"brcm,pull:0";
++		active_low = <&key>,"gpios:8";
++	};
++
++};
+diff --git a/arch/arm/boot/dts/overlays/gpio-led-overlay.dts b/arch/arm/boot/dts/overlays/gpio-led-overlay.dts
+new file mode 100755
+index 000000000000..d8e9d53f1b61
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/gpio-led-overlay.dts
+@@ -0,0 +1,97 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * gpio-led - generic connection of kernel's LED framework to the RPI's GPIO.
++ * Copyright (C) 2021 House Gordon Software Company Ltd. <assafgordon@gmail.com>
++ *
++ * Based on information from:
++ *   https://mjoldfield.com/atelier/2017/03/rpi-devicetree.html
++ *   https://www.raspberrypi.org/documentation/configuration/device-tree.md
++ *   https://www.kernel.org/doc/html/latest/leds/index.html
++ *
++ * compile with:
++ *   dtc -@ -Hepapr -I dts -O dtb -o gpio-led.dtbo gpio-led-overlay.dts
++ *
++ * There will be some warnings (can be ignored):
++ *  Warning (label_is_string): /__overrides__:label: property is not a string
++ *  Warning (unit_address_vs_reg): /fragment@0/__overlay__/led_pins@0:
++ *                                 node has a unit name, but no reg property
++ *  Warning (unit_address_vs_reg): /fragment@1/__overlay__/leds@0:
++ *                                 node has a unit name, but no reg property
++ *  Warning (gpios_property): /__overrides__: Missing property
++ *                 '#gpio-cells' in node /fragment@1/__overlay__/leds@0/led
++ *                  or bad phandle (referred from gpio[0])
++ *
++ * Typical electrical connection is:
++ *    RPI-GPIO.19  ->  LED  -> 300ohm resister  -> RPI-GND
++ *    The GPIO pin number can be changed with the 'gpio=' parameter.
++ *
++ * Test from user-space with:
++ *   # if nothing is shown, the overlay file isn't found in /boot/overlays
++ *   dtoverlay -a | grep gpio-led
++ *
++ *   # Load the overlay
++ *   dtoverlay gpio-led label=moo gpio=19
++ *
++ *   # if nothing is shown, the overlay wasn't loaded successfully
++ *   dtoverlay -l | grep gpio-led
++ *
++ *   echo 1 > /sys/class/leds/moo/brightness
++ *   echo 0 > /sys/class/leds/moo/brightness
++ *   echo cpu > /sys/class/leds/moo/trigger
++ *   echo heartbeat > /sys/class/leds/moo/trigger
++ *
++ *   # unload the overlay
++ *   dtoverlay -r gpio-led
++ *
++ * To load in /boot/config.txt add lines such as:
++ *   dtoverlay=gpio-led,gpio=19,label=heart,trigger=heartbeat
++ *   dtoverlay=gpio-led,gpio=26,label=brain,trigger=cpu
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		// Configure the gpio pin controller
++		target = <&gpio>;
++		__overlay__ {
++			led_pin: led_pins@19 {
++				brcm,pins = <19>; // gpio number
++				brcm,function = <1>; // 0 = input, 1 = output
++				brcm,pull = <0>; // 0 = none, 1 = pull down, 2 = pull up
++			};
++		};
++	};
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			leds: leds@0 {
++				compatible = "gpio-leds";
++				pinctrl-names = "default";
++				pinctrl-0 = <&led_pin>;
++				status = "okay";
++
++				led: led {
++			                label = "myled1";
++					gpios = <&gpio 19 0>;
++			                linux,default-trigger = "none";
++				};
++			};
++		};
++	};
++
++	__overrides__ {
++		gpio =       <&led>,"gpios:4",
++		             <&leds>,"reg:0",
++		             <&led_pin>,"brcm,pins:0",
++		             <&led_pin>,"reg:0";
++		label =      <&led>,"label";
++		active_low = <&led>,"gpios:8";
++		trigger =    <&led>,"linux,default-trigger";
++	};
++
++};
++
+diff --git a/arch/arm/boot/dts/overlays/gpio-no-bank0-irq-overlay.dts b/arch/arm/boot/dts/overlays/gpio-no-bank0-irq-overlay.dts
+new file mode 100755
+index 000000000000..96cbe80820b7
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/gpio-no-bank0-irq-overlay.dts
+@@ -0,0 +1,14 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		// Configure the gpio pin controller
++		target = <&gpio>;
++		__overlay__ {
++			    interrupts = <255 255>, <2 18>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/gpio-no-irq-overlay.dts b/arch/arm/boot/dts/overlays/gpio-no-irq-overlay.dts
+new file mode 100644
+index 000000000000..55f9bff3a8f6
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/gpio-no-irq-overlay.dts
+@@ -0,0 +1,14 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		// Configure the gpio pin controller
++		target = <&gpio>;
++		__overlay__ {
++			    interrupts;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/gpio-poweroff-overlay.dts b/arch/arm/boot/dts/overlays/gpio-poweroff-overlay.dts
+new file mode 100644
+index 000000000000..8153f83f0427
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/gpio-poweroff-overlay.dts
+@@ -0,0 +1,39 @@
++// Definitions for gpio-poweroff module
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			power_ctrl: power_ctrl {
++				compatible = "gpio-poweroff";
++				gpios = <&gpio 26 0>;
++				force;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			power_ctrl_pins: power_ctrl_pins {
++				brcm,pins = <26>;
++				brcm,function = <1>; // out
++			};
++		};
++	};
++
++	__overrides__ {
++		gpiopin =       <&power_ctrl>,"gpios:4",
++				<&power_ctrl_pins>,"brcm,pins:0";
++		active_low =    <&power_ctrl>,"gpios:8";
++		input =         <&power_ctrl>,"input?";
++		export =        <&power_ctrl>,"export?";
++		timeout_ms =    <&power_ctrl>,"timeout-ms:0";
++		active_delay_ms = <&power_ctrl>,"active-delay-ms:0";
++		inactive_delay_ms = <&power_ctrl>,"inactive-delay-ms:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/gpio-shutdown-overlay.dts b/arch/arm/boot/dts/overlays/gpio-shutdown-overlay.dts
+new file mode 100644
+index 000000000000..da148064aedd
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/gpio-shutdown-overlay.dts
+@@ -0,0 +1,86 @@
++// Definitions for gpio-poweroff module
++/dts-v1/;
++/plugin/;
++
++// This overlay sets up an input device that generates KEY_POWER events
++// when a given GPIO pin changes. It defaults to using GPIO3, which can
++// also be used to wake up (start) the Rpi again after shutdown.
++// Raspberry Pi 1 Model B rev 1 can be wake up only by GPIO1 pin, so for
++// these boards change default GPIO pin to 1 via gpio_pin parameter. Since
++// wakeup is active-low, this defaults to active-low with a pullup
++// enabled, but all of this can be changed using overlay parameters (but
++// note that GPIO3 has an external pullup on at least some boards).
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		// Configure the gpio pin controller
++		target = <&gpio>;
++		__overlay__ {
++			// Define a pinctrl state, that sets up the gpio
++			// as an input with a pullup enabled. This does
++			// not take effect by itself, only when referenced
++			// by a "pinctrl client", as is done below. See:
++			//   https://www.kernel.org/doc/Documentation/devicetree/bindings/pinctrl/pinctrl-bindings.txt
++			//   https://www.kernel.org/doc/Documentation/devicetree/bindings/pinctrl/brcm,bcm2835-gpio.txt
++			pin_state: shutdown_button_pins@3 {
++				brcm,pins = <3>; // gpio number
++				brcm,function = <0>; // 0 = input, 1 = output
++				brcm,pull = <2>; // 0 = none, 1 = pull down, 2 = pull up
++			};
++		};
++	};
++	fragment@1 {
++		// Add a new device to the /soc devicetree node
++		target-path = "/soc";
++		__overlay__ {
++			shutdown_button: shutdown_button@3 {
++				// Let the gpio-keys driver handle this device. See:
++				// https://www.kernel.org/doc/Documentation/devicetree/bindings/input/gpio-keys.txt
++				compatible = "gpio-keys";
++
++				// Declare a single pinctrl state (referencing the one declared above) and name it
++				// default, so it is activated automatically.
++				pinctrl-names = "default";
++				pinctrl-0 = <&pin_state>;
++
++				// Enable this device
++				status = "okay";
++
++				// Define a single key, called "shutdown" that monitors the gpio and sends KEY_POWER
++				// (keycode 116, see
++				// https://github.com/torvalds/linux/blob/v4.12/include/uapi/linux/input-event-codes.h#L190)
++				button: shutdown {
++					label = "shutdown";
++					linux,code = <116>; // KEY_POWER
++					gpios = <&gpio 3 1>;
++					debounce-interval = <100>; // ms
++				};
++			};
++		};
++	};
++
++	// This defines parameters that can be specified when loading
++	// the overlay. Each foo = line specifies one parameter, named
++	// foo. The rest of the specification gives properties where the
++	// parameter value is inserted into (changing the values above
++	// or adding new ones).
++	__overrides__ {
++		// Allow overriding the GPIO number.
++		gpio_pin = <&button>,"gpios:4",
++			   <&shutdown_button>,"reg:0",
++			   <&pin_state>,"reg:0",
++		           <&pin_state>,"brcm,pins:0";
++
++		// Allow changing the internal pullup/down state. 0 = none, 1 = pulldown, 2 = pullup
++		// Note that GPIO3 and GPIO2 are the I2c pins and have an external pullup (at least
++		// on some boards). Same applies for GPIO1 on Raspberry Pi 1 Model B rev 1.
++		gpio_pull = <&pin_state>,"brcm,pull:0";
++
++		// Allow setting the active_low flag. 0 = active high, 1 = active low
++		active_low = <&button>,"gpios:8";
++		debounce = <&button>,"debounce-interval:0";
++	};
++
++};
+diff --git a/arch/arm/boot/dts/overlays/hat_map.dts b/arch/arm/boot/dts/overlays/hat_map.dts
+new file mode 100644
+index 000000000000..0b5d902e85b8
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hat_map.dts
+@@ -0,0 +1,124 @@
++/dts-v1/;
++
++/ {
++	hailo-8 {
++		product = "Raspberry Pi AI Hat, Model Hailo-8";
++		vendor = "Hailo Technologies";
++		overlay = "none,pciex1,pciex1_gen=3";
++	};
++
++	hailo-8l {
++		product = "Raspberry Pi AI Hat, Model Hailo-8L";
++		vendor = "Hailo Technologies";
++		overlay = "none,pciex1,pciex1_gen=3";
++	};
++
++	hifiberry-amp100-1 {
++		uuid = [ 5eb863b8 12f9 41ad 978f 4cee1b3eca62 ];
++		overlay = "hifiberry-amp100";
++	};
++
++	hifiberry-amp100-2 {
++		uuid = [ b1a57dbe 8b52 447f 939e 1baf72157d79 ];
++		overlay = "hifiberry-amp100";
++	};
++
++	hifiberry-amp4pro {
++		uuid = [ 3619722a c92d 4092 95bd 493a2903e933 ];
++		overlay = "hifiberry-amp4pro";
++	};
++
++	hifiberry-amp4 {
++		uuid = [ fcb6ec42 a182 419d a314 7eeae416f608 ];
++		overlay = "hifiberry-dacplus-std";
++	};
++
++	hifiberry-dac2proadc {
++		uuid = [ 30660215 dbb2 4c57 953f 099370b63e2e ];
++		overlay = "hifiberry-dacplusadcpro";
++	};
++
++	hifiberry-dac2hd {
++		uuid = [ 482ad277 5586 480c 88e7 85ae89c4e501 ];
++		overlay = "hifiberry-dacplushd";
++	};
++
++	hifiberry-dac2pro {
++		uuid = [ ebf9cfc4 6d77 4880 89fd 353690467dfc ];
++		overlay = "hifiberry-dacplus-pro";
++	};
++
++	hifiberry-dac8x {
++		uuid = [ f65985f9 5354 4457 ae3b 3da39ba2cf6d ];
++		overlay = "hifiberry-dac8x";
++	};
++
++	hifiberry-dacplus-amp2-1 {
++		uuid = [ 81cac43d 27c6 4a1e a0b2 c70b4e608ab6 ];
++		overlay = "hifiberry-dacplus-std";
++	};
++
++	hifiberry-dacplus-amp2-2 {
++		uuid = [ ef586afc 2efa 47a0 be2e 95a7d952fe98 ];
++		overlay = "hifiberry-dacplus-std";
++	};
++
++	hifiberry-digiplus-pro {
++		uuid = [ 2154f80b 0f92 45e4 96db c1643ec2b46b ];
++		overlay = "hifiberry-digi-pro";
++	};
++
++	hifiberry-dacplusadcpro {
++		uuid = [ 36e3d3da 1ed9 468b aea3 cd165f6820f0 ];
++		overlay = "hifiberry-dacplusadcpro";
++	};
++
++	hifiberry-digi2pro {
++		uuid = [ 5af941bb 4dcf 4eac 82a8 e36e84fcabef ];
++		overlay = "hifiberry-digi-pro";
++	};
++
++	hifiberry-digi2standard {
++		uuid = [ 7c980a0e 9d15 40af 9f40 bddfbd3aee8c ];
++		overlay = "hifiberry-digi";
++	};
++
++	hifiberry-dsp2x4 {
++		uuid = [ 8f287583 429d 4206 a751 862264bbda63 ];
++		overlay = "hifiberry-dacplus-dsp";
++	};
++
++	iqaudio-pi-codecplus {
++		uuid = [ dc1c9594 c1ab 4c6c acda a88dc59a3c5b ];
++		overlay = "iqaudio-codec";
++	};
++
++	iqaudio-pi-codeczero {
++		uuid = [ e15c739c 877d 4e29 ab36 4dc73c21127c ];
++		overlay = "iqaudio-codec";
++	};
++
++	pisound {
++		uuid = [ a7ee5d28 da03 41f5 bbd7 20438a4bec5d ];
++		overlay = "pisound";
++	};
++
++	recalbox-rgbdual {
++		uuid = [ 1c955808 681f 4bbc a2ef b7ea47cd388e ];
++		overlay = "recalboxrgbdual";
++	};
++
++	sensehat-v1 {
++		product = "Sense HAT";
++		vendor = "Raspberry Pi";
++		pver = < 0x0001 >;
++		overlay = "rpi-sense";
++	};
++
++	sensehat-v2 {
++		product = "Sense HAT";
++		vendor = "Raspberry Pi";
++		pver = < 0x0002 >;
++		overlay = "rpi-sense-v2";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hd44780-i2c-lcd-overlay.dts b/arch/arm/boot/dts/overlays/hd44780-i2c-lcd-overlay.dts
+new file mode 100644
+index 000000000000..36fcf049ffbf
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hd44780-i2c-lcd-overlay.dts
+@@ -0,0 +1,57 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_arm>;
++		__overlay__ {
++			status = "okay";
++
++			pcf857x: pcf857x@27 {
++				compatible = "nxp,pcf8574";
++				reg = <0x27>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			lcd_screen: auxdisplay {
++				compatible = "hit,hd44780";
++
++				data-gpios = <&pcf857x 4 0>,
++					     <&pcf857x 5 0>,
++					     <&pcf857x 6 0>,
++					     <&pcf857x 7 0>;
++				enable-gpios = <&pcf857x 2 0>;
++				rs-gpios = <&pcf857x 0 0>;
++				rw-gpios = <&pcf857x 1 0>;
++				backlight-gpios = <&pcf857x 3 0>;
++
++				display-width-chars = <16>;
++				display-height-chars = <2>;
++			};
++		};
++	};
++
++	__overrides__ {
++		pin_d4 = <&lcd_screen>,"data-gpios:4";
++		pin_d5 = <&lcd_screen>,"data-gpios:16";
++		pin_d6 = <&lcd_screen>,"data-gpios:28";
++		pin_d7 = <&lcd_screen>,"data-gpios:40";
++		pin_en = <&lcd_screen>,"enable-gpios:4";
++		pin_rs = <&lcd_screen>,"rs-gpios:4";
++		pin_rw = <&lcd_screen>,"rw-gpios:4";
++		pin_bl = <&lcd_screen>,"backlight-gpios:4";
++		display_height = <&lcd_screen>,"display-height-chars:0";
++		display_width = <&lcd_screen>,"display-width-chars:0";
++		addr = <&pcf857x>,"reg:0";
++	};
++
++};
+diff --git a/arch/arm/boot/dts/overlays/hd44780-lcd-overlay.dts b/arch/arm/boot/dts/overlays/hd44780-lcd-overlay.dts
+new file mode 100644
+index 000000000000..ee726669ff51
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hd44780-lcd-overlay.dts
+@@ -0,0 +1,46 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++    compatible = "brcm,bcm2835";
++
++    fragment@0 {
++        target-path = "/";
++        __overlay__ {
++            lcd_screen: auxdisplay {
++                compatible = "hit,hd44780";
++
++                data-gpios = <&gpio 6 0>,
++                             <&gpio 13 0>,
++                             <&gpio 19 0>,
++                             <&gpio 26 0>;
++                enable-gpios = <&gpio 21 0>;
++                rs-gpios = <&gpio 20 0>;
++
++                display-height-chars = <2>;
++                display-width-chars = <16>;
++            };
++
++        };
++    };
++
++    fragment@1 {
++       target = <&lcd_screen>;
++        __dormant__ {
++            backlight-gpios = <&gpio 12 0>;
++        };
++    };
++
++    __overrides__ {
++        pin_d4 = <&lcd_screen>,"data-gpios:4";
++        pin_d5 = <&lcd_screen>,"data-gpios:16";
++        pin_d6 = <&lcd_screen>,"data-gpios:28";
++        pin_d7 = <&lcd_screen>,"data-gpios:40";
++        pin_en = <&lcd_screen>,"enable-gpios:4";
++        pin_rs = <&lcd_screen>,"rs-gpios:4";
++        pin_bl = <0>,"+1", <&lcd_screen>,"backlight-gpios:4";
++        display_height = <&lcd_screen>,"display-height-chars:0";
++        display_width = <&lcd_screen>,"display-width-chars:0";
++    };
++
++};
+diff --git a/arch/arm/boot/dts/overlays/hdmi-backlight-hwhack-gpio-overlay.dts b/arch/arm/boot/dts/overlays/hdmi-backlight-hwhack-gpio-overlay.dts
+new file mode 100644
+index 000000000000..50b9a2665c80
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hdmi-backlight-hwhack-gpio-overlay.dts
+@@ -0,0 +1,47 @@
++/*
++ * Devicetree overlay for GPIO based backlight on/off capability.
++ *
++ * Use this if you have one of those HDMI displays whose backlight cannot be
++ * controlled via DPMS over HDMI and plan to do a little soldering to use an
++ * RPi gpio pin for on/off switching.
++ *
++ * See: https://www.waveshare.com/wiki/7inch_HDMI_LCD_(C)#Backlight_Control
++ *
++ */
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			hdmi_backlight_hwhack_gpio_pins: hdmi_backlight_hwhack_gpio_pins {
++				brcm,pins = <17>;
++				brcm,function = <1>; /* out */
++			};
++		};
++	};
++
++	fragment@2 {
++		target-path = "/";
++		__overlay__ {
++			hdmi_backlight_hwhack_gpio: hdmi_backlight_hwhack_gpio {
++				compatible = "gpio-backlight";
++
++				pinctrl-names = "default";
++				pinctrl-0 = <&hdmi_backlight_hwhack_gpio_pins>;
++
++				gpios = <&gpio 17 0>;
++				default-on;
++			};
++		};
++	};
++
++	__overrides__ {
++		gpio_pin   = <&hdmi_backlight_hwhack_gpio>,"gpios:4",
++		             <&hdmi_backlight_hwhack_gpio_pins>,"brcm,pins:0";
++		active_low = <&hdmi_backlight_hwhack_gpio>,"gpios:8";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-adc-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-adc-overlay.dts
+new file mode 100644
+index 000000000000..2658f3242556
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-adc-overlay.dts
+@@ -0,0 +1,45 @@
++// SPDX-License-Identifier: GPL-2.0
++// Definitions for HiFiBerry ADC, no onboard clocks
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			hb_adc: pcm186x@4a {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm1863";
++				reg = <0x4a>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		hifiberry_adc: __overlay__ {
++			compatible = "hifiberry,hifiberry-adc";
++			audio-codec = <&hb_adc>;
++			i2s-controller = <&i2s_clk_producer>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		leds_off = <&hifiberry_adc>,"hifiberry-adc,leds_off?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-adc8x-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-adc8x-overlay.dts
+new file mode 100644
+index 000000000000..e0432115dc39
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-adc8x-overlay.dts
+@@ -0,0 +1,50 @@
++// Definitions for HiFiBerry ADC8x
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			rp1_i2s0_adc8x: rp1_i2s0_adc8x {
++				function = "i2s0";
++				pins = "gpio18", "gpio19", "gpio20",
++				       "gpio22", "gpio24", "gpio26";
++				bias-disable;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&rp1_i2s0_adc8x>;
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target-path = "/";
++		__overlay__ {
++			dummy-codec {
++				#sound-dai-cells = <0>;
++				compatible = "snd-soc-dummy";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "hifiberry,hifiberry-adc8x";
++			i2s-controller = <&i2s_clk_producer>;
++			status = "okay";
++		};
++	};
++
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-amp-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-amp-overlay.dts
+new file mode 100644
+index 000000000000..667cd2601806
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-amp-overlay.dts
+@@ -0,0 +1,39 @@
++// Definitions for HiFiBerry Amp/Amp+
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			tas5713@1b {
++				#sound-dai-cells = <0>;
++				compatible = "ti,tas5713";
++				reg = <0x1b>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "hifiberry,hifiberry-amp";
++			i2s-controller = <&i2s_clk_producer>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-amp100-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-amp100-overlay.dts
+new file mode 100644
+index 000000000000..b38e6631a572
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-amp100-overlay.dts
+@@ -0,0 +1,67 @@
++// Definitions for HiFiBerry AMP100
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			dacpro_osc: dacpro_osc {
++				compatible = "hifiberry,dacpro-clk";
++				#clock-cells = <0>;
++			};
++		};
++	};
++
++	frag1: fragment@1 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm5122@4d {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4d>;
++				clocks = <&dacpro_osc>;
++				AVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				CPVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		hifiberry_dacplus: __overlay__ {
++			compatible = "hifiberry,hifiberry-dacplus";
++			i2s-controller = <&i2s_clk_consumer>;
++			status = "okay";
++			mute-gpio = <&gpio 4 0>;
++			reset-gpio = <&gpio 17 0x11>;
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain =
++			<&hifiberry_dacplus>,"hifiberry,24db_digital_gain?";
++		slave = <&hifiberry_dacplus>,"hifiberry-dacplus,slave?",
++			<&frag1>,"target:0=",<&i2s_clk_producer>,
++			<&hifiberry_dacplus>,"i2s-controller:0=",<&i2s_clk_producer>;
++
++		leds_off = <&hifiberry_dacplus>,"hifiberry-dacplus,leds_off?";
++		mute_ext_ctl = <&hifiberry_dacplus>,"hifiberry-dacplus,mute_ext_ctl:0";
++		auto_mute = <&hifiberry_dacplus>,"hifiberry-dacplus,auto_mute?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-amp3-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-amp3-overlay.dts
+new file mode 100644
+index 000000000000..fc8f11b6294e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-amp3-overlay.dts
+@@ -0,0 +1,57 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for HiFiBerry's Amp3
++/dts-v1/;
++/plugin/;
++#include <dt-bindings/pinctrl/bcm2835.h>
++#include <dt-bindings/gpio/gpio.h>
++
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			hifiberry_amp3_pins: hifiberry_amp3_pins {
++				brcm,pins = <23 17>;
++				brcm,function = <0 1>;
++				brcm,pull = <2 1>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			hifiberry_amp2: ma120x0p@20 {
++				#sound-dai-cells = <0>;
++				compatible = "ma,ma120x0p";
++				reg = <0x20>;
++				status = "okay";
++				pinctrl-names = "default";
++				pinctrl-0 = <&hifiberry_amp3_pins>;
++				error_gp-gpios = <&gpio 23 GPIO_ACTIVE_HIGH>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "hifiberry,hifiberry-amp3";
++			i2s-controller = <&i2s_clk_producer>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-amp4pro-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-amp4pro-overlay.dts
+new file mode 100644
+index 000000000000..6b211c2932dd
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-amp4pro-overlay.dts
+@@ -0,0 +1,63 @@
++// Definitions for HiFiBerry AMP4PRO
++/dts-v1/;
++/plugin/;
++#include <dt-bindings/gpio/gpio.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			dacpro_osc: dacpro_osc {
++				compatible = "hifiberry,dacpro-clk";
++				#clock-cells = <0>;
++			};
++		};
++	};
++
++	frag1: fragment@1 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			tas5756@4d {
++				#sound-dai-cells = <0>;
++				compatible = "ti,tas5756";
++				reg = <0x4d>;
++				clocks = <&dacpro_osc>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		hifiberry_dacplus: __overlay__ {
++			compatible = "hifiberry,hifiberry-dacplus";
++			i2s-controller = <&i2s_clk_consumer>;
++			status = "okay";
++			mute-gpio = <&gpio 4 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain =
++			<&hifiberry_dacplus>,"hifiberry-amp4,24db_digital_gain?";
++		leds_off = <&hifiberry_dacplus>,"hifiberry-amp4,leds_off?";
++		mute_ext_ctl = <&hifiberry_dacplus>,"hifiberry-amp4,mute_ext_ctl:0";
++		auto_mute = <&hifiberry_dacplus>,"hifiberry-amp4,auto_mute?";
++		slave = <&hifiberry_dacplus>,"hifiberry-dacplus,slave?",
++			<&frag1>,"target:0=",<&i2s_clk_producer>,
++			<&hifiberry_dacplus>,"i2s-controller:0=",<&i2s_clk_producer>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-dac-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-dac-overlay.dts
+new file mode 100644
+index 000000000000..efb0e18dbdc4
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-dac-overlay.dts
+@@ -0,0 +1,34 @@
++// Definitions for HiFiBerry DAC
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			pcm5102a-codec {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5102a";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "hifiberry,hifiberry-dac";
++			i2s-controller = <&i2s_clk_producer>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-dac8x-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-dac8x-overlay.dts
+new file mode 100644
+index 000000000000..efeff792f396
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-dac8x-overlay.dts
+@@ -0,0 +1,50 @@
++// Definitions for HiFiBerry DAC8x
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			rp1_i2s0_dac8x: rp1_i2s0_dac8x {
++				function = "i2s0";
++				pins = "gpio18", "gpio19", "gpio21",
++				       "gpio23", "gpio25", "gpio27";
++				bias-disable;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&rp1_i2s0_dac8x>;
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target-path = "/";
++		__overlay__ {
++			pcm5102a-codec {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5102a";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "hifiberry,hifiberry-dac8x";
++			i2s-controller = <&i2s_clk_producer>;
++			status = "okay";
++		};
++	};
++
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-dacplus-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-dacplus-overlay.dts
+new file mode 100644
+index 000000000000..0d0ab068112f
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-dacplus-overlay.dts
+@@ -0,0 +1,68 @@
++// Definitions for HiFiBerry DAC+
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			dacpro_osc: dacpro_osc {
++				compatible = "hifiberry,dacpro-clk";
++				#clock-cells = <0>;
++			};
++		};
++	};
++
++	frag1: fragment@1 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm5122@4d {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4d>;
++				clocks = <&dacpro_osc>;
++				AVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				CPVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++			hpamp: hpamp@60 {
++				compatible = "ti,tpa6130a2";
++				reg = <0x60>;
++				status = "disabled";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		hifiberry_dacplus: __overlay__ {
++			compatible = "hifiberry,hifiberry-dacplus";
++			i2s-controller = <&i2s_clk_consumer>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain =
++			<&hifiberry_dacplus>,"hifiberry,24db_digital_gain?";
++		slave = <&hifiberry_dacplus>,"hifiberry-dacplus,slave?",
++			<&frag1>,"target:0=",<&i2s_clk_producer>,
++			<&hifiberry_dacplus>,"i2s-controller:0=",<&i2s_clk_producer>;
++
++		leds_off = <&hifiberry_dacplus>,"hifiberry-dacplus,leds_off?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-dacplus-pro-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-dacplus-pro-overlay.dts
+new file mode 100644
+index 000000000000..28b1c2f2f1a8
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-dacplus-pro-overlay.dts
+@@ -0,0 +1,64 @@
++// Definitions for HiFiBerry DAC+ PRO, with onboard clocks
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			dacpro_osc: dacpro_osc {
++				compatible = "hifiberry,dacpro-clk";
++				#clock-cells = <0>;
++			};
++		};
++	};
++
++	frag1: fragment@1 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm5122@4d {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4d>;
++				clocks = <&dacpro_osc>;
++				AVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				CPVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++			hpamp: hpamp@60 {
++				compatible = "ti,tpa6130a2";
++				reg = <0x60>;
++				status = "disabled";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		hifiberry_dacplus: __overlay__ {
++			compatible = "hifiberry,hifiberry-dacplus";
++			i2s-controller = <&i2s_clk_consumer>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain =
++			<&hifiberry_dacplus>,"hifiberry,24db_digital_gain?";
++		leds_off = <&hifiberry_dacplus>,"hifiberry-dacplus,leds_off?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-dacplus-std-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-dacplus-std-overlay.dts
+new file mode 100644
+index 000000000000..8872e3aa348d
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-dacplus-std-overlay.dts
+@@ -0,0 +1,65 @@
++// Definitions for HiFiBerry DAC+ Standard w/o onboard clocks
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			dacpro_osc: dacpro_osc {
++				compatible = "hifiberry,dacpro-clk";
++				#clock-cells = <0>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm5122@4d {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4d>;
++				clocks = <&dacpro_osc>;
++				AVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				CPVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++			hpamp: hpamp@60 {
++				compatible = "ti,tpa6130a2";
++				reg = <0x60>;
++				status = "disabled";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		hifiberry_dacplus: __overlay__ {
++			compatible = "hifiberry,hifiberry-dacplus";
++			i2s-controller = <&i2s_clk_producer>;
++			hifiberry-dacplus,slave;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain =
++			<&hifiberry_dacplus>,"hifiberry,24db_digital_gain?";
++		leds_off = <&hifiberry_dacplus>,"hifiberry-dacplus,leds_off?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-dacplusadc-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-dacplusadc-overlay.dts
+new file mode 100644
+index 000000000000..ea4c3572826f
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-dacplusadc-overlay.dts
+@@ -0,0 +1,72 @@
++// Definitions for HiFiBerry DAC+ADC, no onboard clocks
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			dacpro_osc: dacpro_osc {
++				compatible = "hifiberry,dacpro-clk";
++				#clock-cells = <0>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm_codec: pcm5122@4d {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4d>;
++				clocks = <&dacpro_osc>;
++				AVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				CPVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target-path = "/";
++		__overlay__ {
++			dmic {
++				#sound-dai-cells = <0>;
++				compatible = "dmic-codec";
++				num-channels = <2>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&sound>;
++		hifiberry_dacplusadc: __overlay__ {
++			compatible = "hifiberry,hifiberry-dacplusadc";
++			i2s-controller = <&i2s_clk_producer>;
++			hifiberry-dacplusadc,slave;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain =
++			<&hifiberry_dacplusadc>,"hifiberry,24db_digital_gain?";
++		leds_off = <&hifiberry_dacplusadc>,"hifiberry-dacplusadc,leds_off?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-dacplusadcpro-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-dacplusadcpro-overlay.dts
+new file mode 100644
+index 000000000000..a4268bd72477
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-dacplusadcpro-overlay.dts
+@@ -0,0 +1,72 @@
++// Definitions for HiFiBerry DAC+ADC PRO
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			dacpro_osc: dacpro_osc {
++				compatible = "hifiberry,dacpro-clk";
++				#clock-cells = <0>;
++			};
++		};
++	};
++
++	frag1: fragment@1 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			hb_dac: pcm5122@4d {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4d>;
++				clocks = <&dacpro_osc>;
++				status = "okay";
++			};
++			hb_adc: pcm186x@4a {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm1863";
++				reg = <0x4a>;
++				clocks = <&dacpro_osc>;
++				status = "okay";
++			};
++			hpamp: hpamp@60 {
++				compatible = "ti,tpa6130a2";
++				reg = <0x60>;
++				status = "disabled";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		hifiberry_dacplusadcpro: __overlay__ {
++			compatible = "hifiberry,hifiberry-dacplusadcpro";
++			audio-codec = <&hb_dac &hb_adc>;
++			i2s-controller = <&i2s_clk_consumer>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain =
++			<&hifiberry_dacplusadcpro>,"hifiberry-dacplusadcpro,24db_digital_gain?";
++		slave = <&hifiberry_dacplusadcpro>,"hifiberry-dacplusadcpro,slave?",
++			<&frag1>,"target:0=",<&i2s_clk_producer>,
++			<&hifiberry_dacplusadcpro>,"i2s-controller:0=",<&i2s_clk_producer>;
++		leds_off = <&hifiberry_dacplusadcpro>,"hifiberry-dacplusadcpro,leds_off?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-dacplusdsp-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-dacplusdsp-overlay.dts
+new file mode 100644
+index 000000000000..e916485f737e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-dacplusdsp-overlay.dts
+@@ -0,0 +1,34 @@
++// Definitions for hifiberry DAC+DSP soundcard overlay
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			dacplusdsp-codec {
++				#sound-dai-cells = <0>;
++				compatible = "hifiberry,dacplusdsp";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "hifiberrydacplusdsp,hifiberrydacplusdsp-soundcard";
++			i2s-controller = <&i2s_clk_producer>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-dacplushd-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-dacplushd-overlay.dts
+new file mode 100644
+index 000000000000..1856ac19793b
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-dacplushd-overlay.dts
+@@ -0,0 +1,94 @@
++// Definitions for HiFiBerry DAC+ HD
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm1792a@4c {
++				compatible = "ti,pcm1792a";
++				#sound-dai-cells = <0>;
++				#clock-cells = <0>;
++				reg = <0x4c>;
++				status = "okay";
++			};
++			pll: pll@62 {
++				compatible = "hifiberry,dachd-clk";
++				#clock-cells = <0>;
++				reg = <0x62>;
++				status = "okay";
++				common_pll_regs = [
++					02 53 03 00 07 20 0F 00
++					10 0D 11 1D 12 0D 13 8C
++					14 8C 15 8C 16 8C 17 8C
++					18 2A 1C 00 1D 0F 1F 00
++					2A 00 2C 00 2F 00 30 00
++					31 00 32 00 34 00 37 00
++					38 00 39 00 3A 00 3B 01
++					3E 00 3F 00 40 00 41 00
++					5A 00 5B 00 95 00 96 00
++					97 00 98 00 99 00 9A 00
++					9B 00 A2 00 A3 00 A4 00
++					B7 92 ];
++				192k_pll_regs = [
++					1A 0C 1B 35 1E F0 20 09
++					21 50 2B 02 2D 10 2E 40
++					33 01 35 22 36 80 3C 22
++					3D 46 ];
++				96k_pll_regs = [
++					1A 0C 1B 35 1E F0 20 09
++					21 50 2B 02 2D 10 2E 40
++					33 01 35 47 36 00 3C 32
++					3D 46 ];
++				48k_pll_regs = [
++					1A 0C 1B 35 1E F0 20 09
++					21 50 2B 02 2D 10 2E 40
++					33 01 35 90 36 00 3C 42
++					3D 46 ];
++				176k4_pll_regs = [
++					1A 3D 1B 09 1E F3 20 13
++					21 75 2B 04 2D 11 2E E0
++					33 02 35 25 36 C0 3C 22
++					3D 7A ];
++				88k2_pll_regs = [
++					1A 3D 1B 09 1E F3 20 13
++					21 75 2B 04 2D 11 2E E0
++					33 01 35 4D 36 80 3C 32
++					3D 7A ];
++				44k1_pll_regs = [
++					1A 3D 1B 09 1E F3 20 13
++					21 75 2B 04 2D 11 2E E0
++					33 01 35 9D 36 00 3C 42
++					3D 7A ];
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "hifiberry,hifiberry-dacplushd";
++			i2s-controller = <&i2s_clk_consumer>;
++			clocks = <&pll 0>;
++			reset-gpio = <&gpio 16 GPIO_ACTIVE_LOW>;
++			status = "okay";
++		};
++	};
++
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-digi-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-digi-overlay.dts
+new file mode 100644
+index 000000000000..eb68f117a92a
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-digi-overlay.dts
+@@ -0,0 +1,41 @@
++// Definitions for HiFiBerry Digi
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			wm8804@3b {
++				#sound-dai-cells = <0>;
++				compatible = "wlf,wm8804";
++				reg = <0x3b>;
++				PVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "hifiberry,hifiberry-digi";
++			i2s-controller = <&i2s_clk_consumer>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hifiberry-digi-pro-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-digi-pro-overlay.dts
+new file mode 100644
+index 000000000000..18d16276e120
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hifiberry-digi-pro-overlay.dts
+@@ -0,0 +1,43 @@
++// Definitions for HiFiBerry Digi Pro
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			wm8804@3b {
++				#sound-dai-cells = <0>;
++				compatible = "wlf,wm8804";
++				reg = <0x3b>;
++				PVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "hifiberry,hifiberry-digi";
++			i2s-controller = <&i2s_clk_consumer>;
++			status = "okay";
++			clock44-gpio = <&gpio 5 0>;
++			clock48-gpio = <&gpio 6 0>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/highperi-overlay.dts b/arch/arm/boot/dts/overlays/highperi-overlay.dts
+new file mode 100644
+index 000000000000..46cb76c2d34f
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/highperi-overlay.dts
+@@ -0,0 +1,63 @@
++/*
++ * highperi.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&soc>;
++		#address-cells = <2>;
++		#size-cells = <1>;
++
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <1>;
++			ranges = <0x7c000000  0x4 0x7c000000  0x04000000>,
++				 <0x40000000  0x4 0xc0000000  0x00800000>;
++		};
++	};
++
++	fragment@1 {
++		target = <&scb>;
++		#address-cells = <2>;
++		#size-cells = <1>;
++
++		__overlay__ {
++			#address-cells = <2>;
++			#size-cells = <2>;
++			ranges = <0x0 0x7c000000  0x4 0x7c000000  0x0 0x04000000>,
++				 <0x0 0x40000000  0x4 0xc0000000  0x0 0x00800000>,
++				 <0x6 0x00000000  0x6 0x00000000  0x0 0x40000000>;
++			dma-ranges = <0x0 0x00000000  0x0 0x00000000  0x2 0x00000000>;
++		};
++	};
++
++	fragment@2 {
++		target = <&v3dbus>;
++		#address-cells = <2>;
++		#size-cells = <1>;
++
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <2>;
++			ranges = <0x7c500000  0x4 0x7c500000  0x0 0x03300000>,
++				 <0x40000000  0x4 0xc0000000  0x0 0x00800000>;
++		};
++	};
++
++	fragment@3 {
++		target = <&emmc2bus>;
++		#address-cells = <2>;
++		#size-cells = <1>;
++
++		__overlay__ {
++			#address-cells = <2>;
++			#size-cells = <1>;
++			ranges = <0x0 0x7e000000  0x4 0x7e000000  0x01800000>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hy28a-overlay.dts b/arch/arm/boot/dts/overlays/hy28a-overlay.dts
+new file mode 100644
+index 000000000000..d0d52ebd9bd5
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hy28a-overlay.dts
+@@ -0,0 +1,93 @@
++/*
++ * Device Tree overlay for HY28A display
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			hy28a_pins: hy28a_pins {
++				brcm,pins = <17 25 18>;
++				brcm,function = <0 1 1>; /* in out out */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			hy28a: hy28a@0{
++				compatible = "ilitek,ili9320";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&hy28a_pins>;
++
++				spi-max-frequency = <32000000>;
++				spi-cpol;
++				spi-cpha;
++				rotate = <270>;
++				bgr;
++				fps = <50>;
++				buswidth = <8>;
++				startbyte = <0x70>;
++				reset-gpios = <&gpio 25 1>;
++				led-gpios = <&gpio 18 1>;
++				debug = <0>;
++			};
++
++			hy28a_ts: hy28a-ts@1 {
++				compatible = "ti,ads7846";
++				reg = <1>;
++
++				spi-max-frequency = <2000000>;
++				interrupts = <17 2>; /* high-to-low edge triggered */
++				interrupt-parent = <&gpio>;
++				pendown-gpio = <&gpio 17 1>;
++				ti,x-plate-ohms = /bits/ 16 <100>;
++				ti,pressure-max = /bits/ 16 <255>;
++			};
++		};
++	};
++	__overrides__ {
++		speed =		<&hy28a>,"spi-max-frequency:0";
++		rotate =	<&hy28a>,"rotate:0";
++		fps =		<&hy28a>,"fps:0";
++		debug =		<&hy28a>,"debug:0";
++		xohms =		<&hy28a_ts>,"ti,x-plate-ohms;0";
++		resetgpio =	<&hy28a>,"reset-gpios:4",
++				<&hy28a_pins>, "brcm,pins:4";
++		ledgpio =	<&hy28a>,"led-gpios:4",
++				<&hy28a_pins>, "brcm,pins:8";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hy28b-2017-overlay.dts b/arch/arm/boot/dts/overlays/hy28b-2017-overlay.dts
+new file mode 100644
+index 000000000000..9df33c5d95bb
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hy28b-2017-overlay.dts
+@@ -0,0 +1,152 @@
++/*
++ * Device Tree overlay for HY28b display shield by Texy.
++ * Modified for 2017 version with ILI9325 D chip
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			hy28b_pins: hy28b_pins {
++				brcm,pins = <17 25 18>;
++				brcm,function = <0 1 1>; /* in out out */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			hy28b: hy28b@0{
++				compatible = "ilitek,ili9325";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&hy28b_pins>;
++
++				spi-max-frequency = <48000000>;
++				spi-cpol;
++				spi-cpha;
++				rotate = <270>;
++				bgr;
++				fps = <50>;
++				buswidth = <8>;
++				startbyte = <0x70>;
++				reset-gpios = <&gpio 25 1>;
++				led-gpios = <&gpio 18 1>;
++
++				init = <0x10000e5 0x78F0
++					0x1000001 0x0100
++					0x1000002 0x0700
++				        0x1000003 0x1030
++					0x1000004 0x0000
++					0x1000008 0x0207
++					0x1000009 0x0000
++				        0x100000a 0x0000
++					0x100000c 0x0000
++					0x100000d 0x0000
++					0x100000f 0x0000
++				        0x1000010 0x0000
++					0x1000011 0x0007
++					0x1000012 0x0000
++					0x1000013 0x0000
++					0x1000007 0x0001
++				        0x2000032
++				        0x2000032
++				        0x2000032
++				        0x2000032
++					0x1000010 0x1090
++					0x1000011 0x0227
++				        0x2000032
++					0x1000012 0x001f
++				        0x2000032
++				        0x1000013 0x1500
++					0x1000029 0x0027
++					0x100002b 0x000d
++				        0x2000032
++				        0x1000020 0x0000
++					0x1000021 0x0000
++				        0x2000032
++					0x1000030 0x0000
++					0x1000031 0x0707
++					0x1000032 0x0307
++					0x1000035 0x0200
++					0x1000036 0x0008
++					0x1000037 0x0004
++					0x1000038 0x0000
++					0x1000039 0x0707
++					0x100003c 0x0002
++					0x100003d 0x1d04
++					0x1000050 0x0000
++				        0x1000051 0x00ef
++					0x1000052 0x0000
++					0x1000053 0x013f
++					0x1000060 0xa700
++				        0x1000061 0x0001
++					0x100006a 0x0000
++					0x1000080 0x0000
++					0x1000081 0x0000
++				        0x1000082 0x0000
++					0x1000083 0x0000
++					0x1000084 0x0000
++					0x1000085 0x0000
++				        0x1000090 0x0010
++					0x1000092 0x0600
++					0x1000007 0x0133>;
++				debug = <0>;
++			};
++
++			hy28b_ts: hy28b-ts@1 {
++				compatible = "ti,ads7846";
++				reg = <1>;
++
++				spi-max-frequency = <2000000>;
++				interrupts = <17 2>; /* high-to-low edge triggered */
++				interrupt-parent = <&gpio>;
++				pendown-gpio = <&gpio 17 1>;
++				ti,x-plate-ohms = /bits/ 16 <100>;
++				ti,pressure-max = /bits/ 16 <255>;
++			};
++		};
++	};
++	__overrides__ {
++		speed = 	<&hy28b>,"spi-max-frequency:0";
++		rotate = 	<&hy28b>,"rotate:0";
++		fps = 		<&hy28b>,"fps:0";
++		debug = 	<&hy28b>,"debug:0";
++		xohms =		<&hy28b_ts>,"ti,x-plate-ohms;0";
++		resetgpio =	<&hy28b>,"reset-gpios:4",
++				<&hy28b_pins>, "brcm,pins:4";
++		ledgpio =	<&hy28b>,"led-gpios:4",
++				<&hy28b_pins>, "brcm,pins:8";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/hy28b-overlay.dts b/arch/arm/boot/dts/overlays/hy28b-overlay.dts
+new file mode 100644
+index 000000000000..421bde94a4a0
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/hy28b-overlay.dts
+@@ -0,0 +1,148 @@
++/*
++ * Device Tree overlay for HY28b display shield by Texy
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			hy28b_pins: hy28b_pins {
++				brcm,pins = <17 25 18>;
++				brcm,function = <0 1 1>; /* in out out */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			hy28b: hy28b@0{
++				compatible = "ilitek,ili9325";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&hy28b_pins>;
++
++				spi-max-frequency = <48000000>;
++				spi-cpol;
++				spi-cpha;
++				rotate = <270>;
++				bgr;
++				fps = <50>;
++				buswidth = <8>;
++				startbyte = <0x70>;
++				reset-gpios = <&gpio 25 1>;
++				led-gpios = <&gpio 18 1>;
++
++				gamma = "04 1F 4 7 7 0 7 7 6 0\n0F 00 1 7 4 0 0 0 6 7";
++
++				init = <0x10000e7 0x0010
++					0x1000000 0x0001
++					0x1000001 0x0100
++					0x1000002 0x0700
++				        0x1000003 0x1030
++					0x1000004 0x0000
++					0x1000008 0x0207
++					0x1000009 0x0000
++				        0x100000a 0x0000
++					0x100000c 0x0001
++					0x100000d 0x0000
++					0x100000f 0x0000
++				        0x1000010 0x0000
++					0x1000011 0x0007
++					0x1000012 0x0000
++					0x1000013 0x0000
++				        0x2000032
++					0x1000010 0x1590
++					0x1000011 0x0227
++				        0x2000032
++					0x1000012 0x009c
++				        0x2000032
++				        0x1000013 0x1900
++					0x1000029 0x0023
++					0x100002b 0x000e
++				        0x2000032
++				        0x1000020 0x0000
++					0x1000021 0x0000
++				        0x2000032
++					0x1000050 0x0000
++				        0x1000051 0x00ef
++					0x1000052 0x0000
++					0x1000053 0x013f
++					0x1000060 0xa700
++				        0x1000061 0x0001
++					0x100006a 0x0000
++					0x1000080 0x0000
++					0x1000081 0x0000
++				        0x1000082 0x0000
++					0x1000083 0x0000
++					0x1000084 0x0000
++					0x1000085 0x0000
++				        0x1000090 0x0010
++					0x1000092 0x0000
++					0x1000093 0x0003
++					0x1000095 0x0110
++				        0x1000097 0x0000
++					0x1000098 0x0000
++					0x1000007 0x0133
++					0x1000020 0x0000
++				        0x1000021 0x0000
++				        0x2000064>;
++				debug = <0>;
++			};
++
++			hy28b_ts: hy28b-ts@1 {
++				compatible = "ti,ads7846";
++				reg = <1>;
++
++				spi-max-frequency = <2000000>;
++				interrupts = <17 2>; /* high-to-low edge triggered */
++				interrupt-parent = <&gpio>;
++				pendown-gpio = <&gpio 17 1>;
++				ti,x-plate-ohms = /bits/ 16 <100>;
++				ti,pressure-max = /bits/ 16 <255>;
++			};
++		};
++	};
++	__overrides__ {
++		speed = 	<&hy28b>,"spi-max-frequency:0";
++		rotate = 	<&hy28b>,"rotate:0";
++		fps = 		<&hy28b>,"fps:0";
++		debug = 	<&hy28b>,"debug:0";
++		xohms =		<&hy28b_ts>,"ti,x-plate-ohms;0";
++		resetgpio =	<&hy28b>,"reset-gpios:4",
++				<&hy28b_pins>, "brcm,pins:4";
++		ledgpio =	<&hy28b>,"led-gpios:4",
++				<&hy28b_pins>, "brcm,pins:8";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i-sabre-q2m-overlay.dts b/arch/arm/boot/dts/overlays/i-sabre-q2m-overlay.dts
+new file mode 100644
+index 000000000000..6db52955a8f8
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i-sabre-q2m-overlay.dts
+@@ -0,0 +1,39 @@
++// Definitions for I-Sabre Q2M
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&sound>;
++		frag0: __overlay__ {
++			compatible = "audiophonics,i-sabre-q2m";
++			i2s-controller = <&i2s_clk_producer>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			i-sabre-codec@48 {
++				#sound-dai-cells = <0>;
++				compatible = "audiophonics,i-sabre-codec";
++				reg = <0x48>;
++				status = "okay";
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c-bcm2708-overlay.dts b/arch/arm/boot/dts/overlays/i2c-bcm2708-overlay.dts
+new file mode 100644
+index 000000000000..8204b6b3aef8
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c-bcm2708-overlay.dts
+@@ -0,0 +1,13 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_arm>;
++		__overlay__ {
++			compatible = "brcm,bcm2708-i2c";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c-fan-overlay.dts b/arch/arm/boot/dts/overlays/i2c-fan-overlay.dts
+new file mode 100644
+index 000000000000..f2f4a2aa797a
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c-fan-overlay.dts
+@@ -0,0 +1,108 @@
++// Definitions for I2C based sensors using the Industrial IO or HWMON interface.
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/thermal/thermal.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			emc2301: emc2301@2f {
++				compatible = "microchip,emc2301";
++				reg = <0x2f>;
++				status = "okay";
++				#cooling-cells = <0x02>;
++			};
++		};
++	};
++
++	frag100: fragment@100 {
++		target = <&i2c_arm>;
++		i2cbus: __overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@101 {
++		target = <&i2c0if>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	fragment@102 {
++		target = <&i2c0mux>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	fragment@103 {
++		target = <&cpu_thermal>;
++		__overlay__ {
++			polling-delay = <2000>; /* milliseconds */
++		};
++	};
++
++	fragment@104 {
++		target = <&thermal_trips>;
++		__overlay__ {
++			fanmid0: fanmid0 {
++				temperature = <50000>;
++				hysteresis = <2000>;
++				type = "active";
++			};
++			fanmax0: fanmax0 {
++				temperature = <75000>;
++				hysteresis = <2000>;
++				type = "active";
++			};
++		};
++	};
++
++	fragment@105 {
++		target = <&cooling_maps>;
++		__overlay__ {
++			map0: map0 {
++				trip = <&fanmid0>;
++				cooling-device = <&emc2301 2 6>;
++			};
++			map1: map1 {
++				trip = <&fanmax0>;
++				cooling-device = <&emc2301 7 THERMAL_NO_LIMIT>;
++			};
++		};
++	};
++
++	__overrides__ {
++		i2c0 =		<&frag100>,"target:0=",<&i2c0>;
++		i2c_csi_dsi =	<&frag100>,"target:0=",<&i2c_csi_dsi>,
++				<0>,"+101+102";
++		i2c3 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c3";
++		i2c4 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c4";
++		i2c5 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c5";
++		i2c6 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c6";
++		addr =		<&emc2301>,"reg:0";
++		minpwm =	<&emc2301>,"emc2305,pwm-min.0";
++		maxpwm =	<&emc2301>,"emc2305,pwm-max.0";
++		midtemp =	<&fanmid0>,"temperature:0";
++		midtemp_hyst =	<&fanmid0>,"hysteresis:0";
++		maxtemp =	<&fanmax0>,"temperature:0";
++		maxtemp_hyst =	<&fanmax0>,"hysteresis:0";
++
++		emc2301 =	<0>,"+0",
++				<&map0>,"cooling-device:0=",<&emc2301>,
++				<&map1>,"cooling-device:0=",<&emc2301>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c-gpio-overlay.dts b/arch/arm/boot/dts/overlays/i2c-gpio-overlay.dts
+new file mode 100644
+index 000000000000..63231b5d7c0c
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c-gpio-overlay.dts
+@@ -0,0 +1,47 @@
++// Overlay for i2c_gpio bitbanging host bus.
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++
++		__overlay__ {
++			i2c_gpio: i2c@0 {
++				reg = <0xffffffff>;
++				compatible = "i2c-gpio";
++				gpios = <&gpio 23 (GPIO_ACTIVE_HIGH|GPIO_OPEN_DRAIN) /* sda */
++					 &gpio 24 (GPIO_ACTIVE_HIGH|GPIO_OPEN_DRAIN) /* scl */
++					>;
++				i2c-gpio,delay-us = <2>;        /* ~100 kHz */
++				#address-cells = <1>;
++				#size-cells = <0>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target-path = "/aliases";
++		__overlay__ {
++			i2c_gpio = "/i2c@0";
++		};
++	};
++
++	fragment@2 {
++		target-path = "/__symbols__";
++		__overlay__ {
++			i2c_gpio = "/i2c@0";
++		};
++	};
++
++	__overrides__ {
++		i2c_gpio_sda = <&i2c_gpio>,"gpios:4";
++		i2c_gpio_scl = <&i2c_gpio>,"gpios:16";
++		i2c_gpio_delay_us = <&i2c_gpio>,"i2c-gpio,delay-us:0";
++		bus = <&i2c_gpio>, "reg:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c-mux-overlay.dts b/arch/arm/boot/dts/overlays/i2c-mux-overlay.dts
+new file mode 100644
+index 000000000000..0575b276cd26
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c-mux-overlay.dts
+@@ -0,0 +1,183 @@
++// Umbrella I2C Mux overlay
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/mux/mux.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pca9542: mux@70 {
++				compatible = "nxp,pca9542";
++				reg = <0x70>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				i2c@0 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <0>;
++				};
++				i2c@1 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <1>;
++				};
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pca9545: mux@70 {
++				compatible = "nxp,pca9545";
++				reg = <0x70>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				i2c@0 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <0>;
++				};
++				i2c@1 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <1>;
++				};
++				i2c@2 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <2>;
++				};
++				i2c@3 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <3>;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pca9548: mux@70 {
++				compatible = "nxp,pca9548";
++				reg = <0x70>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				i2c@0 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <0>;
++				};
++				i2c@1 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <1>;
++				};
++				i2c@2 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <2>;
++				};
++				i2c@3 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <3>;
++				};
++				i2c@4 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <4>;
++				};
++				i2c@5 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <5>;
++				};
++				i2c@6 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <6>;
++				};
++				i2c@7 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <7>;
++				};
++			};
++		};
++	};
++
++	frag100: fragment@100 {
++		target = <&i2c_arm>;
++		i2cbus: __overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@101 {
++		target = <&i2c0if>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	fragment@102 {
++		target = <&i2c0mux>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		pca9542 = <0>, "+0";
++		pca9545 = <0>, "+1";
++		pca9548 = <0>, "+2";
++
++		addr =  <&pca9542>,"reg:0",
++			<&pca9545>,"reg:0",
++			<&pca9548>,"reg:0";
++
++		base =  <&pca9542>,"base-nr:0",
++			<&pca9545>,"base-nr:0",
++			<&pca9548>,"base-nr:0";
++
++		i2c0 = <&frag100>, "target:0=",<&i2c0>,
++			      <0>,"+101+102";
++		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
++			      <0>,"+101+102";
++		i2c3 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c3";
++		i2c4 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c4";
++		i2c5 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c5";
++		i2c6 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c6";
++		disconnect_on_idle =
++			<&pca9542>,"idle-state:0=", <MUX_IDLE_DISCONNECT>,
++			<&pca9545>,"idle-state:0=", <MUX_IDLE_DISCONNECT>,
++			<&pca9548>,"idle-state:0=", <MUX_IDLE_DISCONNECT>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts b/arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts
+new file mode 100644
+index 000000000000..b8dfbd56d121
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts
+@@ -0,0 +1,61 @@
++// Definitions for NXP PCA9685A I2C PWM controller on ARM I2C bus.
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2cbus>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pca: pca@40 {
++				compatible = "nxp,pca9685-pwm";
++				#pwm-cells = <2>;
++				reg = <0x40>;
++				status = "okay";
++			};
++		};
++	};
++
++
++	frag100: fragment@100 {
++		target = <&i2c_arm>;
++		i2cbus: __overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@101 {
++		target = <&i2c0if>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	fragment@102 {
++		target = <&i2c0mux>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		addr = <&pca>,"reg:0";
++		i2c0 = <&frag100>, "target:0=",<&i2c0>,
++			      <0>,"+101+102";
++		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
++			      <0>,"+101+102";
++		i2c3 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c3";
++		i2c4 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c4";
++		i2c5 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c5";
++		i2c6 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c6";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c-rtc-common.dtsi b/arch/arm/boot/dts/overlays/i2c-rtc-common.dtsi
+new file mode 100644
+index 000000000000..8638123336ba
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c-rtc-common.dtsi
+@@ -0,0 +1,367 @@
++// Definitions for several I2C based Real Time Clocks
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			abx80x: abx80x@69 {
++				compatible = "abracon,abx80x";
++				reg = <0x69>;
++				abracon,tc-diode = "standard";
++				abracon,tc-resistor = <0>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			ds1307: ds1307@68 {
++				compatible = "dallas,ds1307";
++				reg = <0x68>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			ds1339: ds1339@68 {
++				compatible = "dallas,ds1339";
++				trickle-resistor-ohms = <0>;
++				reg = <0x68>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			ds3231: ds3231@68 {
++				compatible = "maxim,ds3231";
++				reg = <0x68>;
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp7940x: mcp7940x@6f {
++				compatible = "microchip,mcp7940x";
++				reg = <0x6f>;
++			};
++		};
++	};
++
++	fragment@5 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp7941x: mcp7941x@6f {
++				compatible = "microchip,mcp7941x";
++				reg = <0x6f>;
++			};
++		};
++	};
++
++	fragment@6 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pcf2127@51 {
++				compatible = "nxp,pcf2127";
++				reg = <0x51>;
++			};
++		};
++	};
++
++	fragment@7 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pcf8523: pcf8523@68 {
++				compatible = "nxp,pcf8523";
++				reg = <0x68>;
++			};
++		};
++	};
++
++	fragment@8 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pcf8563: pcf8563@51 {
++				compatible = "nxp,pcf8563";
++				reg = <0x51>;
++			};
++		};
++	};
++
++	fragment@9 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			m41t62: m41t62@68 {
++				compatible = "st,m41t62";
++				reg = <0x68>;
++			};
++		};
++	};
++
++	fragment@10 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			rv3028: rv3028@52 {
++				compatible = "microcrystal,rv3028";
++				reg = <0x52>;
++			};
++		};
++	};
++
++	fragment@11 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pcf2129@51 {
++				compatible = "nxp,pcf2129";
++				reg = <0x51>;
++			};
++		};
++	};
++
++	fragment@12 {
++		target = <&i2cbus>;
++	       __dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pcf85363@51 {
++				compatible = "nxp,pcf85363";
++				reg = <0x51>;
++			};
++		};
++	};
++
++	fragment@13 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			rv1805: rv1805@69 {
++				compatible = "microcrystal,rv1805";
++				reg = <0x69>;
++				abracon,tc-diode = "standard";
++				abracon,tc-resistor = <0>;
++			};
++		};
++	};
++
++	fragment@14 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sd3078: sd3078@32 {
++				compatible = "whwave,sd3078";
++				reg = <0x32>;
++			};
++		};
++	};
++
++	fragment@15 {
++		target = <&i2cbus>;
++	       __dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pcf85063@51 {
++				compatible = "nxp,pcf85063";
++				reg = <0x51>;
++			};
++		};
++	};
++
++	fragment@16 {
++		target = <&i2cbus>;
++	       __dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pcf85063a@51 {
++				compatible = "nxp,pcf85063a";
++				reg = <0x51>;
++			};
++		};
++	};
++
++	fragment@17 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			ds1340: ds1340@68 {
++				compatible = "dallas,ds1340";
++				trickle-resistor-ohms = <0>;
++				reg = <0x68>;
++			};
++		};
++	};
++
++	fragment@18 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			s35390a: s35390a@30 {
++				compatible = "sii,s35390a";
++				reg = <0x30>;
++			};
++		};
++	};
++
++	fragment@19 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			bq32000: bq32000@68 {
++				compatible = "ti,bq32000";
++				trickle-resistor-ohms = <0>;
++				reg = <0x68>;
++			};
++		};
++	};
++
++	fragment@20 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			rv8803: rv8803@32 {
++				compatible = "microcrystal,rv8803";
++				reg = <0x32>;
++			};
++		};
++	};
++
++	fragment@21 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			rv3032: rv3032@51 {
++				compatible = "microcrystal,rv3032";
++				reg = <0x51>;
++			};
++		};
++	};
++
++	fragment@22 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pcf2131@53 {
++				compatible = "nxp,pcf2131";
++				reg = <0x53>;
++			};
++		};
++	};
++
++	__overrides__ {
++		abx80x = <0>,"+0";
++		ds1307 = <0>,"+1";
++		ds1339 = <0>,"+2";
++		ds1340 = <0>,"+17";
++		ds3231 = <0>,"+3";
++		mcp7940x = <0>,"+4";
++		mcp7941x = <0>,"+5";
++		pcf2127 = <0>,"+6";
++		pcf8523 = <0>,"+7";
++		pcf8563 = <0>,"+8";
++		m41t62 = <0>,"+9";
++		rv3028 = <0>,"+10";
++		pcf2129 = <0>,"+11";
++		pcf85363 = <0>,"+12";
++		rv1805 = <0>,"+13";
++		sd3078 = <0>,"+14";
++		pcf85063 = <0>,"+15";
++		pcf85063a = <0>,"+16";
++		s35390a = <0>,"+18";
++		bq32000 = <0>,"+19";
++		rv8803 = <0>,"+20";
++		rv3032 = <0>,"+21";
++		pcf2131 = <0>,"+22";
++
++		addr = <&abx80x>, "reg:0",
++		       <&ds1307>, "reg:0",
++		       <&ds1339>, "reg:0",
++		       <&ds3231>, "reg:0",
++		       <&mcp7940x>, "reg:0",
++		       <&mcp7941x>, "reg:0",
++		       <&pcf8523>, "reg:0",
++		       <&pcf8563>, "reg:0",
++		       <&m41t62>, "reg:0",
++		       <&rv1805>, "reg:0",
++		       <&s35390a>, "reg:0";
++		trickle-diode-disable = <&bq32000>,"trickle-diode-disable?";
++		trickle-diode-type = <&abx80x>,"abracon,tc-diode",
++				     <&rv1805>,"abracon,tc-diode";
++		trickle-resistor-ohms = <&ds1339>,"trickle-resistor-ohms:0",
++					<&ds1340>,"trickle-resistor-ohms:0",
++					<&abx80x>,"abracon,tc-resistor:0",
++					<&rv3028>,"trickle-resistor-ohms:0",
++					<&rv3032>,"trickle-resistor-ohms:0",
++					<&rv1805>,"abracon,tc-resistor:0",
++					<&bq32000>,"trickle-resistor-ohms:0";
++		trickle-voltage-mv = <&rv3032>,"trickle-voltage-millivolts:0";
++		backup-switchover-mode = <&rv3028>,"backup-switchover-mode:0";
++		wakeup-source = <&ds1339>,"wakeup-source?",
++				<&ds3231>,"wakeup-source?",
++				<&mcp7940x>,"wakeup-source?",
++				<&mcp7941x>,"wakeup-source?",
++				<&m41t62>,"wakeup-source?",
++				<&pcf8563>,"wakeup-source?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts b/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts
+new file mode 100644
+index 000000000000..c83480c1c327
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts
+@@ -0,0 +1,31 @@
++// Definitions for several I2C based Real Time Clocks
++// Available through i2c-gpio
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++#include "i2c-rtc-common.dtsi"
++
++/ {
++	fragment@100 {
++		target-path = "/";
++		__overlay__ {
++			i2cbus: i2c-gpio-rtc@0 {
++				compatible = "i2c-gpio";
++				gpios = <&gpio 23 (GPIO_ACTIVE_HIGH|GPIO_OPEN_DRAIN) /* sda */
++					 &gpio 24 (GPIO_ACTIVE_HIGH|GPIO_OPEN_DRAIN) /* scl */
++					>;
++				i2c-gpio,delay-us = <2>;        /* ~100 kHz */
++				#address-cells = <1>;
++				#size-cells = <0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		i2c_gpio_sda = <&i2cbus>,"gpios:4";
++		i2c_gpio_scl = <&i2cbus>,"gpios:16";
++		i2c_gpio_delay_us = <&i2cbus>,"i2c-gpio,delay-us:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts b/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
+new file mode 100644
+index 000000000000..cd31eac7e333
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
+@@ -0,0 +1,42 @@
++// Definitions for several I2C based Real Time Clocks
++/dts-v1/;
++/plugin/;
++
++#include "i2c-rtc-common.dtsi"
++
++/ {
++	frag100: fragment@100 {
++		target = <&i2c_arm>;
++		i2cbus: __overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@101 {
++		target = <&i2c0if>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	fragment@102 {
++		target = <&i2c0mux>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		i2c0 = <&frag100>, "target:0=",<&i2c0>;
++		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
++			      <0>,"+101+102";
++		i2c3 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c3";
++		i2c4 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c4";
++		i2c5 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c5";
++		i2c6 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c6";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi b/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
+new file mode 100755
+index 000000000000..9a2a7d4054a4
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
+@@ -0,0 +1,696 @@
++// Definitions for I2C based sensors using the Industrial IO or HWMON interface.
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/interrupt-controller/irq.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			bme280: bme280@76 {
++				compatible = "bosch,bme280";
++				reg = <0x76>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			bmp085: bmp085@77 {
++				compatible = "bosch,bmp085";
++				reg = <0x77>;
++				default-oversampling = <3>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			bmp180: bmp180@77 {
++				compatible = "bosch,bmp180";
++				reg = <0x77>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			bmp280: bmp280@76 {
++				compatible = "bosch,bmp280";
++				reg = <0x76>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			htu21: htu21@40 {
++				compatible = "meas,htu21";
++				reg = <0x40>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@5 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			lm75: lm75@4f {
++				compatible = "national,lm75";
++				reg = <0x4f>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@6 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			si7020: si7020@40 {
++				compatible = "silabs,si7020";
++				reg = <0x40>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@7 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			tmp102: tmp102@48 {
++				compatible = "ti,tmp102";
++				reg = <0x48>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@8 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			hdc100x: hdc100x@40 {
++				compatible = "ti,hdc1000";
++				reg = <0x40>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@9 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			tsl4531: tsl4531@29 {
++				compatible = "amstaos,tsl4531";
++				reg = <0x29>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@10 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			veml6070: veml6070@38 {
++				compatible = "vishay,veml6070";
++				reg = <0x38>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@11 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			sht3x: sht3x@44 {
++				compatible = "sensirion,sht3x";
++				reg = <0x44>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@12 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ds1621: ds1621@48 {
++				compatible = "dallas,ds1621";
++				reg = <0x48>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@13 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			max17040: max17040@36 {
++				compatible = "maxim,max17040";
++				reg = <0x36>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@14 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			bme680: bme680@76 {
++				compatible = "bosch,bme680";
++				reg = <0x76>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@15 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			sps30: sps30@69 {
++				compatible = "sensirion,sps30";
++				reg = <0x69>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@16 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			sgp30: sgp30@58 {
++				compatible = "sensirion,sgp30";
++				reg = <0x58>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@17 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ccs811: ccs811@5b {
++				compatible = "ams,ccs811";
++				reg = <0x5b>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@18 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			bh1750: bh1750@23 {
++				compatible = "rohm,bh1750";
++				reg = <0x23>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@19 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			max30102: max30102@57 {
++				compatible = "maxim,max30102";
++				reg = <0x57>;
++				maxim,red-led-current-microamp = <7000>;
++				maxim,ir-led-current-microamp  = <7000>;
++				interrupt-parent = <&gpio>;
++				interrupts = <4 IRQ_TYPE_EDGE_FALLING>;
++				pinctrl-0 = <&int_pins>;
++				pinctrl-names = "default";
++			};
++		};
++	};
++
++	fragment@20 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			aht10: aht10@38 {
++				compatible = "aosong,aht10";
++				reg = <0x38>;
++			};
++		};
++	};
++
++	fragment@21 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			mcp980x: mcp980x@18 {
++				compatible = "maxim,mcp980x";
++				reg = <0x18>;
++			};
++		};
++	};
++
++	fragment@22 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			jc42: jc42@18 {
++				compatible = "jedec,jc-42.4-temp";
++				reg = <0x18>;
++			};
++		};
++	};
++
++	fragment@23 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ms5637: ms5637@76 {
++				compatible = "meas,ms5637";
++				reg = <0x76>;
++			};
++		};
++	};
++
++	fragment@24 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ms5803: ms5803@76 {
++				compatible = "meas,ms5803";
++				reg = <0x76>;
++			};
++		};
++	};
++
++	fragment@25 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ms5805: ms5805@76 {
++				compatible = "meas,ms5805";
++				reg = <0x76>;
++			};
++		};
++	};
++
++	fragment@26 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ms5837: ms5837@76 {
++				compatible = "meas,ms5837";
++				reg = <0x76>;
++			};
++		};
++	};
++
++	fragment@27 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ms8607: ms8607@76 {
++				compatible = "meas,ms8607-temppressure";
++				reg = <0x76>;
++			};
++		};
++	};
++
++	fragment@28 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			clock-frequency = <400000>;
++
++			mpu6050: mpu6050@68 {
++				compatible = "invensense,mpu6050";
++				reg = <0x68>;
++				interrupt-parent = <&gpio>;
++				interrupts = <4 IRQ_TYPE_EDGE_FALLING>;
++				pinctrl-0 = <&int_pins>;
++				pinctrl-names = "default";
++			};
++		};
++	};
++
++	fragment@29 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			clock-frequency = <400000>;
++
++			mpu9250: mpu9250@68 {
++				compatible = "invensense,mpu9250";
++				reg = <0x68>;
++				interrupt-parent = <&gpio>;
++				interrupts = <4 IRQ_TYPE_EDGE_FALLING>;
++				pinctrl-0 = <&int_pins>;
++				pinctrl-names = "default";
++			};
++		};
++	};
++
++	fragment@30 {
++		target = <&bno055>;
++		__dormant__ {
++			reset-gpios = <&gpio 5 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	fragment@31 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			bno055: bno055@29 {
++				compatible = "bosch,bno055";
++				reg = <0x29>;
++			};
++		};
++	};
++
++	fragment@32 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			sht4x: sht4x@44 {
++				compatible = "sensirion,sht4x";
++				reg = <0x44>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@33 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			bmp380: bmp380@76 {
++				compatible = "bosch,bmp380";
++				reg = <0x76>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@34 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			adt7410: adt7410@48 {
++				compatible = "adi,adt7410", "adi,adt7420";
++				reg = <0x48>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@35 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			hts221: hts221@5f {
++				compatible = "st,hts221-humid", "st,hts221";
++				reg = <0x5f>;
++				interrupt-parent = <&gpio>;
++				interrupts = <4 IRQ_TYPE_EDGE_RISING>;
++				pinctrl-0 = <&int_pins>;
++				pinctrl-names = "default";
++			};
++		};
++	};
++
++	fragment@36 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			veml6075: veml6075@10 {
++				compatible = "vishay,veml6075";
++				reg = <0x10>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@37 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			hdc3020: hdc3020@44 {
++				compatible = "ti,hdc3020";
++				reg = <0x44>;
++				interrupt-parent = <&gpio>;
++				interrupts = <4 IRQ_TYPE_EDGE_RISING>;
++				pinctrl-0 = <&int_pins>;
++				pinctrl-names = "default";
++			};
++		};
++	};
++
++	fragment@38 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			as73211: as73211@74 {
++				compatible = "ams,as73211";
++				reg = <0x74>;
++				interrupt-parent = <&gpio>;
++				interrupts = <4 IRQ_TYPE_EDGE_RISING>;
++				pinctrl-0 = <&int_pins>;
++				pinctrl-names = "default";
++			};
++		};
++	};
++
++	fragment@39 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			as7331: as7331@74 {
++				compatible = "ams,as7331";
++				reg = <0x74>;
++				interrupt-parent = <&gpio>;
++				interrupts = <4 IRQ_TYPE_EDGE_RISING>;
++				pinctrl-0 = <&int_pins>;
++				pinctrl-names = "default";
++			};
++		};
++	};
++
++	fragment@99 {
++		target = <&gpio>;
++		__dormant__ {
++			int_pins: int_pins@4 {
++					brcm,pins = <4>;
++					brcm,function = <0>; /* in */
++					brcm,pull = <0>; /* none */
++			};
++		};
++	};
++
++	__overrides__ {
++		bme280 = <0>,"+0";
++		bmp085 = <0>,"+1";
++		bmp180 = <0>,"+2";
++		bmp280 = <0>,"+3";
++		bmp380 = <0>,"+33";
++		htu21 = <0>,"+4";
++		lm75 = <0>,"+5";
++		lm75addr = <&lm75>,"reg:0";
++		si7020 = <0>,"+6";
++		tmp102 = <0>,"+7";
++		hdc100x = <0>,"+8";
++		tsl4531 = <0>,"+9";
++		veml6070 = <0>,"+10";
++		sht3x = <0>,"+11";
++		ds1621 = <0>,"+12";
++		max17040 = <0>,"+13";
++		bme680 = <0>,"+14";
++		sps30 = <0>,"+15";
++		sgp30 = <0>,"+16";
++		ccs811 = <0>, "+17";
++		bh1750 = <0>, "+18";
++		max30102 = <0>,"+19+99";
++		aht10 = <0>,"+20";
++		mcp980x = <0>,"+21";
++		jc42 = <0>,"+22";
++		ms5637 = <0>,"+23";
++		ms5803 = <0>,"+24";
++		ms5805 = <0>,"+25";
++		ms5837 = <0>,"+26";
++		ms8607 = <0>,"+27";
++		mpu6050 = <0>,"+28+99";
++		mpu9250 = <0>,"+29+99";
++		bno055 = <0>,"+31";
++		sht4x = <0>,"+32";
++		adt7410 = <0>,"+34";
++		hts221 = <0>,"+35+99";
++		veml6075 = <0>,"+36";
++		hdc3020 = <0>,"+37+99";
++		as73211 = <0>,"+38+99";
++		as7331 = <0>,"+39+99";
++
++		addr =	<&bme280>,"reg:0", <&bmp280>,"reg:0", <&tmp102>,"reg:0",
++			<&lm75>,"reg:0", <&hdc100x>,"reg:0", <&sht3x>,"reg:0",
++			<&ds1621>,"reg:0", <&bme680>,"reg:0", <&ccs811>,"reg:0",
++			<&bh1750>,"reg:0", <&mcp980x>,"reg:0", <&jc42>,"reg:0",
++			<&ms5637>,"reg:0", <&ms5803>,"reg:0", <&ms5805>,"reg:0",
++			<&ms5837>,"reg:0", <&ms8607>,"reg:0",
++			<&mpu6050>,"reg:0", <&mpu9250>,"reg:0",
++			<&bno055>,"reg:0", <&sht4x>,"reg:0",
++			<&bmp380>,"reg:0", <&adt7410>,"reg:0",
++			<&hdc3020>,"reg:0", <&as73211>,"reg:0",
++			<&as7331>,"reg:0";
++		int_pin = <&int_pins>, "brcm,pins:0",
++			<&int_pins>, "reg:0",
++			<&max30102>, "interrupts:0",
++			<&mpu6050>, "interrupts:0",
++			<&mpu9250>, "interrupts:0",
++			<&hts221>, "interrupts:0",
++			<&hdc3020>, "interrupts:0",
++			<&as73211>, "interrupts:0",
++			<&as7331>, "interrupts:0";
++		no_timeout = <&jc42>, "smbus-timeout-disable?";
++		reset_pin = <&bno055>,"reset-gpios:4", <0>,"+30";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts b/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
+new file mode 100755
+index 000000000000..f8a39659d83e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
+@@ -0,0 +1,42 @@
++// Definitions for I2C based sensors using the Industrial IO or HWMON interface.
++/dts-v1/;
++/plugin/;
++
++#include "i2c-sensor-common.dtsi"
++
++/ {
++	frag100: fragment@100 {
++		target = <&i2c_arm>;
++		i2cbus: __overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@101 {
++		target = <&i2c0if>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	fragment@102 {
++		target = <&i2c0mux>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		i2c0 = <&frag100>, "target:0=",<&i2c0>;
++		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
++			      <0>,"+101+102";
++		i2c3 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c3";
++		i2c4 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c4";
++		i2c5 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c5";
++		i2c6 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c6";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c0-overlay.dts b/arch/arm/boot/dts/overlays/i2c0-overlay.dts
+new file mode 100644
+index 000000000000..46bf1bf2dc5c
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c0-overlay.dts
+@@ -0,0 +1,83 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++			pinctrl-names = "default";
++			pinctrl-0 = <&i2c0_pins>;
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c0_pins>;
++		pins1: __overlay__ {
++			brcm,pins = <0 1>;
++			brcm,function = <4>; /* alt0 */
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0_pins>;
++		pins2: __dormant__ {
++			brcm,pins = <28 29>;
++			brcm,function = <4>; /* alt0 */
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c0_pins>;
++		pins3: __dormant__ {
++			brcm,pins = <44 45>;
++			brcm,function = <5>; /* alt1 */
++		};
++	};
++
++	fragment@4 {
++		target = <&i2c0_pins>;
++		pins4: __dormant__ {
++			brcm,pins = <46 47>;
++			brcm,function = <4>; /* alt0 */
++		};
++	};
++
++	fragment@5 {
++		target = <&i2c0>;
++		__dormant__ {
++			compatible = "brcm,bcm2708-i2c";
++		};
++	};
++
++	fragment@6 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@7 {
++		target-path = "/aliases";
++		__overlay__ {
++			i2c0 = "/soc/i2c@7e205000";
++		};
++	};
++
++	fragment@8 {
++		target-path = "/__symbols__";
++		__overlay__ {
++			i2c0 = "/soc/i2c@7e205000";
++		};
++	};
++
++	__overrides__ {
++		pins_0_1   = <0>,"+1-2-3-4";
++		pins_28_29 = <0>,"-1+2-3-4";
++		pins_44_45 = <0>,"-1-2+3-4";
++		pins_46_47 = <0>,"-1-2-3+4";
++		combine = <0>, "!5";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c0-pi5-overlay.dts b/arch/arm/boot/dts/overlays/i2c0-pi5-overlay.dts
+new file mode 100644
+index 000000000000..152794822552
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c0-pi5-overlay.dts
+@@ -0,0 +1,34 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&i2c0>;
++		frag0: __overlay__ {
++			status = "okay";
++			clock-frequency = <100000>;
++		};
++	};
++
++	fragment@1 {
++		target = <&frag0>;
++		__overlay__ {
++			pinctrl-0 = <&rp1_i2c0_0_1>;
++		};
++	};
++
++	fragment@2 {
++		target = <&frag0>;
++		__dormant__ {
++			pinctrl-0 = <&rp1_i2c0_8_9>;
++		};
++	};
++
++	__overrides__ {
++		pins_0_1 = <0>,"+1-2";
++		pins_8_9 = <0>,"-1+2";
++		baudrate = <&frag0>, "clock-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c1-overlay.dts b/arch/arm/boot/dts/overlays/i2c1-overlay.dts
+new file mode 100644
+index 000000000000..addaed73e665
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c1-overlay.dts
+@@ -0,0 +1,44 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c1>;
++		__overlay__ {
++			status = "okay";
++			pinctrl-names = "default";
++			pinctrl-0 = <&i2c1_pins>;
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1_pins>;
++		pins1: __overlay__ {
++			brcm,pins = <2 3>;
++			brcm,function = <4>; /* alt 0 */
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1_pins>;
++		pins2: __dormant__ {
++			brcm,pins = <44 45>;
++			brcm,function = <6>; /* alt 2 */
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c1>;
++		__dormant__ {
++			compatible = "brcm,bcm2708-i2c";
++		};
++	};
++
++	__overrides__ {
++		pins_2_3   = <0>,"=1!2";
++		pins_44_45 = <0>,"!1=2";
++		combine = <0>, "!3";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c1-pi5-overlay.dts b/arch/arm/boot/dts/overlays/i2c1-pi5-overlay.dts
+new file mode 100644
+index 000000000000..719966ceb59a
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c1-pi5-overlay.dts
+@@ -0,0 +1,34 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&i2c1>;
++		frag0: __overlay__ {
++			status = "okay";
++			clock-frequency = <100000>;
++		};
++	};
++
++	fragment@1 {
++		target = <&frag0>;
++		__overlay__ {
++			pinctrl-0 = <&rp1_i2c1_2_3>;
++		};
++	};
++
++	fragment@2 {
++		target = <&frag0>;
++		__dormant__ {
++			pinctrl-0 = <&rp1_i2c1_10_11>;
++		};
++	};
++
++	__overrides__ {
++		pins_2_3 = <0>,"+1-2";
++		pins_10_11 = <0>,"-1+2";
++		baudrate = <&frag0>, "clock-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c2-pi5-overlay.dts b/arch/arm/boot/dts/overlays/i2c2-pi5-overlay.dts
+new file mode 100644
+index 000000000000..324d344052b8
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c2-pi5-overlay.dts
+@@ -0,0 +1,21 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&i2c2>;
++		frag0: __overlay__ {
++			status = "okay";
++			clock-frequency = <100000>;
++			pinctrl-0 = <&rp1_i2c2_4_5>;
++		};
++	};
++
++	__overrides__ {
++		pins_4_5 = <&frag0>,"pinctrl-0:0=", <&rp1_i2c2_4_5>;
++		pins_12_13 = <&frag0>,"pinctrl-0:0=", <&rp1_i2c2_12_13>;
++		baudrate = <&frag0>, "clock-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c3-overlay.dts b/arch/arm/boot/dts/overlays/i2c3-overlay.dts
+new file mode 100644
+index 000000000000..663d4f060ee8
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c3-overlay.dts
+@@ -0,0 +1,34 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&i2c3>;
++		frag0: __overlay__ {
++			status = "okay";
++			clock-frequency = <100000>;
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c3_pins>;
++		__dormant__ {
++			brcm,pins = <2 3>;
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c3_pins>;
++		__overlay__ {
++			brcm,pins = <4 5>;
++		};
++	};
++
++	__overrides__ {
++		pins_2_3 = <0>,"=1!2";
++		pins_4_5 = <0>,"!1=2";
++		baudrate = <&frag0>, "clock-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c3-pi5-overlay.dts b/arch/arm/boot/dts/overlays/i2c3-pi5-overlay.dts
+new file mode 100644
+index 000000000000..cbd1f9ff650d
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c3-pi5-overlay.dts
+@@ -0,0 +1,22 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&i2c3>;
++		frag0: __overlay__ {
++			status = "okay";
++			clock-frequency = <100000>;
++			pinctrl-0 = <&rp1_i2c3_6_7>;
++		};
++	};
++
++	__overrides__ {
++		pins_6_7 = <&frag0>,"pinctrl-0:0=", <&rp1_i2c3_6_7>;
++		pins_14_15 = <&frag0>,"pinctrl-0:0=", <&rp1_i2c3_14_15>;
++		pins_22_23 = <&frag0>,"pinctrl-0:0=", <&rp1_i2c3_22_23>;
++		baudrate = <&frag0>, "clock-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c4-overlay.dts b/arch/arm/boot/dts/overlays/i2c4-overlay.dts
+new file mode 100644
+index 000000000000..495de00f7aa1
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c4-overlay.dts
+@@ -0,0 +1,34 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&i2c4>;
++		frag0: __overlay__ {
++			status = "okay";
++			clock-frequency = <100000>;
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c4_pins>;
++		__dormant__ {
++			brcm,pins = <6 7>;
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c4_pins>;
++		__overlay__ {
++			brcm,pins = <8 9>;
++		};
++	};
++
++	__overrides__ {
++		pins_6_7 = <0>,"=1!2";
++		pins_8_9 = <0>,"!1=2";
++		baudrate = <&frag0>, "clock-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c5-overlay.dts b/arch/arm/boot/dts/overlays/i2c5-overlay.dts
+new file mode 100644
+index 000000000000..d498ebc72de6
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c5-overlay.dts
+@@ -0,0 +1,34 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&i2c5>;
++		frag0: __overlay__ {
++			status = "okay";
++			clock-frequency = <100000>;
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c5_pins>;
++		__dormant__ {
++			brcm,pins = <10 11>;
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c5_pins>;
++		__overlay__ {
++			brcm,pins = <12 13>;
++		};
++	};
++
++	__overrides__ {
++		pins_10_11 = <0>,"=1!2";
++		pins_12_13 = <0>,"!1=2";
++		baudrate = <&frag0>, "clock-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2c6-overlay.dts b/arch/arm/boot/dts/overlays/i2c6-overlay.dts
+new file mode 100644
+index 000000000000..4d26178a73ca
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c6-overlay.dts
+@@ -0,0 +1,34 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&i2c6>;
++		frag0: __overlay__ {
++			status = "okay";
++			clock-frequency = <100000>;
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c6_pins>;
++		__dormant__ {
++			brcm,pins = <0 1>;
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c6_pins>;
++		__overlay__ {
++			brcm,pins = <22 23>;
++		};
++	};
++
++	__overrides__ {
++		pins_0_1 = <0>,"=1!2";
++		pins_22_23 = <0>,"!1=2";
++		baudrate = <&frag0>, "clock-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2s-dac-overlay.dts b/arch/arm/boot/dts/overlays/i2s-dac-overlay.dts
+new file mode 100644
+index 000000000000..1d8874a18860
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2s-dac-overlay.dts
+@@ -0,0 +1,34 @@
++// Definitions for RPi DAC
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			pcm1794a-codec {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm1794a";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "rpi,rpi-dac";
++			i2s-controller = <&i2s_clk_producer>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2s-gpio28-31-overlay.dts b/arch/arm/boot/dts/overlays/i2s-gpio28-31-overlay.dts
+new file mode 100644
+index 000000000000..cf43094c6ff4
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2s-gpio28-31-overlay.dts
+@@ -0,0 +1,18 @@
++/*
++ * Device tree overlay to move i2s to gpio 28 to 31 on CM
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_pins>;
++		__overlay__ {
++			brcm,pins = <28 29 30 31>;
++			brcm,function = <6>; /* alt2 */
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/i2s-master-dac-overlay.dts b/arch/arm/boot/dts/overlays/i2s-master-dac-overlay.dts
+new file mode 100644
+index 000000000000..8b46067858d7
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2s-master-dac-overlay.dts
+@@ -0,0 +1,50 @@
++// Definitions for a generic I2S DAC that acts as clock master on the bus.
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			codec_bare: codec_bare {
++				compatible = "linux,spdif-dit";
++				#sound-dai-cells = <0>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "simple-audio-card";
++			i2s-controller = <&i2s_clk_consumer>;
++			status = "okay";
++
++			simple-audio-card,name = "i2s-master-dac";
++			simple-audio-card,format = "i2s";
++
++			simple-audio-card,bitclock-master = <&snd_codec>;
++			simple-audio-card,frame-master = <&snd_codec>;
++
++			simple-audio-card,cpu {
++				sound-dai = <&i2s_clk_consumer>;
++				dai-tdm-slot-num = <2>;
++				dai-tdm-slot-width = <32>;
++			};
++
++			snd_codec: simple-audio-card,codec {
++				sound-dai = <&codec_bare>;
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/ilitek251x-overlay.dts b/arch/arm/boot/dts/overlays/ilitek251x-overlay.dts
+new file mode 100644
+index 000000000000..551aba591d26
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ilitek251x-overlay.dts
+@@ -0,0 +1,45 @@
++// Device tree overlay for I2C connected Ilitek multiple touch controller
++/dts-v1/;
++/plugin/;
++
++ / {
++	compatible = "brcm,bcm2835";
++
++ 	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {		
++			ili251x_pins: ili251x_pins {
++				brcm,pins = <4>; // interrupt
++				brcm,function = <0>; // in
++				brcm,pull = <2>; // pull-up //
++			};
++		};
++	};
++
++ 	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++ 			ili251x: ili251x@41 {
++				compatible = "ilitek,ili251x";
++				reg = <0x41>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&ili251x_pins>;
++				interrupt-parent = <&gpio>;
++				interrupts = <4 8>; // high-to-low edge triggered
++				touchscreen-size-x = <16384>;
++				touchscreen-size-y = <9600>;
++			};
++		};
++	};
++
++ 	__overrides__ {
++		interrupt = <&ili251x_pins>,"brcm,pins:0",
++			<&ili251x>,"interrupts:0";
++		sizex = <&ili251x>,"touchscreen-size-x:0";
++		sizey = <&ili251x>,"touchscreen-size-y:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/imx219-overlay.dts b/arch/arm/boot/dts/overlays/imx219-overlay.dts
+new file mode 100644
+index 000000000000..77bdea8e2961
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx219-overlay.dts
+@@ -0,0 +1,95 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX219 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@1 {
++		target = <&cam1_clk>;
++		__overlay__ {
++			status = "okay";
++			clock-frequency = <24000000>;
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	i2c_frag: fragment@100 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			#include "imx219.dtsi"
++
++			vcm: ad5398@c {
++				compatible = "adi,ad5398";
++				reg = <0x0c>;
++				status = "disabled";
++				VANA-supply = <&cam1_reg>;
++			};
++		};
++	};
++
++	csi_frag: fragment@101 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++
++			port {
++				csi_ep: endpoint {
++					remote-endpoint = <&cam_endpoint>;
++					clock-lanes = <0>;
++					data-lanes = <1 2>;
++					clock-noncontinuous;
++				};
++			};
++		};
++	};
++
++	fragment@102 {
++		target = <&csi1>;
++		__dormant__ {
++			compatible = "brcm,bcm2835-unicam-legacy";
++		};
++	};
++
++	__overrides__ {
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
++		media-controller = <0>,"!102";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&cam_node>, "clocks:0=",<&cam0_clk>,
++		       <&cam_node>, "VANA-supply:0=",<&cam0_reg>,
++		       <&vcm>, "VANA-supply:0=", <&cam0_reg>;
++		vcm = <&vcm>, "status=okay",
++		      <&cam_node>,"lens-focus:0=", <&vcm>;
++	};
++};
++
++&cam_node {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
+diff --git a/arch/arm/boot/dts/overlays/imx219.dtsi b/arch/arm/boot/dts/overlays/imx219.dtsi
+new file mode 100644
+index 000000000000..fa870f77ef07
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx219.dtsi
+@@ -0,0 +1,27 @@
++// Fragment that configures an imx219
++
++cam_node: imx219@10 {
++	compatible = "sony,imx219";
++	reg = <0x10>;
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++	clock-names = "xclk";
++
++	VANA-supply = <&cam1_reg>;	/* 2.8v */
++	VDIG-supply = <&cam_dummy_reg>;	/* 1.8v */
++	VDDL-supply = <&cam_dummy_reg>;	/* 1.2v */
++
++	rotation = <180>;
++	orientation = <2>;
++
++	port {
++		cam_endpoint: endpoint {
++			clock-lanes = <0>;
++			data-lanes = <1 2>;
++			clock-noncontinuous;
++			link-frequencies =
++				/bits/ 64 <456000000>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/imx258-overlay.dts b/arch/arm/boot/dts/overlays/imx258-overlay.dts
+new file mode 100644
+index 000000000000..bf06d681d5dc
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx258-overlay.dts
+@@ -0,0 +1,137 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX258 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@1 {
++		target = <&cam1_clk>;
++		cam_clk: __overlay__ {
++			clock-frequency = <24000000>;
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@11 {
++		target = <&cam_endpoint>;
++		__overlay__ {
++			data-lanes = <1 2>;
++			link-frequencies = /bits/ 64 <633600000
++						      320000000>;
++		};
++	};
++
++	fragment@12 {
++		target = <&cam_endpoint>;
++		__dormant__ {
++			data-lanes = <1 2 3 4>;
++			link-frequencies =
++				/bits/ 64 <633600000 320000000>;
++		};
++	};
++
++	fragment@13 {
++		target = <&csi_ep>;
++		__overlay__ {
++			data-lanes = <1 2>;
++		};
++	};
++
++	fragment@14 {
++		target = <&csi_ep>;
++		__dormant__ {
++			data-lanes = <1 2 3 4>;
++		};
++	};
++
++	csi_frag: fragment@101 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++
++			port {
++				csi_ep: endpoint {
++					remote-endpoint = <&cam_endpoint>;
++					clock-lanes = <0>;
++					clock-noncontinuous;
++				};
++			};
++		};
++	};
++
++	reg_frag: fragment@5 {
++		target = <&cam1_reg>;
++		cam_reg: __overlay__ {
++			regulator-name = "imx258_vana";
++			startup-delay-us = <300000>;
++			regulator-min-microvolt = <2700000>;
++			regulator-max-microvolt = <2700000>;
++		};
++	};
++
++	i2c_frag: fragment@100 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			#include "imx258.dtsi"
++
++			vcm: ad5398@c {
++				compatible = "adi,ad5398";
++				reg = <0x0c>;
++				status = "disabled";
++				VANA-supply = <&cam1_reg>;
++			};
++		};
++	};
++
++	fragment@102 {
++		target = <&csi1>;
++		__dormant__ {
++			compatible = "brcm,bcm2835-unicam-legacy";
++		};
++	};
++
++	__overrides__ {
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
++		media-controller = <0>,"!102";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&reg_frag>, "target:0=",<&cam0_reg>,
++		       <&cam_node>, "clocks:0=",<&cam0_clk>,
++		       <&cam_node>, "vana-supply:0=",<&cam0_reg>;
++		vcm = <&vcm>, "status=okay",
++		      <&cam_node>,"lens-focus:0=", <&vcm>;
++		4lane = <0>, "-11+12-13+14";
++	};
++};
++
++&cam_node {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
+diff --git a/arch/arm/boot/dts/overlays/imx258.dtsi b/arch/arm/boot/dts/overlays/imx258.dtsi
+new file mode 100644
+index 000000000000..cca81e1aa8b3
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx258.dtsi
+@@ -0,0 +1,27 @@
++// Fragment that configures a Sony IMX258
++
++cam_node: imx258@10 {
++	compatible = "sony,imx258";
++	reg = <0x10>;
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++	clock-names = "xclk";
++
++	vana-supply = <&cam1_reg>;	/* 2.8v */
++	vdig-supply = <&cam_dummy_reg>;	/* 1.05v */
++	vif-supply = <&cam_dummy_reg>;	/* 1.8v */
++
++	rotation = <180>;
++	orientation = <2>;
++
++	port {
++		cam_endpoint: endpoint {
++			clock-lanes = <0>;
++			clock-noncontinuous;
++			link-frequencies =
++				/bits/ 64 <633600000
++					320000000>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/imx290-overlay.dts b/arch/arm/boot/dts/overlays/imx290-overlay.dts
+new file mode 100644
+index 000000000000..3de3c3910d90
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx290-overlay.dts
+@@ -0,0 +1,32 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX290 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++#include "imx290_327-overlay.dtsi"
++
++/{
++	compatible = "brcm,bcm2835";
++
++	// Fragment numbers deliberately high to avoid conflicts with the
++	// included imx290_327 overlay file.
++
++	fragment@101 {
++		target = <&cam_node>;
++		__overlay__ {
++			compatible = "sony,imx290lqr";
++		};
++	};
++
++	fragment@102 {
++		target = <&cam_node>;
++		__dormant__ {
++			compatible = "sony,imx290llr";
++		};
++	};
++
++	__overrides__ {
++		mono = <0>, "-101+102";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/imx290_327-overlay.dtsi b/arch/arm/boot/dts/overlays/imx290_327-overlay.dtsi
+new file mode 100644
+index 000000000000..b0da92bf4721
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx290_327-overlay.dtsi
+@@ -0,0 +1,118 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Partial definitions for IMX290 or IMX327 camera module on VC I2C bus
++// The compatible string should be set in an overlay that then includes this one
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	i2c_frag: fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			#include "imx290_327.dtsi"
++		};
++	};
++
++	csi_frag: fragment@1 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++
++			port {
++				csi_ep: endpoint {
++					remote-endpoint = <&cam_endpoint>;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@3 {
++		target = <&cam1_clk>;
++		cam_clk: __overlay__ {
++			status = "okay";
++			clock-frequency = <37125000>;
++		};
++	};
++
++	fragment@4 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@6 {
++		target = <&cam_endpoint>;
++		__overlay__ {
++			data-lanes = <1 2>;
++			link-frequencies =
++				/bits/ 64 <445500000 297000000>;
++		};
++	};
++
++	fragment@7 {
++		target = <&cam_endpoint>;
++		__dormant__ {
++			data-lanes = <1 2 3 4>;
++			link-frequencies =
++				/bits/ 64 <222750000 148500000>;
++		};
++	};
++
++	fragment@8 {
++		target = <&csi_ep>;
++		__overlay__ {
++			data-lanes = <1 2>;
++		};
++	};
++
++	fragment@9 {
++		target = <&csi_ep>;
++		__dormant__ {
++			data-lanes = <1 2 3 4>;
++		};
++	};
++
++	fragment@10 {
++		target = <&csi1>;
++		__dormant__ {
++			compatible = "brcm,bcm2835-unicam-legacy";
++		};
++	};
++
++	__overrides__ {
++		4lane = <0>, "-6+7-8+9";
++		clock-frequency = <&cam_clk>,"clock-frequency:0",
++				  <&cam_node>,"clock-frequency:0";
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
++		media-controller = <0>,"!10";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&cam_node>, "clocks:0=",<&cam0_clk>,
++		       <&cam_node>, "vdda-supply:0=",<&cam0_reg>;
++	};
++};
++
++&cam_node {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
+diff --git a/arch/arm/boot/dts/overlays/imx290_327.dtsi b/arch/arm/boot/dts/overlays/imx290_327.dtsi
+new file mode 100644
+index 000000000000..14d1f0b95bb3
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx290_327.dtsi
+@@ -0,0 +1,24 @@
++// Fragment to configure and IMX290 / IMX327 / IMX462 image sensor
++
++cam_node: imx290@1a {
++	compatible = "sony,imx290lqr";
++	reg = <0x1a>;
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++	clock-names = "xclk";
++	clock-frequency = <37125000>;
++
++	rotation = <0>;
++	orientation = <2>;
++
++	vdda-supply = <&cam1_reg>;	/* 2.8v */
++	vdddo-supply = <&cam_dummy_reg>;	/* 1.8v */
++	vddd-supply = <&cam_dummy_reg>;	/* 1.5v */
++
++	port {
++		cam_endpoint: endpoint {
++			clock-lanes = <0>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/imx296-overlay.dts b/arch/arm/boot/dts/overlays/imx296-overlay.dts
+new file mode 100644
+index 000000000000..018beafdfbd7
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx296-overlay.dts
+@@ -0,0 +1,120 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX296 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@1 {
++		target = <&cam1_clk>;
++		clk_over: __overlay__ {
++			status = "okay";
++			clock-frequency = <54000000>;
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	reg_frag: fragment@5 {
++		target = <&cam1_reg>;
++		cam_reg: __overlay__ {
++			startup-delay-us = <500000>;
++		};
++	};
++
++	reg_alwayson_frag: fragment@99 {
++		target = <&cam1_reg>;
++		__dormant__ {
++			regulator-always-on;
++		};
++	};
++
++	i2c_frag: fragment@100 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			imx296: imx296@1a {
++				compatible = "sony,imx296";
++				reg = <0x1a>;
++				status = "okay";
++
++				clocks = <&cam1_clk>;
++				clock-names = "inck";
++
++				avdd-supply = <&cam1_reg>;	/* 3.3v */
++				dvdd-supply = <&cam_dummy_reg>;	/* 1.8v */
++				ovdd-supply = <&cam_dummy_reg>;	/* 1.2v */
++
++				rotation = <180>;
++				orientation = <2>;
++
++				port {
++					imx296_0: endpoint {
++						remote-endpoint = <&csi_ep>;
++						clock-lanes = <0>;
++						data-lanes = <1>;
++						clock-noncontinuous;
++						link-frequencies =
++							/bits/ 64 <594000000>;
++					};
++				};
++			};
++		};
++	};
++
++	csi_frag: fragment@101 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++
++			port {
++				csi_ep: endpoint {
++					remote-endpoint = <&imx296_0>;
++					clock-lanes = <0>;
++					data-lanes = <1>;
++					clock-noncontinuous;
++				};
++			};
++		};
++	};
++
++	fragment@102 {
++		target = <&csi1>;
++		__dormant__ {
++			compatible = "brcm,bcm2835-unicam-legacy";
++		};
++	};
++
++	__overrides__ {
++		rotation = <&imx296>,"rotation:0";
++		orientation = <&imx296>,"orientation:0";
++		media-controller = <0>,"!102";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&reg_frag>, "target:0=",<&cam0_reg>,
++		       <&reg_alwayson_frag>, "target:0=",<&cam0_reg>,
++		       <&imx296>, "clocks:0=",<&cam0_clk>,
++		       <&imx296>, "avdd-supply:0=",<&cam0_reg>;
++		clock-frequency = <&clk_over>, "clock-frequency:0";
++		always-on = <0>, "+99";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/imx327-overlay.dts b/arch/arm/boot/dts/overlays/imx327-overlay.dts
+new file mode 100644
+index 000000000000..0776954bdba2
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx327-overlay.dts
+@@ -0,0 +1,33 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX327 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++#include "imx290_327-overlay.dtsi"
++
++/{
++	compatible = "brcm,bcm2835";
++
++	// Fragment numbers deliberately high to avoid conflicts with the
++	// included imx290_327 overlay file.
++
++	fragment@101 {
++		target = <&cam_node>;
++		__overlay__ {
++			compatible = "sony,imx327lqr";
++		};
++	};
++
++	fragment@102 {
++		target = <&cam_node>;
++		__dormant__ {
++			// No mono IMX327 is currently defined. Use IMX290.
++			compatible = "sony,imx290llr";
++		};
++	};
++
++	__overrides__ {
++		mono = <0>, "-101+102";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/imx378-overlay.dts b/arch/arm/boot/dts/overlays/imx378-overlay.dts
+new file mode 100644
+index 000000000000..4a5072489a34
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx378-overlay.dts
+@@ -0,0 +1,17 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX378 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include "imx477_378-overlay.dtsi"
++
++&cam_node {
++	compatible = "sony,imx378";
++};
++
++/{
++	__overrides__ {
++		sync-sink = <&cam_node>,"trigger-mode:0=2";
++		sync-source = <&cam_node>,"trigger-mode:0=1";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/imx462-overlay.dts b/arch/arm/boot/dts/overlays/imx462-overlay.dts
+new file mode 100644
+index 000000000000..c4d7aabe2efe
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx462-overlay.dts
+@@ -0,0 +1,39 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX462 camera module on VC I2C bus
++
++// IMX462 is the successor to IMX290. The drivers currently don't support
++// any additional feature of IMX462, so use the IMX290 compatible strings
++// for now.
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++#include "imx290_327-overlay.dtsi"
++
++/{
++	compatible = "brcm,bcm2835";
++
++	// Fragment numbers deliberately high to avoid conflicts with the
++	// included imx290_327 overlay file.
++
++	//IMX462 is not defined in the bindings, so use IMX290 for now.
++
++	fragment@101 {
++		target = <&cam_node>;
++		__overlay__ {
++			compatible = "sony,imx290lqr";
++		};
++	};
++
++	fragment@102 {
++		target = <&cam_node>;
++		__dormant__ {
++			compatible = "sony,imx290llr";
++		};
++	};
++
++	__overrides__ {
++		mono = <0>, "-101+102";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/imx477-overlay.dts b/arch/arm/boot/dts/overlays/imx477-overlay.dts
+new file mode 100644
+index 000000000000..8645162682f4
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx477-overlay.dts
+@@ -0,0 +1,17 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX477 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include "imx477_378-overlay.dtsi"
++
++&cam_node {
++	compatible = "sony,imx477";
++};
++
++/{
++	__overrides__ {
++		sync-sink = <&cam_node>,"trigger-mode:0=2";
++		sync-source = <&cam_node>,"trigger-mode:0=1";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/imx477_378-overlay.dtsi b/arch/arm/boot/dts/overlays/imx477_378-overlay.dtsi
+new file mode 100644
+index 000000000000..2152be1b2cd8
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx477_378-overlay.dtsi
+@@ -0,0 +1,98 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX477 camera module on VC I2C bus
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@1 {
++		target = <&cam1_clk>;
++		cam_clk: __overlay__ {
++			clock-frequency = <24000000>;
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	reg_frag: fragment@3 {
++		target = <&cam1_reg>;
++		cam_reg: __overlay__ {
++			startup-delay-us = <300000>;
++		};
++	};
++
++	reg_alwayson_frag: fragment@99 {
++		target = <&cam1_reg>;
++		__dormant__ {
++			regulator-always-on;
++		};
++	};
++
++	i2c_frag: fragment@100 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			#include "imx477_378.dtsi"
++		};
++	};
++
++	csi_frag: fragment@101 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++
++			port {
++				csi_ep: endpoint {
++					remote-endpoint = <&cam_endpoint>;
++					clock-lanes = <0>;
++					data-lanes = <1 2>;
++					clock-noncontinuous;
++				};
++			};
++		};
++	};
++
++	fragment@102 {
++		target = <&csi1>;
++		__dormant__ {
++			compatible = "brcm,bcm2835-unicam-legacy";
++		};
++	};
++
++	__overrides__ {
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
++		media-controller = <0>,"!102";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&reg_frag>, "target:0=",<&cam0_reg>,
++		       <&reg_alwayson_frag>, "target:0=",<&cam0_reg>,
++		       <&cam_node>, "clocks:0=",<&cam0_clk>,
++		       <&cam_node>, "VANA-supply:0=",<&cam0_reg>;
++		always-on = <0>, "+99";
++	};
++};
++
++&cam_node {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
+diff --git a/arch/arm/boot/dts/overlays/imx477_378.dtsi b/arch/arm/boot/dts/overlays/imx477_378.dtsi
+new file mode 100644
+index 000000000000..a0c154c2a11f
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx477_378.dtsi
+@@ -0,0 +1,24 @@
++cam_node: imx477@1a {
++	reg = <0x1a>;
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++	clock-names = "xclk";
++
++	VANA-supply = <&cam1_reg>;	/* 2.8v */
++	VDIG-supply = <&cam_dummy_reg>;	/* 1.05v */
++	VDDL-supply = <&cam_dummy_reg>;	/* 1.8v */
++
++	rotation = <180>;
++	orientation = <2>;
++
++	port {
++		cam_endpoint: endpoint {
++			clock-lanes = <0>;
++			data-lanes = <1 2>;
++			clock-noncontinuous;
++			link-frequencies =
++				/bits/ 64 <450000000>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/imx500-overlay.dts b/arch/arm/boot/dts/overlays/imx500-overlay.dts
+new file mode 100644
+index 000000000000..b8d76feb259a
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx500-overlay.dts
+@@ -0,0 +1,122 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX500 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	reg_frag: fragment@2 {
++		target = <&cam1_reg>;
++		cam_reg: __overlay__ {
++			startup-delay-us = <300000>;
++		};
++	};
++
++	i2c_frag: fragment@100 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			#include "imx500.dtsi"
++			#include "rpi-rp2040-gpio-bridge.dtsi"
++		};
++	};
++
++	csi_frag: fragment@101 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++			brcm,media-controller;
++
++			port {
++				csi_ep: endpoint {
++					remote-endpoint = <&cam_endpoint>;
++					clock-lanes = <0>;
++					data-lanes = <1 2>;
++					clock-noncontinuous;
++				};
++			};
++		};
++	};
++
++	spi_frag: fragment@102 {
++		target = <&spi_bridgedev0>;
++		__overlay__ {
++			compatible = "sony,imx500";
++		};
++	};
++
++	chosen_frag: fragment@103 {
++		target = <&chosen>;
++		__overlay__ {
++			core_freq_fixed;
++		};
++	};
++
++	fragment@104 {
++		target-path = "/clocks";
++		__overlay__ {
++			clk_aicam: clk-aicam1 {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-frequency = <24000000>;
++			};
++
++			clk_aicam_gated: clk-aicam-gated1 {
++				compatible = "gpio-gate-clock";
++				clocks = <&clk_aicam>;
++				#clock-cells = <0>;
++				enable-gpios = <&spi_bridge 21 GPIO_ACTIVE_HIGH>;
++			};
++		};
++	};
++
++	__overrides__ {
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
++		media-controller = <&csi>,"brcm,media-controller?";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++			   <&spi_bridge>, "power-supply:0=",<&cam0_reg>,
++		       <&reg_frag>, "target:0=",<&cam0_reg>,
++		       <&cam_node>, "VANA-supply:0=",<&cam0_reg>,
++		       <&clk_aicam>,"name=clk-aicam0",
++		       <&clk_aicam_gated>,"name=clk-aicam-gated0";
++		bypass-cache = <&spi_bridge>,"bypass-cache?";
++	};
++};
++
++&cam_node {
++	status = "okay";
++	led-gpios = <&spi_bridge 19 GPIO_ACTIVE_HIGH>;
++	reset-gpios = <&spi_bridge 20 GPIO_ACTIVE_HIGH>;
++	clocks = <&clk_aicam_gated>;
++	spi = <&spi_bridgedev0>;
++};
++
++&spi_bridge {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
+diff --git a/arch/arm/boot/dts/overlays/imx500-pi5-overlay.dts b/arch/arm/boot/dts/overlays/imx500-pi5-overlay.dts
+new file mode 100644
+index 000000000000..8ad4f0cd1c7b
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx500-pi5-overlay.dts
+@@ -0,0 +1,127 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX500 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	reg_frag: fragment@2 {
++		target = <&cam1_reg>;
++		cam_reg: __overlay__ {
++			startup-delay-us = <300000>;
++		};
++	};
++
++	i2c_frag: fragment@100 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			#include "imx500.dtsi"
++			#include "rpi-rp2040-gpio-bridge.dtsi"
++		};
++	};
++
++	csi_frag: fragment@101 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++			brcm,media-controller;
++
++			port {
++				csi_ep: endpoint {
++					remote-endpoint = <&cam_endpoint>;
++					clock-lanes = <0>;
++					data-lanes = <1 2>;
++					clock-noncontinuous;
++				};
++			};
++		};
++	};
++
++	spi_frag: fragment@102 {
++		target = <&spi_bridge>;
++		spi_frag_overlay: __overlay__ {
++			fast_xfer_requires_i2c_lock = <1>;
++			fast_xfer_recv_gpio_base = <11>;
++			fast_xfer-gpios = <&rp1_gpio 40 0>, // CD1_SDA (used as data)
++					  <&rp1_gpio 48 0>; // CD1_IO1_MICDAT1 (clock)
++		};
++	};
++
++	spi_bridge_frag: fragment@103 {
++		target = <&spi_bridgedev0>;
++		__overlay__ {
++			compatible = "sony,imx500";
++		};
++	};
++
++	fragment@104 {
++		target-path = "/clocks";
++		__overlay__ {
++			clk_aicam: clk-aicam1 {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-frequency = <24000000>;
++			};
++
++			clk_aicam_gated: clk-aicam-gated1 {
++				compatible = "gpio-gate-clock";
++				clocks = <&clk_aicam>;
++				#clock-cells = <0>;
++				enable-gpios = <&spi_bridge 21 GPIO_ACTIVE_HIGH>;
++			};
++		};
++	};
++
++	__overrides__ {
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
++		media-controller = <&csi>,"brcm,media-controller?";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++			   <&spi_frag_overlay>, "fast_xfer-gpios:4=38", // CD0_SDA (data)
++			   <&spi_frag_overlay>, "fast_xfer-gpios:16=35", // CD0_IO1_MICDAT0 (clock)
++			   <&spi_bridge>, "power-supply:0=",<&cam0_reg>,
++		       <&reg_frag>, "target:0=",<&cam0_reg>,
++		       <&cam_node>, "VANA-supply:0=",<&cam0_reg>,
++		       <&clk_aicam>,"name=clk-aicam0",
++		       <&clk_aicam_gated>,"name=clk-aicam-gated0";
++		bypass-cache = <&spi_bridge>,"bypass-cache?";
++	};
++};
++
++&cam_node {
++	status = "okay";
++	led-gpios = <&spi_bridge 19 GPIO_ACTIVE_HIGH>;
++	reset-gpios = <&spi_bridge 20 GPIO_ACTIVE_HIGH>;
++	clocks = <&clk_aicam_gated>;
++	spi = <&spi_bridgedev0>;
++};
++
++&spi_bridge {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
+diff --git a/arch/arm/boot/dts/overlays/imx500.dtsi b/arch/arm/boot/dts/overlays/imx500.dtsi
+new file mode 100644
+index 000000000000..a931aa9941e6
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx500.dtsi
+@@ -0,0 +1,28 @@
++// SPDX-License-Identifier: GPL-2.0-only
++cam_node: imx500@1a {
++	reg = <0x1a>;
++	compatible = "sony,imx500";
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++	clock-names = "inck";
++
++	vana-supply = <&cam1_reg>;	/* 2.7v */
++	vdig-supply = <&cam_dummy_reg>;	/* 0.84v */
++	vif-supply = <&cam_dummy_reg>;	/* 1.8v */
++
++	reset-gpios = <&gpio 255 GPIO_ACTIVE_HIGH>;
++
++	rotation = <0>;
++	orientation = <2>;
++
++	port {
++		cam_endpoint: endpoint {
++			clock-lanes = <0>;
++			data-lanes = <1 2>;
++			clock-noncontinuous;
++			link-frequencies =
++				/bits/ 64 <444000000>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/imx519-overlay.dts b/arch/arm/boot/dts/overlays/imx519-overlay.dts
+new file mode 100644
+index 000000000000..f1bcd782b99f
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx519-overlay.dts
+@@ -0,0 +1,99 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for imx519 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	i2c_frag: fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			#include "imx519.dtsi"
++		};
++	};
++
++	csi_frag: fragment@1 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++
++			port{
++				csi_ep: endpoint{
++					remote-endpoint = <&cam_endpoint>;
++					clock-lanes = <0>;
++					data-lanes = <1 2>;
++					clock-noncontinuous;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@3 {
++		target = <&cam1_clk>;
++		__overlay__ {
++			clock-frequency = <24000000>;
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@5 {
++		target = <&cam_node>;
++		__overlay__ {
++			lens-focus = <&vcm_node>;
++		};
++	};
++
++	fragment@6 {
++		target = <&csi1>;
++		__dormant__ {
++			compatible = "brcm,bcm2835-unicam-legacy";
++		};
++	};
++
++	__overrides__ {
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
++		media-controller = <0>,"!6";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&cam_node>, "clocks:0=",<&cam0_clk>,
++		       <&cam_node>, "VANA-supply:0=",<&cam0_reg>,
++		       <&vcm_node>, "vdd-supply:0=",<&cam0_reg>;
++		vcm = <&vcm_node>, "status",
++		      <0>, "=5";
++	};
++};
++
++&cam_node {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
++
++&vcm_node {
++	status = "okay";
++};
+diff --git a/arch/arm/boot/dts/overlays/imx519.dtsi b/arch/arm/boot/dts/overlays/imx519.dtsi
+new file mode 100644
+index 000000000000..18cba1781ec4
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx519.dtsi
+@@ -0,0 +1,34 @@
++// Fragment that configures a Sony IMX519
++
++cam_node: imx519@1a {
++	compatible = "sony,imx519";
++	reg = <0x1a>;
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++	clock-names = "xclk";
++
++	VANA-supply = <&cam1_reg>;	/* 2.8v */
++	VDIG-supply = <&cam_dummy_reg>;	/* 1.8v */
++	VDDL-supply = <&cam_dummy_reg>;	/* 1.2v */
++
++	rotation = <0>;
++	orientation = <2>;
++
++	port {
++		cam_endpoint: endpoint {
++			clock-lanes = <0>;
++			data-lanes = <1 2>;
++			clock-noncontinuous;
++			link-frequencies =
++				/bits/ 64 <408000000>;
++		};
++	};
++};
++
++vcm_node: ak7375@c {
++	compatible = "asahi-kasei,ak7375";
++	reg = <0x0c>;
++	status = "disabled";
++	vdd-supply = <&cam1_reg>;
++};
+diff --git a/arch/arm/boot/dts/overlays/imx708-overlay.dts b/arch/arm/boot/dts/overlays/imx708-overlay.dts
+new file mode 100644
+index 000000000000..3cbec474ce3e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx708-overlay.dts
+@@ -0,0 +1,111 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX708 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@1 {
++		target = <&cam1_clk>;
++		__overlay__ {
++			status = "okay";
++			clock-frequency = <24000000>;
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	reg_frag: fragment@3 {
++		target = <&cam1_reg>;
++		cam_reg: __overlay__ {
++			startup-delay-us = <70000>;
++			off-on-delay-us = <30000>;
++			regulator-min-microvolt = <2700000>;
++			regulator-max-microvolt = <2700000>;
++		};
++	};
++
++	fragment@4 {
++		target = <&cam_node>;
++		__overlay__ {
++			lens-focus = <&vcm_node>;
++		};
++	};
++
++	i2c_frag: fragment@100 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			#include "imx708.dtsi"
++		};
++	};
++
++	csi_frag: fragment@101 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++
++			port {
++				csi_ep: endpoint {
++					remote-endpoint = <&cam_endpoint>;
++					clock-lanes = <0>;
++					data-lanes = <1 2>;
++					clock-noncontinuous;
++				};
++			};
++		};
++	};
++
++	fragment@102 {
++		target = <&csi1>;
++		__dormant__ {
++			compatible = "brcm,bcm2835-unicam-legacy";
++		};
++	};
++
++	__overrides__ {
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
++		media-controller = <0>,"!102";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&reg_frag>, "target:0=",<&cam0_reg>,
++		       <&cam_node>, "clocks:0=",<&cam0_clk>,
++		       <&cam_node>, "vana1-supply:0=",<&cam0_reg>,
++		       <&vcm_node>, "VDD-supply:0=",<&cam0_reg>;
++		vcm = <&vcm_node>, "status",
++		      <0>, "=4";
++		link-frequency = <&cam_endpoint>,"link-frequencies#0";
++	};
++};
++
++&cam_node {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
++
++&vcm_node {
++	status = "okay";
++};
+diff --git a/arch/arm/boot/dts/overlays/imx708.dtsi b/arch/arm/boot/dts/overlays/imx708.dtsi
+new file mode 100644
+index 000000000000..1558458d58ec
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx708.dtsi
+@@ -0,0 +1,35 @@
++// Fragment that configures a Sony IMX708
++
++cam_node: imx708@1a {
++	compatible = "sony,imx708";
++	reg = <0x1a>;
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++	clock-names = "inclk";
++
++	vana1-supply = <&cam1_reg>;	/* 2.8v */
++	vana2-supply = <&cam_dummy_reg>;/* 1.8v */
++	vdig-supply = <&cam_dummy_reg>;	/* 1.1v */
++	vddl-supply = <&cam_dummy_reg>;	/* 1.8v */
++
++	rotation = <180>;
++	orientation = <2>;
++
++	port {
++		cam_endpoint: endpoint {
++			clock-lanes = <0>;
++			data-lanes = <1 2>;
++			clock-noncontinuous;
++			link-frequencies =
++				/bits/ 64 <450000000>;
++		};
++	};
++};
++
++vcm_node: dw9817@c {
++	compatible = "dongwoon,dw9817-vcm";
++	reg = <0x0c>;
++	status = "disabled";
++	VDD-supply = <&cam1_reg>;
++};
+diff --git a/arch/arm/boot/dts/overlays/interludeaudio-analog-overlay.dts b/arch/arm/boot/dts/overlays/interludeaudio-analog-overlay.dts
+new file mode 100644
+index 000000000000..e2590135f919
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/interludeaudio-analog-overlay.dts
+@@ -0,0 +1,73 @@
++// Definitions for Interlude audio analog hat
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "simple-audio-card";
++			i2s-controller = <&i2s_clk_consumer>;
++			status = "okay";
++
++			simple-audio-card,name = "snd_IA_Analog_Hat";
++
++			simple-audio-card,widgets =
++				"Line", "Line In",
++				"Line", "Line Out";
++
++			simple-audio-card,routing =
++				"Line Out","AOUTA+",
++				"Line Out","AOUTA-",
++				"Line Out","AOUTB+",
++				"Line Out","AOUTB-",
++				"AINA","Line In",
++				"AINB","Line In";
++
++			simple-audio-card,format = "i2s";
++
++			simple-audio-card,bitclock-master = <&sound_master>;
++			simple-audio-card,frame-master = <&sound_master>;
++
++			simple-audio-card,cpu {
++				sound-dai = <&i2s>;
++				dai-tdm-slot-num = <2>;
++				dai-tdm-slot-width = <32>;
++			};
++
++			sound_master: simple-audio-card,codec {
++				sound-dai = <&cs4271>;
++				system-clock-frequency = <24576000>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			cs4271: cs4271@10 {
++				#sound-dai-cells = <0>;
++				compatible = "cirrus,cs4271";
++				reg = <0x10>;
++				status = "okay";
++				reset-gpio = <&gpio 24 0>; /* Pin 26, active high */
++			};
++		};
++	};
++	__overrides__ {
++		gpiopin = <&cs4271>,"reset-gpio:4";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/interludeaudio-digital-overlay.dts b/arch/arm/boot/dts/overlays/interludeaudio-digital-overlay.dts
+new file mode 100644
+index 000000000000..24be00860310
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/interludeaudio-digital-overlay.dts
+@@ -0,0 +1,49 @@
++// Definitions for Interlude Audio Digital Hat
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			wm8804@3b {
++				#sound-dai-cells = <0>;
++				compatible = "wlf,wm8804";
++				reg = <0x3b>;
++				PVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "interludeaudio,interludeaudio-digital";
++			i2s-controller = <&i2s_clk_consumer>;
++			status = "okay";
++			clock44-gpio = <&gpio 22 0>;
++			clock48-gpio = <&gpio 27 0>;
++			led1-gpio = <&gpio 13 0>;
++			led2-gpio = <&gpio 12 0>;
++			led3-gpio = <&gpio 6 0>;
++			reset-gpio = <&gpio 23 0>;
++		};
++	};
++
++};
+diff --git a/arch/arm/boot/dts/overlays/iqaudio-codec-overlay.dts b/arch/arm/boot/dts/overlays/iqaudio-codec-overlay.dts
+new file mode 100644
+index 000000000000..bffff5a4d64c
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/iqaudio-codec-overlay.dts
+@@ -0,0 +1,42 @@
++// Definitions for IQaudIO CODEC
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			da2713@1a {
++				#sound-dai-cells = <0>;
++				compatible = "dlg,da7213";
++				reg = <0x1a>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		iqaudio_dac: __overlay__ {
++			compatible = "iqaudio,iqaudio-codec";
++			i2s-controller = <&i2s_clk_consumer>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/iqaudio-dac-overlay.dts b/arch/arm/boot/dts/overlays/iqaudio-dac-overlay.dts
+new file mode 100644
+index 000000000000..05d348f5e58a
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/iqaudio-dac-overlay.dts
+@@ -0,0 +1,46 @@
++// Definitions for IQaudIO DAC
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm5122@4c {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4c>;
++				AVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				CPVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		frag2: __overlay__ {
++			compatible = "iqaudio,iqaudio-dac";
++			i2s-controller = <&i2s_clk_producer>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain = <&frag2>,"iqaudio,24db_digital_gain?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/iqaudio-dacplus-overlay.dts b/arch/arm/boot/dts/overlays/iqaudio-dacplus-overlay.dts
+new file mode 100644
+index 000000000000..3993580f7ac1
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/iqaudio-dacplus-overlay.dts
+@@ -0,0 +1,49 @@
++// Definitions for IQaudIO DAC+
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm5122@4c {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4c>;
++				AVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				CPVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		iqaudio_dac: __overlay__ {
++			compatible = "iqaudio,iqaudio-dac";
++			i2s-controller = <&i2s_clk_producer>;
++			mute-gpios = <&gpio 22 0>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain = <&iqaudio_dac>,"iqaudio,24db_digital_gain?";
++		auto_mute_amp = <&iqaudio_dac>,"iqaudio-dac,auto-mute-amp?";
++		unmute_amp = <&iqaudio_dac>,"iqaudio-dac,unmute-amp?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/iqaudio-digi-wm8804-audio-overlay.dts b/arch/arm/boot/dts/overlays/iqaudio-digi-wm8804-audio-overlay.dts
+new file mode 100644
+index 000000000000..f24faf11ecfa
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/iqaudio-digi-wm8804-audio-overlay.dts
+@@ -0,0 +1,47 @@
++// Definitions for IQAudIO Digi WM8804 audio board
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			wm8804@3b {
++				#sound-dai-cells = <0>;
++				compatible = "wlf,wm8804";
++				reg = <0x3b>;
++				status = "okay";
++				DVDD-supply = <&vdd_3v3_reg>;
++				PVDD-supply = <&vdd_3v3_reg>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		wm8804_digi: __overlay__ {
++			compatible = "iqaudio,wm8804-digi";
++			i2s-controller = <&i2s_clk_consumer>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		card_name = <&wm8804_digi>,"wm8804-digi,card-name";
++		dai_name = <&wm8804_digi>,"wm8804-digi,dai-name";
++		dai_stream_name = <&wm8804_digi>,"wm8804-digi,dai-stream-name";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/iqs550-overlay.dts b/arch/arm/boot/dts/overlays/iqs550-overlay.dts
+new file mode 100644
+index 000000000000..c3956937055f
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/iqs550-overlay.dts
+@@ -0,0 +1,59 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++// Definitions for Azoteq IQS550 trackpad/touchscreen controller
++/dts-v1/;
++/plugin/;
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/interrupt-controller/irq.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			iqs550: iqs550@74 {
++				compatible = "azoteq,iqs550";
++				reg = <0x74>;
++				interrupt-parent = <&gpio>;
++				interrupts = <4 IRQ_TYPE_LEVEL_HIGH>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&iqs550_pins>;
++				touchscreen-size-x = <800>;
++				touchscreen-size-y = <480>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&iqs550>;
++		iqs550_reset: __dormant__ {
++			reset-gpios = <&gpio 255 (GPIO_ACTIVE_LOW |
++						  GPIO_PUSH_PULL)>;
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			iqs550_pins: iqs550_pins {
++				brcm,pins = <4>;
++				brcm,pull = <1>;
++			};
++		};
++	};
++
++	__overrides__ {
++		interrupt = <&iqs550>,"interrupts:0",
++			    <&iqs550_pins>,"brcm,pins:0";
++		reset = <0>,"+1", <&iqs550_reset>,"reset-gpios:4";
++		sizex = <&iqs550>,"touchscreen-size-x:0";
++		sizey = <&iqs550>,"touchscreen-size-y:0";
++		invx = <&iqs550>,"touchscreen-inverted-x?";
++		invy = <&iqs550>,"touchscreen-inverted-y?";
++		swapxy = <&iqs550>,"touchscreen-swapped-x-y?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/irs1125-overlay.dts b/arch/arm/boot/dts/overlays/irs1125-overlay.dts
+new file mode 100644
+index 000000000000..07996247a7be
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/irs1125-overlay.dts
+@@ -0,0 +1,97 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IRS1125 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	i2c_frag: fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			irs1125: irs1125@3d {
++				compatible = "infineon,irs1125";
++				reg = <0x3d>;
++				status = "okay";
++
++				pwdn-gpios = <&gpio 5 0>;
++				clocks = <&cam1_clk>;
++
++				port {
++					irs1125_0: endpoint {
++						remote-endpoint = <&csi1_ep>;
++						clock-lanes = <0>;
++						data-lanes = <1 2>;
++						clock-noncontinuous;
++						link-frequencies =
++							/bits/ 64 <297000000>;
++					};
++				};
++			};
++		};
++	};
++
++	csi_frag: fragment@1 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++
++			port {
++				csi1_ep: endpoint {
++					remote-endpoint = <&irs1125_0>;
++					data-lanes = <1 2>;
++					clock-noncontinuous;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target-path="/__overrides__";
++		__overlay__ {
++			cam0-pwdn-ctrl = <&irs1125>,"pwdn-gpios:0";
++			cam0-pwdn      = <&irs1125>,"pwdn-gpios:4";
++		};
++	};
++
++	clk_frag: fragment@5 {
++		target = <&cam1_clk>;
++		__overlay__ {
++			status = "okay";
++			clock-frequency = <26000000>;
++		};
++	};
++
++	fragment@6 {
++		target = <&csi1>;
++		__overlay__ {
++			compatible = "brcm,bcm2835-unicam-legacy";
++		};
++	};
++
++	__overrides__ {
++		media-controller = <0>,"!6";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&irs1125>, "clocks:0=",<&cam0_clk>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/jedec-spi-nor-overlay.dts b/arch/arm/boot/dts/overlays/jedec-spi-nor-overlay.dts
+new file mode 100644
+index 000000000000..fb6d4bc91bf3
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/jedec-spi-nor-overlay.dts
+@@ -0,0 +1,136 @@
++// Overlay for JEDEC SPI-NOR Flash Devices (aka m25p80)
++
++// dtparams:
++//     flash-spi<n>-<m>        - Enables flash device on SPI<n>, CS#<m>.
++//     flash-fastr-spi<n>-<m>  - Enables flash device with fast read capability on SPI<n>, CS#<m>.
++//     speed                   - Set the SPI clock speed in Hz
++//
++// If devices are present on SPI1 or SPI2, those interfaces must be enabled with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
++//
++// Example: A single flash device with fast read capability on SPI0, CS#0:
++// dtoverlay=jedec-spi-nor:flash-fastr-spi0-0
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	// disable spi-dev on spi0.0
++	fragment@0 {
++		target = <&spidev0>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi0.1
++	fragment@1 {
++		target = <&spidev1>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi1.0
++	fragment@2 {
++		target-path = "spi1/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi1.1
++	fragment@3 {
++		target-path = "spi1/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi1.2
++	fragment@4 {
++		target-path = "spi1/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi2.0
++	fragment@5 {
++		target-path = "spi2/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi2.1
++	fragment@6 {
++		target-path = "spi2/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi2.2
++	fragment@7 {
++		target-path = "spi2/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// Enable fast read for device
++	// Use default active low interrupt signalling.
++	fragment@8 {
++		target = <&spi_nor>;
++		__dormant__ {
++			m25p,fast-read;
++		};
++	};
++
++	payload: fragment@100 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			spi_nor: spi_nor@0 {
++				compatible = "jedec,spi-nor";
++				reg = <0>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	__overrides__ {
++		spi0-0             = <0>,"+0", <&payload>,"target:0=",<&spi0>, <&spi_nor>,"reg:0=0";
++		spi0-1             = <0>,"+1", <&payload>,"target:0=",<&spi0>, <&spi_nor>,"reg:0=1";
++		spi1-0             = <0>,"+2", <&payload>,"target:0=",<&spi1>, <&spi_nor>,"reg:0=0";
++		spi1-1             = <0>,"+3", <&payload>,"target:0=",<&spi1>, <&spi_nor>,"reg:0=1";
++		spi1-2             = <0>,"+4", <&payload>,"target:0=",<&spi1>, <&spi_nor>,"reg:0=2";
++		spi2-0             = <0>,"+5", <&payload>,"target:0=",<&spi2>, <&spi_nor>,"reg:0=0";
++		spi2-1             = <0>,"+6", <&payload>,"target:0=",<&spi2>, <&spi_nor>,"reg:0=1";
++		spi2-2             = <0>,"+7", <&payload>,"target:0=",<&spi2>, <&spi_nor>,"reg:0=2";
++		flash-spi0-0       = <0>,"+0", <&payload>,"target:0=",<&spi0>, <&spi_nor>,"reg:0=0";
++		flash-spi0-1       = <0>,"+1", <&payload>,"target:0=",<&spi0>, <&spi_nor>,"reg:0=1";
++		flash-spi1-0       = <0>,"+2", <&payload>,"target:0=",<&spi1>, <&spi_nor>,"reg:0=0";
++		flash-spi1-1       = <0>,"+3", <&payload>,"target:0=",<&spi1>, <&spi_nor>,"reg:0=1";
++		flash-spi1-2       = <0>,"+4", <&payload>,"target:0=",<&spi1>, <&spi_nor>,"reg:0=2";
++		flash-spi2-0       = <0>,"+5", <&payload>,"target:0=",<&spi2>, <&spi_nor>,"reg:0=0";
++		flash-spi2-1       = <0>,"+6", <&payload>,"target:0=",<&spi2>, <&spi_nor>,"reg:0=1";
++		flash-spi2-2       = <0>,"+7", <&payload>,"target:0=",<&spi2>, <&spi_nor>,"reg:0=2";
++		flash-fastr-spi0-0 = <0>,"+0+8", <&payload>,"target:0=",<&spi0>, <&spi_nor>,"reg:0=0";
++		flash-fastr-spi0-1 = <0>,"+1+8", <&payload>,"target:0=",<&spi0>, <&spi_nor>,"reg:0=1";
++		flash-fastr-spi1-0 = <0>,"+2+8", <&payload>,"target:0=",<&spi1>, <&spi_nor>,"reg:0=0";
++		flash-fastr-spi1-1 = <0>,"+3+8", <&payload>,"target:0=",<&spi1>, <&spi_nor>,"reg:0=1";
++		flash-fastr-spi1-2 = <0>,"+4+8", <&payload>,"target:0=",<&spi1>, <&spi_nor>,"reg:0=2";
++		flash-fastr-spi2-0 = <0>,"+5+8", <&payload>,"target:0=",<&spi2>, <&spi_nor>,"reg:0=0";
++		flash-fastr-spi2-1 = <0>,"+6+8", <&payload>,"target:0=",<&spi2>, <&spi_nor>,"reg:0=1";
++		flash-fastr-spi2-2 = <0>,"+7+8", <&payload>,"target:0=",<&spi2>, <&spi_nor>,"reg:0=2";
++		fastr              = <0>,"+8";
++		speed              = <&spi_nor>, "spi-max-frequency:0";
++	};
++};
++
+diff --git a/arch/arm/boot/dts/overlays/justboom-both-overlay.dts b/arch/arm/boot/dts/overlays/justboom-both-overlay.dts
+new file mode 100644
+index 000000000000..9185d668d1d5
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/justboom-both-overlay.dts
+@@ -0,0 +1,65 @@
++// SPDX-License-Identifier: GPL-2.0
++// Definitions for JustBoom Both (Digi+DAC)
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			wm8804@3b {
++				#sound-dai-cells = <0>;
++				compatible = "wlf,wm8804";
++				reg = <0x3b>;
++				PVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm5122@4d {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4d>;
++				AVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				CPVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		frag3: __overlay__ {
++			compatible = "justboom,justboom-both";
++			i2s-controller = <&i2s_clk_consumer>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain = <&frag3>,"justboom,24db_digital_gain?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/justboom-dac-overlay.dts b/arch/arm/boot/dts/overlays/justboom-dac-overlay.dts
+new file mode 100644
+index 000000000000..901a6aaba4bc
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/justboom-dac-overlay.dts
+@@ -0,0 +1,46 @@
++// Definitions for JustBoom DAC
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pcm5122@4d {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5122";
++				reg = <0x4d>;
++				AVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				CPVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		frag2: __overlay__ {
++			compatible = "justboom,justboom-dac";
++			i2s-controller = <&i2s_clk_producer>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		24db_digital_gain = <&frag2>,"justboom,24db_digital_gain?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/justboom-digi-overlay.dts b/arch/arm/boot/dts/overlays/justboom-digi-overlay.dts
+new file mode 100644
+index 000000000000..c4c968200a4c
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/justboom-digi-overlay.dts
+@@ -0,0 +1,41 @@
++// Definitions for JustBoom Digi
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			wm8804@3b {
++				#sound-dai-cells = <0>;
++				compatible = "wlf,wm8804";
++				reg = <0x3b>;
++				PVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "justboom,justboom-digi";
++			i2s-controller = <&i2s_clk_consumer>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/ltc294x-overlay.dts b/arch/arm/boot/dts/overlays/ltc294x-overlay.dts
+new file mode 100644
+index 000000000000..6d971f3649ca
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ltc294x-overlay.dts
+@@ -0,0 +1,86 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_arm>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ltc2941: ltc2941@64 {
++				compatible = "lltc,ltc2941";
++				reg = <0x64>;
++				lltc,resistor-sense = <50>;
++				lltc,prescaler-exponent = <7>; 
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c_arm>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ltc2942: ltc2942@64 {
++				compatible = "lltc,ltc2942";
++				reg = <0x64>;
++				lltc,resistor-sense = <50>;
++				lltc,prescaler-exponent = <7>; 
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c_arm>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ltc2943: ltc2943@64 {
++				compatible = "lltc,ltc2943";
++				reg = <0x64>;
++				lltc,resistor-sense = <50>;
++				lltc,prescaler-exponent = <7>; 
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c_arm>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ltc2944: ltc2944@64 {
++				compatible = "lltc,ltc2944";
++				reg = <0x64>;
++				lltc,resistor-sense = <50>;
++				lltc,prescaler-exponent = <7>; 
++			};
++		};
++	};
++
++	__overrides__ {
++		ltc2941 = <0>,"+0";
++		ltc2942 = <0>,"+1";
++		ltc2943 = <0>,"+2";
++		ltc2944 = <0>,"+3";
++		resistor-sense = <&ltc2941>, "lltc,resistor-sense:0",
++			         <&ltc2942>, "lltc,resistor-sense:0",
++				 <&ltc2943>, "lltc,resistor-sense:0",
++				 <&ltc2944>, "lltc,resistor-sense:0";
++		prescaler-exponent = <&ltc2941>, "lltc,prescaler-exponent:0",
++			         <&ltc2942>, "lltc,prescaler-exponent:0",
++				 <&ltc2943>, "lltc,prescaler-exponent:0",
++				 <&ltc2944>, "lltc,prescaler-exponent:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/max98357a-overlay.dts b/arch/arm/boot/dts/overlays/max98357a-overlay.dts
+new file mode 100644
+index 000000000000..263d071fe977
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/max98357a-overlay.dts
+@@ -0,0 +1,84 @@
++// Overlay for Maxim MAX98357A audio DAC
++
++// dtparams:
++//     no-sdmode  - SD_MODE pin not managed by driver.
++//     sdmode-pin - Specify GPIO pin to which SD_MODE is connected (default 4).
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	/* Enable I2S */
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	/* DAC whose SD_MODE pin is managed by driver (via GPIO pin) */
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			max98357a_dac: max98357a {
++				compatible = "maxim,max98357a";
++				#sound-dai-cells = <0>;
++				sdmode-gpios = <&gpio 4 0>;   /* 2nd word overwritten by sdmode-pin parameter */
++				status = "okay";
++			};
++		};
++	};
++
++	/* DAC whose SD_MODE pin is not managed by driver */
++	fragment@2 {
++		target-path = "/";
++		__dormant__ {
++			max98357a_nsd: max98357a {
++				compatible = "maxim,max98357a";
++				#sound-dai-cells = <0>;
++				status = "okay";
++			};
++		};
++	};
++
++	/* Soundcard connecting I2S to DAC with SD_MODE */
++	fragment@3 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "simple-audio-card";
++			simple-audio-card,format = "i2s";
++			simple-audio-card,name = "MAX98357A";
++			status = "okay";
++			simple-audio-card,cpu {
++				sound-dai = <&i2s_clk_producer>;
++			};
++			simple-audio-card,codec {
++				sound-dai = <&max98357a_dac>;
++			};
++		};
++	};
++
++	/* Soundcard connecting I2S to DAC without SD_MODE */
++	fragment@4 {
++		target = <&sound>;
++		__dormant__ {
++			compatible = "simple-audio-card";
++			simple-audio-card,format = "i2s";
++			simple-audio-card,name = "MAX98357A";
++			status = "okay";
++			simple-audio-card,cpu {
++				sound-dai = <&i2s_clk_producer>;
++			};
++			simple-audio-card,codec {
++				sound-dai = <&max98357a_nsd>;
++			};
++		};
++	};
++
++	__overrides__ {
++		no-sdmode  = <0>,"-1+2-3+4";
++		sdmode-pin = <&max98357a_dac>,"sdmode-gpios:4";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/maxtherm-overlay.dts b/arch/arm/boot/dts/overlays/maxtherm-overlay.dts
+new file mode 100644
+index 000000000000..9964e246c14f
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/maxtherm-overlay.dts
+@@ -0,0 +1,186 @@
++/*
++ * Universal device tree overlay for SPI devices
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/iio/temperature/thermocouple.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev1>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target-path = "spi1/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target-path = "spi1/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@4 {
++		target-path = "spi1/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@5 {
++		target-path = "spi2/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@6 {
++		target-path = "spi2/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@7 {
++		target-path = "spi2/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	maxfrag: fragment@8 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			max: maxtherm@0 {
++				compatible = "maxim,max6675";
++				reg = <0>;
++				spi-max-frequency = <500000>;
++			};
++		};
++	};
++
++	fragment@9 {
++		target = <&max>;
++		__dormant__ {
++			compatible = "maxim,max31855e", "maxim,max31855";
++		};
++	};
++
++	fragment@10 {
++		target = <&max>;
++		__dormant__ {
++			compatible = "maxim,max31855j", "maxim,max31855";
++		};
++	};
++
++	fragment@11 {
++		target = <&max>;
++		__dormant__ {
++			compatible = "maxim,max31855k", "maxim,max31855";
++		};
++	};
++
++	fragment@12 {
++		target = <&max>;
++		__dormant__ {
++			compatible = "maxim,max31855n", "maxim,max31855";
++		};
++	};
++
++	fragment@13 {
++		target = <&max>;
++		__dormant__ {
++			compatible = "maxim,max31855r", "maxim,max31855";
++		};
++	};
++
++	fragment@14 {
++		target = <&max>;
++		__dormant__ {
++			compatible = "maxim,max31855s", "maxim,max31855";
++		};
++	};
++
++	fragment@15 {
++		target = <&max>;
++		__dormant__ {
++			compatible = "maxim,max31855t", "maxim,max31855";
++		};
++	};
++
++	fragment@16 {
++		target = <&max>;
++		__dormant__ {
++			compatible = "maxim,max31856";
++			spi-cpha;
++			thermocouple-type = <THERMOCOUPLE_TYPE_K>;
++		};
++	};
++
++	__overrides__ {
++		spi0-0 = <0>, "+0",
++			 <&maxfrag>,"target:0=",<&spi0>,
++			 <&max>,"reg:0=0";
++		spi0-1 = <0>, "+1",
++			 <&maxfrag>,"target:0=",<&spi0>,
++			 <&max>,"reg:0=1";
++		spi1-0 = <0>, "+2",
++			 <&maxfrag>,"target:0=",<&spi1>,
++			 <&max>,"reg:0=0";
++		spi1-1 = <0>, "+3",
++			 <&maxfrag>,"target:0=",<&spi1>,
++			 <&max>,"reg:0=1";
++		spi1-2 = <0>, "+4",
++			 <&maxfrag>,"target:0=",<&spi1>,
++			 <&max>,"reg:0=2";
++		spi2-0 = <0>, "+5",
++			 <&maxfrag>,"target:0=",<&spi2>,
++			 <&max>,"reg:0=0";
++		spi2-1 = <0>, "+6",
++			 <&maxfrag>,"target:0=",<&spi2>,
++			 <&max>,"reg:0=1";
++		spi2-2 = <0>, "+7",
++			 <&maxfrag>,"target:0=",<&spi2>,
++			 <&max>,"reg:0=2";
++		max6675 = <&max>,"compatible=maxim,max6675";
++		max31855 = <&max>,"compatible=maxim,max31855";
++		max31855e = <0>,"+9";
++		max31855j = <0>,"+10";
++		max31855k = <0>,"+11";
++		max31855n = <0>,"+12";
++		max31855r = <0>,"+13";
++		max31855s = <0>,"+14";
++		max31855t = <0>,"+15";
++		max31856  = <0>,"+16";
++		type_b    = <&max>,"thermocouple-type:0=",<THERMOCOUPLE_TYPE_B>;
++		type_e    = <&max>,"thermocouple-type:0=",<THERMOCOUPLE_TYPE_E>;
++		type_j    = <&max>,"thermocouple-type:0=",<THERMOCOUPLE_TYPE_J>;
++		type_k    = <&max>,"thermocouple-type:0=",<THERMOCOUPLE_TYPE_K>;
++		type_n    = <&max>,"thermocouple-type:0=",<THERMOCOUPLE_TYPE_N>;
++		type_r    = <&max>,"thermocouple-type:0=",<THERMOCOUPLE_TYPE_R>;
++		type_s    = <&max>,"thermocouple-type:0=",<THERMOCOUPLE_TYPE_S>;
++		type_t    = <&max>,"thermocouple-type:0=",<THERMOCOUPLE_TYPE_T>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/mbed-dac-overlay.dts b/arch/arm/boot/dts/overlays/mbed-dac-overlay.dts
+new file mode 100644
+index 000000000000..e3f56608c643
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mbed-dac-overlay.dts
+@@ -0,0 +1,64 @@
++// Definitions for mbed DAC
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++                        #size-cells = <0>;
++			status = "okay";
++
++			tlv320aic23: codec@1a {
++				#sound-dai-cells = <0>;
++				reg = <0x1a>;
++				compatible = "ti,tlv320aic23";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "simple-audio-card";
++			i2s-controller = <&i2s_clk_producer>;
++			status = "okay";
++
++			simple-audio-card,name = "mbed-DAC";
++
++			simple-audio-card,widgets =
++				"Microphone", "Mic Jack",
++				"Line", "Line In",
++				"Headphone", "Headphone Jack";
++
++			simple-audio-card,routing =
++				"Headphone Jack", "LHPOUT",
++				"Headphone Jack", "RHPOUT",
++				"LLINEIN", "Line In",
++				"RLINEIN", "Line In",
++				"MICIN", "Mic Jack";
++
++			simple-audio-card,format = "i2s";
++
++			simple-audio-card,cpu {
++				sound-dai = <&i2s_clk_producer>;
++			};
++
++			sound_master: simple-audio-card,codec {
++				sound-dai = <&tlv320aic23>;
++				system-clock-frequency = <12288000>;
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/mcp23017-overlay.dts b/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
+new file mode 100644
+index 000000000000..0f9e89484c55
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
+@@ -0,0 +1,103 @@
++// Definitions for MCP23017 Gpio Extender from Microchip Semiconductor
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2cbus>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			mcp23017_pins: mcp23017_pins@20 {
++				brcm,pins = <4>;
++				brcm,function = <0>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&mcp23017>;
++		__dormant__ {
++			compatible = "microchip,mcp23008";
++		};
++	};
++
++	fragment@3 {
++		target = <&mcp23017>;
++		mcp23017_irq: __overlay__ {
++			#interrupt-cells=<2>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&mcp23017_pins>;
++			interrupt-parent = <&gpio>;
++			interrupts = <4 2>;
++			interrupt-controller;
++			microchip,irq-mirror;
++		};
++	};
++
++	fragment@4 {
++		target = <&i2cbus>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp23017: mcp@20 {
++				compatible = "microchip,mcp23017";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++
++				status = "okay";
++			};
++		};
++	};
++
++	frag100: fragment@100 {
++		target = <&i2c1>;
++		i2cbus: __overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@101 { 
++		target = <&i2c0if>; 
++		__dormant__ { 
++			status = "okay"; 
++		}; 
++	};
++
++	fragment@102 { 
++		target = <&i2c0mux>; 
++		__dormant__ { 
++			status = "okay"; 
++		}; 
++	};
++
++	__overrides__ {
++		gpiopin = <&mcp23017_pins>,"brcm,pins:0",
++				<&mcp23017_irq>,"interrupts:0";
++		addr = <&mcp23017>,"reg:0", <&mcp23017_pins>,"reg:0";
++		mcp23008 = <0>,"=2";
++		noints = <0>,"!1!3";
++		i2c0 = <&frag100>, "target:0=",<&i2c0>;
++		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
++			      <0>,"+101+102";
++		i2c3 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c3";
++		i2c4 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c4";
++		i2c5 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c5";
++		i2c6 = <&frag100>, "target?=0",
++		       <&frag100>, "target-path=i2c6";
++	};
++};
++
+diff --git a/arch/arm/boot/dts/overlays/mcp23s17-overlay.dts b/arch/arm/boot/dts/overlays/mcp23s17-overlay.dts
+new file mode 100644
+index 000000000000..484d64b225fb
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mcp23s17-overlay.dts
+@@ -0,0 +1,732 @@
++// Overlay for MCP23S08/17 GPIO Extenders from Microchip Semiconductor
++
++// dtparams:
++//     s08-spi<n>-<m>-present  - 4-bit integer, bitmap indicating MCP23S08 devices present on SPI<n>, CS#<m>.
++//     s17-spi<n>-<m>-present  - 8-bit integer, bitmap indicating MCP23S17 devices present on SPI<n>, CS#<m>.
++//     s08-spi<n>-<m>-int-gpio - integer, enables interrupts on a single MCP23S08 device on SPI<n>, CS#<m>, specifies the GPIO pin to which INT output is connected.
++//     s17-spi<n>-<m>-int-gpio - integer, enables mirrored interrupts on a single MCP23S17 device on SPI<n>, CS#<m>, specifies the GPIO pin to which either INTA or INTB output is connected.
++//
++// If devices are present on SPI1 or SPI2, those interfaces must be enabled with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
++// If interrupts are enabled for a device on a given CS# on a SPI bus, that device must be the only one present on that SPI bus/CS#.
++//
++// Example 1: A single MCP23S17 device on SPI0, CS#0 with its SPI addr set to 0 and INTA output connected to GPIO25:
++// dtoverlay=mcp23s17:s17-spi0-0-present=1,s17-spi0-0-int-gpio=25
++//
++// Example 2: Two MCP23S08 devices on SPI1, CS#0 with their addrs set to 2 and 3. Three MCP23S17 devices on SPI1, CS#1 with their addrs set to 0, 1 and 7:
++// dtoverlay=spi1-2cs
++// dtoverlay=mcp23s17:s08-spi1-0-present=12,s17-spi1-1-present=131
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	// disable spi-dev on spi0.0
++	fragment@0 {
++		target = <&spidev0>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi0.1
++	fragment@1 {
++		target = <&spidev1>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi1.0
++	fragment@2 {
++		target-path = "spi1/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi1.1
++	fragment@3 {
++		target-path = "spi1/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi1.2
++	fragment@4 {
++		target-path = "spi1/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi2.0
++	fragment@5 {
++		target-path = "spi2/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi2.1
++	fragment@6 {
++		target-path = "spi2/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// disable spi-dev on spi2.2
++	fragment@7 {
++		target-path = "spi2/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	// enable one or more mcp23s08s on spi0.0
++	fragment@8 {
++		target = <&spi0>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s08_00: mcp23s08@0 {
++				compatible = "microchip,mcp23s08";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi0-0-present parameter */
++     				reg = <0>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi0-0-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s08s on spi0.1
++	fragment@9 {
++		target = <&spi0>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s08_01: mcp23s08@1 {
++				compatible = "microchip,mcp23s08";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi0-1-present parameter */
++     				reg = <1>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi0-1-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s08s on spi1.0
++	fragment@10 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s08_10: mcp23s08@0 {
++				compatible = "microchip,mcp23s08";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi1-0-present parameter */
++     				reg = <0>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi1-0-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s08s on spi1.1
++	fragment@11 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s08_11: mcp23s08@1 {
++				compatible = "microchip,mcp23s08";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi1-1-present parameter */
++     				reg = <1>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi1-1-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s08s on spi1.2
++	fragment@12 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s08_12: mcp23s08@2 {
++				compatible = "microchip,mcp23s08";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi1-2-present parameter */
++     				reg = <2>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi1-2-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s08s on spi2.0
++	fragment@13 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s08_20: mcp23s08@0 {
++				compatible = "microchip,mcp23s08";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi2-0-present parameter */
++     				reg = <0>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi2-0-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s08s on spi2.1
++	fragment@14 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s08_21: mcp23s08@1 {
++				compatible = "microchip,mcp23s08";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi2-1-present parameter */
++     				reg = <1>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi2-1-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s08s on spi2.2
++	fragment@15 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s08_22: mcp23s08@2 {
++				compatible = "microchip,mcp23s08";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi2-2-present parameter */
++     				reg = <2>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi2-2-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s17s on spi0.0
++	fragment@16 {
++		target = <&spi0>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s17_00: mcp23s17@0 {
++				compatible = "microchip,mcp23s17";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi0-0-present parameter */
++     				reg = <0>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi0-0-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s17s on spi0.1
++	fragment@17 {
++		target = <&spi0>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s17_01: mcp23s17@1 {
++				compatible = "microchip,mcp23s17";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi0-1-present parameter */
++     				reg = <1>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi0-1-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s17s on spi1.0
++	fragment@18 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s17_10: mcp23s17@0 {
++				compatible = "microchip,mcp23s17";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi1-0-present parameter */
++     				reg = <0>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi1-0-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s17s on spi1.1
++	fragment@19 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s17_11: mcp23s17@1 {
++				compatible = "microchip,mcp23s17";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi1-1-present parameter */
++     				reg = <1>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi1-1-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s17s on spi1.2
++	fragment@20 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s17_12: mcp23s17@2 {
++				compatible = "microchip,mcp23s17";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi1-2-present parameter */
++     				reg = <2>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi1-2-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s17s on spi2.0
++	fragment@21 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s17_20: mcp23s17@0 {
++				compatible = "microchip,mcp23s17";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi2-0-present parameter */
++     				reg = <0>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi2-0-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s17s on spi2.1
++	fragment@22 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s17_21: mcp23s17@1 {
++				compatible = "microchip,mcp23s17";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi2-1-present parameter */
++     				reg = <1>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi2-1-int-gpio parameter */
++			};
++		};
++	};
++
++	// enable one or more mcp23s17s on spi2.2
++	fragment@23 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++			mcp23s17_22: mcp23s17@2 {
++				compatible = "microchip,mcp23s17";
++  				gpio-controller;
++  				#gpio-cells = <2>;
++    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi2-2-present parameter */
++     				reg = <2>;
++    				spi-max-frequency = <500000>;
++				status = "okay";
++				#interrupt-cells=<2>;
++				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi2-2-int-gpio parameter */
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi0.0 as a input with no pull-up/down
++	fragment@24 {
++		target = <&gpio>;
++		__dormant__ {
++			spi0_0_int_pins: spi0_0_int_pins {
++				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi0-0-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi0.1 as a input with no pull-up/down
++	fragment@25 {
++		target = <&gpio>;
++		__dormant__ {
++			spi0_1_int_pins: spi0_1_int_pins {
++				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi0-1-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi1.0 as a input with no pull-up/down
++	fragment@26 {
++		target = <&gpio>;
++		__dormant__ {
++			spi1_0_int_pins: spi1_0_int_pins {
++				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi1-0-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi1.1 as a input with no pull-up/down
++	fragment@27 {
++		target = <&gpio>;
++		__dormant__ {
++			spi1_1_int_pins: spi1_1_int_pins {
++				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi1-1-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi1.2 as a input with no pull-up/down
++	fragment@28 {
++		target = <&gpio>;
++		__dormant__ {
++			spi1_2_int_pins: spi1_2_int_pins {
++				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi1-2-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi2.0 as a input with no pull-up/down
++	fragment@29 {
++		target = <&gpio>;
++		__dormant__ {
++			spi2_0_int_pins: spi2_0_int_pins {
++				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi2-0-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi2.1 as a input with no pull-up/down
++	fragment@30 {
++		target = <&gpio>;
++		__dormant__ {
++			spi2_1_int_pins: spi2_1_int_pins {
++				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi2-1-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi2.2 as a input with no pull-up/down
++	fragment@31 {
++		target = <&gpio>;
++		__dormant__ {
++			spi2_2_int_pins: spi2_2_int_pins {
++				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi2-2-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Enable interrupts for a mcp23s08 on spi0.0.
++	// Use default active low interrupt signalling.
++	fragment@32 {
++		target = <&mcp23s08_00>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++		};
++	};
++
++	// Enable interrupts for a mcp23s08 on spi0.1.
++	// Use default active low interrupt signalling.
++	fragment@33 {
++		target = <&mcp23s08_01>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++		};
++	};
++
++	// Enable interrupts for a mcp23s08 on spi1.0.
++	// Use default active low interrupt signalling.
++	fragment@34 {
++		target = <&mcp23s08_10>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++		};
++	};
++
++	// Enable interrupts for a mcp23s08 on spi1.1.
++	// Use default active low interrupt signalling.
++	fragment@35 {
++		target = <&mcp23s08_11>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++		};
++	};
++
++	// Enable interrupts for a mcp23s08 on spi1.2.
++	// Use default active low interrupt signalling.
++	fragment@36 {
++		target = <&mcp23s08_12>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++		};
++	};
++
++	// Enable interrupts for a mcp23s08 on spi2.0.
++	// Use default active low interrupt signalling.
++	fragment@37 {
++		target = <&mcp23s08_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++		};
++	};
++
++	// Enable interrupts for a mcp23s08 on spi2.1.
++	// Use default active low interrupt signalling.
++	fragment@38 {
++		target = <&mcp23s08_21>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++		};
++	};
++
++	// Enable interrupts for a mcp23s08 on spi2.2.
++	// Use default active low interrupt signalling.
++	fragment@39 {
++		target = <&mcp23s08_22>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++		};
++	};
++
++	// Enable interrupts for a mcp23s17 on spi0.0.
++	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
++	// Use default active low interrupt signalling.
++	fragment@40 {
++		target = <&mcp23s17_00>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			microchip,irq-mirror;
++		};
++	};
++
++	// Enable interrupts for a mcp23s17 on spi0.1.
++	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
++	// Configure INTA/B outputs of mcp23s08/17 as active low.
++	fragment@41 {
++		target = <&mcp23s17_01>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			microchip,irq-mirror;
++		};
++	};
++
++	// Enable interrupts for a mcp23s17 on spi1.0.
++	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
++	// Configure INTA/B outputs of mcp23s08/17 as active low.
++	fragment@42 {
++		target = <&mcp23s17_10>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			microchip,irq-mirror;
++		};
++	};
++
++	// Enable interrupts for a mcp23s17 on spi1.1.
++	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
++	// Configure INTA/B outputs of mcp23s08/17 as active low.
++	fragment@43 {
++		target = <&mcp23s17_11>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			microchip,irq-mirror;
++		};
++	};
++
++	// Enable interrupts for a mcp23s17 on spi1.2.
++	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
++	// Configure INTA/B outputs of mcp23s08/17 as active low.
++	fragment@44 {
++		target = <&mcp23s17_12>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			microchip,irq-mirror;
++		};
++	};
++
++	// Enable interrupts for a mcp23s17 on spi2.0.
++	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
++	// Configure INTA/B outputs of mcp23s08/17 as active low.
++	fragment@45 {
++		target = <&mcp23s17_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			microchip,irq-mirror;
++		};
++	};
++
++	// Enable interrupts for a mcp23s17 on spi2.1.
++	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
++	// Configure INTA/B outputs of mcp23s08/17 as active low.
++	fragment@46 {
++		target = <&mcp23s17_21>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			microchip,irq-mirror;
++		};
++	};
++
++	// Enable interrupts for a mcp23s17 on spi2.2.
++	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
++	// Configure INTA/B outputs of mcp23s08/17 as active low.
++	fragment@47 {
++		target = <&mcp23s17_22>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			microchip,irq-mirror;
++		};
++	};
++
++	__overrides__ {
++		s08-spi0-0-present = <0>,"+0+8",  <&mcp23s08_00>,"microchip,spi-present-mask:0";
++		s08-spi0-1-present = <0>,"+1+9",  <&mcp23s08_01>,"microchip,spi-present-mask:0";
++		s08-spi1-0-present = <0>,"+2+10", <&mcp23s08_10>,"microchip,spi-present-mask:0";
++		s08-spi1-1-present = <0>,"+3+11", <&mcp23s08_11>,"microchip,spi-present-mask:0";
++		s08-spi1-2-present = <0>,"+4+12", <&mcp23s08_12>,"microchip,spi-present-mask:0";
++		s08-spi2-0-present = <0>,"+5+13", <&mcp23s08_20>,"microchip,spi-present-mask:0";
++		s08-spi2-1-present = <0>,"+6+14", <&mcp23s08_21>,"microchip,spi-present-mask:0";
++		s08-spi2-2-present = <0>,"+7+15", <&mcp23s08_22>,"microchip,spi-present-mask:0";
++		s17-spi0-0-present = <0>,"+0+16", <&mcp23s17_00>,"microchip,spi-present-mask:0";
++		s17-spi0-1-present = <0>,"+1+17", <&mcp23s17_01>,"microchip,spi-present-mask:0";
++		s17-spi1-0-present = <0>,"+2+18", <&mcp23s17_10>,"microchip,spi-present-mask:0";
++		s17-spi1-1-present = <0>,"+3+19", <&mcp23s17_11>,"microchip,spi-present-mask:0";
++		s17-spi1-2-present = <0>,"+4+20", <&mcp23s17_12>,"microchip,spi-present-mask:0";
++		s17-spi2-0-present = <0>,"+5+21", <&mcp23s17_20>,"microchip,spi-present-mask:0";
++		s17-spi2-1-present = <0>,"+6+22", <&mcp23s17_21>,"microchip,spi-present-mask:0";
++		s17-spi2-2-present = <0>,"+7+23", <&mcp23s17_22>,"microchip,spi-present-mask:0";
++		s08-spi0-0-int-gpio = <0>,"+24+32", <&spi0_0_int_pins>,"brcm,pins:0", <&mcp23s08_00>,"interrupts:0";
++		s08-spi0-1-int-gpio = <0>,"+25+33", <&spi0_1_int_pins>,"brcm,pins:0", <&mcp23s08_01>,"interrupts:0";
++		s08-spi1-0-int-gpio = <0>,"+26+34", <&spi1_0_int_pins>,"brcm,pins:0", <&mcp23s08_10>,"interrupts:0";
++		s08-spi1-1-int-gpio = <0>,"+27+35", <&spi1_1_int_pins>,"brcm,pins:0", <&mcp23s08_11>,"interrupts:0";
++		s08-spi1-2-int-gpio = <0>,"+28+36", <&spi1_2_int_pins>,"brcm,pins:0", <&mcp23s08_12>,"interrupts:0";
++		s08-spi2-0-int-gpio = <0>,"+29+37", <&spi2_0_int_pins>,"brcm,pins:0", <&mcp23s08_20>,"interrupts:0";
++		s08-spi2-1-int-gpio = <0>,"+30+38", <&spi2_1_int_pins>,"brcm,pins:0", <&mcp23s08_21>,"interrupts:0";
++		s08-spi2-2-int-gpio = <0>,"+31+39", <&spi2_2_int_pins>,"brcm,pins:0", <&mcp23s08_22>,"interrupts:0";
++		s17-spi0-0-int-gpio = <0>,"+24+40", <&spi0_0_int_pins>,"brcm,pins:0", <&mcp23s17_00>,"interrupts:0";
++		s17-spi0-1-int-gpio = <0>,"+25+41", <&spi0_1_int_pins>,"brcm,pins:0", <&mcp23s17_01>,"interrupts:0";
++		s17-spi1-0-int-gpio = <0>,"+26+42", <&spi1_0_int_pins>,"brcm,pins:0", <&mcp23s17_10>,"interrupts:0";
++		s17-spi1-1-int-gpio = <0>,"+27+43", <&spi1_1_int_pins>,"brcm,pins:0", <&mcp23s17_11>,"interrupts:0";
++		s17-spi1-2-int-gpio = <0>,"+28+44", <&spi1_2_int_pins>,"brcm,pins:0", <&mcp23s17_12>,"interrupts:0";
++		s17-spi2-0-int-gpio = <0>,"+29+45", <&spi2_0_int_pins>,"brcm,pins:0", <&mcp23s17_20>,"interrupts:0";
++		s17-spi2-1-int-gpio = <0>,"+30+46", <&spi2_1_int_pins>,"brcm,pins:0", <&mcp23s17_21>,"interrupts:0";
++		s17-spi2-2-int-gpio = <0>,"+31+47", <&spi2_2_int_pins>,"brcm,pins:0", <&mcp23s17_22>,"interrupts:0";
++	};
++};
++
+diff --git a/arch/arm/boot/dts/overlays/mcp2515-can0-overlay.dts b/arch/arm/boot/dts/overlays/mcp2515-can0-overlay.dts
+new file mode 100755
+index 000000000000..46f143d809cc
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mcp2515-can0-overlay.dts
+@@ -0,0 +1,73 @@
++/*
++ * Device tree overlay for mcp251x/can0 on spi0.0
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++    compatible = "brcm,bcm2835";
++    /* disable spi-dev for spi0.0 */
++    fragment@0 {
++        target = <&spi0>;
++        __overlay__ {
++            status = "okay";
++        };
++    };
++
++    fragment@1 {
++	target = <&spidev0>;
++	__overlay__ {
++	    status = "disabled";
++	};
++    };
++
++    /* the interrupt pin of the can-controller */
++    fragment@2 {
++        target = <&gpio>;
++        __overlay__ {
++            can0_pins: can0_pins {
++                brcm,pins = <25>;
++                brcm,function = <0>; /* input */
++            };
++        };
++    };
++
++    /* the clock/oscillator of the can-controller */
++    fragment@3 {
++        target-path = "/";
++        __overlay__ {
++            /* external oscillator of mcp2515 on SPI0.0 */
++            can0_osc: can0_osc {
++                compatible = "fixed-clock";
++                #clock-cells = <0>;
++                clock-frequency  = <16000000>;
++            };
++        };
++    };
++
++    /* the spi config of the can-controller itself binding everything together */
++    fragment@4 {
++        target = <&spi0>;
++        __overlay__ {
++            /* needed to avoid dtc warning */
++            #address-cells = <1>;
++            #size-cells = <0>;
++            can0: mcp2515@0 {
++                reg = <0>;
++                compatible = "microchip,mcp2515";
++                pinctrl-names = "default";
++                pinctrl-0 = <&can0_pins>;
++                spi-max-frequency = <10000000>;
++                interrupt-parent = <&gpio>;
++                interrupts = <25 8>; /* IRQ_TYPE_LEVEL_LOW */
++                clocks = <&can0_osc>;
++            };
++        };
++    };
++    __overrides__ {
++        oscillator = <&can0_osc>,"clock-frequency:0";
++        spimaxfrequency = <&can0>,"spi-max-frequency:0";
++        interrupt = <&can0_pins>,"brcm,pins:0",<&can0>,"interrupts:0";
++    };
++};
+diff --git a/arch/arm/boot/dts/overlays/mcp2515-can1-overlay.dts b/arch/arm/boot/dts/overlays/mcp2515-can1-overlay.dts
+new file mode 100644
+index 000000000000..0a8dd576818e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mcp2515-can1-overlay.dts
+@@ -0,0 +1,73 @@
++/*
++ * Device tree overlay for mcp251x/can1 on spi0.1 edited by petit_miner
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++    compatible = "brcm,bcm2835";
++    /* disable spi-dev for spi0.1 */
++    fragment@0 {
++        target = <&spi0>;
++        __overlay__ {
++            status = "okay";
++        };
++    };
++
++    fragment@1 {
++	target = <&spidev1>;
++	__overlay__ {
++	    status = "disabled";
++	};
++    };
++
++    /* the interrupt pin of the can-controller */
++    fragment@2 {
++        target = <&gpio>;
++        __overlay__ {
++            can1_pins: can1_pins {
++                brcm,pins = <25>;
++                brcm,function = <0>; /* input */
++            };
++        };
++    };
++
++    /* the clock/oscillator of the can-controller */
++    fragment@3 {
++        target-path = "/";
++        __overlay__ {
++            /* external oscillator of mcp2515 on spi0.1 */
++            can1_osc: can1_osc {
++                compatible = "fixed-clock";
++                #clock-cells = <0>;
++                clock-frequency  = <16000000>;
++            };
++        };
++    };
++
++    /* the spi config of the can-controller itself binding everything together */
++    fragment@4 {
++        target = <&spi0>;
++        __overlay__ {
++            /* needed to avoid dtc warning */
++            #address-cells = <1>;
++            #size-cells = <0>;
++            can1: mcp2515@1 {
++                reg = <1>;
++                compatible = "microchip,mcp2515";
++                pinctrl-names = "default";
++                pinctrl-0 = <&can1_pins>;
++                spi-max-frequency = <10000000>;
++                interrupt-parent = <&gpio>;
++                interrupts = <25 8>; /* IRQ_TYPE_LEVEL_LOW */
++                clocks = <&can1_osc>;
++            };
++        };
++    };
++    __overrides__ {
++        oscillator = <&can1_osc>,"clock-frequency:0";
++        spimaxfrequency = <&can1>,"spi-max-frequency:0";
++        interrupt = <&can1_pins>,"brcm,pins:0",<&can1>,"interrupts:0";
++    };
++};
+diff --git a/arch/arm/boot/dts/overlays/mcp2515-overlay.dts b/arch/arm/boot/dts/overlays/mcp2515-overlay.dts
+new file mode 100644
+index 000000000000..cda1fb0b1199
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mcp2515-overlay.dts
+@@ -0,0 +1,156 @@
++// SPDX-License-Identifier: (GPL-2.0 OR MIT)
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/interrupt-controller/irq.h>
++#include <dt-bindings/pinctrl/bcm2835.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev1>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target-path = "spi1/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target-path = "spi1/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@4 {
++		target-path = "spi1/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@5 {
++		target-path = "spi2/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@6 {
++		target-path = "spi2/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@7 {
++		target-path = "spi2/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@8 {
++		target = <&gpio>;
++		__overlay__ {
++			mcp2515_pins: mcp2515_pins {
++				brcm,pins = <25>;
++				brcm,function = <BCM2835_FSEL_GPIO_IN>;
++			};
++		};
++	};
++
++	fragment@9 {
++		target-path = "/clocks";
++		__overlay__ {
++			clk_mcp2515_osc: mcp2515-osc {
++				#clock-cells = <0>;
++				compatible = "fixed-clock";
++				clock-frequency = <16000000>;
++			};
++		};
++	};
++
++	mcp2515_frag: fragment@10 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp2515: mcp2515@0 {
++				compatible = "microchip,mcp2515";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&mcp2515_pins>;
++				spi-max-frequency = <10000000>;
++				interrupt-parent = <&gpio>;
++				interrupts = <25 IRQ_TYPE_LEVEL_LOW>;
++				clocks = <&clk_mcp2515_osc>;
++			};
++		};
++	};
++
++	__overrides__ {
++		spi0-0 = <0>, "+0",
++			<&mcp2515_frag>, "target:0=", <&spi0>,
++			<&mcp2515>, "reg:0=0",
++			<&mcp2515_pins>, "name=mcp2515_spi0_0_pins",
++			<&clk_mcp2515_osc>, "name=mcp2515-spi0-0-osc";
++		spi0-1 = <0>, "+1",
++			<&mcp2515_frag>, "target:0=", <&spi0>,
++			<&mcp2515>, "reg:0=1",
++			<&mcp2515_pins>, "name=mcp2515_spi0_1_pins",
++			<&clk_mcp2515_osc>, "name=mcp2515-spi0-1-osc";
++		spi1-0 = <0>, "+2",
++			<&mcp2515_frag>, "target:0=", <&spi1>,
++			<&mcp2515>, "reg:0=0",
++			<&mcp2515_pins>, "name=mcp2515_spi1_0_pins",
++			<&clk_mcp2515_osc>, "name=mcp2515-spi1-0-osc";
++		spi1-1 = <0>, "+3",
++			<&mcp2515_frag>, "target:0=", <&spi1>,
++			<&mcp2515>, "reg:0=1",
++			<&mcp2515_pins>, "name=mcp2515_spi1_1_pins",
++			<&clk_mcp2515_osc>, "name=mcp2515-spi1-1-osc";
++		spi1-2 = <0>, "+4",
++			<&mcp2515_frag>, "target:0=", <&spi1>,
++			<&mcp2515>, "reg:0=2",
++			<&mcp2515_pins>, "name=mcp2515_spi1_2_pins",
++			<&clk_mcp2515_osc>, "name=mcp2515-spi1-2-osc";
++		spi2-0 = <0>, "+5",
++			<&mcp2515_frag>, "target:0=", <&spi2>,
++			<&mcp2515>, "reg:0=0",
++			<&mcp2515_pins>, "name=mcp2515_spi2_0_pins",
++			<&clk_mcp2515_osc>, "name=mcp2515-spi2-0-osc";
++		spi2-1 = <0>, "+6",
++			<&mcp2515_frag>, "target:0=", <&spi2>,
++			<&mcp2515>, "reg:0=1",
++			<&mcp2515_pins>, "name=mcp2515_spi2_1_pins",
++			<&clk_mcp2515_osc>, "name=mcp2515-spi2-1-osc";
++		spi2-2 = <0>, "+7",
++			<&mcp2515_frag>, "target:0=", <&spi2>,
++			<&mcp2515>, "reg:0=2",
++			<&mcp2515_pins>, "name=mcp2515_spi2_2_pins",
++			<&clk_mcp2515_osc>, "name=mcp2515-spi2-2-osc";
++		oscillator = <&clk_mcp2515_osc>, "clock-frequency:0";
++		speed = <&mcp2515>, "spi-max-frequency:0";
++		interrupt = <&mcp2515_pins>, "brcm,pins:0",
++			<&mcp2515>, "interrupts:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/mcp251xfd-overlay.dts b/arch/arm/boot/dts/overlays/mcp251xfd-overlay.dts
+new file mode 100644
+index 000000000000..65c861bbd340
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mcp251xfd-overlay.dts
+@@ -0,0 +1,226 @@
++// SPDX-License-Identifier: (GPL-2.0 OR MIT)
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/interrupt-controller/irq.h>
++#include <dt-bindings/pinctrl/bcm2835.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev1>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target-path = "spi1/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target-path = "spi1/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@4 {
++		target-path = "spi1/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@5 {
++		target-path = "spi2/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@6 {
++		target-path = "spi2/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@7 {
++		target-path = "spi2/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@8 {
++		target = <&gpio>;
++		__overlay__ {
++			mcp251xfd_pins: mcp251xfd_pins {
++				brcm,pins = <25>;
++				brcm,function = <BCM2835_FSEL_GPIO_IN>;
++			};
++		};
++	};
++
++	fragment@9 {
++		target-path = "/clocks";
++		__overlay__ {
++			clk_mcp251xfd_osc: mcp251xfd-osc {
++				#clock-cells = <0>;
++				compatible = "fixed-clock";
++				clock-frequency = <40000000>;
++			};
++		};
++	};
++
++	mcp251xfd_frag: fragment@10 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp251xfd: mcp251xfd@0 {
++				compatible = "microchip,mcp251xfd";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&mcp251xfd_pins>;
++				spi-max-frequency = <20000000>;
++				interrupt-parent = <&gpio>;
++				interrupts = <25 IRQ_TYPE_LEVEL_LOW>;
++				clocks = <&clk_mcp251xfd_osc>;
++			};
++		};
++	};
++
++	fragment@11 {
++		target = <&mcp251xfd>;
++		mcp251xfd_rx_int_gpios: __dormant__ {
++			microchip,rx-int-gpios = <&gpio 255 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	fragment@12 {
++		target = <&gpio>;
++		__dormant__ {
++			mcp251xfd_xceiver_pins: mcp251xfd_xceiver_pins {
++				brcm,pins = <255>;
++				brcm,function = <BCM2835_FSEL_GPIO_OUT>;
++			};
++		};
++	};
++
++	fragment@13 {
++		target-path = "/";
++		__dormant__ {
++			reg_mcp251xfd_xceiver: reg_mcp251xfd_xceiver {
++				compatible = "regulator-fixed";
++				regulator-name = "mcp251xfd_xceiver";
++				regulator-min-microvolt = <3300000>;
++				regulator-max-microvolt = <3300000>;
++				gpio = <&gpio 4 GPIO_ACTIVE_HIGH>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&mcp251xfd_xceiver_pins>;
++			};
++		};
++	};
++
++	fragment@14 {
++		target = <&mcp251xfd>;
++		__dormant__ {
++			xceiver-supply = <&reg_mcp251xfd_xceiver>;
++		};
++	};
++
++	__overrides__ {
++		spi0-0 = <0>, "+0",
++			<&mcp251xfd_frag>, "target:0=", <&spi0>,
++			<&mcp251xfd>, "reg:0=0",
++			<&mcp251xfd_pins>, "name=mcp251xfd_spi0_0_pins",
++			<&clk_mcp251xfd_osc>, "name=mcp251xfd-spi0-0-osc",
++			<&mcp251xfd_xceiver_pins>, "name=mcp251xfd_spi0_0_xceiver_pins",
++			<&reg_mcp251xfd_xceiver>, "name=reg-mcp251xfd-spi0-0-xceiver",
++			<&reg_mcp251xfd_xceiver>, "regulator-name=mcp251xfd-spi0-0-xceiver";
++		spi0-1 = <0>, "+1",
++			<&mcp251xfd_frag>, "target:0=", <&spi0>,
++			<&mcp251xfd>, "reg:0=1",
++			<&mcp251xfd_pins>, "name=mcp251xfd_spi0_1_pins",
++			<&clk_mcp251xfd_osc>, "name=mcp251xfd-spi0-1-osc",
++			<&mcp251xfd_xceiver_pins>, "name=mcp251xfd_spi0_1_xceiver_pins",
++			<&reg_mcp251xfd_xceiver>, "name=reg-mcp251xfd-spi0-1-xceiver",
++			<&reg_mcp251xfd_xceiver>, "regulator-name=mcp251xfd-spi0-1-xceiver";
++		spi1-0 = <0>, "+2",
++			<&mcp251xfd_frag>, "target:0=", <&spi1>,
++			<&mcp251xfd>, "reg:0=0",
++			<&mcp251xfd_pins>, "name=mcp251xfd_spi1_0_pins",
++			<&clk_mcp251xfd_osc>, "name=mcp251xfd-spi1-0-osc",
++			<&mcp251xfd_xceiver_pins>, "name=mcp251xfd_spi1_0_xceiver_pins",
++			<&reg_mcp251xfd_xceiver>, "name=reg-mcp251xfd-spi1-0-xceiver",
++			<&reg_mcp251xfd_xceiver>, "regulator-name=mcp251xfd-spi1-0-xceiver";
++		spi1-1 = <0>, "+3",
++			<&mcp251xfd_frag>, "target:0=", <&spi1>,
++			<&mcp251xfd>, "reg:0=1",
++			<&mcp251xfd_pins>, "name=mcp251xfd_spi1_1_pins",
++			<&clk_mcp251xfd_osc>, "name=mcp251xfd-spi1-1-osc",
++			<&mcp251xfd_xceiver_pins>, "name=mcp251xfd_spi1_1_xceiver_pins",
++			<&reg_mcp251xfd_xceiver>, "name=reg-mcp251xfd-spi1-1-xceiver",
++			<&reg_mcp251xfd_xceiver>, "regulator-name=mcp251xfd-spi1-1-xceiver";
++		spi1-2 = <0>, "+4",
++			<&mcp251xfd_frag>, "target:0=", <&spi1>,
++			<&mcp251xfd>, "reg:0=2",
++			<&mcp251xfd_pins>, "name=mcp251xfd_spi1_2_pins",
++			<&clk_mcp251xfd_osc>, "name=mcp251xfd-spi1-2-osc",
++			<&mcp251xfd_xceiver_pins>, "name=mcp251xfd_spi1_2_xceiver_pins",
++			<&reg_mcp251xfd_xceiver>, "name=reg-mcp251xfd-spi1-2-xceiver",
++			<&reg_mcp251xfd_xceiver>, "regulator-name=mcp251xfd-spi1-2-xceiver";
++		spi2-0 = <0>, "+5",
++			<&mcp251xfd_frag>, "target:0=", <&spi2>,
++			<&mcp251xfd>, "reg:0=0",
++			<&mcp251xfd_pins>, "name=mcp251xfd_spi2_0_pins",
++			<&clk_mcp251xfd_osc>, "name=mcp251xfd-spi2-0-osc",
++			<&mcp251xfd_xceiver_pins>, "name=mcp251xfd_spi2_0_xceiver_pins",
++			<&reg_mcp251xfd_xceiver>, "name=reg-mcp251xfd-spi2-0-xceiver",
++			<&reg_mcp251xfd_xceiver>, "regulator-name=mcp251xfd-spi2-0-xceiver";
++		spi2-1 = <0>, "+6",
++			<&mcp251xfd_frag>, "target:0=", <&spi2>,
++			<&mcp251xfd>, "reg:0=1",
++			<&mcp251xfd_pins>, "name=mcp251xfd_spi2_1_pins",
++			<&clk_mcp251xfd_osc>, "name=mcp251xfd-spi2-1-osc",
++			<&mcp251xfd_xceiver_pins>, "name=mcp251xfd_spi2_1_xceiver_pins",
++			<&reg_mcp251xfd_xceiver>, "name=reg-mcp251xfd-spi2-1-xceiver",
++			<&reg_mcp251xfd_xceiver>, "regulator-name=mcp251xfd-spi2-1-xceiver";
++		spi2-2 = <0>, "+7",
++			<&mcp251xfd_frag>, "target:0=", <&spi2>,
++			<&mcp251xfd>, "reg:0=2",
++			<&mcp251xfd_pins>, "name=mcp251xfd_spi2_2_pins",
++			<&clk_mcp251xfd_osc>, "name=mcp251xfd-spi2-2-osc",
++			<&mcp251xfd_xceiver_pins>, "name=mcp251xfd_spi2_2_xceiver_pins",
++			<&reg_mcp251xfd_xceiver>, "name=reg-mcp251xfd-spi2-2-xceiver",
++			<&reg_mcp251xfd_xceiver>, "regulator-name=mcp251xfd-spi2-2-xceiver";
++		oscillator = <&clk_mcp251xfd_osc>, "clock-frequency:0";
++		speed = <&mcp251xfd>, "spi-max-frequency:0";
++		interrupt = <&mcp251xfd_pins>, "brcm,pins:0",
++			<&mcp251xfd>, "interrupts:0";
++		rx_interrupt = <0>, "+11",
++			<&mcp251xfd_pins>, "brcm,pins:4",
++			<&mcp251xfd_rx_int_gpios>, "microchip,rx-int-gpios:4";
++		xceiver_enable = <0>, "+12+13+14",
++			<&mcp251xfd_xceiver_pins>, "brcm,pins:0",
++			<&reg_mcp251xfd_xceiver>, "gpio:4";
++		xceiver_active_high = <&reg_mcp251xfd_xceiver>, "enable-active-high?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/mcp3008-overlay.dts b/arch/arm/boot/dts/overlays/mcp3008-overlay.dts
+new file mode 100755
+index 000000000000..957fdb9310af
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mcp3008-overlay.dts
+@@ -0,0 +1,205 @@
++/*
++ * Device tree overlay for Microchip mcp3008 10-Bit A/D Converters
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev1>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target-path = "spi1/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target-path = "spi1/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@4 {
++		target-path = "spi1/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@5 {
++		target-path = "spi2/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@6 {
++		target-path = "spi2/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@7 {
++		target-path = "spi2/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@8 {
++		target = <&spi0>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3008_00: mcp3008@0 {
++				compatible = "microchip,mcp3008";
++				reg = <0>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@9 {
++		target = <&spi0>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3008_01: mcp3008@1 {
++				compatible = "microchip,mcp3008";
++				reg = <1>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@10 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3008_10: mcp3008@0 {
++				compatible = "microchip,mcp3008";
++				reg = <0>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@11 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3008_11: mcp3008@1 {
++				compatible = "microchip,mcp3008";
++				reg = <1>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@12 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3008_12: mcp3008@2 {
++				compatible = "microchip,mcp3008";
++				reg = <2>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@13 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3008_20: mcp3008@0 {
++				compatible = "microchip,mcp3008";
++				reg = <0>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@14 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3008_21: mcp3008@1 {
++				compatible = "microchip,mcp3008";
++				reg = <1>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@15 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3008_22: mcp3008@2 {
++				compatible = "microchip,mcp3008";
++				reg = <2>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	__overrides__ {
++		spi0-0-present = <0>, "+0+8";
++		spi0-1-present = <0>, "+1+9";
++		spi1-0-present = <0>, "+2+10";
++		spi1-1-present = <0>, "+3+11";
++		spi1-2-present = <0>, "+4+12";
++		spi2-0-present = <0>, "+5+13";
++		spi2-1-present = <0>, "+6+14";
++		spi2-2-present = <0>, "+7+15";
++		spi0-0-speed = <&mcp3008_00>, "spi-max-frequency:0";
++		spi0-1-speed = <&mcp3008_01>, "spi-max-frequency:0";
++		spi1-0-speed = <&mcp3008_10>, "spi-max-frequency:0";
++		spi1-1-speed = <&mcp3008_11>, "spi-max-frequency:0";
++		spi1-2-speed = <&mcp3008_12>, "spi-max-frequency:0";
++		spi2-0-speed = <&mcp3008_20>, "spi-max-frequency:0";
++		spi2-1-speed = <&mcp3008_21>, "spi-max-frequency:0";
++		spi2-2-speed = <&mcp3008_22>, "spi-max-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/mcp3202-overlay.dts b/arch/arm/boot/dts/overlays/mcp3202-overlay.dts
+new file mode 100755
+index 000000000000..8e4e9f60f285
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mcp3202-overlay.dts
+@@ -0,0 +1,205 @@
++/*
++ * Device tree overlay for Microchip mcp3202 12-Bit A/D Converters
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev1>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target-path = "spi1/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target-path = "spi1/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@4 {
++		target-path = "spi1/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@5 {
++		target-path = "spi2/spidev@0";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@6 {
++		target-path = "spi2/spidev@1";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@7 {
++		target-path = "spi2/spidev@2";
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@8 {
++		target = <&spi0>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3202_00: mcp3202@0 {
++				compatible = "mcp3202";
++				reg = <0>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@9 {
++		target = <&spi0>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3202_01: mcp3202@1 {
++				compatible = "mcp3202";
++				reg = <1>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@10 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3202_10: mcp3202@0 {
++				compatible = "mcp3202";
++				reg = <0>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@11 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3202_11: mcp3202@1 {
++				compatible = "mcp3202";
++				reg = <1>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@12 {
++		target = <&spi1>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3202_12: mcp3202@2 {
++				compatible = "mcp3202";
++				reg = <2>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@13 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3202_20: mcp3202@0 {
++				compatible = "mcp3202";
++				reg = <0>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@14 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3202_21: mcp3202@1 {
++				compatible = "mcp3202";
++				reg = <1>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	fragment@15 {
++		target = <&spi2>;
++		__dormant__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mcp3202_22: mcp3202@2 {
++				compatible = "mcp3202";
++				reg = <2>;
++				spi-max-frequency = <1600000>;
++			};
++		};
++	};
++
++	__overrides__ {
++		spi0-0-present = <0>, "+0+8";
++		spi0-1-present = <0>, "+1+9";
++		spi1-0-present = <0>, "+2+10";
++		spi1-1-present = <0>, "+3+11";
++		spi1-2-present = <0>, "+4+12";
++		spi2-0-present = <0>, "+5+13";
++		spi2-1-present = <0>, "+6+14";
++		spi2-2-present = <0>, "+7+15";
++		spi0-0-speed = <&mcp3202_00>, "spi-max-frequency:0";
++		spi0-1-speed = <&mcp3202_01>, "spi-max-frequency:0";
++		spi1-0-speed = <&mcp3202_10>, "spi-max-frequency:0";
++		spi1-1-speed = <&mcp3202_11>, "spi-max-frequency:0";
++		spi1-2-speed = <&mcp3202_12>, "spi-max-frequency:0";
++		spi2-0-speed = <&mcp3202_20>, "spi-max-frequency:0";
++		spi2-1-speed = <&mcp3202_21>, "spi-max-frequency:0";
++		spi2-2-speed = <&mcp3202_22>, "spi-max-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/mcp342x-overlay.dts b/arch/arm/boot/dts/overlays/mcp342x-overlay.dts
+new file mode 100644
+index 000000000000..714eca5a4b5e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mcp342x-overlay.dts
+@@ -0,0 +1,164 @@
++// Overlay for MCP3421-8 ADCs from Microchip Semiconductor
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			mcp3421: mcp@68 {
++				reg = <0x68>;
++				compatible = "microchip,mcp3421";
++
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			mcp3422: mcp@68 {
++				reg = <0x68>;
++				compatible = "microchip,mcp3422";
++
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			mcp3423: mcp@68 {
++				reg = <0x68>;
++				compatible = "microchip,mcp3423";
++
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			mcp3424: mcp@68 {
++				reg = <0x68>;
++				compatible = "microchip,mcp3424";
++
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			mcp3425: mcp@68 {
++				reg = <0x68>;
++				compatible = "microchip,mcp3425","mcp3425";
++
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@5 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			mcp3426: mcp@68 {
++				reg = <0x68>;
++				compatible = "microchip,mcp3426";
++
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@6 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			mcp3427: mcp@68 {
++				reg = <0x68>;
++				compatible = "microchip,mcp3427";
++
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@7 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			mcp3428: mcp@68 {
++				reg = <0x68>;
++				compatible = "microchip,mcp3428";
++
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		addr = <&mcp3421>,"reg:0",
++		       <&mcp3422>,"reg:0",
++		       <&mcp3423>,"reg:0",
++		       <&mcp3424>,"reg:0",
++		       <&mcp3425>,"reg:0",
++		       <&mcp3426>,"reg:0",
++		       <&mcp3427>,"reg:0",
++		       <&mcp3428>,"reg:0";
++		mcp3421 = <0>,"=0";
++		mcp3422 = <0>,"=1";
++		mcp3423 = <0>,"=2";
++		mcp3424 = <0>,"=3";
++		mcp3425 = <0>,"=4";
++		mcp3426 = <0>,"=5";
++		mcp3427 = <0>,"=6";
++		mcp3428 = <0>,"=7";
++	};
++};
++
+diff --git a/arch/arm/boot/dts/overlays/media-center-overlay.dts b/arch/arm/boot/dts/overlays/media-center-overlay.dts
+new file mode 100644
+index 000000000000..4bc2eaa1f215
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/media-center-overlay.dts
+@@ -0,0 +1,86 @@
++/*
++ * Device Tree overlay for Media Center HAT by Pi Supply
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			rpi_display_pins: rpi_display_pins {
++				brcm,pins = <12 23 24 25>;
++				brcm,function = <1 1 1 0>; /* out out out in */
++				brcm,pull = <0 0 0 2>; /* - - - up */
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			rpidisplay: rpi-display@0{
++				compatible = "ilitek,ili9341";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&rpi_display_pins>;
++
++				spi-max-frequency = <32000000>;
++				rotate = <90>;
++				bgr;
++				fps = <30>;
++				buswidth = <8>;
++				reset-gpios = <&gpio 23 1>;
++				dc-gpios = <&gpio 24 0>;
++				led-gpios = <&gpio 12 0>;
++				debug = <0>;
++			};
++
++			rpidisplay_ts: rpi-display-ts@1 {
++				compatible = "ti,ads7846";
++				reg = <1>;
++
++				spi-max-frequency = <2000000>;
++				interrupts = <25 2>; /* high-to-low edge triggered */
++				interrupt-parent = <&gpio>;
++				pendown-gpio = <&gpio 25 1>;
++				ti,x-plate-ohms = /bits/ 16 <60>;
++				ti,pressure-max = /bits/ 16 <255>;
++			};
++		};
++	};
++
++	__overrides__ {
++		speed =     <&rpidisplay>,"spi-max-frequency:0";
++		rotate =    <&rpidisplay>,"rotate:0";
++		fps =       <&rpidisplay>,"fps:0";
++		debug =     <&rpidisplay>,"debug:0";
++		xohms =     <&rpidisplay_ts>,"ti,x-plate-ohms;0";
++		swapxy =    <&rpidisplay_ts>,"ti,swap-xy?";
++		backlight = <&rpidisplay>,"led-gpios:4",
++		            <&rpi_display_pins>,"brcm,pins:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/merus-amp-overlay.dts b/arch/arm/boot/dts/overlays/merus-amp-overlay.dts
+new file mode 100644
+index 000000000000..96159a48d33f
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/merus-amp-overlay.dts
+@@ -0,0 +1,59 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for Infineon Merus-Amp
++/dts-v1/;
++/plugin/;
++#include <dt-bindings/pinctrl/bcm2835.h>
++#include <dt-bindings/gpio/gpio.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			merus_amp_pins: merus_amp_pins {
++				brcm,pins = <23 8>;
++				brcm,function = <0 0>;
++				brcm,pull = <2 0>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			merus_amp: ma120x0p@20 {
++				#sound-dai-cells = <0>;
++				compatible = "ma,ma120x0p";
++				reg = <0x20>;
++				status = "okay";
++				pinctrl-names = "default";
++				pinctrl-0 = <&merus_amp_pins>;
++				enable_gp-gpios = <&gpio 14 GPIO_ACTIVE_HIGH>;
++				mute_gp-gpios = <&gpio 15 GPIO_ACTIVE_HIGH>;
++				booster_gp-gpios = <&gpio 17 GPIO_ACTIVE_HIGH>;
++				error_gp-gpios = <&gpio 23 GPIO_ACTIVE_HIGH>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "merus,merus-amp";
++			i2s-controller = <&i2s_clk_producer>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/midi-uart0-overlay.dts b/arch/arm/boot/dts/overlays/midi-uart0-overlay.dts
+new file mode 100644
+index 000000000000..f7e44d29e101
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/midi-uart0-overlay.dts
+@@ -0,0 +1,36 @@
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/clock/bcm2835.h>
++
++/*
++ * Fake a higher clock rate to get a larger divisor, and thereby a lower
++ * baudrate. The real clock is 48MHz, which we scale so that requesting
++ * 38.4kHz results in an actual 31.25kHz.
++ *
++ *   48000000*38400/31250 = 58982400
++ */
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			midi_clk: midi_clk {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-output-names = "uart0_pclk";
++				clock-frequency = <58982400>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&uart0>;
++		__overlay__ {
++			clocks = <&midi_clk>,
++			         <&clocks BCM2835_CLOCK_VPU>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/midi-uart0-pi5-overlay.dts b/arch/arm/boot/dts/overlays/midi-uart0-pi5-overlay.dts
+new file mode 100644
+index 000000000000..837d1b014e28
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/midi-uart0-pi5-overlay.dts
+@@ -0,0 +1,35 @@
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/clock/rp1.h>
++
++/*
++ * Fake a higher clock rate to get a larger divisor, and thereby a lower
++ * baudrate. The real clock is 50MHz, which we scale so that requesting
++ * 38.4kHz results in an actual 31.25kHz.
++ *
++ *   50000000*38400/31250 = 61440000
++ */
++
++/{
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			midi_clk: midi_clk0 {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-output-names = "uart0_pclk";
++				clock-frequency = <61440000>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&uart0>;
++		__overlay__ {
++			clocks = <&midi_clk &rp1_clocks RP1_PLL_SYS_PRI_PH>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/midi-uart1-overlay.dts b/arch/arm/boot/dts/overlays/midi-uart1-overlay.dts
+new file mode 100644
+index 000000000000..e0bc410acbff
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/midi-uart1-overlay.dts
+@@ -0,0 +1,43 @@
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/clock/bcm2835-aux.h>
++
++/*
++ * Fake a higher clock rate to get a larger divisor, and thereby a lower
++ * baudrate. The real clock is 48MHz, which we scale so that requesting
++ * 38.4kHz results in an actual 31.25kHz.
++ *
++ *   48000000*38400/31250 = 58982400
++ */
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/clocks";
++		__overlay__ {
++			midi_clk: clock@5 {
++				compatible = "fixed-factor-clock";
++				#clock-cells = <0>;
++				clocks = <&aux BCM2835_AUX_CLOCK_UART>;
++				clock-mult = <38400>;
++				clock-div  = <31250>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&uart1>;
++		__overlay__ {
++			clocks = <&midi_clk>;
++		};
++	};
++
++	fragment@2 {
++		target = <&aux>;
++		__overlay__ {
++			clock-output-names = "aux_uart", "aux_spi1", "aux_spi2";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/midi-uart1-pi5-overlay.dts b/arch/arm/boot/dts/overlays/midi-uart1-pi5-overlay.dts
+new file mode 100644
+index 000000000000..e803876622a9
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/midi-uart1-pi5-overlay.dts
+@@ -0,0 +1,35 @@
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/clock/rp1.h>
++
++/*
++ * Fake a higher clock rate to get a larger divisor, and thereby a lower
++ * baudrate. The real clock is 50MHz, which we scale so that requesting
++ * 38.4kHz results in an actual 31.25kHz.
++ *
++ *   50000000*38400/31250 = 61440000
++ */
++
++/{
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			midi_clk: midi_clk1 {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-output-names = "uart1_pclk";
++				clock-frequency = <61440000>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&uart1>;
++		__overlay__ {
++			clocks = <&midi_clk &rp1_clocks RP1_PLL_SYS_PRI_PH>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/midi-uart2-overlay.dts b/arch/arm/boot/dts/overlays/midi-uart2-overlay.dts
+new file mode 100644
+index 000000000000..5c6985f41ea2
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/midi-uart2-overlay.dts
+@@ -0,0 +1,37 @@
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/clock/bcm2835.h>
++
++/*
++ * Fake a higher clock rate to get a larger divisor, and thereby a lower
++ * baudrate. The real clock is 48MHz, which we scale so that requesting
++ * 38.4kHz results in an actual 31.25kHz.
++ *
++ *   48000000*38400/31250 = 58982400
++ */
++
++/{
++        compatible = "brcm,bcm2711";
++
++        fragment@0 {
++                target-path = "/";
++                __overlay__ {
++                        midi_clk: midi_clk2 {
++                                compatible = "fixed-clock";
++                                #clock-cells = <0>;
++                                clock-output-names = "uart2_pclk";
++                                clock-frequency = <58982400>;
++                        };
++                };
++        };
++
++        fragment@1 {
++                target = <&uart2>;
++                __overlay__ {
++                        clocks = <&midi_clk>,
++                                 <&clocks BCM2835_CLOCK_VPU>;
++                };
++        };
++};
++
+diff --git a/arch/arm/boot/dts/overlays/midi-uart2-pi5-overlay.dts b/arch/arm/boot/dts/overlays/midi-uart2-pi5-overlay.dts
+new file mode 100644
+index 000000000000..4f07e7de2df3
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/midi-uart2-pi5-overlay.dts
+@@ -0,0 +1,35 @@
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/clock/rp1.h>
++
++/*
++ * Fake a higher clock rate to get a larger divisor, and thereby a lower
++ * baudrate. The real clock is 50MHz, which we scale so that requesting
++ * 38.4kHz results in an actual 31.25kHz.
++ *
++ *   50000000*38400/31250 = 61440000
++ */
++
++/{
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			midi_clk: midi_clk2 {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-output-names = "uart2_pclk";
++				clock-frequency = <61440000>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&uart2>;
++		__overlay__ {
++			clocks = <&midi_clk &rp1_clocks RP1_PLL_SYS_PRI_PH>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/midi-uart3-overlay.dts b/arch/arm/boot/dts/overlays/midi-uart3-overlay.dts
+new file mode 100644
+index 000000000000..052027db0564
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/midi-uart3-overlay.dts
+@@ -0,0 +1,38 @@
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/clock/bcm2835.h>
++
++/*
++ * Fake a higher clock rate to get a larger divisor, and thereby a lower
++ * baudrate. The real clock is 48MHz, which we scale so that requesting
++ * 38.4kHz results in an actual 31.25kHz.
++ *
++ *   48000000*38400/31250 = 58982400
++ */
++
++/{
++        compatible = "brcm,bcm2711";
++
++        fragment@0 {
++                target-path = "/";
++                __overlay__ {
++                        midi_clk: midi_clk3 {
++                                compatible = "fixed-clock";
++                                #clock-cells = <0>;
++                                clock-output-names = "uart3_pclk";
++                                clock-frequency = <58982400>;
++                        };
++                };
++        };
++
++        fragment@1 {
++                target = <&uart3>;
++                __overlay__ {
++                        clocks = <&midi_clk>,
++                                 <&clocks BCM2835_CLOCK_VPU>;
++                };
++        };
++};
++
++
+diff --git a/arch/arm/boot/dts/overlays/midi-uart3-pi5-overlay.dts b/arch/arm/boot/dts/overlays/midi-uart3-pi5-overlay.dts
+new file mode 100644
+index 000000000000..478220d41edc
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/midi-uart3-pi5-overlay.dts
+@@ -0,0 +1,35 @@
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/clock/rp1.h>
++
++/*
++ * Fake a higher clock rate to get a larger divisor, and thereby a lower
++ * baudrate. The real clock is 50MHz, which we scale so that requesting
++ * 38.4kHz results in an actual 31.25kHz.
++ *
++ *   50000000*38400/31250 = 61440000
++ */
++
++/{
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			midi_clk: midi_clk3 {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-output-names = "uart3_pclk";
++				clock-frequency = <61440000>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&uart3>;
++		__overlay__ {
++			clocks = <&midi_clk &rp1_clocks RP1_PLL_SYS_PRI_PH>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/midi-uart4-overlay.dts b/arch/arm/boot/dts/overlays/midi-uart4-overlay.dts
+new file mode 100644
+index 000000000000..5f09a7ccd675
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/midi-uart4-overlay.dts
+@@ -0,0 +1,38 @@
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/clock/bcm2835.h>
++
++/*
++ * Fake a higher clock rate to get a larger divisor, and thereby a lower
++ * baudrate. The real clock is 48MHz, which we scale so that requesting
++ * 38.4kHz results in an actual 31.25kHz.
++ *
++ *   48000000*38400/31250 = 58982400
++ */
++
++/{
++        compatible = "brcm,bcm2711";
++
++        fragment@0 {
++                target-path = "/";
++                __overlay__ {
++                        midi_clk: midi_clk4 {
++                                compatible = "fixed-clock";
++                                #clock-cells = <0>;
++                                clock-output-names = "uart4_pclk";
++                                clock-frequency = <58982400>;
++                        };
++                };
++        };
++
++        fragment@1 {
++                target = <&uart4>;
++                __overlay__ {
++                        clocks = <&midi_clk>,
++                                 <&clocks BCM2835_CLOCK_VPU>;
++                };
++        };
++};
++
++
+diff --git a/arch/arm/boot/dts/overlays/midi-uart4-pi5-overlay.dts b/arch/arm/boot/dts/overlays/midi-uart4-pi5-overlay.dts
+new file mode 100644
+index 000000000000..827bd5e951ba
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/midi-uart4-pi5-overlay.dts
+@@ -0,0 +1,35 @@
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/clock/rp1.h>
++
++/*
++ * Fake a higher clock rate to get a larger divisor, and thereby a lower
++ * baudrate. The real clock is 50MHz, which we scale so that requesting
++ * 38.4kHz results in an actual 31.25kHz.
++ *
++ *   50000000*38400/31250 = 61440000
++ */
++
++/{
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			midi_clk: midi_clk4 {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-output-names = "uart4_pclk";
++				clock-frequency = <61440000>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&uart4>;
++		__overlay__ {
++			clocks = <&midi_clk &rp1_clocks RP1_PLL_SYS_PRI_PH>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/midi-uart5-overlay.dts b/arch/arm/boot/dts/overlays/midi-uart5-overlay.dts
+new file mode 100644
+index 000000000000..74551ec2a672
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/midi-uart5-overlay.dts
+@@ -0,0 +1,38 @@
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/clock/bcm2835.h>
++
++/*
++ * Fake a higher clock rate to get a larger divisor, and thereby a lower
++ * baudrate. The real clock is 48MHz, which we scale so that requesting
++ * 38.4kHz results in an actual 31.25kHz.
++ *
++ *   48000000*38400/31250 = 58982400
++ */
++
++/{
++        compatible = "brcm,bcm2711";
++
++        fragment@0 {
++                target-path = "/";
++                __overlay__ {
++                        midi_clk: midi_clk5 {
++                                compatible = "fixed-clock";
++                                #clock-cells = <0>;
++                                clock-output-names = "uart5_pclk";
++                                clock-frequency = <58982400>;
++                        };
++                };
++        };
++
++        fragment@1 {
++                target = <&uart5>;
++                __overlay__ {
++                        clocks = <&midi_clk>,
++                                 <&clocks BCM2835_CLOCK_VPU>;
++                };
++        };
++};
++
++
+diff --git a/arch/arm/boot/dts/overlays/minipitft13-overlay.dts b/arch/arm/boot/dts/overlays/minipitft13-overlay.dts
+new file mode 100644
+index 000000000000..5e0941e8ba54
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/minipitft13-overlay.dts
+@@ -0,0 +1,70 @@
++/*
++ * Device Tree overlay for Adafruit Mini PiTFT 1.3" and 1.5" 240x240 Display
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++        compatible = "brcm,bcm2835";
++
++        fragment@0 {
++                target = <&spidev0>;
++                __overlay__ {
++                        status = "disabled";
++                };
++        };
++
++        fragment@1 {
++                target = <&spidev1>;
++                __overlay__ {
++                        status = "disabled";
++                };
++        };
++
++        fragment@2 {
++                target = <&gpio>;
++                __overlay__ {
++                        pitft_pins: pitft_pins {
++                                brcm,pins = <25>;
++                                brcm,function = <1>; /* out */
++                                brcm,pull = <0>; /* none */
++                        };
++                };
++        };
++
++        fragment@3 {
++                target = <&spi0>;
++                __overlay__ {
++                        /* needed to avoid dtc warning */
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++                        status = "okay";
++
++                        pitft: pitft@0 {
++                                compatible = "fbtft,minipitft13";
++                                reg = <0>;
++                                pinctrl-names = "default";
++                                pinctrl-0 = <&pitft_pins>;
++                                spi-max-frequency = <32000000>;
++                                rotate = <0>;
++                                width = <240>;
++                                height = <240>;
++                                buswidth = <8>;
++                                dc-gpios = <&gpio 25 0>;
++                                led-gpios = <&gpio 26 0>;
++                                debug = <0>;
++                        };
++                };
++        };
++
++        __overrides__ {
++                speed =   <&pitft>,"spi-max-frequency:0";
++                rotate =  <&pitft>,"rotate:0";
++                width =   <&pitft>,"width:0";
++                height =  <&pitft>,"height:0";
++                fps =     <&pitft>,"fps:0";
++                debug =   <&pitft>,"debug:0";
++        };
++};
+diff --git a/arch/arm/boot/dts/overlays/miniuart-bt-overlay.dts b/arch/arm/boot/dts/overlays/miniuart-bt-overlay.dts
+new file mode 100644
+index 000000000000..757e5cd3c4e8
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/miniuart-bt-overlay.dts
+@@ -0,0 +1,83 @@
++/dts-v1/;
++/plugin/;
++
++/* Switch Pi3 Bluetooth function to use the mini-UART (ttyS0) and restore
++   UART0/ttyAMA0 over GPIOs 14 & 15. Note that this may reduce the maximum
++   usable baudrate.
++
++   It is also necessary to edit /lib/systemd/system/hciuart.service and
++   replace ttyAMA0 with ttyS0, unless you have a system with udev rules
++   that create /dev/serial0 and /dev/serial1, in which case use /dev/serial1
++   instead because it will always be correct.
++
++   If cmdline.txt uses the alias serial0 to refer to the user-accessable port
++   then the firmware will replace with the appropriate port whether or not
++   this overlay is used.
++*/
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&uart0>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&uart0_pins>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&bt>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&uart1>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&uart1_pins>;
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target = <&uart0_pins>;
++		__overlay__ {
++			brcm,pins;
++			brcm,function;
++			brcm,pull;
++		};
++	};
++
++	fragment@4 {
++		target = <&uart1>;
++		__overlay__ {
++			pinctrl-0 = <&uart1_bt_pins>;
++		};
++	};
++
++	fragment@5 {
++		target-path = "/aliases";
++		__overlay__ {
++			serial0 = "/soc/serial@7e201000";
++			serial1 = "/soc/serial@7e215040";
++			bluetooth = "/soc/serial@7e215040/bluetooth";
++		};
++	};
++
++	fragment@6 {
++		target = <&minibt>;
++		minibt_frag: __overlay__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		krnbt = <&minibt_frag>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/mipi-dbi-spi-overlay.dts b/arch/arm/boot/dts/overlays/mipi-dbi-spi-overlay.dts
+new file mode 100644
+index 000000000000..63fb3a5f2388
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mipi-dbi-spi-overlay.dts
+@@ -0,0 +1,175 @@
++/*
++ * mipi-dbi-spi-overlay.dts
++ */
++
++#include <dt-bindings/gpio/gpio.h>
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	spidev_fragment: fragment@0 {
++		target-path = "spi0/spidev@0";
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	panel_fragment: fragment@1 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			panel: panel@0 {
++				compatible = "panel", "panel-mipi-dbi-spi";
++				reg = <0>;
++				spi-max-frequency = <32000000>;
++
++				width-mm = <0>;
++				height-mm = <0>;
++
++				timing: panel-timing {
++					hactive = <320>;
++					vactive = <240>;
++					hback-porch = <0>;
++					vback-porch = <0>;
++
++					clock-frequency = <0>;
++					hfront-porch = <0>;
++					hsync-len = <0>;
++					vfront-porch = <0>;
++					vsync-len = <0>;
++				};
++			};
++		};
++	};
++
++	fragment@10 {
++		target = <&panel>;
++		__dormant__  {
++			backlight = <&backlight_gpio>;
++		};
++	};
++
++	fragment@11 {
++		target-path = "/";
++		__dormant__  {
++			backlight_gpio: backlight_gpio {
++				compatible = "gpio-backlight";
++				gpios = <&gpio 255 GPIO_ACTIVE_HIGH>;
++			};
++		};
++	};
++
++	fragment@20 {
++		target = <&panel>;
++		__dormant__  {
++			backlight = <&backlight_pwm>;
++		};
++	};
++
++	fragment@21 {
++		target-path = "/";
++		__dormant__  {
++			backlight_pwm: backlight_pwm {
++				compatible = "pwm-backlight";
++				brightness-levels = <0 6 8 12 16 24 32 40 48 64 96 128 160 192 224 255>;
++				default-brightness-level = <15>;
++				pwms = <&pwm 0 200000 0>;
++			};
++		};
++	};
++
++	fragment@22 {
++		target = <&pwm>;
++		__dormant__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&pwm_pins>;
++			assigned-clock-rates = <1000000>;
++			status = "okay";
++		};
++	};
++
++	fragment@23 {
++		target = <&gpio>;
++		__dormant__ {
++			pwm_pins: pwm_pins {
++				brcm,pins = <18>;
++				brcm,function = <2>; /* Alt5 */
++			};
++		};
++	};
++
++	fragment@24 {
++		target = <&chosen>;
++		__dormant__  {
++			bootargs = "snd_bcm2835.enable_headphones=0";
++		};
++	};
++
++	__overrides__ {
++		compatible    = <&panel>, "compatible";
++
++		spi0-0        = <&panel_fragment>, "target:0=",<&spi0>,
++				<&spidev_fragment>, "target-path=spi0/spidev@0",
++				<&panel>, "reg:0=0";
++		spi0-1        = <&panel_fragment>, "target:0=",<&spi0>,
++				<&spidev_fragment>, "target-path=spi0/spidev@1",
++				<&panel>, "reg:0=1";
++		spi1-0        = <&panel_fragment>, "target:0=",<&spi1>,
++				<&spidev_fragment>, "target-path=spi1/spidev@0",
++				<&panel>, "reg:0=0";
++		spi1-1        = <&panel_fragment>, "target:0=",<&spi1>,
++				<&spidev_fragment>, "target-path=spi1/spidev@1",
++				<&panel>, "reg:0=1";
++		spi1-2        = <&panel_fragment>, "target:0=",<&spi1>,
++				<&spidev_fragment>, "target-path=spi1/spidev@2",
++				<&panel>, "reg:0=2";
++		spi2-0        = <&panel_fragment>, "target:0=",<&spi2>,
++				<&spidev_fragment>, "target-path=spi2/spidev@0",
++				<&panel>, "reg:0=0";
++		spi2-1        = <&panel_fragment>, "target:0=",<&spi2>,
++				<&spidev_fragment>, "target-path=spi2/spidev@1",
++				<&panel>, "reg:0=1";
++		spi2-2        = <&panel_fragment>, "target:0=",<&spi2>,
++				<&spidev_fragment>, "target-path=spi2/spidev@2",
++				<&panel>, "reg:0=2";
++
++		speed         = <&panel>, "spi-max-frequency:0";
++		cpha          = <&panel>, "spi-cpha?";
++		cpol          = <&panel>, "spi-cpol?";
++
++		write-only    = <&panel>, "write-only?";
++
++		width         = <&timing>, "hactive:0";
++		height        = <&timing>, "vactive:0";
++		x-offset      = <&timing>, "hback-porch:0";
++		y-offset      = <&timing>, "vback-porch:0";
++		clock-frequency = <&timing>, "clock-frequency:0";
++
++		width-mm      = <&panel>, "width-mm:0";
++		height-mm     = <&panel>, "height-mm:0";
++
++		/* optional gpios */
++		reset-gpio    = <&panel>, "reset-gpios:0=", <&gpio>,
++				<&panel>, "reset-gpios:4",
++				<&panel>, "reset-gpios:8=0"; /* GPIO_ACTIVE_HIGH */
++		dc-gpio       = <&panel>, "dc-gpios:0=", <&gpio>,
++				<&panel>, "dc-gpios:4",
++				<&panel>, "dc-gpios:8=0"; /* GPIO_ACTIVE_HIGH */
++
++		backlight-gpio        = <0>, "+10+11",
++					<&backlight_gpio>, "gpios:4";
++		backlight-pwm         = <0>, "+20+21+22+23+24";
++		backlight-pwm-chan    = <&backlight_pwm>, "pwms:4";
++		backlight-pwm-gpio    = <&pwm_pins>, "brcm,pins:0";
++		backlight-pwm-func    = <&pwm_pins>, "brcm,function:0";
++		backlight-def-brightness = <&backlight_pwm>, "default-brightness-level:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/mlx90640-overlay.dts b/arch/arm/boot/dts/overlays/mlx90640-overlay.dts
+new file mode 100644
+index 000000000000..a2655ed82585
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mlx90640-overlay.dts
+@@ -0,0 +1,22 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_arm>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			clock-frequency = <400000>;
++
++			mlx90640: mlx90640@33 {
++				compatible = "melexis,mlx90640";
++				reg = <0x33>;
++				status = "okay";
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/mmc-overlay.dts b/arch/arm/boot/dts/overlays/mmc-overlay.dts
+new file mode 100644
+index 000000000000..c1a2f691aa1e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mmc-overlay.dts
+@@ -0,0 +1,46 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&mmc>;
++		frag0: __overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&mmc_pins>;
++			bus-width = <4>;
++			brcm,overclock-50 = <0>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			mmc_pins: mmc_pins {
++				brcm,pins = <48 49 50 51 52 53>;
++				brcm,function = <7>; /* alt3 */
++				brcm,pull = <0 2 2 2 2 2>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sdhost>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&mmcnr>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	__overrides__ {
++		overclock_50     = <&frag0>,"brcm,overclock-50:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/mz61581-overlay.dts b/arch/arm/boot/dts/overlays/mz61581-overlay.dts
+new file mode 100644
+index 000000000000..101ad21d8093
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/mz61581-overlay.dts
+@@ -0,0 +1,117 @@
++/*
++ * Device Tree overlay for MZ61581-PI-EXT 2014.12.28 by Tontec
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			mz61581_pins: mz61581_pins {
++				brcm,pins = <4 15 18 25>;
++				brcm,function = <0 1 1 1>; /* in out out out */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			mz61581: mz61581@0{
++				compatible = "samsung,s6d02a1";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&mz61581_pins>;
++
++				spi-max-frequency = <128000000>;
++				spi-cpol;
++				spi-cpha;
++
++				width = <320>;
++				height = <480>;
++				rotate = <270>;
++				bgr;
++				fps = <30>;
++				buswidth = <8>;
++				txbuflen = <32768>;
++
++				reset-gpios = <&gpio 15 1>;
++				dc-gpios = <&gpio 25 0>;
++				led-gpios = <&gpio 18 0>;
++
++				init = <0x10000b0 00
++					0x1000011
++					0x20000ff
++					0x10000b3 0x02 0x00 0x00 0x00
++					0x10000c0 0x13 0x3b 0x00 0x02 0x00 0x01 0x00 0x43
++					0x10000c1 0x08 0x16 0x08 0x08
++					0x10000c4 0x11 0x07 0x03 0x03
++					0x10000c6 0x00
++					0x10000c8 0x03 0x03 0x13 0x5c 0x03 0x07 0x14 0x08 0x00 0x21 0x08 0x14 0x07 0x53 0x0c 0x13 0x03 0x03 0x21 0x00
++					0x1000035 0x00
++					0x1000036 0xa0
++					0x100003a 0x55
++					0x1000044 0x00 0x01
++					0x10000d0 0x07 0x07 0x1d 0x03
++					0x10000d1 0x03 0x30 0x10
++					0x10000d2 0x03 0x14 0x04
++					0x1000029
++					0x100002c>;
++
++				/* This is a workaround to make sure the init sequence slows down and doesn't fail */
++				debug = <3>;
++			};
++
++			mz61581_ts: mz61581_ts@1 {
++				compatible = "ti,ads7846";
++				reg = <1>;
++
++				spi-max-frequency = <2000000>;
++				interrupts = <4 2>; /* high-to-low edge triggered */
++				interrupt-parent = <&gpio>;
++				pendown-gpio = <&gpio 4 1>;
++
++				ti,x-plate-ohms = /bits/ 16 <60>;
++				ti,pressure-max = /bits/ 16 <255>;
++			};
++		};
++	};
++	__overrides__ {
++		speed =   <&mz61581>, "spi-max-frequency:0";
++		rotate =  <&mz61581>, "rotate:0";
++		fps =     <&mz61581>, "fps:0";
++		txbuflen = <&mz61581>, "txbuflen:0";
++		debug =   <&mz61581>, "debug:0";
++		xohms =   <&mz61581_ts>,"ti,x-plate-ohms;0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/ov2311-overlay.dts b/arch/arm/boot/dts/overlays/ov2311-overlay.dts
+new file mode 100644
+index 000000000000..4dad303c1768
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ov2311-overlay.dts
+@@ -0,0 +1,83 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for OV2311 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	i2c_frag: fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			#include "ov2311.dtsi"
++		};
++	};
++
++	csi_frag: fragment@1 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++
++			port {
++				csi_ep: endpoint {
++					remote-endpoint = <&cam_endpoint>;
++					data-lanes = <1 2>;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@4{
++		target = <&cam1_clk>;
++		__overlay__ {
++			status = "okay";
++			clock-frequency = <24000000>;
++		};
++	};
++
++	fragment@5 {
++		target = <&csi1>;
++		__dormant__ {
++			compatible = "brcm,bcm2835-unicam-legacy";
++		};
++	};
++
++	__overrides__ {
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
++		media-controller = <0>,"!5";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&cam_node>, "clocks:0=",<&cam0_clk>,
++		       <&cam_node>, "avdd-supply:0=",<&cam0_reg>;
++	};
++};
++
++&cam_node {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
+diff --git a/arch/arm/boot/dts/overlays/ov2311.dtsi b/arch/arm/boot/dts/overlays/ov2311.dtsi
+new file mode 100644
+index 000000000000..a1714d6941c3
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ov2311.dtsi
+@@ -0,0 +1,26 @@
++// Fragment that configures an ov2311
++
++cam_node: ov2311@60 {
++	compatible = "ovti,ov2311";
++	reg = <0x60>;
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++	clock-names = "xvclk";
++
++	avdd-supply = <&cam1_reg>;
++	dovdd-supply = <&cam_dummy_reg>;
++	dvdd-supply = <&cam_dummy_reg>;
++
++	rotation = <0>;
++	orientation = <2>;
++
++	port {
++		cam_endpoint: endpoint {
++			clock-lanes = <0>;
++			data-lanes = <1 2>;
++			link-frequencies =
++				/bits/ 64 <400000000>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/ov5647-overlay.dts b/arch/arm/boot/dts/overlays/ov5647-overlay.dts
+new file mode 100644
+index 000000000000..e2d40dac80c9
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ov5647-overlay.dts
+@@ -0,0 +1,100 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for OV5647 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	i2c_frag: fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			#include "ov5647.dtsi"
++
++			vcm_node: ad5398@c {
++				compatible = "adi,ad5398";
++				reg = <0x0c>;
++				status = "disabled";
++				VANA-supply = <&cam1_reg>;
++			};
++		};
++	};
++
++	csi_frag: fragment@1 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++
++			port {
++				csi_ep: endpoint {
++					remote-endpoint = <&cam_endpoint>;
++					data-lanes = <1 2>;
++					clock-noncontinuous;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	reg_frag: fragment@4 {
++		target = <&cam1_reg>;
++		__overlay__ {
++			startup-delay-us = <20000>;
++		};
++	};
++
++	clk_frag: fragment@5 {
++		target = <&cam1_clk>;
++		__overlay__ {
++			status = "okay";
++			clock-frequency = <25000000>;
++		};
++	};
++
++	fragment@6 {
++		target = <&csi1>;
++		__dormant__ {
++			compatible = "brcm,bcm2835-unicam-legacy";
++		};
++	};
++
++	__overrides__ {
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
++		media-controller = <0>,"!6";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&reg_frag>, "target:0=",<&cam0_reg>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&cam_node>, "clocks:0=",<&cam0_clk>,
++		       <&cam_node>, "avdd-supply:0=",<&cam0_reg>,
++		       <&vcm_node>, "VANA-supply:0=",<&cam0_reg>;
++		vcm = <&vcm_node>, "status=okay",
++		       <&cam_node>,"lens-focus:0=", <&vcm_node>;
++	};
++};
++
++&cam_node {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
+diff --git a/arch/arm/boot/dts/overlays/ov5647.dtsi b/arch/arm/boot/dts/overlays/ov5647.dtsi
+new file mode 100644
+index 000000000000..6455a191a394
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ov5647.dtsi
+@@ -0,0 +1,25 @@
++cam_node: ov5647@36 {
++	compatible = "ovti,ov5647";
++	reg = <0x36>;
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++
++	avdd-supply = <&cam1_reg>;
++	dovdd-supply = <&cam_dummy_reg>;
++	dvdd-supply = <&cam_dummy_reg>;
++
++	rotation = <0>;
++	orientation = <2>;
++
++	port {
++		cam_endpoint: endpoint {
++			clock-lanes = <0>;
++			data-lanes = <1 2>;
++			clock-noncontinuous;
++			link-frequencies =
++				/bits/ 64 <297000000>;
++		};
++	};
++};
++
+diff --git a/arch/arm/boot/dts/overlays/ov64a40-overlay.dts b/arch/arm/boot/dts/overlays/ov64a40-overlay.dts
+new file mode 100644
+index 000000000000..a765483aaaca
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ov64a40-overlay.dts
+@@ -0,0 +1,97 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for OV64A40 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	i2c_frag: fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			#include "ov64a40.dtsi"
++		};
++	};
++
++	csi_frag: fragment@1 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++
++			port{
++				csi_ep: endpoint{
++					remote-endpoint = <&cam_endpoint>;
++					clock-lanes = <0>;
++					data-lanes = <1 2>;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@3 {
++		target = <&cam1_clk>;
++		__overlay__ {
++			clock-frequency = <24000000>;
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@5 {
++		target = <&cam_node>;
++		__overlay__ {
++			lens-focus = <&vcm_node>;
++		};
++	};
++
++	fragment@6 {
++		target = <&csi1>;
++		__dormant__ {
++			compatible = "brcm,bcm2835-unicam-legacy";
++		};
++	};
++
++	__overrides__ {
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
++		media-controller = <0>,"!6";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&cam_node>, "clocks:0=",<&cam0_clk>,
++		       <&cam_node>, "avdd-supply:0=",<&cam0_reg>,
++		       <&vcm_node>, "vdd-supply:0=",<&cam0_reg>;
++		vcm = <&vcm_node>, "status",
++		      <0>, "=5";
++		link-frequency = <&cam_endpoint>,"link-frequencies#0";
++	};
++};
++
++&cam_node {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
++
++&vcm_node {
++	status = "okay";
++};
+diff --git a/arch/arm/boot/dts/overlays/ov64a40.dtsi b/arch/arm/boot/dts/overlays/ov64a40.dtsi
+new file mode 100644
+index 000000000000..471b383fa151
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ov64a40.dtsi
+@@ -0,0 +1,34 @@
++// Fragment that configures an OV64A40
++
++cam_node: ov64a40@36 {
++	compatible = "ovti,ov64a40";
++	reg = <0x36>;
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++	clock-names = "xclk";
++
++	avdd-supply = <&cam1_reg>;	/* 2.8v */
++	dovdd-supply = <&cam_dummy_reg>;/* 1.8v */
++	dvdd-supply = <&cam_dummy_reg>;	/* 1.1v */
++
++	rotation = <180>;
++	orientation = <2>;
++
++	port {
++		cam_endpoint: endpoint {
++			bus-type = <4>;
++			clock-lanes = <0>;
++			data-lanes = <1 2>;
++			link-frequencies =
++				/bits/ 64 <456000000>;
++		};
++	};
++};
++
++vcm_node: bu64754@76 {
++	compatible = "rohm,bu64754";
++	reg = <0x76>;
++	status = "disabled";
++	vdd-supply = <&cam1_reg>;
++};
+diff --git a/arch/arm/boot/dts/overlays/ov7251-overlay.dts b/arch/arm/boot/dts/overlays/ov7251-overlay.dts
+new file mode 100644
+index 000000000000..e12953809690
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ov7251-overlay.dts
+@@ -0,0 +1,83 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for OV7251 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	i2c_frag: fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			#include "ov7251.dtsi"
++		};
++	};
++
++	csi_frag: fragment@1 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++
++			port {
++				csi_ep: endpoint {
++					remote-endpoint = <&cam_endpoint>;
++					data-lanes = <1>;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@4 {
++		target = <&cam1_clk>;
++		__overlay__ {
++			status = "okay";
++			clock-frequency = <24000000>;
++		};
++	};
++
++	fragment@5 {
++		target = <&csi1>;
++		__dormant__ {
++			compatible = "brcm,bcm2835-unicam-legacy";
++		};
++	};
++
++	__overrides__ {
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
++		media-controller = <0>,"!5";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&cam_node>, "clocks:0=",<&cam0_clk>,
++		       <&cam_node>, "vdda-supply:0=",<&cam0_reg>;
++	};
++};
++
++&cam_node {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
+diff --git a/arch/arm/boot/dts/overlays/ov7251.dtsi b/arch/arm/boot/dts/overlays/ov7251.dtsi
+new file mode 100644
+index 000000000000..561fed1db837
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ov7251.dtsi
+@@ -0,0 +1,28 @@
++// Fragment that configures an ov7251
++
++cam_node: ov7251@60 {
++	compatible = "ovti,ov7251";
++	reg = <0x60>;
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++	clock-names = "xclk";
++	clock-frequency = <24000000>;
++
++	vdddo-supply = <&cam_dummy_reg>;
++	vdda-supply = <&cam1_reg>;
++	vddd-supply = <&cam_dummy_reg>;
++
++	rotation = <0>;
++	orientation = <2>;
++
++	port {
++		cam_endpoint: endpoint {
++			clock-lanes = <0>;
++			data-lanes = <1>;
++			clock-noncontinuous;
++			link-frequencies =
++				/bits/ 64 <240000000>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/ov9281-overlay.dts b/arch/arm/boot/dts/overlays/ov9281-overlay.dts
+new file mode 100644
+index 000000000000..eee59474e700
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ov9281-overlay.dts
+@@ -0,0 +1,84 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for OV9281 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	i2c_frag: fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			#include "ov9281.dtsi"
++		};
++	};
++
++	csi_frag: fragment@1 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++
++			port {
++				csi_ep: endpoint {
++					remote-endpoint = <&cam_endpoint>;
++					data-lanes = <1 2>;
++					clock-noncontinuous;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@4 {
++		target = <&cam1_clk>;
++		__overlay__ {
++			status = "okay";
++			clock-frequency = <24000000>;
++		};
++	};
++
++	fragment@5 {
++		target = <&csi1>;
++		__dormant__ {
++			compatible = "brcm,bcm2835-unicam-legacy";
++		};
++	};
++
++	__overrides__ {
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
++		media-controller = <0>,"!5";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&cam_node>, "clocks:0=",<&cam0_clk>,
++		       <&cam_node>, "avdd-supply:0=",<&cam0_reg>;
++	};
++};
++
++&cam_node {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
+diff --git a/arch/arm/boot/dts/overlays/ov9281.dtsi b/arch/arm/boot/dts/overlays/ov9281.dtsi
+new file mode 100644
+index 000000000000..7df43bc6ef39
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ov9281.dtsi
+@@ -0,0 +1,27 @@
++// Fragment that configures an ov9281
++
++cam_node: ov9281@60 {
++	compatible = "ovti,ov9281";
++	reg = <0x60>;
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++	clock-names = "xvclk";
++
++	avdd-supply = <&cam1_reg>;
++	dovdd-supply = <&cam_dummy_reg>;
++	dvdd-supply = <&cam_dummy_reg>;
++
++	rotation = <0>;
++	orientation = <2>;
++
++	port {
++		cam_endpoint: endpoint {
++			clock-lanes = <0>;
++			data-lanes = <1 2>;
++			clock-noncontinuous;
++			link-frequencies =
++				/bits/ 64 <400000000>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/overlay_map.dts b/arch/arm/boot/dts/overlays/overlay_map.dts
+new file mode 100644
+index 000000000000..2ddf4c7f4323
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/overlay_map.dts
+@@ -0,0 +1,514 @@
++/dts-v1/;
++
++/ {
++	audremap {
++		bcm2835;
++		bcm2711;
++	};
++
++	balena-fin {
++		bcm2835;
++		bcm2711;
++	};
++
++	bmp085_i2c-sensor {
++		deprecated = "use i2c-sensor,bmp085";
++	};
++
++	cm-swap-i2c0 {
++		bcm2835;
++		bcm2711;
++	};
++
++	cutiepi-panel {
++		bcm2711;
++	};
++
++	disable-bt {
++		bcm2835;
++		bcm2711;
++		bcm2712 = "disable-bt-pi5";
++	};
++
++	disable-bt-pi5 {
++		bcm2712;
++	};
++
++	disable-emmc2 {
++		bcm2711;
++	};
++
++	disable-wifi {
++		bcm2835;
++		bcm2711;
++		bcm2712 = "disable-wifi-pi5";
++	};
++
++	disable-wifi-pi5 {
++		bcm2712;
++	};
++
++	hifiberry-adc8x {
++		bcm2712;
++	};
++
++	hifiberry-dac8x {
++		bcm2712;
++	};
++
++	highperi {
++		bcm2711;
++	};
++
++	i2c0 {
++		bcm2835;
++		bcm2711;
++		bcm2712 = "i2c0-pi5";
++	};
++
++	i2c0-bcm2708 {
++		deprecated = "use i2c0";
++	};
++
++	i2c0-pi5 {
++		bcm2712;
++	};
++
++	i2c1 {
++		bcm2835;
++		bcm2711;
++		bcm2712 = "i2c1-pi5";
++	};
++
++	i2c1-bcm2708 {
++		deprecated = "use i2c1";
++	};
++
++	i2c1-pi5 {
++		bcm2712;
++	};
++
++	i2c2 {
++		bcm2712 = "i2c2-pi5";
++	};
++
++	i2c2-pi5 {
++		bcm2712;
++	};
++
++	i2c3 {
++		bcm2711;
++		bcm2712 = "i2c3-pi5";
++	};
++
++	i2c3-pi5 {
++		bcm2712;
++	};
++
++	i2c4 {
++		bcm2711;
++	};
++
++	i2c5 {
++		bcm2711;
++	};
++
++	i2c6 {
++		bcm2711;
++	};
++
++	i2s-gpio28-31 {
++		bcm2835;
++		bcm2711;
++	};
++
++	imx500 {
++		bcm2835;
++		bcm2711;
++		bcm2712 = "imx500-pi5";
++	};
++
++	imx500-pi5 {
++		bcm2712;
++	};
++
++	lirc-rpi {
++		deprecated = "use gpio-ir";
++	};
++
++	midi-uart0 {
++		bcm2835;
++		bcm2711;
++		bcm2712 = "midi-uart0-pi5";
++	};
++
++	midi-uart0-pi5 {
++		bcm2712;
++	};
++
++	midi-uart1 {
++		bcm2835;
++		bcm2711;
++		bcm2712 = "midi-uart1-pi5";
++	};
++
++	midi-uart1-pi5 {
++		bcm2712;
++	};
++
++	midi-uart2 {
++		bcm2711;
++		bcm2712 = "midi-uart2-pi5";
++	};
++
++	midi-uart2-pi5 {
++		bcm2712;
++	};
++
++	midi-uart3 {
++		bcm2711;
++		bcm2712 = "midi-uart3-pi5";
++	};
++
++	midi-uart3-pi5 {
++		bcm2712;
++	};
++
++	midi-uart4 {
++		bcm2711;
++		bcm2712 = "midi-uart4-pi5";
++	};
++
++	midi-uart4-pi5 {
++		bcm2712;
++	};
++
++	midi-uart5 {
++		bcm2711;
++	};
++
++	miniuart-bt {
++		bcm2835;
++		bcm2711;
++	};
++
++	mmc {
++		bcm2835;
++		bcm2711;
++	};
++
++	mpu6050 {
++		deprecated = "use i2c-sensor,mpu6050";
++	};
++
++	pcie-32bit-dma {
++		bcm2711;
++		bcm2712 = "pcie-32bit-dma-pi5";
++	};
++
++	pcie-32bit-dma-pi5 {
++		bcm2712;
++	};
++
++	pcie-compat-pi5 {
++		bcm2712;
++	};
++
++	pi3-act-led {
++		renamed = "act-led";
++	};
++
++	pi3-disable-bt {
++		renamed = "disable-bt";
++	};
++
++	pi3-disable-wifi {
++		renamed = "disable-wifi";
++	};
++
++	pi3-miniuart-bt {
++		renamed = "miniuart-bt";
++	};
++
++	pisound {
++		bcm2835;
++		bcm2711;
++		bcm2712 = "pisound-pi5";
++	};
++
++	pisound-pi5 {
++		bcm2712;
++	};
++
++	pwm1 {
++		bcm2711;
++	};
++
++	ramoops {
++		bcm2835;
++		bcm2711 = "ramoops-pi4";
++		bcm2712 = "ramoops-pi4";
++	};
++
++	ramoops-pi4 {
++		bcm2711;
++		bcm2712;
++	};
++
++	rpi-cirrus-wm5102 {
++		renamed = "cirrus-wm5102";
++	};
++
++	rpi-dac {
++		renamed = "i2s-dac";
++	};
++
++	rpi-display {
++		renamed = "watterott-display";
++	};
++
++	rpi-proto {
++		renamed = "proto-codec";
++	};
++
++	rpivid-v4l2 {
++		deprecated = "no longer necessary";
++	};
++
++	sdhost {
++		bcm2835;
++		bcm2711;
++	};
++
++	sdio {
++		bcm2835;
++		bcm2711;
++		bcm2712 = "sdio-pi5";
++	};
++
++	sdio-1bit {
++		deprecated = "use sdio,bus_width=1,gpios_22_25";
++	};
++
++	sdio-pi5 {
++		bcm2712;
++	};
++
++	sdtweak {
++		deprecated = "use 'dtparam=sd_poll_once' etc.";
++	};
++
++	smi {
++		bcm2835;
++		bcm2711;
++	};
++
++	smi-dev {
++		bcm2835;
++		bcm2711;
++	};
++
++	smi-nand {
++		bcm2835;
++		bcm2711;
++	};
++
++	spi0-cs {
++		renamed = "spi0-2cs";
++	};
++
++	spi0-hw-cs {
++		deprecated = "no longer necessary";
++	};
++
++	spi2-1cs {
++		bcm2835;
++		bcm2711;
++		bcm2712 = "spi2-1cs-pi5";
++	};
++
++	spi2-1cs-pi5 {
++		bcm2712;
++	};
++
++	spi2-2cs {
++		bcm2835;
++		bcm2711;
++		bcm2712 = "spi2-2cs-pi5";
++	};
++
++	spi2-2cs-pi5 {
++		bcm2712;
++	};
++
++	spi3-1cs {
++		bcm2711;
++		bcm2712 = "spi3-1cs-pi5";
++	};
++
++	spi3-1cs-pi5 {
++		bcm2712;
++	};
++
++	spi3-2cs {
++		bcm2711;
++		bcm2712 = "spi3-2cs-pi5";
++	};
++
++	spi3-2cs-pi5 {
++		bcm2712;
++	};
++
++	spi4-1cs {
++		bcm2711;
++	};
++
++	spi4-2cs {
++		bcm2711;
++	};
++
++	spi5-1cs {
++		bcm2711;
++		bcm2712 = "spi5-1cs-pi5";
++	};
++
++	spi5-1cs-pi5 {
++		bcm2712;
++	};
++
++	spi5-2cs {
++		bcm2711;
++		bcm2712 = "spi5-2cs-pi5";
++	};
++
++	spi5-2cs-pi5 {
++		bcm2712;
++	};
++
++	spi6-1cs {
++		bcm2711;
++	};
++
++	spi6-2cs {
++		bcm2711;
++	};
++
++	uart0 {
++		bcm2835;
++		bcm2711;
++		bcm2712 = "uart0-pi5";
++	};
++
++	uart0-pi5 {
++		bcm2712;
++	};
++
++	uart1 {
++		bcm2835;
++		bcm2711;
++		bcm2712 = "uart1-pi5";
++	};
++
++	uart1-pi5 {
++		bcm2712;
++	};
++
++	uart2 {
++		bcm2711;
++		bcm2712 = "uart2-pi5";
++	};
++
++	uart2-pi5 {
++		bcm2712;
++	};
++
++	uart3 {
++		bcm2711;
++		bcm2712 = "uart3-pi5";
++	};
++
++	uart3-pi5 {
++		bcm2712;
++	};
++
++	uart4 {
++		bcm2711;
++		bcm2712 = "uart4-pi5";
++	};
++
++	uart4-pi5 {
++		bcm2712;
++	};
++
++	uart5 {
++		bcm2711;
++	};
++
++	upstream {
++		bcm2835;
++		bcm2711 = "upstream-pi4";
++	};
++
++	upstream-aux-interrupt {
++		deprecated = "no longer necessary";
++	};
++
++	upstream-pi4 {
++		bcm2711;
++	};
++
++	vc4-fkms-v3d {
++		bcm2835;
++		bcm2711 = "vc4-fkms-v3d-pi4";
++		bcm2712 = "vc4-fkms-v3d-pi4";
++	};
++
++	vc4-fkms-v3d-pi4 {
++		bcm2711;
++		bcm2712;
++	};
++
++	vc4-kms-dpi-at056tn53v1 {
++		deprecated = "use vc4-kms-dpi-panel,at056tn53v1";
++	};
++
++	vc4-kms-v3d {
++		bcm2835;
++		bcm2711 = "vc4-kms-v3d-pi4";
++		bcm2712 = "vc4-kms-v3d-pi5";
++	};
++
++	vc4-kms-v3d-pi4 {
++		bcm2711;
++		bcm2712 = "vc4-kms-v3d-pi5";
++	};
++
++	vc4-kms-v3d-pi5 {
++		bcm2712;
++	};
++
++	vl805 {
++		bcm2711;
++	};
++
++	w1-gpio {
++		bcm2835;
++		bcm2711;
++		bcm2712 = "w1-gpio-pi5";
++	};
++
++	w1-gpio-pi5 {
++		bcm2712;
++	};
++
++	w1-gpio-pullup {
++		bcm2835;
++		bcm2711;
++		bcm2712 = "w1-gpio-pullup-pi5";
++	};
++
++	w1-gpio-pullup-pi5 {
++		bcm2712;
++	};
++
++};
+diff --git a/arch/arm/boot/dts/overlays/papirus-overlay.dts b/arch/arm/boot/dts/overlays/papirus-overlay.dts
+new file mode 100644
+index 000000000000..67052b53a59c
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/papirus-overlay.dts
+@@ -0,0 +1,84 @@
++/* PaPiRus ePaper Screen by Pi Supply */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_arm>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			display_temp: lm75@48 {
++				compatible = "national,lm75b";
++				reg = <0x48>;
++				status = "okay";
++				#thermal-sensor-cells = <0>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target-path = "/thermal-zones";
++		__overlay__ {
++			display {
++				polling-delay-passive = <0>;
++				polling-delay = <0>;
++				thermal-sensors = <&display_temp>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			repaper_pins: repaper_pins {
++				brcm,pins = <14 15 23 24 25>;
++				brcm,function = <1 1 1 1 0>; /* out out out out in */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			repaper: repaper@0{
++				compatible = "not_set";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&repaper_pins>;
++
++				spi-max-frequency = <8000000>;
++
++				panel-on-gpios = <&gpio 23 0>;
++				border-gpios = <&gpio 14 0>;
++				discharge-gpios = <&gpio 15 0>;
++				reset-gpios = <&gpio 24 0>;
++				busy-gpios = <&gpio 25 0>;
++
++				repaper-thermal-zone = "display";
++			};
++		};
++	};
++
++	__overrides__ {
++		panel = <&repaper>, "compatible";
++		speed = <&repaper>, "spi-max-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pca953x-overlay.dts b/arch/arm/boot/dts/overlays/pca953x-overlay.dts
+new file mode 100644
+index 000000000000..ab414e92e366
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pca953x-overlay.dts
+@@ -0,0 +1,240 @@
++// Definitions for NXP PCA953x family of I2C GPIO controllers on ARM I2C bus.
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_arm>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pca: pca@20 {
++				compatible = "nxp,pca9534";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca6416";
++		};
++	};
++	fragment@2 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9505";
++		};
++	};
++	fragment@3 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9535";
++		};
++	};
++	fragment@4 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9536";
++		};
++	};
++	fragment@5 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9537";
++		};
++	};
++	fragment@6 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9538";
++		};
++	};
++	fragment@7 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9539";
++		};
++	};
++	fragment@8 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9554";
++		};
++	};
++	fragment@9 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9555";
++		};
++	};
++	fragment@10 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9556";
++		};
++	};
++	fragment@11 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9557";
++		};
++	};
++	fragment@12 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9574";
++		};
++	};
++	fragment@13 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9575";
++		};
++	};
++	fragment@14 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pca9698";
++		};
++	};
++	fragment@15 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pcal6416";
++		};
++	};
++	fragment@16 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pcal6524";
++		};
++	};
++	fragment@17 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "nxp,pcal9555a";
++		};
++	};
++	fragment@18 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "maxim,max7310";
++		};
++	};
++	fragment@19 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "maxim,max7312";
++		};
++	};
++	fragment@20 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "maxim,max7313";
++		};
++	};
++	fragment@21 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "maxim,max7315";
++		};
++	};
++	fragment@22 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "ti,pca6107";
++		};
++	};
++	fragment@23 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "ti,tca6408";
++		};
++	};
++	fragment@24 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "ti,tca6416";
++		};
++	};
++	fragment@25 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "ti,tca6424";
++		};
++	};
++	fragment@26 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "ti,tca9539";
++		};
++	};
++	fragment@27 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "ti,tca9554";
++		};
++	};
++	fragment@28 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "onnn,cat9554";
++		};
++	};
++	fragment@29 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "onnn,pca9654";
++		};
++	};
++	fragment@30 {
++		target = <&pca>;
++		__dormant__ {
++			compatible = "exar,xra1202";
++		};
++	};
++
++	__overrides__ {
++		addr = <&pca>,"reg:0";
++		pca6416 = <0>, "+1";
++		pca9505 = <0>, "+2";
++		pca9535 = <0>, "+3";
++		pca9536 = <0>, "+4";
++		pca9537 = <0>, "+5";
++		pca9538 = <0>, "+6";
++		pca9539 = <0>, "+7";
++		pca9554 = <0>, "+8";
++		pca9555 = <0>, "+9";
++		pca9556 = <0>, "+10";
++		pca9557 = <0>, "+11";
++		pca9574 = <0>, "+12";
++		pca9575 = <0>, "+13";
++		pca9698 = <0>, "+14";
++		pcal6416 = <0>, "+15";
++		pcal6524 = <0>, "+16";
++		pcal9555a = <0>, "+17";
++		max7310 = <0>, "+18";
++		max7312 = <0>, "+19";
++		max7313 = <0>, "+20";
++		max7315 = <0>, "+21";
++		pca6107 = <0>, "+22";
++		tca6408 = <0>, "+23";
++		tca6416 = <0>, "+24";
++		tca6424 = <0>, "+25";
++		tca9539 = <0>, "+26";
++		tca9554 = <0>, "+27";
++		cat9554 = <0>, "+28";
++		pca9654 = <0>, "+29";
++		xra1202 = <0>, "+30";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pcf857x-overlay.dts b/arch/arm/boot/dts/overlays/pcf857x-overlay.dts
+new file mode 100644
+index 000000000000..68943e1c3320
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pcf857x-overlay.dts
+@@ -0,0 +1,32 @@
++// Definitions for PCF857X GPIO Extender from NXP
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_arm>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pcf857x: pcf857x@0 {
++				compatible = "";
++				reg = <0x00>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		pcf8574  = <&pcf857x>,"compatible=nxp,pcf8574",  <&pcf857x>,"reg:0=0x20";
++		pcf8574a = <&pcf857x>,"compatible=nxp,pcf8574a", <&pcf857x>,"reg:0=0x38";
++		pcf8575  = <&pcf857x>,"compatible=nxp,pcf8575",  <&pcf857x>,"reg:0=0x20";
++		pca8574  = <&pcf857x>,"compatible=nxp,pca8574", <&pcf857x>,"reg:0=0x20";
++		addr = <&pcf857x>,"reg:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pcie-32bit-dma-overlay.dts b/arch/arm/boot/dts/overlays/pcie-32bit-dma-overlay.dts
+new file mode 100644
+index 000000000000..955703563df7
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pcie-32bit-dma-overlay.dts
+@@ -0,0 +1,38 @@
++/*
++ * pcie-32bit-dma-overlay.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target-path = "/aliases";
++		__overlay__ {
++			/*
++			 * Removing this alias stops the firmware patching the
++			 * PCIE DT dma-ranges based on the detected chip
++			 * revision.
++			 */
++			pcie0 = "";
++		};
++	};
++
++	fragment@1 {
++		target = <&pcie0>;
++		__overlay__ {
++			/*
++			 * The size of the range is rounded up to a power of 2,
++			 * so the range ends up being 0-4GB, and the MSI vector
++			 * gets pushed beyond 4GB.
++			 */
++			#address-cells = <3>;
++			#size-cells = <2>;
++			dma-ranges = <0x02000000 0x0 0x00000000 0x0 0x00000000
++				      0x0 0x80000000>;
++		};
++	};
++
++};
+diff --git a/arch/arm/boot/dts/overlays/pcie-32bit-dma-pi5-overlay.dts b/arch/arm/boot/dts/overlays/pcie-32bit-dma-pi5-overlay.dts
+new file mode 100644
+index 000000000000..f9908494f101
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pcie-32bit-dma-pi5-overlay.dts
+@@ -0,0 +1,26 @@
++/*
++ * pcie-32bit-dma-pi5-overlay.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&pcie1>;
++		__overlay__ {
++			/*
++			 * The size of the range is rounded up to a power of 2,
++			 * so the range ends up being 0-4GB, and the MSI vector
++			 * gets pushed beyond 4GB.
++			 */
++			#address-cells = <3>;
++			#size-cells = <2>;
++			dma-ranges = <0x02000000 0x0 0x00000000 0x0 0x00000000
++				      0x0 0x80000000>;
++		};
++	};
++
++};
+diff --git a/arch/arm/boot/dts/overlays/pciex1-compat-pi5-overlay.dts b/arch/arm/boot/dts/overlays/pciex1-compat-pi5-overlay.dts
+new file mode 100644
+index 000000000000..77d59bbc86ce
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pciex1-compat-pi5-overlay.dts
+@@ -0,0 +1,60 @@
++/*
++ * Various feature switches for the 1-lane PCIe controller on Pi 5
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2712";
++
++	/* Enable L1 sub-state support */
++	fragment@0 {
++		target = <&pciex1>;
++		__dormant__ {
++			brcm,enable-l1ss;
++		};
++	};
++
++	/* Disable ASPM L0s */
++	fragment@1 {
++		target = <&pciex1>;
++		__dormant__ {
++			aspm-no-l0s;
++		};
++	};
++
++	/* Use RC MSI target instead of MIP MSIx target */
++	fragment@2 {
++		target = <&pciex1>;
++		__dormant__ {
++			msi-parent = <&pciex1>;
++		};
++	};
++
++	/*
++	 * Shift the start of the 32bit outbound window to 2GB,
++	 * so there are no BARs starting at 0x0. Expand the 64bit
++	 * outbound window to use the spare 2GB.
++	 */
++	fragment@3 {
++		target = <&pciex1>;
++		__dormant__ {
++			#address-cells = <3>;
++			#size-cells = <2>;
++			ranges = <0x02000000 0x00 0x80000000
++				  0x1b 0x80000000
++				  0x00 0x7ffffffc>,
++				 <0x43000000 0x04 0x00000000
++				  0x18 0x00000000
++				  0x03 0x80000000>;
++		};
++	};
++
++	__overrides__ {
++		l1ss = <0>, "+0";
++		no-l0s = <0>, "+1";
++		no-mip = <0>, "+2";
++		mmio-hi = <0>, "+3";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pibell-overlay.dts b/arch/arm/boot/dts/overlays/pibell-overlay.dts
+new file mode 100644
+index 000000000000..99d4b6d97969
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pibell-overlay.dts
+@@ -0,0 +1,81 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++    compatible = "brcm,bcm2835";
++
++    fragment@0 {
++        target-path = "/";
++        __overlay__ {
++            codec_out: spdif-transmitter {
++                #address-cells = <0>;
++                #size-cells = <0>;
++                #sound-dai-cells = <0>;
++                compatible = "linux,spdif-dit";
++                status = "okay";
++            };
++
++            codec_in: card-codec {
++                #sound-dai-cells = <0>;
++                compatible = "invensense,ics43432";
++                status = "okay";
++            };
++        };
++    };
++
++    fragment@1 {
++        target = <&i2s_clk_producer>;
++        __overlay__ {
++            #sound-dai-cells = <0>;
++            status = "okay";
++        };
++    };
++
++    fragment@2 {
++        target = <&sound>;
++        snd: __overlay__ {
++            compatible = "simple-audio-card";
++            simple-audio-card,name = "PiBell";
++
++            status="okay";
++
++            capture_link: simple-audio-card,dai-link@0 {
++                format = "i2s";
++
++                r_cpu_dai: cpu {
++                    sound-dai = <&i2s_clk_producer>;
++
++/* example TDM slot configuration
++                    dai-tdm-slot-num = <2>;
++                    dai-tdm-slot-width = <32>;
++*/
++                };
++
++                r_codec_dai: codec {
++                    sound-dai = <&codec_in>;
++                };
++            };
++
++            playback_link: simple-audio-card,dai-link@1 {
++                format = "i2s";
++
++                p_cpu_dai: cpu {
++                    sound-dai = <&i2s_clk_producer>;
++
++/* example TDM slot configuration
++                    dai-tdm-slot-num = <2>;
++                    dai-tdm-slot-width = <32>;
++*/
++                };
++
++                p_codec_dai: codec {
++                    sound-dai = <&codec_out>;
++                };
++            };
++        };
++    };
++
++    __overrides__ {
++        alsaname = <&snd>, "simple-audio-card,name";
++    };
++};
+diff --git a/arch/arm/boot/dts/overlays/pifacedigital-overlay.dts b/arch/arm/boot/dts/overlays/pifacedigital-overlay.dts
+new file mode 100644
+index 000000000000..532a858683d6
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pifacedigital-overlay.dts
+@@ -0,0 +1,144 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * PiFace Digital, Device Tree Overlay.
++ * Copyright (C) 2020 Thomas Preston <thomas.preston@codethink.co.uk>
++ *
++ * The PiFace Digital is a convenient breakout board for the Microchip mcp23s17
++ * SPI GPIO port expander.
++ *
++ * The first eight GPIOs 0..7 (bank A) are connected to eight output terminals
++ * and LEDs, plus two relays on the first two outputs. These output loads are
++ * active-high.
++ *
++ * The next eight GPIOs 8..15 (bank B) are connected to eight input terminals
++ * with four on-board switches connecting them to ground. Inputs devices are
++ * therefore expected to bridge terminals to ground, so the mcp23s17 pullups are
++ * activated for GPIO bank B.
++ *
++ * On PiFace Digital, the mcp23s17 is connected to the Raspberry Pi's SPI0 CS0
++ * bus. Each SPI bus supports up to eight addressable child devices. The PiFace
++ * Digital only supports addresses 0-4, which can be configured by jumpers JP1
++ * and JP2.
++ *
++ * You can tell the driver about these jumper configurations with the
++ * spi-present-mask bitmask:
++ *
++ *     | JP1 | JP2 | dtoverlay line in /boot/config.txt         |
++ *     | --- | --- | ------------------------------------------ |
++ *     |  0  |  0  | dtoverlay=pifacedigital                    |
++ *     |  0  |  0  | dtoverlay=pifacedigital:spi-present-mask=1 |
++ *     |  0  |  1  | dtoverlay=pifacedigital:spi-present-mask=2 |
++ *     |  1  |  0  | dtoverlay=pifacedigital:spi-present-mask=4 |
++ *     |  1  |  1  | dtoverlay=pifacedigital:spi-present-mask=8 |
++ *
++ * # Example
++ * Set the dtoverlay config in /boot/config.txt and power off the Raspberry Pi:
++ *
++ *     $ grep pifacedigital /boot/config.txt
++ *     dtoverlay=pifacedigital
++ *     $ sudo systemctl poweroff
++ *
++ * Attach the PiFace Digital and power on the Raspberry Pi.
++ * Then use the libgpiod tools to query the device:
++ *
++ *     $ sudo apt install gpiod
++ *     $ gpiodetect | grep mcp23s17
++ *     gpiochip2 [mcp23s17.0] (16 lines)
++ *
++ * Set GPIO outputs 0, 2 and 5:
++ *
++ *     $ gpioset gpiochip2 0=1 2=1 5=1
++ *
++ * Get GPIO status (input GPIO 8..15 are high, because they are active-low):
++ *
++ *     $ gpioget gpiochip2 {8..15}
++ *     1 1 1 1 1 1 1 1
++ *
++ * And even monitor interrupts:
++ *
++ *     $ gpiomon gpiochip2 {8..15}
++ *     event: FALLING EDGE offset: 11 timestamp: [1597361662.926741667]
++ *     event:  RISING EDGE offset: 11 timestamp: [1597361663.062555051]
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	/* Disable exposing /dev/spidev0.0 */
++	fragment@0 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	/* Add the PiFace Digital device node to the spi0.0 device. */
++	fragment@1 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pfdigital: pifacedigital@0 {
++				compatible = "microchip,mcp23s17";
++				reg = <0>;
++
++				/* Set devices present with 8-bit mask. */
++				microchip,spi-present-mask = <0x01>;
++				spi-max-frequency = <500000>;
++
++				gpio-controller;
++				#gpio-cells = <2>;
++
++				/* This device can pass through interrupts. */
++				interrupt-controller;
++				#interrupt-cells = <2>;
++
++				/* INTB is connected to GPIO 25.
++				 * 0x8 active-low level-sensitive
++				 */
++				interrupts = <25 0x8>;
++				interrupt-parent = <&gpio>;
++
++				/* Configure pull-ups on bank B GPIOs */
++				pinctrl-0 = <&pfdigital_irq &pfdigital_pullups>;
++				pinctrl-names = "default";
++				pfdigital_pullups: pinmux {
++					pins =
++						"gpio8",
++						"gpio9",
++						"gpio10",
++						"gpio11",
++						"gpio12",
++						"gpio13",
++						"gpio14",
++						"gpio15";
++					bias-pull-up;
++				};
++			};
++		};
++	};
++
++	/* PiFace Digital mcp23s17 INTB pin is connected to GPIO 25. The INTB
++	 * pin is configured active-low (0 on interrupt), so expect to see
++	 * FALLING_EDGE when inputs are bridged to ground (switch is pressed).
++	 */
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			pfdigital_irq: pifacedigital_irq {
++				brcm,pins = <25>;
++				brcm,function = <0>; /* input */
++			};
++		};
++	};
++
++	__overrides__ {
++		spi-present-mask = <&pfdigital>, "microchip,spi-present-mask:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pifi-40-overlay.dts b/arch/arm/boot/dts/overlays/pifi-40-overlay.dts
+new file mode 100644
+index 000000000000..d9ef4ea4097e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pifi-40-overlay.dts
+@@ -0,0 +1,50 @@
++// Definitions for PiFi-40 Amp
++/dts-v1/;
++/plugin/;
++#include <dt-bindings/gpio/gpio.h>
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			tas5711l: audio-codec@1a {
++				compatible = "ti,tas5711";
++				reg = <0x1a>;
++				#sound-dai-cells = <0>;
++				sound-name-prefix = "Left";
++				status = "okay";
++			};
++
++			tas5711r: audio-codec@1b {
++				compatible = "ti,tas5711";
++				reg = <0x1b>;
++				#sound-dai-cells = <0>;
++				sound-name-prefix = "Right";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		pifi_40: __overlay__ {
++			compatible = "pifi,pifi-40";
++			audio-codec = <&tas5711l &tas5711r>;
++			i2s-controller = <&i2s_clk_producer>;
++			pdn-gpios = <&gpio 23 1>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pifi-dac-hd-overlay.dts b/arch/arm/boot/dts/overlays/pifi-dac-hd-overlay.dts
+new file mode 100644
+index 000000000000..236098365dc2
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pifi-dac-hd-overlay.dts
+@@ -0,0 +1,49 @@
++// Overlay for PiFi-DAC-HD
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells =<0>;
++
++			pcm5142: pcm5142@4c {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5142";
++				reg = <0x4c>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "simple-audio-card";
++			simple-audio-card,name = "PiFi-DAC-HD";
++			status = "okay";
++
++			simple-audio-card,dai-link@1 {
++				format = "i2s";
++				cpu {
++					sound-dai = <&i2s_clk_producer>;
++				};
++				codec {
++					sound-dai = <&pcm5142>;
++				};
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pifi-dac-zero-overlay.dts b/arch/arm/boot/dts/overlays/pifi-dac-zero-overlay.dts
+new file mode 100644
+index 000000000000..dd272388779e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pifi-dac-zero-overlay.dts
+@@ -0,0 +1,49 @@
++// Overlay for PiFi-DAC-Zero
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "simple-audio-card";
++			simple-audio-card,name = "PiFi-DAC-Zero";
++			status = "okay";
++
++			simple-audio-card,dai-link@1 {
++				format = "i2s";
++
++				cpu {
++					sound-dai = <&i2s_clk_producer>;
++					dai-tdm-slot-num = <2>;
++					dai-tdm-slot-width = <32>;
++				};
++
++				codec {
++					sound-dai = <&codec_out>;
++				};
++			};
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			codec_out: pcm5102a-codec {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5102a";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			#sound-dai-cells = <0>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pifi-mini-210-overlay.dts b/arch/arm/boot/dts/overlays/pifi-mini-210-overlay.dts
+new file mode 100644
+index 000000000000..a7b857144a48
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pifi-mini-210-overlay.dts
+@@ -0,0 +1,42 @@
++// Definitions for PiFi Mini 210
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			tas5711@1a {
++				#sound-dai-cells = <0>;
++				compatible = "ti,tas5711";
++				reg = <0x1a>;
++				status = "okay";
++				pdn-gpios = <&gpio 23 1>;
++				reset-gpios = <&gpio 24 1>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "pifi,pifi-mini-210";
++			i2s-controller = <&i2s_clk_producer>;
++
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/piglow-overlay.dts b/arch/arm/boot/dts/overlays/piglow-overlay.dts
+new file mode 100644
+index 000000000000..075bceef158c
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/piglow-overlay.dts
+@@ -0,0 +1,97 @@
++// Definitions for SN3218 LED driver from Si-En Technology on PiGlow
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_arm>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			sn3218@54 {
++				compatible = "si-en,sn3218";
++				reg = <0x54>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++				status = "okay";
++
++				led@1 {
++					reg = <1>;
++					label = "piglow:red:led1";
++				};
++				led@2 {
++					reg = <2>;
++					label = "piglow:orange:led2";
++				};
++				led@3 {
++					reg = <3>;
++					label = "piglow:yellow:led3";
++				};
++				led@4 {
++					reg = <4>;
++					label = "piglow:green:led4";
++				};
++				led@5 {
++					reg = <5>;
++					label = "piglow:blue:led5";
++				};
++				led@6 {
++					reg = <6>;
++					label = "piglow:green:led6";
++				};
++				led@7 {
++					reg = <7>;
++					label = "piglow:red:led7";
++				};
++				led@8 {
++					reg = <8>;
++					label = "piglow:orange:led8";
++				};
++				led@9 {
++					reg = <9>;
++					label = "piglow:yellow:led9";
++				};
++				led@10 {
++					reg = <10>;
++					label = "piglow:white:led10";
++				};
++				led@11 {
++					reg = <11>;
++					label = "piglow:white:led11";
++				};
++				led@12 {
++					reg = <12>;
++					label = "piglow:blue:led12";
++				};
++				led@13 {
++					reg = <13>;
++					label = "piglow:white:led13";
++				};
++				led@14 {
++					reg = <14>;
++					label = "piglow:green:led14";
++				};
++				led@15 {
++					reg = <15>;
++					label = "piglow:blue:led15";
++				};
++				led@16 {
++					reg = <16>;
++					label = "piglow:yellow:led16";
++				};
++				led@17 {
++					reg = <17>;
++					label = "piglow:orange:led17";
++				};
++				led@18 {
++					reg = <18>;
++					label = "piglow:red:led18";
++				};
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pineboards-hat-ai-overlay.dts b/arch/arm/boot/dts/overlays/pineboards-hat-ai-overlay.dts
+new file mode 100644
+index 000000000000..8160272f4705
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pineboards-hat-ai-overlay.dts
+@@ -0,0 +1,18 @@
++/*
++ * Device Tree overlay for Pineboards Hat Ai!.
++ * Compatible with the Google Coral Edge TPU (Single and Dual Edge).
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&pcie1>;
++		__overlay__ {
++			msi-parent = <&pcie1>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pineboards-hatdrive-poe-plus-overlay.dts b/arch/arm/boot/dts/overlays/pineboards-hatdrive-poe-plus-overlay.dts
+new file mode 100644
+index 000000000000..77b8e0d3be31
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pineboards-hatdrive-poe-plus-overlay.dts
+@@ -0,0 +1,19 @@
++/*
++ * Device Tree overlay for Pineboards HatDrive! PoE+.
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target-path = "/chosen";
++		__overlay__ {
++			power: power {
++				hat_current_supply = <5000>;
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/piscreen-overlay.dts b/arch/arm/boot/dts/overlays/piscreen-overlay.dts
+new file mode 100644
+index 000000000000..bd389c8a5e51
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/piscreen-overlay.dts
+@@ -0,0 +1,110 @@
++/*
++ * Device Tree overlay for PiScreen 3.5" display shield by Ozzmaker
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			piscreen_pins: piscreen_pins {
++				brcm,pins = <17 25 24 22>;
++				brcm,function = <0 1 1 1>; /* in out out out */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			piscreen: piscreen@0{
++				compatible = "ilitek,ili9486";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&piscreen_pins>;
++
++				spi-max-frequency = <24000000>;
++				rotate = <270>;
++				bgr;
++				fps = <30>;
++				buswidth = <8>;
++				regwidth = <16>;
++				reset-gpios = <&gpio 25 GPIO_ACTIVE_LOW>;
++				dc-gpios = <&gpio 24 GPIO_ACTIVE_HIGH>;
++				led-gpios = <&gpio 22 GPIO_ACTIVE_HIGH>;
++				debug = <0>;
++
++				init = <0x10000b0 0x00
++				        0x1000011
++					0x20000ff
++					0x100003a 0x55
++					0x1000036 0x28
++					0x10000c2 0x44
++					0x10000c5 0x00 0x00 0x00 0x00
++					0x10000e0 0x0f 0x1f 0x1c 0x0c 0x0f 0x08 0x48 0x98 0x37 0x0a 0x13 0x04 0x11 0x0d 0x00
++					0x10000e1 0x0f 0x32 0x2e 0x0b 0x0d 0x05 0x47 0x75 0x37 0x06 0x10 0x03 0x24 0x20 0x00
++					0x10000e2 0x0f 0x32 0x2e 0x0b 0x0d 0x05 0x47 0x75 0x37 0x06 0x10 0x03 0x24 0x20 0x00
++					0x1000011
++					0x1000029>;
++			};
++
++			piscreen_ts: piscreen-ts@1 {
++				compatible = "ti,ads7846";
++				reg = <1>;
++
++				spi-max-frequency = <2000000>;
++				interrupts = <17 2>; /* high-to-low edge triggered */
++				interrupt-parent = <&gpio>;
++				pendown-gpio = <&gpio 17 GPIO_ACTIVE_LOW>;
++				ti,swap-xy;
++				ti,x-plate-ohms = /bits/ 16 <100>;
++				ti,pressure-max = /bits/ 16 <255>;
++			};
++		};
++	};
++	__overrides__ {
++		speed =		<&piscreen>,"spi-max-frequency:0";
++		rotate =	<&piscreen>,"rotate:0",
++				<&piscreen>,"rotation:0";
++		fps =		<&piscreen>,"fps:0";
++		debug =		<&piscreen>,"debug:0";
++		xohms =		<&piscreen_ts>,"ti,x-plate-ohms;0";
++		drm =		<&piscreen>,"compatible=waveshare,rpi-lcd-35",
++				<&piscreen>,"reset-gpios:8=",<GPIO_ACTIVE_HIGH>;
++		invx =		<&piscreen_ts>,"touchscreen-inverted-x?";
++		invy =		<&piscreen_ts>,"touchscreen-inverted-y?";
++		swapxy =	<&piscreen_ts>,"touchscreen-swapped-x-y!";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/piscreen2r-overlay.dts b/arch/arm/boot/dts/overlays/piscreen2r-overlay.dts
+new file mode 100644
+index 000000000000..4468f4a54bf7
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/piscreen2r-overlay.dts
+@@ -0,0 +1,106 @@
++ /*
++ * Device Tree overlay for PiScreen2 3.5" TFT with resistive touch  by Ozzmaker.com
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			piscreen2_pins: piscreen2_pins {
++				brcm,pins = <17 25 24 22>;
++				brcm,function = <0 1 1 1>; /* in out out out */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			piscreen2: piscreen2@0{
++				compatible = "ilitek,ili9486";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&piscreen2_pins>;
++				bgr;
++				spi-max-frequency = <64000000>;
++				rotate = <90>;
++				fps = <30>;
++				buswidth = <8>;
++				regwidth = <16>;
++				txbuflen = <32768>;
++				reset-gpios = <&gpio 25 1>;
++				dc-gpios = <&gpio 24 0>;
++				led-gpios = <&gpio 22 0>;
++				debug = <0>;
++
++                                init = <0x10000b0 0x00
++                                        0x1000011
++                                        0x20000ff
++                                        0x100003a 0x55
++                                        0x1000036 0x28
++                                        0x10000c0 0x11 0x09
++                                        0x10000c1 0x41
++                                        0x10000c5 0x00 0x00 0x00 0x00
++                                        0x10000b6 0x00 0x02
++                                        0x10000f7 0xa9 0x51 0x2c 0x2
++                                        0x10000be 0x00 0x04
++                                        0x10000e9 0x00
++                                        0x1000011
++                                        0x1000029>;
++
++			};
++
++			piscreen2_ts: piscreen2-ts@1 {
++				compatible = "ti,ads7846";
++				reg = <1>;
++
++				spi-max-frequency = <2000000>;
++				interrupts = <17 2>; /* high-to-low edge triggered */
++				interrupt-parent = <&gpio>;
++				pendown-gpio = <&gpio 17 1>;
++				ti,swap-xy;
++				ti,x-plate-ohms = /bits/ 16 <100>;
++				ti,pressure-max = /bits/ 16 <255>;
++			};
++		};
++	};
++	__overrides__ {
++		speed =		<&piscreen2>,"spi-max-frequency:0";
++		rotate =	<&piscreen2>,"rotate:0";
++		fps =		<&piscreen2>,"fps:0";
++		debug =		<&piscreen2>,"debug:0";
++		xohms =		<&piscreen2_ts>,"ti,x-plate-ohms;0";
++	};
++};
++
+diff --git a/arch/arm/boot/dts/overlays/pisound-overlay.dts b/arch/arm/boot/dts/overlays/pisound-overlay.dts
+new file mode 100644
+index 000000000000..226bcbdf8a09
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pisound-overlay.dts
+@@ -0,0 +1,118 @@
++/*
++ * Pisound Linux kernel module.
++ * Copyright (C) 2016-2024  Vilniaus Blokas UAB, https://blokas.io/pisound
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * as published by the Free Software Foundation; version 2 of the
++ * License.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target = <&spi0>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pisound_spi: pisound_spi@0{
++				compatible = "blokaslabs,pisound-spi";
++				reg = <0>;
++				spi-max-frequency = <1000000>;
++				spi-speed-hz = <150000>;
++			};
++		};
++	};
++
++	fragment@4 {
++		target-path = "/";
++		__overlay__ {
++			pcm5102a-codec {
++				#sound-dai-cells = <0>;
++				compatible = "ti,pcm5102a";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@5 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "blokaslabs,pisound";
++			i2s-controller = <&i2s_clk_consumer>;
++			spi-controller = <&pisound_spi>;
++			status = "okay";
++
++			pinctrl-names = "default";
++			pinctrl-0 = <&pisound_button_pins>;
++
++			osr-gpios =
++				<&gpio 13 GPIO_ACTIVE_HIGH>,
++				<&gpio 26 GPIO_ACTIVE_HIGH>,
++				<&gpio 16 GPIO_ACTIVE_HIGH>;
++
++			reset-gpios =
++				<&gpio 12 GPIO_ACTIVE_HIGH>,
++				<&gpio 24 GPIO_ACTIVE_HIGH>;
++
++			data_available-gpios = <&gpio 25 GPIO_ACTIVE_HIGH>;
++
++			button-gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	fragment@6 {
++		target = <&gpio>;
++		__overlay__ {
++			pisound_button_pins: pisound_button_pins {
++				brcm,pins = <17>;
++				brcm,function = <0>; // Input
++				brcm,pull = <2>; // Pull-Up
++			};
++		};
++	};
++
++	fragment@7 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pisound-pi5-overlay.dts b/arch/arm/boot/dts/overlays/pisound-pi5-overlay.dts
+new file mode 100644
+index 000000000000..a54974c446a0
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pisound-pi5-overlay.dts
+@@ -0,0 +1,31 @@
++/*
++ * Pisound Linux kernel module.
++ * Copyright (C) 2016-2024  Vilniaus Blokas UAB, https://blokas.io/pisound
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * as published by the Free Software Foundation; version 2 of the
++ * License.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include "pisound-overlay.dts"
++
++&pisound_spi {
++	spi-speed-hz = <100000>;
++};
++
++/ {
++	compatible = "brcm,bcm2712";
++};
+diff --git a/arch/arm/boot/dts/overlays/pitft22-overlay.dts b/arch/arm/boot/dts/overlays/pitft22-overlay.dts
+new file mode 100644
+index 000000000000..5759d48aed57
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pitft22-overlay.dts
+@@ -0,0 +1,71 @@
++/*
++ * Device Tree overlay for pitft by Adafruit
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++        };
++
++	fragment@1 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			pitft_pins: pitft_pins {
++				brcm,pins = <25>;
++				brcm,function = <1>; /* out */
++				brcm,pull = <0>; /* none */
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pitft: pitft@0{
++				compatible = "ilitek,ili9340";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&pitft_pins>;
++
++				spi-max-frequency = <32000000>;
++				rotate = <90>;
++				fps = <25>;
++				bgr;
++				buswidth = <8>;
++				dc-gpios = <&gpio 25 0>;
++				debug = <0>;
++			};
++
++		};
++	};
++
++	__overrides__ {
++		speed =   <&pitft>,"spi-max-frequency:0";
++		rotate =  <&pitft>,"rotate:0", /* fbtft */
++				<&pitft>,"rotation:0"; /* drm */
++		fps =     <&pitft>,"fps:0";
++		debug =   <&pitft>,"debug:0";
++		drm =     <&pitft>,"compatible=adafruit,yx240qv29";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pitft28-capacitive-overlay.dts b/arch/arm/boot/dts/overlays/pitft28-capacitive-overlay.dts
+new file mode 100644
+index 000000000000..de98ee7b4496
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pitft28-capacitive-overlay.dts
+@@ -0,0 +1,93 @@
++/*
++ * Device Tree overlay for Adafruit PiTFT 2.8" capacitive touch screen
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			pitft_pins: pitft_pins {
++				brcm,pins = <24 25>;
++				brcm,function = <0 1>; /* in out */
++				brcm,pull = <2 0>; /* pullup none */
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pitft: pitft@0{
++				compatible = "ilitek,ili9340";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&pitft_pins>;
++
++				spi-max-frequency = <32000000>;
++				rotate = <90>;
++				fps = <25>;
++				bgr;
++				buswidth = <8>;
++				dc-gpios = <&gpio 25 0>;
++				debug = <0>;
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&i2c1>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			ft6236: ft6236@38 {
++				compatible = "focaltech,ft6236";
++				reg = <0x38>;
++
++				interrupt-parent = <&gpio>;
++				interrupts = <24 2>;
++				touchscreen-size-x = <240>;
++				touchscreen-size-y = <320>;
++			};
++		};
++	};
++
++	__overrides__ {
++		speed =   <&pitft>,"spi-max-frequency:0";
++		rotate =  <&pitft>,"rotate:0", /* fbtft */
++				<&pitft>,"rotation:0"; /* drm */
++		fps =     <&pitft>,"fps:0";
++		debug =   <&pitft>,"debug:0";
++		drm =     <&pitft>,"compatible=adafruit,yx240qv29";
++		touch-sizex = <&ft6236>,"touchscreen-size-x:0";
++		touch-sizey = <&ft6236>,"touchscreen-size-y:0";
++		touch-invx  = <&ft6236>,"touchscreen-inverted-x?";
++		touch-invy  = <&ft6236>,"touchscreen-inverted-y?";
++		touch-swapxy = <&ft6236>,"touchscreen-swapped-x-y?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pitft28-resistive-overlay.dts b/arch/arm/boot/dts/overlays/pitft28-resistive-overlay.dts
+new file mode 100644
+index 000000000000..bc2597179b9c
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pitft28-resistive-overlay.dts
+@@ -0,0 +1,126 @@
++/*
++ * Device Tree overlay for Adafruit PiTFT 2.8" resistive touch screen
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			pitft_pins: pitft_pins {
++				brcm,pins = <24 25>;
++				brcm,function = <0 1>; /* in out */
++				brcm,pull = <2 0>; /* pullup none */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pitft: pitft@0{
++				compatible = "ilitek,ili9340";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&pitft_pins>;
++
++				spi-max-frequency = <32000000>;
++				rotate = <90>;
++				fps = <25>;
++				bgr;
++				buswidth = <8>;
++				dc-gpios = <&gpio 25 0>;
++				debug = <0>;
++			};
++
++			pitft_ts@1 {
++				/* needed to avoid dtc warning */
++				#address-cells = <1>;
++				#interrupt-cells = <1>;
++				compatible = "st,stmpe610";
++				reg = <1>;
++
++				spi-max-frequency = <500000>;
++				interrupts = <24 2>; /* high-to-low edge triggered */
++				interrupt-parent = <&gpio>;
++				interrupt-controller;
++
++				stmpe_touchscreen: stmpe_touchscreen {
++					compatible = "st,stmpe-ts";
++					st,sample-time = <4>;
++					st,mod-12b = <1>;
++					st,ref-sel = <0>;
++					st,adc-freq = <2>;
++					st,ave-ctrl = <3>;
++					st,touch-det-delay = <4>;
++					st,settling = <2>;
++					st,fraction-z = <7>;
++					st,i-drive = <0>;
++				};
++
++				stmpe_gpio: stmpe_gpio {
++					#gpio-cells = <2>;
++					compatible = "st,stmpe-gpio";
++					/*
++					 * only GPIO2 is wired/available
++					 * and it is wired to the backlight
++					 */
++					st,norequest-mask = <0x7b>;
++				};
++			};
++		};
++	};
++
++	fragment@5 {
++		target-path = "/soc";
++		__overlay__ {
++			backlight {
++				compatible = "gpio-backlight";
++				gpios = <&stmpe_gpio 2 0>;
++				default-on;
++			};
++		};
++	};
++
++	__overrides__ {
++		speed =   <&pitft>,"spi-max-frequency:0";
++		rotate =  <&pitft>,"rotate:0", /* fbtft */
++			  <&pitft>,"rotation:0"; /* drm */
++		fps =     <&pitft>,"fps:0";
++		debug =   <&pitft>,"debug:0";
++		drm =     <&pitft>,"compatible=adafruit,yx240qv29";
++		touch-invx  = <&stmpe_touchscreen>,"touchscreen-inverted-x?";
++		touch-invy  = <&stmpe_touchscreen>,"touchscreen-inverted-y?";
++		touch-swapxy = <&stmpe_touchscreen>,"touchscreen-swapped-x-y?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pitft35-resistive-overlay.dts b/arch/arm/boot/dts/overlays/pitft35-resistive-overlay.dts
+new file mode 100644
+index 000000000000..c3e81ef6003a
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pitft35-resistive-overlay.dts
+@@ -0,0 +1,127 @@
++/*
++ * Device Tree overlay for Adafruit PiTFT 3.5" resistive touch screen
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			pitft_pins: pitft_pins {
++				brcm,pins = <24 25>;
++				brcm,function = <0 1>; /* in out */
++				brcm,pull = <2 0>; /* pullup none */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			pitft: pitft@0{
++				compatible = "himax,hx8357d";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&pitft_pins>;
++
++				spi-max-frequency = <32000000>;
++				rotate = <90>;
++				fps = <25>;
++				bgr;
++				buswidth = <8>;
++				dc-gpios = <&gpio 25 0>;
++				debug = <0>;
++			};
++
++			pitft_ts@1 {
++				/* needed to avoid dtc warning */
++				#address-cells = <1>;
++				#interrupt-cells = <1>;
++				compatible = "st,stmpe610";
++				reg = <1>;
++
++				spi-max-frequency = <500000>;
++				interrupts = <24 2>; /* high-to-low edge triggered */
++				interrupt-parent = <&gpio>;
++				interrupt-controller;
++
++				stmpe_touchscreen: stmpe_touchscreen {
++					compatible = "st,stmpe-ts";
++					st,sample-time = <4>;
++					st,mod-12b = <1>;
++					st,ref-sel = <0>;
++					st,adc-freq = <2>;
++					st,ave-ctrl = <3>;
++					st,touch-det-delay = <4>;
++					st,settling = <2>;
++					st,fraction-z = <7>;
++					st,i-drive = <0>;
++				};
++
++				stmpe_gpio: stmpe_gpio {
++					#gpio-cells = <2>;
++					compatible = "st,stmpe-gpio";
++					/*
++					 * only GPIO2 is wired/available
++					 * and it is wired to the backlight
++					 */
++					st,norequest-mask = <0x7b>;
++				};
++			};
++		};
++	};
++
++	fragment@5 {
++		target-path = "/soc";
++		__overlay__ {
++			backlight: backlight {
++				compatible = "gpio-backlight";
++				gpios = <&stmpe_gpio 2 0>;
++				default-on;
++			};
++		};
++	};
++
++	__overrides__ {
++		speed =   <&pitft>,"spi-max-frequency:0";
++		rotate =  <&pitft>,"rotate:0", /* fbtft */
++			  <&pitft>,"rotation:0"; /* drm */
++		fps =     <&pitft>,"fps:0";
++		debug =   <&pitft>,"debug:0";
++		drm =     <&pitft>,"compatible=adafruit,yx350hv15",
++			  <&pitft>,"backlight:0=",<&backlight>;
++		touch-invx  = <&stmpe_touchscreen>,"touchscreen-inverted-x?";
++		touch-invy  = <&stmpe_touchscreen>,"touchscreen-inverted-y?";
++		touch-swapxy = <&stmpe_touchscreen>,"touchscreen-swapped-x-y?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pps-gpio-overlay.dts b/arch/arm/boot/dts/overlays/pps-gpio-overlay.dts
+new file mode 100644
+index 000000000000..a4f6b868aad8
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pps-gpio-overlay.dts
+@@ -0,0 +1,39 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			pps: pps@12 {
++				compatible = "pps-gpio";
++				pinctrl-names = "default";
++				pinctrl-0 = <&pps_pins>;
++				gpios = <&gpio 18 0>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			pps_pins: pps_pins@12 {
++				brcm,pins =     <18>;
++				brcm,function = <0>;    // in
++				brcm,pull =     <0>;    // off
++			};
++		};
++	};
++
++	__overrides__ {
++		gpiopin = <&pps>,"gpios:4",
++			  <&pps>,"reg:0",
++			  <&pps_pins>,"brcm,pins:0",
++			  <&pps_pins>,"reg:0";
++		assert_falling_edge = <&pps>,"assert-falling-edge?";
++		capture_clear = <&pps>,"capture-clear?";
++		pull = <&pps_pins>,"brcm,pull:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/proto-codec-overlay.dts b/arch/arm/boot/dts/overlays/proto-codec-overlay.dts
+new file mode 100644
+index 000000000000..92f6ed158923
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/proto-codec-overlay.dts
+@@ -0,0 +1,39 @@
++// Definitions for Rpi-Proto
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			wm8731@1a {
++				#sound-dai-cells = <0>;
++				compatible = "wlf,wm8731";
++				reg = <0x1a>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "rpi,rpi-proto";
++			i2s-controller = <&i2s_clk_consumer>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pwm-2chan-overlay.dts b/arch/arm/boot/dts/overlays/pwm-2chan-overlay.dts
+new file mode 100644
+index 000000000000..823c8b4126d1
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pwm-2chan-overlay.dts
+@@ -0,0 +1,48 @@
++/dts-v1/;
++/plugin/;
++
++/*
++This is the 2-channel overlay - only use it if you need both channels.
++
++Legal pin,function combinations for each channel:
++  PWM0: 12,4(Alt0) 18,2(Alt5) 40,4(Alt0)            52,5(Alt1)
++  PWM1: 13,4(Alt0) 19,2(Alt5) 41,4(Alt0) 45,4(Alt0) 53,5(Alt1)
++
++N.B.:
++  1) Pin 18 is the only one available on all platforms, and
++     it is the one used by the I2S audio interface.
++     Pins 12 and 13 might be better choices on an A+, B+ or Pi2.
++  2) The onboard analogue audio output uses both PWM channels.
++  3) So be careful mixing audio and PWM.
++*/
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			pwm_pins: pwm_pins {
++				brcm,pins = <18 19>;
++				brcm,function = <2 2>; /* Alt5 */
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&pwm>;
++		frag1: __overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&pwm_pins>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		pin   = <&pwm_pins>,"brcm,pins:0";
++		pin2  = <&pwm_pins>,"brcm,pins:4";
++		func  = <&pwm_pins>,"brcm,function:0";
++		func2 = <&pwm_pins>,"brcm,function:4";
++		clock = <&frag1>,"assigned-clock-rates:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pwm-gpio-overlay.dts b/arch/arm/boot/dts/overlays/pwm-gpio-overlay.dts
+new file mode 100644
+index 000000000000..f5a1fb38e257
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pwm-gpio-overlay.dts
+@@ -0,0 +1,38 @@
++// Device tree overlay for software GPIO PWM.
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			pwm_gpio_pins: pwm_gpio_pins@4 {
++				brcm,pins = <4>; /* gpio 4 */
++				brcm,function = <1>; /* output */
++				brcm,pull = <0>; /* pull-none */
++			};
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			pwm_gpio: pwm_gpio@4 {
++				  compatible = "pwm-gpio";
++				  pinctrl-names = "default";
++				  pinctrl-0 = <&pwm_gpio_pins>;
++				  gpios = <&gpio 4 0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		gpio = <&pwm_gpio>,"gpios:4",
++		       <&pwm_gpio_pins>,"brcm,pins:0",
++		       /* modify reg values to allow multiple instantiation */
++		       <&pwm_gpio>,"reg:0",
++		       <&pwm_gpio_pins>,"reg:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pwm-ir-tx-overlay.dts b/arch/arm/boot/dts/overlays/pwm-ir-tx-overlay.dts
+new file mode 100644
+index 000000000000..33597eb79729
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pwm-ir-tx-overlay.dts
+@@ -0,0 +1,40 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			pwm0_pins: pwm0_pins {
++				brcm,pins = <18>;
++				brcm,function = <2>; /* Alt5 */
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&pwm>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&pwm0_pins>;
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target-path = "/";
++		__overlay__ {
++			pwm-ir-transmitter {
++				compatible = "pwm-ir-tx";
++				pwms = <&pwm 0 100 0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		gpio_pin = <&pwm0_pins>, "brcm,pins:0";
++		func = <&pwm0_pins>,"brcm,function:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pwm-overlay.dts b/arch/arm/boot/dts/overlays/pwm-overlay.dts
+new file mode 100644
+index 000000000000..32853492aaea
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pwm-overlay.dts
+@@ -0,0 +1,44 @@
++/dts-v1/;
++/plugin/;
++
++/*
++Legal pin,function combinations for each channel:
++  PWM0: 12,4(Alt0) 18,2(Alt5) 40,4(Alt0)            52,5(Alt1)
++  PWM1: 13,4(Alt0) 19,2(Alt5) 41,4(Alt0) 45,4(Alt0) 53,5(Alt1)
++
++N.B.:
++  1) Pin 18 is the only one available on all platforms, and
++     it is the one used by the I2S audio interface.
++     Pins 12 and 13 might be better choices on an A+, B+ or Pi2.
++  2) The onboard analogue audio output uses both PWM channels.
++  3) So be careful mixing audio and PWM.
++*/
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			pwm_pins: pwm_pins {
++				brcm,pins = <18>;
++				brcm,function = <2>; /* Alt5 */
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&pwm>;
++		frag1: __overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&pwm_pins>;
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		pin   = <&pwm_pins>,"brcm,pins:0";
++		func  = <&pwm_pins>,"brcm,function:0";
++		clock = <&frag1>,"assigned-clock-rates:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/pwm1-overlay.dts b/arch/arm/boot/dts/overlays/pwm1-overlay.dts
+new file mode 100644
+index 000000000000..3324d4160653
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pwm1-overlay.dts
+@@ -0,0 +1,59 @@
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/pinctrl/bcm2835.h>
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&pins>;
++		__overlay__ {
++			brcm,pins = <40 41>;
++		};
++	};
++
++	fragment@1 {
++		target = <&pins>;
++		__dormant__ {
++			brcm,pins = <40>;
++		};
++	};
++
++	fragment@2 {
++		target = <&pins>;
++		__dormant__ {
++			brcm,pins = <41>;
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			pins: pwm1_overlay_pins {
++				brcm,pins = <40 41>;
++				brcm,function = <BCM2835_FSEL_ALT0>;
++				brcm,pull = <BCM2835_PUD_UP>;
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&pwm1>;
++		pwm: __overlay__ {
++			status = "okay";
++			pinctrl-names = "default";
++			pinctrl-0 = <&pins>;
++		};
++	};
++
++	__overrides__ {
++		clock = <&pwm>, "assigned-clock-rates:0";
++		pins_40_41 = <0>,"+0-1-2";
++		pins_40 = <0>,"-0+1-2";
++		pins_41 = <0>,"-0-1+2";
++		pull_up = <&pins>, "brcm,pull:0=", <BCM2835_PUD_UP>;
++		pull_down = <&pins>, "brcm,pull:0=", <BCM2835_PUD_DOWN>;
++		pull_off = <&pins>, "brcm,pull:0=", <BCM2835_PUD_OFF>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/qca7000-overlay.dts b/arch/arm/boot/dts/overlays/qca7000-overlay.dts
+new file mode 100644
+index 000000000000..cc5a4fda4e01
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/qca7000-overlay.dts
+@@ -0,0 +1,55 @@
++// Overlay for the Qualcomm Atheros QCA7000 on PLC Stamp micro EVK
++// Visit: https://chargebyte.com/products/evaluation-tools/plc-stamp-micro-2-evaluation-board for details
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			eth1: qca7000@0 {
++				compatible = "qca,qca7000";
++				reg = <0>; /* CE0 */
++				pinctrl-names = "default";
++				pinctrl-0 = <&eth1_pins>;
++				interrupt-parent = <&gpio>;
++				interrupts = <23 0x1>; /* rising edge */
++				spi-max-frequency = <12000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			eth1_pins: eth1_pins {
++				brcm,pins = <23>;
++				brcm,function = <0>; /* in */
++				brcm,pull = <0>; /* none */
++			};
++		};
++	};
++
++	__overrides__ {
++		int_pin = <&eth1>, "interrupts:0",
++		          <&eth1_pins>, "brcm,pins:0";
++		speed   = <&eth1>, "spi-max-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/qca7000-uart0-overlay.dts b/arch/arm/boot/dts/overlays/qca7000-uart0-overlay.dts
+new file mode 100644
+index 000000000000..f103916c9e1c
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/qca7000-uart0-overlay.dts
+@@ -0,0 +1,46 @@
++// Overlay for the Qualcomm Atheros QCA7000 on PLC Stamp micro EVK
++// Visit: https://in-tech-smartcharging.com/products/evaluation-tools/plc-stamp-micro-2-evaluation-board for details
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&uart0>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&uart0_pins>;
++			status = "okay";
++
++			eth2: qca7000 {
++				compatible = "qca,qca7000";
++				current-speed = <115200>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			uart0_pins: uart0_ovl_pins {
++				brcm,pins = <14 15>;
++				brcm,function = <4>; /* alt0 */
++				brcm,pull = <0 2>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target-path = "/aliases";
++		__overlay__ {
++			serial0 = "/soc/serial@7e201000";
++			serial1 = "/soc/serial@7e215040";
++		};
++	};
++
++	__overrides__ {
++		baudrate = <&eth2>, "current-speed:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/ramoops-overlay.dts b/arch/arm/boot/dts/overlays/ramoops-overlay.dts
+new file mode 100644
+index 000000000000..e5038658138d
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ramoops-overlay.dts
+@@ -0,0 +1,25 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&rmem>;
++		__overlay__ {
++			ramoops: ramoops@b000000 {
++				compatible = "ramoops";
++				reg = <0x0b000000 0x10000>; /* 64kB */
++				record-size = <0x4000>; /* 16kB */
++				console-size = <0>; /* disabled by default */
++			};
++		};
++	};
++
++	__overrides__ {
++		base-addr = <&ramoops>,"reg:0";
++		total-size = <&ramoops>,"reg:4";
++		record-size = <&ramoops>,"record-size:0";
++		console-size = <&ramoops>,"console-size:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/ramoops-pi4-overlay.dts b/arch/arm/boot/dts/overlays/ramoops-pi4-overlay.dts
+new file mode 100644
+index 000000000000..1737e37f5724
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ramoops-pi4-overlay.dts
+@@ -0,0 +1,25 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&rmem>;
++		__overlay__ {
++			ramoops: ramoops@b000000 {
++				compatible = "ramoops";
++				reg = <0x0 0x0b000000 0x10000>; /* 64kB */
++				record-size = <0x4000>; /* 16kB */
++				console-size = <0>; /* disabled by default */
++			};
++		};
++	};
++
++	__overrides__ {
++		base-addr = <&ramoops>,"reg#0";
++		total-size = <&ramoops>,"reg:8";
++		record-size = <&ramoops>,"record-size:0";
++		console-size = <&ramoops>,"console-size:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/rotary-encoder-overlay.dts b/arch/arm/boot/dts/overlays/rotary-encoder-overlay.dts
+new file mode 100644
+index 000000000000..ea1d952734e9
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rotary-encoder-overlay.dts
+@@ -0,0 +1,59 @@
++// Device tree overlay for GPIO connected rotary encoder.
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			rotary_pins: rotary_pins@4 {
++				brcm,pins = <4 17>; /* gpio 4 17 */
++				brcm,function = <0 0>; /* input */
++				brcm,pull = <2 2>; /* pull-up */
++			};
++
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			rotary: rotary@4 {
++				compatible = "rotary-encoder";
++				status = "okay";
++				pinctrl-names = "default";
++				pinctrl-0 = <&rotary_pins>;
++				gpios = <&gpio 4 0>, <&gpio 17 0>;
++				linux,axis = <0>; /* REL_X */
++				rotary-encoder,encoding = "gray";
++				rotary-encoder,steps = <24>; /* 24 default */
++				rotary-encoder,steps-per-period = <1>; /* corresponds to full period mode. See README */
++			};
++		};
++
++	};  
++
++	__overrides__ {
++		pin_a =		    <&rotary>,"gpios:4",
++				    <&rotary_pins>,"brcm,pins:0",
++				    /* modify reg values to allow multiple instantiation */
++				    <&rotary>,"reg:0",
++				    <&rotary_pins>,"reg:0";
++		pin_b =		    <&rotary>,"gpios:16",
++				    <&rotary_pins>,"brcm,pins:4";
++		relative_axis =     <&rotary>,"rotary-encoder,relative-axis?";
++		linux_axis =        <&rotary>,"linux,axis:0";
++		rollover =          <&rotary>,"rotary-encoder,rollover?";
++		steps-per-period =  <&rotary>,"rotary-encoder,steps-per-period:0";
++		steps =             <&rotary>,"rotary-encoder,steps:0";
++		wakeup =            <&rotary>,"wakeup-source?";
++		encoding =          <&rotary>,"rotary-encoder,encoding";
++                /* legacy parameters*/
++		rotary0_pin_a =     <&rotary>,"gpios:4",
++		                    <&rotary_pins>,"brcm,pins:0";
++		rotary0_pin_b =     <&rotary>,"gpios:16",
++		                    <&rotary_pins>,"brcm,pins:4";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/rpi-backlight-overlay.dts b/arch/arm/boot/dts/overlays/rpi-backlight-overlay.dts
+new file mode 100644
+index 000000000000..cac5e44c6ec5
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rpi-backlight-overlay.dts
+@@ -0,0 +1,21 @@
++/*
++ * Devicetree overlay for mailbox-driven Raspberry Pi DSI Display
++ * backlight controller
++ */
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			rpi_backlight: rpi_backlight {
++				compatible = "raspberrypi,rpi-backlight";
++				firmware = <&firmware>;
++				status = "okay";
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/rpi-codeczero-overlay.dts b/arch/arm/boot/dts/overlays/rpi-codeczero-overlay.dts
+new file mode 100644
+index 000000000000..c3b0564b2fb2
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rpi-codeczero-overlay.dts
+@@ -0,0 +1,9 @@
++// Overlay for the Raspberry Pi Codec Zero soundcard
++
++#include "iqaudio-codec-overlay.dts"
++
++&iqaudio_dac {
++	card_name = "RPi Codec Zero";
++	dai_name = "Raspberry Pi Codec Zero";
++	dai_stream_name = "Raspberry Pi Codec Zero HiFi";
++};
+diff --git a/arch/arm/boot/dts/overlays/rpi-dacplus-overlay.dts b/arch/arm/boot/dts/overlays/rpi-dacplus-overlay.dts
+new file mode 100644
+index 000000000000..47557aa17f19
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rpi-dacplus-overlay.dts
+@@ -0,0 +1,17 @@
++// Overlay for the Raspberry Pi DAC Plus soundcard
++
++#include "iqaudio-dacplus-overlay.dts"
++
++&iqaudio_dac {
++	card_name = "RPi DAC+";
++	dai_name = "Raspberry Pi DAC+";
++	dai_stream_name = "Raspberry Pi DAC+ HiFi";
++	/delete-property/ mute-gpios;
++};
++
++/ {
++	__overrides__ {
++		/delete-property/ auto_mute_amp;
++		/delete-property/ unmute_amp;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/rpi-dacpro-overlay.dts b/arch/arm/boot/dts/overlays/rpi-dacpro-overlay.dts
+new file mode 100644
+index 000000000000..412260c64edf
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rpi-dacpro-overlay.dts
+@@ -0,0 +1,17 @@
++// Overlay for the Raspberry Pi DAC Pro soundcard
++
++#include "iqaudio-dacplus-overlay.dts"
++
++&iqaudio_dac {
++	card_name = "RPi DAC Pro";
++	dai_name = "Raspberry Pi DAC Pro";
++	dai_stream_name = "Raspberry Pi DAC Pro HiFi";
++	/delete-property/ mute-gpios;
++};
++
++/ {
++	__overrides__ {
++		/delete-property/ auto_mute_amp;
++		/delete-property/ unmute_amp;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/rpi-digiampplus-overlay.dts b/arch/arm/boot/dts/overlays/rpi-digiampplus-overlay.dts
+new file mode 100644
+index 000000000000..5e73d6c1bf42
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rpi-digiampplus-overlay.dts
+@@ -0,0 +1,17 @@
++// Overlay for the Raspberry Pi DAC Plus soundcard
++
++#include "iqaudio-dacplus-overlay.dts"
++
++&iqaudio_dac {
++	card_name = "RPi DigiAMP+";
++	dai_name = "Raspberry Pi DigiAMP+";
++	dai_stream_name = "Raspberry Pi DigiAMP+ HiFi";
++	iqaudio-dac,auto-mute-amp;
++};
++
++/ {
++	__overrides__ {
++		unmute_amp = <&iqaudio_dac>,"iqaudio-dac,unmute-amp?",
++			     <&iqaudio_dac>,"iqaudio-dac,auto-mute-amp!";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/rpi-ft5406-overlay.dts b/arch/arm/boot/dts/overlays/rpi-ft5406-overlay.dts
+new file mode 100644
+index 000000000000..8483c4f4b2eb
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rpi-ft5406-overlay.dts
+@@ -0,0 +1,25 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/soc/firmware";
++		__overlay__ {
++			ts: touchscreen {
++				compatible = "raspberrypi,firmware-ts";
++				touchscreen-size-x = <800>;
++				touchscreen-size-y = <480>;
++			};
++		};
++	};
++
++	__overrides__ {
++		touchscreen-size-x = <&ts>,"touchscreen-size-x:0";
++		touchscreen-size-y = <&ts>,"touchscreen-size-y:0";
++		touchscreen-inverted-x = <&ts>,"touchscreen-inverted-x?";
++		touchscreen-inverted-y = <&ts>,"touchscreen-inverted-y?";
++		touchscreen-swapped-x-y = <&ts>,"touchscreen-swapped-x-y?";
++        };
++};
+diff --git a/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts b/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts
+new file mode 100644
+index 000000000000..cfd9fe37e108
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts
+@@ -0,0 +1,154 @@
++/*
++ * Overlay for the Raspberry Pi POE HAT.
++ */
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			fan: pwm-fan {
++				compatible = "pwm-fan";
++				cooling-levels = <0 1 10 100 255>;
++				#cooling-cells = <2>;
++				pwms = <&fwpwm 0 80000 0>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&cpu_thermal>;
++		__overlay__ {
++			polling-delay = <2000>; /* milliseconds */
++		};
++	};
++
++	fragment@2 {
++		target = <&thermal_trips>;
++		__overlay__ {
++			trip0: trip0 {
++				temperature = <40000>;
++				hysteresis = <2000>;
++				type = "active";
++			};
++			trip1: trip1 {
++				temperature = <45000>;
++				hysteresis = <2000>;
++				type = "active";
++			};
++			trip2: trip2 {
++				temperature = <50000>;
++				hysteresis = <2000>;
++				type = "active";
++			};
++			trip3: trip3 {
++				temperature = <55000>;
++				hysteresis = <5000>;
++				type = "active";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&cooling_maps>;
++		__overlay__ {
++			map0 {
++				trip = <&trip0>;
++				cooling-device = <&fan 0 1>;
++			};
++			map1 {
++				trip = <&trip1>;
++				cooling-device = <&fan 1 2>;
++			};
++			map2 {
++				trip = <&trip2>;
++				cooling-device = <&fan 2 3>;
++			};
++			map3 {
++				trip = <&trip3>;
++				cooling-device = <&fan 3 4>;
++			};
++		};
++	};
++
++	fragment@4 {
++		target-path = "/__overrides__";
++		params: __overlay__ {
++			poe_fan_temp0 =		<&trip0>,"temperature:0";
++			poe_fan_temp0_hyst =	<&trip0>,"hysteresis:0";
++			poe_fan_temp1 =		<&trip1>,"temperature:0";
++			poe_fan_temp1_hyst =	<&trip1>,"hysteresis:0";
++			poe_fan_temp2 =		<&trip2>,"temperature:0";
++			poe_fan_temp2_hyst =	<&trip2>,"hysteresis:0";
++			poe_fan_temp3 =		<&trip3>,"temperature:0";
++			poe_fan_temp3_hyst =	<&trip3>,"hysteresis:0";
++			poe_fan_i2c =		<&fwpwm>,"status=disabled",
++						<&poe_mfd>,"status=okay",
++						<&fan>,"pwms:0=",<&poe_mfd_pwm>;
++		};
++	};
++
++	fragment@5 {
++		target = <&firmware>;
++		__overlay__ {
++			fwpwm: pwm {
++				compatible = "raspberrypi,firmware-poe-pwm";
++				#pwm-cells = <2>;
++			};
++		};
++	};
++
++	fragment@6 {
++		target = <&i2c0>;
++		i2c_bus: __overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			poe_mfd: poe@51 {
++				compatible = "raspberrypi,poe-core";
++				reg = <0x51>;
++				status = "disabled";
++
++				poe_mfd_pwm: poe_pwm@f0 {
++					compatible = "raspberrypi,poe-pwm";
++					reg = <0xf0>;
++					status = "okay";
++					#pwm-cells = <2>;
++				};
++			};
++		};
++	};
++
++	fragment@7 {
++		target = <&i2c0if>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	fragment@8 {
++		target = <&i2c0mux>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		poe_fan_temp0 =		<&trip0>,"temperature:0";
++		poe_fan_temp0_hyst =	<&trip0>,"hysteresis:0";
++		poe_fan_temp1 =		<&trip1>,"temperature:0";
++		poe_fan_temp1_hyst =	<&trip1>,"hysteresis:0";
++		poe_fan_temp2 =		<&trip2>,"temperature:0";
++		poe_fan_temp2_hyst =	<&trip2>,"hysteresis:0";
++		poe_fan_temp3 =		<&trip3>,"temperature:0";
++		poe_fan_temp3_hyst =	<&trip3>,"hysteresis:0";
++		i2c =			<0>, "+5+6",
++					<&fwpwm>,"status=disabled",
++					<&i2c_bus>,"status=okay",
++					<&poe_mfd>,"status=okay",
++					<&fan>,"pwms:0=",<&poe_mfd_pwm>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/rpi-poe-plus-overlay.dts b/arch/arm/boot/dts/overlays/rpi-poe-plus-overlay.dts
+new file mode 100644
+index 000000000000..54deda2f18c3
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rpi-poe-plus-overlay.dts
+@@ -0,0 +1,49 @@
++// SPDX-License-Identifier: (GPL-2.0 OR MIT)
++// Overlay for the Raspberry Pi PoE+ HAT.
++
++#include "rpi-poe-overlay.dts"
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@10 {
++		target-path = "/";
++		__overlay__ {
++			rpi_poe_power_supply: rpi-poe-power-supply {
++				compatible = "raspberrypi,rpi-poe-power-supply";
++				firmware = <&firmware>;
++				status = "okay";
++			};
++		};
++	};
++	fragment@11 {
++		target = <&poe_mfd>;
++		__overlay__ {
++			rpi-poe-power-supply@f2 {
++				compatible = "raspberrypi,rpi-poe-power-supply";
++				reg = <0xf2>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		i2c =	<0>, "+5+6",
++			<&fwpwm>,"status=disabled",
++			<&rpi_poe_power_supply>,"status=disabled",
++			<&i2c_bus>,"status=okay",
++			<&poe_mfd>,"status=okay",
++			<&fan>,"pwms:0=",<&poe_mfd_pwm>;
++	};
++};
++
++&fan {
++	cooling-levels = <0 32 64 128 255>;
++};
++
++&params {
++	poe_fan_i2c = <&fwpwm>,"status=disabled",
++		      <&rpi_poe_power_supply>,"status=disabled",
++		      <&poe_mfd>,"status=okay",
++		      <&fan>,"pwms:0=",<&poe_mfd_pwm>;
++};
+diff --git a/arch/arm/boot/dts/overlays/rpi-rp2040-gpio-bridge.dtsi b/arch/arm/boot/dts/overlays/rpi-rp2040-gpio-bridge.dtsi
+new file mode 100644
+index 000000000000..2b7f670a1f6d
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rpi-rp2040-gpio-bridge.dtsi
+@@ -0,0 +1,21 @@
++// SPDX-License-Identifier: GPL-2.0-only
++spi_bridge: spi@40 {
++	reg = <0x40>;
++	compatible = "raspberrypi,rp2040-gpio-bridge";
++	status = "disabled";
++	#address-cells = <1>;
++	#size-cells = <0>;
++
++	power-supply = <&cam1_reg>;
++
++	#gpio-cells = <2>;
++	gpio-controller;
++
++	spi_bridgedev0: spidev@0{
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <35000000>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/rpi-sense-overlay.dts b/arch/arm/boot/dts/overlays/rpi-sense-overlay.dts
+new file mode 100644
+index 000000000000..32e99b7effc8
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rpi-sense-overlay.dts
+@@ -0,0 +1,69 @@
++// rpi-sense HAT
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			sensehat@46 {
++				compatible = "raspberrypi,sensehat";
++				reg = <0x46>;
++				interrupt-parent = <&gpio>;
++				status = "okay";
++
++				display {
++					compatible = "raspberrypi,rpi-sense-fb";
++					status = "okay";
++				};
++				joystick {
++					compatible = "raspberrypi,sensehat-joystick";
++					interrupts = <23 1>;
++					pinctrl-names = "default";
++					pinctrl-0 = <&sensehat_pins>;
++					status = "okay";
++				};
++			};
++
++			lsm9ds1-magn@1c {
++				compatible = "st,lsm9ds1-magn";
++				reg = <0x1c>;
++				status = "okay";
++			};
++
++			lsm9ds1-accel6a {
++				compatible = "st,lsm9ds1-accel";
++				reg = <0x6a>;
++				status = "okay";
++			};
++
++			lps25h-press@5c {
++				compatible = "st,lps25h-press";
++				reg = <0x5c>;
++				status = "okay";
++			};
++
++			hts221-humid@5f {
++				compatible = "st,hts221-humid", "st,hts221";
++				reg = <0x5f>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			sensehat_pins: sensehat_pins {
++				brcm,pins = <23>;
++				brcm,function = <0>;
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/rpi-sense-v2-overlay.dts b/arch/arm/boot/dts/overlays/rpi-sense-v2-overlay.dts
+new file mode 100644
+index 000000000000..c4fe97db52fb
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rpi-sense-v2-overlay.dts
+@@ -0,0 +1,69 @@
++// rpi-sense HAT
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			sensehat@46 {
++				compatible = "raspberrypi,sensehat";
++				reg = <0x46>;
++				interrupt-parent = <&gpio>;
++				status = "okay";
++
++				display {
++					compatible = "raspberrypi,rpi-sense-fb";
++					status = "okay";
++				};
++				joystick {
++					compatible = "raspberrypi,sensehat-joystick";
++					interrupts = <23 1>;
++					pinctrl-names = "default";
++					pinctrl-0 = <&sensehat_pins>;
++					status = "okay";
++				};
++			};
++
++			lsm9ds1-magn@1c {
++				compatible = "st,lsm9ds1-magn";
++				reg = <0x1c>;
++				status = "okay";
++			};
++
++			lps25h-press@5c {
++				compatible = "st,lps25h-press";
++				reg = <0x5c>;
++				status = "okay";
++			};
++
++			hts221-humid@5f {
++				compatible = "st,hts221-humid", "st,hts221";
++				reg = <0x5f>;
++				status = "okay";
++			};
++
++			lsm9ds1-accel@6a {
++				compatible = "st,lsm9ds1-accel";
++				reg = <0x6a>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			sensehat_pins: sensehat_pins {
++				brcm,pins = <23>;
++				brcm,function = <0>;
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/rpi-tv-overlay.dts b/arch/arm/boot/dts/overlays/rpi-tv-overlay.dts
+new file mode 100644
+index 000000000000..3c97a545d820
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rpi-tv-overlay.dts
+@@ -0,0 +1,34 @@
++// rpi-tv HAT
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			cxd2880@0 {
++				compatible = "sony,cxd2880";
++				reg = <0>; /* CE0 */
++				spi-max-frequency = <50000000>;
++				status = "okay";
++			};
++		};
++	};
++
++};
+diff --git a/arch/arm/boot/dts/overlays/rra-digidac1-wm8741-audio-overlay.dts b/arch/arm/boot/dts/overlays/rra-digidac1-wm8741-audio-overlay.dts
+new file mode 100644
+index 000000000000..97db53a91fda
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rra-digidac1-wm8741-audio-overlay.dts
+@@ -0,0 +1,49 @@
++// Definitions for RRA DigiDAC1 Audio card
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			wm8804@3b {
++				#sound-dai-cells = <0>;
++				compatible = "wlf,wm8804";
++				reg = <0x3b>;
++				status = "okay";
++				PVDD-supply = <&vdd_3v3_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++			};
++
++			wm8742: wm8741@1a {
++				compatible = "wlf,wm8741";
++				reg = <0x1a>;
++				status = "okay";
++				AVDD-supply = <&vdd_5v0_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "rra,digidac1-soundcard";
++			i2s-controller = <&i2s_clk_consumer>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/sainsmart18-overlay.dts b/arch/arm/boot/dts/overlays/sainsmart18-overlay.dts
+new file mode 100644
+index 000000000000..c51f1c030a55
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/sainsmart18-overlay.dts
+@@ -0,0 +1,52 @@
++/*
++ * Device Tree overlay for the Sainsmart 1.8" TFT LCD with ST7735R chip 160x128
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ss18: sainsmart18@0 {
++				compatible = "fbtft,sainsmart18";
++				reg = <0>;
++				pinctrl-names = "default";
++				spi-max-frequency = <40000000>;
++				rotate = <90>;
++				buswidth = <8>;
++				fps = <50>;
++				height = <160>;
++				width = <128>;
++				reset-gpios = <&gpio 25 1>;
++				dc-gpios = <&gpio 24 0>;
++				debug = <0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		speed     = <&ss18>,"spi-max-frequency:0";
++		rotate    = <&ss18>,"rotate:0";
++		fps       = <&ss18>,"fps:0";
++		bgr       = <&ss18>,"bgr?";
++		debug     = <&ss18>,"debug:0";
++		dc_pin    = <&ss18>,"dc-gpios:4";
++		reset_pin = <&ss18>,"reset-gpios:4";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts b/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
+new file mode 100644
+index 000000000000..09c08c1c5433
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
+@@ -0,0 +1,57 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_arm>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			sc16is750: sc16is750@48 {
++				compatible = "nxp,sc16is750";
++				reg = <0x48>; /* i2c address */
++				clocks = <&sc16is750_clk>;
++				interrupt-parent = <&gpio>;
++				interrupts = <24 2>; /* IRQ_TYPE_EDGE_FALLING */
++				pinctrl-0 = <&int_pins>;
++				pinctrl-names = "default";
++				gpio-controller;
++				#gpio-cells = <2>;
++				i2c-max-frequency = <400000>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			sc16is750_clk: sc16is750_i2c_clk@48 {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-frequency = <14745600>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			int_pins: int_pins@18 {
++					brcm,pins = <24>;
++					brcm,function = <0>; /* in */
++					brcm,pull = <0>; /* none */
++			};
++		};
++	};
++
++	__overrides__ {
++		int_pin = <&sc16is750>,"interrupts:0", <&int_pins>,"brcm,pins:0",
++			  <&int_pins>,"reg:0";
++		addr = <&sc16is750>,"reg:0", <&sc16is750_clk>,"name";
++		xtal = <&sc16is750_clk>,"clock-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/sc16is750-spi0-overlay.dts b/arch/arm/boot/dts/overlays/sc16is750-spi0-overlay.dts
+new file mode 100644
+index 000000000000..b289ee900edf
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/sc16is750-spi0-overlay.dts
+@@ -0,0 +1,63 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			sc16is750: sc16is750@0 {
++				compatible = "nxp,sc16is750";
++				reg = <0>; /* CE0 */
++				clocks = <&sc16is750_clk>;
++				interrupt-parent = <&gpio>;
++				interrupts = <24 2>; /* IRQ_TYPE_EDGE_FALLING */
++				pinctrl-0 = <&int_pins>;
++				pinctrl-names = "default";
++				gpio-controller;
++				#gpio-cells = <2>;
++				spi-max-frequency = <4000000>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target-path = "/";
++		__overlay__ {
++			sc16is750_clk: sc16is750_spi0_0_clk {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-frequency = <14745600>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			int_pins: int_pins@18 {
++					brcm,pins = <24>;
++					brcm,function = <0>; /* in */
++					brcm,pull = <0>; /* none */
++			};
++		};
++	};
++
++	__overrides__ {
++		int_pin = <&sc16is750>,"interrupts:0", <&int_pins>,"brcm,pins:0",
++			  <&int_pins>,"reg:0";
++		xtal = <&sc16is750_clk>,"clock-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts b/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
+new file mode 100644
+index 000000000000..a7c538943859
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
+@@ -0,0 +1,57 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_arm>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			sc16is752: sc16is752@48 {
++				compatible = "nxp,sc16is752";
++				reg = <0x48>; /* i2c address */
++				clocks = <&sc16is752_clk>;
++				interrupt-parent = <&gpio>;
++				interrupts = <24 2>; /* IRQ_TYPE_EDGE_FALLING */
++				pinctrl-0 = <&int_pins>;
++				pinctrl-names = "default";
++				gpio-controller;
++				#gpio-cells = <2>;
++				i2c-max-frequency = <400000>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			sc16is752_clk: sc16is752_i2c_clk@48 {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-frequency = <14745600>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			int_pins: int_pins@18 {
++					brcm,pins = <24>;
++					brcm,function = <0>; /* in */
++					brcm,pull = <0>; /* none */
++			};
++		};
++	};
++
++	__overrides__ {
++		int_pin = <&sc16is752>,"interrupts:0", <&int_pins>,"brcm,pins:0",
++			  <&int_pins>,"reg:0";
++		addr = <&sc16is752>,"reg:0",<&sc16is752_clk>,"name";
++		xtal = <&sc16is752_clk>,"clock-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/sc16is752-spi0-overlay.dts b/arch/arm/boot/dts/overlays/sc16is752-spi0-overlay.dts
+new file mode 100644
+index 000000000000..5f8941085831
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/sc16is752-spi0-overlay.dts
+@@ -0,0 +1,63 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			sc16is752: sc16is752@0 {
++				compatible = "nxp,sc16is752";
++				reg = <0>; /* CE0 */
++				clocks = <&sc16is752_clk>;
++				interrupt-parent = <&gpio>;
++				interrupts = <24 2>; /* IRQ_TYPE_EDGE_FALLING */
++				pinctrl-0 = <&int_pins>;
++				pinctrl-names = "default";
++				gpio-controller;
++				#gpio-cells = <2>;
++				spi-max-frequency = <4000000>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target-path = "/";
++		__overlay__ {
++			sc16is752_clk: sc16is752_spi0_0_clk {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-frequency = <14745600>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			int_pins: int_pins@18 {
++					brcm,pins = <24>;
++					brcm,function = <0>; /* in */
++					brcm,pull = <0>; /* none */
++			};
++		};
++	};
++
++	__overrides__ {
++		int_pin = <&sc16is752>,"interrupts:0", <&int_pins>,"brcm,pins:0",
++			  <&int_pins>,"reg:0";
++		xtal = <&sc16is752_clk>,"clock-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/sc16is752-spi1-overlay.dts b/arch/arm/boot/dts/overlays/sc16is752-spi1-overlay.dts
+new file mode 100644
+index 000000000000..a9b64a98c278
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/sc16is752-spi1-overlay.dts
+@@ -0,0 +1,76 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			spi1_pins: spi1_pins {
++				brcm,pins = <19 20 21>;
++				brcm,function = <3>; /* alt4 */
++			};
++
++			spi1_cs_pins: spi1_cs_pins {
++				brcm,pins = <18>;
++				brcm,function = <1>; /* output */
++			};
++
++			int_pins: int_pins@18 {
++					brcm,pins = <24>;
++					brcm,function = <0>; /* in */
++					brcm,pull = <0>; /* none */
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&spi1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&spi1_pins &spi1_cs_pins>;
++			cs-gpios = <&gpio 18 1>;
++			status = "okay";
++
++			sc16is752: sc16is752@0 {
++				compatible = "nxp,sc16is752";
++				reg = <0>; /* CE0 */
++				clocks = <&sc16is752_clk>;
++				interrupt-parent = <&gpio>;
++				interrupts = <24 2>; /* IRQ_TYPE_EDGE_FALLING */
++				pinctrl-0 = <&int_pins>;
++				pinctrl-names = "default";
++				gpio-controller;
++				#gpio-cells = <2>;
++				spi-max-frequency = <4000000>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&aux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target-path = "/";
++		__overlay__ {
++			sc16is752_clk: sc16is752_spi1_0_clk {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-frequency = <14745600>;
++			};
++		};
++	};
++
++	__overrides__ {
++		int_pin = <&sc16is752>,"interrupts:0", <&int_pins>,"brcm,pins:0",
++			  <&int_pins>,"reg:0";
++		xtal = <&sc16is752_clk>,"clock-frequency:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/sdhost-overlay.dts b/arch/arm/boot/dts/overlays/sdhost-overlay.dts
+new file mode 100644
+index 000000000000..0b72b4eeac88
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/sdhost-overlay.dts
+@@ -0,0 +1,38 @@
++/dts-v1/;
++/plugin/;
++
++/* Provide backwards compatible aliases for the old sdhost dtparams. */
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&sdhost>;
++		frag0: __overlay__ {
++			brcm,overclock-50 = <0>;
++			brcm,pio-limit = <1>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&mmc>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&mmcnr>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	__overrides__ {
++		overclock_50     = <&frag0>,"brcm,overclock-50:0";
++		force_pio        = <&frag0>,"brcm,force-pio?";
++		pio_limit        = <&frag0>,"brcm,pio-limit:0";
++		debug            = <&frag0>,"brcm,debug?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/sdio-overlay.dts b/arch/arm/boot/dts/overlays/sdio-overlay.dts
+new file mode 100644
+index 000000000000..873e49056379
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/sdio-overlay.dts
+@@ -0,0 +1,77 @@
++/dts-v1/;
++/plugin/;
++
++/* Enable SDIO from MMC interface via various GPIO groups */
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&mmcnr>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&mmc>;
++		sdio_ovl: __overlay__ {
++			pinctrl-0 = <&sdio_ovl_pins>;
++			pinctrl-names = "default";
++			non-removable;
++			bus-width = <4>;
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			sdio_ovl_pins: sdio_ovl_pins {
++				brcm,pins = <22 23 24 25 26 27>;
++				brcm,function = <7>; /* ALT3 = SD1 */
++				brcm,pull = <0 2 2 2 2 2>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sdio_ovl_pins>;
++		__dormant__ {
++			brcm,pins = <22 23 24 25>;
++			brcm,pull = <0 2 2 2>;
++		};
++	};
++
++	fragment@4 {
++		target = <&sdio_ovl_pins>;
++		__dormant__ {
++			brcm,pins = <34 35 36 37>;
++			brcm,pull = <0 2 2 2>;
++		};
++	};
++
++	fragment@5 {
++		target = <&sdio_ovl_pins>;
++		__dormant__ {
++			brcm,pins = <34 35 36 37 38 39>;
++			brcm,pull = <0 2 2 2 2 2>;
++		};
++	};
++
++	fragment@6 {
++		target-path = "/aliases";
++		__overlay__ {
++			mmc1 = "/soc/mmc@7e300000";
++		};
++	};
++
++	__overrides__ {
++		poll_once = <&sdio_ovl>,"non-removable?";
++		bus_width = <&sdio_ovl>,"bus-width:0";
++		sdio_overclock = <&sdio_ovl>,"brcm,overclock-50:0";
++		gpios_22_25 = <0>,"=3";
++		gpios_34_37 = <0>,"=4";
++		gpios_34_39 = <0>,"=5";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/sdio-pi5-overlay.dts b/arch/arm/boot/dts/overlays/sdio-pi5-overlay.dts
+new file mode 100644
+index 000000000000..4e42cb5c856e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/sdio-pi5-overlay.dts
+@@ -0,0 +1,24 @@
++/dts-v1/;
++/plugin/;
++
++/* SDIO/SD/MMC on RP1 bank 0 */
++
++/{
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&rp1_mmc0>;
++		frag0: __overlay__ {
++			status = "okay";
++			pinctrl-0 = <&rp1_sdio0_22_27>;
++			pinctrl-names = "default";
++		};
++	};
++
++	fragment@1 {
++		target = <&rp1_sdio_clk0>;
++		frag1: __overlay__ {
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/seeed-can-fd-hat-v1-overlay.dts b/arch/arm/boot/dts/overlays/seeed-can-fd-hat-v1-overlay.dts
+new file mode 100644
+index 000000000000..210d027a073e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/seeed-can-fd-hat-v1-overlay.dts
+@@ -0,0 +1,138 @@
++// redo: ovmerge -c spi1-1cs-overlay.dts,cs0_pin=18,cs0_spidev=false mcp251xfd-overlay.dts,spi0-0,interrupt=25 mcp251xfd-overlay.dts,spi1-0,interrupt=24
++
++// Device tree overlay for https://www.seeedstudio.com/2-Channel-CAN-BUS-FD-Shield-for-Raspberry-Pi-p-4072.html
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/interrupt-controller/irq.h>
++#include <dt-bindings/pinctrl/bcm2835.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			spi1_pins: spi1_pins {
++				brcm,pins = <19 20 21>;
++				brcm,function = <3>;
++			};
++			spi1_cs_pins: spi1_cs_pins {
++				brcm,pins = <18>;
++				brcm,function = <1>;
++			};
++		};
++	};
++	fragment@1 {
++		target = <&spi1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&spi1_pins &spi1_cs_pins>;
++			cs-gpios = <&gpio 18 1>;
++			status = "okay";
++			spidev@0 {
++				compatible = "spidev";
++				reg = <0>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "disabled";
++			};
++		};
++	};
++	fragment@2 {
++		target = <&aux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@3 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++	fragment@4 {
++		target = <&gpio>;
++		__overlay__ {
++			mcp251xfd_pins: mcp251xfd_spi0_0_pins {
++				brcm,pins = <25>;
++				brcm,function = <BCM2835_FSEL_GPIO_IN>;
++			};
++		};
++	};
++	fragment@5 {
++		target-path = "/clocks";
++		__overlay__ {
++			clk_mcp251xfd_osc: mcp251xfd-spi0-0-osc {
++				#clock-cells = <0>;
++				compatible = "fixed-clock";
++				clock-frequency = <40000000>;
++			};
++		};
++	};
++	fragment@6 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			mcp251xfd@0 {
++				compatible = "microchip,mcp251xfd";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&mcp251xfd_pins>;
++				spi-max-frequency = <20000000>;
++				interrupt-parent = <&gpio>;
++				interrupts = <25 IRQ_TYPE_LEVEL_LOW>;
++				clocks = <&clk_mcp251xfd_osc>;
++			};
++		};
++	};
++	fragment@7 {
++		target-path = "spi1/spidev@0";
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++	fragment@8 {
++		target = <&gpio>;
++		__overlay__ {
++			mcp251xfd_pins_1: mcp251xfd_spi1_0_pins {
++				brcm,pins = <24>;
++				brcm,function = <BCM2835_FSEL_GPIO_IN>;
++			};
++		};
++	};
++	fragment@9 {
++		target-path = "/clocks";
++		__overlay__ {
++			clk_mcp251xfd_osc_1: mcp251xfd-spi1-0-osc {
++				#clock-cells = <0>;
++				compatible = "fixed-clock";
++				clock-frequency = <40000000>;
++			};
++		};
++	};
++	fragment@10 {
++		target = <&spi1>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			mcp251xfd@0 {
++				compatible = "microchip,mcp251xfd";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&mcp251xfd_pins_1>;
++				spi-max-frequency = <20000000>;
++				interrupt-parent = <&gpio>;
++				interrupts = <24 IRQ_TYPE_LEVEL_LOW>;
++				clocks = <&clk_mcp251xfd_osc_1>;
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/seeed-can-fd-hat-v2-overlay.dts b/arch/arm/boot/dts/overlays/seeed-can-fd-hat-v2-overlay.dts
+new file mode 100644
+index 000000000000..e843d0b19745
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/seeed-can-fd-hat-v2-overlay.dts
+@@ -0,0 +1,117 @@
++// redo: ovmerge -c mcp251xfd-overlay.dts,spi0-0,interrupt=25 mcp251xfd-overlay.dts,spi0-1,interrupt=24 i2c-rtc-overlay.dts,pcf85063
++
++// Device tree overlay for https://www.seeedstudio.com/CAN-BUS-FD-HAT-for-Raspberry-Pi-p-4742.html 
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/interrupt-controller/irq.h>
++#include <dt-bindings/pinctrl/bcm2835.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++	fragment@0 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			mcp251xfd_pins: mcp251xfd_spi0_0_pins {
++				brcm,pins = <25>;
++				brcm,function = <BCM2835_FSEL_GPIO_IN>;
++			};
++		};
++	};
++	fragment@2 {
++		target-path = "/clocks";
++		__overlay__ {
++			clk_mcp251xfd_osc: mcp251xfd-spi0-0-osc {
++				#clock-cells = <0>;
++				compatible = "fixed-clock";
++				clock-frequency = <40000000>;
++			};
++		};
++	};
++	fragment@3 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			mcp251xfd@0 {
++				compatible = "microchip,mcp251xfd";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&mcp251xfd_pins>;
++				spi-max-frequency = <20000000>;
++				interrupt-parent = <&gpio>;
++				interrupts = <25 IRQ_TYPE_LEVEL_LOW>;
++				clocks = <&clk_mcp251xfd_osc>;
++			};
++		};
++	};
++	fragment@4 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++	fragment@5 {
++		target = <&gpio>;
++		__overlay__ {
++			mcp251xfd_pins_1: mcp251xfd_spi0_1_pins {
++				brcm,pins = <24>;
++				brcm,function = <BCM2835_FSEL_GPIO_IN>;
++			};
++		};
++	};
++	fragment@6 {
++		target-path = "/clocks";
++		__overlay__ {
++			clk_mcp251xfd_osc_1: mcp251xfd-spi0-1-osc {
++				#clock-cells = <0>;
++				compatible = "fixed-clock";
++				clock-frequency = <40000000>;
++			};
++		};
++	};
++	fragment@7 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			mcp251xfd@1 {
++				compatible = "microchip,mcp251xfd";
++				reg = <1>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&mcp251xfd_pins_1>;
++				spi-max-frequency = <20000000>;
++				interrupt-parent = <&gpio>;
++				interrupts = <24 IRQ_TYPE_LEVEL_LOW>;
++				clocks = <&clk_mcp251xfd_osc_1>;
++			};
++		};
++	};
++	fragment@8 {
++		target = <&i2cbus>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			pcf85063@51 {
++				compatible = "nxp,pcf85063";
++				reg = <0x51>;
++			};
++		};
++	};
++	fragment@9 {
++		target = <&i2c_arm>;
++		i2cbus: __overlay__ {
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/sh1106-spi-overlay.dts b/arch/arm/boot/dts/overlays/sh1106-spi-overlay.dts
+new file mode 100644
+index 000000000000..57a0cc9b1741
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/sh1106-spi-overlay.dts
+@@ -0,0 +1,84 @@
++/*
++ * Device Tree overlay for SH1106 based SPI OLED display
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			sh1106_pins: sh1106_pins {
++                                brcm,pins = <25 24>;
++                                brcm,function = <1 1>; /* out out */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sh1106: sh1106@0{
++				compatible = "sinowealth,sh1106";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&sh1106_pins>;
++
++				spi-max-frequency = <4000000>;
++				bgr = <0>;
++				bpp = <1>;
++				rotate = <0>;
++				fps = <25>;
++				buswidth = <8>;
++				reset-gpios = <&gpio 25 1>;
++				dc-gpios = <&gpio 24 0>;
++				debug = <0>;
++
++				sinowealth,height = <64>;
++				sinowealth,width = <128>;
++				sinowealth,page-offset = <0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		speed     = <&sh1106>,"spi-max-frequency:0";
++		rotate    = <&sh1106>,"rotate:0";
++		fps       = <&sh1106>,"fps:0";
++		debug     = <&sh1106>,"debug:0";
++		dc_pin    = <&sh1106>,"dc-gpios:4",
++		            <&sh1106_pins>,"brcm,pins:4";
++		reset_pin = <&sh1106>,"reset-gpios:4",
++		            <&sh1106_pins>,"brcm,pins:0";
++		height    = <&sh1106>,"sinowealth,height:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/si446x-spi0-overlay.dts b/arch/arm/boot/dts/overlays/si446x-spi0-overlay.dts
+new file mode 100644
+index 000000000000..90495f0941fb
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/si446x-spi0-overlay.dts
+@@ -0,0 +1,53 @@
++// Overlay for the SiLabs Si446X Controller - SPI0
++// Default Interrupt Pin: 17
++// Default SDN Pin: 27
++/dts-v1/;
++/plugin/;
++
++   / {
++    compatible = "brcm,bcm2835";
++
++    fragment@0 {
++        target = <&spi0>;
++        __overlay__ {
++            // needed to avoid dtc warning
++            #address-cells = <1>;
++            #size-cells = <0>;
++
++            status = "okay";
++
++            uhf0: si446x@0{
++                compatible = "silabs,si446x";
++                reg = <0>; // CE0
++                pinctrl-names = "default";
++                pinctrl-0 = <&uhf0_pins>;
++                interrupt-parent = <&gpio>;
++                interrupts = <17 0x2>; // falling edge
++                spi-max-frequency = <4000000>;
++                sdn_pin = <27>;
++                irq_pin = <17>;
++                status = "okay";
++            };
++        };
++    };
++
++    fragment@1 {
++        target = <&gpio>;
++        __overlay__ {
++            uhf0_pins: uhf0_pins {
++                brcm,pins = <17 27>;
++                brcm,function = <0 1>; // in, out
++                brcm,pull = <2 0>; // high, none
++            };
++        };
++    };
++
++    __overrides__ {
++        int_pin = <&uhf0>, "interrupts:0",
++                  <&uhf0>, "irq_pin:0",
++                  <&uhf0_pins>, "brcm,pins:0";
++        reset_pin = <&uhf0>, "sdn_pin:0",
++                    <&uhf0_pins>, "brcm,pins:4";
++        speed   = <&uhf0>, "spi-max-frequency:0";
++    };
++};
+diff --git a/arch/arm/boot/dts/overlays/smi-dev-overlay.dts b/arch/arm/boot/dts/overlays/smi-dev-overlay.dts
+new file mode 100644
+index 000000000000..bafab6c92506
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/smi-dev-overlay.dts
+@@ -0,0 +1,20 @@
++// Description: Overlay to enable character device interface for SMI.
++// Author:	Luke Wren <luke@raspberrypi.org>
++
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&soc>;
++		__overlay__ {
++			smi_dev {
++				compatible = "brcm,bcm2835-smi-dev";
++				smi_handle = <&smi>;
++				status = "okay";
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/smi-nand-overlay.dts b/arch/arm/boot/dts/overlays/smi-nand-overlay.dts
+new file mode 100644
+index 000000000000..ae1e50329d66
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/smi-nand-overlay.dts
+@@ -0,0 +1,66 @@
++// Description: Overlay to enable NAND flash through
++// the secondary memory interface
++// Author:	Luke Wren
++
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&smi>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&smi_pins>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&soc>;
++		__overlay__ {
++			nand: flash@0 {
++				compatible = "brcm,bcm2835-smi-nand";
++				smi_handle = <&smi>;
++				#address-cells = <1>;
++				#size-cells = <1>;
++				status = "okay";
++
++				partition@0 {
++					label = "stage2";
++					// 128k
++					reg = <0 0x20000>;
++					read-only;
++				};
++				partition@1 {
++					label = "firmware";
++					// 16M
++					reg = <0x20000 0x1000000>;
++					read-only;
++				};
++				partition@2 {
++					label = "root";
++					// 2G (will need to use 64 bit for >=4G)
++					reg = <0x1020000 0x80000000>;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			smi_pins: smi_pins {
++				brcm,pins = <0 1 2 3 4 5 6 7 8 9 10 11
++					12 13 14 15>;
++				/* Alt 1: SMI */
++				brcm,function = <5 5 5 5 5 5 5 5 5 5 5
++					5 5 5 5 5>;
++				/* /CS, /WE and /OE are pulled high, as they are
++				   generally active low signals */
++				brcm,pull = <2 2 2 2 2 2 2 2 0 0 0 0 0 0 0 0>;
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/smi-overlay.dts b/arch/arm/boot/dts/overlays/smi-overlay.dts
+new file mode 100644
+index 000000000000..bb8c7830df23
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/smi-overlay.dts
+@@ -0,0 +1,37 @@
++// Description:	Overlay to enable the secondary memory interface peripheral
++// Author:	Luke Wren
++
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&smi>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&smi_pins>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			smi_pins: smi_pins {
++				/* Don't configure the top two address bits, as
++				   these are already used as ID_SD and ID_SC */
++				brcm,pins = <2 3 4 5 6 7 8 9 10 11 12 13 14 15
++					     16 17 18 19 20 21 22 23 24 25>;
++				/* Alt 1: SMI */
++				brcm,function = <5 5 5 5 5 5 5 5 5 5 5 5 5 5 5
++						 5 5 5 5 5 5 5 5 5>;
++				/* /CS, /WE and /OE are pulled high, as they are
++				   generally active low signals */
++				brcm,pull = <2 2 2 2 2 2 0 0 0 0 0 0 0 0 0 0 0
++					     0 0 0 0 0 0 0>;
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi-gpio35-39-overlay.dts b/arch/arm/boot/dts/overlays/spi-gpio35-39-overlay.dts
+new file mode 100644
+index 000000000000..a132b8637c31
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi-gpio35-39-overlay.dts
+@@ -0,0 +1,31 @@
++/*
++ * Device tree overlay to move spi0 to gpio 35 to 39 on CM
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			cs-gpios = <&gpio 36 1>, <&gpio 35 1>;
++		};
++	};
++
++	fragment@1 {
++		target = <&spi0_cs_pins>;
++		__overlay__ {
++			brcm,pins = <36 35>;
++		};
++	};
++
++	fragment@2 {
++		target = <&spi0_pins>;
++		__overlay__ {
++			brcm,pins = <37 38 39>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi-gpio40-45-overlay.dts b/arch/arm/boot/dts/overlays/spi-gpio40-45-overlay.dts
+new file mode 100644
+index 000000000000..9ebcaf1b5ea0
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi-gpio40-45-overlay.dts
+@@ -0,0 +1,36 @@
++/*
++ * Boot EEPROM overlay
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			cs-gpios = <&gpio 43 1>, <&gpio 44 1>, <&gpio 45 1>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spi0_cs_pins>;
++		__overlay__ {
++			brcm,pins = <45 44 43>;
++			brcm,function = <1>; /* output */
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&spi0_pins>;
++		__overlay__ {
++			brcm,pins = <40 41 42>;
++			brcm,function = <3>; /* alt4 */
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi-rtc-overlay.dts b/arch/arm/boot/dts/overlays/spi-rtc-overlay.dts
+new file mode 100644
+index 000000000000..df3286929c2e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi-rtc-overlay.dts
+@@ -0,0 +1,75 @@
++// Definitions for several SPI-based Real Time Clocks
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&rtc>;
++		__dormant__ {
++			compatible = "dallas,ds3232";
++		};
++	};
++
++	fragment@1 {
++		target = <&rtc>;
++		__dormant__ {
++			compatible = "dallas,ds3234";
++		};
++	};
++
++	fragment@2 {
++		target = <&rtc>;
++		__dormant__ {
++			compatible = "nxp,rtc-pcf2123";
++		};
++	};
++
++	spidev: fragment@100 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	frag101: fragment@101 {
++		target = <&spi0>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			rtc: rtc@0 {
++				reg = <0>;
++				spi-max-frequency = <5000000>;
++			};
++		};
++	};
++
++	__overrides__ {
++		spi0_0 = <&spidev>, "target:0=",<&spidev0>,
++		         <&frag101>, "target:0=",<&spi0>,
++		         <&rtc>, "reg:0=0";
++		spi0_1 = <&spidev>, "target:0=",<&spidev1>,
++		         <&frag101>, "target:0=",<&spi0>,
++		         <&rtc>, "reg:0=1";
++		spi1_0 = <0>,"-100",
++		         <&frag101>, "target:0=",<&spi1>,
++		         <&rtc>, "reg:0=0";
++		spi1_1 = <0>,"-100",
++		         <&frag101>, "target:0=",<&spi1>,
++		         <&rtc>, "reg:0=1";
++		spi2_0 = <0>,"-100",
++		         <&frag101>, "target:0=",<&spi2>,
++		         <&rtc>, "reg:0=0";
++		spi2_1 = <0>,"-100",
++		         <&frag101>, "target:0=",<&spi2>,
++		         <&rtc>, "reg:0=1";
++		cs_high = <&rtc>, "spi-cs-high?";
++
++		ds3232 = <0>,"+0";
++		ds3234 = <0>,"+1";
++		pcf2123 = <0>,"+2";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi0-0cs-overlay.dts b/arch/arm/boot/dts/overlays/spi0-0cs-overlay.dts
+new file mode 100644
+index 000000000000..0d2acabf56a4
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi0-0cs-overlay.dts
+@@ -0,0 +1,39 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0_cs_pins>;
++		frag0: __overlay__ {
++			brcm,pins;
++		};
++	};
++
++	fragment@1 {
++		target = <&spi0>;
++		__overlay__ {
++			cs-gpios;
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&spi0_pins>;
++		__dormant__ {
++			brcm,pins = <10 11>;
++		};
++	};
++
++	__overrides__ {
++		no_miso = <0>,"=3";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi0-1cs-overlay.dts b/arch/arm/boot/dts/overlays/spi0-1cs-overlay.dts
+new file mode 100644
+index 000000000000..e6eb66e2076a
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi0-1cs-overlay.dts
+@@ -0,0 +1,42 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0_cs_pins>;
++		frag0: __overlay__ {
++			brcm,pins = <8>;
++		};
++	};
++
++	fragment@1 {
++		target = <&spi0>;
++		frag1: __overlay__ {
++			cs-gpios = <&gpio 8 1>;
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&spi0_pins>;
++		__dormant__ {
++			brcm,pins = <10 11>;
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag0>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		no_miso = <0>,"=3";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi0-2cs-overlay.dts b/arch/arm/boot/dts/overlays/spi0-2cs-overlay.dts
+new file mode 100644
+index 000000000000..df6519537c3a
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi0-2cs-overlay.dts
+@@ -0,0 +1,37 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0_cs_pins>;
++		frag0: __overlay__ {
++			brcm,pins = <8 7>;
++		};
++	};
++
++	fragment@1 {
++		target = <&spi0>;
++		frag1: __overlay__ {
++			cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&spi0_pins>;
++		__dormant__ {
++			brcm,pins = <10 11>;
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag0>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs1_pin  = <&frag0>,"brcm,pins:4",
++			   <&frag1>,"cs-gpios:16";
++		no_miso = <0>,"=2";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi1-1cs-overlay.dts b/arch/arm/boot/dts/overlays/spi1-1cs-overlay.dts
+new file mode 100644
+index 000000000000..ea2794bc5fd5
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi1-1cs-overlay.dts
+@@ -0,0 +1,57 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			spi1_pins: spi1_pins {
++				brcm,pins = <19 20 21>;
++				brcm,function = <3>; /* alt4 */
++			};
++
++			spi1_cs_pins: spi1_cs_pins {
++				brcm,pins = <18>;
++				brcm,function = <1>; /* output */
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&spi1>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&spi1_pins &spi1_cs_pins>;
++			cs-gpios = <&gpio 18 1>;
++			status = "okay";
++
++			spidev1_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&aux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&spi1_cs_pins>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs0_spidev = <&spidev1_0>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi1-2cs-overlay.dts b/arch/arm/boot/dts/overlays/spi1-2cs-overlay.dts
+new file mode 100644
+index 000000000000..dab34ee79ae2
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi1-2cs-overlay.dts
+@@ -0,0 +1,69 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			spi1_pins: spi1_pins {
++				brcm,pins = <19 20 21>;
++				brcm,function = <3>; /* alt4 */
++			};
++
++			spi1_cs_pins: spi1_cs_pins {
++				brcm,pins = <18 17>;
++				brcm,function = <1>; /* output */
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&spi1>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&spi1_pins &spi1_cs_pins>;
++			cs-gpios = <&gpio 18 1>, <&gpio 17 1>;
++			status = "okay";
++
++			spidev1_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++
++			spidev1_1: spidev@1 {
++				compatible = "spidev";
++				reg = <1>;      /* CE1 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&aux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&spi1_cs_pins>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs1_pin  = <&spi1_cs_pins>,"brcm,pins:4",
++			   <&frag1>,"cs-gpios:16";
++		cs0_spidev = <&spidev1_0>,"status";
++		cs1_spidev = <&spidev1_1>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi1-3cs-overlay.dts b/arch/arm/boot/dts/overlays/spi1-3cs-overlay.dts
+new file mode 100644
+index 000000000000..bc7e7d04324b
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi1-3cs-overlay.dts
+@@ -0,0 +1,81 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			spi1_pins: spi1_pins {
++				brcm,pins = <19 20 21>;
++				brcm,function = <3>; /* alt4 */
++			};
++
++			spi1_cs_pins: spi1_cs_pins {
++				brcm,pins = <18 17 16>;
++				brcm,function = <1>; /* output */
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&spi1>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&spi1_pins &spi1_cs_pins>;
++			cs-gpios = <&gpio 18 1>, <&gpio 17 1>, <&gpio 16 1>;
++			status = "okay";
++
++			spidev1_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++
++			spidev1_1: spidev@1 {
++				compatible = "spidev";
++				reg = <1>;      /* CE1 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++
++			spidev1_2: spidev@2 {
++				compatible = "spidev";
++				reg = <2>;      /* CE2 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&aux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&spi1_cs_pins>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs1_pin  = <&spi1_cs_pins>,"brcm,pins:4",
++			   <&frag1>,"cs-gpios:16";
++		cs2_pin  = <&spi1_cs_pins>,"brcm,pins:8",
++			   <&frag1>,"cs-gpios:28";
++		cs0_spidev = <&spidev1_0>,"status";
++		cs1_spidev = <&spidev1_1>,"status";
++		cs2_spidev = <&spidev1_2>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi2-1cs-overlay.dts b/arch/arm/boot/dts/overlays/spi2-1cs-overlay.dts
+new file mode 100644
+index 000000000000..2a29750462af
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi2-1cs-overlay.dts
+@@ -0,0 +1,57 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			spi2_pins: spi2_pins {
++				brcm,pins = <40 41 42>;
++				brcm,function = <3>; /* alt4 */
++			};
++
++			spi2_cs_pins: spi2_cs_pins {
++				brcm,pins = <43>;
++				brcm,function = <1>; /* output */
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&spi2>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&spi2_pins &spi2_cs_pins>;
++			cs-gpios = <&gpio 43 1>;
++			status = "okay";
++
++			spidev2_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&aux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&spi2_cs_pins>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs0_spidev = <&spidev2_0>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi2-1cs-pi5-overlay.dts b/arch/arm/boot/dts/overlays/spi2-1cs-pi5-overlay.dts
+new file mode 100644
+index 000000000000..44382cc5a7c0
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi2-1cs-pi5-overlay.dts
+@@ -0,0 +1,33 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&spi2>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			cs-gpios = <&gpio 0 1>;
++			status = "okay";
++
++			spidev2_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag1>,"cs-gpios:4";
++		cs0_spidev = <&spidev2_0>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi2-2cs-overlay.dts b/arch/arm/boot/dts/overlays/spi2-2cs-overlay.dts
+new file mode 100644
+index 000000000000..642678fc9ddd
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi2-2cs-overlay.dts
+@@ -0,0 +1,69 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			spi2_pins: spi2_pins {
++				brcm,pins = <40 41 42>;
++				brcm,function = <3>; /* alt4 */
++			};
++
++			spi2_cs_pins: spi2_cs_pins {
++				brcm,pins = <43 44>;
++				brcm,function = <1>; /* output */
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&spi2>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&spi2_pins &spi2_cs_pins>;
++			cs-gpios = <&gpio 43 1>, <&gpio 44 1>;
++			status = "okay";
++
++			spidev2_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++
++			spidev2_1: spidev@1 {
++				compatible = "spidev";
++				reg = <1>;      /* CE1 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&aux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&spi2_cs_pins>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs1_pin  = <&spi2_cs_pins>,"brcm,pins:4",
++			   <&frag1>,"cs-gpios:16";
++		cs0_spidev = <&spidev2_0>,"status";
++		cs1_spidev = <&spidev2_1>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi2-2cs-pi5-overlay.dts b/arch/arm/boot/dts/overlays/spi2-2cs-pi5-overlay.dts
+new file mode 100644
+index 000000000000..b37a2c21c7b4
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi2-2cs-pi5-overlay.dts
+@@ -0,0 +1,44 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&spi2>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			cs-gpios = <&gpio 0 1>, <&gpio 24 1>;
++			status = "okay";
++
++			spidev2_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++
++			spidev2_1: spidev@1 {
++				compatible = "spidev";
++				reg = <1>;      /* CE1 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag1>,"cs-gpios:4";
++		cs1_pin  = <&frag1>,"cs-gpios:16";
++		cs0_spidev = <&spidev2_0>,"status";
++		cs1_spidev = <&spidev2_1>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi2-3cs-overlay.dts b/arch/arm/boot/dts/overlays/spi2-3cs-overlay.dts
+new file mode 100644
+index 000000000000..28d40c6c3c37
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi2-3cs-overlay.dts
+@@ -0,0 +1,81 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			spi2_pins: spi2_pins {
++				brcm,pins = <40 41 42>;
++				brcm,function = <3>; /* alt4 */
++			};
++
++			spi2_cs_pins: spi2_cs_pins {
++				brcm,pins = <43 44 45>;
++				brcm,function = <1>; /* output */
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&spi2>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&spi2_pins &spi2_cs_pins>;
++			cs-gpios = <&gpio 43 1>, <&gpio 44 1>, <&gpio 45 1>;
++			status = "okay";
++
++			spidev2_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++
++			spidev2_1: spidev@1 {
++				compatible = "spidev";
++				reg = <1>;      /* CE1 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++
++			spidev2_2: spidev@2 {
++				compatible = "spidev";
++				reg = <2>;      /* CE2 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&aux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&spi2_cs_pins>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs1_pin  = <&spi2_cs_pins>,"brcm,pins:4",
++			   <&frag1>,"cs-gpios:16";
++		cs2_pin  = <&spi2_cs_pins>,"brcm,pins:8",
++			   <&frag1>,"cs-gpios:28";
++		cs0_spidev = <&spidev2_0>,"status";
++		cs1_spidev = <&spidev2_1>,"status";
++		cs2_spidev = <&spidev2_2>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi3-1cs-overlay.dts b/arch/arm/boot/dts/overlays/spi3-1cs-overlay.dts
+new file mode 100644
+index 000000000000..7abea6d86fd0
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi3-1cs-overlay.dts
+@@ -0,0 +1,42 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&spi3_cs_pins>;
++		frag0: __overlay__ {
++			brcm,pins = <0>;
++			brcm,function = <1>; /* output */
++		};
++	};
++
++	fragment@1 {
++		target = <&spi3>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			cs-gpios = <&gpio 0 1>;
++			status = "okay";
++
++			spidev3_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag0>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs0_spidev = <&spidev3_0>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi3-1cs-pi5-overlay.dts b/arch/arm/boot/dts/overlays/spi3-1cs-pi5-overlay.dts
+new file mode 100644
+index 000000000000..a94e3a9f35ce
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi3-1cs-pi5-overlay.dts
+@@ -0,0 +1,33 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&spi3>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			cs-gpios = <&gpio 4 1>;
++			status = "okay";
++
++			spidev3_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag1>,"cs-gpios:4";
++		cs0_spidev = <&spidev3_0>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi3-2cs-overlay.dts b/arch/arm/boot/dts/overlays/spi3-2cs-overlay.dts
+new file mode 100644
+index 000000000000..2f474ac769f5
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi3-2cs-overlay.dts
+@@ -0,0 +1,54 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&spi3_cs_pins>;
++		frag0: __overlay__ {
++			brcm,pins = <0 24>;
++			brcm,function = <1>; /* output */
++		};
++	};
++
++	fragment@1 {
++		target = <&spi3>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			cs-gpios = <&gpio 0 1>, <&gpio 24 1>;
++			status = "okay";
++
++			spidev3_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++
++			spidev3_1: spidev@1 {
++				compatible = "spidev";
++				reg = <1>;      /* CE1 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag0>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs1_pin  = <&frag0>,"brcm,pins:4",
++			   <&frag1>,"cs-gpios:16";
++		cs0_spidev = <&spidev3_0>,"status";
++		cs1_spidev = <&spidev3_1>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi3-2cs-pi5-overlay.dts b/arch/arm/boot/dts/overlays/spi3-2cs-pi5-overlay.dts
+new file mode 100644
+index 000000000000..259548b37d5c
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi3-2cs-pi5-overlay.dts
+@@ -0,0 +1,44 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&spi3>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			cs-gpios = <&gpio 4 1>, <&gpio 25 1>;
++			status = "okay";
++
++			spidev3_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++
++			spidev3_1: spidev@1 {
++				compatible = "spidev";
++				reg = <1>;      /* CE1 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag1>,"cs-gpios:4";
++		cs1_pin  = <&frag1>,"cs-gpios:16";
++		cs0_spidev = <&spidev3_0>,"status";
++		cs1_spidev = <&spidev3_1>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi4-1cs-overlay.dts b/arch/arm/boot/dts/overlays/spi4-1cs-overlay.dts
+new file mode 100644
+index 000000000000..66d89521124a
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi4-1cs-overlay.dts
+@@ -0,0 +1,42 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&spi4_cs_pins>;
++		frag0: __overlay__ {
++			brcm,pins = <4>;
++			brcm,function = <1>; /* output */
++		};
++	};
++
++	fragment@1 {
++		target = <&spi4>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			cs-gpios = <&gpio 4 1>;
++			status = "okay";
++
++			spidev4_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag0>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs0_spidev = <&spidev4_0>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi4-2cs-overlay.dts b/arch/arm/boot/dts/overlays/spi4-2cs-overlay.dts
+new file mode 100644
+index 000000000000..83d8cb8b918c
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi4-2cs-overlay.dts
+@@ -0,0 +1,54 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&spi4_cs_pins>;
++		frag0: __overlay__ {
++			brcm,pins = <4 25>;
++			brcm,function = <1>; /* output */
++		};
++	};
++
++	fragment@1 {
++		target = <&spi4>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			cs-gpios = <&gpio 4 1>, <&gpio 25 1>;
++			status = "okay";
++
++			spidev4_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++
++			spidev4_1: spidev@1 {
++				compatible = "spidev";
++				reg = <1>;      /* CE1 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag0>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs1_pin  = <&frag0>,"brcm,pins:4",
++			   <&frag1>,"cs-gpios:16";
++		cs0_spidev = <&spidev4_0>,"status";
++		cs1_spidev = <&spidev4_1>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi5-1cs-overlay.dts b/arch/arm/boot/dts/overlays/spi5-1cs-overlay.dts
+new file mode 100644
+index 000000000000..168b4825de34
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi5-1cs-overlay.dts
+@@ -0,0 +1,42 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&spi5_cs_pins>;
++		frag0: __overlay__ {
++			brcm,pins = <12>;
++			brcm,function = <1>; /* output */
++		};
++	};
++
++	fragment@1 {
++		target = <&spi5>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			cs-gpios = <&gpio 12 1>;
++			status = "okay";
++
++			spidev5_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag0>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs0_spidev = <&spidev5_0>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi5-1cs-pi5-overlay.dts b/arch/arm/boot/dts/overlays/spi5-1cs-pi5-overlay.dts
+new file mode 100644
+index 000000000000..bde1837f26c0
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi5-1cs-pi5-overlay.dts
+@@ -0,0 +1,33 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&spi5>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			cs-gpios = <&gpio 12 1>;
++			status = "okay";
++
++			spidev5_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag1>,"cs-gpios:4";
++		cs0_spidev = <&spidev5_0>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi5-2cs-overlay.dts b/arch/arm/boot/dts/overlays/spi5-2cs-overlay.dts
+new file mode 100644
+index 000000000000..c2a239a34b35
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi5-2cs-overlay.dts
+@@ -0,0 +1,54 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&spi5_cs_pins>;
++		frag0: __overlay__ {
++			brcm,pins = <12 26>;
++			brcm,function = <1>; /* output */
++		};
++	};
++
++	fragment@1 {
++		target = <&spi5>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			cs-gpios = <&gpio 12 1>, <&gpio 26 1>;
++			status = "okay";
++
++			spidev5_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++
++			spidev5_1: spidev@1 {
++				compatible = "spidev";
++				reg = <1>;      /* CE1 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag0>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs1_pin  = <&frag0>,"brcm,pins:4",
++			   <&frag1>,"cs-gpios:16";
++		cs0_spidev = <&spidev5_0>,"status";
++		cs1_spidev = <&spidev5_1>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi5-2cs-pi5-overlay.dts b/arch/arm/boot/dts/overlays/spi5-2cs-pi5-overlay.dts
+new file mode 100644
+index 000000000000..2c9eee2a9db8
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi5-2cs-pi5-overlay.dts
+@@ -0,0 +1,44 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&spi5>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			cs-gpios = <&gpio 12 1>, <&gpio 26 1>;
++			status = "okay";
++
++			spidev5_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++
++			spidev5_1: spidev@1 {
++				compatible = "spidev";
++				reg = <1>;      /* CE1 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag1>,"cs-gpios:4";
++		cs1_pin  = <&frag1>,"cs-gpios:16";
++		cs0_spidev = <&spidev5_0>,"status";
++		cs1_spidev = <&spidev5_1>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi6-1cs-overlay.dts b/arch/arm/boot/dts/overlays/spi6-1cs-overlay.dts
+new file mode 100644
+index 000000000000..a784f8a17d23
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi6-1cs-overlay.dts
+@@ -0,0 +1,42 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&spi6_cs_pins>;
++		frag0: __overlay__ {
++			brcm,pins = <18>;
++			brcm,function = <1>; /* output */
++		};
++	};
++
++	fragment@1 {
++		target = <&spi6>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			cs-gpios = <&gpio 18 1>;
++			status = "okay";
++
++			spidev6_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag0>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs0_spidev = <&spidev6_0>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/spi6-2cs-overlay.dts b/arch/arm/boot/dts/overlays/spi6-2cs-overlay.dts
+new file mode 100644
+index 000000000000..8ef513814d2b
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi6-2cs-overlay.dts
+@@ -0,0 +1,54 @@
++/dts-v1/;
++/plugin/;
++
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&spi6_cs_pins>;
++		frag0: __overlay__ {
++			brcm,pins = <18 27>;
++			brcm,function = <1>; /* output */
++		};
++	};
++
++	fragment@1 {
++		target = <&spi6>;
++		frag1: __overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			cs-gpios = <&gpio 18 1>, <&gpio 27 1>;
++			status = "okay";
++
++			spidev6_0: spidev@0 {
++				compatible = "spidev";
++				reg = <0>;      /* CE0 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++
++			spidev6_1: spidev@1 {
++				compatible = "spidev";
++				reg = <1>;      /* CE1 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "okay";
++			};
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag0>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		cs1_pin  = <&frag0>,"brcm,pins:4",
++			   <&frag1>,"cs-gpios:16";
++		cs0_spidev = <&spidev6_0>,"status";
++		cs1_spidev = <&spidev6_1>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/ssd1306-overlay.dts b/arch/arm/boot/dts/overlays/ssd1306-overlay.dts
+new file mode 100644
+index 000000000000..84cf10e489d3
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ssd1306-overlay.dts
+@@ -0,0 +1,36 @@
++// Overlay for SSD1306 128x64 and 128x32 OLED displays
++/dts-v1/;
++/plugin/;
++
++/ {
++    compatible = "brcm,bcm2835";
++
++    fragment@0 {
++	target = <&i2c1>;
++	__overlay__ {
++	    status = "okay";
++
++	    #address-cells = <1>;
++	    #size-cells = <0>;
++
++	    ssd1306: oled@3c{
++		compatible = "solomon,ssd1306fb-i2c";
++		reg = <0x3c>;
++		solomon,width = <128>;
++		solomon,height = <64>;
++		solomon,page-offset = <0>;
++	    };
++	};
++    };
++
++    __overrides__ {
++	address = <&ssd1306>,"reg:0";
++	width = <&ssd1306>,"solomon,width:0";
++	height = <&ssd1306>,"solomon,height:0";
++	offset = <&ssd1306>,"solomon,page-offset:0";
++	normal = <&ssd1306>,"solomon,segment-no-remap?";
++	sequential = <&ssd1306>,"solomon,com-seq?";
++	remapped = <&ssd1306>,"solomon,com-lrremap?";
++	inverted = <&ssd1306>,"solomon,com-invdir?";
++    };
++};
+diff --git a/arch/arm/boot/dts/overlays/ssd1306-spi-overlay.dts b/arch/arm/boot/dts/overlays/ssd1306-spi-overlay.dts
+new file mode 100644
+index 000000000000..679749fc3065
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ssd1306-spi-overlay.dts
+@@ -0,0 +1,85 @@
++/*
++ * Device Tree overlay for SSD1306 based SPI OLED display
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			ssd1306_pins: ssd1306_pins {
++                                brcm,pins = <25 24>;
++                                brcm,function = <1 1>; /* out out */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			ssd1306: ssd1306@0{
++				compatible = "solomon,ssd1306";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&ssd1306_pins>;
++
++				spi-max-frequency = <10000000>;
++				bgr = <0>;
++				bpp = <1>;
++				rotate = <0>;
++				fps = <25>;
++				buswidth = <8>;
++				reset-gpios = <&gpio 25 1>;
++				dc-gpios = <&gpio 24 0>;
++				debug = <0>;
++
++				solomon,height = <64>;
++				solomon,width = <128>;
++				solomon,page-offset = <0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		speed     = <&ssd1306>,"spi-max-frequency:0";
++		rotate    = <&ssd1306>,"rotate:0";
++		fps       = <&ssd1306>,"fps:0";
++		debug     = <&ssd1306>,"debug:0";
++		dc_pin    = <&ssd1306>,"dc-gpios:4",
++		            <&ssd1306_pins>,"brcm,pins:4";
++		reset_pin = <&ssd1306>,"reset-gpios:4",
++		            <&ssd1306_pins>,"brcm,pins:0";
++		height    = <&ssd1306>,"solomon,height:0";
++		inverted = <&ssd1306>,"solomon,com-invdir?";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/ssd1327-spi-overlay.dts b/arch/arm/boot/dts/overlays/ssd1327-spi-overlay.dts
+new file mode 100644
+index 000000000000..c0770738c176
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ssd1327-spi-overlay.dts
+@@ -0,0 +1,70 @@
++/*
++ * Device Tree overlay for SSD1327 based SPI OLED display
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			ssd1327_pins: ssd1327_pins {
++				brcm,pins = <25 24>;
++				brcm,function = <1 1>;
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			ssd1327: ssd1327@0{
++				compatible = "solomon,ssd1327";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&ssd1327_pins>;
++
++				spi-max-frequency = <4500000>;
++				reset-gpios = <&gpio 25 1>;
++				dc-gpios = <&gpio 24 0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		speed     = <&ssd1327>,"spi-max-frequency:0";
++		dc_pin    = <&ssd1327>,"dc-gpios:4",
++			    <&ssd1327_pins>,"brcm,pins:4";
++		reset_pin = <&ssd1327>,"reset-gpios:4",
++			    <&ssd1327_pins>,"brcm,pins:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/ssd1331-spi-overlay.dts b/arch/arm/boot/dts/overlays/ssd1331-spi-overlay.dts
+new file mode 100644
+index 000000000000..9fd5ebf2feda
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ssd1331-spi-overlay.dts
+@@ -0,0 +1,83 @@
++/*
++ * Device Tree overlay for SSD1331 based SPI OLED display
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++        compatible = "brcm,bcm2835";
++
++        fragment@0 {
++                target = <&spi0>;
++                __overlay__ {
++                        status = "okay";
++                };
++        };
++
++        fragment@1 {
++                target = <&spidev0>;
++                __overlay__ {
++                        status = "disabled";
++                };
++        };
++
++        fragment@2 {
++                target = <&spidev1>;
++                __overlay__ {
++                        status = "disabled";
++                };
++        };
++
++        fragment@3 {
++                target = <&gpio>;
++                __overlay__ {
++                        ssd1331_pins: ssd1331_pins {
++                                brcm,pins = <25 24>;
++                                brcm,function = <1 1>; /* out out */
++                        };
++                };
++        };
++
++        fragment@4 {
++                target = <&spi0>;
++                __overlay__ {
++                        /* needed to avoid dtc warning */
++                        #address-cells = <1>;
++                        #size-cells = <0>;
++
++                        ssd1331: ssd1331@0{
++                                compatible = "solomon,ssd1331";
++                                reg = <0>;
++                                pinctrl-names = "default";
++                                pinctrl-0 = <&ssd1331_pins>;
++
++                                spi-max-frequency = <4500000>;
++                                bgr = <0>;
++                                bpp = <16>;
++                                rotate = <0>;
++                                fps = <25>;
++                                buswidth = <8>;
++                                reset-gpios = <&gpio 25 1>;
++                                dc-gpios = <&gpio 24 0>;
++                                debug = <0>;
++
++                                solomon,height = <64>;
++                                solomon,width = <96>;
++                                solomon,page-offset = <0>;
++                        };
++                };
++        };
++
++        __overrides__ {
++                speed     = <&ssd1331>,"spi-max-frequency:0";
++                rotate    = <&ssd1331>,"rotate:0";
++                fps       = <&ssd1331>,"fps:0";
++                debug     = <&ssd1331>,"debug:0";
++                dc_pin    = <&ssd1331>,"dc-gpios:4",
++                            <&ssd1331_pins>,"brcm,pins:4";
++                reset_pin = <&ssd1331>,"reset-gpios:4",
++                            <&ssd1331_pins>,"brcm,pins:0";
++        };
++};
+diff --git a/arch/arm/boot/dts/overlays/ssd1351-spi-overlay.dts b/arch/arm/boot/dts/overlays/ssd1351-spi-overlay.dts
+new file mode 100644
+index 000000000000..ffc872c60648
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ssd1351-spi-overlay.dts
+@@ -0,0 +1,83 @@
++/*
++ * Device Tree overlay for SSD1351 based SPI OLED display
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			ssd1351_pins: ssd1351_pins {
++                                brcm,pins = <25 24>;
++                                brcm,function = <1 1>; /* out out */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			ssd1351: ssd1351@0{
++				compatible = "solomon,ssd1351";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&ssd1351_pins>;
++
++				spi-max-frequency = <4500000>;
++				bgr = <0>;
++				bpp = <16>;
++				rotate = <0>;
++				fps = <25>;
++				buswidth = <8>;
++				reset-gpios = <&gpio 25 1>;
++				dc-gpios = <&gpio 24 0>;
++				debug = <0>;
++
++				solomon,height = <128>;
++				solomon,width = <128>;
++				solomon,page-offset = <0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		speed     = <&ssd1351>,"spi-max-frequency:0";
++		rotate    = <&ssd1351>,"rotate:0";
++		fps       = <&ssd1351>,"fps:0";
++		debug     = <&ssd1351>,"debug:0";
++		dc_pin    = <&ssd1351>,"dc-gpios:4",
++		            <&ssd1351_pins>,"brcm,pins:4";
++		reset_pin = <&ssd1351>,"reset-gpios:4",
++		            <&ssd1351_pins>,"brcm,pins:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/sunfounder-pipower3-overlay.dts b/arch/arm/boot/dts/overlays/sunfounder-pipower3-overlay.dts
+new file mode 100644
+index 000000000000..cd5e8e68f20d
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/sunfounder-pipower3-overlay.dts
+@@ -0,0 +1,44 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/chosen";
++		__overlay__ {
++			power: power {
++				hat_current_supply = <5000>;
++			};
++		};
++	};
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@2 {
++		target-path = "/";
++		__overlay__ {
++			power_ctrl: power_ctrl {
++				compatible = "gpio-poweroff";
++				gpios = <&gpio 26 0>;
++				force;
++			};
++		};
++	};
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			power_ctrl_pins: power_ctrl_pins {
++				brcm,pins = <26>;
++				brcm,function = <1>; // out
++			};
++		};
++	};
++	__overrides__ {
++		poweroff_pin =	<&power_ctrl>,"gpios:4",
++						<&power_ctrl_pins>,"brcm,pins:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/sunfounder-pironman5-overlay.dts b/arch/arm/boot/dts/overlays/sunfounder-pironman5-overlay.dts
+new file mode 100644
+index 000000000000..fad68ef1813f
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/sunfounder-pironman5-overlay.dts
+@@ -0,0 +1,55 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c1>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@1 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@2 {
++		target-path = "/";
++		__overlay__ {
++			gpio_ir: ir-receiver@d {
++				compatible = "gpio-ir-receiver";
++				pinctrl-names = "default";
++				pinctrl-0 = <&gpio_ir_pins>;
++
++				// pin number, high or low
++				gpios = <&gpio 13 1>;
++
++				// parameter for keymap name
++				linux,rc-map-name = "rc-rc6-mce";
++
++				status = "okay";
++			};
++		};
++	};
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			gpio_ir_pins: gpio_ir_pins@d {
++				brcm,pins = <13>;
++				brcm,function = <0>;
++				brcm,pull = <2>;
++			};
++		};
++	};
++	__overrides__ {
++		ir = <&gpio_ir>,"status";
++		ir_pins =
++			<&gpio_ir>,"gpios:4",
++			<&gpio_ir>,"reg:0",
++			<&gpio_ir_pins>,"brcm,pins:0",
++			<&gpio_ir_pins>,"reg:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/superaudioboard-overlay.dts b/arch/arm/boot/dts/overlays/superaudioboard-overlay.dts
+new file mode 100755
+index 000000000000..1006d5fe9e06
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/superaudioboard-overlay.dts
+@@ -0,0 +1,73 @@
++// Definitions for SuperAudioBoard
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&sound>;
++		__overlay__ {
++			compatible = "simple-audio-card";
++			i2s-controller = <&i2s_clk_consumer>;
++			status = "okay";
++
++			simple-audio-card,name = "SuperAudioBoard";
++
++			simple-audio-card,widgets =
++				"Line", "Line In",
++				"Line", "Line Out";
++
++			simple-audio-card,routing =
++				"Line Out","AOUTA+",
++				"Line Out","AOUTA-",
++				"Line Out","AOUTB+",
++				"Line Out","AOUTB-",
++				"AINA","Line In",
++				"AINB","Line In";
++
++			simple-audio-card,format = "i2s";
++
++			simple-audio-card,bitclock-master = <&sound_master>;
++			simple-audio-card,frame-master = <&sound_master>;
++
++			simple-audio-card,cpu {
++				sound-dai = <&i2s_clk_consumer>;
++				dai-tdm-slot-num = <2>;
++				dai-tdm-slot-width = <32>;
++			};
++
++			sound_master: simple-audio-card,codec {
++				sound-dai = <&cs4271>;
++				system-clock-frequency = <24576000>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++    
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			cs4271: cs4271@10 {
++				#sound-dai-cells = <0>;
++				compatible = "cirrus,cs4271";
++				reg = <0x10>;
++				status = "okay";
++				reset-gpio = <&gpio 26 0>; /* Pin 26, active high */
++			};
++		};
++	};
++	__overrides__ {
++		gpiopin = <&cs4271>,"reset-gpio:4";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/sx150x-overlay.dts b/arch/arm/boot/dts/overlays/sx150x-overlay.dts
+new file mode 100644
+index 000000000000..1d1069345da2
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/sx150x-overlay.dts
+@@ -0,0 +1,1706 @@
++// Definitions for SX150x I2C GPIO Expanders from Semtech
++
++// dtparams:
++//     sx150<x>-<n>-<m>          - Enables SX150X device on I2C#<n> with slave address <m>. <x> may be 1-9.
++//                                 <n> may be 0 or 1.  Permissible values of <m> (which is denoted in hex)
++//                                 depend on the device variant.
++//                                 For SX1501, SX1502, SX1504 and SX1505, <m> may be 20 or 21.
++//                                 For SX1503 and SX1506, <m> may be 20.
++//                                 For SX1507 and SX1509, <m> may be 3E, 3F, 70 or 71.
++//                                 For SX1508, <m> may be 20, 21, 22 or 23.
++//     sx150<x>-<n>-<m>-int-gpio - Integer, enables interrupts on SX150X device on I2C#<n> with slave address <m>,
++//                                 specifies the GPIO pin to which NINT output of SX150X is connected.
++//
++//
++// Example 1: A single SX1505 device on I2C#1 with its slave address set to 0x20 and NINT output connected to GPIO25:
++// dtoverlay=sx150x:sx1505-1-20,sx1505-1-20-int-gpio=25
++//
++// Example 2: Two SX1507 devices on I2C#0 with their slave addresses set to 0x3E and 0x70 (interrupts not used):
++// dtoverlay=sx150x:sx1507-0-3E,sx1507-0-70
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	// Enable I2C#0 interface
++	fragment@0 {
++		target = <&i2c0>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	// Enable I2C#1 interface
++	fragment@1 {
++		target = <&i2c1>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	// Enable a SX1501 on I2C#0 at slave addr 0x20
++	fragment@2 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1501_0_20: sx150x@20 {
++				compatible = "semtech,sx1501q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1501-0-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1501 on I2C#1 at slave addr 0x20
++	fragment@3 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1501_1_20: sx150x@20 {
++				compatible = "semtech,sx1501q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1501-1-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1501 on I2C#0 at slave addr 0x21
++	fragment@4 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1501_0_21: sx150x@21 {
++				compatible = "semtech,sx1501q";
++				reg = <0x21>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1501-0-21-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1501 on I2C#1 at slave addr 0x21
++	fragment@5 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1501_1_21: sx150x@21 {
++				compatible = "semtech,sx1501q";
++				reg = <0x21>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1501-1-21-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1502 on I2C#0 at slave addr 0x20
++	fragment@6 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1502_0_20: sx150x@20 {
++				compatible = "semtech,sx1502q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1502-0-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1502 on I2C#1 at slave addr 0x20
++	fragment@7 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1502_1_20: sx150x@20 {
++				compatible = "semtech,sx1502q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1502-1-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1502 on I2C#0 at slave addr 0x21
++	fragment@8 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1502_0_21: sx150x@21 {
++				compatible = "semtech,sx1502q";
++				reg = <0x21>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1502-0-21-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1502 on I2C#1 at slave addr 0x21
++	fragment@9 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1502_1_21: sx150x@21 {
++				compatible = "semtech,sx1502q";
++				reg = <0x21>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1501-1-21-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1503 on I2C#0 at slave addr 0x20
++	fragment@10 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1503_0_20: sx150x@20 {
++				compatible = "semtech,sx1503q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1503-0-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1503 on I2C#1 at slave addr 0x20
++	fragment@11 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1503_1_20: sx150x@20 {
++				compatible = "semtech,sx1503q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1503-1-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1504 on I2C#0 at slave addr 0x20
++	fragment@12 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1504_0_20: sx150x@20 {
++				compatible = "semtech,sx1504q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1504-0-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1504 on I2C#1 at slave addr 0x20
++	fragment@13 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1504_1_20: sx150x@20 {
++				compatible = "semtech,sx1504q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1504-1-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1504 on I2C#0 at slave addr 0x21
++	fragment@14 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1504_0_21: sx150x@21 {
++				compatible = "semtech,sx1504q";
++				reg = <0x21>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1504-0-21-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1504 on I2C#1 at slave addr 0x21
++	fragment@15 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1504_1_21: sx150x@21 {
++				compatible = "semtech,sx1504q";
++				reg = <0x21>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1504-1-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1505 on I2C#0 at slave addr 0x20
++	fragment@16 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1505_0_20: sx150x@20 {
++				compatible = "semtech,sx1505q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1505-0-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1505 on I2C#1 at slave addr 0x20
++	fragment@17 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1505_1_20: sx150x@20 {
++				compatible = "semtech,sx1505q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1505-1-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1505 on I2C#0 at slave addr 0x21
++	fragment@18 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1505_0_21: sx150x@21 {
++				compatible = "semtech,sx1505q";
++				reg = <0x21>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1505-0-21-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1505 on I2C#1 at slave addr 0x21
++	fragment@19 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1505_1_21: sx150x@21 {
++				compatible = "semtech,sx1505q";
++				reg = <0x21>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1505-1-21-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1506 on I2C#0 at slave addr 0x20
++	fragment@20 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1506_0_20: sx150x@20 {
++				compatible = "semtech,sx1506q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1506-0-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1506 on I2C#1 at slave addr 0x20
++	fragment@21 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1506_1_20: sx150x@20 {
++				compatible = "semtech,sx1506q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1506-1-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1507 on I2C#0 at slave addr 0x3E
++	fragment@22 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1507_0_3E: sx150x@3E {
++				compatible = "semtech,sx1507q";
++				reg = <0x3E>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1507_0_3E-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1507 on I2C#1 at slave addr 0x3E
++	fragment@23 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1507_1_3E: sx150x@3E {
++				compatible = "semtech,sx1507q";
++				reg = <0x3E>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1507_1_3E-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1507 on I2C#0 at slave addr 0x3F
++	fragment@24 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1507_0_3F: sx150x@3F {
++				compatible = "semtech,sx1507q";
++				reg = <0x3F>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1507_0_3F-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1507 on I2C#1 at slave addr 0x3F
++	fragment@25 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1507_1_3F: sx150x@3F {
++				compatible = "semtech,sx1507q";
++				reg = <0x3F>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1507_1_3F-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1507 on I2C#0 at slave addr 0x70
++	fragment@26 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1507_0_70: sx150x@70 {
++				compatible = "semtech,sx1507q";
++				reg = <0x70>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1507-0-70-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1507 on I2C#1 at slave addr 0x70
++	fragment@27 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1507_1_70: sx150x@70 {
++				compatible = "semtech,sx1507q";
++				reg = <0x70>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1507-1-70-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1507 on I2C#0 at slave addr 0x71
++	fragment@28 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1507_0_71: sx150x@71 {
++				compatible = "semtech,sx1507q";
++				reg = <0x71>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1507-0-71-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1507 on I2C#1 at slave addr 0x71
++	fragment@29 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1507_1_71: sx150x@71 {
++				compatible = "semtech,sx1507q";
++				reg = <0x71>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1507-1-71-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1508 on I2C#0 at slave addr 0x20
++	fragment@30 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1508_0_20: sx150x@20 {
++				compatible = "semtech,sx1508q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1508-0-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1508 on I2C#1 at slave addr 0x20
++	fragment@31 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1508_1_20: sx150x@20 {
++				compatible = "semtech,sx1508q";
++				reg = <0x20>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1508-1-20-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1508 on I2C#0 at slave addr 0x21
++	fragment@32 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1508_0_21: sx150x@21 {
++				compatible = "semtech,sx1508q";
++				reg = <0x21>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1508-0-21-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1508 on I2C#1 at slave addr 0x21
++	fragment@33 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1508_1_21: sx150x@21 {
++				compatible = "semtech,sx1508q";
++				reg = <0x21>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1508-1-21-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1508 on I2C#0 at slave addr 0x22
++	fragment@34 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1508_0_22: sx150x@22 {
++				compatible = "semtech,sx1508q";
++				reg = <0x22>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1508-0-22-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1508 on I2C#1 at slave addr 0x22
++	fragment@35 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1508_1_22: sx150x@22 {
++				compatible = "semtech,sx1508q";
++				reg = <0x22>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1508-1-22-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1508 on I2C#0 at slave addr 0x23
++	fragment@36 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1508_0_23: sx150x@23 {
++				compatible = "semtech,sx1508q";
++				reg = <0x23>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1508-0-23-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1508 on I2C#1 at slave addr 0x23
++	fragment@37 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1508_1_23: sx150x@23 {
++				compatible = "semtech,sx1508q";
++				reg = <0x23>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1508-1-23-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1509 on I2C#0 at slave addr 0x3E
++	fragment@38 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1509_0_3E: sx150x@3E {
++				compatible = "semtech,sx1509q";
++				reg = <0x3E>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1509_0_3E-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1509 on I2C#1 at slave addr 0x3E
++	fragment@39 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1509_1_3E: sx150x@3E {
++				compatible = "semtech,sx1509q";
++				reg = <0x3E>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1509_1_3E-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1509 on I2C#0 at slave addr 0x3F
++	fragment@40 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1509_0_3F: sx150x@3F {
++				compatible = "semtech,sx1509q";
++				reg = <0x3F>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1509_0_3F-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1509 on I2C#1 at slave addr 0x3F
++	fragment@41 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1509_1_3F: sx150x@3F {
++				compatible = "semtech,sx1509q";
++				reg = <0x3F>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1509_1_3F-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1509 on I2C#0 at slave addr 0x70
++	fragment@42 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1509_0_70: sx150x@70 {
++				compatible = "semtech,sx1509q";
++				reg = <0x70>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1509-0-70-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1509 on I2C#1 at slave addr 0x70
++	fragment@43 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1509_1_70: sx150x@70 {
++				compatible = "semtech,sx1509q";
++				reg = <0x70>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1509-1-70-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1509 on I2C#0 at slave addr 0x71
++	fragment@44 {
++		target = <&i2c0>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1509_0_71: sx150x@71 {
++				compatible = "semtech,sx1509q";
++				reg = <0x71>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1509-0-71-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable a SX1509 on I2C#1 at slave addr 0x71
++	fragment@45 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			sx1509_1_71: sx150x@71 {
++				compatible = "semtech,sx1509q";
++				reg = <0x71>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				#interrupt-cells = <2>;
++				interrupts = <25 2>; /* 1st word overwritten by sx1509-1-71-int-gpio parameter
++				                        2nd word is 2 for falling-edge triggered */
++				status = "okay";
++			};
++		};
++	};
++
++	// Enable interrupts for a SX1501 on I2C#0 at slave addr 0x20
++	fragment@46 {
++		target = <&sx1501_0_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1501 on I2C#1 at slave addr 0x20
++	fragment@47 {
++		target = <&sx1501_1_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1501 on I2C#0 at slave addr 0x21
++	fragment@48 {
++		target = <&sx1501_0_21>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_21_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1501 on I2C#1 at slave addr 0x21
++	fragment@49 {
++		target = <&sx1501_1_21>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_21_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1502 on I2C#0 at slave addr 0x20
++	fragment@50 {
++		target = <&sx1502_0_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1502 on I2C#1 at slave addr 0x20
++	fragment@51 {
++		target = <&sx1502_1_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1502 on I2C#0 at slave addr 0x21
++	fragment@52 {
++		target = <&sx1502_0_21>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_21_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1502 on I2C#1 at slave addr 0x21
++	fragment@53 {
++		target = <&sx1502_1_21>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_21_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1503 on I2C#0 at slave addr 0x20
++	fragment@54 {
++		target = <&sx1503_0_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1503 on I2C#1 at slave addr 0x20
++	fragment@55 {
++		target = <&sx1503_1_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1504 on I2C#0 at slave addr 0x20
++	fragment@56 {
++		target = <&sx1504_0_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1504 on I2C#1 at slave addr 0x20
++	fragment@57 {
++		target = <&sx1504_1_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1504 on I2C#0 at slave addr 0x21
++	fragment@58 {
++		target = <&sx1504_0_21>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_21_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1504 on I2C#1 at slave addr 0x21
++	fragment@59 {
++		target = <&sx1504_1_21>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_21_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1505 on I2C#0 at slave addr 0x20
++	fragment@60 {
++		target = <&sx1505_0_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1505 on I2C#1 at slave addr 0x20
++	fragment@61 {
++		target = <&sx1505_1_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1505 on I2C#0 at slave addr 0x21
++	fragment@62 {
++		target = <&sx1505_0_21>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_21_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1505 on I2C#1 at slave addr 0x21
++	fragment@63 {
++		target = <&sx1505_1_21>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_21_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1506 on I2C#0 at slave addr 0x20
++	fragment@64 {
++		target = <&sx1506_0_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1506 on I2C#1 at slave addr 0x20
++	fragment@65 {
++		target = <&sx1506_1_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1507 on I2C#0 at slave addr 0x3E
++	fragment@66 {
++		target = <&sx1507_0_3E>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_3E_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1507 on I2C#1 at slave addr 0x3E
++	fragment@67 {
++		target = <&sx1507_1_3E>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_3E_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1507 on I2C#0 at slave addr 0x3F
++	fragment@68 {
++		target = <&sx1507_0_3F>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_3F_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1507 on I2C#1 at slave addr 0x3F
++	fragment@69 {
++		target = <&sx1507_1_3F>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_3F_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1507 on I2C#0 at slave addr 0x70
++	fragment@70 {
++		target = <&sx1507_0_70>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_70_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1507 on I2C#1 at slave addr 0x70
++	fragment@71 {
++		target = <&sx1507_1_70>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_70_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1507 on I2C#0 at slave addr 0x71
++	fragment@72 {
++		target = <&sx1507_0_71>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_71_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1507 on I2C#1 at slave addr 0x71
++	fragment@73 {
++		target = <&sx1507_1_71>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_71_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1508 on I2C#0 at slave addr 0x20
++	fragment@74 {
++		target = <&sx1508_0_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1508 on I2C#1 at slave addr 0x20
++	fragment@75 {
++		target = <&sx1508_1_20>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_20_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1508 on I2C#0 at slave addr 0x21
++	fragment@76 {
++		target = <&sx1508_0_21>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_21_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1508 on I2C#1 at slave addr 0x21
++	fragment@77 {
++		target = <&sx1508_1_21>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_21_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1508 on I2C#0 at slave addr 0x22
++	fragment@78 {
++		target = <&sx1508_0_22>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_22_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1508 on I2C#1 at slave addr 0x22
++	fragment@79 {
++		target = <&sx1508_1_22>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_22_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1508 on I2C#0 at slave addr 0x23
++	fragment@80 {
++		target = <&sx1508_0_23>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_23_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1508 on I2C#1 at slave addr 0x23
++	fragment@81 {
++		target = <&sx1508_1_23>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_23_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1509 on I2C#0 at slave addr 0x3E
++	fragment@82 {
++		target = <&sx1509_0_3E>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_3E_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1509 on I2C#1 at slave addr 0x3E
++	fragment@83 {
++		target = <&sx1509_1_3E>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_3E_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1509 on I2C#0 at slave addr 0x3F
++	fragment@84 {
++		target = <&sx1509_0_3F>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_3F_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1509 on I2C#1 at slave addr 0x3F
++	fragment@85 {
++		target = <&sx1509_1_3F>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_3F_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1509 on I2C#0 at slave addr 0x70
++	fragment@86 {
++		target = <&sx1509_0_70>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_70_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1509 on I2C#1 at slave addr 0x70
++	fragment@87 {
++		target = <&sx1509_1_70>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_70_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1509 on I2C#0 at slave addr 0x71
++	fragment@88 {
++		target = <&sx1509_0_71>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_0_71_pins>;
++		};
++	};
++
++	// Enable interrupts for a SX1509 on I2C#1 at slave addr 0x71
++	fragment@89 {
++		target = <&sx1509_1_71>;
++		__dormant__ {
++			interrupt-parent = <&gpio>;
++			interrupt-controller;
++			pinctrl-names = "default";
++			pinctrl-0 = <&sx150x_1_71_pins>;
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x20
++        // Configure as a input with no pull-up/down
++	fragment@90 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_0_20_pins: sx150x_0_20_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-0-20-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x20
++        // Configure as a input with no pull-up/down
++	fragment@91 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_1_20_pins: sx150x_1_20_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-1-20-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x21
++        // Configure as a input with no pull-up/down
++	fragment@92 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_0_21_pins: sx150x_0_21_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-0-21-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x21
++        // Configure as a input with no pull-up/down
++	fragment@93 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_1_21_pins: sx150x_1_21_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-1-21-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x22
++        // Configure as a input with no pull-up/down
++	fragment@94 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_0_22_pins: sx150x_0_22_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-0-22-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x22
++        // Configure as a input with no pull-up/down
++	fragment@95 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_1_22_pins: sx150x_1_22_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-1-22-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x23
++        // Configure as a input with no pull-up/down
++	fragment@96 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_0_23_pins: sx150x_0_23_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-0-23-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x23
++        // Configure as a input with no pull-up/down
++	fragment@97 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_1_23_pins: sx150x_1_23_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-1-23-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x3E
++        // Configure as a input with no pull-up/down
++	fragment@98 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_0_3E_pins: sx150x_0_3E_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-0-3E-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x3E
++        // Configure as a input with no pull-up/down
++	fragment@99 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_1_3E_pins: sx150x_1_3E_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-1-3E-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x3F
++        // Configure as a input with no pull-up/down
++	fragment@100 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_0_3F_pins: sx150x_0_3F_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-0-3F-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x3F
++        // Configure as a input with no pull-up/down
++	fragment@101 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_1_3F_pins: sx150x_1_3F_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-1-3F-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x70
++        // Configure as a input with no pull-up/down
++	fragment@102 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_0_70_pins: sx150x_0_70_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-0-70-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x70
++        // Configure as a input with no pull-up/down
++	fragment@103 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_1_70_pins: sx150x_1_70_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-1-70-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x71
++        // Configure as a input with no pull-up/down
++	fragment@104 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_0_71_pins: sx150x_0_71_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-0-71-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x71
++        // Configure as a input with no pull-up/down
++	fragment@105 {
++		target = <&gpio>;
++		__dormant__ {
++			sx150x_1_71_pins: sx150x_1_71_pins {
++				brcm,pins = <0>;  /* overwritten by sx150x-1-71-int-gpio parameter */
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		sx1501-0-20          = <0>,"+0+2";
++		sx1501-1-20          = <0>,"+1+3";
++		sx1501-0-21          = <0>,"+0+4";
++		sx1501-1-21          = <0>,"+1+5";
++		sx1502-0-20          = <0>,"+0+6";
++		sx1502-1-20          = <0>,"+1+7";
++		sx1502-0-21          = <0>,"+0+8";
++		sx1502-1-21          = <0>,"+1+9";
++		sx1503-0-20          = <0>,"+0+10";
++		sx1503-1-20          = <0>,"+1+11";
++		sx1504-0-20          = <0>,"+0+12";
++		sx1504-1-20          = <0>,"+1+13";
++		sx1504-0-21          = <0>,"+0+14";
++		sx1504-1-21          = <0>,"+1+15";
++		sx1505-0-20          = <0>,"+0+16";
++		sx1505-1-20          = <0>,"+1+17";
++		sx1505-0-21          = <0>,"+0+18";
++		sx1505-1-21          = <0>,"+1+19";
++		sx1506-0-20          = <0>,"+0+20";
++		sx1506-1-20          = <0>,"+1+21";
++		sx1507-0-3E          = <0>,"+0+22";
++		sx1507-1-3E          = <0>,"+1+23";
++		sx1507-0-3F          = <0>,"+0+24";
++		sx1507-1-3F          = <0>,"+1+25";
++		sx1507-0-70          = <0>,"+0+26";
++		sx1507-1-70          = <0>,"+1+27";
++		sx1507-0-71          = <0>,"+0+28";
++		sx1507-1-71          = <0>,"+1+29";
++		sx1508-0-20          = <0>,"+0+30";
++		sx1508-1-20          = <0>,"+1+31";
++		sx1508-0-21          = <0>,"+0+32";
++		sx1508-1-21          = <0>,"+1+33";
++		sx1508-0-22          = <0>,"+0+34";
++		sx1508-1-22          = <0>,"+1+35";
++		sx1508-0-23          = <0>,"+0+36";
++		sx1508-1-23          = <0>,"+1+37";
++		sx1509-0-3E          = <0>,"+0+38";
++		sx1509-1-3E          = <0>,"+1+39";
++		sx1509-0-3F          = <0>,"+0+40";
++		sx1509-1-3F          = <0>,"+1+41";
++		sx1509-0-70          = <0>,"+0+42";
++		sx1509-1-70          = <0>,"+1+43";
++		sx1509-0-71          = <0>,"+0+44";
++		sx1509-1-71          = <0>,"+1+45";
++		sx1501-0-20-int-gpio = <0>,"+46+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1501_0_20>,"interrupts:0";
++		sx1501-1-20-int-gpio = <0>,"+47+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1501_1_20>,"interrupts:0";
++		sx1501-0-21-int-gpio = <0>,"+48+92",  <&sx150x_0_21_pins>,"brcm,pins:0", <&sx1501_0_21>,"interrupts:0";
++		sx1501-1-21-int-gpio = <0>,"+49+93",  <&sx150x_1_21_pins>,"brcm,pins:0", <&sx1501_1_21>,"interrupts:0";
++		sx1502-0-20-int-gpio = <0>,"+50+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1502_0_20>,"interrupts:0";
++		sx1502-1-20-int-gpio = <0>,"+51+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1502_1_20>,"interrupts:0";
++		sx1502-0-21-int-gpio = <0>,"+52+92",  <&sx150x_0_21_pins>,"brcm,pins:0", <&sx1502_0_21>,"interrupts:0";
++		sx1502-1-21-int-gpio = <0>,"+53+93",  <&sx150x_1_21_pins>,"brcm,pins:0", <&sx1502_1_21>,"interrupts:0";
++		sx1503-0-20-int-gpio = <0>,"+54+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1503_0_20>,"interrupts:0";
++		sx1503-1-20-int-gpio = <0>,"+55+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1503_1_20>,"interrupts:0";
++		sx1504-0-20-int-gpio = <0>,"+56+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1504_0_20>,"interrupts:0";
++		sx1504-1-20-int-gpio = <0>,"+57+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1504_1_20>,"interrupts:0";
++		sx1504-0-21-int-gpio = <0>,"+58+92",  <&sx150x_0_21_pins>,"brcm,pins:0", <&sx1504_0_21>,"interrupts:0";
++		sx1504-1-21-int-gpio = <0>,"+59+93",  <&sx150x_1_21_pins>,"brcm,pins:0", <&sx1504_1_21>,"interrupts:0";
++		sx1505-0-20-int-gpio = <0>,"+60+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1505_0_20>,"interrupts:0";
++		sx1505-1-20-int-gpio = <0>,"+61+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1505_1_20>,"interrupts:0";
++		sx1505-0-21-int-gpio = <0>,"+62+92",  <&sx150x_0_21_pins>,"brcm,pins:0", <&sx1505_0_21>,"interrupts:0";
++		sx1505-1-21-int-gpio = <0>,"+63+93",  <&sx150x_1_21_pins>,"brcm,pins:0", <&sx1505_1_21>,"interrupts:0";
++		sx1506-0-20-int-gpio = <0>,"+64+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1506_0_20>,"interrupts:0";
++		sx1506-1-20-int-gpio = <0>,"+65+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1506_1_20>,"interrupts:0";
++		sx1507-0-3E-int-gpio = <0>,"+66+98",  <&sx150x_0_3E_pins>,"brcm,pins:0", <&sx1507_0_3E>,"interrupts:0";
++		sx1507-1-3E-int-gpio = <0>,"+67+99",  <&sx150x_1_3E_pins>,"brcm,pins:0", <&sx1507_1_3E>,"interrupts:0";
++		sx1507-0-3F-int-gpio = <0>,"+68+100", <&sx150x_0_3F_pins>,"brcm,pins:0", <&sx1507_0_3F>,"interrupts:0";
++		sx1507-1-3F-int-gpio = <0>,"+69+101", <&sx150x_1_3F_pins>,"brcm,pins:0", <&sx1507_1_3F>,"interrupts:0";
++		sx1507-0-70-int-gpio = <0>,"+60+102", <&sx150x_0_70_pins>,"brcm,pins:0", <&sx1507_0_70>,"interrupts:0";
++		sx1507-1-70-int-gpio = <0>,"+71+103", <&sx150x_1_70_pins>,"brcm,pins:0", <&sx1507_1_70>,"interrupts:0";
++		sx1507-0-71-int-gpio = <0>,"+72+104", <&sx150x_0_71_pins>,"brcm,pins:0", <&sx1507_0_71>,"interrupts:0";
++		sx1507-1-71-int-gpio = <0>,"+73+105", <&sx150x_1_71_pins>,"brcm,pins:0", <&sx1507_1_71>,"interrupts:0";
++		sx1508-0-20-int-gpio = <0>,"+74+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1508_0_20>,"interrupts:0";
++		sx1508-1-20-int-gpio = <0>,"+75+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1508_1_20>,"interrupts:0";
++		sx1508-0-21-int-gpio = <0>,"+76+92",  <&sx150x_0_21_pins>,"brcm,pins:0", <&sx1508_0_21>,"interrupts:0";
++		sx1508-1-21-int-gpio = <0>,"+77+93",  <&sx150x_1_21_pins>,"brcm,pins:0", <&sx1508_1_21>,"interrupts:0";
++		sx1508-0-22-int-gpio = <0>,"+78+94",  <&sx150x_0_22_pins>,"brcm,pins:0", <&sx1508_0_22>,"interrupts:0";
++		sx1508-1-22-int-gpio = <0>,"+79+95",  <&sx150x_1_22_pins>,"brcm,pins:0", <&sx1508_1_22>,"interrupts:0";
++		sx1508-0-23-int-gpio = <0>,"+80+96",  <&sx150x_0_23_pins>,"brcm,pins:0", <&sx1508_0_23>,"interrupts:0";
++		sx1508-1-23-int-gpio = <0>,"+81+97",  <&sx150x_1_23_pins>,"brcm,pins:0", <&sx1508_1_23>,"interrupts:0";
++		sx1509-0-3E-int-gpio = <0>,"+82+98",  <&sx150x_0_3E_pins>,"brcm,pins:0", <&sx1509_0_3E>,"interrupts:0";
++		sx1509-1-3E-int-gpio = <0>,"+83+99",  <&sx150x_1_3E_pins>,"brcm,pins:0", <&sx1509_1_3E>,"interrupts:0";
++		sx1509-0-3F-int-gpio = <0>,"+84+100", <&sx150x_0_3F_pins>,"brcm,pins:0", <&sx1509_0_3F>,"interrupts:0";
++		sx1509-1-3F-int-gpio = <0>,"+85+101", <&sx150x_1_3F_pins>,"brcm,pins:0", <&sx1509_1_3F>,"interrupts:0";
++		sx1509-0-70-int-gpio = <0>,"+86+102", <&sx150x_0_70_pins>,"brcm,pins:0", <&sx1509_0_70>,"interrupts:0";
++		sx1509-1-70-int-gpio = <0>,"+87+103", <&sx150x_1_70_pins>,"brcm,pins:0", <&sx1509_1_70>,"interrupts:0";
++		sx1509-0-71-int-gpio = <0>,"+88+104", <&sx150x_0_71_pins>,"brcm,pins:0", <&sx1509_0_71>,"interrupts:0";
++		sx1509-1-71-int-gpio = <0>,"+89+105", <&sx150x_1_71_pins>,"brcm,pins:0", <&sx1509_1_71>,"interrupts:0";
++	};
++};
++
+diff --git a/arch/arm/boot/dts/overlays/tc358743-audio-overlay.dts b/arch/arm/boot/dts/overlays/tc358743-audio-overlay.dts
+new file mode 100644
+index 000000000000..6bb3dceb0df3
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/tc358743-audio-overlay.dts
+@@ -0,0 +1,52 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions to add I2S audio from the Toshiba TC358743 HDMI to CSI2 bridge.
++// Requires tc358743 overlay to have been loaded to actually function.
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			tc358743_codec: tc358743-codec {
++				#sound-dai-cells = <0>;
++				compatible = "linux,spdif-dir";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		sound_overlay: __overlay__ {
++			compatible = "simple-audio-card";
++			simple-audio-card,format = "i2s";
++			simple-audio-card,name = "tc358743";
++			simple-audio-card,bitclock-master = <&dailink0_master>;
++			simple-audio-card,frame-master = <&dailink0_master>;
++			status = "okay";
++
++			simple-audio-card,cpu {
++				sound-dai = <&i2s_clk_consumer>;
++				dai-tdm-slot-num = <2>;
++				dai-tdm-slot-width = <32>;
++			};
++			dailink0_master: simple-audio-card,codec {
++				sound-dai = <&tc358743_codec>;
++			};
++		};
++	};
++
++	__overrides__ {
++		card-name = <&sound_overlay>,"simple-audio-card,name";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/tc358743-overlay.dts b/arch/arm/boot/dts/overlays/tc358743-overlay.dts
+new file mode 100644
+index 000000000000..44a28ca6eedf
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/tc358743-overlay.dts
+@@ -0,0 +1,116 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for Toshiba TC358743 HDMI to CSI2 bridge on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	i2c_frag: fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			tc358743: tc358743@f {
++				compatible = "toshiba,tc358743";
++				reg = <0x0f>;
++				status = "okay";
++
++				clocks = <&cam1_clk>;
++				clock-names = "refclk";
++
++				port {
++					tc358743_0: endpoint {
++						remote-endpoint = <&csi1_ep>;
++						clock-lanes = <0>;
++						clock-noncontinuous;
++						link-frequencies =
++							/bits/ 64 <486000000>;
++					};
++				};
++			};
++		};
++	};
++
++	csi_frag: fragment@1 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++
++			port {
++				csi1_ep: endpoint {
++					remote-endpoint = <&tc358743_0>;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&tc358743_0>;
++		__overlay__ {
++			data-lanes = <1 2>;
++		};
++	};
++
++	fragment@3 {
++		target = <&tc358743_0>;
++		__dormant__ {
++			data-lanes = <1 2 3 4>;
++		};
++	};
++
++	fragment@4 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@5 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@6 {
++		target = <&cam1_clk>;
++		__overlay__ {
++			status = "okay";
++			clock-frequency = <27000000>;
++		};
++	};
++
++	fragment@7 {
++		target = <&csi1_ep>;
++		__overlay__ {
++			data-lanes = <1 2>;
++		};
++	};
++
++	fragment@8 {
++		target = <&csi1_ep>;
++		__dormant__ {
++			data-lanes = <1 2 3 4>;
++		};
++	};
++
++	fragment@9 {
++		target = <&csi1>;
++		__overlay__ {
++			compatible = "brcm,bcm2835-unicam-legacy";
++		};
++	};
++
++	__overrides__ {
++		4lane = <0>, "-2+3-7+8";
++		link-frequency = <&tc358743_0>,"link-frequencies#0";
++		media-controller = <0>,"!9";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&tc358743>, "clocks:0=",<&cam0_clk>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/tinylcd35-overlay.dts b/arch/arm/boot/dts/overlays/tinylcd35-overlay.dts
+new file mode 100644
+index 000000000000..edc5889b6f5f
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/tinylcd35-overlay.dts
+@@ -0,0 +1,222 @@
++/*
++ * tinylcd35-overlay.dts
++ *
++ * -------------------------------------------------
++ * www.tinlylcd.com
++ * -------------------------------------------------
++ * Device---Driver-----BUS       GPIO's
++ * display  tinylcd35  spi0.0    25 24 18
++ * touch    ads7846    spi0.1    5
++ * rtc      ds1307     i2c1-0068
++ * rtc      pcf8563    i2c1-0051
++ * keypad   gpio-keys  --------- 17 22 27 23 28
++ *
++ *
++ * TinyLCD.com 3.5 inch TFT
++ *
++ *  Version 001
++ *  5/3/2015  -- Noralf Trønnes     Initial Device tree framework
++ *  10/3/2015 -- tinylcd@gmail.com  added ds1307 support.
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			tinylcd35_pins: tinylcd35_pins {
++				brcm,pins = <25 24 18>;
++				brcm,function = <1>; /* out */
++			};
++			tinylcd35_ts_pins: tinylcd35_ts_pins {
++				brcm,pins = <5>;
++				brcm,function = <0>; /* in */
++			};
++			keypad_pins: keypad_pins {
++				brcm,pins = <4 17 22 23 27>;
++				brcm,function = <0>; /* in */
++				brcm,pull = <1>; /* down */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			tinylcd35: tinylcd35@0{
++				compatible = "neosec,tinylcd";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&tinylcd35_pins>,
++					    <&tinylcd35_ts_pins>;
++
++				spi-max-frequency = <48000000>;
++				rotate = <270>;
++				fps = <20>;
++				bgr;
++				buswidth = <8>;
++				reset-gpios = <&gpio 25 1>;
++				dc-gpios = <&gpio 24 0>;
++				led-gpios = <&gpio 18 0>;
++				debug = <0>;
++
++				init = <0x10000B0 0x80
++					0x10000C0 0x0A 0x0A
++					0x10000C1 0x01 0x01
++					0x10000C2 0x33
++					0x10000C5 0x00 0x42 0x80
++					0x10000B1 0xD0 0x11
++					0x10000B4 0x02
++					0x10000B6 0x00 0x22 0x3B
++					0x10000B7 0x07
++					0x1000036 0x58
++					0x10000F0 0x36 0xA5 0xD3
++					0x10000E5 0x80
++					0x10000E5 0x01
++					0x10000B3 0x00
++					0x10000E5 0x00
++					0x10000F0 0x36 0xA5 0x53
++					0x10000E0 0x00 0x35 0x33 0x00 0x00 0x00 0x00 0x35 0x33 0x00 0x00 0x00
++					0x100003A 0x55
++					0x1000011
++					0x2000001
++					0x1000029>;
++			};
++
++			tinylcd35_ts: tinylcd35_ts@1 {
++				compatible = "ti,ads7846";
++				reg = <1>;
++				status = "disabled";
++
++				spi-max-frequency = <2000000>;
++				interrupts = <5 2>; /* high-to-low edge triggered */
++				interrupt-parent = <&gpio>;
++				pendown-gpio = <&gpio 5 1>;
++				ti,x-plate-ohms = /bits/ 16 <100>;
++				ti,pressure-max = /bits/ 16 <255>;
++			};
++		};
++	};
++
++	/*  RTC    */
++
++	fragment@5 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			pcf8563: pcf8563@51 {
++				compatible = "nxp,pcf8563";
++				reg = <0x51>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@6 {
++		target = <&i2c1>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			ds1307: ds1307@68 {
++				compatible = "dallas,ds1307";
++				reg = <0x68>;
++				status = "okay";
++			};
++		};
++	};
++
++	/*
++	 * Values for input event code is found under the
++	 * 'Keys and buttons' heading in include/uapi/linux/input.h
++	 */
++	fragment@7 {
++		target-path = "/soc";
++		__overlay__ {
++			keypad: keypad {
++				compatible = "gpio-keys";
++				pinctrl-names = "default";
++				pinctrl-0 = <&keypad_pins>;
++				status = "disabled";
++				autorepeat;
++
++				button@17 {
++					label = "GPIO KEY_UP";
++					linux,code = <103>;
++					gpios = <&gpio 17 0>;
++				};
++				button@22 {
++					label = "GPIO KEY_DOWN";
++					linux,code = <108>;
++					gpios = <&gpio 22 0>;
++				};
++				button@27 {
++					label = "GPIO KEY_LEFT";
++					linux,code = <105>;
++					gpios = <&gpio 27 0>;
++				};
++				button@23 {
++					label = "GPIO KEY_RIGHT";
++					linux,code = <106>;
++					gpios = <&gpio 23 0>;
++				};
++				button@4 {
++					label = "GPIO KEY_ENTER";
++					linux,code = <28>;
++					gpios = <&gpio 4 0>;
++				};
++			};
++		};
++	};
++
++	__overrides__ {
++		speed =      <&tinylcd35>,"spi-max-frequency:0";
++		rotate =     <&tinylcd35>,"rotate:0";
++		fps =        <&tinylcd35>,"fps:0";
++		debug =      <&tinylcd35>,"debug:0";
++		touch =      <&tinylcd35_ts>,"status";
++		touchgpio =  <&tinylcd35_ts_pins>,"brcm,pins:0",
++			     <&tinylcd35_ts>,"interrupts:0",
++			     <&tinylcd35_ts>,"pendown-gpio:4";
++		xohms =      <&tinylcd35_ts>,"ti,x-plate-ohms;0";
++		rtc-pcf =    <0>,"=5";
++		rtc-ds =     <0>,"=6";
++		keypad =     <&keypad>,"status";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/tpm-slb9670-overlay.dts b/arch/arm/boot/dts/overlays/tpm-slb9670-overlay.dts
+new file mode 100644
+index 000000000000..e69188503ca3
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/tpm-slb9670-overlay.dts
+@@ -0,0 +1,44 @@
++/*
++ * Device Tree overlay for the Infineon SLB9670 Trusted Platform Module add-on
++ * boards, which can be used as a secure key storage and hwrng.
++ * available as "Iridium SLB9670" by Infineon and "LetsTrust TPM" by pi3g.
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			slb9670: slb9670@1 {
++				compatible = "infineon,slb9670";
++				reg = <1>;	/* CE1 */
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <32000000>;
++				status = "okay";
++			};
++
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/tpm-slb9673-overlay.dts b/arch/arm/boot/dts/overlays/tpm-slb9673-overlay.dts
+new file mode 100644
+index 000000000000..cba8c25c30e5
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/tpm-slb9673-overlay.dts
+@@ -0,0 +1,50 @@
++/*
++ * Device Tree overlay for the Infineon SLB9673 Trusted Platform Module add-on
++ * boards, which can be used as a secure key storage and hwrng.
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	/* Due to issue https://github.com/raspberrypi/linux/issues/4884 the
++	   hardware I2C needs to be disabled and software I2C enabled */
++	fragment@0 {
++		target = <&i2c_arm>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			i2c1: i2c-gpio@1 {
++				#address-cells = <1>;
++				#size-cells = <0>;
++				compatible = "i2c-gpio";
++				gpios = <&gpio 2 6>, /* SDA GPIO_OPEN_DRAIN */
++				     	<&gpio 3 6>; /* CLK GPIO_OPEN_DRAIN */
++				clock-frequency = <400000>;
++				status = "okay";
++			};
++		};
++	};
++
++	/* Add the TPM */
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			slb9673: slb9673@2e {
++				compatible = "infineon,slb9673", "tcg,tpm-tis-i2c";
++				reg = <0x2e>;
++				status = "okay";
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/uart0-overlay.dts b/arch/arm/boot/dts/overlays/uart0-overlay.dts
+new file mode 100755
+index 000000000000..6bf2e0fd5c61
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/uart0-overlay.dts
+@@ -0,0 +1,32 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&uart0>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&uart0_pins>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			uart0_pins: uart0_ovl_pins {
++				brcm,pins = <14 15>;
++				brcm,function = <4>; /* alt0 */
++				brcm,pull = <0 2>;
++			};
++		};
++	};
++
++	__overrides__ {
++		txd0_pin = <&uart0_pins>,"brcm,pins:0";
++		rxd0_pin = <&uart0_pins>,"brcm,pins:4";
++		pin_func = <&uart0_pins>,"brcm,function:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/uart0-pi5-overlay.dts b/arch/arm/boot/dts/overlays/uart0-pi5-overlay.dts
+new file mode 100755
+index 000000000000..3cc9843b812d
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/uart0-pi5-overlay.dts
+@@ -0,0 +1,18 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&uart0>;
++		frag0: __overlay__ {
++			status = "okay";
++			pinctrl-0 = <&uart0_pins>;
++		};
++	};
++
++	__overrides__ {
++		ctsrts = <&frag0>,"pinctrl-0:4=",<&uart0_ctsrts_pins>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/uart1-overlay.dts b/arch/arm/boot/dts/overlays/uart1-overlay.dts
+new file mode 100644
+index 000000000000..64163bf932b7
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/uart1-overlay.dts
+@@ -0,0 +1,38 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&uart1>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&uart1_pins>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			uart1_pins: uart1_ovl_pins {
++				brcm,pins = <14 15>;
++				brcm,function = <2>; /* alt5 */
++				brcm,pull = <0 2>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target-path = "/chosen";
++		__overlay__ {
++			bootargs = "8250.nr_uarts=1";
++		};
++	};
++
++	__overrides__ {
++		txd1_pin = <&uart1_pins>,"brcm,pins:0";
++		rxd1_pin = <&uart1_pins>,"brcm,pins:4";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/uart1-pi5-overlay.dts b/arch/arm/boot/dts/overlays/uart1-pi5-overlay.dts
+new file mode 100755
+index 000000000000..739f5a941ffa
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/uart1-pi5-overlay.dts
+@@ -0,0 +1,18 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&uart1>;
++		frag0: __overlay__ {
++			status = "okay";
++			pinctrl-0 = <&uart1_pins>;
++		};
++	};
++
++	__overrides__ {
++		ctsrts = <&frag0>,"pinctrl-0:4=",<&uart1_ctsrts_pins>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/uart2-overlay.dts b/arch/arm/boot/dts/overlays/uart2-overlay.dts
+new file mode 100644
+index 000000000000..d98cb5795f6a
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/uart2-overlay.dts
+@@ -0,0 +1,25 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&uart2>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&uart2_pins>;
++		__dormant__ {
++			brcm,pins = <0 1 2 3>;
++			brcm,pull = <0 2 2 0>;
++		};
++	};
++
++	__overrides__ {
++		ctsrts = <0>,"=1";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/uart2-pi5-overlay.dts b/arch/arm/boot/dts/overlays/uart2-pi5-overlay.dts
+new file mode 100755
+index 000000000000..1df956425d3a
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/uart2-pi5-overlay.dts
+@@ -0,0 +1,18 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&uart2>;
++		frag0: __overlay__ {
++			status = "okay";
++			pinctrl-0 = <&uart2_pins>;
++		};
++	};
++
++	__overrides__ {
++		ctsrts = <&frag0>,"pinctrl-0:4=",<&uart2_ctsrts_pins>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/uart3-overlay.dts b/arch/arm/boot/dts/overlays/uart3-overlay.dts
+new file mode 100644
+index 000000000000..5751d5b1a29e
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/uart3-overlay.dts
+@@ -0,0 +1,25 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&uart3>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&uart3_pins>;
++		__dormant__ {
++			brcm,pins = <4 5 6 7>;
++			brcm,pull = <0 2 2 0>;
++		};
++	};
++
++	__overrides__ {
++		ctsrts = <0>,"=1";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/uart3-pi5-overlay.dts b/arch/arm/boot/dts/overlays/uart3-pi5-overlay.dts
+new file mode 100755
+index 000000000000..d8ef51b403dd
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/uart3-pi5-overlay.dts
+@@ -0,0 +1,18 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&uart3>;
++		frag0: __overlay__ {
++			status = "okay";
++			pinctrl-0 = <&uart3_pins>;
++		};
++	};
++
++	__overrides__ {
++		ctsrts = <&frag0>,"pinctrl-0:4=",<&uart3_ctsrts_pins>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/uart4-overlay.dts b/arch/arm/boot/dts/overlays/uart4-overlay.dts
+new file mode 100644
+index 000000000000..99def557b779
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/uart4-overlay.dts
+@@ -0,0 +1,25 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&uart4>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&uart4_pins>;
++		__dormant__ {
++			brcm,pins = <8 9 10 11>;
++			brcm,pull = <0 2 2 0>;
++		};
++	};
++
++	__overrides__ {
++		ctsrts = <0>,"=1";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/uart4-pi5-overlay.dts b/arch/arm/boot/dts/overlays/uart4-pi5-overlay.dts
+new file mode 100755
+index 000000000000..7ce5be8cc95c
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/uart4-pi5-overlay.dts
+@@ -0,0 +1,18 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&uart4>;
++		frag0: __overlay__ {
++			status = "okay";
++			pinctrl-0 = <&uart4_pins>;
++		};
++	};
++
++	__overrides__ {
++		ctsrts = <&frag0>,"pinctrl-0:4=",<&uart4_ctsrts_pins>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/uart5-overlay.dts b/arch/arm/boot/dts/overlays/uart5-overlay.dts
+new file mode 100644
+index 000000000000..649daea52e6b
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/uart5-overlay.dts
+@@ -0,0 +1,25 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target = <&uart5>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&uart5_pins>;
++		__dormant__ {
++			brcm,pins = <12 13 14 15>;
++			brcm,pull = <0 2 2 0>;
++		};
++	};
++
++	__overrides__ {
++		ctsrts = <0>,"=1";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/udrc-overlay.dts b/arch/arm/boot/dts/overlays/udrc-overlay.dts
+new file mode 100644
+index 000000000000..701f28e811bb
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/udrc-overlay.dts
+@@ -0,0 +1,128 @@
++#include <dt-bindings/clock/bcm2835.h>
++/*
++ * Device tree overlay for the Universal Digital Radio Controller
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++    compatible = "brcm,bcm2835";
++    fragment@0 {
++        target = <&i2s_clk_producer>;
++        __overlay__ {
++            clocks = <&clocks BCM2835_CLOCK_PCM>;
++            clock-names = "pcm";
++            status = "okay";
++        };
++    };
++
++    fragment@1 {
++        target-path = "/";
++        __overlay__ {
++            regulators {
++                compatible = "simple-bus";
++                #address-cells = <1>;
++                #size-cells = <0>;
++
++                udrc0_ldoin: udrc0_ldoin {
++                    compatible = "regulator-fixed";
++                    regulator-name = "ldoin";
++                    regulator-min-microvolt = <3300000>;
++                    regulator-max-microvolt = <3300000>;
++                    regulator-always-on;
++                };
++            };
++        };
++    };
++
++    fragment@2 {
++        target = <&i2c1>;
++        __overlay__ {
++            #address-cells = <1>;
++            #size-cells = <0>;
++            status = "okay";
++            clocks = <&clocks BCM2835_CLOCK_VPU>;
++            clock-frequency = <400000>;
++
++            tlv320aic32x4: tlv320aic32x4@18 {
++                compatible = "ti,tlv320aic32x4";
++                #sound-dai-cells = <0>;
++                reg = <0x18>;
++                status = "okay";
++
++                clocks = <&clocks BCM2835_CLOCK_GP0>;
++                clock-names = "mclk";
++                assigned-clocks = <&clocks BCM2835_CLOCK_GP0>;
++                assigned-clock-rates = <25000000>;
++
++                pinctrl-names = "default";
++                pinctrl-0 = <&gpclk0_pin &aic3204_reset>;
++
++                reset-gpios = <&gpio 13 0>;
++
++                iov-supply = <&udrc0_ldoin>;
++                ldoin-supply = <&udrc0_ldoin>;
++            };
++        };
++    };
++
++    fragment@3 {
++        target = <&sound>;
++        snd: __overlay__ {
++            compatible = "simple-audio-card";
++            i2s-controller = <&i2s_clk_producer>;
++            status = "okay";
++
++            simple-audio-card,name = "udrc";
++            simple-audio-card,format = "i2s";
++
++            simple-audio-card,bitclock-master = <&dailink0_master>;
++            simple-audio-card,frame-master = <&dailink0_master>;
++
++            simple-audio-card,widgets =
++                "Line", "Line In",
++                "Line", "Line Out";
++
++            simple-audio-card,routing =
++                "IN1_R", "Line In",
++                "IN1_L", "Line In",
++                "CM_L", "Line In",
++                "CM_R", "Line In",
++                "Line Out", "LOR",
++                "Line Out", "LOL";
++
++            dailink0_master: simple-audio-card,cpu {
++                sound-dai = <&i2s_clk_producer>;
++            };
++
++            simple-audio-card,codec {
++                sound-dai = <&tlv320aic32x4>;
++            };
++        };
++    };
++
++    fragment@4 {
++        target = <&gpio>;
++        __overlay__ {
++            gpclk0_pin: gpclk0_pin {
++                brcm,pins = <4>;
++                brcm,function = <4>;
++            };
++
++            aic3204_reset: aic3204_reset {
++                brcm,pins = <13>;
++                brcm,function = <1>;
++                brcm,pull = <1>;
++            };
++
++            aic3204_gpio: aic3204_gpio {
++                brcm,pins = <26>;
++            };
++        };
++    };
++
++    __overrides__ {
++        alsaname = <&snd>, "simple-audio-card,name";
++    };
++};
+diff --git a/arch/arm/boot/dts/overlays/ugreen-dabboard-overlay.dts b/arch/arm/boot/dts/overlays/ugreen-dabboard-overlay.dts
+new file mode 100644
+index 000000000000..234f1f38225b
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ugreen-dabboard-overlay.dts
+@@ -0,0 +1,49 @@
++// Definitions for the ugreen dabboard I2S
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_consumer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			dmic_codec: dmic-codec {
++				#sound-dai-cells = <0>;
++				compatible = "dmic-codec";
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&sound>;
++		sound_overlay: __overlay__ {
++			compatible = "simple-audio-card";
++			simple-audio-card,format = "i2s";
++			simple-audio-card,name = "dabboard";
++			simple-audio-card,bitclock-master = <&dailink0_master>;
++			simple-audio-card,frame-master = <&dailink0_master>;
++			simple-audio-card,widgets = "Microphone", "Microphone Jack";
++			status = "okay";
++			simple-audio-card,cpu {
++				sound-dai = <&i2s_clk_consumer>;
++			};
++			dailink0_master: simple-audio-card,codec {
++				#sound-dai-cells = <0>;
++				sound-dai = <&dmic_codec>;
++			};
++		};
++	};
++
++	__overrides__ {
++		card-name = <&sound_overlay>,"simple-audio-card,name";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/upstream-overlay.dts b/arch/arm/boot/dts/overlays/upstream-overlay.dts
+new file mode 100644
+index 000000000000..55a99736a33b
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/upstream-overlay.dts
+@@ -0,0 +1,101 @@
++// redo: ovmerge -c vc4-kms-v3d-overlay.dts,cma-default,composite dwc2-overlay.dts,dr_mode=otg
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/clock/bcm2835.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++	fragment@0 {
++		target = <&i2c2>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@1 {
++		target = <&fb>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++	fragment@2 {
++		target = <&pixelvalve0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@3 {
++		target = <&pixelvalve1>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@4 {
++		target = <&pixelvalve2>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@5 {
++		target = <&hvs>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@6 {
++		target = <&hdmi>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@7 {
++		target = <&v3d>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@8 {
++		target = <&vc4>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@9 {
++		target = <&clocks>;
++		__overlay__ {
++			claim-clocks = <BCM2835_PLLD_DSI0 BCM2835_PLLD_DSI1 BCM2835_PLLH_AUX BCM2835_PLLH_PIX>;
++		};
++	};
++	fragment@10 {
++		target = <&vec>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@11 {
++		target = <&txp>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@12 {
++		target = <&chosen>;
++		__overlay__ {
++			bootargs = "snd_bcm2835.enable_hdmi=0";
++		};
++	};
++	fragment@13 {
++		target = <&usb>;
++		#address-cells = <1>;
++		#size-cells = <1>;
++		__overlay__ {
++			compatible = "brcm,bcm2835-usb";
++			dr_mode = "otg";
++			g-np-tx-fifo-size = <32>;
++			g-rx-fifo-size = <558>;
++			g-tx-fifo-size = <512 512 512 512 512 256 256>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/upstream-pi4-overlay.dts b/arch/arm/boot/dts/overlays/upstream-pi4-overlay.dts
+new file mode 100644
+index 000000000000..1dc60ae6d967
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/upstream-pi4-overlay.dts
+@@ -0,0 +1,137 @@
++// redo: ovmerge -c vc4-kms-v3d-pi4-overlay.dts,cma-default dwc2-overlay.dts,dr_mode=otg
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/clock/bcm2835.h>
++
++/ {
++	compatible = "brcm,bcm2711";
++	fragment@0 {
++		target = <&ddc0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@1 {
++		target = <&ddc1>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@2 {
++		target = <&hdmi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@3 {
++		target = <&hdmi1>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@4 {
++		target = <&hvs>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@5 {
++		target = <&pixelvalve0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@6 {
++		target = <&pixelvalve1>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@7 {
++		target = <&pixelvalve2>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@8 {
++		target = <&pixelvalve3>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@9 {
++		target = <&pixelvalve4>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@10 {
++		target = <&v3d>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@11 {
++		target = <&vc4>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@12 {
++		target = <&txp>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@13 {
++		target = <&fb>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++	fragment@14 {
++		target = <&firmwarekms>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++	fragment@15 {
++		target = <&vec>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++	fragment@16 {
++		target-path = "/chosen";
++		__overlay__ {
++			bootargs = "snd_bcm2835.enable_hdmi=0";
++		};
++	};
++	fragment@17 {
++		target = <&dvp>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@18 {
++		target = <&aon_intr>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@19 {
++		target = <&usb>;
++		#address-cells = <1>;
++		#size-cells = <1>;
++		__overlay__ {
++			compatible = "brcm,bcm2835-usb";
++			dr_mode = "otg";
++			g-np-tx-fifo-size = <32>;
++			g-rx-fifo-size = <558>;
++			g-tx-fifo-size = <512 512 512 512 512 256 256>;
++			status = "okay";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts b/arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts
+new file mode 100644
+index 000000000000..d201edbe7003
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts
+@@ -0,0 +1,46 @@
++/*
++ * vc4-fkms-v3d-overlay.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include "cma-overlay.dts"
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@1 {
++		target = <&fb>;
++		__overlay__  {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&firmwarekms>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target = <&v3d>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&vc4>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++	fragment@5 {
++		target-path = "/chosen";
++		__overlay__  {
++			bootargs = "clk_ignore_unused";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-fkms-v3d-pi4-overlay.dts b/arch/arm/boot/dts/overlays/vc4-fkms-v3d-pi4-overlay.dts
+new file mode 100644
+index 000000000000..1e10203dfd86
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-fkms-v3d-pi4-overlay.dts
+@@ -0,0 +1,50 @@
++/*
++ * vc4-fkms-v3d-overlay.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include "cma-overlay.dts"
++
++&frag0 {
++	size = <((512-4)*1024*1024)>;
++};
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@1 {
++		target = <&fb>;
++		__overlay__  {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&firmwarekms>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target = <&v3d>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&vc4>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++	fragment@5 {
++		target-path = "/chosen";
++		__overlay__  {
++			bootargs = "clk_ignore_unused";
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-dpi-generic-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-dpi-generic-overlay.dts
+new file mode 100644
+index 000000000000..73c339ada161
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dpi-generic-overlay.dts
+@@ -0,0 +1,82 @@
++/*
++ * vc4-kms-dpi-generic-overlay.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include "vc4-kms-dpi.dtsi"
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&panel>;
++		panel_generic: __overlay__  {
++			compatible = "panel-dpi";
++
++			width-mm = <154>;
++			height-mm = <83>;
++			bus-format = <0x1009>;
++
++			timing: panel-timing {
++				clock-frequency = <29500000>;
++				hactive = <800>;
++				hfront-porch = <24>;
++				hsync-len = <72>;
++				hback-porch = <96>;
++				hsync-active = <1>;
++				vactive = <480>;
++				vfront-porch = <3>;
++				vsync-len = <10>;
++				vback-porch = <7>;
++				vsync-active = <1>;
++
++				de-active = <1>;
++				pixelclk-active = <1>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&dpi>;
++		dpi_node_generic: __overlay__  {
++			pinctrl-0 = <&dpi_18bit_gpio0>;
++		};
++	};
++
++	__overrides__ {
++		clock-frequency = <&timing>, "clock-frequency:0";
++		hactive = <&timing>, "hactive:0";
++		hfp = <&timing>, "hfront-porch:0";
++		hsync = <&timing>, "hsync-len:0";
++		hbp = <&timing>, "hback-porch:0";
++		vactive = <&timing>, "vactive:0";
++		vfp = <&timing>, "vfront-porch:0";
++		vsync = <&timing>, "vsync-len:0";
++		vbp = <&timing>, "vback-porch:0";
++		hsync-invert = <&timing>, "hsync-active:0=0";
++		vsync-invert = <&timing>, "vsync-active:0=0";
++		de-invert = <&timing>, "de-active:0=0";
++		pixclk-invert = <&timing>, "pixelclk-active:0=0";
++
++		width-mm = <&panel_generic>, "width-mm:0";
++		height-mm = <&panel_generic>, "height-mm:0";
++
++		rgb565 = <&panel_generic>, "bus-format:0=0x1017",
++			<&dpi_node_generic>, "pinctrl-0:0=",<&dpi_16bit_gpio0>;
++		rgb565-padhi = <&panel_generic>, "bus-format:0=0x1022",
++			<&dpi_node_generic>, "pinctrl-0:0=",<&dpi_16bit_cpadhi_gpio0>;
++		bgr666 = <&panel_generic>, "bus-format:0=0x1023";
++		bgr666-padhi = <&panel_generic>, "bus-format:0=0x1024",
++			<&dpi_node_generic>, "pinctrl-0:0=",<&dpi_18bit_cpadhi_gpio0>;
++		rgb666-padhi = <&panel_generic>, "bus-format:0=0x1015",
++			<&dpi_node_generic>, "pinctrl-0:0=",<&dpi_18bit_cpadhi_gpio0>;
++		bgr888 = <&panel_generic>, "bus-format:0=0x1013",
++			<&dpi_node_generic>, "pinctrl-0:0=",<&dpi_gpio0>;
++		rgb888 = <&panel_generic>, "bus-format:0=0x100a",
++			<&dpi_node_generic>, "pinctrl-0:0=",<&dpi_gpio0>;
++		bus-format = <&panel_generic>, "bus-format:0";
++		rgb-order = <&dpi_node_generic>, "rgb_order";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel.dtsi b/arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel.dtsi
+new file mode 100644
+index 000000000000..585402a3b9b4
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel.dtsi
+@@ -0,0 +1,94 @@
++/*
++ * vc4-kms-dpi-hyperpixel4.dtsi
++ * Commmon initialisation for HyperPixel DPI displays
++ */
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/pinctrl/bcm2835.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			spi {
++				compatible = "spi-gpio";
++				#address-cells = <1>;
++				#size-cells = <0>;
++				pinctrl-0 = <&spi_pins>;
++				pinctrl-names = "default";
++
++				sck-gpios = <&gpio 27 GPIO_ACTIVE_HIGH>;
++				mosi-gpios = <&gpio 26 GPIO_ACTIVE_HIGH>;
++				cs-gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
++				num-chipselects = <1>;
++				sck-idle-input;
++
++				panel: display@0 {
++					reg = <0>;
++					/* 100 kHz */
++					spi-max-frequency = <100000>;
++					backlight = <&backlight>;
++					rotation = <0>;
++
++					port {
++						panel_in: endpoint {
++							remote-endpoint = <&dpi_out>;
++						};
++					};
++				};
++			};
++
++			backlight: backlight {
++				compatible = "gpio-backlight";
++				gpios = <&gpio 19 0>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&dpi>;
++		__overlay__  {
++			status = "okay";
++
++			pinctrl-names = "default";
++			pinctrl-0 = <&dpi_18bit_cpadhi_gpio0>;
++
++			port {
++				dpi_out: endpoint {
++					remote-endpoint = <&panel_in>;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			spi_pins: hyperpixel4_spi_pins {
++				brcm,pins = <27 18 26>;
++				brcm,pull = <BCM2835_PUD_UP BCM2835_PUD_UP BCM2835_PUD_OFF>;
++				brcm,function = <0>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target-path = "/";
++		__overlay__ {
++			i2c_gpio: i2c@0 {
++				compatible = "i2c-gpio";
++				gpios = <&gpio 10 0 /* sda */
++					 &gpio 11 0>; /* scl */
++				i2c-gpio,delay-us = <4>;        /* ~100 kHz */
++				#address-cells = <1>;
++				#size-cells = <0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		rotate = <&panel>, "rotation:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel2r-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel2r-overlay.dts
+new file mode 100644
+index 000000000000..4cd9d6a55c48
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel2r-overlay.dts
+@@ -0,0 +1,114 @@
++/*
++ * vc4-kms-dpi-hyperpixel2r-overlay.dts
++ */
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/pinctrl/bcm2835.h>
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			spi {
++				compatible = "spi-gpio";
++				#address-cells = <1>;
++				#size-cells = <0>;
++				pinctrl-0 = <&spi_pins>;
++				pinctrl-names = "default";
++
++				sck-gpios = <&gpio 11 GPIO_ACTIVE_HIGH>;
++				mosi-gpios = <&gpio 10 GPIO_ACTIVE_HIGH>;
++				cs-gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
++				num-chipselects = <1>;
++
++				panel: display@0 {
++					compatible = "pimoroni,hyperpixel2round";
++					reg = <0>;
++					/* 100 kHz */
++					spi-max-frequency = <100000>;
++					backlight = <&backlight>;
++					rotation = <0>;
++
++					port {
++						panel_in: endpoint {
++							remote-endpoint = <&dpi_out>;
++						};
++					};
++				};
++			};
++
++			backlight: backlight {
++				compatible = "gpio-backlight";
++				gpios = <&gpio 19 0>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&dpi>;
++		__overlay__  {
++			status = "okay";
++
++			pinctrl-names = "default";
++			pinctrl-0 = <&dpi_18bit_cpadhi_gpio0>;
++
++			port {
++				dpi_out: endpoint {
++					remote-endpoint = <&panel_in>;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			spi_pins: hyperpixel4_spi_pins {
++				brcm,pins = <27 18 26>;
++				brcm,pull = <BCM2835_PUD_UP BCM2835_PUD_UP BCM2835_PUD_OFF>;
++				brcm,function = <0>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target-path = "/";
++		__overlay__ {
++			i2c_gpio: i2c@0 {
++				compatible = "i2c-gpio";
++				status = "disabled";
++
++				gpios = <&gpio 10 GPIO_ACTIVE_HIGH /* sda */
++					 &gpio 11 GPIO_ACTIVE_HIGH>; /* scl */
++				i2c-gpio,delay-us = <4>;        /* ~100 kHz */
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				polytouch: edt-ft5x06@15 {
++					#address-cells = <1>;
++					#size-cells = <0>;
++					compatible = "edt,edt-ft5406";
++					reg = <0x15>;
++					interrupt-parent = <&gpio>;
++					interrupts = <27 0x02>;
++					touchscreen-size-x = <240>;
++					touchscreen-size-y = <240>;
++				};
++			};
++		};
++	};
++
++	__overrides__ {
++		disable-touch = <0>,"-3";
++		touchscreen-inverted-x = <&polytouch>,"touchscreen-inverted-x?";
++		touchscreen-inverted-y = <&polytouch>,"touchscreen-inverted-y!";
++		touchscreen-swapped-x-y = <&polytouch>,"touchscreen-swapped-x-y!";
++		rotate = <&panel>, "rotation:0";
++	};
++
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel4-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel4-overlay.dts
+new file mode 100644
+index 000000000000..eafc25ad79ff
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel4-overlay.dts
+@@ -0,0 +1,57 @@
++/*
++ * vc4-kms-dpi-hyperpixel4sq-overlay.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include "vc4-kms-dpi-hyperpixel.dtsi"
++
++&panel {
++	compatible = "pimoroni,hyperpixel4";
++};
++
++/ {
++	fragment@11 {
++		target = <&i2c_gpio>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++			ft6236_14: ft6236@14 {
++				compatible = "goodix,gt911";
++				reg = <0x14>;
++				interrupt-parent = <&gpio>;
++				interrupts = <27 2>;
++				touchscreen-size-x = <480>;
++				touchscreen-size-y = <800>;
++				touchscreen-x-mm = <51>;
++				touchscreen-y-mm = <85>;
++				touchscreen-inverted-y;
++				touchscreen-swapped-x-y;
++			};
++			ft6236_5d: ft6236@5d {
++				compatible = "goodix,gt911";
++				reg = <0x5d>;
++				interrupt-parent = <&gpio>;
++				interrupts = <27 2>;
++				touchscreen-size-x = <480>;
++				touchscreen-size-y = <800>;
++				touchscreen-x-mm = <51>;
++				touchscreen-y-mm = <85>;
++				touchscreen-inverted-y;
++				touchscreen-swapped-x-y;
++			};
++		};
++	};
++
++	__overrides__ {
++		disable-touch = <0>,"-3-11";
++		touchscreen-inverted-x = <&ft6236_14>,"touchscreen-inverted-x?",
++					 <&ft6236_5d>,"touchscreen-inverted-x?";
++		touchscreen-inverted-y = <&ft6236_14>,"touchscreen-inverted-y!",
++					 <&ft6236_5d>,"touchscreen-inverted-y!";
++		touchscreen-swapped-x-y = <&ft6236_14>,"touchscreen-swapped-x-y!",
++					  <&ft6236_5d>,"touchscreen-swapped-x-y!";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel4sq-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel4sq-overlay.dts
+new file mode 100644
+index 000000000000..700046348ecf
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dpi-hyperpixel4sq-overlay.dts
+@@ -0,0 +1,36 @@
++/*
++ * vc4-kms-dpi-hyperpixel4-overlay.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include "vc4-kms-dpi-hyperpixel.dtsi"
++
++&panel {
++	compatible = "pimoroni,hyperpixel4square";
++};
++
++/ {
++	fragment@11 {
++		target = <&i2c_gpio>;
++		__overlay__ {
++			polytouch: edt-ft5x06@48 {
++				#address-cells = <1>;
++				#size-cells = <0>;
++				compatible = "edt,edt-ft5406";
++				reg = <0x48>;
++				interrupt-parent = <&gpio>;
++				interrupts = <27 0x02>;
++				touchscreen-size-x = <720>;
++				touchscreen-size-y = <720>;
++			};
++		};
++	};
++	__overrides__ {
++		disable-touch = <0>,"-3-11";
++		touchscreen-inverted-x = <&polytouch>,"touchscreen-inverted-x?";
++		touchscreen-inverted-y = <&polytouch>,"touchscreen-inverted-y!";
++		touchscreen-swapped-x-y = <&polytouch>,"touchscreen-swapped-x-y!";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-dpi-panel-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-dpi-panel-overlay.dts
+new file mode 100644
+index 000000000000..ee9e2e8fd246
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dpi-panel-overlay.dts
+@@ -0,0 +1,69 @@
++/*
++ * vc4-kms-dpi-panel-overlay.dts
++ * Support for any predefined DPI panel.
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include "vc4-kms-dpi.dtsi"
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&panel>;
++		__dormant__  {
++			compatible = "innolux,at056tn53v1", "simple-panel";
++		};
++	};
++	fragment@1 {
++		target = <&panel>;
++		__dormant__  {
++			compatible = "ontat,yx700wv03", "simple-panel";
++		};
++	};
++	fragment@2 {
++		target = <&panel>;
++		__dormant__  {
++			compatible = "geekworm,mzp280", "simple-panel";
++		};
++	};
++
++	fragment@90 {
++		target = <&dpi>;
++		__dormant__  {
++			pinctrl-0 = <&dpi_18bit_cpadhi_gpio0>;
++		};
++	};
++	fragment@91 {
++		target = <&dpi>;
++		__dormant__  {
++			pinctrl-0 = <&dpi_18bit_gpio0>;
++		};
++	};
++	fragment@92 {
++		target = <&dpi>;
++		__dormant__  {
++			pinctrl-0 = <&dpi_gpio0>;
++		};
++	};
++	fragment@93 {
++		target = <&dpi>;
++		__dormant__  {
++			pinctrl-0 = <&dpi_16bit_cpadhi_gpio0>;
++		};
++	};
++	fragment@94 {
++		target = <&dpi>;
++		__dormant__  {
++			pinctrl-0 = <&dpi_16bit_gpio0>;
++		};
++	};
++
++	__overrides__ {
++		at056tn53v1 = <0>, "+0+90";
++		kippah-7inch = <0>, "+1+91";
++		mzp280 = <0>, "+2+93";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-dpi.dtsi b/arch/arm/boot/dts/overlays/vc4-kms-dpi.dtsi
+new file mode 100644
+index 000000000000..67c884de2a8d
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dpi.dtsi
+@@ -0,0 +1,111 @@
++/*
++ * vc4-kms-dpi.dtsi
++ */
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/pinctrl/bcm2835.h>
++
++/ {
++	fragment@100 {
++		target-path = "/";
++		__overlay__ {
++			panel: panel {
++				rotation = <0>;
++				port {
++					panel_in: endpoint {
++						remote-endpoint = <&dpi_out>;
++					};
++				};
++			};
++		};
++	};
++
++	fragment@101 {
++		target = <&dpi>;
++		dpi_node: __overlay__  {
++			status = "okay";
++
++			pinctrl-names = "default";
++
++			port {
++				dpi_out: endpoint {
++					remote-endpoint = <&panel_in>;
++				};
++			};
++		};
++	};
++
++	fragment@102 {
++		target = <&panel>;
++		__dormant__  {
++			backlight = <&backlight>;
++		};
++	};
++
++	fragment@103 {
++		target-path = "/";
++		__dormant__  {
++			backlight: backlight {
++				compatible = "gpio-backlight";
++				gpios = <&gpio 255 GPIO_ACTIVE_HIGH>;
++			};
++		};
++	};
++
++	fragment@104 {
++		target = <&panel>;
++		__dormant__  {
++			backlight = <&backlight_pwm>;
++		};
++	};
++
++	fragment@105 {
++		target-path = "/";
++		__dormant__  {
++			backlight_pwm: backlight_pwm {
++				compatible = "pwm-backlight";
++				brightness-levels = <0 6 8 12 16 24 32 40 48 64 96 128 160 192 224 255>;
++				default-brightness-level = <16>;
++				pwms = <&pwm 0 200000 0>;
++			};
++		};
++	};
++
++	fragment@106 {
++		target = <&pwm>;
++		__dormant__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&pwm_pins>;
++			assigned-clock-rates = <1000000>;
++			status = "okay";
++		};
++	};
++
++	fragment@107 {
++		target = <&gpio>;
++		__dormant__ {
++			pwm_pins: pwm_pins {
++				brcm,pins = <18>;
++				brcm,function = <2>; /* Alt5 */
++			};
++		};
++	};
++
++	fragment@108 {
++		target = <&chosen>;
++		__dormant__  {
++			bootargs = "snd_bcm2835.enable_headphones=0";
++		};
++	};
++
++	__overrides__ {
++		backlight-gpio = <0>, "+102+103",
++			<&backlight>, "gpios:4";
++		backlight-pwm = <0>, "+104+105+106+107+108";
++		backlight-pwm-chan = <&backlight_pwm>, "pwms:4";
++		backlight-pwm-gpio = <&pwm_pins>, "brcm,pins:0";
++		backlight-pwm-func = <&pwm_pins>, "brcm,function:0";
++		backlight-def-brightness = <&backlight_pwm>, "default-brightness-level:0";
++		rotate = <&panel>, "rotation:0";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-dsi-7inch-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-dsi-7inch-overlay.dts
+new file mode 100644
+index 000000000000..302fa807d31d
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dsi-7inch-overlay.dts
+@@ -0,0 +1,124 @@
++/*
++ * Device Tree overlay for RaspberryPi 7" Touchscreen panel
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include "edt-ft5406.dtsi"
++
++/ {
++	/* No compatible as it will have come from edt-ft5406.dtsi */
++
++	dsi_frag: fragment@0 {
++		target = <&dsi1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			port {
++				dsi_out: endpoint {
++					remote-endpoint = <&bridge_in>;
++				};
++			};
++			bridge@0 {
++				reg = <0>;
++				compatible = "toshiba,tc358762";
++				vddc-supply = <&reg_bridge>;
++				ports {
++					#address-cells = <1>;
++					#size-cells = <0>;
++
++					port@0 {
++						reg = <0>;
++						bridge_in: endpoint {
++							remote-endpoint = <&dsi_out>;
++						};
++					};
++
++					port@1 {
++						reg = <1>;
++						bridge_out: endpoint {
++							remote-endpoint = <&panel_in>;
++						};
++					};
++				};
++			};
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			panel_disp: panel_disp@1 {
++				reg = <1>;
++				compatible = "raspberrypi,7inch-dsi", "simple-panel";
++				backlight = <&reg_display>;
++				power-supply = <&reg_display>;
++
++				port {
++					panel_in: endpoint {
++						remote-endpoint = <&bridge_out>;
++					};
++				};
++			};
++
++			reg_bridge: reg_bridge@1 {
++				reg = <1>;
++				compatible = "regulator-fixed";
++				regulator-name = "bridge_reg";
++				gpio = <&reg_display 0 0>;
++				vin-supply = <&reg_display>;
++				enable-active-high;
++			};
++		};
++	};
++
++	i2c_frag: fragment@2 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			reg_display: reg_display@45 {
++				compatible = "raspberrypi,7inch-touchscreen-panel-regulator";
++				reg = <0x45>;
++				gpio-controller;
++				#gpio-cells = <2>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@5 {
++		target = <&ft5406>;
++		__overlay__ {
++			vcc-supply = <&reg_display>;
++			reset-gpio = <&reg_display 1 1>;
++		};
++	};
++
++	__overrides__ {
++		dsi0 = <&dsi_frag>, "target:0=",<&dsi0>,
++		       <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&ts_i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&panel_disp>, "reg:0=0",
++		       <&reg_bridge>, "reg:0=0",
++		       <&reg_bridge>, "regulator-name=bridge_reg_0";
++		disable_touch = <&ft5406>, "status=disabled";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-dsi-generic-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-dsi-generic-overlay.dts
+new file mode 100644
+index 000000000000..cf4ca5b6c75f
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dsi-generic-overlay.dts
+@@ -0,0 +1,106 @@
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	dsi_frag: fragment@0 {
++		target = <&dsi1>;
++		__overlay__{
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			port {
++				dsi_out:endpoint {
++					remote-endpoint = <&panel_dsi_port>;
++				};
++			};
++			panel: panel-dsi-generic@0 {
++				// See panel-dsi.yaml binding
++				// Using dummy name for panel model
++				compatible = "Generic,panel-dsi","panel-dsi";
++				reg = <0>;
++				power-supply = <0>;
++				backlight = <0>;
++				dsi-color-format = "RGB888";
++				mode = "MODE_VIDEO";
++				width-mm = <0>;
++				height-mm = <0>;
++
++				port {
++					panel_dsi_port: endpoint {
++						data-lanes = <1>;
++						remote-endpoint = <&dsi_out>;
++					};
++				};
++
++				timing: panel-timing {
++					clock-frequency = <30000000>;
++					hactive = <840>;
++					vactive = <480>;
++					hback-porch = <44>;
++					hfront-porch = <46>;
++					hsync-len = <2>;
++					vback-porch = <18>;
++					vfront-porch = <16>;
++					vsync-len = <2>;
++				};
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&panel_dsi_port>;
++		__dormant__ {
++			data-lanes = <1>;
++		};
++	};
++
++	fragment@2 {
++		target = <&panel_dsi_port>;
++		__dormant__ {
++			data-lanes = <1 2>;
++		};
++	};
++
++	fragment@3 {
++		target = <&panel_dsi_port>;
++		__dormant__ {
++			data-lanes = <1 2 3>;
++		};
++	};
++
++	fragment@4 {
++		target = <&panel_dsi_port>;
++		__dormant__ {
++			data-lanes = <1 2 3 4>;
++		};
++	};
++
++	__overrides__ {
++		dsi0 = <&dsi_frag>, "target:0=",<&dsi0>;
++
++		clock-frequency = <&timing>, "clock-frequency:0";
++		hactive = <&timing>, "hactive:0";
++		hfp = <&timing>, "hfront-porch:0";
++		hsync = <&timing>, "hsync-len:0";
++		hbp = <&timing>, "hback-porch:0";
++		vactive = <&timing>, "vactive:0";
++		vfp = <&timing>, "vfront-porch:0";
++		vsync = <&timing>, "vsync-len:0";
++		vbp = <&timing>, "vback-porch:0";
++
++		width-mm = <&panel>, "width-mm:0";
++		height-mm = <&panel>, "height-mm:0";
++
++		rgb565 = <&panel>, "dsi-color-format=RGB565";
++		rgb666p = <&panel>, "dsi-color-format=RGB666_PACKED";
++		rgb666 = <&panel>, "dsi-color-format=RGB666";
++		rgb888 = <&panel>, "dsi-color-format=RGB888";
++		one-lane = <0>,"+1";
++		two-lane = <0>,"+2";
++		three-lane = <0>,"+3";
++		four-lane = <0>,"+4";
++	};
++
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-dsi-ili9881-5inch-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-dsi-ili9881-5inch-overlay.dts
+new file mode 100644
+index 000000000000..1985766c0e67
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dsi-ili9881-5inch-overlay.dts
+@@ -0,0 +1,122 @@
++/*
++ * vc4-kms-dsi-ili9881-5inch-overlay.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	i2c_frag: fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			display_mcu: display_mcu@45
++			{
++				compatible = "raspberrypi,v2-touchscreen-panel-regulator";
++				reg = <0x45>;
++				gpio-controller;
++				#gpio-cells = <2>;
++			};
++
++			gt911: gt911@5d {
++				compatible = "goodix,gt911";
++				reg = <0x5d>;
++				AVDD28-supply = <&touch_reg>;
++				touchscreen-size-x = <720>;
++				touchscreen-size-y = <1280>;
++				touchscreen-x-mm = <62>;
++				touchscreen-y-mm = <110>;
++			};
++		};
++	};
++
++	dsi_frag: fragment@1 {
++		target = <&dsi1>;
++		__overlay__  {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			port {
++				dsi_out: endpoint {
++					remote-endpoint = <&panel_in>;
++				};
++			};
++
++			dsi_panel: dsi_panel@0 {
++				reg = <0>;
++				compatible = "raspberrypi,dsi-5inch";
++				reset-gpio = <&display_mcu 0 GPIO_ACTIVE_LOW>;
++				backlight = <&display_mcu>;
++
++				port {
++					panel_in: endpoint {
++						remote-endpoint = <&dsi_out>;
++					};
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target-path = "/";
++		__overlay__ {
++			touch_reg: touch_reg@1 {
++				reg = <1>;
++				compatible = "regulator-fixed";
++				regulator-name = "touch_reg_1";
++				gpio = <&display_mcu 1 GPIO_ACTIVE_HIGH>;
++				startup-delay-us = <50000>;
++				enable-active-high;
++			};
++		};
++	};
++
++	fragment@10 {
++		target = <&gt911>;
++		__dormant__ {
++			touchscreen-inverted-x;
++		};
++	};
++
++	fragment@11 {
++		target = <&gt911>;
++		__dormant__ {
++			touchscreen-inverted-y;
++		};
++	};
++
++	__overrides__ {
++		dsi0 = <&dsi_frag>, "target:0=",<&dsi0>,
++		       <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&touch_reg>, "reg:0=0",
++		       <&touch_reg>, "regulator-name=touch_reg_0";
++		sizex = <&gt911>,"touchscreen-size-x:0";
++		sizey = <&gt911>,"touchscreen-size-y:0";
++		invx = <0>, "+10";
++		invy = <0>, "+11";
++		swapxy = <&gt911>,"touchscreen-swapped-x-y?";
++		disable_touch = <&gt911>, "status=disabled";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-dsi-ili9881-7inch-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-dsi-ili9881-7inch-overlay.dts
+new file mode 100644
+index 000000000000..d1eb31df1d69
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dsi-ili9881-7inch-overlay.dts
+@@ -0,0 +1,122 @@
++/*
++ * vc4-kms-dsi-ili9881-5inch-overlay.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	i2c_frag: fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			display_mcu: display_mcu@45
++			{
++				compatible = "raspberrypi,v2-touchscreen-panel-regulator";
++				reg = <0x45>;
++				gpio-controller;
++				#gpio-cells = <2>;
++			};
++
++			gt911: gt911@5d {
++				compatible = "goodix,gt911";
++				reg = <0x5d>;
++				AVDD28-supply = <&touch_reg>;
++				touchscreen-size-x = <720>;
++				touchscreen-size-y = <1280>;
++				touchscreen-x-mm = <90>;
++				touchscreen-y-mm = <151>;
++			};
++		};
++	};
++
++	dsi_frag: fragment@1 {
++		target = <&dsi1>;
++		__overlay__  {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			port {
++				dsi_out: endpoint {
++					remote-endpoint = <&panel_in>;
++				};
++			};
++
++			dsi_panel: dsi_panel@0 {
++				reg = <0>;
++				compatible = "raspberrypi,dsi-7inch";
++				reset-gpio = <&display_mcu 0 GPIO_ACTIVE_LOW>;
++				backlight = <&display_mcu>;
++
++				port {
++					panel_in: endpoint {
++						remote-endpoint = <&dsi_out>;
++					};
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target-path = "/";
++		__overlay__ {
++			touch_reg: touch_reg@1 {
++				reg = <1>;
++				compatible = "regulator-fixed";
++				regulator-name = "touch_reg_1";
++				gpio = <&display_mcu 1 GPIO_ACTIVE_HIGH>;
++				startup-delay-us = <50000>;
++				enable-active-high;
++			};
++		};
++	};
++
++	fragment@10 {
++		target = <&gt911>;
++		__dormant__ {
++			touchscreen-inverted-x;
++		};
++	};
++
++	fragment@11 {
++		target = <&gt911>;
++		__dormant__ {
++			touchscreen-inverted-y;
++		};
++	};
++
++	__overrides__ {
++		dsi0 = <&dsi_frag>, "target:0=",<&dsi0>,
++		       <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&touch_reg>, "reg:0=0",
++		       <&touch_reg>, "regulator-name=touch_reg_0";
++		sizex = <&gt911>,"touchscreen-size-x:0";
++		sizey = <&gt911>,"touchscreen-size-y:0";
++		invx = <0>, "+10";
++		invy = <0>, "+11";
++		swapxy = <&gt911>,"touchscreen-swapped-x-y?";
++		disable_touch = <&gt911>, "status=disabled";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-dsi-lt070me05000-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-dsi-lt070me05000-overlay.dts
+new file mode 100644
+index 000000000000..d7b8f6713804
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dsi-lt070me05000-overlay.dts
+@@ -0,0 +1,69 @@
++/*
++ * Device Tree overlay to connect a JDI LT070ME05000 DSI panel to DSI1.
++ * This uses 4 DSI data lanes, so can only be used with a Compute Module.
++ *
++ * Credit to forum user gizmomouse on
++ * https://www.raspberrypi.org/forums/viewtopic.php?f=98&t=253912 and
++ * Andrey Vostrukhin of Harlab for the overlay.
++ *
++ * Refer to https://github.com/harlab/CM4_LCD_LT070ME05000 for schematics and
++ * other documentation.
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&dsi1>;
++		__overlay__{
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			port {
++				dsi_out_port:endpoint {
++					remote-endpoint = <&panel_dsi_port>;
++				};
++			};
++
++			lt070me05000:lt070me05000@0 {
++				compatible    = "jdi,lt070me05000";
++				status        = "okay";
++				reg           = <0>;
++				reset-gpios   = <&gpio 17 1>;   // LCD RST
++				enable-gpios  = <&gpio 4 0>;    // LCD Enable
++				dcdc-en-gpios = <&gpio 5 0>;    // LCD DC-DC Enable
++				port {
++					panel_dsi_port: endpoint {
++						remote-endpoint = <&dsi_out_port>;
++					};
++				};
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			lt070me05000_pins: lt070me05000_pins {
++				brcm,pins = <4 5 17>;
++				brcm,function = <1 1 1>; // out
++				brcm,pull = <0 0 0>; // off
++			};
++		};
++
++	};
++
++	__overrides__ {
++		reset = <&lt070me05000_pins>,"brcm,pins:8",
++			<&lt070me05000>,"reset-gpios:4";
++
++		enable = <&lt070me05000_pins>,"brcm,pins:0",
++			<&lt070me05000>,"enable-gpios:4";
++
++		dcdc-en = <&lt070me05000_pins>,"brcm,pins:4",
++			<&lt070me05000>,"dcdc-en-gpios:4";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-dsi-lt070me05000-v2-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-dsi-lt070me05000-v2-overlay.dts
+new file mode 100644
+index 000000000000..5dcd0f2243e2
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dsi-lt070me05000-v2-overlay.dts
+@@ -0,0 +1,64 @@
++/*
++ * Device Tree overlay to connect a JDI LT070ME05000 DSI panel to DSI1.
++ * This uses 4 DSI data lanes, so can only be used with a Compute Module.
++ *
++ * The overlay is for V2 of Harlab's interface board that uses a PCA9536 to
++ * handle the panel's control GPIOs instead of wiring it back to Pi GPIOs.
++ *
++ * Credit to Andrey Vostrukhin of Harlab for the overlay.
++ *
++ * Refer to https://github.com/harlab/CM4_LCD_LT070ME05000 for schematics and
++ * other documentation.
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			pca: pca@41 {
++				compatible = "nxp,pca9536";
++				reg = <0x41>;
++				gpio-controller;
++				#gpio-cells = <2>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&dsi1>;
++		__overlay__{
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			port {
++				dsi_out_port:endpoint {
++					remote-endpoint = <&panel_dsi_port>;
++				};
++			};
++
++			lt070me05000:lt070me05000@0 {
++				compatible    = "jdi,lt070me05000";
++				status        = "okay";
++				reg           = <0>;
++				reset-gpios   = <&pca 0 1>;
++				enable-gpios  = <&pca 2 0>;
++				dcdc-en-gpios = <&pca 1 0>;
++				port {
++					panel_dsi_port: endpoint {
++						remote-endpoint = <&dsi_out_port>;
++					};
++				};
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-dsi-waveshare-800x480-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-dsi-waveshare-800x480-overlay.dts
+new file mode 100644
+index 000000000000..78e8f46c69cc
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dsi-waveshare-800x480-overlay.dts
+@@ -0,0 +1,119 @@
++/*
++ * Device Tree overlay for Waveshare 4.3" 800x480 panel.
++ * It tries to look like a Pi 7" panel, but fails with some of the timing
++ * options.
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include "edt-ft5406.dtsi"
++
++/ {
++	/* No compatible as it will have come from edt-ft5406.dtsi */
++
++	dsi_frag: fragment@0 {
++		target = <&dsi1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			port {
++				dsi_out: endpoint {
++					remote-endpoint = <&panel_dsi_port>;
++				};
++			};
++
++			panel: panel-dsi-generic@0 {
++				// See panel-dsi.yaml binding
++				compatible = "waveshare,4-3-inch-dsi","panel-dsi";
++				reg = <0>;
++				power-supply = <&reg_display>;
++				backlight = <&reg_display>;
++				dsi-color-format = "RGB888";
++				mode = "MODE_VIDEO";
++				width-mm = <0>;
++				height-mm = <0>;
++
++				port {
++					panel_dsi_port: endpoint {
++						data-lanes = <1>;
++						remote-endpoint = <&dsi_out>;
++					};
++				};
++
++				timing: panel-timing {
++					clock-frequency = <27777000>;
++					hactive = <800>;
++					vactive = <480>;
++					hfront-porch = <59>;
++					hsync-len = <2>;
++					hback-porch = <45>;
++					vfront-porch = <7>;
++					vsync-len = <2>;
++					vback-porch = <22>;
++				};
++			};
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			reg_bridge: reg_bridge@1 {
++				reg = <1>;
++				compatible = "regulator-fixed";
++				regulator-name = "bridge_reg";
++				gpio = <&reg_display 0 0>;
++				vin-supply = <&reg_display>;
++				enable-active-high;
++			};
++		};
++	};
++
++	i2c_frag: fragment@2 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			reg_display: reg_display@45 {
++				compatible = "raspberrypi,7inch-touchscreen-panel-regulator";
++				reg = <0x45>;
++				gpio-controller;
++				#gpio-cells = <2>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@5 {
++		target = <&ft5406>;
++		__overlay__ {
++			vcc-supply = <&reg_display>;
++			reset-gpio = <&reg_display 1 1>;
++		};
++	};
++
++	__overrides__ {
++		dsi0 = <&dsi_frag>, "target:0=",<&dsi0>,
++		       <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&ts_i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&reg_bridge>, "reg:0=0",
++		       <&reg_bridge>, "regulator-name=bridge_reg_0";
++		disable_touch = <&ft5406>, "status=disabled";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-dsi-waveshare-panel-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-dsi-waveshare-panel-overlay.dts
+new file mode 100644
+index 000000000000..3b03ef09cdb9
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dsi-waveshare-panel-overlay.dts
+@@ -0,0 +1,133 @@
++/*
++ * Device Tree overlay for Waveshare DSI Touchscreens
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	dsi_frag: fragment@0 {
++		target = <&dsi1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++			port {
++				dsi_out: endpoint {
++					remote-endpoint = <&panel_in>;
++				};
++			};
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++		};
++	};
++
++	i2c_frag: fragment@2 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			panel: panel_disp1@45 {
++				reg = <0x45>;
++				compatible = "waveshare,10.1inch-panel";
++
++				port {
++					panel_in: endpoint {
++						remote-endpoint = <&dsi_out>;
++					};
++				};
++			};
++
++			touch: goodix@14 {
++				reg = <0x14>;
++				compatible = "goodix,gt911";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@5 {
++		target = <&i2c_arm>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		2_8_inch = <&panel>, "compatible=waveshare,2.8inch-panel",
++				   <&touch>, "touchscreen-size-x:0=480",
++				   <&touch>, "touchscreen-size-y:0=640",
++				   <&touch>, "touchscreen-inverted-y?",
++				   <&touch>, "touchscreen-swapped-x-y?";
++		3_4_inch = <&panel>, "compatible=waveshare,3.4inch-panel",
++				   <&touch>, "touchscreen-size-x:0=800",
++				   <&touch>, "touchscreen-size-y:0=800";
++		4_0_inch = <&panel>, "compatible=waveshare,4.0inch-panel",
++				   <&touch>, "touchscreen-size-x:0=800",
++				   <&touch>, "touchscreen-size-y:0=480",
++				   <&touch>, "touchscreen-inverted-x?",
++				   <&touch>, "touchscreen-swapped-x-y?";
++		7_0_inchC = <&panel>, "compatible=waveshare,7.0inch-c-panel",
++				   <&touch>, "touchscreen-size-x:0=800",
++				   <&touch>, "touchscreen-size-y:0=480";
++		7_9_inch = <&panel>, "compatible=waveshare,7.9inch-panel",
++				   <&touch>, "touchscreen-size-x:0=4096",
++				   <&touch>, "touchscreen-size-y:0=4096",
++				   <&touch>, "touchscreen-inverted-x?",
++				   <&touch>, "touchscreen-swapped-x-y?";
++		8_0_inch = <&panel>, "compatible=waveshare,8.0inch-panel",
++				   <&touch>, "touchscreen-size-x:0=800",
++				   <&touch>, "touchscreen-size-y:0=1280",
++				   <&touch>, "touchscreen-inverted-x?",
++				   <&touch>, "touchscreen-swapped-x-y?";
++		10_1_inch = <&panel>, "compatible=waveshare,10.1inch-panel",
++				   <&touch>, "touchscreen-size-x:0=800",
++				   <&touch>, "touchscreen-size-y:0=1280",
++				   <&touch>, "touchscreen-inverted-x?",
++				   <&touch>, "touchscreen-swapped-x-y?";
++		11_9_inch = <&panel>, "compatible=waveshare,11.9inch-panel",
++				   <&touch>, "touchscreen-inverted-x?",
++				   <&touch>, "touchscreen-swapped-x-y?";
++		4_0_inchC = <&panel>, "compatible=waveshare,4inch-panel",
++				   <&touch>, "touchscreen-size-x:0=720",
++				   <&touch>, "touchscreen-size-y:0=720";
++		5_0_inch = <&panel>, "compatible=waveshare,5.0inch-panel",
++				   <&touch>, "touchscreen-inverted-x?",
++				   <&touch>, "touchscreen-inverted-y?";
++		6_25_inch = <&panel>, "compatible=waveshare,6.25inch-panel",
++				   <&touch>, "touchscreen-inverted-x?",
++				   <&touch>, "touchscreen-inverted-y?";
++		8_8_inch = <&panel>, "compatible=waveshare,8.8inch-panel";
++		i2c1 = <&i2c_frag>, "target:0=",<&i2c1>,
++		       <0>, "-3-4+5";
++		disable_touch = <&touch>, "status=disabled";
++		rotation = <&panel>, "rotation:0";
++		invx = <&touch>,"touchscreen-inverted-x?";
++		invy = <&touch>,"touchscreen-inverted-y?";
++		swapxy = <&touch>,"touchscreen-swapped-x-y?";
++		dsi0 = <&dsi_frag>, "target:0=",<&dsi0>,
++		       <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>;
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-kippah-7inch-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-kippah-7inch-overlay.dts
+new file mode 100644
+index 000000000000..4c1aa1c70158
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-kippah-7inch-overlay.dts
+@@ -0,0 +1,26 @@
++/*
++ * vc4-kms-kippah-7inch-overlay.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include "vc4-kms-dpi.dtsi"
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&panel>;
++		__overlay__  {
++			compatible = "ontat,yx700wv03", "simple-panel";
++		};
++	};
++
++	fragment@1 {
++		target = <&dpi>;
++		__overlay__  {
++			pinctrl-0 = <&dpi_18bit_gpio0>;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
+new file mode 100644
+index 000000000000..26a5bd71945d
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
+@@ -0,0 +1,124 @@
++/*
++ * vc4-kms-v3d-overlay.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/clock/bcm2835.h>
++
++#include "cma-overlay.dts"
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@1 {
++		target = <&i2c2>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&fb>;
++		__overlay__  {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&pixelvalve0>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&pixelvalve1>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@5 {
++		target = <&pixelvalve2>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@6 {
++		target = <&hvs>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@7 {
++		target = <&hdmi>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@8 {
++		target = <&v3d>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@9 {
++		target = <&vc4>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@10 {
++		target = <&clocks>;
++		__overlay__  {
++			claim-clocks = <
++				BCM2835_PLLD_DSI0
++				BCM2835_PLLD_DSI1
++				BCM2835_PLLH_AUX
++				BCM2835_PLLH_PIX
++			>;
++		};
++	};
++
++	fragment@11 {
++		target = <&vec>;
++		__dormant__  {
++			status = "okay";
++		};
++	};
++
++	fragment@12 {
++		target = <&txp>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@13 {
++		target = <&hdmi>;
++		__dormant__  {
++			dmas;
++		};
++	};
++
++	fragment@14 {
++		target = <&chosen>;
++		__overlay__  {
++			bootargs = "snd_bcm2835.enable_hdmi=0";
++		};
++	};
++
++	__overrides__ {
++		audio   = <0>,"!13";
++		noaudio = <0>,"=13";
++		composite = <0>, "=11";
++		nohdmi = <0>, "-1-7";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-v3d-pi4-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-v3d-pi4-overlay.dts
+new file mode 100644
+index 000000000000..c1e53e3ed575
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-v3d-pi4-overlay.dts
+@@ -0,0 +1,200 @@
++/*
++ * vc4-kms-v3d-pi4-overlay.dts
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/clock/bcm2835.h>
++
++#include "cma-overlay.dts"
++
++&frag0 {
++	size = <((512-4)*1024*1024)>;
++};
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@1 {
++		target = <&ddc0>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&ddc1>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target = <&hdmi0>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&hdmi1>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@5 {
++		target = <&hvs>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@6 {
++		target = <&pixelvalve0>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@7 {
++		target = <&pixelvalve1>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@8 {
++		target = <&pixelvalve2>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@9 {
++		target = <&pixelvalve3>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@10 {
++		target = <&pixelvalve4>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@11 {
++		target = <&v3d>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@12 {
++		target = <&vc4>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@13 {
++		target = <&txp>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@14 {
++		target = <&fb>;
++		__overlay__  {
++			status = "disabled";
++		};
++	};
++
++	fragment@15 {
++		target = <&firmwarekms>;
++		__overlay__  {
++			status = "disabled";
++		};
++	};
++
++	fragment@16 {
++		target = <&vec>;
++		__overlay__  {
++			status = "disabled";
++		};
++	};
++
++	fragment@17 {
++		target = <&hdmi0>;
++		__dormant__  {
++			dmas;
++		};
++	};
++
++	fragment@18 {
++		target = <&hdmi1>;
++		__dormant__  {
++			dmas;
++		};
++	};
++
++	fragment@19 {
++		target-path = "/chosen";
++		__overlay__  {
++			bootargs = "snd_bcm2835.enable_hdmi=0";
++		};
++	};
++
++	fragment@20 {
++		target = <&dvp>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@21 {
++		target = <&pixelvalve3>;
++		__dormant__  {
++			status = "okay";
++		};
++	};
++
++	fragment@22 {
++		target = <&vec>;
++		__dormant__  {
++			status = "okay";
++		};
++	};
++
++	fragment@23 {
++		target = <&aon_intr>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		audio   = <0>,"!17";
++		audio1   = <0>,"!18";
++		noaudio = <0>,"=17", <0>,"=18";
++		composite = <0>, "!1",
++			    <0>, "!2",
++			    <0>, "!3",
++			    <0>, "!4",
++			    <0>, "!6",
++			    <0>, "!7",
++			    <0>, "!8",
++			    <0>, "!9",
++			    <0>, "!10",
++			    <0>, "!16",
++			    <0>, "=21",
++			    <0>, "=22";
++		nohdmi0 =   <0>, "-1-3-8";
++		nohdmi1 =   <0>, "-2-4-10";
++		nohdmi =    <0>, "-1-2-3-4-8-10";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-v3d-pi5-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-v3d-pi5-overlay.dts
+new file mode 100644
+index 000000000000..94ab6eb1fbaf
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-v3d-pi5-overlay.dts
+@@ -0,0 +1,147 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include "cma-overlay.dts"
++
++&frag0 {
++	size = <(64*1024*1024)>;
++};
++
++/ {
++	compatible = "brcm,bcm2712";
++
++	fragment@1 {
++		target = <&fb>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&aon_intr>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@3 {
++		target = <&ddc0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&ddc1>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@5 {
++		target = <&hdmi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@6 {
++		target = <&hdmi1>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@7 {
++		target = <&hvs>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@8 {
++		target = <&mop>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@9 {
++		target = <&moplet>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@10 {
++		target = <&pixelvalve0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@11 {
++		target = <&pixelvalve1>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@12 {
++		target = <&v3d>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@13 {
++		target = <&vec>;
++		frag13: __overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@14 {
++		target = <&hdmi0>;
++		__dormant__  {
++			dmas;
++		};
++	};
++
++	fragment@15 {
++		target = <&hdmi1>;
++		__dormant__  {
++			dmas;
++		};
++	};
++
++	fragment@16 {
++		target = <&disp_intr>;
++		__overlay__  {
++			status = "okay";
++		};
++	};
++
++	fragment@17 {
++		target = <&vc4>;
++		__overlay__  {
++			/* IOMMU attaches here, where we allocate DMA buffers */
++			iommus = <&iommu4>;
++		};
++	};
++
++	__overrides__ {
++		audio   = <0>,"!14";
++		audio1   = <0>,"!15";
++		noaudio = <0>,"=14", <0>,"=15";
++		composite = <0>, "!3",
++			    <0>, "!4",
++			    <0>, "!5",
++			    <0>, "!6",
++			    <0>, "!10",
++			    <0>, "!11",
++			    <&frag13>, "status";
++		nohdmi0 =   <0>, "-3-5-10";
++		nohdmi1 =   <0>, "-4-6-11";
++		nohdmi =    <0>, "-3-4-5-6-10-11";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vc4-kms-vga666-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-vga666-overlay.dts
+new file mode 100644
+index 000000000000..c3a682d5b7d9
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vc4-kms-vga666-overlay.dts
+@@ -0,0 +1,107 @@
++/*
++ * vc4-kms-vga666-overlay.dts
++ * Configures a FenLogic or similar VGA666 DPI adapter when using the
++ * vc4-kms-v3d driver.
++ * If a suitable I2C level shifter is connected to GPIOs 0&1 and the VGA
++ * ID1/SDA (pin 12) and ID3/SCL (pin 15) lines, then there is the option to
++ * enable reading the EDID from the display.
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/pinctrl/bcm2835.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			vga_connector: vga_connector {
++				compatible = "vga-connector";
++				label = "vga";
++
++				port {
++					vga_con_in: endpoint {
++						remote-endpoint = <&vga666_out>;
++					};
++				};
++			};
++
++			vga_dac {
++				compatible = "dumb-vga-dac";
++
++				ports {
++					#address-cells = <1>;
++					#size-cells = <0>;
++
++					port@0 {
++						reg = <0>;
++
++						vga666_in: endpoint {
++							remote-endpoint = <&dpi_out>;
++						};
++					};
++
++					port@1 {
++						reg = <1>;
++
++						vga666_out: endpoint {
++							remote-endpoint = <&vga_con_in>;
++						};
++					};
++				};
++			};
++
++		};
++	};
++
++	fragment@1 {
++		target = <&dpi>;
++		__overlay__  {
++			status = "okay";
++
++			pinctrl-names = "default";
++			pinctrl-0 = <&dpi_18bit_gpio2>;
++
++			port {
++				dpi_out: endpoint@0 {
++					remote-endpoint = <&vga666_in>;
++				};
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&vga_connector>;
++		__dormant__  {
++			ddc-i2c-bus = <&i2c_vc>;
++		};
++	};
++
++	fragment@3 {
++		target = <&i2c0if>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	fragment@4 {
++		target = <&i2c0mux>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	fragment@5 {
++		target = <&i2c_vc>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		ddc = <0>,"=2", <0>,"=3", <0>,"=4", <0>,"=5";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vga666-overlay.dts b/arch/arm/boot/dts/overlays/vga666-overlay.dts
+new file mode 100644
+index 000000000000..a4968d180a5d
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vga666-overlay.dts
+@@ -0,0 +1,30 @@
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	// There is no VGA driver module, but we need a platform device
++	// node (that doesn't already use pinctrl) to hang the pinctrl
++	// reference on - leds will do
++
++	fragment@0 {
++		target = <&leds>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&vga666_pins>;
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			vga666_pins: vga666_pins {
++				brcm,pins = <2 3 4 5 6 7 8 9 10 11 12
++					     13 14 15 16 17 18 19 20 21>;
++				brcm,function = <6>; /* alt2 */
++				brcm,pull = <0>; /* no pull */
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/vl805-overlay.dts b/arch/arm/boot/dts/overlays/vl805-overlay.dts
+new file mode 100644
+index 000000000000..81adf34b29f2
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/vl805-overlay.dts
+@@ -0,0 +1,18 @@
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/reset/raspberrypi,firmware-reset.h>
++
++/ {
++	compatible = "brcm,bcm2711";
++
++	fragment@0 {
++		target-path = "pcie0/pci@0,0";
++		__overlay__ {
++			usb@0,0 {
++				reg = <0 0 0 0 0>;
++				resets = <&reset RASPBERRYPI_FIRMWARE_RESET_ID_USB>;
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/w1-gpio-overlay.dts b/arch/arm/boot/dts/overlays/w1-gpio-overlay.dts
+new file mode 100644
+index 000000000000..f44e325bc1f2
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/w1-gpio-overlay.dts
+@@ -0,0 +1,40 @@
++// Definitions for w1-gpio module (without external pullup)
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++
++			w1: onewire@0 {
++				compatible = "w1-gpio";
++				pinctrl-names = "default";
++				pinctrl-0 = <&w1_pins>;
++				gpios = <&gpio 4 0>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			w1_pins: w1_pins@0 {
++				brcm,pins = <4>;
++				brcm,function = <0>; // in (initially)
++				brcm,pull = <0>; // off
++			};
++		};
++	};
++
++	__overrides__ {
++		gpiopin =       <&w1>,"gpios:4",
++				<&w1>,"reg:0",
++				<&w1_pins>,"brcm,pins:0",
++				<&w1_pins>,"reg:0";
++		pullup;		// Silently ignore unneeded parameter
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/w1-gpio-pi5-overlay.dts b/arch/arm/boot/dts/overlays/w1-gpio-pi5-overlay.dts
+new file mode 100644
+index 000000000000..a408d3d62d40
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/w1-gpio-pi5-overlay.dts
+@@ -0,0 +1,15 @@
++/dts-v1/;
++/plugin/;
++
++#include "w1-gpio-overlay.dts"
++
++/ {
++	compatible = "brcm,bcm2712";
++
++	fragment@2 {
++		target = <&w1>;
++		__overlay__ {
++			raspberrypi,delay-needs-poll;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/w1-gpio-pullup-overlay.dts b/arch/arm/boot/dts/overlays/w1-gpio-pullup-overlay.dts
+new file mode 100644
+index 000000000000..953c6a1aeab9
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/w1-gpio-pullup-overlay.dts
+@@ -0,0 +1,42 @@
++// Definitions for w1-gpio module (with external pullup)
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++
++			w1: onewire@0 {
++				compatible = "w1-gpio";
++				pinctrl-names = "default";
++				pinctrl-0 = <&w1_pins>;
++				gpios = <&gpio 4 0>, <&gpio 5 1>;
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			w1_pins: w1_pins@0 {
++				brcm,pins = <4 5>;
++				brcm,function = <0 1>; // in out
++				brcm,pull = <0 0>; // off off
++			};
++		};
++	};
++
++	__overrides__ {
++		gpiopin =       <&w1>,"gpios:4",
++				<&w1>,"reg:0",
++				<&w1_pins>,"brcm,pins:0",
++				<&w1_pins>,"reg:0";
++		extpullup =     <&w1>,"gpios:16",
++				<&w1_pins>,"brcm,pins:4";
++		pullup;		// Silently ignore unneeded parameter
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/w1-gpio-pullup-pi5-overlay.dts b/arch/arm/boot/dts/overlays/w1-gpio-pullup-pi5-overlay.dts
+new file mode 100644
+index 000000000000..9d1fffb7e87c
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/w1-gpio-pullup-pi5-overlay.dts
+@@ -0,0 +1,15 @@
++/dts-v1/;
++/plugin/;
++
++#include "w1-gpio-pullup-overlay.dts"
++
++/ {
++	compatible = "brcm,bcm2712";
++
++	fragment@2 {
++		target = <&w1>;
++		__overlay__ {
++			raspberrypi,delay-needs-poll;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/w5500-overlay.dts b/arch/arm/boot/dts/overlays/w5500-overlay.dts
+new file mode 100644
+index 000000000000..4d3e66296753
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/w5500-overlay.dts
+@@ -0,0 +1,63 @@
++// Overlay for the Wiznet w5500 Ethernet Controller
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev1>;
++		__dormant__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			status = "okay";
++
++			eth1: w5500@0{
++				compatible = "wiznet,w5500";
++				reg = <0>; /* CE0 */
++				pinctrl-names = "default";
++				pinctrl-0 = <&eth1_pins>;
++				interrupt-parent = <&gpio>;
++				interrupts = <25 0x8>;
++				spi-max-frequency = <30000000>;
++//				local-mac-address = [aa bb cc dd ee ff];
++				status = "okay";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			eth1_pins: eth1_pins {
++				brcm,pins = <25>;
++				brcm,function = <0>; /* in */
++				brcm,pull = <0>; /* none */
++			};
++		};
++	};
++
++	__overrides__ {
++		int_pin = <&eth1>, "interrupts:0",
++		          <&eth1_pins>, "brcm,pins:0";
++		speed   = <&eth1>, "spi-max-frequency:0";
++		cs      = <&eth1>, "reg:0",
++			  <0>, "!0=1";
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/watterott-display-overlay.dts b/arch/arm/boot/dts/overlays/watterott-display-overlay.dts
+new file mode 100644
+index 000000000000..4388706d2c38
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/watterott-display-overlay.dts
+@@ -0,0 +1,150 @@
++/*
++ * Device Tree overlay for rpi-display by Watterott
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&gpio>;
++		__overlay__ {
++			rpi_display_pins: rpi_display_pins {
++				brcm,pins = <18 23 24 25>;
++				brcm,function = <1 1 1 0>; /* out out out in */
++				brcm,pull = <0 0 0 2>; /* - - - up */
++			};
++		};
++	};
++
++	fragment@4 {
++		target = <&spi0>;
++		__overlay__ {
++			/* needed to avoid dtc warning */
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			rpidisplay: rpi-display@0{
++				compatible = "ilitek,ili9341";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&rpi_display_pins>;
++
++				spi-max-frequency = <32000000>;
++				rotate = <270>;
++				bgr;
++				fps = <30>;
++				buswidth = <8>;
++				reset-gpios = <&gpio 23 1>;
++				dc-gpios = <&gpio 24 0>;
++				led-gpios = <&gpio 18 0>;
++				debug = <0>;
++			};
++
++			rpidisplay_ts: rpi-display-ts@1 {
++				compatible = "ti,ads7846";
++				reg = <1>;
++
++				spi-max-frequency = <2000000>;
++				interrupts = <25 2>; /* high-to-low edge triggered */
++				interrupt-parent = <&gpio>;
++				pendown-gpio = <&gpio 25 1>;
++				ti,x-plate-ohms = /bits/ 16 <60>;
++				ti,pressure-max = /bits/ 16 <255>;
++			};
++		};
++	};
++
++	fragment@10 {
++		target = <&rpidisplay>;
++		__dormant__  {
++			backlight = <&backlight_gpio>;
++		};
++	};
++
++	fragment@11 {
++		target-path = "/";
++		__dormant__  {
++			backlight_gpio: backlight_gpio {
++				compatible = "gpio-backlight";
++				gpios = <&gpio 18 0>; /* GPIO_ACTIVE_HIGH */
++			};
++		};
++	};
++
++	fragment@20 {
++		target = <&rpidisplay>;
++		__dormant__  {
++			backlight = <&backlight_pwm>;
++		};
++	};
++
++	fragment@21 {
++		target-path = "/";
++		__dormant__  {
++			backlight_pwm: backlight_pwm {
++				compatible = "pwm-backlight";
++				brightness-levels = <0 6 8 12 16 24 32 40 48 64 96 128 160 192 224 255>;
++				default-brightness-level = <16>;
++				pwms = <&pwm 0 200000 0>;
++			};
++		};
++	};
++
++	fragment@22 {
++		target = <&pwm>;
++		__dormant__ {
++			assigned-clock-rates = <1000000>;
++			status = "okay";
++		};
++	};
++
++	fragment@23 {
++		target = <&chosen>;
++		__dormant__  {
++			bootargs = "snd_bcm2835.enable_headphones=0";
++		};
++	};
++
++	__overrides__ {
++		speed =     <&rpidisplay>,"spi-max-frequency:0";
++		rotate =    <&rpidisplay>,"rotate:0", /* fbtft */
++			    <&rpidisplay>,"rotation:0"; /* drm */
++		fps =       <&rpidisplay>,"fps:0";
++		debug =     <&rpidisplay>,"debug:0";
++		xohms =     <&rpidisplay_ts>,"ti,x-plate-ohms;0";
++		swapxy =    <&rpidisplay_ts>,"ti,swap-xy?";
++		backlight = <&rpidisplay>,"led-gpios:4",
++		            <&rpi_display_pins>,"brcm,pins:0";
++		drm =       <&rpidisplay>, "compatible=multi-inno,mi0283qt",
++			    <&rpidisplay>, "spi-max-frequency:0=70000000",
++			    <&rpidisplay>, "reset-gpios:8=0", /* GPIO_ACTIVE_HIGH */
++			    <0>, "+10+11";
++		backlight-pwm = <0>, "-10-11+20+21+22+23",
++				<&rpi_display_pins>, "brcm,function:0=2"; /* Alt5 */
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/waveshare-can-fd-hat-mode-a-overlay.dts b/arch/arm/boot/dts/overlays/waveshare-can-fd-hat-mode-a-overlay.dts
+new file mode 100644
+index 000000000000..59388cc3b0b9
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/waveshare-can-fd-hat-mode-a-overlay.dts
+@@ -0,0 +1,140 @@
++// redo: ovmerge -c spi1-1cs-overlay.dts,cs0_pin=26,cs0_spidev=false mcp251xfd-overlay.dts,spi0-0,interrupt=25 mcp251xfd-overlay.dts,spi1-0,interrupt=16
++
++// Device tree overlay for https://www.waveshare.com/2-ch-can-fd-hat.htm
++// in "Mode A" (default) configuration
++// for details see https://www.waveshare.com/wiki/2-CH_CAN_FD_HAT
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/interrupt-controller/irq.h>
++#include <dt-bindings/pinctrl/bcm2835.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			spi1_pins: spi1_pins {
++				brcm,pins = <19 20 21>;
++				brcm,function = <3>;
++			};
++			spi1_cs_pins: spi1_cs_pins {
++				brcm,pins = <26>;
++				brcm,function = <1>;
++			};
++		};
++	};
++	fragment@1 {
++		target = <&spi1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&spi1_pins &spi1_cs_pins>;
++			cs-gpios = <&gpio 26 1>;
++			status = "okay";
++			spidev@0 {
++				compatible = "spidev";
++				reg = <0>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++				spi-max-frequency = <125000000>;
++				status = "disabled";
++			};
++		};
++	};
++	fragment@2 {
++		target = <&aux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++	fragment@3 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++	fragment@4 {
++		target = <&gpio>;
++		__overlay__ {
++			mcp251xfd_pins: mcp251xfd_spi0_0_pins {
++				brcm,pins = <25>;
++				brcm,function = <BCM2835_FSEL_GPIO_IN>;
++			};
++		};
++	};
++	fragment@5 {
++		target-path = "/clocks";
++		__overlay__ {
++			clk_mcp251xfd_osc: mcp251xfd-spi0-0-osc {
++				#clock-cells = <0>;
++				compatible = "fixed-clock";
++				clock-frequency = <40000000>;
++			};
++		};
++	};
++	fragment@6 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			mcp251xfd@0 {
++				compatible = "microchip,mcp251xfd";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&mcp251xfd_pins>;
++				spi-max-frequency = <20000000>;
++				interrupt-parent = <&gpio>;
++				interrupts = <25 IRQ_TYPE_LEVEL_LOW>;
++				clocks = <&clk_mcp251xfd_osc>;
++			};
++		};
++	};
++	fragment@7 {
++		target-path = "spi1/spidev@0";
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++	fragment@8 {
++		target = <&gpio>;
++		__overlay__ {
++			mcp251xfd_pins_1: mcp251xfd_spi1_0_pins {
++				brcm,pins = <16>;
++				brcm,function = <BCM2835_FSEL_GPIO_IN>;
++			};
++		};
++	};
++	fragment@9 {
++		target-path = "/clocks";
++		__overlay__ {
++			clk_mcp251xfd_osc_1: mcp251xfd-spi1-0-osc {
++				#clock-cells = <0>;
++				compatible = "fixed-clock";
++				clock-frequency = <40000000>;
++			};
++		};
++	};
++	fragment@10 {
++		target = <&spi1>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			mcp251xfd@0 {
++				compatible = "microchip,mcp251xfd";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&mcp251xfd_pins_1>;
++				spi-max-frequency = <20000000>;
++				interrupt-parent = <&gpio>;
++				interrupts = <16 IRQ_TYPE_LEVEL_LOW>;
++				clocks = <&clk_mcp251xfd_osc_1>;
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/waveshare-can-fd-hat-mode-b-overlay.dts b/arch/arm/boot/dts/overlays/waveshare-can-fd-hat-mode-b-overlay.dts
+new file mode 100644
+index 000000000000..b2504922c8de
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/waveshare-can-fd-hat-mode-b-overlay.dts
+@@ -0,0 +1,103 @@
++// redo: ovmerge -c mcp251xfd-overlay.dts,spi0-0,interrupt=25 mcp251xfd-overlay.dts,spi0-1,interrupt=16
++
++// Device tree overlay for https://www.waveshare.com/2-ch-can-fd-hat.htm
++// in "Mode B" (requried hardware modification) configuration
++// for details see https://www.waveshare.com/wiki/2-CH_CAN_FD_HAT
++
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/interrupt-controller/irq.h>
++#include <dt-bindings/pinctrl/bcm2835.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++	fragment@0 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			mcp251xfd_pins: mcp251xfd_spi0_0_pins {
++				brcm,pins = <25>;
++				brcm,function = <BCM2835_FSEL_GPIO_IN>;
++			};
++		};
++	};
++	fragment@2 {
++		target-path = "/clocks";
++		__overlay__ {
++			clk_mcp251xfd_osc: mcp251xfd-spi0-0-osc {
++				#clock-cells = <0>;
++				compatible = "fixed-clock";
++				clock-frequency = <40000000>;
++			};
++		};
++	};
++	fragment@3 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			mcp251xfd@0 {
++				compatible = "microchip,mcp251xfd";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&mcp251xfd_pins>;
++				spi-max-frequency = <20000000>;
++				interrupt-parent = <&gpio>;
++				interrupts = <25 IRQ_TYPE_LEVEL_LOW>;
++				clocks = <&clk_mcp251xfd_osc>;
++			};
++		};
++	};
++	fragment@4 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++	fragment@5 {
++		target = <&gpio>;
++		__overlay__ {
++			mcp251xfd_pins_1: mcp251xfd_spi0_1_pins {
++				brcm,pins = <16>;
++				brcm,function = <BCM2835_FSEL_GPIO_IN>;
++			};
++		};
++	};
++	fragment@6 {
++		target-path = "/clocks";
++		__overlay__ {
++			clk_mcp251xfd_osc_1: mcp251xfd-spi0-1-osc {
++				#clock-cells = <0>;
++				compatible = "fixed-clock";
++				clock-frequency = <40000000>;
++			};
++		};
++	};
++	fragment@7 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			mcp251xfd@1 {
++				compatible = "microchip,mcp251xfd";
++				reg = <1>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&mcp251xfd_pins_1>;
++				spi-max-frequency = <20000000>;
++				interrupt-parent = <&gpio>;
++				interrupts = <16 IRQ_TYPE_LEVEL_LOW>;
++				clocks = <&clk_mcp251xfd_osc_1>;
++			};
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/overlays/wittypi-overlay.dts b/arch/arm/boot/dts/overlays/wittypi-overlay.dts
+new file mode 100644
+index 000000000000..71ce806186de
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/wittypi-overlay.dts
+@@ -0,0 +1,44 @@
++/*
++ * Device Tree overlay for Witty Pi extension board by UUGear
++ *
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&leds>;
++		__overlay__ {
++			compatible = "gpio-leds";
++			wittypi_led: wittypi_led {
++				label = "wittypi_led";
++				linux,default-trigger = "default-on";
++				gpios = <&gpio 17 0>;
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			rtc: ds1337@68 {
++				compatible = "dallas,ds1337";
++				reg = <0x68>;
++				wakeup-source;
++			};
++		};
++	};
++
++	__overrides__ {
++		led_gpio =	<&wittypi_led>,"gpios:4";
++		led_trigger =	<&wittypi_led>,"linux,default-trigger";
++	};
++
++};
+diff --git a/arch/arm/boot/dts/overlays/wm8960-soundcard-overlay.dts b/arch/arm/boot/dts/overlays/wm8960-soundcard-overlay.dts
+new file mode 100644
+index 000000000000..d896c59f469b
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/wm8960-soundcard-overlay.dts
+@@ -0,0 +1,82 @@
++// Definitions for Waveshare WM8960 https://github.com/waveshare/WM8960-Audio-HAT
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2s_clk_producer>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			wm8960_mclk: wm8960_mclk {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-frequency = <12288000>;
++			};
++		};
++	};
++	fragment@2 {
++		target = <&i2c1>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			wm8960: wm8960@1a {
++				compatible = "wlf,wm8960";
++				reg = <0x1a>;
++				#sound-dai-cells = <0>;
++				AVDD-supply = <&vdd_5v0_reg>;
++				DVDD-supply = <&vdd_3v3_reg>;
++				clocks = <&wm8960_mclk>;
++				clock-names = "mclk";
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&sound>;
++		slave_overlay: __overlay__ {
++			compatible = "simple-audio-card";
++			simple-audio-card,format = "i2s";
++			simple-audio-card,name = "wm8960-soundcard"; 
++			status = "okay";
++
++			simple-audio-card,widgets =
++				"Microphone", "Mic Jack",
++				"Line", "Line In",
++				"Line", "Line Out",
++				"Speaker", "Speaker",
++				"Headphone", "Headphone Jack";
++			simple-audio-card,routing =
++				"Headphone Jack", "HP_L",
++				"Headphone Jack", "HP_R",
++				"Speaker", "SPK_LP",
++				"Speaker", "SPK_LN",
++				"LINPUT1", "Mic Jack",
++				"LINPUT3", "Mic Jack",
++				"RINPUT1", "Mic Jack",
++				"RINPUT2", "Mic Jack";
++
++			simple-audio-card,cpu {
++				sound-dai = <&i2s_clk_producer>;
++			};
++
++			dailink0_slave: simple-audio-card,codec {
++				sound-dai = <&wm8960>;
++			};
++		};
++	};
++
++	__overrides__ {
++		alsaname = <&slave_overlay>,"simple-audio-card,name";
++		compatible = <&wm8960>,"compatible";
++	};
++};
+diff --git a/arch/arm64/boot/dts/Makefile b/arch/arm64/boot/dts/Makefile
+index 21cd3a87f385..4b79ed838b12 100644
+--- a/arch/arm64/boot/dts/Makefile
++++ b/arch/arm64/boot/dts/Makefile
+@@ -34,3 +34,5 @@ subdir-y += tesla
+ subdir-y += ti
+ subdir-y += toshiba
+ subdir-y += xilinx
++
++subdir-y += overlays
+diff --git a/arch/arm64/boot/dts/broadcom/Makefile b/arch/arm64/boot/dts/broadcom/Makefile
+index 92565e9781ad..b90591d821f5 100644
+--- a/arch/arm64/boot/dts/broadcom/Makefile
++++ b/arch/arm64/boot/dts/broadcom/Makefile
+@@ -13,6 +13,27 @@ dtb-$(CONFIG_ARCH_BCM2835) += bcm2711-rpi-400.dtb \
+ 			      bcm2837-rpi-cm3-io3.dtb \
+ 			      bcm2837-rpi-zero-2-w.dtb
+ 
++dtb-$(CONFIG_ARCH_BCM2835) += bcm2710-rpi-zero-2.dtb
++dtb-$(CONFIG_ARCH_BCM2835) += bcm2710-rpi-zero-2-w.dtb
++dtb-$(CONFIG_ARCH_BCM2835) += bcm2710-rpi-2-b.dtb
++dtb-$(CONFIG_ARCH_BCM2835) += bcm2710-rpi-3-b.dtb
++dtb-$(CONFIG_ARCH_BCM2835) += bcm2710-rpi-3-b-plus.dtb
++dtb-$(CONFIG_ARCH_BCM2835) += bcm2710-rpi-cm3.dtb
++dtb-$(CONFIG_ARCH_BCM2835) += bcm2711-rpi-cm4.dtb
++dtb-$(CONFIG_ARCH_BCM2835) += bcm2711-rpi-cm4s.dtb
++dtb-$(CONFIG_ARCH_BCM2835) += bcm2712-rpi-5-b.dtb
++dtb-$(CONFIG_ARCH_BCM2835) += bcm2712d0-rpi-5-b.dtb
++dtb-$(CONFIG_ARCH_BCM2835) += bcm2712-rpi-500.dtb
++dtb-$(CONFIG_ARCH_BCM2835) += bcm2712-rpi-cm5-cm5io.dtb
++dtb-$(CONFIG_ARCH_BCM2835) += bcm2712-rpi-cm5-cm4io.dtb
++dtb-$(CONFIG_ARCH_BCM2835) += bcm2712-rpi-cm5l-cm5io.dtb
++dtb-$(CONFIG_ARCH_BCM2835) += bcm2712-rpi-cm5l-cm4io.dtb
++
+ subdir-y	+= bcmbca
+ subdir-y	+= northstar2
+ subdir-y	+= stingray
++
++# Enable fixups to support overlays on BCM2835 platforms
++ifeq ($(CONFIG_ARCH_BCM2835),y)
++	DTC_FLAGS += -@
++endif
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2710-rpi-2-b.dts b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-2-b.dts
+new file mode 100644
+index 000000000000..9b2c0120842a
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-2-b.dts
+@@ -0,0 +1 @@
++#include "arm/broadcom/bcm2710-rpi-2-b.dts"
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b-plus.dts b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b-plus.dts
+new file mode 100644
+index 000000000000..bc869aeaee9b
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b-plus.dts
+@@ -0,0 +1 @@
++#include "arm/broadcom/bcm2710-rpi-3-b-plus.dts"
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b.dts b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b.dts
+new file mode 100644
+index 000000000000..263fc8db863a
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b.dts
+@@ -0,0 +1 @@
++#include "arm/broadcom/bcm2710-rpi-3-b.dts"
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2710-rpi-cm3.dts b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-cm3.dts
+new file mode 100644
+index 000000000000..6beee41b0077
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-cm3.dts
+@@ -0,0 +1 @@
++#include "arm/broadcom/bcm2710-rpi-cm3.dts"
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2710-rpi-zero-2-w.dts b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-zero-2-w.dts
+new file mode 100644
+index 000000000000..65fa59a939b7
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-zero-2-w.dts
+@@ -0,0 +1 @@
++#include "arm/broadcom/bcm2710-rpi-zero-2-w.dts"
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2710-rpi-zero-2.dts b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-zero-2.dts
+new file mode 100644
+index 000000000000..65fa59a939b7
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-zero-2.dts
+@@ -0,0 +1 @@
++#include "arm/broadcom/bcm2710-rpi-zero-2-w.dts"
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2711-rpi-cm4.dts b/arch/arm64/boot/dts/broadcom/bcm2711-rpi-cm4.dts
+new file mode 100644
+index 000000000000..3e25a0e1797f
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2711-rpi-cm4.dts
+@@ -0,0 +1 @@
++#include "arm/broadcom/bcm2711-rpi-cm4.dts"
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2711-rpi-cm4s.dts b/arch/arm64/boot/dts/broadcom/bcm2711-rpi-cm4s.dts
+new file mode 100644
+index 000000000000..c72d752e7400
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2711-rpi-cm4s.dts
+@@ -0,0 +1 @@
++#include "arm/broadcom/bcm2711-rpi-cm4s.dts"
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2712-ds.dtsi b/arch/arm64/boot/dts/broadcom/bcm2712-ds.dtsi
+new file mode 100644
+index 000000000000..401d9056b057
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-ds.dtsi
+@@ -0,0 +1,808 @@
++// SPDX-License-Identifier: GPL-2.0
++#include <dt-bindings/soc/bcm2835-pm.h>
++
++#include "bcm2712.dtsi"
++
++/ {
++#ifndef FIRMWARE_UPDATED
++	#size-cells = <1>;
++
++	reserved-memory {
++		ranges;
++		#address-cells = <2>;
++		#size-cells = <1>;
++
++		atf@0 {
++			reg = <0x0 0x0 0x80000>;
++		};
++
++		linux,cma {
++			size = <0x4000000>; /* 64MB */
++			alloc-ranges = <0x0 0x00000000 0x40000000>;
++		};
++	};
++#endif
++
++	clocks: clocks {
++		compatible = "simple-bus";
++		#address-cells = <1>;
++		#size-cells = <0>;
++
++		clk_usb: clk-usb {
++			compatible = "fixed-clock";
++			#clock-cells = <0>;
++			clock-output-names = "otg";
++			clock-frequency = <480000000>;
++		};
++
++		clk_27MHz: clk-27M {
++			#clock-cells = <0>;
++			compatible = "fixed-clock";
++			clock-frequency = <27000000>;
++			clock-output-names = "27MHz-clock";
++		};
++
++		clk_108MHz: clk-108M {
++			#clock-cells = <0>;
++			compatible = "fixed-clock";
++			clock-frequency = <108000000>;
++			clock-output-names = "108MHz-clock";
++		};
++	};
++
++	thermal-zones {
++		cpu_thermal: cpu-thermal {
++			polling-delay-passive = <1000>;
++			polling-delay = <1000>;
++			coefficients = <(-550) 450000>;
++			thermal-sensors = <&thermal>;
++
++			thermal_trips: trips {
++				cpu_crit: cpu-crit {
++					temperature	= <110000>;
++					hysteresis	= <0>;
++					type		= "critical";
++				};
++			};
++
++			cooling_maps: cooling-maps {
++			};
++		};
++	};
++
++	firmwarekms: firmwarekms {
++		compatible = "raspberrypi,rpi-firmware-kms-2712";
++		interrupt-parent = <&cpu_l2_irq>;
++		interrupts = <19>;
++		brcm,firmware = <&firmware>;
++		status = "disabled";
++	};
++
++	usbphy: phy {
++		compatible = "usb-nop-xceiv";
++		#phy-cells = <0>;
++	};
++};
++
++&soc {
++	system_timer: timer@7c003000 {
++		compatible = "brcm,bcm2835-system-timer";
++		reg = <0x7c003000 0x1000>;
++		interrupts = <GIC_SPI 64 IRQ_TYPE_LEVEL_HIGH>,
++					<GIC_SPI 65 IRQ_TYPE_LEVEL_HIGH>,
++						<GIC_SPI 66 IRQ_TYPE_LEVEL_HIGH>,
++						<GIC_SPI 67 IRQ_TYPE_LEVEL_HIGH>;
++		clock-frequency = <1000000>;
++	};
++
++	axiperf: axiperf@7c012800 {
++		compatible = "brcm,bcm2712-axiperf";
++		reg = <0x7c012800 0x100>,
++			<0x7e000000 0x100>;
++		firmware = <&firmware>;
++		status = "disabled";
++	};
++
++	pixelvalve0: pixelvalve@7c410000 {
++		compatible = "brcm,bcm2712-pixelvalve0";
++		reg = <0x7c410000 0x100>;
++		interrupts = <GIC_SPI 101 IRQ_TYPE_LEVEL_HIGH>;
++		status = "disabled";
++	};
++
++	pixelvalve1: pixelvalve@7c411000 {
++		compatible = "brcm,bcm2712-pixelvalve1";
++		reg = <0x7c411000 0x100>;
++		interrupts = <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH>;
++		status = "disabled";
++	};
++
++	mop: mop@7c500000 {
++		compatible = "brcm,bcm2712-mop";
++		reg = <0x7c500000 0x28>;
++		interrupt-parent = <&disp_intr>;
++		interrupts = <1>;
++		status = "disabled";
++	};
++
++	moplet: moplet@7c501000 {
++		compatible = "brcm,bcm2712-moplet";
++		reg = <0x7c501000 0x20>;
++		interrupt-parent = <&disp_intr>;
++		interrupts = <0>;
++		status = "disabled";
++	};
++
++	disp_intr: interrupt-controller@7c502000 {
++		compatible = "brcm,bcm2711-l2-intc", "brcm,l2-intc";
++		reg = <0x7c502000 0x30>;
++		interrupts = <GIC_SPI 97 IRQ_TYPE_LEVEL_HIGH>;
++		interrupt-controller;
++		#interrupt-cells = <1>;
++		status = "disabled";
++	};
++
++	dvp: clock@7c700000 {
++		compatible = "brcm,brcm2711-dvp";
++		reg = <0x7c700000 0x10>;
++		clocks = <&clk_108MHz>;
++		#clock-cells = <1>;
++		#reset-cells = <1>;
++	};
++
++	spi10: spi@7d004000 {
++		compatible = "brcm,bcm2835-spi";
++		reg = <0x7d004000 0x200>;
++		interrupts = <GIC_SPI 118 IRQ_TYPE_LEVEL_HIGH>;
++		clocks = <&clk_vpu>;
++		num-cs = <1>;
++		#address-cells = <1>;
++		#size-cells = <0>;
++		status = "disabled";
++	};
++
++	i2c10: i2c@7d005600 {
++		compatible = "brcm,bcm2711-i2c", "brcm,bcm2835-i2c";
++		reg = <0x7d005600 0x20>;
++		interrupts = <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>;
++		clocks = <&clk_vpu>;
++		#address-cells = <1>;
++		#size-cells = <0>;
++		status = "disabled";
++	};
++
++	pm: watchdog@7d200000 {
++		compatible = "brcm,bcm2712-pm";
++		reg = <0x7d200000 0x308>;
++		reg-names = "pm";
++		#power-domain-cells = <1>;
++		#reset-cells = <1>;
++		system-power-controller;
++	};
++
++	random: rng@7d208000 {
++		compatible = "brcm,bcm2711-rng200";
++		reg = <0x7d208000 0x28>;
++		status = "okay";
++	};
++
++	cpu_l2_irq: intc@7d503000 {
++		compatible = "brcm,l2-intc";
++		reg = <0x7d503000 0x18>;
++		interrupts = <GIC_SPI 238 IRQ_TYPE_LEVEL_HIGH>;
++		interrupt-controller;
++		#interrupt-cells = <1>;
++	};
++
++	pinctrl: pinctrl@7d504100 {
++		compatible = "brcm,bcm2712-pinctrl";
++		reg = <0x7d504100 0x30>;
++
++		uarta_24_pins: uarta_24_pins {
++			pin_rts {
++				function = "uart0";
++				pins = "gpio24";
++				bias-disable;
++			};
++			pin_cts {
++				function = "uart0";
++				pins = "gpio25";
++				bias-pull-up;
++			};
++			pin_txd {
++				function = "uart0";
++				pins = "gpio26";
++				bias-disable;
++			};
++			pin_rxd {
++				function = "uart0";
++				pins = "gpio27";
++				bias-pull-up;
++			};
++		};
++
++		sdio2_30_pins: sdio2_30_pins {
++			pin_clk {
++				function = "sd2";
++				pins = "gpio30";
++				bias-disable;
++			};
++			pin_cmd {
++				function = "sd2";
++				pins = "gpio31";
++				bias-pull-up;
++			};
++			pins_dat {
++				function = "sd2";
++				pins = "gpio32", "gpio33", "gpio34", "gpio35";
++				bias-pull-up;
++			};
++		};
++	};
++
++	ddc0: i2c@7d508200 {
++		compatible = "brcm,brcmstb-i2c";
++		reg = <0x7d508200 0x58>;
++		interrupt-parent = <&bsc_irq>;
++		interrupts = <1>;
++		clock-frequency = <97500>;
++		#address-cells = <1>;
++		#size-cells = <0>;
++		status = "disabled";
++	};
++
++	ddc1: i2c@7d508280 {
++		compatible = "brcm,brcmstb-i2c";
++		reg = <0x7d508280 0x58>;
++		interrupt-parent = <&bsc_irq>;
++		interrupts = <2>;
++		clock-frequency = <97500>;
++		#address-cells = <1>;
++		#size-cells = <0>;
++		status = "disabled";
++	};
++
++	bsc_irq: intc@7d508380 {
++		compatible = "brcm,bcm7271-l2-intc";
++		reg = <0x7d508380 0x10>;
++		interrupts = <GIC_SPI 242 IRQ_TYPE_LEVEL_HIGH>;
++		interrupt-controller;
++		#interrupt-cells = <1>;
++	};
++
++	main_irq: intc@7d508400 {
++		compatible = "brcm,bcm7271-l2-intc";
++		reg = <0x7d508400 0x10>;
++		interrupts = <GIC_SPI 244 IRQ_TYPE_LEVEL_HIGH>;
++		interrupt-controller;
++		#interrupt-cells = <1>;
++	};
++
++	gio: gpio@7d508500 {
++		compatible = "brcm,brcmstb-gpio";
++		reg = <0x7d508500 0x40>;
++		interrupt-parent = <&main_irq>;
++		interrupts = <0>;
++		gpio-controller;
++		#gpio-cells = <2>;
++		interrupt-controller;
++		#interrupt-cells = <2>;
++		brcm,gpio-bank-widths = <32 22>;
++		brcm,gpio-direct;
++	};
++
++	uarta: serial@7d50c000 {
++		compatible = "brcm,bcm7271-uart";
++		reg = <0x7d50c000 0x20>;
++		reg-names = "uart";
++		reg-shift = <2>;
++		reg-io-width = <4>;
++		interrupts = <GIC_SPI 276 IRQ_TYPE_LEVEL_HIGH>;
++		skip-init;
++		status = "disabled";
++	};
++
++	aon_intr: interrupt-controller@7d510600 {
++		compatible = "brcm,bcm2711-l2-intc", "brcm,l2-intc";
++		reg = <0x7d510600 0x30>;
++		interrupts = <GIC_SPI 239 IRQ_TYPE_LEVEL_HIGH>;
++		interrupt-controller;
++		#interrupt-cells = <1>;
++		status = "disabled";
++	};
++
++	pinctrl_aon: pinctrl@7d510700 {
++		compatible = "brcm,bcm2712-aon-pinctrl";
++		reg = <0x7d510700 0x20>;
++
++		i2c3_m4_agpio0_pins: i2c3_m4_agpio0_pins {
++			function = "vc_i2c3";
++			pins = "aon_gpio0", "aon_gpio1";
++			bias-pull-up;
++		};
++
++		bsc_m1_agpio13_pins: bsc_m1_agpio13_pins {
++			function = "bsc_m1";
++			pins = "aon_gpio13", "aon_gpio14";
++			bias-pull-up;
++		};
++
++		bsc_pmu_sgpio4_pins: bsc_pmu_sgpio4_pins {
++			function = "avs_pmu_bsc";
++			pins = "aon_sgpio4", "aon_sgpio5";
++		};
++
++		bsc_m2_sgpio4_pins: bsc_m2_sgpio4_pins {
++			function = "bsc_m2";
++			pins = "aon_sgpio4", "aon_sgpio5";
++		};
++
++		pwm_aon_agpio1_pins: pwm_aon_agpio1_pins {
++			function = "aon_pwm";
++			pins = "aon_gpio1", "aon_gpio2";
++		};
++
++		pwm_aon_agpio4_pins: pwm_aon_agpio4_pins {
++			function = "vc_pwm0";
++			pins = "aon_gpio4", "aon_gpio5";
++		};
++
++		pwm_aon_agpio7_pins: pwm_aon_agpio7_pins {
++			function = "aon_pwm";
++			pins = "aon_gpio7", "aon_gpio9";
++		};
++	};
++
++	interrupt-controller@7d517000 {
++		status = "disabled";
++	};
++
++	main_aon_irq: intc@7d517ac0 {
++		compatible = "brcm,bcm7271-l2-intc";
++		reg = <0x7d517ac0 0x10>;
++		interrupts = <GIC_SPI 245 IRQ_TYPE_LEVEL_HIGH>;
++		interrupt-controller;
++		#interrupt-cells = <1>;
++	};
++
++	avs_monitor: avs-monitor@7d542000 {
++		compatible = "brcm,bcm2711-avs-monitor",
++					"syscon", "simple-mfd";
++		reg = <0x7d542000 0xf00>;
++		status = "okay";
++
++		thermal: thermal {
++			compatible = "brcm,bcm2711-thermal";
++			#thermal-sensor-cells = <0>;
++		};
++	};
++
++	hdmi0: hdmi@7ef00700 {
++		compatible = "brcm,bcm2712-hdmi0";
++		reg = <0x7c701400 0x300>,
++				<0x7c701000 0x200>,
++				<0x7c701d00 0x300>,
++				<0x7c702000 0x80>,
++				<0x7c703800 0x200>,
++				<0x7c704000 0x800>,
++				<0x7c700100 0x80>,
++				<0x7d510800 0x100>,
++				<0x7c720000 0x100>;
++		reg-names = "hdmi",
++				"dvp",
++				"phy",
++				"rm",
++				"packet",
++				"metadata",
++				"csc",
++				"cec",
++				"hd";
++		resets = <&dvp 1>;
++		interrupt-parent = <&aon_intr>;
++		interrupts = <1>, <2>, <3>,
++					<7>, <8>;
++		interrupt-names = "cec-tx", "cec-rx", "cec-low",
++					"hpd-connected", "hpd-removed";
++		ddc = <&ddc0>;
++		dmas = <&dma32 10>;
++		dma-names = "audio-rx";
++		status = "disabled";
++	};
++
++	hdmi1: hdmi@7ef05700 {
++		compatible = "brcm,bcm2712-hdmi1";
++		reg = <0x7c706400 0x300>,
++				<0x7c706000 0x200>,
++				<0x7c706d00 0x300>,
++				<0x7c707000 0x80>,
++				<0x7c708800 0x200>,
++				<0x7c709000 0x800>,
++				<0x7c700180 0x80>,
++				<0x7d511000 0x100>,
++				<0x7c720000 0x100>;
++		reg-names = "hdmi",
++				"dvp",
++				"phy",
++				"rm",
++				"packet",
++				"metadata",
++				"csc",
++				"cec",
++				"hd";
++		ddc = <&ddc1>;
++		resets = <&dvp 2>;
++		interrupt-parent = <&aon_intr>;
++		interrupts = <11>, <12>, <13>,
++					<14>, <15>;
++		interrupt-names = "cec-tx", "cec-rx", "cec-low",
++					"hpd-connected", "hpd-removed";
++		dmas = <&dma32 17>;
++		dma-names = "audio-rx";
++		status = "disabled";
++	};
++};
++
++/ {
++	axi: axi {
++		compatible = "simple-bus";
++		#address-cells = <2>;
++		#size-cells = <2>;
++
++		ranges = <0x00 0x00000000  0x00 0x00000000  0x10 0x00000000>,
++			 <0x10 0x00000000  0x10 0x00000000  0x01 0x00000000>,
++			 <0x14 0x00000000  0x14 0x00000000  0x04 0x00000000>,
++			 <0x18 0x00000000  0x18 0x00000000  0x04 0x00000000>,
++			 <0x1c 0x00000000  0x1c 0x00000000  0x04 0x00000000>;
++
++		dma-ranges = <0x00 0x00000000  0x00 0x00000000  0x10 0x00000000>,
++			     <0x10 0x00000000  0x10 0x00000000  0x01 0x00000000>,
++			     <0x14 0x00000000  0x14 0x00000000  0x04 0x00000000>,
++			     <0x18 0x00000000  0x18 0x00000000  0x04 0x00000000>,
++			     <0x1c 0x00000000  0x1c 0x00000000  0x04 0x00000000>;
++
++		vc4: gpu {
++			compatible = "brcm,bcm2712-vc6";
++		};
++
++		iommu2: iommu@5100 {
++			/* IOMMU2 for PISP-BE, HEVC; and (unused) H264 accelerators */
++			compatible = "brcm,bcm2712-iommu";
++			reg = <0x10 0x5100  0x0 0x80>;
++			cache = <&iommuc>;
++			#iommu-cells = <0>;
++		};
++
++		iommu4: iommu@5200 {
++			/* IOMMU4 for HVS, MPL/TXP; and (unused) Unicam, PISP-FE, MiniBVN */
++			compatible = "brcm,bcm2712-iommu";
++			reg = <0x10 0x5200  0x0 0x80>;
++			cache = <&iommuc>;
++			#iommu-cells = <0>;
++			#interconnect-cells = <0>;
++		};
++
++		iommu5: iommu@5280 {
++			/* IOMMU5 for PCIe2 (RP1); and (unused) BSTM */
++			compatible = "brcm,bcm2712-iommu";
++			reg = <0x10 0x5280  0x0 0x80>;
++			cache = <&iommuc>;
++			#iommu-cells = <0>;
++			dma-iova-offset = <0x10 0x00000000>; // HACK for RP1 masters over PCIe
++		};
++
++		iommuc: iommuc@5b00 {
++			compatible = "brcm,bcm2712-iommuc";
++			reg = <0x10 0x5b00  0x0 0x80>;
++		};
++
++		dma32: dma@10000 {
++			compatible = "brcm,bcm2712-dma";
++			reg = <0x10 0x00010000 0 0x600>;
++			interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 81 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 82 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 83 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 84 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
++			interrupt-names = "dma0",
++					  "dma1",
++					  "dma2",
++					  "dma3",
++					  "dma4",
++					  "dma5";
++			#dma-cells = <1>;
++			brcm,dma-channel-mask = <0x0035>;
++		};
++
++		dma40: dma@10600 {
++			compatible = "brcm,bcm2712-dma";
++			reg = <0x10 0x00010600 0 0x600>;
++			interrupts =
++				<GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>, /* dma4 6 */
++				<GIC_SPI 87 IRQ_TYPE_LEVEL_HIGH>, /* dma4 7 */
++				<GIC_SPI 88 IRQ_TYPE_LEVEL_HIGH>, /* dma4 8 */
++				<GIC_SPI 89 IRQ_TYPE_LEVEL_HIGH>, /* dma4 9 */
++				<GIC_SPI 90 IRQ_TYPE_LEVEL_HIGH>, /* dma4 10 */
++				<GIC_SPI 91 IRQ_TYPE_LEVEL_HIGH>; /* dma4 11 */
++			interrupt-names = "dma6",
++					  "dma7",
++					  "dma8",
++					  "dma9",
++					  "dma10",
++					  "dma11";
++			#dma-cells = <1>;
++			brcm,dma-channel-mask = <0x0fc0>;
++		};
++
++		// Single-lane Gen3 PCIe
++		// Outbound window at 0x14_000000-0x17_ffffff
++		pcie0: pcie@100000 {
++			compatible = "brcm,bcm2712-pcie";
++			reg = <0x10 0x00100000  0x0 0x9310>;
++			device_type = "pci";
++			max-link-speed = <2>;
++			#address-cells = <3>;
++			#interrupt-cells = <1>;
++			#size-cells = <2>;
++			/*
++			 * Unused interrupts:
++			 * 208: AER
++			 * 215: NMI
++			 * 216: PME
++			 */
++			interrupt-parent = <&gicv2>;
++			interrupts = <GIC_SPI 213 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 214 IRQ_TYPE_LEVEL_HIGH>;
++			interrupt-names = "pcie", "msi";
++			interrupt-map-mask = <0x0 0x0 0x0 0x7>;
++			interrupt-map = <0 0 0 1 &gicv2 GIC_SPI 209
++							IRQ_TYPE_LEVEL_HIGH>,
++					<0 0 0 2 &gicv2 GIC_SPI 210
++							IRQ_TYPE_LEVEL_HIGH>,
++					<0 0 0 3 &gicv2 GIC_SPI 211
++							IRQ_TYPE_LEVEL_HIGH>,
++					<0 0 0 4 &gicv2 GIC_SPI 212
++							IRQ_TYPE_LEVEL_HIGH>;
++			resets = <&bcm_reset 5>, <&bcm_reset 42>, <&pcie_rescal>;
++			reset-names = "swinit", "bridge", "rescal";
++			msi-controller;
++			msi-parent = <&pcie0>;
++
++			ranges = <0x02000000 0x00 0x00000000
++				  0x17 0x00000000
++				  0x0 0xfffffffc>,
++				 <0x43000000 0x04 0x00000000
++				  0x14 0x00000000
++				  0x3 0x00000000>;
++
++			dma-ranges = <0x43000000 0x10 0x00000000
++				      0x00 0x00000000
++				      0x10 0x00000000>;
++
++			status = "disabled";
++		};
++
++		// Single-lane Gen3 PCIe
++		// Outbound window at 0x18_000000-0x1b_ffffff
++		pcie1: pcie@110000 {
++			compatible = "brcm,bcm2712-pcie";
++			reg = <0x10 0x00110000  0x0 0x9310>;
++			device_type = "pci";
++			max-link-speed = <2>;
++			#address-cells = <3>;
++			#interrupt-cells = <1>;
++			#size-cells = <2>;
++			/*
++			 * Unused interrupts:
++			 * 218: AER
++			 * 225: NMI
++			 * 226: PME
++			 */
++			interrupt-parent = <&gicv2>;
++			interrupts = <GIC_SPI 223 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 224 IRQ_TYPE_LEVEL_HIGH>;
++			interrupt-names = "pcie", "msi";
++			interrupt-map-mask = <0x0 0x0 0x0 0x7>;
++			interrupt-map = <0 0 0 1 &gicv2 GIC_SPI 219
++							IRQ_TYPE_LEVEL_HIGH>,
++					<0 0 0 2 &gicv2 GIC_SPI 220
++							IRQ_TYPE_LEVEL_HIGH>,
++					<0 0 0 3 &gicv2 GIC_SPI 221
++							IRQ_TYPE_LEVEL_HIGH>,
++					<0 0 0 4 &gicv2 GIC_SPI 222
++							IRQ_TYPE_LEVEL_HIGH>;
++			resets = <&bcm_reset 7>, <&bcm_reset 43>, <&pcie_rescal>;
++			reset-names = "swinit", "bridge", "rescal";
++			msi-controller;
++			msi-parent = <&mip1>;
++
++			// 2GB, 32-bit, non-prefetchable at PCIe 00_80000000
++			ranges = <0x02000000 0x00 0x80000000
++				  0x1b 0x80000000
++				  0x00 0x80000000>,
++			// 14GB, 64-bit, prefetchable at PCIe 04_00000000
++				 <0x43000000 0x04 0x00000000
++				  0x18 0x00000000
++				  0x03 0x80000000>;
++
++			dma-ranges = <0x03000000 0x10 0x00000000
++				      0x00 0x00000000
++				      0x10 0x00000000>;
++
++			status = "disabled";
++		};
++
++		pcie_rescal: reset-controller@119500 {
++			compatible = "brcm,bcm7216-pcie-sata-rescal";
++			reg = <0x10 0x00119500  0x0 0x10>;
++			#reset-cells = <0>;
++		};
++
++		// Quad-lane Gen3 PCIe
++		// Outbound window at 0x1c_000000-0x1f_ffffff
++		pcie2: pcie@120000 {
++			compatible = "brcm,bcm2712-pcie";
++			reg = <0x10 0x00120000  0x0 0x9310>;
++			device_type = "pci";
++			max-link-speed = <2>;
++			#address-cells = <3>;
++			#interrupt-cells = <1>;
++			#size-cells = <2>;
++			/*
++			 * Unused interrupts:
++			 * 228: AER
++			 * 235: NMI
++			 * 236: PME
++			 */
++			interrupt-parent = <&gicv2>;
++			interrupts = <GIC_SPI 233 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 234 IRQ_TYPE_LEVEL_HIGH>;
++			interrupt-names = "pcie", "msi";
++			interrupt-map-mask = <0x0 0x0 0x0 0x7>;
++			interrupt-map = <0 0 0 1 &gicv2 GIC_SPI 229
++							IRQ_TYPE_LEVEL_HIGH>,
++					<0 0 0 2 &gicv2 GIC_SPI 230
++							IRQ_TYPE_LEVEL_HIGH>,
++					<0 0 0 3 &gicv2 GIC_SPI 231
++							IRQ_TYPE_LEVEL_HIGH>,
++					<0 0 0 4 &gicv2 GIC_SPI 232
++							IRQ_TYPE_LEVEL_HIGH>;
++			resets = <&bcm_reset 32>, <&bcm_reset 44>, <&pcie_rescal>;
++			reset-names = "swinit", "bridge", "rescal";
++			msi-controller;
++			msi-parent = <&mip0>;
++
++			// ~4GB, 32-bit, not-prefetchable at PCIe 00_00000000
++			ranges = <0x02000000 0x00 0x00000000
++				  0x1f 0x00000000
++				  0x0 0xfffffffc>,
++			// 12GB, 64-bit, prefetchable at PCIe 04_00000000
++				 <0x43000000 0x04 0x00000000
++				  0x1c 0x00000000
++				  0x03 0x00000000>;
++
++			// 64GB system RAM space at PCIe 10_00000000
++			dma-ranges = <0x02000000 0x00 0x00000000
++				      0x1f 0x00000000
++				      0x00 0x00400000>,
++				     <0x43000000 0x10 0x00000000
++				      0x00 0x00000000
++				      0x10 0x00000000>;
++
++			status = "disabled";
++		};
++
++		mip0: msi-controller@130000 {
++			compatible = "brcm,bcm2712-mip-intc";
++			reg = <0x10 0x00130000  0x0 0xc0>;
++			msi-controller;
++			interrupt-controller;
++			#interrupt-cells = <2>;
++			brcm,msi-base-spi = <128>;
++			brcm,msi-num-spis = <64>;
++			brcm,msi-offset = <0>;
++			brcm,msi-pci-addr = <0xff 0xfffff000>;
++		};
++
++		mip1: msi-controller@131000 {
++			compatible = "brcm,bcm2712-mip-intc";
++			reg = <0x10 0x00131000  0x0 0xc0>;
++			msi-controller;
++			interrupt-controller;
++			#interrupt-cells = <2>;
++			brcm,msi-base-spi = <247>;
++			/* Actually 20 total, but the others are
++			 * both sparse and non-consecutive */
++			brcm,msi-num-spis = <8>;
++			brcm,msi-offset = <8>;
++			brcm,msi-pci-addr = <0xff 0xffffe000>;
++		};
++
++		syscon_piarbctl: syscon@400018 {
++			compatible = "brcm,syscon-piarbctl", "syscon", "simple-mfd";
++			reg = <0x10 0x00400018  0x0 0x18>;
++		};
++
++		usb: usb@480000 {
++			compatible = "brcm,bcm2835-usb";
++			reg = <0x10 0x00480000  0x0 0x10000>;
++			interrupts = <GIC_SPI 73 IRQ_TYPE_LEVEL_HIGH>;
++			#address-cells = <1>;
++			#size-cells = <0>;
++			clocks = <&clk_usb>;
++			clock-names = "otg";
++			phys = <&usbphy>;
++			phy-names = "usb2-phy";
++			status = "disabled";
++		};
++
++		rpivid: codec@800000 {
++			compatible = "raspberrypi,rpivid-vid-decoder";
++			reg = <0x10 0x00800000  0x0 0x10000>, /* HEVC */
++			      <0x10 0x00840000  0x0 0x1000>;  /* INTC */
++			reg-names = "hevc",
++				    "intc";
++
++			interrupts = <GIC_SPI 98 IRQ_TYPE_LEVEL_HIGH>;
++
++			clocks = <&firmware_clocks 11>;
++			clock-names = "hevc";
++			iommus = <&iommu2>;
++			status = "disabled";
++		};
++
++		pisp_be: pisp_be@880000  {
++			compatible = "raspberrypi,pispbe";
++			reg = <0x10 0x00880000  0x0 0x4000>;
++			interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&firmware_clocks 7>;
++			clocks-names = "isp_be";
++			status = "okay";
++			iommus = <&iommu2>;
++		};
++
++		sdio2: mmc@1100000 {
++			compatible = "brcm,bcm2712-sdhci";
++			reg = <0x10 0x01100000  0x0 0x260>,
++			      <0x10 0x01100400  0x0 0x200>;
++			reg-names = "host", "cfg";
++			interrupts = <GIC_SPI 274 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&clk_emmc2>;
++			sdhci-caps-mask = <0x0000C000 0x0>;
++			sdhci-caps = <0x0 0x0>;
++			supports-cqe;
++			mmc-ddr-3_3v;
++			status = "disabled";
++		};
++
++		bcm_reset: reset-controller@1504318 {
++			compatible = "brcm,brcmstb-reset";
++			reg = <0x10 0x01504318  0x0 0x30>;
++			#reset-cells = <1>;
++		};
++
++		v3d: v3d@2000000 {
++			compatible = "brcm,2712-v3d";
++			reg = <0x10 0x02000000  0x0 0x4000>,
++			      <0x10 0x02008000  0x0 0x6000>;
++			reg-names = "hub", "core0";
++
++			power-domains = <&pm BCM2835_POWER_DOMAIN_GRAFX_V3D>;
++			resets = <&pm BCM2835_RESET_V3D>;
++			clocks = <&firmware_clocks 5>;
++			clocks-names = "v3d";
++			interrupts = <GIC_SPI 250 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 249 IRQ_TYPE_LEVEL_HIGH>;
++			status = "disabled";
++		};
++
++		hvs: hvs@7c580000 {
++			compatible = "brcm,bcm2712-hvs";
++			reg = <0x10 0x7c580000  0x0 0x1a000>;
++			interrupt-parent = <&disp_intr>;
++			interrupts = <2>, <9>, <16>;
++			interrupt-names = "ch0-eof", "ch1-eof", "ch2-eof";
++			status = "disabled";
++		};
++	};
++};
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b.dts b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b.dts
+index 2bdbb6780242..30a59c577aef 100644
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b.dts
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b.dts
+@@ -1,28 +1,44 @@
+-// SPDX-License-Identifier: (GPL-2.0 OR MIT)
++// SPDX-License-Identifier: GPL-2.0
+ /dts-v1/;
+ 
+ #include <dt-bindings/gpio/gpio.h>
+-#include "bcm2712.dtsi"
++#include <dt-bindings/clock/rp1.h>
++#include <dt-bindings/interrupt-controller/irq.h>
++#include <dt-bindings/mfd/rp1.h>
++#include <dt-bindings/pwm/pwm.h>
++#include <dt-bindings/reset/raspberrypi,firmware-reset.h>
++
++#include "bcm2712-ds.dtsi"
+ 
+ / {
+ 	compatible = "raspberrypi,5-model-b", "brcm,bcm2712";
+ 	model = "Raspberry Pi 5";
+ 
+-	aliases {
+-		serial10 = &uart10;
+-	};
+-
+-	chosen: chosen {
+-		stdout-path = "serial10:115200n8";
+-	};
+-
+ 	/* Will be filled by the bootloader */
+ 	memory@0 {
+ 		device_type = "memory";
+-		reg = <0 0 0 0x28000000>;
++		reg = <0 0 0x28000000>;
+ 	};
+ 
+-	sd_io_1v8_reg: sd-io-1v8-reg {
++	leds: leds {
++		compatible = "gpio-leds";
++
++		led_pwr: led-pwr {
++			label = "PWR";
++			gpios = <&rp1_gpio 44 GPIO_ACTIVE_LOW>;
++			default-state = "off";
++			linux,default-trigger = "none";
++		};
++
++		led_act: led-act {
++			label = "ACT";
++			gpios = <&gio_aon 9 GPIO_ACTIVE_LOW>;
++			default-state = "off";
++			linux,default-trigger = "mmc0";
++		};
++	};
++
++	sd_io_1v8_reg: sd_io_1v8_reg {
+ 		compatible = "regulator-gpio";
+ 		regulator-name = "vdd-sd-io";
+ 		regulator-min-microvolt = <1800000>;
+@@ -31,11 +47,12 @@ sd_io_1v8_reg: sd-io-1v8-reg {
+ 		regulator-always-on;
+ 		regulator-settling-time-us = <5000>;
+ 		gpios = <&gio_aon 3 GPIO_ACTIVE_HIGH>;
+-		states = <1800000 1>,
+-			 <3300000 0>;
++		states = <1800000 0x1
++			  3300000 0x0>;
++		status = "okay";
+ 	};
+ 
+-	sd_vcc_reg: sd-vcc-reg {
++	sd_vcc_reg: sd_vcc_reg {
+ 		compatible = "regulator-fixed";
+ 		regulator-name = "vcc-sd";
+ 		regulator-min-microvolt = <3300000>;
+@@ -43,22 +60,649 @@ sd_vcc_reg: sd-vcc-reg {
+ 		regulator-boot-on;
+ 		enable-active-high;
+ 		gpios = <&gio_aon 4 GPIO_ACTIVE_HIGH>;
++		status = "okay";
++	};
++
++	wl_on_reg: wl_on_reg {
++		compatible = "regulator-fixed";
++		regulator-name = "wl-on-regulator";
++		regulator-min-microvolt = <3300000>;
++		regulator-max-microvolt = <3300000>;
++		pinctrl-0 = <&wl_on_pins>;
++		pinctrl-names = "default";
++
++		gpio = <&gio 28 GPIO_ACTIVE_HIGH>;
++
++		startup-delay-us = <150000>;
++		enable-active-high;
++	};
++
++	cam1_clk: cam1_clk {
++		compatible = "fixed-clock";
++		#clock-cells = <0>;
++		status = "disabled";
++	};
++
++	cam0_clk: cam0_clk {
++		compatible = "fixed-clock";
++		#clock-cells = <0>;
++		status = "disabled";
++	};
++
++	cam0_reg: cam0_reg {
++		compatible = "regulator-fixed";
++		regulator-name = "cam0_reg";
++		enable-active-high;
++		status = "okay";
++		gpio = <&rp1_gpio 34 0>;  // CD0_IO0_MICCLK, to MIPI 0 connector
++	};
++
++	cam1_reg: cam1_reg {
++		compatible = "regulator-fixed";
++		regulator-name = "cam1_reg";
++		enable-active-high;
++		status = "okay";
++		gpio = <&rp1_gpio 46 0>;  // CD1_IO0_MICCLK, to MIPI 1 connector
++	};
++
++	cam_dummy_reg: cam_dummy_reg {
++		compatible = "regulator-fixed";
++		regulator-name = "cam-dummy-reg";
++		status = "okay";
++	};
++
++	dummy: dummy {
++		// A target for unwanted overlay fragments
++	};
++
++
++	// A few extra labels to keep overlays happy
++
++	i2c0if: i2c0if {};
++	i2c0mux: i2c0mux {};
++};
++
++rp1_target: &pcie2 {
++	brcm,enable-mps-rcb;
++	brcm,vdm-qos-map = <0xbbaa9888>;
++	aspm-no-l0s;
++	status = "okay";
++};
++
++&pcie1 {
++	brcm,vdm-qos-map = <0x33333333>;
++};
++
++// Add some labels to 2712 device
++
++// The system UART
++&uart10 { status = "okay"; };
++
++// The system SPI for the bootloader EEPROM
++&spi10 { status = "okay"; };
++
++#include "rp1.dtsi"
++
++&rp1 {
++	// PCIe address space layout:
++	// 00_00000000-00_00xxxxxx = RP1 peripherals
++	// 10_00000000-1x_xxxxxxxx = up to 64GB system RAM
++
++	// outbound access aimed at PCIe 0_00xxxxxx -> RP1 c0_40xxxxxx
++	// This is the RP1 peripheral space
++	ranges = <0xc0 0x40000000
++		  0x02000000 0x00 0x00000000
++		  0x00 0x00400000>;
++
++	dma-ranges =
++	// inbound RP1 1x_xxxxxxxx -> PCIe 1x_xxxxxxxx
++		     <0x10 0x00000000
++		      0x43000000 0x10 0x00000000
++		      0x10 0x00000000>,
++
++	// inbound RP1 c0_40xxxxxx -> PCIe 00_00xxxxxx
++	// This allows the RP1 DMA controller to address RP1 hardware
++		     <0xc0 0x40000000
++		      0x02000000 0x0 0x00000000
++		      0x0 0x00400000>,
++
++	// inbound RP1 0x_xxxxxxxx -> PCIe 1x_xxxxxxxx
++		     <0x00 0x00000000
++		      0x02000000 0x10 0x00000000
++		      0x10 0x00000000>;
++};
++
++// Expose RP1 nodes as system nodes with labels
++
++&rp1_dma  {
++	status = "okay";
++};
++
++&rp1_eth {
++	status = "okay";
++	phy-handle = <&phy1>;
++	phy-reset-gpios = <&rp1_gpio 32 GPIO_ACTIVE_LOW>;
++	phy-reset-duration = <5>;
++
++	phy1: ethernet-phy@1 {
++		reg = <0x1>;
++		brcm,powerdown-enable;
+ 	};
+ };
+ 
+-/* The Debug UART, on Rpi5 it's on JST-SH 1.0mm 3-pin connector
+- * labeled "UART", i.e. the interface with the system console.
+- */
+-&uart10 {
++gpio: &rp1_gpio {
++	status = "okay";
++};
++
++aux: &dummy {};
++
++&rp1_usb0 {
++	pinctrl-0 = <&usb_vbus_pins>;
++	pinctrl-names = "default";
++	status = "okay";
++};
++
++&rp1_usb1 {
+ 	status = "okay";
+ };
+ 
++#include "bcm2712-rpi.dtsi"
++
++i2c_csi_dsi0: &i2c6 { // Note: This is for MIPI0 connector only
++	pinctrl-0 = <&rp1_i2c6_38_39>;
++	pinctrl-names = "default";
++	clock-frequency = <100000>;
++	symlink = "i2c-6";
++};
++
++i2c_csi_dsi1: &i2c4 { // Note: This is for MIPI1 connector only
++	pinctrl-0 = <&rp1_i2c4_40_41>;
++	pinctrl-names = "default";
++	clock-frequency = <100000>;
++	symlink = "i2c-4";
++};
++
++i2c_csi_dsi: &i2c_csi_dsi1 { }; // An alias for compatibility
++
++csi0: &rp1_csi0 { };
++csi1: &rp1_csi1 { };
++dsi0: &rp1_dsi0 { };
++dsi1: &rp1_dsi1 { };
++dpi: &rp1_dpi { };
++vec: &rp1_vec { };
++dpi_gpio0:              &rp1_dpi_24bit_gpio0        { };
++dpi_gpio1:              &rp1_dpi_24bit_gpio2        { };
++dpi_18bit_cpadhi_gpio0: &rp1_dpi_18bit_cpadhi_gpio0 { };
++dpi_18bit_cpadhi_gpio2: &rp1_dpi_18bit_cpadhi_gpio2 { };
++dpi_18bit_gpio0:        &rp1_dpi_18bit_gpio0        { };
++dpi_18bit_gpio2:        &rp1_dpi_18bit_gpio2        { };
++dpi_16bit_cpadhi_gpio0: &rp1_dpi_16bit_cpadhi_gpio0 { };
++dpi_16bit_cpadhi_gpio2: &rp1_dpi_16bit_cpadhi_gpio2 { };
++dpi_16bit_gpio0:        &rp1_dpi_16bit_gpio0        { };
++dpi_16bit_gpio2:        &rp1_dpi_16bit_gpio2        { };
++
++/* Add the IOMMUs for some RP1 bus masters */
++
++&csi0 {
++	iommus = <&iommu5>;
++};
++
++&csi1 {
++	iommus = <&iommu5>;
++};
++
++&dsi0 {
++	iommus = <&iommu5>;
++};
++
++&dsi1 {
++	iommus = <&iommu5>;
++};
++
++&dpi {
++	iommus = <&iommu5>;
++};
++
++&vec {
++	iommus = <&iommu5>;
++};
++
++&ddc0 {
++	status = "disabled";
++};
++
++&ddc1 {
++	status = "disabled";
++};
++
++&hdmi0 {
++	clocks = <&firmware_clocks 13>, <&firmware_clocks 14>, <&dvp 0>, <&clk_27MHz>;
++	clock-names = "hdmi", "bvb", "audio", "cec";
++	status = "disabled";
++};
++
++&hdmi1 {
++	clocks = <&firmware_clocks 13>, <&firmware_clocks 14>, <&dvp 1>, <&clk_27MHz>;
++	clock-names = "hdmi", "bvb", "audio", "cec";
++	status = "disabled";
++};
++
++&hvs {
++	clocks = <&firmware_clocks 4>, <&firmware_clocks 16>;
++	clock-names = "core", "disp";
++};
++
++&mop {
++	status = "disabled";
++};
++
++&moplet {
++	status = "disabled";
++};
++
++&pixelvalve0 {
++	status = "disabled";
++};
++
++&pixelvalve1 {
++	status = "disabled";
++};
++
++&disp_intr {
++	status = "disabled";
++};
++
+ /* SDIO1 is used to drive the SD card */
+ &sdio1 {
++	pinctrl-0 = <&emmc_sd_pulls>, <&emmc_aon_cd_pins>;
++	pinctrl-names = "default";
+ 	vqmmc-supply = <&sd_io_1v8_reg>;
+ 	vmmc-supply = <&sd_vcc_reg>;
+ 	bus-width = <4>;
+ 	sd-uhs-sdr50;
+ 	sd-uhs-ddr50;
+ 	sd-uhs-sdr104;
++	supports-cqe;
++	cd-gpios = <&gio_aon 5 GPIO_ACTIVE_LOW>;
++	//no-1-8-v;
++	status = "okay";
++};
++
++&pinctrl_aon {
++	emmc_aon_cd_pins: emmc_aon_cd_pins {
++		function = "sd_card_g";
++		pins = "aon_gpio5";
++		bias-pull-up;
++	};
++
++	/* Slight hack - only one PWM pin (status LED) is usable */
++	aon_pwm_1pin: aon_pwm_1pin {
++		function = "aon_pwm";
++		pins = "aon_gpio9";
++	};
++};
++
++&pinctrl {
++	pwr_button_pins: pwr_button_pins {
++		function = "gpio";
++		pins = "gpio20";
++		bias-pull-up;
++	};
++
++	wl_on_pins: wl_on_pins {
++		function = "gpio";
++		pins = "gpio28";
++	};
++
++	bt_shutdown_pins: bt_shutdown_pins {
++		function = "gpio";
++		pins = "gpio29";
++	};
++
++	emmc_sd_pulls: emmc_sd_pulls {
++		pins = "emmc_cmd", "emmc_dat0", "emmc_dat1", "emmc_dat2", "emmc_dat3";
++		bias-pull-up;
++	};
++};
++
++/* uarta communicates with the BT module */
++&uarta {
++	uart-has-rtscts;
++	auto-flow-control;
++	status = "okay";
++	clock-frequency = <96000000>;
++	pinctrl-0 = <&uarta_24_pins &bt_shutdown_pins>;
++	pinctrl-names = "default";
++
++	bluetooth: bluetooth {
++		compatible = "brcm,bcm43438-bt";
++		max-speed = <3000000>;
++		shutdown-gpios = <&gio 29 GPIO_ACTIVE_HIGH>;
++		local-bd-address = [ 00 00 00 00 00 00 ];
++	};
++};
++
++&i2c10 {
++	clock-frequency = <400000>;
++	pinctrl-0 = <&i2c3_m4_agpio0_pins>;
++	pinctrl-names = "default";
++};
++
++/ {
++	fan: cooling_fan {
++		status = "disabled";
++		compatible = "pwm-fan";
++		#cooling-cells = <2>;
++		cooling-min-state = <0>;
++		cooling-max-state = <3>;
++		cooling-levels = <0 75 125 175 250>;
++		pwms = <&rp1_pwm1 3 41566 PWM_POLARITY_INVERTED>;
++		rpm-regmap = <&rp1_pwm1>;
++		rpm-offset = <0x3c>;
++	};
++
++	pwr_button {
++		compatible = "gpio-keys";
++
++		pinctrl-names = "default";
++		pinctrl-0 = <&pwr_button_pins>;
++		status = "okay";
++
++		pwr_key: pwr {
++			label = "pwr_button";
++			// linux,code = <205>; // KEY_SUSPEND
++			linux,code = <116>; // KEY_POWER
++			gpios = <&gio 20 GPIO_ACTIVE_LOW>;
++			debounce-interval = <50>; // ms
++		};
++	};
++};
++
++&usb {
++	power-domains = <&power RPI_POWER_DOMAIN_USB>;
++};
++
++/* SDIO2 drives the WLAN interface */
++&sdio2 {
++	pinctrl-0 = <&sdio2_30_pins>;
++	pinctrl-names = "default";
++	bus-width = <4>;
++	vmmc-supply = <&wl_on_reg>;
++	sd-uhs-ddr50;
++	non-removable;
++	status = "okay";
++	#address-cells = <1>;
++	#size-cells = <0>;
++
++	wifi: wifi@1 {
++		reg = <1>;
++		compatible = "brcm,bcm4329-fmac";
++		local-mac-address = [00 00 00 00 00 00];
++	};
++};
++
++&rpivid {
++	status = "okay";
++};
++
++&pinctrl {
++	spi10_gpio2: spi10_gpio2 {
++		function = "vc_spi0";
++		pins = "gpio2", "gpio3", "gpio4";
++		bias-disable;
++	};
++
++	spi10_cs_gpio1: spi10_cs_gpio1 {
++		function = "gpio";
++		pins = "gpio1";
++		bias-pull-up;
++	};
++};
++
++spi10_pins: &spi10_gpio2 {};
++spi10_cs_pins: &spi10_cs_gpio1 {};
++
++&spi10 {
++	pinctrl-names = "default";
++	cs-gpios = <&gio 1 1>;
++	pinctrl-0 = <&spi10_pins &spi10_cs_pins>;
++
++	spidev10: spidev@0 {
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <20000000>;
++		status = "okay";
++	};
++};
++
++// =============================================
++// Board specific stuff here
++
++&gio_aon {
++	// Don't use GIO_AON as an interrupt controller because it will
++	// clash with the firmware monitoring the PMIC interrupt via the VPU.
++
++	/delete-property/ interrupt-controller;
++	/delete-property/ #interrupt-cells;
++};
++
++&main_aon_irq {
++	// Don't use the MAIN_AON_IRQ interrupt controller because it will
++	// clash with the firmware monitoring the PMIC interrupt via the VPU.
++
++	status = "disabled";
++};
++
++&rp1_pwm1 {
++	status = "disabled";
++	pinctrl-0 = <&rp1_pwm1_gpio45>;
++	pinctrl-names = "default";
++};
++
++&thermal_trips {
++	cpu_tepid: cpu-tepid {
++		temperature = <50000>;
++		hysteresis = <5000>;
++		type = "active";
++	};
++
++	cpu_warm: cpu-warm {
++		temperature = <60000>;
++		hysteresis = <5000>;
++		type = "active";
++	};
++
++	cpu_hot: cpu-hot {
++		temperature = <67500>;
++		hysteresis = <5000>;
++		type = "active";
++	};
++
++	cpu_vhot: cpu-vhot {
++		temperature = <75000>;
++		hysteresis = <5000>;
++		type = "active";
++	};
++};
++
++&cooling_maps {
++	tepid {
++		trip = <&cpu_tepid>;
++		cooling-device = <&fan 1 1>;
++	};
++
++	warm {
++		trip = <&cpu_warm>;
++		cooling-device = <&fan 2 2>;
++	};
++
++	hot {
++		trip = <&cpu_hot>;
++		cooling-device = <&fan 3 3>;
++	};
++
++	vhot {
++		trip = <&cpu_vhot>;
++		cooling-device = <&fan 4 4>;
++	};
++
++	melt {
++		trip = <&cpu_crit>;
++		cooling-device = <&fan 4 4>;
++	};
++};
++
++&gio {
++	// The GPIOs above 35 are not used on Pi 5, so shrink the upper bank
++	// to reduce the clutter in gpioinfo/pinctrl
++	brcm,gpio-bank-widths = <32 4>;
++
++	gpio-line-names =
++		"-", // GPIO_000
++		"2712_BOOT_CS_N", // GPIO_001
++		"2712_BOOT_MISO", // GPIO_002
++		"2712_BOOT_MOSI", // GPIO_003
++		"2712_BOOT_SCLK", // GPIO_004
++		"-", // GPIO_005
++		"-", // GPIO_006
++		"-", // GPIO_007
++		"-", // GPIO_008
++		"-", // GPIO_009
++		"-", // GPIO_010
++		"-", // GPIO_011
++		"-", // GPIO_012
++		"-", // GPIO_013
++		"PCIE_SDA", // GPIO_014
++		"PCIE_SCL", // GPIO_015
++		"-", // GPIO_016
++		"-", // GPIO_017
++		"-", // GPIO_018
++		"-", // GPIO_019
++		"PWR_GPIO", // GPIO_020
++		"2712_G21_FS", // GPIO_021
++		"-", // GPIO_022
++		"-", // GPIO_023
++		"BT_RTS", // GPIO_024
++		"BT_CTS", // GPIO_025
++		"BT_TXD", // GPIO_026
++		"BT_RXD", // GPIO_027
++		"WL_ON", // GPIO_028
++		"BT_ON", // GPIO_029
++		"WIFI_SDIO_CLK", // GPIO_030
++		"WIFI_SDIO_CMD", // GPIO_031
++		"WIFI_SDIO_D0", // GPIO_032
++		"WIFI_SDIO_D1", // GPIO_033
++		"WIFI_SDIO_D2", // GPIO_034
++		"WIFI_SDIO_D3"; // GPIO_035
++};
++
++&gio_aon {
++	gpio-line-names =
++		"RP1_SDA", // AON_GPIO_00
++		"RP1_SCL", // AON_GPIO_01
++		"RP1_RUN", // AON_GPIO_02
++		"SD_IOVDD_SEL", // AON_GPIO_03
++		"SD_PWR_ON", // AON_GPIO_04
++		"SD_CDET_N", // AON_GPIO_05
++		"SD_FLG_N", // AON_GPIO_06
++		"-", // AON_GPIO_07
++		"2712_WAKE", // AON_GPIO_08
++		"2712_STAT_LED", // AON_GPIO_09
++		"-", // AON_GPIO_10
++		"-", // AON_GPIO_11
++		"PMIC_INT", // AON_GPIO_12
++		"UART_TX_FS", // AON_GPIO_13
++		"UART_RX_FS", // AON_GPIO_14
++		"-", // AON_GPIO_15
++		"-", // AON_GPIO_16
++
++		// Pad bank0 out to 32 entries
++		"", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
++
++		"HDMI0_SCL", // AON_SGPIO_00
++		"HDMI0_SDA", // AON_SGPIO_01
++		"HDMI1_SCL", // AON_SGPIO_02
++		"HDMI1_SDA", // AON_SGPIO_03
++		"PMIC_SCL", // AON_SGPIO_04
++		"PMIC_SDA"; // AON_SGPIO_05
++
++	rp1_run_hog {
++		gpio-hog;
++		gpios = <2 GPIO_ACTIVE_HIGH>;
++		output-high;
++		line-name = "RP1 RUN pin";
++	};
++};
++
++&rp1_gpio {
++	gpio-line-names =
++		"ID_SDA", // GPIO0
++		"ID_SCL", // GPIO1
++		"GPIO2", // GPIO2
++		"GPIO3", // GPIO3
++		"GPIO4", // GPIO4
++		"GPIO5", // GPIO5
++		"GPIO6", // GPIO6
++		"GPIO7", // GPIO7
++		"GPIO8", // GPIO8
++		"GPIO9", // GPIO9
++		"GPIO10", // GPIO10
++		"GPIO11", // GPIO11
++		"GPIO12", // GPIO12
++		"GPIO13", // GPIO13
++		"GPIO14", // GPIO14
++		"GPIO15", // GPIO15
++		"GPIO16", // GPIO16
++		"GPIO17", // GPIO17
++		"GPIO18", // GPIO18
++		"GPIO19", // GPIO19
++		"GPIO20", // GPIO20
++		"GPIO21", // GPIO21
++		"GPIO22", // GPIO22
++		"GPIO23", // GPIO23
++		"GPIO24", // GPIO24
++		"GPIO25", // GPIO25
++		"GPIO26", // GPIO26
++		"GPIO27", // GPIO27
++
++		"PCIE_RP1_WAKE", // GPIO28
++		"FAN_TACH", // GPIO29
++		"HOST_SDA", // GPIO30
++		"HOST_SCL", // GPIO31
++		"ETH_RST_N", // GPIO32
++		"-", // GPIO33
++
++		"CD0_IO0_MICCLK", // GPIO34
++		"CD0_IO0_MICDAT0", // GPIO35
++		"RP1_PCIE_CLKREQ_N", // GPIO36
++		"-", // GPIO37
++		"CD0_SDA", // GPIO38
++		"CD0_SCL", // GPIO39
++		"CD1_SDA", // GPIO40
++		"CD1_SCL", // GPIO41
++		"USB_VBUS_EN", // GPIO42
++		"USB_OC_N", // GPIO43
++		"RP1_STAT_LED", // GPIO44
++		"FAN_PWM", // GPIO45
++		"CD1_IO0_MICCLK", // GPIO46
++		"2712_WAKE", // GPIO47
++		"CD1_IO1_MICDAT1", // GPIO48
++		"EN_MAX_USB_CUR", // GPIO49
++		"-", // GPIO50
++		"-", // GPIO51
++		"-", // GPIO52
++		"-"; // GPIO53
++
++	usb_vbus_pins: usb_vbus_pins {
++		function = "vbus1";
++		pins = "gpio42", "gpio43";
++	};
++};
++
++/ {
++	__overrides__ {
++		sd_cqe = <&sdio1>, "supports-cqe?";
++	};
+ };
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-500.dts b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-500.dts
+new file mode 100644
+index 000000000000..1862e55fa1d2
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-500.dts
+@@ -0,0 +1,142 @@
++// SPDX-License-Identifier: GPL-2.0
++#include "bcm2712d0-rpi-5-b.dts"
++
++/ {
++	compatible = "raspberrypi,500", "brcm,bcm2712";
++	model = "Raspberry Pi 500";
++};
++
++&pwr_key {
++	debounce-interval = <400>;
++};
++
++&gio {
++	gpio-line-names =
++		"", // GPIO_000
++		"2712_BOOT_CS_N", // GPIO_001
++		"2712_BOOT_MISO", // GPIO_002
++		"2712_BOOT_MOSI", // GPIO_003
++		"2712_BOOT_SCLK", // GPIO_004
++		"", // GPIO_005
++		"", // GPIO_006
++		"", // GPIO_007
++		"", // GPIO_008
++		"", // GPIO_009
++		"-", // GPIO_010
++		"-", // GPIO_011
++		"-", // GPIO_012
++		"-", // GPIO_013
++		"M2_DET_WAKE", // GPIO_014
++		"M2_PWR_EN", // GPIO_015
++		"", // GPIO_016
++		"", // GPIO_017
++		"KEYB_BOOTSEL", // GPIO_018
++		"-", // GPIO_019
++		"PWR_GPIO", // GPIO_020
++		"KEYB_RUN", // GPIO_021
++		"-", // GPIO_022
++		"USER_LED", // GPIO_023
++		"BT_RTS", // GPIO_024
++		"BT_CTS", // GPIO_025
++		"BT_TXD", // GPIO_026
++		"BT_RXD", // GPIO_027
++		"WL_ON", // GPIO_028
++		"BT_ON", // GPIO_029
++		"WIFI_SDIO_CLK", // GPIO_030
++		"WIFI_SDIO_CMD", // GPIO_031
++		"WIFI_SDIO_D0", // GPIO_032
++		"WIFI_SDIO_D1", // GPIO_033
++		"WIFI_SDIO_D2", // GPIO_034
++		"WIFI_SDIO_D3"; // GPIO_035
++};
++
++&gio_aon {
++	gpio-line-names =
++		"RP1_SDA", // AON_GPIO_00
++		"RP1_SCL", // AON_GPIO_01
++		"RP1_RUN", // AON_GPIO_02
++		"SD_IOVDD_SEL", // AON_GPIO_03
++		"SD_PWR_ON", // AON_GPIO_04
++		"SD_CDET_N", // AON_GPIO_05
++		"SD_FLG_N", // AON_GPIO_06
++		"", // AON_GPIO_07
++		"2712_WAKE", // AON_GPIO_08
++		"2712_STAT_LED", // AON_GPIO_09
++		"", // AON_GPIO_10
++		"", // AON_GPIO_11
++		"PMIC_INT", // AON_GPIO_12
++		"UART_TX_FS", // AON_GPIO_13
++		"UART_RX_FS", // AON_GPIO_14
++		"", // AON_GPIO_15
++		"", // AON_GPIO_16
++
++		// Pad bank0 out to 32 entries
++		"", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
++
++		"HDMI0_SCL", // AON_SGPIO_00
++		"HDMI0_SDA", // AON_SGPIO_01
++		"HDMI1_SCL", // AON_SGPIO_02
++		"HDMI1_SDA", // AON_SGPIO_03
++		"PMIC_SCL", // AON_SGPIO_04
++		"PMIC_SDA"; // AON_SGPIO_05
++};
++
++&rp1_gpio {
++	gpio-line-names =
++		"ID_SDA", // GPIO0
++		"ID_SCL", // GPIO1
++		"GPIO2", // GPIO2
++		"GPIO3", // GPIO3
++		"GPIO4", // GPIO4
++		"GPIO5", // GPIO5
++		"GPIO6", // GPIO6
++		"GPIO7", // GPIO7
++		"GPIO8", // GPIO8
++		"GPIO9", // GPIO9
++		"GPIO10", // GPIO10
++		"GPIO11", // GPIO11
++		"GPIO12", // GPIO12
++		"GPIO13", // GPIO13
++		"GPIO14", // GPIO14
++		"GPIO15", // GPIO15
++		"GPIO16", // GPIO16
++		"GPIO17", // GPIO17
++		"GPIO18", // GPIO18
++		"GPIO19", // GPIO19
++		"GPIO20", // GPIO20
++		"GPIO21", // GPIO21
++		"GPIO22", // GPIO22
++		"GPIO23", // GPIO23
++		"GPIO24", // GPIO24
++		"GPIO25", // GPIO25
++		"GPIO26", // GPIO26
++		"GPIO27", // GPIO27
++
++		"PCIE_RP1_WAKE", // GPIO28
++		"-", // GPIO29
++		"HOST_SDA", // GPIO30
++		"HOST_SCL", // GPIO31
++		"ETH_RST_N", // GPIO32
++		"PCIE_DET_WAKE", // GPIO33
++
++		"-", // GPIO34
++		"-", // GPIO35
++		"RP1_PCIE_CLKREQ_N", // GPIO36
++		"-", // GPIO37
++		"-", // GPIO38
++		"-", // GPIO39
++		"CD1_SDA", // GPIO40
++		"CD1_SCL", // GPIO41
++		"USB_VBUS_EN", // GPIO42
++		"USB_OC_N", // GPIO43
++		"RP1_STAT_LED", // GPIO44
++		"-", // GPIO45
++		"-", // GPIO46
++		"HOST_WAKE", // GPIO47
++		"-", // GPIO48
++		"EN_MAX_USB_CUR", // GPIO49
++		"-", // GPIO50
++		"-", // GPIO51
++		"-", // GPIO52
++		"-"; // GPIO53
++};
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm4io.dtsi b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm4io.dtsi
+new file mode 100644
+index 000000000000..1b4c42a61817
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm4io.dtsi
+@@ -0,0 +1,28 @@
++// SPDX-License-Identifier: GPL-2.0
++
++i2c_csi_dsi0: &i2c0 { // Note: For CAM0 and DISP0 connectors
++};
++
++i2c_csi_dsi1: &i2c6 { // Note: For CAM1, DISP1, on-board RTC, and fan controller
++	pinctrl-0 = <&rp1_i2c6_38_39>;
++	pinctrl-names = "default";
++	clock-frequency = <100000>;
++	symlink = "i2c-6";
++};
++
++i2c_csi_dsi: &i2c_csi_dsi1 { }; // The connector that needs no jumper to enable
++
++&aliases {
++    /delete-property/ i2c11;
++    i2c10 = &i2c_csi_dsi;
++};
++
++// The RP1 USB3 interfaces are not usable on CM4IO
++
++&rp1_usb0 {
++	status = "disabled";
++};
++
++&rp1_usb1 {
++	status = "disabled";
++};
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5-cm4io.dts b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5-cm4io.dts
+new file mode 100644
+index 000000000000..96cd7cf735d5
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5-cm4io.dts
+@@ -0,0 +1,5 @@
++// SPDX-License-Identifier: GPL-2.0
++/dts-v1/;
++
++#include "bcm2712-rpi-cm5.dtsi"
++#include "bcm2712-rpi-cm4io.dtsi"
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5-cm5io.dts b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5-cm5io.dts
+new file mode 100644
+index 000000000000..6b5e147d569d
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5-cm5io.dts
+@@ -0,0 +1,5 @@
++// SPDX-License-Identifier: GPL-2.0
++/dts-v1/;
++
++#include "bcm2712-rpi-cm5.dtsi"
++#include "bcm2712-rpi-cm5io.dtsi"
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi
+new file mode 100644
+index 000000000000..bbcfa216da6f
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi
+@@ -0,0 +1,712 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/clock/rp1.h>
++#include <dt-bindings/interrupt-controller/irq.h>
++#include <dt-bindings/mfd/rp1.h>
++#include <dt-bindings/pwm/pwm.h>
++#include <dt-bindings/reset/raspberrypi,firmware-reset.h>
++
++#include "bcm2712-ds.dtsi"
++
++/ {
++	compatible = "raspberrypi,5-compute-module", "brcm,bcm2712";
++	model = "Raspberry Pi Compute Module 5";
++
++	/* Will be filled by the bootloader */
++	memory@0 {
++		device_type = "memory";
++		reg = <0 0 0x28000000>;
++	};
++
++	leds: leds {
++		compatible = "gpio-leds";
++
++		led_pwr: led-pwr {
++			label = "PWR";
++			gpios = <&rp1_gpio 44 GPIO_ACTIVE_LOW>;
++			default-state = "off";
++			linux,default-trigger = "none";
++		};
++
++		led_act: led-act {
++			label = "ACT";
++			gpios = <&gio_aon 9 GPIO_ACTIVE_LOW>;
++			default-state = "off";
++			linux,default-trigger = "mmc0";
++		};
++	};
++
++	sd_io_1v8_reg: sd_io_1v8_reg {
++		compatible = "regulator-fixed";
++		regulator-name = "vdd-sd-io";
++		regulator-min-microvolt = <1800000>;
++		regulator-max-microvolt = <1800000>;
++		regulator-always-on;
++	};
++
++	sd_vcc_reg: sd_vcc_reg {
++		compatible = "regulator-fixed";
++		regulator-name = "vcc-sd";
++		regulator-min-microvolt = <3300000>;
++		regulator-max-microvolt = <3300000>;
++		regulator-boot-on;
++		enable-active-high;
++		gpios = <&gio_aon 4 GPIO_ACTIVE_HIGH>;
++		status = "okay";
++	};
++
++	wl_on_reg: wl_on_reg {
++		compatible = "regulator-fixed";
++		regulator-name = "wl-on-regulator";
++		regulator-min-microvolt = <3300000>;
++		regulator-max-microvolt = <3300000>;
++		pinctrl-0 = <&wl_on_pins>;
++		pinctrl-names = "default";
++
++		gpio = <&gio 28 GPIO_ACTIVE_HIGH>;
++
++		startup-delay-us = <150000>;
++		enable-active-high;
++	};
++
++	cam1_clk: cam1_clk {
++		compatible = "fixed-clock";
++		#clock-cells = <0>;
++		status = "disabled";
++	};
++
++	cam0_clk: cam0_clk {
++		compatible = "fixed-clock";
++		#clock-cells = <0>;
++		status = "disabled";
++	};
++
++	cam0_reg: cam0_reg {
++		compatible = "regulator-fixed";
++		regulator-name = "cam0_reg";
++		enable-active-high;
++		status = "okay";
++		gpio = <&rp1_gpio 34 0>; // CD0_IO0_MICCLK, to CAM_GPIO on connector
++	};
++
++	cam_dummy_reg: cam_dummy_reg {
++		compatible = "regulator-fixed";
++		regulator-name = "cam-dummy-reg";
++		status = "okay";
++	};
++
++	dummy: dummy {
++		// A target for unwanted overlay fragments
++	};
++
++
++	// A few extra labels to keep overlays happy
++
++	i2c0if: i2c0if {};
++	i2c0mux: i2c0mux {};
++};
++
++rp1_target: &pcie2 {
++	brcm,enable-mps-rcb;
++	brcm,vdm-qos-map = <0xbbaa9888>;
++	aspm-no-l0s;
++	status = "okay";
++};
++
++// Add some labels to 2712 device
++
++// The system UART
++&uart10 { status = "okay"; };
++
++// The system SPI for the bootloader EEPROM
++&spi10 { status = "okay"; };
++
++#include "rp1.dtsi"
++
++&rp1 {
++	// PCIe address space layout:
++	// 00_00000000-00_00xxxxxx = RP1 peripherals
++	// 10_00000000-1x_xxxxxxxx = up to 64GB system RAM
++
++	// outbound access aimed at PCIe 0_00xxxxxx -> RP1 c0_40xxxxxx
++	// This is the RP1 peripheral space
++	ranges = <0xc0 0x40000000
++		  0x02000000 0x00 0x00000000
++		  0x00 0x00400000>;
++
++	dma-ranges =
++	// inbound RP1 1x_xxxxxxxx -> PCIe 1x_xxxxxxxx
++		     <0x10 0x00000000
++		      0x43000000 0x10 0x00000000
++		      0x10 0x00000000>,
++
++	// inbound RP1 c0_40xxxxxx -> PCIe 00_00xxxxxx
++	// This allows the RP1 DMA controller to address RP1 hardware
++		     <0xc0 0x40000000
++		      0x02000000 0x0 0x00000000
++		      0x0 0x00400000>,
++
++	// inbound RP1 0x_xxxxxxxx -> PCIe 1x_xxxxxxxx
++		     <0x00 0x00000000
++		      0x02000000 0x10 0x00000000
++		      0x10 0x00000000>;
++};
++
++// Expose RP1 nodes as system nodes with labels
++
++&rp1_dma  {
++	status = "okay";
++};
++
++&rp1_eth {
++	status = "okay";
++	phy-handle = <&phy1>;
++	phy-reset-gpios = <&rp1_gpio 32 GPIO_ACTIVE_LOW>;
++	phy-reset-duration = <5>;
++
++	phy1: ethernet-phy@1 {
++		reg = <0x1>;
++		brcm,powerdown-enable;
++		interrupt-parent = <&gpio>;
++		interrupts = <37 IRQ_TYPE_LEVEL_LOW>;
++	};
++};
++
++gpio: &rp1_gpio {
++	status = "okay";
++};
++
++aux: &dummy {};
++
++&rp1_usb0 {
++	pinctrl-0 = <&usb_vbus_pins>;
++	pinctrl-names = "default";
++	status = "okay";
++};
++
++&rp1_usb1 {
++	status = "okay";
++};
++
++#include "bcm2712-rpi.dtsi"
++
++cam1_reg: &cam0_reg { // Shares CAM_GPIO with cam0_reg
++};
++
++csi0: &rp1_csi0 { };
++csi1: &rp1_csi1 { };
++dsi0: &rp1_dsi0 { };
++dsi1: &rp1_dsi1 { };
++dpi: &rp1_dpi { };
++vec: &rp1_vec { };
++dpi_gpio0:              &rp1_dpi_24bit_gpio0        { };
++dpi_gpio1:              &rp1_dpi_24bit_gpio2        { };
++dpi_18bit_cpadhi_gpio0: &rp1_dpi_18bit_cpadhi_gpio0 { };
++dpi_18bit_cpadhi_gpio2: &rp1_dpi_18bit_cpadhi_gpio2 { };
++dpi_18bit_gpio0:        &rp1_dpi_18bit_gpio0        { };
++dpi_18bit_gpio2:        &rp1_dpi_18bit_gpio2        { };
++dpi_16bit_cpadhi_gpio0: &rp1_dpi_16bit_cpadhi_gpio0 { };
++dpi_16bit_cpadhi_gpio2: &rp1_dpi_16bit_cpadhi_gpio2 { };
++dpi_16bit_gpio0:        &rp1_dpi_16bit_gpio0        { };
++dpi_16bit_gpio2:        &rp1_dpi_16bit_gpio2        { };
++
++/* Add the IOMMUs for some RP1 bus masters */
++
++&csi0 {
++	iommus = <&iommu5>;
++};
++
++&csi1 {
++	iommus = <&iommu5>;
++};
++
++&dsi0 {
++	iommus = <&iommu5>;
++};
++
++&dsi1 {
++	iommus = <&iommu5>;
++};
++
++&dpi {
++	iommus = <&iommu5>;
++};
++
++&vec {
++	iommus = <&iommu5>;
++};
++
++&ddc0 {
++	status = "disabled";
++};
++
++&ddc1 {
++	status = "disabled";
++};
++
++&hdmi0 {
++	clocks = <&firmware_clocks 13>, <&firmware_clocks 14>, <&dvp 0>, <&clk_27MHz>;
++	clock-names = "hdmi", "bvb", "audio", "cec";
++	status = "disabled";
++};
++
++&hdmi1 {
++	clocks = <&firmware_clocks 13>, <&firmware_clocks 14>, <&dvp 1>, <&clk_27MHz>;
++	clock-names = "hdmi", "bvb", "audio", "cec";
++	status = "disabled";
++};
++
++&hvs {
++	clocks = <&firmware_clocks 4>, <&firmware_clocks 16>;
++	clock-names = "core", "disp";
++};
++
++&mop {
++	status = "disabled";
++};
++
++&moplet {
++	status = "disabled";
++};
++
++&pixelvalve0 {
++	status = "disabled";
++};
++
++&pixelvalve1 {
++	status = "disabled";
++};
++
++&disp_intr {
++	status = "disabled";
++};
++
++/* SDIO1 is used to drive the eMMC/SD card */
++&sdio1 {
++	pinctrl-0 = <&emmc_cmddat_pulls>, <&emmc_ds_pull>;
++	pinctrl-names = "default";
++	vqmmc-supply = <&sd_io_1v8_reg>;
++	vmmc-supply = <&sd_vcc_reg>;
++	bus-width = <8>;
++	sd-uhs-sdr50;
++	sd-uhs-ddr50;
++	sd-uhs-sdr104;
++	mmc-hs200-1_8v;
++	mmc-hs400-1_8v;
++	mmc-hs400-enhanced-strobe;
++	broken-cd;
++	supports-cqe;
++	status = "okay";
++};
++
++&pinctrl_aon {
++	ant_pins: ant_pins {
++		function = "gpio";
++		pins = "aon_gpio5", "aon_gpio6";
++	};
++
++	/* Slight hack - only one PWM pin (status LED) is usable */
++	aon_pwm_1pin: aon_pwm_1pin {
++		function = "aon_pwm";
++		pins = "aon_gpio9";
++	};
++};
++
++&pinctrl {
++	pwr_button_pins: pwr_button_pins {
++		function = "gpio";
++		pins = "gpio20";
++		bias-pull-up;
++	};
++
++	wl_on_pins: wl_on_pins {
++		function = "gpio";
++		pins = "gpio28";
++	};
++
++	bt_shutdown_pins: bt_shutdown_pins {
++		function = "gpio";
++		pins = "gpio29";
++	};
++
++	emmc_ds_pull: emmc_ds_pull {
++		pins = "emmc_ds";
++		bias-pull-down;
++	};
++
++	emmc_cmddat_pulls: emmc_cmddat_pulls {
++		pins = "emmc_cmd", "emmc_dat0", "emmc_dat1", "emmc_dat2", "emmc_dat3",
++		       "emmc_dat4", "emmc_dat5", "emmc_dat6", "emmc_dat7";
++		bias-pull-up;
++	};
++};
++
++/* uarta communicates with the BT module */
++&uarta {
++	uart-has-rtscts;
++	auto-flow-control;
++	status = "okay";
++	clock-frequency = <96000000>;
++	pinctrl-0 = <&uarta_24_pins &bt_shutdown_pins>;
++	pinctrl-names = "default";
++
++	bluetooth: bluetooth {
++		compatible = "brcm,bcm43438-bt";
++		max-speed = <3000000>;
++		shutdown-gpios = <&gio 29 GPIO_ACTIVE_HIGH>;
++		local-bd-address = [ 00 00 00 00 00 00 ];
++	};
++};
++
++&i2c10 {
++	clock-frequency = <400000>;
++	pinctrl-0 = <&i2c3_m4_agpio0_pins>;
++	pinctrl-names = "default";
++};
++
++/ {
++	fan: cooling_fan {
++		status = "disabled";
++		compatible = "pwm-fan";
++		#cooling-cells = <2>;
++		cooling-min-state = <0>;
++		cooling-max-state = <3>;
++		cooling-levels = <0 75 125 175 250>;
++		pwms = <&rp1_pwm1 3 41566 PWM_POLARITY_INVERTED>;
++		rpm-regmap = <&rp1_pwm1>;
++		rpm-offset = <0x3c>;
++	};
++
++	pwr_button {
++		compatible = "gpio-keys";
++
++		pinctrl-names = "default";
++		pinctrl-0 = <&pwr_button_pins>;
++		status = "okay";
++
++		pwr_key: pwr {
++			label = "pwr_button";
++			// linux,code = <205>; // KEY_SUSPEND
++			linux,code = <116>; // KEY_POWER
++			gpios = <&gio 20 GPIO_ACTIVE_LOW>;
++			debounce-interval = <50>; // ms
++		};
++	};
++};
++
++&usb {
++	power-domains = <&power RPI_POWER_DOMAIN_USB>;
++};
++
++/* SDIO2 drives the WLAN interface */
++&sdio2 {
++	pinctrl-0 = <&sdio2_30_pins>, <&ant_pins>;
++	pinctrl-names = "default";
++	bus-width = <4>;
++	vmmc-supply = <&wl_on_reg>;
++	sd-uhs-ddr50;
++	non-removable;
++	status = "okay";
++	#address-cells = <1>;
++	#size-cells = <0>;
++
++	wifi: wifi@1 {
++		reg = <1>;
++		compatible = "brcm,bcm4329-fmac";
++		local-mac-address = [00 00 00 00 00 00];
++	};
++};
++
++&rpivid {
++	status = "okay";
++};
++
++&pinctrl {
++	spi10_gpio2: spi10_gpio2 {
++		function = "vc_spi0";
++		pins = "gpio2", "gpio3", "gpio4";
++		bias-disable;
++	};
++
++	spi10_cs_gpio1: spi10_cs_gpio1 {
++		function = "gpio";
++		pins = "gpio1";
++		bias-pull-up;
++	};
++};
++
++spi10_pins: &spi10_gpio2 {};
++spi10_cs_pins: &spi10_cs_gpio1 {};
++
++&spi10 {
++	pinctrl-names = "default";
++	cs-gpios = <&gio 1 1>;
++	pinctrl-0 = <&spi10_pins &spi10_cs_pins>;
++
++	spidev10: spidev@0 {
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <20000000>;
++		status = "okay";
++	};
++};
++
++// =============================================
++// Board specific stuff here
++
++&gio_aon {
++	// Don't use GIO_AON as an interrupt controller because it will
++	// clash with the firmware monitoring the PMIC interrupt via the VPU.
++
++	/delete-property/ interrupt-controller;
++	/delete-property/ #interrupt-cells;
++};
++
++&main_aon_irq {
++	// Don't use the MAIN_AON_IRQ interrupt controller because it will
++	// clash with the firmware monitoring the PMIC interrupt via the VPU.
++
++	status = "disabled";
++};
++
++&rp1_pwm1 {
++	status = "disabled";
++	pinctrl-0 = <&rp1_pwm1_gpio45>;
++	pinctrl-names = "default";
++};
++
++&thermal_trips {
++	cpu_tepid: cpu-tepid {
++		temperature = <50000>;
++		hysteresis = <5000>;
++		type = "active";
++	};
++
++	cpu_warm: cpu-warm {
++		temperature = <60000>;
++		hysteresis = <5000>;
++		type = "active";
++	};
++
++	cpu_hot: cpu-hot {
++		temperature = <67500>;
++		hysteresis = <5000>;
++		type = "active";
++	};
++
++	cpu_vhot: cpu-vhot {
++		temperature = <75000>;
++		hysteresis = <5000>;
++		type = "active";
++	};
++};
++
++&cooling_maps {
++	tepid {
++		trip = <&cpu_tepid>;
++		cooling-device = <&fan 1 1>;
++	};
++
++	warm {
++		trip = <&cpu_warm>;
++		cooling-device = <&fan 2 2>;
++	};
++
++	hot {
++		trip = <&cpu_hot>;
++		cooling-device = <&fan 3 3>;
++	};
++
++	vhot {
++		trip = <&cpu_vhot>;
++		cooling-device = <&fan 4 4>;
++	};
++
++	melt {
++		trip = <&cpu_crit>;
++		cooling-device = <&fan 4 4>;
++	};
++};
++
++&gio {
++	// The GPIOs above 35 are not used on Pi 5, so shrink the upper bank
++	// to reduce the clutter in gpioinfo/pinctrl
++	brcm,gpio-bank-widths = <32 4>;
++
++	gpio-line-names =
++		"-", // GPIO_000
++		"2712_BOOT_CS_N", // GPIO_001
++		"2712_BOOT_MISO", // GPIO_002
++		"2712_BOOT_MOSI", // GPIO_003
++		"2712_BOOT_SCLK", // GPIO_004
++		"-", // GPIO_005
++		"-", // GPIO_006
++		"-", // GPIO_007
++		"-", // GPIO_008
++		"-", // GPIO_009
++		"-", // GPIO_010
++		"-", // GPIO_011
++		"-", // GPIO_012
++		"-", // GPIO_013
++		"-", // GPIO_014
++		"-", // GPIO_015
++		"-", // GPIO_016
++		"-", // GPIO_017
++		"-", // GPIO_018
++		"-", // GPIO_019
++		"PWR_GPIO", // GPIO_020
++		"2712_G21_FS", // GPIO_021
++		"-", // GPIO_022
++		"-", // GPIO_023
++		"BT_RTS", // GPIO_024
++		"BT_CTS", // GPIO_025
++		"BT_TXD", // GPIO_026
++		"BT_RXD", // GPIO_027
++		"WL_ON", // GPIO_028
++		"BT_ON", // GPIO_029
++		"WIFI_SDIO_CLK", // GPIO_030
++		"WIFI_SDIO_CMD", // GPIO_031
++		"WIFI_SDIO_D0", // GPIO_032
++		"WIFI_SDIO_D1", // GPIO_033
++		"WIFI_SDIO_D2", // GPIO_034
++		"WIFI_SDIO_D3"; // GPIO_035
++};
++
++&gio_aon {
++	gpio-line-names =
++		"RP1_SDA", // AON_GPIO_00
++		"RP1_SCL", // AON_GPIO_01
++		"RP1_RUN", // AON_GPIO_02
++		"SD_IOVDD_SEL", // AON_GPIO_03
++		"SD_PWR_ON", // AON_GPIO_04
++		"ANT1", // AON_GPIO_05
++		"ANT2", // AON_GPIO_06
++		"-", // AON_GPIO_07
++		"2712_WAKE", // AON_GPIO_08
++		"2712_STAT_LED", // AON_GPIO_09
++		"-", // AON_GPIO_10
++		"-", // AON_GPIO_11
++		"PMIC_INT", // AON_GPIO_12
++		"UART_TX_FS", // AON_GPIO_13
++		"UART_RX_FS", // AON_GPIO_14
++		"-", // AON_GPIO_15
++		"-", // AON_GPIO_16
++
++		// Pad bank0 out to 32 entries
++		"", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
++
++		"HDMI0_SCL", // AON_SGPIO_00
++		"HDMI0_SDA", // AON_SGPIO_01
++		"HDMI1_SCL", // AON_SGPIO_02
++		"HDMI1_SDA", // AON_SGPIO_03
++		"PMIC_SCL", // AON_SGPIO_04
++		"PMIC_SDA"; // AON_SGPIO_05
++
++	rp1_run_hog {
++		gpio-hog;
++		gpios = <2 GPIO_ACTIVE_HIGH>;
++		output-high;
++		line-name = "RP1 RUN pin";
++	};
++
++	ant1: ant1-hog {
++		gpio-hog;
++		gpios = <5 GPIO_ACTIVE_HIGH>;
++		/* internal antenna enabled */
++		output-high;
++		line-name = "ant1";
++	};
++
++	ant2: ant2-hog {
++		gpio-hog;
++		gpios = <6 GPIO_ACTIVE_HIGH>;
++		/* external antenna disabled */
++		output-low;
++		line-name = "ant2";
++	};
++};
++
++&rp1_gpio {
++	gpio-line-names =
++		"ID_SDA", // GPIO0
++		"ID_SCL", // GPIO1
++		"GPIO2", // GPIO2
++		"GPIO3", // GPIO3
++		"GPIO4", // GPIO4
++		"GPIO5", // GPIO5
++		"GPIO6", // GPIO6
++		"GPIO7", // GPIO7
++		"GPIO8", // GPIO8
++		"GPIO9", // GPIO9
++		"GPIO10", // GPIO10
++		"GPIO11", // GPIO11
++		"GPIO12", // GPIO12
++		"GPIO13", // GPIO13
++		"GPIO14", // GPIO14
++		"GPIO15", // GPIO15
++		"GPIO16", // GPIO16
++		"GPIO17", // GPIO17
++		"GPIO18", // GPIO18
++		"GPIO19", // GPIO19
++		"GPIO20", // GPIO20
++		"GPIO21", // GPIO21
++		"GPIO22", // GPIO22
++		"GPIO23", // GPIO23
++		"GPIO24", // GPIO24
++		"GPIO25", // GPIO25
++		"GPIO26", // GPIO26
++		"GPIO27", // GPIO27
++
++		"PCIE_PWR_EN", // GPIO28
++		"FAN_TACH", // GPIO29
++		"HOST_SDA", // GPIO30
++		"HOST_SCL", // GPIO31
++		"ETH_RST_N", // GPIO32
++		"PCIE_DET_WAKE", // GPIO33
++
++		"CD0_IO0_MICCLK", // GPIO34
++		"CD0_IO0_MICDAT0", // GPIO35
++		"RP1_PCIE_CLKREQ_N", // GPIO36
++		"ETH_IRQ_N", // GPIO37
++		"SDA0", // GPIO38
++		"SCL0", // GPIO39
++		"-", // GPIO40
++		"-", // GPIO41
++		"USB_VBUS_EN", // GPIO42
++		"USB_OC_N", // GPIO43
++		"RP1_STAT_LED", // GPIO44
++		"FAN_PWM", // GPIO45
++		"-", // GPIO46
++		"2712_WAKE", // GPIO47
++		"-", // GPIO48
++		"-", // GPIO49
++		"-", // GPIO50
++		"-", // GPIO51
++		"-", // GPIO52
++		"-"; // GPIO53
++
++	usb_vbus_pins: usb_vbus_pins {
++		function = "vbus1";
++		pins = "gpio42", "gpio43";
++	};
++};
++
++/ {
++	__overrides__ {
++		ant1 =  <&ant1>,"output-high?=on",
++			<&ant1>, "output-low?=off",
++			<&ant2>, "output-high?=off",
++			<&ant2>, "output-low?=on";
++		ant2 =  <&ant1>,"output-high?=off",
++			<&ant1>, "output-low?=on",
++			<&ant2>, "output-high?=on",
++			<&ant2>, "output-low?=off";
++		noant = <&ant1>,"output-high?=off",
++			<&ant1>, "output-low?=on",
++			<&ant2>, "output-high?=off",
++			<&ant2>, "output-low?=on";
++	};
++};
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5io.dtsi b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5io.dtsi
+new file mode 100644
+index 000000000000..788fda2fcbfb
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5io.dtsi
+@@ -0,0 +1,14 @@
++// SPDX-License-Identifier: GPL-2.0
++
++i2c_csi_dsi1: &i2c0 { // Note: This is for CAM/DISP 1 connector
++	symlink = "i2c-11";
++};
++
++i2c_csi_dsi0: &i2c6 { // Note: This is for CAM/DISP 0 connector
++	pinctrl-0 = <&rp1_i2c6_38_39>;
++	pinctrl-names = "default";
++	clock-frequency = <100000>;
++	symlink = "i2c-6";
++};
++
++i2c_csi_dsi: &i2c_csi_dsi0 { }; // The connector that needs no jumper to enable
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5l-cm4io.dts b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5l-cm4io.dts
+new file mode 100644
+index 000000000000..71259a673d99
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5l-cm4io.dts
+@@ -0,0 +1,5 @@
++// SPDX-License-Identifier: GPL-2.0
++/dts-v1/;
++
++#include "bcm2712-rpi-cm5l.dtsi"
++#include "bcm2712-rpi-cm4io.dtsi"
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5l-cm5io.dts b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5l-cm5io.dts
+new file mode 100644
+index 000000000000..11a56dfb7b48
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5l-cm5io.dts
+@@ -0,0 +1,5 @@
++// SPDX-License-Identifier: GPL-2.0
++/dts-v1/;
++
++#include "bcm2712-rpi-cm5l.dtsi"
++#include "bcm2712-rpi-cm5io.dtsi"
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5l.dtsi b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5l.dtsi
+new file mode 100644
+index 000000000000..98ac6c113e81
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5l.dtsi
+@@ -0,0 +1,22 @@
++// SPDX-License-Identifier: GPL-2.0
++/dts-v1/;
++
++#include "bcm2712-rpi-cm5.dtsi"
++
++/ {
++	model = "Raspberry Pi Compute Module 5 Lite";
++};
++
++&sd_io_1v8_reg {
++	compatible = "regulator-gpio";
++	regulator-max-microvolt = <3300000>;
++	regulator-settling-time-us = <5000>;
++	gpios = <&gio_aon 3 GPIO_ACTIVE_HIGH>;
++	states = <1800000 0x1
++		  3300000 0x0>;
++};
++
++&sdio1 {
++	/delete-property/ mmc-hs400-1_8v;
++	/delete-property/ mmc-hs400-enhanced-strobe;
++};
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2712-rpi.dtsi b/arch/arm64/boot/dts/broadcom/bcm2712-rpi.dtsi
+new file mode 100644
+index 000000000000..dc938798968e
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi.dtsi
+@@ -0,0 +1,466 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include <dt-bindings/power/raspberrypi-power.h>
++
++&soc {
++	firmware: firmware {
++		compatible = "raspberrypi,bcm2835-firmware", "simple-mfd";
++		#address-cells = <1>;
++		#size-cells = <1>;
++
++		mboxes = <&mailbox>;
++		dma-ranges;
++
++		firmware_clocks: clocks {
++			compatible = "raspberrypi,firmware-clocks";
++			#clock-cells = <1>;
++		};
++
++		reset: reset {
++			compatible = "raspberrypi,firmware-reset";
++			#reset-cells = <1>;
++		};
++
++		vcio: vcio {
++			compatible = "raspberrypi,vcio";
++		};
++	};
++
++	power: power {
++		compatible = "raspberrypi,bcm2835-power";
++		firmware = <&firmware>;
++		#power-domain-cells = <1>;
++	};
++
++	fb: fb {
++		compatible = "brcm,bcm2708-fb";
++		firmware = <&firmware>;
++		status = "okay";
++	};
++
++	rpi_rtc: rpi_rtc {
++		compatible = "raspberrypi,rpi-rtc";
++		firmware = <&firmware>;
++		status = "okay";
++		trickle-charge-microvolt = <0>;
++	};
++
++	nvmem {
++		compatible = "simple-bus";
++		#address-cells = <1>;
++		#size-cells = <1>;
++
++		nvmem_otp: nvmem_otp {
++			compatible = "raspberrypi,rpi-otp";
++			firmware = <&firmware>;
++			reg = <0 192>;
++			status = "okay";
++		};
++
++		nvmem_cust: nvmem_cust {
++			compatible = "raspberrypi,rpi-otp";
++			firmware = <&firmware>;
++			reg = <1 8>;
++			status = "okay";
++		};
++
++		nvmem_mac: nvmem_mac {
++			compatible = "raspberrypi,rpi-otp";
++			firmware = <&firmware>;
++			reg = <2 6>;
++			status = "okay";
++		};
++
++		nvmem_priv: nvmem_priv {
++			compatible = "raspberrypi,rpi-otp";
++			firmware = <&firmware>;
++			reg = <3 16>;
++			status = "okay";
++		};
++	};
++
++	/* Define these notional regulators for use by overlays, etc. */
++	vdd_3v3_reg: fixedregulator_3v3 {
++		compatible = "regulator-fixed";
++		regulator-always-on;
++		regulator-max-microvolt = <3300000>;
++		regulator-min-microvolt = <3300000>;
++		regulator-name = "3v3";
++	};
++
++	vdd_5v0_reg: fixedregulator_5v0 {
++		compatible = "regulator-fixed";
++		regulator-always-on;
++		regulator-max-microvolt = <5000000>;
++		regulator-min-microvolt = <5000000>;
++		regulator-name = "5v0";
++	};
++};
++
++/ {
++	chosen: chosen {
++		bootargs = "reboot=w coherent_pool=1M 8250.nr_uarts=1 pci=pcie_bus_safe cgroup_disable=memory numa_policy=interleave";
++		stdout-path = "serial10:115200n8";
++	};
++
++	aliases: aliases {
++		blconfig = &blconfig;
++		blpubkey = &blpubkey;
++		bluetooth = &bluetooth;
++		console = &uart10;
++		drm-dsi1 = &dsi0;
++		drm-dsi2 = &dsi1;
++		ethernet0 = &rp1_eth;
++		fb = &fb;
++		gpio0 = &gpio;
++		gpio1 = &gio;
++		gpio2 = &gio_aon;
++		gpio3 = &pinctrl;
++		gpio4 = &pinctrl_aon;
++		gpiochip0 = &gpio;
++		gpiochip10 = &gio;
++		i2c = &i2c_arm;
++		i2c0 = &i2c0;
++		i2c1 = &i2c1;
++		i2c2 = &i2c2;
++		i2c3 = &i2c3;
++		i2c10 = &i2c_csi_dsi0;
++		i2c11 = &i2c_csi_dsi1;
++		i2c12 = &i2c10;
++		mailbox = &mailbox;
++		mmc0 = &sdio1;
++		serial0 = &uart0;
++		serial1 = &uart1;
++		serial10 = &uart10;
++		serial2 = &uart2;
++		serial3 = &uart3;
++		serial4 = &uart4;
++		spi0 = &spi0;
++		spi1 = &spi1;
++		spi10 = &spi10;
++		spi2 = &spi2;
++		spi3 = &spi3;
++		spi4 = &spi4;
++		spi5 = &spi5;
++		uart0 = &uart0;
++		uart1 = &uart1;
++		uart10 = &uart10;
++		uart2 = &uart2;
++		uart3 = &uart3;
++		uart4 = &uart4;
++		usb0 = &rp1_usb0;
++		usb1 = &rp1_usb1;
++		wifi0 = &wifi;
++	};
++
++	__overrides__ {
++		act_led_gpio = <&led_act>,"gpios:4",<&led_act>,"gpios:0=",<&gpio>;
++		act_led_activelow = <&led_act>, "gpios:8";
++		act_led_trigger = <&led_act>, "linux,default-trigger";
++		axiperf = <&axiperf>,"status";
++		bdaddr = <&bluetooth>, "local-bd-address[";
++		button_debounce = <&pwr_key>, "debounce-interval:0";
++		cooling_fan = <&fan>, "status", <&rp1_pwm1>, "status";
++		drm_fb0_rp1_dpi = <&aliases>, "drm-fb0=",&dpi;
++		drm_fb0_rp1_dsi0 = <&aliases>, "drm-fb0=",&dsi0;
++		drm_fb0_rp1_dsi1 = <&aliases>, "drm-fb0=",&dsi1;
++		drm_fb0_vc4 = <&aliases>, "drm-fb0=",&vc4;
++		drm_fb1_rp1_dpi = <&aliases>, "drm-fb1=",&dpi;
++		drm_fb1_rp1_dsi0 = <&aliases>, "drm-fb1=",&dsi0;
++		drm_fb1_rp1_dsi1 = <&aliases>, "drm-fb1=",&dsi1;
++		drm_fb1_vc4 = <&aliases>, "drm-fb1=",&vc4;
++		drm_fb2_rp1_dpi = <&aliases>, "drm-fb2=",&dpi;
++		drm_fb2_rp1_dsi0 = <&aliases>, "drm-fb2=",&dsi0;
++		drm_fb2_rp1_dsi1 = <&aliases>, "drm-fb2=",&dsi1;
++		drm_fb2_vc4 = <&aliases>, "drm-fb2=",&vc4;
++		eth_led0 = <&phy1>,"led-modes:0";
++		eth_led1 = <&phy1>,"led-modes:4";
++		fan_temp0 = <&cpu_tepid>,"temperature:0";
++		fan_temp0_hyst = <&cpu_tepid>,"hysteresis:0";
++		fan_temp0_speed = <&fan>, "cooling-levels:4";
++		fan_temp1 = <&cpu_warm>,"temperature:0";
++		fan_temp1_hyst = <&cpu_warm>,"hysteresis:0";
++		fan_temp1_speed = <&fan>, "cooling-levels:8";
++		fan_temp2 = <&cpu_hot>,"temperature:0";
++		fan_temp2_hyst = <&cpu_hot>,"hysteresis:0";
++		fan_temp2_speed = <&fan>, "cooling-levels:12";
++		fan_temp3 = <&cpu_vhot>,"temperature:0";
++		fan_temp3_hyst = <&cpu_vhot>,"hysteresis:0";
++		fan_temp3_speed = <&fan>, "cooling-levels:16";
++		i2c = <&i2c1>, "status";
++		i2c_arm = <&i2c_arm>, "status";
++		i2c_arm_baudrate = <&i2c_arm>, "clock-frequency:0";
++		i2c_baudrate = <&i2c_arm>, "clock-frequency:0";
++		i2c_csi_dsi = <&i2c_csi_dsi>, "status";
++		i2c_csi_dsi0 = <&i2c_csi_dsi0>, "status";
++		i2c_csi_dsi1 = <&i2c_csi_dsi1>, "status";
++		i2c_vc = <&i2c_vc>, "status";
++		i2c_vc_baudrate = <&i2c_vc>, "clock-frequency:0";
++		i2c0 = <&i2c0>, "status";
++		i2c0_baudrate = <&i2c0>, "clock-frequency:0";
++		i2c1 = <&i2c1>, "status";
++		i2c1_baudrate = <&i2c1>, "clock-frequency:0";
++		krnbt = <&bluetooth>, "status";
++		nvme = <&pciex1>, "status";
++		nvmem_cust_rw = <&nvmem_cust>,"rw?";
++		nvmem_mac_rw = <&nvmem_mac>,"rw?";
++		nvmem_priv_rw = <&nvmem_priv>,"rw?";
++		pcie_tperst_clk_ms = <&pciex1>, "brcm,tperst-clk-ms:0";
++		pciex1 = <&pciex1>, "status";
++		pciex1_gen = <&pciex1> , "max-link-speed:0";
++		pciex1_no_l0s = <&pciex1>, "aspm-no-l0s?";
++		pciex1_tperst_clk_ms = <&pciex1>, "brcm,tperst-clk-ms:0";
++		pwr_led_gpio = <&led_pwr>, "gpios:4";
++		pwr_led_activelow = <&led_pwr>, "gpios:8";
++		pwr_led_trigger = <&led_pwr>, "linux,default-trigger";
++		random = <&random>, "status";
++		rtc = <&rpi_rtc>, "status";
++		rtc_bbat_vchg = <&rpi_rtc>, "trickle-charge-microvolt:0";
++		spi = <&spi0>, "status";
++		strict_gpiod = <&chosen>, "bootargs=pinctrl_rp1.persist_gpio_outputs=n";
++		suspend = <&pwr_key>, "linux,code:0=205";
++		uart0 = <&uart0>, "status";
++		uart0_console = <&uart0>,"status", <&aliases>, "console=",&uart0;
++		wifiaddr = <&wifi>, "local-mac-address[";
++
++		cam0_reg = <&cam0_reg>,"status";
++		cam0_reg_gpio = <&cam0_reg>,"gpio:4",
++				<&cam0_reg>,"gpio:0=", <&gpio>;
++		cam1_reg = <&cam1_reg>,"status";
++		cam1_reg_gpio = <&cam1_reg>,"gpio:4",
++				<&cam1_reg>,"gpio:0=", <&gpio>;
++	};
++};
++
++pciex1: &pcie1 { };
++pciex4: &pcie2 { };
++
++&dma32 {
++	/* The VPU firmware uses DMA channel 11 for VCHIQ */
++	brcm,dma-channel-mask = <0x03f>;
++};
++
++&dma40 {
++	/* The VPU firmware DMA channel 11 for VCHIQ */
++	brcm,dma-channel-mask = <0x07c0>;
++};
++
++&hdmi0 {
++	dmas = <&dma40 (10|(1<<30)|(1<<24)|(10<<16)|(15<<20))>;
++};
++
++&hdmi1 {
++	dmas = <&dma40 (17|(1<<30)|(1<<24)|(10<<16)|(15<<20))>;
++};
++
++&spi10 {
++	dmas = <&dma40 6>, <&dma40 7>;
++	dma-names = "tx", "rx";
++};
++
++&usb {
++	power-domains = <&power RPI_POWER_DOMAIN_USB>;
++};
++
++&rmem {
++	/*
++	 * RPi5's co-processor will copy the board's bootloader configuration
++	 * into memory for the OS to consume. It'll also update this node with
++	 * its placement information.
++	 */
++	blconfig: nvram@0 {
++		compatible = "raspberrypi,bootloader-config", "nvmem-rmem";
++		#address-cells = <1>;
++		#size-cells = <1>;
++		reg = <0x0 0x0 0x0>;
++		no-map;
++		status = "disabled";
++	};
++	/*
++	 * RPi5 will copy the binary public key blob (if present) from the bootloader
++	 * into memory for use by the OS.
++	 */
++	blpubkey: nvram@1 {
++		compatible = "raspberrypi,bootloader-public-key", "nvmem-rmem";
++		#address-cells = <1>;
++		#size-cells = <1>;
++		reg = <0x0 0x0 0x0>;
++		no-map;
++		status = "disabled";
++	};
++};
++
++&rp1_adc {
++	status = "okay";
++};
++
++/* Add some gpiomem nodes to make the devices accessible to userspace.
++ * /dev/gpiomem<n> should expose the registers for the interface with DT alias
++ * gpio<n>.
++ */
++
++&rp1 {
++	gpiomem@d0000 {
++		/* Export IO_BANKs, RIO_BANKs and PADS_BANKs to userspace */
++		compatible = "raspberrypi,gpiomem";
++		reg = <0xc0 0x400d0000  0x0 0x30000>;
++		chardev-name = "gpiomem0";
++	};
++};
++
++&soc {
++	gpiomem@7d508500 {
++		compatible = "raspberrypi,gpiomem";
++		reg = <0x7d508500 0x40>;
++		chardev-name = "gpiomem1";
++	};
++
++	gpiomem@7d517c00 {
++		compatible = "raspberrypi,gpiomem";
++		reg = <0x7d517c00 0x40>;
++		chardev-name = "gpiomem2";
++	};
++
++	gpiomem@7d504100 {
++		compatible = "raspberrypi,gpiomem";
++		reg = <0x7d504100 0x20>;
++		chardev-name = "gpiomem3";
++	};
++
++	gpiomem@7d510700 {
++		compatible = "raspberrypi,gpiomem";
++		reg = <0x7d510700 0x20>;
++		chardev-name = "gpiomem4";
++	};
++
++	sound: sound {
++		status = "disabled";
++	};
++};
++
++i2c0: &rp1_i2c0 { };
++i2c1: &rp1_i2c1 { };
++i2c2: &rp1_i2c2 { };
++i2c3: &rp1_i2c3 { };
++i2c4: &rp1_i2c4 { };
++i2c5: &rp1_i2c5 { };
++i2c6: &rp1_i2c6 { };
++i2s:  &rp1_i2s0 { };
++i2s_clk_producer: &rp1_i2s0 { };
++i2s_clk_consumer: &rp1_i2s1 { };
++pwm0: &rp1_pwm0 { };
++pwm1: &rp1_pwm1 { };
++pwm: &pwm0 { };
++spi0: &rp1_spi0 { };
++spi1: &rp1_spi1 { };
++spi2: &rp1_spi2 { };
++spi3: &rp1_spi3 { };
++spi4: &rp1_spi4 { };
++spi5: &rp1_spi5 { };
++
++uart0_pins: &rp1_uart0_14_15 {};
++uart0_ctsrts_pins: &rp1_uart0_ctsrts_16_17 {};
++uart0: &rp1_uart0 {
++	pinctrl-0 = <&uart0_pins>;
++};
++
++uart1_pins: &rp1_uart1_0_1 {};
++uart1_ctsrts_pins: &rp1_uart1_ctsrts_2_3 {};
++uart1: &rp1_uart1 { };
++
++uart2_pins: &rp1_uart2_4_5 {};
++uart2_ctsrts_pins: &rp1_uart2_ctsrts_6_7 {};
++uart2: &rp1_uart2 { };
++
++uart3_pins: &rp1_uart3_8_9 {};
++uart3_ctsrts_pins: &rp1_uart3_ctsrts_10_11 {};
++uart3: &rp1_uart3 { };
++
++uart4_pins: &rp1_uart4_12_13 {};
++uart4_ctsrts_pins: &rp1_uart4_ctsrts_14_15 {};
++uart4: &rp1_uart4 { };
++
++i2c0_pins: &rp1_i2c0_0_1 {};
++i2c_vc: &i2c0 {      // This is pins 27,28 on the header (not MIPI)
++	pinctrl-0 = <&i2c0_pins>;
++	pinctrl-names = "default";
++	clock-frequency = <100000>;
++};
++
++i2c1_pins: &rp1_i2c1_2_3 {};
++i2c_arm: &i2c1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c1_pins>;
++	clock-frequency = <100000>;
++};
++
++i2c2_pins: &rp1_i2c2_4_5 {};
++&i2c2 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c2_pins>;
++};
++
++i2c3_pins: &rp1_i2c3_6_7 {};
++&i2c3 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c3_pins>;
++};
++
++&i2s_clk_producer {
++	pinctrl-names = "default";
++	pinctrl-0 = <&rp1_i2s0_18_21>;
++};
++
++&i2s_clk_consumer {
++	pinctrl-names = "default";
++	pinctrl-0 = <&rp1_i2s1_18_21>;
++};
++
++spi0_pins: &rp1_spi0_gpio9 {};
++spi0_cs_pins: &rp1_spi0_cs_gpio7 {};
++
++&spi0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
++	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
++
++	spidev0: spidev@0 {
++		compatible = "spidev";
++		reg = <0>;	/* CE0 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++
++	spidev1: spidev@1 {
++		compatible = "spidev";
++		reg = <1>;	/* CE1 */
++		#address-cells = <1>;
++		#size-cells = <0>;
++		spi-max-frequency = <125000000>;
++	};
++};
++
++spi2_pins: &rp1_spi2_gpio1 {};
++&spi2 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi2_pins>;
++};
++
++spi3_pins: &rp1_spi3_gpio5 {};
++&spi3 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi3_pins>;
++};
++
++spi4_pins: &rp1_spi4_gpio9 {};
++&spi4 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi4_pins>;
++};
++
++spi5_pins: &rp1_spi5_gpio13 {};
++&spi5 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi5_pins>;
++};
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2712d0-rpi-5-b.dts b/arch/arm64/boot/dts/broadcom/bcm2712d0-rpi-5-b.dts
+new file mode 100644
+index 000000000000..d06536bc7592
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2712d0-rpi-5-b.dts
+@@ -0,0 +1,107 @@
++// SPDX-License-Identifier: GPL-2.0
++#include "bcm2712-rpi-5-b.dts"
++
++&gio {
++	brcm,gpio-bank-widths = <32 4>;
++
++	gpio-line-names =
++		"", // GPIO_000
++		"2712_BOOT_CS_N", // GPIO_001
++		"2712_BOOT_MISO", // GPIO_002
++		"2712_BOOT_MOSI", // GPIO_003
++		"2712_BOOT_SCLK", // GPIO_004
++		"", // GPIO_005
++		"", // GPIO_006
++		"", // GPIO_007
++		"", // GPIO_008
++		"", // GPIO_009
++		"-", // GPIO_010
++		"-", // GPIO_011
++		"-", // GPIO_012
++		"-", // GPIO_013
++		"PCIE_SDA", // GPIO_014
++		"PCIE_SCL", // GPIO_015
++		"", // GPIO_016
++		"", // GPIO_017
++		"-", // GPIO_018
++		"-", // GPIO_019
++		"PWR_GPIO", // GPIO_020
++		"2712_G21_FS", // GPIO_021
++		"-", // GPIO_022
++		"-", // GPIO_023
++		"BT_RTS", // GPIO_024
++		"BT_CTS", // GPIO_025
++		"BT_TXD", // GPIO_026
++		"BT_RXD", // GPIO_027
++		"WL_ON", // GPIO_028
++		"BT_ON", // GPIO_029
++		"WIFI_SDIO_CLK", // GPIO_030
++		"WIFI_SDIO_CMD", // GPIO_031
++		"WIFI_SDIO_D0", // GPIO_032
++		"WIFI_SDIO_D1", // GPIO_033
++		"WIFI_SDIO_D2", // GPIO_034
++		"WIFI_SDIO_D3"; // GPIO_035
++};
++
++&gio_aon {
++	brcm,gpio-bank-widths = <15 6>;
++
++	gpio-line-names =
++		"RP1_SDA", // AON_GPIO_00
++		"RP1_SCL", // AON_GPIO_01
++		"RP1_RUN", // AON_GPIO_02
++		"SD_IOVDD_SEL", // AON_GPIO_03
++		"SD_PWR_ON", // AON_GPIO_04
++		"SD_CDET_N", // AON_GPIO_05
++		"SD_FLG_N", // AON_GPIO_06
++		"", // AON_GPIO_07
++		"2712_WAKE", // AON_GPIO_08
++		"2712_STAT_LED", // AON_GPIO_09
++		"", // AON_GPIO_10
++		"", // AON_GPIO_11
++		"PMIC_INT", // AON_GPIO_12
++		"UART_TX_FS", // AON_GPIO_13
++		"UART_RX_FS", // AON_GPIO_14
++		"", // AON_GPIO_15
++		"", // AON_GPIO_16
++
++		// Pad bank0 out to 32 entries
++		"", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
++
++		"HDMI0_SCL", // AON_SGPIO_00
++		"HDMI0_SDA", // AON_SGPIO_01
++		"HDMI1_SCL", // AON_SGPIO_02
++		"HDMI1_SDA", // AON_SGPIO_03
++		"PMIC_SCL", // AON_SGPIO_04
++		"PMIC_SDA"; // AON_SGPIO_05
++};
++
++&pinctrl {
++	compatible = "brcm,bcm2712d0-pinctrl";
++	reg = <0x7d504100 0x20>;
++};
++
++&pinctrl_aon {
++	compatible = "brcm,bcm2712d0-aon-pinctrl";
++	reg = <0x7d510700 0x1c>;
++};
++
++&vc4 {
++	compatible = "brcm,bcm2712d0-vc6", "brcm,bcm2712-vc6";
++};
++
++&uart10 {
++	interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>;
++};
++
++&spi10 {
++	dmas = <&dma40 3>, <&dma40 4>;
++};
++
++&hdmi0 {
++	dmas = <&dma40 (12|(1<<30)|(1<<24)|(10<<16)|(15<<20))>;
++};
++
++&hdmi1 {
++	dmas = <&dma40 (13|(1<<30)|(1<<24)|(10<<16)|(15<<20))>;
++};
+diff --git a/arch/arm64/boot/dts/broadcom/rp1.dtsi b/arch/arm64/boot/dts/broadcom/rp1.dtsi
+new file mode 100644
+index 000000000000..920a3a00d338
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/rp1.dtsi
+@@ -0,0 +1,1291 @@
++#include <dt-bindings/clock/rp1.h>
++#include <dt-bindings/interrupt-controller/irq.h>
++#include <dt-bindings/mfd/rp1.h>
++
++&rp1_target {
++	rp1: rp1 {
++		compatible = "simple-bus";
++		#address-cells = <2>;
++		#size-cells = <2>;
++		#interrupt-cells = <2>;
++		interrupt-controller;
++		interrupt-parent = <&rp1>;
++
++		// ranges and dma-ranges must be provided by the includer
++
++		rp1_clocks: clocks@18000 {
++			compatible = "raspberrypi,rp1-clocks";
++			#clock-cells = <1>;
++			reg = <0xc0 0x40018000 0x0 0x10038>;
++			clocks = <&clk_xosc>;
++
++			assigned-clocks = <&rp1_clocks RP1_PLL_SYS_CORE>,
++					  <&rp1_clocks RP1_PLL_AUDIO_CORE>,
++					  // RP1_PLL_VIDEO_CORE and dividers are now managed by VEC,DPI drivers
++					  <&rp1_clocks RP1_PLL_SYS>,
++					  <&rp1_clocks RP1_PLL_SYS_SEC>,
++					  <&rp1_clocks RP1_PLL_AUDIO>,
++					  <&rp1_clocks RP1_PLL_AUDIO_SEC>,
++					  <&rp1_clocks RP1_CLK_SYS>,
++					  <&rp1_clocks RP1_PLL_SYS_PRI_PH>,
++					  // RP1_CLK_SLOW_SYS is used for the frequency counter (FC0)
++					  <&rp1_clocks RP1_CLK_SLOW_SYS>,
++					  <&rp1_clocks RP1_CLK_SDIO_TIMER>,
++					  <&rp1_clocks RP1_CLK_SDIO_ALT_SRC>,
++					  <&rp1_clocks RP1_CLK_ETH_TSU>;
++
++			assigned-clock-rates = <1000000000>, // RP1_PLL_SYS_CORE
++					       <1536000000>, // RP1_PLL_AUDIO_CORE
++					       <200000000>,  // RP1_PLL_SYS
++					       <125000000>,  // RP1_PLL_SYS_SEC
++					       <61440000>,   // RP1_PLL_AUDIO
++					       <192000000>,  // RP1_PLL_AUDIO_SEC
++					       <200000000>,  // RP1_CLK_SYS
++					       <100000000>,  // RP1_PLL_SYS_PRI_PH
++					       // Must match the XOSC frequency
++					       <50000000>, // RP1_CLK_SLOW_SYS
++					       <1000000>, // RP1_CLK_SDIO_TIMER
++					       <200000000>, // RP1_CLK_SDIO_ALT_SRC
++					       <50000000>; // RP1_CLK_ETH_TSU
++		};
++
++		rp1_uart0: serial@30000 {
++			compatible = "arm,pl011-axi";
++			reg = <0xc0 0x40030000  0x0 0x100>;
++			interrupts = <RP1_INT_UART0 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_UART &rp1_clocks RP1_PLL_SYS_PRI_PH>;
++			clock-names = "uartclk", "apb_pclk";
++			// dmas = <&rp1_dma RP1_DMA_UART0_TX>,
++			//        <&rp1_dma RP1_DMA_UART0_RX>;
++			// dma-names = "tx", "rx";
++			pinctrl-names = "default";
++			arm,primecell-periphid = <0x00541011>;
++			uart-has-rtscts;
++			cts-event-workaround;
++			skip-init;
++			status = "disabled";
++		};
++
++		rp1_uart1: serial@34000 {
++			compatible = "arm,pl011-axi";
++			reg = <0xc0 0x40034000  0x0 0x100>;
++			interrupts = <RP1_INT_UART1 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_UART &rp1_clocks RP1_PLL_SYS_PRI_PH>;
++			clock-names = "uartclk", "apb_pclk";
++			// dmas = <&rp1_dma RP1_DMA_UART1_TX>,
++			//        <&rp1_dma RP1_DMA_UART1_RX>;
++			// dma-names = "tx", "rx";
++			pinctrl-names = "default";
++			arm,primecell-periphid = <0x00541011>;
++			uart-has-rtscts;
++			cts-event-workaround;
++			skip-init;
++			status = "disabled";
++		};
++
++		rp1_uart2: serial@38000 {
++			compatible = "arm,pl011-axi";
++			reg = <0xc0 0x40038000  0x0 0x100>;
++			interrupts = <RP1_INT_UART2 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_UART &rp1_clocks RP1_PLL_SYS_PRI_PH>;
++			clock-names = "uartclk", "apb_pclk";
++			// dmas = <&rp1_dma RP1_DMA_UART2_TX>,
++			//        <&rp1_dma RP1_DMA_UART2_RX>;
++			// dma-names = "tx", "rx";
++			pinctrl-names = "default";
++			arm,primecell-periphid = <0x00541011>;
++			uart-has-rtscts;
++			cts-event-workaround;
++			skip-init;
++			status = "disabled";
++		};
++
++		rp1_uart3: serial@3c000 {
++			compatible = "arm,pl011-axi";
++			reg = <0xc0 0x4003c000  0x0 0x100>;
++			interrupts = <RP1_INT_UART3 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_UART &rp1_clocks RP1_PLL_SYS_PRI_PH>;
++			clock-names = "uartclk", "apb_pclk";
++			// dmas = <&rp1_dma RP1_DMA_UART3_TX>,
++			//        <&rp1_dma RP1_DMA_UART3_RX>;
++			// dma-names = "tx", "rx";
++			pinctrl-names = "default";
++			arm,primecell-periphid = <0x00541011>;
++			uart-has-rtscts;
++			cts-event-workaround;
++			skip-init;
++			status = "disabled";
++		};
++
++		rp1_uart4: serial@40000 {
++			compatible = "arm,pl011-axi";
++			reg = <0xc0 0x40040000  0x0 0x100>;
++			interrupts = <RP1_INT_UART4 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_UART &rp1_clocks RP1_PLL_SYS_PRI_PH>;
++			clock-names = "uartclk", "apb_pclk";
++			// dmas = <&rp1_dma RP1_DMA_UART4_TX>,
++			//        <&rp1_dma RP1_DMA_UART4_RX>;
++			// dma-names = "tx", "rx";
++			pinctrl-names = "default";
++			arm,primecell-periphid = <0x00541011>;
++			uart-has-rtscts;
++			cts-event-workaround;
++			skip-init;
++			status = "disabled";
++		};
++
++		rp1_uart5: serial@44000 {
++			compatible = "arm,pl011-axi";
++			reg = <0xc0 0x40044000  0x0 0x100>;
++			interrupts = <RP1_INT_UART5 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_UART &rp1_clocks RP1_PLL_SYS_PRI_PH>;
++			clock-names = "uartclk", "apb_pclk";
++			// dmas = <&rp1_dma RP1_DMA_UART5_TX>,
++			//        <&rp1_dma RP1_DMA_UART5_RX>;
++			// dma-names = "tx", "rx";
++			pinctrl-names = "default";
++			arm,primecell-periphid = <0x00541011>;
++			uart-has-rtscts;
++			cts-event-workaround;
++			skip-init;
++			status = "disabled";
++		};
++
++		rp1_spi8: spi@4c000 {
++			reg = <0xc0 0x4004c000  0x0 0x130>;
++			compatible = "snps,dw-apb-ssi";
++			interrupts = <RP1_INT_SPI8 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_SYS>;
++			clock-names = "ssi_clk";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			num-cs = <2>;
++			dmas = <&rp1_dma RP1_DMA_SPI8_TX>,
++			       <&rp1_dma RP1_DMA_SPI8_RX>;
++			dma-names = "tx", "rx";
++			status = "disabled";
++		};
++
++		rp1_spi0: spi@50000 {
++			reg = <0xc0 0x40050000  0x0 0x130>;
++			compatible = "snps,dw-apb-ssi";
++			interrupts = <RP1_INT_SPI0 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_SYS>;
++			clock-names = "ssi_clk";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			num-cs = <2>;
++			dmas = <&rp1_dma RP1_DMA_SPI0_TX>,
++			       <&rp1_dma RP1_DMA_SPI0_RX>;
++			dma-names = "tx", "rx";
++			status = "disabled";
++		};
++
++		rp1_spi1: spi@54000 {
++			reg = <0xc0 0x40054000  0x0 0x130>;
++			compatible = "snps,dw-apb-ssi";
++			interrupts = <RP1_INT_SPI1 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_SYS>;
++			clock-names = "ssi_clk";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			num-cs = <2>;
++			dmas = <&rp1_dma RP1_DMA_SPI1_TX>,
++			       <&rp1_dma RP1_DMA_SPI1_RX>;
++			dma-names = "tx", "rx";
++			status = "disabled";
++		};
++
++		rp1_spi2: spi@58000 {
++			reg = <0xc0 0x40058000  0x0 0x130>;
++			compatible = "snps,dw-apb-ssi";
++			interrupts = <RP1_INT_SPI2 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_SYS>;
++			clock-names = "ssi_clk";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			num-cs = <2>;
++			dmas = <&rp1_dma RP1_DMA_SPI2_TX>,
++			       <&rp1_dma RP1_DMA_SPI2_RX>;
++			dma-names = "tx", "rx";
++			status = "disabled";
++		};
++
++		rp1_spi3: spi@5c000 {
++			reg = <0xc0 0x4005c000  0x0 0x130>;
++			compatible = "snps,dw-apb-ssi";
++			interrupts = <RP1_INT_SPI3 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_SYS>;
++			clock-names = "ssi_clk";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			num-cs = <2>;
++			dmas = <&rp1_dma RP1_DMA_SPI3_TX>,
++			       <&rp1_dma RP1_DMA_SPI3_RX>;
++			dma-names = "tx", "rx";
++			status = "disabled";
++		};
++
++		// SPI4 is a target/slave interface
++		rp1_spi4: spi@60000 {
++			reg = <0xc0 0x40060000  0x0 0x130>;
++			compatible = "snps,dw-apb-ssi";
++			interrupts = <RP1_INT_SPI4 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_SYS>;
++			clock-names = "ssi_clk";
++			#address-cells = <0>;
++			#size-cells = <0>;
++			num-cs = <1>;
++			spi-slave;
++			dmas = <&rp1_dma RP1_DMA_SPI4_TX>,
++			       <&rp1_dma RP1_DMA_SPI4_RX>;
++			dma-names = "tx", "rx";
++			status = "disabled";
++
++			slave {
++				compatible = "spidev";
++				spi-max-frequency = <1000000>;
++			};
++		};
++
++		rp1_spi5: spi@64000 {
++			reg = <0xc0 0x40064000  0x0 0x130>;
++			compatible = "snps,dw-apb-ssi";
++			interrupts = <RP1_INT_SPI5 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_SYS>;
++			clock-names = "ssi_clk";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			num-cs = <2>;
++			dmas = <&rp1_dma RP1_DMA_SPI5_TX>,
++			       <&rp1_dma RP1_DMA_SPI5_RX>;
++			dma-names = "tx", "rx";
++			status = "disabled";
++		};
++
++		rp1_spi6: spi@68000 {
++			reg = <0xc0 0x40068000  0x0 0x130>;
++			compatible = "snps,dw-apb-ssi";
++			interrupts = <RP1_INT_SPI6 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_SYS>;
++			clock-names = "ssi_clk";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			num-cs = <2>;
++			dmas = <&rp1_dma RP1_DMA_SPI6_TX>,
++			       <&rp1_dma RP1_DMA_SPI6_RX>;
++			dma-names = "tx", "rx";
++			status = "disabled";
++		};
++
++		// SPI7 is a target/slave interface
++		rp1_spi7: spi@6c000 {
++			reg = <0xc0 0x4006c000  0x0 0x130>;
++			compatible = "snps,dw-apb-ssi";
++			interrupts = <RP1_INT_SPI7 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_SYS>;
++			clock-names = "ssi_clk";
++			#address-cells = <0>;
++			#size-cells = <0>;
++			num-cs = <1>;
++			spi-slave;
++			dmas = <&rp1_dma RP1_DMA_SPI7_TX>,
++			       <&rp1_dma RP1_DMA_SPI7_RX>;
++			dma-names = "tx", "rx";
++			status = "disabled";
++
++			slave {
++				compatible = "spidev";
++				spi-max-frequency = <1000000>;
++			};
++		};
++
++		rp1_i2c0: i2c@70000 {
++			reg = <0xc0 0x40070000  0x0 0x1000>;
++			compatible = "snps,designware-i2c";
++			interrupts = <RP1_INT_I2C0 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_SYS>;
++			i2c-scl-rising-time-ns = <65>;
++			i2c-scl-falling-time-ns = <100>;
++			status = "disabled";
++		};
++
++		rp1_i2c1: i2c@74000 {
++			reg = <0xc0 0x40074000  0x0 0x1000>;
++			compatible = "snps,designware-i2c";
++			interrupts = <RP1_INT_I2C1 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_SYS>;
++			i2c-scl-rising-time-ns = <65>;
++			i2c-scl-falling-time-ns = <100>;
++			status = "disabled";
++		};
++
++		rp1_i2c2: i2c@78000 {
++			reg = <0xc0 0x40078000  0x0 0x1000>;
++			compatible = "snps,designware-i2c";
++			interrupts = <RP1_INT_I2C2 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_SYS>;
++			i2c-scl-rising-time-ns = <65>;
++			i2c-scl-falling-time-ns = <100>;
++			status = "disabled";
++		};
++
++		rp1_i2c3: i2c@7c000 {
++			reg = <0xc0 0x4007c000  0x0 0x1000>;
++			compatible = "snps,designware-i2c";
++			interrupts = <RP1_INT_I2C3 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_SYS>;
++			i2c-scl-rising-time-ns = <65>;
++			i2c-scl-falling-time-ns = <100>;
++			status = "disabled";
++		};
++
++		rp1_i2c4: i2c@80000 {
++			reg = <0xc0 0x40080000  0x0 0x1000>;
++			compatible = "snps,designware-i2c";
++			interrupts = <RP1_INT_I2C4 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_SYS>;
++			i2c-scl-rising-time-ns = <65>;
++			i2c-scl-falling-time-ns = <100>;
++			status = "disabled";
++		};
++
++		rp1_i2c5: i2c@84000 {
++			reg = <0xc0 0x40084000  0x0 0x1000>;
++			compatible = "snps,designware-i2c";
++			interrupts = <RP1_INT_I2C5 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_SYS>;
++			i2c-scl-rising-time-ns = <65>;
++			i2c-scl-falling-time-ns = <100>;
++			status = "disabled";
++		};
++
++		rp1_i2c6: i2c@88000 {
++			reg = <0xc0 0x40088000  0x0 0x1000>;
++			compatible = "snps,designware-i2c";
++			interrupts = <RP1_INT_I2C6 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_SYS>;
++			i2c-scl-rising-time-ns = <65>;
++			i2c-scl-falling-time-ns = <100>;
++			status = "disabled";
++		};
++
++		rp1_pwm0: pwm@98000 {
++			compatible = "raspberrypi,rp1-pwm";
++			reg = <0xc0 0x40098000  0x0 0x100>;
++			#pwm-cells = <3>;
++			clocks = <&rp1_clocks RP1_CLK_PWM0>;
++			assigned-clocks = <&rp1_clocks RP1_CLK_PWM0>;
++			assigned-clock-rates = <50000000>;
++			status = "disabled";
++		};
++
++		rp1_pwm1: pwm@9c000 {
++			compatible = "raspberrypi,rp1-pwm";
++			reg = <0xc0 0x4009c000  0x0 0x100>;
++			#pwm-cells = <3>;
++			clocks = <&rp1_clocks RP1_CLK_PWM1>;
++			assigned-clocks = <&rp1_clocks RP1_CLK_PWM1>;
++			assigned-clock-rates = <50000000>;
++			status = "disabled";
++		};
++
++		rp1_i2s0: i2s@a0000 {
++			reg = <0xc0 0x400a0000  0x0 0x1000>;
++			compatible = "snps,designware-i2s";
++			// Providing an interrupt disables DMA
++			// interrupts = <RP1_INT_I2S0 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_I2S>;
++			clock-names = "i2sclk";
++			#sound-dai-cells = <0>;
++			dmas = <&rp1_dma RP1_DMA_I2S0_TX>,<&rp1_dma RP1_DMA_I2S0_RX>;
++			dma-names = "tx", "rx";
++			dma-maxburst = <4>;
++			status = "disabled";
++		};
++
++		rp1_i2s1: i2s@a4000 {
++			reg = <0xc0 0x400a4000  0x0 0x1000>;
++			compatible = "snps,designware-i2s";
++			// Providing an interrupt disables DMA
++			// interrupts = <RP1_INT_I2S1 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_I2S>;
++			clock-names = "i2sclk";
++			#sound-dai-cells = <0>;
++			dmas = <&rp1_dma RP1_DMA_I2S1_TX>,<&rp1_dma RP1_DMA_I2S1_RX>;
++			dma-names = "tx", "rx";
++			dma-maxburst = <4>;
++			status = "disabled";
++		};
++
++		rp1_i2s2: i2s@a8000 {
++			reg = <0xc0 0x400a8000  0x0 0x1000>;
++			compatible = "snps,designware-i2s";
++			// Providing an interrupt disables DMA
++			// interrupts = <RP1_INT_I2S2 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_I2S>;
++			status = "disabled";
++		};
++
++		rp1_sdio_clk0: sdio_clk0@b0004 {
++			compatible = "raspberrypi,rp1-sdio-clk";
++			reg = <0xc0 0x400b0004 0x0 0x1c>;
++			clocks = <&sdio_src &sdhci_core>;
++			clock-names = "src", "base";
++			#clock-cells = <0>;
++			status = "disabled";
++		};
++
++		rp1_sdio_clk1: sdio_clk1@b4004 {
++			compatible = "raspberrypi,rp1-sdio-clk";
++			reg = <0xc0 0x400b4004 0x0 0x1c>;
++			clocks = <&sdio_src &sdhci_core>;
++			clock-names = "src", "base";
++			#clock-cells = <0>;
++			status = "disabled";
++		};
++
++		rp1_adc: adc@c8000 {
++			compatible = "raspberrypi,rp1-adc";
++			reg = <0xc0 0x400c8000 0x0 0x4000>;
++			clocks = <&rp1_clocks RP1_CLK_ADC>;
++			clock-names = "adcclk";
++			#clock-cells = <0>;
++			vref-supply = <&rp1_vdd_3v3>;
++			status = "disabled";
++		};
++
++		rp1_gpio: gpio@d0000 {
++			reg = <0xc0 0x400d0000  0x0 0xc000>,
++			      <0xc0 0x400e0000  0x0 0xc000>,
++			      <0xc0 0x400f0000  0x0 0xc000>;
++			compatible = "raspberrypi,rp1-gpio";
++			interrupts = <RP1_INT_IO_BANK0 IRQ_TYPE_LEVEL_HIGH>,
++				     <RP1_INT_IO_BANK1 IRQ_TYPE_LEVEL_HIGH>,
++			             <RP1_INT_IO_BANK2 IRQ_TYPE_LEVEL_HIGH>;
++			gpio-controller;
++			#gpio-cells = <2>;
++			interrupt-controller;
++			#interrupt-cells = <2>;
++			gpio-ranges = <&rp1_gpio 0 0 54>;
++
++			rp1_uart0_14_15: rp1_uart0_14_15 {
++				pin_txd {
++					function = "uart0";
++					pins = "gpio14";
++					bias-disable;
++				};
++				pin_rxd {
++					function = "uart0";
++					pins = "gpio15";
++					bias-pull-up;
++				};
++			};
++			rp1_uart0_ctsrts_16_17: rp1_uart0_ctsrts_16_17 {
++				pin_cts {
++					function = "uart0";
++					pins = "gpio16";
++					bias-pull-up;
++				};
++				pin_rts {
++					function = "uart0";
++					pins = "gpio17";
++					bias-disable;
++				};
++			};
++			rp1_uart1_0_1: rp1_uart1_0_1 {
++				pin_txd {
++					function = "uart1";
++					pins = "gpio0";
++					bias-disable;
++				};
++				pin_rxd {
++					function = "uart1";
++					pins = "gpio1";
++					bias-pull-up;
++				};
++			};
++			rp1_uart1_ctsrts_2_3: rp1_uart1_ctsrts_2_3 {
++				pin_cts {
++					function = "uart1";
++					pins = "gpio2";
++					bias-pull-up;
++				};
++				pin_rts {
++					function = "uart1";
++					pins = "gpio3";
++					bias-disable;
++				};
++			};
++			rp1_uart2_4_5: rp1_uart2_4_5 {
++				pin_txd {
++					function = "uart2";
++					pins = "gpio4";
++					bias-disable;
++				};
++				pin_rxd {
++					function = "uart2";
++					pins = "gpio5";
++					bias-pull-up;
++				};
++			};
++			rp1_uart2_ctsrts_6_7: rp1_uart2_ctsrts_6_7 {
++				pin_cts {
++					function = "uart2";
++					pins = "gpio6";
++					bias-pull-up;
++				};
++				pin_rts {
++					function = "uart2";
++					pins = "gpio7";
++					bias-disable;
++				};
++			};
++			rp1_uart3_8_9: rp1_uart3_8_9 {
++				pin_txd {
++					function = "uart3";
++					pins = "gpio8";
++					bias-disable;
++				};
++				pin_rxd {
++					function = "uart3";
++					pins = "gpio9";
++					bias-pull-up;
++				};
++			};
++			rp1_uart3_ctsrts_10_11: rp1_uart3_ctsrts_10_11 {
++				pin_cts {
++					function = "uart3";
++					pins = "gpio10";
++					bias-pull-up;
++				};
++				pin_rts {
++					function = "uart3";
++					pins = "gpio11";
++					bias-disable;
++				};
++			};
++			rp1_uart4_12_13: rp1_uart4_12_13 {
++				pin_txd {
++					function = "uart4";
++					pins = "gpio12";
++					bias-disable;
++				};
++				pin_rxd {
++					function = "uart4";
++					pins = "gpio13";
++					bias-pull-up;
++				};
++			};
++			rp1_uart4_ctsrts_14_15: rp1_uart4_ctsrts_14_15 {
++				pin_cts {
++					function = "uart4";
++					pins = "gpio14";
++					bias-pull-up;
++				};
++				pin_rts {
++					function = "uart4";
++					pins = "gpio15";
++					bias-disable;
++				};
++			};
++
++			rp1_sdio0_22_27: rp1_sdio0_22_27 {
++				pin_clk {
++					function = "sd0";
++					pins = "gpio22";
++					bias-disable;
++					drive-strength = <12>;
++					slew-rate = <1>;
++				};
++				pin_cmd {
++					function = "sd0";
++					pins = "gpio23";
++					bias-pull-up;
++					drive-strength = <12>;
++					slew-rate = <1>;
++				};
++				pins_dat {
++					function = "sd0";
++					pins = "gpio24", "gpio25", "gpio26", "gpio27";
++					bias-pull-up;
++					drive-strength = <12>;
++					slew-rate = <1>;
++				};
++			};
++
++			rp1_sdio1_28_33: rp1_sdio1_28_33 {
++				pin_clk {
++					function = "sd1";
++					pins = "gpio28";
++					bias-disable;
++					drive-strength = <12>;
++					slew-rate = <1>;
++				};
++				pin_cmd {
++					function = "sd1";
++					pins = "gpio29";
++					bias-pull-up;
++					drive-strength = <12>;
++					slew-rate = <1>;
++				};
++				pins_dat {
++					function = "sd1";
++					pins = "gpio30", "gpio31", "gpio32", "gpio33";
++					bias-pull-up;
++					drive-strength = <12>;
++					slew-rate = <1>;
++				};
++			};
++
++			rp1_i2s0_18_21: rp1_i2s0_18_21 {
++				function = "i2s0";
++				pins = "gpio18", "gpio19", "gpio20", "gpio21";
++				bias-disable;
++			};
++
++			rp1_i2s1_18_21: rp1_i2s1_18_21 {
++				function = "i2s1";
++				pins = "gpio18", "gpio19", "gpio20", "gpio21";
++				bias-disable;
++			};
++
++			rp1_i2c4_34_35: rp1_i2c4_34_35 {
++				function = "i2c4";
++				pins = "gpio34", "gpio35";
++				drive-strength = <12>;
++				bias-pull-up;
++			};
++			rp1_i2c6_38_39: rp1_i2c6_38_39 {
++				function = "i2c6";
++				pins = "gpio38", "gpio39";
++				drive-strength = <12>;
++				bias-pull-up;
++			};
++			rp1_i2c4_40_41: rp1_i2c4_40_41 {
++				function = "i2c4";
++				pins = "gpio40", "gpio41";
++				drive-strength = <12>;
++				bias-pull-up;
++			};
++			rp1_i2c5_44_45: rp1_i2c5_44_45 {
++				function = "i2c5";
++				pins = "gpio44", "gpio45";
++				drive-strength = <12>;
++				bias-pull-up;
++			};
++			rp1_i2c0_0_1: rp1_i2c0_0_1 {
++				function = "i2c0";
++				pins = "gpio0", "gpio1";
++				drive-strength = <12>;
++				bias-pull-up;
++			};
++			rp1_i2c0_8_9: rp1_i2c0_8_9 {
++				function = "i2c0";
++				pins = "gpio8", "gpio9";
++				drive-strength = <12>;
++				bias-pull-up;
++			};
++			rp1_i2c1_2_3: rp1_i2c1_2_3 {
++				function = "i2c1";
++				pins = "gpio2", "gpio3";
++				drive-strength = <12>;
++				bias-pull-up;
++			};
++			rp1_i2c1_10_11: rp1_i2c1_10_11 {
++				function = "i2c1";
++				pins = "gpio10", "gpio11";
++				drive-strength = <12>;
++				bias-pull-up;
++			};
++			rp1_i2c2_4_5: rp1_i2c2_4_5 {
++				function = "i2c2";
++				pins = "gpio4", "gpio5";
++				drive-strength = <12>;
++				bias-pull-up;
++			};
++			rp1_i2c2_12_13: rp1_i2c2_12_13 {
++				function = "i2c2";
++				pins = "gpio12", "gpio13";
++				drive-strength = <12>;
++				bias-pull-up;
++			};
++			rp1_i2c3_6_7: rp1_i2c3_6_7 {
++				function = "i2c3";
++				pins = "gpio6", "gpio7";
++				drive-strength = <12>;
++				bias-pull-up;
++			};
++			rp1_i2c3_14_15: rp1_i2c3_14_15 {
++				function = "i2c3";
++				pins = "gpio14", "gpio15";
++				drive-strength = <12>;
++				bias-pull-up;
++			};
++			rp1_i2c3_22_23: rp1_i2c3_22_23 {
++				function = "i2c3";
++				pins = "gpio22", "gpio23";
++				drive-strength = <12>;
++				bias-pull-up;
++			};
++
++			// DPI mappings with HSYNC,VSYNC but without PIXCLK,DE
++			rp1_dpi_16bit_gpio2: rp1_dpi_16bit_gpio2 { /* Mode 2, not fully supported by RP1 */
++				function = "dpi";
++				pins = "gpio2", "gpio3", "gpio4", "gpio5",
++				       "gpio6", "gpio7", "gpio8", "gpio9",
++				       "gpio10", "gpio11", "gpio12", "gpio13",
++				       "gpio14", "gpio15", "gpio16", "gpio17",
++				       "gpio18", "gpio19";
++				bias-disable;
++			};
++			rp1_dpi_16bit_cpadhi_gpio2: rp1_dpi_16bit_cpadhi_gpio2 { /* Mode 3 */
++				function = "dpi";
++				pins = "gpio2", "gpio3", "gpio4", "gpio5",
++				       "gpio6", "gpio7", "gpio8",
++				       "gpio12", "gpio13", "gpio14", "gpio15",
++				       "gpio16", "gpio17",
++				       "gpio20", "gpio21", "gpio22", "gpio23",
++				       "gpio24";
++				bias-disable;
++			};
++			rp1_dpi_16bit_pad666_gpio2: rp1_dpi_16bit_pad666_gpio2 { /* Mode 4 */
++				function = "dpi";
++				pins = "gpio2", "gpio3",
++				       "gpio5", "gpio6", "gpio7", "gpio8",
++				       "gpio9",
++				       "gpio12", "gpio13", "gpio14", "gpio15",
++				       "gpio16", "gpio17",
++				       "gpio21", "gpio22", "gpio23", "gpio24",
++				       "gpio25";
++				bias-disable;
++			};
++			rp1_dpi_18bit_gpio2: rp1_dpi_18bit_gpio2 { /* Mode 5, not fully supported by RP1 */
++				function = "dpi";
++				pins = "gpio2", "gpio3", "gpio4", "gpio5",
++				       "gpio6", "gpio7", "gpio8", "gpio9",
++				       "gpio10", "gpio11", "gpio12", "gpio13",
++				       "gpio14", "gpio15", "gpio16", "gpio17",
++				       "gpio18", "gpio19", "gpio20", "gpio21";
++				bias-disable;
++			};
++			rp1_dpi_18bit_cpadhi_gpio2: rp1_dpi_18bit_cpadhi_gpio2 { /* Mode 6 */
++				function = "dpi";
++				pins = "gpio2", "gpio3", "gpio4", "gpio5",
++				       "gpio6", "gpio7", "gpio8", "gpio9",
++				       "gpio12", "gpio13", "gpio14", "gpio15",
++				       "gpio16", "gpio17",
++				       "gpio20", "gpio21", "gpio22", "gpio23",
++				       "gpio24", "gpio25";
++				bias-disable;
++			};
++			rp1_dpi_24bit_gpio2: rp1_dpi_24bit_gpio2 { /* Mode 7 */
++				function = "dpi";
++				pins = "gpio2", "gpio3", "gpio4", "gpio5",
++				       "gpio6", "gpio7", "gpio8", "gpio9",
++				       "gpio10", "gpio11", "gpio12", "gpio13",
++				       "gpio14", "gpio15", "gpio16", "gpio17",
++				       "gpio18", "gpio19", "gpio20", "gpio21",
++				       "gpio22", "gpio23", "gpio24", "gpio25",
++				       "gpio26", "gpio27";
++				bias-disable;
++			};
++			rp1_dpi_hvsync: rp1_dpi_hvsync { /* Sync only, for use with int VDAC */
++				function = "dpi";
++				pins = "gpio2", "gpio3";
++				bias-disable;
++			};
++
++			// More DPI mappings, including PIXCLK,DE on GPIOs 0,1
++			rp1_dpi_16bit_gpio0: rp1_dpi_16bit_gpio0 { /* Mode 2, not fully supported by RP1 */
++				function = "dpi";
++				pins = "gpio0", "gpio1", "gpio2", "gpio3",
++				       "gpio4", "gpio5", "gpio6", "gpio7",
++				       "gpio8", "gpio9", "gpio10", "gpio11",
++				       "gpio12", "gpio13", "gpio14", "gpio15",
++				       "gpio16", "gpio17", "gpio18", "gpio19";
++				bias-disable;
++			};
++			rp1_dpi_16bit_cpadhi_gpio0: rp1_dpi_16bit_cpadhi_gpio0 { /* Mode 3 */
++				function = "dpi";
++				pins = "gpio0", "gpio1", "gpio2", "gpio3",
++				       "gpio4", "gpio5", "gpio6", "gpio7",
++				       "gpio8",
++				       "gpio12", "gpio13", "gpio14", "gpio15",
++				       "gpio16", "gpio17",
++				       "gpio20", "gpio21", "gpio22", "gpio23",
++				       "gpio24";
++				bias-disable;
++			};
++			rp1_dpi_16bit_pad666_gpio0: rp1_dpi_16bit_pad666_gpio0 { /* Mode 4 */
++				function = "dpi";
++				pins = "gpio0", "gpio1", "gpio2", "gpio3",
++				       "gpio5", "gpio6", "gpio7", "gpio8",
++				       "gpio9",
++				       "gpio12", "gpio13", "gpio14", "gpio15",
++				       "gpio16", "gpio17",
++				       "gpio21", "gpio22", "gpio23", "gpio24",
++				       "gpio25";
++				bias-disable;
++			};
++			rp1_dpi_18bit_gpio0: rp1_dpi_18bit_gpio0 { /* Mode 5, not fully supported by RP1 */
++				function = "dpi";
++				pins = "gpio0", "gpio1", "gpio2", "gpio3",
++				       "gpio4", "gpio5", "gpio6", "gpio7",
++				       "gpio8", "gpio9", "gpio10", "gpio11",
++				       "gpio12", "gpio13", "gpio14", "gpio15",
++				       "gpio16", "gpio17", "gpio18", "gpio19",
++				       "gpio20", "gpio21";
++				bias-disable;
++			};
++			rp1_dpi_18bit_cpadhi_gpio0: rp1_dpi_18bit_cpadhi_gpio0 { /* Mode 6 */
++				function = "dpi";
++				pins = "gpio0", "gpio1", "gpio2", "gpio3",
++				       "gpio4", "gpio5", "gpio6", "gpio7",
++				       "gpio8", "gpio9",
++				       "gpio12", "gpio13", "gpio14", "gpio15",
++				       "gpio16", "gpio17",
++				       "gpio20", "gpio21", "gpio22", "gpio23",
++				       "gpio24", "gpio25";
++				bias-disable;
++			};
++			rp1_dpi_24bit_gpio0: rp1_dpi_24bit_gpio0 { /* Mode 7 -- All GPIOs used! */
++				function = "dpi";
++				pins = "gpio0", "gpio1", "gpio2", "gpio3",
++				       "gpio4", "gpio5", "gpio6", "gpio7",
++				       "gpio8", "gpio9", "gpio10", "gpio11",
++				       "gpio12", "gpio13", "gpio14", "gpio15",
++				       "gpio16", "gpio17", "gpio18", "gpio19",
++				       "gpio20", "gpio21", "gpio22", "gpio23",
++				       "gpio24", "gpio25", "gpio26", "gpio27";
++				bias-disable;
++			};
++
++			rp1_gpclksrc0_gpio4: rp1_gpclksrc0_gpio4 {
++				function = "gpclk0";
++				pins = "gpio4";
++				bias-disable;
++			};
++
++			rp1_gpclksrc0_gpio20: rp1_gpclksrc0_gpio20 {
++				function = "gpclk0";
++				pins = "gpio20";
++				bias-disable;
++			};
++
++			rp1_gpclksrc1_gpio5: rp1_gpclksrc1_gpio5 {
++				function = "gpclk1";
++				pins = "gpio5";
++				bias-disable;
++			};
++
++			rp1_gpclksrc1_gpio18: rp1_gpclksrc1_gpio18 {
++				function = "gpclk1";
++				pins = "gpio18";
++				bias-disable;
++			};
++
++			rp1_gpclksrc1_gpio21: rp1_gpclksrc1_gpio21 {
++				function = "gpclk1";
++				pins = "gpio21";
++				bias-disable;
++			};
++
++			rp1_pwm1_gpio45: rp1_pwm1_gpio45 {
++				function = "pwm1";
++				pins = "gpio45";
++				bias-pull-down;
++			};
++
++			rp1_spi0_gpio9: rp1_spi0_gpio9 {
++				function = "spi0";
++				pins = "gpio9", "gpio10", "gpio11";
++				bias-disable;
++				drive-strength = <12>;
++				slew-rate = <1>;
++			};
++
++			rp1_spi0_cs_gpio7: rp1_spi0_cs_gpio7 {
++				function = "spi0";
++				pins = "gpio7", "gpio8";
++				bias-pull-up;
++			};
++
++			rp1_spi1_gpio19: rp1_spi1_gpio19 {
++				function = "spi1";
++				pins = "gpio19", "gpio20", "gpio21";
++				bias-disable;
++				drive-strength = <12>;
++				slew-rate = <1>;
++			};
++
++			rp1_spi2_gpio1: rp1_spi2_gpio1 {
++				function = "spi2";
++				pins = "gpio1", "gpio2", "gpio3";
++				bias-disable;
++				drive-strength = <12>;
++				slew-rate = <1>;
++			};
++
++			rp1_spi3_gpio5: rp1_spi3_gpio5 {
++				function = "spi3";
++				pins = "gpio5", "gpio6", "gpio7";
++				bias-disable;
++				drive-strength = <12>;
++				slew-rate = <1>;
++			};
++
++			rp1_spi4_gpio9: rp1_spi4_gpio9 {
++				function = "spi4";
++				pins = "gpio9", "gpio10", "gpio11";
++				bias-disable;
++				drive-strength = <12>;
++				slew-rate = <1>;
++			};
++
++			rp1_spi5_gpio13: rp1_spi5_gpio13 {
++				function = "spi5";
++				pins = "gpio13", "gpio14", "gpio15";
++				bias-disable;
++				drive-strength = <12>;
++				slew-rate = <1>;
++			};
++
++			rp1_spi8_gpio49: rp1_spi8_gpio49 {
++				function = "spi8";
++				pins = "gpio49", "gpio50", "gpio51";
++				bias-disable;
++				drive-strength = <12>;
++				slew-rate = <1>;
++			};
++
++			rp1_spi8_cs_gpio52: rp1_spi8_cs_gpio52 {
++				function = "spi0";
++				pins = "gpio52", "gpio53";
++				bias-pull-up;
++			};
++		};
++
++		rp1_eth: ethernet@100000 {
++			reg = <0xc0 0x40100000  0x0 0x4000>;
++			compatible = "cdns,macb";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			interrupts = <RP1_INT_ETH IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&macb_pclk &macb_hclk &rp1_clocks RP1_CLK_ETH_TSU>;
++			clock-names = "pclk", "hclk", "tsu_clk";
++			phy-mode = "rgmii-id";
++			cdns,aw2w-max-pipe = /bits/ 8 <8>;
++			cdns,ar2r-max-pipe = /bits/ 8 <8>;
++			cdns,use-aw2b-fill;
++			local-mac-address = [00 00 00 00 00 00];
++			status = "disabled";
++		};
++
++		rp1_csi0: csi@110000 {
++			compatible = "raspberrypi,rp1-cfe";
++			reg = <0xc0 0x40110000  0x0 0x100>, // CSI2 DMA address
++			      <0xc0 0x40114000  0x0 0x100>, // PHY/CSI Host address
++			      <0xc0 0x40120000  0x0 0x100>, // MIPI CFG address
++			      <0xc0 0x40124000  0x0 0x1000>; // PiSP FE address
++
++			// interrupts must match rp1_pisp_fe setup
++			interrupts = <RP1_INT_MIPI0 IRQ_TYPE_LEVEL_HIGH>;
++
++			clocks = <&rp1_clocks RP1_CLK_MIPI0_CFG>;
++			assigned-clocks = <&rp1_clocks RP1_CLK_MIPI0_CFG>;
++			assigned-clock-rates = <25000000>;
++
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "disabled";
++		};
++
++		rp1_csi1: csi@128000 {
++			compatible = "raspberrypi,rp1-cfe";
++			reg = <0xc0 0x40128000  0x0 0x100>, // CSI2 DMA address
++			      <0xc0 0x4012c000  0x0 0x100>, // PHY/CSI Host address
++			      <0xc0 0x40138000  0x0 0x100>, // MIPI CFG address
++			      <0xc0 0x4013c000  0x0 0x1000>; // PiSP FE address
++
++			// interrupts must match rp1_pisp_fe setup
++			interrupts = <RP1_INT_MIPI1 IRQ_TYPE_LEVEL_HIGH>;
++
++			clocks = <&rp1_clocks RP1_CLK_MIPI1_CFG>;
++			assigned-clocks = <&rp1_clocks RP1_CLK_MIPI1_CFG>;
++			assigned-clock-rates = <25000000>;
++
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "disabled";
++		};
++
++		rp1_mmc0: mmc@180000 {
++			reg = <0xc0 0x40180000  0x0 0x100>;
++			compatible = "raspberrypi,rp1-dwcmshc";
++			interrupts = <RP1_INT_SDIO0 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_SYS &sdhci_core
++			          &rp1_clocks RP1_CLK_SDIO_TIMER
++			          &rp1_sdio_clk0>;
++			clock-names = "bus", "core", "timeout", "sdio";
++			/* Bank 0 VDDIO is fixed */
++			no-1-8-v;
++			bus-width = <4>;
++			vmmc-supply = <&rp1_vdd_3v3>;
++			broken-cd;
++			status = "disabled";
++		};
++
++		rp1_mmc1: mmc@184000 {
++			reg = <0xc0 0x40184000  0x0 0x100>;
++			compatible = "raspberrypi,rp1-dwcmshc";
++			interrupts = <RP1_INT_SDIO1 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&rp1_clocks RP1_CLK_SYS &sdhci_core
++			          &rp1_clocks RP1_CLK_SDIO_TIMER
++			          &rp1_sdio_clk1>;
++			clock-names = "bus", "core", "timeout", "sdio";
++			bus-width = <4>;
++			vmmc-supply = <&rp1_vdd_3v3>;
++			/* Nerf SDR speeds */
++			sdhci-caps-mask = <0x3 0x0>;
++			broken-cd;
++			status = "disabled";
++		};
++
++		rp1_dma: dma@188000 {
++			reg = <0xc0 0x40188000  0x0 0x1000>;
++			compatible = "snps,axi-dma-1.01a";
++			interrupts = <RP1_INT_DMA IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&sdhci_core &rp1_clocks RP1_CLK_SYS>;
++			clock-names = "core-clk", "cfgr-clk";
++
++			#dma-cells = <1>;
++			dma-channels = <8>;
++			snps,dma-masters = <1>;
++			snps,dma-targets = <64>;
++			snps,data-width = <4>; // (8 << 4) == 128 bits
++			snps,block-size = <0x40000 0x40000 0x40000 0x40000 0x40000 0x40000 0x40000 0x40000>;
++			snps,priority = <0 1 2 3 4 5 6 7>;
++			snps,axi-max-burst-len = <4>;
++			status = "disabled";
++		};
++
++		rp1_usb0: usb@200000 {
++			reg = <0xc0 0x40200000  0x0 0x100000>;
++			compatible = "snps,dwc3";
++			dr_mode = "host";
++			usb3-lpm-capable;
++			snps,axi-pipe-limit = /bits/ 8 <8>;
++			snps,dis_rxdet_inp3_quirk;
++			snps,enhanced-nak-fs-quirk;
++			snps,parkmode-disable-ss-quirk;
++			snps,parkmode-disable-hs-quirk;
++			snps,parkmode-disable-fsls-quirk;
++			snps,tx-max-burst = /bits/ 8 <8>;
++			snps,tx-thr-num-pkt = /bits/ 8 <2>;
++			interrupts = <RP1_INT_USBHOST0_0 IRQ_TYPE_EDGE_RISING>;
++			status = "disabled";
++		};
++
++		rp1_usb1: usb@300000 {
++			reg = <0xc0 0x40300000  0x0 0x100000>;
++			compatible = "snps,dwc3";
++			dr_mode = "host";
++			usb3-lpm-capable;
++			snps,axi-pipe-limit = /bits/ 8 <8>;
++			snps,dis_rxdet_inp3_quirk;
++			snps,enhanced-nak-fs-quirk;
++			snps,parkmode-disable-ss-quirk;
++			snps,parkmode-disable-hs-quirk;
++			snps,parkmode-disable-fsls-quirk;
++			snps,tx-max-burst = /bits/ 8 <8>;
++			snps,tx-thr-num-pkt = /bits/ 8 <2>;
++			interrupts = <RP1_INT_USBHOST1_0 IRQ_TYPE_EDGE_RISING>;
++			status = "disabled";
++		};
++
++		rp1_dsi0: dsi@110000 {
++			compatible = "raspberrypi,rp1dsi";
++			status = "disabled";
++			reg = <0xc0 0x40118000  0x0 0x1000>,  // MIPI0 DSI DMA (ArgonDPI)
++			      <0xc0 0x4011c000  0x0 0x1000>,  // MIPI0 DSI Host (SNPS)
++			      <0xc0 0x40120000  0x0 0x1000>;  // MIPI0 CFG
++
++			interrupts = <RP1_INT_MIPI0 IRQ_TYPE_LEVEL_HIGH>;
++
++			clocks = <&rp1_clocks RP1_CLK_MIPI0_CFG>,
++				 <&rp1_clocks RP1_CLK_MIPI0_DPI>,
++				 <&rp1_clocks RP1_CLK_MIPI0_DSI_BYTECLOCK>,
++				 <&clk_xosc>,                // hardwired to DSI "refclk"
++				 <&rp1_clocks RP1_PLL_SYS>;  // alternate parent for divide
++			clock-names = "cfgclk", "dpiclk", "byteclk", "refclk", "pllsys";
++
++			assigned-clocks = <&rp1_clocks RP1_CLK_MIPI0_CFG>;
++			assigned-clock-rates = <25000000>;
++		};
++
++		rp1_dsi1: dsi@128000 {
++			compatible = "raspberrypi,rp1dsi";
++			status = "disabled";
++			reg = <0xc0 0x40130000  0x0 0x1000>,  // MIPI1 DSI DMA (ArgonDPI)
++		              <0xc0 0x40134000  0x0 0x1000>,  // MIPI1 DSI Host (SNPS)
++		              <0xc0 0x40138000  0x0 0x1000>;  // MIPI1 CFG
++
++			interrupts = <RP1_INT_MIPI1 IRQ_TYPE_LEVEL_HIGH>;
++
++			clocks = <&rp1_clocks RP1_CLK_MIPI1_CFG>,
++				 <&rp1_clocks RP1_CLK_MIPI1_DPI>,
++				 <&rp1_clocks RP1_CLK_MIPI1_DSI_BYTECLOCK>,
++				 <&clk_xosc>,               // hardwired to DSI "refclk"
++				 <&rp1_clocks RP1_PLL_SYS>; // alternate parent for divide
++			clock-names = "cfgclk", "dpiclk", "byteclk", "refclk", "pllsys";
++
++			assigned-clocks = <&rp1_clocks RP1_CLK_MIPI1_CFG>;
++			assigned-clock-rates = <25000000>;
++		};
++
++		/* VEC and DPI both need to control PLL_VIDEO and cannot work together;   */
++		/* config.txt should enable one or other using dtparam=vec or an overlay. */
++		rp1_vec: vec@144000 {
++			compatible = "raspberrypi,rp1vec";
++			status = "disabled";
++			reg = <0xc0 0x40144000  0x0 0x1000>, // VIDEO_OUT_VEC
++			      <0xc0 0x40140000  0x0 0x1000>; // VIDEO_OUT_CFG
++
++			interrupts = <RP1_INT_VIDEO_OUT IRQ_TYPE_LEVEL_HIGH>;
++
++			clocks = <&rp1_clocks RP1_CLK_VEC>;
++
++			assigned-clocks = <&rp1_clocks RP1_PLL_VIDEO_CORE>,
++					  <&rp1_clocks RP1_PLL_VIDEO_SEC>,
++					  <&rp1_clocks RP1_CLK_VEC>;
++			assigned-clock-rates = <1188000000>,
++					       <108000000>,
++					       <108000000>;
++			assigned-clock-parents = <0>,
++						 <&rp1_clocks RP1_PLL_VIDEO_CORE>,
++						 <&rp1_clocks RP1_PLL_VIDEO_SEC>;
++		};
++
++		rp1_dpi: dpi@148000 {
++			compatible = "raspberrypi,rp1dpi";
++			status = "disabled";
++			reg = <0xc0 0x40148000  0x0 0x1000>, // VIDEO_OUT DPI
++			      <0xc0 0x40140000  0x0 0x1000>; // VIDEO_OUT_CFG
++
++			interrupts = <RP1_INT_VIDEO_OUT IRQ_TYPE_LEVEL_HIGH>;
++
++			clocks = <&rp1_clocks RP1_CLK_DPI>,        // DPI pixel clock
++				 <&rp1_clocks RP1_PLL_VIDEO>,      // PLL primary divider, and
++				 <&rp1_clocks RP1_PLL_VIDEO_CORE>; // VCO, which we also control
++			clock-names = "dpiclk", "plldiv", "pllcore";
++
++			assigned-clocks        = <&rp1_clocks RP1_CLK_DPI>;
++			assigned-clock-parents = <&rp1_clocks RP1_PLL_VIDEO>;
++		};
++	};
++};
++
++&clocks {
++	clk_xosc: clk_xosc {
++		compatible = "fixed-clock";
++		#clock-cells = <0>;
++		clock-output-names = "xosc";
++		clock-frequency = <50000000>;
++	};
++	macb_pclk: macb_pclk {
++		compatible = "fixed-clock";
++		#clock-cells = <0>;
++		clock-output-names = "pclk";
++		clock-frequency = <200000000>;
++	};
++	macb_hclk: macb_hclk {
++		compatible = "fixed-clock";
++		#clock-cells = <0>;
++		clock-output-names = "hclk";
++		clock-frequency = <200000000>;
++	};
++	sdio_src: sdio_src {
++		// 400 MHz on FPGA. PLL sys VCO on asic
++		compatible = "fixed-clock";
++		#clock-cells = <0>;
++		clock-output-names = "src";
++		clock-frequency = <1000000000>;
++	};
++	sdhci_core: sdhci_core {
++		compatible = "fixed-clock";
++		#clock-cells = <0>;
++		clock-output-names = "core";
++		clock-frequency = <50000000>;
++	};
++	/* GPIO derived clock sources. Each GPIO with a GPCLK function
++	 * can drive its output from the respective GPCLK
++	 * generator, and provide a clock source to other internal
++	 * dividers. Add dummy sources here so that they can be overridden
++	 * with overlays.
++	 */
++	clksrc_gp0: clksrc_gp0 {
++		status = "disabled";
++		compatible = "fixed-factor-clock";
++		#clock-cells = <0>;
++		clock-div = <1>;
++		clock-mult = <1>;
++		clocks = <&rp1_clocks RP1_CLK_GP0>;
++		clock-output-names = "clksrc_gp0";
++	};
++	clksrc_gp1: clksrc_gp1 {
++		status = "disabled";
++		compatible = "fixed-factor-clock";
++		#clock-cells = <0>;
++		clock-div = <1>;
++		clock-mult = <1>;
++		clocks = <&rp1_clocks RP1_CLK_GP1>;
++		clock-output-names = "clksrc_gp1";
++	};
++	clksrc_gp2: clksrc_gp2 {
++		status = "disabled";
++		compatible = "fixed-factor-clock";
++		clock-div = <1>;
++		clock-mult = <1>;
++		#clock-cells = <0>;
++		clocks = <&rp1_clocks RP1_CLK_GP2>;
++		clock-output-names = "clksrc_gp2";
++	};
++	clksrc_gp3: clksrc_gp3 {
++		status = "disabled";
++		compatible = "fixed-factor-clock";
++		clock-div = <1>;
++		clock-mult = <1>;
++		#clock-cells = <0>;
++		clocks = <&rp1_clocks RP1_CLK_GP3>;
++		clock-output-names = "clksrc_gp3";
++	};
++	clksrc_gp4: clksrc_gp4 {
++		status = "disabled";
++		compatible = "fixed-factor-clock";
++		#clock-cells = <0>;
++		clock-div = <1>;
++		clock-mult = <1>;
++		clocks = <&rp1_clocks RP1_CLK_GP4>;
++		clock-output-names = "clksrc_gp4";
++	};
++	clksrc_gp5: clksrc_gp5 {
++		status = "disabled";
++		compatible = "fixed-factor-clock";
++		#clock-cells = <0>;
++		clock-div = <1>;
++		clock-mult = <1>;
++		clocks = <&rp1_clocks RP1_CLK_GP5>;
++		clock-output-names = "clksrc_gp5";
++	};
++};
++
++/ {
++	rp1_vdd_3v3: rp1_vdd_3v3 {
++		compatible = "regulator-fixed";
++		regulator-name = "vdd-3v3";
++		regulator-min-microvolt = <3300000>;
++		regulator-max-microvolt = <3300000>;
++		regulator-always-on;
++	};
++};
+diff --git a/arch/arm64/boot/dts/overlays b/arch/arm64/boot/dts/overlays
+new file mode 120000
+index 000000000000..ded08646b6f6
+--- /dev/null
++++ b/arch/arm64/boot/dts/overlays
+@@ -0,0 +1 @@
++../../../arm/boot/dts/overlays
+\ No newline at end of file
+diff --git a/include/dt-bindings/gpio/gpio-fsm.h b/include/dt-bindings/gpio/gpio-fsm.h
+new file mode 100644
+index 000000000000..eb40cfdc71df
+--- /dev/null
++++ b/include/dt-bindings/gpio/gpio-fsm.h
+@@ -0,0 +1,21 @@
++/* SPDX-License-Identifier: GPL-2.0+ */
++/*
++ * This header provides constants for binding rpi,gpio-fsm.
++ */
++
++#ifndef _DT_BINDINGS_GPIO_FSM_H
++#define _DT_BINDINGS_GPIO_FSM_H
++
++#define GF_IN       0
++#define GF_OUT      1
++#define GF_SOFT     2
++#define GF_DELAY    3
++#define GF_SHUTDOWN 4
++
++#define GF_IO(t, v) (((v) << 16) | ((t) & 0xffff))
++
++#define GF_IP(x)    GF_IO(GF_IN, (x))
++#define GF_OP(x)    GF_IO(GF_OUT, (x))
++#define GF_SW(x)    GF_IO(GF_SOFT, (x))
++
++#endif
+diff --git a/scripts/Makefile.build b/scripts/Makefile.build
+index 880785b52c04..c2a55059fb5c 100644
+--- a/scripts/Makefile.build
++++ b/scripts/Makefile.build
+@@ -41,6 +41,20 @@ include $(srctree)/scripts/Makefile.compiler
+ include $(kbuild-file)
+ include $(srctree)/scripts/Makefile.lib
+ 
++# Do not include hostprogs rules unless needed.
++# $(sort ...) is used here to remove duplicated words and excessive spaces.
++hostprogs := $(sort $(hostprogs))
++ifneq ($(hostprogs),)
++include $(srctree)/scripts/Makefile.host
++endif
++
++# Do not include userprogs rules unless needed.
++# $(sort ...) is used here to remove duplicated words and excessive spaces.
++userprogs := $(sort $(userprogs))
++ifneq ($(userprogs),)
++include $(srctree)/scripts/Makefile.userprogs
++endif
++
+ ifndef obj
+ $(warning kbuild: Makefile.build is included improperly)
+ endif
+@@ -57,6 +71,7 @@ endif
+ # subdir-builtin and subdir-modorder may contain duplications. Use $(sort ...)
+ subdir-builtin := $(sort $(filter %/built-in.a, $(real-obj-y)))
+ subdir-modorder := $(sort $(filter %/modules.order, $(obj-m)))
++subdir-dtbslist := $(sort $(filter %/dtbs-list, $(dtb-y)))
+ 
+ targets-for-builtin := $(extra-y)
+ 
+@@ -273,15 +288,10 @@ rust_common_cmd = \
+ # would not match each other.
+ 
+ quiet_cmd_rustc_o_rs = $(RUSTC_OR_CLIPPY_QUIET) $(quiet_modtag) $@
+-      cmd_rustc_o_rs = $(rust_common_cmd) --emit=obj=$@ $< $(cmd_objtool)
+-
+-define rule_rustc_o_rs
+-	$(call cmd_and_fixdep,rustc_o_rs)
+-	$(call cmd,gen_objtooldep)
+-endef
++      cmd_rustc_o_rs = $(rust_common_cmd) --emit=obj=$@ $<
+ 
+ $(obj)/%.o: $(obj)/%.rs FORCE
+-	+$(call if_changed_rule,rustc_o_rs)
++	+$(call if_changed_dep,rustc_o_rs)
+ 
+ quiet_cmd_rustc_rsi_rs = $(RUSTC_OR_CLIPPY_QUIET) $(quiet_modtag) $@
+       cmd_rustc_rsi_rs = \
+@@ -353,7 +363,7 @@ $(obj)/%.o: $(obj)/%.S FORCE
+ 
+ targets += $(filter-out $(subdir-builtin), $(real-obj-y))
+ targets += $(filter-out $(subdir-modorder), $(real-obj-m))
+-targets += $(lib-y) $(always-y)
++targets += $(real-dtb-y) $(lib-y) $(always-y)
+ 
+ # Linker scripts preprocessor (.lds.S -> .lds)
+ # ---------------------------------------------------------------------------
+@@ -379,6 +389,7 @@ $(obj)/%.asn1.c $(obj)/%.asn1.h: $(src)/%.asn1 $(objtree)/scripts/asn1_compiler
+ # To build objects in subdirs, we need to descend into the directories
+ $(subdir-builtin): $(obj)/%/built-in.a: $(obj)/% ;
+ $(subdir-modorder): $(obj)/%/modules.order: $(obj)/% ;
++$(subdir-dtbslist): $(obj)/%/dtbs-list: $(obj)/% ;
+ 
+ #
+ # Rule to compile a set of .o files into one .a file (without symbol table)
+@@ -394,8 +405,12 @@ quiet_cmd_ar_builtin = AR      $@
+ $(obj)/built-in.a: $(real-obj-y) FORCE
+ 	$(call if_changed,ar_builtin)
+ 
+-# This is a list of build artifacts from the current Makefile and its
+-# sub-directories. The timestamp should be updated when any of the member files.
++#
++# Rule to create modules.order and dtbs-list
++#
++# This is a list of build artifacts (module or dtb) from the current Makefile
++# and its sub-directories. The timestamp should be updated when any of the
++# member files.
+ 
+ cmd_gen_order = { $(foreach m, $(real-prereqs), \
+ 	$(if $(filter %/$(notdir $@), $m), cat $m, echo $m);) :; } \
+@@ -404,6 +419,9 @@ cmd_gen_order = { $(foreach m, $(real-prereqs), \
+ $(obj)/modules.order: $(obj-m) FORCE
+ 	$(call if_changed,gen_order)
+ 
++$(obj)/dtbs-list: $(dtb-y) $(dtbo-y) FORCE
++	$(call if_changed,gen_order)
++
+ #
+ # Rule to compile a set of .o files into one .a file (with symbol table)
+ #
+@@ -432,26 +450,15 @@ intermediate_targets = $(foreach sfx, $(2), \
+ 				$(patsubst %$(strip $(1)),%$(sfx), \
+ 					$(filter %$(strip $(1)), $(targets))))
+ # %.asn1.o <- %.asn1.[ch] <- %.asn1
+-targets += $(call intermediate_targets, .asn1.o, .asn1.c .asn1.h)
+-
+-# Include additional build rules when necessary
+-# ---------------------------------------------------------------------------
+-
+-# $(sort ...) is used here to remove duplicated words and excessive spaces.
+-hostprogs := $(sort $(hostprogs))
+-ifneq ($(hostprogs),)
+-include $(srctree)/scripts/Makefile.host
+-endif
+-
+-# $(sort ...) is used here to remove duplicated words and excessive spaces.
+-userprogs := $(sort $(userprogs))
+-ifneq ($(userprogs),)
+-include $(srctree)/scripts/Makefile.userprogs
+-endif
+-
+-ifneq ($(need-dtbslist)$(dtb-y)$(dtb-)$(filter %.dtb %.dtb.o %.dtbo.o,$(targets)),)
+-include $(srctree)/scripts/Makefile.dtbs
+-endif
++# %.dtb.o <- %.dtb.S <- %.dtb <- %.dts
++# %.dtbo.o <- %.dtbo.S <- %.dtbo <- %.dtso
++# %.lex.o <- %.lex.c <- %.l
++# %.tab.o <- %.tab.[ch] <- %.y
++targets += $(call intermediate_targets, .asn1.o, .asn1.c .asn1.h) \
++	   $(call intermediate_targets, .dtb.o, .dtb.S .dtb) \
++	   $(call intermediate_targets, .dtbo.o, .dtbo.S .dtbo) \
++	   $(call intermediate_targets, .lex.o, .lex.c) \
++	   $(call intermediate_targets, .tab.o, .tab.c .tab.h)
+ 
+ # Build
+ # ---------------------------------------------------------------------------
+diff --git a/scripts/Makefile.dtbinst b/scripts/Makefile.dtbinst
+index 9d920419a62c..4be9ebd3995c 100644
+--- a/scripts/Makefile.dtbinst
++++ b/scripts/Makefile.dtbinst
+@@ -31,9 +31,14 @@ $(dst)/%: $(obj)/$(1)%
+ 	$$(call cmd,dtb_install)
+ endef
+ 
+-$(foreach d, $(sort $(dir $(dtbs))), $(eval $(call gen_install_rules,$(d))))
++define overlays_install_rules
++$(dst)/overlays/%: $(obj)/$(1)%
++	$$(call cmd,dtb_install)
++endef
++
++$(foreach d, $(sort $(dir $(dtbs))), $(if $(findstring "overlays/","$(d)"),$(eval $(call overlays_install_rules,$(d))),$(eval $(call gen_install_rules,$(d)))))
+ 
+-dtbs := $(notdir $(dtbs))
++dtbs := $(foreach d, $(dtbs), $(if $(findstring overlays/,$(d)),$(d),$(notdir $(d))))
+ 
+ endif # CONFIG_ARCH_WANT_FLAT_DTB_INSTALL
+ 
+diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
+index 01a9f567d5af..2ccedbddef42 100644
+--- a/scripts/Makefile.lib
++++ b/scripts/Makefile.lib
+@@ -45,6 +45,11 @@ else
+ obj-y		:= $(filter-out %/, $(obj-y))
+ endif
+ 
++ifdef need-dtbslist
++dtb-y		+= $(addsuffix /dtbs-list, $(subdir-ym))
++always-y	+= dtbs-list
++endif
++
+ # Expand $(foo-objs) $(foo-y) etc. by replacing their individuals
+ suffix-search = $(strip $(foreach s, $3, $($(1:%$(strip $2)=%$s))))
+ # List composite targets that are constructed by combining other targets
+@@ -75,6 +80,19 @@ always-y += $(hostprogs-always-y) $(hostprogs-always-m)
+ userprogs += $(userprogs-always-y) $(userprogs-always-m)
+ always-y += $(userprogs-always-y) $(userprogs-always-m)
+ 
++# DTB
++# If CONFIG_OF_ALL_DTBS is enabled, all DT blobs are built
++dtb-$(CONFIG_OF_ALL_DTBS)       += $(dtb-)
++
++# Composite DTB (i.e. DTB constructed by overlay)
++multi-dtb-y := $(call multi-search, $(dtb-y), .dtb, -dtbs)
++# Primitive DTB compiled from *.dts
++real-dtb-y := $(call real-search, $(dtb-y), .dtb, -dtbs)
++# Base DTB that overlay is applied onto
++base-dtb-y := $(filter %.dtb, $(call real-search, $(multi-dtb-y), .dtb, -dtbs))
++
++always-y			+= $(dtb-y)
++
+ # Add subdir path
+ 
+ ifneq ($(obj),.)
+@@ -86,6 +104,10 @@ lib-y		:= $(addprefix $(obj)/,$(lib-y))
+ real-obj-y	:= $(addprefix $(obj)/,$(real-obj-y))
+ real-obj-m	:= $(addprefix $(obj)/,$(real-obj-m))
+ multi-obj-m	:= $(addprefix $(obj)/, $(multi-obj-m))
++dtb-y		:= $(addprefix $(obj)/, $(dtb-y))
++dtbo-y		:= $(addprefix $(obj)/, $(dtbo-y))
++multi-dtb-y	:= $(addprefix $(obj)/, $(multi-dtb-y))
++real-dtb-y	:= $(addprefix $(obj)/, $(real-dtb-y))
+ subdir-ym	:= $(addprefix $(obj)/,$(subdir-ym))
+ endif
+ 
+@@ -146,9 +168,6 @@ ifneq ($(CONFIG_KASAN_HW_TAGS),y)
+ _c_flags += $(if $(patsubst n%,, \
+ 		$(KASAN_SANITIZE_$(target-stem).o)$(KASAN_SANITIZE)$(is-kernel-object)), \
+ 		$(CFLAGS_KASAN), $(CFLAGS_KASAN_NOSANITIZE))
+-_rust_flags += $(if $(patsubst n%,, \
+-		$(KASAN_SANITIZE_$(target-stem).o)$(KASAN_SANITIZE)$(is-kernel-object)), \
+-		$(RUSTFLAGS_KASAN))
+ endif
+ endif
+ 
+@@ -220,7 +239,7 @@ modkern_rustflags =                                              \
+ 
+ modkern_aflags = $(if $(part-of-module),				\
+ 			$(KBUILD_AFLAGS_MODULE) $(AFLAGS_MODULE),	\
+-			$(KBUILD_AFLAGS_KERNEL) $(AFLAGS_KERNEL) $(modfile_flags))
++			$(KBUILD_AFLAGS_KERNEL) $(AFLAGS_KERNEL))
+ 
+ c_flags        = -Wp,-MMD,$(depfile) $(NOSTDINC_FLAGS) $(LINUXINCLUDE)     \
+ 		 -include $(srctree)/include/linux/compiler_types.h       \
+@@ -230,13 +249,19 @@ c_flags        = -Wp,-MMD,$(depfile) $(NOSTDINC_FLAGS) $(LINUXINCLUDE)     \
+ rust_flags     = $(_rust_flags) $(modkern_rustflags) @$(objtree)/include/generated/rustc_cfg
+ 
+ a_flags        = -Wp,-MMD,$(depfile) $(NOSTDINC_FLAGS) $(LINUXINCLUDE)     \
+-		 $(_a_flags) $(modkern_aflags) $(modname_flags)
++		 $(_a_flags) $(modkern_aflags)
+ 
+ cpp_flags      = -Wp,-MMD,$(depfile) $(NOSTDINC_FLAGS) $(LINUXINCLUDE)     \
+ 		 $(_cpp_flags)
+ 
+ ld_flags       = $(KBUILD_LDFLAGS) $(ldflags-y) $(LDFLAGS_$(@F))
+ 
++DTC_INCLUDE    := $(srctree)/scripts/dtc/include-prefixes
++
++dtc_cpp_flags  = -Wp,-MMD,$(depfile).pre.tmp -nostdinc                    \
++		 $(addprefix -I,$(DTC_INCLUDE))                          \
++		 -undef -D__DTS__
++
+ ifdef CONFIG_OBJTOOL
+ 
+ objtool := $(objtree)/tools/objtool/objtool
+@@ -326,6 +351,114 @@ cmd_objcopy = $(OBJCOPY) $(OBJCOPYFLAGS) $(OBJCOPYFLAGS_$(@F)) $< $@
+ quiet_cmd_gzip = GZIP    $@
+       cmd_gzip = cat $(real-prereqs) | $(KGZIP) -n -f -9 > $@
+ 
++# DTC
++# ---------------------------------------------------------------------------
++DTC ?= $(objtree)/scripts/dtc/dtc
++DTC_FLAGS += \
++	-Wno-unique_unit_address
++
++# Disable noisy checks by default
++ifeq ($(findstring 1,$(KBUILD_EXTRA_WARN)),)
++DTC_FLAGS += -Wno-unit_address_vs_reg \
++	-Wno-gpios_property \
++	-Wno-avoid_unnecessary_addr_size \
++	-Wno-alias_paths \
++	-Wno-graph_child_address \
++	-Wno-simple_bus_reg
++else
++DTC_FLAGS += \
++        -Wunique_unit_address_if_enabled
++endif
++
++ifneq ($(findstring 2,$(KBUILD_EXTRA_WARN)),)
++DTC_FLAGS += -Wnode_name_chars_strict \
++	-Wproperty_name_chars_strict \
++	-Wunique_unit_address
++endif
++
++DTC_FLAGS += $(DTC_FLAGS_$(target-stem))
++
++# Set -@ if the target is a base DTB that overlay is applied onto
++DTC_FLAGS += $(if $(filter $(patsubst $(obj)/%,%,$@), $(base-dtb-y)), -@)
++
++# Generate an assembly file to wrap the output of the device tree compiler
++quiet_cmd_wrap_S_dtb = WRAP    $@
++      cmd_wrap_S_dtb = {								\
++		symbase=__$(patsubst .%,%,$(suffix $<))_$(subst -,_,$(notdir $*));	\
++		echo '\#include <asm-generic/vmlinux.lds.h>';				\
++		echo '.section .dtb.init.rodata,"a"';					\
++		echo '.balign STRUCT_ALIGNMENT';					\
++		echo ".global $${symbase}_begin";					\
++		echo "$${symbase}_begin:";						\
++		echo '.incbin "$<" ';							\
++		echo ".global $${symbase}_end";						\
++		echo "$${symbase}_end:";						\
++		echo '.balign STRUCT_ALIGNMENT';					\
++	} > $@
++
++$(obj)/%.dtb.S: $(obj)/%.dtb FORCE
++	$(call if_changed,wrap_S_dtb)
++
++$(obj)/%.dtbo.S: $(obj)/%.dtbo FORCE
++	$(call if_changed,wrap_S_dtb)
++
++quiet_dtb_check_tag = $(if $(dtb-check-enabled),[C],   )
++cmd_dtb_check = $(if $(dtb-check-enabled),; $(DT_CHECKER) $(DT_CHECKER_FLAGS) -u $(srctree)/$(DT_BINDING_DIR) -p $(DT_TMP_SCHEMA) $@ || true)
++
++quiet_cmd_dtc = DTC $(quiet_dtb_check_tag) $@
++cmd_dtc = $(HOSTCC) -E $(dtc_cpp_flags) -x assembler-with-cpp -o $(dtc-tmp) $< ; \
++	$(DTC) -o $@ -b 0 \
++		$(addprefix -i,$(dir $<) $(DTC_INCLUDE)) $(DTC_FLAGS) \
++		-d $(depfile).dtc.tmp $(dtc-tmp) ; \
++	cat $(depfile).pre.tmp $(depfile).dtc.tmp > $(depfile) \
++	$(cmd_dtb_check)
++
++# NOTE:
++# Do not replace $(filter %.dtb %.dtbo, $^) with $(real-prereqs). When a single
++# DTB is turned into a multi-blob DTB, $^ will contain header file dependencies
++# recorded in the .*.cmd file.
++quiet_cmd_fdtoverlay = OVL $(quiet_dtb_check_tag) $@
++      cmd_fdtoverlay = $(objtree)/scripts/dtc/fdtoverlay -o $@ -i $(filter %.dtb %.dtbo, $^) $(cmd_dtb_check)
++
++$(multi-dtb-y): FORCE
++	$(call if_changed,fdtoverlay)
++$(call multi_depend, $(multi-dtb-y), .dtb, -dtbs)
++
++ifneq ($(CHECK_DTBS),)
++DT_CHECKER ?= dt-validate
++DT_CHECKER_FLAGS ?= $(if $(DT_SCHEMA_FILES),-l $(DT_SCHEMA_FILES),-m)
++DT_BINDING_DIR := Documentation/devicetree/bindings
++DT_TMP_SCHEMA := $(objtree)/$(DT_BINDING_DIR)/processed-schema.json
++dtb-check-enabled = $(if $(filter %.dtb, $@),y)
++endif
++
++$(obj)/%.dtb: $(obj)/%.dts $(DTC) $(DT_TMP_SCHEMA) FORCE
++	$(call if_changed_dep,dtc)
++
++$(obj)/%.dtbo: $(src)/%.dtso $(DTC) FORCE
++	$(call if_changed_dep,dtc)
++
++quiet_cmd_dtco = DTCO    $@
++cmd_dtco = mkdir -p $(dir ${dtc-tmp}) ; \
++	$(CPP) $(dtc_cpp_flags) -x assembler-with-cpp -o $(dtc-tmp) $< ; \
++	$(DTC) -@ -H epapr -O dtb -o $@ -b 0 \
++		-i $(dir $<) $(DTC_FLAGS) \
++		-Wno-interrupts_property \
++		-Wno-label_is_string \
++		-Wno-reg_format \
++		-Wno-pci_device_bus_num \
++		-Wno-i2c_bus_reg \
++		-Wno-spi_bus_reg \
++		-Wno-avoid_default_addr_size \
++		-Wno-interrupt_provider \
++		-d $(depfile).dtc.tmp $(dtc-tmp) ; \
++	cat $(depfile).pre.tmp $(depfile).dtc.tmp > $(depfile)
++
++$(obj)/%.dtbo: $(src)/%-overlay.dts FORCE
++	$(call if_changed_dep,dtco)
++
++dtc-tmp = $(subst $(comma),_,$(dot-target).dts.tmp)
++
+ # Bzip2
+ # ---------------------------------------------------------------------------
+ 
+@@ -418,17 +551,14 @@ quiet_cmd_fit = FIT     $@
+ 
+ # XZ
+ # ---------------------------------------------------------------------------
+-# Use xzkern or xzkern_with_size to compress the kernel image and xzmisc to
+-# compress other things.
++# Use xzkern to compress the kernel image and xzmisc to compress other things.
+ #
+ # xzkern uses a big LZMA2 dictionary since it doesn't increase memory usage
+ # of the kernel decompressor. A BCJ filter is used if it is available for
+-# the target architecture.
+-#
+-# xzkern_with_size also appends uncompressed size of the data using
+-# size_append. The .xz format has the size information available at the end
+-# of the file too, but it's in more complex format and it's good to avoid
+-# changing the part of the boot code that reads the uncompressed size.
++# the target architecture. xzkern also appends uncompressed size of the data
++# using size_append. The .xz format has the size information available at
++# the end of the file too, but it's in more complex format and it's good to
++# avoid changing the part of the boot code that reads the uncompressed size.
+ # Note that the bytes added by size_append will make the xz tool think that
+ # the file is corrupt. This is expected.
+ #
+-- 
+2.47.1
+
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0021-clk-raspberrypi-Allow-cpufreq-driver-to-also-adjust-.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0021-clk-raspberrypi-Allow-cpufreq-driver-to-also-adjust-.patch
new file mode 100644
index 00000000..b8008f07
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0021-clk-raspberrypi-Allow-cpufreq-driver-to-also-adjust-.patch
@@ -0,0 +1,25 @@
+From 0c982a65617ddab7a80b88d8293022f657857ae4 Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Mon, 9 Sep 2019 15:49:56 +0100
+Subject: [PATCH 021/697] clk-raspberrypi: Allow cpufreq driver to also adjust
+ gpu clocks
+
+For performance/power it is beneficial to adjust gpu clocks with arm clock.
+This is how the downstream cpufreq driver works
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+---
+ drivers/clk/bcm/clk-raspberrypi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/bcm/clk-raspberrypi.c
++++ b/drivers/clk/bcm/clk-raspberrypi.c
+@@ -153,7 +153,7 @@ static int raspberrypi_clock_property(st
+ 	struct raspberrypi_firmware_prop msg = {
+ 		.id = cpu_to_le32(data->id),
+ 		.val = cpu_to_le32(*val),
+-		.disable_turbo = cpu_to_le32(1),
++		.disable_turbo = cpu_to_le32(0),
+ 	};
+ 	int ret;
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0022-clk-bcm-rpi-Create-helper-to-retrieve-private-data.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0022-clk-bcm-rpi-Create-helper-to-retrieve-private-data.patch
new file mode 100644
index 00000000..939bd279
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0022-clk-bcm-rpi-Create-helper-to-retrieve-private-data.patch
@@ -0,0 +1,70 @@
+From e0060fa6ffa45d46235ba9565b26619e8e0c2367 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Mon, 11 Jul 2022 15:58:36 +0200
+Subject: [PATCH 022/697] clk: bcm: rpi: Create helper to retrieve private data
+
+The RaspberryPi firmware clocks driver uses in several instances a
+container_of to retrieve the struct raspberrypi_clk_data from a pointer
+to struct clk_hw. Let's create a small function to avoid duplicating it
+all over the place.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/clk/bcm/clk-raspberrypi.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+--- a/drivers/clk/bcm/clk-raspberrypi.c
++++ b/drivers/clk/bcm/clk-raspberrypi.c
+@@ -56,6 +56,12 @@ struct raspberrypi_clk_data {
+ 	struct raspberrypi_clk *rpi;
+ };
+ 
++static inline
++const struct raspberrypi_clk_data *clk_hw_to_data(const struct clk_hw *hw)
++{
++	return container_of(hw, struct raspberrypi_clk_data, hw);
++}
++
+ struct raspberrypi_clk_variant {
+ 	bool		export;
+ 	char		*clkdev;
+@@ -168,8 +174,7 @@ static int raspberrypi_clock_property(st
+ 
+ static int raspberrypi_fw_is_prepared(struct clk_hw *hw)
+ {
+-	struct raspberrypi_clk_data *data =
+-		container_of(hw, struct raspberrypi_clk_data, hw);
++	const struct raspberrypi_clk_data *data = clk_hw_to_data(hw);
+ 	struct raspberrypi_clk *rpi = data->rpi;
+ 	u32 val = 0;
+ 	int ret;
+@@ -186,8 +191,7 @@ static int raspberrypi_fw_is_prepared(st
+ static unsigned long raspberrypi_fw_get_rate(struct clk_hw *hw,
+ 					     unsigned long parent_rate)
+ {
+-	struct raspberrypi_clk_data *data =
+-		container_of(hw, struct raspberrypi_clk_data, hw);
++	const struct raspberrypi_clk_data *data = clk_hw_to_data(hw);
+ 	struct raspberrypi_clk *rpi = data->rpi;
+ 	u32 val = 0;
+ 	int ret;
+@@ -203,8 +207,7 @@ static unsigned long raspberrypi_fw_get_
+ static int raspberrypi_fw_set_rate(struct clk_hw *hw, unsigned long rate,
+ 				   unsigned long parent_rate)
+ {
+-	struct raspberrypi_clk_data *data =
+-		container_of(hw, struct raspberrypi_clk_data, hw);
++	const struct raspberrypi_clk_data *data = clk_hw_to_data(hw);
+ 	struct raspberrypi_clk *rpi = data->rpi;
+ 	u32 _rate = rate;
+ 	int ret;
+@@ -221,8 +224,7 @@ static int raspberrypi_fw_set_rate(struc
+ static int raspberrypi_fw_dumb_determine_rate(struct clk_hw *hw,
+ 					      struct clk_rate_request *req)
+ {
+-	struct raspberrypi_clk_data *data =
+-		container_of(hw, struct raspberrypi_clk_data, hw);
++	const struct raspberrypi_clk_data *data = clk_hw_to_data(hw);
+ 	struct raspberrypi_clk_variant *variant = data->variant;
+ 
+ 	/*
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0023-clk-raspberrypi-Add-ISP-to-exported-clocks.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0023-clk-raspberrypi-Add-ISP-to-exported-clocks.patch
new file mode 100644
index 00000000..26b0ae09
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0023-clk-raspberrypi-Add-ISP-to-exported-clocks.patch
@@ -0,0 +1,85 @@
+From 23af1bc548742e8d20a57ae703c5646c7f70e20a Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Tue, 12 Apr 2022 20:07:20 +0100
+Subject: [PATCH 023/697] clk-raspberrypi: Add ISP to exported clocks
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+clk-raspberrypi: Enable minimize for all firmware clocks
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+clk: bcm: rpi: Add disp clock
+
+BCM2712 has an extra clock exposed by the firmware called DISP, and used
+by (at least) the HVS. Let's add it to the list of clocks to register in
+Linux.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+
+clk: bcm: rpi: Add the BCM283x pixel clock.
+
+The clk-bcm2835 handling of the pixel clock does not function
+correctly when the HDMI power domain is disabled.
+
+The firmware supports it correctly, so add it to the
+firmware clock driver.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/clk/bcm/clk-raspberrypi.c          | 14 ++++++++++++++
+ include/soc/bcm2835/raspberrypi-firmware.h |  1 +
+ 2 files changed, 15 insertions(+)
+
+--- a/drivers/clk/bcm/clk-raspberrypi.c
++++ b/drivers/clk/bcm/clk-raspberrypi.c
+@@ -34,6 +34,7 @@ static char *rpi_firmware_clk_names[] =
+ 	[RPI_FIRMWARE_M2MC_CLK_ID]	= "m2mc",
+ 	[RPI_FIRMWARE_PIXEL_BVB_CLK_ID]	= "pixel-bvb",
+ 	[RPI_FIRMWARE_VEC_CLK_ID]	= "vec",
++	[RPI_FIRMWARE_DISP_CLK_ID]	= "disp",
+ };
+ 
+ #define RPI_FIRMWARE_STATE_ENABLE_BIT	BIT(0)
+@@ -117,18 +118,31 @@ raspberrypi_clk_variants[RPI_FIRMWARE_NU
+ 	},
+ 	[RPI_FIRMWARE_V3D_CLK_ID] = {
+ 		.export = true,
++		.minimize = true,
+ 	},
+ 	[RPI_FIRMWARE_PIXEL_CLK_ID] = {
+ 		.export = true,
++		.minimize = true,
+ 	},
+ 	[RPI_FIRMWARE_HEVC_CLK_ID] = {
+ 		.export = true,
++		.minimize = true,
++	},
++	[RPI_FIRMWARE_ISP_CLK_ID] = {
++		.export = true,
++		.minimize = true,
+ 	},
+ 	[RPI_FIRMWARE_PIXEL_BVB_CLK_ID] = {
+ 		.export = true,
++		.minimize = true,
+ 	},
+ 	[RPI_FIRMWARE_VEC_CLK_ID] = {
+ 		.export = true,
++		.minimize = true,
++	},
++	[RPI_FIRMWARE_DISP_CLK_ID] = {
++		.export = true,
++		.minimize = true,
+ 	},
+ };
+ 
+--- a/include/soc/bcm2835/raspberrypi-firmware.h
++++ b/include/soc/bcm2835/raspberrypi-firmware.h
+@@ -176,6 +176,7 @@ enum rpi_firmware_clk_id {
+ 	RPI_FIRMWARE_M2MC_CLK_ID,
+ 	RPI_FIRMWARE_PIXEL_BVB_CLK_ID,
+ 	RPI_FIRMWARE_VEC_CLK_ID,
++	RPI_FIRMWARE_DISP_CLK_ID,
+ 	RPI_FIRMWARE_NUM_CLK_ID,
+ };
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0024-clk-clk-bcm2835-Register-the-clocks-early-during-the.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0024-clk-clk-bcm2835-Register-the-clocks-early-during-the.patch
new file mode 100644
index 00000000..cab6bc89
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0024-clk-clk-bcm2835-Register-the-clocks-early-during-the.patch
@@ -0,0 +1,83 @@
+From cee2529d24e48051fff96a9f2d4740f5c3661f7e Mon Sep 17 00:00:00 2001
+From: Martin Sperl <kernel@martin.sperl.org>
+Date: Fri, 2 Sep 2016 16:45:27 +0100
+Subject: [PATCH 024/697] clk: clk-bcm2835: Register the clocks early during
+ the boot process
+
+so that special/critical clocks can get enabled early on in the
+boot process avoiding the risk of disabling a clock, pll_divider
+or pll when a claiming driver fails to install propperly - maybe it needs to defer.
+
+Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
+
+clk: clk-bcm2835: Use %zd when printing size_t
+
+The debug text for how many clocks have been registered
+uses "%d" with a size_t. Correct it to "%zd".
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+Initialise rpi-firmware before clk-bcm2835
+
+The IMA (Integrity Measurement Architecture) looks for a TPM (Trusted
+Platform Module) having been registered when it initialises; otherwise
+it assumes there is no TPM. It has been observed on BCM2835 that IMA
+is initialised before TPM, and that initialising the BCM2835 clock
+driver before the firmware driver has the effect of reversing this
+order.
+
+Change the firmware driver to initialise at core_initcall, delaying the
+BCM2835 clock driver to postcore_initcall.
+
+See: https://github.com/raspberrypi/linux/issues/3291
+     https://github.com/raspberrypi/linux/pull/3297
+
+Signed-off-by: Luke Hinds <lhinds@redhat.com>
+Co-authored-by: Phil Elwell <phil@raspberrypi.org>
+
+clk-bcm2835: use subsys_initcall for the clock driver when IMA is enabled
+
+Co-authored-by: Davide Scovotto <scovottodavide@gmail.com>
+Co-developed-by: Davide Scovotto <scovottodavide@gmail.com>
+Signed-off-by: Davide Scovotto <scovottodavide@gmail.com>
+Signed-off-by: Alberto Solavagione <albertosolavagione30@gmail.com>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -2319,8 +2319,15 @@ static int bcm2835_clk_probe(struct plat
+ 	if (ret)
+ 		return ret;
+ 
+-	return of_clk_add_hw_provider(dev->of_node, of_clk_hw_onecell_get,
++	ret = of_clk_add_hw_provider(dev->of_node, of_clk_hw_onecell_get,
+ 				      &cprman->onecell);
++	if (ret)
++		return ret;
++
++	/* note that we have registered all the clocks */
++	dev_dbg(dev, "registered %zd clocks\n", asize);
++
++	return 0;
+ }
+ 
+ static const struct cprman_plat_data cprman_bcm2835_plat_data = {
+@@ -2346,7 +2353,15 @@ static struct platform_driver bcm2835_cl
+ 	.probe          = bcm2835_clk_probe,
+ };
+ 
+-builtin_platform_driver(bcm2835_clk_driver);
++static int __init __bcm2835_clk_driver_init(void)
++{
++	return platform_driver_register(&bcm2835_clk_driver);
++}
++#ifdef CONFIG_IMA
++subsys_initcall(__bcm2835_clk_driver_init);
++#else
++postcore_initcall(__bcm2835_clk_driver_init);
++#endif
+ 
+ MODULE_AUTHOR("Eric Anholt <eric@anholt.net>");
+ MODULE_DESCRIPTION("BCM2835 clock driver");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0025-clk-bcm2835-Mark-used-PLLs-and-dividers-CRITICAL.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0025-clk-bcm2835-Mark-used-PLLs-and-dividers-CRITICAL.patch
new file mode 100644
index 00000000..bcbe08a6
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0025-clk-bcm2835-Mark-used-PLLs-and-dividers-CRITICAL.patch
@@ -0,0 +1,28 @@
+From 4333d849f06982afd3a6633e51afe448224305a5 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Mon, 13 Feb 2017 17:20:08 +0000
+Subject: [PATCH 025/697] clk-bcm2835: Mark used PLLs and dividers CRITICAL
+
+The VPU configures and relies on several PLLs and dividers. Mark all
+enabled dividers and their PLLs as CRITICAL to prevent the kernel from
+switching them off.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -1407,6 +1407,11 @@ bcm2835_register_pll_divider(struct bcm2
+ 	divider->div.hw.init = &init;
+ 	divider->div.table = NULL;
+ 
++	if (!(cprman_read(cprman, divider_data->cm_reg) & divider_data->hold_mask)) {
++		init.flags |= CLK_IS_CRITICAL;
++		divider->div.flags |= CLK_IS_CRITICAL;
++	}
++
+ 	divider->cprman = cprman;
+ 	divider->data = divider_data;
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0026-clk-bcm2835-Add-claim-clocks-property.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0026-clk-bcm2835-Add-claim-clocks-property.patch
new file mode 100644
index 00000000..1381468f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0026-clk-bcm2835-Add-claim-clocks-property.patch
@@ -0,0 +1,118 @@
+From f9d8149791e2cbe06cf656182c53ee29f5cd9972 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Mon, 13 Feb 2017 17:20:08 +0000
+Subject: [PATCH 026/697] clk-bcm2835: Add claim-clocks property
+
+The claim-clocks property can be used to prevent PLLs and dividers
+from being marked as critical. It contains a vector of clock IDs,
+as defined by dt-bindings/clock/bcm2835.h.
+
+Use this mechanism to claim PLLD_DSI0, PLLD_DSI1, PLLH_AUX and
+PLLH_PIX for the vc4_kms_v3d driver.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 43 +++++++++++++++++++++++++++++++++--
+ 1 file changed, 41 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -1335,6 +1335,8 @@ static const struct clk_ops bcm2835_vpu_
+ 	.debug_init = bcm2835_clock_debug_init,
+ };
+ 
++static bool bcm2835_clk_is_claimed(const char *name);
++
+ static struct clk_hw *bcm2835_register_pll(struct bcm2835_cprman *cprman,
+ 					   const void *data)
+ {
+@@ -1352,6 +1354,9 @@ static struct clk_hw *bcm2835_register_p
+ 	init.ops = &bcm2835_pll_clk_ops;
+ 	init.flags = pll_data->flags | CLK_IGNORE_UNUSED;
+ 
++	if (!bcm2835_clk_is_claimed(pll_data->name))
++		init.flags |= CLK_IS_CRITICAL;
++
+ 	pll = kzalloc(sizeof(*pll), GFP_KERNEL);
+ 	if (!pll)
+ 		return NULL;
+@@ -1408,8 +1413,10 @@ bcm2835_register_pll_divider(struct bcm2
+ 	divider->div.table = NULL;
+ 
+ 	if (!(cprman_read(cprman, divider_data->cm_reg) & divider_data->hold_mask)) {
+-		init.flags |= CLK_IS_CRITICAL;
+-		divider->div.flags |= CLK_IS_CRITICAL;
++		if (!bcm2835_clk_is_claimed(divider_data->source_pll))
++			init.flags |= CLK_IS_CRITICAL;
++		if (!bcm2835_clk_is_claimed(divider_data->name))
++			divider->div.flags |= CLK_IS_CRITICAL;
+ 	}
+ 
+ 	divider->cprman = cprman;
+@@ -1466,6 +1473,15 @@ static struct clk_hw *bcm2835_register_c
+ 	init.flags = clock_data->flags | CLK_IGNORE_UNUSED;
+ 
+ 	/*
++	 * Some GPIO clocks for ethernet/wifi PLLs are marked as
++	 * critical (since some platforms use them), but if the
++	 * firmware didn't have them turned on then they clearly
++	 * aren't actually critical.
++	 */
++	if ((cprman_read(cprman, clock_data->ctl_reg) & CM_ENABLE) == 0)
++		init.flags &= ~CLK_IS_CRITICAL;
++
++	/*
+ 	 * Pass the CLK_SET_RATE_PARENT flag if we are allowed to propagate
+ 	 * rate changes on at least of the parents.
+ 	 */
+@@ -2245,6 +2261,8 @@ static const struct bcm2835_clk_desc clk
+ 		.ctl_reg = CM_PERIICTL),
+ };
+ 
++static bool bcm2835_clk_claimed[ARRAY_SIZE(clk_desc_array)];
++
+ /*
+  * Permanently take a reference on the parent of the SDRAM clock.
+  *
+@@ -2264,6 +2282,19 @@ static int bcm2835_mark_sdc_parent_criti
+ 	return clk_prepare_enable(parent);
+ }
+ 
++static bool bcm2835_clk_is_claimed(const char *name)
++{
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(clk_desc_array); i++) {
++		const char *clk_name = *(const char **)(clk_desc_array[i].data);
++		if (!strcmp(name, clk_name))
++		    return bcm2835_clk_claimed[i];
++	}
++
++	return false;
++}
++
+ static int bcm2835_clk_probe(struct platform_device *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
+@@ -2273,6 +2304,7 @@ static int bcm2835_clk_probe(struct plat
+ 	const size_t asize = ARRAY_SIZE(clk_desc_array);
+ 	const struct cprman_plat_data *pdata;
+ 	size_t i;
++	u32 clk_id;
+ 	int ret;
+ 
+ 	pdata = of_device_get_match_data(&pdev->dev);
+@@ -2291,6 +2323,13 @@ static int bcm2835_clk_probe(struct plat
+ 	if (IS_ERR(cprman->regs))
+ 		return PTR_ERR(cprman->regs);
+ 
++	memset(bcm2835_clk_claimed, 0, sizeof(bcm2835_clk_claimed));
++	for (i = 0;
++	     !of_property_read_u32_index(pdev->dev.of_node, "claim-clocks",
++					 i, &clk_id);
++	     i++)
++		bcm2835_clk_claimed[clk_id]= true;
++
+ 	memcpy(cprman->real_parent_names, cprman_parent_names,
+ 	       sizeof(cprman_parent_names));
+ 	of_clk_parent_fill(dev->of_node, cprman->real_parent_names,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0027-clk-bcm2835-Read-max-core-clock-from-firmware.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0027-clk-bcm2835-Read-max-core-clock-from-firmware.patch
new file mode 100644
index 00000000..5ead9cd6
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0027-clk-bcm2835-Read-max-core-clock-from-firmware.patch
@@ -0,0 +1,122 @@
+From 1c0f5f04c143e5543d498fb05c1ec50c5aa7e3e8 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Mon, 6 Mar 2017 09:06:18 +0000
+Subject: [PATCH 027/697] clk-bcm2835: Read max core clock from firmware
+
+The VPU is responsible for managing the core clock, usually under
+direction from the bcm2835-cpufreq driver but not via the clk-bcm2835
+driver. Since the core frequency can change without warning, it is
+safer to report the maximum clock rate to users of the core clock -
+I2C, SPI and the mini UART - to err on the safe side when calculating
+clock divisors.
+
+If the DT node for the clock driver includes a reference to the
+firmware node, use the firmware API to query the maximum core clock
+instead of reading the divider registers.
+
+Prior to this patch, a "100KHz" I2C bus was sometimes clocked at about
+160KHz. In particular, switching to the 4.9 kernel was likely to break
+SenseHAT usage on a Pi3.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+clk: bcm2835: Pass DT node to rpi_firmware_get
+
+The fw_node pointer has already been retrieved, and using it allows
+us to remove a downstream patch to the firmware driver.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 39 ++++++++++++++++++++++++++++++++++-
+ 1 file changed, 38 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -36,6 +36,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/slab.h>
+ #include <dt-bindings/clock/bcm2835.h>
++#include <soc/bcm2835/raspberrypi-firmware.h>
+ 
+ #define CM_PASSWORD		0x5a000000
+ 
+@@ -296,6 +297,8 @@
+ #define SOC_BCM2711		BIT(1)
+ #define SOC_ALL			(SOC_BCM2835 | SOC_BCM2711)
+ 
++#define VCMSG_ID_CORE_CLOCK     4
++
+ /*
+  * Names of clocks used within the driver that need to be replaced
+  * with an external parent's name.  This array is in the order that
+@@ -314,6 +317,7 @@ static const char *const cprman_parent_n
+ struct bcm2835_cprman {
+ 	struct device *dev;
+ 	void __iomem *regs;
++	struct rpi_firmware *fw;
+ 	spinlock_t regs_lock; /* spinlock for all clocks */
+ 	unsigned int soc;
+ 
+@@ -1039,6 +1043,30 @@ static unsigned long bcm2835_clock_get_r
+ 	return rate;
+ }
+ 
++static unsigned long bcm2835_clock_get_rate_vpu(struct clk_hw *hw,
++						unsigned long parent_rate)
++{
++	struct bcm2835_clock *clock = bcm2835_clock_from_hw(hw);
++	struct bcm2835_cprman *cprman = clock->cprman;
++
++	if (cprman->fw) {
++		struct {
++			u32 id;
++			u32 val;
++		} packet;
++
++		packet.id = VCMSG_ID_CORE_CLOCK;
++		packet.val = 0;
++
++		if (!rpi_firmware_property(cprman->fw,
++					   RPI_FIRMWARE_GET_MAX_CLOCK_RATE,
++					   &packet, sizeof(packet)))
++			return packet.val;
++	}
++
++	return bcm2835_clock_get_rate(hw, parent_rate);
++}
++
+ static void bcm2835_clock_wait_busy(struct bcm2835_clock *clock)
+ {
+ 	struct bcm2835_cprman *cprman = clock->cprman;
+@@ -1327,7 +1355,7 @@ static int bcm2835_vpu_clock_is_on(struc
+  */
+ static const struct clk_ops bcm2835_vpu_clock_clk_ops = {
+ 	.is_prepared = bcm2835_vpu_clock_is_on,
+-	.recalc_rate = bcm2835_clock_get_rate,
++	.recalc_rate = bcm2835_clock_get_rate_vpu,
+ 	.set_rate = bcm2835_clock_set_rate,
+ 	.determine_rate = bcm2835_clock_determine_rate,
+ 	.set_parent = bcm2835_clock_set_parent,
+@@ -2303,6 +2331,7 @@ static int bcm2835_clk_probe(struct plat
+ 	const struct bcm2835_clk_desc *desc;
+ 	const size_t asize = ARRAY_SIZE(clk_desc_array);
+ 	const struct cprman_plat_data *pdata;
++	struct device_node *fw_node;
+ 	size_t i;
+ 	u32 clk_id;
+ 	int ret;
+@@ -2323,6 +2352,14 @@ static int bcm2835_clk_probe(struct plat
+ 	if (IS_ERR(cprman->regs))
+ 		return PTR_ERR(cprman->regs);
+ 
++	fw_node = of_parse_phandle(dev->of_node, "firmware", 0);
++	if (fw_node) {
++		struct rpi_firmware *fw = rpi_firmware_get(fw_node);
++		if (!fw)
++			return -EPROBE_DEFER;
++		cprman->fw = fw;
++	}
++
+ 	memset(bcm2835_clk_claimed, 0, sizeof(bcm2835_clk_claimed));
+ 	for (i = 0;
+ 	     !of_property_read_u32_index(pdev->dev.of_node, "claim-clocks",
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0028-clk-bcm2835-Don-t-wait-for-pllh-lock.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0028-clk-bcm2835-Don-t-wait-for-pllh-lock.patch
new file mode 100644
index 00000000..89fa4b1f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0028-clk-bcm2835-Don-t-wait-for-pllh-lock.patch
@@ -0,0 +1,38 @@
+From b8607274cb63f5367763bd0aa958c7341e295989 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Wed, 23 Jan 2019 16:11:50 +0000
+Subject: [PATCH 028/697] clk-bcm2835: Don't wait for pllh lock
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -647,15 +647,17 @@ static int bcm2835_pll_on(struct clk_hw
+ 	spin_unlock(&cprman->regs_lock);
+ 
+ 	/* Wait for the PLL to lock. */
+-	timeout = ktime_add_ns(ktime_get(), LOCK_TIMEOUT_NS);
+-	while (!(cprman_read(cprman, CM_LOCK) & data->lock_mask)) {
+-		if (ktime_after(ktime_get(), timeout)) {
+-			dev_err(cprman->dev, "%s: couldn't lock PLL\n",
+-				clk_hw_get_name(hw));
+-			return -ETIMEDOUT;
+-		}
++	if (strcmp(data->name, "pllh")) {
++		timeout = ktime_add_ns(ktime_get(), LOCK_TIMEOUT_NS);
++		while (!(cprman_read(cprman, CM_LOCK) & data->lock_mask)) {
++			if (ktime_after(ktime_get(), timeout)) {
++				dev_err(cprman->dev, "%s: couldn't lock PLL\n",
++					clk_hw_get_name(hw));
++				return -ETIMEDOUT;
++			}
+ 
+-		cpu_relax();
++			cpu_relax();
++		}
+ 	}
+ 
+ 	cprman_write(cprman, data->a2w_ctrl_reg,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0029-clk-bcm2835-Add-support-for-setting-leaf-clock-rates.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0029-clk-bcm2835-Add-support-for-setting-leaf-clock-rates.patch
new file mode 100644
index 00000000..6297d33a
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0029-clk-bcm2835-Add-support-for-setting-leaf-clock-rates.patch
@@ -0,0 +1,53 @@
+From d47e5b29dc19e4a5b1984e109c0541a19ba28d3a Mon Sep 17 00:00:00 2001
+From: Eric Anholt <eric@anholt.net>
+Date: Thu, 2 May 2019 15:11:05 -0700
+Subject: [PATCH 029/697] clk: bcm2835: Add support for setting leaf clock
+ rates while running.
+
+As long as you wait for !BUSY, you can do glitch-free updates of clock
+rate while the clock is running.
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -1138,15 +1138,19 @@ static int bcm2835_clock_set_rate(struct
+ 
+ 	spin_lock(&cprman->regs_lock);
+ 
+-	/*
+-	 * Setting up frac support
+-	 *
+-	 * In principle it is recommended to stop/start the clock first,
+-	 * but as we set CLK_SET_RATE_GATE during registration of the
+-	 * clock this requirement should be take care of by the
+-	 * clk-framework.
++	ctl = cprman_read(cprman, data->ctl_reg);
++
++	/* If the clock is running, we have to pause clock generation while
++	 * updating the control and div regs.  This is glitchless (no clock
++	 * signals generated faster than the rate) but each reg access is two
++	 * OSC cycles so the clock will slow down for a moment.
+ 	 */
+-	ctl = cprman_read(cprman, data->ctl_reg) & ~CM_FRAC;
++	if (ctl & CM_ENABLE) {
++		cprman_write(cprman, data->ctl_reg, ctl & ~CM_ENABLE);
++		bcm2835_clock_wait_busy(clock);
++	}
++
++	ctl &= ~CM_FRAC;
+ 	ctl |= (div & CM_DIV_FRAC_MASK) ? CM_FRAC : 0;
+ 	cprman_write(cprman, data->ctl_reg, ctl);
+ 
+@@ -1522,7 +1526,7 @@ static struct clk_hw *bcm2835_register_c
+ 		init.ops = &bcm2835_vpu_clock_clk_ops;
+ 	} else {
+ 		init.ops = &bcm2835_clock_clk_ops;
+-		init.flags |= CLK_SET_RATE_GATE | CLK_SET_PARENT_GATE;
++		init.flags |= CLK_SET_PARENT_GATE;
+ 
+ 		/* If the clock wasn't actually enabled at boot, it's not
+ 		 * critical.
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0030-clk-bcm2835-Allow-reparenting-leaf-clocks-while-they.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0030-clk-bcm2835-Allow-reparenting-leaf-clocks-while-they.patch
new file mode 100644
index 00000000..cd7e10f9
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0030-clk-bcm2835-Allow-reparenting-leaf-clocks-while-they.patch
@@ -0,0 +1,71 @@
+From bf79500a8deff78a1b1c8ef906d3eda1b742b449 Mon Sep 17 00:00:00 2001
+From: Eric Anholt <eric@anholt.net>
+Date: Thu, 2 May 2019 15:24:04 -0700
+Subject: [PATCH 030/697] clk: bcm2835: Allow reparenting leaf clocks while
+ they're running.
+
+This falls under the same "we can reprogram glitch-free as long as we
+pause generation" rule as updating the div/frac fields.  This can be
+used for runtime reclocking of V3D to manage power leakage.
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -1127,8 +1127,10 @@ static int bcm2835_clock_on(struct clk_h
+ 	return 0;
+ }
+ 
+-static int bcm2835_clock_set_rate(struct clk_hw *hw,
+-				  unsigned long rate, unsigned long parent_rate)
++static int bcm2835_clock_set_rate_and_parent(struct clk_hw *hw,
++					     unsigned long rate,
++					     unsigned long parent_rate,
++					     u8 parent)
+ {
+ 	struct bcm2835_clock *clock = bcm2835_clock_from_hw(hw);
+ 	struct bcm2835_cprman *cprman = clock->cprman;
+@@ -1150,6 +1152,11 @@ static int bcm2835_clock_set_rate(struct
+ 		bcm2835_clock_wait_busy(clock);
+ 	}
+ 
++	if (parent != 0xff) {
++		ctl &= ~(CM_SRC_MASK << CM_SRC_SHIFT);
++		ctl |= parent << CM_SRC_SHIFT;
++	}
++
+ 	ctl &= ~CM_FRAC;
+ 	ctl |= (div & CM_DIV_FRAC_MASK) ? CM_FRAC : 0;
+ 	cprman_write(cprman, data->ctl_reg, ctl);
+@@ -1161,6 +1168,12 @@ static int bcm2835_clock_set_rate(struct
+ 	return 0;
+ }
+ 
++static int bcm2835_clock_set_rate(struct clk_hw *hw,
++				  unsigned long rate, unsigned long parent_rate)
++{
++	return bcm2835_clock_set_rate_and_parent(hw, rate, parent_rate, 0xff);
++}
++
+ static bool
+ bcm2835_clk_is_pllc(struct clk_hw *hw)
+ {
+@@ -1344,6 +1357,7 @@ static const struct clk_ops bcm2835_cloc
+ 	.unprepare = bcm2835_clock_off,
+ 	.recalc_rate = bcm2835_clock_get_rate,
+ 	.set_rate = bcm2835_clock_set_rate,
++	.set_rate_and_parent = bcm2835_clock_set_rate_and_parent,
+ 	.determine_rate = bcm2835_clock_determine_rate,
+ 	.set_parent = bcm2835_clock_set_parent,
+ 	.get_parent = bcm2835_clock_get_parent,
+@@ -1526,7 +1540,6 @@ static struct clk_hw *bcm2835_register_c
+ 		init.ops = &bcm2835_vpu_clock_clk_ops;
+ 	} else {
+ 		init.ops = &bcm2835_clock_clk_ops;
+-		init.flags |= CLK_SET_PARENT_GATE;
+ 
+ 		/* If the clock wasn't actually enabled at boot, it's not
+ 		 * critical.
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0031-clk-bcm2835-Avoid-null-pointer-exception.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0031-clk-bcm2835-Avoid-null-pointer-exception.patch
new file mode 100644
index 00000000..32e6d0c7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0031-clk-bcm2835-Avoid-null-pointer-exception.patch
@@ -0,0 +1,29 @@
+From 5be3ac68ad03a16a5039ebdbbc2361b7972c870e Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Tue, 6 Aug 2019 15:23:14 +0100
+Subject: [PATCH 031/697] clk-bcm2835: Avoid null pointer exception
+
+clk_desc_array[BCM2835_PLLB] doesn't exist so we dereference null when iterating
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -2334,9 +2334,11 @@ static bool bcm2835_clk_is_claimed(const
+ 	int i;
+ 
+ 	for (i = 0; i < ARRAY_SIZE(clk_desc_array); i++) {
+-		const char *clk_name = *(const char **)(clk_desc_array[i].data);
+-		if (!strcmp(name, clk_name))
+-		    return bcm2835_clk_claimed[i];
++		if (clk_desc_array[i].data) {
++			const char *clk_name = *(const char **)(clk_desc_array[i].data);
++			if (!strcmp(name, clk_name))
++				return bcm2835_clk_claimed[i];
++		}
+ 	}
+ 
+ 	return false;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0032-clk-bcm2835-Disable-v3d-clock.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0032-clk-bcm2835-Disable-v3d-clock.patch
new file mode 100644
index 00000000..20459f70
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0032-clk-bcm2835-Disable-v3d-clock.patch
@@ -0,0 +1,84 @@
+From 93d180421ece351c0f36d43106def3e82c8e3e2b Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Tue, 3 Sep 2019 20:28:00 +0100
+Subject: [PATCH 032/697] clk-bcm2835: Disable v3d clock
+
+This is controlled by firmware, see clk-raspberrypi.c
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+
+clk-bcm2835: Remove VEC clock support
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 45 ++++++++++-------------------------
+ 1 file changed, 12 insertions(+), 33 deletions(-)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -1764,16 +1764,12 @@ static const struct bcm2835_clk_desc clk
+ 		.hold_mask = CM_PLLA_HOLDCORE,
+ 		.fixed_divider = 1,
+ 		.flags = CLK_SET_RATE_PARENT),
+-	[BCM2835_PLLA_PER]	= REGISTER_PLL_DIV(
+-		SOC_ALL,
+-		.name = "plla_per",
+-		.source_pll = "plla",
+-		.cm_reg = CM_PLLA,
+-		.a2w_reg = A2W_PLLA_PER,
+-		.load_mask = CM_PLLA_LOADPER,
+-		.hold_mask = CM_PLLA_HOLDPER,
+-		.fixed_divider = 1,
+-		.flags = CLK_SET_RATE_PARENT),
++
++	/*
++	 * PLLA_PER is used for gpu clocks. Controlled by firmware, see
++	 * clk-raspberrypi.c.
++	 */
++
+ 	[BCM2835_PLLA_DSI0]	= REGISTER_PLL_DIV(
+ 		SOC_ALL,
+ 		.name = "plla_dsi0",
+@@ -2074,14 +2070,12 @@ static const struct bcm2835_clk_desc clk
+ 		.int_bits = 6,
+ 		.frac_bits = 0,
+ 		.tcnt_mux = 3),
+-	[BCM2835_CLOCK_V3D]	= REGISTER_VPU_CLK(
+-		SOC_ALL,
+-		.name = "v3d",
+-		.ctl_reg = CM_V3DCTL,
+-		.div_reg = CM_V3DDIV,
+-		.int_bits = 4,
+-		.frac_bits = 8,
+-		.tcnt_mux = 4),
++
++	/*
++	 * CLOCK_V3D is used for v3d clock. Controlled by firmware, see
++	 * clk-raspberrypi.c.
++	 */
++
+ 	/*
+ 	 * VPU clock.  This doesn't have an enable bit, since it drives
+ 	 * the bus for everything else, and is special so it doesn't need
+@@ -2244,21 +2238,6 @@ static const struct bcm2835_clk_desc clk
+ 		.tcnt_mux = 28,
+ 		.round_up = true),
+ 
+-	/* TV encoder clock.  Only operating frequency is 108Mhz.  */
+-	[BCM2835_CLOCK_VEC]	= REGISTER_PER_CLK(
+-		SOC_ALL,
+-		.name = "vec",
+-		.ctl_reg = CM_VECCTL,
+-		.div_reg = CM_VECDIV,
+-		.int_bits = 4,
+-		.frac_bits = 0,
+-		/*
+-		 * Allow rate change propagation only on PLLH_AUX which is
+-		 * assigned index 7 in the parent array.
+-		 */
+-		.set_rate_parent = BIT(7),
+-		.tcnt_mux = 29),
+-
+ 	/* dsi clocks */
+ 	[BCM2835_CLOCK_DSI0E]	= REGISTER_PER_CLK(
+ 		SOC_ALL,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0033-clk-bcm2835-Use-PLLD-for-DSI0-HS-clock.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0033-clk-bcm2835-Use-PLLD-for-DSI0-HS-clock.patch
new file mode 100644
index 00000000..1c6283f8
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0033-clk-bcm2835-Use-PLLD-for-DSI0-HS-clock.patch
@@ -0,0 +1,35 @@
+From 5688f668827f7afed32950b89b8763f23810adf6 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 26 Apr 2024 17:05:39 +0100
+Subject: [PATCH 033/697] clk-bcm2835: Use PLLD for DSI0 HS clock
+
+DSI0 can take the clock from either PLLA or PLLD. PLLA is
+the default muxing, but PLLD is considered the more stable.
+
+Switch to using PLLD.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -107,6 +107,7 @@
+ #define CM_UARTDIV		0x0f4
+ #define CM_VECCTL		0x0f8
+ #define CM_VECDIV		0x0fc
++#define CM_DSI0HSCK		0x120
+ #define CM_PULSECTL		0x190
+ #define CM_PULSEDIV		0x194
+ #define CM_SDCCTL		0x1a8
+@@ -2352,6 +2353,9 @@ static int bcm2835_clk_probe(struct plat
+ 	if (IS_ERR(cprman->regs))
+ 		return PTR_ERR(cprman->regs);
+ 
++	/* Mux DSI0 clock to PLLD */
++	cprman_write(cprman, CM_DSI0HSCK, 1);
++
+ 	fw_node = of_parse_phandle(dev->of_node, "firmware", 0);
+ 	if (fw_node) {
+ 		struct rpi_firmware *fw = rpi_firmware_get(fw_node);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0034-cache-export-clean-and-invalidate.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0034-cache-export-clean-and-invalidate.patch
new file mode 100644
index 00000000..74340a06
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0034-cache-export-clean-and-invalidate.patch
@@ -0,0 +1,53 @@
+From a90210e2da00901e65ac5a3147338f3b2421fca4 Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Fri, 25 Aug 2017 19:18:13 +0100
+Subject: [PATCH 034/697] cache: export clean and invalidate
+
+hack: cache: Fix linker error
+---
+ arch/arm/mm/cache-v6.S | 4 ++--
+ arch/arm/mm/cache-v7.S | 6 ++++--
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/mm/cache-v6.S
++++ b/arch/arm/mm/cache-v6.S
+@@ -206,7 +206,7 @@ SYM_FUNC_END(v6_flush_kern_dcache_area)
+  *	- start   - virtual start address of region
+  *	- end     - virtual end address of region
+  */
+-v6_dma_inv_range:
++ENTRY(v6_dma_inv_range)
+ 	tst	r0, #D_CACHE_LINE_SIZE - 1
+ 	bic	r0, r0, #D_CACHE_LINE_SIZE - 1
+ #ifdef HARVARD_CACHE
+@@ -239,7 +239,7 @@ v6_dma_inv_range:
+  *	- start   - virtual start address of region
+  *	- end     - virtual end address of region
+  */
+-v6_dma_clean_range:
++ENTRY(v6_dma_clean_range)
+ 	bic	r0, r0, #D_CACHE_LINE_SIZE - 1
+ 1:
+ #ifdef HARVARD_CACHE
+--- a/arch/arm/mm/cache-v7.S
++++ b/arch/arm/mm/cache-v7.S
+@@ -364,7 +364,8 @@ SYM_FUNC_END(v7_flush_kern_dcache_area)
+  *	- start   - virtual start address of region
+  *	- end     - virtual end address of region
+  */
+-v7_dma_inv_range:
++ENTRY(b15_dma_inv_range)
++ENTRY(v7_dma_inv_range)
+ 	dcache_line_size r2, r3
+ 	sub	r3, r2, #1
+ 	tst	r0, r3
+@@ -394,7 +395,8 @@ ENDPROC(v7_dma_inv_range)
+  *	- start   - virtual start address of region
+  *	- end     - virtual end address of region
+  */
+-v7_dma_clean_range:
++ENTRY(b15_dma_clean_range)
++ENTRY(v7_dma_clean_range)
+ 	dcache_line_size r2, r3
+ 	sub	r3, r2, #1
+ 	bic	r0, r0, r3
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0035-smsc95xx-Experimental-Enable-turbo_mode-and-packetsi.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0035-smsc95xx-Experimental-Enable-turbo_mode-and-packetsi.patch
new file mode 100644
index 00000000..dbc3f357
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0035-smsc95xx-Experimental-Enable-turbo_mode-and-packetsi.patch
@@ -0,0 +1,43 @@
+From fab8fa9116af0c5fe24df66ab0adbb9900a25c80 Mon Sep 17 00:00:00 2001
+From: Sam Nazarko <email@samnazarko.co.uk>
+Date: Fri, 1 Apr 2016 17:27:21 +0100
+Subject: [PATCH 035/697] smsc95xx: Experimental: Enable turbo_mode and
+ packetsize=2560 by default
+
+See: http://forum.kodi.tv/showthread.php?tid=285288
+---
+ drivers/net/usb/smsc95xx.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/usb/smsc95xx.c
++++ b/drivers/net/usb/smsc95xx.c
+@@ -79,6 +79,10 @@ static bool turbo_mode = true;
+ module_param(turbo_mode, bool, 0644);
+ MODULE_PARM_DESC(turbo_mode, "Enable multiple frames per Rx transaction");
+ 
++static int packetsize = 2560;
++module_param(packetsize, int, 0644);
++MODULE_PARM_DESC(packetsize, "Override the RX URB packet size");
++
+ static int __must_check smsc95xx_read_reg(struct usbnet *dev, u32 index,
+ 					  u32 *data)
+ {
+@@ -932,13 +936,13 @@ static int smsc95xx_reset(struct usbnet
+ 
+ 	if (!turbo_mode) {
+ 		burst_cap = 0;
+-		dev->rx_urb_size = MAX_SINGLE_PACKET_SIZE;
++		dev->rx_urb_size = packetsize ? packetsize : MAX_SINGLE_PACKET_SIZE;
+ 	} else if (dev->udev->speed == USB_SPEED_HIGH) {
+-		burst_cap = DEFAULT_HS_BURST_CAP_SIZE / HS_USB_PKT_SIZE;
+-		dev->rx_urb_size = DEFAULT_HS_BURST_CAP_SIZE;
++		dev->rx_urb_size = packetsize ? packetsize : DEFAULT_HS_BURST_CAP_SIZE;
++		burst_cap = dev->rx_urb_size / HS_USB_PKT_SIZE;
+ 	} else {
+-		burst_cap = DEFAULT_FS_BURST_CAP_SIZE / FS_USB_PKT_SIZE;
+-		dev->rx_urb_size = DEFAULT_FS_BURST_CAP_SIZE;
++		dev->rx_urb_size = packetsize ? packetsize : DEFAULT_FS_BURST_CAP_SIZE;
++		burst_cap = dev->rx_urb_size / FS_USB_PKT_SIZE;
+ 	}
+ 
+ 	netif_dbg(dev, ifup, dev->net, "rx_urb_size=%ld\n",
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0036-Allow-mac-address-to-be-set-in-smsc95xx.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0036-Allow-mac-address-to-be-set-in-smsc95xx.patch
new file mode 100644
index 00000000..8bdb7b61
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0036-Allow-mac-address-to-be-set-in-smsc95xx.patch
@@ -0,0 +1,72 @@
+From 263f694f2ea62ab6222689edcc1f3657892889e0 Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Tue, 26 Mar 2013 17:26:38 +0000
+Subject: [PATCH 036/697] Allow mac address to be set in smsc95xx
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+
+SQUASH: smsc95xx: Use dev_mod_addr to set MAC addr
+
+Since adeef3e32146 ("net: constify netdev->dev_addr") it has been
+illegal to write to the dev_addr MAC address field. Later commits
+have added explicit checks that it hasn't been modified by nefarious
+means. The dev_addr_mod helper function is the accepted way to change
+the dev_addr field, so use it.
+
+Squash with 96c1def63ee1 ("Allow mac address to be set in smsc95xx").
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/net/usb/smsc95xx.c | 27 +++++++++++++++++++++++++++
+ 1 file changed, 27 insertions(+)
+
+--- a/drivers/net/usb/smsc95xx.c
++++ b/drivers/net/usb/smsc95xx.c
+@@ -83,6 +83,10 @@ static int packetsize = 2560;
+ module_param(packetsize, int, 0644);
+ MODULE_PARM_DESC(packetsize, "Override the RX URB packet size");
+ 
++static char *macaddr = ":";
++module_param(macaddr, charp, 0);
++MODULE_PARM_DESC(macaddr, "MAC address");
++
+ static int __must_check smsc95xx_read_reg(struct usbnet *dev, u32 index,
+ 					  u32 *data)
+ {
+@@ -805,6 +809,21 @@ static int smsc95xx_ioctl(struct net_dev
+ 	return phy_mii_ioctl(netdev->phydev, rq, cmd);
+ }
+ 
++/* Check the macaddr module parameter for a MAC address */
++static int smsc95xx_macaddr_param(struct usbnet *dev, struct net_device *nd)
++{
++	u8 mtbl[ETH_ALEN];
++
++	if (mac_pton(macaddr, mtbl)) {
++		netif_dbg(dev, ifup, dev->net,
++			  "Overriding MAC address with: %pM\n", mtbl);
++		dev_addr_mod(nd, 0, mtbl, ETH_ALEN);
++		return 0;
++	} else {
++		return -EINVAL;
++	}
++}
++
+ static void smsc95xx_init_mac_address(struct usbnet *dev)
+ {
+ 	u8 addr[ETH_ALEN];
+@@ -827,6 +846,14 @@ static void smsc95xx_init_mac_address(st
+ 			return;
+ 		}
+ 	}
++
++	/* Check module parameters */
++	if (smsc95xx_macaddr_param(dev, dev->net) == 0) {
++		if (is_valid_ether_addr(dev->net->dev_addr)) {
++			netif_dbg(dev, ifup, dev->net, "MAC address read from module parameter\n");
++			return;
++		}
++	}
+ 
+ 	/* no useful static MAC address found. generate a random one */
+ 	eth_hw_addr_random(dev->net);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0037-Protect-__release_resource-against-resources-without.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0037-Protect-__release_resource-against-resources-without.patch
new file mode 100644
index 00000000..3551d824
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0037-Protect-__release_resource-against-resources-without.patch
@@ -0,0 +1,28 @@
+From 9b1bb38bb5a638b1d0c21e8b7828d9f71d326ece Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Fri, 13 Mar 2015 12:43:36 +0000
+Subject: [PATCH 037/697] Protect __release_resource against resources without
+ parents
+
+Without this patch, removing a device tree overlay can crash here.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ kernel/resource.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/kernel/resource.c
++++ b/kernel/resource.c
+@@ -192,6 +192,12 @@ static int __release_resource(struct res
+ {
+ 	struct resource *tmp, **p, *chd;
+ 
++	if (!old->parent) {
++		WARN(old->sibling, "sibling but no parent");
++		if (old->sibling)
++			return -EINVAL;
++		return 0;
++	}
+ 	p = &old->parent->child;
+ 	for (;;) {
+ 		tmp = *p;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0038-irq-bcm2836-Avoid-Invalid-trigger-warning.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0038-irq-bcm2836-Avoid-Invalid-trigger-warning.patch
new file mode 100644
index 00000000..9c570966
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0038-irq-bcm2836-Avoid-Invalid-trigger-warning.patch
@@ -0,0 +1,24 @@
+From ed8471410d1f18d25507b68f81333bb45ed45ccd Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Thu, 9 Feb 2017 14:33:30 +0000
+Subject: [PATCH 038/697] irq-bcm2836: Avoid "Invalid trigger warning"
+
+Initialise the level for each IRQ to avoid a warning from the
+arm arch timer code.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/irqchip/irq-bcm2836.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/irqchip/irq-bcm2836.c
++++ b/drivers/irqchip/irq-bcm2836.c
+@@ -128,7 +128,7 @@ static int bcm2836_map(struct irq_domain
+ 	irq_set_percpu_devid(irq);
+ 	irq_domain_set_info(d, irq, hw, chip, d->host_data,
+ 			    handle_percpu_devid_irq, NULL, NULL);
+-	irq_set_status_flags(irq, IRQ_NOAUTOEN);
++	irq_set_status_flags(irq, IRQ_NOAUTOEN | IRQ_TYPE_LEVEL_LOW);
+ 
+ 	return 0;
+ }
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0039-irqchip-bcm2835-Add-FIQ-support.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0039-irqchip-bcm2835-Add-FIQ-support.patch
new file mode 100644
index 00000000..c4f5f0ea
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0039-irqchip-bcm2835-Add-FIQ-support.patch
@@ -0,0 +1,127 @@
+From 413429d8367d139cc4198cd69e8c66ad2c07aff3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
+Date: Fri, 12 Jun 2015 19:01:05 +0200
+Subject: [PATCH 039/697] irqchip: bcm2835: Add FIQ support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Add a duplicate irq range with an offset on the hwirq's so the
+driver can detect that enable_fiq() is used.
+Tested with downstream dwc_otg USB controller driver.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+Reviewed-by: Eric Anholt <eric@anholt.net>
+Acked-by: Stephen Warren <swarren@wwwdotorg.org>
+---
+ arch/arm/mach-bcm/Kconfig     |  1 +
+ drivers/irqchip/irq-bcm2835.c | 51 +++++++++++++++++++++++++++++++----
+ 2 files changed, 47 insertions(+), 5 deletions(-)
+
+--- a/arch/arm/mach-bcm/Kconfig
++++ b/arch/arm/mach-bcm/Kconfig
+@@ -158,6 +158,7 @@ config ARCH_BCM2835
+ 	select ARM_TIMER_SP804
+ 	select HAVE_ARM_ARCH_TIMER if ARCH_MULTI_V7
+ 	select BCM2835_TIMER
++	select FIQ
+ 	select PINCTRL
+ 	select PINCTRL_BCM2835
+ 	select MFD_CORE
+--- a/drivers/irqchip/irq-bcm2835.c
++++ b/drivers/irqchip/irq-bcm2835.c
+@@ -45,7 +45,7 @@
+ #include <asm/exception.h>
+ 
+ /* Put the bank and irq (32 bits) into the hwirq */
+-#define MAKE_HWIRQ(b, n)	((b << 5) | (n))
++#define MAKE_HWIRQ(b, n)	(((b) << 5) | (n))
+ #define HWIRQ_BANK(i)		(i >> 5)
+ #define HWIRQ_BIT(i)		BIT(i & 0x1f)
+ 
+@@ -62,9 +62,13 @@
+ 
+ #define REG_FIQ_CONTROL		0x0c
+ #define FIQ_CONTROL_ENABLE	BIT(7)
++#define REG_FIQ_ENABLE		FIQ_CONTROL_ENABLE
++#define REG_FIQ_DISABLE	0
+ 
+ #define NR_BANKS		3
+ #define IRQS_PER_BANK		32
++#define NUMBER_IRQS		MAKE_HWIRQ(NR_BANKS, 0)
++#define FIQ_START		(NR_IRQS_BANK0 + MAKE_HWIRQ(NR_BANKS - 1, 0))
+ 
+ static const int reg_pending[] __initconst = { 0x00, 0x04, 0x08 };
+ static const int reg_enable[] __initconst = { 0x18, 0x10, 0x14 };
+@@ -89,14 +93,38 @@ static void __exception_irq_entry bcm283
+ 	struct pt_regs *regs);
+ static void bcm2836_chained_handle_irq(struct irq_desc *desc);
+ 
++static inline unsigned int hwirq_to_fiq(unsigned long hwirq)
++{
++	hwirq -= NUMBER_IRQS;
++	/*
++	 * The hwirq numbering used in this driver is:
++	 *   BASE (0-7) GPU1 (32-63) GPU2 (64-95).
++	 * This differ from the one used in the FIQ register:
++	 *   GPU1 (0-31) GPU2 (32-63) BASE (64-71)
++	 */
++	if (hwirq >= 32)
++		return hwirq - 32;
++
++	return hwirq + 64;
++}
++
+ static void armctrl_mask_irq(struct irq_data *d)
+ {
+-	writel_relaxed(HWIRQ_BIT(d->hwirq), intc.disable[HWIRQ_BANK(d->hwirq)]);
++	if (d->hwirq >= NUMBER_IRQS)
++		writel_relaxed(REG_FIQ_DISABLE, intc.base + REG_FIQ_CONTROL);
++	else
++		writel_relaxed(HWIRQ_BIT(d->hwirq),
++			       intc.disable[HWIRQ_BANK(d->hwirq)]);
+ }
+ 
+ static void armctrl_unmask_irq(struct irq_data *d)
+ {
+-	writel_relaxed(HWIRQ_BIT(d->hwirq), intc.enable[HWIRQ_BANK(d->hwirq)]);
++	if (d->hwirq >= NUMBER_IRQS)
++		writel_relaxed(REG_FIQ_ENABLE | hwirq_to_fiq(d->hwirq),
++			       intc.base + REG_FIQ_CONTROL);
++	else
++		writel_relaxed(HWIRQ_BIT(d->hwirq),
++			       intc.enable[HWIRQ_BANK(d->hwirq)]);
+ }
+ 
+ static struct irq_chip armctrl_chip = {
+@@ -144,8 +172,9 @@ static int __init armctrl_of_init(struct
+ 	if (!base)
+ 		panic("%pOF: unable to map IC registers\n", node);
+ 
+-	intc.domain = irq_domain_add_linear(node, MAKE_HWIRQ(NR_BANKS, 0),
+-			&armctrl_ops, NULL);
++	intc.base = base;
++	intc.domain = irq_domain_add_linear(node, NUMBER_IRQS * 2,
++					    &armctrl_ops, NULL);
+ 	if (!intc.domain)
+ 		panic("%pOF: unable to create IRQ domain\n", node);
+ 
+@@ -188,6 +217,18 @@ static int __init armctrl_of_init(struct
+ 		set_handle_irq(bcm2835_handle_irq);
+ 	}
+ 
++	/* Make a duplicate irq range which is used to enable FIQ */
++	for (b = 0; b < NR_BANKS; b++) {
++		for (i = 0; i < bank_irqs[b]; i++) {
++			irq = irq_create_mapping(intc.domain,
++					MAKE_HWIRQ(b, i) + NUMBER_IRQS);
++			BUG_ON(irq <= 0);
++			irq_set_chip(irq, &armctrl_chip);
++			set_irq_flags(irq, IRQF_VALID | IRQF_PROBE);
++		}
++	}
++	init_FIQ(FIQ_START);
++
+ 	return 0;
+ }
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0040-irqchip-irq-bcm2835-Add-2836-FIQ-support.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0040-irqchip-irq-bcm2835-Add-2836-FIQ-support.patch
new file mode 100644
index 00000000..3ea99c1e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0040-irqchip-irq-bcm2835-Add-2836-FIQ-support.patch
@@ -0,0 +1,99 @@
+From 37d40a56c903c47aef2d15c3d73e6a5d00dbffb3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
+Date: Fri, 23 Oct 2015 16:26:55 +0200
+Subject: [PATCH 040/697] irqchip: irq-bcm2835: Add 2836 FIQ support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+---
+ drivers/irqchip/irq-bcm2835.c | 43 +++++++++++++++++++++++++++++++++--
+ 1 file changed, 41 insertions(+), 2 deletions(-)
+
+--- a/drivers/irqchip/irq-bcm2835.c
++++ b/drivers/irqchip/irq-bcm2835.c
+@@ -41,8 +41,11 @@
+ #include <linux/of_irq.h>
+ #include <linux/irqchip.h>
+ #include <linux/irqdomain.h>
++#include <linux/mfd/syscon.h>
++#include <linux/regmap.h>
+ 
+ #include <asm/exception.h>
++#include <asm/mach/irq.h>
+ 
+ /* Put the bank and irq (32 bits) into the hwirq */
+ #define MAKE_HWIRQ(b, n)	(((b) << 5) | (n))
+@@ -60,6 +63,9 @@
+ #define BANK0_VALID_MASK	(BANK0_HWIRQ_MASK | BANK1_HWIRQ | BANK2_HWIRQ \
+ 					| SHORTCUT1_MASK | SHORTCUT2_MASK)
+ 
++#undef ARM_LOCAL_GPU_INT_ROUTING
++#define ARM_LOCAL_GPU_INT_ROUTING 0x0c
++
+ #define REG_FIQ_CONTROL		0x0c
+ #define FIQ_CONTROL_ENABLE	BIT(7)
+ #define REG_FIQ_ENABLE		FIQ_CONTROL_ENABLE
+@@ -86,6 +92,7 @@ struct armctrl_ic {
+ 	void __iomem *enable[NR_BANKS];
+ 	void __iomem *disable[NR_BANKS];
+ 	struct irq_domain *domain;
++	struct regmap *local_regmap;
+ };
+ 
+ static struct armctrl_ic intc __read_mostly;
+@@ -119,12 +126,35 @@ static void armctrl_mask_irq(struct irq_
+ 
+ static void armctrl_unmask_irq(struct irq_data *d)
+ {
+-	if (d->hwirq >= NUMBER_IRQS)
++	if (d->hwirq >= NUMBER_IRQS) {
++		if (num_online_cpus() > 1) {
++			unsigned int data;
++			int ret;
++
++			if (!intc.local_regmap) {
++				pr_err("FIQ is disabled due to missing regmap\n");
++				return;
++			}
++
++			ret = regmap_read(intc.local_regmap,
++					  ARM_LOCAL_GPU_INT_ROUTING, &data);
++			if (ret) {
++				pr_err("Failed to read int routing %d\n", ret);
++				return;
++			}
++
++			data &= ~0xc;
++			data |= (1 << 2);
++			regmap_write(intc.local_regmap,
++				     ARM_LOCAL_GPU_INT_ROUTING, data);
++		}
++
+ 		writel_relaxed(REG_FIQ_ENABLE | hwirq_to_fiq(d->hwirq),
+ 			       intc.base + REG_FIQ_CONTROL);
+-	else
++	} else {
+ 		writel_relaxed(HWIRQ_BIT(d->hwirq),
+ 			       intc.enable[HWIRQ_BANK(d->hwirq)]);
++	}
+ }
+ 
+ static struct irq_chip armctrl_chip = {
+@@ -217,6 +247,15 @@ static int __init armctrl_of_init(struct
+ 		set_handle_irq(bcm2835_handle_irq);
+ 	}
+ 
++	if (is_2836) {
++		intc.local_regmap =
++			syscon_regmap_lookup_by_compatible("brcm,bcm2836-arm-local");
++		if (IS_ERR(intc.local_regmap)) {
++			pr_err("Failed to get local register map. FIQ is disabled for cpus > 1\n");
++			intc.local_regmap = NULL;
++		}
++	}
++
+ 	/* Make a duplicate irq range which is used to enable FIQ */
+ 	for (b = 0; b < NR_BANKS; b++) {
+ 		for (i = 0; i < bank_irqs[b]; i++) {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0041-spi-spidev-Completely-disable-the-spidev-warning.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0041-spi-spidev-Completely-disable-the-spidev-warning.patch
new file mode 100644
index 00000000..5859f652
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0041-spi-spidev-Completely-disable-the-spidev-warning.patch
@@ -0,0 +1,24 @@
+From e7b3aedf8b24fcb4a0fc27965098f291f7d3c23b Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Mon, 24 Jan 2022 13:41:16 +0000
+Subject: [PATCH 041/697] spi: spidev: Completely disable the spidev warning
+
+An alternative strategy would be to use "rpi,spidev" instead, but that
+would require many Raspberry Pi Device Tree changes.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/spi/spidev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -721,7 +721,7 @@ MODULE_DEVICE_TABLE(spi, spidev_spi_ids)
+  */
+ static int spidev_of_check(struct device *dev)
+ {
+-	if (device_property_match_string(dev, "compatible", "spidev") < 0)
++	if (1 || device_property_match_string(dev, "compatible", "spidev") < 0)
+ 		return 0;
+ 
+ 	dev_err(dev, "spidev listed directly in DT is not supported\n");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0042-dmaengine-bcm2835-Load-driver-early-and-support-lega.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0042-dmaengine-bcm2835-Load-driver-early-and-support-lega.patch
new file mode 100644
index 00000000..b62ac415
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0042-dmaengine-bcm2835-Load-driver-early-and-support-lega.patch
@@ -0,0 +1,1216 @@
+From 4b187fd50298ecafb03964a0dd7703c312f5aba9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
+Date: Sat, 3 Oct 2015 22:22:55 +0200
+Subject: [PATCH 042/697] dmaengine: bcm2835: Load driver early and support
+ legacy API
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Load driver early since at least bcm2708_fb doesn't support deferred
+probing and even if it did, we don't want the video driver deferred.
+Support the legacy DMA API which is needed by bcm2708_fb.
+Don't mask out channel 2.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+bcm2835-dma: Add support for per-channel flags
+
+Add the ability to interpret the high bits of the dreq specifier as
+flags to be included in the DMA_CS register. The motivation for this
+change is the ability to set the DISDEBUG flag for SD card transfers
+to avoid corruption when using the VPU debugger.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-dma: Add proper 40-bit DMA support
+
+BCM2711 has 4 DMA channels with a 40-bit address range, allowing them
+to access the full 4GB of memory on a Pi 4.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-dma: Derive slave DMA addresses correctly
+
+Slave addresses for DMA are meant to be supplied as physical addresses
+(contrary to what struct snd_dmaengine_dai_dma_data does). It is up to
+the DMA controller driver to perform the translation based on its own
+view of the world, as described in Device Tree.
+
+Now that the Pi Device Trees have the correct peripheral mappings,
+replace the hacky address munging with phys_to_dma().
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+bcm2835-dma: Add NO_WAIT_RESP flag
+
+Use bit 27 of the dreq value (the second cell of the DT DMA descriptor)
+to request that the WAIT_RESP bit is not set.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+bcm2835-dma: Advertise the full DMA range
+
+Unless the DMA mask is set wider than 32 bits, DMA mapping will use a
+bounce buffer.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+bcm2835-dma: only reserve channel 0 if legacy dma driver is enabled
+
+If CONFIG_DMA_BCM2708 isn't enabled there's no need to mask out
+one of the already scarce DMA channels.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+bcm2835-dma: Avoid losing CS flags after interrupt
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+bcm2835-dma: Add bcm2835-dma: Add DMA_WIDE_SOURCE and DMA_WIDE_DEST flags
+
+Use (reserved) bits 24 and 25 of the dreq value
+(the second cell of the DT DMA descriptor) to request
+that wide source reads or wide dest writes are required
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+dmaengine: bcm2835: Fix position reporting for 40 bits channels
+
+For 40 bits channels, the position is reported by reading the upper byte
+in the SRCI/DESTI registers. However the driver adds that upper byte
+with an 8-bits left shift, while it should be 32.
+
+Fixes: 9a52a9918306 ("bcm2835-dma: Add proper 40-bit DMA support")
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+
+dmaengine: bcm2835: Use to_bcm2711_cbaddr where relevant
+
+bcm2711_dma40_memcpy has some code strictly equivalent to the
+to_bcm2711_cbaddr() function. Let's use it instead.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+
+dmaengine: bcm2835: Fix descriptors usage for 40-bits channels
+
+The bcm2835_dma_create_cb_chain() function is in charge of building up
+the descriptors chain for a given transfer.
+
+It was initially supporting only the BCM2835-style DMA controller, and
+was later expanded to support controllers with 40-bits channels that use
+a different descriptor layout.
+
+However, some part of the function only use the old style descriptor,
+even when building a chain of new-style descriptors, resulting in weird
+bugs.
+
+Fixes: 9a52a9918306 ("bcm2835-dma: Add proper 40-bit DMA support")
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+
+bcm2835-dma: Fix WAIT_RESP on memcpy
+
+It goes in info not extra
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+bcm2835-dma: Fix dma_abort for 40-bit channels
+
+It wasn't aborting the transfer and caused stop/start
+of hdmi audio dma to be unreliable.
+
+New sequence approved by Broadcom.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+bcm2835-dma: Fix dma_abort for non-40bit channels
+
+The sequence we were doing was not safe.
+
+Clearing CS meant BCM2835_DMA_WAIT_FOR_WRITES was cleared
+and so polling BCM2835_DMA_WAITING_FOR_WRITES has no benefit
+
+Broadcom have provided a recommended sequence to abort
+a dma lite channel, so switch to that.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+bcm2835-dma: Support dma flags for multi-beat burst
+
+Add a control bit to enable a multi-beat burst on a DMA.
+This improves DMA performance and is required for HDMI audio.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+bcm2835-dma: Need to keep PROT bits set in CS on 40bit controller
+
+Resetting them to zero puts DMA channel into secure mode
+which makes further accesses impossible
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+dmaengine: bcm2835: Delete vestigial code
+
+The dedicated dma40 memcpy code is no longer used, and without a
+prototype the kernel build fails. Delete it.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/dma/Kconfig       |   2 +-
+ drivers/dma/bcm2835-dma.c | 665 +++++++++++++++++++++++++++++++-------
+ 2 files changed, 553 insertions(+), 114 deletions(-)
+
+--- a/drivers/dma/Kconfig
++++ b/drivers/dma/Kconfig
+@@ -136,7 +136,7 @@ config BCM_SBA_RAID
+ 
+ config DMA_BCM2835
+ 	tristate "BCM2835 DMA engine support"
+-	depends on ARCH_BCM2835
++	depends on ARCH_BCM2835 || ARCH_BCM2708 || ARCH_BCM2709
+ 	select DMA_ENGINE
+ 	select DMA_VIRTUAL_CHANNELS
+ 
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -18,6 +18,7 @@
+  *	Copyright 2012 Marvell International Ltd.
+  */
+ #include <linux/dmaengine.h>
++#include <linux/dma-direct.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/dmapool.h>
+ #include <linux/err.h>
+@@ -25,6 +26,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/list.h>
+ #include <linux/module.h>
++#include <linux/platform_data/dma-bcm2708.h>
+ #include <linux/platform_device.h>
+ #include <linux/slab.h>
+ #include <linux/io.h>
+@@ -36,6 +38,13 @@
+ 
+ #define BCM2835_DMA_MAX_DMA_CHAN_SUPPORTED 14
+ #define BCM2835_DMA_CHAN_NAME_SIZE 8
++#define BCM2835_DMA_BULK_MASK  BIT(0)
++#define BCM2711_DMA_MEMCPY_CHAN 14
++
++struct bcm2835_dma_cfg_data {
++	u64	dma_mask;
++	u32	chan_40bit_mask;
++};
+ 
+ /**
+  * struct bcm2835_dmadev - BCM2835 DMA controller
+@@ -48,6 +57,7 @@ struct bcm2835_dmadev {
+ 	struct dma_device ddev;
+ 	void __iomem *base;
+ 	dma_addr_t zero_page;
++	const struct bcm2835_dma_cfg_data *cfg_data;
+ };
+ 
+ struct bcm2835_dma_cb {
+@@ -60,6 +70,17 @@ struct bcm2835_dma_cb {
+ 	uint32_t pad[2];
+ };
+ 
++struct bcm2711_dma40_scb {
++	uint32_t ti;
++	uint32_t src;
++	uint32_t srci;
++	uint32_t dst;
++	uint32_t dsti;
++	uint32_t len;
++	uint32_t next_cb;
++	uint32_t rsvd;
++};
++
+ struct bcm2835_cb_entry {
+ 	struct bcm2835_dma_cb *cb;
+ 	dma_addr_t paddr;
+@@ -80,6 +101,7 @@ struct bcm2835_chan {
+ 	unsigned int irq_flags;
+ 
+ 	bool is_lite_channel;
++	bool is_40bit_channel;
+ };
+ 
+ struct bcm2835_desc {
+@@ -136,11 +158,37 @@ struct bcm2835_desc {
+ #define BCM2835_DMA_S_WIDTH	BIT(9) /* 128bit writes if set */
+ #define BCM2835_DMA_S_DREQ	BIT(10) /* enable SREQ for source */
+ #define BCM2835_DMA_S_IGNORE	BIT(11) /* ignore source reads - read 0 */
+-#define BCM2835_DMA_BURST_LENGTH(x) ((x & 15) << 12)
++#define BCM2835_DMA_BURST_LENGTH(x) (((x) & 15) << 12)
++#define BCM2835_DMA_GET_BURST_LENGTH(x) (((x) >> 12) & 15)
++#define BCM2835_DMA_CS_FLAGS(x) (x & (BCM2835_DMA_PRIORITY(15) | \
++				      BCM2835_DMA_PANIC_PRIORITY(15) | \
++				      BCM2835_DMA_WAIT_FOR_WRITES | \
++				      BCM2835_DMA_DIS_DEBUG))
+ #define BCM2835_DMA_PER_MAP(x)	((x & 31) << 16) /* REQ source */
+ #define BCM2835_DMA_WAIT(x)	((x & 31) << 21) /* add DMA-wait cycles */
+ #define BCM2835_DMA_NO_WIDE_BURSTS BIT(26) /* no 2 beat write bursts */
+ 
++/* A fake bit to request that the driver doesn't set the WAIT_RESP bit. */
++#define BCM2835_DMA_NO_WAIT_RESP BIT(27)
++#define WAIT_RESP(x) ((x & BCM2835_DMA_NO_WAIT_RESP) ? \
++		      0 : BCM2835_DMA_WAIT_RESP)
++
++/* A fake bit to request that the driver requires wide reads */
++#define BCM2835_DMA_WIDE_SOURCE BIT(24)
++#define WIDE_SOURCE(x) ((x & BCM2835_DMA_WIDE_SOURCE) ? \
++		      BCM2835_DMA_S_WIDTH : 0)
++
++/* A fake bit to request that the driver requires wide writes */
++#define BCM2835_DMA_WIDE_DEST BIT(25)
++#define WIDE_DEST(x) ((x & BCM2835_DMA_WIDE_DEST) ? \
++		      BCM2835_DMA_D_WIDTH : 0)
++
++/* A fake bit to request that the driver requires multi-beat burst */
++#define BCM2835_DMA_BURST BIT(30)
++#define BURST_LENGTH(x) ((x & BCM2835_DMA_BURST) ? \
++		      BCM2835_DMA_BURST_LENGTH(3) : 0)
++
++
+ /* debug register bits */
+ #define BCM2835_DMA_DEBUG_LAST_NOT_SET_ERR	BIT(0)
+ #define BCM2835_DMA_DEBUG_FIFO_ERR		BIT(1)
+@@ -165,13 +213,124 @@ struct bcm2835_desc {
+ #define BCM2835_DMA_DATA_TYPE_S128	16
+ 
+ /* Valid only for channels 0 - 14, 15 has its own base address */
+-#define BCM2835_DMA_CHAN(n)	((n) << 8) /* Base address */
++#define BCM2835_DMA_CHAN_SIZE	0x100
++#define BCM2835_DMA_CHAN(n)	((n) * BCM2835_DMA_CHAN_SIZE) /* Base address */
+ #define BCM2835_DMA_CHANIO(base, n) ((base) + BCM2835_DMA_CHAN(n))
+ 
+ /* the max dma length for different channels */
+ #define MAX_DMA_LEN SZ_1G
+ #define MAX_LITE_DMA_LEN (SZ_64K - 4)
+ 
++/* 40-bit DMA support */
++#define BCM2711_DMA40_CS	0x00
++#define BCM2711_DMA40_CB	0x04
++#define BCM2711_DMA40_DEBUG	0x0c
++#define BCM2711_DMA40_TI	0x10
++#define BCM2711_DMA40_SRC	0x14
++#define BCM2711_DMA40_SRCI	0x18
++#define BCM2711_DMA40_DEST	0x1c
++#define BCM2711_DMA40_DESTI	0x20
++#define BCM2711_DMA40_LEN	0x24
++#define BCM2711_DMA40_NEXT_CB	0x28
++#define BCM2711_DMA40_DEBUG2	0x2c
++
++#define BCM2711_DMA40_ACTIVE		BIT(0)
++#define BCM2711_DMA40_END		BIT(1)
++#define BCM2711_DMA40_INT		BIT(2)
++#define BCM2711_DMA40_DREQ		BIT(3)  /* DREQ state */
++#define BCM2711_DMA40_RD_PAUSED		BIT(4)  /* Reading is paused */
++#define BCM2711_DMA40_WR_PAUSED		BIT(5)  /* Writing is paused */
++#define BCM2711_DMA40_DREQ_PAUSED	BIT(6)  /* Is paused by DREQ flow control */
++#define BCM2711_DMA40_WAITING_FOR_WRITES BIT(7)  /* Waiting for last write */
++// we always want to run in supervisor mode
++#define BCM2711_DMA40_PROT		(BIT(8)|BIT(9))
++#define BCM2711_DMA40_ERR		BIT(10)
++#define BCM2711_DMA40_QOS(x)		(((x) & 0x1f) << 16)
++#define BCM2711_DMA40_PANIC_QOS(x)	(((x) & 0x1f) << 20)
++#define BCM2711_DMA40_TRANSACTIONS	BIT(25)
++#define BCM2711_DMA40_WAIT_FOR_WRITES	BIT(28)
++#define BCM2711_DMA40_DISDEBUG		BIT(29)
++#define BCM2711_DMA40_ABORT		BIT(30)
++#define BCM2711_DMA40_HALT		BIT(31)
++
++#define BCM2711_DMA40_CS_FLAGS(x) (x & (BCM2711_DMA40_QOS(15) | \
++					BCM2711_DMA40_PANIC_QOS(15) | \
++					BCM2711_DMA40_WAIT_FOR_WRITES |	\
++					BCM2711_DMA40_DISDEBUG))
++
++/* Transfer information bits */
++#define BCM2711_DMA40_INTEN		BIT(0)
++#define BCM2711_DMA40_TDMODE		BIT(1) /* 2D-Mode */
++#define BCM2711_DMA40_WAIT_RESP		BIT(2) /* wait for AXI write to be acked */
++#define BCM2711_DMA40_WAIT_RD_RESP	BIT(3) /* wait for AXI read to complete */
++#define BCM2711_DMA40_PER_MAP(x)	((x & 31) << 9) /* REQ source */
++#define BCM2711_DMA40_S_DREQ		BIT(14) /* enable SREQ for source */
++#define BCM2711_DMA40_D_DREQ		BIT(15) /* enable DREQ for destination */
++#define BCM2711_DMA40_S_WAIT(x)		((x & 0xff) << 16) /* add DMA read-wait cycles */
++#define BCM2711_DMA40_D_WAIT(x)		((x & 0xff) << 24) /* add DMA write-wait cycles */
++
++/* debug register bits */
++#define BCM2711_DMA40_DEBUG_WRITE_ERR		BIT(0)
++#define BCM2711_DMA40_DEBUG_FIFO_ERR		BIT(1)
++#define BCM2711_DMA40_DEBUG_READ_ERR		BIT(2)
++#define BCM2711_DMA40_DEBUG_READ_CB_ERR		BIT(3)
++#define BCM2711_DMA40_DEBUG_IN_ON_ERR		BIT(8)
++#define BCM2711_DMA40_DEBUG_ABORT_ON_ERR	BIT(9)
++#define BCM2711_DMA40_DEBUG_HALT_ON_ERR		BIT(10)
++#define BCM2711_DMA40_DEBUG_DISABLE_CLK_GATE	BIT(11)
++#define BCM2711_DMA40_DEBUG_RSTATE_SHIFT	14
++#define BCM2711_DMA40_DEBUG_RSTATE_BITS		4
++#define BCM2711_DMA40_DEBUG_WSTATE_SHIFT	18
++#define BCM2711_DMA40_DEBUG_WSTATE_BITS		4
++#define BCM2711_DMA40_DEBUG_RESET		BIT(23)
++#define BCM2711_DMA40_DEBUG_ID_SHIFT		24
++#define BCM2711_DMA40_DEBUG_ID_BITS		4
++#define BCM2711_DMA40_DEBUG_VERSION_SHIFT	28
++#define BCM2711_DMA40_DEBUG_VERSION_BITS	4
++
++/* Valid only for channels 0 - 3 (11 - 14) */
++#define BCM2711_DMA40_CHAN(n)	(((n) + 11) << 8) /* Base address */
++#define BCM2711_DMA40_CHANIO(base, n) ((base) + BCM2711_DMA_CHAN(n))
++
++/* the max dma length for different channels */
++#define MAX_DMA40_LEN SZ_1G
++
++#define BCM2711_DMA40_BURST_LEN(x)	(((x) & 15) << 8)
++#define BCM2711_DMA40_INC		BIT(12)
++#define BCM2711_DMA40_SIZE_32		(0 << 13)
++#define BCM2711_DMA40_SIZE_64		(1 << 13)
++#define BCM2711_DMA40_SIZE_128		(2 << 13)
++#define BCM2711_DMA40_SIZE_256		(3 << 13)
++#define BCM2711_DMA40_IGNORE		BIT(15)
++#define BCM2711_DMA40_STRIDE(x)		((x) << 16) /* For 2D mode */
++
++#define BCM2711_DMA40_MEMCPY_FLAGS \
++	(BCM2711_DMA40_QOS(0) | \
++	 BCM2711_DMA40_PANIC_QOS(0) | \
++	 BCM2711_DMA40_WAIT_FOR_WRITES | \
++	 BCM2711_DMA40_DISDEBUG)
++
++#define BCM2711_DMA40_MEMCPY_XFER_INFO \
++	(BCM2711_DMA40_SIZE_128 | \
++	 BCM2711_DMA40_INC | \
++	 BCM2711_DMA40_BURST_LEN(16))
++
++struct bcm2835_dmadev *memcpy_parent;
++static void __iomem *memcpy_chan;
++static struct bcm2711_dma40_scb *memcpy_scb;
++static dma_addr_t memcpy_scb_dma;
++DEFINE_SPINLOCK(memcpy_lock);
++
++static const struct bcm2835_dma_cfg_data bcm2835_dma_cfg = {
++	.chan_40bit_mask = 0,
++	.dma_mask = DMA_BIT_MASK(32),
++};
++
++static const struct bcm2835_dma_cfg_data bcm2711_dma_cfg = {
++	.chan_40bit_mask = BIT(11) | BIT(12) | BIT(13) | BIT(14),
++	.dma_mask = DMA_BIT_MASK(36),
++};
++
+ static inline size_t bcm2835_dma_max_frame_length(struct bcm2835_chan *c)
+ {
+ 	/* lite and normal channels have different max frame length */
+@@ -201,6 +360,36 @@ static inline struct bcm2835_desc *to_bc
+ 	return container_of(t, struct bcm2835_desc, vd.tx);
+ }
+ 
++static inline uint32_t to_bcm2711_ti(uint32_t info)
++{
++	return ((info & BCM2835_DMA_INT_EN) ? BCM2711_DMA40_INTEN : 0) |
++		((info & BCM2835_DMA_WAIT_RESP) ? BCM2711_DMA40_WAIT_RESP : 0) |
++		((info & BCM2835_DMA_S_DREQ) ?
++		 (BCM2711_DMA40_S_DREQ | BCM2711_DMA40_WAIT_RD_RESP) : 0) |
++		((info & BCM2835_DMA_D_DREQ) ? BCM2711_DMA40_D_DREQ : 0) |
++		BCM2711_DMA40_PER_MAP((info >> 16) & 0x1f);
++}
++
++static inline uint32_t to_bcm2711_srci(uint32_t info)
++{
++	return ((info & BCM2835_DMA_S_INC) ? BCM2711_DMA40_INC : 0) |
++	       ((info & BCM2835_DMA_S_WIDTH) ? BCM2711_DMA40_SIZE_128 : 0) |
++	       BCM2711_DMA40_BURST_LEN(BCM2835_DMA_GET_BURST_LENGTH(info));
++}
++
++static inline uint32_t to_bcm2711_dsti(uint32_t info)
++{
++	return ((info & BCM2835_DMA_D_INC) ? BCM2711_DMA40_INC : 0) |
++	       ((info & BCM2835_DMA_D_WIDTH) ? BCM2711_DMA40_SIZE_128 : 0) |
++	       BCM2711_DMA40_BURST_LEN(BCM2835_DMA_GET_BURST_LENGTH(info));
++}
++
++static inline uint32_t to_bcm2711_cbaddr(dma_addr_t addr)
++{
++	BUG_ON(addr & 0x1f);
++	return (addr >> 5);
++}
++
+ static void bcm2835_dma_free_cb_chain(struct bcm2835_desc *desc)
+ {
+ 	size_t i;
+@@ -219,45 +408,53 @@ static void bcm2835_dma_desc_free(struct
+ }
+ 
+ static void bcm2835_dma_create_cb_set_length(
+-	struct bcm2835_chan *chan,
++	struct bcm2835_chan *c,
+ 	struct bcm2835_dma_cb *control_block,
+ 	size_t len,
+ 	size_t period_len,
+ 	size_t *total_len,
+ 	u32 finalextrainfo)
+ {
+-	size_t max_len = bcm2835_dma_max_frame_length(chan);
++	size_t max_len = bcm2835_dma_max_frame_length(c);
++	uint32_t cb_len;
+ 
+ 	/* set the length taking lite-channel limitations into account */
+-	control_block->length = min_t(u32, len, max_len);
++	cb_len = min_t(u32, len, max_len);
+ 
+-	/* finished if we have no period_length */
+-	if (!period_len)
+-		return;
++	if (period_len) {
++		/*
++		 * period_len means: that we need to generate
++		 * transfers that are terminating at every
++		 * multiple of period_len - this is typically
++		 * used to set the interrupt flag in info
++		 * which is required during cyclic transfers
++		 */
+ 
+-	/*
+-	 * period_len means: that we need to generate
+-	 * transfers that are terminating at every
+-	 * multiple of period_len - this is typically
+-	 * used to set the interrupt flag in info
+-	 * which is required during cyclic transfers
+-	 */
++		/* have we filled in period_length yet? */
++		if (*total_len + cb_len < period_len) {
++			/* update number of bytes in this period so far */
++			*total_len += cb_len;
++		} else {
++			/* calculate the length that remains to reach period_len */
++			cb_len = period_len - *total_len;
+ 
+-	/* have we filled in period_length yet? */
+-	if (*total_len + control_block->length < period_len) {
+-		/* update number of bytes in this period so far */
+-		*total_len += control_block->length;
+-		return;
++			/* reset total_length for next period */
++			*total_len = 0;
++		}
+ 	}
+ 
+-	/* calculate the length that remains to reach period_length */
+-	control_block->length = period_len - *total_len;
+-
+-	/* reset total_length for next period */
+-	*total_len = 0;
+-
+-	/* add extrainfo bits in info */
+-	control_block->info |= finalextrainfo;
++	if (c->is_40bit_channel) {
++		struct bcm2711_dma40_scb *scb =
++			(struct bcm2711_dma40_scb *)control_block;
++
++		scb->len = cb_len;
++		/* add extrainfo bits to ti */
++		scb->ti |= to_bcm2711_ti(finalextrainfo);
++	} else {
++		control_block->length = cb_len;
++		/* add extrainfo bits to info */
++		control_block->info |= finalextrainfo;
++	}
+ }
+ 
+ static inline size_t bcm2835_dma_count_frames_for_sg(
+@@ -280,7 +477,7 @@ static inline size_t bcm2835_dma_count_f
+ /**
+  * bcm2835_dma_create_cb_chain - create a control block and fills data in
+  *
+- * @chan:           the @dma_chan for which we run this
++ * @c:              the @bcm2835_chan for which we run this
+  * @direction:      the direction in which we transfer
+  * @cyclic:         it is a cyclic transfer
+  * @info:           the default info bits to apply per controlblock
+@@ -298,12 +495,11 @@ static inline size_t bcm2835_dma_count_f
+  * @gfp:            the GFP flag to use for allocation
+  */
+ static struct bcm2835_desc *bcm2835_dma_create_cb_chain(
+-	struct dma_chan *chan, enum dma_transfer_direction direction,
++	struct bcm2835_chan *c, enum dma_transfer_direction direction,
+ 	bool cyclic, u32 info, u32 finalextrainfo, size_t frames,
+ 	dma_addr_t src, dma_addr_t dst, size_t buf_len,
+ 	size_t period_len, gfp_t gfp)
+ {
+-	struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
+ 	size_t len = buf_len, total_len;
+ 	size_t frame;
+ 	struct bcm2835_desc *d;
+@@ -335,11 +531,23 @@ static struct bcm2835_desc *bcm2835_dma_
+ 
+ 		/* fill in the control block */
+ 		control_block = cb_entry->cb;
+-		control_block->info = info;
+-		control_block->src = src;
+-		control_block->dst = dst;
+-		control_block->stride = 0;
+-		control_block->next = 0;
++		if (c->is_40bit_channel) {
++			struct bcm2711_dma40_scb *scb =
++				(struct bcm2711_dma40_scb *)control_block;
++			scb->ti = to_bcm2711_ti(info);
++			scb->src = lower_32_bits(src);
++			scb->srci= upper_32_bits(src) | to_bcm2711_srci(info);
++			scb->dst = lower_32_bits(dst);
++			scb->dsti = upper_32_bits(dst) | to_bcm2711_dsti(info);
++			scb->next_cb = 0;
++		} else {
++			control_block->info = info;
++			control_block->src = src;
++			control_block->dst = dst;
++			control_block->stride = 0;
++			control_block->next = 0;
++		}
++
+ 		/* set up length in control_block if requested */
+ 		if (buf_len) {
+ 			/* calculate length honoring period_length */
+@@ -349,25 +557,51 @@ static struct bcm2835_desc *bcm2835_dma_
+ 				cyclic ? finalextrainfo : 0);
+ 
+ 			/* calculate new remaining length */
+-			len -= control_block->length;
++			if (c->is_40bit_channel)
++				len -= ((struct bcm2711_dma40_scb *)control_block)->len;
++			else
++				len -= control_block->length;
+ 		}
+ 
+ 		/* link this the last controlblock */
+-		if (frame)
++		if (frame && c->is_40bit_channel)
++			((struct bcm2711_dma40_scb *)
++			 d->cb_list[frame - 1].cb)->next_cb =
++				to_bcm2711_cbaddr(cb_entry->paddr);
++		if (frame && !c->is_40bit_channel)
+ 			d->cb_list[frame - 1].cb->next = cb_entry->paddr;
+ 
+ 		/* update src and dst and length */
+-		if (src && (info & BCM2835_DMA_S_INC))
+-			src += control_block->length;
+-		if (dst && (info & BCM2835_DMA_D_INC))
+-			dst += control_block->length;
++		if (src && (info & BCM2835_DMA_S_INC)) {
++			if (c->is_40bit_channel)
++				src += ((struct bcm2711_dma40_scb *)control_block)->len;
++			else
++				src += control_block->length;
++		}
++
++		if (dst && (info & BCM2835_DMA_D_INC)) {
++			if (c->is_40bit_channel)
++				dst += ((struct bcm2711_dma40_scb *)control_block)->len;
++			else
++				dst += control_block->length;
++		}
+ 
+ 		/* Length of total transfer */
+-		d->size += control_block->length;
++		if (c->is_40bit_channel)
++			d->size += ((struct bcm2711_dma40_scb *)control_block)->len;
++		else
++			d->size += control_block->length;
+ 	}
+ 
+ 	/* the last frame requires extra flags */
+-	d->cb_list[d->frames - 1].cb->info |= finalextrainfo;
++	if (c->is_40bit_channel) {
++		struct bcm2711_dma40_scb *scb =
++			(struct bcm2711_dma40_scb *)d->cb_list[d->frames-1].cb;
++
++		scb->ti |= to_bcm2711_ti(finalextrainfo);
++	} else {
++		d->cb_list[d->frames - 1].cb->info |= finalextrainfo;
++	}
+ 
+ 	/* detect a size mismatch */
+ 	if (buf_len && (d->size != buf_len))
+@@ -381,13 +615,12 @@ error_cb:
+ }
+ 
+ static void bcm2835_dma_fill_cb_chain_with_sg(
+-	struct dma_chan *chan,
++	struct bcm2835_chan *c,
+ 	enum dma_transfer_direction direction,
+ 	struct bcm2835_cb_entry *cb,
+ 	struct scatterlist *sgl,
+ 	unsigned int sg_len)
+ {
+-	struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
+ 	size_t len, max_len;
+ 	unsigned int i;
+ 	dma_addr_t addr;
+@@ -395,14 +628,35 @@ static void bcm2835_dma_fill_cb_chain_wi
+ 
+ 	max_len = bcm2835_dma_max_frame_length(c);
+ 	for_each_sg(sgl, sgent, sg_len, i) {
+-		for (addr = sg_dma_address(sgent), len = sg_dma_len(sgent);
+-		     len > 0;
+-		     addr += cb->cb->length, len -= cb->cb->length, cb++) {
+-			if (direction == DMA_DEV_TO_MEM)
+-				cb->cb->dst = addr;
+-			else
+-				cb->cb->src = addr;
+-			cb->cb->length = min(len, max_len);
++		if (c->is_40bit_channel) {
++			struct bcm2711_dma40_scb *scb;
++
++			for (addr = sg_dma_address(sgent),
++				     len = sg_dma_len(sgent);
++				     len > 0;
++			     addr += scb->len, len -= scb->len, cb++) {
++				scb = (struct bcm2711_dma40_scb *)cb->cb;
++				if (direction == DMA_DEV_TO_MEM) {
++					scb->dst = lower_32_bits(addr);
++					scb->dsti = upper_32_bits(addr) | BCM2711_DMA40_INC;
++				} else {
++					scb->src = lower_32_bits(addr);
++					scb->srci = upper_32_bits(addr) | BCM2711_DMA40_INC;
++				}
++				scb->len = min(len, max_len);
++			}
++		} else {
++			for (addr = sg_dma_address(sgent),
++				     len = sg_dma_len(sgent);
++			     len > 0;
++			     addr += cb->cb->length, len -= cb->cb->length,
++			     cb++) {
++				if (direction == DMA_DEV_TO_MEM)
++					cb->cb->dst = addr;
++				else
++					cb->cb->src = addr;
++				cb->cb->length = min(len, max_len);
++			}
+ 		}
+ 	}
+ }
+@@ -410,29 +664,74 @@ static void bcm2835_dma_fill_cb_chain_wi
+ static void bcm2835_dma_abort(struct bcm2835_chan *c)
+ {
+ 	void __iomem *chan_base = c->chan_base;
+-	long int timeout = 10000;
++	long timeout = 100;
+ 
+-	/*
+-	 * A zero control block address means the channel is idle.
+-	 * (The ACTIVE flag in the CS register is not a reliable indicator.)
+-	 */
+-	if (!readl(chan_base + BCM2835_DMA_ADDR))
+-		return;
++	if (c->is_40bit_channel) {
++		/*
++		 * A zero control block address means the channel is idle.
++		 * (The ACTIVE flag in the CS register is not a reliable indicator.)
++		 */
++		if (!readl(chan_base + BCM2711_DMA40_CB))
++			return;
+ 
+-	/* Write 0 to the active bit - Pause the DMA */
+-	writel(0, chan_base + BCM2835_DMA_CS);
++		/* Pause the current DMA */
++		writel(readl(chan_base + BCM2711_DMA40_CS) & ~BCM2711_DMA40_ACTIVE,
++			     chan_base + BCM2711_DMA40_CS);
++
++		/* wait for outstanding transactions to complete */
++		while ((readl(chan_base + BCM2711_DMA40_CS) & BCM2711_DMA40_TRANSACTIONS) &&
++			--timeout)
++			cpu_relax();
++
++		/* Peripheral might be stuck and fail to complete */
++		if (!timeout)
++			dev_err(c->vc.chan.device->dev,
++				"failed to complete pause on dma %d (CS:%08x)\n", c->ch,
++				readl(chan_base + BCM2711_DMA40_CS));
++
++		/* Set CS back to default state */
++		writel(BCM2711_DMA40_PROT, chan_base + BCM2711_DMA40_CS);
++
++		/* Reset the DMA */
++		writel(readl(chan_base + BCM2711_DMA40_DEBUG) | BCM2711_DMA40_DEBUG_RESET,
++		       chan_base + BCM2711_DMA40_DEBUG);
++	} else {
++		/*
++		 * A zero control block address means the channel is idle.
++		 * (The ACTIVE flag in the CS register is not a reliable indicator.)
++		 */
++		if (!readl(chan_base + BCM2835_DMA_ADDR))
++			return;
+ 
+-	/* Wait for any current AXI transfer to complete */
+-	while ((readl(chan_base + BCM2835_DMA_CS) &
+-		BCM2835_DMA_WAITING_FOR_WRITES) && --timeout)
+-		cpu_relax();
+-
+-	/* Peripheral might be stuck and fail to signal AXI write responses */
+-	if (!timeout)
+-		dev_err(c->vc.chan.device->dev,
+-			"failed to complete outstanding writes\n");
++		/* We need to clear the next DMA block pending */
++		writel(0, chan_base + BCM2835_DMA_NEXTCB);
+ 
+-	writel(BCM2835_DMA_RESET, chan_base + BCM2835_DMA_CS);
++		/* Abort the DMA, which needs to be enabled to complete */
++		writel(readl(chan_base + BCM2835_DMA_CS) | BCM2835_DMA_ABORT | BCM2835_DMA_ACTIVE,
++		      chan_base + BCM2835_DMA_CS);
++
++		/* wait for DMA to be aborted */
++		while ((readl(chan_base + BCM2835_DMA_CS) & BCM2835_DMA_ABORT) && --timeout)
++			cpu_relax();
++
++		/* Write 0 to the active bit - Pause the DMA */
++		writel(readl(chan_base + BCM2835_DMA_CS) & ~BCM2835_DMA_ACTIVE,
++		       chan_base + BCM2835_DMA_CS);
++
++		/*
++		 * Peripheral might be stuck and fail to complete
++		 * This is expected when dreqs are enabled but not asserted
++		 * so only report error in non dreq case
++		 */
++		if (!timeout && !(readl(chan_base + BCM2835_DMA_TI) &
++		   (BCM2835_DMA_S_DREQ | BCM2835_DMA_D_DREQ)))
++			dev_err(c->vc.chan.device->dev,
++				"failed to complete pause on dma %d (CS:%08x)\n", c->ch,
++				readl(chan_base + BCM2835_DMA_CS));
++
++		/* Set CS back to default state and reset the DMA */
++		writel(BCM2835_DMA_RESET, chan_base + BCM2835_DMA_CS);
++	}
+ }
+ 
+ static void bcm2835_dma_start_desc(struct bcm2835_chan *c)
+@@ -449,8 +748,16 @@ static void bcm2835_dma_start_desc(struc
+ 
+ 	c->desc = d = to_bcm2835_dma_desc(&vd->tx);
+ 
+-	writel(d->cb_list[0].paddr, c->chan_base + BCM2835_DMA_ADDR);
+-	writel(BCM2835_DMA_ACTIVE, c->chan_base + BCM2835_DMA_CS);
++	if (c->is_40bit_channel) {
++		writel(to_bcm2711_cbaddr(d->cb_list[0].paddr),
++		       c->chan_base + BCM2711_DMA40_CB);
++		writel(BCM2711_DMA40_ACTIVE | BCM2711_DMA40_PROT | BCM2711_DMA40_CS_FLAGS(c->dreq),
++		       c->chan_base + BCM2711_DMA40_CS);
++	} else {
++		writel(d->cb_list[0].paddr, c->chan_base + BCM2835_DMA_ADDR);
++		writel(BCM2835_DMA_ACTIVE | BCM2835_DMA_CS_FLAGS(c->dreq),
++		       c->chan_base + BCM2835_DMA_CS);
++	}
+ }
+ 
+ static irqreturn_t bcm2835_dma_callback(int irq, void *data)
+@@ -477,8 +784,13 @@ static irqreturn_t bcm2835_dma_callback(
+ 	 * if this IRQ handler is threaded.) If the channel is finished, it
+ 	 * will remain idle despite the ACTIVE flag being set.
+ 	 */
+-	writel(BCM2835_DMA_INT | BCM2835_DMA_ACTIVE,
+-	       c->chan_base + BCM2835_DMA_CS);
++	if (c->is_40bit_channel)
++		writel(BCM2835_DMA_INT | BCM2711_DMA40_ACTIVE | BCM2711_DMA40_PROT |
++		       BCM2711_DMA40_CS_FLAGS(c->dreq),
++		       c->chan_base + BCM2711_DMA40_CS);
++	else
++		writel(BCM2835_DMA_INT | BCM2835_DMA_ACTIVE | BCM2835_DMA_CS_FLAGS(c->dreq),
++		       c->chan_base + BCM2835_DMA_CS);
+ 
+ 	d = c->desc;
+ 
+@@ -540,20 +852,39 @@ static size_t bcm2835_dma_desc_size_pos(
+ 	unsigned int i;
+ 	size_t size;
+ 
+-	for (size = i = 0; i < d->frames; i++) {
+-		struct bcm2835_dma_cb *control_block = d->cb_list[i].cb;
+-		size_t this_size = control_block->length;
+-		dma_addr_t dma;
++	if (d->c->is_40bit_channel) {
++		for (size = i = 0; i < d->frames; i++) {
++			struct bcm2711_dma40_scb *control_block =
++				(struct bcm2711_dma40_scb *)d->cb_list[i].cb;
++			size_t this_size = control_block->len;
++			dma_addr_t dma;
+ 
+-		if (d->dir == DMA_DEV_TO_MEM)
+-			dma = control_block->dst;
+-		else
+-			dma = control_block->src;
++			if (d->dir == DMA_DEV_TO_MEM)
++				dma = control_block->dst;
++			else
++				dma = control_block->src;
+ 
+-		if (size)
+-			size += this_size;
+-		else if (addr >= dma && addr < dma + this_size)
+-			size += dma + this_size - addr;
++			if (size)
++				size += this_size;
++			else if (addr >= dma && addr < dma + this_size)
++				size += dma + this_size - addr;
++		}
++	} else {
++		for (size = i = 0; i < d->frames; i++) {
++			struct bcm2835_dma_cb *control_block = d->cb_list[i].cb;
++			size_t this_size = control_block->length;
++			dma_addr_t dma;
++
++			if (d->dir == DMA_DEV_TO_MEM)
++				dma = control_block->dst;
++			else
++				dma = control_block->src;
++
++			if (size)
++				size += this_size;
++			else if (addr >= dma && addr < dma + this_size)
++				size += dma + this_size - addr;
++		}
+ 	}
+ 
+ 	return size;
+@@ -580,12 +911,25 @@ static enum dma_status bcm2835_dma_tx_st
+ 		struct bcm2835_desc *d = c->desc;
+ 		dma_addr_t pos;
+ 
+-		if (d->dir == DMA_MEM_TO_DEV)
++		if (d->dir == DMA_MEM_TO_DEV && c->is_40bit_channel) {
++			u64 lo_bits, hi_bits;
++
++			lo_bits = readl(c->chan_base + BCM2711_DMA40_SRC);
++			hi_bits = readl(c->chan_base + BCM2711_DMA40_SRCI) & 0xff;
++			pos = (hi_bits << 32) | lo_bits;
++		} else if (d->dir == DMA_MEM_TO_DEV && !c->is_40bit_channel) {
+ 			pos = readl(c->chan_base + BCM2835_DMA_SOURCE_AD);
+-		else if (d->dir == DMA_DEV_TO_MEM)
++		} else if (d->dir == DMA_DEV_TO_MEM && c->is_40bit_channel) {
++			u64 lo_bits, hi_bits;
++
++			lo_bits = readl(c->chan_base + BCM2711_DMA40_DEST);
++			hi_bits = readl(c->chan_base + BCM2711_DMA40_DESTI) & 0xff;
++			pos = (hi_bits << 32) | lo_bits;
++		} else if (d->dir == DMA_DEV_TO_MEM && !c->is_40bit_channel) {
+ 			pos = readl(c->chan_base + BCM2835_DMA_DEST_AD);
+-		else
++		} else {
+ 			pos = 0;
++		}
+ 
+ 		txstate->residue = bcm2835_dma_desc_size_pos(d, pos);
+ 	} else {
+@@ -615,8 +959,10 @@ static struct dma_async_tx_descriptor *b
+ {
+ 	struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
+ 	struct bcm2835_desc *d;
+-	u32 info = BCM2835_DMA_D_INC | BCM2835_DMA_S_INC;
+-	u32 extra = BCM2835_DMA_INT_EN | BCM2835_DMA_WAIT_RESP;
++	u32 info = BCM2835_DMA_D_INC | BCM2835_DMA_S_INC |
++		   WAIT_RESP(c->dreq) | WIDE_SOURCE(c->dreq) |
++		   WIDE_DEST(c->dreq) | BURST_LENGTH(c->dreq);
++	u32 extra = BCM2835_DMA_INT_EN;
+ 	size_t max_len = bcm2835_dma_max_frame_length(c);
+ 	size_t frames;
+ 
+@@ -628,7 +974,7 @@ static struct dma_async_tx_descriptor *b
+ 	frames = bcm2835_dma_frames_for_length(len, max_len);
+ 
+ 	/* allocate the CB chain - this also fills in the pointers */
+-	d = bcm2835_dma_create_cb_chain(chan, DMA_MEM_TO_MEM, false,
++	d = bcm2835_dma_create_cb_chain(c, DMA_MEM_TO_MEM, false,
+ 					info, extra, frames,
+ 					src, dst, len, 0, GFP_KERNEL);
+ 	if (!d)
+@@ -646,7 +992,8 @@ static struct dma_async_tx_descriptor *b
+ 	struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
+ 	struct bcm2835_desc *d;
+ 	dma_addr_t src = 0, dst = 0;
+-	u32 info = BCM2835_DMA_WAIT_RESP;
++	u32 info = WAIT_RESP(c->dreq) | WIDE_SOURCE(c->dreq) |
++		   WIDE_DEST(c->dreq) | BURST_LENGTH(c->dreq);
+ 	u32 extra = BCM2835_DMA_INT_EN;
+ 	size_t frames;
+ 
+@@ -662,12 +1009,12 @@ static struct dma_async_tx_descriptor *b
+ 	if (direction == DMA_DEV_TO_MEM) {
+ 		if (c->cfg.src_addr_width != DMA_SLAVE_BUSWIDTH_4_BYTES)
+ 			return NULL;
+-		src = c->cfg.src_addr;
++		src = phys_to_dma(chan->device->dev, c->cfg.src_addr);
+ 		info |= BCM2835_DMA_S_DREQ | BCM2835_DMA_D_INC;
+ 	} else {
+ 		if (c->cfg.dst_addr_width != DMA_SLAVE_BUSWIDTH_4_BYTES)
+ 			return NULL;
+-		dst = c->cfg.dst_addr;
++		dst = phys_to_dma(chan->device->dev, c->cfg.dst_addr);
+ 		info |= BCM2835_DMA_D_DREQ | BCM2835_DMA_S_INC;
+ 	}
+ 
+@@ -675,7 +1022,7 @@ static struct dma_async_tx_descriptor *b
+ 	frames = bcm2835_dma_count_frames_for_sg(c, sgl, sg_len);
+ 
+ 	/* allocate the CB chain */
+-	d = bcm2835_dma_create_cb_chain(chan, direction, false,
++	d = bcm2835_dma_create_cb_chain(c, direction, false,
+ 					info, extra,
+ 					frames, src, dst, 0, 0,
+ 					GFP_NOWAIT);
+@@ -683,7 +1030,7 @@ static struct dma_async_tx_descriptor *b
+ 		return NULL;
+ 
+ 	/* fill in frames with scatterlist pointers */
+-	bcm2835_dma_fill_cb_chain_with_sg(chan, direction, d->cb_list,
++	bcm2835_dma_fill_cb_chain_with_sg(c, direction, d->cb_list,
+ 					  sgl, sg_len);
+ 
+ 	return vchan_tx_prep(&c->vc, &d->vd, flags);
+@@ -698,7 +1045,8 @@ static struct dma_async_tx_descriptor *b
+ 	struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
+ 	struct bcm2835_desc *d;
+ 	dma_addr_t src, dst;
+-	u32 info = BCM2835_DMA_WAIT_RESP;
++	u32 info = WAIT_RESP(c->dreq) | WIDE_SOURCE(c->dreq) |
++		   WIDE_DEST(c->dreq) | BURST_LENGTH(c->dreq);
+ 	u32 extra = 0;
+ 	size_t max_len = bcm2835_dma_max_frame_length(c);
+ 	size_t frames;
+@@ -736,13 +1084,13 @@ static struct dma_async_tx_descriptor *b
+ 	if (direction == DMA_DEV_TO_MEM) {
+ 		if (c->cfg.src_addr_width != DMA_SLAVE_BUSWIDTH_4_BYTES)
+ 			return NULL;
+-		src = c->cfg.src_addr;
++		src = phys_to_dma(chan->device->dev, c->cfg.src_addr);
+ 		dst = buf_addr;
+ 		info |= BCM2835_DMA_S_DREQ | BCM2835_DMA_D_INC;
+ 	} else {
+ 		if (c->cfg.dst_addr_width != DMA_SLAVE_BUSWIDTH_4_BYTES)
+ 			return NULL;
+-		dst = c->cfg.dst_addr;
++		dst = phys_to_dma(chan->device->dev, c->cfg.dst_addr);
+ 		src = buf_addr;
+ 		info |= BCM2835_DMA_D_DREQ | BCM2835_DMA_S_INC;
+ 
+@@ -762,7 +1110,7 @@ static struct dma_async_tx_descriptor *b
+ 	 * note that we need to use GFP_NOWAIT, as the ALSA i2s dmaengine
+ 	 * implementation calls prep_dma_cyclic with interrupts disabled.
+ 	 */
+-	d = bcm2835_dma_create_cb_chain(chan, direction, true,
++	d = bcm2835_dma_create_cb_chain(c, direction, true,
+ 					info, extra,
+ 					frames, src, dst, buf_len,
+ 					period_len, GFP_NOWAIT);
+@@ -770,7 +1118,12 @@ static struct dma_async_tx_descriptor *b
+ 		return NULL;
+ 
+ 	/* wrap around into a loop */
+-	d->cb_list[d->frames - 1].cb->next = d->cb_list[0].paddr;
++	if (c->is_40bit_channel)
++		((struct bcm2711_dma40_scb *)
++		 d->cb_list[frames - 1].cb)->next_cb =
++			to_bcm2711_cbaddr(d->cb_list[0].paddr);
++	else
++		d->cb_list[d->frames - 1].cb->next = d->cb_list[0].paddr;
+ 
+ 	return vchan_tx_prep(&c->vc, &d->vd, flags);
+ }
+@@ -831,9 +1184,11 @@ static int bcm2835_dma_chan_init(struct
+ 	c->irq_number = irq;
+ 	c->irq_flags = irq_flags;
+ 
+-	/* check in DEBUG register if this is a LITE channel */
+-	if (readl(c->chan_base + BCM2835_DMA_DEBUG) &
+-		BCM2835_DMA_DEBUG_LITE)
++	/* check for 40bit and lite channels */
++	if (d->cfg_data->chan_40bit_mask & BIT(chan_id))
++		c->is_40bit_channel = true;
++	else if (readl(c->chan_base + BCM2835_DMA_DEBUG) &
++		 BCM2835_DMA_DEBUG_LITE)
+ 		c->is_lite_channel = true;
+ 
+ 	return 0;
+@@ -854,7 +1209,8 @@ static void bcm2835_dma_free(struct bcm2
+ }
+ 
+ static const struct of_device_id bcm2835_dma_of_match[] = {
+-	{ .compatible = "brcm,bcm2835-dma", },
++	{ .compatible = "brcm,bcm2835-dma", .data = &bcm2835_dma_cfg },
++	{ .compatible = "brcm,bcm2711-dma", .data = &bcm2711_dma_cfg },
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(of, bcm2835_dma_of_match);
+@@ -877,7 +1233,10 @@ static struct dma_chan *bcm2835_dma_xlat
+ 
+ static int bcm2835_dma_probe(struct platform_device *pdev)
+ {
++	const struct bcm2835_dma_cfg_data *cfg_data;
++	const struct of_device_id *of_id;
+ 	struct bcm2835_dmadev *od;
++	struct resource *res;
+ 	void __iomem *base;
+ 	int rc;
+ 	int i, j;
+@@ -885,11 +1244,20 @@ static int bcm2835_dma_probe(struct plat
+ 	int irq_flags;
+ 	uint32_t chans_available;
+ 	char chan_name[BCM2835_DMA_CHAN_NAME_SIZE];
++	int chan_count, chan_start, chan_end;
++
++	of_id = of_match_node(bcm2835_dma_of_match, pdev->dev.of_node);
++	if (!of_id) {
++		dev_err(&pdev->dev, "Failed to match compatible string\n");
++		return -EINVAL;
++	}
++
++	cfg_data = of_id->data;
+ 
+ 	if (!pdev->dev.dma_mask)
+ 		pdev->dev.dma_mask = &pdev->dev.coherent_dma_mask;
+ 
+-	rc = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
++	rc = dma_set_mask_and_coherent(&pdev->dev, cfg_data->dma_mask);
+ 	if (rc) {
+ 		dev_err(&pdev->dev, "Unable to set DMA mask\n");
+ 		return rc;
+@@ -901,10 +1269,17 @@ static int bcm2835_dma_probe(struct plat
+ 
+ 	dma_set_max_seg_size(&pdev->dev, 0x3FFFFFFF);
+ 
+-	base = devm_platform_ioremap_resource(pdev, 0);
++	base = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
+ 	if (IS_ERR(base))
+ 		return PTR_ERR(base);
+ 
++	/* The set of channels can be split across multiple instances. */
++	chan_start = ((u32)(uintptr_t)base / BCM2835_DMA_CHAN_SIZE) & 0xf;
++	base -= BCM2835_DMA_CHAN(chan_start);
++	chan_count = resource_size(res) / BCM2835_DMA_CHAN_SIZE;
++	chan_end = min(chan_start + chan_count,
++			 BCM2835_DMA_MAX_DMA_CHAN_SUPPORTED + 1);
++
+ 	od->base = base;
+ 
+ 	dma_cap_set(DMA_SLAVE, od->ddev.cap_mask);
+@@ -940,6 +1315,14 @@ static int bcm2835_dma_probe(struct plat
+ 		return -ENOMEM;
+ 	}
+ 
++	of_id = of_match_node(bcm2835_dma_of_match, pdev->dev.of_node);
++	if (!of_id) {
++		dev_err(&pdev->dev, "Failed to match compatible string\n");
++		return -EINVAL;
++	}
++
++	od->cfg_data = cfg_data;
++
+ 	/* Request DMA channel mask from device tree */
+ 	if (of_property_read_u32(pdev->dev.of_node,
+ 			"brcm,dma-channel-mask",
+@@ -949,8 +1332,36 @@ static int bcm2835_dma_probe(struct plat
+ 		goto err_no_dma;
+ 	}
+ 
++#ifdef CONFIG_DMA_BCM2708
++	/* One channel is reserved for the legacy API */
++	if (chans_available & BCM2835_DMA_BULK_MASK) {
++		rc = bcm_dmaman_probe(pdev, base,
++				      chans_available & BCM2835_DMA_BULK_MASK);
++		if (rc)
++			dev_err(&pdev->dev,
++				"Failed to initialize the legacy API\n");
++
++		chans_available &= ~BCM2835_DMA_BULK_MASK;
++	}
++#endif
++
++	/* And possibly one for the 40-bit DMA memcpy API */
++	if (chans_available & od->cfg_data->chan_40bit_mask &
++	    BIT(BCM2711_DMA_MEMCPY_CHAN)) {
++		memcpy_parent = od;
++		memcpy_chan = BCM2835_DMA_CHANIO(base, BCM2711_DMA_MEMCPY_CHAN);
++		memcpy_scb = dma_alloc_coherent(memcpy_parent->ddev.dev,
++						sizeof(*memcpy_scb),
++						&memcpy_scb_dma, GFP_KERNEL);
++		if (!memcpy_scb)
++			dev_warn(&pdev->dev,
++				 "Failed to allocated memcpy scb\n");
++
++		chans_available &= ~BIT(BCM2711_DMA_MEMCPY_CHAN);
++	}
++
+ 	/* get irqs for each channel that we support */
+-	for (i = 0; i <= BCM2835_DMA_MAX_DMA_CHAN_SUPPORTED; i++) {
++	for (i = chan_start; i < chan_end; i++) {
+ 		/* skip masked out channels */
+ 		if (!(chans_available & (1 << i))) {
+ 			irq[i] = -1;
+@@ -973,13 +1384,17 @@ static int bcm2835_dma_probe(struct plat
+ 		irq[i] = platform_get_irq(pdev, i < 11 ? i : 11);
+ 	}
+ 
++	chan_count = 0;
++
+ 	/* get irqs for each channel */
+-	for (i = 0; i <= BCM2835_DMA_MAX_DMA_CHAN_SUPPORTED; i++) {
++	for (i = chan_start; i < chan_end; i++) {
+ 		/* skip channels without irq */
+ 		if (irq[i] < 0)
+ 			continue;
+ 
+ 		/* check if there are other channels that also use this irq */
++		/* FIXME: This will fail if interrupts are shared across
++		   instances */
+ 		irq_flags = 0;
+ 		for (j = 0; j <= BCM2835_DMA_MAX_DMA_CHAN_SUPPORTED; j++)
+ 			if ((i != j) && (irq[j] == irq[i])) {
+@@ -991,9 +1406,10 @@ static int bcm2835_dma_probe(struct plat
+ 		rc = bcm2835_dma_chan_init(od, i, irq[i], irq_flags);
+ 		if (rc)
+ 			goto err_no_dma;
++		chan_count++;
+ 	}
+ 
+-	dev_dbg(&pdev->dev, "Initialized %i DMA channels\n", i);
++	dev_dbg(&pdev->dev, "Initialized %i DMA channels\n", chan_count);
+ 
+ 	/* Device-tree DMA controller registration */
+ 	rc = of_dma_controller_register(pdev->dev.of_node,
+@@ -1023,7 +1439,15 @@ static void bcm2835_dma_remove(struct pl
+ {
+ 	struct bcm2835_dmadev *od = platform_get_drvdata(pdev);
+ 
++	bcm_dmaman_remove(pdev);
+ 	dma_async_device_unregister(&od->ddev);
++	if (memcpy_parent == od) {
++		dma_free_coherent(&pdev->dev, sizeof(*memcpy_scb), memcpy_scb,
++				  memcpy_scb_dma);
++		memcpy_parent = NULL;
++		memcpy_scb = NULL;
++		memcpy_chan = NULL;
++	}
+ 	bcm2835_dma_free(od);
+ }
+ 
+@@ -1036,7 +1460,22 @@ static struct platform_driver bcm2835_dm
+ 	},
+ };
+ 
+-module_platform_driver(bcm2835_dma_driver);
++static int bcm2835_dma_init(void)
++{
++	return platform_driver_register(&bcm2835_dma_driver);
++}
++
++static void bcm2835_dma_exit(void)
++{
++	platform_driver_unregister(&bcm2835_dma_driver);
++}
++
++/*
++ * Load after serial driver (arch_initcall) so we see the messages if it fails,
++ * but before drivers (module_init) that need a DMA channel.
++ */
++subsys_initcall(bcm2835_dma_init);
++module_exit(bcm2835_dma_exit);
+ 
+ MODULE_ALIAS("platform:bcm2835-dma");
+ MODULE_DESCRIPTION("BCM2835 DMA engine driver");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0043-rtc-Add-SPI-alias-for-pcf2123-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0043-rtc-Add-SPI-alias-for-pcf2123-driver.patch
new file mode 100644
index 00000000..8b2d11ec
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0043-rtc-Add-SPI-alias-for-pcf2123-driver.patch
@@ -0,0 +1,20 @@
+From ee79ef68ef6caa1a2ec4d47819b09c24f17315fc Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Wed, 15 Jun 2016 16:48:41 +0100
+Subject: [PATCH 043/697] rtc: Add SPI alias for pcf2123 driver
+
+Without this alias, Device Tree won't cause the driver
+to be loaded.
+
+See: https://github.com/raspberrypi/linux/pull/1510
+---
+ drivers/rtc/rtc-pcf2123.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/rtc/rtc-pcf2123.c
++++ b/drivers/rtc/rtc-pcf2123.c
+@@ -479,3 +479,4 @@ module_spi_driver(pcf2123_driver);
+ MODULE_AUTHOR("Chris Verges <chrisv@cyberswitching.com>");
+ MODULE_DESCRIPTION("NXP PCF2123 RTC driver");
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS("spi:rtc-pcf2123");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0044-watchdog-bcm2835-Support-setting-reboot-partition.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0044-watchdog-bcm2835-Support-setting-reboot-partition.patch
new file mode 100644
index 00000000..2744788e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0044-watchdog-bcm2835-Support-setting-reboot-partition.patch
@@ -0,0 +1,102 @@
+From 23bd9095c0e8842e3b2d0fb377a5b16b22a53103 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
+Date: Fri, 7 Oct 2016 16:50:59 +0200
+Subject: [PATCH 044/697] watchdog: bcm2835: Support setting reboot partition
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The Raspberry Pi firmware looks at the RSTS register to know which
+partition to boot from. The reboot syscall command
+LINUX_REBOOT_CMD_RESTART2 supports passing in a string argument.
+
+Add support for passing in a partition number 0..63 to boot from.
+Partition 63 is a special partiton indicating halt.
+If the partition doesn't exist, the firmware falls back to partition 0.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+---
+ drivers/watchdog/bcm2835_wdt.c | 49 +++++++++++++++++++---------------
+ 1 file changed, 27 insertions(+), 22 deletions(-)
+
+--- a/drivers/watchdog/bcm2835_wdt.c
++++ b/drivers/watchdog/bcm2835_wdt.c
+@@ -32,13 +32,7 @@
+ #define PM_RSTC_WRCFG_SET		0x00000030
+ #define PM_RSTC_WRCFG_FULL_RESET	0x00000020
+ #define PM_RSTC_RESET			0x00000102
+-
+-/*
+- * The Raspberry Pi firmware uses the RSTS register to know which partition
+- * to boot from. The partition value is spread into bits 0, 2, 4, 6, 8, 10.
+- * Partition 63 is a special partition used by the firmware to indicate halt.
+- */
+-#define PM_RSTS_RASPBERRYPI_HALT	0x555
++#define PM_RSTS_PARTITION_CLR          0xfffffaaa
+ 
+ #define SECS_TO_WDOG_TICKS(x) ((x) << 16)
+ #define WDOG_TICKS_TO_SECS(x) ((x) >> 16)
+@@ -98,9 +92,24 @@ static unsigned int bcm2835_wdt_get_time
+ 	return WDOG_TICKS_TO_SECS(ret & PM_WDOG_TIME_SET);
+ }
+ 
+-static void __bcm2835_restart(struct bcm2835_wdt *wdt)
++/*
++ * The Raspberry Pi firmware uses the RSTS register to know which partiton
++ * to boot from. The partiton value is spread into bits 0, 2, 4, 6, 8, 10.
++ * Partiton 63 is a special partition used by the firmware to indicate halt.
++ */
++
++static void __bcm2835_restart(struct bcm2835_wdt *wdt, u8 partition)
+ {
+-	u32 val;
++	u32 val, rsts;
++
++	rsts = (partition & BIT(0)) | ((partition & BIT(1)) << 1) |
++	       ((partition & BIT(2)) << 2) | ((partition & BIT(3)) << 3) |
++	       ((partition & BIT(4)) << 4) | ((partition & BIT(5)) << 5);
++
++	val = readl_relaxed(wdt->base + PM_RSTS);
++	val &= PM_RSTS_PARTITION_CLR;
++	val |= PM_PASSWORD | rsts;
++	writel_relaxed(val, wdt->base + PM_RSTS);
+ 
+ 	/* use a timeout of 10 ticks (~150us) */
+ 	writel_relaxed(10 | PM_PASSWORD, wdt->base + PM_WDOG);
+@@ -118,7 +127,13 @@ static int bcm2835_restart(struct watchd
+ {
+ 	struct bcm2835_wdt *wdt = watchdog_get_drvdata(wdog);
+ 
+-	__bcm2835_restart(wdt);
++	unsigned long long val;
++	u8 partition = 0;
++
++	if (data && !kstrtoull(data, 0, &val) && val <= 63)
++		partition = val;
++
++	__bcm2835_restart(wdt, partition);
+ 
+ 	return 0;
+ }
+@@ -153,19 +168,9 @@ static struct watchdog_device bcm2835_wd
+ static void bcm2835_power_off(void)
+ {
+ 	struct bcm2835_wdt *wdt = bcm2835_power_off_wdt;
+-	u32 val;
+-
+-	/*
+-	 * We set the watchdog hard reset bit here to distinguish this reset
+-	 * from the normal (full) reset. bootcode.bin will not reboot after a
+-	 * hard reset.
+-	 */
+-	val = readl_relaxed(wdt->base + PM_RSTS);
+-	val |= PM_PASSWORD | PM_RSTS_RASPBERRYPI_HALT;
+-	writel_relaxed(val, wdt->base + PM_RSTS);
+ 
+-	/* Continue with normal reset mechanism */
+-	__bcm2835_restart(wdt);
++	/* Partition 63 tells the firmware that this is a halt */
++	__bcm2835_restart(wdt, 63);
+ }
+ 
+ static int bcm2835_wdt_probe(struct platform_device *pdev)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0045-reboot-Use-power-off-rather-than-busy-spinning-when-.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0045-reboot-Use-power-off-rather-than-busy-spinning-when-.patch
new file mode 100644
index 00000000..2525cd23
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0045-reboot-Use-power-off-rather-than-busy-spinning-when-.patch
@@ -0,0 +1,49 @@
+From 76f6475c036de43457c980bb61560f4f0d2e8210 Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Tue, 5 Apr 2016 19:40:12 +0100
+Subject: [PATCH 045/697] reboot: Use power off rather than busy spinning when
+ halt is requested
+
+reboot: Use power off rather than busy spinning when halt is requested
+
+Busy spinning after halt is dumb
+We've previously applied this patch to arch/arm
+but it is currenltly missing in arch/arm64
+
+Pi4 after "sudo halt" uses 520mA
+Pi4 after "sudo shutdown now" uses 310mA
+
+Make them both use the lower powered option
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ arch/arm/kernel/reboot.c    | 4 +---
+ arch/arm64/kernel/process.c | 4 +---
+ 2 files changed, 2 insertions(+), 6 deletions(-)
+
+--- a/arch/arm/kernel/reboot.c
++++ b/arch/arm/kernel/reboot.c
+@@ -102,9 +102,7 @@ void machine_shutdown(void)
+  */
+ void machine_halt(void)
+ {
+-	local_irq_disable();
+-	smp_send_stop();
+-	while (1);
++	machine_power_off();
+ }
+ 
+ /*
+--- a/arch/arm64/kernel/process.c
++++ b/arch/arm64/kernel/process.c
+@@ -97,9 +97,7 @@ void machine_shutdown(void)
+  */
+ void machine_halt(void)
+ {
+-	local_irq_disable();
+-	smp_send_stop();
+-	while (1);
++	machine_power_off();
+ }
+ 
+ /*
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0046-bcm2835-rng-Avoid-initialising-if-already-enabled.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0046-bcm2835-rng-Avoid-initialising-if-already-enabled.patch
new file mode 100644
index 00000000..321a6de0
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0046-bcm2835-rng-Avoid-initialising-if-already-enabled.patch
@@ -0,0 +1,25 @@
+From 66bea8024da1f06fc766b32f2be284040481d651 Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Tue, 6 Dec 2016 17:05:39 +0000
+Subject: [PATCH 046/697] bcm2835-rng: Avoid initialising if already enabled
+
+Avoids the 0x40000 cycles of warmup again if firmware has already used it
+---
+ drivers/char/hw_random/bcm2835-rng.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/char/hw_random/bcm2835-rng.c
++++ b/drivers/char/hw_random/bcm2835-rng.c
+@@ -107,8 +107,10 @@ static int bcm2835_rng_init(struct hwrng
+ 	}
+ 
+ 	/* set warm-up count & enable */
+-	rng_writel(priv, RNG_WARMUP_COUNT, RNG_STATUS);
+-	rng_writel(priv, RNG_RBGEN, RNG_CTRL);
++	if (!(rng_readl(priv, RNG_CTRL) & RNG_RBGEN)) {
++		rng_writel(priv, RNG_WARMUP_COUNT, RNG_STATUS);
++		rng_writel(priv, RNG_RBGEN, RNG_CTRL);
++	}
+ 
+ 	return ret;
+ }
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0047-Update-vfpmodule.c.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0047-Update-vfpmodule.c.patch
new file mode 100644
index 00000000..6a0b5e81
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0047-Update-vfpmodule.c.patch
@@ -0,0 +1,137 @@
+From 1f82489c12ee1f104649498bc6b67d9d217602e1 Mon Sep 17 00:00:00 2001
+From: Claggy3 <stephen.maclagan@hotmail.com>
+Date: Sat, 11 Feb 2017 14:00:30 +0000
+Subject: [PATCH 047/697] Update vfpmodule.c
+
+Christopher Alexander Tobias Schulze - May 2, 2015, 11:57 a.m.
+This patch fixes a problem with VFP state save and restore related
+to exception handling (panic with message "BUG: unsupported FP
+instruction in kernel mode") present on VFP11 floating point units
+(as used with ARM1176JZF-S CPUs, e.g. on first generation Raspberry
+Pi boards). This patch was developed and discussed on
+
+   https://github.com/raspberrypi/linux/issues/859
+
+A precondition to see the crashes is that floating point exception
+traps are enabled. In this case, the VFP11 might determine that a FPU
+operation needs to trap at a point in time when it is not possible to
+signal this to the ARM11 core any more. The VFP11 will then set the
+FPEXC.EX bit and store the trapped opcode in FPINST. (In some cases,
+a second opcode might have been accepted by the VFP11 before the
+exception was detected and could be reported to the ARM11 - in this
+case, the VFP11 also sets FPEXC.FP2V and stores the second opcode in
+FPINST2.)
+
+If FPEXC.EX is set, the VFP11 will "bounce" the next FPU opcode issued
+by the ARM11 CPU, which will be seen by the ARM11 as an undefined opcode
+trap. The VFP support code examines the FPEXC.EX and FPEXC.FP2V bits
+to decide what actions to take, i.e., whether to emulate the opcodes
+found in FPINST and FPINST2, and whether to retry the bounced instruction.
+
+If a user space application has left the VFP11 in this "pending trap"
+state, the next FPU opcode issued to the VFP11 might actually be the
+VSTMIA operation vfp_save_state() uses to store the FPU registers
+to memory (in our test cases, when building the signal stack frame).
+In this case, the kernel crashes as described above.
+
+This patch fixes the problem by making sure that vfp_save_state() is
+always entered with FPEXC.EX cleared. (The current value of FPEXC has
+already been saved, so this does not corrupt the context. Clearing
+FPEXC.EX has no effects on FPINST or FPINST2. Also note that many
+callers already modify FPEXC by setting FPEXC.EN before invoking
+vfp_save_state().)
+
+This patch also addresses a second problem related to FPEXC.EX: After
+returning from signal handling, the kernel reloads the VFP context
+from the user mode stack. However, the current code explicitly clears
+both FPEXC.EX and FPEXC.FP2V during reload. As VFP11 requires these
+bits to be preserved, this patch disables clearing them for VFP
+implementations belonging to architecture 1. There should be no
+negative side effects: the user can set both bits by executing FPU
+opcodes anyway, and while user code may now place arbitrary values
+into FPINST and FPINST2 (e.g., non-VFP ARM opcodes) the VFP support
+code knows which instructions can be emulated, and rejects other
+opcodes with "unhandled bounce" messages, so there should be no
+security impact from allowing reloading FPEXC.EX and FPEXC.FP2V.
+
+Signed-off-by: Christopher Alexander Tobias Schulze <cat.schulze@alice-dsl.net>
+---
+ arch/arm/vfp/vfpmodule.c | 25 +++++++++++++++++++------
+ 1 file changed, 19 insertions(+), 6 deletions(-)
+
+--- a/arch/arm/vfp/vfpmodule.c
++++ b/arch/arm/vfp/vfpmodule.c
+@@ -176,8 +176,11 @@ static int vfp_notifier(struct notifier_
+ 		 * case the thread migrates to a different CPU. The
+ 		 * restoring is done lazily.
+ 		 */
+-		if ((fpexc & FPEXC_EN) && vfp_current_hw_state[cpu])
++		if ((fpexc & FPEXC_EN) && vfp_current_hw_state[cpu]) {
++			/* vfp_save_state oopses on VFP11 if EX bit set */
++			fmxr(FPEXC, fpexc & ~FPEXC_EX);
+ 			vfp_save_state(vfp_current_hw_state[cpu], fpexc);
++		}
+ #endif
+ 
+ 		/*
+@@ -451,13 +454,16 @@ static int vfp_pm_suspend(void)
+ 	/* if vfp is on, then save state for resumption */
+ 	if (fpexc & FPEXC_EN) {
+ 		pr_debug("%s: saving vfp state\n", __func__);
++		/* vfp_save_state oopses on VFP11 if EX bit set */
++		fmxr(FPEXC, fpexc & ~FPEXC_EX);
+ 		vfp_save_state(&ti->vfpstate, fpexc);
+ 
+ 		/* disable, just in case */
+ 		fmxr(FPEXC, fmrx(FPEXC) & ~FPEXC_EN);
+ 	} else if (vfp_current_hw_state[ti->cpu]) {
+ #ifndef CONFIG_SMP
+-		fmxr(FPEXC, fpexc | FPEXC_EN);
++		/* vfp_save_state oopses on VFP11 if EX bit set */
++		fmxr(FPEXC, (fpexc & ~FPEXC_EX) | FPEXC_EN);
+ 		vfp_save_state(vfp_current_hw_state[ti->cpu], fpexc);
+ 		fmxr(FPEXC, fpexc);
+ #endif
+@@ -522,7 +528,8 @@ void vfp_sync_hwstate(struct thread_info
+ 		/*
+ 		 * Save the last VFP state on this CPU.
+ 		 */
+-		fmxr(FPEXC, fpexc | FPEXC_EN);
++		/* vfp_save_state oopses on VFP11 if EX bit set */
++		fmxr(FPEXC, (fpexc & ~FPEXC_EX) | FPEXC_EN);
+ 		vfp_save_state(&thread->vfpstate, fpexc | FPEXC_EN);
+ 		fmxr(FPEXC, fpexc);
+ 	}
+@@ -589,6 +596,7 @@ int vfp_restore_user_hwstate(struct user
+ 	struct thread_info *thread = current_thread_info();
+ 	struct vfp_hard_struct *hwstate = &thread->vfpstate.hard;
+ 	unsigned long fpexc;
++	u32 fpsid = fmrx(FPSID);
+ 
+ 	/* Disable VFP to avoid corrupting the new thread state. */
+ 	vfp_flush_hwstate(thread);
+@@ -611,8 +619,12 @@ int vfp_restore_user_hwstate(struct user
+ 	/* Ensure the VFP is enabled. */
+ 	fpexc |= FPEXC_EN;
+ 
+-	/* Ensure FPINST2 is invalid and the exception flag is cleared. */
+-	fpexc &= ~(FPEXC_EX | FPEXC_FP2V);
++	/* Mask FPXEC_EX and FPEXC_FP2V if not required by VFP arch */
++	if ((fpsid & FPSID_ARCH_MASK) != (1 << FPSID_ARCH_BIT)) {
++		/* Ensure FPINST2 is invalid and the exception flag is cleared. */
++		fpexc &= ~(FPEXC_EX | FPEXC_FP2V);
++	}
++
+ 	hwstate->fpexc = fpexc;
+ 
+ 	hwstate->fpinst = ufp_exc->fpinst;
+@@ -848,7 +860,8 @@ void kernel_neon_begin(void)
+ 	cpu = __smp_processor_id();
+ 
+ 	fpexc = fmrx(FPEXC) | FPEXC_EN;
+-	fmxr(FPEXC, fpexc);
++	/* vfp_save_state oopses on VFP11 if EX bit set */
++	fmxr(FPEXC, fpexc & ~FPEXC_EX);
+ 
+ 	/*
+ 	 * Save the userland NEON/VFP state. Under UP,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0048-i2c-bcm2835-Add-debug-support.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0048-i2c-bcm2835-Add-debug-support.patch
new file mode 100644
index 00000000..f061df29
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0048-i2c-bcm2835-Add-debug-support.patch
@@ -0,0 +1,189 @@
+From f85e49f1da2b674f63d9ac5ce9e2331e5e93ebd8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
+Date: Tue, 1 Nov 2016 15:15:41 +0100
+Subject: [PATCH 048/697] i2c: bcm2835: Add debug support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This adds a debug module parameter to aid in debugging transfer issues
+by printing info to the kernel log. When enabled, status values are
+collected in the interrupt routine and msg info in
+bcm2835_i2c_start_transfer(). This is done in a way that tries to avoid
+affecting timing. Having printk in the isr can mask issues.
+
+debug values (additive):
+1: Print info on error
+2: Print info on all transfers
+3: Print messages before transfer is started
+
+The value can be changed at runtime:
+/sys/module/i2c_bcm2835/parameters/debug
+
+Example output, debug=3:
+[  747.114448] bcm2835_i2c_xfer: msg(1/2) write addr=0x54, len=2 flags= [i2c1]
+[  747.114463] bcm2835_i2c_xfer: msg(2/2) read addr=0x54, len=32 flags= [i2c1]
+[  747.117809] start_transfer: msg(1/2) write addr=0x54, len=2 flags= [i2c1]
+[  747.117825] isr: remain=2, status=0x30000055 : TA TXW TXD TXE  [i2c1]
+[  747.117839] start_transfer: msg(2/2) read addr=0x54, len=32 flags= [i2c1]
+[  747.117849] isr: remain=32, status=0xd0000039 : TA RXR TXD RXD  [i2c1]
+[  747.117861] isr: remain=20, status=0xd0000039 : TA RXR TXD RXD  [i2c1]
+[  747.117870] isr: remain=8, status=0x32 : DONE TXD RXD  [i2c1]
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+---
+ drivers/i2c/busses/i2c-bcm2835.c | 99 +++++++++++++++++++++++++++++++-
+ 1 file changed, 98 insertions(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-bcm2835.c
++++ b/drivers/i2c/busses/i2c-bcm2835.c
+@@ -56,6 +56,18 @@
+ #define BCM2835_I2C_CDIV_MIN	0x0002
+ #define BCM2835_I2C_CDIV_MAX	0xFFFE
+ 
++static unsigned int debug;
++module_param(debug, uint, 0644);
++MODULE_PARM_DESC(debug, "1=err, 2=isr, 3=xfer");
++
++#define BCM2835_DEBUG_MAX	512
++struct bcm2835_debug {
++	struct i2c_msg *msg;
++	int msg_idx;
++	size_t remain;
++	u32 status;
++};
++
+ struct bcm2835_i2c_dev {
+ 	struct device *dev;
+ 	void __iomem *regs;
+@@ -68,8 +80,78 @@ struct bcm2835_i2c_dev {
+ 	u32 msg_err;
+ 	u8 *msg_buf;
+ 	size_t msg_buf_remaining;
++	struct bcm2835_debug debug[BCM2835_DEBUG_MAX];
++	unsigned int debug_num;
++	unsigned int debug_num_msgs;
+ };
+ 
++static inline void bcm2835_debug_add(struct bcm2835_i2c_dev *i2c_dev, u32 s)
++{
++	if (!i2c_dev->debug_num_msgs || i2c_dev->debug_num >= BCM2835_DEBUG_MAX)
++		return;
++
++	i2c_dev->debug[i2c_dev->debug_num].msg = i2c_dev->curr_msg;
++	i2c_dev->debug[i2c_dev->debug_num].msg_idx =
++				i2c_dev->debug_num_msgs - i2c_dev->num_msgs;
++	i2c_dev->debug[i2c_dev->debug_num].remain = i2c_dev->msg_buf_remaining;
++	i2c_dev->debug[i2c_dev->debug_num].status = s;
++	i2c_dev->debug_num++;
++}
++
++static void bcm2835_debug_print_status(struct bcm2835_i2c_dev *i2c_dev,
++				       struct bcm2835_debug *d)
++{
++	u32 s = d->status;
++
++	pr_info("isr: remain=%zu, status=0x%x : %s%s%s%s%s%s%s%s%s%s [i2c%d]\n",
++		d->remain, s,
++		s & BCM2835_I2C_S_TA ? "TA " : "",
++		s & BCM2835_I2C_S_DONE ? "DONE " : "",
++		s & BCM2835_I2C_S_TXW ? "TXW " : "",
++		s & BCM2835_I2C_S_RXR ? "RXR " : "",
++		s & BCM2835_I2C_S_TXD ? "TXD " : "",
++		s & BCM2835_I2C_S_RXD ? "RXD " : "",
++		s & BCM2835_I2C_S_TXE ? "TXE " : "",
++		s & BCM2835_I2C_S_RXF ? "RXF " : "",
++		s & BCM2835_I2C_S_ERR ? "ERR " : "",
++		s & BCM2835_I2C_S_CLKT ? "CLKT " : "",
++		i2c_dev->adapter.nr);
++}
++
++static void bcm2835_debug_print_msg(struct bcm2835_i2c_dev *i2c_dev,
++				    struct i2c_msg *msg, int i, int total,
++				    const char *fname)
++{
++	pr_info("%s: msg(%d/%d) %s addr=0x%02x, len=%u flags=%s%s%s%s%s%s%s [i2c%d]\n",
++		fname, i, total,
++		msg->flags & I2C_M_RD ? "read" : "write", msg->addr, msg->len,
++		msg->flags & I2C_M_TEN ? "TEN" : "",
++		msg->flags & I2C_M_RECV_LEN ? "RECV_LEN" : "",
++		msg->flags & I2C_M_NO_RD_ACK ? "NO_RD_ACK" : "",
++		msg->flags & I2C_M_IGNORE_NAK ? "IGNORE_NAK" : "",
++		msg->flags & I2C_M_REV_DIR_ADDR ? "REV_DIR_ADDR" : "",
++		msg->flags & I2C_M_NOSTART ? "NOSTART" : "",
++		msg->flags & I2C_M_STOP ? "STOP" : "",
++		i2c_dev->adapter.nr);
++}
++
++static void bcm2835_debug_print(struct bcm2835_i2c_dev *i2c_dev)
++{
++	struct bcm2835_debug *d;
++	unsigned int i;
++
++	for (i = 0; i < i2c_dev->debug_num; i++) {
++		d = &i2c_dev->debug[i];
++		if (d->status == ~0)
++			bcm2835_debug_print_msg(i2c_dev, d->msg, d->msg_idx,
++				i2c_dev->debug_num_msgs, "start_transfer");
++		else
++			bcm2835_debug_print_status(i2c_dev, d);
++	}
++	if (i2c_dev->debug_num >= BCM2835_DEBUG_MAX)
++		pr_info("BCM2835_DEBUG_MAX reached\n");
++}
++
+ static inline void bcm2835_i2c_writel(struct bcm2835_i2c_dev *i2c_dev,
+ 				      u32 reg, u32 val)
+ {
+@@ -257,6 +339,7 @@ static void bcm2835_i2c_start_transfer(s
+ 	bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_A, msg->addr);
+ 	bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_DLEN, msg->len);
+ 	bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C, c);
++	bcm2835_debug_add(i2c_dev, ~0);
+ }
+ 
+ static void bcm2835_i2c_finish_transfer(struct bcm2835_i2c_dev *i2c_dev)
+@@ -283,6 +366,7 @@ static irqreturn_t bcm2835_i2c_isr(int t
+ 	u32 val, err;
+ 
+ 	val = bcm2835_i2c_readl(i2c_dev, BCM2835_I2C_S);
++	bcm2835_debug_add(i2c_dev, val);
+ 
+ 	err = val & (BCM2835_I2C_S_CLKT | BCM2835_I2C_S_ERR);
+ 	if (err) {
+@@ -349,6 +433,13 @@ static int bcm2835_i2c_xfer(struct i2c_a
+ 	unsigned long time_left;
+ 	int i;
+ 
++	if (debug)
++		i2c_dev->debug_num_msgs = num;
++
++	if (debug > 2)
++		for (i = 0; i < num; i++)
++			bcm2835_debug_print_msg(i2c_dev, &msgs[i], i + 1, num, __func__);
++
+ 	for (i = 0; i < (num - 1); i++)
+ 		if (msgs[i].flags & I2C_M_RD) {
+ 			dev_warn_once(i2c_dev->dev,
+@@ -367,6 +458,10 @@ static int bcm2835_i2c_xfer(struct i2c_a
+ 
+ 	bcm2835_i2c_finish_transfer(i2c_dev);
+ 
++	if (debug > 1 || (debug && (!time_left || i2c_dev->msg_err)))
++		bcm2835_debug_print(i2c_dev);
++	i2c_dev->debug_num_msgs = 0;
++	i2c_dev->debug_num = 0;
+ 	if (!time_left) {
+ 		bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C,
+ 				   BCM2835_I2C_C_CLEAR);
+@@ -376,7 +471,9 @@ static int bcm2835_i2c_xfer(struct i2c_a
+ 	if (!i2c_dev->msg_err)
+ 		return num;
+ 
+-	dev_dbg(i2c_dev->dev, "i2c transfer failed: %x\n", i2c_dev->msg_err);
++	if (debug)
++		dev_err(i2c_dev->dev, "i2c transfer failed: %x\n",
++			i2c_dev->msg_err);
+ 
+ 	if (i2c_dev->msg_err & BCM2835_I2C_S_ERR)
+ 		return -EREMOTEIO;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0049-irqchip-irq-bcm2836-Remove-regmap-and-syscon-use.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0049-irqchip-irq-bcm2836-Remove-regmap-and-syscon-use.patch
new file mode 100644
index 00000000..ce0216ed
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0049-irqchip-irq-bcm2836-Remove-regmap-and-syscon-use.patch
@@ -0,0 +1,112 @@
+From d60db5d76824afbb83f65ff24cfebba74f4ba4d6 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Tue, 23 Jan 2018 16:52:45 +0000
+Subject: [PATCH 049/697] irqchip: irq-bcm2836: Remove regmap and syscon use
+
+The syscon node defines a register range that duplicates that used by
+the local_intc node on bcm2836/7. Since irq-bcm2835 and irq-bcm2836 are
+built in and always present together (both drivers are enabled by
+CONFIG_ARCH_BCM2835), it is possible to replace the syscon usage with a
+global variable that simplifies the code. Doing so does lose the
+locking provided by regmap, but as only one side is using the regmap
+interface (irq-bcm2835 uses readl and write) there is no loss of
+atomicity.
+
+See: https://github.com/raspberrypi/firmware/issues/926
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/irqchip/irq-bcm2835.c | 32 ++++++++++++--------------------
+ drivers/irqchip/irq-bcm2836.c |  5 +++++
+ 2 files changed, 17 insertions(+), 20 deletions(-)
+
+--- a/drivers/irqchip/irq-bcm2835.c
++++ b/drivers/irqchip/irq-bcm2835.c
+@@ -41,8 +41,6 @@
+ #include <linux/of_irq.h>
+ #include <linux/irqchip.h>
+ #include <linux/irqdomain.h>
+-#include <linux/mfd/syscon.h>
+-#include <linux/regmap.h>
+ 
+ #include <asm/exception.h>
+ #include <asm/mach/irq.h>
+@@ -92,7 +90,7 @@ struct armctrl_ic {
+ 	void __iomem *enable[NR_BANKS];
+ 	void __iomem *disable[NR_BANKS];
+ 	struct irq_domain *domain;
+-	struct regmap *local_regmap;
++	void __iomem *local_base;
+ };
+ 
+ static struct armctrl_ic intc __read_mostly;
+@@ -129,24 +127,20 @@ static void armctrl_unmask_irq(struct ir
+ 	if (d->hwirq >= NUMBER_IRQS) {
+ 		if (num_online_cpus() > 1) {
+ 			unsigned int data;
+-			int ret;
+ 
+-			if (!intc.local_regmap) {
+-				pr_err("FIQ is disabled due to missing regmap\n");
++			if (!intc.local_base) {
++				pr_err("FIQ is disabled due to missing arm_local_intc\n");
+ 				return;
+ 			}
+ 
+-			ret = regmap_read(intc.local_regmap,
+-					  ARM_LOCAL_GPU_INT_ROUTING, &data);
+-			if (ret) {
+-				pr_err("Failed to read int routing %d\n", ret);
+-				return;
+-			}
++			data = readl_relaxed(intc.local_base +
++					     ARM_LOCAL_GPU_INT_ROUTING);
+ 
+ 			data &= ~0xc;
+ 			data |= (1 << 2);
+-			regmap_write(intc.local_regmap,
+-				     ARM_LOCAL_GPU_INT_ROUTING, data);
++			writel_relaxed(data,
++				       intc.local_base +
++				       ARM_LOCAL_GPU_INT_ROUTING);
+ 		}
+ 
+ 		writel_relaxed(REG_FIQ_ENABLE | hwirq_to_fiq(d->hwirq),
+@@ -248,12 +242,10 @@ static int __init armctrl_of_init(struct
+ 	}
+ 
+ 	if (is_2836) {
+-		intc.local_regmap =
+-			syscon_regmap_lookup_by_compatible("brcm,bcm2836-arm-local");
+-		if (IS_ERR(intc.local_regmap)) {
+-			pr_err("Failed to get local register map. FIQ is disabled for cpus > 1\n");
+-			intc.local_regmap = NULL;
+-		}
++		extern void __iomem * __attribute__((weak)) arm_local_intc;
++		intc.local_base = arm_local_intc;
++		if (!intc.local_base)
++			pr_err("Failed to get local intc base. FIQ is disabled for cpus > 1\n");
+ 	}
+ 
+ 	/* Make a duplicate irq range which is used to enable FIQ */
+--- a/drivers/irqchip/irq-bcm2836.c
++++ b/drivers/irqchip/irq-bcm2836.c
+@@ -22,6 +22,9 @@ struct bcm2836_arm_irqchip_intc {
+ 
+ static struct bcm2836_arm_irqchip_intc intc  __read_mostly;
+ 
++void __iomem *arm_local_intc;
++EXPORT_SYMBOL_GPL(arm_local_intc);
++
+ static void bcm2836_arm_irqchip_mask_per_cpu_irq(unsigned int reg_offset,
+ 						 unsigned int bit,
+ 						 int cpu)
+@@ -320,6 +323,8 @@ static int __init bcm2836_arm_irqchip_l1
+ 		panic("%pOF: unable to map local interrupt registers\n", node);
+ 	}
+ 
++	arm_local_intc = intc.base;
++
+ 	bcm2835_init_local_timer_frequency();
+ 
+ 	intc.domain = irq_domain_add_linear(node, LAST_IRQ + 1,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0050-amba_pl011-Insert-mb-for-correct-FIFO-handling.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0050-amba_pl011-Insert-mb-for-correct-FIFO-handling.patch
new file mode 100644
index 00000000..1a8a0308
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0050-amba_pl011-Insert-mb-for-correct-FIFO-handling.patch
@@ -0,0 +1,27 @@
+From 0f1e8b96198b74dcb95a10e139c66ee5ae36e6b2 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Fri, 29 Sep 2017 10:32:19 +0100
+Subject: [PATCH 050/697] amba_pl011: Insert mb() for correct FIFO handling
+
+The pl011 register accessor functions use the _relaxed versions of the
+standard readl() and writel() functions, meaning that there are no
+automatic memory barriers. When polling a FIFO status register to check
+for fullness, it is necessary to ensure that any outstanding writes have
+completed; otherwise the flags are effectively stale, making it possible
+that the next write is to a full FIFO.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/tty/serial/amba-pl011.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -1433,6 +1433,7 @@ static bool pl011_tx_char(struct uart_am
+ 		return false; /* unable to transmit character */
+ 
+ 	pl011_write(c, uap, REG_DR);
++	mb();
+ 	uap->port.icount.tx++;
+ 
+ 	return true;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0051-amba_pl011-Add-cts-event-workaround-DT-property.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0051-amba_pl011-Add-cts-event-workaround-DT-property.patch
new file mode 100644
index 00000000..eb0c6358
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0051-amba_pl011-Add-cts-event-workaround-DT-property.patch
@@ -0,0 +1,50 @@
+From 2d203a775b47a3bc0f1aa50b6d67fb7d7a627218 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Fri, 29 Sep 2017 10:32:19 +0100
+Subject: [PATCH 051/697] amba_pl011: Add cts-event-workaround DT property
+
+The BCM2835 PL011 implementation seems to have a bug that can lead to a
+transmission lockup if CTS changes frequently. A workaround was added to
+the driver with a vendor-specific flag to enable it, but this flag is
+currently not set for ARM implementations.
+
+Add a "cts-event-workaround" property to Pi DTBs and use the presence
+of that property to force the flag to be enabled in the driver.
+
+See: https://github.com/raspberrypi/linux/issues/1280
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ Documentation/devicetree/bindings/serial/pl011.yaml | 6 ++++++
+ drivers/tty/serial/amba-pl011.c                     | 5 +++++
+ 2 files changed, 11 insertions(+)
+
+--- a/Documentation/devicetree/bindings/serial/pl011.yaml
++++ b/Documentation/devicetree/bindings/serial/pl011.yaml
+@@ -101,6 +101,12 @@ properties:
+       on the device.
+     enum: [1, 4]
+ 
++  cts-event-workaround:
++    description:
++      Enables the (otherwise vendor-specific) workaround for the
++      CTS-induced TX lockup.
++    type: boolean
++
+ required:
+   - compatible
+   - reg
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -2783,6 +2783,11 @@ static int pl011_probe(struct amba_devic
+ 	if (IS_ERR(uap->clk))
+ 		return PTR_ERR(uap->clk);
+ 
++	if (of_property_read_bool(dev->dev.of_node, "cts-event-workaround")) {
++	    vendor->cts_event_workaround = true;
++	    dev_info(&dev->dev, "cts_event_workaround enabled\n");
++	}
++
+ 	uap->reg_offset = vendor->reg_offset;
+ 	uap->vendor = vendor;
+ 	uap->fifosize = vendor->get_fifosize(dev);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0052-tty-amba-pl011-Avoid-rare-write-when-full-error.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0052-tty-amba-pl011-Avoid-rare-write-when-full-error.patch
new file mode 100644
index 00000000..55884f3a
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0052-tty-amba-pl011-Avoid-rare-write-when-full-error.patch
@@ -0,0 +1,42 @@
+From 492c6b7b05bdb4daaa8889e5f80d6d651e4b131a Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Wed, 29 Jan 2020 09:35:19 +0000
+Subject: [PATCH 052/697] tty: amba-pl011: Avoid rare write-when-full error
+
+Under some circumstances on BCM283x processors data loss can be
+observed - a single byte missing from the TX output stream. These bytes
+are always the last byte of a batch of 8 written from pl011_tx_chars
+when from_irq is true, meaning that the FIFO full flag is not checked
+before writing.
+
+The transmit optimisation relies on the FIFO being half-empty when the
+TX interrupt is raised. Instrumenting the driver further showed that
+the failure case correlated with the TX FIFO full flag being set at the
+point where the last byte was written to the data register, which
+explains the data loss but not how the FIFO appeared to be prematurely
+full. A possible explanation is that a FIFO write was in flight at the
+time the interrupt was raised, but as yet there is no hypothesis as to
+how this might occur.
+
+In the absence of a clear understanding of the failure mechanism, avoid
+the problem by checking the FIFO levels before writing the last byte of
+the group, which will have minimal performance impact.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/tty/serial/amba-pl011.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -1466,6 +1466,10 @@ static bool pl011_tx_chars(struct uart_a
+ 		if (likely(from_irq) && count-- == 0)
+ 			break;
+ 
++		if (likely(from_irq) && count == 0 &&
++		    pl011_read(uap, REG_FR) & UART01x_FR_TXFF)
++			break;
++
+ 		if (!kfifo_peek(&tport->xmit_fifo, &c))
+ 			break;
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0053-Main-bcm2708-bcm2709-linux-port.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0053-Main-bcm2708-bcm2709-linux-port.patch
new file mode 100644
index 00000000..5ab2211e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0053-Main-bcm2708-bcm2709-linux-port.patch
@@ -0,0 +1,150 @@
+From bf3174d438a6244ac733e236f3ceb4726d427944 Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Sun, 12 May 2013 12:24:19 +0100
+Subject: [PATCH 053/697] Main bcm2708/bcm2709 linux port
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+bcm2709: Drop platform smp and timer init code
+
+irq-bcm2836 handles this through these functions:
+bcm2835_init_local_timer_frequency()
+bcm2836_arm_irqchip_smp_init()
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+bcm270x: Use watchdog for reboot/poweroff
+
+The watchdog driver already has support for reboot/poweroff.
+Make use of this and remove the code from the platform files.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+board_bcm2835: Remove coherent dma pool increase - API has gone
+---
+ arch/arm/mach-bcm/Kconfig         |  1 +
+ arch/arm/mm/proc-v6.S             | 15 ++++++++++++---
+ drivers/irqchip/irq-bcm2835.c     |  7 ++++++-
+ drivers/mailbox/bcm2835-mailbox.c | 18 ++++++++++++++++--
+ 4 files changed, 35 insertions(+), 6 deletions(-)
+
+--- a/arch/arm/mach-bcm/Kconfig
++++ b/arch/arm/mach-bcm/Kconfig
+@@ -162,6 +162,7 @@ config ARCH_BCM2835
+ 	select PINCTRL
+ 	select PINCTRL_BCM2835
+ 	select MFD_CORE
++	select MFD_SYSCON if ARCH_MULTI_V7
+ 	help
+ 	  This enables support for the Broadcom BCM2711 and BCM283x SoCs.
+ 	  This SoC is used in the Raspberry Pi and Roku 2 devices.
+--- a/arch/arm/mm/proc-v6.S
++++ b/arch/arm/mm/proc-v6.S
+@@ -75,10 +75,19 @@ SYM_FUNC_END(cpu_v6_reset)
+  *
+  *	IRQs are already disabled.
+  */
++
++/* See jira SW-5991 for details of this workaround */
+ SYM_TYPED_FUNC_START(cpu_v6_do_idle)
+-	mov	r1, #0
+-	mcr	p15, 0, r1, c7, c10, 4		@ DWB - WFI may enter a low-power mode
+-	mcr	p15, 0, r1, c7, c0, 4		@ wait for interrupt
++	.align 5
++	mov     r1, #2
++1:	subs	r1, #1
++	nop
++	mcreq	p15, 0, r1, c7, c10, 4		@ DWB - WFI may enter a low-power mode
++	mcreq	p15, 0, r1, c7, c0, 4		@ wait for interrupt
++	nop
++	nop
++	nop
++	bne 1b
+ 	ret	lr
+ SYM_FUNC_END(cpu_v6_do_idle)
+ 
+--- a/drivers/irqchip/irq-bcm2835.c
++++ b/drivers/irqchip/irq-bcm2835.c
+@@ -43,7 +43,9 @@
+ #include <linux/irqdomain.h>
+ 
+ #include <asm/exception.h>
++#ifndef CONFIG_ARM64
+ #include <asm/mach/irq.h>
++#endif
+ 
+ /* Put the bank and irq (32 bits) into the hwirq */
+ #define MAKE_HWIRQ(b, n)	(((b) << 5) | (n))
+@@ -72,6 +74,7 @@
+ #define NR_BANKS		3
+ #define IRQS_PER_BANK		32
+ #define NUMBER_IRQS		MAKE_HWIRQ(NR_BANKS, 0)
++#undef FIQ_START
+ #define FIQ_START		(NR_IRQS_BANK0 + MAKE_HWIRQ(NR_BANKS - 1, 0))
+ 
+ static const int reg_pending[] __initconst = { 0x00, 0x04, 0x08 };
+@@ -255,10 +258,12 @@ static int __init armctrl_of_init(struct
+ 					MAKE_HWIRQ(b, i) + NUMBER_IRQS);
+ 			BUG_ON(irq <= 0);
+ 			irq_set_chip(irq, &armctrl_chip);
+-			set_irq_flags(irq, IRQF_VALID | IRQF_PROBE);
++			irq_set_probe(irq);
+ 		}
+ 	}
++#ifndef CONFIG_ARM64
+ 	init_FIQ(FIQ_START);
++#endif
+ 
+ 	return 0;
+ }
+--- a/drivers/mailbox/bcm2835-mailbox.c
++++ b/drivers/mailbox/bcm2835-mailbox.c
+@@ -45,12 +45,15 @@
+ #define MAIL1_WRT	(ARM_0_MAIL1 + 0x00)
+ #define MAIL1_STA	(ARM_0_MAIL1 + 0x18)
+ 
++/* On ARCH_BCM270x these come through <linux/interrupt.h> (arm_control.h ) */
++#ifndef ARM_MS_FULL
+ /* Status register: FIFO state. */
+ #define ARM_MS_FULL		BIT(31)
+ #define ARM_MS_EMPTY		BIT(30)
+ 
+ /* Configuration register: Enable interrupts. */
+ #define ARM_MC_IHAVEDATAIRQEN	BIT(0)
++#endif
+ 
+ struct bcm2835_mbox {
+ 	void __iomem *regs;
+@@ -144,7 +147,7 @@ static int bcm2835_mbox_probe(struct pla
+ 		return -ENOMEM;
+ 	spin_lock_init(&mbox->lock);
+ 
+-	ret = devm_request_irq(dev, irq_of_parse_and_map(dev->of_node, 0),
++	ret = devm_request_irq(dev, platform_get_irq(pdev, 0),
+ 			       bcm2835_mbox_irq, IRQF_NO_SUSPEND, dev_name(dev),
+ 			       mbox);
+ 	if (ret) {
+@@ -193,7 +196,18 @@ static struct platform_driver bcm2835_mb
+ 	},
+ 	.probe		= bcm2835_mbox_probe,
+ };
+-module_platform_driver(bcm2835_mbox_driver);
++
++static int __init bcm2835_mbox_init(void)
++{
++	return platform_driver_register(&bcm2835_mbox_driver);
++}
++arch_initcall(bcm2835_mbox_init);
++
++static void __init bcm2835_mbox_exit(void)
++{
++	platform_driver_unregister(&bcm2835_mbox_driver);
++}
++module_exit(bcm2835_mbox_exit);
+ 
+ MODULE_AUTHOR("Lubomir Rintel <lkundrak@v3.sk>");
+ MODULE_DESCRIPTION("BCM2835 mailbox IPC driver");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0054-Add-dwc_otg-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0054-Add-dwc_otg-driver.patch
new file mode 100644
index 00000000..6a3055c9
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0054-Add-dwc_otg-driver.patch
@@ -0,0 +1,61017 @@
+From 7cd22f6e9a8d1e1a5ff82429f9e4fed59889665b Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Wed, 1 May 2013 19:46:17 +0100
+Subject: [PATCH 054/697] Add dwc_otg driver
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+
+usb: dwc: fix lockdep false positive
+
+Signed-off-by: Kari Suvanto <karis79@gmail.com>
+
+usb: dwc: fix inconsistent lock state
+
+Signed-off-by: Kari Suvanto <karis79@gmail.com>
+
+Add FIQ patch to dwc_otg driver. Enable with dwc_otg.fiq_fix_enable=1. Should give about 10% more ARM performance.
+Thanks to Gordon and Costas
+
+Avoid dynamic memory allocation for channel lock in USB driver. Thanks ddv2005.
+
+Add NAK holdoff scheme. Enabled by default, disable with dwc_otg.nak_holdoff_enable=0. Thanks gsh
+
+Make sure we wait for the reset to finish
+
+dwc_otg: fix bug in dwc_otg_hcd.c resulting in silent kernel
+	 memory corruption, escalating to OOPS under high USB load.
+
+dwc_otg: Fix unsafe access of QTD during URB enqueue
+
+In dwc_otg_hcd_urb_enqueue during qtd creation, it was possible that the
+transaction could complete almost immediately after the qtd was assigned
+to a host channel during URB enqueue, which meant the qtd pointer was no
+longer valid having been completed and removed. Usually, this resulted in
+an OOPS during URB submission. By predetermining whether transactions
+need to be queued or not, this unsafe pointer access is avoided.
+
+This bug was only evident on the Pi model A where a device was attached
+that had no periodic endpoints (e.g. USB pendrive or some wlan devices).
+
+dwc_otg: Fix incorrect URB allocation error handling
+
+If the memory allocation for a dwc_otg_urb failed, the kernel would OOPS
+because for some reason a member of the *unallocated* struct was set to
+zero. Error handling changed to fail correctly.
+
+dwc_otg: fix potential use-after-free case in interrupt handler
+
+If a transaction had previously aborted, certain interrupts are
+enabled to track error counts and reset where necessary. On IN
+endpoints the host generates an ACK interrupt near-simultaneously
+with completion of transfer. In the case where this transfer had
+previously had an error, this results in a use-after-free on
+the QTD memory space with a 1-byte length being overwritten to
+0x00.
+
+dwc_otg: add handling of SPLIT transaction data toggle errors
+
+Previously a data toggle error on packets from a USB1.1 device behind
+a TT would result in the Pi locking up as the driver never handled
+the associated interrupt. Patch adds basic retry mechanism and
+interrupt acknowledgement to cater for either a chance toggle error or
+for devices that have a broken initial toggle state (FT8U232/FT232BM).
+
+dwc_otg: implement tasklet for returning URBs to usbcore hcd layer
+
+The dwc_otg driver interrupt handler for transfer completion will spend
+a very long time with interrupts disabled when a URB is completed -
+this is because usb_hcd_giveback_urb is called from within the handler
+which for a USB device driver with complicated processing (e.g. webcam)
+will take an exorbitant amount of time to complete. This results in
+missed completion interrupts for other USB packets which lead to them
+being dropped due to microframe overruns.
+
+This patch splits returning the URB to the usb hcd layer into a
+high-priority tasklet. This will have most benefit for isochronous IN
+transfers but will also have incidental benefit where multiple periodic
+devices are active at once.
+
+dwc_otg: fix NAK holdoff and allow on split transactions only
+
+This corrects a bug where if a single active non-periodic endpoint
+had at least one transaction in its qh, on frnum == MAX_FRNUM the qh
+would get skipped and never get queued again. This would result in
+a silent device until error detection (automatic or otherwise) would
+either reset the device or flush and requeue the URBs.
+
+Additionally the NAK holdoff was enabled for all transactions - this
+would potentially stall a HS endpoint for 1ms if a previous error state
+enabled this interrupt and the next response was a NAK. Fix so that
+only split transactions get held off.
+
+dwc_otg: Call usb_hcd_unlink_urb_from_ep with lock held in completion handler
+
+usb_hcd_unlink_urb_from_ep must be called with the HCD lock held.  Calling it
+asynchronously in the tasklet was not safe (regression in
+c4564d4a1a0a9b10d4419e48239f5d99e88d2667).
+
+This change unlinks it from the endpoint prior to queueing it for handling in
+the tasklet, and also adds a check to ensure the urb is OK to be unlinked
+before doing so.
+
+NULL pointer dereference kernel oopses had been observed in usb_hcd_giveback_urb
+when a USB device was unplugged/replugged during data transfer.  This effect
+was reproduced using automated USB port power control, hundreds of replug
+events were performed during active transfers to confirm that the problem was
+eliminated.
+
+USB fix using a FIQ to implement split transactions
+
+This commit adds a FIQ implementaion that schedules
+the split transactions using a FIQ so we don't get
+held off by the interrupt latency of Linux
+
+dwc_otg: fix device attributes and avoid kernel warnings on boot
+
+dcw_otg: avoid logging function that can cause panics
+
+See: https://github.com/raspberrypi/firmware/issues/21
+Thanks to cleverca22 for fix
+
+dwc_otg: mask correct interrupts after transaction error recovery
+
+The dwc_otg driver will unmask certain interrupts on a transaction
+that previously halted in the error state in order to reset the
+QTD error count. The various fine-grained interrupt handlers do not
+consider that other interrupts besides themselves were unmasked.
+
+By disabling the two other interrupts only ever enabled in DMA mode
+for this purpose, we can avoid unnecessary function calls in the
+IRQ handler. This will also prevent an unneccesary FIQ interrupt
+from being generated if the FIQ is enabled.
+
+dwc_otg: fiq: prevent FIQ thrash and incorrect state passing to IRQ
+
+In the case of a transaction to a device that had previously aborted
+due to an error, several interrupts are enabled to reset the error
+count when a device responds. This has the side-effect of making the
+FIQ thrash because the hardware will generate multiple instances of
+a NAK on an IN bulk/interrupt endpoint and multiple instances of ACK
+on an OUT bulk/interrupt endpoint. Make the FIQ mask and clear the
+associated interrupts.
+
+Additionally, on non-split transactions make sure that only unmasked
+interrupts are cleared. This caused a hard-to-trigger but serious
+race condition when you had the combination of an endpoint awaiting
+error recovery and a transaction completed on an endpoint - due to
+the sequencing and timing of interrupts generated by the dwc_otg core,
+it was possible to confuse the IRQ handler.
+
+Fix function tracing
+
+dwc_otg: whitespace cleanup in dwc_otg_urb_enqueue
+
+dwc_otg: prevent OOPSes during device disconnects
+
+The dwc_otg_urb_enqueue function is thread-unsafe. In particular the
+access of urb->hcpriv, usb_hcd_link_urb_to_ep, dwc_otg_urb->qtd and
+friends does not occur within a critical section and so if a device
+was unplugged during activity there was a high chance that the
+usbcore hub_thread would try to disable the endpoint with partially-
+formed entries in the URB queue. This would result in BUG() or null
+pointer dereferences.
+
+Fix so that access of urb->hcpriv, enqueuing to the hardware and
+adding to usbcore endpoint URB lists is contained within a single
+critical section.
+
+dwc_otg: prevent BUG() in TT allocation if hub address is > 16
+
+A fixed-size array is used to track TT allocation. This was
+previously set to 16 which caused a crash because
+dwc_otg_hcd_allocate_port would read past the end of the array.
+
+This was hit if a hub was plugged in which enumerated as addr > 16,
+due to previous device resets or unplugs.
+
+Also add #ifdef FIQ_DEBUG around hcd->hub_port_alloc[], which grows
+to a large size if 128 hub addresses are supported. This field is
+for debug only for tracking which frame an allocate happened in.
+
+dwc_otg: make channel halts with unknown state less damaging
+
+If the IRQ received a channel halt interrupt through the FIQ
+with no other bits set, the IRQ would not release the host
+channel and never complete the URB.
+
+Add catchall handling to treat as a transaction error and retry.
+
+dwc_otg: fiq_split: use TTs with more granularity
+
+This fixes certain issues with split transaction scheduling.
+
+- Isochronous multi-packet OUT transactions now hog the TT until
+  they are completed - this prevents hubs aborting transactions
+  if they get a periodic start-split out-of-order
+- Don't perform TT allocation on non-periodic endpoints - this
+  allows simultaneous use of the TT's bulk/control and periodic
+  transaction buffers
+
+This commit will mainly affect USB audio playback.
+
+dwc_otg: fix potential sleep while atomic during urb enqueue
+
+Fixes a regression introduced with eb1b482a. Kmalloc called from
+dwc_otg_hcd_qtd_add / dwc_otg_hcd_qtd_create did not always have
+the GPF_ATOMIC flag set. Force this flag when inside the larger
+critical section.
+
+dwc_otg: make fiq_split_enable imply fiq_fix_enable
+
+Failing to set up the FIQ correctly would result in
+"IRQ 32: nobody cared" errors in dmesg.
+
+dwc_otg: prevent crashes on host port disconnects
+
+Fix several issues resulting in crashes or inconsistent state
+if a Model A root port was disconnected.
+
+- Clean up queue heads properly in kill_urbs_in_qh_list by
+  removing the empty QHs from the schedule lists
+- Set the halt status properly to prevent IRQ handlers from
+  using freed memory
+- Add fiq_split related cleanup for saved registers
+- Make microframe scheduling reclaim host channels if
+  active during a disconnect
+- Abort URBs with -ESHUTDOWN status response, informing
+  device drivers so they respond in a more correct fashion
+  and don't try to resubmit URBs
+- Prevent IRQ handlers from attempting to handle channel
+  interrupts if the associated URB was dequeued (and the
+  driver state was cleared)
+
+dwc_otg: prevent leaking URBs during enqueue
+
+A dwc_otg_urb would get leaked if the HCD enqueue function
+failed for any reason. Free the URB at the appropriate points.
+
+dwc_otg: Enable NAK holdoff for control split transactions
+
+Certain low-speed devices take a very long time to complete a
+data or status stage of a control transaction, producing NAK
+responses until they complete internal processing - the USB2.0
+spec limit is up to 500mS. This causes the same type of interrupt
+storm as seen with USB-serial dongles prior to c8edb238.
+
+In certain circumstances, usually while booting, this interrupt
+storm could cause SD card timeouts.
+
+dwc_otg: Fix for occasional lockup on boot when doing a USB reset
+
+dwc_otg: Don't issue traffic to LS devices in FS mode
+
+Issuing low-speed packets when the root port is in full-speed mode
+causes the root port to stop responding. Explicitly fail when
+enqueuing URBs to a LS endpoint on a FS bus.
+
+Fix ARM architecture issue with local_irq_restore()
+
+If local_fiq_enable() is called before a local_irq_restore(flags) where
+the flags variable has the F bit set, the FIQ will be erroneously disabled.
+
+Fixup arch_local_irq_restore to avoid trampling the F bit in CPSR.
+
+Also fix some of the hacks previously implemented for previous dwc_otg
+incarnations.
+
+dwc_otg: fiq_fsm: Base commit for driver rewrite
+
+This commit removes the previous FIQ fixes entirely and adds fiq_fsm.
+
+This rewrite features much more complete support for split transactions
+and takes into account several OTG hardware bugs. High-speed
+isochronous transactions are also capable of being performed by fiq_fsm.
+
+All driver options have been removed and replaced with:
+  - dwc_otg.fiq_enable (bool)
+  - dwc_otg.fiq_fsm_enable (bool)
+  - dwc_otg.fiq_fsm_mask (bitmask)
+  - dwc_otg.nak_holdoff (unsigned int)
+
+Defaults are specified such that fiq_fsm behaves similarly to the
+previously implemented FIQ fixes.
+
+fiq_fsm: Push error recovery into the FIQ when fiq_fsm is used
+
+If the transfer associated with a QTD failed due to a bus error, the HCD
+would retry the transfer up to 3 times (implementing the USB2.0
+three-strikes retry in software).
+
+Due to the masking mechanism used by fiq_fsm, it is only possible to pass
+a single interrupt through to the HCD per-transfer.
+
+In this instance host channels would fall off the radar because the error
+reset would function, but the subsequent channel halt would be lost.
+
+Push the error count reset into the FIQ handler.
+
+fiq_fsm: Implement timeout mechanism
+
+For full-speed endpoints with a large packet size, interrupt latency
+runs the risk of the FIQ starting a transaction too late in a full-speed
+frame. If the device is still transmitting data when EOF2 for the
+downstream frame occurs, the hub will disable the port. This change is
+not reflected in the hub status endpoint and the device becomes
+unresponsive.
+
+Prevent high-bandwidth transactions from being started too late in a
+frame. The mechanism is not guaranteed: a combination of bit stuffing
+and hub latency may still result in a device overrunning.
+
+fiq_fsm: fix bounce buffer utilisation for Isochronous OUT
+
+Multi-packet isochronous OUT transactions were subject to a few bounday
+bugs. Fix them.
+
+Audio playback is now much more robust: however, an issue stands with
+devices that have adaptive sinks - ALSA plays samples too fast.
+
+dwc_otg: Return full-speed frame numbers in HS mode
+
+The frame counter increments on every *microframe* in high-speed mode.
+Most device drivers expect this number to be in full-speed frames - this
+caused considerable confusion to e.g. snd_usb_audio which uses the
+frame counter to estimate the number of samples played.
+
+fiq_fsm: save PID on completion of interrupt OUT transfers
+
+Also add edge case handling for interrupt transports.
+
+Note that for periodic split IN, data toggles are unimplemented in the
+OTG host hardware - it unconditionally accepts any PID.
+
+fiq_fsm: add missing case for fiq_fsm_tt_in_use()
+
+Certain combinations of bitrate and endpoint activity could
+result in a periodic transaction erroneously getting started
+while the previous Isochronous OUT was still active.
+
+fiq_fsm: clear hcintmsk for aborted transactions
+
+Prevents the FIQ from erroneously handling interrupts
+on a timed out channel.
+
+fiq_fsm: enable by default
+
+fiq_fsm: fix dequeues for non-periodic split transactions
+
+If a dequeue happened between the SSPLIT and CSPLIT phases of the
+transaction, the HCD would never receive an interrupt.
+
+fiq_fsm: Disable by default
+
+fiq_fsm: Handle HC babble errors
+
+The HCTSIZ transfer size field raises a babble interrupt if
+the counter wraps. Handle the resulting interrupt in this case.
+
+dwc_otg: fix interrupt registration for fiq_enable=0
+
+Additionally make the module parameter conditional for wherever
+hcd->fiq_state is touched.
+
+fiq_fsm: Enable by default
+
+dwc_otg: Fix various issues with root port and transaction errors
+
+Process the host port interrupts correctly (and don't trample them).
+Root port hotplug now functional again.
+
+Fix a few thinkos with the transaction error passthrough for fiq_fsm.
+
+fiq_fsm: Implement hack for Split Interrupt transactions
+
+Hubs aren't too picky about which endpoint we send Control type split
+transactions to. By treating Interrupt transfers as Control, it is
+possible to use the non-periodic queue in the OTG core as well as the
+non-periodic FIFOs in the hub itself. This massively reduces the
+microframe exclusivity/contention that periodic split transactions
+otherwise have to enforce.
+
+It goes without saying that this is a fairly egregious USB specification
+violation, but it works.
+
+Original idea by Hans Petter Selasky @ FreeBSD.org.
+
+dwc_otg: FIQ support on SMP. Set up FIQ stack and handler on Core 0 only.
+
+dwc_otg: introduce fiq_fsm_spin(un|)lock()
+
+SMP safety for the FIQ relies on register read-modify write cycles being
+completed in the correct order. Several places in the DWC code modify
+registers also touched by the FIQ. Protect these by a bare-bones lock
+mechanism.
+
+This also makes it possible to run the FIQ and IRQ handlers on different
+cores.
+
+fiq_fsm: fix build on bcm2708 and bcm2709 platforms
+
+dwc_otg: put some barriers back where they should be for UP
+
+bcm2709/dwc_otg: Setup FIQ on core 1 if >1 core active
+
+dwc_otg: fixup read-modify-write in critical paths
+
+Be more careful about read-modify-write on registers that the FIQ
+also touches.
+
+Guard fiq_fsm_spin_lock with fiq_enable check
+
+fiq_fsm: Falling out of the state machine isn't fatal
+
+This edge case can be hit if the port is disabled while the FIQ is
+in the middle of a transaction. Make the effects less severe.
+
+Also get rid of the useless return value.
+
+squash: dwc_otg: Allow to build without SMP
+
+usb: core: make overcurrent messages more prominent
+
+Hub overcurrent messages are more serious than "debug". Increase loglevel.
+
+usb: dwc_otg: Don't use dma_to_virt()
+
+Commit 6ce0d20 changes dma_to_virt() which breaks this driver.
+Open code the old dma_to_virt() implementation to work around this.
+
+Limit the use of __bus_to_virt() to cases where transfer_buffer_length
+is set and transfer_buffer is not set. This is done to increase the
+chance that this driver will also work on ARCH_BCM2835.
+
+transfer_buffer should not be NULL if the length is set, but the
+comment in the code indicates that there are situations where this
+might happen. drivers/usb/isp1760/isp1760-hcd.c also has a similar
+comment pointing to a possible: 'usb storage / SCSI bug'.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+dwc_otg: Fix crash when fiq_enable=0
+
+dwc_otg: fiq_fsm: Make high-speed isochronous strided transfers work properly
+
+Certain low-bandwidth high-speed USB devices (specialist audio devices,
+compressed-frame webcams) have packet intervals > 1 microframe.
+
+Stride these transfers in the FIQ by using the start-of-frame interrupt
+to restart the channel at the right time.
+
+dwc_otg: Force host mode to fix incorrect compute module boards
+
+dwc_otg: Add ARCH_BCM2835 support
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+dwc_otg: Simplify FIQ irq number code
+
+Dropping ATAGS means we can simplify the FIQ irq number code.
+Also add error checking on the returned irq number.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+dwc_otg: Remove duplicate gadget probe/unregister function
+
+dwc_otg: Properly set the HFIR
+
+Douglas Anderson reported:
+
+According to the most up to date version of the dwc2 databook, the FRINT
+field of the HFIR register should be programmed to:
+* 125 us * (PHY clock freq for HS) - 1
+* 1000 us * (PHY clock freq for FS/LS) - 1
+
+This is opposed to older versions of the doc that claimed it should be:
+* 125 us * (PHY clock freq for HS)
+* 1000 us * (PHY clock freq for FS/LS)
+
+and reported lower timing jitter on a USB analyser
+
+dcw_otg: trim xfer length when buffer larger than allocated size is received
+
+dwc_otg: Don't free qh align buffers in atomic context
+
+dwc_otg: Enable the hack for Split Interrupt transactions by default
+
+dwc_otg.fiq_fsm_mask=0xF has long been a suggestion for users with audio stutters or other USB bandwidth issues.
+So far we are aware of many success stories but no failure caused by this setting.
+Make it a default to learn more.
+
+See: https://www.raspberrypi.org/forums/viewtopic.php?f=28&t=70437
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+
+dwc_otg: Use kzalloc when suitable
+
+dwc_otg: Pass struct device to dma_alloc*()
+
+This makes it possible to get the bus address from Device Tree.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+dwc_otg: fix summarize urb->actual_length for isochronous transfers
+
+Kernel does not copy input data of ISO transfers to userspace
+if actual_length is set only in ISO transfers and not summarized
+in urb->actual_length. Fixes raspberrypi/linux#903
+
+fiq_fsm: Use correct states when starting isoc OUT transfers
+
+In fiq_fsm_start_next_periodic() if an isochronous OUT transfer
+was selected, no regard was given as to whether this was a single-packet
+transfer or a multi-packet staged transfer.
+
+For single-packet transfers, this had the effect of repeatedly sending
+OUT packets with bogus data and lengths.
+
+Eventually if the channel was repeatedly enabled enough times, this
+would lock up the OTG core and no further bus transfers would happen.
+
+Set the FSM state up properly if we select a single-packet transfer.
+
+Fixes https://github.com/raspberrypi/linux/issues/1842
+
+dwc_otg: make nak_holdoff work as intended with empty queues
+
+If URBs reading from non-periodic split endpoints were dequeued and
+the last transfer from the endpoint was a NAK handshake, the resulting
+qh->nak_frame value was stale which would result in unnecessarily long
+polling intervals for the first subsequent transfer with a fresh URB.
+
+Fixup qh->nak_frame in dwc_otg_hcd_urb_dequeue and also guard against
+a case where a single URB is submitted to the endpoint, a NAK was
+received on the transfer immediately prior to receiving data and the
+device subsequently resubmits another URB past the qh->nak_frame interval.
+
+Fixes https://github.com/raspberrypi/linux/issues/1709
+
+dwc_otg: fix split transaction data toggle handling around dequeues
+
+See https://github.com/raspberrypi/linux/issues/1709
+
+Fix several issues regarding endpoint state when URBs are dequeued
+- If the HCD is disconnected, flush FIQ-enabled channels properly
+- Save the data toggle state for bulk endpoints if the last transfer
+  from an endpoint where URBs were dequeued returned a data packet
+- Reset hc->start_pkt_count properly in assign_and_init_hc()
+
+dwc_otg: fix several potential crash sources
+
+On root port disconnect events, the host driver state is cleared and
+in-progress host channels are forcibly stopped. This doesn't play
+well with the FIQ running in the background, so:
+- Guard the disconnect callback with both the host spinlock and FIQ
+  spinlock
+- Move qtd dereference in dwc_otg_handle_hc_fsm() after the early-out
+  so we don't dereference a qtd that has gone away
+- Turn catch-all BUG()s in dwc_otg_handle_hc_fsm() into warnings.
+
+dwc_otg: delete hcd->channel_lock
+
+The lock serves no purpose as it is only held while the HCD spinlock
+is already being held.
+
+dwc_otg: remove unnecessary dma-mode channel halts on disconnect interrupt
+
+Host channels are already halted in kill_urbs_in_qh_list() with the
+subsequent interrupt processing behaving as if the URB was dequeued
+via HCD callback.
+
+There's no need to clobber the host channel registers a second time
+as this exposes races between the driver and host channel resulting
+in hcd->free_hc_list becoming corrupted.
+
+dwcotg: Allow to build without FIQ on ARM64
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+
+dwc_otg: make periodic scheduling behave properly for FS buses
+
+If the root port is in full-speed mode, transfer times at 12mbit/s
+would be calculated but matched against high-speed quotas.
+
+Reinitialise hcd->frame_usecs[i] on each port enable event so that
+full-speed bandwidth can be tracked sensibly.
+
+Also, don't bother using the FIQ for transfers when in full-speed
+mode - at the slower bus speed, interrupt frequency is reduced by
+an order of magnitude.
+
+Related issue: https://github.com/raspberrypi/linux/issues/2020
+
+dwc_otg: fiq_fsm: Make isochronous compatibility checks work properly
+
+Get rid of the spammy printk and local pointer mangling.
+Also, there is a nominal benefit for using fiq_fsm for isochronous
+transfers in FS mode (~1.1k IRQs per second vs 2.1k IRQs per second)
+so remove the root port speed check.
+
+dwc_otg: add module parameter int_ep_interval_min
+
+Add a module parameter (defaulting to ignored) that clamps the polling rate
+of high-speed Interrupt endpoints to a minimum microframe interval.
+
+The parameter is modifiable at runtime as it is used when activating new
+endpoints (such as on device connect).
+
+dwc_otg: fiq_fsm: Add non-periodic TT exclusivity constraints
+
+Certain hub types do not discriminate between pipe direction (IN or OUT)
+when considering non-periodic transfers. Therefore these hubs get confused
+if multiple transfers are issued in different directions with the same
+device address and endpoint number.
+
+Constrain queuing non-periodic split transactions so they are performed
+serially in such cases.
+
+Related: https://github.com/raspberrypi/linux/issues/2024
+
+dwc_otg: Fixup change to DRIVER_ATTR interface
+
+dwc_otg: Fix compilation warnings
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+USB_DWCOTG: Disable building dwc_otg as a module (#2265)
+
+When dwc_otg is built as a module, build will fail with the following
+error:
+
+ERROR: "DWC_TASK_HI_SCHEDULE" [drivers/usb/host/dwc_otg/dwc_otg.ko] undefined!
+scripts/Makefile.modpost:91: recipe for target '__modpost' failed
+make[1]: *** [__modpost] Error 1
+Makefile:1199: recipe for target 'modules' failed
+make: *** [modules] Error 2
+
+Even if the error is solved by including the missing
+DWC_TASK_HI_SCHEDULE function, the kernel will panic when loading
+dwc_otg.
+
+As a workaround, simply prevent user from building dwc_otg as a module
+as the current kernel does not support it.
+
+See: https://github.com/raspberrypi/linux/issues/2258
+
+Signed-off-by: Malik Olivier Boussejra <malik@boussejra.com>
+
+dwc_otg: New timer API
+
+dwc_otg: Fix removed ACCESS_ONCE->READ_ONCE
+
+dwc_otg: don't unconditionally force host mode in dwc_otg_cil_init()
+
+Add the ability to disable force_host_mode for those that want to use
+dwc_otg in both device and host modes.
+
+dwc_otg: Fix a regression when dequeueing isochronous transfers
+
+In 282bed95 (dwc_otg: make nak_holdoff work as intended with empty queues)
+the dequeue mechanism was changed to leave FIQ-enabled transfers to run
+to completion - to avoid leaving hub TT buffers with stale packets lying
+around.
+
+This broke FIQ-accelerated isochronous transfers, as this then meant that
+dozens of transfers were performed after the dequeue function returned.
+
+Restore the state machine fence for isochronous transfers.
+
+fiq_fsm: rewind DMA pointer for OUT transactions that fail (#2288)
+
+See: https://github.com/raspberrypi/linux/issues/2140
+
+dwc_otg: add smp_mb() to prevent driver state corruption on boot
+
+Occasional crashes have been seen where the FIQ code dereferences
+invalid/random pointers immediately after being set up, leading to
+panic on boot.
+
+The crash occurs as the FIQ code races against hcd_init_fiq() and
+the hcd_init_fiq() code races against the outstanding memory stores
+from dwc_otg_hcd_init(). Use explicit barriers after touching
+driver state.
+
+usb: dwc_otg: fix memory corruption in dwc_otg driver
+
+[Upstream commit 51b1b6491752ac066ee8d32cc66042fcc955fef6]
+
+The move from the staging tree to the main tree exposed a
+longstanding memory corruption bug in the dwc2 driver. The
+reordering of the driver initialization caused the dwc2 driver
+to corrupt the initialization data of the sdhci driver on the
+Raspberry Pi platform, which made the bug show up.
+
+The error is in calling to_usb_device(hsotg->dev), since ->dev
+is not a member of struct usb_device. The easiest fix is to
+just remove the offending code, since it is not really needed.
+
+Thanks to Stephen Warren for tracking down the cause of this.
+
+Reported-by: Andre Heider <a.heider@gmail.com>
+Tested-by: Stephen Warren <swarren@wwwdotorg.org>
+Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+[lukas: port from upstream dwc2 to out-of-tree dwc_otg driver]
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+
+usb: dwb_otg: Fix unreachable switch statement warning
+
+This warning appears with GCC 7.3.0 from toolchains.bootlin.com:
+
+../drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c: In function ‘fiq_fsm_update_hs_isoc’:
+../drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c:595:61: warning: statement will never be executed [-Wswitch-unreachable]
+   st->hctsiz_copy.b.xfersize = nrpackets * st->hcchar_copy.b.mps;
+                                            ~~~~~~~~~~~~~~~~~^~~~
+
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+
+dwc_otg: fiq_fsm: fix incorrect DMA register offset calculation
+
+Rationalise the offset and update all call sites.
+
+Fixes https://github.com/raspberrypi/linux/issues/2408
+
+dwc_otg: fix bug with port_addr assignment for single-TT hubs
+
+See https://github.com/raspberrypi/linux/issues/2734
+
+The "Hub Port" field in the split transaction packet was always set
+to 1 for single-TT hubs. The majority of single-TT hub products
+apparently ignore this field and broadcast to all downstream enabled
+ports, which masked the issue. A subset of hub devices apparently
+need the port number to be exact or split transactions will fail.
+
+usb: dwc_otg: Clean up build warnings on 64bit kernels
+
+No functional changes. Almost all are changes to logging lines.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+usb: dwc_otg: Use dma allocation for mphi dummy_send buffer
+
+The FIQ driver used a kzalloc'ed buffer for dummy_send,
+passing a kernel virtual address to the hardware block.
+The buffer is only ever used for a dummy read, so it
+should be harmless, but there is the chance that it will
+cause exceptions.
+
+Use a dma allocation so that we have a genuine bus address,
+and read from that.
+Free the allocation when done for good measure.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+dwc_otg: only do_split when we actually need to do a split
+
+The previous test would fail if the root port was in fullspeed mode
+and there was a hub between the FS device and the root port. While
+the transfer worked, the schedule mangling performed for high-speed
+split transfers would break leading to an 8ms polling interval.
+
+dwc_otg: fix locking around dequeueing and killing URBs
+
+kill_urbs_in_qh_list() is practically only ever called with the fiq lock
+already held, so don't spinlock twice in the case where we need to cancel
+an isochronous transfer.
+
+Also fix up a case where the global interrupt register could be read with
+the fiq lock not held.
+
+Fixes the deadlock seen in https://github.com/raspberrypi/linux/issues/2907
+
+ARM64/DWC_OTG: Port dwc_otg driver to ARM64
+
+In ARM64, the FIQ mechanism used by this driver is not current
+implemented.   As a workaround, reqular IRQ is used instead
+of FIQ.
+
+In a separate change, the IRQ-CPU mapping is round robined
+on ARM64 to increase concurrency and allow multiple interrupts
+to be serviced at a time.  This reduces the need for FIQ.
+
+Tests Run:
+
+This mechanism is most likely to break when multiple USB devices
+are attached at the same time.  So the system was tested under
+stress.
+
+Devices:
+
+1. USB Speakers playing back a FLAC audio through VLC
+   at 96KHz.(Higher then typically, but supported on my speakers).
+
+2. sftp transferring large files through the buildin ethernet
+   connection which is connected through USB.
+
+3. Keyboard and mouse attached and being used.
+
+Although I do occasionally hear some glitches, the music seems to
+play quite well.
+
+Signed-off-by: Michael Zoran <mzoran@crowfest.net>
+
+usb: dwc_otg: Clean up interrupt claiming code
+
+The FIQ/IRQ interrupt number identification code is scattered through
+the dwc_otg driver. Rationalise it, simplifying the code and solving
+an existing issue.
+
+See: https://github.com/raspberrypi/linux/issues/2612
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+dwc_otg: Choose appropriate IRQ handover strategy
+
+2711 has no MPHI peripheral, but the ARM Control block can fake
+interrupts. Use the size of the DTB "mphi" reg block to determine
+which is required.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+usb: host: dwc_otg: fix compiling in separate directory
+
+The dwc_otg Makefile does not respect the O=path argument correctly:
+include paths in CFLAGS are given relatively to object path, not source
+path. Compiling in a separate directory yields #include errors.
+
+Signed-off-by: Marek Behún <marek.behun@nic.cz>
+
+dwc_otg: use align_buf for small IN control transfers (#3150)
+
+The hardware will do a 4-byte write to memory on any IN packet received
+that is between 1 and 3 bytes long. This tramples memory in the uvcvideo
+driver, as it uses a sequence of 1- and 2-byte control transfers to
+query the min/max/range/step of each individual camera control and
+gives us buffers that are offsets into a struct.
+
+Catch small control transfers in the data phase and use the align_buf
+to bounce the correct number of bytes into the URB's buffer.
+
+In general, short packets on non-control endpoints should be OK as URBs
+should have enough buffer space for a wMaxPacket size transfer.
+
+See: https://github.com/raspberrypi/linux/issues/3148
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
+
+dwc_otg: Declare DMA capability with HCD_DMA flag
+
+Following [1], USB controllers have to declare DMA capabilities in
+order for them to be used by adding the HCD_DMA flag to their hc_driver
+struct.
+
+[1] 7b81cb6bddd2 ("usb: add a HCD_DMA flag instead of guestimating DMA capabilities")
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+dwc_otg: checking the urb->transfer_buffer too early (#3332)
+
+After enable the HIGHMEM and VMSPLIT_3G, the dwc_otg driver doesn't
+work well on Pi2/3 boards with 1G physical ram. Users experience
+the failure when copying a file of 600M size to the USB stick. And
+at the same time, the dmesg shows:
+usb 1-1.1.2: reset high-speed USB device number 8 using dwc_otg
+sd 0:0:0:0: [sda] tag#0 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK
+blk_update_request: I/O error, dev sda, sector 3024048 op 0x1:(WRITE) flags 0x4000 phys_seg 15 prio class 0
+
+When this happens, the sg_buf sent to the driver is located in the
+highmem region, the usb_sg_init() in the core/message.c will leave
+transfer_buffer to NULL if the sg_buf is in highmem, but in the
+dwc_otg driver, it returns -EINVAL unconditionally if transfer_buffer
+is NULL.
+
+The driver can handle the situation of buffer to be NULL, if it is in
+DMA mode, it will convert an address from transfer_dma.
+
+But if the conversion fails or it is in the PIO mode, we should check
+buffer and return -EINVAL if it is NULL.
+
+BugLink: https://bugs.launchpad.net/bugs/1852510
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+dwc_otg: constrain endpoint max packet and transfer size on split IN
+
+The hcd would unconditionally set the transfer length to the endpoint
+packet size for non-isoc IN transfers. If the remaining buffer length
+was less than the length of returned data, random memory would get
+scribbled over, with bad effects if it crossed a page boundary.
+
+Force a babble error if this happens by limiting the max transfer size
+to the available buffer space. DMA will stop writing to memory on a
+babble condition.
+
+The hardware expects xfersize to be an integer multiple of maxpacket
+size, so override hcchar.b.mps as well.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
+
+dwc_otg: fiq_fsm: pause when cancelling split transactions
+
+Non-periodic splits will DMA to/from the driver-provided transfer_buffer,
+which may be freed immediately after the dequeue call returns. Block until
+we know the transfer is complete.
+
+A similar delay is needed when cleaning up disconnects, as the FIQ could
+have started a periodic transfer in the previous microframe to the one
+that triggered a disconnect.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
+
+dwc_otg: fiq_fsm: add a barrier on entry into FIQ handler(s)
+
+On BCM2835, there is no hardware guarantee that multiple outstanding
+reads to different peripherals will complete in-order. The FIQ code
+uses peripheral reads without barriers for performance, so in the case
+where a read to a slow peripheral was issued immediately prior to FIQ
+entry, the first peripheral read that the FIQ did could end up with
+wrong read data returned.
+
+Add dsb(sy) on entry so that all outstanding reads are retired.
+
+The FIQ only issues reads to the dwc_otg core, so per-read barriers
+in the handler itself are not required.
+
+On BCM2836 and BCM2837 the barrier is not strictly required due to
+differences in how the peripheral bus is implemented, but having
+arch-specific handlers that introduce different latencies is risky.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
+
+dwc_otg: whitelist_table is now productlist_table
+
+dwc_otg: initialise sched_frame for periodic QHs that were parked
+
+If a periodic QH has no remaining QTDs, then it is removed from all
+periodic schedules. When re-adding, initialise the sched_frame and
+start_split_frame from the current value of the frame counter.
+
+See https://bugs.launchpad.net/raspbian/+bug/1819560
+and
+ https://github.com/raspberrypi/linux/issues/3883
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+dwc_otg: Minimise header and fix build warnings
+
+Delete a large amount of unused declaration from "usb.h", some of which
+were causing build warnings, and get the module building cleanly.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+dwc-otg: fix clang -Wignored-attributes warning
+
+warning: attribute declaration must precede definition
+
+dwc-otg: fix clang -Wsometimes-uninitialized warning
+
+warning: variable 'retval' is used uninitialized whenever 'if' condition is false
+
+dwc-otg: fix clang -Wpointer-bool-conversion warning
+
+warning: address of array 'desc->wMaxPacketSize' will always evaluate to 'true'
+
+The wMaxPacketSize field is actually a two element array which content should
+be accessed via the UGETW macro.
+
+dwc_otg: fix an undeclared variable
+Replace an undeclared variable used by DWC_DEBUGPL with the real endpoint address. DWC_DEBUGPL does nothing with DEBUG undefined so it did not go wrong before.
+Signed-off-by: Zixuan Wang <wangzixuan@sjtu.edu.cn>
+
+dwc_otg: Update NetBSD usb.h header licence
+
+NetBSD have changed their licensing requirements such that the 2-clause
+licence is preferred. Update usb.h in the downstream dwc_otg code
+accordingly.
+
+See https://www.netbsd.org/about/redistribution.html for more
+information.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+dwc_otg: pay attention to qh->interval when rescheduling periodic queues
+
+A regression introduced in https://github.com/raspberrypi/linux/pull/3887
+meant that if the newly scheduled transfer immediately returned data, and
+the driver resubmitted a single URB after every transfer, then the effective
+polling interval would end up being approx 1ms.
+
+Use the larger of SCHEDULE_SLOP or the configured endpoint interval.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+drivers: dwc_otg: Fix fallthrough warnings
+
+Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
+
+drivers: usb: dwc_otg: fix reference passing when checking bandwidth
+
+The pointer (struct usb_host_endpoint *)->hcpriv should contain a
+reference to dwc_otg_qh_t if the driver has already seen a URB submitted
+to this endpoint.
+
+It then checks whether the qh exists and is already in a schedule in
+order to decide whether to allocate periodic bandwidth or not. Passing a
+pointer to an offset inside of struct usb_host_endpoint instead of just
+the pointer means it dereferences bogus addresses.
+
+Rationalise (delete) a variable while we're at it.
+
+See https://github.com/raspberrypi/linux/issues/5189
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+drivers: dwc_otg: stop GCC from patching FIQ functions
+
+Configuring GCC to use task stack protector canaries means it will
+insert calls to check functions in FIQ code. This is bad, as a) the
+FIQ's stack is banked and b) the failure invokes __stack_chk_fail which
+eventually tries to call printk(). Printing to the console inside the
+FIQ is generally fatal.
+
+Add CFLAGS to stop this happening in FIQ code.
+
+Also catch one function where notrace wasn't specified.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+dwc_otg: Avoid the use of align_buf for short packets
+
+Recent kernels (from 6.5) fail to boot on Pi0-3.
+
+This has been tracked down to the call to:
+ret = usb_get_std_status(hdev, USB_RECIP_DEVICE, 0, &hubstatus);
+
+returning garbage in hubstatus (it gets the uninitialised contents of
+a kmalloc buffer that is not overwritten as expected).
+
+As we don't have strong evidence that this code path has ever worked,
+and it is causing a clear problem currently, lets disable it to
+allow wider use of newer kernels.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+drivers: dwc_otg: use C11 style variable array declarations
+
+The kernel C standard changed in 5.18.
+
+Remove a layer of indirection around the FIQ bounce buffers, be consistent
+with pointers to FIQ bounce buffers, and remove open-coded 32-bit clamping
+of DMA addresses.
+
+Also remove a pointless fiq_state initialisation loop.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ arch/arm/include/asm/irqflags.h               |   16 +-
+ arch/arm/kernel/fiqasm.S                      |    4 +
+ drivers/usb/Makefile                          |    1 +
+ drivers/usb/core/generic.c                    |    1 +
+ drivers/usb/core/hub.c                        |    2 +-
+ drivers/usb/core/message.c                    |   79 +
+ drivers/usb/core/otg_productlist.h            |  114 +-
+ drivers/usb/gadget/file_storage.c             | 3676 +++++++++
+ drivers/usb/host/Kconfig                      |   10 +
+ drivers/usb/host/Makefile                     |    1 +
+ drivers/usb/host/dwc_common_port/Makefile     |   58 +
+ .../usb/host/dwc_common_port/Makefile.fbsd    |   17 +
+ .../usb/host/dwc_common_port/Makefile.linux   |   49 +
+ drivers/usb/host/dwc_common_port/changes.txt  |  174 +
+ .../usb/host/dwc_common_port/doc/doxygen.cfg  |  270 +
+ drivers/usb/host/dwc_common_port/dwc_cc.c     |  532 ++
+ drivers/usb/host/dwc_common_port/dwc_cc.h     |  224 +
+ .../host/dwc_common_port/dwc_common_fbsd.c    | 1308 +++
+ .../host/dwc_common_port/dwc_common_linux.c   | 1409 ++++
+ .../host/dwc_common_port/dwc_common_nbsd.c    | 1275 +++
+ drivers/usb/host/dwc_common_port/dwc_crypto.c |  308 +
+ drivers/usb/host/dwc_common_port/dwc_crypto.h |  111 +
+ drivers/usb/host/dwc_common_port/dwc_dh.c     |  291 +
+ drivers/usb/host/dwc_common_port/dwc_dh.h     |  106 +
+ drivers/usb/host/dwc_common_port/dwc_list.h   |  594 ++
+ drivers/usb/host/dwc_common_port/dwc_mem.c    |  245 +
+ drivers/usb/host/dwc_common_port/dwc_modpow.c |  636 ++
+ drivers/usb/host/dwc_common_port/dwc_modpow.h |   34 +
+ .../usb/host/dwc_common_port/dwc_notifier.c   |  319 +
+ .../usb/host/dwc_common_port/dwc_notifier.h   |  122 +
+ drivers/usb/host/dwc_common_port/dwc_os.h     | 1275 +++
+ drivers/usb/host/dwc_common_port/usb.h        |  275 +
+ drivers/usb/host/dwc_otg/Makefile             |   86 +
+ drivers/usb/host/dwc_otg/doc/doxygen.cfg      |  224 +
+ drivers/usb/host/dwc_otg/dummy_audio.c        | 1574 ++++
+ drivers/usb/host/dwc_otg/dwc_cfi_common.h     |  142 +
+ drivers/usb/host/dwc_otg/dwc_otg_adp.c        |  842 ++
+ drivers/usb/host/dwc_otg/dwc_otg_adp.h        |   80 +
+ drivers/usb/host/dwc_otg/dwc_otg_attr.c       | 1212 +++
+ drivers/usb/host/dwc_otg/dwc_otg_attr.h       |   89 +
+ drivers/usb/host/dwc_otg/dwc_otg_cfi.c        | 1874 +++++
+ drivers/usb/host/dwc_otg/dwc_otg_cfi.h        |  320 +
+ drivers/usb/host/dwc_otg/dwc_otg_cil.c        | 7121 +++++++++++++++++
+ drivers/usb/host/dwc_otg/dwc_otg_cil.h        | 1464 ++++
+ drivers/usb/host/dwc_otg/dwc_otg_cil_intr.c   | 1578 ++++
+ drivers/usb/host/dwc_otg/dwc_otg_core_if.h    |  705 ++
+ drivers/usb/host/dwc_otg/dwc_otg_dbg.h        |  117 +
+ drivers/usb/host/dwc_otg/dwc_otg_driver.c     | 1725 ++++
+ drivers/usb/host/dwc_otg/dwc_otg_driver.h     |   86 +
+ drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c    | 1434 ++++
+ drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h    |  395 +
+ drivers/usb/host/dwc_otg/dwc_otg_fiq_stub.S   |   80 +
+ drivers/usb/host/dwc_otg/dwc_otg_hcd.c        | 4366 ++++++++++
+ drivers/usb/host/dwc_otg/dwc_otg_hcd.h        |  870 ++
+ drivers/usb/host/dwc_otg/dwc_otg_hcd_ddma.c   | 1135 +++
+ drivers/usb/host/dwc_otg/dwc_otg_hcd_if.h     |  441 +
+ drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c   | 2757 +++++++
+ drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c  | 1084 +++
+ drivers/usb/host/dwc_otg/dwc_otg_hcd_queue.c  |  974 +++
+ drivers/usb/host/dwc_otg/dwc_otg_os_dep.h     |  200 +
+ drivers/usb/host/dwc_otg/dwc_otg_pcd.c        | 2723 +++++++
+ drivers/usb/host/dwc_otg/dwc_otg_pcd.h        |  277 +
+ drivers/usb/host/dwc_otg/dwc_otg_pcd_if.h     |  381 +
+ drivers/usb/host/dwc_otg/dwc_otg_pcd_intr.c   | 5148 ++++++++++++
+ drivers/usb/host/dwc_otg/dwc_otg_pcd_linux.c  | 1262 +++
+ drivers/usb/host/dwc_otg/dwc_otg_regs.h       | 2550 ++++++
+ drivers/usb/host/dwc_otg/test/Makefile        |   16 +
+ drivers/usb/host/dwc_otg/test/dwc_otg_test.pm |  337 +
+ .../usb/host/dwc_otg/test/test_mod_param.pl   |  133 +
+ drivers/usb/host/dwc_otg/test/test_sysfs.pl   |  193 +
+ 70 files changed, 59515 insertions(+), 16 deletions(-)
+ create mode 100644 drivers/usb/gadget/file_storage.c
+ create mode 100644 drivers/usb/host/dwc_common_port/Makefile
+ create mode 100644 drivers/usb/host/dwc_common_port/Makefile.fbsd
+ create mode 100644 drivers/usb/host/dwc_common_port/Makefile.linux
+ create mode 100644 drivers/usb/host/dwc_common_port/changes.txt
+ create mode 100644 drivers/usb/host/dwc_common_port/doc/doxygen.cfg
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_cc.c
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_cc.h
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_common_fbsd.c
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_common_linux.c
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_common_nbsd.c
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_crypto.c
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_crypto.h
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_dh.c
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_dh.h
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_list.h
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_mem.c
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_modpow.c
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_modpow.h
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_notifier.c
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_notifier.h
+ create mode 100644 drivers/usb/host/dwc_common_port/dwc_os.h
+ create mode 100644 drivers/usb/host/dwc_common_port/usb.h
+ create mode 100644 drivers/usb/host/dwc_otg/Makefile
+ create mode 100644 drivers/usb/host/dwc_otg/doc/doxygen.cfg
+ create mode 100644 drivers/usb/host/dwc_otg/dummy_audio.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_cfi_common.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_adp.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_adp.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_attr.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_attr.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_cfi.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_cfi.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_cil.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_cil.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_cil_intr.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_core_if.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_dbg.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_driver.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_driver.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_fiq_stub.S
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd_ddma.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd_if.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd_queue.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_os_dep.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_pcd.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_pcd.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_pcd_if.h
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_pcd_intr.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_pcd_linux.c
+ create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_regs.h
+ create mode 100644 drivers/usb/host/dwc_otg/test/Makefile
+ create mode 100644 drivers/usb/host/dwc_otg/test/dwc_otg_test.pm
+ create mode 100644 drivers/usb/host/dwc_otg/test/test_mod_param.pl
+ create mode 100644 drivers/usb/host/dwc_otg/test/test_sysfs.pl
+
+--- a/arch/arm/include/asm/irqflags.h
++++ b/arch/arm/include/asm/irqflags.h
+@@ -163,13 +163,23 @@ static inline unsigned long arch_local_s
+ }
+ 
+ /*
+- * restore saved IRQ & FIQ state
++ * restore saved IRQ state
+  */
+ #define arch_local_irq_restore arch_local_irq_restore
+ static inline void arch_local_irq_restore(unsigned long flags)
+ {
+-	asm volatile(
+-		"	msr	" IRQMASK_REG_NAME_W ", %0	@ local_irq_restore"
++	unsigned long temp = 0;
++	flags &= ~(1 << 6);
++	asm volatile (
++		" mrs %0, cpsr"
++		: "=r" (temp)
++		:
++		: "memory", "cc");
++		/* Preserve FIQ bit */
++		temp &= (1 << 6);
++		flags = flags | temp;
++	asm volatile (
++		"    msr    cpsr_c, %0    @ local_irq_restore"
+ 		:
+ 		: "r" (flags)
+ 		: "memory", "cc");
+--- a/arch/arm/kernel/fiqasm.S
++++ b/arch/arm/kernel/fiqasm.S
+@@ -47,3 +47,7 @@ ENTRY(__get_fiq_regs)
+ 	mov	r0, r0		@ avoid hazard prior to ARMv4
+ 	ret	lr
+ ENDPROC(__get_fiq_regs)
++
++ENTRY(__FIQ_Branch)
++	mov pc, r8
++ENDPROC(__FIQ_Branch)
+--- a/drivers/usb/Makefile
++++ b/drivers/usb/Makefile
+@@ -9,6 +9,7 @@ obj-$(CONFIG_USB_COMMON)	+= common/
+ obj-$(CONFIG_USB)		+= core/
+ obj-$(CONFIG_USB_SUPPORT)	+= phy/
+ 
++obj-$(CONFIG_USB_DWCOTG)	+= host/
+ obj-$(CONFIG_USB_DWC3)		+= dwc3/
+ obj-$(CONFIG_USB_DWC2)		+= dwc2/
+ obj-$(CONFIG_USB_ISP1760)	+= isp1760/
+--- a/drivers/usb/core/generic.c
++++ b/drivers/usb/core/generic.c
+@@ -206,6 +206,7 @@ int usb_choose_configuration(struct usb_
+ 		dev_warn(&udev->dev,
+ 			"no configuration chosen from %d choice%s\n",
+ 			num_configs, plural(num_configs));
++		dev_warn(&udev->dev, "No support over %dmA\n", udev->bus_mA);
+ 	}
+ 	return i;
+ }
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -5742,7 +5742,7 @@ static void port_event(struct usb_hub *h
+ 		port_dev->over_current_count++;
+ 		port_over_current_notify(port_dev);
+ 
+-		dev_dbg(&port_dev->dev, "over-current change #%u\n",
++		dev_notice(&port_dev->dev, "over-current change #%u\n",
+ 			port_dev->over_current_count);
+ 		usb_clear_port_feature(hdev, port1,
+ 				USB_PORT_FEAT_C_OVER_CURRENT);
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -2180,6 +2180,85 @@ free_interfaces:
+ 	if (cp->string == NULL &&
+ 			!(dev->quirks & USB_QUIRK_CONFIG_INTF_STRINGS))
+ 		cp->string = usb_cache_string(dev, cp->desc.iConfiguration);
++/* Uncomment this define to enable the HS Electrical Test support */
++#define DWC_HS_ELECT_TST 1
++#ifdef DWC_HS_ELECT_TST
++		/* Here we implement the HS Electrical Test support. The
++		 * tester uses a vendor ID of 0x1A0A to indicate we should
++		 * run a special test sequence. The product ID tells us
++		 * which sequence to run. We invoke the test sequence by
++		 * sending a non-standard SetFeature command to our root
++		 * hub port. Our dwc_otg_hcd_hub_control() routine will
++		 * recognize the command and perform the desired test
++		 * sequence.
++		 */
++		if (dev->descriptor.idVendor == 0x1A0A) {
++			/* HSOTG Electrical Test */
++			dev_warn(&dev->dev, "VID from HSOTG Electrical Test Fixture\n");
++
++			if (dev->bus && dev->bus->root_hub) {
++				struct usb_device *hdev = dev->bus->root_hub;
++				dev_warn(&dev->dev, "Got PID 0x%x\n", dev->descriptor.idProduct);
++
++				switch (dev->descriptor.idProduct) {
++				case 0x0101:	/* TEST_SE0_NAK */
++					dev_warn(&dev->dev, "TEST_SE0_NAK\n");
++					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
++							USB_REQ_SET_FEATURE, USB_RT_PORT,
++							USB_PORT_FEAT_TEST, 0x300, NULL, 0, HZ);
++					break;
++
++				case 0x0102:	/* TEST_J */
++					dev_warn(&dev->dev, "TEST_J\n");
++					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
++							USB_REQ_SET_FEATURE, USB_RT_PORT,
++							USB_PORT_FEAT_TEST, 0x100, NULL, 0, HZ);
++					break;
++
++				case 0x0103:	/* TEST_K */
++					dev_warn(&dev->dev, "TEST_K\n");
++					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
++							USB_REQ_SET_FEATURE, USB_RT_PORT,
++							USB_PORT_FEAT_TEST, 0x200, NULL, 0, HZ);
++					break;
++
++				case 0x0104:	/* TEST_PACKET */
++					dev_warn(&dev->dev, "TEST_PACKET\n");
++					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
++							USB_REQ_SET_FEATURE, USB_RT_PORT,
++							USB_PORT_FEAT_TEST, 0x400, NULL, 0, HZ);
++					break;
++
++				case 0x0105:	/* TEST_FORCE_ENABLE */
++					dev_warn(&dev->dev, "TEST_FORCE_ENABLE\n");
++					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
++							USB_REQ_SET_FEATURE, USB_RT_PORT,
++							USB_PORT_FEAT_TEST, 0x500, NULL, 0, HZ);
++					break;
++
++				case 0x0106:	/* HS_HOST_PORT_SUSPEND_RESUME */
++					dev_warn(&dev->dev, "HS_HOST_PORT_SUSPEND_RESUME\n");
++					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
++							USB_REQ_SET_FEATURE, USB_RT_PORT,
++							USB_PORT_FEAT_TEST, 0x600, NULL, 0, 40 * HZ);
++					break;
++
++				case 0x0107:	/* SINGLE_STEP_GET_DEVICE_DESCRIPTOR setup */
++					dev_warn(&dev->dev, "SINGLE_STEP_GET_DEVICE_DESCRIPTOR setup\n");
++					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
++							USB_REQ_SET_FEATURE, USB_RT_PORT,
++							USB_PORT_FEAT_TEST, 0x700, NULL, 0, 40 * HZ);
++					break;
++
++				case 0x0108:	/* SINGLE_STEP_GET_DEVICE_DESCRIPTOR execute */
++					dev_warn(&dev->dev, "SINGLE_STEP_GET_DEVICE_DESCRIPTOR execute\n");
++					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
++							USB_REQ_SET_FEATURE, USB_RT_PORT,
++							USB_PORT_FEAT_TEST, 0x800, NULL, 0, 40 * HZ);
++				}
++			}
++		}
++#endif /* DWC_HS_ELECT_TST */
+ 
+ 	/* Now that the interfaces are installed, re-enable LPM. */
+ 	usb_unlocked_enable_lpm(dev);
+--- a/drivers/usb/core/otg_productlist.h
++++ b/drivers/usb/core/otg_productlist.h
+@@ -11,33 +11,82 @@
+ static struct usb_device_id productlist_table[] = {
+ 
+ /* hubs are optional in OTG, but very handy ... */
++#define CERT_WITHOUT_HUBS
++#if defined(CERT_WITHOUT_HUBS)
++{ USB_DEVICE( 0x0000, 0x0000 ), }, /* Root HUB Only*/
++#else
+ { USB_DEVICE_INFO(USB_CLASS_HUB, 0, 0), },
+ { USB_DEVICE_INFO(USB_CLASS_HUB, 0, 1), },
++{ USB_DEVICE_INFO(USB_CLASS_HUB, 0, 2), },
++#endif
+ 
+ #ifdef	CONFIG_USB_PRINTER		/* ignoring nonstatic linkage! */
+ /* FIXME actually, printers are NOT supposed to use device classes;
+  * they're supposed to use interface classes...
+  */
+-{ USB_DEVICE_INFO(7, 1, 1) },
+-{ USB_DEVICE_INFO(7, 1, 2) },
+-{ USB_DEVICE_INFO(7, 1, 3) },
++//{ USB_DEVICE_INFO(7, 1, 1) },
++//{ USB_DEVICE_INFO(7, 1, 2) },
++//{ USB_DEVICE_INFO(7, 1, 3) },
+ #endif
+ 
+ #ifdef	CONFIG_USB_NET_CDCETHER
+ /* Linux-USB CDC Ethernet gadget */
+-{ USB_DEVICE(0x0525, 0xa4a1), },
++//{ USB_DEVICE(0x0525, 0xa4a1), },
+ /* Linux-USB CDC Ethernet + RNDIS gadget */
+-{ USB_DEVICE(0x0525, 0xa4a2), },
++//{ USB_DEVICE(0x0525, 0xa4a2), },
+ #endif
+ 
+ #if	IS_ENABLED(CONFIG_USB_TEST)
+ /* gadget zero, for testing */
+-{ USB_DEVICE(0x0525, 0xa4a0), },
++//{ USB_DEVICE(0x0525, 0xa4a0), },
+ #endif
+ 
++/* OPT Tester */
++{ USB_DEVICE( 0x1a0a, 0x0101 ), }, /* TEST_SE0_NAK */
++{ USB_DEVICE( 0x1a0a, 0x0102 ), }, /* Test_J */
++{ USB_DEVICE( 0x1a0a, 0x0103 ), }, /* Test_K */
++{ USB_DEVICE( 0x1a0a, 0x0104 ), }, /* Test_PACKET */
++{ USB_DEVICE( 0x1a0a, 0x0105 ), }, /* Test_FORCE_ENABLE */
++{ USB_DEVICE( 0x1a0a, 0x0106 ), }, /* HS_PORT_SUSPEND_RESUME  */
++{ USB_DEVICE( 0x1a0a, 0x0107 ), }, /* SINGLE_STEP_GET_DESCRIPTOR setup */
++{ USB_DEVICE( 0x1a0a, 0x0108 ), }, /* SINGLE_STEP_GET_DESCRIPTOR execute */
++
++/* Sony cameras */
++{ USB_DEVICE_VER(0x054c,0x0010,0x0410, 0x0500), },
++
++/* Memory Devices */
++//{ USB_DEVICE( 0x0781, 0x5150 ), }, /* SanDisk */
++//{ USB_DEVICE( 0x05DC, 0x0080 ), }, /* Lexar */
++//{ USB_DEVICE( 0x4146, 0x9281 ), }, /* IOMEGA */
++//{ USB_DEVICE( 0x067b, 0x2507 ), }, /* Hammer 20GB External HD  */
++{ USB_DEVICE( 0x0EA0, 0x2168 ), }, /* Ours Technology Inc. (BUFFALO ClipDrive)*/
++//{ USB_DEVICE( 0x0457, 0x0150 ), }, /* Silicon Integrated Systems Corp. */
++
++/* HP Printers */
++//{ USB_DEVICE( 0x03F0, 0x1102 ), }, /* HP Photosmart 245 */
++//{ USB_DEVICE( 0x03F0, 0x1302 ), }, /* HP Photosmart 370 Series */
++
++/* Speakers */
++//{ USB_DEVICE( 0x0499, 0x3002 ), }, /* YAMAHA YST-MS35D USB Speakers */
++//{ USB_DEVICE( 0x0672, 0x1041 ), }, /* Labtec USB Headset */
++
+ { }	/* Terminating entry */
+ };
+ 
++static inline void report_errors(struct usb_device *dev)
++{
++	/* OTG MESSAGE: report errors here, customize to match your product */
++	dev_info(&dev->dev, "device Vendor:%04x Product:%04x is not supported\n",
++		 le16_to_cpu(dev->descriptor.idVendor),
++		 le16_to_cpu(dev->descriptor.idProduct));
++        if (USB_CLASS_HUB == dev->descriptor.bDeviceClass){
++                dev_printk(KERN_CRIT, &dev->dev, "Unsupported Hub Topology\n");
++        } else {
++                dev_printk(KERN_CRIT, &dev->dev, "Attached Device is not Supported\n");
++        }
++}
++
++
+ static int is_targeted(struct usb_device *dev)
+ {
+ 	struct usb_device_id	*id = productlist_table;
+@@ -87,16 +136,57 @@ static int is_targeted(struct usb_device
+ 			continue;
+ 
+ 		return 1;
+-	}
++		/* NOTE: can't use usb_match_id() since interface caches
++		 * aren't set up yet. this is cut/paste from that code.
++		 */
++		for (id = productlist_table; id->match_flags; id++) {
++#ifdef DEBUG
++			dev_dbg(&dev->dev,
++				"ID: V:%04x P:%04x DC:%04x SC:%04x PR:%04x \n",
++				id->idVendor,
++				id->idProduct,
++				id->bDeviceClass,
++				id->bDeviceSubClass,
++				id->bDeviceProtocol);
++#endif
+ 
+-	/* add other match criteria here ... */
++			if ((id->match_flags & USB_DEVICE_ID_MATCH_VENDOR) &&
++			    id->idVendor != le16_to_cpu(dev->descriptor.idVendor))
++				continue;
++
++			if ((id->match_flags & USB_DEVICE_ID_MATCH_PRODUCT) &&
++			    id->idProduct != le16_to_cpu(dev->descriptor.idProduct))
++				continue;
++
++			/* No need to test id->bcdDevice_lo != 0, since 0 is never
++			   greater than any unsigned number. */
++			if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_LO) &&
++			    (id->bcdDevice_lo > le16_to_cpu(dev->descriptor.bcdDevice)))
++				continue;
++
++			if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_HI) &&
++			    (id->bcdDevice_hi < le16_to_cpu(dev->descriptor.bcdDevice)))
++				continue;
++
++			if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_CLASS) &&
++			    (id->bDeviceClass != dev->descriptor.bDeviceClass))
++				continue;
++
++			if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_SUBCLASS) &&
++			    (id->bDeviceSubClass != dev->descriptor.bDeviceSubClass))
++				continue;
++
++			if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_PROTOCOL) &&
++			    (id->bDeviceProtocol != dev->descriptor.bDeviceProtocol))
++				continue;
+ 
++			return 1;
++		}
++	}
+ 
+-	/* OTG MESSAGE: report errors here, customize to match your product */
+-	dev_err(&dev->dev, "device v%04x p%04x is not supported\n",
+-		le16_to_cpu(dev->descriptor.idVendor),
+-		le16_to_cpu(dev->descriptor.idProduct));
++	/* add other match criteria here ... */
+ 
++	report_errors(dev);
+ 	return 0;
+ }
+ 
+--- /dev/null
++++ b/drivers/usb/gadget/file_storage.c
+@@ -0,0 +1,3676 @@
++/*
++ * file_storage.c -- File-backed USB Storage Gadget, for USB development
++ *
++ * Copyright (C) 2003-2008 Alan Stern
++ * All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions, and the following disclaimer,
++ *    without modification.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. The names of the above-listed copyright holders may not be used
++ *    to endorse or promote products derived from this software without
++ *    specific prior written permission.
++ *
++ * ALTERNATIVELY, this software may be distributed under the terms of the
++ * GNU General Public License ("GPL") as published by the Free Software
++ * Foundation, either version 2 of that License or (at your option) any
++ * later version.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
++ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
++ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
++ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
++ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
++ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++
++
++/*
++ * The File-backed Storage Gadget acts as a USB Mass Storage device,
++ * appearing to the host as a disk drive or as a CD-ROM drive.  In addition
++ * to providing an example of a genuinely useful gadget driver for a USB
++ * device, it also illustrates a technique of double-buffering for increased
++ * throughput.  Last but not least, it gives an easy way to probe the
++ * behavior of the Mass Storage drivers in a USB host.
++ *
++ * Backing storage is provided by a regular file or a block device, specified
++ * by the "file" module parameter.  Access can be limited to read-only by
++ * setting the optional "ro" module parameter.  (For CD-ROM emulation,
++ * access is always read-only.)  The gadget will indicate that it has
++ * removable media if the optional "removable" module parameter is set.
++ *
++ * The gadget supports the Control-Bulk (CB), Control-Bulk-Interrupt (CBI),
++ * and Bulk-Only (also known as Bulk-Bulk-Bulk or BBB) transports, selected
++ * by the optional "transport" module parameter.  It also supports the
++ * following protocols: RBC (0x01), ATAPI or SFF-8020i (0x02), QIC-157 (0c03),
++ * UFI (0x04), SFF-8070i (0x05), and transparent SCSI (0x06), selected by
++ * the optional "protocol" module parameter.  In addition, the default
++ * Vendor ID, Product ID, release number and serial number can be overridden.
++ *
++ * There is support for multiple logical units (LUNs), each of which has
++ * its own backing file.  The number of LUNs can be set using the optional
++ * "luns" module parameter (anywhere from 1 to 8), and the corresponding
++ * files are specified using comma-separated lists for "file" and "ro".
++ * The default number of LUNs is taken from the number of "file" elements;
++ * it is 1 if "file" is not given.  If "removable" is not set then a backing
++ * file must be specified for each LUN.  If it is set, then an unspecified
++ * or empty backing filename means the LUN's medium is not loaded.  Ideally
++ * each LUN would be settable independently as a disk drive or a CD-ROM
++ * drive, but currently all LUNs have to be the same type.  The CD-ROM
++ * emulation includes a single data track and no audio tracks; hence there
++ * need be only one backing file per LUN.
++ *
++ * Requirements are modest; only a bulk-in and a bulk-out endpoint are
++ * needed (an interrupt-out endpoint is also needed for CBI).  The memory
++ * requirement amounts to two 16K buffers, size configurable by a parameter.
++ * Support is included for both full-speed and high-speed operation.
++ *
++ * Note that the driver is slightly non-portable in that it assumes a
++ * single memory/DMA buffer will be useable for bulk-in, bulk-out, and
++ * interrupt-in endpoints.  With most device controllers this isn't an
++ * issue, but there may be some with hardware restrictions that prevent
++ * a buffer from being used by more than one endpoint.
++ *
++ * Module options:
++ *
++ *	file=filename[,filename...]
++ *				Required if "removable" is not set, names of
++ *					the files or block devices used for
++ *					backing storage
++ *	serial=HHHH...		Required serial number (string of hex chars)
++ *	ro=b[,b...]		Default false, booleans for read-only access
++ *	removable		Default false, boolean for removable media
++ *	luns=N			Default N = number of filenames, number of
++ *					LUNs to support
++ *	nofua=b[,b...]		Default false, booleans for ignore FUA flag
++ *					in SCSI WRITE(10,12) commands
++ *	stall			Default determined according to the type of
++ *					USB device controller (usually true),
++ *					boolean to permit the driver to halt
++ *					bulk endpoints
++ *	cdrom			Default false, boolean for whether to emulate
++ *					a CD-ROM drive
++ *	transport=XXX		Default BBB, transport name (CB, CBI, or BBB)
++ *	protocol=YYY		Default SCSI, protocol name (RBC, 8020 or
++ *					ATAPI, QIC, UFI, 8070, or SCSI;
++ *					also 1 - 6)
++ *	vendor=0xVVVV		Default 0x0525 (NetChip), USB Vendor ID
++ *	product=0xPPPP		Default 0xa4a5 (FSG), USB Product ID
++ *	release=0xRRRR		Override the USB release number (bcdDevice)
++ *	buflen=N		Default N=16384, buffer size used (will be
++ *					rounded down to a multiple of
++ *					PAGE_CACHE_SIZE)
++ *
++ * If CONFIG_USB_FILE_STORAGE_TEST is not set, only the "file", "serial", "ro",
++ * "removable", "luns", "nofua", "stall", and "cdrom" options are available;
++ * default values are used for everything else.
++ *
++ * The pathnames of the backing files and the ro settings are available in
++ * the attribute files "file", "nofua", and "ro" in the lun<n> subdirectory of
++ * the gadget's sysfs directory.  If the "removable" option is set, writing to
++ * these files will simulate ejecting/loading the medium (writing an empty
++ * line means eject) and adjusting a write-enable tab.  Changes to the ro
++ * setting are not allowed when the medium is loaded or if CD-ROM emulation
++ * is being used.
++ *
++ * This gadget driver is heavily based on "Gadget Zero" by David Brownell.
++ * The driver's SCSI command interface was based on the "Information
++ * technology - Small Computer System Interface - 2" document from
++ * X3T9.2 Project 375D, Revision 10L, 7-SEP-93, available at
++ * <http://www.t10.org/ftp/t10/drafts/s2/s2-r10l.pdf>.  The single exception
++ * is opcode 0x23 (READ FORMAT CAPACITIES), which was based on the
++ * "Universal Serial Bus Mass Storage Class UFI Command Specification"
++ * document, Revision 1.0, December 14, 1998, available at
++ * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>.
++ */
++
++
++/*
++ *				Driver Design
++ *
++ * The FSG driver is fairly straightforward.  There is a main kernel
++ * thread that handles most of the work.  Interrupt routines field
++ * callbacks from the controller driver: bulk- and interrupt-request
++ * completion notifications, endpoint-0 events, and disconnect events.
++ * Completion events are passed to the main thread by wakeup calls.  Many
++ * ep0 requests are handled at interrupt time, but SetInterface,
++ * SetConfiguration, and device reset requests are forwarded to the
++ * thread in the form of "exceptions" using SIGUSR1 signals (since they
++ * should interrupt any ongoing file I/O operations).
++ *
++ * The thread's main routine implements the standard command/data/status
++ * parts of a SCSI interaction.  It and its subroutines are full of tests
++ * for pending signals/exceptions -- all this polling is necessary since
++ * the kernel has no setjmp/longjmp equivalents.  (Maybe this is an
++ * indication that the driver really wants to be running in userspace.)
++ * An important point is that so long as the thread is alive it keeps an
++ * open reference to the backing file.  This will prevent unmounting
++ * the backing file's underlying filesystem and could cause problems
++ * during system shutdown, for example.  To prevent such problems, the
++ * thread catches INT, TERM, and KILL signals and converts them into
++ * an EXIT exception.
++ *
++ * In normal operation the main thread is started during the gadget's
++ * fsg_bind() callback and stopped during fsg_unbind().  But it can also
++ * exit when it receives a signal, and there's no point leaving the
++ * gadget running when the thread is dead.  So just before the thread
++ * exits, it deregisters the gadget driver.  This makes things a little
++ * tricky: The driver is deregistered at two places, and the exiting
++ * thread can indirectly call fsg_unbind() which in turn can tell the
++ * thread to exit.  The first problem is resolved through the use of the
++ * REGISTERED atomic bitflag; the driver will only be deregistered once.
++ * The second problem is resolved by having fsg_unbind() check
++ * fsg->state; it won't try to stop the thread if the state is already
++ * FSG_STATE_TERMINATED.
++ *
++ * To provide maximum throughput, the driver uses a circular pipeline of
++ * buffer heads (struct fsg_buffhd).  In principle the pipeline can be
++ * arbitrarily long; in practice the benefits don't justify having more
++ * than 2 stages (i.e., double buffering).  But it helps to think of the
++ * pipeline as being a long one.  Each buffer head contains a bulk-in and
++ * a bulk-out request pointer (since the buffer can be used for both
++ * output and input -- directions always are given from the host's
++ * point of view) as well as a pointer to the buffer and various state
++ * variables.
++ *
++ * Use of the pipeline follows a simple protocol.  There is a variable
++ * (fsg->next_buffhd_to_fill) that points to the next buffer head to use.
++ * At any time that buffer head may still be in use from an earlier
++ * request, so each buffer head has a state variable indicating whether
++ * it is EMPTY, FULL, or BUSY.  Typical use involves waiting for the
++ * buffer head to be EMPTY, filling the buffer either by file I/O or by
++ * USB I/O (during which the buffer head is BUSY), and marking the buffer
++ * head FULL when the I/O is complete.  Then the buffer will be emptied
++ * (again possibly by USB I/O, during which it is marked BUSY) and
++ * finally marked EMPTY again (possibly by a completion routine).
++ *
++ * A module parameter tells the driver to avoid stalling the bulk
++ * endpoints wherever the transport specification allows.  This is
++ * necessary for some UDCs like the SuperH, which cannot reliably clear a
++ * halt on a bulk endpoint.  However, under certain circumstances the
++ * Bulk-only specification requires a stall.  In such cases the driver
++ * will halt the endpoint and set a flag indicating that it should clear
++ * the halt in software during the next device reset.  Hopefully this
++ * will permit everything to work correctly.  Furthermore, although the
++ * specification allows the bulk-out endpoint to halt when the host sends
++ * too much data, implementing this would cause an unavoidable race.
++ * The driver will always use the "no-stall" approach for OUT transfers.
++ *
++ * One subtle point concerns sending status-stage responses for ep0
++ * requests.  Some of these requests, such as device reset, can involve
++ * interrupting an ongoing file I/O operation, which might take an
++ * arbitrarily long time.  During that delay the host might give up on
++ * the original ep0 request and issue a new one.  When that happens the
++ * driver should not notify the host about completion of the original
++ * request, as the host will no longer be waiting for it.  So the driver
++ * assigns to each ep0 request a unique tag, and it keeps track of the
++ * tag value of the request associated with a long-running exception
++ * (device-reset, interface-change, or configuration-change).  When the
++ * exception handler is finished, the status-stage response is submitted
++ * only if the current ep0 request tag is equal to the exception request
++ * tag.  Thus only the most recently received ep0 request will get a
++ * status-stage response.
++ *
++ * Warning: This driver source file is too long.  It ought to be split up
++ * into a header file plus about 3 separate .c files, to handle the details
++ * of the Gadget, USB Mass Storage, and SCSI protocols.
++ */
++
++
++/* #define VERBOSE_DEBUG */
++/* #define DUMP_MSGS */
++
++
++#include <linux/blkdev.h>
++#include <linux/completion.h>
++#include <linux/dcache.h>
++#include <linux/delay.h>
++#include <linux/device.h>
++#include <linux/fcntl.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/kref.h>
++#include <linux/kthread.h>
++#include <linux/limits.h>
++#include <linux/module.h>
++#include <linux/rwsem.h>
++#include <linux/slab.h>
++#include <linux/spinlock.h>
++#include <linux/string.h>
++#include <linux/freezer.h>
++#include <linux/utsname.h>
++
++#include <linux/usb/ch9.h>
++#include <linux/usb/gadget.h>
++
++#include "gadget_chips.h"
++
++
++
++/*
++ * Kbuild is not very cooperative with respect to linking separately
++ * compiled library objects into one module.  So for now we won't use
++ * separate compilation ... ensuring init/exit sections work to shrink
++ * the runtime footprint, and giving us at least some parts of what
++ * a "gcc --combine ... part1.c part2.c part3.c ... " build would.
++ */
++#include "usbstring.c"
++#include "config.c"
++#include "epautoconf.c"
++
++/*-------------------------------------------------------------------------*/
++
++#define DRIVER_DESC		"File-backed Storage Gadget"
++#define DRIVER_NAME		"g_file_storage"
++#define DRIVER_VERSION		"1 September 2010"
++
++static       char fsg_string_manufacturer[64];
++static const char fsg_string_product[] = DRIVER_DESC;
++static const char fsg_string_config[] = "Self-powered";
++static const char fsg_string_interface[] = "Mass Storage";
++
++
++#include "storage_common.c"
++
++
++MODULE_DESCRIPTION(DRIVER_DESC);
++MODULE_AUTHOR("Alan Stern");
++MODULE_LICENSE("Dual BSD/GPL");
++
++/*
++ * This driver assumes self-powered hardware and has no way for users to
++ * trigger remote wakeup.  It uses autoconfiguration to select endpoints
++ * and endpoint addresses.
++ */
++
++
++/*-------------------------------------------------------------------------*/
++
++
++/* Encapsulate the module parameter settings */
++
++static struct {
++	char		*file[FSG_MAX_LUNS];
++	char		*serial;
++	bool		ro[FSG_MAX_LUNS];
++	bool		nofua[FSG_MAX_LUNS];
++	unsigned int	num_filenames;
++	unsigned int	num_ros;
++	unsigned int	num_nofuas;
++	unsigned int	nluns;
++
++	bool		removable;
++	bool		can_stall;
++	bool		cdrom;
++
++	char		*transport_parm;
++	char		*protocol_parm;
++	unsigned short	vendor;
++	unsigned short	product;
++	unsigned short	release;
++	unsigned int	buflen;
++
++	int		transport_type;
++	char		*transport_name;
++	int		protocol_type;
++	char		*protocol_name;
++
++} mod_data = {					// Default values
++	.transport_parm		= "BBB",
++	.protocol_parm		= "SCSI",
++	.removable		= 0,
++	.can_stall		= 1,
++	.cdrom			= 0,
++	.vendor			= FSG_VENDOR_ID,
++	.product		= FSG_PRODUCT_ID,
++	.release		= 0xffff,	// Use controller chip type
++	.buflen			= 16384,
++	};
++
++
++module_param_array_named(file, mod_data.file, charp, &mod_data.num_filenames,
++		S_IRUGO);
++MODULE_PARM_DESC(file, "names of backing files or devices");
++
++module_param_named(serial, mod_data.serial, charp, S_IRUGO);
++MODULE_PARM_DESC(serial, "USB serial number");
++
++module_param_array_named(ro, mod_data.ro, bool, &mod_data.num_ros, S_IRUGO);
++MODULE_PARM_DESC(ro, "true to force read-only");
++
++module_param_array_named(nofua, mod_data.nofua, bool, &mod_data.num_nofuas,
++		S_IRUGO);
++MODULE_PARM_DESC(nofua, "true to ignore SCSI WRITE(10,12) FUA bit");
++
++module_param_named(luns, mod_data.nluns, uint, S_IRUGO);
++MODULE_PARM_DESC(luns, "number of LUNs");
++
++module_param_named(removable, mod_data.removable, bool, S_IRUGO);
++MODULE_PARM_DESC(removable, "true to simulate removable media");
++
++module_param_named(stall, mod_data.can_stall, bool, S_IRUGO);
++MODULE_PARM_DESC(stall, "false to prevent bulk stalls");
++
++module_param_named(cdrom, mod_data.cdrom, bool, S_IRUGO);
++MODULE_PARM_DESC(cdrom, "true to emulate cdrom instead of disk");
++
++/* In the non-TEST version, only the module parameters listed above
++ * are available. */
++#ifdef CONFIG_USB_FILE_STORAGE_TEST
++
++module_param_named(transport, mod_data.transport_parm, charp, S_IRUGO);
++MODULE_PARM_DESC(transport, "type of transport (BBB, CBI, or CB)");
++
++module_param_named(protocol, mod_data.protocol_parm, charp, S_IRUGO);
++MODULE_PARM_DESC(protocol, "type of protocol (RBC, 8020, QIC, UFI, "
++		"8070, or SCSI)");
++
++module_param_named(vendor, mod_data.vendor, ushort, S_IRUGO);
++MODULE_PARM_DESC(vendor, "USB Vendor ID");
++
++module_param_named(product, mod_data.product, ushort, S_IRUGO);
++MODULE_PARM_DESC(product, "USB Product ID");
++
++module_param_named(release, mod_data.release, ushort, S_IRUGO);
++MODULE_PARM_DESC(release, "USB release number");
++
++module_param_named(buflen, mod_data.buflen, uint, S_IRUGO);
++MODULE_PARM_DESC(buflen, "I/O buffer size");
++
++#endif /* CONFIG_USB_FILE_STORAGE_TEST */
++
++
++/*
++ * These definitions will permit the compiler to avoid generating code for
++ * parts of the driver that aren't used in the non-TEST version.  Even gcc
++ * can recognize when a test of a constant expression yields a dead code
++ * path.
++ */
++
++#ifdef CONFIG_USB_FILE_STORAGE_TEST
++
++#define transport_is_bbb()	(mod_data.transport_type == USB_PR_BULK)
++#define transport_is_cbi()	(mod_data.transport_type == USB_PR_CBI)
++#define protocol_is_scsi()	(mod_data.protocol_type == USB_SC_SCSI)
++
++#else
++
++#define transport_is_bbb()	1
++#define transport_is_cbi()	0
++#define protocol_is_scsi()	1
++
++#endif /* CONFIG_USB_FILE_STORAGE_TEST */
++
++
++/*-------------------------------------------------------------------------*/
++
++
++struct fsg_dev {
++	/* lock protects: state, all the req_busy's, and cbbuf_cmnd */
++	spinlock_t		lock;
++	struct usb_gadget	*gadget;
++
++	/* filesem protects: backing files in use */
++	struct rw_semaphore	filesem;
++
++	/* reference counting: wait until all LUNs are released */
++	struct kref		ref;
++
++	struct usb_ep		*ep0;		// Handy copy of gadget->ep0
++	struct usb_request	*ep0req;	// For control responses
++	unsigned int		ep0_req_tag;
++	const char		*ep0req_name;
++
++	struct usb_request	*intreq;	// For interrupt responses
++	int			intreq_busy;
++	struct fsg_buffhd	*intr_buffhd;
++
++	unsigned int		bulk_out_maxpacket;
++	enum fsg_state		state;		// For exception handling
++	unsigned int		exception_req_tag;
++
++	u8			config, new_config;
++
++	unsigned int		running : 1;
++	unsigned int		bulk_in_enabled : 1;
++	unsigned int		bulk_out_enabled : 1;
++	unsigned int		intr_in_enabled : 1;
++	unsigned int		phase_error : 1;
++	unsigned int		short_packet_received : 1;
++	unsigned int		bad_lun_okay : 1;
++
++	unsigned long		atomic_bitflags;
++#define REGISTERED		0
++#define IGNORE_BULK_OUT		1
++#define SUSPENDED		2
++
++	struct usb_ep		*bulk_in;
++	struct usb_ep		*bulk_out;
++	struct usb_ep		*intr_in;
++
++	struct fsg_buffhd	*next_buffhd_to_fill;
++	struct fsg_buffhd	*next_buffhd_to_drain;
++
++	int			thread_wakeup_needed;
++	struct completion	thread_notifier;
++	struct task_struct	*thread_task;
++
++	int			cmnd_size;
++	u8			cmnd[MAX_COMMAND_SIZE];
++	enum data_direction	data_dir;
++	u32			data_size;
++	u32			data_size_from_cmnd;
++	u32			tag;
++	unsigned int		lun;
++	u32			residue;
++	u32			usb_amount_left;
++
++	/* The CB protocol offers no way for a host to know when a command
++	 * has completed.  As a result the next command may arrive early,
++	 * and we will still have to handle it.  For that reason we need
++	 * a buffer to store new commands when using CB (or CBI, which
++	 * does not oblige a host to wait for command completion either). */
++	int			cbbuf_cmnd_size;
++	u8			cbbuf_cmnd[MAX_COMMAND_SIZE];
++
++	unsigned int		nluns;
++	struct fsg_lun		*luns;
++	struct fsg_lun		*curlun;
++	/* Must be the last entry */
++	struct fsg_buffhd	buffhds[];
++};
++
++typedef void (*fsg_routine_t)(struct fsg_dev *);
++
++static int exception_in_progress(struct fsg_dev *fsg)
++{
++	return (fsg->state > FSG_STATE_IDLE);
++}
++
++/* Make bulk-out requests be divisible by the maxpacket size */
++static void set_bulk_out_req_length(struct fsg_dev *fsg,
++		struct fsg_buffhd *bh, unsigned int length)
++{
++	unsigned int	rem;
++
++	bh->bulk_out_intended_length = length;
++	rem = length % fsg->bulk_out_maxpacket;
++	if (rem > 0)
++		length += fsg->bulk_out_maxpacket - rem;
++	bh->outreq->length = length;
++}
++
++static struct fsg_dev			*the_fsg;
++static struct usb_gadget_driver		fsg_driver;
++
++
++/*-------------------------------------------------------------------------*/
++
++static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
++{
++	const char	*name;
++
++	if (ep == fsg->bulk_in)
++		name = "bulk-in";
++	else if (ep == fsg->bulk_out)
++		name = "bulk-out";
++	else
++		name = ep->name;
++	DBG(fsg, "%s set halt\n", name);
++	return usb_ep_set_halt(ep);
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++/*
++ * DESCRIPTORS ... most are static, but strings and (full) configuration
++ * descriptors are built on demand.  Also the (static) config and interface
++ * descriptors are adjusted during fsg_bind().
++ */
++
++/* There is only one configuration. */
++#define	CONFIG_VALUE		1
++
++static struct usb_device_descriptor
++device_desc = {
++	.bLength =		sizeof device_desc,
++	.bDescriptorType =	USB_DT_DEVICE,
++
++	.bcdUSB =		cpu_to_le16(0x0200),
++	.bDeviceClass =		USB_CLASS_PER_INTERFACE,
++
++	/* The next three values can be overridden by module parameters */
++	.idVendor =		cpu_to_le16(FSG_VENDOR_ID),
++	.idProduct =		cpu_to_le16(FSG_PRODUCT_ID),
++	.bcdDevice =		cpu_to_le16(0xffff),
++
++	.iManufacturer =	FSG_STRING_MANUFACTURER,
++	.iProduct =		FSG_STRING_PRODUCT,
++	.iSerialNumber =	FSG_STRING_SERIAL,
++	.bNumConfigurations =	1,
++};
++
++static struct usb_config_descriptor
++config_desc = {
++	.bLength =		sizeof config_desc,
++	.bDescriptorType =	USB_DT_CONFIG,
++
++	/* wTotalLength computed by usb_gadget_config_buf() */
++	.bNumInterfaces =	1,
++	.bConfigurationValue =	CONFIG_VALUE,
++	.iConfiguration =	FSG_STRING_CONFIG,
++	.bmAttributes =		USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
++	.bMaxPower =		CONFIG_USB_GADGET_VBUS_DRAW / 2,
++};
++
++
++static struct usb_qualifier_descriptor
++dev_qualifier = {
++	.bLength =		sizeof dev_qualifier,
++	.bDescriptorType =	USB_DT_DEVICE_QUALIFIER,
++
++	.bcdUSB =		cpu_to_le16(0x0200),
++	.bDeviceClass =		USB_CLASS_PER_INTERFACE,
++
++	.bNumConfigurations =	1,
++};
++
++static int populate_bos(struct fsg_dev *fsg, u8 *buf)
++{
++	memcpy(buf, &fsg_bos_desc, USB_DT_BOS_SIZE);
++	buf += USB_DT_BOS_SIZE;
++
++	memcpy(buf, &fsg_ext_cap_desc, USB_DT_USB_EXT_CAP_SIZE);
++	buf += USB_DT_USB_EXT_CAP_SIZE;
++
++	memcpy(buf, &fsg_ss_cap_desc, USB_DT_USB_SS_CAP_SIZE);
++
++	return USB_DT_BOS_SIZE + USB_DT_USB_SS_CAP_SIZE
++		+ USB_DT_USB_EXT_CAP_SIZE;
++}
++
++/*
++ * Config descriptors must agree with the code that sets configurations
++ * and with code managing interfaces and their altsettings.  They must
++ * also handle different speeds and other-speed requests.
++ */
++static int populate_config_buf(struct usb_gadget *gadget,
++		u8 *buf, u8 type, unsigned index)
++{
++	enum usb_device_speed			speed = gadget->speed;
++	int					len;
++	const struct usb_descriptor_header	**function;
++
++	if (index > 0)
++		return -EINVAL;
++
++	if (gadget_is_dualspeed(gadget) && type == USB_DT_OTHER_SPEED_CONFIG)
++		speed = (USB_SPEED_FULL + USB_SPEED_HIGH) - speed;
++	function = gadget_is_dualspeed(gadget) && speed == USB_SPEED_HIGH
++		? (const struct usb_descriptor_header **)fsg_hs_function
++		: (const struct usb_descriptor_header **)fsg_fs_function;
++
++	/* for now, don't advertise srp-only devices */
++	if (!gadget_is_otg(gadget))
++		function++;
++
++	len = usb_gadget_config_buf(&config_desc, buf, EP0_BUFSIZE, function);
++	((struct usb_config_descriptor *) buf)->bDescriptorType = type;
++	return len;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++/* These routines may be called in process context or in_irq */
++
++/* Caller must hold fsg->lock */
++static void wakeup_thread(struct fsg_dev *fsg)
++{
++	/* Tell the main thread that something has happened */
++	fsg->thread_wakeup_needed = 1;
++	if (fsg->thread_task)
++		wake_up_process(fsg->thread_task);
++}
++
++
++static void raise_exception(struct fsg_dev *fsg, enum fsg_state new_state)
++{
++	unsigned long		flags;
++
++	/* Do nothing if a higher-priority exception is already in progress.
++	 * If a lower-or-equal priority exception is in progress, preempt it
++	 * and notify the main thread by sending it a signal. */
++	spin_lock_irqsave(&fsg->lock, flags);
++	if (fsg->state <= new_state) {
++		fsg->exception_req_tag = fsg->ep0_req_tag;
++		fsg->state = new_state;
++		if (fsg->thread_task)
++			send_sig_info(SIGUSR1, SEND_SIG_FORCED,
++					fsg->thread_task);
++	}
++	spin_unlock_irqrestore(&fsg->lock, flags);
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++/* The disconnect callback and ep0 routines.  These always run in_irq,
++ * except that ep0_queue() is called in the main thread to acknowledge
++ * completion of various requests: set config, set interface, and
++ * Bulk-only device reset. */
++
++static void fsg_disconnect(struct usb_gadget *gadget)
++{
++	struct fsg_dev		*fsg = get_gadget_data(gadget);
++
++	DBG(fsg, "disconnect or port reset\n");
++	raise_exception(fsg, FSG_STATE_DISCONNECT);
++}
++
++
++static int ep0_queue(struct fsg_dev *fsg)
++{
++	int	rc;
++
++	rc = usb_ep_queue(fsg->ep0, fsg->ep0req, GFP_ATOMIC);
++	if (rc != 0 && rc != -ESHUTDOWN) {
++
++		/* We can't do much more than wait for a reset */
++		WARNING(fsg, "error in submission: %s --> %d\n",
++				fsg->ep0->name, rc);
++	}
++	return rc;
++}
++
++static void ep0_complete(struct usb_ep *ep, struct usb_request *req)
++{
++	struct fsg_dev		*fsg = ep->driver_data;
++
++	if (req->actual > 0)
++		dump_msg(fsg, fsg->ep0req_name, req->buf, req->actual);
++	if (req->status || req->actual != req->length)
++		DBG(fsg, "%s --> %d, %u/%u\n", __func__,
++				req->status, req->actual, req->length);
++	if (req->status == -ECONNRESET)		// Request was cancelled
++		usb_ep_fifo_flush(ep);
++
++	if (req->status == 0 && req->context)
++		((fsg_routine_t) (req->context))(fsg);
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++/* Bulk and interrupt endpoint completion handlers.
++ * These always run in_irq. */
++
++static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
++{
++	struct fsg_dev		*fsg = ep->driver_data;
++	struct fsg_buffhd	*bh = req->context;
++
++	if (req->status || req->actual != req->length)
++		DBG(fsg, "%s --> %d, %u/%u\n", __func__,
++				req->status, req->actual, req->length);
++	if (req->status == -ECONNRESET)		// Request was cancelled
++		usb_ep_fifo_flush(ep);
++
++	/* Hold the lock while we update the request and buffer states */
++	smp_wmb();
++	spin_lock(&fsg->lock);
++	bh->inreq_busy = 0;
++	bh->state = BUF_STATE_EMPTY;
++	wakeup_thread(fsg);
++	spin_unlock(&fsg->lock);
++}
++
++static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
++{
++	struct fsg_dev		*fsg = ep->driver_data;
++	struct fsg_buffhd	*bh = req->context;
++
++	dump_msg(fsg, "bulk-out", req->buf, req->actual);
++	if (req->status || req->actual != bh->bulk_out_intended_length)
++		DBG(fsg, "%s --> %d, %u/%u\n", __func__,
++				req->status, req->actual,
++				bh->bulk_out_intended_length);
++	if (req->status == -ECONNRESET)		// Request was cancelled
++		usb_ep_fifo_flush(ep);
++
++	/* Hold the lock while we update the request and buffer states */
++	smp_wmb();
++	spin_lock(&fsg->lock);
++	bh->outreq_busy = 0;
++	bh->state = BUF_STATE_FULL;
++	wakeup_thread(fsg);
++	spin_unlock(&fsg->lock);
++}
++
++
++#ifdef CONFIG_USB_FILE_STORAGE_TEST
++static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
++{
++	struct fsg_dev		*fsg = ep->driver_data;
++	struct fsg_buffhd	*bh = req->context;
++
++	if (req->status || req->actual != req->length)
++		DBG(fsg, "%s --> %d, %u/%u\n", __func__,
++				req->status, req->actual, req->length);
++	if (req->status == -ECONNRESET)		// Request was cancelled
++		usb_ep_fifo_flush(ep);
++
++	/* Hold the lock while we update the request and buffer states */
++	smp_wmb();
++	spin_lock(&fsg->lock);
++	fsg->intreq_busy = 0;
++	bh->state = BUF_STATE_EMPTY;
++	wakeup_thread(fsg);
++	spin_unlock(&fsg->lock);
++}
++
++#else
++static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
++{}
++#endif /* CONFIG_USB_FILE_STORAGE_TEST */
++
++
++/*-------------------------------------------------------------------------*/
++
++/* Ep0 class-specific handlers.  These always run in_irq. */
++
++#ifdef CONFIG_USB_FILE_STORAGE_TEST
++static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{
++	struct usb_request	*req = fsg->ep0req;
++	static u8		cbi_reset_cmnd[6] = {
++			SEND_DIAGNOSTIC, 4, 0xff, 0xff, 0xff, 0xff};
++
++	/* Error in command transfer? */
++	if (req->status || req->length != req->actual ||
++			req->actual < 6 || req->actual > MAX_COMMAND_SIZE) {
++
++		/* Not all controllers allow a protocol stall after
++		 * receiving control-out data, but we'll try anyway. */
++		fsg_set_halt(fsg, fsg->ep0);
++		return;			// Wait for reset
++	}
++
++	/* Is it the special reset command? */
++	if (req->actual >= sizeof cbi_reset_cmnd &&
++			memcmp(req->buf, cbi_reset_cmnd,
++				sizeof cbi_reset_cmnd) == 0) {
++
++		/* Raise an exception to stop the current operation
++		 * and reinitialize our state. */
++		DBG(fsg, "cbi reset request\n");
++		raise_exception(fsg, FSG_STATE_RESET);
++		return;
++	}
++
++	VDBG(fsg, "CB[I] accept device-specific command\n");
++	spin_lock(&fsg->lock);
++
++	/* Save the command for later */
++	if (fsg->cbbuf_cmnd_size)
++		WARNING(fsg, "CB[I] overwriting previous command\n");
++	fsg->cbbuf_cmnd_size = req->actual;
++	memcpy(fsg->cbbuf_cmnd, req->buf, fsg->cbbuf_cmnd_size);
++
++	wakeup_thread(fsg);
++	spin_unlock(&fsg->lock);
++}
++
++#else
++static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{}
++#endif /* CONFIG_USB_FILE_STORAGE_TEST */
++
++
++static int class_setup_req(struct fsg_dev *fsg,
++		const struct usb_ctrlrequest *ctrl)
++{
++	struct usb_request	*req = fsg->ep0req;
++	int			value = -EOPNOTSUPP;
++	u16			w_index = le16_to_cpu(ctrl->wIndex);
++	u16                     w_value = le16_to_cpu(ctrl->wValue);
++	u16			w_length = le16_to_cpu(ctrl->wLength);
++
++	if (!fsg->config)
++		return value;
++
++	/* Handle Bulk-only class-specific requests */
++	if (transport_is_bbb()) {
++		switch (ctrl->bRequest) {
++
++		case US_BULK_RESET_REQUEST:
++			if (ctrl->bRequestType != (USB_DIR_OUT |
++					USB_TYPE_CLASS | USB_RECIP_INTERFACE))
++				break;
++			if (w_index != 0 || w_value != 0 || w_length != 0) {
++				value = -EDOM;
++				break;
++			}
++
++			/* Raise an exception to stop the current operation
++			 * and reinitialize our state. */
++			DBG(fsg, "bulk reset request\n");
++			raise_exception(fsg, FSG_STATE_RESET);
++			value = DELAYED_STATUS;
++			break;
++
++		case US_BULK_GET_MAX_LUN:
++			if (ctrl->bRequestType != (USB_DIR_IN |
++					USB_TYPE_CLASS | USB_RECIP_INTERFACE))
++				break;
++			if (w_index != 0 || w_value != 0 || w_length != 1) {
++				value = -EDOM;
++				break;
++			}
++			VDBG(fsg, "get max LUN\n");
++			*(u8 *) req->buf = fsg->nluns - 1;
++			value = 1;
++			break;
++		}
++	}
++
++	/* Handle CBI class-specific requests */
++	else {
++		switch (ctrl->bRequest) {
++
++		case USB_CBI_ADSC_REQUEST:
++			if (ctrl->bRequestType != (USB_DIR_OUT |
++					USB_TYPE_CLASS | USB_RECIP_INTERFACE))
++				break;
++			if (w_index != 0 || w_value != 0) {
++				value = -EDOM;
++				break;
++			}
++			if (w_length > MAX_COMMAND_SIZE) {
++				value = -EOVERFLOW;
++				break;
++			}
++			value = w_length;
++			fsg->ep0req->context = received_cbi_adsc;
++			break;
++		}
++	}
++
++	if (value == -EOPNOTSUPP)
++		VDBG(fsg,
++			"unknown class-specific control req "
++			"%02x.%02x v%04x i%04x l%u\n",
++			ctrl->bRequestType, ctrl->bRequest,
++			le16_to_cpu(ctrl->wValue), w_index, w_length);
++	return value;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++/* Ep0 standard request handlers.  These always run in_irq. */
++
++static int standard_setup_req(struct fsg_dev *fsg,
++		const struct usb_ctrlrequest *ctrl)
++{
++	struct usb_request	*req = fsg->ep0req;
++	int			value = -EOPNOTSUPP;
++	u16			w_index = le16_to_cpu(ctrl->wIndex);
++	u16			w_value = le16_to_cpu(ctrl->wValue);
++
++	/* Usually this just stores reply data in the pre-allocated ep0 buffer,
++	 * but config change events will also reconfigure hardware. */
++	switch (ctrl->bRequest) {
++
++	case USB_REQ_GET_DESCRIPTOR:
++		if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
++				USB_RECIP_DEVICE))
++			break;
++		switch (w_value >> 8) {
++
++		case USB_DT_DEVICE:
++			VDBG(fsg, "get device descriptor\n");
++			device_desc.bMaxPacketSize0 = fsg->ep0->maxpacket;
++			value = sizeof device_desc;
++			memcpy(req->buf, &device_desc, value);
++			break;
++		case USB_DT_DEVICE_QUALIFIER:
++			VDBG(fsg, "get device qualifier\n");
++			if (!gadget_is_dualspeed(fsg->gadget) ||
++					fsg->gadget->speed == USB_SPEED_SUPER)
++				break;
++			/*
++			 * Assume ep0 uses the same maxpacket value for both
++			 * speeds
++			 */
++			dev_qualifier.bMaxPacketSize0 = fsg->ep0->maxpacket;
++			value = sizeof dev_qualifier;
++			memcpy(req->buf, &dev_qualifier, value);
++			break;
++
++		case USB_DT_OTHER_SPEED_CONFIG:
++			VDBG(fsg, "get other-speed config descriptor\n");
++			if (!gadget_is_dualspeed(fsg->gadget) ||
++					fsg->gadget->speed == USB_SPEED_SUPER)
++				break;
++			goto get_config;
++		case USB_DT_CONFIG:
++			VDBG(fsg, "get configuration descriptor\n");
++get_config:
++			value = populate_config_buf(fsg->gadget,
++					req->buf,
++					w_value >> 8,
++					w_value & 0xff);
++			break;
++
++		case USB_DT_STRING:
++			VDBG(fsg, "get string descriptor\n");
++
++			/* wIndex == language code */
++			value = usb_gadget_get_string(&fsg_stringtab,
++					w_value & 0xff, req->buf);
++			break;
++
++		case USB_DT_BOS:
++			VDBG(fsg, "get bos descriptor\n");
++
++			if (gadget_is_superspeed(fsg->gadget))
++				value = populate_bos(fsg, req->buf);
++			break;
++		}
++
++		break;
++
++	/* One config, two speeds */
++	case USB_REQ_SET_CONFIGURATION:
++		if (ctrl->bRequestType != (USB_DIR_OUT | USB_TYPE_STANDARD |
++				USB_RECIP_DEVICE))
++			break;
++		VDBG(fsg, "set configuration\n");
++		if (w_value == CONFIG_VALUE || w_value == 0) {
++			fsg->new_config = w_value;
++
++			/* Raise an exception to wipe out previous transaction
++			 * state (queued bufs, etc) and set the new config. */
++			raise_exception(fsg, FSG_STATE_CONFIG_CHANGE);
++			value = DELAYED_STATUS;
++		}
++		break;
++	case USB_REQ_GET_CONFIGURATION:
++		if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
++				USB_RECIP_DEVICE))
++			break;
++		VDBG(fsg, "get configuration\n");
++		*(u8 *) req->buf = fsg->config;
++		value = 1;
++		break;
++
++	case USB_REQ_SET_INTERFACE:
++		if (ctrl->bRequestType != (USB_DIR_OUT| USB_TYPE_STANDARD |
++				USB_RECIP_INTERFACE))
++			break;
++		if (fsg->config && w_index == 0) {
++
++			/* Raise an exception to wipe out previous transaction
++			 * state (queued bufs, etc) and install the new
++			 * interface altsetting. */
++			raise_exception(fsg, FSG_STATE_INTERFACE_CHANGE);
++			value = DELAYED_STATUS;
++		}
++		break;
++	case USB_REQ_GET_INTERFACE:
++		if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
++				USB_RECIP_INTERFACE))
++			break;
++		if (!fsg->config)
++			break;
++		if (w_index != 0) {
++			value = -EDOM;
++			break;
++		}
++		VDBG(fsg, "get interface\n");
++		*(u8 *) req->buf = 0;
++		value = 1;
++		break;
++
++	default:
++		VDBG(fsg,
++			"unknown control req %02x.%02x v%04x i%04x l%u\n",
++			ctrl->bRequestType, ctrl->bRequest,
++			w_value, w_index, le16_to_cpu(ctrl->wLength));
++	}
++
++	return value;
++}
++
++
++static int fsg_setup(struct usb_gadget *gadget,
++		const struct usb_ctrlrequest *ctrl)
++{
++	struct fsg_dev		*fsg = get_gadget_data(gadget);
++	int			rc;
++	int			w_length = le16_to_cpu(ctrl->wLength);
++
++	++fsg->ep0_req_tag;		// Record arrival of a new request
++	fsg->ep0req->context = NULL;
++	fsg->ep0req->length = 0;
++	dump_msg(fsg, "ep0-setup", (u8 *) ctrl, sizeof(*ctrl));
++
++	if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_CLASS)
++		rc = class_setup_req(fsg, ctrl);
++	else
++		rc = standard_setup_req(fsg, ctrl);
++
++	/* Respond with data/status or defer until later? */
++	if (rc >= 0 && rc != DELAYED_STATUS) {
++		rc = min(rc, w_length);
++		fsg->ep0req->length = rc;
++		fsg->ep0req->zero = rc < w_length;
++		fsg->ep0req_name = (ctrl->bRequestType & USB_DIR_IN ?
++				"ep0-in" : "ep0-out");
++		rc = ep0_queue(fsg);
++	}
++
++	/* Device either stalls (rc < 0) or reports success */
++	return rc;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++/* All the following routines run in process context */
++
++
++/* Use this for bulk or interrupt transfers, not ep0 */
++static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
++		struct usb_request *req, int *pbusy,
++		enum fsg_buffer_state *state)
++{
++	int	rc;
++
++	if (ep == fsg->bulk_in)
++		dump_msg(fsg, "bulk-in", req->buf, req->length);
++	else if (ep == fsg->intr_in)
++		dump_msg(fsg, "intr-in", req->buf, req->length);
++
++	spin_lock_irq(&fsg->lock);
++	*pbusy = 1;
++	*state = BUF_STATE_BUSY;
++	spin_unlock_irq(&fsg->lock);
++	rc = usb_ep_queue(ep, req, GFP_KERNEL);
++	if (rc != 0) {
++		*pbusy = 0;
++		*state = BUF_STATE_EMPTY;
++
++		/* We can't do much more than wait for a reset */
++
++		/* Note: currently the net2280 driver fails zero-length
++		 * submissions if DMA is enabled. */
++		if (rc != -ESHUTDOWN && !(rc == -EOPNOTSUPP &&
++						req->length == 0))
++			WARNING(fsg, "error in submission: %s --> %d\n",
++					ep->name, rc);
++	}
++}
++
++
++static int sleep_thread(struct fsg_dev *fsg)
++{
++	int	rc = 0;
++
++	/* Wait until a signal arrives or we are woken up */
++	for (;;) {
++		try_to_freeze();
++		set_current_state(TASK_INTERRUPTIBLE);
++		if (signal_pending(current)) {
++			rc = -EINTR;
++			break;
++		}
++		if (fsg->thread_wakeup_needed)
++			break;
++		schedule();
++	}
++	__set_current_state(TASK_RUNNING);
++	fsg->thread_wakeup_needed = 0;
++	return rc;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static int do_read(struct fsg_dev *fsg)
++{
++	struct fsg_lun		*curlun = fsg->curlun;
++	u32			lba;
++	struct fsg_buffhd	*bh;
++	int			rc;
++	u32			amount_left;
++	loff_t			file_offset, file_offset_tmp;
++	unsigned int		amount;
++	ssize_t			nread;
++
++	/* Get the starting Logical Block Address and check that it's
++	 * not too big */
++	if (fsg->cmnd[0] == READ_6)
++		lba = get_unaligned_be24(&fsg->cmnd[1]);
++	else {
++		lba = get_unaligned_be32(&fsg->cmnd[2]);
++
++		/* We allow DPO (Disable Page Out = don't save data in the
++		 * cache) and FUA (Force Unit Access = don't read from the
++		 * cache), but we don't implement them. */
++		if ((fsg->cmnd[1] & ~0x18) != 0) {
++			curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++			return -EINVAL;
++		}
++	}
++	if (lba >= curlun->num_sectors) {
++		curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
++		return -EINVAL;
++	}
++	file_offset = ((loff_t) lba) << curlun->blkbits;
++
++	/* Carry out the file reads */
++	amount_left = fsg->data_size_from_cmnd;
++	if (unlikely(amount_left == 0))
++		return -EIO;		// No default reply
++
++	for (;;) {
++
++		/* Figure out how much we need to read:
++		 * Try to read the remaining amount.
++		 * But don't read more than the buffer size.
++		 * And don't try to read past the end of the file.
++		 */
++		amount = min((unsigned int) amount_left, mod_data.buflen);
++		amount = min((loff_t) amount,
++				curlun->file_length - file_offset);
++
++		/* Wait for the next buffer to become available */
++		bh = fsg->next_buffhd_to_fill;
++		while (bh->state != BUF_STATE_EMPTY) {
++			rc = sleep_thread(fsg);
++			if (rc)
++				return rc;
++		}
++
++		/* If we were asked to read past the end of file,
++		 * end with an empty buffer. */
++		if (amount == 0) {
++			curlun->sense_data =
++					SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
++			curlun->sense_data_info = file_offset >> curlun->blkbits;
++			curlun->info_valid = 1;
++			bh->inreq->length = 0;
++			bh->state = BUF_STATE_FULL;
++			break;
++		}
++
++		/* Perform the read */
++		file_offset_tmp = file_offset;
++		nread = vfs_read(curlun->filp,
++				(char __user *) bh->buf,
++				amount, &file_offset_tmp);
++		VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
++				(unsigned long long) file_offset,
++				(int) nread);
++		if (signal_pending(current))
++			return -EINTR;
++
++		if (nread < 0) {
++			LDBG(curlun, "error in file read: %d\n",
++					(int) nread);
++			nread = 0;
++		} else if (nread < amount) {
++			LDBG(curlun, "partial file read: %d/%u\n",
++					(int) nread, amount);
++			nread = round_down(nread, curlun->blksize);
++		}
++		file_offset  += nread;
++		amount_left  -= nread;
++		fsg->residue -= nread;
++
++		/* Except at the end of the transfer, nread will be
++		 * equal to the buffer size, which is divisible by the
++		 * bulk-in maxpacket size.
++		 */
++		bh->inreq->length = nread;
++		bh->state = BUF_STATE_FULL;
++
++		/* If an error occurred, report it and its position */
++		if (nread < amount) {
++			curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
++			curlun->sense_data_info = file_offset >> curlun->blkbits;
++			curlun->info_valid = 1;
++			break;
++		}
++
++		if (amount_left == 0)
++			break;		// No more left to read
++
++		/* Send this buffer and go read some more */
++		bh->inreq->zero = 0;
++		start_transfer(fsg, fsg->bulk_in, bh->inreq,
++				&bh->inreq_busy, &bh->state);
++		fsg->next_buffhd_to_fill = bh->next;
++	}
++
++	return -EIO;		// No default reply
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static int do_write(struct fsg_dev *fsg)
++{
++	struct fsg_lun		*curlun = fsg->curlun;
++	u32			lba;
++	struct fsg_buffhd	*bh;
++	int			get_some_more;
++	u32			amount_left_to_req, amount_left_to_write;
++	loff_t			usb_offset, file_offset, file_offset_tmp;
++	unsigned int		amount;
++	ssize_t			nwritten;
++	int			rc;
++
++	if (curlun->ro) {
++		curlun->sense_data = SS_WRITE_PROTECTED;
++		return -EINVAL;
++	}
++	spin_lock(&curlun->filp->f_lock);
++	curlun->filp->f_flags &= ~O_SYNC;	// Default is not to wait
++	spin_unlock(&curlun->filp->f_lock);
++
++	/* Get the starting Logical Block Address and check that it's
++	 * not too big */
++	if (fsg->cmnd[0] == WRITE_6)
++		lba = get_unaligned_be24(&fsg->cmnd[1]);
++	else {
++		lba = get_unaligned_be32(&fsg->cmnd[2]);
++
++		/* We allow DPO (Disable Page Out = don't save data in the
++		 * cache) and FUA (Force Unit Access = write directly to the
++		 * medium).  We don't implement DPO; we implement FUA by
++		 * performing synchronous output. */
++		if ((fsg->cmnd[1] & ~0x18) != 0) {
++			curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++			return -EINVAL;
++		}
++		/* FUA */
++		if (!curlun->nofua && (fsg->cmnd[1] & 0x08)) {
++			spin_lock(&curlun->filp->f_lock);
++			curlun->filp->f_flags |= O_DSYNC;
++			spin_unlock(&curlun->filp->f_lock);
++		}
++	}
++	if (lba >= curlun->num_sectors) {
++		curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
++		return -EINVAL;
++	}
++
++	/* Carry out the file writes */
++	get_some_more = 1;
++	file_offset = usb_offset = ((loff_t) lba) << curlun->blkbits;
++	amount_left_to_req = amount_left_to_write = fsg->data_size_from_cmnd;
++
++	while (amount_left_to_write > 0) {
++
++		/* Queue a request for more data from the host */
++		bh = fsg->next_buffhd_to_fill;
++		if (bh->state == BUF_STATE_EMPTY && get_some_more) {
++
++			/* Figure out how much we want to get:
++			 * Try to get the remaining amount,
++			 * but not more than the buffer size.
++			 */
++			amount = min(amount_left_to_req, mod_data.buflen);
++
++			/* Beyond the end of the backing file? */
++			if (usb_offset >= curlun->file_length) {
++				get_some_more = 0;
++				curlun->sense_data =
++					SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
++				curlun->sense_data_info = usb_offset >> curlun->blkbits;
++				curlun->info_valid = 1;
++				continue;
++			}
++
++			/* Get the next buffer */
++			usb_offset += amount;
++			fsg->usb_amount_left -= amount;
++			amount_left_to_req -= amount;
++			if (amount_left_to_req == 0)
++				get_some_more = 0;
++
++			/* Except at the end of the transfer, amount will be
++			 * equal to the buffer size, which is divisible by
++			 * the bulk-out maxpacket size.
++			 */
++			set_bulk_out_req_length(fsg, bh, amount);
++			start_transfer(fsg, fsg->bulk_out, bh->outreq,
++					&bh->outreq_busy, &bh->state);
++			fsg->next_buffhd_to_fill = bh->next;
++			continue;
++		}
++
++		/* Write the received data to the backing file */
++		bh = fsg->next_buffhd_to_drain;
++		if (bh->state == BUF_STATE_EMPTY && !get_some_more)
++			break;			// We stopped early
++		if (bh->state == BUF_STATE_FULL) {
++			smp_rmb();
++			fsg->next_buffhd_to_drain = bh->next;
++			bh->state = BUF_STATE_EMPTY;
++
++			/* Did something go wrong with the transfer? */
++			if (bh->outreq->status != 0) {
++				curlun->sense_data = SS_COMMUNICATION_FAILURE;
++				curlun->sense_data_info = file_offset >> curlun->blkbits;
++				curlun->info_valid = 1;
++				break;
++			}
++
++			amount = bh->outreq->actual;
++			if (curlun->file_length - file_offset < amount) {
++				LERROR(curlun,
++	"write %u @ %llu beyond end %llu\n",
++	amount, (unsigned long long) file_offset,
++	(unsigned long long) curlun->file_length);
++				amount = curlun->file_length - file_offset;
++			}
++
++			/* Don't accept excess data.  The spec doesn't say
++			 * what to do in this case.  We'll ignore the error.
++			 */
++			amount = min(amount, bh->bulk_out_intended_length);
++
++			/* Don't write a partial block */
++			amount = round_down(amount, curlun->blksize);
++			if (amount == 0)
++				goto empty_write;
++
++			/* Perform the write */
++			file_offset_tmp = file_offset;
++			nwritten = vfs_write(curlun->filp,
++					(char __user *) bh->buf,
++					amount, &file_offset_tmp);
++			VLDBG(curlun, "file write %u @ %llu -> %d\n", amount,
++					(unsigned long long) file_offset,
++					(int) nwritten);
++			if (signal_pending(current))
++				return -EINTR;		// Interrupted!
++
++			if (nwritten < 0) {
++				LDBG(curlun, "error in file write: %d\n",
++						(int) nwritten);
++				nwritten = 0;
++			} else if (nwritten < amount) {
++				LDBG(curlun, "partial file write: %d/%u\n",
++						(int) nwritten, amount);
++				nwritten = round_down(nwritten, curlun->blksize);
++			}
++			file_offset += nwritten;
++			amount_left_to_write -= nwritten;
++			fsg->residue -= nwritten;
++
++			/* If an error occurred, report it and its position */
++			if (nwritten < amount) {
++				curlun->sense_data = SS_WRITE_ERROR;
++				curlun->sense_data_info = file_offset >> curlun->blkbits;
++				curlun->info_valid = 1;
++				break;
++			}
++
++ empty_write:
++			/* Did the host decide to stop early? */
++			if (bh->outreq->actual < bh->bulk_out_intended_length) {
++				fsg->short_packet_received = 1;
++				break;
++			}
++			continue;
++		}
++
++		/* Wait for something to happen */
++		rc = sleep_thread(fsg);
++		if (rc)
++			return rc;
++	}
++
++	return -EIO;		// No default reply
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static int do_synchronize_cache(struct fsg_dev *fsg)
++{
++	struct fsg_lun	*curlun = fsg->curlun;
++	int		rc;
++
++	/* We ignore the requested LBA and write out all file's
++	 * dirty data buffers. */
++	rc = fsg_lun_fsync_sub(curlun);
++	if (rc)
++		curlun->sense_data = SS_WRITE_ERROR;
++	return 0;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static void invalidate_sub(struct fsg_lun *curlun)
++{
++	struct file	*filp = curlun->filp;
++	struct inode	*inode = filp->f_path.dentry->d_inode;
++	unsigned long	rc;
++
++	rc = invalidate_mapping_pages(inode->i_mapping, 0, -1);
++	VLDBG(curlun, "invalidate_mapping_pages -> %ld\n", rc);
++}
++
++static int do_verify(struct fsg_dev *fsg)
++{
++	struct fsg_lun		*curlun = fsg->curlun;
++	u32			lba;
++	u32			verification_length;
++	struct fsg_buffhd	*bh = fsg->next_buffhd_to_fill;
++	loff_t			file_offset, file_offset_tmp;
++	u32			amount_left;
++	unsigned int		amount;
++	ssize_t			nread;
++
++	/* Get the starting Logical Block Address and check that it's
++	 * not too big */
++	lba = get_unaligned_be32(&fsg->cmnd[2]);
++	if (lba >= curlun->num_sectors) {
++		curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
++		return -EINVAL;
++	}
++
++	/* We allow DPO (Disable Page Out = don't save data in the
++	 * cache) but we don't implement it. */
++	if ((fsg->cmnd[1] & ~0x10) != 0) {
++		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++		return -EINVAL;
++	}
++
++	verification_length = get_unaligned_be16(&fsg->cmnd[7]);
++	if (unlikely(verification_length == 0))
++		return -EIO;		// No default reply
++
++	/* Prepare to carry out the file verify */
++	amount_left = verification_length << curlun->blkbits;
++	file_offset = ((loff_t) lba) << curlun->blkbits;
++
++	/* Write out all the dirty buffers before invalidating them */
++	fsg_lun_fsync_sub(curlun);
++	if (signal_pending(current))
++		return -EINTR;
++
++	invalidate_sub(curlun);
++	if (signal_pending(current))
++		return -EINTR;
++
++	/* Just try to read the requested blocks */
++	while (amount_left > 0) {
++
++		/* Figure out how much we need to read:
++		 * Try to read the remaining amount, but not more than
++		 * the buffer size.
++		 * And don't try to read past the end of the file.
++		 */
++		amount = min((unsigned int) amount_left, mod_data.buflen);
++		amount = min((loff_t) amount,
++				curlun->file_length - file_offset);
++		if (amount == 0) {
++			curlun->sense_data =
++					SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
++			curlun->sense_data_info = file_offset >> curlun->blkbits;
++			curlun->info_valid = 1;
++			break;
++		}
++
++		/* Perform the read */
++		file_offset_tmp = file_offset;
++		nread = vfs_read(curlun->filp,
++				(char __user *) bh->buf,
++				amount, &file_offset_tmp);
++		VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
++				(unsigned long long) file_offset,
++				(int) nread);
++		if (signal_pending(current))
++			return -EINTR;
++
++		if (nread < 0) {
++			LDBG(curlun, "error in file verify: %d\n",
++					(int) nread);
++			nread = 0;
++		} else if (nread < amount) {
++			LDBG(curlun, "partial file verify: %d/%u\n",
++					(int) nread, amount);
++			nread = round_down(nread, curlun->blksize);
++		}
++		if (nread == 0) {
++			curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
++			curlun->sense_data_info = file_offset >> curlun->blkbits;
++			curlun->info_valid = 1;
++			break;
++		}
++		file_offset += nread;
++		amount_left -= nread;
++	}
++	return 0;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static int do_inquiry(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{
++	u8	*buf = (u8 *) bh->buf;
++
++	static char vendor_id[] = "Linux   ";
++	static char product_disk_id[] = "File-Stor Gadget";
++	static char product_cdrom_id[] = "File-CD Gadget  ";
++
++	if (!fsg->curlun) {		// Unsupported LUNs are okay
++		fsg->bad_lun_okay = 1;
++		memset(buf, 0, 36);
++		buf[0] = 0x7f;		// Unsupported, no device-type
++		buf[4] = 31;		// Additional length
++		return 36;
++	}
++
++	memset(buf, 0, 8);
++	buf[0] = (mod_data.cdrom ? TYPE_ROM : TYPE_DISK);
++	if (mod_data.removable)
++		buf[1] = 0x80;
++	buf[2] = 2;		// ANSI SCSI level 2
++	buf[3] = 2;		// SCSI-2 INQUIRY data format
++	buf[4] = 31;		// Additional length
++				// No special options
++	sprintf(buf + 8, "%-8s%-16s%04x", vendor_id,
++			(mod_data.cdrom ? product_cdrom_id :
++				product_disk_id),
++			mod_data.release);
++	return 36;
++}
++
++
++static int do_request_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{
++	struct fsg_lun	*curlun = fsg->curlun;
++	u8		*buf = (u8 *) bh->buf;
++	u32		sd, sdinfo;
++	int		valid;
++
++	/*
++	 * From the SCSI-2 spec., section 7.9 (Unit attention condition):
++	 *
++	 * If a REQUEST SENSE command is received from an initiator
++	 * with a pending unit attention condition (before the target
++	 * generates the contingent allegiance condition), then the
++	 * target shall either:
++	 *   a) report any pending sense data and preserve the unit
++	 *	attention condition on the logical unit, or,
++	 *   b) report the unit attention condition, may discard any
++	 *	pending sense data, and clear the unit attention
++	 *	condition on the logical unit for that initiator.
++	 *
++	 * FSG normally uses option a); enable this code to use option b).
++	 */
++#if 0
++	if (curlun && curlun->unit_attention_data != SS_NO_SENSE) {
++		curlun->sense_data = curlun->unit_attention_data;
++		curlun->unit_attention_data = SS_NO_SENSE;
++	}
++#endif
++
++	if (!curlun) {		// Unsupported LUNs are okay
++		fsg->bad_lun_okay = 1;
++		sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
++		sdinfo = 0;
++		valid = 0;
++	} else {
++		sd = curlun->sense_data;
++		sdinfo = curlun->sense_data_info;
++		valid = curlun->info_valid << 7;
++		curlun->sense_data = SS_NO_SENSE;
++		curlun->sense_data_info = 0;
++		curlun->info_valid = 0;
++	}
++
++	memset(buf, 0, 18);
++	buf[0] = valid | 0x70;			// Valid, current error
++	buf[2] = SK(sd);
++	put_unaligned_be32(sdinfo, &buf[3]);	/* Sense information */
++	buf[7] = 18 - 8;			// Additional sense length
++	buf[12] = ASC(sd);
++	buf[13] = ASCQ(sd);
++	return 18;
++}
++
++
++static int do_read_capacity(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{
++	struct fsg_lun	*curlun = fsg->curlun;
++	u32		lba = get_unaligned_be32(&fsg->cmnd[2]);
++	int		pmi = fsg->cmnd[8];
++	u8		*buf = (u8 *) bh->buf;
++
++	/* Check the PMI and LBA fields */
++	if (pmi > 1 || (pmi == 0 && lba != 0)) {
++		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++		return -EINVAL;
++	}
++
++	put_unaligned_be32(curlun->num_sectors - 1, &buf[0]);
++						/* Max logical block */
++	put_unaligned_be32(curlun->blksize, &buf[4]);	/* Block length */
++	return 8;
++}
++
++
++static int do_read_header(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{
++	struct fsg_lun	*curlun = fsg->curlun;
++	int		msf = fsg->cmnd[1] & 0x02;
++	u32		lba = get_unaligned_be32(&fsg->cmnd[2]);
++	u8		*buf = (u8 *) bh->buf;
++
++	if ((fsg->cmnd[1] & ~0x02) != 0) {		/* Mask away MSF */
++		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++		return -EINVAL;
++	}
++	if (lba >= curlun->num_sectors) {
++		curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
++		return -EINVAL;
++	}
++
++	memset(buf, 0, 8);
++	buf[0] = 0x01;		/* 2048 bytes of user data, rest is EC */
++	store_cdrom_address(&buf[4], msf, lba);
++	return 8;
++}
++
++
++static int do_read_toc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{
++	struct fsg_lun	*curlun = fsg->curlun;
++	int		msf = fsg->cmnd[1] & 0x02;
++	int		start_track = fsg->cmnd[6];
++	u8		*buf = (u8 *) bh->buf;
++
++	if ((fsg->cmnd[1] & ~0x02) != 0 ||		/* Mask away MSF */
++			start_track > 1) {
++		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++		return -EINVAL;
++	}
++
++	memset(buf, 0, 20);
++	buf[1] = (20-2);		/* TOC data length */
++	buf[2] = 1;			/* First track number */
++	buf[3] = 1;			/* Last track number */
++	buf[5] = 0x16;			/* Data track, copying allowed */
++	buf[6] = 0x01;			/* Only track is number 1 */
++	store_cdrom_address(&buf[8], msf, 0);
++
++	buf[13] = 0x16;			/* Lead-out track is data */
++	buf[14] = 0xAA;			/* Lead-out track number */
++	store_cdrom_address(&buf[16], msf, curlun->num_sectors);
++	return 20;
++}
++
++
++static int do_mode_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{
++	struct fsg_lun	*curlun = fsg->curlun;
++	int		mscmnd = fsg->cmnd[0];
++	u8		*buf = (u8 *) bh->buf;
++	u8		*buf0 = buf;
++	int		pc, page_code;
++	int		changeable_values, all_pages;
++	int		valid_page = 0;
++	int		len, limit;
++
++	if ((fsg->cmnd[1] & ~0x08) != 0) {		// Mask away DBD
++		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++		return -EINVAL;
++	}
++	pc = fsg->cmnd[2] >> 6;
++	page_code = fsg->cmnd[2] & 0x3f;
++	if (pc == 3) {
++		curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED;
++		return -EINVAL;
++	}
++	changeable_values = (pc == 1);
++	all_pages = (page_code == 0x3f);
++
++	/* Write the mode parameter header.  Fixed values are: default
++	 * medium type, no cache control (DPOFUA), and no block descriptors.
++	 * The only variable value is the WriteProtect bit.  We will fill in
++	 * the mode data length later. */
++	memset(buf, 0, 8);
++	if (mscmnd == MODE_SENSE) {
++		buf[2] = (curlun->ro ? 0x80 : 0x00);		// WP, DPOFUA
++		buf += 4;
++		limit = 255;
++	} else {			// MODE_SENSE_10
++		buf[3] = (curlun->ro ? 0x80 : 0x00);		// WP, DPOFUA
++		buf += 8;
++		limit = 65535;		// Should really be mod_data.buflen
++	}
++
++	/* No block descriptors */
++
++	/* The mode pages, in numerical order.  The only page we support
++	 * is the Caching page. */
++	if (page_code == 0x08 || all_pages) {
++		valid_page = 1;
++		buf[0] = 0x08;		// Page code
++		buf[1] = 10;		// Page length
++		memset(buf+2, 0, 10);	// None of the fields are changeable
++
++		if (!changeable_values) {
++			buf[2] = 0x04;	// Write cache enable,
++					// Read cache not disabled
++					// No cache retention priorities
++			put_unaligned_be16(0xffff, &buf[4]);
++					/* Don't disable prefetch */
++					/* Minimum prefetch = 0 */
++			put_unaligned_be16(0xffff, &buf[8]);
++					/* Maximum prefetch */
++			put_unaligned_be16(0xffff, &buf[10]);
++					/* Maximum prefetch ceiling */
++		}
++		buf += 12;
++	}
++
++	/* Check that a valid page was requested and the mode data length
++	 * isn't too long. */
++	len = buf - buf0;
++	if (!valid_page || len > limit) {
++		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++		return -EINVAL;
++	}
++
++	/*  Store the mode data length */
++	if (mscmnd == MODE_SENSE)
++		buf0[0] = len - 1;
++	else
++		put_unaligned_be16(len - 2, buf0);
++	return len;
++}
++
++
++static int do_start_stop(struct fsg_dev *fsg)
++{
++	struct fsg_lun	*curlun = fsg->curlun;
++	int		loej, start;
++
++	if (!mod_data.removable) {
++		curlun->sense_data = SS_INVALID_COMMAND;
++		return -EINVAL;
++	}
++
++	// int immed = fsg->cmnd[1] & 0x01;
++	loej = fsg->cmnd[4] & 0x02;
++	start = fsg->cmnd[4] & 0x01;
++
++#ifdef CONFIG_USB_FILE_STORAGE_TEST
++	if ((fsg->cmnd[1] & ~0x01) != 0 ||		// Mask away Immed
++			(fsg->cmnd[4] & ~0x03) != 0) {	// Mask LoEj, Start
++		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++		return -EINVAL;
++	}
++
++	if (!start) {
++
++		/* Are we allowed to unload the media? */
++		if (curlun->prevent_medium_removal) {
++			LDBG(curlun, "unload attempt prevented\n");
++			curlun->sense_data = SS_MEDIUM_REMOVAL_PREVENTED;
++			return -EINVAL;
++		}
++		if (loej) {		// Simulate an unload/eject
++			up_read(&fsg->filesem);
++			down_write(&fsg->filesem);
++			fsg_lun_close(curlun);
++			up_write(&fsg->filesem);
++			down_read(&fsg->filesem);
++		}
++	} else {
++
++		/* Our emulation doesn't support mounting; the medium is
++		 * available for use as soon as it is loaded. */
++		if (!fsg_lun_is_open(curlun)) {
++			curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
++			return -EINVAL;
++		}
++	}
++#endif
++	return 0;
++}
++
++
++static int do_prevent_allow(struct fsg_dev *fsg)
++{
++	struct fsg_lun	*curlun = fsg->curlun;
++	int		prevent;
++
++	if (!mod_data.removable) {
++		curlun->sense_data = SS_INVALID_COMMAND;
++		return -EINVAL;
++	}
++
++	prevent = fsg->cmnd[4] & 0x01;
++	if ((fsg->cmnd[4] & ~0x01) != 0) {		// Mask away Prevent
++		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++		return -EINVAL;
++	}
++
++	if (curlun->prevent_medium_removal && !prevent)
++		fsg_lun_fsync_sub(curlun);
++	curlun->prevent_medium_removal = prevent;
++	return 0;
++}
++
++
++static int do_read_format_capacities(struct fsg_dev *fsg,
++			struct fsg_buffhd *bh)
++{
++	struct fsg_lun	*curlun = fsg->curlun;
++	u8		*buf = (u8 *) bh->buf;
++
++	buf[0] = buf[1] = buf[2] = 0;
++	buf[3] = 8;		// Only the Current/Maximum Capacity Descriptor
++	buf += 4;
++
++	put_unaligned_be32(curlun->num_sectors, &buf[0]);
++						/* Number of blocks */
++	put_unaligned_be32(curlun->blksize, &buf[4]);	/* Block length */
++	buf[4] = 0x02;				/* Current capacity */
++	return 12;
++}
++
++
++static int do_mode_select(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{
++	struct fsg_lun	*curlun = fsg->curlun;
++
++	/* We don't support MODE SELECT */
++	curlun->sense_data = SS_INVALID_COMMAND;
++	return -EINVAL;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static int halt_bulk_in_endpoint(struct fsg_dev *fsg)
++{
++	int	rc;
++
++	rc = fsg_set_halt(fsg, fsg->bulk_in);
++	if (rc == -EAGAIN)
++		VDBG(fsg, "delayed bulk-in endpoint halt\n");
++	while (rc != 0) {
++		if (rc != -EAGAIN) {
++			WARNING(fsg, "usb_ep_set_halt -> %d\n", rc);
++			rc = 0;
++			break;
++		}
++
++		/* Wait for a short time and then try again */
++		if (msleep_interruptible(100) != 0)
++			return -EINTR;
++		rc = usb_ep_set_halt(fsg->bulk_in);
++	}
++	return rc;
++}
++
++static int wedge_bulk_in_endpoint(struct fsg_dev *fsg)
++{
++	int	rc;
++
++	DBG(fsg, "bulk-in set wedge\n");
++	rc = usb_ep_set_wedge(fsg->bulk_in);
++	if (rc == -EAGAIN)
++		VDBG(fsg, "delayed bulk-in endpoint wedge\n");
++	while (rc != 0) {
++		if (rc != -EAGAIN) {
++			WARNING(fsg, "usb_ep_set_wedge -> %d\n", rc);
++			rc = 0;
++			break;
++		}
++
++		/* Wait for a short time and then try again */
++		if (msleep_interruptible(100) != 0)
++			return -EINTR;
++		rc = usb_ep_set_wedge(fsg->bulk_in);
++	}
++	return rc;
++}
++
++static int throw_away_data(struct fsg_dev *fsg)
++{
++	struct fsg_buffhd	*bh;
++	u32			amount;
++	int			rc;
++
++	while ((bh = fsg->next_buffhd_to_drain)->state != BUF_STATE_EMPTY ||
++			fsg->usb_amount_left > 0) {
++
++		/* Throw away the data in a filled buffer */
++		if (bh->state == BUF_STATE_FULL) {
++			smp_rmb();
++			bh->state = BUF_STATE_EMPTY;
++			fsg->next_buffhd_to_drain = bh->next;
++
++			/* A short packet or an error ends everything */
++			if (bh->outreq->actual < bh->bulk_out_intended_length ||
++					bh->outreq->status != 0) {
++				raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
++				return -EINTR;
++			}
++			continue;
++		}
++
++		/* Try to submit another request if we need one */
++		bh = fsg->next_buffhd_to_fill;
++		if (bh->state == BUF_STATE_EMPTY && fsg->usb_amount_left > 0) {
++			amount = min(fsg->usb_amount_left,
++					(u32) mod_data.buflen);
++
++			/* Except at the end of the transfer, amount will be
++			 * equal to the buffer size, which is divisible by
++			 * the bulk-out maxpacket size.
++			 */
++			set_bulk_out_req_length(fsg, bh, amount);
++			start_transfer(fsg, fsg->bulk_out, bh->outreq,
++					&bh->outreq_busy, &bh->state);
++			fsg->next_buffhd_to_fill = bh->next;
++			fsg->usb_amount_left -= amount;
++			continue;
++		}
++
++		/* Otherwise wait for something to happen */
++		rc = sleep_thread(fsg);
++		if (rc)
++			return rc;
++	}
++	return 0;
++}
++
++
++static int finish_reply(struct fsg_dev *fsg)
++{
++	struct fsg_buffhd	*bh = fsg->next_buffhd_to_fill;
++	int			rc = 0;
++
++	switch (fsg->data_dir) {
++	case DATA_DIR_NONE:
++		break;			// Nothing to send
++
++	/* If we don't know whether the host wants to read or write,
++	 * this must be CB or CBI with an unknown command.  We mustn't
++	 * try to send or receive any data.  So stall both bulk pipes
++	 * if we can and wait for a reset. */
++	case DATA_DIR_UNKNOWN:
++		if (mod_data.can_stall) {
++			fsg_set_halt(fsg, fsg->bulk_out);
++			rc = halt_bulk_in_endpoint(fsg);
++		}
++		break;
++
++	/* All but the last buffer of data must have already been sent */
++	case DATA_DIR_TO_HOST:
++		if (fsg->data_size == 0)
++			;		// Nothing to send
++
++		/* If there's no residue, simply send the last buffer */
++		else if (fsg->residue == 0) {
++			bh->inreq->zero = 0;
++			start_transfer(fsg, fsg->bulk_in, bh->inreq,
++					&bh->inreq_busy, &bh->state);
++			fsg->next_buffhd_to_fill = bh->next;
++		}
++
++		/* There is a residue.  For CB and CBI, simply mark the end
++		 * of the data with a short packet.  However, if we are
++		 * allowed to stall, there was no data at all (residue ==
++		 * data_size), and the command failed (invalid LUN or
++		 * sense data is set), then halt the bulk-in endpoint
++		 * instead. */
++		else if (!transport_is_bbb()) {
++			if (mod_data.can_stall &&
++					fsg->residue == fsg->data_size &&
++	(!fsg->curlun || fsg->curlun->sense_data != SS_NO_SENSE)) {
++				bh->state = BUF_STATE_EMPTY;
++				rc = halt_bulk_in_endpoint(fsg);
++			} else {
++				bh->inreq->zero = 1;
++				start_transfer(fsg, fsg->bulk_in, bh->inreq,
++						&bh->inreq_busy, &bh->state);
++				fsg->next_buffhd_to_fill = bh->next;
++			}
++		}
++
++		/*
++		 * For Bulk-only, mark the end of the data with a short
++		 * packet.  If we are allowed to stall, halt the bulk-in
++		 * endpoint.  (Note: This violates the Bulk-Only Transport
++		 * specification, which requires us to pad the data if we
++		 * don't halt the endpoint.  Presumably nobody will mind.)
++		 */
++		else {
++			bh->inreq->zero = 1;
++			start_transfer(fsg, fsg->bulk_in, bh->inreq,
++					&bh->inreq_busy, &bh->state);
++			fsg->next_buffhd_to_fill = bh->next;
++			if (mod_data.can_stall)
++				rc = halt_bulk_in_endpoint(fsg);
++		}
++		break;
++
++	/* We have processed all we want from the data the host has sent.
++	 * There may still be outstanding bulk-out requests. */
++	case DATA_DIR_FROM_HOST:
++		if (fsg->residue == 0)
++			;		// Nothing to receive
++
++		/* Did the host stop sending unexpectedly early? */
++		else if (fsg->short_packet_received) {
++			raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
++			rc = -EINTR;
++		}
++
++		/* We haven't processed all the incoming data.  Even though
++		 * we may be allowed to stall, doing so would cause a race.
++		 * The controller may already have ACK'ed all the remaining
++		 * bulk-out packets, in which case the host wouldn't see a
++		 * STALL.  Not realizing the endpoint was halted, it wouldn't
++		 * clear the halt -- leading to problems later on. */
++#if 0
++		else if (mod_data.can_stall) {
++			fsg_set_halt(fsg, fsg->bulk_out);
++			raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
++			rc = -EINTR;
++		}
++#endif
++
++		/* We can't stall.  Read in the excess data and throw it
++		 * all away. */
++		else
++			rc = throw_away_data(fsg);
++		break;
++	}
++	return rc;
++}
++
++
++static int send_status(struct fsg_dev *fsg)
++{
++	struct fsg_lun		*curlun = fsg->curlun;
++	struct fsg_buffhd	*bh;
++	int			rc;
++	u8			status = US_BULK_STAT_OK;
++	u32			sd, sdinfo = 0;
++
++	/* Wait for the next buffer to become available */
++	bh = fsg->next_buffhd_to_fill;
++	while (bh->state != BUF_STATE_EMPTY) {
++		rc = sleep_thread(fsg);
++		if (rc)
++			return rc;
++	}
++
++	if (curlun) {
++		sd = curlun->sense_data;
++		sdinfo = curlun->sense_data_info;
++	} else if (fsg->bad_lun_okay)
++		sd = SS_NO_SENSE;
++	else
++		sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
++
++	if (fsg->phase_error) {
++		DBG(fsg, "sending phase-error status\n");
++		status = US_BULK_STAT_PHASE;
++		sd = SS_INVALID_COMMAND;
++	} else if (sd != SS_NO_SENSE) {
++		DBG(fsg, "sending command-failure status\n");
++		status = US_BULK_STAT_FAIL;
++		VDBG(fsg, "  sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
++				"  info x%x\n",
++				SK(sd), ASC(sd), ASCQ(sd), sdinfo);
++	}
++
++	if (transport_is_bbb()) {
++		struct bulk_cs_wrap	*csw = bh->buf;
++
++		/* Store and send the Bulk-only CSW */
++		csw->Signature = cpu_to_le32(US_BULK_CS_SIGN);
++		csw->Tag = fsg->tag;
++		csw->Residue = cpu_to_le32(fsg->residue);
++		csw->Status = status;
++
++		bh->inreq->length = US_BULK_CS_WRAP_LEN;
++		bh->inreq->zero = 0;
++		start_transfer(fsg, fsg->bulk_in, bh->inreq,
++				&bh->inreq_busy, &bh->state);
++
++	} else if (mod_data.transport_type == USB_PR_CB) {
++
++		/* Control-Bulk transport has no status phase! */
++		return 0;
++
++	} else {			// USB_PR_CBI
++		struct interrupt_data	*buf = bh->buf;
++
++		/* Store and send the Interrupt data.  UFI sends the ASC
++		 * and ASCQ bytes.  Everything else sends a Type (which
++		 * is always 0) and the status Value. */
++		if (mod_data.protocol_type == USB_SC_UFI) {
++			buf->bType = ASC(sd);
++			buf->bValue = ASCQ(sd);
++		} else {
++			buf->bType = 0;
++			buf->bValue = status;
++		}
++		fsg->intreq->length = CBI_INTERRUPT_DATA_LEN;
++
++		fsg->intr_buffhd = bh;		// Point to the right buffhd
++		fsg->intreq->buf = bh->inreq->buf;
++		fsg->intreq->context = bh;
++		start_transfer(fsg, fsg->intr_in, fsg->intreq,
++				&fsg->intreq_busy, &bh->state);
++	}
++
++	fsg->next_buffhd_to_fill = bh->next;
++	return 0;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++/* Check whether the command is properly formed and whether its data size
++ * and direction agree with the values we already have. */
++static int check_command(struct fsg_dev *fsg, int cmnd_size,
++		enum data_direction data_dir, unsigned int mask,
++		int needs_medium, const char *name)
++{
++	int			i;
++	int			lun = fsg->cmnd[1] >> 5;
++	static const char	dirletter[4] = {'u', 'o', 'i', 'n'};
++	char			hdlen[20];
++	struct fsg_lun		*curlun;
++
++	/* Adjust the expected cmnd_size for protocol encapsulation padding.
++	 * Transparent SCSI doesn't pad. */
++	if (protocol_is_scsi())
++		;
++
++	/* There's some disagreement as to whether RBC pads commands or not.
++	 * We'll play it safe and accept either form. */
++	else if (mod_data.protocol_type == USB_SC_RBC) {
++		if (fsg->cmnd_size == 12)
++			cmnd_size = 12;
++
++	/* All the other protocols pad to 12 bytes */
++	} else
++		cmnd_size = 12;
++
++	hdlen[0] = 0;
++	if (fsg->data_dir != DATA_DIR_UNKNOWN)
++		sprintf(hdlen, ", H%c=%u", dirletter[(int) fsg->data_dir],
++				fsg->data_size);
++	VDBG(fsg, "SCSI command: %s;  Dc=%d, D%c=%u;  Hc=%d%s\n",
++			name, cmnd_size, dirletter[(int) data_dir],
++			fsg->data_size_from_cmnd, fsg->cmnd_size, hdlen);
++
++	/* We can't reply at all until we know the correct data direction
++	 * and size. */
++	if (fsg->data_size_from_cmnd == 0)
++		data_dir = DATA_DIR_NONE;
++	if (fsg->data_dir == DATA_DIR_UNKNOWN) {	// CB or CBI
++		fsg->data_dir = data_dir;
++		fsg->data_size = fsg->data_size_from_cmnd;
++
++	} else {					// Bulk-only
++		if (fsg->data_size < fsg->data_size_from_cmnd) {
++
++			/* Host data size < Device data size is a phase error.
++			 * Carry out the command, but only transfer as much
++			 * as we are allowed. */
++			fsg->data_size_from_cmnd = fsg->data_size;
++			fsg->phase_error = 1;
++		}
++	}
++	fsg->residue = fsg->usb_amount_left = fsg->data_size;
++
++	/* Conflicting data directions is a phase error */
++	if (fsg->data_dir != data_dir && fsg->data_size_from_cmnd > 0) {
++		fsg->phase_error = 1;
++		return -EINVAL;
++	}
++
++	/* Verify the length of the command itself */
++	if (cmnd_size != fsg->cmnd_size) {
++
++		/* Special case workaround: There are plenty of buggy SCSI
++		 * implementations. Many have issues with cbw->Length
++		 * field passing a wrong command size. For those cases we
++		 * always try to work around the problem by using the length
++		 * sent by the host side provided it is at least as large
++		 * as the correct command length.
++		 * Examples of such cases would be MS-Windows, which issues
++		 * REQUEST SENSE with cbw->Length == 12 where it should
++		 * be 6, and xbox360 issuing INQUIRY, TEST UNIT READY and
++		 * REQUEST SENSE with cbw->Length == 10 where it should
++		 * be 6 as well.
++		 */
++		if (cmnd_size <= fsg->cmnd_size) {
++			DBG(fsg, "%s is buggy! Expected length %d "
++					"but we got %d\n", name,
++					cmnd_size, fsg->cmnd_size);
++			cmnd_size = fsg->cmnd_size;
++		} else {
++			fsg->phase_error = 1;
++			return -EINVAL;
++		}
++	}
++
++	/* Check that the LUN values are consistent */
++	if (transport_is_bbb()) {
++		if (fsg->lun != lun)
++			DBG(fsg, "using LUN %d from CBW, "
++					"not LUN %d from CDB\n",
++					fsg->lun, lun);
++	}
++
++	/* Check the LUN */
++	curlun = fsg->curlun;
++	if (curlun) {
++		if (fsg->cmnd[0] != REQUEST_SENSE) {
++			curlun->sense_data = SS_NO_SENSE;
++			curlun->sense_data_info = 0;
++			curlun->info_valid = 0;
++		}
++	} else {
++		fsg->bad_lun_okay = 0;
++
++		/* INQUIRY and REQUEST SENSE commands are explicitly allowed
++		 * to use unsupported LUNs; all others may not. */
++		if (fsg->cmnd[0] != INQUIRY &&
++				fsg->cmnd[0] != REQUEST_SENSE) {
++			DBG(fsg, "unsupported LUN %d\n", fsg->lun);
++			return -EINVAL;
++		}
++	}
++
++	/* If a unit attention condition exists, only INQUIRY and
++	 * REQUEST SENSE commands are allowed; anything else must fail. */
++	if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
++			fsg->cmnd[0] != INQUIRY &&
++			fsg->cmnd[0] != REQUEST_SENSE) {
++		curlun->sense_data = curlun->unit_attention_data;
++		curlun->unit_attention_data = SS_NO_SENSE;
++		return -EINVAL;
++	}
++
++	/* Check that only command bytes listed in the mask are non-zero */
++	fsg->cmnd[1] &= 0x1f;			// Mask away the LUN
++	for (i = 1; i < cmnd_size; ++i) {
++		if (fsg->cmnd[i] && !(mask & (1 << i))) {
++			if (curlun)
++				curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++			return -EINVAL;
++		}
++	}
++
++	/* If the medium isn't mounted and the command needs to access
++	 * it, return an error. */
++	if (curlun && !fsg_lun_is_open(curlun) && needs_medium) {
++		curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++/* wrapper of check_command for data size in blocks handling */
++static int check_command_size_in_blocks(struct fsg_dev *fsg, int cmnd_size,
++		enum data_direction data_dir, unsigned int mask,
++		int needs_medium, const char *name)
++{
++	if (fsg->curlun)
++		fsg->data_size_from_cmnd <<= fsg->curlun->blkbits;
++	return check_command(fsg, cmnd_size, data_dir,
++			mask, needs_medium, name);
++}
++
++static int do_scsi_command(struct fsg_dev *fsg)
++{
++	struct fsg_buffhd	*bh;
++	int			rc;
++	int			reply = -EINVAL;
++	int			i;
++	static char		unknown[16];
++
++	dump_cdb(fsg);
++
++	/* Wait for the next buffer to become available for data or status */
++	bh = fsg->next_buffhd_to_drain = fsg->next_buffhd_to_fill;
++	while (bh->state != BUF_STATE_EMPTY) {
++		rc = sleep_thread(fsg);
++		if (rc)
++			return rc;
++	}
++	fsg->phase_error = 0;
++	fsg->short_packet_received = 0;
++
++	down_read(&fsg->filesem);	// We're using the backing file
++	switch (fsg->cmnd[0]) {
++
++	case INQUIRY:
++		fsg->data_size_from_cmnd = fsg->cmnd[4];
++		if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
++				(1<<4), 0,
++				"INQUIRY")) == 0)
++			reply = do_inquiry(fsg, bh);
++		break;
++
++	case MODE_SELECT:
++		fsg->data_size_from_cmnd = fsg->cmnd[4];
++		if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
++				(1<<1) | (1<<4), 0,
++				"MODE SELECT(6)")) == 0)
++			reply = do_mode_select(fsg, bh);
++		break;
++
++	case MODE_SELECT_10:
++		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
++		if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
++				(1<<1) | (3<<7), 0,
++				"MODE SELECT(10)")) == 0)
++			reply = do_mode_select(fsg, bh);
++		break;
++
++	case MODE_SENSE:
++		fsg->data_size_from_cmnd = fsg->cmnd[4];
++		if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
++				(1<<1) | (1<<2) | (1<<4), 0,
++				"MODE SENSE(6)")) == 0)
++			reply = do_mode_sense(fsg, bh);
++		break;
++
++	case MODE_SENSE_10:
++		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
++		if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
++				(1<<1) | (1<<2) | (3<<7), 0,
++				"MODE SENSE(10)")) == 0)
++			reply = do_mode_sense(fsg, bh);
++		break;
++
++	case ALLOW_MEDIUM_REMOVAL:
++		fsg->data_size_from_cmnd = 0;
++		if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
++				(1<<4), 0,
++				"PREVENT-ALLOW MEDIUM REMOVAL")) == 0)
++			reply = do_prevent_allow(fsg);
++		break;
++
++	case READ_6:
++		i = fsg->cmnd[4];
++		fsg->data_size_from_cmnd = (i == 0) ? 256 : i;
++		if ((reply = check_command_size_in_blocks(fsg, 6,
++				DATA_DIR_TO_HOST,
++				(7<<1) | (1<<4), 1,
++				"READ(6)")) == 0)
++			reply = do_read(fsg);
++		break;
++
++	case READ_10:
++		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
++		if ((reply = check_command_size_in_blocks(fsg, 10,
++				DATA_DIR_TO_HOST,
++				(1<<1) | (0xf<<2) | (3<<7), 1,
++				"READ(10)")) == 0)
++			reply = do_read(fsg);
++		break;
++
++	case READ_12:
++		fsg->data_size_from_cmnd = get_unaligned_be32(&fsg->cmnd[6]);
++		if ((reply = check_command_size_in_blocks(fsg, 12,
++				DATA_DIR_TO_HOST,
++				(1<<1) | (0xf<<2) | (0xf<<6), 1,
++				"READ(12)")) == 0)
++			reply = do_read(fsg);
++		break;
++
++	case READ_CAPACITY:
++		fsg->data_size_from_cmnd = 8;
++		if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
++				(0xf<<2) | (1<<8), 1,
++				"READ CAPACITY")) == 0)
++			reply = do_read_capacity(fsg, bh);
++		break;
++
++	case READ_HEADER:
++		if (!mod_data.cdrom)
++			goto unknown_cmnd;
++		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
++		if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
++				(3<<7) | (0x1f<<1), 1,
++				"READ HEADER")) == 0)
++			reply = do_read_header(fsg, bh);
++		break;
++
++	case READ_TOC:
++		if (!mod_data.cdrom)
++			goto unknown_cmnd;
++		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
++		if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
++				(7<<6) | (1<<1), 1,
++				"READ TOC")) == 0)
++			reply = do_read_toc(fsg, bh);
++		break;
++
++	case READ_FORMAT_CAPACITIES:
++		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
++		if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
++				(3<<7), 1,
++				"READ FORMAT CAPACITIES")) == 0)
++			reply = do_read_format_capacities(fsg, bh);
++		break;
++
++	case REQUEST_SENSE:
++		fsg->data_size_from_cmnd = fsg->cmnd[4];
++		if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
++				(1<<4), 0,
++				"REQUEST SENSE")) == 0)
++			reply = do_request_sense(fsg, bh);
++		break;
++
++	case START_STOP:
++		fsg->data_size_from_cmnd = 0;
++		if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
++				(1<<1) | (1<<4), 0,
++				"START-STOP UNIT")) == 0)
++			reply = do_start_stop(fsg);
++		break;
++
++	case SYNCHRONIZE_CACHE:
++		fsg->data_size_from_cmnd = 0;
++		if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
++				(0xf<<2) | (3<<7), 1,
++				"SYNCHRONIZE CACHE")) == 0)
++			reply = do_synchronize_cache(fsg);
++		break;
++
++	case TEST_UNIT_READY:
++		fsg->data_size_from_cmnd = 0;
++		reply = check_command(fsg, 6, DATA_DIR_NONE,
++				0, 1,
++				"TEST UNIT READY");
++		break;
++
++	/* Although optional, this command is used by MS-Windows.  We
++	 * support a minimal version: BytChk must be 0. */
++	case VERIFY:
++		fsg->data_size_from_cmnd = 0;
++		if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
++				(1<<1) | (0xf<<2) | (3<<7), 1,
++				"VERIFY")) == 0)
++			reply = do_verify(fsg);
++		break;
++
++	case WRITE_6:
++		i = fsg->cmnd[4];
++		fsg->data_size_from_cmnd = (i == 0) ? 256 : i;
++		if ((reply = check_command_size_in_blocks(fsg, 6,
++				DATA_DIR_FROM_HOST,
++				(7<<1) | (1<<4), 1,
++				"WRITE(6)")) == 0)
++			reply = do_write(fsg);
++		break;
++
++	case WRITE_10:
++		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
++		if ((reply = check_command_size_in_blocks(fsg, 10,
++				DATA_DIR_FROM_HOST,
++				(1<<1) | (0xf<<2) | (3<<7), 1,
++				"WRITE(10)")) == 0)
++			reply = do_write(fsg);
++		break;
++
++	case WRITE_12:
++		fsg->data_size_from_cmnd = get_unaligned_be32(&fsg->cmnd[6]);
++		if ((reply = check_command_size_in_blocks(fsg, 12,
++				DATA_DIR_FROM_HOST,
++				(1<<1) | (0xf<<2) | (0xf<<6), 1,
++				"WRITE(12)")) == 0)
++			reply = do_write(fsg);
++		break;
++
++	/* Some mandatory commands that we recognize but don't implement.
++	 * They don't mean much in this setting.  It's left as an exercise
++	 * for anyone interested to implement RESERVE and RELEASE in terms
++	 * of Posix locks. */
++	case FORMAT_UNIT:
++	case RELEASE:
++	case RESERVE:
++	case SEND_DIAGNOSTIC:
++		// Fall through
++
++	default:
++ unknown_cmnd:
++		fsg->data_size_from_cmnd = 0;
++		sprintf(unknown, "Unknown x%02x", fsg->cmnd[0]);
++		if ((reply = check_command(fsg, fsg->cmnd_size,
++				DATA_DIR_UNKNOWN, ~0, 0, unknown)) == 0) {
++			fsg->curlun->sense_data = SS_INVALID_COMMAND;
++			reply = -EINVAL;
++		}
++		break;
++	}
++	up_read(&fsg->filesem);
++
++	if (reply == -EINTR || signal_pending(current))
++		return -EINTR;
++
++	/* Set up the single reply buffer for finish_reply() */
++	if (reply == -EINVAL)
++		reply = 0;		// Error reply length
++	if (reply >= 0 && fsg->data_dir == DATA_DIR_TO_HOST) {
++		reply = min((u32) reply, fsg->data_size_from_cmnd);
++		bh->inreq->length = reply;
++		bh->state = BUF_STATE_FULL;
++		fsg->residue -= reply;
++	}				// Otherwise it's already set
++
++	return 0;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{
++	struct usb_request		*req = bh->outreq;
++	struct bulk_cb_wrap	*cbw = req->buf;
++
++	/* Was this a real packet?  Should it be ignored? */
++	if (req->status || test_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
++		return -EINVAL;
++
++	/* Is the CBW valid? */
++	if (req->actual != US_BULK_CB_WRAP_LEN ||
++			cbw->Signature != cpu_to_le32(
++				US_BULK_CB_SIGN)) {
++		DBG(fsg, "invalid CBW: len %u sig 0x%x\n",
++				req->actual,
++				le32_to_cpu(cbw->Signature));
++
++		/* The Bulk-only spec says we MUST stall the IN endpoint
++		 * (6.6.1), so it's unavoidable.  It also says we must
++		 * retain this state until the next reset, but there's
++		 * no way to tell the controller driver it should ignore
++		 * Clear-Feature(HALT) requests.
++		 *
++		 * We aren't required to halt the OUT endpoint; instead
++		 * we can simply accept and discard any data received
++		 * until the next reset. */
++		wedge_bulk_in_endpoint(fsg);
++		set_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
++		return -EINVAL;
++	}
++
++	/* Is the CBW meaningful? */
++	if (cbw->Lun >= FSG_MAX_LUNS || cbw->Flags & ~US_BULK_FLAG_IN ||
++			cbw->Length <= 0 || cbw->Length > MAX_COMMAND_SIZE) {
++		DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, "
++				"cmdlen %u\n",
++				cbw->Lun, cbw->Flags, cbw->Length);
++
++		/* We can do anything we want here, so let's stall the
++		 * bulk pipes if we are allowed to. */
++		if (mod_data.can_stall) {
++			fsg_set_halt(fsg, fsg->bulk_out);
++			halt_bulk_in_endpoint(fsg);
++		}
++		return -EINVAL;
++	}
++
++	/* Save the command for later */
++	fsg->cmnd_size = cbw->Length;
++	memcpy(fsg->cmnd, cbw->CDB, fsg->cmnd_size);
++	if (cbw->Flags & US_BULK_FLAG_IN)
++		fsg->data_dir = DATA_DIR_TO_HOST;
++	else
++		fsg->data_dir = DATA_DIR_FROM_HOST;
++	fsg->data_size = le32_to_cpu(cbw->DataTransferLength);
++	if (fsg->data_size == 0)
++		fsg->data_dir = DATA_DIR_NONE;
++	fsg->lun = cbw->Lun;
++	fsg->tag = cbw->Tag;
++	return 0;
++}
++
++
++static int get_next_command(struct fsg_dev *fsg)
++{
++	struct fsg_buffhd	*bh;
++	int			rc = 0;
++
++	if (transport_is_bbb()) {
++
++		/* Wait for the next buffer to become available */
++		bh = fsg->next_buffhd_to_fill;
++		while (bh->state != BUF_STATE_EMPTY) {
++			rc = sleep_thread(fsg);
++			if (rc)
++				return rc;
++		}
++
++		/* Queue a request to read a Bulk-only CBW */
++		set_bulk_out_req_length(fsg, bh, US_BULK_CB_WRAP_LEN);
++		start_transfer(fsg, fsg->bulk_out, bh->outreq,
++				&bh->outreq_busy, &bh->state);
++
++		/* We will drain the buffer in software, which means we
++		 * can reuse it for the next filling.  No need to advance
++		 * next_buffhd_to_fill. */
++
++		/* Wait for the CBW to arrive */
++		while (bh->state != BUF_STATE_FULL) {
++			rc = sleep_thread(fsg);
++			if (rc)
++				return rc;
++		}
++		smp_rmb();
++		rc = received_cbw(fsg, bh);
++		bh->state = BUF_STATE_EMPTY;
++
++	} else {		// USB_PR_CB or USB_PR_CBI
++
++		/* Wait for the next command to arrive */
++		while (fsg->cbbuf_cmnd_size == 0) {
++			rc = sleep_thread(fsg);
++			if (rc)
++				return rc;
++		}
++
++		/* Is the previous status interrupt request still busy?
++		 * The host is allowed to skip reading the status,
++		 * so we must cancel it. */
++		if (fsg->intreq_busy)
++			usb_ep_dequeue(fsg->intr_in, fsg->intreq);
++
++		/* Copy the command and mark the buffer empty */
++		fsg->data_dir = DATA_DIR_UNKNOWN;
++		spin_lock_irq(&fsg->lock);
++		fsg->cmnd_size = fsg->cbbuf_cmnd_size;
++		memcpy(fsg->cmnd, fsg->cbbuf_cmnd, fsg->cmnd_size);
++		fsg->cbbuf_cmnd_size = 0;
++		spin_unlock_irq(&fsg->lock);
++
++		/* Use LUN from the command */
++		fsg->lun = fsg->cmnd[1] >> 5;
++	}
++
++	/* Update current lun */
++	if (fsg->lun >= 0 && fsg->lun < fsg->nluns)
++		fsg->curlun = &fsg->luns[fsg->lun];
++	else
++		fsg->curlun = NULL;
++
++	return rc;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static int enable_endpoint(struct fsg_dev *fsg, struct usb_ep *ep,
++		const struct usb_endpoint_descriptor *d)
++{
++	int	rc;
++
++	ep->driver_data = fsg;
++	ep->desc = d;
++	rc = usb_ep_enable(ep);
++	if (rc)
++		ERROR(fsg, "can't enable %s, result %d\n", ep->name, rc);
++	return rc;
++}
++
++static int alloc_request(struct fsg_dev *fsg, struct usb_ep *ep,
++		struct usb_request **preq)
++{
++	*preq = usb_ep_alloc_request(ep, GFP_ATOMIC);
++	if (*preq)
++		return 0;
++	ERROR(fsg, "can't allocate request for %s\n", ep->name);
++	return -ENOMEM;
++}
++
++/*
++ * Reset interface setting and re-init endpoint state (toggle etc).
++ * Call with altsetting < 0 to disable the interface.  The only other
++ * available altsetting is 0, which enables the interface.
++ */
++static int do_set_interface(struct fsg_dev *fsg, int altsetting)
++{
++	int	rc = 0;
++	int	i;
++	const struct usb_endpoint_descriptor	*d;
++
++	if (fsg->running)
++		DBG(fsg, "reset interface\n");
++
++reset:
++	/* Deallocate the requests */
++	for (i = 0; i < fsg_num_buffers; ++i) {
++		struct fsg_buffhd *bh = &fsg->buffhds[i];
++
++		if (bh->inreq) {
++			usb_ep_free_request(fsg->bulk_in, bh->inreq);
++			bh->inreq = NULL;
++		}
++		if (bh->outreq) {
++			usb_ep_free_request(fsg->bulk_out, bh->outreq);
++			bh->outreq = NULL;
++		}
++	}
++	if (fsg->intreq) {
++		usb_ep_free_request(fsg->intr_in, fsg->intreq);
++		fsg->intreq = NULL;
++	}
++
++	/* Disable the endpoints */
++	if (fsg->bulk_in_enabled) {
++		usb_ep_disable(fsg->bulk_in);
++		fsg->bulk_in_enabled = 0;
++	}
++	if (fsg->bulk_out_enabled) {
++		usb_ep_disable(fsg->bulk_out);
++		fsg->bulk_out_enabled = 0;
++	}
++	if (fsg->intr_in_enabled) {
++		usb_ep_disable(fsg->intr_in);
++		fsg->intr_in_enabled = 0;
++	}
++
++	fsg->running = 0;
++	if (altsetting < 0 || rc != 0)
++		return rc;
++
++	DBG(fsg, "set interface %d\n", altsetting);
++
++	/* Enable the endpoints */
++	d = fsg_ep_desc(fsg->gadget,
++			&fsg_fs_bulk_in_desc, &fsg_hs_bulk_in_desc,
++			&fsg_ss_bulk_in_desc);
++	if ((rc = enable_endpoint(fsg, fsg->bulk_in, d)) != 0)
++		goto reset;
++	fsg->bulk_in_enabled = 1;
++
++	d = fsg_ep_desc(fsg->gadget,
++			&fsg_fs_bulk_out_desc, &fsg_hs_bulk_out_desc,
++			&fsg_ss_bulk_out_desc);
++	if ((rc = enable_endpoint(fsg, fsg->bulk_out, d)) != 0)
++		goto reset;
++	fsg->bulk_out_enabled = 1;
++	fsg->bulk_out_maxpacket = usb_endpoint_maxp(d);
++	clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
++
++	if (transport_is_cbi()) {
++		d = fsg_ep_desc(fsg->gadget,
++				&fsg_fs_intr_in_desc, &fsg_hs_intr_in_desc,
++				&fsg_ss_intr_in_desc);
++		if ((rc = enable_endpoint(fsg, fsg->intr_in, d)) != 0)
++			goto reset;
++		fsg->intr_in_enabled = 1;
++	}
++
++	/* Allocate the requests */
++	for (i = 0; i < fsg_num_buffers; ++i) {
++		struct fsg_buffhd	*bh = &fsg->buffhds[i];
++
++		if ((rc = alloc_request(fsg, fsg->bulk_in, &bh->inreq)) != 0)
++			goto reset;
++		if ((rc = alloc_request(fsg, fsg->bulk_out, &bh->outreq)) != 0)
++			goto reset;
++		bh->inreq->buf = bh->outreq->buf = bh->buf;
++		bh->inreq->context = bh->outreq->context = bh;
++		bh->inreq->complete = bulk_in_complete;
++		bh->outreq->complete = bulk_out_complete;
++	}
++	if (transport_is_cbi()) {
++		if ((rc = alloc_request(fsg, fsg->intr_in, &fsg->intreq)) != 0)
++			goto reset;
++		fsg->intreq->complete = intr_in_complete;
++	}
++
++	fsg->running = 1;
++	for (i = 0; i < fsg->nluns; ++i)
++		fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
++	return rc;
++}
++
++
++/*
++ * Change our operational configuration.  This code must agree with the code
++ * that returns config descriptors, and with interface altsetting code.
++ *
++ * It's also responsible for power management interactions.  Some
++ * configurations might not work with our current power sources.
++ * For now we just assume the gadget is always self-powered.
++ */
++static int do_set_config(struct fsg_dev *fsg, u8 new_config)
++{
++	int	rc = 0;
++
++	/* Disable the single interface */
++	if (fsg->config != 0) {
++		DBG(fsg, "reset config\n");
++		fsg->config = 0;
++		rc = do_set_interface(fsg, -1);
++	}
++
++	/* Enable the interface */
++	if (new_config != 0) {
++		fsg->config = new_config;
++		if ((rc = do_set_interface(fsg, 0)) != 0)
++			fsg->config = 0;	// Reset on errors
++		else
++			INFO(fsg, "%s config #%d\n",
++			     usb_speed_string(fsg->gadget->speed),
++			     fsg->config);
++	}
++	return rc;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static void handle_exception(struct fsg_dev *fsg)
++{
++	siginfo_t		info;
++	int			sig;
++	int			i;
++	int			num_active;
++	struct fsg_buffhd	*bh;
++	enum fsg_state		old_state;
++	u8			new_config;
++	struct fsg_lun		*curlun;
++	unsigned int		exception_req_tag;
++	int			rc;
++
++	/* Clear the existing signals.  Anything but SIGUSR1 is converted
++	 * into a high-priority EXIT exception. */
++	for (;;) {
++		sig = dequeue_signal_lock(current, &current->blocked, &info);
++		if (!sig)
++			break;
++		if (sig != SIGUSR1) {
++			if (fsg->state < FSG_STATE_EXIT)
++				DBG(fsg, "Main thread exiting on signal\n");
++			raise_exception(fsg, FSG_STATE_EXIT);
++		}
++	}
++
++	/* Cancel all the pending transfers */
++	if (fsg->intreq_busy)
++		usb_ep_dequeue(fsg->intr_in, fsg->intreq);
++	for (i = 0; i < fsg_num_buffers; ++i) {
++		bh = &fsg->buffhds[i];
++		if (bh->inreq_busy)
++			usb_ep_dequeue(fsg->bulk_in, bh->inreq);
++		if (bh->outreq_busy)
++			usb_ep_dequeue(fsg->bulk_out, bh->outreq);
++	}
++
++	/* Wait until everything is idle */
++	for (;;) {
++		num_active = fsg->intreq_busy;
++		for (i = 0; i < fsg_num_buffers; ++i) {
++			bh = &fsg->buffhds[i];
++			num_active += bh->inreq_busy + bh->outreq_busy;
++		}
++		if (num_active == 0)
++			break;
++		if (sleep_thread(fsg))
++			return;
++	}
++
++	/* Clear out the controller's fifos */
++	if (fsg->bulk_in_enabled)
++		usb_ep_fifo_flush(fsg->bulk_in);
++	if (fsg->bulk_out_enabled)
++		usb_ep_fifo_flush(fsg->bulk_out);
++	if (fsg->intr_in_enabled)
++		usb_ep_fifo_flush(fsg->intr_in);
++
++	/* Reset the I/O buffer states and pointers, the SCSI
++	 * state, and the exception.  Then invoke the handler. */
++	spin_lock_irq(&fsg->lock);
++
++	for (i = 0; i < fsg_num_buffers; ++i) {
++		bh = &fsg->buffhds[i];
++		bh->state = BUF_STATE_EMPTY;
++	}
++	fsg->next_buffhd_to_fill = fsg->next_buffhd_to_drain =
++			&fsg->buffhds[0];
++
++	exception_req_tag = fsg->exception_req_tag;
++	new_config = fsg->new_config;
++	old_state = fsg->state;
++
++	if (old_state == FSG_STATE_ABORT_BULK_OUT)
++		fsg->state = FSG_STATE_STATUS_PHASE;
++	else {
++		for (i = 0; i < fsg->nluns; ++i) {
++			curlun = &fsg->luns[i];
++			curlun->prevent_medium_removal = 0;
++			curlun->sense_data = curlun->unit_attention_data =
++					SS_NO_SENSE;
++			curlun->sense_data_info = 0;
++			curlun->info_valid = 0;
++		}
++		fsg->state = FSG_STATE_IDLE;
++	}
++	spin_unlock_irq(&fsg->lock);
++
++	/* Carry out any extra actions required for the exception */
++	switch (old_state) {
++	default:
++		break;
++
++	case FSG_STATE_ABORT_BULK_OUT:
++		send_status(fsg);
++		spin_lock_irq(&fsg->lock);
++		if (fsg->state == FSG_STATE_STATUS_PHASE)
++			fsg->state = FSG_STATE_IDLE;
++		spin_unlock_irq(&fsg->lock);
++		break;
++
++	case FSG_STATE_RESET:
++		/* In case we were forced against our will to halt a
++		 * bulk endpoint, clear the halt now.  (The SuperH UDC
++		 * requires this.) */
++		if (test_and_clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
++			usb_ep_clear_halt(fsg->bulk_in);
++
++		if (transport_is_bbb()) {
++			if (fsg->ep0_req_tag == exception_req_tag)
++				ep0_queue(fsg);	// Complete the status stage
++
++		} else if (transport_is_cbi())
++			send_status(fsg);	// Status by interrupt pipe
++
++		/* Technically this should go here, but it would only be
++		 * a waste of time.  Ditto for the INTERFACE_CHANGE and
++		 * CONFIG_CHANGE cases. */
++		// for (i = 0; i < fsg->nluns; ++i)
++		//	fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
++		break;
++
++	case FSG_STATE_INTERFACE_CHANGE:
++		rc = do_set_interface(fsg, 0);
++		if (fsg->ep0_req_tag != exception_req_tag)
++			break;
++		if (rc != 0)			// STALL on errors
++			fsg_set_halt(fsg, fsg->ep0);
++		else				// Complete the status stage
++			ep0_queue(fsg);
++		break;
++
++	case FSG_STATE_CONFIG_CHANGE:
++		rc = do_set_config(fsg, new_config);
++		if (fsg->ep0_req_tag != exception_req_tag)
++			break;
++		if (rc != 0)			// STALL on errors
++			fsg_set_halt(fsg, fsg->ep0);
++		else				// Complete the status stage
++			ep0_queue(fsg);
++		break;
++
++	case FSG_STATE_DISCONNECT:
++		for (i = 0; i < fsg->nluns; ++i)
++			fsg_lun_fsync_sub(fsg->luns + i);
++		do_set_config(fsg, 0);		// Unconfigured state
++		break;
++
++	case FSG_STATE_EXIT:
++	case FSG_STATE_TERMINATED:
++		do_set_config(fsg, 0);			// Free resources
++		spin_lock_irq(&fsg->lock);
++		fsg->state = FSG_STATE_TERMINATED;	// Stop the thread
++		spin_unlock_irq(&fsg->lock);
++		break;
++	}
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static int fsg_main_thread(void *fsg_)
++{
++	struct fsg_dev		*fsg = fsg_;
++
++	/* Allow the thread to be killed by a signal, but set the signal mask
++	 * to block everything but INT, TERM, KILL, and USR1. */
++	allow_signal(SIGINT);
++	allow_signal(SIGTERM);
++	allow_signal(SIGKILL);
++	allow_signal(SIGUSR1);
++
++	/* Allow the thread to be frozen */
++	set_freezable();
++
++	/* Arrange for userspace references to be interpreted as kernel
++	 * pointers.  That way we can pass a kernel pointer to a routine
++	 * that expects a __user pointer and it will work okay. */
++	set_fs(get_ds());
++
++	/* The main loop */
++	while (fsg->state != FSG_STATE_TERMINATED) {
++		if (exception_in_progress(fsg) || signal_pending(current)) {
++			handle_exception(fsg);
++			continue;
++		}
++
++		if (!fsg->running) {
++			sleep_thread(fsg);
++			continue;
++		}
++
++		if (get_next_command(fsg))
++			continue;
++
++		spin_lock_irq(&fsg->lock);
++		if (!exception_in_progress(fsg))
++			fsg->state = FSG_STATE_DATA_PHASE;
++		spin_unlock_irq(&fsg->lock);
++
++		if (do_scsi_command(fsg) || finish_reply(fsg))
++			continue;
++
++		spin_lock_irq(&fsg->lock);
++		if (!exception_in_progress(fsg))
++			fsg->state = FSG_STATE_STATUS_PHASE;
++		spin_unlock_irq(&fsg->lock);
++
++		if (send_status(fsg))
++			continue;
++
++		spin_lock_irq(&fsg->lock);
++		if (!exception_in_progress(fsg))
++			fsg->state = FSG_STATE_IDLE;
++		spin_unlock_irq(&fsg->lock);
++		}
++
++	spin_lock_irq(&fsg->lock);
++	fsg->thread_task = NULL;
++	spin_unlock_irq(&fsg->lock);
++
++	/* If we are exiting because of a signal, unregister the
++	 * gadget driver. */
++	if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags))
++		usb_gadget_unregister_driver(&fsg_driver);
++
++	/* Let the unbind and cleanup routines know the thread has exited */
++	complete_and_exit(&fsg->thread_notifier, 0);
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++
++/* The write permissions and store_xxx pointers are set in fsg_bind() */
++static DEVICE_ATTR(ro, 0444, fsg_show_ro, NULL);
++static DEVICE_ATTR(nofua, 0644, fsg_show_nofua, NULL);
++static DEVICE_ATTR(file, 0444, fsg_show_file, NULL);
++
++
++/*-------------------------------------------------------------------------*/
++
++static void fsg_release(struct kref *ref)
++{
++	struct fsg_dev	*fsg = container_of(ref, struct fsg_dev, ref);
++
++	kfree(fsg->luns);
++	kfree(fsg);
++}
++
++static void lun_release(struct device *dev)
++{
++	struct rw_semaphore	*filesem = dev_get_drvdata(dev);
++	struct fsg_dev		*fsg =
++		container_of(filesem, struct fsg_dev, filesem);
++
++	kref_put(&fsg->ref, fsg_release);
++}
++
++static void /* __init_or_exit */ fsg_unbind(struct usb_gadget *gadget)
++{
++	struct fsg_dev		*fsg = get_gadget_data(gadget);
++	int			i;
++	struct fsg_lun		*curlun;
++	struct usb_request	*req = fsg->ep0req;
++
++	DBG(fsg, "unbind\n");
++	clear_bit(REGISTERED, &fsg->atomic_bitflags);
++
++	/* If the thread isn't already dead, tell it to exit now */
++	if (fsg->state != FSG_STATE_TERMINATED) {
++		raise_exception(fsg, FSG_STATE_EXIT);
++		wait_for_completion(&fsg->thread_notifier);
++
++		/* The cleanup routine waits for this completion also */
++		complete(&fsg->thread_notifier);
++	}
++
++	/* Unregister the sysfs attribute files and the LUNs */
++	for (i = 0; i < fsg->nluns; ++i) {
++		curlun = &fsg->luns[i];
++		if (curlun->registered) {
++			device_remove_file(&curlun->dev, &dev_attr_nofua);
++			device_remove_file(&curlun->dev, &dev_attr_ro);
++			device_remove_file(&curlun->dev, &dev_attr_file);
++			fsg_lun_close(curlun);
++			device_unregister(&curlun->dev);
++			curlun->registered = 0;
++		}
++	}
++
++	/* Free the data buffers */
++	for (i = 0; i < fsg_num_buffers; ++i)
++		kfree(fsg->buffhds[i].buf);
++
++	/* Free the request and buffer for endpoint 0 */
++	if (req) {
++		kfree(req->buf);
++		usb_ep_free_request(fsg->ep0, req);
++	}
++
++	set_gadget_data(gadget, NULL);
++}
++
++
++static int __init check_parameters(struct fsg_dev *fsg)
++{
++	int	prot;
++	int	gcnum;
++
++	/* Store the default values */
++	mod_data.transport_type = USB_PR_BULK;
++	mod_data.transport_name = "Bulk-only";
++	mod_data.protocol_type = USB_SC_SCSI;
++	mod_data.protocol_name = "Transparent SCSI";
++
++	/* Some peripheral controllers are known not to be able to
++	 * halt bulk endpoints correctly.  If one of them is present,
++	 * disable stalls.
++	 */
++	if (gadget_is_at91(fsg->gadget))
++		mod_data.can_stall = 0;
++
++	if (mod_data.release == 0xffff) {	// Parameter wasn't set
++		gcnum = usb_gadget_controller_number(fsg->gadget);
++		if (gcnum >= 0)
++			mod_data.release = 0x0300 + gcnum;
++		else {
++			WARNING(fsg, "controller '%s' not recognized\n",
++				fsg->gadget->name);
++			mod_data.release = 0x0399;
++		}
++	}
++
++	prot = simple_strtol(mod_data.protocol_parm, NULL, 0);
++
++#ifdef CONFIG_USB_FILE_STORAGE_TEST
++	if (strnicmp(mod_data.transport_parm, "BBB", 10) == 0) {
++		;		// Use default setting
++	} else if (strnicmp(mod_data.transport_parm, "CB", 10) == 0) {
++		mod_data.transport_type = USB_PR_CB;
++		mod_data.transport_name = "Control-Bulk";
++	} else if (strnicmp(mod_data.transport_parm, "CBI", 10) == 0) {
++		mod_data.transport_type = USB_PR_CBI;
++		mod_data.transport_name = "Control-Bulk-Interrupt";
++	} else {
++		ERROR(fsg, "invalid transport: %s\n", mod_data.transport_parm);
++		return -EINVAL;
++	}
++
++	if (strnicmp(mod_data.protocol_parm, "SCSI", 10) == 0 ||
++			prot == USB_SC_SCSI) {
++		;		// Use default setting
++	} else if (strnicmp(mod_data.protocol_parm, "RBC", 10) == 0 ||
++			prot == USB_SC_RBC) {
++		mod_data.protocol_type = USB_SC_RBC;
++		mod_data.protocol_name = "RBC";
++	} else if (strnicmp(mod_data.protocol_parm, "8020", 4) == 0 ||
++			strnicmp(mod_data.protocol_parm, "ATAPI", 10) == 0 ||
++			prot == USB_SC_8020) {
++		mod_data.protocol_type = USB_SC_8020;
++		mod_data.protocol_name = "8020i (ATAPI)";
++	} else if (strnicmp(mod_data.protocol_parm, "QIC", 3) == 0 ||
++			prot == USB_SC_QIC) {
++		mod_data.protocol_type = USB_SC_QIC;
++		mod_data.protocol_name = "QIC-157";
++	} else if (strnicmp(mod_data.protocol_parm, "UFI", 10) == 0 ||
++			prot == USB_SC_UFI) {
++		mod_data.protocol_type = USB_SC_UFI;
++		mod_data.protocol_name = "UFI";
++	} else if (strnicmp(mod_data.protocol_parm, "8070", 4) == 0 ||
++			prot == USB_SC_8070) {
++		mod_data.protocol_type = USB_SC_8070;
++		mod_data.protocol_name = "8070i";
++	} else {
++		ERROR(fsg, "invalid protocol: %s\n", mod_data.protocol_parm);
++		return -EINVAL;
++	}
++
++	mod_data.buflen &= PAGE_CACHE_MASK;
++	if (mod_data.buflen <= 0) {
++		ERROR(fsg, "invalid buflen\n");
++		return -ETOOSMALL;
++	}
++
++#endif /* CONFIG_USB_FILE_STORAGE_TEST */
++
++	/* Serial string handling.
++	 * On a real device, the serial string would be loaded
++	 * from permanent storage. */
++	if (mod_data.serial) {
++		const char *ch;
++		unsigned len = 0;
++
++		/* Sanity check :
++		 * The CB[I] specification limits the serial string to
++		 * 12 uppercase hexadecimal characters.
++		 * BBB need at least 12 uppercase hexadecimal characters,
++		 * with a maximum of 126. */
++		for (ch = mod_data.serial; *ch; ++ch) {
++			++len;
++			if ((*ch < '0' || *ch > '9') &&
++			    (*ch < 'A' || *ch > 'F')) { /* not uppercase hex */
++				WARNING(fsg,
++					"Invalid serial string character: %c\n",
++					*ch);
++				goto no_serial;
++			}
++		}
++		if (len > 126 ||
++		    (mod_data.transport_type == USB_PR_BULK && len < 12) ||
++		    (mod_data.transport_type != USB_PR_BULK && len > 12)) {
++			WARNING(fsg, "Invalid serial string length!\n");
++			goto no_serial;
++		}
++		fsg_strings[FSG_STRING_SERIAL - 1].s = mod_data.serial;
++	} else {
++		WARNING(fsg, "No serial-number string provided!\n");
++ no_serial:
++		device_desc.iSerialNumber = 0;
++	}
++
++	return 0;
++}
++
++
++static int __init fsg_bind(struct usb_gadget *gadget)
++{
++	struct fsg_dev		*fsg = the_fsg;
++	int			rc;
++	int			i;
++	struct fsg_lun		*curlun;
++	struct usb_ep		*ep;
++	struct usb_request	*req;
++	char			*pathbuf, *p;
++
++	fsg->gadget = gadget;
++	set_gadget_data(gadget, fsg);
++	fsg->ep0 = gadget->ep0;
++	fsg->ep0->driver_data = fsg;
++
++	if ((rc = check_parameters(fsg)) != 0)
++		goto out;
++
++	if (mod_data.removable) {	// Enable the store_xxx attributes
++		dev_attr_file.attr.mode = 0644;
++		dev_attr_file.store = fsg_store_file;
++		if (!mod_data.cdrom) {
++			dev_attr_ro.attr.mode = 0644;
++			dev_attr_ro.store = fsg_store_ro;
++		}
++	}
++
++	/* Only for removable media? */
++	dev_attr_nofua.attr.mode = 0644;
++	dev_attr_nofua.store = fsg_store_nofua;
++
++	/* Find out how many LUNs there should be */
++	i = mod_data.nluns;
++	if (i == 0)
++		i = max(mod_data.num_filenames, 1u);
++	if (i > FSG_MAX_LUNS) {
++		ERROR(fsg, "invalid number of LUNs: %d\n", i);
++		rc = -EINVAL;
++		goto out;
++	}
++
++	/* Create the LUNs, open their backing files, and register the
++	 * LUN devices in sysfs. */
++	fsg->luns = kzalloc(i * sizeof(struct fsg_lun), GFP_KERNEL);
++	if (!fsg->luns) {
++		rc = -ENOMEM;
++		goto out;
++	}
++	fsg->nluns = i;
++
++	for (i = 0; i < fsg->nluns; ++i) {
++		curlun = &fsg->luns[i];
++		curlun->cdrom = !!mod_data.cdrom;
++		curlun->ro = mod_data.cdrom || mod_data.ro[i];
++		curlun->initially_ro = curlun->ro;
++		curlun->removable = mod_data.removable;
++		curlun->nofua = mod_data.nofua[i];
++		curlun->dev.release = lun_release;
++		curlun->dev.parent = &gadget->dev;
++		curlun->dev.driver = &fsg_driver.driver;
++		dev_set_drvdata(&curlun->dev, &fsg->filesem);
++		dev_set_name(&curlun->dev,"%s-lun%d",
++			     dev_name(&gadget->dev), i);
++
++		kref_get(&fsg->ref);
++		rc = device_register(&curlun->dev);
++		if (rc) {
++			INFO(fsg, "failed to register LUN%d: %d\n", i, rc);
++			put_device(&curlun->dev);
++			goto out;
++		}
++		curlun->registered = 1;
++
++		rc = device_create_file(&curlun->dev, &dev_attr_ro);
++		if (rc)
++			goto out;
++		rc = device_create_file(&curlun->dev, &dev_attr_nofua);
++		if (rc)
++			goto out;
++		rc = device_create_file(&curlun->dev, &dev_attr_file);
++		if (rc)
++			goto out;
++
++		if (mod_data.file[i] && *mod_data.file[i]) {
++			rc = fsg_lun_open(curlun, mod_data.file[i]);
++			if (rc)
++				goto out;
++		} else if (!mod_data.removable) {
++			ERROR(fsg, "no file given for LUN%d\n", i);
++			rc = -EINVAL;
++			goto out;
++		}
++	}
++
++	/* Find all the endpoints we will use */
++	usb_ep_autoconfig_reset(gadget);
++	ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_in_desc);
++	if (!ep)
++		goto autoconf_fail;
++	ep->driver_data = fsg;		// claim the endpoint
++	fsg->bulk_in = ep;
++
++	ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_out_desc);
++	if (!ep)
++		goto autoconf_fail;
++	ep->driver_data = fsg;		// claim the endpoint
++	fsg->bulk_out = ep;
++
++	if (transport_is_cbi()) {
++		ep = usb_ep_autoconfig(gadget, &fsg_fs_intr_in_desc);
++		if (!ep)
++			goto autoconf_fail;
++		ep->driver_data = fsg;		// claim the endpoint
++		fsg->intr_in = ep;
++	}
++
++	/* Fix up the descriptors */
++	device_desc.idVendor = cpu_to_le16(mod_data.vendor);
++	device_desc.idProduct = cpu_to_le16(mod_data.product);
++	device_desc.bcdDevice = cpu_to_le16(mod_data.release);
++
++	i = (transport_is_cbi() ? 3 : 2);	// Number of endpoints
++	fsg_intf_desc.bNumEndpoints = i;
++	fsg_intf_desc.bInterfaceSubClass = mod_data.protocol_type;
++	fsg_intf_desc.bInterfaceProtocol = mod_data.transport_type;
++	fsg_fs_function[i + FSG_FS_FUNCTION_PRE_EP_ENTRIES] = NULL;
++
++	if (gadget_is_dualspeed(gadget)) {
++		fsg_hs_function[i + FSG_HS_FUNCTION_PRE_EP_ENTRIES] = NULL;
++
++		/* Assume endpoint addresses are the same for both speeds */
++		fsg_hs_bulk_in_desc.bEndpointAddress =
++			fsg_fs_bulk_in_desc.bEndpointAddress;
++		fsg_hs_bulk_out_desc.bEndpointAddress =
++			fsg_fs_bulk_out_desc.bEndpointAddress;
++		fsg_hs_intr_in_desc.bEndpointAddress =
++			fsg_fs_intr_in_desc.bEndpointAddress;
++	}
++
++	if (gadget_is_superspeed(gadget)) {
++		unsigned		max_burst;
++
++		fsg_ss_function[i + FSG_SS_FUNCTION_PRE_EP_ENTRIES] = NULL;
++
++		/* Calculate bMaxBurst, we know packet size is 1024 */
++		max_burst = min_t(unsigned, mod_data.buflen / 1024, 15);
++
++		/* Assume endpoint addresses are the same for both speeds */
++		fsg_ss_bulk_in_desc.bEndpointAddress =
++			fsg_fs_bulk_in_desc.bEndpointAddress;
++		fsg_ss_bulk_in_comp_desc.bMaxBurst = max_burst;
++
++		fsg_ss_bulk_out_desc.bEndpointAddress =
++			fsg_fs_bulk_out_desc.bEndpointAddress;
++		fsg_ss_bulk_out_comp_desc.bMaxBurst = max_burst;
++	}
++
++	if (gadget_is_otg(gadget))
++		fsg_otg_desc.bmAttributes |= USB_OTG_HNP;
++
++	rc = -ENOMEM;
++
++	/* Allocate the request and buffer for endpoint 0 */
++	fsg->ep0req = req = usb_ep_alloc_request(fsg->ep0, GFP_KERNEL);
++	if (!req)
++		goto out;
++	req->buf = kmalloc(EP0_BUFSIZE, GFP_KERNEL);
++	if (!req->buf)
++		goto out;
++	req->complete = ep0_complete;
++
++	/* Allocate the data buffers */
++	for (i = 0; i < fsg_num_buffers; ++i) {
++		struct fsg_buffhd	*bh = &fsg->buffhds[i];
++
++		/* Allocate for the bulk-in endpoint.  We assume that
++		 * the buffer will also work with the bulk-out (and
++		 * interrupt-in) endpoint. */
++		bh->buf = kmalloc(mod_data.buflen, GFP_KERNEL);
++		if (!bh->buf)
++			goto out;
++		bh->next = bh + 1;
++	}
++	fsg->buffhds[fsg_num_buffers - 1].next = &fsg->buffhds[0];
++
++	/* This should reflect the actual gadget power source */
++	usb_gadget_set_selfpowered(gadget);
++
++	snprintf(fsg_string_manufacturer, sizeof fsg_string_manufacturer,
++			"%s %s with %s",
++			init_utsname()->sysname, init_utsname()->release,
++			gadget->name);
++
++	fsg->thread_task = kthread_create(fsg_main_thread, fsg,
++			"file-storage-gadget");
++	if (IS_ERR(fsg->thread_task)) {
++		rc = PTR_ERR(fsg->thread_task);
++		goto out;
++	}
++
++	INFO(fsg, DRIVER_DESC ", version: " DRIVER_VERSION "\n");
++	INFO(fsg, "NOTE: This driver is deprecated.  "
++			"Consider using g_mass_storage instead.\n");
++	INFO(fsg, "Number of LUNs=%d\n", fsg->nluns);
++
++	pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
++	for (i = 0; i < fsg->nluns; ++i) {
++		curlun = &fsg->luns[i];
++		if (fsg_lun_is_open(curlun)) {
++			p = NULL;
++			if (pathbuf) {
++				p = d_path(&curlun->filp->f_path,
++					   pathbuf, PATH_MAX);
++				if (IS_ERR(p))
++					p = NULL;
++			}
++			LINFO(curlun, "ro=%d, nofua=%d, file: %s\n",
++			      curlun->ro, curlun->nofua, (p ? p : "(error)"));
++		}
++	}
++	kfree(pathbuf);
++
++	DBG(fsg, "transport=%s (x%02x)\n",
++			mod_data.transport_name, mod_data.transport_type);
++	DBG(fsg, "protocol=%s (x%02x)\n",
++			mod_data.protocol_name, mod_data.protocol_type);
++	DBG(fsg, "VendorID=x%04x, ProductID=x%04x, Release=x%04x\n",
++			mod_data.vendor, mod_data.product, mod_data.release);
++	DBG(fsg, "removable=%d, stall=%d, cdrom=%d, buflen=%u\n",
++			mod_data.removable, mod_data.can_stall,
++			mod_data.cdrom, mod_data.buflen);
++	DBG(fsg, "I/O thread pid: %d\n", task_pid_nr(fsg->thread_task));
++
++	set_bit(REGISTERED, &fsg->atomic_bitflags);
++
++	/* Tell the thread to start working */
++	wake_up_process(fsg->thread_task);
++	return 0;
++
++autoconf_fail:
++	ERROR(fsg, "unable to autoconfigure all endpoints\n");
++	rc = -ENOTSUPP;
++
++out:
++	fsg->state = FSG_STATE_TERMINATED;	// The thread is dead
++	fsg_unbind(gadget);
++	complete(&fsg->thread_notifier);
++	return rc;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static void fsg_suspend(struct usb_gadget *gadget)
++{
++	struct fsg_dev		*fsg = get_gadget_data(gadget);
++
++	DBG(fsg, "suspend\n");
++	set_bit(SUSPENDED, &fsg->atomic_bitflags);
++}
++
++static void fsg_resume(struct usb_gadget *gadget)
++{
++	struct fsg_dev		*fsg = get_gadget_data(gadget);
++
++	DBG(fsg, "resume\n");
++	clear_bit(SUSPENDED, &fsg->atomic_bitflags);
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static struct usb_gadget_driver		fsg_driver = {
++	.max_speed	= USB_SPEED_SUPER,
++	.function	= (char *) fsg_string_product,
++	.unbind		= fsg_unbind,
++	.disconnect	= fsg_disconnect,
++	.setup		= fsg_setup,
++	.suspend	= fsg_suspend,
++	.resume		= fsg_resume,
++
++	.driver		= {
++		.name		= DRIVER_NAME,
++		.owner		= THIS_MODULE,
++		// .release = ...
++		// .suspend = ...
++		// .resume = ...
++	},
++};
++
++
++static int __init fsg_alloc(void)
++{
++	struct fsg_dev		*fsg;
++
++	fsg = kzalloc(sizeof *fsg +
++		      fsg_num_buffers * sizeof *(fsg->buffhds), GFP_KERNEL);
++
++	if (!fsg)
++		return -ENOMEM;
++	spin_lock_init(&fsg->lock);
++	init_rwsem(&fsg->filesem);
++	kref_init(&fsg->ref);
++	init_completion(&fsg->thread_notifier);
++
++	the_fsg = fsg;
++	return 0;
++}
++
++
++static int __init fsg_init(void)
++{
++	int		rc;
++	struct fsg_dev	*fsg;
++
++	rc = fsg_num_buffers_validate();
++	if (rc != 0)
++		return rc;
++
++	if ((rc = fsg_alloc()) != 0)
++		return rc;
++	fsg = the_fsg;
++	if ((rc = usb_gadget_probe_driver(&fsg_driver, fsg_bind)) != 0)
++		kref_put(&fsg->ref, fsg_release);
++	return rc;
++}
++module_init(fsg_init);
++
++
++static void __exit fsg_cleanup(void)
++{
++	struct fsg_dev	*fsg = the_fsg;
++
++	/* Unregister the driver iff the thread hasn't already done so */
++	if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags))
++		usb_gadget_unregister_driver(&fsg_driver);
++
++	/* Wait for the thread to finish up */
++	wait_for_completion(&fsg->thread_notifier);
++
++	kref_put(&fsg->ref, fsg_release);
++}
++module_exit(fsg_cleanup);
+--- a/drivers/usb/host/Kconfig
++++ b/drivers/usb/host/Kconfig
+@@ -678,6 +678,16 @@ config USB_RENESAS_USBHS_HCD
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called renesas-usbhs.
+ 
++config USB_DWCOTG
++	bool "Synopsis DWC host support"
++	depends on USB=y && (FIQ || ARM64)
++	help
++	  The Synopsis DWC controller is a dual-role
++	  host/peripheral/OTG ("On The Go") USB controllers.
++
++	  Enable this option to support this IP in host controller mode.
++	  If unsure, say N.
++
+ config USB_HCD_BCMA
+ 	tristate "BCMA usb host driver"
+ 	depends on BCMA
+--- a/drivers/usb/host/Makefile
++++ b/drivers/usb/host/Makefile
+@@ -77,6 +77,7 @@ obj-$(CONFIG_USB_XHCI_TEGRA)	+= xhci-teg
+ obj-$(CONFIG_USB_SL811_HCD)	+= sl811-hcd.o
+ obj-$(CONFIG_USB_SL811_CS)	+= sl811_cs.o
+ obj-$(CONFIG_USB_R8A66597_HCD)	+= r8a66597-hcd.o
++obj-$(CONFIG_USB_DWCOTG)        += dwc_otg/ dwc_common_port/
+ obj-$(CONFIG_USB_FSL_USB2)	+= fsl-mph-dr-of.o
+ obj-$(CONFIG_USB_EHCI_FSL)	+= fsl-mph-dr-of.o
+ obj-$(CONFIG_USB_EHCI_FSL)	+= ehci-fsl.o
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/Makefile
+@@ -0,0 +1,58 @@
++#
++# Makefile for DWC_common library
++#
++
++ifneq ($(KERNELRELEASE),)
++
++ccflags-y	+= -DDWC_LINUX
++#ccflags-y	+= -DDEBUG
++#ccflags-y	+= -DDWC_DEBUG_REGS
++#ccflags-y	+= -DDWC_DEBUG_MEMORY
++
++ccflags-y	+= -DDWC_LIBMODULE
++ccflags-y	+= -DDWC_CCLIB
++#ccflags-y	+= -DDWC_CRYPTOLIB
++ccflags-y	+= -DDWC_NOTIFYLIB
++ccflags-y	+= -DDWC_UTFLIB
++
++obj-$(CONFIG_USB_DWCOTG)	+= dwc_common_port_lib.o
++dwc_common_port_lib-objs := dwc_cc.o dwc_modpow.o dwc_dh.o \
++			    dwc_crypto.o dwc_notifier.o \
++			    dwc_common_linux.o dwc_mem.o
++
++kernrelwd := $(subst ., ,$(KERNELRELEASE))
++kernrel3 := $(word 1,$(kernrelwd)).$(word 2,$(kernrelwd)).$(word 3,$(kernrelwd))
++
++ifneq ($(kernrel3),2.6.20)
++# grayg - I only know that we use ccflags-y in 2.6.31 actually
++ccflags-y += $(CPPFLAGS)
++endif
++
++else
++
++#ifeq ($(KDIR),)
++#$(error Must give "KDIR=/path/to/kernel/source" on command line or in environment)
++#endif
++
++ifeq ($(ARCH),)
++$(error Must give "ARCH=<arch>" on command line or in environment. Also, if \
++ cross-compiling, must give "CROSS_COMPILE=/path/to/compiler/plus/tool-prefix-")
++endif
++
++ifeq ($(DOXYGEN),)
++DOXYGEN		:= doxygen
++endif
++
++default:
++	$(MAKE) -C$(KDIR) M=$(PWD) ARCH=$(ARCH) CROSS_COMPILE=$(CROSS_COMPILE) modules
++
++docs:	$(wildcard *.[hc]) doc/doxygen.cfg
++	$(DOXYGEN) doc/doxygen.cfg
++
++tags:	$(wildcard *.[hc])
++	$(CTAGS) -e $(wildcard *.[hc]) $(wildcard linux/*.[hc]) $(wildcard $(KDIR)/include/linux/usb*.h)
++
++endif
++
++clean:
++	rm -rf *.o *.ko .*.cmd *.mod.c .*.o.d .*.o.tmp modules.order Module.markers Module.symvers .tmp_versions/
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/Makefile.fbsd
+@@ -0,0 +1,17 @@
++CFLAGS	+= -I/sys/i386/compile/GENERIC -I/sys/i386/include -I/usr/include
++CFLAGS	+= -DDWC_FREEBSD
++CFLAGS	+= -DDEBUG
++#CFLAGS	+= -DDWC_DEBUG_REGS
++#CFLAGS	+= -DDWC_DEBUG_MEMORY
++
++#CFLAGS	+= -DDWC_LIBMODULE
++#CFLAGS	+= -DDWC_CCLIB
++#CFLAGS	+= -DDWC_CRYPTOLIB
++#CFLAGS	+= -DDWC_NOTIFYLIB
++#CFLAGS	+= -DDWC_UTFLIB
++
++KMOD = dwc_common_port_lib
++SRCS = dwc_cc.c dwc_modpow.c dwc_dh.c dwc_crypto.c dwc_notifier.c \
++       dwc_common_fbsd.c dwc_mem.c
++
++.include <bsd.kmod.mk>
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/Makefile.linux
+@@ -0,0 +1,49 @@
++#
++# Makefile for DWC_common library
++#
++ifneq ($(KERNELRELEASE),)
++
++ccflags-y	+= -DDWC_LINUX
++#ccflags-y	+= -DDEBUG
++#ccflags-y	+= -DDWC_DEBUG_REGS
++#ccflags-y	+= -DDWC_DEBUG_MEMORY
++
++ccflags-y	+= -DDWC_LIBMODULE
++ccflags-y	+= -DDWC_CCLIB
++ccflags-y	+= -DDWC_CRYPTOLIB
++ccflags-y	+= -DDWC_NOTIFYLIB
++ccflags-y	+= -DDWC_UTFLIB
++
++obj-m			 := dwc_common_port_lib.o
++dwc_common_port_lib-objs := dwc_cc.o dwc_modpow.o dwc_dh.o \
++			    dwc_crypto.o dwc_notifier.o \
++			    dwc_common_linux.o dwc_mem.o
++
++else
++
++ifeq ($(KDIR),)
++$(error Must give "KDIR=/path/to/kernel/source" on command line or in environment)
++endif
++
++ifeq ($(ARCH),)
++$(error Must give "ARCH=<arch>" on command line or in environment. Also, if \
++ cross-compiling, must give "CROSS_COMPILE=/path/to/compiler/plus/tool-prefix-")
++endif
++
++ifeq ($(DOXYGEN),)
++DOXYGEN		:= doxygen
++endif
++
++default:
++	$(MAKE) -C$(KDIR) M=$(PWD) ARCH=$(ARCH) CROSS_COMPILE=$(CROSS_COMPILE) modules
++
++docs:	$(wildcard *.[hc]) doc/doxygen.cfg
++	$(DOXYGEN) doc/doxygen.cfg
++
++tags:	$(wildcard *.[hc])
++	$(CTAGS) -e $(wildcard *.[hc]) $(wildcard linux/*.[hc]) $(wildcard $(KDIR)/include/linux/usb*.h)
++
++endif
++
++clean:
++	rm -rf *.o *.ko .*.cmd *.mod.c .*.o.d .*.o.tmp modules.order Module.markers Module.symvers .tmp_versions/
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/changes.txt
+@@ -0,0 +1,174 @@
++
++dwc_read_reg32() and friends now take an additional parameter, a pointer to an
++IO context struct. The IO context struct should live in an os-dependent struct
++in your driver. As an example, the dwc_usb3 driver has an os-dependent struct
++named 'os_dep' embedded in the main device struct. So there these calls look
++like this:
++
++	dwc_read_reg32(&usb3_dev->os_dep.ioctx, &pcd->dev_global_regs->dcfg);
++
++	dwc_write_reg32(&usb3_dev->os_dep.ioctx,
++			&pcd->dev_global_regs->dcfg, 0);
++
++Note that for the existing Linux driver ports, it is not necessary to actually
++define the 'ioctx' member in the os-dependent struct. Since Linux does not
++require an IO context, its macros for dwc_read_reg32() and friends do not
++use the context pointer, so it is optimized away by the compiler. But it is
++necessary to add the pointer parameter to all of the call sites, to be ready
++for any future ports (such as FreeBSD) which do require an IO context.
++
++
++Similarly, dwc_alloc(), dwc_alloc_atomic(), dwc_strdup(), and dwc_free() now
++take an additional parameter, a pointer to a memory context. Examples:
++
++	addr = dwc_alloc(&usb3_dev->os_dep.memctx, size);
++
++	dwc_free(&usb3_dev->os_dep.memctx, addr);
++
++Again, for the Linux ports, it is not necessary to actually define the memctx
++member, but it is necessary to add the pointer parameter to all of the call
++sites.
++
++
++Same for dwc_dma_alloc() and dwc_dma_free(). Examples:
++
++	virt_addr = dwc_dma_alloc(&usb3_dev->os_dep.dmactx, size, &phys_addr);
++
++	dwc_dma_free(&usb3_dev->os_dep.dmactx, size, virt_addr, phys_addr);
++
++
++Same for dwc_mutex_alloc() and dwc_mutex_free(). Examples:
++
++	mutex = dwc_mutex_alloc(&usb3_dev->os_dep.mtxctx);
++
++	dwc_mutex_free(&usb3_dev->os_dep.mtxctx, mutex);
++
++
++Same for dwc_spinlock_alloc() and dwc_spinlock_free(). Examples:
++
++	lock = dwc_spinlock_alloc(&usb3_dev->osdep.splctx);
++
++	dwc_spinlock_free(&usb3_dev->osdep.splctx, lock);
++
++
++Same for dwc_timer_alloc(). Example:
++
++	timer = dwc_timer_alloc(&usb3_dev->os_dep.tmrctx, "dwc_usb3_tmr1",
++				cb_func, cb_data);
++
++
++Same for dwc_waitq_alloc(). Example:
++
++	waitq = dwc_waitq_alloc(&usb3_dev->os_dep.wtqctx);
++
++
++Same for dwc_thread_run(). Example:
++
++	thread = dwc_thread_run(&usb3_dev->os_dep.thdctx, func,
++				"dwc_usb3_thd1", data);
++
++
++Same for dwc_workq_alloc(). Example:
++
++	workq = dwc_workq_alloc(&usb3_dev->osdep.wkqctx, "dwc_usb3_wkq1");
++
++
++Same for dwc_task_alloc(). Example:
++
++	task = dwc_task_alloc(&usb3_dev->os_dep.tskctx, "dwc_usb3_tsk1",
++			      cb_func, cb_data);
++
++
++In addition to the context pointer additions, a few core functions have had
++other changes made to their parameters:
++
++The 'flags' parameter to dwc_spinlock_irqsave() and dwc_spinunlock_irqrestore()
++has been changed from a uint64_t to a dwc_irqflags_t.
++
++dwc_thread_should_stop() now takes a 'dwc_thread_t *' parameter, because the
++FreeBSD equivalent of that function requires it.
++
++And, in addition to the context pointer, dwc_task_alloc() also adds a
++'char *name' parameter, to be consistent with dwc_thread_run() and
++dwc_workq_alloc(), and because the FreeBSD equivalent of that function
++requires a unique name.
++
++
++Here is a complete list of the core functions that now take a pointer to a
++context as their first parameter:
++
++	dwc_read_reg32
++	dwc_read_reg64
++	dwc_write_reg32
++	dwc_write_reg64
++	dwc_modify_reg32
++	dwc_modify_reg64
++	dwc_alloc
++	dwc_alloc_atomic
++	dwc_strdup
++	dwc_free
++	dwc_dma_alloc
++	dwc_dma_free
++	dwc_mutex_alloc
++	dwc_mutex_free
++	dwc_spinlock_alloc
++	dwc_spinlock_free
++	dwc_timer_alloc
++	dwc_waitq_alloc
++	dwc_thread_run
++	dwc_workq_alloc
++	dwc_task_alloc     Also adds a 'char *name' as its 2nd parameter
++
++And here are the core functions that have other changes to their parameters:
++
++	dwc_spinlock_irqsave      'flags' param is now a 'dwc_irqflags_t *'
++	dwc_spinunlock_irqrestore 'flags' param is now a 'dwc_irqflags_t'
++	dwc_thread_should_stop    Adds a 'dwc_thread_t *' parameter
++
++
++
++The changes to the core functions also require some of the other library
++functions to change:
++
++	dwc_cc_if_alloc() and dwc_cc_if_free() now take a 'void *memctx'
++	(for memory allocation) as the 1st param and a 'void *mtxctx'
++	(for mutex allocation) as the 2nd param.
++
++	dwc_cc_clear(), dwc_cc_add(), dwc_cc_change(), dwc_cc_remove(),
++	dwc_cc_data_for_save(), and dwc_cc_restore_from_data() now take a
++	'void *memctx' as the 1st param.
++
++	dwc_dh_modpow(), dwc_dh_pk(), and dwc_dh_derive_keys() now take a
++	'void *memctx' as the 1st param.
++
++	dwc_modpow() now takes a 'void *memctx' as the 1st param.
++
++	dwc_alloc_notification_manager() now takes a 'void *memctx' as the
++	1st param and a 'void *wkqctx' (for work queue allocation) as the 2nd
++	param, and also now returns an integer value that is non-zero if
++	allocation of its data structures or work queue fails.
++
++	dwc_register_notifier() now takes a 'void *memctx' as the 1st param.
++
++	dwc_memory_debug_start() now takes a 'void *mem_ctx' as the first
++	param, and also now returns an integer value that is non-zero if
++	allocation of its data structures fails.
++
++
++
++Other miscellaneous changes:
++
++The DEBUG_MEMORY and DEBUG_REGS #define's have been renamed to
++DWC_DEBUG_MEMORY and DWC_DEBUG_REGS.
++
++The following #define's have been added to allow selectively compiling library
++features:
++
++	DWC_CCLIB
++	DWC_CRYPTOLIB
++	DWC_NOTIFYLIB
++	DWC_UTFLIB
++
++A DWC_LIBMODULE #define has also been added. If this is not defined, then the
++module code in dwc_common_linux.c is not compiled in. This allows linking the
++library code directly into a driver module, instead of as a standalone module.
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/doc/doxygen.cfg
+@@ -0,0 +1,270 @@
++# Doxyfile 1.4.5
++
++#---------------------------------------------------------------------------
++# Project related configuration options
++#---------------------------------------------------------------------------
++PROJECT_NAME           = "Synopsys DWC Portability and Common Library for UWB"
++PROJECT_NUMBER         =
++OUTPUT_DIRECTORY       = doc
++CREATE_SUBDIRS         = NO
++OUTPUT_LANGUAGE        = English
++BRIEF_MEMBER_DESC      = YES
++REPEAT_BRIEF           = YES
++ABBREVIATE_BRIEF       = "The $name class" \
++                         "The $name widget" \
++                         "The $name file" \
++                         is \
++                         provides \
++                         specifies \
++                         contains \
++                         represents \
++                         a \
++                         an \
++                         the
++ALWAYS_DETAILED_SEC    = YES
++INLINE_INHERITED_MEMB  = NO
++FULL_PATH_NAMES        = NO
++STRIP_FROM_PATH        = ..
++STRIP_FROM_INC_PATH    =
++SHORT_NAMES            = NO
++JAVADOC_AUTOBRIEF      = YES
++MULTILINE_CPP_IS_BRIEF = NO
++DETAILS_AT_TOP         = YES
++INHERIT_DOCS           = YES
++SEPARATE_MEMBER_PAGES  = NO
++TAB_SIZE               = 8
++ALIASES                =
++OPTIMIZE_OUTPUT_FOR_C  = YES
++OPTIMIZE_OUTPUT_JAVA   = NO
++BUILTIN_STL_SUPPORT    = NO
++DISTRIBUTE_GROUP_DOC   = NO
++SUBGROUPING            = NO
++#---------------------------------------------------------------------------
++# Build related configuration options
++#---------------------------------------------------------------------------
++EXTRACT_ALL            = NO
++EXTRACT_PRIVATE        = NO
++EXTRACT_STATIC         = YES
++EXTRACT_LOCAL_CLASSES  = NO
++EXTRACT_LOCAL_METHODS  = NO
++HIDE_UNDOC_MEMBERS     = NO
++HIDE_UNDOC_CLASSES     = NO
++HIDE_FRIEND_COMPOUNDS  = NO
++HIDE_IN_BODY_DOCS      = NO
++INTERNAL_DOCS          = NO
++CASE_SENSE_NAMES       = YES
++HIDE_SCOPE_NAMES       = NO
++SHOW_INCLUDE_FILES     = NO
++INLINE_INFO            = YES
++SORT_MEMBER_DOCS       = NO
++SORT_BRIEF_DOCS        = NO
++SORT_BY_SCOPE_NAME     = NO
++GENERATE_TODOLIST      = YES
++GENERATE_TESTLIST      = YES
++GENERATE_BUGLIST       = YES
++GENERATE_DEPRECATEDLIST= YES
++ENABLED_SECTIONS       =
++MAX_INITIALIZER_LINES  = 30
++SHOW_USED_FILES        = YES
++SHOW_DIRECTORIES       = YES
++FILE_VERSION_FILTER    =
++#---------------------------------------------------------------------------
++# configuration options related to warning and progress messages
++#---------------------------------------------------------------------------
++QUIET                  = YES
++WARNINGS               = YES
++WARN_IF_UNDOCUMENTED   = NO
++WARN_IF_DOC_ERROR      = YES
++WARN_NO_PARAMDOC       = YES
++WARN_FORMAT            = "$file:$line: $text"
++WARN_LOGFILE           =
++#---------------------------------------------------------------------------
++# configuration options related to the input files
++#---------------------------------------------------------------------------
++INPUT                  = .
++FILE_PATTERNS          = *.c \
++                         *.cc \
++                         *.cxx \
++                         *.cpp \
++                         *.c++ \
++                         *.d \
++                         *.java \
++                         *.ii \
++                         *.ixx \
++                         *.ipp \
++                         *.i++ \
++                         *.inl \
++                         *.h \
++                         *.hh \
++                         *.hxx \
++                         *.hpp \
++                         *.h++ \
++                         *.idl \
++                         *.odl \
++                         *.cs \
++                         *.php \
++                         *.php3 \
++                         *.inc \
++                         *.m \
++                         *.mm \
++                         *.dox \
++                         *.py \
++                         *.C \
++                         *.CC \
++                         *.C++ \
++                         *.II \
++                         *.I++ \
++                         *.H \
++                         *.HH \
++                         *.H++ \
++                         *.CS \
++                         *.PHP \
++                         *.PHP3 \
++                         *.M \
++                         *.MM \
++                         *.PY
++RECURSIVE              = NO
++EXCLUDE                =
++EXCLUDE_SYMLINKS       = NO
++EXCLUDE_PATTERNS       =
++EXAMPLE_PATH           =
++EXAMPLE_PATTERNS       = *
++EXAMPLE_RECURSIVE      = NO
++IMAGE_PATH             =
++INPUT_FILTER           =
++FILTER_PATTERNS        =
++FILTER_SOURCE_FILES    = NO
++#---------------------------------------------------------------------------
++# configuration options related to source browsing
++#---------------------------------------------------------------------------
++SOURCE_BROWSER         = NO
++INLINE_SOURCES         = NO
++STRIP_CODE_COMMENTS    = YES
++REFERENCED_BY_RELATION = YES
++REFERENCES_RELATION    = YES
++USE_HTAGS              = NO
++VERBATIM_HEADERS       = NO
++#---------------------------------------------------------------------------
++# configuration options related to the alphabetical class index
++#---------------------------------------------------------------------------
++ALPHABETICAL_INDEX     = NO
++COLS_IN_ALPHA_INDEX    = 5
++IGNORE_PREFIX          =
++#---------------------------------------------------------------------------
++# configuration options related to the HTML output
++#---------------------------------------------------------------------------
++GENERATE_HTML          = YES
++HTML_OUTPUT            = html
++HTML_FILE_EXTENSION    = .html
++HTML_HEADER            =
++HTML_FOOTER            =
++HTML_STYLESHEET        =
++HTML_ALIGN_MEMBERS     = YES
++GENERATE_HTMLHELP      = NO
++CHM_FILE               =
++HHC_LOCATION           =
++GENERATE_CHI           = NO
++BINARY_TOC             = NO
++TOC_EXPAND             = NO
++DISABLE_INDEX          = NO
++ENUM_VALUES_PER_LINE   = 4
++GENERATE_TREEVIEW      = YES
++TREEVIEW_WIDTH         = 250
++#---------------------------------------------------------------------------
++# configuration options related to the LaTeX output
++#---------------------------------------------------------------------------
++GENERATE_LATEX         = NO
++LATEX_OUTPUT           = latex
++LATEX_CMD_NAME         = latex
++MAKEINDEX_CMD_NAME     = makeindex
++COMPACT_LATEX          = NO
++PAPER_TYPE             = a4wide
++EXTRA_PACKAGES         =
++LATEX_HEADER           =
++PDF_HYPERLINKS         = NO
++USE_PDFLATEX           = NO
++LATEX_BATCHMODE        = NO
++LATEX_HIDE_INDICES     = NO
++#---------------------------------------------------------------------------
++# configuration options related to the RTF output
++#---------------------------------------------------------------------------
++GENERATE_RTF           = NO
++RTF_OUTPUT             = rtf
++COMPACT_RTF            = NO
++RTF_HYPERLINKS         = NO
++RTF_STYLESHEET_FILE    =
++RTF_EXTENSIONS_FILE    =
++#---------------------------------------------------------------------------
++# configuration options related to the man page output
++#---------------------------------------------------------------------------
++GENERATE_MAN           = NO
++MAN_OUTPUT             = man
++MAN_EXTENSION          = .3
++MAN_LINKS              = NO
++#---------------------------------------------------------------------------
++# configuration options related to the XML output
++#---------------------------------------------------------------------------
++GENERATE_XML           = NO
++XML_OUTPUT             = xml
++XML_SCHEMA             =
++XML_DTD                =
++XML_PROGRAMLISTING     = YES
++#---------------------------------------------------------------------------
++# configuration options for the AutoGen Definitions output
++#---------------------------------------------------------------------------
++GENERATE_AUTOGEN_DEF   = NO
++#---------------------------------------------------------------------------
++# configuration options related to the Perl module output
++#---------------------------------------------------------------------------
++GENERATE_PERLMOD       = NO
++PERLMOD_LATEX          = NO
++PERLMOD_PRETTY         = YES
++PERLMOD_MAKEVAR_PREFIX =
++#---------------------------------------------------------------------------
++# Configuration options related to the preprocessor
++#---------------------------------------------------------------------------
++ENABLE_PREPROCESSING   = YES
++MACRO_EXPANSION        = NO
++EXPAND_ONLY_PREDEF     = NO
++SEARCH_INCLUDES        = YES
++INCLUDE_PATH           =
++INCLUDE_FILE_PATTERNS  =
++PREDEFINED             = DEBUG DEBUG_MEMORY
++EXPAND_AS_DEFINED      =
++SKIP_FUNCTION_MACROS   = YES
++#---------------------------------------------------------------------------
++# Configuration::additions related to external references
++#---------------------------------------------------------------------------
++TAGFILES               =
++GENERATE_TAGFILE       =
++ALLEXTERNALS           = NO
++EXTERNAL_GROUPS        = YES
++PERL_PATH              = /usr/bin/perl
++#---------------------------------------------------------------------------
++# Configuration options related to the dot tool
++#---------------------------------------------------------------------------
++CLASS_DIAGRAMS         = YES
++HIDE_UNDOC_RELATIONS   = YES
++HAVE_DOT               = NO
++CLASS_GRAPH            = YES
++COLLABORATION_GRAPH    = YES
++GROUP_GRAPHS           = YES
++UML_LOOK               = NO
++TEMPLATE_RELATIONS     = NO
++INCLUDE_GRAPH          = NO
++INCLUDED_BY_GRAPH      = YES
++CALL_GRAPH             = NO
++GRAPHICAL_HIERARCHY    = YES
++DIRECTORY_GRAPH        = YES
++DOT_IMAGE_FORMAT       = png
++DOT_PATH               =
++DOTFILE_DIRS           =
++MAX_DOT_GRAPH_DEPTH    = 1000
++DOT_TRANSPARENT        = NO
++DOT_MULTI_TARGETS      = NO
++GENERATE_LEGEND        = YES
++DOT_CLEANUP            = YES
++#---------------------------------------------------------------------------
++# Configuration::additions related to the search engine
++#---------------------------------------------------------------------------
++SEARCHENGINE           = NO
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_cc.c
+@@ -0,0 +1,532 @@
++/* =========================================================================
++ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_cc.c $
++ * $Revision: #4 $
++ * $Date: 2010/11/04 $
++ * $Change: 1621692 $
++ *
++ * Synopsys Portability Library Software and documentation
++ * (hereinafter, "Software") is an Unsupported proprietary work of
++ * Synopsys, Inc. unless otherwise expressly agreed to in writing
++ * between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product
++ * under any End User Software License Agreement or Agreement for
++ * Licensed Product with Synopsys or any supplement thereto. You are
++ * permitted to use and redistribute this Software in source and binary
++ * forms, with or without modification, provided that redistributions
++ * of source code must retain this notice. You may not view, use,
++ * disclose, copy or distribute this file or any information contained
++ * herein except pursuant to this license grant from Synopsys. If you
++ * do not agree with this notice, including the disclaimer below, then
++ * you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
++ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
++ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
++ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
++ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
++ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================= */
++#ifdef DWC_CCLIB
++
++#include "dwc_cc.h"
++
++typedef struct dwc_cc
++{
++	uint32_t uid;
++	uint8_t chid[16];
++	uint8_t cdid[16];
++	uint8_t ck[16];
++	uint8_t *name;
++	uint8_t length;
++        DWC_CIRCLEQ_ENTRY(dwc_cc) list_entry;
++} dwc_cc_t;
++
++DWC_CIRCLEQ_HEAD(context_list, dwc_cc);
++
++/** The main structure for CC management.  */
++struct dwc_cc_if
++{
++	dwc_mutex_t *mutex;
++	char *filename;
++
++	unsigned is_host:1;
++
++	dwc_notifier_t *notifier;
++
++	struct context_list list;
++};
++
++#ifdef DEBUG
++static inline void dump_bytes(char *name, uint8_t *bytes, int len)
++{
++	int i;
++	DWC_PRINTF("%s: ", name);
++	for (i=0; i<len; i++) {
++		DWC_PRINTF("%02x ", bytes[i]);
++	}
++	DWC_PRINTF("\n");
++}
++#else
++#define dump_bytes(x...)
++#endif
++
++static dwc_cc_t *alloc_cc(void *mem_ctx, uint8_t *name, uint32_t length)
++{
++	dwc_cc_t *cc = dwc_alloc(mem_ctx, sizeof(dwc_cc_t));
++	if (!cc) {
++		return NULL;
++	}
++	DWC_MEMSET(cc, 0, sizeof(dwc_cc_t));
++
++	if (name) {
++		cc->length = length;
++		cc->name = dwc_alloc(mem_ctx, length);
++		if (!cc->name) {
++			dwc_free(mem_ctx, cc);
++			return NULL;
++		}
++
++		DWC_MEMCPY(cc->name, name, length);
++	}
++
++	return cc;
++}
++
++static void free_cc(void *mem_ctx, dwc_cc_t *cc)
++{
++	if (cc->name) {
++		dwc_free(mem_ctx, cc->name);
++	}
++	dwc_free(mem_ctx, cc);
++}
++
++static uint32_t next_uid(dwc_cc_if_t *cc_if)
++{
++	uint32_t uid = 0;
++	dwc_cc_t *cc;
++	DWC_CIRCLEQ_FOREACH(cc, &cc_if->list, list_entry) {
++		if (cc->uid > uid) {
++			uid = cc->uid;
++		}
++	}
++
++	if (uid == 0) {
++		uid = 255;
++	}
++
++	return uid + 1;
++}
++
++static dwc_cc_t *cc_find(dwc_cc_if_t *cc_if, uint32_t uid)
++{
++	dwc_cc_t *cc;
++	DWC_CIRCLEQ_FOREACH(cc, &cc_if->list, list_entry) {
++		if (cc->uid == uid) {
++			return cc;
++		}
++	}
++	return NULL;
++}
++
++static unsigned int cc_data_size(dwc_cc_if_t *cc_if)
++{
++	unsigned int size = 0;
++	dwc_cc_t *cc;
++	DWC_CIRCLEQ_FOREACH(cc, &cc_if->list, list_entry) {
++		size += (48 + 1);
++		if (cc->name) {
++			size += cc->length;
++		}
++	}
++	return size;
++}
++
++static uint32_t cc_match_chid(dwc_cc_if_t *cc_if, uint8_t *chid)
++{
++	uint32_t uid = 0;
++	dwc_cc_t *cc;
++
++	DWC_CIRCLEQ_FOREACH(cc, &cc_if->list, list_entry) {
++		if (DWC_MEMCMP(cc->chid, chid, 16) == 0) {
++			uid = cc->uid;
++			break;
++		}
++	}
++	return uid;
++}
++static uint32_t cc_match_cdid(dwc_cc_if_t *cc_if, uint8_t *cdid)
++{
++	uint32_t uid = 0;
++	dwc_cc_t *cc;
++
++	DWC_CIRCLEQ_FOREACH(cc, &cc_if->list, list_entry) {
++		if (DWC_MEMCMP(cc->cdid, cdid, 16) == 0) {
++			uid = cc->uid;
++			break;
++		}
++	}
++	return uid;
++}
++
++/* Internal cc_add */
++static int32_t cc_add(void *mem_ctx, dwc_cc_if_t *cc_if, uint8_t *chid,
++		      uint8_t *cdid, uint8_t *ck, uint8_t *name, uint8_t length)
++{
++	dwc_cc_t *cc;
++	uint32_t uid;
++
++	if (cc_if->is_host) {
++		uid = cc_match_cdid(cc_if, cdid);
++	}
++	else {
++		uid = cc_match_chid(cc_if, chid);
++	}
++
++	if (uid) {
++		DWC_DEBUGC("Replacing previous connection context id=%d name=%p name_len=%d", uid, name, length);
++		cc = cc_find(cc_if, uid);
++	}
++	else {
++		cc = alloc_cc(mem_ctx, name, length);
++		cc->uid = next_uid(cc_if);
++		DWC_CIRCLEQ_INSERT_TAIL(&cc_if->list, cc, list_entry);
++	}
++
++	DWC_MEMCPY(&(cc->chid[0]), chid, 16);
++	DWC_MEMCPY(&(cc->cdid[0]), cdid, 16);
++	DWC_MEMCPY(&(cc->ck[0]), ck, 16);
++
++	DWC_DEBUGC("Added connection context id=%d name=%p name_len=%d", cc->uid, name, length);
++	dump_bytes("CHID", cc->chid, 16);
++	dump_bytes("CDID", cc->cdid, 16);
++	dump_bytes("CK", cc->ck, 16);
++	return cc->uid;
++}
++
++/* Internal cc_clear */
++static void cc_clear(void *mem_ctx, dwc_cc_if_t *cc_if)
++{
++	while (!DWC_CIRCLEQ_EMPTY(&cc_if->list)) {
++		dwc_cc_t *cc = DWC_CIRCLEQ_FIRST(&cc_if->list);
++		DWC_CIRCLEQ_REMOVE_INIT(&cc_if->list, cc, list_entry);
++		free_cc(mem_ctx, cc);
++	}
++}
++
++dwc_cc_if_t *dwc_cc_if_alloc(void *mem_ctx, void *mtx_ctx,
++			     dwc_notifier_t *notifier, unsigned is_host)
++{
++	dwc_cc_if_t *cc_if = NULL;
++
++	/* Allocate a common_cc_if structure */
++	cc_if = dwc_alloc(mem_ctx, sizeof(dwc_cc_if_t));
++
++	if (!cc_if)
++		return NULL;
++
++#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES))
++	DWC_MUTEX_ALLOC_LINUX_DEBUG(cc_if->mutex);
++#else
++	cc_if->mutex = dwc_mutex_alloc(mtx_ctx);
++#endif
++	if (!cc_if->mutex) {
++		dwc_free(mem_ctx, cc_if);
++		return NULL;
++	}
++
++	DWC_CIRCLEQ_INIT(&cc_if->list);
++	cc_if->is_host = is_host;
++	cc_if->notifier = notifier;
++	return cc_if;
++}
++
++void dwc_cc_if_free(void *mem_ctx, void *mtx_ctx, dwc_cc_if_t *cc_if)
++{
++#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES))
++	DWC_MUTEX_FREE(cc_if->mutex);
++#else
++	dwc_mutex_free(mtx_ctx, cc_if->mutex);
++#endif
++	cc_clear(mem_ctx, cc_if);
++	dwc_free(mem_ctx, cc_if);
++}
++
++static void cc_changed(dwc_cc_if_t *cc_if)
++{
++	if (cc_if->notifier) {
++		dwc_notify(cc_if->notifier, DWC_CC_LIST_CHANGED_NOTIFICATION, cc_if);
++	}
++}
++
++void dwc_cc_clear(void *mem_ctx, dwc_cc_if_t *cc_if)
++{
++	DWC_MUTEX_LOCK(cc_if->mutex);
++	cc_clear(mem_ctx, cc_if);
++	DWC_MUTEX_UNLOCK(cc_if->mutex);
++	cc_changed(cc_if);
++}
++
++int32_t dwc_cc_add(void *mem_ctx, dwc_cc_if_t *cc_if, uint8_t *chid,
++		   uint8_t *cdid, uint8_t *ck, uint8_t *name, uint8_t length)
++{
++	uint32_t uid;
++
++	DWC_MUTEX_LOCK(cc_if->mutex);
++	uid = cc_add(mem_ctx, cc_if, chid, cdid, ck, name, length);
++	DWC_MUTEX_UNLOCK(cc_if->mutex);
++	cc_changed(cc_if);
++
++	return uid;
++}
++
++void dwc_cc_change(void *mem_ctx, dwc_cc_if_t *cc_if, int32_t id, uint8_t *chid,
++		   uint8_t *cdid, uint8_t *ck, uint8_t *name, uint8_t length)
++{
++	dwc_cc_t* cc;
++
++	DWC_DEBUGC("Change connection context %d", id);
++
++	DWC_MUTEX_LOCK(cc_if->mutex);
++	cc = cc_find(cc_if, id);
++	if (!cc) {
++		DWC_ERROR("Uid %d not found in cc list\n", id);
++		DWC_MUTEX_UNLOCK(cc_if->mutex);
++		return;
++	}
++
++	if (chid) {
++		DWC_MEMCPY(&(cc->chid[0]), chid, 16);
++	}
++	if (cdid) {
++		DWC_MEMCPY(&(cc->cdid[0]), cdid, 16);
++	}
++	if (ck) {
++		DWC_MEMCPY(&(cc->ck[0]), ck, 16);
++	}
++
++	if (name) {
++		if (cc->name) {
++			dwc_free(mem_ctx, cc->name);
++		}
++		cc->name = dwc_alloc(mem_ctx, length);
++		if (!cc->name) {
++			DWC_ERROR("Out of memory in dwc_cc_change()\n");
++			DWC_MUTEX_UNLOCK(cc_if->mutex);
++			return;
++		}
++		cc->length = length;
++		DWC_MEMCPY(cc->name, name, length);
++	}
++
++	DWC_MUTEX_UNLOCK(cc_if->mutex);
++
++	cc_changed(cc_if);
++
++	DWC_DEBUGC("Changed connection context id=%d\n", id);
++	dump_bytes("New CHID", cc->chid, 16);
++	dump_bytes("New CDID", cc->cdid, 16);
++	dump_bytes("New CK", cc->ck, 16);
++}
++
++void dwc_cc_remove(void *mem_ctx, dwc_cc_if_t *cc_if, int32_t id)
++{
++	dwc_cc_t *cc;
++
++	DWC_DEBUGC("Removing connection context %d", id);
++
++	DWC_MUTEX_LOCK(cc_if->mutex);
++	cc = cc_find(cc_if, id);
++	if (!cc) {
++		DWC_ERROR("Uid %d not found in cc list\n", id);
++		DWC_MUTEX_UNLOCK(cc_if->mutex);
++		return;
++	}
++
++	DWC_CIRCLEQ_REMOVE_INIT(&cc_if->list, cc, list_entry);
++	DWC_MUTEX_UNLOCK(cc_if->mutex);
++	free_cc(mem_ctx, cc);
++
++	cc_changed(cc_if);
++}
++
++uint8_t *dwc_cc_data_for_save(void *mem_ctx, dwc_cc_if_t *cc_if, unsigned int *length)
++{
++	uint8_t *buf, *x;
++	uint8_t zero = 0;
++	dwc_cc_t *cc;
++
++	DWC_MUTEX_LOCK(cc_if->mutex);
++	*length = cc_data_size(cc_if);
++	if (!(*length)) {
++		DWC_MUTEX_UNLOCK(cc_if->mutex);
++		return NULL;
++	}
++
++	DWC_DEBUGC("Creating data for saving (length=%d)", *length);
++
++	buf = dwc_alloc(mem_ctx, *length);
++	if (!buf) {
++		*length = 0;
++		DWC_MUTEX_UNLOCK(cc_if->mutex);
++		return NULL;
++	}
++
++	x = buf;
++	DWC_CIRCLEQ_FOREACH(cc, &cc_if->list, list_entry) {
++		DWC_MEMCPY(x, cc->chid, 16);
++		x += 16;
++		DWC_MEMCPY(x, cc->cdid, 16);
++		x += 16;
++		DWC_MEMCPY(x, cc->ck, 16);
++		x += 16;
++		if (cc->name) {
++			DWC_MEMCPY(x, &cc->length, 1);
++			x += 1;
++			DWC_MEMCPY(x, cc->name, cc->length);
++			x += cc->length;
++		}
++		else {
++			DWC_MEMCPY(x, &zero, 1);
++			x += 1;
++		}
++	}
++	DWC_MUTEX_UNLOCK(cc_if->mutex);
++
++	return buf;
++}
++
++void dwc_cc_restore_from_data(void *mem_ctx, dwc_cc_if_t *cc_if, uint8_t *data, uint32_t length)
++{
++	uint8_t name_length;
++	uint8_t *name;
++	uint8_t *chid;
++	uint8_t *cdid;
++	uint8_t *ck;
++	uint32_t i = 0;
++
++	DWC_MUTEX_LOCK(cc_if->mutex);
++	cc_clear(mem_ctx, cc_if);
++
++	while (i < length) {
++		chid = &data[i];
++		i += 16;
++		cdid = &data[i];
++		i += 16;
++		ck = &data[i];
++		i += 16;
++
++		name_length = data[i];
++		i ++;
++
++		if (name_length) {
++			name = &data[i];
++			i += name_length;
++		}
++		else {
++			name = NULL;
++		}
++
++		/* check to see if we haven't overflown the buffer */
++		if (i > length) {
++			DWC_ERROR("Data format error while attempting to load CCs "
++				  "(nlen=%d, iter=%d, buflen=%d).\n", name_length, i, length);
++			break;
++		}
++
++		cc_add(mem_ctx, cc_if, chid, cdid, ck, name, name_length);
++	}
++	DWC_MUTEX_UNLOCK(cc_if->mutex);
++
++	cc_changed(cc_if);
++}
++
++uint32_t dwc_cc_match_chid(dwc_cc_if_t *cc_if, uint8_t *chid)
++{
++	uint32_t uid = 0;
++
++	DWC_MUTEX_LOCK(cc_if->mutex);
++	uid = cc_match_chid(cc_if, chid);
++	DWC_MUTEX_UNLOCK(cc_if->mutex);
++	return uid;
++}
++uint32_t dwc_cc_match_cdid(dwc_cc_if_t *cc_if, uint8_t *cdid)
++{
++	uint32_t uid = 0;
++
++	DWC_MUTEX_LOCK(cc_if->mutex);
++	uid = cc_match_cdid(cc_if, cdid);
++	DWC_MUTEX_UNLOCK(cc_if->mutex);
++	return uid;
++}
++
++uint8_t *dwc_cc_ck(dwc_cc_if_t *cc_if, int32_t id)
++{
++	uint8_t *ck = NULL;
++	dwc_cc_t *cc;
++
++	DWC_MUTEX_LOCK(cc_if->mutex);
++	cc = cc_find(cc_if, id);
++	if (cc) {
++		ck = cc->ck;
++	}
++	DWC_MUTEX_UNLOCK(cc_if->mutex);
++
++	return ck;
++
++}
++
++uint8_t *dwc_cc_chid(dwc_cc_if_t *cc_if, int32_t id)
++{
++	uint8_t *retval = NULL;
++	dwc_cc_t *cc;
++
++	DWC_MUTEX_LOCK(cc_if->mutex);
++	cc = cc_find(cc_if, id);
++	if (cc) {
++		retval = cc->chid;
++	}
++	DWC_MUTEX_UNLOCK(cc_if->mutex);
++
++	return retval;
++}
++
++uint8_t *dwc_cc_cdid(dwc_cc_if_t *cc_if, int32_t id)
++{
++	uint8_t *retval = NULL;
++	dwc_cc_t *cc;
++
++	DWC_MUTEX_LOCK(cc_if->mutex);
++	cc = cc_find(cc_if, id);
++	if (cc) {
++		retval = cc->cdid;
++	}
++	DWC_MUTEX_UNLOCK(cc_if->mutex);
++
++	return retval;
++}
++
++uint8_t *dwc_cc_name(dwc_cc_if_t *cc_if, int32_t id, uint8_t *length)
++{
++	uint8_t *retval = NULL;
++	dwc_cc_t *cc;
++
++	DWC_MUTEX_LOCK(cc_if->mutex);
++	*length = 0;
++	cc = cc_find(cc_if, id);
++	if (cc) {
++		*length = cc->length;
++		retval = cc->name;
++	}
++	DWC_MUTEX_UNLOCK(cc_if->mutex);
++
++	return retval;
++}
++
++#endif	/* DWC_CCLIB */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_cc.h
+@@ -0,0 +1,224 @@
++/* =========================================================================
++ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_cc.h $
++ * $Revision: #4 $
++ * $Date: 2010/09/28 $
++ * $Change: 1596182 $
++ *
++ * Synopsys Portability Library Software and documentation
++ * (hereinafter, "Software") is an Unsupported proprietary work of
++ * Synopsys, Inc. unless otherwise expressly agreed to in writing
++ * between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product
++ * under any End User Software License Agreement or Agreement for
++ * Licensed Product with Synopsys or any supplement thereto. You are
++ * permitted to use and redistribute this Software in source and binary
++ * forms, with or without modification, provided that redistributions
++ * of source code must retain this notice. You may not view, use,
++ * disclose, copy or distribute this file or any information contained
++ * herein except pursuant to this license grant from Synopsys. If you
++ * do not agree with this notice, including the disclaimer below, then
++ * you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
++ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
++ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
++ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
++ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
++ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================= */
++#ifndef _DWC_CC_H_
++#define _DWC_CC_H_
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++/** @file
++ *
++ * This file defines the Context Context library.
++ *
++ * The main data structure is dwc_cc_if_t which is returned by either the
++ * dwc_cc_if_alloc function or returned by the module to the user via a provided
++ * function. The data structure is opaque and should only be manipulated via the
++ * functions provied in this API.
++ *
++ * It manages a list of connection contexts and operations can be performed to
++ * add, remove, query, search, and change, those contexts.  Additionally,
++ * a dwc_notifier_t object can be requested from the manager so that
++ * the user can be notified whenever the context list has changed.
++ */
++
++#include "dwc_os.h"
++#include "dwc_list.h"
++#include "dwc_notifier.h"
++
++
++/* Notifications */
++#define DWC_CC_LIST_CHANGED_NOTIFICATION "DWC_CC_LIST_CHANGED_NOTIFICATION"
++
++struct dwc_cc_if;
++typedef struct dwc_cc_if dwc_cc_if_t;
++
++
++/** @name Connection Context Operations */
++/** @{ */
++
++/** This function allocates memory for a dwc_cc_if_t structure, initializes
++ * fields to default values, and returns a pointer to the structure or NULL on
++ * error. */
++extern dwc_cc_if_t *dwc_cc_if_alloc(void *mem_ctx, void *mtx_ctx,
++				    dwc_notifier_t *notifier, unsigned is_host);
++
++/** Frees the memory for the specified CC structure allocated from
++ * dwc_cc_if_alloc(). */
++extern void dwc_cc_if_free(void *mem_ctx, void *mtx_ctx, dwc_cc_if_t *cc_if);
++
++/** Removes all contexts from the connection context list */
++extern void dwc_cc_clear(void *mem_ctx, dwc_cc_if_t *cc_if);
++
++/** Adds a connection context (CHID, CK, CDID, Name) to the connection context list.
++ * If a CHID already exists, the CK and name are overwritten.  Statistics are
++ * not overwritten.
++ *
++ * @param cc_if The cc_if structure.
++ * @param chid A pointer to the 16-byte CHID.  This value will be copied.
++ * @param ck A pointer to the 16-byte CK.  This value will be copied.
++ * @param cdid A pointer to the 16-byte CDID.  This value will be copied.
++ * @param name An optional host friendly name as defined in the association model
++ * spec.  Must be a UTF16-LE unicode string.  Can be NULL to indicated no name.
++ * @param length The length othe unicode string.
++ * @return A unique identifier used to refer to this context that is valid for
++ * as long as this context is still in the list. */
++extern int32_t dwc_cc_add(void *mem_ctx, dwc_cc_if_t *cc_if, uint8_t *chid,
++			  uint8_t *cdid, uint8_t *ck, uint8_t *name,
++			  uint8_t length);
++
++/** Changes the CHID, CK, CDID, or Name values of a connection context in the
++ * list, preserving any accumulated statistics.  This would typically be called
++ * if the host decideds to change the context with a SET_CONNECTION request.
++ *
++ * @param cc_if The cc_if structure.
++ * @param id The identifier of the connection context.
++ * @param chid A pointer to the 16-byte CHID.  This value will be copied.  NULL
++ * indicates no change.
++ * @param cdid A pointer to the 16-byte CDID.  This value will be copied.  NULL
++ * indicates no change.
++ * @param ck A pointer to the 16-byte CK.  This value will be copied.  NULL
++ * indicates no change.
++ * @param name Host friendly name UTF16-LE.  NULL indicates no change.
++ * @param length Length of name. */
++extern void dwc_cc_change(void *mem_ctx, dwc_cc_if_t *cc_if, int32_t id,
++			  uint8_t *chid, uint8_t *cdid, uint8_t *ck,
++			  uint8_t *name, uint8_t length);
++
++/** Remove the specified connection context.
++ * @param cc_if The cc_if structure.
++ * @param id The identifier of the connection context to remove. */
++extern void dwc_cc_remove(void *mem_ctx, dwc_cc_if_t *cc_if, int32_t id);
++
++/** Get a binary block of data for the connection context list and attributes.
++ * This data can be used by the OS specific driver to save the connection
++ * context list into non-volatile memory.
++ *
++ * @param cc_if The cc_if structure.
++ * @param length Return the length of the data buffer.
++ * @return A pointer to the data buffer.  The memory for this buffer should be
++ * freed with DWC_FREE() after use. */
++extern uint8_t *dwc_cc_data_for_save(void *mem_ctx, dwc_cc_if_t *cc_if,
++				     unsigned int *length);
++
++/** Restore the connection context list from the binary data that was previously
++ * returned from a call to dwc_cc_data_for_save.  This can be used by the OS specific
++ * driver to load a connection context list from non-volatile memory.
++ *
++ * @param cc_if The cc_if structure.
++ * @param data The data bytes as returned from dwc_cc_data_for_save.
++ * @param length The length of the data. */
++extern void dwc_cc_restore_from_data(void *mem_ctx, dwc_cc_if_t *cc_if,
++				     uint8_t *data, unsigned int length);
++
++/** Find the connection context from the specified CHID.
++ *
++ * @param cc_if The cc_if structure.
++ * @param chid A pointer to the CHID data.
++ * @return A non-zero identifier of the connection context if the CHID matches.
++ * Otherwise returns 0. */
++extern uint32_t dwc_cc_match_chid(dwc_cc_if_t *cc_if, uint8_t *chid);
++
++/** Find the connection context from the specified CDID.
++ *
++ * @param cc_if The cc_if structure.
++ * @param cdid A pointer to the CDID data.
++ * @return A non-zero identifier of the connection context if the CHID matches.
++ * Otherwise returns 0. */
++extern uint32_t dwc_cc_match_cdid(dwc_cc_if_t *cc_if, uint8_t *cdid);
++
++/** Retrieve the CK from the specified connection context.
++ *
++ * @param cc_if The cc_if structure.
++ * @param id The identifier of the connection context.
++ * @return A pointer to the CK data.  The memory does not need to be freed. */
++extern uint8_t *dwc_cc_ck(dwc_cc_if_t *cc_if, int32_t id);
++
++/** Retrieve the CHID from the specified connection context.
++ *
++ * @param cc_if The cc_if structure.
++ * @param id The identifier of the connection context.
++ * @return A pointer to the CHID data.  The memory does not need to be freed. */
++extern uint8_t *dwc_cc_chid(dwc_cc_if_t *cc_if, int32_t id);
++
++/** Retrieve the CDID from the specified connection context.
++ *
++ * @param cc_if The cc_if structure.
++ * @param id The identifier of the connection context.
++ * @return A pointer to the CDID data.  The memory does not need to be freed. */
++extern uint8_t *dwc_cc_cdid(dwc_cc_if_t *cc_if, int32_t id);
++
++extern uint8_t *dwc_cc_name(dwc_cc_if_t *cc_if, int32_t id, uint8_t *length);
++
++/** Checks a buffer for non-zero.
++ * @param id A pointer to a 16 byte buffer.
++ * @return true if the 16 byte value is non-zero. */
++static inline unsigned dwc_assoc_is_not_zero_id(uint8_t *id) {
++	int i;
++	for (i=0; i<16; i++) {
++		if (id[i]) return 1;
++	}
++	return 0;
++}
++
++/** Checks a buffer for zero.
++ * @param id A pointer to a 16 byte buffer.
++ * @return true if the 16 byte value is zero. */
++static inline unsigned dwc_assoc_is_zero_id(uint8_t *id) {
++	return !dwc_assoc_is_not_zero_id(id);
++}
++
++/** Prints an ASCII representation for the 16-byte chid, cdid, or ck, into
++ * buffer. */
++static inline int dwc_print_id_string(char *buffer, uint8_t *id) {
++	char *ptr = buffer;
++	int i;
++	for (i=0; i<16; i++) {
++		ptr += DWC_SPRINTF(ptr, "%02x", id[i]);
++		if (i < 15) {
++			ptr += DWC_SPRINTF(ptr, " ");
++		}
++	}
++	return ptr - buffer;
++}
++
++/** @} */
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* _DWC_CC_H_ */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_common_fbsd.c
+@@ -0,0 +1,1308 @@
++#include "dwc_os.h"
++#include "dwc_list.h"
++
++#ifdef DWC_CCLIB
++# include "dwc_cc.h"
++#endif
++
++#ifdef DWC_CRYPTOLIB
++# include "dwc_modpow.h"
++# include "dwc_dh.h"
++# include "dwc_crypto.h"
++#endif
++
++#ifdef DWC_NOTIFYLIB
++# include "dwc_notifier.h"
++#endif
++
++/* OS-Level Implementations */
++
++/* This is the FreeBSD 7.0 kernel implementation of the DWC platform library. */
++
++
++/* MISC */
++
++void *DWC_MEMSET(void *dest, uint8_t byte, uint32_t size)
++{
++	return memset(dest, byte, size);
++}
++
++void *DWC_MEMCPY(void *dest, void const *src, uint32_t size)
++{
++	return memcpy(dest, src, size);
++}
++
++void *DWC_MEMMOVE(void *dest, void *src, uint32_t size)
++{
++	bcopy(src, dest, size);
++	return dest;
++}
++
++int DWC_MEMCMP(void *m1, void *m2, uint32_t size)
++{
++	return memcmp(m1, m2, size);
++}
++
++int DWC_STRNCMP(void *s1, void *s2, uint32_t size)
++{
++	return strncmp(s1, s2, size);
++}
++
++int DWC_STRCMP(void *s1, void *s2)
++{
++	return strcmp(s1, s2);
++}
++
++int DWC_STRLEN(char const *str)
++{
++	return strlen(str);
++}
++
++char *DWC_STRCPY(char *to, char const *from)
++{
++	return strcpy(to, from);
++}
++
++char *DWC_STRDUP(char const *str)
++{
++	int len = DWC_STRLEN(str) + 1;
++	char *new = DWC_ALLOC_ATOMIC(len);
++
++	if (!new) {
++		return NULL;
++	}
++
++	DWC_MEMCPY(new, str, len);
++	return new;
++}
++
++int DWC_ATOI(char *str, int32_t *value)
++{
++	char *end = NULL;
++
++	*value = strtol(str, &end, 0);
++	if (*end == '\0') {
++		return 0;
++	}
++
++	return -1;
++}
++
++int DWC_ATOUI(char *str, uint32_t *value)
++{
++	char *end = NULL;
++
++	*value = strtoul(str, &end, 0);
++	if (*end == '\0') {
++		return 0;
++	}
++
++	return -1;
++}
++
++
++#ifdef DWC_UTFLIB
++/* From usbstring.c */
++
++int DWC_UTF8_TO_UTF16LE(uint8_t const *s, uint16_t *cp, unsigned len)
++{
++	int	count = 0;
++	u8	c;
++	u16	uchar;
++
++	/* this insists on correct encodings, though not minimal ones.
++	 * BUT it currently rejects legit 4-byte UTF-8 code points,
++	 * which need surrogate pairs.  (Unicode 3.1 can use them.)
++	 */
++	while (len != 0 && (c = (u8) *s++) != 0) {
++		if (unlikely(c & 0x80)) {
++			// 2-byte sequence:
++			// 00000yyyyyxxxxxx = 110yyyyy 10xxxxxx
++			if ((c & 0xe0) == 0xc0) {
++				uchar = (c & 0x1f) << 6;
++
++				c = (u8) *s++;
++				if ((c & 0xc0) != 0xc0)
++					goto fail;
++				c &= 0x3f;
++				uchar |= c;
++
++			// 3-byte sequence (most CJKV characters):
++			// zzzzyyyyyyxxxxxx = 1110zzzz 10yyyyyy 10xxxxxx
++			} else if ((c & 0xf0) == 0xe0) {
++				uchar = (c & 0x0f) << 12;
++
++				c = (u8) *s++;
++				if ((c & 0xc0) != 0xc0)
++					goto fail;
++				c &= 0x3f;
++				uchar |= c << 6;
++
++				c = (u8) *s++;
++				if ((c & 0xc0) != 0xc0)
++					goto fail;
++				c &= 0x3f;
++				uchar |= c;
++
++				/* no bogus surrogates */
++				if (0xd800 <= uchar && uchar <= 0xdfff)
++					goto fail;
++
++			// 4-byte sequence (surrogate pairs, currently rare):
++			// 11101110wwwwzzzzyy + 110111yyyyxxxxxx
++			//     = 11110uuu 10uuzzzz 10yyyyyy 10xxxxxx
++			// (uuuuu = wwww + 1)
++			// FIXME accept the surrogate code points (only)
++			} else
++				goto fail;
++		} else
++			uchar = c;
++		put_unaligned (cpu_to_le16 (uchar), cp++);
++		count++;
++		len--;
++	}
++	return count;
++fail:
++	return -1;
++}
++
++#endif	/* DWC_UTFLIB */
++
++
++/* dwc_debug.h */
++
++dwc_bool_t DWC_IN_IRQ(void)
++{
++//	return in_irq();
++	return 0;
++}
++
++dwc_bool_t DWC_IN_BH(void)
++{
++//	return in_softirq();
++	return 0;
++}
++
++void DWC_VPRINTF(char *format, va_list args)
++{
++	vprintf(format, args);
++}
++
++int DWC_VSNPRINTF(char *str, int size, char *format, va_list args)
++{
++	return vsnprintf(str, size, format, args);
++}
++
++void DWC_PRINTF(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++}
++
++int DWC_SPRINTF(char *buffer, char *format, ...)
++{
++	int retval;
++	va_list args;
++
++	va_start(args, format);
++	retval = vsprintf(buffer, format, args);
++	va_end(args);
++	return retval;
++}
++
++int DWC_SNPRINTF(char *buffer, int size, char *format, ...)
++{
++	int retval;
++	va_list args;
++
++	va_start(args, format);
++	retval = vsnprintf(buffer, size, format, args);
++	va_end(args);
++	return retval;
++}
++
++void __DWC_WARN(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++}
++
++void __DWC_ERROR(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++}
++
++void DWC_EXCEPTION(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++//	BUG_ON(1);	???
++}
++
++#ifdef DEBUG
++void __DWC_DEBUG(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++}
++#endif
++
++
++/* dwc_mem.h */
++
++#if 0
++dwc_pool_t *DWC_DMA_POOL_CREATE(uint32_t size,
++				uint32_t align,
++				uint32_t alloc)
++{
++	struct dma_pool *pool = dma_pool_create("Pool", NULL,
++						size, align, alloc);
++	return (dwc_pool_t *)pool;
++}
++
++void DWC_DMA_POOL_DESTROY(dwc_pool_t *pool)
++{
++	dma_pool_destroy((struct dma_pool *)pool);
++}
++
++void *DWC_DMA_POOL_ALLOC(dwc_pool_t *pool, uint64_t *dma_addr)
++{
++//	return dma_pool_alloc((struct dma_pool *)pool, GFP_KERNEL, dma_addr);
++	return dma_pool_alloc((struct dma_pool *)pool, M_WAITOK, dma_addr);
++}
++
++void *DWC_DMA_POOL_ZALLOC(dwc_pool_t *pool, uint64_t *dma_addr)
++{
++	void *vaddr = DWC_DMA_POOL_ALLOC(pool, dma_addr);
++	memset(..);
++}
++
++void DWC_DMA_POOL_FREE(dwc_pool_t *pool, void *vaddr, void *daddr)
++{
++	dma_pool_free(pool, vaddr, daddr);
++}
++#endif
++
++static void dmamap_cb(void *arg, bus_dma_segment_t *segs, int nseg, int error)
++{
++	if (error)
++		return;
++	*(bus_addr_t *)arg = segs[0].ds_addr;
++}
++
++void *__DWC_DMA_ALLOC(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr)
++{
++	dwc_dmactx_t *dma = (dwc_dmactx_t *)dma_ctx;
++	int error;
++
++	error = bus_dma_tag_create(
++#if __FreeBSD_version >= 700000
++			bus_get_dma_tag(dma->dev),	/* parent */
++#else
++			NULL,				/* parent */
++#endif
++			4, 0,				/* alignment, bounds */
++			BUS_SPACE_MAXADDR_32BIT,	/* lowaddr */
++			BUS_SPACE_MAXADDR,		/* highaddr */
++			NULL, NULL,			/* filter, filterarg */
++			size,				/* maxsize */
++			1,				/* nsegments */
++			size,				/* maxsegsize */
++			0,				/* flags */
++			NULL,				/* lockfunc */
++			NULL,				/* lockarg */
++			&dma->dma_tag);
++	if (error) {
++		device_printf(dma->dev, "%s: bus_dma_tag_create failed: %d\n",
++			      __func__, error);
++		goto fail_0;
++	}
++
++	error = bus_dmamem_alloc(dma->dma_tag, &dma->dma_vaddr,
++				 BUS_DMA_NOWAIT | BUS_DMA_COHERENT, &dma->dma_map);
++	if (error) {
++		device_printf(dma->dev, "%s: bus_dmamem_alloc(%ju) failed: %d\n",
++			      __func__, (uintmax_t)size, error);
++		goto fail_1;
++	}
++
++	dma->dma_paddr = 0;
++	error = bus_dmamap_load(dma->dma_tag, dma->dma_map, dma->dma_vaddr, size,
++				dmamap_cb, &dma->dma_paddr, BUS_DMA_NOWAIT);
++	if (error || dma->dma_paddr == 0) {
++		device_printf(dma->dev, "%s: bus_dmamap_load failed: %d\n",
++			      __func__, error);
++		goto fail_2;
++	}
++
++	*dma_addr = dma->dma_paddr;
++	return dma->dma_vaddr;
++
++fail_2:
++	bus_dmamap_unload(dma->dma_tag, dma->dma_map);
++fail_1:
++	bus_dmamem_free(dma->dma_tag, dma->dma_vaddr, dma->dma_map);
++	bus_dma_tag_destroy(dma->dma_tag);
++fail_0:
++	dma->dma_map = NULL;
++	dma->dma_tag = NULL;
++
++	return NULL;
++}
++
++void __DWC_DMA_FREE(void *dma_ctx, uint32_t size, void *virt_addr, dwc_dma_t dma_addr)
++{
++	dwc_dmactx_t *dma = (dwc_dmactx_t *)dma_ctx;
++
++	if (dma->dma_tag == NULL)
++		return;
++	if (dma->dma_map != NULL) {
++		bus_dmamap_sync(dma->dma_tag, dma->dma_map,
++				BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
++		bus_dmamap_unload(dma->dma_tag, dma->dma_map);
++		bus_dmamem_free(dma->dma_tag, dma->dma_vaddr, dma->dma_map);
++		dma->dma_map = NULL;
++	}
++
++	bus_dma_tag_destroy(dma->dma_tag);
++	dma->dma_tag = NULL;
++}
++
++void *__DWC_ALLOC(void *mem_ctx, uint32_t size)
++{
++	return malloc(size, M_DEVBUF, M_WAITOK | M_ZERO);
++}
++
++void *__DWC_ALLOC_ATOMIC(void *mem_ctx, uint32_t size)
++{
++	return malloc(size, M_DEVBUF, M_NOWAIT | M_ZERO);
++}
++
++void __DWC_FREE(void *mem_ctx, void *addr)
++{
++	free(addr, M_DEVBUF);
++}
++
++
++#ifdef DWC_CRYPTOLIB
++/* dwc_crypto.h */
++
++void DWC_RANDOM_BYTES(uint8_t *buffer, uint32_t length)
++{
++	get_random_bytes(buffer, length);
++}
++
++int DWC_AES_CBC(uint8_t *message, uint32_t messagelen, uint8_t *key, uint32_t keylen, uint8_t iv[16], uint8_t *out)
++{
++	struct crypto_blkcipher *tfm;
++	struct blkcipher_desc desc;
++	struct scatterlist sgd;
++	struct scatterlist sgs;
++
++	tfm = crypto_alloc_blkcipher("cbc(aes)", 0, CRYPTO_ALG_ASYNC);
++	if (tfm == NULL) {
++		printk("failed to load transform for aes CBC\n");
++		return -1;
++	}
++
++	crypto_blkcipher_setkey(tfm, key, keylen);
++	crypto_blkcipher_set_iv(tfm, iv, 16);
++
++	sg_init_one(&sgd, out, messagelen);
++	sg_init_one(&sgs, message, messagelen);
++
++	desc.tfm = tfm;
++	desc.flags = 0;
++
++	if (crypto_blkcipher_encrypt(&desc, &sgd, &sgs, messagelen)) {
++		crypto_free_blkcipher(tfm);
++		DWC_ERROR("AES CBC encryption failed");
++		return -1;
++	}
++
++	crypto_free_blkcipher(tfm);
++	return 0;
++}
++
++int DWC_SHA256(uint8_t *message, uint32_t len, uint8_t *out)
++{
++	struct crypto_hash *tfm;
++	struct hash_desc desc;
++	struct scatterlist sg;
++
++	tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
++	if (IS_ERR(tfm)) {
++		DWC_ERROR("Failed to load transform for sha256: %ld", PTR_ERR(tfm));
++		return 0;
++	}
++	desc.tfm = tfm;
++	desc.flags = 0;
++
++	sg_init_one(&sg, message, len);
++	crypto_hash_digest(&desc, &sg, len, out);
++	crypto_free_hash(tfm);
++
++	return 1;
++}
++
++int DWC_HMAC_SHA256(uint8_t *message, uint32_t messagelen,
++		    uint8_t *key, uint32_t keylen, uint8_t *out)
++{
++	struct crypto_hash *tfm;
++	struct hash_desc desc;
++	struct scatterlist sg;
++
++	tfm = crypto_alloc_hash("hmac(sha256)", 0, CRYPTO_ALG_ASYNC);
++	if (IS_ERR(tfm)) {
++		DWC_ERROR("Failed to load transform for hmac(sha256): %ld", PTR_ERR(tfm));
++		return 0;
++	}
++	desc.tfm = tfm;
++	desc.flags = 0;
++
++	sg_init_one(&sg, message, messagelen);
++	crypto_hash_setkey(tfm, key, keylen);
++	crypto_hash_digest(&desc, &sg, messagelen, out);
++	crypto_free_hash(tfm);
++
++	return 1;
++}
++
++#endif	/* DWC_CRYPTOLIB */
++
++
++/* Byte Ordering Conversions */
++
++uint32_t DWC_CPU_TO_LE32(uint32_t *p)
++{
++#ifdef __LITTLE_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++
++	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
++#endif
++}
++
++uint32_t DWC_CPU_TO_BE32(uint32_t *p)
++{
++#ifdef __BIG_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++
++	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
++#endif
++}
++
++uint32_t DWC_LE32_TO_CPU(uint32_t *p)
++{
++#ifdef __LITTLE_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++
++	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
++#endif
++}
++
++uint32_t DWC_BE32_TO_CPU(uint32_t *p)
++{
++#ifdef __BIG_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++
++	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
++#endif
++}
++
++uint16_t DWC_CPU_TO_LE16(uint16_t *p)
++{
++#ifdef __LITTLE_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++	return (u_p[1] | (u_p[0] << 8));
++#endif
++}
++
++uint16_t DWC_CPU_TO_BE16(uint16_t *p)
++{
++#ifdef __BIG_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++	return (u_p[1] | (u_p[0] << 8));
++#endif
++}
++
++uint16_t DWC_LE16_TO_CPU(uint16_t *p)
++{
++#ifdef __LITTLE_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++	return (u_p[1] | (u_p[0] << 8));
++#endif
++}
++
++uint16_t DWC_BE16_TO_CPU(uint16_t *p)
++{
++#ifdef __BIG_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++	return (u_p[1] | (u_p[0] << 8));
++#endif
++}
++
++
++/* Registers */
++
++uint32_t DWC_READ_REG32(void *io_ctx, uint32_t volatile *reg)
++{
++	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
++	bus_size_t ior = (bus_size_t)reg;
++
++	return bus_space_read_4(io->iot, io->ioh, ior);
++}
++
++#if 0
++uint64_t DWC_READ_REG64(void *io_ctx, uint64_t volatile *reg)
++{
++	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
++	bus_size_t ior = (bus_size_t)reg;
++
++	return bus_space_read_8(io->iot, io->ioh, ior);
++}
++#endif
++
++void DWC_WRITE_REG32(void *io_ctx, uint32_t volatile *reg, uint32_t value)
++{
++	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
++	bus_size_t ior = (bus_size_t)reg;
++
++	bus_space_write_4(io->iot, io->ioh, ior, value);
++}
++
++#if 0
++void DWC_WRITE_REG64(void *io_ctx, uint64_t volatile *reg, uint64_t value)
++{
++	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
++	bus_size_t ior = (bus_size_t)reg;
++
++	bus_space_write_8(io->iot, io->ioh, ior, value);
++}
++#endif
++
++void DWC_MODIFY_REG32(void *io_ctx, uint32_t volatile *reg, uint32_t clear_mask,
++		      uint32_t set_mask)
++{
++	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
++	bus_size_t ior = (bus_size_t)reg;
++
++	bus_space_write_4(io->iot, io->ioh, ior,
++			  (bus_space_read_4(io->iot, io->ioh, ior) &
++			   ~clear_mask) | set_mask);
++}
++
++#if 0
++void DWC_MODIFY_REG64(void *io_ctx, uint64_t volatile *reg, uint64_t clear_mask,
++		      uint64_t set_mask)
++{
++	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
++	bus_size_t ior = (bus_size_t)reg;
++
++	bus_space_write_8(io->iot, io->ioh, ior,
++			  (bus_space_read_8(io->iot, io->ioh, ior) &
++			   ~clear_mask) | set_mask);
++}
++#endif
++
++
++/* Locking */
++
++dwc_spinlock_t *DWC_SPINLOCK_ALLOC(void)
++{
++	struct mtx *sl = DWC_ALLOC(sizeof(*sl));
++
++	if (!sl) {
++		DWC_ERROR("Cannot allocate memory for spinlock");
++		return NULL;
++	}
++
++	mtx_init(sl, "dw3spn", NULL, MTX_SPIN);
++	return (dwc_spinlock_t *)sl;
++}
++
++void DWC_SPINLOCK_FREE(dwc_spinlock_t *lock)
++{
++	struct mtx *sl = (struct mtx *)lock;
++
++	mtx_destroy(sl);
++	DWC_FREE(sl);
++}
++
++void DWC_SPINLOCK(dwc_spinlock_t *lock)
++{
++	mtx_lock_spin((struct mtx *)lock);	// ???
++}
++
++void DWC_SPINUNLOCK(dwc_spinlock_t *lock)
++{
++	mtx_unlock_spin((struct mtx *)lock);	// ???
++}
++
++void DWC_SPINLOCK_IRQSAVE(dwc_spinlock_t *lock, dwc_irqflags_t *flags)
++{
++	mtx_lock_spin((struct mtx *)lock);
++}
++
++void DWC_SPINUNLOCK_IRQRESTORE(dwc_spinlock_t *lock, dwc_irqflags_t flags)
++{
++	mtx_unlock_spin((struct mtx *)lock);
++}
++
++dwc_mutex_t *DWC_MUTEX_ALLOC(void)
++{
++	struct mtx *m;
++	dwc_mutex_t *mutex = (dwc_mutex_t *)DWC_ALLOC(sizeof(struct mtx));
++
++	if (!mutex) {
++		DWC_ERROR("Cannot allocate memory for mutex");
++		return NULL;
++	}
++
++	m = (struct mtx *)mutex;
++	mtx_init(m, "dw3mtx", NULL, MTX_DEF);
++	return mutex;
++}
++
++#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES))
++#else
++void DWC_MUTEX_FREE(dwc_mutex_t *mutex)
++{
++	mtx_destroy((struct mtx *)mutex);
++	DWC_FREE(mutex);
++}
++#endif
++
++void DWC_MUTEX_LOCK(dwc_mutex_t *mutex)
++{
++	struct mtx *m = (struct mtx *)mutex;
++
++	mtx_lock(m);
++}
++
++int DWC_MUTEX_TRYLOCK(dwc_mutex_t *mutex)
++{
++	struct mtx *m = (struct mtx *)mutex;
++
++	return mtx_trylock(m);
++}
++
++void DWC_MUTEX_UNLOCK(dwc_mutex_t *mutex)
++{
++	struct mtx *m = (struct mtx *)mutex;
++
++	mtx_unlock(m);
++}
++
++
++/* Timing */
++
++void DWC_UDELAY(uint32_t usecs)
++{
++	DELAY(usecs);
++}
++
++void DWC_MDELAY(uint32_t msecs)
++{
++	do {
++		DELAY(1000);
++	} while (--msecs);
++}
++
++void DWC_MSLEEP(uint32_t msecs)
++{
++	struct timeval tv;
++
++	tv.tv_sec = msecs / 1000;
++	tv.tv_usec = (msecs - tv.tv_sec * 1000) * 1000;
++	pause("dw3slp", tvtohz(&tv));
++}
++
++uint32_t DWC_TIME(void)
++{
++	struct timeval tv;
++
++	microuptime(&tv);	// or getmicrouptime? (less precise, but faster)
++	return tv.tv_sec * 1000 + tv.tv_usec / 1000;
++}
++
++
++/* Timers */
++
++struct dwc_timer {
++	struct callout t;
++	char *name;
++	dwc_spinlock_t *lock;
++	dwc_timer_callback_t cb;
++	void *data;
++};
++
++dwc_timer_t *DWC_TIMER_ALLOC(char *name, dwc_timer_callback_t cb, void *data)
++{
++	dwc_timer_t *t = DWC_ALLOC(sizeof(*t));
++
++	if (!t) {
++		DWC_ERROR("Cannot allocate memory for timer");
++		return NULL;
++	}
++
++	callout_init(&t->t, 1);
++
++	t->name = DWC_STRDUP(name);
++	if (!t->name) {
++		DWC_ERROR("Cannot allocate memory for timer->name");
++		goto no_name;
++	}
++
++	t->lock = DWC_SPINLOCK_ALLOC();
++	if (!t->lock) {
++		DWC_ERROR("Cannot allocate memory for lock");
++		goto no_lock;
++	}
++
++	t->cb = cb;
++	t->data = data;
++
++	return t;
++
++ no_lock:
++	DWC_FREE(t->name);
++ no_name:
++	DWC_FREE(t);
++
++	return NULL;
++}
++
++void DWC_TIMER_FREE(dwc_timer_t *timer)
++{
++	callout_stop(&timer->t);
++	DWC_SPINLOCK_FREE(timer->lock);
++	DWC_FREE(timer->name);
++	DWC_FREE(timer);
++}
++
++void DWC_TIMER_SCHEDULE(dwc_timer_t *timer, uint32_t time)
++{
++	struct timeval tv;
++
++	tv.tv_sec = time / 1000;
++	tv.tv_usec = (time - tv.tv_sec * 1000) * 1000;
++	callout_reset(&timer->t, tvtohz(&tv), timer->cb, timer->data);
++}
++
++void DWC_TIMER_CANCEL(dwc_timer_t *timer)
++{
++	callout_stop(&timer->t);
++}
++
++
++/* Wait Queues */
++
++struct dwc_waitq {
++	struct mtx lock;
++	int abort;
++};
++
++dwc_waitq_t *DWC_WAITQ_ALLOC(void)
++{
++	dwc_waitq_t *wq = DWC_ALLOC(sizeof(*wq));
++
++	if (!wq) {
++		DWC_ERROR("Cannot allocate memory for waitqueue");
++		return NULL;
++	}
++
++	mtx_init(&wq->lock, "dw3wtq", NULL, MTX_DEF);
++	wq->abort = 0;
++
++	return wq;
++}
++
++void DWC_WAITQ_FREE(dwc_waitq_t *wq)
++{
++	mtx_destroy(&wq->lock);
++	DWC_FREE(wq);
++}
++
++int32_t DWC_WAITQ_WAIT(dwc_waitq_t *wq, dwc_waitq_condition_t cond, void *data)
++{
++//	intrmask_t ipl;
++	int result = 0;
++
++	mtx_lock(&wq->lock);
++//	ipl = splbio();
++
++	/* Skip the sleep if already aborted or triggered */
++	if (!wq->abort && !cond(data)) {
++//		splx(ipl);
++		result = msleep(wq, &wq->lock, PCATCH, "dw3wat", 0); // infinite timeout
++//		ipl = splbio();
++	}
++
++	if (result == ERESTART) {	// signaled - restart
++		result = -DWC_E_RESTART;
++
++	} else if (result == EINTR) {	// signaled - interrupt
++		result = -DWC_E_ABORT;
++
++	} else if (wq->abort) {
++		result = -DWC_E_ABORT;
++
++	} else {
++		result = 0;
++	}
++
++	wq->abort = 0;
++//	splx(ipl);
++	mtx_unlock(&wq->lock);
++	return result;
++}
++
++int32_t DWC_WAITQ_WAIT_TIMEOUT(dwc_waitq_t *wq, dwc_waitq_condition_t cond,
++			       void *data, int32_t msecs)
++{
++	struct timeval tv, tv1, tv2;
++//	intrmask_t ipl;
++	int result = 0;
++
++	tv.tv_sec = msecs / 1000;
++	tv.tv_usec = (msecs - tv.tv_sec * 1000) * 1000;
++
++	mtx_lock(&wq->lock);
++//	ipl = splbio();
++
++	/* Skip the sleep if already aborted or triggered */
++	if (!wq->abort && !cond(data)) {
++//		splx(ipl);
++		getmicrouptime(&tv1);
++		result = msleep(wq, &wq->lock, PCATCH, "dw3wto", tvtohz(&tv));
++		getmicrouptime(&tv2);
++//		ipl = splbio();
++	}
++
++	if (result == 0) {			// awoken
++		if (wq->abort) {
++			result = -DWC_E_ABORT;
++		} else {
++			tv2.tv_usec -= tv1.tv_usec;
++			if (tv2.tv_usec < 0) {
++				tv2.tv_usec += 1000000;
++				tv2.tv_sec--;
++			}
++
++			tv2.tv_sec -= tv1.tv_sec;
++			result = tv2.tv_sec * 1000 + tv2.tv_usec / 1000;
++			result = msecs - result;
++			if (result <= 0)
++				result = 1;
++		}
++	} else if (result == ERESTART) {	// signaled - restart
++		result = -DWC_E_RESTART;
++
++	} else if (result == EINTR) {		// signaled - interrupt
++		result = -DWC_E_ABORT;
++
++	} else {				// timed out
++		result = -DWC_E_TIMEOUT;
++	}
++
++	wq->abort = 0;
++//	splx(ipl);
++	mtx_unlock(&wq->lock);
++	return result;
++}
++
++void DWC_WAITQ_TRIGGER(dwc_waitq_t *wq)
++{
++	wakeup(wq);
++}
++
++void DWC_WAITQ_ABORT(dwc_waitq_t *wq)
++{
++//	intrmask_t ipl;
++
++	mtx_lock(&wq->lock);
++//	ipl = splbio();
++	wq->abort = 1;
++	wakeup(wq);
++//	splx(ipl);
++	mtx_unlock(&wq->lock);
++}
++
++
++/* Threading */
++
++struct dwc_thread {
++	struct proc *proc;
++	int abort;
++};
++
++dwc_thread_t *DWC_THREAD_RUN(dwc_thread_function_t func, char *name, void *data)
++{
++	int retval;
++	dwc_thread_t *thread = DWC_ALLOC(sizeof(*thread));
++
++	if (!thread) {
++		return NULL;
++	}
++
++	thread->abort = 0;
++	retval = kthread_create((void (*)(void *))func, data, &thread->proc,
++				RFPROC | RFNOWAIT, 0, "%s", name);
++	if (retval) {
++		DWC_FREE(thread);
++		return NULL;
++	}
++
++	return thread;
++}
++
++int DWC_THREAD_STOP(dwc_thread_t *thread)
++{
++	int retval;
++
++	thread->abort = 1;
++	retval = tsleep(&thread->abort, 0, "dw3stp", 60 * hz);
++
++	if (retval == 0) {
++		/* DWC_THREAD_EXIT() will free the thread struct */
++		return 0;
++	}
++
++	/* NOTE: We leak the thread struct if thread doesn't die */
++
++	if (retval == EWOULDBLOCK) {
++		return -DWC_E_TIMEOUT;
++	}
++
++	return -DWC_E_UNKNOWN;
++}
++
++dwc_bool_t DWC_THREAD_SHOULD_STOP(dwc_thread_t *thread)
++{
++	return thread->abort;
++}
++
++void DWC_THREAD_EXIT(dwc_thread_t *thread)
++{
++	wakeup(&thread->abort);
++	DWC_FREE(thread);
++	kthread_exit(0);
++}
++
++
++/* tasklets
++ - Runs in interrupt context (cannot sleep)
++ - Each tasklet runs on a single CPU [ How can we ensure this on FreeBSD? Does it matter? ]
++ - Different tasklets can be running simultaneously on different CPUs [ shouldn't matter ]
++ */
++struct dwc_tasklet {
++	struct task t;
++	dwc_tasklet_callback_t cb;
++	void *data;
++};
++
++static void tasklet_callback(void *data, int pending)	// what to do with pending ???
++{
++	dwc_tasklet_t *task = (dwc_tasklet_t *)data;
++
++	task->cb(task->data);
++}
++
++dwc_tasklet_t *DWC_TASK_ALLOC(char *name, dwc_tasklet_callback_t cb, void *data)
++{
++	dwc_tasklet_t *task = DWC_ALLOC(sizeof(*task));
++
++	if (task) {
++		task->cb = cb;
++		task->data = data;
++		TASK_INIT(&task->t, 0, tasklet_callback, task);
++	} else {
++		DWC_ERROR("Cannot allocate memory for tasklet");
++	}
++
++	return task;
++}
++
++void DWC_TASK_FREE(dwc_tasklet_t *task)
++{
++	taskqueue_drain(taskqueue_fast, &task->t);	// ???
++	DWC_FREE(task);
++}
++
++void DWC_TASK_SCHEDULE(dwc_tasklet_t *task)
++{
++	/* Uses predefined system queue */
++	taskqueue_enqueue_fast(taskqueue_fast, &task->t);
++}
++
++
++/* workqueues
++ - Runs in process context (can sleep)
++ */
++typedef struct work_container {
++	dwc_work_callback_t cb;
++	void *data;
++	dwc_workq_t *wq;
++	char *name;
++	int hz;
++
++#ifdef DEBUG
++	DWC_CIRCLEQ_ENTRY(work_container) entry;
++#endif
++	struct task task;
++} work_container_t;
++
++#ifdef DEBUG
++DWC_CIRCLEQ_HEAD(work_container_queue, work_container);
++#endif
++
++struct dwc_workq {
++	struct taskqueue *taskq;
++	dwc_spinlock_t *lock;
++	dwc_waitq_t *waitq;
++	int pending;
++
++#ifdef DEBUG
++	struct work_container_queue entries;
++#endif
++};
++
++static void do_work(void *data, int pending)	// what to do with pending ???
++{
++	work_container_t *container = (work_container_t *)data;
++	dwc_workq_t *wq = container->wq;
++	dwc_irqflags_t flags;
++
++	if (container->hz) {
++		pause("dw3wrk", container->hz);
++	}
++
++	container->cb(container->data);
++	DWC_DEBUG("Work done: %s, container=%p", container->name, container);
++
++	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
++
++#ifdef DEBUG
++	DWC_CIRCLEQ_REMOVE(&wq->entries, container, entry);
++#endif
++	if (container->name)
++		DWC_FREE(container->name);
++	DWC_FREE(container);
++	wq->pending--;
++	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
++	DWC_WAITQ_TRIGGER(wq->waitq);
++}
++
++static int work_done(void *data)
++{
++	dwc_workq_t *workq = (dwc_workq_t *)data;
++
++	return workq->pending == 0;
++}
++
++int DWC_WORKQ_WAIT_WORK_DONE(dwc_workq_t *workq, int timeout)
++{
++	return DWC_WAITQ_WAIT_TIMEOUT(workq->waitq, work_done, workq, timeout);
++}
++
++dwc_workq_t *DWC_WORKQ_ALLOC(char *name)
++{
++	dwc_workq_t *wq = DWC_ALLOC(sizeof(*wq));
++
++	if (!wq) {
++		DWC_ERROR("Cannot allocate memory for workqueue");
++		return NULL;
++	}
++
++	wq->taskq = taskqueue_create(name, M_NOWAIT, taskqueue_thread_enqueue, &wq->taskq);
++	if (!wq->taskq) {
++		DWC_ERROR("Cannot allocate memory for taskqueue");
++		goto no_taskq;
++	}
++
++	wq->pending = 0;
++
++	wq->lock = DWC_SPINLOCK_ALLOC();
++	if (!wq->lock) {
++		DWC_ERROR("Cannot allocate memory for spinlock");
++		goto no_lock;
++	}
++
++	wq->waitq = DWC_WAITQ_ALLOC();
++	if (!wq->waitq) {
++		DWC_ERROR("Cannot allocate memory for waitqueue");
++		goto no_waitq;
++	}
++
++	taskqueue_start_threads(&wq->taskq, 1, PWAIT, "%s taskq", "dw3tsk");
++
++#ifdef DEBUG
++	DWC_CIRCLEQ_INIT(&wq->entries);
++#endif
++	return wq;
++
++ no_waitq:
++	DWC_SPINLOCK_FREE(wq->lock);
++ no_lock:
++	taskqueue_free(wq->taskq);
++ no_taskq:
++	DWC_FREE(wq);
++
++	return NULL;
++}
++
++void DWC_WORKQ_FREE(dwc_workq_t *wq)
++{
++#ifdef DEBUG
++	dwc_irqflags_t flags;
++
++	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
++
++	if (wq->pending != 0) {
++		struct work_container *container;
++
++		DWC_ERROR("Destroying work queue with pending work");
++
++		DWC_CIRCLEQ_FOREACH(container, &wq->entries, entry) {
++			DWC_ERROR("Work %s still pending", container->name);
++		}
++	}
++
++	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
++#endif
++	DWC_WAITQ_FREE(wq->waitq);
++	DWC_SPINLOCK_FREE(wq->lock);
++	taskqueue_free(wq->taskq);
++	DWC_FREE(wq);
++}
++
++void DWC_WORKQ_SCHEDULE(dwc_workq_t *wq, dwc_work_callback_t cb, void *data,
++			char *format, ...)
++{
++	dwc_irqflags_t flags;
++	work_container_t *container;
++	static char name[128];
++	va_list args;
++
++	va_start(args, format);
++	DWC_VSNPRINTF(name, 128, format, args);
++	va_end(args);
++
++	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
++	wq->pending++;
++	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
++	DWC_WAITQ_TRIGGER(wq->waitq);
++
++	container = DWC_ALLOC_ATOMIC(sizeof(*container));
++	if (!container) {
++		DWC_ERROR("Cannot allocate memory for container");
++		return;
++	}
++
++	container->name = DWC_STRDUP(name);
++	if (!container->name) {
++		DWC_ERROR("Cannot allocate memory for container->name");
++		DWC_FREE(container);
++		return;
++	}
++
++	container->cb = cb;
++	container->data = data;
++	container->wq = wq;
++	container->hz = 0;
++
++	DWC_DEBUG("Queueing work: %s, container=%p", container->name, container);
++
++	TASK_INIT(&container->task, 0, do_work, container);
++
++#ifdef DEBUG
++	DWC_CIRCLEQ_INSERT_TAIL(&wq->entries, container, entry);
++#endif
++	taskqueue_enqueue_fast(wq->taskq, &container->task);
++}
++
++void DWC_WORKQ_SCHEDULE_DELAYED(dwc_workq_t *wq, dwc_work_callback_t cb,
++				void *data, uint32_t time, char *format, ...)
++{
++	dwc_irqflags_t flags;
++	work_container_t *container;
++	static char name[128];
++	struct timeval tv;
++	va_list args;
++
++	va_start(args, format);
++	DWC_VSNPRINTF(name, 128, format, args);
++	va_end(args);
++
++	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
++	wq->pending++;
++	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
++	DWC_WAITQ_TRIGGER(wq->waitq);
++
++	container = DWC_ALLOC_ATOMIC(sizeof(*container));
++	if (!container) {
++		DWC_ERROR("Cannot allocate memory for container");
++		return;
++	}
++
++	container->name = DWC_STRDUP(name);
++	if (!container->name) {
++		DWC_ERROR("Cannot allocate memory for container->name");
++		DWC_FREE(container);
++		return;
++	}
++
++	container->cb = cb;
++	container->data = data;
++	container->wq = wq;
++
++	tv.tv_sec = time / 1000;
++	tv.tv_usec = (time - tv.tv_sec * 1000) * 1000;
++	container->hz = tvtohz(&tv);
++
++	DWC_DEBUG("Queueing work: %s, container=%p", container->name, container);
++
++	TASK_INIT(&container->task, 0, do_work, container);
++
++#ifdef DEBUG
++	DWC_CIRCLEQ_INSERT_TAIL(&wq->entries, container, entry);
++#endif
++	taskqueue_enqueue_fast(wq->taskq, &container->task);
++}
++
++int DWC_WORKQ_PENDING(dwc_workq_t *wq)
++{
++	return wq->pending;
++}
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_common_linux.c
+@@ -0,0 +1,1409 @@
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/kthread.h>
++
++#ifdef DWC_CCLIB
++# include "dwc_cc.h"
++#endif
++
++#ifdef DWC_CRYPTOLIB
++# include "dwc_modpow.h"
++# include "dwc_dh.h"
++# include "dwc_crypto.h"
++#endif
++
++#ifdef DWC_NOTIFYLIB
++# include "dwc_notifier.h"
++#endif
++
++/* OS-Level Implementations */
++
++/* This is the Linux kernel implementation of the DWC platform library. */
++#include <linux/moduleparam.h>
++#include <linux/ctype.h>
++#include <linux/crypto.h>
++#include <linux/delay.h>
++#include <linux/device.h>
++#include <linux/dma-mapping.h>
++#include <linux/cdev.h>
++#include <linux/errno.h>
++#include <linux/interrupt.h>
++#include <linux/jiffies.h>
++#include <linux/list.h>
++#include <linux/pci.h>
++#include <linux/random.h>
++#include <linux/scatterlist.h>
++#include <linux/slab.h>
++#include <linux/stat.h>
++#include <linux/string.h>
++#include <linux/timer.h>
++#include <linux/usb.h>
++
++#include <linux/version.h>
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24)
++# include <linux/usb/gadget.h>
++#else
++# include <linux/usb_gadget.h>
++#endif
++
++#include <asm/io.h>
++#include <asm/page.h>
++#include <asm/uaccess.h>
++#include <linux/unaligned.h>
++
++#include "dwc_os.h"
++#include "dwc_list.h"
++
++
++/* MISC */
++
++void *DWC_MEMSET(void *dest, uint8_t byte, uint32_t size)
++{
++	return memset(dest, byte, size);
++}
++
++void *DWC_MEMCPY(void *dest, void const *src, uint32_t size)
++{
++	return memcpy(dest, src, size);
++}
++
++void *DWC_MEMMOVE(void *dest, void *src, uint32_t size)
++{
++	return memmove(dest, src, size);
++}
++
++int DWC_MEMCMP(void *m1, void *m2, uint32_t size)
++{
++	return memcmp(m1, m2, size);
++}
++
++int DWC_STRNCMP(void *s1, void *s2, uint32_t size)
++{
++	return strncmp(s1, s2, size);
++}
++
++int DWC_STRCMP(void *s1, void *s2)
++{
++	return strcmp(s1, s2);
++}
++
++int DWC_STRLEN(char const *str)
++{
++	return strlen(str);
++}
++
++char *DWC_STRCPY(char *to, char const *from)
++{
++	return strcpy(to, from);
++}
++
++char *DWC_STRDUP(char const *str)
++{
++	int len = DWC_STRLEN(str) + 1;
++	char *new = DWC_ALLOC_ATOMIC(len);
++
++	if (!new) {
++		return NULL;
++	}
++
++	DWC_MEMCPY(new, str, len);
++	return new;
++}
++
++int DWC_ATOI(const char *str, int32_t *value)
++{
++	char *end = NULL;
++
++	*value = simple_strtol(str, &end, 0);
++	if (*end == '\0') {
++		return 0;
++	}
++
++	return -1;
++}
++
++int DWC_ATOUI(const char *str, uint32_t *value)
++{
++	char *end = NULL;
++
++	*value = simple_strtoul(str, &end, 0);
++	if (*end == '\0') {
++		return 0;
++	}
++
++	return -1;
++}
++
++
++#ifdef DWC_UTFLIB
++/* From usbstring.c */
++
++int DWC_UTF8_TO_UTF16LE(uint8_t const *s, uint16_t *cp, unsigned len)
++{
++	int	count = 0;
++	u8	c;
++	u16	uchar;
++
++	/* this insists on correct encodings, though not minimal ones.
++	 * BUT it currently rejects legit 4-byte UTF-8 code points,
++	 * which need surrogate pairs.  (Unicode 3.1 can use them.)
++	 */
++	while (len != 0 && (c = (u8) *s++) != 0) {
++		if (unlikely(c & 0x80)) {
++			// 2-byte sequence:
++			// 00000yyyyyxxxxxx = 110yyyyy 10xxxxxx
++			if ((c & 0xe0) == 0xc0) {
++				uchar = (c & 0x1f) << 6;
++
++				c = (u8) *s++;
++				if ((c & 0xc0) != 0xc0)
++					goto fail;
++				c &= 0x3f;
++				uchar |= c;
++
++			// 3-byte sequence (most CJKV characters):
++			// zzzzyyyyyyxxxxxx = 1110zzzz 10yyyyyy 10xxxxxx
++			} else if ((c & 0xf0) == 0xe0) {
++				uchar = (c & 0x0f) << 12;
++
++				c = (u8) *s++;
++				if ((c & 0xc0) != 0xc0)
++					goto fail;
++				c &= 0x3f;
++				uchar |= c << 6;
++
++				c = (u8) *s++;
++				if ((c & 0xc0) != 0xc0)
++					goto fail;
++				c &= 0x3f;
++				uchar |= c;
++
++				/* no bogus surrogates */
++				if (0xd800 <= uchar && uchar <= 0xdfff)
++					goto fail;
++
++			// 4-byte sequence (surrogate pairs, currently rare):
++			// 11101110wwwwzzzzyy + 110111yyyyxxxxxx
++			//     = 11110uuu 10uuzzzz 10yyyyyy 10xxxxxx
++			// (uuuuu = wwww + 1)
++			// FIXME accept the surrogate code points (only)
++			} else
++				goto fail;
++		} else
++			uchar = c;
++		put_unaligned (cpu_to_le16 (uchar), cp++);
++		count++;
++		len--;
++	}
++	return count;
++fail:
++	return -1;
++}
++#endif	/* DWC_UTFLIB */
++
++
++/* dwc_debug.h */
++
++dwc_bool_t DWC_IN_IRQ(void)
++{
++	return in_irq();
++}
++
++dwc_bool_t DWC_IN_BH(void)
++{
++	return in_softirq();
++}
++
++void DWC_VPRINTF(char *format, va_list args)
++{
++	vprintk(format, args);
++}
++
++int DWC_VSNPRINTF(char *str, int size, char *format, va_list args)
++{
++	return vsnprintf(str, size, format, args);
++}
++
++void DWC_PRINTF(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++}
++
++int DWC_SPRINTF(char *buffer, char *format, ...)
++{
++	int retval;
++	va_list args;
++
++	va_start(args, format);
++	retval = vsprintf(buffer, format, args);
++	va_end(args);
++	return retval;
++}
++
++int DWC_SNPRINTF(char *buffer, int size, char *format, ...)
++{
++	int retval;
++	va_list args;
++
++	va_start(args, format);
++	retval = vsnprintf(buffer, size, format, args);
++	va_end(args);
++	return retval;
++}
++
++void __DWC_WARN(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_PRINTF(KERN_WARNING);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++}
++
++void __DWC_ERROR(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_PRINTF(KERN_ERR);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++}
++
++void DWC_EXCEPTION(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_PRINTF(KERN_ERR);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++	BUG_ON(1);
++}
++
++#ifdef DEBUG
++void __DWC_DEBUG(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_PRINTF(KERN_DEBUG);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++}
++#endif
++
++
++/* dwc_mem.h */
++
++#if 0
++dwc_pool_t *DWC_DMA_POOL_CREATE(uint32_t size,
++				uint32_t align,
++				uint32_t alloc)
++{
++	struct dma_pool *pool = dma_pool_create("Pool", NULL,
++						size, align, alloc);
++	return (dwc_pool_t *)pool;
++}
++
++void DWC_DMA_POOL_DESTROY(dwc_pool_t *pool)
++{
++	dma_pool_destroy((struct dma_pool *)pool);
++}
++
++void *DWC_DMA_POOL_ALLOC(dwc_pool_t *pool, uint64_t *dma_addr)
++{
++	return dma_pool_alloc((struct dma_pool *)pool, GFP_KERNEL, dma_addr);
++}
++
++void *DWC_DMA_POOL_ZALLOC(dwc_pool_t *pool, uint64_t *dma_addr)
++{
++	void *vaddr = DWC_DMA_POOL_ALLOC(pool, dma_addr);
++	memset(..);
++}
++
++void DWC_DMA_POOL_FREE(dwc_pool_t *pool, void *vaddr, void *daddr)
++{
++	dma_pool_free(pool, vaddr, daddr);
++}
++#endif
++
++void *__DWC_DMA_ALLOC(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr)
++{
++	return dma_alloc_coherent(dma_ctx, size, dma_addr, GFP_KERNEL | GFP_DMA32);
++}
++
++void *__DWC_DMA_ALLOC_ATOMIC(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr)
++{
++	return dma_alloc_coherent(dma_ctx, size, dma_addr, GFP_ATOMIC);
++}
++
++void __DWC_DMA_FREE(void *dma_ctx, uint32_t size, void *virt_addr, dwc_dma_t dma_addr)
++{
++	dma_free_coherent(dma_ctx, size, virt_addr, dma_addr);
++}
++
++void *__DWC_ALLOC(void *mem_ctx, uint32_t size)
++{
++	return kzalloc(size, GFP_KERNEL);
++}
++
++void *__DWC_ALLOC_ATOMIC(void *mem_ctx, uint32_t size)
++{
++	return kzalloc(size, GFP_ATOMIC);
++}
++
++void __DWC_FREE(void *mem_ctx, void *addr)
++{
++	kfree(addr);
++}
++
++
++#ifdef DWC_CRYPTOLIB
++/* dwc_crypto.h */
++
++void DWC_RANDOM_BYTES(uint8_t *buffer, uint32_t length)
++{
++	get_random_bytes(buffer, length);
++}
++
++int DWC_AES_CBC(uint8_t *message, uint32_t messagelen, uint8_t *key, uint32_t keylen, uint8_t iv[16], uint8_t *out)
++{
++	struct crypto_blkcipher *tfm;
++	struct blkcipher_desc desc;
++	struct scatterlist sgd;
++	struct scatterlist sgs;
++
++	tfm = crypto_alloc_blkcipher("cbc(aes)", 0, CRYPTO_ALG_ASYNC);
++	if (tfm == NULL) {
++		printk("failed to load transform for aes CBC\n");
++		return -1;
++	}
++
++	crypto_blkcipher_setkey(tfm, key, keylen);
++	crypto_blkcipher_set_iv(tfm, iv, 16);
++
++	sg_init_one(&sgd, out, messagelen);
++	sg_init_one(&sgs, message, messagelen);
++
++	desc.tfm = tfm;
++	desc.flags = 0;
++
++	if (crypto_blkcipher_encrypt(&desc, &sgd, &sgs, messagelen)) {
++		crypto_free_blkcipher(tfm);
++		DWC_ERROR("AES CBC encryption failed");
++		return -1;
++	}
++
++	crypto_free_blkcipher(tfm);
++	return 0;
++}
++
++int DWC_SHA256(uint8_t *message, uint32_t len, uint8_t *out)
++{
++	struct crypto_hash *tfm;
++	struct hash_desc desc;
++	struct scatterlist sg;
++
++	tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
++	if (IS_ERR(tfm)) {
++		DWC_ERROR("Failed to load transform for sha256: %ld\n", PTR_ERR(tfm));
++		return 0;
++	}
++	desc.tfm = tfm;
++	desc.flags = 0;
++
++	sg_init_one(&sg, message, len);
++	crypto_hash_digest(&desc, &sg, len, out);
++	crypto_free_hash(tfm);
++
++	return 1;
++}
++
++int DWC_HMAC_SHA256(uint8_t *message, uint32_t messagelen,
++		    uint8_t *key, uint32_t keylen, uint8_t *out)
++{
++	struct crypto_hash *tfm;
++	struct hash_desc desc;
++	struct scatterlist sg;
++
++	tfm = crypto_alloc_hash("hmac(sha256)", 0, CRYPTO_ALG_ASYNC);
++	if (IS_ERR(tfm)) {
++		DWC_ERROR("Failed to load transform for hmac(sha256): %ld\n", PTR_ERR(tfm));
++		return 0;
++	}
++	desc.tfm = tfm;
++	desc.flags = 0;
++
++	sg_init_one(&sg, message, messagelen);
++	crypto_hash_setkey(tfm, key, keylen);
++	crypto_hash_digest(&desc, &sg, messagelen, out);
++	crypto_free_hash(tfm);
++
++	return 1;
++}
++#endif	/* DWC_CRYPTOLIB */
++
++
++/* Byte Ordering Conversions */
++
++uint32_t DWC_CPU_TO_LE32(uint32_t *p)
++{
++#ifdef __LITTLE_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++
++	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
++#endif
++}
++
++uint32_t DWC_CPU_TO_BE32(uint32_t *p)
++{
++#ifdef __BIG_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++
++	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
++#endif
++}
++
++uint32_t DWC_LE32_TO_CPU(uint32_t *p)
++{
++#ifdef __LITTLE_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++
++	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
++#endif
++}
++
++uint32_t DWC_BE32_TO_CPU(uint32_t *p)
++{
++#ifdef __BIG_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++
++	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
++#endif
++}
++
++uint16_t DWC_CPU_TO_LE16(uint16_t *p)
++{
++#ifdef __LITTLE_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++	return (u_p[1] | (u_p[0] << 8));
++#endif
++}
++
++uint16_t DWC_CPU_TO_BE16(uint16_t *p)
++{
++#ifdef __BIG_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++	return (u_p[1] | (u_p[0] << 8));
++#endif
++}
++
++uint16_t DWC_LE16_TO_CPU(uint16_t *p)
++{
++#ifdef __LITTLE_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++	return (u_p[1] | (u_p[0] << 8));
++#endif
++}
++
++uint16_t DWC_BE16_TO_CPU(uint16_t *p)
++{
++#ifdef __BIG_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++	return (u_p[1] | (u_p[0] << 8));
++#endif
++}
++
++
++/* Registers */
++
++uint32_t DWC_READ_REG32(uint32_t volatile *reg)
++{
++	return readl(reg);
++}
++
++#if 0
++uint64_t DWC_READ_REG64(uint64_t volatile *reg)
++{
++}
++#endif
++
++void DWC_WRITE_REG32(uint32_t volatile *reg, uint32_t value)
++{
++	writel(value, reg);
++}
++
++#if 0
++void DWC_WRITE_REG64(uint64_t volatile *reg, uint64_t value)
++{
++}
++#endif
++
++void DWC_MODIFY_REG32(uint32_t volatile *reg, uint32_t clear_mask, uint32_t set_mask)
++{
++	writel((readl(reg) & ~clear_mask) | set_mask, reg);
++}
++
++#if 0
++void DWC_MODIFY_REG64(uint64_t volatile *reg, uint64_t clear_mask, uint64_t set_mask)
++{
++}
++#endif
++
++
++/* Locking */
++
++dwc_spinlock_t *DWC_SPINLOCK_ALLOC(void)
++{
++	spinlock_t *sl = (spinlock_t *)1;
++
++#if defined(CONFIG_PREEMPT) || defined(CONFIG_SMP)
++	sl = DWC_ALLOC(sizeof(*sl));
++	if (!sl) {
++		DWC_ERROR("Cannot allocate memory for spinlock\n");
++		return NULL;
++	}
++
++	spin_lock_init(sl);
++#endif
++	return (dwc_spinlock_t *)sl;
++}
++
++void DWC_SPINLOCK_FREE(dwc_spinlock_t *lock)
++{
++#if defined(CONFIG_PREEMPT) || defined(CONFIG_SMP)
++	DWC_FREE(lock);
++#endif
++}
++
++void DWC_SPINLOCK(dwc_spinlock_t *lock)
++{
++#if defined(CONFIG_PREEMPT) || defined(CONFIG_SMP)
++	spin_lock((spinlock_t *)lock);
++#endif
++}
++
++void DWC_SPINUNLOCK(dwc_spinlock_t *lock)
++{
++#if defined(CONFIG_PREEMPT) || defined(CONFIG_SMP)
++	spin_unlock((spinlock_t *)lock);
++#endif
++}
++
++void DWC_SPINLOCK_IRQSAVE(dwc_spinlock_t *lock, dwc_irqflags_t *flags)
++{
++	dwc_irqflags_t f;
++
++#if defined(CONFIG_PREEMPT) || defined(CONFIG_SMP)
++	spin_lock_irqsave((spinlock_t *)lock, f);
++#else
++	local_irq_save(f);
++#endif
++	*flags = f;
++}
++
++void DWC_SPINUNLOCK_IRQRESTORE(dwc_spinlock_t *lock, dwc_irqflags_t flags)
++{
++#if defined(CONFIG_PREEMPT) || defined(CONFIG_SMP)
++	spin_unlock_irqrestore((spinlock_t *)lock, flags);
++#else
++	local_irq_restore(flags);
++#endif
++}
++
++dwc_mutex_t *DWC_MUTEX_ALLOC(void)
++{
++	struct mutex *m;
++	dwc_mutex_t *mutex = (dwc_mutex_t *)DWC_ALLOC(sizeof(struct mutex));
++
++	if (!mutex) {
++		DWC_ERROR("Cannot allocate memory for mutex\n");
++		return NULL;
++	}
++
++	m = (struct mutex *)mutex;
++	mutex_init(m);
++	return mutex;
++}
++
++#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES))
++#else
++void DWC_MUTEX_FREE(dwc_mutex_t *mutex)
++{
++	mutex_destroy((struct mutex *)mutex);
++	DWC_FREE(mutex);
++}
++#endif
++
++void DWC_MUTEX_LOCK(dwc_mutex_t *mutex)
++{
++	struct mutex *m = (struct mutex *)mutex;
++	mutex_lock(m);
++}
++
++int DWC_MUTEX_TRYLOCK(dwc_mutex_t *mutex)
++{
++	struct mutex *m = (struct mutex *)mutex;
++	return mutex_trylock(m);
++}
++
++void DWC_MUTEX_UNLOCK(dwc_mutex_t *mutex)
++{
++	struct mutex *m = (struct mutex *)mutex;
++	mutex_unlock(m);
++}
++
++
++/* Timing */
++
++void DWC_UDELAY(uint32_t usecs)
++{
++	udelay(usecs);
++}
++
++void DWC_MDELAY(uint32_t msecs)
++{
++	mdelay(msecs);
++}
++
++void DWC_MSLEEP(uint32_t msecs)
++{
++	msleep(msecs);
++}
++
++uint32_t DWC_TIME(void)
++{
++	return jiffies_to_msecs(jiffies);
++}
++
++
++/* Timers */
++
++struct dwc_timer {
++	struct timer_list t;
++	char *name;
++	dwc_timer_callback_t cb;
++	void *data;
++	uint8_t scheduled;
++	dwc_spinlock_t *lock;
++};
++
++static void timer_callback(struct timer_list *tt)
++{
++	dwc_timer_t *timer = from_timer(timer, tt, t);
++	dwc_irqflags_t flags;
++
++	DWC_SPINLOCK_IRQSAVE(timer->lock, &flags);
++	timer->scheduled = 0;
++	DWC_SPINUNLOCK_IRQRESTORE(timer->lock, flags);
++	DWC_DEBUGC("Timer %s callback", timer->name);
++	timer->cb(timer->data);
++}
++
++dwc_timer_t *DWC_TIMER_ALLOC(char *name, dwc_timer_callback_t cb, void *data)
++{
++	dwc_timer_t *t = DWC_ALLOC(sizeof(*t));
++
++	if (!t) {
++		DWC_ERROR("Cannot allocate memory for timer");
++		return NULL;
++	}
++
++	t->name = DWC_STRDUP(name);
++	if (!t->name) {
++		DWC_ERROR("Cannot allocate memory for timer->name");
++		goto no_name;
++	}
++
++#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_SPINLOCK))
++	DWC_SPINLOCK_ALLOC_LINUX_DEBUG(t->lock);
++#else
++	t->lock = DWC_SPINLOCK_ALLOC();
++#endif
++	if (!t->lock) {
++		DWC_ERROR("Cannot allocate memory for lock");
++		goto no_lock;
++	}
++
++	t->scheduled = 0;
++	t->t.expires = jiffies;
++	timer_setup(&t->t, timer_callback, 0);
++
++	t->cb = cb;
++	t->data = data;
++
++	return t;
++
++ no_lock:
++	DWC_FREE(t->name);
++ no_name:
++	DWC_FREE(t);
++	return NULL;
++}
++
++void DWC_TIMER_FREE(dwc_timer_t *timer)
++{
++	dwc_irqflags_t flags;
++
++	DWC_SPINLOCK_IRQSAVE(timer->lock, &flags);
++
++	if (timer->scheduled) {
++		del_timer(&timer->t);
++		timer->scheduled = 0;
++	}
++
++	DWC_SPINUNLOCK_IRQRESTORE(timer->lock, flags);
++	DWC_SPINLOCK_FREE(timer->lock);
++	DWC_FREE(timer->name);
++	DWC_FREE(timer);
++}
++
++void DWC_TIMER_SCHEDULE(dwc_timer_t *timer, uint32_t time)
++{
++	dwc_irqflags_t flags;
++
++	DWC_SPINLOCK_IRQSAVE(timer->lock, &flags);
++
++	if (!timer->scheduled) {
++		timer->scheduled = 1;
++		DWC_DEBUGC("Scheduling timer %s to expire in +%d msec", timer->name, time);
++		timer->t.expires = jiffies + msecs_to_jiffies(time);
++		add_timer(&timer->t);
++	} else {
++		DWC_DEBUGC("Modifying timer %s to expire in +%d msec", timer->name, time);
++		mod_timer(&timer->t, jiffies + msecs_to_jiffies(time));
++	}
++
++	DWC_SPINUNLOCK_IRQRESTORE(timer->lock, flags);
++}
++
++void DWC_TIMER_CANCEL(dwc_timer_t *timer)
++{
++	del_timer(&timer->t);
++}
++
++
++/* Wait Queues */
++
++struct dwc_waitq {
++	wait_queue_head_t queue;
++	int abort;
++};
++
++dwc_waitq_t *DWC_WAITQ_ALLOC(void)
++{
++	dwc_waitq_t *wq = DWC_ALLOC(sizeof(*wq));
++
++	if (!wq) {
++		DWC_ERROR("Cannot allocate memory for waitqueue\n");
++		return NULL;
++	}
++
++	init_waitqueue_head(&wq->queue);
++	wq->abort = 0;
++	return wq;
++}
++
++void DWC_WAITQ_FREE(dwc_waitq_t *wq)
++{
++	DWC_FREE(wq);
++}
++
++int32_t DWC_WAITQ_WAIT(dwc_waitq_t *wq, dwc_waitq_condition_t cond, void *data)
++{
++	int result = wait_event_interruptible(wq->queue,
++					      cond(data) || wq->abort);
++	if (result == -ERESTARTSYS) {
++		wq->abort = 0;
++		return -DWC_E_RESTART;
++	}
++
++	if (wq->abort == 1) {
++		wq->abort = 0;
++		return -DWC_E_ABORT;
++	}
++
++	wq->abort = 0;
++
++	if (result == 0) {
++		return 0;
++	}
++
++	return -DWC_E_UNKNOWN;
++}
++
++int32_t DWC_WAITQ_WAIT_TIMEOUT(dwc_waitq_t *wq, dwc_waitq_condition_t cond,
++			       void *data, int32_t msecs)
++{
++	int32_t tmsecs;
++	int result = wait_event_interruptible_timeout(wq->queue,
++						      cond(data) || wq->abort,
++						      msecs_to_jiffies(msecs));
++	if (result == -ERESTARTSYS) {
++		wq->abort = 0;
++		return -DWC_E_RESTART;
++	}
++
++	if (wq->abort == 1) {
++		wq->abort = 0;
++		return -DWC_E_ABORT;
++	}
++
++	wq->abort = 0;
++
++	if (result > 0) {
++		tmsecs = jiffies_to_msecs(result);
++		if (!tmsecs) {
++			return 1;
++		}
++
++		return tmsecs;
++	}
++
++	if (result == 0) {
++		return -DWC_E_TIMEOUT;
++	}
++
++	return -DWC_E_UNKNOWN;
++}
++
++void DWC_WAITQ_TRIGGER(dwc_waitq_t *wq)
++{
++	wq->abort = 0;
++	wake_up_interruptible(&wq->queue);
++}
++
++void DWC_WAITQ_ABORT(dwc_waitq_t *wq)
++{
++	wq->abort = 1;
++	wake_up_interruptible(&wq->queue);
++}
++
++
++/* Threading */
++
++dwc_thread_t *DWC_THREAD_RUN(dwc_thread_function_t func, char *name, void *data)
++{
++	struct task_struct *thread = kthread_run(func, data, name);
++
++	if (thread == ERR_PTR(-ENOMEM)) {
++		return NULL;
++	}
++
++	return (dwc_thread_t *)thread;
++}
++
++int DWC_THREAD_STOP(dwc_thread_t *thread)
++{
++	return kthread_stop((struct task_struct *)thread);
++}
++
++dwc_bool_t DWC_THREAD_SHOULD_STOP(void)
++{
++	return kthread_should_stop();
++}
++
++
++/* tasklets
++ - run in interrupt context (cannot sleep)
++ - each tasklet runs on a single CPU
++ - different tasklets can be running simultaneously on different CPUs
++ */
++struct dwc_tasklet {
++	struct tasklet_struct t;
++	dwc_tasklet_callback_t cb;
++	void *data;
++};
++
++static void tasklet_callback(unsigned long data)
++{
++	dwc_tasklet_t *t = (dwc_tasklet_t *)data;
++	t->cb(t->data);
++}
++
++dwc_tasklet_t *DWC_TASK_ALLOC(char *name, dwc_tasklet_callback_t cb, void *data)
++{
++	dwc_tasklet_t *t = DWC_ALLOC(sizeof(*t));
++
++	if (t) {
++		t->cb = cb;
++		t->data = data;
++		tasklet_init(&t->t, tasklet_callback, (unsigned long)t);
++	} else {
++		DWC_ERROR("Cannot allocate memory for tasklet\n");
++	}
++
++	return t;
++}
++
++void DWC_TASK_FREE(dwc_tasklet_t *task)
++{
++	DWC_FREE(task);
++}
++
++void DWC_TASK_SCHEDULE(dwc_tasklet_t *task)
++{
++	tasklet_schedule(&task->t);
++}
++
++void DWC_TASK_HI_SCHEDULE(dwc_tasklet_t *task)
++{
++	tasklet_hi_schedule(&task->t);
++}
++
++
++/* workqueues
++ - run in process context (can sleep)
++ */
++typedef struct work_container {
++	dwc_work_callback_t cb;
++	void *data;
++	dwc_workq_t *wq;
++	char *name;
++
++#ifdef DEBUG
++	DWC_CIRCLEQ_ENTRY(work_container) entry;
++#endif
++	struct delayed_work work;
++} work_container_t;
++
++#ifdef DEBUG
++DWC_CIRCLEQ_HEAD(work_container_queue, work_container);
++#endif
++
++struct dwc_workq {
++	struct workqueue_struct *wq;
++	dwc_spinlock_t *lock;
++	dwc_waitq_t *waitq;
++	int pending;
++
++#ifdef DEBUG
++	struct work_container_queue entries;
++#endif
++};
++
++static void do_work(struct work_struct *work)
++{
++	dwc_irqflags_t flags;
++	struct delayed_work *dw = container_of(work, struct delayed_work, work);
++	work_container_t *container = container_of(dw, struct work_container, work);
++	dwc_workq_t *wq = container->wq;
++
++	container->cb(container->data);
++
++#ifdef DEBUG
++	DWC_CIRCLEQ_REMOVE(&wq->entries, container, entry);
++#endif
++	DWC_DEBUGC("Work done: %s, container=%p", container->name, container);
++	if (container->name) {
++		DWC_FREE(container->name);
++	}
++	DWC_FREE(container);
++
++	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
++	wq->pending--;
++	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
++	DWC_WAITQ_TRIGGER(wq->waitq);
++}
++
++static int work_done(void *data)
++{
++	dwc_workq_t *workq = (dwc_workq_t *)data;
++	return workq->pending == 0;
++}
++
++int DWC_WORKQ_WAIT_WORK_DONE(dwc_workq_t *workq, int timeout)
++{
++	return DWC_WAITQ_WAIT_TIMEOUT(workq->waitq, work_done, workq, timeout);
++}
++
++dwc_workq_t *DWC_WORKQ_ALLOC(char *name)
++{
++	dwc_workq_t *wq = DWC_ALLOC(sizeof(*wq));
++
++	if (!wq) {
++		return NULL;
++	}
++
++	wq->wq = create_singlethread_workqueue(name);
++	if (!wq->wq) {
++		goto no_wq;
++	}
++
++	wq->pending = 0;
++
++#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_SPINLOCK))
++	DWC_SPINLOCK_ALLOC_LINUX_DEBUG(wq->lock);
++#else
++	wq->lock = DWC_SPINLOCK_ALLOC();
++#endif
++	if (!wq->lock) {
++		goto no_lock;
++	}
++
++	wq->waitq = DWC_WAITQ_ALLOC();
++	if (!wq->waitq) {
++		goto no_waitq;
++	}
++
++#ifdef DEBUG
++	DWC_CIRCLEQ_INIT(&wq->entries);
++#endif
++	return wq;
++
++ no_waitq:
++	DWC_SPINLOCK_FREE(wq->lock);
++ no_lock:
++	destroy_workqueue(wq->wq);
++ no_wq:
++	DWC_FREE(wq);
++
++	return NULL;
++}
++
++void DWC_WORKQ_FREE(dwc_workq_t *wq)
++{
++#ifdef DEBUG
++	if (wq->pending != 0) {
++		struct work_container *wc;
++		DWC_ERROR("Destroying work queue with pending work");
++		DWC_CIRCLEQ_FOREACH(wc, &wq->entries, entry) {
++			DWC_ERROR("Work %s still pending", wc->name);
++		}
++	}
++#endif
++	destroy_workqueue(wq->wq);
++	DWC_SPINLOCK_FREE(wq->lock);
++	DWC_WAITQ_FREE(wq->waitq);
++	DWC_FREE(wq);
++}
++
++void DWC_WORKQ_SCHEDULE(dwc_workq_t *wq, dwc_work_callback_t cb, void *data,
++			char *format, ...)
++{
++	dwc_irqflags_t flags;
++	work_container_t *container;
++	static char name[128];
++	va_list args;
++
++	va_start(args, format);
++	DWC_VSNPRINTF(name, 128, format, args);
++	va_end(args);
++
++	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
++	wq->pending++;
++	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
++	DWC_WAITQ_TRIGGER(wq->waitq);
++
++	container = DWC_ALLOC_ATOMIC(sizeof(*container));
++	if (!container) {
++		DWC_ERROR("Cannot allocate memory for container\n");
++		return;
++	}
++
++	container->name = DWC_STRDUP(name);
++	if (!container->name) {
++		DWC_ERROR("Cannot allocate memory for container->name\n");
++		DWC_FREE(container);
++		return;
++	}
++
++	container->cb = cb;
++	container->data = data;
++	container->wq = wq;
++	DWC_DEBUGC("Queueing work: %s, container=%p", container->name, container);
++	INIT_WORK(&container->work.work, do_work);
++
++#ifdef DEBUG
++	DWC_CIRCLEQ_INSERT_TAIL(&wq->entries, container, entry);
++#endif
++	queue_work(wq->wq, &container->work.work);
++}
++
++void DWC_WORKQ_SCHEDULE_DELAYED(dwc_workq_t *wq, dwc_work_callback_t cb,
++				void *data, uint32_t time, char *format, ...)
++{
++	dwc_irqflags_t flags;
++	work_container_t *container;
++	static char name[128];
++	va_list args;
++
++	va_start(args, format);
++	DWC_VSNPRINTF(name, 128, format, args);
++	va_end(args);
++
++	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
++	wq->pending++;
++	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
++	DWC_WAITQ_TRIGGER(wq->waitq);
++
++	container = DWC_ALLOC_ATOMIC(sizeof(*container));
++	if (!container) {
++		DWC_ERROR("Cannot allocate memory for container\n");
++		return;
++	}
++
++	container->name = DWC_STRDUP(name);
++	if (!container->name) {
++		DWC_ERROR("Cannot allocate memory for container->name\n");
++		DWC_FREE(container);
++		return;
++	}
++
++	container->cb = cb;
++	container->data = data;
++	container->wq = wq;
++	DWC_DEBUGC("Queueing work: %s, container=%p", container->name, container);
++	INIT_DELAYED_WORK(&container->work, do_work);
++
++#ifdef DEBUG
++	DWC_CIRCLEQ_INSERT_TAIL(&wq->entries, container, entry);
++#endif
++	queue_delayed_work(wq->wq, &container->work, msecs_to_jiffies(time));
++}
++
++int DWC_WORKQ_PENDING(dwc_workq_t *wq)
++{
++	return wq->pending;
++}
++
++
++#ifdef DWC_LIBMODULE
++
++#ifdef DWC_CCLIB
++/* CC */
++EXPORT_SYMBOL(dwc_cc_if_alloc);
++EXPORT_SYMBOL(dwc_cc_if_free);
++EXPORT_SYMBOL(dwc_cc_clear);
++EXPORT_SYMBOL(dwc_cc_add);
++EXPORT_SYMBOL(dwc_cc_remove);
++EXPORT_SYMBOL(dwc_cc_change);
++EXPORT_SYMBOL(dwc_cc_data_for_save);
++EXPORT_SYMBOL(dwc_cc_restore_from_data);
++EXPORT_SYMBOL(dwc_cc_match_chid);
++EXPORT_SYMBOL(dwc_cc_match_cdid);
++EXPORT_SYMBOL(dwc_cc_ck);
++EXPORT_SYMBOL(dwc_cc_chid);
++EXPORT_SYMBOL(dwc_cc_cdid);
++EXPORT_SYMBOL(dwc_cc_name);
++#endif	/* DWC_CCLIB */
++
++#ifdef DWC_CRYPTOLIB
++# ifndef CONFIG_MACH_IPMATE
++/* Modpow */
++EXPORT_SYMBOL(dwc_modpow);
++
++/* DH */
++EXPORT_SYMBOL(dwc_dh_modpow);
++EXPORT_SYMBOL(dwc_dh_derive_keys);
++EXPORT_SYMBOL(dwc_dh_pk);
++# endif	/* CONFIG_MACH_IPMATE */
++
++/* Crypto */
++EXPORT_SYMBOL(dwc_wusb_aes_encrypt);
++EXPORT_SYMBOL(dwc_wusb_cmf);
++EXPORT_SYMBOL(dwc_wusb_prf);
++EXPORT_SYMBOL(dwc_wusb_fill_ccm_nonce);
++EXPORT_SYMBOL(dwc_wusb_gen_nonce);
++EXPORT_SYMBOL(dwc_wusb_gen_key);
++EXPORT_SYMBOL(dwc_wusb_gen_mic);
++#endif	/* DWC_CRYPTOLIB */
++
++/* Notification */
++#ifdef DWC_NOTIFYLIB
++EXPORT_SYMBOL(dwc_alloc_notification_manager);
++EXPORT_SYMBOL(dwc_free_notification_manager);
++EXPORT_SYMBOL(dwc_register_notifier);
++EXPORT_SYMBOL(dwc_unregister_notifier);
++EXPORT_SYMBOL(dwc_add_observer);
++EXPORT_SYMBOL(dwc_remove_observer);
++EXPORT_SYMBOL(dwc_notify);
++#endif
++
++/* Memory Debugging Routines */
++#ifdef DWC_DEBUG_MEMORY
++EXPORT_SYMBOL(dwc_alloc_debug);
++EXPORT_SYMBOL(dwc_alloc_atomic_debug);
++EXPORT_SYMBOL(dwc_free_debug);
++EXPORT_SYMBOL(dwc_dma_alloc_debug);
++EXPORT_SYMBOL(dwc_dma_free_debug);
++#endif
++
++EXPORT_SYMBOL(DWC_MEMSET);
++EXPORT_SYMBOL(DWC_MEMCPY);
++EXPORT_SYMBOL(DWC_MEMMOVE);
++EXPORT_SYMBOL(DWC_MEMCMP);
++EXPORT_SYMBOL(DWC_STRNCMP);
++EXPORT_SYMBOL(DWC_STRCMP);
++EXPORT_SYMBOL(DWC_STRLEN);
++EXPORT_SYMBOL(DWC_STRCPY);
++EXPORT_SYMBOL(DWC_STRDUP);
++EXPORT_SYMBOL(DWC_ATOI);
++EXPORT_SYMBOL(DWC_ATOUI);
++
++#ifdef DWC_UTFLIB
++EXPORT_SYMBOL(DWC_UTF8_TO_UTF16LE);
++#endif	/* DWC_UTFLIB */
++
++EXPORT_SYMBOL(DWC_IN_IRQ);
++EXPORT_SYMBOL(DWC_IN_BH);
++EXPORT_SYMBOL(DWC_VPRINTF);
++EXPORT_SYMBOL(DWC_VSNPRINTF);
++EXPORT_SYMBOL(DWC_PRINTF);
++EXPORT_SYMBOL(DWC_SPRINTF);
++EXPORT_SYMBOL(DWC_SNPRINTF);
++EXPORT_SYMBOL(__DWC_WARN);
++EXPORT_SYMBOL(__DWC_ERROR);
++EXPORT_SYMBOL(DWC_EXCEPTION);
++
++#ifdef DEBUG
++EXPORT_SYMBOL(__DWC_DEBUG);
++#endif
++
++EXPORT_SYMBOL(__DWC_DMA_ALLOC);
++EXPORT_SYMBOL(__DWC_DMA_ALLOC_ATOMIC);
++EXPORT_SYMBOL(__DWC_DMA_FREE);
++EXPORT_SYMBOL(__DWC_ALLOC);
++EXPORT_SYMBOL(__DWC_ALLOC_ATOMIC);
++EXPORT_SYMBOL(__DWC_FREE);
++
++#ifdef DWC_CRYPTOLIB
++EXPORT_SYMBOL(DWC_RANDOM_BYTES);
++EXPORT_SYMBOL(DWC_AES_CBC);
++EXPORT_SYMBOL(DWC_SHA256);
++EXPORT_SYMBOL(DWC_HMAC_SHA256);
++#endif
++
++EXPORT_SYMBOL(DWC_CPU_TO_LE32);
++EXPORT_SYMBOL(DWC_CPU_TO_BE32);
++EXPORT_SYMBOL(DWC_LE32_TO_CPU);
++EXPORT_SYMBOL(DWC_BE32_TO_CPU);
++EXPORT_SYMBOL(DWC_CPU_TO_LE16);
++EXPORT_SYMBOL(DWC_CPU_TO_BE16);
++EXPORT_SYMBOL(DWC_LE16_TO_CPU);
++EXPORT_SYMBOL(DWC_BE16_TO_CPU);
++EXPORT_SYMBOL(DWC_READ_REG32);
++EXPORT_SYMBOL(DWC_WRITE_REG32);
++EXPORT_SYMBOL(DWC_MODIFY_REG32);
++
++#if 0
++EXPORT_SYMBOL(DWC_READ_REG64);
++EXPORT_SYMBOL(DWC_WRITE_REG64);
++EXPORT_SYMBOL(DWC_MODIFY_REG64);
++#endif
++
++EXPORT_SYMBOL(DWC_SPINLOCK_ALLOC);
++EXPORT_SYMBOL(DWC_SPINLOCK_FREE);
++EXPORT_SYMBOL(DWC_SPINLOCK);
++EXPORT_SYMBOL(DWC_SPINUNLOCK);
++EXPORT_SYMBOL(DWC_SPINLOCK_IRQSAVE);
++EXPORT_SYMBOL(DWC_SPINUNLOCK_IRQRESTORE);
++EXPORT_SYMBOL(DWC_MUTEX_ALLOC);
++
++#if (!defined(DWC_LINUX) || !defined(CONFIG_DEBUG_MUTEXES))
++EXPORT_SYMBOL(DWC_MUTEX_FREE);
++#endif
++
++EXPORT_SYMBOL(DWC_MUTEX_LOCK);
++EXPORT_SYMBOL(DWC_MUTEX_TRYLOCK);
++EXPORT_SYMBOL(DWC_MUTEX_UNLOCK);
++EXPORT_SYMBOL(DWC_UDELAY);
++EXPORT_SYMBOL(DWC_MDELAY);
++EXPORT_SYMBOL(DWC_MSLEEP);
++EXPORT_SYMBOL(DWC_TIME);
++EXPORT_SYMBOL(DWC_TIMER_ALLOC);
++EXPORT_SYMBOL(DWC_TIMER_FREE);
++EXPORT_SYMBOL(DWC_TIMER_SCHEDULE);
++EXPORT_SYMBOL(DWC_TIMER_CANCEL);
++EXPORT_SYMBOL(DWC_WAITQ_ALLOC);
++EXPORT_SYMBOL(DWC_WAITQ_FREE);
++EXPORT_SYMBOL(DWC_WAITQ_WAIT);
++EXPORT_SYMBOL(DWC_WAITQ_WAIT_TIMEOUT);
++EXPORT_SYMBOL(DWC_WAITQ_TRIGGER);
++EXPORT_SYMBOL(DWC_WAITQ_ABORT);
++EXPORT_SYMBOL(DWC_THREAD_RUN);
++EXPORT_SYMBOL(DWC_THREAD_STOP);
++EXPORT_SYMBOL(DWC_THREAD_SHOULD_STOP);
++EXPORT_SYMBOL(DWC_TASK_ALLOC);
++EXPORT_SYMBOL(DWC_TASK_FREE);
++EXPORT_SYMBOL(DWC_TASK_SCHEDULE);
++EXPORT_SYMBOL(DWC_WORKQ_WAIT_WORK_DONE);
++EXPORT_SYMBOL(DWC_WORKQ_ALLOC);
++EXPORT_SYMBOL(DWC_WORKQ_FREE);
++EXPORT_SYMBOL(DWC_WORKQ_SCHEDULE);
++EXPORT_SYMBOL(DWC_WORKQ_SCHEDULE_DELAYED);
++EXPORT_SYMBOL(DWC_WORKQ_PENDING);
++
++static int dwc_common_port_init_module(void)
++{
++	int result = 0;
++
++	printk(KERN_DEBUG "Module dwc_common_port init\n" );
++
++#ifdef DWC_DEBUG_MEMORY
++	result = dwc_memory_debug_start(NULL);
++	if (result) {
++		printk(KERN_ERR
++		       "dwc_memory_debug_start() failed with error %d\n",
++		       result);
++		return result;
++	}
++#endif
++
++#ifdef DWC_NOTIFYLIB
++	result = dwc_alloc_notification_manager(NULL, NULL);
++	if (result) {
++		printk(KERN_ERR
++		       "dwc_alloc_notification_manager() failed with error %d\n",
++		       result);
++		return result;
++	}
++#endif
++	return result;
++}
++
++static void dwc_common_port_exit_module(void)
++{
++	printk(KERN_DEBUG "Module dwc_common_port exit\n" );
++
++#ifdef DWC_NOTIFYLIB
++	dwc_free_notification_manager();
++#endif
++
++#ifdef DWC_DEBUG_MEMORY
++	dwc_memory_debug_stop();
++#endif
++}
++
++module_init(dwc_common_port_init_module);
++module_exit(dwc_common_port_exit_module);
++
++MODULE_DESCRIPTION("DWC Common Library - Portable version");
++MODULE_AUTHOR("Synopsys Inc.");
++MODULE_LICENSE ("GPL");
++
++#endif	/* DWC_LIBMODULE */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_common_nbsd.c
+@@ -0,0 +1,1275 @@
++#include "dwc_os.h"
++#include "dwc_list.h"
++
++#ifdef DWC_CCLIB
++# include "dwc_cc.h"
++#endif
++
++#ifdef DWC_CRYPTOLIB
++# include "dwc_modpow.h"
++# include "dwc_dh.h"
++# include "dwc_crypto.h"
++#endif
++
++#ifdef DWC_NOTIFYLIB
++# include "dwc_notifier.h"
++#endif
++
++/* OS-Level Implementations */
++
++/* This is the NetBSD 4.0.1 kernel implementation of the DWC platform library. */
++
++
++/* MISC */
++
++void *DWC_MEMSET(void *dest, uint8_t byte, uint32_t size)
++{
++	return memset(dest, byte, size);
++}
++
++void *DWC_MEMCPY(void *dest, void const *src, uint32_t size)
++{
++	return memcpy(dest, src, size);
++}
++
++void *DWC_MEMMOVE(void *dest, void *src, uint32_t size)
++{
++	bcopy(src, dest, size);
++	return dest;
++}
++
++int DWC_MEMCMP(void *m1, void *m2, uint32_t size)
++{
++	return memcmp(m1, m2, size);
++}
++
++int DWC_STRNCMP(void *s1, void *s2, uint32_t size)
++{
++	return strncmp(s1, s2, size);
++}
++
++int DWC_STRCMP(void *s1, void *s2)
++{
++	return strcmp(s1, s2);
++}
++
++int DWC_STRLEN(char const *str)
++{
++	return strlen(str);
++}
++
++char *DWC_STRCPY(char *to, char const *from)
++{
++	return strcpy(to, from);
++}
++
++char *DWC_STRDUP(char const *str)
++{
++	int len = DWC_STRLEN(str) + 1;
++	char *new = DWC_ALLOC_ATOMIC(len);
++
++	if (!new) {
++		return NULL;
++	}
++
++	DWC_MEMCPY(new, str, len);
++	return new;
++}
++
++int DWC_ATOI(char *str, int32_t *value)
++{
++	char *end = NULL;
++
++	/* NetBSD doesn't have 'strtol' in the kernel, but 'strtoul'
++	 * should be equivalent on 2's complement machines
++	 */
++	*value = strtoul(str, &end, 0);
++	if (*end == '\0') {
++		return 0;
++	}
++
++	return -1;
++}
++
++int DWC_ATOUI(char *str, uint32_t *value)
++{
++	char *end = NULL;
++
++	*value = strtoul(str, &end, 0);
++	if (*end == '\0') {
++		return 0;
++	}
++
++	return -1;
++}
++
++
++#ifdef DWC_UTFLIB
++/* From usbstring.c */
++
++int DWC_UTF8_TO_UTF16LE(uint8_t const *s, uint16_t *cp, unsigned len)
++{
++	int	count = 0;
++	u8	c;
++	u16	uchar;
++
++	/* this insists on correct encodings, though not minimal ones.
++	 * BUT it currently rejects legit 4-byte UTF-8 code points,
++	 * which need surrogate pairs.  (Unicode 3.1 can use them.)
++	 */
++	while (len != 0 && (c = (u8) *s++) != 0) {
++		if (unlikely(c & 0x80)) {
++			// 2-byte sequence:
++			// 00000yyyyyxxxxxx = 110yyyyy 10xxxxxx
++			if ((c & 0xe0) == 0xc0) {
++				uchar = (c & 0x1f) << 6;
++
++				c = (u8) *s++;
++				if ((c & 0xc0) != 0xc0)
++					goto fail;
++				c &= 0x3f;
++				uchar |= c;
++
++			// 3-byte sequence (most CJKV characters):
++			// zzzzyyyyyyxxxxxx = 1110zzzz 10yyyyyy 10xxxxxx
++			} else if ((c & 0xf0) == 0xe0) {
++				uchar = (c & 0x0f) << 12;
++
++				c = (u8) *s++;
++				if ((c & 0xc0) != 0xc0)
++					goto fail;
++				c &= 0x3f;
++				uchar |= c << 6;
++
++				c = (u8) *s++;
++				if ((c & 0xc0) != 0xc0)
++					goto fail;
++				c &= 0x3f;
++				uchar |= c;
++
++				/* no bogus surrogates */
++				if (0xd800 <= uchar && uchar <= 0xdfff)
++					goto fail;
++
++			// 4-byte sequence (surrogate pairs, currently rare):
++			// 11101110wwwwzzzzyy + 110111yyyyxxxxxx
++			//     = 11110uuu 10uuzzzz 10yyyyyy 10xxxxxx
++			// (uuuuu = wwww + 1)
++			// FIXME accept the surrogate code points (only)
++			} else
++				goto fail;
++		} else
++			uchar = c;
++		put_unaligned (cpu_to_le16 (uchar), cp++);
++		count++;
++		len--;
++	}
++	return count;
++fail:
++	return -1;
++}
++
++#endif	/* DWC_UTFLIB */
++
++
++/* dwc_debug.h */
++
++dwc_bool_t DWC_IN_IRQ(void)
++{
++//	return in_irq();
++	return 0;
++}
++
++dwc_bool_t DWC_IN_BH(void)
++{
++//	return in_softirq();
++	return 0;
++}
++
++void DWC_VPRINTF(char *format, va_list args)
++{
++	vprintf(format, args);
++}
++
++int DWC_VSNPRINTF(char *str, int size, char *format, va_list args)
++{
++	return vsnprintf(str, size, format, args);
++}
++
++void DWC_PRINTF(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++}
++
++int DWC_SPRINTF(char *buffer, char *format, ...)
++{
++	int retval;
++	va_list args;
++
++	va_start(args, format);
++	retval = vsprintf(buffer, format, args);
++	va_end(args);
++	return retval;
++}
++
++int DWC_SNPRINTF(char *buffer, int size, char *format, ...)
++{
++	int retval;
++	va_list args;
++
++	va_start(args, format);
++	retval = vsnprintf(buffer, size, format, args);
++	va_end(args);
++	return retval;
++}
++
++void __DWC_WARN(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++}
++
++void __DWC_ERROR(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++}
++
++void DWC_EXCEPTION(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++//	BUG_ON(1);	???
++}
++
++#ifdef DEBUG
++void __DWC_DEBUG(char *format, ...)
++{
++	va_list args;
++
++	va_start(args, format);
++	DWC_VPRINTF(format, args);
++	va_end(args);
++}
++#endif
++
++
++/* dwc_mem.h */
++
++#if 0
++dwc_pool_t *DWC_DMA_POOL_CREATE(uint32_t size,
++				uint32_t align,
++				uint32_t alloc)
++{
++	struct dma_pool *pool = dma_pool_create("Pool", NULL,
++						size, align, alloc);
++	return (dwc_pool_t *)pool;
++}
++
++void DWC_DMA_POOL_DESTROY(dwc_pool_t *pool)
++{
++	dma_pool_destroy((struct dma_pool *)pool);
++}
++
++void *DWC_DMA_POOL_ALLOC(dwc_pool_t *pool, uint64_t *dma_addr)
++{
++//	return dma_pool_alloc((struct dma_pool *)pool, GFP_KERNEL, dma_addr);
++	return dma_pool_alloc((struct dma_pool *)pool, M_WAITOK, dma_addr);
++}
++
++void *DWC_DMA_POOL_ZALLOC(dwc_pool_t *pool, uint64_t *dma_addr)
++{
++	void *vaddr = DWC_DMA_POOL_ALLOC(pool, dma_addr);
++	memset(..);
++}
++
++void DWC_DMA_POOL_FREE(dwc_pool_t *pool, void *vaddr, void *daddr)
++{
++	dma_pool_free(pool, vaddr, daddr);
++}
++#endif
++
++void *__DWC_DMA_ALLOC(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr)
++{
++	dwc_dmactx_t *dma = (dwc_dmactx_t *)dma_ctx;
++	int error;
++
++	error = bus_dmamem_alloc(dma->dma_tag, size, 1, size, dma->segs,
++				 sizeof(dma->segs) / sizeof(dma->segs[0]),
++				 &dma->nsegs, BUS_DMA_NOWAIT);
++	if (error) {
++		printf("%s: bus_dmamem_alloc(%ju) failed: %d\n", __func__,
++		       (uintmax_t)size, error);
++		goto fail_0;
++	}
++
++	error = bus_dmamem_map(dma->dma_tag, dma->segs, dma->nsegs, size,
++			       (caddr_t *)&dma->dma_vaddr,
++			       BUS_DMA_NOWAIT | BUS_DMA_COHERENT);
++	if (error) {
++		printf("%s: bus_dmamem_map failed: %d\n", __func__, error);
++		goto fail_1;
++	}
++
++	error = bus_dmamap_create(dma->dma_tag, size, 1, size, 0,
++				  BUS_DMA_NOWAIT, &dma->dma_map);
++	if (error) {
++		printf("%s: bus_dmamap_create failed: %d\n", __func__, error);
++		goto fail_2;
++	}
++
++	error = bus_dmamap_load(dma->dma_tag, dma->dma_map, dma->dma_vaddr,
++				size, NULL, BUS_DMA_NOWAIT);
++	if (error) {
++		printf("%s: bus_dmamap_load failed: %d\n", __func__, error);
++		goto fail_3;
++	}
++
++	dma->dma_paddr = (bus_addr_t)dma->segs[0].ds_addr;
++	*dma_addr = dma->dma_paddr;
++	return dma->dma_vaddr;
++
++fail_3:
++	bus_dmamap_destroy(dma->dma_tag, dma->dma_map);
++fail_2:
++	bus_dmamem_unmap(dma->dma_tag, dma->dma_vaddr, size);
++fail_1:
++	bus_dmamem_free(dma->dma_tag, dma->segs, dma->nsegs);
++fail_0:
++	dma->dma_map = NULL;
++	dma->dma_vaddr = NULL;
++	dma->nsegs = 0;
++
++	return NULL;
++}
++
++void __DWC_DMA_FREE(void *dma_ctx, uint32_t size, void *virt_addr, dwc_dma_t dma_addr)
++{
++	dwc_dmactx_t *dma = (dwc_dmactx_t *)dma_ctx;
++
++	if (dma->dma_map != NULL) {
++		bus_dmamap_sync(dma->dma_tag, dma->dma_map, 0, size,
++				BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
++		bus_dmamap_unload(dma->dma_tag, dma->dma_map);
++		bus_dmamap_destroy(dma->dma_tag, dma->dma_map);
++		bus_dmamem_unmap(dma->dma_tag, dma->dma_vaddr, size);
++		bus_dmamem_free(dma->dma_tag, dma->segs, dma->nsegs);
++		dma->dma_paddr = 0;
++		dma->dma_map = NULL;
++		dma->dma_vaddr = NULL;
++		dma->nsegs = 0;
++	}
++}
++
++void *__DWC_ALLOC(void *mem_ctx, uint32_t size)
++{
++	return malloc(size, M_DEVBUF, M_WAITOK | M_ZERO);
++}
++
++void *__DWC_ALLOC_ATOMIC(void *mem_ctx, uint32_t size)
++{
++	return malloc(size, M_DEVBUF, M_NOWAIT | M_ZERO);
++}
++
++void __DWC_FREE(void *mem_ctx, void *addr)
++{
++	free(addr, M_DEVBUF);
++}
++
++
++#ifdef DWC_CRYPTOLIB
++/* dwc_crypto.h */
++
++void DWC_RANDOM_BYTES(uint8_t *buffer, uint32_t length)
++{
++	get_random_bytes(buffer, length);
++}
++
++int DWC_AES_CBC(uint8_t *message, uint32_t messagelen, uint8_t *key, uint32_t keylen, uint8_t iv[16], uint8_t *out)
++{
++	struct crypto_blkcipher *tfm;
++	struct blkcipher_desc desc;
++	struct scatterlist sgd;
++	struct scatterlist sgs;
++
++	tfm = crypto_alloc_blkcipher("cbc(aes)", 0, CRYPTO_ALG_ASYNC);
++	if (tfm == NULL) {
++		printk("failed to load transform for aes CBC\n");
++		return -1;
++	}
++
++	crypto_blkcipher_setkey(tfm, key, keylen);
++	crypto_blkcipher_set_iv(tfm, iv, 16);
++
++	sg_init_one(&sgd, out, messagelen);
++	sg_init_one(&sgs, message, messagelen);
++
++	desc.tfm = tfm;
++	desc.flags = 0;
++
++	if (crypto_blkcipher_encrypt(&desc, &sgd, &sgs, messagelen)) {
++		crypto_free_blkcipher(tfm);
++		DWC_ERROR("AES CBC encryption failed");
++		return -1;
++	}
++
++	crypto_free_blkcipher(tfm);
++	return 0;
++}
++
++int DWC_SHA256(uint8_t *message, uint32_t len, uint8_t *out)
++{
++	struct crypto_hash *tfm;
++	struct hash_desc desc;
++	struct scatterlist sg;
++
++	tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
++	if (IS_ERR(tfm)) {
++		DWC_ERROR("Failed to load transform for sha256: %ld", PTR_ERR(tfm));
++		return 0;
++	}
++	desc.tfm = tfm;
++	desc.flags = 0;
++
++	sg_init_one(&sg, message, len);
++	crypto_hash_digest(&desc, &sg, len, out);
++	crypto_free_hash(tfm);
++
++	return 1;
++}
++
++int DWC_HMAC_SHA256(uint8_t *message, uint32_t messagelen,
++		    uint8_t *key, uint32_t keylen, uint8_t *out)
++{
++	struct crypto_hash *tfm;
++	struct hash_desc desc;
++	struct scatterlist sg;
++
++	tfm = crypto_alloc_hash("hmac(sha256)", 0, CRYPTO_ALG_ASYNC);
++	if (IS_ERR(tfm)) {
++		DWC_ERROR("Failed to load transform for hmac(sha256): %ld", PTR_ERR(tfm));
++		return 0;
++	}
++	desc.tfm = tfm;
++	desc.flags = 0;
++
++	sg_init_one(&sg, message, messagelen);
++	crypto_hash_setkey(tfm, key, keylen);
++	crypto_hash_digest(&desc, &sg, messagelen, out);
++	crypto_free_hash(tfm);
++
++	return 1;
++}
++
++#endif	/* DWC_CRYPTOLIB */
++
++
++/* Byte Ordering Conversions */
++
++uint32_t DWC_CPU_TO_LE32(uint32_t *p)
++{
++#ifdef __LITTLE_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++
++	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
++#endif
++}
++
++uint32_t DWC_CPU_TO_BE32(uint32_t *p)
++{
++#ifdef __BIG_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++
++	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
++#endif
++}
++
++uint32_t DWC_LE32_TO_CPU(uint32_t *p)
++{
++#ifdef __LITTLE_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++
++	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
++#endif
++}
++
++uint32_t DWC_BE32_TO_CPU(uint32_t *p)
++{
++#ifdef __BIG_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++
++	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
++#endif
++}
++
++uint16_t DWC_CPU_TO_LE16(uint16_t *p)
++{
++#ifdef __LITTLE_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++	return (u_p[1] | (u_p[0] << 8));
++#endif
++}
++
++uint16_t DWC_CPU_TO_BE16(uint16_t *p)
++{
++#ifdef __BIG_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++	return (u_p[1] | (u_p[0] << 8));
++#endif
++}
++
++uint16_t DWC_LE16_TO_CPU(uint16_t *p)
++{
++#ifdef __LITTLE_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++	return (u_p[1] | (u_p[0] << 8));
++#endif
++}
++
++uint16_t DWC_BE16_TO_CPU(uint16_t *p)
++{
++#ifdef __BIG_ENDIAN
++	return *p;
++#else
++	uint8_t *u_p = (uint8_t *)p;
++	return (u_p[1] | (u_p[0] << 8));
++#endif
++}
++
++
++/* Registers */
++
++uint32_t DWC_READ_REG32(void *io_ctx, uint32_t volatile *reg)
++{
++	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
++	bus_size_t ior = (bus_size_t)reg;
++
++	return bus_space_read_4(io->iot, io->ioh, ior);
++}
++
++#if 0
++uint64_t DWC_READ_REG64(void *io_ctx, uint64_t volatile *reg)
++{
++	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
++	bus_size_t ior = (bus_size_t)reg;
++
++	return bus_space_read_8(io->iot, io->ioh, ior);
++}
++#endif
++
++void DWC_WRITE_REG32(void *io_ctx, uint32_t volatile *reg, uint32_t value)
++{
++	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
++	bus_size_t ior = (bus_size_t)reg;
++
++	bus_space_write_4(io->iot, io->ioh, ior, value);
++}
++
++#if 0
++void DWC_WRITE_REG64(void *io_ctx, uint64_t volatile *reg, uint64_t value)
++{
++	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
++	bus_size_t ior = (bus_size_t)reg;
++
++	bus_space_write_8(io->iot, io->ioh, ior, value);
++}
++#endif
++
++void DWC_MODIFY_REG32(void *io_ctx, uint32_t volatile *reg, uint32_t clear_mask,
++		      uint32_t set_mask)
++{
++	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
++	bus_size_t ior = (bus_size_t)reg;
++
++	bus_space_write_4(io->iot, io->ioh, ior,
++			  (bus_space_read_4(io->iot, io->ioh, ior) &
++			   ~clear_mask) | set_mask);
++}
++
++#if 0
++void DWC_MODIFY_REG64(void *io_ctx, uint64_t volatile *reg, uint64_t clear_mask,
++		      uint64_t set_mask)
++{
++	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
++	bus_size_t ior = (bus_size_t)reg;
++
++	bus_space_write_8(io->iot, io->ioh, ior,
++			  (bus_space_read_8(io->iot, io->ioh, ior) &
++			   ~clear_mask) | set_mask);
++}
++#endif
++
++
++/* Locking */
++
++dwc_spinlock_t *DWC_SPINLOCK_ALLOC(void)
++{
++	struct simplelock *sl = DWC_ALLOC(sizeof(*sl));
++
++	if (!sl) {
++		DWC_ERROR("Cannot allocate memory for spinlock");
++		return NULL;
++	}
++
++	simple_lock_init(sl);
++	return (dwc_spinlock_t *)sl;
++}
++
++void DWC_SPINLOCK_FREE(dwc_spinlock_t *lock)
++{
++	struct simplelock *sl = (struct simplelock *)lock;
++
++	DWC_FREE(sl);
++}
++
++void DWC_SPINLOCK(dwc_spinlock_t *lock)
++{
++	simple_lock((struct simplelock *)lock);
++}
++
++void DWC_SPINUNLOCK(dwc_spinlock_t *lock)
++{
++	simple_unlock((struct simplelock *)lock);
++}
++
++void DWC_SPINLOCK_IRQSAVE(dwc_spinlock_t *lock, dwc_irqflags_t *flags)
++{
++	simple_lock((struct simplelock *)lock);
++	*flags = splbio();
++}
++
++void DWC_SPINUNLOCK_IRQRESTORE(dwc_spinlock_t *lock, dwc_irqflags_t flags)
++{
++	splx(flags);
++	simple_unlock((struct simplelock *)lock);
++}
++
++dwc_mutex_t *DWC_MUTEX_ALLOC(void)
++{
++	dwc_mutex_t *mutex = DWC_ALLOC(sizeof(struct lock));
++
++	if (!mutex) {
++		DWC_ERROR("Cannot allocate memory for mutex");
++		return NULL;
++	}
++
++	lockinit((struct lock *)mutex, 0, "dw3mtx", 0, 0);
++	return mutex;
++}
++
++#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES))
++#else
++void DWC_MUTEX_FREE(dwc_mutex_t *mutex)
++{
++	DWC_FREE(mutex);
++}
++#endif
++
++void DWC_MUTEX_LOCK(dwc_mutex_t *mutex)
++{
++	lockmgr((struct lock *)mutex, LK_EXCLUSIVE, NULL);
++}
++
++int DWC_MUTEX_TRYLOCK(dwc_mutex_t *mutex)
++{
++	int status;
++
++	status = lockmgr((struct lock *)mutex, LK_EXCLUSIVE | LK_NOWAIT, NULL);
++	return status == 0;
++}
++
++void DWC_MUTEX_UNLOCK(dwc_mutex_t *mutex)
++{
++	lockmgr((struct lock *)mutex, LK_RELEASE, NULL);
++}
++
++
++/* Timing */
++
++void DWC_UDELAY(uint32_t usecs)
++{
++	DELAY(usecs);
++}
++
++void DWC_MDELAY(uint32_t msecs)
++{
++	do {
++		DELAY(1000);
++	} while (--msecs);
++}
++
++void DWC_MSLEEP(uint32_t msecs)
++{
++	struct timeval tv;
++
++	tv.tv_sec = msecs / 1000;
++	tv.tv_usec = (msecs - tv.tv_sec * 1000) * 1000;
++	tsleep(&tv, 0, "dw3slp", tvtohz(&tv));
++}
++
++uint32_t DWC_TIME(void)
++{
++	struct timeval tv;
++
++	microuptime(&tv);	// or getmicrouptime? (less precise, but faster)
++	return tv.tv_sec * 1000 + tv.tv_usec / 1000;
++}
++
++
++/* Timers */
++
++struct dwc_timer {
++	struct callout t;
++	char *name;
++	dwc_spinlock_t *lock;
++	dwc_timer_callback_t cb;
++	void *data;
++};
++
++dwc_timer_t *DWC_TIMER_ALLOC(char *name, dwc_timer_callback_t cb, void *data)
++{
++	dwc_timer_t *t = DWC_ALLOC(sizeof(*t));
++
++	if (!t) {
++		DWC_ERROR("Cannot allocate memory for timer");
++		return NULL;
++	}
++
++	callout_init(&t->t);
++
++	t->name = DWC_STRDUP(name);
++	if (!t->name) {
++		DWC_ERROR("Cannot allocate memory for timer->name");
++		goto no_name;
++	}
++
++	t->lock = DWC_SPINLOCK_ALLOC();
++	if (!t->lock) {
++		DWC_ERROR("Cannot allocate memory for timer->lock");
++		goto no_lock;
++	}
++
++	t->cb = cb;
++	t->data = data;
++
++	return t;
++
++ no_lock:
++	DWC_FREE(t->name);
++ no_name:
++	DWC_FREE(t);
++
++	return NULL;
++}
++
++void DWC_TIMER_FREE(dwc_timer_t *timer)
++{
++	callout_stop(&timer->t);
++	DWC_SPINLOCK_FREE(timer->lock);
++	DWC_FREE(timer->name);
++	DWC_FREE(timer);
++}
++
++void DWC_TIMER_SCHEDULE(dwc_timer_t *timer, uint32_t time)
++{
++	struct timeval tv;
++
++	tv.tv_sec = time / 1000;
++	tv.tv_usec = (time - tv.tv_sec * 1000) * 1000;
++	callout_reset(&timer->t, tvtohz(&tv), timer->cb, timer->data);
++}
++
++void DWC_TIMER_CANCEL(dwc_timer_t *timer)
++{
++	callout_stop(&timer->t);
++}
++
++
++/* Wait Queues */
++
++struct dwc_waitq {
++	struct simplelock lock;
++	int abort;
++};
++
++dwc_waitq_t *DWC_WAITQ_ALLOC(void)
++{
++	dwc_waitq_t *wq = DWC_ALLOC(sizeof(*wq));
++
++	if (!wq) {
++		DWC_ERROR("Cannot allocate memory for waitqueue");
++		return NULL;
++	}
++
++	simple_lock_init(&wq->lock);
++	wq->abort = 0;
++
++	return wq;
++}
++
++void DWC_WAITQ_FREE(dwc_waitq_t *wq)
++{
++	DWC_FREE(wq);
++}
++
++int32_t DWC_WAITQ_WAIT(dwc_waitq_t *wq, dwc_waitq_condition_t cond, void *data)
++{
++	int ipl;
++	int result = 0;
++
++	simple_lock(&wq->lock);
++	ipl = splbio();
++
++	/* Skip the sleep if already aborted or triggered */
++	if (!wq->abort && !cond(data)) {
++		splx(ipl);
++		result = ltsleep(wq, PCATCH, "dw3wat", 0, &wq->lock); // infinite timeout
++		ipl = splbio();
++	}
++
++	if (result == 0) {			// awoken
++		if (wq->abort) {
++			wq->abort = 0;
++			result = -DWC_E_ABORT;
++		} else {
++			result = 0;
++		}
++
++		splx(ipl);
++		simple_unlock(&wq->lock);
++	} else {
++		wq->abort = 0;
++		splx(ipl);
++		simple_unlock(&wq->lock);
++
++		if (result == ERESTART) {	// signaled - restart
++			result = -DWC_E_RESTART;
++		} else {			// signaled - must be EINTR
++			result = -DWC_E_ABORT;
++		}
++	}
++
++	return result;
++}
++
++int32_t DWC_WAITQ_WAIT_TIMEOUT(dwc_waitq_t *wq, dwc_waitq_condition_t cond,
++			       void *data, int32_t msecs)
++{
++	struct timeval tv, tv1, tv2;
++	int ipl;
++	int result = 0;
++
++	tv.tv_sec = msecs / 1000;
++	tv.tv_usec = (msecs - tv.tv_sec * 1000) * 1000;
++
++	simple_lock(&wq->lock);
++	ipl = splbio();
++
++	/* Skip the sleep if already aborted or triggered */
++	if (!wq->abort && !cond(data)) {
++		splx(ipl);
++		getmicrouptime(&tv1);
++		result = ltsleep(wq, PCATCH, "dw3wto", tvtohz(&tv), &wq->lock);
++		getmicrouptime(&tv2);
++		ipl = splbio();
++	}
++
++	if (result == 0) {			// awoken
++		if (wq->abort) {
++			wq->abort = 0;
++			splx(ipl);
++			simple_unlock(&wq->lock);
++			result = -DWC_E_ABORT;
++		} else {
++			splx(ipl);
++			simple_unlock(&wq->lock);
++
++			tv2.tv_usec -= tv1.tv_usec;
++			if (tv2.tv_usec < 0) {
++				tv2.tv_usec += 1000000;
++				tv2.tv_sec--;
++			}
++
++			tv2.tv_sec -= tv1.tv_sec;
++			result = tv2.tv_sec * 1000 + tv2.tv_usec / 1000;
++			result = msecs - result;
++			if (result <= 0)
++				result = 1;
++		}
++	} else {
++		wq->abort = 0;
++		splx(ipl);
++		simple_unlock(&wq->lock);
++
++		if (result == ERESTART) {	// signaled - restart
++			result = -DWC_E_RESTART;
++
++		} else if (result == EINTR) {		// signaled - interrupt
++			result = -DWC_E_ABORT;
++
++		} else {				// timed out
++			result = -DWC_E_TIMEOUT;
++		}
++	}
++
++	return result;
++}
++
++void DWC_WAITQ_TRIGGER(dwc_waitq_t *wq)
++{
++	wakeup(wq);
++}
++
++void DWC_WAITQ_ABORT(dwc_waitq_t *wq)
++{
++	int ipl;
++
++	simple_lock(&wq->lock);
++	ipl = splbio();
++	wq->abort = 1;
++	wakeup(wq);
++	splx(ipl);
++	simple_unlock(&wq->lock);
++}
++
++
++/* Threading */
++
++struct dwc_thread {
++	struct proc *proc;
++	int abort;
++};
++
++dwc_thread_t *DWC_THREAD_RUN(dwc_thread_function_t func, char *name, void *data)
++{
++	int retval;
++	dwc_thread_t *thread = DWC_ALLOC(sizeof(*thread));
++
++	if (!thread) {
++		return NULL;
++	}
++
++	thread->abort = 0;
++	retval = kthread_create1((void (*)(void *))func, data, &thread->proc,
++				 "%s", name);
++	if (retval) {
++		DWC_FREE(thread);
++		return NULL;
++	}
++
++	return thread;
++}
++
++int DWC_THREAD_STOP(dwc_thread_t *thread)
++{
++	int retval;
++
++	thread->abort = 1;
++	retval = tsleep(&thread->abort, 0, "dw3stp", 60 * hz);
++
++	if (retval == 0) {
++		/* DWC_THREAD_EXIT() will free the thread struct */
++		return 0;
++	}
++
++	/* NOTE: We leak the thread struct if thread doesn't die */
++
++	if (retval == EWOULDBLOCK) {
++		return -DWC_E_TIMEOUT;
++	}
++
++	return -DWC_E_UNKNOWN;
++}
++
++dwc_bool_t DWC_THREAD_SHOULD_STOP(dwc_thread_t *thread)
++{
++	return thread->abort;
++}
++
++void DWC_THREAD_EXIT(dwc_thread_t *thread)
++{
++	wakeup(&thread->abort);
++	DWC_FREE(thread);
++	kthread_exit(0);
++}
++
++/* tasklets
++ - Runs in interrupt context (cannot sleep)
++ - Each tasklet runs on a single CPU
++ - Different tasklets can be running simultaneously on different CPUs
++ [ On NetBSD there is no corresponding mechanism, drivers don't have bottom-
++   halves. So we just call the callback directly from DWC_TASK_SCHEDULE() ]
++ */
++struct dwc_tasklet {
++	dwc_tasklet_callback_t cb;
++	void *data;
++};
++
++static void tasklet_callback(void *data)
++{
++	dwc_tasklet_t *task = (dwc_tasklet_t *)data;
++
++	task->cb(task->data);
++}
++
++dwc_tasklet_t *DWC_TASK_ALLOC(char *name, dwc_tasklet_callback_t cb, void *data)
++{
++	dwc_tasklet_t *task = DWC_ALLOC(sizeof(*task));
++
++	if (task) {
++		task->cb = cb;
++		task->data = data;
++	} else {
++		DWC_ERROR("Cannot allocate memory for tasklet");
++	}
++
++	return task;
++}
++
++void DWC_TASK_FREE(dwc_tasklet_t *task)
++{
++	DWC_FREE(task);
++}
++
++void DWC_TASK_SCHEDULE(dwc_tasklet_t *task)
++{
++	tasklet_callback(task);
++}
++
++
++/* workqueues
++ - Runs in process context (can sleep)
++ */
++typedef struct work_container {
++	dwc_work_callback_t cb;
++	void *data;
++	dwc_workq_t *wq;
++	char *name;
++	int hz;
++	struct work task;
++} work_container_t;
++
++struct dwc_workq {
++	struct workqueue *taskq;
++	dwc_spinlock_t *lock;
++	dwc_waitq_t *waitq;
++	int pending;
++	struct work_container *container;
++};
++
++static void do_work(struct work *task, void *data)
++{
++	dwc_workq_t *wq = (dwc_workq_t *)data;
++	work_container_t *container = wq->container;
++	dwc_irqflags_t flags;
++
++	if (container->hz) {
++		tsleep(container, 0, "dw3wrk", container->hz);
++	}
++
++	container->cb(container->data);
++	DWC_DEBUG("Work done: %s, container=%p", container->name, container);
++
++	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
++	if (container->name)
++		DWC_FREE(container->name);
++	DWC_FREE(container);
++	wq->pending--;
++	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
++	DWC_WAITQ_TRIGGER(wq->waitq);
++}
++
++static int work_done(void *data)
++{
++	dwc_workq_t *workq = (dwc_workq_t *)data;
++
++	return workq->pending == 0;
++}
++
++int DWC_WORKQ_WAIT_WORK_DONE(dwc_workq_t *workq, int timeout)
++{
++	return DWC_WAITQ_WAIT_TIMEOUT(workq->waitq, work_done, workq, timeout);
++}
++
++dwc_workq_t *DWC_WORKQ_ALLOC(char *name)
++{
++	int result;
++	dwc_workq_t *wq = DWC_ALLOC(sizeof(*wq));
++
++	if (!wq) {
++		DWC_ERROR("Cannot allocate memory for workqueue");
++		return NULL;
++	}
++
++	result = workqueue_create(&wq->taskq, name, do_work, wq, 0 /*PWAIT*/,
++				  IPL_BIO, 0);
++	if (result) {
++		DWC_ERROR("Cannot create workqueue");
++		goto no_taskq;
++	}
++
++	wq->pending = 0;
++
++	wq->lock = DWC_SPINLOCK_ALLOC();
++	if (!wq->lock) {
++		DWC_ERROR("Cannot allocate memory for spinlock");
++		goto no_lock;
++	}
++
++	wq->waitq = DWC_WAITQ_ALLOC();
++	if (!wq->waitq) {
++		DWC_ERROR("Cannot allocate memory for waitqueue");
++		goto no_waitq;
++	}
++
++	return wq;
++
++ no_waitq:
++	DWC_SPINLOCK_FREE(wq->lock);
++ no_lock:
++	workqueue_destroy(wq->taskq);
++ no_taskq:
++	DWC_FREE(wq);
++
++	return NULL;
++}
++
++void DWC_WORKQ_FREE(dwc_workq_t *wq)
++{
++#ifdef DEBUG
++	dwc_irqflags_t flags;
++
++	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
++
++	if (wq->pending != 0) {
++		struct work_container *container = wq->container;
++
++		DWC_ERROR("Destroying work queue with pending work");
++
++		if (container && container->name) {
++			DWC_ERROR("Work %s still pending", container->name);
++		}
++	}
++
++	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
++#endif
++	DWC_WAITQ_FREE(wq->waitq);
++	DWC_SPINLOCK_FREE(wq->lock);
++	workqueue_destroy(wq->taskq);
++	DWC_FREE(wq);
++}
++
++void DWC_WORKQ_SCHEDULE(dwc_workq_t *wq, dwc_work_callback_t cb, void *data,
++			char *format, ...)
++{
++	dwc_irqflags_t flags;
++	work_container_t *container;
++	static char name[128];
++	va_list args;
++
++	va_start(args, format);
++	DWC_VSNPRINTF(name, 128, format, args);
++	va_end(args);
++
++	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
++	wq->pending++;
++	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
++	DWC_WAITQ_TRIGGER(wq->waitq);
++
++	container = DWC_ALLOC_ATOMIC(sizeof(*container));
++	if (!container) {
++		DWC_ERROR("Cannot allocate memory for container");
++		return;
++	}
++
++	container->name = DWC_STRDUP(name);
++	if (!container->name) {
++		DWC_ERROR("Cannot allocate memory for container->name");
++		DWC_FREE(container);
++		return;
++	}
++
++	container->cb = cb;
++	container->data = data;
++	container->wq = wq;
++	container->hz = 0;
++	wq->container = container;
++
++	DWC_DEBUG("Queueing work: %s, container=%p", container->name, container);
++	workqueue_enqueue(wq->taskq, &container->task);
++}
++
++void DWC_WORKQ_SCHEDULE_DELAYED(dwc_workq_t *wq, dwc_work_callback_t cb,
++				void *data, uint32_t time, char *format, ...)
++{
++	dwc_irqflags_t flags;
++	work_container_t *container;
++	static char name[128];
++	struct timeval tv;
++	va_list args;
++
++	va_start(args, format);
++	DWC_VSNPRINTF(name, 128, format, args);
++	va_end(args);
++
++	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
++	wq->pending++;
++	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
++	DWC_WAITQ_TRIGGER(wq->waitq);
++
++	container = DWC_ALLOC_ATOMIC(sizeof(*container));
++	if (!container) {
++		DWC_ERROR("Cannot allocate memory for container");
++		return;
++	}
++
++	container->name = DWC_STRDUP(name);
++	if (!container->name) {
++		DWC_ERROR("Cannot allocate memory for container->name");
++		DWC_FREE(container);
++		return;
++	}
++
++	container->cb = cb;
++	container->data = data;
++	container->wq = wq;
++	tv.tv_sec = time / 1000;
++	tv.tv_usec = (time - tv.tv_sec * 1000) * 1000;
++	container->hz = tvtohz(&tv);
++	wq->container = container;
++
++	DWC_DEBUG("Queueing work: %s, container=%p", container->name, container);
++	workqueue_enqueue(wq->taskq, &container->task);
++}
++
++int DWC_WORKQ_PENDING(dwc_workq_t *wq)
++{
++	return wq->pending;
++}
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_crypto.c
+@@ -0,0 +1,308 @@
++/* =========================================================================
++ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_crypto.c $
++ * $Revision: #5 $
++ * $Date: 2010/09/28 $
++ * $Change: 1596182 $
++ *
++ * Synopsys Portability Library Software and documentation
++ * (hereinafter, "Software") is an Unsupported proprietary work of
++ * Synopsys, Inc. unless otherwise expressly agreed to in writing
++ * between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product
++ * under any End User Software License Agreement or Agreement for
++ * Licensed Product with Synopsys or any supplement thereto. You are
++ * permitted to use and redistribute this Software in source and binary
++ * forms, with or without modification, provided that redistributions
++ * of source code must retain this notice. You may not view, use,
++ * disclose, copy or distribute this file or any information contained
++ * herein except pursuant to this license grant from Synopsys. If you
++ * do not agree with this notice, including the disclaimer below, then
++ * you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
++ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
++ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
++ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
++ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
++ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================= */
++
++/** @file
++ * This file contains the WUSB cryptographic routines.
++ */
++
++#ifdef DWC_CRYPTOLIB
++
++#include "dwc_crypto.h"
++#include "usb.h"
++
++#ifdef DEBUG
++static inline void dump_bytes(char *name, uint8_t *bytes, int len)
++{
++	int i;
++	DWC_PRINTF("%s: ", name);
++	for (i=0; i<len; i++) {
++		DWC_PRINTF("%02x ", bytes[i]);
++	}
++	DWC_PRINTF("\n");
++}
++#else
++#define dump_bytes(x...)
++#endif
++
++/* Display a block */
++void show_block(const u8 *blk, const char *prefix, const char *suffix, int a)
++{
++#ifdef DWC_DEBUG_CRYPTO
++	int i, blksize = 16;
++
++	DWC_DEBUG("%s", prefix);
++
++	if (suffix == NULL) {
++		suffix = "\n";
++		blksize = a;
++	}
++
++	for (i = 0; i < blksize; i++)
++		DWC_PRINT("%02x%s", *blk++, ((i & 3) == 3) ? "  " : " ");
++	DWC_PRINT(suffix);
++#endif
++}
++
++/**
++ * Encrypts an array of bytes using the AES encryption engine.
++ * If <code>dst</code> == <code>src</code>, then the bytes will be encrypted
++ * in-place.
++ *
++ * @return  0 on success, negative error code on error.
++ */
++int dwc_wusb_aes_encrypt(u8 *src, u8 *key, u8 *dst)
++{
++	u8 block_t[16];
++	DWC_MEMSET(block_t, 0, 16);
++
++	return DWC_AES_CBC(src, 16, key, 16, block_t, dst);
++}
++
++/**
++ * The CCM-MAC-FUNCTION described in section 6.5 of the WUSB spec.
++ * This function takes a data string and returns the encrypted CBC
++ * Counter-mode MIC.
++ *
++ * @param key     The 128-bit symmetric key.
++ * @param nonce   The CCM nonce.
++ * @param label   The unique 14-byte ASCII text label.
++ * @param bytes   The byte array to be encrypted.
++ * @param len     Length of the byte array.
++ * @param result  Byte array to receive the 8-byte encrypted MIC.
++ */
++void dwc_wusb_cmf(u8 *key, u8 *nonce,
++		  char *label, u8 *bytes, int len, u8 *result)
++{
++	u8 block_m[16];
++	u8 block_x[16];
++	u8 block_t[8];
++	int idx, blkNum;
++	u16 la = (u16)(len + 14);
++
++	/* Set the AES-128 key */
++	//dwc_aes_setkey(tfm, key, 16);
++
++	/* Fill block B0 from flags = 0x59, N, and l(m) = 0 */
++	block_m[0] = 0x59;
++	for (idx = 0; idx < 13; idx++)
++		block_m[idx + 1] = nonce[idx];
++	block_m[14] = 0;
++	block_m[15] = 0;
++
++	/* Produce the CBC IV */
++	dwc_wusb_aes_encrypt(block_m, key, block_x);
++	show_block(block_m, "CBC IV in: ", "\n", 0);
++	show_block(block_x, "CBC IV out:", "\n", 0);
++
++	/* Fill block B1 from l(a) = Blen + 14, and A */
++	block_x[0] ^= (u8)(la >> 8);
++	block_x[1] ^= (u8)la;
++	for (idx = 0; idx < 14; idx++)
++		block_x[idx + 2] ^= label[idx];
++	show_block(block_x, "After xor: ", "b1\n", 16);
++
++	dwc_wusb_aes_encrypt(block_x, key, block_x);
++	show_block(block_x, "After AES: ", "b1\n", 16);
++
++	idx = 0;
++	blkNum = 0;
++
++	/* Fill remaining blocks with B */
++	while (len-- > 0) {
++		block_x[idx] ^= *bytes++;
++		if (++idx >= 16) {
++			idx = 0;
++			show_block(block_x, "After xor: ", "\n", blkNum);
++			dwc_wusb_aes_encrypt(block_x, key, block_x);
++			show_block(block_x, "After AES: ", "\n", blkNum);
++			blkNum++;
++		}
++	}
++
++	/* Handle partial last block */
++	if (idx > 0) {
++		show_block(block_x, "After xor: ", "\n", blkNum);
++		dwc_wusb_aes_encrypt(block_x, key, block_x);
++		show_block(block_x, "After AES: ", "\n", blkNum);
++	}
++
++	/* Save the MIC tag */
++	DWC_MEMCPY(block_t, block_x, 8);
++	show_block(block_t, "MIC tag  : ", NULL, 8);
++
++	/* Fill block A0 from flags = 0x01, N, and counter = 0 */
++	block_m[0] = 0x01;
++	block_m[14] = 0;
++	block_m[15] = 0;
++
++	/* Encrypt the counter */
++	dwc_wusb_aes_encrypt(block_m, key, block_x);
++	show_block(block_x, "CTR[MIC] : ", NULL, 8);
++
++	/* XOR with MIC tag */
++	for (idx = 0; idx < 8; idx++) {
++		block_t[idx] ^= block_x[idx];
++	}
++
++	/* Return result to caller */
++	DWC_MEMCPY(result, block_t, 8);
++	show_block(result, "CCM-MIC  : ", NULL, 8);
++
++}
++
++/**
++ * The PRF function described in section 6.5 of the WUSB spec. This function
++ * concatenates MIC values returned from dwc_cmf() to create a value of
++ * the requested length.
++ *
++ * @param prf_len  Length of the PRF function in bits (64, 128, or 256).
++ * @param key, nonce, label, bytes, len  Same as for dwc_cmf().
++ * @param result   Byte array to receive the result.
++ */
++void dwc_wusb_prf(int prf_len, u8 *key,
++		  u8 *nonce, char *label, u8 *bytes, int len, u8 *result)
++{
++	int i;
++
++	nonce[0] = 0;
++	for (i = 0; i < prf_len >> 6; i++, nonce[0]++) {
++		dwc_wusb_cmf(key, nonce, label, bytes, len, result);
++		result += 8;
++	}
++}
++
++/**
++ * Fills in CCM Nonce per the WUSB spec.
++ *
++ * @param[in] haddr Host address.
++ * @param[in] daddr Device address.
++ * @param[in] tkid Session Key(PTK) identifier.
++ * @param[out] nonce Pointer to where the CCM Nonce output is to be written.
++ */
++void dwc_wusb_fill_ccm_nonce(uint16_t haddr, uint16_t daddr, uint8_t *tkid,
++			     uint8_t *nonce)
++{
++
++	DWC_DEBUG("%s %x %x\n", __func__, daddr, haddr);
++
++	DWC_MEMSET(&nonce[0], 0, 16);
++
++	DWC_MEMCPY(&nonce[6], tkid, 3);
++	nonce[9] = daddr & 0xFF;
++	nonce[10] = (daddr >> 8) & 0xFF;
++	nonce[11] = haddr & 0xFF;
++	nonce[12] = (haddr >> 8) & 0xFF;
++
++	dump_bytes("CCM nonce", nonce, 16);
++}
++
++/**
++ * Generates a 16-byte cryptographic-grade random number for the Host/Device
++ * Nonce.
++ */
++void dwc_wusb_gen_nonce(uint16_t addr, uint8_t *nonce)
++{
++	uint8_t inonce[16];
++	uint32_t temp[4];
++
++	/* Fill in the Nonce */
++	DWC_MEMSET(&inonce[0], 0, sizeof(inonce));
++	inonce[9] = addr & 0xFF;
++	inonce[10] = (addr >> 8) & 0xFF;
++	inonce[11] = inonce[9];
++	inonce[12] = inonce[10];
++
++	/* Collect "randomness samples" */
++	DWC_RANDOM_BYTES((uint8_t *)temp, 16);
++
++	dwc_wusb_prf_128((uint8_t *)temp, nonce,
++			 "Random Numbers", (uint8_t *)temp, sizeof(temp),
++			 nonce);
++}
++
++/**
++ * Generates the Session Key (PTK) and Key Confirmation Key (KCK) per the
++ * WUSB spec.
++ *
++ * @param[in] ccm_nonce Pointer to CCM Nonce.
++ * @param[in] mk Master Key to derive the session from
++ * @param[in] hnonce Pointer to Host Nonce.
++ * @param[in] dnonce Pointer to Device Nonce.
++ * @param[out] kck Pointer to where the KCK output is to be written.
++ * @param[out] ptk Pointer to where the PTK output is to be written.
++ */
++void dwc_wusb_gen_key(uint8_t *ccm_nonce, uint8_t *mk, uint8_t *hnonce,
++		      uint8_t *dnonce, uint8_t *kck, uint8_t *ptk)
++{
++	uint8_t idata[32];
++	uint8_t odata[32];
++
++	dump_bytes("ck", mk, 16);
++	dump_bytes("hnonce", hnonce, 16);
++	dump_bytes("dnonce", dnonce, 16);
++
++	/* The data is the HNonce and DNonce concatenated */
++	DWC_MEMCPY(&idata[0], hnonce, 16);
++	DWC_MEMCPY(&idata[16], dnonce, 16);
++
++	dwc_wusb_prf_256(mk, ccm_nonce, "Pair-wise keys", idata, 32, odata);
++
++	/* Low 16 bytes of the result is the KCK, high 16 is the PTK */
++	DWC_MEMCPY(kck, &odata[0], 16);
++	DWC_MEMCPY(ptk, &odata[16], 16);
++
++	dump_bytes("kck", kck, 16);
++	dump_bytes("ptk", ptk, 16);
++}
++
++/**
++ * Generates the Message Integrity Code over the Handshake data per the
++ * WUSB spec.
++ *
++ * @param ccm_nonce Pointer to CCM Nonce.
++ * @param kck   Pointer to Key Confirmation Key.
++ * @param data  Pointer to Handshake data to be checked.
++ * @param mic   Pointer to where the MIC output is to be written.
++ */
++void dwc_wusb_gen_mic(uint8_t *ccm_nonce, uint8_t *kck,
++		      uint8_t *data, uint8_t *mic)
++{
++
++	dwc_wusb_prf_64(kck, ccm_nonce, "out-of-bandMIC",
++			data, WUSB_HANDSHAKE_LEN_FOR_MIC, mic);
++}
++
++#endif	/* DWC_CRYPTOLIB */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_crypto.h
+@@ -0,0 +1,111 @@
++/* =========================================================================
++ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_crypto.h $
++ * $Revision: #3 $
++ * $Date: 2010/09/28 $
++ * $Change: 1596182 $
++ *
++ * Synopsys Portability Library Software and documentation
++ * (hereinafter, "Software") is an Unsupported proprietary work of
++ * Synopsys, Inc. unless otherwise expressly agreed to in writing
++ * between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product
++ * under any End User Software License Agreement or Agreement for
++ * Licensed Product with Synopsys or any supplement thereto. You are
++ * permitted to use and redistribute this Software in source and binary
++ * forms, with or without modification, provided that redistributions
++ * of source code must retain this notice. You may not view, use,
++ * disclose, copy or distribute this file or any information contained
++ * herein except pursuant to this license grant from Synopsys. If you
++ * do not agree with this notice, including the disclaimer below, then
++ * you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
++ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
++ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
++ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
++ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
++ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================= */
++
++#ifndef _DWC_CRYPTO_H_
++#define _DWC_CRYPTO_H_
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++/** @file
++ *
++ * This file contains declarations for the WUSB Cryptographic routines as
++ * defined in the WUSB spec.  They are only to be used internally by the DWC UWB
++ * modules.
++ */
++
++#include "dwc_os.h"
++
++int dwc_wusb_aes_encrypt(u8 *src, u8 *key, u8 *dst);
++
++void dwc_wusb_cmf(u8 *key, u8 *nonce,
++		  char *label, u8 *bytes, int len, u8 *result);
++void dwc_wusb_prf(int prf_len, u8 *key,
++		  u8 *nonce, char *label, u8 *bytes, int len, u8 *result);
++
++/**
++ * The PRF-64 function described in section 6.5 of the WUSB spec.
++ *
++ * @param key, nonce, label, bytes, len, result  Same as for dwc_prf().
++ */
++static inline void dwc_wusb_prf_64(u8 *key, u8 *nonce,
++				   char *label, u8 *bytes, int len, u8 *result)
++{
++	dwc_wusb_prf(64, key, nonce, label, bytes, len, result);
++}
++
++/**
++ * The PRF-128 function described in section 6.5 of the WUSB spec.
++ *
++ * @param key, nonce, label, bytes, len, result  Same as for dwc_prf().
++ */
++static inline void dwc_wusb_prf_128(u8 *key, u8 *nonce,
++				    char *label, u8 *bytes, int len, u8 *result)
++{
++	dwc_wusb_prf(128, key, nonce, label, bytes, len, result);
++}
++
++/**
++ * The PRF-256 function described in section 6.5 of the WUSB spec.
++ *
++ * @param key, nonce, label, bytes, len, result  Same as for dwc_prf().
++ */
++static inline void dwc_wusb_prf_256(u8 *key, u8 *nonce,
++				    char *label, u8 *bytes, int len, u8 *result)
++{
++	dwc_wusb_prf(256, key, nonce, label, bytes, len, result);
++}
++
++
++void dwc_wusb_fill_ccm_nonce(uint16_t haddr, uint16_t daddr, uint8_t *tkid,
++			       uint8_t *nonce);
++void dwc_wusb_gen_nonce(uint16_t addr,
++			  uint8_t *nonce);
++
++void dwc_wusb_gen_key(uint8_t *ccm_nonce, uint8_t *mk,
++			uint8_t *hnonce, uint8_t *dnonce,
++			uint8_t *kck, uint8_t *ptk);
++
++
++void dwc_wusb_gen_mic(uint8_t *ccm_nonce, uint8_t
++			*kck, uint8_t *data, uint8_t *mic);
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* _DWC_CRYPTO_H_ */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_dh.c
+@@ -0,0 +1,291 @@
++/* =========================================================================
++ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_dh.c $
++ * $Revision: #3 $
++ * $Date: 2010/09/28 $
++ * $Change: 1596182 $
++ *
++ * Synopsys Portability Library Software and documentation
++ * (hereinafter, "Software") is an Unsupported proprietary work of
++ * Synopsys, Inc. unless otherwise expressly agreed to in writing
++ * between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product
++ * under any End User Software License Agreement or Agreement for
++ * Licensed Product with Synopsys or any supplement thereto. You are
++ * permitted to use and redistribute this Software in source and binary
++ * forms, with or without modification, provided that redistributions
++ * of source code must retain this notice. You may not view, use,
++ * disclose, copy or distribute this file or any information contained
++ * herein except pursuant to this license grant from Synopsys. If you
++ * do not agree with this notice, including the disclaimer below, then
++ * you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
++ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
++ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
++ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
++ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
++ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================= */
++#ifdef DWC_CRYPTOLIB
++
++#ifndef CONFIG_MACH_IPMATE
++
++#include "dwc_dh.h"
++#include "dwc_modpow.h"
++
++#ifdef DEBUG
++/* This function prints out a buffer in the format described in the Association
++ * Model specification. */
++static void dh_dump(char *str, void *_num, int len)
++{
++	uint8_t *num = _num;
++	int i;
++	DWC_PRINTF("%s\n", str);
++	for (i = 0; i < len; i ++) {
++		DWC_PRINTF("%02x", num[i]);
++		if (((i + 1) % 2) == 0) DWC_PRINTF(" ");
++		if (((i + 1) % 26) == 0) DWC_PRINTF("\n");
++	}
++
++	DWC_PRINTF("\n");
++}
++#else
++#define dh_dump(_x...) do {; } while(0)
++#endif
++
++/* Constant g value */
++static __u32 dh_g[] = {
++	0x02000000,
++};
++
++/* Constant p value */
++static __u32 dh_p[] = {
++	0xFFFFFFFF, 0xFFFFFFFF, 0xA2DA0FC9, 0x34C26821, 0x8B62C6C4, 0xD11CDC80, 0x084E0229, 0x74CC678A,
++	0xA6BE0B02, 0x229B133B, 0x79084A51, 0xDD04348E, 0xB31995EF, 0x1B433ACD, 0x6D0A2B30, 0x37145FF2,
++	0x6D35E14F, 0x45C2516D, 0x76B585E4, 0xC67E5E62, 0xE9424CF4, 0x6BED37A6, 0xB65CFF0B, 0xEDB706F4,
++	0xFB6B38EE, 0xA59F895A, 0x11249FAE, 0xE61F4B7C, 0x51662849, 0x3D5BE4EC, 0xB87C00C2, 0x05BF63A1,
++	0x3648DA98, 0x9AD3551C, 0xA83F1669, 0x5FCF24FD, 0x235D6583, 0x96ADA3DC, 0x56F3621C, 0xBB528520,
++	0x0729D59E, 0x6D969670, 0x4E350C67, 0x0498BC4A, 0x086C74F1, 0x7C2118CA, 0x465E9032, 0x3BCE362E,
++	0x2C779EE3, 0x03860E18, 0xA283279B, 0x8FA207EC, 0xF05DC5B5, 0xC9524C6F, 0xF6CB2BDE, 0x18175895,
++	0x7C499539, 0xE56A95EA, 0x1826D215, 0x1005FA98, 0x5A8E7215, 0x2DC4AA8A, 0x0D1733AD, 0x337A5004,
++	0xAB2155A8, 0x64BA1CDF, 0x0485FBEC, 0x0AEFDB58, 0x5771EA8A, 0x7D0C065D, 0x850F97B3, 0xC7E4E1A6,
++	0x8CAEF5AB, 0xD73309DB, 0xE0948C1E, 0x9D61254A, 0x26D2E3CE, 0x6BEED21A, 0x06FA2FF1, 0x64088AD9,
++	0x730276D8, 0x646AC83E, 0x182B1F52, 0x0C207B17, 0x5717E1BB, 0x6C5D617A, 0xC0880977, 0xE246D9BA,
++	0xA04FE208, 0x31ABE574, 0xFC5BDB43, 0x8E10FDE0, 0x20D1824B, 0xCAD23AA9, 0xFFFFFFFF, 0xFFFFFFFF,
++};
++
++static void dh_swap_bytes(void *_in, void *_out, uint32_t len)
++{
++	uint8_t *in = _in;
++	uint8_t *out = _out;
++	int i;
++	for (i=0; i<len; i++) {
++		out[i] = in[len-1-i];
++	}
++}
++
++/* Computes the modular exponentiation (num^exp % mod).  num, exp, and mod are
++ * big endian numbers of size len, in bytes.  Each len value must be a multiple
++ * of 4. */
++int dwc_dh_modpow(void *mem_ctx, void *num, uint32_t num_len,
++		  void *exp, uint32_t exp_len,
++		  void *mod, uint32_t mod_len,
++		  void *out)
++{
++	/* modpow() takes little endian numbers.  AM uses big-endian.  This
++	 * function swaps bytes of numbers before passing onto modpow. */
++
++	int retval = 0;
++	uint32_t *result;
++
++	uint32_t *bignum_num = dwc_alloc(mem_ctx, num_len + 4);
++	uint32_t *bignum_exp = dwc_alloc(mem_ctx, exp_len + 4);
++	uint32_t *bignum_mod = dwc_alloc(mem_ctx, mod_len + 4);
++
++	dh_swap_bytes(num, &bignum_num[1], num_len);
++	bignum_num[0] = num_len / 4;
++
++	dh_swap_bytes(exp, &bignum_exp[1], exp_len);
++	bignum_exp[0] = exp_len / 4;
++
++	dh_swap_bytes(mod, &bignum_mod[1], mod_len);
++	bignum_mod[0] = mod_len / 4;
++
++	result = dwc_modpow(mem_ctx, bignum_num, bignum_exp, bignum_mod);
++	if (!result) {
++		retval = -1;
++		goto dh_modpow_nomem;
++	}
++
++	dh_swap_bytes(&result[1], out, result[0] * 4);
++	dwc_free(mem_ctx, result);
++
++ dh_modpow_nomem:
++	dwc_free(mem_ctx, bignum_num);
++	dwc_free(mem_ctx, bignum_exp);
++	dwc_free(mem_ctx, bignum_mod);
++	return retval;
++}
++
++
++int dwc_dh_pk(void *mem_ctx, uint8_t nd, uint8_t *exp, uint8_t *pk, uint8_t *hash)
++{
++	int retval;
++	uint8_t m3[385];
++
++#ifndef DH_TEST_VECTORS
++	DWC_RANDOM_BYTES(exp, 32);
++#endif
++
++	/* Compute the pkd */
++	if ((retval = dwc_dh_modpow(mem_ctx, dh_g, 4,
++				    exp, 32,
++				    dh_p, 384, pk))) {
++		return retval;
++	}
++
++	m3[384] = nd;
++	DWC_MEMCPY(&m3[0], pk, 384);
++	DWC_SHA256(m3, 385, hash);
++
++	dh_dump("PK", pk, 384);
++	dh_dump("SHA-256(M3)", hash, 32);
++	return 0;
++}
++
++int dwc_dh_derive_keys(void *mem_ctx, uint8_t nd, uint8_t *pkh, uint8_t *pkd,
++		       uint8_t *exp, int is_host,
++		       char *dd, uint8_t *ck, uint8_t *kdk)
++{
++	int retval;
++	uint8_t mv[784];
++	uint8_t sha_result[32];
++	uint8_t dhkey[384];
++	uint8_t shared_secret[384];
++	char *message;
++	uint32_t vd;
++
++	uint8_t *pk;
++
++	if (is_host) {
++		pk = pkd;
++	}
++	else {
++		pk = pkh;
++	}
++
++	if ((retval = dwc_dh_modpow(mem_ctx, pk, 384,
++				    exp, 32,
++				    dh_p, 384, shared_secret))) {
++		return retval;
++	}
++	dh_dump("Shared Secret", shared_secret, 384);
++
++	DWC_SHA256(shared_secret, 384, dhkey);
++	dh_dump("DHKEY", dhkey, 384);
++
++	DWC_MEMCPY(&mv[0], pkd, 384);
++	DWC_MEMCPY(&mv[384], pkh, 384);
++	DWC_MEMCPY(&mv[768], "displayed digest", 16);
++	dh_dump("MV", mv, 784);
++
++	DWC_SHA256(mv, 784, sha_result);
++	dh_dump("SHA-256(MV)", sha_result, 32);
++	dh_dump("First 32-bits of SHA-256(MV)", sha_result, 4);
++
++	dh_swap_bytes(sha_result, &vd, 4);
++#ifdef DEBUG
++	DWC_PRINTF("Vd (decimal) = %d\n", vd);
++#endif
++
++	switch (nd) {
++	case 2:
++		vd = vd % 100;
++		DWC_SPRINTF(dd, "%02d", vd);
++		break;
++	case 3:
++		vd = vd % 1000;
++		DWC_SPRINTF(dd, "%03d", vd);
++		break;
++	case 4:
++		vd = vd % 10000;
++		DWC_SPRINTF(dd, "%04d", vd);
++		break;
++	}
++#ifdef DEBUG
++	DWC_PRINTF("Display Digits: %s\n", dd);
++#endif
++
++	message = "connection key";
++	DWC_HMAC_SHA256(message, DWC_STRLEN(message), dhkey, 32, sha_result);
++	dh_dump("HMAC(SHA-256, DHKey, connection key)", sha_result, 32);
++	DWC_MEMCPY(ck, sha_result, 16);
++
++	message = "key derivation key";
++	DWC_HMAC_SHA256(message, DWC_STRLEN(message), dhkey, 32, sha_result);
++	dh_dump("HMAC(SHA-256, DHKey, key derivation key)", sha_result, 32);
++	DWC_MEMCPY(kdk, sha_result, 32);
++
++	return 0;
++}
++
++
++#ifdef DH_TEST_VECTORS
++
++static __u8 dh_a[] = {
++	0x44, 0x00, 0x51, 0xd6,
++	0xf0, 0xb5, 0x5e, 0xa9,
++	0x67, 0xab, 0x31, 0xc6,
++	0x8a, 0x8b, 0x5e, 0x37,
++	0xd9, 0x10, 0xda, 0xe0,
++	0xe2, 0xd4, 0x59, 0xa4,
++	0x86, 0x45, 0x9c, 0xaa,
++	0xdf, 0x36, 0x75, 0x16,
++};
++
++static __u8 dh_b[] = {
++	0x5d, 0xae, 0xc7, 0x86,
++	0x79, 0x80, 0xa3, 0x24,
++	0x8c, 0xe3, 0x57, 0x8f,
++	0xc7, 0x5f, 0x1b, 0x0f,
++	0x2d, 0xf8, 0x9d, 0x30,
++	0x6f, 0xa4, 0x52, 0xcd,
++	0xe0, 0x7a, 0x04, 0x8a,
++	0xde, 0xd9, 0x26, 0x56,
++};
++
++void dwc_run_dh_test_vectors(void *mem_ctx)
++{
++	uint8_t pkd[384];
++	uint8_t pkh[384];
++	uint8_t hashd[32];
++	uint8_t hashh[32];
++	uint8_t ck[16];
++	uint8_t kdk[32];
++	char dd[5];
++
++	DWC_PRINTF("\n\n\nDH_TEST_VECTORS\n\n");
++
++	/* compute the PKd and SHA-256(PKd || Nd) */
++	DWC_PRINTF("Computing PKd\n");
++	dwc_dh_pk(mem_ctx, 2, dh_a, pkd, hashd);
++
++	/* compute the PKd and SHA-256(PKh || Nd) */
++	DWC_PRINTF("Computing PKh\n");
++	dwc_dh_pk(mem_ctx, 2, dh_b, pkh, hashh);
++
++	/* compute the dhkey */
++	dwc_dh_derive_keys(mem_ctx, 2, pkh, pkd, dh_a, 0, dd, ck, kdk);
++}
++#endif /* DH_TEST_VECTORS */
++
++#endif /* !CONFIG_MACH_IPMATE */
++
++#endif /* DWC_CRYPTOLIB */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_dh.h
+@@ -0,0 +1,106 @@
++/* =========================================================================
++ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_dh.h $
++ * $Revision: #4 $
++ * $Date: 2010/09/28 $
++ * $Change: 1596182 $
++ *
++ * Synopsys Portability Library Software and documentation
++ * (hereinafter, "Software") is an Unsupported proprietary work of
++ * Synopsys, Inc. unless otherwise expressly agreed to in writing
++ * between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product
++ * under any End User Software License Agreement or Agreement for
++ * Licensed Product with Synopsys or any supplement thereto. You are
++ * permitted to use and redistribute this Software in source and binary
++ * forms, with or without modification, provided that redistributions
++ * of source code must retain this notice. You may not view, use,
++ * disclose, copy or distribute this file or any information contained
++ * herein except pursuant to this license grant from Synopsys. If you
++ * do not agree with this notice, including the disclaimer below, then
++ * you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
++ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
++ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
++ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
++ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
++ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================= */
++#ifndef _DWC_DH_H_
++#define _DWC_DH_H_
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++#include "dwc_os.h"
++
++/** @file
++ *
++ * This file defines the common functions on device and host for performing
++ * numeric association as defined in the WUSB spec.  They are only to be
++ * used internally by the DWC UWB modules. */
++
++extern int dwc_dh_sha256(uint8_t *message, uint32_t len, uint8_t *out);
++extern int dwc_dh_hmac_sha256(uint8_t *message, uint32_t messagelen,
++			      uint8_t *key, uint32_t keylen,
++			      uint8_t *out);
++extern int dwc_dh_modpow(void *mem_ctx, void *num, uint32_t num_len,
++			 void *exp, uint32_t exp_len,
++			 void *mod, uint32_t mod_len,
++			 void *out);
++
++/** Computes PKD or PKH, and SHA-256(PKd || Nd)
++ *
++ * PK = g^exp mod p.
++ *
++ * Input:
++ * Nd = Number of digits on the device.
++ *
++ * Output:
++ * exp = A 32-byte buffer to be filled with a randomly generated number.
++ *       used as either A or B.
++ * pk = A 384-byte buffer to be filled with the PKH or PKD.
++ * hash = A 32-byte buffer to be filled with SHA-256(PK || ND).
++ */
++extern int dwc_dh_pk(void *mem_ctx, uint8_t nd, uint8_t *exp, uint8_t *pkd, uint8_t *hash);
++
++/** Computes the DHKEY, and VD.
++ *
++ * If called from host, then it will comput DHKEY=PKD^exp % p.
++ * If called from device, then it will comput DHKEY=PKH^exp % p.
++ *
++ * Input:
++ * pkd = The PKD value.
++ * pkh = The PKH value.
++ * exp = The A value (if device) or B value (if host) generated in dwc_wudev_dh_pk.
++ * is_host = Set to non zero if a WUSB host is calling this function.
++ *
++ * Output:
++
++ * dd = A pointer to an buffer to be set to the displayed digits string to be shown
++ *      to the user.  This buffer should be at 5 bytes long to hold 4 digits plus a
++ *      null termination character.  This buffer can be used directly for display.
++ * ck = A 16-byte buffer to be filled with the CK.
++ * kdk = A 32-byte buffer to be filled with the KDK.
++ */
++extern int dwc_dh_derive_keys(void *mem_ctx, uint8_t nd, uint8_t *pkh, uint8_t *pkd,
++			      uint8_t *exp, int is_host,
++			      char *dd, uint8_t *ck, uint8_t *kdk);
++
++#ifdef DH_TEST_VECTORS
++extern void dwc_run_dh_test_vectors(void);
++#endif
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* _DWC_DH_H_ */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_list.h
+@@ -0,0 +1,594 @@
++/*	$OpenBSD: queue.h,v 1.26 2004/05/04 16:59:32 grange Exp $	*/
++/*	$NetBSD: queue.h,v 1.11 1996/05/16 05:17:14 mycroft Exp $	*/
++
++/*
++ * Copyright (c) 1991, 1993
++ *	The Regents of the University of California.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. Neither the name of the University nor the names of its contributors
++ *    may be used to endorse or promote products derived from this software
++ *    without specific prior written permission.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
++ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
++ * SUCH DAMAGE.
++ *
++ *	@(#)queue.h	8.5 (Berkeley) 8/20/94
++ */
++
++#ifndef _DWC_LIST_H_
++#define _DWC_LIST_H_
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++/** @file
++ *
++ * This file defines linked list operations.  It is derived from BSD with
++ * only the MACRO names being prefixed with DWC_.  This is because a few of
++ * these names conflict with those on Linux.  For documentation on use, see the
++ * inline comments in the source code.  The original license for this source
++ * code applies and is preserved in the dwc_list.h source file.
++ */
++
++/*
++ * This file defines five types of data structures: singly-linked lists,
++ * lists, simple queues, tail queues, and circular queues.
++ *
++ *
++ * A singly-linked list is headed by a single forward pointer. The elements
++ * are singly linked for minimum space and pointer manipulation overhead at
++ * the expense of O(n) removal for arbitrary elements. New elements can be
++ * added to the list after an existing element or at the head of the list.
++ * Elements being removed from the head of the list should use the explicit
++ * macro for this purpose for optimum efficiency. A singly-linked list may
++ * only be traversed in the forward direction.  Singly-linked lists are ideal
++ * for applications with large datasets and few or no removals or for
++ * implementing a LIFO queue.
++ *
++ * A list is headed by a single forward pointer (or an array of forward
++ * pointers for a hash table header). The elements are doubly linked
++ * so that an arbitrary element can be removed without a need to
++ * traverse the list. New elements can be added to the list before
++ * or after an existing element or at the head of the list. A list
++ * may only be traversed in the forward direction.
++ *
++ * A simple queue is headed by a pair of pointers, one the head of the
++ * list and the other to the tail of the list. The elements are singly
++ * linked to save space, so elements can only be removed from the
++ * head of the list. New elements can be added to the list before or after
++ * an existing element, at the head of the list, or at the end of the
++ * list. A simple queue may only be traversed in the forward direction.
++ *
++ * A tail queue is headed by a pair of pointers, one to the head of the
++ * list and the other to the tail of the list. The elements are doubly
++ * linked so that an arbitrary element can be removed without a need to
++ * traverse the list. New elements can be added to the list before or
++ * after an existing element, at the head of the list, or at the end of
++ * the list. A tail queue may be traversed in either direction.
++ *
++ * A circle queue is headed by a pair of pointers, one to the head of the
++ * list and the other to the tail of the list. The elements are doubly
++ * linked so that an arbitrary element can be removed without a need to
++ * traverse the list. New elements can be added to the list before or after
++ * an existing element, at the head of the list, or at the end of the list.
++ * A circle queue may be traversed in either direction, but has a more
++ * complex end of list detection.
++ *
++ * For details on the use of these macros, see the queue(3) manual page.
++ */
++
++/*
++ * Double-linked List.
++ */
++
++typedef struct dwc_list_link {
++	struct dwc_list_link *next;
++	struct dwc_list_link *prev;
++} dwc_list_link_t;
++
++#define DWC_LIST_INIT(link) do {	\
++	(link)->next = (link);		\
++	(link)->prev = (link);		\
++} while (0)
++
++#define DWC_LIST_FIRST(link)	((link)->next)
++#define DWC_LIST_LAST(link)	((link)->prev)
++#define DWC_LIST_END(link)	(link)
++#define DWC_LIST_NEXT(link)	((link)->next)
++#define DWC_LIST_PREV(link)	((link)->prev)
++#define DWC_LIST_EMPTY(link)	\
++	(DWC_LIST_FIRST(link) == DWC_LIST_END(link))
++#define DWC_LIST_ENTRY(link, type, field)			\
++	(type *)((uint8_t *)(link) - (size_t)(&((type *)0)->field))
++
++#if 0
++#define DWC_LIST_INSERT_HEAD(list, link) do {			\
++	(link)->next = (list)->next;				\
++	(link)->prev = (list);					\
++	(list)->next->prev = (link);				\
++	(list)->next = (link);					\
++} while (0)
++
++#define DWC_LIST_INSERT_TAIL(list, link) do {			\
++	(link)->next = (list);					\
++	(link)->prev = (list)->prev;				\
++	(list)->prev->next = (link);				\
++	(list)->prev = (link);					\
++} while (0)
++#else
++#define DWC_LIST_INSERT_HEAD(list, link) do {			\
++	dwc_list_link_t *__next__ = (list)->next;		\
++	__next__->prev = (link);				\
++	(link)->next = __next__;				\
++	(link)->prev = (list);					\
++	(list)->next = (link);					\
++} while (0)
++
++#define DWC_LIST_INSERT_TAIL(list, link) do {			\
++	dwc_list_link_t *__prev__ = (list)->prev;		\
++	(list)->prev = (link);					\
++	(link)->next = (list);					\
++	(link)->prev = __prev__;				\
++	__prev__->next = (link);				\
++} while (0)
++#endif
++
++#if 0
++static inline void __list_add(struct list_head *new,
++                              struct list_head *prev,
++                              struct list_head *next)
++{
++        next->prev = new;
++        new->next = next;
++        new->prev = prev;
++        prev->next = new;
++}
++
++static inline void list_add(struct list_head *new, struct list_head *head)
++{
++        __list_add(new, head, head->next);
++}
++
++static inline void list_add_tail(struct list_head *new, struct list_head *head)
++{
++        __list_add(new, head->prev, head);
++}
++
++static inline void __list_del(struct list_head * prev, struct list_head * next)
++{
++        next->prev = prev;
++        prev->next = next;
++}
++
++static inline void list_del(struct list_head *entry)
++{
++        __list_del(entry->prev, entry->next);
++        entry->next = LIST_POISON1;
++        entry->prev = LIST_POISON2;
++}
++#endif
++
++#define DWC_LIST_REMOVE(link) do {				\
++	(link)->next->prev = (link)->prev;			\
++	(link)->prev->next = (link)->next;			\
++} while (0)
++
++#define DWC_LIST_REMOVE_INIT(link) do {				\
++	DWC_LIST_REMOVE(link);					\
++	DWC_LIST_INIT(link);					\
++} while (0)
++
++#define DWC_LIST_MOVE_HEAD(list, link) do {			\
++	DWC_LIST_REMOVE(link);					\
++	DWC_LIST_INSERT_HEAD(list, link);			\
++} while (0)
++
++#define DWC_LIST_MOVE_TAIL(list, link) do {			\
++	DWC_LIST_REMOVE(link);					\
++	DWC_LIST_INSERT_TAIL(list, link);			\
++} while (0)
++
++#define DWC_LIST_FOREACH(var, list)				\
++	for((var) = DWC_LIST_FIRST(list);			\
++	    (var) != DWC_LIST_END(list);			\
++	    (var) = DWC_LIST_NEXT(var))
++
++#define DWC_LIST_FOREACH_SAFE(var, var2, list)			\
++	for((var) = DWC_LIST_FIRST(list), (var2) = DWC_LIST_NEXT(var);	\
++	    (var) != DWC_LIST_END(list);			\
++	    (var) = (var2), (var2) = DWC_LIST_NEXT(var2))
++
++#define DWC_LIST_FOREACH_REVERSE(var, list)			\
++	for((var) = DWC_LIST_LAST(list);			\
++	    (var) != DWC_LIST_END(list);			\
++	    (var) = DWC_LIST_PREV(var))
++
++/*
++ * Singly-linked List definitions.
++ */
++#define DWC_SLIST_HEAD(name, type)					\
++struct name {								\
++	struct type *slh_first;	/* first element */			\
++}
++
++#define DWC_SLIST_HEAD_INITIALIZER(head)				\
++	{ NULL }
++
++#define DWC_SLIST_ENTRY(type)						\
++struct {								\
++	struct type *sle_next;	/* next element */			\
++}
++
++/*
++ * Singly-linked List access methods.
++ */
++#define DWC_SLIST_FIRST(head)	((head)->slh_first)
++#define DWC_SLIST_END(head)		NULL
++#define DWC_SLIST_EMPTY(head)	(SLIST_FIRST(head) == SLIST_END(head))
++#define DWC_SLIST_NEXT(elm, field)	((elm)->field.sle_next)
++
++#define DWC_SLIST_FOREACH(var, head, field)				\
++	for((var) = SLIST_FIRST(head);					\
++	    (var) != SLIST_END(head);					\
++	    (var) = SLIST_NEXT(var, field))
++
++#define DWC_SLIST_FOREACH_PREVPTR(var, varp, head, field)		\
++	for((varp) = &SLIST_FIRST((head));				\
++	    ((var) = *(varp)) != SLIST_END(head);			\
++	    (varp) = &SLIST_NEXT((var), field))
++
++/*
++ * Singly-linked List functions.
++ */
++#define DWC_SLIST_INIT(head) {						\
++	SLIST_FIRST(head) = SLIST_END(head);				\
++}
++
++#define DWC_SLIST_INSERT_AFTER(slistelm, elm, field) do {		\
++	(elm)->field.sle_next = (slistelm)->field.sle_next;		\
++	(slistelm)->field.sle_next = (elm);				\
++} while (0)
++
++#define DWC_SLIST_INSERT_HEAD(head, elm, field) do {			\
++	(elm)->field.sle_next = (head)->slh_first;			\
++	(head)->slh_first = (elm);					\
++} while (0)
++
++#define DWC_SLIST_REMOVE_NEXT(head, elm, field) do {			\
++	(elm)->field.sle_next = (elm)->field.sle_next->field.sle_next;	\
++} while (0)
++
++#define DWC_SLIST_REMOVE_HEAD(head, field) do {				\
++	(head)->slh_first = (head)->slh_first->field.sle_next;		\
++} while (0)
++
++#define DWC_SLIST_REMOVE(head, elm, type, field) do {			\
++	if ((head)->slh_first == (elm)) {				\
++		SLIST_REMOVE_HEAD((head), field);			\
++	}								\
++	else {								\
++		struct type *curelm = (head)->slh_first;		\
++		while( curelm->field.sle_next != (elm) )		\
++			curelm = curelm->field.sle_next;		\
++		curelm->field.sle_next =				\
++		    curelm->field.sle_next->field.sle_next;		\
++	}								\
++} while (0)
++
++/*
++ * Simple queue definitions.
++ */
++#define DWC_SIMPLEQ_HEAD(name, type)					\
++struct name {								\
++	struct type *sqh_first;	/* first element */			\
++	struct type **sqh_last;	/* addr of last next element */		\
++}
++
++#define DWC_SIMPLEQ_HEAD_INITIALIZER(head)				\
++	{ NULL, &(head).sqh_first }
++
++#define DWC_SIMPLEQ_ENTRY(type)						\
++struct {								\
++	struct type *sqe_next;	/* next element */			\
++}
++
++/*
++ * Simple queue access methods.
++ */
++#define DWC_SIMPLEQ_FIRST(head)	    ((head)->sqh_first)
++#define DWC_SIMPLEQ_END(head)	    NULL
++#define DWC_SIMPLEQ_EMPTY(head)	    (SIMPLEQ_FIRST(head) == SIMPLEQ_END(head))
++#define DWC_SIMPLEQ_NEXT(elm, field)    ((elm)->field.sqe_next)
++
++#define DWC_SIMPLEQ_FOREACH(var, head, field)				\
++	for((var) = SIMPLEQ_FIRST(head);				\
++	    (var) != SIMPLEQ_END(head);					\
++	    (var) = SIMPLEQ_NEXT(var, field))
++
++/*
++ * Simple queue functions.
++ */
++#define DWC_SIMPLEQ_INIT(head) do {					\
++	(head)->sqh_first = NULL;					\
++	(head)->sqh_last = &(head)->sqh_first;				\
++} while (0)
++
++#define DWC_SIMPLEQ_INSERT_HEAD(head, elm, field) do {			\
++	if (((elm)->field.sqe_next = (head)->sqh_first) == NULL)	\
++		(head)->sqh_last = &(elm)->field.sqe_next;		\
++	(head)->sqh_first = (elm);					\
++} while (0)
++
++#define DWC_SIMPLEQ_INSERT_TAIL(head, elm, field) do {			\
++	(elm)->field.sqe_next = NULL;					\
++	*(head)->sqh_last = (elm);					\
++	(head)->sqh_last = &(elm)->field.sqe_next;			\
++} while (0)
++
++#define DWC_SIMPLEQ_INSERT_AFTER(head, listelm, elm, field) do {	\
++	if (((elm)->field.sqe_next = (listelm)->field.sqe_next) == NULL)\
++		(head)->sqh_last = &(elm)->field.sqe_next;		\
++	(listelm)->field.sqe_next = (elm);				\
++} while (0)
++
++#define DWC_SIMPLEQ_REMOVE_HEAD(head, field) do {			\
++	if (((head)->sqh_first = (head)->sqh_first->field.sqe_next) == NULL) \
++		(head)->sqh_last = &(head)->sqh_first;			\
++} while (0)
++
++/*
++ * Tail queue definitions.
++ */
++#define DWC_TAILQ_HEAD(name, type)					\
++struct name {								\
++	struct type *tqh_first;	/* first element */			\
++	struct type **tqh_last;	/* addr of last next element */		\
++}
++
++#define DWC_TAILQ_HEAD_INITIALIZER(head)				\
++	{ NULL, &(head).tqh_first }
++
++#define DWC_TAILQ_ENTRY(type)						\
++struct {								\
++	struct type *tqe_next;	/* next element */			\
++	struct type **tqe_prev;	/* address of previous next element */	\
++}
++
++/*
++ * tail queue access methods
++ */
++#define DWC_TAILQ_FIRST(head)		((head)->tqh_first)
++#define DWC_TAILQ_END(head)		NULL
++#define DWC_TAILQ_NEXT(elm, field)	((elm)->field.tqe_next)
++#define DWC_TAILQ_LAST(head, headname)					\
++	(*(((struct headname *)((head)->tqh_last))->tqh_last))
++/* XXX */
++#define DWC_TAILQ_PREV(elm, headname, field)				\
++	(*(((struct headname *)((elm)->field.tqe_prev))->tqh_last))
++#define DWC_TAILQ_EMPTY(head)						\
++	(DWC_TAILQ_FIRST(head) == DWC_TAILQ_END(head))
++
++#define DWC_TAILQ_FOREACH(var, head, field)				\
++	for ((var) = DWC_TAILQ_FIRST(head);				\
++	    (var) != DWC_TAILQ_END(head);				\
++	    (var) = DWC_TAILQ_NEXT(var, field))
++
++#define DWC_TAILQ_FOREACH_REVERSE(var, head, headname, field)		\
++	for ((var) = DWC_TAILQ_LAST(head, headname);			\
++	    (var) != DWC_TAILQ_END(head);				\
++	    (var) = DWC_TAILQ_PREV(var, headname, field))
++
++/*
++ * Tail queue functions.
++ */
++#define DWC_TAILQ_INIT(head) do {					\
++	(head)->tqh_first = NULL;					\
++	(head)->tqh_last = &(head)->tqh_first;				\
++} while (0)
++
++#define DWC_TAILQ_INSERT_HEAD(head, elm, field) do {			\
++	if (((elm)->field.tqe_next = (head)->tqh_first) != NULL)	\
++		(head)->tqh_first->field.tqe_prev =			\
++		    &(elm)->field.tqe_next;				\
++	else								\
++		(head)->tqh_last = &(elm)->field.tqe_next;		\
++	(head)->tqh_first = (elm);					\
++	(elm)->field.tqe_prev = &(head)->tqh_first;			\
++} while (0)
++
++#define DWC_TAILQ_INSERT_TAIL(head, elm, field) do {			\
++	(elm)->field.tqe_next = NULL;					\
++	(elm)->field.tqe_prev = (head)->tqh_last;			\
++	*(head)->tqh_last = (elm);					\
++	(head)->tqh_last = &(elm)->field.tqe_next;			\
++} while (0)
++
++#define DWC_TAILQ_INSERT_AFTER(head, listelm, elm, field) do {		\
++	if (((elm)->field.tqe_next = (listelm)->field.tqe_next) != NULL)\
++		(elm)->field.tqe_next->field.tqe_prev =			\
++		    &(elm)->field.tqe_next;				\
++	else								\
++		(head)->tqh_last = &(elm)->field.tqe_next;		\
++	(listelm)->field.tqe_next = (elm);				\
++	(elm)->field.tqe_prev = &(listelm)->field.tqe_next;		\
++} while (0)
++
++#define DWC_TAILQ_INSERT_BEFORE(listelm, elm, field) do {		\
++	(elm)->field.tqe_prev = (listelm)->field.tqe_prev;		\
++	(elm)->field.tqe_next = (listelm);				\
++	*(listelm)->field.tqe_prev = (elm);				\
++	(listelm)->field.tqe_prev = &(elm)->field.tqe_next;		\
++} while (0)
++
++#define DWC_TAILQ_REMOVE(head, elm, field) do {				\
++	if (((elm)->field.tqe_next) != NULL)				\
++		(elm)->field.tqe_next->field.tqe_prev =			\
++		    (elm)->field.tqe_prev;				\
++	else								\
++		(head)->tqh_last = (elm)->field.tqe_prev;		\
++	*(elm)->field.tqe_prev = (elm)->field.tqe_next;			\
++} while (0)
++
++#define DWC_TAILQ_REPLACE(head, elm, elm2, field) do {			\
++	if (((elm2)->field.tqe_next = (elm)->field.tqe_next) != NULL)	\
++		(elm2)->field.tqe_next->field.tqe_prev =		\
++		    &(elm2)->field.tqe_next;				\
++	else								\
++		(head)->tqh_last = &(elm2)->field.tqe_next;		\
++	(elm2)->field.tqe_prev = (elm)->field.tqe_prev;			\
++	*(elm2)->field.tqe_prev = (elm2);				\
++} while (0)
++
++/*
++ * Circular queue definitions.
++ */
++#define DWC_CIRCLEQ_HEAD(name, type)					\
++struct name {								\
++	struct type *cqh_first;		/* first element */		\
++	struct type *cqh_last;		/* last element */		\
++}
++
++#define DWC_CIRCLEQ_HEAD_INITIALIZER(head)				\
++	{ DWC_CIRCLEQ_END(&head), DWC_CIRCLEQ_END(&head) }
++
++#define DWC_CIRCLEQ_ENTRY(type)						\
++struct {								\
++	struct type *cqe_next;		/* next element */		\
++	struct type *cqe_prev;		/* previous element */		\
++}
++
++/*
++ * Circular queue access methods
++ */
++#define DWC_CIRCLEQ_FIRST(head)		((head)->cqh_first)
++#define DWC_CIRCLEQ_LAST(head)		((head)->cqh_last)
++#define DWC_CIRCLEQ_END(head)		((void *)(head))
++#define DWC_CIRCLEQ_NEXT(elm, field)	((elm)->field.cqe_next)
++#define DWC_CIRCLEQ_PREV(elm, field)	((elm)->field.cqe_prev)
++#define DWC_CIRCLEQ_EMPTY(head)						\
++	(DWC_CIRCLEQ_FIRST(head) == DWC_CIRCLEQ_END(head))
++
++#define DWC_CIRCLEQ_EMPTY_ENTRY(elm, field) (((elm)->field.cqe_next == NULL) && ((elm)->field.cqe_prev == NULL))
++
++#define DWC_CIRCLEQ_FOREACH(var, head, field)				\
++	for((var) = DWC_CIRCLEQ_FIRST(head);				\
++	    (var) != DWC_CIRCLEQ_END(head);				\
++	    (var) = DWC_CIRCLEQ_NEXT(var, field))
++
++#define DWC_CIRCLEQ_FOREACH_SAFE(var, var2, head, field)			\
++	for((var) = DWC_CIRCLEQ_FIRST(head), var2 = DWC_CIRCLEQ_NEXT(var, field); \
++	    (var) != DWC_CIRCLEQ_END(head);					\
++	    (var) = var2, var2 = DWC_CIRCLEQ_NEXT(var, field))
++
++#define DWC_CIRCLEQ_FOREACH_REVERSE(var, head, field)			\
++	for((var) = DWC_CIRCLEQ_LAST(head);				\
++	    (var) != DWC_CIRCLEQ_END(head);				\
++	    (var) = DWC_CIRCLEQ_PREV(var, field))
++
++/*
++ * Circular queue functions.
++ */
++#define DWC_CIRCLEQ_INIT(head) do {					\
++	(head)->cqh_first = DWC_CIRCLEQ_END(head);			\
++	(head)->cqh_last = DWC_CIRCLEQ_END(head);			\
++} while (0)
++
++#define DWC_CIRCLEQ_INIT_ENTRY(elm, field) do {				\
++	(elm)->field.cqe_next = NULL;					\
++	(elm)->field.cqe_prev = NULL;					\
++} while (0)
++
++#define DWC_CIRCLEQ_INSERT_AFTER(head, listelm, elm, field) do {	\
++	(elm)->field.cqe_next = (listelm)->field.cqe_next;		\
++	(elm)->field.cqe_prev = (listelm);				\
++	if ((listelm)->field.cqe_next == DWC_CIRCLEQ_END(head))		\
++		(head)->cqh_last = (elm);				\
++	else								\
++		(listelm)->field.cqe_next->field.cqe_prev = (elm);	\
++	(listelm)->field.cqe_next = (elm);				\
++} while (0)
++
++#define DWC_CIRCLEQ_INSERT_BEFORE(head, listelm, elm, field) do {	\
++	(elm)->field.cqe_next = (listelm);				\
++	(elm)->field.cqe_prev = (listelm)->field.cqe_prev;		\
++	if ((listelm)->field.cqe_prev == DWC_CIRCLEQ_END(head))		\
++		(head)->cqh_first = (elm);				\
++	else								\
++		(listelm)->field.cqe_prev->field.cqe_next = (elm);	\
++	(listelm)->field.cqe_prev = (elm);				\
++} while (0)
++
++#define DWC_CIRCLEQ_INSERT_HEAD(head, elm, field) do {			\
++	(elm)->field.cqe_next = (head)->cqh_first;			\
++	(elm)->field.cqe_prev = DWC_CIRCLEQ_END(head);			\
++	if ((head)->cqh_last == DWC_CIRCLEQ_END(head))			\
++		(head)->cqh_last = (elm);				\
++	else								\
++		(head)->cqh_first->field.cqe_prev = (elm);		\
++	(head)->cqh_first = (elm);					\
++} while (0)
++
++#define DWC_CIRCLEQ_INSERT_TAIL(head, elm, field) do {			\
++	(elm)->field.cqe_next = DWC_CIRCLEQ_END(head);			\
++	(elm)->field.cqe_prev = (head)->cqh_last;			\
++	if ((head)->cqh_first == DWC_CIRCLEQ_END(head))			\
++		(head)->cqh_first = (elm);				\
++	else								\
++		(head)->cqh_last->field.cqe_next = (elm);		\
++	(head)->cqh_last = (elm);					\
++} while (0)
++
++#define DWC_CIRCLEQ_REMOVE(head, elm, field) do {			\
++	if ((elm)->field.cqe_next == DWC_CIRCLEQ_END(head))		\
++		(head)->cqh_last = (elm)->field.cqe_prev;		\
++	else								\
++		(elm)->field.cqe_next->field.cqe_prev =			\
++		    (elm)->field.cqe_prev;				\
++	if ((elm)->field.cqe_prev == DWC_CIRCLEQ_END(head))		\
++		(head)->cqh_first = (elm)->field.cqe_next;		\
++	else								\
++		(elm)->field.cqe_prev->field.cqe_next =			\
++		    (elm)->field.cqe_next;				\
++} while (0)
++
++#define DWC_CIRCLEQ_REMOVE_INIT(head, elm, field) do {			\
++	DWC_CIRCLEQ_REMOVE(head, elm, field);				\
++	DWC_CIRCLEQ_INIT_ENTRY(elm, field);				\
++} while (0)
++
++#define DWC_CIRCLEQ_REPLACE(head, elm, elm2, field) do {		\
++	if (((elm2)->field.cqe_next = (elm)->field.cqe_next) ==		\
++	    DWC_CIRCLEQ_END(head))					\
++		(head).cqh_last = (elm2);				\
++	else								\
++		(elm2)->field.cqe_next->field.cqe_prev = (elm2);	\
++	if (((elm2)->field.cqe_prev = (elm)->field.cqe_prev) ==		\
++	    DWC_CIRCLEQ_END(head))					\
++		(head).cqh_first = (elm2);				\
++	else								\
++		(elm2)->field.cqe_prev->field.cqe_next = (elm2);	\
++} while (0)
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* _DWC_LIST_H_ */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_mem.c
+@@ -0,0 +1,245 @@
++/* Memory Debugging */
++#ifdef DWC_DEBUG_MEMORY
++
++#include "dwc_os.h"
++#include "dwc_list.h"
++
++struct allocation {
++	void *addr;
++	void *ctx;
++	char *func;
++	int line;
++	uint32_t size;
++	int dma;
++	DWC_CIRCLEQ_ENTRY(allocation) entry;
++};
++
++DWC_CIRCLEQ_HEAD(allocation_queue, allocation);
++
++struct allocation_manager {
++	void *mem_ctx;
++	struct allocation_queue allocations;
++
++	/* statistics */
++	int num;
++	int num_freed;
++	int num_active;
++	uint32_t total;
++	uint32_t cur;
++	uint32_t max;
++};
++
++static struct allocation_manager *manager = NULL;
++
++static int add_allocation(void *ctx, uint32_t size, char const *func, int line, void *addr,
++			  int dma)
++{
++	struct allocation *a;
++
++	DWC_ASSERT(manager != NULL, "manager not allocated");
++
++	a = __DWC_ALLOC_ATOMIC(manager->mem_ctx, sizeof(*a));
++	if (!a) {
++		return -DWC_E_NO_MEMORY;
++	}
++
++	a->func = __DWC_ALLOC_ATOMIC(manager->mem_ctx, DWC_STRLEN(func) + 1);
++	if (!a->func) {
++		__DWC_FREE(manager->mem_ctx, a);
++		return -DWC_E_NO_MEMORY;
++	}
++
++	DWC_MEMCPY(a->func, func, DWC_STRLEN(func) + 1);
++	a->addr = addr;
++	a->ctx = ctx;
++	a->line = line;
++	a->size = size;
++	a->dma = dma;
++	DWC_CIRCLEQ_INSERT_TAIL(&manager->allocations, a, entry);
++
++	/* Update stats */
++	manager->num++;
++	manager->num_active++;
++	manager->total += size;
++	manager->cur += size;
++
++	if (manager->max < manager->cur) {
++		manager->max = manager->cur;
++	}
++
++	return 0;
++}
++
++static struct allocation *find_allocation(void *ctx, void *addr)
++{
++	struct allocation *a;
++
++	DWC_CIRCLEQ_FOREACH(a, &manager->allocations, entry) {
++		if (a->ctx == ctx && a->addr == addr) {
++			return a;
++		}
++	}
++
++	return NULL;
++}
++
++static void free_allocation(void *ctx, void *addr, char const *func, int line)
++{
++	struct allocation *a = find_allocation(ctx, addr);
++
++	if (!a) {
++		DWC_ASSERT(0,
++			   "Free of address %p that was never allocated or already freed %s:%d",
++			   addr, func, line);
++		return;
++	}
++
++	DWC_CIRCLEQ_REMOVE(&manager->allocations, a, entry);
++
++	manager->num_active--;
++	manager->num_freed++;
++	manager->cur -= a->size;
++	__DWC_FREE(manager->mem_ctx, a->func);
++	__DWC_FREE(manager->mem_ctx, a);
++}
++
++int dwc_memory_debug_start(void *mem_ctx)
++{
++	DWC_ASSERT(manager == NULL, "Memory debugging has already started\n");
++
++	if (manager) {
++		return -DWC_E_BUSY;
++	}
++
++	manager = __DWC_ALLOC(mem_ctx, sizeof(*manager));
++	if (!manager) {
++		return -DWC_E_NO_MEMORY;
++	}
++
++	DWC_CIRCLEQ_INIT(&manager->allocations);
++	manager->mem_ctx = mem_ctx;
++	manager->num = 0;
++	manager->num_freed = 0;
++	manager->num_active = 0;
++	manager->total = 0;
++	manager->cur = 0;
++	manager->max = 0;
++
++	return 0;
++}
++
++void dwc_memory_debug_stop(void)
++{
++	struct allocation *a;
++
++	dwc_memory_debug_report();
++
++	DWC_CIRCLEQ_FOREACH(a, &manager->allocations, entry) {
++		DWC_ERROR("Memory leaked from %s:%d\n", a->func, a->line);
++		free_allocation(a->ctx, a->addr, NULL, -1);
++	}
++
++	__DWC_FREE(manager->mem_ctx, manager);
++}
++
++void dwc_memory_debug_report(void)
++{
++	struct allocation *a;
++
++	DWC_PRINTF("\n\n\n----------------- Memory Debugging Report -----------------\n\n");
++	DWC_PRINTF("Num Allocations = %d\n", manager->num);
++	DWC_PRINTF("Freed = %d\n", manager->num_freed);
++	DWC_PRINTF("Active = %d\n", manager->num_active);
++	DWC_PRINTF("Current Memory Used = %d\n", manager->cur);
++	DWC_PRINTF("Total Memory Used = %d\n", manager->total);
++	DWC_PRINTF("Maximum Memory Used at Once = %d\n", manager->max);
++	DWC_PRINTF("Unfreed allocations:\n");
++
++	DWC_CIRCLEQ_FOREACH(a, &manager->allocations, entry) {
++		DWC_PRINTF("    addr=%p, size=%d from %s:%d, DMA=%d\n",
++			   a->addr, a->size, a->func, a->line, a->dma);
++	}
++}
++
++/* The replacement functions */
++void *dwc_alloc_debug(void *mem_ctx, uint32_t size, char const *func, int line)
++{
++	void *addr = __DWC_ALLOC(mem_ctx, size);
++
++	if (!addr) {
++		return NULL;
++	}
++
++	if (add_allocation(mem_ctx, size, func, line, addr, 0)) {
++		__DWC_FREE(mem_ctx, addr);
++		return NULL;
++	}
++
++	return addr;
++}
++
++void *dwc_alloc_atomic_debug(void *mem_ctx, uint32_t size, char const *func,
++			     int line)
++{
++	void *addr = __DWC_ALLOC_ATOMIC(mem_ctx, size);
++
++	if (!addr) {
++		return NULL;
++	}
++
++	if (add_allocation(mem_ctx, size, func, line, addr, 0)) {
++		__DWC_FREE(mem_ctx, addr);
++		return NULL;
++	}
++
++	return addr;
++}
++
++void dwc_free_debug(void *mem_ctx, void *addr, char const *func, int line)
++{
++	free_allocation(mem_ctx, addr, func, line);
++	__DWC_FREE(mem_ctx, addr);
++}
++
++void *dwc_dma_alloc_debug(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr,
++			  char const *func, int line)
++{
++	void *addr = __DWC_DMA_ALLOC(dma_ctx, size, dma_addr);
++
++	if (!addr) {
++		return NULL;
++	}
++
++	if (add_allocation(dma_ctx, size, func, line, addr, 1)) {
++		__DWC_DMA_FREE(dma_ctx, size, addr, *dma_addr);
++		return NULL;
++	}
++
++	return addr;
++}
++
++void *dwc_dma_alloc_atomic_debug(void *dma_ctx, uint32_t size,
++				 dwc_dma_t *dma_addr, char const *func, int line)
++{
++	void *addr = __DWC_DMA_ALLOC_ATOMIC(dma_ctx, size, dma_addr);
++
++	if (!addr) {
++		return NULL;
++	}
++
++	if (add_allocation(dma_ctx, size, func, line, addr, 1)) {
++		__DWC_DMA_FREE(dma_ctx, size, addr, *dma_addr);
++		return NULL;
++	}
++
++	return addr;
++}
++
++void dwc_dma_free_debug(void *dma_ctx, uint32_t size, void *virt_addr,
++			dwc_dma_t dma_addr, char const *func, int line)
++{
++	free_allocation(dma_ctx, virt_addr, func, line);
++	__DWC_DMA_FREE(dma_ctx, size, virt_addr, dma_addr);
++}
++
++#endif /* DWC_DEBUG_MEMORY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_modpow.c
+@@ -0,0 +1,636 @@
++/* Bignum routines adapted from PUTTY sources.  PuTTY copyright notice follows.
++ *
++ * PuTTY is copyright 1997-2007 Simon Tatham.
++ *
++ * Portions copyright Robert de Bath, Joris van Rantwijk, Delian
++ * Delchev, Andreas Schultz, Jeroen Massar, Wez Furlong, Nicolas Barry,
++ * Justin Bradford, Ben Harris, Malcolm Smith, Ahmad Khalifa, Markus
++ * Kuhn, and CORE SDI S.A.
++ *
++ * Permission is hereby granted, free of charge, to any person
++ * obtaining a copy of this software and associated documentation files
++ * (the "Software"), to deal in the Software without restriction,
++ * including without limitation the rights to use, copy, modify, merge,
++ * publish, distribute, sublicense, and/or sell copies of the Software,
++ * and to permit persons to whom the Software is furnished to do so,
++ * subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be
++ * included in all copies or substantial portions of the Software.
++
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
++ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
++ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
++ * NONINFRINGEMENT.  IN NO EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE
++ * FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
++ * CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
++ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
++ *
++ */
++#ifdef DWC_CRYPTOLIB
++
++#ifndef CONFIG_MACH_IPMATE
++
++#include "dwc_modpow.h"
++
++#define BIGNUM_INT_MASK  0xFFFFFFFFUL
++#define BIGNUM_TOP_BIT   0x80000000UL
++#define BIGNUM_INT_BITS  32
++
++
++static void *snmalloc(void *mem_ctx, size_t n, size_t size)
++{
++    void *p;
++    size *= n;
++    if (size == 0) size = 1;
++    p = dwc_alloc(mem_ctx, size);
++    return p;
++}
++
++#define snewn(ctx, n, type) ((type *)snmalloc((ctx), (n), sizeof(type)))
++#define sfree dwc_free
++
++/*
++ * Usage notes:
++ *  * Do not call the DIVMOD_WORD macro with expressions such as array
++ *    subscripts, as some implementations object to this (see below).
++ *  * Note that none of the division methods below will cope if the
++ *    quotient won't fit into BIGNUM_INT_BITS. Callers should be careful
++ *    to avoid this case.
++ *    If this condition occurs, in the case of the x86 DIV instruction,
++ *    an overflow exception will occur, which (according to a correspondent)
++ *    will manifest on Windows as something like
++ *      0xC0000095: Integer overflow
++ *    The C variant won't give the right answer, either.
++ */
++
++#define MUL_WORD(w1, w2) ((BignumDblInt)w1 * w2)
++
++#if defined __GNUC__ && defined __i386__
++#define DIVMOD_WORD(q, r, hi, lo, w) \
++    __asm__("div %2" : \
++	    "=d" (r), "=a" (q) : \
++	    "r" (w), "d" (hi), "a" (lo))
++#else
++#define DIVMOD_WORD(q, r, hi, lo, w) do { \
++    BignumDblInt n = (((BignumDblInt)hi) << BIGNUM_INT_BITS) | lo; \
++    q = n / w; \
++    r = n % w; \
++} while (0)
++#endif
++
++//    q = n / w;
++//    r = n % w;
++
++#define BIGNUM_INT_BYTES (BIGNUM_INT_BITS / 8)
++
++#define BIGNUM_INTERNAL
++
++static Bignum newbn(void *mem_ctx, int length)
++{
++    Bignum b = snewn(mem_ctx, length + 1, BignumInt);
++    //if (!b)
++    //abort();		       /* FIXME */
++    DWC_MEMSET(b, 0, (length + 1) * sizeof(*b));
++    b[0] = length;
++    return b;
++}
++
++void freebn(void *mem_ctx, Bignum b)
++{
++    /*
++     * Burn the evidence, just in case.
++     */
++    DWC_MEMSET(b, 0, sizeof(b[0]) * (b[0] + 1));
++    sfree(mem_ctx, b);
++}
++
++/*
++ * Compute c = a * b.
++ * Input is in the first len words of a and b.
++ * Result is returned in the first 2*len words of c.
++ */
++static void internal_mul(BignumInt *a, BignumInt *b,
++			 BignumInt *c, int len)
++{
++    int i, j;
++    BignumDblInt t;
++
++    for (j = 0; j < 2 * len; j++)
++	c[j] = 0;
++
++    for (i = len - 1; i >= 0; i--) {
++	t = 0;
++	for (j = len - 1; j >= 0; j--) {
++	    t += MUL_WORD(a[i], (BignumDblInt) b[j]);
++	    t += (BignumDblInt) c[i + j + 1];
++	    c[i + j + 1] = (BignumInt) t;
++	    t = t >> BIGNUM_INT_BITS;
++	}
++	c[i] = (BignumInt) t;
++    }
++}
++
++static void internal_add_shifted(BignumInt *number,
++				 unsigned n, int shift)
++{
++    int word = 1 + (shift / BIGNUM_INT_BITS);
++    int bshift = shift % BIGNUM_INT_BITS;
++    BignumDblInt addend;
++
++    addend = (BignumDblInt)n << bshift;
++
++    while (addend) {
++	addend += number[word];
++	number[word] = (BignumInt) addend & BIGNUM_INT_MASK;
++	addend >>= BIGNUM_INT_BITS;
++	word++;
++    }
++}
++
++/*
++ * Compute a = a % m.
++ * Input in first alen words of a and first mlen words of m.
++ * Output in first alen words of a
++ * (of which first alen-mlen words will be zero).
++ * The MSW of m MUST have its high bit set.
++ * Quotient is accumulated in the `quotient' array, which is a Bignum
++ * rather than the internal bigendian format. Quotient parts are shifted
++ * left by `qshift' before adding into quot.
++ */
++static void internal_mod(BignumInt *a, int alen,
++			 BignumInt *m, int mlen,
++			 BignumInt *quot, int qshift)
++{
++    BignumInt m0, m1;
++    unsigned int h;
++    int i, k;
++
++    m0 = m[0];
++    if (mlen > 1)
++	m1 = m[1];
++    else
++	m1 = 0;
++
++    for (i = 0; i <= alen - mlen; i++) {
++	BignumDblInt t;
++	unsigned int q, r, c, ai1;
++
++	if (i == 0) {
++	    h = 0;
++	} else {
++	    h = a[i - 1];
++	    a[i - 1] = 0;
++	}
++
++	if (i == alen - 1)
++	    ai1 = 0;
++	else
++	    ai1 = a[i + 1];
++
++	/* Find q = h:a[i] / m0 */
++	if (h >= m0) {
++	    /*
++	     * Special case.
++	     *
++	     * To illustrate it, suppose a BignumInt is 8 bits, and
++	     * we are dividing (say) A1:23:45:67 by A1:B2:C3. Then
++	     * our initial division will be 0xA123 / 0xA1, which
++	     * will give a quotient of 0x100 and a divide overflow.
++	     * However, the invariants in this division algorithm
++	     * are not violated, since the full number A1:23:... is
++	     * _less_ than the quotient prefix A1:B2:... and so the
++	     * following correction loop would have sorted it out.
++	     *
++	     * In this situation we set q to be the largest
++	     * quotient we _can_ stomach (0xFF, of course).
++	     */
++	    q = BIGNUM_INT_MASK;
++	} else {
++	    /* Macro doesn't want an array subscript expression passed
++	     * into it (see definition), so use a temporary. */
++	    BignumInt tmplo = a[i];
++	    DIVMOD_WORD(q, r, h, tmplo, m0);
++
++	    /* Refine our estimate of q by looking at
++	     h:a[i]:a[i+1] / m0:m1 */
++	    t = MUL_WORD(m1, q);
++	    if (t > ((BignumDblInt) r << BIGNUM_INT_BITS) + ai1) {
++		q--;
++		t -= m1;
++		r = (r + m0) & BIGNUM_INT_MASK;     /* overflow? */
++		if (r >= (BignumDblInt) m0 &&
++		    t > ((BignumDblInt) r << BIGNUM_INT_BITS) + ai1) q--;
++	    }
++	}
++
++	/* Subtract q * m from a[i...] */
++	c = 0;
++	for (k = mlen - 1; k >= 0; k--) {
++	    t = MUL_WORD(q, m[k]);
++	    t += c;
++	    c = (unsigned)(t >> BIGNUM_INT_BITS);
++	    if ((BignumInt) t > a[i + k])
++		c++;
++	    a[i + k] -= (BignumInt) t;
++	}
++
++	/* Add back m in case of borrow */
++	if (c != h) {
++	    t = 0;
++	    for (k = mlen - 1; k >= 0; k--) {
++		t += m[k];
++		t += a[i + k];
++		a[i + k] = (BignumInt) t;
++		t = t >> BIGNUM_INT_BITS;
++	    }
++	    q--;
++	}
++	if (quot)
++	    internal_add_shifted(quot, q, qshift + BIGNUM_INT_BITS * (alen - mlen - i));
++    }
++}
++
++/*
++ * Compute p % mod.
++ * The most significant word of mod MUST be non-zero.
++ * We assume that the result array is the same size as the mod array.
++ * We optionally write out a quotient if `quotient' is non-NULL.
++ * We can avoid writing out the result if `result' is NULL.
++ */
++void bigdivmod(void *mem_ctx, Bignum p, Bignum mod, Bignum result, Bignum quotient)
++{
++    BignumInt *n, *m;
++    int mshift;
++    int plen, mlen, i, j;
++
++    /* Allocate m of size mlen, copy mod to m */
++    /* We use big endian internally */
++    mlen = mod[0];
++    m = snewn(mem_ctx, mlen, BignumInt);
++    //if (!m)
++    //abort();		       /* FIXME */
++    for (j = 0; j < mlen; j++)
++	m[j] = mod[mod[0] - j];
++
++    /* Shift m left to make msb bit set */
++    for (mshift = 0; mshift < BIGNUM_INT_BITS-1; mshift++)
++	if ((m[0] << mshift) & BIGNUM_TOP_BIT)
++	    break;
++    if (mshift) {
++	for (i = 0; i < mlen - 1; i++)
++	    m[i] = (m[i] << mshift) | (m[i + 1] >> (BIGNUM_INT_BITS - mshift));
++	m[mlen - 1] = m[mlen - 1] << mshift;
++    }
++
++    plen = p[0];
++    /* Ensure plen > mlen */
++    if (plen <= mlen)
++	plen = mlen + 1;
++
++    /* Allocate n of size plen, copy p to n */
++    n = snewn(mem_ctx, plen, BignumInt);
++    //if (!n)
++    //abort();		       /* FIXME */
++    for (j = 0; j < plen; j++)
++	n[j] = 0;
++    for (j = 1; j <= (int)p[0]; j++)
++	n[plen - j] = p[j];
++
++    /* Main computation */
++    internal_mod(n, plen, m, mlen, quotient, mshift);
++
++    /* Fixup result in case the modulus was shifted */
++    if (mshift) {
++	for (i = plen - mlen - 1; i < plen - 1; i++)
++	    n[i] = (n[i] << mshift) | (n[i + 1] >> (BIGNUM_INT_BITS - mshift));
++	n[plen - 1] = n[plen - 1] << mshift;
++	internal_mod(n, plen, m, mlen, quotient, 0);
++	for (i = plen - 1; i >= plen - mlen; i--)
++	    n[i] = (n[i] >> mshift) | (n[i - 1] << (BIGNUM_INT_BITS - mshift));
++    }
++
++    /* Copy result to buffer */
++    if (result) {
++	for (i = 1; i <= (int)result[0]; i++) {
++	    int j = plen - i;
++	    result[i] = j >= 0 ? n[j] : 0;
++	}
++    }
++
++    /* Free temporary arrays */
++    for (i = 0; i < mlen; i++)
++	m[i] = 0;
++    sfree(mem_ctx, m);
++    for (i = 0; i < plen; i++)
++	n[i] = 0;
++    sfree(mem_ctx, n);
++}
++
++/*
++ * Simple remainder.
++ */
++Bignum bigmod(void *mem_ctx, Bignum a, Bignum b)
++{
++    Bignum r = newbn(mem_ctx, b[0]);
++    bigdivmod(mem_ctx, a, b, r, NULL);
++    return r;
++}
++
++/*
++ * Compute (base ^ exp) % mod.
++ */
++Bignum dwc_modpow(void *mem_ctx, Bignum base_in, Bignum exp, Bignum mod)
++{
++    BignumInt *a, *b, *n, *m;
++    int mshift;
++    int mlen, i, j;
++    Bignum base, result;
++
++    /*
++     * The most significant word of mod needs to be non-zero. It
++     * should already be, but let's make sure.
++     */
++    //assert(mod[mod[0]] != 0);
++
++    /*
++     * Make sure the base is smaller than the modulus, by reducing
++     * it modulo the modulus if not.
++     */
++    base = bigmod(mem_ctx, base_in, mod);
++
++    /* Allocate m of size mlen, copy mod to m */
++    /* We use big endian internally */
++    mlen = mod[0];
++    m = snewn(mem_ctx, mlen, BignumInt);
++    //if (!m)
++    //abort();		       /* FIXME */
++    for (j = 0; j < mlen; j++)
++	m[j] = mod[mod[0] - j];
++
++    /* Shift m left to make msb bit set */
++    for (mshift = 0; mshift < BIGNUM_INT_BITS - 1; mshift++)
++	if ((m[0] << mshift) & BIGNUM_TOP_BIT)
++	    break;
++    if (mshift) {
++	for (i = 0; i < mlen - 1; i++)
++	    m[i] =
++		(m[i] << mshift) | (m[i + 1] >>
++				    (BIGNUM_INT_BITS - mshift));
++	m[mlen - 1] = m[mlen - 1] << mshift;
++    }
++
++    /* Allocate n of size mlen, copy base to n */
++    n = snewn(mem_ctx, mlen, BignumInt);
++    //if (!n)
++    //abort();		       /* FIXME */
++    i = mlen - base[0];
++    for (j = 0; j < i; j++)
++	n[j] = 0;
++    for (j = 0; j < base[0]; j++)
++	n[i + j] = base[base[0] - j];
++
++    /* Allocate a and b of size 2*mlen. Set a = 1 */
++    a = snewn(mem_ctx, 2 * mlen, BignumInt);
++    //if (!a)
++    //abort();		       /* FIXME */
++    b = snewn(mem_ctx, 2 * mlen, BignumInt);
++    //if (!b)
++    //abort();		       /* FIXME */
++    for (i = 0; i < 2 * mlen; i++)
++	a[i] = 0;
++    a[2 * mlen - 1] = 1;
++
++    /* Skip leading zero bits of exp. */
++    i = 0;
++    j = BIGNUM_INT_BITS - 1;
++    while (i < exp[0] && (exp[exp[0] - i] & (1 << j)) == 0) {
++	j--;
++	if (j < 0) {
++	    i++;
++	    j = BIGNUM_INT_BITS - 1;
++	}
++    }
++
++    /* Main computation */
++    while (i < exp[0]) {
++	while (j >= 0) {
++	    internal_mul(a + mlen, a + mlen, b, mlen);
++	    internal_mod(b, mlen * 2, m, mlen, NULL, 0);
++	    if ((exp[exp[0] - i] & (1 << j)) != 0) {
++		internal_mul(b + mlen, n, a, mlen);
++		internal_mod(a, mlen * 2, m, mlen, NULL, 0);
++	    } else {
++		BignumInt *t;
++		t = a;
++		a = b;
++		b = t;
++	    }
++	    j--;
++	}
++	i++;
++	j = BIGNUM_INT_BITS - 1;
++    }
++
++    /* Fixup result in case the modulus was shifted */
++    if (mshift) {
++	for (i = mlen - 1; i < 2 * mlen - 1; i++)
++	    a[i] =
++		(a[i] << mshift) | (a[i + 1] >>
++				    (BIGNUM_INT_BITS - mshift));
++	a[2 * mlen - 1] = a[2 * mlen - 1] << mshift;
++	internal_mod(a, mlen * 2, m, mlen, NULL, 0);
++	for (i = 2 * mlen - 1; i >= mlen; i--)
++	    a[i] =
++		(a[i] >> mshift) | (a[i - 1] <<
++				    (BIGNUM_INT_BITS - mshift));
++    }
++
++    /* Copy result to buffer */
++    result = newbn(mem_ctx, mod[0]);
++    for (i = 0; i < mlen; i++)
++	result[result[0] - i] = a[i + mlen];
++    while (result[0] > 1 && result[result[0]] == 0)
++	result[0]--;
++
++    /* Free temporary arrays */
++    for (i = 0; i < 2 * mlen; i++)
++	a[i] = 0;
++    sfree(mem_ctx, a);
++    for (i = 0; i < 2 * mlen; i++)
++	b[i] = 0;
++    sfree(mem_ctx, b);
++    for (i = 0; i < mlen; i++)
++	m[i] = 0;
++    sfree(mem_ctx, m);
++    for (i = 0; i < mlen; i++)
++	n[i] = 0;
++    sfree(mem_ctx, n);
++
++    freebn(mem_ctx, base);
++
++    return result;
++}
++
++
++#ifdef UNITTEST
++
++static __u32 dh_p[] = {
++	96,
++	0xFFFFFFFF,
++	0xFFFFFFFF,
++	0xA93AD2CA,
++	0x4B82D120,
++	0xE0FD108E,
++	0x43DB5BFC,
++	0x74E5AB31,
++	0x08E24FA0,
++	0xBAD946E2,
++	0x770988C0,
++	0x7A615D6C,
++	0xBBE11757,
++	0x177B200C,
++	0x521F2B18,
++	0x3EC86A64,
++	0xD8760273,
++	0xD98A0864,
++	0xF12FFA06,
++	0x1AD2EE6B,
++	0xCEE3D226,
++	0x4A25619D,
++	0x1E8C94E0,
++	0xDB0933D7,
++	0xABF5AE8C,
++	0xA6E1E4C7,
++	0xB3970F85,
++	0x5D060C7D,
++	0x8AEA7157,
++	0x58DBEF0A,
++	0xECFB8504,
++	0xDF1CBA64,
++	0xA85521AB,
++	0x04507A33,
++	0xAD33170D,
++	0x8AAAC42D,
++	0x15728E5A,
++	0x98FA0510,
++	0x15D22618,
++	0xEA956AE5,
++	0x3995497C,
++	0x95581718,
++	0xDE2BCBF6,
++	0x6F4C52C9,
++	0xB5C55DF0,
++	0xEC07A28F,
++	0x9B2783A2,
++	0x180E8603,
++	0xE39E772C,
++	0x2E36CE3B,
++	0x32905E46,
++	0xCA18217C,
++	0xF1746C08,
++	0x4ABC9804,
++	0x670C354E,
++	0x7096966D,
++	0x9ED52907,
++	0x208552BB,
++	0x1C62F356,
++	0xDCA3AD96,
++	0x83655D23,
++	0xFD24CF5F,
++	0x69163FA8,
++	0x1C55D39A,
++	0x98DA4836,
++	0xA163BF05,
++	0xC2007CB8,
++	0xECE45B3D,
++	0x49286651,
++	0x7C4B1FE6,
++	0xAE9F2411,
++	0x5A899FA5,
++	0xEE386BFB,
++	0xF406B7ED,
++	0x0BFF5CB6,
++	0xA637ED6B,
++	0xF44C42E9,
++	0x625E7EC6,
++	0xE485B576,
++	0x6D51C245,
++	0x4FE1356D,
++	0xF25F1437,
++	0x302B0A6D,
++	0xCD3A431B,
++	0xEF9519B3,
++	0x8E3404DD,
++	0x514A0879,
++	0x3B139B22,
++	0x020BBEA6,
++	0x8A67CC74,
++	0x29024E08,
++	0x80DC1CD1,
++	0xC4C6628B,
++	0x2168C234,
++	0xC90FDAA2,
++	0xFFFFFFFF,
++	0xFFFFFFFF,
++};
++
++static __u32 dh_a[] = {
++	8,
++	0xdf367516,
++	0x86459caa,
++	0xe2d459a4,
++	0xd910dae0,
++	0x8a8b5e37,
++	0x67ab31c6,
++	0xf0b55ea9,
++	0x440051d6,
++};
++
++static __u32 dh_b[] = {
++	8,
++	0xded92656,
++	0xe07a048a,
++	0x6fa452cd,
++	0x2df89d30,
++	0xc75f1b0f,
++	0x8ce3578f,
++	0x7980a324,
++	0x5daec786,
++};
++
++static __u32 dh_g[] = {
++	1,
++	2,
++};
++
++int main(void)
++{
++	int i;
++	__u32 *k;
++	k = dwc_modpow(NULL, dh_g, dh_a, dh_p);
++
++	printf("\n\n");
++	for (i=0; i<k[0]; i++) {
++		__u32 word32 = k[k[0] - i];
++		__u16 l = word32 & 0xffff;
++		__u16 m = (word32 & 0xffff0000) >> 16;
++		printf("%04x %04x ", m, l);
++		if (!((i + 1)%13)) printf("\n");
++	}
++	printf("\n\n");
++
++	if ((k[0] == 0x60) && (k[1] == 0x28e490e5) && (k[0x60] == 0x5a0d3d4e)) {
++		printf("PASS\n\n");
++	}
++	else {
++		printf("FAIL\n\n");
++	}
++
++}
++
++#endif /* UNITTEST */
++
++#endif /* CONFIG_MACH_IPMATE */
++
++#endif /*DWC_CRYPTOLIB */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_modpow.h
+@@ -0,0 +1,34 @@
++/*
++ * dwc_modpow.h
++ * See dwc_modpow.c for license and changes
++ */
++#ifndef _DWC_MODPOW_H
++#define _DWC_MODPOW_H
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++#include "dwc_os.h"
++
++/** @file
++ *
++ * This file defines the module exponentiation function which is only used
++ * internally by the DWC UWB modules for calculation of PKs during numeric
++ * association.  The routine is taken from the PUTTY, an open source terminal
++ * emulator.  The PUTTY License is preserved in the dwc_modpow.c file.
++ *
++ */
++
++typedef uint32_t BignumInt;
++typedef uint64_t BignumDblInt;
++typedef BignumInt *Bignum;
++
++/* Compute modular exponentiaion */
++extern Bignum dwc_modpow(void *mem_ctx, Bignum base_in, Bignum exp, Bignum mod);
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* _LINUX_BIGNUM_H */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_notifier.c
+@@ -0,0 +1,319 @@
++#ifdef DWC_NOTIFYLIB
++
++#include "dwc_notifier.h"
++#include "dwc_list.h"
++
++typedef struct dwc_observer {
++	void *observer;
++	dwc_notifier_callback_t callback;
++	void *data;
++	char *notification;
++	DWC_CIRCLEQ_ENTRY(dwc_observer) list_entry;
++} observer_t;
++
++DWC_CIRCLEQ_HEAD(observer_queue, dwc_observer);
++
++typedef struct dwc_notifier {
++	void *mem_ctx;
++	void *object;
++	struct observer_queue observers;
++	DWC_CIRCLEQ_ENTRY(dwc_notifier) list_entry;
++} notifier_t;
++
++DWC_CIRCLEQ_HEAD(notifier_queue, dwc_notifier);
++
++typedef struct manager {
++	void *mem_ctx;
++	void *wkq_ctx;
++	dwc_workq_t *wq;
++//	dwc_mutex_t *mutex;
++	struct notifier_queue notifiers;
++} manager_t;
++
++static manager_t *manager = NULL;
++
++static int create_manager(void *mem_ctx, void *wkq_ctx)
++{
++	manager = dwc_alloc(mem_ctx, sizeof(manager_t));
++	if (!manager) {
++		return -DWC_E_NO_MEMORY;
++	}
++
++	DWC_CIRCLEQ_INIT(&manager->notifiers);
++
++	manager->wq = dwc_workq_alloc(wkq_ctx, "DWC Notification WorkQ");
++	if (!manager->wq) {
++		return -DWC_E_NO_MEMORY;
++	}
++
++	return 0;
++}
++
++static void free_manager(void)
++{
++	dwc_workq_free(manager->wq);
++
++	/* All notifiers must have unregistered themselves before this module
++	 * can be removed.  Hitting this assertion indicates a programmer
++	 * error. */
++	DWC_ASSERT(DWC_CIRCLEQ_EMPTY(&manager->notifiers),
++		   "Notification manager being freed before all notifiers have been removed");
++	dwc_free(manager->mem_ctx, manager);
++}
++
++#ifdef DEBUG
++static void dump_manager(void)
++{
++	notifier_t *n;
++	observer_t *o;
++
++	DWC_ASSERT(manager, "Notification manager not found");
++
++	DWC_DEBUG("List of all notifiers and observers:\n");
++	DWC_CIRCLEQ_FOREACH(n, &manager->notifiers, list_entry) {
++		DWC_DEBUG("Notifier %p has observers:\n", n->object);
++		DWC_CIRCLEQ_FOREACH(o, &n->observers, list_entry) {
++			DWC_DEBUG("    %p watching %s\n", o->observer, o->notification);
++		}
++	}
++}
++#else
++#define dump_manager(...)
++#endif
++
++static observer_t *alloc_observer(void *mem_ctx, void *observer, char *notification,
++				  dwc_notifier_callback_t callback, void *data)
++{
++	observer_t *new_observer = dwc_alloc(mem_ctx, sizeof(observer_t));
++
++	if (!new_observer) {
++		return NULL;
++	}
++
++	DWC_CIRCLEQ_INIT_ENTRY(new_observer, list_entry);
++	new_observer->observer = observer;
++	new_observer->notification = notification;
++	new_observer->callback = callback;
++	new_observer->data = data;
++	return new_observer;
++}
++
++static void free_observer(void *mem_ctx, observer_t *observer)
++{
++	dwc_free(mem_ctx, observer);
++}
++
++static notifier_t *alloc_notifier(void *mem_ctx, void *object)
++{
++	notifier_t *notifier;
++
++	if (!object) {
++		return NULL;
++	}
++
++	notifier = dwc_alloc(mem_ctx, sizeof(notifier_t));
++	if (!notifier) {
++		return NULL;
++	}
++
++	DWC_CIRCLEQ_INIT(&notifier->observers);
++	DWC_CIRCLEQ_INIT_ENTRY(notifier, list_entry);
++
++	notifier->mem_ctx = mem_ctx;
++	notifier->object = object;
++	return notifier;
++}
++
++static void free_notifier(notifier_t *notifier)
++{
++	observer_t *observer;
++
++	DWC_CIRCLEQ_FOREACH(observer, &notifier->observers, list_entry) {
++		free_observer(notifier->mem_ctx, observer);
++	}
++
++	dwc_free(notifier->mem_ctx, notifier);
++}
++
++static notifier_t *find_notifier(void *object)
++{
++	notifier_t *notifier;
++
++	DWC_ASSERT(manager, "Notification manager not found");
++
++	if (!object) {
++		return NULL;
++	}
++
++	DWC_CIRCLEQ_FOREACH(notifier, &manager->notifiers, list_entry) {
++		if (notifier->object == object) {
++			return notifier;
++		}
++	}
++
++	return NULL;
++}
++
++int dwc_alloc_notification_manager(void *mem_ctx, void *wkq_ctx)
++{
++	return create_manager(mem_ctx, wkq_ctx);
++}
++
++void dwc_free_notification_manager(void)
++{
++	free_manager();
++}
++
++dwc_notifier_t *dwc_register_notifier(void *mem_ctx, void *object)
++{
++	notifier_t *notifier;
++
++	DWC_ASSERT(manager, "Notification manager not found");
++
++	notifier = find_notifier(object);
++	if (notifier) {
++		DWC_ERROR("Notifier %p is already registered\n", object);
++		return NULL;
++	}
++
++	notifier = alloc_notifier(mem_ctx, object);
++	if (!notifier) {
++		return NULL;
++	}
++
++	DWC_CIRCLEQ_INSERT_TAIL(&manager->notifiers, notifier, list_entry);
++
++	DWC_INFO("Notifier %p registered", object);
++	dump_manager();
++
++	return notifier;
++}
++
++void dwc_unregister_notifier(dwc_notifier_t *notifier)
++{
++	DWC_ASSERT(manager, "Notification manager not found");
++
++	if (!DWC_CIRCLEQ_EMPTY(&notifier->observers)) {
++		observer_t *o;
++
++		DWC_ERROR("Notifier %p has active observers when removing\n", notifier->object);
++		DWC_CIRCLEQ_FOREACH(o, &notifier->observers, list_entry) {
++			DWC_DEBUGC("    %p watching %s\n", o->observer, o->notification);
++		}
++
++		DWC_ASSERT(DWC_CIRCLEQ_EMPTY(&notifier->observers),
++			   "Notifier %p has active observers when removing", notifier);
++	}
++
++	DWC_CIRCLEQ_REMOVE_INIT(&manager->notifiers, notifier, list_entry);
++	free_notifier(notifier);
++
++	DWC_INFO("Notifier unregistered");
++	dump_manager();
++}
++
++/* Add an observer to observe the notifier for a particular state, event, or notification. */
++int dwc_add_observer(void *observer, void *object, char *notification,
++		     dwc_notifier_callback_t callback, void *data)
++{
++	notifier_t *notifier = find_notifier(object);
++	observer_t *new_observer;
++
++	if (!notifier) {
++		DWC_ERROR("Notifier %p is not found when adding observer\n", object);
++		return -DWC_E_INVALID;
++	}
++
++	new_observer = alloc_observer(notifier->mem_ctx, observer, notification, callback, data);
++	if (!new_observer) {
++		return -DWC_E_NO_MEMORY;
++	}
++
++	DWC_CIRCLEQ_INSERT_TAIL(&notifier->observers, new_observer, list_entry);
++
++	DWC_INFO("Added observer %p to notifier %p observing notification %s, callback=%p, data=%p",
++		 observer, object, notification, callback, data);
++
++	dump_manager();
++	return 0;
++}
++
++int dwc_remove_observer(void *observer)
++{
++	notifier_t *n;
++
++	DWC_ASSERT(manager, "Notification manager not found");
++
++	DWC_CIRCLEQ_FOREACH(n, &manager->notifiers, list_entry) {
++		observer_t *o;
++		observer_t *o2;
++
++		DWC_CIRCLEQ_FOREACH_SAFE(o, o2, &n->observers, list_entry) {
++			if (o->observer == observer) {
++				DWC_CIRCLEQ_REMOVE_INIT(&n->observers, o, list_entry);
++				DWC_INFO("Removing observer %p from notifier %p watching notification %s:",
++					 o->observer, n->object, o->notification);
++				free_observer(n->mem_ctx, o);
++			}
++		}
++	}
++
++	dump_manager();
++	return 0;
++}
++
++typedef struct callback_data {
++	void *mem_ctx;
++	dwc_notifier_callback_t cb;
++	void *observer;
++	void *data;
++	void *object;
++	char *notification;
++	void *notification_data;
++} cb_data_t;
++
++static void cb_task(void *data)
++{
++	cb_data_t *cb = (cb_data_t *)data;
++
++	cb->cb(cb->object, cb->notification, cb->observer, cb->notification_data, cb->data);
++	dwc_free(cb->mem_ctx, cb);
++}
++
++void dwc_notify(dwc_notifier_t *notifier, char *notification, void *notification_data)
++{
++	observer_t *o;
++
++	DWC_ASSERT(manager, "Notification manager not found");
++
++	DWC_CIRCLEQ_FOREACH(o, &notifier->observers, list_entry) {
++		int len = DWC_STRLEN(notification);
++
++		if (DWC_STRLEN(o->notification) != len) {
++			continue;
++		}
++
++		if (DWC_STRNCMP(o->notification, notification, len) == 0) {
++			cb_data_t *cb_data = dwc_alloc(notifier->mem_ctx, sizeof(cb_data_t));
++
++			if (!cb_data) {
++				DWC_ERROR("Failed to allocate callback data\n");
++				return;
++			}
++
++			cb_data->mem_ctx = notifier->mem_ctx;
++			cb_data->cb = o->callback;
++			cb_data->observer = o->observer;
++			cb_data->data = o->data;
++			cb_data->object = notifier->object;
++			cb_data->notification = notification;
++			cb_data->notification_data = notification_data;
++			DWC_DEBUGC("Observer found %p for notification %s\n", o->observer, notification);
++			DWC_WORKQ_SCHEDULE(manager->wq, cb_task, cb_data,
++					   "Notify callback from %p for Notification %s, to observer %p",
++					   cb_data->object, notification, cb_data->observer);
++		}
++	}
++}
++
++#endif	/* DWC_NOTIFYLIB */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_notifier.h
+@@ -0,0 +1,122 @@
++
++#ifndef __DWC_NOTIFIER_H__
++#define __DWC_NOTIFIER_H__
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++#include "dwc_os.h"
++
++/** @file
++ *
++ * A simple implementation of the Observer pattern.  Any "module" can
++ * register as an observer or notifier.  The notion of "module" is abstract and
++ * can mean anything used to identify either an observer or notifier.  Usually
++ * it will be a pointer to a data structure which contains some state, ie an
++ * object.
++ *
++ * Before any notifiers can be added, the global notification manager must be
++ * brought up with dwc_alloc_notification_manager().
++ * dwc_free_notification_manager() will bring it down and free all resources.
++ * These would typically be called upon module load and unload.  The
++ * notification manager is a single global instance that handles all registered
++ * observable modules and observers so this should be done only once.
++ *
++ * A module can be observable by using Notifications to publicize some general
++ * information about it's state or operation.  It does not care who listens, or
++ * even if anyone listens, or what they do with the information.  The observable
++ * modules do not need to know any information about it's observers or their
++ * interface, or their state or data.
++ *
++ * Any module can register to emit Notifications.  It should publish a list of
++ * notifications that it can emit and their behavior, such as when they will get
++ * triggered, and what information will be provided to the observer.  Then it
++ * should register itself as an observable module. See dwc_register_notifier().
++ *
++ * Any module can observe any observable, registered module, provided it has a
++ * handle to the other module and knows what notifications to observe.  See
++ * dwc_add_observer().
++ *
++ * A function of type dwc_notifier_callback_t is called whenever a notification
++ * is triggered with one or more observers observing it.  This function is
++ * called in it's own process so it may sleep or block if needed.  It is
++ * guaranteed to be called sometime after the notification has occurred and will
++ * be called once per each time the notification is triggered.  It will NOT be
++ * called in the same process context used to trigger the notification.
++ *
++ * @section Limitiations
++ *
++ * Keep in mind that Notifications that can be triggered in rapid sucession may
++ * schedule too many processes too handle.  Be aware of this limitation when
++ * designing to use notifications, and only add notifications for appropriate
++ * observable information.
++ *
++ * Also Notification callbacks are not synchronous.  If you need to synchronize
++ * the behavior between module/observer you must use other means.  And perhaps
++ * that will mean Notifications are not the proper solution.
++ */
++
++struct dwc_notifier;
++typedef struct dwc_notifier dwc_notifier_t;
++
++/** The callback function must be of this type.
++ *
++ * @param object This is the object that is being observed.
++ * @param notification This is the notification that was triggered.
++ * @param observer This is the observer
++ * @param notification_data This is notification-specific data that the notifier
++ * has included in this notification.  The value of this should be published in
++ * the documentation of the observable module with the notifications.
++ * @param user_data This is any custom data that the observer provided when
++ * adding itself as an observer to the notification. */
++typedef void (*dwc_notifier_callback_t)(void *object, char *notification, void *observer,
++					void *notification_data, void *user_data);
++
++/** Brings up the notification manager. */
++extern int dwc_alloc_notification_manager(void *mem_ctx, void *wkq_ctx);
++/** Brings down the notification manager. */
++extern void dwc_free_notification_manager(void);
++
++/** This function registers an observable module.  A dwc_notifier_t object is
++ * returned to the observable module.  This is an opaque object that is used by
++ * the observable module to trigger notifications.  This object should only be
++ * accessible to functions that are authorized to trigger notifications for this
++ * module.  Observers do not need this object. */
++extern dwc_notifier_t *dwc_register_notifier(void *mem_ctx, void *object);
++
++/** This function unregisters an observable module.  All observers have to be
++ * removed prior to unregistration. */
++extern void dwc_unregister_notifier(dwc_notifier_t *notifier);
++
++/** Add a module as an observer to the observable module.  The observable module
++ * needs to have previously registered with the notification manager.
++ *
++ * @param observer The observer module
++ * @param object The module to observe
++ * @param notification The notification to observe
++ * @param callback The callback function to call
++ * @param user_data Any additional user data to pass into the callback function */
++extern int dwc_add_observer(void *observer, void *object, char *notification,
++			    dwc_notifier_callback_t callback, void *user_data);
++
++/** Removes the specified observer from all notifications that it is currently
++ * observing. */
++extern int dwc_remove_observer(void *observer);
++
++/** This function triggers a Notification.  It should be called by the
++ * observable module, or any module or library which the observable module
++ * allows to trigger notification on it's behalf.  Such as the dwc_cc_t.
++ *
++ * dwc_notify is a non-blocking function.  Callbacks are scheduled called in
++ * their own process context for each trigger.  Callbacks can be blocking.
++ * dwc_notify can be called from interrupt context if needed.
++ *
++ */
++void dwc_notify(dwc_notifier_t *notifier, char *notification, void *notification_data);
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* __DWC_NOTIFIER_H__ */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/dwc_os.h
+@@ -0,0 +1,1275 @@
++/* =========================================================================
++ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_os.h $
++ * $Revision: #14 $
++ * $Date: 2010/11/04 $
++ * $Change: 1621695 $
++ *
++ * Synopsys Portability Library Software and documentation
++ * (hereinafter, "Software") is an Unsupported proprietary work of
++ * Synopsys, Inc. unless otherwise expressly agreed to in writing
++ * between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product
++ * under any End User Software License Agreement or Agreement for
++ * Licensed Product with Synopsys or any supplement thereto. You are
++ * permitted to use and redistribute this Software in source and binary
++ * forms, with or without modification, provided that redistributions
++ * of source code must retain this notice. You may not view, use,
++ * disclose, copy or distribute this file or any information contained
++ * herein except pursuant to this license grant from Synopsys. If you
++ * do not agree with this notice, including the disclaimer below, then
++ * you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
++ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
++ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
++ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
++ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
++ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================= */
++#ifndef _DWC_OS_H_
++#define _DWC_OS_H_
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++/** @file
++ *
++ * DWC portability library, low level os-wrapper functions
++ *
++ */
++
++/* These basic types need to be defined by some OS header file or custom header
++ * file for your specific target architecture.
++ *
++ * uint8_t, int8_t, uint16_t, int16_t, uint32_t, int32_t, uint64_t, int64_t
++ *
++ * Any custom or alternate header file must be added and enabled here.
++ */
++
++#ifdef DWC_LINUX
++# include <linux/types.h>
++# ifdef CONFIG_DEBUG_MUTEXES
++#  include <linux/mutex.h>
++# endif
++# include <linux/spinlock.h>
++# include <linux/errno.h>
++#endif
++
++#if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
++# include <os_dep.h>
++#endif
++
++
++/** @name Primitive Types and Values */
++
++/** We define a boolean type for consistency.  Can be either YES or NO */
++typedef uint8_t dwc_bool_t;
++#define YES  1
++#define NO   0
++
++#ifdef DWC_LINUX
++
++/** @name Error Codes */
++#define DWC_E_INVALID		EINVAL
++#define DWC_E_NO_MEMORY		ENOMEM
++#define DWC_E_NO_DEVICE		ENODEV
++#define DWC_E_NOT_SUPPORTED	EOPNOTSUPP
++#define DWC_E_TIMEOUT		ETIMEDOUT
++#define DWC_E_BUSY		EBUSY
++#define DWC_E_AGAIN		EAGAIN
++#define DWC_E_RESTART		ERESTART
++#define DWC_E_ABORT		ECONNABORTED
++#define DWC_E_SHUTDOWN		ESHUTDOWN
++#define DWC_E_NO_DATA		ENODATA
++#define DWC_E_DISCONNECT	ECONNRESET
++#define DWC_E_UNKNOWN		EINVAL
++#define DWC_E_NO_STREAM_RES	ENOSR
++#define DWC_E_COMMUNICATION	ECOMM
++#define DWC_E_OVERFLOW		EOVERFLOW
++#define DWC_E_PROTOCOL		EPROTO
++#define DWC_E_IN_PROGRESS	EINPROGRESS
++#define DWC_E_PIPE		EPIPE
++#define DWC_E_IO		EIO
++#define DWC_E_NO_SPACE		ENOSPC
++
++#else
++
++/** @name Error Codes */
++#define DWC_E_INVALID		1001
++#define DWC_E_NO_MEMORY		1002
++#define DWC_E_NO_DEVICE		1003
++#define DWC_E_NOT_SUPPORTED	1004
++#define DWC_E_TIMEOUT		1005
++#define DWC_E_BUSY		1006
++#define DWC_E_AGAIN		1007
++#define DWC_E_RESTART		1008
++#define DWC_E_ABORT		1009
++#define DWC_E_SHUTDOWN		1010
++#define DWC_E_NO_DATA		1011
++#define DWC_E_DISCONNECT	2000
++#define DWC_E_UNKNOWN		3000
++#define DWC_E_NO_STREAM_RES	4001
++#define DWC_E_COMMUNICATION	4002
++#define DWC_E_OVERFLOW		4003
++#define DWC_E_PROTOCOL		4004
++#define DWC_E_IN_PROGRESS	4005
++#define DWC_E_PIPE		4006
++#define DWC_E_IO		4007
++#define DWC_E_NO_SPACE		4008
++
++#endif
++
++
++/** @name Tracing/Logging Functions
++ *
++ * These function provide the capability to add tracing, debugging, and error
++ * messages, as well exceptions as assertions.  The WUDEV uses these
++ * extensively.  These could be logged to the main console, the serial port, an
++ * internal buffer, etc.  These functions could also be no-op if they are too
++ * expensive on your system.  By default undefining the DEBUG macro already
++ * no-ops some of these functions. */
++
++/** Returns non-zero if in interrupt context. */
++extern dwc_bool_t DWC_IN_IRQ(void);
++#define dwc_in_irq DWC_IN_IRQ
++
++/** Returns "IRQ" if DWC_IN_IRQ is true. */
++static inline char *dwc_irq(void) {
++	return DWC_IN_IRQ() ? "IRQ" : "";
++}
++
++/** Returns non-zero if in bottom-half context. */
++extern dwc_bool_t DWC_IN_BH(void);
++#define dwc_in_bh DWC_IN_BH
++
++/** Returns "BH" if DWC_IN_BH is true. */
++static inline char *dwc_bh(void) {
++	return DWC_IN_BH() ? "BH" : "";
++}
++
++/**
++ * A vprintf() clone.  Just call vprintf if you've got it.
++ */
++extern void DWC_VPRINTF(char *format, va_list args);
++#define dwc_vprintf DWC_VPRINTF
++
++/**
++ * A vsnprintf() clone.  Just call vprintf if you've got it.
++ */
++extern int DWC_VSNPRINTF(char *str, int size, char *format, va_list args);
++#define dwc_vsnprintf DWC_VSNPRINTF
++
++/**
++ * printf() clone.  Just call printf if you've go it.
++ */
++extern void DWC_PRINTF(char *format, ...)
++/* This provides compiler level static checking of the parameters if you're
++ * using GCC. */
++#ifdef __GNUC__
++	__attribute__ ((format(printf, 1, 2)));
++#else
++	;
++#endif
++#define dwc_printf DWC_PRINTF
++
++/**
++ * sprintf() clone.  Just call sprintf if you've got it.
++ */
++extern int DWC_SPRINTF(char *string, char *format, ...)
++#ifdef __GNUC__
++	__attribute__ ((format(printf, 2, 3)));
++#else
++	;
++#endif
++#define dwc_sprintf DWC_SPRINTF
++
++/**
++ * snprintf() clone.  Just call snprintf if you've got it.
++ */
++extern int DWC_SNPRINTF(char *string, int size, char *format, ...)
++#ifdef __GNUC__
++	__attribute__ ((format(printf, 3, 4)));
++#else
++	;
++#endif
++#define dwc_snprintf DWC_SNPRINTF
++
++/**
++ * Prints a WARNING message.  On systems that don't differentiate between
++ * warnings and regular log messages, just print it.  Indicates that something
++ * may be wrong with the driver.  Works like printf().
++ *
++ * Use the DWC_WARN macro to call this function.
++ */
++extern void __DWC_WARN(char *format, ...)
++#ifdef __GNUC__
++	__attribute__ ((format(printf, 1, 2)));
++#else
++	;
++#endif
++
++/**
++ * Prints an error message.  On systems that don't differentiate between errors
++ * and regular log messages, just print it.  Indicates that something went wrong
++ * with the driver.  Works like printf().
++ *
++ * Use the DWC_ERROR macro to call this function.
++ */
++extern void __DWC_ERROR(char *format, ...)
++#ifdef __GNUC__
++	__attribute__ ((format(printf, 1, 2)));
++#else
++	;
++#endif
++
++/**
++ * Prints an exception error message and takes some user-defined action such as
++ * print out a backtrace or trigger a breakpoint.  Indicates that something went
++ * abnormally wrong with the driver such as programmer error, or other
++ * exceptional condition.  It should not be ignored so even on systems without
++ * printing capability, some action should be taken to notify the developer of
++ * it.  Works like printf().
++ */
++extern void DWC_EXCEPTION(char *format, ...)
++#ifdef __GNUC__
++	__attribute__ ((format(printf, 1, 2)));
++#else
++	;
++#endif
++#define dwc_exception DWC_EXCEPTION
++
++#ifndef DWC_OTG_DEBUG_LEV
++#define DWC_OTG_DEBUG_LEV 0
++#endif
++
++#ifdef DEBUG
++/**
++ * Prints out a debug message.  Used for logging/trace messages.
++ *
++ * Use the DWC_DEBUG macro to call this function
++ */
++extern void __DWC_DEBUG(char *format, ...)
++#ifdef __GNUC__
++	__attribute__ ((format(printf, 1, 2)));
++#else
++	;
++#endif
++#else
++#define __DWC_DEBUG printk
++#endif
++
++/**
++ * Prints out a Debug message.
++ */
++#define DWC_DEBUG(_format, _args...) __DWC_DEBUG("DEBUG:%s:%s: " _format "\n", \
++						 __func__, dwc_irq(), ## _args)
++#define dwc_debug DWC_DEBUG
++/**
++ * Prints out a Debug message if enabled at compile time.
++ */
++#if DWC_OTG_DEBUG_LEV > 0
++#define DWC_DEBUGC(_format, _args...) DWC_DEBUG(_format, ##_args )
++#else
++#define DWC_DEBUGC(_format, _args...)
++#endif
++#define dwc_debugc DWC_DEBUGC
++/**
++ * Prints out an informative message.
++ */
++#define DWC_INFO(_format, _args...) DWC_PRINTF("INFO:%s: " _format "\n", \
++					       dwc_irq(), ## _args)
++#define dwc_info DWC_INFO
++/**
++ * Prints out an informative message if enabled at compile time.
++ */
++#if DWC_OTG_DEBUG_LEV > 1
++#define DWC_INFOC(_format, _args...) DWC_INFO(_format, ##_args )
++#else
++#define DWC_INFOC(_format, _args...)
++#endif
++#define dwc_infoc DWC_INFOC
++/**
++ * Prints out a warning message.
++ */
++#define DWC_WARN(_format, _args...) __DWC_WARN("WARN:%s:%s:%d: " _format "\n", \
++					dwc_irq(), __func__, __LINE__, ## _args)
++#define dwc_warn DWC_WARN
++/**
++ * Prints out an error message.
++ */
++#define DWC_ERROR(_format, _args...) __DWC_ERROR("ERROR:%s:%s:%d: " _format "\n", \
++					dwc_irq(), __func__, __LINE__, ## _args)
++#define dwc_error DWC_ERROR
++
++#define DWC_PROTO_ERROR(_format, _args...) __DWC_WARN("ERROR:%s:%s:%d: " _format "\n", \
++						dwc_irq(), __func__, __LINE__, ## _args)
++#define dwc_proto_error DWC_PROTO_ERROR
++
++#ifdef DEBUG
++/** Prints out a exception error message if the _expr expression fails.  Disabled
++ * if DEBUG is not enabled. */
++#define DWC_ASSERT(_expr, _format, _args...) do { \
++	if (!(_expr)) { DWC_EXCEPTION("%s:%s:%d: " _format "\n", dwc_irq(), \
++				      __FILE__, __LINE__, ## _args); } \
++	} while (0)
++#else
++#define DWC_ASSERT(_x...)
++#endif
++#define dwc_assert DWC_ASSERT
++
++
++/** @name Byte Ordering
++ * The following functions are for conversions between processor's byte ordering
++ * and specific ordering you want.
++ */
++
++/** Converts 32 bit data in CPU byte ordering to little endian. */
++extern uint32_t DWC_CPU_TO_LE32(uint32_t *p);
++#define dwc_cpu_to_le32 DWC_CPU_TO_LE32
++
++/** Converts 32 bit data in CPU byte orderint to big endian. */
++extern uint32_t DWC_CPU_TO_BE32(uint32_t *p);
++#define dwc_cpu_to_be32 DWC_CPU_TO_BE32
++
++/** Converts 32 bit little endian data to CPU byte ordering. */
++extern uint32_t DWC_LE32_TO_CPU(uint32_t *p);
++#define dwc_le32_to_cpu DWC_LE32_TO_CPU
++
++/** Converts 32 bit big endian data to CPU byte ordering. */
++extern uint32_t DWC_BE32_TO_CPU(uint32_t *p);
++#define dwc_be32_to_cpu DWC_BE32_TO_CPU
++
++/** Converts 16 bit data in CPU byte ordering to little endian. */
++extern uint16_t DWC_CPU_TO_LE16(uint16_t *p);
++#define dwc_cpu_to_le16 DWC_CPU_TO_LE16
++
++/** Converts 16 bit data in CPU byte orderint to big endian. */
++extern uint16_t DWC_CPU_TO_BE16(uint16_t *p);
++#define dwc_cpu_to_be16 DWC_CPU_TO_BE16
++
++/** Converts 16 bit little endian data to CPU byte ordering. */
++extern uint16_t DWC_LE16_TO_CPU(uint16_t *p);
++#define dwc_le16_to_cpu DWC_LE16_TO_CPU
++
++/** Converts 16 bit bi endian data to CPU byte ordering. */
++extern uint16_t DWC_BE16_TO_CPU(uint16_t *p);
++#define dwc_be16_to_cpu DWC_BE16_TO_CPU
++
++
++/** @name Register Read/Write
++ *
++ * The following six functions should be implemented to read/write registers of
++ * 32-bit and 64-bit sizes.  All modules use this to read/write register values.
++ * The reg value is a pointer to the register calculated from the void *base
++ * variable passed into the driver when it is started.  */
++
++#ifdef DWC_LINUX
++/* Linux doesn't need any extra parameters for register read/write, so we
++ * just throw away the IO context parameter.
++ */
++/** Reads the content of a 32-bit register. */
++extern uint32_t DWC_READ_REG32(uint32_t volatile *reg);
++#define dwc_read_reg32(_ctx_,_reg_) DWC_READ_REG32(_reg_)
++
++/** Reads the content of a 64-bit register. */
++extern uint64_t DWC_READ_REG64(uint64_t volatile *reg);
++#define dwc_read_reg64(_ctx_,_reg_) DWC_READ_REG64(_reg_)
++
++/** Writes to a 32-bit register. */
++extern void DWC_WRITE_REG32(uint32_t volatile *reg, uint32_t value);
++#define dwc_write_reg32(_ctx_,_reg_,_val_) DWC_WRITE_REG32(_reg_, _val_)
++
++/** Writes to a 64-bit register. */
++extern void DWC_WRITE_REG64(uint64_t volatile *reg, uint64_t value);
++#define dwc_write_reg64(_ctx_,_reg_,_val_) DWC_WRITE_REG64(_reg_, _val_)
++
++/**
++ * Modify bit values in a register.  Using the
++ * algorithm: (reg_contents & ~clear_mask) | set_mask.
++ */
++extern void DWC_MODIFY_REG32(uint32_t volatile *reg, uint32_t clear_mask, uint32_t set_mask);
++#define dwc_modify_reg32(_ctx_,_reg_,_cmsk_,_smsk_) DWC_MODIFY_REG32(_reg_,_cmsk_,_smsk_)
++extern void DWC_MODIFY_REG64(uint64_t volatile *reg, uint64_t clear_mask, uint64_t set_mask);
++#define dwc_modify_reg64(_ctx_,_reg_,_cmsk_,_smsk_) DWC_MODIFY_REG64(_reg_,_cmsk_,_smsk_)
++
++#endif	/* DWC_LINUX */
++
++#if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
++typedef struct dwc_ioctx {
++	struct device *dev;
++	bus_space_tag_t iot;
++	bus_space_handle_t ioh;
++} dwc_ioctx_t;
++
++/** BSD needs two extra parameters for register read/write, so we pass
++ * them in using the IO context parameter.
++ */
++/** Reads the content of a 32-bit register. */
++extern uint32_t DWC_READ_REG32(void *io_ctx, uint32_t volatile *reg);
++#define dwc_read_reg32 DWC_READ_REG32
++
++/** Reads the content of a 64-bit register. */
++extern uint64_t DWC_READ_REG64(void *io_ctx, uint64_t volatile *reg);
++#define dwc_read_reg64 DWC_READ_REG64
++
++/** Writes to a 32-bit register. */
++extern void DWC_WRITE_REG32(void *io_ctx, uint32_t volatile *reg, uint32_t value);
++#define dwc_write_reg32 DWC_WRITE_REG32
++
++/** Writes to a 64-bit register. */
++extern void DWC_WRITE_REG64(void *io_ctx, uint64_t volatile *reg, uint64_t value);
++#define dwc_write_reg64 DWC_WRITE_REG64
++
++/**
++ * Modify bit values in a register.  Using the
++ * algorithm: (reg_contents & ~clear_mask) | set_mask.
++ */
++extern void DWC_MODIFY_REG32(void *io_ctx, uint32_t volatile *reg, uint32_t clear_mask, uint32_t set_mask);
++#define dwc_modify_reg32 DWC_MODIFY_REG32
++extern void DWC_MODIFY_REG64(void *io_ctx, uint64_t volatile *reg, uint64_t clear_mask, uint64_t set_mask);
++#define dwc_modify_reg64 DWC_MODIFY_REG64
++
++#endif	/* DWC_FREEBSD || DWC_NETBSD */
++
++/** @cond */
++
++/** @name Some convenience MACROS used internally.  Define DWC_DEBUG_REGS to log the
++ * register writes. */
++
++#ifdef DWC_LINUX
++
++# ifdef DWC_DEBUG_REGS
++
++#define dwc_define_read_write_reg_n(_reg,_container_type) \
++static inline uint32_t dwc_read_##_reg##_n(_container_type *container, int num) { \
++	return DWC_READ_REG32(&container->regs->_reg[num]); \
++} \
++static inline void dwc_write_##_reg##_n(_container_type *container, int num, uint32_t data) { \
++	DWC_DEBUG("WRITING %8s[%d]: %p: %08x", #_reg, num, \
++		  &(((uint32_t*)container->regs->_reg)[num]), data); \
++	DWC_WRITE_REG32(&(((uint32_t*)container->regs->_reg)[num]), data); \
++}
++
++#define dwc_define_read_write_reg(_reg,_container_type) \
++static inline uint32_t dwc_read_##_reg(_container_type *container) { \
++	return DWC_READ_REG32(&container->regs->_reg); \
++} \
++static inline void dwc_write_##_reg(_container_type *container, uint32_t data) { \
++	DWC_DEBUG("WRITING %11s: %p: %08x", #_reg, &container->regs->_reg, data); \
++	DWC_WRITE_REG32(&container->regs->_reg, data); \
++}
++
++# else	/* DWC_DEBUG_REGS */
++
++#define dwc_define_read_write_reg_n(_reg,_container_type) \
++static inline uint32_t dwc_read_##_reg##_n(_container_type *container, int num) { \
++	return DWC_READ_REG32(&container->regs->_reg[num]); \
++} \
++static inline void dwc_write_##_reg##_n(_container_type *container, int num, uint32_t data) { \
++	DWC_WRITE_REG32(&(((uint32_t*)container->regs->_reg)[num]), data); \
++}
++
++#define dwc_define_read_write_reg(_reg,_container_type) \
++static inline uint32_t dwc_read_##_reg(_container_type *container) { \
++	return DWC_READ_REG32(&container->regs->_reg); \
++} \
++static inline void dwc_write_##_reg(_container_type *container, uint32_t data) { \
++	DWC_WRITE_REG32(&container->regs->_reg, data); \
++}
++
++# endif	/* DWC_DEBUG_REGS */
++
++#endif	/* DWC_LINUX */
++
++#if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
++
++# ifdef DWC_DEBUG_REGS
++
++#define dwc_define_read_write_reg_n(_reg,_container_type) \
++static inline uint32_t dwc_read_##_reg##_n(void *io_ctx, _container_type *container, int num) { \
++	return DWC_READ_REG32(io_ctx, &container->regs->_reg[num]); \
++} \
++static inline void dwc_write_##_reg##_n(void *io_ctx, _container_type *container, int num, uint32_t data) { \
++	DWC_DEBUG("WRITING %8s[%d]: %p: %08x", #_reg, num, \
++		  &(((uint32_t*)container->regs->_reg)[num]), data); \
++	DWC_WRITE_REG32(io_ctx, &(((uint32_t*)container->regs->_reg)[num]), data); \
++}
++
++#define dwc_define_read_write_reg(_reg,_container_type) \
++static inline uint32_t dwc_read_##_reg(void *io_ctx, _container_type *container) { \
++	return DWC_READ_REG32(io_ctx, &container->regs->_reg); \
++} \
++static inline void dwc_write_##_reg(void *io_ctx, _container_type *container, uint32_t data) { \
++	DWC_DEBUG("WRITING %11s: %p: %08x", #_reg, &container->regs->_reg, data); \
++	DWC_WRITE_REG32(io_ctx, &container->regs->_reg, data); \
++}
++
++# else	/* DWC_DEBUG_REGS */
++
++#define dwc_define_read_write_reg_n(_reg,_container_type) \
++static inline uint32_t dwc_read_##_reg##_n(void *io_ctx, _container_type *container, int num) { \
++	return DWC_READ_REG32(io_ctx, &container->regs->_reg[num]); \
++} \
++static inline void dwc_write_##_reg##_n(void *io_ctx, _container_type *container, int num, uint32_t data) { \
++	DWC_WRITE_REG32(io_ctx, &(((uint32_t*)container->regs->_reg)[num]), data); \
++}
++
++#define dwc_define_read_write_reg(_reg,_container_type) \
++static inline uint32_t dwc_read_##_reg(void *io_ctx, _container_type *container) { \
++	return DWC_READ_REG32(io_ctx, &container->regs->_reg); \
++} \
++static inline void dwc_write_##_reg(void *io_ctx, _container_type *container, uint32_t data) { \
++	DWC_WRITE_REG32(io_ctx, &container->regs->_reg, data); \
++}
++
++# endif	/* DWC_DEBUG_REGS */
++
++#endif	/* DWC_FREEBSD || DWC_NETBSD */
++
++/** @endcond */
++
++
++#ifdef DWC_CRYPTOLIB
++/** @name Crypto Functions
++ *
++ * These are the low-level cryptographic functions used by the driver. */
++
++/** Perform AES CBC */
++extern int DWC_AES_CBC(uint8_t *message, uint32_t messagelen, uint8_t *key, uint32_t keylen, uint8_t iv[16], uint8_t *out);
++#define dwc_aes_cbc DWC_AES_CBC
++
++/** Fill the provided buffer with random bytes.  These should be cryptographic grade random numbers. */
++extern void DWC_RANDOM_BYTES(uint8_t *buffer, uint32_t length);
++#define dwc_random_bytes DWC_RANDOM_BYTES
++
++/** Perform the SHA-256 hash function */
++extern int DWC_SHA256(uint8_t *message, uint32_t len, uint8_t *out);
++#define dwc_sha256 DWC_SHA256
++
++/** Calculated the HMAC-SHA256 */
++extern int DWC_HMAC_SHA256(uint8_t *message, uint32_t messagelen, uint8_t *key, uint32_t keylen, uint8_t *out);
++#define dwc_hmac_sha256 DWC_HMAC_SHA256
++
++#endif	/* DWC_CRYPTOLIB */
++
++
++/** @name Memory Allocation
++ *
++ * These function provide access to memory allocation.  There are only 2 DMA
++ * functions and 3 Regular memory functions that need to be implemented.  None
++ * of the memory debugging routines need to be implemented.  The allocation
++ * routines all ZERO the contents of the memory.
++ *
++ * Defining DWC_DEBUG_MEMORY turns on memory debugging and statistic gathering.
++ * This checks for memory leaks, keeping track of alloc/free pairs.  It also
++ * keeps track of how much memory the driver is using at any given time. */
++
++#define DWC_PAGE_SIZE 4096
++#define DWC_PAGE_OFFSET(addr) (((uint32_t)addr) & 0xfff)
++#define DWC_PAGE_ALIGNED(addr) ((((uint32_t)addr) & 0xfff) == 0)
++
++#define DWC_INVALID_DMA_ADDR 0x0
++
++#ifdef DWC_LINUX
++/** Type for a DMA address */
++typedef dma_addr_t dwc_dma_t;
++#endif
++
++#if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
++typedef bus_addr_t dwc_dma_t;
++#endif
++
++#ifdef DWC_FREEBSD
++typedef struct dwc_dmactx {
++	struct device *dev;
++	bus_dma_tag_t dma_tag;
++	bus_dmamap_t dma_map;
++	bus_addr_t dma_paddr;
++	void *dma_vaddr;
++} dwc_dmactx_t;
++#endif
++
++#ifdef DWC_NETBSD
++typedef struct dwc_dmactx {
++	struct device *dev;
++	bus_dma_tag_t dma_tag;
++	bus_dmamap_t dma_map;
++	bus_dma_segment_t segs[1];
++	int nsegs;
++	bus_addr_t dma_paddr;
++	void *dma_vaddr;
++} dwc_dmactx_t;
++#endif
++
++/* @todo these functions will be added in the future */
++#if 0
++/**
++ * Creates a DMA pool from which you can allocate DMA buffers.  Buffers
++ * allocated from this pool will be guaranteed to meet the size, alignment, and
++ * boundary requirements specified.
++ *
++ * @param[in] size Specifies the size of the buffers that will be allocated from
++ * this pool.
++ * @param[in] align Specifies the byte alignment requirements of the buffers
++ * allocated from this pool.  Must be a power of 2.
++ * @param[in] boundary Specifies the N-byte boundary that buffers allocated from
++ * this pool must not cross.
++ *
++ * @returns A pointer to an internal opaque structure which is not to be
++ * accessed outside of these library functions.  Use this handle to specify
++ * which pools to allocate/free DMA buffers from and also to destroy the pool,
++ * when you are done with it.
++ */
++extern dwc_pool_t *DWC_DMA_POOL_CREATE(uint32_t size, uint32_t align, uint32_t boundary);
++
++/**
++ * Destroy a DMA pool.  All buffers allocated from that pool must be freed first.
++ */
++extern void DWC_DMA_POOL_DESTROY(dwc_pool_t *pool);
++
++/**
++ * Allocate a buffer from the specified DMA pool and zeros its contents.
++ */
++extern void *DWC_DMA_POOL_ALLOC(dwc_pool_t *pool, uint64_t *dma_addr);
++
++/**
++ * Free a previously allocated buffer from the DMA pool.
++ */
++extern void DWC_DMA_POOL_FREE(dwc_pool_t *pool, void *vaddr, void *daddr);
++#endif
++
++/** Allocates a DMA capable buffer and zeroes its contents. */
++extern void *__DWC_DMA_ALLOC(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr);
++
++/** Allocates a DMA capable buffer and zeroes its contents in atomic contest */
++extern void *__DWC_DMA_ALLOC_ATOMIC(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr);
++
++/** Frees a previously allocated buffer. */
++extern void __DWC_DMA_FREE(void *dma_ctx, uint32_t size, void *virt_addr, dwc_dma_t dma_addr);
++
++/** Allocates a block of memory and zeroes its contents. */
++extern void *__DWC_ALLOC(void *mem_ctx, uint32_t size);
++
++/** Allocates a block of memory and zeroes its contents, in an atomic manner
++ * which can be used inside interrupt context.  The size should be sufficiently
++ * small, a few KB at most, such that failures are not likely to occur.  Can just call
++ * __DWC_ALLOC if it is atomic. */
++extern void *__DWC_ALLOC_ATOMIC(void *mem_ctx, uint32_t size);
++
++/** Frees a previously allocated buffer. */
++extern void __DWC_FREE(void *mem_ctx, void *addr);
++
++#ifndef DWC_DEBUG_MEMORY
++
++#define DWC_ALLOC(_size_) __DWC_ALLOC(NULL, _size_)
++#define DWC_ALLOC_ATOMIC(_size_) __DWC_ALLOC_ATOMIC(NULL, _size_)
++#define DWC_FREE(_addr_) __DWC_FREE(NULL, _addr_)
++
++# ifdef DWC_LINUX
++#define DWC_DMA_ALLOC(_dev, _size_, _dma_) __DWC_DMA_ALLOC(_dev, _size_, _dma_)
++#define DWC_DMA_ALLOC_ATOMIC(_dev, _size_, _dma_) __DWC_DMA_ALLOC_ATOMIC(_dev, _size_, _dma_)
++#define DWC_DMA_FREE(_dev, _size_,_virt_, _dma_) __DWC_DMA_FREE(_dev, _size_, _virt_, _dma_)
++# endif
++
++# if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
++#define DWC_DMA_ALLOC __DWC_DMA_ALLOC
++#define DWC_DMA_FREE __DWC_DMA_FREE
++# endif
++extern void *dwc_dma_alloc_atomic_debug(uint32_t size, dwc_dma_t *dma_addr, char const *func, int line);
++
++#else	/* DWC_DEBUG_MEMORY */
++
++extern void *dwc_alloc_debug(void *mem_ctx, uint32_t size, char const *func, int line);
++extern void *dwc_alloc_atomic_debug(void *mem_ctx, uint32_t size, char const *func, int line);
++extern void dwc_free_debug(void *mem_ctx, void *addr, char const *func, int line);
++extern void *dwc_dma_alloc_debug(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr,
++				 char const *func, int line);
++extern void *dwc_dma_alloc_atomic_debug(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr,
++				char const *func, int line);
++extern void dwc_dma_free_debug(void *dma_ctx, uint32_t size, void *virt_addr,
++			       dwc_dma_t dma_addr, char const *func, int line);
++
++extern int dwc_memory_debug_start(void *mem_ctx);
++extern void dwc_memory_debug_stop(void);
++extern void dwc_memory_debug_report(void);
++
++#define DWC_ALLOC(_size_) dwc_alloc_debug(NULL, _size_, __func__, __LINE__)
++#define DWC_ALLOC_ATOMIC(_size_) dwc_alloc_atomic_debug(NULL, _size_, \
++							__func__, __LINE__)
++#define DWC_FREE(_addr_) dwc_free_debug(NULL, _addr_, __func__, __LINE__)
++
++# ifdef DWC_LINUX
++#define DWC_DMA_ALLOC(_dev, _size_, _dma_) \
++	dwc_dma_alloc_debug(_dev, _size_, _dma_, __func__, __LINE__)
++#define DWC_DMA_ALLOC_ATOMIC(_dev, _size_, _dma_) \
++	dwc_dma_alloc_atomic_debug(_dev, _size_, _dma_, __func__, __LINE__)
++#define DWC_DMA_FREE(_dev, _size_, _virt_, _dma_) \
++	dwc_dma_free_debug(_dev, _size_, _virt_, _dma_, __func__, __LINE__)
++# endif
++
++# if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
++#define DWC_DMA_ALLOC(_ctx_,_size_,_dma_) dwc_dma_alloc_debug(_ctx_, _size_, \
++						_dma_, __func__, __LINE__)
++#define DWC_DMA_FREE(_ctx_,_size_,_virt_,_dma_) dwc_dma_free_debug(_ctx_, _size_, \
++						 _virt_, _dma_, __func__, __LINE__)
++# endif
++
++#endif /* DWC_DEBUG_MEMORY */
++
++#define dwc_alloc(_ctx_,_size_) DWC_ALLOC(_size_)
++#define dwc_alloc_atomic(_ctx_,_size_) DWC_ALLOC_ATOMIC(_size_)
++#define dwc_free(_ctx_,_addr_) DWC_FREE(_addr_)
++
++#ifdef DWC_LINUX
++/* Linux doesn't need any extra parameters for DMA buffer allocation, so we
++ * just throw away the DMA context parameter.
++ */
++#define dwc_dma_alloc(_ctx_,_size_,_dma_) DWC_DMA_ALLOC(_size_, _dma_)
++#define dwc_dma_alloc_atomic(_ctx_,_size_,_dma_) DWC_DMA_ALLOC_ATOMIC(_size_, _dma_)
++#define dwc_dma_free(_ctx_,_size_,_virt_,_dma_) DWC_DMA_FREE(_size_, _virt_, _dma_)
++#endif
++
++#if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
++/** BSD needs several extra parameters for DMA buffer allocation, so we pass
++ * them in using the DMA context parameter.
++ */
++#define dwc_dma_alloc DWC_DMA_ALLOC
++#define dwc_dma_free DWC_DMA_FREE
++#endif
++
++
++/** @name Memory and String Processing */
++
++/** memset() clone */
++extern void *DWC_MEMSET(void *dest, uint8_t byte, uint32_t size);
++#define dwc_memset DWC_MEMSET
++
++/** memcpy() clone */
++extern void *DWC_MEMCPY(void *dest, void const *src, uint32_t size);
++#define dwc_memcpy DWC_MEMCPY
++
++/** memmove() clone */
++extern void *DWC_MEMMOVE(void *dest, void *src, uint32_t size);
++#define dwc_memmove DWC_MEMMOVE
++
++/** memcmp() clone */
++extern int DWC_MEMCMP(void *m1, void *m2, uint32_t size);
++#define dwc_memcmp DWC_MEMCMP
++
++/** strcmp() clone */
++extern int DWC_STRCMP(void *s1, void *s2);
++#define dwc_strcmp DWC_STRCMP
++
++/** strncmp() clone */
++extern int DWC_STRNCMP(void *s1, void *s2, uint32_t size);
++#define dwc_strncmp DWC_STRNCMP
++
++/** strlen() clone, for NULL terminated ASCII strings */
++extern int DWC_STRLEN(char const *str);
++#define dwc_strlen DWC_STRLEN
++
++/** strcpy() clone, for NULL terminated ASCII strings */
++extern char *DWC_STRCPY(char *to, const char *from);
++#define dwc_strcpy DWC_STRCPY
++
++/** strdup() clone.  If you wish to use memory allocation debugging, this
++ * implementation of strdup should use the DWC_* memory routines instead of
++ * calling a predefined strdup.  Otherwise the memory allocated by this routine
++ * will not be seen by the debugging routines. */
++extern char *DWC_STRDUP(char const *str);
++#define dwc_strdup(_ctx_,_str_) DWC_STRDUP(_str_)
++
++/** NOT an atoi() clone.  Read the description carefully.  Returns an integer
++ * converted from the string str in base 10 unless the string begins with a "0x"
++ * in which case it is base 16.  String must be a NULL terminated sequence of
++ * ASCII characters and may optionally begin with whitespace, a + or -, and a
++ * "0x" prefix if base 16.  The remaining characters must be valid digits for
++ * the number and end with a NULL character.  If any invalid characters are
++ * encountered or it returns with a negative error code and the results of the
++ * conversion are undefined.  On sucess it returns 0.  Overflow conditions are
++ * undefined.  An example implementation using atoi() can be referenced from the
++ * Linux implementation. */
++extern int DWC_ATOI(const char *str, int32_t *value);
++#define dwc_atoi DWC_ATOI
++
++/** Same as above but for unsigned. */
++extern int DWC_ATOUI(const char *str, uint32_t *value);
++#define dwc_atoui DWC_ATOUI
++
++#ifdef DWC_UTFLIB
++/** This routine returns a UTF16LE unicode encoded string from a UTF8 string. */
++extern int DWC_UTF8_TO_UTF16LE(uint8_t const *utf8string, uint16_t *utf16string, unsigned len);
++#define dwc_utf8_to_utf16le DWC_UTF8_TO_UTF16LE
++#endif
++
++
++/** @name Wait queues
++ *
++ * Wait queues provide a means of synchronizing between threads or processes.  A
++ * process can block on a waitq if some condition is not true, waiting for it to
++ * become true.  When the waitq is triggered all waiting process will get
++ * unblocked and the condition will be check again.  Waitqs should be triggered
++ * every time a condition can potentially change.*/
++struct dwc_waitq;
++
++/** Type for a waitq */
++typedef struct dwc_waitq dwc_waitq_t;
++
++/** The type of waitq condition callback function.  This is called every time
++ * condition is evaluated. */
++typedef int (*dwc_waitq_condition_t)(void *data);
++
++/** Allocate a waitq */
++extern dwc_waitq_t *DWC_WAITQ_ALLOC(void);
++#define dwc_waitq_alloc(_ctx_) DWC_WAITQ_ALLOC()
++
++/** Free a waitq */
++extern void DWC_WAITQ_FREE(dwc_waitq_t *wq);
++#define dwc_waitq_free DWC_WAITQ_FREE
++
++/** Check the condition and if it is false, block on the waitq.  When unblocked, check the
++ * condition again.  The function returns when the condition becomes true.  The return value
++ * is 0 on condition true, DWC_WAITQ_ABORTED on abort or killed, or DWC_WAITQ_UNKNOWN on error. */
++extern int32_t DWC_WAITQ_WAIT(dwc_waitq_t *wq, dwc_waitq_condition_t cond, void *data);
++#define dwc_waitq_wait DWC_WAITQ_WAIT
++
++/** Check the condition and if it is false, block on the waitq.  When unblocked,
++ * check the condition again.  The function returns when the condition become
++ * true or the timeout has passed.  The return value is 0 on condition true or
++ * DWC_TIMED_OUT on timeout, or DWC_WAITQ_ABORTED, or DWC_WAITQ_UNKNOWN on
++ * error. */
++extern int32_t DWC_WAITQ_WAIT_TIMEOUT(dwc_waitq_t *wq, dwc_waitq_condition_t cond,
++				      void *data, int32_t msecs);
++#define dwc_waitq_wait_timeout DWC_WAITQ_WAIT_TIMEOUT
++
++/** Trigger a waitq, unblocking all processes.  This should be called whenever a condition
++ * has potentially changed. */
++extern void DWC_WAITQ_TRIGGER(dwc_waitq_t *wq);
++#define dwc_waitq_trigger DWC_WAITQ_TRIGGER
++
++/** Unblock all processes waiting on the waitq with an ABORTED result. */
++extern void DWC_WAITQ_ABORT(dwc_waitq_t *wq);
++#define dwc_waitq_abort DWC_WAITQ_ABORT
++
++
++/** @name Threads
++ *
++ * A thread must be explicitly stopped.  It must check DWC_THREAD_SHOULD_STOP
++ * whenever it is woken up, and then return.  The DWC_THREAD_STOP function
++ * returns the value from the thread.
++ */
++
++struct dwc_thread;
++
++/** Type for a thread */
++typedef struct dwc_thread dwc_thread_t;
++
++/** The thread function */
++typedef int (*dwc_thread_function_t)(void *data);
++
++/** Create a thread and start it running the thread_function.  Returns a handle
++ * to the thread */
++extern dwc_thread_t *DWC_THREAD_RUN(dwc_thread_function_t func, char *name, void *data);
++#define dwc_thread_run(_ctx_,_func_,_name_,_data_) DWC_THREAD_RUN(_func_, _name_, _data_)
++
++/** Stops a thread.  Return the value returned by the thread.  Or will return
++ * DWC_ABORT if the thread never started. */
++extern int DWC_THREAD_STOP(dwc_thread_t *thread);
++#define dwc_thread_stop DWC_THREAD_STOP
++
++/** Signifies to the thread that it must stop. */
++#ifdef DWC_LINUX
++/* Linux doesn't need any parameters for kthread_should_stop() */
++extern dwc_bool_t DWC_THREAD_SHOULD_STOP(void);
++#define dwc_thread_should_stop(_thrd_) DWC_THREAD_SHOULD_STOP()
++
++/* No thread_exit function in Linux */
++#define dwc_thread_exit(_thrd_)
++#endif
++
++#if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
++/** BSD needs the thread pointer for kthread_suspend_check() */
++extern dwc_bool_t DWC_THREAD_SHOULD_STOP(dwc_thread_t *thread);
++#define dwc_thread_should_stop DWC_THREAD_SHOULD_STOP
++
++/** The thread must call this to exit. */
++extern void DWC_THREAD_EXIT(dwc_thread_t *thread);
++#define dwc_thread_exit DWC_THREAD_EXIT
++#endif
++
++
++/** @name Work queues
++ *
++ * Workqs are used to queue a callback function to be called at some later time,
++ * in another thread. */
++struct dwc_workq;
++
++/** Type for a workq */
++typedef struct dwc_workq dwc_workq_t;
++
++/** The type of the callback function to be called. */
++typedef void (*dwc_work_callback_t)(void *data);
++
++/** Allocate a workq */
++extern dwc_workq_t *DWC_WORKQ_ALLOC(char *name);
++#define dwc_workq_alloc(_ctx_,_name_) DWC_WORKQ_ALLOC(_name_)
++
++/** Free a workq.  All work must be completed before being freed. */
++extern void DWC_WORKQ_FREE(dwc_workq_t *workq);
++#define dwc_workq_free DWC_WORKQ_FREE
++
++/** Schedule a callback on the workq, passing in data.  The function will be
++ * scheduled at some later time. */
++extern void DWC_WORKQ_SCHEDULE(dwc_workq_t *workq, dwc_work_callback_t cb,
++			       void *data, char *format, ...)
++#ifdef __GNUC__
++	__attribute__ ((format(printf, 4, 5)));
++#else
++	;
++#endif
++#define dwc_workq_schedule DWC_WORKQ_SCHEDULE
++
++/** Schedule a callback on the workq, that will be called until at least
++ * given number miliseconds have passed. */
++extern void DWC_WORKQ_SCHEDULE_DELAYED(dwc_workq_t *workq, dwc_work_callback_t cb,
++				       void *data, uint32_t time, char *format, ...)
++#ifdef __GNUC__
++	__attribute__ ((format(printf, 5, 6)));
++#else
++	;
++#endif
++#define dwc_workq_schedule_delayed DWC_WORKQ_SCHEDULE_DELAYED
++
++/** The number of processes in the workq */
++extern int DWC_WORKQ_PENDING(dwc_workq_t *workq);
++#define dwc_workq_pending DWC_WORKQ_PENDING
++
++/** Blocks until all the work in the workq is complete or timed out.  Returns <
++ * 0 on timeout. */
++extern int DWC_WORKQ_WAIT_WORK_DONE(dwc_workq_t *workq, int timeout);
++#define dwc_workq_wait_work_done DWC_WORKQ_WAIT_WORK_DONE
++
++
++/** @name Tasklets
++ *
++ */
++struct dwc_tasklet;
++
++/** Type for a tasklet */
++typedef struct dwc_tasklet dwc_tasklet_t;
++
++/** The type of the callback function to be called */
++typedef void (*dwc_tasklet_callback_t)(void *data);
++
++/** Allocates a tasklet */
++extern dwc_tasklet_t *DWC_TASK_ALLOC(char *name, dwc_tasklet_callback_t cb, void *data);
++#define dwc_task_alloc(_ctx_,_name_,_cb_,_data_) DWC_TASK_ALLOC(_name_, _cb_, _data_)
++
++/** Frees a tasklet */
++extern void DWC_TASK_FREE(dwc_tasklet_t *task);
++#define dwc_task_free DWC_TASK_FREE
++
++/** Schedules a tasklet to run */
++extern void DWC_TASK_SCHEDULE(dwc_tasklet_t *task);
++#define dwc_task_schedule DWC_TASK_SCHEDULE
++
++extern void DWC_TASK_HI_SCHEDULE(dwc_tasklet_t *task);
++#define dwc_task_hi_schedule DWC_TASK_HI_SCHEDULE
++
++/** @name Timer
++ *
++ * Callbacks must be small and atomic.
++ */
++struct dwc_timer;
++
++/** Type for a timer */
++typedef struct dwc_timer dwc_timer_t;
++
++/** The type of the callback function to be called */
++typedef void (*dwc_timer_callback_t)(void *data);
++
++/** Allocates a timer */
++extern dwc_timer_t *DWC_TIMER_ALLOC(char *name, dwc_timer_callback_t cb, void *data);
++#define dwc_timer_alloc(_ctx_,_name_,_cb_,_data_) DWC_TIMER_ALLOC(_name_,_cb_,_data_)
++
++/** Frees a timer */
++extern void DWC_TIMER_FREE(dwc_timer_t *timer);
++#define dwc_timer_free DWC_TIMER_FREE
++
++/** Schedules the timer to run at time ms from now.  And will repeat at every
++ * repeat_interval msec therafter
++ *
++ * Modifies a timer that is still awaiting execution to a new expiration time.
++ * The mod_time is added to the old time.  */
++extern void DWC_TIMER_SCHEDULE(dwc_timer_t *timer, uint32_t time);
++#define dwc_timer_schedule DWC_TIMER_SCHEDULE
++
++/** Disables the timer from execution. */
++extern void DWC_TIMER_CANCEL(dwc_timer_t *timer);
++#define dwc_timer_cancel DWC_TIMER_CANCEL
++
++
++/** @name Spinlocks
++ *
++ * These locks are used when the work between the lock/unlock is atomic and
++ * short.  Interrupts are also disabled during the lock/unlock and thus they are
++ * suitable to lock between interrupt/non-interrupt context.  They also lock
++ * between processes if you have multiple CPUs or Preemption.  If you don't have
++ * multiple CPUS or Preemption, then the you can simply implement the
++ * DWC_SPINLOCK and DWC_SPINUNLOCK to disable and enable interrupts.  Because
++ * the work between the lock/unlock is atomic, the process context will never
++ * change, and so you never have to lock between processes.  */
++
++struct dwc_spinlock;
++
++/** Type for a spinlock */
++typedef struct dwc_spinlock dwc_spinlock_t;
++
++/** Type for the 'flags' argument to spinlock funtions */
++typedef unsigned long dwc_irqflags_t;
++
++/** Returns an initialized lock variable.  This function should allocate and
++ * initialize the OS-specific data structure used for locking.  This data
++ * structure is to be used for the DWC_LOCK and DWC_UNLOCK functions and should
++ * be freed by the DWC_FREE_LOCK when it is no longer used.
++ *
++ * For Linux Spinlock Debugging make it macro because the debugging routines use
++ * the symbol name to determine recursive locking. Using a wrapper function
++ * makes it falsely think recursive locking occurs. */
++#if defined(DWC_LINUX) && defined(CONFIG_DEBUG_SPINLOCK)
++#define DWC_SPINLOCK_ALLOC_LINUX_DEBUG(lock) ({ \
++	lock = DWC_ALLOC(sizeof(spinlock_t)); \
++	if (lock) { \
++		spin_lock_init((spinlock_t *)lock); \
++	} \
++})
++#else
++extern dwc_spinlock_t *DWC_SPINLOCK_ALLOC(void);
++#define dwc_spinlock_alloc(_ctx_) DWC_SPINLOCK_ALLOC()
++#endif
++
++/** Frees an initialized lock variable. */
++extern void DWC_SPINLOCK_FREE(dwc_spinlock_t *lock);
++#define dwc_spinlock_free(_ctx_,_lock_) DWC_SPINLOCK_FREE(_lock_)
++
++/** Disables interrupts and blocks until it acquires the lock.
++ *
++ * @param lock Pointer to the spinlock.
++ * @param flags Unsigned long for irq flags storage.
++ */
++extern void DWC_SPINLOCK_IRQSAVE(dwc_spinlock_t *lock, dwc_irqflags_t *flags);
++#define dwc_spinlock_irqsave DWC_SPINLOCK_IRQSAVE
++
++/** Re-enables the interrupt and releases the lock.
++ *
++ * @param lock Pointer to the spinlock.
++ * @param flags Unsigned long for irq flags storage.  Must be the same as was
++ * passed into DWC_LOCK.
++ */
++extern void DWC_SPINUNLOCK_IRQRESTORE(dwc_spinlock_t *lock, dwc_irqflags_t flags);
++#define dwc_spinunlock_irqrestore DWC_SPINUNLOCK_IRQRESTORE
++
++/** Blocks until it acquires the lock.
++ *
++ * @param lock Pointer to the spinlock.
++ */
++extern void DWC_SPINLOCK(dwc_spinlock_t *lock);
++#define dwc_spinlock DWC_SPINLOCK
++
++/** Releases the lock.
++ *
++ * @param lock Pointer to the spinlock.
++ */
++extern void DWC_SPINUNLOCK(dwc_spinlock_t *lock);
++#define dwc_spinunlock DWC_SPINUNLOCK
++
++
++/** @name Mutexes
++ *
++ * Unlike spinlocks Mutexes lock only between processes and the work between the
++ * lock/unlock CAN block, therefore it CANNOT be called from interrupt context.
++ */
++
++struct dwc_mutex;
++
++/** Type for a mutex */
++typedef struct dwc_mutex dwc_mutex_t;
++
++/* For Linux Mutex Debugging make it inline because the debugging routines use
++ * the symbol to determine recursive locking.  This makes it falsely think
++ * recursive locking occurs. */
++#if defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES)
++#define DWC_MUTEX_ALLOC_LINUX_DEBUG(__mutexp) ({ \
++	__mutexp = (dwc_mutex_t *)DWC_ALLOC(sizeof(struct mutex)); \
++	mutex_init((struct mutex *)__mutexp); \
++})
++#endif
++
++/** Allocate a mutex */
++extern dwc_mutex_t *DWC_MUTEX_ALLOC(void);
++#define dwc_mutex_alloc(_ctx_) DWC_MUTEX_ALLOC()
++
++/* For memory leak debugging when using Linux Mutex Debugging */
++#if defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES)
++#define DWC_MUTEX_FREE(__mutexp) do { \
++	mutex_destroy((struct mutex *)__mutexp); \
++	DWC_FREE(__mutexp); \
++} while(0)
++#else
++/** Free a mutex */
++extern void DWC_MUTEX_FREE(dwc_mutex_t *mutex);
++#define dwc_mutex_free(_ctx_,_mutex_) DWC_MUTEX_FREE(_mutex_)
++#endif
++
++/** Lock a mutex */
++extern void DWC_MUTEX_LOCK(dwc_mutex_t *mutex);
++#define dwc_mutex_lock DWC_MUTEX_LOCK
++
++/** Non-blocking lock returns 1 on successful lock. */
++extern int DWC_MUTEX_TRYLOCK(dwc_mutex_t *mutex);
++#define dwc_mutex_trylock DWC_MUTEX_TRYLOCK
++
++/** Unlock a mutex */
++extern void DWC_MUTEX_UNLOCK(dwc_mutex_t *mutex);
++#define dwc_mutex_unlock DWC_MUTEX_UNLOCK
++
++
++/** @name Time */
++
++/** Microsecond delay.
++ *
++ * @param usecs  Microseconds to delay.
++ */
++extern void DWC_UDELAY(uint32_t usecs);
++#define dwc_udelay DWC_UDELAY
++
++/** Millisecond delay.
++ *
++ * @param msecs  Milliseconds to delay.
++ */
++extern void DWC_MDELAY(uint32_t msecs);
++#define dwc_mdelay DWC_MDELAY
++
++/** Non-busy waiting.
++ * Sleeps for specified number of milliseconds.
++ *
++ * @param msecs Milliseconds to sleep.
++ */
++extern void DWC_MSLEEP(uint32_t msecs);
++#define dwc_msleep DWC_MSLEEP
++
++/**
++ * Returns number of milliseconds since boot.
++ */
++extern uint32_t DWC_TIME(void);
++#define dwc_time DWC_TIME
++
++
++
++
++/* @mainpage DWC Portability and Common Library
++ *
++ * This is the documentation for the DWC Portability and Common Library.
++ *
++ * @section intro Introduction
++ *
++ * The DWC Portability library consists of wrapper calls and data structures to
++ * all low-level functions which are typically provided by the OS.  The WUDEV
++ * driver uses only these functions.  In order to port the WUDEV driver, only
++ * the functions in this library need to be re-implemented, with the same
++ * behavior as documented here.
++ *
++ * The Common library consists of higher level functions, which rely only on
++ * calling the functions from the DWC Portability library.  These common
++ * routines are shared across modules.  Some of the common libraries need to be
++ * used directly by the driver programmer when porting WUDEV.  Such as the
++ * parameter and notification libraries.
++ *
++ * @section low Portability Library OS Wrapper Functions
++ *
++ * Any function starting with DWC and in all CAPS is a low-level OS-wrapper that
++ * needs to be implemented when porting, for example DWC_MUTEX_ALLOC().  All of
++ * these functions are included in the dwc_os.h file.
++ *
++ * There are many functions here covering a wide array of OS services.  Please
++ * see dwc_os.h for details, and implementation notes for each function.
++ *
++ * @section common Common Library Functions
++ *
++ * Any function starting with dwc and in all lowercase is a common library
++ * routine.  These functions have a portable implementation and do not need to
++ * be reimplemented when porting.  The common routines can be used by any
++ * driver, and some must be used by the end user to control the drivers.  For
++ * example, you must use the Parameter common library in order to set the
++ * parameters in the WUDEV module.
++ *
++ * The common libraries consist of the following:
++ *
++ * - Connection Contexts - Used internally and can be used by end-user.  See dwc_cc.h
++ * - Parameters - Used internally and can be used by end-user.  See dwc_params.h
++ * - Notifications - Used internally and can be used by end-user.  See dwc_notifier.h
++ * - Lists - Used internally and can be used by end-user.  See dwc_list.h
++ * - Memory Debugging - Used internally and can be used by end-user.  See dwc_os.h
++ * - Modpow - Used internally only.  See dwc_modpow.h
++ * - DH - Used internally only.  See dwc_dh.h
++ * - Crypto - Used internally only.  See dwc_crypto.h
++ *
++ *
++ * @section prereq Prerequistes For dwc_os.h
++ * @subsection types Data Types
++ *
++ * The dwc_os.h file assumes that several low-level data types are pre defined for the
++ * compilation environment.  These data types are:
++ *
++ * - uint8_t - unsigned 8-bit data type
++ * - int8_t - signed 8-bit data type
++ * - uint16_t - unsigned 16-bit data type
++ * - int16_t - signed 16-bit data type
++ * - uint32_t - unsigned 32-bit data type
++ * - int32_t - signed 32-bit data type
++ * - uint64_t - unsigned 64-bit data type
++ * - int64_t - signed 64-bit data type
++ *
++ * Ensure that these are defined before using dwc_os.h.  The easiest way to do
++ * that is to modify the top of the file to include the appropriate header.
++ * This is already done for the Linux environment.  If the DWC_LINUX macro is
++ * defined, the correct header will be added.  A standard header <stdint.h> is
++ * also used for environments where standard C headers are available.
++ *
++ * @subsection stdarg Variable Arguments
++ *
++ * Variable arguments are provided by a standard C header <stdarg.h>.  it is
++ * available in Both the Linux and ANSI C enviornment.  An equivalent must be
++ * provided in your enviornment in order to use dwc_os.h with the debug and
++ * tracing message functionality.
++ *
++ * @subsection thread Threading
++ *
++ * WUDEV Core must be run on an operating system that provides for multiple
++ * threads/processes.  Threading can be implemented in many ways, even in
++ * embedded systems without an operating system.  At the bare minimum, the
++ * system should be able to start any number of processes at any time to handle
++ * special work.  It need not be a pre-emptive system.  Process context can
++ * change upon a call to a blocking function.  The hardware interrupt context
++ * that calls the module's ISR() function must be differentiable from process
++ * context, even if your processes are impemented via a hardware interrupt.
++ * Further locking mechanism between process must exist (or be implemented), and
++ * process context must have a way to disable interrupts for a period of time to
++ * lock them out.  If all of this exists, the functions in dwc_os.h related to
++ * threading should be able to be implemented with the defined behavior.
++ *
++ */
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* _DWC_OS_H_ */
+--- /dev/null
++++ b/drivers/usb/host/dwc_common_port/usb.h
+@@ -0,0 +1,275 @@
++/*
++ * Copyright (c) 1998 The NetBSD Foundation, Inc.
++ * All rights reserved.
++ *
++ * This code is derived from software contributed to The NetBSD Foundation
++ * by Lennart Augustsson (lennart@augustsson.net) at
++ * Carlstedt Research & Technology.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
++ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
++ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
++ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
++ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
++ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
++ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
++ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
++ * POSSIBILITY OF SUCH DAMAGE.
++ */
++
++/* Modified by Synopsys, Inc, 12/12/2007 */
++
++
++#ifndef _USB_H_
++#define _USB_H_
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++/*
++ * The USB records contain some unaligned little-endian word
++ * components.  The U[SG]ETW macros take care of both the alignment
++ * and endian problem and should always be used to access non-byte
++ * values.
++ */
++typedef u_int8_t uByte;
++typedef u_int8_t uWord[2];
++typedef u_int8_t uDWord[4];
++
++#define UGETW(w) ((w)[0] | ((w)[1] << 8))
++#define USETW(w,v) ((w)[0] = (u_int8_t)(v), (w)[1] = (u_int8_t)((v) >> 8))
++#define UGETDW(w) ((w)[0] | ((w)[1] << 8) | ((w)[2] << 16) | ((w)[3] << 24))
++#define USETDW(w,v) ((w)[0] = (u_int8_t)(v), \
++		     (w)[1] = (u_int8_t)((v) >> 8), \
++		     (w)[2] = (u_int8_t)((v) >> 16), \
++		     (w)[3] = (u_int8_t)((v) >> 24))
++
++#define UPACKED __attribute__((__packed__))
++
++typedef struct {
++	uByte		bmRequestType;
++	uByte		bRequest;
++	uWord		wValue;
++	uWord		wIndex;
++	uWord		wLength;
++} UPACKED usb_device_request_t;
++
++#define UT_GET_DIR(a) ((a) & 0x80)
++#define UT_WRITE		0x00
++#define UT_READ			0x80
++
++#define UT_GET_TYPE(a) ((a) & 0x60)
++#define UT_STANDARD		0x00
++#define UT_CLASS		0x20
++#define UT_VENDOR		0x40
++
++#define UT_GET_RECIPIENT(a) ((a) & 0x1f)
++#define UT_DEVICE		0x00
++#define UT_INTERFACE		0x01
++#define UT_ENDPOINT		0x02
++#define UT_OTHER		0x03
++
++/* Requests */
++#define UR_GET_STATUS		0x00
++#define  USTAT_STANDARD_STATUS  0x00
++#define  WUSTAT_WUSB_FEATURE    0x01
++#define  WUSTAT_CHANNEL_INFO    0x02
++#define  WUSTAT_RECEIVED_DATA   0x03
++#define  WUSTAT_MAS_AVAILABILITY 0x04
++#define  WUSTAT_CURRENT_TRANSMIT_POWER 0x05
++#define UR_CLEAR_FEATURE	0x01
++#define UR_SET_FEATURE		0x03
++#define UR_SET_AND_TEST_FEATURE 0x0c
++#define UR_SET_ADDRESS		0x05
++#define UR_GET_DESCRIPTOR	0x06
++#define  UDESC_DEVICE		0x01
++#define  UDESC_CONFIG		0x02
++#define  UDESC_STRING		0x03
++#define  UDESC_INTERFACE	0x04
++#define  UDESC_ENDPOINT		0x05
++#define  UDESC_SS_USB_COMPANION	0x30
++#define  UDESC_DEVICE_QUALIFIER	0x06
++#define  UDESC_OTHER_SPEED_CONFIGURATION 0x07
++#define  UDESC_INTERFACE_POWER	0x08
++#define  UDESC_OTG		0x09
++#define  WUDESC_SECURITY	0x0c
++#define  WUDESC_KEY		0x0d
++#define   WUD_GET_KEY_INDEX(_wValue_) ((_wValue_) & 0xf)
++#define   WUD_GET_KEY_TYPE(_wValue_) (((_wValue_) & 0x30) >> 4)
++#define    WUD_KEY_TYPE_ASSOC    0x01
++#define    WUD_KEY_TYPE_GTK      0x02
++#define   WUD_GET_KEY_ORIGIN(_wValue_) (((_wValue_) & 0x40) >> 6)
++#define    WUD_KEY_ORIGIN_HOST   0x00
++#define    WUD_KEY_ORIGIN_DEVICE 0x01
++#define  WUDESC_ENCRYPTION_TYPE	0x0e
++#define  WUDESC_BOS		0x0f
++#define  WUDESC_DEVICE_CAPABILITY 0x10
++#define  WUDESC_WIRELESS_ENDPOINT_COMPANION 0x11
++#define  UDESC_BOS		0x0f
++#define  UDESC_DEVICE_CAPABILITY 0x10
++#define  UDESC_CS_DEVICE	0x21	/* class specific */
++#define  UDESC_CS_CONFIG	0x22
++#define  UDESC_CS_STRING	0x23
++#define  UDESC_CS_INTERFACE	0x24
++#define  UDESC_CS_ENDPOINT	0x25
++#define  UDESC_HUB		0x29
++#define UR_SET_DESCRIPTOR	0x07
++#define UR_GET_CONFIG		0x08
++#define UR_SET_CONFIG		0x09
++#define UR_GET_INTERFACE	0x0a
++#define UR_SET_INTERFACE	0x0b
++#define UR_SYNCH_FRAME		0x0c
++#define WUR_SET_ENCRYPTION      0x0d
++#define WUR_GET_ENCRYPTION	0x0e
++#define WUR_SET_HANDSHAKE	0x0f
++#define WUR_GET_HANDSHAKE	0x10
++#define WUR_SET_CONNECTION	0x11
++#define WUR_SET_SECURITY_DATA	0x12
++#define WUR_GET_SECURITY_DATA	0x13
++#define WUR_SET_WUSB_DATA	0x14
++#define  WUDATA_DRPIE_INFO	0x01
++#define  WUDATA_TRANSMIT_DATA	0x02
++#define  WUDATA_TRANSMIT_PARAMS	0x03
++#define  WUDATA_RECEIVE_PARAMS	0x04
++#define  WUDATA_TRANSMIT_POWER	0x05
++#define WUR_LOOPBACK_DATA_WRITE	0x15
++#define WUR_LOOPBACK_DATA_READ	0x16
++#define WUR_SET_INTERFACE_DS	0x17
++
++/* Feature numbers */
++#define UF_ENDPOINT_HALT	0
++#define UF_DEVICE_REMOTE_WAKEUP	1
++#define UF_TEST_MODE		2
++#define UF_DEVICE_B_HNP_ENABLE	3
++#define UF_DEVICE_A_HNP_SUPPORT	4
++#define UF_DEVICE_A_ALT_HNP_SUPPORT 5
++#define WUF_WUSB		3
++#define  WUF_TX_DRPIE		0x0
++#define  WUF_DEV_XMIT_PACKET	0x1
++#define  WUF_COUNT_PACKETS	0x2
++#define  WUF_CAPTURE_PACKETS	0x3
++#define UF_FUNCTION_SUSPEND	0
++#define UF_U1_ENABLE		48
++#define UF_U2_ENABLE		49
++#define UF_LTM_ENABLE		50
++
++/* Class requests from the USB 2.0 hub spec, table 11-15 */
++#define UCR_CLEAR_HUB_FEATURE		(0x2000 | UR_CLEAR_FEATURE)
++#define UCR_CLEAR_PORT_FEATURE		(0x2300 | UR_CLEAR_FEATURE)
++#define UCR_GET_HUB_DESCRIPTOR		(0xa000 | UR_GET_DESCRIPTOR)
++#define UCR_GET_HUB_STATUS		(0xa000 | UR_GET_STATUS)
++#define UCR_GET_PORT_STATUS		(0xa300 | UR_GET_STATUS)
++#define UCR_SET_HUB_FEATURE		(0x2000 | UR_SET_FEATURE)
++#define UCR_SET_PORT_FEATURE		(0x2300 | UR_SET_FEATURE)
++#define UCR_SET_AND_TEST_PORT_FEATURE	(0xa300 | UR_SET_AND_TEST_FEATURE)
++
++#ifdef _MSC_VER
++#include <pshpack1.h>
++#endif
++
++typedef struct {
++	uByte		bLength;
++	uByte		bDescriptorType;
++	uByte		bEndpointAddress;
++#define UE_GET_DIR(a)	((a) & 0x80)
++#define UE_SET_DIR(a,d)	((a) | (((d)&1) << 7))
++#define UE_DIR_IN	0x80
++#define UE_DIR_OUT	0x00
++#define UE_ADDR		0x0f
++#define UE_GET_ADDR(a)	((a) & UE_ADDR)
++	uByte		bmAttributes;
++#define UE_XFERTYPE	0x03
++#define  UE_CONTROL	0x00
++#define  UE_ISOCHRONOUS	0x01
++#define  UE_BULK	0x02
++#define  UE_INTERRUPT	0x03
++#define UE_GET_XFERTYPE(a)	((a) & UE_XFERTYPE)
++#define UE_ISO_TYPE	0x0c
++#define  UE_ISO_ASYNC	0x04
++#define  UE_ISO_ADAPT	0x08
++#define  UE_ISO_SYNC	0x0c
++#define UE_GET_ISO_TYPE(a)	((a) & UE_ISO_TYPE)
++	uWord		wMaxPacketSize;
++	uByte		bInterval;
++} UPACKED usb_endpoint_descriptor_t;
++#define USB_ENDPOINT_DESCRIPTOR_SIZE 7
++
++/* Hub specific request */
++#define UR_GET_BUS_STATE	0x02
++#define UR_CLEAR_TT_BUFFER	0x08
++#define UR_RESET_TT		0x09
++#define UR_GET_TT_STATE		0x0a
++#define UR_STOP_TT		0x0b
++
++/* Hub features */
++#define UHF_C_HUB_LOCAL_POWER	0
++#define UHF_C_HUB_OVER_CURRENT	1
++#define UHF_PORT_CONNECTION	0
++#define UHF_PORT_ENABLE		1
++#define UHF_PORT_SUSPEND	2
++#define UHF_PORT_OVER_CURRENT	3
++#define UHF_PORT_RESET		4
++#define UHF_PORT_L1		5
++#define UHF_PORT_POWER		8
++#define UHF_PORT_LOW_SPEED	9
++#define UHF_PORT_HIGH_SPEED	10
++#define UHF_C_PORT_CONNECTION	16
++#define UHF_C_PORT_ENABLE	17
++#define UHF_C_PORT_SUSPEND	18
++#define UHF_C_PORT_OVER_CURRENT	19
++#define UHF_C_PORT_RESET	20
++#define UHF_C_PORT_L1		23
++#define UHF_PORT_TEST		21
++#define UHF_PORT_INDICATOR	22
++
++typedef struct {
++	uByte		bDescLength;
++	uByte		bDescriptorType;
++	uByte		bNbrPorts;
++	uWord		wHubCharacteristics;
++#define UHD_PWR			0x0003
++#define  UHD_PWR_GANGED		0x0000
++#define  UHD_PWR_INDIVIDUAL	0x0001
++#define  UHD_PWR_NO_SWITCH	0x0002
++#define UHD_COMPOUND		0x0004
++#define UHD_OC			0x0018
++#define  UHD_OC_GLOBAL		0x0000
++#define  UHD_OC_INDIVIDUAL	0x0008
++#define  UHD_OC_NONE		0x0010
++#define UHD_TT_THINK		0x0060
++#define  UHD_TT_THINK_8		0x0000
++#define  UHD_TT_THINK_16	0x0020
++#define  UHD_TT_THINK_24	0x0040
++#define  UHD_TT_THINK_32	0x0060
++#define UHD_PORT_IND		0x0080
++	uByte		bPwrOn2PwrGood;	/* delay in 2 ms units */
++#define UHD_PWRON_FACTOR 2
++	uByte		bHubContrCurrent;
++	uByte		DeviceRemovable[32]; /* max 255 ports */
++#define UHD_NOT_REMOV(desc, i) \
++    (((desc)->DeviceRemovable[(i)/8] >> ((i) % 8)) & 1)
++	/* deprecated */ uByte		PortPowerCtrlMask[1];
++} UPACKED usb_hub_descriptor_t;
++#define USB_HUB_DESCRIPTOR_SIZE 9 /* includes deprecated PortPowerCtrlMask */
++
++#ifdef _MSC_VER
++#include <poppack.h>
++#endif
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* _USB_H_ */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/Makefile
+@@ -0,0 +1,86 @@
++#
++# Makefile for DWC_otg Highspeed USB controller driver
++#
++
++ifneq ($(KERNELRELEASE),)
++
++# Use the BUS_INTERFACE variable to compile the software for either
++# PCI(PCI_INTERFACE) or LM(LM_INTERFACE) bus.
++ifeq ($(BUS_INTERFACE),)
++#	BUS_INTERFACE = -DPCI_INTERFACE
++#	BUS_INTERFACE = -DLM_INTERFACE
++        BUS_INTERFACE = -DPLATFORM_INTERFACE
++endif
++
++#ccflags-y	+= -DDEBUG
++#ccflags-y	+= -DDWC_OTG_DEBUGLEV=1 # reduce common debug msgs
++
++# Use one of the following flags to compile the software in host-only or
++# device-only mode.
++#ccflags-y        += -DDWC_HOST_ONLY
++#ccflags-y        += -DDWC_DEVICE_ONLY
++
++ccflags-y	+= -Dlinux -DDWC_HS_ELECT_TST
++#ccflags-y	+= -DDWC_EN_ISOC
++ccflags-y   	+= -I$(srctree)/drivers/usb/host/dwc_common_port
++#ccflags-y   	+= -I$(PORTLIB)
++ccflags-y   	+= -DDWC_LINUX
++ccflags-y   	+= $(CFI)
++ccflags-y	+= $(BUS_INTERFACE)
++#ccflags-y	+= -DDWC_DEV_SRPCAP
++CFLAGS_dwc_otg_fiq_fsm.o += -fno-stack-protector
++
++obj-$(CONFIG_USB_DWCOTG) += dwc_otg.o
++
++dwc_otg-objs	:= dwc_otg_driver.o dwc_otg_attr.o
++dwc_otg-objs	+= dwc_otg_cil.o dwc_otg_cil_intr.o
++dwc_otg-objs	+= dwc_otg_pcd_linux.o dwc_otg_pcd.o dwc_otg_pcd_intr.o
++dwc_otg-objs	+= dwc_otg_hcd.o dwc_otg_hcd_linux.o dwc_otg_hcd_intr.o dwc_otg_hcd_queue.o dwc_otg_hcd_ddma.o
++dwc_otg-objs	+= dwc_otg_adp.o
++dwc_otg-objs	+= dwc_otg_fiq_fsm.o
++ifneq ($(CONFIG_ARM64),y)
++dwc_otg-objs	+= dwc_otg_fiq_stub.o
++endif
++
++ifneq ($(CFI),)
++dwc_otg-objs	+= dwc_otg_cfi.o
++endif
++
++kernrelwd := $(subst ., ,$(KERNELRELEASE))
++kernrel3 := $(word 1,$(kernrelwd)).$(word 2,$(kernrelwd)).$(word 3,$(kernrelwd))
++
++ifneq ($(kernrel3),2.6.20)
++ccflags-y += $(CPPFLAGS)
++endif
++
++else
++
++PWD		:= $(shell pwd)
++PORTLIB		:= $(PWD)/../dwc_common_port
++
++# Command paths
++CTAGS		:= $(CTAGS)
++DOXYGEN		:= $(DOXYGEN)
++
++default: portlib
++	$(MAKE) -C$(KDIR) M=$(PWD) ARCH=$(ARCH) CROSS_COMPILE=$(CROSS_COMPILE) modules
++
++install: default
++	$(MAKE) -C$(KDIR) M=$(PORTLIB) modules_install
++	$(MAKE) -C$(KDIR) M=$(PWD) modules_install
++
++portlib:
++	$(MAKE) -C$(KDIR) M=$(PORTLIB) ARCH=$(ARCH) CROSS_COMPILE=$(CROSS_COMPILE) modules
++	cp $(PORTLIB)/Module.symvers $(PWD)/
++
++docs:	$(wildcard *.[hc]) doc/doxygen.cfg
++	$(DOXYGEN) doc/doxygen.cfg
++
++tags:	$(wildcard *.[hc])
++	$(CTAGS) -e $(wildcard *.[hc]) $(wildcard linux/*.[hc]) $(wildcard $(KDIR)/include/linux/usb*.h)
++
++
++clean:
++	rm -rf   *.o *.ko .*cmd *.mod.c .tmp_versions Module.symvers
++
++endif
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/doc/doxygen.cfg
+@@ -0,0 +1,224 @@
++# Doxyfile 1.3.9.1
++
++#---------------------------------------------------------------------------
++# Project related configuration options
++#---------------------------------------------------------------------------
++PROJECT_NAME           = "DesignWare USB 2.0 OTG Controller (DWC_otg) Device Driver"
++PROJECT_NUMBER         = v3.00a
++OUTPUT_DIRECTORY       = ./doc/
++CREATE_SUBDIRS         = NO
++OUTPUT_LANGUAGE        = English
++BRIEF_MEMBER_DESC      = YES
++REPEAT_BRIEF           = YES
++ABBREVIATE_BRIEF       = "The $name class" \
++                         "The $name widget" \
++                         "The $name file" \
++                         is \
++                         provides \
++                         specifies \
++                         contains \
++                         represents \
++                         a \
++                         an \
++                         the
++ALWAYS_DETAILED_SEC    = NO
++INLINE_INHERITED_MEMB  = NO
++FULL_PATH_NAMES        = NO
++STRIP_FROM_PATH        =
++STRIP_FROM_INC_PATH    =
++SHORT_NAMES            = NO
++JAVADOC_AUTOBRIEF      = YES
++MULTILINE_CPP_IS_BRIEF = NO
++INHERIT_DOCS           = YES
++DISTRIBUTE_GROUP_DOC   = NO
++TAB_SIZE               = 8
++ALIASES                =
++OPTIMIZE_OUTPUT_FOR_C  = YES
++OPTIMIZE_OUTPUT_JAVA   = NO
++SUBGROUPING            = YES
++#---------------------------------------------------------------------------
++# Build related configuration options
++#---------------------------------------------------------------------------
++EXTRACT_ALL            = NO
++EXTRACT_PRIVATE        = YES
++EXTRACT_STATIC         = YES
++EXTRACT_LOCAL_CLASSES  = YES
++EXTRACT_LOCAL_METHODS  = NO
++HIDE_UNDOC_MEMBERS     = NO
++HIDE_UNDOC_CLASSES     = NO
++HIDE_FRIEND_COMPOUNDS  = NO
++HIDE_IN_BODY_DOCS      = NO
++INTERNAL_DOCS          = NO
++CASE_SENSE_NAMES       = NO
++HIDE_SCOPE_NAMES       = NO
++SHOW_INCLUDE_FILES     = YES
++INLINE_INFO            = YES
++SORT_MEMBER_DOCS       = NO
++SORT_BRIEF_DOCS        = NO
++SORT_BY_SCOPE_NAME     = NO
++GENERATE_TODOLIST      = YES
++GENERATE_TESTLIST      = YES
++GENERATE_BUGLIST       = YES
++GENERATE_DEPRECATEDLIST= YES
++ENABLED_SECTIONS       =
++MAX_INITIALIZER_LINES  = 30
++SHOW_USED_FILES        = YES
++SHOW_DIRECTORIES       = YES
++#---------------------------------------------------------------------------
++# configuration options related to warning and progress messages
++#---------------------------------------------------------------------------
++QUIET                  = YES
++WARNINGS               = YES
++WARN_IF_UNDOCUMENTED   = NO
++WARN_IF_DOC_ERROR      = YES
++WARN_FORMAT            = "$file:$line: $text"
++WARN_LOGFILE           =
++#---------------------------------------------------------------------------
++# configuration options related to the input files
++#---------------------------------------------------------------------------
++INPUT                  = .
++FILE_PATTERNS          = *.c \
++                         *.h \
++                         ./linux/*.c \
++                         ./linux/*.h
++RECURSIVE              = NO
++EXCLUDE                = ./test/ \
++                         ./dwc_otg/.AppleDouble/
++EXCLUDE_SYMLINKS       = YES
++EXCLUDE_PATTERNS       = *.mod.*
++EXAMPLE_PATH           =
++EXAMPLE_PATTERNS       = *
++EXAMPLE_RECURSIVE      = NO
++IMAGE_PATH             =
++INPUT_FILTER           =
++FILTER_PATTERNS        =
++FILTER_SOURCE_FILES    = NO
++#---------------------------------------------------------------------------
++# configuration options related to source browsing
++#---------------------------------------------------------------------------
++SOURCE_BROWSER         = YES
++INLINE_SOURCES         = NO
++STRIP_CODE_COMMENTS    = YES
++REFERENCED_BY_RELATION = NO
++REFERENCES_RELATION    = NO
++VERBATIM_HEADERS       = NO
++#---------------------------------------------------------------------------
++# configuration options related to the alphabetical class index
++#---------------------------------------------------------------------------
++ALPHABETICAL_INDEX     = NO
++COLS_IN_ALPHA_INDEX    = 5
++IGNORE_PREFIX          =
++#---------------------------------------------------------------------------
++# configuration options related to the HTML output
++#---------------------------------------------------------------------------
++GENERATE_HTML          = YES
++HTML_OUTPUT            = html
++HTML_FILE_EXTENSION    = .html
++HTML_HEADER            =
++HTML_FOOTER            =
++HTML_STYLESHEET        =
++HTML_ALIGN_MEMBERS     = YES
++GENERATE_HTMLHELP      = NO
++CHM_FILE               =
++HHC_LOCATION           =
++GENERATE_CHI           = NO
++BINARY_TOC             = NO
++TOC_EXPAND             = NO
++DISABLE_INDEX          = NO
++ENUM_VALUES_PER_LINE   = 4
++GENERATE_TREEVIEW      = YES
++TREEVIEW_WIDTH         = 250
++#---------------------------------------------------------------------------
++# configuration options related to the LaTeX output
++#---------------------------------------------------------------------------
++GENERATE_LATEX         = NO
++LATEX_OUTPUT           = latex
++LATEX_CMD_NAME         = latex
++MAKEINDEX_CMD_NAME     = makeindex
++COMPACT_LATEX          = NO
++PAPER_TYPE             = a4wide
++EXTRA_PACKAGES         =
++LATEX_HEADER           =
++PDF_HYPERLINKS         = NO
++USE_PDFLATEX           = NO
++LATEX_BATCHMODE        = NO
++LATEX_HIDE_INDICES     = NO
++#---------------------------------------------------------------------------
++# configuration options related to the RTF output
++#---------------------------------------------------------------------------
++GENERATE_RTF           = NO
++RTF_OUTPUT             = rtf
++COMPACT_RTF            = NO
++RTF_HYPERLINKS         = NO
++RTF_STYLESHEET_FILE    =
++RTF_EXTENSIONS_FILE    =
++#---------------------------------------------------------------------------
++# configuration options related to the man page output
++#---------------------------------------------------------------------------
++GENERATE_MAN           = NO
++MAN_OUTPUT             = man
++MAN_EXTENSION          = .3
++MAN_LINKS              = NO
++#---------------------------------------------------------------------------
++# configuration options related to the XML output
++#---------------------------------------------------------------------------
++GENERATE_XML           = NO
++XML_OUTPUT             = xml
++XML_SCHEMA             =
++XML_DTD                =
++XML_PROGRAMLISTING     = YES
++#---------------------------------------------------------------------------
++# configuration options for the AutoGen Definitions output
++#---------------------------------------------------------------------------
++GENERATE_AUTOGEN_DEF   = NO
++#---------------------------------------------------------------------------
++# configuration options related to the Perl module output
++#---------------------------------------------------------------------------
++GENERATE_PERLMOD       = NO
++PERLMOD_LATEX          = NO
++PERLMOD_PRETTY         = YES
++PERLMOD_MAKEVAR_PREFIX =
++#---------------------------------------------------------------------------
++# Configuration options related to the preprocessor
++#---------------------------------------------------------------------------
++ENABLE_PREPROCESSING   = YES
++MACRO_EXPANSION        = YES
++EXPAND_ONLY_PREDEF     = YES
++SEARCH_INCLUDES        = YES
++INCLUDE_PATH           =
++INCLUDE_FILE_PATTERNS  =
++PREDEFINED             = DEVICE_ATTR DWC_EN_ISOC
++EXPAND_AS_DEFINED      = DWC_OTG_DEVICE_ATTR_BITFIELD_SHOW DWC_OTG_DEVICE_ATTR_BITFIELD_STORE DWC_OTG_DEVICE_ATTR_BITFIELD_RW DWC_OTG_DEVICE_ATTR_BITFIELD_RO DWC_OTG_DEVICE_ATTR_REG_SHOW DWC_OTG_DEVICE_ATTR_REG_STORE DWC_OTG_DEVICE_ATTR_REG32_RW DWC_OTG_DEVICE_ATTR_REG32_RO DWC_EN_ISOC
++SKIP_FUNCTION_MACROS   = NO
++#---------------------------------------------------------------------------
++# Configuration::additions related to external references
++#---------------------------------------------------------------------------
++TAGFILES               =
++GENERATE_TAGFILE       =
++ALLEXTERNALS           = NO
++EXTERNAL_GROUPS        = YES
++PERL_PATH              = /usr/bin/perl
++#---------------------------------------------------------------------------
++# Configuration options related to the dot tool
++#---------------------------------------------------------------------------
++CLASS_DIAGRAMS         = YES
++HIDE_UNDOC_RELATIONS   = YES
++HAVE_DOT               = NO
++CLASS_GRAPH            = YES
++COLLABORATION_GRAPH    = YES
++UML_LOOK               = NO
++TEMPLATE_RELATIONS     = NO
++INCLUDE_GRAPH          = YES
++INCLUDED_BY_GRAPH      = YES
++CALL_GRAPH             = NO
++GRAPHICAL_HIERARCHY    = YES
++DOT_IMAGE_FORMAT       = png
++DOT_PATH               =
++DOTFILE_DIRS           =
++MAX_DOT_GRAPH_DEPTH    = 1000
++GENERATE_LEGEND        = YES
++DOT_CLEANUP            = YES
++#---------------------------------------------------------------------------
++# Configuration::additions related to the search engine
++#---------------------------------------------------------------------------
++SEARCHENGINE           = NO
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dummy_audio.c
+@@ -0,0 +1,1574 @@
++/*
++ * zero.c -- Gadget Zero, for USB development
++ *
++ * Copyright (C) 2003-2004 David Brownell
++ * All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions, and the following disclaimer,
++ *    without modification.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. The names of the above-listed copyright holders may not be used
++ *    to endorse or promote products derived from this software without
++ *    specific prior written permission.
++ *
++ * ALTERNATIVELY, this software may be distributed under the terms of the
++ * GNU General Public License ("GPL") as published by the Free Software
++ * Foundation, either version 2 of that License or (at your option) any
++ * later version.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
++ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
++ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
++ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
++ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
++ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++
++
++/*
++ * Gadget Zero only needs two bulk endpoints, and is an example of how you
++ * can write a hardware-agnostic gadget driver running inside a USB device.
++ *
++ * Hardware details are visible (see CONFIG_USB_ZERO_* below) but don't
++ * affect most of the driver.
++ *
++ * Use it with the Linux host/master side "usbtest" driver to get a basic
++ * functional test of your device-side usb stack, or with "usb-skeleton".
++ *
++ * It supports two similar configurations.  One sinks whatever the usb host
++ * writes, and in return sources zeroes.  The other loops whatever the host
++ * writes back, so the host can read it.  Module options include:
++ *
++ *   buflen=N		default N=4096, buffer size used
++ *   qlen=N		default N=32, how many buffers in the loopback queue
++ *   loopdefault	default false, list loopback config first
++ *
++ * Many drivers will only have one configuration, letting them be much
++ * simpler if they also don't support high speed operation (like this
++ * driver does).
++ */
++
++#include <linux/config.h>
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/delay.h>
++#include <linux/ioport.h>
++#include <linux/sched.h>
++#include <linux/slab.h>
++#include <linux/smp_lock.h>
++#include <linux/errno.h>
++#include <linux/init.h>
++#include <linux/timer.h>
++#include <linux/list.h>
++#include <linux/interrupt.h>
++#include <linux/uts.h>
++#include <linux/version.h>
++#include <linux/device.h>
++#include <linux/moduleparam.h>
++#include <linux/proc_fs.h>
++
++#include <asm/byteorder.h>
++#include <asm/io.h>
++#include <asm/irq.h>
++#include <asm/system.h>
++#include <linux/unaligned.h>
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
++# include <linux/usb/ch9.h>
++#else
++# include <linux/usb_ch9.h>
++#endif
++
++#include <linux/usb_gadget.h>
++
++
++/*-------------------------------------------------------------------------*/
++/*-------------------------------------------------------------------------*/
++
++
++static int utf8_to_utf16le(const char *s, u16 *cp, unsigned len)
++{
++	int	count = 0;
++	u8	c;
++	u16	uchar;
++
++	/* this insists on correct encodings, though not minimal ones.
++	 * BUT it currently rejects legit 4-byte UTF-8 code points,
++	 * which need surrogate pairs.  (Unicode 3.1 can use them.)
++	 */
++	while (len != 0 && (c = (u8) *s++) != 0) {
++		if (unlikely(c & 0x80)) {
++			// 2-byte sequence:
++			// 00000yyyyyxxxxxx = 110yyyyy 10xxxxxx
++			if ((c & 0xe0) == 0xc0) {
++				uchar = (c & 0x1f) << 6;
++
++				c = (u8) *s++;
++				if ((c & 0xc0) != 0xc0)
++					goto fail;
++				c &= 0x3f;
++				uchar |= c;
++
++			// 3-byte sequence (most CJKV characters):
++			// zzzzyyyyyyxxxxxx = 1110zzzz 10yyyyyy 10xxxxxx
++			} else if ((c & 0xf0) == 0xe0) {
++				uchar = (c & 0x0f) << 12;
++
++				c = (u8) *s++;
++				if ((c & 0xc0) != 0xc0)
++					goto fail;
++				c &= 0x3f;
++				uchar |= c << 6;
++
++				c = (u8) *s++;
++				if ((c & 0xc0) != 0xc0)
++					goto fail;
++				c &= 0x3f;
++				uchar |= c;
++
++				/* no bogus surrogates */
++				if (0xd800 <= uchar && uchar <= 0xdfff)
++					goto fail;
++
++			// 4-byte sequence (surrogate pairs, currently rare):
++			// 11101110wwwwzzzzyy + 110111yyyyxxxxxx
++			//     = 11110uuu 10uuzzzz 10yyyyyy 10xxxxxx
++			// (uuuuu = wwww + 1)
++			// FIXME accept the surrogate code points (only)
++
++			} else
++				goto fail;
++		} else
++			uchar = c;
++		put_unaligned (cpu_to_le16 (uchar), cp++);
++		count++;
++		len--;
++	}
++	return count;
++fail:
++	return -1;
++}
++
++
++/**
++ * usb_gadget_get_string - fill out a string descriptor
++ * @table: of c strings encoded using UTF-8
++ * @id: string id, from low byte of wValue in get string descriptor
++ * @buf: at least 256 bytes
++ *
++ * Finds the UTF-8 string matching the ID, and converts it into a
++ * string descriptor in utf16-le.
++ * Returns length of descriptor (always even) or negative errno
++ *
++ * If your driver needs stings in multiple languages, you'll probably
++ * "switch (wIndex) { ... }"  in your ep0 string descriptor logic,
++ * using this routine after choosing which set of UTF-8 strings to use.
++ * Note that US-ASCII is a strict subset of UTF-8; any string bytes with
++ * the eighth bit set will be multibyte UTF-8 characters, not ISO-8859/1
++ * characters (which are also widely used in C strings).
++ */
++int
++usb_gadget_get_string (struct usb_gadget_strings *table, int id, u8 *buf)
++{
++	struct usb_string	*s;
++	int			len;
++
++	/* descriptor 0 has the language id */
++	if (id == 0) {
++		buf [0] = 4;
++		buf [1] = USB_DT_STRING;
++		buf [2] = (u8) table->language;
++		buf [3] = (u8) (table->language >> 8);
++		return 4;
++	}
++	for (s = table->strings; s && s->s; s++)
++		if (s->id == id)
++			break;
++
++	/* unrecognized: stall. */
++	if (!s || !s->s)
++		return -EINVAL;
++
++	/* string descriptors have length, tag, then UTF16-LE text */
++	len = min ((size_t) 126, strlen (s->s));
++	memset (buf + 2, 0, 2 * len);	/* zero all the bytes */
++	len = utf8_to_utf16le(s->s, (u16 *)&buf[2], len);
++	if (len < 0)
++		return -EINVAL;
++	buf [0] = (len + 1) * 2;
++	buf [1] = USB_DT_STRING;
++	return buf [0];
++}
++
++
++/*-------------------------------------------------------------------------*/
++/*-------------------------------------------------------------------------*/
++
++
++/**
++ * usb_descriptor_fillbuf - fill buffer with descriptors
++ * @buf: Buffer to be filled
++ * @buflen: Size of buf
++ * @src: Array of descriptor pointers, terminated by null pointer.
++ *
++ * Copies descriptors into the buffer, returning the length or a
++ * negative error code if they can't all be copied.  Useful when
++ * assembling descriptors for an associated set of interfaces used
++ * as part of configuring a composite device; or in other cases where
++ * sets of descriptors need to be marshaled.
++ */
++int
++usb_descriptor_fillbuf(void *buf, unsigned buflen,
++		const struct usb_descriptor_header **src)
++{
++	u8	*dest = buf;
++
++	if (!src)
++		return -EINVAL;
++
++	/* fill buffer from src[] until null descriptor ptr */
++	for (; 0 != *src; src++) {
++		unsigned		len = (*src)->bLength;
++
++		if (len > buflen)
++			return -EINVAL;
++		memcpy(dest, *src, len);
++		buflen -= len;
++		dest += len;
++	}
++	return dest - (u8 *)buf;
++}
++
++
++/**
++ * usb_gadget_config_buf - builts a complete configuration descriptor
++ * @config: Header for the descriptor, including characteristics such
++ *	as power requirements and number of interfaces.
++ * @desc: Null-terminated vector of pointers to the descriptors (interface,
++ *	endpoint, etc) defining all functions in this device configuration.
++ * @buf: Buffer for the resulting configuration descriptor.
++ * @length: Length of buffer.  If this is not big enough to hold the
++ *	entire configuration descriptor, an error code will be returned.
++ *
++ * This copies descriptors into the response buffer, building a descriptor
++ * for that configuration.  It returns the buffer length or a negative
++ * status code.  The config.wTotalLength field is set to match the length
++ * of the result, but other descriptor fields (including power usage and
++ * interface count) must be set by the caller.
++ *
++ * Gadget drivers could use this when constructing a config descriptor
++ * in response to USB_REQ_GET_DESCRIPTOR.  They will need to patch the
++ * resulting bDescriptorType value if USB_DT_OTHER_SPEED_CONFIG is needed.
++ */
++int usb_gadget_config_buf(
++	const struct usb_config_descriptor	*config,
++	void					*buf,
++	unsigned				length,
++	const struct usb_descriptor_header	**desc
++)
++{
++	struct usb_config_descriptor		*cp = buf;
++	int					len;
++
++	/* config descriptor first */
++	if (length < USB_DT_CONFIG_SIZE || !desc)
++		return -EINVAL;
++	*cp = *config;
++
++	/* then interface/endpoint/class/vendor/... */
++	len = usb_descriptor_fillbuf(USB_DT_CONFIG_SIZE + (u8*)buf,
++			length - USB_DT_CONFIG_SIZE, desc);
++	if (len < 0)
++		return len;
++	len += USB_DT_CONFIG_SIZE;
++	if (len > 0xffff)
++		return -EINVAL;
++
++	/* patch up the config descriptor */
++	cp->bLength = USB_DT_CONFIG_SIZE;
++	cp->bDescriptorType = USB_DT_CONFIG;
++	cp->wTotalLength = cpu_to_le16(len);
++	cp->bmAttributes |= USB_CONFIG_ATT_ONE;
++	return len;
++}
++
++/*-------------------------------------------------------------------------*/
++/*-------------------------------------------------------------------------*/
++
++
++#define RBUF_LEN (1024*1024)
++static int rbuf_start;
++static int rbuf_len;
++static __u8 rbuf[RBUF_LEN];
++
++/*-------------------------------------------------------------------------*/
++
++#define DRIVER_VERSION		"St Patrick's Day 2004"
++
++static const char shortname [] = "zero";
++static const char longname [] = "YAMAHA YST-MS35D USB Speaker  ";
++
++static const char source_sink [] = "source and sink data";
++static const char loopback [] = "loop input to output";
++
++/*-------------------------------------------------------------------------*/
++
++/*
++ * driver assumes self-powered hardware, and
++ * has no way for users to trigger remote wakeup.
++ *
++ * this version autoconfigures as much as possible,
++ * which is reasonable for most "bulk-only" drivers.
++ */
++static const char *EP_IN_NAME;		/* source */
++static const char *EP_OUT_NAME;		/* sink */
++
++/*-------------------------------------------------------------------------*/
++
++/* big enough to hold our biggest descriptor */
++#define USB_BUFSIZ	512
++
++struct zero_dev {
++	spinlock_t		lock;
++	struct usb_gadget	*gadget;
++	struct usb_request	*req;		/* for control responses */
++
++	/* when configured, we have one of two configs:
++	 * - source data (in to host) and sink it (out from host)
++	 * - or loop it back (out from host back in to host)
++	 */
++	u8			config;
++	struct usb_ep		*in_ep, *out_ep;
++
++	/* autoresume timer */
++	struct timer_list	resume;
++};
++
++#define xprintk(d,level,fmt,args...) \
++	dev_printk(level , &(d)->gadget->dev , fmt , ## args)
++
++#ifdef DEBUG
++#define DBG(dev,fmt,args...) \
++	xprintk(dev , KERN_DEBUG , fmt , ## args)
++#else
++#define DBG(dev,fmt,args...) \
++	do { } while (0)
++#endif /* DEBUG */
++
++#ifdef VERBOSE
++#define VDBG	DBG
++#else
++#define VDBG(dev,fmt,args...) \
++	do { } while (0)
++#endif /* VERBOSE */
++
++#define ERROR(dev,fmt,args...) \
++	xprintk(dev , KERN_ERR , fmt , ## args)
++#define WARN(dev,fmt,args...) \
++	xprintk(dev , KERN_WARNING , fmt , ## args)
++#define INFO(dev,fmt,args...) \
++	xprintk(dev , KERN_INFO , fmt , ## args)
++
++/*-------------------------------------------------------------------------*/
++
++static unsigned buflen = 4096;
++static unsigned qlen = 32;
++static unsigned pattern = 0;
++
++module_param (buflen, uint, S_IRUGO|S_IWUSR);
++module_param (qlen, uint, S_IRUGO|S_IWUSR);
++module_param (pattern, uint, S_IRUGO|S_IWUSR);
++
++/*
++ * if it's nonzero, autoresume says how many seconds to wait
++ * before trying to wake up the host after suspend.
++ */
++static unsigned autoresume = 0;
++module_param (autoresume, uint, 0);
++
++/*
++ * Normally the "loopback" configuration is second (index 1) so
++ * it's not the default.  Here's where to change that order, to
++ * work better with hosts where config changes are problematic.
++ * Or controllers (like superh) that only support one config.
++ */
++static int loopdefault = 0;
++
++module_param (loopdefault, bool, S_IRUGO|S_IWUSR);
++
++/*-------------------------------------------------------------------------*/
++
++/* Thanks to NetChip Technologies for donating this product ID.
++ *
++ * DO NOT REUSE THESE IDs with a protocol-incompatible driver!!  Ever!!
++ * Instead:  allocate your own, using normal USB-IF procedures.
++ */
++#ifndef	CONFIG_USB_ZERO_HNPTEST
++#define DRIVER_VENDOR_NUM	0x0525		/* NetChip */
++#define DRIVER_PRODUCT_NUM	0xa4a0		/* Linux-USB "Gadget Zero" */
++#else
++#define DRIVER_VENDOR_NUM	0x1a0a		/* OTG test device IDs */
++#define DRIVER_PRODUCT_NUM	0xbadd
++#endif
++
++/*-------------------------------------------------------------------------*/
++
++/*
++ * DESCRIPTORS ... most are static, but strings and (full)
++ * configuration descriptors are built on demand.
++ */
++
++/*
++#define STRING_MANUFACTURER		25
++#define STRING_PRODUCT			42
++#define STRING_SERIAL			101
++*/
++#define STRING_MANUFACTURER		1
++#define STRING_PRODUCT			2
++#define STRING_SERIAL			3
++
++#define STRING_SOURCE_SINK		250
++#define STRING_LOOPBACK			251
++
++/*
++ * This device advertises two configurations; these numbers work
++ * on a pxa250 as well as more flexible hardware.
++ */
++#define	CONFIG_SOURCE_SINK	3
++#define	CONFIG_LOOPBACK		2
++
++/*
++static struct usb_device_descriptor
++device_desc = {
++	.bLength =		sizeof device_desc,
++	.bDescriptorType =	USB_DT_DEVICE,
++
++	.bcdUSB =		__constant_cpu_to_le16 (0x0200),
++	.bDeviceClass =		USB_CLASS_VENDOR_SPEC,
++
++	.idVendor =		__constant_cpu_to_le16 (DRIVER_VENDOR_NUM),
++	.idProduct =		__constant_cpu_to_le16 (DRIVER_PRODUCT_NUM),
++	.iManufacturer =	STRING_MANUFACTURER,
++	.iProduct =		STRING_PRODUCT,
++	.iSerialNumber =	STRING_SERIAL,
++	.bNumConfigurations =	2,
++};
++*/
++static struct usb_device_descriptor
++device_desc = {
++	.bLength =		sizeof device_desc,
++	.bDescriptorType =	USB_DT_DEVICE,
++	.bcdUSB =		__constant_cpu_to_le16 (0x0100),
++	.bDeviceClass =		USB_CLASS_PER_INTERFACE,
++	.bDeviceSubClass =      0,
++	.bDeviceProtocol =      0,
++	.bMaxPacketSize0 =      64,
++	.bcdDevice =            __constant_cpu_to_le16 (0x0100),
++	.idVendor =		__constant_cpu_to_le16 (0x0499),
++	.idProduct =		__constant_cpu_to_le16 (0x3002),
++	.iManufacturer =	STRING_MANUFACTURER,
++	.iProduct =		STRING_PRODUCT,
++	.iSerialNumber =	STRING_SERIAL,
++	.bNumConfigurations =	1,
++};
++
++static struct usb_config_descriptor
++z_config = {
++	.bLength =		sizeof z_config,
++	.bDescriptorType =	USB_DT_CONFIG,
++
++	/* compute wTotalLength on the fly */
++	.bNumInterfaces =	2,
++	.bConfigurationValue =	1,
++	.iConfiguration =	0,
++	.bmAttributes =		0x40,
++	.bMaxPower =		0,	/* self-powered */
++};
++
++
++static struct usb_otg_descriptor
++otg_descriptor = {
++	.bLength =		sizeof otg_descriptor,
++	.bDescriptorType =	USB_DT_OTG,
++
++	.bmAttributes =		USB_OTG_SRP,
++};
++
++/* one interface in each configuration */
++#ifdef	CONFIG_USB_GADGET_DUALSPEED
++
++/*
++ * usb 2.0 devices need to expose both high speed and full speed
++ * descriptors, unless they only run at full speed.
++ *
++ * that means alternate endpoint descriptors (bigger packets)
++ * and a "device qualifier" ... plus more construction options
++ * for the config descriptor.
++ */
++
++static struct usb_qualifier_descriptor
++dev_qualifier = {
++	.bLength =		sizeof dev_qualifier,
++	.bDescriptorType =	USB_DT_DEVICE_QUALIFIER,
++
++	.bcdUSB =		__constant_cpu_to_le16 (0x0200),
++	.bDeviceClass =		USB_CLASS_VENDOR_SPEC,
++
++	.bNumConfigurations =	2,
++};
++
++
++struct usb_cs_as_general_descriptor {
++	__u8  bLength;
++	__u8  bDescriptorType;
++
++	__u8  bDescriptorSubType;
++	__u8  bTerminalLink;
++	__u8  bDelay;
++	__u16  wFormatTag;
++} __attribute__ ((packed));
++
++struct usb_cs_as_format_descriptor {
++	__u8  bLength;
++	__u8  bDescriptorType;
++
++	__u8  bDescriptorSubType;
++	__u8  bFormatType;
++	__u8  bNrChannels;
++	__u8  bSubframeSize;
++	__u8  bBitResolution;
++	__u8  bSamfreqType;
++	__u8  tLowerSamFreq[3];
++	__u8  tUpperSamFreq[3];
++} __attribute__ ((packed));
++
++static const struct usb_interface_descriptor
++z_audio_control_if_desc = {
++	.bLength =		sizeof z_audio_control_if_desc,
++	.bDescriptorType =	USB_DT_INTERFACE,
++	.bInterfaceNumber = 0,
++	.bAlternateSetting = 0,
++	.bNumEndpoints = 0,
++	.bInterfaceClass = USB_CLASS_AUDIO,
++	.bInterfaceSubClass = 0x1,
++	.bInterfaceProtocol = 0,
++	.iInterface = 0,
++};
++
++static const struct usb_interface_descriptor
++z_audio_if_desc = {
++	.bLength =		sizeof z_audio_if_desc,
++	.bDescriptorType =	USB_DT_INTERFACE,
++	.bInterfaceNumber = 1,
++	.bAlternateSetting = 0,
++	.bNumEndpoints = 0,
++	.bInterfaceClass = USB_CLASS_AUDIO,
++	.bInterfaceSubClass = 0x2,
++	.bInterfaceProtocol = 0,
++	.iInterface = 0,
++};
++
++static const struct usb_interface_descriptor
++z_audio_if_desc2 = {
++	.bLength =		sizeof z_audio_if_desc,
++	.bDescriptorType =	USB_DT_INTERFACE,
++	.bInterfaceNumber = 1,
++	.bAlternateSetting = 1,
++	.bNumEndpoints = 1,
++	.bInterfaceClass = USB_CLASS_AUDIO,
++	.bInterfaceSubClass = 0x2,
++	.bInterfaceProtocol = 0,
++	.iInterface = 0,
++};
++
++static const struct usb_cs_as_general_descriptor
++z_audio_cs_as_if_desc = {
++	.bLength = 7,
++	.bDescriptorType = 0x24,
++
++	.bDescriptorSubType = 0x01,
++	.bTerminalLink = 0x01,
++	.bDelay = 0x0,
++	.wFormatTag = __constant_cpu_to_le16 (0x0001)
++};
++
++
++static const struct usb_cs_as_format_descriptor
++z_audio_cs_as_format_desc = {
++	.bLength = 0xe,
++	.bDescriptorType = 0x24,
++
++	.bDescriptorSubType = 2,
++	.bFormatType = 1,
++	.bNrChannels = 1,
++	.bSubframeSize = 1,
++	.bBitResolution = 8,
++	.bSamfreqType = 0,
++	.tLowerSamFreq = {0x7e, 0x13, 0x00},
++	.tUpperSamFreq = {0xe2, 0xd6, 0x00},
++};
++
++static const struct usb_endpoint_descriptor
++z_iso_ep = {
++	.bLength = 0x09,
++	.bDescriptorType = 0x05,
++	.bEndpointAddress = 0x04,
++	.bmAttributes = 0x09,
++	.wMaxPacketSize = 0x0038,
++	.bInterval = 0x01,
++	.bRefresh = 0x00,
++	.bSynchAddress = 0x00,
++};
++
++static char z_iso_ep2[] = {0x07, 0x25, 0x01, 0x00, 0x02, 0x00, 0x02};
++
++// 9 bytes
++static char z_ac_interface_header_desc[] =
++{ 0x09, 0x24, 0x01, 0x00, 0x01, 0x2b, 0x00, 0x01, 0x01 };
++
++// 12 bytes
++static char z_0[] = {0x0c, 0x24, 0x02, 0x01, 0x01, 0x01, 0x00, 0x02,
++		     0x03, 0x00, 0x00, 0x00};
++// 13 bytes
++static char z_1[] = {0x0d, 0x24, 0x06, 0x02, 0x01, 0x02, 0x15, 0x00,
++		     0x02, 0x00, 0x02, 0x00, 0x00};
++// 9 bytes
++static char z_2[] = {0x09, 0x24, 0x03, 0x03, 0x01, 0x03, 0x00, 0x02,
++		     0x00};
++
++static char za_0[] = {0x09, 0x04, 0x01, 0x02, 0x01, 0x01, 0x02, 0x00,
++		      0x00};
++
++static char za_1[] = {0x07, 0x24, 0x01, 0x01, 0x00, 0x01, 0x00};
++
++static char za_2[] = {0x0e, 0x24, 0x02, 0x01, 0x02, 0x01, 0x08, 0x00,
++		      0x7e, 0x13, 0x00, 0xe2, 0xd6, 0x00};
++
++static char za_3[] = {0x09, 0x05, 0x04, 0x09, 0x70, 0x00, 0x01, 0x00,
++		      0x00};
++
++static char za_4[] = {0x07, 0x25, 0x01, 0x00, 0x02, 0x00, 0x02};
++
++static char za_5[] = {0x09, 0x04, 0x01, 0x03, 0x01, 0x01, 0x02, 0x00,
++		      0x00};
++
++static char za_6[] = {0x07, 0x24, 0x01, 0x01, 0x00, 0x01, 0x00};
++
++static char za_7[] = {0x0e, 0x24, 0x02, 0x01, 0x01, 0x02, 0x10, 0x00,
++		      0x7e, 0x13, 0x00, 0xe2, 0xd6, 0x00};
++
++static char za_8[] = {0x09, 0x05, 0x04, 0x09, 0x70, 0x00, 0x01, 0x00,
++		      0x00};
++
++static char za_9[] = {0x07, 0x25, 0x01, 0x00, 0x02, 0x00, 0x02};
++
++static char za_10[] = {0x09, 0x04, 0x01, 0x04, 0x01, 0x01, 0x02, 0x00,
++		       0x00};
++
++static char za_11[] = {0x07, 0x24, 0x01, 0x01, 0x00, 0x01, 0x00};
++
++static char za_12[] = {0x0e, 0x24, 0x02, 0x01, 0x02, 0x02, 0x10, 0x00,
++		       0x73, 0x13, 0x00, 0xe2, 0xd6, 0x00};
++
++static char za_13[] = {0x09, 0x05, 0x04, 0x09, 0xe0, 0x00, 0x01, 0x00,
++		       0x00};
++
++static char za_14[] = {0x07, 0x25, 0x01, 0x00, 0x02, 0x00, 0x02};
++
++static char za_15[] = {0x09, 0x04, 0x01, 0x05, 0x01, 0x01, 0x02, 0x00,
++		       0x00};
++
++static char za_16[] = {0x07, 0x24, 0x01, 0x01, 0x00, 0x01, 0x00};
++
++static char za_17[] = {0x0e, 0x24, 0x02, 0x01, 0x01, 0x03, 0x14, 0x00,
++		       0x7e, 0x13, 0x00, 0xe2, 0xd6, 0x00};
++
++static char za_18[] = {0x09, 0x05, 0x04, 0x09, 0xa8, 0x00, 0x01, 0x00,
++		       0x00};
++
++static char za_19[] = {0x07, 0x25, 0x01, 0x00, 0x02, 0x00, 0x02};
++
++static char za_20[] = {0x09, 0x04, 0x01, 0x06, 0x01, 0x01, 0x02, 0x00,
++		       0x00};
++
++static char za_21[] = {0x07, 0x24, 0x01, 0x01, 0x00, 0x01, 0x00};
++
++static char za_22[] = {0x0e, 0x24, 0x02, 0x01, 0x02, 0x03, 0x14, 0x00,
++		       0x7e, 0x13, 0x00, 0xe2, 0xd6, 0x00};
++
++static char za_23[] = {0x09, 0x05, 0x04, 0x09, 0x50, 0x01, 0x01, 0x00,
++		       0x00};
++
++static char za_24[] = {0x07, 0x25, 0x01, 0x00, 0x02, 0x00, 0x02};
++
++
++
++static const struct usb_descriptor_header *z_function [] = {
++	(struct usb_descriptor_header *) &z_audio_control_if_desc,
++	(struct usb_descriptor_header *) &z_ac_interface_header_desc,
++	(struct usb_descriptor_header *) &z_0,
++	(struct usb_descriptor_header *) &z_1,
++	(struct usb_descriptor_header *) &z_2,
++	(struct usb_descriptor_header *) &z_audio_if_desc,
++	(struct usb_descriptor_header *) &z_audio_if_desc2,
++	(struct usb_descriptor_header *) &z_audio_cs_as_if_desc,
++	(struct usb_descriptor_header *) &z_audio_cs_as_format_desc,
++	(struct usb_descriptor_header *) &z_iso_ep,
++	(struct usb_descriptor_header *) &z_iso_ep2,
++	(struct usb_descriptor_header *) &za_0,
++	(struct usb_descriptor_header *) &za_1,
++	(struct usb_descriptor_header *) &za_2,
++	(struct usb_descriptor_header *) &za_3,
++	(struct usb_descriptor_header *) &za_4,
++	(struct usb_descriptor_header *) &za_5,
++	(struct usb_descriptor_header *) &za_6,
++	(struct usb_descriptor_header *) &za_7,
++	(struct usb_descriptor_header *) &za_8,
++	(struct usb_descriptor_header *) &za_9,
++	(struct usb_descriptor_header *) &za_10,
++	(struct usb_descriptor_header *) &za_11,
++	(struct usb_descriptor_header *) &za_12,
++	(struct usb_descriptor_header *) &za_13,
++	(struct usb_descriptor_header *) &za_14,
++	(struct usb_descriptor_header *) &za_15,
++	(struct usb_descriptor_header *) &za_16,
++	(struct usb_descriptor_header *) &za_17,
++	(struct usb_descriptor_header *) &za_18,
++	(struct usb_descriptor_header *) &za_19,
++	(struct usb_descriptor_header *) &za_20,
++	(struct usb_descriptor_header *) &za_21,
++	(struct usb_descriptor_header *) &za_22,
++	(struct usb_descriptor_header *) &za_23,
++	(struct usb_descriptor_header *) &za_24,
++	NULL,
++};
++
++/* maxpacket and other transfer characteristics vary by speed. */
++#define ep_desc(g,hs,fs) (((g)->speed==USB_SPEED_HIGH)?(hs):(fs))
++
++#else
++
++/* if there's no high speed support, maxpacket doesn't change. */
++#define ep_desc(g,hs,fs) fs
++
++#endif	/* !CONFIG_USB_GADGET_DUALSPEED */
++
++static char				manufacturer [40];
++//static char				serial [40];
++static char				serial [] = "Ser 00 em";
++
++/* static strings, in UTF-8 */
++static struct usb_string		strings [] = {
++	{ STRING_MANUFACTURER, manufacturer, },
++	{ STRING_PRODUCT, longname, },
++	{ STRING_SERIAL, serial, },
++	{ STRING_LOOPBACK, loopback, },
++	{ STRING_SOURCE_SINK, source_sink, },
++	{  }			/* end of list */
++};
++
++static struct usb_gadget_strings	stringtab = {
++	.language	= 0x0409,	/* en-us */
++	.strings	= strings,
++};
++
++/*
++ * config descriptors are also handcrafted.  these must agree with code
++ * that sets configurations, and with code managing interfaces and their
++ * altsettings.  other complexity may come from:
++ *
++ *  - high speed support, including "other speed config" rules
++ *  - multiple configurations
++ *  - interfaces with alternate settings
++ *  - embedded class or vendor-specific descriptors
++ *
++ * this handles high speed, and has a second config that could as easily
++ * have been an alternate interface setting (on most hardware).
++ *
++ * NOTE:  to demonstrate (and test) more USB capabilities, this driver
++ * should include an altsetting to test interrupt transfers, including
++ * high bandwidth modes at high speed.  (Maybe work like Intel's test
++ * device?)
++ */
++static int
++config_buf (struct usb_gadget *gadget, u8 *buf, u8 type, unsigned index)
++{
++	int len;
++	const struct usb_descriptor_header **function;
++
++	function = z_function;
++	len = usb_gadget_config_buf (&z_config, buf, USB_BUFSIZ, function);
++	if (len < 0)
++		return len;
++	((struct usb_config_descriptor *) buf)->bDescriptorType = type;
++	return len;
++}
++
++/*-------------------------------------------------------------------------*/
++
++static struct usb_request *
++alloc_ep_req (struct usb_ep *ep, unsigned length)
++{
++	struct usb_request	*req;
++
++	req = usb_ep_alloc_request (ep, GFP_ATOMIC);
++	if (req) {
++		req->length = length;
++		req->buf = usb_ep_alloc_buffer (ep, length,
++				&req->dma, GFP_ATOMIC);
++		if (!req->buf) {
++			usb_ep_free_request (ep, req);
++			req = NULL;
++		}
++	}
++	return req;
++}
++
++static void free_ep_req (struct usb_ep *ep, struct usb_request *req)
++{
++	if (req->buf)
++		usb_ep_free_buffer (ep, req->buf, req->dma, req->length);
++	usb_ep_free_request (ep, req);
++}
++
++/*-------------------------------------------------------------------------*/
++
++/* optionally require specific source/sink data patterns  */
++
++static int
++check_read_data (
++	struct zero_dev		*dev,
++	struct usb_ep		*ep,
++	struct usb_request	*req
++)
++{
++	unsigned	i;
++	u8		*buf = req->buf;
++
++	for (i = 0; i < req->actual; i++, buf++) {
++		switch (pattern) {
++		/* all-zeroes has no synchronization issues */
++		case 0:
++			if (*buf == 0)
++				continue;
++			break;
++		/* mod63 stays in sync with short-terminated transfers,
++		 * or otherwise when host and gadget agree on how large
++		 * each usb transfer request should be.  resync is done
++		 * with set_interface or set_config.
++		 */
++		case 1:
++			if (*buf == (u8)(i % 63))
++				continue;
++			break;
++		}
++		ERROR (dev, "bad OUT byte, buf [%d] = %d\n", i, *buf);
++		usb_ep_set_halt (ep);
++		return -EINVAL;
++	}
++	return 0;
++}
++
++/*-------------------------------------------------------------------------*/
++
++static void zero_reset_config (struct zero_dev *dev)
++{
++	if (dev->config == 0)
++		return;
++
++	DBG (dev, "reset config\n");
++
++	/* just disable endpoints, forcing completion of pending i/o.
++	 * all our completion handlers free their requests in this case.
++	 */
++	if (dev->in_ep) {
++		usb_ep_disable (dev->in_ep);
++		dev->in_ep = NULL;
++	}
++	if (dev->out_ep) {
++		usb_ep_disable (dev->out_ep);
++		dev->out_ep = NULL;
++	}
++	dev->config = 0;
++	del_timer (&dev->resume);
++}
++
++#define _write(f, buf, sz) (f->f_op->write(f, buf, sz, &f->f_pos))
++
++static void
++zero_isoc_complete (struct usb_ep *ep, struct usb_request *req)
++{
++	struct zero_dev	*dev = ep->driver_data;
++	int		status = req->status;
++	int i, j;
++
++	switch (status) {
++
++	case 0: 			/* normal completion? */
++		//printk ("\nzero ---------------> isoc normal completion %d bytes\n", req->actual);
++		for (i=0, j=rbuf_start; i<req->actual; i++) {
++			//printk ("%02x ", ((__u8*)req->buf)[i]);
++			rbuf[j] = ((__u8*)req->buf)[i];
++			j++;
++			if (j >= RBUF_LEN) j=0;
++		}
++		rbuf_start = j;
++		//printk ("\n\n");
++
++		if (rbuf_len < RBUF_LEN) {
++			rbuf_len += req->actual;
++			if (rbuf_len > RBUF_LEN) {
++				rbuf_len = RBUF_LEN;
++			}
++		}
++
++		break;
++
++	/* this endpoint is normally active while we're configured */
++	case -ECONNABORTED: 		/* hardware forced ep reset */
++	case -ECONNRESET:		/* request dequeued */
++	case -ESHUTDOWN:		/* disconnect from host */
++		VDBG (dev, "%s gone (%d), %d/%d\n", ep->name, status,
++				req->actual, req->length);
++		if (ep == dev->out_ep)
++			check_read_data (dev, ep, req);
++		free_ep_req (ep, req);
++		return;
++
++	case -EOVERFLOW:		/* buffer overrun on read means that
++					 * we didn't provide a big enough
++					 * buffer.
++					 */
++	default:
++#if 1
++		DBG (dev, "%s complete --> %d, %d/%d\n", ep->name,
++				status, req->actual, req->length);
++#endif
++	case -EREMOTEIO:		/* short read */
++		break;
++	}
++
++	status = usb_ep_queue (ep, req, GFP_ATOMIC);
++	if (status) {
++		ERROR (dev, "kill %s:  resubmit %d bytes --> %d\n",
++				ep->name, req->length, status);
++		usb_ep_set_halt (ep);
++		/* FIXME recover later ... somehow */
++	}
++}
++
++static struct usb_request *
++zero_start_isoc_ep (struct usb_ep *ep, int gfp_flags)
++{
++	struct usb_request	*req;
++	int			status;
++
++	req = alloc_ep_req (ep, 512);
++	if (!req)
++		return NULL;
++
++	req->complete = zero_isoc_complete;
++
++	status = usb_ep_queue (ep, req, gfp_flags);
++	if (status) {
++		struct zero_dev	*dev = ep->driver_data;
++
++		ERROR (dev, "start %s --> %d\n", ep->name, status);
++		free_ep_req (ep, req);
++		req = NULL;
++	}
++
++	return req;
++}
++
++/* change our operational config.  this code must agree with the code
++ * that returns config descriptors, and altsetting code.
++ *
++ * it's also responsible for power management interactions. some
++ * configurations might not work with our current power sources.
++ *
++ * note that some device controller hardware will constrain what this
++ * code can do, perhaps by disallowing more than one configuration or
++ * by limiting configuration choices (like the pxa2xx).
++ */
++static int
++zero_set_config (struct zero_dev *dev, unsigned number, int gfp_flags)
++{
++	int			result = 0;
++	struct usb_gadget	*gadget = dev->gadget;
++	const struct usb_endpoint_descriptor	*d;
++	struct usb_ep		*ep;
++
++	if (number == dev->config)
++		return 0;
++
++	zero_reset_config (dev);
++
++	gadget_for_each_ep (ep, gadget) {
++
++		if (strcmp (ep->name, "ep4") == 0) {
++
++			d = (struct usb_endpoint_descripter *)&za_23; // isoc ep desc for audio i/f alt setting 6
++			result = usb_ep_enable (ep, d);
++
++			if (result == 0) {
++				ep->driver_data = dev;
++				dev->in_ep = ep;
++
++				if (zero_start_isoc_ep (ep, gfp_flags) != 0) {
++
++					dev->in_ep = ep;
++					continue;
++				}
++
++				usb_ep_disable (ep);
++				result = -EIO;
++			}
++		}
++
++	}
++
++	dev->config = number;
++	return result;
++}
++
++/*-------------------------------------------------------------------------*/
++
++static void zero_setup_complete (struct usb_ep *ep, struct usb_request *req)
++{
++	if (req->status || req->actual != req->length)
++		DBG ((struct zero_dev *) ep->driver_data,
++				"setup complete --> %d, %d/%d\n",
++				req->status, req->actual, req->length);
++}
++
++/*
++ * The setup() callback implements all the ep0 functionality that's
++ * not handled lower down, in hardware or the hardware driver (like
++ * device and endpoint feature flags, and their status).  It's all
++ * housekeeping for the gadget function we're implementing.  Most of
++ * the work is in config-specific setup.
++ */
++static int
++zero_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
++{
++	struct zero_dev		*dev = get_gadget_data (gadget);
++	struct usb_request	*req = dev->req;
++	int			value = -EOPNOTSUPP;
++
++	/* usually this stores reply data in the pre-allocated ep0 buffer,
++	 * but config change events will reconfigure hardware.
++	 */
++	req->zero = 0;
++	switch (ctrl->bRequest) {
++
++	case USB_REQ_GET_DESCRIPTOR:
++
++		switch (ctrl->wValue >> 8) {
++
++		case USB_DT_DEVICE:
++			value = min (ctrl->wLength, (u16) sizeof device_desc);
++			memcpy (req->buf, &device_desc, value);
++			break;
++#ifdef CONFIG_USB_GADGET_DUALSPEED
++		case USB_DT_DEVICE_QUALIFIER:
++			if (!gadget->is_dualspeed)
++				break;
++			value = min (ctrl->wLength, (u16) sizeof dev_qualifier);
++			memcpy (req->buf, &dev_qualifier, value);
++			break;
++
++		case USB_DT_OTHER_SPEED_CONFIG:
++			if (!gadget->is_dualspeed)
++				break;
++			// FALLTHROUGH
++#endif /* CONFIG_USB_GADGET_DUALSPEED */
++		case USB_DT_CONFIG:
++			value = config_buf (gadget, req->buf,
++					ctrl->wValue >> 8,
++					ctrl->wValue & 0xff);
++			if (value >= 0)
++				value = min (ctrl->wLength, (u16) value);
++			break;
++
++		case USB_DT_STRING:
++			/* wIndex == language code.
++			 * this driver only handles one language, you can
++			 * add string tables for other languages, using
++			 * any UTF-8 characters
++			 */
++			value = usb_gadget_get_string (&stringtab,
++					ctrl->wValue & 0xff, req->buf);
++			if (value >= 0) {
++				value = min (ctrl->wLength, (u16) value);
++			}
++			break;
++		}
++		break;
++
++	/* currently two configs, two speeds */
++	case USB_REQ_SET_CONFIGURATION:
++		if (ctrl->bRequestType != 0)
++			goto unknown;
++
++		spin_lock (&dev->lock);
++		value = zero_set_config (dev, ctrl->wValue, GFP_ATOMIC);
++		spin_unlock (&dev->lock);
++		break;
++	case USB_REQ_GET_CONFIGURATION:
++		if (ctrl->bRequestType != USB_DIR_IN)
++			goto unknown;
++		*(u8 *)req->buf = dev->config;
++		value = min (ctrl->wLength, (u16) 1);
++		break;
++
++	/* until we add altsetting support, or other interfaces,
++	 * only 0/0 are possible.  pxa2xx only supports 0/0 (poorly)
++	 * and already killed pending endpoint I/O.
++	 */
++	case USB_REQ_SET_INTERFACE:
++
++		if (ctrl->bRequestType != USB_RECIP_INTERFACE)
++			goto unknown;
++		spin_lock (&dev->lock);
++		if (dev->config) {
++			u8		config = dev->config;
++
++			/* resets interface configuration, forgets about
++			 * previous transaction state (queued bufs, etc)
++			 * and re-inits endpoint state (toggle etc)
++			 * no response queued, just zero status == success.
++			 * if we had more than one interface we couldn't
++			 * use this "reset the config" shortcut.
++			 */
++			zero_reset_config (dev);
++			zero_set_config (dev, config, GFP_ATOMIC);
++			value = 0;
++		}
++		spin_unlock (&dev->lock);
++		break;
++	case USB_REQ_GET_INTERFACE:
++		if ((ctrl->bRequestType == 0x21) && (ctrl->wIndex == 0x02)) {
++			value = ctrl->wLength;
++			break;
++		}
++		else {
++			if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE))
++				goto unknown;
++			if (!dev->config)
++				break;
++			if (ctrl->wIndex != 0) {
++				value = -EDOM;
++				break;
++			}
++			*(u8 *)req->buf = 0;
++			value = min (ctrl->wLength, (u16) 1);
++		}
++		break;
++
++	/*
++	 * These are the same vendor-specific requests supported by
++	 * Intel's USB 2.0 compliance test devices.  We exceed that
++	 * device spec by allowing multiple-packet requests.
++	 */
++	case 0x5b:	/* control WRITE test -- fill the buffer */
++		if (ctrl->bRequestType != (USB_DIR_OUT|USB_TYPE_VENDOR))
++			goto unknown;
++		if (ctrl->wValue || ctrl->wIndex)
++			break;
++		/* just read that many bytes into the buffer */
++		if (ctrl->wLength > USB_BUFSIZ)
++			break;
++		value = ctrl->wLength;
++		break;
++	case 0x5c:	/* control READ test -- return the buffer */
++		if (ctrl->bRequestType != (USB_DIR_IN|USB_TYPE_VENDOR))
++			goto unknown;
++		if (ctrl->wValue || ctrl->wIndex)
++			break;
++		/* expect those bytes are still in the buffer; send back */
++		if (ctrl->wLength > USB_BUFSIZ
++				|| ctrl->wLength != req->length)
++			break;
++		value = ctrl->wLength;
++		break;
++
++	case 0x01: // SET_CUR
++	case 0x02:
++	case 0x03:
++	case 0x04:
++	case 0x05:
++		value = ctrl->wLength;
++		break;
++	case 0x81:
++		switch (ctrl->wValue) {
++		case 0x0201:
++		case 0x0202:
++			((u8*)req->buf)[0] = 0x00;
++			((u8*)req->buf)[1] = 0xe3;
++			break;
++		case 0x0300:
++		case 0x0500:
++			((u8*)req->buf)[0] = 0x00;
++			break;
++		}
++		//((u8*)req->buf)[0] = 0x81;
++		//((u8*)req->buf)[1] = 0x81;
++		value = ctrl->wLength;
++		break;
++	case 0x82:
++		switch (ctrl->wValue) {
++		case 0x0201:
++		case 0x0202:
++			((u8*)req->buf)[0] = 0x00;
++			((u8*)req->buf)[1] = 0xc3;
++			break;
++		case 0x0300:
++		case 0x0500:
++			((u8*)req->buf)[0] = 0x00;
++			break;
++		}
++		//((u8*)req->buf)[0] = 0x82;
++		//((u8*)req->buf)[1] = 0x82;
++		value = ctrl->wLength;
++		break;
++	case 0x83:
++		switch (ctrl->wValue) {
++		case 0x0201:
++		case 0x0202:
++			((u8*)req->buf)[0] = 0x00;
++			((u8*)req->buf)[1] = 0x00;
++			break;
++		case 0x0300:
++			((u8*)req->buf)[0] = 0x60;
++			break;
++		case 0x0500:
++			((u8*)req->buf)[0] = 0x18;
++			break;
++		}
++		//((u8*)req->buf)[0] = 0x83;
++		//((u8*)req->buf)[1] = 0x83;
++		value = ctrl->wLength;
++		break;
++	case 0x84:
++		switch (ctrl->wValue) {
++		case 0x0201:
++		case 0x0202:
++			((u8*)req->buf)[0] = 0x00;
++			((u8*)req->buf)[1] = 0x01;
++			break;
++		case 0x0300:
++		case 0x0500:
++			((u8*)req->buf)[0] = 0x08;
++			break;
++		}
++		//((u8*)req->buf)[0] = 0x84;
++		//((u8*)req->buf)[1] = 0x84;
++		value = ctrl->wLength;
++		break;
++	case 0x85:
++		((u8*)req->buf)[0] = 0x85;
++		((u8*)req->buf)[1] = 0x85;
++		value = ctrl->wLength;
++		break;
++
++
++	default:
++unknown:
++		printk("unknown control req%02x.%02x v%04x i%04x l%d\n",
++			ctrl->bRequestType, ctrl->bRequest,
++			ctrl->wValue, ctrl->wIndex, ctrl->wLength);
++	}
++
++	/* respond with data transfer before status phase? */
++	if (value >= 0) {
++		req->length = value;
++		req->zero = value < ctrl->wLength
++				&& (value % gadget->ep0->maxpacket) == 0;
++		value = usb_ep_queue (gadget->ep0, req, GFP_ATOMIC);
++		if (value < 0) {
++			DBG (dev, "ep_queue < 0 --> %d\n", value);
++			req->status = 0;
++			zero_setup_complete (gadget->ep0, req);
++		}
++	}
++
++	/* device either stalls (value < 0) or reports success */
++	return value;
++}
++
++static void
++zero_disconnect (struct usb_gadget *gadget)
++{
++	struct zero_dev		*dev = get_gadget_data (gadget);
++	unsigned long		flags;
++
++	spin_lock_irqsave (&dev->lock, flags);
++	zero_reset_config (dev);
++
++	/* a more significant application might have some non-usb
++	 * activities to quiesce here, saving resources like power
++	 * or pushing the notification up a network stack.
++	 */
++	spin_unlock_irqrestore (&dev->lock, flags);
++
++	/* next we may get setup() calls to enumerate new connections;
++	 * or an unbind() during shutdown (including removing module).
++	 */
++}
++
++static void
++zero_autoresume (unsigned long _dev)
++{
++	struct zero_dev	*dev = (struct zero_dev *) _dev;
++	int		status;
++
++	/* normally the host would be woken up for something
++	 * more significant than just a timer firing...
++	 */
++	if (dev->gadget->speed != USB_SPEED_UNKNOWN) {
++		status = usb_gadget_wakeup (dev->gadget);
++		DBG (dev, "wakeup --> %d\n", status);
++	}
++}
++
++/*-------------------------------------------------------------------------*/
++
++static void
++zero_unbind (struct usb_gadget *gadget)
++{
++	struct zero_dev		*dev = get_gadget_data (gadget);
++
++	DBG (dev, "unbind\n");
++
++	/* we've already been disconnected ... no i/o is active */
++	if (dev->req)
++		free_ep_req (gadget->ep0, dev->req);
++	del_timer_sync (&dev->resume);
++	kfree (dev);
++	set_gadget_data (gadget, NULL);
++}
++
++static int
++zero_bind (struct usb_gadget *gadget)
++{
++	struct zero_dev		*dev;
++	//struct usb_ep		*ep;
++
++	printk("binding\n");
++	/*
++	 * DRIVER POLICY CHOICE:  you may want to do this differently.
++	 * One thing to avoid is reusing a bcdDevice revision code
++	 * with different host-visible configurations or behavior
++	 * restrictions -- using ep1in/ep2out vs ep1out/ep3in, etc
++	 */
++	//device_desc.bcdDevice = __constant_cpu_to_le16 (0x0201);
++
++
++	/* ok, we made sense of the hardware ... */
++	dev = kzalloc (sizeof *dev, SLAB_KERNEL);
++	if (!dev)
++		return -ENOMEM;
++	spin_lock_init (&dev->lock);
++	dev->gadget = gadget;
++	set_gadget_data (gadget, dev);
++
++	/* preallocate control response and buffer */
++	dev->req = usb_ep_alloc_request (gadget->ep0, GFP_KERNEL);
++	if (!dev->req)
++		goto enomem;
++	dev->req->buf = usb_ep_alloc_buffer (gadget->ep0, USB_BUFSIZ,
++				&dev->req->dma, GFP_KERNEL);
++	if (!dev->req->buf)
++		goto enomem;
++
++	dev->req->complete = zero_setup_complete;
++
++	device_desc.bMaxPacketSize0 = gadget->ep0->maxpacket;
++
++#ifdef CONFIG_USB_GADGET_DUALSPEED
++	/* assume ep0 uses the same value for both speeds ... */
++	dev_qualifier.bMaxPacketSize0 = device_desc.bMaxPacketSize0;
++
++	/* and that all endpoints are dual-speed */
++	//hs_source_desc.bEndpointAddress = fs_source_desc.bEndpointAddress;
++	//hs_sink_desc.bEndpointAddress = fs_sink_desc.bEndpointAddress;
++#endif
++
++	usb_gadget_set_selfpowered (gadget);
++
++	init_timer (&dev->resume);
++	dev->resume.function = zero_autoresume;
++	dev->resume.data = (unsigned long) dev;
++
++	gadget->ep0->driver_data = dev;
++
++	INFO (dev, "%s, version: " DRIVER_VERSION "\n", longname);
++	INFO (dev, "using %s, OUT %s IN %s\n", gadget->name,
++		EP_OUT_NAME, EP_IN_NAME);
++
++	snprintf (manufacturer, sizeof manufacturer,
++		UTS_SYSNAME " " UTS_RELEASE " with %s",
++		gadget->name);
++
++	return 0;
++
++enomem:
++	zero_unbind (gadget);
++	return -ENOMEM;
++}
++
++/*-------------------------------------------------------------------------*/
++
++static void
++zero_suspend (struct usb_gadget *gadget)
++{
++	struct zero_dev		*dev = get_gadget_data (gadget);
++
++	if (gadget->speed == USB_SPEED_UNKNOWN)
++		return;
++
++	if (autoresume) {
++		mod_timer (&dev->resume, jiffies + (HZ * autoresume));
++		DBG (dev, "suspend, wakeup in %d seconds\n", autoresume);
++	} else
++		DBG (dev, "suspend\n");
++}
++
++static void
++zero_resume (struct usb_gadget *gadget)
++{
++	struct zero_dev		*dev = get_gadget_data (gadget);
++
++	DBG (dev, "resume\n");
++	del_timer (&dev->resume);
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static struct usb_gadget_driver zero_driver = {
++#ifdef CONFIG_USB_GADGET_DUALSPEED
++	.speed		= USB_SPEED_HIGH,
++#else
++	.speed		= USB_SPEED_FULL,
++#endif
++	.function	= (char *) longname,
++	.bind		= zero_bind,
++	.unbind		= zero_unbind,
++
++	.setup		= zero_setup,
++	.disconnect	= zero_disconnect,
++
++	.suspend	= zero_suspend,
++	.resume		= zero_resume,
++
++	.driver 	= {
++		.name		= (char *) shortname,
++		// .shutdown = ...
++		// .suspend = ...
++		// .resume = ...
++	},
++};
++
++MODULE_AUTHOR ("David Brownell");
++MODULE_LICENSE ("Dual BSD/GPL");
++
++static struct proc_dir_entry *pdir, *pfile;
++
++static int isoc_read_data (char *page, char **start,
++			   off_t off, int count,
++			   int *eof, void *data)
++{
++	int i;
++	static int c = 0;
++	static int done = 0;
++	static int s = 0;
++
++/*
++	printk ("\ncount: %d\n", count);
++	printk ("rbuf_start: %d\n", rbuf_start);
++	printk ("rbuf_len: %d\n", rbuf_len);
++	printk ("off: %d\n", off);
++	printk ("start: %p\n\n", *start);
++*/
++	if (done) {
++		c = 0;
++		done = 0;
++		*eof = 1;
++		return 0;
++	}
++
++	if (c == 0) {
++		if (rbuf_len == RBUF_LEN)
++			s = rbuf_start;
++		else s = 0;
++	}
++
++	for (i=0; i<count && c<rbuf_len; i++, c++) {
++		page[i] = rbuf[(c+s) % RBUF_LEN];
++	}
++	*start = page;
++
++	if (c >= rbuf_len) {
++		*eof = 1;
++		done = 1;
++	}
++
++
++	return i;
++}
++
++static int __init init (void)
++{
++
++	int retval = 0;
++
++	pdir = proc_mkdir("isoc_test", NULL);
++	if(pdir == NULL) {
++		retval = -ENOMEM;
++		printk("Error creating dir\n");
++		goto done;
++	}
++	pdir->owner = THIS_MODULE;
++
++	pfile = create_proc_read_entry("isoc_data",
++				       0444, pdir,
++				       isoc_read_data,
++				       NULL);
++	if (pfile == NULL) {
++		retval = -ENOMEM;
++		printk("Error creating file\n");
++		goto no_file;
++	}
++	pfile->owner = THIS_MODULE;
++
++	return usb_gadget_register_driver (&zero_driver);
++
++ no_file:
++	remove_proc_entry("isoc_data", NULL);
++ done:
++	return retval;
++}
++module_init (init);
++
++static void __exit cleanup (void)
++{
++
++	usb_gadget_unregister_driver (&zero_driver);
++
++	remove_proc_entry("isoc_data", pdir);
++	remove_proc_entry("isoc_test", NULL);
++}
++module_exit (cleanup);
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_cfi_common.h
+@@ -0,0 +1,142 @@
++/* ==========================================================================
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++#if !defined(__DWC_CFI_COMMON_H__)
++#define __DWC_CFI_COMMON_H__
++
++//#include <linux/types.h>
++
++/**
++ * @file
++ *
++ * This file contains the CFI specific common constants, interfaces
++ * (functions and macros) and structures for Linux. No PCD specific
++ * data structure or definition is to be included in this file.
++ *
++ */
++
++/** This is a request for all Core Features */
++#define VEN_CORE_GET_FEATURES		0xB1
++
++/** This is a request to get the value of a specific Core Feature */
++#define VEN_CORE_GET_FEATURE		0xB2
++
++/** This command allows the host to set the value of a specific Core Feature */
++#define VEN_CORE_SET_FEATURE		0xB3
++
++/** This command allows the host to set the default values of
++ * either all or any specific Core Feature
++ */
++#define VEN_CORE_RESET_FEATURES		0xB4
++
++/** This command forces the PCD to write the deferred values of a Core Features */
++#define VEN_CORE_ACTIVATE_FEATURES	0xB5
++
++/** This request reads a DWORD value from a register at the specified offset */
++#define VEN_CORE_READ_REGISTER		0xB6
++
++/** This request writes a DWORD value into a register at the specified offset */
++#define VEN_CORE_WRITE_REGISTER		0xB7
++
++/** This structure is the header of the Core Features dataset returned to
++ *  the Host
++ */
++struct cfi_all_features_header {
++/** The features header structure length is */
++#define CFI_ALL_FEATURES_HDR_LEN		8
++	/**
++	 * The total length of the features dataset returned to the Host
++	 */
++	uint16_t wTotalLen;
++
++	/**
++	 * CFI version number inBinary-Coded Decimal (i.e., 1.00 is 100H).
++	 * This field identifies the version of the CFI Specification with which
++	 * the device is compliant.
++	 */
++	uint16_t wVersion;
++
++	/** The ID of the Core */
++	uint16_t wCoreID;
++#define CFI_CORE_ID_UDC		1
++#define CFI_CORE_ID_OTG		2
++#define CFI_CORE_ID_WUDEV	3
++
++	/** Number of features returned by VEN_CORE_GET_FEATURES request */
++	uint16_t wNumFeatures;
++} UPACKED;
++
++typedef struct cfi_all_features_header cfi_all_features_header_t;
++
++/** This structure is a header of the Core Feature descriptor dataset returned to
++ *  the Host after the VEN_CORE_GET_FEATURES request
++ */
++struct cfi_feature_desc_header {
++#define CFI_FEATURE_DESC_HDR_LEN	8
++
++	/** The feature ID */
++	uint16_t wFeatureID;
++
++	/** Length of this feature descriptor in bytes - including the
++	 * length of the feature name string
++	 */
++	uint16_t wLength;
++
++	/** The data length of this feature in bytes */
++	uint16_t wDataLength;
++
++	/**
++	 * Attributes of this features
++	 * D0: Access rights
++	 * 0 - Read/Write
++	 * 1 - Read only
++	 */
++	uint8_t bmAttributes;
++#define CFI_FEATURE_ATTR_RO		1
++#define CFI_FEATURE_ATTR_RW		0
++
++	/** Length of the feature name in bytes */
++	uint8_t bNameLen;
++
++	/** The feature name buffer */
++	//uint8_t *name;
++} UPACKED;
++
++typedef struct cfi_feature_desc_header cfi_feature_desc_header_t;
++
++/**
++ * This structure describes a NULL terminated string referenced by its id field.
++ * It is very similar to usb_string structure but has the id field type set to 16-bit.
++ */
++struct cfi_string {
++	uint16_t id;
++	const uint8_t *s;
++};
++typedef struct cfi_string cfi_string_t;
++
++#endif
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_adp.c
+@@ -0,0 +1,842 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_adp.c $
++ * $Revision: #12 $
++ * $Date: 2011/10/26 $
++ * $Change: 1873028 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++#include "dwc_os.h"
++#include "dwc_otg_regs.h"
++#include "dwc_otg_cil.h"
++#include "dwc_otg_adp.h"
++
++/** @file
++ *
++ * This file contains the most of the Attach Detect Protocol implementation for
++ * the driver to support OTG Rev2.0.
++ *
++ */
++
++void dwc_otg_adp_write_reg(dwc_otg_core_if_t * core_if, uint32_t value)
++{
++	adpctl_data_t adpctl;
++
++	adpctl.d32 = value;
++	adpctl.b.ar = 0x2;
++
++	DWC_WRITE_REG32(&core_if->core_global_regs->adpctl, adpctl.d32);
++
++	while (adpctl.b.ar) {
++		adpctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->adpctl);
++	}
++
++}
++
++/**
++ * Function is called to read ADP registers
++ */
++uint32_t dwc_otg_adp_read_reg(dwc_otg_core_if_t * core_if)
++{
++	adpctl_data_t adpctl;
++
++	adpctl.d32 = 0;
++	adpctl.b.ar = 0x1;
++
++	DWC_WRITE_REG32(&core_if->core_global_regs->adpctl, adpctl.d32);
++
++	while (adpctl.b.ar) {
++		adpctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->adpctl);
++	}
++
++	return adpctl.d32;
++}
++
++/**
++ * Function is called to read ADPCTL register and filter Write-clear bits
++ */
++static uint32_t dwc_otg_adp_read_reg_filter(dwc_otg_core_if_t * core_if)
++{
++	adpctl_data_t adpctl;
++
++	adpctl.d32 = dwc_otg_adp_read_reg(core_if);
++	adpctl.b.adp_tmout_int = 0;
++	adpctl.b.adp_prb_int = 0;
++	adpctl.b.adp_tmout_int = 0;
++
++	return adpctl.d32;
++}
++
++static void adp_sense_timeout(void *ptr)
++{
++	dwc_otg_core_if_t *core_if = (dwc_otg_core_if_t *) ptr;
++	core_if->adp.sense_timer_started = 0;
++	DWC_PRINTF("ADP SENSE TIMEOUT\n");
++	if (core_if->adp_enable) {
++		dwc_otg_adp_sense_stop(core_if);
++		dwc_otg_adp_probe_start(core_if);
++	}
++}
++
++/**
++ * This function is called when the ADP vbus timer expires. Timeout is 1.1s.
++ */
++static void adp_vbuson_timeout(void *ptr)
++{
++	gpwrdn_data_t gpwrdn;
++	dwc_otg_core_if_t *core_if = (dwc_otg_core_if_t *) ptr;
++	hprt0_data_t hprt0 = {.d32 = 0 };
++	pcgcctl_data_t pcgcctl = {.d32 = 0 };
++	DWC_PRINTF("%s: 1.1 seconds expire after turning on VBUS\n",__FUNCTION__);
++	if (core_if) {
++		core_if->adp.vbuson_timer_started = 0;
++		/* Turn off vbus */
++		hprt0.b.prtpwr = 1;
++		DWC_MODIFY_REG32(core_if->host_if->hprt0, hprt0.d32, 0);
++		gpwrdn.d32 = 0;
++
++		/* Power off the core */
++		if (core_if->power_down == 2) {
++			/* Enable Wakeup Logic */
++//                      gpwrdn.b.wkupactiv = 1;
++			gpwrdn.b.pmuactv = 0;
++			gpwrdn.b.pwrdnrstn = 1;
++			gpwrdn.b.pwrdnclmp = 1;
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0,
++					 gpwrdn.d32);
++
++			/* Suspend the Phy Clock */
++			pcgcctl.b.stoppclk = 1;
++			DWC_MODIFY_REG32(core_if->pcgcctl, 0, pcgcctl.d32);
++
++			/* Switch on VDD */
++//                      gpwrdn.b.wkupactiv = 1;
++			gpwrdn.b.pmuactv = 1;
++			gpwrdn.b.pwrdnrstn = 1;
++			gpwrdn.b.pwrdnclmp = 1;
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0,
++					 gpwrdn.d32);
++		} else {
++			/* Enable Power Down Logic */
++			gpwrdn.b.pmuintsel = 1;
++			gpwrdn.b.pmuactv = 1;
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++		}
++
++		/* Power off the core */
++		if (core_if->power_down == 2) {
++			gpwrdn.d32 = 0;
++			gpwrdn.b.pwrdnswtch = 1;
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn,
++					 gpwrdn.d32, 0);
++		}
++
++		/* Unmask SRP detected interrupt from Power Down Logic */
++		gpwrdn.d32 = 0;
++		gpwrdn.b.srp_det_msk = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++
++		dwc_otg_adp_probe_start(core_if);
++		dwc_otg_dump_global_registers(core_if);
++		dwc_otg_dump_host_registers(core_if);
++	}
++
++}
++
++/**
++ * Start the ADP Initial Probe timer to detect if Port Connected interrupt is
++ * not asserted within 1.1 seconds.
++ *
++ * @param core_if the pointer to core_if strucure.
++ */
++static void dwc_otg_adp_vbuson_timer_start(dwc_otg_core_if_t * core_if)
++{
++	core_if->adp.vbuson_timer_started = 1;
++	if (core_if->adp.vbuson_timer)
++	{
++		DWC_PRINTF("SCHEDULING VBUSON TIMER\n");
++		/* 1.1 secs + 60ms necessary for cil_hcd_start*/
++		DWC_TIMER_SCHEDULE(core_if->adp.vbuson_timer, 1160);
++	} else {
++		DWC_WARN("VBUSON_TIMER = %p\n",core_if->adp.vbuson_timer);
++	}
++}
++
++#if 0
++/**
++ * Masks all DWC OTG core interrupts
++ *
++ */
++static void mask_all_interrupts(dwc_otg_core_if_t * core_if)
++{
++	int i;
++	gahbcfg_data_t ahbcfg = {.d32 = 0 };
++
++	/* Mask Host Interrupts */
++
++	/* Clear and disable HCINTs */
++	for (i = 0; i < core_if->core_params->host_channels; i++) {
++		DWC_WRITE_REG32(&core_if->host_if->hc_regs[i]->hcintmsk, 0);
++		DWC_WRITE_REG32(&core_if->host_if->hc_regs[i]->hcint, 0xFFFFFFFF);
++
++	}
++
++	/* Clear and disable HAINT */
++	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->haintmsk, 0x0000);
++	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->haint, 0xFFFFFFFF);
++
++	/* Mask Device Interrupts */
++	if (!core_if->multiproc_int_enable) {
++		/* Clear and disable IN Endpoint interrupts */
++		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->diepmsk, 0);
++		for (i = 0; i <= core_if->dev_if->num_in_eps; i++) {
++			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[i]->
++					diepint, 0xFFFFFFFF);
++		}
++
++		/* Clear and disable OUT Endpoint interrupts */
++		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->doepmsk, 0);
++		for (i = 0; i <= core_if->dev_if->num_out_eps; i++) {
++			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[i]->
++					doepint, 0xFFFFFFFF);
++		}
++
++		/* Clear and disable DAINT */
++		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->daint,
++				0xFFFFFFFF);
++		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->daintmsk, 0);
++	} else {
++		for (i = 0; i < core_if->dev_if->num_in_eps; ++i) {
++			DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->
++					diepeachintmsk[i], 0);
++			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[i]->
++					diepint, 0xFFFFFFFF);
++		}
++
++		for (i = 0; i < core_if->dev_if->num_out_eps; ++i) {
++			DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->
++					doepeachintmsk[i], 0);
++			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[i]->
++					doepint, 0xFFFFFFFF);
++		}
++
++		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->deachintmsk,
++				0);
++		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->deachint,
++				0xFFFFFFFF);
++
++	}
++
++	/* Disable interrupts */
++	ahbcfg.b.glblintrmsk = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gahbcfg, ahbcfg.d32, 0);
++
++	/* Disable all interrupts. */
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, 0);
++
++	/* Clear any pending interrupts */
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
++
++	/* Clear any pending OTG Interrupts */
++	DWC_WRITE_REG32(&core_if->core_global_regs->gotgint, 0xFFFFFFFF);
++}
++
++/**
++ * Unmask Port Connection Detected interrupt
++ *
++ */
++static void unmask_conn_det_intr(dwc_otg_core_if_t * core_if)
++{
++	gintmsk_data_t gintmsk = {.d32 = 0,.b.portintr = 1 };
++
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, gintmsk.d32);
++}
++#endif
++
++/**
++ * Starts the ADP Probing
++ *
++ * @param core_if the pointer to core_if structure.
++ */
++uint32_t dwc_otg_adp_probe_start(dwc_otg_core_if_t * core_if)
++{
++
++	adpctl_data_t adpctl = {.d32 = 0};
++	gpwrdn_data_t gpwrdn;
++#if 0
++	adpctl_data_t adpctl_int = {.d32 = 0, .b.adp_prb_int = 1,
++								.b.adp_sns_int = 1, b.adp_tmout_int};
++#endif
++	dwc_otg_disable_global_interrupts(core_if);
++	DWC_PRINTF("ADP Probe Start\n");
++	core_if->adp.probe_enabled = 1;
++
++	adpctl.b.adpres = 1;
++	dwc_otg_adp_write_reg(core_if, adpctl.d32);
++
++	while (adpctl.b.adpres) {
++		adpctl.d32 = dwc_otg_adp_read_reg(core_if);
++	}
++
++	adpctl.d32 = 0;
++	gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++
++	/* In Host mode unmask SRP detected interrupt */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.sts_chngint_msk = 1;
++	if (!gpwrdn.b.idsts) {
++		gpwrdn.b.srp_det_msk = 1;
++	}
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++
++	adpctl.b.adp_tmout_int_msk = 1;
++	adpctl.b.adp_prb_int_msk = 1;
++	adpctl.b.prb_dschg = 1;
++	adpctl.b.prb_delta = 1;
++	adpctl.b.prb_per = 1;
++	adpctl.b.adpen = 1;
++	adpctl.b.enaprb = 1;
++
++	dwc_otg_adp_write_reg(core_if, adpctl.d32);
++	DWC_PRINTF("ADP Probe Finish\n");
++	return 0;
++}
++
++/**
++ * Starts the ADP Sense timer to detect if ADP Sense interrupt is not asserted
++ * within 3 seconds.
++ *
++ * @param core_if the pointer to core_if strucure.
++ */
++static void dwc_otg_adp_sense_timer_start(dwc_otg_core_if_t * core_if)
++{
++	core_if->adp.sense_timer_started = 1;
++	DWC_TIMER_SCHEDULE(core_if->adp.sense_timer, 3000 /* 3 secs */ );
++}
++
++/**
++ * Starts the ADP Sense
++ *
++ * @param core_if the pointer to core_if strucure.
++ */
++uint32_t dwc_otg_adp_sense_start(dwc_otg_core_if_t * core_if)
++{
++	adpctl_data_t adpctl;
++
++	DWC_PRINTF("ADP Sense Start\n");
++
++	/* Unmask ADP sense interrupt and mask all other from the core */
++	adpctl.d32 = dwc_otg_adp_read_reg_filter(core_if);
++	adpctl.b.adp_sns_int_msk = 1;
++	dwc_otg_adp_write_reg(core_if, adpctl.d32);
++	dwc_otg_disable_global_interrupts(core_if); // vahrama
++
++	/* Set ADP reset bit*/
++	adpctl.d32 = dwc_otg_adp_read_reg_filter(core_if);
++	adpctl.b.adpres = 1;
++	dwc_otg_adp_write_reg(core_if, adpctl.d32);
++
++	while (adpctl.b.adpres) {
++		adpctl.d32 = dwc_otg_adp_read_reg(core_if);
++	}
++
++	adpctl.b.adpres = 0;
++	adpctl.b.adpen = 1;
++	adpctl.b.enasns = 1;
++	dwc_otg_adp_write_reg(core_if, adpctl.d32);
++
++	dwc_otg_adp_sense_timer_start(core_if);
++
++	return 0;
++}
++
++/**
++ * Stops the ADP Probing
++ *
++ * @param core_if the pointer to core_if strucure.
++ */
++uint32_t dwc_otg_adp_probe_stop(dwc_otg_core_if_t * core_if)
++{
++
++	adpctl_data_t adpctl;
++	DWC_PRINTF("Stop ADP probe\n");
++	core_if->adp.probe_enabled = 0;
++	core_if->adp.probe_counter = 0;
++	adpctl.d32 = dwc_otg_adp_read_reg(core_if);
++
++	adpctl.b.adpen = 0;
++	adpctl.b.adp_prb_int = 1;
++	adpctl.b.adp_tmout_int = 1;
++	adpctl.b.adp_sns_int = 1;
++	dwc_otg_adp_write_reg(core_if, adpctl.d32);
++
++	return 0;
++}
++
++/**
++ * Stops the ADP Sensing
++ *
++ * @param core_if the pointer to core_if strucure.
++ */
++uint32_t dwc_otg_adp_sense_stop(dwc_otg_core_if_t * core_if)
++{
++	adpctl_data_t adpctl;
++
++	core_if->adp.sense_enabled = 0;
++
++	adpctl.d32 = dwc_otg_adp_read_reg_filter(core_if);
++	adpctl.b.enasns = 0;
++	adpctl.b.adp_sns_int = 1;
++	dwc_otg_adp_write_reg(core_if, adpctl.d32);
++
++	return 0;
++}
++
++/**
++ * Called to turn on the VBUS after initial ADP probe in host mode.
++ * If port power was already enabled in cil_hcd_start function then
++ * only schedule a timer.
++ *
++ * @param core_if the pointer to core_if structure.
++ */
++static void dwc_otg_adp_turnon_vbus(dwc_otg_core_if_t * core_if)
++{
++	hprt0_data_t hprt0 = {.d32 = 0 };
++	hprt0.d32 = dwc_otg_read_hprt0(core_if);
++	DWC_PRINTF("Turn on VBUS for 1.1s, port power is %d\n", hprt0.b.prtpwr);
++
++	if (hprt0.b.prtpwr == 0) {
++		hprt0.b.prtpwr = 1;
++		//DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++	}
++
++	dwc_otg_adp_vbuson_timer_start(core_if);
++}
++
++/**
++ * Called right after driver is loaded
++ * to perform initial actions for ADP
++ *
++ * @param core_if the pointer to core_if structure.
++ * @param is_host - flag for current mode of operation either from GINTSTS or GPWRDN
++ */
++void dwc_otg_adp_start(dwc_otg_core_if_t * core_if, uint8_t is_host)
++{
++	gpwrdn_data_t gpwrdn;
++
++	DWC_PRINTF("ADP Initial Start\n");
++	core_if->adp.adp_started = 1;
++
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
++	dwc_otg_disable_global_interrupts(core_if);
++	if (is_host) {
++		DWC_PRINTF("HOST MODE\n");
++		/* Enable Power Down Logic Interrupt*/
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pmuintsel = 1;
++		gpwrdn.b.pmuactv = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++		/* Initialize first ADP probe to obtain Ramp Time value */
++		core_if->adp.initial_probe = 1;
++		dwc_otg_adp_probe_start(core_if);
++	} else {
++		gotgctl_data_t gotgctl;
++		gotgctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
++		DWC_PRINTF("DEVICE MODE\n");
++		if (gotgctl.b.bsesvld == 0) {
++			/* Enable Power Down Logic Interrupt*/
++			gpwrdn.d32 = 0;
++			DWC_PRINTF("VBUS is not valid - start ADP probe\n");
++			gpwrdn.b.pmuintsel = 1;
++			gpwrdn.b.pmuactv = 1;
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++			core_if->adp.initial_probe = 1;
++			dwc_otg_adp_probe_start(core_if);
++		} else {
++			DWC_PRINTF("VBUS is valid - initialize core as a Device\n");
++			core_if->op_state = B_PERIPHERAL;
++			dwc_otg_core_init(core_if);
++			dwc_otg_enable_global_interrupts(core_if);
++			cil_pcd_start(core_if);
++			dwc_otg_dump_global_registers(core_if);
++			dwc_otg_dump_dev_registers(core_if);
++		}
++	}
++}
++
++void dwc_otg_adp_init(dwc_otg_core_if_t * core_if)
++{
++	core_if->adp.adp_started = 0;
++	core_if->adp.initial_probe = 0;
++	core_if->adp.probe_timer_values[0] = -1;
++	core_if->adp.probe_timer_values[1] = -1;
++	core_if->adp.probe_enabled = 0;
++	core_if->adp.sense_enabled = 0;
++	core_if->adp.sense_timer_started = 0;
++	core_if->adp.vbuson_timer_started = 0;
++	core_if->adp.probe_counter = 0;
++	core_if->adp.gpwrdn = 0;
++	core_if->adp.attached = DWC_OTG_ADP_UNKOWN;
++	/* Initialize timers */
++	core_if->adp.sense_timer =
++	    DWC_TIMER_ALLOC("ADP SENSE TIMER", adp_sense_timeout, core_if);
++	core_if->adp.vbuson_timer =
++	    DWC_TIMER_ALLOC("ADP VBUS ON TIMER", adp_vbuson_timeout, core_if);
++	if (!core_if->adp.sense_timer || !core_if->adp.vbuson_timer)
++	{
++		DWC_ERROR("Could not allocate memory for ADP timers\n");
++	}
++}
++
++void dwc_otg_adp_remove(dwc_otg_core_if_t * core_if)
++{
++	gpwrdn_data_t gpwrdn = { .d32 = 0 };
++	gpwrdn.b.pmuintsel = 1;
++	gpwrdn.b.pmuactv = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	if (core_if->adp.probe_enabled)
++		dwc_otg_adp_probe_stop(core_if);
++	if (core_if->adp.sense_enabled)
++		dwc_otg_adp_sense_stop(core_if);
++	if (core_if->adp.sense_timer_started)
++		DWC_TIMER_CANCEL(core_if->adp.sense_timer);
++	if (core_if->adp.vbuson_timer_started)
++		DWC_TIMER_CANCEL(core_if->adp.vbuson_timer);
++	DWC_TIMER_FREE(core_if->adp.sense_timer);
++	DWC_TIMER_FREE(core_if->adp.vbuson_timer);
++}
++
++/////////////////////////////////////////////////////////////////////
++////////////// ADP Interrupt Handlers ///////////////////////////////
++/////////////////////////////////////////////////////////////////////
++/**
++ * This function sets Ramp Timer values
++ */
++static uint32_t set_timer_value(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	if (core_if->adp.probe_timer_values[0] == -1) {
++		core_if->adp.probe_timer_values[0] = val;
++		core_if->adp.probe_timer_values[1] = -1;
++		return 1;
++	} else {
++		core_if->adp.probe_timer_values[1] =
++		    core_if->adp.probe_timer_values[0];
++		core_if->adp.probe_timer_values[0] = val;
++		return 0;
++	}
++}
++
++/**
++ * This function compares Ramp Timer values
++ */
++static uint32_t compare_timer_values(dwc_otg_core_if_t * core_if)
++{
++	uint32_t diff;
++	if (core_if->adp.probe_timer_values[0]>=core_if->adp.probe_timer_values[1])
++			diff = core_if->adp.probe_timer_values[0]-core_if->adp.probe_timer_values[1];
++	else
++			diff = core_if->adp.probe_timer_values[1]-core_if->adp.probe_timer_values[0];
++	if(diff < 2) {
++		return 0;
++	} else {
++		return 1;
++	}
++}
++
++/**
++ * This function handles ADP Probe Interrupts
++ */
++static int32_t dwc_otg_adp_handle_prb_intr(dwc_otg_core_if_t * core_if,
++						 uint32_t val)
++{
++	adpctl_data_t adpctl = {.d32 = 0 };
++	gpwrdn_data_t gpwrdn, temp;
++	adpctl.d32 = val;
++
++	temp.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++	core_if->adp.probe_counter++;
++	core_if->adp.gpwrdn = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++	if (adpctl.b.rtim == 0 && !temp.b.idsts){
++		DWC_PRINTF("RTIM value is 0\n");
++		goto exit;
++	}
++	if (set_timer_value(core_if, adpctl.b.rtim) &&
++	    core_if->adp.initial_probe) {
++		core_if->adp.initial_probe = 0;
++		dwc_otg_adp_probe_stop(core_if);
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pmuactv = 1;
++		gpwrdn.b.pmuintsel = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++		DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
++
++		/* check which value is for device mode and which for Host mode */
++		if (!temp.b.idsts) {	/* considered host mode value is 0 */
++			/*
++			 * Turn on VBUS after initial ADP probe.
++			 */
++			core_if->op_state = A_HOST;
++			dwc_otg_enable_global_interrupts(core_if);
++			DWC_SPINUNLOCK(core_if->lock);
++			cil_hcd_start(core_if);
++			dwc_otg_adp_turnon_vbus(core_if);
++			DWC_SPINLOCK(core_if->lock);
++		} else {
++			/*
++			 * Initiate SRP after initial ADP probe.
++			 */
++			dwc_otg_enable_global_interrupts(core_if);
++			dwc_otg_initiate_srp(core_if);
++		}
++	} else if (core_if->adp.probe_counter > 2){
++		gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++		if (compare_timer_values(core_if)) {
++			DWC_PRINTF("Difference in timer values !!! \n");
++//                      core_if->adp.attached = DWC_OTG_ADP_ATTACHED;
++			dwc_otg_adp_probe_stop(core_if);
++
++			/* Power on the core */
++			if (core_if->power_down == 2) {
++				gpwrdn.b.pwrdnswtch = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++			}
++
++			/* check which value is for device mode and which for Host mode */
++			if (!temp.b.idsts) {	/* considered host mode value is 0 */
++				/* Disable Interrupt from Power Down Logic */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.pmuintsel = 1;
++				gpwrdn.b.pmuactv = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, gpwrdn.d32, 0);
++
++				/*
++				 * Initialize the Core for Host mode.
++				 */
++				core_if->op_state = A_HOST;
++				dwc_otg_core_init(core_if);
++				dwc_otg_enable_global_interrupts(core_if);
++				cil_hcd_start(core_if);
++			} else {
++				gotgctl_data_t gotgctl;
++				/* Mask SRP detected interrupt from Power Down Logic */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.srp_det_msk = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, gpwrdn.d32, 0);
++
++				/* Disable Power Down Logic */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.pmuintsel = 1;
++				gpwrdn.b.pmuactv = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, gpwrdn.d32, 0);
++
++				/*
++				 * Initialize the Core for Device mode.
++				 */
++				core_if->op_state = B_PERIPHERAL;
++				dwc_otg_core_init(core_if);
++				dwc_otg_enable_global_interrupts(core_if);
++				cil_pcd_start(core_if);
++
++				gotgctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
++				if (!gotgctl.b.bsesvld) {
++					dwc_otg_initiate_srp(core_if);
++				}
++			}
++		}
++		if (core_if->power_down == 2) {
++			if (gpwrdn.b.bsessvld) {
++				/* Mask SRP detected interrupt from Power Down Logic */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.srp_det_msk = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++				/* Disable Power Down Logic */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.pmuactv = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++				/*
++				 * Initialize the Core for Device mode.
++				 */
++				core_if->op_state = B_PERIPHERAL;
++				dwc_otg_core_init(core_if);
++				dwc_otg_enable_global_interrupts(core_if);
++				cil_pcd_start(core_if);
++			}
++		}
++	}
++exit:
++	/* Clear interrupt */
++	adpctl.d32 = dwc_otg_adp_read_reg(core_if);
++	adpctl.b.adp_prb_int = 1;
++	dwc_otg_adp_write_reg(core_if, adpctl.d32);
++
++	return 0;
++}
++
++/**
++ * This function hadles ADP Sense Interrupt
++ */
++static int32_t dwc_otg_adp_handle_sns_intr(dwc_otg_core_if_t * core_if)
++{
++	adpctl_data_t adpctl;
++	/* Stop ADP Sense timer */
++	DWC_TIMER_CANCEL(core_if->adp.sense_timer);
++
++	/* Restart ADP Sense timer */
++	dwc_otg_adp_sense_timer_start(core_if);
++
++	/* Clear interrupt */
++	adpctl.d32 = dwc_otg_adp_read_reg(core_if);
++	adpctl.b.adp_sns_int = 1;
++	dwc_otg_adp_write_reg(core_if, adpctl.d32);
++
++	return 0;
++}
++
++/**
++ * This function handles ADP Probe Interrupts
++ */
++static int32_t dwc_otg_adp_handle_prb_tmout_intr(dwc_otg_core_if_t * core_if,
++						 uint32_t val)
++{
++	adpctl_data_t adpctl = {.d32 = 0 };
++	adpctl.d32 = val;
++	set_timer_value(core_if, adpctl.b.rtim);
++
++	/* Clear interrupt */
++	adpctl.d32 = dwc_otg_adp_read_reg(core_if);
++	adpctl.b.adp_tmout_int = 1;
++	dwc_otg_adp_write_reg(core_if, adpctl.d32);
++
++	return 0;
++}
++
++/**
++ * ADP Interrupt handler.
++ *
++ */
++int32_t dwc_otg_adp_handle_intr(dwc_otg_core_if_t * core_if)
++{
++	int retval = 0;
++	adpctl_data_t adpctl = {.d32 = 0};
++
++	adpctl.d32 = dwc_otg_adp_read_reg(core_if);
++	DWC_PRINTF("ADPCTL = %08x\n",adpctl.d32);
++
++	if (adpctl.b.adp_sns_int & adpctl.b.adp_sns_int_msk) {
++		DWC_PRINTF("ADP Sense interrupt\n");
++		retval |= dwc_otg_adp_handle_sns_intr(core_if);
++	}
++	if (adpctl.b.adp_tmout_int & adpctl.b.adp_tmout_int_msk) {
++		DWC_PRINTF("ADP timeout interrupt\n");
++		retval |= dwc_otg_adp_handle_prb_tmout_intr(core_if, adpctl.d32);
++	}
++	if (adpctl.b.adp_prb_int & adpctl.b.adp_prb_int_msk) {
++		DWC_PRINTF("ADP Probe interrupt\n");
++		adpctl.b.adp_prb_int = 1;
++		retval |= dwc_otg_adp_handle_prb_intr(core_if, adpctl.d32);
++	}
++
++	DWC_PRINTF("RETURN FROM ADP ISR\n");
++
++	return retval;
++}
++
++/**
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++int32_t dwc_otg_adp_handle_srp_intr(dwc_otg_core_if_t * core_if)
++{
++
++#ifndef DWC_HOST_ONLY
++	hprt0_data_t hprt0;
++	gpwrdn_data_t gpwrdn;
++	DWC_DEBUGPL(DBG_ANY, "++ Power Down Logic Session Request Interrupt++\n");
++
++	gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++	/* check which value is for device mode and which for Host mode */
++	if (!gpwrdn.b.idsts) {	/* considered host mode value is 0 */
++		DWC_PRINTF("SRP: Host mode\n");
++
++		if (core_if->adp_enable) {
++			dwc_otg_adp_probe_stop(core_if);
++
++			/* Power on the core */
++			if (core_if->power_down == 2) {
++				gpwrdn.b.pwrdnswtch = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++			}
++
++			core_if->op_state = A_HOST;
++			dwc_otg_core_init(core_if);
++			dwc_otg_enable_global_interrupts(core_if);
++			cil_hcd_start(core_if);
++		}
++
++		/* Turn on the port power bit. */
++		hprt0.d32 = dwc_otg_read_hprt0(core_if);
++		hprt0.b.prtpwr = 1;
++		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++
++		/* Start the Connection timer. So a message can be displayed
++		 * if connect does not occur within 10 seconds. */
++		cil_hcd_session_start(core_if);
++	} else {
++		DWC_PRINTF("SRP: Device mode %s\n", __FUNCTION__);
++		if (core_if->adp_enable) {
++			dwc_otg_adp_probe_stop(core_if);
++
++			/* Power on the core */
++			if (core_if->power_down == 2) {
++				gpwrdn.b.pwrdnswtch = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++			}
++
++			gpwrdn.d32 = 0;
++			gpwrdn.b.pmuactv = 0;
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0,
++					 gpwrdn.d32);
++
++			core_if->op_state = B_PERIPHERAL;
++			dwc_otg_core_init(core_if);
++			dwc_otg_enable_global_interrupts(core_if);
++			cil_pcd_start(core_if);
++		}
++	}
++#endif
++	return 1;
++}
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_adp.h
+@@ -0,0 +1,80 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_adp.h $
++ * $Revision: #7 $
++ * $Date: 2011/10/24 $
++ * $Change: 1871159 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++#ifndef __DWC_OTG_ADP_H__
++#define __DWC_OTG_ADP_H__
++
++/**
++ * @file
++ *
++ * This file contains the Attach Detect Protocol interfaces and defines
++ * (functions) and structures for Linux.
++ *
++ */
++
++#define DWC_OTG_ADP_UNATTACHED	0
++#define DWC_OTG_ADP_ATTACHED	1
++#define DWC_OTG_ADP_UNKOWN	2
++
++typedef struct dwc_otg_adp {
++	uint32_t adp_started;
++	uint32_t initial_probe;
++	int32_t probe_timer_values[2];
++	uint32_t probe_enabled;
++	uint32_t sense_enabled;
++	dwc_timer_t *sense_timer;
++	uint32_t sense_timer_started;
++	dwc_timer_t *vbuson_timer;
++	uint32_t vbuson_timer_started;
++	uint32_t attached;
++	uint32_t probe_counter;
++	uint32_t gpwrdn;
++} dwc_otg_adp_t;
++
++/**
++ * Attach Detect Protocol functions
++ */
++
++extern void dwc_otg_adp_write_reg(dwc_otg_core_if_t * core_if, uint32_t value);
++extern uint32_t dwc_otg_adp_read_reg(dwc_otg_core_if_t * core_if);
++extern uint32_t dwc_otg_adp_probe_start(dwc_otg_core_if_t * core_if);
++extern uint32_t dwc_otg_adp_sense_start(dwc_otg_core_if_t * core_if);
++extern uint32_t dwc_otg_adp_probe_stop(dwc_otg_core_if_t * core_if);
++extern uint32_t dwc_otg_adp_sense_stop(dwc_otg_core_if_t * core_if);
++extern void dwc_otg_adp_start(dwc_otg_core_if_t * core_if, uint8_t is_host);
++extern void dwc_otg_adp_init(dwc_otg_core_if_t * core_if);
++extern void dwc_otg_adp_remove(dwc_otg_core_if_t * core_if);
++extern int32_t dwc_otg_adp_handle_intr(dwc_otg_core_if_t * core_if);
++extern int32_t dwc_otg_adp_handle_srp_intr(dwc_otg_core_if_t * core_if);
++
++#endif //__DWC_OTG_ADP_H__
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_attr.c
+@@ -0,0 +1,1212 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_attr.c $
++ * $Revision: #44 $
++ * $Date: 2010/11/29 $
++ * $Change: 1636033 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++/** @file
++ *
++ * The diagnostic interface will provide access to the controller for
++ * bringing up the hardware and testing.  The Linux driver attributes
++ * feature will be used to provide the Linux Diagnostic
++ * Interface. These attributes are accessed through sysfs.
++ */
++
++/** @page "Linux Module Attributes"
++ *
++ * The Linux module attributes feature is used to provide the Linux
++ * Diagnostic Interface.  These attributes are accessed through sysfs.
++ * The diagnostic interface will provide access to the controller for
++ * bringing up the hardware and testing.
++
++ The following table shows the attributes.
++ <table>
++ <tr>
++ <td><b> Name</b></td>
++ <td><b> Description</b></td>
++ <td><b> Access</b></td>
++ </tr>
++
++ <tr>
++ <td> mode </td>
++ <td> Returns the current mode: 0 for device mode, 1 for host mode</td>
++ <td> Read</td>
++ </tr>
++
++ <tr>
++ <td> hnpcapable </td>
++ <td> Gets or sets the "HNP-capable" bit in the Core USB Configuraton Register.
++ Read returns the current value.</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> srpcapable </td>
++ <td> Gets or sets the "SRP-capable" bit in the Core USB Configuraton Register.
++ Read returns the current value.</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> hsic_connect </td>
++ <td> Gets or sets the "HSIC-Connect" bit in the GLPMCFG Register.
++ Read returns the current value.</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> inv_sel_hsic </td>
++ <td> Gets or sets the "Invert Select HSIC" bit in the GLPMFG Register.
++ Read returns the current value.</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> hnp </td>
++ <td> Initiates the Host Negotiation Protocol.  Read returns the status.</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> srp </td>
++ <td> Initiates the Session Request Protocol.  Read returns the status.</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> buspower </td>
++ <td> Gets or sets the Power State of the bus (0 - Off or 1 - On)</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> bussuspend </td>
++ <td> Suspends the USB bus.</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> busconnected </td>
++ <td> Gets the connection status of the bus</td>
++ <td> Read</td>
++ </tr>
++
++ <tr>
++ <td> gotgctl </td>
++ <td> Gets or sets the Core Control Status Register.</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> gusbcfg </td>
++ <td> Gets or sets the Core USB Configuration Register</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> grxfsiz </td>
++ <td> Gets or sets the Receive FIFO Size Register</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> gnptxfsiz </td>
++ <td> Gets or sets the non-periodic Transmit Size Register</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> gpvndctl </td>
++ <td> Gets or sets the PHY Vendor Control Register</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> ggpio </td>
++ <td> Gets the value in the lower 16-bits of the General Purpose IO Register
++ or sets the upper 16 bits.</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> guid </td>
++ <td> Gets or sets the value of the User ID Register</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> gsnpsid </td>
++ <td> Gets the value of the Synopsys ID Regester</td>
++ <td> Read</td>
++ </tr>
++
++ <tr>
++ <td> devspeed </td>
++ <td> Gets or sets the device speed setting in the DCFG register</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> enumspeed </td>
++ <td> Gets the device enumeration Speed.</td>
++ <td> Read</td>
++ </tr>
++
++ <tr>
++ <td> hptxfsiz </td>
++ <td> Gets the value of the Host Periodic Transmit FIFO</td>
++ <td> Read</td>
++ </tr>
++
++ <tr>
++ <td> hprt0 </td>
++ <td> Gets or sets the value in the Host Port Control and Status Register</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> regoffset </td>
++ <td> Sets the register offset for the next Register Access</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> regvalue </td>
++ <td> Gets or sets the value of the register at the offset in the regoffset attribute.</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> remote_wakeup </td>
++ <td> On read, shows the status of Remote Wakeup. On write, initiates a remote
++ wakeup of the host. When bit 0 is 1 and Remote Wakeup is enabled, the Remote
++ Wakeup signalling bit in the Device Control Register is set for 1
++ milli-second.</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> rem_wakeup_pwrdn </td>
++ <td> On read, shows the status core - hibernated or not. On write, initiates
++ a remote wakeup of the device from Hibernation. </td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> mode_ch_tim_en </td>
++ <td> This bit is used to enable or disable the host core to wait for 200 PHY
++ clock cycles at the end of Resume to change the opmode signal to the PHY to 00
++ after Suspend or LPM. </td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> fr_interval </td>
++ <td> On read, shows the value of HFIR Frame Interval. On write, dynamically
++ reload HFIR register during runtime. The application can write a value to this
++ register only after the Port Enable bit of the Host Port Control and Status
++ register (HPRT.PrtEnaPort) has been set </td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> disconnect_us </td>
++ <td> On read, shows the status of disconnect_device_us. On write, sets disconnect_us
++ which causes soft disconnect for 100us. Applicable only for device mode of operation.</td>
++ <td> Read/Write</td>
++ </tr>
++
++ <tr>
++ <td> regdump </td>
++ <td> Dumps the contents of core registers.</td>
++ <td> Read</td>
++ </tr>
++
++ <tr>
++ <td> spramdump </td>
++ <td> Dumps the contents of core registers.</td>
++ <td> Read</td>
++ </tr>
++
++ <tr>
++ <td> hcddump </td>
++ <td> Dumps the current HCD state.</td>
++ <td> Read</td>
++ </tr>
++
++ <tr>
++ <td> hcd_frrem </td>
++ <td> Shows the average value of the Frame Remaining
++ field in the Host Frame Number/Frame Remaining register when an SOF interrupt
++ occurs. This can be used to determine the average interrupt latency. Also
++ shows the average Frame Remaining value for start_transfer and the "a" and
++ "b" sample points. The "a" and "b" sample points may be used during debugging
++ bto determine how long it takes to execute a section of the HCD code.</td>
++ <td> Read</td>
++ </tr>
++
++ <tr>
++ <td> rd_reg_test </td>
++ <td> Displays the time required to read the GNPTXFSIZ register many times
++ (the output shows the number of times the register is read).
++ <td> Read</td>
++ </tr>
++
++ <tr>
++ <td> wr_reg_test </td>
++ <td> Displays the time required to write the GNPTXFSIZ register many times
++ (the output shows the number of times the register is written).
++ <td> Read</td>
++ </tr>
++
++ <tr>
++ <td> lpm_response </td>
++ <td> Gets or sets lpm_response mode. Applicable only in device mode.
++ <td> Write</td>
++ </tr>
++
++ <tr>
++ <td> sleep_status </td>
++ <td> Shows sleep status of device.
++ <td> Read</td>
++ </tr>
++
++ </table>
++
++ Example usage:
++ To get the current mode:
++ cat /sys/devices/lm0/mode
++
++ To power down the USB:
++ echo 0 > /sys/devices/lm0/buspower
++ */
++
++#include "dwc_otg_os_dep.h"
++#include "dwc_os.h"
++#include "dwc_otg_driver.h"
++#include "dwc_otg_attr.h"
++#include "dwc_otg_core_if.h"
++#include "dwc_otg_pcd_if.h"
++#include "dwc_otg_hcd_if.h"
++
++/*
++ * MACROs for defining sysfs attribute
++ */
++#ifdef LM_INTERFACE
++
++#define DWC_OTG_DEVICE_ATTR_BITFIELD_SHOW(_otg_attr_name_,_string_) \
++static ssize_t _otg_attr_name_##_show (struct device *_dev, struct device_attribute *attr, char *buf) \
++{ \
++	struct lm_device *lm_dev = container_of(_dev, struct lm_device, dev); \
++	dwc_otg_device_t *otg_dev = lm_get_drvdata(lm_dev);		\
++	uint32_t val; \
++	val = dwc_otg_get_##_otg_attr_name_ (otg_dev->core_if); \
++	return sprintf (buf, "%s = 0x%x\n", _string_, val); \
++}
++#define DWC_OTG_DEVICE_ATTR_BITFIELD_STORE(_otg_attr_name_,_string_) \
++static ssize_t _otg_attr_name_##_store (struct device *_dev, struct device_attribute *attr, \
++					const char *buf, size_t count) \
++{ \
++	struct lm_device *lm_dev = container_of(_dev, struct lm_device, dev); \
++	dwc_otg_device_t *otg_dev = lm_get_drvdata(lm_dev); \
++	uint32_t set = simple_strtoul(buf, NULL, 16); \
++	dwc_otg_set_##_otg_attr_name_(otg_dev->core_if, set);\
++	return count; \
++}
++
++#elif defined(PCI_INTERFACE)
++
++#define DWC_OTG_DEVICE_ATTR_BITFIELD_SHOW(_otg_attr_name_,_string_) \
++static ssize_t _otg_attr_name_##_show (struct device *_dev, struct device_attribute *attr, char *buf) \
++{ \
++	dwc_otg_device_t *otg_dev = dev_get_drvdata(_dev);	\
++	uint32_t val; \
++	val = dwc_otg_get_##_otg_attr_name_ (otg_dev->core_if); \
++	return sprintf (buf, "%s = 0x%x\n", _string_, val); \
++}
++#define DWC_OTG_DEVICE_ATTR_BITFIELD_STORE(_otg_attr_name_,_string_) \
++static ssize_t _otg_attr_name_##_store (struct device *_dev, struct device_attribute *attr, \
++					const char *buf, size_t count) \
++{ \
++	dwc_otg_device_t *otg_dev = dev_get_drvdata(_dev);  \
++	uint32_t set = simple_strtoul(buf, NULL, 16); \
++	dwc_otg_set_##_otg_attr_name_(otg_dev->core_if, set);\
++	return count; \
++}
++
++#elif defined(PLATFORM_INTERFACE)
++
++#define DWC_OTG_DEVICE_ATTR_BITFIELD_SHOW(_otg_attr_name_,_string_) \
++static ssize_t _otg_attr_name_##_show (struct device *_dev, struct device_attribute *attr, char *buf) \
++{ \
++        struct platform_device *platform_dev = \
++                container_of(_dev, struct platform_device, dev); \
++        dwc_otg_device_t *otg_dev = platform_get_drvdata(platform_dev);  \
++	uint32_t val; \
++	DWC_PRINTF("%s(%p) -> platform_dev %p, otg_dev %p\n", \
++                    __func__, _dev, platform_dev, otg_dev); \
++	val = dwc_otg_get_##_otg_attr_name_ (otg_dev->core_if); \
++	return sprintf (buf, "%s = 0x%x\n", _string_, val); \
++}
++#define DWC_OTG_DEVICE_ATTR_BITFIELD_STORE(_otg_attr_name_,_string_) \
++static ssize_t _otg_attr_name_##_store (struct device *_dev, struct device_attribute *attr, \
++					const char *buf, size_t count) \
++{ \
++        struct platform_device *platform_dev = container_of(_dev, struct platform_device, dev); \
++        dwc_otg_device_t *otg_dev = platform_get_drvdata(platform_dev); \
++	uint32_t set = simple_strtoul(buf, NULL, 16); \
++	dwc_otg_set_##_otg_attr_name_(otg_dev->core_if, set);\
++	return count; \
++}
++#endif
++
++/*
++ * MACROs for defining sysfs attribute for 32-bit registers
++ */
++#ifdef LM_INTERFACE
++#define DWC_OTG_DEVICE_ATTR_REG_SHOW(_otg_attr_name_,_string_) \
++static ssize_t _otg_attr_name_##_show (struct device *_dev, struct device_attribute *attr, char *buf) \
++{ \
++	struct lm_device *lm_dev = container_of(_dev, struct lm_device, dev); \
++	dwc_otg_device_t *otg_dev = lm_get_drvdata(lm_dev); \
++	uint32_t val; \
++	val = dwc_otg_get_##_otg_attr_name_ (otg_dev->core_if); \
++	return sprintf (buf, "%s = 0x%08x\n", _string_, val); \
++}
++#define DWC_OTG_DEVICE_ATTR_REG_STORE(_otg_attr_name_,_string_) \
++static ssize_t _otg_attr_name_##_store (struct device *_dev, struct device_attribute *attr, \
++					const char *buf, size_t count) \
++{ \
++	struct lm_device *lm_dev = container_of(_dev, struct lm_device, dev); \
++	dwc_otg_device_t *otg_dev = lm_get_drvdata(lm_dev); \
++	uint32_t val = simple_strtoul(buf, NULL, 16); \
++	dwc_otg_set_##_otg_attr_name_ (otg_dev->core_if, val); \
++	return count; \
++}
++#elif defined(PCI_INTERFACE)
++#define DWC_OTG_DEVICE_ATTR_REG_SHOW(_otg_attr_name_,_string_) \
++static ssize_t _otg_attr_name_##_show (struct device *_dev, struct device_attribute *attr, char *buf) \
++{ \
++	dwc_otg_device_t *otg_dev = dev_get_drvdata(_dev);  \
++	uint32_t val; \
++	val = dwc_otg_get_##_otg_attr_name_ (otg_dev->core_if); \
++	return sprintf (buf, "%s = 0x%08x\n", _string_, val); \
++}
++#define DWC_OTG_DEVICE_ATTR_REG_STORE(_otg_attr_name_,_string_) \
++static ssize_t _otg_attr_name_##_store (struct device *_dev, struct device_attribute *attr, \
++					const char *buf, size_t count) \
++{ \
++	dwc_otg_device_t *otg_dev = dev_get_drvdata(_dev);  \
++	uint32_t val = simple_strtoul(buf, NULL, 16); \
++	dwc_otg_set_##_otg_attr_name_ (otg_dev->core_if, val); \
++	return count; \
++}
++
++#elif defined(PLATFORM_INTERFACE)
++#include "dwc_otg_dbg.h"
++#define DWC_OTG_DEVICE_ATTR_REG_SHOW(_otg_attr_name_,_string_) \
++static ssize_t _otg_attr_name_##_show (struct device *_dev, struct device_attribute *attr, char *buf) \
++{ \
++	struct platform_device *platform_dev = container_of(_dev, struct platform_device, dev); \
++	dwc_otg_device_t *otg_dev = platform_get_drvdata(platform_dev); \
++	uint32_t val; \
++	DWC_PRINTF("%s(%p) -> platform_dev %p, otg_dev %p\n", \
++                    __func__, _dev, platform_dev, otg_dev); \
++	val = dwc_otg_get_##_otg_attr_name_ (otg_dev->core_if); \
++	return sprintf (buf, "%s = 0x%08x\n", _string_, val); \
++}
++#define DWC_OTG_DEVICE_ATTR_REG_STORE(_otg_attr_name_,_string_) \
++static ssize_t _otg_attr_name_##_store (struct device *_dev, struct device_attribute *attr, \
++					const char *buf, size_t count) \
++{ \
++	struct platform_device *platform_dev = container_of(_dev, struct platform_device, dev); \
++	dwc_otg_device_t *otg_dev = platform_get_drvdata(platform_dev); \
++	uint32_t val = simple_strtoul(buf, NULL, 16); \
++	dwc_otg_set_##_otg_attr_name_ (otg_dev->core_if, val); \
++	return count; \
++}
++
++#endif
++
++#define DWC_OTG_DEVICE_ATTR_BITFIELD_RW(_otg_attr_name_,_string_) \
++DWC_OTG_DEVICE_ATTR_BITFIELD_SHOW(_otg_attr_name_,_string_) \
++DWC_OTG_DEVICE_ATTR_BITFIELD_STORE(_otg_attr_name_,_string_) \
++DEVICE_ATTR(_otg_attr_name_,0644,_otg_attr_name_##_show,_otg_attr_name_##_store);
++
++#define DWC_OTG_DEVICE_ATTR_BITFIELD_RO(_otg_attr_name_,_string_) \
++DWC_OTG_DEVICE_ATTR_BITFIELD_SHOW(_otg_attr_name_,_string_) \
++DEVICE_ATTR(_otg_attr_name_,0444,_otg_attr_name_##_show,NULL);
++
++#define DWC_OTG_DEVICE_ATTR_REG32_RW(_otg_attr_name_,_addr_,_string_) \
++DWC_OTG_DEVICE_ATTR_REG_SHOW(_otg_attr_name_,_string_) \
++DWC_OTG_DEVICE_ATTR_REG_STORE(_otg_attr_name_,_string_) \
++DEVICE_ATTR(_otg_attr_name_,0644,_otg_attr_name_##_show,_otg_attr_name_##_store);
++
++#define DWC_OTG_DEVICE_ATTR_REG32_RO(_otg_attr_name_,_addr_,_string_) \
++DWC_OTG_DEVICE_ATTR_REG_SHOW(_otg_attr_name_,_string_) \
++DEVICE_ATTR(_otg_attr_name_,0444,_otg_attr_name_##_show,NULL);
++
++/** @name Functions for Show/Store of Attributes */
++/**@{*/
++
++/**
++ * Helper function returning the otg_device structure of the given device
++ */
++static dwc_otg_device_t *dwc_otg_drvdev(struct device *_dev)
++{
++        dwc_otg_device_t *otg_dev;
++        DWC_OTG_GETDRVDEV(otg_dev, _dev);
++        return otg_dev;
++}
++
++/**
++ * Show the register offset of the Register Access.
++ */
++static ssize_t regoffset_show(struct device *_dev,
++			      struct device_attribute *attr, char *buf)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	return snprintf(buf, sizeof("0xFFFFFFFF\n") + 1, "0x%08x\n",
++			otg_dev->os_dep.reg_offset);
++}
++
++/**
++ * Set the register offset for the next Register Access 	Read/Write
++ */
++static ssize_t regoffset_store(struct device *_dev,
++			       struct device_attribute *attr,
++			       const char *buf, size_t count)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	uint32_t offset = simple_strtoul(buf, NULL, 16);
++#if defined(LM_INTERFACE) || defined(PLATFORM_INTERFACE)
++	if (offset < SZ_256K) {
++#elif  defined(PCI_INTERFACE)
++	if (offset < 0x00040000) {
++#endif
++		otg_dev->os_dep.reg_offset = offset;
++	} else {
++		dev_err(_dev, "invalid offset\n");
++	}
++
++	return count;
++}
++
++DEVICE_ATTR(regoffset, S_IRUGO | S_IWUSR, regoffset_show, regoffset_store);
++
++/**
++ * Show the value of the register at the offset in the reg_offset
++ * attribute.
++ */
++static ssize_t regvalue_show(struct device *_dev,
++			     struct device_attribute *attr, char *buf)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	uint32_t val;
++	volatile uint32_t *addr;
++
++	if (otg_dev->os_dep.reg_offset != 0xFFFFFFFF && 0 != otg_dev->os_dep.base) {
++		/* Calculate the address */
++		addr = (uint32_t *) (otg_dev->os_dep.reg_offset +
++				     (uint8_t *) otg_dev->os_dep.base);
++		val = DWC_READ_REG32(addr);
++		return snprintf(buf,
++				sizeof("Reg@0xFFFFFFFF = 0xFFFFFFFF\n") + 1,
++				"Reg@0x%06x = 0x%08x\n", otg_dev->os_dep.reg_offset,
++				val);
++	} else {
++		dev_err(_dev, "Invalid offset (0x%0x)\n", otg_dev->os_dep.reg_offset);
++		return sprintf(buf, "invalid offset\n");
++	}
++}
++
++/**
++ * Store the value in the register at the offset in the reg_offset
++ * attribute.
++ *
++ */
++static ssize_t regvalue_store(struct device *_dev,
++			      struct device_attribute *attr,
++			      const char *buf, size_t count)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	volatile uint32_t *addr;
++	uint32_t val = simple_strtoul(buf, NULL, 16);
++	//dev_dbg(_dev, "Offset=0x%08x Val=0x%08x\n", otg_dev->reg_offset, val);
++	if (otg_dev->os_dep.reg_offset != 0xFFFFFFFF && 0 != otg_dev->os_dep.base) {
++		/* Calculate the address */
++		addr = (uint32_t *) (otg_dev->os_dep.reg_offset +
++				     (uint8_t *) otg_dev->os_dep.base);
++		DWC_WRITE_REG32(addr, val);
++	} else {
++		dev_err(_dev, "Invalid Register Offset (0x%08x)\n",
++			otg_dev->os_dep.reg_offset);
++	}
++	return count;
++}
++
++DEVICE_ATTR(regvalue, S_IRUGO | S_IWUSR, regvalue_show, regvalue_store);
++
++/*
++ * Attributes
++ */
++DWC_OTG_DEVICE_ATTR_BITFIELD_RO(mode, "Mode");
++DWC_OTG_DEVICE_ATTR_BITFIELD_RW(hnpcapable, "HNPCapable");
++DWC_OTG_DEVICE_ATTR_BITFIELD_RW(srpcapable, "SRPCapable");
++DWC_OTG_DEVICE_ATTR_BITFIELD_RW(hsic_connect, "HSIC Connect");
++DWC_OTG_DEVICE_ATTR_BITFIELD_RW(inv_sel_hsic, "Invert Select HSIC");
++
++//DWC_OTG_DEVICE_ATTR_BITFIELD_RW(buspower,&(otg_dev->core_if->core_global_regs->gotgctl),(1<<8),8,"Mode");
++//DWC_OTG_DEVICE_ATTR_BITFIELD_RW(bussuspend,&(otg_dev->core_if->core_global_regs->gotgctl),(1<<8),8,"Mode");
++DWC_OTG_DEVICE_ATTR_BITFIELD_RO(busconnected, "Bus Connected");
++
++DWC_OTG_DEVICE_ATTR_REG32_RW(gotgctl, 0, "GOTGCTL");
++DWC_OTG_DEVICE_ATTR_REG32_RW(gusbcfg,
++			     &(otg_dev->core_if->core_global_regs->gusbcfg),
++			     "GUSBCFG");
++DWC_OTG_DEVICE_ATTR_REG32_RW(grxfsiz,
++			     &(otg_dev->core_if->core_global_regs->grxfsiz),
++			     "GRXFSIZ");
++DWC_OTG_DEVICE_ATTR_REG32_RW(gnptxfsiz,
++			     &(otg_dev->core_if->core_global_regs->gnptxfsiz),
++			     "GNPTXFSIZ");
++DWC_OTG_DEVICE_ATTR_REG32_RW(gpvndctl,
++			     &(otg_dev->core_if->core_global_regs->gpvndctl),
++			     "GPVNDCTL");
++DWC_OTG_DEVICE_ATTR_REG32_RW(ggpio,
++			     &(otg_dev->core_if->core_global_regs->ggpio),
++			     "GGPIO");
++DWC_OTG_DEVICE_ATTR_REG32_RW(guid, &(otg_dev->core_if->core_global_regs->guid),
++			     "GUID");
++DWC_OTG_DEVICE_ATTR_REG32_RO(gsnpsid,
++			     &(otg_dev->core_if->core_global_regs->gsnpsid),
++			     "GSNPSID");
++DWC_OTG_DEVICE_ATTR_BITFIELD_RW(devspeed, "Device Speed");
++DWC_OTG_DEVICE_ATTR_BITFIELD_RO(enumspeed, "Device Enumeration Speed");
++
++DWC_OTG_DEVICE_ATTR_REG32_RO(hptxfsiz,
++			     &(otg_dev->core_if->core_global_regs->hptxfsiz),
++			     "HPTXFSIZ");
++DWC_OTG_DEVICE_ATTR_REG32_RW(hprt0, otg_dev->core_if->host_if->hprt0, "HPRT0");
++
++/**
++ * @todo Add code to initiate the HNP.
++ */
++/**
++ * Show the HNP status bit
++ */
++static ssize_t hnp_show(struct device *_dev,
++			struct device_attribute *attr, char *buf)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	return sprintf(buf, "HstNegScs = 0x%x\n",
++		       dwc_otg_get_hnpstatus(otg_dev->core_if));
++}
++
++/**
++ * Set the HNP Request bit
++ */
++static ssize_t hnp_store(struct device *_dev,
++			 struct device_attribute *attr,
++			 const char *buf, size_t count)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	uint32_t in = simple_strtoul(buf, NULL, 16);
++	dwc_otg_set_hnpreq(otg_dev->core_if, in);
++	return count;
++}
++
++DEVICE_ATTR(hnp, 0644, hnp_show, hnp_store);
++
++/**
++ * @todo Add code to initiate the SRP.
++ */
++/**
++ * Show the SRP status bit
++ */
++static ssize_t srp_show(struct device *_dev,
++			struct device_attribute *attr, char *buf)
++{
++#ifndef DWC_HOST_ONLY
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	return sprintf(buf, "SesReqScs = 0x%x\n",
++		       dwc_otg_get_srpstatus(otg_dev->core_if));
++#else
++	return sprintf(buf, "Host Only Mode!\n");
++#endif
++}
++
++/**
++ * Set the SRP Request bit
++ */
++static ssize_t srp_store(struct device *_dev,
++			 struct device_attribute *attr,
++			 const char *buf, size_t count)
++{
++#ifndef DWC_HOST_ONLY
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	dwc_otg_pcd_initiate_srp(otg_dev->pcd);
++#endif
++	return count;
++}
++
++DEVICE_ATTR(srp, 0644, srp_show, srp_store);
++
++/**
++ * @todo Need to do more for power on/off?
++ */
++/**
++ * Show the Bus Power status
++ */
++static ssize_t buspower_show(struct device *_dev,
++			     struct device_attribute *attr, char *buf)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	return sprintf(buf, "Bus Power = 0x%x\n",
++		       dwc_otg_get_prtpower(otg_dev->core_if));
++}
++
++/**
++ * Set the Bus Power status
++ */
++static ssize_t buspower_store(struct device *_dev,
++			      struct device_attribute *attr,
++			      const char *buf, size_t count)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	uint32_t on = simple_strtoul(buf, NULL, 16);
++	dwc_otg_set_prtpower(otg_dev->core_if, on);
++	return count;
++}
++
++DEVICE_ATTR(buspower, 0644, buspower_show, buspower_store);
++
++/**
++ * @todo Need to do more for suspend?
++ */
++/**
++ * Show the Bus Suspend status
++ */
++static ssize_t bussuspend_show(struct device *_dev,
++			       struct device_attribute *attr, char *buf)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	return sprintf(buf, "Bus Suspend = 0x%x\n",
++		       dwc_otg_get_prtsuspend(otg_dev->core_if));
++}
++
++/**
++ * Set the Bus Suspend status
++ */
++static ssize_t bussuspend_store(struct device *_dev,
++				struct device_attribute *attr,
++				const char *buf, size_t count)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	uint32_t in = simple_strtoul(buf, NULL, 16);
++	dwc_otg_set_prtsuspend(otg_dev->core_if, in);
++	return count;
++}
++
++DEVICE_ATTR(bussuspend, 0644, bussuspend_show, bussuspend_store);
++
++/**
++ * Show the Mode Change Ready Timer status
++ */
++static ssize_t mode_ch_tim_en_show(struct device *_dev,
++				   struct device_attribute *attr, char *buf)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	return sprintf(buf, "Mode Change Ready Timer Enable = 0x%x\n",
++		       dwc_otg_get_mode_ch_tim(otg_dev->core_if));
++}
++
++/**
++ * Set the Mode Change Ready Timer status
++ */
++static ssize_t mode_ch_tim_en_store(struct device *_dev,
++				    struct device_attribute *attr,
++				    const char *buf, size_t count)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	uint32_t in = simple_strtoul(buf, NULL, 16);
++	dwc_otg_set_mode_ch_tim(otg_dev->core_if, in);
++	return count;
++}
++
++DEVICE_ATTR(mode_ch_tim_en, 0644, mode_ch_tim_en_show, mode_ch_tim_en_store);
++
++/**
++ * Show the value of HFIR Frame Interval bitfield
++ */
++static ssize_t fr_interval_show(struct device *_dev,
++				struct device_attribute *attr, char *buf)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	return sprintf(buf, "Frame Interval = 0x%x\n",
++		       dwc_otg_get_fr_interval(otg_dev->core_if));
++}
++
++/**
++ * Set the HFIR Frame Interval value
++ */
++static ssize_t fr_interval_store(struct device *_dev,
++				 struct device_attribute *attr,
++				 const char *buf, size_t count)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	uint32_t in = simple_strtoul(buf, NULL, 10);
++	dwc_otg_set_fr_interval(otg_dev->core_if, in);
++	return count;
++}
++
++DEVICE_ATTR(fr_interval, 0644, fr_interval_show, fr_interval_store);
++
++/**
++ * Show the status of Remote Wakeup.
++ */
++static ssize_t remote_wakeup_show(struct device *_dev,
++				  struct device_attribute *attr, char *buf)
++{
++#ifndef DWC_HOST_ONLY
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++
++	return sprintf(buf,
++		       "Remote Wakeup Sig = %d Enabled = %d LPM Remote Wakeup = %d\n",
++		       dwc_otg_get_remotewakesig(otg_dev->core_if),
++		       dwc_otg_pcd_get_rmwkup_enable(otg_dev->pcd),
++		       dwc_otg_get_lpm_remotewakeenabled(otg_dev->core_if));
++#else
++	return sprintf(buf, "Host Only Mode!\n");
++#endif /* DWC_HOST_ONLY */
++}
++
++/**
++ * Initiate a remote wakeup of the host.  The Device control register
++ * Remote Wakeup Signal bit is written if the PCD Remote wakeup enable
++ * flag is set.
++ *
++ */
++static ssize_t remote_wakeup_store(struct device *_dev,
++				   struct device_attribute *attr,
++				   const char *buf, size_t count)
++{
++#ifndef DWC_HOST_ONLY
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	uint32_t val = simple_strtoul(buf, NULL, 16);
++
++	if (val & 1) {
++		dwc_otg_pcd_remote_wakeup(otg_dev->pcd, 1);
++	} else {
++		dwc_otg_pcd_remote_wakeup(otg_dev->pcd, 0);
++	}
++#endif /* DWC_HOST_ONLY */
++	return count;
++}
++
++DEVICE_ATTR(remote_wakeup, S_IRUGO | S_IWUSR, remote_wakeup_show,
++	    remote_wakeup_store);
++
++/**
++ * Show the whether core is hibernated or not.
++ */
++static ssize_t rem_wakeup_pwrdn_show(struct device *_dev,
++				     struct device_attribute *attr, char *buf)
++{
++#ifndef DWC_HOST_ONLY
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++
++	if (dwc_otg_get_core_state(otg_dev->core_if)) {
++		DWC_PRINTF("Core is in hibernation\n");
++	} else {
++		DWC_PRINTF("Core is not in hibernation\n");
++	}
++#endif /* DWC_HOST_ONLY */
++	return 0;
++}
++
++extern int dwc_otg_device_hibernation_restore(dwc_otg_core_if_t * core_if,
++					      int rem_wakeup, int reset);
++
++/**
++ * Initiate a remote wakeup of the device to exit from hibernation.
++ */
++static ssize_t rem_wakeup_pwrdn_store(struct device *_dev,
++				      struct device_attribute *attr,
++				      const char *buf, size_t count)
++{
++#ifndef DWC_HOST_ONLY
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	dwc_otg_device_hibernation_restore(otg_dev->core_if, 1, 0);
++#endif
++	return count;
++}
++
++DEVICE_ATTR(rem_wakeup_pwrdn, S_IRUGO | S_IWUSR, rem_wakeup_pwrdn_show,
++	    rem_wakeup_pwrdn_store);
++
++static ssize_t disconnect_us(struct device *_dev,
++			     struct device_attribute *attr,
++			     const char *buf, size_t count)
++{
++
++#ifndef DWC_HOST_ONLY
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	uint32_t val = simple_strtoul(buf, NULL, 16);
++	DWC_PRINTF("The Passed value is %04x\n", val);
++
++	dwc_otg_pcd_disconnect_us(otg_dev->pcd, 50);
++
++#endif /* DWC_HOST_ONLY */
++	return count;
++}
++
++DEVICE_ATTR(disconnect_us, S_IWUSR, 0, disconnect_us);
++
++/**
++ * Dump global registers and either host or device registers (depending on the
++ * current mode of the core).
++ */
++static ssize_t regdump_show(struct device *_dev,
++			    struct device_attribute *attr, char *buf)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++
++	dwc_otg_dump_global_registers(otg_dev->core_if);
++	if (dwc_otg_is_host_mode(otg_dev->core_if)) {
++		dwc_otg_dump_host_registers(otg_dev->core_if);
++	} else {
++		dwc_otg_dump_dev_registers(otg_dev->core_if);
++
++	}
++	return sprintf(buf, "Register Dump\n");
++}
++
++DEVICE_ATTR(regdump, S_IRUGO, regdump_show, 0);
++
++/**
++ * Dump global registers and either host or device registers (depending on the
++ * current mode of the core).
++ */
++static ssize_t spramdump_show(struct device *_dev,
++			      struct device_attribute *attr, char *buf)
++{
++#if 0
++	dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++
++	dwc_otg_dump_spram(otg_dev->core_if);
++#endif
++
++	return sprintf(buf, "SPRAM Dump\n");
++}
++
++DEVICE_ATTR(spramdump, S_IRUGO, spramdump_show, 0);
++
++/**
++ * Dump the current hcd state.
++ */
++static ssize_t hcddump_show(struct device *_dev,
++			    struct device_attribute *attr, char *buf)
++{
++#ifndef DWC_DEVICE_ONLY
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	dwc_otg_hcd_dump_state(otg_dev->hcd);
++#endif /* DWC_DEVICE_ONLY */
++	return sprintf(buf, "HCD Dump\n");
++}
++
++DEVICE_ATTR(hcddump, S_IRUGO, hcddump_show, 0);
++
++/**
++ * Dump the average frame remaining at SOF. This can be used to
++ * determine average interrupt latency. Frame remaining is also shown for
++ * start transfer and two additional sample points.
++ */
++static ssize_t hcd_frrem_show(struct device *_dev,
++			      struct device_attribute *attr, char *buf)
++{
++#ifndef DWC_DEVICE_ONLY
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++
++	dwc_otg_hcd_dump_frrem(otg_dev->hcd);
++#endif /* DWC_DEVICE_ONLY */
++	return sprintf(buf, "HCD Dump Frame Remaining\n");
++}
++
++DEVICE_ATTR(hcd_frrem, S_IRUGO, hcd_frrem_show, 0);
++
++/**
++ * Displays the time required to read the GNPTXFSIZ register many times (the
++ * output shows the number of times the register is read).
++ */
++#define RW_REG_COUNT 10000000
++#define MSEC_PER_JIFFIE 1000/HZ
++static ssize_t rd_reg_test_show(struct device *_dev,
++				struct device_attribute *attr, char *buf)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	int i;
++	int time;
++	int start_jiffies;
++
++	printk("HZ %d, MSEC_PER_JIFFIE %d, loops_per_jiffy %lu\n",
++	       HZ, MSEC_PER_JIFFIE, loops_per_jiffy);
++	start_jiffies = jiffies;
++	for (i = 0; i < RW_REG_COUNT; i++) {
++		dwc_otg_get_gnptxfsiz(otg_dev->core_if);
++	}
++	time = jiffies - start_jiffies;
++	return sprintf(buf,
++		       "Time to read GNPTXFSIZ reg %d times: %d msecs (%d jiffies)\n",
++		       RW_REG_COUNT, time * MSEC_PER_JIFFIE, time);
++}
++
++DEVICE_ATTR(rd_reg_test, S_IRUGO, rd_reg_test_show, 0);
++
++/**
++ * Displays the time required to write the GNPTXFSIZ register many times (the
++ * output shows the number of times the register is written).
++ */
++static ssize_t wr_reg_test_show(struct device *_dev,
++				struct device_attribute *attr, char *buf)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	uint32_t reg_val;
++	int i;
++	int time;
++	int start_jiffies;
++
++	printk("HZ %d, MSEC_PER_JIFFIE %d, loops_per_jiffy %lu\n",
++	       HZ, MSEC_PER_JIFFIE, loops_per_jiffy);
++	reg_val = dwc_otg_get_gnptxfsiz(otg_dev->core_if);
++	start_jiffies = jiffies;
++	for (i = 0; i < RW_REG_COUNT; i++) {
++		dwc_otg_set_gnptxfsiz(otg_dev->core_if, reg_val);
++	}
++	time = jiffies - start_jiffies;
++	return sprintf(buf,
++		       "Time to write GNPTXFSIZ reg %d times: %d msecs (%d jiffies)\n",
++		       RW_REG_COUNT, time * MSEC_PER_JIFFIE, time);
++}
++
++DEVICE_ATTR(wr_reg_test, S_IRUGO, wr_reg_test_show, 0);
++
++#ifdef CONFIG_USB_DWC_OTG_LPM
++
++/**
++* Show the lpm_response attribute.
++*/
++static ssize_t lpmresp_show(struct device *_dev,
++			    struct device_attribute *attr, char *buf)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++
++	if (!dwc_otg_get_param_lpm_enable(otg_dev->core_if))
++		return sprintf(buf, "** LPM is DISABLED **\n");
++
++	if (!dwc_otg_is_device_mode(otg_dev->core_if)) {
++		return sprintf(buf, "** Current mode is not device mode\n");
++	}
++	return sprintf(buf, "lpm_response = %d\n",
++		       dwc_otg_get_lpmresponse(otg_dev->core_if));
++}
++
++/**
++* Store the lpm_response attribute.
++*/
++static ssize_t lpmresp_store(struct device *_dev,
++			     struct device_attribute *attr,
++			     const char *buf, size_t count)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	uint32_t val = simple_strtoul(buf, NULL, 16);
++
++	if (!dwc_otg_get_param_lpm_enable(otg_dev->core_if)) {
++		return 0;
++	}
++
++	if (!dwc_otg_is_device_mode(otg_dev->core_if)) {
++		return 0;
++	}
++
++	dwc_otg_set_lpmresponse(otg_dev->core_if, val);
++	return count;
++}
++
++DEVICE_ATTR(lpm_response, S_IRUGO | S_IWUSR, lpmresp_show, lpmresp_store);
++
++/**
++* Show the sleep_status attribute.
++*/
++static ssize_t sleepstatus_show(struct device *_dev,
++				struct device_attribute *attr, char *buf)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	return sprintf(buf, "Sleep Status = %d\n",
++		       dwc_otg_get_lpm_portsleepstatus(otg_dev->core_if));
++}
++
++/**
++ * Store the sleep_status attribure.
++ */
++static ssize_t sleepstatus_store(struct device *_dev,
++				 struct device_attribute *attr,
++				 const char *buf, size_t count)
++{
++        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
++	dwc_otg_core_if_t *core_if = otg_dev->core_if;
++
++	if (dwc_otg_get_lpm_portsleepstatus(otg_dev->core_if)) {
++		if (dwc_otg_is_host_mode(core_if)) {
++
++			DWC_PRINTF("Host initiated resume\n");
++			dwc_otg_set_prtresume(otg_dev->core_if, 1);
++		}
++	}
++
++	return count;
++}
++
++DEVICE_ATTR(sleep_status, S_IRUGO | S_IWUSR, sleepstatus_show,
++	    sleepstatus_store);
++
++#endif /* CONFIG_USB_DWC_OTG_LPM_ENABLE */
++
++/**@}*/
++
++/**
++ * Create the device files
++ */
++void dwc_otg_attr_create(
++#ifdef LM_INTERFACE
++	struct lm_device *dev
++#elif  defined(PCI_INTERFACE)
++	struct pci_dev *dev
++#elif  defined(PLATFORM_INTERFACE)
++        struct platform_device *dev
++#endif
++    )
++{
++	int error;
++
++	error = device_create_file(&dev->dev, &dev_attr_regoffset);
++	error = device_create_file(&dev->dev, &dev_attr_regvalue);
++	error = device_create_file(&dev->dev, &dev_attr_mode);
++	error = device_create_file(&dev->dev, &dev_attr_hnpcapable);
++	error = device_create_file(&dev->dev, &dev_attr_srpcapable);
++	error = device_create_file(&dev->dev, &dev_attr_hsic_connect);
++	error = device_create_file(&dev->dev, &dev_attr_inv_sel_hsic);
++	error = device_create_file(&dev->dev, &dev_attr_hnp);
++	error = device_create_file(&dev->dev, &dev_attr_srp);
++	error = device_create_file(&dev->dev, &dev_attr_buspower);
++	error = device_create_file(&dev->dev, &dev_attr_bussuspend);
++	error = device_create_file(&dev->dev, &dev_attr_mode_ch_tim_en);
++	error = device_create_file(&dev->dev, &dev_attr_fr_interval);
++	error = device_create_file(&dev->dev, &dev_attr_busconnected);
++	error = device_create_file(&dev->dev, &dev_attr_gotgctl);
++	error = device_create_file(&dev->dev, &dev_attr_gusbcfg);
++	error = device_create_file(&dev->dev, &dev_attr_grxfsiz);
++	error = device_create_file(&dev->dev, &dev_attr_gnptxfsiz);
++	error = device_create_file(&dev->dev, &dev_attr_gpvndctl);
++	error = device_create_file(&dev->dev, &dev_attr_ggpio);
++	error = device_create_file(&dev->dev, &dev_attr_guid);
++	error = device_create_file(&dev->dev, &dev_attr_gsnpsid);
++	error = device_create_file(&dev->dev, &dev_attr_devspeed);
++	error = device_create_file(&dev->dev, &dev_attr_enumspeed);
++	error = device_create_file(&dev->dev, &dev_attr_hptxfsiz);
++	error = device_create_file(&dev->dev, &dev_attr_hprt0);
++	error = device_create_file(&dev->dev, &dev_attr_remote_wakeup);
++	error = device_create_file(&dev->dev, &dev_attr_rem_wakeup_pwrdn);
++	error = device_create_file(&dev->dev, &dev_attr_disconnect_us);
++	error = device_create_file(&dev->dev, &dev_attr_regdump);
++	error = device_create_file(&dev->dev, &dev_attr_spramdump);
++	error = device_create_file(&dev->dev, &dev_attr_hcddump);
++	error = device_create_file(&dev->dev, &dev_attr_hcd_frrem);
++	error = device_create_file(&dev->dev, &dev_attr_rd_reg_test);
++	error = device_create_file(&dev->dev, &dev_attr_wr_reg_test);
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	error = device_create_file(&dev->dev, &dev_attr_lpm_response);
++	error = device_create_file(&dev->dev, &dev_attr_sleep_status);
++#endif
++}
++
++/**
++ * Remove the device files
++ */
++void dwc_otg_attr_remove(
++#ifdef LM_INTERFACE
++	struct lm_device *dev
++#elif  defined(PCI_INTERFACE)
++	struct pci_dev *dev
++#elif  defined(PLATFORM_INTERFACE)
++	struct platform_device *dev
++#endif
++    )
++{
++	device_remove_file(&dev->dev, &dev_attr_regoffset);
++	device_remove_file(&dev->dev, &dev_attr_regvalue);
++	device_remove_file(&dev->dev, &dev_attr_mode);
++	device_remove_file(&dev->dev, &dev_attr_hnpcapable);
++	device_remove_file(&dev->dev, &dev_attr_srpcapable);
++	device_remove_file(&dev->dev, &dev_attr_hsic_connect);
++	device_remove_file(&dev->dev, &dev_attr_inv_sel_hsic);
++	device_remove_file(&dev->dev, &dev_attr_hnp);
++	device_remove_file(&dev->dev, &dev_attr_srp);
++	device_remove_file(&dev->dev, &dev_attr_buspower);
++	device_remove_file(&dev->dev, &dev_attr_bussuspend);
++	device_remove_file(&dev->dev, &dev_attr_mode_ch_tim_en);
++	device_remove_file(&dev->dev, &dev_attr_fr_interval);
++	device_remove_file(&dev->dev, &dev_attr_busconnected);
++	device_remove_file(&dev->dev, &dev_attr_gotgctl);
++	device_remove_file(&dev->dev, &dev_attr_gusbcfg);
++	device_remove_file(&dev->dev, &dev_attr_grxfsiz);
++	device_remove_file(&dev->dev, &dev_attr_gnptxfsiz);
++	device_remove_file(&dev->dev, &dev_attr_gpvndctl);
++	device_remove_file(&dev->dev, &dev_attr_ggpio);
++	device_remove_file(&dev->dev, &dev_attr_guid);
++	device_remove_file(&dev->dev, &dev_attr_gsnpsid);
++	device_remove_file(&dev->dev, &dev_attr_devspeed);
++	device_remove_file(&dev->dev, &dev_attr_enumspeed);
++	device_remove_file(&dev->dev, &dev_attr_hptxfsiz);
++	device_remove_file(&dev->dev, &dev_attr_hprt0);
++	device_remove_file(&dev->dev, &dev_attr_remote_wakeup);
++	device_remove_file(&dev->dev, &dev_attr_rem_wakeup_pwrdn);
++	device_remove_file(&dev->dev, &dev_attr_disconnect_us);
++	device_remove_file(&dev->dev, &dev_attr_regdump);
++	device_remove_file(&dev->dev, &dev_attr_spramdump);
++	device_remove_file(&dev->dev, &dev_attr_hcddump);
++	device_remove_file(&dev->dev, &dev_attr_hcd_frrem);
++	device_remove_file(&dev->dev, &dev_attr_rd_reg_test);
++	device_remove_file(&dev->dev, &dev_attr_wr_reg_test);
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	device_remove_file(&dev->dev, &dev_attr_lpm_response);
++	device_remove_file(&dev->dev, &dev_attr_sleep_status);
++#endif
++}
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_attr.h
+@@ -0,0 +1,89 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_attr.h $
++ * $Revision: #13 $
++ * $Date: 2010/06/21 $
++ * $Change: 1532021 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++#if !defined(__DWC_OTG_ATTR_H__)
++#define __DWC_OTG_ATTR_H__
++
++/** @file
++ * This file contains the interface to the Linux device attributes.
++ */
++extern struct device_attribute dev_attr_regoffset;
++extern struct device_attribute dev_attr_regvalue;
++
++extern struct device_attribute dev_attr_mode;
++extern struct device_attribute dev_attr_hnpcapable;
++extern struct device_attribute dev_attr_srpcapable;
++extern struct device_attribute dev_attr_hnp;
++extern struct device_attribute dev_attr_srp;
++extern struct device_attribute dev_attr_buspower;
++extern struct device_attribute dev_attr_bussuspend;
++extern struct device_attribute dev_attr_mode_ch_tim_en;
++extern struct device_attribute dev_attr_fr_interval;
++extern struct device_attribute dev_attr_busconnected;
++extern struct device_attribute dev_attr_gotgctl;
++extern struct device_attribute dev_attr_gusbcfg;
++extern struct device_attribute dev_attr_grxfsiz;
++extern struct device_attribute dev_attr_gnptxfsiz;
++extern struct device_attribute dev_attr_gpvndctl;
++extern struct device_attribute dev_attr_ggpio;
++extern struct device_attribute dev_attr_guid;
++extern struct device_attribute dev_attr_gsnpsid;
++extern struct device_attribute dev_attr_devspeed;
++extern struct device_attribute dev_attr_enumspeed;
++extern struct device_attribute dev_attr_hptxfsiz;
++extern struct device_attribute dev_attr_hprt0;
++#ifdef CONFIG_USB_DWC_OTG_LPM
++extern struct device_attribute dev_attr_lpm_response;
++extern struct device_attribute devi_attr_sleep_status;
++#endif
++
++void dwc_otg_attr_create(
++#ifdef LM_INTERFACE
++				struct lm_device *dev
++#elif  defined(PCI_INTERFACE)
++				struct pci_dev *dev
++#elif  defined(PLATFORM_INTERFACE)
++	struct platform_device *dev
++#endif
++    );
++
++void dwc_otg_attr_remove(
++#ifdef LM_INTERFACE
++				struct lm_device *dev
++#elif  defined(PCI_INTERFACE)
++				struct pci_dev *dev
++#elif  defined(PLATFORM_INTERFACE)
++	struct platform_device *dev
++#endif
++    );
++#endif
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_cfi.c
+@@ -0,0 +1,1874 @@
++/* ==========================================================================
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++/** @file
++ *
++ * This file contains the most of the CFI(Core Feature Interface)
++ * implementation for the OTG.
++ */
++
++#ifdef DWC_UTE_CFI
++
++#include "dwc_otg_pcd.h"
++#include "dwc_otg_cfi.h"
++
++/** This definition should actually migrate to the Portability Library */
++#define DWC_CONSTANT_CPU_TO_LE16(x) (x)
++
++static int cfi_core_features_buf(uint8_t * buf, uint16_t buflen);
++static int cfi_get_feature_value(uint8_t * buf, uint16_t buflen,
++				 struct dwc_otg_pcd *pcd,
++				 struct cfi_usb_ctrlrequest *ctrl_req);
++static int cfi_set_feature_value(struct dwc_otg_pcd *pcd);
++static int cfi_ep_get_sg_val(uint8_t * buf, struct dwc_otg_pcd *pcd,
++			     struct cfi_usb_ctrlrequest *req);
++static int cfi_ep_get_concat_val(uint8_t * buf, struct dwc_otg_pcd *pcd,
++				 struct cfi_usb_ctrlrequest *req);
++static int cfi_ep_get_align_val(uint8_t * buf, struct dwc_otg_pcd *pcd,
++				struct cfi_usb_ctrlrequest *req);
++static int cfi_preproc_reset(struct dwc_otg_pcd *pcd,
++			     struct cfi_usb_ctrlrequest *req);
++static void cfi_free_ep_bs_dyn_data(cfi_ep_t * cfiep);
++
++static uint16_t get_dfifo_size(dwc_otg_core_if_t * core_if);
++static int32_t get_rxfifo_size(dwc_otg_core_if_t * core_if, uint16_t wValue);
++static int32_t get_txfifo_size(struct dwc_otg_pcd *pcd, uint16_t wValue);
++
++static uint8_t resize_fifos(dwc_otg_core_if_t * core_if);
++
++/** This is the header of the all features descriptor */
++static cfi_all_features_header_t all_props_desc_header = {
++	.wVersion = DWC_CONSTANT_CPU_TO_LE16(0x100),
++	.wCoreID = DWC_CONSTANT_CPU_TO_LE16(CFI_CORE_ID_OTG),
++	.wNumFeatures = DWC_CONSTANT_CPU_TO_LE16(9),
++};
++
++/** This is an array of statically allocated feature descriptors */
++static cfi_feature_desc_header_t prop_descs[] = {
++
++	/* FT_ID_DMA_MODE */
++	{
++	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_DMA_MODE),
++	 .bmAttributes = CFI_FEATURE_ATTR_RW,
++	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(1),
++	 },
++
++	/* FT_ID_DMA_BUFFER_SETUP */
++	{
++	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_DMA_BUFFER_SETUP),
++	 .bmAttributes = CFI_FEATURE_ATTR_RW,
++	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(6),
++	 },
++
++	/* FT_ID_DMA_BUFF_ALIGN */
++	{
++	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_DMA_BUFF_ALIGN),
++	 .bmAttributes = CFI_FEATURE_ATTR_RW,
++	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(2),
++	 },
++
++	/* FT_ID_DMA_CONCAT_SETUP */
++	{
++	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_DMA_CONCAT_SETUP),
++	 .bmAttributes = CFI_FEATURE_ATTR_RW,
++	 //.wDataLength  = DWC_CONSTANT_CPU_TO_LE16(6),
++	 },
++
++	/* FT_ID_DMA_CIRCULAR */
++	{
++	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_DMA_CIRCULAR),
++	 .bmAttributes = CFI_FEATURE_ATTR_RW,
++	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(6),
++	 },
++
++	/* FT_ID_THRESHOLD_SETUP */
++	{
++	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_THRESHOLD_SETUP),
++	 .bmAttributes = CFI_FEATURE_ATTR_RW,
++	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(6),
++	 },
++
++	/* FT_ID_DFIFO_DEPTH */
++	{
++	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_DFIFO_DEPTH),
++	 .bmAttributes = CFI_FEATURE_ATTR_RO,
++	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(2),
++	 },
++
++	/* FT_ID_TX_FIFO_DEPTH */
++	{
++	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_TX_FIFO_DEPTH),
++	 .bmAttributes = CFI_FEATURE_ATTR_RW,
++	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(2),
++	 },
++
++	/* FT_ID_RX_FIFO_DEPTH */
++	{
++	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_RX_FIFO_DEPTH),
++	 .bmAttributes = CFI_FEATURE_ATTR_RW,
++	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(2),
++	 }
++};
++
++/** The table of feature names */
++cfi_string_t prop_name_table[] = {
++	{FT_ID_DMA_MODE, "dma_mode"},
++	{FT_ID_DMA_BUFFER_SETUP, "buffer_setup"},
++	{FT_ID_DMA_BUFF_ALIGN, "buffer_align"},
++	{FT_ID_DMA_CONCAT_SETUP, "concat_setup"},
++	{FT_ID_DMA_CIRCULAR, "buffer_circular"},
++	{FT_ID_THRESHOLD_SETUP, "threshold_setup"},
++	{FT_ID_DFIFO_DEPTH, "dfifo_depth"},
++	{FT_ID_TX_FIFO_DEPTH, "txfifo_depth"},
++	{FT_ID_RX_FIFO_DEPTH, "rxfifo_depth"},
++	{}
++};
++
++/************************************************************************/
++
++/**
++ * Returns the name of the feature by its ID
++ * or NULL if no featute ID matches.
++ *
++ */
++const uint8_t *get_prop_name(uint16_t prop_id, int *len)
++{
++	cfi_string_t *pstr;
++	*len = 0;
++
++	for (pstr = prop_name_table; pstr && pstr->s; pstr++) {
++		if (pstr->id == prop_id) {
++			*len = DWC_STRLEN(pstr->s);
++			return pstr->s;
++		}
++	}
++	return NULL;
++}
++
++/**
++ * This function handles all CFI specific control requests.
++ *
++ * Return a negative value to stall the DCE.
++ */
++int cfi_setup(struct dwc_otg_pcd *pcd, struct cfi_usb_ctrlrequest *ctrl)
++{
++	int retval = 0;
++	dwc_otg_pcd_ep_t *ep = NULL;
++	cfiobject_t *cfi = pcd->cfi;
++	struct dwc_otg_core_if *coreif = GET_CORE_IF(pcd);
++	uint16_t wLen = DWC_LE16_TO_CPU(&ctrl->wLength);
++	uint16_t wValue = DWC_LE16_TO_CPU(&ctrl->wValue);
++	uint16_t wIndex = DWC_LE16_TO_CPU(&ctrl->wIndex);
++	uint32_t regaddr = 0;
++	uint32_t regval = 0;
++
++	/* Save this Control Request in the CFI object.
++	 * The data field will be assigned in the data stage completion CB function.
++	 */
++	cfi->ctrl_req = *ctrl;
++	cfi->ctrl_req.data = NULL;
++
++	cfi->need_gadget_att = 0;
++	cfi->need_status_in_complete = 0;
++
++	switch (ctrl->bRequest) {
++	case VEN_CORE_GET_FEATURES:
++		retval = cfi_core_features_buf(cfi->buf_in.buf, CFI_IN_BUF_LEN);
++		if (retval >= 0) {
++			//dump_msg(cfi->buf_in.buf, retval);
++			ep = &pcd->ep0;
++
++			retval = min((uint16_t) retval, wLen);
++			/* Transfer this buffer to the host through the EP0-IN EP */
++			ep->dwc_ep.dma_addr = cfi->buf_in.addr;
++			ep->dwc_ep.start_xfer_buff = cfi->buf_in.buf;
++			ep->dwc_ep.xfer_buff = cfi->buf_in.buf;
++			ep->dwc_ep.xfer_len = retval;
++			ep->dwc_ep.xfer_count = 0;
++			ep->dwc_ep.sent_zlp = 0;
++			ep->dwc_ep.total_len = ep->dwc_ep.xfer_len;
++
++			pcd->ep0_pending = 1;
++			dwc_otg_ep0_start_transfer(coreif, &ep->dwc_ep);
++		}
++		retval = 0;
++		break;
++
++	case VEN_CORE_GET_FEATURE:
++		CFI_INFO("VEN_CORE_GET_FEATURE\n");
++		retval = cfi_get_feature_value(cfi->buf_in.buf, CFI_IN_BUF_LEN,
++					       pcd, ctrl);
++		if (retval >= 0) {
++			ep = &pcd->ep0;
++
++			retval = min((uint16_t) retval, wLen);
++			/* Transfer this buffer to the host through the EP0-IN EP */
++			ep->dwc_ep.dma_addr = cfi->buf_in.addr;
++			ep->dwc_ep.start_xfer_buff = cfi->buf_in.buf;
++			ep->dwc_ep.xfer_buff = cfi->buf_in.buf;
++			ep->dwc_ep.xfer_len = retval;
++			ep->dwc_ep.xfer_count = 0;
++			ep->dwc_ep.sent_zlp = 0;
++			ep->dwc_ep.total_len = ep->dwc_ep.xfer_len;
++
++			pcd->ep0_pending = 1;
++			dwc_otg_ep0_start_transfer(coreif, &ep->dwc_ep);
++		}
++		CFI_INFO("VEN_CORE_GET_FEATURE=%d\n", retval);
++		dump_msg(cfi->buf_in.buf, retval);
++		break;
++
++	case VEN_CORE_SET_FEATURE:
++		CFI_INFO("VEN_CORE_SET_FEATURE\n");
++		/* Set up an XFER to get the data stage of the control request,
++		 * which is the new value of the feature to be modified.
++		 */
++		ep = &pcd->ep0;
++		ep->dwc_ep.is_in = 0;
++		ep->dwc_ep.dma_addr = cfi->buf_out.addr;
++		ep->dwc_ep.start_xfer_buff = cfi->buf_out.buf;
++		ep->dwc_ep.xfer_buff = cfi->buf_out.buf;
++		ep->dwc_ep.xfer_len = wLen;
++		ep->dwc_ep.xfer_count = 0;
++		ep->dwc_ep.sent_zlp = 0;
++		ep->dwc_ep.total_len = ep->dwc_ep.xfer_len;
++
++		pcd->ep0_pending = 1;
++		/* Read the control write's data stage */
++		dwc_otg_ep0_start_transfer(coreif, &ep->dwc_ep);
++		retval = 0;
++		break;
++
++	case VEN_CORE_RESET_FEATURES:
++		CFI_INFO("VEN_CORE_RESET_FEATURES\n");
++		cfi->need_gadget_att = 1;
++		cfi->need_status_in_complete = 1;
++		retval = cfi_preproc_reset(pcd, ctrl);
++		CFI_INFO("VEN_CORE_RESET_FEATURES = (%d)\n", retval);
++		break;
++
++	case VEN_CORE_ACTIVATE_FEATURES:
++		CFI_INFO("VEN_CORE_ACTIVATE_FEATURES\n");
++		break;
++
++	case VEN_CORE_READ_REGISTER:
++		CFI_INFO("VEN_CORE_READ_REGISTER\n");
++		/* wValue optionally contains the HI WORD of the register offset and
++		 * wIndex contains the LOW WORD of the register offset
++		 */
++		if (wValue == 0) {
++			/* @TODO - MAS - fix the access to the base field */
++			regaddr = 0;
++			//regaddr = (uint32_t) pcd->otg_dev->os_dep.base;
++			//GET_CORE_IF(pcd)->co
++			regaddr |= wIndex;
++		} else {
++			regaddr = (wValue << 16) | wIndex;
++		}
++
++		/* Read a 32-bit value of the memory at the regaddr */
++		regval = DWC_READ_REG32((uint32_t *) regaddr);
++
++		ep = &pcd->ep0;
++		dwc_memcpy(cfi->buf_in.buf, &regval, sizeof(uint32_t));
++		ep->dwc_ep.is_in = 1;
++		ep->dwc_ep.dma_addr = cfi->buf_in.addr;
++		ep->dwc_ep.start_xfer_buff = cfi->buf_in.buf;
++		ep->dwc_ep.xfer_buff = cfi->buf_in.buf;
++		ep->dwc_ep.xfer_len = wLen;
++		ep->dwc_ep.xfer_count = 0;
++		ep->dwc_ep.sent_zlp = 0;
++		ep->dwc_ep.total_len = ep->dwc_ep.xfer_len;
++
++		pcd->ep0_pending = 1;
++		dwc_otg_ep0_start_transfer(coreif, &ep->dwc_ep);
++		cfi->need_gadget_att = 0;
++		retval = 0;
++		break;
++
++	case VEN_CORE_WRITE_REGISTER:
++		CFI_INFO("VEN_CORE_WRITE_REGISTER\n");
++		/* Set up an XFER to get the data stage of the control request,
++		 * which is the new value of the register to be modified.
++		 */
++		ep = &pcd->ep0;
++		ep->dwc_ep.is_in = 0;
++		ep->dwc_ep.dma_addr = cfi->buf_out.addr;
++		ep->dwc_ep.start_xfer_buff = cfi->buf_out.buf;
++		ep->dwc_ep.xfer_buff = cfi->buf_out.buf;
++		ep->dwc_ep.xfer_len = wLen;
++		ep->dwc_ep.xfer_count = 0;
++		ep->dwc_ep.sent_zlp = 0;
++		ep->dwc_ep.total_len = ep->dwc_ep.xfer_len;
++
++		pcd->ep0_pending = 1;
++		/* Read the control write's data stage */
++		dwc_otg_ep0_start_transfer(coreif, &ep->dwc_ep);
++		retval = 0;
++		break;
++
++	default:
++		retval = -DWC_E_NOT_SUPPORTED;
++		break;
++	}
++
++	return retval;
++}
++
++/**
++ * This function prepares the core features descriptors and copies its
++ * raw representation into the buffer <buf>.
++ *
++ * The buffer structure is as follows:
++ *	all_features_header (8 bytes)
++ *	features_#1 (8 bytes + feature name string length)
++ *	features_#2 (8 bytes + feature name string length)
++ *	.....
++ *	features_#n - where n=the total count of feature descriptors
++ */
++static int cfi_core_features_buf(uint8_t * buf, uint16_t buflen)
++{
++	cfi_feature_desc_header_t *prop_hdr = prop_descs;
++	cfi_feature_desc_header_t *prop;
++	cfi_all_features_header_t *all_props_hdr = &all_props_desc_header;
++	cfi_all_features_header_t *tmp;
++	uint8_t *tmpbuf = buf;
++	const uint8_t *pname = NULL;
++	int i, j, namelen = 0, totlen;
++
++	/* Prepare and copy the core features into the buffer */
++	CFI_INFO("%s:\n", __func__);
++
++	tmp = (cfi_all_features_header_t *) tmpbuf;
++	*tmp = *all_props_hdr;
++	tmpbuf += CFI_ALL_FEATURES_HDR_LEN;
++
++	j = sizeof(prop_descs) / sizeof(cfi_all_features_header_t);
++	for (i = 0; i < j; i++, prop_hdr++) {
++		pname = get_prop_name(prop_hdr->wFeatureID, &namelen);
++		prop = (cfi_feature_desc_header_t *) tmpbuf;
++		*prop = *prop_hdr;
++
++		prop->bNameLen = namelen;
++		prop->wLength =
++		    DWC_CONSTANT_CPU_TO_LE16(CFI_FEATURE_DESC_HDR_LEN +
++					     namelen);
++
++		tmpbuf += CFI_FEATURE_DESC_HDR_LEN;
++		dwc_memcpy(tmpbuf, pname, namelen);
++		tmpbuf += namelen;
++	}
++
++	totlen = tmpbuf - buf;
++
++	if (totlen > 0) {
++		tmp = (cfi_all_features_header_t *) buf;
++		tmp->wTotalLen = DWC_CONSTANT_CPU_TO_LE16(totlen);
++	}
++
++	return totlen;
++}
++
++/**
++ * This function releases all the dynamic memory in the CFI object.
++ */
++static void cfi_release(cfiobject_t * cfiobj)
++{
++	cfi_ep_t *cfiep;
++	dwc_list_link_t *tmp;
++
++	CFI_INFO("%s\n", __func__);
++
++	if (cfiobj->buf_in.buf) {
++		DWC_DMA_FREE(CFI_IN_BUF_LEN, cfiobj->buf_in.buf,
++			     cfiobj->buf_in.addr);
++		cfiobj->buf_in.buf = NULL;
++	}
++
++	if (cfiobj->buf_out.buf) {
++		DWC_DMA_FREE(CFI_OUT_BUF_LEN, cfiobj->buf_out.buf,
++			     cfiobj->buf_out.addr);
++		cfiobj->buf_out.buf = NULL;
++	}
++
++	/* Free the Buffer Setup values for each EP */
++	//list_for_each_entry(cfiep, &cfiobj->active_eps, lh) {
++	DWC_LIST_FOREACH(tmp, &cfiobj->active_eps) {
++		cfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
++		cfi_free_ep_bs_dyn_data(cfiep);
++	}
++}
++
++/**
++ * This function frees the dynamically allocated EP buffer setup data.
++ */
++static void cfi_free_ep_bs_dyn_data(cfi_ep_t * cfiep)
++{
++	if (cfiep->bm_sg) {
++		DWC_FREE(cfiep->bm_sg);
++		cfiep->bm_sg = NULL;
++	}
++
++	if (cfiep->bm_align) {
++		DWC_FREE(cfiep->bm_align);
++		cfiep->bm_align = NULL;
++	}
++
++	if (cfiep->bm_concat) {
++		if (NULL != cfiep->bm_concat->wTxBytes) {
++			DWC_FREE(cfiep->bm_concat->wTxBytes);
++			cfiep->bm_concat->wTxBytes = NULL;
++		}
++		DWC_FREE(cfiep->bm_concat);
++		cfiep->bm_concat = NULL;
++	}
++}
++
++/**
++ * This function initializes the default values of the features
++ * for a specific endpoint and should be called only once when
++ * the EP is enabled first time.
++ */
++static int cfi_ep_init_defaults(struct dwc_otg_pcd *pcd, cfi_ep_t * cfiep)
++{
++	int retval = 0;
++
++	cfiep->bm_sg = DWC_ALLOC(sizeof(ddma_sg_buffer_setup_t));
++	if (NULL == cfiep->bm_sg) {
++		CFI_INFO("Failed to allocate memory for SG feature value\n");
++		return -DWC_E_NO_MEMORY;
++	}
++	dwc_memset(cfiep->bm_sg, 0, sizeof(ddma_sg_buffer_setup_t));
++
++	/* For the Concatenation feature's default value we do not allocate
++	 * memory for the wTxBytes field - it will be done in the set_feature_value
++	 * request handler.
++	 */
++	cfiep->bm_concat = DWC_ALLOC(sizeof(ddma_concat_buffer_setup_t));
++	if (NULL == cfiep->bm_concat) {
++		CFI_INFO
++		    ("Failed to allocate memory for CONCATENATION feature value\n");
++		DWC_FREE(cfiep->bm_sg);
++		return -DWC_E_NO_MEMORY;
++	}
++	dwc_memset(cfiep->bm_concat, 0, sizeof(ddma_concat_buffer_setup_t));
++
++	cfiep->bm_align = DWC_ALLOC(sizeof(ddma_align_buffer_setup_t));
++	if (NULL == cfiep->bm_align) {
++		CFI_INFO
++		    ("Failed to allocate memory for Alignment feature value\n");
++		DWC_FREE(cfiep->bm_sg);
++		DWC_FREE(cfiep->bm_concat);
++		return -DWC_E_NO_MEMORY;
++	}
++	dwc_memset(cfiep->bm_align, 0, sizeof(ddma_align_buffer_setup_t));
++
++	return retval;
++}
++
++/**
++ * The callback function that notifies the CFI on the activation of
++ * an endpoint in the PCD. The following steps are done in this function:
++ *
++ *	Create a dynamically allocated cfi_ep_t object (a CFI wrapper to the PCD's
++ *		active endpoint)
++ *	Create MAX_DMA_DESCS_PER_EP count DMA Descriptors for the EP
++ *	Set the Buffer Mode to standard
++ *	Initialize the default values for all EP modes (SG, Circular, Concat, Align)
++ *	Add the cfi_ep_t object to the list of active endpoints in the CFI object
++ */
++static int cfi_ep_enable(struct cfiobject *cfi, struct dwc_otg_pcd *pcd,
++			 struct dwc_otg_pcd_ep *ep)
++{
++	cfi_ep_t *cfiep;
++	int retval = -DWC_E_NOT_SUPPORTED;
++
++	CFI_INFO("%s: epname=%s; epnum=0x%02x\n", __func__,
++		 "EP_" /*ep->ep.name */ , ep->desc->bEndpointAddress);
++	/* MAS - Check whether this endpoint already is in the list */
++	cfiep = get_cfi_ep_by_pcd_ep(cfi, ep);
++
++	if (NULL == cfiep) {
++		/* Allocate a cfi_ep_t object */
++		cfiep = DWC_ALLOC(sizeof(cfi_ep_t));
++		if (NULL == cfiep) {
++			CFI_INFO
++			    ("Unable to allocate memory for <cfiep> in function %s\n",
++			     __func__);
++			return -DWC_E_NO_MEMORY;
++		}
++		dwc_memset(cfiep, 0, sizeof(cfi_ep_t));
++
++		/* Save the dwc_otg_pcd_ep pointer in the cfiep object */
++		cfiep->ep = ep;
++
++		/* Allocate the DMA Descriptors chain of MAX_DMA_DESCS_PER_EP count */
++		ep->dwc_ep.descs =
++		    DWC_DMA_ALLOC(MAX_DMA_DESCS_PER_EP *
++				  sizeof(dwc_otg_dma_desc_t),
++				  &ep->dwc_ep.descs_dma_addr);
++
++		if (NULL == ep->dwc_ep.descs) {
++			DWC_FREE(cfiep);
++			return -DWC_E_NO_MEMORY;
++		}
++
++		DWC_LIST_INIT(&cfiep->lh);
++
++		/* Set the buffer mode to BM_STANDARD. It will be modified
++		 * when building descriptors for a specific buffer mode */
++		ep->dwc_ep.buff_mode = BM_STANDARD;
++
++		/* Create and initialize the default values for this EP's Buffer modes */
++		if ((retval = cfi_ep_init_defaults(pcd, cfiep)) < 0)
++			return retval;
++
++		/* Add the cfi_ep_t object to the CFI object's list of active endpoints */
++		DWC_LIST_INSERT_TAIL(&cfi->active_eps, &cfiep->lh);
++		retval = 0;
++	} else {		/* The sought EP already is in the list */
++		CFI_INFO("%s: The sought EP already is in the list\n",
++			 __func__);
++	}
++
++	return retval;
++}
++
++/**
++ * This function is called when the data stage of a 3-stage Control Write request
++ * is complete.
++ *
++ */
++static int cfi_ctrl_write_complete(struct cfiobject *cfi,
++				   struct dwc_otg_pcd *pcd)
++{
++	uint32_t addr, reg_value;
++	uint16_t wIndex, wValue;
++	uint8_t bRequest;
++	uint8_t *buf = cfi->buf_out.buf;
++	//struct usb_ctrlrequest *ctrl_req = &cfi->ctrl_req_saved;
++	struct cfi_usb_ctrlrequest *ctrl_req = &cfi->ctrl_req;
++	int retval = -DWC_E_NOT_SUPPORTED;
++
++	CFI_INFO("%s\n", __func__);
++
++	bRequest = ctrl_req->bRequest;
++	wIndex = DWC_CONSTANT_CPU_TO_LE16(ctrl_req->wIndex);
++	wValue = DWC_CONSTANT_CPU_TO_LE16(ctrl_req->wValue);
++
++	/*
++	 * Save the pointer to the data stage in the ctrl_req's <data> field.
++	 * The request should be already saved in the command stage by now.
++	 */
++	ctrl_req->data = cfi->buf_out.buf;
++	cfi->need_status_in_complete = 0;
++	cfi->need_gadget_att = 0;
++
++	switch (bRequest) {
++	case VEN_CORE_WRITE_REGISTER:
++		/* The buffer contains raw data of the new value for the register */
++		reg_value = *((uint32_t *) buf);
++		if (wValue == 0) {
++			addr = 0;
++			//addr = (uint32_t) pcd->otg_dev->os_dep.base;
++			addr += wIndex;
++		} else {
++			addr = (wValue << 16) | wIndex;
++		}
++
++		//writel(reg_value, addr);
++
++		retval = 0;
++		cfi->need_status_in_complete = 1;
++		break;
++
++	case VEN_CORE_SET_FEATURE:
++		/* The buffer contains raw data of the new value of the feature */
++		retval = cfi_set_feature_value(pcd);
++		if (retval < 0)
++			return retval;
++
++		cfi->need_status_in_complete = 1;
++		break;
++
++	default:
++		break;
++	}
++
++	return retval;
++}
++
++/**
++ * This function builds the DMA descriptors for the SG buffer mode.
++ */
++static void cfi_build_sg_descs(struct cfiobject *cfi, cfi_ep_t * cfiep,
++			       dwc_otg_pcd_request_t * req)
++{
++	struct dwc_otg_pcd_ep *ep = cfiep->ep;
++	ddma_sg_buffer_setup_t *sgval = cfiep->bm_sg;
++	struct dwc_otg_dma_desc *desc = cfiep->ep->dwc_ep.descs;
++	struct dwc_otg_dma_desc *desc_last = cfiep->ep->dwc_ep.descs;
++	dma_addr_t buff_addr = req->dma;
++	int i;
++	uint32_t txsize, off;
++
++	txsize = sgval->wSize;
++	off = sgval->bOffset;
++
++//      CFI_INFO("%s: %s TXSIZE=0x%08x; OFFSET=0x%08x\n",
++//              __func__, cfiep->ep->ep.name, txsize, off);
++
++	for (i = 0; i < sgval->bCount; i++) {
++		desc->status.b.bs = BS_HOST_BUSY;
++		desc->buf = buff_addr;
++		desc->status.b.l = 0;
++		desc->status.b.ioc = 0;
++		desc->status.b.sp = 0;
++		desc->status.b.bytes = txsize;
++		desc->status.b.bs = BS_HOST_READY;
++
++		/* Set the next address of the buffer */
++		buff_addr += txsize + off;
++		desc_last = desc;
++		desc++;
++	}
++
++	/* Set the last, ioc and sp bits on the Last DMA Descriptor */
++	desc_last->status.b.l = 1;
++	desc_last->status.b.ioc = 1;
++	desc_last->status.b.sp = ep->dwc_ep.sent_zlp;
++	/* Save the last DMA descriptor pointer */
++	cfiep->dma_desc_last = desc_last;
++	cfiep->desc_count = sgval->bCount;
++}
++
++/**
++ * This function builds the DMA descriptors for the Concatenation buffer mode.
++ */
++static void cfi_build_concat_descs(struct cfiobject *cfi, cfi_ep_t * cfiep,
++				   dwc_otg_pcd_request_t * req)
++{
++	struct dwc_otg_pcd_ep *ep = cfiep->ep;
++	ddma_concat_buffer_setup_t *concatval = cfiep->bm_concat;
++	struct dwc_otg_dma_desc *desc = cfiep->ep->dwc_ep.descs;
++	struct dwc_otg_dma_desc *desc_last = cfiep->ep->dwc_ep.descs;
++	dma_addr_t buff_addr = req->dma;
++	int i;
++	uint16_t *txsize;
++
++	txsize = concatval->wTxBytes;
++
++	for (i = 0; i < concatval->hdr.bDescCount; i++) {
++		desc->buf = buff_addr;
++		desc->status.b.bs = BS_HOST_BUSY;
++		desc->status.b.l = 0;
++		desc->status.b.ioc = 0;
++		desc->status.b.sp = 0;
++		desc->status.b.bytes = *txsize;
++		desc->status.b.bs = BS_HOST_READY;
++
++		txsize++;
++		/* Set the next address of the buffer */
++		buff_addr += UGETW(ep->desc->wMaxPacketSize);
++		desc_last = desc;
++		desc++;
++	}
++
++	/* Set the last, ioc and sp bits on the Last DMA Descriptor */
++	desc_last->status.b.l = 1;
++	desc_last->status.b.ioc = 1;
++	desc_last->status.b.sp = ep->dwc_ep.sent_zlp;
++	cfiep->dma_desc_last = desc_last;
++	cfiep->desc_count = concatval->hdr.bDescCount;
++}
++
++/**
++ * This function builds the DMA descriptors for the Circular buffer mode
++ */
++static void cfi_build_circ_descs(struct cfiobject *cfi, cfi_ep_t * cfiep,
++				 dwc_otg_pcd_request_t * req)
++{
++	/* @todo: MAS - add implementation when this feature needs to be tested */
++}
++
++/**
++ * This function builds the DMA descriptors for the Alignment buffer mode
++ */
++static void cfi_build_align_descs(struct cfiobject *cfi, cfi_ep_t * cfiep,
++				  dwc_otg_pcd_request_t * req)
++{
++	struct dwc_otg_pcd_ep *ep = cfiep->ep;
++	ddma_align_buffer_setup_t *alignval = cfiep->bm_align;
++	struct dwc_otg_dma_desc *desc = cfiep->ep->dwc_ep.descs;
++	dma_addr_t buff_addr = req->dma;
++
++	desc->status.b.bs = BS_HOST_BUSY;
++	desc->status.b.l = 1;
++	desc->status.b.ioc = 1;
++	desc->status.b.sp = ep->dwc_ep.sent_zlp;
++	desc->status.b.bytes = req->length;
++	/* Adjust the buffer alignment */
++	desc->buf = (buff_addr + alignval->bAlign);
++	desc->status.b.bs = BS_HOST_READY;
++	cfiep->dma_desc_last = desc;
++	cfiep->desc_count = 1;
++}
++
++/**
++ * This function builds the DMA descriptors chain for different modes of the
++ * buffer setup of an endpoint.
++ */
++static void cfi_build_descriptors(struct cfiobject *cfi,
++				  struct dwc_otg_pcd *pcd,
++				  struct dwc_otg_pcd_ep *ep,
++				  dwc_otg_pcd_request_t * req)
++{
++	cfi_ep_t *cfiep;
++
++	/* Get the cfiep by the dwc_otg_pcd_ep */
++	cfiep = get_cfi_ep_by_pcd_ep(cfi, ep);
++	if (NULL == cfiep) {
++		CFI_INFO("%s: Unable to find a matching active endpoint\n",
++			 __func__);
++		return;
++	}
++
++	cfiep->xfer_len = req->length;
++
++	/* Iterate through all the DMA descriptors */
++	switch (cfiep->ep->dwc_ep.buff_mode) {
++	case BM_SG:
++		cfi_build_sg_descs(cfi, cfiep, req);
++		break;
++
++	case BM_CONCAT:
++		cfi_build_concat_descs(cfi, cfiep, req);
++		break;
++
++	case BM_CIRCULAR:
++		cfi_build_circ_descs(cfi, cfiep, req);
++		break;
++
++	case BM_ALIGN:
++		cfi_build_align_descs(cfi, cfiep, req);
++		break;
++
++	default:
++		break;
++	}
++}
++
++/**
++ * Allocate DMA buffer for different Buffer modes.
++ */
++static void *cfi_ep_alloc_buf(struct cfiobject *cfi, struct dwc_otg_pcd *pcd,
++			      struct dwc_otg_pcd_ep *ep, dma_addr_t * dma,
++			      unsigned size, gfp_t flags)
++{
++	return DWC_DMA_ALLOC(size, dma);
++}
++
++/**
++ * This function initializes the CFI object.
++ */
++int init_cfi(cfiobject_t * cfiobj)
++{
++	CFI_INFO("%s\n", __func__);
++
++	/* Allocate a buffer for IN XFERs */
++	cfiobj->buf_in.buf =
++	    DWC_DMA_ALLOC(CFI_IN_BUF_LEN, &cfiobj->buf_in.addr);
++	if (NULL == cfiobj->buf_in.buf) {
++		CFI_INFO("Unable to allocate buffer for INs\n");
++		return -DWC_E_NO_MEMORY;
++	}
++
++	/* Allocate a buffer for OUT XFERs */
++	cfiobj->buf_out.buf =
++	    DWC_DMA_ALLOC(CFI_OUT_BUF_LEN, &cfiobj->buf_out.addr);
++	if (NULL == cfiobj->buf_out.buf) {
++		CFI_INFO("Unable to allocate buffer for OUT\n");
++		return -DWC_E_NO_MEMORY;
++	}
++
++	/* Initialize the callback function pointers */
++	cfiobj->ops.release = cfi_release;
++	cfiobj->ops.ep_enable = cfi_ep_enable;
++	cfiobj->ops.ctrl_write_complete = cfi_ctrl_write_complete;
++	cfiobj->ops.build_descriptors = cfi_build_descriptors;
++	cfiobj->ops.ep_alloc_buf = cfi_ep_alloc_buf;
++
++	/* Initialize the list of active endpoints in the CFI object */
++	DWC_LIST_INIT(&cfiobj->active_eps);
++
++	return 0;
++}
++
++/**
++ * This function reads the required feature's current value into the buffer
++ *
++ * @retval: Returns negative as error, or the data length of the feature
++ */
++static int cfi_get_feature_value(uint8_t * buf, uint16_t buflen,
++				 struct dwc_otg_pcd *pcd,
++				 struct cfi_usb_ctrlrequest *ctrl_req)
++{
++	int retval = -DWC_E_NOT_SUPPORTED;
++	struct dwc_otg_core_if *coreif = GET_CORE_IF(pcd);
++	uint16_t dfifo, rxfifo, txfifo;
++
++	switch (ctrl_req->wIndex) {
++		/* Whether the DDMA is enabled or not */
++	case FT_ID_DMA_MODE:
++		*buf = (coreif->dma_enable && coreif->dma_desc_enable) ? 1 : 0;
++		retval = 1;
++		break;
++
++	case FT_ID_DMA_BUFFER_SETUP:
++		retval = cfi_ep_get_sg_val(buf, pcd, ctrl_req);
++		break;
++
++	case FT_ID_DMA_BUFF_ALIGN:
++		retval = cfi_ep_get_align_val(buf, pcd, ctrl_req);
++		break;
++
++	case FT_ID_DMA_CONCAT_SETUP:
++		retval = cfi_ep_get_concat_val(buf, pcd, ctrl_req);
++		break;
++
++	case FT_ID_DMA_CIRCULAR:
++		CFI_INFO("GetFeature value (FT_ID_DMA_CIRCULAR)\n");
++		break;
++
++	case FT_ID_THRESHOLD_SETUP:
++		CFI_INFO("GetFeature value (FT_ID_THRESHOLD_SETUP)\n");
++		break;
++
++	case FT_ID_DFIFO_DEPTH:
++		dfifo = get_dfifo_size(coreif);
++		*((uint16_t *) buf) = dfifo;
++		retval = sizeof(uint16_t);
++		break;
++
++	case FT_ID_TX_FIFO_DEPTH:
++		retval = get_txfifo_size(pcd, ctrl_req->wValue);
++		if (retval >= 0) {
++			txfifo = retval;
++			*((uint16_t *) buf) = txfifo;
++			retval = sizeof(uint16_t);
++		}
++		break;
++
++	case FT_ID_RX_FIFO_DEPTH:
++		retval = get_rxfifo_size(coreif, ctrl_req->wValue);
++		if (retval >= 0) {
++			rxfifo = retval;
++			*((uint16_t *) buf) = rxfifo;
++			retval = sizeof(uint16_t);
++		}
++		break;
++	}
++
++	return retval;
++}
++
++/**
++ * This function resets the SG for the specified EP to its default value
++ */
++static int cfi_reset_sg_val(cfi_ep_t * cfiep)
++{
++	dwc_memset(cfiep->bm_sg, 0, sizeof(ddma_sg_buffer_setup_t));
++	return 0;
++}
++
++/**
++ * This function resets the Alignment for the specified EP to its default value
++ */
++static int cfi_reset_align_val(cfi_ep_t * cfiep)
++{
++	dwc_memset(cfiep->bm_sg, 0, sizeof(ddma_sg_buffer_setup_t));
++	return 0;
++}
++
++/**
++ * This function resets the Concatenation for the specified EP to its default value
++ * This function will also set the value of the wTxBytes field to NULL after
++ * freeing the memory previously allocated for this field.
++ */
++static int cfi_reset_concat_val(cfi_ep_t * cfiep)
++{
++	/* First we need to free the wTxBytes field */
++	if (cfiep->bm_concat->wTxBytes) {
++		DWC_FREE(cfiep->bm_concat->wTxBytes);
++		cfiep->bm_concat->wTxBytes = NULL;
++	}
++
++	dwc_memset(cfiep->bm_concat, 0, sizeof(ddma_concat_buffer_setup_t));
++	return 0;
++}
++
++/**
++ * This function resets all the buffer setups of the specified endpoint
++ */
++static int cfi_ep_reset_all_setup_vals(cfi_ep_t * cfiep)
++{
++	cfi_reset_sg_val(cfiep);
++	cfi_reset_align_val(cfiep);
++	cfi_reset_concat_val(cfiep);
++	return 0;
++}
++
++static int cfi_handle_reset_fifo_val(struct dwc_otg_pcd *pcd, uint8_t ep_addr,
++				     uint8_t rx_rst, uint8_t tx_rst)
++{
++	int retval = -DWC_E_INVALID;
++	uint16_t tx_siz[15];
++	uint16_t rx_siz = 0;
++	dwc_otg_pcd_ep_t *ep = NULL;
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dwc_otg_core_params_t *params = GET_CORE_IF(pcd)->core_params;
++
++	if (rx_rst) {
++		rx_siz = params->dev_rx_fifo_size;
++		params->dev_rx_fifo_size = GET_CORE_IF(pcd)->init_rxfsiz;
++	}
++
++	if (tx_rst) {
++		if (ep_addr == 0) {
++			int i;
++
++			for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
++				tx_siz[i] =
++				    core_if->core_params->dev_tx_fifo_size[i];
++				core_if->core_params->dev_tx_fifo_size[i] =
++				    core_if->init_txfsiz[i];
++			}
++		} else {
++
++			ep = get_ep_by_addr(pcd, ep_addr);
++
++			if (NULL == ep) {
++				CFI_INFO
++				    ("%s: Unable to get the endpoint addr=0x%02x\n",
++				     __func__, ep_addr);
++				return -DWC_E_INVALID;
++			}
++
++			tx_siz[0] =
++			    params->dev_tx_fifo_size[ep->dwc_ep.tx_fifo_num -
++						     1];
++			params->dev_tx_fifo_size[ep->dwc_ep.tx_fifo_num - 1] =
++			    GET_CORE_IF(pcd)->init_txfsiz[ep->
++							  dwc_ep.tx_fifo_num -
++							  1];
++		}
++	}
++
++	if (resize_fifos(GET_CORE_IF(pcd))) {
++		retval = 0;
++	} else {
++		CFI_INFO
++		    ("%s: Error resetting the feature Reset All(FIFO size)\n",
++		     __func__);
++		if (rx_rst) {
++			params->dev_rx_fifo_size = rx_siz;
++		}
++
++		if (tx_rst) {
++			if (ep_addr == 0) {
++				int i;
++				for (i = 0; i < core_if->hwcfg4.b.num_in_eps;
++				     i++) {
++					core_if->
++					    core_params->dev_tx_fifo_size[i] =
++					    tx_siz[i];
++				}
++			} else {
++				params->dev_tx_fifo_size[ep->
++							 dwc_ep.tx_fifo_num -
++							 1] = tx_siz[0];
++			}
++		}
++		retval = -DWC_E_INVALID;
++	}
++	return retval;
++}
++
++static int cfi_handle_reset_all(struct dwc_otg_pcd *pcd, uint8_t addr)
++{
++	int retval = 0;
++	cfi_ep_t *cfiep;
++	cfiobject_t *cfi = pcd->cfi;
++	dwc_list_link_t *tmp;
++
++	retval = cfi_handle_reset_fifo_val(pcd, addr, 1, 1);
++	if (retval < 0) {
++		return retval;
++	}
++
++	/* If the EP address is known then reset the features for only that EP */
++	if (addr) {
++		cfiep = get_cfi_ep_by_addr(pcd->cfi, addr);
++		if (NULL == cfiep) {
++			CFI_INFO("%s: Error getting the EP address 0x%02x\n",
++				 __func__, addr);
++			return -DWC_E_INVALID;
++		}
++		retval = cfi_ep_reset_all_setup_vals(cfiep);
++		cfiep->ep->dwc_ep.buff_mode = BM_STANDARD;
++	}
++	/* Otherwise (wValue == 0), reset all features of all EP's */
++	else {
++		/* Traverse all the active EP's and reset the feature(s) value(s) */
++		//list_for_each_entry(cfiep, &cfi->active_eps, lh) {
++		DWC_LIST_FOREACH(tmp, &cfi->active_eps) {
++			cfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
++			retval = cfi_ep_reset_all_setup_vals(cfiep);
++			cfiep->ep->dwc_ep.buff_mode = BM_STANDARD;
++			if (retval < 0) {
++				CFI_INFO
++				    ("%s: Error resetting the feature Reset All\n",
++				     __func__);
++				return retval;
++			}
++		}
++	}
++	return retval;
++}
++
++static int cfi_handle_reset_dma_buff_setup(struct dwc_otg_pcd *pcd,
++					   uint8_t addr)
++{
++	int retval = 0;
++	cfi_ep_t *cfiep;
++	cfiobject_t *cfi = pcd->cfi;
++	dwc_list_link_t *tmp;
++
++	/* If the EP address is known then reset the features for only that EP */
++	if (addr) {
++		cfiep = get_cfi_ep_by_addr(pcd->cfi, addr);
++		if (NULL == cfiep) {
++			CFI_INFO("%s: Error getting the EP address 0x%02x\n",
++				 __func__, addr);
++			return -DWC_E_INVALID;
++		}
++		retval = cfi_reset_sg_val(cfiep);
++	}
++	/* Otherwise (wValue == 0), reset all features of all EP's */
++	else {
++		/* Traverse all the active EP's and reset the feature(s) value(s) */
++		//list_for_each_entry(cfiep, &cfi->active_eps, lh) {
++		DWC_LIST_FOREACH(tmp, &cfi->active_eps) {
++			cfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
++			retval = cfi_reset_sg_val(cfiep);
++			if (retval < 0) {
++				CFI_INFO
++				    ("%s: Error resetting the feature Buffer Setup\n",
++				     __func__);
++				return retval;
++			}
++		}
++	}
++	return retval;
++}
++
++static int cfi_handle_reset_concat_val(struct dwc_otg_pcd *pcd, uint8_t addr)
++{
++	int retval = 0;
++	cfi_ep_t *cfiep;
++	cfiobject_t *cfi = pcd->cfi;
++	dwc_list_link_t *tmp;
++
++	/* If the EP address is known then reset the features for only that EP */
++	if (addr) {
++		cfiep = get_cfi_ep_by_addr(pcd->cfi, addr);
++		if (NULL == cfiep) {
++			CFI_INFO("%s: Error getting the EP address 0x%02x\n",
++				 __func__, addr);
++			return -DWC_E_INVALID;
++		}
++		retval = cfi_reset_concat_val(cfiep);
++	}
++	/* Otherwise (wValue == 0), reset all features of all EP's */
++	else {
++		/* Traverse all the active EP's and reset the feature(s) value(s) */
++		//list_for_each_entry(cfiep, &cfi->active_eps, lh) {
++		DWC_LIST_FOREACH(tmp, &cfi->active_eps) {
++			cfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
++			retval = cfi_reset_concat_val(cfiep);
++			if (retval < 0) {
++				CFI_INFO
++				    ("%s: Error resetting the feature Concatenation Value\n",
++				     __func__);
++				return retval;
++			}
++		}
++	}
++	return retval;
++}
++
++static int cfi_handle_reset_align_val(struct dwc_otg_pcd *pcd, uint8_t addr)
++{
++	int retval = 0;
++	cfi_ep_t *cfiep;
++	cfiobject_t *cfi = pcd->cfi;
++	dwc_list_link_t *tmp;
++
++	/* If the EP address is known then reset the features for only that EP */
++	if (addr) {
++		cfiep = get_cfi_ep_by_addr(pcd->cfi, addr);
++		if (NULL == cfiep) {
++			CFI_INFO("%s: Error getting the EP address 0x%02x\n",
++				 __func__, addr);
++			return -DWC_E_INVALID;
++		}
++		retval = cfi_reset_align_val(cfiep);
++	}
++	/* Otherwise (wValue == 0), reset all features of all EP's */
++	else {
++		/* Traverse all the active EP's and reset the feature(s) value(s) */
++		//list_for_each_entry(cfiep, &cfi->active_eps, lh) {
++		DWC_LIST_FOREACH(tmp, &cfi->active_eps) {
++			cfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
++			retval = cfi_reset_align_val(cfiep);
++			if (retval < 0) {
++				CFI_INFO
++				    ("%s: Error resetting the feature Aliignment Value\n",
++				     __func__);
++				return retval;
++			}
++		}
++	}
++	return retval;
++
++}
++
++static int cfi_preproc_reset(struct dwc_otg_pcd *pcd,
++			     struct cfi_usb_ctrlrequest *req)
++{
++	int retval = 0;
++
++	switch (req->wIndex) {
++	case 0:
++		/* Reset all features */
++		retval = cfi_handle_reset_all(pcd, req->wValue & 0xff);
++		break;
++
++	case FT_ID_DMA_BUFFER_SETUP:
++		/* Reset the SG buffer setup */
++		retval =
++		    cfi_handle_reset_dma_buff_setup(pcd, req->wValue & 0xff);
++		break;
++
++	case FT_ID_DMA_CONCAT_SETUP:
++		/* Reset the Concatenation buffer setup */
++		retval = cfi_handle_reset_concat_val(pcd, req->wValue & 0xff);
++		break;
++
++	case FT_ID_DMA_BUFF_ALIGN:
++		/* Reset the Alignment buffer setup */
++		retval = cfi_handle_reset_align_val(pcd, req->wValue & 0xff);
++		break;
++
++	case FT_ID_TX_FIFO_DEPTH:
++		retval =
++		    cfi_handle_reset_fifo_val(pcd, req->wValue & 0xff, 0, 1);
++		pcd->cfi->need_gadget_att = 0;
++		break;
++
++	case FT_ID_RX_FIFO_DEPTH:
++		retval = cfi_handle_reset_fifo_val(pcd, 0, 1, 0);
++		pcd->cfi->need_gadget_att = 0;
++		break;
++	default:
++		break;
++	}
++	return retval;
++}
++
++/**
++ * This function sets a new value for the SG buffer setup.
++ */
++static int cfi_ep_set_sg_val(uint8_t * buf, struct dwc_otg_pcd *pcd)
++{
++	uint8_t inaddr, outaddr;
++	cfi_ep_t *epin, *epout;
++	ddma_sg_buffer_setup_t *psgval;
++	uint32_t desccount, size;
++
++	CFI_INFO("%s\n", __func__);
++
++	psgval = (ddma_sg_buffer_setup_t *) buf;
++	desccount = (uint32_t) psgval->bCount;
++	size = (uint32_t) psgval->wSize;
++
++	/* Check the DMA descriptor count */
++	if ((desccount > MAX_DMA_DESCS_PER_EP) || (desccount == 0)) {
++		CFI_INFO
++		    ("%s: The count of DMA Descriptors should be between 1 and %d\n",
++		     __func__, MAX_DMA_DESCS_PER_EP);
++		return -DWC_E_INVALID;
++	}
++
++	/* Check the DMA descriptor count */
++
++	if (size == 0) {
++
++		CFI_INFO("%s: The transfer size should be at least 1 byte\n",
++			 __func__);
++
++		return -DWC_E_INVALID;
++
++	}
++
++	inaddr = psgval->bInEndpointAddress;
++	outaddr = psgval->bOutEndpointAddress;
++
++	epin = get_cfi_ep_by_addr(pcd->cfi, inaddr);
++	epout = get_cfi_ep_by_addr(pcd->cfi, outaddr);
++
++	if (NULL == epin || NULL == epout) {
++		CFI_INFO
++		    ("%s: Unable to get the endpoints inaddr=0x%02x outaddr=0x%02x\n",
++		     __func__, inaddr, outaddr);
++		return -DWC_E_INVALID;
++	}
++
++	epin->ep->dwc_ep.buff_mode = BM_SG;
++	dwc_memcpy(epin->bm_sg, psgval, sizeof(ddma_sg_buffer_setup_t));
++
++	epout->ep->dwc_ep.buff_mode = BM_SG;
++	dwc_memcpy(epout->bm_sg, psgval, sizeof(ddma_sg_buffer_setup_t));
++
++	return 0;
++}
++
++/**
++ * This function sets a new value for the buffer Alignment setup.
++ */
++static int cfi_ep_set_alignment_val(uint8_t * buf, struct dwc_otg_pcd *pcd)
++{
++	cfi_ep_t *ep;
++	uint8_t addr;
++	ddma_align_buffer_setup_t *palignval;
++
++	palignval = (ddma_align_buffer_setup_t *) buf;
++	addr = palignval->bEndpointAddress;
++
++	ep = get_cfi_ep_by_addr(pcd->cfi, addr);
++
++	if (NULL == ep) {
++		CFI_INFO("%s: Unable to get the endpoint addr=0x%02x\n",
++			 __func__, addr);
++		return -DWC_E_INVALID;
++	}
++
++	ep->ep->dwc_ep.buff_mode = BM_ALIGN;
++	dwc_memcpy(ep->bm_align, palignval, sizeof(ddma_align_buffer_setup_t));
++
++	return 0;
++}
++
++/**
++ * This function sets a new value for the Concatenation buffer setup.
++ */
++static int cfi_ep_set_concat_val(uint8_t * buf, struct dwc_otg_pcd *pcd)
++{
++	uint8_t addr;
++	cfi_ep_t *ep;
++	struct _ddma_concat_buffer_setup_hdr *pConcatValHdr;
++	uint16_t *pVals;
++	uint32_t desccount;
++	int i;
++	uint16_t mps;
++
++	pConcatValHdr = (struct _ddma_concat_buffer_setup_hdr *)buf;
++	desccount = (uint32_t) pConcatValHdr->bDescCount;
++	pVals = (uint16_t *) (buf + BS_CONCAT_VAL_HDR_LEN);
++
++	/* Check the DMA descriptor count */
++	if (desccount > MAX_DMA_DESCS_PER_EP) {
++		CFI_INFO("%s: Maximum DMA Descriptor count should be %d\n",
++			 __func__, MAX_DMA_DESCS_PER_EP);
++		return -DWC_E_INVALID;
++	}
++
++	addr = pConcatValHdr->bEndpointAddress;
++	ep = get_cfi_ep_by_addr(pcd->cfi, addr);
++	if (NULL == ep) {
++		CFI_INFO("%s: Unable to get the endpoint addr=0x%02x\n",
++			 __func__, addr);
++		return -DWC_E_INVALID;
++	}
++
++	mps = UGETW(ep->ep->desc->wMaxPacketSize);
++
++#if 0
++	for (i = 0; i < desccount; i++) {
++		CFI_INFO("%s: wTxSize[%d]=0x%04x\n", __func__, i, pVals[i]);
++	}
++	CFI_INFO("%s: epname=%s; mps=%d\n", __func__, ep->ep->ep.name, mps);
++#endif
++
++	/* Check the wTxSizes to be less than or equal to the mps */
++	for (i = 0; i < desccount; i++) {
++		if (pVals[i] > mps) {
++			CFI_INFO
++			    ("%s: ERROR - the wTxSize[%d] should be <= MPS (wTxSize=%d)\n",
++			     __func__, i, pVals[i]);
++			return -DWC_E_INVALID;
++		}
++	}
++
++	ep->ep->dwc_ep.buff_mode = BM_CONCAT;
++	dwc_memcpy(ep->bm_concat, pConcatValHdr, BS_CONCAT_VAL_HDR_LEN);
++
++	/* Free the previously allocated storage for the wTxBytes */
++	if (ep->bm_concat->wTxBytes) {
++		DWC_FREE(ep->bm_concat->wTxBytes);
++	}
++
++	/* Allocate a new storage for the wTxBytes field */
++	ep->bm_concat->wTxBytes =
++	    DWC_ALLOC(sizeof(uint16_t) * pConcatValHdr->bDescCount);
++	if (NULL == ep->bm_concat->wTxBytes) {
++		CFI_INFO("%s: Unable to allocate memory\n", __func__);
++		return -DWC_E_NO_MEMORY;
++	}
++
++	/* Copy the new values into the wTxBytes filed */
++	dwc_memcpy(ep->bm_concat->wTxBytes, buf + BS_CONCAT_VAL_HDR_LEN,
++		   sizeof(uint16_t) * pConcatValHdr->bDescCount);
++
++	return 0;
++}
++
++/**
++ * This function calculates the total of all FIFO sizes
++ *
++ * @param core_if Programming view of DWC_otg controller
++ *
++ * @return The total of data FIFO sizes.
++ *
++ */
++static uint16_t get_dfifo_size(dwc_otg_core_if_t * core_if)
++{
++	dwc_otg_core_params_t *params = core_if->core_params;
++	uint16_t dfifo_total = 0;
++	int i;
++
++	/* The shared RxFIFO size */
++	dfifo_total =
++	    params->dev_rx_fifo_size + params->dev_nperio_tx_fifo_size;
++
++	/* Add up each TxFIFO size to the total */
++	for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
++		dfifo_total += params->dev_tx_fifo_size[i];
++	}
++
++	return dfifo_total;
++}
++
++/**
++ * This function returns Rx FIFO size
++ *
++ * @param core_if Programming view of DWC_otg controller
++ *
++ * @return The total of data FIFO sizes.
++ *
++ */
++static int32_t get_rxfifo_size(dwc_otg_core_if_t * core_if, uint16_t wValue)
++{
++	switch (wValue >> 8) {
++	case 0:
++		return (core_if->pwron_rxfsiz <
++			32768) ? core_if->pwron_rxfsiz : 32768;
++		break;
++	case 1:
++		return core_if->core_params->dev_rx_fifo_size;
++		break;
++	default:
++		return -DWC_E_INVALID;
++		break;
++	}
++}
++
++/**
++ * This function returns Tx FIFO size for IN EP
++ *
++ * @param core_if Programming view of DWC_otg controller
++ *
++ * @return The total of data FIFO sizes.
++ *
++ */
++static int32_t get_txfifo_size(struct dwc_otg_pcd *pcd, uint16_t wValue)
++{
++	dwc_otg_pcd_ep_t *ep;
++
++	ep = get_ep_by_addr(pcd, wValue & 0xff);
++
++	if (NULL == ep) {
++		CFI_INFO("%s: Unable to get the endpoint addr=0x%02x\n",
++			 __func__, wValue & 0xff);
++		return -DWC_E_INVALID;
++	}
++
++	if (!ep->dwc_ep.is_in) {
++		CFI_INFO
++		    ("%s: No Tx FIFO assingned to the Out endpoint addr=0x%02x\n",
++		     __func__, wValue & 0xff);
++		return -DWC_E_INVALID;
++	}
++
++	switch (wValue >> 8) {
++	case 0:
++		return (GET_CORE_IF(pcd)->pwron_txfsiz
++			[ep->dwc_ep.tx_fifo_num - 1] <
++			768) ? GET_CORE_IF(pcd)->pwron_txfsiz[ep->
++							      dwc_ep.tx_fifo_num
++							      - 1] : 32768;
++		break;
++	case 1:
++		return GET_CORE_IF(pcd)->core_params->
++		    dev_tx_fifo_size[ep->dwc_ep.num - 1];
++		break;
++	default:
++		return -DWC_E_INVALID;
++		break;
++	}
++}
++
++/**
++ * This function checks if the submitted combination of
++ * device mode FIFO sizes is possible or not.
++ *
++ * @param core_if Programming view of DWC_otg controller
++ *
++ * @return 1 if possible, 0 otherwise.
++ *
++ */
++static uint8_t check_fifo_sizes(dwc_otg_core_if_t * core_if)
++{
++	uint16_t dfifo_actual = 0;
++	dwc_otg_core_params_t *params = core_if->core_params;
++	uint16_t start_addr = 0;
++	int i;
++
++	dfifo_actual =
++	    params->dev_rx_fifo_size + params->dev_nperio_tx_fifo_size;
++
++	for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
++		dfifo_actual += params->dev_tx_fifo_size[i];
++	}
++
++	if (dfifo_actual > core_if->total_fifo_size) {
++		return 0;
++	}
++
++	if (params->dev_rx_fifo_size > 32768 || params->dev_rx_fifo_size < 16)
++		return 0;
++
++	if (params->dev_nperio_tx_fifo_size > 32768
++	    || params->dev_nperio_tx_fifo_size < 16)
++		return 0;
++
++	for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
++
++		if (params->dev_tx_fifo_size[i] > 768
++		    || params->dev_tx_fifo_size[i] < 4)
++			return 0;
++	}
++
++	if (params->dev_rx_fifo_size > core_if->pwron_rxfsiz)
++		return 0;
++	start_addr = params->dev_rx_fifo_size;
++
++	if (params->dev_nperio_tx_fifo_size > core_if->pwron_gnptxfsiz)
++		return 0;
++	start_addr += params->dev_nperio_tx_fifo_size;
++
++	for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
++
++		if (params->dev_tx_fifo_size[i] > core_if->pwron_txfsiz[i])
++			return 0;
++		start_addr += params->dev_tx_fifo_size[i];
++	}
++
++	return 1;
++}
++
++/**
++ * This function resizes Device mode FIFOs
++ *
++ * @param core_if Programming view of DWC_otg controller
++ *
++ * @return 1 if successful, 0 otherwise
++ *
++ */
++static uint8_t resize_fifos(dwc_otg_core_if_t * core_if)
++{
++	int i = 0;
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	dwc_otg_core_params_t *params = core_if->core_params;
++	uint32_t rx_fifo_size;
++	fifosize_data_t nptxfifosize;
++	fifosize_data_t txfifosize[15];
++
++	uint32_t rx_fsz_bak;
++	uint32_t nptxfsz_bak;
++	uint32_t txfsz_bak[15];
++
++	uint16_t start_address;
++	uint8_t retval = 1;
++
++	if (!check_fifo_sizes(core_if)) {
++		return 0;
++	}
++
++	/* Configure data FIFO sizes */
++	if (core_if->hwcfg2.b.dynamic_fifo && params->enable_dynamic_fifo) {
++		rx_fsz_bak = DWC_READ_REG32(&global_regs->grxfsiz);
++		rx_fifo_size = params->dev_rx_fifo_size;
++		DWC_WRITE_REG32(&global_regs->grxfsiz, rx_fifo_size);
++
++		/*
++		 * Tx FIFOs These FIFOs are numbered from 1 to 15.
++		 * Indexes of the FIFO size module parameters in the
++		 * dev_tx_fifo_size array and the FIFO size registers in
++		 * the dtxfsiz array run from 0 to 14.
++		 */
++
++		/* Non-periodic Tx FIFO */
++		nptxfsz_bak = DWC_READ_REG32(&global_regs->gnptxfsiz);
++		nptxfifosize.b.depth = params->dev_nperio_tx_fifo_size;
++		start_address = params->dev_rx_fifo_size;
++		nptxfifosize.b.startaddr = start_address;
++
++		DWC_WRITE_REG32(&global_regs->gnptxfsiz, nptxfifosize.d32);
++
++		start_address += nptxfifosize.b.depth;
++
++		for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
++			txfsz_bak[i] = DWC_READ_REG32(&global_regs->dtxfsiz[i]);
++
++			txfifosize[i].b.depth = params->dev_tx_fifo_size[i];
++			txfifosize[i].b.startaddr = start_address;
++			DWC_WRITE_REG32(&global_regs->dtxfsiz[i],
++					txfifosize[i].d32);
++
++			start_address += txfifosize[i].b.depth;
++		}
++
++		/** Check if register values are set correctly */
++		if (rx_fifo_size != DWC_READ_REG32(&global_regs->grxfsiz)) {
++			retval = 0;
++		}
++
++		if (nptxfifosize.d32 != DWC_READ_REG32(&global_regs->gnptxfsiz)) {
++			retval = 0;
++		}
++
++		for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
++			if (txfifosize[i].d32 !=
++			    DWC_READ_REG32(&global_regs->dtxfsiz[i])) {
++				retval = 0;
++			}
++		}
++
++		/** If register values are not set correctly, reset old values */
++		if (retval == 0) {
++			DWC_WRITE_REG32(&global_regs->grxfsiz, rx_fsz_bak);
++
++			/* Non-periodic Tx FIFO */
++			DWC_WRITE_REG32(&global_regs->gnptxfsiz, nptxfsz_bak);
++
++			for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
++				DWC_WRITE_REG32(&global_regs->dtxfsiz[i],
++						txfsz_bak[i]);
++			}
++		}
++	} else {
++		return 0;
++	}
++
++	/* Flush the FIFOs */
++	dwc_otg_flush_tx_fifo(core_if, 0x10);	/* all Tx FIFOs */
++	dwc_otg_flush_rx_fifo(core_if);
++
++	return retval;
++}
++
++/**
++ * This function sets a new value for the buffer Alignment setup.
++ */
++static int cfi_ep_set_tx_fifo_val(uint8_t * buf, dwc_otg_pcd_t * pcd)
++{
++	int retval;
++	uint32_t fsiz;
++	uint16_t size;
++	uint16_t ep_addr;
++	dwc_otg_pcd_ep_t *ep;
++	dwc_otg_core_params_t *params = GET_CORE_IF(pcd)->core_params;
++	tx_fifo_size_setup_t *ptxfifoval;
++
++	ptxfifoval = (tx_fifo_size_setup_t *) buf;
++	ep_addr = ptxfifoval->bEndpointAddress;
++	size = ptxfifoval->wDepth;
++
++	ep = get_ep_by_addr(pcd, ep_addr);
++
++	CFI_INFO
++	    ("%s: Set Tx FIFO size: endpoint addr=0x%02x, depth=%d, FIFO Num=%d\n",
++	     __func__, ep_addr, size, ep->dwc_ep.tx_fifo_num);
++
++	if (NULL == ep) {
++		CFI_INFO("%s: Unable to get the endpoint addr=0x%02x\n",
++			 __func__, ep_addr);
++		return -DWC_E_INVALID;
++	}
++
++	fsiz = params->dev_tx_fifo_size[ep->dwc_ep.tx_fifo_num - 1];
++	params->dev_tx_fifo_size[ep->dwc_ep.tx_fifo_num - 1] = size;
++
++	if (resize_fifos(GET_CORE_IF(pcd))) {
++		retval = 0;
++	} else {
++		CFI_INFO
++		    ("%s: Error setting the feature Tx FIFO Size for EP%d\n",
++		     __func__, ep_addr);
++		params->dev_tx_fifo_size[ep->dwc_ep.tx_fifo_num - 1] = fsiz;
++		retval = -DWC_E_INVALID;
++	}
++
++	return retval;
++}
++
++/**
++ * This function sets a new value for the buffer Alignment setup.
++ */
++static int cfi_set_rx_fifo_val(uint8_t * buf, dwc_otg_pcd_t * pcd)
++{
++	int retval;
++	uint32_t fsiz;
++	uint16_t size;
++	dwc_otg_core_params_t *params = GET_CORE_IF(pcd)->core_params;
++	rx_fifo_size_setup_t *prxfifoval;
++
++	prxfifoval = (rx_fifo_size_setup_t *) buf;
++	size = prxfifoval->wDepth;
++
++	fsiz = params->dev_rx_fifo_size;
++	params->dev_rx_fifo_size = size;
++
++	if (resize_fifos(GET_CORE_IF(pcd))) {
++		retval = 0;
++	} else {
++		CFI_INFO("%s: Error setting the feature Rx FIFO Size\n",
++			 __func__);
++		params->dev_rx_fifo_size = fsiz;
++		retval = -DWC_E_INVALID;
++	}
++
++	return retval;
++}
++
++/**
++ * This function reads the SG of an EP's buffer setup into the buffer buf
++ */
++static int cfi_ep_get_sg_val(uint8_t * buf, struct dwc_otg_pcd *pcd,
++			     struct cfi_usb_ctrlrequest *req)
++{
++	int retval = -DWC_E_INVALID;
++	uint8_t addr;
++	cfi_ep_t *ep;
++
++	/* The Low Byte of the wValue contains a non-zero address of the endpoint */
++	addr = req->wValue & 0xFF;
++	if (addr == 0)		/* The address should be non-zero */
++		return retval;
++
++	ep = get_cfi_ep_by_addr(pcd->cfi, addr);
++	if (NULL == ep) {
++		CFI_INFO("%s: Unable to get the endpoint address(0x%02x)\n",
++			 __func__, addr);
++		return retval;
++	}
++
++	dwc_memcpy(buf, ep->bm_sg, BS_SG_VAL_DESC_LEN);
++	retval = BS_SG_VAL_DESC_LEN;
++	return retval;
++}
++
++/**
++ * This function reads the Concatenation value of an EP's buffer mode into
++ * the buffer buf
++ */
++static int cfi_ep_get_concat_val(uint8_t * buf, struct dwc_otg_pcd *pcd,
++				 struct cfi_usb_ctrlrequest *req)
++{
++	int retval = -DWC_E_INVALID;
++	uint8_t addr;
++	cfi_ep_t *ep;
++	uint8_t desc_count;
++
++	/* The Low Byte of the wValue contains a non-zero address of the endpoint */
++	addr = req->wValue & 0xFF;
++	if (addr == 0)		/* The address should be non-zero */
++		return retval;
++
++	ep = get_cfi_ep_by_addr(pcd->cfi, addr);
++	if (NULL == ep) {
++		CFI_INFO("%s: Unable to get the endpoint address(0x%02x)\n",
++			 __func__, addr);
++		return retval;
++	}
++
++	/* Copy the header to the buffer */
++	dwc_memcpy(buf, ep->bm_concat, BS_CONCAT_VAL_HDR_LEN);
++	/* Advance the buffer pointer by the header size */
++	buf += BS_CONCAT_VAL_HDR_LEN;
++
++	desc_count = ep->bm_concat->hdr.bDescCount;
++	/* Copy alll the wTxBytes to the buffer */
++	dwc_memcpy(buf, ep->bm_concat->wTxBytes, sizeof(uid16_t) * desc_count);
++
++	retval = BS_CONCAT_VAL_HDR_LEN + sizeof(uid16_t) * desc_count;
++	return retval;
++}
++
++/**
++ * This function reads the buffer Alignment value of an EP's buffer mode into
++ * the buffer buf
++ *
++ * @return The total number of bytes copied to the buffer or negative error code.
++ */
++static int cfi_ep_get_align_val(uint8_t * buf, struct dwc_otg_pcd *pcd,
++				struct cfi_usb_ctrlrequest *req)
++{
++	int retval = -DWC_E_INVALID;
++	uint8_t addr;
++	cfi_ep_t *ep;
++
++	/* The Low Byte of the wValue contains a non-zero address of the endpoint */
++	addr = req->wValue & 0xFF;
++	if (addr == 0)		/* The address should be non-zero */
++		return retval;
++
++	ep = get_cfi_ep_by_addr(pcd->cfi, addr);
++	if (NULL == ep) {
++		CFI_INFO("%s: Unable to get the endpoint address(0x%02x)\n",
++			 __func__, addr);
++		return retval;
++	}
++
++	dwc_memcpy(buf, ep->bm_align, BS_ALIGN_VAL_HDR_LEN);
++	retval = BS_ALIGN_VAL_HDR_LEN;
++
++	return retval;
++}
++
++/**
++ * This function sets a new value for the specified feature
++ *
++ * @param	pcd	A pointer to the PCD object
++ *
++ * @return 0 if successful, negative error code otherwise to stall the DCE.
++ */
++static int cfi_set_feature_value(struct dwc_otg_pcd *pcd)
++{
++	int retval = -DWC_E_NOT_SUPPORTED;
++	uint16_t wIndex, wValue;
++	uint8_t bRequest;
++	struct dwc_otg_core_if *coreif;
++	cfiobject_t *cfi = pcd->cfi;
++	struct cfi_usb_ctrlrequest *ctrl_req;
++	uint8_t *buf;
++	ctrl_req = &cfi->ctrl_req;
++
++	buf = pcd->cfi->ctrl_req.data;
++
++	coreif = GET_CORE_IF(pcd);
++	bRequest = ctrl_req->bRequest;
++	wIndex = DWC_CONSTANT_CPU_TO_LE16(ctrl_req->wIndex);
++	wValue = DWC_CONSTANT_CPU_TO_LE16(ctrl_req->wValue);
++
++	/* See which feature is to be modified */
++	switch (wIndex) {
++	case FT_ID_DMA_BUFFER_SETUP:
++		/* Modify the feature */
++		if ((retval = cfi_ep_set_sg_val(buf, pcd)) < 0)
++			return retval;
++
++		/* And send this request to the gadget */
++		cfi->need_gadget_att = 1;
++		break;
++
++	case FT_ID_DMA_BUFF_ALIGN:
++		if ((retval = cfi_ep_set_alignment_val(buf, pcd)) < 0)
++			return retval;
++		cfi->need_gadget_att = 1;
++		break;
++
++	case FT_ID_DMA_CONCAT_SETUP:
++		/* Modify the feature */
++		if ((retval = cfi_ep_set_concat_val(buf, pcd)) < 0)
++			return retval;
++		cfi->need_gadget_att = 1;
++		break;
++
++	case FT_ID_DMA_CIRCULAR:
++		CFI_INFO("FT_ID_DMA_CIRCULAR\n");
++		break;
++
++	case FT_ID_THRESHOLD_SETUP:
++		CFI_INFO("FT_ID_THRESHOLD_SETUP\n");
++		break;
++
++	case FT_ID_DFIFO_DEPTH:
++		CFI_INFO("FT_ID_DFIFO_DEPTH\n");
++		break;
++
++	case FT_ID_TX_FIFO_DEPTH:
++		CFI_INFO("FT_ID_TX_FIFO_DEPTH\n");
++		if ((retval = cfi_ep_set_tx_fifo_val(buf, pcd)) < 0)
++			return retval;
++		cfi->need_gadget_att = 0;
++		break;
++
++	case FT_ID_RX_FIFO_DEPTH:
++		CFI_INFO("FT_ID_RX_FIFO_DEPTH\n");
++		if ((retval = cfi_set_rx_fifo_val(buf, pcd)) < 0)
++			return retval;
++		cfi->need_gadget_att = 0;
++		break;
++	}
++
++	return retval;
++}
++
++#endif //DWC_UTE_CFI
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_cfi.h
+@@ -0,0 +1,320 @@
++/* ==========================================================================
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++#if !defined(__DWC_OTG_CFI_H__)
++#define __DWC_OTG_CFI_H__
++
++#include "dwc_otg_pcd.h"
++#include "dwc_cfi_common.h"
++
++/**
++ * @file
++ * This file contains the CFI related OTG PCD specific common constants,
++ * interfaces(functions and macros) and data structures.The CFI Protocol is an
++ * optional interface for internal testing purposes that a DUT may implement to
++ * support testing of configurable features.
++ *
++ */
++
++struct dwc_otg_pcd;
++struct dwc_otg_pcd_ep;
++
++/** OTG CFI Features (properties) ID constants */
++/** This is a request for all Core Features */
++#define FT_ID_DMA_MODE					0x0001
++#define FT_ID_DMA_BUFFER_SETUP			0x0002
++#define FT_ID_DMA_BUFF_ALIGN			0x0003
++#define FT_ID_DMA_CONCAT_SETUP			0x0004
++#define FT_ID_DMA_CIRCULAR				0x0005
++#define FT_ID_THRESHOLD_SETUP			0x0006
++#define FT_ID_DFIFO_DEPTH				0x0007
++#define FT_ID_TX_FIFO_DEPTH				0x0008
++#define FT_ID_RX_FIFO_DEPTH				0x0009
++
++/**********************************************************/
++#define CFI_INFO_DEF
++
++#ifdef CFI_INFO_DEF
++#define CFI_INFO(fmt...)	DWC_PRINTF("CFI: " fmt);
++#else
++#define CFI_INFO(fmt...)
++#endif
++
++#define min(x,y) ({ \
++	x < y ? x : y; })
++
++#define max(x,y) ({ \
++	x > y ? x : y; })
++
++/**
++ * Descriptor DMA SG Buffer setup structure (SG buffer). This structure is
++ * also used for setting up a buffer for Circular DDMA.
++ */
++struct _ddma_sg_buffer_setup {
++#define BS_SG_VAL_DESC_LEN	6
++	/* The OUT EP address */
++	uint8_t bOutEndpointAddress;
++	/* The IN EP address */
++	uint8_t bInEndpointAddress;
++	/* Number of bytes to put between transfer segments (must be DWORD boundaries) */
++	uint8_t bOffset;
++	/* The number of transfer segments (a DMA descriptors per each segment) */
++	uint8_t bCount;
++	/* Size (in byte) of each transfer segment */
++	uint16_t wSize;
++} __attribute__ ((packed));
++typedef struct _ddma_sg_buffer_setup ddma_sg_buffer_setup_t;
++
++/** Descriptor DMA Concatenation Buffer setup structure */
++struct _ddma_concat_buffer_setup_hdr {
++#define BS_CONCAT_VAL_HDR_LEN	4
++	/* The endpoint for which the buffer is to be set up */
++	uint8_t bEndpointAddress;
++	/* The count of descriptors to be used */
++	uint8_t bDescCount;
++	/* The total size of the transfer */
++	uint16_t wSize;
++} __attribute__ ((packed));
++typedef struct _ddma_concat_buffer_setup_hdr ddma_concat_buffer_setup_hdr_t;
++
++/** Descriptor DMA Concatenation Buffer setup structure */
++struct _ddma_concat_buffer_setup {
++	/* The SG header */
++	ddma_concat_buffer_setup_hdr_t hdr;
++
++	/* The XFER sizes pointer (allocated dynamically) */
++	uint16_t *wTxBytes;
++} __attribute__ ((packed));
++typedef struct _ddma_concat_buffer_setup ddma_concat_buffer_setup_t;
++
++/** Descriptor DMA Alignment Buffer setup structure */
++struct _ddma_align_buffer_setup {
++#define BS_ALIGN_VAL_HDR_LEN	2
++	uint8_t bEndpointAddress;
++	uint8_t bAlign;
++} __attribute__ ((packed));
++typedef struct _ddma_align_buffer_setup ddma_align_buffer_setup_t;
++
++/** Transmit FIFO Size setup structure */
++struct _tx_fifo_size_setup {
++	uint8_t bEndpointAddress;
++	uint16_t wDepth;
++} __attribute__ ((packed));
++typedef struct _tx_fifo_size_setup tx_fifo_size_setup_t;
++
++/** Transmit FIFO Size setup structure */
++struct _rx_fifo_size_setup {
++	uint16_t wDepth;
++} __attribute__ ((packed));
++typedef struct _rx_fifo_size_setup rx_fifo_size_setup_t;
++
++/**
++ * struct cfi_usb_ctrlrequest - the CFI implementation of the struct usb_ctrlrequest
++ * This structure encapsulates the standard usb_ctrlrequest and adds a pointer
++ * to the data returned in the data stage of a 3-stage Control Write requests.
++ */
++struct cfi_usb_ctrlrequest {
++	uint8_t bRequestType;
++	uint8_t bRequest;
++	uint16_t wValue;
++	uint16_t wIndex;
++	uint16_t wLength;
++	uint8_t *data;
++} UPACKED;
++
++/*---------------------------------------------------------------------------*/
++
++/**
++ * The CFI wrapper of the enabled and activated dwc_otg_pcd_ep structures.
++ * This structure is used to store the buffer setup data for any
++ * enabled endpoint in the PCD.
++ */
++struct cfi_ep {
++	/* Entry for the list container */
++	dwc_list_link_t lh;
++	/* Pointer to the active PCD endpoint structure */
++	struct dwc_otg_pcd_ep *ep;
++	/* The last descriptor in the chain of DMA descriptors of the endpoint */
++	struct dwc_otg_dma_desc *dma_desc_last;
++	/* The SG feature value */
++	ddma_sg_buffer_setup_t *bm_sg;
++	/* The Circular feature value */
++	ddma_sg_buffer_setup_t *bm_circ;
++	/* The Concatenation feature value */
++	ddma_concat_buffer_setup_t *bm_concat;
++	/* The Alignment feature value */
++	ddma_align_buffer_setup_t *bm_align;
++	/* XFER length */
++	uint32_t xfer_len;
++	/*
++	 * Count of DMA descriptors currently used.
++	 * The total should not exceed the MAX_DMA_DESCS_PER_EP value
++	 * defined in the dwc_otg_cil.h
++	 */
++	uint32_t desc_count;
++};
++typedef struct cfi_ep cfi_ep_t;
++
++typedef struct cfi_dma_buff {
++#define CFI_IN_BUF_LEN	1024
++#define CFI_OUT_BUF_LEN	1024
++	dma_addr_t addr;
++	uint8_t *buf;
++} cfi_dma_buff_t;
++
++struct cfiobject;
++
++/**
++ * This is the interface for the CFI operations.
++ *
++ * @param	ep_enable			Called when any endpoint is enabled and activated.
++ * @param	release				Called when the CFI object is released and it needs to correctly
++ *								deallocate the dynamic memory
++ * @param	ctrl_write_complete	Called when the data stage of the request is complete
++ */
++typedef struct cfi_ops {
++	int (*ep_enable) (struct cfiobject * cfi, struct dwc_otg_pcd * pcd,
++			  struct dwc_otg_pcd_ep * ep);
++	void *(*ep_alloc_buf) (struct cfiobject * cfi, struct dwc_otg_pcd * pcd,
++			       struct dwc_otg_pcd_ep * ep, dma_addr_t * dma,
++			       unsigned size, gfp_t flags);
++	void (*release) (struct cfiobject * cfi);
++	int (*ctrl_write_complete) (struct cfiobject * cfi,
++				    struct dwc_otg_pcd * pcd);
++	void (*build_descriptors) (struct cfiobject * cfi,
++				   struct dwc_otg_pcd * pcd,
++				   struct dwc_otg_pcd_ep * ep,
++				   dwc_otg_pcd_request_t * req);
++} cfi_ops_t;
++
++struct cfiobject {
++	cfi_ops_t ops;
++	struct dwc_otg_pcd *pcd;
++	struct usb_gadget *gadget;
++
++	/* Buffers used to send/receive CFI-related request data */
++	cfi_dma_buff_t buf_in;
++	cfi_dma_buff_t buf_out;
++
++	/* CFI specific Control request wrapper */
++	struct cfi_usb_ctrlrequest ctrl_req;
++
++	/* The list of active EP's in the PCD of type cfi_ep_t */
++	dwc_list_link_t active_eps;
++
++	/* This flag shall control the propagation of a specific request
++	 * to the gadget's processing routines.
++	 * 0 - no gadget handling
++	 * 1 - the gadget needs to know about this request (w/o completing a status
++	 * phase - just return a 0 to the _setup callback)
++	 */
++	uint8_t need_gadget_att;
++
++	/* Flag indicating whether the status IN phase needs to be
++	 * completed by the PCD
++	 */
++	uint8_t need_status_in_complete;
++};
++typedef struct cfiobject cfiobject_t;
++
++#define DUMP_MSG
++
++#if defined(DUMP_MSG)
++static inline void dump_msg(const u8 * buf, unsigned int length)
++{
++	unsigned int start, num, i;
++	char line[52], *p;
++
++	if (length >= 512)
++		return;
++
++	start = 0;
++	while (length > 0) {
++		num = min(length, 16u);
++		p = line;
++		for (i = 0; i < num; ++i) {
++			if (i == 8)
++				*p++ = ' ';
++			DWC_SPRINTF(p, " %02x", buf[i]);
++			p += 3;
++		}
++		*p = 0;
++		DWC_DEBUG("%6x: %s\n", start, line);
++		buf += num;
++		start += num;
++		length -= num;
++	}
++}
++#else
++static inline void dump_msg(const u8 * buf, unsigned int length)
++{
++}
++#endif
++
++/**
++ * This function returns a pointer to cfi_ep_t object with the addr address.
++ */
++static inline struct cfi_ep *get_cfi_ep_by_addr(struct cfiobject *cfi,
++						uint8_t addr)
++{
++	struct cfi_ep *pcfiep;
++	dwc_list_link_t *tmp;
++
++	DWC_LIST_FOREACH(tmp, &cfi->active_eps) {
++		pcfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
++
++		if (pcfiep->ep->desc->bEndpointAddress == addr) {
++			return pcfiep;
++		}
++	}
++
++	return NULL;
++}
++
++/**
++ * This function returns a pointer to cfi_ep_t object that matches
++ * the dwc_otg_pcd_ep object.
++ */
++static inline struct cfi_ep *get_cfi_ep_by_pcd_ep(struct cfiobject *cfi,
++						  struct dwc_otg_pcd_ep *ep)
++{
++	struct cfi_ep *pcfiep = NULL;
++	dwc_list_link_t *tmp;
++
++	DWC_LIST_FOREACH(tmp, &cfi->active_eps) {
++		pcfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
++		if (pcfiep->ep == ep) {
++			return pcfiep;
++		}
++	}
++	return NULL;
++}
++
++int cfi_setup(struct dwc_otg_pcd *pcd, struct cfi_usb_ctrlrequest *ctrl);
++
++#endif /* (__DWC_OTG_CFI_H__) */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_cil.c
+@@ -0,0 +1,7121 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_cil.c $
++ * $Revision: #191 $
++ * $Date: 2012/08/10 $
++ * $Change: 2047372 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++/** @file
++ *
++ * The Core Interface Layer provides basic services for accessing and
++ * managing the DWC_otg hardware. These services are used by both the
++ * Host Controller Driver and the Peripheral Controller Driver.
++ *
++ * The CIL manages the memory map for the core so that the HCD and PCD
++ * don't have to do this separately. It also handles basic tasks like
++ * reading/writing the registers and data FIFOs in the controller.
++ * Some of the data access functions provide encapsulation of several
++ * operations required to perform a task, such as writing multiple
++ * registers to start a transfer. Finally, the CIL performs basic
++ * services that are not specific to either the host or device modes
++ * of operation. These services include management of the OTG Host
++ * Negotiation Protocol (HNP) and Session Request Protocol (SRP). A
++ * Diagnostic API is also provided to allow testing of the controller
++ * hardware.
++ *
++ * The Core Interface Layer has the following requirements:
++ * - Provides basic controller operations.
++ * - Minimal use of OS services.
++ * - The OS services used will be abstracted by using inline functions
++ *	 or macros.
++ *
++ */
++
++#include "dwc_os.h"
++#include "dwc_otg_regs.h"
++#include "dwc_otg_cil.h"
++#include "dwc_otg_os_dep.h"
++#include "dwc_otg_hcd_if.h"
++
++extern bool cil_force_host;
++
++static int dwc_otg_setup_params(dwc_otg_core_if_t * core_if);
++
++/**
++ * This function is called to initialize the DWC_otg CSR data
++ * structures. The register addresses in the device and host
++ * structures are initialized from the base address supplied by the
++ * caller. The calling function must make the OS calls to get the
++ * base address of the DWC_otg controller registers. The core_params
++ * argument holds the parameters that specify how the core should be
++ * configured.
++ *
++ * @param reg_base_addr Base address of DWC_otg core registers
++ *
++ */
++dwc_otg_core_if_t *dwc_otg_cil_init(const uint32_t * reg_base_addr)
++{
++	dwc_otg_core_if_t *core_if = 0;
++	dwc_otg_dev_if_t *dev_if = 0;
++	dwc_otg_host_if_t *host_if = 0;
++	uint8_t *reg_base = (uint8_t *) reg_base_addr;
++	int i = 0;
++
++	DWC_DEBUGPL(DBG_CILV, "%s(%p)\n", __func__, reg_base_addr);
++
++	core_if = DWC_ALLOC(sizeof(dwc_otg_core_if_t));
++
++	if (core_if == NULL) {
++		DWC_DEBUGPL(DBG_CIL,
++			    "Allocation of dwc_otg_core_if_t failed\n");
++		return 0;
++	}
++	core_if->core_global_regs = (dwc_otg_core_global_regs_t *) reg_base;
++
++	/*
++	 * Allocate the Device Mode structures.
++	 */
++	dev_if = DWC_ALLOC(sizeof(dwc_otg_dev_if_t));
++
++	if (dev_if == NULL) {
++		DWC_DEBUGPL(DBG_CIL, "Allocation of dwc_otg_dev_if_t failed\n");
++		DWC_FREE(core_if);
++		return 0;
++	}
++
++	dev_if->dev_global_regs =
++	    (dwc_otg_device_global_regs_t *) (reg_base +
++					      DWC_DEV_GLOBAL_REG_OFFSET);
++
++	for (i = 0; i < MAX_EPS_CHANNELS; i++) {
++		dev_if->in_ep_regs[i] = (dwc_otg_dev_in_ep_regs_t *)
++		    (reg_base + DWC_DEV_IN_EP_REG_OFFSET +
++		     (i * DWC_EP_REG_OFFSET));
++
++		dev_if->out_ep_regs[i] = (dwc_otg_dev_out_ep_regs_t *)
++		    (reg_base + DWC_DEV_OUT_EP_REG_OFFSET +
++		     (i * DWC_EP_REG_OFFSET));
++		DWC_DEBUGPL(DBG_CILV, "in_ep_regs[%d]->diepctl=%p\n",
++			    i, &dev_if->in_ep_regs[i]->diepctl);
++		DWC_DEBUGPL(DBG_CILV, "out_ep_regs[%d]->doepctl=%p\n",
++			    i, &dev_if->out_ep_regs[i]->doepctl);
++	}
++
++	dev_if->speed = 0;	// unknown
++
++	core_if->dev_if = dev_if;
++
++	/*
++	 * Allocate the Host Mode structures.
++	 */
++	host_if = DWC_ALLOC(sizeof(dwc_otg_host_if_t));
++
++	if (host_if == NULL) {
++		DWC_DEBUGPL(DBG_CIL,
++			    "Allocation of dwc_otg_host_if_t failed\n");
++		DWC_FREE(dev_if);
++		DWC_FREE(core_if);
++		return 0;
++	}
++
++	host_if->host_global_regs = (dwc_otg_host_global_regs_t *)
++	    (reg_base + DWC_OTG_HOST_GLOBAL_REG_OFFSET);
++
++	host_if->hprt0 =
++	    (uint32_t *) (reg_base + DWC_OTG_HOST_PORT_REGS_OFFSET);
++
++	for (i = 0; i < MAX_EPS_CHANNELS; i++) {
++		host_if->hc_regs[i] = (dwc_otg_hc_regs_t *)
++		    (reg_base + DWC_OTG_HOST_CHAN_REGS_OFFSET +
++		     (i * DWC_OTG_CHAN_REGS_OFFSET));
++		DWC_DEBUGPL(DBG_CILV, "hc_reg[%d]->hcchar=%p\n",
++			    i, &host_if->hc_regs[i]->hcchar);
++	}
++
++	host_if->num_host_channels = MAX_EPS_CHANNELS;
++	core_if->host_if = host_if;
++
++	for (i = 0; i < MAX_EPS_CHANNELS; i++) {
++		core_if->data_fifo[i] =
++		    (uint32_t *) (reg_base + DWC_OTG_DATA_FIFO_OFFSET +
++				  (i * DWC_OTG_DATA_FIFO_SIZE));
++		DWC_DEBUGPL(DBG_CILV, "data_fifo[%d]=0x%08lx\n",
++			    i, (unsigned long)core_if->data_fifo[i]);
++	}
++
++	core_if->pcgcctl = (uint32_t *) (reg_base + DWC_OTG_PCGCCTL_OFFSET);
++
++	/* Initiate lx_state to L3 disconnected state */
++	core_if->lx_state = DWC_OTG_L3;
++	/*
++	 * Store the contents of the hardware configuration registers here for
++	 * easy access later.
++	 */
++	core_if->hwcfg1.d32 =
++	    DWC_READ_REG32(&core_if->core_global_regs->ghwcfg1);
++	core_if->hwcfg2.d32 =
++	    DWC_READ_REG32(&core_if->core_global_regs->ghwcfg2);
++	core_if->hwcfg3.d32 =
++	    DWC_READ_REG32(&core_if->core_global_regs->ghwcfg3);
++	core_if->hwcfg4.d32 =
++	    DWC_READ_REG32(&core_if->core_global_regs->ghwcfg4);
++
++	/* Force host mode to get HPTXFSIZ exact power on value */
++	{
++		gusbcfg_data_t gusbcfg = {.d32 = 0 };
++		gusbcfg.d32 =  DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
++		gusbcfg.b.force_host_mode = 1;
++		DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, gusbcfg.d32);
++		dwc_mdelay(100);
++		core_if->hptxfsiz.d32 =
++		DWC_READ_REG32(&core_if->core_global_regs->hptxfsiz);
++		gusbcfg.d32 =  DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
++		if (cil_force_host)
++			gusbcfg.b.force_host_mode = 1;
++		else
++			gusbcfg.b.force_host_mode = 0;
++		DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, gusbcfg.d32);
++		dwc_mdelay(100);
++	}
++
++	DWC_DEBUGPL(DBG_CILV, "hwcfg1=%08x\n", core_if->hwcfg1.d32);
++	DWC_DEBUGPL(DBG_CILV, "hwcfg2=%08x\n", core_if->hwcfg2.d32);
++	DWC_DEBUGPL(DBG_CILV, "hwcfg3=%08x\n", core_if->hwcfg3.d32);
++	DWC_DEBUGPL(DBG_CILV, "hwcfg4=%08x\n", core_if->hwcfg4.d32);
++
++	core_if->hcfg.d32 =
++	    DWC_READ_REG32(&core_if->host_if->host_global_regs->hcfg);
++	core_if->dcfg.d32 =
++	    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
++
++	DWC_DEBUGPL(DBG_CILV, "hcfg=%08x\n", core_if->hcfg.d32);
++	DWC_DEBUGPL(DBG_CILV, "dcfg=%08x\n", core_if->dcfg.d32);
++
++	DWC_DEBUGPL(DBG_CILV, "op_mode=%0x\n", core_if->hwcfg2.b.op_mode);
++	DWC_DEBUGPL(DBG_CILV, "arch=%0x\n", core_if->hwcfg2.b.architecture);
++	DWC_DEBUGPL(DBG_CILV, "num_dev_ep=%d\n", core_if->hwcfg2.b.num_dev_ep);
++	DWC_DEBUGPL(DBG_CILV, "num_host_chan=%d\n",
++		    core_if->hwcfg2.b.num_host_chan);
++	DWC_DEBUGPL(DBG_CILV, "nonperio_tx_q_depth=0x%0x\n",
++		    core_if->hwcfg2.b.nonperio_tx_q_depth);
++	DWC_DEBUGPL(DBG_CILV, "host_perio_tx_q_depth=0x%0x\n",
++		    core_if->hwcfg2.b.host_perio_tx_q_depth);
++	DWC_DEBUGPL(DBG_CILV, "dev_token_q_depth=0x%0x\n",
++		    core_if->hwcfg2.b.dev_token_q_depth);
++
++	DWC_DEBUGPL(DBG_CILV, "Total FIFO SZ=%d\n",
++		    core_if->hwcfg3.b.dfifo_depth);
++	DWC_DEBUGPL(DBG_CILV, "xfer_size_cntr_width=%0x\n",
++		    core_if->hwcfg3.b.xfer_size_cntr_width);
++
++	/*
++	 * Set the SRP sucess bit for FS-I2c
++	 */
++	core_if->srp_success = 0;
++	core_if->srp_timer_started = 0;
++
++	/*
++	 * Create new workqueue and init works
++	 */
++	core_if->wq_otg = DWC_WORKQ_ALLOC("dwc_otg");
++	if (core_if->wq_otg == 0) {
++		DWC_WARN("DWC_WORKQ_ALLOC failed\n");
++		DWC_FREE(host_if);
++		DWC_FREE(dev_if);
++		DWC_FREE(core_if);
++		return 0;
++	}
++
++	core_if->snpsid = DWC_READ_REG32(&core_if->core_global_regs->gsnpsid);
++
++	DWC_PRINTF("Core Release: %x.%x%x%x\n",
++		   (core_if->snpsid >> 12 & 0xF),
++		   (core_if->snpsid >> 8 & 0xF),
++		   (core_if->snpsid >> 4 & 0xF), (core_if->snpsid & 0xF));
++
++	core_if->wkp_timer = DWC_TIMER_ALLOC("Wake Up Timer",
++					     w_wakeup_detected, core_if);
++	if (core_if->wkp_timer == 0) {
++		DWC_WARN("DWC_TIMER_ALLOC failed\n");
++		DWC_FREE(host_if);
++		DWC_FREE(dev_if);
++		DWC_WORKQ_FREE(core_if->wq_otg);
++		DWC_FREE(core_if);
++		return 0;
++	}
++
++	if (dwc_otg_setup_params(core_if)) {
++		DWC_WARN("Error while setting core params\n");
++	}
++
++	core_if->hibernation_suspend = 0;
++
++	/** ADP initialization */
++	dwc_otg_adp_init(core_if);
++
++	return core_if;
++}
++
++/**
++ * This function frees the structures allocated by dwc_otg_cil_init().
++ *
++ * @param core_if The core interface pointer returned from
++ * 		  dwc_otg_cil_init().
++ *
++ */
++void dwc_otg_cil_remove(dwc_otg_core_if_t * core_if)
++{
++	dctl_data_t dctl = {.d32 = 0 };
++	DWC_DEBUGPL(DBG_CILV, "%s(%p)\n", __func__, core_if);
++
++	/* Disable all interrupts */
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gahbcfg, 1, 0);
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, 0);
++
++	dctl.b.sftdiscon = 1;
++	if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0,
++				 dctl.d32);
++	}
++
++	if (core_if->wq_otg) {
++		DWC_WORKQ_WAIT_WORK_DONE(core_if->wq_otg, 500);
++		DWC_WORKQ_FREE(core_if->wq_otg);
++	}
++	if (core_if->dev_if) {
++		DWC_FREE(core_if->dev_if);
++	}
++	if (core_if->host_if) {
++		DWC_FREE(core_if->host_if);
++	}
++
++	/** Remove ADP Stuff  */
++	dwc_otg_adp_remove(core_if);
++	if (core_if->core_params) {
++		DWC_FREE(core_if->core_params);
++	}
++	if (core_if->wkp_timer) {
++		DWC_TIMER_FREE(core_if->wkp_timer);
++	}
++	if (core_if->srp_timer) {
++		DWC_TIMER_FREE(core_if->srp_timer);
++	}
++	DWC_FREE(core_if);
++}
++
++/**
++ * This function enables the controller's Global Interrupt in the AHB Config
++ * register.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++void dwc_otg_enable_global_interrupts(dwc_otg_core_if_t * core_if)
++{
++	gahbcfg_data_t ahbcfg = {.d32 = 0 };
++	ahbcfg.b.glblintrmsk = 1;	/* Enable interrupts */
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gahbcfg, 0, ahbcfg.d32);
++}
++
++/**
++ * This function disables the controller's Global Interrupt in the AHB Config
++ * register.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++void dwc_otg_disable_global_interrupts(dwc_otg_core_if_t * core_if)
++{
++	gahbcfg_data_t ahbcfg = {.d32 = 0 };
++	ahbcfg.b.glblintrmsk = 1;	/* Disable interrupts */
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gahbcfg, ahbcfg.d32, 0);
++}
++
++/**
++ * This function initializes the commmon interrupts, used in both
++ * device and host modes.
++ *
++ * @param core_if Programming view of the DWC_otg controller
++ *
++ */
++static void dwc_otg_enable_common_interrupts(dwc_otg_core_if_t * core_if)
++{
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++
++	/* Clear any pending OTG Interrupts */
++	DWC_WRITE_REG32(&global_regs->gotgint, 0xFFFFFFFF);
++
++	/* Clear any pending interrupts */
++	DWC_WRITE_REG32(&global_regs->gintsts, 0xFFFFFFFF);
++
++	/*
++	 * Enable the interrupts in the GINTMSK.
++	 */
++	intr_mask.b.modemismatch = 1;
++	intr_mask.b.otgintr = 1;
++
++	if (!core_if->dma_enable) {
++		intr_mask.b.rxstsqlvl = 1;
++	}
++
++	intr_mask.b.conidstschng = 1;
++	intr_mask.b.wkupintr = 1;
++	intr_mask.b.disconnect = 0;
++	intr_mask.b.usbsuspend = 1;
++	intr_mask.b.sessreqintr = 1;
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	if (core_if->core_params->lpm_enable) {
++		intr_mask.b.lpmtranrcvd = 1;
++	}
++#endif
++	DWC_WRITE_REG32(&global_regs->gintmsk, intr_mask.d32);
++}
++
++/*
++ * The restore operation is modified to support Synopsys Emulated Powerdown and
++ * Hibernation. This function is for exiting from Device mode hibernation by
++ * Host Initiated Resume/Reset and Device Initiated Remote-Wakeup.
++ * @param core_if Programming view of DWC_otg controller.
++ * @param rem_wakeup - indicates whether resume is initiated by Device or Host.
++ * @param reset - indicates whether resume is initiated by Reset.
++ */
++int dwc_otg_device_hibernation_restore(dwc_otg_core_if_t * core_if,
++				       int rem_wakeup, int reset)
++{
++	gpwrdn_data_t gpwrdn = {.d32 = 0 };
++	pcgcctl_data_t pcgcctl = {.d32 = 0 };
++	dctl_data_t dctl = {.d32 = 0 };
++
++	int timeout = 2000;
++
++	if (!core_if->hibernation_suspend) {
++		DWC_PRINTF("Already exited from Hibernation\n");
++		return 1;
++	}
++
++	DWC_DEBUGPL(DBG_PCD, "%s called\n", __FUNCTION__);
++	/* Switch-on voltage to the core */
++	gpwrdn.b.pwrdnswtch = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Reset core */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnrstn = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Assert Restore signal */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.restore = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++	dwc_udelay(10);
++
++	/* Disable power clamps */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnclmp = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	if (rem_wakeup) {
++		dwc_udelay(70);
++	}
++
++	/* Deassert Reset core */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnrstn = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++	dwc_udelay(10);
++
++	/* Disable PMU interrupt */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pmuintsel = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	/* Mask interrupts from gpwrdn */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.connect_det_msk = 1;
++	gpwrdn.b.srp_det_msk = 1;
++	gpwrdn.b.disconn_det_msk = 1;
++	gpwrdn.b.rst_det_msk = 1;
++	gpwrdn.b.lnstchng_msk = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	/* Indicates that we are going out from hibernation */
++	core_if->hibernation_suspend = 0;
++
++	/*
++	 * Set Restore Essential Regs bit in PCGCCTL register, restore_mode = 1
++	 * indicates restore from remote_wakeup
++	 */
++	restore_essential_regs(core_if, rem_wakeup, 0);
++
++	/*
++	 * Wait a little for seeing new value of variable hibernation_suspend if
++	 * Restore done interrupt received before polling
++	 */
++	dwc_udelay(10);
++
++	if (core_if->hibernation_suspend == 0) {
++		/*
++		 * Wait For Restore_done Interrupt. This mechanism of polling the
++		 * interrupt is introduced to avoid any possible race conditions
++		 */
++		do {
++			gintsts_data_t gintsts;
++			gintsts.d32 =
++			    DWC_READ_REG32(&core_if->core_global_regs->gintsts);
++			if (gintsts.b.restoredone) {
++				gintsts.d32 = 0;
++				gintsts.b.restoredone = 1;
++				DWC_WRITE_REG32(&core_if->core_global_regs->
++						gintsts, gintsts.d32);
++				DWC_PRINTF("Restore Done Interrupt seen\n");
++				break;
++			}
++			dwc_udelay(10);
++		} while (--timeout);
++		if (!timeout) {
++			DWC_PRINTF("Restore Done interrupt wasn't generated here\n");
++		}
++	}
++	/* Clear all pending interupts */
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
++
++	/* De-assert Restore */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.restore = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	if (!rem_wakeup) {
++		pcgcctl.d32 = 0;
++		pcgcctl.b.rstpdwnmodule = 1;
++		DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
++	}
++
++	/* Restore GUSBCFG and DCFG */
++	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg,
++			core_if->gr_backup->gusbcfg_local);
++	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg,
++			core_if->dr_backup->dcfg);
++
++	/* De-assert Wakeup Logic */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pmuactv = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	if (!rem_wakeup) {
++		/* Set Device programming done bit */
++		dctl.b.pwronprgdone = 1;
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0, dctl.d32);
++	} else {
++		/* Start Remote Wakeup Signaling */
++		dctl.d32 = core_if->dr_backup->dctl;
++		dctl.b.rmtwkupsig = 1;
++		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32);
++	}
++
++	dwc_mdelay(2);
++	/* Clear all pending interupts */
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
++
++	/* Restore global registers */
++	dwc_otg_restore_global_regs(core_if);
++	/* Restore device global registers */
++	dwc_otg_restore_dev_regs(core_if, rem_wakeup);
++
++	if (rem_wakeup) {
++		dwc_mdelay(7);
++		dctl.d32 = 0;
++		dctl.b.rmtwkupsig = 1;
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32, 0);
++	}
++
++	core_if->hibernation_suspend = 0;
++	/* The core will be in ON STATE */
++	core_if->lx_state = DWC_OTG_L0;
++	DWC_PRINTF("Hibernation recovery completes here\n");
++
++	return 1;
++}
++
++/*
++ * The restore operation is modified to support Synopsys Emulated Powerdown and
++ * Hibernation. This function is for exiting from Host mode hibernation by
++ * Host Initiated Resume/Reset and Device Initiated Remote-Wakeup.
++ * @param core_if Programming view of DWC_otg controller.
++ * @param rem_wakeup - indicates whether resume is initiated by Device or Host.
++ * @param reset - indicates whether resume is initiated by Reset.
++ */
++int dwc_otg_host_hibernation_restore(dwc_otg_core_if_t * core_if,
++				     int rem_wakeup, int reset)
++{
++	gpwrdn_data_t gpwrdn = {.d32 = 0 };
++	hprt0_data_t hprt0 = {.d32 = 0 };
++
++	int timeout = 2000;
++
++	DWC_DEBUGPL(DBG_HCD, "%s called\n", __FUNCTION__);
++	/* Switch-on voltage to the core */
++	gpwrdn.b.pwrdnswtch = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Reset core */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnrstn = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Assert Restore signal */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.restore = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++	dwc_udelay(10);
++
++	/* Disable power clamps */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnclmp = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	if (!rem_wakeup) {
++		dwc_udelay(50);
++	}
++
++	/* Deassert Reset core */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnrstn = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++	dwc_udelay(10);
++
++	/* Disable PMU interrupt */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pmuintsel = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	gpwrdn.d32 = 0;
++	gpwrdn.b.connect_det_msk = 1;
++	gpwrdn.b.srp_det_msk = 1;
++	gpwrdn.b.disconn_det_msk = 1;
++	gpwrdn.b.rst_det_msk = 1;
++	gpwrdn.b.lnstchng_msk = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	/* Indicates that we are going out from hibernation */
++	core_if->hibernation_suspend = 0;
++
++	/* Set Restore Essential Regs bit in PCGCCTL register */
++	restore_essential_regs(core_if, rem_wakeup, 1);
++
++	/* Wait a little for seeing new value of variable hibernation_suspend if
++	 * Restore done interrupt received before polling */
++	dwc_udelay(10);
++
++	if (core_if->hibernation_suspend == 0) {
++		/* Wait For Restore_done Interrupt. This mechanism of polling the
++		 * interrupt is introduced to avoid any possible race conditions
++		 */
++		do {
++			gintsts_data_t gintsts;
++			gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
++			if (gintsts.b.restoredone) {
++				gintsts.d32 = 0;
++				gintsts.b.restoredone = 1;
++			DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++				DWC_DEBUGPL(DBG_HCD,"Restore Done Interrupt seen\n");
++				break;
++			}
++			dwc_udelay(10);
++		} while (--timeout);
++		if (!timeout) {
++			DWC_WARN("Restore Done interrupt wasn't generated\n");
++		}
++	}
++
++	/* Set the flag's value to 0 again after receiving restore done interrupt */
++	core_if->hibernation_suspend = 0;
++
++	/* This step is not described in functional spec but if not wait for this
++	 * delay, mismatch interrupts occurred because just after restore core is
++	 * in Device mode(gintsts.curmode == 0) */
++	dwc_mdelay(100);
++
++	/* Clear all pending interrupts */
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
++
++	/* De-assert Restore */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.restore = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Restore GUSBCFG and HCFG */
++	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg,
++			core_if->gr_backup->gusbcfg_local);
++	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hcfg,
++			core_if->hr_backup->hcfg_local);
++
++	/* De-assert Wakeup Logic */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pmuactv = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Start the Resume operation by programming HPRT0 */
++	hprt0.d32 = core_if->hr_backup->hprt0_local;
++	hprt0.b.prtpwr = 1;
++	hprt0.b.prtena = 0;
++	hprt0.b.prtsusp = 0;
++	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++
++	DWC_PRINTF("Resume Starts Now\n");
++	if (!reset) {		// Indicates it is Resume Operation
++		hprt0.d32 = core_if->hr_backup->hprt0_local;
++		hprt0.b.prtres = 1;
++		hprt0.b.prtpwr = 1;
++		hprt0.b.prtena = 0;
++		hprt0.b.prtsusp = 0;
++		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++
++		if (!rem_wakeup)
++			hprt0.b.prtres = 0;
++		/* Wait for Resume time and then program HPRT again */
++		dwc_mdelay(100);
++		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++
++	} else {		// Indicates it is Reset Operation
++		hprt0.d32 = core_if->hr_backup->hprt0_local;
++		hprt0.b.prtrst = 1;
++		hprt0.b.prtpwr = 1;
++		hprt0.b.prtena = 0;
++		hprt0.b.prtsusp = 0;
++		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++		/* Wait for Reset time and then program HPRT again */
++		dwc_mdelay(60);
++		hprt0.b.prtrst = 0;
++		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++	}
++	/* Clear all interrupt status */
++	hprt0.d32 = dwc_otg_read_hprt0(core_if);
++	hprt0.b.prtconndet = 1;
++	hprt0.b.prtenchng = 1;
++	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++
++	/* Clear all pending interupts */
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
++
++	/* Restore global registers */
++	dwc_otg_restore_global_regs(core_if);
++	/* Restore host global registers */
++	dwc_otg_restore_host_regs(core_if, reset);
++
++	/* The core will be in ON STATE */
++	core_if->lx_state = DWC_OTG_L0;
++	DWC_PRINTF("Hibernation recovery is complete here\n");
++	return 0;
++}
++
++/** Saves some register values into system memory. */
++int dwc_otg_save_global_regs(dwc_otg_core_if_t * core_if)
++{
++	struct dwc_otg_global_regs_backup *gr;
++	int i;
++
++	gr = core_if->gr_backup;
++	if (!gr) {
++		gr = DWC_ALLOC(sizeof(*gr));
++		if (!gr) {
++			return -DWC_E_NO_MEMORY;
++		}
++		core_if->gr_backup = gr;
++	}
++
++	gr->gotgctl_local = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
++	gr->gintmsk_local = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
++	gr->gahbcfg_local = DWC_READ_REG32(&core_if->core_global_regs->gahbcfg);
++	gr->gusbcfg_local = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
++	gr->grxfsiz_local = DWC_READ_REG32(&core_if->core_global_regs->grxfsiz);
++	gr->gnptxfsiz_local = DWC_READ_REG32(&core_if->core_global_regs->gnptxfsiz);
++	gr->hptxfsiz_local = DWC_READ_REG32(&core_if->core_global_regs->hptxfsiz);
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	gr->glpmcfg_local = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++#endif
++	gr->gi2cctl_local = DWC_READ_REG32(&core_if->core_global_regs->gi2cctl);
++	gr->pcgcctl_local = DWC_READ_REG32(core_if->pcgcctl);
++	gr->gdfifocfg_local =
++	    DWC_READ_REG32(&core_if->core_global_regs->gdfifocfg);
++	for (i = 0; i < MAX_EPS_CHANNELS; i++) {
++		gr->dtxfsiz_local[i] =
++		    DWC_READ_REG32(&(core_if->core_global_regs->dtxfsiz[i]));
++	}
++
++	DWC_DEBUGPL(DBG_ANY, "===========Backing Global registers==========\n");
++	DWC_DEBUGPL(DBG_ANY, "Backed up gotgctl   = %08x\n", gr->gotgctl_local);
++	DWC_DEBUGPL(DBG_ANY, "Backed up gintmsk   = %08x\n", gr->gintmsk_local);
++	DWC_DEBUGPL(DBG_ANY, "Backed up gahbcfg   = %08x\n", gr->gahbcfg_local);
++	DWC_DEBUGPL(DBG_ANY, "Backed up gusbcfg   = %08x\n", gr->gusbcfg_local);
++	DWC_DEBUGPL(DBG_ANY, "Backed up grxfsiz   = %08x\n", gr->grxfsiz_local);
++	DWC_DEBUGPL(DBG_ANY, "Backed up gnptxfsiz = %08x\n",
++		    gr->gnptxfsiz_local);
++	DWC_DEBUGPL(DBG_ANY, "Backed up hptxfsiz  = %08x\n",
++		    gr->hptxfsiz_local);
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	DWC_DEBUGPL(DBG_ANY, "Backed up glpmcfg   = %08x\n", gr->glpmcfg_local);
++#endif
++	DWC_DEBUGPL(DBG_ANY, "Backed up gi2cctl   = %08x\n", gr->gi2cctl_local);
++	DWC_DEBUGPL(DBG_ANY, "Backed up pcgcctl   = %08x\n", gr->pcgcctl_local);
++	DWC_DEBUGPL(DBG_ANY,"Backed up gdfifocfg   = %08x\n",gr->gdfifocfg_local);
++
++	return 0;
++}
++
++int dwc_otg_save_dev_regs(dwc_otg_core_if_t * core_if)
++{
++	struct dwc_otg_dev_regs_backup *dr;
++	int i;
++
++	dr = core_if->dr_backup;
++	if (!dr) {
++		dr = DWC_ALLOC(sizeof(*dr));
++		if (!dr) {
++			return -DWC_E_NO_MEMORY;
++		}
++		core_if->dr_backup = dr;
++	}
++
++	dr->dcfg = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
++	dr->dctl = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dctl);
++	dr->daintmsk =
++	    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->daintmsk);
++	dr->diepmsk =
++	    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->diepmsk);
++	dr->doepmsk =
++	    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->doepmsk);
++
++	for (i = 0; i < core_if->dev_if->num_in_eps; ++i) {
++		dr->diepctl[i] =
++		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[i]->diepctl);
++		dr->dieptsiz[i] =
++		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[i]->dieptsiz);
++		dr->diepdma[i] =
++		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[i]->diepdma);
++	}
++
++	DWC_DEBUGPL(DBG_ANY,
++		    "=============Backing Host registers==============\n");
++	DWC_DEBUGPL(DBG_ANY, "Backed up dcfg            = %08x\n", dr->dcfg);
++	DWC_DEBUGPL(DBG_ANY, "Backed up dctl        = %08x\n", dr->dctl);
++	DWC_DEBUGPL(DBG_ANY, "Backed up daintmsk            = %08x\n",
++		    dr->daintmsk);
++	DWC_DEBUGPL(DBG_ANY, "Backed up diepmsk        = %08x\n", dr->diepmsk);
++	DWC_DEBUGPL(DBG_ANY, "Backed up doepmsk        = %08x\n", dr->doepmsk);
++	for (i = 0; i < core_if->dev_if->num_in_eps; ++i) {
++		DWC_DEBUGPL(DBG_ANY, "Backed up diepctl[%d]        = %08x\n", i,
++			    dr->diepctl[i]);
++		DWC_DEBUGPL(DBG_ANY, "Backed up dieptsiz[%d]        = %08x\n",
++			    i, dr->dieptsiz[i]);
++		DWC_DEBUGPL(DBG_ANY, "Backed up diepdma[%d]        = %08x\n", i,
++			    dr->diepdma[i]);
++	}
++
++	return 0;
++}
++
++int dwc_otg_save_host_regs(dwc_otg_core_if_t * core_if)
++{
++	struct dwc_otg_host_regs_backup *hr;
++	int i;
++
++	hr = core_if->hr_backup;
++	if (!hr) {
++		hr = DWC_ALLOC(sizeof(*hr));
++		if (!hr) {
++			return -DWC_E_NO_MEMORY;
++		}
++		core_if->hr_backup = hr;
++	}
++
++	hr->hcfg_local =
++	    DWC_READ_REG32(&core_if->host_if->host_global_regs->hcfg);
++	hr->haintmsk_local =
++	    DWC_READ_REG32(&core_if->host_if->host_global_regs->haintmsk);
++	for (i = 0; i < dwc_otg_get_param_host_channels(core_if); ++i) {
++		hr->hcintmsk_local[i] =
++		    DWC_READ_REG32(&core_if->host_if->hc_regs[i]->hcintmsk);
++	}
++	hr->hprt0_local = DWC_READ_REG32(core_if->host_if->hprt0);
++	hr->hfir_local =
++	    DWC_READ_REG32(&core_if->host_if->host_global_regs->hfir);
++
++	DWC_DEBUGPL(DBG_ANY,
++		    "=============Backing Host registers===============\n");
++	DWC_DEBUGPL(DBG_ANY, "Backed up hcfg		= %08x\n",
++		    hr->hcfg_local);
++	DWC_DEBUGPL(DBG_ANY, "Backed up haintmsk = %08x\n", hr->haintmsk_local);
++	for (i = 0; i < dwc_otg_get_param_host_channels(core_if); ++i) {
++		DWC_DEBUGPL(DBG_ANY, "Backed up hcintmsk[%02d]=%08x\n", i,
++			    hr->hcintmsk_local[i]);
++	}
++	DWC_DEBUGPL(DBG_ANY, "Backed up hprt0           = %08x\n",
++		    hr->hprt0_local);
++	DWC_DEBUGPL(DBG_ANY, "Backed up hfir           = %08x\n",
++		    hr->hfir_local);
++
++	return 0;
++}
++
++int dwc_otg_restore_global_regs(dwc_otg_core_if_t *core_if)
++{
++	struct dwc_otg_global_regs_backup *gr;
++	int i;
++
++	gr = core_if->gr_backup;
++	if (!gr) {
++		return -DWC_E_INVALID;
++	}
++
++	DWC_WRITE_REG32(&core_if->core_global_regs->gotgctl, gr->gotgctl_local);
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, gr->gintmsk_local);
++	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, gr->gusbcfg_local);
++	DWC_WRITE_REG32(&core_if->core_global_regs->gahbcfg, gr->gahbcfg_local);
++	DWC_WRITE_REG32(&core_if->core_global_regs->grxfsiz, gr->grxfsiz_local);
++	DWC_WRITE_REG32(&core_if->core_global_regs->gnptxfsiz,
++			gr->gnptxfsiz_local);
++	DWC_WRITE_REG32(&core_if->core_global_regs->hptxfsiz,
++			gr->hptxfsiz_local);
++	DWC_WRITE_REG32(&core_if->core_global_regs->gdfifocfg,
++			gr->gdfifocfg_local);
++	for (i = 0; i < MAX_EPS_CHANNELS; i++) {
++		DWC_WRITE_REG32(&core_if->core_global_regs->dtxfsiz[i],
++				gr->dtxfsiz_local[i]);
++	}
++
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
++	DWC_WRITE_REG32(core_if->host_if->hprt0, 0x0000100A);
++	DWC_WRITE_REG32(&core_if->core_global_regs->gahbcfg,
++			(gr->gahbcfg_local));
++	return 0;
++}
++
++int dwc_otg_restore_dev_regs(dwc_otg_core_if_t * core_if, int rem_wakeup)
++{
++	struct dwc_otg_dev_regs_backup *dr;
++	int i;
++
++	dr = core_if->dr_backup;
++
++	if (!dr) {
++		return -DWC_E_INVALID;
++	}
++
++	if (!rem_wakeup) {
++		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl,
++				dr->dctl);
++	}
++
++	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->daintmsk, dr->daintmsk);
++	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->diepmsk, dr->diepmsk);
++	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->doepmsk, dr->doepmsk);
++
++	for (i = 0; i < core_if->dev_if->num_in_eps; ++i) {
++		DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[i]->dieptsiz, dr->dieptsiz[i]);
++		DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[i]->diepdma, dr->diepdma[i]);
++		DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[i]->diepctl, dr->diepctl[i]);
++	}
++
++	return 0;
++}
++
++int dwc_otg_restore_host_regs(dwc_otg_core_if_t * core_if, int reset)
++{
++	struct dwc_otg_host_regs_backup *hr;
++	int i;
++	hr = core_if->hr_backup;
++
++	if (!hr) {
++		return -DWC_E_INVALID;
++	}
++
++	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hcfg, hr->hcfg_local);
++	//if (!reset)
++	//{
++	//      DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hfir, hr->hfir_local);
++	//}
++
++	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->haintmsk,
++			hr->haintmsk_local);
++	for (i = 0; i < dwc_otg_get_param_host_channels(core_if); ++i) {
++		DWC_WRITE_REG32(&core_if->host_if->hc_regs[i]->hcintmsk,
++				hr->hcintmsk_local[i]);
++	}
++
++	return 0;
++}
++
++int restore_lpm_i2c_regs(dwc_otg_core_if_t * core_if)
++{
++	struct dwc_otg_global_regs_backup *gr;
++
++	gr = core_if->gr_backup;
++
++	/* Restore values for LPM and I2C */
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg, gr->glpmcfg_local);
++#endif
++	DWC_WRITE_REG32(&core_if->core_global_regs->gi2cctl, gr->gi2cctl_local);
++
++	return 0;
++}
++
++int restore_essential_regs(dwc_otg_core_if_t * core_if, int rmode, int is_host)
++{
++	struct dwc_otg_global_regs_backup *gr;
++	pcgcctl_data_t pcgcctl = {.d32 = 0 };
++	gahbcfg_data_t gahbcfg = {.d32 = 0 };
++	gusbcfg_data_t gusbcfg = {.d32 = 0 };
++	gintmsk_data_t gintmsk = {.d32 = 0 };
++
++	/* Restore LPM and I2C registers */
++	restore_lpm_i2c_regs(core_if);
++
++	/* Set PCGCCTL to 0 */
++	DWC_WRITE_REG32(core_if->pcgcctl, 0x00000000);
++
++	gr = core_if->gr_backup;
++	/* Load restore values for [31:14] bits */
++	DWC_WRITE_REG32(core_if->pcgcctl,
++			((gr->pcgcctl_local & 0xffffc000) | 0x00020000));
++
++	/* Umnask global Interrupt in GAHBCFG and restore it */
++	gahbcfg.d32 = gr->gahbcfg_local;
++	gahbcfg.b.glblintrmsk = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gahbcfg, gahbcfg.d32);
++
++	/* Clear all pending interupts */
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
++
++	/* Unmask restore done interrupt */
++	gintmsk.b.restoredone = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, gintmsk.d32);
++
++	/* Restore GUSBCFG and HCFG/DCFG */
++	gusbcfg.d32 = core_if->gr_backup->gusbcfg_local;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, gusbcfg.d32);
++
++	if (is_host) {
++		hcfg_data_t hcfg = {.d32 = 0 };
++		hcfg.d32 = core_if->hr_backup->hcfg_local;
++		DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hcfg,
++				hcfg.d32);
++
++		/* Load restore values for [31:14] bits */
++		pcgcctl.d32 = gr->pcgcctl_local & 0xffffc000;
++		pcgcctl.d32 = gr->pcgcctl_local | 0x00020000;
++
++		if (rmode)
++			pcgcctl.b.restoremode = 1;
++		DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
++		dwc_udelay(10);
++
++		/* Load restore values for [31:14] bits and set EssRegRestored bit */
++		pcgcctl.d32 = gr->pcgcctl_local | 0xffffc000;
++		pcgcctl.d32 = gr->pcgcctl_local & 0xffffc000;
++		pcgcctl.b.ess_reg_restored = 1;
++		if (rmode)
++			pcgcctl.b.restoremode = 1;
++		DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
++	} else {
++		dcfg_data_t dcfg = {.d32 = 0 };
++		dcfg.d32 = core_if->dr_backup->dcfg;
++		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg, dcfg.d32);
++
++		/* Load restore values for [31:14] bits */
++		pcgcctl.d32 = gr->pcgcctl_local & 0xffffc000;
++		pcgcctl.d32 = gr->pcgcctl_local | 0x00020000;
++		if (!rmode) {
++			pcgcctl.d32 |= 0x208;
++		}
++		DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
++		dwc_udelay(10);
++
++		/* Load restore values for [31:14] bits */
++		pcgcctl.d32 = gr->pcgcctl_local & 0xffffc000;
++		pcgcctl.d32 = gr->pcgcctl_local | 0x00020000;
++		pcgcctl.b.ess_reg_restored = 1;
++		if (!rmode)
++			pcgcctl.d32 |= 0x208;
++		DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
++	}
++
++	return 0;
++}
++
++/**
++ * Initializes the FSLSPClkSel field of the HCFG register depending on the PHY
++ * type.
++ */
++static void init_fslspclksel(dwc_otg_core_if_t * core_if)
++{
++	uint32_t val;
++	hcfg_data_t hcfg;
++
++	if (((core_if->hwcfg2.b.hs_phy_type == 2) &&
++	     (core_if->hwcfg2.b.fs_phy_type == 1) &&
++	     (core_if->core_params->ulpi_fs_ls)) ||
++	    (core_if->core_params->phy_type == DWC_PHY_TYPE_PARAM_FS)) {
++		/* Full speed PHY */
++		val = DWC_HCFG_48_MHZ;
++	} else {
++		/* High speed PHY running at full speed or high speed */
++		val = DWC_HCFG_30_60_MHZ;
++	}
++
++	DWC_DEBUGPL(DBG_CIL, "Initializing HCFG.FSLSPClkSel to 0x%1x\n", val);
++	hcfg.d32 = DWC_READ_REG32(&core_if->host_if->host_global_regs->hcfg);
++	hcfg.b.fslspclksel = val;
++	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hcfg, hcfg.d32);
++}
++
++/**
++ * Initializes the DevSpd field of the DCFG register depending on the PHY type
++ * and the enumeration speed of the device.
++ */
++static void init_devspd(dwc_otg_core_if_t * core_if)
++{
++	uint32_t val;
++	dcfg_data_t dcfg;
++
++	if (((core_if->hwcfg2.b.hs_phy_type == 2) &&
++	     (core_if->hwcfg2.b.fs_phy_type == 1) &&
++	     (core_if->core_params->ulpi_fs_ls)) ||
++	    (core_if->core_params->phy_type == DWC_PHY_TYPE_PARAM_FS)) {
++		/* Full speed PHY */
++		val = 0x3;
++	} else if (core_if->core_params->speed == DWC_SPEED_PARAM_FULL) {
++		/* High speed PHY running at full speed */
++		val = 0x1;
++	} else {
++		/* High speed PHY running at high speed */
++		val = 0x0;
++	}
++
++	DWC_DEBUGPL(DBG_CIL, "Initializing DCFG.DevSpd to 0x%1x\n", val);
++
++	dcfg.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
++	dcfg.b.devspd = val;
++	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg, dcfg.d32);
++}
++
++/**
++ * This function calculates the number of IN EPS
++ * using GHWCFG1 and GHWCFG2 registers values
++ *
++ * @param core_if Programming view of the DWC_otg controller
++ */
++static uint32_t calc_num_in_eps(dwc_otg_core_if_t * core_if)
++{
++	uint32_t num_in_eps = 0;
++	uint32_t num_eps = core_if->hwcfg2.b.num_dev_ep;
++	uint32_t hwcfg1 = core_if->hwcfg1.d32 >> 3;
++	uint32_t num_tx_fifos = core_if->hwcfg4.b.num_in_eps;
++	int i;
++
++	for (i = 0; i < num_eps; ++i) {
++		if (!(hwcfg1 & 0x1))
++			num_in_eps++;
++
++		hwcfg1 >>= 2;
++	}
++
++	if (core_if->hwcfg4.b.ded_fifo_en) {
++		num_in_eps =
++		    (num_in_eps > num_tx_fifos) ? num_tx_fifos : num_in_eps;
++	}
++
++	return num_in_eps;
++}
++
++/**
++ * This function calculates the number of OUT EPS
++ * using GHWCFG1 and GHWCFG2 registers values
++ *
++ * @param core_if Programming view of the DWC_otg controller
++ */
++static uint32_t calc_num_out_eps(dwc_otg_core_if_t * core_if)
++{
++	uint32_t num_out_eps = 0;
++	uint32_t num_eps = core_if->hwcfg2.b.num_dev_ep;
++	uint32_t hwcfg1 = core_if->hwcfg1.d32 >> 2;
++	int i;
++
++	for (i = 0; i < num_eps; ++i) {
++		if (!(hwcfg1 & 0x1))
++			num_out_eps++;
++
++		hwcfg1 >>= 2;
++	}
++	return num_out_eps;
++}
++
++/**
++ * This function initializes the DWC_otg controller registers and
++ * prepares the core for device mode or host mode operation.
++ *
++ * @param core_if Programming view of the DWC_otg controller
++ *
++ */
++void dwc_otg_core_init(dwc_otg_core_if_t * core_if)
++{
++	int i = 0;
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	gahbcfg_data_t ahbcfg = {.d32 = 0 };
++	gusbcfg_data_t usbcfg = {.d32 = 0 };
++	gi2cctl_data_t i2cctl = {.d32 = 0 };
++
++	DWC_DEBUGPL(DBG_CILV, "dwc_otg_core_init(%p) regs at %p\n",
++                    core_if, global_regs);
++
++	/* Common Initialization */
++	usbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
++
++	/* Program the ULPI External VBUS bit if needed */
++	usbcfg.b.ulpi_ext_vbus_drv =
++	    (core_if->core_params->phy_ulpi_ext_vbus ==
++	     DWC_PHY_ULPI_EXTERNAL_VBUS) ? 1 : 0;
++
++	/* Set external TS Dline pulsing */
++	usbcfg.b.term_sel_dl_pulse =
++	    (core_if->core_params->ts_dline == 1) ? 1 : 0;
++	DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
++
++	/* Reset the Controller */
++	dwc_otg_core_reset(core_if);
++
++	core_if->adp_enable = core_if->core_params->adp_supp_enable;
++	core_if->power_down = core_if->core_params->power_down;
++	core_if->otg_sts = 0;
++
++	/* Initialize parameters from Hardware configuration registers. */
++	dev_if->num_in_eps = calc_num_in_eps(core_if);
++	dev_if->num_out_eps = calc_num_out_eps(core_if);
++
++	DWC_DEBUGPL(DBG_CIL, "num_dev_perio_in_ep=%d\n",
++		    core_if->hwcfg4.b.num_dev_perio_in_ep);
++
++	for (i = 0; i < core_if->hwcfg4.b.num_dev_perio_in_ep; i++) {
++		dev_if->perio_tx_fifo_size[i] =
++		    DWC_READ_REG32(&global_regs->dtxfsiz[i]) >> 16;
++		DWC_DEBUGPL(DBG_CIL, "Periodic Tx FIFO SZ #%d=0x%0x\n",
++			    i, dev_if->perio_tx_fifo_size[i]);
++	}
++
++	for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
++		dev_if->tx_fifo_size[i] =
++		    DWC_READ_REG32(&global_regs->dtxfsiz[i]) >> 16;
++		DWC_DEBUGPL(DBG_CIL, "Tx FIFO SZ #%d=0x%0x\n",
++			    i, dev_if->tx_fifo_size[i]);
++	}
++
++	core_if->total_fifo_size = core_if->hwcfg3.b.dfifo_depth;
++	core_if->rx_fifo_size = DWC_READ_REG32(&global_regs->grxfsiz);
++	core_if->nperio_tx_fifo_size =
++	    DWC_READ_REG32(&global_regs->gnptxfsiz) >> 16;
++
++	DWC_DEBUGPL(DBG_CIL, "Total FIFO SZ=%d\n", core_if->total_fifo_size);
++	DWC_DEBUGPL(DBG_CIL, "Rx FIFO SZ=%d\n", core_if->rx_fifo_size);
++	DWC_DEBUGPL(DBG_CIL, "NP Tx FIFO SZ=%d\n",
++		    core_if->nperio_tx_fifo_size);
++
++	/* This programming sequence needs to happen in FS mode before any other
++	 * programming occurs */
++	if ((core_if->core_params->speed == DWC_SPEED_PARAM_FULL) &&
++	    (core_if->core_params->phy_type == DWC_PHY_TYPE_PARAM_FS)) {
++		/* If FS mode with FS PHY */
++
++		/* core_init() is now called on every switch so only call the
++		 * following for the first time through. */
++		if (!core_if->phy_init_done) {
++			core_if->phy_init_done = 1;
++			DWC_DEBUGPL(DBG_CIL, "FS_PHY detected\n");
++			usbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
++			usbcfg.b.physel = 1;
++			DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
++
++			/* Reset after a PHY select */
++			dwc_otg_core_reset(core_if);
++		}
++
++		/* Program DCFG.DevSpd or HCFG.FSLSPclkSel to 48Mhz in FS.      Also
++		 * do this on HNP Dev/Host mode switches (done in dev_init and
++		 * host_init). */
++		if (dwc_otg_is_host_mode(core_if)) {
++			init_fslspclksel(core_if);
++		} else {
++			init_devspd(core_if);
++		}
++
++		if (core_if->core_params->i2c_enable) {
++			DWC_DEBUGPL(DBG_CIL, "FS_PHY Enabling I2c\n");
++			/* Program GUSBCFG.OtgUtmifsSel to I2C */
++			usbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
++			usbcfg.b.otgutmifssel = 1;
++			DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
++
++			/* Program GI2CCTL.I2CEn */
++			i2cctl.d32 = DWC_READ_REG32(&global_regs->gi2cctl);
++			i2cctl.b.i2cdevaddr = 1;
++			i2cctl.b.i2cen = 0;
++			DWC_WRITE_REG32(&global_regs->gi2cctl, i2cctl.d32);
++			i2cctl.b.i2cen = 1;
++			DWC_WRITE_REG32(&global_regs->gi2cctl, i2cctl.d32);
++		}
++
++	} /* endif speed == DWC_SPEED_PARAM_FULL */
++	else {
++		/* High speed PHY. */
++		if (!core_if->phy_init_done) {
++			core_if->phy_init_done = 1;
++			/* HS PHY parameters.  These parameters are preserved
++			 * during soft reset so only program the first time.  Do
++			 * a soft reset immediately after setting phyif.  */
++
++			if (core_if->core_params->phy_type == 2) {
++				/* ULPI interface */
++				usbcfg.b.ulpi_utmi_sel = 1;
++				usbcfg.b.phyif = 0;
++				usbcfg.b.ddrsel =
++				    core_if->core_params->phy_ulpi_ddr;
++			} else if (core_if->core_params->phy_type == 1) {
++				/* UTMI+ interface */
++				usbcfg.b.ulpi_utmi_sel = 0;
++				if (core_if->core_params->phy_utmi_width == 16) {
++					usbcfg.b.phyif = 1;
++
++				} else {
++					usbcfg.b.phyif = 0;
++				}
++			} else {
++				DWC_ERROR("FS PHY TYPE\n");
++			}
++			DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
++			/* Reset after setting the PHY parameters */
++			dwc_otg_core_reset(core_if);
++		}
++	}
++
++	if ((core_if->hwcfg2.b.hs_phy_type == 2) &&
++	    (core_if->hwcfg2.b.fs_phy_type == 1) &&
++	    (core_if->core_params->ulpi_fs_ls)) {
++		DWC_DEBUGPL(DBG_CIL, "Setting ULPI FSLS\n");
++		usbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
++		usbcfg.b.ulpi_fsls = 1;
++		usbcfg.b.ulpi_clk_sus_m = 1;
++		DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
++	} else {
++		usbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
++		usbcfg.b.ulpi_fsls = 0;
++		usbcfg.b.ulpi_clk_sus_m = 0;
++		DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
++	}
++
++	/* Program the GAHBCFG Register. */
++	switch (core_if->hwcfg2.b.architecture) {
++
++	case DWC_SLAVE_ONLY_ARCH:
++		DWC_DEBUGPL(DBG_CIL, "Slave Only Mode\n");
++		ahbcfg.b.nptxfemplvl_txfemplvl =
++		    DWC_GAHBCFG_TXFEMPTYLVL_HALFEMPTY;
++		ahbcfg.b.ptxfemplvl = DWC_GAHBCFG_TXFEMPTYLVL_HALFEMPTY;
++		core_if->dma_enable = 0;
++		core_if->dma_desc_enable = 0;
++		break;
++
++	case DWC_EXT_DMA_ARCH:
++		DWC_DEBUGPL(DBG_CIL, "External DMA Mode\n");
++		{
++			uint8_t brst_sz = core_if->core_params->dma_burst_size;
++			ahbcfg.b.hburstlen = 0;
++			while (brst_sz > 1) {
++				ahbcfg.b.hburstlen++;
++				brst_sz >>= 1;
++			}
++		}
++		core_if->dma_enable = (core_if->core_params->dma_enable != 0);
++		core_if->dma_desc_enable =
++		    (core_if->core_params->dma_desc_enable != 0);
++		break;
++
++	case DWC_INT_DMA_ARCH:
++		DWC_DEBUGPL(DBG_CIL, "Internal DMA Mode\n");
++		/* Old value was DWC_GAHBCFG_INT_DMA_BURST_INCR - done for
++		  Host mode ISOC in issue fix - vahrama */
++		/* Broadcom had altered to (1<<3)|(0<<0) - WRESP=1, max 4 beats */
++		ahbcfg.b.hburstlen = (1<<3)|(0<<0);//DWC_GAHBCFG_INT_DMA_BURST_INCR4;
++		core_if->dma_enable = (core_if->core_params->dma_enable != 0);
++		core_if->dma_desc_enable =
++		    (core_if->core_params->dma_desc_enable != 0);
++		break;
++
++	}
++	if (core_if->dma_enable) {
++		if (core_if->dma_desc_enable) {
++			DWC_PRINTF("Using Descriptor DMA mode\n");
++		} else {
++			DWC_PRINTF("Using Buffer DMA mode\n");
++
++		}
++	} else {
++		DWC_PRINTF("Using Slave mode\n");
++		core_if->dma_desc_enable = 0;
++	}
++
++	if (core_if->core_params->ahb_single) {
++		ahbcfg.b.ahbsingle = 1;
++	}
++
++	ahbcfg.b.dmaenable = core_if->dma_enable;
++	DWC_WRITE_REG32(&global_regs->gahbcfg, ahbcfg.d32);
++
++	core_if->en_multiple_tx_fifo = core_if->hwcfg4.b.ded_fifo_en;
++
++	core_if->pti_enh_enable = core_if->core_params->pti_enable != 0;
++	core_if->multiproc_int_enable = core_if->core_params->mpi_enable;
++	DWC_PRINTF("Periodic Transfer Interrupt Enhancement - %s\n",
++		   ((core_if->pti_enh_enable) ? "enabled" : "disabled"));
++	DWC_PRINTF("Multiprocessor Interrupt Enhancement - %s\n",
++		   ((core_if->multiproc_int_enable) ? "enabled" : "disabled"));
++
++	/*
++	 * Program the GUSBCFG register.
++	 */
++	usbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
++
++	switch (core_if->hwcfg2.b.op_mode) {
++	case DWC_MODE_HNP_SRP_CAPABLE:
++		usbcfg.b.hnpcap = (core_if->core_params->otg_cap ==
++				   DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE);
++		usbcfg.b.srpcap = (core_if->core_params->otg_cap !=
++				   DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE);
++		break;
++
++	case DWC_MODE_SRP_ONLY_CAPABLE:
++		usbcfg.b.hnpcap = 0;
++		usbcfg.b.srpcap = (core_if->core_params->otg_cap !=
++				   DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE);
++		break;
++
++	case DWC_MODE_NO_HNP_SRP_CAPABLE:
++		usbcfg.b.hnpcap = 0;
++		usbcfg.b.srpcap = 0;
++		break;
++
++	case DWC_MODE_SRP_CAPABLE_DEVICE:
++		usbcfg.b.hnpcap = 0;
++		usbcfg.b.srpcap = (core_if->core_params->otg_cap !=
++				   DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE);
++		break;
++
++	case DWC_MODE_NO_SRP_CAPABLE_DEVICE:
++		usbcfg.b.hnpcap = 0;
++		usbcfg.b.srpcap = 0;
++		break;
++
++	case DWC_MODE_SRP_CAPABLE_HOST:
++		usbcfg.b.hnpcap = 0;
++		usbcfg.b.srpcap = (core_if->core_params->otg_cap !=
++				   DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE);
++		break;
++
++	case DWC_MODE_NO_SRP_CAPABLE_HOST:
++		usbcfg.b.hnpcap = 0;
++		usbcfg.b.srpcap = 0;
++		break;
++	}
++
++	DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
++
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	if (core_if->core_params->lpm_enable) {
++		glpmcfg_data_t lpmcfg = {.d32 = 0 };
++
++		/* To enable LPM support set lpm_cap_en bit */
++		lpmcfg.b.lpm_cap_en = 1;
++
++		/* Make AppL1Res ACK */
++		lpmcfg.b.appl_resp = 1;
++
++		/* Retry 3 times */
++		lpmcfg.b.retry_count = 3;
++
++		DWC_MODIFY_REG32(&core_if->core_global_regs->glpmcfg,
++				 0, lpmcfg.d32);
++
++	}
++#endif
++	if (core_if->core_params->ic_usb_cap) {
++		gusbcfg_data_t gusbcfg = {.d32 = 0 };
++		gusbcfg.b.ic_usb_cap = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gusbcfg,
++				 0, gusbcfg.d32);
++	}
++	{
++		gotgctl_data_t gotgctl = {.d32 = 0 };
++		gotgctl.b.otgver = core_if->core_params->otg_ver;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gotgctl, 0,
++				 gotgctl.d32);
++		/* Set OTG version supported */
++		core_if->otg_ver = core_if->core_params->otg_ver;
++		DWC_PRINTF("OTG VER PARAM: %d, OTG VER FLAG: %d\n",
++			   core_if->core_params->otg_ver, core_if->otg_ver);
++	}
++
++
++	/* Enable common interrupts */
++	dwc_otg_enable_common_interrupts(core_if);
++
++	/* Do device or host intialization based on mode during PCD
++	 * and HCD initialization  */
++	if (dwc_otg_is_host_mode(core_if)) {
++		DWC_DEBUGPL(DBG_ANY, "Host Mode\n");
++		core_if->op_state = A_HOST;
++	} else {
++		DWC_DEBUGPL(DBG_ANY, "Device Mode\n");
++		core_if->op_state = B_PERIPHERAL;
++#ifdef DWC_DEVICE_ONLY
++		dwc_otg_core_dev_init(core_if);
++#endif
++	}
++}
++
++/**
++ * This function enables the Device mode interrupts.
++ *
++ * @param core_if Programming view of DWC_otg controller
++ */
++void dwc_otg_enable_device_interrupts(dwc_otg_core_if_t * core_if)
++{
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++
++	DWC_DEBUGPL(DBG_CIL, "%s()\n", __func__);
++
++	/* Disable all interrupts. */
++	DWC_WRITE_REG32(&global_regs->gintmsk, 0);
++
++	/* Clear any pending interrupts */
++	DWC_WRITE_REG32(&global_regs->gintsts, 0xFFFFFFFF);
++
++	/* Enable the common interrupts */
++	dwc_otg_enable_common_interrupts(core_if);
++
++	/* Enable interrupts */
++	intr_mask.b.usbreset = 1;
++	intr_mask.b.enumdone = 1;
++	/* Disable Disconnect interrupt in Device mode */
++	intr_mask.b.disconnect = 0;
++
++	if (!core_if->multiproc_int_enable) {
++		intr_mask.b.inepintr = 1;
++		intr_mask.b.outepintr = 1;
++	}
++
++	intr_mask.b.erlysuspend = 1;
++
++	if (core_if->en_multiple_tx_fifo == 0) {
++		intr_mask.b.epmismatch = 1;
++	}
++
++	//intr_mask.b.incomplisoout = 1;
++	intr_mask.b.incomplisoin = 1;
++
++/* Enable the ignore frame number for ISOC xfers - MAS */
++/* Disable to support high bandwith ISOC transfers - manukz */
++#if 0
++#ifdef DWC_UTE_PER_IO
++	if (core_if->dma_enable) {
++		if (core_if->dma_desc_enable) {
++			dctl_data_t dctl1 = {.d32 = 0 };
++			dctl1.b.ifrmnum = 1;
++			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
++					 dctl, 0, dctl1.d32);
++			DWC_DEBUG("----Enabled Ignore frame number (0x%08x)",
++				  DWC_READ_REG32(&core_if->dev_if->
++						 dev_global_regs->dctl));
++		}
++	}
++#endif
++#endif
++#ifdef DWC_EN_ISOC
++	if (core_if->dma_enable) {
++		if (core_if->dma_desc_enable == 0) {
++			if (core_if->pti_enh_enable) {
++				dctl_data_t dctl = {.d32 = 0 };
++				dctl.b.ifrmnum = 1;
++				DWC_MODIFY_REG32(&core_if->
++						 dev_if->dev_global_regs->dctl,
++						 0, dctl.d32);
++			} else {
++				intr_mask.b.incomplisoin = 1;
++				intr_mask.b.incomplisoout = 1;
++			}
++		}
++	} else {
++		intr_mask.b.incomplisoin = 1;
++		intr_mask.b.incomplisoout = 1;
++	}
++#endif /* DWC_EN_ISOC */
++
++	/** @todo NGS: Should this be a module parameter? */
++#ifdef USE_PERIODIC_EP
++	intr_mask.b.isooutdrop = 1;
++	intr_mask.b.eopframe = 1;
++	intr_mask.b.incomplisoin = 1;
++	intr_mask.b.incomplisoout = 1;
++#endif
++
++	DWC_MODIFY_REG32(&global_regs->gintmsk, intr_mask.d32, intr_mask.d32);
++
++	DWC_DEBUGPL(DBG_CIL, "%s() gintmsk=%0x\n", __func__,
++		    DWC_READ_REG32(&global_regs->gintmsk));
++}
++
++/**
++ * This function initializes the DWC_otg controller registers for
++ * device mode.
++ *
++ * @param core_if Programming view of DWC_otg controller
++ *
++ */
++void dwc_otg_core_dev_init(dwc_otg_core_if_t * core_if)
++{
++	int i;
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	dwc_otg_core_params_t *params = core_if->core_params;
++	dcfg_data_t dcfg = {.d32 = 0 };
++	depctl_data_t diepctl = {.d32 = 0 };
++	grstctl_t resetctl = {.d32 = 0 };
++	uint32_t rx_fifo_size;
++	fifosize_data_t nptxfifosize;
++	fifosize_data_t txfifosize;
++	dthrctl_data_t dthrctl;
++	fifosize_data_t ptxfifosize;
++	uint16_t rxfsiz, nptxfsiz;
++	gdfifocfg_data_t gdfifocfg = {.d32 = 0 };
++	hwcfg3_data_t hwcfg3 = {.d32 = 0 };
++
++	/* Restart the Phy Clock */
++	DWC_WRITE_REG32(core_if->pcgcctl, 0);
++
++	/* Device configuration register */
++	init_devspd(core_if);
++	dcfg.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dcfg);
++	dcfg.b.descdma = (core_if->dma_desc_enable) ? 1 : 0;
++	dcfg.b.perfrint = DWC_DCFG_FRAME_INTERVAL_80;
++	/* Enable Device OUT NAK in case of DDMA mode*/
++	if (core_if->core_params->dev_out_nak) {
++		dcfg.b.endevoutnak = 1;
++	}
++
++	if (core_if->core_params->cont_on_bna) {
++		dctl_data_t dctl = {.d32 = 0 };
++		dctl.b.encontonbna = 1;
++		DWC_MODIFY_REG32(&dev_if->dev_global_regs->dctl, 0, dctl.d32);
++	}
++
++
++	DWC_WRITE_REG32(&dev_if->dev_global_regs->dcfg, dcfg.d32);
++
++	/* Configure data FIFO sizes */
++	if (core_if->hwcfg2.b.dynamic_fifo && params->enable_dynamic_fifo) {
++		DWC_DEBUGPL(DBG_CIL, "Total FIFO Size=%d\n",
++			    core_if->total_fifo_size);
++		DWC_DEBUGPL(DBG_CIL, "Rx FIFO Size=%d\n",
++			    params->dev_rx_fifo_size);
++		DWC_DEBUGPL(DBG_CIL, "NP Tx FIFO Size=%d\n",
++			    params->dev_nperio_tx_fifo_size);
++
++		/* Rx FIFO */
++		DWC_DEBUGPL(DBG_CIL, "initial grxfsiz=%08x\n",
++			    DWC_READ_REG32(&global_regs->grxfsiz));
++
++#ifdef DWC_UTE_CFI
++		core_if->pwron_rxfsiz = DWC_READ_REG32(&global_regs->grxfsiz);
++		core_if->init_rxfsiz = params->dev_rx_fifo_size;
++#endif
++		rx_fifo_size = params->dev_rx_fifo_size;
++		DWC_WRITE_REG32(&global_regs->grxfsiz, rx_fifo_size);
++
++		DWC_DEBUGPL(DBG_CIL, "new grxfsiz=%08x\n",
++			    DWC_READ_REG32(&global_regs->grxfsiz));
++
++		/** Set Periodic Tx FIFO Mask all bits 0 */
++		core_if->p_tx_msk = 0;
++
++		/** Set Tx FIFO Mask all bits 0 */
++		core_if->tx_msk = 0;
++
++		if (core_if->en_multiple_tx_fifo == 0) {
++			/* Non-periodic Tx FIFO */
++			DWC_DEBUGPL(DBG_CIL, "initial gnptxfsiz=%08x\n",
++				    DWC_READ_REG32(&global_regs->gnptxfsiz));
++
++			nptxfifosize.b.depth = params->dev_nperio_tx_fifo_size;
++			nptxfifosize.b.startaddr = params->dev_rx_fifo_size;
++
++			DWC_WRITE_REG32(&global_regs->gnptxfsiz,
++					nptxfifosize.d32);
++
++			DWC_DEBUGPL(DBG_CIL, "new gnptxfsiz=%08x\n",
++				    DWC_READ_REG32(&global_regs->gnptxfsiz));
++
++			/**@todo NGS: Fix Periodic FIFO Sizing! */
++			/*
++			 * Periodic Tx FIFOs These FIFOs are numbered from 1 to 15.
++			 * Indexes of the FIFO size module parameters in the
++			 * dev_perio_tx_fifo_size array and the FIFO size registers in
++			 * the dptxfsiz array run from 0 to 14.
++			 */
++			/** @todo Finish debug of this */
++			ptxfifosize.b.startaddr =
++			    nptxfifosize.b.startaddr + nptxfifosize.b.depth;
++			for (i = 0; i < core_if->hwcfg4.b.num_dev_perio_in_ep; i++) {
++				ptxfifosize.b.depth =
++				    params->dev_perio_tx_fifo_size[i];
++				DWC_DEBUGPL(DBG_CIL,
++					    "initial dtxfsiz[%d]=%08x\n", i,
++					    DWC_READ_REG32(&global_regs->dtxfsiz
++							   [i]));
++				DWC_WRITE_REG32(&global_regs->dtxfsiz[i],
++						ptxfifosize.d32);
++				DWC_DEBUGPL(DBG_CIL, "new dtxfsiz[%d]=%08x\n",
++					    i,
++					    DWC_READ_REG32(&global_regs->dtxfsiz
++							   [i]));
++				ptxfifosize.b.startaddr += ptxfifosize.b.depth;
++			}
++		} else {
++			/*
++			 * Tx FIFOs These FIFOs are numbered from 1 to 15.
++			 * Indexes of the FIFO size module parameters in the
++			 * dev_tx_fifo_size array and the FIFO size registers in
++			 * the dtxfsiz array run from 0 to 14.
++			 */
++
++			/* Non-periodic Tx FIFO */
++			DWC_DEBUGPL(DBG_CIL, "initial gnptxfsiz=%08x\n",
++				    DWC_READ_REG32(&global_regs->gnptxfsiz));
++
++#ifdef DWC_UTE_CFI
++			core_if->pwron_gnptxfsiz =
++			    (DWC_READ_REG32(&global_regs->gnptxfsiz) >> 16);
++			core_if->init_gnptxfsiz =
++			    params->dev_nperio_tx_fifo_size;
++#endif
++			nptxfifosize.b.depth = params->dev_nperio_tx_fifo_size;
++			nptxfifosize.b.startaddr = params->dev_rx_fifo_size;
++
++			DWC_WRITE_REG32(&global_regs->gnptxfsiz,
++					nptxfifosize.d32);
++
++			DWC_DEBUGPL(DBG_CIL, "new gnptxfsiz=%08x\n",
++				    DWC_READ_REG32(&global_regs->gnptxfsiz));
++
++			txfifosize.b.startaddr =
++			    nptxfifosize.b.startaddr + nptxfifosize.b.depth;
++
++			for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
++
++				txfifosize.b.depth =
++				    params->dev_tx_fifo_size[i];
++
++				DWC_DEBUGPL(DBG_CIL,
++					    "initial dtxfsiz[%d]=%08x\n",
++					    i,
++					    DWC_READ_REG32(&global_regs->dtxfsiz
++							   [i]));
++
++#ifdef DWC_UTE_CFI
++				core_if->pwron_txfsiz[i] =
++				    (DWC_READ_REG32
++				     (&global_regs->dtxfsiz[i]) >> 16);
++				core_if->init_txfsiz[i] =
++				    params->dev_tx_fifo_size[i];
++#endif
++				DWC_WRITE_REG32(&global_regs->dtxfsiz[i],
++						txfifosize.d32);
++
++				DWC_DEBUGPL(DBG_CIL,
++					    "new dtxfsiz[%d]=%08x\n",
++					    i,
++					    DWC_READ_REG32(&global_regs->dtxfsiz
++							   [i]));
++
++				txfifosize.b.startaddr += txfifosize.b.depth;
++			}
++			if (core_if->snpsid <= OTG_CORE_REV_2_94a) {
++				/* Calculating DFIFOCFG for Device mode to include RxFIFO and NPTXFIFO */
++				gdfifocfg.d32 = DWC_READ_REG32(&global_regs->gdfifocfg);
++				hwcfg3.d32 = DWC_READ_REG32(&global_regs->ghwcfg3);
++				gdfifocfg.b.gdfifocfg = (DWC_READ_REG32(&global_regs->ghwcfg3) >> 16);
++				DWC_WRITE_REG32(&global_regs->gdfifocfg, gdfifocfg.d32);
++				rxfsiz = (DWC_READ_REG32(&global_regs->grxfsiz) & 0x0000ffff);
++				nptxfsiz = (DWC_READ_REG32(&global_regs->gnptxfsiz) >> 16);
++				gdfifocfg.b.epinfobase = rxfsiz + nptxfsiz;
++				DWC_WRITE_REG32(&global_regs->gdfifocfg, gdfifocfg.d32);
++			}
++		}
++
++		/* Flush the FIFOs */
++		dwc_otg_flush_tx_fifo(core_if, 0x10);	/* all Tx FIFOs */
++		dwc_otg_flush_rx_fifo(core_if);
++
++		/* Flush the Learning Queue. */
++		resetctl.b.intknqflsh = 1;
++		DWC_WRITE_REG32(&core_if->core_global_regs->grstctl, resetctl.d32);
++
++		if (!core_if->core_params->en_multiple_tx_fifo && core_if->dma_enable) {
++			core_if->start_predict = 0;
++			for (i = 0; i<= core_if->dev_if->num_in_eps; ++i) {
++				core_if->nextep_seq[i] = 0xff;	// 0xff - EP not active
++			}
++			core_if->nextep_seq[0] = 0;
++			core_if->first_in_nextep_seq = 0;
++			diepctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[0]->diepctl);
++			diepctl.b.nextep = 0;
++			DWC_WRITE_REG32(&dev_if->in_ep_regs[0]->diepctl, diepctl.d32);
++
++			/* Update IN Endpoint Mismatch Count by active IN NP EP count + 1 */
++			dcfg.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dcfg);
++			dcfg.b.epmscnt = 2;
++			DWC_WRITE_REG32(&dev_if->dev_global_regs->dcfg, dcfg.d32);
++
++			DWC_DEBUGPL(DBG_CILV,"%s first_in_nextep_seq= %2d; nextep_seq[]:\n",
++				__func__, core_if->first_in_nextep_seq);
++			for (i=0; i <= core_if->dev_if->num_in_eps; i++) {
++				DWC_DEBUGPL(DBG_CILV, "%2d ", core_if->nextep_seq[i]);
++			}
++			DWC_DEBUGPL(DBG_CILV,"\n");
++		}
++
++		/* Clear all pending Device Interrupts */
++		/** @todo - if the condition needed to be checked
++		 *  or in any case all pending interrutps should be cleared?
++	     */
++		if (core_if->multiproc_int_enable) {
++			for (i = 0; i < core_if->dev_if->num_in_eps; ++i) {
++				DWC_WRITE_REG32(&dev_if->
++						dev_global_regs->diepeachintmsk[i], 0);
++			}
++		}
++
++		for (i = 0; i < core_if->dev_if->num_out_eps; ++i) {
++			DWC_WRITE_REG32(&dev_if->
++					dev_global_regs->doepeachintmsk[i], 0);
++		}
++
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->deachint, 0xFFFFFFFF);
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->deachintmsk, 0);
++	} else {
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->diepmsk, 0);
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->doepmsk, 0);
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->daint, 0xFFFFFFFF);
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->daintmsk, 0);
++	}
++
++	for (i = 0; i <= dev_if->num_in_eps; i++) {
++		depctl_data_t depctl;
++		depctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
++		if (depctl.b.epena) {
++			depctl.d32 = 0;
++			depctl.b.epdis = 1;
++			depctl.b.snak = 1;
++		} else {
++			depctl.d32 = 0;
++		}
++
++		DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepctl, depctl.d32);
++
++		DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->dieptsiz, 0);
++		DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepdma, 0);
++		DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepint, 0xFF);
++	}
++
++	for (i = 0; i <= dev_if->num_out_eps; i++) {
++		depctl_data_t depctl;
++		depctl.d32 = DWC_READ_REG32(&dev_if->out_ep_regs[i]->doepctl);
++		if (depctl.b.epena) {
++			dctl_data_t dctl = {.d32 = 0 };
++			gintmsk_data_t gintsts = {.d32 = 0 };
++			doepint_data_t doepint = {.d32 = 0 };
++			dctl.b.sgoutnak = 1;
++			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0, dctl.d32);
++			do {
++				dwc_udelay(10);
++				gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
++			} while (!gintsts.b.goutnakeff);
++			gintsts.d32 = 0;
++			gintsts.b.goutnakeff = 1;
++			DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++
++			depctl.d32 = 0;
++			depctl.b.epdis = 1;
++			depctl.b.snak = 1;
++			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[i]->doepctl, depctl.d32);
++			do {
++				dwc_udelay(10);
++				doepint.d32 = DWC_READ_REG32(&core_if->dev_if->
++					out_ep_regs[i]->doepint);
++			} while (!doepint.b.epdisabled);
++
++			doepint.b.epdisabled = 1;
++			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[i]->doepint, doepint.d32);
++
++			dctl.d32 = 0;
++			dctl.b.cgoutnak = 1;
++			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0, dctl.d32);
++		} else {
++			depctl.d32 = 0;
++		}
++
++		DWC_WRITE_REG32(&dev_if->out_ep_regs[i]->doepctl, depctl.d32);
++
++		DWC_WRITE_REG32(&dev_if->out_ep_regs[i]->doeptsiz, 0);
++		DWC_WRITE_REG32(&dev_if->out_ep_regs[i]->doepdma, 0);
++		DWC_WRITE_REG32(&dev_if->out_ep_regs[i]->doepint, 0xFF);
++	}
++
++	if (core_if->en_multiple_tx_fifo && core_if->dma_enable) {
++		dev_if->non_iso_tx_thr_en = params->thr_ctl & 0x1;
++		dev_if->iso_tx_thr_en = (params->thr_ctl >> 1) & 0x1;
++		dev_if->rx_thr_en = (params->thr_ctl >> 2) & 0x1;
++
++		dev_if->rx_thr_length = params->rx_thr_length;
++		dev_if->tx_thr_length = params->tx_thr_length;
++
++		dev_if->setup_desc_index = 0;
++
++		dthrctl.d32 = 0;
++		dthrctl.b.non_iso_thr_en = dev_if->non_iso_tx_thr_en;
++		dthrctl.b.iso_thr_en = dev_if->iso_tx_thr_en;
++		dthrctl.b.tx_thr_len = dev_if->tx_thr_length;
++		dthrctl.b.rx_thr_en = dev_if->rx_thr_en;
++		dthrctl.b.rx_thr_len = dev_if->rx_thr_length;
++		dthrctl.b.ahb_thr_ratio = params->ahb_thr_ratio;
++
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->dtknqr3_dthrctl,
++				dthrctl.d32);
++
++		DWC_DEBUGPL(DBG_CIL,
++			    "Non ISO Tx Thr - %d\nISO Tx Thr - %d\nRx Thr - %d\nTx Thr Len - %d\nRx Thr Len - %d\n",
++			    dthrctl.b.non_iso_thr_en, dthrctl.b.iso_thr_en,
++			    dthrctl.b.rx_thr_en, dthrctl.b.tx_thr_len,
++			    dthrctl.b.rx_thr_len);
++
++	}
++
++	dwc_otg_enable_device_interrupts(core_if);
++
++	{
++		diepmsk_data_t msk = {.d32 = 0 };
++		msk.b.txfifoundrn = 1;
++		if (core_if->multiproc_int_enable) {
++			DWC_MODIFY_REG32(&dev_if->dev_global_regs->
++					 diepeachintmsk[0], msk.d32, msk.d32);
++		} else {
++			DWC_MODIFY_REG32(&dev_if->dev_global_regs->diepmsk,
++					 msk.d32, msk.d32);
++		}
++	}
++
++	if (core_if->multiproc_int_enable) {
++		/* Set NAK on Babble */
++		dctl_data_t dctl = {.d32 = 0 };
++		dctl.b.nakonbble = 1;
++		DWC_MODIFY_REG32(&dev_if->dev_global_regs->dctl, 0, dctl.d32);
++	}
++
++	if (core_if->snpsid >= OTG_CORE_REV_2_94a) {
++		dctl_data_t dctl = {.d32 = 0 };
++		dctl.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dctl);
++		dctl.b.sftdiscon = 0;
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->dctl, dctl.d32);
++	}
++}
++
++/**
++ * This function enables the Host mode interrupts.
++ *
++ * @param core_if Programming view of DWC_otg controller
++ */
++void dwc_otg_enable_host_interrupts(dwc_otg_core_if_t * core_if)
++{
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++
++	DWC_DEBUGPL(DBG_CIL, "%s(%p)\n", __func__, core_if);
++
++	/* Disable all interrupts. */
++	DWC_WRITE_REG32(&global_regs->gintmsk, 0);
++
++	/* Clear any pending interrupts. */
++	DWC_WRITE_REG32(&global_regs->gintsts, 0xFFFFFFFF);
++
++	/* Enable the common interrupts */
++	dwc_otg_enable_common_interrupts(core_if);
++
++	/*
++	 * Enable host mode interrupts without disturbing common
++	 * interrupts.
++	 */
++
++	intr_mask.b.disconnect = 1;
++	intr_mask.b.portintr = 1;
++	intr_mask.b.hcintr = 1;
++
++	DWC_MODIFY_REG32(&global_regs->gintmsk, intr_mask.d32, intr_mask.d32);
++}
++
++/**
++ * This function disables the Host Mode interrupts.
++ *
++ * @param core_if Programming view of DWC_otg controller
++ */
++void dwc_otg_disable_host_interrupts(dwc_otg_core_if_t * core_if)
++{
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++
++	DWC_DEBUGPL(DBG_CILV, "%s()\n", __func__);
++
++	/*
++	 * Disable host mode interrupts without disturbing common
++	 * interrupts.
++	 */
++	intr_mask.b.sofintr = 1;
++	intr_mask.b.portintr = 1;
++	intr_mask.b.hcintr = 1;
++	intr_mask.b.ptxfempty = 1;
++	intr_mask.b.nptxfempty = 1;
++
++	DWC_MODIFY_REG32(&global_regs->gintmsk, intr_mask.d32, 0);
++}
++
++/**
++ * This function initializes the DWC_otg controller registers for
++ * host mode.
++ *
++ * This function flushes the Tx and Rx FIFOs and it flushes any entries in the
++ * request queues. Host channels are reset to ensure that they are ready for
++ * performing transfers.
++ *
++ * @param core_if Programming view of DWC_otg controller
++ *
++ */
++void dwc_otg_core_host_init(dwc_otg_core_if_t * core_if)
++{
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	dwc_otg_host_if_t *host_if = core_if->host_if;
++	dwc_otg_core_params_t *params = core_if->core_params;
++	hprt0_data_t hprt0 = {.d32 = 0 };
++	fifosize_data_t nptxfifosize;
++	fifosize_data_t ptxfifosize;
++	uint16_t rxfsiz, nptxfsiz, hptxfsiz;
++	gdfifocfg_data_t gdfifocfg = {.d32 = 0 };
++	int i;
++	hcchar_data_t hcchar;
++	hcfg_data_t hcfg;
++	hfir_data_t hfir;
++	dwc_otg_hc_regs_t *hc_regs;
++	int num_channels;
++	gotgctl_data_t gotgctl = {.d32 = 0 };
++
++	DWC_DEBUGPL(DBG_CILV, "%s(%p)\n", __func__, core_if);
++
++	/* Restart the Phy Clock */
++	DWC_WRITE_REG32(core_if->pcgcctl, 0);
++
++	/* Initialize Host Configuration Register */
++	init_fslspclksel(core_if);
++	if (core_if->core_params->speed == DWC_SPEED_PARAM_FULL) {
++		hcfg.d32 = DWC_READ_REG32(&host_if->host_global_regs->hcfg);
++		hcfg.b.fslssupp = 1;
++		DWC_WRITE_REG32(&host_if->host_global_regs->hcfg, hcfg.d32);
++
++	}
++
++	/* This bit allows dynamic reloading of the HFIR register
++	 * during runtime. This bit needs to be programmed during
++	 * initial configuration and its value must not be changed
++	 * during runtime.*/
++	if (core_if->core_params->reload_ctl == 1) {
++		hfir.d32 = DWC_READ_REG32(&host_if->host_global_regs->hfir);
++		hfir.b.hfirrldctrl = 1;
++		DWC_WRITE_REG32(&host_if->host_global_regs->hfir, hfir.d32);
++	}
++
++	if (core_if->core_params->dma_desc_enable) {
++		uint8_t op_mode = core_if->hwcfg2.b.op_mode;
++		if (!
++		    (core_if->hwcfg4.b.desc_dma
++		     && (core_if->snpsid >= OTG_CORE_REV_2_90a)
++		     && ((op_mode == DWC_HWCFG2_OP_MODE_HNP_SRP_CAPABLE_OTG)
++			 || (op_mode == DWC_HWCFG2_OP_MODE_SRP_ONLY_CAPABLE_OTG)
++			 || (op_mode ==
++			     DWC_HWCFG2_OP_MODE_NO_HNP_SRP_CAPABLE_OTG)
++			 || (op_mode == DWC_HWCFG2_OP_MODE_SRP_CAPABLE_HOST)
++			 || (op_mode ==
++			     DWC_HWCFG2_OP_MODE_NO_SRP_CAPABLE_HOST)))) {
++
++			DWC_ERROR("Host can't operate in Descriptor DMA mode.\n"
++				  "Either core version is below 2.90a or "
++				  "GHWCFG2, GHWCFG4 registers' values do not allow Descriptor DMA in host mode.\n"
++				  "To run the driver in Buffer DMA host mode set dma_desc_enable "
++				  "module parameter to 0.\n");
++			return;
++		}
++		hcfg.d32 = DWC_READ_REG32(&host_if->host_global_regs->hcfg);
++		hcfg.b.descdma = 1;
++		DWC_WRITE_REG32(&host_if->host_global_regs->hcfg, hcfg.d32);
++	}
++
++	/* Configure data FIFO sizes */
++	if (core_if->hwcfg2.b.dynamic_fifo && params->enable_dynamic_fifo) {
++		DWC_DEBUGPL(DBG_CIL, "Total FIFO Size=%d\n",
++			    core_if->total_fifo_size);
++		DWC_DEBUGPL(DBG_CIL, "Rx FIFO Size=%d\n",
++			    params->host_rx_fifo_size);
++		DWC_DEBUGPL(DBG_CIL, "NP Tx FIFO Size=%d\n",
++			    params->host_nperio_tx_fifo_size);
++		DWC_DEBUGPL(DBG_CIL, "P Tx FIFO Size=%d\n",
++			    params->host_perio_tx_fifo_size);
++
++		/* Rx FIFO */
++		DWC_DEBUGPL(DBG_CIL, "initial grxfsiz=%08x\n",
++			    DWC_READ_REG32(&global_regs->grxfsiz));
++		DWC_WRITE_REG32(&global_regs->grxfsiz,
++				params->host_rx_fifo_size);
++		DWC_DEBUGPL(DBG_CIL, "new grxfsiz=%08x\n",
++			    DWC_READ_REG32(&global_regs->grxfsiz));
++
++		/* Non-periodic Tx FIFO */
++		DWC_DEBUGPL(DBG_CIL, "initial gnptxfsiz=%08x\n",
++			    DWC_READ_REG32(&global_regs->gnptxfsiz));
++		nptxfifosize.b.depth = params->host_nperio_tx_fifo_size;
++		nptxfifosize.b.startaddr = params->host_rx_fifo_size;
++		DWC_WRITE_REG32(&global_regs->gnptxfsiz, nptxfifosize.d32);
++		DWC_DEBUGPL(DBG_CIL, "new gnptxfsiz=%08x\n",
++			    DWC_READ_REG32(&global_regs->gnptxfsiz));
++
++		/* Periodic Tx FIFO */
++		DWC_DEBUGPL(DBG_CIL, "initial hptxfsiz=%08x\n",
++			    DWC_READ_REG32(&global_regs->hptxfsiz));
++		ptxfifosize.b.depth = params->host_perio_tx_fifo_size;
++		ptxfifosize.b.startaddr =
++		    nptxfifosize.b.startaddr + nptxfifosize.b.depth;
++		DWC_WRITE_REG32(&global_regs->hptxfsiz, ptxfifosize.d32);
++		DWC_DEBUGPL(DBG_CIL, "new hptxfsiz=%08x\n",
++			    DWC_READ_REG32(&global_regs->hptxfsiz));
++
++		if (core_if->en_multiple_tx_fifo
++		    && core_if->snpsid <= OTG_CORE_REV_2_94a) {
++			/* Global DFIFOCFG calculation for Host mode - include RxFIFO, NPTXFIFO and HPTXFIFO */
++			gdfifocfg.d32 = DWC_READ_REG32(&global_regs->gdfifocfg);
++			rxfsiz = (DWC_READ_REG32(&global_regs->grxfsiz) & 0x0000ffff);
++			nptxfsiz = (DWC_READ_REG32(&global_regs->gnptxfsiz) >> 16);
++			hptxfsiz = (DWC_READ_REG32(&global_regs->hptxfsiz) >> 16);
++			gdfifocfg.b.epinfobase = rxfsiz + nptxfsiz + hptxfsiz;
++			DWC_WRITE_REG32(&global_regs->gdfifocfg, gdfifocfg.d32);
++		}
++	}
++
++	/* TODO - check this */
++	/* Clear Host Set HNP Enable in the OTG Control Register */
++	gotgctl.b.hstsethnpen = 1;
++	DWC_MODIFY_REG32(&global_regs->gotgctl, gotgctl.d32, 0);
++	/* Make sure the FIFOs are flushed. */
++	dwc_otg_flush_tx_fifo(core_if, 0x10 /* all TX FIFOs */ );
++	dwc_otg_flush_rx_fifo(core_if);
++
++	/* Clear Host Set HNP Enable in the OTG Control Register */
++	gotgctl.b.hstsethnpen = 1;
++	DWC_MODIFY_REG32(&global_regs->gotgctl, gotgctl.d32, 0);
++
++	if (!core_if->core_params->dma_desc_enable) {
++		/* Flush out any leftover queued requests. */
++		num_channels = core_if->core_params->host_channels;
++
++		for (i = 0; i < num_channels; i++) {
++			hc_regs = core_if->host_if->hc_regs[i];
++			hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++			hcchar.b.chen = 0;
++			hcchar.b.chdis = 1;
++			hcchar.b.epdir = 0;
++			DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++		}
++
++		/* Halt all channels to put them into a known state. */
++		for (i = 0; i < num_channels; i++) {
++			int count = 0;
++			hc_regs = core_if->host_if->hc_regs[i];
++			hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++			hcchar.b.chen = 1;
++			hcchar.b.chdis = 1;
++			hcchar.b.epdir = 0;
++			DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++			DWC_DEBUGPL(DBG_HCDV, "%s: Halt channel %d regs %p\n", __func__, i, hc_regs);
++			do {
++				hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++				if (++count > 1000) {
++					DWC_ERROR
++					    ("%s: Unable to clear halt on channel %d (timeout HCCHAR 0x%X @%p)\n",
++					     __func__, i, hcchar.d32, &hc_regs->hcchar);
++					break;
++				}
++				dwc_udelay(1);
++			} while (hcchar.b.chen);
++		}
++	}
++
++	/* Turn on the vbus power. */
++	DWC_PRINTF("Init: Port Power? op_state=%d\n", core_if->op_state);
++	if (core_if->op_state == A_HOST) {
++		hprt0.d32 = dwc_otg_read_hprt0(core_if);
++		DWC_PRINTF("Init: Power Port (%d)\n", hprt0.b.prtpwr);
++		if (hprt0.b.prtpwr == 0) {
++			hprt0.b.prtpwr = 1;
++			DWC_WRITE_REG32(host_if->hprt0, hprt0.d32);
++		}
++	}
++
++	dwc_otg_enable_host_interrupts(core_if);
++}
++
++/**
++ * Prepares a host channel for transferring packets to/from a specific
++ * endpoint. The HCCHARn register is set up with the characteristics specified
++ * in _hc. Host channel interrupts that may need to be serviced while this
++ * transfer is in progress are enabled.
++ *
++ * @param core_if Programming view of DWC_otg controller
++ * @param hc Information needed to initialize the host channel
++ */
++void dwc_otg_hc_init(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
++{
++	hcintmsk_data_t hc_intr_mask;
++	hcchar_data_t hcchar;
++	hcsplt_data_t hcsplt;
++
++	uint8_t hc_num = hc->hc_num;
++	dwc_otg_host_if_t *host_if = core_if->host_if;
++	dwc_otg_hc_regs_t *hc_regs = host_if->hc_regs[hc_num];
++
++	/* Clear old interrupt conditions for this host channel. */
++	hc_intr_mask.d32 = 0xFFFFFFFF;
++	hc_intr_mask.b.reserved14_31 = 0;
++	DWC_WRITE_REG32(&hc_regs->hcint, hc_intr_mask.d32);
++
++	/* Enable channel interrupts required for this transfer. */
++	hc_intr_mask.d32 = 0;
++	hc_intr_mask.b.chhltd = 1;
++	if (core_if->dma_enable) {
++		/* For Descriptor DMA mode core halts the channel on AHB error. Interrupt is not required */
++		if (!core_if->dma_desc_enable)
++			hc_intr_mask.b.ahberr = 1;
++		else {
++			if (hc->ep_type == DWC_OTG_EP_TYPE_ISOC)
++				hc_intr_mask.b.xfercompl = 1;
++		}
++
++		if (hc->error_state && !hc->do_split &&
++		    hc->ep_type != DWC_OTG_EP_TYPE_ISOC) {
++			hc_intr_mask.b.ack = 1;
++			if (hc->ep_is_in) {
++				hc_intr_mask.b.datatglerr = 1;
++				if (hc->ep_type != DWC_OTG_EP_TYPE_INTR) {
++					hc_intr_mask.b.nak = 1;
++				}
++			}
++		}
++	} else {
++		switch (hc->ep_type) {
++		case DWC_OTG_EP_TYPE_CONTROL:
++		case DWC_OTG_EP_TYPE_BULK:
++			hc_intr_mask.b.xfercompl = 1;
++			hc_intr_mask.b.stall = 1;
++			hc_intr_mask.b.xacterr = 1;
++			hc_intr_mask.b.datatglerr = 1;
++			if (hc->ep_is_in) {
++				hc_intr_mask.b.bblerr = 1;
++			} else {
++				hc_intr_mask.b.nak = 1;
++				hc_intr_mask.b.nyet = 1;
++				if (hc->do_ping) {
++					hc_intr_mask.b.ack = 1;
++				}
++			}
++
++			if (hc->do_split) {
++				hc_intr_mask.b.nak = 1;
++				if (hc->complete_split) {
++					hc_intr_mask.b.nyet = 1;
++				} else {
++					hc_intr_mask.b.ack = 1;
++				}
++			}
++
++			if (hc->error_state) {
++				hc_intr_mask.b.ack = 1;
++			}
++			break;
++		case DWC_OTG_EP_TYPE_INTR:
++			hc_intr_mask.b.xfercompl = 1;
++			hc_intr_mask.b.nak = 1;
++			hc_intr_mask.b.stall = 1;
++			hc_intr_mask.b.xacterr = 1;
++			hc_intr_mask.b.datatglerr = 1;
++			hc_intr_mask.b.frmovrun = 1;
++
++			if (hc->ep_is_in) {
++				hc_intr_mask.b.bblerr = 1;
++			}
++			if (hc->error_state) {
++				hc_intr_mask.b.ack = 1;
++			}
++			if (hc->do_split) {
++				if (hc->complete_split) {
++					hc_intr_mask.b.nyet = 1;
++				} else {
++					hc_intr_mask.b.ack = 1;
++				}
++			}
++			break;
++		case DWC_OTG_EP_TYPE_ISOC:
++			hc_intr_mask.b.xfercompl = 1;
++			hc_intr_mask.b.frmovrun = 1;
++			hc_intr_mask.b.ack = 1;
++
++			if (hc->ep_is_in) {
++				hc_intr_mask.b.xacterr = 1;
++				hc_intr_mask.b.bblerr = 1;
++			}
++			break;
++		}
++	}
++	DWC_WRITE_REG32(&hc_regs->hcintmsk, hc_intr_mask.d32);
++
++	/*
++	 * Program the HCCHARn register with the endpoint characteristics for
++	 * the current transfer.
++	 */
++	hcchar.d32 = 0;
++	hcchar.b.devaddr = hc->dev_addr;
++	hcchar.b.epnum = hc->ep_num;
++	hcchar.b.epdir = hc->ep_is_in;
++	hcchar.b.lspddev = (hc->speed == DWC_OTG_EP_SPEED_LOW);
++	hcchar.b.eptype = hc->ep_type;
++	hcchar.b.mps = hc->max_packet;
++
++	DWC_WRITE_REG32(&host_if->hc_regs[hc_num]->hcchar, hcchar.d32);
++
++	DWC_DEBUGPL(DBG_HCDV, "%s: Channel %d, Dev Addr %d, EP #%d\n",
++                    __func__, hc->hc_num, hcchar.b.devaddr, hcchar.b.epnum);
++	DWC_DEBUGPL(DBG_HCDV, "	 Is In %d, Is Low Speed %d, EP Type %d, "
++                                "Max Pkt %d, Multi Cnt %d\n",
++                    hcchar.b.epdir, hcchar.b.lspddev, hcchar.b.eptype,
++                    hcchar.b.mps, hcchar.b.multicnt);
++
++	/*
++	 * Program the HCSPLIT register for SPLITs
++	 */
++	hcsplt.d32 = 0;
++	if (hc->do_split) {
++		DWC_DEBUGPL(DBG_HCDV, "Programming HC %d with split --> %s\n",
++			    hc->hc_num,
++			    hc->complete_split ? "CSPLIT" : "SSPLIT");
++		hcsplt.b.compsplt = hc->complete_split;
++		hcsplt.b.xactpos = hc->xact_pos;
++		hcsplt.b.hubaddr = hc->hub_addr;
++		hcsplt.b.prtaddr = hc->port_addr;
++		DWC_DEBUGPL(DBG_HCDV, "\t  comp split %d\n", hc->complete_split);
++		DWC_DEBUGPL(DBG_HCDV, "\t  xact pos %d\n", hc->xact_pos);
++		DWC_DEBUGPL(DBG_HCDV, "\t  hub addr %d\n", hc->hub_addr);
++		DWC_DEBUGPL(DBG_HCDV, "\t  port addr %d\n", hc->port_addr);
++		DWC_DEBUGPL(DBG_HCDV, "\t  is_in %d\n", hc->ep_is_in);
++		DWC_DEBUGPL(DBG_HCDV, "\t  Max Pkt: %d\n", hcchar.b.mps);
++		DWC_DEBUGPL(DBG_HCDV, "\t  xferlen: %d\n", hc->xfer_len);
++	}
++	DWC_WRITE_REG32(&host_if->hc_regs[hc_num]->hcsplt, hcsplt.d32);
++
++}
++
++/**
++ * Attempts to halt a host channel. This function should only be called in
++ * Slave mode or to abort a transfer in either Slave mode or DMA mode. Under
++ * normal circumstances in DMA mode, the controller halts the channel when the
++ * transfer is complete or a condition occurs that requires application
++ * intervention.
++ *
++ * In slave mode, checks for a free request queue entry, then sets the Channel
++ * Enable and Channel Disable bits of the Host Channel Characteristics
++ * register of the specified channel to intiate the halt. If there is no free
++ * request queue entry, sets only the Channel Disable bit of the HCCHARn
++ * register to flush requests for this channel. In the latter case, sets a
++ * flag to indicate that the host channel needs to be halted when a request
++ * queue slot is open.
++ *
++ * In DMA mode, always sets the Channel Enable and Channel Disable bits of the
++ * HCCHARn register. The controller ensures there is space in the request
++ * queue before submitting the halt request.
++ *
++ * Some time may elapse before the core flushes any posted requests for this
++ * host channel and halts. The Channel Halted interrupt handler completes the
++ * deactivation of the host channel.
++ *
++ * @param core_if Controller register interface.
++ * @param hc Host channel to halt.
++ * @param halt_status Reason for halting the channel.
++ */
++void dwc_otg_hc_halt(dwc_otg_core_if_t * core_if,
++		     dwc_hc_t * hc, dwc_otg_halt_status_e halt_status)
++{
++	gnptxsts_data_t nptxsts;
++	hptxsts_data_t hptxsts;
++	hcchar_data_t hcchar;
++	dwc_otg_hc_regs_t *hc_regs;
++	dwc_otg_core_global_regs_t *global_regs;
++	dwc_otg_host_global_regs_t *host_global_regs;
++
++	hc_regs = core_if->host_if->hc_regs[hc->hc_num];
++	global_regs = core_if->core_global_regs;
++	host_global_regs = core_if->host_if->host_global_regs;
++
++	DWC_ASSERT(!(halt_status == DWC_OTG_HC_XFER_NO_HALT_STATUS),
++		   "halt_status = %d\n", halt_status);
++
++	if (halt_status == DWC_OTG_HC_XFER_URB_DEQUEUE ||
++	    halt_status == DWC_OTG_HC_XFER_AHB_ERR) {
++		/*
++		 * Disable all channel interrupts except Ch Halted. The QTD
++		 * and QH state associated with this transfer has been cleared
++		 * (in the case of URB_DEQUEUE), so the channel needs to be
++		 * shut down carefully to prevent crashes.
++		 */
++		hcintmsk_data_t hcintmsk;
++		hcintmsk.d32 = 0;
++		hcintmsk.b.chhltd = 1;
++		DWC_WRITE_REG32(&hc_regs->hcintmsk, hcintmsk.d32);
++
++		/*
++		 * Make sure no other interrupts besides halt are currently
++		 * pending. Handling another interrupt could cause a crash due
++		 * to the QTD and QH state.
++		 */
++		DWC_WRITE_REG32(&hc_regs->hcint, ~hcintmsk.d32);
++
++		/*
++		 * Make sure the halt status is set to URB_DEQUEUE or AHB_ERR
++		 * even if the channel was already halted for some other
++		 * reason.
++		 */
++		hc->halt_status = halt_status;
++
++		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++		if (hcchar.b.chen == 0) {
++			/*
++			 * The channel is either already halted or it hasn't
++			 * started yet. In DMA mode, the transfer may halt if
++			 * it finishes normally or a condition occurs that
++			 * requires driver intervention. Don't want to halt
++			 * the channel again. In either Slave or DMA mode,
++			 * it's possible that the transfer has been assigned
++			 * to a channel, but not started yet when an URB is
++			 * dequeued. Don't want to halt a channel that hasn't
++			 * started yet.
++			 */
++			return;
++		}
++	}
++	if (hc->halt_pending) {
++		/*
++		 * A halt has already been issued for this channel. This might
++		 * happen when a transfer is aborted by a higher level in
++		 * the stack.
++		 */
++#ifdef DEBUG
++		DWC_PRINTF
++		    ("*** %s: Channel %d, _hc->halt_pending already set ***\n",
++		     __func__, hc->hc_num);
++
++#endif
++		return;
++	}
++
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++
++	/* No need to set the bit in DDMA for disabling the channel */
++	//TODO check it everywhere channel is disabled
++	if (!core_if->core_params->dma_desc_enable)
++		hcchar.b.chen = 1;
++	hcchar.b.chdis = 1;
++
++	if (!core_if->dma_enable) {
++		/* Check for space in the request queue to issue the halt. */
++		if (hc->ep_type == DWC_OTG_EP_TYPE_CONTROL ||
++		    hc->ep_type == DWC_OTG_EP_TYPE_BULK) {
++			nptxsts.d32 = DWC_READ_REG32(&global_regs->gnptxsts);
++			if (nptxsts.b.nptxqspcavail == 0) {
++				hcchar.b.chen = 0;
++			}
++		} else {
++			hptxsts.d32 =
++			    DWC_READ_REG32(&host_global_regs->hptxsts);
++			if ((hptxsts.b.ptxqspcavail == 0)
++			    || (core_if->queuing_high_bandwidth)) {
++				hcchar.b.chen = 0;
++			}
++		}
++	}
++	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++
++	hc->halt_status = halt_status;
++
++	if (hcchar.b.chen) {
++		hc->halt_pending = 1;
++		hc->halt_on_queue = 0;
++	} else {
++		hc->halt_on_queue = 1;
++	}
++
++	DWC_DEBUGPL(DBG_HCDV, "%s: Channel %d\n", __func__, hc->hc_num);
++	DWC_DEBUGPL(DBG_HCDV, "	 hcchar: 0x%08x\n", hcchar.d32);
++	DWC_DEBUGPL(DBG_HCDV, "	 halt_pending: %d\n", hc->halt_pending);
++	DWC_DEBUGPL(DBG_HCDV, "	 halt_on_queue: %d\n", hc->halt_on_queue);
++	DWC_DEBUGPL(DBG_HCDV, "	 halt_status: %d\n", hc->halt_status);
++
++	return;
++}
++
++/**
++ * Clears the transfer state for a host channel. This function is normally
++ * called after a transfer is done and the host channel is being released.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param hc Identifies the host channel to clean up.
++ */
++void dwc_otg_hc_cleanup(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
++{
++	dwc_otg_hc_regs_t *hc_regs;
++
++	hc->xfer_started = 0;
++
++	/*
++	 * Clear channel interrupt enables and any unhandled channel interrupt
++	 * conditions.
++	 */
++	hc_regs = core_if->host_if->hc_regs[hc->hc_num];
++	DWC_WRITE_REG32(&hc_regs->hcintmsk, 0);
++	DWC_WRITE_REG32(&hc_regs->hcint, 0xFFFFFFFF);
++#ifdef DEBUG
++	DWC_TIMER_CANCEL(core_if->hc_xfer_timer[hc->hc_num]);
++#endif
++}
++
++/**
++ * Sets the channel property that indicates in which frame a periodic transfer
++ * should occur. This is always set to the _next_ frame. This function has no
++ * effect on non-periodic transfers.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param hc Identifies the host channel to set up and its properties.
++ * @param hcchar Current value of the HCCHAR register for the specified host
++ * channel.
++ */
++static inline void hc_set_even_odd_frame(dwc_otg_core_if_t * core_if,
++					 dwc_hc_t * hc, hcchar_data_t * hcchar)
++{
++	if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
++	    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
++		hfnum_data_t hfnum;
++		hfnum.d32 =
++		    DWC_READ_REG32(&core_if->host_if->host_global_regs->hfnum);
++
++		/* 1 if _next_ frame is odd, 0 if it's even */
++		hcchar->b.oddfrm = (hfnum.b.frnum & 0x1) ? 0 : 1;
++#ifdef DEBUG
++		if (hc->ep_type == DWC_OTG_EP_TYPE_INTR && hc->do_split
++		    && !hc->complete_split) {
++			switch (hfnum.b.frnum & 0x7) {
++			case 7:
++				core_if->hfnum_7_samples++;
++				core_if->hfnum_7_frrem_accum += hfnum.b.frrem;
++				break;
++			case 0:
++				core_if->hfnum_0_samples++;
++				core_if->hfnum_0_frrem_accum += hfnum.b.frrem;
++				break;
++			default:
++				core_if->hfnum_other_samples++;
++				core_if->hfnum_other_frrem_accum +=
++				    hfnum.b.frrem;
++				break;
++			}
++		}
++#endif
++	}
++}
++
++#ifdef DEBUG
++void hc_xfer_timeout(void *ptr)
++{
++	hc_xfer_info_t *xfer_info = NULL;
++	int hc_num = 0;
++
++	if (ptr)
++		xfer_info = (hc_xfer_info_t *) ptr;
++
++	if (!xfer_info->hc) {
++		DWC_ERROR("xfer_info->hc = %p\n", xfer_info->hc);
++		return;
++	}
++
++	hc_num = xfer_info->hc->hc_num;
++	DWC_WARN("%s: timeout on channel %d\n", __func__, hc_num);
++	DWC_WARN("	start_hcchar_val 0x%08x\n",
++		 xfer_info->core_if->start_hcchar_val[hc_num]);
++}
++#endif
++
++void ep_xfer_timeout(void *ptr)
++{
++	ep_xfer_info_t *xfer_info = NULL;
++	int ep_num = 0;
++	dctl_data_t dctl = {.d32 = 0 };
++	gintsts_data_t gintsts = {.d32 = 0 };
++	gintmsk_data_t gintmsk = {.d32 = 0 };
++
++	if (ptr)
++		xfer_info = (ep_xfer_info_t *) ptr;
++
++	if (!xfer_info->ep) {
++		DWC_ERROR("xfer_info->ep = %p\n", xfer_info->ep);
++		return;
++	}
++
++	ep_num = xfer_info->ep->num;
++	DWC_WARN("%s: timeout on endpoit %d\n", __func__, ep_num);
++	/* Put the sate to 2 as it was time outed */
++	xfer_info->state = 2;
++
++	dctl.d32 =
++	    DWC_READ_REG32(&xfer_info->core_if->dev_if->dev_global_regs->dctl);
++	gintsts.d32 =
++	    DWC_READ_REG32(&xfer_info->core_if->core_global_regs->gintsts);
++	gintmsk.d32 =
++	    DWC_READ_REG32(&xfer_info->core_if->core_global_regs->gintmsk);
++
++	if (!gintmsk.b.goutnakeff) {
++		/* Unmask it */
++		gintmsk.b.goutnakeff = 1;
++		DWC_WRITE_REG32(&xfer_info->core_if->core_global_regs->gintmsk,
++				gintmsk.d32);
++
++	}
++
++	if (!gintsts.b.goutnakeff) {
++		dctl.b.sgoutnak = 1;
++	}
++	DWC_WRITE_REG32(&xfer_info->core_if->dev_if->dev_global_regs->dctl,
++			dctl.d32);
++
++}
++
++static void set_pid_isoc(dwc_hc_t * hc)
++{
++	/* Set up the initial PID for the transfer. */
++	if (hc->speed == DWC_OTG_EP_SPEED_HIGH) {
++		if (hc->ep_is_in) {
++			if (hc->multi_count == 1) {
++				hc->data_pid_start = DWC_OTG_HC_PID_DATA0;
++			} else if (hc->multi_count == 2) {
++				hc->data_pid_start = DWC_OTG_HC_PID_DATA1;
++			} else {
++				hc->data_pid_start = DWC_OTG_HC_PID_DATA2;
++			}
++		} else {
++			if (hc->multi_count == 1) {
++				hc->data_pid_start = DWC_OTG_HC_PID_DATA0;
++			} else {
++				hc->data_pid_start = DWC_OTG_HC_PID_MDATA;
++			}
++		}
++	} else {
++		hc->data_pid_start = DWC_OTG_HC_PID_DATA0;
++	}
++}
++
++/**
++ * This function does the setup for a data transfer for a host channel and
++ * starts the transfer. May be called in either Slave mode or DMA mode. In
++ * Slave mode, the caller must ensure that there is sufficient space in the
++ * request queue and Tx Data FIFO.
++ *
++ * For an OUT transfer in Slave mode, it loads a data packet into the
++ * appropriate FIFO. If necessary, additional data packets will be loaded in
++ * the Host ISR.
++ *
++ * For an IN transfer in Slave mode, a data packet is requested. The data
++ * packets are unloaded from the Rx FIFO in the Host ISR. If necessary,
++ * additional data packets are requested in the Host ISR.
++ *
++ * For a PING transfer in Slave mode, the Do Ping bit is set in the HCTSIZ
++ * register along with a packet count of 1 and the channel is enabled. This
++ * causes a single PING transaction to occur. Other fields in HCTSIZ are
++ * simply set to 0 since no data transfer occurs in this case.
++ *
++ * For a PING transfer in DMA mode, the HCTSIZ register is initialized with
++ * all the information required to perform the subsequent data transfer. In
++ * addition, the Do Ping bit is set in the HCTSIZ register. In this case, the
++ * controller performs the entire PING protocol, then starts the data
++ * transfer.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param hc Information needed to initialize the host channel. The xfer_len
++ * value may be reduced to accommodate the max widths of the XferSize and
++ * PktCnt fields in the HCTSIZn register. The multi_count value may be changed
++ * to reflect the final xfer_len value.
++ */
++void dwc_otg_hc_start_transfer(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
++{
++	hcchar_data_t hcchar;
++	hctsiz_data_t hctsiz;
++	uint16_t num_packets;
++	uint32_t max_hc_xfer_size = core_if->core_params->max_transfer_size;
++	uint16_t max_hc_pkt_count = core_if->core_params->max_packet_count;
++	dwc_otg_hc_regs_t *hc_regs = core_if->host_if->hc_regs[hc->hc_num];
++
++	hctsiz.d32 = 0;
++
++	if (hc->do_ping) {
++		if (!core_if->dma_enable) {
++			dwc_otg_hc_do_ping(core_if, hc);
++			hc->xfer_started = 1;
++			return;
++		} else {
++			hctsiz.b.dopng = 1;
++		}
++	}
++
++	if (hc->do_split) {
++		num_packets = 1;
++
++		if (hc->complete_split && !hc->ep_is_in) {
++			/* For CSPLIT OUT Transfer, set the size to 0 so the
++			 * core doesn't expect any data written to the FIFO */
++			hc->xfer_len = 0;
++		} else if (hc->ep_is_in || (hc->xfer_len > hc->max_packet)) {
++			hc->xfer_len = hc->max_packet;
++		} else if (!hc->ep_is_in && (hc->xfer_len > 188)) {
++			hc->xfer_len = 188;
++		}
++
++		hctsiz.b.xfersize = hc->xfer_len;
++	} else {
++		/*
++		 * Ensure that the transfer length and packet count will fit
++		 * in the widths allocated for them in the HCTSIZn register.
++		 */
++		if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
++		    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
++			/*
++			 * Make sure the transfer size is no larger than one
++			 * (micro)frame's worth of data. (A check was done
++			 * when the periodic transfer was accepted to ensure
++			 * that a (micro)frame's worth of data can be
++			 * programmed into a channel.)
++			 */
++			uint32_t max_periodic_len =
++			    hc->multi_count * hc->max_packet;
++			if (hc->xfer_len > max_periodic_len) {
++				hc->xfer_len = max_periodic_len;
++			} else {
++			}
++		} else if (hc->xfer_len > max_hc_xfer_size) {
++			/* Make sure that xfer_len is a multiple of max packet size. */
++			hc->xfer_len = max_hc_xfer_size - hc->max_packet + 1;
++		}
++
++		if (hc->xfer_len > 0) {
++			num_packets =
++			    (hc->xfer_len + hc->max_packet -
++			     1) / hc->max_packet;
++			if (num_packets > max_hc_pkt_count) {
++				num_packets = max_hc_pkt_count;
++				hc->xfer_len = num_packets * hc->max_packet;
++			}
++		} else {
++			/* Need 1 packet for transfer length of 0. */
++			num_packets = 1;
++		}
++
++		if (hc->ep_is_in) {
++			/* Always program an integral # of max packets for IN transfers. */
++			hc->xfer_len = num_packets * hc->max_packet;
++		}
++
++		if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
++		    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
++			/*
++			 * Make sure that the multi_count field matches the
++			 * actual transfer length.
++			 */
++			hc->multi_count = num_packets;
++		}
++
++		if (hc->ep_type == DWC_OTG_EP_TYPE_ISOC)
++			set_pid_isoc(hc);
++
++		hctsiz.b.xfersize = hc->xfer_len;
++	}
++
++	hc->start_pkt_count = num_packets;
++	hctsiz.b.pktcnt = num_packets;
++	hctsiz.b.pid = hc->data_pid_start;
++	DWC_WRITE_REG32(&hc_regs->hctsiz, hctsiz.d32);
++
++	DWC_DEBUGPL(DBG_HCDV, "%s: Channel %d\n", __func__, hc->hc_num);
++	DWC_DEBUGPL(DBG_HCDV, "	 Xfer Size: %d\n", hctsiz.b.xfersize);
++	DWC_DEBUGPL(DBG_HCDV, "	 Num Pkts: %d\n", hctsiz.b.pktcnt);
++	DWC_DEBUGPL(DBG_HCDV, "	 Start PID: %d\n", hctsiz.b.pid);
++
++	if (core_if->dma_enable) {
++		dwc_dma_t dma_addr;
++		if (hc->align_buff) {
++			dma_addr = hc->align_buff;
++		} else {
++			dma_addr = ((unsigned long)hc->xfer_buff & 0xffffffff);
++		}
++		DWC_WRITE_REG32(&hc_regs->hcdma, dma_addr);
++	}
++
++	/* Start the split */
++	if (hc->do_split) {
++		hcsplt_data_t hcsplt;
++		hcsplt.d32 = DWC_READ_REG32(&hc_regs->hcsplt);
++		hcsplt.b.spltena = 1;
++		DWC_WRITE_REG32(&hc_regs->hcsplt, hcsplt.d32);
++	}
++
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	hcchar.b.multicnt = hc->multi_count;
++	hc_set_even_odd_frame(core_if, hc, &hcchar);
++#ifdef DEBUG
++	core_if->start_hcchar_val[hc->hc_num] = hcchar.d32;
++	if (hcchar.b.chdis) {
++		DWC_WARN("%s: chdis set, channel %d, hcchar 0x%08x\n",
++			 __func__, hc->hc_num, hcchar.d32);
++	}
++#endif
++
++	/* Set host channel enable after all other setup is complete. */
++	hcchar.b.chen = 1;
++	hcchar.b.chdis = 0;
++	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++
++	hc->xfer_started = 1;
++	hc->requests++;
++
++	if (!core_if->dma_enable && !hc->ep_is_in && hc->xfer_len > 0) {
++		/* Load OUT packet into the appropriate Tx FIFO. */
++		dwc_otg_hc_write_packet(core_if, hc);
++	}
++#ifdef DEBUG
++	if (hc->ep_type != DWC_OTG_EP_TYPE_INTR) {
++                DWC_DEBUGPL(DBG_HCDV, "transfer %d from core_if %p\n",
++                            hc->hc_num, core_if);//GRAYG
++		core_if->hc_xfer_info[hc->hc_num].core_if = core_if;
++		core_if->hc_xfer_info[hc->hc_num].hc = hc;
++
++		/* Start a timer for this transfer. */
++		DWC_TIMER_SCHEDULE(core_if->hc_xfer_timer[hc->hc_num], 10000);
++	}
++#endif
++}
++
++/**
++ * This function does the setup for a data transfer for a host channel
++ * and starts the transfer in Descriptor DMA mode.
++ *
++ * Initializes HCTSIZ register. For a PING transfer the Do Ping bit is set.
++ * Sets PID and NTD values. For periodic transfers
++ * initializes SCHED_INFO field with micro-frame bitmap.
++ *
++ * Initializes HCDMA register with descriptor list address and CTD value
++ * then starts the transfer via enabling the channel.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param hc Information needed to initialize the host channel.
++ */
++void dwc_otg_hc_start_transfer_ddma(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
++{
++	dwc_otg_hc_regs_t *hc_regs = core_if->host_if->hc_regs[hc->hc_num];
++	hcchar_data_t hcchar;
++	hctsiz_data_t hctsiz;
++	hcdma_data_t hcdma;
++
++	hctsiz.d32 = 0;
++
++	if (hc->do_ping)
++		hctsiz.b_ddma.dopng = 1;
++
++	if (hc->ep_type == DWC_OTG_EP_TYPE_ISOC)
++		set_pid_isoc(hc);
++
++	/* Packet Count and Xfer Size are not used in Descriptor DMA mode */
++	hctsiz.b_ddma.pid = hc->data_pid_start;
++	hctsiz.b_ddma.ntd = hc->ntd - 1;	/* 0 - 1 descriptor, 1 - 2 descriptors, etc. */
++	hctsiz.b_ddma.schinfo = hc->schinfo;	/* Non-zero only for high-speed interrupt endpoints */
++
++	DWC_DEBUGPL(DBG_HCDV, "%s: Channel %d\n", __func__, hc->hc_num);
++	DWC_DEBUGPL(DBG_HCDV, "	 Start PID: %d\n", hctsiz.b.pid);
++	DWC_DEBUGPL(DBG_HCDV, "	 NTD: %d\n", hctsiz.b_ddma.ntd);
++
++	DWC_WRITE_REG32(&hc_regs->hctsiz, hctsiz.d32);
++
++	hcdma.d32 = 0;
++	hcdma.b.dma_addr = ((uint32_t) hc->desc_list_addr) >> 11;
++
++	/* Always start from first descriptor. */
++	hcdma.b.ctd = 0;
++	DWC_WRITE_REG32(&hc_regs->hcdma, hcdma.d32);
++
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	hcchar.b.multicnt = hc->multi_count;
++
++#ifdef DEBUG
++	core_if->start_hcchar_val[hc->hc_num] = hcchar.d32;
++	if (hcchar.b.chdis) {
++		DWC_WARN("%s: chdis set, channel %d, hcchar 0x%08x\n",
++			 __func__, hc->hc_num, hcchar.d32);
++	}
++#endif
++
++	/* Set host channel enable after all other setup is complete. */
++	hcchar.b.chen = 1;
++	hcchar.b.chdis = 0;
++
++	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++
++	hc->xfer_started = 1;
++	hc->requests++;
++
++#ifdef DEBUG
++	if ((hc->ep_type != DWC_OTG_EP_TYPE_INTR)
++	    && (hc->ep_type != DWC_OTG_EP_TYPE_ISOC)) {
++                DWC_DEBUGPL(DBG_HCDV, "DMA transfer %d from core_if %p\n",
++                            hc->hc_num, core_if);//GRAYG
++		core_if->hc_xfer_info[hc->hc_num].core_if = core_if;
++		core_if->hc_xfer_info[hc->hc_num].hc = hc;
++		/* Start a timer for this transfer. */
++		DWC_TIMER_SCHEDULE(core_if->hc_xfer_timer[hc->hc_num], 10000);
++	}
++#endif
++
++}
++
++/**
++ * This function continues a data transfer that was started by previous call
++ * to <code>dwc_otg_hc_start_transfer</code>. The caller must ensure there is
++ * sufficient space in the request queue and Tx Data FIFO. This function
++ * should only be called in Slave mode. In DMA mode, the controller acts
++ * autonomously to complete transfers programmed to a host channel.
++ *
++ * For an OUT transfer, a new data packet is loaded into the appropriate FIFO
++ * if there is any data remaining to be queued. For an IN transfer, another
++ * data packet is always requested. For the SETUP phase of a control transfer,
++ * this function does nothing.
++ *
++ * @return 1 if a new request is queued, 0 if no more requests are required
++ * for this transfer.
++ */
++int dwc_otg_hc_continue_transfer(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
++{
++	DWC_DEBUGPL(DBG_HCDV, "%s: Channel %d\n", __func__, hc->hc_num);
++
++	if (hc->do_split) {
++		/* SPLITs always queue just once per channel */
++		return 0;
++	} else if (hc->data_pid_start == DWC_OTG_HC_PID_SETUP) {
++		/* SETUPs are queued only once since they can't be NAKed. */
++		return 0;
++	} else if (hc->ep_is_in) {
++		/*
++		 * Always queue another request for other IN transfers. If
++		 * back-to-back INs are issued and NAKs are received for both,
++		 * the driver may still be processing the first NAK when the
++		 * second NAK is received. When the interrupt handler clears
++		 * the NAK interrupt for the first NAK, the second NAK will
++		 * not be seen. So we can't depend on the NAK interrupt
++		 * handler to requeue a NAKed request. Instead, IN requests
++		 * are issued each time this function is called. When the
++		 * transfer completes, the extra requests for the channel will
++		 * be flushed.
++		 */
++		hcchar_data_t hcchar;
++		dwc_otg_hc_regs_t *hc_regs =
++		    core_if->host_if->hc_regs[hc->hc_num];
++
++		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++		hc_set_even_odd_frame(core_if, hc, &hcchar);
++		hcchar.b.chen = 1;
++		hcchar.b.chdis = 0;
++		DWC_DEBUGPL(DBG_HCDV, "	 IN xfer: hcchar = 0x%08x\n",
++			    hcchar.d32);
++		DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++		hc->requests++;
++		return 1;
++	} else {
++		/* OUT transfers. */
++		if (hc->xfer_count < hc->xfer_len) {
++			if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
++			    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
++				hcchar_data_t hcchar;
++				dwc_otg_hc_regs_t *hc_regs;
++				hc_regs = core_if->host_if->hc_regs[hc->hc_num];
++				hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++				hc_set_even_odd_frame(core_if, hc, &hcchar);
++			}
++
++			/* Load OUT packet into the appropriate Tx FIFO. */
++			dwc_otg_hc_write_packet(core_if, hc);
++			hc->requests++;
++			return 1;
++		} else {
++			return 0;
++		}
++	}
++}
++
++/**
++ * Starts a PING transfer. This function should only be called in Slave mode.
++ * The Do Ping bit is set in the HCTSIZ register, then the channel is enabled.
++ */
++void dwc_otg_hc_do_ping(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
++{
++	hcchar_data_t hcchar;
++	hctsiz_data_t hctsiz;
++	dwc_otg_hc_regs_t *hc_regs = core_if->host_if->hc_regs[hc->hc_num];
++
++	DWC_DEBUGPL(DBG_HCDV, "%s: Channel %d\n", __func__, hc->hc_num);
++
++	hctsiz.d32 = 0;
++	hctsiz.b.dopng = 1;
++	hctsiz.b.pktcnt = 1;
++	DWC_WRITE_REG32(&hc_regs->hctsiz, hctsiz.d32);
++
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	hcchar.b.chen = 1;
++	hcchar.b.chdis = 0;
++	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++}
++
++/*
++ * This function writes a packet into the Tx FIFO associated with the Host
++ * Channel. For a channel associated with a non-periodic EP, the non-periodic
++ * Tx FIFO is written. For a channel associated with a periodic EP, the
++ * periodic Tx FIFO is written. This function should only be called in Slave
++ * mode.
++ *
++ * Upon return the xfer_buff and xfer_count fields in _hc are incremented by
++ * then number of bytes written to the Tx FIFO.
++ */
++void dwc_otg_hc_write_packet(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
++{
++	uint32_t i;
++	uint32_t remaining_count;
++	uint32_t byte_count;
++	uint32_t dword_count;
++
++	uint32_t *data_buff = (uint32_t *) (hc->xfer_buff);
++	uint32_t *data_fifo = core_if->data_fifo[hc->hc_num];
++
++	remaining_count = hc->xfer_len - hc->xfer_count;
++	if (remaining_count > hc->max_packet) {
++		byte_count = hc->max_packet;
++	} else {
++		byte_count = remaining_count;
++	}
++
++	dword_count = (byte_count + 3) / 4;
++
++	if ((((unsigned long)data_buff) & 0x3) == 0) {
++		/* xfer_buff is DWORD aligned. */
++		for (i = 0; i < dword_count; i++, data_buff++) {
++			DWC_WRITE_REG32(data_fifo, *data_buff);
++		}
++	} else {
++		/* xfer_buff is not DWORD aligned. */
++		for (i = 0; i < dword_count; i++, data_buff++) {
++			uint32_t data;
++			data =
++			    (data_buff[0] | data_buff[1] << 8 | data_buff[2] <<
++			     16 | data_buff[3] << 24);
++			DWC_WRITE_REG32(data_fifo, data);
++		}
++	}
++
++	hc->xfer_count += byte_count;
++	hc->xfer_buff += byte_count;
++}
++
++/**
++ * Gets the current USB frame number. This is the frame number from the last
++ * SOF packet.
++ */
++uint32_t dwc_otg_get_frame_number(dwc_otg_core_if_t * core_if)
++{
++	dsts_data_t dsts;
++	dsts.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
++
++	/* read current frame/microframe number from DSTS register */
++	return dsts.b.soffn;
++}
++
++/**
++ * Calculates and gets the frame Interval value of HFIR register according PHY
++ * type and speed.The application can modify a value of HFIR register only after
++ * the Port Enable bit of the Host Port Control and Status register
++ * (HPRT.PrtEnaPort) has been set.
++*/
++
++uint32_t calc_frame_interval(dwc_otg_core_if_t * core_if)
++{
++	gusbcfg_data_t usbcfg;
++	hwcfg2_data_t hwcfg2;
++	hprt0_data_t hprt0;
++	int clock = 60;		// default value
++	usbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
++	hwcfg2.d32 = DWC_READ_REG32(&core_if->core_global_regs->ghwcfg2);
++	hprt0.d32 = DWC_READ_REG32(core_if->host_if->hprt0);
++	if (!usbcfg.b.physel && usbcfg.b.ulpi_utmi_sel && !usbcfg.b.phyif)
++		clock = 60;
++	if (usbcfg.b.physel && hwcfg2.b.fs_phy_type == 3)
++		clock = 48;
++	if (!usbcfg.b.phylpwrclksel && !usbcfg.b.physel &&
++	    !usbcfg.b.ulpi_utmi_sel && usbcfg.b.phyif)
++		clock = 30;
++	if (!usbcfg.b.phylpwrclksel && !usbcfg.b.physel &&
++	    !usbcfg.b.ulpi_utmi_sel && !usbcfg.b.phyif)
++		clock = 60;
++	if (usbcfg.b.phylpwrclksel && !usbcfg.b.physel &&
++	    !usbcfg.b.ulpi_utmi_sel && usbcfg.b.phyif)
++		clock = 48;
++	if (usbcfg.b.physel && !usbcfg.b.phyif && hwcfg2.b.fs_phy_type == 2)
++		clock = 48;
++	if (usbcfg.b.physel && hwcfg2.b.fs_phy_type == 1)
++		clock = 48;
++	if (hprt0.b.prtspd == 0)
++		/* High speed case */
++		return 125 * clock - 1;
++	else
++		/* FS/LS case */
++		return 1000 * clock - 1;
++}
++
++/**
++ * This function reads a setup packet from the Rx FIFO into the destination
++ * buffer. This function is called from the Rx Status Queue Level (RxStsQLvl)
++ * Interrupt routine when a SETUP packet has been received in Slave mode.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param dest Destination buffer for packet data.
++ */
++void dwc_otg_read_setup_packet(dwc_otg_core_if_t * core_if, uint32_t * dest)
++{
++	device_grxsts_data_t status;
++	/* Get the 8 bytes of a setup transaction data */
++
++	/* Pop 2 DWORDS off the receive data FIFO into memory */
++	dest[0] = DWC_READ_REG32(core_if->data_fifo[0]);
++	dest[1] = DWC_READ_REG32(core_if->data_fifo[0]);
++	if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
++		status.d32 =
++		    DWC_READ_REG32(&core_if->core_global_regs->grxstsp);
++		DWC_DEBUGPL(DBG_ANY,
++			    "EP:%d BCnt:%d " "pktsts:%x Frame:%d(0x%0x)\n",
++			    status.b.epnum, status.b.bcnt, status.b.pktsts,
++			    status.b.fn, status.b.fn);
++	}
++}
++
++/**
++ * This function enables EP0 OUT to receive SETUP packets and configures EP0
++ * IN for transmitting packets. It is normally called when the
++ * "Enumeration Done" interrupt occurs.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP0 data.
++ */
++void dwc_otg_ep0_activate(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	dsts_data_t dsts;
++	depctl_data_t diepctl;
++	depctl_data_t doepctl;
++	dctl_data_t dctl = {.d32 = 0 };
++
++	ep->stp_rollover = 0;
++	/* Read the Device Status and Endpoint 0 Control registers */
++	dsts.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dsts);
++	diepctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[0]->diepctl);
++	doepctl.d32 = DWC_READ_REG32(&dev_if->out_ep_regs[0]->doepctl);
++
++	/* Set the MPS of the IN EP based on the enumeration speed */
++	switch (dsts.b.enumspd) {
++	case DWC_DSTS_ENUMSPD_HS_PHY_30MHZ_OR_60MHZ:
++	case DWC_DSTS_ENUMSPD_FS_PHY_30MHZ_OR_60MHZ:
++	case DWC_DSTS_ENUMSPD_FS_PHY_48MHZ:
++		diepctl.b.mps = DWC_DEP0CTL_MPS_64;
++		break;
++	case DWC_DSTS_ENUMSPD_LS_PHY_6MHZ:
++		diepctl.b.mps = DWC_DEP0CTL_MPS_8;
++		break;
++	}
++
++	DWC_WRITE_REG32(&dev_if->in_ep_regs[0]->diepctl, diepctl.d32);
++
++	/* Enable OUT EP for receive */
++	if (core_if->snpsid <= OTG_CORE_REV_2_94a) {
++	doepctl.b.epena = 1;
++	DWC_WRITE_REG32(&dev_if->out_ep_regs[0]->doepctl, doepctl.d32);
++	}
++#ifdef VERBOSE
++	DWC_DEBUGPL(DBG_PCDV, "doepctl0=%0x\n",
++		    DWC_READ_REG32(&dev_if->out_ep_regs[0]->doepctl));
++	DWC_DEBUGPL(DBG_PCDV, "diepctl0=%0x\n",
++		    DWC_READ_REG32(&dev_if->in_ep_regs[0]->diepctl));
++#endif
++	dctl.b.cgnpinnak = 1;
++
++	DWC_MODIFY_REG32(&dev_if->dev_global_regs->dctl, dctl.d32, dctl.d32);
++	DWC_DEBUGPL(DBG_PCDV, "dctl=%0x\n",
++		    DWC_READ_REG32(&dev_if->dev_global_regs->dctl));
++
++}
++
++/**
++ * This function activates an EP.  The Device EP control register for
++ * the EP is configured as defined in the ep structure. Note: This
++ * function is not used for EP0.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to activate.
++ */
++void dwc_otg_ep_activate(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	depctl_data_t depctl;
++	volatile uint32_t *addr;
++	daint_data_t daintmsk = {.d32 = 0 };
++	dcfg_data_t dcfg;
++	uint8_t i;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s() EP%d-%s\n", __func__, ep->num,
++		    (ep->is_in ? "IN" : "OUT"));
++
++#ifdef DWC_UTE_PER_IO
++	ep->xiso_frame_num = 0xFFFFFFFF;
++	ep->xiso_active_xfers = 0;
++	ep->xiso_queued_xfers = 0;
++#endif
++	/* Read DEPCTLn register */
++	if (ep->is_in == 1) {
++		addr = &dev_if->in_ep_regs[ep->num]->diepctl;
++		daintmsk.ep.in = 1 << ep->num;
++	} else {
++		addr = &dev_if->out_ep_regs[ep->num]->doepctl;
++		daintmsk.ep.out = 1 << ep->num;
++	}
++
++	/* If the EP is already active don't change the EP Control
++	 * register. */
++	depctl.d32 = DWC_READ_REG32(addr);
++	if (!depctl.b.usbactep) {
++		depctl.b.mps = ep->maxpacket;
++		depctl.b.eptype = ep->type;
++		depctl.b.txfnum = ep->tx_fifo_num;
++
++		if (ep->type == DWC_OTG_EP_TYPE_ISOC) {
++			depctl.b.setd0pid = 1;	// ???
++		} else {
++			depctl.b.setd0pid = 1;
++		}
++		depctl.b.usbactep = 1;
++
++		/* Update nextep_seq array and EPMSCNT in DCFG*/
++		if (!(depctl.b.eptype & 1) && (ep->is_in == 1)) {	// NP IN EP
++			for (i = 0; i <= core_if->dev_if->num_in_eps; i++) {
++				if (core_if->nextep_seq[i] == core_if->first_in_nextep_seq)
++				break;
++			}
++			core_if->nextep_seq[i] = ep->num;
++			core_if->nextep_seq[ep->num] = core_if->first_in_nextep_seq;
++			depctl.b.nextep = core_if->nextep_seq[ep->num];
++			dcfg.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dcfg);
++			dcfg.b.epmscnt++;
++			DWC_WRITE_REG32(&dev_if->dev_global_regs->dcfg, dcfg.d32);
++
++			DWC_DEBUGPL(DBG_PCDV,
++				    "%s first_in_nextep_seq= %2d; nextep_seq[]:\n",
++				__func__, core_if->first_in_nextep_seq);
++			for (i=0; i <= core_if->dev_if->num_in_eps; i++) {
++				DWC_DEBUGPL(DBG_PCDV, "%2d\n",
++					    core_if->nextep_seq[i]);
++			}
++
++		}
++
++
++		DWC_WRITE_REG32(addr, depctl.d32);
++		DWC_DEBUGPL(DBG_PCDV, "DEPCTL=%08x\n", DWC_READ_REG32(addr));
++	}
++
++	/* Enable the Interrupt for this EP */
++	if (core_if->multiproc_int_enable) {
++		if (ep->is_in == 1) {
++			diepmsk_data_t diepmsk = {.d32 = 0 };
++			diepmsk.b.xfercompl = 1;
++			diepmsk.b.timeout = 1;
++			diepmsk.b.epdisabled = 1;
++			diepmsk.b.ahberr = 1;
++			diepmsk.b.intknepmis = 1;
++			if (!core_if->en_multiple_tx_fifo && core_if->dma_enable)
++				diepmsk.b.intknepmis = 0;
++			diepmsk.b.txfifoundrn = 1;	//?????
++			if (ep->type == DWC_OTG_EP_TYPE_ISOC) {
++				diepmsk.b.nak = 1;
++			}
++
++
++
++/*
++			if (core_if->dma_desc_enable) {
++				diepmsk.b.bna = 1;
++			}
++*/
++/*
++			if (core_if->dma_enable) {
++				doepmsk.b.nak = 1;
++			}
++*/
++			DWC_WRITE_REG32(&dev_if->dev_global_regs->
++					diepeachintmsk[ep->num], diepmsk.d32);
++
++		} else {
++			doepmsk_data_t doepmsk = {.d32 = 0 };
++			doepmsk.b.xfercompl = 1;
++			doepmsk.b.ahberr = 1;
++			doepmsk.b.epdisabled = 1;
++			if (ep->type == DWC_OTG_EP_TYPE_ISOC)
++				doepmsk.b.outtknepdis = 1;
++
++/*
++
++			if (core_if->dma_desc_enable) {
++				doepmsk.b.bna = 1;
++			}
++*/
++/*
++			doepmsk.b.babble = 1;
++			doepmsk.b.nyet = 1;
++			doepmsk.b.nak = 1;
++*/
++			DWC_WRITE_REG32(&dev_if->dev_global_regs->
++					doepeachintmsk[ep->num], doepmsk.d32);
++		}
++		DWC_MODIFY_REG32(&dev_if->dev_global_regs->deachintmsk,
++				 0, daintmsk.d32);
++	} else {
++		if (ep->type == DWC_OTG_EP_TYPE_ISOC) {
++			if (ep->is_in) {
++				diepmsk_data_t diepmsk = {.d32 = 0 };
++				diepmsk.b.nak = 1;
++				DWC_MODIFY_REG32(&dev_if->dev_global_regs->diepmsk, 0, diepmsk.d32);
++			} else {
++				doepmsk_data_t doepmsk = {.d32 = 0 };
++				doepmsk.b.outtknepdis = 1;
++				DWC_MODIFY_REG32(&dev_if->dev_global_regs->doepmsk, 0, doepmsk.d32);
++			}
++		}
++		DWC_MODIFY_REG32(&dev_if->dev_global_regs->daintmsk,
++				 0, daintmsk.d32);
++	}
++
++	DWC_DEBUGPL(DBG_PCDV, "DAINTMSK=%0x\n",
++		    DWC_READ_REG32(&dev_if->dev_global_regs->daintmsk));
++
++	ep->stall_clear_flag = 0;
++
++	return;
++}
++
++/**
++ * This function deactivates an EP. This is done by clearing the USB Active
++ * EP bit in the Device EP control register. Note: This function is not used
++ * for EP0. EP0 cannot be deactivated.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to deactivate.
++ */
++void dwc_otg_ep_deactivate(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	depctl_data_t depctl = {.d32 = 0 };
++	volatile uint32_t *addr;
++	daint_data_t daintmsk = {.d32 = 0 };
++	dcfg_data_t dcfg;
++	uint8_t i = 0;
++
++#ifdef DWC_UTE_PER_IO
++	ep->xiso_frame_num = 0xFFFFFFFF;
++	ep->xiso_active_xfers = 0;
++	ep->xiso_queued_xfers = 0;
++#endif
++
++	/* Read DEPCTLn register */
++	if (ep->is_in == 1) {
++		addr = &core_if->dev_if->in_ep_regs[ep->num]->diepctl;
++		daintmsk.ep.in = 1 << ep->num;
++	} else {
++		addr = &core_if->dev_if->out_ep_regs[ep->num]->doepctl;
++		daintmsk.ep.out = 1 << ep->num;
++	}
++
++	depctl.d32 = DWC_READ_REG32(addr);
++
++	depctl.b.usbactep = 0;
++
++	/* Update nextep_seq array and EPMSCNT in DCFG*/
++	if (!(depctl.b.eptype & 1) && ep->is_in == 1) {	// NP EP IN
++		for (i = 0; i <= core_if->dev_if->num_in_eps; i++) {
++			if (core_if->nextep_seq[i] == ep->num)
++			break;
++		}
++		core_if->nextep_seq[i] = core_if->nextep_seq[ep->num];
++		if (core_if->first_in_nextep_seq == ep->num)
++			core_if->first_in_nextep_seq = i;
++		core_if->nextep_seq[ep->num] = 0xff;
++		depctl.b.nextep = 0;
++		dcfg.d32 =
++		    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
++		dcfg.b.epmscnt--;
++		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg,
++				dcfg.d32);
++
++		DWC_DEBUGPL(DBG_PCDV,
++			    "%s first_in_nextep_seq= %2d; nextep_seq[]:\n",
++				__func__, core_if->first_in_nextep_seq);
++			for (i=0; i <= core_if->dev_if->num_in_eps; i++) {
++				DWC_DEBUGPL(DBG_PCDV, "%2d\n", core_if->nextep_seq[i]);
++			}
++	}
++
++	if (ep->is_in == 1)
++		depctl.b.txfnum = 0;
++
++	if (core_if->dma_desc_enable)
++		depctl.b.epdis = 1;
++
++	DWC_WRITE_REG32(addr, depctl.d32);
++	depctl.d32 = DWC_READ_REG32(addr);
++	if (core_if->dma_enable && ep->type == DWC_OTG_EP_TYPE_ISOC
++	    && depctl.b.epena) {
++		depctl_data_t depctl = {.d32 = 0};
++		if (ep->is_in) {
++			diepint_data_t diepint = {.d32 = 0};
++
++			depctl.b.snak = 1;
++			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
++					diepctl, depctl.d32);
++			do {
++				dwc_udelay(10);
++				diepint.d32 =
++				    DWC_READ_REG32(&core_if->
++						   dev_if->in_ep_regs[ep->num]->
++						   diepint);
++			} while (!diepint.b.inepnakeff);
++			diepint.b.inepnakeff = 1;
++			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
++					diepint, diepint.d32);
++			depctl.d32 = 0;
++			depctl.b.epdis = 1;
++			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
++					diepctl, depctl.d32);
++			do {
++				dwc_udelay(10);
++				diepint.d32 =
++				    DWC_READ_REG32(&core_if->
++						   dev_if->in_ep_regs[ep->num]->
++						   diepint);
++			} while (!diepint.b.epdisabled);
++			diepint.b.epdisabled = 1;
++			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
++					diepint, diepint.d32);
++		} else {
++			dctl_data_t dctl = {.d32 = 0};
++			gintmsk_data_t gintsts = {.d32 = 0};
++			doepint_data_t doepint = {.d32 = 0};
++			dctl.b.sgoutnak = 1;
++			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
++					 dctl, 0, dctl.d32);
++			do {
++				dwc_udelay(10);
++				gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
++			} while (!gintsts.b.goutnakeff);
++			gintsts.d32 = 0;
++			gintsts.b.goutnakeff = 1;
++			DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++
++			depctl.d32 = 0;
++			depctl.b.epdis = 1;
++			depctl.b.snak = 1;
++			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[ep->num]->doepctl, depctl.d32);
++			do
++			{
++				dwc_udelay(10);
++				doepint.d32 = DWC_READ_REG32(&core_if->dev_if->
++											out_ep_regs[ep->num]->doepint);
++			} while (!doepint.b.epdisabled);
++
++			doepint.b.epdisabled = 1;
++			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[ep->num]->doepint, doepint.d32);
++
++			dctl.d32 = 0;
++			dctl.b.cgoutnak = 1;
++			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0, dctl.d32);
++		}
++	}
++
++	/* Disable the Interrupt for this EP */
++	if (core_if->multiproc_int_enable) {
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->deachintmsk,
++				 daintmsk.d32, 0);
++
++		if (ep->is_in == 1) {
++			DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->
++					diepeachintmsk[ep->num], 0);
++		} else {
++			DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->
++					doepeachintmsk[ep->num], 0);
++		}
++	} else {
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->daintmsk,
++				 daintmsk.d32, 0);
++	}
++
++}
++
++/**
++ * This function initializes dma descriptor chain.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to start the transfer on.
++ */
++static void init_dma_desc_chain(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	dwc_otg_dev_dma_desc_t *dma_desc;
++	uint32_t offset;
++	uint32_t xfer_est;
++	int i;
++	unsigned maxxfer_local, total_len;
++
++	if (!ep->is_in && ep->type == DWC_OTG_EP_TYPE_INTR &&
++					(ep->maxpacket%4)) {
++		maxxfer_local = ep->maxpacket;
++		total_len = ep->xfer_len;
++	} else {
++		maxxfer_local = ep->maxxfer;
++		total_len = ep->total_len;
++	}
++
++	ep->desc_cnt = (total_len / maxxfer_local) +
++            ((total_len % maxxfer_local) ? 1 : 0);
++
++	if (!ep->desc_cnt)
++		ep->desc_cnt = 1;
++
++	if (ep->desc_cnt > MAX_DMA_DESC_CNT)
++		ep->desc_cnt = MAX_DMA_DESC_CNT;
++
++	dma_desc = ep->desc_addr;
++	if (maxxfer_local == ep->maxpacket) {
++		if ((total_len % maxxfer_local) &&
++				(total_len/maxxfer_local < MAX_DMA_DESC_CNT)) {
++			xfer_est = (ep->desc_cnt - 1) * maxxfer_local +
++					(total_len % maxxfer_local);
++		} else
++			xfer_est = ep->desc_cnt * maxxfer_local;
++	} else
++		xfer_est = total_len;
++	offset = 0;
++	for (i = 0; i < ep->desc_cnt; ++i) {
++		/** DMA Descriptor Setup */
++		if (xfer_est > maxxfer_local) {
++			dma_desc->status.b.bs = BS_HOST_BUSY;
++			dma_desc->status.b.l = 0;
++			dma_desc->status.b.ioc = 0;
++			dma_desc->status.b.sp = 0;
++			dma_desc->status.b.bytes = maxxfer_local;
++			dma_desc->buf = ep->dma_addr + offset;
++			dma_desc->status.b.sts = 0;
++			dma_desc->status.b.bs = BS_HOST_READY;
++
++			xfer_est -= maxxfer_local;
++			offset += maxxfer_local;
++		} else {
++			dma_desc->status.b.bs = BS_HOST_BUSY;
++			dma_desc->status.b.l = 1;
++			dma_desc->status.b.ioc = 1;
++			if (ep->is_in) {
++				dma_desc->status.b.sp =
++				    (xfer_est %
++				     ep->maxpacket) ? 1 : ((ep->
++							    sent_zlp) ? 1 : 0);
++				dma_desc->status.b.bytes = xfer_est;
++			} else {
++				if (maxxfer_local == ep->maxpacket)
++					dma_desc->status.b.bytes = xfer_est;
++				else
++					dma_desc->status.b.bytes =
++						xfer_est + ((4 - (xfer_est & 0x3)) & 0x3);
++			}
++
++			dma_desc->buf = ep->dma_addr + offset;
++			dma_desc->status.b.sts = 0;
++			dma_desc->status.b.bs = BS_HOST_READY;
++		}
++		dma_desc++;
++	}
++}
++/**
++ * This function is called when to write ISOC data into appropriate dedicated
++ * periodic FIFO.
++ */
++static int32_t write_isoc_tx_fifo(dwc_otg_core_if_t * core_if, dwc_ep_t * dwc_ep)
++{
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	dwc_otg_dev_in_ep_regs_t *ep_regs;
++	dtxfsts_data_t txstatus = {.d32 = 0 };
++	uint32_t len = 0;
++	int epnum = dwc_ep->num;
++	int dwords;
++
++	DWC_DEBUGPL(DBG_PCD, "Dedicated TxFifo Empty: %d \n", epnum);
++
++	ep_regs = core_if->dev_if->in_ep_regs[epnum];
++
++	len = dwc_ep->xfer_len - dwc_ep->xfer_count;
++
++	if (len > dwc_ep->maxpacket) {
++		len = dwc_ep->maxpacket;
++	}
++
++	dwords = (len + 3) / 4;
++
++	/* While there is space in the queue and space in the FIFO and
++	 * More data to tranfer, Write packets to the Tx FIFO */
++	txstatus.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dtxfsts);
++	DWC_DEBUGPL(DBG_PCDV, "b4 dtxfsts[%d]=0x%08x\n", epnum, txstatus.d32);
++
++	while (txstatus.b.txfspcavail > dwords &&
++	       dwc_ep->xfer_count < dwc_ep->xfer_len && dwc_ep->xfer_len != 0) {
++		/* Write the FIFO */
++		dwc_otg_ep_write_packet(core_if, dwc_ep, 0);
++
++		len = dwc_ep->xfer_len - dwc_ep->xfer_count;
++		if (len > dwc_ep->maxpacket) {
++			len = dwc_ep->maxpacket;
++		}
++
++		dwords = (len + 3) / 4;
++		txstatus.d32 =
++		    DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dtxfsts);
++		DWC_DEBUGPL(DBG_PCDV, "dtxfsts[%d]=0x%08x\n", epnum,
++			    txstatus.d32);
++	}
++
++	DWC_DEBUGPL(DBG_PCDV, "b4 dtxfsts[%d]=0x%08x\n", epnum,
++		    DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dtxfsts));
++
++	return 1;
++}
++/**
++ * This function does the setup for a data transfer for an EP and
++ * starts the transfer. For an IN transfer, the packets will be
++ * loaded into the appropriate Tx FIFO in the ISR. For OUT transfers,
++ * the packets are unloaded from the Rx FIFO in the ISR.  the ISR.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to start the transfer on.
++ */
++
++void dwc_otg_ep_start_transfer(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	depctl_data_t depctl;
++	deptsiz_data_t deptsiz;
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++
++	DWC_DEBUGPL((DBG_PCDV | DBG_CILV), "%s()\n", __func__);
++	DWC_DEBUGPL(DBG_PCD, "ep%d-%s xfer_len=%d xfer_cnt=%d "
++		    "xfer_buff=%p start_xfer_buff=%p, total_len = %d\n",
++		    ep->num, (ep->is_in ? "IN" : "OUT"), ep->xfer_len,
++		    ep->xfer_count, ep->xfer_buff, ep->start_xfer_buff,
++		    ep->total_len);
++	/* IN endpoint */
++	if (ep->is_in == 1) {
++		dwc_otg_dev_in_ep_regs_t *in_regs =
++		    core_if->dev_if->in_ep_regs[ep->num];
++
++		gnptxsts_data_t gtxstatus;
++
++		gtxstatus.d32 =
++		    DWC_READ_REG32(&core_if->core_global_regs->gnptxsts);
++
++		if (core_if->en_multiple_tx_fifo == 0
++		    && gtxstatus.b.nptxqspcavail == 0 && !core_if->dma_enable) {
++#ifdef DEBUG
++			DWC_PRINTF("TX Queue Full (0x%0x)\n", gtxstatus.d32);
++#endif
++			return;
++		}
++
++		depctl.d32 = DWC_READ_REG32(&(in_regs->diepctl));
++		deptsiz.d32 = DWC_READ_REG32(&(in_regs->dieptsiz));
++
++		if (ep->maxpacket > ep->maxxfer / MAX_PKT_CNT)
++			ep->xfer_len += (ep->maxxfer < (ep->total_len - ep->xfer_len)) ?
++				ep->maxxfer : (ep->total_len - ep->xfer_len);
++		else
++			ep->xfer_len += (MAX_PKT_CNT * ep->maxpacket < (ep->total_len - ep->xfer_len)) ?
++				 MAX_PKT_CNT * ep->maxpacket : (ep->total_len - ep->xfer_len);
++
++
++		/* Zero Length Packet? */
++		if ((ep->xfer_len - ep->xfer_count) == 0) {
++			deptsiz.b.xfersize = 0;
++			deptsiz.b.pktcnt = 1;
++		} else {
++			/* Program the transfer size and packet count
++			 *      as follows: xfersize = N * maxpacket +
++			 *      short_packet pktcnt = N + (short_packet
++			 *      exist ? 1 : 0)
++			 */
++			deptsiz.b.xfersize = ep->xfer_len - ep->xfer_count;
++			deptsiz.b.pktcnt =
++			    (ep->xfer_len - ep->xfer_count - 1 +
++			     ep->maxpacket) / ep->maxpacket;
++			if (deptsiz.b.pktcnt > MAX_PKT_CNT) {
++				deptsiz.b.pktcnt = MAX_PKT_CNT;
++				deptsiz.b.xfersize = deptsiz.b.pktcnt * ep->maxpacket;
++			}
++			if (ep->type == DWC_OTG_EP_TYPE_ISOC)
++				deptsiz.b.mc = deptsiz.b.pktcnt;
++		}
++
++		/* Write the DMA register */
++		if (core_if->dma_enable) {
++			if (core_if->dma_desc_enable == 0) {
++				if (ep->type != DWC_OTG_EP_TYPE_ISOC)
++					deptsiz.b.mc = 1;
++				DWC_WRITE_REG32(&in_regs->dieptsiz,
++						deptsiz.d32);
++				DWC_WRITE_REG32(&(in_regs->diepdma),
++						(uint32_t) ep->dma_addr);
++			} else {
++#ifdef DWC_UTE_CFI
++				/* The descriptor chain should be already initialized by now */
++				if (ep->buff_mode != BM_STANDARD) {
++					DWC_WRITE_REG32(&in_regs->diepdma,
++							ep->descs_dma_addr);
++				} else {
++#endif
++					init_dma_desc_chain(core_if, ep);
++				/** DIEPDMAn Register write */
++					DWC_WRITE_REG32(&in_regs->diepdma,
++							ep->dma_desc_addr);
++#ifdef DWC_UTE_CFI
++				}
++#endif
++			}
++		} else {
++			DWC_WRITE_REG32(&in_regs->dieptsiz, deptsiz.d32);
++			if (ep->type != DWC_OTG_EP_TYPE_ISOC) {
++				/**
++				 * Enable the Non-Periodic Tx FIFO empty interrupt,
++				 * or the Tx FIFO epmty interrupt in dedicated Tx FIFO mode,
++				 * the data will be written into the fifo by the ISR.
++				 */
++				if (core_if->en_multiple_tx_fifo == 0) {
++					intr_mask.b.nptxfempty = 1;
++					DWC_MODIFY_REG32
++					    (&core_if->core_global_regs->gintmsk,
++					     intr_mask.d32, intr_mask.d32);
++				} else {
++					/* Enable the Tx FIFO Empty Interrupt for this EP */
++					if (ep->xfer_len > 0) {
++						uint32_t fifoemptymsk = 0;
++						fifoemptymsk = 1 << ep->num;
++						DWC_MODIFY_REG32
++						    (&core_if->dev_if->dev_global_regs->dtknqr4_fifoemptymsk,
++						     0, fifoemptymsk);
++
++					}
++				}
++			}  else {
++					 write_isoc_tx_fifo(core_if, ep);
++			}
++		}
++		if (!core_if->core_params->en_multiple_tx_fifo && core_if->dma_enable)
++			depctl.b.nextep = core_if->nextep_seq[ep->num];
++
++		if (ep->type == DWC_OTG_EP_TYPE_ISOC) {
++			dsts_data_t dsts = {.d32 = 0};
++			if (ep->bInterval == 1) {
++				dsts.d32 =
++				    DWC_READ_REG32(&core_if->dev_if->
++						   dev_global_regs->dsts);
++				ep->frame_num = dsts.b.soffn + ep->bInterval;
++				if (ep->frame_num > 0x3FFF) {
++					ep->frm_overrun = 1;
++					ep->frame_num &= 0x3FFF;
++				} else
++					ep->frm_overrun = 0;
++				if (ep->frame_num & 0x1) {
++					depctl.b.setd1pid = 1;
++				} else {
++					depctl.b.setd0pid = 1;
++				}
++			}
++		}
++		/* EP enable, IN data in FIFO */
++		depctl.b.cnak = 1;
++		depctl.b.epena = 1;
++		DWC_WRITE_REG32(&in_regs->diepctl, depctl.d32);
++
++	} else {
++		/* OUT endpoint */
++		dwc_otg_dev_out_ep_regs_t *out_regs =
++		    core_if->dev_if->out_ep_regs[ep->num];
++
++		depctl.d32 = DWC_READ_REG32(&(out_regs->doepctl));
++		deptsiz.d32 = DWC_READ_REG32(&(out_regs->doeptsiz));
++
++		if (!core_if->dma_desc_enable) {
++			if (ep->maxpacket > ep->maxxfer / MAX_PKT_CNT)
++				ep->xfer_len += (ep->maxxfer < (ep->total_len - ep->xfer_len)) ?
++				ep->maxxfer : (ep->total_len - ep->xfer_len);
++                else
++					ep->xfer_len += (MAX_PKT_CNT * ep->maxpacket < (ep->total_len
++					- ep->xfer_len)) ? MAX_PKT_CNT * ep->maxpacket : (ep->total_len - ep->xfer_len);
++		}
++
++		/* Program the transfer size and packet count as follows:
++		 *
++		 *      pktcnt = N
++		 *      xfersize = N * maxpacket
++		 */
++		if ((ep->xfer_len - ep->xfer_count) == 0) {
++			/* Zero Length Packet */
++			deptsiz.b.xfersize = ep->maxpacket;
++			deptsiz.b.pktcnt = 1;
++		} else {
++			deptsiz.b.pktcnt =
++			    (ep->xfer_len - ep->xfer_count +
++			     (ep->maxpacket - 1)) / ep->maxpacket;
++			if (deptsiz.b.pktcnt > MAX_PKT_CNT) {
++				deptsiz.b.pktcnt = MAX_PKT_CNT;
++			}
++			if (!core_if->dma_desc_enable) {
++				ep->xfer_len =
++					deptsiz.b.pktcnt * ep->maxpacket + ep->xfer_count;
++			}
++			deptsiz.b.xfersize = ep->xfer_len - ep->xfer_count;
++		}
++
++		DWC_DEBUGPL(DBG_PCDV, "ep%d xfersize=%d pktcnt=%d\n",
++			    ep->num, deptsiz.b.xfersize, deptsiz.b.pktcnt);
++
++		if (core_if->dma_enable) {
++			if (!core_if->dma_desc_enable) {
++				DWC_WRITE_REG32(&out_regs->doeptsiz,
++						deptsiz.d32);
++
++				DWC_WRITE_REG32(&(out_regs->doepdma),
++						(uint32_t) ep->dma_addr);
++			} else {
++#ifdef DWC_UTE_CFI
++				/* The descriptor chain should be already initialized by now */
++				if (ep->buff_mode != BM_STANDARD) {
++					DWC_WRITE_REG32(&out_regs->doepdma,
++							ep->descs_dma_addr);
++				} else {
++#endif
++					/** This is used for interrupt out transfers*/
++					if (!ep->xfer_len)
++						ep->xfer_len = ep->total_len;
++					init_dma_desc_chain(core_if, ep);
++
++					if (core_if->core_params->dev_out_nak) {
++						if (ep->type == DWC_OTG_EP_TYPE_BULK) {
++							deptsiz.b.pktcnt = (ep->total_len +
++								(ep->maxpacket - 1)) / ep->maxpacket;
++							deptsiz.b.xfersize = ep->total_len;
++							/* Remember initial value of doeptsiz */
++							core_if->start_doeptsiz_val[ep->num] = deptsiz.d32;
++							DWC_WRITE_REG32(&out_regs->doeptsiz,
++								deptsiz.d32);
++						}
++					}
++				/** DOEPDMAn Register write */
++					DWC_WRITE_REG32(&out_regs->doepdma,
++							ep->dma_desc_addr);
++#ifdef DWC_UTE_CFI
++				}
++#endif
++			}
++		} else {
++			DWC_WRITE_REG32(&out_regs->doeptsiz, deptsiz.d32);
++		}
++
++		if (ep->type == DWC_OTG_EP_TYPE_ISOC) {
++			dsts_data_t dsts = {.d32 = 0};
++			if (ep->bInterval == 1) {
++				dsts.d32 =
++				    DWC_READ_REG32(&core_if->dev_if->
++						   dev_global_regs->dsts);
++				ep->frame_num = dsts.b.soffn + ep->bInterval;
++				if (ep->frame_num > 0x3FFF) {
++					ep->frm_overrun = 1;
++					ep->frame_num &= 0x3FFF;
++				} else
++					ep->frm_overrun = 0;
++
++				if (ep->frame_num & 0x1) {
++					depctl.b.setd1pid = 1;
++				} else {
++					depctl.b.setd0pid = 1;
++				}
++			}
++		}
++
++		/* EP enable */
++		depctl.b.cnak = 1;
++		depctl.b.epena = 1;
++
++		DWC_WRITE_REG32(&out_regs->doepctl, depctl.d32);
++
++		DWC_DEBUGPL(DBG_PCD, "DOEPCTL=%08x DOEPTSIZ=%08x\n",
++			    DWC_READ_REG32(&out_regs->doepctl),
++			    DWC_READ_REG32(&out_regs->doeptsiz));
++		DWC_DEBUGPL(DBG_PCD, "DAINTMSK=%08x GINTMSK=%08x\n",
++			    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->
++					   daintmsk),
++			    DWC_READ_REG32(&core_if->core_global_regs->
++					   gintmsk));
++
++		/* Timer is scheduling only for out bulk transfers for
++		 * "Device DDMA OUT NAK Enhancement" feature to inform user
++		 * about received data payload in case of timeout
++		 */
++		if (core_if->core_params->dev_out_nak) {
++			if (ep->type == DWC_OTG_EP_TYPE_BULK) {
++				core_if->ep_xfer_info[ep->num].core_if = core_if;
++				core_if->ep_xfer_info[ep->num].ep = ep;
++				core_if->ep_xfer_info[ep->num].state = 1;
++
++				/* Start a timer for this transfer. */
++				DWC_TIMER_SCHEDULE(core_if->ep_xfer_timer[ep->num], 10000);
++			}
++		}
++	}
++}
++
++/**
++ * This function setup a zero length transfer in Buffer DMA and
++ * Slave modes for usb requests with zero field set
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to start the transfer on.
++ *
++ */
++void dwc_otg_ep_start_zl_transfer(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++
++	depctl_data_t depctl;
++	deptsiz_data_t deptsiz;
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++
++	DWC_DEBUGPL((DBG_PCDV | DBG_CILV), "%s()\n", __func__);
++	DWC_PRINTF("zero length transfer is called\n");
++
++	/* IN endpoint */
++	if (ep->is_in == 1) {
++		dwc_otg_dev_in_ep_regs_t *in_regs =
++		    core_if->dev_if->in_ep_regs[ep->num];
++
++		depctl.d32 = DWC_READ_REG32(&(in_regs->diepctl));
++		deptsiz.d32 = DWC_READ_REG32(&(in_regs->dieptsiz));
++
++		deptsiz.b.xfersize = 0;
++		deptsiz.b.pktcnt = 1;
++
++		/* Write the DMA register */
++		if (core_if->dma_enable) {
++			if (core_if->dma_desc_enable == 0) {
++				deptsiz.b.mc = 1;
++				DWC_WRITE_REG32(&in_regs->dieptsiz,
++						deptsiz.d32);
++				DWC_WRITE_REG32(&(in_regs->diepdma),
++						(uint32_t) ep->dma_addr);
++			}
++		} else {
++			DWC_WRITE_REG32(&in_regs->dieptsiz, deptsiz.d32);
++			/**
++			 * Enable the Non-Periodic Tx FIFO empty interrupt,
++			 * or the Tx FIFO epmty interrupt in dedicated Tx FIFO mode,
++			 * the data will be written into the fifo by the ISR.
++			 */
++			if (core_if->en_multiple_tx_fifo == 0) {
++				intr_mask.b.nptxfempty = 1;
++				DWC_MODIFY_REG32(&core_if->
++						 core_global_regs->gintmsk,
++						 intr_mask.d32, intr_mask.d32);
++			} else {
++				/* Enable the Tx FIFO Empty Interrupt for this EP */
++				if (ep->xfer_len > 0) {
++					uint32_t fifoemptymsk = 0;
++					fifoemptymsk = 1 << ep->num;
++					DWC_MODIFY_REG32(&core_if->
++							 dev_if->dev_global_regs->dtknqr4_fifoemptymsk,
++							 0, fifoemptymsk);
++				}
++			}
++		}
++
++		if (!core_if->core_params->en_multiple_tx_fifo && core_if->dma_enable)
++			depctl.b.nextep = core_if->nextep_seq[ep->num];
++		/* EP enable, IN data in FIFO */
++		depctl.b.cnak = 1;
++		depctl.b.epena = 1;
++		DWC_WRITE_REG32(&in_regs->diepctl, depctl.d32);
++
++	} else {
++		/* OUT endpoint */
++		dwc_otg_dev_out_ep_regs_t *out_regs =
++		    core_if->dev_if->out_ep_regs[ep->num];
++
++		depctl.d32 = DWC_READ_REG32(&(out_regs->doepctl));
++		deptsiz.d32 = DWC_READ_REG32(&(out_regs->doeptsiz));
++
++		/* Zero Length Packet */
++		deptsiz.b.xfersize = ep->maxpacket;
++		deptsiz.b.pktcnt = 1;
++
++		if (core_if->dma_enable) {
++			if (!core_if->dma_desc_enable) {
++				DWC_WRITE_REG32(&out_regs->doeptsiz,
++						deptsiz.d32);
++
++				DWC_WRITE_REG32(&(out_regs->doepdma),
++						(uint32_t) ep->dma_addr);
++			}
++		} else {
++			DWC_WRITE_REG32(&out_regs->doeptsiz, deptsiz.d32);
++		}
++
++		/* EP enable */
++		depctl.b.cnak = 1;
++		depctl.b.epena = 1;
++
++		DWC_WRITE_REG32(&out_regs->doepctl, depctl.d32);
++
++	}
++}
++
++/**
++ * This function does the setup for a data transfer for EP0 and starts
++ * the transfer.  For an IN transfer, the packets will be loaded into
++ * the appropriate Tx FIFO in the ISR. For OUT transfers, the packets are
++ * unloaded from the Rx FIFO in the ISR.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP0 data.
++ */
++void dwc_otg_ep0_start_transfer(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	depctl_data_t depctl;
++	deptsiz0_data_t deptsiz;
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++	dwc_otg_dev_dma_desc_t *dma_desc;
++
++	DWC_DEBUGPL(DBG_PCD, "ep%d-%s xfer_len=%d xfer_cnt=%d "
++		    "xfer_buff=%p start_xfer_buff=%p \n",
++		    ep->num, (ep->is_in ? "IN" : "OUT"), ep->xfer_len,
++		    ep->xfer_count, ep->xfer_buff, ep->start_xfer_buff);
++
++	ep->total_len = ep->xfer_len;
++
++	/* IN endpoint */
++	if (ep->is_in == 1) {
++		dwc_otg_dev_in_ep_regs_t *in_regs =
++		    core_if->dev_if->in_ep_regs[0];
++
++		gnptxsts_data_t gtxstatus;
++
++		if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
++			depctl.d32 = DWC_READ_REG32(&in_regs->diepctl);
++			if (depctl.b.epena)
++				return;
++		}
++
++		gtxstatus.d32 =
++		    DWC_READ_REG32(&core_if->core_global_regs->gnptxsts);
++
++		/* If dedicated FIFO every time flush fifo before enable ep*/
++		if (core_if->en_multiple_tx_fifo && core_if->snpsid >= OTG_CORE_REV_3_00a)
++			dwc_otg_flush_tx_fifo(core_if, ep->tx_fifo_num);
++
++		if (core_if->en_multiple_tx_fifo == 0
++		    && gtxstatus.b.nptxqspcavail == 0
++		    && !core_if->dma_enable) {
++#ifdef DEBUG
++			deptsiz.d32 = DWC_READ_REG32(&in_regs->dieptsiz);
++			DWC_DEBUGPL(DBG_PCD, "DIEPCTL0=%0x\n",
++				    DWC_READ_REG32(&in_regs->diepctl));
++			DWC_DEBUGPL(DBG_PCD, "DIEPTSIZ0=%0x (sz=%d, pcnt=%d)\n",
++				    deptsiz.d32,
++				    deptsiz.b.xfersize, deptsiz.b.pktcnt);
++			DWC_PRINTF("TX Queue or FIFO Full (0x%0x)\n",
++				   gtxstatus.d32);
++#endif
++			return;
++		}
++
++		depctl.d32 = DWC_READ_REG32(&in_regs->diepctl);
++		deptsiz.d32 = DWC_READ_REG32(&in_regs->dieptsiz);
++
++		/* Zero Length Packet? */
++		if (ep->xfer_len == 0) {
++			deptsiz.b.xfersize = 0;
++			deptsiz.b.pktcnt = 1;
++		} else {
++			/* Program the transfer size and packet count
++			 *      as follows: xfersize = N * maxpacket +
++			 *      short_packet pktcnt = N + (short_packet
++			 *      exist ? 1 : 0)
++			 */
++			if (ep->xfer_len > ep->maxpacket) {
++				ep->xfer_len = ep->maxpacket;
++				deptsiz.b.xfersize = ep->maxpacket;
++			} else {
++				deptsiz.b.xfersize = ep->xfer_len;
++			}
++			deptsiz.b.pktcnt = 1;
++
++		}
++		DWC_DEBUGPL(DBG_PCDV,
++			    "IN len=%d  xfersize=%d pktcnt=%d [%08x]\n",
++			    ep->xfer_len, deptsiz.b.xfersize, deptsiz.b.pktcnt,
++			    deptsiz.d32);
++
++		/* Write the DMA register */
++		if (core_if->dma_enable) {
++			if (core_if->dma_desc_enable == 0) {
++				DWC_WRITE_REG32(&in_regs->dieptsiz,
++						deptsiz.d32);
++
++				DWC_WRITE_REG32(&(in_regs->diepdma),
++						(uint32_t) ep->dma_addr);
++			} else {
++				dma_desc = core_if->dev_if->in_desc_addr;
++
++				/** DMA Descriptor Setup */
++				dma_desc->status.b.bs = BS_HOST_BUSY;
++				dma_desc->status.b.l = 1;
++				dma_desc->status.b.ioc = 1;
++				dma_desc->status.b.sp =
++				    (ep->xfer_len == ep->maxpacket) ? 0 : 1;
++				dma_desc->status.b.bytes = ep->xfer_len;
++				dma_desc->buf = ep->dma_addr;
++				dma_desc->status.b.sts = 0;
++				dma_desc->status.b.bs = BS_HOST_READY;
++
++				/** DIEPDMA0 Register write */
++				DWC_WRITE_REG32(&in_regs->diepdma,
++						core_if->
++						dev_if->dma_in_desc_addr);
++			}
++		} else {
++			DWC_WRITE_REG32(&in_regs->dieptsiz, deptsiz.d32);
++		}
++
++		if (!core_if->core_params->en_multiple_tx_fifo && core_if->dma_enable)
++			depctl.b.nextep = core_if->nextep_seq[ep->num];
++		/* EP enable, IN data in FIFO */
++		depctl.b.cnak = 1;
++		depctl.b.epena = 1;
++		DWC_WRITE_REG32(&in_regs->diepctl, depctl.d32);
++
++		/**
++		 * Enable the Non-Periodic Tx FIFO empty interrupt, the
++		 * data will be written into the fifo by the ISR.
++		 */
++		if (!core_if->dma_enable) {
++			if (core_if->en_multiple_tx_fifo == 0) {
++				intr_mask.b.nptxfempty = 1;
++				DWC_MODIFY_REG32(&core_if->
++						 core_global_regs->gintmsk,
++						 intr_mask.d32, intr_mask.d32);
++			} else {
++				/* Enable the Tx FIFO Empty Interrupt for this EP */
++				if (ep->xfer_len > 0) {
++					uint32_t fifoemptymsk = 0;
++					fifoemptymsk |= 1 << ep->num;
++					DWC_MODIFY_REG32(&core_if->
++							 dev_if->dev_global_regs->dtknqr4_fifoemptymsk,
++							 0, fifoemptymsk);
++				}
++			}
++		}
++	} else {
++		/* OUT endpoint */
++		dwc_otg_dev_out_ep_regs_t *out_regs =
++		    core_if->dev_if->out_ep_regs[0];
++
++		depctl.d32 = DWC_READ_REG32(&out_regs->doepctl);
++		deptsiz.d32 = DWC_READ_REG32(&out_regs->doeptsiz);
++
++		/* Program the transfer size and packet count as follows:
++		 *      xfersize = N * (maxpacket + 4 - (maxpacket % 4))
++		 *      pktcnt = N                                                                                      */
++		/* Zero Length Packet */
++		deptsiz.b.xfersize = ep->maxpacket;
++		deptsiz.b.pktcnt = 1;
++		if (core_if->snpsid >= OTG_CORE_REV_3_00a)
++			deptsiz.b.supcnt = 3;
++
++		DWC_DEBUGPL(DBG_PCDV, "len=%d  xfersize=%d pktcnt=%d\n",
++			    ep->xfer_len, deptsiz.b.xfersize, deptsiz.b.pktcnt);
++
++		if (core_if->dma_enable) {
++			if (!core_if->dma_desc_enable) {
++				DWC_WRITE_REG32(&out_regs->doeptsiz,
++						deptsiz.d32);
++
++				DWC_WRITE_REG32(&(out_regs->doepdma),
++						(uint32_t) ep->dma_addr);
++			} else {
++				dma_desc = core_if->dev_if->out_desc_addr;
++
++				/** DMA Descriptor Setup */
++				dma_desc->status.b.bs = BS_HOST_BUSY;
++				if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
++					dma_desc->status.b.mtrf = 0;
++					dma_desc->status.b.sr = 0;
++				}
++				dma_desc->status.b.l = 1;
++				dma_desc->status.b.ioc = 1;
++				dma_desc->status.b.bytes = ep->maxpacket;
++				dma_desc->buf = ep->dma_addr;
++				dma_desc->status.b.sts = 0;
++				dma_desc->status.b.bs = BS_HOST_READY;
++
++				/** DOEPDMA0 Register write */
++				DWC_WRITE_REG32(&out_regs->doepdma,
++						core_if->dev_if->
++						dma_out_desc_addr);
++			}
++		} else {
++			DWC_WRITE_REG32(&out_regs->doeptsiz, deptsiz.d32);
++		}
++
++		/* EP enable */
++		depctl.b.cnak = 1;
++		depctl.b.epena = 1;
++		DWC_WRITE_REG32(&(out_regs->doepctl), depctl.d32);
++	}
++}
++
++/**
++ * This function continues control IN transfers started by
++ * dwc_otg_ep0_start_transfer, when the transfer does not fit in a
++ * single packet.  NOTE: The DIEPCTL0/DOEPCTL0 registers only have one
++ * bit for the packet count.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP0 data.
++ */
++void dwc_otg_ep0_continue_transfer(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	depctl_data_t depctl;
++	deptsiz0_data_t deptsiz;
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++	dwc_otg_dev_dma_desc_t *dma_desc;
++
++	if (ep->is_in == 1) {
++		dwc_otg_dev_in_ep_regs_t *in_regs =
++		    core_if->dev_if->in_ep_regs[0];
++		gnptxsts_data_t tx_status = {.d32 = 0 };
++
++		tx_status.d32 =
++		    DWC_READ_REG32(&core_if->core_global_regs->gnptxsts);
++		/** @todo Should there be check for room in the Tx
++		 * Status Queue.  If not remove the code above this comment. */
++
++		depctl.d32 = DWC_READ_REG32(&in_regs->diepctl);
++		deptsiz.d32 = DWC_READ_REG32(&in_regs->dieptsiz);
++
++		/* Program the transfer size and packet count
++		 *      as follows: xfersize = N * maxpacket +
++		 *      short_packet pktcnt = N + (short_packet
++		 *      exist ? 1 : 0)
++		 */
++
++		if (core_if->dma_desc_enable == 0) {
++			deptsiz.b.xfersize =
++			    (ep->total_len - ep->xfer_count) >
++			    ep->maxpacket ? ep->maxpacket : (ep->total_len -
++							     ep->xfer_count);
++			deptsiz.b.pktcnt = 1;
++			if (core_if->dma_enable == 0) {
++				ep->xfer_len += deptsiz.b.xfersize;
++			} else {
++				ep->xfer_len = deptsiz.b.xfersize;
++			}
++			DWC_WRITE_REG32(&in_regs->dieptsiz, deptsiz.d32);
++		} else {
++			ep->xfer_len =
++			    (ep->total_len - ep->xfer_count) >
++			    ep->maxpacket ? ep->maxpacket : (ep->total_len -
++							     ep->xfer_count);
++
++			dma_desc = core_if->dev_if->in_desc_addr;
++
++			/** DMA Descriptor Setup */
++			dma_desc->status.b.bs = BS_HOST_BUSY;
++			dma_desc->status.b.l = 1;
++			dma_desc->status.b.ioc = 1;
++			dma_desc->status.b.sp =
++			    (ep->xfer_len == ep->maxpacket) ? 0 : 1;
++			dma_desc->status.b.bytes = ep->xfer_len;
++			dma_desc->buf = ep->dma_addr;
++			dma_desc->status.b.sts = 0;
++			dma_desc->status.b.bs = BS_HOST_READY;
++
++			/** DIEPDMA0 Register write */
++			DWC_WRITE_REG32(&in_regs->diepdma,
++					core_if->dev_if->dma_in_desc_addr);
++		}
++
++		DWC_DEBUGPL(DBG_PCDV,
++			    "IN len=%d  xfersize=%d pktcnt=%d [%08x]\n",
++			    ep->xfer_len, deptsiz.b.xfersize, deptsiz.b.pktcnt,
++			    deptsiz.d32);
++
++		/* Write the DMA register */
++		if (core_if->hwcfg2.b.architecture == DWC_INT_DMA_ARCH) {
++			if (core_if->dma_desc_enable == 0)
++				DWC_WRITE_REG32(&(in_regs->diepdma),
++						(uint32_t) ep->dma_addr);
++		}
++		if (!core_if->core_params->en_multiple_tx_fifo && core_if->dma_enable)
++			depctl.b.nextep = core_if->nextep_seq[ep->num];
++		/* EP enable, IN data in FIFO */
++		depctl.b.cnak = 1;
++		depctl.b.epena = 1;
++		DWC_WRITE_REG32(&in_regs->diepctl, depctl.d32);
++
++		/**
++		 * Enable the Non-Periodic Tx FIFO empty interrupt, the
++		 * data will be written into the fifo by the ISR.
++		 */
++		if (!core_if->dma_enable) {
++			if (core_if->en_multiple_tx_fifo == 0) {
++				/* First clear it from GINTSTS */
++				intr_mask.b.nptxfempty = 1;
++				DWC_MODIFY_REG32(&core_if->
++						 core_global_regs->gintmsk,
++						 intr_mask.d32, intr_mask.d32);
++
++			} else {
++				/* Enable the Tx FIFO Empty Interrupt for this EP */
++				if (ep->xfer_len > 0) {
++					uint32_t fifoemptymsk = 0;
++					fifoemptymsk |= 1 << ep->num;
++					DWC_MODIFY_REG32(&core_if->
++							 dev_if->dev_global_regs->dtknqr4_fifoemptymsk,
++							 0, fifoemptymsk);
++				}
++			}
++		}
++	} else {
++		dwc_otg_dev_out_ep_regs_t *out_regs =
++		    core_if->dev_if->out_ep_regs[0];
++
++		depctl.d32 = DWC_READ_REG32(&out_regs->doepctl);
++		deptsiz.d32 = DWC_READ_REG32(&out_regs->doeptsiz);
++
++		/* Program the transfer size and packet count
++		 *      as follows: xfersize = N * maxpacket +
++		 *      short_packet pktcnt = N + (short_packet
++		 *      exist ? 1 : 0)
++		 */
++		deptsiz.b.xfersize = ep->maxpacket;
++		deptsiz.b.pktcnt = 1;
++
++		if (core_if->dma_desc_enable == 0) {
++			DWC_WRITE_REG32(&out_regs->doeptsiz, deptsiz.d32);
++		} else {
++			dma_desc = core_if->dev_if->out_desc_addr;
++
++			/** DMA Descriptor Setup */
++			dma_desc->status.b.bs = BS_HOST_BUSY;
++			dma_desc->status.b.l = 1;
++			dma_desc->status.b.ioc = 1;
++			dma_desc->status.b.bytes = ep->maxpacket;
++			dma_desc->buf = ep->dma_addr;
++			dma_desc->status.b.sts = 0;
++			dma_desc->status.b.bs = BS_HOST_READY;
++
++			/** DOEPDMA0 Register write */
++			DWC_WRITE_REG32(&out_regs->doepdma,
++					core_if->dev_if->dma_out_desc_addr);
++		}
++
++		DWC_DEBUGPL(DBG_PCDV,
++			    "IN len=%d  xfersize=%d pktcnt=%d [%08x]\n",
++			    ep->xfer_len, deptsiz.b.xfersize, deptsiz.b.pktcnt,
++			    deptsiz.d32);
++
++		/* Write the DMA register */
++		if (core_if->hwcfg2.b.architecture == DWC_INT_DMA_ARCH) {
++			if (core_if->dma_desc_enable == 0)
++				DWC_WRITE_REG32(&(out_regs->doepdma),
++						(uint32_t) ep->dma_addr);
++
++		}
++
++		/* EP enable, IN data in FIFO */
++		depctl.b.cnak = 1;
++		depctl.b.epena = 1;
++		DWC_WRITE_REG32(&out_regs->doepctl, depctl.d32);
++
++	}
++}
++
++#ifdef DEBUG
++void dump_msg(const u8 * buf, unsigned int length)
++{
++	unsigned int start, num, i;
++	char line[52], *p;
++
++	if (length >= 512)
++		return;
++	start = 0;
++	while (length > 0) {
++		num = length < 16u ? length : 16u;
++		p = line;
++		for (i = 0; i < num; ++i) {
++			if (i == 8)
++				*p++ = ' ';
++			DWC_SPRINTF(p, " %02x", buf[i]);
++			p += 3;
++		}
++		*p = 0;
++		DWC_PRINTF("%6x: %s\n", start, line);
++		buf += num;
++		start += num;
++		length -= num;
++	}
++}
++#else
++static inline void dump_msg(const u8 * buf, unsigned int length)
++{
++}
++#endif
++
++/**
++ * This function writes a packet into the Tx FIFO associated with the
++ * EP. For non-periodic EPs the non-periodic Tx FIFO is written.  For
++ * periodic EPs the periodic Tx FIFO associated with the EP is written
++ * with all packets for the next micro-frame.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to write packet for.
++ * @param dma Indicates if DMA is being used.
++ */
++void dwc_otg_ep_write_packet(dwc_otg_core_if_t * core_if, dwc_ep_t * ep,
++			     int dma)
++{
++	/**
++	 * The buffer is padded to DWORD on a per packet basis in
++	 * slave/dma mode if the MPS is not DWORD aligned. The last
++	 * packet, if short, is also padded to a multiple of DWORD.
++	 *
++	 * ep->xfer_buff always starts DWORD aligned in memory and is a
++	 * multiple of DWORD in length
++	 *
++	 * ep->xfer_len can be any number of bytes
++	 *
++	 * ep->xfer_count is a multiple of ep->maxpacket until the last
++	 *	packet
++	 *
++	 * FIFO access is DWORD */
++
++	uint32_t i;
++	uint32_t byte_count;
++	uint32_t dword_count;
++	uint32_t *fifo;
++	uint32_t *data_buff = (uint32_t *) ep->xfer_buff;
++
++	DWC_DEBUGPL((DBG_PCDV | DBG_CILV), "%s(%p,%p)\n", __func__, core_if,
++		    ep);
++	if (ep->xfer_count >= ep->xfer_len) {
++		DWC_WARN("%s() No data for EP%d!!!\n", __func__, ep->num);
++		return;
++	}
++
++	/* Find the byte length of the packet either short packet or MPS */
++	if ((ep->xfer_len - ep->xfer_count) < ep->maxpacket) {
++		byte_count = ep->xfer_len - ep->xfer_count;
++	} else {
++		byte_count = ep->maxpacket;
++	}
++
++	/* Find the DWORD length, padded by extra bytes as neccessary if MPS
++	 * is not a multiple of DWORD */
++	dword_count = (byte_count + 3) / 4;
++
++#ifdef VERBOSE
++	dump_msg(ep->xfer_buff, byte_count);
++#endif
++
++	/**@todo NGS Where are the Periodic Tx FIFO addresses
++	 * intialized?	What should this be? */
++
++	fifo = core_if->data_fifo[ep->num];
++
++	DWC_DEBUGPL((DBG_PCDV | DBG_CILV), "fifo=%p buff=%p *p=%08x bc=%d\n",
++		    fifo, data_buff, *data_buff, byte_count);
++
++	if (!dma) {
++		for (i = 0; i < dword_count; i++, data_buff++) {
++			DWC_WRITE_REG32(fifo, *data_buff);
++		}
++	}
++
++	ep->xfer_count += byte_count;
++	ep->xfer_buff += byte_count;
++	ep->dma_addr += byte_count;
++}
++
++/**
++ * Set the EP STALL.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to set the stall on.
++ */
++void dwc_otg_ep_set_stall(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	depctl_data_t depctl;
++	volatile uint32_t *depctl_addr;
++
++	DWC_DEBUGPL(DBG_PCD, "%s ep%d-%s\n", __func__, ep->num,
++		    (ep->is_in ? "IN" : "OUT"));
++
++	if (ep->is_in == 1) {
++		depctl_addr = &(core_if->dev_if->in_ep_regs[ep->num]->diepctl);
++		depctl.d32 = DWC_READ_REG32(depctl_addr);
++
++		/* set the disable and stall bits */
++		if (depctl.b.epena) {
++			depctl.b.epdis = 1;
++		}
++		depctl.b.stall = 1;
++		DWC_WRITE_REG32(depctl_addr, depctl.d32);
++	} else {
++		depctl_addr = &(core_if->dev_if->out_ep_regs[ep->num]->doepctl);
++		depctl.d32 = DWC_READ_REG32(depctl_addr);
++
++		/* set the stall bit */
++		depctl.b.stall = 1;
++		DWC_WRITE_REG32(depctl_addr, depctl.d32);
++	}
++
++	DWC_DEBUGPL(DBG_PCD, "DEPCTL=%0x\n", DWC_READ_REG32(depctl_addr));
++
++	return;
++}
++
++/**
++ * Clear the EP STALL.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to clear stall from.
++ */
++void dwc_otg_ep_clear_stall(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	depctl_data_t depctl;
++	volatile uint32_t *depctl_addr;
++
++	DWC_DEBUGPL(DBG_PCD, "%s ep%d-%s\n", __func__, ep->num,
++		    (ep->is_in ? "IN" : "OUT"));
++
++	if (ep->is_in == 1) {
++		depctl_addr = &(core_if->dev_if->in_ep_regs[ep->num]->diepctl);
++	} else {
++		depctl_addr = &(core_if->dev_if->out_ep_regs[ep->num]->doepctl);
++	}
++
++	depctl.d32 = DWC_READ_REG32(depctl_addr);
++
++	/* clear the stall bits */
++	depctl.b.stall = 0;
++
++	/*
++	 * USB Spec 9.4.5: For endpoints using data toggle, regardless
++	 * of whether an endpoint has the Halt feature set, a
++	 * ClearFeature(ENDPOINT_HALT) request always results in the
++	 * data toggle being reinitialized to DATA0.
++	 */
++	if (ep->type == DWC_OTG_EP_TYPE_INTR ||
++	    ep->type == DWC_OTG_EP_TYPE_BULK) {
++		depctl.b.setd0pid = 1;	/* DATA0 */
++	}
++
++	DWC_WRITE_REG32(depctl_addr, depctl.d32);
++	DWC_DEBUGPL(DBG_PCD, "DEPCTL=%0x\n", DWC_READ_REG32(depctl_addr));
++	return;
++}
++
++/**
++ * This function reads a packet from the Rx FIFO into the destination
++ * buffer. To read SETUP data use dwc_otg_read_setup_packet.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param dest	  Destination buffer for the packet.
++ * @param bytes  Number of bytes to copy to the destination.
++ */
++void dwc_otg_read_packet(dwc_otg_core_if_t * core_if,
++			 uint8_t * dest, uint16_t bytes)
++{
++	int i;
++	int word_count = (bytes + 3) / 4;
++
++	volatile uint32_t *fifo = core_if->data_fifo[0];
++	uint32_t *data_buff = (uint32_t *) dest;
++
++	/**
++	 * @todo Account for the case where _dest is not dword aligned. This
++	 * requires reading data from the FIFO into a uint32_t temp buffer,
++	 * then moving it into the data buffer.
++	 */
++
++	DWC_DEBUGPL((DBG_PCDV | DBG_CILV), "%s(%p,%p,%d)\n", __func__,
++		    core_if, dest, bytes);
++
++	for (i = 0; i < word_count; i++, data_buff++) {
++		*data_buff = DWC_READ_REG32(fifo);
++	}
++
++	return;
++}
++
++/**
++ * This functions reads the device registers and prints them
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++void dwc_otg_dump_dev_registers(dwc_otg_core_if_t * core_if)
++{
++	int i;
++	volatile uint32_t *addr;
++
++	DWC_PRINTF("Device Global Registers\n");
++	addr = &core_if->dev_if->dev_global_regs->dcfg;
++	DWC_PRINTF("DCFG		 @0x%08lX : 0x%08X\n",
++		   (unsigned long)addr, DWC_READ_REG32(addr));
++	addr = &core_if->dev_if->dev_global_regs->dctl;
++	DWC_PRINTF("DCTL		 @0x%08lX : 0x%08X\n",
++		   (unsigned long)addr, DWC_READ_REG32(addr));
++	addr = &core_if->dev_if->dev_global_regs->dsts;
++	DWC_PRINTF("DSTS		 @0x%08lX : 0x%08X\n",
++		   (unsigned long)addr, DWC_READ_REG32(addr));
++	addr = &core_if->dev_if->dev_global_regs->diepmsk;
++	DWC_PRINTF("DIEPMSK	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->dev_if->dev_global_regs->doepmsk;
++	DWC_PRINTF("DOEPMSK	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->dev_if->dev_global_regs->daint;
++	DWC_PRINTF("DAINT	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->dev_if->dev_global_regs->daintmsk;
++	DWC_PRINTF("DAINTMSK	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->dev_if->dev_global_regs->dtknqr1;
++	DWC_PRINTF("DTKNQR1	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	if (core_if->hwcfg2.b.dev_token_q_depth > 6) {
++		addr = &core_if->dev_if->dev_global_regs->dtknqr2;
++		DWC_PRINTF("DTKNQR2	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++	}
++
++	addr = &core_if->dev_if->dev_global_regs->dvbusdis;
++	DWC_PRINTF("DVBUSID	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++
++	addr = &core_if->dev_if->dev_global_regs->dvbuspulse;
++	DWC_PRINTF("DVBUSPULSE	@0x%08lX : 0x%08X\n",
++		   (unsigned long)addr, DWC_READ_REG32(addr));
++
++	addr = &core_if->dev_if->dev_global_regs->dtknqr3_dthrctl;
++	DWC_PRINTF("DTKNQR3_DTHRCTL	 @0x%08lX : 0x%08X\n",
++		   (unsigned long)addr, DWC_READ_REG32(addr));
++
++	if (core_if->hwcfg2.b.dev_token_q_depth > 22) {
++		addr = &core_if->dev_if->dev_global_regs->dtknqr4_fifoemptymsk;
++		DWC_PRINTF("DTKNQR4	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++	}
++
++	addr = &core_if->dev_if->dev_global_regs->dtknqr4_fifoemptymsk;
++	DWC_PRINTF("FIFOEMPMSK	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++
++	if (core_if->hwcfg2.b.multi_proc_int) {
++
++		addr = &core_if->dev_if->dev_global_regs->deachint;
++		DWC_PRINTF("DEACHINT	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->dev_if->dev_global_regs->deachintmsk;
++		DWC_PRINTF("DEACHINTMSK	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++
++		for (i = 0; i <= core_if->dev_if->num_in_eps; i++) {
++			addr =
++			    &core_if->dev_if->
++			    dev_global_regs->diepeachintmsk[i];
++			DWC_PRINTF("DIEPEACHINTMSK[%d]	 @0x%08lX : 0x%08X\n",
++				   i, (unsigned long)addr,
++				   DWC_READ_REG32(addr));
++		}
++
++		for (i = 0; i <= core_if->dev_if->num_out_eps; i++) {
++			addr =
++			    &core_if->dev_if->
++			    dev_global_regs->doepeachintmsk[i];
++			DWC_PRINTF("DOEPEACHINTMSK[%d]	 @0x%08lX : 0x%08X\n",
++				   i, (unsigned long)addr,
++				   DWC_READ_REG32(addr));
++		}
++	}
++
++	for (i = 0; i <= core_if->dev_if->num_in_eps; i++) {
++		DWC_PRINTF("Device IN EP %d Registers\n", i);
++		addr = &core_if->dev_if->in_ep_regs[i]->diepctl;
++		DWC_PRINTF("DIEPCTL	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->dev_if->in_ep_regs[i]->diepint;
++		DWC_PRINTF("DIEPINT	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->dev_if->in_ep_regs[i]->dieptsiz;
++		DWC_PRINTF("DIETSIZ	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->dev_if->in_ep_regs[i]->diepdma;
++		DWC_PRINTF("DIEPDMA	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->dev_if->in_ep_regs[i]->dtxfsts;
++		DWC_PRINTF("DTXFSTS	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->dev_if->in_ep_regs[i]->diepdmab;
++		DWC_PRINTF("DIEPDMAB	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, 0 /*DWC_READ_REG32(addr) */ );
++	}
++
++	for (i = 0; i <= core_if->dev_if->num_out_eps; i++) {
++		DWC_PRINTF("Device OUT EP %d Registers\n", i);
++		addr = &core_if->dev_if->out_ep_regs[i]->doepctl;
++		DWC_PRINTF("DOEPCTL	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->dev_if->out_ep_regs[i]->doepint;
++		DWC_PRINTF("DOEPINT	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->dev_if->out_ep_regs[i]->doeptsiz;
++		DWC_PRINTF("DOETSIZ	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->dev_if->out_ep_regs[i]->doepdma;
++		DWC_PRINTF("DOEPDMA	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		if (core_if->dma_enable) {	/* Don't access this register in SLAVE mode */
++			addr = &core_if->dev_if->out_ep_regs[i]->doepdmab;
++			DWC_PRINTF("DOEPDMAB	 @0x%08lX : 0x%08X\n",
++				   (unsigned long)addr, DWC_READ_REG32(addr));
++		}
++
++	}
++}
++
++/**
++ * This functions reads the SPRAM and prints its content
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++void dwc_otg_dump_spram(dwc_otg_core_if_t * core_if)
++{
++	volatile uint8_t *addr, *start_addr, *end_addr;
++
++	DWC_PRINTF("SPRAM Data:\n");
++	start_addr = (void *)core_if->core_global_regs;
++	DWC_PRINTF("Base Address: 0x%8lX\n", (unsigned long)start_addr);
++	start_addr += 0x00028000;
++	end_addr = (void *)core_if->core_global_regs;
++	end_addr += 0x000280e0;
++
++	for (addr = start_addr; addr < end_addr; addr += 16) {
++		DWC_PRINTF
++		    ("0x%8lX:\t%2X %2X %2X %2X %2X %2X %2X %2X %2X %2X %2X %2X %2X %2X %2X %2X\n",
++		     (unsigned long)addr, addr[0], addr[1], addr[2], addr[3],
++		     addr[4], addr[5], addr[6], addr[7], addr[8], addr[9],
++		     addr[10], addr[11], addr[12], addr[13], addr[14], addr[15]
++		    );
++	}
++
++	return;
++}
++
++/**
++ * This function reads the host registers and prints them
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++void dwc_otg_dump_host_registers(dwc_otg_core_if_t * core_if)
++{
++	int i;
++	volatile uint32_t *addr;
++
++	DWC_PRINTF("Host Global Registers\n");
++	addr = &core_if->host_if->host_global_regs->hcfg;
++	DWC_PRINTF("HCFG		 @0x%08lX : 0x%08X\n",
++		   (unsigned long)addr, DWC_READ_REG32(addr));
++	addr = &core_if->host_if->host_global_regs->hfir;
++	DWC_PRINTF("HFIR		 @0x%08lX : 0x%08X\n",
++		   (unsigned long)addr, DWC_READ_REG32(addr));
++	addr = &core_if->host_if->host_global_regs->hfnum;
++	DWC_PRINTF("HFNUM	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->host_if->host_global_regs->hptxsts;
++	DWC_PRINTF("HPTXSTS	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->host_if->host_global_regs->haint;
++	DWC_PRINTF("HAINT	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->host_if->host_global_regs->haintmsk;
++	DWC_PRINTF("HAINTMSK	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	if (core_if->dma_desc_enable) {
++		addr = &core_if->host_if->host_global_regs->hflbaddr;
++		DWC_PRINTF("HFLBADDR	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++	}
++
++	addr = core_if->host_if->hprt0;
++	DWC_PRINTF("HPRT0	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++
++	for (i = 0; i < core_if->core_params->host_channels; i++) {
++		DWC_PRINTF("Host Channel %d Specific Registers\n", i);
++		addr = &core_if->host_if->hc_regs[i]->hcchar;
++		DWC_PRINTF("HCCHAR	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->host_if->hc_regs[i]->hcsplt;
++		DWC_PRINTF("HCSPLT	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->host_if->hc_regs[i]->hcint;
++		DWC_PRINTF("HCINT	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->host_if->hc_regs[i]->hcintmsk;
++		DWC_PRINTF("HCINTMSK	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->host_if->hc_regs[i]->hctsiz;
++		DWC_PRINTF("HCTSIZ	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		addr = &core_if->host_if->hc_regs[i]->hcdma;
++		DWC_PRINTF("HCDMA	 @0x%08lX : 0x%08X\n",
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++		if (core_if->dma_desc_enable) {
++			addr = &core_if->host_if->hc_regs[i]->hcdmab;
++			DWC_PRINTF("HCDMAB	 @0x%08lX : 0x%08X\n",
++				   (unsigned long)addr, DWC_READ_REG32(addr));
++		}
++
++	}
++	return;
++}
++
++/**
++ * This function reads the core global registers and prints them
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++void dwc_otg_dump_global_registers(dwc_otg_core_if_t * core_if)
++{
++	int i, ep_num;
++	volatile uint32_t *addr;
++	char *txfsiz;
++
++	DWC_PRINTF("Core Global Registers\n");
++	addr = &core_if->core_global_regs->gotgctl;
++	DWC_PRINTF("GOTGCTL	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->gotgint;
++	DWC_PRINTF("GOTGINT	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->gahbcfg;
++	DWC_PRINTF("GAHBCFG	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->gusbcfg;
++	DWC_PRINTF("GUSBCFG	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->grstctl;
++	DWC_PRINTF("GRSTCTL	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->gintsts;
++	DWC_PRINTF("GINTSTS	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->gintmsk;
++	DWC_PRINTF("GINTMSK	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->grxstsr;
++	DWC_PRINTF("GRXSTSR	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->grxfsiz;
++	DWC_PRINTF("GRXFSIZ	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->gnptxfsiz;
++	DWC_PRINTF("GNPTXFSIZ @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->gnptxsts;
++	DWC_PRINTF("GNPTXSTS	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->gi2cctl;
++	DWC_PRINTF("GI2CCTL	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->gpvndctl;
++	DWC_PRINTF("GPVNDCTL	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->ggpio;
++	DWC_PRINTF("GGPIO	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->guid;
++	DWC_PRINTF("GUID		 @0x%08lX : 0x%08X\n",
++		   (unsigned long)addr, DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->gsnpsid;
++	DWC_PRINTF("GSNPSID	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->ghwcfg1;
++	DWC_PRINTF("GHWCFG1	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->ghwcfg2;
++	DWC_PRINTF("GHWCFG2	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->ghwcfg3;
++	DWC_PRINTF("GHWCFG3	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->ghwcfg4;
++	DWC_PRINTF("GHWCFG4	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->glpmcfg;
++	DWC_PRINTF("GLPMCFG	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->gpwrdn;
++	DWC_PRINTF("GPWRDN	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->gdfifocfg;
++	DWC_PRINTF("GDFIFOCFG	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++	addr = &core_if->core_global_regs->adpctl;
++	DWC_PRINTF("ADPCTL	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   dwc_otg_adp_read_reg(core_if));
++	addr = &core_if->core_global_regs->hptxfsiz;
++	DWC_PRINTF("HPTXFSIZ	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++
++	if (core_if->en_multiple_tx_fifo == 0) {
++		ep_num = core_if->hwcfg4.b.num_dev_perio_in_ep;
++		txfsiz = "DPTXFSIZ";
++	} else {
++		ep_num = core_if->hwcfg4.b.num_in_eps;
++		txfsiz = "DIENPTXF";
++	}
++	for (i = 0; i < ep_num; i++) {
++		addr = &core_if->core_global_regs->dtxfsiz[i];
++		DWC_PRINTF("%s[%d] @0x%08lX : 0x%08X\n", txfsiz, i + 1,
++			   (unsigned long)addr, DWC_READ_REG32(addr));
++	}
++	addr = core_if->pcgcctl;
++	DWC_PRINTF("PCGCCTL	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
++		   DWC_READ_REG32(addr));
++}
++
++/**
++ * Flush a Tx FIFO.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param num Tx FIFO to flush.
++ */
++void dwc_otg_flush_tx_fifo(dwc_otg_core_if_t * core_if, const int num)
++{
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	volatile grstctl_t greset = {.d32 = 0 };
++	int count = 0;
++
++	DWC_DEBUGPL((DBG_CIL | DBG_PCDV), "Flush Tx FIFO %d\n", num);
++
++	greset.b.txfflsh = 1;
++	greset.b.txfnum = num;
++	DWC_WRITE_REG32(&global_regs->grstctl, greset.d32);
++
++	do {
++		greset.d32 = DWC_READ_REG32(&global_regs->grstctl);
++		if (++count > 10000) {
++			DWC_WARN("%s() HANG! GRSTCTL=%0x GNPTXSTS=0x%08x\n",
++				 __func__, greset.d32,
++				 DWC_READ_REG32(&global_regs->gnptxsts));
++			break;
++		}
++		dwc_udelay(1);
++	} while (greset.b.txfflsh == 1);
++
++	/* Wait for 3 PHY Clocks */
++	dwc_udelay(1);
++}
++
++/**
++ * Flush Rx FIFO.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++void dwc_otg_flush_rx_fifo(dwc_otg_core_if_t * core_if)
++{
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	volatile grstctl_t greset = {.d32 = 0 };
++	int count = 0;
++
++	DWC_DEBUGPL((DBG_CIL | DBG_PCDV), "%s\n", __func__);
++	/*
++	 *
++	 */
++	greset.b.rxfflsh = 1;
++	DWC_WRITE_REG32(&global_regs->grstctl, greset.d32);
++
++	do {
++		greset.d32 = DWC_READ_REG32(&global_regs->grstctl);
++		if (++count > 10000) {
++			DWC_WARN("%s() HANG! GRSTCTL=%0x\n", __func__,
++				 greset.d32);
++			break;
++		}
++		dwc_udelay(1);
++	} while (greset.b.rxfflsh == 1);
++
++	/* Wait for 3 PHY Clocks */
++	dwc_udelay(1);
++}
++
++/**
++ * Do core a soft reset of the core.  Be careful with this because it
++ * resets all the internal state machines of the core.
++ */
++void dwc_otg_core_reset(dwc_otg_core_if_t * core_if)
++{
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	volatile grstctl_t greset = {.d32 = 0 };
++	int count = 0;
++
++	DWC_DEBUGPL(DBG_CILV, "%s\n", __func__);
++	/* Wait for AHB master IDLE state. */
++	do {
++		dwc_udelay(10);
++		greset.d32 = DWC_READ_REG32(&global_regs->grstctl);
++		if (++count > 100000) {
++			DWC_WARN("%s() HANG! AHB Idle GRSTCTL=%0x\n", __func__,
++				 greset.d32);
++			return;
++		}
++	}
++	while (greset.b.ahbidle == 0);
++
++	/* Core Soft Reset */
++	count = 0;
++	greset.b.csftrst = 1;
++	DWC_WRITE_REG32(&global_regs->grstctl, greset.d32);
++	do {
++		greset.d32 = DWC_READ_REG32(&global_regs->grstctl);
++		if (++count > 10000) {
++			DWC_WARN("%s() HANG! Soft Reset GRSTCTL=%0x\n",
++				 __func__, greset.d32);
++			break;
++		}
++		dwc_udelay(1);
++	}
++	while (greset.b.csftrst == 1);
++
++	/* Wait for 3 PHY Clocks */
++	dwc_mdelay(100);
++}
++
++uint8_t dwc_otg_is_device_mode(dwc_otg_core_if_t * _core_if)
++{
++	return (dwc_otg_mode(_core_if) != DWC_HOST_MODE);
++}
++
++uint8_t dwc_otg_is_host_mode(dwc_otg_core_if_t * _core_if)
++{
++	return (dwc_otg_mode(_core_if) == DWC_HOST_MODE);
++}
++
++/**
++ * Register HCD callbacks. The callbacks are used to start and stop
++ * the HCD for interrupt processing.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param cb the HCD callback structure.
++ * @param p pointer to be passed to callback function (usb_hcd*).
++ */
++void dwc_otg_cil_register_hcd_callbacks(dwc_otg_core_if_t * core_if,
++					dwc_otg_cil_callbacks_t * cb, void *p)
++{
++	core_if->hcd_cb = cb;
++	cb->p = p;
++}
++
++/**
++ * Register PCD callbacks. The callbacks are used to start and stop
++ * the PCD for interrupt processing.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param cb the PCD callback structure.
++ * @param p pointer to be passed to callback function (pcd*).
++ */
++void dwc_otg_cil_register_pcd_callbacks(dwc_otg_core_if_t * core_if,
++					dwc_otg_cil_callbacks_t * cb, void *p)
++{
++	core_if->pcd_cb = cb;
++	cb->p = p;
++}
++
++#ifdef DWC_EN_ISOC
++
++/**
++ * This function writes isoc data per 1 (micro)frame into tx fifo
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to start the transfer on.
++ *
++ */
++void write_isoc_frame_data(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	dwc_otg_dev_in_ep_regs_t *ep_regs;
++	dtxfsts_data_t txstatus = {.d32 = 0 };
++	uint32_t len = 0;
++	uint32_t dwords;
++
++	ep->xfer_len = ep->data_per_frame;
++	ep->xfer_count = 0;
++
++	ep_regs = core_if->dev_if->in_ep_regs[ep->num];
++
++	len = ep->xfer_len - ep->xfer_count;
++
++	if (len > ep->maxpacket) {
++		len = ep->maxpacket;
++	}
++
++	dwords = (len + 3) / 4;
++
++	/* While there is space in the queue and space in the FIFO and
++	 * More data to tranfer, Write packets to the Tx FIFO */
++	txstatus.d32 =
++	    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[ep->num]->dtxfsts);
++	DWC_DEBUGPL(DBG_PCDV, "b4 dtxfsts[%d]=0x%08x\n", ep->num, txstatus.d32);
++
++	while (txstatus.b.txfspcavail > dwords &&
++	       ep->xfer_count < ep->xfer_len && ep->xfer_len != 0) {
++		/* Write the FIFO */
++		dwc_otg_ep_write_packet(core_if, ep, 0);
++
++		len = ep->xfer_len - ep->xfer_count;
++		if (len > ep->maxpacket) {
++			len = ep->maxpacket;
++		}
++
++		dwords = (len + 3) / 4;
++		txstatus.d32 =
++		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
++				   dtxfsts);
++		DWC_DEBUGPL(DBG_PCDV, "dtxfsts[%d]=0x%08x\n", ep->num,
++			    txstatus.d32);
++	}
++}
++
++/**
++ * This function initializes a descriptor chain for Isochronous transfer
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to start the transfer on.
++ *
++ */
++void dwc_otg_iso_ep_start_frm_transfer(dwc_otg_core_if_t * core_if,
++				       dwc_ep_t * ep)
++{
++	deptsiz_data_t deptsiz = {.d32 = 0 };
++	depctl_data_t depctl = {.d32 = 0 };
++	dsts_data_t dsts = {.d32 = 0 };
++	volatile uint32_t *addr;
++
++	if (ep->is_in) {
++		addr = &core_if->dev_if->in_ep_regs[ep->num]->diepctl;
++	} else {
++		addr = &core_if->dev_if->out_ep_regs[ep->num]->doepctl;
++	}
++
++	ep->xfer_len = ep->data_per_frame;
++	ep->xfer_count = 0;
++	ep->xfer_buff = ep->cur_pkt_addr;
++	ep->dma_addr = ep->cur_pkt_dma_addr;
++
++	if (ep->is_in) {
++		/* Program the transfer size and packet count
++		 *      as follows: xfersize = N * maxpacket +
++		 *      short_packet pktcnt = N + (short_packet
++		 *      exist ? 1 : 0)
++		 */
++		deptsiz.b.xfersize = ep->xfer_len;
++		deptsiz.b.pktcnt =
++		    (ep->xfer_len - 1 + ep->maxpacket) / ep->maxpacket;
++		deptsiz.b.mc = deptsiz.b.pktcnt;
++		DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[ep->num]->dieptsiz,
++				deptsiz.d32);
++
++		/* Write the DMA register */
++		if (core_if->dma_enable) {
++			DWC_WRITE_REG32(&
++					(core_if->dev_if->in_ep_regs[ep->num]->
++					 diepdma), (uint32_t) ep->dma_addr);
++		}
++	} else {
++		deptsiz.b.pktcnt =
++		    (ep->xfer_len + (ep->maxpacket - 1)) / ep->maxpacket;
++		deptsiz.b.xfersize = deptsiz.b.pktcnt * ep->maxpacket;
++
++		DWC_WRITE_REG32(&core_if->dev_if->
++				out_ep_regs[ep->num]->doeptsiz, deptsiz.d32);
++
++		if (core_if->dma_enable) {
++			DWC_WRITE_REG32(&
++					(core_if->dev_if->
++					 out_ep_regs[ep->num]->doepdma),
++					(uint32_t) ep->dma_addr);
++		}
++	}
++
++	/** Enable endpoint, clear nak  */
++
++	depctl.d32 = 0;
++	if (ep->bInterval == 1) {
++		dsts.d32 =
++		    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
++		ep->next_frame = dsts.b.soffn + ep->bInterval;
++
++		if (ep->next_frame & 0x1) {
++			depctl.b.setd1pid = 1;
++		} else {
++			depctl.b.setd0pid = 1;
++		}
++	} else {
++		ep->next_frame += ep->bInterval;
++
++		if (ep->next_frame & 0x1) {
++			depctl.b.setd1pid = 1;
++		} else {
++			depctl.b.setd0pid = 1;
++		}
++	}
++	depctl.b.epena = 1;
++	depctl.b.cnak = 1;
++
++	DWC_MODIFY_REG32(addr, 0, depctl.d32);
++	depctl.d32 = DWC_READ_REG32(addr);
++
++	if (ep->is_in && core_if->dma_enable == 0) {
++		write_isoc_frame_data(core_if, ep);
++	}
++
++}
++#endif /* DWC_EN_ISOC */
++
++static void dwc_otg_set_uninitialized(int32_t * p, int size)
++{
++	int i;
++	for (i = 0; i < size; i++) {
++		p[i] = -1;
++	}
++}
++
++static int dwc_otg_param_initialized(int32_t val)
++{
++	return val != -1;
++}
++
++static int dwc_otg_setup_params(dwc_otg_core_if_t * core_if)
++{
++	int i;
++	core_if->core_params = DWC_ALLOC(sizeof(*core_if->core_params));
++	if (!core_if->core_params) {
++		return -DWC_E_NO_MEMORY;
++	}
++	dwc_otg_set_uninitialized((int32_t *) core_if->core_params,
++				  sizeof(*core_if->core_params) /
++				  sizeof(int32_t));
++	DWC_PRINTF("Setting default values for core params\n");
++	dwc_otg_set_param_otg_cap(core_if, dwc_param_otg_cap_default);
++	dwc_otg_set_param_dma_enable(core_if, dwc_param_dma_enable_default);
++	dwc_otg_set_param_dma_desc_enable(core_if,
++					  dwc_param_dma_desc_enable_default);
++	dwc_otg_set_param_opt(core_if, dwc_param_opt_default);
++	dwc_otg_set_param_dma_burst_size(core_if,
++					 dwc_param_dma_burst_size_default);
++	dwc_otg_set_param_host_support_fs_ls_low_power(core_if,
++						       dwc_param_host_support_fs_ls_low_power_default);
++	dwc_otg_set_param_enable_dynamic_fifo(core_if,
++					      dwc_param_enable_dynamic_fifo_default);
++	dwc_otg_set_param_data_fifo_size(core_if,
++					 dwc_param_data_fifo_size_default);
++	dwc_otg_set_param_dev_rx_fifo_size(core_if,
++					   dwc_param_dev_rx_fifo_size_default);
++	dwc_otg_set_param_dev_nperio_tx_fifo_size(core_if,
++						  dwc_param_dev_nperio_tx_fifo_size_default);
++	dwc_otg_set_param_host_rx_fifo_size(core_if,
++					    dwc_param_host_rx_fifo_size_default);
++	dwc_otg_set_param_host_nperio_tx_fifo_size(core_if,
++						   dwc_param_host_nperio_tx_fifo_size_default);
++	dwc_otg_set_param_host_perio_tx_fifo_size(core_if,
++						  dwc_param_host_perio_tx_fifo_size_default);
++	dwc_otg_set_param_max_transfer_size(core_if,
++					    dwc_param_max_transfer_size_default);
++	dwc_otg_set_param_max_packet_count(core_if,
++					   dwc_param_max_packet_count_default);
++	dwc_otg_set_param_host_channels(core_if,
++					dwc_param_host_channels_default);
++	dwc_otg_set_param_dev_endpoints(core_if,
++					dwc_param_dev_endpoints_default);
++	dwc_otg_set_param_phy_type(core_if, dwc_param_phy_type_default);
++	dwc_otg_set_param_speed(core_if, dwc_param_speed_default);
++	dwc_otg_set_param_host_ls_low_power_phy_clk(core_if,
++						    dwc_param_host_ls_low_power_phy_clk_default);
++	dwc_otg_set_param_phy_ulpi_ddr(core_if, dwc_param_phy_ulpi_ddr_default);
++	dwc_otg_set_param_phy_ulpi_ext_vbus(core_if,
++					    dwc_param_phy_ulpi_ext_vbus_default);
++	dwc_otg_set_param_phy_utmi_width(core_if,
++					 dwc_param_phy_utmi_width_default);
++	dwc_otg_set_param_ts_dline(core_if, dwc_param_ts_dline_default);
++	dwc_otg_set_param_i2c_enable(core_if, dwc_param_i2c_enable_default);
++	dwc_otg_set_param_ulpi_fs_ls(core_if, dwc_param_ulpi_fs_ls_default);
++	dwc_otg_set_param_en_multiple_tx_fifo(core_if,
++					      dwc_param_en_multiple_tx_fifo_default);
++	for (i = 0; i < 15; i++) {
++		dwc_otg_set_param_dev_perio_tx_fifo_size(core_if,
++							 dwc_param_dev_perio_tx_fifo_size_default,
++							 i);
++	}
++
++	for (i = 0; i < 15; i++) {
++		dwc_otg_set_param_dev_tx_fifo_size(core_if,
++						   dwc_param_dev_tx_fifo_size_default,
++						   i);
++	}
++	dwc_otg_set_param_thr_ctl(core_if, dwc_param_thr_ctl_default);
++	dwc_otg_set_param_mpi_enable(core_if, dwc_param_mpi_enable_default);
++	dwc_otg_set_param_pti_enable(core_if, dwc_param_pti_enable_default);
++	dwc_otg_set_param_lpm_enable(core_if, dwc_param_lpm_enable_default);
++	dwc_otg_set_param_ic_usb_cap(core_if, dwc_param_ic_usb_cap_default);
++	dwc_otg_set_param_tx_thr_length(core_if,
++					dwc_param_tx_thr_length_default);
++	dwc_otg_set_param_rx_thr_length(core_if,
++					dwc_param_rx_thr_length_default);
++	dwc_otg_set_param_ahb_thr_ratio(core_if,
++					dwc_param_ahb_thr_ratio_default);
++	dwc_otg_set_param_power_down(core_if, dwc_param_power_down_default);
++	dwc_otg_set_param_reload_ctl(core_if, dwc_param_reload_ctl_default);
++	dwc_otg_set_param_dev_out_nak(core_if, dwc_param_dev_out_nak_default);
++	dwc_otg_set_param_cont_on_bna(core_if, dwc_param_cont_on_bna_default);
++	dwc_otg_set_param_ahb_single(core_if, dwc_param_ahb_single_default);
++	dwc_otg_set_param_otg_ver(core_if, dwc_param_otg_ver_default);
++	dwc_otg_set_param_adp_enable(core_if, dwc_param_adp_enable_default);
++	DWC_PRINTF("Finished setting default values for core params\n");
++
++	return 0;
++}
++
++uint8_t dwc_otg_is_dma_enable(dwc_otg_core_if_t * core_if)
++{
++	return core_if->dma_enable;
++}
++
++/* Checks if the parameter is outside of its valid range of values */
++#define DWC_OTG_PARAM_TEST(_param_, _low_, _high_) \
++		(((_param_) < (_low_)) || \
++		((_param_) > (_high_)))
++
++/* Parameter access functions */
++int dwc_otg_set_param_otg_cap(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int valid;
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 0, 2)) {
++		DWC_WARN("Wrong value for otg_cap parameter\n");
++		DWC_WARN("otg_cap parameter must be 0,1 or 2\n");
++		retval = -DWC_E_INVALID;
++		goto out;
++	}
++
++	valid = 1;
++	switch (val) {
++	case DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE:
++		if (core_if->hwcfg2.b.op_mode !=
++		    DWC_HWCFG2_OP_MODE_HNP_SRP_CAPABLE_OTG)
++			valid = 0;
++		break;
++	case DWC_OTG_CAP_PARAM_SRP_ONLY_CAPABLE:
++		if ((core_if->hwcfg2.b.op_mode !=
++		     DWC_HWCFG2_OP_MODE_HNP_SRP_CAPABLE_OTG)
++		    && (core_if->hwcfg2.b.op_mode !=
++			DWC_HWCFG2_OP_MODE_SRP_ONLY_CAPABLE_OTG)
++		    && (core_if->hwcfg2.b.op_mode !=
++			DWC_HWCFG2_OP_MODE_SRP_CAPABLE_DEVICE)
++		    && (core_if->hwcfg2.b.op_mode !=
++			DWC_HWCFG2_OP_MODE_SRP_CAPABLE_HOST)) {
++			valid = 0;
++		}
++		break;
++	case DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE:
++		/* always valid */
++		break;
++	}
++	if (!valid) {
++		if (dwc_otg_param_initialized(core_if->core_params->otg_cap)) {
++			DWC_ERROR
++			    ("%d invalid for otg_cap paremter. Check HW configuration.\n",
++			     val);
++		}
++		val =
++		    (((core_if->hwcfg2.b.op_mode ==
++		       DWC_HWCFG2_OP_MODE_HNP_SRP_CAPABLE_OTG)
++		      || (core_if->hwcfg2.b.op_mode ==
++			  DWC_HWCFG2_OP_MODE_SRP_ONLY_CAPABLE_OTG)
++		      || (core_if->hwcfg2.b.op_mode ==
++			  DWC_HWCFG2_OP_MODE_SRP_CAPABLE_DEVICE)
++		      || (core_if->hwcfg2.b.op_mode ==
++			  DWC_HWCFG2_OP_MODE_SRP_CAPABLE_HOST)) ?
++		     DWC_OTG_CAP_PARAM_SRP_ONLY_CAPABLE :
++		     DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE);
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->otg_cap = val;
++out:
++	return retval;
++}
++
++int32_t dwc_otg_get_param_otg_cap(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->otg_cap;
++}
++
++int dwc_otg_set_param_opt(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong value for opt parameter\n");
++		return -DWC_E_INVALID;
++	}
++	core_if->core_params->opt = val;
++	return 0;
++}
++
++int32_t dwc_otg_get_param_opt(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->opt;
++}
++
++int dwc_otg_set_param_dma_enable(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong value for dma enable\n");
++		return -DWC_E_INVALID;
++	}
++
++	if ((val == 1) && (core_if->hwcfg2.b.architecture == 0)) {
++		if (dwc_otg_param_initialized(core_if->core_params->dma_enable)) {
++			DWC_ERROR
++			    ("%d invalid for dma_enable paremter. Check HW configuration.\n",
++			     val);
++		}
++		val = 0;
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->dma_enable = val;
++	if (val == 0) {
++		dwc_otg_set_param_dma_desc_enable(core_if, 0);
++	}
++	return retval;
++}
++
++int32_t dwc_otg_get_param_dma_enable(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->dma_enable;
++}
++
++int dwc_otg_set_param_dma_desc_enable(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong value for dma_enable\n");
++		DWC_WARN("dma_desc_enable must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	if ((val == 1)
++	    && ((dwc_otg_get_param_dma_enable(core_if) == 0)
++		|| (core_if->hwcfg4.b.desc_dma == 0))) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->dma_desc_enable)) {
++			DWC_ERROR
++			    ("%d invalid for dma_desc_enable paremter. Check HW configuration.\n",
++			     val);
++		}
++		val = 0;
++		retval = -DWC_E_INVALID;
++	}
++	core_if->core_params->dma_desc_enable = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_dma_desc_enable(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->dma_desc_enable;
++}
++
++int dwc_otg_set_param_host_support_fs_ls_low_power(dwc_otg_core_if_t * core_if,
++						   int32_t val)
++{
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong value for host_support_fs_low_power\n");
++		DWC_WARN("host_support_fs_low_power must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++	core_if->core_params->host_support_fs_ls_low_power = val;
++	return 0;
++}
++
++int32_t dwc_otg_get_param_host_support_fs_ls_low_power(dwc_otg_core_if_t *
++						       core_if)
++{
++	return core_if->core_params->host_support_fs_ls_low_power;
++}
++
++int dwc_otg_set_param_enable_dynamic_fifo(dwc_otg_core_if_t * core_if,
++					  int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong value for enable_dynamic_fifo\n");
++		DWC_WARN("enable_dynamic_fifo must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	if ((val == 1) && (core_if->hwcfg2.b.dynamic_fifo == 0)) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->enable_dynamic_fifo)) {
++			DWC_ERROR
++			    ("%d invalid for enable_dynamic_fifo paremter. Check HW configuration.\n",
++			     val);
++		}
++		val = 0;
++		retval = -DWC_E_INVALID;
++	}
++	core_if->core_params->enable_dynamic_fifo = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_enable_dynamic_fifo(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->enable_dynamic_fifo;
++}
++
++int dwc_otg_set_param_data_fifo_size(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 32, 32768)) {
++		DWC_WARN("Wrong value for data_fifo_size\n");
++		DWC_WARN("data_fifo_size must be 32-32768\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val > core_if->hwcfg3.b.dfifo_depth) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->data_fifo_size)) {
++			DWC_ERROR
++			    ("%d invalid for data_fifo_size parameter. Check HW configuration.\n",
++			     val);
++		}
++		val = core_if->hwcfg3.b.dfifo_depth;
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->data_fifo_size = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_data_fifo_size(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->data_fifo_size;
++}
++
++int dwc_otg_set_param_dev_rx_fifo_size(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 16, 32768)) {
++		DWC_WARN("Wrong value for dev_rx_fifo_size\n");
++		DWC_WARN("dev_rx_fifo_size must be 16-32768\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val > DWC_READ_REG32(&core_if->core_global_regs->grxfsiz)) {
++		if (dwc_otg_param_initialized(core_if->core_params->dev_rx_fifo_size)) {
++		DWC_WARN("%d invalid for dev_rx_fifo_size parameter\n", val);
++		}
++		val = DWC_READ_REG32(&core_if->core_global_regs->grxfsiz);
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->dev_rx_fifo_size = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_dev_rx_fifo_size(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->dev_rx_fifo_size;
++}
++
++int dwc_otg_set_param_dev_nperio_tx_fifo_size(dwc_otg_core_if_t * core_if,
++					      int32_t val)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 16, 32768)) {
++		DWC_WARN("Wrong value for dev_nperio_tx_fifo\n");
++		DWC_WARN("dev_nperio_tx_fifo must be 16-32768\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val > (DWC_READ_REG32(&core_if->core_global_regs->gnptxfsiz) >> 16)) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->dev_nperio_tx_fifo_size)) {
++			DWC_ERROR
++			    ("%d invalid for dev_nperio_tx_fifo_size. Check HW configuration.\n",
++			     val);
++		}
++		val =
++		    (DWC_READ_REG32(&core_if->core_global_regs->gnptxfsiz) >>
++		     16);
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->dev_nperio_tx_fifo_size = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_dev_nperio_tx_fifo_size(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->dev_nperio_tx_fifo_size;
++}
++
++int dwc_otg_set_param_host_rx_fifo_size(dwc_otg_core_if_t * core_if,
++					int32_t val)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 16, 32768)) {
++		DWC_WARN("Wrong value for host_rx_fifo_size\n");
++		DWC_WARN("host_rx_fifo_size must be 16-32768\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val > DWC_READ_REG32(&core_if->core_global_regs->grxfsiz)) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->host_rx_fifo_size)) {
++			DWC_ERROR
++			    ("%d invalid for host_rx_fifo_size. Check HW configuration.\n",
++			     val);
++		}
++		val = DWC_READ_REG32(&core_if->core_global_regs->grxfsiz);
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->host_rx_fifo_size = val;
++	return retval;
++
++}
++
++int32_t dwc_otg_get_param_host_rx_fifo_size(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->host_rx_fifo_size;
++}
++
++int dwc_otg_set_param_host_nperio_tx_fifo_size(dwc_otg_core_if_t * core_if,
++					       int32_t val)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 16, 32768)) {
++		DWC_WARN("Wrong value for host_nperio_tx_fifo_size\n");
++		DWC_WARN("host_nperio_tx_fifo_size must be 16-32768\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val > (DWC_READ_REG32(&core_if->core_global_regs->gnptxfsiz) >> 16)) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->host_nperio_tx_fifo_size)) {
++			DWC_ERROR
++			    ("%d invalid for host_nperio_tx_fifo_size. Check HW configuration.\n",
++			     val);
++		}
++		val =
++		    (DWC_READ_REG32(&core_if->core_global_regs->gnptxfsiz) >>
++		     16);
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->host_nperio_tx_fifo_size = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_host_nperio_tx_fifo_size(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->host_nperio_tx_fifo_size;
++}
++
++int dwc_otg_set_param_host_perio_tx_fifo_size(dwc_otg_core_if_t * core_if,
++					      int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 16, 32768)) {
++		DWC_WARN("Wrong value for host_perio_tx_fifo_size\n");
++		DWC_WARN("host_perio_tx_fifo_size must be 16-32768\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val > ((core_if->hptxfsiz.d32) >> 16)) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->host_perio_tx_fifo_size)) {
++			DWC_ERROR
++			    ("%d invalid for host_perio_tx_fifo_size. Check HW configuration.\n",
++			     val);
++		}
++		val = (core_if->hptxfsiz.d32) >> 16;
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->host_perio_tx_fifo_size = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_host_perio_tx_fifo_size(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->host_perio_tx_fifo_size;
++}
++
++int dwc_otg_set_param_max_transfer_size(dwc_otg_core_if_t * core_if,
++					int32_t val)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 2047, 524288)) {
++		DWC_WARN("Wrong value for max_transfer_size\n");
++		DWC_WARN("max_transfer_size must be 2047-524288\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val >= (1 << (core_if->hwcfg3.b.xfer_size_cntr_width + 11))) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->max_transfer_size)) {
++			DWC_ERROR
++			    ("%d invalid for max_transfer_size. Check HW configuration.\n",
++			     val);
++		}
++		val =
++		    ((1 << (core_if->hwcfg3.b.packet_size_cntr_width + 11)) -
++		     1);
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->max_transfer_size = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_max_transfer_size(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->max_transfer_size;
++}
++
++int dwc_otg_set_param_max_packet_count(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 15, 511)) {
++		DWC_WARN("Wrong value for max_packet_count\n");
++		DWC_WARN("max_packet_count must be 15-511\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val > (1 << (core_if->hwcfg3.b.packet_size_cntr_width + 4))) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->max_packet_count)) {
++			DWC_ERROR
++			    ("%d invalid for max_packet_count. Check HW configuration.\n",
++			     val);
++		}
++		val =
++		    ((1 << (core_if->hwcfg3.b.packet_size_cntr_width + 4)) - 1);
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->max_packet_count = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_max_packet_count(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->max_packet_count;
++}
++
++int dwc_otg_set_param_host_channels(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 1, 16)) {
++		DWC_WARN("Wrong value for host_channels\n");
++		DWC_WARN("host_channels must be 1-16\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val > (core_if->hwcfg2.b.num_host_chan + 1)) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->host_channels)) {
++			DWC_ERROR
++			    ("%d invalid for host_channels. Check HW configurations.\n",
++			     val);
++		}
++		val = (core_if->hwcfg2.b.num_host_chan + 1);
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->host_channels = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_host_channels(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->host_channels;
++}
++
++int dwc_otg_set_param_dev_endpoints(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 1, 15)) {
++		DWC_WARN("Wrong value for dev_endpoints\n");
++		DWC_WARN("dev_endpoints must be 1-15\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val > (core_if->hwcfg2.b.num_dev_ep)) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->dev_endpoints)) {
++			DWC_ERROR
++			    ("%d invalid for dev_endpoints. Check HW configurations.\n",
++			     val);
++		}
++		val = core_if->hwcfg2.b.num_dev_ep;
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->dev_endpoints = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_dev_endpoints(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->dev_endpoints;
++}
++
++int dwc_otg_set_param_phy_type(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	int valid = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 0, 2)) {
++		DWC_WARN("Wrong value for phy_type\n");
++		DWC_WARN("phy_type must be 0,1 or 2\n");
++		return -DWC_E_INVALID;
++	}
++#ifndef NO_FS_PHY_HW_CHECKS
++	if ((val == DWC_PHY_TYPE_PARAM_UTMI) &&
++	    ((core_if->hwcfg2.b.hs_phy_type == 1) ||
++	     (core_if->hwcfg2.b.hs_phy_type == 3))) {
++		valid = 1;
++	} else if ((val == DWC_PHY_TYPE_PARAM_ULPI) &&
++		   ((core_if->hwcfg2.b.hs_phy_type == 2) ||
++		    (core_if->hwcfg2.b.hs_phy_type == 3))) {
++		valid = 1;
++	} else if ((val == DWC_PHY_TYPE_PARAM_FS) &&
++		   (core_if->hwcfg2.b.fs_phy_type == 1)) {
++		valid = 1;
++	}
++	if (!valid) {
++		if (dwc_otg_param_initialized(core_if->core_params->phy_type)) {
++			DWC_ERROR
++			    ("%d invalid for phy_type. Check HW configurations.\n",
++			     val);
++		}
++		if (core_if->hwcfg2.b.hs_phy_type) {
++			if ((core_if->hwcfg2.b.hs_phy_type == 3) ||
++			    (core_if->hwcfg2.b.hs_phy_type == 1)) {
++				val = DWC_PHY_TYPE_PARAM_UTMI;
++			} else {
++				val = DWC_PHY_TYPE_PARAM_ULPI;
++			}
++		}
++		retval = -DWC_E_INVALID;
++	}
++#endif
++	core_if->core_params->phy_type = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_phy_type(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->phy_type;
++}
++
++int dwc_otg_set_param_speed(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong value for speed parameter\n");
++		DWC_WARN("max_speed parameter must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++	if ((val == 0)
++	    && dwc_otg_get_param_phy_type(core_if) == DWC_PHY_TYPE_PARAM_FS) {
++		if (dwc_otg_param_initialized(core_if->core_params->speed)) {
++			DWC_ERROR
++			    ("%d invalid for speed paremter. Check HW configuration.\n",
++			     val);
++		}
++		val =
++		    (dwc_otg_get_param_phy_type(core_if) ==
++		     DWC_PHY_TYPE_PARAM_FS ? 1 : 0);
++		retval = -DWC_E_INVALID;
++	}
++	core_if->core_params->speed = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_speed(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->speed;
++}
++
++int dwc_otg_set_param_host_ls_low_power_phy_clk(dwc_otg_core_if_t * core_if,
++						int32_t val)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN
++		    ("Wrong value for host_ls_low_power_phy_clk parameter\n");
++		DWC_WARN("host_ls_low_power_phy_clk must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	if ((val == DWC_HOST_LS_LOW_POWER_PHY_CLK_PARAM_48MHZ)
++	    && (dwc_otg_get_param_phy_type(core_if) == DWC_PHY_TYPE_PARAM_FS)) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->host_ls_low_power_phy_clk)) {
++			DWC_ERROR
++			    ("%d invalid for host_ls_low_power_phy_clk. Check HW configuration.\n",
++			     val);
++		}
++		val =
++		    (dwc_otg_get_param_phy_type(core_if) ==
++		     DWC_PHY_TYPE_PARAM_FS) ?
++		    DWC_HOST_LS_LOW_POWER_PHY_CLK_PARAM_6MHZ :
++		    DWC_HOST_LS_LOW_POWER_PHY_CLK_PARAM_48MHZ;
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->host_ls_low_power_phy_clk = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_host_ls_low_power_phy_clk(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->host_ls_low_power_phy_clk;
++}
++
++int dwc_otg_set_param_phy_ulpi_ddr(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong value for phy_ulpi_ddr\n");
++		DWC_WARN("phy_upli_ddr must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	core_if->core_params->phy_ulpi_ddr = val;
++	return 0;
++}
++
++int32_t dwc_otg_get_param_phy_ulpi_ddr(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->phy_ulpi_ddr;
++}
++
++int dwc_otg_set_param_phy_ulpi_ext_vbus(dwc_otg_core_if_t * core_if,
++					int32_t val)
++{
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong valaue for phy_ulpi_ext_vbus\n");
++		DWC_WARN("phy_ulpi_ext_vbus must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	core_if->core_params->phy_ulpi_ext_vbus = val;
++	return 0;
++}
++
++int32_t dwc_otg_get_param_phy_ulpi_ext_vbus(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->phy_ulpi_ext_vbus;
++}
++
++int dwc_otg_set_param_phy_utmi_width(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	if (DWC_OTG_PARAM_TEST(val, 8, 8) && DWC_OTG_PARAM_TEST(val, 16, 16)) {
++		DWC_WARN("Wrong valaue for phy_utmi_width\n");
++		DWC_WARN("phy_utmi_width must be 8 or 16\n");
++		return -DWC_E_INVALID;
++	}
++
++	core_if->core_params->phy_utmi_width = val;
++	return 0;
++}
++
++int32_t dwc_otg_get_param_phy_utmi_width(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->phy_utmi_width;
++}
++
++int dwc_otg_set_param_ulpi_fs_ls(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong valaue for ulpi_fs_ls\n");
++		DWC_WARN("ulpi_fs_ls must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	core_if->core_params->ulpi_fs_ls = val;
++	return 0;
++}
++
++int32_t dwc_otg_get_param_ulpi_fs_ls(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->ulpi_fs_ls;
++}
++
++int dwc_otg_set_param_ts_dline(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong valaue for ts_dline\n");
++		DWC_WARN("ts_dline must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	core_if->core_params->ts_dline = val;
++	return 0;
++}
++
++int32_t dwc_otg_get_param_ts_dline(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->ts_dline;
++}
++
++int dwc_otg_set_param_i2c_enable(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong valaue for i2c_enable\n");
++		DWC_WARN("i2c_enable must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++#ifndef NO_FS_PHY_HW_CHECK
++	if (val == 1 && core_if->hwcfg3.b.i2c == 0) {
++		if (dwc_otg_param_initialized(core_if->core_params->i2c_enable)) {
++			DWC_ERROR
++			    ("%d invalid for i2c_enable. Check HW configuration.\n",
++			     val);
++		}
++		val = 0;
++		retval = -DWC_E_INVALID;
++	}
++#endif
++
++	core_if->core_params->i2c_enable = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_i2c_enable(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->i2c_enable;
++}
++
++int dwc_otg_set_param_dev_perio_tx_fifo_size(dwc_otg_core_if_t * core_if,
++					     int32_t val, int fifo_num)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 4, 768)) {
++		DWC_WARN("Wrong value for dev_perio_tx_fifo_size\n");
++		DWC_WARN("dev_perio_tx_fifo_size must be 4-768\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val >
++	    (DWC_READ_REG32(&core_if->core_global_regs->dtxfsiz[fifo_num]))) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->dev_perio_tx_fifo_size[fifo_num])) {
++			DWC_ERROR
++			    ("`%d' invalid for parameter `dev_perio_fifo_size_%d'. Check HW configuration.\n",
++			     val, fifo_num);
++		}
++		val = (DWC_READ_REG32(&core_if->core_global_regs->dtxfsiz[fifo_num]));
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->dev_perio_tx_fifo_size[fifo_num] = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_dev_perio_tx_fifo_size(dwc_otg_core_if_t * core_if,
++						 int fifo_num)
++{
++	return core_if->core_params->dev_perio_tx_fifo_size[fifo_num];
++}
++
++int dwc_otg_set_param_en_multiple_tx_fifo(dwc_otg_core_if_t * core_if,
++					  int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong valaue for en_multiple_tx_fifo,\n");
++		DWC_WARN("en_multiple_tx_fifo must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val == 1 && core_if->hwcfg4.b.ded_fifo_en == 0) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->en_multiple_tx_fifo)) {
++			DWC_ERROR
++			    ("%d invalid for parameter en_multiple_tx_fifo. Check HW configuration.\n",
++			     val);
++		}
++		val = 0;
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->en_multiple_tx_fifo = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_en_multiple_tx_fifo(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->en_multiple_tx_fifo;
++}
++
++int dwc_otg_set_param_dev_tx_fifo_size(dwc_otg_core_if_t * core_if, int32_t val,
++				       int fifo_num)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 4, 768)) {
++		DWC_WARN("Wrong value for dev_tx_fifo_size\n");
++		DWC_WARN("dev_tx_fifo_size must be 4-768\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val >
++	    (DWC_READ_REG32(&core_if->core_global_regs->dtxfsiz[fifo_num]))) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->dev_tx_fifo_size[fifo_num])) {
++			DWC_ERROR
++			    ("`%d' invalid for parameter `dev_tx_fifo_size_%d'. Check HW configuration.\n",
++			     val, fifo_num);
++		}
++		val = (DWC_READ_REG32(&core_if->core_global_regs->dtxfsiz[fifo_num]));
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->dev_tx_fifo_size[fifo_num] = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_dev_tx_fifo_size(dwc_otg_core_if_t * core_if,
++					   int fifo_num)
++{
++	return core_if->core_params->dev_tx_fifo_size[fifo_num];
++}
++
++int dwc_otg_set_param_thr_ctl(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 0, 7)) {
++		DWC_WARN("Wrong value for thr_ctl\n");
++		DWC_WARN("thr_ctl must be 0-7\n");
++		return -DWC_E_INVALID;
++	}
++
++	if ((val != 0) &&
++	    (!dwc_otg_get_param_dma_enable(core_if) ||
++	     !core_if->hwcfg4.b.ded_fifo_en)) {
++		if (dwc_otg_param_initialized(core_if->core_params->thr_ctl)) {
++			DWC_ERROR
++			    ("%d invalid for parameter thr_ctl. Check HW configuration.\n",
++			     val);
++		}
++		val = 0;
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->thr_ctl = val;
++	return retval;
++}
++
++static int32_t dwc_otg_get_param_thr_ctl(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->thr_ctl;
++}
++
++int dwc_otg_set_param_lpm_enable(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("Wrong value for lpm_enable\n");
++		DWC_WARN("lpm_enable must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val && !core_if->hwcfg3.b.otg_lpm_en) {
++		if (dwc_otg_param_initialized(core_if->core_params->lpm_enable)) {
++			DWC_ERROR
++			    ("%d invalid for parameter lpm_enable. Check HW configuration.\n",
++			     val);
++		}
++		val = 0;
++		retval = -DWC_E_INVALID;
++	}
++
++	core_if->core_params->lpm_enable = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_lpm_enable(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->lpm_enable;
++}
++
++int dwc_otg_set_param_tx_thr_length(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	if (DWC_OTG_PARAM_TEST(val, 8, 128)) {
++		DWC_WARN("Wrong valaue for tx_thr_length\n");
++		DWC_WARN("tx_thr_length must be 8 - 128\n");
++		return -DWC_E_INVALID;
++	}
++
++	core_if->core_params->tx_thr_length = val;
++	return 0;
++}
++
++static int32_t dwc_otg_get_param_tx_thr_length(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->tx_thr_length;
++}
++
++int dwc_otg_set_param_rx_thr_length(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	if (DWC_OTG_PARAM_TEST(val, 8, 128)) {
++		DWC_WARN("Wrong valaue for rx_thr_length\n");
++		DWC_WARN("rx_thr_length must be 8 - 128\n");
++		return -DWC_E_INVALID;
++	}
++
++	core_if->core_params->rx_thr_length = val;
++	return 0;
++}
++
++int dwc_otg_set_param_dma_burst_size(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	if (DWC_OTG_PARAM_TEST(val, 1, 1) &&
++	    DWC_OTG_PARAM_TEST(val, 4, 4) &&
++	    DWC_OTG_PARAM_TEST(val, 8, 8) &&
++	    DWC_OTG_PARAM_TEST(val, 16, 16) &&
++	    DWC_OTG_PARAM_TEST(val, 32, 32) &&
++	    DWC_OTG_PARAM_TEST(val, 64, 64) &&
++	    DWC_OTG_PARAM_TEST(val, 128, 128) &&
++	    DWC_OTG_PARAM_TEST(val, 256, 256)) {
++		DWC_WARN("`%d' invalid for parameter `dma_burst_size'\n", val);
++		return -DWC_E_INVALID;
++	}
++	core_if->core_params->dma_burst_size = val;
++	return 0;
++}
++
++int32_t dwc_otg_get_param_dma_burst_size(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->dma_burst_size;
++}
++
++int dwc_otg_set_param_pti_enable(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("`%d' invalid for parameter `pti_enable'\n", val);
++		return -DWC_E_INVALID;
++	}
++	if (val && (core_if->snpsid < OTG_CORE_REV_2_72a)) {
++		if (dwc_otg_param_initialized(core_if->core_params->pti_enable)) {
++			DWC_ERROR
++			    ("%d invalid for parameter pti_enable. Check HW configuration.\n",
++			     val);
++		}
++		retval = -DWC_E_INVALID;
++		val = 0;
++	}
++	core_if->core_params->pti_enable = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_pti_enable(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->pti_enable;
++}
++
++int dwc_otg_set_param_mpi_enable(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("`%d' invalid for parameter `mpi_enable'\n", val);
++		return -DWC_E_INVALID;
++	}
++	if (val && (core_if->hwcfg2.b.multi_proc_int == 0)) {
++		if (dwc_otg_param_initialized(core_if->core_params->mpi_enable)) {
++			DWC_ERROR
++			    ("%d invalid for parameter mpi_enable. Check HW configuration.\n",
++			     val);
++		}
++		retval = -DWC_E_INVALID;
++		val = 0;
++	}
++	core_if->core_params->mpi_enable = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_mpi_enable(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->mpi_enable;
++}
++
++int dwc_otg_set_param_adp_enable(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("`%d' invalid for parameter `adp_enable'\n", val);
++		return -DWC_E_INVALID;
++	}
++	if (val && (core_if->hwcfg3.b.adp_supp == 0)) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->adp_supp_enable)) {
++			DWC_ERROR
++			    ("%d invalid for parameter adp_enable. Check HW configuration.\n",
++			     val);
++		}
++		retval = -DWC_E_INVALID;
++		val = 0;
++	}
++	core_if->core_params->adp_supp_enable = val;
++	/*Set OTG version 2.0 in case of enabling ADP*/
++	if (val)
++		dwc_otg_set_param_otg_ver(core_if, 1);
++
++	return retval;
++}
++
++int32_t dwc_otg_get_param_adp_enable(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->adp_supp_enable;
++}
++
++int dwc_otg_set_param_ic_usb_cap(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("`%d' invalid for parameter `ic_usb_cap'\n", val);
++		DWC_WARN("ic_usb_cap must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val && (core_if->hwcfg2.b.otg_enable_ic_usb == 0)) {
++		if (dwc_otg_param_initialized(core_if->core_params->ic_usb_cap)) {
++			DWC_ERROR
++			    ("%d invalid for parameter ic_usb_cap. Check HW configuration.\n",
++			     val);
++		}
++		retval = -DWC_E_INVALID;
++		val = 0;
++	}
++	core_if->core_params->ic_usb_cap = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_ic_usb_cap(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->ic_usb_cap;
++}
++
++int dwc_otg_set_param_ahb_thr_ratio(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	int valid = 1;
++
++	if (DWC_OTG_PARAM_TEST(val, 0, 3)) {
++		DWC_WARN("`%d' invalid for parameter `ahb_thr_ratio'\n", val);
++		DWC_WARN("ahb_thr_ratio must be 0 - 3\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (val
++	    && (core_if->snpsid < OTG_CORE_REV_2_81a
++		|| !dwc_otg_get_param_thr_ctl(core_if))) {
++		valid = 0;
++	} else if (val
++		   && ((dwc_otg_get_param_tx_thr_length(core_if) / (1 << val)) <
++		       4)) {
++		valid = 0;
++	}
++	if (valid == 0) {
++		if (dwc_otg_param_initialized
++		    (core_if->core_params->ahb_thr_ratio)) {
++			DWC_ERROR
++			    ("%d invalid for parameter ahb_thr_ratio. Check HW configuration.\n",
++			     val);
++		}
++		retval = -DWC_E_INVALID;
++		val = 0;
++	}
++
++	core_if->core_params->ahb_thr_ratio = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_ahb_thr_ratio(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->ahb_thr_ratio;
++}
++
++int dwc_otg_set_param_power_down(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	int valid = 1;
++	hwcfg4_data_t hwcfg4 = {.d32 = 0 };
++	hwcfg4.d32 = DWC_READ_REG32(&core_if->core_global_regs->ghwcfg4);
++
++	if (DWC_OTG_PARAM_TEST(val, 0, 3)) {
++		DWC_WARN("`%d' invalid for parameter `power_down'\n", val);
++		DWC_WARN("power_down must be 0 - 2\n");
++		return -DWC_E_INVALID;
++	}
++
++	if ((val == 2) && (core_if->snpsid < OTG_CORE_REV_2_91a)) {
++		valid = 0;
++	}
++	if ((val == 3)
++	    && ((core_if->snpsid < OTG_CORE_REV_3_00a)
++		|| (hwcfg4.b.xhiber == 0))) {
++		valid = 0;
++	}
++	if (valid == 0) {
++		if (dwc_otg_param_initialized(core_if->core_params->power_down)) {
++			DWC_ERROR
++			    ("%d invalid for parameter power_down. Check HW configuration.\n",
++			     val);
++		}
++		retval = -DWC_E_INVALID;
++		val = 0;
++	}
++	core_if->core_params->power_down = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_power_down(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->power_down;
++}
++
++int dwc_otg_set_param_reload_ctl(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	int valid = 1;
++
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("`%d' invalid for parameter `reload_ctl'\n", val);
++		DWC_WARN("reload_ctl must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	if ((val == 1) && (core_if->snpsid < OTG_CORE_REV_2_92a)) {
++		valid = 0;
++	}
++	if (valid == 0) {
++		if (dwc_otg_param_initialized(core_if->core_params->reload_ctl)) {
++			DWC_ERROR("%d invalid for parameter reload_ctl."
++				  "Check HW configuration.\n", val);
++		}
++		retval = -DWC_E_INVALID;
++		val = 0;
++	}
++	core_if->core_params->reload_ctl = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_reload_ctl(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->reload_ctl;
++}
++
++int dwc_otg_set_param_dev_out_nak(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	int valid = 1;
++
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("`%d' invalid for parameter `dev_out_nak'\n", val);
++		DWC_WARN("dev_out_nak must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	if ((val == 1) && ((core_if->snpsid < OTG_CORE_REV_2_93a) ||
++		!(core_if->core_params->dma_desc_enable))) {
++		valid = 0;
++	}
++	if (valid == 0) {
++		if (dwc_otg_param_initialized(core_if->core_params->dev_out_nak)) {
++			DWC_ERROR("%d invalid for parameter dev_out_nak."
++				"Check HW configuration.\n", val);
++		}
++		retval = -DWC_E_INVALID;
++		val = 0;
++	}
++	core_if->core_params->dev_out_nak = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_dev_out_nak(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->dev_out_nak;
++}
++
++int dwc_otg_set_param_cont_on_bna(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	int valid = 1;
++
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("`%d' invalid for parameter `cont_on_bna'\n", val);
++		DWC_WARN("cont_on_bna must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	if ((val == 1) && ((core_if->snpsid < OTG_CORE_REV_2_94a) ||
++		!(core_if->core_params->dma_desc_enable))) {
++			valid = 0;
++	}
++	if (valid == 0) {
++		if (dwc_otg_param_initialized(core_if->core_params->cont_on_bna)) {
++			DWC_ERROR("%d invalid for parameter cont_on_bna."
++				"Check HW configuration.\n", val);
++		}
++		retval = -DWC_E_INVALID;
++		val = 0;
++	}
++	core_if->core_params->cont_on_bna = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_cont_on_bna(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->cont_on_bna;
++}
++
++int dwc_otg_set_param_ahb_single(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++	int valid = 1;
++
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("`%d' invalid for parameter `ahb_single'\n", val);
++		DWC_WARN("ahb_single must be 0 or 1\n");
++		return -DWC_E_INVALID;
++	}
++
++	if ((val == 1) && (core_if->snpsid < OTG_CORE_REV_2_94a)) {
++			valid = 0;
++	}
++	if (valid == 0) {
++		if (dwc_otg_param_initialized(core_if->core_params->ahb_single)) {
++			DWC_ERROR("%d invalid for parameter ahb_single."
++				"Check HW configuration.\n", val);
++		}
++		retval = -DWC_E_INVALID;
++		val = 0;
++	}
++	core_if->core_params->ahb_single = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_ahb_single(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->ahb_single;
++}
++
++int dwc_otg_set_param_otg_ver(dwc_otg_core_if_t * core_if, int32_t val)
++{
++	int retval = 0;
++
++	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
++		DWC_WARN("`%d' invalid for parameter `otg_ver'\n", val);
++		DWC_WARN
++		    ("otg_ver must be 0(for OTG 1.3 support) or 1(for OTG 2.0 support)\n");
++		return -DWC_E_INVALID;
++	}
++
++	core_if->core_params->otg_ver = val;
++	return retval;
++}
++
++int32_t dwc_otg_get_param_otg_ver(dwc_otg_core_if_t * core_if)
++{
++	return core_if->core_params->otg_ver;
++}
++
++uint32_t dwc_otg_get_hnpstatus(dwc_otg_core_if_t * core_if)
++{
++	gotgctl_data_t otgctl;
++	otgctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
++	return otgctl.b.hstnegscs;
++}
++
++uint32_t dwc_otg_get_srpstatus(dwc_otg_core_if_t * core_if)
++{
++	gotgctl_data_t otgctl;
++	otgctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
++	return otgctl.b.sesreqscs;
++}
++
++void dwc_otg_set_hnpreq(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	if(core_if->otg_ver == 0) {
++		gotgctl_data_t otgctl;
++		otgctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
++		otgctl.b.hnpreq = val;
++		DWC_WRITE_REG32(&core_if->core_global_regs->gotgctl, otgctl.d32);
++	} else {
++		core_if->otg_sts = val;
++	}
++}
++
++uint32_t dwc_otg_get_gsnpsid(dwc_otg_core_if_t * core_if)
++{
++	return core_if->snpsid;
++}
++
++uint32_t dwc_otg_get_mode(dwc_otg_core_if_t * core_if)
++{
++	gintsts_data_t gintsts;
++	gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
++	return gintsts.b.curmode;
++}
++
++uint32_t dwc_otg_get_hnpcapable(dwc_otg_core_if_t * core_if)
++{
++	gusbcfg_data_t usbcfg;
++	usbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
++	return usbcfg.b.hnpcap;
++}
++
++void dwc_otg_set_hnpcapable(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	gusbcfg_data_t usbcfg;
++	usbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
++	usbcfg.b.hnpcap = val;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, usbcfg.d32);
++}
++
++uint32_t dwc_otg_get_srpcapable(dwc_otg_core_if_t * core_if)
++{
++	gusbcfg_data_t usbcfg;
++	usbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
++	return usbcfg.b.srpcap;
++}
++
++void dwc_otg_set_srpcapable(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	gusbcfg_data_t usbcfg;
++	usbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
++	usbcfg.b.srpcap = val;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, usbcfg.d32);
++}
++
++uint32_t dwc_otg_get_devspeed(dwc_otg_core_if_t * core_if)
++{
++	dcfg_data_t dcfg;
++	/* originally: dcfg.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg); */
++
++        dcfg.d32 = -1; //GRAYG
++        DWC_DEBUGPL(DBG_CILV, "%s - core_if(%p)\n", __func__, core_if);
++        if (NULL == core_if)
++                DWC_ERROR("reg request with NULL core_if\n");
++        DWC_DEBUGPL(DBG_CILV, "%s - core_if(%p)->dev_if(%p)\n", __func__,
++                    core_if, core_if->dev_if);
++        if (NULL == core_if->dev_if)
++                DWC_ERROR("reg request with NULL dev_if\n");
++        DWC_DEBUGPL(DBG_CILV, "%s - core_if(%p)->dev_if(%p)->"
++                    "dev_global_regs(%p)\n", __func__,
++                    core_if, core_if->dev_if,
++                    core_if->dev_if->dev_global_regs);
++        if (NULL == core_if->dev_if->dev_global_regs)
++                DWC_ERROR("reg request with NULL dev_global_regs\n");
++        else {
++                DWC_DEBUGPL(DBG_CILV, "%s - &core_if(%p)->dev_if(%p)->"
++                            "dev_global_regs(%p)->dcfg = %p\n", __func__,
++                            core_if, core_if->dev_if,
++                            core_if->dev_if->dev_global_regs,
++                            &core_if->dev_if->dev_global_regs->dcfg);
++		dcfg.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
++        }
++	return dcfg.b.devspd;
++}
++
++void dwc_otg_set_devspeed(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	dcfg_data_t dcfg;
++	dcfg.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
++	dcfg.b.devspd = val;
++	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg, dcfg.d32);
++}
++
++uint32_t dwc_otg_get_busconnected(dwc_otg_core_if_t * core_if)
++{
++	hprt0_data_t hprt0;
++	hprt0.d32 = DWC_READ_REG32(core_if->host_if->hprt0);
++	return hprt0.b.prtconnsts;
++}
++
++uint32_t dwc_otg_get_enumspeed(dwc_otg_core_if_t * core_if)
++{
++	dsts_data_t dsts;
++	dsts.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
++	return dsts.b.enumspd;
++}
++
++uint32_t dwc_otg_get_prtpower(dwc_otg_core_if_t * core_if)
++{
++	hprt0_data_t hprt0;
++	hprt0.d32 = DWC_READ_REG32(core_if->host_if->hprt0);
++	return hprt0.b.prtpwr;
++
++}
++
++uint32_t dwc_otg_get_core_state(dwc_otg_core_if_t * core_if)
++{
++	return core_if->hibernation_suspend;
++}
++
++void dwc_otg_set_prtpower(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	hprt0_data_t hprt0;
++	hprt0.d32 = dwc_otg_read_hprt0(core_if);
++	hprt0.b.prtpwr = val;
++	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++}
++
++uint32_t dwc_otg_get_prtsuspend(dwc_otg_core_if_t * core_if)
++{
++	hprt0_data_t hprt0;
++	hprt0.d32 = DWC_READ_REG32(core_if->host_if->hprt0);
++	return hprt0.b.prtsusp;
++
++}
++
++void dwc_otg_set_prtsuspend(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	hprt0_data_t hprt0;
++	hprt0.d32 = dwc_otg_read_hprt0(core_if);
++	hprt0.b.prtsusp = val;
++	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++}
++
++uint32_t dwc_otg_get_fr_interval(dwc_otg_core_if_t * core_if)
++{
++	hfir_data_t hfir;
++	hfir.d32 = DWC_READ_REG32(&core_if->host_if->host_global_regs->hfir);
++	return hfir.b.frint;
++
++}
++
++void dwc_otg_set_fr_interval(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	hfir_data_t hfir;
++	uint32_t fram_int;
++	fram_int = calc_frame_interval(core_if);
++	hfir.d32 = DWC_READ_REG32(&core_if->host_if->host_global_regs->hfir);
++	if (!core_if->core_params->reload_ctl) {
++		DWC_WARN("\nCannot reload HFIR register.HFIR.HFIRRldCtrl bit is"
++			 "not set to 1.\nShould load driver with reload_ctl=1"
++			 " module parameter\n");
++		return;
++	}
++	switch (fram_int) {
++	case 3750:
++		if ((val < 3350) || (val > 4150)) {
++			DWC_WARN("HFIR interval for HS core and 30 MHz"
++				 "clock freq should be from 3350 to 4150\n");
++			return;
++		}
++		break;
++	case 30000:
++		if ((val < 26820) || (val > 33180)) {
++			DWC_WARN("HFIR interval for FS/LS core and 30 MHz"
++				 "clock freq should be from 26820 to 33180\n");
++			return;
++		}
++		break;
++	case 6000:
++		if ((val < 5360) || (val > 6640)) {
++			DWC_WARN("HFIR interval for HS core and 48 MHz"
++				 "clock freq should be from 5360 to 6640\n");
++			return;
++		}
++		break;
++	case 48000:
++		if ((val < 42912) || (val > 53088)) {
++			DWC_WARN("HFIR interval for FS/LS core and 48 MHz"
++				 "clock freq should be from 42912 to 53088\n");
++			return;
++		}
++		break;
++	case 7500:
++		if ((val < 6700) || (val > 8300)) {
++			DWC_WARN("HFIR interval for HS core and 60 MHz"
++				 "clock freq should be from 6700 to 8300\n");
++			return;
++		}
++		break;
++	case 60000:
++		if ((val < 53640) || (val > 65536)) {
++			DWC_WARN("HFIR interval for FS/LS core and 60 MHz"
++				 "clock freq should be from 53640 to 65536\n");
++			return;
++		}
++		break;
++	default:
++		DWC_WARN("Unknown frame interval\n");
++		return;
++		break;
++
++	}
++	hfir.b.frint = val;
++	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hfir, hfir.d32);
++}
++
++uint32_t dwc_otg_get_mode_ch_tim(dwc_otg_core_if_t * core_if)
++{
++	hcfg_data_t hcfg;
++	hcfg.d32 = DWC_READ_REG32(&core_if->host_if->host_global_regs->hcfg);
++	return hcfg.b.modechtimen;
++
++}
++
++void dwc_otg_set_mode_ch_tim(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	hcfg_data_t hcfg;
++	hcfg.d32 = DWC_READ_REG32(&core_if->host_if->host_global_regs->hcfg);
++	hcfg.b.modechtimen = val;
++	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hcfg, hcfg.d32);
++}
++
++void dwc_otg_set_prtresume(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	hprt0_data_t hprt0;
++	hprt0.d32 = dwc_otg_read_hprt0(core_if);
++	hprt0.b.prtres = val;
++	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++}
++
++uint32_t dwc_otg_get_remotewakesig(dwc_otg_core_if_t * core_if)
++{
++	dctl_data_t dctl;
++	dctl.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dctl);
++	return dctl.b.rmtwkupsig;
++}
++
++uint32_t dwc_otg_get_lpm_portsleepstatus(dwc_otg_core_if_t * core_if)
++{
++	glpmcfg_data_t lpmcfg;
++	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++
++	DWC_ASSERT(!
++		   ((core_if->lx_state == DWC_OTG_L1) ^ lpmcfg.b.prt_sleep_sts),
++		   "lx_state = %d, lmpcfg.prt_sleep_sts = %d\n",
++		   core_if->lx_state, lpmcfg.b.prt_sleep_sts);
++
++	return lpmcfg.b.prt_sleep_sts;
++}
++
++uint32_t dwc_otg_get_lpm_remotewakeenabled(dwc_otg_core_if_t * core_if)
++{
++	glpmcfg_data_t lpmcfg;
++	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++	return lpmcfg.b.rem_wkup_en;
++}
++
++uint32_t dwc_otg_get_lpmresponse(dwc_otg_core_if_t * core_if)
++{
++	glpmcfg_data_t lpmcfg;
++	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++	return lpmcfg.b.appl_resp;
++}
++
++void dwc_otg_set_lpmresponse(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	glpmcfg_data_t lpmcfg;
++	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++	lpmcfg.b.appl_resp = val;
++	DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg, lpmcfg.d32);
++}
++
++uint32_t dwc_otg_get_hsic_connect(dwc_otg_core_if_t * core_if)
++{
++	glpmcfg_data_t lpmcfg;
++	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++	return lpmcfg.b.hsic_connect;
++}
++
++void dwc_otg_set_hsic_connect(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	glpmcfg_data_t lpmcfg;
++	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++	lpmcfg.b.hsic_connect = val;
++	DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg, lpmcfg.d32);
++}
++
++uint32_t dwc_otg_get_inv_sel_hsic(dwc_otg_core_if_t * core_if)
++{
++	glpmcfg_data_t lpmcfg;
++	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++	return lpmcfg.b.inv_sel_hsic;
++
++}
++
++void dwc_otg_set_inv_sel_hsic(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	glpmcfg_data_t lpmcfg;
++	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++	lpmcfg.b.inv_sel_hsic = val;
++	DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg, lpmcfg.d32);
++}
++
++uint32_t dwc_otg_get_gotgctl(dwc_otg_core_if_t * core_if)
++{
++	return DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
++}
++
++void dwc_otg_set_gotgctl(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	DWC_WRITE_REG32(&core_if->core_global_regs->gotgctl, val);
++}
++
++uint32_t dwc_otg_get_gusbcfg(dwc_otg_core_if_t * core_if)
++{
++	return DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
++}
++
++void dwc_otg_set_gusbcfg(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, val);
++}
++
++uint32_t dwc_otg_get_grxfsiz(dwc_otg_core_if_t * core_if)
++{
++	return DWC_READ_REG32(&core_if->core_global_regs->grxfsiz);
++}
++
++void dwc_otg_set_grxfsiz(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	DWC_WRITE_REG32(&core_if->core_global_regs->grxfsiz, val);
++}
++
++uint32_t dwc_otg_get_gnptxfsiz(dwc_otg_core_if_t * core_if)
++{
++	return DWC_READ_REG32(&core_if->core_global_regs->gnptxfsiz);
++}
++
++void dwc_otg_set_gnptxfsiz(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	DWC_WRITE_REG32(&core_if->core_global_regs->gnptxfsiz, val);
++}
++
++uint32_t dwc_otg_get_gpvndctl(dwc_otg_core_if_t * core_if)
++{
++	return DWC_READ_REG32(&core_if->core_global_regs->gpvndctl);
++}
++
++void dwc_otg_set_gpvndctl(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	DWC_WRITE_REG32(&core_if->core_global_regs->gpvndctl, val);
++}
++
++uint32_t dwc_otg_get_ggpio(dwc_otg_core_if_t * core_if)
++{
++	return DWC_READ_REG32(&core_if->core_global_regs->ggpio);
++}
++
++void dwc_otg_set_ggpio(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	DWC_WRITE_REG32(&core_if->core_global_regs->ggpio, val);
++}
++
++uint32_t dwc_otg_get_hprt0(dwc_otg_core_if_t * core_if)
++{
++	return DWC_READ_REG32(core_if->host_if->hprt0);
++
++}
++
++void dwc_otg_set_hprt0(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	DWC_WRITE_REG32(core_if->host_if->hprt0, val);
++}
++
++uint32_t dwc_otg_get_guid(dwc_otg_core_if_t * core_if)
++{
++	return DWC_READ_REG32(&core_if->core_global_regs->guid);
++}
++
++void dwc_otg_set_guid(dwc_otg_core_if_t * core_if, uint32_t val)
++{
++	DWC_WRITE_REG32(&core_if->core_global_regs->guid, val);
++}
++
++uint32_t dwc_otg_get_hptxfsiz(dwc_otg_core_if_t * core_if)
++{
++	return DWC_READ_REG32(&core_if->core_global_regs->hptxfsiz);
++}
++
++uint16_t dwc_otg_get_otg_version(dwc_otg_core_if_t * core_if)
++{
++	return ((core_if->otg_ver == 1) ? (uint16_t)0x0200 : (uint16_t)0x0103);
++}
++
++/**
++ * Start the SRP timer to detect when the SRP does not complete within
++ * 6 seconds.
++ *
++ * @param core_if the pointer to core_if strucure.
++ */
++static void dwc_otg_pcd_start_srp_timer(dwc_otg_core_if_t * core_if)
++{
++	core_if->srp_timer_started = 1;
++	DWC_TIMER_SCHEDULE(core_if->srp_timer, 6000 /* 6 secs */ );
++}
++
++void dwc_otg_initiate_srp(dwc_otg_core_if_t * core_if)
++{
++	uint32_t *addr = (uint32_t *) & (core_if->core_global_regs->gotgctl);
++	gotgctl_data_t mem;
++	gotgctl_data_t val;
++
++	val.d32 = DWC_READ_REG32(addr);
++	if (val.b.sesreq) {
++		DWC_ERROR("Session Request Already active!\n");
++		return;
++	}
++
++	DWC_INFO("Session Request Initated\n");	//NOTICE
++	mem.d32 = DWC_READ_REG32(addr);
++	mem.b.sesreq = 1;
++	DWC_WRITE_REG32(addr, mem.d32);
++
++	/* Start the SRP timer */
++	dwc_otg_pcd_start_srp_timer(core_if);
++	return;
++}
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_cil.h
+@@ -0,0 +1,1464 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_cil.h $
++ * $Revision: #123 $
++ * $Date: 2012/08/10 $
++ * $Change: 2047372 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++#if !defined(__DWC_CIL_H__)
++#define __DWC_CIL_H__
++
++#include "dwc_list.h"
++#include "dwc_otg_dbg.h"
++#include "dwc_otg_regs.h"
++
++#include "dwc_otg_core_if.h"
++#include "dwc_otg_adp.h"
++
++/**
++ * @file
++ * This file contains the interface to the Core Interface Layer.
++ */
++
++#ifdef DWC_UTE_CFI
++
++#define MAX_DMA_DESCS_PER_EP	256
++
++/**
++ * Enumeration for the data buffer mode
++ */
++typedef enum _data_buffer_mode {
++	BM_STANDARD = 0,	/* data buffer is in normal mode */
++	BM_SG = 1,		/* data buffer uses the scatter/gather mode */
++	BM_CONCAT = 2,		/* data buffer uses the concatenation mode */
++	BM_CIRCULAR = 3,	/* data buffer uses the circular DMA mode */
++	BM_ALIGN = 4		/* data buffer is in buffer alignment mode */
++} data_buffer_mode_e;
++#endif //DWC_UTE_CFI
++
++/** Macros defined for DWC OTG HW Release version */
++
++#define OTG_CORE_REV_2_60a	0x4F54260A
++#define OTG_CORE_REV_2_71a	0x4F54271A
++#define OTG_CORE_REV_2_72a	0x4F54272A
++#define OTG_CORE_REV_2_80a	0x4F54280A
++#define OTG_CORE_REV_2_81a	0x4F54281A
++#define OTG_CORE_REV_2_90a	0x4F54290A
++#define OTG_CORE_REV_2_91a	0x4F54291A
++#define OTG_CORE_REV_2_92a	0x4F54292A
++#define OTG_CORE_REV_2_93a	0x4F54293A
++#define OTG_CORE_REV_2_94a	0x4F54294A
++#define OTG_CORE_REV_3_00a	0x4F54300A
++
++/**
++ * Information for each ISOC packet.
++ */
++typedef struct iso_pkt_info {
++	uint32_t offset;
++	uint32_t length;
++	int32_t status;
++} iso_pkt_info_t;
++
++/**
++ * The <code>dwc_ep</code> structure represents the state of a single
++ * endpoint when acting in device mode. It contains the data items
++ * needed for an endpoint to be activated and transfer packets.
++ */
++typedef struct dwc_ep {
++	/** EP number used for register address lookup */
++	uint8_t num;
++	/** EP direction 0 = OUT */
++	unsigned is_in:1;
++	/** EP active. */
++	unsigned active:1;
++
++	/**
++	 * Periodic Tx FIFO # for IN EPs For INTR EP set to 0 to use non-periodic
++	 * Tx FIFO. If dedicated Tx FIFOs are enabled Tx FIFO # FOR IN EPs*/
++	unsigned tx_fifo_num:4;
++	/** EP type: 0 - Control, 1 - ISOC,	 2 - BULK,	3 - INTR */
++	unsigned type:2;
++#define DWC_OTG_EP_TYPE_CONTROL	   0
++#define DWC_OTG_EP_TYPE_ISOC	   1
++#define DWC_OTG_EP_TYPE_BULK	   2
++#define DWC_OTG_EP_TYPE_INTR	   3
++
++	/** DATA start PID for INTR and BULK EP */
++	unsigned data_pid_start:1;
++	/** Frame (even/odd) for ISOC EP */
++	unsigned even_odd_frame:1;
++	/** Max Packet bytes */
++	unsigned maxpacket:11;
++
++	/** Max Transfer size */
++	uint32_t maxxfer;
++
++	/** @name Transfer state */
++	/** @{ */
++
++	/**
++	 * Pointer to the beginning of the transfer buffer -- do not modify
++	 * during transfer.
++	 */
++
++	dwc_dma_t dma_addr;
++
++	dwc_dma_t dma_desc_addr;
++	dwc_otg_dev_dma_desc_t *desc_addr;
++
++	uint8_t *start_xfer_buff;
++	/** pointer to the transfer buffer */
++	uint8_t *xfer_buff;
++	/** Number of bytes to transfer */
++	unsigned xfer_len:19;
++	/** Number of bytes transferred. */
++	unsigned xfer_count:19;
++	/** Sent ZLP */
++	unsigned sent_zlp:1;
++	/** Total len for control transfer */
++	unsigned total_len:19;
++
++	/** stall clear flag */
++	unsigned stall_clear_flag:1;
++
++	/** SETUP pkt cnt rollover flag for EP0 out*/
++	unsigned stp_rollover;
++
++#ifdef DWC_UTE_CFI
++	/* The buffer mode */
++	data_buffer_mode_e buff_mode;
++
++	/* The chain of DMA descriptors.
++	 * MAX_DMA_DESCS_PER_EP will be allocated for each active EP.
++	 */
++	dwc_otg_dma_desc_t *descs;
++
++	/* The DMA address of the descriptors chain start */
++	dma_addr_t descs_dma_addr;
++	/** This variable stores the length of the last enqueued request */
++	uint32_t cfi_req_len;
++#endif				//DWC_UTE_CFI
++
++/** Max DMA Descriptor count for any EP */
++#define MAX_DMA_DESC_CNT 256
++	/** Allocated DMA Desc count */
++	uint32_t desc_cnt;
++
++	/** bInterval */
++	uint32_t bInterval;
++	/** Next frame num to setup next ISOC transfer */
++	uint32_t frame_num;
++	/** Indicates SOF number overrun in DSTS */
++	uint8_t frm_overrun;
++
++#ifdef DWC_UTE_PER_IO
++	/** Next frame num for which will be setup DMA Desc */
++	uint32_t xiso_frame_num;
++	/** bInterval */
++	uint32_t xiso_bInterval;
++	/** Count of currently active transfers - shall be either 0 or 1 */
++	int xiso_active_xfers;
++	int xiso_queued_xfers;
++#endif
++#ifdef DWC_EN_ISOC
++	/**
++	 * Variables specific for ISOC EPs
++	 *
++	 */
++	/** DMA addresses of ISOC buffers */
++	dwc_dma_t dma_addr0;
++	dwc_dma_t dma_addr1;
++
++	dwc_dma_t iso_dma_desc_addr;
++	dwc_otg_dev_dma_desc_t *iso_desc_addr;
++
++	/** pointer to the transfer buffers */
++	uint8_t *xfer_buff0;
++	uint8_t *xfer_buff1;
++
++	/** number of ISOC Buffer is processing */
++	uint32_t proc_buf_num;
++	/** Interval of ISOC Buffer processing */
++	uint32_t buf_proc_intrvl;
++	/** Data size for regular frame */
++	uint32_t data_per_frame;
++
++	/* todo - pattern data support is to be implemented in the future */
++	/** Data size for pattern frame */
++	uint32_t data_pattern_frame;
++	/** Frame number of pattern data */
++	uint32_t sync_frame;
++
++	/** bInterval */
++	uint32_t bInterval;
++	/** ISO Packet number per frame */
++	uint32_t pkt_per_frm;
++	/** Next frame num for which will be setup DMA Desc */
++	uint32_t next_frame;
++	/** Number of packets per buffer processing */
++	uint32_t pkt_cnt;
++	/** Info for all isoc packets */
++	iso_pkt_info_t *pkt_info;
++	/** current pkt number */
++	uint32_t cur_pkt;
++	/** current pkt number */
++	uint8_t *cur_pkt_addr;
++	/** current pkt number */
++	uint32_t cur_pkt_dma_addr;
++#endif				/* DWC_EN_ISOC */
++
++/** @} */
++} dwc_ep_t;
++
++/*
++ * Reasons for halting a host channel.
++ */
++typedef enum dwc_otg_halt_status {
++	DWC_OTG_HC_XFER_NO_HALT_STATUS,
++	DWC_OTG_HC_XFER_COMPLETE,
++	DWC_OTG_HC_XFER_URB_COMPLETE,
++	DWC_OTG_HC_XFER_ACK,
++	DWC_OTG_HC_XFER_NAK,
++	DWC_OTG_HC_XFER_NYET,
++	DWC_OTG_HC_XFER_STALL,
++	DWC_OTG_HC_XFER_XACT_ERR,
++	DWC_OTG_HC_XFER_FRAME_OVERRUN,
++	DWC_OTG_HC_XFER_BABBLE_ERR,
++	DWC_OTG_HC_XFER_DATA_TOGGLE_ERR,
++	DWC_OTG_HC_XFER_AHB_ERR,
++	DWC_OTG_HC_XFER_PERIODIC_INCOMPLETE,
++	DWC_OTG_HC_XFER_URB_DEQUEUE
++} dwc_otg_halt_status_e;
++
++/**
++ * Host channel descriptor. This structure represents the state of a single
++ * host channel when acting in host mode. It contains the data items needed to
++ * transfer packets to an endpoint via a host channel.
++ */
++typedef struct dwc_hc {
++	/** Host channel number used for register address lookup */
++	uint8_t hc_num;
++
++	/** Device to access */
++	unsigned dev_addr:7;
++
++	/** EP to access */
++	unsigned ep_num:4;
++
++	/** EP direction. 0: OUT, 1: IN */
++	unsigned ep_is_in:1;
++
++	/**
++	 * EP speed.
++	 * One of the following values:
++	 *	- DWC_OTG_EP_SPEED_LOW
++	 *	- DWC_OTG_EP_SPEED_FULL
++	 *	- DWC_OTG_EP_SPEED_HIGH
++	 */
++	unsigned speed:2;
++#define DWC_OTG_EP_SPEED_LOW	0
++#define DWC_OTG_EP_SPEED_FULL	1
++#define DWC_OTG_EP_SPEED_HIGH	2
++
++	/**
++	 * Endpoint type.
++	 * One of the following values:
++	 *	- DWC_OTG_EP_TYPE_CONTROL: 0
++	 *	- DWC_OTG_EP_TYPE_ISOC: 1
++	 *	- DWC_OTG_EP_TYPE_BULK: 2
++	 *	- DWC_OTG_EP_TYPE_INTR: 3
++	 */
++	unsigned ep_type:2;
++
++	/** Max packet size in bytes */
++	unsigned max_packet:11;
++
++	/**
++	 * PID for initial transaction.
++	 * 0: DATA0,<br>
++	 * 1: DATA2,<br>
++	 * 2: DATA1,<br>
++	 * 3: MDATA (non-Control EP),
++	 *	  SETUP (Control EP)
++	 */
++	unsigned data_pid_start:2;
++#define DWC_OTG_HC_PID_DATA0 0
++#define DWC_OTG_HC_PID_DATA2 1
++#define DWC_OTG_HC_PID_DATA1 2
++#define DWC_OTG_HC_PID_MDATA 3
++#define DWC_OTG_HC_PID_SETUP 3
++
++	/** Number of periodic transactions per (micro)frame */
++	unsigned multi_count:2;
++
++	/** @name Transfer State */
++	/** @{ */
++
++	/** Pointer to the current transfer buffer position. */
++	uint8_t *xfer_buff;
++	/**
++	 * In Buffer DMA mode this buffer will be used
++	 * if xfer_buff is not DWORD aligned.
++	 */
++	dwc_dma_t align_buff;
++	/** Total number of bytes to transfer. */
++	uint32_t xfer_len;
++	/** Number of bytes transferred so far. */
++	uint32_t xfer_count;
++	/** Packet count at start of transfer.*/
++	uint16_t start_pkt_count;
++
++	/**
++	 * Flag to indicate whether the transfer has been started. Set to 1 if
++	 * it has been started, 0 otherwise.
++	 */
++	uint8_t xfer_started;
++
++	/**
++	 * Set to 1 to indicate that a PING request should be issued on this
++	 * channel. If 0, process normally.
++	 */
++	uint8_t do_ping;
++
++	/**
++	 * Set to 1 to indicate that the error count for this transaction is
++	 * non-zero. Set to 0 if the error count is 0.
++	 */
++	uint8_t error_state;
++
++	/**
++	 * Set to 1 to indicate that this channel should be halted the next
++	 * time a request is queued for the channel. This is necessary in
++	 * slave mode if no request queue space is available when an attempt
++	 * is made to halt the channel.
++	 */
++	uint8_t halt_on_queue;
++
++	/**
++	 * Set to 1 if the host channel has been halted, but the core is not
++	 * finished flushing queued requests. Otherwise 0.
++	 */
++	uint8_t halt_pending;
++
++	/**
++	 * Reason for halting the host channel.
++	 */
++	dwc_otg_halt_status_e halt_status;
++
++	/*
++	 * Split settings for the host channel
++	 */
++	uint8_t do_split;		   /**< Enable split for the channel */
++	uint8_t complete_split;	   /**< Enable complete split */
++	uint8_t hub_addr;		   /**< Address of high speed hub */
++
++	uint8_t port_addr;		   /**< Port of the low/full speed device */
++	/** Split transaction position
++	 * One of the following values:
++	 *	  - DWC_HCSPLIT_XACTPOS_MID
++	 *	  - DWC_HCSPLIT_XACTPOS_BEGIN
++	 *	  - DWC_HCSPLIT_XACTPOS_END
++	 *	  - DWC_HCSPLIT_XACTPOS_ALL */
++	uint8_t xact_pos;
++
++	/** Set when the host channel does a short read. */
++	uint8_t short_read;
++
++	/**
++	 * Number of requests issued for this channel since it was assigned to
++	 * the current transfer (not counting PINGs).
++	 */
++	uint8_t requests;
++
++	/**
++	 * Queue Head for the transfer being processed by this channel.
++	 */
++	struct dwc_otg_qh *qh;
++
++	/** @} */
++
++	/** Entry in list of host channels. */
++	 DWC_CIRCLEQ_ENTRY(dwc_hc) hc_list_entry;
++
++	/** @name Descriptor DMA support */
++	/** @{ */
++
++	/** Number of Transfer Descriptors */
++	uint16_t ntd;
++
++	/** Descriptor List DMA address */
++	dwc_dma_t desc_list_addr;
++
++	/** Scheduling micro-frame bitmap. */
++	uint8_t schinfo;
++
++	/** @} */
++} dwc_hc_t;
++
++/**
++ * The following parameters may be specified when starting the module. These
++ * parameters define how the DWC_otg controller should be configured.
++ */
++typedef struct dwc_otg_core_params {
++	int32_t opt;
++
++	/**
++	 * Specifies the OTG capabilities. The driver will automatically
++	 * detect the value for this parameter if none is specified.
++	 * 0 - HNP and SRP capable (default)
++	 * 1 - SRP Only capable
++	 * 2 - No HNP/SRP capable
++	 */
++	int32_t otg_cap;
++
++	/**
++	 * Specifies whether to use slave or DMA mode for accessing the data
++	 * FIFOs. The driver will automatically detect the value for this
++	 * parameter if none is specified.
++	 * 0 - Slave
++	 * 1 - DMA (default, if available)
++	 */
++	int32_t dma_enable;
++
++	/**
++	 * When DMA mode is enabled specifies whether to use address DMA or DMA
++	 * Descriptor mode for accessing the data FIFOs in device mode. The driver
++	 * will automatically detect the value for this if none is specified.
++	 * 0 - address DMA
++	 * 1 - DMA Descriptor(default, if available)
++	 */
++	int32_t dma_desc_enable;
++	/** The DMA Burst size (applicable only for External DMA
++	 * Mode). 1, 4, 8 16, 32, 64, 128, 256 (default 32)
++	 */
++	int32_t dma_burst_size;	/* Translate this to GAHBCFG values */
++
++	/**
++	 * Specifies the maximum speed of operation in host and device mode.
++	 * The actual speed depends on the speed of the attached device and
++	 * the value of phy_type. The actual speed depends on the speed of the
++	 * attached device.
++	 * 0 - High Speed (default)
++	 * 1 - Full Speed
++	 */
++	int32_t speed;
++	/** Specifies whether low power mode is supported when attached
++	 *	to a Full Speed or Low Speed device in host mode.
++	 * 0 - Don't support low power mode (default)
++	 * 1 - Support low power mode
++	 */
++	int32_t host_support_fs_ls_low_power;
++
++	/** Specifies the PHY clock rate in low power mode when connected to a
++	 * Low Speed device in host mode. This parameter is applicable only if
++	 * HOST_SUPPORT_FS_LS_LOW_POWER is enabled. If PHY_TYPE is set to FS
++	 * then defaults to 6 MHZ otherwise 48 MHZ.
++	 *
++	 * 0 - 48 MHz
++	 * 1 - 6 MHz
++	 */
++	int32_t host_ls_low_power_phy_clk;
++
++	/**
++	 * 0 - Use cC FIFO size parameters
++	 * 1 - Allow dynamic FIFO sizing (default)
++	 */
++	int32_t enable_dynamic_fifo;
++
++	/** Total number of 4-byte words in the data FIFO memory. This
++	 * memory includes the Rx FIFO, non-periodic Tx FIFO, and periodic
++	 * Tx FIFOs.
++	 * 32 to 32768 (default 8192)
++	 * Note: The total FIFO memory depth in the FPGA configuration is 8192.
++	 */
++	int32_t data_fifo_size;
++
++	/** Number of 4-byte words in the Rx FIFO in device mode when dynamic
++	 * FIFO sizing is enabled.
++	 * 16 to 32768 (default 1064)
++	 */
++	int32_t dev_rx_fifo_size;
++
++	/** Number of 4-byte words in the non-periodic Tx FIFO in device mode
++	 * when dynamic FIFO sizing is enabled.
++	 * 16 to 32768 (default 1024)
++	 */
++	int32_t dev_nperio_tx_fifo_size;
++
++	/** Number of 4-byte words in each of the periodic Tx FIFOs in device
++	 * mode when dynamic FIFO sizing is enabled.
++	 * 4 to 768 (default 256)
++	 */
++	uint32_t dev_perio_tx_fifo_size[MAX_PERIO_FIFOS];
++
++	/** Number of 4-byte words in the Rx FIFO in host mode when dynamic
++	 * FIFO sizing is enabled.
++	 * 16 to 32768 (default 1024)
++	 */
++	int32_t host_rx_fifo_size;
++
++	/** Number of 4-byte words in the non-periodic Tx FIFO in host mode
++	 * when Dynamic FIFO sizing is enabled in the core.
++	 * 16 to 32768 (default 1024)
++	 */
++	int32_t host_nperio_tx_fifo_size;
++
++	/** Number of 4-byte words in the host periodic Tx FIFO when dynamic
++	 * FIFO sizing is enabled.
++	 * 16 to 32768 (default 1024)
++	 */
++	int32_t host_perio_tx_fifo_size;
++
++	/** The maximum transfer size supported in bytes.
++	 * 2047 to 65,535  (default 65,535)
++	 */
++	int32_t max_transfer_size;
++
++	/** The maximum number of packets in a transfer.
++	 * 15 to 511  (default 511)
++	 */
++	int32_t max_packet_count;
++
++	/** The number of host channel registers to use.
++	 * 1 to 16 (default 12)
++	 * Note: The FPGA configuration supports a maximum of 12 host channels.
++	 */
++	int32_t host_channels;
++
++	/** The number of endpoints in addition to EP0 available for device
++	 * mode operations.
++	 * 1 to 15 (default 6 IN and OUT)
++	 * Note: The FPGA configuration supports a maximum of 6 IN and OUT
++	 * endpoints in addition to EP0.
++	 */
++	int32_t dev_endpoints;
++
++		/**
++		 * Specifies the type of PHY interface to use. By default, the driver
++		 * will automatically detect the phy_type.
++		 *
++		 * 0 - Full Speed PHY
++		 * 1 - UTMI+ (default)
++		 * 2 - ULPI
++		 */
++	int32_t phy_type;
++
++	/**
++	 * Specifies the UTMI+ Data Width. This parameter is
++	 * applicable for a PHY_TYPE of UTMI+ or ULPI. (For a ULPI
++	 * PHY_TYPE, this parameter indicates the data width between
++	 * the MAC and the ULPI Wrapper.) Also, this parameter is
++	 * applicable only if the OTG_HSPHY_WIDTH cC parameter was set
++	 * to "8 and 16 bits", meaning that the core has been
++	 * configured to work at either data path width.
++	 *
++	 * 8 or 16 bits (default 16)
++	 */
++	int32_t phy_utmi_width;
++
++	/**
++	 * Specifies whether the ULPI operates at double or single
++	 * data rate. This parameter is only applicable if PHY_TYPE is
++	 * ULPI.
++	 *
++	 * 0 - single data rate ULPI interface with 8 bit wide data
++	 * bus (default)
++	 * 1 - double data rate ULPI interface with 4 bit wide data
++	 * bus
++	 */
++	int32_t phy_ulpi_ddr;
++
++	/**
++	 * Specifies whether to use the internal or external supply to
++	 * drive the vbus with a ULPI phy.
++	 */
++	int32_t phy_ulpi_ext_vbus;
++
++	/**
++	 * Specifies whether to use the I2Cinterface for full speed PHY. This
++	 * parameter is only applicable if PHY_TYPE is FS.
++	 * 0 - No (default)
++	 * 1 - Yes
++	 */
++	int32_t i2c_enable;
++
++	int32_t ulpi_fs_ls;
++
++	int32_t ts_dline;
++
++	/**
++	 * Specifies whether dedicated transmit FIFOs are
++	 * enabled for non periodic IN endpoints in device mode
++	 * 0 - No
++	 * 1 - Yes
++	 */
++	int32_t en_multiple_tx_fifo;
++
++	/** Number of 4-byte words in each of the Tx FIFOs in device
++	 * mode when dynamic FIFO sizing is enabled.
++	 * 4 to 768 (default 256)
++	 */
++	uint32_t dev_tx_fifo_size[MAX_TX_FIFOS];
++
++	/** Thresholding enable flag-
++	 * bit 0 - enable non-ISO Tx thresholding
++	 * bit 1 - enable ISO Tx thresholding
++	 * bit 2 - enable Rx thresholding
++	 */
++	uint32_t thr_ctl;
++
++	/** Thresholding length for Tx
++	 *	FIFOs in 32 bit DWORDs
++	 */
++	uint32_t tx_thr_length;
++
++	/** Thresholding length for Rx
++	 *	FIFOs in 32 bit DWORDs
++	 */
++	uint32_t rx_thr_length;
++
++	/**
++	 * Specifies whether LPM (Link Power Management) support is enabled
++	 */
++	int32_t lpm_enable;
++
++	/** Per Transfer Interrupt
++	 *	mode enable flag
++	 * 1 - Enabled
++	 * 0 - Disabled
++	 */
++	int32_t pti_enable;
++
++	/** Multi Processor Interrupt
++	 *	mode enable flag
++	 * 1 - Enabled
++	 * 0 - Disabled
++	 */
++	int32_t mpi_enable;
++
++	/** IS_USB Capability
++	 * 1 - Enabled
++	 * 0 - Disabled
++	 */
++	int32_t ic_usb_cap;
++
++	/** AHB Threshold Ratio
++	 * 2'b00 AHB Threshold = 	MAC Threshold
++	 * 2'b01 AHB Threshold = 1/2 	MAC Threshold
++	 * 2'b10 AHB Threshold = 1/4	MAC Threshold
++	 * 2'b11 AHB Threshold = 1/8	MAC Threshold
++	 */
++	int32_t ahb_thr_ratio;
++
++	/** ADP Support
++	 * 1 - Enabled
++	 * 0 - Disabled
++	 */
++	int32_t adp_supp_enable;
++
++	/** HFIR Reload Control
++	 * 0 - The HFIR cannot be reloaded dynamically.
++	 * 1 - Allow dynamic reloading of the HFIR register during runtime.
++	 */
++	int32_t reload_ctl;
++
++	/** DCFG: Enable device Out NAK
++	 * 0 - The core does not set NAK after Bulk Out transfer complete.
++	 * 1 - The core sets NAK after Bulk OUT transfer complete.
++	 */
++	int32_t dev_out_nak;
++
++	/** DCFG: Enable Continue on BNA
++	 * After receiving BNA interrupt the core disables the endpoint,when the
++	 * endpoint is re-enabled by the application the core starts processing
++	 * 0 - from the DOEPDMA descriptor
++	 * 1 - from the descriptor which received the BNA.
++	 */
++	int32_t cont_on_bna;
++
++	/** GAHBCFG: AHB Single Support
++	 * This bit when programmed supports SINGLE transfers for remainder
++	 * data in a transfer for DMA mode of operation.
++	 * 0 - in this case the remainder data will be sent using INCR burst size.
++	 * 1 - in this case the remainder data will be sent using SINGLE burst size.
++	 */
++	int32_t ahb_single;
++
++	/** Core Power down mode
++	 * 0 - No Power Down is enabled
++	 * 1 - Reserved
++	 * 2 - Complete Power Down (Hibernation)
++	 */
++	int32_t power_down;
++
++	/** OTG revision supported
++	 * 0 - OTG 1.3 revision
++	 * 1 - OTG 2.0 revision
++	 */
++	int32_t otg_ver;
++
++} dwc_otg_core_params_t;
++
++#ifdef DEBUG
++struct dwc_otg_core_if;
++typedef struct hc_xfer_info {
++	struct dwc_otg_core_if *core_if;
++	dwc_hc_t *hc;
++} hc_xfer_info_t;
++#endif
++
++typedef struct ep_xfer_info {
++	struct dwc_otg_core_if *core_if;
++	dwc_ep_t *ep;
++	uint8_t state;
++} ep_xfer_info_t;
++/*
++ * Device States
++ */
++typedef enum dwc_otg_lx_state {
++	/** On state */
++	DWC_OTG_L0,
++	/** LPM sleep state*/
++	DWC_OTG_L1,
++	/** USB suspend state*/
++	DWC_OTG_L2,
++	/** Off state*/
++	DWC_OTG_L3
++} dwc_otg_lx_state_e;
++
++struct dwc_otg_global_regs_backup {
++	uint32_t gotgctl_local;
++	uint32_t gintmsk_local;
++	uint32_t gahbcfg_local;
++	uint32_t gusbcfg_local;
++	uint32_t grxfsiz_local;
++	uint32_t gnptxfsiz_local;
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	uint32_t glpmcfg_local;
++#endif
++	uint32_t gi2cctl_local;
++	uint32_t hptxfsiz_local;
++	uint32_t pcgcctl_local;
++	uint32_t gdfifocfg_local;
++	uint32_t dtxfsiz_local[MAX_EPS_CHANNELS];
++	uint32_t gpwrdn_local;
++	uint32_t xhib_pcgcctl;
++	uint32_t xhib_gpwrdn;
++};
++
++struct dwc_otg_host_regs_backup {
++	uint32_t hcfg_local;
++	uint32_t haintmsk_local;
++	uint32_t hcintmsk_local[MAX_EPS_CHANNELS];
++	uint32_t hprt0_local;
++	uint32_t hfir_local;
++};
++
++struct dwc_otg_dev_regs_backup {
++	uint32_t dcfg;
++	uint32_t dctl;
++	uint32_t daintmsk;
++	uint32_t diepmsk;
++	uint32_t doepmsk;
++	uint32_t diepctl[MAX_EPS_CHANNELS];
++	uint32_t dieptsiz[MAX_EPS_CHANNELS];
++	uint32_t diepdma[MAX_EPS_CHANNELS];
++};
++/**
++ * The <code>dwc_otg_core_if</code> structure contains information needed to manage
++ * the DWC_otg controller acting in either host or device mode. It
++ * represents the programming view of the controller as a whole.
++ */
++struct dwc_otg_core_if {
++	/** Parameters that define how the core should be configured.*/
++	dwc_otg_core_params_t *core_params;
++
++	/** Core Global registers starting at offset 000h. */
++	dwc_otg_core_global_regs_t *core_global_regs;
++
++	/** Device-specific information */
++	dwc_otg_dev_if_t *dev_if;
++	/** Host-specific information */
++	dwc_otg_host_if_t *host_if;
++
++	/** Value from SNPSID register */
++	uint32_t snpsid;
++
++	/*
++	 * Set to 1 if the core PHY interface bits in USBCFG have been
++	 * initialized.
++	 */
++	uint8_t phy_init_done;
++
++	/*
++	 * SRP Success flag, set by srp success interrupt in FS I2C mode
++	 */
++	uint8_t srp_success;
++	uint8_t srp_timer_started;
++	/** Timer for SRP. If it expires before SRP is successful
++	 * clear the SRP. */
++	dwc_timer_t *srp_timer;
++
++#ifdef DWC_DEV_SRPCAP
++	/* This timer is needed to power on the hibernated host core if SRP is not
++	 * initiated on connected SRP capable device for limited period of time
++	 */
++	uint8_t pwron_timer_started;
++	dwc_timer_t *pwron_timer;
++#endif
++	/* Common configuration information */
++	/** Power and Clock Gating Control Register */
++	volatile uint32_t *pcgcctl;
++#define DWC_OTG_PCGCCTL_OFFSET 0xE00
++
++	/** Push/pop addresses for endpoints or host channels.*/
++	uint32_t *data_fifo[MAX_EPS_CHANNELS];
++#define DWC_OTG_DATA_FIFO_OFFSET 0x1000
++#define DWC_OTG_DATA_FIFO_SIZE 0x1000
++
++	/** Total RAM for FIFOs (Bytes) */
++	uint16_t total_fifo_size;
++	/** Size of Rx FIFO (Bytes) */
++	uint16_t rx_fifo_size;
++	/** Size of Non-periodic Tx FIFO (Bytes) */
++	uint16_t nperio_tx_fifo_size;
++
++	/** 1 if DMA is enabled, 0 otherwise. */
++	uint8_t dma_enable;
++
++	/** 1 if DMA descriptor is enabled, 0 otherwise. */
++	uint8_t dma_desc_enable;
++
++	/** 1 if PTI Enhancement mode is enabled, 0 otherwise. */
++	uint8_t pti_enh_enable;
++
++	/** 1 if MPI Enhancement mode is enabled, 0 otherwise. */
++	uint8_t multiproc_int_enable;
++
++	/** 1 if dedicated Tx FIFOs are enabled, 0 otherwise. */
++	uint8_t en_multiple_tx_fifo;
++
++	/** Set to 1 if multiple packets of a high-bandwidth transfer is in
++	 * process of being queued */
++	uint8_t queuing_high_bandwidth;
++
++	/** Hardware Configuration -- stored here for convenience.*/
++	hwcfg1_data_t hwcfg1;
++	hwcfg2_data_t hwcfg2;
++	hwcfg3_data_t hwcfg3;
++	hwcfg4_data_t hwcfg4;
++	fifosize_data_t hptxfsiz;
++
++	/** Host and Device Configuration -- stored here for convenience.*/
++	hcfg_data_t hcfg;
++	dcfg_data_t dcfg;
++
++	/** The operational State, during transations
++	 * (a_host>>a_peripherial and b_device=>b_host) this may not
++	 * match the core but allows the software to determine
++	 * transitions.
++	 */
++	uint8_t op_state;
++
++	/**
++	 * Set to 1 if the HCD needs to be restarted on a session request
++	 * interrupt. This is required if no connector ID status change has
++	 * occurred since the HCD was last disconnected.
++	 */
++	uint8_t restart_hcd_on_session_req;
++
++	/** HCD callbacks */
++	/** A-Device is a_host */
++#define A_HOST		(1)
++	/** A-Device is a_suspend */
++#define A_SUSPEND	(2)
++	/** A-Device is a_peripherial */
++#define A_PERIPHERAL	(3)
++	/** B-Device is operating as a Peripheral. */
++#define B_PERIPHERAL	(4)
++	/** B-Device is operating as a Host. */
++#define B_HOST		(5)
++
++	/** HCD callbacks */
++	struct dwc_otg_cil_callbacks *hcd_cb;
++	/** PCD callbacks */
++	struct dwc_otg_cil_callbacks *pcd_cb;
++
++	/** Device mode Periodic Tx FIFO Mask */
++	uint32_t p_tx_msk;
++	/** Device mode Periodic Tx FIFO Mask */
++	uint32_t tx_msk;
++
++	/** Workqueue object used for handling several interrupts */
++	dwc_workq_t *wq_otg;
++
++	/** Timer object used for handling "Wakeup Detected" Interrupt */
++	dwc_timer_t *wkp_timer;
++	/** This arrays used for debug purposes for DEV OUT NAK enhancement */
++	uint32_t start_doeptsiz_val[MAX_EPS_CHANNELS];
++	ep_xfer_info_t ep_xfer_info[MAX_EPS_CHANNELS];
++	dwc_timer_t *ep_xfer_timer[MAX_EPS_CHANNELS];
++#ifdef DEBUG
++	uint32_t start_hcchar_val[MAX_EPS_CHANNELS];
++
++	hc_xfer_info_t hc_xfer_info[MAX_EPS_CHANNELS];
++	dwc_timer_t *hc_xfer_timer[MAX_EPS_CHANNELS];
++
++	uint32_t hfnum_7_samples;
++	uint64_t hfnum_7_frrem_accum;
++	uint32_t hfnum_0_samples;
++	uint64_t hfnum_0_frrem_accum;
++	uint32_t hfnum_other_samples;
++	uint64_t hfnum_other_frrem_accum;
++#endif
++
++#ifdef DWC_UTE_CFI
++	uint16_t pwron_rxfsiz;
++	uint16_t pwron_gnptxfsiz;
++	uint16_t pwron_txfsiz[15];
++
++	uint16_t init_rxfsiz;
++	uint16_t init_gnptxfsiz;
++	uint16_t init_txfsiz[15];
++#endif
++
++	/** Lx state of device */
++	dwc_otg_lx_state_e lx_state;
++
++	/** Saved Core Global registers */
++	struct dwc_otg_global_regs_backup *gr_backup;
++	/** Saved Host registers */
++	struct dwc_otg_host_regs_backup *hr_backup;
++	/** Saved Device registers */
++	struct dwc_otg_dev_regs_backup *dr_backup;
++
++	/** Power Down Enable */
++	uint32_t power_down;
++
++	/** ADP support Enable */
++	uint32_t adp_enable;
++
++	/** ADP structure object */
++	dwc_otg_adp_t adp;
++
++	/** hibernation/suspend flag */
++	int hibernation_suspend;
++
++	/** Device mode extended hibernation flag */
++	int xhib;
++
++	/** OTG revision supported */
++	uint32_t otg_ver;
++
++	/** OTG status flag used for HNP polling */
++	uint8_t otg_sts;
++
++	/** Pointer to either hcd->lock or pcd->lock */
++	dwc_spinlock_t *lock;
++
++	/** Start predict NextEP based on Learning Queue if equal 1,
++	 * also used as counter of disabled NP IN EP's */
++	uint8_t start_predict;
++
++	/** NextEp sequence, including EP0: nextep_seq[] = EP if non-periodic and
++	 * active, 0xff otherwise */
++	uint8_t nextep_seq[MAX_EPS_CHANNELS];
++
++	/** Index of fisrt EP in nextep_seq array which should be re-enabled **/
++	uint8_t first_in_nextep_seq;
++
++	/** Frame number while entering to ISR - needed for ISOCs **/
++	uint32_t frame_num;
++
++};
++
++#ifdef DEBUG
++/*
++ * This function is called when transfer is timed out.
++ */
++extern void hc_xfer_timeout(void *ptr);
++#endif
++
++/*
++ * This function is called when transfer is timed out on endpoint.
++ */
++extern void ep_xfer_timeout(void *ptr);
++
++/*
++ * The following functions are functions for works
++ * using during handling some interrupts
++ */
++extern void w_conn_id_status_change(void *p);
++
++extern void w_wakeup_detected(void *p);
++
++/** Saves global register values into system memory. */
++extern int dwc_otg_save_global_regs(dwc_otg_core_if_t * core_if);
++/** Saves device register values into system memory. */
++extern int dwc_otg_save_dev_regs(dwc_otg_core_if_t * core_if);
++/** Saves host register values into system memory. */
++extern int dwc_otg_save_host_regs(dwc_otg_core_if_t * core_if);
++/** Restore global register values. */
++extern int dwc_otg_restore_global_regs(dwc_otg_core_if_t * core_if);
++/** Restore host register values. */
++extern int dwc_otg_restore_host_regs(dwc_otg_core_if_t * core_if, int reset);
++/** Restore device register values. */
++extern int dwc_otg_restore_dev_regs(dwc_otg_core_if_t * core_if,
++				    int rem_wakeup);
++extern int restore_lpm_i2c_regs(dwc_otg_core_if_t * core_if);
++extern int restore_essential_regs(dwc_otg_core_if_t * core_if, int rmode,
++				  int is_host);
++
++extern int dwc_otg_host_hibernation_restore(dwc_otg_core_if_t * core_if,
++					    int restore_mode, int reset);
++extern int dwc_otg_device_hibernation_restore(dwc_otg_core_if_t * core_if,
++					      int rem_wakeup, int reset);
++
++/*
++ * The following functions support initialization of the CIL driver component
++ * and the DWC_otg controller.
++ */
++extern void dwc_otg_core_host_init(dwc_otg_core_if_t * _core_if);
++extern void dwc_otg_core_dev_init(dwc_otg_core_if_t * _core_if);
++
++/** @name Device CIL Functions
++ * The following functions support managing the DWC_otg controller in device
++ * mode.
++ */
++/**@{*/
++extern void dwc_otg_wakeup(dwc_otg_core_if_t * _core_if);
++extern void dwc_otg_read_setup_packet(dwc_otg_core_if_t * _core_if,
++				      uint32_t * _dest);
++extern uint32_t dwc_otg_get_frame_number(dwc_otg_core_if_t * _core_if);
++extern void dwc_otg_ep0_activate(dwc_otg_core_if_t * _core_if, dwc_ep_t * _ep);
++extern void dwc_otg_ep_activate(dwc_otg_core_if_t * _core_if, dwc_ep_t * _ep);
++extern void dwc_otg_ep_deactivate(dwc_otg_core_if_t * _core_if, dwc_ep_t * _ep);
++extern void dwc_otg_ep_start_transfer(dwc_otg_core_if_t * _core_if,
++				      dwc_ep_t * _ep);
++extern void dwc_otg_ep_start_zl_transfer(dwc_otg_core_if_t * _core_if,
++					 dwc_ep_t * _ep);
++extern void dwc_otg_ep0_start_transfer(dwc_otg_core_if_t * _core_if,
++				       dwc_ep_t * _ep);
++extern void dwc_otg_ep0_continue_transfer(dwc_otg_core_if_t * _core_if,
++					  dwc_ep_t * _ep);
++extern void dwc_otg_ep_write_packet(dwc_otg_core_if_t * _core_if,
++				    dwc_ep_t * _ep, int _dma);
++extern void dwc_otg_ep_set_stall(dwc_otg_core_if_t * _core_if, dwc_ep_t * _ep);
++extern void dwc_otg_ep_clear_stall(dwc_otg_core_if_t * _core_if,
++				   dwc_ep_t * _ep);
++extern void dwc_otg_enable_device_interrupts(dwc_otg_core_if_t * _core_if);
++
++#ifdef DWC_EN_ISOC
++extern void dwc_otg_iso_ep_start_frm_transfer(dwc_otg_core_if_t * core_if,
++					      dwc_ep_t * ep);
++extern void dwc_otg_iso_ep_start_buf_transfer(dwc_otg_core_if_t * core_if,
++					      dwc_ep_t * ep);
++#endif /* DWC_EN_ISOC */
++/**@}*/
++
++/** @name Host CIL Functions
++ * The following functions support managing the DWC_otg controller in host
++ * mode.
++ */
++/**@{*/
++extern void dwc_otg_hc_init(dwc_otg_core_if_t * _core_if, dwc_hc_t * _hc);
++extern void dwc_otg_hc_halt(dwc_otg_core_if_t * _core_if,
++			    dwc_hc_t * _hc, dwc_otg_halt_status_e _halt_status);
++extern void dwc_otg_hc_cleanup(dwc_otg_core_if_t * _core_if, dwc_hc_t * _hc);
++extern void dwc_otg_hc_start_transfer(dwc_otg_core_if_t * _core_if,
++				      dwc_hc_t * _hc);
++extern int dwc_otg_hc_continue_transfer(dwc_otg_core_if_t * _core_if,
++					dwc_hc_t * _hc);
++extern void dwc_otg_hc_do_ping(dwc_otg_core_if_t * _core_if, dwc_hc_t * _hc);
++extern void dwc_otg_hc_write_packet(dwc_otg_core_if_t * _core_if,
++				    dwc_hc_t * _hc);
++extern void dwc_otg_enable_host_interrupts(dwc_otg_core_if_t * _core_if);
++extern void dwc_otg_disable_host_interrupts(dwc_otg_core_if_t * _core_if);
++
++extern void dwc_otg_hc_start_transfer_ddma(dwc_otg_core_if_t * core_if,
++					   dwc_hc_t * hc);
++
++extern uint32_t calc_frame_interval(dwc_otg_core_if_t * core_if);
++
++/* Macro used to clear one channel interrupt */
++#define clear_hc_int(_hc_regs_, _intr_) \
++do { \
++	hcint_data_t hcint_clear = {.d32 = 0}; \
++	hcint_clear.b._intr_ = 1; \
++	DWC_WRITE_REG32(&(_hc_regs_)->hcint, hcint_clear.d32); \
++} while (0)
++
++/*
++ * Macro used to disable one channel interrupt. Channel interrupts are
++ * disabled when the channel is halted or released by the interrupt handler.
++ * There is no need to handle further interrupts of that type until the
++ * channel is re-assigned. In fact, subsequent handling may cause crashes
++ * because the channel structures are cleaned up when the channel is released.
++ */
++#define disable_hc_int(_hc_regs_, _intr_) \
++do { \
++	hcintmsk_data_t hcintmsk = {.d32 = 0}; \
++	hcintmsk.b._intr_ = 1; \
++	DWC_MODIFY_REG32(&(_hc_regs_)->hcintmsk, hcintmsk.d32, 0); \
++} while (0)
++
++/**
++ * This function Reads HPRT0 in preparation to modify. It keeps the
++ * WC bits 0 so that if they are read as 1, they won't clear when you
++ * write it back
++ */
++static inline uint32_t dwc_otg_read_hprt0(dwc_otg_core_if_t * _core_if)
++{
++	hprt0_data_t hprt0;
++	hprt0.d32 = DWC_READ_REG32(_core_if->host_if->hprt0);
++	hprt0.b.prtena = 0;
++	hprt0.b.prtconndet = 0;
++	hprt0.b.prtenchng = 0;
++	hprt0.b.prtovrcurrchng = 0;
++	return hprt0.d32;
++}
++
++/**@}*/
++
++/** @name Common CIL Functions
++ * The following functions support managing the DWC_otg controller in either
++ * device or host mode.
++ */
++/**@{*/
++
++extern void dwc_otg_read_packet(dwc_otg_core_if_t * core_if,
++				uint8_t * dest, uint16_t bytes);
++
++extern void dwc_otg_flush_tx_fifo(dwc_otg_core_if_t * _core_if, const int _num);
++extern void dwc_otg_flush_rx_fifo(dwc_otg_core_if_t * _core_if);
++extern void dwc_otg_core_reset(dwc_otg_core_if_t * _core_if);
++
++/**
++ * This function returns the Core Interrupt register.
++ */
++static inline uint32_t dwc_otg_read_core_intr(dwc_otg_core_if_t * core_if)
++{
++	return (DWC_READ_REG32(&core_if->core_global_regs->gintsts) &
++		DWC_READ_REG32(&core_if->core_global_regs->gintmsk));
++}
++
++/**
++ * This function returns the OTG Interrupt register.
++ */
++static inline uint32_t dwc_otg_read_otg_intr(dwc_otg_core_if_t * core_if)
++{
++	return (DWC_READ_REG32(&core_if->core_global_regs->gotgint));
++}
++
++/**
++ * This function reads the Device All Endpoints Interrupt register and
++ * returns the IN endpoint interrupt bits.
++ */
++static inline uint32_t dwc_otg_read_dev_all_in_ep_intr(dwc_otg_core_if_t *
++						       core_if)
++{
++
++	uint32_t v;
++
++	if (core_if->multiproc_int_enable) {
++		v = DWC_READ_REG32(&core_if->dev_if->
++				   dev_global_regs->deachint) &
++		    DWC_READ_REG32(&core_if->
++				   dev_if->dev_global_regs->deachintmsk);
++	} else {
++		v = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->daint) &
++		    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->daintmsk);
++	}
++	return (v & 0xffff);
++}
++
++/**
++ * This function reads the Device All Endpoints Interrupt register and
++ * returns the OUT endpoint interrupt bits.
++ */
++static inline uint32_t dwc_otg_read_dev_all_out_ep_intr(dwc_otg_core_if_t *
++							core_if)
++{
++	uint32_t v;
++
++	if (core_if->multiproc_int_enable) {
++		v = DWC_READ_REG32(&core_if->dev_if->
++				   dev_global_regs->deachint) &
++		    DWC_READ_REG32(&core_if->
++				   dev_if->dev_global_regs->deachintmsk);
++	} else {
++		v = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->daint) &
++		    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->daintmsk);
++	}
++
++	return ((v & 0xffff0000) >> 16);
++}
++
++/**
++ * This function returns the Device IN EP Interrupt register
++ */
++static inline uint32_t dwc_otg_read_dev_in_ep_intr(dwc_otg_core_if_t * core_if,
++						   dwc_ep_t * ep)
++{
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	uint32_t v, msk, emp;
++
++	if (core_if->multiproc_int_enable) {
++		msk =
++		    DWC_READ_REG32(&dev_if->
++				   dev_global_regs->diepeachintmsk[ep->num]);
++		emp =
++		    DWC_READ_REG32(&dev_if->
++				   dev_global_regs->dtknqr4_fifoemptymsk);
++		msk |= ((emp >> ep->num) & 0x1) << 7;
++		v = DWC_READ_REG32(&dev_if->in_ep_regs[ep->num]->diepint) & msk;
++	} else {
++		msk = DWC_READ_REG32(&dev_if->dev_global_regs->diepmsk);
++		emp =
++		    DWC_READ_REG32(&dev_if->
++				   dev_global_regs->dtknqr4_fifoemptymsk);
++		msk |= ((emp >> ep->num) & 0x1) << 7;
++		v = DWC_READ_REG32(&dev_if->in_ep_regs[ep->num]->diepint) & msk;
++	}
++
++	return v;
++}
++
++/**
++ * This function returns the Device OUT EP Interrupt register
++ */
++static inline uint32_t dwc_otg_read_dev_out_ep_intr(dwc_otg_core_if_t *
++						    _core_if, dwc_ep_t * _ep)
++{
++	dwc_otg_dev_if_t *dev_if = _core_if->dev_if;
++	uint32_t v;
++	doepmsk_data_t msk = {.d32 = 0 };
++
++	if (_core_if->multiproc_int_enable) {
++		msk.d32 =
++		    DWC_READ_REG32(&dev_if->
++				   dev_global_regs->doepeachintmsk[_ep->num]);
++		if (_core_if->pti_enh_enable) {
++			msk.b.pktdrpsts = 1;
++		}
++		v = DWC_READ_REG32(&dev_if->
++				   out_ep_regs[_ep->num]->doepint) & msk.d32;
++	} else {
++		msk.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->doepmsk);
++		if (_core_if->pti_enh_enable) {
++			msk.b.pktdrpsts = 1;
++		}
++		v = DWC_READ_REG32(&dev_if->
++				   out_ep_regs[_ep->num]->doepint) & msk.d32;
++	}
++	return v;
++}
++
++/**
++ * This function returns the Host All Channel Interrupt register
++ */
++static inline uint32_t dwc_otg_read_host_all_channels_intr(dwc_otg_core_if_t *
++							   _core_if)
++{
++	return (DWC_READ_REG32(&_core_if->host_if->host_global_regs->haint));
++}
++
++static inline uint32_t dwc_otg_read_host_channel_intr(dwc_otg_core_if_t *
++						      _core_if, dwc_hc_t * _hc)
++{
++	return (DWC_READ_REG32
++		(&_core_if->host_if->hc_regs[_hc->hc_num]->hcint));
++}
++
++/**
++ * This function returns the mode of the operation, host or device.
++ *
++ * @return 0 - Device Mode, 1 - Host Mode
++ */
++static inline uint32_t dwc_otg_mode(dwc_otg_core_if_t * _core_if)
++{
++	return (DWC_READ_REG32(&_core_if->core_global_regs->gintsts) & 0x1);
++}
++
++/**@}*/
++
++/**
++ * DWC_otg CIL callback structure. This structure allows the HCD and
++ * PCD to register functions used for starting and stopping the PCD
++ * and HCD for role change on for a DRD.
++ */
++typedef struct dwc_otg_cil_callbacks {
++	/** Start function for role change */
++	int (*start) (void *_p);
++	/** Stop Function for role change */
++	int (*stop) (void *_p);
++	/** Disconnect Function for role change */
++	int (*disconnect) (void *_p);
++	/** Resume/Remote wakeup Function */
++	int (*resume_wakeup) (void *_p);
++	/** Suspend function */
++	int (*suspend) (void *_p);
++	/** Session Start (SRP) */
++	int (*session_start) (void *_p);
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	/** Sleep (switch to L0 state) */
++	int (*sleep) (void *_p);
++#endif
++	/** Pointer passed to start() and stop() */
++	void *p;
++} dwc_otg_cil_callbacks_t;
++
++extern void dwc_otg_cil_register_pcd_callbacks(dwc_otg_core_if_t * _core_if,
++					       dwc_otg_cil_callbacks_t * _cb,
++					       void *_p);
++extern void dwc_otg_cil_register_hcd_callbacks(dwc_otg_core_if_t * _core_if,
++					       dwc_otg_cil_callbacks_t * _cb,
++					       void *_p);
++
++void dwc_otg_initiate_srp(dwc_otg_core_if_t * core_if);
++
++//////////////////////////////////////////////////////////////////////
++/** Start the HCD.  Helper function for using the HCD callbacks.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static inline void cil_hcd_start(dwc_otg_core_if_t * core_if)
++{
++	if (core_if->hcd_cb && core_if->hcd_cb->start) {
++		core_if->hcd_cb->start(core_if->hcd_cb->p);
++	}
++}
++
++/** Stop the HCD.  Helper function for using the HCD callbacks.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static inline void cil_hcd_stop(dwc_otg_core_if_t * core_if)
++{
++	if (core_if->hcd_cb && core_if->hcd_cb->stop) {
++		core_if->hcd_cb->stop(core_if->hcd_cb->p);
++	}
++}
++
++/** Disconnect the HCD.  Helper function for using the HCD callbacks.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static inline void cil_hcd_disconnect(dwc_otg_core_if_t * core_if)
++{
++	if (core_if->hcd_cb && core_if->hcd_cb->disconnect) {
++		core_if->hcd_cb->disconnect(core_if->hcd_cb->p);
++	}
++}
++
++/** Inform the HCD the a New Session has begun.  Helper function for
++ * using the HCD callbacks.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static inline void cil_hcd_session_start(dwc_otg_core_if_t * core_if)
++{
++	if (core_if->hcd_cb && core_if->hcd_cb->session_start) {
++		core_if->hcd_cb->session_start(core_if->hcd_cb->p);
++	}
++}
++
++#ifdef CONFIG_USB_DWC_OTG_LPM
++/**
++ * Inform the HCD about LPM sleep.
++ * Helper function for using the HCD callbacks.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static inline void cil_hcd_sleep(dwc_otg_core_if_t * core_if)
++{
++	if (core_if->hcd_cb && core_if->hcd_cb->sleep) {
++		core_if->hcd_cb->sleep(core_if->hcd_cb->p);
++	}
++}
++#endif
++
++/** Resume the HCD.  Helper function for using the HCD callbacks.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static inline void cil_hcd_resume(dwc_otg_core_if_t * core_if)
++{
++	if (core_if->hcd_cb && core_if->hcd_cb->resume_wakeup) {
++		core_if->hcd_cb->resume_wakeup(core_if->hcd_cb->p);
++	}
++}
++
++/** Start the PCD.  Helper function for using the PCD callbacks.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static inline void cil_pcd_start(dwc_otg_core_if_t * core_if)
++{
++	if (core_if->pcd_cb && core_if->pcd_cb->start) {
++		core_if->pcd_cb->start(core_if->pcd_cb->p);
++	}
++}
++
++/** Stop the PCD.  Helper function for using the PCD callbacks.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static inline void cil_pcd_stop(dwc_otg_core_if_t * core_if)
++{
++	if (core_if->pcd_cb && core_if->pcd_cb->stop) {
++		core_if->pcd_cb->stop(core_if->pcd_cb->p);
++	}
++}
++
++/** Suspend the PCD.  Helper function for using the PCD callbacks.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static inline void cil_pcd_suspend(dwc_otg_core_if_t * core_if)
++{
++	if (core_if->pcd_cb && core_if->pcd_cb->suspend) {
++		core_if->pcd_cb->suspend(core_if->pcd_cb->p);
++	}
++}
++
++/** Resume the PCD.  Helper function for using the PCD callbacks.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static inline void cil_pcd_resume(dwc_otg_core_if_t * core_if)
++{
++	if (core_if->pcd_cb && core_if->pcd_cb->resume_wakeup) {
++		core_if->pcd_cb->resume_wakeup(core_if->pcd_cb->p);
++	}
++}
++
++//////////////////////////////////////////////////////////////////////
++
++#endif
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_cil_intr.c
+@@ -0,0 +1,1578 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_cil_intr.c $
++ * $Revision: #32 $
++ * $Date: 2012/08/10 $
++ * $Change: 2047372 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++/** @file
++ *
++ * The Core Interface Layer provides basic services for accessing and
++ * managing the DWC_otg hardware. These services are used by both the
++ * Host Controller Driver and the Peripheral Controller Driver.
++ *
++ * This file contains the Common Interrupt handlers.
++ */
++#include "dwc_os.h"
++#include "dwc_otg_regs.h"
++#include "dwc_otg_cil.h"
++#include "dwc_otg_driver.h"
++#include "dwc_otg_pcd.h"
++#include "dwc_otg_hcd.h"
++
++#ifdef DEBUG
++inline const char *op_state_str(dwc_otg_core_if_t * core_if)
++{
++	return (core_if->op_state == A_HOST ? "a_host" :
++		(core_if->op_state == A_SUSPEND ? "a_suspend" :
++		 (core_if->op_state == A_PERIPHERAL ? "a_peripheral" :
++		  (core_if->op_state == B_PERIPHERAL ? "b_peripheral" :
++		   (core_if->op_state == B_HOST ? "b_host" : "unknown")))));
++}
++#endif
++
++/** This function will log a debug message
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static int32_t dwc_otg_handle_mode_mismatch_intr(dwc_otg_core_if_t * core_if)
++{
++	gintsts_data_t gintsts;
++	DWC_WARN("Mode Mismatch Interrupt: currently in %s mode\n",
++		 dwc_otg_mode(core_if) ? "Host" : "Device");
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.modemismatch = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++	return 1;
++}
++
++/**
++ * This function handles the OTG Interrupts. It reads the OTG
++ * Interrupt Register (GOTGINT) to determine what interrupt has
++ * occurred.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static int32_t dwc_otg_handle_otg_intr(dwc_otg_core_if_t * core_if)
++{
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	gotgint_data_t gotgint;
++	gotgctl_data_t gotgctl;
++	gintmsk_data_t gintmsk;
++	gpwrdn_data_t gpwrdn;
++
++	gotgint.d32 = DWC_READ_REG32(&global_regs->gotgint);
++	gotgctl.d32 = DWC_READ_REG32(&global_regs->gotgctl);
++	DWC_DEBUGPL(DBG_CIL, "++OTG Interrupt gotgint=%0x [%s]\n", gotgint.d32,
++		    op_state_str(core_if));
++
++	if (gotgint.b.sesenddet) {
++		DWC_DEBUGPL(DBG_ANY, " ++OTG Interrupt: "
++			    "Session End Detected++ (%s)\n",
++			    op_state_str(core_if));
++		gotgctl.d32 = DWC_READ_REG32(&global_regs->gotgctl);
++
++		if (core_if->op_state == B_HOST) {
++			cil_pcd_start(core_if);
++			core_if->op_state = B_PERIPHERAL;
++		} else {
++			/* If not B_HOST and Device HNP still set. HNP
++			 * Did not succeed!*/
++			if (gotgctl.b.devhnpen) {
++				DWC_DEBUGPL(DBG_ANY, "Session End Detected\n");
++				__DWC_ERROR("Device Not Connected/Responding!\n");
++			}
++
++			/* If Session End Detected the B-Cable has
++			 * been disconnected. */
++			/* Reset PCD and Gadget driver to a
++			 * clean state. */
++			core_if->lx_state = DWC_OTG_L0;
++			DWC_SPINUNLOCK(core_if->lock);
++			cil_pcd_stop(core_if);
++			DWC_SPINLOCK(core_if->lock);
++
++			if (core_if->adp_enable) {
++				if (core_if->power_down == 2) {
++					gpwrdn.d32 = 0;
++					gpwrdn.b.pwrdnswtch = 1;
++					DWC_MODIFY_REG32(&core_if->
++							 core_global_regs->
++							 gpwrdn, gpwrdn.d32, 0);
++				}
++
++				gpwrdn.d32 = 0;
++				gpwrdn.b.pmuintsel = 1;
++				gpwrdn.b.pmuactv = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++
++				dwc_otg_adp_sense_start(core_if);
++			}
++		}
++
++		gotgctl.d32 = 0;
++		gotgctl.b.devhnpen = 1;
++		DWC_MODIFY_REG32(&global_regs->gotgctl, gotgctl.d32, 0);
++	}
++	if (gotgint.b.sesreqsucstschng) {
++		DWC_DEBUGPL(DBG_ANY, " ++OTG Interrupt: "
++			    "Session Reqeust Success Status Change++\n");
++		gotgctl.d32 = DWC_READ_REG32(&global_regs->gotgctl);
++		if (gotgctl.b.sesreqscs) {
++
++			if ((core_if->core_params->phy_type ==
++			     DWC_PHY_TYPE_PARAM_FS) && (core_if->core_params->i2c_enable)) {
++				core_if->srp_success = 1;
++			} else {
++				DWC_SPINUNLOCK(core_if->lock);
++				cil_pcd_resume(core_if);
++				DWC_SPINLOCK(core_if->lock);
++				/* Clear Session Request */
++				gotgctl.d32 = 0;
++				gotgctl.b.sesreq = 1;
++				DWC_MODIFY_REG32(&global_regs->gotgctl,
++						 gotgctl.d32, 0);
++			}
++		}
++	}
++	if (gotgint.b.hstnegsucstschng) {
++		/* Print statements during the HNP interrupt handling
++		 * can cause it to fail.*/
++		gotgctl.d32 = DWC_READ_REG32(&global_regs->gotgctl);
++		/* WA for 3.00a- HW is not setting cur_mode, even sometimes
++		 * this does not help*/
++		if (core_if->snpsid >= OTG_CORE_REV_3_00a)
++			dwc_udelay(100);
++		if (gotgctl.b.hstnegscs) {
++			if (dwc_otg_is_host_mode(core_if)) {
++				core_if->op_state = B_HOST;
++				/*
++				 * Need to disable SOF interrupt immediately.
++				 * When switching from device to host, the PCD
++				 * interrupt handler won't handle the
++				 * interrupt if host mode is already set. The
++				 * HCD interrupt handler won't get called if
++				 * the HCD state is HALT. This means that the
++				 * interrupt does not get handled and Linux
++				 * complains loudly.
++				 */
++				gintmsk.d32 = 0;
++				gintmsk.b.sofintr = 1;
++				DWC_MODIFY_REG32(&global_regs->gintmsk,
++						 gintmsk.d32, 0);
++				/* Call callback function with spin lock released */
++				DWC_SPINUNLOCK(core_if->lock);
++				cil_pcd_stop(core_if);
++				/*
++				 * Initialize the Core for Host mode.
++				 */
++				cil_hcd_start(core_if);
++				DWC_SPINLOCK(core_if->lock);
++				core_if->op_state = B_HOST;
++			}
++		} else {
++			gotgctl.d32 = 0;
++			gotgctl.b.hnpreq = 1;
++			gotgctl.b.devhnpen = 1;
++			DWC_MODIFY_REG32(&global_regs->gotgctl, gotgctl.d32, 0);
++			DWC_DEBUGPL(DBG_ANY, "HNP Failed\n");
++			__DWC_ERROR("Device Not Connected/Responding\n");
++		}
++	}
++	if (gotgint.b.hstnegdet) {
++		/* The disconnect interrupt is set at the same time as
++		 * Host Negotiation Detected.  During the mode
++		 * switch all interrupts are cleared so the disconnect
++		 * interrupt handler will not get executed.
++		 */
++		DWC_DEBUGPL(DBG_ANY, " ++OTG Interrupt: "
++			    "Host Negotiation Detected++ (%s)\n",
++			    (dwc_otg_is_host_mode(core_if) ? "Host" :
++			     "Device"));
++		if (dwc_otg_is_device_mode(core_if)) {
++			DWC_DEBUGPL(DBG_ANY, "a_suspend->a_peripheral (%d)\n",
++				    core_if->op_state);
++			DWC_SPINUNLOCK(core_if->lock);
++			cil_hcd_disconnect(core_if);
++			cil_pcd_start(core_if);
++			DWC_SPINLOCK(core_if->lock);
++			core_if->op_state = A_PERIPHERAL;
++		} else {
++			/*
++			 * Need to disable SOF interrupt immediately. When
++			 * switching from device to host, the PCD interrupt
++			 * handler won't handle the interrupt if host mode is
++			 * already set. The HCD interrupt handler won't get
++			 * called if the HCD state is HALT. This means that
++			 * the interrupt does not get handled and Linux
++			 * complains loudly.
++			 */
++			gintmsk.d32 = 0;
++			gintmsk.b.sofintr = 1;
++			DWC_MODIFY_REG32(&global_regs->gintmsk, gintmsk.d32, 0);
++			DWC_SPINUNLOCK(core_if->lock);
++			cil_pcd_stop(core_if);
++			cil_hcd_start(core_if);
++			DWC_SPINLOCK(core_if->lock);
++			core_if->op_state = A_HOST;
++		}
++	}
++	if (gotgint.b.adevtoutchng) {
++		DWC_DEBUGPL(DBG_ANY, " ++OTG Interrupt: "
++			    "A-Device Timeout Change++\n");
++	}
++	if (gotgint.b.debdone) {
++		DWC_DEBUGPL(DBG_ANY, " ++OTG Interrupt: " "Debounce Done++\n");
++	}
++
++	/* Clear GOTGINT */
++	DWC_WRITE_REG32(&core_if->core_global_regs->gotgint, gotgint.d32);
++
++	return 1;
++}
++
++void w_conn_id_status_change(void *p)
++{
++	dwc_otg_core_if_t *core_if = p;
++	uint32_t count = 0;
++	gotgctl_data_t gotgctl = {.d32 = 0 };
++
++	gotgctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
++	DWC_DEBUGPL(DBG_CIL, "gotgctl=%0x\n", gotgctl.d32);
++	DWC_DEBUGPL(DBG_CIL, "gotgctl.b.conidsts=%d\n", gotgctl.b.conidsts);
++
++	/* B-Device connector (Device Mode) */
++	if (gotgctl.b.conidsts) {
++		/* Wait for switch to device mode. */
++		while (!dwc_otg_is_device_mode(core_if)) {
++			DWC_PRINTF("Waiting for Peripheral Mode, Mode=%s\n",
++				   (dwc_otg_is_host_mode(core_if) ? "Host" :
++				    "Peripheral"));
++			dwc_mdelay(100);
++			if (++count > 10000)
++				break;
++		}
++		DWC_ASSERT(++count < 10000,
++			   "Connection id status change timed out");
++		core_if->op_state = B_PERIPHERAL;
++		dwc_otg_core_init(core_if);
++		dwc_otg_enable_global_interrupts(core_if);
++		cil_pcd_start(core_if);
++	} else {
++		/* A-Device connector (Host Mode) */
++		while (!dwc_otg_is_host_mode(core_if)) {
++			DWC_PRINTF("Waiting for Host Mode, Mode=%s\n",
++				   (dwc_otg_is_host_mode(core_if) ? "Host" :
++				    "Peripheral"));
++			dwc_mdelay(100);
++			if (++count > 10000)
++				break;
++		}
++		DWC_ASSERT(++count < 10000,
++			   "Connection id status change timed out");
++		core_if->op_state = A_HOST;
++		/*
++		 * Initialize the Core for Host mode.
++		 */
++		dwc_otg_core_init(core_if);
++		dwc_otg_enable_global_interrupts(core_if);
++		cil_hcd_start(core_if);
++	}
++}
++
++/**
++ * This function handles the Connector ID Status Change Interrupt.  It
++ * reads the OTG Interrupt Register (GOTCTL) to determine whether this
++ * is a Device to Host Mode transition or a Host Mode to Device
++ * Transition.
++ *
++ * This only occurs when the cable is connected/removed from the PHY
++ * connector.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static int32_t dwc_otg_handle_conn_id_status_change_intr(dwc_otg_core_if_t * core_if)
++{
++
++	/*
++	 * Need to disable SOF interrupt immediately. If switching from device
++	 * to host, the PCD interrupt handler won't handle the interrupt if
++	 * host mode is already set. The HCD interrupt handler won't get
++	 * called if the HCD state is HALT. This means that the interrupt does
++	 * not get handled and Linux complains loudly.
++	 */
++	gintmsk_data_t gintmsk = {.d32 = 0 };
++	gintsts_data_t gintsts = {.d32 = 0 };
++
++	gintmsk.b.sofintr = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, gintmsk.d32, 0);
++
++	DWC_DEBUGPL(DBG_CIL,
++		    " ++Connector ID Status Change Interrupt++  (%s)\n",
++		    (dwc_otg_is_host_mode(core_if) ? "Host" : "Device"));
++
++	DWC_SPINUNLOCK(core_if->lock);
++
++	/*
++	 * Need to schedule a work, as there are possible DELAY function calls
++	 * Release lock before scheduling workq as it holds spinlock during scheduling
++	 */
++
++	DWC_WORKQ_SCHEDULE(core_if->wq_otg, w_conn_id_status_change,
++			   core_if, "connection id status change");
++	DWC_SPINLOCK(core_if->lock);
++
++	/* Set flag and clear interrupt */
++	gintsts.b.conidstschng = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++
++	return 1;
++}
++
++/**
++ * This interrupt indicates that a device is initiating the Session
++ * Request Protocol to request the host to turn on bus power so a new
++ * session can begin. The handler responds by turning on bus power. If
++ * the DWC_otg controller is in low power mode, the handler brings the
++ * controller out of low power mode before turning on bus power.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static int32_t dwc_otg_handle_session_req_intr(dwc_otg_core_if_t * core_if)
++{
++	gintsts_data_t gintsts;
++
++#ifndef DWC_HOST_ONLY
++	DWC_DEBUGPL(DBG_ANY, "++Session Request Interrupt++\n");
++
++	if (dwc_otg_is_device_mode(core_if)) {
++		DWC_PRINTF("SRP: Device mode\n");
++	} else {
++		hprt0_data_t hprt0;
++		DWC_PRINTF("SRP: Host mode\n");
++
++		/* Turn on the port power bit. */
++		hprt0.d32 = dwc_otg_read_hprt0(core_if);
++		hprt0.b.prtpwr = 1;
++		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++
++		/* Start the Connection timer. So a message can be displayed
++		 * if connect does not occur within 10 seconds. */
++		cil_hcd_session_start(core_if);
++	}
++#endif
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.sessreqintr = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++
++	return 1;
++}
++
++void w_wakeup_detected(void *p)
++{
++	dwc_otg_core_if_t *core_if = (dwc_otg_core_if_t *) p;
++	/*
++	 * Clear the Resume after 70ms. (Need 20 ms minimum. Use 70 ms
++	 * so that OPT tests pass with all PHYs).
++	 */
++	hprt0_data_t hprt0 = {.d32 = 0 };
++#if 0
++	pcgcctl_data_t pcgcctl = {.d32 = 0 };
++	/* Restart the Phy Clock */
++	pcgcctl.b.stoppclk = 1;
++	DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
++	dwc_udelay(10);
++#endif //0
++	hprt0.d32 = dwc_otg_read_hprt0(core_if);
++	DWC_DEBUGPL(DBG_ANY, "Resume: HPRT0=%0x\n", hprt0.d32);
++//      dwc_mdelay(70);
++	hprt0.b.prtres = 0;	/* Resume */
++	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++	DWC_DEBUGPL(DBG_ANY, "Clear Resume: HPRT0=%0x\n",
++		    DWC_READ_REG32(core_if->host_if->hprt0));
++
++	cil_hcd_resume(core_if);
++
++	/** Change to L0 state*/
++	core_if->lx_state = DWC_OTG_L0;
++}
++
++/**
++ * This interrupt indicates that the DWC_otg controller has detected a
++ * resume or remote wakeup sequence. If the DWC_otg controller is in
++ * low power mode, the handler must brings the controller out of low
++ * power mode. The controller automatically begins resume
++ * signaling. The handler schedules a time to stop resume signaling.
++ */
++static int32_t dwc_otg_handle_wakeup_detected_intr(dwc_otg_core_if_t * core_if)
++{
++	gintsts_data_t gintsts;
++
++	DWC_DEBUGPL(DBG_ANY,
++		    "++Resume and Remote Wakeup Detected Interrupt++\n");
++
++	DWC_PRINTF("%s lxstate = %d\n", __func__, core_if->lx_state);
++
++	if (dwc_otg_is_device_mode(core_if)) {
++		dctl_data_t dctl = {.d32 = 0 };
++		DWC_DEBUGPL(DBG_PCD, "DSTS=0x%0x\n",
++			    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->
++					   dsts));
++		if (core_if->lx_state == DWC_OTG_L2) {
++#ifdef PARTIAL_POWER_DOWN
++			if (core_if->hwcfg4.b.power_optimiz) {
++				pcgcctl_data_t power = {.d32 = 0 };
++
++				power.d32 = DWC_READ_REG32(core_if->pcgcctl);
++				DWC_DEBUGPL(DBG_CIL, "PCGCCTL=%0x\n",
++					    power.d32);
++
++				power.b.stoppclk = 0;
++				DWC_WRITE_REG32(core_if->pcgcctl, power.d32);
++
++				power.b.pwrclmp = 0;
++				DWC_WRITE_REG32(core_if->pcgcctl, power.d32);
++
++				power.b.rstpdwnmodule = 0;
++				DWC_WRITE_REG32(core_if->pcgcctl, power.d32);
++			}
++#endif
++			/* Clear the Remote Wakeup Signaling */
++			dctl.b.rmtwkupsig = 1;
++			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
++					 dctl, dctl.d32, 0);
++
++			DWC_SPINUNLOCK(core_if->lock);
++			if (core_if->pcd_cb && core_if->pcd_cb->resume_wakeup) {
++				core_if->pcd_cb->resume_wakeup(core_if->pcd_cb->p);
++			}
++			DWC_SPINLOCK(core_if->lock);
++		} else {
++			glpmcfg_data_t lpmcfg;
++			lpmcfg.d32 =
++			    DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++			lpmcfg.b.hird_thres &= (~(1 << 4));
++			DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg,
++					lpmcfg.d32);
++		}
++		/** Change to L0 state*/
++		core_if->lx_state = DWC_OTG_L0;
++	} else {
++		if (core_if->lx_state != DWC_OTG_L1) {
++			pcgcctl_data_t pcgcctl = {.d32 = 0 };
++
++			/* Restart the Phy Clock */
++			pcgcctl.b.stoppclk = 1;
++			DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
++			DWC_TIMER_SCHEDULE(core_if->wkp_timer, 71);
++		} else {
++			/** Change to L0 state*/
++			core_if->lx_state = DWC_OTG_L0;
++		}
++	}
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.wkupintr = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++
++	return 1;
++}
++
++/**
++ * This interrupt indicates that the Wakeup Logic has detected a
++ * Device disconnect.
++ */
++static int32_t dwc_otg_handle_pwrdn_disconnect_intr(dwc_otg_core_if_t *core_if)
++{
++	gpwrdn_data_t gpwrdn = { .d32 = 0 };
++	gpwrdn_data_t gpwrdn_temp = { .d32 = 0 };
++	gpwrdn_temp.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++
++	DWC_PRINTF("%s called\n", __FUNCTION__);
++
++	if (!core_if->hibernation_suspend) {
++		DWC_PRINTF("Already exited from Hibernation\n");
++		return 1;
++	}
++
++	/* Switch on the voltage to the core */
++	gpwrdn.b.pwrdnswtch = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Reset the core */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnrstn = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Disable power clamps*/
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnclmp = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	/* Remove reset the core signal */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnrstn = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++	dwc_udelay(10);
++
++	/* Disable PMU interrupt */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pmuintsel = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	core_if->hibernation_suspend = 0;
++
++	/* Disable PMU */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pmuactv = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	if (gpwrdn_temp.b.idsts) {
++		core_if->op_state = B_PERIPHERAL;
++		dwc_otg_core_init(core_if);
++		dwc_otg_enable_global_interrupts(core_if);
++		cil_pcd_start(core_if);
++	} else {
++		core_if->op_state = A_HOST;
++		dwc_otg_core_init(core_if);
++		dwc_otg_enable_global_interrupts(core_if);
++		cil_hcd_start(core_if);
++	}
++
++	return 1;
++}
++
++/**
++ * This interrupt indicates that the Wakeup Logic has detected a
++ * remote wakeup sequence.
++ */
++static int32_t dwc_otg_handle_pwrdn_wakeup_detected_intr(dwc_otg_core_if_t * core_if)
++{
++	gpwrdn_data_t gpwrdn = {.d32 = 0 };
++	DWC_DEBUGPL(DBG_ANY,
++		    "++Powerdown Remote Wakeup Detected Interrupt++\n");
++
++	if (!core_if->hibernation_suspend) {
++		DWC_PRINTF("Already exited from Hibernation\n");
++		return 1;
++	}
++
++	gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++	if (gpwrdn.b.idsts) {	// Device Mode
++		if ((core_if->power_down == 2)
++		    && (core_if->hibernation_suspend == 1)) {
++			dwc_otg_device_hibernation_restore(core_if, 0, 0);
++		}
++	} else {
++		if ((core_if->power_down == 2)
++		    && (core_if->hibernation_suspend == 1)) {
++			dwc_otg_host_hibernation_restore(core_if, 1, 0);
++		}
++	}
++	return 1;
++}
++
++static int32_t dwc_otg_handle_pwrdn_idsts_change(dwc_otg_device_t *otg_dev)
++{
++	gpwrdn_data_t gpwrdn = {.d32 = 0 };
++	gpwrdn_data_t gpwrdn_temp = {.d32 = 0 };
++	dwc_otg_core_if_t *core_if = otg_dev->core_if;
++
++	DWC_DEBUGPL(DBG_ANY, "%s called\n", __FUNCTION__);
++	gpwrdn_temp.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++	if (core_if->power_down == 2) {
++		if (!core_if->hibernation_suspend) {
++			DWC_PRINTF("Already exited from Hibernation\n");
++			return 1;
++		}
++		DWC_DEBUGPL(DBG_ANY, "Exit from hibernation on ID sts change\n");
++		/* Switch on the voltage to the core */
++		gpwrdn.b.pwrdnswtch = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++		dwc_udelay(10);
++
++		/* Reset the core */
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pwrdnrstn = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++		dwc_udelay(10);
++
++		/* Disable power clamps */
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pwrdnclmp = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++		/* Remove reset the core signal */
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pwrdnrstn = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++		dwc_udelay(10);
++
++		/* Disable PMU interrupt */
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pmuintsel = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++		/*Indicates that we are exiting from hibernation */
++		core_if->hibernation_suspend = 0;
++
++		/* Disable PMU */
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pmuactv = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++		dwc_udelay(10);
++
++		gpwrdn.d32 = core_if->gr_backup->gpwrdn_local;
++		if (gpwrdn.b.dis_vbus == 1) {
++			gpwrdn.d32 = 0;
++			gpwrdn.b.dis_vbus = 1;
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++		}
++
++		if (gpwrdn_temp.b.idsts) {
++			core_if->op_state = B_PERIPHERAL;
++			dwc_otg_core_init(core_if);
++			dwc_otg_enable_global_interrupts(core_if);
++			cil_pcd_start(core_if);
++		} else {
++			core_if->op_state = A_HOST;
++			dwc_otg_core_init(core_if);
++			dwc_otg_enable_global_interrupts(core_if);
++			cil_hcd_start(core_if);
++		}
++	}
++
++	if (core_if->adp_enable) {
++		uint8_t is_host = 0;
++		DWC_SPINUNLOCK(core_if->lock);
++		/* Change the core_if's lock to hcd/pcd lock depend on mode? */
++#ifndef DWC_HOST_ONLY
++		if (gpwrdn_temp.b.idsts)
++			core_if->lock = otg_dev->pcd->lock;
++#endif
++#ifndef DWC_DEVICE_ONLY
++		if (!gpwrdn_temp.b.idsts) {
++				core_if->lock = otg_dev->hcd->lock;
++				is_host = 1;
++		}
++#endif
++		DWC_PRINTF("RESTART ADP\n");
++		if (core_if->adp.probe_enabled)
++			dwc_otg_adp_probe_stop(core_if);
++		if (core_if->adp.sense_enabled)
++			dwc_otg_adp_sense_stop(core_if);
++		if (core_if->adp.sense_timer_started)
++			DWC_TIMER_CANCEL(core_if->adp.sense_timer);
++		if (core_if->adp.vbuson_timer_started)
++			DWC_TIMER_CANCEL(core_if->adp.vbuson_timer);
++		core_if->adp.probe_timer_values[0] = -1;
++		core_if->adp.probe_timer_values[1] = -1;
++		core_if->adp.sense_timer_started = 0;
++		core_if->adp.vbuson_timer_started = 0;
++		core_if->adp.probe_counter = 0;
++		core_if->adp.gpwrdn = 0;
++
++		/* Disable PMU and restart ADP */
++		gpwrdn_temp.d32 = 0;
++		gpwrdn_temp.b.pmuactv = 1;
++		gpwrdn_temp.b.pmuintsel = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++		DWC_PRINTF("Check point 1\n");
++		dwc_mdelay(110);
++		dwc_otg_adp_start(core_if, is_host);
++		DWC_SPINLOCK(core_if->lock);
++	}
++
++
++	return 1;
++}
++
++static int32_t dwc_otg_handle_pwrdn_session_change(dwc_otg_core_if_t * core_if)
++{
++	gpwrdn_data_t gpwrdn = {.d32 = 0 };
++	int32_t otg_cap_param = core_if->core_params->otg_cap;
++	DWC_DEBUGPL(DBG_ANY, "%s called\n", __FUNCTION__);
++
++	gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++	if (core_if->power_down == 2) {
++		if (!core_if->hibernation_suspend) {
++			DWC_PRINTF("Already exited from Hibernation\n");
++			return 1;
++		}
++
++		if ((otg_cap_param != DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE ||
++			 otg_cap_param != DWC_OTG_CAP_PARAM_SRP_ONLY_CAPABLE) &&
++			gpwrdn.b.bsessvld == 0) {
++			/* Save gpwrdn register for further usage if stschng interrupt */
++			core_if->gr_backup->gpwrdn_local =
++				DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++			/*Exit from ISR and wait for stschng interrupt with bsessvld = 1 */
++			return 1;
++		}
++
++		/* Switch on the voltage to the core */
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pwrdnswtch = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++		dwc_udelay(10);
++
++		/* Reset the core */
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pwrdnrstn = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++		dwc_udelay(10);
++
++		/* Disable power clamps */
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pwrdnclmp = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++		/* Remove reset the core signal */
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pwrdnrstn = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++		dwc_udelay(10);
++
++		/* Disable PMU interrupt */
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pmuintsel = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++		dwc_udelay(10);
++
++		/*Indicates that we are exiting from hibernation */
++		core_if->hibernation_suspend = 0;
++
++		/* Disable PMU */
++		gpwrdn.d32 = 0;
++		gpwrdn.b.pmuactv = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++		dwc_udelay(10);
++
++		core_if->op_state = B_PERIPHERAL;
++		dwc_otg_core_init(core_if);
++		dwc_otg_enable_global_interrupts(core_if);
++		cil_pcd_start(core_if);
++
++		if (otg_cap_param == DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE ||
++			otg_cap_param == DWC_OTG_CAP_PARAM_SRP_ONLY_CAPABLE) {
++			/*
++			 * Initiate SRP after initial ADP probe.
++			 */
++			dwc_otg_initiate_srp(core_if);
++		}
++	}
++
++	return 1;
++}
++/**
++ * This interrupt indicates that the Wakeup Logic has detected a
++ * status change either on IDDIG or BSessVld.
++ */
++static uint32_t dwc_otg_handle_pwrdn_stschng_intr(dwc_otg_device_t *otg_dev)
++{
++	uint32_t retval = 0;
++	gpwrdn_data_t gpwrdn = {.d32 = 0 };
++	gpwrdn_data_t gpwrdn_temp = {.d32 = 0 };
++	dwc_otg_core_if_t *core_if = otg_dev->core_if;
++
++	DWC_PRINTF("%s called\n", __FUNCTION__);
++
++	if (core_if->power_down == 2) {
++		if (core_if->hibernation_suspend <= 0) {
++			DWC_PRINTF("Already exited from Hibernation\n");
++			return 1;
++		} else
++			gpwrdn_temp.d32 = core_if->gr_backup->gpwrdn_local;
++
++	} else {
++		gpwrdn_temp.d32 = core_if->adp.gpwrdn;
++	}
++
++	gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++
++	if (gpwrdn.b.idsts ^ gpwrdn_temp.b.idsts) {
++		retval = dwc_otg_handle_pwrdn_idsts_change(otg_dev);
++	} else if (gpwrdn.b.bsessvld ^ gpwrdn_temp.b.bsessvld) {
++		retval = dwc_otg_handle_pwrdn_session_change(core_if);
++	}
++
++	return retval;
++}
++
++/**
++ * This interrupt indicates that the Wakeup Logic has detected a
++ * SRP.
++ */
++static int32_t dwc_otg_handle_pwrdn_srp_intr(dwc_otg_core_if_t * core_if)
++{
++	gpwrdn_data_t gpwrdn = {.d32 = 0 };
++
++	DWC_PRINTF("%s called\n", __FUNCTION__);
++
++	if (!core_if->hibernation_suspend) {
++		DWC_PRINTF("Already exited from Hibernation\n");
++		return 1;
++	}
++#ifdef DWC_DEV_SRPCAP
++	if (core_if->pwron_timer_started) {
++		core_if->pwron_timer_started = 0;
++		DWC_TIMER_CANCEL(core_if->pwron_timer);
++	}
++#endif
++
++	/* Switch on the voltage to the core */
++	gpwrdn.b.pwrdnswtch = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Reset the core */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnrstn = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Disable power clamps */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnclmp = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	/* Remove reset the core signal */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnrstn = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++	dwc_udelay(10);
++
++	/* Disable PMU interrupt */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pmuintsel = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	/* Indicates that we are exiting from hibernation */
++	core_if->hibernation_suspend = 0;
++
++	/* Disable PMU */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pmuactv = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Programm Disable VBUS to 0 */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.dis_vbus = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	/*Initialize the core as Host */
++	core_if->op_state = A_HOST;
++	dwc_otg_core_init(core_if);
++	dwc_otg_enable_global_interrupts(core_if);
++	cil_hcd_start(core_if);
++
++	return 1;
++}
++
++/**
++ * This interrupt indicates that a device has been disconnected from
++ * the root port.
++ */
++static int32_t dwc_otg_handle_disconnect_intr(dwc_otg_core_if_t * core_if)
++{
++	gintsts_data_t gintsts;
++
++	DWC_DEBUGPL(DBG_ANY, "++Disconnect Detected Interrupt++ (%s) %s\n",
++		    (dwc_otg_is_host_mode(core_if) ? "Host" : "Device"),
++		    op_state_str(core_if));
++
++/** @todo Consolidate this if statement. */
++#ifndef DWC_HOST_ONLY
++	if (core_if->op_state == B_HOST) {
++		/* If in device mode Disconnect and stop the HCD, then
++		 * start the PCD. */
++		DWC_SPINUNLOCK(core_if->lock);
++		cil_hcd_disconnect(core_if);
++		cil_pcd_start(core_if);
++		DWC_SPINLOCK(core_if->lock);
++		core_if->op_state = B_PERIPHERAL;
++	} else if (dwc_otg_is_device_mode(core_if)) {
++		gotgctl_data_t gotgctl = {.d32 = 0 };
++		gotgctl.d32 =
++		    DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
++		if (gotgctl.b.hstsethnpen == 1) {
++			/* Do nothing, if HNP in process the OTG
++			 * interrupt "Host Negotiation Detected"
++			 * interrupt will do the mode switch.
++			 */
++		} else if (gotgctl.b.devhnpen == 0) {
++			/* If in device mode Disconnect and stop the HCD, then
++			 * start the PCD. */
++			DWC_SPINUNLOCK(core_if->lock);
++			cil_hcd_disconnect(core_if);
++			cil_pcd_start(core_if);
++			DWC_SPINLOCK(core_if->lock);
++			core_if->op_state = B_PERIPHERAL;
++		} else {
++			DWC_DEBUGPL(DBG_ANY, "!a_peripheral && !devhnpen\n");
++		}
++	} else {
++		if (core_if->op_state == A_HOST) {
++			/* A-Cable still connected but device disconnected. */
++			DWC_SPINUNLOCK(core_if->lock);
++			cil_hcd_disconnect(core_if);
++			DWC_SPINLOCK(core_if->lock);
++			if (core_if->adp_enable) {
++				gpwrdn_data_t gpwrdn = { .d32 = 0 };
++				cil_hcd_stop(core_if);
++				/* Enable Power Down Logic */
++				gpwrdn.b.pmuintsel = 1;
++				gpwrdn.b.pmuactv = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++				dwc_otg_adp_probe_start(core_if);
++
++				/* Power off the core */
++				if (core_if->power_down == 2) {
++					gpwrdn.d32 = 0;
++					gpwrdn.b.pwrdnswtch = 1;
++					DWC_MODIFY_REG32
++					    (&core_if->core_global_regs->gpwrdn,
++					     gpwrdn.d32, 0);
++				}
++			}
++		}
++	}
++#endif
++	/* Change to L3(OFF) state */
++	core_if->lx_state = DWC_OTG_L3;
++
++	gintsts.d32 = 0;
++	gintsts.b.disconnect = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++	return 1;
++}
++
++/**
++ * This interrupt indicates that SUSPEND state has been detected on
++ * the USB.
++ *
++ * For HNP the USB Suspend interrupt signals the change from
++ * "a_peripheral" to "a_host".
++ *
++ * When power management is enabled the core will be put in low power
++ * mode.
++ */
++static int32_t dwc_otg_handle_usb_suspend_intr(dwc_otg_core_if_t * core_if)
++{
++	dsts_data_t dsts;
++	gintsts_data_t gintsts;
++	dcfg_data_t dcfg;
++
++	DWC_DEBUGPL(DBG_ANY, "USB SUSPEND\n");
++
++	if (dwc_otg_is_device_mode(core_if)) {
++		/* Check the Device status register to determine if the Suspend
++		 * state is active. */
++		dsts.d32 =
++		    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
++		DWC_DEBUGPL(DBG_PCD, "DSTS=0x%0x\n", dsts.d32);
++		DWC_DEBUGPL(DBG_PCD, "DSTS.Suspend Status=%d "
++			    "HWCFG4.power Optimize=%d\n",
++			    dsts.b.suspsts, core_if->hwcfg4.b.power_optimiz);
++
++#ifdef PARTIAL_POWER_DOWN
++/** @todo Add a module parameter for power management. */
++
++		if (dsts.b.suspsts && core_if->hwcfg4.b.power_optimiz) {
++			pcgcctl_data_t power = {.d32 = 0 };
++			DWC_DEBUGPL(DBG_CIL, "suspend\n");
++
++			power.b.pwrclmp = 1;
++			DWC_WRITE_REG32(core_if->pcgcctl, power.d32);
++
++			power.b.rstpdwnmodule = 1;
++			DWC_MODIFY_REG32(core_if->pcgcctl, 0, power.d32);
++
++			power.b.stoppclk = 1;
++			DWC_MODIFY_REG32(core_if->pcgcctl, 0, power.d32);
++
++		} else {
++			DWC_DEBUGPL(DBG_ANY, "disconnect?\n");
++		}
++#endif
++		/* PCD callback for suspend. Release the lock inside of callback function */
++		cil_pcd_suspend(core_if);
++		if (core_if->power_down == 2)
++		{
++			dcfg.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
++			DWC_DEBUGPL(DBG_ANY,"lx_state = %08x\n",core_if->lx_state);
++			DWC_DEBUGPL(DBG_ANY," device address = %08d\n",dcfg.b.devaddr);
++
++			if (core_if->lx_state != DWC_OTG_L3 && dcfg.b.devaddr) {
++				pcgcctl_data_t pcgcctl = {.d32 = 0 };
++				gpwrdn_data_t gpwrdn = {.d32 = 0 };
++				gusbcfg_data_t gusbcfg = {.d32 = 0 };
++
++				/* Change to L2(suspend) state */
++				core_if->lx_state = DWC_OTG_L2;
++
++				/* Clear interrupt in gintsts */
++				gintsts.d32 = 0;
++				gintsts.b.usbsuspend = 1;
++				DWC_WRITE_REG32(&core_if->core_global_regs->
++						gintsts, gintsts.d32);
++				DWC_PRINTF("Start of hibernation completed\n");
++				dwc_otg_save_global_regs(core_if);
++				dwc_otg_save_dev_regs(core_if);
++
++				gusbcfg.d32 =
++				    DWC_READ_REG32(&core_if->core_global_regs->
++						   gusbcfg);
++				if (gusbcfg.b.ulpi_utmi_sel == 1) {
++					/* ULPI interface */
++					/* Suspend the Phy Clock */
++					pcgcctl.d32 = 0;
++					pcgcctl.b.stoppclk = 1;
++					DWC_MODIFY_REG32(core_if->pcgcctl, 0,
++							 pcgcctl.d32);
++					dwc_udelay(10);
++					gpwrdn.b.pmuactv = 1;
++					DWC_MODIFY_REG32(&core_if->
++							 core_global_regs->
++							 gpwrdn, 0, gpwrdn.d32);
++				} else {
++					/* UTMI+ Interface */
++					gpwrdn.b.pmuactv = 1;
++					DWC_MODIFY_REG32(&core_if->
++							 core_global_regs->
++							 gpwrdn, 0, gpwrdn.d32);
++					dwc_udelay(10);
++					pcgcctl.b.stoppclk = 1;
++					DWC_MODIFY_REG32(core_if->pcgcctl, 0,
++							 pcgcctl.d32);
++					dwc_udelay(10);
++				}
++
++				/* Set flag to indicate that we are in hibernation */
++				core_if->hibernation_suspend = 1;
++				/* Enable interrupts from wake up logic */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.pmuintsel = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++				dwc_udelay(10);
++
++				/* Unmask device mode interrupts in GPWRDN */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.rst_det_msk = 1;
++				gpwrdn.b.lnstchng_msk = 1;
++				gpwrdn.b.sts_chngint_msk = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++				dwc_udelay(10);
++
++				/* Enable Power Down Clamp */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.pwrdnclmp = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++				dwc_udelay(10);
++
++				/* Switch off VDD */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.pwrdnswtch = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++
++				/* Save gpwrdn register for further usage if stschng interrupt */
++				core_if->gr_backup->gpwrdn_local =
++							DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++				DWC_PRINTF("Hibernation completed\n");
++
++				return 1;
++			}
++		} else if (core_if->power_down == 3) {
++			pcgcctl_data_t pcgcctl = {.d32 = 0 };
++			dcfg.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
++			DWC_DEBUGPL(DBG_ANY, "lx_state = %08x\n",core_if->lx_state);
++			DWC_DEBUGPL(DBG_ANY, " device address = %08d\n",dcfg.b.devaddr);
++
++			if (core_if->lx_state != DWC_OTG_L3 && dcfg.b.devaddr) {
++				DWC_DEBUGPL(DBG_ANY, "Start entering to extended hibernation\n");
++				core_if->xhib = 1;
++
++				/* Clear interrupt in gintsts */
++				gintsts.d32 = 0;
++				gintsts.b.usbsuspend = 1;
++				DWC_WRITE_REG32(&core_if->core_global_regs->
++					gintsts, gintsts.d32);
++
++				dwc_otg_save_global_regs(core_if);
++				dwc_otg_save_dev_regs(core_if);
++
++				/* Wait for 10 PHY clocks */
++				dwc_udelay(10);
++
++				/* Program GPIO register while entering to xHib */
++				DWC_WRITE_REG32(&core_if->core_global_regs->ggpio, 0x1);
++
++				pcgcctl.b.enbl_extnd_hiber = 1;
++				DWC_MODIFY_REG32(core_if->pcgcctl, 0, pcgcctl.d32);
++				DWC_MODIFY_REG32(core_if->pcgcctl, 0, pcgcctl.d32);
++
++				pcgcctl.d32 = 0;
++				pcgcctl.b.extnd_hiber_pwrclmp = 1;
++				DWC_MODIFY_REG32(core_if->pcgcctl, 0, pcgcctl.d32);
++
++				pcgcctl.d32 = 0;
++				pcgcctl.b.extnd_hiber_switch = 1;
++				core_if->gr_backup->xhib_gpwrdn = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++				core_if->gr_backup->xhib_pcgcctl = DWC_READ_REG32(core_if->pcgcctl) | pcgcctl.d32;
++				DWC_MODIFY_REG32(core_if->pcgcctl, 0, pcgcctl.d32);
++
++				DWC_DEBUGPL(DBG_ANY, "Finished entering to extended hibernation\n");
++
++				return 1;
++			}
++		}
++	} else {
++		if (core_if->op_state == A_PERIPHERAL) {
++			DWC_DEBUGPL(DBG_ANY, "a_peripheral->a_host\n");
++			/* Clear the a_peripheral flag, back to a_host. */
++			DWC_SPINUNLOCK(core_if->lock);
++			cil_pcd_stop(core_if);
++			cil_hcd_start(core_if);
++			DWC_SPINLOCK(core_if->lock);
++			core_if->op_state = A_HOST;
++		}
++	}
++
++	/* Change to L2(suspend) state */
++	core_if->lx_state = DWC_OTG_L2;
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.usbsuspend = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++
++	return 1;
++}
++
++static int32_t dwc_otg_handle_xhib_exit_intr(dwc_otg_core_if_t * core_if)
++{
++	gpwrdn_data_t gpwrdn = {.d32 = 0 };
++	pcgcctl_data_t pcgcctl = {.d32 = 0 };
++	gahbcfg_data_t gahbcfg = {.d32 = 0 };
++
++	dwc_udelay(10);
++
++	/* Program GPIO register while entering to xHib */
++	DWC_WRITE_REG32(&core_if->core_global_regs->ggpio, 0x0);
++
++	pcgcctl.d32 = core_if->gr_backup->xhib_pcgcctl;
++	pcgcctl.b.extnd_hiber_pwrclmp = 0;
++	DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
++	dwc_udelay(10);
++
++	gpwrdn.d32 = core_if->gr_backup->xhib_gpwrdn;
++	gpwrdn.b.restore = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32);
++	dwc_udelay(10);
++
++	restore_lpm_i2c_regs(core_if);
++
++	pcgcctl.d32 = core_if->gr_backup->pcgcctl_local & (0x3FFFF << 14);
++	pcgcctl.b.max_xcvrselect = 1;
++	pcgcctl.b.ess_reg_restored = 0;
++	pcgcctl.b.extnd_hiber_switch = 0;
++	pcgcctl.b.extnd_hiber_pwrclmp = 0;
++	pcgcctl.b.enbl_extnd_hiber = 1;
++	DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
++
++	gahbcfg.d32 = core_if->gr_backup->gahbcfg_local;
++	gahbcfg.b.glblintrmsk = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gahbcfg, gahbcfg.d32);
++
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, 0x1 << 16);
++
++	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg,
++			core_if->gr_backup->gusbcfg_local);
++	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg,
++			core_if->dr_backup->dcfg);
++
++	pcgcctl.d32 = 0;
++	pcgcctl.d32 = core_if->gr_backup->pcgcctl_local & (0x3FFFF << 14);
++	pcgcctl.b.max_xcvrselect = 1;
++	pcgcctl.d32 |= 0x608;
++	DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
++	dwc_udelay(10);
++
++	pcgcctl.d32 = 0;
++	pcgcctl.d32 = core_if->gr_backup->pcgcctl_local & (0x3FFFF << 14);
++	pcgcctl.b.max_xcvrselect = 1;
++	pcgcctl.b.ess_reg_restored = 1;
++	pcgcctl.b.enbl_extnd_hiber = 1;
++	pcgcctl.b.rstpdwnmodule = 1;
++	pcgcctl.b.restoremode = 1;
++	DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
++
++	DWC_DEBUGPL(DBG_ANY, "%s called\n", __FUNCTION__);
++
++	return 1;
++}
++
++#ifdef CONFIG_USB_DWC_OTG_LPM
++/**
++ * This function hadles LPM transaction received interrupt.
++ */
++static int32_t dwc_otg_handle_lpm_intr(dwc_otg_core_if_t * core_if)
++{
++	glpmcfg_data_t lpmcfg;
++	gintsts_data_t gintsts;
++
++	if (!core_if->core_params->lpm_enable) {
++		DWC_PRINTF("Unexpected LPM interrupt\n");
++	}
++
++	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++	DWC_PRINTF("LPM config register = 0x%08x\n", lpmcfg.d32);
++
++	if (dwc_otg_is_host_mode(core_if)) {
++		cil_hcd_sleep(core_if);
++	} else {
++		lpmcfg.b.hird_thres |= (1 << 4);
++		DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg,
++				lpmcfg.d32);
++	}
++
++	/* Examine prt_sleep_sts after TL1TokenTetry period max (10 us) */
++	dwc_udelay(10);
++	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++	if (lpmcfg.b.prt_sleep_sts) {
++		/* Save the current state */
++		core_if->lx_state = DWC_OTG_L1;
++	}
++
++	/* Clear interrupt  */
++	gintsts.d32 = 0;
++	gintsts.b.lpmtranrcvd = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++	return 1;
++}
++#endif /* CONFIG_USB_DWC_OTG_LPM */
++
++/**
++ * This function returns the Core Interrupt register.
++ */
++static inline uint32_t dwc_otg_read_common_intr(dwc_otg_core_if_t * core_if, gintmsk_data_t *reenable_gintmsk, dwc_otg_hcd_t *hcd)
++{
++	gahbcfg_data_t gahbcfg = {.d32 = 0 };
++	gintsts_data_t gintsts;
++	gintmsk_data_t gintmsk;
++	gintmsk_data_t gintmsk_common = {.d32 = 0 };
++	gintmsk_common.b.wkupintr = 1;
++	gintmsk_common.b.sessreqintr = 1;
++	gintmsk_common.b.conidstschng = 1;
++	gintmsk_common.b.otgintr = 1;
++	gintmsk_common.b.modemismatch = 1;
++	gintmsk_common.b.disconnect = 1;
++	gintmsk_common.b.usbsuspend = 1;
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	gintmsk_common.b.lpmtranrcvd = 1;
++#endif
++	gintmsk_common.b.restoredone = 1;
++	if(dwc_otg_is_device_mode(core_if))
++	{
++		/** @todo: The port interrupt occurs while in device
++		 * mode. Added code to CIL to clear the interrupt for now!
++		 */
++		gintmsk_common.b.portintr = 1;
++	}
++	if(fiq_enable) {
++		local_fiq_disable();
++		fiq_fsm_spin_lock(&hcd->fiq_state->lock);
++		gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
++		gintmsk.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
++		/* Pull in the interrupts that the FIQ has masked */
++		gintmsk.d32 |= ~(hcd->fiq_state->gintmsk_saved.d32);
++		gintmsk.d32 |= gintmsk_common.d32;
++		/* for the upstairs function to reenable - have to read it here in case FIQ triggers again */
++		reenable_gintmsk->d32 = gintmsk.d32;
++		fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
++		local_fiq_enable();
++	} else {
++		gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
++		gintmsk.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
++	}
++
++	gahbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gahbcfg);
++
++#ifdef DEBUG
++	/* if any common interrupts set */
++	if (gintsts.d32 & gintmsk_common.d32) {
++		DWC_DEBUGPL(DBG_ANY, "common_intr: gintsts=%08x  gintmsk=%08x\n",
++			    gintsts.d32, gintmsk.d32);
++	}
++#endif
++	if (!fiq_enable){
++		if (gahbcfg.b.glblintrmsk)
++			return ((gintsts.d32 & gintmsk.d32) & gintmsk_common.d32);
++		else
++			return 0;
++	} else {
++		/* Our IRQ kicker is no longer the USB hardware, it's the MPHI interface.
++		 * Can't trust the global interrupt mask bit in this case.
++		 */
++		return ((gintsts.d32 & gintmsk.d32) & gintmsk_common.d32);
++	}
++
++}
++
++/* MACRO for clearing interupt bits in GPWRDN register */
++#define CLEAR_GPWRDN_INTR(__core_if,__intr) \
++do { \
++		gpwrdn_data_t gpwrdn = {.d32=0}; \
++		gpwrdn.b.__intr = 1; \
++		DWC_MODIFY_REG32(&__core_if->core_global_regs->gpwrdn, \
++		0, gpwrdn.d32); \
++} while (0)
++
++/**
++ * Common interrupt handler.
++ *
++ * The common interrupts are those that occur in both Host and Device mode.
++ * This handler handles the following interrupts:
++ * - Mode Mismatch Interrupt
++ * - Disconnect Interrupt
++ * - OTG Interrupt
++ * - Connector ID Status Change Interrupt
++ * - Session Request Interrupt.
++ * - Resume / Remote Wakeup Detected Interrupt.
++ * - LPM Transaction Received Interrupt
++ * - ADP Transaction Received Interrupt
++ *
++ */
++int32_t dwc_otg_handle_common_intr(void *dev)
++{
++	int retval = 0;
++	gintsts_data_t gintsts;
++	gintmsk_data_t gintmsk_reenable = { .d32 = 0 };
++	gpwrdn_data_t gpwrdn = {.d32 = 0 };
++	dwc_otg_device_t *otg_dev = dev;
++	dwc_otg_core_if_t *core_if = otg_dev->core_if;
++	gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++	if (dwc_otg_is_device_mode(core_if))
++		core_if->frame_num = dwc_otg_get_frame_number(core_if);
++
++	if (core_if->lock)
++		DWC_SPINLOCK(core_if->lock);
++
++	if (core_if->power_down == 3 && core_if->xhib == 1) {
++		DWC_DEBUGPL(DBG_ANY, "Exiting from xHIB state\n");
++		retval |= dwc_otg_handle_xhib_exit_intr(core_if);
++		core_if->xhib = 2;
++		if (core_if->lock)
++			DWC_SPINUNLOCK(core_if->lock);
++
++		return retval;
++	}
++
++	if (core_if->hibernation_suspend <= 0) {
++		/* read_common will have to poke the FIQ's saved mask. We must then clear this mask at the end
++		 * of this handler - god only knows why it's done like this
++		 */
++		gintsts.d32 = dwc_otg_read_common_intr(core_if, &gintmsk_reenable, otg_dev->hcd);
++
++		if (gintsts.b.modemismatch) {
++			retval |= dwc_otg_handle_mode_mismatch_intr(core_if);
++		}
++		if (gintsts.b.otgintr) {
++			retval |= dwc_otg_handle_otg_intr(core_if);
++		}
++		if (gintsts.b.conidstschng) {
++			retval |=
++			    dwc_otg_handle_conn_id_status_change_intr(core_if);
++		}
++		if (gintsts.b.disconnect) {
++			retval |= dwc_otg_handle_disconnect_intr(core_if);
++		}
++		if (gintsts.b.sessreqintr) {
++			retval |= dwc_otg_handle_session_req_intr(core_if);
++		}
++		if (gintsts.b.wkupintr) {
++			retval |= dwc_otg_handle_wakeup_detected_intr(core_if);
++		}
++		if (gintsts.b.usbsuspend) {
++			retval |= dwc_otg_handle_usb_suspend_intr(core_if);
++		}
++#ifdef CONFIG_USB_DWC_OTG_LPM
++		if (gintsts.b.lpmtranrcvd) {
++			retval |= dwc_otg_handle_lpm_intr(core_if);
++		}
++#endif
++		if (gintsts.b.restoredone) {
++			gintsts.d32 = 0;
++	                if (core_if->power_down == 2)
++				core_if->hibernation_suspend = -1;
++			else if (core_if->power_down == 3 && core_if->xhib == 2) {
++				gpwrdn_data_t gpwrdn = {.d32 = 0 };
++				pcgcctl_data_t pcgcctl = {.d32 = 0 };
++				dctl_data_t dctl = {.d32 = 0 };
++
++				DWC_WRITE_REG32(&core_if->core_global_regs->
++						gintsts, 0xFFFFFFFF);
++
++				DWC_DEBUGPL(DBG_ANY,
++					    "RESTORE DONE generated\n");
++
++				gpwrdn.b.restore = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++				dwc_udelay(10);
++
++				pcgcctl.b.rstpdwnmodule = 1;
++				DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
++
++				DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, core_if->gr_backup->gusbcfg_local);
++				DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg, core_if->dr_backup->dcfg);
++				DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl, core_if->dr_backup->dctl);
++				dwc_udelay(50);
++
++				dctl.b.pwronprgdone = 1;
++				DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0, dctl.d32);
++				dwc_udelay(10);
++
++				dwc_otg_restore_global_regs(core_if);
++				dwc_otg_restore_dev_regs(core_if, 0);
++
++				dctl.d32 = 0;
++				dctl.b.pwronprgdone = 1;
++				DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32, 0);
++				dwc_udelay(10);
++
++				pcgcctl.d32 = 0;
++				pcgcctl.b.enbl_extnd_hiber = 1;
++				DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
++
++				/* The core will be in ON STATE */
++				core_if->lx_state = DWC_OTG_L0;
++				core_if->xhib = 0;
++
++				DWC_SPINUNLOCK(core_if->lock);
++				if (core_if->pcd_cb && core_if->pcd_cb->resume_wakeup) {
++					core_if->pcd_cb->resume_wakeup(core_if->pcd_cb->p);
++				}
++				DWC_SPINLOCK(core_if->lock);
++
++			}
++
++			gintsts.b.restoredone = 1;
++			DWC_WRITE_REG32(&core_if->core_global_regs->gintsts,gintsts.d32);
++			DWC_PRINTF(" --Restore done interrupt received-- \n");
++			retval |= 1;
++		}
++		if (gintsts.b.portintr && dwc_otg_is_device_mode(core_if)) {
++			/* The port interrupt occurs while in device mode with HPRT0
++			 * Port Enable/Disable.
++			 */
++			gintsts.d32 = 0;
++			gintsts.b.portintr = 1;
++			DWC_WRITE_REG32(&core_if->core_global_regs->gintsts,gintsts.d32);
++			retval |= 1;
++			gintmsk_reenable.b.portintr = 1;
++
++		}
++		/* Did we actually handle anything? if so, unmask the interrupt */
++//		fiq_print(FIQDBG_INT, otg_dev->hcd->fiq_state, "CILOUT %1d", retval);
++//		fiq_print(FIQDBG_INT, otg_dev->hcd->fiq_state, "%08x", gintsts.d32);
++//		fiq_print(FIQDBG_INT, otg_dev->hcd->fiq_state, "%08x", gintmsk_reenable.d32);
++		if (retval && fiq_enable) {
++			DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, gintmsk_reenable.d32);
++		}
++
++	} else {
++		DWC_DEBUGPL(DBG_ANY, "gpwrdn=%08x\n", gpwrdn.d32);
++
++		if (gpwrdn.b.disconn_det && gpwrdn.b.disconn_det_msk) {
++			CLEAR_GPWRDN_INTR(core_if, disconn_det);
++			if (gpwrdn.b.linestate == 0) {
++				dwc_otg_handle_pwrdn_disconnect_intr(core_if);
++			} else {
++				DWC_PRINTF("Disconnect detected while linestate is not 0\n");
++			}
++
++			retval |= 1;
++		}
++		if (gpwrdn.b.lnstschng && gpwrdn.b.lnstchng_msk) {
++			CLEAR_GPWRDN_INTR(core_if, lnstschng);
++			/* remote wakeup from hibernation */
++			if (gpwrdn.b.linestate == 2 || gpwrdn.b.linestate == 1) {
++				dwc_otg_handle_pwrdn_wakeup_detected_intr(core_if);
++			} else {
++				DWC_PRINTF("gpwrdn.linestate = %d\n", gpwrdn.b.linestate);
++			}
++			retval |= 1;
++		}
++		if (gpwrdn.b.rst_det && gpwrdn.b.rst_det_msk) {
++			CLEAR_GPWRDN_INTR(core_if, rst_det);
++			if (gpwrdn.b.linestate == 0) {
++				DWC_PRINTF("Reset detected\n");
++				retval |= dwc_otg_device_hibernation_restore(core_if, 0, 1);
++			}
++		}
++		if (gpwrdn.b.srp_det && gpwrdn.b.srp_det_msk) {
++			CLEAR_GPWRDN_INTR(core_if, srp_det);
++			dwc_otg_handle_pwrdn_srp_intr(core_if);
++			retval |= 1;
++		}
++	}
++	/* Handle ADP interrupt here */
++	if (gpwrdn.b.adp_int) {
++		DWC_PRINTF("ADP interrupt\n");
++		CLEAR_GPWRDN_INTR(core_if, adp_int);
++		dwc_otg_adp_handle_intr(core_if);
++		retval |= 1;
++	}
++	if (gpwrdn.b.sts_chngint && gpwrdn.b.sts_chngint_msk) {
++		DWC_PRINTF("STS CHNG interrupt asserted\n");
++		CLEAR_GPWRDN_INTR(core_if, sts_chngint);
++		dwc_otg_handle_pwrdn_stschng_intr(otg_dev);
++
++		retval |= 1;
++	}
++	if (core_if->lock)
++		DWC_SPINUNLOCK(core_if->lock);
++	return retval;
++}
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_core_if.h
+@@ -0,0 +1,705 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_core_if.h $
++ * $Revision: #13 $
++ * $Date: 2012/08/10 $
++ * $Change: 2047372 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++#if !defined(__DWC_CORE_IF_H__)
++#define __DWC_CORE_IF_H__
++
++#include "dwc_os.h"
++
++/** @file
++ * This file defines DWC_OTG Core API
++ */
++
++struct dwc_otg_core_if;
++typedef struct dwc_otg_core_if dwc_otg_core_if_t;
++
++/** Maximum number of Periodic FIFOs */
++#define MAX_PERIO_FIFOS 15
++/** Maximum number of Periodic FIFOs */
++#define MAX_TX_FIFOS 15
++
++/** Maximum number of Endpoints/HostChannels */
++#define MAX_EPS_CHANNELS 16
++
++extern dwc_otg_core_if_t *dwc_otg_cil_init(const uint32_t * _reg_base_addr);
++extern void dwc_otg_core_init(dwc_otg_core_if_t * _core_if);
++extern void dwc_otg_cil_remove(dwc_otg_core_if_t * _core_if);
++
++extern void dwc_otg_enable_global_interrupts(dwc_otg_core_if_t * _core_if);
++extern void dwc_otg_disable_global_interrupts(dwc_otg_core_if_t * _core_if);
++
++extern uint8_t dwc_otg_is_device_mode(dwc_otg_core_if_t * _core_if);
++extern uint8_t dwc_otg_is_host_mode(dwc_otg_core_if_t * _core_if);
++
++extern uint8_t dwc_otg_is_dma_enable(dwc_otg_core_if_t * core_if);
++
++/** This function should be called on every hardware interrupt. */
++extern int32_t dwc_otg_handle_common_intr(void *otg_dev);
++
++/** @name OTG Core Parameters */
++/** @{ */
++
++/**
++ * Specifies the OTG capabilities. The driver will automatically
++ * detect the value for this parameter if none is specified.
++ * 0 - HNP and SRP capable (default)
++ * 1 - SRP Only capable
++ * 2 - No HNP/SRP capable
++ */
++extern int dwc_otg_set_param_otg_cap(dwc_otg_core_if_t * core_if, int32_t val);
++extern int32_t dwc_otg_get_param_otg_cap(dwc_otg_core_if_t * core_if);
++#define DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE 0
++#define DWC_OTG_CAP_PARAM_SRP_ONLY_CAPABLE 1
++#define DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE 2
++#define dwc_param_otg_cap_default DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE
++
++extern int dwc_otg_set_param_opt(dwc_otg_core_if_t * core_if, int32_t val);
++extern int32_t dwc_otg_get_param_opt(dwc_otg_core_if_t * core_if);
++#define dwc_param_opt_default 1
++
++/**
++ * Specifies whether to use slave or DMA mode for accessing the data
++ * FIFOs. The driver will automatically detect the value for this
++ * parameter if none is specified.
++ * 0 - Slave
++ * 1 - DMA (default, if available)
++ */
++extern int dwc_otg_set_param_dma_enable(dwc_otg_core_if_t * core_if,
++					int32_t val);
++extern int32_t dwc_otg_get_param_dma_enable(dwc_otg_core_if_t * core_if);
++#define dwc_param_dma_enable_default 1
++
++/**
++ * When DMA mode is enabled specifies whether to use
++ * address DMA or DMA Descritor mode for accessing the data
++ * FIFOs in device mode. The driver will automatically detect
++ * the value for this parameter if none is specified.
++ * 0 - address DMA
++ * 1 - DMA Descriptor(default, if available)
++ */
++extern int dwc_otg_set_param_dma_desc_enable(dwc_otg_core_if_t * core_if,
++					     int32_t val);
++extern int32_t dwc_otg_get_param_dma_desc_enable(dwc_otg_core_if_t * core_if);
++//#define dwc_param_dma_desc_enable_default 1
++#define dwc_param_dma_desc_enable_default 0 // Broadcom BCM2708
++
++/** The DMA Burst size (applicable only for External DMA
++ * Mode). 1, 4, 8 16, 32, 64, 128, 256 (default 32)
++ */
++extern int dwc_otg_set_param_dma_burst_size(dwc_otg_core_if_t * core_if,
++					    int32_t val);
++extern int32_t dwc_otg_get_param_dma_burst_size(dwc_otg_core_if_t * core_if);
++#define dwc_param_dma_burst_size_default 32
++
++/**
++ * Specifies the maximum speed of operation in host and device mode.
++ * The actual speed depends on the speed of the attached device and
++ * the value of phy_type. The actual speed depends on the speed of the
++ * attached device.
++ * 0 - High Speed (default)
++ * 1 - Full Speed
++ */
++extern int dwc_otg_set_param_speed(dwc_otg_core_if_t * core_if, int32_t val);
++extern int32_t dwc_otg_get_param_speed(dwc_otg_core_if_t * core_if);
++#define dwc_param_speed_default 0
++#define DWC_SPEED_PARAM_HIGH 0
++#define DWC_SPEED_PARAM_FULL 1
++
++/** Specifies whether low power mode is supported when attached
++ *	to a Full Speed or Low Speed device in host mode.
++ * 0 - Don't support low power mode (default)
++ * 1 - Support low power mode
++ */
++extern int dwc_otg_set_param_host_support_fs_ls_low_power(dwc_otg_core_if_t *
++							  core_if, int32_t val);
++extern int32_t dwc_otg_get_param_host_support_fs_ls_low_power(dwc_otg_core_if_t
++							      * core_if);
++#define dwc_param_host_support_fs_ls_low_power_default 0
++
++/** Specifies the PHY clock rate in low power mode when connected to a
++ * Low Speed device in host mode. This parameter is applicable only if
++ * HOST_SUPPORT_FS_LS_LOW_POWER is enabled. If PHY_TYPE is set to FS
++ * then defaults to 6 MHZ otherwise 48 MHZ.
++ *
++ * 0 - 48 MHz
++ * 1 - 6 MHz
++ */
++extern int dwc_otg_set_param_host_ls_low_power_phy_clk(dwc_otg_core_if_t *
++						       core_if, int32_t val);
++extern int32_t dwc_otg_get_param_host_ls_low_power_phy_clk(dwc_otg_core_if_t *
++							   core_if);
++#define dwc_param_host_ls_low_power_phy_clk_default 0
++#define DWC_HOST_LS_LOW_POWER_PHY_CLK_PARAM_48MHZ 0
++#define DWC_HOST_LS_LOW_POWER_PHY_CLK_PARAM_6MHZ 1
++
++/**
++ * 0 - Use cC FIFO size parameters
++ * 1 - Allow dynamic FIFO sizing (default)
++ */
++extern int dwc_otg_set_param_enable_dynamic_fifo(dwc_otg_core_if_t * core_if,
++						 int32_t val);
++extern int32_t dwc_otg_get_param_enable_dynamic_fifo(dwc_otg_core_if_t *
++						     core_if);
++#define dwc_param_enable_dynamic_fifo_default 1
++
++/** Total number of 4-byte words in the data FIFO memory. This
++ * memory includes the Rx FIFO, non-periodic Tx FIFO, and periodic
++ * Tx FIFOs.
++ * 32 to 32768 (default 8192)
++ * Note: The total FIFO memory depth in the FPGA configuration is 8192.
++ */
++extern int dwc_otg_set_param_data_fifo_size(dwc_otg_core_if_t * core_if,
++					    int32_t val);
++extern int32_t dwc_otg_get_param_data_fifo_size(dwc_otg_core_if_t * core_if);
++//#define dwc_param_data_fifo_size_default 8192
++#define dwc_param_data_fifo_size_default 0xFF0 // Broadcom BCM2708
++
++/** Number of 4-byte words in the Rx FIFO in device mode when dynamic
++ * FIFO sizing is enabled.
++ * 16 to 32768 (default 1064)
++ */
++extern int dwc_otg_set_param_dev_rx_fifo_size(dwc_otg_core_if_t * core_if,
++					      int32_t val);
++extern int32_t dwc_otg_get_param_dev_rx_fifo_size(dwc_otg_core_if_t * core_if);
++#define dwc_param_dev_rx_fifo_size_default 1064
++
++/** Number of 4-byte words in the non-periodic Tx FIFO in device mode
++ * when dynamic FIFO sizing is enabled.
++ * 16 to 32768 (default 1024)
++ */
++extern int dwc_otg_set_param_dev_nperio_tx_fifo_size(dwc_otg_core_if_t *
++						     core_if, int32_t val);
++extern int32_t dwc_otg_get_param_dev_nperio_tx_fifo_size(dwc_otg_core_if_t *
++							 core_if);
++#define dwc_param_dev_nperio_tx_fifo_size_default 1024
++
++/** Number of 4-byte words in each of the periodic Tx FIFOs in device
++ * mode when dynamic FIFO sizing is enabled.
++ * 4 to 768 (default 256)
++ */
++extern int dwc_otg_set_param_dev_perio_tx_fifo_size(dwc_otg_core_if_t * core_if,
++						    int32_t val, int fifo_num);
++extern int32_t dwc_otg_get_param_dev_perio_tx_fifo_size(dwc_otg_core_if_t *
++							core_if, int fifo_num);
++#define dwc_param_dev_perio_tx_fifo_size_default 256
++
++/** Number of 4-byte words in the Rx FIFO in host mode when dynamic
++ * FIFO sizing is enabled.
++ * 16 to 32768 (default 1024)
++ */
++extern int dwc_otg_set_param_host_rx_fifo_size(dwc_otg_core_if_t * core_if,
++					       int32_t val);
++extern int32_t dwc_otg_get_param_host_rx_fifo_size(dwc_otg_core_if_t * core_if);
++//#define dwc_param_host_rx_fifo_size_default 1024
++#define dwc_param_host_rx_fifo_size_default 774 // Broadcom BCM2708
++
++/** Number of 4-byte words in the non-periodic Tx FIFO in host mode
++ * when Dynamic FIFO sizing is enabled in the core.
++ * 16 to 32768 (default 1024)
++ */
++extern int dwc_otg_set_param_host_nperio_tx_fifo_size(dwc_otg_core_if_t *
++						      core_if, int32_t val);
++extern int32_t dwc_otg_get_param_host_nperio_tx_fifo_size(dwc_otg_core_if_t *
++							  core_if);
++//#define dwc_param_host_nperio_tx_fifo_size_default 1024
++#define dwc_param_host_nperio_tx_fifo_size_default 0x100 // Broadcom BCM2708
++
++/** Number of 4-byte words in the host periodic Tx FIFO when dynamic
++ * FIFO sizing is enabled.
++ * 16 to 32768 (default 1024)
++ */
++extern int dwc_otg_set_param_host_perio_tx_fifo_size(dwc_otg_core_if_t *
++						     core_if, int32_t val);
++extern int32_t dwc_otg_get_param_host_perio_tx_fifo_size(dwc_otg_core_if_t *
++							 core_if);
++//#define dwc_param_host_perio_tx_fifo_size_default 1024
++#define dwc_param_host_perio_tx_fifo_size_default 0x200 // Broadcom BCM2708
++
++/** The maximum transfer size supported in bytes.
++ * 2047 to 65,535  (default 65,535)
++ */
++extern int dwc_otg_set_param_max_transfer_size(dwc_otg_core_if_t * core_if,
++					       int32_t val);
++extern int32_t dwc_otg_get_param_max_transfer_size(dwc_otg_core_if_t * core_if);
++#define dwc_param_max_transfer_size_default 65535
++
++/** The maximum number of packets in a transfer.
++ * 15 to 511  (default 511)
++ */
++extern int dwc_otg_set_param_max_packet_count(dwc_otg_core_if_t * core_if,
++					      int32_t val);
++extern int32_t dwc_otg_get_param_max_packet_count(dwc_otg_core_if_t * core_if);
++#define dwc_param_max_packet_count_default 511
++
++/** The number of host channel registers to use.
++ * 1 to 16 (default 12)
++ * Note: The FPGA configuration supports a maximum of 12 host channels.
++ */
++extern int dwc_otg_set_param_host_channels(dwc_otg_core_if_t * core_if,
++					   int32_t val);
++extern int32_t dwc_otg_get_param_host_channels(dwc_otg_core_if_t * core_if);
++//#define dwc_param_host_channels_default 12
++#define dwc_param_host_channels_default 8 // Broadcom BCM2708
++
++/** The number of endpoints in addition to EP0 available for device
++ * mode operations.
++ * 1 to 15 (default 6 IN and OUT)
++ * Note: The FPGA configuration supports a maximum of 6 IN and OUT
++ * endpoints in addition to EP0.
++ */
++extern int dwc_otg_set_param_dev_endpoints(dwc_otg_core_if_t * core_if,
++					   int32_t val);
++extern int32_t dwc_otg_get_param_dev_endpoints(dwc_otg_core_if_t * core_if);
++#define dwc_param_dev_endpoints_default 6
++
++/**
++ * Specifies the type of PHY interface to use. By default, the driver
++ * will automatically detect the phy_type.
++ *
++ * 0 - Full Speed PHY
++ * 1 - UTMI+ (default)
++ * 2 - ULPI
++ */
++extern int dwc_otg_set_param_phy_type(dwc_otg_core_if_t * core_if, int32_t val);
++extern int32_t dwc_otg_get_param_phy_type(dwc_otg_core_if_t * core_if);
++#define DWC_PHY_TYPE_PARAM_FS 0
++#define DWC_PHY_TYPE_PARAM_UTMI 1
++#define DWC_PHY_TYPE_PARAM_ULPI 2
++#define dwc_param_phy_type_default DWC_PHY_TYPE_PARAM_UTMI
++
++/**
++ * Specifies the UTMI+ Data Width. This parameter is
++ * applicable for a PHY_TYPE of UTMI+ or ULPI. (For a ULPI
++ * PHY_TYPE, this parameter indicates the data width between
++ * the MAC and the ULPI Wrapper.) Also, this parameter is
++ * applicable only if the OTG_HSPHY_WIDTH cC parameter was set
++ * to "8 and 16 bits", meaning that the core has been
++ * configured to work at either data path width.
++ *
++ * 8 or 16 bits (default 16)
++ */
++extern int dwc_otg_set_param_phy_utmi_width(dwc_otg_core_if_t * core_if,
++					    int32_t val);
++extern int32_t dwc_otg_get_param_phy_utmi_width(dwc_otg_core_if_t * core_if);
++//#define dwc_param_phy_utmi_width_default 16
++#define dwc_param_phy_utmi_width_default 8 // Broadcom BCM2708
++
++/**
++ * Specifies whether the ULPI operates at double or single
++ * data rate. This parameter is only applicable if PHY_TYPE is
++ * ULPI.
++ *
++ * 0 - single data rate ULPI interface with 8 bit wide data
++ * bus (default)
++ * 1 - double data rate ULPI interface with 4 bit wide data
++ * bus
++ */
++extern int dwc_otg_set_param_phy_ulpi_ddr(dwc_otg_core_if_t * core_if,
++					  int32_t val);
++extern int32_t dwc_otg_get_param_phy_ulpi_ddr(dwc_otg_core_if_t * core_if);
++#define dwc_param_phy_ulpi_ddr_default 0
++
++/**
++ * Specifies whether to use the internal or external supply to
++ * drive the vbus with a ULPI phy.
++ */
++extern int dwc_otg_set_param_phy_ulpi_ext_vbus(dwc_otg_core_if_t * core_if,
++					       int32_t val);
++extern int32_t dwc_otg_get_param_phy_ulpi_ext_vbus(dwc_otg_core_if_t * core_if);
++#define DWC_PHY_ULPI_INTERNAL_VBUS 0
++#define DWC_PHY_ULPI_EXTERNAL_VBUS 1
++#define dwc_param_phy_ulpi_ext_vbus_default DWC_PHY_ULPI_INTERNAL_VBUS
++
++/**
++ * Specifies whether to use the I2Cinterface for full speed PHY. This
++ * parameter is only applicable if PHY_TYPE is FS.
++ * 0 - No (default)
++ * 1 - Yes
++ */
++extern int dwc_otg_set_param_i2c_enable(dwc_otg_core_if_t * core_if,
++					int32_t val);
++extern int32_t dwc_otg_get_param_i2c_enable(dwc_otg_core_if_t * core_if);
++#define dwc_param_i2c_enable_default 0
++
++extern int dwc_otg_set_param_ulpi_fs_ls(dwc_otg_core_if_t * core_if,
++					int32_t val);
++extern int32_t dwc_otg_get_param_ulpi_fs_ls(dwc_otg_core_if_t * core_if);
++#define dwc_param_ulpi_fs_ls_default 0
++
++extern int dwc_otg_set_param_ts_dline(dwc_otg_core_if_t * core_if, int32_t val);
++extern int32_t dwc_otg_get_param_ts_dline(dwc_otg_core_if_t * core_if);
++#define dwc_param_ts_dline_default 0
++
++/**
++ * Specifies whether dedicated transmit FIFOs are
++ * enabled for non periodic IN endpoints in device mode
++ * 0 - No
++ * 1 - Yes
++ */
++extern int dwc_otg_set_param_en_multiple_tx_fifo(dwc_otg_core_if_t * core_if,
++						 int32_t val);
++extern int32_t dwc_otg_get_param_en_multiple_tx_fifo(dwc_otg_core_if_t *
++						     core_if);
++#define dwc_param_en_multiple_tx_fifo_default 1
++
++/** Number of 4-byte words in each of the Tx FIFOs in device
++ * mode when dynamic FIFO sizing is enabled.
++ * 4 to 768 (default 256)
++ */
++extern int dwc_otg_set_param_dev_tx_fifo_size(dwc_otg_core_if_t * core_if,
++					      int fifo_num, int32_t val);
++extern int32_t dwc_otg_get_param_dev_tx_fifo_size(dwc_otg_core_if_t * core_if,
++						  int fifo_num);
++#define dwc_param_dev_tx_fifo_size_default 768
++
++/** Thresholding enable flag-
++ * bit 0 - enable non-ISO Tx thresholding
++ * bit 1 - enable ISO Tx thresholding
++ * bit 2 - enable Rx thresholding
++ */
++extern int dwc_otg_set_param_thr_ctl(dwc_otg_core_if_t * core_if, int32_t val);
++extern int32_t dwc_otg_get_thr_ctl(dwc_otg_core_if_t * core_if, int fifo_num);
++#define dwc_param_thr_ctl_default 0
++
++/** Thresholding length for Tx
++ * FIFOs in 32 bit DWORDs
++ */
++extern int dwc_otg_set_param_tx_thr_length(dwc_otg_core_if_t * core_if,
++					   int32_t val);
++extern int32_t dwc_otg_get_tx_thr_length(dwc_otg_core_if_t * core_if);
++#define dwc_param_tx_thr_length_default 64
++
++/** Thresholding length for Rx
++ *	FIFOs in 32 bit DWORDs
++ */
++extern int dwc_otg_set_param_rx_thr_length(dwc_otg_core_if_t * core_if,
++					   int32_t val);
++extern int32_t dwc_otg_get_rx_thr_length(dwc_otg_core_if_t * core_if);
++#define dwc_param_rx_thr_length_default 64
++
++/**
++ * Specifies whether LPM (Link Power Management) support is enabled
++ */
++extern int dwc_otg_set_param_lpm_enable(dwc_otg_core_if_t * core_if,
++					int32_t val);
++extern int32_t dwc_otg_get_param_lpm_enable(dwc_otg_core_if_t * core_if);
++#define dwc_param_lpm_enable_default 1
++
++/**
++ * Specifies whether PTI enhancement is enabled
++ */
++extern int dwc_otg_set_param_pti_enable(dwc_otg_core_if_t * core_if,
++					int32_t val);
++extern int32_t dwc_otg_get_param_pti_enable(dwc_otg_core_if_t * core_if);
++#define dwc_param_pti_enable_default 0
++
++/**
++ * Specifies whether MPI enhancement is enabled
++ */
++extern int dwc_otg_set_param_mpi_enable(dwc_otg_core_if_t * core_if,
++					int32_t val);
++extern int32_t dwc_otg_get_param_mpi_enable(dwc_otg_core_if_t * core_if);
++#define dwc_param_mpi_enable_default 0
++
++/**
++ * Specifies whether ADP capability is enabled
++ */
++extern int dwc_otg_set_param_adp_enable(dwc_otg_core_if_t * core_if,
++					int32_t val);
++extern int32_t dwc_otg_get_param_adp_enable(dwc_otg_core_if_t * core_if);
++#define dwc_param_adp_enable_default 0
++
++/**
++ * Specifies whether IC_USB capability is enabled
++ */
++
++extern int dwc_otg_set_param_ic_usb_cap(dwc_otg_core_if_t * core_if,
++					int32_t val);
++extern int32_t dwc_otg_get_param_ic_usb_cap(dwc_otg_core_if_t * core_if);
++#define dwc_param_ic_usb_cap_default 0
++
++extern int dwc_otg_set_param_ahb_thr_ratio(dwc_otg_core_if_t * core_if,
++					   int32_t val);
++extern int32_t dwc_otg_get_param_ahb_thr_ratio(dwc_otg_core_if_t * core_if);
++#define dwc_param_ahb_thr_ratio_default 0
++
++extern int dwc_otg_set_param_power_down(dwc_otg_core_if_t * core_if,
++					int32_t val);
++extern int32_t dwc_otg_get_param_power_down(dwc_otg_core_if_t * core_if);
++#define dwc_param_power_down_default 0
++
++extern int dwc_otg_set_param_reload_ctl(dwc_otg_core_if_t * core_if,
++					int32_t val);
++extern int32_t dwc_otg_get_param_reload_ctl(dwc_otg_core_if_t * core_if);
++#define dwc_param_reload_ctl_default 0
++
++extern int dwc_otg_set_param_dev_out_nak(dwc_otg_core_if_t * core_if,
++										int32_t val);
++extern int32_t dwc_otg_get_param_dev_out_nak(dwc_otg_core_if_t * core_if);
++#define dwc_param_dev_out_nak_default 0
++
++extern int dwc_otg_set_param_cont_on_bna(dwc_otg_core_if_t * core_if,
++										 int32_t val);
++extern int32_t dwc_otg_get_param_cont_on_bna(dwc_otg_core_if_t * core_if);
++#define dwc_param_cont_on_bna_default 0
++
++extern int dwc_otg_set_param_ahb_single(dwc_otg_core_if_t * core_if,
++										 int32_t val);
++extern int32_t dwc_otg_get_param_ahb_single(dwc_otg_core_if_t * core_if);
++#define dwc_param_ahb_single_default 0
++
++extern int dwc_otg_set_param_otg_ver(dwc_otg_core_if_t * core_if, int32_t val);
++extern int32_t dwc_otg_get_param_otg_ver(dwc_otg_core_if_t * core_if);
++#define dwc_param_otg_ver_default 0
++
++/** @} */
++
++/** @name Access to registers and bit-fields */
++
++/**
++ * Dump core registers and SPRAM
++ */
++extern void dwc_otg_dump_dev_registers(dwc_otg_core_if_t * _core_if);
++extern void dwc_otg_dump_spram(dwc_otg_core_if_t * _core_if);
++extern void dwc_otg_dump_host_registers(dwc_otg_core_if_t * _core_if);
++extern void dwc_otg_dump_global_registers(dwc_otg_core_if_t * _core_if);
++
++/**
++ * Get host negotiation status.
++ */
++extern uint32_t dwc_otg_get_hnpstatus(dwc_otg_core_if_t * core_if);
++
++/**
++ * Get srp status
++ */
++extern uint32_t dwc_otg_get_srpstatus(dwc_otg_core_if_t * core_if);
++
++/**
++ * Set hnpreq bit in the GOTGCTL register.
++ */
++extern void dwc_otg_set_hnpreq(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * Get Content of SNPSID register.
++ */
++extern uint32_t dwc_otg_get_gsnpsid(dwc_otg_core_if_t * core_if);
++
++/**
++ * Get current mode.
++ * Returns 0 if in device mode, and 1 if in host mode.
++ */
++extern uint32_t dwc_otg_get_mode(dwc_otg_core_if_t * core_if);
++
++/**
++ * Get value of hnpcapable field in the GUSBCFG register
++ */
++extern uint32_t dwc_otg_get_hnpcapable(dwc_otg_core_if_t * core_if);
++/**
++ * Set value of hnpcapable field in the GUSBCFG register
++ */
++extern void dwc_otg_set_hnpcapable(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * Get value of srpcapable field in the GUSBCFG register
++ */
++extern uint32_t dwc_otg_get_srpcapable(dwc_otg_core_if_t * core_if);
++/**
++ * Set value of srpcapable field in the GUSBCFG register
++ */
++extern void dwc_otg_set_srpcapable(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * Get value of devspeed field in the DCFG register
++ */
++extern uint32_t dwc_otg_get_devspeed(dwc_otg_core_if_t * core_if);
++/**
++ * Set value of devspeed field in the DCFG register
++ */
++extern void dwc_otg_set_devspeed(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * Get the value of busconnected field from the HPRT0 register
++ */
++extern uint32_t dwc_otg_get_busconnected(dwc_otg_core_if_t * core_if);
++
++/**
++ * Gets the device enumeration Speed.
++ */
++extern uint32_t dwc_otg_get_enumspeed(dwc_otg_core_if_t * core_if);
++
++/**
++ * Get value of prtpwr field from the HPRT0 register
++ */
++extern uint32_t dwc_otg_get_prtpower(dwc_otg_core_if_t * core_if);
++
++/**
++ * Get value of flag indicating core state - hibernated or not
++ */
++extern uint32_t dwc_otg_get_core_state(dwc_otg_core_if_t * core_if);
++
++/**
++ * Set value of prtpwr field from the HPRT0 register
++ */
++extern void dwc_otg_set_prtpower(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * Get value of prtsusp field from the HPRT0 regsiter
++ */
++extern uint32_t dwc_otg_get_prtsuspend(dwc_otg_core_if_t * core_if);
++/**
++ * Set value of prtpwr field from the HPRT0 register
++ */
++extern void dwc_otg_set_prtsuspend(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * Get value of ModeChTimEn field from the HCFG regsiter
++ */
++extern uint32_t dwc_otg_get_mode_ch_tim(dwc_otg_core_if_t * core_if);
++/**
++ * Set value of ModeChTimEn field from the HCFG regsiter
++ */
++extern void dwc_otg_set_mode_ch_tim(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * Get value of Fram Interval field from the HFIR regsiter
++ */
++extern uint32_t dwc_otg_get_fr_interval(dwc_otg_core_if_t * core_if);
++/**
++ * Set value of Frame Interval field from the HFIR regsiter
++ */
++extern void dwc_otg_set_fr_interval(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * Set value of prtres field from the HPRT0 register
++ *FIXME Remove?
++ */
++extern void dwc_otg_set_prtresume(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * Get value of rmtwkupsig bit in DCTL register
++ */
++extern uint32_t dwc_otg_get_remotewakesig(dwc_otg_core_if_t * core_if);
++
++/**
++ * Get value of prt_sleep_sts field from the GLPMCFG register
++ */
++extern uint32_t dwc_otg_get_lpm_portsleepstatus(dwc_otg_core_if_t * core_if);
++
++/**
++ * Get value of rem_wkup_en field from the GLPMCFG register
++ */
++extern uint32_t dwc_otg_get_lpm_remotewakeenabled(dwc_otg_core_if_t * core_if);
++
++/**
++ * Get value of appl_resp field from the GLPMCFG register
++ */
++extern uint32_t dwc_otg_get_lpmresponse(dwc_otg_core_if_t * core_if);
++/**
++ * Set value of appl_resp field from the GLPMCFG register
++ */
++extern void dwc_otg_set_lpmresponse(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * Get value of hsic_connect field from the GLPMCFG register
++ */
++extern uint32_t dwc_otg_get_hsic_connect(dwc_otg_core_if_t * core_if);
++/**
++ * Set value of hsic_connect field from the GLPMCFG register
++ */
++extern void dwc_otg_set_hsic_connect(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * Get value of inv_sel_hsic field from the GLPMCFG register.
++ */
++extern uint32_t dwc_otg_get_inv_sel_hsic(dwc_otg_core_if_t * core_if);
++/**
++ * Set value of inv_sel_hsic field from the GLPMFG register.
++ */
++extern void dwc_otg_set_inv_sel_hsic(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/*
++ * Some functions for accessing registers
++ */
++
++/**
++ *  GOTGCTL register
++ */
++extern uint32_t dwc_otg_get_gotgctl(dwc_otg_core_if_t * core_if);
++extern void dwc_otg_set_gotgctl(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * GUSBCFG register
++ */
++extern uint32_t dwc_otg_get_gusbcfg(dwc_otg_core_if_t * core_if);
++extern void dwc_otg_set_gusbcfg(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * GRXFSIZ register
++ */
++extern uint32_t dwc_otg_get_grxfsiz(dwc_otg_core_if_t * core_if);
++extern void dwc_otg_set_grxfsiz(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * GNPTXFSIZ register
++ */
++extern uint32_t dwc_otg_get_gnptxfsiz(dwc_otg_core_if_t * core_if);
++extern void dwc_otg_set_gnptxfsiz(dwc_otg_core_if_t * core_if, uint32_t val);
++
++extern uint32_t dwc_otg_get_gpvndctl(dwc_otg_core_if_t * core_if);
++extern void dwc_otg_set_gpvndctl(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * GGPIO register
++ */
++extern uint32_t dwc_otg_get_ggpio(dwc_otg_core_if_t * core_if);
++extern void dwc_otg_set_ggpio(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * GUID register
++ */
++extern uint32_t dwc_otg_get_guid(dwc_otg_core_if_t * core_if);
++extern void dwc_otg_set_guid(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * HPRT0 register
++ */
++extern uint32_t dwc_otg_get_hprt0(dwc_otg_core_if_t * core_if);
++extern void dwc_otg_set_hprt0(dwc_otg_core_if_t * core_if, uint32_t val);
++
++/**
++ * GHPTXFSIZE
++ */
++extern uint32_t dwc_otg_get_hptxfsiz(dwc_otg_core_if_t * core_if);
++
++/** @} */
++
++#endif				/* __DWC_CORE_IF_H__ */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_dbg.h
+@@ -0,0 +1,117 @@
++/* ==========================================================================
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++#ifndef __DWC_OTG_DBG_H__
++#define __DWC_OTG_DBG_H__
++
++/** @file
++ * This file defines debug levels.
++ * Debugging support vanishes in non-debug builds.
++ */
++
++/**
++ * The Debug Level bit-mask variable.
++ */
++extern uint32_t g_dbg_lvl;
++/**
++ * Set the Debug Level variable.
++ */
++static inline uint32_t SET_DEBUG_LEVEL(const uint32_t new)
++{
++	uint32_t old = g_dbg_lvl;
++	g_dbg_lvl = new;
++	return old;
++}
++
++#define DBG_USER	(0x1)
++/** When debug level has the DBG_CIL bit set, display CIL Debug messages. */
++#define DBG_CIL		(0x2)
++/** When debug level has the DBG_CILV bit set, display CIL Verbose debug
++ * messages */
++#define DBG_CILV	(0x20)
++/**  When debug level has the DBG_PCD bit set, display PCD (Device) debug
++ *  messages */
++#define DBG_PCD		(0x4)
++/** When debug level has the DBG_PCDV set, display PCD (Device) Verbose debug
++ * messages */
++#define DBG_PCDV	(0x40)
++/** When debug level has the DBG_HCD bit set, display Host debug messages */
++#define DBG_HCD		(0x8)
++/** When debug level has the DBG_HCDV bit set, display Verbose Host debug
++ * messages */
++#define DBG_HCDV	(0x80)
++/** When debug level has the DBG_HCD_URB bit set, display enqueued URBs in host
++ *  mode. */
++#define DBG_HCD_URB	(0x800)
++/** When debug level has the DBG_HCDI bit set, display host interrupt
++ *  messages. */
++#define DBG_HCDI	(0x1000)
++
++/** When debug level has any bit set, display debug messages */
++#define DBG_ANY		(0xFF)
++
++/** All debug messages off */
++#define DBG_OFF		0
++
++/** Prefix string for DWC_DEBUG print macros. */
++#define USB_DWC "DWC_otg: "
++
++/**
++ * Print a debug message when the Global debug level variable contains
++ * the bit defined in <code>lvl</code>.
++ *
++ * @param[in] lvl - Debug level, use one of the DBG_ constants above.
++ * @param[in] x - like printf
++ *
++ *    Example:<p>
++ * <code>
++ *      DWC_DEBUGPL( DBG_ANY, "%s(%p)\n", __func__, _reg_base_addr);
++ * </code>
++ * <br>
++ * results in:<br>
++ * <code>
++ * usb-DWC_otg: dwc_otg_cil_init(ca867000)
++ * </code>
++ */
++#ifdef DEBUG
++
++# define DWC_DEBUGPL(lvl, x...) do{ if ((lvl)&g_dbg_lvl)__DWC_DEBUG(USB_DWC x ); }while(0)
++# define DWC_DEBUGP(x...)	DWC_DEBUGPL(DBG_ANY, x )
++
++# define CHK_DEBUG_LEVEL(level) ((level) & g_dbg_lvl)
++
++#else
++
++# define DWC_DEBUGPL(lvl, x...) do{}while(0)
++# define DWC_DEBUGP(x...)
++
++# define CHK_DEBUG_LEVEL(level) (0)
++
++#endif /*DEBUG*/
++#endif
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_driver.c
+@@ -0,0 +1,1725 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_driver.c $
++ * $Revision: #92 $
++ * $Date: 2012/08/10 $
++ * $Change: 2047372 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++/** @file
++ * The dwc_otg_driver module provides the initialization and cleanup entry
++ * points for the DWC_otg driver. This module will be dynamically installed
++ * after Linux is booted using the insmod command. When the module is
++ * installed, the dwc_otg_driver_init function is called. When the module is
++ * removed (using rmmod), the dwc_otg_driver_cleanup function is called.
++ *
++ * This module also defines a data structure for the dwc_otg_driver, which is
++ * used in conjunction with the standard ARM lm_device structure. These
++ * structures allow the OTG driver to comply with the standard Linux driver
++ * model in which devices and drivers are registered with a bus driver. This
++ * has the benefit that Linux can expose attributes of the driver and device
++ * in its special sysfs file system. Users can then read or write files in
++ * this file system to perform diagnostics on the driver components or the
++ * device.
++ */
++
++#include "dwc_otg_os_dep.h"
++#include "dwc_os.h"
++#include "dwc_otg_dbg.h"
++#include "dwc_otg_driver.h"
++#include "dwc_otg_attr.h"
++#include "dwc_otg_core_if.h"
++#include "dwc_otg_pcd_if.h"
++#include "dwc_otg_hcd_if.h"
++#include "dwc_otg_fiq_fsm.h"
++#include "dwc_otg_adp.h"
++
++#define DWC_DRIVER_VERSION	"3.00a 10-AUG-2012"
++#define DWC_DRIVER_DESC		"HS OTG USB Controller driver"
++
++bool microframe_schedule=true;
++
++static const char dwc_driver_name[] = "dwc_otg";
++
++/*-------------------------------------------------------------------------*/
++/* Encapsulate the module parameter settings */
++
++struct dwc_otg_driver_module_params {
++	int32_t opt;
++	int32_t otg_cap;
++	int32_t dma_enable;
++	int32_t dma_desc_enable;
++	int32_t dma_burst_size;
++	int32_t speed;
++	int32_t host_support_fs_ls_low_power;
++	int32_t host_ls_low_power_phy_clk;
++	int32_t enable_dynamic_fifo;
++	int32_t data_fifo_size;
++	int32_t dev_rx_fifo_size;
++	int32_t dev_nperio_tx_fifo_size;
++	uint32_t dev_perio_tx_fifo_size[MAX_PERIO_FIFOS];
++	int32_t host_rx_fifo_size;
++	int32_t host_nperio_tx_fifo_size;
++	int32_t host_perio_tx_fifo_size;
++	int32_t max_transfer_size;
++	int32_t max_packet_count;
++	int32_t host_channels;
++	int32_t dev_endpoints;
++	int32_t phy_type;
++	int32_t phy_utmi_width;
++	int32_t phy_ulpi_ddr;
++	int32_t phy_ulpi_ext_vbus;
++	int32_t i2c_enable;
++	int32_t ulpi_fs_ls;
++	int32_t ts_dline;
++	int32_t en_multiple_tx_fifo;
++	uint32_t dev_tx_fifo_size[MAX_TX_FIFOS];
++	uint32_t thr_ctl;
++	uint32_t tx_thr_length;
++	uint32_t rx_thr_length;
++	int32_t pti_enable;
++	int32_t mpi_enable;
++	int32_t lpm_enable;
++	int32_t ic_usb_cap;
++	int32_t ahb_thr_ratio;
++	int32_t power_down;
++	int32_t reload_ctl;
++	int32_t dev_out_nak;
++	int32_t cont_on_bna;
++	int32_t ahb_single;
++	int32_t otg_ver;
++	int32_t adp_enable;
++};
++
++static struct dwc_otg_driver_module_params dwc_otg_module_params = {
++	.opt = -1,
++	.otg_cap = -1,
++	.dma_enable = -1,
++	.dma_desc_enable = -1,
++	.dma_burst_size = -1,
++	.speed = -1,
++	.host_support_fs_ls_low_power = -1,
++	.host_ls_low_power_phy_clk = -1,
++	.enable_dynamic_fifo = -1,
++	.data_fifo_size = -1,
++	.dev_rx_fifo_size = -1,
++	.dev_nperio_tx_fifo_size = -1,
++	.dev_perio_tx_fifo_size = {
++				   /* dev_perio_tx_fifo_size_1 */
++				   -1,
++				   -1,
++				   -1,
++				   -1,
++				   -1,
++				   -1,
++				   -1,
++				   -1,
++				   -1,
++				   -1,
++				   -1,
++				   -1,
++				   -1,
++				   -1,
++				   -1
++				   /* 15 */
++				   },
++	.host_rx_fifo_size = -1,
++	.host_nperio_tx_fifo_size = -1,
++	.host_perio_tx_fifo_size = -1,
++	.max_transfer_size = -1,
++	.max_packet_count = -1,
++	.host_channels = -1,
++	.dev_endpoints = -1,
++	.phy_type = -1,
++	.phy_utmi_width = -1,
++	.phy_ulpi_ddr = -1,
++	.phy_ulpi_ext_vbus = -1,
++	.i2c_enable = -1,
++	.ulpi_fs_ls = -1,
++	.ts_dline = -1,
++	.en_multiple_tx_fifo = -1,
++	.dev_tx_fifo_size = {
++			     /* dev_tx_fifo_size */
++			     -1,
++			     -1,
++			     -1,
++			     -1,
++			     -1,
++			     -1,
++			     -1,
++			     -1,
++			     -1,
++			     -1,
++			     -1,
++			     -1,
++			     -1,
++			     -1,
++			     -1
++			     /* 15 */
++			     },
++	.thr_ctl = -1,
++	.tx_thr_length = -1,
++	.rx_thr_length = -1,
++	.pti_enable = -1,
++	.mpi_enable = -1,
++	.lpm_enable = 0,
++	.ic_usb_cap = -1,
++	.ahb_thr_ratio = -1,
++	.power_down = -1,
++	.reload_ctl = -1,
++	.dev_out_nak = -1,
++	.cont_on_bna = -1,
++	.ahb_single = -1,
++	.otg_ver = -1,
++	.adp_enable = -1,
++};
++
++//Global variable to switch the fiq fix on or off
++bool fiq_enable = 1;
++// Global variable to enable the split transaction fix
++bool fiq_fsm_enable = true;
++//Bulk split-transaction NAK holdoff in microframes
++uint16_t nak_holdoff = 8;
++
++//Force host mode during CIL re-init
++bool cil_force_host = true;
++
++unsigned short fiq_fsm_mask = 0x0F;
++
++unsigned short int_ep_interval_min = 0;
++/**
++ * This function shows the Driver Version.
++ */
++static ssize_t version_show(struct device_driver *dev, char *buf)
++{
++	return snprintf(buf, sizeof(DWC_DRIVER_VERSION) + 2, "%s\n",
++			DWC_DRIVER_VERSION);
++}
++
++static DRIVER_ATTR_RO(version);
++
++/**
++ * Global Debug Level Mask.
++ */
++uint32_t g_dbg_lvl = 0;		/* OFF */
++
++/**
++ * This function shows the driver Debug Level.
++ */
++static ssize_t debuglevel_show(struct device_driver *drv, char *buf)
++{
++	return sprintf(buf, "0x%0x\n", g_dbg_lvl);
++}
++
++/**
++ * This function stores the driver Debug Level.
++ */
++static ssize_t debuglevel_store(struct device_driver *drv, const char *buf,
++			       size_t count)
++{
++	g_dbg_lvl = simple_strtoul(buf, NULL, 16);
++	return count;
++}
++
++static DRIVER_ATTR_RW(debuglevel);
++
++/**
++ * This function is called during module intialization
++ * to pass module parameters to the DWC_OTG CORE.
++ */
++static int set_parameters(dwc_otg_core_if_t * core_if)
++{
++	int retval = 0;
++	int i;
++
++	if (dwc_otg_module_params.otg_cap != -1) {
++		retval +=
++		    dwc_otg_set_param_otg_cap(core_if,
++					      dwc_otg_module_params.otg_cap);
++	}
++	if (dwc_otg_module_params.dma_enable != -1) {
++		retval +=
++		    dwc_otg_set_param_dma_enable(core_if,
++						 dwc_otg_module_params.
++						 dma_enable);
++	}
++	if (dwc_otg_module_params.dma_desc_enable != -1) {
++		retval +=
++		    dwc_otg_set_param_dma_desc_enable(core_if,
++						      dwc_otg_module_params.
++						      dma_desc_enable);
++	}
++	if (dwc_otg_module_params.opt != -1) {
++		retval +=
++		    dwc_otg_set_param_opt(core_if, dwc_otg_module_params.opt);
++	}
++	if (dwc_otg_module_params.dma_burst_size != -1) {
++		retval +=
++		    dwc_otg_set_param_dma_burst_size(core_if,
++						     dwc_otg_module_params.
++						     dma_burst_size);
++	}
++	if (dwc_otg_module_params.host_support_fs_ls_low_power != -1) {
++		retval +=
++		    dwc_otg_set_param_host_support_fs_ls_low_power(core_if,
++								   dwc_otg_module_params.
++								   host_support_fs_ls_low_power);
++	}
++	if (dwc_otg_module_params.enable_dynamic_fifo != -1) {
++		retval +=
++		    dwc_otg_set_param_enable_dynamic_fifo(core_if,
++							  dwc_otg_module_params.
++							  enable_dynamic_fifo);
++	}
++	if (dwc_otg_module_params.data_fifo_size != -1) {
++		retval +=
++		    dwc_otg_set_param_data_fifo_size(core_if,
++						     dwc_otg_module_params.
++						     data_fifo_size);
++	}
++	if (dwc_otg_module_params.dev_rx_fifo_size != -1) {
++		retval +=
++		    dwc_otg_set_param_dev_rx_fifo_size(core_if,
++						       dwc_otg_module_params.
++						       dev_rx_fifo_size);
++	}
++	if (dwc_otg_module_params.dev_nperio_tx_fifo_size != -1) {
++		retval +=
++		    dwc_otg_set_param_dev_nperio_tx_fifo_size(core_if,
++							      dwc_otg_module_params.
++							      dev_nperio_tx_fifo_size);
++	}
++	if (dwc_otg_module_params.host_rx_fifo_size != -1) {
++		retval +=
++		    dwc_otg_set_param_host_rx_fifo_size(core_if,
++							dwc_otg_module_params.host_rx_fifo_size);
++	}
++	if (dwc_otg_module_params.host_nperio_tx_fifo_size != -1) {
++		retval +=
++		    dwc_otg_set_param_host_nperio_tx_fifo_size(core_if,
++							       dwc_otg_module_params.
++							       host_nperio_tx_fifo_size);
++	}
++	if (dwc_otg_module_params.host_perio_tx_fifo_size != -1) {
++		retval +=
++		    dwc_otg_set_param_host_perio_tx_fifo_size(core_if,
++							      dwc_otg_module_params.
++							      host_perio_tx_fifo_size);
++	}
++	if (dwc_otg_module_params.max_transfer_size != -1) {
++		retval +=
++		    dwc_otg_set_param_max_transfer_size(core_if,
++							dwc_otg_module_params.
++							max_transfer_size);
++	}
++	if (dwc_otg_module_params.max_packet_count != -1) {
++		retval +=
++		    dwc_otg_set_param_max_packet_count(core_if,
++						       dwc_otg_module_params.
++						       max_packet_count);
++	}
++	if (dwc_otg_module_params.host_channels != -1) {
++		retval +=
++		    dwc_otg_set_param_host_channels(core_if,
++						    dwc_otg_module_params.
++						    host_channels);
++	}
++	if (dwc_otg_module_params.dev_endpoints != -1) {
++		retval +=
++		    dwc_otg_set_param_dev_endpoints(core_if,
++						    dwc_otg_module_params.
++						    dev_endpoints);
++	}
++	if (dwc_otg_module_params.phy_type != -1) {
++		retval +=
++		    dwc_otg_set_param_phy_type(core_if,
++					       dwc_otg_module_params.phy_type);
++	}
++	if (dwc_otg_module_params.speed != -1) {
++		retval +=
++		    dwc_otg_set_param_speed(core_if,
++					    dwc_otg_module_params.speed);
++	}
++	if (dwc_otg_module_params.host_ls_low_power_phy_clk != -1) {
++		retval +=
++		    dwc_otg_set_param_host_ls_low_power_phy_clk(core_if,
++								dwc_otg_module_params.
++								host_ls_low_power_phy_clk);
++	}
++	if (dwc_otg_module_params.phy_ulpi_ddr != -1) {
++		retval +=
++		    dwc_otg_set_param_phy_ulpi_ddr(core_if,
++						   dwc_otg_module_params.
++						   phy_ulpi_ddr);
++	}
++	if (dwc_otg_module_params.phy_ulpi_ext_vbus != -1) {
++		retval +=
++		    dwc_otg_set_param_phy_ulpi_ext_vbus(core_if,
++							dwc_otg_module_params.
++							phy_ulpi_ext_vbus);
++	}
++	if (dwc_otg_module_params.phy_utmi_width != -1) {
++		retval +=
++		    dwc_otg_set_param_phy_utmi_width(core_if,
++						     dwc_otg_module_params.
++						     phy_utmi_width);
++	}
++	if (dwc_otg_module_params.ulpi_fs_ls != -1) {
++		retval +=
++		    dwc_otg_set_param_ulpi_fs_ls(core_if,
++						 dwc_otg_module_params.ulpi_fs_ls);
++	}
++	if (dwc_otg_module_params.ts_dline != -1) {
++		retval +=
++		    dwc_otg_set_param_ts_dline(core_if,
++					       dwc_otg_module_params.ts_dline);
++	}
++	if (dwc_otg_module_params.i2c_enable != -1) {
++		retval +=
++		    dwc_otg_set_param_i2c_enable(core_if,
++						 dwc_otg_module_params.
++						 i2c_enable);
++	}
++	if (dwc_otg_module_params.en_multiple_tx_fifo != -1) {
++		retval +=
++		    dwc_otg_set_param_en_multiple_tx_fifo(core_if,
++							  dwc_otg_module_params.
++							  en_multiple_tx_fifo);
++	}
++	for (i = 0; i < 15; i++) {
++		if (dwc_otg_module_params.dev_perio_tx_fifo_size[i] != -1) {
++			retval +=
++			    dwc_otg_set_param_dev_perio_tx_fifo_size(core_if,
++								     dwc_otg_module_params.
++								     dev_perio_tx_fifo_size
++								     [i], i);
++		}
++	}
++
++	for (i = 0; i < 15; i++) {
++		if (dwc_otg_module_params.dev_tx_fifo_size[i] != -1) {
++			retval += dwc_otg_set_param_dev_tx_fifo_size(core_if,
++								     dwc_otg_module_params.
++								     dev_tx_fifo_size
++								     [i], i);
++		}
++	}
++	if (dwc_otg_module_params.thr_ctl != -1) {
++		retval +=
++		    dwc_otg_set_param_thr_ctl(core_if,
++					      dwc_otg_module_params.thr_ctl);
++	}
++	if (dwc_otg_module_params.mpi_enable != -1) {
++		retval +=
++		    dwc_otg_set_param_mpi_enable(core_if,
++						 dwc_otg_module_params.
++						 mpi_enable);
++	}
++	if (dwc_otg_module_params.pti_enable != -1) {
++		retval +=
++		    dwc_otg_set_param_pti_enable(core_if,
++						 dwc_otg_module_params.
++						 pti_enable);
++	}
++	if (dwc_otg_module_params.lpm_enable != -1) {
++		retval +=
++		    dwc_otg_set_param_lpm_enable(core_if,
++						 dwc_otg_module_params.
++						 lpm_enable);
++	}
++	if (dwc_otg_module_params.ic_usb_cap != -1) {
++		retval +=
++		    dwc_otg_set_param_ic_usb_cap(core_if,
++						 dwc_otg_module_params.
++						 ic_usb_cap);
++	}
++	if (dwc_otg_module_params.tx_thr_length != -1) {
++		retval +=
++		    dwc_otg_set_param_tx_thr_length(core_if,
++						    dwc_otg_module_params.tx_thr_length);
++	}
++	if (dwc_otg_module_params.rx_thr_length != -1) {
++		retval +=
++		    dwc_otg_set_param_rx_thr_length(core_if,
++						    dwc_otg_module_params.
++						    rx_thr_length);
++	}
++	if (dwc_otg_module_params.ahb_thr_ratio != -1) {
++		retval +=
++		    dwc_otg_set_param_ahb_thr_ratio(core_if,
++						    dwc_otg_module_params.ahb_thr_ratio);
++	}
++	if (dwc_otg_module_params.power_down != -1) {
++		retval +=
++		    dwc_otg_set_param_power_down(core_if,
++						 dwc_otg_module_params.power_down);
++	}
++	if (dwc_otg_module_params.reload_ctl != -1) {
++		retval +=
++		    dwc_otg_set_param_reload_ctl(core_if,
++						 dwc_otg_module_params.reload_ctl);
++	}
++
++	if (dwc_otg_module_params.dev_out_nak != -1) {
++		retval +=
++			dwc_otg_set_param_dev_out_nak(core_if,
++			dwc_otg_module_params.dev_out_nak);
++	}
++
++	if (dwc_otg_module_params.cont_on_bna != -1) {
++		retval +=
++			dwc_otg_set_param_cont_on_bna(core_if,
++			dwc_otg_module_params.cont_on_bna);
++	}
++
++	if (dwc_otg_module_params.ahb_single != -1) {
++		retval +=
++			dwc_otg_set_param_ahb_single(core_if,
++			dwc_otg_module_params.ahb_single);
++	}
++
++	if (dwc_otg_module_params.otg_ver != -1) {
++		retval +=
++		    dwc_otg_set_param_otg_ver(core_if,
++					      dwc_otg_module_params.otg_ver);
++	}
++	if (dwc_otg_module_params.adp_enable != -1) {
++		retval +=
++		    dwc_otg_set_param_adp_enable(core_if,
++						 dwc_otg_module_params.
++						 adp_enable);
++	}
++	return retval;
++}
++
++/**
++ * This function is the top level interrupt handler for the Common
++ * (Device and host modes) interrupts.
++ */
++static irqreturn_t dwc_otg_common_irq(int irq, void *dev)
++{
++	int32_t retval = IRQ_NONE;
++
++	retval = dwc_otg_handle_common_intr(dev);
++	if (retval != 0) {
++		S3C2410X_CLEAR_EINTPEND();
++	}
++	return IRQ_RETVAL(retval);
++}
++
++/**
++ * This function is called when a lm_device is unregistered with the
++ * dwc_otg_driver. This happens, for example, when the rmmod command is
++ * executed. The device may or may not be electrically present. If it is
++ * present, the driver stops device processing. Any resources used on behalf
++ * of this device are freed.
++ *
++ * @param _dev
++ */
++#ifdef LM_INTERFACE
++#define REM_RETVAL(n)
++static void dwc_otg_driver_remove(	 struct lm_device *_dev )
++{       dwc_otg_device_t *otg_dev = lm_get_drvdata(_dev);
++#elif  defined(PCI_INTERFACE)
++#define REM_RETVAL(n)
++static void dwc_otg_driver_remove(	 struct pci_dev *_dev )
++{	dwc_otg_device_t *otg_dev = pci_get_drvdata(_dev);
++#elif  defined(PLATFORM_INTERFACE)
++#define REM_RETVAL(n) n
++static void dwc_otg_driver_remove(        struct platform_device *_dev )
++{       dwc_otg_device_t *otg_dev = platform_get_drvdata(_dev);
++#endif
++
++	DWC_DEBUGPL(DBG_ANY, "%s(%p) otg_dev %p\n", __func__, _dev, otg_dev);
++
++	if (!otg_dev) {
++		/* Memory allocation for the dwc_otg_device failed. */
++		DWC_DEBUGPL(DBG_ANY, "%s: otg_dev NULL!\n", __func__);
++	}
++#ifndef DWC_DEVICE_ONLY
++	if (otg_dev->hcd) {
++		hcd_remove(_dev);
++	} else {
++		DWC_DEBUGPL(DBG_ANY, "%s: otg_dev->hcd NULL!\n", __func__);
++	}
++#endif
++
++#ifndef DWC_HOST_ONLY
++	if (otg_dev->pcd) {
++		pcd_remove(_dev);
++	} else {
++		DWC_DEBUGPL(DBG_ANY, "%s: otg_dev->pcd NULL!\n", __func__);
++	}
++#endif
++	/*
++	 * Free the IRQ
++	 */
++	if (otg_dev->common_irq_installed) {
++		free_irq(otg_dev->os_dep.irq_num, otg_dev);
++        } else {
++		DWC_DEBUGPL(DBG_ANY, "%s: There is no installed irq!\n", __func__);
++	}
++
++	if (otg_dev->core_if) {
++		dwc_otg_cil_remove(otg_dev->core_if);
++	} else {
++		DWC_DEBUGPL(DBG_ANY, "%s: otg_dev->core_if NULL!\n", __func__);
++	}
++
++	/*
++	 * Remove the device attributes
++	 */
++	dwc_otg_attr_remove(_dev);
++
++	/*
++	 * Return the memory.
++	 */
++	if (otg_dev->os_dep.base) {
++		iounmap(otg_dev->os_dep.base);
++	}
++	DWC_FREE(otg_dev);
++
++	/*
++	 * Clear the drvdata pointer.
++	 */
++#ifdef LM_INTERFACE
++	lm_set_drvdata(_dev, 0);
++#elif defined(PCI_INTERFACE)
++        release_mem_region(otg_dev->os_dep.rsrc_start,
++                           otg_dev->os_dep.rsrc_len);
++	pci_set_drvdata(_dev, 0);
++#elif  defined(PLATFORM_INTERFACE)
++        platform_set_drvdata(_dev, 0);
++#endif
++}
++
++/**
++ * This function is called when an lm_device is bound to a
++ * dwc_otg_driver. It creates the driver components required to
++ * control the device (CIL, HCD, and PCD) and it initializes the
++ * device. The driver components are stored in a dwc_otg_device
++ * structure. A reference to the dwc_otg_device is saved in the
++ * lm_device. This allows the driver to access the dwc_otg_device
++ * structure on subsequent calls to driver methods for this device.
++ *
++ * @param _dev Bus device
++ */
++static int dwc_otg_driver_probe(
++#ifdef LM_INTERFACE
++				       struct lm_device *_dev
++#elif defined(PCI_INTERFACE)
++				       struct pci_dev *_dev,
++				       const struct pci_device_id *id
++#elif  defined(PLATFORM_INTERFACE)
++                                       struct platform_device *_dev
++#endif
++    )
++{
++	int retval = 0;
++	dwc_otg_device_t *dwc_otg_device;
++        int devirq;
++
++	dev_dbg(&_dev->dev, "dwc_otg_driver_probe(%p)\n", _dev);
++#ifdef LM_INTERFACE
++	dev_dbg(&_dev->dev, "start=0x%08x\n", (unsigned)_dev->resource.start);
++#elif defined(PCI_INTERFACE)
++	if (!id) {
++		DWC_ERROR("Invalid pci_device_id %p", id);
++		return -EINVAL;
++	}
++
++	if (!_dev || (pci_enable_device(_dev) < 0)) {
++		DWC_ERROR("Invalid pci_device %p", _dev);
++		return -ENODEV;
++	}
++	dev_dbg(&_dev->dev, "start=0x%08x\n", (unsigned)pci_resource_start(_dev,0));
++	/* other stuff needed as well? */
++
++#elif  defined(PLATFORM_INTERFACE)
++	dev_dbg(&_dev->dev, "start=0x%08x (len 0x%x)\n",
++                (unsigned)_dev->resource->start,
++                (unsigned)(_dev->resource->end - _dev->resource->start));
++#endif
++
++	dwc_otg_device = DWC_ALLOC(sizeof(dwc_otg_device_t));
++
++	if (!dwc_otg_device) {
++		dev_err(&_dev->dev, "kmalloc of dwc_otg_device failed\n");
++		return -ENOMEM;
++	}
++
++	memset(dwc_otg_device, 0, sizeof(*dwc_otg_device));
++	dwc_otg_device->os_dep.reg_offset = 0xFFFFFFFF;
++	dwc_otg_device->os_dep.platformdev = _dev;
++
++	/*
++	 * Map the DWC_otg Core memory into virtual address space.
++	 */
++#ifdef LM_INTERFACE
++	dwc_otg_device->os_dep.base = ioremap(_dev->resource.start, SZ_256K);
++
++	if (!dwc_otg_device->os_dep.base) {
++		dev_err(&_dev->dev, "ioremap() failed\n");
++		DWC_FREE(dwc_otg_device);
++		return -ENOMEM;
++	}
++	dev_dbg(&_dev->dev, "base=0x%08x\n",
++		(unsigned)dwc_otg_device->os_dep.base);
++#elif defined(PCI_INTERFACE)
++	_dev->current_state = PCI_D0;
++	_dev->dev.power.power_state = PMSG_ON;
++
++	if (!_dev->irq) {
++		DWC_ERROR("Found HC with no IRQ. Check BIOS/PCI %s setup!",
++			  pci_name(_dev));
++		iounmap(dwc_otg_device->os_dep.base);
++		DWC_FREE(dwc_otg_device);
++		return -ENODEV;
++	}
++
++	dwc_otg_device->os_dep.rsrc_start = pci_resource_start(_dev, 0);
++	dwc_otg_device->os_dep.rsrc_len = pci_resource_len(_dev, 0);
++	DWC_DEBUGPL(DBG_ANY, "PCI resource: start=%08x, len=%08x\n",
++		    (unsigned)dwc_otg_device->os_dep.rsrc_start,
++		    (unsigned)dwc_otg_device->os_dep.rsrc_len);
++	if (!request_mem_region
++	    (dwc_otg_device->os_dep.rsrc_start, dwc_otg_device->os_dep.rsrc_len,
++	     "dwc_otg")) {
++		dev_dbg(&_dev->dev, "error requesting memory\n");
++		iounmap(dwc_otg_device->os_dep.base);
++		DWC_FREE(dwc_otg_device);
++		return -EFAULT;
++	}
++
++	dwc_otg_device->os_dep.base =
++	    ioremap(dwc_otg_device->os_dep.rsrc_start,
++			    dwc_otg_device->os_dep.rsrc_len);
++	if (dwc_otg_device->os_dep.base == NULL) {
++		dev_dbg(&_dev->dev, "error mapping memory\n");
++		release_mem_region(dwc_otg_device->os_dep.rsrc_start,
++				   dwc_otg_device->os_dep.rsrc_len);
++		iounmap(dwc_otg_device->os_dep.base);
++		DWC_FREE(dwc_otg_device);
++		return -EFAULT;
++	}
++	dev_dbg(&_dev->dev, "base=0x%p (before adjust) \n",
++		dwc_otg_device->os_dep.base);
++	dwc_otg_device->os_dep.base = (char *)dwc_otg_device->os_dep.base;
++	dev_dbg(&_dev->dev, "base=0x%p (after adjust) \n",
++		dwc_otg_device->os_dep.base);
++	dev_dbg(&_dev->dev, "%s: mapped PA 0x%x to VA 0x%p\n", __func__,
++		(unsigned)dwc_otg_device->os_dep.rsrc_start,
++		dwc_otg_device->os_dep.base);
++
++	pci_set_master(_dev);
++	pci_set_drvdata(_dev, dwc_otg_device);
++#elif defined(PLATFORM_INTERFACE)
++        DWC_DEBUGPL(DBG_ANY,"Platform resource: start=%08x, len=%08x\n",
++                    _dev->resource->start,
++                    _dev->resource->end - _dev->resource->start + 1);
++#if 1
++        if (!request_mem_region(_dev->resource[0].start,
++                                _dev->resource[0].end - _dev->resource[0].start + 1,
++                                "dwc_otg")) {
++          dev_dbg(&_dev->dev, "error reserving mapped memory\n");
++          retval = -EFAULT;
++          goto fail;
++        }
++
++	dwc_otg_device->os_dep.base = ioremap(_dev->resource[0].start,
++                                                      _dev->resource[0].end -
++                                                      _dev->resource[0].start+1);
++	if (fiq_enable)
++	{
++		if (!request_mem_region(_dev->resource[1].start,
++	                                _dev->resource[1].end - _dev->resource[1].start + 1,
++	                                "dwc_otg")) {
++			dev_dbg(&_dev->dev, "error reserving mapped memory\n");
++			retval = -EFAULT;
++			goto fail;
++		}
++
++		dwc_otg_device->os_dep.mphi_base = ioremap(_dev->resource[1].start,
++							    _dev->resource[1].end -
++							    _dev->resource[1].start + 1);
++		dwc_otg_device->os_dep.use_swirq = (_dev->resource[1].end - _dev->resource[1].start) == 0x200;
++	}
++
++#else
++        {
++                struct map_desc desc = {
++                    .virtual = IO_ADDRESS((unsigned)_dev->resource->start),
++                    .pfn     = __phys_to_pfn((unsigned)_dev->resource->start),
++                    .length  = SZ_128K,
++                    .type    = MT_DEVICE
++                };
++                iotable_init(&desc, 1);
++                dwc_otg_device->os_dep.base = (void *)desc.virtual;
++        }
++#endif
++	if (!dwc_otg_device->os_dep.base) {
++		dev_err(&_dev->dev, "ioremap() failed\n");
++		retval = -ENOMEM;
++		goto fail;
++	}
++#endif
++
++	/*
++	 * Initialize driver data to point to the global DWC_otg
++	 * Device structure.
++	 */
++#ifdef LM_INTERFACE
++	lm_set_drvdata(_dev, dwc_otg_device);
++#elif defined(PLATFORM_INTERFACE)
++	platform_set_drvdata(_dev, dwc_otg_device);
++#endif
++	dev_dbg(&_dev->dev, "dwc_otg_device=0x%p\n", dwc_otg_device);
++
++	dwc_otg_device->core_if = dwc_otg_cil_init(dwc_otg_device->os_dep.base);
++        DWC_DEBUGPL(DBG_HCDV, "probe of device %p given core_if %p\n",
++                    dwc_otg_device, dwc_otg_device->core_if);//GRAYG
++
++	if (!dwc_otg_device->core_if) {
++		dev_err(&_dev->dev, "CIL initialization failed!\n");
++		retval = -ENOMEM;
++		goto fail;
++	}
++
++	dev_dbg(&_dev->dev, "Calling get_gsnpsid\n");
++	/*
++	 * Attempt to ensure this device is really a DWC_otg Controller.
++	 * Read and verify the SNPSID register contents. The value should be
++	 * 0x45F42XXX or 0x45F42XXX, which corresponds to either "OT2" or "OTG3",
++	 * as in "OTG version 2.XX" or "OTG version 3.XX".
++	 */
++
++	if (((dwc_otg_get_gsnpsid(dwc_otg_device->core_if) & 0xFFFFF000) !=	0x4F542000) &&
++		((dwc_otg_get_gsnpsid(dwc_otg_device->core_if) & 0xFFFFF000) != 0x4F543000)) {
++		dev_err(&_dev->dev, "Bad value for SNPSID: 0x%08x\n",
++			dwc_otg_get_gsnpsid(dwc_otg_device->core_if));
++		retval = -EINVAL;
++		goto fail;
++	}
++
++	/*
++	 * Validate parameter values.
++	 */
++	dev_dbg(&_dev->dev, "Calling set_parameters\n");
++	if (set_parameters(dwc_otg_device->core_if)) {
++		retval = -EINVAL;
++		goto fail;
++	}
++
++	/*
++	 * Create Device Attributes in sysfs
++	 */
++	dev_dbg(&_dev->dev, "Calling attr_create\n");
++	dwc_otg_attr_create(_dev);
++
++	/*
++	 * Disable the global interrupt until all the interrupt
++	 * handlers are installed.
++	 */
++	dev_dbg(&_dev->dev, "Calling disable_global_interrupts\n");
++	dwc_otg_disable_global_interrupts(dwc_otg_device->core_if);
++
++	/*
++	 * Install the interrupt handler for the common interrupts before
++	 * enabling common interrupts in core_init below.
++	 */
++
++#if defined(PLATFORM_INTERFACE)
++	devirq = platform_get_irq_byname(_dev, fiq_enable ? "soft" : "usb");
++	if (devirq < 0)
++	    devirq = platform_get_irq(_dev, fiq_enable ? 0 : 1);
++#else
++	devirq = _dev->irq;
++#endif
++	DWC_DEBUGPL(DBG_CIL, "registering (common) handler for irq%d\n",
++		    devirq);
++	dev_dbg(&_dev->dev, "Calling request_irq(%d)\n", devirq);
++	retval = request_irq(devirq, dwc_otg_common_irq,
++                             IRQF_SHARED,
++                             "dwc_otg", dwc_otg_device);
++	if (retval) {
++		DWC_ERROR("request of irq%d failed\n", devirq);
++		retval = -EBUSY;
++		goto fail;
++	} else {
++		dwc_otg_device->common_irq_installed = 1;
++	}
++	dwc_otg_device->os_dep.irq_num = devirq;
++	dwc_otg_device->os_dep.fiq_num = -EINVAL;
++	if (fiq_enable) {
++		int devfiq = platform_get_irq_byname(_dev, "usb");
++		if (devfiq < 0)
++			devfiq = platform_get_irq(_dev, 1);
++		dwc_otg_device->os_dep.fiq_num = devfiq;
++	}
++
++#ifndef IRQF_TRIGGER_LOW
++#if defined(LM_INTERFACE) || defined(PLATFORM_INTERFACE)
++	dev_dbg(&_dev->dev, "Calling set_irq_type\n");
++	set_irq_type(devirq,
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30))
++                     IRQT_LOW
++#else
++                     IRQ_TYPE_LEVEL_LOW
++#endif
++                    );
++#endif
++#endif /*IRQF_TRIGGER_LOW*/
++
++	/*
++	 * Initialize the DWC_otg core.
++	 */
++	dev_dbg(&_dev->dev, "Calling dwc_otg_core_init\n");
++	dwc_otg_core_init(dwc_otg_device->core_if);
++
++#ifndef DWC_HOST_ONLY
++	/*
++	 * Initialize the PCD
++	 */
++	dev_dbg(&_dev->dev, "Calling pcd_init\n");
++	retval = pcd_init(_dev);
++	if (retval != 0) {
++		DWC_ERROR("pcd_init failed\n");
++		dwc_otg_device->pcd = NULL;
++		goto fail;
++	}
++#endif
++#ifndef DWC_DEVICE_ONLY
++	/*
++	 * Initialize the HCD
++	 */
++	dev_dbg(&_dev->dev, "Calling hcd_init\n");
++	retval = hcd_init(_dev);
++	if (retval != 0) {
++		DWC_ERROR("hcd_init failed\n");
++		dwc_otg_device->hcd = NULL;
++		goto fail;
++	}
++#endif
++        /* Recover from drvdata having been overwritten by hcd_init() */
++#ifdef LM_INTERFACE
++	lm_set_drvdata(_dev, dwc_otg_device);
++#elif defined(PLATFORM_INTERFACE)
++	platform_set_drvdata(_dev, dwc_otg_device);
++#elif defined(PCI_INTERFACE)
++	pci_set_drvdata(_dev, dwc_otg_device);
++	dwc_otg_device->os_dep.pcidev = _dev;
++#endif
++
++	/*
++	 * Enable the global interrupt after all the interrupt
++	 * handlers are installed if there is no ADP support else
++	 * perform initial actions required for Internal ADP logic.
++	 */
++	if (!dwc_otg_get_param_adp_enable(dwc_otg_device->core_if)) {
++	        dev_dbg(&_dev->dev, "Calling enable_global_interrupts\n");
++		dwc_otg_enable_global_interrupts(dwc_otg_device->core_if);
++	        dev_dbg(&_dev->dev, "Done\n");
++	} else
++		dwc_otg_adp_start(dwc_otg_device->core_if,
++							dwc_otg_is_host_mode(dwc_otg_device->core_if));
++
++	return 0;
++
++fail:
++	dwc_otg_driver_remove(_dev);
++	return retval;
++}
++
++/**
++ * This structure defines the methods to be called by a bus driver
++ * during the lifecycle of a device on that bus. Both drivers and
++ * devices are registered with a bus driver. The bus driver matches
++ * devices to drivers based on information in the device and driver
++ * structures.
++ *
++ * The probe function is called when the bus driver matches a device
++ * to this driver. The remove function is called when a device is
++ * unregistered with the bus driver.
++ */
++#ifdef LM_INTERFACE
++static struct lm_driver dwc_otg_driver = {
++	.drv = {.name = (char *)dwc_driver_name,},
++	.probe = dwc_otg_driver_probe,
++	.remove = dwc_otg_driver_remove,
++        // 'suspend' and 'resume' absent
++};
++#elif defined(PCI_INTERFACE)
++static const struct pci_device_id pci_ids[] = { {
++						 PCI_DEVICE(0x16c3, 0xabcd),
++						 .driver_data =
++						 (unsigned long)0xdeadbeef,
++						 }, { /* end: all zeroes */ }
++};
++
++MODULE_DEVICE_TABLE(pci, pci_ids);
++
++/* pci driver glue; this is a "new style" PCI driver module */
++static struct pci_driver dwc_otg_driver = {
++	.name = "dwc_otg",
++	.id_table = pci_ids,
++
++	.probe = dwc_otg_driver_probe,
++	.remove = dwc_otg_driver_remove,
++
++	.driver = {
++		   .name = (char *)dwc_driver_name,
++		   },
++};
++#elif defined(PLATFORM_INTERFACE)
++static struct platform_device_id platform_ids[] = {
++        {
++              .name = "bcm2708_usb",
++              .driver_data = (kernel_ulong_t) 0xdeadbeef,
++        },
++        { /* end: all zeroes */ }
++};
++MODULE_DEVICE_TABLE(platform, platform_ids);
++
++static const struct of_device_id dwc_otg_of_match_table[] = {
++	{ .compatible = "brcm,bcm2708-usb", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, dwc_otg_of_match_table);
++
++static struct platform_driver dwc_otg_driver = {
++	.driver = {
++		.name = (char *)dwc_driver_name,
++		.of_match_table = dwc_otg_of_match_table,
++		},
++        .id_table = platform_ids,
++
++	.probe = dwc_otg_driver_probe,
++	.remove = dwc_otg_driver_remove,
++        // no 'shutdown', 'suspend', 'resume', 'suspend_late' or 'resume_early'
++};
++#endif
++
++/**
++ * This function is called when the dwc_otg_driver is installed with the
++ * insmod command. It registers the dwc_otg_driver structure with the
++ * appropriate bus driver. This will cause the dwc_otg_driver_probe function
++ * to be called. In addition, the bus driver will automatically expose
++ * attributes defined for the device and driver in the special sysfs file
++ * system.
++ *
++ * @return
++ */
++static int __init dwc_otg_driver_init(void)
++{
++	int retval = 0;
++	int error;
++        struct device_driver *drv;
++
++	if(fiq_fsm_enable && !fiq_enable) {
++		printk(KERN_WARNING "dwc_otg: fiq_fsm_enable was set without fiq_enable! Correcting.\n");
++		fiq_enable = 1;
++	}
++
++	printk(KERN_INFO "%s: version %s (%s bus)\n", dwc_driver_name,
++	       DWC_DRIVER_VERSION,
++#ifdef LM_INTERFACE
++               "logicmodule");
++	retval = lm_driver_register(&dwc_otg_driver);
++        drv = &dwc_otg_driver.drv;
++#elif defined(PCI_INTERFACE)
++               "pci");
++	retval = pci_register_driver(&dwc_otg_driver);
++        drv = &dwc_otg_driver.driver;
++#elif defined(PLATFORM_INTERFACE)
++               "platform");
++	retval = platform_driver_register(&dwc_otg_driver);
++        drv = &dwc_otg_driver.driver;
++#endif
++	if (retval < 0) {
++		printk(KERN_ERR "%s retval=%d\n", __func__, retval);
++		return retval;
++	}
++	printk(KERN_DEBUG "dwc_otg: FIQ %s\n", fiq_enable ? "enabled":"disabled");
++	printk(KERN_DEBUG "dwc_otg: NAK holdoff %s\n", nak_holdoff ? "enabled":"disabled");
++	printk(KERN_DEBUG "dwc_otg: FIQ split-transaction FSM %s\n", fiq_fsm_enable ? "enabled":"disabled");
++
++	error = driver_create_file(drv, &driver_attr_version);
++#ifdef DEBUG
++	error = driver_create_file(drv, &driver_attr_debuglevel);
++#endif
++	return retval;
++}
++
++module_init(dwc_otg_driver_init);
++
++/**
++ * This function is called when the driver is removed from the kernel
++ * with the rmmod command. The driver unregisters itself with its bus
++ * driver.
++ *
++ */
++static void __exit dwc_otg_driver_cleanup(void)
++{
++	printk(KERN_DEBUG "dwc_otg_driver_cleanup()\n");
++
++#ifdef LM_INTERFACE
++	driver_remove_file(&dwc_otg_driver.drv, &driver_attr_debuglevel);
++	driver_remove_file(&dwc_otg_driver.drv, &driver_attr_version);
++	lm_driver_unregister(&dwc_otg_driver);
++#elif defined(PCI_INTERFACE)
++	driver_remove_file(&dwc_otg_driver.driver, &driver_attr_debuglevel);
++	driver_remove_file(&dwc_otg_driver.driver, &driver_attr_version);
++	pci_unregister_driver(&dwc_otg_driver);
++#elif defined(PLATFORM_INTERFACE)
++	driver_remove_file(&dwc_otg_driver.driver, &driver_attr_debuglevel);
++	driver_remove_file(&dwc_otg_driver.driver, &driver_attr_version);
++	platform_driver_unregister(&dwc_otg_driver);
++#endif
++
++	printk(KERN_INFO "%s module removed\n", dwc_driver_name);
++}
++
++module_exit(dwc_otg_driver_cleanup);
++
++MODULE_DESCRIPTION(DWC_DRIVER_DESC);
++MODULE_AUTHOR("Synopsys Inc.");
++MODULE_LICENSE("GPL");
++
++module_param_named(otg_cap, dwc_otg_module_params.otg_cap, int, 0444);
++MODULE_PARM_DESC(otg_cap, "OTG Capabilities 0=HNP&SRP 1=SRP Only 2=None");
++module_param_named(opt, dwc_otg_module_params.opt, int, 0444);
++MODULE_PARM_DESC(opt, "OPT Mode");
++module_param_named(dma_enable, dwc_otg_module_params.dma_enable, int, 0444);
++MODULE_PARM_DESC(dma_enable, "DMA Mode 0=Slave 1=DMA enabled");
++
++module_param_named(dma_desc_enable, dwc_otg_module_params.dma_desc_enable, int,
++		   0444);
++MODULE_PARM_DESC(dma_desc_enable,
++		 "DMA Desc Mode 0=Address DMA 1=DMA Descriptor enabled");
++
++module_param_named(dma_burst_size, dwc_otg_module_params.dma_burst_size, int,
++		   0444);
++MODULE_PARM_DESC(dma_burst_size,
++		 "DMA Burst Size 1, 4, 8, 16, 32, 64, 128, 256");
++module_param_named(speed, dwc_otg_module_params.speed, int, 0444);
++MODULE_PARM_DESC(speed, "Speed 0=High Speed 1=Full Speed");
++module_param_named(host_support_fs_ls_low_power,
++		   dwc_otg_module_params.host_support_fs_ls_low_power, int,
++		   0444);
++MODULE_PARM_DESC(host_support_fs_ls_low_power,
++		 "Support Low Power w/FS or LS 0=Support 1=Don't Support");
++module_param_named(host_ls_low_power_phy_clk,
++		   dwc_otg_module_params.host_ls_low_power_phy_clk, int, 0444);
++MODULE_PARM_DESC(host_ls_low_power_phy_clk,
++		 "Low Speed Low Power Clock 0=48Mhz 1=6Mhz");
++module_param_named(enable_dynamic_fifo,
++		   dwc_otg_module_params.enable_dynamic_fifo, int, 0444);
++MODULE_PARM_DESC(enable_dynamic_fifo, "0=cC Setting 1=Allow Dynamic Sizing");
++module_param_named(data_fifo_size, dwc_otg_module_params.data_fifo_size, int,
++		   0444);
++MODULE_PARM_DESC(data_fifo_size,
++		 "Total number of words in the data FIFO memory 32-32768");
++module_param_named(dev_rx_fifo_size, dwc_otg_module_params.dev_rx_fifo_size,
++		   int, 0444);
++MODULE_PARM_DESC(dev_rx_fifo_size, "Number of words in the Rx FIFO 16-32768");
++module_param_named(dev_nperio_tx_fifo_size,
++		   dwc_otg_module_params.dev_nperio_tx_fifo_size, int, 0444);
++MODULE_PARM_DESC(dev_nperio_tx_fifo_size,
++		 "Number of words in the non-periodic Tx FIFO 16-32768");
++module_param_named(dev_perio_tx_fifo_size_1,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[0], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_1,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_2,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[1], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_2,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_3,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[2], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_3,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_4,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[3], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_4,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_5,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[4], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_5,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_6,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[5], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_6,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_7,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[6], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_7,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_8,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[7], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_8,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_9,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[8], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_9,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_10,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[9], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_10,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_11,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[10], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_11,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_12,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[11], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_12,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_13,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[12], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_13,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_14,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[13], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_14,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(dev_perio_tx_fifo_size_15,
++		   dwc_otg_module_params.dev_perio_tx_fifo_size[14], int, 0444);
++MODULE_PARM_DESC(dev_perio_tx_fifo_size_15,
++		 "Number of words in the periodic Tx FIFO 4-768");
++module_param_named(host_rx_fifo_size, dwc_otg_module_params.host_rx_fifo_size,
++		   int, 0444);
++MODULE_PARM_DESC(host_rx_fifo_size, "Number of words in the Rx FIFO 16-32768");
++module_param_named(host_nperio_tx_fifo_size,
++		   dwc_otg_module_params.host_nperio_tx_fifo_size, int, 0444);
++MODULE_PARM_DESC(host_nperio_tx_fifo_size,
++		 "Number of words in the non-periodic Tx FIFO 16-32768");
++module_param_named(host_perio_tx_fifo_size,
++		   dwc_otg_module_params.host_perio_tx_fifo_size, int, 0444);
++MODULE_PARM_DESC(host_perio_tx_fifo_size,
++		 "Number of words in the host periodic Tx FIFO 16-32768");
++module_param_named(max_transfer_size, dwc_otg_module_params.max_transfer_size,
++		   int, 0444);
++/** @todo Set the max to 512K, modify checks */
++MODULE_PARM_DESC(max_transfer_size,
++		 "The maximum transfer size supported in bytes 2047-65535");
++module_param_named(max_packet_count, dwc_otg_module_params.max_packet_count,
++		   int, 0444);
++MODULE_PARM_DESC(max_packet_count,
++		 "The maximum number of packets in a transfer 15-511");
++module_param_named(host_channels, dwc_otg_module_params.host_channels, int,
++		   0444);
++MODULE_PARM_DESC(host_channels,
++		 "The number of host channel registers to use 1-16");
++module_param_named(dev_endpoints, dwc_otg_module_params.dev_endpoints, int,
++		   0444);
++MODULE_PARM_DESC(dev_endpoints,
++		 "The number of endpoints in addition to EP0 available for device mode 1-15");
++module_param_named(phy_type, dwc_otg_module_params.phy_type, int, 0444);
++MODULE_PARM_DESC(phy_type, "0=Reserved 1=UTMI+ 2=ULPI");
++module_param_named(phy_utmi_width, dwc_otg_module_params.phy_utmi_width, int,
++		   0444);
++MODULE_PARM_DESC(phy_utmi_width, "Specifies the UTMI+ Data Width 8 or 16 bits");
++module_param_named(phy_ulpi_ddr, dwc_otg_module_params.phy_ulpi_ddr, int, 0444);
++MODULE_PARM_DESC(phy_ulpi_ddr,
++		 "ULPI at double or single data rate 0=Single 1=Double");
++module_param_named(phy_ulpi_ext_vbus, dwc_otg_module_params.phy_ulpi_ext_vbus,
++		   int, 0444);
++MODULE_PARM_DESC(phy_ulpi_ext_vbus,
++		 "ULPI PHY using internal or external vbus 0=Internal");
++module_param_named(i2c_enable, dwc_otg_module_params.i2c_enable, int, 0444);
++MODULE_PARM_DESC(i2c_enable, "FS PHY Interface");
++module_param_named(ulpi_fs_ls, dwc_otg_module_params.ulpi_fs_ls, int, 0444);
++MODULE_PARM_DESC(ulpi_fs_ls, "ULPI PHY FS/LS mode only");
++module_param_named(ts_dline, dwc_otg_module_params.ts_dline, int, 0444);
++MODULE_PARM_DESC(ts_dline, "Term select Dline pulsing for all PHYs");
++module_param_named(debug, g_dbg_lvl, int, 0444);
++MODULE_PARM_DESC(debug, "");
++
++module_param_named(en_multiple_tx_fifo,
++		   dwc_otg_module_params.en_multiple_tx_fifo, int, 0444);
++MODULE_PARM_DESC(en_multiple_tx_fifo,
++		 "Dedicated Non Periodic Tx FIFOs 0=disabled 1=enabled");
++module_param_named(dev_tx_fifo_size_1,
++		   dwc_otg_module_params.dev_tx_fifo_size[0], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_1, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_2,
++		   dwc_otg_module_params.dev_tx_fifo_size[1], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_2, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_3,
++		   dwc_otg_module_params.dev_tx_fifo_size[2], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_3, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_4,
++		   dwc_otg_module_params.dev_tx_fifo_size[3], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_4, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_5,
++		   dwc_otg_module_params.dev_tx_fifo_size[4], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_5, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_6,
++		   dwc_otg_module_params.dev_tx_fifo_size[5], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_6, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_7,
++		   dwc_otg_module_params.dev_tx_fifo_size[6], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_7, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_8,
++		   dwc_otg_module_params.dev_tx_fifo_size[7], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_8, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_9,
++		   dwc_otg_module_params.dev_tx_fifo_size[8], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_9, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_10,
++		   dwc_otg_module_params.dev_tx_fifo_size[9], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_10, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_11,
++		   dwc_otg_module_params.dev_tx_fifo_size[10], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_11, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_12,
++		   dwc_otg_module_params.dev_tx_fifo_size[11], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_12, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_13,
++		   dwc_otg_module_params.dev_tx_fifo_size[12], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_13, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_14,
++		   dwc_otg_module_params.dev_tx_fifo_size[13], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_14, "Number of words in the Tx FIFO 4-768");
++module_param_named(dev_tx_fifo_size_15,
++		   dwc_otg_module_params.dev_tx_fifo_size[14], int, 0444);
++MODULE_PARM_DESC(dev_tx_fifo_size_15, "Number of words in the Tx FIFO 4-768");
++
++module_param_named(thr_ctl, dwc_otg_module_params.thr_ctl, int, 0444);
++MODULE_PARM_DESC(thr_ctl,
++		 "Thresholding enable flag bit 0 - non ISO Tx thr., 1 - ISO Tx thr., 2 - Rx thr.- bit 0=disabled 1=enabled");
++module_param_named(tx_thr_length, dwc_otg_module_params.tx_thr_length, int,
++		   0444);
++MODULE_PARM_DESC(tx_thr_length, "Tx Threshold length in 32 bit DWORDs");
++module_param_named(rx_thr_length, dwc_otg_module_params.rx_thr_length, int,
++		   0444);
++MODULE_PARM_DESC(rx_thr_length, "Rx Threshold length in 32 bit DWORDs");
++
++module_param_named(pti_enable, dwc_otg_module_params.pti_enable, int, 0444);
++module_param_named(mpi_enable, dwc_otg_module_params.mpi_enable, int, 0444);
++module_param_named(lpm_enable, dwc_otg_module_params.lpm_enable, int, 0444);
++MODULE_PARM_DESC(lpm_enable, "LPM Enable 0=LPM Disabled 1=LPM Enabled");
++module_param_named(ic_usb_cap, dwc_otg_module_params.ic_usb_cap, int, 0444);
++MODULE_PARM_DESC(ic_usb_cap,
++		 "IC_USB Capability 0=IC_USB Disabled 1=IC_USB Enabled");
++module_param_named(ahb_thr_ratio, dwc_otg_module_params.ahb_thr_ratio, int,
++		   0444);
++MODULE_PARM_DESC(ahb_thr_ratio, "AHB Threshold Ratio");
++module_param_named(power_down, dwc_otg_module_params.power_down, int, 0444);
++MODULE_PARM_DESC(power_down, "Power Down Mode");
++module_param_named(reload_ctl, dwc_otg_module_params.reload_ctl, int, 0444);
++MODULE_PARM_DESC(reload_ctl, "HFIR Reload Control");
++module_param_named(dev_out_nak, dwc_otg_module_params.dev_out_nak, int, 0444);
++MODULE_PARM_DESC(dev_out_nak, "Enable Device OUT NAK");
++module_param_named(cont_on_bna, dwc_otg_module_params.cont_on_bna, int, 0444);
++MODULE_PARM_DESC(cont_on_bna, "Enable Enable Continue on BNA");
++module_param_named(ahb_single, dwc_otg_module_params.ahb_single, int, 0444);
++MODULE_PARM_DESC(ahb_single, "Enable AHB Single Support");
++module_param_named(adp_enable, dwc_otg_module_params.adp_enable, int, 0444);
++MODULE_PARM_DESC(adp_enable, "ADP Enable 0=ADP Disabled 1=ADP Enabled");
++module_param_named(otg_ver, dwc_otg_module_params.otg_ver, int, 0444);
++MODULE_PARM_DESC(otg_ver, "OTG revision supported 0=OTG 1.3 1=OTG 2.0");
++module_param(microframe_schedule, bool, 0444);
++MODULE_PARM_DESC(microframe_schedule, "Enable the microframe scheduler");
++
++module_param(fiq_enable, bool, 0444);
++MODULE_PARM_DESC(fiq_enable, "Enable the FIQ");
++module_param(nak_holdoff, ushort, 0644);
++MODULE_PARM_DESC(nak_holdoff, "Throttle duration for bulk split-transaction endpoints on a NAK. Default 8");
++module_param(fiq_fsm_enable, bool, 0444);
++MODULE_PARM_DESC(fiq_fsm_enable, "Enable the FIQ to perform split transactions as defined by fiq_fsm_mask");
++module_param(fiq_fsm_mask, ushort, 0444);
++MODULE_PARM_DESC(fiq_fsm_mask, "Bitmask of transactions to perform in the FIQ.\n"
++					"Bit 0 : Non-periodic split transactions\n"
++					"Bit 1 : Periodic split transactions\n"
++					"Bit 2 : High-speed multi-transfer isochronous\n"
++					"All other bits should be set 0.");
++module_param(int_ep_interval_min, ushort, 0644);
++MODULE_PARM_DESC(int_ep_interval_min, "Clamp high-speed Interrupt endpoints to a minimum polling interval.\n"
++					"0..1 = Use endpoint default\n"
++					"2..n = Minimum interval n microframes. Use powers of 2.\n");
++
++module_param(cil_force_host, bool, 0644);
++MODULE_PARM_DESC(cil_force_host, "On a connector-ID status change, "
++					"force Host Mode regardless of OTG state.");
++
++/** @page "Module Parameters"
++ *
++ * The following parameters may be specified when starting the module.
++ * These parameters define how the DWC_otg controller should be
++ * configured. Parameter values are passed to the CIL initialization
++ * function dwc_otg_cil_init
++ *
++ * Example: <code>modprobe dwc_otg speed=1 otg_cap=1</code>
++ *
++
++ <table>
++ <tr><td>Parameter Name</td><td>Meaning</td></tr>
++
++ <tr>
++ <td>otg_cap</td>
++ <td>Specifies the OTG capabilities. The driver will automatically detect the
++ value for this parameter if none is specified.
++ - 0: HNP and SRP capable (default, if available)
++ - 1: SRP Only capable
++ - 2: No HNP/SRP capable
++ </td></tr>
++
++ <tr>
++ <td>dma_enable</td>
++ <td>Specifies whether to use slave or DMA mode for accessing the data FIFOs.
++ The driver will automatically detect the value for this parameter if none is
++ specified.
++ - 0: Slave
++ - 1: DMA (default, if available)
++ </td></tr>
++
++ <tr>
++ <td>dma_burst_size</td>
++ <td>The DMA Burst size (applicable only for External DMA Mode).
++ - Values: 1, 4, 8 16, 32, 64, 128, 256 (default 32)
++ </td></tr>
++
++ <tr>
++ <td>speed</td>
++ <td>Specifies the maximum speed of operation in host and device mode. The
++ actual speed depends on the speed of the attached device and the value of
++ phy_type.
++ - 0: High Speed (default)
++ - 1: Full Speed
++ </td></tr>
++
++ <tr>
++ <td>host_support_fs_ls_low_power</td>
++ <td>Specifies whether low power mode is supported when attached to a Full
++ Speed or Low Speed device in host mode.
++ - 0: Don't support low power mode (default)
++ - 1: Support low power mode
++ </td></tr>
++
++ <tr>
++ <td>host_ls_low_power_phy_clk</td>
++ <td>Specifies the PHY clock rate in low power mode when connected to a Low
++ Speed device in host mode. This parameter is applicable only if
++ HOST_SUPPORT_FS_LS_LOW_POWER is enabled.
++ - 0: 48 MHz (default)
++ - 1: 6 MHz
++ </td></tr>
++
++ <tr>
++ <td>enable_dynamic_fifo</td>
++ <td> Specifies whether FIFOs may be resized by the driver software.
++ - 0: Use cC FIFO size parameters
++ - 1: Allow dynamic FIFO sizing (default)
++ </td></tr>
++
++ <tr>
++ <td>data_fifo_size</td>
++ <td>Total number of 4-byte words in the data FIFO memory. This memory
++ includes the Rx FIFO, non-periodic Tx FIFO, and periodic Tx FIFOs.
++ - Values: 32 to 32768 (default 8192)
++
++ Note: The total FIFO memory depth in the FPGA configuration is 8192.
++ </td></tr>
++
++ <tr>
++ <td>dev_rx_fifo_size</td>
++ <td>Number of 4-byte words in the Rx FIFO in device mode when dynamic
++ FIFO sizing is enabled.
++ - Values: 16 to 32768 (default 1064)
++ </td></tr>
++
++ <tr>
++ <td>dev_nperio_tx_fifo_size</td>
++ <td>Number of 4-byte words in the non-periodic Tx FIFO in device mode when
++ dynamic FIFO sizing is enabled.
++ - Values: 16 to 32768 (default 1024)
++ </td></tr>
++
++ <tr>
++ <td>dev_perio_tx_fifo_size_n (n = 1 to 15)</td>
++ <td>Number of 4-byte words in each of the periodic Tx FIFOs in device mode
++ when dynamic FIFO sizing is enabled.
++ - Values: 4 to 768 (default 256)
++ </td></tr>
++
++ <tr>
++ <td>host_rx_fifo_size</td>
++ <td>Number of 4-byte words in the Rx FIFO in host mode when dynamic FIFO
++ sizing is enabled.
++ - Values: 16 to 32768 (default 1024)
++ </td></tr>
++
++ <tr>
++ <td>host_nperio_tx_fifo_size</td>
++ <td>Number of 4-byte words in the non-periodic Tx FIFO in host mode when
++ dynamic FIFO sizing is enabled in the core.
++ - Values: 16 to 32768 (default 1024)
++ </td></tr>
++
++ <tr>
++ <td>host_perio_tx_fifo_size</td>
++ <td>Number of 4-byte words in the host periodic Tx FIFO when dynamic FIFO
++ sizing is enabled.
++ - Values: 16 to 32768 (default 1024)
++ </td></tr>
++
++ <tr>
++ <td>max_transfer_size</td>
++ <td>The maximum transfer size supported in bytes.
++ - Values: 2047 to 65,535 (default 65,535)
++ </td></tr>
++
++ <tr>
++ <td>max_packet_count</td>
++ <td>The maximum number of packets in a transfer.
++ - Values: 15 to 511 (default 511)
++ </td></tr>
++
++ <tr>
++ <td>host_channels</td>
++ <td>The number of host channel registers to use.
++ - Values: 1 to 16 (default 12)
++
++ Note: The FPGA configuration supports a maximum of 12 host channels.
++ </td></tr>
++
++ <tr>
++ <td>dev_endpoints</td>
++ <td>The number of endpoints in addition to EP0 available for device mode
++ operations.
++ - Values: 1 to 15 (default 6 IN and OUT)
++
++ Note: The FPGA configuration supports a maximum of 6 IN and OUT endpoints in
++ addition to EP0.
++ </td></tr>
++
++ <tr>
++ <td>phy_type</td>
++ <td>Specifies the type of PHY interface to use. By default, the driver will
++ automatically detect the phy_type.
++ - 0: Full Speed
++ - 1: UTMI+ (default, if available)
++ - 2: ULPI
++ </td></tr>
++
++ <tr>
++ <td>phy_utmi_width</td>
++ <td>Specifies the UTMI+ Data Width. This parameter is applicable for a
++ phy_type of UTMI+. Also, this parameter is applicable only if the
++ OTG_HSPHY_WIDTH cC parameter was set to "8 and 16 bits", meaning that the
++ core has been configured to work at either data path width.
++ - Values: 8 or 16 bits (default 16)
++ </td></tr>
++
++ <tr>
++ <td>phy_ulpi_ddr</td>
++ <td>Specifies whether the ULPI operates at double or single data rate. This
++ parameter is only applicable if phy_type is ULPI.
++ - 0: single data rate ULPI interface with 8 bit wide data bus (default)
++ - 1: double data rate ULPI interface with 4 bit wide data bus
++ </td></tr>
++
++ <tr>
++ <td>i2c_enable</td>
++ <td>Specifies whether to use the I2C interface for full speed PHY. This
++ parameter is only applicable if PHY_TYPE is FS.
++ - 0: Disabled (default)
++ - 1: Enabled
++ </td></tr>
++
++ <tr>
++ <td>ulpi_fs_ls</td>
++ <td>Specifies whether to use ULPI FS/LS mode only.
++ - 0: Disabled (default)
++ - 1: Enabled
++ </td></tr>
++
++ <tr>
++ <td>ts_dline</td>
++ <td>Specifies whether term select D-Line pulsing for all PHYs is enabled.
++ - 0: Disabled (default)
++ - 1: Enabled
++ </td></tr>
++
++ <tr>
++ <td>en_multiple_tx_fifo</td>
++ <td>Specifies whether dedicatedto tx fifos are enabled for non periodic IN EPs.
++ The driver will automatically detect the value for this parameter if none is
++ specified.
++ - 0: Disabled
++ - 1: Enabled (default, if available)
++ </td></tr>
++
++ <tr>
++ <td>dev_tx_fifo_size_n (n = 1 to 15)</td>
++ <td>Number of 4-byte words in each of the Tx FIFOs in device mode
++ when dynamic FIFO sizing is enabled.
++ - Values: 4 to 768 (default 256)
++ </td></tr>
++
++ <tr>
++ <td>tx_thr_length</td>
++ <td>Transmit Threshold length in 32 bit double words
++ - Values: 8 to 128 (default 64)
++ </td></tr>
++
++ <tr>
++ <td>rx_thr_length</td>
++ <td>Receive Threshold length in 32 bit double words
++ - Values: 8 to 128 (default 64)
++ </td></tr>
++
++<tr>
++ <td>thr_ctl</td>
++ <td>Specifies whether to enable Thresholding for Device mode. Bits 0, 1, 2 of
++ this parmater specifies if thresholding is enabled for non-Iso Tx, Iso Tx and
++ Rx transfers accordingly.
++ The driver will automatically detect the value for this parameter if none is
++ specified.
++ - Values: 0 to 7 (default 0)
++ Bit values indicate:
++ - 0: Thresholding disabled
++ - 1: Thresholding enabled
++ </td></tr>
++
++<tr>
++ <td>dma_desc_enable</td>
++ <td>Specifies whether to enable Descriptor DMA mode.
++ The driver will automatically detect the value for this parameter if none is
++ specified.
++ - 0: Descriptor DMA disabled
++ - 1: Descriptor DMA (default, if available)
++ </td></tr>
++
++<tr>
++ <td>mpi_enable</td>
++ <td>Specifies whether to enable MPI enhancement mode.
++ The driver will automatically detect the value for this parameter if none is
++ specified.
++ - 0: MPI disabled (default)
++ - 1: MPI enable
++ </td></tr>
++
++<tr>
++ <td>pti_enable</td>
++ <td>Specifies whether to enable PTI enhancement support.
++ The driver will automatically detect the value for this parameter if none is
++ specified.
++ - 0: PTI disabled (default)
++ - 1: PTI enable
++ </td></tr>
++
++<tr>
++ <td>lpm_enable</td>
++ <td>Specifies whether to enable LPM support.
++ The driver will automatically detect the value for this parameter if none is
++ specified.
++ - 0: LPM disabled
++ - 1: LPM enable (default, if available)
++ </td></tr>
++
++<tr>
++ <td>ic_usb_cap</td>
++ <td>Specifies whether to enable IC_USB capability.
++ The driver will automatically detect the value for this parameter if none is
++ specified.
++ - 0: IC_USB disabled (default, if available)
++ - 1: IC_USB enable
++ </td></tr>
++
++<tr>
++ <td>ahb_thr_ratio</td>
++ <td>Specifies AHB Threshold ratio.
++ - Values: 0 to 3 (default 0)
++ </td></tr>
++
++<tr>
++ <td>power_down</td>
++ <td>Specifies Power Down(Hibernation) Mode.
++ The driver will automatically detect the value for this parameter if none is
++ specified.
++ - 0: Power Down disabled (default)
++ - 2: Power Down enabled
++ </td></tr>
++
++ <tr>
++ <td>reload_ctl</td>
++ <td>Specifies whether dynamic reloading of the HFIR register is allowed during
++ run time. The driver will automatically detect the value for this parameter if
++ none is specified. In case the HFIR value is reloaded when HFIR.RldCtrl == 1'b0
++ the core might misbehave.
++ - 0: Reload Control disabled (default)
++ - 1: Reload Control enabled
++ </td></tr>
++
++ <tr>
++ <td>dev_out_nak</td>
++ <td>Specifies whether  Device OUT NAK enhancement enabled or no.
++ The driver will automatically detect the value for this parameter if
++ none is specified. This parameter is valid only when OTG_EN_DESC_DMA == 1b1.
++ - 0: The core does not set NAK after Bulk OUT transfer complete (default)
++ - 1: The core sets NAK after Bulk OUT transfer complete
++ </td></tr>
++
++ <tr>
++ <td>cont_on_bna</td>
++ <td>Specifies whether Enable Continue on BNA enabled or no.
++ After receiving BNA interrupt the core disables the endpoint,when the
++ endpoint is re-enabled by the application the
++ - 0: Core starts processing from the DOEPDMA descriptor (default)
++ - 1: Core starts processing from the descriptor which received the BNA.
++ This parameter is valid only when OTG_EN_DESC_DMA == 1b1.
++ </td></tr>
++
++ <tr>
++ <td>ahb_single</td>
++ <td>This bit when programmed supports SINGLE transfers for remainder data
++ in a transfer for DMA mode of operation.
++ - 0: The remainder data will be sent using INCR burst size (default)
++ - 1: The remainder data will be sent using SINGLE burst size.
++ </td></tr>
++
++<tr>
++ <td>adp_enable</td>
++ <td>Specifies whether ADP feature is enabled.
++ The driver will automatically detect the value for this parameter if none is
++ specified.
++ - 0: ADP feature disabled (default)
++ - 1: ADP feature enabled
++ </td></tr>
++
++  <tr>
++ <td>otg_ver</td>
++ <td>Specifies whether OTG is performing as USB OTG Revision 2.0 or Revision 1.3
++ USB OTG device.
++ - 0: OTG 2.0 support disabled (default)
++ - 1: OTG 2.0 support enabled
++ </td></tr>
++
++*/
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_driver.h
+@@ -0,0 +1,86 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_driver.h $
++ * $Revision: #19 $
++ * $Date: 2010/11/15 $
++ * $Change: 1627671 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++#ifndef __DWC_OTG_DRIVER_H__
++#define __DWC_OTG_DRIVER_H__
++
++/** @file
++ * This file contains the interface to the Linux driver.
++ */
++#include "dwc_otg_os_dep.h"
++#include "dwc_otg_core_if.h"
++
++/* Type declarations */
++struct dwc_otg_pcd;
++struct dwc_otg_hcd;
++
++/**
++ * This structure is a wrapper that encapsulates the driver components used to
++ * manage a single DWC_otg controller.
++ */
++typedef struct dwc_otg_device {
++	/** Structure containing OS-dependent stuff. KEEP THIS STRUCT AT THE
++	 * VERY BEGINNING OF THE DEVICE STRUCT. OSes such as FreeBSD and NetBSD
++	 * require this. */
++	struct os_dependent os_dep;
++
++	/** Pointer to the core interface structure. */
++	dwc_otg_core_if_t *core_if;
++
++	/** Pointer to the PCD structure. */
++	struct dwc_otg_pcd *pcd;
++
++	/** Pointer to the HCD structure. */
++	struct dwc_otg_hcd *hcd;
++
++	/** Flag to indicate whether the common IRQ handler is installed. */
++	uint8_t common_irq_installed;
++
++} dwc_otg_device_t;
++
++/*We must clear S3C24XX_EINTPEND external interrupt register
++ * because after clearing in this register trigerred IRQ from
++ * H/W core in kernel interrupt can be occured again before OTG
++ * handlers clear all IRQ sources of Core registers because of
++ * timing latencies and Low Level IRQ Type.
++ */
++#ifdef CONFIG_MACH_IPMATE
++#define  S3C2410X_CLEAR_EINTPEND()   \
++do { \
++	__raw_writel(1UL << 11,S3C24XX_EINTPEND); \
++} while (0)
++#else
++#define  S3C2410X_CLEAR_EINTPEND()   do { } while (0)
++#endif
++
++#endif
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c
+@@ -0,0 +1,1434 @@
++/*
++ * dwc_otg_fiq_fsm.c - The finite state machine FIQ
++ *
++ * Copyright (c) 2013 Raspberry Pi Foundation
++ *
++ * Author: Jonathan Bell <jonathan@raspberrypi.org>
++ * All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions are met:
++ *	* Redistributions of source code must retain the above copyright
++ *	  notice, this list of conditions and the following disclaimer.
++ *	* Redistributions in binary form must reproduce the above copyright
++ *	  notice, this list of conditions and the following disclaimer in the
++ *	  documentation and/or other materials provided with the distribution.
++ *	* Neither the name of Raspberry Pi nor the
++ *	  names of its contributors may be used to endorse or promote products
++ *	  derived from this software without specific prior written permission.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
++ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
++ * DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY
++ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
++ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ * This FIQ implements functionality that performs split transactions on
++ * the dwc_otg hardware without any outside intervention. A split transaction
++ * is "queued" by nominating a specific host channel to perform the entirety
++ * of a split transaction. This FIQ will then perform the microframe-precise
++ * scheduling required in each phase of the transaction until completion.
++ *
++ * The FIQ functionality is glued into the Synopsys driver via the entry point
++ * in the FSM enqueue function, and at the exit point in handling a HC interrupt
++ * for a FSM-enabled channel.
++ *
++ * NB: Large parts of this implementation have architecture-specific code.
++ * For porting this functionality to other ARM machines, the minimum is required:
++ * - An interrupt controller allowing the top-level dwc USB interrupt to be routed
++ *   to the FIQ
++ * - A method of forcing a software generated interrupt from FIQ mode that then
++ *   triggers an IRQ entry (with the dwc USB handler called by this IRQ number)
++ * - Guaranteed interrupt routing such that both the FIQ and SGI occur on the same
++ *   processor core - there is no locking between the FIQ and IRQ (aside from
++ *   local_fiq_disable)
++ *
++ */
++
++#include "dwc_otg_fiq_fsm.h"
++
++
++char buffer[1000*16];
++int wptr;
++void notrace _fiq_print(enum fiq_debug_level dbg_lvl, volatile struct fiq_state *state, char *fmt, ...)
++{
++	enum fiq_debug_level dbg_lvl_req = FIQDBG_ERR;
++	va_list args;
++	char text[17];
++	hfnum_data_t hfnum = { .d32 = FIQ_READ(state->dwc_regs_base + 0x408) };
++
++	if((dbg_lvl & dbg_lvl_req) || dbg_lvl == FIQDBG_ERR)
++	{
++		snprintf(text, 9, " %4d:%1u  ", hfnum.b.frnum/8, hfnum.b.frnum & 7);
++		va_start(args, fmt);
++		vsnprintf(text+8, 9, fmt, args);
++		va_end(args);
++
++		memcpy(buffer + wptr, text, 16);
++		wptr = (wptr + 16) % sizeof(buffer);
++	}
++}
++
++
++#ifdef CONFIG_ARM64
++
++inline void fiq_fsm_spin_lock(fiq_lock_t *lock)
++{
++	spin_lock((spinlock_t *)lock);
++}
++
++inline void fiq_fsm_spin_unlock(fiq_lock_t *lock)
++{
++	spin_unlock((spinlock_t *)lock);
++}
++
++#else
++
++/**
++ * fiq_fsm_spin_lock() - ARMv6+ bare bones spinlock
++ * Must be called with local interrupts and FIQ disabled.
++ */
++#if defined(CONFIG_ARCH_BCM2835) && defined(CONFIG_SMP)
++inline void fiq_fsm_spin_lock(fiq_lock_t *lock)
++{
++	unsigned long tmp;
++	uint32_t newval;
++	fiq_lock_t lockval;
++	/* Nested locking, yay. If we are on the same CPU as the fiq, then the disable
++	 * will be sufficient. If we are on a different CPU, then the lock protects us. */
++	prefetchw(&lock->slock);
++	asm volatile (
++	"1:     ldrex   %0, [%3]\n"
++	"       add     %1, %0, %4\n"
++	"       strex   %2, %1, [%3]\n"
++	"       teq     %2, #0\n"
++	"       bne     1b"
++	: "=&r" (lockval), "=&r" (newval), "=&r" (tmp)
++	: "r" (&lock->slock), "I" (1 << 16)
++	: "cc");
++
++	while (lockval.tickets.next != lockval.tickets.owner) {
++		wfe();
++		lockval.tickets.owner = READ_ONCE(lock->tickets.owner);
++	}
++	smp_mb();
++}
++#else
++inline void fiq_fsm_spin_lock(fiq_lock_t *lock) { }
++#endif
++
++/**
++ * fiq_fsm_spin_unlock() - ARMv6+ bare bones spinunlock
++ */
++#if defined(CONFIG_ARCH_BCM2835) && defined(CONFIG_SMP)
++inline void fiq_fsm_spin_unlock(fiq_lock_t *lock)
++{
++	smp_mb();
++	lock->tickets.owner++;
++	dsb_sev();
++}
++#else
++inline void fiq_fsm_spin_unlock(fiq_lock_t *lock) { }
++#endif
++
++#endif
++
++/**
++ * fiq_fsm_restart_channel() - Poke channel enable bit for a split transaction
++ * @channel: channel to re-enable
++ */
++static void notrace fiq_fsm_restart_channel(struct fiq_state *st, int n, int force)
++{
++	hcchar_data_t hcchar = { .d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR) };
++
++	hcchar.b.chen = 0;
++	if (st->channel[n].hcchar_copy.b.eptype & 0x1) {
++		hfnum_data_t hfnum = { .d32 = FIQ_READ(st->dwc_regs_base + HFNUM) };
++		/* Hardware bug workaround: update the ssplit index */
++		if (st->channel[n].hcsplt_copy.b.spltena)
++			st->channel[n].expected_uframe = (hfnum.b.frnum + 1) & 0x3FFF;
++
++		hcchar.b.oddfrm = (hfnum.b.frnum & 0x1) ? 0	: 1;
++	}
++
++	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR, hcchar.d32);
++	hcchar.d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR);
++	hcchar.b.chen = 1;
++
++	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR, hcchar.d32);
++	fiq_print(FIQDBG_INT, st, "HCGO %01d %01d", n, force);
++}
++
++/**
++ * fiq_fsm_setup_csplit() - Prepare a host channel for a CSplit transaction stage
++ * @st: Pointer to the channel's state
++ * @n : channel number
++ *
++ * Change host channel registers to perform a complete-split transaction. Being mindful of the
++ * endpoint direction, set control regs up correctly.
++ */
++static void notrace fiq_fsm_setup_csplit(struct fiq_state *st, int n)
++{
++	hcsplt_data_t hcsplt = { .d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCSPLT) };
++	hctsiz_data_t hctsiz = { .d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ) };
++
++	hcsplt.b.compsplt = 1;
++	if (st->channel[n].hcchar_copy.b.epdir == 1) {
++		// If IN, the CSPLIT result contains the data or a hub handshake. hctsiz = maxpacket.
++		hctsiz.b.xfersize = st->channel[n].hctsiz_copy.b.xfersize;
++	} else {
++		// If OUT, the CSPLIT result contains handshake only.
++		hctsiz.b.xfersize = 0;
++	}
++	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCSPLT, hcsplt.d32);
++	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ, hctsiz.d32);
++	mb();
++}
++
++/**
++ * fiq_fsm_restart_np_pending() - Restart a single non-periodic contended transfer
++ * @st: Pointer to the channel's state
++ * @num_channels: Total number of host channels
++ * @orig_channel: Channel index of completed transfer
++ *
++ * In the case where an IN and OUT transfer are simultaneously scheduled to the
++ * same device/EP, inadequate hub implementations will misbehave. Once the first
++ * transfer is complete, a pending non-periodic split can then be issued.
++ */
++static void notrace fiq_fsm_restart_np_pending(struct fiq_state *st, int num_channels, int orig_channel)
++{
++	int i;
++	int dev_addr = st->channel[orig_channel].hcchar_copy.b.devaddr;
++	int ep_num = st->channel[orig_channel].hcchar_copy.b.epnum;
++	for (i = 0; i < num_channels; i++) {
++		if (st->channel[i].fsm == FIQ_NP_SSPLIT_PENDING &&
++			st->channel[i].hcchar_copy.b.devaddr == dev_addr &&
++			st->channel[i].hcchar_copy.b.epnum == ep_num) {
++			st->channel[i].fsm = FIQ_NP_SSPLIT_STARTED;
++			fiq_fsm_restart_channel(st, i, 0);
++			break;
++		}
++	}
++}
++
++static inline int notrace fiq_get_xfer_len(struct fiq_state *st, int n)
++{
++	/* The xfersize register is a bit wonky. For IN transfers, it decrements by the packet size. */
++	hctsiz_data_t hctsiz = { .d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ) };
++
++	if (st->channel[n].hcchar_copy.b.epdir == 0) {
++		return st->channel[n].hctsiz_copy.b.xfersize;
++	} else {
++		return st->channel[n].hctsiz_copy.b.xfersize - hctsiz.b.xfersize;
++	}
++
++}
++
++
++/**
++ * fiq_increment_dma_buf() - update DMA address for bounce buffers after a CSPLIT
++ *
++ * Of use only for IN periodic transfers.
++ */
++static int notrace fiq_increment_dma_buf(struct fiq_state *st, int num_channels, int n)
++{
++	hcdma_data_t hcdma;
++	int i = st->channel[n].dma_info.index;
++	int len;
++	struct fiq_dma_channel *split_dma =
++		(struct fiq_dma_channel *)(uintptr_t)st->dma_base;
++
++	len = fiq_get_xfer_len(st, n);
++	fiq_print(FIQDBG_INT, st, "LEN: %03d", len);
++	st->channel[n].dma_info.slot_len[i] = len;
++	i++;
++	if (i > 6)
++		BUG();
++
++	hcdma.d32 = lower_32_bits((uintptr_t)&split_dma[n].index[i].buf[0]);
++	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HC_DMA, hcdma.d32);
++	st->channel[n].dma_info.index = i;
++	return 0;
++}
++
++/**
++ * fiq_reload_hctsiz() - for IN transactions, reset HCTSIZ
++ */
++static void notrace fiq_fsm_reload_hctsiz(struct fiq_state *st, int n)
++{
++	hctsiz_data_t hctsiz = { .d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ) };
++	hctsiz.b.xfersize = st->channel[n].hctsiz_copy.b.xfersize;
++	hctsiz.b.pktcnt = 1;
++	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ, hctsiz.d32);
++}
++
++/**
++ * fiq_fsm_reload_hcdma() - for OUT transactions, rewind DMA pointer
++ */
++static void notrace fiq_fsm_reload_hcdma(struct fiq_state *st, int n)
++{
++	hcdma_data_t hcdma = st->channel[n].hcdma_copy;
++	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HC_DMA, hcdma.d32);
++}
++
++/**
++ * fiq_iso_out_advance() - update DMA address and split position bits
++ * for isochronous OUT transactions.
++ *
++ * Returns 1 if this is the last packet queued, 0 otherwise. Split-ALL and
++ * Split-BEGIN states are not handled - this is done when the transaction was queued.
++ *
++ * This function must only be called from the FIQ_ISO_OUT_ACTIVE state.
++ */
++static int notrace fiq_iso_out_advance(struct fiq_state *st, int num_channels, int n)
++{
++	hcsplt_data_t hcsplt;
++	hctsiz_data_t hctsiz;
++	hcdma_data_t hcdma;
++	struct fiq_dma_channel *split_dma =
++		(struct fiq_dma_channel *)(uintptr_t)st->dma_base;
++	int last = 0;
++	int i = st->channel[n].dma_info.index;
++
++	fiq_print(FIQDBG_INT, st, "ADV %01d %01d ", n, i);
++	i++;
++	if (i == 4)
++		last = 1;
++	if (st->channel[n].dma_info.slot_len[i+1] == 255)
++		last = 1;
++
++	/* New DMA address - address of bounce buffer referred to in index */
++	hcdma.d32 = lower_32_bits((uintptr_t)&split_dma[n].index[i].buf[0]);
++	//hcdma.d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HC_DMA);
++	//hcdma.d32 += st->channel[n].dma_info.slot_len[i];
++	fiq_print(FIQDBG_INT, st, "LAST: %01d ", last);
++	fiq_print(FIQDBG_INT, st, "LEN: %03d", st->channel[n].dma_info.slot_len[i]);
++	hcsplt.d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCSPLT);
++	hctsiz.d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ);
++	hcsplt.b.xactpos = (last) ? ISOC_XACTPOS_END : ISOC_XACTPOS_MID;
++	/* Set up new packet length */
++	hctsiz.b.pktcnt = 1;
++	hctsiz.b.xfersize = st->channel[n].dma_info.slot_len[i];
++	fiq_print(FIQDBG_INT, st, "%08x", hctsiz.d32);
++
++	st->channel[n].dma_info.index++;
++	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCSPLT, hcsplt.d32);
++	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ, hctsiz.d32);
++	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HC_DMA, hcdma.d32);
++	return last;
++}
++
++/**
++ * fiq_fsm_tt_next_isoc() - queue next pending isochronous out start-split on a TT
++ *
++ * Despite the limitations of the DWC core, we can force a microframe pipeline of
++ * isochronous OUT start-split transactions while waiting for a corresponding other-type
++ * of endpoint to finish its CSPLITs. TTs have big periodic buffers therefore it
++ * is very unlikely that filling the start-split FIFO will cause data loss.
++ * This allows much better interleaving of transactions in an order-independent way-
++ * there is no requirement to prioritise isochronous, just a state-space search has
++ * to be performed on each periodic start-split complete interrupt.
++ */
++static int notrace fiq_fsm_tt_next_isoc(struct fiq_state *st, int num_channels, int n)
++{
++	int hub_addr = st->channel[n].hub_addr;
++	int port_addr = st->channel[n].port_addr;
++	int i, poked = 0;
++	for (i = 0; i < num_channels; i++) {
++		if (i == n || st->channel[i].fsm == FIQ_PASSTHROUGH)
++			continue;
++		if (st->channel[i].hub_addr == hub_addr &&
++			st->channel[i].port_addr == port_addr) {
++			switch (st->channel[i].fsm) {
++			case FIQ_PER_ISO_OUT_PENDING:
++				if (st->channel[i].nrpackets == 1) {
++					st->channel[i].fsm = FIQ_PER_ISO_OUT_LAST;
++				} else {
++					st->channel[i].fsm = FIQ_PER_ISO_OUT_ACTIVE;
++				}
++				fiq_fsm_restart_channel(st, i, 0);
++				poked = 1;
++				break;
++
++			default:
++				break;
++			}
++		}
++		if (poked)
++			break;
++	}
++	return poked;
++}
++
++/**
++ * fiq_fsm_tt_in_use() - search for host channels using this TT
++ * @n: Channel to use as reference
++ *
++ */
++int notrace noinline fiq_fsm_tt_in_use(struct fiq_state *st, int num_channels, int n)
++{
++	int hub_addr = st->channel[n].hub_addr;
++	int port_addr = st->channel[n].port_addr;
++	int i, in_use = 0;
++	for (i = 0; i < num_channels; i++) {
++		if (i == n || st->channel[i].fsm == FIQ_PASSTHROUGH)
++			continue;
++		switch (st->channel[i].fsm) {
++		/* TT is reserved for channels that are in the middle of a periodic
++		 * split transaction.
++		 */
++		case FIQ_PER_SSPLIT_STARTED:
++		case FIQ_PER_CSPLIT_WAIT:
++		case FIQ_PER_CSPLIT_NYET1:
++		//case FIQ_PER_CSPLIT_POLL:
++		case FIQ_PER_ISO_OUT_ACTIVE:
++		case FIQ_PER_ISO_OUT_LAST:
++			if (st->channel[i].hub_addr == hub_addr &&
++				st->channel[i].port_addr == port_addr) {
++				in_use = 1;
++			}
++			break;
++		default:
++			break;
++		}
++		if (in_use)
++			break;
++	}
++	return in_use;
++}
++
++/**
++ * fiq_fsm_more_csplits() - determine whether additional CSPLITs need
++ * 			to be issued for this IN transaction.
++ *
++ * We cannot tell the inbound PID of a data packet due to hardware limitations.
++ * we need to make an educated guess as to whether we need to queue another CSPLIT
++ * or not. A no-brainer is when we have received enough data to fill the endpoint
++ * size, but for endpoints that give variable-length data then we have to resort
++ * to heuristics.
++ *
++ * We also return whether this is the last CSPLIT to be queued, again based on
++ * heuristics. This is to allow a 1-uframe overlap of periodic split transactions.
++ * Note: requires at least 1 CSPLIT to have been performed prior to being called.
++ */
++
++/*
++ * We need some way of guaranteeing if a returned periodic packet of size X
++ * has a DATA0 PID.
++ * The heuristic value of 144 bytes assumes that the received data has maximal
++ * bit-stuffing and the clock frequency of the transmitting device is at the lowest
++ * permissible limit. If the transfer length results in a final packet size
++ * 144 < p <= 188, then an erroneous CSPLIT will be issued.
++ * Also used to ensure that an endpoint will nominally only return a single
++ * complete-split worth of data.
++ */
++#define DATA0_PID_HEURISTIC 144
++
++static int notrace noinline fiq_fsm_more_csplits(struct fiq_state *state, int n, int *probably_last)
++{
++
++	int i;
++	int total_len = 0;
++	int more_needed = 1;
++	struct fiq_channel_state *st = &state->channel[n];
++
++	for (i = 0; i < st->dma_info.index; i++) {
++			total_len += st->dma_info.slot_len[i];
++	}
++
++	*probably_last = 0;
++
++	if (st->hcchar_copy.b.eptype == 0x3) {
++		/*
++		 * An interrupt endpoint will take max 2 CSPLITs. if we are receiving data
++		 * then this is definitely the last CSPLIT.
++		 */
++		*probably_last = 1;
++	} else {
++		/* Isoc IN. This is a bit risky if we are the first transaction:
++		 * we may have been held off slightly. */
++		if (i > 1 && st->dma_info.slot_len[st->dma_info.index-1] <= DATA0_PID_HEURISTIC) {
++			more_needed = 0;
++		}
++		/* If in the next uframe we will receive enough data to fill the endpoint,
++		 * then only issue 1 more csplit.
++		 */
++		if (st->hctsiz_copy.b.xfersize - total_len <= DATA0_PID_HEURISTIC)
++			*probably_last = 1;
++	}
++
++	if (total_len >= st->hctsiz_copy.b.xfersize ||
++		i == 6 || total_len == 0)
++		/* Note: due to bit stuffing it is possible to have > 6 CSPLITs for
++		 * a single endpoint. Accepting more would completely break our scheduling mechanism though
++		 * - in these extreme cases we will pass through a truncated packet.
++		 */
++		more_needed = 0;
++
++	return more_needed;
++}
++
++/**
++ * fiq_fsm_too_late() - Test transaction for lateness
++ *
++ * If a SSPLIT for a large IN transaction is issued too late in a frame,
++ * the hub will disable the port to the device and respond with ERR handshakes.
++ * The hub status endpoint will not reflect this change.
++ * Returns 1 if we will issue a SSPLIT that will result in a device babble.
++ */
++int notrace fiq_fsm_too_late(struct fiq_state *st, int n)
++{
++	int uframe;
++	hfnum_data_t hfnum = { .d32 = FIQ_READ(st->dwc_regs_base + HFNUM) };
++	uframe = hfnum.b.frnum & 0x7;
++	if ((uframe < 6) && (st->channel[n].nrpackets + 1 + uframe > 7)) {
++		return 1;
++	} else {
++		return 0;
++	}
++}
++
++
++/**
++ * fiq_fsm_start_next_periodic() - A half-arsed attempt at a microframe pipeline
++ *
++ * Search pending transactions in the start-split pending state and queue them.
++ * Don't queue packets in uframe .5 (comes out in .6) (USB2.0 11.18.4).
++ * Note: we specifically don't do isochronous OUT transactions first because better
++ * use of the TT's start-split fifo can be achieved by pipelining an IN before an OUT.
++ */
++static void notrace noinline fiq_fsm_start_next_periodic(struct fiq_state *st, int num_channels)
++{
++	int n;
++	hfnum_data_t hfnum = { .d32 = FIQ_READ(st->dwc_regs_base + HFNUM) };
++	if ((hfnum.b.frnum & 0x7) == 5)
++		return;
++	for (n = 0; n < num_channels; n++) {
++		if (st->channel[n].fsm == FIQ_PER_SSPLIT_QUEUED) {
++			/* Check to see if any other transactions are using this TT */
++			if(!fiq_fsm_tt_in_use(st, num_channels, n)) {
++				if (!fiq_fsm_too_late(st, n)) {
++					st->channel[n].fsm = FIQ_PER_SSPLIT_STARTED;
++					fiq_print(FIQDBG_INT, st, "NEXTPER ");
++					fiq_fsm_restart_channel(st, n, 0);
++				} else {
++					st->channel[n].fsm = FIQ_PER_SPLIT_TIMEOUT;
++				}
++				break;
++			}
++		}
++	}
++	for (n = 0; n < num_channels; n++) {
++		if (st->channel[n].fsm == FIQ_PER_ISO_OUT_PENDING) {
++			if (!fiq_fsm_tt_in_use(st, num_channels, n)) {
++				fiq_print(FIQDBG_INT, st, "NEXTISO ");
++				if (st->channel[n].nrpackets == 1)
++					st->channel[n].fsm = FIQ_PER_ISO_OUT_LAST;
++				else
++					st->channel[n].fsm = FIQ_PER_ISO_OUT_ACTIVE;
++				fiq_fsm_restart_channel(st, n, 0);
++				break;
++			}
++		}
++	}
++}
++
++/**
++ * fiq_fsm_update_hs_isoc() - update isochronous frame and transfer data
++ * @state:	Pointer to fiq_state
++ * @n:		Channel transaction is active on
++ * @hcint:	Copy of host channel interrupt register
++ *
++ * Returns 0 if there are no more transactions for this HC to do, 1
++ * otherwise.
++ */
++static int notrace noinline fiq_fsm_update_hs_isoc(struct fiq_state *state, int n, hcint_data_t hcint)
++{
++	struct fiq_channel_state *st = &state->channel[n];
++	int xfer_len = 0, nrpackets = 0;
++	hcdma_data_t hcdma;
++	fiq_print(FIQDBG_INT, state, "HSISO %02d", n);
++
++	xfer_len = fiq_get_xfer_len(state, n);
++	st->hs_isoc_info.iso_desc[st->hs_isoc_info.index].actual_length = xfer_len;
++
++	st->hs_isoc_info.iso_desc[st->hs_isoc_info.index].status = hcint.d32;
++
++	st->hs_isoc_info.index++;
++	if (st->hs_isoc_info.index == st->hs_isoc_info.nrframes) {
++		return 0;
++	}
++
++	/* grab the next DMA address offset from the array */
++	hcdma.d32 = st->hcdma_copy.d32 + st->hs_isoc_info.iso_desc[st->hs_isoc_info.index].offset;
++	FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HC_DMA, hcdma.d32);
++
++	/* We need to set multi_count. This is a bit tricky - has to be set per-transaction as
++	 * the core needs to be told to send the correct number. Caution: for IN transfers,
++	 * this is always set to the maximum size of the endpoint. */
++	xfer_len = st->hs_isoc_info.iso_desc[st->hs_isoc_info.index].length;
++	/* Integer divide in a FIQ: fun. FIXME: make this not suck */
++	nrpackets = (xfer_len + st->hcchar_copy.b.mps - 1) / st->hcchar_copy.b.mps;
++	if (nrpackets == 0)
++		nrpackets = 1;
++	st->hcchar_copy.b.multicnt = nrpackets;
++	st->hctsiz_copy.b.pktcnt = nrpackets;
++
++	/* Initial PID also needs to be set */
++	if (st->hcchar_copy.b.epdir == 0) {
++		st->hctsiz_copy.b.xfersize = xfer_len;
++		switch (st->hcchar_copy.b.multicnt) {
++		case 1:
++			st->hctsiz_copy.b.pid = DWC_PID_DATA0;
++			break;
++		case 2:
++		case 3:
++			st->hctsiz_copy.b.pid = DWC_PID_MDATA;
++			break;
++		}
++
++	} else {
++		st->hctsiz_copy.b.xfersize = nrpackets * st->hcchar_copy.b.mps;
++		switch (st->hcchar_copy.b.multicnt) {
++		case 1:
++			st->hctsiz_copy.b.pid = DWC_PID_DATA0;
++			break;
++		case 2:
++			st->hctsiz_copy.b.pid = DWC_PID_DATA1;
++			break;
++		case 3:
++			st->hctsiz_copy.b.pid = DWC_PID_DATA2;
++			break;
++		}
++	}
++	FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ, st->hctsiz_copy.d32);
++	FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR, st->hcchar_copy.d32);
++	/* Channel is enabled on hcint handler exit */
++	fiq_print(FIQDBG_INT, state, "HSISOOUT");
++	return 1;
++}
++
++
++/**
++ * fiq_fsm_do_sof() - FSM start-of-frame interrupt handler
++ * @state:	Pointer to the state struct passed from banked FIQ mode registers.
++ * @num_channels:	set according to the DWC hardware configuration
++ *
++ * The SOF handler in FSM mode has two functions
++ * 1. Hold off SOF from causing schedule advancement in IRQ context if there's
++ *    nothing to do
++ * 2. Advance certain FSM states that require either a microframe delay, or a microframe
++ *    of holdoff.
++ *
++ * The second part is architecture-specific to mach-bcm2835 -
++ * a sane interrupt controller would have a mask register for ARM interrupt sources
++ * to be promoted to the nFIQ line, but it doesn't. Instead a single interrupt
++ * number (USB) can be enabled. This means that certain parts of the USB specification
++ * that require "wait a little while, then issue another packet" cannot be fulfilled with
++ * the timing granularity required to achieve optimal throughout. The workaround is to use
++ * the SOF "timer" (125uS) to perform this task.
++ */
++static int notrace noinline fiq_fsm_do_sof(struct fiq_state *state, int num_channels)
++{
++	hfnum_data_t hfnum = { .d32 = FIQ_READ(state->dwc_regs_base + HFNUM) };
++	int n;
++	int kick_irq = 0;
++
++	if ((hfnum.b.frnum & 0x7) == 1) {
++		/* We cannot issue csplits for transactions in the last frame past (n+1).1
++		 * Check to see if there are any transactions that are stale.
++		 * Boot them out.
++		 */
++		for (n = 0; n < num_channels; n++) {
++			switch (state->channel[n].fsm) {
++			case FIQ_PER_CSPLIT_WAIT:
++			case FIQ_PER_CSPLIT_NYET1:
++			case FIQ_PER_CSPLIT_POLL:
++			case FIQ_PER_CSPLIT_LAST:
++				/* Check if we are no longer in the same full-speed frame. */
++				if (((state->channel[n].expected_uframe & 0x3FFF) & ~0x7) <
++						(hfnum.b.frnum & ~0x7))
++					state->channel[n].fsm = FIQ_PER_SPLIT_TIMEOUT;
++				break;
++			default:
++				break;
++			}
++		}
++	}
++
++	for (n = 0; n < num_channels; n++) {
++		switch (state->channel[n].fsm) {
++
++		case FIQ_NP_SSPLIT_RETRY:
++		case FIQ_NP_IN_CSPLIT_RETRY:
++		case FIQ_NP_OUT_CSPLIT_RETRY:
++			fiq_fsm_restart_channel(state, n, 0);
++			break;
++
++		case FIQ_HS_ISOC_SLEEPING:
++			/* Is it time to wake this channel yet? */
++			if (--state->channel[n].uframe_sleeps == 0) {
++				state->channel[n].fsm = FIQ_HS_ISOC_TURBO;
++				fiq_fsm_restart_channel(state, n, 0);
++			}
++			break;
++
++		case FIQ_PER_SSPLIT_QUEUED:
++			if ((hfnum.b.frnum & 0x7) == 5)
++				break;
++			if(!fiq_fsm_tt_in_use(state, num_channels, n)) {
++				if (!fiq_fsm_too_late(state, n)) {
++					fiq_print(FIQDBG_INT, state, "SOF GO %01d", n);
++					fiq_fsm_restart_channel(state, n, 0);
++					state->channel[n].fsm = FIQ_PER_SSPLIT_STARTED;
++				} else {
++					/* Transaction cannot be started without risking a device babble error */
++					state->channel[n].fsm = FIQ_PER_SPLIT_TIMEOUT;
++					state->haintmsk_saved.b2.chint &= ~(1 << n);
++					FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCINTMSK, 0);
++					kick_irq |= 1;
++				}
++			}
++			break;
++
++		case FIQ_PER_ISO_OUT_PENDING:
++			/* Ordinarily, this should be poked after the SSPLIT
++			 * complete interrupt for a competing transfer on the same
++			 * TT. Doesn't happen for aborted transactions though.
++			 */
++			if ((hfnum.b.frnum & 0x7) >= 5)
++				break;
++			if (!fiq_fsm_tt_in_use(state, num_channels, n)) {
++				/* Hardware bug. SOF can sometimes occur after the channel halt interrupt
++				 * that caused this.
++				 */
++					fiq_fsm_restart_channel(state, n, 0);
++					fiq_print(FIQDBG_INT, state, "SOF ISOC");
++					if (state->channel[n].nrpackets == 1) {
++						state->channel[n].fsm = FIQ_PER_ISO_OUT_LAST;
++					} else {
++						state->channel[n].fsm = FIQ_PER_ISO_OUT_ACTIVE;
++					}
++			}
++			break;
++
++		case FIQ_PER_CSPLIT_WAIT:
++			/* we are guaranteed to be in this state if and only if the SSPLIT interrupt
++			 * occurred when the bus transaction occurred. The SOF interrupt reversal bug
++			 * will utterly bugger this up though.
++			 */
++			if (hfnum.b.frnum != state->channel[n].expected_uframe) {
++				fiq_print(FIQDBG_INT, state, "SOFCS %d ", n);
++				state->channel[n].fsm = FIQ_PER_CSPLIT_POLL;
++				fiq_fsm_restart_channel(state, n, 0);
++				fiq_fsm_start_next_periodic(state, num_channels);
++
++			}
++			break;
++
++		case FIQ_PER_SPLIT_TIMEOUT:
++		case FIQ_DEQUEUE_ISSUED:
++			/* Ugly: we have to force a HCD interrupt.
++			 * Poke the mask for the channel in question.
++			 * We will take a fake SOF because of this, but
++			 * that's OK.
++			 */
++			state->haintmsk_saved.b2.chint &= ~(1 << n);
++			FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCINTMSK, 0);
++			kick_irq |= 1;
++			break;
++
++		default:
++			break;
++		}
++	}
++
++	if (state->kick_np_queues ||
++			dwc_frame_num_le(state->next_sched_frame, hfnum.b.frnum))
++		kick_irq |= 1;
++
++	return !kick_irq;
++}
++
++
++/**
++ * fiq_fsm_do_hcintr() - FSM host channel interrupt handler
++ * @state: Pointer to the FIQ state struct
++ * @num_channels: Number of channels as per hardware config
++ * @n: channel for which HAINT(i) was raised
++ *
++ * An important property is that only the CHHLT interrupt is unmasked. Unfortunately, AHBerr is as well.
++ */
++static int notrace noinline fiq_fsm_do_hcintr(struct fiq_state *state, int num_channels, int n)
++{
++	hcint_data_t hcint;
++	hcintmsk_data_t hcintmsk;
++	hcint_data_t hcint_probe;
++	hcchar_data_t hcchar;
++	int handled = 0;
++	int restart = 0;
++	int last_csplit = 0;
++	int start_next_periodic = 0;
++	struct fiq_channel_state *st = &state->channel[n];
++	hfnum_data_t hfnum;
++
++	hcint.d32 = FIQ_READ(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCINT);
++	hcintmsk.d32 = FIQ_READ(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCINTMSK);
++	hcint_probe.d32 = hcint.d32 & hcintmsk.d32;
++
++	if (st->fsm != FIQ_PASSTHROUGH) {
++		fiq_print(FIQDBG_INT, state, "HC%01d ST%02d", n, st->fsm);
++		fiq_print(FIQDBG_INT, state, "%08x", hcint.d32);
++	}
++
++	switch (st->fsm) {
++
++	case FIQ_PASSTHROUGH:
++	case FIQ_DEQUEUE_ISSUED:
++		/* doesn't belong to us, kick it upstairs */
++		break;
++
++	case FIQ_PASSTHROUGH_ERRORSTATE:
++		/* We are here to emulate the error recovery mechanism of the dwc HCD.
++		 * Several interrupts are unmasked if a previous transaction failed - it's
++		 * death for the FIQ to attempt to handle them as the channel isn't halted.
++		 * Emulate what the HCD does in this situation: mask and continue.
++		 * The FSM has no other state setup so this has to be handled out-of-band.
++		 */
++		fiq_print(FIQDBG_ERR, state, "ERRST %02d", n);
++		if (hcint_probe.b.nak || hcint_probe.b.ack || hcint_probe.b.datatglerr) {
++			fiq_print(FIQDBG_ERR, state, "RESET %02d", n);
++			/* In some random cases we can get a NAK interrupt coincident with a Xacterr
++			 * interrupt, after the device has disappeared.
++			 */
++			if (!hcint.b.xacterr)
++				st->nr_errors = 0;
++			hcintmsk.b.nak = 0;
++			hcintmsk.b.ack = 0;
++			hcintmsk.b.datatglerr = 0;
++			FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCINTMSK, hcintmsk.d32);
++			return 1;
++		}
++		if (hcint_probe.b.chhltd) {
++			fiq_print(FIQDBG_ERR, state, "CHHLT %02d", n);
++			fiq_print(FIQDBG_ERR, state, "%08x", hcint.d32);
++			return 0;
++		}
++		break;
++
++	/* Non-periodic state groups */
++	case FIQ_NP_SSPLIT_STARTED:
++	case FIQ_NP_SSPLIT_RETRY:
++		/* Got a HCINT for a NP SSPLIT. Expected ACK / NAK / fail */
++		if (hcint.b.ack) {
++			/* SSPLIT complete. For OUT, the data has been sent. For IN, the LS transaction
++			 * will start shortly. SOF needs to kick the transaction to prevent a NYET flood.
++			 */
++			if(st->hcchar_copy.b.epdir == 1)
++				st->fsm = FIQ_NP_IN_CSPLIT_RETRY;
++			else
++				st->fsm = FIQ_NP_OUT_CSPLIT_RETRY;
++			st->nr_errors = 0;
++			handled = 1;
++			fiq_fsm_setup_csplit(state, n);
++		} else if (hcint.b.nak) {
++			// No buffer space in TT. Retry on a uframe boundary.
++			fiq_fsm_reload_hcdma(state, n);
++			st->fsm = FIQ_NP_SSPLIT_RETRY;
++			handled = 1;
++		} else if (hcint.b.xacterr) {
++			// The only other one we care about is xacterr. This implies HS bus error - retry.
++			st->nr_errors++;
++			if(st->hcchar_copy.b.epdir == 0)
++				fiq_fsm_reload_hcdma(state, n);
++			st->fsm = FIQ_NP_SSPLIT_RETRY;
++			if (st->nr_errors >= 3) {
++				st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
++			} else {
++				handled = 1;
++				restart = 1;
++			}
++		} else {
++			st->fsm = FIQ_NP_SPLIT_LS_ABORTED;
++			handled = 0;
++			restart = 0;
++		}
++		break;
++
++	case FIQ_NP_IN_CSPLIT_RETRY:
++		/* Received a CSPLIT done interrupt.
++		 * Expected Data/NAK/STALL/NYET for IN.
++		 */
++		if (hcint.b.xfercomp) {
++			/* For IN, data is present. */
++			st->fsm = FIQ_NP_SPLIT_DONE;
++		} else if (hcint.b.nak) {
++			/* no endpoint data. Punt it upstairs */
++			st->fsm = FIQ_NP_SPLIT_DONE;
++		} else if (hcint.b.nyet) {
++			/* CSPLIT NYET - retry on a uframe boundary. */
++			handled = 1;
++			st->nr_errors = 0;
++		} else if (hcint.b.datatglerr) {
++			/* data toggle errors do not set the xfercomp bit. */
++			st->fsm = FIQ_NP_SPLIT_LS_ABORTED;
++		} else if (hcint.b.xacterr) {
++			/* HS error. Retry immediate */
++			st->fsm = FIQ_NP_IN_CSPLIT_RETRY;
++			st->nr_errors++;
++			if (st->nr_errors >= 3) {
++				st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
++			} else {
++				handled = 1;
++				restart = 1;
++			}
++		} else if (hcint.b.stall || hcint.b.bblerr) {
++			/* A STALL implies either a LS bus error or a genuine STALL. */
++			st->fsm = FIQ_NP_SPLIT_LS_ABORTED;
++		} else {
++			/*  Hardware bug. It's possible in some cases to
++			 *  get a channel halt with nothing else set when
++			 *  the response was a NYET. Treat as local 3-strikes retry.
++			 */
++			hcint_data_t hcint_test = hcint;
++			hcint_test.b.chhltd = 0;
++			if (!hcint_test.d32) {
++				st->nr_errors++;
++				if (st->nr_errors >= 3) {
++					st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
++				} else {
++					handled = 1;
++				}
++			} else {
++				/* Bail out if something unexpected happened */
++				st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
++			}
++		}
++		if (st->fsm != FIQ_NP_IN_CSPLIT_RETRY) {
++			fiq_fsm_restart_np_pending(state, num_channels, n);
++		}
++		break;
++
++	case FIQ_NP_OUT_CSPLIT_RETRY:
++		/* Received a CSPLIT done interrupt.
++		 * Expected ACK/NAK/STALL/NYET/XFERCOMP for OUT.*/
++		if (hcint.b.xfercomp) {
++			st->fsm = FIQ_NP_SPLIT_DONE;
++		} else if (hcint.b.nak) {
++			// The HCD will implement the holdoff on frame boundaries.
++			st->fsm = FIQ_NP_SPLIT_DONE;
++		} else if (hcint.b.nyet) {
++			// Hub still processing.
++			st->fsm = FIQ_NP_OUT_CSPLIT_RETRY;
++			handled = 1;
++			st->nr_errors = 0;
++			//restart = 1;
++		} else if (hcint.b.xacterr) {
++			/* HS error. retry immediate */
++			st->fsm = FIQ_NP_OUT_CSPLIT_RETRY;
++			st->nr_errors++;
++			if (st->nr_errors >= 3) {
++				st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
++			} else {
++				handled = 1;
++				restart = 1;
++			}
++		} else if (hcint.b.stall) {
++			/* LS bus error or genuine stall */
++			st->fsm = FIQ_NP_SPLIT_LS_ABORTED;
++		} else {
++			/*
++			 * Hardware bug. It's possible in some cases to get a
++			 * channel halt with nothing else set when the response was a NYET.
++			 * Treat as local 3-strikes retry.
++			 */
++			hcint_data_t hcint_test = hcint;
++			hcint_test.b.chhltd = 0;
++			if (!hcint_test.d32) {
++				st->nr_errors++;
++				if (st->nr_errors >= 3) {
++					st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
++				} else {
++					handled = 1;
++				}
++			} else {
++				// Something unexpected happened. AHBerror or babble perhaps. Let the IRQ deal with it.
++				st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
++			}
++		}
++		if (st->fsm != FIQ_NP_OUT_CSPLIT_RETRY) {
++			fiq_fsm_restart_np_pending(state, num_channels, n);
++		}
++		break;
++
++	/* Periodic split states (except isoc out) */
++	case FIQ_PER_SSPLIT_STARTED:
++		/* Expect an ACK or failure for SSPLIT */
++		if (hcint.b.ack) {
++			/*
++			 * SSPLIT transfer complete interrupt - the generation of this interrupt is fraught with bugs.
++			 * For a packet queued in microframe n-3 to appear in n-2, if the channel is enabled near the EOF1
++			 * point for microframe n-3, the packet will not appear on the bus until microframe n.
++			 * Additionally, the generation of the actual interrupt is dodgy. For a packet appearing on the bus
++			 * in microframe n, sometimes the interrupt is generated immediately. Sometimes, it appears in n+1
++			 * coincident with SOF for n+1.
++			 * SOF is also buggy. It can sometimes be raised AFTER the first bus transaction has taken place.
++			 * These appear to be caused by timing/clock crossing bugs within the core itself.
++			 * State machine workaround.
++			 */
++			hfnum.d32 = FIQ_READ(state->dwc_regs_base + HFNUM);
++			hcchar.d32 = FIQ_READ(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR);
++			fiq_fsm_setup_csplit(state, n);
++			/* Poke the oddfrm bit. If we are equivalent, we received the interrupt at the correct
++			 * time. If not, then we're in the next SOF.
++			 */
++			if ((hfnum.b.frnum & 0x1) == hcchar.b.oddfrm) {
++				fiq_print(FIQDBG_INT, state, "CSWAIT %01d", n);
++				st->expected_uframe = hfnum.b.frnum;
++				st->fsm = FIQ_PER_CSPLIT_WAIT;
++			} else {
++				fiq_print(FIQDBG_INT, state, "CSPOL  %01d", n);
++				/* For isochronous IN endpoints,
++				 * we need to hold off if we are expecting a lot of data */
++				if (st->hcchar_copy.b.mps < DATA0_PID_HEURISTIC) {
++					start_next_periodic = 1;
++				}
++				/* Danger will robinson: we are in a broken state. If our first interrupt after
++				 * this is a NYET, it will be delayed by 1 uframe and result in an unrecoverable
++				 * lag. Unmask the NYET interrupt.
++				 */
++				st->expected_uframe = (hfnum.b.frnum + 1) & 0x3FFF;
++				st->fsm = FIQ_PER_CSPLIT_BROKEN_NYET1;
++				restart = 1;
++			}
++			handled = 1;
++		} else if (hcint.b.xacterr) {
++			/* 3-strikes retry is enabled, we have hit our max nr_errors */
++			st->fsm = FIQ_PER_SPLIT_HS_ABORTED;
++			start_next_periodic = 1;
++		} else {
++			st->fsm = FIQ_PER_SPLIT_HS_ABORTED;
++			start_next_periodic = 1;
++		}
++		/* We can now queue the next isochronous OUT transaction, if one is pending. */
++		if(fiq_fsm_tt_next_isoc(state, num_channels, n)) {
++			fiq_print(FIQDBG_INT, state, "NEXTISO ");
++		}
++		break;
++
++	case FIQ_PER_CSPLIT_NYET1:
++		/* First CSPLIT attempt was a NYET. If we get a subsequent NYET,
++		 * we are too late and the TT has dropped its CSPLIT fifo.
++		 */
++		hfnum.d32 = FIQ_READ(state->dwc_regs_base + HFNUM);
++		hcchar.d32 = FIQ_READ(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR);
++		start_next_periodic = 1;
++		if (hcint.b.nak) {
++			st->fsm = FIQ_PER_SPLIT_DONE;
++		} else if (hcint.b.xfercomp) {
++			fiq_increment_dma_buf(state, num_channels, n);
++			st->fsm = FIQ_PER_CSPLIT_POLL;
++			st->nr_errors = 0;
++			if (fiq_fsm_more_csplits(state, n, &last_csplit)) {
++				handled = 1;
++				restart = 1;
++				if (!last_csplit)
++					start_next_periodic = 0;
++			} else {
++				st->fsm = FIQ_PER_SPLIT_DONE;
++			}
++		} else if (hcint.b.nyet) {
++			/* Doh. Data lost. */
++			st->fsm = FIQ_PER_SPLIT_NYET_ABORTED;
++		} else if (hcint.b.xacterr || hcint.b.stall || hcint.b.bblerr) {
++			st->fsm = FIQ_PER_SPLIT_LS_ABORTED;
++		} else {
++			st->fsm = FIQ_PER_SPLIT_HS_ABORTED;
++		}
++		break;
++
++	case FIQ_PER_CSPLIT_BROKEN_NYET1:
++		/*
++		 * we got here because our host channel is in the delayed-interrupt
++		 * state and we cannot take a NYET interrupt any later than when it
++		 * occurred. Disable then re-enable the channel if this happens to force
++		 * CSPLITs to occur at the right time.
++		 */
++		hfnum.d32 = FIQ_READ(state->dwc_regs_base + HFNUM);
++		hcchar.d32 = FIQ_READ(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR);
++		fiq_print(FIQDBG_INT, state, "BROK: %01d ", n);
++		if (hcint.b.nak) {
++			st->fsm = FIQ_PER_SPLIT_DONE;
++			start_next_periodic = 1;
++		} else if (hcint.b.xfercomp) {
++			fiq_increment_dma_buf(state, num_channels, n);
++			if (fiq_fsm_more_csplits(state, n, &last_csplit)) {
++				st->fsm = FIQ_PER_CSPLIT_POLL;
++				handled = 1;
++				restart = 1;
++				start_next_periodic = 1;
++				/* Reload HCTSIZ for the next transfer */
++				fiq_fsm_reload_hctsiz(state, n);
++				if (!last_csplit)
++					start_next_periodic = 0;
++			} else {
++				st->fsm = FIQ_PER_SPLIT_DONE;
++			}
++		} else if (hcint.b.nyet) {
++			st->fsm = FIQ_PER_SPLIT_NYET_ABORTED;
++			start_next_periodic = 1;
++		} else if (hcint.b.xacterr || hcint.b.stall || hcint.b.bblerr) {
++			/* Local 3-strikes retry is handled by the core. This is a ERR response.*/
++			st->fsm = FIQ_PER_SPLIT_LS_ABORTED;
++		} else {
++			st->fsm = FIQ_PER_SPLIT_HS_ABORTED;
++		}
++		break;
++
++	case FIQ_PER_CSPLIT_POLL:
++		hfnum.d32 = FIQ_READ(state->dwc_regs_base + HFNUM);
++		hcchar.d32 = FIQ_READ(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR);
++		start_next_periodic = 1;
++		if (hcint.b.nak) {
++			st->fsm = FIQ_PER_SPLIT_DONE;
++		} else if (hcint.b.xfercomp) {
++			fiq_increment_dma_buf(state, num_channels, n);
++			if (fiq_fsm_more_csplits(state, n, &last_csplit)) {
++				handled = 1;
++				restart = 1;
++				/* Reload HCTSIZ for the next transfer */
++				fiq_fsm_reload_hctsiz(state, n);
++				if (!last_csplit)
++					start_next_periodic = 0;
++			} else {
++				st->fsm = FIQ_PER_SPLIT_DONE;
++			}
++		} else if (hcint.b.nyet) {
++			/* Are we a NYET after the first data packet? */
++			if (st->nrpackets == 0) {
++				st->fsm = FIQ_PER_CSPLIT_NYET1;
++				handled = 1;
++				restart = 1;
++			} else {
++				/* We got a NYET when polling CSPLITs. Can happen
++				 * if our heuristic fails, or if someone disables us
++				 * for any significant length of time.
++				 */
++				if (st->nr_errors >= 3) {
++					st->fsm = FIQ_PER_SPLIT_NYET_ABORTED;
++				} else {
++					st->fsm = FIQ_PER_SPLIT_DONE;
++				}
++			}
++		} else if (hcint.b.xacterr || hcint.b.stall || hcint.b.bblerr) {
++			/* For xacterr, Local 3-strikes retry is handled by the core. This is a ERR response.*/
++			st->fsm = FIQ_PER_SPLIT_LS_ABORTED;
++		} else {
++			st->fsm = FIQ_PER_SPLIT_HS_ABORTED;
++		}
++		break;
++
++	case FIQ_HS_ISOC_TURBO:
++		if (fiq_fsm_update_hs_isoc(state, n, hcint)) {
++			/* more transactions to come */
++			handled = 1;
++			fiq_print(FIQDBG_INT, state, "HSISO M ");
++			/* For strided transfers, put ourselves to sleep */
++			if (st->hs_isoc_info.stride > 1) {
++				st->uframe_sleeps = st->hs_isoc_info.stride - 1;
++				st->fsm = FIQ_HS_ISOC_SLEEPING;
++			} else {
++				restart = 1;
++			}
++		} else {
++			st->fsm = FIQ_HS_ISOC_DONE;
++			fiq_print(FIQDBG_INT, state, "HSISO F ");
++		}
++		break;
++
++	case FIQ_HS_ISOC_ABORTED:
++		/* This abort is called by the driver rewriting the state mid-transaction
++		 * which allows the dequeue mechanism to work more effectively.
++		 */
++		break;
++
++	case FIQ_PER_ISO_OUT_ACTIVE:
++		if (hcint.b.ack) {
++			if(fiq_iso_out_advance(state, num_channels, n)) {
++				/* last OUT transfer */
++				st->fsm = FIQ_PER_ISO_OUT_LAST;
++				/*
++				 * Assuming the periodic FIFO in the dwc core
++				 * actually does its job properly, we can queue
++				 * the next ssplit now and in theory, the wire
++				 * transactions will be in-order.
++				 */
++				// No it doesn't. It appears to process requests in host channel order.
++				//start_next_periodic = 1;
++			}
++			handled = 1;
++			restart = 1;
++		} else {
++			/*
++			 * Isochronous transactions carry on regardless. Log the error
++			 * and continue.
++			 */
++			//explode += 1;
++			st->nr_errors++;
++			if(fiq_iso_out_advance(state, num_channels, n)) {
++				st->fsm = FIQ_PER_ISO_OUT_LAST;
++				//start_next_periodic = 1;
++			}
++			handled = 1;
++			restart = 1;
++		}
++		break;
++
++	case FIQ_PER_ISO_OUT_LAST:
++		if (hcint.b.ack) {
++			/* All done here */
++			st->fsm = FIQ_PER_ISO_OUT_DONE;
++		} else {
++			st->fsm = FIQ_PER_ISO_OUT_DONE;
++			st->nr_errors++;
++		}
++		start_next_periodic = 1;
++		break;
++
++	case FIQ_PER_SPLIT_TIMEOUT:
++		/* SOF kicked us because we overran. */
++		start_next_periodic = 1;
++		break;
++
++	default:
++		break;
++	}
++
++	if (handled) {
++		FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCINT, hcint.d32);
++	} else {
++		/* Copy the regs into the state so the IRQ knows what to do */
++		st->hcint_copy.d32 = hcint.d32;
++	}
++
++	if (restart) {
++		/* Restart always implies handled. */
++		if (restart == 2) {
++			/* For complete-split INs, the show must go on.
++			 * Force a channel restart */
++			fiq_fsm_restart_channel(state, n, 1);
++		} else {
++			fiq_fsm_restart_channel(state, n, 0);
++		}
++	}
++	if (start_next_periodic) {
++		fiq_fsm_start_next_periodic(state, num_channels);
++	}
++	if (st->fsm != FIQ_PASSTHROUGH) {
++		fiq_print(FIQDBG_INT, state, "FSMOUT%02d", st->fsm);
++	}
++
++	return handled;
++}
++
++
++/**
++ * dwc_otg_fiq_fsm() - Flying State Machine (monster) FIQ
++ * @state:		pointer to state struct passed from the banked FIQ mode registers.
++ * @num_channels:	set according to the DWC hardware configuration
++ * @dma:		pointer to DMA bounce buffers for split transaction slots
++ *
++ * The FSM FIQ performs the low-level tasks that normally would be performed by the microcode
++ * inside an EHCI or similar host controller regarding split transactions. The DWC core
++ * interrupts each and every time a split transaction packet is received or sent successfully.
++ * This results in either an interrupt storm when everything is working "properly", or
++ * the interrupt latency of the system in general breaks time-sensitive periodic split
++ * transactions. Pushing the low-level, but relatively easy state machine work into the FIQ
++ * solves these problems.
++ *
++ * Return: void
++ */
++void notrace dwc_otg_fiq_fsm(struct fiq_state *state, int num_channels)
++{
++	gintsts_data_t gintsts, gintsts_handled;
++	gintmsk_data_t gintmsk;
++	//hfnum_data_t hfnum;
++	haint_data_t haint, haint_handled;
++	haintmsk_data_t haintmsk;
++	int kick_irq = 0;
++
++	/* Ensure peripheral reads issued prior to FIQ entry are complete */
++	dsb(sy);
++
++	gintsts_handled.d32 = 0;
++	haint_handled.d32 = 0;
++
++	fiq_fsm_spin_lock(&state->lock);
++	gintsts.d32 = FIQ_READ(state->dwc_regs_base + GINTSTS);
++	gintmsk.d32 = FIQ_READ(state->dwc_regs_base + GINTMSK);
++	gintsts.d32 &= gintmsk.d32;
++
++	if (gintsts.b.sofintr) {
++		/* For FSM mode, SOF is required to keep the state machine advance for
++		 * certain stages of the periodic pipeline. It's death to mask this
++		 * interrupt in that case.
++		 */
++
++		if (!fiq_fsm_do_sof(state, num_channels)) {
++			/* Kick IRQ once. Queue advancement means that all pending transactions
++			 * will get serviced when the IRQ finally executes.
++			 */
++			if (state->gintmsk_saved.b.sofintr == 1)
++				kick_irq |= 1;
++			state->gintmsk_saved.b.sofintr = 0;
++		}
++		gintsts_handled.b.sofintr = 1;
++	}
++
++	if (gintsts.b.hcintr) {
++		int i;
++		haint.d32 = FIQ_READ(state->dwc_regs_base + HAINT);
++		haintmsk.d32 = FIQ_READ(state->dwc_regs_base + HAINTMSK);
++		haint.d32 &= haintmsk.d32;
++		haint_handled.d32 = 0;
++		for (i=0; i<num_channels; i++) {
++			if (haint.b2.chint & (1 << i)) {
++				if(!fiq_fsm_do_hcintr(state, num_channels, i)) {
++					/* HCINT was not handled in FIQ
++					 * HAINT is level-sensitive, leading to level-sensitive ginststs.b.hcint bit.
++					 * Mask HAINT(i) but keep top-level hcint unmasked.
++					 */
++					state->haintmsk_saved.b2.chint &= ~(1 << i);
++				} else {
++					/* do_hcintr cleaned up after itself, but clear haint */
++					haint_handled.b2.chint |= (1 << i);
++				}
++			}
++		}
++
++		if (haint_handled.b2.chint) {
++			FIQ_WRITE(state->dwc_regs_base + HAINT, haint_handled.d32);
++		}
++
++		if (haintmsk.d32 != (haintmsk.d32 & state->haintmsk_saved.d32)) {
++			/*
++			 * This is necessary to avoid multiple retriggers of the MPHI in the case
++			 * where interrupts are held off and HCINTs start to pile up.
++			 * Only wake up the IRQ if a new interrupt came in, was not handled and was
++			 * masked.
++			 */
++			haintmsk.d32 &= state->haintmsk_saved.d32;
++			FIQ_WRITE(state->dwc_regs_base + HAINTMSK, haintmsk.d32);
++			kick_irq |= 1;
++		}
++		/* Top-Level interrupt - always handled because it's level-sensitive */
++		gintsts_handled.b.hcintr = 1;
++	}
++
++
++	/* Clear the bits in the saved register that were not handled but were triggered. */
++	state->gintmsk_saved.d32 &= ~(gintsts.d32 & ~gintsts_handled.d32);
++
++	/* FIQ didn't handle something - mask has changed - write new mask */
++	if (gintmsk.d32 != (gintmsk.d32 & state->gintmsk_saved.d32)) {
++		gintmsk.d32 &= state->gintmsk_saved.d32;
++		gintmsk.b.sofintr = 1;
++		FIQ_WRITE(state->dwc_regs_base + GINTMSK, gintmsk.d32);
++//		fiq_print(FIQDBG_INT, state, "KICKGINT");
++//		fiq_print(FIQDBG_INT, state, "%08x", gintmsk.d32);
++//		fiq_print(FIQDBG_INT, state, "%08x", state->gintmsk_saved.d32);
++		kick_irq |= 1;
++	}
++
++	if (gintsts_handled.d32) {
++		/* Only applies to edge-sensitive bits in GINTSTS */
++		FIQ_WRITE(state->dwc_regs_base + GINTSTS, gintsts_handled.d32);
++	}
++
++	/* We got an interrupt, didn't handle it. */
++	if (kick_irq) {
++		state->mphi_int_count++;
++		if (state->mphi_regs.swirq_set) {
++			FIQ_WRITE(state->mphi_regs.swirq_set, 1);
++		} else {
++			FIQ_WRITE(state->mphi_regs.outdda, state->dummy_send_dma);
++			FIQ_WRITE(state->mphi_regs.outddb, (1<<29));
++		}
++
++	}
++	state->fiq_done++;
++	mb();
++	fiq_fsm_spin_unlock(&state->lock);
++}
++
++
++/**
++ * dwc_otg_fiq_nop() - FIQ "lite"
++ * @state:	pointer to state struct passed from the banked FIQ mode registers.
++ *
++ * The "nop" handler does not intervene on any interrupts other than SOF.
++ * It is limited in scope to deciding at each SOF if the IRQ SOF handler (which deals
++ * with non-periodic/periodic queues) needs to be kicked.
++ *
++ * This is done to hold off the SOF interrupt, which occurs at a rate of 8000 per second.
++ *
++ * Return: void
++ */
++void notrace dwc_otg_fiq_nop(struct fiq_state *state)
++{
++	gintsts_data_t gintsts, gintsts_handled;
++	gintmsk_data_t gintmsk;
++	hfnum_data_t hfnum;
++
++	/* Ensure peripheral reads issued prior to FIQ entry are complete */
++	dsb(sy);
++
++	fiq_fsm_spin_lock(&state->lock);
++	hfnum.d32 = FIQ_READ(state->dwc_regs_base + HFNUM);
++	gintsts.d32 = FIQ_READ(state->dwc_regs_base + GINTSTS);
++	gintmsk.d32 = FIQ_READ(state->dwc_regs_base + GINTMSK);
++	gintsts.d32 &= gintmsk.d32;
++	gintsts_handled.d32 = 0;
++
++	if (gintsts.b.sofintr) {
++		if (!state->kick_np_queues &&
++				dwc_frame_num_gt(state->next_sched_frame, hfnum.b.frnum)) {
++			/* SOF handled, no work to do, just ACK interrupt */
++			gintsts_handled.b.sofintr = 1;
++		} else {
++			/* Kick IRQ */
++			state->gintmsk_saved.b.sofintr = 0;
++		}
++	}
++
++	/* Reset handled interrupts */
++	if(gintsts_handled.d32) {
++		FIQ_WRITE(state->dwc_regs_base + GINTSTS, gintsts_handled.d32);
++	}
++
++	/* Clear the bits in the saved register that were not handled but were triggered. */
++	state->gintmsk_saved.d32 &= ~(gintsts.d32 & ~gintsts_handled.d32);
++
++	/* We got an interrupt, didn't handle it and want to mask it */
++	if (~(state->gintmsk_saved.d32)) {
++		state->mphi_int_count++;
++		gintmsk.d32 &= state->gintmsk_saved.d32;
++		FIQ_WRITE(state->dwc_regs_base + GINTMSK, gintmsk.d32);
++		if (state->mphi_regs.swirq_set) {
++			FIQ_WRITE(state->mphi_regs.swirq_set, 1);
++		} else {
++			/* Force a clear before another dummy send */
++			FIQ_WRITE(state->mphi_regs.intstat, (1<<29));
++			FIQ_WRITE(state->mphi_regs.outdda, state->dummy_send_dma);
++			FIQ_WRITE(state->mphi_regs.outddb, (1<<29));
++		}
++	}
++	state->fiq_done++;
++	mb();
++	fiq_fsm_spin_unlock(&state->lock);
++}
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h
+@@ -0,0 +1,395 @@
++/*
++ * dwc_otg_fiq_fsm.h - Finite state machine FIQ header definitions
++ *
++ * Copyright (c) 2013 Raspberry Pi Foundation
++ *
++ * Author: Jonathan Bell <jonathan@raspberrypi.org>
++ * All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions are met:
++ *	* Redistributions of source code must retain the above copyright
++ *	  notice, this list of conditions and the following disclaimer.
++ *	* Redistributions in binary form must reproduce the above copyright
++ *	  notice, this list of conditions and the following disclaimer in the
++ *	  documentation and/or other materials provided with the distribution.
++ *	* Neither the name of Raspberry Pi nor the
++ *	  names of its contributors may be used to endorse or promote products
++ *	  derived from this software without specific prior written permission.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
++ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
++ * DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY
++ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
++ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ * This FIQ implements functionality that performs split transactions on
++ * the dwc_otg hardware without any outside intervention. A split transaction
++ * is "queued" by nominating a specific host channel to perform the entirety
++ * of a split transaction. This FIQ will then perform the microframe-precise
++ * scheduling required in each phase of the transaction until completion.
++ *
++ * The FIQ functionality has been surgically implanted into the Synopsys
++ * vendor-provided driver.
++ *
++ */
++
++#ifndef DWC_OTG_FIQ_FSM_H_
++#define DWC_OTG_FIQ_FSM_H_
++
++#include "dwc_otg_regs.h"
++#include "dwc_otg_cil.h"
++#include "dwc_otg_hcd.h"
++#include <linux/kernel.h>
++#include <linux/irqflags.h>
++#include <linux/string.h>
++#include <asm/barrier.h>
++
++#if 0
++#define FLAME_ON(x)					\
++do {							\
++	int gpioreg;                                    \
++							\
++	gpioreg = readl(__io_address(0x20200000+0x8));	\
++	gpioreg &= ~(7 << (x-20)*3);			\
++	gpioreg |= 0x1 << (x-20)*3;			\
++	writel(gpioreg, __io_address(0x20200000+0x8));	\
++							\
++	writel(1<<x, __io_address(0x20200000+(0x1C)));	\
++} while (0)
++
++#define FLAME_OFF(x)					\
++do {							\
++	writel(1<<x, __io_address(0x20200000+(0x28)));	\
++} while (0)
++#else
++#define FLAME_ON(x) do { } while (0)
++#define FLAME_OFF(X) do { } while (0)
++#endif
++
++/* This is a quick-and-dirty arch-specific register read/write. We know that
++ * writes to a peripheral on BCM2835 will always arrive in-order, also that
++ * reads and writes are executed in-order therefore the need for memory barriers
++ * is obviated if we're only talking to USB.
++ */
++#define FIQ_WRITE(_addr_,_data_) (*(volatile unsigned int *) (_addr_) = (_data_))
++#define FIQ_READ(_addr_) (*(volatile unsigned int *) (_addr_))
++
++/* FIQ-ified register definitions. Offsets are from dwc_regs_base. */
++#define GINTSTS		0x014
++#define GINTMSK		0x018
++/* Debug register. Poll the top of the received packets FIFO. */
++#define GRXSTSR		0x01C
++#define HFNUM		0x408
++#define HAINT		0x414
++#define HAINTMSK	0x418
++#define HPRT0		0x440
++
++/* HC_regs start from an offset of 0x500 */
++#define HC_START	0x500
++#define HC_OFFSET	0x020
++
++#define HC_DMA		0x14
++
++#define HCCHAR		0x00
++#define HCSPLT		0x04
++#define HCINT		0x08
++#define HCINTMSK	0x0C
++#define HCTSIZ		0x10
++
++#define ISOC_XACTPOS_ALL 	0b11
++#define ISOC_XACTPOS_BEGIN	0b10
++#define ISOC_XACTPOS_MID	0b00
++#define ISOC_XACTPOS_END	0b01
++
++#define DWC_PID_DATA2	0b01
++#define DWC_PID_MDATA	0b11
++#define DWC_PID_DATA1	0b10
++#define DWC_PID_DATA0	0b00
++
++typedef struct {
++	volatile void* base;
++	volatile void* ctrl;
++	volatile void* outdda;
++	volatile void* outddb;
++	volatile void* intstat;
++	volatile void* swirq_set;
++	volatile void* swirq_clr;
++} mphi_regs_t;
++
++enum fiq_debug_level {
++	FIQDBG_SCHED = (1 << 0),
++	FIQDBG_INT   = (1 << 1),
++	FIQDBG_ERR   = (1 << 2),
++	FIQDBG_PORTHUB = (1 << 3),
++};
++
++#ifdef CONFIG_ARM64
++
++typedef spinlock_t fiq_lock_t;
++
++#else
++
++typedef struct {
++	union {
++		uint32_t slock;
++		struct _tickets {
++			uint16_t owner;
++			uint16_t next;
++		} tickets;
++	};
++} fiq_lock_t;
++
++#endif
++
++struct fiq_state;
++
++extern void _fiq_print (enum fiq_debug_level dbg_lvl, volatile struct fiq_state *state, char *fmt, ...);
++#if 0
++#define fiq_print _fiq_print
++#else
++#define fiq_print(x, y, ...)
++#endif
++
++extern bool fiq_enable, fiq_fsm_enable;
++extern ushort nak_holdoff;
++
++/**
++ * enum fiq_fsm_state - The FIQ FSM states.
++ *
++ * This is the "core" of the FIQ FSM. Broadly, the FSM states follow the
++ * USB2.0 specification for host responses to various transaction states.
++ * There are modifications to this host state machine because of a variety of
++ * quirks and limitations in the dwc_otg hardware.
++ *
++ * The fsm state is also used to communicate back to the driver on completion of
++ * a split transaction. The end states are used in conjunction with the interrupts
++ * raised by the final transaction.
++ */
++enum fiq_fsm_state {
++	/* FIQ isn't enabled for this host channel */
++	FIQ_PASSTHROUGH = 0,
++	/* For the first interrupt received for this channel,
++	 * the FIQ has to ack any interrupts indicating success. */
++	FIQ_PASSTHROUGH_ERRORSTATE = 31,
++	/* Nonperiodic state groups */
++	FIQ_NP_SSPLIT_STARTED = 1,
++	FIQ_NP_SSPLIT_RETRY = 2,
++	/* TT contention - working around hub bugs */
++	FIQ_NP_SSPLIT_PENDING = 33,
++	FIQ_NP_OUT_CSPLIT_RETRY = 3,
++	FIQ_NP_IN_CSPLIT_RETRY = 4,
++	FIQ_NP_SPLIT_DONE = 5,
++	FIQ_NP_SPLIT_LS_ABORTED = 6,
++	/* This differentiates a HS transaction error from a LS one
++	 * (handling the hub state is different) */
++	FIQ_NP_SPLIT_HS_ABORTED = 7,
++
++	/* Periodic state groups */
++	/* Periodic transactions are either started directly by the IRQ handler
++	 * or deferred if the TT is already in use.
++	 */
++	FIQ_PER_SSPLIT_QUEUED = 8,
++	FIQ_PER_SSPLIT_STARTED = 9,
++	FIQ_PER_SSPLIT_LAST = 10,
++
++
++	FIQ_PER_ISO_OUT_PENDING = 11,
++	FIQ_PER_ISO_OUT_ACTIVE = 12,
++	FIQ_PER_ISO_OUT_LAST = 13,
++	FIQ_PER_ISO_OUT_DONE = 27,
++
++	FIQ_PER_CSPLIT_WAIT = 14,
++	FIQ_PER_CSPLIT_NYET1 = 15,
++	FIQ_PER_CSPLIT_BROKEN_NYET1 = 28,
++	FIQ_PER_CSPLIT_NYET_FAFF = 29,
++	/* For multiple CSPLITs (large isoc IN, or delayed interrupt) */
++	FIQ_PER_CSPLIT_POLL = 16,
++	/* The last CSPLIT for a transaction has been issued, differentiates
++	 * for the state machine to queue the next packet.
++	 */
++	FIQ_PER_CSPLIT_LAST = 17,
++
++	FIQ_PER_SPLIT_DONE = 18,
++	FIQ_PER_SPLIT_LS_ABORTED = 19,
++	FIQ_PER_SPLIT_HS_ABORTED = 20,
++	FIQ_PER_SPLIT_NYET_ABORTED = 21,
++	/* Frame rollover has occurred without the transaction finishing. */
++	FIQ_PER_SPLIT_TIMEOUT = 22,
++
++	/* FIQ-accelerated HS Isochronous state groups */
++	FIQ_HS_ISOC_TURBO = 23,
++	/* For interval > 1, SOF wakes up the isochronous FSM */
++	FIQ_HS_ISOC_SLEEPING = 24,
++	FIQ_HS_ISOC_DONE = 25,
++	FIQ_HS_ISOC_ABORTED = 26,
++	FIQ_DEQUEUE_ISSUED = 30,
++	FIQ_TEST = 32,
++};
++
++struct fiq_stack {
++	int magic1;
++	uint8_t stack[2048];
++	int magic2;
++};
++
++
++/**
++ * struct fiq_dma_info - DMA bounce buffer utilisation information (per-channel)
++ * @index:	Number of slots reported used for IN transactions / number of slots
++ *			transmitted for an OUT transaction
++ * @slot_len[6]: Number of actual transfer bytes in each slot (255 if unused)
++ *
++ * Split transaction transfers can have variable length depending on other bus
++ * traffic. The OTG core DMA engine requires 4-byte aligned addresses therefore
++ * each transaction needs a guaranteed aligned address. A maximum of 6 split transfers
++ * can happen per-frame.
++ */
++struct fiq_dma_info {
++	u8 index;
++	u8 slot_len[6];
++};
++
++struct fiq_split_dma_slot {
++	u8 buf[188];
++} __attribute__((packed));
++
++struct fiq_dma_channel {
++	struct fiq_split_dma_slot index[6];
++} __attribute__((packed));
++
++/**
++ * struct fiq_hs_isoc_info - USB2.0 isochronous data
++ * @iso_frame:	Pointer to the array of OTG URB iso_frame_descs.
++ * @nrframes:	Total length of iso_frame_desc array
++ * @index:	Current index (FIQ-maintained)
++ * @stride:	Interval in uframes between HS isoc transactions
++ */
++struct fiq_hs_isoc_info {
++	struct dwc_otg_hcd_iso_packet_desc *iso_desc;
++	unsigned int nrframes;
++	unsigned int index;
++	unsigned int stride;
++};
++
++/**
++ * struct fiq_channel_state - FIQ state machine storage
++ * @fsm:	Current state of the channel as understood by the FIQ
++ * @nr_errors:	Number of transaction errors on this split-transaction
++ * @hub_addr:   SSPLIT/CSPLIT destination hub
++ * @port_addr:  SSPLIT/CSPLIT destination port - always 1 if single TT hub
++ * @nrpackets:  For isoc OUT, the number of split-OUT packets to transmit. For
++ * 		split-IN, number of CSPLIT data packets that were received.
++ * @hcchar_copy:
++ * @hcsplt_copy:
++ * @hcintmsk_copy:
++ * @hctsiz_copy:	Copies of the host channel registers.
++ * 			For use as scratch, or for returning state.
++ *
++ * The fiq_channel_state is state storage between interrupts for a host channel. The
++ * FSM state is stored here. Members of this structure must only be set up by the
++ * driver prior to enabling the FIQ for this host channel, and not touched until the FIQ
++ * has updated the state to either a COMPLETE state group or ABORT state group.
++ */
++
++struct fiq_channel_state {
++	enum fiq_fsm_state fsm;
++	unsigned int nr_errors;
++	unsigned int hub_addr;
++	unsigned int port_addr;
++	/* Hardware bug workaround: sometimes channel halt interrupts are
++	 * delayed until the next SOF. Keep track of when we expected to get interrupted. */
++	unsigned int expected_uframe;
++	/* number of uframes remaining (for interval > 1 HS isoc transfers) before next transfer */
++	unsigned int uframe_sleeps;
++	/* in/out for communicating number of dma buffers used, or number of ISOC to do */
++	unsigned int nrpackets;
++	struct fiq_dma_info dma_info;
++	struct fiq_hs_isoc_info hs_isoc_info;
++	/* Copies of HC registers - in/out communication from/to IRQ handler
++	 * and for ease of channel setup. A bit of mungeing is performed - for
++	 * example the hctsiz.b.maxp is _always_ the max packet size of the endpoint.
++	 */
++	hcchar_data_t hcchar_copy;
++	hcsplt_data_t hcsplt_copy;
++	hcint_data_t hcint_copy;
++	hcintmsk_data_t hcintmsk_copy;
++	hctsiz_data_t hctsiz_copy;
++	hcdma_data_t hcdma_copy;
++};
++
++/**
++ * struct fiq_state - top-level FIQ state machine storage
++ * @mphi_regs:		virtual address of the MPHI peripheral register file
++ * @dwc_regs_base:	virtual address of the base of the DWC core register file
++ * @dma_base:		physical address for the base of the DMA bounce buffers
++ * @dummy_send:		Scratch area for sending a fake message to the MPHI peripheral
++ * @gintmsk_saved:	Top-level mask of interrupts that the FIQ has not handled.
++ * 			Used for determining which interrupts fired to set off the IRQ handler.
++ * @haintmsk_saved:	Mask of interrupts from host channels that the FIQ did not handle internally.
++ * @np_count:		Non-periodic transactions in the active queue
++ * @np_sent:		Count of non-periodic transactions that have completed
++ * @next_sched_frame:	For periodic transactions handled by the driver's SOF-driven queuing mechanism,
++ * 			this is the next frame on which a SOF interrupt is required. Used to hold off
++ * 			passing SOF through to the driver until necessary.
++ * @channel[n]:		Per-channel FIQ state. Allocated during init depending on the number of host
++ * 			channels configured into the core logic.
++ *
++ * This is passed as the first argument to the dwc_otg_fiq_fsm top-level FIQ handler from the asm stub.
++ * It contains top-level state information.
++ */
++struct fiq_state {
++	fiq_lock_t lock;
++	mphi_regs_t mphi_regs;
++	void *dwc_regs_base;
++	dma_addr_t dma_base;
++	struct fiq_dma_channel *fiq_dmab;
++	void *dummy_send;
++	dma_addr_t dummy_send_dma;
++	gintmsk_data_t gintmsk_saved;
++	haintmsk_data_t haintmsk_saved;
++	int mphi_int_count;
++	unsigned int fiq_done;
++	unsigned int kick_np_queues;
++	unsigned int next_sched_frame;
++#ifdef FIQ_DEBUG
++	char * buffer;
++	unsigned int bufsiz;
++#endif
++	struct fiq_channel_state channel[];
++};
++
++#ifdef CONFIG_ARM64
++
++#ifdef local_fiq_enable
++#undef local_fiq_enable
++#endif
++
++#ifdef local_fiq_disable
++#undef local_fiq_disable
++#endif
++
++extern void local_fiq_enable(void);
++
++extern void local_fiq_disable(void);
++
++#endif
++
++extern void fiq_fsm_spin_lock(fiq_lock_t *lock);
++
++extern void fiq_fsm_spin_unlock(fiq_lock_t *lock);
++
++extern int fiq_fsm_too_late(struct fiq_state *st, int n);
++
++extern int fiq_fsm_tt_in_use(struct fiq_state *st, int num_channels, int n);
++
++extern void dwc_otg_fiq_fsm(struct fiq_state *state, int num_channels);
++
++extern void dwc_otg_fiq_nop(struct fiq_state *state);
++
++#endif /* DWC_OTG_FIQ_FSM_H_ */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_fiq_stub.S
+@@ -0,0 +1,80 @@
++/*
++ * dwc_otg_fiq_fsm.S - assembly stub for the FSM FIQ
++ *
++ * Copyright (c) 2013 Raspberry Pi Foundation
++ *
++ * Author: Jonathan Bell <jonathan@raspberrypi.org>
++ * All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions are met:
++ *	* Redistributions of source code must retain the above copyright
++ *	  notice, this list of conditions and the following disclaimer.
++ *	* Redistributions in binary form must reproduce the above copyright
++ *	  notice, this list of conditions and the following disclaimer in the
++ *	  documentation and/or other materials provided with the distribution.
++ *	* Neither the name of Raspberry Pi nor the
++ *	  names of its contributors may be used to endorse or promote products
++ *	  derived from this software without specific prior written permission.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
++ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
++ * DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY
++ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
++ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++
++
++#include <asm/assembler.h>
++#include <linux/linkage.h>
++
++
++.text
++
++.global _dwc_otg_fiq_stub_end;
++
++/**
++  * _dwc_otg_fiq_stub() - entry copied to the FIQ vector page to allow
++  * a C-style function call with arguments from the FIQ banked registers.
++  * r0 = &hcd->fiq_state
++  * r1 = &hcd->num_channels
++  * r2 = &hcd->dma_buffers
++  * Tramples: r0, r1, r2, r4, fp, ip
++  */
++
++ENTRY(_dwc_otg_fiq_stub)
++	/* Stash unbanked regs - SP will have been set up for us */
++	mov ip, sp;
++	stmdb sp!, {r0-r12, lr};
++#ifdef FIQ_DEBUG
++	// Cycle profiling - read cycle counter at start
++	mrc p15, 0, r5, c15, c12, 1;
++#endif
++	/* r11 = fp, don't trample it */
++	mov r4, fp;
++	/* set EABI frame size */
++	sub fp, ip, #512;
++
++	/* for fiq NOP mode - just need state */
++	mov r0, r8;
++	/* r9 = num_channels */
++	mov r1, r9;
++	/* r10 = struct *dma_bufs */
++//	mov r2, r10;
++
++	/* r4 = &fiq_c_function */
++	blx r4;
++#ifdef FIQ_DEBUG
++	mrc p15, 0, r4, c15, c12, 1;
++	subs r5, r5, r4;
++	// r5 is now the cycle count time for executing the FIQ. Store it somewhere?
++#endif
++	ldmia sp!, {r0-r12, lr};
++	subs pc, lr, #4;
++_dwc_otg_fiq_stub_end:
++END(_dwc_otg_fiq_stub)
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd.c
+@@ -0,0 +1,4366 @@
++
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd.c $
++ * $Revision: #104 $
++ * $Date: 2011/10/24 $
++ * $Change: 1871159 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++#ifndef DWC_DEVICE_ONLY
++
++/** @file
++ * This file implements HCD Core. All code in this file is portable and doesn't
++ * use any OS specific functions.
++ * Interface provided by HCD Core is defined in <code><hcd_if.h></code>
++ * header file.
++ */
++
++#include <linux/usb.h>
++#include <linux/usb/hcd.h>
++
++#include "dwc_otg_hcd.h"
++#include "dwc_otg_regs.h"
++#include "dwc_otg_fiq_fsm.h"
++
++extern bool microframe_schedule;
++extern uint16_t fiq_fsm_mask, nak_holdoff;
++
++//#define DEBUG_HOST_CHANNELS
++#ifdef DEBUG_HOST_CHANNELS
++static int last_sel_trans_num_per_scheduled = 0;
++static int last_sel_trans_num_nonper_scheduled = 0;
++static int last_sel_trans_num_avail_hc_at_start = 0;
++static int last_sel_trans_num_avail_hc_at_end = 0;
++#endif /* DEBUG_HOST_CHANNELS */
++
++static_assert(FIQ_PASSTHROUGH == 0);
++
++dwc_otg_hcd_t *dwc_otg_hcd_alloc_hcd(void)
++{
++	return DWC_ALLOC(sizeof(dwc_otg_hcd_t));
++}
++
++/**
++ * Connection timeout function.  An OTG host is required to display a
++ * message if the device does not connect within 10 seconds.
++ */
++static void dwc_otg_hcd_connect_timeout(void *ptr)
++{
++	DWC_DEBUGPL(DBG_HCDV, "%s(%p)\n", __func__, ptr);
++	DWC_PRINTF("Connect Timeout\n");
++	__DWC_ERROR("Device Not Connected/Responding\n");
++}
++
++#if defined(DEBUG)
++static void dump_channel_info(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	if (qh->channel != NULL) {
++		dwc_hc_t *hc = qh->channel;
++		dwc_list_link_t *item;
++		dwc_otg_qh_t *qh_item;
++		int num_channels = hcd->core_if->core_params->host_channels;
++		int i;
++
++		dwc_otg_hc_regs_t *hc_regs;
++		hcchar_data_t hcchar;
++		hcsplt_data_t hcsplt;
++		hctsiz_data_t hctsiz;
++		uint32_t hcdma;
++
++		hc_regs = hcd->core_if->host_if->hc_regs[hc->hc_num];
++		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++		hcsplt.d32 = DWC_READ_REG32(&hc_regs->hcsplt);
++		hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
++		hcdma = DWC_READ_REG32(&hc_regs->hcdma);
++
++		DWC_PRINTF("  Assigned to channel %p:\n", hc);
++		DWC_PRINTF("    hcchar 0x%08x, hcsplt 0x%08x\n", hcchar.d32,
++			   hcsplt.d32);
++		DWC_PRINTF("    hctsiz 0x%08x, hcdma 0x%08x\n", hctsiz.d32,
++			   hcdma);
++		DWC_PRINTF("    dev_addr: %d, ep_num: %d, ep_is_in: %d\n",
++			   hc->dev_addr, hc->ep_num, hc->ep_is_in);
++		DWC_PRINTF("    ep_type: %d\n", hc->ep_type);
++		DWC_PRINTF("    max_packet: %d\n", hc->max_packet);
++		DWC_PRINTF("    data_pid_start: %d\n", hc->data_pid_start);
++		DWC_PRINTF("    xfer_started: %d\n", hc->xfer_started);
++		DWC_PRINTF("    halt_status: %d\n", hc->halt_status);
++		DWC_PRINTF("    xfer_buff: %p\n", hc->xfer_buff);
++		DWC_PRINTF("    xfer_len: %d\n", hc->xfer_len);
++		DWC_PRINTF("    qh: %p\n", hc->qh);
++		DWC_PRINTF("  NP inactive sched:\n");
++		DWC_LIST_FOREACH(item, &hcd->non_periodic_sched_inactive) {
++			qh_item =
++			    DWC_LIST_ENTRY(item, dwc_otg_qh_t, qh_list_entry);
++			DWC_PRINTF("    %p\n", qh_item);
++		}
++		DWC_PRINTF("  NP active sched:\n");
++		DWC_LIST_FOREACH(item, &hcd->non_periodic_sched_active) {
++			qh_item =
++			    DWC_LIST_ENTRY(item, dwc_otg_qh_t, qh_list_entry);
++			DWC_PRINTF("    %p\n", qh_item);
++		}
++		DWC_PRINTF("  Channels: \n");
++		for (i = 0; i < num_channels; i++) {
++			dwc_hc_t *hc = hcd->hc_ptr_array[i];
++			DWC_PRINTF("    %2d: %p\n", i, hc);
++		}
++	}
++}
++#else
++#define dump_channel_info(hcd, qh)
++#endif /* DEBUG */
++
++/**
++ * Work queue function for starting the HCD when A-Cable is connected.
++ * The hcd_start() must be called in a process context.
++ */
++static void hcd_start_func(void *_vp)
++{
++	dwc_otg_hcd_t *hcd = (dwc_otg_hcd_t *) _vp;
++
++	DWC_DEBUGPL(DBG_HCDV, "%s() %p\n", __func__, hcd);
++	if (hcd) {
++		hcd->fops->start(hcd);
++	}
++}
++
++static void del_xfer_timers(dwc_otg_hcd_t * hcd)
++{
++#ifdef DEBUG
++	int i;
++	int num_channels = hcd->core_if->core_params->host_channels;
++	for (i = 0; i < num_channels; i++) {
++		DWC_TIMER_CANCEL(hcd->core_if->hc_xfer_timer[i]);
++	}
++#endif
++}
++
++static void del_timers(dwc_otg_hcd_t * hcd)
++{
++	del_xfer_timers(hcd);
++	DWC_TIMER_CANCEL(hcd->conn_timer);
++}
++
++/**
++ * Processes all the URBs in a single list of QHs. Completes them with
++ * -ESHUTDOWN and frees the QTD.
++ */
++static void kill_urbs_in_qh_list(dwc_otg_hcd_t * hcd, dwc_list_link_t * qh_list)
++{
++	dwc_list_link_t *qh_item, *qh_tmp;
++	dwc_otg_qh_t *qh;
++	dwc_otg_qtd_t *qtd, *qtd_tmp;
++	int quiesced = 0;
++
++	DWC_LIST_FOREACH_SAFE(qh_item, qh_tmp, qh_list) {
++		qh = DWC_LIST_ENTRY(qh_item, dwc_otg_qh_t, qh_list_entry);
++		DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp,
++					 &qh->qtd_list, qtd_list_entry) {
++			qtd = DWC_CIRCLEQ_FIRST(&qh->qtd_list);
++			if (qtd->urb != NULL) {
++				hcd->fops->complete(hcd, qtd->urb->priv,
++						    qtd->urb, -DWC_E_SHUTDOWN);
++				dwc_otg_hcd_qtd_remove_and_free(hcd, qtd, qh);
++			}
++
++		}
++		if(qh->channel) {
++			int n = qh->channel->hc_num;
++			/* Using hcchar.chen == 1 is not a reliable test.
++			 * It is possible that the channel has already halted
++			 * but not yet been through the IRQ handler.
++			 */
++			if (fiq_fsm_enable && (hcd->fiq_state->channel[qh->channel->hc_num].fsm != FIQ_PASSTHROUGH)) {
++				qh->channel->halt_status = DWC_OTG_HC_XFER_URB_DEQUEUE;
++				qh->channel->halt_pending = 1;
++				if (hcd->fiq_state->channel[n].fsm == FIQ_HS_ISOC_TURBO ||
++				    hcd->fiq_state->channel[n].fsm == FIQ_HS_ISOC_SLEEPING)
++					hcd->fiq_state->channel[n].fsm = FIQ_HS_ISOC_ABORTED;
++				/* We're called from disconnect callback or in the middle of freeing the HCD here,
++				 * so FIQ is disabled, top-level interrupts masked and we're holding the spinlock.
++				 * No further URBs will be submitted, but wait 1 microframe for any previously
++				 * submitted periodic DMA to finish.
++				 */
++				if (!quiesced) {
++					udelay(125);
++					quiesced = 1;
++				}
++			} else {
++				dwc_otg_hc_halt(hcd->core_if, qh->channel,
++						DWC_OTG_HC_XFER_URB_DEQUEUE);
++			}
++			qh->channel = NULL;
++		}
++		dwc_otg_hcd_qh_remove(hcd, qh);
++	}
++}
++
++/**
++ * Responds with an error status of ESHUTDOWN to all URBs in the non-periodic
++ * and periodic schedules. The QTD associated with each URB is removed from
++ * the schedule and freed. This function may be called when a disconnect is
++ * detected or when the HCD is being stopped.
++ */
++static void kill_all_urbs(dwc_otg_hcd_t * hcd)
++{
++	kill_urbs_in_qh_list(hcd, &hcd->non_periodic_sched_inactive);
++	kill_urbs_in_qh_list(hcd, &hcd->non_periodic_sched_active);
++	kill_urbs_in_qh_list(hcd, &hcd->periodic_sched_inactive);
++	kill_urbs_in_qh_list(hcd, &hcd->periodic_sched_ready);
++	kill_urbs_in_qh_list(hcd, &hcd->periodic_sched_assigned);
++	kill_urbs_in_qh_list(hcd, &hcd->periodic_sched_queued);
++}
++
++/**
++ * Start the connection timer.  An OTG host is required to display a
++ * message if the device does not connect within 10 seconds.  The
++ * timer is deleted if a port connect interrupt occurs before the
++ * timer expires.
++ */
++static void dwc_otg_hcd_start_connect_timer(dwc_otg_hcd_t * hcd)
++{
++	DWC_TIMER_SCHEDULE(hcd->conn_timer, 10000 /* 10 secs */ );
++}
++
++/**
++ * HCD Callback function for disconnect of the HCD.
++ *
++ * @param p void pointer to the <code>struct usb_hcd</code>
++ */
++static int32_t dwc_otg_hcd_session_start_cb(void *p)
++{
++	dwc_otg_hcd_t *dwc_otg_hcd;
++	DWC_DEBUGPL(DBG_HCDV, "%s(%p)\n", __func__, p);
++	dwc_otg_hcd = p;
++	dwc_otg_hcd_start_connect_timer(dwc_otg_hcd);
++	return 1;
++}
++
++/**
++ * HCD Callback function for starting the HCD when A-Cable is
++ * connected.
++ *
++ * @param p void pointer to the <code>struct usb_hcd</code>
++ */
++static int32_t dwc_otg_hcd_start_cb(void *p)
++{
++	dwc_otg_hcd_t *dwc_otg_hcd = p;
++	dwc_otg_core_if_t *core_if;
++	hprt0_data_t hprt0;
++
++	core_if = dwc_otg_hcd->core_if;
++
++	if (core_if->op_state == B_HOST) {
++		/*
++		 * Reset the port.  During a HNP mode switch the reset
++		 * needs to occur within 1ms and have a duration of at
++		 * least 50ms.
++		 */
++		hprt0.d32 = dwc_otg_read_hprt0(core_if);
++		hprt0.b.prtrst = 1;
++		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++	}
++	DWC_WORKQ_SCHEDULE_DELAYED(core_if->wq_otg,
++				   hcd_start_func, dwc_otg_hcd, 50,
++				   "start hcd");
++
++	return 1;
++}
++
++/**
++ * HCD Callback function for disconnect of the HCD.
++ *
++ * @param p void pointer to the <code>struct usb_hcd</code>
++ */
++static int32_t dwc_otg_hcd_disconnect_cb(void *p)
++{
++	gintsts_data_t intr;
++	dwc_otg_hcd_t *dwc_otg_hcd = p;
++
++	DWC_SPINLOCK(dwc_otg_hcd->lock);
++	/*
++	 * Set status flags for the hub driver.
++	 */
++	dwc_otg_hcd->flags.b.port_connect_status_change = 1;
++	dwc_otg_hcd->flags.b.port_connect_status = 0;
++	if(fiq_enable) {
++		local_fiq_disable();
++		fiq_fsm_spin_lock(&dwc_otg_hcd->fiq_state->lock);
++	}
++	/*
++	 * Shutdown any transfers in process by clearing the Tx FIFO Empty
++	 * interrupt mask and status bits and disabling subsequent host
++	 * channel interrupts.
++	 */
++	intr.d32 = 0;
++	intr.b.nptxfempty = 1;
++	intr.b.ptxfempty = 1;
++	intr.b.hcintr = 1;
++	DWC_MODIFY_REG32(&dwc_otg_hcd->core_if->core_global_regs->gintmsk,
++			 intr.d32, 0);
++	DWC_MODIFY_REG32(&dwc_otg_hcd->core_if->core_global_regs->gintsts,
++			 intr.d32, 0);
++
++	del_timers(dwc_otg_hcd);
++
++	/*
++	 * Turn off the vbus power only if the core has transitioned to device
++	 * mode. If still in host mode, need to keep power on to detect a
++	 * reconnection.
++	 */
++	if (dwc_otg_is_device_mode(dwc_otg_hcd->core_if)) {
++		if (dwc_otg_hcd->core_if->op_state != A_SUSPEND) {
++			hprt0_data_t hprt0 = {.d32 = 0 };
++			DWC_PRINTF("Disconnect: PortPower off\n");
++			hprt0.b.prtpwr = 0;
++			DWC_WRITE_REG32(dwc_otg_hcd->core_if->host_if->hprt0,
++					hprt0.d32);
++		}
++
++		dwc_otg_disable_host_interrupts(dwc_otg_hcd->core_if);
++	}
++
++	/* Respond with an error status to all URBs in the schedule. */
++	kill_all_urbs(dwc_otg_hcd);
++
++	if (dwc_otg_is_host_mode(dwc_otg_hcd->core_if)) {
++		/* Clean up any host channels that were in use. */
++		int num_channels;
++		int i;
++		dwc_hc_t *channel;
++		dwc_otg_hc_regs_t *hc_regs;
++		hcchar_data_t hcchar;
++
++		num_channels = dwc_otg_hcd->core_if->core_params->host_channels;
++
++		if (!dwc_otg_hcd->core_if->dma_enable) {
++			/* Flush out any channel requests in slave mode. */
++			for (i = 0; i < num_channels; i++) {
++				channel = dwc_otg_hcd->hc_ptr_array[i];
++				if (DWC_CIRCLEQ_EMPTY_ENTRY
++				    (channel, hc_list_entry)) {
++					hc_regs =
++					    dwc_otg_hcd->core_if->
++					    host_if->hc_regs[i];
++					hcchar.d32 =
++					    DWC_READ_REG32(&hc_regs->hcchar);
++					if (hcchar.b.chen) {
++						hcchar.b.chen = 0;
++						hcchar.b.chdis = 1;
++						hcchar.b.epdir = 0;
++						DWC_WRITE_REG32
++						    (&hc_regs->hcchar,
++						     hcchar.d32);
++					}
++				}
++			}
++		}
++
++		if(fiq_fsm_enable) {
++			for(i=0; i < 128; i++) {
++				dwc_otg_hcd->hub_port[i] = 0;
++			}
++		}
++	}
++
++	if(fiq_enable) {
++		fiq_fsm_spin_unlock(&dwc_otg_hcd->fiq_state->lock);
++		local_fiq_enable();
++	}
++
++	if (dwc_otg_hcd->fops->disconnect) {
++		dwc_otg_hcd->fops->disconnect(dwc_otg_hcd);
++	}
++
++	DWC_SPINUNLOCK(dwc_otg_hcd->lock);
++	return 1;
++}
++
++/**
++ * HCD Callback function for stopping the HCD.
++ *
++ * @param p void pointer to the <code>struct usb_hcd</code>
++ */
++static int32_t dwc_otg_hcd_stop_cb(void *p)
++{
++	dwc_otg_hcd_t *dwc_otg_hcd = p;
++
++	DWC_DEBUGPL(DBG_HCDV, "%s(%p)\n", __func__, p);
++	dwc_otg_hcd_stop(dwc_otg_hcd);
++	return 1;
++}
++
++#ifdef CONFIG_USB_DWC_OTG_LPM
++/**
++ * HCD Callback function for sleep of HCD.
++ *
++ * @param p void pointer to the <code>struct usb_hcd</code>
++ */
++static int dwc_otg_hcd_sleep_cb(void *p)
++{
++	dwc_otg_hcd_t *hcd = p;
++
++	dwc_otg_hcd_free_hc_from_lpm(hcd);
++
++	return 0;
++}
++#endif
++
++
++/**
++ * HCD Callback function for Remote Wakeup.
++ *
++ * @param p void pointer to the <code>struct usb_hcd</code>
++ */
++static int dwc_otg_hcd_rem_wakeup_cb(void *p)
++{
++	dwc_otg_hcd_t *hcd = p;
++
++	if (hcd->core_if->lx_state == DWC_OTG_L2) {
++		hcd->flags.b.port_suspend_change = 1;
++	}
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	else {
++		hcd->flags.b.port_l1_change = 1;
++	}
++#endif
++	return 0;
++}
++
++/**
++ * Halts the DWC_otg host mode operations in a clean manner. USB transfers are
++ * stopped.
++ */
++void dwc_otg_hcd_stop(dwc_otg_hcd_t * hcd)
++{
++	hprt0_data_t hprt0 = {.d32 = 0 };
++
++	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD STOP\n");
++
++	/*
++	 * The root hub should be disconnected before this function is called.
++	 * The disconnect will clear the QTD lists (via ..._hcd_urb_dequeue)
++	 * and the QH lists (via ..._hcd_endpoint_disable).
++	 */
++
++	/* Turn off all host-specific interrupts. */
++	dwc_otg_disable_host_interrupts(hcd->core_if);
++
++	/* Turn off the vbus power */
++	DWC_PRINTF("PortPower off\n");
++	hprt0.b.prtpwr = 0;
++	DWC_WRITE_REG32(hcd->core_if->host_if->hprt0, hprt0.d32);
++	dwc_mdelay(1);
++}
++
++int dwc_otg_hcd_urb_enqueue(dwc_otg_hcd_t * hcd,
++			    dwc_otg_hcd_urb_t * dwc_otg_urb, void **ep_handle,
++			    int atomic_alloc)
++{
++	int retval = 0;
++	uint8_t needs_scheduling = 0;
++	dwc_otg_transaction_type_e tr_type;
++	dwc_otg_qtd_t *qtd;
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++	hprt0_data_t hprt0 = { .d32 = 0 };
++
++#ifdef DEBUG /* integrity checks (Broadcom) */
++	if (NULL == hcd->core_if) {
++		DWC_ERROR("**** DWC OTG HCD URB Enqueue - HCD has NULL core_if\n");
++		/* No longer connected. */
++		return -DWC_E_INVALID;
++	}
++#endif
++	if (!hcd->flags.b.port_connect_status) {
++		/* No longer connected. */
++		DWC_ERROR("Not connected\n");
++		return -DWC_E_NO_DEVICE;
++	}
++
++	/* Some core configurations cannot support LS traffic on a FS root port */
++	if ((hcd->fops->speed(hcd, dwc_otg_urb->priv) == USB_SPEED_LOW) &&
++		(hcd->core_if->hwcfg2.b.fs_phy_type == 1) &&
++		(hcd->core_if->hwcfg2.b.hs_phy_type == 1)) {
++			hprt0.d32 = DWC_READ_REG32(hcd->core_if->host_if->hprt0);
++			if (hprt0.b.prtspd == DWC_HPRT0_PRTSPD_FULL_SPEED) {
++				return -DWC_E_NO_DEVICE;
++			}
++	}
++
++	qtd = dwc_otg_hcd_qtd_create(dwc_otg_urb, atomic_alloc);
++	if (qtd == NULL) {
++		DWC_ERROR("DWC OTG HCD URB Enqueue failed creating QTD\n");
++		return -DWC_E_NO_MEMORY;
++	}
++#ifdef DEBUG /* integrity checks (Broadcom) */
++	if (qtd->urb == NULL) {
++		DWC_ERROR("**** DWC OTG HCD URB Enqueue created QTD with no URBs\n");
++		return -DWC_E_NO_MEMORY;
++	}
++	if (qtd->urb->priv == NULL) {
++		DWC_ERROR("**** DWC OTG HCD URB Enqueue created QTD URB with no URB handle\n");
++		return -DWC_E_NO_MEMORY;
++	}
++#endif
++	intr_mask.d32 = DWC_READ_REG32(&hcd->core_if->core_global_regs->gintmsk);
++	if(!intr_mask.b.sofintr || fiq_enable) needs_scheduling = 1;
++	if((((dwc_otg_qh_t *)ep_handle)->ep_type == UE_BULK) && !(qtd->urb->flags & URB_GIVEBACK_ASAP))
++		/* Do not schedule SG transactions until qtd has URB_GIVEBACK_ASAP set */
++		needs_scheduling = 0;
++
++	retval = dwc_otg_hcd_qtd_add(qtd, hcd, (dwc_otg_qh_t **) ep_handle, atomic_alloc);
++            // creates a new queue in ep_handle if it doesn't exist already
++	if (retval < 0) {
++		DWC_ERROR("DWC OTG HCD URB Enqueue failed adding QTD. "
++			  "Error status %d\n", retval);
++		dwc_otg_hcd_qtd_free(qtd);
++		return retval;
++	}
++
++	if(needs_scheduling) {
++		tr_type = dwc_otg_hcd_select_transactions(hcd);
++		if (tr_type != DWC_OTG_TRANSACTION_NONE) {
++			dwc_otg_hcd_queue_transactions(hcd, tr_type);
++		}
++	}
++	return retval;
++}
++
++int dwc_otg_hcd_urb_dequeue(dwc_otg_hcd_t * hcd,
++			    dwc_otg_hcd_urb_t * dwc_otg_urb)
++{
++	dwc_otg_qh_t *qh;
++	dwc_otg_qtd_t *urb_qtd;
++	BUG_ON(!hcd);
++	BUG_ON(!dwc_otg_urb);
++
++#ifdef DEBUG /* integrity checks (Broadcom) */
++
++	if (hcd == NULL) {
++		DWC_ERROR("**** DWC OTG HCD URB Dequeue has NULL HCD\n");
++		return -DWC_E_INVALID;
++	}
++	if (dwc_otg_urb == NULL) {
++		DWC_ERROR("**** DWC OTG HCD URB Dequeue has NULL URB\n");
++		return -DWC_E_INVALID;
++	}
++	if (dwc_otg_urb->qtd == NULL) {
++		DWC_ERROR("**** DWC OTG HCD URB Dequeue with NULL QTD\n");
++		return -DWC_E_INVALID;
++	}
++	urb_qtd = dwc_otg_urb->qtd;
++	BUG_ON(!urb_qtd);
++	if (urb_qtd->qh == NULL) {
++		DWC_ERROR("**** DWC OTG HCD URB Dequeue with QTD with NULL Q handler\n");
++		return -DWC_E_INVALID;
++	}
++#else
++	urb_qtd = dwc_otg_urb->qtd;
++	BUG_ON(!urb_qtd);
++#endif
++	qh = urb_qtd->qh;
++	BUG_ON(!qh);
++	if (CHK_DEBUG_LEVEL(DBG_HCDV | DBG_HCD_URB)) {
++		if (urb_qtd->in_process) {
++			dump_channel_info(hcd, qh);
++		}
++	}
++#ifdef DEBUG /* integrity checks (Broadcom) */
++	if (hcd->core_if == NULL) {
++		DWC_ERROR("**** DWC OTG HCD URB Dequeue HCD has NULL core_if\n");
++		return -DWC_E_INVALID;
++	}
++#endif
++	if (urb_qtd->in_process && qh->channel) {
++		/* The QTD is in process (it has been assigned to a channel). */
++		if (hcd->flags.b.port_connect_status) {
++			int n = qh->channel->hc_num;
++			/*
++			 * If still connected (i.e. in host mode), halt the
++			 * channel so it can be used for other transfers. If
++			 * no longer connected, the host registers can't be
++			 * written to halt the channel since the core is in
++			 * device mode.
++			 */
++			/* In FIQ FSM mode, we need to shut down carefully.
++			 * The FIQ may attempt to restart a disabled channel */
++			if (fiq_fsm_enable && (hcd->fiq_state->channel[n].fsm != FIQ_PASSTHROUGH)) {
++				int retries = 3;
++				int running = 0;
++				enum fiq_fsm_state state;
++
++				local_fiq_disable();
++				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
++				qh->channel->halt_status = DWC_OTG_HC_XFER_URB_DEQUEUE;
++				qh->channel->halt_pending = 1;
++				if (hcd->fiq_state->channel[n].fsm == FIQ_HS_ISOC_TURBO ||
++				    hcd->fiq_state->channel[n].fsm == FIQ_HS_ISOC_SLEEPING)
++					hcd->fiq_state->channel[n].fsm = FIQ_HS_ISOC_ABORTED;
++				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
++				local_fiq_enable();
++
++				if (dwc_qh_is_non_per(qh)) {
++					do {
++						state = READ_ONCE(hcd->fiq_state->channel[n].fsm);
++						running = (state != FIQ_NP_SPLIT_DONE) &&
++							  (state != FIQ_NP_SPLIT_LS_ABORTED) &&
++							  (state != FIQ_NP_SPLIT_HS_ABORTED);
++						if (!running)
++							break;
++						udelay(125);
++					} while(--retries);
++					if (!retries)
++						DWC_WARN("Timed out waiting for FSM NP transfer to complete on %d",
++							 qh->channel->hc_num);
++				}
++			} else {
++				dwc_otg_hc_halt(hcd->core_if, qh->channel,
++						DWC_OTG_HC_XFER_URB_DEQUEUE);
++			}
++		}
++	}
++
++	/*
++	 * Free the QTD and clean up the associated QH. Leave the QH in the
++	 * schedule if it has any remaining QTDs.
++	 */
++
++	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD URB Dequeue - "
++                    "delete %sQueue handler\n",
++                    hcd->core_if->dma_desc_enable?"DMA ":"");
++	if (!hcd->core_if->dma_desc_enable) {
++		uint8_t b = urb_qtd->in_process;
++		if (nak_holdoff && qh->do_split && dwc_qh_is_non_per(qh))
++			qh->nak_frame = 0xFFFF;
++		dwc_otg_hcd_qtd_remove_and_free(hcd, urb_qtd, qh);
++		if (b) {
++			dwc_otg_hcd_qh_deactivate(hcd, qh, 0);
++			qh->channel = NULL;
++		} else if (DWC_CIRCLEQ_EMPTY(&qh->qtd_list)) {
++			dwc_otg_hcd_qh_remove(hcd, qh);
++		}
++	} else {
++		dwc_otg_hcd_qtd_remove_and_free(hcd, urb_qtd, qh);
++	}
++	return 0;
++}
++
++int dwc_otg_hcd_endpoint_disable(dwc_otg_hcd_t * hcd, void *ep_handle,
++				 int retry)
++{
++	dwc_otg_qh_t *qh = (dwc_otg_qh_t *) ep_handle;
++	int retval = 0;
++	dwc_irqflags_t flags;
++
++	if (retry < 0) {
++		retval = -DWC_E_INVALID;
++		goto done;
++	}
++
++	if (!qh) {
++		retval = -DWC_E_INVALID;
++		goto done;
++	}
++
++	DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
++
++	while (!DWC_CIRCLEQ_EMPTY(&qh->qtd_list) && retry) {
++		DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
++		retry--;
++		dwc_msleep(5);
++		DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
++	}
++
++	dwc_otg_hcd_qh_remove(hcd, qh);
++
++	DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
++	/*
++	 * Split dwc_otg_hcd_qh_remove_and_free() into qh_remove
++	 * and qh_free to prevent stack dump on DWC_DMA_FREE() with
++	 * irq_disabled (spinlock_irqsave) in dwc_otg_hcd_desc_list_free()
++	 * and dwc_otg_hcd_frame_list_alloc().
++	 */
++	dwc_otg_hcd_qh_free(hcd, qh);
++
++done:
++	return retval;
++}
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30)
++int dwc_otg_hcd_endpoint_reset(dwc_otg_hcd_t * hcd, void *ep_handle)
++{
++	int retval = 0;
++	dwc_otg_qh_t *qh = (dwc_otg_qh_t *) ep_handle;
++	if (!qh)
++		return -DWC_E_INVALID;
++
++	qh->data_toggle = DWC_OTG_HC_PID_DATA0;
++	return retval;
++}
++#endif
++
++/**
++ * HCD Callback structure for handling mode switching.
++ */
++static dwc_otg_cil_callbacks_t hcd_cil_callbacks = {
++	.start = dwc_otg_hcd_start_cb,
++	.stop = dwc_otg_hcd_stop_cb,
++	.disconnect = dwc_otg_hcd_disconnect_cb,
++	.session_start = dwc_otg_hcd_session_start_cb,
++	.resume_wakeup = dwc_otg_hcd_rem_wakeup_cb,
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	.sleep = dwc_otg_hcd_sleep_cb,
++#endif
++	.p = 0,
++};
++
++/**
++ * Reset tasklet function
++ */
++static void reset_tasklet_func(void *data)
++{
++	dwc_otg_hcd_t *dwc_otg_hcd = (dwc_otg_hcd_t *) data;
++	dwc_otg_core_if_t *core_if = dwc_otg_hcd->core_if;
++	hprt0_data_t hprt0;
++
++	DWC_DEBUGPL(DBG_HCDV, "USB RESET tasklet called\n");
++
++	hprt0.d32 = dwc_otg_read_hprt0(core_if);
++	hprt0.b.prtrst = 1;
++	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++	dwc_mdelay(60);
++
++	hprt0.b.prtrst = 0;
++	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++	dwc_otg_hcd->flags.b.port_reset_change = 1;
++}
++
++static void completion_tasklet_func(void *ptr)
++{
++	dwc_otg_hcd_t *hcd = (dwc_otg_hcd_t *) ptr;
++	struct urb *urb;
++	urb_tq_entry_t *item;
++	dwc_irqflags_t flags;
++
++	/* This could just be spin_lock_irq */
++	DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
++	while (!DWC_TAILQ_EMPTY(&hcd->completed_urb_list)) {
++		item = DWC_TAILQ_FIRST(&hcd->completed_urb_list);
++		urb = item->urb;
++		DWC_TAILQ_REMOVE(&hcd->completed_urb_list, item,
++				urb_tq_entries);
++		DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
++		DWC_FREE(item);
++
++		usb_hcd_giveback_urb(hcd->priv, urb, urb->status);
++
++
++		DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
++	}
++	DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
++	return;
++}
++
++static void qh_list_free(dwc_otg_hcd_t * hcd, dwc_list_link_t * qh_list)
++{
++	dwc_list_link_t *item;
++	dwc_otg_qh_t *qh;
++	dwc_irqflags_t flags;
++
++	if (!qh_list->next) {
++		/* The list hasn't been initialized yet. */
++		return;
++	}
++	/*
++	 * Hold spinlock here. Not needed in that case if bellow
++	 * function is being called from ISR
++	 */
++	DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
++	/* Ensure there are no QTDs or URBs left. */
++	kill_urbs_in_qh_list(hcd, qh_list);
++	DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
++
++	DWC_LIST_FOREACH(item, qh_list) {
++		qh = DWC_LIST_ENTRY(item, dwc_otg_qh_t, qh_list_entry);
++		dwc_otg_hcd_qh_remove_and_free(hcd, qh);
++	}
++}
++
++/**
++ * Exit from Hibernation if Host did not detect SRP from connected SRP capable
++ * Device during SRP time by host power up.
++ */
++#ifdef DWC_DEV_SRPCAP
++static void dwc_otg_hcd_power_up(void *ptr)
++{
++	gpwrdn_data_t gpwrdn = {.d32 = 0 };
++	dwc_otg_core_if_t *core_if = (dwc_otg_core_if_t *) ptr;
++
++	DWC_PRINTF("%s called\n", __FUNCTION__);
++
++	if (!core_if->hibernation_suspend) {
++		DWC_PRINTF("Already exited from Hibernation\n");
++		return;
++	}
++
++	/* Switch on the voltage to the core */
++	gpwrdn.b.pwrdnswtch = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Reset the core */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnrstn = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Disable power clamps */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnclmp = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	/* Remove reset the core signal */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pwrdnrstn = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
++	dwc_udelay(10);
++
++	/* Disable PMU interrupt */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pmuintsel = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	core_if->hibernation_suspend = 0;
++
++	/* Disable PMU */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.pmuactv = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++	dwc_udelay(10);
++
++	/* Enable VBUS */
++	gpwrdn.d32 = 0;
++	gpwrdn.b.dis_vbus = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
++
++	core_if->op_state = A_HOST;
++	dwc_otg_core_init(core_if);
++	dwc_otg_enable_global_interrupts(core_if);
++	cil_hcd_start(core_if);
++}
++#endif
++
++void dwc_otg_cleanup_fiq_channel(dwc_otg_hcd_t *hcd, uint32_t num)
++{
++	struct fiq_channel_state *st = &hcd->fiq_state->channel[num];
++	struct fiq_dma_channel *split_dma = hcd->fiq_dmab;
++	int i;
++
++	st->fsm = FIQ_PASSTHROUGH;
++	st->hcchar_copy.d32 = 0;
++	st->hcsplt_copy.d32 = 0;
++	st->hcint_copy.d32 = 0;
++	st->hcintmsk_copy.d32 = 0;
++	st->hctsiz_copy.d32 = 0;
++	st->hcdma_copy.d32 = 0;
++	st->nr_errors = 0;
++	st->hub_addr = 0;
++	st->port_addr = 0;
++	st->expected_uframe = 0;
++	st->nrpackets = 0;
++	st->dma_info.index = 0;
++	for (i = 0; i < 6; i++)
++		st->dma_info.slot_len[i] = 255;
++	st->hs_isoc_info.index = 0;
++	st->hs_isoc_info.iso_desc = NULL;
++	st->hs_isoc_info.nrframes = 0;
++
++	DWC_MEMSET(&split_dma[num].index[0], 0x6b, 1128);
++}
++
++/**
++ * Frees secondary storage associated with the dwc_otg_hcd structure contained
++ * in the struct usb_hcd field.
++ */
++static void dwc_otg_hcd_free(dwc_otg_hcd_t * dwc_otg_hcd)
++{
++	struct device *dev = dwc_otg_hcd_to_dev(dwc_otg_hcd);
++	int i;
++
++	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD FREE\n");
++
++	del_timers(dwc_otg_hcd);
++
++	/* Free memory for QH/QTD lists */
++	qh_list_free(dwc_otg_hcd, &dwc_otg_hcd->non_periodic_sched_inactive);
++	qh_list_free(dwc_otg_hcd, &dwc_otg_hcd->non_periodic_sched_active);
++	qh_list_free(dwc_otg_hcd, &dwc_otg_hcd->periodic_sched_inactive);
++	qh_list_free(dwc_otg_hcd, &dwc_otg_hcd->periodic_sched_ready);
++	qh_list_free(dwc_otg_hcd, &dwc_otg_hcd->periodic_sched_assigned);
++	qh_list_free(dwc_otg_hcd, &dwc_otg_hcd->periodic_sched_queued);
++
++	/* Free memory for the host channels. */
++	for (i = 0; i < MAX_EPS_CHANNELS; i++) {
++		dwc_hc_t *hc = dwc_otg_hcd->hc_ptr_array[i];
++
++#ifdef DEBUG
++		if (dwc_otg_hcd->core_if->hc_xfer_timer[i]) {
++			DWC_TIMER_FREE(dwc_otg_hcd->core_if->hc_xfer_timer[i]);
++		}
++#endif
++		if (hc != NULL) {
++			DWC_DEBUGPL(DBG_HCDV, "HCD Free channel #%i, hc=%p\n",
++				    i, hc);
++			DWC_FREE(hc);
++		}
++	}
++
++	if (dwc_otg_hcd->core_if->dma_enable) {
++		if (dwc_otg_hcd->status_buf_dma) {
++			DWC_DMA_FREE(dev, DWC_OTG_HCD_STATUS_BUF_SIZE,
++				     dwc_otg_hcd->status_buf,
++				     dwc_otg_hcd->status_buf_dma);
++		}
++	} else if (dwc_otg_hcd->status_buf != NULL) {
++		DWC_FREE(dwc_otg_hcd->status_buf);
++	}
++	DWC_SPINLOCK_FREE(dwc_otg_hcd->lock);
++	/* Set core_if's lock pointer to NULL */
++	dwc_otg_hcd->core_if->lock = NULL;
++
++	DWC_TIMER_FREE(dwc_otg_hcd->conn_timer);
++	DWC_TASK_FREE(dwc_otg_hcd->reset_tasklet);
++	DWC_TASK_FREE(dwc_otg_hcd->completion_tasklet);
++	DWC_DMA_FREE(dev, 16, dwc_otg_hcd->fiq_state->dummy_send,
++		     dwc_otg_hcd->fiq_state->dummy_send_dma);
++	DWC_FREE(dwc_otg_hcd->fiq_state);
++
++#ifdef DWC_DEV_SRPCAP
++	if (dwc_otg_hcd->core_if->power_down == 2 &&
++	    dwc_otg_hcd->core_if->pwron_timer) {
++		DWC_TIMER_FREE(dwc_otg_hcd->core_if->pwron_timer);
++	}
++#endif
++	DWC_FREE(dwc_otg_hcd);
++}
++
++int dwc_otg_hcd_init(dwc_otg_hcd_t * hcd, dwc_otg_core_if_t * core_if)
++{
++	struct device *dev = dwc_otg_hcd_to_dev(hcd);
++	int retval = 0;
++	int num_channels;
++	int i;
++	dwc_hc_t *channel;
++
++#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_SPINLOCK))
++	DWC_SPINLOCK_ALLOC_LINUX_DEBUG(hcd->lock);
++#else
++	hcd->lock = DWC_SPINLOCK_ALLOC();
++#endif
++        DWC_DEBUGPL(DBG_HCDV, "init of HCD %p given core_if %p\n",
++                    hcd, core_if);
++	if (!hcd->lock) {
++		DWC_ERROR("Could not allocate lock for pcd");
++		DWC_FREE(hcd);
++		retval = -DWC_E_NO_MEMORY;
++		goto out;
++	}
++	hcd->core_if = core_if;
++
++	/* Register the HCD CIL Callbacks */
++	dwc_otg_cil_register_hcd_callbacks(hcd->core_if,
++					   &hcd_cil_callbacks, hcd);
++
++	/* Initialize the non-periodic schedule. */
++	DWC_LIST_INIT(&hcd->non_periodic_sched_inactive);
++	DWC_LIST_INIT(&hcd->non_periodic_sched_active);
++
++	/* Initialize the periodic schedule. */
++	DWC_LIST_INIT(&hcd->periodic_sched_inactive);
++	DWC_LIST_INIT(&hcd->periodic_sched_ready);
++	DWC_LIST_INIT(&hcd->periodic_sched_assigned);
++	DWC_LIST_INIT(&hcd->periodic_sched_queued);
++	DWC_TAILQ_INIT(&hcd->completed_urb_list);
++	/*
++	 * Create a host channel descriptor for each host channel implemented
++	 * in the controller. Initialize the channel descriptor array.
++	 */
++	DWC_CIRCLEQ_INIT(&hcd->free_hc_list);
++	num_channels = hcd->core_if->core_params->host_channels;
++	DWC_MEMSET(hcd->hc_ptr_array, 0, sizeof(hcd->hc_ptr_array));
++	for (i = 0; i < num_channels; i++) {
++		channel = DWC_ALLOC(sizeof(dwc_hc_t));
++		if (channel == NULL) {
++			retval = -DWC_E_NO_MEMORY;
++			DWC_ERROR("%s: host channel allocation failed\n",
++				  __func__);
++			dwc_otg_hcd_free(hcd);
++			goto out;
++		}
++		channel->hc_num = i;
++		hcd->hc_ptr_array[i] = channel;
++#ifdef DEBUG
++		hcd->core_if->hc_xfer_timer[i] =
++		    DWC_TIMER_ALLOC("hc timer", hc_xfer_timeout,
++				    &hcd->core_if->hc_xfer_info[i]);
++#endif
++		DWC_DEBUGPL(DBG_HCDV, "HCD Added channel #%d, hc=%p\n", i,
++			    channel);
++	}
++
++	if (fiq_enable) {
++		hcd->fiq_state = DWC_ALLOC(sizeof(struct fiq_state) + (sizeof(struct fiq_channel_state) * num_channels));
++		if (!hcd->fiq_state) {
++			retval = -DWC_E_NO_MEMORY;
++			DWC_ERROR("%s: cannot allocate fiq_state structure\n", __func__);
++			dwc_otg_hcd_free(hcd);
++			goto out;
++		}
++		DWC_MEMSET(hcd->fiq_state, 0, (sizeof(struct fiq_state) + (sizeof(struct fiq_channel_state) * num_channels)));
++
++#ifdef CONFIG_ARM64
++		spin_lock_init(&hcd->fiq_state->lock);
++#endif
++
++		hcd->fiq_state->dummy_send = DWC_DMA_ALLOC_ATOMIC(dev, 16,
++							 &hcd->fiq_state->dummy_send_dma);
++
++		hcd->fiq_stack = DWC_ALLOC(sizeof(struct fiq_stack));
++		if (!hcd->fiq_stack) {
++			retval = -DWC_E_NO_MEMORY;
++			DWC_ERROR("%s: cannot allocate fiq_stack structure\n", __func__);
++			dwc_otg_hcd_free(hcd);
++			goto out;
++		}
++		hcd->fiq_stack->magic1 = 0xDEADBEEF;
++		hcd->fiq_stack->magic2 = 0xD00DFEED;
++		hcd->fiq_state->gintmsk_saved.d32 = ~0;
++		hcd->fiq_state->haintmsk_saved.b2.chint = ~0;
++
++		/* This bit is terrible and uses no API, but necessary. The FIQ has no concept of DMA pools
++		 * (and if it did, would be a lot slower). This allocates a chunk of memory (~9kiB for 8 host channels)
++		 * for use as transaction bounce buffers in a 2-D array. Our access into this chunk is done by some
++		 * moderately readable array casts.
++		 */
++		hcd->fiq_dmab = DWC_DMA_ALLOC(dev, (sizeof(struct fiq_dma_channel) * num_channels), &hcd->fiq_state->dma_base);
++		DWC_WARN("FIQ DMA bounce buffers: virt = %px dma = %pad len=%zu",
++				hcd->fiq_dmab, &hcd->fiq_state->dma_base,
++				sizeof(struct fiq_dma_channel) * num_channels);
++
++		DWC_MEMSET(hcd->fiq_dmab, 0x6b, 9024);
++
++		/* pointer for debug in fiq_print */
++		hcd->fiq_state->fiq_dmab = hcd->fiq_dmab;
++		if (fiq_fsm_enable) {
++			int i;
++			for (i=0; i < hcd->core_if->core_params->host_channels; i++) {
++				dwc_otg_cleanup_fiq_channel(hcd, i);
++			}
++			DWC_PRINTF("FIQ FSM acceleration enabled for :\n%s%s%s%s",
++				(fiq_fsm_mask & 0x1) ? "Non-periodic Split Transactions\n" : "",
++				(fiq_fsm_mask & 0x2) ? "Periodic Split Transactions\n" : "",
++				(fiq_fsm_mask & 0x4) ? "High-Speed Isochronous Endpoints\n" : "",
++				(fiq_fsm_mask & 0x8) ? "Interrupt/Control Split Transaction hack enabled\n" : "");
++		}
++	}
++
++	/* Initialize the Connection timeout timer. */
++	hcd->conn_timer = DWC_TIMER_ALLOC("Connection timer",
++					  dwc_otg_hcd_connect_timeout, 0);
++
++	printk(KERN_DEBUG "dwc_otg: Microframe scheduler %s\n", microframe_schedule ? "enabled":"disabled");
++	if (microframe_schedule)
++		init_hcd_usecs(hcd);
++
++	/* Initialize reset tasklet. */
++	hcd->reset_tasklet = DWC_TASK_ALLOC("reset_tasklet", reset_tasklet_func, hcd);
++
++	hcd->completion_tasklet = DWC_TASK_ALLOC("completion_tasklet",
++						completion_tasklet_func, hcd);
++#ifdef DWC_DEV_SRPCAP
++	if (hcd->core_if->power_down == 2) {
++		/* Initialize Power on timer for Host power up in case hibernation */
++		hcd->core_if->pwron_timer = DWC_TIMER_ALLOC("PWRON TIMER",
++									dwc_otg_hcd_power_up, core_if);
++	}
++#endif
++
++	/*
++	 * Allocate space for storing data on status transactions. Normally no
++	 * data is sent, but this space acts as a bit bucket. This must be
++	 * done after usb_add_hcd since that function allocates the DMA buffer
++	 * pool.
++	 */
++	if (hcd->core_if->dma_enable) {
++		hcd->status_buf =
++		    DWC_DMA_ALLOC(dev, DWC_OTG_HCD_STATUS_BUF_SIZE,
++				  &hcd->status_buf_dma);
++	} else {
++		hcd->status_buf = DWC_ALLOC(DWC_OTG_HCD_STATUS_BUF_SIZE);
++	}
++	if (!hcd->status_buf) {
++		retval = -DWC_E_NO_MEMORY;
++		DWC_ERROR("%s: status_buf allocation failed\n", __func__);
++		dwc_otg_hcd_free(hcd);
++		goto out;
++	}
++
++	hcd->otg_port = 1;
++	hcd->frame_list = NULL;
++	hcd->frame_list_dma = 0;
++	hcd->periodic_qh_count = 0;
++
++	DWC_MEMSET(hcd->hub_port, 0, sizeof(hcd->hub_port));
++#ifdef FIQ_DEBUG
++	DWC_MEMSET(hcd->hub_port_alloc, -1, sizeof(hcd->hub_port_alloc));
++#endif
++
++out:
++	return retval;
++}
++
++void dwc_otg_hcd_remove(dwc_otg_hcd_t * hcd)
++{
++	/* Turn off all host-specific interrupts. */
++	dwc_otg_disable_host_interrupts(hcd->core_if);
++
++	dwc_otg_hcd_free(hcd);
++}
++
++/**
++ * Initializes dynamic portions of the DWC_otg HCD state.
++ */
++static void dwc_otg_hcd_reinit(dwc_otg_hcd_t * hcd)
++{
++	int num_channels;
++	int i;
++	dwc_hc_t *channel;
++	dwc_hc_t *channel_tmp;
++
++	hcd->flags.d32 = 0;
++
++	hcd->non_periodic_qh_ptr = &hcd->non_periodic_sched_active;
++	if (!microframe_schedule) {
++		hcd->non_periodic_channels = 0;
++		hcd->periodic_channels = 0;
++	} else {
++		hcd->available_host_channels = hcd->core_if->core_params->host_channels;
++	}
++	/*
++	 * Put all channels in the free channel list and clean up channel
++	 * states.
++	 */
++	DWC_CIRCLEQ_FOREACH_SAFE(channel, channel_tmp,
++				 &hcd->free_hc_list, hc_list_entry) {
++		DWC_CIRCLEQ_REMOVE(&hcd->free_hc_list, channel, hc_list_entry);
++	}
++
++	num_channels = hcd->core_if->core_params->host_channels;
++	for (i = 0; i < num_channels; i++) {
++		channel = hcd->hc_ptr_array[i];
++		DWC_CIRCLEQ_INSERT_TAIL(&hcd->free_hc_list, channel,
++					hc_list_entry);
++		dwc_otg_hc_cleanup(hcd->core_if, channel);
++	}
++
++	/* Initialize the DWC core for host mode operation. */
++	dwc_otg_core_host_init(hcd->core_if);
++
++	/* Set core_if's lock pointer to the hcd->lock */
++	hcd->core_if->lock = hcd->lock;
++}
++
++/**
++ * Assigns transactions from a QTD to a free host channel and initializes the
++ * host channel to perform the transactions. The host channel is removed from
++ * the free list.
++ *
++ * @param hcd The HCD state structure.
++ * @param qh Transactions from the first QTD for this QH are selected and
++ * assigned to a free host channel.
++ */
++static void assign_and_init_hc(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	dwc_hc_t *hc;
++	dwc_otg_qtd_t *qtd;
++	dwc_otg_hcd_urb_t *urb;
++	void* ptr = NULL;
++	uint16_t wLength;
++	uint32_t intr_enable;
++	unsigned long flags;
++	gintmsk_data_t gintmsk = { .d32 = 0, };
++	struct device *dev = dwc_otg_hcd_to_dev(hcd);
++
++	qtd = DWC_CIRCLEQ_FIRST(&qh->qtd_list);
++
++	urb = qtd->urb;
++
++	DWC_DEBUGPL(DBG_HCDV, "%s(%p,%p) - urb %x, actual_length %d\n", __func__, hcd, qh, (unsigned int)urb, urb->actual_length);
++
++	if (((urb->actual_length < 0) || (urb->actual_length > urb->length)) && !dwc_otg_hcd_is_pipe_in(&urb->pipe_info))
++		urb->actual_length = urb->length;
++
++
++	hc = DWC_CIRCLEQ_FIRST(&hcd->free_hc_list);
++
++	/* Remove the host channel from the free list. */
++	DWC_CIRCLEQ_REMOVE_INIT(&hcd->free_hc_list, hc, hc_list_entry);
++
++	qh->channel = hc;
++
++	qtd->in_process = 1;
++
++	/*
++	 * Use usb_pipedevice to determine device address. This address is
++	 * 0 before the SET_ADDRESS command and the correct address afterward.
++	 */
++	hc->dev_addr = dwc_otg_hcd_get_dev_addr(&urb->pipe_info);
++	hc->ep_num = dwc_otg_hcd_get_ep_num(&urb->pipe_info);
++	hc->speed = qh->dev_speed;
++	hc->max_packet = dwc_max_packet(qh->maxp);
++
++	hc->xfer_started = 0;
++	hc->halt_status = DWC_OTG_HC_XFER_NO_HALT_STATUS;
++	hc->error_state = (qtd->error_count > 0);
++	hc->halt_on_queue = 0;
++	hc->halt_pending = 0;
++	hc->requests = 0;
++
++	/*
++	 * The following values may be modified in the transfer type section
++	 * below. The xfer_len value may be reduced when the transfer is
++	 * started to accommodate the max widths of the XferSize and PktCnt
++	 * fields in the HCTSIZn register.
++	 */
++
++	hc->ep_is_in = (dwc_otg_hcd_is_pipe_in(&urb->pipe_info) != 0);
++	if (hc->ep_is_in) {
++		hc->do_ping = 0;
++	} else {
++		hc->do_ping = qh->ping_state;
++	}
++
++	hc->data_pid_start = qh->data_toggle;
++	hc->multi_count = 1;
++
++	if (hcd->core_if->dma_enable) {
++		hc->xfer_buff =
++		    (uint8_t *)(uintptr_t)urb->dma + urb->actual_length;
++
++		/* For non-dword aligned case */
++		if (((unsigned long)hc->xfer_buff & 0x3)
++		    && !hcd->core_if->dma_desc_enable) {
++			ptr = (uint8_t *) urb->buf + urb->actual_length;
++		}
++	} else {
++		hc->xfer_buff = (uint8_t *) urb->buf + urb->actual_length;
++	}
++	hc->xfer_len = urb->length - urb->actual_length;
++	hc->xfer_count = 0;
++
++	/*
++	 * Set the split attributes
++	 */
++	hc->do_split = 0;
++	if (qh->do_split) {
++		uint32_t hub_addr, port_addr;
++		hc->do_split = 1;
++		hc->start_pkt_count = 1;
++		hc->xact_pos = qtd->isoc_split_pos;
++		/* We don't need to do complete splits anymore */
++//		if(fiq_fsm_enable)
++		if (0)
++			hc->complete_split = qtd->complete_split = 0;
++		else
++			hc->complete_split = qtd->complete_split;
++
++		hcd->fops->hub_info(hcd, urb->priv, &hub_addr, &port_addr);
++		hc->hub_addr = (uint8_t) hub_addr;
++		hc->port_addr = (uint8_t) port_addr;
++	}
++
++	switch (dwc_otg_hcd_get_pipe_type(&urb->pipe_info)) {
++	case UE_CONTROL:
++		hc->ep_type = DWC_OTG_EP_TYPE_CONTROL;
++		switch (qtd->control_phase) {
++		case DWC_OTG_CONTROL_SETUP:
++			DWC_DEBUGPL(DBG_HCDV, "  Control setup transaction\n");
++			hc->do_ping = 0;
++			hc->ep_is_in = 0;
++			hc->data_pid_start = DWC_OTG_HC_PID_SETUP;
++			if (hcd->core_if->dma_enable) {
++				hc->xfer_buff =
++					(uint8_t *)(uintptr_t)urb->setup_dma;
++			} else {
++				hc->xfer_buff = (uint8_t *) urb->setup_packet;
++			}
++			hc->xfer_len = 8;
++			ptr = NULL;
++			break;
++		case DWC_OTG_CONTROL_DATA:
++			DWC_DEBUGPL(DBG_HCDV, "  Control data transaction\n");
++			/*
++			 * Hardware bug: small IN packets with length < 4
++			 * cause a 4-byte write to memory. We can only catch
++			 * the case where we know a short packet is going to be
++			 * returned in a control transfer, as the length is
++			 * specified in the setup packet. This is only an issue
++			 * for drivers that insist on packing a device's various
++			 * properties into a struct and querying them one at a
++			 * time (uvcvideo).
++			 * Force the use of align_buf so that the subsequent
++			 * memcpy puts the right number of bytes in the URB's
++			 * buffer.
++			 */
++			wLength = ((uint16_t *)urb->setup_packet)[3];
++			#if 0
++			if (hc->ep_is_in && wLength < 4)
++				ptr = hc->xfer_buff;
++			#endif
++
++			hc->data_pid_start = qtd->data_toggle;
++			break;
++		case DWC_OTG_CONTROL_STATUS:
++			/*
++			 * Direction is opposite of data direction or IN if no
++			 * data.
++			 */
++			DWC_DEBUGPL(DBG_HCDV, "  Control status transaction\n");
++			if (urb->length == 0) {
++				hc->ep_is_in = 1;
++			} else {
++				hc->ep_is_in =
++				    dwc_otg_hcd_is_pipe_out(&urb->pipe_info);
++			}
++			if (hc->ep_is_in) {
++				hc->do_ping = 0;
++			}
++
++			hc->data_pid_start = DWC_OTG_HC_PID_DATA1;
++
++			hc->xfer_len = 0;
++			if (hcd->core_if->dma_enable) {
++				hc->xfer_buff = (uint8_t *)
++					(uintptr_t)hcd->status_buf_dma;
++			} else {
++				hc->xfer_buff = (uint8_t *) hcd->status_buf;
++			}
++			ptr = NULL;
++			break;
++		}
++		break;
++	case UE_BULK:
++		hc->ep_type = DWC_OTG_EP_TYPE_BULK;
++		break;
++	case UE_INTERRUPT:
++		hc->ep_type = DWC_OTG_EP_TYPE_INTR;
++		break;
++	case UE_ISOCHRONOUS:
++		{
++			struct dwc_otg_hcd_iso_packet_desc *frame_desc;
++
++			hc->ep_type = DWC_OTG_EP_TYPE_ISOC;
++
++			if (hcd->core_if->dma_desc_enable)
++				break;
++
++			frame_desc = &urb->iso_descs[qtd->isoc_frame_index];
++
++			frame_desc->status = 0;
++
++			if (hcd->core_if->dma_enable) {
++				hc->xfer_buff = (uint8_t *)(uintptr_t)urb->dma;
++			} else {
++				hc->xfer_buff = (uint8_t *) urb->buf;
++			}
++			hc->xfer_buff +=
++			    frame_desc->offset + qtd->isoc_split_offset;
++			hc->xfer_len =
++			    frame_desc->length - qtd->isoc_split_offset;
++
++			/* For non-dword aligned buffers */
++			if (((unsigned long)hc->xfer_buff & 0x3)
++			    && hcd->core_if->dma_enable) {
++				ptr =
++				    (uint8_t *) urb->buf + frame_desc->offset +
++				    qtd->isoc_split_offset;
++			} else
++				ptr = NULL;
++
++			if (hc->xact_pos == DWC_HCSPLIT_XACTPOS_ALL) {
++				if (hc->xfer_len <= 188) {
++					hc->xact_pos = DWC_HCSPLIT_XACTPOS_ALL;
++				} else {
++					hc->xact_pos =
++					    DWC_HCSPLIT_XACTPOS_BEGIN;
++				}
++			}
++		}
++		break;
++	}
++	/* non DWORD-aligned buffer case */
++	if (ptr) {
++		uint32_t buf_size;
++		if (hc->ep_type != DWC_OTG_EP_TYPE_ISOC) {
++			buf_size = hcd->core_if->core_params->max_transfer_size;
++		} else {
++			buf_size = 4096;
++		}
++		if (!qh->dw_align_buf) {
++			qh->dw_align_buf = DWC_DMA_ALLOC_ATOMIC(dev, buf_size,
++							 &qh->dw_align_buf_dma);
++			if (!qh->dw_align_buf) {
++				DWC_ERROR
++				    ("%s: Failed to allocate memory to handle "
++				     "non-dword aligned buffer case\n",
++				     __func__);
++				return;
++			}
++		}
++		if (!hc->ep_is_in) {
++			dwc_memcpy(qh->dw_align_buf, ptr, hc->xfer_len);
++		}
++		hc->align_buff = qh->dw_align_buf_dma;
++	} else {
++		hc->align_buff = 0;
++	}
++
++	if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
++	    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
++		/*
++		 * This value may be modified when the transfer is started to
++		 * reflect the actual transfer length.
++		 */
++		hc->multi_count = dwc_hb_mult(qh->maxp);
++	}
++
++	if (hcd->core_if->dma_desc_enable)
++		hc->desc_list_addr = qh->desc_list_dma;
++
++	dwc_otg_hc_init(hcd->core_if, hc);
++
++	local_irq_save(flags);
++
++	if (fiq_enable) {
++		local_fiq_disable();
++		fiq_fsm_spin_lock(&hcd->fiq_state->lock);
++	}
++
++	/* Enable the top level host channel interrupt. */
++	intr_enable = (1 << hc->hc_num);
++	DWC_MODIFY_REG32(&hcd->core_if->host_if->host_global_regs->haintmsk, 0, intr_enable);
++
++	/* Make sure host channel interrupts are enabled. */
++	gintmsk.b.hcintr = 1;
++	DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, 0, gintmsk.d32);
++
++	if (fiq_enable) {
++		fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
++		local_fiq_enable();
++	}
++
++	local_irq_restore(flags);
++	hc->qh = qh;
++}
++
++
++/**
++ * fiq_fsm_transaction_suitable() - Test a QH for compatibility with the FIQ
++ * @hcd:	Pointer to the dwc_otg_hcd struct
++ * @qh:	pointer to the endpoint's queue head
++ *
++ * Transaction start/end control flow is grafted onto the existing dwc_otg
++ * mechanisms, to avoid spaghettifying the functions more than they already are.
++ * This function's eligibility check is altered by debug parameter.
++ *
++ * Returns: 0 for unsuitable, 1 implies the FIQ can be enabled for this transaction.
++ */
++
++int fiq_fsm_transaction_suitable(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh)
++{
++	if (qh->do_split) {
++		switch (qh->ep_type) {
++		case UE_CONTROL:
++		case UE_BULK:
++			if (fiq_fsm_mask & (1 << 0))
++				return 1;
++			break;
++		case UE_INTERRUPT:
++		case UE_ISOCHRONOUS:
++			if (fiq_fsm_mask & (1 << 1))
++				return 1;
++			break;
++		default:
++			break;
++		}
++	} else if (qh->ep_type == UE_ISOCHRONOUS) {
++		if (fiq_fsm_mask & (1 << 2)) {
++			/* ISOCH support. We test for compatibility:
++			 * - DWORD aligned buffers
++			 * - Must be at least 2 transfers (otherwise pointless to use the FIQ)
++			 * If yes, then the fsm enqueue function will handle the state machine setup.
++			 */
++			dwc_otg_qtd_t *qtd = DWC_CIRCLEQ_FIRST(&qh->qtd_list);
++			dwc_otg_hcd_urb_t *urb = qtd->urb;
++			dwc_dma_t ptr;
++			int i;
++
++			if (urb->packet_count < 2)
++				return 0;
++			for (i = 0; i < urb->packet_count; i++) {
++				ptr = urb->dma + urb->iso_descs[i].offset;
++				if (ptr & 0x3)
++					return 0;
++			}
++			return 1;
++		}
++	}
++	return 0;
++}
++
++/**
++ * fiq_fsm_setup_periodic_dma() - Set up DMA bounce buffers
++ * @hcd: Pointer to the dwc_otg_hcd struct
++ * @qh: Pointer to the endpoint's queue head
++ *
++ * Periodic split transactions are transmitted modulo 188 bytes.
++ * This necessitates slicing data up into buckets for isochronous out
++ * and fixing up the DMA address for all IN transfers.
++ *
++ * Returns 1 if the DMA bounce buffers have been used, 0 if the default
++ * HC buffer has been used.
++ */
++static int fiq_fsm_setup_periodic_dma(dwc_otg_hcd_t *hcd, struct fiq_channel_state *st, dwc_otg_qh_t *qh)
++ {
++	int frame_length, i = 0;
++	uint8_t *ptr = NULL;
++	dwc_hc_t *hc = qh->channel;
++	struct fiq_dma_channel *split_dma;
++	struct dwc_otg_hcd_iso_packet_desc *frame_desc;
++
++	for (i = 0; i < 6; i++) {
++		st->dma_info.slot_len[i] = 255;
++	}
++	st->dma_info.index = 0;
++	i = 0;
++	if (hc->ep_is_in) {
++		/*
++		 * Set dma_regs to bounce buffer. FIQ will update the
++		 * state depending on transaction progress.
++		 * Pointer arithmetic on hcd->fiq_state->dma_base (a dma_addr_t)
++		 * to point it to the correct offset in the allocated buffers.
++		 */
++		split_dma = (struct fiq_dma_channel *)
++			(uintptr_t)hcd->fiq_state->dma_base;
++		st->hcdma_copy.d32 = lower_32_bits((uintptr_t)
++			&split_dma[hc->hc_num].index[0].buf[0]);
++
++		/* Calculate the max number of CSPLITS such that the FIQ can time out
++		 * a transaction if it fails.
++		 */
++		frame_length = st->hcchar_copy.b.mps;
++		do {
++			i++;
++			frame_length -= 188;
++		} while (frame_length >= 0);
++		st->nrpackets = i;
++		return 1;
++	} else {
++		if (qh->ep_type == UE_ISOCHRONOUS) {
++
++			dwc_otg_qtd_t *qtd = DWC_CIRCLEQ_FIRST(&qh->qtd_list);
++
++			frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
++			frame_length = frame_desc->length;
++
++			/* Virtual address for bounce buffers */
++			split_dma = hcd->fiq_dmab;
++
++			ptr = qtd->urb->buf + frame_desc->offset;
++			if (frame_length == 0) {
++				/*
++				 * for isochronous transactions, we must still transmit a packet
++				 * even if the length is zero.
++				 */
++				st->dma_info.slot_len[0] = 0;
++				st->nrpackets = 1;
++			} else {
++				do {
++					if (frame_length <= 188) {
++						dwc_memcpy(&split_dma[hc->hc_num].index[i].buf[0], ptr, frame_length);
++						st->dma_info.slot_len[i] = frame_length;
++						ptr += frame_length;
++					} else {
++						dwc_memcpy(&split_dma[hc->hc_num].index[i].buf[0], ptr, 188);
++						st->dma_info.slot_len[i] = 188;
++						ptr += 188;
++					}
++					i++;
++					frame_length -= 188;
++				} while (frame_length > 0);
++				st->nrpackets = i;
++			}
++			ptr = qtd->urb->buf + frame_desc->offset;
++			/*
++			 * Point the HC at the DMA address of the bounce buffers
++			 *
++			 * Pointer arithmetic on hcd->fiq_state->dma_base (a
++			 * dma_addr_t) to point it to the correct offset in the
++			 * allocated buffers.
++			 */
++			split_dma = (struct fiq_dma_channel *)
++				(uintptr_t)hcd->fiq_state->dma_base;
++			st->hcdma_copy.d32 = lower_32_bits((uintptr_t)
++				&split_dma[hc->hc_num].index[0].buf[0]);
++
++			/* fixup xfersize to the actual packet size */
++			st->hctsiz_copy.b.pid = 0;
++			st->hctsiz_copy.b.xfersize = st->dma_info.slot_len[0];
++			return 1;
++		} else {
++			/* For interrupt, single OUT packet required, goes in the SSPLIT from hc_buff. */
++			return 0;
++		}
++	}
++}
++
++/**
++ * fiq_fsm_np_tt_contended() - Avoid performing contended non-periodic transfers
++ * @hcd: Pointer to the dwc_otg_hcd struct
++ * @qh: Pointer to the endpoint's queue head
++ *
++ * Certain hub chips don't differentiate between IN and OUT non-periodic pipes
++ * with the same endpoint number. If transfers get completed out of order
++ * (disregarding the direction token) then the hub can lock up
++ * or return erroneous responses.
++ *
++ * Returns 1 if initiating the transfer would cause contention, 0 otherwise.
++ */
++static int fiq_fsm_np_tt_contended(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh)
++{
++	int i;
++	struct fiq_channel_state *st;
++	int dev_addr = qh->channel->dev_addr;
++	int ep_num = qh->channel->ep_num;
++	for (i = 0; i < hcd->core_if->core_params->host_channels; i++) {
++		if (i == qh->channel->hc_num)
++			continue;
++		st = &hcd->fiq_state->channel[i];
++		switch (st->fsm) {
++		case FIQ_NP_SSPLIT_STARTED:
++		case FIQ_NP_SSPLIT_RETRY:
++		case FIQ_NP_SSPLIT_PENDING:
++		case FIQ_NP_OUT_CSPLIT_RETRY:
++		case FIQ_NP_IN_CSPLIT_RETRY:
++			if (st->hcchar_copy.b.devaddr == dev_addr &&
++				st->hcchar_copy.b.epnum == ep_num)
++				return 1;
++			break;
++		default:
++			break;
++		}
++	}
++	return 0;
++}
++
++/*
++ * Pushing a periodic request into the queue near the EOF1 point
++ * in a microframe causes erroneous behaviour (frmovrun) interrupt.
++ * Usually, the request goes out on the bus causing a transfer but
++ * the core does not transfer the data to memory.
++ * This guard interval (in number of 60MHz clocks) is required which
++ * must cater for CPU latency between reading the value and enabling
++ * the channel.
++ */
++#define PERIODIC_FRREM_BACKOFF 1000
++
++static int fiq_fsm_queue_isoc_transaction(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh)
++{
++	dwc_hc_t *hc = qh->channel;
++	dwc_otg_hc_regs_t *hc_regs = hcd->core_if->host_if->hc_regs[hc->hc_num];
++	dwc_otg_qtd_t *qtd = DWC_CIRCLEQ_FIRST(&qh->qtd_list);
++	int frame;
++	struct fiq_channel_state *st = &hcd->fiq_state->channel[hc->hc_num];
++	int xfer_len, nrpackets;
++	hcdma_data_t hcdma;
++	hfnum_data_t hfnum;
++
++	if (st->fsm != FIQ_PASSTHROUGH)
++		return 0;
++
++	st->nr_errors = 0;
++
++	st->hcchar_copy.d32 = 0;
++	st->hcchar_copy.b.mps = hc->max_packet;
++	st->hcchar_copy.b.epdir = hc->ep_is_in;
++	st->hcchar_copy.b.devaddr = hc->dev_addr;
++	st->hcchar_copy.b.epnum = hc->ep_num;
++	st->hcchar_copy.b.eptype = hc->ep_type;
++
++	st->hcintmsk_copy.b.chhltd = 1;
++
++	frame = dwc_otg_hcd_get_frame_number(hcd);
++	st->hcchar_copy.b.oddfrm = (frame & 0x1) ? 0 : 1;
++
++	st->hcchar_copy.b.lspddev = 0;
++	/* Enable the channel later as a final register write. */
++
++	st->hcsplt_copy.d32 = 0;
++
++	st->hs_isoc_info.iso_desc = (struct dwc_otg_hcd_iso_packet_desc *) &qtd->urb->iso_descs;
++	st->hs_isoc_info.nrframes = qtd->urb->packet_count;
++	/* grab the next DMA address offset from the array */
++	st->hcdma_copy.d32 = qtd->urb->dma;
++	hcdma.d32 = st->hcdma_copy.d32 + st->hs_isoc_info.iso_desc[0].offset;
++
++	/* We need to set multi_count. This is a bit tricky - has to be set per-transaction as
++	 * the core needs to be told to send the correct number. Caution: for IN transfers,
++	 * this is always set to the maximum size of the endpoint. */
++	xfer_len = st->hs_isoc_info.iso_desc[0].length;
++	nrpackets = (xfer_len + st->hcchar_copy.b.mps - 1) / st->hcchar_copy.b.mps;
++	if (nrpackets == 0)
++		nrpackets = 1;
++	st->hcchar_copy.b.multicnt = nrpackets;
++	st->hctsiz_copy.b.pktcnt = nrpackets;
++
++	/* Initial PID also needs to be set */
++	if (st->hcchar_copy.b.epdir == 0) {
++		st->hctsiz_copy.b.xfersize = xfer_len;
++		switch (st->hcchar_copy.b.multicnt) {
++		case 1:
++			st->hctsiz_copy.b.pid = DWC_PID_DATA0;
++			break;
++		case 2:
++		case 3:
++			st->hctsiz_copy.b.pid = DWC_PID_MDATA;
++			break;
++		}
++
++	} else {
++		st->hctsiz_copy.b.xfersize = nrpackets * st->hcchar_copy.b.mps;
++		switch (st->hcchar_copy.b.multicnt) {
++		case 1:
++			st->hctsiz_copy.b.pid = DWC_PID_DATA0;
++			break;
++		case 2:
++			st->hctsiz_copy.b.pid = DWC_PID_DATA1;
++			break;
++		case 3:
++			st->hctsiz_copy.b.pid = DWC_PID_DATA2;
++			break;
++		}
++	}
++
++	st->hs_isoc_info.stride = qh->interval;
++	st->uframe_sleeps = 0;
++
++	fiq_print(FIQDBG_INT, hcd->fiq_state, "FSMQ  %01d ", hc->hc_num);
++	fiq_print(FIQDBG_INT, hcd->fiq_state, "%08x", st->hcchar_copy.d32);
++	fiq_print(FIQDBG_INT, hcd->fiq_state, "%08x", st->hctsiz_copy.d32);
++	fiq_print(FIQDBG_INT, hcd->fiq_state, "%08x", st->hcdma_copy.d32);
++	hfnum.d32 = DWC_READ_REG32(&hcd->core_if->host_if->host_global_regs->hfnum);
++	local_fiq_disable();
++	fiq_fsm_spin_lock(&hcd->fiq_state->lock);
++	DWC_WRITE_REG32(&hc_regs->hctsiz, st->hctsiz_copy.d32);
++	DWC_WRITE_REG32(&hc_regs->hcsplt, st->hcsplt_copy.d32);
++	DWC_WRITE_REG32(&hc_regs->hcdma, st->hcdma_copy.d32);
++	DWC_WRITE_REG32(&hc_regs->hcchar, st->hcchar_copy.d32);
++	DWC_WRITE_REG32(&hc_regs->hcintmsk, st->hcintmsk_copy.d32);
++	if (hfnum.b.frrem < PERIODIC_FRREM_BACKOFF) {
++		/* Prevent queueing near EOF1. Bad things happen if a periodic
++		 * split transaction is queued very close to EOF. SOF interrupt handler
++		 * will wake this channel at the next interrupt.
++		 */
++		st->fsm = FIQ_HS_ISOC_SLEEPING;
++		st->uframe_sleeps = 1;
++	} else {
++		st->fsm = FIQ_HS_ISOC_TURBO;
++		st->hcchar_copy.b.chen = 1;
++		DWC_WRITE_REG32(&hc_regs->hcchar, st->hcchar_copy.d32);
++	}
++	mb();
++	st->hcchar_copy.b.chen = 0;
++	fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
++	local_fiq_enable();
++	return 0;
++}
++
++
++/**
++ * fiq_fsm_queue_split_transaction() - Set up a host channel and FIQ state
++ * @hcd: Pointer to the dwc_otg_hcd struct
++ * @qh: Pointer to the endpoint's queue head
++ *
++ * This overrides the dwc_otg driver's normal method of queueing a transaction.
++ * Called from dwc_otg_hcd_queue_transactions(), this performs specific setup
++ * for the nominated host channel.
++ *
++ * For periodic transfers, it also peeks at the FIQ state to see if an immediate
++ * start is possible. If not, then the FIQ is left to start the transfer.
++ */
++static int fiq_fsm_queue_split_transaction(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh)
++{
++	int start_immediate = 1, i;
++	hfnum_data_t hfnum;
++	dwc_hc_t *hc = qh->channel;
++	dwc_otg_hc_regs_t *hc_regs = hcd->core_if->host_if->hc_regs[hc->hc_num];
++	/* Program HC registers, setup FIQ_state, examine FIQ if periodic, start transfer (not if uframe 5) */
++	int hub_addr, port_addr, frame, uframe;
++	struct fiq_channel_state *st = &hcd->fiq_state->channel[hc->hc_num];
++
++	/*
++	 * Non-periodic channel assignments stay in the non_periodic_active queue.
++	 * Therefore we get repeatedly called until the FIQ's done processing this channel.
++	 */
++	if (qh->channel->xfer_started == 1)
++		return 0;
++
++	if (st->fsm != FIQ_PASSTHROUGH) {
++		pr_warn_ratelimited("%s:%d: Queue called for an active channel\n", __func__, __LINE__);
++		return 0;
++	}
++
++	qh->channel->xfer_started = 1;
++
++	st->nr_errors = 0;
++
++	st->hcchar_copy.d32 = 0;
++	st->hcchar_copy.b.mps = min_t(uint32_t, hc->xfer_len, hc->max_packet);
++	st->hcchar_copy.b.epdir = hc->ep_is_in;
++	st->hcchar_copy.b.devaddr = hc->dev_addr;
++	st->hcchar_copy.b.epnum = hc->ep_num;
++	st->hcchar_copy.b.eptype = hc->ep_type;
++	if (hc->ep_type & 0x1) {
++		if (hc->ep_is_in)
++			st->hcchar_copy.b.multicnt = 3;
++		else
++			/* Docs say set this to 1, but driver sets to 0! */
++			st->hcchar_copy.b.multicnt = 0;
++	} else {
++		st->hcchar_copy.b.multicnt = 1;
++		st->hcchar_copy.b.oddfrm = 0;
++	}
++	st->hcchar_copy.b.lspddev = (hc->speed == DWC_OTG_EP_SPEED_LOW) ? 1 : 0;
++	/* Enable the channel later as a final register write. */
++
++	st->hcsplt_copy.d32 = 0;
++	if(qh->do_split) {
++		hcd->fops->hub_info(hcd, DWC_CIRCLEQ_FIRST(&qh->qtd_list)->urb->priv, &hub_addr, &port_addr);
++		st->hcsplt_copy.b.compsplt = 0;
++		st->hcsplt_copy.b.spltena = 1;
++		// XACTPOS is for isoc-out only but needs initialising anyway.
++		st->hcsplt_copy.b.xactpos = ISOC_XACTPOS_ALL;
++		if((qh->ep_type == DWC_OTG_EP_TYPE_ISOC) && (!qh->ep_is_in)) {
++			/* For packetsize 0 < L < 188, ISOC_XACTPOS_ALL.
++			 * for longer than this, ISOC_XACTPOS_BEGIN and the FIQ
++			 * will update as necessary.
++			 */
++			if (hc->xfer_len > 188) {
++				st->hcsplt_copy.b.xactpos = ISOC_XACTPOS_BEGIN;
++			}
++		}
++		st->hcsplt_copy.b.hubaddr = (uint8_t) hub_addr;
++		st->hcsplt_copy.b.prtaddr = (uint8_t) port_addr;
++		st->hub_addr = hub_addr;
++		st->port_addr = port_addr;
++	}
++
++	st->hctsiz_copy.d32 = 0;
++	st->hctsiz_copy.b.dopng = 0;
++	st->hctsiz_copy.b.pid = hc->data_pid_start;
++
++	if (hc->ep_is_in || (hc->xfer_len > hc->max_packet)) {
++		hc->xfer_len = min_t(uint32_t, hc->xfer_len, hc->max_packet);
++	} else if (!hc->ep_is_in && (hc->xfer_len > 188)) {
++		hc->xfer_len = 188;
++	}
++	st->hctsiz_copy.b.xfersize = hc->xfer_len;
++
++	st->hctsiz_copy.b.pktcnt = 1;
++
++	if (hc->ep_type & 0x1) {
++		/*
++		 * For potentially multi-packet transfers, must use the DMA bounce buffers. For IN transfers,
++		 * the DMA address is the address of the first 188byte slot buffer in the bounce buffer array.
++		 * For multi-packet OUT transfers, we need to copy the data into the bounce buffer array so the FIQ can punt
++		 * the right address out as necessary. hc->xfer_buff and hc->xfer_len have already been set
++		 * in assign_and_init_hc(), but this is for the eventual transaction completion only. The FIQ
++		 * must not touch internal driver state.
++		 */
++		if(!fiq_fsm_setup_periodic_dma(hcd, st, qh)) {
++			if (hc->align_buff) {
++				st->hcdma_copy.d32 = hc->align_buff;
++			} else {
++				st->hcdma_copy.d32 = lower_32_bits((uintptr_t)hc->xfer_buff);
++			}
++		}
++	} else {
++		if (hc->align_buff) {
++			st->hcdma_copy.d32 = hc->align_buff;
++		} else {
++			st->hcdma_copy.d32 = lower_32_bits((uintptr_t)hc->xfer_buff);
++		}
++	}
++	/* The FIQ depends upon no other interrupts being enabled except channel halt.
++	 * Fixup channel interrupt mask. */
++	st->hcintmsk_copy.d32 = 0;
++	st->hcintmsk_copy.b.chhltd = 1;
++	st->hcintmsk_copy.b.ahberr = 1;
++
++	/* Hack courtesy of FreeBSD: apparently forcing Interrupt Split transactions
++	 * as Control puts the transfer into the non-periodic request queue and the
++	 * non-periodic handler in the hub. Makes things lots easier.
++	 */
++	if ((fiq_fsm_mask & 0x8) && hc->ep_type == UE_INTERRUPT) {
++		st->hcchar_copy.b.multicnt = 0;
++		st->hcchar_copy.b.oddfrm = 0;
++		st->hcchar_copy.b.eptype = UE_CONTROL;
++		if (hc->align_buff) {
++			st->hcdma_copy.d32 = hc->align_buff;
++		} else {
++			st->hcdma_copy.d32 = lower_32_bits((uintptr_t)hc->xfer_buff);
++		}
++	}
++	DWC_WRITE_REG32(&hc_regs->hcdma, st->hcdma_copy.d32);
++	DWC_WRITE_REG32(&hc_regs->hctsiz, st->hctsiz_copy.d32);
++	DWC_WRITE_REG32(&hc_regs->hcsplt, st->hcsplt_copy.d32);
++	DWC_WRITE_REG32(&hc_regs->hcchar, st->hcchar_copy.d32);
++	DWC_WRITE_REG32(&hc_regs->hcintmsk, st->hcintmsk_copy.d32);
++
++	local_fiq_disable();
++	fiq_fsm_spin_lock(&hcd->fiq_state->lock);
++
++	if (hc->ep_type & 0x1) {
++		hfnum.d32 = DWC_READ_REG32(&hcd->core_if->host_if->host_global_regs->hfnum);
++		frame = (hfnum.b.frnum & ~0x7) >> 3;
++		uframe = hfnum.b.frnum & 0x7;
++		if (hfnum.b.frrem < PERIODIC_FRREM_BACKOFF) {
++			/* Prevent queueing near EOF1. Bad things happen if a periodic
++			 * split transaction is queued very close to EOF.
++			 */
++			start_immediate = 0;
++		} else if (uframe == 5) {
++			start_immediate = 0;
++		} else if (hc->ep_type == UE_ISOCHRONOUS && !hc->ep_is_in) {
++			start_immediate = 0;
++		} else if (hc->ep_is_in && fiq_fsm_too_late(hcd->fiq_state, hc->hc_num)) {
++			start_immediate = 0;
++		} else {
++			/* Search through all host channels to determine if a transaction
++			 * is currently in progress */
++			for (i = 0; i < hcd->core_if->core_params->host_channels; i++) {
++				if (i == hc->hc_num || hcd->fiq_state->channel[i].fsm == FIQ_PASSTHROUGH)
++					continue;
++				switch (hcd->fiq_state->channel[i].fsm) {
++				/* TT is reserved for channels that are in the middle of a periodic
++				 * split transaction.
++				 */
++				case FIQ_PER_SSPLIT_STARTED:
++				case FIQ_PER_CSPLIT_WAIT:
++				case FIQ_PER_CSPLIT_NYET1:
++				case FIQ_PER_CSPLIT_POLL:
++				case FIQ_PER_ISO_OUT_ACTIVE:
++				case FIQ_PER_ISO_OUT_LAST:
++					if (hcd->fiq_state->channel[i].hub_addr == hub_addr &&
++							hcd->fiq_state->channel[i].port_addr == port_addr) {
++						start_immediate = 0;
++					}
++					break;
++				default:
++					break;
++				}
++				if (!start_immediate)
++					break;
++			}
++		}
++	}
++	if ((fiq_fsm_mask & 0x8) && hc->ep_type == UE_INTERRUPT)
++		start_immediate = 1;
++
++	fiq_print(FIQDBG_INT, hcd->fiq_state, "FSMQ %01d %01d", hc->hc_num, start_immediate);
++	fiq_print(FIQDBG_INT, hcd->fiq_state, "%08d", hfnum.b.frrem);
++	//fiq_print(FIQDBG_INT, hcd->fiq_state, "H:%02dP:%02d", hub_addr, port_addr);
++	//fiq_print(FIQDBG_INT, hcd->fiq_state, "%08x", st->hctsiz_copy.d32);
++	//fiq_print(FIQDBG_INT, hcd->fiq_state, "%08x", st->hcdma_copy.d32);
++	switch (hc->ep_type) {
++		case UE_CONTROL:
++		case UE_BULK:
++			if (fiq_fsm_np_tt_contended(hcd, qh)) {
++				st->fsm = FIQ_NP_SSPLIT_PENDING;
++				start_immediate = 0;
++			} else {
++				st->fsm = FIQ_NP_SSPLIT_STARTED;
++			}
++			break;
++		case UE_ISOCHRONOUS:
++			if (hc->ep_is_in) {
++				if (start_immediate) {
++					st->fsm = FIQ_PER_SSPLIT_STARTED;
++				} else {
++					st->fsm = FIQ_PER_SSPLIT_QUEUED;
++				}
++			} else {
++				if (start_immediate) {
++					/* Single-isoc OUT packets don't require FIQ involvement */
++					if (st->nrpackets == 1) {
++						st->fsm = FIQ_PER_ISO_OUT_LAST;
++					} else {
++						st->fsm = FIQ_PER_ISO_OUT_ACTIVE;
++					}
++				} else {
++					st->fsm = FIQ_PER_ISO_OUT_PENDING;
++				}
++			}
++			break;
++		case UE_INTERRUPT:
++			if (fiq_fsm_mask & 0x8) {
++				if (fiq_fsm_np_tt_contended(hcd, qh)) {
++					st->fsm = FIQ_NP_SSPLIT_PENDING;
++					start_immediate = 0;
++				} else {
++					st->fsm = FIQ_NP_SSPLIT_STARTED;
++				}
++			} else if (start_immediate) {
++					st->fsm = FIQ_PER_SSPLIT_STARTED;
++			} else {
++				st->fsm = FIQ_PER_SSPLIT_QUEUED;
++			}
++			break;
++		default:
++			break;
++	}
++	if (start_immediate) {
++		/* Set the oddfrm bit as close as possible to actual queueing */
++		frame = dwc_otg_hcd_get_frame_number(hcd);
++		st->expected_uframe = (frame + 1) & 0x3FFF;
++		st->hcchar_copy.b.oddfrm = (frame & 0x1) ? 0 : 1;
++		st->hcchar_copy.b.chen = 1;
++		DWC_WRITE_REG32(&hc_regs->hcchar, st->hcchar_copy.d32);
++	}
++	mb();
++	fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
++	local_fiq_enable();
++	return 0;
++}
++
++
++/**
++ * This function selects transactions from the HCD transfer schedule and
++ * assigns them to available host channels. It is called from HCD interrupt
++ * handler functions.
++ *
++ * @param hcd The HCD state structure.
++ *
++ * @return The types of new transactions that were assigned to host channels.
++ */
++dwc_otg_transaction_type_e dwc_otg_hcd_select_transactions(dwc_otg_hcd_t * hcd)
++{
++	dwc_list_link_t *qh_ptr;
++	dwc_otg_qh_t *qh;
++	int num_channels;
++	dwc_otg_transaction_type_e ret_val = DWC_OTG_TRANSACTION_NONE;
++
++#ifdef DEBUG_HOST_CHANNELS
++	last_sel_trans_num_per_scheduled = 0;
++	last_sel_trans_num_nonper_scheduled = 0;
++	last_sel_trans_num_avail_hc_at_start = hcd->available_host_channels;
++#endif /* DEBUG_HOST_CHANNELS */
++
++	/* Process entries in the periodic ready list. */
++	qh_ptr = DWC_LIST_FIRST(&hcd->periodic_sched_ready);
++
++	while (qh_ptr != &hcd->periodic_sched_ready &&
++	       !DWC_CIRCLEQ_EMPTY(&hcd->free_hc_list)) {
++
++		qh = DWC_LIST_ENTRY(qh_ptr, dwc_otg_qh_t, qh_list_entry);
++
++		if (microframe_schedule) {
++			// Make sure we leave one channel for non periodic transactions.
++			if (hcd->available_host_channels <= 1) {
++				break;
++			}
++			hcd->available_host_channels--;
++#ifdef DEBUG_HOST_CHANNELS
++			last_sel_trans_num_per_scheduled++;
++#endif /* DEBUG_HOST_CHANNELS */
++		}
++		qh = DWC_LIST_ENTRY(qh_ptr, dwc_otg_qh_t, qh_list_entry);
++		assign_and_init_hc(hcd, qh);
++
++		/*
++		 * Move the QH from the periodic ready schedule to the
++		 * periodic assigned schedule.
++		 */
++		qh_ptr = DWC_LIST_NEXT(qh_ptr);
++		DWC_LIST_MOVE_HEAD(&hcd->periodic_sched_assigned,
++				   &qh->qh_list_entry);
++	}
++
++	/*
++	 * Process entries in the inactive portion of the non-periodic
++	 * schedule. Some free host channels may not be used if they are
++	 * reserved for periodic transfers.
++	 */
++	qh_ptr = hcd->non_periodic_sched_inactive.next;
++	num_channels = hcd->core_if->core_params->host_channels;
++	while (qh_ptr != &hcd->non_periodic_sched_inactive &&
++	       (microframe_schedule || hcd->non_periodic_channels <
++		num_channels - hcd->periodic_channels) &&
++	       !DWC_CIRCLEQ_EMPTY(&hcd->free_hc_list)) {
++
++		qh = DWC_LIST_ENTRY(qh_ptr, dwc_otg_qh_t, qh_list_entry);
++		/*
++		 * Check to see if this is a NAK'd retransmit, in which case ignore for retransmission
++		 * we hold off on bulk retransmissions to reduce NAK interrupt overhead for full-speed
++		 * cheeky devices that just hold off using NAKs
++		 */
++		if (fiq_enable && nak_holdoff && qh->do_split) {
++			if (qh->nak_frame != 0xffff) {
++				uint16_t next_frame = dwc_frame_num_inc(qh->nak_frame, (qh->ep_type == UE_BULK) ? nak_holdoff : 8);
++				uint16_t frame = dwc_otg_hcd_get_frame_number(hcd);
++				if (dwc_frame_num_le(frame, next_frame)) {
++					if(dwc_frame_num_le(next_frame, hcd->fiq_state->next_sched_frame)) {
++						hcd->fiq_state->next_sched_frame = next_frame;
++					}
++					qh_ptr = DWC_LIST_NEXT(qh_ptr);
++					continue;
++				} else {
++					qh->nak_frame = 0xFFFF;
++				}
++			}
++		}
++
++		if (microframe_schedule) {
++				if (hcd->available_host_channels < 1) {
++					break;
++				}
++				hcd->available_host_channels--;
++#ifdef DEBUG_HOST_CHANNELS
++				last_sel_trans_num_nonper_scheduled++;
++#endif /* DEBUG_HOST_CHANNELS */
++		}
++
++		assign_and_init_hc(hcd, qh);
++
++		/*
++		 * Move the QH from the non-periodic inactive schedule to the
++		 * non-periodic active schedule.
++		 */
++		qh_ptr = DWC_LIST_NEXT(qh_ptr);
++		DWC_LIST_MOVE_HEAD(&hcd->non_periodic_sched_active,
++				   &qh->qh_list_entry);
++
++		if (!microframe_schedule)
++			hcd->non_periodic_channels++;
++	}
++	/* we moved a non-periodic QH to the active schedule. If the inactive queue is empty,
++	 * stop the FIQ from kicking us. We could potentially still have elements here if we
++	 * ran out of host channels.
++	 */
++	if (fiq_enable) {
++		if (DWC_LIST_EMPTY(&hcd->non_periodic_sched_inactive)) {
++			hcd->fiq_state->kick_np_queues = 0;
++		} else {
++			/* For each entry remaining in the NP inactive queue,
++			* if this a NAK'd retransmit then don't set the kick flag.
++			*/
++			if(nak_holdoff) {
++				DWC_LIST_FOREACH(qh_ptr, &hcd->non_periodic_sched_inactive) {
++					qh = DWC_LIST_ENTRY(qh_ptr, dwc_otg_qh_t, qh_list_entry);
++					if (qh->nak_frame == 0xFFFF) {
++						hcd->fiq_state->kick_np_queues = 1;
++					}
++				}
++			}
++		}
++	}
++	if(!DWC_LIST_EMPTY(&hcd->periodic_sched_assigned))
++		ret_val |= DWC_OTG_TRANSACTION_PERIODIC;
++
++	if(!DWC_LIST_EMPTY(&hcd->non_periodic_sched_active))
++		ret_val |= DWC_OTG_TRANSACTION_NON_PERIODIC;
++
++
++#ifdef DEBUG_HOST_CHANNELS
++	last_sel_trans_num_avail_hc_at_end = hcd->available_host_channels;
++#endif /* DEBUG_HOST_CHANNELS */
++	return ret_val;
++}
++
++/**
++ * Attempts to queue a single transaction request for a host channel
++ * associated with either a periodic or non-periodic transfer. This function
++ * assumes that there is space available in the appropriate request queue. For
++ * an OUT transfer or SETUP transaction in Slave mode, it checks whether space
++ * is available in the appropriate Tx FIFO.
++ *
++ * @param hcd The HCD state structure.
++ * @param hc Host channel descriptor associated with either a periodic or
++ * non-periodic transfer.
++ * @param fifo_dwords_avail Number of DWORDs available in the periodic Tx
++ * FIFO for periodic transfers or the non-periodic Tx FIFO for non-periodic
++ * transfers.
++ *
++ * @return 1 if a request is queued and more requests may be needed to
++ * complete the transfer, 0 if no more requests are required for this
++ * transfer, -1 if there is insufficient space in the Tx FIFO.
++ */
++static int queue_transaction(dwc_otg_hcd_t * hcd,
++			     dwc_hc_t * hc, uint16_t fifo_dwords_avail)
++{
++	int retval;
++
++	if (hcd->core_if->dma_enable) {
++		if (hcd->core_if->dma_desc_enable) {
++			if (!hc->xfer_started
++			    || (hc->ep_type == DWC_OTG_EP_TYPE_ISOC)) {
++				dwc_otg_hcd_start_xfer_ddma(hcd, hc->qh);
++				hc->qh->ping_state = 0;
++			}
++		} else if (!hc->xfer_started) {
++			if (fiq_fsm_enable && hc->error_state) {
++				hcd->fiq_state->channel[hc->hc_num].nr_errors =
++					DWC_CIRCLEQ_FIRST(&hc->qh->qtd_list)->error_count;
++				hcd->fiq_state->channel[hc->hc_num].fsm =
++					FIQ_PASSTHROUGH_ERRORSTATE;
++			}
++			dwc_otg_hc_start_transfer(hcd->core_if, hc);
++			hc->qh->ping_state = 0;
++		}
++		retval = 0;
++	} else if (hc->halt_pending) {
++		/* Don't queue a request if the channel has been halted. */
++		retval = 0;
++	} else if (hc->halt_on_queue) {
++		dwc_otg_hc_halt(hcd->core_if, hc, hc->halt_status);
++		retval = 0;
++	} else if (hc->do_ping) {
++		if (!hc->xfer_started) {
++			dwc_otg_hc_start_transfer(hcd->core_if, hc);
++		}
++		retval = 0;
++	} else if (!hc->ep_is_in || hc->data_pid_start == DWC_OTG_HC_PID_SETUP) {
++		if ((fifo_dwords_avail * 4) >= hc->max_packet) {
++			if (!hc->xfer_started) {
++				dwc_otg_hc_start_transfer(hcd->core_if, hc);
++				retval = 1;
++			} else {
++				retval =
++				    dwc_otg_hc_continue_transfer(hcd->core_if,
++								 hc);
++			}
++		} else {
++			retval = -1;
++		}
++	} else {
++		if (!hc->xfer_started) {
++			dwc_otg_hc_start_transfer(hcd->core_if, hc);
++			retval = 1;
++		} else {
++			retval = dwc_otg_hc_continue_transfer(hcd->core_if, hc);
++		}
++	}
++
++	return retval;
++}
++
++/**
++ * Processes periodic channels for the next frame and queues transactions for
++ * these channels to the DWC_otg controller. After queueing transactions, the
++ * Periodic Tx FIFO Empty interrupt is enabled if there are more transactions
++ * to queue as Periodic Tx FIFO or request queue space becomes available.
++ * Otherwise, the Periodic Tx FIFO Empty interrupt is disabled.
++ */
++static void process_periodic_channels(dwc_otg_hcd_t * hcd)
++{
++	hptxsts_data_t tx_status;
++	dwc_list_link_t *qh_ptr;
++	dwc_otg_qh_t *qh;
++	int status = 0;
++	int no_queue_space = 0;
++	int no_fifo_space = 0;
++
++	dwc_otg_host_global_regs_t *host_regs;
++	host_regs = hcd->core_if->host_if->host_global_regs;
++
++	DWC_DEBUGPL(DBG_HCDV, "Queue periodic transactions\n");
++#ifdef DEBUG
++	tx_status.d32 = DWC_READ_REG32(&host_regs->hptxsts);
++	DWC_DEBUGPL(DBG_HCDV,
++		    "  P Tx Req Queue Space Avail (before queue): %d\n",
++		    tx_status.b.ptxqspcavail);
++	DWC_DEBUGPL(DBG_HCDV, "  P Tx FIFO Space Avail (before queue): %d\n",
++		    tx_status.b.ptxfspcavail);
++#endif
++
++	qh_ptr = hcd->periodic_sched_assigned.next;
++	while (qh_ptr != &hcd->periodic_sched_assigned) {
++		tx_status.d32 = DWC_READ_REG32(&host_regs->hptxsts);
++		if (tx_status.b.ptxqspcavail == 0) {
++			no_queue_space = 1;
++			break;
++		}
++
++		qh = DWC_LIST_ENTRY(qh_ptr, dwc_otg_qh_t, qh_list_entry);
++
++		// Do not send a split start transaction any later than frame .6
++		// Note, we have to schedule a periodic in .5 to make it go in .6
++		if(fiq_fsm_enable && qh->do_split && ((dwc_otg_hcd_get_frame_number(hcd) + 1) & 7) > 6)
++		{
++			qh_ptr = qh_ptr->next;
++			hcd->fiq_state->next_sched_frame = dwc_otg_hcd_get_frame_number(hcd) | 7;
++			continue;
++		}
++
++		if (fiq_fsm_enable && fiq_fsm_transaction_suitable(hcd, qh)) {
++			if (qh->do_split)
++				fiq_fsm_queue_split_transaction(hcd, qh);
++			else
++				fiq_fsm_queue_isoc_transaction(hcd, qh);
++		} else {
++
++			/*
++			 * Set a flag if we're queueing high-bandwidth in slave mode.
++			 * The flag prevents any halts to get into the request queue in
++			 * the middle of multiple high-bandwidth packets getting queued.
++			 */
++			if (!hcd->core_if->dma_enable && qh->channel->multi_count > 1) {
++				hcd->core_if->queuing_high_bandwidth = 1;
++			}
++			status = queue_transaction(hcd, qh->channel,
++							tx_status.b.ptxfspcavail);
++			if (status < 0) {
++				no_fifo_space = 1;
++				break;
++			}
++		}
++
++		/*
++		 * In Slave mode, stay on the current transfer until there is
++		 * nothing more to do or the high-bandwidth request count is
++		 * reached. In DMA mode, only need to queue one request. The
++		 * controller automatically handles multiple packets for
++		 * high-bandwidth transfers.
++		 */
++		if (hcd->core_if->dma_enable || status == 0 ||
++		    qh->channel->requests == qh->channel->multi_count) {
++			qh_ptr = qh_ptr->next;
++			/*
++			 * Move the QH from the periodic assigned schedule to
++			 * the periodic queued schedule.
++			 */
++			DWC_LIST_MOVE_HEAD(&hcd->periodic_sched_queued,
++					   &qh->qh_list_entry);
++
++			/* done queuing high bandwidth */
++			hcd->core_if->queuing_high_bandwidth = 0;
++		}
++	}
++
++	if (!hcd->core_if->dma_enable) {
++		dwc_otg_core_global_regs_t *global_regs;
++		gintmsk_data_t intr_mask = {.d32 = 0 };
++
++		global_regs = hcd->core_if->core_global_regs;
++		intr_mask.b.ptxfempty = 1;
++#ifdef DEBUG
++		tx_status.d32 = DWC_READ_REG32(&host_regs->hptxsts);
++		DWC_DEBUGPL(DBG_HCDV,
++			    "  P Tx Req Queue Space Avail (after queue): %d\n",
++			    tx_status.b.ptxqspcavail);
++		DWC_DEBUGPL(DBG_HCDV,
++			    "  P Tx FIFO Space Avail (after queue): %d\n",
++			    tx_status.b.ptxfspcavail);
++#endif
++		if (!DWC_LIST_EMPTY(&hcd->periodic_sched_assigned) ||
++		    no_queue_space || no_fifo_space) {
++			/*
++			 * May need to queue more transactions as the request
++			 * queue or Tx FIFO empties. Enable the periodic Tx
++			 * FIFO empty interrupt. (Always use the half-empty
++			 * level to ensure that new requests are loaded as
++			 * soon as possible.)
++			 */
++			DWC_MODIFY_REG32(&global_regs->gintmsk, 0,
++					 intr_mask.d32);
++		} else {
++			/*
++			 * Disable the Tx FIFO empty interrupt since there are
++			 * no more transactions that need to be queued right
++			 * now. This function is called from interrupt
++			 * handlers to queue more transactions as transfer
++			 * states change.
++			 */
++			DWC_MODIFY_REG32(&global_regs->gintmsk, intr_mask.d32,
++					 0);
++		}
++	}
++}
++
++/**
++ * Processes active non-periodic channels and queues transactions for these
++ * channels to the DWC_otg controller. After queueing transactions, the NP Tx
++ * FIFO Empty interrupt is enabled if there are more transactions to queue as
++ * NP Tx FIFO or request queue space becomes available. Otherwise, the NP Tx
++ * FIFO Empty interrupt is disabled.
++ */
++static void process_non_periodic_channels(dwc_otg_hcd_t * hcd)
++{
++	gnptxsts_data_t tx_status;
++	dwc_list_link_t *orig_qh_ptr;
++	dwc_otg_qh_t *qh;
++	int status;
++	int no_queue_space = 0;
++	int no_fifo_space = 0;
++	int more_to_do = 0;
++
++	dwc_otg_core_global_regs_t *global_regs =
++	    hcd->core_if->core_global_regs;
++
++	DWC_DEBUGPL(DBG_HCDV, "Queue non-periodic transactions\n");
++#ifdef DEBUG
++	tx_status.d32 = DWC_READ_REG32(&global_regs->gnptxsts);
++	DWC_DEBUGPL(DBG_HCDV,
++		    "  NP Tx Req Queue Space Avail (before queue): %d\n",
++		    tx_status.b.nptxqspcavail);
++	DWC_DEBUGPL(DBG_HCDV, "  NP Tx FIFO Space Avail (before queue): %d\n",
++		    tx_status.b.nptxfspcavail);
++#endif
++	/*
++	 * Keep track of the starting point. Skip over the start-of-list
++	 * entry.
++	 */
++	if (hcd->non_periodic_qh_ptr == &hcd->non_periodic_sched_active) {
++		hcd->non_periodic_qh_ptr = hcd->non_periodic_qh_ptr->next;
++	}
++	orig_qh_ptr = hcd->non_periodic_qh_ptr;
++
++	/*
++	 * Process once through the active list or until no more space is
++	 * available in the request queue or the Tx FIFO.
++	 */
++	do {
++		tx_status.d32 = DWC_READ_REG32(&global_regs->gnptxsts);
++		if (!hcd->core_if->dma_enable && tx_status.b.nptxqspcavail == 0) {
++			no_queue_space = 1;
++			break;
++		}
++
++		qh = DWC_LIST_ENTRY(hcd->non_periodic_qh_ptr, dwc_otg_qh_t,
++				    qh_list_entry);
++
++		if(fiq_fsm_enable && fiq_fsm_transaction_suitable(hcd, qh)) {
++			fiq_fsm_queue_split_transaction(hcd, qh);
++		} else {
++			status = queue_transaction(hcd, qh->channel,
++						tx_status.b.nptxfspcavail);
++
++			if (status > 0) {
++				more_to_do = 1;
++			} else if (status < 0) {
++				no_fifo_space = 1;
++				break;
++			}
++		}
++		/* Advance to next QH, skipping start-of-list entry. */
++		hcd->non_periodic_qh_ptr = hcd->non_periodic_qh_ptr->next;
++		if (hcd->non_periodic_qh_ptr == &hcd->non_periodic_sched_active) {
++			hcd->non_periodic_qh_ptr =
++			    hcd->non_periodic_qh_ptr->next;
++		}
++
++	} while (hcd->non_periodic_qh_ptr != orig_qh_ptr);
++
++	if (!hcd->core_if->dma_enable) {
++		gintmsk_data_t intr_mask = {.d32 = 0 };
++		intr_mask.b.nptxfempty = 1;
++
++#ifdef DEBUG
++		tx_status.d32 = DWC_READ_REG32(&global_regs->gnptxsts);
++		DWC_DEBUGPL(DBG_HCDV,
++			    "  NP Tx Req Queue Space Avail (after queue): %d\n",
++			    tx_status.b.nptxqspcavail);
++		DWC_DEBUGPL(DBG_HCDV,
++			    "  NP Tx FIFO Space Avail (after queue): %d\n",
++			    tx_status.b.nptxfspcavail);
++#endif
++		if (more_to_do || no_queue_space || no_fifo_space) {
++			/*
++			 * May need to queue more transactions as the request
++			 * queue or Tx FIFO empties. Enable the non-periodic
++			 * Tx FIFO empty interrupt. (Always use the half-empty
++			 * level to ensure that new requests are loaded as
++			 * soon as possible.)
++			 */
++			DWC_MODIFY_REG32(&global_regs->gintmsk, 0,
++					 intr_mask.d32);
++		} else {
++			/*
++			 * Disable the Tx FIFO empty interrupt since there are
++			 * no more transactions that need to be queued right
++			 * now. This function is called from interrupt
++			 * handlers to queue more transactions as transfer
++			 * states change.
++			 */
++			DWC_MODIFY_REG32(&global_regs->gintmsk, intr_mask.d32,
++					 0);
++		}
++	}
++}
++
++/**
++ * This function processes the currently active host channels and queues
++ * transactions for these channels to the DWC_otg controller. It is called
++ * from HCD interrupt handler functions.
++ *
++ * @param hcd The HCD state structure.
++ * @param tr_type The type(s) of transactions to queue (non-periodic,
++ * periodic, or both).
++ */
++void dwc_otg_hcd_queue_transactions(dwc_otg_hcd_t * hcd,
++				    dwc_otg_transaction_type_e tr_type)
++{
++#ifdef DEBUG_SOF
++	DWC_DEBUGPL(DBG_HCD, "Queue Transactions\n");
++#endif
++	/* Process host channels associated with periodic transfers. */
++	if ((tr_type == DWC_OTG_TRANSACTION_PERIODIC ||
++	     tr_type == DWC_OTG_TRANSACTION_ALL) &&
++	    !DWC_LIST_EMPTY(&hcd->periodic_sched_assigned)) {
++
++		process_periodic_channels(hcd);
++	}
++
++	/* Process host channels associated with non-periodic transfers. */
++	if (tr_type == DWC_OTG_TRANSACTION_NON_PERIODIC ||
++	    tr_type == DWC_OTG_TRANSACTION_ALL) {
++		if (!DWC_LIST_EMPTY(&hcd->non_periodic_sched_active)) {
++			process_non_periodic_channels(hcd);
++		} else {
++			/*
++			 * Ensure NP Tx FIFO empty interrupt is disabled when
++			 * there are no non-periodic transfers to process.
++			 */
++			gintmsk_data_t gintmsk = {.d32 = 0 };
++			gintmsk.b.nptxfempty = 1;
++
++			if (fiq_enable) {
++				local_fiq_disable();
++				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
++				DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, gintmsk.d32, 0);
++				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
++				local_fiq_enable();
++			} else {
++				DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, gintmsk.d32, 0);
++			}
++		}
++	}
++}
++
++#ifdef DWC_HS_ELECT_TST
++/*
++ * Quick and dirty hack to implement the HS Electrical Test
++ * SINGLE_STEP_GET_DEVICE_DESCRIPTOR feature.
++ *
++ * This code was copied from our userspace app "hset". It sends a
++ * Get Device Descriptor control sequence in two parts, first the
++ * Setup packet by itself, followed some time later by the In and
++ * Ack packets. Rather than trying to figure out how to add this
++ * functionality to the normal driver code, we just hijack the
++ * hardware, using these two function to drive the hardware
++ * directly.
++ */
++
++static dwc_otg_core_global_regs_t *global_regs;
++static dwc_otg_host_global_regs_t *hc_global_regs;
++static dwc_otg_hc_regs_t *hc_regs;
++static uint32_t *data_fifo;
++
++static void do_setup(void)
++{
++	gintsts_data_t gintsts;
++	hctsiz_data_t hctsiz;
++	hcchar_data_t hcchar;
++	haint_data_t haint;
++	hcint_data_t hcint;
++
++	/* Enable HAINTs */
++	DWC_WRITE_REG32(&hc_global_regs->haintmsk, 0x0001);
++
++	/* Enable HCINTs */
++	DWC_WRITE_REG32(&hc_regs->hcintmsk, 0x04a3);
++
++	/* Read GINTSTS */
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++	/* Read HAINT */
++	haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
++
++	/* Read HCINT */
++	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++
++	/* Read HCCHAR */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++
++	/* Clear HCINT */
++	DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
++
++	/* Clear HAINT */
++	DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
++
++	/* Clear GINTSTS */
++	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++	/* Read GINTSTS */
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++	/*
++	 * Send Setup packet (Get Device Descriptor)
++	 */
++
++	/* Make sure channel is disabled */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	if (hcchar.b.chen) {
++		hcchar.b.chdis = 1;
++//              hcchar.b.chen = 1;
++		DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++		//sleep(1);
++		dwc_mdelay(1000);
++
++		/* Read GINTSTS */
++		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++		/* Read HAINT */
++		haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
++
++		/* Read HCINT */
++		hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++
++		/* Read HCCHAR */
++		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++
++		/* Clear HCINT */
++		DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
++
++		/* Clear HAINT */
++		DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
++
++		/* Clear GINTSTS */
++		DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	}
++
++	/* Set HCTSIZ */
++	hctsiz.d32 = 0;
++	hctsiz.b.xfersize = 8;
++	hctsiz.b.pktcnt = 1;
++	hctsiz.b.pid = DWC_OTG_HC_PID_SETUP;
++	DWC_WRITE_REG32(&hc_regs->hctsiz, hctsiz.d32);
++
++	/* Set HCCHAR */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	hcchar.b.eptype = DWC_OTG_EP_TYPE_CONTROL;
++	hcchar.b.epdir = 0;
++	hcchar.b.epnum = 0;
++	hcchar.b.mps = 8;
++	hcchar.b.chen = 1;
++	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++
++	/* Fill FIFO with Setup data for Get Device Descriptor */
++	data_fifo = (uint32_t *) ((char *)global_regs + 0x1000);
++	DWC_WRITE_REG32(data_fifo++, 0x01000680);
++	DWC_WRITE_REG32(data_fifo++, 0x00080000);
++
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++	/* Wait for host channel interrupt */
++	do {
++		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++	} while (gintsts.b.hcintr == 0);
++
++	/* Disable HCINTs */
++	DWC_WRITE_REG32(&hc_regs->hcintmsk, 0x0000);
++
++	/* Disable HAINTs */
++	DWC_WRITE_REG32(&hc_global_regs->haintmsk, 0x0000);
++
++	/* Read HAINT */
++	haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
++
++	/* Read HCINT */
++	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++
++	/* Read HCCHAR */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++
++	/* Clear HCINT */
++	DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
++
++	/* Clear HAINT */
++	DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
++
++	/* Clear GINTSTS */
++	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++	/* Read GINTSTS */
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++}
++
++static void do_in_ack(void)
++{
++	gintsts_data_t gintsts;
++	hctsiz_data_t hctsiz;
++	hcchar_data_t hcchar;
++	haint_data_t haint;
++	hcint_data_t hcint;
++	host_grxsts_data_t grxsts;
++
++	/* Enable HAINTs */
++	DWC_WRITE_REG32(&hc_global_regs->haintmsk, 0x0001);
++
++	/* Enable HCINTs */
++	DWC_WRITE_REG32(&hc_regs->hcintmsk, 0x04a3);
++
++	/* Read GINTSTS */
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++	/* Read HAINT */
++	haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
++
++	/* Read HCINT */
++	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++
++	/* Read HCCHAR */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++
++	/* Clear HCINT */
++	DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
++
++	/* Clear HAINT */
++	DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
++
++	/* Clear GINTSTS */
++	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++	/* Read GINTSTS */
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++	/*
++	 * Receive Control In packet
++	 */
++
++	/* Make sure channel is disabled */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	if (hcchar.b.chen) {
++		hcchar.b.chdis = 1;
++		hcchar.b.chen = 1;
++		DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++		//sleep(1);
++		dwc_mdelay(1000);
++
++		/* Read GINTSTS */
++		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++		/* Read HAINT */
++		haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
++
++		/* Read HCINT */
++		hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++
++		/* Read HCCHAR */
++		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++
++		/* Clear HCINT */
++		DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
++
++		/* Clear HAINT */
++		DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
++
++		/* Clear GINTSTS */
++		DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	}
++
++	/* Set HCTSIZ */
++	hctsiz.d32 = 0;
++	hctsiz.b.xfersize = 8;
++	hctsiz.b.pktcnt = 1;
++	hctsiz.b.pid = DWC_OTG_HC_PID_DATA1;
++	DWC_WRITE_REG32(&hc_regs->hctsiz, hctsiz.d32);
++
++	/* Set HCCHAR */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	hcchar.b.eptype = DWC_OTG_EP_TYPE_CONTROL;
++	hcchar.b.epdir = 1;
++	hcchar.b.epnum = 0;
++	hcchar.b.mps = 8;
++	hcchar.b.chen = 1;
++	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++	/* Wait for receive status queue interrupt */
++	do {
++		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++	} while (gintsts.b.rxstsqlvl == 0);
++
++	/* Read RXSTS */
++	grxsts.d32 = DWC_READ_REG32(&global_regs->grxstsp);
++
++	/* Clear RXSTSQLVL in GINTSTS */
++	gintsts.d32 = 0;
++	gintsts.b.rxstsqlvl = 1;
++	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++	switch (grxsts.b.pktsts) {
++	case DWC_GRXSTS_PKTSTS_IN:
++		/* Read the data into the host buffer */
++		if (grxsts.b.bcnt > 0) {
++			int i;
++			int word_count = (grxsts.b.bcnt + 3) / 4;
++
++			data_fifo = (uint32_t *) ((char *)global_regs + 0x1000);
++
++			for (i = 0; i < word_count; i++) {
++				(void)DWC_READ_REG32(data_fifo++);
++			}
++		}
++		break;
++
++	default:
++		break;
++	}
++
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++	/* Wait for receive status queue interrupt */
++	do {
++		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++	} while (gintsts.b.rxstsqlvl == 0);
++
++	/* Read RXSTS */
++	grxsts.d32 = DWC_READ_REG32(&global_regs->grxstsp);
++
++	/* Clear RXSTSQLVL in GINTSTS */
++	gintsts.d32 = 0;
++	gintsts.b.rxstsqlvl = 1;
++	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++	switch (grxsts.b.pktsts) {
++	case DWC_GRXSTS_PKTSTS_IN_XFER_COMP:
++		break;
++
++	default:
++		break;
++	}
++
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++	/* Wait for host channel interrupt */
++	do {
++		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++	} while (gintsts.b.hcintr == 0);
++
++	/* Read HAINT */
++	haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
++
++	/* Read HCINT */
++	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++
++	/* Read HCCHAR */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++
++	/* Clear HCINT */
++	DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
++
++	/* Clear HAINT */
++	DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
++
++	/* Clear GINTSTS */
++	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++	/* Read GINTSTS */
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++//      usleep(100000);
++//      mdelay(100);
++	dwc_mdelay(1);
++
++	/*
++	 * Send handshake packet
++	 */
++
++	/* Read HAINT */
++	haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
++
++	/* Read HCINT */
++	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++
++	/* Read HCCHAR */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++
++	/* Clear HCINT */
++	DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
++
++	/* Clear HAINT */
++	DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
++
++	/* Clear GINTSTS */
++	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++	/* Read GINTSTS */
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++	/* Make sure channel is disabled */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	if (hcchar.b.chen) {
++		hcchar.b.chdis = 1;
++		hcchar.b.chen = 1;
++		DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++		//sleep(1);
++		dwc_mdelay(1000);
++
++		/* Read GINTSTS */
++		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++		/* Read HAINT */
++		haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
++
++		/* Read HCINT */
++		hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++
++		/* Read HCCHAR */
++		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++
++		/* Clear HCINT */
++		DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
++
++		/* Clear HAINT */
++		DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
++
++		/* Clear GINTSTS */
++		DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	}
++
++	/* Set HCTSIZ */
++	hctsiz.d32 = 0;
++	hctsiz.b.xfersize = 0;
++	hctsiz.b.pktcnt = 1;
++	hctsiz.b.pid = DWC_OTG_HC_PID_DATA1;
++	DWC_WRITE_REG32(&hc_regs->hctsiz, hctsiz.d32);
++
++	/* Set HCCHAR */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	hcchar.b.eptype = DWC_OTG_EP_TYPE_CONTROL;
++	hcchar.b.epdir = 0;
++	hcchar.b.epnum = 0;
++	hcchar.b.mps = 8;
++	hcchar.b.chen = 1;
++	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
++
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++
++	/* Wait for host channel interrupt */
++	do {
++		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++	} while (gintsts.b.hcintr == 0);
++
++	/* Disable HCINTs */
++	DWC_WRITE_REG32(&hc_regs->hcintmsk, 0x0000);
++
++	/* Disable HAINTs */
++	DWC_WRITE_REG32(&hc_global_regs->haintmsk, 0x0000);
++
++	/* Read HAINT */
++	haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
++
++	/* Read HCINT */
++	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++
++	/* Read HCCHAR */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++
++	/* Clear HCINT */
++	DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
++
++	/* Clear HAINT */
++	DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
++
++	/* Clear GINTSTS */
++	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++	/* Read GINTSTS */
++	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
++}
++#endif
++
++/** Handles hub class-specific requests. */
++int dwc_otg_hcd_hub_control(dwc_otg_hcd_t * dwc_otg_hcd,
++			    uint16_t typeReq,
++			    uint16_t wValue,
++			    uint16_t wIndex, uint8_t * buf, uint16_t wLength)
++{
++	int retval = 0;
++
++	dwc_otg_core_if_t *core_if = dwc_otg_hcd->core_if;
++	usb_hub_descriptor_t *hub_desc;
++	hprt0_data_t hprt0 = {.d32 = 0 };
++
++	uint32_t port_status;
++
++	switch (typeReq) {
++	case UCR_CLEAR_HUB_FEATURE:
++		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++			    "ClearHubFeature 0x%x\n", wValue);
++		switch (wValue) {
++		case UHF_C_HUB_LOCAL_POWER:
++		case UHF_C_HUB_OVER_CURRENT:
++			/* Nothing required here */
++			break;
++		default:
++			retval = -DWC_E_INVALID;
++			DWC_ERROR("DWC OTG HCD - "
++				  "ClearHubFeature request %xh unknown\n",
++				  wValue);
++		}
++		break;
++	case UCR_CLEAR_PORT_FEATURE:
++#ifdef CONFIG_USB_DWC_OTG_LPM
++		if (wValue != UHF_PORT_L1)
++#endif
++			if (!wIndex || wIndex > 1)
++				goto error;
++
++		switch (wValue) {
++		case UHF_PORT_ENABLE:
++			DWC_DEBUGPL(DBG_ANY, "DWC OTG HCD HUB CONTROL - "
++				    "ClearPortFeature USB_PORT_FEAT_ENABLE\n");
++			hprt0.d32 = dwc_otg_read_hprt0(core_if);
++			hprt0.b.prtena = 1;
++			DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++			break;
++		case UHF_PORT_SUSPEND:
++			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++				    "ClearPortFeature USB_PORT_FEAT_SUSPEND\n");
++
++			if (core_if->power_down == 2) {
++				dwc_otg_host_hibernation_restore(core_if, 0, 0);
++			} else {
++				DWC_WRITE_REG32(core_if->pcgcctl, 0);
++				dwc_mdelay(5);
++
++				hprt0.d32 = dwc_otg_read_hprt0(core_if);
++				hprt0.b.prtres = 1;
++				DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++				hprt0.b.prtsusp = 0;
++				/* Clear Resume bit */
++				dwc_mdelay(100);
++				hprt0.b.prtres = 0;
++				DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++			}
++			break;
++#ifdef CONFIG_USB_DWC_OTG_LPM
++		case UHF_PORT_L1:
++			{
++				pcgcctl_data_t pcgcctl = {.d32 = 0 };
++				glpmcfg_data_t lpmcfg = {.d32 = 0 };
++
++				lpmcfg.d32 =
++				    DWC_READ_REG32(&core_if->
++						   core_global_regs->glpmcfg);
++				lpmcfg.b.en_utmi_sleep = 0;
++				lpmcfg.b.hird_thres &= (~(1 << 4));
++				lpmcfg.b.prt_sleep_sts = 1;
++				DWC_WRITE_REG32(&core_if->
++						core_global_regs->glpmcfg,
++						lpmcfg.d32);
++
++				/* Clear Enbl_L1Gating bit. */
++				pcgcctl.b.enbl_sleep_gating = 1;
++				DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32,
++						 0);
++
++				dwc_mdelay(5);
++
++				hprt0.d32 = dwc_otg_read_hprt0(core_if);
++				hprt0.b.prtres = 1;
++				DWC_WRITE_REG32(core_if->host_if->hprt0,
++						hprt0.d32);
++				/* This bit will be cleared in wakeup interrupt handle */
++				break;
++			}
++#endif
++		case UHF_PORT_POWER:
++			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++				    "ClearPortFeature USB_PORT_FEAT_POWER\n");
++			hprt0.d32 = dwc_otg_read_hprt0(core_if);
++			hprt0.b.prtpwr = 0;
++			DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++			break;
++		case UHF_PORT_INDICATOR:
++			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++				    "ClearPortFeature USB_PORT_FEAT_INDICATOR\n");
++			/* Port inidicator not supported */
++			break;
++		case UHF_C_PORT_CONNECTION:
++			/* Clears drivers internal connect status change
++			 * flag */
++			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++				    "ClearPortFeature USB_PORT_FEAT_C_CONNECTION\n");
++			dwc_otg_hcd->flags.b.port_connect_status_change = 0;
++			break;
++		case UHF_C_PORT_RESET:
++			/* Clears the driver's internal Port Reset Change
++			 * flag */
++			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++				    "ClearPortFeature USB_PORT_FEAT_C_RESET\n");
++			dwc_otg_hcd->flags.b.port_reset_change = 0;
++			break;
++		case UHF_C_PORT_ENABLE:
++			/* Clears the driver's internal Port
++			 * Enable/Disable Change flag */
++			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++				    "ClearPortFeature USB_PORT_FEAT_C_ENABLE\n");
++			dwc_otg_hcd->flags.b.port_enable_change = 0;
++			break;
++		case UHF_C_PORT_SUSPEND:
++			/* Clears the driver's internal Port Suspend
++			 * Change flag, which is set when resume signaling on
++			 * the host port is complete */
++			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++				    "ClearPortFeature USB_PORT_FEAT_C_SUSPEND\n");
++			dwc_otg_hcd->flags.b.port_suspend_change = 0;
++			break;
++#ifdef CONFIG_USB_DWC_OTG_LPM
++		case UHF_C_PORT_L1:
++			dwc_otg_hcd->flags.b.port_l1_change = 0;
++			break;
++#endif
++		case UHF_C_PORT_OVER_CURRENT:
++			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++				    "ClearPortFeature USB_PORT_FEAT_C_OVER_CURRENT\n");
++			dwc_otg_hcd->flags.b.port_over_current_change = 0;
++			break;
++		default:
++			retval = -DWC_E_INVALID;
++			DWC_ERROR("DWC OTG HCD - "
++				  "ClearPortFeature request %xh "
++				  "unknown or unsupported\n", wValue);
++		}
++		break;
++	case UCR_GET_HUB_DESCRIPTOR:
++		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++			    "GetHubDescriptor\n");
++		hub_desc = (usb_hub_descriptor_t *) buf;
++		hub_desc->bDescLength = 9;
++		hub_desc->bDescriptorType = 0x29;
++		hub_desc->bNbrPorts = 1;
++		USETW(hub_desc->wHubCharacteristics, 0x08);
++		hub_desc->bPwrOn2PwrGood = 1;
++		hub_desc->bHubContrCurrent = 0;
++		hub_desc->DeviceRemovable[0] = 0;
++		hub_desc->DeviceRemovable[1] = 0xff;
++		break;
++	case UCR_GET_HUB_STATUS:
++		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++			    "GetHubStatus\n");
++		DWC_MEMSET(buf, 0, 4);
++		break;
++	case UCR_GET_PORT_STATUS:
++		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++			    "GetPortStatus wIndex = 0x%04x FLAGS=0x%08x\n",
++			    wIndex, dwc_otg_hcd->flags.d32);
++		if (!wIndex || wIndex > 1)
++			goto error;
++
++		port_status = 0;
++
++		if (dwc_otg_hcd->flags.b.port_connect_status_change)
++			port_status |= (1 << UHF_C_PORT_CONNECTION);
++
++		if (dwc_otg_hcd->flags.b.port_enable_change)
++			port_status |= (1 << UHF_C_PORT_ENABLE);
++
++		if (dwc_otg_hcd->flags.b.port_suspend_change)
++			port_status |= (1 << UHF_C_PORT_SUSPEND);
++
++		if (dwc_otg_hcd->flags.b.port_l1_change)
++			port_status |= (1 << UHF_C_PORT_L1);
++
++		if (dwc_otg_hcd->flags.b.port_reset_change) {
++			port_status |= (1 << UHF_C_PORT_RESET);
++		}
++
++		if (dwc_otg_hcd->flags.b.port_over_current_change) {
++			DWC_WARN("Overcurrent change detected\n");
++			port_status |= (1 << UHF_C_PORT_OVER_CURRENT);
++		}
++
++		if (!dwc_otg_hcd->flags.b.port_connect_status) {
++			/*
++			 * The port is disconnected, which means the core is
++			 * either in device mode or it soon will be. Just
++			 * return 0's for the remainder of the port status
++			 * since the port register can't be read if the core
++			 * is in device mode.
++			 */
++			*((__le32 *) buf) = dwc_cpu_to_le32(&port_status);
++			break;
++		}
++
++		hprt0.d32 = DWC_READ_REG32(core_if->host_if->hprt0);
++		DWC_DEBUGPL(DBG_HCDV, "  HPRT0: 0x%08x\n", hprt0.d32);
++
++		if (hprt0.b.prtconnsts)
++			port_status |= (1 << UHF_PORT_CONNECTION);
++
++		if (hprt0.b.prtena)
++			port_status |= (1 << UHF_PORT_ENABLE);
++
++		if (hprt0.b.prtsusp)
++			port_status |= (1 << UHF_PORT_SUSPEND);
++
++		if (hprt0.b.prtovrcurract)
++			port_status |= (1 << UHF_PORT_OVER_CURRENT);
++
++		if (hprt0.b.prtrst)
++			port_status |= (1 << UHF_PORT_RESET);
++
++		if (hprt0.b.prtpwr)
++			port_status |= (1 << UHF_PORT_POWER);
++
++		if (hprt0.b.prtspd == DWC_HPRT0_PRTSPD_HIGH_SPEED)
++			port_status |= (1 << UHF_PORT_HIGH_SPEED);
++		else if (hprt0.b.prtspd == DWC_HPRT0_PRTSPD_LOW_SPEED)
++			port_status |= (1 << UHF_PORT_LOW_SPEED);
++
++		if (hprt0.b.prttstctl)
++			port_status |= (1 << UHF_PORT_TEST);
++		if (dwc_otg_get_lpm_portsleepstatus(dwc_otg_hcd->core_if)) {
++			port_status |= (1 << UHF_PORT_L1);
++		}
++		/*
++		   For Synopsys HW emulation of Power down wkup_control asserts the
++		   hreset_n and prst_n on suspned. This causes the HPRT0 to be zero.
++		   We intentionally tell the software that port is in L2Suspend state.
++		   Only for STE.
++		*/
++		if ((core_if->power_down == 2)
++		    && (core_if->hibernation_suspend == 1)) {
++			port_status |= (1 << UHF_PORT_SUSPEND);
++		}
++		/* USB_PORT_FEAT_INDICATOR unsupported always 0 */
++
++		*((__le32 *) buf) = dwc_cpu_to_le32(&port_status);
++
++		break;
++	case UCR_SET_HUB_FEATURE:
++		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++			    "SetHubFeature\n");
++		/* No HUB features supported */
++		break;
++	case UCR_SET_PORT_FEATURE:
++		if (wValue != UHF_PORT_TEST && (!wIndex || wIndex > 1))
++			goto error;
++
++		if (!dwc_otg_hcd->flags.b.port_connect_status) {
++			/*
++			 * The port is disconnected, which means the core is
++			 * either in device mode or it soon will be. Just
++			 * return without doing anything since the port
++			 * register can't be written if the core is in device
++			 * mode.
++			 */
++			break;
++		}
++
++		switch (wValue) {
++		case UHF_PORT_SUSPEND:
++			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++				    "SetPortFeature - USB_PORT_FEAT_SUSPEND\n");
++			if (dwc_otg_hcd_otg_port(dwc_otg_hcd) != wIndex) {
++				goto error;
++			}
++			if (core_if->power_down == 2) {
++				int timeout = 300;
++				dwc_irqflags_t flags;
++				pcgcctl_data_t pcgcctl = {.d32 = 0 };
++				gpwrdn_data_t gpwrdn = {.d32 = 0 };
++				gusbcfg_data_t gusbcfg = {.d32 = 0 };
++#ifdef DWC_DEV_SRPCAP
++				int32_t otg_cap_param = core_if->core_params->otg_cap;
++#endif
++				DWC_PRINTF("Preparing for complete power-off\n");
++
++				/* Save registers before hibernation */
++				dwc_otg_save_global_regs(core_if);
++				dwc_otg_save_host_regs(core_if);
++
++				hprt0.d32 = dwc_otg_read_hprt0(core_if);
++				hprt0.b.prtsusp = 1;
++				hprt0.b.prtena = 0;
++				DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++				/* Spin hprt0.b.prtsusp to became 1 */
++				do {
++					hprt0.d32 = dwc_otg_read_hprt0(core_if);
++					if (hprt0.b.prtsusp) {
++						break;
++					}
++					dwc_mdelay(1);
++				} while (--timeout);
++				if (!timeout) {
++					DWC_WARN("Suspend wasn't genereted\n");
++				}
++				dwc_udelay(10);
++
++				/*
++				 * We need to disable interrupts to prevent servicing of any IRQ
++				 * during going to hibernation
++				 */
++				DWC_SPINLOCK_IRQSAVE(dwc_otg_hcd->lock, &flags);
++				core_if->lx_state = DWC_OTG_L2;
++#ifdef DWC_DEV_SRPCAP
++				hprt0.d32 = dwc_otg_read_hprt0(core_if);
++				hprt0.b.prtpwr = 0;
++				hprt0.b.prtena = 0;
++				DWC_WRITE_REG32(core_if->host_if->hprt0,
++						hprt0.d32);
++#endif
++				gusbcfg.d32 =
++				    DWC_READ_REG32(&core_if->core_global_regs->
++						   gusbcfg);
++				if (gusbcfg.b.ulpi_utmi_sel == 1) {
++					/* ULPI interface */
++					/* Suspend the Phy Clock */
++					pcgcctl.d32 = 0;
++					pcgcctl.b.stoppclk = 1;
++					DWC_MODIFY_REG32(core_if->pcgcctl, 0,
++							 pcgcctl.d32);
++					dwc_udelay(10);
++					gpwrdn.b.pmuactv = 1;
++					DWC_MODIFY_REG32(&core_if->
++							 core_global_regs->
++							 gpwrdn, 0, gpwrdn.d32);
++				} else {
++					/* UTMI+ Interface */
++					gpwrdn.b.pmuactv = 1;
++					DWC_MODIFY_REG32(&core_if->
++							 core_global_regs->
++							 gpwrdn, 0, gpwrdn.d32);
++					dwc_udelay(10);
++					pcgcctl.b.stoppclk = 1;
++					DWC_MODIFY_REG32(core_if->pcgcctl, 0, pcgcctl.d32);
++					dwc_udelay(10);
++				}
++#ifdef DWC_DEV_SRPCAP
++				gpwrdn.d32 = 0;
++				gpwrdn.b.dis_vbus = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++#endif
++				gpwrdn.d32 = 0;
++				gpwrdn.b.pmuintsel = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++				dwc_udelay(10);
++
++				gpwrdn.d32 = 0;
++#ifdef DWC_DEV_SRPCAP
++				gpwrdn.b.srp_det_msk = 1;
++#endif
++				gpwrdn.b.disconn_det_msk = 1;
++				gpwrdn.b.lnstchng_msk = 1;
++				gpwrdn.b.sts_chngint_msk = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++				dwc_udelay(10);
++
++				/* Enable Power Down Clamp and all interrupts in GPWRDN */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.pwrdnclmp = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++				dwc_udelay(10);
++
++				/* Switch off VDD */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.pwrdnswtch = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++
++#ifdef DWC_DEV_SRPCAP
++				if (otg_cap_param == DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE)
++				{
++					core_if->pwron_timer_started = 1;
++					DWC_TIMER_SCHEDULE(core_if->pwron_timer, 6000 /* 6 secs */ );
++				}
++#endif
++				/* Save gpwrdn register for further usage if stschng interrupt */
++				core_if->gr_backup->gpwrdn_local =
++						DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
++
++				/* Set flag to indicate that we are in hibernation */
++				core_if->hibernation_suspend = 1;
++				DWC_SPINUNLOCK_IRQRESTORE(dwc_otg_hcd->lock,flags);
++
++				DWC_PRINTF("Host hibernation completed\n");
++				// Exit from case statement
++				break;
++
++			}
++			if (dwc_otg_hcd_otg_port(dwc_otg_hcd) == wIndex &&
++			    dwc_otg_hcd->fops->get_b_hnp_enable(dwc_otg_hcd)) {
++				gotgctl_data_t gotgctl = {.d32 = 0 };
++				gotgctl.b.hstsethnpen = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gotgctl, 0, gotgctl.d32);
++				core_if->op_state = A_SUSPEND;
++			}
++			hprt0.d32 = dwc_otg_read_hprt0(core_if);
++			hprt0.b.prtsusp = 1;
++			DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++			{
++				dwc_irqflags_t flags;
++				/* Update lx_state */
++				DWC_SPINLOCK_IRQSAVE(dwc_otg_hcd->lock, &flags);
++				core_if->lx_state = DWC_OTG_L2;
++				DWC_SPINUNLOCK_IRQRESTORE(dwc_otg_hcd->lock, flags);
++			}
++			/* Suspend the Phy Clock */
++			{
++				pcgcctl_data_t pcgcctl = {.d32 = 0 };
++				pcgcctl.b.stoppclk = 1;
++				DWC_MODIFY_REG32(core_if->pcgcctl, 0,
++						 pcgcctl.d32);
++				dwc_udelay(10);
++			}
++
++			/* For HNP the bus must be suspended for at least 200ms. */
++			if (dwc_otg_hcd->fops->get_b_hnp_enable(dwc_otg_hcd)) {
++				pcgcctl_data_t pcgcctl = {.d32 = 0 };
++				pcgcctl.b.stoppclk = 1;
++                DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
++				dwc_mdelay(200);
++			}
++
++			/** @todo - check how sw can wait for 1 sec to check asesvld??? */
++#if 0 //vahrama !!!!!!!!!!!!!!!!!!
++			if (core_if->adp_enable) {
++				gotgctl_data_t gotgctl = {.d32 = 0 };
++				gpwrdn_data_t gpwrdn;
++
++				while (gotgctl.b.asesvld == 1) {
++					gotgctl.d32 =
++					    DWC_READ_REG32(&core_if->
++							   core_global_regs->
++							   gotgctl);
++					dwc_mdelay(100);
++				}
++
++				/* Enable Power Down Logic */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.pmuactv = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++
++				/* Unmask SRP detected interrupt from Power Down Logic */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.srp_det_msk = 1;
++				DWC_MODIFY_REG32(&core_if->core_global_regs->
++						 gpwrdn, 0, gpwrdn.d32);
++
++				dwc_otg_adp_probe_start(core_if);
++			}
++#endif
++			break;
++		case UHF_PORT_POWER:
++			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++				    "SetPortFeature - USB_PORT_FEAT_POWER\n");
++			hprt0.d32 = dwc_otg_read_hprt0(core_if);
++			hprt0.b.prtpwr = 1;
++			DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++			break;
++		case UHF_PORT_RESET:
++			if ((core_if->power_down == 2)
++			    && (core_if->hibernation_suspend == 1)) {
++				/* If we are going to exit from Hibernated
++				 * state via USB RESET.
++				 */
++				dwc_otg_host_hibernation_restore(core_if, 0, 1);
++			} else {
++				hprt0.d32 = dwc_otg_read_hprt0(core_if);
++
++				DWC_DEBUGPL(DBG_HCD,
++					    "DWC OTG HCD HUB CONTROL - "
++					    "SetPortFeature - USB_PORT_FEAT_RESET\n");
++				{
++					pcgcctl_data_t pcgcctl = {.d32 = 0 };
++					pcgcctl.b.enbl_sleep_gating = 1;
++					pcgcctl.b.stoppclk = 1;
++					DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
++					DWC_WRITE_REG32(core_if->pcgcctl, 0);
++				}
++#ifdef CONFIG_USB_DWC_OTG_LPM
++				{
++					glpmcfg_data_t lpmcfg;
++					lpmcfg.d32 =
++						DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++					if (lpmcfg.b.prt_sleep_sts) {
++						lpmcfg.b.en_utmi_sleep = 0;
++						lpmcfg.b.hird_thres &= (~(1 << 4));
++						DWC_WRITE_REG32
++						    (&core_if->core_global_regs->glpmcfg,
++						     lpmcfg.d32);
++						dwc_mdelay(1);
++					}
++				}
++#endif
++				hprt0.d32 = dwc_otg_read_hprt0(core_if);
++				/* Clear suspend bit if resetting from suspended state. */
++				hprt0.b.prtsusp = 0;
++				/* When B-Host the Port reset bit is set in
++				 * the Start HCD Callback function, so that
++				 * the reset is started within 1ms of the HNP
++				 * success interrupt. */
++				if (!dwc_otg_hcd_is_b_host(dwc_otg_hcd)) {
++					hprt0.b.prtpwr = 1;
++					hprt0.b.prtrst = 1;
++					DWC_PRINTF("Indeed it is in host mode hprt0 = %08x\n",hprt0.d32);
++					DWC_WRITE_REG32(core_if->host_if->hprt0,
++							hprt0.d32);
++				}
++				/* Clear reset bit in 10ms (FS/LS) or 50ms (HS) */
++				dwc_mdelay(60);
++				hprt0.b.prtrst = 0;
++				DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++				core_if->lx_state = DWC_OTG_L0;	/* Now back to the on state */
++			}
++			break;
++#ifdef DWC_HS_ELECT_TST
++		case UHF_PORT_TEST:
++			{
++				uint32_t t;
++				gintmsk_data_t gintmsk;
++
++				t = (wIndex >> 8);	/* MSB wIndex USB */
++				DWC_DEBUGPL(DBG_HCD,
++					    "DWC OTG HCD HUB CONTROL - "
++					    "SetPortFeature - USB_PORT_FEAT_TEST %d\n",
++					    t);
++				DWC_WARN("USB_PORT_FEAT_TEST %d\n", t);
++				if (t < 6) {
++					hprt0.d32 = dwc_otg_read_hprt0(core_if);
++					hprt0.b.prttstctl = t;
++					DWC_WRITE_REG32(core_if->host_if->hprt0,
++							hprt0.d32);
++				} else {
++					/* Setup global vars with reg addresses (quick and
++					 * dirty hack, should be cleaned up)
++					 */
++					global_regs = core_if->core_global_regs;
++					hc_global_regs =
++					    core_if->host_if->host_global_regs;
++					hc_regs =
++					    (dwc_otg_hc_regs_t *) ((char *)
++								   global_regs +
++								   0x500);
++					data_fifo =
++					    (uint32_t *) ((char *)global_regs +
++							  0x1000);
++
++					if (t == 6) {	/* HS_HOST_PORT_SUSPEND_RESUME */
++						/* Save current interrupt mask */
++						gintmsk.d32 =
++						    DWC_READ_REG32
++						    (&global_regs->gintmsk);
++
++						/* Disable all interrupts while we muck with
++						 * the hardware directly
++						 */
++						DWC_WRITE_REG32(&global_regs->gintmsk, 0);
++
++						/* 15 second delay per the test spec */
++						dwc_mdelay(15000);
++
++						/* Drive suspend on the root port */
++						hprt0.d32 =
++						    dwc_otg_read_hprt0(core_if);
++						hprt0.b.prtsusp = 1;
++						hprt0.b.prtres = 0;
++						DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++
++						/* 15 second delay per the test spec */
++						dwc_mdelay(15000);
++
++						/* Drive resume on the root port */
++						hprt0.d32 =
++						    dwc_otg_read_hprt0(core_if);
++						hprt0.b.prtsusp = 0;
++						hprt0.b.prtres = 1;
++						DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++						dwc_mdelay(100);
++
++						/* Clear the resume bit */
++						hprt0.b.prtres = 0;
++						DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
++
++						/* Restore interrupts */
++						DWC_WRITE_REG32(&global_regs->gintmsk, gintmsk.d32);
++					} else if (t == 7) {	/* SINGLE_STEP_GET_DEVICE_DESCRIPTOR setup */
++						/* Save current interrupt mask */
++						gintmsk.d32 =
++						    DWC_READ_REG32
++						    (&global_regs->gintmsk);
++
++						/* Disable all interrupts while we muck with
++						 * the hardware directly
++						 */
++						DWC_WRITE_REG32(&global_regs->gintmsk, 0);
++
++						/* 15 second delay per the test spec */
++						dwc_mdelay(15000);
++
++						/* Send the Setup packet */
++						do_setup();
++
++						/* 15 second delay so nothing else happens for awhile */
++						dwc_mdelay(15000);
++
++						/* Restore interrupts */
++						DWC_WRITE_REG32(&global_regs->gintmsk, gintmsk.d32);
++					} else if (t == 8) {	/* SINGLE_STEP_GET_DEVICE_DESCRIPTOR execute */
++						/* Save current interrupt mask */
++						gintmsk.d32 =
++						    DWC_READ_REG32
++						    (&global_regs->gintmsk);
++
++						/* Disable all interrupts while we muck with
++						 * the hardware directly
++						 */
++						DWC_WRITE_REG32(&global_regs->gintmsk, 0);
++
++						/* Send the Setup packet */
++						do_setup();
++
++						/* 15 second delay so nothing else happens for awhile */
++						dwc_mdelay(15000);
++
++						/* Send the In and Ack packets */
++						do_in_ack();
++
++						/* 15 second delay so nothing else happens for awhile */
++						dwc_mdelay(15000);
++
++						/* Restore interrupts */
++						DWC_WRITE_REG32(&global_regs->gintmsk, gintmsk.d32);
++					}
++				}
++				break;
++			}
++#endif /* DWC_HS_ELECT_TST */
++
++		case UHF_PORT_INDICATOR:
++			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
++				    "SetPortFeature - USB_PORT_FEAT_INDICATOR\n");
++			/* Not supported */
++			break;
++		default:
++			retval = -DWC_E_INVALID;
++			DWC_ERROR("DWC OTG HCD - "
++				  "SetPortFeature request %xh "
++				  "unknown or unsupported\n", wValue);
++			break;
++		}
++		break;
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	case UCR_SET_AND_TEST_PORT_FEATURE:
++		if (wValue != UHF_PORT_L1) {
++			goto error;
++		}
++		{
++			int portnum, hird, devaddr, remwake;
++			glpmcfg_data_t lpmcfg;
++			uint32_t time_usecs;
++			gintsts_data_t gintsts;
++			gintmsk_data_t gintmsk;
++
++			if (!dwc_otg_get_param_lpm_enable(core_if)) {
++				goto error;
++			}
++			if (wValue != UHF_PORT_L1 || wLength != 1) {
++				goto error;
++			}
++			/* Check if the port currently is in SLEEP state */
++			lpmcfg.d32 =
++			    DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++			if (lpmcfg.b.prt_sleep_sts) {
++				DWC_INFO("Port is already in sleep mode\n");
++				buf[0] = 0;	/* Return success */
++				break;
++			}
++
++			portnum = wIndex & 0xf;
++			hird = (wIndex >> 4) & 0xf;
++			devaddr = (wIndex >> 8) & 0x7f;
++			remwake = (wIndex >> 15);
++
++			if (portnum != 1) {
++				retval = -DWC_E_INVALID;
++				DWC_WARN
++				    ("Wrong port number(%d) in SetandTestPortFeature request\n",
++				     portnum);
++				break;
++			}
++
++			DWC_PRINTF
++			    ("SetandTestPortFeature request: portnum = %d, hird = %d, devaddr = %d, rewake = %d\n",
++			     portnum, hird, devaddr, remwake);
++			/* Disable LPM interrupt */
++			gintmsk.d32 = 0;
++			gintmsk.b.lpmtranrcvd = 1;
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk,
++					 gintmsk.d32, 0);
++
++			if (dwc_otg_hcd_send_lpm
++			    (dwc_otg_hcd, devaddr, hird, remwake)) {
++				retval = -DWC_E_INVALID;
++				break;
++			}
++
++			time_usecs = 10 * (lpmcfg.b.retry_count + 1);
++			/* We will consider timeout if time_usecs microseconds pass,
++			 * and we don't receive LPM transaction status.
++			 * After receiving non-error responce(ACK/NYET/STALL) from device,
++			 *  core will set lpmtranrcvd bit.
++			 */
++			do {
++				gintsts.d32 =
++				    DWC_READ_REG32(&core_if->core_global_regs->gintsts);
++				if (gintsts.b.lpmtranrcvd) {
++					break;
++				}
++				dwc_udelay(1);
++			} while (--time_usecs);
++			/* lpm_int bit will be cleared in LPM interrupt handler */
++
++			/* Now fill status
++			 * 0x00 - Success
++			 * 0x10 - NYET
++			 * 0x11 - Timeout
++			 */
++			if (!gintsts.b.lpmtranrcvd) {
++				buf[0] = 0x3;	/* Completion code is Timeout */
++				dwc_otg_hcd_free_hc_from_lpm(dwc_otg_hcd);
++			} else {
++				lpmcfg.d32 =
++				    DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++				if (lpmcfg.b.lpm_resp == 0x3) {
++					/* ACK responce from the device */
++					buf[0] = 0x00;	/* Success */
++				} else if (lpmcfg.b.lpm_resp == 0x2) {
++					/* NYET responce from the device */
++					buf[0] = 0x2;
++				} else {
++					/* Otherwise responce with Timeout */
++					buf[0] = 0x3;
++				}
++			}
++			DWC_PRINTF("Device responce to LPM trans is %x\n",
++				   lpmcfg.b.lpm_resp);
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, 0,
++					 gintmsk.d32);
++
++			break;
++		}
++#endif /* CONFIG_USB_DWC_OTG_LPM */
++	default:
++error:
++		retval = -DWC_E_INVALID;
++		DWC_WARN("DWC OTG HCD - "
++			 "Unknown hub control request type or invalid typeReq: %xh wIndex: %xh wValue: %xh\n",
++			 typeReq, wIndex, wValue);
++		break;
++	}
++
++	return retval;
++}
++
++#ifdef CONFIG_USB_DWC_OTG_LPM
++/** Returns index of host channel to perform LPM transaction. */
++int dwc_otg_hcd_get_hc_for_lpm_tran(dwc_otg_hcd_t * hcd, uint8_t devaddr)
++{
++	dwc_otg_core_if_t *core_if = hcd->core_if;
++	dwc_hc_t *hc;
++	hcchar_data_t hcchar;
++	gintmsk_data_t gintmsk = {.d32 = 0 };
++
++	if (DWC_CIRCLEQ_EMPTY(&hcd->free_hc_list)) {
++		DWC_PRINTF("No free channel to select for LPM transaction\n");
++		return -1;
++	}
++
++	hc = DWC_CIRCLEQ_FIRST(&hcd->free_hc_list);
++
++	/* Mask host channel interrupts. */
++	gintmsk.b.hcintr = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, gintmsk.d32, 0);
++
++	/* Fill fields that core needs for LPM transaction */
++	hcchar.b.devaddr = devaddr;
++	hcchar.b.epnum = 0;
++	hcchar.b.eptype = DWC_OTG_EP_TYPE_CONTROL;
++	hcchar.b.mps = 64;
++	hcchar.b.lspddev = (hc->speed == DWC_OTG_EP_SPEED_LOW);
++	hcchar.b.epdir = 0;	/* OUT */
++	DWC_WRITE_REG32(&core_if->host_if->hc_regs[hc->hc_num]->hcchar,
++			hcchar.d32);
++
++	/* Remove the host channel from the free list. */
++	DWC_CIRCLEQ_REMOVE_INIT(&hcd->free_hc_list, hc, hc_list_entry);
++
++	DWC_PRINTF("hcnum = %d devaddr = %d\n", hc->hc_num, devaddr);
++
++	return hc->hc_num;
++}
++
++/** Release hc after performing LPM transaction */
++void dwc_otg_hcd_free_hc_from_lpm(dwc_otg_hcd_t * hcd)
++{
++	dwc_hc_t *hc;
++	glpmcfg_data_t lpmcfg;
++	uint8_t hc_num;
++
++	lpmcfg.d32 = DWC_READ_REG32(&hcd->core_if->core_global_regs->glpmcfg);
++	hc_num = lpmcfg.b.lpm_chan_index;
++
++	hc = hcd->hc_ptr_array[hc_num];
++
++	DWC_PRINTF("Freeing channel %d after LPM\n", hc_num);
++	/* Return host channel to free list */
++	DWC_CIRCLEQ_INSERT_TAIL(&hcd->free_hc_list, hc, hc_list_entry);
++}
++
++int dwc_otg_hcd_send_lpm(dwc_otg_hcd_t * hcd, uint8_t devaddr, uint8_t hird,
++			 uint8_t bRemoteWake)
++{
++	glpmcfg_data_t lpmcfg;
++	pcgcctl_data_t pcgcctl = {.d32 = 0 };
++	int channel;
++
++	channel = dwc_otg_hcd_get_hc_for_lpm_tran(hcd, devaddr);
++	if (channel < 0) {
++		return channel;
++	}
++
++	pcgcctl.b.enbl_sleep_gating = 1;
++	DWC_MODIFY_REG32(hcd->core_if->pcgcctl, 0, pcgcctl.d32);
++
++	/* Read LPM config register */
++	lpmcfg.d32 = DWC_READ_REG32(&hcd->core_if->core_global_regs->glpmcfg);
++
++	/* Program LPM transaction fields */
++	lpmcfg.b.rem_wkup_en = bRemoteWake;
++	lpmcfg.b.hird = hird;
++	lpmcfg.b.hird_thres = 0x1c;
++	lpmcfg.b.lpm_chan_index = channel;
++	lpmcfg.b.en_utmi_sleep = 1;
++	/* Program LPM config register */
++	DWC_WRITE_REG32(&hcd->core_if->core_global_regs->glpmcfg, lpmcfg.d32);
++
++	/* Send LPM transaction */
++	lpmcfg.b.send_lpm = 1;
++	DWC_WRITE_REG32(&hcd->core_if->core_global_regs->glpmcfg, lpmcfg.d32);
++
++	return 0;
++}
++
++#endif /* CONFIG_USB_DWC_OTG_LPM */
++
++int dwc_otg_hcd_is_status_changed(dwc_otg_hcd_t * hcd, int port)
++{
++	int retval;
++
++	if (port != 1) {
++		return -DWC_E_INVALID;
++	}
++
++	retval = (hcd->flags.b.port_connect_status_change ||
++		  hcd->flags.b.port_reset_change ||
++		  hcd->flags.b.port_enable_change ||
++		  hcd->flags.b.port_suspend_change ||
++		  hcd->flags.b.port_over_current_change);
++#ifdef DEBUG
++	if (retval) {
++		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB STATUS DATA:"
++			    " Root port status changed\n");
++		DWC_DEBUGPL(DBG_HCDV, "  port_connect_status_change: %d\n",
++			    hcd->flags.b.port_connect_status_change);
++		DWC_DEBUGPL(DBG_HCDV, "  port_reset_change: %d\n",
++			    hcd->flags.b.port_reset_change);
++		DWC_DEBUGPL(DBG_HCDV, "  port_enable_change: %d\n",
++			    hcd->flags.b.port_enable_change);
++		DWC_DEBUGPL(DBG_HCDV, "  port_suspend_change: %d\n",
++			    hcd->flags.b.port_suspend_change);
++		DWC_DEBUGPL(DBG_HCDV, "  port_over_current_change: %d\n",
++			    hcd->flags.b.port_over_current_change);
++	}
++#endif
++	return retval;
++}
++
++int dwc_otg_hcd_get_frame_number(dwc_otg_hcd_t * dwc_otg_hcd)
++{
++	hfnum_data_t hfnum;
++	hfnum.d32 =
++	    DWC_READ_REG32(&dwc_otg_hcd->core_if->host_if->host_global_regs->
++			   hfnum);
++
++#ifdef DEBUG_SOF
++	DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD GET FRAME NUMBER %d\n",
++		    hfnum.b.frnum);
++#endif
++	return hfnum.b.frnum;
++}
++
++int dwc_otg_hcd_start(dwc_otg_hcd_t * hcd,
++		      struct dwc_otg_hcd_function_ops *fops)
++{
++	int retval = 0;
++
++	hcd->fops = fops;
++	if (!dwc_otg_is_device_mode(hcd->core_if) &&
++		(!hcd->core_if->adp_enable || hcd->core_if->adp.adp_started)) {
++		dwc_otg_hcd_reinit(hcd);
++	} else {
++		retval = -DWC_E_NO_DEVICE;
++	}
++
++	return retval;
++}
++
++void *dwc_otg_hcd_get_priv_data(dwc_otg_hcd_t * hcd)
++{
++	return hcd->priv;
++}
++
++void dwc_otg_hcd_set_priv_data(dwc_otg_hcd_t * hcd, void *priv_data)
++{
++	hcd->priv = priv_data;
++}
++
++uint32_t dwc_otg_hcd_otg_port(dwc_otg_hcd_t * hcd)
++{
++	return hcd->otg_port;
++}
++
++uint32_t dwc_otg_hcd_is_b_host(dwc_otg_hcd_t * hcd)
++{
++	uint32_t is_b_host;
++	if (hcd->core_if->op_state == B_HOST) {
++		is_b_host = 1;
++	} else {
++		is_b_host = 0;
++	}
++
++	return is_b_host;
++}
++
++dwc_otg_hcd_urb_t *dwc_otg_hcd_urb_alloc(dwc_otg_hcd_t * hcd,
++					 int iso_desc_count, int atomic_alloc)
++{
++	dwc_otg_hcd_urb_t *dwc_otg_urb;
++	uint32_t size;
++
++	size =
++	    sizeof(*dwc_otg_urb) +
++	    iso_desc_count * sizeof(struct dwc_otg_hcd_iso_packet_desc);
++	if (atomic_alloc)
++		dwc_otg_urb = DWC_ALLOC_ATOMIC(size);
++	else
++		dwc_otg_urb = DWC_ALLOC(size);
++
++        if (dwc_otg_urb)
++		dwc_otg_urb->packet_count = iso_desc_count;
++        else {
++		DWC_ERROR("**** DWC OTG HCD URB alloc - "
++			"%salloc of %db failed\n",
++			atomic_alloc?"atomic ":"", size);
++	}
++	return dwc_otg_urb;
++}
++
++void dwc_otg_hcd_urb_set_pipeinfo(dwc_otg_hcd_urb_t * dwc_otg_urb,
++				  uint8_t dev_addr, uint8_t ep_num,
++				  uint8_t ep_type, uint8_t ep_dir, uint16_t mps)
++{
++	dwc_otg_hcd_fill_pipe(&dwc_otg_urb->pipe_info, dev_addr, ep_num,
++			      ep_type, ep_dir, mps);
++#if 0
++	DWC_PRINTF
++	    ("addr = %d, ep_num = %d, ep_dir = 0x%x, ep_type = 0x%x, mps = %d\n",
++	     dev_addr, ep_num, ep_dir, ep_type, mps);
++#endif
++}
++
++void dwc_otg_hcd_urb_set_params(dwc_otg_hcd_urb_t * dwc_otg_urb,
++				void *urb_handle, void *buf, dwc_dma_t dma,
++				uint32_t buflen, void *setup_packet,
++				dwc_dma_t setup_dma, uint32_t flags,
++				uint16_t interval)
++{
++	dwc_otg_urb->priv = urb_handle;
++	dwc_otg_urb->buf = buf;
++	dwc_otg_urb->dma = dma;
++	dwc_otg_urb->length = buflen;
++	dwc_otg_urb->setup_packet = setup_packet;
++	dwc_otg_urb->setup_dma = setup_dma;
++	dwc_otg_urb->flags = flags;
++	dwc_otg_urb->interval = interval;
++	dwc_otg_urb->status = -DWC_E_IN_PROGRESS;
++}
++
++uint32_t dwc_otg_hcd_urb_get_status(dwc_otg_hcd_urb_t * dwc_otg_urb)
++{
++	return dwc_otg_urb->status;
++}
++
++uint32_t dwc_otg_hcd_urb_get_actual_length(dwc_otg_hcd_urb_t * dwc_otg_urb)
++{
++	return dwc_otg_urb->actual_length;
++}
++
++uint32_t dwc_otg_hcd_urb_get_error_count(dwc_otg_hcd_urb_t * dwc_otg_urb)
++{
++	return dwc_otg_urb->error_count;
++}
++
++void dwc_otg_hcd_urb_set_iso_desc_params(dwc_otg_hcd_urb_t * dwc_otg_urb,
++					 int desc_num, uint32_t offset,
++					 uint32_t length)
++{
++	dwc_otg_urb->iso_descs[desc_num].offset = offset;
++	dwc_otg_urb->iso_descs[desc_num].length = length;
++}
++
++uint32_t dwc_otg_hcd_urb_get_iso_desc_status(dwc_otg_hcd_urb_t * dwc_otg_urb,
++					     int desc_num)
++{
++	return dwc_otg_urb->iso_descs[desc_num].status;
++}
++
++uint32_t dwc_otg_hcd_urb_get_iso_desc_actual_length(dwc_otg_hcd_urb_t *
++						    dwc_otg_urb, int desc_num)
++{
++	return dwc_otg_urb->iso_descs[desc_num].actual_length;
++}
++
++int dwc_otg_hcd_is_bandwidth_allocated(dwc_otg_hcd_t * hcd, void *ep_handle)
++{
++	int allocated = 0;
++	dwc_otg_qh_t *qh = (dwc_otg_qh_t *) ep_handle;
++
++	if (qh) {
++		if (!DWC_LIST_EMPTY(&qh->qh_list_entry)) {
++			allocated = 1;
++		}
++	}
++	return allocated;
++}
++
++int dwc_otg_hcd_is_bandwidth_freed(dwc_otg_hcd_t * hcd, void *ep_handle)
++{
++	dwc_otg_qh_t *qh = (dwc_otg_qh_t *) ep_handle;
++	int freed = 0;
++	DWC_ASSERT(qh, "qh is not allocated\n");
++
++	if (DWC_LIST_EMPTY(&qh->qh_list_entry)) {
++		freed = 1;
++	}
++
++	return freed;
++}
++
++uint8_t dwc_otg_hcd_get_ep_bandwidth(dwc_otg_hcd_t * hcd, void *ep_handle)
++{
++	dwc_otg_qh_t *qh = (dwc_otg_qh_t *) ep_handle;
++	DWC_ASSERT(qh, "qh is not allocated\n");
++	return qh->usecs;
++}
++
++void dwc_otg_hcd_dump_state(dwc_otg_hcd_t * hcd)
++{
++#ifdef DEBUG
++	int num_channels;
++	int i;
++	gnptxsts_data_t np_tx_status;
++	hptxsts_data_t p_tx_status;
++
++	num_channels = hcd->core_if->core_params->host_channels;
++	DWC_PRINTF("\n");
++	DWC_PRINTF
++	    ("************************************************************\n");
++	DWC_PRINTF("HCD State:\n");
++	DWC_PRINTF("  Num channels: %d\n", num_channels);
++	for (i = 0; i < num_channels; i++) {
++		dwc_hc_t *hc = hcd->hc_ptr_array[i];
++		DWC_PRINTF("  Channel %d:\n", i);
++		DWC_PRINTF("    dev_addr: %d, ep_num: %d, ep_is_in: %d\n",
++			   hc->dev_addr, hc->ep_num, hc->ep_is_in);
++		DWC_PRINTF("    speed: %d\n", hc->speed);
++		DWC_PRINTF("    ep_type: %d\n", hc->ep_type);
++		DWC_PRINTF("    max_packet: %d\n", hc->max_packet);
++		DWC_PRINTF("    data_pid_start: %d\n", hc->data_pid_start);
++		DWC_PRINTF("    multi_count: %d\n", hc->multi_count);
++		DWC_PRINTF("    xfer_started: %d\n", hc->xfer_started);
++		DWC_PRINTF("    xfer_buff: %p\n", hc->xfer_buff);
++		DWC_PRINTF("    xfer_len: %d\n", hc->xfer_len);
++		DWC_PRINTF("    xfer_count: %d\n", hc->xfer_count);
++		DWC_PRINTF("    halt_on_queue: %d\n", hc->halt_on_queue);
++		DWC_PRINTF("    halt_pending: %d\n", hc->halt_pending);
++		DWC_PRINTF("    halt_status: %d\n", hc->halt_status);
++		DWC_PRINTF("    do_split: %d\n", hc->do_split);
++		DWC_PRINTF("    complete_split: %d\n", hc->complete_split);
++		DWC_PRINTF("    hub_addr: %d\n", hc->hub_addr);
++		DWC_PRINTF("    port_addr: %d\n", hc->port_addr);
++		DWC_PRINTF("    xact_pos: %d\n", hc->xact_pos);
++		DWC_PRINTF("    requests: %d\n", hc->requests);
++		DWC_PRINTF("    qh: %p\n", hc->qh);
++		if (hc->xfer_started) {
++			hfnum_data_t hfnum;
++			hcchar_data_t hcchar;
++			hctsiz_data_t hctsiz;
++			hcint_data_t hcint;
++			hcintmsk_data_t hcintmsk;
++			hfnum.d32 =
++			    DWC_READ_REG32(&hcd->core_if->
++					   host_if->host_global_regs->hfnum);
++			hcchar.d32 =
++			    DWC_READ_REG32(&hcd->core_if->host_if->
++					   hc_regs[i]->hcchar);
++			hctsiz.d32 =
++			    DWC_READ_REG32(&hcd->core_if->host_if->
++					   hc_regs[i]->hctsiz);
++			hcint.d32 =
++			    DWC_READ_REG32(&hcd->core_if->host_if->
++					   hc_regs[i]->hcint);
++			hcintmsk.d32 =
++			    DWC_READ_REG32(&hcd->core_if->host_if->
++					   hc_regs[i]->hcintmsk);
++			DWC_PRINTF("    hfnum: 0x%08x\n", hfnum.d32);
++			DWC_PRINTF("    hcchar: 0x%08x\n", hcchar.d32);
++			DWC_PRINTF("    hctsiz: 0x%08x\n", hctsiz.d32);
++			DWC_PRINTF("    hcint: 0x%08x\n", hcint.d32);
++			DWC_PRINTF("    hcintmsk: 0x%08x\n", hcintmsk.d32);
++		}
++		if (hc->xfer_started && hc->qh) {
++			dwc_otg_qtd_t *qtd;
++			dwc_otg_hcd_urb_t *urb;
++
++			DWC_CIRCLEQ_FOREACH(qtd, &hc->qh->qtd_list, qtd_list_entry) {
++				if (!qtd->in_process)
++					break;
++
++				urb = qtd->urb;
++			DWC_PRINTF("    URB Info:\n");
++			DWC_PRINTF("      qtd: %p, urb: %p\n", qtd, urb);
++			if (urb) {
++				DWC_PRINTF("      Dev: %d, EP: %d %s\n",
++					   dwc_otg_hcd_get_dev_addr(&urb->
++								    pipe_info),
++					   dwc_otg_hcd_get_ep_num(&urb->
++								  pipe_info),
++					   dwc_otg_hcd_is_pipe_in(&urb->
++								  pipe_info) ?
++					   "IN" : "OUT");
++				DWC_PRINTF("      Max packet size: %d\n",
++					   dwc_otg_hcd_get_mps(&urb->
++							       pipe_info));
++				DWC_PRINTF("      transfer_buffer: %p\n",
++					   urb->buf);
++				DWC_PRINTF("      transfer_dma: %p\n",
++					   (void *)urb->dma);
++				DWC_PRINTF("      transfer_buffer_length: %d\n",
++					   urb->length);
++					DWC_PRINTF("      actual_length: %d\n",
++						   urb->actual_length);
++				}
++			}
++		}
++	}
++	DWC_PRINTF("  non_periodic_channels: %d\n", hcd->non_periodic_channels);
++	DWC_PRINTF("  periodic_channels: %d\n", hcd->periodic_channels);
++	DWC_PRINTF("  periodic_usecs: %d\n", hcd->periodic_usecs);
++	np_tx_status.d32 =
++	    DWC_READ_REG32(&hcd->core_if->core_global_regs->gnptxsts);
++	DWC_PRINTF("  NP Tx Req Queue Space Avail: %d\n",
++		   np_tx_status.b.nptxqspcavail);
++	DWC_PRINTF("  NP Tx FIFO Space Avail: %d\n",
++		   np_tx_status.b.nptxfspcavail);
++	p_tx_status.d32 =
++	    DWC_READ_REG32(&hcd->core_if->host_if->host_global_regs->hptxsts);
++	DWC_PRINTF("  P Tx Req Queue Space Avail: %d\n",
++		   p_tx_status.b.ptxqspcavail);
++	DWC_PRINTF("  P Tx FIFO Space Avail: %d\n", p_tx_status.b.ptxfspcavail);
++	dwc_otg_hcd_dump_frrem(hcd);
++	dwc_otg_dump_global_registers(hcd->core_if);
++	dwc_otg_dump_host_registers(hcd->core_if);
++	DWC_PRINTF
++	    ("************************************************************\n");
++	DWC_PRINTF("\n");
++#endif
++}
++
++#ifdef DEBUG
++void dwc_print_setup_data(uint8_t * setup)
++{
++	int i;
++	if (CHK_DEBUG_LEVEL(DBG_HCD)) {
++		DWC_PRINTF("Setup Data = MSB ");
++		for (i = 7; i >= 0; i--)
++			DWC_PRINTF("%02x ", setup[i]);
++		DWC_PRINTF("\n");
++		DWC_PRINTF("  bmRequestType Tranfer = %s\n",
++			   (setup[0] & 0x80) ? "Device-to-Host" :
++			   "Host-to-Device");
++		DWC_PRINTF("  bmRequestType Type = ");
++		switch ((setup[0] & 0x60) >> 5) {
++		case 0:
++			DWC_PRINTF("Standard\n");
++			break;
++		case 1:
++			DWC_PRINTF("Class\n");
++			break;
++		case 2:
++			DWC_PRINTF("Vendor\n");
++			break;
++		case 3:
++			DWC_PRINTF("Reserved\n");
++			break;
++		}
++		DWC_PRINTF("  bmRequestType Recipient = ");
++		switch (setup[0] & 0x1f) {
++		case 0:
++			DWC_PRINTF("Device\n");
++			break;
++		case 1:
++			DWC_PRINTF("Interface\n");
++			break;
++		case 2:
++			DWC_PRINTF("Endpoint\n");
++			break;
++		case 3:
++			DWC_PRINTF("Other\n");
++			break;
++		default:
++			DWC_PRINTF("Reserved\n");
++			break;
++		}
++		DWC_PRINTF("  bRequest = 0x%0x\n", setup[1]);
++		DWC_PRINTF("  wValue = 0x%0x\n", *((uint16_t *) & setup[2]));
++		DWC_PRINTF("  wIndex = 0x%0x\n", *((uint16_t *) & setup[4]));
++		DWC_PRINTF("  wLength = 0x%0x\n\n", *((uint16_t *) & setup[6]));
++	}
++}
++#endif
++
++void dwc_otg_hcd_dump_frrem(dwc_otg_hcd_t * hcd)
++{
++#if 0
++	DWC_PRINTF("Frame remaining at SOF:\n");
++	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
++		   hcd->frrem_samples, hcd->frrem_accum,
++		   (hcd->frrem_samples > 0) ?
++		   hcd->frrem_accum / hcd->frrem_samples : 0);
++
++	DWC_PRINTF("\n");
++	DWC_PRINTF("Frame remaining at start_transfer (uframe 7):\n");
++	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
++		   hcd->core_if->hfnum_7_samples,
++		   hcd->core_if->hfnum_7_frrem_accum,
++		   (hcd->core_if->hfnum_7_samples >
++		    0) ? hcd->core_if->hfnum_7_frrem_accum /
++		   hcd->core_if->hfnum_7_samples : 0);
++	DWC_PRINTF("Frame remaining at start_transfer (uframe 0):\n");
++	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
++		   hcd->core_if->hfnum_0_samples,
++		   hcd->core_if->hfnum_0_frrem_accum,
++		   (hcd->core_if->hfnum_0_samples >
++		    0) ? hcd->core_if->hfnum_0_frrem_accum /
++		   hcd->core_if->hfnum_0_samples : 0);
++	DWC_PRINTF("Frame remaining at start_transfer (uframe 1-6):\n");
++	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
++		   hcd->core_if->hfnum_other_samples,
++		   hcd->core_if->hfnum_other_frrem_accum,
++		   (hcd->core_if->hfnum_other_samples >
++		    0) ? hcd->core_if->hfnum_other_frrem_accum /
++		   hcd->core_if->hfnum_other_samples : 0);
++
++	DWC_PRINTF("\n");
++	DWC_PRINTF("Frame remaining at sample point A (uframe 7):\n");
++	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
++		   hcd->hfnum_7_samples_a, hcd->hfnum_7_frrem_accum_a,
++		   (hcd->hfnum_7_samples_a > 0) ?
++		   hcd->hfnum_7_frrem_accum_a / hcd->hfnum_7_samples_a : 0);
++	DWC_PRINTF("Frame remaining at sample point A (uframe 0):\n");
++	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
++		   hcd->hfnum_0_samples_a, hcd->hfnum_0_frrem_accum_a,
++		   (hcd->hfnum_0_samples_a > 0) ?
++		   hcd->hfnum_0_frrem_accum_a / hcd->hfnum_0_samples_a : 0);
++	DWC_PRINTF("Frame remaining at sample point A (uframe 1-6):\n");
++	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
++		   hcd->hfnum_other_samples_a, hcd->hfnum_other_frrem_accum_a,
++		   (hcd->hfnum_other_samples_a > 0) ?
++		   hcd->hfnum_other_frrem_accum_a /
++		   hcd->hfnum_other_samples_a : 0);
++
++	DWC_PRINTF("\n");
++	DWC_PRINTF("Frame remaining at sample point B (uframe 7):\n");
++	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
++		   hcd->hfnum_7_samples_b, hcd->hfnum_7_frrem_accum_b,
++		   (hcd->hfnum_7_samples_b > 0) ?
++		   hcd->hfnum_7_frrem_accum_b / hcd->hfnum_7_samples_b : 0);
++	DWC_PRINTF("Frame remaining at sample point B (uframe 0):\n");
++	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
++		   hcd->hfnum_0_samples_b, hcd->hfnum_0_frrem_accum_b,
++		   (hcd->hfnum_0_samples_b > 0) ?
++		   hcd->hfnum_0_frrem_accum_b / hcd->hfnum_0_samples_b : 0);
++	DWC_PRINTF("Frame remaining at sample point B (uframe 1-6):\n");
++	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
++		   hcd->hfnum_other_samples_b, hcd->hfnum_other_frrem_accum_b,
++		   (hcd->hfnum_other_samples_b > 0) ?
++		   hcd->hfnum_other_frrem_accum_b /
++		   hcd->hfnum_other_samples_b : 0);
++#endif
++}
++
++#endif /* DWC_DEVICE_ONLY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd.h
+@@ -0,0 +1,870 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd.h $
++ * $Revision: #58 $
++ * $Date: 2011/09/15 $
++ * $Change: 1846647 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++#ifndef DWC_DEVICE_ONLY
++#ifndef __DWC_HCD_H__
++#define __DWC_HCD_H__
++
++#include "dwc_otg_os_dep.h"
++#include "usb.h"
++#include "dwc_otg_hcd_if.h"
++#include "dwc_otg_core_if.h"
++#include "dwc_list.h"
++#include "dwc_otg_cil.h"
++#include "dwc_otg_fiq_fsm.h"
++#include "dwc_otg_driver.h"
++
++
++/**
++ * @file
++ *
++ * This file contains the structures, constants, and interfaces for
++ * the Host Contoller Driver (HCD).
++ *
++ * The Host Controller Driver (HCD) is responsible for translating requests
++ * from the USB Driver into the appropriate actions on the DWC_otg controller.
++ * It isolates the USBD from the specifics of the controller by providing an
++ * API to the USBD.
++ */
++
++struct dwc_otg_hcd_pipe_info {
++	uint8_t dev_addr;
++	uint8_t ep_num;
++	uint8_t pipe_type;
++	uint8_t pipe_dir;
++	uint16_t mps;
++};
++
++struct dwc_otg_hcd_iso_packet_desc {
++	uint32_t offset;
++	uint32_t length;
++	uint32_t actual_length;
++	uint32_t status;
++};
++
++struct dwc_otg_qtd;
++
++struct dwc_otg_hcd_urb {
++	void *priv;
++	struct dwc_otg_qtd *qtd;
++	void *buf;
++	dwc_dma_t dma;
++	void *setup_packet;
++	dwc_dma_t setup_dma;
++	uint32_t length;
++	uint32_t actual_length;
++	uint32_t status;
++	uint32_t error_count;
++	uint32_t packet_count;
++	uint32_t flags;
++	uint16_t interval;
++	struct dwc_otg_hcd_pipe_info pipe_info;
++	struct dwc_otg_hcd_iso_packet_desc iso_descs[];
++};
++
++static inline uint8_t dwc_otg_hcd_get_ep_num(struct dwc_otg_hcd_pipe_info *pipe)
++{
++	return pipe->ep_num;
++}
++
++static inline uint8_t dwc_otg_hcd_get_pipe_type(struct dwc_otg_hcd_pipe_info
++						*pipe)
++{
++	return pipe->pipe_type;
++}
++
++static inline uint16_t dwc_otg_hcd_get_mps(struct dwc_otg_hcd_pipe_info *pipe)
++{
++	return pipe->mps;
++}
++
++static inline uint8_t dwc_otg_hcd_get_dev_addr(struct dwc_otg_hcd_pipe_info
++					       *pipe)
++{
++	return pipe->dev_addr;
++}
++
++static inline uint8_t dwc_otg_hcd_is_pipe_isoc(struct dwc_otg_hcd_pipe_info
++					       *pipe)
++{
++	return (pipe->pipe_type == UE_ISOCHRONOUS);
++}
++
++static inline uint8_t dwc_otg_hcd_is_pipe_int(struct dwc_otg_hcd_pipe_info
++					      *pipe)
++{
++	return (pipe->pipe_type == UE_INTERRUPT);
++}
++
++static inline uint8_t dwc_otg_hcd_is_pipe_bulk(struct dwc_otg_hcd_pipe_info
++					       *pipe)
++{
++	return (pipe->pipe_type == UE_BULK);
++}
++
++static inline uint8_t dwc_otg_hcd_is_pipe_control(struct dwc_otg_hcd_pipe_info
++						  *pipe)
++{
++	return (pipe->pipe_type == UE_CONTROL);
++}
++
++static inline uint8_t dwc_otg_hcd_is_pipe_in(struct dwc_otg_hcd_pipe_info *pipe)
++{
++	return (pipe->pipe_dir == UE_DIR_IN);
++}
++
++static inline uint8_t dwc_otg_hcd_is_pipe_out(struct dwc_otg_hcd_pipe_info
++					      *pipe)
++{
++	return (!dwc_otg_hcd_is_pipe_in(pipe));
++}
++
++static inline void dwc_otg_hcd_fill_pipe(struct dwc_otg_hcd_pipe_info *pipe,
++					 uint8_t devaddr, uint8_t ep_num,
++					 uint8_t pipe_type, uint8_t pipe_dir,
++					 uint16_t mps)
++{
++	pipe->dev_addr = devaddr;
++	pipe->ep_num = ep_num;
++	pipe->pipe_type = pipe_type;
++	pipe->pipe_dir = pipe_dir;
++	pipe->mps = mps;
++}
++
++/**
++ * Phases for control transfers.
++ */
++typedef enum dwc_otg_control_phase {
++	DWC_OTG_CONTROL_SETUP,
++	DWC_OTG_CONTROL_DATA,
++	DWC_OTG_CONTROL_STATUS
++} dwc_otg_control_phase_e;
++
++/** Transaction types. */
++typedef enum dwc_otg_transaction_type {
++	DWC_OTG_TRANSACTION_NONE          = 0,
++	DWC_OTG_TRANSACTION_PERIODIC      = 1,
++	DWC_OTG_TRANSACTION_NON_PERIODIC  = 2,
++	DWC_OTG_TRANSACTION_ALL           = DWC_OTG_TRANSACTION_PERIODIC + DWC_OTG_TRANSACTION_NON_PERIODIC
++} dwc_otg_transaction_type_e;
++
++struct dwc_otg_qh;
++
++/**
++ * A Queue Transfer Descriptor (QTD) holds the state of a bulk, control,
++ * interrupt, or isochronous transfer. A single QTD is created for each URB
++ * (of one of these types) submitted to the HCD. The transfer associated with
++ * a QTD may require one or multiple transactions.
++ *
++ * A QTD is linked to a Queue Head, which is entered in either the
++ * non-periodic or periodic schedule for execution. When a QTD is chosen for
++ * execution, some or all of its transactions may be executed. After
++ * execution, the state of the QTD is updated. The QTD may be retired if all
++ * its transactions are complete or if an error occurred. Otherwise, it
++ * remains in the schedule so more transactions can be executed later.
++ */
++typedef struct dwc_otg_qtd {
++	/**
++	 * Determines the PID of the next data packet for the data phase of
++	 * control transfers. Ignored for other transfer types.<br>
++	 * One of the following values:
++	 *	- DWC_OTG_HC_PID_DATA0
++	 *	- DWC_OTG_HC_PID_DATA1
++	 */
++	uint8_t data_toggle;
++
++	/** Current phase for control transfers (Setup, Data, or Status). */
++	dwc_otg_control_phase_e control_phase;
++
++	/** Keep track of the current split type
++	 * for FS/LS endpoints on a HS Hub */
++	uint8_t complete_split;
++
++	/** How many bytes transferred during SSPLIT OUT */
++	uint32_t ssplit_out_xfer_count;
++
++	/**
++	 * Holds the number of bus errors that have occurred for a transaction
++	 * within this transfer.
++	 */
++	uint8_t error_count;
++
++	/**
++	 * Index of the next frame descriptor for an isochronous transfer. A
++	 * frame descriptor describes the buffer position and length of the
++	 * data to be transferred in the next scheduled (micro)frame of an
++	 * isochronous transfer. It also holds status for that transaction.
++	 * The frame index starts at 0.
++	 */
++	uint16_t isoc_frame_index;
++
++	/** Position of the ISOC split on full/low speed */
++	uint8_t isoc_split_pos;
++
++	/** Position of the ISOC split in the buffer for the current frame */
++	uint16_t isoc_split_offset;
++
++	/** URB for this transfer */
++	struct dwc_otg_hcd_urb *urb;
++
++	struct dwc_otg_qh *qh;
++
++	/** This list of QTDs */
++	 DWC_CIRCLEQ_ENTRY(dwc_otg_qtd) qtd_list_entry;
++
++	/** Indicates if this QTD is currently processed by HW. */
++	uint8_t in_process;
++
++	/** Number of DMA descriptors for this QTD */
++	uint8_t n_desc;
++
++	/**
++	 * Last activated frame(packet) index.
++	 * Used in Descriptor DMA mode only.
++	 */
++	uint16_t isoc_frame_index_last;
++
++} dwc_otg_qtd_t;
++
++DWC_CIRCLEQ_HEAD(dwc_otg_qtd_list, dwc_otg_qtd);
++
++/**
++ * A Queue Head (QH) holds the static characteristics of an endpoint and
++ * maintains a list of transfers (QTDs) for that endpoint. A QH structure may
++ * be entered in either the non-periodic or periodic schedule.
++ */
++typedef struct dwc_otg_qh {
++	/**
++	 * Endpoint type.
++	 * One of the following values:
++	 *	- UE_CONTROL
++	 *	- UE_BULK
++	 *	- UE_INTERRUPT
++	 *	- UE_ISOCHRONOUS
++	 */
++	uint8_t ep_type;
++	uint8_t ep_is_in;
++
++	/** wMaxPacketSize Field of Endpoint Descriptor. */
++	uint16_t maxp;
++
++	/**
++	 * Device speed.
++	 * One of the following values:
++	 *	- DWC_OTG_EP_SPEED_LOW
++	 *	- DWC_OTG_EP_SPEED_FULL
++	 *	- DWC_OTG_EP_SPEED_HIGH
++	 */
++	uint8_t dev_speed;
++
++	/**
++	 * Determines the PID of the next data packet for non-control
++	 * transfers. Ignored for control transfers.<br>
++	 * One of the following values:
++	 *	- DWC_OTG_HC_PID_DATA0
++	 *	- DWC_OTG_HC_PID_DATA1
++	 */
++	uint8_t data_toggle;
++
++	/** Ping state if 1. */
++	uint8_t ping_state;
++
++	/**
++	 * List of QTDs for this QH.
++	 */
++	struct dwc_otg_qtd_list qtd_list;
++
++	/** Host channel currently processing transfers for this QH. */
++	struct dwc_hc *channel;
++
++	/** Full/low speed endpoint on high-speed hub requires split. */
++	uint8_t do_split;
++
++	/** @name Periodic schedule information */
++	/** @{ */
++
++	/** Bandwidth in microseconds per (micro)frame. */
++	uint16_t usecs;
++
++	/** Interval between transfers in (micro)frames. */
++	uint16_t interval;
++
++	/**
++	 * (micro)frame to initialize a periodic transfer. The transfer
++	 * executes in the following (micro)frame.
++	 */
++	uint16_t sched_frame;
++
++	/*
++	** Frame a NAK was received on this queue head, used to minimise NAK retransmission
++	*/
++	uint16_t nak_frame;
++
++	/** (micro)frame at which last start split was initialized. */
++	uint16_t start_split_frame;
++
++	/** @} */
++
++	/**
++	 * Used instead of original buffer if
++	 * it(physical address) is not dword-aligned.
++	 */
++	uint8_t *dw_align_buf;
++	dwc_dma_t dw_align_buf_dma;
++
++	/** Entry for QH in either the periodic or non-periodic schedule. */
++	dwc_list_link_t qh_list_entry;
++
++	/** @name Descriptor DMA support */
++	/** @{ */
++
++	/** Descriptor List. */
++	dwc_otg_host_dma_desc_t *desc_list;
++
++	/** Descriptor List physical address. */
++	dwc_dma_t desc_list_dma;
++
++	/**
++	 * Xfer Bytes array.
++	 * Each element corresponds to a descriptor and indicates
++	 * original XferSize size value for the descriptor.
++	 */
++	uint32_t *n_bytes;
++
++	/** Actual number of transfer descriptors in a list. */
++	uint16_t ntd;
++
++	/** First activated isochronous transfer descriptor index. */
++	uint8_t td_first;
++	/** Last activated isochronous transfer descriptor index. */
++	uint8_t td_last;
++
++	/** @} */
++
++
++	uint16_t speed;
++	uint16_t frame_usecs[8];
++
++	uint32_t skip_count;
++} dwc_otg_qh_t;
++
++DWC_CIRCLEQ_HEAD(hc_list, dwc_hc);
++
++typedef struct urb_tq_entry {
++	struct urb *urb;
++	DWC_TAILQ_ENTRY(urb_tq_entry) urb_tq_entries;
++} urb_tq_entry_t;
++
++DWC_TAILQ_HEAD(urb_list, urb_tq_entry);
++
++/**
++ * This structure holds the state of the HCD, including the non-periodic and
++ * periodic schedules.
++ */
++struct dwc_otg_hcd {
++	/** The DWC otg device pointer */
++	struct dwc_otg_device *otg_dev;
++	/** DWC OTG Core Interface Layer */
++	dwc_otg_core_if_t *core_if;
++
++	/** Function HCD driver callbacks */
++	struct dwc_otg_hcd_function_ops *fops;
++
++	/** Internal DWC HCD Flags */
++	volatile union dwc_otg_hcd_internal_flags {
++		uint32_t d32;
++		struct {
++			unsigned port_connect_status_change:1;
++			unsigned port_connect_status:1;
++			unsigned port_reset_change:1;
++			unsigned port_enable_change:1;
++			unsigned port_suspend_change:1;
++			unsigned port_over_current_change:1;
++			unsigned port_l1_change:1;
++			unsigned port_speed:2;
++			unsigned reserved:24;
++		} b;
++	} flags;
++
++	/**
++	 * Inactive items in the non-periodic schedule. This is a list of
++	 * Queue Heads. Transfers associated with these Queue Heads are not
++	 * currently assigned to a host channel.
++	 */
++	dwc_list_link_t non_periodic_sched_inactive;
++
++	/**
++	 * Active items in the non-periodic schedule. This is a list of
++	 * Queue Heads. Transfers associated with these Queue Heads are
++	 * currently assigned to a host channel.
++	 */
++	dwc_list_link_t non_periodic_sched_active;
++
++	/**
++	 * Pointer to the next Queue Head to process in the active
++	 * non-periodic schedule.
++	 */
++	dwc_list_link_t *non_periodic_qh_ptr;
++
++	/**
++	 * Inactive items in the periodic schedule. This is a list of QHs for
++	 * periodic transfers that are _not_ scheduled for the next frame.
++	 * Each QH in the list has an interval counter that determines when it
++	 * needs to be scheduled for execution. This scheduling mechanism
++	 * allows only a simple calculation for periodic bandwidth used (i.e.
++	 * must assume that all periodic transfers may need to execute in the
++	 * same frame). However, it greatly simplifies scheduling and should
++	 * be sufficient for the vast majority of OTG hosts, which need to
++	 * connect to a small number of peripherals at one time.
++	 *
++	 * Items move from this list to periodic_sched_ready when the QH
++	 * interval counter is 0 at SOF.
++	 */
++	dwc_list_link_t periodic_sched_inactive;
++
++	/**
++	 * List of periodic QHs that are ready for execution in the next
++	 * frame, but have not yet been assigned to host channels.
++	 *
++	 * Items move from this list to periodic_sched_assigned as host
++	 * channels become available during the current frame.
++	 */
++	dwc_list_link_t periodic_sched_ready;
++
++	/**
++	 * List of periodic QHs to be executed in the next frame that are
++	 * assigned to host channels.
++	 *
++	 * Items move from this list to periodic_sched_queued as the
++	 * transactions for the QH are queued to the DWC_otg controller.
++	 */
++	dwc_list_link_t periodic_sched_assigned;
++
++	/**
++	 * List of periodic QHs that have been queued for execution.
++	 *
++	 * Items move from this list to either periodic_sched_inactive or
++	 * periodic_sched_ready when the channel associated with the transfer
++	 * is released. If the interval for the QH is 1, the item moves to
++	 * periodic_sched_ready because it must be rescheduled for the next
++	 * frame. Otherwise, the item moves to periodic_sched_inactive.
++	 */
++	dwc_list_link_t periodic_sched_queued;
++
++	/**
++	 * Total bandwidth claimed so far for periodic transfers. This value
++	 * is in microseconds per (micro)frame. The assumption is that all
++	 * periodic transfers may occur in the same (micro)frame.
++	 */
++	uint16_t periodic_usecs;
++
++	/**
++	 * Total bandwidth claimed so far for all periodic transfers
++	 * in a frame.
++	 * This will include a mixture of HS and FS transfers.
++	 * Units are microseconds per (micro)frame.
++	 * We have a budget per frame and have to schedule
++	 * transactions accordingly.
++	 * Watch out for the fact that things are actually scheduled for the
++	 * "next frame".
++	 */
++	uint16_t                frame_usecs[8];
++
++
++	/**
++	 * Frame number read from the core at SOF. The value ranges from 0 to
++	 * DWC_HFNUM_MAX_FRNUM.
++	 */
++	uint16_t frame_number;
++
++	/**
++	 * Count of periodic QHs, if using several eps. For SOF enable/disable.
++	 */
++	uint16_t periodic_qh_count;
++
++	/**
++	 * Free host channels in the controller. This is a list of
++	 * dwc_hc_t items.
++	 */
++	struct hc_list free_hc_list;
++	/**
++	 * Number of host channels assigned to periodic transfers. Currently
++	 * assuming that there is a dedicated host channel for each periodic
++	 * transaction and at least one host channel available for
++	 * non-periodic transactions.
++	 */
++	int periodic_channels; /* microframe_schedule==0 */
++
++	/**
++	 * Number of host channels assigned to non-periodic transfers.
++	 */
++	int non_periodic_channels; /* microframe_schedule==0 */
++
++	/**
++	 * Number of host channels assigned to non-periodic transfers.
++	 */
++	int available_host_channels;
++
++	/**
++	 * Array of pointers to the host channel descriptors. Allows accessing
++	 * a host channel descriptor given the host channel number. This is
++	 * useful in interrupt handlers.
++	 */
++	struct dwc_hc *hc_ptr_array[MAX_EPS_CHANNELS];
++
++	/**
++	 * Buffer to use for any data received during the status phase of a
++	 * control transfer. Normally no data is transferred during the status
++	 * phase. This buffer is used as a bit bucket.
++	 */
++	uint8_t *status_buf;
++
++	/**
++	 * DMA address for status_buf.
++	 */
++	dma_addr_t status_buf_dma;
++#define DWC_OTG_HCD_STATUS_BUF_SIZE 64
++
++	/**
++	 * Connection timer. An OTG host must display a message if the device
++	 * does not connect. Started when the VBus power is turned on via
++	 * sysfs attribute "buspower".
++	 */
++	dwc_timer_t *conn_timer;
++
++	/* Tasket to do a reset */
++	dwc_tasklet_t *reset_tasklet;
++
++	dwc_tasklet_t *completion_tasklet;
++	struct urb_list completed_urb_list;
++
++	/*  */
++	dwc_spinlock_t *lock;
++	/**
++	 * Private data that could be used by OS wrapper.
++	 */
++	void *priv;
++
++	uint8_t otg_port;
++
++	/** Frame List */
++	uint32_t *frame_list;
++
++	/** Hub - Port assignment */
++	int hub_port[128];
++#ifdef FIQ_DEBUG
++	int hub_port_alloc[2048];
++#endif
++
++	/** Frame List DMA address */
++	dma_addr_t frame_list_dma;
++
++	struct fiq_stack *fiq_stack;
++	struct fiq_state *fiq_state;
++
++	/** Virtual address for split transaction DMA bounce buffers */
++	struct fiq_dma_channel *fiq_dmab;
++
++#ifdef DEBUG
++	uint32_t frrem_samples;
++	uint64_t frrem_accum;
++
++	uint32_t hfnum_7_samples_a;
++	uint64_t hfnum_7_frrem_accum_a;
++	uint32_t hfnum_0_samples_a;
++	uint64_t hfnum_0_frrem_accum_a;
++	uint32_t hfnum_other_samples_a;
++	uint64_t hfnum_other_frrem_accum_a;
++
++	uint32_t hfnum_7_samples_b;
++	uint64_t hfnum_7_frrem_accum_b;
++	uint32_t hfnum_0_samples_b;
++	uint64_t hfnum_0_frrem_accum_b;
++	uint32_t hfnum_other_samples_b;
++	uint64_t hfnum_other_frrem_accum_b;
++#endif
++};
++
++static inline struct device *dwc_otg_hcd_to_dev(struct dwc_otg_hcd *hcd)
++{
++	return &hcd->otg_dev->os_dep.platformdev->dev;
++}
++
++/** @name Transaction Execution Functions */
++/** @{ */
++extern dwc_otg_transaction_type_e dwc_otg_hcd_select_transactions(dwc_otg_hcd_t
++								  * hcd);
++extern void dwc_otg_hcd_queue_transactions(dwc_otg_hcd_t * hcd,
++					   dwc_otg_transaction_type_e tr_type);
++
++int dwc_otg_hcd_allocate_port(dwc_otg_hcd_t * hcd, dwc_otg_qh_t *qh);
++void dwc_otg_hcd_release_port(dwc_otg_hcd_t * dwc_otg_hcd, dwc_otg_qh_t *qh);
++
++extern int fiq_fsm_queue_transaction(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh);
++extern int fiq_fsm_transaction_suitable(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh);
++extern void dwc_otg_cleanup_fiq_channel(dwc_otg_hcd_t *hcd, uint32_t num);
++
++/** @} */
++
++/** @name Interrupt Handler Functions */
++/** @{ */
++extern int32_t dwc_otg_hcd_handle_intr(dwc_otg_hcd_t * dwc_otg_hcd);
++extern int32_t dwc_otg_hcd_handle_sof_intr(dwc_otg_hcd_t * dwc_otg_hcd);
++extern int32_t dwc_otg_hcd_handle_rx_status_q_level_intr(dwc_otg_hcd_t *
++							 dwc_otg_hcd);
++extern int32_t dwc_otg_hcd_handle_np_tx_fifo_empty_intr(dwc_otg_hcd_t *
++							dwc_otg_hcd);
++extern int32_t dwc_otg_hcd_handle_perio_tx_fifo_empty_intr(dwc_otg_hcd_t *
++							   dwc_otg_hcd);
++extern int32_t dwc_otg_hcd_handle_incomplete_periodic_intr(dwc_otg_hcd_t *
++							   dwc_otg_hcd);
++extern int32_t dwc_otg_hcd_handle_port_intr(dwc_otg_hcd_t * dwc_otg_hcd);
++extern int32_t dwc_otg_hcd_handle_conn_id_status_change_intr(dwc_otg_hcd_t *
++							     dwc_otg_hcd);
++extern int32_t dwc_otg_hcd_handle_disconnect_intr(dwc_otg_hcd_t * dwc_otg_hcd);
++extern int32_t dwc_otg_hcd_handle_hc_intr(dwc_otg_hcd_t * dwc_otg_hcd);
++extern int32_t dwc_otg_hcd_handle_hc_n_intr(dwc_otg_hcd_t * dwc_otg_hcd,
++					    uint32_t num);
++extern int32_t dwc_otg_hcd_handle_session_req_intr(dwc_otg_hcd_t * dwc_otg_hcd);
++extern int32_t dwc_otg_hcd_handle_wakeup_detected_intr(dwc_otg_hcd_t *
++						       dwc_otg_hcd);
++/** @} */
++
++/** @name Schedule Queue Functions */
++/** @{ */
++
++/* Implemented in dwc_otg_hcd_queue.c */
++extern dwc_otg_qh_t *dwc_otg_hcd_qh_create(dwc_otg_hcd_t * hcd,
++					   dwc_otg_hcd_urb_t * urb, int atomic_alloc);
++extern void dwc_otg_hcd_qh_free(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh);
++extern int dwc_otg_hcd_qh_add(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh);
++extern void dwc_otg_hcd_qh_remove(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh);
++extern void dwc_otg_hcd_qh_deactivate(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh,
++				      int sched_csplit);
++
++/** Remove and free a QH */
++static inline void dwc_otg_hcd_qh_remove_and_free(dwc_otg_hcd_t * hcd,
++						  dwc_otg_qh_t * qh)
++{
++	dwc_irqflags_t flags;
++	DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
++	dwc_otg_hcd_qh_remove(hcd, qh);
++	DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
++	dwc_otg_hcd_qh_free(hcd, qh);
++}
++
++/** Allocates memory for a QH structure.
++ * @return Returns the memory allocate or NULL on error. */
++static inline dwc_otg_qh_t *dwc_otg_hcd_qh_alloc(int atomic_alloc)
++{
++	if (atomic_alloc)
++		return (dwc_otg_qh_t *) DWC_ALLOC_ATOMIC(sizeof(dwc_otg_qh_t));
++	else
++		return (dwc_otg_qh_t *) DWC_ALLOC(sizeof(dwc_otg_qh_t));
++}
++
++extern dwc_otg_qtd_t *dwc_otg_hcd_qtd_create(dwc_otg_hcd_urb_t * urb,
++					     int atomic_alloc);
++extern void dwc_otg_hcd_qtd_init(dwc_otg_qtd_t * qtd, dwc_otg_hcd_urb_t * urb);
++extern int dwc_otg_hcd_qtd_add(dwc_otg_qtd_t * qtd, dwc_otg_hcd_t * dwc_otg_hcd,
++			       dwc_otg_qh_t ** qh, int atomic_alloc);
++
++/** Allocates memory for a QTD structure.
++ * @return Returns the memory allocate or NULL on error. */
++static inline dwc_otg_qtd_t *dwc_otg_hcd_qtd_alloc(int atomic_alloc)
++{
++	if (atomic_alloc)
++		return (dwc_otg_qtd_t *) DWC_ALLOC_ATOMIC(sizeof(dwc_otg_qtd_t));
++	else
++		return (dwc_otg_qtd_t *) DWC_ALLOC(sizeof(dwc_otg_qtd_t));
++}
++
++/** Frees the memory for a QTD structure.  QTD should already be removed from
++ * list.
++ * @param qtd QTD to free.*/
++static inline void dwc_otg_hcd_qtd_free(dwc_otg_qtd_t * qtd)
++{
++	DWC_FREE(qtd);
++}
++
++/** Removes a QTD from list.
++ * @param hcd HCD instance.
++ * @param qtd QTD to remove from list.
++ * @param qh QTD belongs to.
++ */
++static inline void dwc_otg_hcd_qtd_remove(dwc_otg_hcd_t * hcd,
++					  dwc_otg_qtd_t * qtd,
++					  dwc_otg_qh_t * qh)
++{
++	DWC_CIRCLEQ_REMOVE(&qh->qtd_list, qtd, qtd_list_entry);
++}
++
++/** Remove and free a QTD
++  * Need to disable IRQ and hold hcd lock while calling this function out of
++  * interrupt servicing chain */
++static inline void dwc_otg_hcd_qtd_remove_and_free(dwc_otg_hcd_t * hcd,
++						   dwc_otg_qtd_t * qtd,
++						   dwc_otg_qh_t * qh)
++{
++	dwc_otg_hcd_qtd_remove(hcd, qtd, qh);
++	dwc_otg_hcd_qtd_free(qtd);
++}
++
++/** @} */
++
++/** @name Descriptor DMA Supporting Functions */
++/** @{ */
++
++extern void dwc_otg_hcd_start_xfer_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh);
++extern void dwc_otg_hcd_complete_xfer_ddma(dwc_otg_hcd_t * hcd,
++					   dwc_hc_t * hc,
++					   dwc_otg_hc_regs_t * hc_regs,
++					   dwc_otg_halt_status_e halt_status);
++
++extern int dwc_otg_hcd_qh_init_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh);
++extern void dwc_otg_hcd_qh_free_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh);
++
++/** @} */
++
++/** @name Internal Functions */
++/** @{ */
++dwc_otg_qh_t *dwc_urb_to_qh(dwc_otg_hcd_urb_t * urb);
++/** @} */
++
++#ifdef CONFIG_USB_DWC_OTG_LPM
++extern int dwc_otg_hcd_get_hc_for_lpm_tran(dwc_otg_hcd_t * hcd,
++					   uint8_t devaddr);
++extern void dwc_otg_hcd_free_hc_from_lpm(dwc_otg_hcd_t * hcd);
++#endif
++
++/** Gets the QH that contains the list_head */
++#define dwc_list_to_qh(_list_head_ptr_) container_of(_list_head_ptr_, dwc_otg_qh_t, qh_list_entry)
++
++/** Gets the QTD that contains the list_head */
++#define dwc_list_to_qtd(_list_head_ptr_) container_of(_list_head_ptr_, dwc_otg_qtd_t, qtd_list_entry)
++
++/** Check if QH is non-periodic  */
++#define dwc_qh_is_non_per(_qh_ptr_) ((_qh_ptr_->ep_type == UE_BULK) || \
++				     (_qh_ptr_->ep_type == UE_CONTROL))
++
++/** High bandwidth multiplier as encoded in highspeed endpoint descriptors */
++#define dwc_hb_mult(wMaxPacketSize) (1 + (((wMaxPacketSize) >> 11) & 0x03))
++
++/** Packet size for any kind of endpoint descriptor */
++#define dwc_max_packet(wMaxPacketSize) ((wMaxPacketSize) & 0x07ff)
++
++/**
++ * Returns true if _frame1 is less than or equal to _frame2. The comparison is
++ * done modulo DWC_HFNUM_MAX_FRNUM. This accounts for the rollover of the
++ * frame number when the max frame number is reached.
++ */
++static inline int dwc_frame_num_le(uint16_t frame1, uint16_t frame2)
++{
++	return ((frame2 - frame1) & DWC_HFNUM_MAX_FRNUM) <=
++	    (DWC_HFNUM_MAX_FRNUM >> 1);
++}
++
++/**
++ * Returns true if _frame1 is greater than _frame2. The comparison is done
++ * modulo DWC_HFNUM_MAX_FRNUM. This accounts for the rollover of the frame
++ * number when the max frame number is reached.
++ */
++static inline int dwc_frame_num_gt(uint16_t frame1, uint16_t frame2)
++{
++	return (frame1 != frame2) &&
++	    (((frame1 - frame2) & DWC_HFNUM_MAX_FRNUM) <
++	     (DWC_HFNUM_MAX_FRNUM >> 1));
++}
++
++/**
++ * Increments _frame by the amount specified by _inc. The addition is done
++ * modulo DWC_HFNUM_MAX_FRNUM. Returns the incremented value.
++ */
++static inline uint16_t dwc_frame_num_inc(uint16_t frame, uint16_t inc)
++{
++	return (frame + inc) & DWC_HFNUM_MAX_FRNUM;
++}
++
++static inline uint16_t dwc_full_frame_num(uint16_t frame)
++{
++	return (frame & DWC_HFNUM_MAX_FRNUM) >> 3;
++}
++
++static inline uint16_t dwc_micro_frame_num(uint16_t frame)
++{
++	return frame & 0x7;
++}
++
++extern void init_hcd_usecs(dwc_otg_hcd_t *_hcd);
++
++void dwc_otg_hcd_save_data_toggle(dwc_hc_t * hc,
++				  dwc_otg_hc_regs_t * hc_regs,
++				  dwc_otg_qtd_t * qtd);
++
++#ifdef DEBUG
++/**
++ * Macro to sample the remaining PHY clocks left in the current frame. This
++ * may be used during debugging to determine the average time it takes to
++ * execute sections of code. There are two possible sample points, "a" and
++ * "b", so the _letter argument must be one of these values.
++ *
++ * To dump the average sample times, read the "hcd_frrem" sysfs attribute. For
++ * example, "cat /sys/devices/lm0/hcd_frrem".
++ */
++#define dwc_sample_frrem(_hcd, _qh, _letter) \
++{ \
++	hfnum_data_t hfnum; \
++	dwc_otg_qtd_t *qtd; \
++	qtd = list_entry(_qh->qtd_list.next, dwc_otg_qtd_t, qtd_list_entry); \
++	if (usb_pipeint(qtd->urb->pipe) && _qh->start_split_frame != 0 && !qtd->complete_split) { \
++		hfnum.d32 = DWC_READ_REG32(&_hcd->core_if->host_if->host_global_regs->hfnum); \
++		switch (hfnum.b.frnum & 0x7) { \
++		case 7: \
++			_hcd->hfnum_7_samples_##_letter++; \
++			_hcd->hfnum_7_frrem_accum_##_letter += hfnum.b.frrem; \
++			break; \
++		case 0: \
++			_hcd->hfnum_0_samples_##_letter++; \
++			_hcd->hfnum_0_frrem_accum_##_letter += hfnum.b.frrem; \
++			break; \
++		default: \
++			_hcd->hfnum_other_samples_##_letter++; \
++			_hcd->hfnum_other_frrem_accum_##_letter += hfnum.b.frrem; \
++			break; \
++		} \
++	} \
++}
++#else
++#define dwc_sample_frrem(_hcd, _qh, _letter)
++#endif
++#endif
++#endif /* DWC_DEVICE_ONLY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_ddma.c
+@@ -0,0 +1,1135 @@
++/*==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd_ddma.c $
++ * $Revision: #10 $
++ * $Date: 2011/10/20 $
++ * $Change: 1869464 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++#ifndef DWC_DEVICE_ONLY
++
++/** @file
++ * This file contains Descriptor DMA support implementation for host mode.
++ */
++
++#include "dwc_otg_hcd.h"
++#include "dwc_otg_regs.h"
++
++extern bool microframe_schedule;
++
++static inline uint8_t frame_list_idx(uint16_t frame)
++{
++	return (frame & (MAX_FRLIST_EN_NUM - 1));
++}
++
++static inline uint16_t desclist_idx_inc(uint16_t idx, uint16_t inc, uint8_t speed)
++{
++	return (idx + inc) &
++	    (((speed ==
++	       DWC_OTG_EP_SPEED_HIGH) ? MAX_DMA_DESC_NUM_HS_ISOC :
++	      MAX_DMA_DESC_NUM_GENERIC) - 1);
++}
++
++static inline uint16_t desclist_idx_dec(uint16_t idx, uint16_t inc, uint8_t speed)
++{
++	return (idx - inc) &
++	    (((speed ==
++	       DWC_OTG_EP_SPEED_HIGH) ? MAX_DMA_DESC_NUM_HS_ISOC :
++	      MAX_DMA_DESC_NUM_GENERIC) - 1);
++}
++
++static inline uint16_t max_desc_num(dwc_otg_qh_t * qh)
++{
++	return (((qh->ep_type == UE_ISOCHRONOUS)
++		 && (qh->dev_speed == DWC_OTG_EP_SPEED_HIGH))
++		? MAX_DMA_DESC_NUM_HS_ISOC : MAX_DMA_DESC_NUM_GENERIC);
++}
++static inline uint16_t frame_incr_val(dwc_otg_qh_t * qh)
++{
++	return ((qh->dev_speed == DWC_OTG_EP_SPEED_HIGH)
++		? ((qh->interval + 8 - 1) / 8)
++		: qh->interval);
++}
++
++static int desc_list_alloc(struct device *dev, dwc_otg_qh_t * qh)
++{
++	int retval = 0;
++
++	qh->desc_list = (dwc_otg_host_dma_desc_t *)
++	    DWC_DMA_ALLOC(dev, sizeof(dwc_otg_host_dma_desc_t) * max_desc_num(qh),
++			  &qh->desc_list_dma);
++
++	if (!qh->desc_list) {
++		retval = -DWC_E_NO_MEMORY;
++		DWC_ERROR("%s: DMA descriptor list allocation failed\n", __func__);
++
++	}
++
++	dwc_memset(qh->desc_list, 0x00,
++		   sizeof(dwc_otg_host_dma_desc_t) * max_desc_num(qh));
++
++	qh->n_bytes =
++	    (uint32_t *) DWC_ALLOC(sizeof(uint32_t) * max_desc_num(qh));
++
++	if (!qh->n_bytes) {
++		retval = -DWC_E_NO_MEMORY;
++		DWC_ERROR
++		    ("%s: Failed to allocate array for descriptors' size actual values\n",
++		     __func__);
++
++	}
++	return retval;
++
++}
++
++static void desc_list_free(struct device *dev, dwc_otg_qh_t * qh)
++{
++	if (qh->desc_list) {
++		DWC_DMA_FREE(dev, max_desc_num(qh), qh->desc_list,
++			     qh->desc_list_dma);
++		qh->desc_list = NULL;
++	}
++
++	if (qh->n_bytes) {
++		DWC_FREE(qh->n_bytes);
++		qh->n_bytes = NULL;
++	}
++}
++
++static int frame_list_alloc(dwc_otg_hcd_t * hcd)
++{
++	struct device *dev = dwc_otg_hcd_to_dev(hcd);
++	int retval = 0;
++
++	if (hcd->frame_list)
++		return 0;
++
++	hcd->frame_list = DWC_DMA_ALLOC(dev, 4 * MAX_FRLIST_EN_NUM,
++					&hcd->frame_list_dma);
++	if (!hcd->frame_list) {
++		retval = -DWC_E_NO_MEMORY;
++		DWC_ERROR("%s: Frame List allocation failed\n", __func__);
++	}
++
++	dwc_memset(hcd->frame_list, 0x00, 4 * MAX_FRLIST_EN_NUM);
++
++	return retval;
++}
++
++static void frame_list_free(dwc_otg_hcd_t * hcd)
++{
++	struct device *dev = dwc_otg_hcd_to_dev(hcd);
++
++	if (!hcd->frame_list)
++		return;
++
++	DWC_DMA_FREE(dev, 4 * MAX_FRLIST_EN_NUM, hcd->frame_list, hcd->frame_list_dma);
++	hcd->frame_list = NULL;
++}
++
++static void per_sched_enable(dwc_otg_hcd_t * hcd, uint16_t fr_list_en)
++{
++
++	hcfg_data_t hcfg;
++
++	hcfg.d32 = DWC_READ_REG32(&hcd->core_if->host_if->host_global_regs->hcfg);
++
++	if (hcfg.b.perschedena) {
++		/* already enabled */
++		return;
++	}
++
++	DWC_WRITE_REG32(&hcd->core_if->host_if->host_global_regs->hflbaddr,
++			hcd->frame_list_dma);
++
++	switch (fr_list_en) {
++	case 64:
++		hcfg.b.frlisten = 3;
++		break;
++	case 32:
++		hcfg.b.frlisten = 2;
++		break;
++	case 16:
++		hcfg.b.frlisten = 1;
++		break;
++	case 8:
++		hcfg.b.frlisten = 0;
++		break;
++	default:
++		break;
++	}
++
++	hcfg.b.perschedena = 1;
++
++	DWC_DEBUGPL(DBG_HCD, "Enabling Periodic schedule\n");
++	DWC_WRITE_REG32(&hcd->core_if->host_if->host_global_regs->hcfg, hcfg.d32);
++
++}
++
++static void per_sched_disable(dwc_otg_hcd_t * hcd)
++{
++	hcfg_data_t hcfg;
++
++	hcfg.d32 = DWC_READ_REG32(&hcd->core_if->host_if->host_global_regs->hcfg);
++
++	if (!hcfg.b.perschedena) {
++		/* already disabled */
++		return;
++	}
++	hcfg.b.perschedena = 0;
++
++	DWC_DEBUGPL(DBG_HCD, "Disabling Periodic schedule\n");
++	DWC_WRITE_REG32(&hcd->core_if->host_if->host_global_regs->hcfg, hcfg.d32);
++}
++
++/*
++ * Activates/Deactivates FrameList entries for the channel
++ * based on endpoint servicing period.
++ */
++static void update_frame_list(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh, uint8_t enable)
++{
++	uint16_t i, j, inc;
++	dwc_hc_t *hc = NULL;
++
++	if (!qh->channel) {
++		DWC_ERROR("qh->channel = %p", qh->channel);
++		return;
++	}
++
++	if (!hcd) {
++		DWC_ERROR("------hcd = %p", hcd);
++		return;
++	}
++
++	if (!hcd->frame_list) {
++		DWC_ERROR("-------hcd->frame_list = %p", hcd->frame_list);
++		return;
++	}
++
++	hc = qh->channel;
++	inc = frame_incr_val(qh);
++	if (qh->ep_type == UE_ISOCHRONOUS)
++		i = frame_list_idx(qh->sched_frame);
++	else
++		i = 0;
++
++	j = i;
++	do {
++		if (enable)
++			hcd->frame_list[j] |= (1 << hc->hc_num);
++		else
++			hcd->frame_list[j] &= ~(1 << hc->hc_num);
++		j = (j + inc) & (MAX_FRLIST_EN_NUM - 1);
++	}
++	while (j != i);
++	if (!enable)
++		return;
++	hc->schinfo = 0;
++	if (qh->channel->speed == DWC_OTG_EP_SPEED_HIGH) {
++		j = 1;
++		/* TODO - check this */
++		inc = (8 + qh->interval - 1) / qh->interval;
++		for (i = 0; i < inc; i++) {
++			hc->schinfo |= j;
++			j = j << qh->interval;
++		}
++	} else {
++		hc->schinfo = 0xff;
++	}
++}
++
++#if 0
++static void dump_frame_list(dwc_otg_hcd_t * hcd)
++{
++	int i = 0;
++	DWC_PRINTF("--FRAME LIST (hex) --\n");
++	for (i = 0; i < MAX_FRLIST_EN_NUM; i++) {
++		DWC_PRINTF("%x\t", hcd->frame_list[i]);
++		if (!(i % 8) && i)
++			DWC_PRINTF("\n");
++	}
++	DWC_PRINTF("\n----\n");
++
++}
++#endif
++
++static void release_channel_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	dwc_hc_t *hc = qh->channel;
++	if (dwc_qh_is_non_per(qh)) {
++		if (!microframe_schedule)
++			hcd->non_periodic_channels--;
++		else
++			hcd->available_host_channels++;
++	} else
++		update_frame_list(hcd, qh, 0);
++
++	/*
++	 * The condition is added to prevent double cleanup try in case of device
++	 * disconnect. See channel cleanup in dwc_otg_hcd_disconnect_cb().
++	 */
++	if (hc->qh) {
++		dwc_otg_hc_cleanup(hcd->core_if, hc);
++		DWC_CIRCLEQ_INSERT_TAIL(&hcd->free_hc_list, hc, hc_list_entry);
++		hc->qh = NULL;
++	}
++
++	qh->channel = NULL;
++	qh->ntd = 0;
++
++	if (qh->desc_list) {
++		dwc_memset(qh->desc_list, 0x00,
++			   sizeof(dwc_otg_host_dma_desc_t) * max_desc_num(qh));
++	}
++}
++
++/**
++ * Initializes a QH structure's Descriptor DMA related members.
++ * Allocates memory for descriptor list.
++ * On first periodic QH, allocates memory for FrameList
++ * and enables periodic scheduling.
++ *
++ * @param hcd The HCD state structure for the DWC OTG controller.
++ * @param qh The QH to init.
++ *
++ * @return 0 if successful, negative error code otherwise.
++ */
++int dwc_otg_hcd_qh_init_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	struct device *dev = dwc_otg_hcd_to_dev(hcd);
++	int retval = 0;
++
++	if (qh->do_split) {
++		DWC_ERROR("SPLIT Transfers are not supported in Descriptor DMA.\n");
++		return -1;
++	}
++
++	retval = desc_list_alloc(dev, qh);
++
++	if ((retval == 0)
++	    && (qh->ep_type == UE_ISOCHRONOUS || qh->ep_type == UE_INTERRUPT)) {
++		if (!hcd->frame_list) {
++			retval = frame_list_alloc(hcd);
++			/* Enable periodic schedule on first periodic QH */
++			if (retval == 0)
++				per_sched_enable(hcd, MAX_FRLIST_EN_NUM);
++		}
++	}
++
++	qh->ntd = 0;
++
++	return retval;
++}
++
++/**
++ * Frees descriptor list memory associated with the QH.
++ * If QH is periodic and the last, frees FrameList memory
++ * and disables periodic scheduling.
++ *
++ * @param hcd The HCD state structure for the DWC OTG controller.
++ * @param qh The QH to init.
++ */
++void dwc_otg_hcd_qh_free_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	struct device *dev = dwc_otg_hcd_to_dev(hcd);
++
++	desc_list_free(dev, qh);
++
++	/*
++	 * Channel still assigned due to some reasons.
++	 * Seen on Isoc URB dequeue. Channel halted but no subsequent
++	 * ChHalted interrupt to release the channel. Afterwards
++	 * when it comes here from endpoint disable routine
++	 * channel remains assigned.
++	 */
++	if (qh->channel)
++		release_channel_ddma(hcd, qh);
++
++	if ((qh->ep_type == UE_ISOCHRONOUS || qh->ep_type == UE_INTERRUPT)
++	    && (microframe_schedule || !hcd->periodic_channels) && hcd->frame_list) {
++
++		per_sched_disable(hcd);
++		frame_list_free(hcd);
++	}
++}
++
++static uint8_t frame_to_desc_idx(dwc_otg_qh_t * qh, uint16_t frame_idx)
++{
++	if (qh->dev_speed == DWC_OTG_EP_SPEED_HIGH) {
++		/*
++		 * Descriptor set(8 descriptors) index
++		 * which is 8-aligned.
++		 */
++		return (frame_idx & ((MAX_DMA_DESC_NUM_HS_ISOC / 8) - 1)) * 8;
++	} else {
++		return (frame_idx & (MAX_DMA_DESC_NUM_GENERIC - 1));
++	}
++}
++
++/*
++ * Determine starting frame for Isochronous transfer.
++ * Few frames skipped to prevent race condition with HC.
++ */
++static uint8_t calc_starting_frame(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh,
++				   uint8_t * skip_frames)
++{
++	uint16_t frame = 0;
++	hcd->frame_number = dwc_otg_hcd_get_frame_number(hcd);
++
++	/* sched_frame is always frame number(not uFrame) both in FS and HS !! */
++
++	/*
++	 * skip_frames is used to limit activated descriptors number
++	 * to avoid the situation when HC services the last activated
++	 * descriptor firstly.
++	 * Example for FS:
++	 * Current frame is 1, scheduled frame is 3. Since HC always fetches the descriptor
++	 * corresponding to curr_frame+1, the descriptor corresponding to frame 2
++	 * will be fetched. If the number of descriptors is max=64 (or greather) the
++	 * list will be fully programmed with Active descriptors and it is possible
++	 * case(rare) that the latest descriptor(considering rollback) corresponding
++	 * to frame 2 will be serviced first. HS case is more probable because, in fact,
++	 * up to 11 uframes(16 in the code) may be skipped.
++	 */
++	if (qh->dev_speed == DWC_OTG_EP_SPEED_HIGH) {
++		/*
++		 * Consider uframe counter also, to start xfer asap.
++		 * If half of the frame elapsed skip 2 frames otherwise
++		 * just 1 frame.
++		 * Starting descriptor index must be 8-aligned, so
++		 * if the current frame is near to complete the next one
++		 * is skipped as well.
++		 */
++
++		if (dwc_micro_frame_num(hcd->frame_number) >= 5) {
++			*skip_frames = 2 * 8;
++			frame = dwc_frame_num_inc(hcd->frame_number, *skip_frames);
++		} else {
++			*skip_frames = 1 * 8;
++			frame = dwc_frame_num_inc(hcd->frame_number, *skip_frames);
++		}
++
++		frame = dwc_full_frame_num(frame);
++	} else {
++		/*
++		 * Two frames are skipped for FS - the current and the next.
++		 * But for descriptor programming, 1 frame(descriptor) is enough,
++		 * see example above.
++		 */
++		*skip_frames = 1;
++		frame = dwc_frame_num_inc(hcd->frame_number, 2);
++	}
++
++	return frame;
++}
++
++/*
++ * Calculate initial descriptor index for isochronous transfer
++ * based on scheduled frame.
++ */
++static uint8_t recalc_initial_desc_idx(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	uint16_t frame = 0, fr_idx, fr_idx_tmp;
++	uint8_t skip_frames = 0;
++	/*
++	 * With current ISOC processing algorithm the channel is being
++	 * released when no more QTDs in the list(qh->ntd == 0).
++	 * Thus this function is called only when qh->ntd == 0 and qh->channel == 0.
++	 *
++	 * So qh->channel != NULL branch is not used and just not removed from the
++	 * source file. It is required for another possible approach which is,
++	 * do not disable and release the channel when ISOC session completed,
++	 * just move QH to inactive schedule until new QTD arrives.
++	 * On new QTD, the QH moved back to 'ready' schedule,
++	 * starting frame and therefore starting desc_index are recalculated.
++	 * In this case channel is released only on ep_disable.
++	 */
++
++	/* Calculate starting descriptor index. For INTERRUPT endpoint it is always 0. */
++	if (qh->channel) {
++		frame = calc_starting_frame(hcd, qh, &skip_frames);
++		/*
++		 * Calculate initial descriptor index based on FrameList current bitmap
++		 * and servicing period.
++		 */
++		fr_idx_tmp = frame_list_idx(frame);
++		fr_idx =
++		    (MAX_FRLIST_EN_NUM + frame_list_idx(qh->sched_frame) -
++		     fr_idx_tmp)
++		    % frame_incr_val(qh);
++		fr_idx = (fr_idx + fr_idx_tmp) % MAX_FRLIST_EN_NUM;
++	} else {
++		qh->sched_frame = calc_starting_frame(hcd, qh, &skip_frames);
++		fr_idx = frame_list_idx(qh->sched_frame);
++	}
++
++	qh->td_first = qh->td_last = frame_to_desc_idx(qh, fr_idx);
++
++	return skip_frames;
++}
++
++#define	ISOC_URB_GIVEBACK_ASAP
++
++#define MAX_ISOC_XFER_SIZE_FS 1023
++#define MAX_ISOC_XFER_SIZE_HS 3072
++#define DESCNUM_THRESHOLD 4
++
++static void init_isoc_dma_desc(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh,
++			       uint8_t skip_frames)
++{
++	struct dwc_otg_hcd_iso_packet_desc *frame_desc;
++	dwc_otg_qtd_t *qtd;
++	dwc_otg_host_dma_desc_t *dma_desc;
++	uint16_t idx, inc, n_desc, ntd_max, max_xfer_size;
++
++	idx = qh->td_last;
++	inc = qh->interval;
++	n_desc = 0;
++
++	ntd_max = (max_desc_num(qh) + qh->interval - 1) / qh->interval;
++	if (skip_frames && !qh->channel)
++		ntd_max = ntd_max - skip_frames / qh->interval;
++
++	max_xfer_size =
++	    (qh->dev_speed ==
++	     DWC_OTG_EP_SPEED_HIGH) ? MAX_ISOC_XFER_SIZE_HS :
++	    MAX_ISOC_XFER_SIZE_FS;
++
++	DWC_CIRCLEQ_FOREACH(qtd, &qh->qtd_list, qtd_list_entry) {
++		while ((qh->ntd < ntd_max)
++		       && (qtd->isoc_frame_index_last <
++			   qtd->urb->packet_count)) {
++
++			dma_desc = &qh->desc_list[idx];
++			dwc_memset(dma_desc, 0x00, sizeof(dwc_otg_host_dma_desc_t));
++
++			frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index_last];
++
++			if (frame_desc->length > max_xfer_size)
++				qh->n_bytes[idx] = max_xfer_size;
++			else
++				qh->n_bytes[idx] = frame_desc->length;
++			dma_desc->status.b_isoc.n_bytes = qh->n_bytes[idx];
++			dma_desc->status.b_isoc.a = 1;
++			dma_desc->status.b_isoc.sts = 0;
++
++			dma_desc->buf = qtd->urb->dma + frame_desc->offset;
++
++			qh->ntd++;
++
++			qtd->isoc_frame_index_last++;
++
++#ifdef	ISOC_URB_GIVEBACK_ASAP
++			/*
++			 * Set IOC for each descriptor corresponding to the
++			 * last frame of the URB.
++			 */
++			if (qtd->isoc_frame_index_last ==
++			    qtd->urb->packet_count)
++				dma_desc->status.b_isoc.ioc = 1;
++
++#endif
++			idx = desclist_idx_inc(idx, inc, qh->dev_speed);
++			n_desc++;
++
++		}
++		qtd->in_process = 1;
++	}
++
++	qh->td_last = idx;
++
++#ifdef	ISOC_URB_GIVEBACK_ASAP
++	/* Set IOC for the last descriptor if descriptor list is full */
++	if (qh->ntd == ntd_max) {
++		idx = desclist_idx_dec(qh->td_last, inc, qh->dev_speed);
++		qh->desc_list[idx].status.b_isoc.ioc = 1;
++	}
++#else
++	/*
++	 * Set IOC bit only for one descriptor.
++	 * Always try to be ahead of HW processing,
++	 * i.e. on IOC generation driver activates next descriptors but
++	 * core continues to process descriptors followed the one with IOC set.
++	 */
++
++	if (n_desc > DESCNUM_THRESHOLD) {
++		/*
++		 * Move IOC "up". Required even if there is only one QTD
++		 * in the list, cause QTDs migth continue to be queued,
++		 * but during the activation it was only one queued.
++		 * Actually more than one QTD might be in the list if this function called
++		 * from XferCompletion - QTDs was queued during HW processing of the previous
++		 * descriptor chunk.
++		 */
++		idx = dwc_desclist_idx_dec(idx, inc * ((qh->ntd + 1) / 2), qh->dev_speed);
++	} else {
++		/*
++		 * Set the IOC for the latest descriptor
++		 * if either number of descriptor is not greather than threshold
++		 * or no more new descriptors activated.
++		 */
++		idx = dwc_desclist_idx_dec(qh->td_last, inc, qh->dev_speed);
++	}
++
++	qh->desc_list[idx].status.b_isoc.ioc = 1;
++#endif
++}
++
++static void init_non_isoc_dma_desc(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++
++	dwc_hc_t *hc;
++	dwc_otg_host_dma_desc_t *dma_desc;
++	dwc_otg_qtd_t *qtd;
++	int num_packets, len, n_desc = 0;
++
++	hc = qh->channel;
++
++	/*
++	 * Start with hc->xfer_buff initialized in
++	 * assign_and_init_hc(), then if SG transfer consists of multiple URBs,
++	 * this pointer re-assigned to the buffer of the currently processed QTD.
++	 * For non-SG request there is always one QTD active.
++	 */
++
++	DWC_CIRCLEQ_FOREACH(qtd, &qh->qtd_list, qtd_list_entry) {
++
++		if (n_desc) {
++			/* SG request - more than 1 QTDs */
++			hc->xfer_buff = (uint8_t *)(uintptr_t)qtd->urb->dma +
++					qtd->urb->actual_length;
++			hc->xfer_len = qtd->urb->length - qtd->urb->actual_length;
++		}
++
++		qtd->n_desc = 0;
++
++		do {
++			dma_desc = &qh->desc_list[n_desc];
++			len = hc->xfer_len;
++
++			if (len > MAX_DMA_DESC_SIZE)
++				len = MAX_DMA_DESC_SIZE - hc->max_packet + 1;
++
++			if (hc->ep_is_in) {
++				if (len > 0) {
++					num_packets = (len + hc->max_packet - 1) / hc->max_packet;
++				} else {
++					/* Need 1 packet for transfer length of 0. */
++					num_packets = 1;
++				}
++				/* Always program an integral # of max packets for IN transfers. */
++				len = num_packets * hc->max_packet;
++			}
++
++			dma_desc->status.b.n_bytes = len;
++
++			qh->n_bytes[n_desc] = len;
++
++			if ((qh->ep_type == UE_CONTROL)
++			    && (qtd->control_phase == DWC_OTG_CONTROL_SETUP))
++				dma_desc->status.b.sup = 1;	/* Setup Packet */
++
++			dma_desc->status.b.a = 1;	/* Active descriptor */
++			dma_desc->status.b.sts = 0;
++
++			dma_desc->buf =
++			    ((unsigned long)hc->xfer_buff & 0xffffffff);
++
++			/*
++			 * Last descriptor(or single) of IN transfer
++			 * with actual size less than MaxPacket.
++			 */
++			if (len > hc->xfer_len) {
++				hc->xfer_len = 0;
++			} else {
++				hc->xfer_buff += len;
++				hc->xfer_len -= len;
++			}
++
++			qtd->n_desc++;
++			n_desc++;
++		}
++		while ((hc->xfer_len > 0) && (n_desc != MAX_DMA_DESC_NUM_GENERIC));
++
++
++		qtd->in_process = 1;
++
++		if (qh->ep_type == UE_CONTROL)
++			break;
++
++		if (n_desc == MAX_DMA_DESC_NUM_GENERIC)
++			break;
++	}
++
++	if (n_desc) {
++		/* Request Transfer Complete interrupt for the last descriptor */
++		qh->desc_list[n_desc - 1].status.b.ioc = 1;
++		/* End of List indicator */
++		qh->desc_list[n_desc - 1].status.b.eol = 1;
++
++		hc->ntd = n_desc;
++	}
++}
++
++/**
++ * For Control and Bulk endpoints initializes descriptor list
++ * and starts the transfer.
++ *
++ * For Interrupt and Isochronous endpoints initializes descriptor list
++ * then updates FrameList, marking appropriate entries as active.
++ * In case of Isochronous, the starting descriptor index is calculated based
++ * on the scheduled frame, but only on the first transfer descriptor within a session.
++ * Then starts the transfer via enabling the channel.
++ * For Isochronous endpoint the channel is not halted on XferComplete
++ * interrupt so remains assigned to the endpoint(QH) until session is done.
++ *
++ * @param hcd The HCD state structure for the DWC OTG controller.
++ * @param qh The QH to init.
++ *
++ * @return 0 if successful, negative error code otherwise.
++ */
++void dwc_otg_hcd_start_xfer_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	/* Channel is already assigned */
++	dwc_hc_t *hc = qh->channel;
++	uint8_t skip_frames = 0;
++
++	switch (hc->ep_type) {
++	case DWC_OTG_EP_TYPE_CONTROL:
++	case DWC_OTG_EP_TYPE_BULK:
++		init_non_isoc_dma_desc(hcd, qh);
++
++		dwc_otg_hc_start_transfer_ddma(hcd->core_if, hc);
++		break;
++	case DWC_OTG_EP_TYPE_INTR:
++		init_non_isoc_dma_desc(hcd, qh);
++
++		update_frame_list(hcd, qh, 1);
++
++		dwc_otg_hc_start_transfer_ddma(hcd->core_if, hc);
++		break;
++	case DWC_OTG_EP_TYPE_ISOC:
++
++		if (!qh->ntd)
++			skip_frames = recalc_initial_desc_idx(hcd, qh);
++
++		init_isoc_dma_desc(hcd, qh, skip_frames);
++
++		if (!hc->xfer_started) {
++
++			update_frame_list(hcd, qh, 1);
++
++			/*
++			 * Always set to max, instead of actual size.
++			 * Otherwise ntd will be changed with
++			 * channel being enabled. Not recommended.
++			 *
++			 */
++			hc->ntd = max_desc_num(qh);
++			/* Enable channel only once for ISOC */
++			dwc_otg_hc_start_transfer_ddma(hcd->core_if, hc);
++		}
++
++		break;
++	default:
++
++		break;
++	}
++}
++
++static void complete_isoc_xfer_ddma(dwc_otg_hcd_t * hcd,
++				    dwc_hc_t * hc,
++				    dwc_otg_hc_regs_t * hc_regs,
++				    dwc_otg_halt_status_e halt_status)
++{
++	struct dwc_otg_hcd_iso_packet_desc *frame_desc;
++	dwc_otg_qtd_t *qtd, *qtd_tmp;
++	dwc_otg_qh_t *qh;
++	dwc_otg_host_dma_desc_t *dma_desc;
++	uint16_t idx, remain;
++	uint8_t urb_compl;
++
++	qh = hc->qh;
++	idx = qh->td_first;
++
++	if (hc->halt_status == DWC_OTG_HC_XFER_URB_DEQUEUE) {
++		DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp, &hc->qh->qtd_list, qtd_list_entry)
++		    qtd->in_process = 0;
++		return;
++	} else if ((halt_status == DWC_OTG_HC_XFER_AHB_ERR) ||
++		   (halt_status == DWC_OTG_HC_XFER_BABBLE_ERR)) {
++		/*
++		 * Channel is halted in these error cases.
++		 * Considered as serious issues.
++		 * Complete all URBs marking all frames as failed,
++		 * irrespective whether some of the descriptors(frames) succeeded or no.
++		 * Pass error code to completion routine as well, to
++		 * update urb->status, some of class drivers might use it to stop
++		 * queing transfer requests.
++		 */
++		int err = (halt_status == DWC_OTG_HC_XFER_AHB_ERR)
++		    ? (-DWC_E_IO)
++		    : (-DWC_E_OVERFLOW);
++
++		DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp, &hc->qh->qtd_list, qtd_list_entry) {
++			for (idx = 0; idx < qtd->urb->packet_count; idx++) {
++				frame_desc = &qtd->urb->iso_descs[idx];
++				frame_desc->status = err;
++			}
++			hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, err);
++			dwc_otg_hcd_qtd_remove_and_free(hcd, qtd, qh);
++		}
++		return;
++	}
++
++	DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp, &hc->qh->qtd_list, qtd_list_entry) {
++
++		if (!qtd->in_process)
++			break;
++
++		urb_compl = 0;
++
++		do {
++
++			dma_desc = &qh->desc_list[idx];
++
++			frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
++			remain = hc->ep_is_in ? dma_desc->status.b_isoc.n_bytes : 0;
++
++			if (dma_desc->status.b_isoc.sts == DMA_DESC_STS_PKTERR) {
++				/*
++				 * XactError or, unable to complete all the transactions
++				 * in the scheduled micro-frame/frame,
++				 * both indicated by DMA_DESC_STS_PKTERR.
++				 */
++				qtd->urb->error_count++;
++				frame_desc->actual_length = qh->n_bytes[idx] - remain;
++				frame_desc->status = -DWC_E_PROTOCOL;
++			} else {
++				/* Success */
++
++				frame_desc->actual_length = qh->n_bytes[idx] - remain;
++				frame_desc->status = 0;
++			}
++
++			if (++qtd->isoc_frame_index == qtd->urb->packet_count) {
++				/*
++				 * urb->status is not used for isoc transfers here.
++				 * The individual frame_desc status are used instead.
++				 */
++
++				hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
++				dwc_otg_hcd_qtd_remove_and_free(hcd, qtd, qh);
++
++				/*
++				 * This check is necessary because urb_dequeue can be called
++				 * from urb complete callback(sound driver example).
++				 * All pending URBs are dequeued there, so no need for
++				 * further processing.
++				 */
++				if (hc->halt_status == DWC_OTG_HC_XFER_URB_DEQUEUE) {
++					return;
++				}
++
++				urb_compl = 1;
++
++			}
++
++			qh->ntd--;
++
++			/* Stop if IOC requested descriptor reached */
++			if (dma_desc->status.b_isoc.ioc) {
++				idx = desclist_idx_inc(idx, qh->interval, hc->speed);
++				goto stop_scan;
++			}
++
++			idx = desclist_idx_inc(idx, qh->interval, hc->speed);
++
++			if (urb_compl)
++				break;
++		}
++		while (idx != qh->td_first);
++	}
++stop_scan:
++	qh->td_first = idx;
++}
++
++static uint8_t update_non_isoc_urb_state_ddma(dwc_otg_hcd_t * hcd,
++				       dwc_hc_t * hc,
++				       dwc_otg_qtd_t * qtd,
++				       dwc_otg_host_dma_desc_t * dma_desc,
++				       dwc_otg_halt_status_e halt_status,
++				       uint32_t n_bytes, uint8_t * xfer_done)
++{
++
++	uint16_t remain = hc->ep_is_in ? dma_desc->status.b.n_bytes : 0;
++	dwc_otg_hcd_urb_t *urb = qtd->urb;
++
++	if (halt_status == DWC_OTG_HC_XFER_AHB_ERR) {
++		urb->status = -DWC_E_IO;
++		return 1;
++	}
++	if (dma_desc->status.b.sts == DMA_DESC_STS_PKTERR) {
++		switch (halt_status) {
++		case DWC_OTG_HC_XFER_STALL:
++			urb->status = -DWC_E_PIPE;
++			break;
++		case DWC_OTG_HC_XFER_BABBLE_ERR:
++			urb->status = -DWC_E_OVERFLOW;
++			break;
++		case DWC_OTG_HC_XFER_XACT_ERR:
++			urb->status = -DWC_E_PROTOCOL;
++			break;
++		default:
++			DWC_ERROR("%s: Unhandled descriptor error status (%d)\n", __func__,
++				  halt_status);
++			break;
++		}
++		return 1;
++	}
++
++	if (dma_desc->status.b.a == 1) {
++		DWC_DEBUGPL(DBG_HCDV,
++			    "Active descriptor encountered on channel %d\n",
++			    hc->hc_num);
++		return 0;
++	}
++
++	if (hc->ep_type == DWC_OTG_EP_TYPE_CONTROL) {
++		if (qtd->control_phase == DWC_OTG_CONTROL_DATA) {
++			urb->actual_length += n_bytes - remain;
++			if (remain || urb->actual_length == urb->length) {
++				/*
++				 * For Control Data stage do not set urb->status=0 to prevent
++				 * URB callback. Set it when Status phase done. See below.
++				 */
++				*xfer_done = 1;
++			}
++
++		} else if (qtd->control_phase == DWC_OTG_CONTROL_STATUS) {
++			urb->status = 0;
++			*xfer_done = 1;
++		}
++		/* No handling for SETUP stage */
++	} else {
++		/* BULK and INTR */
++		urb->actual_length += n_bytes - remain;
++		if (remain || urb->actual_length == urb->length) {
++			urb->status = 0;
++			*xfer_done = 1;
++		}
++	}
++
++	return 0;
++}
++
++static void complete_non_isoc_xfer_ddma(dwc_otg_hcd_t * hcd,
++					dwc_hc_t * hc,
++					dwc_otg_hc_regs_t * hc_regs,
++					dwc_otg_halt_status_e halt_status)
++{
++	dwc_otg_hcd_urb_t *urb = NULL;
++	dwc_otg_qtd_t *qtd, *qtd_tmp;
++	dwc_otg_qh_t *qh;
++	dwc_otg_host_dma_desc_t *dma_desc;
++	uint32_t n_bytes, n_desc, i;
++	uint8_t failed = 0, xfer_done;
++
++	n_desc = 0;
++
++	qh = hc->qh;
++
++	if (hc->halt_status == DWC_OTG_HC_XFER_URB_DEQUEUE) {
++		DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp, &hc->qh->qtd_list, qtd_list_entry) {
++			qtd->in_process = 0;
++		}
++		return;
++	}
++
++	DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp, &qh->qtd_list, qtd_list_entry) {
++
++		urb = qtd->urb;
++
++		n_bytes = 0;
++		xfer_done = 0;
++
++		for (i = 0; i < qtd->n_desc; i++) {
++			dma_desc = &qh->desc_list[n_desc];
++
++			n_bytes = qh->n_bytes[n_desc];
++
++			failed =
++			    update_non_isoc_urb_state_ddma(hcd, hc, qtd,
++							   dma_desc,
++							   halt_status, n_bytes,
++							   &xfer_done);
++
++			if (failed
++			    || (xfer_done
++				&& (urb->status != -DWC_E_IN_PROGRESS))) {
++
++				hcd->fops->complete(hcd, urb->priv, urb,
++						    urb->status);
++				dwc_otg_hcd_qtd_remove_and_free(hcd, qtd, qh);
++
++				if (failed)
++					goto stop_scan;
++			} else if (qh->ep_type == UE_CONTROL) {
++				if (qtd->control_phase == DWC_OTG_CONTROL_SETUP) {
++					if (urb->length > 0) {
++						qtd->control_phase = DWC_OTG_CONTROL_DATA;
++					} else {
++						qtd->control_phase = DWC_OTG_CONTROL_STATUS;
++					}
++					DWC_DEBUGPL(DBG_HCDV, "  Control setup transaction done\n");
++				} else if (qtd->control_phase == DWC_OTG_CONTROL_DATA) {
++					if (xfer_done) {
++						qtd->control_phase = DWC_OTG_CONTROL_STATUS;
++						DWC_DEBUGPL(DBG_HCDV, "  Control data transfer done\n");
++					} else if (i + 1 == qtd->n_desc) {
++						/*
++						 * Last descriptor for Control data stage which is
++						 * not completed yet.
++						 */
++						dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
++					}
++				}
++			}
++
++			n_desc++;
++		}
++
++	}
++
++stop_scan:
++
++	if (qh->ep_type != UE_CONTROL) {
++		/*
++		 * Resetting the data toggle for bulk
++		 * and interrupt endpoints in case of stall. See handle_hc_stall_intr()
++		 */
++		if (halt_status == DWC_OTG_HC_XFER_STALL)
++			qh->data_toggle = DWC_OTG_HC_PID_DATA0;
++		else
++			dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
++	}
++
++	if (halt_status == DWC_OTG_HC_XFER_COMPLETE) {
++		hcint_data_t hcint;
++		hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++		if (hcint.b.nyet) {
++			/*
++			 * Got a NYET on the last transaction of the transfer. It
++			 * means that the endpoint should be in the PING state at the
++			 * beginning of the next transfer.
++			 */
++			qh->ping_state = 1;
++			clear_hc_int(hc_regs, nyet);
++		}
++
++	}
++
++}
++
++/**
++ * This function is called from interrupt handlers.
++ * Scans the descriptor list, updates URB's status and
++ * calls completion routine for the URB if it's done.
++ * Releases the channel to be used by other transfers.
++ * In case of Isochronous endpoint the channel is not halted until
++ * the end of the session, i.e. QTD list is empty.
++ * If periodic channel released the FrameList is updated accordingly.
++ *
++ * Calls transaction selection routines to activate pending transfers.
++ *
++ * @param hcd The HCD state structure for the DWC OTG controller.
++ * @param hc Host channel, the transfer is completed on.
++ * @param hc_regs Host channel registers.
++ * @param halt_status Reason the channel is being halted,
++ *		      or just XferComplete for isochronous transfer
++ */
++void dwc_otg_hcd_complete_xfer_ddma(dwc_otg_hcd_t * hcd,
++				    dwc_hc_t * hc,
++				    dwc_otg_hc_regs_t * hc_regs,
++				    dwc_otg_halt_status_e halt_status)
++{
++	uint8_t continue_isoc_xfer = 0;
++	dwc_otg_transaction_type_e tr_type;
++	dwc_otg_qh_t *qh = hc->qh;
++
++	if (hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
++
++		complete_isoc_xfer_ddma(hcd, hc, hc_regs, halt_status);
++
++		/* Release the channel if halted or session completed */
++		if (halt_status != DWC_OTG_HC_XFER_COMPLETE ||
++		    DWC_CIRCLEQ_EMPTY(&qh->qtd_list)) {
++
++			/* Halt the channel if session completed */
++			if (halt_status == DWC_OTG_HC_XFER_COMPLETE) {
++				dwc_otg_hc_halt(hcd->core_if, hc, halt_status);
++			}
++
++			release_channel_ddma(hcd, qh);
++			dwc_otg_hcd_qh_remove(hcd, qh);
++		} else {
++			/* Keep in assigned schedule to continue transfer */
++			DWC_LIST_MOVE_HEAD(&hcd->periodic_sched_assigned,
++					   &qh->qh_list_entry);
++			continue_isoc_xfer = 1;
++
++		}
++		/** @todo Consider the case when period exceeds FrameList size.
++		 *  Frame Rollover interrupt should be used.
++		 */
++	} else {
++		/* Scan descriptor list to complete the URB(s), then release the channel */
++		complete_non_isoc_xfer_ddma(hcd, hc, hc_regs, halt_status);
++
++		release_channel_ddma(hcd, qh);
++		dwc_otg_hcd_qh_remove(hcd, qh);
++
++		if (!DWC_CIRCLEQ_EMPTY(&qh->qtd_list)) {
++			/* Add back to inactive non-periodic schedule on normal completion */
++			dwc_otg_hcd_qh_add(hcd, qh);
++		}
++
++	}
++	tr_type = dwc_otg_hcd_select_transactions(hcd);
++	if (tr_type != DWC_OTG_TRANSACTION_NONE || continue_isoc_xfer) {
++		if (continue_isoc_xfer) {
++			if (tr_type == DWC_OTG_TRANSACTION_NONE) {
++				tr_type = DWC_OTG_TRANSACTION_PERIODIC;
++			} else if (tr_type == DWC_OTG_TRANSACTION_NON_PERIODIC) {
++				tr_type = DWC_OTG_TRANSACTION_ALL;
++			}
++		}
++		dwc_otg_hcd_queue_transactions(hcd, tr_type);
++	}
++}
++
++#endif /* DWC_DEVICE_ONLY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_if.h
+@@ -0,0 +1,441 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd_if.h $
++ * $Revision: #12 $
++ * $Date: 2011/10/26 $
++ * $Change: 1873028 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++#ifndef DWC_DEVICE_ONLY
++#ifndef __DWC_HCD_IF_H__
++#define __DWC_HCD_IF_H__
++
++#include "dwc_otg_core_if.h"
++
++/** @file
++ * This file defines DWC_OTG HCD Core API.
++ */
++
++struct dwc_otg_hcd;
++typedef struct dwc_otg_hcd dwc_otg_hcd_t;
++
++struct dwc_otg_hcd_urb;
++typedef struct dwc_otg_hcd_urb dwc_otg_hcd_urb_t;
++
++/** @name HCD Function Driver Callbacks */
++/** @{ */
++
++/** This function is called whenever core switches to host mode. */
++typedef int (*dwc_otg_hcd_start_cb_t) (dwc_otg_hcd_t * hcd);
++
++/** This function is called when device has been disconnected */
++typedef int (*dwc_otg_hcd_disconnect_cb_t) (dwc_otg_hcd_t * hcd);
++
++/** Wrapper provides this function to HCD to core, so it can get hub information to which device is connected */
++typedef int (*dwc_otg_hcd_hub_info_from_urb_cb_t) (dwc_otg_hcd_t * hcd,
++						   void *urb_handle,
++						   uint32_t * hub_addr,
++						   uint32_t * port_addr);
++/** Via this function HCD core gets device speed */
++typedef int (*dwc_otg_hcd_speed_from_urb_cb_t) (dwc_otg_hcd_t * hcd,
++						void *urb_handle);
++
++/** This function is called when urb is completed */
++typedef int (*dwc_otg_hcd_complete_urb_cb_t) (dwc_otg_hcd_t * hcd,
++					      void *urb_handle,
++					      dwc_otg_hcd_urb_t * dwc_otg_urb,
++					      int32_t status);
++
++/** Via this function HCD core gets b_hnp_enable parameter */
++typedef int (*dwc_otg_hcd_get_b_hnp_enable) (dwc_otg_hcd_t * hcd);
++
++struct dwc_otg_hcd_function_ops {
++	dwc_otg_hcd_start_cb_t start;
++	dwc_otg_hcd_disconnect_cb_t disconnect;
++	dwc_otg_hcd_hub_info_from_urb_cb_t hub_info;
++	dwc_otg_hcd_speed_from_urb_cb_t speed;
++	dwc_otg_hcd_complete_urb_cb_t complete;
++	dwc_otg_hcd_get_b_hnp_enable get_b_hnp_enable;
++};
++/** @} */
++
++/** @name HCD Core API */
++/** @{ */
++/** This function allocates dwc_otg_hcd structure and returns pointer on it. */
++extern dwc_otg_hcd_t *dwc_otg_hcd_alloc_hcd(void);
++
++/** This function should be called to initiate HCD Core.
++ *
++ * @param hcd The HCD
++ * @param core_if The DWC_OTG Core
++ *
++ * Returns -DWC_E_NO_MEMORY if no enough memory.
++ * Returns 0 on success
++ */
++extern int dwc_otg_hcd_init(dwc_otg_hcd_t * hcd, dwc_otg_core_if_t * core_if);
++
++/** Frees HCD
++ *
++ * @param hcd The HCD
++ */
++extern void dwc_otg_hcd_remove(dwc_otg_hcd_t * hcd);
++
++/** This function should be called on every hardware interrupt.
++ *
++ * @param dwc_otg_hcd The HCD
++ *
++ * Returns non zero if interrupt is handled
++ * Return 0 if interrupt is not handled
++ */
++extern int32_t dwc_otg_hcd_handle_intr(dwc_otg_hcd_t * dwc_otg_hcd);
++
++/** This function is used to handle the fast interrupt
++ *
++ */
++#ifdef CONFIG_ARM64
++extern void dwc_otg_hcd_handle_fiq(void);
++#else
++extern void __attribute__ ((naked)) dwc_otg_hcd_handle_fiq(void);
++#endif
++
++/**
++ * Returns private data set by
++ * dwc_otg_hcd_set_priv_data function.
++ *
++ * @param hcd The HCD
++ */
++extern void *dwc_otg_hcd_get_priv_data(dwc_otg_hcd_t * hcd);
++
++/**
++ * Set private data.
++ *
++ * @param hcd The HCD
++ * @param priv_data pointer to be stored in private data
++ */
++extern void dwc_otg_hcd_set_priv_data(dwc_otg_hcd_t * hcd, void *priv_data);
++
++/**
++ * This function initializes the HCD Core.
++ *
++ * @param hcd The HCD
++ * @param fops The Function Driver Operations data structure containing pointers to all callbacks.
++ *
++ * Returns -DWC_E_NO_DEVICE if Core is currently is in device mode.
++ * Returns 0 on success
++ */
++extern int dwc_otg_hcd_start(dwc_otg_hcd_t * hcd,
++			     struct dwc_otg_hcd_function_ops *fops);
++
++/**
++ * Halts the DWC_otg host mode operations in a clean manner. USB transfers are
++ * stopped.
++ *
++ * @param hcd The HCD
++ */
++extern void dwc_otg_hcd_stop(dwc_otg_hcd_t * hcd);
++
++/**
++ * Handles hub class-specific requests.
++ *
++ * @param dwc_otg_hcd The HCD
++ * @param typeReq Request Type
++ * @param wValue wValue from control request
++ * @param wIndex wIndex from control request
++ * @param buf data buffer
++ * @param wLength data buffer length
++ *
++ * Returns -DWC_E_INVALID if invalid argument is passed
++ * Returns 0 on success
++ */
++extern int dwc_otg_hcd_hub_control(dwc_otg_hcd_t * dwc_otg_hcd,
++				   uint16_t typeReq, uint16_t wValue,
++				   uint16_t wIndex, uint8_t * buf,
++				   uint16_t wLength);
++
++/**
++ * Returns otg port number.
++ *
++ * @param hcd The HCD
++ */
++extern uint32_t dwc_otg_hcd_otg_port(dwc_otg_hcd_t * hcd);
++
++/**
++ * Returns OTG version - either 1.3 or 2.0.
++ *
++ * @param core_if The core_if structure pointer
++ */
++extern uint16_t dwc_otg_get_otg_version(dwc_otg_core_if_t * core_if);
++
++/**
++ * Returns 1 if currently core is acting as B host, and 0 otherwise.
++ *
++ * @param hcd The HCD
++ */
++extern uint32_t dwc_otg_hcd_is_b_host(dwc_otg_hcd_t * hcd);
++
++/**
++ * Returns current frame number.
++ *
++ * @param hcd The HCD
++ */
++extern int dwc_otg_hcd_get_frame_number(dwc_otg_hcd_t * hcd);
++
++/**
++ * Dumps hcd state.
++ *
++ * @param hcd The HCD
++ */
++extern void dwc_otg_hcd_dump_state(dwc_otg_hcd_t * hcd);
++
++/**
++ * Dump the average frame remaining at SOF. This can be used to
++ * determine average interrupt latency. Frame remaining is also shown for
++ * start transfer and two additional sample points.
++ * Currently this function is not implemented.
++ *
++ * @param hcd The HCD
++ */
++extern void dwc_otg_hcd_dump_frrem(dwc_otg_hcd_t * hcd);
++
++/**
++ * Sends LPM transaction to the local device.
++ *
++ * @param hcd The HCD
++ * @param devaddr Device Address
++ * @param hird Host initiated resume duration
++ * @param bRemoteWake Value of bRemoteWake field in LPM transaction
++ *
++ * Returns negative value if sending LPM transaction was not succeeded.
++ * Returns 0 on success.
++ */
++extern int dwc_otg_hcd_send_lpm(dwc_otg_hcd_t * hcd, uint8_t devaddr,
++				uint8_t hird, uint8_t bRemoteWake);
++
++/* URB interface */
++
++/**
++ * Allocates memory for dwc_otg_hcd_urb structure.
++ * Allocated memory should be freed by call of DWC_FREE.
++ *
++ * @param hcd The HCD
++ * @param iso_desc_count Count of ISOC descriptors
++ * @param atomic_alloc Specefies whether to perform atomic allocation.
++ */
++extern dwc_otg_hcd_urb_t *dwc_otg_hcd_urb_alloc(dwc_otg_hcd_t * hcd,
++						int iso_desc_count,
++						int atomic_alloc);
++
++/**
++ * Set pipe information in URB.
++ *
++ * @param hcd_urb DWC_OTG URB
++ * @param devaddr Device Address
++ * @param ep_num Endpoint Number
++ * @param ep_type Endpoint Type
++ * @param ep_dir Endpoint Direction
++ * @param mps Max Packet Size
++ */
++extern void dwc_otg_hcd_urb_set_pipeinfo(dwc_otg_hcd_urb_t * hcd_urb,
++					 uint8_t devaddr, uint8_t ep_num,
++					 uint8_t ep_type, uint8_t ep_dir,
++					 uint16_t mps);
++
++/* Transfer flags */
++#define URB_GIVEBACK_ASAP 0x1
++#define URB_SEND_ZERO_PACKET 0x2
++
++/**
++ * Sets dwc_otg_hcd_urb parameters.
++ *
++ * @param urb DWC_OTG URB allocated by dwc_otg_hcd_urb_alloc function.
++ * @param urb_handle Unique handle for request, this will be passed back
++ * to function driver in completion callback.
++ * @param buf The buffer for the data
++ * @param dma The DMA buffer for the data
++ * @param buflen Transfer length
++ * @param sp Buffer for setup data
++ * @param sp_dma DMA address of setup data buffer
++ * @param flags Transfer flags
++ * @param interval Polling interval for interrupt or isochronous transfers.
++ */
++extern void dwc_otg_hcd_urb_set_params(dwc_otg_hcd_urb_t * urb,
++				       void *urb_handle, void *buf,
++				       dwc_dma_t dma, uint32_t buflen, void *sp,
++				       dwc_dma_t sp_dma, uint32_t flags,
++				       uint16_t interval);
++
++/** Gets status from dwc_otg_hcd_urb
++ *
++ * @param dwc_otg_urb DWC_OTG URB
++ */
++extern uint32_t dwc_otg_hcd_urb_get_status(dwc_otg_hcd_urb_t * dwc_otg_urb);
++
++/** Gets actual length from dwc_otg_hcd_urb
++ *
++ * @param dwc_otg_urb DWC_OTG URB
++ */
++extern uint32_t dwc_otg_hcd_urb_get_actual_length(dwc_otg_hcd_urb_t *
++						  dwc_otg_urb);
++
++/** Gets error count from dwc_otg_hcd_urb. Only for ISOC URBs
++ *
++ * @param dwc_otg_urb DWC_OTG URB
++ */
++extern uint32_t dwc_otg_hcd_urb_get_error_count(dwc_otg_hcd_urb_t *
++						dwc_otg_urb);
++
++/** Set ISOC descriptor offset and length
++ *
++ * @param dwc_otg_urb DWC_OTG URB
++ * @param desc_num ISOC descriptor number
++ * @param offset Offset from beginig of buffer.
++ * @param length Transaction length
++ */
++extern void dwc_otg_hcd_urb_set_iso_desc_params(dwc_otg_hcd_urb_t * dwc_otg_urb,
++						int desc_num, uint32_t offset,
++						uint32_t length);
++
++/** Get status of ISOC descriptor, specified by desc_num
++ *
++ * @param dwc_otg_urb DWC_OTG URB
++ * @param desc_num ISOC descriptor number
++ */
++extern uint32_t dwc_otg_hcd_urb_get_iso_desc_status(dwc_otg_hcd_urb_t *
++						    dwc_otg_urb, int desc_num);
++
++/** Get actual length of ISOC descriptor, specified by desc_num
++ *
++ * @param dwc_otg_urb DWC_OTG URB
++ * @param desc_num ISOC descriptor number
++ */
++extern uint32_t dwc_otg_hcd_urb_get_iso_desc_actual_length(dwc_otg_hcd_urb_t *
++							   dwc_otg_urb,
++							   int desc_num);
++
++/** Queue URB. After transfer is completes, the complete callback will be called with the URB status
++ *
++ * @param dwc_otg_hcd The HCD
++ * @param dwc_otg_urb DWC_OTG URB
++ * @param ep_handle Out parameter for returning endpoint handle
++ * @param atomic_alloc Flag to do atomic allocation if needed
++ *
++ * Returns -DWC_E_NO_DEVICE if no device is connected.
++ * Returns -DWC_E_NO_MEMORY if there is no enough memory.
++ * Returns 0 on success.
++ */
++extern int dwc_otg_hcd_urb_enqueue(dwc_otg_hcd_t * dwc_otg_hcd,
++				   dwc_otg_hcd_urb_t * dwc_otg_urb,
++				   void **ep_handle, int atomic_alloc);
++
++/** De-queue the specified URB
++ *
++ * @param dwc_otg_hcd The HCD
++ * @param dwc_otg_urb DWC_OTG URB
++ */
++extern int dwc_otg_hcd_urb_dequeue(dwc_otg_hcd_t * dwc_otg_hcd,
++				   dwc_otg_hcd_urb_t * dwc_otg_urb);
++
++/** Frees resources in the DWC_otg controller related to a given endpoint.
++ * Any URBs for the endpoint must already be dequeued.
++ *
++ * @param hcd The HCD
++ * @param ep_handle Endpoint handle, returned by dwc_otg_hcd_urb_enqueue function
++ * @param retry Number of retries if there are queued transfers.
++ *
++ * Returns -DWC_E_INVALID if invalid arguments are passed.
++ * Returns 0 on success
++ */
++extern int dwc_otg_hcd_endpoint_disable(dwc_otg_hcd_t * hcd, void *ep_handle,
++					int retry);
++
++/* Resets the data toggle in qh structure. This function can be called from
++ * usb_clear_halt routine.
++ *
++ * @param hcd The HCD
++ * @param ep_handle Endpoint handle, returned by dwc_otg_hcd_urb_enqueue function
++ *
++ * Returns -DWC_E_INVALID if invalid arguments are passed.
++ * Returns 0 on success
++ */
++extern int dwc_otg_hcd_endpoint_reset(dwc_otg_hcd_t * hcd, void *ep_handle);
++
++/** Returns 1 if status of specified port is changed and 0 otherwise.
++ *
++ * @param hcd The HCD
++ * @param port Port number
++ */
++extern int dwc_otg_hcd_is_status_changed(dwc_otg_hcd_t * hcd, int port);
++
++/** Call this function to check if bandwidth was allocated for specified endpoint.
++ * Only for ISOC and INTERRUPT endpoints.
++ *
++ * @param hcd The HCD
++ * @param ep_handle Endpoint handle
++ */
++extern int dwc_otg_hcd_is_bandwidth_allocated(dwc_otg_hcd_t * hcd,
++					      void *ep_handle);
++
++/** Call this function to check if bandwidth was freed for specified endpoint.
++ *
++ * @param hcd The HCD
++ * @param ep_handle Endpoint handle
++ */
++extern int dwc_otg_hcd_is_bandwidth_freed(dwc_otg_hcd_t * hcd, void *ep_handle);
++
++/** Returns bandwidth allocated for specified endpoint in microseconds.
++ * Only for ISOC and INTERRUPT endpoints.
++ *
++ * @param hcd The HCD
++ * @param ep_handle Endpoint handle
++ */
++extern uint8_t dwc_otg_hcd_get_ep_bandwidth(dwc_otg_hcd_t * hcd,
++					    void *ep_handle);
++
++extern int hcd_init(
++#ifdef LM_INTERFACE
++			   struct lm_device *_dev
++#elif  defined(PCI_INTERFACE)
++			   struct pci_dev *_dev
++#elif  defined(PLATFORM_INTERFACE)
++	struct platform_device *dev
++#endif
++    );
++
++extern void hcd_remove(
++#ifdef LM_INTERFACE
++			      struct lm_device *_dev
++#elif  defined(PCI_INTERFACE)
++			      struct pci_dev *_dev
++#elif  defined(PLATFORM_INTERFACE)
++	struct platform_device *_dev
++#endif
++    );
++
++/** @} */
++
++#endif /* __DWC_HCD_IF_H__ */
++#endif /* DWC_DEVICE_ONLY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c
+@@ -0,0 +1,2757 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd_intr.c $
++ * $Revision: #89 $
++ * $Date: 2011/10/20 $
++ * $Change: 1869487 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++#ifndef DWC_DEVICE_ONLY
++
++#include "dwc_otg_hcd.h"
++#include "dwc_otg_regs.h"
++
++#include <linux/jiffies.h>
++#ifdef CONFIG_ARM
++#include <asm/fiq.h>
++#endif
++
++extern bool microframe_schedule;
++
++/** @file
++ * This file contains the implementation of the HCD Interrupt handlers.
++ */
++
++int fiq_done, int_done;
++
++#ifdef FIQ_DEBUG
++char buffer[1000*16];
++int wptr;
++void notrace _fiq_print(FIQDBG_T dbg_lvl, char *fmt, ...)
++{
++	FIQDBG_T dbg_lvl_req = FIQDBG_PORTHUB;
++	va_list args;
++	char text[17];
++	hfnum_data_t hfnum = { .d32 = FIQ_READ(dwc_regs_base + 0x408) };
++
++	if(dbg_lvl & dbg_lvl_req || dbg_lvl == FIQDBG_ERR)
++	{
++		local_fiq_disable();
++		snprintf(text, 9, "%4d%d:%d ", hfnum.b.frnum/8, hfnum.b.frnum%8, 8 - hfnum.b.frrem/937);
++		va_start(args, fmt);
++		vsnprintf(text+8, 9, fmt, args);
++		va_end(args);
++
++		memcpy(buffer + wptr, text, 16);
++		wptr = (wptr + 16) % sizeof(buffer);
++		local_fiq_enable();
++	}
++}
++#endif
++
++/** This function handles interrupts for the HCD. */
++int32_t dwc_otg_hcd_handle_intr(dwc_otg_hcd_t * dwc_otg_hcd)
++{
++	int retval = 0;
++	static int last_time;
++	dwc_otg_core_if_t *core_if = dwc_otg_hcd->core_if;
++	gintsts_data_t gintsts;
++	gintmsk_data_t gintmsk;
++	hfnum_data_t hfnum;
++	haintmsk_data_t haintmsk;
++
++#ifdef DEBUG
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++
++#endif
++
++	gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
++	gintmsk.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
++
++	/* Exit from ISR if core is hibernated */
++	if (core_if->hibernation_suspend == 1) {
++		goto exit_handler_routine;
++	}
++	DWC_SPINLOCK(dwc_otg_hcd->lock);
++	/* Check if HOST Mode */
++	if (dwc_otg_is_host_mode(core_if)) {
++		if (fiq_enable) {
++			local_fiq_disable();
++			fiq_fsm_spin_lock(&dwc_otg_hcd->fiq_state->lock);
++			/* Pull in from the FIQ's disabled mask */
++			gintmsk.d32 = gintmsk.d32 | ~(dwc_otg_hcd->fiq_state->gintmsk_saved.d32);
++			dwc_otg_hcd->fiq_state->gintmsk_saved.d32 = ~0;
++		}
++
++		if (fiq_fsm_enable && ( 0x0000FFFF & ~(dwc_otg_hcd->fiq_state->haintmsk_saved.b2.chint))) {
++			gintsts.b.hcintr = 1;
++		}
++
++		/* Danger will robinson: fake a SOF if necessary */
++		if (fiq_fsm_enable && (dwc_otg_hcd->fiq_state->gintmsk_saved.b.sofintr == 1)) {
++			gintsts.b.sofintr = 1;
++		}
++		gintsts.d32 &= gintmsk.d32;
++
++		if (fiq_enable) {
++			fiq_fsm_spin_unlock(&dwc_otg_hcd->fiq_state->lock);
++			local_fiq_enable();
++		}
++
++		if (!gintsts.d32) {
++			goto exit_handler_routine;
++		}
++
++#ifdef DEBUG
++		// We should be OK doing this because the common interrupts should already have been serviced
++		/* Don't print debug message in the interrupt handler on SOF */
++#ifndef DEBUG_SOF
++		if (gintsts.d32 != DWC_SOF_INTR_MASK)
++#endif
++			DWC_DEBUGPL(DBG_HCDI, "\n");
++#endif
++
++#ifdef DEBUG
++#ifndef DEBUG_SOF
++		if (gintsts.d32 != DWC_SOF_INTR_MASK)
++#endif
++			DWC_DEBUGPL(DBG_HCDI,
++				    "DWC OTG HCD Interrupt Detected gintsts&gintmsk=0x%08x core_if=%p\n",
++				    gintsts.d32, core_if);
++#endif
++		hfnum.d32 = DWC_READ_REG32(&dwc_otg_hcd->core_if->host_if->host_global_regs->hfnum);
++		if (gintsts.b.sofintr) {
++			retval |= dwc_otg_hcd_handle_sof_intr(dwc_otg_hcd);
++		}
++
++		if (gintsts.b.rxstsqlvl) {
++			retval |=
++			    dwc_otg_hcd_handle_rx_status_q_level_intr
++			    (dwc_otg_hcd);
++		}
++		if (gintsts.b.nptxfempty) {
++			retval |=
++			    dwc_otg_hcd_handle_np_tx_fifo_empty_intr
++			    (dwc_otg_hcd);
++		}
++		if (gintsts.b.i2cintr) {
++			/** @todo Implement i2cintr handler. */
++		}
++		if (gintsts.b.portintr) {
++
++			gintmsk_data_t gintmsk = { .b.portintr = 1};
++			retval |= dwc_otg_hcd_handle_port_intr(dwc_otg_hcd);
++			if (fiq_enable) {
++				local_fiq_disable();
++				fiq_fsm_spin_lock(&dwc_otg_hcd->fiq_state->lock);
++				DWC_MODIFY_REG32(&dwc_otg_hcd->core_if->core_global_regs->gintmsk, 0, gintmsk.d32);
++				fiq_fsm_spin_unlock(&dwc_otg_hcd->fiq_state->lock);
++				local_fiq_enable();
++			} else {
++				DWC_MODIFY_REG32(&dwc_otg_hcd->core_if->core_global_regs->gintmsk, 0, gintmsk.d32);
++			}
++		}
++		if (gintsts.b.hcintr) {
++			retval |= dwc_otg_hcd_handle_hc_intr(dwc_otg_hcd);
++		}
++		if (gintsts.b.ptxfempty) {
++			retval |=
++			    dwc_otg_hcd_handle_perio_tx_fifo_empty_intr
++			    (dwc_otg_hcd);
++		}
++#ifdef DEBUG
++#ifndef DEBUG_SOF
++		if (gintsts.d32 != DWC_SOF_INTR_MASK)
++#endif
++		{
++			DWC_DEBUGPL(DBG_HCDI,
++				    "DWC OTG HCD Finished Servicing Interrupts\n");
++			DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD gintsts=0x%08x\n",
++				    DWC_READ_REG32(&global_regs->gintsts));
++			DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD gintmsk=0x%08x\n",
++				    DWC_READ_REG32(&global_regs->gintmsk));
++		}
++#endif
++
++#ifdef DEBUG
++#ifndef DEBUG_SOF
++		if (gintsts.d32 != DWC_SOF_INTR_MASK)
++#endif
++			DWC_DEBUGPL(DBG_HCDI, "\n");
++#endif
++
++	}
++
++exit_handler_routine:
++	if (fiq_enable)	{
++		gintmsk_data_t gintmsk_new;
++		haintmsk_data_t haintmsk_new;
++		local_fiq_disable();
++		fiq_fsm_spin_lock(&dwc_otg_hcd->fiq_state->lock);
++		gintmsk_new.d32 = *(volatile uint32_t *)&dwc_otg_hcd->fiq_state->gintmsk_saved.d32;
++		if(fiq_fsm_enable)
++			haintmsk_new.d32 = *(volatile uint32_t *)&dwc_otg_hcd->fiq_state->haintmsk_saved.d32;
++		else
++			haintmsk_new.d32 = 0x0000FFFF;
++
++		/* The FIQ could have sneaked another interrupt in. If so, don't clear MPHI */
++		if ((gintmsk_new.d32 == ~0) && (haintmsk_new.d32 == 0x0000FFFF)) {
++			if (dwc_otg_hcd->fiq_state->mphi_regs.swirq_clr) {
++				DWC_WRITE_REG32(dwc_otg_hcd->fiq_state->mphi_regs.swirq_clr, 1);
++			} else {
++				DWC_WRITE_REG32(dwc_otg_hcd->fiq_state->mphi_regs.intstat, (1<<16));
++			}
++			if (dwc_otg_hcd->fiq_state->mphi_int_count >= 50) {
++				fiq_print(FIQDBG_INT, dwc_otg_hcd->fiq_state, "MPHI CLR");
++					DWC_WRITE_REG32(dwc_otg_hcd->fiq_state->mphi_regs.ctrl, ((1<<31) + (1<<16)));
++					while (!(DWC_READ_REG32(dwc_otg_hcd->fiq_state->mphi_regs.ctrl) & (1 << 17)))
++						;
++					DWC_WRITE_REG32(dwc_otg_hcd->fiq_state->mphi_regs.ctrl, (1<<31));
++					dwc_otg_hcd->fiq_state->mphi_int_count = 0;
++			}
++			int_done++;
++		}
++		haintmsk.d32 = DWC_READ_REG32(&core_if->host_if->host_global_regs->haintmsk);
++		/* Re-enable interrupts that the FIQ masked (first time round) */
++		FIQ_WRITE(dwc_otg_hcd->fiq_state->dwc_regs_base + GINTMSK, gintmsk.d32);
++		fiq_fsm_spin_unlock(&dwc_otg_hcd->fiq_state->lock);
++		local_fiq_enable();
++
++		if ((jiffies / HZ) > last_time) {
++			//dwc_otg_qh_t *qh;
++			//dwc_list_link_t *cur;
++			/* Once a second output the fiq and irq numbers, useful for debug */
++			last_time = jiffies / HZ;
++		//	 DWC_WARN("np_kick=%d AHC=%d sched_frame=%d cur_frame=%d int_done=%d fiq_done=%d",
++		//	dwc_otg_hcd->fiq_state->kick_np_queues, dwc_otg_hcd->available_host_channels,
++		//	dwc_otg_hcd->fiq_state->next_sched_frame, hfnum.b.frnum, int_done, dwc_otg_hcd->fiq_state->fiq_done);
++			 //printk(KERN_WARNING "Periodic queues:\n");
++		}
++	}
++
++	DWC_SPINUNLOCK(dwc_otg_hcd->lock);
++	return retval;
++}
++
++#ifdef DWC_TRACK_MISSED_SOFS
++
++#warning Compiling code to track missed SOFs
++#define FRAME_NUM_ARRAY_SIZE 1000
++/**
++ * This function is for debug only.
++ */
++static inline void track_missed_sofs(uint16_t curr_frame_number)
++{
++	static uint16_t frame_num_array[FRAME_NUM_ARRAY_SIZE];
++	static uint16_t last_frame_num_array[FRAME_NUM_ARRAY_SIZE];
++	static int frame_num_idx = 0;
++	static uint16_t last_frame_num = DWC_HFNUM_MAX_FRNUM;
++	static int dumped_frame_num_array = 0;
++
++	if (frame_num_idx < FRAME_NUM_ARRAY_SIZE) {
++		if (((last_frame_num + 1) & DWC_HFNUM_MAX_FRNUM) !=
++		    curr_frame_number) {
++			frame_num_array[frame_num_idx] = curr_frame_number;
++			last_frame_num_array[frame_num_idx++] = last_frame_num;
++		}
++	} else if (!dumped_frame_num_array) {
++		int i;
++		DWC_PRINTF("Frame     Last Frame\n");
++		DWC_PRINTF("-----     ----------\n");
++		for (i = 0; i < FRAME_NUM_ARRAY_SIZE; i++) {
++			DWC_PRINTF("0x%04x    0x%04x\n",
++				   frame_num_array[i], last_frame_num_array[i]);
++		}
++		dumped_frame_num_array = 1;
++	}
++	last_frame_num = curr_frame_number;
++}
++#endif
++
++/**
++ * Handles the start-of-frame interrupt in host mode. Non-periodic
++ * transactions may be queued to the DWC_otg controller for the current
++ * (micro)frame. Periodic transactions may be queued to the controller for the
++ * next (micro)frame.
++ */
++int32_t dwc_otg_hcd_handle_sof_intr(dwc_otg_hcd_t * hcd)
++{
++	hfnum_data_t hfnum;
++	gintsts_data_t gintsts = { .d32 = 0 };
++	dwc_list_link_t *qh_entry;
++	dwc_otg_qh_t *qh;
++	dwc_otg_transaction_type_e tr_type;
++	int did_something = 0;
++	int32_t next_sched_frame = -1;
++
++	hfnum.d32 =
++	    DWC_READ_REG32(&hcd->core_if->host_if->host_global_regs->hfnum);
++
++#ifdef DEBUG_SOF
++	DWC_DEBUGPL(DBG_HCD, "--Start of Frame Interrupt--\n");
++#endif
++	hcd->frame_number = hfnum.b.frnum;
++
++#ifdef DEBUG
++	hcd->frrem_accum += hfnum.b.frrem;
++	hcd->frrem_samples++;
++#endif
++
++#ifdef DWC_TRACK_MISSED_SOFS
++	track_missed_sofs(hcd->frame_number);
++#endif
++	/* Determine whether any periodic QHs should be executed. */
++	qh_entry = DWC_LIST_FIRST(&hcd->periodic_sched_inactive);
++	while (qh_entry != &hcd->periodic_sched_inactive) {
++		qh = DWC_LIST_ENTRY(qh_entry, dwc_otg_qh_t, qh_list_entry);
++		qh_entry = qh_entry->next;
++		if (dwc_frame_num_le(qh->sched_frame, hcd->frame_number)) {
++
++			/*
++			 * Move QH to the ready list to be executed next
++			 * (micro)frame.
++			 */
++			DWC_LIST_MOVE_HEAD(&hcd->periodic_sched_ready,
++					   &qh->qh_list_entry);
++
++			did_something = 1;
++		}
++		else
++		{
++			if(next_sched_frame < 0 || dwc_frame_num_le(qh->sched_frame, next_sched_frame))
++			{
++				next_sched_frame = qh->sched_frame;
++			}
++		}
++	}
++	if (fiq_enable)
++		hcd->fiq_state->next_sched_frame = next_sched_frame;
++
++	tr_type = dwc_otg_hcd_select_transactions(hcd);
++	if (tr_type != DWC_OTG_TRANSACTION_NONE) {
++		dwc_otg_hcd_queue_transactions(hcd, tr_type);
++		did_something = 1;
++	}
++
++	/* Clear interrupt - but do not trample on the FIQ sof */
++	if (!fiq_fsm_enable) {
++		gintsts.b.sofintr = 1;
++		DWC_WRITE_REG32(&hcd->core_if->core_global_regs->gintsts, gintsts.d32);
++	}
++	return 1;
++}
++
++/** Handles the Rx Status Queue Level Interrupt, which indicates that there is at
++ * least one packet in the Rx FIFO.  The packets are moved from the FIFO to
++ * memory if the DWC_otg controller is operating in Slave mode. */
++int32_t dwc_otg_hcd_handle_rx_status_q_level_intr(dwc_otg_hcd_t * dwc_otg_hcd)
++{
++	host_grxsts_data_t grxsts;
++	dwc_hc_t *hc = NULL;
++
++	DWC_DEBUGPL(DBG_HCD, "--RxStsQ Level Interrupt--\n");
++
++	grxsts.d32 =
++	    DWC_READ_REG32(&dwc_otg_hcd->core_if->core_global_regs->grxstsp);
++
++	hc = dwc_otg_hcd->hc_ptr_array[grxsts.b.chnum];
++	if (!hc) {
++		DWC_ERROR("Unable to get corresponding channel\n");
++		return 0;
++	}
++
++	/* Packet Status */
++	DWC_DEBUGPL(DBG_HCDV, "    Ch num = %d\n", grxsts.b.chnum);
++	DWC_DEBUGPL(DBG_HCDV, "    Count = %d\n", grxsts.b.bcnt);
++	DWC_DEBUGPL(DBG_HCDV, "    DPID = %d, hc.dpid = %d\n", grxsts.b.dpid,
++		    hc->data_pid_start);
++	DWC_DEBUGPL(DBG_HCDV, "    PStatus = %d\n", grxsts.b.pktsts);
++
++	switch (grxsts.b.pktsts) {
++	case DWC_GRXSTS_PKTSTS_IN:
++		/* Read the data into the host buffer. */
++		if (grxsts.b.bcnt > 0) {
++			dwc_otg_read_packet(dwc_otg_hcd->core_if,
++					    hc->xfer_buff, grxsts.b.bcnt);
++
++			/* Update the HC fields for the next packet received. */
++			hc->xfer_count += grxsts.b.bcnt;
++			hc->xfer_buff += grxsts.b.bcnt;
++		}
++		break;
++	case DWC_GRXSTS_PKTSTS_IN_XFER_COMP:
++	case DWC_GRXSTS_PKTSTS_DATA_TOGGLE_ERR:
++	case DWC_GRXSTS_PKTSTS_CH_HALTED:
++		/* Handled in interrupt, just ignore data */
++		break;
++	default:
++		DWC_ERROR("RX_STS_Q Interrupt: Unknown status %d\n",
++			  grxsts.b.pktsts);
++		break;
++	}
++
++	return 1;
++}
++
++/** This interrupt occurs when the non-periodic Tx FIFO is half-empty. More
++ * data packets may be written to the FIFO for OUT transfers. More requests
++ * may be written to the non-periodic request queue for IN transfers. This
++ * interrupt is enabled only in Slave mode. */
++int32_t dwc_otg_hcd_handle_np_tx_fifo_empty_intr(dwc_otg_hcd_t * dwc_otg_hcd)
++{
++	DWC_DEBUGPL(DBG_HCD, "--Non-Periodic TxFIFO Empty Interrupt--\n");
++	dwc_otg_hcd_queue_transactions(dwc_otg_hcd,
++				       DWC_OTG_TRANSACTION_NON_PERIODIC);
++	return 1;
++}
++
++/** This interrupt occurs when the periodic Tx FIFO is half-empty. More data
++ * packets may be written to the FIFO for OUT transfers. More requests may be
++ * written to the periodic request queue for IN transfers. This interrupt is
++ * enabled only in Slave mode. */
++int32_t dwc_otg_hcd_handle_perio_tx_fifo_empty_intr(dwc_otg_hcd_t * dwc_otg_hcd)
++{
++	DWC_DEBUGPL(DBG_HCD, "--Periodic TxFIFO Empty Interrupt--\n");
++	dwc_otg_hcd_queue_transactions(dwc_otg_hcd,
++				       DWC_OTG_TRANSACTION_PERIODIC);
++	return 1;
++}
++
++/** There are multiple conditions that can cause a port interrupt. This function
++ * determines which interrupt conditions have occurred and handles them
++ * appropriately. */
++int32_t dwc_otg_hcd_handle_port_intr(dwc_otg_hcd_t * dwc_otg_hcd)
++{
++	int retval = 0;
++	hprt0_data_t hprt0;
++	hprt0_data_t hprt0_modify;
++
++	hprt0.d32 = DWC_READ_REG32(dwc_otg_hcd->core_if->host_if->hprt0);
++	hprt0_modify.d32 = DWC_READ_REG32(dwc_otg_hcd->core_if->host_if->hprt0);
++
++	/* Clear appropriate bits in HPRT0 to clear the interrupt bit in
++	 * GINTSTS */
++
++	hprt0_modify.b.prtena = 0;
++	hprt0_modify.b.prtconndet = 0;
++	hprt0_modify.b.prtenchng = 0;
++	hprt0_modify.b.prtovrcurrchng = 0;
++
++	/* Port Connect Detected
++	 * Set flag and clear if detected */
++	if (dwc_otg_hcd->core_if->hibernation_suspend == 1) {
++		// Dont modify port status if we are in hibernation state
++		hprt0_modify.b.prtconndet = 1;
++		hprt0_modify.b.prtenchng = 1;
++		DWC_WRITE_REG32(dwc_otg_hcd->core_if->host_if->hprt0, hprt0_modify.d32);
++		hprt0.d32 = DWC_READ_REG32(dwc_otg_hcd->core_if->host_if->hprt0);
++		return retval;
++	}
++
++	if (hprt0.b.prtconndet) {
++		/** @todo - check if steps performed in 'else' block should be perfromed regardles adp */
++		if (dwc_otg_hcd->core_if->adp_enable &&
++				dwc_otg_hcd->core_if->adp.vbuson_timer_started == 1) {
++			DWC_PRINTF("PORT CONNECT DETECTED ----------------\n");
++			DWC_TIMER_CANCEL(dwc_otg_hcd->core_if->adp.vbuson_timer);
++			dwc_otg_hcd->core_if->adp.vbuson_timer_started = 0;
++			/* TODO - check if this is required, as
++			 * host initialization was already performed
++			 * after initial ADP probing
++			 */
++			/*dwc_otg_hcd->core_if->adp.vbuson_timer_started = 0;
++			dwc_otg_core_init(dwc_otg_hcd->core_if);
++			dwc_otg_enable_global_interrupts(dwc_otg_hcd->core_if);
++			cil_hcd_start(dwc_otg_hcd->core_if);*/
++		} else {
++
++			DWC_DEBUGPL(DBG_HCD, "--Port Interrupt HPRT0=0x%08x "
++				    "Port Connect Detected--\n", hprt0.d32);
++			dwc_otg_hcd->flags.b.port_connect_status_change = 1;
++			dwc_otg_hcd->flags.b.port_connect_status = 1;
++			hprt0_modify.b.prtconndet = 1;
++
++			/* B-Device has connected, Delete the connection timer. */
++			DWC_TIMER_CANCEL(dwc_otg_hcd->conn_timer);
++		}
++		/* The Hub driver asserts a reset when it sees port connect
++		 * status change flag */
++		retval |= 1;
++	}
++
++	/* Port Enable Changed
++	 * Clear if detected - Set internal flag if disabled */
++	if (hprt0.b.prtenchng) {
++		DWC_DEBUGPL(DBG_HCD, "  --Port Interrupt HPRT0=0x%08x "
++			    "Port Enable Changed--\n", hprt0.d32);
++		hprt0_modify.b.prtenchng = 1;
++		if (hprt0.b.prtena == 1) {
++			hfir_data_t hfir;
++			int do_reset = 0;
++			dwc_otg_core_params_t *params =
++			    dwc_otg_hcd->core_if->core_params;
++			dwc_otg_core_global_regs_t *global_regs =
++			    dwc_otg_hcd->core_if->core_global_regs;
++			dwc_otg_host_if_t *host_if =
++			    dwc_otg_hcd->core_if->host_if;
++
++			dwc_otg_hcd->flags.b.port_speed = hprt0.b.prtspd;
++			if (microframe_schedule)
++				init_hcd_usecs(dwc_otg_hcd);
++
++			/* Every time when port enables calculate
++			 * HFIR.FrInterval
++			 */
++			hfir.d32 = DWC_READ_REG32(&host_if->host_global_regs->hfir);
++			hfir.b.frint = calc_frame_interval(dwc_otg_hcd->core_if);
++			DWC_WRITE_REG32(&host_if->host_global_regs->hfir, hfir.d32);
++
++			/* Check if we need to adjust the PHY clock speed for
++			 * low power and adjust it */
++			if (params->host_support_fs_ls_low_power) {
++				gusbcfg_data_t usbcfg;
++
++				usbcfg.d32 =
++				    DWC_READ_REG32(&global_regs->gusbcfg);
++
++				if (hprt0.b.prtspd == DWC_HPRT0_PRTSPD_LOW_SPEED
++				    || hprt0.b.prtspd ==
++				    DWC_HPRT0_PRTSPD_FULL_SPEED) {
++					/*
++					 * Low power
++					 */
++					hcfg_data_t hcfg;
++					if (usbcfg.b.phylpwrclksel == 0) {
++						/* Set PHY low power clock select for FS/LS devices */
++						usbcfg.b.phylpwrclksel = 1;
++						DWC_WRITE_REG32
++						    (&global_regs->gusbcfg,
++						     usbcfg.d32);
++						do_reset = 1;
++					}
++
++					hcfg.d32 =
++					    DWC_READ_REG32
++					    (&host_if->host_global_regs->hcfg);
++
++					if (hprt0.b.prtspd ==
++					    DWC_HPRT0_PRTSPD_LOW_SPEED
++					    && params->host_ls_low_power_phy_clk
++					    ==
++					    DWC_HOST_LS_LOW_POWER_PHY_CLK_PARAM_6MHZ)
++					{
++						/* 6 MHZ */
++						DWC_DEBUGPL(DBG_CIL,
++							    "FS_PHY programming HCFG to 6 MHz (Low Power)\n");
++						if (hcfg.b.fslspclksel !=
++						    DWC_HCFG_6_MHZ) {
++							hcfg.b.fslspclksel =
++							    DWC_HCFG_6_MHZ;
++							DWC_WRITE_REG32
++							    (&host_if->host_global_regs->hcfg,
++							     hcfg.d32);
++							do_reset = 1;
++						}
++					} else {
++						/* 48 MHZ */
++						DWC_DEBUGPL(DBG_CIL,
++							    "FS_PHY programming HCFG to 48 MHz ()\n");
++						if (hcfg.b.fslspclksel !=
++						    DWC_HCFG_48_MHZ) {
++							hcfg.b.fslspclksel =
++							    DWC_HCFG_48_MHZ;
++							DWC_WRITE_REG32
++							    (&host_if->host_global_regs->hcfg,
++							     hcfg.d32);
++							do_reset = 1;
++						}
++					}
++				} else {
++					/*
++					 * Not low power
++					 */
++					if (usbcfg.b.phylpwrclksel == 1) {
++						usbcfg.b.phylpwrclksel = 0;
++						DWC_WRITE_REG32
++						    (&global_regs->gusbcfg,
++						     usbcfg.d32);
++						do_reset = 1;
++					}
++				}
++
++				if (do_reset) {
++					DWC_TASK_SCHEDULE(dwc_otg_hcd->reset_tasklet);
++				}
++			}
++
++			if (!do_reset) {
++				/* Port has been enabled set the reset change flag */
++				dwc_otg_hcd->flags.b.port_reset_change = 1;
++			}
++		} else {
++			dwc_otg_hcd->flags.b.port_enable_change = 1;
++		}
++		retval |= 1;
++	}
++
++	/** Overcurrent Change Interrupt */
++	if (hprt0.b.prtovrcurrchng) {
++		DWC_DEBUGPL(DBG_HCD, "  --Port Interrupt HPRT0=0x%08x "
++			    "Port Overcurrent Changed--\n", hprt0.d32);
++		dwc_otg_hcd->flags.b.port_over_current_change = 1;
++		hprt0_modify.b.prtovrcurrchng = 1;
++		retval |= 1;
++	}
++
++	/* Clear Port Interrupts */
++	DWC_WRITE_REG32(dwc_otg_hcd->core_if->host_if->hprt0, hprt0_modify.d32);
++
++	return retval;
++}
++
++/** This interrupt indicates that one or more host channels has a pending
++ * interrupt. There are multiple conditions that can cause each host channel
++ * interrupt. This function determines which conditions have occurred for each
++ * host channel interrupt and handles them appropriately. */
++int32_t dwc_otg_hcd_handle_hc_intr(dwc_otg_hcd_t * dwc_otg_hcd)
++{
++	int i;
++	int retval = 0;
++	haint_data_t haint = { .d32 = 0 } ;
++
++	/* Clear appropriate bits in HCINTn to clear the interrupt bit in
++	 * GINTSTS */
++
++	if (!fiq_fsm_enable)
++		haint.d32 = dwc_otg_read_host_all_channels_intr(dwc_otg_hcd->core_if);
++
++	// Overwrite with saved interrupts from fiq handler
++	if(fiq_fsm_enable)
++	{
++		/* check the mask? */
++		local_fiq_disable();
++		fiq_fsm_spin_lock(&dwc_otg_hcd->fiq_state->lock);
++		haint.b2.chint |= ~(dwc_otg_hcd->fiq_state->haintmsk_saved.b2.chint);
++		dwc_otg_hcd->fiq_state->haintmsk_saved.b2.chint = ~0;
++		fiq_fsm_spin_unlock(&dwc_otg_hcd->fiq_state->lock);
++		local_fiq_enable();
++	}
++
++	for (i = 0; i < dwc_otg_hcd->core_if->core_params->host_channels; i++) {
++		if (haint.b2.chint & (1 << i)) {
++			retval |= dwc_otg_hcd_handle_hc_n_intr(dwc_otg_hcd, i);
++		}
++	}
++
++	return retval;
++}
++
++/**
++ * Gets the actual length of a transfer after the transfer halts. _halt_status
++ * holds the reason for the halt.
++ *
++ * For IN transfers where halt_status is DWC_OTG_HC_XFER_COMPLETE,
++ * *short_read is set to 1 upon return if less than the requested
++ * number of bytes were transferred. Otherwise, *short_read is set to 0 upon
++ * return. short_read may also be NULL on entry, in which case it remains
++ * unchanged.
++ */
++static uint32_t get_actual_xfer_length(dwc_hc_t * hc,
++				       dwc_otg_hc_regs_t * hc_regs,
++				       dwc_otg_qtd_t * qtd,
++				       dwc_otg_halt_status_e halt_status,
++				       int *short_read)
++{
++	hctsiz_data_t hctsiz;
++	uint32_t length;
++
++	if (short_read != NULL) {
++		*short_read = 0;
++	}
++	hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
++
++	if (halt_status == DWC_OTG_HC_XFER_COMPLETE) {
++		if (hc->ep_is_in) {
++			length = hc->xfer_len - hctsiz.b.xfersize;
++			if (short_read != NULL) {
++				*short_read = (hctsiz.b.xfersize != 0);
++			}
++		} else if (hc->qh->do_split) {
++				//length = split_out_xfersize[hc->hc_num];
++				length = qtd->ssplit_out_xfer_count;
++		} else {
++			length = hc->xfer_len;
++		}
++	} else {
++		/*
++		 * Must use the hctsiz.pktcnt field to determine how much data
++		 * has been transferred. This field reflects the number of
++		 * packets that have been transferred via the USB. This is
++		 * always an integral number of packets if the transfer was
++		 * halted before its normal completion. (Can't use the
++		 * hctsiz.xfersize field because that reflects the number of
++		 * bytes transferred via the AHB, not the USB).
++		 */
++		length =
++		    (hc->start_pkt_count - hctsiz.b.pktcnt) * hc->max_packet;
++	}
++
++	return length;
++}
++
++/**
++ * Updates the state of the URB after a Transfer Complete interrupt on the
++ * host channel. Updates the actual_length field of the URB based on the
++ * number of bytes transferred via the host channel. Sets the URB status
++ * if the data transfer is finished.
++ *
++ * @return 1 if the data transfer specified by the URB is completely finished,
++ * 0 otherwise.
++ */
++static int update_urb_state_xfer_comp(dwc_hc_t * hc,
++				      dwc_otg_hc_regs_t * hc_regs,
++				      dwc_otg_hcd_urb_t * urb,
++				      dwc_otg_qtd_t * qtd)
++{
++	int xfer_done = 0;
++	int short_read = 0;
++
++	int xfer_length;
++
++	xfer_length = get_actual_xfer_length(hc, hc_regs, qtd,
++					     DWC_OTG_HC_XFER_COMPLETE,
++					     &short_read);
++
++	if (urb->actual_length + xfer_length > urb->length) {
++		printk_once(KERN_DEBUG "dwc_otg: DEVICE:%03d : %s:%d:trimming xfer length\n",
++			hc->dev_addr, __func__, __LINE__);
++		xfer_length = urb->length - urb->actual_length;
++	}
++
++	/* non DWORD-aligned buffer case handling. */
++	if (hc->align_buff && xfer_length && hc->ep_is_in) {
++		dwc_memcpy(urb->buf + urb->actual_length, hc->qh->dw_align_buf,
++			   xfer_length);
++	}
++
++	urb->actual_length += xfer_length;
++
++	if (xfer_length && (hc->ep_type == DWC_OTG_EP_TYPE_BULK) &&
++	    (urb->flags & URB_SEND_ZERO_PACKET)
++	    && (urb->actual_length == urb->length)
++	    && !(urb->length % hc->max_packet)) {
++		xfer_done = 0;
++	} else if (short_read || urb->actual_length >= urb->length) {
++		xfer_done = 1;
++		urb->status = 0;
++	}
++
++#ifdef DEBUG
++	{
++		hctsiz_data_t hctsiz;
++		hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
++		DWC_DEBUGPL(DBG_HCDV, "DWC_otg: %s: %s, channel %d\n",
++			    __func__, (hc->ep_is_in ? "IN" : "OUT"),
++			    hc->hc_num);
++		DWC_DEBUGPL(DBG_HCDV, "  hc->xfer_len %d\n", hc->xfer_len);
++		DWC_DEBUGPL(DBG_HCDV, "  hctsiz.xfersize %d\n",
++			    hctsiz.b.xfersize);
++		DWC_DEBUGPL(DBG_HCDV, "  urb->transfer_buffer_length %d\n",
++			    urb->length);
++		DWC_DEBUGPL(DBG_HCDV, "  urb->actual_length %d\n",
++			    urb->actual_length);
++		DWC_DEBUGPL(DBG_HCDV, "  short_read %d, xfer_done %d\n",
++			    short_read, xfer_done);
++	}
++#endif
++
++	return xfer_done;
++}
++
++/*
++ * Save the starting data toggle for the next transfer. The data toggle is
++ * saved in the QH for non-control transfers and it's saved in the QTD for
++ * control transfers.
++ */
++void dwc_otg_hcd_save_data_toggle(dwc_hc_t * hc,
++			     dwc_otg_hc_regs_t * hc_regs, dwc_otg_qtd_t * qtd)
++{
++	hctsiz_data_t hctsiz;
++	hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
++
++	if (hc->ep_type != DWC_OTG_EP_TYPE_CONTROL) {
++		dwc_otg_qh_t *qh = hc->qh;
++		if (hctsiz.b.pid == DWC_HCTSIZ_DATA0) {
++			qh->data_toggle = DWC_OTG_HC_PID_DATA0;
++		} else {
++			qh->data_toggle = DWC_OTG_HC_PID_DATA1;
++		}
++	} else {
++		if (hctsiz.b.pid == DWC_HCTSIZ_DATA0) {
++			qtd->data_toggle = DWC_OTG_HC_PID_DATA0;
++		} else {
++			qtd->data_toggle = DWC_OTG_HC_PID_DATA1;
++		}
++	}
++}
++
++/**
++ * Updates the state of an Isochronous URB when the transfer is stopped for
++ * any reason. The fields of the current entry in the frame descriptor array
++ * are set based on the transfer state and the input _halt_status. Completes
++ * the Isochronous URB if all the URB frames have been completed.
++ *
++ * @return DWC_OTG_HC_XFER_COMPLETE if there are more frames remaining to be
++ * transferred in the URB. Otherwise return DWC_OTG_HC_XFER_URB_COMPLETE.
++ */
++static dwc_otg_halt_status_e
++update_isoc_urb_state(dwc_otg_hcd_t * hcd,
++		      dwc_hc_t * hc,
++		      dwc_otg_hc_regs_t * hc_regs,
++		      dwc_otg_qtd_t * qtd, dwc_otg_halt_status_e halt_status)
++{
++	dwc_otg_hcd_urb_t *urb = qtd->urb;
++	dwc_otg_halt_status_e ret_val = halt_status;
++	struct dwc_otg_hcd_iso_packet_desc *frame_desc;
++
++	frame_desc = &urb->iso_descs[qtd->isoc_frame_index];
++	switch (halt_status) {
++	case DWC_OTG_HC_XFER_COMPLETE:
++		frame_desc->status = 0;
++		frame_desc->actual_length =
++		    get_actual_xfer_length(hc, hc_regs, qtd, halt_status, NULL);
++
++		/* non DWORD-aligned buffer case handling. */
++		if (hc->align_buff && frame_desc->actual_length && hc->ep_is_in) {
++			dwc_memcpy(urb->buf + frame_desc->offset + qtd->isoc_split_offset,
++				   hc->qh->dw_align_buf, frame_desc->actual_length);
++		}
++
++		break;
++	case DWC_OTG_HC_XFER_FRAME_OVERRUN:
++		urb->error_count++;
++		if (hc->ep_is_in) {
++			frame_desc->status = -DWC_E_NO_STREAM_RES;
++		} else {
++			frame_desc->status = -DWC_E_COMMUNICATION;
++		}
++		frame_desc->actual_length = 0;
++		break;
++	case DWC_OTG_HC_XFER_BABBLE_ERR:
++		urb->error_count++;
++		frame_desc->status = -DWC_E_OVERFLOW;
++		/* Don't need to update actual_length in this case. */
++		break;
++	case DWC_OTG_HC_XFER_XACT_ERR:
++		urb->error_count++;
++		frame_desc->status = -DWC_E_PROTOCOL;
++		frame_desc->actual_length =
++		    get_actual_xfer_length(hc, hc_regs, qtd, halt_status, NULL);
++
++		/* non DWORD-aligned buffer case handling. */
++		if (hc->align_buff && frame_desc->actual_length && hc->ep_is_in) {
++			dwc_memcpy(urb->buf + frame_desc->offset + qtd->isoc_split_offset,
++				   hc->qh->dw_align_buf, frame_desc->actual_length);
++		}
++		/* Skip whole frame */
++		if (hc->qh->do_split && (hc->ep_type == DWC_OTG_EP_TYPE_ISOC) &&
++		    hc->ep_is_in && hcd->core_if->dma_enable) {
++			qtd->complete_split = 0;
++			qtd->isoc_split_offset = 0;
++		}
++
++		break;
++	default:
++		DWC_ASSERT(1, "Unhandled _halt_status (%d)\n", halt_status);
++		break;
++	}
++	if (++qtd->isoc_frame_index == urb->packet_count) {
++		/*
++		 * urb->status is not used for isoc transfers.
++		 * The individual frame_desc statuses are used instead.
++		 */
++		hcd->fops->complete(hcd, urb->priv, urb, 0);
++		ret_val = DWC_OTG_HC_XFER_URB_COMPLETE;
++	} else {
++		ret_val = DWC_OTG_HC_XFER_COMPLETE;
++	}
++	return ret_val;
++}
++
++/**
++ * Frees the first QTD in the QH's list if free_qtd is 1. For non-periodic
++ * QHs, removes the QH from the active non-periodic schedule. If any QTDs are
++ * still linked to the QH, the QH is added to the end of the inactive
++ * non-periodic schedule. For periodic QHs, removes the QH from the periodic
++ * schedule if no more QTDs are linked to the QH.
++ */
++static void deactivate_qh(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh, int free_qtd)
++{
++	int continue_split = 0;
++	dwc_otg_qtd_t *qtd;
++
++	DWC_DEBUGPL(DBG_HCDV, "  %s(%p,%p,%d)\n", __func__, hcd, qh, free_qtd);
++
++	qtd = DWC_CIRCLEQ_FIRST(&qh->qtd_list);
++
++	if (qtd->complete_split) {
++		continue_split = 1;
++	} else if (qtd->isoc_split_pos == DWC_HCSPLIT_XACTPOS_MID ||
++		   qtd->isoc_split_pos == DWC_HCSPLIT_XACTPOS_END) {
++		continue_split = 1;
++	}
++
++	if (free_qtd) {
++		dwc_otg_hcd_qtd_remove_and_free(hcd, qtd, qh);
++		continue_split = 0;
++	}
++
++	qh->channel = NULL;
++	dwc_otg_hcd_qh_deactivate(hcd, qh, continue_split);
++}
++
++/**
++ * Releases a host channel for use by other transfers. Attempts to select and
++ * queue more transactions since at least one host channel is available.
++ *
++ * @param hcd The HCD state structure.
++ * @param hc The host channel to release.
++ * @param qtd The QTD associated with the host channel. This QTD may be freed
++ * if the transfer is complete or an error has occurred.
++ * @param halt_status Reason the channel is being released. This status
++ * determines the actions taken by this function.
++ */
++static void release_channel(dwc_otg_hcd_t * hcd,
++			    dwc_hc_t * hc,
++			    dwc_otg_qtd_t * qtd,
++			    dwc_otg_halt_status_e halt_status)
++{
++	dwc_otg_transaction_type_e tr_type;
++	int free_qtd;
++
++	int hog_port = 0;
++
++	DWC_DEBUGPL(DBG_HCDV, "  %s: channel %d, halt_status %d, xfer_len %d\n",
++		    __func__, hc->hc_num, halt_status, hc->xfer_len);
++
++	if(fiq_fsm_enable && hc->do_split) {
++		if(!hc->ep_is_in && hc->ep_type == UE_ISOCHRONOUS) {
++			if(hc->xact_pos == DWC_HCSPLIT_XACTPOS_MID ||
++					hc->xact_pos == DWC_HCSPLIT_XACTPOS_BEGIN) {
++				hog_port = 0;
++			}
++		}
++	}
++
++	switch (halt_status) {
++	case DWC_OTG_HC_XFER_URB_COMPLETE:
++		free_qtd = 1;
++		break;
++	case DWC_OTG_HC_XFER_AHB_ERR:
++	case DWC_OTG_HC_XFER_STALL:
++	case DWC_OTG_HC_XFER_BABBLE_ERR:
++		free_qtd = 1;
++		break;
++	case DWC_OTG_HC_XFER_XACT_ERR:
++		if (qtd->error_count >= 3) {
++			DWC_DEBUGPL(DBG_HCDV,
++				    "  Complete URB with transaction error\n");
++			free_qtd = 1;
++			qtd->urb->status = -DWC_E_PROTOCOL;
++			hcd->fops->complete(hcd, qtd->urb->priv,
++					    qtd->urb, -DWC_E_PROTOCOL);
++		} else {
++			free_qtd = 0;
++		}
++		break;
++	case DWC_OTG_HC_XFER_URB_DEQUEUE:
++		/*
++		 * The QTD has already been removed and the QH has been
++		 * deactivated. Don't want to do anything except release the
++		 * host channel and try to queue more transfers.
++		 */
++		goto cleanup;
++	case DWC_OTG_HC_XFER_NO_HALT_STATUS:
++		free_qtd = 0;
++		break;
++	case DWC_OTG_HC_XFER_PERIODIC_INCOMPLETE:
++		DWC_DEBUGPL(DBG_HCDV,
++			"  Complete URB with I/O error\n");
++		free_qtd = 1;
++		qtd->urb->status = -DWC_E_IO;
++		hcd->fops->complete(hcd, qtd->urb->priv,
++			qtd->urb, -DWC_E_IO);
++		break;
++	default:
++		free_qtd = 0;
++		break;
++	}
++
++	deactivate_qh(hcd, hc->qh, free_qtd);
++
++cleanup:
++	/*
++	 * Release the host channel for use by other transfers. The cleanup
++	 * function clears the channel interrupt enables and conditions, so
++	 * there's no need to clear the Channel Halted interrupt separately.
++	 */
++	if (fiq_fsm_enable && hcd->fiq_state->channel[hc->hc_num].fsm != FIQ_PASSTHROUGH)
++		dwc_otg_cleanup_fiq_channel(hcd, hc->hc_num);
++	dwc_otg_hc_cleanup(hcd->core_if, hc);
++	DWC_CIRCLEQ_INSERT_TAIL(&hcd->free_hc_list, hc, hc_list_entry);
++
++	if (!microframe_schedule) {
++		switch (hc->ep_type) {
++		case DWC_OTG_EP_TYPE_CONTROL:
++		case DWC_OTG_EP_TYPE_BULK:
++			hcd->non_periodic_channels--;
++			break;
++
++		default:
++			/*
++			 * Don't release reservations for periodic channels here.
++			 * That's done when a periodic transfer is descheduled (i.e.
++			 * when the QH is removed from the periodic schedule).
++			 */
++			break;
++		}
++	} else {
++		hcd->available_host_channels++;
++		fiq_print(FIQDBG_INT, hcd->fiq_state, "AHC = %d ", hcd->available_host_channels);
++	}
++
++	/* Try to queue more transfers now that there's a free channel. */
++	tr_type = dwc_otg_hcd_select_transactions(hcd);
++	if (tr_type != DWC_OTG_TRANSACTION_NONE) {
++		dwc_otg_hcd_queue_transactions(hcd, tr_type);
++	}
++}
++
++/**
++ * Halts a host channel. If the channel cannot be halted immediately because
++ * the request queue is full, this function ensures that the FIFO empty
++ * interrupt for the appropriate queue is enabled so that the halt request can
++ * be queued when there is space in the request queue.
++ *
++ * This function may also be called in DMA mode. In that case, the channel is
++ * simply released since the core always halts the channel automatically in
++ * DMA mode.
++ */
++static void halt_channel(dwc_otg_hcd_t * hcd,
++			 dwc_hc_t * hc,
++			 dwc_otg_qtd_t * qtd, dwc_otg_halt_status_e halt_status)
++{
++	if (hcd->core_if->dma_enable) {
++		release_channel(hcd, hc, qtd, halt_status);
++		return;
++	}
++
++	/* Slave mode processing... */
++	dwc_otg_hc_halt(hcd->core_if, hc, halt_status);
++
++	if (hc->halt_on_queue) {
++		gintmsk_data_t gintmsk = {.d32 = 0 };
++		dwc_otg_core_global_regs_t *global_regs;
++		global_regs = hcd->core_if->core_global_regs;
++
++		if (hc->ep_type == DWC_OTG_EP_TYPE_CONTROL ||
++		    hc->ep_type == DWC_OTG_EP_TYPE_BULK) {
++			/*
++			 * Make sure the Non-periodic Tx FIFO empty interrupt
++			 * is enabled so that the non-periodic schedule will
++			 * be processed.
++			 */
++			gintmsk.b.nptxfempty = 1;
++			if (fiq_enable) {
++				local_fiq_disable();
++				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
++				DWC_MODIFY_REG32(&global_regs->gintmsk, 0, gintmsk.d32);
++				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
++				local_fiq_enable();
++			} else {
++				DWC_MODIFY_REG32(&global_regs->gintmsk, 0, gintmsk.d32);
++			}
++		} else {
++			/*
++			 * Move the QH from the periodic queued schedule to
++			 * the periodic assigned schedule. This allows the
++			 * halt to be queued when the periodic schedule is
++			 * processed.
++			 */
++			DWC_LIST_MOVE_HEAD(&hcd->periodic_sched_assigned,
++					   &hc->qh->qh_list_entry);
++
++			/*
++			 * Make sure the Periodic Tx FIFO Empty interrupt is
++			 * enabled so that the periodic schedule will be
++			 * processed.
++			 */
++			gintmsk.b.ptxfempty = 1;
++			if (fiq_enable) {
++				local_fiq_disable();
++				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
++				DWC_MODIFY_REG32(&global_regs->gintmsk, 0, gintmsk.d32);
++				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
++				local_fiq_enable();
++			} else {
++				DWC_MODIFY_REG32(&global_regs->gintmsk, 0, gintmsk.d32);
++			}
++		}
++	}
++}
++
++/**
++ * Performs common cleanup for non-periodic transfers after a Transfer
++ * Complete interrupt. This function should be called after any endpoint type
++ * specific handling is finished to release the host channel.
++ */
++static void complete_non_periodic_xfer(dwc_otg_hcd_t * hcd,
++				       dwc_hc_t * hc,
++				       dwc_otg_hc_regs_t * hc_regs,
++				       dwc_otg_qtd_t * qtd,
++				       dwc_otg_halt_status_e halt_status)
++{
++	hcint_data_t hcint;
++
++	qtd->error_count = 0;
++
++	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++	if (hcint.b.nyet) {
++		/*
++		 * Got a NYET on the last transaction of the transfer. This
++		 * means that the endpoint should be in the PING state at the
++		 * beginning of the next transfer.
++		 */
++		hc->qh->ping_state = 1;
++		clear_hc_int(hc_regs, nyet);
++	}
++
++	/*
++	 * Always halt and release the host channel to make it available for
++	 * more transfers. There may still be more phases for a control
++	 * transfer or more data packets for a bulk transfer at this point,
++	 * but the host channel is still halted. A channel will be reassigned
++	 * to the transfer when the non-periodic schedule is processed after
++	 * the channel is released. This allows transactions to be queued
++	 * properly via dwc_otg_hcd_queue_transactions, which also enables the
++	 * Tx FIFO Empty interrupt if necessary.
++	 */
++	if (hc->ep_is_in) {
++		/*
++		 * IN transfers in Slave mode require an explicit disable to
++		 * halt the channel. (In DMA mode, this call simply releases
++		 * the channel.)
++		 */
++		halt_channel(hcd, hc, qtd, halt_status);
++	} else {
++		/*
++		 * The channel is automatically disabled by the core for OUT
++		 * transfers in Slave mode.
++		 */
++		release_channel(hcd, hc, qtd, halt_status);
++	}
++}
++
++/**
++ * Performs common cleanup for periodic transfers after a Transfer Complete
++ * interrupt. This function should be called after any endpoint type specific
++ * handling is finished to release the host channel.
++ */
++static void complete_periodic_xfer(dwc_otg_hcd_t * hcd,
++				   dwc_hc_t * hc,
++				   dwc_otg_hc_regs_t * hc_regs,
++				   dwc_otg_qtd_t * qtd,
++				   dwc_otg_halt_status_e halt_status)
++{
++	hctsiz_data_t hctsiz;
++	qtd->error_count = 0;
++
++	hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
++	if (!hc->ep_is_in || hctsiz.b.pktcnt == 0) {
++		/* Core halts channel in these cases. */
++		release_channel(hcd, hc, qtd, halt_status);
++	} else {
++		/* Flush any outstanding requests from the Tx queue. */
++		halt_channel(hcd, hc, qtd, halt_status);
++	}
++}
++
++static int32_t handle_xfercomp_isoc_split_in(dwc_otg_hcd_t * hcd,
++					     dwc_hc_t * hc,
++					     dwc_otg_hc_regs_t * hc_regs,
++					     dwc_otg_qtd_t * qtd)
++{
++	uint32_t len;
++	struct dwc_otg_hcd_iso_packet_desc *frame_desc;
++	frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
++
++	len = get_actual_xfer_length(hc, hc_regs, qtd,
++				     DWC_OTG_HC_XFER_COMPLETE, NULL);
++
++	if (!len) {
++		qtd->complete_split = 0;
++		qtd->isoc_split_offset = 0;
++		return 0;
++	}
++	frame_desc->actual_length += len;
++
++	if (hc->align_buff && len)
++		dwc_memcpy(qtd->urb->buf + frame_desc->offset +
++			   qtd->isoc_split_offset, hc->qh->dw_align_buf, len);
++	qtd->isoc_split_offset += len;
++
++	if (frame_desc->length == frame_desc->actual_length) {
++		frame_desc->status = 0;
++		qtd->isoc_frame_index++;
++		qtd->complete_split = 0;
++		qtd->isoc_split_offset = 0;
++	}
++
++	if (qtd->isoc_frame_index == qtd->urb->packet_count) {
++		hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
++		release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
++	} else {
++		release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
++	}
++
++	return 1;		/* Indicates that channel released */
++}
++
++/**
++ * Handles a host channel Transfer Complete interrupt. This handler may be
++ * called in either DMA mode or Slave mode.
++ */
++static int32_t handle_hc_xfercomp_intr(dwc_otg_hcd_t * hcd,
++				       dwc_hc_t * hc,
++				       dwc_otg_hc_regs_t * hc_regs,
++				       dwc_otg_qtd_t * qtd)
++{
++	int urb_xfer_done;
++	dwc_otg_halt_status_e halt_status = DWC_OTG_HC_XFER_COMPLETE;
++	dwc_otg_hcd_urb_t *urb = qtd->urb;
++	int pipe_type = dwc_otg_hcd_get_pipe_type(&urb->pipe_info);
++
++	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
++		    "Transfer Complete--\n", hc->hc_num);
++
++	if (hcd->core_if->dma_desc_enable) {
++		dwc_otg_hcd_complete_xfer_ddma(hcd, hc, hc_regs, halt_status);
++		if (pipe_type == UE_ISOCHRONOUS) {
++			/* Do not disable the interrupt, just clear it */
++			clear_hc_int(hc_regs, xfercomp);
++			return 1;
++		}
++		goto handle_xfercomp_done;
++	}
++
++	/*
++	 * Handle xfer complete on CSPLIT.
++	 */
++
++	if (hc->qh->do_split) {
++		if ((hc->ep_type == DWC_OTG_EP_TYPE_ISOC) && hc->ep_is_in
++		    && hcd->core_if->dma_enable) {
++			if (qtd->complete_split
++			    && handle_xfercomp_isoc_split_in(hcd, hc, hc_regs,
++							     qtd))
++				goto handle_xfercomp_done;
++		} else {
++			qtd->complete_split = 0;
++		}
++	}
++
++	/* Update the QTD and URB states. */
++	switch (pipe_type) {
++	case UE_CONTROL:
++		switch (qtd->control_phase) {
++		case DWC_OTG_CONTROL_SETUP:
++			if (urb->length > 0) {
++				qtd->control_phase = DWC_OTG_CONTROL_DATA;
++			} else {
++				qtd->control_phase = DWC_OTG_CONTROL_STATUS;
++			}
++			DWC_DEBUGPL(DBG_HCDV,
++				    "  Control setup transaction done\n");
++			halt_status = DWC_OTG_HC_XFER_COMPLETE;
++			break;
++		case DWC_OTG_CONTROL_DATA:{
++				urb_xfer_done =
++				    update_urb_state_xfer_comp(hc, hc_regs, urb,
++							       qtd);
++				if (urb_xfer_done) {
++					qtd->control_phase =
++					    DWC_OTG_CONTROL_STATUS;
++					DWC_DEBUGPL(DBG_HCDV,
++						    "  Control data transfer done\n");
++				} else {
++					dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
++				}
++				halt_status = DWC_OTG_HC_XFER_COMPLETE;
++				break;
++			}
++		case DWC_OTG_CONTROL_STATUS:
++			DWC_DEBUGPL(DBG_HCDV, "  Control transfer complete\n");
++			if (urb->status == -DWC_E_IN_PROGRESS) {
++				urb->status = 0;
++			}
++			hcd->fops->complete(hcd, urb->priv, urb, urb->status);
++			halt_status = DWC_OTG_HC_XFER_URB_COMPLETE;
++			break;
++		}
++
++		complete_non_periodic_xfer(hcd, hc, hc_regs, qtd, halt_status);
++		break;
++	case UE_BULK:
++		DWC_DEBUGPL(DBG_HCDV, "  Bulk transfer complete\n");
++		urb_xfer_done =
++		    update_urb_state_xfer_comp(hc, hc_regs, urb, qtd);
++		if (urb_xfer_done) {
++			hcd->fops->complete(hcd, urb->priv, urb, urb->status);
++			halt_status = DWC_OTG_HC_XFER_URB_COMPLETE;
++		} else {
++			halt_status = DWC_OTG_HC_XFER_COMPLETE;
++		}
++
++		dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
++		complete_non_periodic_xfer(hcd, hc, hc_regs, qtd, halt_status);
++		break;
++	case UE_INTERRUPT:
++		DWC_DEBUGPL(DBG_HCDV, "  Interrupt transfer complete\n");
++		urb_xfer_done =
++			update_urb_state_xfer_comp(hc, hc_regs, urb, qtd);
++
++		/*
++		 * Interrupt URB is done on the first transfer complete
++		 * interrupt.
++		 */
++		if (urb_xfer_done) {
++				hcd->fops->complete(hcd, urb->priv, urb, urb->status);
++				halt_status = DWC_OTG_HC_XFER_URB_COMPLETE;
++		} else {
++				halt_status = DWC_OTG_HC_XFER_COMPLETE;
++		}
++
++		dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
++		complete_periodic_xfer(hcd, hc, hc_regs, qtd, halt_status);
++		break;
++	case UE_ISOCHRONOUS:
++		DWC_DEBUGPL(DBG_HCDV, "  Isochronous transfer complete\n");
++		if (qtd->isoc_split_pos == DWC_HCSPLIT_XACTPOS_ALL) {
++			halt_status =
++			    update_isoc_urb_state(hcd, hc, hc_regs, qtd,
++						  DWC_OTG_HC_XFER_COMPLETE);
++		}
++		complete_periodic_xfer(hcd, hc, hc_regs, qtd, halt_status);
++		break;
++	}
++
++handle_xfercomp_done:
++	disable_hc_int(hc_regs, xfercompl);
++
++	return 1;
++}
++
++/**
++ * Handles a host channel STALL interrupt. This handler may be called in
++ * either DMA mode or Slave mode.
++ */
++static int32_t handle_hc_stall_intr(dwc_otg_hcd_t * hcd,
++				    dwc_hc_t * hc,
++				    dwc_otg_hc_regs_t * hc_regs,
++				    dwc_otg_qtd_t * qtd)
++{
++	dwc_otg_hcd_urb_t *urb = qtd->urb;
++	int pipe_type = dwc_otg_hcd_get_pipe_type(&urb->pipe_info);
++
++	DWC_DEBUGPL(DBG_HCD, "--Host Channel %d Interrupt: "
++		    "STALL Received--\n", hc->hc_num);
++
++	if (hcd->core_if->dma_desc_enable) {
++		dwc_otg_hcd_complete_xfer_ddma(hcd, hc, hc_regs, DWC_OTG_HC_XFER_STALL);
++		goto handle_stall_done;
++	}
++
++	if (pipe_type == UE_CONTROL) {
++		hcd->fops->complete(hcd, urb->priv, urb, -DWC_E_PIPE);
++	}
++
++	if (pipe_type == UE_BULK || pipe_type == UE_INTERRUPT) {
++		hcd->fops->complete(hcd, urb->priv, urb, -DWC_E_PIPE);
++		/*
++		 * USB protocol requires resetting the data toggle for bulk
++		 * and interrupt endpoints when a CLEAR_FEATURE(ENDPOINT_HALT)
++		 * setup command is issued to the endpoint. Anticipate the
++		 * CLEAR_FEATURE command since a STALL has occurred and reset
++		 * the data toggle now.
++		 */
++		hc->qh->data_toggle = 0;
++	}
++
++	halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_STALL);
++
++handle_stall_done:
++	disable_hc_int(hc_regs, stall);
++
++	return 1;
++}
++
++/*
++ * Updates the state of the URB when a transfer has been stopped due to an
++ * abnormal condition before the transfer completes. Modifies the
++ * actual_length field of the URB to reflect the number of bytes that have
++ * actually been transferred via the host channel.
++ */
++static void update_urb_state_xfer_intr(dwc_hc_t * hc,
++				       dwc_otg_hc_regs_t * hc_regs,
++				       dwc_otg_hcd_urb_t * urb,
++				       dwc_otg_qtd_t * qtd,
++				       dwc_otg_halt_status_e halt_status)
++{
++	uint32_t bytes_transferred = get_actual_xfer_length(hc, hc_regs, qtd,
++							    halt_status, NULL);
++
++	if (urb->actual_length + bytes_transferred > urb->length) {
++		printk_once(KERN_DEBUG "dwc_otg: DEVICE:%03d : %s:%d:trimming xfer length\n",
++			hc->dev_addr, __func__, __LINE__);
++		bytes_transferred = urb->length - urb->actual_length;
++	}
++
++	/* non DWORD-aligned buffer case handling. */
++	if (hc->align_buff && bytes_transferred && hc->ep_is_in) {
++		dwc_memcpy(urb->buf + urb->actual_length, hc->qh->dw_align_buf,
++			   bytes_transferred);
++	}
++
++	urb->actual_length += bytes_transferred;
++
++#ifdef DEBUG
++	{
++		hctsiz_data_t hctsiz;
++		hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
++		DWC_DEBUGPL(DBG_HCDV, "DWC_otg: %s: %s, channel %d\n",
++			    __func__, (hc->ep_is_in ? "IN" : "OUT"),
++			    hc->hc_num);
++		DWC_DEBUGPL(DBG_HCDV, "  hc->start_pkt_count %d\n",
++			    hc->start_pkt_count);
++		DWC_DEBUGPL(DBG_HCDV, "  hctsiz.pktcnt %d\n", hctsiz.b.pktcnt);
++		DWC_DEBUGPL(DBG_HCDV, "  hc->max_packet %d\n", hc->max_packet);
++		DWC_DEBUGPL(DBG_HCDV, "  bytes_transferred %d\n",
++			    bytes_transferred);
++		DWC_DEBUGPL(DBG_HCDV, "  urb->actual_length %d\n",
++			    urb->actual_length);
++		DWC_DEBUGPL(DBG_HCDV, "  urb->transfer_buffer_length %d\n",
++			    urb->length);
++	}
++#endif
++}
++
++/**
++ * Handles a host channel NAK interrupt. This handler may be called in either
++ * DMA mode or Slave mode.
++ */
++static int32_t handle_hc_nak_intr(dwc_otg_hcd_t * hcd,
++				  dwc_hc_t * hc,
++				  dwc_otg_hc_regs_t * hc_regs,
++				  dwc_otg_qtd_t * qtd)
++{
++	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
++		    "NAK Received--\n", hc->hc_num);
++
++	/*
++	 * When we get bulk NAKs then remember this so we holdoff on this qh until
++	 * the beginning of the next frame
++	 */
++	switch(dwc_otg_hcd_get_pipe_type(&qtd->urb->pipe_info)) {
++		case UE_BULK:
++		case UE_CONTROL:
++		if (nak_holdoff && qtd->qh->do_split)
++			hc->qh->nak_frame = dwc_otg_hcd_get_frame_number(hcd);
++	}
++
++	/*
++	 * Handle NAK for IN/OUT SSPLIT/CSPLIT transfers, bulk, control, and
++	 * interrupt.  Re-start the SSPLIT transfer.
++	 */
++	if (hc->do_split) {
++		if (hc->complete_split) {
++			qtd->error_count = 0;
++		}
++		qtd->complete_split = 0;
++		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NAK);
++		goto handle_nak_done;
++	}
++
++	switch (dwc_otg_hcd_get_pipe_type(&qtd->urb->pipe_info)) {
++	case UE_CONTROL:
++	case UE_BULK:
++		if (hcd->core_if->dma_enable && hc->ep_is_in) {
++			/*
++			 * NAK interrupts are enabled on bulk/control IN
++			 * transfers in DMA mode for the sole purpose of
++			 * resetting the error count after a transaction error
++			 * occurs. The core will continue transferring data.
++			 * Disable other interrupts unmasked for the same
++			 * reason.
++			 */
++			disable_hc_int(hc_regs, datatglerr);
++			disable_hc_int(hc_regs, ack);
++			qtd->error_count = 0;
++			goto handle_nak_done;
++		}
++
++		/*
++		 * NAK interrupts normally occur during OUT transfers in DMA
++		 * or Slave mode. For IN transfers, more requests will be
++		 * queued as request queue space is available.
++		 */
++		qtd->error_count = 0;
++
++		if (!hc->qh->ping_state) {
++			update_urb_state_xfer_intr(hc, hc_regs,
++						   qtd->urb, qtd,
++						   DWC_OTG_HC_XFER_NAK);
++			dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
++
++			if (hc->speed == DWC_OTG_EP_SPEED_HIGH)
++				hc->qh->ping_state = 1;
++		}
++
++		/*
++		 * Halt the channel so the transfer can be re-started from
++		 * the appropriate point or the PING protocol will
++		 * start/continue.
++		 */
++		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NAK);
++		break;
++	case UE_INTERRUPT:
++		qtd->error_count = 0;
++		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NAK);
++		break;
++	case UE_ISOCHRONOUS:
++		/* Should never get called for isochronous transfers. */
++		DWC_ASSERT(1, "NACK interrupt for ISOC transfer\n");
++		break;
++	}
++
++handle_nak_done:
++	disable_hc_int(hc_regs, nak);
++
++	return 1;
++}
++
++/**
++ * Handles a host channel ACK interrupt. This interrupt is enabled when
++ * performing the PING protocol in Slave mode, when errors occur during
++ * either Slave mode or DMA mode, and during Start Split transactions.
++ */
++static int32_t handle_hc_ack_intr(dwc_otg_hcd_t * hcd,
++				  dwc_hc_t * hc,
++				  dwc_otg_hc_regs_t * hc_regs,
++				  dwc_otg_qtd_t * qtd)
++{
++	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
++		    "ACK Received--\n", hc->hc_num);
++
++	if (hc->do_split) {
++		/*
++		 * Handle ACK on SSPLIT.
++		 * ACK should not occur in CSPLIT.
++		 */
++		if (!hc->ep_is_in && hc->data_pid_start != DWC_OTG_HC_PID_SETUP) {
++			qtd->ssplit_out_xfer_count = hc->xfer_len;
++		}
++		if (!(hc->ep_type == DWC_OTG_EP_TYPE_ISOC && !hc->ep_is_in)) {
++			/* Don't need complete for isochronous out transfers. */
++			qtd->complete_split = 1;
++		}
++
++		/* ISOC OUT */
++		if (hc->ep_type == DWC_OTG_EP_TYPE_ISOC && !hc->ep_is_in) {
++			switch (hc->xact_pos) {
++			case DWC_HCSPLIT_XACTPOS_ALL:
++				break;
++			case DWC_HCSPLIT_XACTPOS_END:
++				qtd->isoc_split_pos = DWC_HCSPLIT_XACTPOS_ALL;
++				qtd->isoc_split_offset = 0;
++				break;
++			case DWC_HCSPLIT_XACTPOS_BEGIN:
++			case DWC_HCSPLIT_XACTPOS_MID:
++				/*
++				 * For BEGIN or MID, calculate the length for
++				 * the next microframe to determine the correct
++				 * SSPLIT token, either MID or END.
++				 */
++				{
++					struct dwc_otg_hcd_iso_packet_desc
++					*frame_desc;
++
++					frame_desc =
++					    &qtd->urb->
++					    iso_descs[qtd->isoc_frame_index];
++					qtd->isoc_split_offset += 188;
++
++					if ((frame_desc->length -
++					     qtd->isoc_split_offset) <= 188) {
++						qtd->isoc_split_pos =
++						    DWC_HCSPLIT_XACTPOS_END;
++					} else {
++						qtd->isoc_split_pos =
++						    DWC_HCSPLIT_XACTPOS_MID;
++					}
++
++				}
++				break;
++			}
++		} else {
++			halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_ACK);
++		}
++	} else {
++		/*
++		 * An unmasked ACK on a non-split DMA transaction is
++		 * for the sole purpose of resetting error counts. Disable other
++		 * interrupts unmasked for the same reason.
++		 */
++		if(hcd->core_if->dma_enable) {
++			disable_hc_int(hc_regs, datatglerr);
++			disable_hc_int(hc_regs, nak);
++		}
++		qtd->error_count = 0;
++
++		if (hc->qh->ping_state) {
++			hc->qh->ping_state = 0;
++			/*
++			 * Halt the channel so the transfer can be re-started
++			 * from the appropriate point. This only happens in
++			 * Slave mode. In DMA mode, the ping_state is cleared
++			 * when the transfer is started because the core
++			 * automatically executes the PING, then the transfer.
++			 */
++			halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_ACK);
++		}
++	}
++
++	/*
++	 * If the ACK occurred when _not_ in the PING state, let the channel
++	 * continue transferring data after clearing the error count.
++	 */
++
++	disable_hc_int(hc_regs, ack);
++
++	return 1;
++}
++
++/**
++ * Handles a host channel NYET interrupt. This interrupt should only occur on
++ * Bulk and Control OUT endpoints and for complete split transactions. If a
++ * NYET occurs at the same time as a Transfer Complete interrupt, it is
++ * handled in the xfercomp interrupt handler, not here. This handler may be
++ * called in either DMA mode or Slave mode.
++ */
++static int32_t handle_hc_nyet_intr(dwc_otg_hcd_t * hcd,
++				   dwc_hc_t * hc,
++				   dwc_otg_hc_regs_t * hc_regs,
++				   dwc_otg_qtd_t * qtd)
++{
++	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
++		    "NYET Received--\n", hc->hc_num);
++
++	/*
++	 * NYET on CSPLIT
++	 * re-do the CSPLIT immediately on non-periodic
++	 */
++	if (hc->do_split && hc->complete_split) {
++		if (hc->ep_is_in && (hc->ep_type == DWC_OTG_EP_TYPE_ISOC)
++		    && hcd->core_if->dma_enable) {
++			qtd->complete_split = 0;
++			qtd->isoc_split_offset = 0;
++			if (++qtd->isoc_frame_index == qtd->urb->packet_count) {
++				hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
++				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
++			}
++			else
++				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
++			goto handle_nyet_done;
++		}
++
++		if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
++		    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
++			int frnum = dwc_otg_hcd_get_frame_number(hcd);
++
++			// With the FIQ running we only ever see the failed NYET
++			if (dwc_full_frame_num(frnum) !=
++			    dwc_full_frame_num(hc->qh->sched_frame) ||
++			    fiq_fsm_enable) {
++				/*
++				 * No longer in the same full speed frame.
++				 * Treat this as a transaction error.
++				 */
++#if 0
++				/** @todo Fix system performance so this can
++				 * be treated as an error. Right now complete
++				 * splits cannot be scheduled precisely enough
++				 * due to other system activity, so this error
++				 * occurs regularly in Slave mode.
++				 */
++				qtd->error_count++;
++#endif
++				qtd->complete_split = 0;
++				halt_channel(hcd, hc, qtd,
++					     DWC_OTG_HC_XFER_XACT_ERR);
++				/** @todo add support for isoc release */
++				goto handle_nyet_done;
++			}
++		}
++
++		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NYET);
++		goto handle_nyet_done;
++	}
++
++	hc->qh->ping_state = 1;
++	qtd->error_count = 0;
++
++	update_urb_state_xfer_intr(hc, hc_regs, qtd->urb, qtd,
++				   DWC_OTG_HC_XFER_NYET);
++	dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
++
++	/*
++	 * Halt the channel and re-start the transfer so the PING
++	 * protocol will start.
++	 */
++	halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NYET);
++
++handle_nyet_done:
++	disable_hc_int(hc_regs, nyet);
++	return 1;
++}
++
++/**
++ * Handles a host channel babble interrupt. This handler may be called in
++ * either DMA mode or Slave mode.
++ */
++static int32_t handle_hc_babble_intr(dwc_otg_hcd_t * hcd,
++				     dwc_hc_t * hc,
++				     dwc_otg_hc_regs_t * hc_regs,
++				     dwc_otg_qtd_t * qtd)
++{
++	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
++		    "Babble Error--\n", hc->hc_num);
++
++	if (hcd->core_if->dma_desc_enable) {
++		dwc_otg_hcd_complete_xfer_ddma(hcd, hc, hc_regs,
++					       DWC_OTG_HC_XFER_BABBLE_ERR);
++		goto handle_babble_done;
++	}
++
++	if (hc->ep_type != DWC_OTG_EP_TYPE_ISOC) {
++		hcd->fops->complete(hcd, qtd->urb->priv,
++				    qtd->urb, -DWC_E_OVERFLOW);
++		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_BABBLE_ERR);
++	} else {
++		dwc_otg_halt_status_e halt_status;
++		halt_status = update_isoc_urb_state(hcd, hc, hc_regs, qtd,
++						    DWC_OTG_HC_XFER_BABBLE_ERR);
++		halt_channel(hcd, hc, qtd, halt_status);
++	}
++
++handle_babble_done:
++	disable_hc_int(hc_regs, bblerr);
++	return 1;
++}
++
++/**
++ * Handles a host channel AHB error interrupt. This handler is only called in
++ * DMA mode.
++ */
++static int32_t handle_hc_ahberr_intr(dwc_otg_hcd_t * hcd,
++				     dwc_hc_t * hc,
++				     dwc_otg_hc_regs_t * hc_regs,
++				     dwc_otg_qtd_t * qtd)
++{
++	hcchar_data_t hcchar;
++	hcsplt_data_t hcsplt;
++	hctsiz_data_t hctsiz;
++	uint32_t hcdma;
++	char *pipetype, *speed;
++
++	dwc_otg_hcd_urb_t *urb = qtd->urb;
++
++	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
++		    "AHB Error--\n", hc->hc_num);
++
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	hcsplt.d32 = DWC_READ_REG32(&hc_regs->hcsplt);
++	hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
++	hcdma = DWC_READ_REG32(&hc_regs->hcdma);
++
++	DWC_ERROR("AHB ERROR, Channel %d\n", hc->hc_num);
++	DWC_ERROR("  hcchar 0x%08x, hcsplt 0x%08x\n", hcchar.d32, hcsplt.d32);
++	DWC_ERROR("  hctsiz 0x%08x, hcdma 0x%08x\n", hctsiz.d32, hcdma);
++	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD URB Enqueue\n");
++	DWC_ERROR("  Device address: %d\n",
++		  dwc_otg_hcd_get_dev_addr(&urb->pipe_info));
++	DWC_ERROR("  Endpoint: %d, %s\n",
++		  dwc_otg_hcd_get_ep_num(&urb->pipe_info),
++		  (dwc_otg_hcd_is_pipe_in(&urb->pipe_info) ? "IN" : "OUT"));
++
++	switch (dwc_otg_hcd_get_pipe_type(&urb->pipe_info)) {
++	case UE_CONTROL:
++		pipetype = "CONTROL";
++		break;
++	case UE_BULK:
++		pipetype = "BULK";
++		break;
++	case UE_INTERRUPT:
++		pipetype = "INTERRUPT";
++		break;
++	case UE_ISOCHRONOUS:
++		pipetype = "ISOCHRONOUS";
++		break;
++	default:
++		pipetype = "UNKNOWN";
++		break;
++	}
++
++	DWC_ERROR("  Endpoint type: %s\n", pipetype);
++
++	switch (hc->speed) {
++	case DWC_OTG_EP_SPEED_HIGH:
++		speed = "HIGH";
++		break;
++	case DWC_OTG_EP_SPEED_FULL:
++		speed = "FULL";
++		break;
++	case DWC_OTG_EP_SPEED_LOW:
++		speed = "LOW";
++		break;
++	default:
++		speed = "UNKNOWN";
++		break;
++	};
++
++	DWC_ERROR("  Speed: %s\n", speed);
++
++	DWC_ERROR("  Max packet size: %d\n",
++		  dwc_otg_hcd_get_mps(&urb->pipe_info));
++	DWC_ERROR("  Data buffer length: %d\n", urb->length);
++	DWC_ERROR("  Transfer buffer: %p, Transfer DMA: %pad\n",
++		  urb->buf, &urb->dma);
++	DWC_ERROR("  Setup buffer: %p, Setup DMA: %pad\n",
++		  urb->setup_packet, &urb->setup_dma);
++	DWC_ERROR("  Interval: %d\n", urb->interval);
++
++	/* Core haltes the channel for Descriptor DMA mode */
++	if (hcd->core_if->dma_desc_enable) {
++		dwc_otg_hcd_complete_xfer_ddma(hcd, hc, hc_regs,
++					       DWC_OTG_HC_XFER_AHB_ERR);
++		goto handle_ahberr_done;
++	}
++
++	hcd->fops->complete(hcd, urb->priv, urb, -DWC_E_IO);
++
++	/*
++	 * Force a channel halt. Don't call halt_channel because that won't
++	 * write to the HCCHARn register in DMA mode to force the halt.
++	 */
++	dwc_otg_hc_halt(hcd->core_if, hc, DWC_OTG_HC_XFER_AHB_ERR);
++handle_ahberr_done:
++	disable_hc_int(hc_regs, ahberr);
++	return 1;
++}
++
++/**
++ * Handles a host channel transaction error interrupt. This handler may be
++ * called in either DMA mode or Slave mode.
++ */
++static int32_t handle_hc_xacterr_intr(dwc_otg_hcd_t * hcd,
++				      dwc_hc_t * hc,
++				      dwc_otg_hc_regs_t * hc_regs,
++				      dwc_otg_qtd_t * qtd)
++{
++	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
++		    "Transaction Error--\n", hc->hc_num);
++
++	if (hcd->core_if->dma_desc_enable) {
++		dwc_otg_hcd_complete_xfer_ddma(hcd, hc, hc_regs,
++					       DWC_OTG_HC_XFER_XACT_ERR);
++		goto handle_xacterr_done;
++	}
++
++	switch (dwc_otg_hcd_get_pipe_type(&qtd->urb->pipe_info)) {
++	case UE_CONTROL:
++	case UE_BULK:
++		qtd->error_count++;
++		if (!hc->qh->ping_state) {
++
++			update_urb_state_xfer_intr(hc, hc_regs,
++						   qtd->urb, qtd,
++						   DWC_OTG_HC_XFER_XACT_ERR);
++			dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
++			if (!hc->ep_is_in && hc->speed == DWC_OTG_EP_SPEED_HIGH) {
++				hc->qh->ping_state = 1;
++			}
++		}
++
++		/*
++		 * Halt the channel so the transfer can be re-started from
++		 * the appropriate point or the PING protocol will start.
++		 */
++		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_XACT_ERR);
++		break;
++	case UE_INTERRUPT:
++		qtd->error_count++;
++		if (hc->do_split && hc->complete_split) {
++			qtd->complete_split = 0;
++		}
++		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_XACT_ERR);
++		break;
++	case UE_ISOCHRONOUS:
++		{
++			dwc_otg_halt_status_e halt_status;
++			halt_status =
++			    update_isoc_urb_state(hcd, hc, hc_regs, qtd,
++						  DWC_OTG_HC_XFER_XACT_ERR);
++
++			halt_channel(hcd, hc, qtd, halt_status);
++		}
++		break;
++	}
++handle_xacterr_done:
++	disable_hc_int(hc_regs, xacterr);
++
++	return 1;
++}
++
++/**
++ * Handles a host channel frame overrun interrupt. This handler may be called
++ * in either DMA mode or Slave mode.
++ */
++static int32_t handle_hc_frmovrun_intr(dwc_otg_hcd_t * hcd,
++				       dwc_hc_t * hc,
++				       dwc_otg_hc_regs_t * hc_regs,
++				       dwc_otg_qtd_t * qtd)
++{
++	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
++		    "Frame Overrun--\n", hc->hc_num);
++
++	switch (dwc_otg_hcd_get_pipe_type(&qtd->urb->pipe_info)) {
++	case UE_CONTROL:
++	case UE_BULK:
++		break;
++	case UE_INTERRUPT:
++		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_FRAME_OVERRUN);
++		break;
++	case UE_ISOCHRONOUS:
++		{
++			dwc_otg_halt_status_e halt_status;
++			halt_status =
++			    update_isoc_urb_state(hcd, hc, hc_regs, qtd,
++						  DWC_OTG_HC_XFER_FRAME_OVERRUN);
++
++			halt_channel(hcd, hc, qtd, halt_status);
++		}
++		break;
++	}
++
++	disable_hc_int(hc_regs, frmovrun);
++
++	return 1;
++}
++
++/**
++ * Handles a host channel data toggle error interrupt. This handler may be
++ * called in either DMA mode or Slave mode.
++ */
++static int32_t handle_hc_datatglerr_intr(dwc_otg_hcd_t * hcd,
++					 dwc_hc_t * hc,
++					 dwc_otg_hc_regs_t * hc_regs,
++					 dwc_otg_qtd_t * qtd)
++{
++	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
++		"Data Toggle Error on %s transfer--\n",
++		hc->hc_num, (hc->ep_is_in ? "IN" : "OUT"));
++
++	/* Data toggles on split transactions cause the hc to halt.
++	 * restart transfer */
++	if(hc->qh->do_split)
++	{
++		qtd->error_count++;
++		dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
++		update_urb_state_xfer_intr(hc, hc_regs,
++			qtd->urb, qtd, DWC_OTG_HC_XFER_XACT_ERR);
++		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_XACT_ERR);
++	} else if (hc->ep_is_in) {
++		/* An unmasked data toggle error on a non-split DMA transaction is
++		 * for the sole purpose of resetting error counts. Disable other
++		 * interrupts unmasked for the same reason.
++		 */
++		if(hcd->core_if->dma_enable) {
++			disable_hc_int(hc_regs, ack);
++			disable_hc_int(hc_regs, nak);
++		}
++		qtd->error_count = 0;
++	}
++
++	disable_hc_int(hc_regs, datatglerr);
++
++	return 1;
++}
++
++#ifdef DEBUG
++/**
++ * This function is for debug only. It checks that a valid halt status is set
++ * and that HCCHARn.chdis is clear. If there's a problem, corrective action is
++ * taken and a warning is issued.
++ * @return 1 if halt status is ok, 0 otherwise.
++ */
++static inline int halt_status_ok(dwc_otg_hcd_t * hcd,
++				 dwc_hc_t * hc,
++				 dwc_otg_hc_regs_t * hc_regs,
++				 dwc_otg_qtd_t * qtd)
++{
++	hcchar_data_t hcchar;
++	hctsiz_data_t hctsiz;
++	hcint_data_t hcint;
++	hcintmsk_data_t hcintmsk;
++	hcsplt_data_t hcsplt;
++
++	if (hc->halt_status == DWC_OTG_HC_XFER_NO_HALT_STATUS) {
++		/*
++		 * This code is here only as a check. This condition should
++		 * never happen. Ignore the halt if it does occur.
++		 */
++		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++		hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
++		hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++		hcintmsk.d32 = DWC_READ_REG32(&hc_regs->hcintmsk);
++		hcsplt.d32 = DWC_READ_REG32(&hc_regs->hcsplt);
++		DWC_WARN
++		    ("%s: hc->halt_status == DWC_OTG_HC_XFER_NO_HALT_STATUS, "
++		     "channel %d, hcchar 0x%08x, hctsiz 0x%08x, "
++		     "hcint 0x%08x, hcintmsk 0x%08x, "
++		     "hcsplt 0x%08x, qtd->complete_split %d\n", __func__,
++		     hc->hc_num, hcchar.d32, hctsiz.d32, hcint.d32,
++		     hcintmsk.d32, hcsplt.d32, qtd->complete_split);
++
++		DWC_WARN("%s: no halt status, channel %d, ignoring interrupt\n",
++			 __func__, hc->hc_num);
++		DWC_WARN("\n");
++		clear_hc_int(hc_regs, chhltd);
++		return 0;
++	}
++
++	/*
++	 * This code is here only as a check. hcchar.chdis should
++	 * never be set when the halt interrupt occurs. Halt the
++	 * channel again if it does occur.
++	 */
++	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
++	if (hcchar.b.chdis) {
++		DWC_WARN("%s: hcchar.chdis set unexpectedly, "
++			 "hcchar 0x%08x, trying to halt again\n",
++			 __func__, hcchar.d32);
++		clear_hc_int(hc_regs, chhltd);
++		hc->halt_pending = 0;
++		halt_channel(hcd, hc, qtd, hc->halt_status);
++		return 0;
++	}
++
++	return 1;
++}
++#endif
++
++/**
++ * Handles a host Channel Halted interrupt in DMA mode. This handler
++ * determines the reason the channel halted and proceeds accordingly.
++ */
++static void handle_hc_chhltd_intr_dma(dwc_otg_hcd_t * hcd,
++				      dwc_hc_t * hc,
++				      dwc_otg_hc_regs_t * hc_regs,
++				      dwc_otg_qtd_t * qtd)
++{
++	int out_nak_enh = 0;
++	hcint_data_t hcint;
++	hcintmsk_data_t hcintmsk;
++	/* For core with OUT NAK enhancement, the flow for high-
++	 * speed CONTROL/BULK OUT is handled a little differently.
++	 */
++	if (hcd->core_if->snpsid >= OTG_CORE_REV_2_71a) {
++		if (hc->speed == DWC_OTG_EP_SPEED_HIGH && !hc->ep_is_in &&
++		    (hc->ep_type == DWC_OTG_EP_TYPE_CONTROL ||
++		     hc->ep_type == DWC_OTG_EP_TYPE_BULK)) {
++			out_nak_enh = 1;
++		}
++	}
++
++	if (hc->halt_status == DWC_OTG_HC_XFER_URB_DEQUEUE ||
++	    (hc->halt_status == DWC_OTG_HC_XFER_AHB_ERR
++	     && !hcd->core_if->dma_desc_enable)) {
++		/*
++		 * Just release the channel. A dequeue can happen on a
++		 * transfer timeout. In the case of an AHB Error, the channel
++		 * was forced to halt because there's no way to gracefully
++		 * recover.
++		 */
++		if (hcd->core_if->dma_desc_enable)
++			dwc_otg_hcd_complete_xfer_ddma(hcd, hc, hc_regs,
++						       hc->halt_status);
++		else
++			release_channel(hcd, hc, qtd, hc->halt_status);
++		return;
++	}
++
++	/* Read the HCINTn register to determine the cause for the halt. */
++
++	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++	hcintmsk.d32 = DWC_READ_REG32(&hc_regs->hcintmsk);
++
++	if (hcint.b.xfercomp) {
++		/** @todo This is here because of a possible hardware bug.  Spec
++		 * says that on SPLIT-ISOC OUT transfers in DMA mode that a HALT
++		 * interrupt w/ACK bit set should occur, but I only see the
++		 * XFERCOMP bit, even with it masked out.  This is a workaround
++		 * for that behavior.  Should fix this when hardware is fixed.
++		 */
++		if (hc->ep_type == DWC_OTG_EP_TYPE_ISOC && !hc->ep_is_in) {
++			handle_hc_ack_intr(hcd, hc, hc_regs, qtd);
++		}
++		handle_hc_xfercomp_intr(hcd, hc, hc_regs, qtd);
++	} else if (hcint.b.stall) {
++		handle_hc_stall_intr(hcd, hc, hc_regs, qtd);
++	} else if (hcint.b.xacterr && !hcd->core_if->dma_desc_enable) {
++		if (out_nak_enh) {
++			if (hcint.b.nyet || hcint.b.nak || hcint.b.ack) {
++				DWC_DEBUGPL(DBG_HCD, "XactErr with NYET/NAK/ACK\n");
++				qtd->error_count = 0;
++			} else {
++				DWC_DEBUGPL(DBG_HCD, "XactErr without NYET/NAK/ACK\n");
++			}
++		}
++
++		/*
++		 * Must handle xacterr before nak or ack. Could get a xacterr
++		 * at the same time as either of these on a BULK/CONTROL OUT
++		 * that started with a PING. The xacterr takes precedence.
++		 */
++		handle_hc_xacterr_intr(hcd, hc, hc_regs, qtd);
++	} else if (hcint.b.xcs_xact && hcd->core_if->dma_desc_enable) {
++		handle_hc_xacterr_intr(hcd, hc, hc_regs, qtd);
++	} else if (hcint.b.ahberr && hcd->core_if->dma_desc_enable) {
++		handle_hc_ahberr_intr(hcd, hc, hc_regs, qtd);
++	} else if (hcint.b.bblerr) {
++		handle_hc_babble_intr(hcd, hc, hc_regs, qtd);
++	} else if (hcint.b.frmovrun) {
++		handle_hc_frmovrun_intr(hcd, hc, hc_regs, qtd);
++	} else if (hcint.b.datatglerr) {
++		handle_hc_datatglerr_intr(hcd, hc, hc_regs, qtd);
++	} else if (!out_nak_enh) {
++		if (hcint.b.nyet) {
++			/*
++			 * Must handle nyet before nak or ack. Could get a nyet at the
++			 * same time as either of those on a BULK/CONTROL OUT that
++			 * started with a PING. The nyet takes precedence.
++			 */
++			handle_hc_nyet_intr(hcd, hc, hc_regs, qtd);
++		} else if (hcint.b.nak && !hcintmsk.b.nak) {
++			/*
++			 * If nak is not masked, it's because a non-split IN transfer
++			 * is in an error state. In that case, the nak is handled by
++			 * the nak interrupt handler, not here. Handle nak here for
++			 * BULK/CONTROL OUT transfers, which halt on a NAK to allow
++			 * rewinding the buffer pointer.
++			 */
++			handle_hc_nak_intr(hcd, hc, hc_regs, qtd);
++		} else if (hcint.b.ack && !hcintmsk.b.ack) {
++			/*
++			 * If ack is not masked, it's because a non-split IN transfer
++			 * is in an error state. In that case, the ack is handled by
++			 * the ack interrupt handler, not here. Handle ack here for
++			 * split transfers. Start splits halt on ACK.
++			 */
++			handle_hc_ack_intr(hcd, hc, hc_regs, qtd);
++		} else {
++			if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
++			    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
++				/*
++				 * A periodic transfer halted with no other channel
++				 * interrupts set. Assume it was halted by the core
++				 * because it could not be completed in its scheduled
++				 * (micro)frame.
++				 */
++#ifdef DEBUG
++				DWC_PRINTF
++				    ("%s: Halt channel %d (assume incomplete periodic transfer)\n",
++				     __func__, hc->hc_num);
++#endif
++				halt_channel(hcd, hc, qtd,
++					     DWC_OTG_HC_XFER_PERIODIC_INCOMPLETE);
++			} else {
++				DWC_ERROR
++				    ("%s: Channel %d, DMA Mode -- ChHltd set, but reason "
++				     "for halting is unknown, hcint 0x%08x, intsts 0x%08x\n",
++				     __func__, hc->hc_num, hcint.d32,
++				     DWC_READ_REG32(&hcd->
++						    core_if->core_global_regs->
++						    gintsts));
++				/* Failthrough: use 3-strikes rule */
++				qtd->error_count++;
++				dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
++				update_urb_state_xfer_intr(hc, hc_regs,
++					   qtd->urb, qtd, DWC_OTG_HC_XFER_XACT_ERR);
++				halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_XACT_ERR);
++			}
++
++		}
++	} else {
++		DWC_PRINTF("NYET/NAK/ACK/other in non-error case, 0x%08x\n",
++			   hcint.d32);
++		/* Failthrough: use 3-strikes rule */
++		qtd->error_count++;
++		dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
++		update_urb_state_xfer_intr(hc, hc_regs,
++			   qtd->urb, qtd, DWC_OTG_HC_XFER_XACT_ERR);
++		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_XACT_ERR);
++	}
++}
++
++/**
++ * Handles a host channel Channel Halted interrupt.
++ *
++ * In slave mode, this handler is called only when the driver specifically
++ * requests a halt. This occurs during handling other host channel interrupts
++ * (e.g. nak, xacterr, stall, nyet, etc.).
++ *
++ * In DMA mode, this is the interrupt that occurs when the core has finished
++ * processing a transfer on a channel. Other host channel interrupts (except
++ * ahberr) are disabled in DMA mode.
++ */
++static int32_t handle_hc_chhltd_intr(dwc_otg_hcd_t * hcd,
++				     dwc_hc_t * hc,
++				     dwc_otg_hc_regs_t * hc_regs,
++				     dwc_otg_qtd_t * qtd)
++{
++	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
++		    "Channel Halted--\n", hc->hc_num);
++
++	if (hcd->core_if->dma_enable) {
++		handle_hc_chhltd_intr_dma(hcd, hc, hc_regs, qtd);
++	} else {
++#ifdef DEBUG
++		if (!halt_status_ok(hcd, hc, hc_regs, qtd)) {
++			return 1;
++		}
++#endif
++		release_channel(hcd, hc, qtd, hc->halt_status);
++	}
++
++	return 1;
++}
++
++
++/**
++ * dwc_otg_fiq_unmangle_isoc() - Update the iso_frame_desc structure on
++ * FIQ transfer completion
++ * @hcd:	Pointer to dwc_otg_hcd struct
++ * @num:	Host channel number
++ *
++ * 1. Un-mangle the status as recorded in each iso_frame_desc status
++ * 2. Copy it from the dwc_otg_urb into the real URB
++ */
++static void dwc_otg_fiq_unmangle_isoc(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh, dwc_otg_qtd_t *qtd, uint32_t num)
++{
++	struct dwc_otg_hcd_urb *dwc_urb = qtd->urb;
++	int nr_frames = dwc_urb->packet_count;
++	int i;
++	hcint_data_t frame_hcint;
++
++	for (i = 0; i < nr_frames; i++) {
++		frame_hcint.d32 = dwc_urb->iso_descs[i].status;
++		if (frame_hcint.b.xfercomp) {
++			dwc_urb->iso_descs[i].status = 0;
++			dwc_urb->actual_length += dwc_urb->iso_descs[i].actual_length;
++		} else if (frame_hcint.b.frmovrun) {
++			if (qh->ep_is_in)
++				dwc_urb->iso_descs[i].status = -DWC_E_NO_STREAM_RES;
++			else
++				dwc_urb->iso_descs[i].status = -DWC_E_COMMUNICATION;
++			dwc_urb->error_count++;
++			dwc_urb->iso_descs[i].actual_length = 0;
++		} else if (frame_hcint.b.xacterr) {
++			dwc_urb->iso_descs[i].status = -DWC_E_PROTOCOL;
++			dwc_urb->error_count++;
++			dwc_urb->iso_descs[i].actual_length = 0;
++		} else if (frame_hcint.b.bblerr) {
++			dwc_urb->iso_descs[i].status = -DWC_E_OVERFLOW;
++			dwc_urb->error_count++;
++			dwc_urb->iso_descs[i].actual_length = 0;
++		} else {
++			/* Something went wrong */
++			dwc_urb->iso_descs[i].status = -1;
++			dwc_urb->iso_descs[i].actual_length = 0;
++			dwc_urb->error_count++;
++		}
++	}
++	qh->sched_frame = dwc_frame_num_inc(qh->sched_frame, qh->interval * (nr_frames - 1));
++
++	//printk_ratelimited(KERN_INFO "%s: HS isochronous of %d/%d frames with %d errors complete\n",
++	//			__FUNCTION__, i, dwc_urb->packet_count, dwc_urb->error_count);
++}
++
++/**
++ * dwc_otg_fiq_unsetup_per_dma() - Remove data from bounce buffers for split transactions
++ * @hcd:	Pointer to dwc_otg_hcd struct
++ * @num:	Host channel number
++ *
++ * Copies data from the FIQ bounce buffers into the URB's transfer buffer. Does not modify URB state.
++ * Returns total length of data or -1 if the buffers were not used.
++ *
++ */
++static int dwc_otg_fiq_unsetup_per_dma(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh, dwc_otg_qtd_t *qtd, uint32_t num)
++{
++	dwc_hc_t *hc = qh->channel;
++	struct fiq_dma_channel *split_dma = hcd->fiq_dmab;
++	struct fiq_channel_state *st = &hcd->fiq_state->channel[num];
++	uint8_t *ptr = NULL;
++	int index = 0, len = 0;
++	int i = 0;
++	if (hc->ep_is_in) {
++		/* Copy data out of the DMA bounce buffers to the URB's buffer.
++		 * The align_buf is ignored as this is ignored on FSM enqueue. */
++		ptr = qtd->urb->buf;
++		if (qh->ep_type == UE_ISOCHRONOUS) {
++			/* Isoc IN transactions - grab the offset of the iso_frame_desc into the URB transfer buffer */
++			index = qtd->isoc_frame_index;
++			ptr += qtd->urb->iso_descs[index].offset;
++		} else {
++			/* Need to increment by actual_length for interrupt IN */
++			ptr += qtd->urb->actual_length;
++		}
++
++		for (i = 0; i < st->dma_info.index; i++) {
++			len += st->dma_info.slot_len[i];
++			dwc_memcpy(ptr, &split_dma[num].index[i].buf[0], st->dma_info.slot_len[i]);
++			ptr += st->dma_info.slot_len[i];
++		}
++		return len;
++	} else {
++		/* OUT endpoints - nothing to do. */
++		return -1;
++	}
++
++}
++/**
++ * dwc_otg_hcd_handle_hc_fsm() - handle an unmasked channel interrupt
++ * 				 from a channel handled in the FIQ
++ * @hcd:	Pointer to dwc_otg_hcd struct
++ * @num:	Host channel number
++ *
++ * If a host channel interrupt was received by the IRQ and this was a channel
++ * used by the FIQ, the execution flow for transfer completion is substantially
++ * different from the normal (messy) path. This function and its friends handles
++ * channel cleanup and transaction completion from a FIQ transaction.
++ */
++static void dwc_otg_hcd_handle_hc_fsm(dwc_otg_hcd_t *hcd, uint32_t num)
++{
++	struct fiq_channel_state *st = &hcd->fiq_state->channel[num];
++	dwc_hc_t *hc = hcd->hc_ptr_array[num];
++	dwc_otg_qtd_t *qtd;
++	dwc_otg_hc_regs_t *hc_regs = hcd->core_if->host_if->hc_regs[num];
++	hcint_data_t hcint = hcd->fiq_state->channel[num].hcint_copy;
++	hctsiz_data_t hctsiz = hcd->fiq_state->channel[num].hctsiz_copy;
++	int hostchannels  = 0;
++	fiq_print(FIQDBG_INT, hcd->fiq_state, "OUT %01d %01d ", num , st->fsm);
++
++	hostchannels = hcd->available_host_channels;
++	if (hc->halt_pending) {
++		/* Dequeue: The FIQ was allowed to complete the transfer but state has been cleared. */
++		if (hc->qh && st->fsm == FIQ_NP_SPLIT_DONE &&
++				hcint.b.xfercomp && hc->qh->ep_type == UE_BULK) {
++			if (hctsiz.b.pid == DWC_HCTSIZ_DATA0) {
++				hc->qh->data_toggle = DWC_OTG_HC_PID_DATA1;
++			} else {
++				hc->qh->data_toggle = DWC_OTG_HC_PID_DATA0;
++			}
++		}
++		release_channel(hcd, hc, NULL, hc->halt_status);
++		return;
++	}
++
++	qtd = DWC_CIRCLEQ_FIRST(&hc->qh->qtd_list);
++	switch (st->fsm) {
++	case FIQ_TEST:
++		break;
++
++	case FIQ_DEQUEUE_ISSUED:
++		/* Handled above, but keep for posterity */
++		release_channel(hcd, hc, NULL, hc->halt_status);
++		break;
++
++	case FIQ_NP_SPLIT_DONE:
++		/* Nonperiodic transaction complete. */
++		if (!hc->ep_is_in) {
++			qtd->ssplit_out_xfer_count = hc->xfer_len;
++		}
++		if (hcint.b.xfercomp) {
++			handle_hc_xfercomp_intr(hcd, hc, hc_regs, qtd);
++		} else if (hcint.b.nak) {
++			handle_hc_nak_intr(hcd, hc, hc_regs, qtd);
++		} else {
++			DWC_WARN("Unexpected IRQ state on FSM transaction:"
++					"dev_addr=%d ep=%d fsm=%d, hcint=0x%08x\n",
++				hc->dev_addr, hc->ep_num, st->fsm, hcint.d32);
++			release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
++		}
++		break;
++
++	case FIQ_NP_SPLIT_HS_ABORTED:
++		/* A HS abort is a 3-strikes on the HS bus at any point in the transaction.
++		 * Normally a CLEAR_TT_BUFFER hub command would be required: we can't do that
++		 * because there's no guarantee which order a non-periodic split happened in.
++		 * We could end up clearing a perfectly good transaction out of the buffer.
++		 */
++		if (hcint.b.xacterr) {
++			qtd->error_count += st->nr_errors;
++			handle_hc_xacterr_intr(hcd, hc, hc_regs, qtd);
++		} else if (hcint.b.ahberr) {
++			handle_hc_ahberr_intr(hcd, hc, hc_regs, qtd);
++		} else {
++			DWC_WARN("Unexpected IRQ state on FSM transaction:"
++					"dev_addr=%d ep=%d fsm=%d, hcint=0x%08x\n",
++				hc->dev_addr, hc->ep_num, st->fsm, hcint.d32);
++			release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
++		}
++		break;
++
++	case FIQ_NP_SPLIT_LS_ABORTED:
++		/* A few cases can cause this - either an unknown state on a SSPLIT or
++		 * STALL/data toggle error response on a CSPLIT */
++		if (hcint.b.stall) {
++			handle_hc_stall_intr(hcd, hc, hc_regs, qtd);
++		} else if (hcint.b.datatglerr) {
++			handle_hc_datatglerr_intr(hcd, hc, hc_regs, qtd);
++		} else if (hcint.b.bblerr) {
++			handle_hc_babble_intr(hcd, hc, hc_regs, qtd);
++		} else if (hcint.b.ahberr) {
++			handle_hc_ahberr_intr(hcd, hc, hc_regs, qtd);
++		} else {
++			DWC_WARN("Unexpected IRQ state on FSM transaction:"
++					"dev_addr=%d ep=%d fsm=%d, hcint=0x%08x\n",
++				hc->dev_addr, hc->ep_num, st->fsm, hcint.d32);
++			release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
++		}
++		break;
++
++	case FIQ_PER_SPLIT_DONE:
++		/* Isoc IN or Interrupt IN/OUT */
++
++		/* Flow control here is different from the normal execution by the driver.
++		* We need to completely ignore most of the driver's method of handling
++		* split transactions and do it ourselves.
++		*/
++		if (hc->ep_type == UE_INTERRUPT) {
++			if (hcint.b.nak) {
++					handle_hc_nak_intr(hcd, hc, hc_regs, qtd);
++			} else if (hc->ep_is_in) {
++				int len;
++				len = dwc_otg_fiq_unsetup_per_dma(hcd, hc->qh, qtd, num);
++				//printk(KERN_NOTICE "FIQ Transaction: hc=%d len=%d urb_len = %d\n", num, len, qtd->urb->length);
++				qtd->urb->actual_length += len;
++				if (qtd->urb->actual_length >= qtd->urb->length) {
++					qtd->urb->status = 0;
++					hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, qtd->urb->status);
++					release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
++				} else {
++					/* Interrupt transfer not complete yet - is it a short read? */
++					if (len < hc->max_packet) {
++						/* Interrupt transaction complete */
++						qtd->urb->status = 0;
++						hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, qtd->urb->status);
++						release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
++					} else {
++						/* Further transactions required */
++						release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_COMPLETE);
++					}
++				}
++			} else {
++				/* Interrupt OUT complete. */
++				dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
++				qtd->urb->actual_length += hc->xfer_len;
++				if (qtd->urb->actual_length >= qtd->urb->length) {
++					qtd->urb->status = 0;
++					hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, qtd->urb->status);
++					release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
++				} else {
++					release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_COMPLETE);
++				}
++			}
++		} else {
++			/* ISOC IN complete. */
++			struct dwc_otg_hcd_iso_packet_desc *frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
++			int len = 0;
++			/* Record errors, update qtd. */
++			if (st->nr_errors) {
++				frame_desc->actual_length = 0;
++				frame_desc->status = -DWC_E_PROTOCOL;
++			} else {
++				frame_desc->status = 0;
++				/* Unswizzle dma */
++				len = dwc_otg_fiq_unsetup_per_dma(hcd, hc->qh, qtd, num);
++				frame_desc->actual_length = len;
++			}
++			qtd->isoc_frame_index++;
++			if (qtd->isoc_frame_index == qtd->urb->packet_count) {
++				hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
++				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
++			} else {
++				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_COMPLETE);
++			}
++		}
++		break;
++
++	case FIQ_PER_ISO_OUT_DONE: {
++			struct dwc_otg_hcd_iso_packet_desc *frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
++			/* Record errors, update qtd. */
++			if (st->nr_errors) {
++				frame_desc->actual_length = 0;
++				frame_desc->status = -DWC_E_PROTOCOL;
++			} else {
++				frame_desc->status = 0;
++				frame_desc->actual_length = frame_desc->length;
++			}
++			qtd->isoc_frame_index++;
++			qtd->isoc_split_offset = 0;
++			if (qtd->isoc_frame_index == qtd->urb->packet_count) {
++				hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
++				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
++			} else {
++				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_COMPLETE);
++			}
++		}
++		break;
++
++	case FIQ_PER_SPLIT_NYET_ABORTED:
++		/* Doh. lost the data. */
++		printk_ratelimited(KERN_INFO "Transfer to device %d endpoint 0x%x frame %d failed "
++				"- FIQ reported NYET. Data may have been lost.\n",
++				hc->dev_addr, hc->ep_num, dwc_otg_hcd_get_frame_number(hcd) >> 3);
++		if (hc->ep_type == UE_ISOCHRONOUS) {
++			struct dwc_otg_hcd_iso_packet_desc *frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
++			/* Record errors, update qtd. */
++			frame_desc->actual_length = 0;
++			frame_desc->status = -DWC_E_PROTOCOL;
++			qtd->isoc_frame_index++;
++			qtd->isoc_split_offset = 0;
++			if (qtd->isoc_frame_index == qtd->urb->packet_count) {
++				hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
++				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
++			} else {
++				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_COMPLETE);
++			}
++		} else {
++			release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
++		}
++		break;
++
++	case FIQ_HS_ISOC_DONE:
++		/* The FIQ has performed a whole pile of isochronous transactions.
++		 * The status is recorded as the interrupt state should the transaction
++		 * fail.
++		 */
++		dwc_otg_fiq_unmangle_isoc(hcd, hc->qh, qtd, num);
++		hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
++		release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
++		break;
++
++	case FIQ_PER_SPLIT_LS_ABORTED:
++		if (hcint.b.xacterr) {
++			/* Hub has responded with an ERR packet. Device
++			 * has been unplugged or the port has been disabled.
++			 * TODO: need to issue a reset to the hub port. */
++			qtd->error_count += 3;
++			handle_hc_xacterr_intr(hcd, hc, hc_regs, qtd);
++		} else if (hcint.b.stall) {
++			handle_hc_stall_intr(hcd, hc, hc_regs, qtd);
++		} else if (hcint.b.bblerr) {
++			handle_hc_babble_intr(hcd, hc, hc_regs, qtd);
++		} else {
++			printk_ratelimited(KERN_INFO "Transfer to device %d endpoint 0x%x failed "
++				"- FIQ reported FSM=%d. Data may have been lost.\n",
++				st->fsm, hc->dev_addr, hc->ep_num);
++			release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
++		}
++		break;
++
++	case FIQ_PER_SPLIT_HS_ABORTED:
++		/* Either the SSPLIT phase suffered transaction errors or something
++		 * unexpected happened.
++		 */
++		qtd->error_count += 3;
++		handle_hc_xacterr_intr(hcd, hc, hc_regs, qtd);
++		release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
++		break;
++
++	case FIQ_PER_SPLIT_TIMEOUT:
++		/* Couldn't complete in the nominated frame */
++		printk(KERN_INFO "Transfer to device %d endpoint 0x%x frame %d failed "
++				"- FIQ timed out. Data may have been lost.\n",
++				hc->dev_addr, hc->ep_num, dwc_otg_hcd_get_frame_number(hcd) >> 3);
++		if (hc->ep_type == UE_ISOCHRONOUS) {
++			struct dwc_otg_hcd_iso_packet_desc *frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
++			/* Record errors, update qtd. */
++			frame_desc->actual_length = 0;
++			if (hc->ep_is_in) {
++				frame_desc->status = -DWC_E_NO_STREAM_RES;
++			} else {
++				frame_desc->status = -DWC_E_COMMUNICATION;
++			}
++			qtd->isoc_frame_index++;
++			if (qtd->isoc_frame_index == qtd->urb->packet_count) {
++				hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
++				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
++			} else {
++				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_COMPLETE);
++			}
++		} else {
++			release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
++		}
++		break;
++
++	default:
++		DWC_WARN("Unexpected state received on hc=%d fsm=%d on transfer to device %d ep 0x%x", 
++					hc->hc_num, st->fsm, hc->dev_addr, hc->ep_num);
++		qtd->error_count++;
++		release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
++	}
++	return;
++}
++
++/** Handles interrupt for a specific Host Channel */
++int32_t dwc_otg_hcd_handle_hc_n_intr(dwc_otg_hcd_t * dwc_otg_hcd, uint32_t num)
++{
++	int retval = 0;
++	hcint_data_t hcint;
++	hcintmsk_data_t hcintmsk;
++	dwc_hc_t *hc;
++	dwc_otg_hc_regs_t *hc_regs;
++	dwc_otg_qtd_t *qtd;
++
++	DWC_DEBUGPL(DBG_HCDV, "--Host Channel Interrupt--, Channel %d\n", num);
++
++	hc = dwc_otg_hcd->hc_ptr_array[num];
++	hc_regs = dwc_otg_hcd->core_if->host_if->hc_regs[num];
++	if(hc->halt_status == DWC_OTG_HC_XFER_URB_DEQUEUE) {
++		/* A dequeue was issued for this transfer. Our QTD has gone away
++		 * but in the case of a FIQ transfer, the transfer would have run
++		 * to completion.
++		 */
++		if (fiq_fsm_enable && dwc_otg_hcd->fiq_state->channel[num].fsm != FIQ_PASSTHROUGH) {
++			dwc_otg_hcd_handle_hc_fsm(dwc_otg_hcd, num);
++		} else {
++			release_channel(dwc_otg_hcd, hc, NULL, hc->halt_status);
++		}
++		return 1;
++	}
++	qtd = DWC_CIRCLEQ_FIRST(&hc->qh->qtd_list);
++
++	/*
++	 * FSM mode: Check to see if this is a HC interrupt from a channel handled by the FIQ.
++	 * Execution path is fundamentally different for the channels after a FIQ has completed
++	 * a split transaction.
++	 */
++	if (fiq_fsm_enable) {
++		switch (dwc_otg_hcd->fiq_state->channel[num].fsm) {
++			case FIQ_PASSTHROUGH:
++				break;
++			case FIQ_PASSTHROUGH_ERRORSTATE:
++				/* Hook into the error count */
++				fiq_print(FIQDBG_ERR, dwc_otg_hcd->fiq_state, "HCDERR%02d", num);
++				if (!dwc_otg_hcd->fiq_state->channel[num].nr_errors) {
++					qtd->error_count = 0;
++					fiq_print(FIQDBG_ERR, dwc_otg_hcd->fiq_state, "RESET   ");
++				}
++				break;
++			default:
++				dwc_otg_hcd_handle_hc_fsm(dwc_otg_hcd, num);
++				return 1;
++		}
++	}
++
++	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
++	hcintmsk.d32 = DWC_READ_REG32(&hc_regs->hcintmsk);
++	hcint.d32 = hcint.d32 & hcintmsk.d32;
++	if (!dwc_otg_hcd->core_if->dma_enable) {
++		if (hcint.b.chhltd && hcint.d32 != 0x2) {
++			hcint.b.chhltd = 0;
++		}
++	}
++
++	if (hcint.b.xfercomp) {
++		retval |=
++		    handle_hc_xfercomp_intr(dwc_otg_hcd, hc, hc_regs, qtd);
++		/*
++		 * If NYET occurred at same time as Xfer Complete, the NYET is
++		 * handled by the Xfer Complete interrupt handler. Don't want
++		 * to call the NYET interrupt handler in this case.
++		 */
++		hcint.b.nyet = 0;
++	}
++	if (hcint.b.chhltd) {
++		retval |= handle_hc_chhltd_intr(dwc_otg_hcd, hc, hc_regs, qtd);
++	}
++	if (hcint.b.ahberr) {
++		retval |= handle_hc_ahberr_intr(dwc_otg_hcd, hc, hc_regs, qtd);
++	}
++	if (hcint.b.stall) {
++		retval |= handle_hc_stall_intr(dwc_otg_hcd, hc, hc_regs, qtd);
++	}
++	if (hcint.b.nak) {
++		retval |= handle_hc_nak_intr(dwc_otg_hcd, hc, hc_regs, qtd);
++	}
++	if (hcint.b.ack) {
++		if(!hcint.b.chhltd)
++			retval |= handle_hc_ack_intr(dwc_otg_hcd, hc, hc_regs, qtd);
++	}
++	if (hcint.b.nyet) {
++		retval |= handle_hc_nyet_intr(dwc_otg_hcd, hc, hc_regs, qtd);
++	}
++	if (hcint.b.xacterr) {
++		retval |= handle_hc_xacterr_intr(dwc_otg_hcd, hc, hc_regs, qtd);
++	}
++	if (hcint.b.bblerr) {
++		retval |= handle_hc_babble_intr(dwc_otg_hcd, hc, hc_regs, qtd);
++	}
++	if (hcint.b.frmovrun) {
++		retval |=
++		    handle_hc_frmovrun_intr(dwc_otg_hcd, hc, hc_regs, qtd);
++	}
++	if (hcint.b.datatglerr) {
++		retval |=
++		    handle_hc_datatglerr_intr(dwc_otg_hcd, hc, hc_regs, qtd);
++	}
++
++	return retval;
++}
++#endif /* DWC_DEVICE_ONLY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
+@@ -0,0 +1,1084 @@
++
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd_linux.c $
++ * $Revision: #20 $
++ * $Date: 2011/10/26 $
++ * $Change: 1872981 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++#ifndef DWC_DEVICE_ONLY
++
++/**
++ * @file
++ *
++ * This file contains the implementation of the HCD. In Linux, the HCD
++ * implements the hc_driver API.
++ */
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/moduleparam.h>
++#include <linux/init.h>
++#include <linux/device.h>
++#include <linux/errno.h>
++#include <linux/list.h>
++#include <linux/interrupt.h>
++#include <linux/string.h>
++#include <linux/dma-mapping.h>
++#include <linux/version.h>
++#include <asm/io.h>
++#ifdef CONFIG_ARM
++#include <asm/fiq.h>
++#endif
++#include <linux/usb.h>
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35)
++#include <../drivers/usb/core/hcd.h>
++#else
++#include <linux/usb/hcd.h>
++#endif
++#include <asm/bug.h>
++
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30))
++#define USB_URB_EP_LINKING 1
++#else
++#define USB_URB_EP_LINKING 0
++#endif
++
++#include "dwc_otg_hcd_if.h"
++#include "dwc_otg_dbg.h"
++#include "dwc_otg_driver.h"
++#include "dwc_otg_hcd.h"
++
++#ifndef __virt_to_bus
++#define __virt_to_bus	__virt_to_phys
++#define __bus_to_virt	__phys_to_virt
++#define __pfn_to_bus(x)	__pfn_to_phys(x)
++#define __bus_to_pfn(x)	__phys_to_pfn(x)
++#endif
++
++extern unsigned char  _dwc_otg_fiq_stub, _dwc_otg_fiq_stub_end;
++
++/**
++ * Gets the endpoint number from a _bEndpointAddress argument. The endpoint is
++ * qualified with its direction (possible 32 endpoints per device).
++ */
++#define dwc_ep_addr_to_endpoint(_bEndpointAddress_) ((_bEndpointAddress_ & USB_ENDPOINT_NUMBER_MASK) | \
++						     ((_bEndpointAddress_ & USB_DIR_IN) != 0) << 4)
++
++static const char dwc_otg_hcd_name[] = "dwc_otg_hcd";
++
++extern bool fiq_enable;
++
++/** @name Linux HC Driver API Functions */
++/** @{ */
++/* manage i/o requests, device state */
++static int dwc_otg_urb_enqueue(struct usb_hcd *hcd,
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
++		       struct usb_host_endpoint *ep,
++#endif
++		       struct urb *urb, gfp_t mem_flags);
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30)
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
++static int dwc_otg_urb_dequeue(struct usb_hcd *hcd, struct urb *urb);
++#endif
++#else /* kernels at or post 2.6.30 */
++static int dwc_otg_urb_dequeue(struct usb_hcd *hcd,
++                               struct urb *urb, int status);
++#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30) */
++
++static void endpoint_disable(struct usb_hcd *hcd, struct usb_host_endpoint *ep);
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30)
++static void endpoint_reset(struct usb_hcd *hcd, struct usb_host_endpoint *ep);
++#endif
++static irqreturn_t dwc_otg_hcd_irq(struct usb_hcd *hcd);
++extern int hcd_start(struct usb_hcd *hcd);
++extern void hcd_stop(struct usb_hcd *hcd);
++static int get_frame_number(struct usb_hcd *hcd);
++extern int hub_status_data(struct usb_hcd *hcd, char *buf);
++extern int hub_control(struct usb_hcd *hcd,
++		       u16 typeReq,
++		       u16 wValue, u16 wIndex, char *buf, u16 wLength);
++
++struct wrapper_priv_data {
++	dwc_otg_hcd_t *dwc_otg_hcd;
++};
++
++/** @} */
++
++static struct hc_driver dwc_otg_hc_driver = {
++
++	.description = dwc_otg_hcd_name,
++	.product_desc = "DWC OTG Controller",
++	.hcd_priv_size = sizeof(struct wrapper_priv_data),
++
++	.irq = dwc_otg_hcd_irq,
++
++	.flags = HCD_MEMORY | HCD_DMA | HCD_USB2,
++
++	//.reset =
++	.start = hcd_start,
++	//.suspend =
++	//.resume =
++	.stop = hcd_stop,
++
++	.urb_enqueue = dwc_otg_urb_enqueue,
++	.urb_dequeue = dwc_otg_urb_dequeue,
++	.endpoint_disable = endpoint_disable,
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30)
++	.endpoint_reset = endpoint_reset,
++#endif
++	.get_frame_number = get_frame_number,
++
++	.hub_status_data = hub_status_data,
++	.hub_control = hub_control,
++	//.bus_suspend =
++	//.bus_resume =
++};
++
++/** Gets the dwc_otg_hcd from a struct usb_hcd */
++static inline dwc_otg_hcd_t *hcd_to_dwc_otg_hcd(struct usb_hcd *hcd)
++{
++	struct wrapper_priv_data *p;
++	p = (struct wrapper_priv_data *)(hcd->hcd_priv);
++	return p->dwc_otg_hcd;
++}
++
++/** Gets the struct usb_hcd that contains a dwc_otg_hcd_t. */
++static inline struct usb_hcd *dwc_otg_hcd_to_hcd(dwc_otg_hcd_t * dwc_otg_hcd)
++{
++	return dwc_otg_hcd_get_priv_data(dwc_otg_hcd);
++}
++
++/** Gets the usb_host_endpoint associated with an URB. */
++inline struct usb_host_endpoint *dwc_urb_to_endpoint(struct urb *urb)
++{
++	struct usb_device *dev = urb->dev;
++	int ep_num = usb_pipeendpoint(urb->pipe);
++
++	if (usb_pipein(urb->pipe))
++		return dev->ep_in[ep_num];
++	else
++		return dev->ep_out[ep_num];
++}
++
++static int _disconnect(dwc_otg_hcd_t * hcd)
++{
++	struct usb_hcd *usb_hcd = dwc_otg_hcd_to_hcd(hcd);
++
++	usb_hcd->self.is_b_host = 0;
++	return 0;
++}
++
++static int _start(dwc_otg_hcd_t * hcd)
++{
++	struct usb_hcd *usb_hcd = dwc_otg_hcd_to_hcd(hcd);
++
++	usb_hcd->self.is_b_host = dwc_otg_hcd_is_b_host(hcd);
++	hcd_start(usb_hcd);
++
++	return 0;
++}
++
++static int _hub_info(dwc_otg_hcd_t * hcd, void *urb_handle, uint32_t * hub_addr,
++		     uint32_t * port_addr)
++{
++   struct urb *urb = (struct urb *)urb_handle;
++   struct usb_bus *bus;
++#if 1 //GRAYG - temporary
++   if (NULL == urb_handle)
++      DWC_ERROR("**** %s - NULL URB handle\n", __func__);//GRAYG
++   if (NULL == urb->dev)
++      DWC_ERROR("**** %s - URB has no device\n", __func__);//GRAYG
++   if (NULL == port_addr)
++      DWC_ERROR("**** %s - NULL port_address\n", __func__);//GRAYG
++#endif
++   if (urb->dev->tt) {
++        if (NULL == urb->dev->tt->hub) {
++                DWC_ERROR("**** %s - (URB's transactor has no TT - giving no hub)\n",
++                           __func__); //GRAYG
++                //*hub_addr = (u8)usb_pipedevice(urb->pipe); //GRAYG
++                *hub_addr = 0; //GRAYG
++                // we probably shouldn't have a transaction translator if
++                // there's no associated hub?
++        } else {
++		bus = hcd_to_bus(dwc_otg_hcd_to_hcd(hcd));
++		if (urb->dev->tt->hub == bus->root_hub)
++			*hub_addr = 0;
++		else
++			*hub_addr = urb->dev->tt->hub->devnum;
++	}
++	*port_addr = urb->dev->ttport;
++   } else {
++        *hub_addr = 0;
++	*port_addr = urb->dev->ttport;
++   }
++   return 0;
++}
++
++static int _speed(dwc_otg_hcd_t * hcd, void *urb_handle)
++{
++	struct urb *urb = (struct urb *)urb_handle;
++	return urb->dev->speed;
++}
++
++static int _get_b_hnp_enable(dwc_otg_hcd_t * hcd)
++{
++	struct usb_hcd *usb_hcd = dwc_otg_hcd_to_hcd(hcd);
++	return usb_hcd->self.b_hnp_enable;
++}
++
++static void allocate_bus_bandwidth(struct usb_hcd *hcd, uint32_t bw,
++				   struct urb *urb)
++{
++	hcd_to_bus(hcd)->bandwidth_allocated += bw / urb->interval;
++	if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
++		hcd_to_bus(hcd)->bandwidth_isoc_reqs++;
++	} else {
++		hcd_to_bus(hcd)->bandwidth_int_reqs++;
++	}
++}
++
++static void free_bus_bandwidth(struct usb_hcd *hcd, uint32_t bw,
++			       struct urb *urb)
++{
++	hcd_to_bus(hcd)->bandwidth_allocated -= bw / urb->interval;
++	if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
++		hcd_to_bus(hcd)->bandwidth_isoc_reqs--;
++	} else {
++		hcd_to_bus(hcd)->bandwidth_int_reqs--;
++	}
++}
++
++/**
++ * Sets the final status of an URB and returns it to the device driver. Any
++ * required cleanup of the URB is performed.  The HCD lock should be held on
++ * entry.
++ */
++static int _complete(dwc_otg_hcd_t * hcd, void *urb_handle,
++		     dwc_otg_hcd_urb_t * dwc_otg_urb, int32_t status)
++{
++	struct urb *urb = (struct urb *)urb_handle;
++	urb_tq_entry_t *new_entry;
++	int rc = 0;
++	if (CHK_DEBUG_LEVEL(DBG_HCDV | DBG_HCD_URB)) {
++		DWC_PRINTF("%s: urb %p, device %d, ep %d %s, status=%d\n",
++			   __func__, urb, usb_pipedevice(urb->pipe),
++			   usb_pipeendpoint(urb->pipe),
++			   usb_pipein(urb->pipe) ? "IN" : "OUT", status);
++		if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
++			int i;
++			for (i = 0; i < urb->number_of_packets; i++) {
++				DWC_PRINTF("  ISO Desc %d status: %d\n",
++					   i, urb->iso_frame_desc[i].status);
++			}
++		}
++	}
++	new_entry = DWC_ALLOC_ATOMIC(sizeof(urb_tq_entry_t));
++	urb->actual_length = dwc_otg_hcd_urb_get_actual_length(dwc_otg_urb);
++	/* Convert status value. */
++	switch (status) {
++	case -DWC_E_PROTOCOL:
++		status = -EPROTO;
++		break;
++	case -DWC_E_IN_PROGRESS:
++		status = -EINPROGRESS;
++		break;
++	case -DWC_E_PIPE:
++		status = -EPIPE;
++		break;
++	case -DWC_E_IO:
++		status = -EIO;
++		break;
++	case -DWC_E_TIMEOUT:
++		status = -ETIMEDOUT;
++		break;
++	case -DWC_E_OVERFLOW:
++		status = -EOVERFLOW;
++		break;
++	case -DWC_E_SHUTDOWN:
++		status = -ESHUTDOWN;
++		break;
++	default:
++		if (status) {
++			DWC_PRINTF("Uknown urb status %d\n", status);
++
++		}
++	}
++
++	if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
++		int i;
++
++		urb->error_count = dwc_otg_hcd_urb_get_error_count(dwc_otg_urb);
++		urb->actual_length = 0;
++		for (i = 0; i < urb->number_of_packets; ++i) {
++			urb->iso_frame_desc[i].actual_length =
++			    dwc_otg_hcd_urb_get_iso_desc_actual_length
++			    (dwc_otg_urb, i);
++			urb->actual_length += urb->iso_frame_desc[i].actual_length;
++			urb->iso_frame_desc[i].status =
++			    dwc_otg_hcd_urb_get_iso_desc_status(dwc_otg_urb, i);
++		}
++	}
++
++	urb->status = status;
++	urb->hcpriv = NULL;
++	if (!status) {
++		if ((urb->transfer_flags & URB_SHORT_NOT_OK) &&
++		    (urb->actual_length < urb->transfer_buffer_length)) {
++			urb->status = -EREMOTEIO;
++		}
++	}
++
++	if ((usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) ||
++	    (usb_pipetype(urb->pipe) == PIPE_INTERRUPT)) {
++		struct usb_host_endpoint *ep = dwc_urb_to_endpoint(urb);
++		if (ep) {
++			free_bus_bandwidth(dwc_otg_hcd_to_hcd(hcd),
++					   dwc_otg_hcd_get_ep_bandwidth(hcd,
++									ep->hcpriv),
++					   urb);
++		}
++	}
++	DWC_FREE(dwc_otg_urb);
++	if (!new_entry) {
++		DWC_ERROR("dwc_otg_hcd: complete: cannot allocate URB TQ entry\n");
++		urb->status = -EPROTO;
++		/* don't schedule the tasklet -
++		 * directly return the packet here with error. */
++#if USB_URB_EP_LINKING
++		usb_hcd_unlink_urb_from_ep(dwc_otg_hcd_to_hcd(hcd), urb);
++#endif
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
++		usb_hcd_giveback_urb(dwc_otg_hcd_to_hcd(hcd), urb);
++#else
++		usb_hcd_giveback_urb(dwc_otg_hcd_to_hcd(hcd), urb, urb->status);
++#endif
++	} else {
++		new_entry->urb = urb;
++#if USB_URB_EP_LINKING
++		rc = usb_hcd_check_unlink_urb(dwc_otg_hcd_to_hcd(hcd), urb, urb->status);
++		if(0 == rc) {
++			usb_hcd_unlink_urb_from_ep(dwc_otg_hcd_to_hcd(hcd), urb);
++		}
++#endif
++		if(0 == rc) {
++			DWC_TAILQ_INSERT_TAIL(&hcd->completed_urb_list, new_entry,
++						urb_tq_entries);
++			DWC_TASK_HI_SCHEDULE(hcd->completion_tasklet);
++		}
++	}
++	return 0;
++}
++
++static struct dwc_otg_hcd_function_ops hcd_fops = {
++	.start = _start,
++	.disconnect = _disconnect,
++	.hub_info = _hub_info,
++	.speed = _speed,
++	.complete = _complete,
++	.get_b_hnp_enable = _get_b_hnp_enable,
++};
++
++#ifdef CONFIG_ARM64
++
++static int simfiq_irq = -1;
++
++void local_fiq_enable(void)
++{
++	if (simfiq_irq >= 0)
++		enable_irq(simfiq_irq);
++}
++
++void local_fiq_disable(void)
++{
++	if (simfiq_irq >= 0)
++		disable_irq(simfiq_irq);
++}
++
++static irqreturn_t fiq_irq_handler(int irq, void *dev_id)
++{
++	dwc_otg_hcd_t *dwc_otg_hcd = (dwc_otg_hcd_t *)dev_id;
++
++	if (fiq_fsm_enable)
++		dwc_otg_fiq_fsm(dwc_otg_hcd->fiq_state, dwc_otg_hcd->core_if->core_params->host_channels);
++	else
++		dwc_otg_fiq_nop(dwc_otg_hcd->fiq_state);
++
++	return IRQ_HANDLED;
++}
++
++#else
++static struct fiq_handler fh = {
++  .name = "usb_fiq",
++};
++
++#endif
++
++static void hcd_init_fiq(void *cookie)
++{
++	dwc_otg_device_t *otg_dev = cookie;
++	dwc_otg_hcd_t *dwc_otg_hcd = otg_dev->hcd;
++#ifdef CONFIG_ARM64
++	int retval = 0;
++	int irq;
++#else
++	struct pt_regs regs;
++	int irq;
++
++	if (claim_fiq(&fh)) {
++		DWC_ERROR("Can't claim FIQ");
++		BUG();
++	}
++	DWC_WARN("FIQ on core %d", smp_processor_id());
++	DWC_WARN("FIQ ASM at %px length %d", &_dwc_otg_fiq_stub, (int)(&_dwc_otg_fiq_stub_end - &_dwc_otg_fiq_stub));
++	set_fiq_handler((void *) &_dwc_otg_fiq_stub, &_dwc_otg_fiq_stub_end - &_dwc_otg_fiq_stub);
++	memset(&regs,0,sizeof(regs));
++
++	regs.ARM_r8 = (long) dwc_otg_hcd->fiq_state;
++	if (fiq_fsm_enable) {
++		regs.ARM_r9 = dwc_otg_hcd->core_if->core_params->host_channels;
++		//regs.ARM_r10 = dwc_otg_hcd->dma;
++		regs.ARM_fp = (long) dwc_otg_fiq_fsm;
++	} else {
++		regs.ARM_fp = (long) dwc_otg_fiq_nop;
++	}
++
++	regs.ARM_sp = (long) dwc_otg_hcd->fiq_stack + (sizeof(struct fiq_stack) - 4);
++
++//		__show_regs(&regs);
++	set_fiq_regs(&regs);
++#endif
++
++	dwc_otg_hcd->fiq_state->dwc_regs_base = otg_dev->os_dep.base;
++	//Set the mphi periph to the required registers
++	dwc_otg_hcd->fiq_state->mphi_regs.base    = otg_dev->os_dep.mphi_base;
++	if (otg_dev->os_dep.use_swirq) {
++		dwc_otg_hcd->fiq_state->mphi_regs.swirq_set =
++			otg_dev->os_dep.mphi_base + 0x1f0;
++		dwc_otg_hcd->fiq_state->mphi_regs.swirq_clr =
++			otg_dev->os_dep.mphi_base + 0x1f4;
++		DWC_WARN("Fake MPHI regs_base at %px",
++			 dwc_otg_hcd->fiq_state->mphi_regs.base);
++	} else {
++		dwc_otg_hcd->fiq_state->mphi_regs.ctrl =
++			otg_dev->os_dep.mphi_base + 0x4c;
++		dwc_otg_hcd->fiq_state->mphi_regs.outdda
++			= otg_dev->os_dep.mphi_base + 0x28;
++		dwc_otg_hcd->fiq_state->mphi_regs.outddb
++			= otg_dev->os_dep.mphi_base + 0x2c;
++		dwc_otg_hcd->fiq_state->mphi_regs.intstat
++			= otg_dev->os_dep.mphi_base + 0x50;
++		DWC_WARN("MPHI regs_base at %px",
++			 dwc_otg_hcd->fiq_state->mphi_regs.base);
++
++		//Enable mphi peripheral
++		writel((1<<31),dwc_otg_hcd->fiq_state->mphi_regs.ctrl);
++#ifdef DEBUG
++		if (readl(dwc_otg_hcd->fiq_state->mphi_regs.ctrl) & 0x80000000)
++			DWC_WARN("MPHI periph has been enabled");
++		else
++			DWC_WARN("MPHI periph has NOT been enabled");
++#endif
++	}
++	// Enable FIQ interrupt from USB peripheral
++#ifdef CONFIG_ARM64
++	irq = otg_dev->os_dep.fiq_num;
++
++	if (irq < 0) {
++		DWC_ERROR("Can't get SIM-FIQ irq");
++		return;
++	}
++
++	retval = request_irq(irq, fiq_irq_handler, 0, "dwc_otg_sim-fiq", dwc_otg_hcd);
++
++	if (retval < 0) {
++		DWC_ERROR("Unable to request SIM-FIQ irq\n");
++		return;
++	}
++
++	simfiq_irq = irq;
++#else
++#ifdef CONFIG_GENERIC_IRQ_MULTI_HANDLER
++	irq = otg_dev->os_dep.fiq_num;
++#else
++	irq = INTERRUPT_VC_USB;
++#endif
++	if (irq < 0) {
++		DWC_ERROR("Can't get FIQ irq");
++		return;
++	}
++	/*
++	 * We could take an interrupt immediately after enabling the FIQ.
++	 * Ensure coherency of hcd->fiq_state.
++	 */
++	smp_mb();
++	enable_fiq(irq);
++	local_fiq_enable();
++#endif
++
++}
++
++/**
++ * Initializes the HCD. This function allocates memory for and initializes the
++ * static parts of the usb_hcd and dwc_otg_hcd structures. It also registers the
++ * USB bus with the core and calls the hc_driver->start() function. It returns
++ * a negative error on failure.
++ */
++int hcd_init(dwc_bus_dev_t *_dev)
++{
++	struct usb_hcd *hcd = NULL;
++	dwc_otg_hcd_t *dwc_otg_hcd = NULL;
++	dwc_otg_device_t *otg_dev = DWC_OTG_BUSDRVDATA(_dev);
++	int retval = 0;
++        u64 dmamask;
++
++	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD INIT otg_dev=%p\n", otg_dev);
++
++	/* Set device flags indicating whether the HCD supports DMA. */
++	if (dwc_otg_is_dma_enable(otg_dev->core_if))
++                dmamask = DMA_BIT_MASK(32);
++        else
++                dmamask = 0;
++
++#if    defined(LM_INTERFACE) || defined(PLATFORM_INTERFACE)
++        dma_set_mask(&_dev->dev, dmamask);
++        dma_set_coherent_mask(&_dev->dev, dmamask);
++#elif  defined(PCI_INTERFACE)
++        pci_set_dma_mask(_dev, dmamask);
++        pci_set_consistent_dma_mask(_dev, dmamask);
++#endif
++
++	/*
++	 * Allocate memory for the base HCD plus the DWC OTG HCD.
++	 * Initialize the base HCD.
++	 */
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30)
++	hcd = usb_create_hcd(&dwc_otg_hc_driver, &_dev->dev, _dev->dev.bus_id);
++#else
++	hcd = usb_create_hcd(&dwc_otg_hc_driver, &_dev->dev, dev_name(&_dev->dev));
++	hcd->has_tt = 1;
++//      hcd->uses_new_polling = 1;
++//      hcd->poll_rh = 0;
++#endif
++	if (!hcd) {
++		retval = -ENOMEM;
++		goto error1;
++	}
++
++	hcd->regs = otg_dev->os_dep.base;
++
++
++	/* Initialize the DWC OTG HCD. */
++	dwc_otg_hcd = dwc_otg_hcd_alloc_hcd();
++	if (!dwc_otg_hcd) {
++		goto error2;
++	}
++	((struct wrapper_priv_data *)(hcd->hcd_priv))->dwc_otg_hcd =
++	    dwc_otg_hcd;
++	otg_dev->hcd = dwc_otg_hcd;
++	otg_dev->hcd->otg_dev = otg_dev;
++
++#ifdef CONFIG_ARM64
++	if (dwc_otg_hcd_init(dwc_otg_hcd, otg_dev->core_if))
++		goto error2;
++
++	if (fiq_enable)
++		hcd_init_fiq(otg_dev);
++#else
++	if (dwc_otg_hcd_init(dwc_otg_hcd, otg_dev->core_if)) {
++		goto error2;
++	}
++
++	if (fiq_enable) {
++		if (num_online_cpus() > 1) {
++			/*
++			 * bcm2709: can run the FIQ on a separate core to IRQs.
++			 * Ensure driver state is visible to other cores before setting up the FIQ.
++			 */
++			smp_mb();
++			smp_call_function_single(1, hcd_init_fiq, otg_dev, 1);
++		} else {
++			smp_call_function_single(0, hcd_init_fiq, otg_dev, 1);
++		}
++	}
++#endif
++
++	hcd->self.otg_port = dwc_otg_hcd_otg_port(dwc_otg_hcd);
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,33) //don't support for LM(with 2.6.20.1 kernel)
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35) //version field absent later
++	hcd->self.otg_version = dwc_otg_get_otg_version(otg_dev->core_if);
++#endif
++	/* Don't support SG list at this point */
++	hcd->self.sg_tablesize = 0;
++#endif
++	/*
++	 * Finish generic HCD initialization and start the HCD. This function
++	 * allocates the DMA buffer pool, registers the USB bus, requests the
++	 * IRQ line, and calls hcd_start method.
++	 */
++	retval = usb_add_hcd(hcd, otg_dev->os_dep.irq_num, IRQF_SHARED);
++	if (retval < 0) {
++		goto error2;
++	}
++
++	dwc_otg_hcd_set_priv_data(dwc_otg_hcd, hcd);
++	return 0;
++
++error2:
++	usb_put_hcd(hcd);
++error1:
++	return retval;
++}
++
++/**
++ * Removes the HCD.
++ * Frees memory and resources associated with the HCD and deregisters the bus.
++ */
++void hcd_remove(dwc_bus_dev_t *_dev)
++{
++	dwc_otg_device_t *otg_dev = DWC_OTG_BUSDRVDATA(_dev);
++	dwc_otg_hcd_t *dwc_otg_hcd;
++	struct usb_hcd *hcd;
++
++	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD REMOVE otg_dev=%p\n", otg_dev);
++
++	if (!otg_dev) {
++		DWC_DEBUGPL(DBG_ANY, "%s: otg_dev NULL!\n", __func__);
++		return;
++	}
++
++	dwc_otg_hcd = otg_dev->hcd;
++
++	if (!dwc_otg_hcd) {
++		DWC_DEBUGPL(DBG_ANY, "%s: otg_dev->hcd NULL!\n", __func__);
++		return;
++	}
++
++	hcd = dwc_otg_hcd_to_hcd(dwc_otg_hcd);
++
++	if (!hcd) {
++		DWC_DEBUGPL(DBG_ANY,
++			    "%s: dwc_otg_hcd_to_hcd(dwc_otg_hcd) NULL!\n",
++			    __func__);
++		return;
++	}
++	usb_remove_hcd(hcd);
++	dwc_otg_hcd_set_priv_data(dwc_otg_hcd, NULL);
++	dwc_otg_hcd_remove(dwc_otg_hcd);
++	usb_put_hcd(hcd);
++}
++
++/* =========================================================================
++ *  Linux HC Driver Functions
++ * ========================================================================= */
++
++/** Initializes the DWC_otg controller and its root hub and prepares it for host
++ * mode operation. Activates the root port. Returns 0 on success and a negative
++ * error code on failure. */
++int hcd_start(struct usb_hcd *hcd)
++{
++	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
++	struct usb_bus *bus;
++
++	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD START\n");
++	bus = hcd_to_bus(hcd);
++
++	hcd->state = HC_STATE_RUNNING;
++	if (dwc_otg_hcd_start(dwc_otg_hcd, &hcd_fops)) {
++		return 0;
++	}
++
++	/* Initialize and connect root hub if one is not already attached */
++	if (bus->root_hub) {
++		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD Has Root Hub\n");
++		/* Inform the HUB driver to resume. */
++		usb_hcd_resume_root_hub(hcd);
++	}
++
++	return 0;
++}
++
++/**
++ * Halts the DWC_otg host mode operations in a clean manner. USB transfers are
++ * stopped.
++ */
++void hcd_stop(struct usb_hcd *hcd)
++{
++	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
++
++	dwc_otg_hcd_stop(dwc_otg_hcd);
++}
++
++/** Returns the current frame number. */
++static int get_frame_number(struct usb_hcd *hcd)
++{
++	hprt0_data_t hprt0;
++	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
++	hprt0.d32 = DWC_READ_REG32(dwc_otg_hcd->core_if->host_if->hprt0);
++	if (hprt0.b.prtspd == DWC_HPRT0_PRTSPD_HIGH_SPEED)
++		return dwc_otg_hcd_get_frame_number(dwc_otg_hcd) >> 3;
++	else
++		return dwc_otg_hcd_get_frame_number(dwc_otg_hcd);
++}
++
++#ifdef DEBUG
++static void dump_urb_info(struct urb *urb, char *fn_name)
++{
++	DWC_PRINTF("%s, urb %p\n", fn_name, urb);
++	DWC_PRINTF("  Device address: %d\n", usb_pipedevice(urb->pipe));
++	DWC_PRINTF("  Endpoint: %d, %s\n", usb_pipeendpoint(urb->pipe),
++		   (usb_pipein(urb->pipe) ? "IN" : "OUT"));
++	DWC_PRINTF("  Endpoint type: %s\n", ( {
++					     char *pipetype;
++					     switch (usb_pipetype(urb->pipe)) {
++case PIPE_CONTROL:
++pipetype = "CONTROL"; break; case PIPE_BULK:
++pipetype = "BULK"; break; case PIPE_INTERRUPT:
++pipetype = "INTERRUPT"; break; case PIPE_ISOCHRONOUS:
++pipetype = "ISOCHRONOUS"; break; default:
++					     pipetype = "UNKNOWN"; break;};
++					     pipetype;}
++		   )) ;
++	DWC_PRINTF("  Speed: %s\n", ( {
++				     char *speed; switch (urb->dev->speed) {
++case USB_SPEED_HIGH:
++speed = "HIGH"; break; case USB_SPEED_FULL:
++speed = "FULL"; break; case USB_SPEED_LOW:
++speed = "LOW"; break; default:
++				     speed = "UNKNOWN"; break;};
++				     speed;}
++		   )) ;
++	DWC_PRINTF("  Max packet size: %d\n",
++		   usb_maxpacket(urb->dev, urb->pipe);
++	DWC_PRINTF("  Data buffer length: %d\n", urb->transfer_buffer_length);
++	DWC_PRINTF("  Transfer buffer: %p, Transfer DMA: %p\n",
++		   urb->transfer_buffer, (void *)urb->transfer_dma);
++	DWC_PRINTF("  Setup buffer: %p, Setup DMA: %p\n",
++		   urb->setup_packet, (void *)urb->setup_dma);
++	DWC_PRINTF("  Interval: %d\n", urb->interval);
++	if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
++		int i;
++		for (i = 0; i < urb->number_of_packets; i++) {
++			DWC_PRINTF("  ISO Desc %d:\n", i);
++			DWC_PRINTF("    offset: %d, length %d\n",
++				   urb->iso_frame_desc[i].offset,
++				   urb->iso_frame_desc[i].length);
++		}
++	}
++}
++#endif
++
++/** Starts processing a USB transfer request specified by a USB Request Block
++ * (URB). mem_flags indicates the type of memory allocation to use while
++ * processing this URB. */
++static int dwc_otg_urb_enqueue(struct usb_hcd *hcd,
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
++		       struct usb_host_endpoint *ep,
++#endif
++		       struct urb *urb, gfp_t mem_flags)
++{
++	int retval = 0;
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28)
++	struct usb_host_endpoint *ep = urb->ep;
++#endif
++	dwc_irqflags_t irqflags;
++	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
++	dwc_otg_hcd_urb_t *dwc_otg_urb;
++	int i;
++	int alloc_bandwidth = 0;
++	uint8_t ep_type = 0;
++	uint32_t flags = 0;
++	void *buf;
++
++#ifdef DEBUG
++	if (CHK_DEBUG_LEVEL(DBG_HCDV | DBG_HCD_URB)) {
++		dump_urb_info(urb, "dwc_otg_urb_enqueue");
++	}
++#endif
++	if ((usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS)
++	    || (usb_pipetype(urb->pipe) == PIPE_INTERRUPT)) {
++		if (!dwc_otg_hcd_is_bandwidth_allocated
++		    (dwc_otg_hcd, ep->hcpriv)) {
++			alloc_bandwidth = 1;
++		}
++	}
++
++	switch (usb_pipetype(urb->pipe)) {
++	case PIPE_CONTROL:
++		ep_type = USB_ENDPOINT_XFER_CONTROL;
++		break;
++	case PIPE_ISOCHRONOUS:
++		ep_type = USB_ENDPOINT_XFER_ISOC;
++		break;
++	case PIPE_BULK:
++		ep_type = USB_ENDPOINT_XFER_BULK;
++		break;
++	case PIPE_INTERRUPT:
++		ep_type = USB_ENDPOINT_XFER_INT;
++		break;
++	default:
++                DWC_WARN("Wrong EP type - %d\n", usb_pipetype(urb->pipe));
++	}
++
++        /* # of packets is often 0 - do we really need to call this then? */
++	dwc_otg_urb = dwc_otg_hcd_urb_alloc(dwc_otg_hcd,
++					    urb->number_of_packets,
++					    mem_flags == GFP_ATOMIC ? 1 : 0);
++
++	if(dwc_otg_urb == NULL)
++		return -ENOMEM;
++
++	if (!dwc_otg_urb && urb->number_of_packets)
++		return -ENOMEM;
++
++	dwc_otg_hcd_urb_set_pipeinfo(dwc_otg_urb, usb_pipedevice(urb->pipe),
++				     usb_pipeendpoint(urb->pipe), ep_type,
++				     usb_pipein(urb->pipe),
++				     usb_maxpacket(urb->dev, urb->pipe));
++
++	buf = urb->transfer_buffer;
++	if (hcd_uses_dma(hcd) && !buf && urb->transfer_buffer_length) {
++		/*
++		 * Calculate virtual address from physical address,
++		 * because some class driver may not fill transfer_buffer.
++		 * In Buffer DMA mode virual address is used,
++		 * when handling non DWORD aligned buffers.
++		 */
++		buf = (void *)__bus_to_virt((unsigned long)urb->transfer_dma);
++		dev_warn_once(&urb->dev->dev,
++			      "USB transfer_buffer was NULL, will use __bus_to_virt(%pad)=%p\n",
++			      &urb->transfer_dma, buf);
++	}
++
++	if (!buf && urb->transfer_buffer_length) {
++		DWC_FREE(dwc_otg_urb);
++		DWC_ERROR("transfer_buffer is NULL in PIO mode or both "
++			   "transfer_buffer and transfer_dma are NULL in DMA mode\n");
++		return -EINVAL;
++	}
++
++	if (!(urb->transfer_flags & URB_NO_INTERRUPT))
++		flags |= URB_GIVEBACK_ASAP;
++	if (urb->transfer_flags & URB_ZERO_PACKET)
++		flags |= URB_SEND_ZERO_PACKET;
++
++	dwc_otg_hcd_urb_set_params(dwc_otg_urb, urb, buf,
++				   urb->transfer_dma,
++				   urb->transfer_buffer_length,
++				   urb->setup_packet,
++				   urb->setup_dma, flags, urb->interval);
++
++	for (i = 0; i < urb->number_of_packets; ++i) {
++		dwc_otg_hcd_urb_set_iso_desc_params(dwc_otg_urb, i,
++						    urb->
++						    iso_frame_desc[i].offset,
++						    urb->
++						    iso_frame_desc[i].length);
++	}
++
++	DWC_SPINLOCK_IRQSAVE(dwc_otg_hcd->lock, &irqflags);
++	urb->hcpriv = dwc_otg_urb;
++#if USB_URB_EP_LINKING
++	retval = usb_hcd_link_urb_to_ep(hcd, urb);
++	if (0 == retval)
++#endif
++	{
++		retval = dwc_otg_hcd_urb_enqueue(dwc_otg_hcd, dwc_otg_urb,
++						&ep->hcpriv, 1);
++		if (0 == retval) {
++			if (alloc_bandwidth) {
++				allocate_bus_bandwidth(hcd,
++						dwc_otg_hcd_get_ep_bandwidth(
++							dwc_otg_hcd, ep->hcpriv),
++						urb);
++			}
++		} else {
++			DWC_DEBUGPL(DBG_HCD, "DWC OTG dwc_otg_hcd_urb_enqueue failed rc %d\n", retval);
++#if USB_URB_EP_LINKING
++			usb_hcd_unlink_urb_from_ep(hcd, urb);
++#endif
++			DWC_FREE(dwc_otg_urb);
++			urb->hcpriv = NULL;
++			if (retval == -DWC_E_NO_DEVICE)
++				retval = -ENODEV;
++		}
++	}
++#if USB_URB_EP_LINKING
++	else
++	{
++		DWC_FREE(dwc_otg_urb);
++		urb->hcpriv = NULL;
++	}
++#endif
++	DWC_SPINUNLOCK_IRQRESTORE(dwc_otg_hcd->lock, irqflags);
++	return retval;
++}
++
++/** Aborts/cancels a USB transfer request. Always returns 0 to indicate
++ * success.  */
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
++static int dwc_otg_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
++#else
++static int dwc_otg_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
++#endif
++{
++	dwc_irqflags_t flags;
++	dwc_otg_hcd_t *dwc_otg_hcd;
++        int rc;
++
++	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD URB Dequeue\n");
++
++	dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
++
++#ifdef DEBUG
++	if (CHK_DEBUG_LEVEL(DBG_HCDV | DBG_HCD_URB)) {
++		dump_urb_info(urb, "dwc_otg_urb_dequeue");
++	}
++#endif
++
++	DWC_SPINLOCK_IRQSAVE(dwc_otg_hcd->lock, &flags);
++	rc = usb_hcd_check_unlink_urb(hcd, urb, status);
++	if (0 == rc) {
++		if(urb->hcpriv != NULL) {
++	                dwc_otg_hcd_urb_dequeue(dwc_otg_hcd,
++	                                    (dwc_otg_hcd_urb_t *)urb->hcpriv);
++
++		        DWC_FREE(urb->hcpriv);
++			urb->hcpriv = NULL;
++		}
++        }
++
++        if (0 == rc) {
++		/* Higher layer software sets URB status. */
++#if USB_URB_EP_LINKING
++                usb_hcd_unlink_urb_from_ep(hcd, urb);
++#endif
++		DWC_SPINUNLOCK_IRQRESTORE(dwc_otg_hcd->lock, flags);
++
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
++                usb_hcd_giveback_urb(hcd, urb);
++#else
++                usb_hcd_giveback_urb(hcd, urb, status);
++#endif
++                if (CHK_DEBUG_LEVEL(DBG_HCDV | DBG_HCD_URB)) {
++                        DWC_PRINTF("Called usb_hcd_giveback_urb() \n");
++                        DWC_PRINTF("  1urb->status = %d\n", urb->status);
++                }
++                DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD URB Dequeue OK\n");
++        } else {
++		DWC_SPINUNLOCK_IRQRESTORE(dwc_otg_hcd->lock, flags);
++                DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD URB Dequeue failed - rc %d\n",
++                            rc);
++        }
++
++	return rc;
++}
++
++/* Frees resources in the DWC_otg controller related to a given endpoint. Also
++ * clears state in the HCD related to the endpoint. Any URBs for the endpoint
++ * must already be dequeued. */
++static void endpoint_disable(struct usb_hcd *hcd, struct usb_host_endpoint *ep)
++{
++	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
++
++	DWC_DEBUGPL(DBG_HCD,
++		    "DWC OTG HCD EP DISABLE: _bEndpointAddress=0x%02x, "
++		    "endpoint=%d\n", ep->desc.bEndpointAddress,
++		    dwc_ep_addr_to_endpoint(ep->desc.bEndpointAddress));
++	dwc_otg_hcd_endpoint_disable(dwc_otg_hcd, ep->hcpriv, 250);
++	ep->hcpriv = NULL;
++}
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30)
++/* Resets endpoint specific parameter values, in current version used to reset
++ * the data toggle(as a WA). This function can be called from usb_clear_halt routine */
++static void endpoint_reset(struct usb_hcd *hcd, struct usb_host_endpoint *ep)
++{
++	dwc_irqflags_t flags;
++	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
++
++	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD EP RESET: Endpoint Num=0x%02d\n",
++		    ep->desc.bEndpointAddress);
++
++	DWC_SPINLOCK_IRQSAVE(dwc_otg_hcd->lock, &flags);
++	if (ep->hcpriv) {
++		dwc_otg_hcd_endpoint_reset(dwc_otg_hcd, ep->hcpriv);
++	}
++	DWC_SPINUNLOCK_IRQRESTORE(dwc_otg_hcd->lock, flags);
++}
++#endif
++
++/** Handles host mode interrupts for the DWC_otg controller. Returns IRQ_NONE if
++ * there was no interrupt to handle. Returns IRQ_HANDLED if there was a valid
++ * interrupt.
++ *
++ * This function is called by the USB core when an interrupt occurs */
++static irqreturn_t dwc_otg_hcd_irq(struct usb_hcd *hcd)
++{
++	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
++	int32_t retval = dwc_otg_hcd_handle_intr(dwc_otg_hcd);
++	if (retval != 0) {
++		S3C2410X_CLEAR_EINTPEND();
++	}
++	return IRQ_RETVAL(retval);
++}
++
++/** Creates Status Change bitmap for the root hub and root port. The bitmap is
++ * returned in buf. Bit 0 is the status change indicator for the root hub. Bit 1
++ * is the status change indicator for the single root port. Returns 1 if either
++ * change indicator is 1, otherwise returns 0. */
++int hub_status_data(struct usb_hcd *hcd, char *buf)
++{
++	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
++
++	buf[0] = 0;
++	buf[0] |= (dwc_otg_hcd_is_status_changed(dwc_otg_hcd, 1)) << 1;
++
++	return (buf[0] != 0);
++}
++
++/** Handles hub class-specific requests. */
++int hub_control(struct usb_hcd *hcd,
++		u16 typeReq, u16 wValue, u16 wIndex, char *buf, u16 wLength)
++{
++	int retval;
++
++	retval = dwc_otg_hcd_hub_control(hcd_to_dwc_otg_hcd(hcd),
++					 typeReq, wValue, wIndex, buf, wLength);
++
++	switch (retval) {
++	case -DWC_E_INVALID:
++		retval = -EINVAL;
++		break;
++	}
++
++	return retval;
++}
++
++#endif /* DWC_DEVICE_ONLY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_queue.c
+@@ -0,0 +1,974 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd_queue.c $
++ * $Revision: #44 $
++ * $Date: 2011/10/26 $
++ * $Change: 1873028 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++#ifndef DWC_DEVICE_ONLY
++
++/**
++ * @file
++ *
++ * This file contains the functions to manage Queue Heads and Queue
++ * Transfer Descriptors.
++ */
++
++#include "dwc_otg_hcd.h"
++#include "dwc_otg_regs.h"
++
++extern bool microframe_schedule;
++extern unsigned short int_ep_interval_min;
++
++/**
++ * Free each QTD in the QH's QTD-list then free the QH.  QH should already be
++ * removed from a list.  QTD list should already be empty if called from URB
++ * Dequeue.
++ *
++ * @param hcd HCD instance.
++ * @param qh The QH to free.
++ */
++void dwc_otg_hcd_qh_free(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	dwc_otg_qtd_t *qtd, *qtd_tmp;
++	dwc_irqflags_t flags;
++	uint32_t buf_size = 0;
++	uint8_t *align_buf_virt = NULL;
++	dwc_dma_t align_buf_dma;
++	struct device *dev = dwc_otg_hcd_to_dev(hcd);
++
++	/* Free each QTD in the QTD list */
++	DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
++	DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp, &qh->qtd_list, qtd_list_entry) {
++		DWC_CIRCLEQ_REMOVE(&qh->qtd_list, qtd, qtd_list_entry);
++		dwc_otg_hcd_qtd_free(qtd);
++	}
++
++	if (hcd->core_if->dma_desc_enable) {
++		dwc_otg_hcd_qh_free_ddma(hcd, qh);
++	} else if (qh->dw_align_buf) {
++		if (qh->ep_type == UE_ISOCHRONOUS) {
++			buf_size = 4096;
++		} else {
++			buf_size = hcd->core_if->core_params->max_transfer_size;
++		}
++		align_buf_virt = qh->dw_align_buf;
++		align_buf_dma = qh->dw_align_buf_dma;
++	}
++
++	DWC_FREE(qh);
++	DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
++	if (align_buf_virt)
++		DWC_DMA_FREE(dev, buf_size, align_buf_virt, align_buf_dma);
++	return;
++}
++
++#define BitStuffTime(bytecount)  ((8 * 7* bytecount) / 6)
++#define HS_HOST_DELAY		5	/* nanoseconds */
++#define FS_LS_HOST_DELAY	1000	/* nanoseconds */
++#define HUB_LS_SETUP		333	/* nanoseconds */
++#define NS_TO_US(ns)		((ns + 500) / 1000)
++				/* convert & round nanoseconds to microseconds */
++
++static uint32_t calc_bus_time(int speed, int is_in, int is_isoc, int bytecount)
++{
++	unsigned long retval;
++
++	switch (speed) {
++	case USB_SPEED_HIGH:
++		if (is_isoc) {
++			retval =
++			    ((38 * 8 * 2083) +
++			     (2083 * (3 + BitStuffTime(bytecount)))) / 1000 +
++			    HS_HOST_DELAY;
++		} else {
++			retval =
++			    ((55 * 8 * 2083) +
++			     (2083 * (3 + BitStuffTime(bytecount)))) / 1000 +
++			    HS_HOST_DELAY;
++		}
++		break;
++	case USB_SPEED_FULL:
++		if (is_isoc) {
++			retval =
++			    (8354 * (31 + 10 * BitStuffTime(bytecount))) / 1000;
++			if (is_in) {
++				retval = 7268 + FS_LS_HOST_DELAY + retval;
++			} else {
++				retval = 6265 + FS_LS_HOST_DELAY + retval;
++			}
++		} else {
++			retval =
++			    (8354 * (31 + 10 * BitStuffTime(bytecount))) / 1000;
++			retval = 9107 + FS_LS_HOST_DELAY + retval;
++		}
++		break;
++	case USB_SPEED_LOW:
++		if (is_in) {
++			retval =
++			    (67667 * (31 + 10 * BitStuffTime(bytecount))) /
++			    1000;
++			retval =
++			    64060 + (2 * HUB_LS_SETUP) + FS_LS_HOST_DELAY +
++			    retval;
++		} else {
++			retval =
++			    (66700 * (31 + 10 * BitStuffTime(bytecount))) /
++			    1000;
++			retval =
++			    64107 + (2 * HUB_LS_SETUP) + FS_LS_HOST_DELAY +
++			    retval;
++		}
++		break;
++	default:
++		DWC_WARN("Unknown device speed\n");
++		retval = -1;
++	}
++
++	return NS_TO_US(retval);
++}
++
++/**
++ * Initializes a QH structure.
++ *
++ * @param hcd The HCD state structure for the DWC OTG controller.
++ * @param qh  The QH to init.
++ * @param urb Holds the information about the device/endpoint that we need
++ * 	      to initialize the QH.
++ */
++#define SCHEDULE_SLOP 10
++static void qh_init(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh, dwc_otg_hcd_urb_t * urb)
++{
++	char *speed, *type;
++	int dev_speed;
++	uint32_t hub_addr, hub_port;
++	hprt0_data_t hprt;
++
++	dwc_memset(qh, 0, sizeof(dwc_otg_qh_t));
++	hprt.d32 = DWC_READ_REG32(hcd->core_if->host_if->hprt0);
++
++	/* Initialize QH */
++	qh->ep_type = dwc_otg_hcd_get_pipe_type(&urb->pipe_info);
++	qh->ep_is_in = dwc_otg_hcd_is_pipe_in(&urb->pipe_info) ? 1 : 0;
++
++	qh->data_toggle = DWC_OTG_HC_PID_DATA0;
++	qh->maxp = dwc_otg_hcd_get_mps(&urb->pipe_info);
++	DWC_CIRCLEQ_INIT(&qh->qtd_list);
++	DWC_LIST_INIT(&qh->qh_list_entry);
++	qh->channel = NULL;
++
++	/* FS/LS Enpoint on HS Hub
++	 * NOT virtual root hub */
++	dev_speed = hcd->fops->speed(hcd, urb->priv);
++
++	hcd->fops->hub_info(hcd, urb->priv, &hub_addr, &hub_port);
++	qh->do_split = 0;
++	if (microframe_schedule)
++		qh->speed = dev_speed;
++
++	qh->nak_frame = 0xffff;
++
++	if (hprt.b.prtspd == DWC_HPRT0_PRTSPD_HIGH_SPEED &&
++			dev_speed != USB_SPEED_HIGH) {
++		DWC_DEBUGPL(DBG_HCD,
++			    "QH init: EP %d: TT found at hub addr %d, for port %d\n",
++			    dwc_otg_hcd_get_ep_num(&urb->pipe_info), hub_addr,
++			    hub_port);
++		qh->do_split = 1;
++		qh->skip_count = 0;
++	}
++
++	if (qh->ep_type == UE_INTERRUPT || qh->ep_type == UE_ISOCHRONOUS) {
++		/* Compute scheduling parameters once and save them. */
++
++		/** @todo Account for split transfers in the bus time. */
++		int bytecount =
++		    dwc_hb_mult(qh->maxp) * dwc_max_packet(qh->maxp);
++
++		qh->usecs =
++		    calc_bus_time((qh->do_split ? USB_SPEED_HIGH : dev_speed),
++				  qh->ep_is_in, (qh->ep_type == UE_ISOCHRONOUS),
++				  bytecount);
++		/* Start in a slightly future (micro)frame. */
++		qh->sched_frame = dwc_frame_num_inc(hcd->frame_number,
++						    SCHEDULE_SLOP);
++		qh->interval = urb->interval;
++
++		if (hprt.b.prtspd == DWC_HPRT0_PRTSPD_HIGH_SPEED) {
++			if (dev_speed == USB_SPEED_LOW ||
++					dev_speed == USB_SPEED_FULL) {
++				qh->interval *= 8;
++				qh->sched_frame |= 0x7;
++				qh->start_split_frame = qh->sched_frame;
++			} else if (int_ep_interval_min >= 2 &&
++					qh->interval < int_ep_interval_min &&
++					qh->ep_type == UE_INTERRUPT) {
++				qh->interval = int_ep_interval_min;
++			}
++		}
++	}
++
++	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD QH Initialized\n");
++	DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH  - qh = %p\n", qh);
++	DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH  - Device Address = %d\n",
++		    dwc_otg_hcd_get_dev_addr(&urb->pipe_info));
++	DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH  - Endpoint %d, %s\n",
++		    dwc_otg_hcd_get_ep_num(&urb->pipe_info),
++		    dwc_otg_hcd_is_pipe_in(&urb->pipe_info) ? "IN" : "OUT");
++	switch (dev_speed) {
++	case USB_SPEED_LOW:
++		qh->dev_speed = DWC_OTG_EP_SPEED_LOW;
++		speed = "low";
++		break;
++	case USB_SPEED_FULL:
++		qh->dev_speed = DWC_OTG_EP_SPEED_FULL;
++		speed = "full";
++		break;
++	case USB_SPEED_HIGH:
++		qh->dev_speed = DWC_OTG_EP_SPEED_HIGH;
++		speed = "high";
++		break;
++	default:
++		speed = "?";
++		break;
++	}
++	DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH  - Speed = %s\n", speed);
++
++	switch (qh->ep_type) {
++	case UE_ISOCHRONOUS:
++		type = "isochronous";
++		break;
++	case UE_INTERRUPT:
++		type = "interrupt";
++		break;
++	case UE_CONTROL:
++		type = "control";
++		break;
++	case UE_BULK:
++		type = "bulk";
++		break;
++	default:
++		type = "?";
++		break;
++	}
++
++	DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH  - Type = %s\n", type);
++
++#ifdef DEBUG
++	if (qh->ep_type == UE_INTERRUPT) {
++		DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH - usecs = %d\n",
++			    qh->usecs);
++		DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH - interval = %d\n",
++			    qh->interval);
++	}
++#endif
++
++}
++
++/**
++ * This function allocates and initializes a QH.
++ *
++ * @param hcd The HCD state structure for the DWC OTG controller.
++ * @param urb Holds the information about the device/endpoint that we need
++ * 	      to initialize the QH.
++ * @param atomic_alloc Flag to do atomic allocation if needed
++ *
++ * @return Returns pointer to the newly allocated QH, or NULL on error. */
++dwc_otg_qh_t *dwc_otg_hcd_qh_create(dwc_otg_hcd_t * hcd,
++				    dwc_otg_hcd_urb_t * urb, int atomic_alloc)
++{
++	dwc_otg_qh_t *qh;
++
++	/* Allocate memory */
++	/** @todo add memflags argument */
++	qh = dwc_otg_hcd_qh_alloc(atomic_alloc);
++	if (qh == NULL) {
++		DWC_ERROR("qh allocation failed");
++		return NULL;
++	}
++
++	qh_init(hcd, qh, urb);
++
++	if (hcd->core_if->dma_desc_enable
++	    && (dwc_otg_hcd_qh_init_ddma(hcd, qh) < 0)) {
++		dwc_otg_hcd_qh_free(hcd, qh);
++		return NULL;
++	}
++
++	return qh;
++}
++
++/* microframe_schedule=0 start */
++
++/**
++ * Checks that a channel is available for a periodic transfer.
++ *
++ * @return 0 if successful, negative error code otherise.
++ */
++static int periodic_channel_available(dwc_otg_hcd_t * hcd)
++{
++	/*
++	 * Currently assuming that there is a dedicated host channnel for each
++	 * periodic transaction plus at least one host channel for
++	 * non-periodic transactions.
++	 */
++	int status;
++	int num_channels;
++
++	num_channels = hcd->core_if->core_params->host_channels;
++	if ((hcd->periodic_channels + hcd->non_periodic_channels < num_channels)
++	    && (hcd->periodic_channels < num_channels - 1)) {
++		status = 0;
++	} else {
++		DWC_INFO("%s: Total channels: %d, Periodic: %d, Non-periodic: %d\n",
++			__func__, num_channels, hcd->periodic_channels, hcd->non_periodic_channels);	//NOTICE
++		status = -DWC_E_NO_SPACE;
++	}
++
++	return status;
++}
++
++/**
++ * Checks that there is sufficient bandwidth for the specified QH in the
++ * periodic schedule. For simplicity, this calculation assumes that all the
++ * transfers in the periodic schedule may occur in the same (micro)frame.
++ *
++ * @param hcd The HCD state structure for the DWC OTG controller.
++ * @param qh QH containing periodic bandwidth required.
++ *
++ * @return 0 if successful, negative error code otherwise.
++ */
++static int check_periodic_bandwidth(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	int status;
++	int16_t max_claimed_usecs;
++
++	status = 0;
++
++	if ((qh->dev_speed == DWC_OTG_EP_SPEED_HIGH) || qh->do_split) {
++		/*
++		 * High speed mode.
++		 * Max periodic usecs is 80% x 125 usec = 100 usec.
++		 */
++
++		max_claimed_usecs = 100 - qh->usecs;
++	} else {
++		/*
++		 * Full speed mode.
++		 * Max periodic usecs is 90% x 1000 usec = 900 usec.
++		 */
++		max_claimed_usecs = 900 - qh->usecs;
++	}
++
++	if (hcd->periodic_usecs > max_claimed_usecs) {
++		DWC_INFO("%s: already claimed usecs %d, required usecs %d\n", __func__, hcd->periodic_usecs, qh->usecs);	//NOTICE
++		status = -DWC_E_NO_SPACE;
++	}
++
++	return status;
++}
++
++/* microframe_schedule=0 end */
++
++/**
++ * Microframe scheduler
++ * track the total use in hcd->frame_usecs
++ * keep each qh use in qh->frame_usecs
++ * when surrendering the qh then donate the time back
++ */
++const unsigned short max_uframe_usecs[]={ 100, 100, 100, 100, 100, 100, 30, 0 };
++
++/*
++ * called from dwc_otg_hcd.c:dwc_otg_hcd_init
++ */
++void init_hcd_usecs(dwc_otg_hcd_t *_hcd)
++{
++	int i;
++	if (_hcd->flags.b.port_speed == DWC_HPRT0_PRTSPD_FULL_SPEED) {
++		_hcd->frame_usecs[0] = 900;
++		for (i = 1; i < 8; i++)
++			_hcd->frame_usecs[i] = 0;
++	} else {
++		for (i = 0; i < 8; i++)
++			_hcd->frame_usecs[i] = max_uframe_usecs[i];
++	}
++}
++
++static int find_single_uframe(dwc_otg_hcd_t * _hcd, dwc_otg_qh_t * _qh)
++{
++	int i;
++	unsigned short utime;
++	int t_left;
++	int ret;
++	int done;
++
++	ret = -1;
++	utime = _qh->usecs;
++	t_left = utime;
++	i = 0;
++	done = 0;
++	while (done == 0) {
++		/* At the start _hcd->frame_usecs[i] = max_uframe_usecs[i]; */
++		if (utime <= _hcd->frame_usecs[i]) {
++			_hcd->frame_usecs[i] -= utime;
++			_qh->frame_usecs[i] += utime;
++			t_left -= utime;
++			ret = i;
++			done = 1;
++			return ret;
++		} else {
++			i++;
++			if (i == 8) {
++				done = 1;
++				ret = -1;
++			}
++		}
++	}
++	return ret;
++ }
++
++/*
++ * use this for FS apps that can span multiple uframes
++  */
++static int find_multi_uframe(dwc_otg_hcd_t * _hcd, dwc_otg_qh_t * _qh)
++{
++	int i;
++	int j;
++	unsigned short utime;
++	int t_left;
++	int ret;
++	int done;
++	unsigned short xtime;
++
++	ret = -1;
++	utime = _qh->usecs;
++	t_left = utime;
++	i = 0;
++	done = 0;
++loop:
++	while (done == 0) {
++		if(_hcd->frame_usecs[i] <= 0) {
++			i++;
++			if (i == 8) {
++				done = 1;
++				ret = -1;
++			}
++			goto loop;
++		}
++
++		/*
++		 * we need n consecutive slots
++		 * so use j as a start slot j plus j+1 must be enough time (for now)
++		 */
++		xtime= _hcd->frame_usecs[i];
++		for (j = i+1 ; j < 8 ; j++ ) {
++                       /*
++                        * if we add this frame remaining time to xtime we may
++                        * be OK, if not we need to test j for a complete frame
++                        */
++                       if ((xtime+_hcd->frame_usecs[j]) < utime) {
++                               if (_hcd->frame_usecs[j] < max_uframe_usecs[j]) {
++                                       j = 8;
++                                       ret = -1;
++                                       continue;
++                               }
++                       }
++                       if (xtime >= utime) {
++                               ret = i;
++                               j = 8;  /* stop loop with a good value ret */
++                               continue;
++                       }
++                       /* add the frame time to x time */
++                       xtime += _hcd->frame_usecs[j];
++		       /* we must have a fully available next frame or break */
++		       if ((xtime < utime)
++				       && (_hcd->frame_usecs[j] == max_uframe_usecs[j])) {
++			       ret = -1;
++			       j = 8;  /* stop loop with a bad value ret */
++			       continue;
++		       }
++		}
++		if (ret >= 0) {
++			t_left = utime;
++			for (j = i; (t_left>0) && (j < 8); j++ ) {
++				t_left -= _hcd->frame_usecs[j];
++				if ( t_left <= 0 ) {
++					_qh->frame_usecs[j] += _hcd->frame_usecs[j] + t_left;
++					_hcd->frame_usecs[j]= -t_left;
++					ret = i;
++					done = 1;
++				} else {
++					_qh->frame_usecs[j] += _hcd->frame_usecs[j];
++					_hcd->frame_usecs[j] = 0;
++				}
++			}
++		} else {
++			i++;
++			if (i == 8) {
++				done = 1;
++				ret = -1;
++			}
++		}
++	}
++	return ret;
++}
++
++static int find_uframe(dwc_otg_hcd_t * _hcd, dwc_otg_qh_t * _qh)
++{
++	int ret;
++	ret = -1;
++
++	if (_qh->speed == USB_SPEED_HIGH ||
++		_hcd->flags.b.port_speed == DWC_HPRT0_PRTSPD_FULL_SPEED) {
++		/* if this is a hs transaction we need a full frame - or account for FS usecs */
++		ret = find_single_uframe(_hcd, _qh);
++	} else {
++		/* if this is a fs transaction we may need a sequence of frames */
++		ret = find_multi_uframe(_hcd, _qh);
++	}
++	return ret;
++}
++
++/**
++ * Checks that the max transfer size allowed in a host channel is large enough
++ * to handle the maximum data transfer in a single (micro)frame for a periodic
++ * transfer.
++ *
++ * @param hcd The HCD state structure for the DWC OTG controller.
++ * @param qh QH for a periodic endpoint.
++ *
++ * @return 0 if successful, negative error code otherwise.
++ */
++static int check_max_xfer_size(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	int status;
++	uint32_t max_xfer_size;
++	uint32_t max_channel_xfer_size;
++
++	status = 0;
++
++	max_xfer_size = dwc_max_packet(qh->maxp) * dwc_hb_mult(qh->maxp);
++	max_channel_xfer_size = hcd->core_if->core_params->max_transfer_size;
++
++	if (max_xfer_size > max_channel_xfer_size) {
++		DWC_INFO("%s: Periodic xfer length %d > " "max xfer length for channel %d\n",
++				__func__, max_xfer_size, max_channel_xfer_size);	//NOTICE
++		status = -DWC_E_NO_SPACE;
++	}
++
++	return status;
++}
++
++
++
++/**
++ * Schedules an interrupt or isochronous transfer in the periodic schedule.
++ *
++ * @param hcd The HCD state structure for the DWC OTG controller.
++ * @param qh QH for the periodic transfer. The QH should already contain the
++ * scheduling information.
++ *
++ * @return 0 if successful, negative error code otherwise.
++ */
++static int schedule_periodic(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	int status = 0;
++
++	if (microframe_schedule) {
++		int frame;
++		status = find_uframe(hcd, qh);
++		frame = -1;
++		if (status == 0) {
++			frame = 7;
++		} else {
++			if (status > 0 )
++				frame = status-1;
++		}
++
++		/* Set the new frame up */
++		if (frame > -1) {
++			qh->sched_frame &= ~0x7;
++			qh->sched_frame |= (frame & 7);
++		}
++
++		if (status != -1)
++			status = 0;
++	} else {
++		status = periodic_channel_available(hcd);
++		if (status) {
++			DWC_INFO("%s: No host channel available for periodic " "transfer.\n", __func__);	//NOTICE
++			return status;
++		}
++
++		status = check_periodic_bandwidth(hcd, qh);
++	}
++	if (status) {
++		DWC_INFO("%s: Insufficient periodic bandwidth for "
++			    "periodic transfer.\n", __func__);
++		return -DWC_E_NO_SPACE;
++	}
++	status = check_max_xfer_size(hcd, qh);
++	if (status) {
++		DWC_INFO("%s: Channel max transfer size too small "
++			    "for periodic transfer.\n", __func__);
++		return status;
++	}
++
++	if (hcd->core_if->dma_desc_enable) {
++		/* Don't rely on SOF and start in ready schedule */
++		DWC_LIST_INSERT_TAIL(&hcd->periodic_sched_ready, &qh->qh_list_entry);
++	}
++	else {
++		if(fiq_enable && (DWC_LIST_EMPTY(&hcd->periodic_sched_inactive) || dwc_frame_num_le(qh->sched_frame, hcd->fiq_state->next_sched_frame)))
++		{
++			hcd->fiq_state->next_sched_frame = qh->sched_frame;
++
++		}
++		/* Always start in the inactive schedule. */
++		DWC_LIST_INSERT_TAIL(&hcd->periodic_sched_inactive, &qh->qh_list_entry);
++	}
++
++	if (!microframe_schedule) {
++		/* Reserve the periodic channel. */
++		hcd->periodic_channels++;
++	}
++
++	/* Update claimed usecs per (micro)frame. */
++	hcd->periodic_usecs += qh->usecs;
++
++	return status;
++}
++
++
++/**
++ * This function adds a QH to either the non periodic or periodic schedule if
++ * it is not already in the schedule. If the QH is already in the schedule, no
++ * action is taken.
++ *
++ * @return 0 if successful, negative error code otherwise.
++ */
++int dwc_otg_hcd_qh_add(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	int status = 0;
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++
++	if (!DWC_LIST_EMPTY(&qh->qh_list_entry)) {
++		/* QH already in a schedule. */
++		return status;
++	}
++
++	/* Add the new QH to the appropriate schedule */
++	if (dwc_qh_is_non_per(qh)) {
++		/* Always start in the inactive schedule. */
++		DWC_LIST_INSERT_TAIL(&hcd->non_periodic_sched_inactive,
++				     &qh->qh_list_entry);
++		//hcd->fiq_state->kick_np_queues = 1;
++	} else {
++		/* If the QH wasn't in a schedule, then sched_frame is stale. */
++		qh->sched_frame = dwc_frame_num_inc(dwc_otg_hcd_get_frame_number(hcd),
++						    max_t(uint32_t, qh->interval, SCHEDULE_SLOP));
++		status = schedule_periodic(hcd, qh);
++		qh->start_split_frame = qh->sched_frame;
++		if ( !hcd->periodic_qh_count ) {
++			intr_mask.b.sofintr = 1;
++			if (fiq_enable) {
++				local_fiq_disable();
++				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
++				DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, intr_mask.d32, intr_mask.d32);
++				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
++				local_fiq_enable();
++			} else {
++				DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, intr_mask.d32, intr_mask.d32);
++			}
++		}
++		hcd->periodic_qh_count++;
++	}
++
++	return status;
++}
++
++/**
++ * Removes an interrupt or isochronous transfer from the periodic schedule.
++ *
++ * @param hcd The HCD state structure for the DWC OTG controller.
++ * @param qh QH for the periodic transfer.
++ */
++static void deschedule_periodic(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	int i;
++	DWC_LIST_REMOVE_INIT(&qh->qh_list_entry);
++
++	/* Update claimed usecs per (micro)frame. */
++	hcd->periodic_usecs -= qh->usecs;
++
++	if (!microframe_schedule) {
++		/* Release the periodic channel reservation. */
++		hcd->periodic_channels--;
++	} else {
++		for (i = 0; i < 8; i++) {
++			hcd->frame_usecs[i] += qh->frame_usecs[i];
++			qh->frame_usecs[i] = 0;
++		}
++	}
++}
++
++/**
++ * Removes a QH from either the non-periodic or periodic schedule.  Memory is
++ * not freed.
++ *
++ * @param hcd The HCD state structure.
++ * @param qh QH to remove from schedule. */
++void dwc_otg_hcd_qh_remove(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
++{
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++
++	if (DWC_LIST_EMPTY(&qh->qh_list_entry)) {
++		/* QH is not in a schedule. */
++		return;
++	}
++
++	if (dwc_qh_is_non_per(qh)) {
++		if (hcd->non_periodic_qh_ptr == &qh->qh_list_entry) {
++			hcd->non_periodic_qh_ptr =
++			    hcd->non_periodic_qh_ptr->next;
++		}
++		DWC_LIST_REMOVE_INIT(&qh->qh_list_entry);
++		//if (!DWC_LIST_EMPTY(&hcd->non_periodic_sched_inactive))
++		//	hcd->fiq_state->kick_np_queues = 1;
++	} else {
++		deschedule_periodic(hcd, qh);
++		hcd->periodic_qh_count--;
++		if( !hcd->periodic_qh_count && !fiq_fsm_enable ) {
++			intr_mask.b.sofintr = 1;
++			if (fiq_enable) {
++				local_fiq_disable();
++				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
++				DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, intr_mask.d32, 0);
++				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
++				local_fiq_enable();
++			} else {
++				DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, intr_mask.d32, 0);
++			}
++		}
++	}
++}
++
++/**
++ * Deactivates a QH. For non-periodic QHs, removes the QH from the active
++ * non-periodic schedule. The QH is added to the inactive non-periodic
++ * schedule if any QTDs are still attached to the QH.
++ *
++ * For periodic QHs, the QH is removed from the periodic queued schedule. If
++ * there are any QTDs still attached to the QH, the QH is added to either the
++ * periodic inactive schedule or the periodic ready schedule and its next
++ * scheduled frame is calculated. The QH is placed in the ready schedule if
++ * the scheduled frame has been reached already. Otherwise it's placed in the
++ * inactive schedule. If there are no QTDs attached to the QH, the QH is
++ * completely removed from the periodic schedule.
++ */
++void dwc_otg_hcd_qh_deactivate(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh,
++			       int sched_next_periodic_split)
++{
++	if (dwc_qh_is_non_per(qh)) {
++		dwc_otg_hcd_qh_remove(hcd, qh);
++		if (!DWC_CIRCLEQ_EMPTY(&qh->qtd_list)) {
++			/* Add back to inactive non-periodic schedule. */
++			dwc_otg_hcd_qh_add(hcd, qh);
++			//hcd->fiq_state->kick_np_queues = 1;
++		} else {
++			if(nak_holdoff && qh->do_split) {
++				qh->nak_frame = 0xFFFF;
++			}
++		}
++	} else {
++		uint16_t frame_number = dwc_otg_hcd_get_frame_number(hcd);
++
++		if (qh->do_split) {
++			/* Schedule the next continuing periodic split transfer */
++			if (sched_next_periodic_split) {
++
++				qh->sched_frame = frame_number;
++
++				if (dwc_frame_num_le(frame_number,
++						     dwc_frame_num_inc
++						     (qh->start_split_frame,
++						      1))) {
++					/*
++					 * Allow one frame to elapse after start
++					 * split microframe before scheduling
++					 * complete split, but DONT if we are
++					 * doing the next start split in the
++					 * same frame for an ISOC out.
++					 */
++					if ((qh->ep_type != UE_ISOCHRONOUS) ||
++					    (qh->ep_is_in != 0)) {
++						qh->sched_frame =
++						    dwc_frame_num_inc(qh->sched_frame, 1);
++					}
++				}
++			} else {
++				qh->sched_frame =
++				    dwc_frame_num_inc(qh->start_split_frame,
++						      qh->interval);
++				if (dwc_frame_num_le
++				    (qh->sched_frame, frame_number)) {
++					qh->sched_frame = frame_number;
++				}
++				qh->sched_frame |= 0x7;
++				qh->start_split_frame = qh->sched_frame;
++			}
++		} else {
++			qh->sched_frame =
++			    dwc_frame_num_inc(qh->sched_frame, qh->interval);
++			if (dwc_frame_num_le(qh->sched_frame, frame_number)) {
++				qh->sched_frame = frame_number;
++			}
++		}
++
++		if (DWC_CIRCLEQ_EMPTY(&qh->qtd_list)) {
++			dwc_otg_hcd_qh_remove(hcd, qh);
++		} else {
++			/*
++			 * Remove from periodic_sched_queued and move to
++			 * appropriate queue.
++			 */
++			if ((microframe_schedule && dwc_frame_num_le(qh->sched_frame, frame_number)) ||
++			(!microframe_schedule && qh->sched_frame == frame_number)) {
++				DWC_LIST_MOVE_HEAD(&hcd->periodic_sched_ready,
++						   &qh->qh_list_entry);
++			} else {
++				if(fiq_enable && !dwc_frame_num_le(hcd->fiq_state->next_sched_frame, qh->sched_frame))
++				{
++					hcd->fiq_state->next_sched_frame = qh->sched_frame;
++				}
++
++				DWC_LIST_MOVE_HEAD
++				    (&hcd->periodic_sched_inactive,
++				     &qh->qh_list_entry);
++			}
++		}
++	}
++}
++
++/**
++ * This function allocates and initializes a QTD.
++ *
++ * @param urb The URB to create a QTD from.  Each URB-QTD pair will end up
++ * 	      pointing to each other so each pair should have a unique correlation.
++ * @param atomic_alloc Flag to do atomic alloc if needed
++ *
++ * @return Returns pointer to the newly allocated QTD, or NULL on error. */
++dwc_otg_qtd_t *dwc_otg_hcd_qtd_create(dwc_otg_hcd_urb_t * urb, int atomic_alloc)
++{
++	dwc_otg_qtd_t *qtd;
++
++	qtd = dwc_otg_hcd_qtd_alloc(atomic_alloc);
++	if (qtd == NULL) {
++		return NULL;
++	}
++
++	dwc_otg_hcd_qtd_init(qtd, urb);
++	return qtd;
++}
++
++/**
++ * Initializes a QTD structure.
++ *
++ * @param qtd The QTD to initialize.
++ * @param urb The URB to use for initialization.  */
++void dwc_otg_hcd_qtd_init(dwc_otg_qtd_t * qtd, dwc_otg_hcd_urb_t * urb)
++{
++	dwc_memset(qtd, 0, sizeof(dwc_otg_qtd_t));
++	qtd->urb = urb;
++	if (dwc_otg_hcd_get_pipe_type(&urb->pipe_info) == UE_CONTROL) {
++		/*
++		 * The only time the QTD data toggle is used is on the data
++		 * phase of control transfers. This phase always starts with
++		 * DATA1.
++		 */
++		qtd->data_toggle = DWC_OTG_HC_PID_DATA1;
++		qtd->control_phase = DWC_OTG_CONTROL_SETUP;
++	}
++
++	/* start split */
++	qtd->complete_split = 0;
++	qtd->isoc_split_pos = DWC_HCSPLIT_XACTPOS_ALL;
++	qtd->isoc_split_offset = 0;
++	qtd->in_process = 0;
++
++	/* Store the qtd ptr in the urb to reference what QTD. */
++	urb->qtd = qtd;
++	return;
++}
++
++/**
++ * This function adds a QTD to the QTD-list of a QH.  It will find the correct
++ * QH to place the QTD into.  If it does not find a QH, then it will create a
++ * new QH. If the QH to which the QTD is added is not currently scheduled, it
++ * is placed into the proper schedule based on its EP type.
++ * HCD lock must be held and interrupts must be disabled on entry
++ *
++ * @param[in] qtd The QTD to add
++ * @param[in] hcd The DWC HCD structure
++ * @param[out] qh out parameter to return queue head
++ * @param atomic_alloc Flag to do atomic alloc if needed
++ *
++ * @return 0 if successful, negative error code otherwise.
++ */
++int dwc_otg_hcd_qtd_add(dwc_otg_qtd_t * qtd,
++			dwc_otg_hcd_t * hcd, dwc_otg_qh_t ** qh, int atomic_alloc)
++{
++	int retval = 0;
++	dwc_otg_hcd_urb_t *urb = qtd->urb;
++
++	/*
++	 * Get the QH which holds the QTD-list to insert to. Create QH if it
++	 * doesn't exist.
++	 */
++	if (*qh == NULL) {
++		*qh = dwc_otg_hcd_qh_create(hcd, urb, atomic_alloc);
++		if (*qh == NULL) {
++			retval = -DWC_E_NO_MEMORY;
++			goto done;
++		} else {
++			if (fiq_enable)
++				hcd->fiq_state->kick_np_queues = 1;
++		}
++	}
++	retval = dwc_otg_hcd_qh_add(hcd, *qh);
++	if (retval == 0) {
++		DWC_CIRCLEQ_INSERT_TAIL(&((*qh)->qtd_list), qtd,
++					qtd_list_entry);
++		qtd->qh = *qh;
++	}
++done:
++
++	return retval;
++}
++
++#endif /* DWC_DEVICE_ONLY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_os_dep.h
+@@ -0,0 +1,200 @@
++#ifndef _DWC_OS_DEP_H_
++#define _DWC_OS_DEP_H_
++
++/**
++ * @file
++ *
++ * This file contains OS dependent structures.
++ *
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/moduleparam.h>
++#include <linux/init.h>
++#include <linux/device.h>
++#include <linux/errno.h>
++#include <linux/types.h>
++#include <linux/slab.h>
++#include <linux/list.h>
++#include <linux/interrupt.h>
++#include <linux/ctype.h>
++#include <linux/string.h>
++#include <linux/dma-mapping.h>
++#include <linux/jiffies.h>
++#include <linux/delay.h>
++#include <linux/timer.h>
++#include <linux/workqueue.h>
++#include <linux/stat.h>
++#include <linux/pci.h>
++#include <linux/compiler.h>
++
++#include <linux/version.h>
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,20)
++# include <linux/irq.h>
++#endif
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
++# include <linux/usb/ch9.h>
++#else
++# include <linux/usb_ch9.h>
++#endif
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24)
++# include <linux/usb/gadget.h>
++#else
++# include <linux/usb_gadget.h>
++#endif
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20)
++# include <asm/irq.h>
++#endif
++
++#ifdef PCI_INTERFACE
++# include <asm/io.h>
++#endif
++
++#ifdef LM_INTERFACE
++# include <linux/unaligned.h>
++# include <asm/sizes.h>
++# include <asm/param.h>
++# include <asm/io.h>
++# if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30))
++#  include <asm/arch/hardware.h>
++#  include <asm/arch/lm.h>
++#  include <asm/arch/irqs.h>
++#  include <asm/arch/regs-irq.h>
++# else
++/* in 2.6.31, at least, we seem to have lost the generic LM infrastructure -
++   here we assume that the machine architecture provides definitions
++   in its own header
++*/
++#  include <mach/lm.h>
++#  include <mach/hardware.h>
++# endif
++#endif
++
++#ifdef PLATFORM_INTERFACE
++#include <linux/platform_device.h>
++#ifdef CONFIG_ARM
++#include <asm/mach/map.h>
++#endif
++#endif
++
++/** The OS page size */
++#define DWC_OS_PAGE_SIZE	PAGE_SIZE
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,14)
++typedef int gfp_t;
++#endif
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,18)
++# define IRQF_SHARED SA_SHIRQ
++#endif
++
++typedef struct os_dependent {
++	/** Base address returned from ioremap() */
++	void *base;
++
++	/** Register offset for Diagnostic API */
++	uint32_t reg_offset;
++
++	/** Base address for MPHI peripheral */
++	void *mphi_base;
++
++	/** mphi_base actually points to the SWIRQ block */
++	bool use_swirq;
++
++	/** IRQ number (<0 if not valid) */
++	int irq_num;
++
++	/** FIQ number (<0 if not valid) */
++	int fiq_num;
++
++#ifdef LM_INTERFACE
++	struct lm_device *lmdev;
++#elif  defined(PCI_INTERFACE)
++	struct pci_dev *pcidev;
++
++	/** Start address of a PCI region */
++	resource_size_t rsrc_start;
++
++	/** Length address of a PCI region */
++	resource_size_t rsrc_len;
++#elif  defined(PLATFORM_INTERFACE)
++	struct platform_device *platformdev;
++#endif
++
++} os_dependent_t;
++
++#ifdef __cplusplus
++}
++#endif
++
++
++
++/* Type for the our device on the chosen bus */
++#if   defined(LM_INTERFACE)
++typedef struct lm_device       dwc_bus_dev_t;
++#elif defined(PCI_INTERFACE)
++typedef struct pci_dev         dwc_bus_dev_t;
++#elif defined(PLATFORM_INTERFACE)
++typedef struct platform_device dwc_bus_dev_t;
++#endif
++
++/* Helper macro to retrieve drvdata from the device on the chosen bus */
++#if    defined(LM_INTERFACE)
++#define DWC_OTG_BUSDRVDATA(_dev) lm_get_drvdata(_dev)
++#elif  defined(PCI_INTERFACE)
++#define DWC_OTG_BUSDRVDATA(_dev) pci_get_drvdata(_dev)
++#elif  defined(PLATFORM_INTERFACE)
++#define DWC_OTG_BUSDRVDATA(_dev) platform_get_drvdata(_dev)
++#endif
++
++/**
++ * Helper macro returning the otg_device structure of a given struct device
++ *
++ * c.f. static dwc_otg_device_t *dwc_otg_drvdev(struct device *_dev)
++ */
++#ifdef LM_INTERFACE
++#define DWC_OTG_GETDRVDEV(_var, _dev) do { \
++                struct lm_device *lm_dev = \
++                        container_of(_dev, struct lm_device, dev); \
++                _var = lm_get_drvdata(lm_dev); \
++        } while (0)
++
++#elif defined(PCI_INTERFACE)
++#define DWC_OTG_GETDRVDEV(_var, _dev) do { \
++                _var = dev_get_drvdata(_dev); \
++        } while (0)
++
++#elif defined(PLATFORM_INTERFACE)
++#define DWC_OTG_GETDRVDEV(_var, _dev) do { \
++                struct platform_device *platform_dev = \
++                        container_of(_dev, struct platform_device, dev); \
++                _var = platform_get_drvdata(platform_dev); \
++        } while (0)
++#endif
++
++
++/**
++ * Helper macro returning the struct dev of the given struct os_dependent
++ *
++ * c.f. static struct device *dwc_otg_getdev(struct os_dependent *osdep)
++ */
++#ifdef LM_INTERFACE
++#define DWC_OTG_OS_GETDEV(_osdep) \
++        ((_osdep).lmdev == NULL? NULL: &(_osdep).lmdev->dev)
++#elif defined(PCI_INTERFACE)
++#define DWC_OTG_OS_GETDEV(_osdep) \
++        ((_osdep).pci_dev == NULL? NULL: &(_osdep).pci_dev->dev)
++#elif defined(PLATFORM_INTERFACE)
++#define DWC_OTG_OS_GETDEV(_osdep) \
++        ((_osdep).platformdev == NULL? NULL: &(_osdep).platformdev->dev)
++#endif
++
++
++
++
++#endif /* _DWC_OS_DEP_H_ */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_pcd.c
+@@ -0,0 +1,2723 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_pcd.c $
++ * $Revision: #101 $
++ * $Date: 2012/08/10 $
++ * $Change: 2047372 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++#ifndef DWC_HOST_ONLY
++
++/** @file
++ * This file implements PCD Core. All code in this file is portable and doesn't
++ * use any OS specific functions.
++ * PCD Core provides Interface, defined in <code><dwc_otg_pcd_if.h></code>
++ * header file, which can be used to implement OS specific PCD interface.
++ *
++ * An important function of the PCD is managing interrupts generated
++ * by the DWC_otg controller. The implementation of the DWC_otg device
++ * mode interrupt service routines is in dwc_otg_pcd_intr.c.
++ *
++ * @todo Add Device Mode test modes (Test J mode, Test K mode, etc).
++ * @todo Does it work when the request size is greater than DEPTSIZ
++ * transfer size
++ *
++ */
++
++#include "dwc_otg_pcd.h"
++
++#ifdef DWC_UTE_CFI
++#include "dwc_otg_cfi.h"
++
++extern int init_cfi(cfiobject_t * cfiobj);
++#endif
++
++/**
++ * Choose endpoint from ep arrays using usb_ep structure.
++ */
++static dwc_otg_pcd_ep_t *get_ep_from_handle(dwc_otg_pcd_t * pcd, void *handle)
++{
++	int i;
++	if (pcd->ep0.priv == handle) {
++		return &pcd->ep0;
++	}
++	for (i = 0; i < MAX_EPS_CHANNELS - 1; i++) {
++		if (pcd->in_ep[i].priv == handle)
++			return &pcd->in_ep[i];
++		if (pcd->out_ep[i].priv == handle)
++			return &pcd->out_ep[i];
++	}
++
++	return NULL;
++}
++
++/**
++ * This function completes a request.  It call's the request call back.
++ */
++void dwc_otg_request_done(dwc_otg_pcd_ep_t * ep, dwc_otg_pcd_request_t * req,
++			  int32_t status)
++{
++	unsigned stopped = ep->stopped;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s(ep %p req %p)\n", __func__, ep, req);
++	DWC_CIRCLEQ_REMOVE_INIT(&ep->queue, req, queue_entry);
++
++	/* don't modify queue heads during completion callback */
++	ep->stopped = 1;
++	/* spin_unlock/spin_lock now done in fops->complete() */
++	ep->pcd->fops->complete(ep->pcd, ep->priv, req->priv, status,
++				req->actual);
++
++	if (ep->pcd->request_pending > 0) {
++		--ep->pcd->request_pending;
++	}
++
++	ep->stopped = stopped;
++	DWC_FREE(req);
++}
++
++/**
++ * This function terminates all the requsts in the EP request queue.
++ */
++void dwc_otg_request_nuke(dwc_otg_pcd_ep_t * ep)
++{
++	dwc_otg_pcd_request_t *req;
++
++	ep->stopped = 1;
++
++	/* called with irqs blocked?? */
++	while (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
++		req = DWC_CIRCLEQ_FIRST(&ep->queue);
++		dwc_otg_request_done(ep, req, -DWC_E_SHUTDOWN);
++	}
++}
++
++void dwc_otg_pcd_start(dwc_otg_pcd_t * pcd,
++		       const struct dwc_otg_pcd_function_ops *fops)
++{
++	pcd->fops = fops;
++}
++
++/**
++ * PCD Callback function for initializing the PCD when switching to
++ * device mode.
++ *
++ * @param p void pointer to the <code>dwc_otg_pcd_t</code>
++ */
++static int32_t dwc_otg_pcd_start_cb(void *p)
++{
++	dwc_otg_pcd_t *pcd = (dwc_otg_pcd_t *) p;
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++
++	/*
++	 * Initialized the Core for Device mode.
++	 */
++	if (dwc_otg_is_device_mode(core_if)) {
++		dwc_otg_core_dev_init(core_if);
++		/* Set core_if's lock pointer to the pcd->lock */
++		core_if->lock = pcd->lock;
++	}
++	return 1;
++}
++
++/** CFI-specific buffer allocation function for EP */
++#ifdef DWC_UTE_CFI
++uint8_t *cfiw_ep_alloc_buffer(dwc_otg_pcd_t * pcd, void *pep, dwc_dma_t * addr,
++			      size_t buflen, int flags)
++{
++	dwc_otg_pcd_ep_t *ep;
++	ep = get_ep_from_handle(pcd, pep);
++	if (!ep) {
++		DWC_WARN("bad ep\n");
++		return -DWC_E_INVALID;
++	}
++
++	return pcd->cfi->ops.ep_alloc_buf(pcd->cfi, pcd, ep, addr, buflen,
++					  flags);
++}
++#else
++uint8_t *cfiw_ep_alloc_buffer(dwc_otg_pcd_t * pcd, void *pep, dwc_dma_t * addr,
++			      size_t buflen, int flags);
++#endif
++
++/**
++ * PCD Callback function for notifying the PCD when resuming from
++ * suspend.
++ *
++ * @param p void pointer to the <code>dwc_otg_pcd_t</code>
++ */
++static int32_t dwc_otg_pcd_resume_cb(void *p)
++{
++	dwc_otg_pcd_t *pcd = (dwc_otg_pcd_t *) p;
++
++	if (pcd->fops->resume) {
++		pcd->fops->resume(pcd);
++	}
++
++	/* Stop the SRP timeout timer. */
++	if ((GET_CORE_IF(pcd)->core_params->phy_type != DWC_PHY_TYPE_PARAM_FS)
++	    || (!GET_CORE_IF(pcd)->core_params->i2c_enable)) {
++		if (GET_CORE_IF(pcd)->srp_timer_started) {
++			GET_CORE_IF(pcd)->srp_timer_started = 0;
++			DWC_TIMER_CANCEL(GET_CORE_IF(pcd)->srp_timer);
++		}
++	}
++	return 1;
++}
++
++/**
++ * PCD Callback function for notifying the PCD device is suspended.
++ *
++ * @param p void pointer to the <code>dwc_otg_pcd_t</code>
++ */
++static int32_t dwc_otg_pcd_suspend_cb(void *p)
++{
++	dwc_otg_pcd_t *pcd = (dwc_otg_pcd_t *) p;
++
++	if (pcd->fops->suspend) {
++		DWC_SPINUNLOCK(pcd->lock);
++		pcd->fops->suspend(pcd);
++		DWC_SPINLOCK(pcd->lock);
++	}
++
++	return 1;
++}
++
++/**
++ * PCD Callback function for stopping the PCD when switching to Host
++ * mode.
++ *
++ * @param p void pointer to the <code>dwc_otg_pcd_t</code>
++ */
++static int32_t dwc_otg_pcd_stop_cb(void *p)
++{
++	dwc_otg_pcd_t *pcd = (dwc_otg_pcd_t *) p;
++	extern void dwc_otg_pcd_stop(dwc_otg_pcd_t * _pcd);
++
++	dwc_otg_pcd_stop(pcd);
++	return 1;
++}
++
++/**
++ * PCD Callback structure for handling mode switching.
++ */
++static dwc_otg_cil_callbacks_t pcd_callbacks = {
++	.start = dwc_otg_pcd_start_cb,
++	.stop = dwc_otg_pcd_stop_cb,
++	.suspend = dwc_otg_pcd_suspend_cb,
++	.resume_wakeup = dwc_otg_pcd_resume_cb,
++	.p = 0,			/* Set at registration */
++};
++
++/**
++ * This function allocates a DMA Descriptor chain for the Endpoint
++ * buffer to be used for a transfer to/from the specified endpoint.
++ */
++static dwc_otg_dev_dma_desc_t *dwc_otg_ep_alloc_desc_chain(struct device *dev,
++						    dwc_dma_t * dma_desc_addr,
++						    uint32_t count)
++{
++	return DWC_DMA_ALLOC_ATOMIC(dev, count * sizeof(dwc_otg_dev_dma_desc_t),
++							dma_desc_addr);
++}
++
++/**
++ * This function frees a DMA Descriptor chain that was allocated by ep_alloc_desc.
++ */
++static void dwc_otg_ep_free_desc_chain(struct device *dev,
++				dwc_otg_dev_dma_desc_t * desc_addr,
++				uint32_t dma_desc_addr, uint32_t count)
++{
++	DWC_DMA_FREE(dev, count * sizeof(dwc_otg_dev_dma_desc_t), desc_addr,
++		     dma_desc_addr);
++}
++
++#ifdef DWC_EN_ISOC
++
++/**
++ * This function initializes a descriptor chain for Isochronous transfer
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param dwc_ep The EP to start the transfer on.
++ *
++ */
++void dwc_otg_iso_ep_start_ddma_transfer(dwc_otg_core_if_t * core_if,
++					dwc_ep_t * dwc_ep)
++{
++
++	dsts_data_t dsts = {.d32 = 0 };
++	depctl_data_t depctl = {.d32 = 0 };
++	volatile uint32_t *addr;
++	int i, j;
++	uint32_t len;
++
++	if (dwc_ep->is_in)
++		dwc_ep->desc_cnt = dwc_ep->buf_proc_intrvl / dwc_ep->bInterval;
++	else
++		dwc_ep->desc_cnt =
++		    dwc_ep->buf_proc_intrvl * dwc_ep->pkt_per_frm /
++		    dwc_ep->bInterval;
++
++	/** Allocate descriptors for double buffering */
++	dwc_ep->iso_desc_addr =
++	    dwc_otg_ep_alloc_desc_chain(&dwc_ep->iso_dma_desc_addr,
++					dwc_ep->desc_cnt * 2);
++	if (dwc_ep->desc_addr) {
++		DWC_WARN("%s, can't allocate DMA descriptor chain\n", __func__);
++		return;
++	}
++
++	dsts.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
++
++	/** ISO OUT EP */
++	if (dwc_ep->is_in == 0) {
++		dev_dma_desc_sts_t sts = {.d32 = 0 };
++		dwc_otg_dev_dma_desc_t *dma_desc = dwc_ep->iso_desc_addr;
++		dma_addr_t dma_ad;
++		uint32_t data_per_desc;
++		dwc_otg_dev_out_ep_regs_t *out_regs =
++		    core_if->dev_if->out_ep_regs[dwc_ep->num];
++		int offset;
++
++		addr = &core_if->dev_if->out_ep_regs[dwc_ep->num]->doepctl;
++		dma_ad = (dma_addr_t) DWC_READ_REG32(&(out_regs->doepdma));
++
++		/** Buffer 0 descriptors setup */
++		dma_ad = dwc_ep->dma_addr0;
++
++		sts.b_iso_out.bs = BS_HOST_READY;
++		sts.b_iso_out.rxsts = 0;
++		sts.b_iso_out.l = 0;
++		sts.b_iso_out.sp = 0;
++		sts.b_iso_out.ioc = 0;
++		sts.b_iso_out.pid = 0;
++		sts.b_iso_out.framenum = 0;
++
++		offset = 0;
++		for (i = 0; i < dwc_ep->desc_cnt - dwc_ep->pkt_per_frm;
++		     i += dwc_ep->pkt_per_frm) {
++
++			for (j = 0; j < dwc_ep->pkt_per_frm; ++j) {
++				uint32_t len = (j + 1) * dwc_ep->maxpacket;
++				if (len > dwc_ep->data_per_frame)
++					data_per_desc =
++					    dwc_ep->data_per_frame -
++					    j * dwc_ep->maxpacket;
++				else
++					data_per_desc = dwc_ep->maxpacket;
++				len = data_per_desc % 4;
++				if (len)
++					data_per_desc += 4 - len;
++
++				sts.b_iso_out.rxbytes = data_per_desc;
++				dma_desc->buf = dma_ad;
++				dma_desc->status.d32 = sts.d32;
++
++				offset += data_per_desc;
++				dma_desc++;
++				dma_ad += data_per_desc;
++			}
++		}
++
++		for (j = 0; j < dwc_ep->pkt_per_frm - 1; ++j) {
++			uint32_t len = (j + 1) * dwc_ep->maxpacket;
++			if (len > dwc_ep->data_per_frame)
++				data_per_desc =
++				    dwc_ep->data_per_frame -
++				    j * dwc_ep->maxpacket;
++			else
++				data_per_desc = dwc_ep->maxpacket;
++			len = data_per_desc % 4;
++			if (len)
++				data_per_desc += 4 - len;
++			sts.b_iso_out.rxbytes = data_per_desc;
++			dma_desc->buf = dma_ad;
++			dma_desc->status.d32 = sts.d32;
++
++			offset += data_per_desc;
++			dma_desc++;
++			dma_ad += data_per_desc;
++		}
++
++		sts.b_iso_out.ioc = 1;
++		len = (j + 1) * dwc_ep->maxpacket;
++		if (len > dwc_ep->data_per_frame)
++			data_per_desc =
++			    dwc_ep->data_per_frame - j * dwc_ep->maxpacket;
++		else
++			data_per_desc = dwc_ep->maxpacket;
++		len = data_per_desc % 4;
++		if (len)
++			data_per_desc += 4 - len;
++		sts.b_iso_out.rxbytes = data_per_desc;
++
++		dma_desc->buf = dma_ad;
++		dma_desc->status.d32 = sts.d32;
++		dma_desc++;
++
++		/** Buffer 1 descriptors setup */
++		sts.b_iso_out.ioc = 0;
++		dma_ad = dwc_ep->dma_addr1;
++
++		offset = 0;
++		for (i = 0; i < dwc_ep->desc_cnt - dwc_ep->pkt_per_frm;
++		     i += dwc_ep->pkt_per_frm) {
++			for (j = 0; j < dwc_ep->pkt_per_frm; ++j) {
++				uint32_t len = (j + 1) * dwc_ep->maxpacket;
++				if (len > dwc_ep->data_per_frame)
++					data_per_desc =
++					    dwc_ep->data_per_frame -
++					    j * dwc_ep->maxpacket;
++				else
++					data_per_desc = dwc_ep->maxpacket;
++				len = data_per_desc % 4;
++				if (len)
++					data_per_desc += 4 - len;
++
++				data_per_desc =
++				    sts.b_iso_out.rxbytes = data_per_desc;
++				dma_desc->buf = dma_ad;
++				dma_desc->status.d32 = sts.d32;
++
++				offset += data_per_desc;
++				dma_desc++;
++				dma_ad += data_per_desc;
++			}
++		}
++		for (j = 0; j < dwc_ep->pkt_per_frm - 1; ++j) {
++			data_per_desc =
++			    ((j + 1) * dwc_ep->maxpacket >
++			     dwc_ep->data_per_frame) ? dwc_ep->data_per_frame -
++			    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
++			data_per_desc +=
++			    (data_per_desc % 4) ? (4 - data_per_desc % 4) : 0;
++			sts.b_iso_out.rxbytes = data_per_desc;
++			dma_desc->buf = dma_ad;
++			dma_desc->status.d32 = sts.d32;
++
++			offset += data_per_desc;
++			dma_desc++;
++			dma_ad += data_per_desc;
++		}
++
++		sts.b_iso_out.ioc = 1;
++		sts.b_iso_out.l = 1;
++		data_per_desc =
++		    ((j + 1) * dwc_ep->maxpacket >
++		     dwc_ep->data_per_frame) ? dwc_ep->data_per_frame -
++		    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
++		data_per_desc +=
++		    (data_per_desc % 4) ? (4 - data_per_desc % 4) : 0;
++		sts.b_iso_out.rxbytes = data_per_desc;
++
++		dma_desc->buf = dma_ad;
++		dma_desc->status.d32 = sts.d32;
++
++		dwc_ep->next_frame = 0;
++
++		/** Write dma_ad into DOEPDMA register */
++		DWC_WRITE_REG32(&(out_regs->doepdma),
++				(uint32_t) dwc_ep->iso_dma_desc_addr);
++
++	}
++	/** ISO IN EP */
++	else {
++		dev_dma_desc_sts_t sts = {.d32 = 0 };
++		dwc_otg_dev_dma_desc_t *dma_desc = dwc_ep->iso_desc_addr;
++		dma_addr_t dma_ad;
++		dwc_otg_dev_in_ep_regs_t *in_regs =
++		    core_if->dev_if->in_ep_regs[dwc_ep->num];
++		unsigned int frmnumber;
++		fifosize_data_t txfifosize, rxfifosize;
++
++		txfifosize.d32 =
++		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[dwc_ep->num]->
++				   dtxfsts);
++		rxfifosize.d32 =
++		    DWC_READ_REG32(&core_if->core_global_regs->grxfsiz);
++
++		addr = &core_if->dev_if->in_ep_regs[dwc_ep->num]->diepctl;
++
++		dma_ad = dwc_ep->dma_addr0;
++
++		dsts.d32 =
++		    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
++
++		sts.b_iso_in.bs = BS_HOST_READY;
++		sts.b_iso_in.txsts = 0;
++		sts.b_iso_in.sp =
++		    (dwc_ep->data_per_frame % dwc_ep->maxpacket) ? 1 : 0;
++		sts.b_iso_in.ioc = 0;
++		sts.b_iso_in.pid = dwc_ep->pkt_per_frm;
++
++		frmnumber = dwc_ep->next_frame;
++
++		sts.b_iso_in.framenum = frmnumber;
++		sts.b_iso_in.txbytes = dwc_ep->data_per_frame;
++		sts.b_iso_in.l = 0;
++
++		/** Buffer 0 descriptors setup */
++		for (i = 0; i < dwc_ep->desc_cnt - 1; i++) {
++			dma_desc->buf = dma_ad;
++			dma_desc->status.d32 = sts.d32;
++			dma_desc++;
++
++			dma_ad += dwc_ep->data_per_frame;
++			sts.b_iso_in.framenum += dwc_ep->bInterval;
++		}
++
++		sts.b_iso_in.ioc = 1;
++		dma_desc->buf = dma_ad;
++		dma_desc->status.d32 = sts.d32;
++		++dma_desc;
++
++		/** Buffer 1 descriptors setup */
++		sts.b_iso_in.ioc = 0;
++		dma_ad = dwc_ep->dma_addr1;
++
++		for (i = 0; i < dwc_ep->desc_cnt - dwc_ep->pkt_per_frm;
++		     i += dwc_ep->pkt_per_frm) {
++			dma_desc->buf = dma_ad;
++			dma_desc->status.d32 = sts.d32;
++			dma_desc++;
++
++			dma_ad += dwc_ep->data_per_frame;
++			sts.b_iso_in.framenum += dwc_ep->bInterval;
++
++			sts.b_iso_in.ioc = 0;
++		}
++		sts.b_iso_in.ioc = 1;
++		sts.b_iso_in.l = 1;
++
++		dma_desc->buf = dma_ad;
++		dma_desc->status.d32 = sts.d32;
++
++		dwc_ep->next_frame = sts.b_iso_in.framenum + dwc_ep->bInterval;
++
++		/** Write dma_ad into diepdma register */
++		DWC_WRITE_REG32(&(in_regs->diepdma),
++				(uint32_t) dwc_ep->iso_dma_desc_addr);
++	}
++	/** Enable endpoint, clear nak  */
++	depctl.d32 = 0;
++	depctl.b.epena = 1;
++	depctl.b.usbactep = 1;
++	depctl.b.cnak = 1;
++
++	DWC_MODIFY_REG32(addr, depctl.d32, depctl.d32);
++	depctl.d32 = DWC_READ_REG32(addr);
++}
++
++/**
++ * This function initializes a descriptor chain for Isochronous transfer
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to start the transfer on.
++ *
++ */
++void dwc_otg_iso_ep_start_buf_transfer(dwc_otg_core_if_t * core_if,
++				       dwc_ep_t * ep)
++{
++	depctl_data_t depctl = {.d32 = 0 };
++	volatile uint32_t *addr;
++
++	if (ep->is_in) {
++		addr = &core_if->dev_if->in_ep_regs[ep->num]->diepctl;
++	} else {
++		addr = &core_if->dev_if->out_ep_regs[ep->num]->doepctl;
++	}
++
++	if (core_if->dma_enable == 0 || core_if->dma_desc_enable != 0) {
++		return;
++	} else {
++		deptsiz_data_t deptsiz = {.d32 = 0 };
++
++		ep->xfer_len =
++		    ep->data_per_frame * ep->buf_proc_intrvl / ep->bInterval;
++		ep->pkt_cnt =
++		    (ep->xfer_len - 1 + ep->maxpacket) / ep->maxpacket;
++		ep->xfer_count = 0;
++		ep->xfer_buff =
++		    (ep->proc_buf_num) ? ep->xfer_buff1 : ep->xfer_buff0;
++		ep->dma_addr =
++		    (ep->proc_buf_num) ? ep->dma_addr1 : ep->dma_addr0;
++
++		if (ep->is_in) {
++			/* Program the transfer size and packet count
++			 *      as follows: xfersize = N * maxpacket +
++			 *      short_packet pktcnt = N + (short_packet
++			 *      exist ? 1 : 0)
++			 */
++			deptsiz.b.mc = ep->pkt_per_frm;
++			deptsiz.b.xfersize = ep->xfer_len;
++			deptsiz.b.pktcnt =
++			    (ep->xfer_len - 1 + ep->maxpacket) / ep->maxpacket;
++			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
++					dieptsiz, deptsiz.d32);
++
++			/* Write the DMA register */
++			DWC_WRITE_REG32(&
++					(core_if->dev_if->in_ep_regs[ep->num]->
++					 diepdma), (uint32_t) ep->dma_addr);
++
++		} else {
++			deptsiz.b.pktcnt =
++			    (ep->xfer_len + (ep->maxpacket - 1)) /
++			    ep->maxpacket;
++			deptsiz.b.xfersize = deptsiz.b.pktcnt * ep->maxpacket;
++
++			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[ep->num]->
++					doeptsiz, deptsiz.d32);
++
++			/* Write the DMA register */
++			DWC_WRITE_REG32(&
++					(core_if->dev_if->out_ep_regs[ep->num]->
++					 doepdma), (uint32_t) ep->dma_addr);
++
++		}
++		/** Enable endpoint, clear nak  */
++		depctl.d32 = 0;
++		depctl.b.epena = 1;
++		depctl.b.cnak = 1;
++
++		DWC_MODIFY_REG32(addr, depctl.d32, depctl.d32);
++	}
++}
++
++/**
++ * This function does the setup for a data transfer for an EP and
++ * starts the transfer. For an IN transfer, the packets will be
++ * loaded into the appropriate Tx FIFO in the ISR. For OUT transfers,
++ * the packets are unloaded from the Rx FIFO in the ISR.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to start the transfer on.
++ */
++
++static void dwc_otg_iso_ep_start_transfer(dwc_otg_core_if_t * core_if,
++					  dwc_ep_t * ep)
++{
++	if (core_if->dma_enable) {
++		if (core_if->dma_desc_enable) {
++			if (ep->is_in) {
++				ep->desc_cnt = ep->pkt_cnt / ep->pkt_per_frm;
++			} else {
++				ep->desc_cnt = ep->pkt_cnt;
++			}
++			dwc_otg_iso_ep_start_ddma_transfer(core_if, ep);
++		} else {
++			if (core_if->pti_enh_enable) {
++				dwc_otg_iso_ep_start_buf_transfer(core_if, ep);
++			} else {
++				ep->cur_pkt_addr =
++				    (ep->proc_buf_num) ? ep->xfer_buff1 : ep->
++				    xfer_buff0;
++				ep->cur_pkt_dma_addr =
++				    (ep->proc_buf_num) ? ep->dma_addr1 : ep->
++				    dma_addr0;
++				dwc_otg_iso_ep_start_frm_transfer(core_if, ep);
++			}
++		}
++	} else {
++		ep->cur_pkt_addr =
++		    (ep->proc_buf_num) ? ep->xfer_buff1 : ep->xfer_buff0;
++		ep->cur_pkt_dma_addr =
++		    (ep->proc_buf_num) ? ep->dma_addr1 : ep->dma_addr0;
++		dwc_otg_iso_ep_start_frm_transfer(core_if, ep);
++	}
++}
++
++/**
++ * This function stops transfer for an EP and
++ * resets the ep's variables.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to start the transfer on.
++ */
++
++void dwc_otg_iso_ep_stop_transfer(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	depctl_data_t depctl = {.d32 = 0 };
++	volatile uint32_t *addr;
++
++	if (ep->is_in == 1) {
++		addr = &core_if->dev_if->in_ep_regs[ep->num]->diepctl;
++	} else {
++		addr = &core_if->dev_if->out_ep_regs[ep->num]->doepctl;
++	}
++
++	/* disable the ep */
++	depctl.d32 = DWC_READ_REG32(addr);
++
++	depctl.b.epdis = 1;
++	depctl.b.snak = 1;
++
++	DWC_WRITE_REG32(addr, depctl.d32);
++
++	if (core_if->dma_desc_enable &&
++	    ep->iso_desc_addr && ep->iso_dma_desc_addr) {
++		dwc_otg_ep_free_desc_chain(ep->iso_desc_addr,
++					   ep->iso_dma_desc_addr,
++					   ep->desc_cnt * 2);
++	}
++
++	/* reset varibales */
++	ep->dma_addr0 = 0;
++	ep->dma_addr1 = 0;
++	ep->xfer_buff0 = 0;
++	ep->xfer_buff1 = 0;
++	ep->data_per_frame = 0;
++	ep->data_pattern_frame = 0;
++	ep->sync_frame = 0;
++	ep->buf_proc_intrvl = 0;
++	ep->bInterval = 0;
++	ep->proc_buf_num = 0;
++	ep->pkt_per_frm = 0;
++	ep->pkt_per_frm = 0;
++	ep->desc_cnt = 0;
++	ep->iso_desc_addr = 0;
++	ep->iso_dma_desc_addr = 0;
++}
++
++int dwc_otg_pcd_iso_ep_start(dwc_otg_pcd_t * pcd, void *ep_handle,
++			     uint8_t * buf0, uint8_t * buf1, dwc_dma_t dma0,
++			     dwc_dma_t dma1, int sync_frame, int dp_frame,
++			     int data_per_frame, int start_frame,
++			     int buf_proc_intrvl, void *req_handle,
++			     int atomic_alloc)
++{
++	dwc_otg_pcd_ep_t *ep;
++	dwc_irqflags_t flags = 0;
++	dwc_ep_t *dwc_ep;
++	int32_t frm_data;
++	dsts_data_t dsts;
++	dwc_otg_core_if_t *core_if;
++
++	ep = get_ep_from_handle(pcd, ep_handle);
++
++	if (!ep || !ep->desc || ep->dwc_ep.num == 0) {
++		DWC_WARN("bad ep\n");
++		return -DWC_E_INVALID;
++	}
++
++	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
++	core_if = GET_CORE_IF(pcd);
++	dwc_ep = &ep->dwc_ep;
++
++	if (ep->iso_req_handle) {
++		DWC_WARN("ISO request in progress\n");
++	}
++
++	dwc_ep->dma_addr0 = dma0;
++	dwc_ep->dma_addr1 = dma1;
++
++	dwc_ep->xfer_buff0 = buf0;
++	dwc_ep->xfer_buff1 = buf1;
++
++	dwc_ep->data_per_frame = data_per_frame;
++
++	/** @todo - pattern data support is to be implemented in the future */
++	dwc_ep->data_pattern_frame = dp_frame;
++	dwc_ep->sync_frame = sync_frame;
++
++	dwc_ep->buf_proc_intrvl = buf_proc_intrvl;
++
++	dwc_ep->bInterval = 1 << (ep->desc->bInterval - 1);
++
++	dwc_ep->proc_buf_num = 0;
++
++	dwc_ep->pkt_per_frm = 0;
++	frm_data = ep->dwc_ep.data_per_frame;
++	while (frm_data > 0) {
++		dwc_ep->pkt_per_frm++;
++		frm_data -= ep->dwc_ep.maxpacket;
++	}
++
++	dsts.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
++
++	if (start_frame == -1) {
++		dwc_ep->next_frame = dsts.b.soffn + 1;
++		if (dwc_ep->bInterval != 1) {
++			dwc_ep->next_frame =
++			    dwc_ep->next_frame + (dwc_ep->bInterval - 1 -
++						  dwc_ep->next_frame %
++						  dwc_ep->bInterval);
++		}
++	} else {
++		dwc_ep->next_frame = start_frame;
++	}
++
++	if (!core_if->pti_enh_enable) {
++		dwc_ep->pkt_cnt =
++		    dwc_ep->buf_proc_intrvl * dwc_ep->pkt_per_frm /
++		    dwc_ep->bInterval;
++	} else {
++		dwc_ep->pkt_cnt =
++		    (dwc_ep->data_per_frame *
++		     (dwc_ep->buf_proc_intrvl / dwc_ep->bInterval)
++		     - 1 + dwc_ep->maxpacket) / dwc_ep->maxpacket;
++	}
++
++	if (core_if->dma_desc_enable) {
++		dwc_ep->desc_cnt =
++		    dwc_ep->buf_proc_intrvl * dwc_ep->pkt_per_frm /
++		    dwc_ep->bInterval;
++	}
++
++	if (atomic_alloc) {
++		dwc_ep->pkt_info =
++		    DWC_ALLOC_ATOMIC(sizeof(iso_pkt_info_t) * dwc_ep->pkt_cnt);
++	} else {
++		dwc_ep->pkt_info =
++		    DWC_ALLOC(sizeof(iso_pkt_info_t) * dwc_ep->pkt_cnt);
++	}
++	if (!dwc_ep->pkt_info) {
++		DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++		return -DWC_E_NO_MEMORY;
++	}
++	if (core_if->pti_enh_enable) {
++		dwc_memset(dwc_ep->pkt_info, 0,
++			   sizeof(iso_pkt_info_t) * dwc_ep->pkt_cnt);
++	}
++
++	dwc_ep->cur_pkt = 0;
++	ep->iso_req_handle = req_handle;
++
++	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++	dwc_otg_iso_ep_start_transfer(core_if, dwc_ep);
++	return 0;
++}
++
++int dwc_otg_pcd_iso_ep_stop(dwc_otg_pcd_t * pcd, void *ep_handle,
++			    void *req_handle)
++{
++	dwc_irqflags_t flags = 0;
++	dwc_otg_pcd_ep_t *ep;
++	dwc_ep_t *dwc_ep;
++
++	ep = get_ep_from_handle(pcd, ep_handle);
++	if (!ep || !ep->desc || ep->dwc_ep.num == 0) {
++		DWC_WARN("bad ep\n");
++		return -DWC_E_INVALID;
++	}
++	dwc_ep = &ep->dwc_ep;
++
++	dwc_otg_iso_ep_stop_transfer(GET_CORE_IF(pcd), dwc_ep);
++
++	DWC_FREE(dwc_ep->pkt_info);
++	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
++	if (ep->iso_req_handle != req_handle) {
++		DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++		return -DWC_E_INVALID;
++	}
++
++	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++
++	ep->iso_req_handle = 0;
++	return 0;
++}
++
++/**
++ * This function is used for perodical data exchnage between PCD and gadget drivers.
++ * for Isochronous EPs
++ *
++ *	- Every time a sync period completes this function is called to
++ *	  perform data exchange between PCD and gadget
++ */
++void dwc_otg_iso_buffer_done(dwc_otg_pcd_t * pcd, dwc_otg_pcd_ep_t * ep,
++			     void *req_handle)
++{
++	int i;
++	dwc_ep_t *dwc_ep;
++
++	dwc_ep = &ep->dwc_ep;
++
++	DWC_SPINUNLOCK(ep->pcd->lock);
++	pcd->fops->isoc_complete(pcd, ep->priv, ep->iso_req_handle,
++				 dwc_ep->proc_buf_num ^ 0x1);
++	DWC_SPINLOCK(ep->pcd->lock);
++
++	for (i = 0; i < dwc_ep->pkt_cnt; ++i) {
++		dwc_ep->pkt_info[i].status = 0;
++		dwc_ep->pkt_info[i].offset = 0;
++		dwc_ep->pkt_info[i].length = 0;
++	}
++}
++
++int dwc_otg_pcd_get_iso_packet_count(dwc_otg_pcd_t * pcd, void *ep_handle,
++				     void *iso_req_handle)
++{
++	dwc_otg_pcd_ep_t *ep;
++	dwc_ep_t *dwc_ep;
++
++	ep = get_ep_from_handle(pcd, ep_handle);
++	if (!ep->desc || ep->dwc_ep.num == 0) {
++		DWC_WARN("bad ep\n");
++		return -DWC_E_INVALID;
++	}
++	dwc_ep = &ep->dwc_ep;
++
++	return dwc_ep->pkt_cnt;
++}
++
++void dwc_otg_pcd_get_iso_packet_params(dwc_otg_pcd_t * pcd, void *ep_handle,
++				       void *iso_req_handle, int packet,
++				       int *status, int *actual, int *offset)
++{
++	dwc_otg_pcd_ep_t *ep;
++	dwc_ep_t *dwc_ep;
++
++	ep = get_ep_from_handle(pcd, ep_handle);
++	if (!ep)
++		DWC_WARN("bad ep\n");
++
++	dwc_ep = &ep->dwc_ep;
++
++	*status = dwc_ep->pkt_info[packet].status;
++	*actual = dwc_ep->pkt_info[packet].length;
++	*offset = dwc_ep->pkt_info[packet].offset;
++}
++
++#endif /* DWC_EN_ISOC */
++
++static void dwc_otg_pcd_init_ep(dwc_otg_pcd_t * pcd, dwc_otg_pcd_ep_t * pcd_ep,
++				uint32_t is_in, uint32_t ep_num)
++{
++	/* Init EP structure */
++	pcd_ep->desc = 0;
++	pcd_ep->pcd = pcd;
++	pcd_ep->stopped = 1;
++	pcd_ep->queue_sof = 0;
++
++	/* Init DWC ep structure */
++	pcd_ep->dwc_ep.is_in = is_in;
++	pcd_ep->dwc_ep.num = ep_num;
++	pcd_ep->dwc_ep.active = 0;
++	pcd_ep->dwc_ep.tx_fifo_num = 0;
++	/* Control until ep is actvated */
++	pcd_ep->dwc_ep.type = DWC_OTG_EP_TYPE_CONTROL;
++	pcd_ep->dwc_ep.maxpacket = MAX_PACKET_SIZE;
++	pcd_ep->dwc_ep.dma_addr = 0;
++	pcd_ep->dwc_ep.start_xfer_buff = 0;
++	pcd_ep->dwc_ep.xfer_buff = 0;
++	pcd_ep->dwc_ep.xfer_len = 0;
++	pcd_ep->dwc_ep.xfer_count = 0;
++	pcd_ep->dwc_ep.sent_zlp = 0;
++	pcd_ep->dwc_ep.total_len = 0;
++	pcd_ep->dwc_ep.desc_addr = 0;
++	pcd_ep->dwc_ep.dma_desc_addr = 0;
++	DWC_CIRCLEQ_INIT(&pcd_ep->queue);
++}
++
++/**
++ * Initialize ep's
++ */
++static void dwc_otg_pcd_reinit(dwc_otg_pcd_t * pcd)
++{
++	int i;
++	uint32_t hwcfg1;
++	dwc_otg_pcd_ep_t *ep;
++	int in_ep_cntr, out_ep_cntr;
++	uint32_t num_in_eps = (GET_CORE_IF(pcd))->dev_if->num_in_eps;
++	uint32_t num_out_eps = (GET_CORE_IF(pcd))->dev_if->num_out_eps;
++
++	/**
++	 * Initialize the EP0 structure.
++	 */
++	ep = &pcd->ep0;
++	dwc_otg_pcd_init_ep(pcd, ep, 0, 0);
++
++	in_ep_cntr = 0;
++	hwcfg1 = (GET_CORE_IF(pcd))->hwcfg1.d32 >> 3;
++	for (i = 1; in_ep_cntr < num_in_eps; i++) {
++		if ((hwcfg1 & 0x1) == 0) {
++			dwc_otg_pcd_ep_t *ep = &pcd->in_ep[in_ep_cntr];
++			in_ep_cntr++;
++			/**
++			 * @todo NGS: Add direction to EP, based on contents
++			 * of HWCFG1.  Need a copy of HWCFG1 in pcd structure?
++			 * sprintf(";r
++			 */
++			dwc_otg_pcd_init_ep(pcd, ep, 1 /* IN */ , i);
++
++			DWC_CIRCLEQ_INIT(&ep->queue);
++		}
++		hwcfg1 >>= 2;
++	}
++
++	out_ep_cntr = 0;
++	hwcfg1 = (GET_CORE_IF(pcd))->hwcfg1.d32 >> 2;
++	for (i = 1; out_ep_cntr < num_out_eps; i++) {
++		if ((hwcfg1 & 0x1) == 0) {
++			dwc_otg_pcd_ep_t *ep = &pcd->out_ep[out_ep_cntr];
++			out_ep_cntr++;
++			/**
++			 * @todo NGS: Add direction to EP, based on contents
++			 * of HWCFG1.  Need a copy of HWCFG1 in pcd structure?
++			 * sprintf(";r
++			 */
++			dwc_otg_pcd_init_ep(pcd, ep, 0 /* OUT */ , i);
++			DWC_CIRCLEQ_INIT(&ep->queue);
++		}
++		hwcfg1 >>= 2;
++	}
++
++	pcd->ep0state = EP0_DISCONNECT;
++	pcd->ep0.dwc_ep.maxpacket = MAX_EP0_SIZE;
++	pcd->ep0.dwc_ep.type = DWC_OTG_EP_TYPE_CONTROL;
++}
++
++/**
++ * This function is called when the SRP timer expires. The SRP should
++ * complete within 6 seconds.
++ */
++static void srp_timeout(void *ptr)
++{
++	gotgctl_data_t gotgctl;
++	dwc_otg_core_if_t *core_if = (dwc_otg_core_if_t *) ptr;
++	volatile uint32_t *addr = &core_if->core_global_regs->gotgctl;
++
++	gotgctl.d32 = DWC_READ_REG32(addr);
++
++	core_if->srp_timer_started = 0;
++
++	if (core_if->adp_enable) {
++		if (gotgctl.b.bsesvld == 0) {
++			gpwrdn_data_t gpwrdn = {.d32 = 0 };
++			DWC_PRINTF("SRP Timeout BSESSVLD = 0\n");
++			/* Power off the core */
++			if (core_if->power_down == 2) {
++				gpwrdn.b.pwrdnswtch = 1;
++				DWC_MODIFY_REG32(&core_if->
++						 core_global_regs->gpwrdn,
++						 gpwrdn.d32, 0);
++			}
++
++			gpwrdn.d32 = 0;
++			gpwrdn.b.pmuintsel = 1;
++			gpwrdn.b.pmuactv = 1;
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0,
++					 gpwrdn.d32);
++			dwc_otg_adp_probe_start(core_if);
++		} else {
++			DWC_PRINTF("SRP Timeout BSESSVLD = 1\n");
++			core_if->op_state = B_PERIPHERAL;
++			dwc_otg_core_init(core_if);
++			dwc_otg_enable_global_interrupts(core_if);
++			cil_pcd_start(core_if);
++		}
++	}
++
++	if ((core_if->core_params->phy_type == DWC_PHY_TYPE_PARAM_FS) &&
++	    (core_if->core_params->i2c_enable)) {
++		DWC_PRINTF("SRP Timeout\n");
++
++		if ((core_if->srp_success) && (gotgctl.b.bsesvld)) {
++			if (core_if->pcd_cb && core_if->pcd_cb->resume_wakeup) {
++				core_if->pcd_cb->resume_wakeup(core_if->pcd_cb->p);
++			}
++
++			/* Clear Session Request */
++			gotgctl.d32 = 0;
++			gotgctl.b.sesreq = 1;
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gotgctl,
++					 gotgctl.d32, 0);
++
++			core_if->srp_success = 0;
++		} else {
++			__DWC_ERROR("Device not connected/responding\n");
++			gotgctl.b.sesreq = 0;
++			DWC_WRITE_REG32(addr, gotgctl.d32);
++		}
++	} else if (gotgctl.b.sesreq) {
++		DWC_PRINTF("SRP Timeout\n");
++
++		__DWC_ERROR("Device not connected/responding\n");
++		gotgctl.b.sesreq = 0;
++		DWC_WRITE_REG32(addr, gotgctl.d32);
++	} else {
++		DWC_PRINTF(" SRP GOTGCTL=%0x\n", gotgctl.d32);
++	}
++}
++
++/**
++ * Tasklet
++ *
++ */
++static void start_xfer_tasklet_func(void *data)
++{
++	dwc_otg_pcd_t *pcd = (dwc_otg_pcd_t *) data;
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++
++	int i;
++	depctl_data_t diepctl;
++
++	DWC_DEBUGPL(DBG_PCDV, "Start xfer tasklet\n");
++
++	diepctl.d32 = DWC_READ_REG32(&core_if->dev_if->in_ep_regs[0]->diepctl);
++
++	if (pcd->ep0.queue_sof) {
++		pcd->ep0.queue_sof = 0;
++		start_next_request(&pcd->ep0);
++		// break;
++	}
++
++	for (i = 0; i < core_if->dev_if->num_in_eps; i++) {
++		depctl_data_t diepctl;
++		diepctl.d32 =
++		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[i]->diepctl);
++
++		if (pcd->in_ep[i].queue_sof) {
++			pcd->in_ep[i].queue_sof = 0;
++			start_next_request(&pcd->in_ep[i]);
++			// break;
++		}
++	}
++
++	return;
++}
++
++/**
++ * This function initialized the PCD portion of the driver.
++ *
++ */
++dwc_otg_pcd_t *dwc_otg_pcd_init(dwc_otg_device_t *otg_dev)
++{
++	struct device *dev = &otg_dev->os_dep.platformdev->dev;
++	dwc_otg_core_if_t *core_if = otg_dev->core_if;
++	dwc_otg_pcd_t *pcd = NULL;
++	dwc_otg_dev_if_t *dev_if;
++	int i;
++
++	/*
++	 * Allocate PCD structure
++	 */
++	pcd = DWC_ALLOC(sizeof(dwc_otg_pcd_t));
++
++	if (pcd == NULL) {
++		return NULL;
++	}
++
++#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_SPINLOCK))
++	DWC_SPINLOCK_ALLOC_LINUX_DEBUG(pcd->lock);
++#else
++	pcd->lock = DWC_SPINLOCK_ALLOC();
++#endif
++        DWC_DEBUGPL(DBG_HCDV, "Init of PCD %p given core_if %p\n",
++                    pcd, core_if);//GRAYG
++	if (!pcd->lock) {
++		DWC_ERROR("Could not allocate lock for pcd");
++		DWC_FREE(pcd);
++		return NULL;
++	}
++	/* Set core_if's lock pointer to hcd->lock */
++	core_if->lock = pcd->lock;
++	pcd->core_if = core_if;
++
++	dev_if = core_if->dev_if;
++	dev_if->isoc_ep = NULL;
++
++	if (core_if->hwcfg4.b.ded_fifo_en) {
++		DWC_PRINTF("Dedicated Tx FIFOs mode\n");
++	} else {
++		DWC_PRINTF("Shared Tx FIFO mode\n");
++	}
++
++	/*
++	 * Initialized the Core for Device mode here if there is nod ADP support.
++	 * Otherwise it will be done later in dwc_otg_adp_start routine.
++	 */
++	if (dwc_otg_is_device_mode(core_if) /*&& !core_if->adp_enable*/) {
++		dwc_otg_core_dev_init(core_if);
++	}
++
++	/*
++	 * Register the PCD Callbacks.
++	 */
++	dwc_otg_cil_register_pcd_callbacks(core_if, &pcd_callbacks, pcd);
++
++	/*
++	 * Initialize the DMA buffer for SETUP packets
++	 */
++	if (GET_CORE_IF(pcd)->dma_enable) {
++		pcd->setup_pkt =
++		    DWC_DMA_ALLOC(dev, sizeof(*pcd->setup_pkt) * 5,
++				  &pcd->setup_pkt_dma_handle);
++		if (pcd->setup_pkt == NULL) {
++			DWC_FREE(pcd);
++			return NULL;
++		}
++
++		pcd->status_buf =
++		    DWC_DMA_ALLOC(dev, sizeof(uint16_t),
++				  &pcd->status_buf_dma_handle);
++		if (pcd->status_buf == NULL) {
++			DWC_DMA_FREE(dev, sizeof(*pcd->setup_pkt) * 5,
++				     pcd->setup_pkt, pcd->setup_pkt_dma_handle);
++			DWC_FREE(pcd);
++			return NULL;
++		}
++
++		if (GET_CORE_IF(pcd)->dma_desc_enable) {
++			dev_if->setup_desc_addr[0] =
++			    dwc_otg_ep_alloc_desc_chain(dev,
++				&dev_if->dma_setup_desc_addr[0], 1);
++			dev_if->setup_desc_addr[1] =
++			    dwc_otg_ep_alloc_desc_chain(dev,
++				&dev_if->dma_setup_desc_addr[1], 1);
++			dev_if->in_desc_addr =
++			    dwc_otg_ep_alloc_desc_chain(dev,
++				&dev_if->dma_in_desc_addr, 1);
++			dev_if->out_desc_addr =
++			    dwc_otg_ep_alloc_desc_chain(dev,
++				&dev_if->dma_out_desc_addr, 1);
++			pcd->data_terminated = 0;
++
++			if (dev_if->setup_desc_addr[0] == 0
++			    || dev_if->setup_desc_addr[1] == 0
++			    || dev_if->in_desc_addr == 0
++			    || dev_if->out_desc_addr == 0) {
++
++				if (dev_if->out_desc_addr)
++					dwc_otg_ep_free_desc_chain(dev,
++					     dev_if->out_desc_addr,
++					     dev_if->dma_out_desc_addr, 1);
++				if (dev_if->in_desc_addr)
++					dwc_otg_ep_free_desc_chain(dev,
++					     dev_if->in_desc_addr,
++					     dev_if->dma_in_desc_addr, 1);
++				if (dev_if->setup_desc_addr[1])
++					dwc_otg_ep_free_desc_chain(dev,
++					     dev_if->setup_desc_addr[1],
++					     dev_if->dma_setup_desc_addr[1], 1);
++				if (dev_if->setup_desc_addr[0])
++					dwc_otg_ep_free_desc_chain(dev,
++					     dev_if->setup_desc_addr[0],
++					     dev_if->dma_setup_desc_addr[0], 1);
++
++				DWC_DMA_FREE(dev, sizeof(*pcd->setup_pkt) * 5,
++					     pcd->setup_pkt,
++					     pcd->setup_pkt_dma_handle);
++				DWC_DMA_FREE(dev, sizeof(*pcd->status_buf),
++					     pcd->status_buf,
++					     pcd->status_buf_dma_handle);
++
++				DWC_FREE(pcd);
++
++				return NULL;
++			}
++		}
++	} else {
++		pcd->setup_pkt = DWC_ALLOC(sizeof(*pcd->setup_pkt) * 5);
++		if (pcd->setup_pkt == NULL) {
++			DWC_FREE(pcd);
++			return NULL;
++		}
++
++		pcd->status_buf = DWC_ALLOC(sizeof(uint16_t));
++		if (pcd->status_buf == NULL) {
++			DWC_FREE(pcd->setup_pkt);
++			DWC_FREE(pcd);
++			return NULL;
++		}
++	}
++
++	dwc_otg_pcd_reinit(pcd);
++
++	/* Allocate the cfi object for the PCD */
++#ifdef DWC_UTE_CFI
++	pcd->cfi = DWC_ALLOC(sizeof(cfiobject_t));
++	if (NULL == pcd->cfi)
++		goto fail;
++	if (init_cfi(pcd->cfi)) {
++		CFI_INFO("%s: Failed to init the CFI object\n", __func__);
++		goto fail;
++	}
++#endif
++
++	/* Initialize tasklets */
++	pcd->start_xfer_tasklet = DWC_TASK_ALLOC("xfer_tasklet",
++						 start_xfer_tasklet_func, pcd);
++	pcd->test_mode_tasklet = DWC_TASK_ALLOC("test_mode_tasklet",
++						do_test_mode, pcd);
++
++	/* Initialize SRP timer */
++	core_if->srp_timer = DWC_TIMER_ALLOC("SRP TIMER", srp_timeout, core_if);
++
++	if (core_if->core_params->dev_out_nak) {
++		/**
++		* Initialize xfer timeout timer. Implemented for
++		* 2.93a feature "Device DDMA OUT NAK Enhancement"
++		*/
++		for(i = 0; i < MAX_EPS_CHANNELS; i++) {
++			pcd->core_if->ep_xfer_timer[i] =
++				DWC_TIMER_ALLOC("ep timer", ep_xfer_timeout,
++				&pcd->core_if->ep_xfer_info[i]);
++		}
++	}
++
++	return pcd;
++#ifdef DWC_UTE_CFI
++fail:
++#endif
++	if (pcd->setup_pkt)
++		DWC_FREE(pcd->setup_pkt);
++	if (pcd->status_buf)
++		DWC_FREE(pcd->status_buf);
++#ifdef DWC_UTE_CFI
++	if (pcd->cfi)
++		DWC_FREE(pcd->cfi);
++#endif
++	if (pcd)
++		DWC_FREE(pcd);
++	return NULL;
++
++}
++
++/**
++ * Remove PCD specific data
++ */
++void dwc_otg_pcd_remove(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_dev_if_t *dev_if = GET_CORE_IF(pcd)->dev_if;
++	struct device *dev = dwc_otg_pcd_to_dev(pcd);
++	int i;
++
++	if (pcd->core_if->core_params->dev_out_nak) {
++		for (i = 0; i < MAX_EPS_CHANNELS; i++) {
++			DWC_TIMER_CANCEL(pcd->core_if->ep_xfer_timer[i]);
++			pcd->core_if->ep_xfer_info[i].state = 0;
++		}
++	}
++
++	if (GET_CORE_IF(pcd)->dma_enable) {
++		DWC_DMA_FREE(dev, sizeof(*pcd->setup_pkt) * 5, pcd->setup_pkt,
++			     pcd->setup_pkt_dma_handle);
++		DWC_DMA_FREE(dev, sizeof(uint16_t), pcd->status_buf,
++			     pcd->status_buf_dma_handle);
++		if (GET_CORE_IF(pcd)->dma_desc_enable) {
++			dwc_otg_ep_free_desc_chain(dev,
++						   dev_if->setup_desc_addr[0],
++						   dev_if->dma_setup_desc_addr
++						   [0], 1);
++			dwc_otg_ep_free_desc_chain(dev,
++						   dev_if->setup_desc_addr[1],
++						   dev_if->dma_setup_desc_addr
++						   [1], 1);
++			dwc_otg_ep_free_desc_chain(dev,
++						   dev_if->in_desc_addr,
++						   dev_if->dma_in_desc_addr, 1);
++			dwc_otg_ep_free_desc_chain(dev,
++						   dev_if->out_desc_addr,
++						   dev_if->dma_out_desc_addr,
++						   1);
++		}
++	} else {
++		DWC_FREE(pcd->setup_pkt);
++		DWC_FREE(pcd->status_buf);
++	}
++	DWC_SPINLOCK_FREE(pcd->lock);
++	/* Set core_if's lock pointer to NULL */
++	pcd->core_if->lock = NULL;
++
++	DWC_TASK_FREE(pcd->start_xfer_tasklet);
++	DWC_TASK_FREE(pcd->test_mode_tasklet);
++	if (pcd->core_if->core_params->dev_out_nak) {
++		for (i = 0; i < MAX_EPS_CHANNELS; i++) {
++			if (pcd->core_if->ep_xfer_timer[i]) {
++					DWC_TIMER_FREE(pcd->core_if->ep_xfer_timer[i]);
++			}
++		}
++	}
++
++/* Release the CFI object's dynamic memory */
++#ifdef DWC_UTE_CFI
++	if (pcd->cfi->ops.release) {
++		pcd->cfi->ops.release(pcd->cfi);
++	}
++#endif
++
++	DWC_FREE(pcd);
++}
++
++/**
++ * Returns whether registered pcd is dual speed or not
++ */
++uint32_t dwc_otg_pcd_is_dualspeed(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++
++	if ((core_if->core_params->speed == DWC_SPEED_PARAM_FULL) ||
++	    ((core_if->hwcfg2.b.hs_phy_type == 2) &&
++	     (core_if->hwcfg2.b.fs_phy_type == 1) &&
++	     (core_if->core_params->ulpi_fs_ls))) {
++		return 0;
++	}
++
++	return 1;
++}
++
++/**
++ * Returns whether registered pcd is OTG capable or not
++ */
++uint32_t dwc_otg_pcd_is_otg(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	gusbcfg_data_t usbcfg = {.d32 = 0 };
++
++	usbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
++	if (!usbcfg.b.srpcap || !usbcfg.b.hnpcap) {
++		return 0;
++	}
++
++	return 1;
++}
++
++/**
++ * This function assigns periodic Tx FIFO to an periodic EP
++ * in shared Tx FIFO mode
++ */
++static uint32_t assign_tx_fifo(dwc_otg_core_if_t * core_if)
++{
++	uint32_t TxMsk = 1;
++	int i;
++
++	for (i = 0; i < core_if->hwcfg4.b.num_in_eps; ++i) {
++		if ((TxMsk & core_if->tx_msk) == 0) {
++			core_if->tx_msk |= TxMsk;
++			return i + 1;
++		}
++		TxMsk <<= 1;
++	}
++	return 0;
++}
++
++/**
++ * This function assigns periodic Tx FIFO to an periodic EP
++ * in shared Tx FIFO mode
++ */
++static uint32_t assign_perio_tx_fifo(dwc_otg_core_if_t * core_if)
++{
++	uint32_t PerTxMsk = 1;
++	int i;
++	for (i = 0; i < core_if->hwcfg4.b.num_dev_perio_in_ep; ++i) {
++		if ((PerTxMsk & core_if->p_tx_msk) == 0) {
++			core_if->p_tx_msk |= PerTxMsk;
++			return i + 1;
++		}
++		PerTxMsk <<= 1;
++	}
++	return 0;
++}
++
++/**
++ * This function releases periodic Tx FIFO
++ * in shared Tx FIFO mode
++ */
++static void release_perio_tx_fifo(dwc_otg_core_if_t * core_if,
++				  uint32_t fifo_num)
++{
++	core_if->p_tx_msk =
++	    (core_if->p_tx_msk & (1 << (fifo_num - 1))) ^ core_if->p_tx_msk;
++}
++
++/**
++ * This function releases periodic Tx FIFO
++ * in shared Tx FIFO mode
++ */
++static void release_tx_fifo(dwc_otg_core_if_t * core_if, uint32_t fifo_num)
++{
++	core_if->tx_msk =
++	    (core_if->tx_msk & (1 << (fifo_num - 1))) ^ core_if->tx_msk;
++}
++
++/**
++ * This function is being called from gadget
++ * to enable PCD endpoint.
++ */
++int dwc_otg_pcd_ep_enable(dwc_otg_pcd_t * pcd,
++			  const uint8_t * ep_desc, void *usb_ep)
++{
++	int num, dir;
++	dwc_otg_pcd_ep_t *ep = NULL;
++	const usb_endpoint_descriptor_t *desc;
++	dwc_irqflags_t flags;
++	fifosize_data_t dptxfsiz = {.d32 = 0 };
++	gdfifocfg_data_t gdfifocfg = {.d32 = 0 };
++	gdfifocfg_data_t gdfifocfgbase = {.d32 = 0 };
++	int retval = 0;
++	int i, epcount;
++	struct device *dev = dwc_otg_pcd_to_dev(pcd);
++
++	desc = (const usb_endpoint_descriptor_t *)ep_desc;
++
++	if (!desc) {
++		pcd->ep0.priv = usb_ep;
++		ep = &pcd->ep0;
++		retval = -DWC_E_INVALID;
++		goto out;
++	}
++
++	num = UE_GET_ADDR(desc->bEndpointAddress);
++	dir = UE_GET_DIR(desc->bEndpointAddress);
++
++	if (!UGETW(desc->wMaxPacketSize)) {
++		DWC_WARN("bad maxpacketsize\n");
++		retval = -DWC_E_INVALID;
++		goto out;
++	}
++
++	if (dir == UE_DIR_IN) {
++		epcount = pcd->core_if->dev_if->num_in_eps;
++		for (i = 0; i < epcount; i++) {
++			if (num == pcd->in_ep[i].dwc_ep.num) {
++				ep = &pcd->in_ep[i];
++				break;
++			}
++		}
++	} else {
++		epcount = pcd->core_if->dev_if->num_out_eps;
++		for (i = 0; i < epcount; i++) {
++			if (num == pcd->out_ep[i].dwc_ep.num) {
++				ep = &pcd->out_ep[i];
++				break;
++			}
++		}
++	}
++
++	if (!ep) {
++		DWC_WARN("bad address\n");
++		retval = -DWC_E_INVALID;
++		goto out;
++	}
++
++	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
++
++	ep->desc = desc;
++	ep->priv = usb_ep;
++
++	/*
++	 * Activate the EP
++	 */
++	ep->stopped = 0;
++
++	ep->dwc_ep.is_in = (dir == UE_DIR_IN);
++	ep->dwc_ep.maxpacket = UGETW(desc->wMaxPacketSize);
++
++	ep->dwc_ep.type = desc->bmAttributes & UE_XFERTYPE;
++
++	if (ep->dwc_ep.is_in) {
++		if (!GET_CORE_IF(pcd)->en_multiple_tx_fifo) {
++			ep->dwc_ep.tx_fifo_num = 0;
++
++			if (ep->dwc_ep.type == UE_ISOCHRONOUS) {
++				/*
++				 * if ISOC EP then assign a Periodic Tx FIFO.
++				 */
++				ep->dwc_ep.tx_fifo_num =
++				    assign_perio_tx_fifo(GET_CORE_IF(pcd));
++			}
++		} else {
++			/*
++			 * if Dedicated FIFOs mode is on then assign a Tx FIFO.
++			 */
++			ep->dwc_ep.tx_fifo_num =
++			    assign_tx_fifo(GET_CORE_IF(pcd));
++		}
++
++		/* Calculating EP info controller base address */
++		if (ep->dwc_ep.tx_fifo_num
++		    && GET_CORE_IF(pcd)->en_multiple_tx_fifo) {
++			gdfifocfg.d32 =
++			    DWC_READ_REG32(&GET_CORE_IF(pcd)->
++					   core_global_regs->gdfifocfg);
++			gdfifocfgbase.d32 = gdfifocfg.d32 >> 16;
++			dptxfsiz.d32 =
++			    (DWC_READ_REG32
++			     (&GET_CORE_IF(pcd)->core_global_regs->
++			      dtxfsiz[ep->dwc_ep.tx_fifo_num - 1]) >> 16);
++			gdfifocfg.b.epinfobase =
++			    gdfifocfgbase.d32 + dptxfsiz.d32;
++			if (GET_CORE_IF(pcd)->snpsid <= OTG_CORE_REV_2_94a) {
++				DWC_WRITE_REG32(&GET_CORE_IF(pcd)->
++						core_global_regs->gdfifocfg,
++						gdfifocfg.d32);
++			}
++		}
++	}
++	/* Set initial data PID. */
++	if (ep->dwc_ep.type == UE_BULK) {
++		ep->dwc_ep.data_pid_start = 0;
++	}
++
++	/* Alloc DMA Descriptors */
++	if (GET_CORE_IF(pcd)->dma_desc_enable) {
++#ifndef DWC_UTE_PER_IO
++		if (ep->dwc_ep.type != UE_ISOCHRONOUS) {
++#endif
++			ep->dwc_ep.desc_addr =
++			    dwc_otg_ep_alloc_desc_chain(dev,
++						&ep->dwc_ep.dma_desc_addr,
++						MAX_DMA_DESC_CNT);
++			if (!ep->dwc_ep.desc_addr) {
++				DWC_WARN("%s, can't allocate DMA descriptor\n",
++					 __func__);
++				retval = -DWC_E_SHUTDOWN;
++				DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++				goto out;
++			}
++#ifndef DWC_UTE_PER_IO
++		}
++#endif
++	}
++
++	DWC_DEBUGPL(DBG_PCD, "Activate %s: type=%d, mps=%d desc=%p\n",
++		    (ep->dwc_ep.is_in ? "IN" : "OUT"),
++		    ep->dwc_ep.type, ep->dwc_ep.maxpacket, ep->desc);
++#ifdef DWC_UTE_PER_IO
++	ep->dwc_ep.xiso_bInterval = 1 << (ep->desc->bInterval - 1);
++#endif
++	if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
++		ep->dwc_ep.bInterval = 1 << (ep->desc->bInterval - 1);
++		ep->dwc_ep.frame_num = 0xFFFFFFFF;
++	}
++
++	dwc_otg_ep_activate(GET_CORE_IF(pcd), &ep->dwc_ep);
++
++#ifdef DWC_UTE_CFI
++	if (pcd->cfi->ops.ep_enable) {
++		pcd->cfi->ops.ep_enable(pcd->cfi, pcd, ep);
++	}
++#endif
++
++	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++
++out:
++	return retval;
++}
++
++/**
++ * This function is being called from gadget
++ * to disable PCD endpoint.
++ */
++int dwc_otg_pcd_ep_disable(dwc_otg_pcd_t * pcd, void *ep_handle)
++{
++	dwc_otg_pcd_ep_t *ep;
++	dwc_irqflags_t flags;
++	dwc_otg_dev_dma_desc_t *desc_addr;
++	dwc_dma_t dma_desc_addr;
++	gdfifocfg_data_t gdfifocfgbase = {.d32 = 0 };
++	gdfifocfg_data_t gdfifocfg = {.d32 = 0 };
++	fifosize_data_t dptxfsiz = {.d32 = 0 };
++	struct device *dev = dwc_otg_pcd_to_dev(pcd);
++
++	ep = get_ep_from_handle(pcd, ep_handle);
++
++	if (!ep || !ep->desc) {
++		DWC_DEBUGPL(DBG_PCD, "bad ep address\n");
++		return -DWC_E_INVALID;
++	}
++
++	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
++
++	dwc_otg_request_nuke(ep);
++
++	dwc_otg_ep_deactivate(GET_CORE_IF(pcd), &ep->dwc_ep);
++	if (pcd->core_if->core_params->dev_out_nak) {
++		DWC_TIMER_CANCEL(pcd->core_if->ep_xfer_timer[ep->dwc_ep.num]);
++		pcd->core_if->ep_xfer_info[ep->dwc_ep.num].state = 0;
++	}
++	ep->desc = NULL;
++	ep->stopped = 1;
++
++	gdfifocfg.d32 =
++	    DWC_READ_REG32(&GET_CORE_IF(pcd)->core_global_regs->gdfifocfg);
++	gdfifocfgbase.d32 = gdfifocfg.d32 >> 16;
++
++	if (ep->dwc_ep.is_in) {
++		if (GET_CORE_IF(pcd)->en_multiple_tx_fifo) {
++			/* Flush the Tx FIFO */
++			dwc_otg_flush_tx_fifo(GET_CORE_IF(pcd),
++					      ep->dwc_ep.tx_fifo_num);
++		}
++		release_perio_tx_fifo(GET_CORE_IF(pcd), ep->dwc_ep.tx_fifo_num);
++		release_tx_fifo(GET_CORE_IF(pcd), ep->dwc_ep.tx_fifo_num);
++		if (GET_CORE_IF(pcd)->en_multiple_tx_fifo) {
++			/* Decreasing EPinfo Base Addr */
++			dptxfsiz.d32 =
++			    (DWC_READ_REG32
++			     (&GET_CORE_IF(pcd)->
++				core_global_regs->dtxfsiz[ep->dwc_ep.tx_fifo_num-1]) >> 16);
++			gdfifocfg.b.epinfobase = gdfifocfgbase.d32 - dptxfsiz.d32;
++			if (GET_CORE_IF(pcd)->snpsid <= OTG_CORE_REV_2_94a) {
++				DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gdfifocfg,
++					gdfifocfg.d32);
++			}
++		}
++	}
++
++	/* Free DMA Descriptors */
++	if (GET_CORE_IF(pcd)->dma_desc_enable) {
++		if (ep->dwc_ep.type != UE_ISOCHRONOUS) {
++			desc_addr = ep->dwc_ep.desc_addr;
++			dma_desc_addr = ep->dwc_ep.dma_desc_addr;
++
++			/* Cannot call dma_free_coherent() with IRQs disabled */
++			DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++			dwc_otg_ep_free_desc_chain(dev, desc_addr, dma_desc_addr,
++						   MAX_DMA_DESC_CNT);
++
++			goto out_unlocked;
++		}
++	}
++	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++
++out_unlocked:
++	DWC_DEBUGPL(DBG_PCD, "%d %s disabled\n", ep->dwc_ep.num,
++		    ep->dwc_ep.is_in ? "IN" : "OUT");
++	return 0;
++
++}
++
++/******************************************************************************/
++#ifdef DWC_UTE_PER_IO
++
++/**
++ * Free the request and its extended parts
++ *
++ */
++void dwc_pcd_xiso_ereq_free(dwc_otg_pcd_ep_t * ep, dwc_otg_pcd_request_t * req)
++{
++	DWC_FREE(req->ext_req.per_io_frame_descs);
++	DWC_FREE(req);
++}
++
++/**
++ * Start the next request in the endpoint's queue.
++ *
++ */
++int dwc_otg_pcd_xiso_start_next_request(dwc_otg_pcd_t * pcd,
++					dwc_otg_pcd_ep_t * ep)
++{
++	int i;
++	dwc_otg_pcd_request_t *req = NULL;
++	dwc_ep_t *dwcep = NULL;
++	struct dwc_iso_xreq_port *ereq = NULL;
++	struct dwc_iso_pkt_desc_port *ddesc_iso;
++	uint16_t nat;
++	depctl_data_t diepctl;
++
++	dwcep = &ep->dwc_ep;
++
++	if (dwcep->xiso_active_xfers > 0) {
++#if 0	//Disable this to decrease s/w overhead that is crucial for Isoc transfers
++		DWC_WARN("There are currently active transfers for EP%d \
++				(active=%d; queued=%d)", dwcep->num, dwcep->xiso_active_xfers,
++				dwcep->xiso_queued_xfers);
++#endif
++		return 0;
++	}
++
++	nat = UGETW(ep->desc->wMaxPacketSize);
++	nat = (nat >> 11) & 0x03;
++
++	if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
++		req = DWC_CIRCLEQ_FIRST(&ep->queue);
++		ereq = &req->ext_req;
++		ep->stopped = 0;
++
++		/* Get the frame number */
++		dwcep->xiso_frame_num =
++		    dwc_otg_get_frame_number(GET_CORE_IF(pcd));
++		DWC_DEBUG("FRM_NUM=%d", dwcep->xiso_frame_num);
++
++		ddesc_iso = ereq->per_io_frame_descs;
++
++		if (dwcep->is_in) {
++			/* Setup DMA Descriptor chain for IN Isoc request */
++			for (i = 0; i < ereq->pio_pkt_count; i++) {
++				//if ((i % (nat + 1)) == 0)
++				if ( i > 0 )
++					dwcep->xiso_frame_num =
++					    (dwcep->xiso_bInterval +
++										dwcep->xiso_frame_num) & 0x3FFF;
++				dwcep->desc_addr[i].buf =
++				    req->dma + ddesc_iso[i].offset;
++				dwcep->desc_addr[i].status.b_iso_in.txbytes =
++				    ddesc_iso[i].length;
++				dwcep->desc_addr[i].status.b_iso_in.framenum =
++				    dwcep->xiso_frame_num;
++				dwcep->desc_addr[i].status.b_iso_in.bs =
++				    BS_HOST_READY;
++				dwcep->desc_addr[i].status.b_iso_in.txsts = 0;
++				dwcep->desc_addr[i].status.b_iso_in.sp =
++				    (ddesc_iso[i].length %
++				     dwcep->maxpacket) ? 1 : 0;
++				dwcep->desc_addr[i].status.b_iso_in.ioc = 0;
++				dwcep->desc_addr[i].status.b_iso_in.pid = nat + 1;
++				dwcep->desc_addr[i].status.b_iso_in.l = 0;
++
++				/* Process the last descriptor */
++				if (i == ereq->pio_pkt_count - 1) {
++					dwcep->desc_addr[i].status.b_iso_in.ioc = 1;
++					dwcep->desc_addr[i].status.b_iso_in.l = 1;
++				}
++			}
++
++			/* Setup and start the transfer for this endpoint */
++			dwcep->xiso_active_xfers++;
++			DWC_WRITE_REG32(&GET_CORE_IF(pcd)->dev_if->
++					in_ep_regs[dwcep->num]->diepdma,
++					dwcep->dma_desc_addr);
++			diepctl.d32 = 0;
++			diepctl.b.epena = 1;
++			diepctl.b.cnak = 1;
++			DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->dev_if->
++					 in_ep_regs[dwcep->num]->diepctl, 0,
++					 diepctl.d32);
++		} else {
++			/* Setup DMA Descriptor chain for OUT Isoc request */
++			for (i = 0; i < ereq->pio_pkt_count; i++) {
++				//if ((i % (nat + 1)) == 0)
++				dwcep->xiso_frame_num = (dwcep->xiso_bInterval +
++										dwcep->xiso_frame_num) & 0x3FFF;
++				dwcep->desc_addr[i].buf =
++				    req->dma + ddesc_iso[i].offset;
++				dwcep->desc_addr[i].status.b_iso_out.rxbytes =
++				    ddesc_iso[i].length;
++				dwcep->desc_addr[i].status.b_iso_out.framenum =
++				    dwcep->xiso_frame_num;
++				dwcep->desc_addr[i].status.b_iso_out.bs =
++				    BS_HOST_READY;
++				dwcep->desc_addr[i].status.b_iso_out.rxsts = 0;
++				dwcep->desc_addr[i].status.b_iso_out.sp =
++				    (ddesc_iso[i].length %
++				     dwcep->maxpacket) ? 1 : 0;
++				dwcep->desc_addr[i].status.b_iso_out.ioc = 0;
++				dwcep->desc_addr[i].status.b_iso_out.pid = nat + 1;
++				dwcep->desc_addr[i].status.b_iso_out.l = 0;
++
++				/* Process the last descriptor */
++				if (i == ereq->pio_pkt_count - 1) {
++					dwcep->desc_addr[i].status.b_iso_out.ioc = 1;
++					dwcep->desc_addr[i].status.b_iso_out.l = 1;
++				}
++			}
++
++			/* Setup and start the transfer for this endpoint */
++			dwcep->xiso_active_xfers++;
++			DWC_WRITE_REG32(&GET_CORE_IF(pcd)->
++					dev_if->out_ep_regs[dwcep->num]->
++					doepdma, dwcep->dma_desc_addr);
++			diepctl.d32 = 0;
++			diepctl.b.epena = 1;
++			diepctl.b.cnak = 1;
++			DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->
++					 dev_if->out_ep_regs[dwcep->num]->
++					 doepctl, 0, diepctl.d32);
++		}
++
++	} else {
++		ep->stopped = 1;
++	}
++
++	return 0;
++}
++
++/**
++ *	- Remove the request from the queue
++ */
++void complete_xiso_ep(dwc_otg_pcd_ep_t * ep)
++{
++	dwc_otg_pcd_request_t *req = NULL;
++	struct dwc_iso_xreq_port *ereq = NULL;
++	struct dwc_iso_pkt_desc_port *ddesc_iso = NULL;
++	dwc_ep_t *dwcep = NULL;
++	int i;
++
++	//DWC_DEBUG();
++	dwcep = &ep->dwc_ep;
++
++	/* Get the first pending request from the queue */
++	if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
++		req = DWC_CIRCLEQ_FIRST(&ep->queue);
++		if (!req) {
++			DWC_PRINTF("complete_ep 0x%p, req = NULL!\n", ep);
++			return;
++		}
++		dwcep->xiso_active_xfers--;
++		dwcep->xiso_queued_xfers--;
++		/* Remove this request from the queue */
++		DWC_CIRCLEQ_REMOVE_INIT(&ep->queue, req, queue_entry);
++	} else {
++		DWC_PRINTF("complete_ep 0x%p, ep->queue empty!\n", ep);
++		return;
++	}
++
++	ep->stopped = 1;
++	ereq = &req->ext_req;
++	ddesc_iso = ereq->per_io_frame_descs;
++
++	if (dwcep->xiso_active_xfers < 0) {
++		DWC_WARN("EP#%d (xiso_active_xfers=%d)", dwcep->num,
++			 dwcep->xiso_active_xfers);
++	}
++
++	/* Fill the Isoc descs of portable extended req from dma descriptors */
++	for (i = 0; i < ereq->pio_pkt_count; i++) {
++		if (dwcep->is_in) {	/* IN endpoints */
++			ddesc_iso[i].actual_length = ddesc_iso[i].length -
++			    dwcep->desc_addr[i].status.b_iso_in.txbytes;
++			ddesc_iso[i].status =
++			    dwcep->desc_addr[i].status.b_iso_in.txsts;
++		} else {	/* OUT endpoints */
++			ddesc_iso[i].actual_length = ddesc_iso[i].length -
++			    dwcep->desc_addr[i].status.b_iso_out.rxbytes;
++			ddesc_iso[i].status =
++			    dwcep->desc_addr[i].status.b_iso_out.rxsts;
++		}
++	}
++
++	DWC_SPINUNLOCK(ep->pcd->lock);
++
++	/* Call the completion function in the non-portable logic */
++	ep->pcd->fops->xisoc_complete(ep->pcd, ep->priv, req->priv, 0,
++				      &req->ext_req);
++
++	DWC_SPINLOCK(ep->pcd->lock);
++
++	/* Free the request - specific freeing needed for extended request object */
++	dwc_pcd_xiso_ereq_free(ep, req);
++
++	/* Start the next request */
++	dwc_otg_pcd_xiso_start_next_request(ep->pcd, ep);
++
++	return;
++}
++
++/**
++ * Create and initialize the Isoc pkt descriptors of the extended request.
++ *
++ */
++static int dwc_otg_pcd_xiso_create_pkt_descs(dwc_otg_pcd_request_t * req,
++					     void *ereq_nonport,
++					     int atomic_alloc)
++{
++	struct dwc_iso_xreq_port *ereq = NULL;
++	struct dwc_iso_xreq_port *req_mapped = NULL;
++	struct dwc_iso_pkt_desc_port *ipds = NULL;	/* To be created in this function */
++	uint32_t pkt_count;
++	int i;
++
++	ereq = &req->ext_req;
++	req_mapped = (struct dwc_iso_xreq_port *)ereq_nonport;
++	pkt_count = req_mapped->pio_pkt_count;
++
++	/* Create the isoc descs */
++	if (atomic_alloc) {
++		ipds = DWC_ALLOC_ATOMIC(sizeof(*ipds) * pkt_count);
++	} else {
++		ipds = DWC_ALLOC(sizeof(*ipds) * pkt_count);
++	}
++
++	if (!ipds) {
++		DWC_ERROR("Failed to allocate isoc descriptors");
++		return -DWC_E_NO_MEMORY;
++	}
++
++	/* Initialize the extended request fields */
++	ereq->per_io_frame_descs = ipds;
++	ereq->error_count = 0;
++	ereq->pio_alloc_pkt_count = pkt_count;
++	ereq->pio_pkt_count = pkt_count;
++	ereq->tr_sub_flags = req_mapped->tr_sub_flags;
++
++	/* Init the Isoc descriptors */
++	for (i = 0; i < pkt_count; i++) {
++		ipds[i].length = req_mapped->per_io_frame_descs[i].length;
++		ipds[i].offset = req_mapped->per_io_frame_descs[i].offset;
++		ipds[i].status = req_mapped->per_io_frame_descs[i].status;	/* 0 */
++		ipds[i].actual_length =
++		    req_mapped->per_io_frame_descs[i].actual_length;
++	}
++
++	return 0;
++}
++
++static void prn_ext_request(struct dwc_iso_xreq_port *ereq)
++{
++	struct dwc_iso_pkt_desc_port *xfd = NULL;
++	int i;
++
++	DWC_DEBUG("per_io_frame_descs=%p", ereq->per_io_frame_descs);
++	DWC_DEBUG("tr_sub_flags=%d", ereq->tr_sub_flags);
++	DWC_DEBUG("error_count=%d", ereq->error_count);
++	DWC_DEBUG("pio_alloc_pkt_count=%d", ereq->pio_alloc_pkt_count);
++	DWC_DEBUG("pio_pkt_count=%d", ereq->pio_pkt_count);
++	DWC_DEBUG("res=%d", ereq->res);
++
++	for (i = 0; i < ereq->pio_pkt_count; i++) {
++		xfd = &ereq->per_io_frame_descs[0];
++		DWC_DEBUG("FD #%d", i);
++
++		DWC_DEBUG("xfd->actual_length=%d", xfd->actual_length);
++		DWC_DEBUG("xfd->length=%d", xfd->length);
++		DWC_DEBUG("xfd->offset=%d", xfd->offset);
++		DWC_DEBUG("xfd->status=%d", xfd->status);
++	}
++}
++
++/**
++ *
++ */
++int dwc_otg_pcd_xiso_ep_queue(dwc_otg_pcd_t * pcd, void *ep_handle,
++			      uint8_t * buf, dwc_dma_t dma_buf, uint32_t buflen,
++			      int zero, void *req_handle, int atomic_alloc,
++			      void *ereq_nonport)
++{
++	dwc_otg_pcd_request_t *req = NULL;
++	dwc_otg_pcd_ep_t *ep;
++	dwc_irqflags_t flags;
++	int res;
++
++	ep = get_ep_from_handle(pcd, ep_handle);
++	if (!ep) {
++		DWC_WARN("bad ep\n");
++		return -DWC_E_INVALID;
++	}
++
++	/* We support this extension only for DDMA mode */
++	if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC)
++		if (!GET_CORE_IF(pcd)->dma_desc_enable)
++			return -DWC_E_INVALID;
++
++	/* Create a dwc_otg_pcd_request_t object */
++	if (atomic_alloc) {
++		req = DWC_ALLOC_ATOMIC(sizeof(*req));
++	} else {
++		req = DWC_ALLOC(sizeof(*req));
++	}
++
++	if (!req) {
++		return -DWC_E_NO_MEMORY;
++	}
++
++	/* Create the Isoc descs for this request which shall be the exact match
++	 * of the structure sent to us from the non-portable logic */
++	res =
++	    dwc_otg_pcd_xiso_create_pkt_descs(req, ereq_nonport, atomic_alloc);
++	if (res) {
++		DWC_WARN("Failed to init the Isoc descriptors");
++		DWC_FREE(req);
++		return res;
++	}
++
++	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
++
++	DWC_CIRCLEQ_INIT_ENTRY(req, queue_entry);
++	req->buf = buf;
++	req->dma = dma_buf;
++	req->length = buflen;
++	req->sent_zlp = zero;
++	req->priv = req_handle;
++
++	//DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
++	ep->dwc_ep.dma_addr = dma_buf;
++	ep->dwc_ep.start_xfer_buff = buf;
++	ep->dwc_ep.xfer_buff = buf;
++	ep->dwc_ep.xfer_len = 0;
++	ep->dwc_ep.xfer_count = 0;
++	ep->dwc_ep.sent_zlp = 0;
++	ep->dwc_ep.total_len = buflen;
++
++	/* Add this request to the tail */
++	DWC_CIRCLEQ_INSERT_TAIL(&ep->queue, req, queue_entry);
++	ep->dwc_ep.xiso_queued_xfers++;
++
++//DWC_DEBUG("CP_0");
++//DWC_DEBUG("req->ext_req.tr_sub_flags=%d", req->ext_req.tr_sub_flags);
++//prn_ext_request((struct dwc_iso_xreq_port *) ereq_nonport);
++//prn_ext_request(&req->ext_req);
++
++	//DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++
++	/* If the req->status == ASAP  then check if there is any active transfer
++	 * for this endpoint. If no active transfers, then get the first entry
++	 * from the queue and start that transfer
++	 */
++	if (req->ext_req.tr_sub_flags == DWC_EREQ_TF_ASAP) {
++		res = dwc_otg_pcd_xiso_start_next_request(pcd, ep);
++		if (res) {
++			DWC_WARN("Failed to start the next Isoc transfer");
++			DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++			DWC_FREE(req);
++			return res;
++		}
++	}
++
++	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++	return 0;
++}
++
++#endif
++/* END ifdef DWC_UTE_PER_IO ***************************************************/
++int dwc_otg_pcd_ep_queue(dwc_otg_pcd_t * pcd, void *ep_handle,
++			 uint8_t * buf, dwc_dma_t dma_buf, uint32_t buflen,
++			 int zero, void *req_handle, int atomic_alloc)
++{
++	struct device *dev = dwc_otg_pcd_to_dev(pcd);
++	dwc_irqflags_t flags;
++	dwc_otg_pcd_request_t *req;
++	dwc_otg_pcd_ep_t *ep;
++	uint32_t max_transfer;
++
++	ep = get_ep_from_handle(pcd, ep_handle);
++	if (!ep || (!ep->desc && ep->dwc_ep.num != 0)) {
++		DWC_WARN("bad ep\n");
++		return -DWC_E_INVALID;
++	}
++
++	if (atomic_alloc) {
++		req = DWC_ALLOC_ATOMIC(sizeof(*req));
++	} else {
++		req = DWC_ALLOC(sizeof(*req));
++	}
++
++	if (!req) {
++		return -DWC_E_NO_MEMORY;
++	}
++	DWC_CIRCLEQ_INIT_ENTRY(req, queue_entry);
++	if (!GET_CORE_IF(pcd)->core_params->opt) {
++		if (ep->dwc_ep.num != 0) {
++			DWC_ERROR("queue req %p, len %d buf %p\n",
++				  req_handle, buflen, buf);
++		}
++	}
++
++	req->buf = buf;
++	req->dma = dma_buf;
++	req->length = buflen;
++	req->sent_zlp = zero;
++	req->priv = req_handle;
++	req->dw_align_buf = NULL;
++	if ((dma_buf & 0x3) && GET_CORE_IF(pcd)->dma_enable
++			&& !GET_CORE_IF(pcd)->dma_desc_enable)
++		req->dw_align_buf = DWC_DMA_ALLOC(dev, buflen,
++				 &req->dw_align_buf_dma);
++	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
++
++	/*
++	 * After adding request to the queue for IN ISOC wait for In Token Received
++	 * when TX FIFO is empty interrupt and for OUT ISOC wait for OUT Token
++	 * Received when EP is disabled interrupt to obtain starting microframe
++	 * (odd/even) start transfer
++	 */
++	if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
++		if (req != 0) {
++			depctl_data_t depctl = {.d32 =
++				    DWC_READ_REG32(&pcd->core_if->dev_if->
++						   in_ep_regs[ep->dwc_ep.num]->
++						   diepctl) };
++			++pcd->request_pending;
++
++			DWC_CIRCLEQ_INSERT_TAIL(&ep->queue, req, queue_entry);
++			if (ep->dwc_ep.is_in) {
++				depctl.b.cnak = 1;
++				DWC_WRITE_REG32(&pcd->core_if->dev_if->
++						in_ep_regs[ep->dwc_ep.num]->
++						diepctl, depctl.d32);
++			}
++
++			DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++		}
++		return 0;
++	}
++
++	/*
++	 * For EP0 IN without premature status, zlp is required?
++	 */
++	if (ep->dwc_ep.num == 0 && ep->dwc_ep.is_in) {
++		DWC_DEBUGPL(DBG_PCDV, "%d-OUT ZLP\n", ep->dwc_ep.num);
++		//_req->zero = 1;
++	}
++
++	/* Start the transfer */
++	if (DWC_CIRCLEQ_EMPTY(&ep->queue) && !ep->stopped) {
++		/* EP0 Transfer? */
++		if (ep->dwc_ep.num == 0) {
++			switch (pcd->ep0state) {
++			case EP0_IN_DATA_PHASE:
++				DWC_DEBUGPL(DBG_PCD,
++					    "%s ep0: EP0_IN_DATA_PHASE\n",
++					    __func__);
++				break;
++
++			case EP0_OUT_DATA_PHASE:
++				DWC_DEBUGPL(DBG_PCD,
++					    "%s ep0: EP0_OUT_DATA_PHASE\n",
++					    __func__);
++				if (pcd->request_config) {
++					/* Complete STATUS PHASE */
++					ep->dwc_ep.is_in = 1;
++					pcd->ep0state = EP0_IN_STATUS_PHASE;
++				}
++				break;
++
++			case EP0_IN_STATUS_PHASE:
++				DWC_DEBUGPL(DBG_PCD,
++					    "%s ep0: EP0_IN_STATUS_PHASE\n",
++					    __func__);
++				break;
++
++			default:
++				DWC_DEBUGPL(DBG_ANY, "ep0: odd state %d\n",
++					    pcd->ep0state);
++				DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++				return -DWC_E_SHUTDOWN;
++			}
++
++			ep->dwc_ep.dma_addr = dma_buf;
++			ep->dwc_ep.start_xfer_buff = buf;
++			ep->dwc_ep.xfer_buff = buf;
++			ep->dwc_ep.xfer_len = buflen;
++			ep->dwc_ep.xfer_count = 0;
++			ep->dwc_ep.sent_zlp = 0;
++			ep->dwc_ep.total_len = ep->dwc_ep.xfer_len;
++
++			if (zero) {
++				if ((ep->dwc_ep.xfer_len %
++				     ep->dwc_ep.maxpacket == 0)
++				    && (ep->dwc_ep.xfer_len != 0)) {
++					ep->dwc_ep.sent_zlp = 1;
++				}
++
++			}
++
++			dwc_otg_ep0_start_transfer(GET_CORE_IF(pcd),
++						   &ep->dwc_ep);
++		}		// non-ep0 endpoints
++		else {
++#ifdef DWC_UTE_CFI
++			if (ep->dwc_ep.buff_mode != BM_STANDARD) {
++				/* store the request length */
++				ep->dwc_ep.cfi_req_len = buflen;
++				pcd->cfi->ops.build_descriptors(pcd->cfi, pcd,
++								ep, req);
++			} else {
++#endif
++				max_transfer =
++				    GET_CORE_IF(ep->pcd)->core_params->
++				    max_transfer_size;
++
++				/* Setup and start the Transfer */
++				if (req->dw_align_buf){
++					if (ep->dwc_ep.is_in)
++						dwc_memcpy(req->dw_align_buf,
++							   buf, buflen);
++					ep->dwc_ep.dma_addr =
++					    req->dw_align_buf_dma;
++					ep->dwc_ep.start_xfer_buff =
++					    req->dw_align_buf;
++					ep->dwc_ep.xfer_buff =
++					    req->dw_align_buf;
++				} else {
++					ep->dwc_ep.dma_addr = dma_buf;
++					ep->dwc_ep.start_xfer_buff = buf;
++                                        ep->dwc_ep.xfer_buff = buf;
++				}
++				ep->dwc_ep.xfer_len = 0;
++				ep->dwc_ep.xfer_count = 0;
++				ep->dwc_ep.sent_zlp = 0;
++				ep->dwc_ep.total_len = buflen;
++
++				ep->dwc_ep.maxxfer = max_transfer;
++				if (GET_CORE_IF(pcd)->dma_desc_enable) {
++					uint32_t out_max_xfer =
++					    DDMA_MAX_TRANSFER_SIZE -
++					    (DDMA_MAX_TRANSFER_SIZE % 4);
++					if (ep->dwc_ep.is_in) {
++						if (ep->dwc_ep.maxxfer >
++						    DDMA_MAX_TRANSFER_SIZE) {
++							ep->dwc_ep.maxxfer =
++							    DDMA_MAX_TRANSFER_SIZE;
++						}
++					} else {
++						if (ep->dwc_ep.maxxfer >
++						    out_max_xfer) {
++							ep->dwc_ep.maxxfer =
++							    out_max_xfer;
++						}
++					}
++				}
++				if (ep->dwc_ep.maxxfer < ep->dwc_ep.total_len) {
++					ep->dwc_ep.maxxfer -=
++					    (ep->dwc_ep.maxxfer %
++					     ep->dwc_ep.maxpacket);
++				}
++
++				if (zero) {
++					if ((ep->dwc_ep.total_len %
++					     ep->dwc_ep.maxpacket == 0)
++					    && (ep->dwc_ep.total_len != 0)) {
++						ep->dwc_ep.sent_zlp = 1;
++					}
++				}
++#ifdef DWC_UTE_CFI
++			}
++#endif
++			dwc_otg_ep_start_transfer(GET_CORE_IF(pcd),
++						  &ep->dwc_ep);
++		}
++	}
++
++	if (req != 0) {
++		++pcd->request_pending;
++		DWC_CIRCLEQ_INSERT_TAIL(&ep->queue, req, queue_entry);
++		if (ep->dwc_ep.is_in && ep->stopped
++		    && !(GET_CORE_IF(pcd)->dma_enable)) {
++			/** @todo NGS Create a function for this. */
++			diepmsk_data_t diepmsk = {.d32 = 0 };
++			diepmsk.b.intktxfemp = 1;
++			if (GET_CORE_IF(pcd)->multiproc_int_enable) {
++				DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->
++						 dev_if->dev_global_regs->diepeachintmsk
++						 [ep->dwc_ep.num], 0,
++						 diepmsk.d32);
++			} else {
++				DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->
++						 dev_if->dev_global_regs->
++						 diepmsk, 0, diepmsk.d32);
++			}
++
++		}
++	}
++	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++
++	return 0;
++}
++
++int dwc_otg_pcd_ep_dequeue(dwc_otg_pcd_t * pcd, void *ep_handle,
++			   void *req_handle)
++{
++	dwc_irqflags_t flags;
++	dwc_otg_pcd_request_t *req;
++	dwc_otg_pcd_ep_t *ep;
++
++	ep = get_ep_from_handle(pcd, ep_handle);
++	if (!ep || (!ep->desc && ep->dwc_ep.num != 0)) {
++		DWC_WARN("bad argument\n");
++		return -DWC_E_INVALID;
++	}
++
++	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
++
++	/* make sure it's actually queued on this endpoint */
++	DWC_CIRCLEQ_FOREACH(req, &ep->queue, queue_entry) {
++		if (req->priv == (void *)req_handle) {
++			break;
++		}
++	}
++
++	if (req->priv != (void *)req_handle) {
++		DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++		return -DWC_E_INVALID;
++	}
++
++	if (!DWC_CIRCLEQ_EMPTY_ENTRY(req, queue_entry)) {
++		dwc_otg_request_done(ep, req, -DWC_E_RESTART);
++	} else {
++		req = NULL;
++	}
++
++	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++
++	return req ? 0 : -DWC_E_SHUTDOWN;
++
++}
++
++/**
++ * dwc_otg_pcd_ep_wedge - sets the halt feature and ignores clear requests
++ *
++ * Use this to stall an endpoint and ignore CLEAR_FEATURE(HALT_ENDPOINT)
++ * requests. If the gadget driver clears the halt status, it will
++ * automatically unwedge the endpoint.
++ *
++ * Returns zero on success, else negative DWC error code.
++ */
++int dwc_otg_pcd_ep_wedge(dwc_otg_pcd_t * pcd, void *ep_handle)
++{
++	dwc_otg_pcd_ep_t *ep;
++	dwc_irqflags_t flags;
++	int retval = 0;
++
++	ep = get_ep_from_handle(pcd, ep_handle);
++
++	if ((!ep->desc && ep != &pcd->ep0) ||
++	    (ep->desc && (ep->desc->bmAttributes == UE_ISOCHRONOUS))) {
++		DWC_WARN("%s, bad ep\n", __func__);
++		return -DWC_E_INVALID;
++	}
++
++	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
++	if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
++		DWC_WARN("%d %s XFer In process\n", ep->dwc_ep.num,
++			 ep->dwc_ep.is_in ? "IN" : "OUT");
++		retval = -DWC_E_AGAIN;
++	} else {
++                /* This code needs to be reviewed */
++		if (ep->dwc_ep.is_in == 1 && GET_CORE_IF(pcd)->dma_desc_enable) {
++			dtxfsts_data_t txstatus;
++			fifosize_data_t txfifosize;
++
++			txfifosize.d32 =
++			    DWC_READ_REG32(&GET_CORE_IF(pcd)->
++					   core_global_regs->dtxfsiz[ep->dwc_ep.
++								     tx_fifo_num]);
++			txstatus.d32 =
++			    DWC_READ_REG32(&GET_CORE_IF(pcd)->
++					   dev_if->in_ep_regs[ep->dwc_ep.num]->
++					   dtxfsts);
++
++			if (txstatus.b.txfspcavail < txfifosize.b.depth) {
++				DWC_WARN("%s() Data In Tx Fifo\n", __func__);
++				retval = -DWC_E_AGAIN;
++			} else {
++				if (ep->dwc_ep.num == 0) {
++					pcd->ep0state = EP0_STALL;
++				}
++
++				ep->stopped = 1;
++				dwc_otg_ep_set_stall(GET_CORE_IF(pcd),
++						     &ep->dwc_ep);
++			}
++		} else {
++			if (ep->dwc_ep.num == 0) {
++				pcd->ep0state = EP0_STALL;
++			}
++
++			ep->stopped = 1;
++			dwc_otg_ep_set_stall(GET_CORE_IF(pcd), &ep->dwc_ep);
++		}
++	}
++
++	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++
++	return retval;
++}
++
++int dwc_otg_pcd_ep_halt(dwc_otg_pcd_t * pcd, void *ep_handle, int value)
++{
++	dwc_otg_pcd_ep_t *ep;
++	dwc_irqflags_t flags;
++	int retval = 0;
++
++	ep = get_ep_from_handle(pcd, ep_handle);
++
++	if (!ep || (!ep->desc && ep != &pcd->ep0) ||
++	    (ep->desc && (ep->desc->bmAttributes == UE_ISOCHRONOUS))) {
++		DWC_WARN("%s, bad ep\n", __func__);
++		return -DWC_E_INVALID;
++	}
++
++	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
++	if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
++		DWC_WARN("%d %s XFer In process\n", ep->dwc_ep.num,
++			 ep->dwc_ep.is_in ? "IN" : "OUT");
++		retval = -DWC_E_AGAIN;
++	} else if (value == 0) {
++		dwc_otg_ep_clear_stall(GET_CORE_IF(pcd), &ep->dwc_ep);
++	} else if (value == 1) {
++		if (ep->dwc_ep.is_in == 1 && GET_CORE_IF(pcd)->dma_desc_enable) {
++			dtxfsts_data_t txstatus;
++			fifosize_data_t txfifosize;
++
++			txfifosize.d32 =
++			    DWC_READ_REG32(&GET_CORE_IF(pcd)->core_global_regs->
++					   dtxfsiz[ep->dwc_ep.tx_fifo_num]);
++			txstatus.d32 =
++			    DWC_READ_REG32(&GET_CORE_IF(pcd)->dev_if->
++					   in_ep_regs[ep->dwc_ep.num]->dtxfsts);
++
++			if (txstatus.b.txfspcavail < txfifosize.b.depth) {
++				DWC_WARN("%s() Data In Tx Fifo\n", __func__);
++				retval = -DWC_E_AGAIN;
++			} else {
++				if (ep->dwc_ep.num == 0) {
++					pcd->ep0state = EP0_STALL;
++				}
++
++				ep->stopped = 1;
++				dwc_otg_ep_set_stall(GET_CORE_IF(pcd),
++						     &ep->dwc_ep);
++			}
++		} else {
++			if (ep->dwc_ep.num == 0) {
++				pcd->ep0state = EP0_STALL;
++			}
++
++			ep->stopped = 1;
++			dwc_otg_ep_set_stall(GET_CORE_IF(pcd), &ep->dwc_ep);
++		}
++	} else if (value == 2) {
++		ep->dwc_ep.stall_clear_flag = 0;
++	} else if (value == 3) {
++		ep->dwc_ep.stall_clear_flag = 1;
++	}
++
++	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++
++	return retval;
++}
++
++/**
++ * This function initiates remote wakeup of the host from suspend state.
++ */
++static void dwc_otg_pcd_rem_wkup_from_suspend(dwc_otg_pcd_t * pcd, int set)
++{
++	dctl_data_t dctl = { 0 };
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dsts_data_t dsts;
++
++	dsts.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
++	if (!dsts.b.suspsts) {
++		DWC_WARN("Remote wakeup while is not in suspend state\n");
++	}
++	/* Check if DEVICE_REMOTE_WAKEUP feature enabled */
++	if (pcd->remote_wakeup_enable) {
++		if (set) {
++
++			if (core_if->adp_enable) {
++				gpwrdn_data_t gpwrdn;
++
++				dwc_otg_adp_probe_stop(core_if);
++
++				/* Mask SRP detected interrupt from Power Down Logic */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.srp_det_msk = 1;
++				DWC_MODIFY_REG32(&core_if->
++						 core_global_regs->gpwrdn,
++						 gpwrdn.d32, 0);
++
++				/* Disable Power Down Logic */
++				gpwrdn.d32 = 0;
++				gpwrdn.b.pmuactv = 1;
++				DWC_MODIFY_REG32(&core_if->
++						 core_global_regs->gpwrdn,
++						 gpwrdn.d32, 0);
++
++				/*
++				 * Initialize the Core for Device mode.
++				 */
++				core_if->op_state = B_PERIPHERAL;
++				dwc_otg_core_init(core_if);
++				dwc_otg_enable_global_interrupts(core_if);
++				cil_pcd_start(core_if);
++
++				dwc_otg_initiate_srp(core_if);
++			}
++
++			dctl.b.rmtwkupsig = 1;
++			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
++					 dctl, 0, dctl.d32);
++			DWC_DEBUGPL(DBG_PCD, "Set Remote Wakeup\n");
++
++			dwc_mdelay(2);
++			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
++					 dctl, dctl.d32, 0);
++			DWC_DEBUGPL(DBG_PCD, "Clear Remote Wakeup\n");
++		}
++	} else {
++		DWC_DEBUGPL(DBG_PCD, "Remote Wakeup is disabled\n");
++	}
++}
++
++#ifdef CONFIG_USB_DWC_OTG_LPM
++/**
++ * This function initiates remote wakeup of the host from L1 sleep state.
++ */
++void dwc_otg_pcd_rem_wkup_from_sleep(dwc_otg_pcd_t * pcd, int set)
++{
++	glpmcfg_data_t lpmcfg;
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++
++	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++
++	/* Check if we are in L1 state */
++	if (!lpmcfg.b.prt_sleep_sts) {
++		DWC_DEBUGPL(DBG_PCD, "Device is not in sleep state\n");
++		return;
++	}
++
++	/* Check if host allows remote wakeup */
++	if (!lpmcfg.b.rem_wkup_en) {
++		DWC_DEBUGPL(DBG_PCD, "Host does not allow remote wakeup\n");
++		return;
++	}
++
++	/* Check if Resume OK */
++	if (!lpmcfg.b.sleep_state_resumeok) {
++		DWC_DEBUGPL(DBG_PCD, "Sleep state resume is not OK\n");
++		return;
++	}
++
++	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
++	lpmcfg.b.en_utmi_sleep = 0;
++	lpmcfg.b.hird_thres &= (~(1 << 4));
++	DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg, lpmcfg.d32);
++
++	if (set) {
++		dctl_data_t dctl = {.d32 = 0 };
++		dctl.b.rmtwkupsig = 1;
++		/* Set RmtWkUpSig bit to start remote wakup signaling.
++		 * Hardware will automatically clear this bit.
++		 */
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl,
++				 0, dctl.d32);
++		DWC_DEBUGPL(DBG_PCD, "Set Remote Wakeup\n");
++	}
++
++}
++#endif
++
++/**
++ * Performs remote wakeup.
++ */
++void dwc_otg_pcd_remote_wakeup(dwc_otg_pcd_t * pcd, int set)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dwc_irqflags_t flags;
++	if (dwc_otg_is_device_mode(core_if)) {
++		DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
++#ifdef CONFIG_USB_DWC_OTG_LPM
++		if (core_if->lx_state == DWC_OTG_L1) {
++			dwc_otg_pcd_rem_wkup_from_sleep(pcd, set);
++		} else {
++#endif
++			dwc_otg_pcd_rem_wkup_from_suspend(pcd, set);
++#ifdef CONFIG_USB_DWC_OTG_LPM
++		}
++#endif
++		DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++	}
++	return;
++}
++
++void dwc_otg_pcd_disconnect_us(dwc_otg_pcd_t * pcd, int no_of_usecs)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dctl_data_t dctl = { 0 };
++
++	if (dwc_otg_is_device_mode(core_if)) {
++		dctl.b.sftdiscon = 1;
++		DWC_PRINTF("Soft disconnect for %d useconds\n",no_of_usecs);
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0, dctl.d32);
++		dwc_udelay(no_of_usecs);
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32,0);
++
++	} else{
++		DWC_PRINTF("NOT SUPPORTED IN HOST MODE\n");
++	}
++	return;
++
++}
++
++int dwc_otg_pcd_wakeup(dwc_otg_pcd_t * pcd)
++{
++	dsts_data_t dsts;
++	gotgctl_data_t gotgctl;
++
++	/*
++	 * This function starts the Protocol if no session is in progress. If
++	 * a session is already in progress, but the device is suspended,
++	 * remote wakeup signaling is started.
++	 */
++
++	/* Check if valid session */
++	gotgctl.d32 =
++	    DWC_READ_REG32(&(GET_CORE_IF(pcd)->core_global_regs->gotgctl));
++	if (gotgctl.b.bsesvld) {
++		/* Check if suspend state */
++		dsts.d32 =
++		    DWC_READ_REG32(&
++				   (GET_CORE_IF(pcd)->dev_if->
++				    dev_global_regs->dsts));
++		if (dsts.b.suspsts) {
++			dwc_otg_pcd_remote_wakeup(pcd, 1);
++		}
++	} else {
++		dwc_otg_pcd_initiate_srp(pcd);
++	}
++
++	return 0;
++
++}
++
++/**
++ * Start the SRP timer to detect when the SRP does not complete within
++ * 6 seconds.
++ *
++ * @param pcd the pcd structure.
++ */
++void dwc_otg_pcd_initiate_srp(dwc_otg_pcd_t * pcd)
++{
++	dwc_irqflags_t flags;
++	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
++	dwc_otg_initiate_srp(GET_CORE_IF(pcd));
++	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
++}
++
++int dwc_otg_pcd_get_frame_number(dwc_otg_pcd_t * pcd)
++{
++	return dwc_otg_get_frame_number(GET_CORE_IF(pcd));
++}
++
++int dwc_otg_pcd_is_lpm_enabled(dwc_otg_pcd_t * pcd)
++{
++	return GET_CORE_IF(pcd)->core_params->lpm_enable;
++}
++
++uint32_t get_b_hnp_enable(dwc_otg_pcd_t * pcd)
++{
++	return pcd->b_hnp_enable;
++}
++
++uint32_t get_a_hnp_support(dwc_otg_pcd_t * pcd)
++{
++	return pcd->a_hnp_support;
++}
++
++uint32_t get_a_alt_hnp_support(dwc_otg_pcd_t * pcd)
++{
++	return pcd->a_alt_hnp_support;
++}
++
++int dwc_otg_pcd_get_rmwkup_enable(dwc_otg_pcd_t * pcd)
++{
++	return pcd->remote_wakeup_enable;
++}
++
++#endif /* DWC_HOST_ONLY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_pcd.h
+@@ -0,0 +1,277 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_pcd.h $
++ * $Revision: #48 $
++ * $Date: 2012/08/10 $
++ * $Change: 2047372 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++#ifndef DWC_HOST_ONLY
++#if !defined(__DWC_PCD_H__)
++#define __DWC_PCD_H__
++
++#include "dwc_otg_os_dep.h"
++#include "usb.h"
++#include "dwc_otg_cil.h"
++#include "dwc_otg_pcd_if.h"
++#include "dwc_otg_driver.h"
++
++struct cfiobject;
++
++/**
++ * @file
++ *
++ * This file contains the structures, constants, and interfaces for
++ * the Perpherial Contoller Driver (PCD).
++ *
++ * The Peripheral Controller Driver (PCD) for Linux will implement the
++ * Gadget API, so that the existing Gadget drivers can be used. For
++ * the Mass Storage Function driver the File-backed USB Storage Gadget
++ * (FBS) driver will be used.  The FBS driver supports the
++ * Control-Bulk (CB), Control-Bulk-Interrupt (CBI), and Bulk-Only
++ * transports.
++ *
++ */
++
++/** Invalid DMA Address */
++#define DWC_DMA_ADDR_INVALID	(~(dwc_dma_t)0)
++
++/** Max Transfer size for any EP */
++#define DDMA_MAX_TRANSFER_SIZE 65535
++
++/**
++ * Get the pointer to the core_if from the pcd pointer.
++ */
++#define GET_CORE_IF( _pcd ) (_pcd->core_if)
++
++/**
++ * States of EP0.
++ */
++typedef enum ep0_state {
++	EP0_DISCONNECT,		/* no host */
++	EP0_IDLE,
++	EP0_IN_DATA_PHASE,
++	EP0_OUT_DATA_PHASE,
++	EP0_IN_STATUS_PHASE,
++	EP0_OUT_STATUS_PHASE,
++	EP0_STALL,
++} ep0state_e;
++
++/** Fordward declaration.*/
++struct dwc_otg_pcd;
++
++/** DWC_otg iso request structure.
++ *
++ */
++typedef struct usb_iso_request dwc_otg_pcd_iso_request_t;
++
++#ifdef DWC_UTE_PER_IO
++
++/**
++ * This shall be the exact analogy of the same type structure defined in the
++ * usb_gadget.h. Each descriptor contains
++ */
++struct dwc_iso_pkt_desc_port {
++	uint32_t offset;
++	uint32_t length;	/* expected length */
++	uint32_t actual_length;
++	uint32_t status;
++};
++
++struct dwc_iso_xreq_port {
++	/** transfer/submission flag */
++	uint32_t tr_sub_flags;
++	/** Start the request ASAP */
++#define DWC_EREQ_TF_ASAP		0x00000002
++	/** Just enqueue the request w/o initiating a transfer */
++#define DWC_EREQ_TF_ENQUEUE		0x00000004
++
++	/**
++	* count of ISO packets attached to this request - shall
++	* not exceed the pio_alloc_pkt_count
++	*/
++	uint32_t pio_pkt_count;
++	/** count of ISO packets allocated for this request */
++	uint32_t pio_alloc_pkt_count;
++	/** number of ISO packet errors */
++	uint32_t error_count;
++	/** reserved for future extension */
++	uint32_t res;
++	/** Will be allocated and freed in the UTE gadget and based on the CFC value */
++	struct dwc_iso_pkt_desc_port *per_io_frame_descs;
++};
++#endif
++/** DWC_otg request structure.
++ * This structure is a list of requests.
++ */
++typedef struct dwc_otg_pcd_request {
++	void *priv;
++	void *buf;
++	dwc_dma_t dma;
++	uint32_t length;
++	uint32_t actual;
++	unsigned sent_zlp:1;
++    /**
++     * Used instead of original buffer if
++     * it(physical address) is not dword-aligned.
++     **/
++     uint8_t *dw_align_buf;
++     dwc_dma_t dw_align_buf_dma;
++
++	 DWC_CIRCLEQ_ENTRY(dwc_otg_pcd_request) queue_entry;
++#ifdef DWC_UTE_PER_IO
++	struct dwc_iso_xreq_port ext_req;
++	//void *priv_ereq_nport; /*  */
++#endif
++} dwc_otg_pcd_request_t;
++
++DWC_CIRCLEQ_HEAD(req_list, dwc_otg_pcd_request);
++
++/**	  PCD EP structure.
++ * This structure describes an EP, there is an array of EPs in the PCD
++ * structure.
++ */
++typedef struct dwc_otg_pcd_ep {
++	/** USB EP Descriptor */
++	const usb_endpoint_descriptor_t *desc;
++
++	/** queue of dwc_otg_pcd_requests. */
++	struct req_list queue;
++	unsigned stopped:1;
++	unsigned disabling:1;
++	unsigned dma:1;
++	unsigned queue_sof:1;
++
++#ifdef DWC_EN_ISOC
++	/** ISOC req handle passed */
++	void *iso_req_handle;
++#endif				//_EN_ISOC_
++
++	/** DWC_otg ep data. */
++	dwc_ep_t dwc_ep;
++
++	/** Pointer to PCD */
++	struct dwc_otg_pcd *pcd;
++
++	void *priv;
++} dwc_otg_pcd_ep_t;
++
++/** DWC_otg PCD Structure.
++ * This structure encapsulates the data for the dwc_otg PCD.
++ */
++struct dwc_otg_pcd {
++	const struct dwc_otg_pcd_function_ops *fops;
++	/** The DWC otg device pointer */
++	struct dwc_otg_device *otg_dev;
++	/** Core Interface */
++	dwc_otg_core_if_t *core_if;
++	/** State of EP0 */
++	ep0state_e ep0state;
++	/** EP0 Request is pending */
++	unsigned ep0_pending:1;
++	/** Indicates when SET CONFIGURATION Request is in process */
++	unsigned request_config:1;
++	/** The state of the Remote Wakeup Enable. */
++	unsigned remote_wakeup_enable:1;
++	/** The state of the B-Device HNP Enable. */
++	unsigned b_hnp_enable:1;
++	/** The state of A-Device HNP Support. */
++	unsigned a_hnp_support:1;
++	/** The state of the A-Device Alt HNP support. */
++	unsigned a_alt_hnp_support:1;
++	/** Count of pending Requests */
++	unsigned request_pending;
++
++	/** SETUP packet for EP0
++	 * This structure is allocated as a DMA buffer on PCD initialization
++	 * with enough space for up to 3 setup packets.
++	 */
++	union {
++		usb_device_request_t req;
++		uint32_t d32[2];
++	} *setup_pkt;
++
++	dwc_dma_t setup_pkt_dma_handle;
++
++	/* Additional buffer and flag for CTRL_WR premature case */
++	uint8_t *backup_buf;
++	unsigned data_terminated;
++
++	/** 2-byte dma buffer used to return status from GET_STATUS */
++	uint16_t *status_buf;
++	dwc_dma_t status_buf_dma_handle;
++
++	/** EP0 */
++	dwc_otg_pcd_ep_t ep0;
++
++	/** Array of IN EPs. */
++	dwc_otg_pcd_ep_t in_ep[MAX_EPS_CHANNELS - 1];
++	/** Array of OUT EPs. */
++	dwc_otg_pcd_ep_t out_ep[MAX_EPS_CHANNELS - 1];
++	/** number of valid EPs in the above array. */
++//        unsigned      num_eps : 4;
++	dwc_spinlock_t *lock;
++
++	/** Tasklet to defer starting of TEST mode transmissions until
++	 *	Status Phase has been completed.
++	 */
++	dwc_tasklet_t *test_mode_tasklet;
++
++	/** Tasklet to delay starting of xfer in DMA mode */
++	dwc_tasklet_t *start_xfer_tasklet;
++
++	/** The test mode to enter when the tasklet is executed. */
++	unsigned test_mode;
++	/** The cfi_api structure that implements most of the CFI API
++	 * and OTG specific core configuration functionality
++	 */
++#ifdef DWC_UTE_CFI
++	struct cfiobject *cfi;
++#endif
++
++};
++
++static inline struct device *dwc_otg_pcd_to_dev(struct dwc_otg_pcd *pcd)
++{
++	return &pcd->otg_dev->os_dep.platformdev->dev;
++}
++
++extern void dwc_otg_pcd_stop(dwc_otg_pcd_t * pcd);
++extern dwc_otg_pcd_ep_t *get_ep_by_addr(dwc_otg_pcd_t * pcd, u16 wIndex);
++extern void start_next_request(dwc_otg_pcd_ep_t * ep);
++
++//FIXME this functions should be static, and this prototypes should be removed
++extern void dwc_otg_request_nuke(dwc_otg_pcd_ep_t * ep);
++extern void dwc_otg_request_done(dwc_otg_pcd_ep_t * ep,
++				 dwc_otg_pcd_request_t * req, int32_t status);
++
++void dwc_otg_iso_buffer_done(dwc_otg_pcd_t * pcd, dwc_otg_pcd_ep_t * ep,
++			     void *req_handle);
++
++extern void do_test_mode(void *data);
++#endif
++#endif /* DWC_HOST_ONLY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_pcd_if.h
+@@ -0,0 +1,381 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_pcd_if.h $
++ * $Revision: #11 $
++ * $Date: 2011/10/26 $
++ * $Change: 1873028 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++#ifndef DWC_HOST_ONLY
++
++#if !defined(__DWC_PCD_IF_H__)
++#define __DWC_PCD_IF_H__
++
++//#include "dwc_os.h"
++#include "dwc_otg_core_if.h"
++#include "dwc_otg_driver.h"
++
++/** @file
++ * This file defines DWC_OTG PCD Core API.
++ */
++
++struct dwc_otg_pcd;
++typedef struct dwc_otg_pcd dwc_otg_pcd_t;
++
++/** Maxpacket size for EP0 */
++#define MAX_EP0_SIZE	64
++/** Maxpacket size for any EP */
++#define MAX_PACKET_SIZE 1024
++
++/** @name Function Driver Callbacks */
++/** @{ */
++
++/** This function will be called whenever a previously queued request has
++ * completed.  The status value will be set to -DWC_E_SHUTDOWN to indicated a
++ * failed or aborted transfer, or -DWC_E_RESTART to indicate the device was reset,
++ * or -DWC_E_TIMEOUT to indicate it timed out, or -DWC_E_INVALID to indicate invalid
++ * parameters. */
++typedef int (*dwc_completion_cb_t) (dwc_otg_pcd_t * pcd, void *ep_handle,
++				    void *req_handle, int32_t status,
++				    uint32_t actual);
++/**
++ * This function will be called whenever a previousle queued ISOC request has
++ * completed. Count of ISOC packets could be read using dwc_otg_pcd_get_iso_packet_count
++ * function.
++ * The status of each ISOC packet could be read using dwc_otg_pcd_get_iso_packet_*
++ * functions.
++ */
++typedef int (*dwc_isoc_completion_cb_t) (dwc_otg_pcd_t * pcd, void *ep_handle,
++					 void *req_handle, int proc_buf_num);
++/** This function should handle any SETUP request that cannot be handled by the
++ * PCD Core.  This includes most GET_DESCRIPTORs, SET_CONFIGS, Any
++ * class-specific requests, etc.  The function must non-blocking.
++ *
++ * Returns 0 on success.
++ * Returns -DWC_E_NOT_SUPPORTED if the request is not supported.
++ * Returns -DWC_E_INVALID if the setup request had invalid parameters or bytes.
++ * Returns -DWC_E_SHUTDOWN on any other error. */
++typedef int (*dwc_setup_cb_t) (dwc_otg_pcd_t * pcd, uint8_t * bytes);
++/** This is called whenever the device has been disconnected.  The function
++ * driver should take appropriate action to clean up all pending requests in the
++ * PCD Core, remove all endpoints (except ep0), and initialize back to reset
++ * state. */
++typedef int (*dwc_disconnect_cb_t) (dwc_otg_pcd_t * pcd);
++/** This function is called when device has been connected. */
++typedef int (*dwc_connect_cb_t) (dwc_otg_pcd_t * pcd, int speed);
++/** This function is called when device has been suspended */
++typedef int (*dwc_suspend_cb_t) (dwc_otg_pcd_t * pcd);
++/** This function is called when device has received LPM tokens, i.e.
++ * device has been sent to sleep state. */
++typedef int (*dwc_sleep_cb_t) (dwc_otg_pcd_t * pcd);
++/** This function is called when device has been resumed
++ * from suspend(L2) or L1 sleep state. */
++typedef int (*dwc_resume_cb_t) (dwc_otg_pcd_t * pcd);
++/** This function is called whenever hnp params has been changed.
++ * User can call get_b_hnp_enable, get_a_hnp_support, get_a_alt_hnp_support functions
++ * to get hnp parameters. */
++typedef int (*dwc_hnp_params_changed_cb_t) (dwc_otg_pcd_t * pcd);
++/** This function is called whenever USB RESET is detected. */
++typedef int (*dwc_reset_cb_t) (dwc_otg_pcd_t * pcd);
++
++typedef int (*cfi_setup_cb_t) (dwc_otg_pcd_t * pcd, void *ctrl_req_bytes);
++
++/**
++ *
++ * @param ep_handle	Void pointer to the usb_ep structure
++ * @param ereq_port Pointer to the extended request structure created in the
++ *					portable part.
++ */
++typedef int (*xiso_completion_cb_t) (dwc_otg_pcd_t * pcd, void *ep_handle,
++				     void *req_handle, int32_t status,
++				     void *ereq_port);
++/** Function Driver Ops Data Structure */
++struct dwc_otg_pcd_function_ops {
++	dwc_connect_cb_t connect;
++	dwc_disconnect_cb_t disconnect;
++	dwc_setup_cb_t setup;
++	dwc_completion_cb_t complete;
++	dwc_isoc_completion_cb_t isoc_complete;
++	dwc_suspend_cb_t suspend;
++	dwc_sleep_cb_t sleep;
++	dwc_resume_cb_t resume;
++	dwc_reset_cb_t reset;
++	dwc_hnp_params_changed_cb_t hnp_changed;
++	cfi_setup_cb_t cfi_setup;
++#ifdef DWC_UTE_PER_IO
++	xiso_completion_cb_t xisoc_complete;
++#endif
++};
++/** @} */
++
++/** @name Function Driver Functions */
++/** @{ */
++
++/** Call this function to get pointer on dwc_otg_pcd_t,
++ * this pointer will be used for all PCD API functions.
++ *
++ * @param core_if The DWC_OTG Core
++ */
++extern dwc_otg_pcd_t *dwc_otg_pcd_init(dwc_otg_device_t *otg_dev);
++
++/** Frees PCD allocated by dwc_otg_pcd_init
++ *
++ * @param pcd The PCD
++ */
++extern void dwc_otg_pcd_remove(dwc_otg_pcd_t * pcd);
++
++/** Call this to bind the function driver to the PCD Core.
++ *
++ * @param pcd Pointer on dwc_otg_pcd_t returned by dwc_otg_pcd_init function.
++ * @param fops The Function Driver Ops data structure containing pointers to all callbacks.
++ */
++extern void dwc_otg_pcd_start(dwc_otg_pcd_t * pcd,
++			      const struct dwc_otg_pcd_function_ops *fops);
++
++/** Enables an endpoint for use.  This function enables an endpoint in
++ * the PCD.  The endpoint is described by the ep_desc which has the
++ * same format as a USB ep descriptor.  The ep_handle parameter is used to refer
++ * to the endpoint from other API functions and in callbacks.  Normally this
++ * should be called after a SET_CONFIGURATION/SET_INTERFACE to configure the
++ * core for that interface.
++ *
++ * Returns -DWC_E_INVALID if invalid parameters were passed.
++ * Returns -DWC_E_SHUTDOWN if any other error ocurred.
++ * Returns 0 on success.
++ *
++ * @param pcd The PCD
++ * @param ep_desc Endpoint descriptor
++ * @param usb_ep Handle on endpoint, that will be used to identify endpoint.
++ */
++extern int dwc_otg_pcd_ep_enable(dwc_otg_pcd_t * pcd,
++				 const uint8_t * ep_desc, void *usb_ep);
++
++/** Disable the endpoint referenced by ep_handle.
++ *
++ * Returns -DWC_E_INVALID if invalid parameters were passed.
++ * Returns -DWC_E_SHUTDOWN if any other error occurred.
++ * Returns 0 on success. */
++extern int dwc_otg_pcd_ep_disable(dwc_otg_pcd_t * pcd, void *ep_handle);
++
++/** Queue a data transfer request on the endpoint referenced by ep_handle.
++ * After the transfer is completes, the complete callback will be called with
++ * the request status.
++ *
++ * @param pcd The PCD
++ * @param ep_handle The handle of the endpoint
++ * @param buf The buffer for the data
++ * @param dma_buf The DMA buffer for the data
++ * @param buflen The length of the data transfer
++ * @param zero Specifies whether to send zero length last packet.
++ * @param req_handle Set this handle to any value to use to reference this
++ * request in the ep_dequeue function or from the complete callback
++ * @param atomic_alloc If driver need to perform atomic allocations
++ * for internal data structures.
++ *
++ * Returns -DWC_E_INVALID if invalid parameters were passed.
++ * Returns -DWC_E_SHUTDOWN if any other error ocurred.
++ * Returns 0 on success. */
++extern int dwc_otg_pcd_ep_queue(dwc_otg_pcd_t * pcd, void *ep_handle,
++				uint8_t * buf, dwc_dma_t dma_buf,
++				uint32_t buflen, int zero, void *req_handle,
++				int atomic_alloc);
++#ifdef DWC_UTE_PER_IO
++/**
++ *
++ * @param ereq_nonport	Pointer to the extended request part of the
++ *						usb_request structure defined in usb_gadget.h file.
++ */
++extern int dwc_otg_pcd_xiso_ep_queue(dwc_otg_pcd_t * pcd, void *ep_handle,
++				     uint8_t * buf, dwc_dma_t dma_buf,
++				     uint32_t buflen, int zero,
++				     void *req_handle, int atomic_alloc,
++				     void *ereq_nonport);
++
++#endif
++
++/** De-queue the specified data transfer that has not yet completed.
++ *
++ * Returns -DWC_E_INVALID if invalid parameters were passed.
++ * Returns -DWC_E_SHUTDOWN if any other error ocurred.
++ * Returns 0 on success. */
++extern int dwc_otg_pcd_ep_dequeue(dwc_otg_pcd_t * pcd, void *ep_handle,
++				  void *req_handle);
++
++/** Halt (STALL) an endpoint or clear it.
++ *
++ * Returns -DWC_E_INVALID if invalid parameters were passed.
++ * Returns -DWC_E_SHUTDOWN if any other error ocurred.
++ * Returns -DWC_E_AGAIN if the STALL cannot be sent and must be tried again later
++ * Returns 0 on success. */
++extern int dwc_otg_pcd_ep_halt(dwc_otg_pcd_t * pcd, void *ep_handle, int value);
++
++/** This function */
++extern int dwc_otg_pcd_ep_wedge(dwc_otg_pcd_t * pcd, void *ep_handle);
++
++/** This function should be called on every hardware interrupt */
++extern int32_t dwc_otg_pcd_handle_intr(dwc_otg_pcd_t * pcd);
++
++/** This function returns current frame number */
++extern int dwc_otg_pcd_get_frame_number(dwc_otg_pcd_t * pcd);
++
++/**
++ * Start isochronous transfers on the endpoint referenced by ep_handle.
++ * For isochronous transfers duble buffering is used.
++ * After processing each of buffers comlete callback will be called with
++ * status for each transaction.
++ *
++ * @param pcd The PCD
++ * @param ep_handle The handle of the endpoint
++ * @param buf0 The virtual address of first data buffer
++ * @param buf1 The virtual address of second data buffer
++ * @param dma0 The DMA address of first data buffer
++ * @param dma1 The DMA address of second data buffer
++ * @param sync_frame Data pattern frame number
++ * @param dp_frame Data size for pattern frame
++ * @param data_per_frame Data size for regular frame
++ * @param start_frame Frame number to start transfers, if -1 then start transfers ASAP.
++ * @param buf_proc_intrvl Interval of ISOC Buffer processing
++ * @param req_handle Handle of ISOC request
++ * @param atomic_alloc Specefies whether to perform atomic allocation for
++ * 			internal data structures.
++ *
++ * Returns -DWC_E_NO_MEMORY if there is no enough memory.
++ * Returns -DWC_E_INVALID if incorrect arguments are passed to the function.
++ * Returns -DW_E_SHUTDOWN for any other error.
++ * Returns 0 on success
++ */
++extern int dwc_otg_pcd_iso_ep_start(dwc_otg_pcd_t * pcd, void *ep_handle,
++				    uint8_t * buf0, uint8_t * buf1,
++				    dwc_dma_t dma0, dwc_dma_t dma1,
++				    int sync_frame, int dp_frame,
++				    int data_per_frame, int start_frame,
++				    int buf_proc_intrvl, void *req_handle,
++				    int atomic_alloc);
++
++/** Stop ISOC transfers on endpoint referenced by ep_handle.
++ *
++ * @param pcd The PCD
++ * @param ep_handle The handle of the endpoint
++ * @param req_handle Handle of ISOC request
++ *
++ * Returns -DWC_E_INVALID if incorrect arguments are passed to the function
++ * Returns 0 on success
++ */
++int dwc_otg_pcd_iso_ep_stop(dwc_otg_pcd_t * pcd, void *ep_handle,
++			    void *req_handle);
++
++/** Get ISOC packet status.
++ *
++ * @param pcd The PCD
++ * @param ep_handle The handle of the endpoint
++ * @param iso_req_handle Isochronoush request handle
++ * @param packet Number of packet
++ * @param status Out parameter for returning status
++ * @param actual Out parameter for returning actual length
++ * @param offset Out parameter for returning offset
++ *
++ */
++extern void dwc_otg_pcd_get_iso_packet_params(dwc_otg_pcd_t * pcd,
++					      void *ep_handle,
++					      void *iso_req_handle, int packet,
++					      int *status, int *actual,
++					      int *offset);
++
++/** Get ISOC packet count.
++ *
++ * @param pcd The PCD
++ * @param ep_handle The handle of the endpoint
++ * @param iso_req_handle
++ */
++extern int dwc_otg_pcd_get_iso_packet_count(dwc_otg_pcd_t * pcd,
++					    void *ep_handle,
++					    void *iso_req_handle);
++
++/** This function starts the SRP Protocol if no session is in progress. If
++ * a session is already in progress, but the device is suspended,
++ * remote wakeup signaling is started.
++ */
++extern int dwc_otg_pcd_wakeup(dwc_otg_pcd_t * pcd);
++
++/** This function returns 1 if LPM support is enabled, and 0 otherwise. */
++extern int dwc_otg_pcd_is_lpm_enabled(dwc_otg_pcd_t * pcd);
++
++/** This function returns 1 if remote wakeup is allowed and 0, otherwise. */
++extern int dwc_otg_pcd_get_rmwkup_enable(dwc_otg_pcd_t * pcd);
++
++/** Initiate SRP */
++extern void dwc_otg_pcd_initiate_srp(dwc_otg_pcd_t * pcd);
++
++/** Starts remote wakeup signaling. */
++extern void dwc_otg_pcd_remote_wakeup(dwc_otg_pcd_t * pcd, int set);
++
++/** Starts micorsecond soft disconnect. */
++extern void dwc_otg_pcd_disconnect_us(dwc_otg_pcd_t * pcd, int no_of_usecs);
++/** This function returns whether device is dualspeed.*/
++extern uint32_t dwc_otg_pcd_is_dualspeed(dwc_otg_pcd_t * pcd);
++
++/** This function returns whether device is otg. */
++extern uint32_t dwc_otg_pcd_is_otg(dwc_otg_pcd_t * pcd);
++
++/** These functions allow to get hnp parameters */
++extern uint32_t get_b_hnp_enable(dwc_otg_pcd_t * pcd);
++extern uint32_t get_a_hnp_support(dwc_otg_pcd_t * pcd);
++extern uint32_t get_a_alt_hnp_support(dwc_otg_pcd_t * pcd);
++
++/** CFI specific Interface functions */
++/** Allocate a cfi buffer */
++extern uint8_t *cfiw_ep_alloc_buffer(dwc_otg_pcd_t * pcd, void *pep,
++				     dwc_dma_t * addr, size_t buflen,
++				     int flags);
++
++extern int pcd_init(
++#ifdef LM_INTERFACE
++			   struct lm_device *_dev
++#elif  defined(PCI_INTERFACE)
++			   struct pci_dev *_dev
++#elif  defined(PLATFORM_INTERFACE)
++	struct platform_device *dev
++#endif
++    );
++
++extern void pcd_remove(
++#ifdef LM_INTERFACE
++			     struct lm_device *_dev
++#elif  defined(PCI_INTERFACE)
++			     struct pci_dev *_dev
++#elif  defined(PLATFORM_INTERFACE)
++	struct platform_device *_dev
++#endif
++    );
++
++/******************************************************************************/
++
++/** @} */
++
++#endif				/* __DWC_PCD_IF_H__ */
++
++#endif				/* DWC_HOST_ONLY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_pcd_intr.c
+@@ -0,0 +1,5148 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_pcd_intr.c $
++ * $Revision: #116 $
++ * $Date: 2012/08/10 $
++ * $Change: 2047372 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++#ifndef DWC_HOST_ONLY
++
++#include "dwc_otg_pcd.h"
++
++#ifdef DWC_UTE_CFI
++#include "dwc_otg_cfi.h"
++#endif
++
++#ifdef DWC_UTE_PER_IO
++extern void complete_xiso_ep(dwc_otg_pcd_ep_t * ep);
++#endif
++//#define PRINT_CFI_DMA_DESCS
++
++#define DEBUG_EP0
++
++/**
++ * This function updates OTG.
++ */
++static void dwc_otg_pcd_update_otg(dwc_otg_pcd_t * pcd, const unsigned reset)
++{
++
++	if (reset) {
++		pcd->b_hnp_enable = 0;
++		pcd->a_hnp_support = 0;
++		pcd->a_alt_hnp_support = 0;
++	}
++
++	if (pcd->fops->hnp_changed) {
++		pcd->fops->hnp_changed(pcd);
++	}
++}
++
++/** @file
++ * This file contains the implementation of the PCD Interrupt handlers.
++ *
++ * The PCD handles the device interrupts.  Many conditions can cause a
++ * device interrupt. When an interrupt occurs, the device interrupt
++ * service routine determines the cause of the interrupt and
++ * dispatches handling to the appropriate function. These interrupt
++ * handling functions are described below.
++ * All interrupt registers are processed from LSB to MSB.
++ */
++
++/**
++ * This function prints the ep0 state for debug purposes.
++ */
++static inline void print_ep0_state(dwc_otg_pcd_t * pcd)
++{
++#ifdef DEBUG
++	char str[40];
++
++	switch (pcd->ep0state) {
++	case EP0_DISCONNECT:
++		dwc_strcpy(str, "EP0_DISCONNECT");
++		break;
++	case EP0_IDLE:
++		dwc_strcpy(str, "EP0_IDLE");
++		break;
++	case EP0_IN_DATA_PHASE:
++		dwc_strcpy(str, "EP0_IN_DATA_PHASE");
++		break;
++	case EP0_OUT_DATA_PHASE:
++		dwc_strcpy(str, "EP0_OUT_DATA_PHASE");
++		break;
++	case EP0_IN_STATUS_PHASE:
++		dwc_strcpy(str, "EP0_IN_STATUS_PHASE");
++		break;
++	case EP0_OUT_STATUS_PHASE:
++		dwc_strcpy(str, "EP0_OUT_STATUS_PHASE");
++		break;
++	case EP0_STALL:
++		dwc_strcpy(str, "EP0_STALL");
++		break;
++	default:
++		dwc_strcpy(str, "EP0_INVALID");
++	}
++
++	DWC_DEBUGPL(DBG_ANY, "%s(%d)\n", str, pcd->ep0state);
++#endif
++}
++
++/**
++ * This function calculate the size of the payload in the memory
++ * for out endpoints and prints size for debug purposes(used in
++ * 2.93a DevOutNak feature).
++ */
++static inline void print_memory_payload(dwc_otg_pcd_t * pcd,  dwc_ep_t * ep)
++{
++#ifdef DEBUG
++	deptsiz_data_t deptsiz_init = {.d32 = 0 };
++	deptsiz_data_t deptsiz_updt = {.d32 = 0 };
++	int pack_num;
++	unsigned payload;
++
++	deptsiz_init.d32 = pcd->core_if->start_doeptsiz_val[ep->num];
++	deptsiz_updt.d32 =
++		DWC_READ_REG32(&pcd->core_if->dev_if->
++						out_ep_regs[ep->num]->doeptsiz);
++	/* Payload will be */
++	payload = deptsiz_init.b.xfersize - deptsiz_updt.b.xfersize;
++	/* Packet count is decremented every time a packet
++	 * is written to the RxFIFO not in to the external memory
++	 * So, if payload == 0, then it means no packet was sent to ext memory*/
++	pack_num = (!payload) ? 0 : (deptsiz_init.b.pktcnt - deptsiz_updt.b.pktcnt);
++	DWC_DEBUGPL(DBG_PCDV,
++		"Payload for EP%d-%s\n",
++		ep->num, (ep->is_in ? "IN" : "OUT"));
++	DWC_DEBUGPL(DBG_PCDV,
++		"Number of transfered bytes = 0x%08x\n", payload);
++	DWC_DEBUGPL(DBG_PCDV,
++		"Number of transfered packets = %d\n", pack_num);
++#endif
++}
++
++
++#ifdef DWC_UTE_CFI
++static inline void print_desc(struct dwc_otg_dma_desc *ddesc,
++			      const uint8_t * epname, int descnum)
++{
++	CFI_INFO
++	    ("%s DMA_DESC(%d) buf=0x%08x bytes=0x%04x; sp=0x%x; l=0x%x; sts=0x%02x; bs=0x%02x\n",
++	     epname, descnum, ddesc->buf, ddesc->status.b.bytes,
++	     ddesc->status.b.sp, ddesc->status.b.l, ddesc->status.b.sts,
++	     ddesc->status.b.bs);
++}
++#endif
++
++/**
++ * This function returns pointer to in ep struct with number ep_num
++ */
++static inline dwc_otg_pcd_ep_t *get_in_ep(dwc_otg_pcd_t * pcd, uint32_t ep_num)
++{
++	int i;
++	int num_in_eps = GET_CORE_IF(pcd)->dev_if->num_in_eps;
++	if (ep_num == 0) {
++		return &pcd->ep0;
++	} else {
++		for (i = 0; i < num_in_eps; ++i) {
++			if (pcd->in_ep[i].dwc_ep.num == ep_num)
++				return &pcd->in_ep[i];
++		}
++		return 0;
++	}
++}
++
++/**
++ * This function returns pointer to out ep struct with number ep_num
++ */
++static inline dwc_otg_pcd_ep_t *get_out_ep(dwc_otg_pcd_t * pcd, uint32_t ep_num)
++{
++	int i;
++	int num_out_eps = GET_CORE_IF(pcd)->dev_if->num_out_eps;
++	if (ep_num == 0) {
++		return &pcd->ep0;
++	} else {
++		for (i = 0; i < num_out_eps; ++i) {
++			if (pcd->out_ep[i].dwc_ep.num == ep_num)
++				return &pcd->out_ep[i];
++		}
++		return 0;
++	}
++}
++
++/**
++ * This functions gets a pointer to an EP from the wIndex address
++ * value of the control request.
++ */
++dwc_otg_pcd_ep_t *get_ep_by_addr(dwc_otg_pcd_t * pcd, u16 wIndex)
++{
++	dwc_otg_pcd_ep_t *ep;
++	uint32_t ep_num = UE_GET_ADDR(wIndex);
++
++	if (ep_num == 0) {
++		ep = &pcd->ep0;
++	} else if (UE_GET_DIR(wIndex) == UE_DIR_IN) {	/* in ep */
++		ep = &pcd->in_ep[ep_num - 1];
++	} else {
++		ep = &pcd->out_ep[ep_num - 1];
++	}
++
++	return ep;
++}
++
++/**
++ * This function checks the EP request queue, if the queue is not
++ * empty the next request is started.
++ */
++void start_next_request(dwc_otg_pcd_ep_t * ep)
++{
++	dwc_otg_pcd_request_t *req = 0;
++	uint32_t max_transfer =
++	    GET_CORE_IF(ep->pcd)->core_params->max_transfer_size;
++
++#ifdef DWC_UTE_CFI
++	struct dwc_otg_pcd *pcd;
++	pcd = ep->pcd;
++#endif
++
++	if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
++		req = DWC_CIRCLEQ_FIRST(&ep->queue);
++
++#ifdef DWC_UTE_CFI
++		if (ep->dwc_ep.buff_mode != BM_STANDARD) {
++			ep->dwc_ep.cfi_req_len = req->length;
++			pcd->cfi->ops.build_descriptors(pcd->cfi, pcd, ep, req);
++		} else {
++#endif
++			/* Setup and start the Transfer */
++			if (req->dw_align_buf) {
++				ep->dwc_ep.dma_addr = req->dw_align_buf_dma;
++				ep->dwc_ep.start_xfer_buff = req->dw_align_buf;
++				ep->dwc_ep.xfer_buff = req->dw_align_buf;
++			} else {
++				ep->dwc_ep.dma_addr = req->dma;
++				ep->dwc_ep.start_xfer_buff = req->buf;
++				ep->dwc_ep.xfer_buff = req->buf;
++			}
++			ep->dwc_ep.sent_zlp = 0;
++			ep->dwc_ep.total_len = req->length;
++			ep->dwc_ep.xfer_len = 0;
++			ep->dwc_ep.xfer_count = 0;
++
++			ep->dwc_ep.maxxfer = max_transfer;
++			if (GET_CORE_IF(ep->pcd)->dma_desc_enable) {
++				uint32_t out_max_xfer = DDMA_MAX_TRANSFER_SIZE
++				    - (DDMA_MAX_TRANSFER_SIZE % 4);
++				if (ep->dwc_ep.is_in) {
++					if (ep->dwc_ep.maxxfer >
++					    DDMA_MAX_TRANSFER_SIZE) {
++						ep->dwc_ep.maxxfer =
++						    DDMA_MAX_TRANSFER_SIZE;
++					}
++				} else {
++					if (ep->dwc_ep.maxxfer > out_max_xfer) {
++						ep->dwc_ep.maxxfer =
++						    out_max_xfer;
++					}
++				}
++			}
++			if (ep->dwc_ep.maxxfer < ep->dwc_ep.total_len) {
++				ep->dwc_ep.maxxfer -=
++				    (ep->dwc_ep.maxxfer % ep->dwc_ep.maxpacket);
++			}
++			if (req->sent_zlp) {
++				if ((ep->dwc_ep.total_len %
++				     ep->dwc_ep.maxpacket == 0)
++				    && (ep->dwc_ep.total_len != 0)) {
++					ep->dwc_ep.sent_zlp = 1;
++				}
++
++			}
++#ifdef DWC_UTE_CFI
++		}
++#endif
++		dwc_otg_ep_start_transfer(GET_CORE_IF(ep->pcd), &ep->dwc_ep);
++	} else if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
++		DWC_PRINTF("There are no more ISOC requests \n");
++		ep->dwc_ep.frame_num = 0xFFFFFFFF;
++	}
++}
++
++/**
++ * This function handles the SOF Interrupts. At this time the SOF
++ * Interrupt is disabled.
++ */
++static int32_t dwc_otg_pcd_handle_sof_intr(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++
++	gintsts_data_t gintsts;
++
++	DWC_DEBUGPL(DBG_PCD, "SOF\n");
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.sofintr = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++
++	return 1;
++}
++
++/**
++ * This function handles the Rx Status Queue Level Interrupt, which
++ * indicates that there is a least one packet in the Rx FIFO.  The
++ * packets are moved from the FIFO to memory, where they will be
++ * processed when the Endpoint Interrupt Register indicates Transfer
++ * Complete or SETUP Phase Done.
++ *
++ * Repeat the following until the Rx Status Queue is empty:
++ *	 -# Read the Receive Status Pop Register (GRXSTSP) to get Packet
++ *		info
++ *	 -# If Receive FIFO is empty then skip to step Clear the interrupt
++ *		and exit
++ *	 -# If SETUP Packet call dwc_otg_read_setup_packet to copy the
++ *		SETUP data to the buffer
++ *	 -# If OUT Data Packet call dwc_otg_read_packet to copy the data
++ *		to the destination buffer
++ */
++static int32_t dwc_otg_pcd_handle_rx_status_q_level_intr(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	gintmsk_data_t gintmask = {.d32 = 0 };
++	device_grxsts_data_t status;
++	dwc_otg_pcd_ep_t *ep;
++	gintsts_data_t gintsts;
++#ifdef DEBUG
++	static char *dpid_str[] = { "D0", "D2", "D1", "MDATA" };
++#endif
++
++	//DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, _pcd);
++	/* Disable the Rx Status Queue Level interrupt */
++	gintmask.b.rxstsqlvl = 1;
++	DWC_MODIFY_REG32(&global_regs->gintmsk, gintmask.d32, 0);
++
++	/* Get the Status from the top of the FIFO */
++	status.d32 = DWC_READ_REG32(&global_regs->grxstsp);
++
++	DWC_DEBUGPL(DBG_PCD, "EP:%d BCnt:%d DPID:%s "
++		    "pktsts:%x Frame:%d(0x%0x)\n",
++		    status.b.epnum, status.b.bcnt,
++		    dpid_str[status.b.dpid],
++		    status.b.pktsts, status.b.fn, status.b.fn);
++	/* Get pointer to EP structure */
++	ep = get_out_ep(pcd, status.b.epnum);
++
++	switch (status.b.pktsts) {
++	case DWC_DSTS_GOUT_NAK:
++		DWC_DEBUGPL(DBG_PCDV, "Global OUT NAK\n");
++		break;
++	case DWC_STS_DATA_UPDT:
++		DWC_DEBUGPL(DBG_PCDV, "OUT Data Packet\n");
++		if (status.b.bcnt && ep->dwc_ep.xfer_buff) {
++			/** @todo NGS Check for buffer overflow? */
++			dwc_otg_read_packet(core_if,
++					    ep->dwc_ep.xfer_buff,
++					    status.b.bcnt);
++			ep->dwc_ep.xfer_count += status.b.bcnt;
++			ep->dwc_ep.xfer_buff += status.b.bcnt;
++		}
++		break;
++	case DWC_STS_XFER_COMP:
++		DWC_DEBUGPL(DBG_PCDV, "OUT Complete\n");
++		break;
++	case DWC_DSTS_SETUP_COMP:
++#ifdef DEBUG_EP0
++		DWC_DEBUGPL(DBG_PCDV, "Setup Complete\n");
++#endif
++		break;
++	case DWC_DSTS_SETUP_UPDT:
++		dwc_otg_read_setup_packet(core_if, pcd->setup_pkt->d32);
++#ifdef DEBUG_EP0
++		DWC_DEBUGPL(DBG_PCD,
++			    "SETUP PKT: %02x.%02x v%04x i%04x l%04x\n",
++			    pcd->setup_pkt->req.bmRequestType,
++			    pcd->setup_pkt->req.bRequest,
++			    UGETW(pcd->setup_pkt->req.wValue),
++			    UGETW(pcd->setup_pkt->req.wIndex),
++			    UGETW(pcd->setup_pkt->req.wLength));
++#endif
++		ep->dwc_ep.xfer_count += status.b.bcnt;
++		break;
++	default:
++		DWC_DEBUGPL(DBG_PCDV, "Invalid Packet Status (0x%0x)\n",
++			    status.b.pktsts);
++		break;
++	}
++
++	/* Enable the Rx Status Queue Level interrupt */
++	DWC_MODIFY_REG32(&global_regs->gintmsk, 0, gintmask.d32);
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.rxstsqlvl = 1;
++	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++	//DWC_DEBUGPL(DBG_PCDV, "EXIT: %s\n", __func__);
++	return 1;
++}
++
++/**
++ * This function examines the Device IN Token Learning Queue to
++ * determine the EP number of the last IN token received.  This
++ * implementation is for the Mass Storage device where there are only
++ * 2 IN EPs (Control-IN and BULK-IN).
++ *
++ * The EP numbers for the first six IN Tokens are in DTKNQR1 and there
++ * are 8 EP Numbers in each of the other possible DTKNQ Registers.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ *
++ */
++static inline int get_ep_of_last_in_token(dwc_otg_core_if_t * core_if)
++{
++	dwc_otg_device_global_regs_t *dev_global_regs =
++	    core_if->dev_if->dev_global_regs;
++	const uint32_t TOKEN_Q_DEPTH = core_if->hwcfg2.b.dev_token_q_depth;
++	/* Number of Token Queue Registers */
++	const int DTKNQ_REG_CNT = (TOKEN_Q_DEPTH + 7) / 8;
++	dtknq1_data_t dtknqr1;
++	uint32_t in_tkn_epnums[4];
++	int ndx = 0;
++	int i = 0;
++	volatile uint32_t *addr = &dev_global_regs->dtknqr1;
++	int epnum = 0;
++
++	//DWC_DEBUGPL(DBG_PCD,"dev_token_q_depth=%d\n",TOKEN_Q_DEPTH);
++
++	/* Read the DTKNQ Registers */
++	for (i = 0; i < DTKNQ_REG_CNT; i++) {
++		in_tkn_epnums[i] = DWC_READ_REG32(addr);
++		DWC_DEBUGPL(DBG_PCDV, "DTKNQR%d=0x%08x\n", i + 1,
++			    in_tkn_epnums[i]);
++		if (addr == &dev_global_regs->dvbusdis) {
++			addr = &dev_global_regs->dtknqr3_dthrctl;
++		} else {
++			++addr;
++		}
++
++	}
++
++	/* Copy the DTKNQR1 data to the bit field. */
++	dtknqr1.d32 = in_tkn_epnums[0];
++	/* Get the EP numbers */
++	in_tkn_epnums[0] = dtknqr1.b.epnums0_5;
++	ndx = dtknqr1.b.intknwptr - 1;
++
++	//DWC_DEBUGPL(DBG_PCDV,"ndx=%d\n",ndx);
++	if (ndx == -1) {
++		/** @todo Find a simpler way to calculate the max
++		 * queue position.*/
++		int cnt = TOKEN_Q_DEPTH;
++		if (TOKEN_Q_DEPTH <= 6) {
++			cnt = TOKEN_Q_DEPTH - 1;
++		} else if (TOKEN_Q_DEPTH <= 14) {
++			cnt = TOKEN_Q_DEPTH - 7;
++		} else if (TOKEN_Q_DEPTH <= 22) {
++			cnt = TOKEN_Q_DEPTH - 15;
++		} else {
++			cnt = TOKEN_Q_DEPTH - 23;
++		}
++		epnum = (in_tkn_epnums[DTKNQ_REG_CNT - 1] >> (cnt * 4)) & 0xF;
++	} else {
++		if (ndx <= 5) {
++			epnum = (in_tkn_epnums[0] >> (ndx * 4)) & 0xF;
++		} else if (ndx <= 13) {
++			ndx -= 6;
++			epnum = (in_tkn_epnums[1] >> (ndx * 4)) & 0xF;
++		} else if (ndx <= 21) {
++			ndx -= 14;
++			epnum = (in_tkn_epnums[2] >> (ndx * 4)) & 0xF;
++		} else if (ndx <= 29) {
++			ndx -= 22;
++			epnum = (in_tkn_epnums[3] >> (ndx * 4)) & 0xF;
++		}
++	}
++	//DWC_DEBUGPL(DBG_PCD,"epnum=%d\n",epnum);
++	return epnum;
++}
++
++/**
++ * This interrupt occurs when the non-periodic Tx FIFO is half-empty.
++ * The active request is checked for the next packet to be loaded into
++ * the non-periodic Tx FIFO.
++ */
++static int32_t dwc_otg_pcd_handle_np_tx_fifo_empty_intr(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	dwc_otg_dev_in_ep_regs_t *ep_regs;
++	gnptxsts_data_t txstatus = {.d32 = 0 };
++	gintsts_data_t gintsts;
++
++	int epnum = 0;
++	dwc_otg_pcd_ep_t *ep = 0;
++	uint32_t len = 0;
++	int dwords;
++
++	/* Get the epnum from the IN Token Learning Queue. */
++	epnum = get_ep_of_last_in_token(core_if);
++	ep = get_in_ep(pcd, epnum);
++
++	DWC_DEBUGPL(DBG_PCD, "NP TxFifo Empty: %d \n", epnum);
++
++	ep_regs = core_if->dev_if->in_ep_regs[epnum];
++
++	len = ep->dwc_ep.xfer_len - ep->dwc_ep.xfer_count;
++	if (len > ep->dwc_ep.maxpacket) {
++		len = ep->dwc_ep.maxpacket;
++	}
++	dwords = (len + 3) / 4;
++
++	/* While there is space in the queue and space in the FIFO and
++	 * More data to tranfer, Write packets to the Tx FIFO */
++	txstatus.d32 = DWC_READ_REG32(&global_regs->gnptxsts);
++	DWC_DEBUGPL(DBG_PCDV, "b4 GNPTXSTS=0x%08x\n", txstatus.d32);
++
++	while (txstatus.b.nptxqspcavail > 0 &&
++	       txstatus.b.nptxfspcavail > dwords &&
++	       ep->dwc_ep.xfer_count < ep->dwc_ep.xfer_len) {
++		/* Write the FIFO */
++		dwc_otg_ep_write_packet(core_if, &ep->dwc_ep, 0);
++		len = ep->dwc_ep.xfer_len - ep->dwc_ep.xfer_count;
++
++		if (len > ep->dwc_ep.maxpacket) {
++			len = ep->dwc_ep.maxpacket;
++		}
++
++		dwords = (len + 3) / 4;
++		txstatus.d32 = DWC_READ_REG32(&global_regs->gnptxsts);
++		DWC_DEBUGPL(DBG_PCDV, "GNPTXSTS=0x%08x\n", txstatus.d32);
++	}
++
++	DWC_DEBUGPL(DBG_PCDV, "GNPTXSTS=0x%08x\n",
++		    DWC_READ_REG32(&global_regs->gnptxsts));
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.nptxfempty = 1;
++	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
++
++	return 1;
++}
++
++/**
++ * This function is called when dedicated Tx FIFO Empty interrupt occurs.
++ * The active request is checked for the next packet to be loaded into
++ * apropriate Tx FIFO.
++ */
++static int32_t write_empty_tx_fifo(dwc_otg_pcd_t * pcd, uint32_t epnum)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	dwc_otg_dev_in_ep_regs_t *ep_regs;
++	dtxfsts_data_t txstatus = {.d32 = 0 };
++	dwc_otg_pcd_ep_t *ep = 0;
++	uint32_t len = 0;
++	int dwords;
++
++	ep = get_in_ep(pcd, epnum);
++
++	DWC_DEBUGPL(DBG_PCD, "Dedicated TxFifo Empty: %d \n", epnum);
++
++	ep_regs = core_if->dev_if->in_ep_regs[epnum];
++
++	len = ep->dwc_ep.xfer_len - ep->dwc_ep.xfer_count;
++
++	if (len > ep->dwc_ep.maxpacket) {
++		len = ep->dwc_ep.maxpacket;
++	}
++
++	dwords = (len + 3) / 4;
++
++	/* While there is space in the queue and space in the FIFO and
++	 * More data to tranfer, Write packets to the Tx FIFO */
++	txstatus.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dtxfsts);
++	DWC_DEBUGPL(DBG_PCDV, "b4 dtxfsts[%d]=0x%08x\n", epnum, txstatus.d32);
++
++	while (txstatus.b.txfspcavail > dwords &&
++	       ep->dwc_ep.xfer_count < ep->dwc_ep.xfer_len &&
++	       ep->dwc_ep.xfer_len != 0) {
++		/* Write the FIFO */
++		dwc_otg_ep_write_packet(core_if, &ep->dwc_ep, 0);
++
++		len = ep->dwc_ep.xfer_len - ep->dwc_ep.xfer_count;
++		if (len > ep->dwc_ep.maxpacket) {
++			len = ep->dwc_ep.maxpacket;
++		}
++
++		dwords = (len + 3) / 4;
++		txstatus.d32 =
++		    DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dtxfsts);
++		DWC_DEBUGPL(DBG_PCDV, "dtxfsts[%d]=0x%08x\n", epnum,
++			    txstatus.d32);
++	}
++
++	DWC_DEBUGPL(DBG_PCDV, "b4 dtxfsts[%d]=0x%08x\n", epnum,
++		    DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dtxfsts));
++
++	return 1;
++}
++
++/**
++ * This function is called when the Device is disconnected. It stops
++ * any active requests and informs the Gadget driver of the
++ * disconnect.
++ */
++void dwc_otg_pcd_stop(dwc_otg_pcd_t * pcd)
++{
++	int i, num_in_eps, num_out_eps;
++	dwc_otg_pcd_ep_t *ep;
++
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++
++	DWC_SPINLOCK(pcd->lock);
++
++	num_in_eps = GET_CORE_IF(pcd)->dev_if->num_in_eps;
++	num_out_eps = GET_CORE_IF(pcd)->dev_if->num_out_eps;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s() \n", __func__);
++	/* don't disconnect drivers more than once */
++	if (pcd->ep0state == EP0_DISCONNECT) {
++		DWC_DEBUGPL(DBG_ANY, "%s() Already Disconnected\n", __func__);
++		DWC_SPINUNLOCK(pcd->lock);
++		return;
++	}
++	pcd->ep0state = EP0_DISCONNECT;
++
++	/* Reset the OTG state. */
++	dwc_otg_pcd_update_otg(pcd, 1);
++
++	/* Disable the NP Tx Fifo Empty Interrupt. */
++	intr_mask.b.nptxfempty = 1;
++	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
++			 intr_mask.d32, 0);
++
++	/* Flush the FIFOs */
++	/**@todo NGS Flush Periodic FIFOs */
++	dwc_otg_flush_tx_fifo(GET_CORE_IF(pcd), 0x10);
++	dwc_otg_flush_rx_fifo(GET_CORE_IF(pcd));
++
++	/* prevent new request submissions, kill any outstanding requests  */
++	ep = &pcd->ep0;
++	dwc_otg_request_nuke(ep);
++	/* prevent new request submissions, kill any outstanding requests  */
++	for (i = 0; i < num_in_eps; i++) {
++		dwc_otg_pcd_ep_t *ep = &pcd->in_ep[i];
++		dwc_otg_request_nuke(ep);
++	}
++	/* prevent new request submissions, kill any outstanding requests  */
++	for (i = 0; i < num_out_eps; i++) {
++		dwc_otg_pcd_ep_t *ep = &pcd->out_ep[i];
++		dwc_otg_request_nuke(ep);
++	}
++
++	/* report disconnect; the driver is already quiesced */
++	if (pcd->fops->disconnect) {
++		DWC_SPINUNLOCK(pcd->lock);
++		pcd->fops->disconnect(pcd);
++		DWC_SPINLOCK(pcd->lock);
++	}
++	DWC_SPINUNLOCK(pcd->lock);
++}
++
++/**
++ * This interrupt indicates that ...
++ */
++static int32_t dwc_otg_pcd_handle_i2c_intr(dwc_otg_pcd_t * pcd)
++{
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++	gintsts_data_t gintsts;
++
++	DWC_PRINTF("INTERRUPT Handler not implemented for %s\n", "i2cintr");
++	intr_mask.b.i2cintr = 1;
++	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
++			 intr_mask.d32, 0);
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.i2cintr = 1;
++	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
++			gintsts.d32);
++	return 1;
++}
++
++/**
++ * This interrupt indicates that ...
++ */
++static int32_t dwc_otg_pcd_handle_early_suspend_intr(dwc_otg_pcd_t * pcd)
++{
++	gintsts_data_t gintsts;
++#if defined(VERBOSE)
++	DWC_PRINTF("Early Suspend Detected\n");
++#endif
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.erlysuspend = 1;
++	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
++			gintsts.d32);
++	return 1;
++}
++
++/**
++ * This function configures EPO to receive SETUP packets.
++ *
++ * @todo NGS: Update the comments from the HW FS.
++ *
++ *	-# Program the following fields in the endpoint specific registers
++ *	for Control OUT EP 0, in order to receive a setup packet
++ *	- DOEPTSIZ0.Packet Count = 3 (To receive up to 3 back to back
++ *	  setup packets)
++ *	- DOEPTSIZE0.Transfer Size = 24 Bytes (To receive up to 3 back
++ *	  to back setup packets)
++ *		- In DMA mode, DOEPDMA0 Register with a memory address to
++ *		  store any setup packets received
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param pcd	  Programming view of the PCD.
++ */
++static inline void ep0_out_start(dwc_otg_core_if_t * core_if,
++				 dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	deptsiz0_data_t doeptsize0 = {.d32 = 0 };
++	dwc_otg_dev_dma_desc_t *dma_desc;
++	depctl_data_t doepctl = {.d32 = 0 };
++
++#ifdef VERBOSE
++	DWC_DEBUGPL(DBG_PCDV, "%s() doepctl0=%0x\n", __func__,
++		    DWC_READ_REG32(&dev_if->out_ep_regs[0]->doepctl));
++#endif
++	if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
++		doepctl.d32 = DWC_READ_REG32(&dev_if->out_ep_regs[0]->doepctl);
++		if (doepctl.b.epena) {
++			return;
++		}
++	}
++
++	doeptsize0.b.supcnt = 3;
++	doeptsize0.b.pktcnt = 1;
++	doeptsize0.b.xfersize = 8 * 3;
++
++	if (core_if->dma_enable) {
++		if (!core_if->dma_desc_enable) {
++			/** put here as for Hermes mode deptisz register should not be written */
++			DWC_WRITE_REG32(&dev_if->out_ep_regs[0]->doeptsiz,
++					doeptsize0.d32);
++
++			/** @todo dma needs to handle multiple setup packets (up to 3) */
++			DWC_WRITE_REG32(&dev_if->out_ep_regs[0]->doepdma,
++					pcd->setup_pkt_dma_handle);
++		} else {
++			dev_if->setup_desc_index =
++			    (dev_if->setup_desc_index + 1) & 1;
++			dma_desc =
++			    dev_if->setup_desc_addr[dev_if->setup_desc_index];
++
++			/** DMA Descriptor Setup */
++			dma_desc->status.b.bs = BS_HOST_BUSY;
++			if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
++				dma_desc->status.b.sr = 0;
++				dma_desc->status.b.mtrf = 0;
++			}
++			dma_desc->status.b.l = 1;
++			dma_desc->status.b.ioc = 1;
++			dma_desc->status.b.bytes = pcd->ep0.dwc_ep.maxpacket;
++			dma_desc->buf = pcd->setup_pkt_dma_handle;
++			dma_desc->status.b.sts = 0;
++			dma_desc->status.b.bs = BS_HOST_READY;
++
++			/** DOEPDMA0 Register write */
++			DWC_WRITE_REG32(&dev_if->out_ep_regs[0]->doepdma,
++					dev_if->dma_setup_desc_addr
++					[dev_if->setup_desc_index]);
++		}
++
++	} else {
++		/** put here as for Hermes mode deptisz register should not be written */
++		DWC_WRITE_REG32(&dev_if->out_ep_regs[0]->doeptsiz,
++				doeptsize0.d32);
++	}
++
++	/** DOEPCTL0 Register write cnak will be set after setup interrupt */
++	doepctl.d32 = 0;
++	doepctl.b.epena = 1;
++	if (core_if->snpsid <= OTG_CORE_REV_2_94a) {
++	doepctl.b.cnak = 1;
++	DWC_WRITE_REG32(&dev_if->out_ep_regs[0]->doepctl, doepctl.d32);
++	} else {
++		DWC_MODIFY_REG32(&dev_if->out_ep_regs[0]->doepctl, 0, doepctl.d32);
++	}
++
++#ifdef VERBOSE
++	DWC_DEBUGPL(DBG_PCDV, "doepctl0=%0x\n",
++		    DWC_READ_REG32(&dev_if->out_ep_regs[0]->doepctl));
++	DWC_DEBUGPL(DBG_PCDV, "diepctl0=%0x\n",
++		    DWC_READ_REG32(&dev_if->in_ep_regs[0]->diepctl));
++#endif
++}
++
++/**
++ * This interrupt occurs when a USB Reset is detected. When the USB
++ * Reset Interrupt occurs the device state is set to DEFAULT and the
++ * EP0 state is set to IDLE.
++ *	-#	Set the NAK bit for all OUT endpoints (DOEPCTLn.SNAK = 1)
++ *	-#	Unmask the following interrupt bits
++ *		- DAINTMSK.INEP0 = 1 (Control 0 IN endpoint)
++ *	- DAINTMSK.OUTEP0 = 1 (Control 0 OUT endpoint)
++ *	- DOEPMSK.SETUP = 1
++ *	- DOEPMSK.XferCompl = 1
++ *	- DIEPMSK.XferCompl = 1
++ *	- DIEPMSK.TimeOut = 1
++ *	-# Program the following fields in the endpoint specific registers
++ *	for Control OUT EP 0, in order to receive a setup packet
++ *	- DOEPTSIZ0.Packet Count = 3 (To receive up to 3 back to back
++ *	  setup packets)
++ *	- DOEPTSIZE0.Transfer Size = 24 Bytes (To receive up to 3 back
++ *	  to back setup packets)
++ *		- In DMA mode, DOEPDMA0 Register with a memory address to
++ *		  store any setup packets received
++ * At this point, all the required initialization, except for enabling
++ * the control 0 OUT endpoint is done, for receiving SETUP packets.
++ */
++static int32_t dwc_otg_pcd_handle_usb_reset_intr(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	depctl_data_t doepctl = {.d32 = 0 };
++	depctl_data_t diepctl = {.d32 = 0 };
++	daint_data_t daintmsk = {.d32 = 0 };
++	doepmsk_data_t doepmsk = {.d32 = 0 };
++	diepmsk_data_t diepmsk = {.d32 = 0 };
++	dcfg_data_t dcfg = {.d32 = 0 };
++	grstctl_t resetctl = {.d32 = 0 };
++	dctl_data_t dctl = {.d32 = 0 };
++	int i = 0;
++	gintsts_data_t gintsts;
++	pcgcctl_data_t power = {.d32 = 0 };
++
++	power.d32 = DWC_READ_REG32(core_if->pcgcctl);
++	if (power.b.stoppclk) {
++		power.d32 = 0;
++		power.b.stoppclk = 1;
++		DWC_MODIFY_REG32(core_if->pcgcctl, power.d32, 0);
++
++		power.b.pwrclmp = 1;
++		DWC_MODIFY_REG32(core_if->pcgcctl, power.d32, 0);
++
++		power.b.rstpdwnmodule = 1;
++		DWC_MODIFY_REG32(core_if->pcgcctl, power.d32, 0);
++	}
++
++	core_if->lx_state = DWC_OTG_L0;
++
++	DWC_PRINTF("USB RESET\n");
++#ifdef DWC_EN_ISOC
++	for (i = 1; i < 16; ++i) {
++		dwc_otg_pcd_ep_t *ep;
++		dwc_ep_t *dwc_ep;
++		ep = get_in_ep(pcd, i);
++		if (ep != 0) {
++			dwc_ep = &ep->dwc_ep;
++			dwc_ep->next_frame = 0xffffffff;
++		}
++	}
++#endif /* DWC_EN_ISOC */
++
++	/* reset the HNP settings */
++	dwc_otg_pcd_update_otg(pcd, 1);
++
++	/* Clear the Remote Wakeup Signalling */
++	dctl.b.rmtwkupsig = 1;
++	DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32, 0);
++
++	/* Set NAK for all OUT EPs */
++	doepctl.b.snak = 1;
++	for (i = 0; i <= dev_if->num_out_eps; i++) {
++		DWC_WRITE_REG32(&dev_if->out_ep_regs[i]->doepctl, doepctl.d32);
++	}
++
++	/* Flush the NP Tx FIFO */
++	dwc_otg_flush_tx_fifo(core_if, 0x10);
++	/* Flush the Learning Queue */
++	resetctl.b.intknqflsh = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->grstctl, resetctl.d32);
++
++	if (!core_if->core_params->en_multiple_tx_fifo && core_if->dma_enable) {
++		core_if->start_predict = 0;
++		for (i = 0; i<= core_if->dev_if->num_in_eps; ++i) {
++			core_if->nextep_seq[i] = 0xff;	// 0xff - EP not active
++		}
++		core_if->nextep_seq[0] = 0;
++		core_if->first_in_nextep_seq = 0;
++		diepctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[0]->diepctl);
++		diepctl.b.nextep = 0;
++		DWC_WRITE_REG32(&dev_if->in_ep_regs[0]->diepctl, diepctl.d32);
++
++		/* Update IN Endpoint Mismatch Count by active IN NP EP count + 1 */
++		dcfg.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dcfg);
++		dcfg.b.epmscnt = 2;
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->dcfg, dcfg.d32);
++
++		DWC_DEBUGPL(DBG_PCDV,
++			    "%s first_in_nextep_seq= %2d; nextep_seq[]:\n",
++			__func__, core_if->first_in_nextep_seq);
++		for (i=0; i <= core_if->dev_if->num_in_eps; i++) {
++			DWC_DEBUGPL(DBG_PCDV, "%2d\n", core_if->nextep_seq[i]);
++		}
++	}
++
++	if (core_if->multiproc_int_enable) {
++		daintmsk.b.inep0 = 1;
++		daintmsk.b.outep0 = 1;
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->deachintmsk,
++				daintmsk.d32);
++
++		doepmsk.b.setup = 1;
++		doepmsk.b.xfercompl = 1;
++		doepmsk.b.ahberr = 1;
++		doepmsk.b.epdisabled = 1;
++
++		if ((core_if->dma_desc_enable) ||
++		    (core_if->dma_enable
++		     && core_if->snpsid >= OTG_CORE_REV_3_00a)) {
++			doepmsk.b.stsphsercvd = 1;
++		}
++		if (core_if->dma_desc_enable)
++			doepmsk.b.bna = 1;
++/*
++		doepmsk.b.babble = 1;
++		doepmsk.b.nyet = 1;
++
++		if (core_if->dma_enable) {
++			doepmsk.b.nak = 1;
++		}
++*/
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->doepeachintmsk[0],
++				doepmsk.d32);
++
++		diepmsk.b.xfercompl = 1;
++		diepmsk.b.timeout = 1;
++		diepmsk.b.epdisabled = 1;
++		diepmsk.b.ahberr = 1;
++		diepmsk.b.intknepmis = 1;
++		if (!core_if->en_multiple_tx_fifo && core_if->dma_enable)
++			diepmsk.b.intknepmis = 0;
++
++/*		if (core_if->dma_desc_enable) {
++			diepmsk.b.bna = 1;
++		}
++*/
++/*
++		if (core_if->dma_enable) {
++			diepmsk.b.nak = 1;
++		}
++*/
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->diepeachintmsk[0],
++				diepmsk.d32);
++	} else {
++		daintmsk.b.inep0 = 1;
++		daintmsk.b.outep0 = 1;
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->daintmsk,
++				daintmsk.d32);
++
++		doepmsk.b.setup = 1;
++		doepmsk.b.xfercompl = 1;
++		doepmsk.b.ahberr = 1;
++		doepmsk.b.epdisabled = 1;
++
++		if ((core_if->dma_desc_enable) ||
++		    (core_if->dma_enable
++		     && core_if->snpsid >= OTG_CORE_REV_3_00a)) {
++			doepmsk.b.stsphsercvd = 1;
++		}
++		if (core_if->dma_desc_enable)
++			doepmsk.b.bna = 1;
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->doepmsk, doepmsk.d32);
++
++		diepmsk.b.xfercompl = 1;
++		diepmsk.b.timeout = 1;
++		diepmsk.b.epdisabled = 1;
++		diepmsk.b.ahberr = 1;
++		if (!core_if->en_multiple_tx_fifo && core_if->dma_enable)
++			diepmsk.b.intknepmis = 0;
++/*
++		if (core_if->dma_desc_enable) {
++			diepmsk.b.bna = 1;
++		}
++*/
++
++		DWC_WRITE_REG32(&dev_if->dev_global_regs->diepmsk, diepmsk.d32);
++	}
++
++	/* Reset Device Address */
++	dcfg.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dcfg);
++	dcfg.b.devaddr = 0;
++	DWC_WRITE_REG32(&dev_if->dev_global_regs->dcfg, dcfg.d32);
++
++	/* setup EP0 to receive SETUP packets */
++	if (core_if->snpsid <= OTG_CORE_REV_2_94a)
++		ep0_out_start(core_if, pcd);
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.usbreset = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++
++	return 1;
++}
++
++/**
++ * Get the device speed from the device status register and convert it
++ * to USB speed constant.
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ */
++static int get_device_speed(dwc_otg_core_if_t * core_if)
++{
++	dsts_data_t dsts;
++	int speed = 0;
++	dsts.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
++
++	switch (dsts.b.enumspd) {
++	case DWC_DSTS_ENUMSPD_HS_PHY_30MHZ_OR_60MHZ:
++		speed = USB_SPEED_HIGH;
++		break;
++	case DWC_DSTS_ENUMSPD_FS_PHY_30MHZ_OR_60MHZ:
++	case DWC_DSTS_ENUMSPD_FS_PHY_48MHZ:
++		speed = USB_SPEED_FULL;
++		break;
++
++	case DWC_DSTS_ENUMSPD_LS_PHY_6MHZ:
++		speed = USB_SPEED_LOW;
++		break;
++	}
++
++	return speed;
++}
++
++/**
++ * Read the device status register and set the device speed in the
++ * data structure.
++ * Set up EP0 to receive SETUP packets by calling dwc_ep0_activate.
++ */
++static int32_t dwc_otg_pcd_handle_enum_done_intr(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
++	gintsts_data_t gintsts;
++	gusbcfg_data_t gusbcfg;
++	dwc_otg_core_global_regs_t *global_regs =
++	    GET_CORE_IF(pcd)->core_global_regs;
++	uint8_t utmi16b, utmi8b;
++	int speed;
++	DWC_DEBUGPL(DBG_PCD, "SPEED ENUM\n");
++
++	if (GET_CORE_IF(pcd)->snpsid >= OTG_CORE_REV_2_60a) {
++		utmi16b = 6;	//vahrama old value was 6;
++		utmi8b = 9;
++	} else {
++		utmi16b = 4;
++		utmi8b = 8;
++	}
++	dwc_otg_ep0_activate(GET_CORE_IF(pcd), &ep0->dwc_ep);
++	if (GET_CORE_IF(pcd)->snpsid >= OTG_CORE_REV_3_00a) {
++		ep0_out_start(GET_CORE_IF(pcd), pcd);
++	}
++
++#ifdef DEBUG_EP0
++	print_ep0_state(pcd);
++#endif
++
++	if (pcd->ep0state == EP0_DISCONNECT) {
++		pcd->ep0state = EP0_IDLE;
++	} else if (pcd->ep0state == EP0_STALL) {
++		pcd->ep0state = EP0_IDLE;
++	}
++
++	pcd->ep0state = EP0_IDLE;
++
++	ep0->stopped = 0;
++
++	speed = get_device_speed(GET_CORE_IF(pcd));
++	pcd->fops->connect(pcd, speed);
++
++	/* Set USB turnaround time based on device speed and PHY interface. */
++	gusbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
++	if (speed == USB_SPEED_HIGH) {
++		if (GET_CORE_IF(pcd)->hwcfg2.b.hs_phy_type ==
++		    DWC_HWCFG2_HS_PHY_TYPE_ULPI) {
++			/* ULPI interface */
++			gusbcfg.b.usbtrdtim = 9;
++		}
++		if (GET_CORE_IF(pcd)->hwcfg2.b.hs_phy_type ==
++		    DWC_HWCFG2_HS_PHY_TYPE_UTMI) {
++			/* UTMI+ interface */
++			if (GET_CORE_IF(pcd)->hwcfg4.b.utmi_phy_data_width == 0) {
++				gusbcfg.b.usbtrdtim = utmi8b;
++			} else if (GET_CORE_IF(pcd)->hwcfg4.
++				   b.utmi_phy_data_width == 1) {
++				gusbcfg.b.usbtrdtim = utmi16b;
++			} else if (GET_CORE_IF(pcd)->
++				   core_params->phy_utmi_width == 8) {
++				gusbcfg.b.usbtrdtim = utmi8b;
++			} else {
++				gusbcfg.b.usbtrdtim = utmi16b;
++			}
++		}
++		if (GET_CORE_IF(pcd)->hwcfg2.b.hs_phy_type ==
++		    DWC_HWCFG2_HS_PHY_TYPE_UTMI_ULPI) {
++			/* UTMI+  OR  ULPI interface */
++			if (gusbcfg.b.ulpi_utmi_sel == 1) {
++				/* ULPI interface */
++				gusbcfg.b.usbtrdtim = 9;
++			} else {
++				/* UTMI+ interface */
++				if (GET_CORE_IF(pcd)->
++				    core_params->phy_utmi_width == 16) {
++					gusbcfg.b.usbtrdtim = utmi16b;
++				} else {
++					gusbcfg.b.usbtrdtim = utmi8b;
++				}
++			}
++		}
++	} else {
++		/* Full or low speed */
++		gusbcfg.b.usbtrdtim = 9;
++	}
++	DWC_WRITE_REG32(&global_regs->gusbcfg, gusbcfg.d32);
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.enumdone = 1;
++	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
++			gintsts.d32);
++	return 1;
++}
++
++/**
++ * This interrupt indicates that the ISO OUT Packet was dropped due to
++ * Rx FIFO full or Rx Status Queue Full.  If this interrupt occurs
++ * read all the data from the Rx FIFO.
++ */
++static int32_t dwc_otg_pcd_handle_isoc_out_packet_dropped_intr(dwc_otg_pcd_t * pcd)
++{
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++	gintsts_data_t gintsts;
++
++	DWC_WARN("INTERRUPT Handler not implemented for %s\n",
++		 "ISOC Out Dropped");
++
++	intr_mask.b.isooutdrop = 1;
++	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
++			 intr_mask.d32, 0);
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.isooutdrop = 1;
++	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
++			gintsts.d32);
++
++	return 1;
++}
++
++/**
++ * This interrupt indicates the end of the portion of the micro-frame
++ * for periodic transactions.  If there is a periodic transaction for
++ * the next frame, load the packets into the EP periodic Tx FIFO.
++ */
++static int32_t dwc_otg_pcd_handle_end_periodic_frame_intr(dwc_otg_pcd_t * pcd)
++{
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++	gintsts_data_t gintsts;
++	DWC_PRINTF("INTERRUPT Handler not implemented for %s\n", "EOP");
++
++	intr_mask.b.eopframe = 1;
++	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
++			 intr_mask.d32, 0);
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.eopframe = 1;
++	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
++			gintsts.d32);
++
++	return 1;
++}
++
++/**
++ * This interrupt indicates that EP of the packet on the top of the
++ * non-periodic Tx FIFO does not match EP of the IN Token received.
++ *
++ * The "Device IN Token Queue" Registers are read to determine the
++ * order the IN Tokens have been received. The non-periodic Tx FIFO
++ * is flushed, so it can be reloaded in the order seen in the IN Token
++ * Queue.
++ */
++static int32_t dwc_otg_pcd_handle_ep_mismatch_intr(dwc_otg_pcd_t * pcd)
++{
++	gintsts_data_t gintsts;
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dctl_data_t dctl;
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++
++	if (!core_if->en_multiple_tx_fifo && core_if->dma_enable) {
++		core_if->start_predict = 1;
++
++		DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, core_if);
++
++		gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
++		if (!gintsts.b.ginnakeff) {
++			/* Disable EP Mismatch interrupt */
++			intr_mask.d32 = 0;
++			intr_mask.b.epmismatch = 1;
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, intr_mask.d32, 0);
++			/* Enable the Global IN NAK Effective Interrupt */
++			intr_mask.d32 = 0;
++			intr_mask.b.ginnakeff = 1;
++			DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, 0, intr_mask.d32);
++			/* Set the global non-periodic IN NAK handshake */
++			dctl.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dctl);
++			dctl.b.sgnpinnak = 1;
++			DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32);
++		} else {
++			DWC_PRINTF("gintsts.b.ginnakeff = 1! dctl.b.sgnpinnak not set\n");
++		}
++		/* Disabling of all EP's will be done in dwc_otg_pcd_handle_in_nak_effective()
++		 * handler after Global IN NAK Effective interrupt will be asserted */
++	}
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.epmismatch = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++
++	return 1;
++}
++
++/**
++ * This interrupt is valid only in DMA mode. This interrupt indicates that the
++ * core has stopped fetching data for IN endpoints due to the unavailability of
++ * TxFIFO space or Request Queue space. This interrupt is used by the
++ * application for an endpoint mismatch algorithm.
++ *
++ * @param pcd The PCD
++ */
++static int32_t dwc_otg_pcd_handle_ep_fetsusp_intr(dwc_otg_pcd_t * pcd)
++{
++	gintsts_data_t gintsts;
++	gintmsk_data_t gintmsk_data;
++	dctl_data_t dctl;
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, core_if);
++
++	/* Clear the global non-periodic IN NAK handshake */
++	dctl.d32 = 0;
++	dctl.b.cgnpinnak = 1;
++	DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32, dctl.d32);
++
++	/* Mask GINTSTS.FETSUSP interrupt */
++	gintmsk_data.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
++	gintmsk_data.b.fetsusp = 0;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, gintmsk_data.d32);
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.fetsusp = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
++
++	return 1;
++}
++/**
++ * This funcion stalls EP0.
++ */
++static inline void ep0_do_stall(dwc_otg_pcd_t * pcd, const int err_val)
++{
++	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
++	usb_device_request_t *ctrl = &pcd->setup_pkt->req;
++	DWC_WARN("req %02x.%02x protocol STALL; err %d\n",
++		 ctrl->bmRequestType, ctrl->bRequest, err_val);
++
++	ep0->dwc_ep.is_in = 1;
++	dwc_otg_ep_set_stall(GET_CORE_IF(pcd), &ep0->dwc_ep);
++	pcd->ep0.stopped = 1;
++	pcd->ep0state = EP0_IDLE;
++	ep0_out_start(GET_CORE_IF(pcd), pcd);
++}
++
++/**
++ * This functions delegates the setup command to the gadget driver.
++ */
++static inline void do_gadget_setup(dwc_otg_pcd_t * pcd,
++				   usb_device_request_t * ctrl)
++{
++	int ret = 0;
++	DWC_SPINUNLOCK(pcd->lock);
++	ret = pcd->fops->setup(pcd, (uint8_t *) ctrl);
++	DWC_SPINLOCK(pcd->lock);
++	if (ret < 0) {
++		ep0_do_stall(pcd, ret);
++	}
++
++	/** @todo This is a g_file_storage gadget driver specific
++	 * workaround: a DELAYED_STATUS result from the fsg_setup
++	 * routine will result in the gadget queueing a EP0 IN status
++	 * phase for a two-stage control transfer. Exactly the same as
++	 * a SET_CONFIGURATION/SET_INTERFACE except that this is a class
++	 * specific request.  Need a generic way to know when the gadget
++	 * driver will queue the status phase. Can we assume when we
++	 * call the gadget driver setup() function that it will always
++	 * queue and require the following flag? Need to look into
++	 * this.
++	 */
++
++	if (ret == 256 + 999) {
++		pcd->request_config = 1;
++	}
++}
++
++#ifdef DWC_UTE_CFI
++/**
++ * This functions delegates the CFI setup commands to the gadget driver.
++ * This function will return a negative value to indicate a failure.
++ */
++static inline int cfi_gadget_setup(dwc_otg_pcd_t * pcd,
++				   struct cfi_usb_ctrlrequest *ctrl_req)
++{
++	int ret = 0;
++
++	if (pcd->fops && pcd->fops->cfi_setup) {
++		DWC_SPINUNLOCK(pcd->lock);
++		ret = pcd->fops->cfi_setup(pcd, ctrl_req);
++		DWC_SPINLOCK(pcd->lock);
++		if (ret < 0) {
++			ep0_do_stall(pcd, ret);
++			return ret;
++		}
++	}
++
++	return ret;
++}
++#endif
++
++/**
++ * This function starts the Zero-Length Packet for the IN status phase
++ * of a 2 stage control transfer.
++ */
++static inline void do_setup_in_status_phase(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
++	if (pcd->ep0state == EP0_STALL) {
++		return;
++	}
++
++	pcd->ep0state = EP0_IN_STATUS_PHASE;
++
++	/* Prepare for more SETUP Packets */
++	DWC_DEBUGPL(DBG_PCD, "EP0 IN ZLP\n");
++	if ((GET_CORE_IF(pcd)->snpsid >= OTG_CORE_REV_3_00a)
++	    && (pcd->core_if->dma_desc_enable)
++	    && (ep0->dwc_ep.xfer_count < ep0->dwc_ep.total_len)) {
++		DWC_DEBUGPL(DBG_PCDV,
++			    "Data terminated wait next packet in out_desc_addr\n");
++		pcd->backup_buf = phys_to_virt(ep0->dwc_ep.dma_addr);
++		pcd->data_terminated = 1;
++	}
++	ep0->dwc_ep.xfer_len = 0;
++	ep0->dwc_ep.xfer_count = 0;
++	ep0->dwc_ep.is_in = 1;
++	ep0->dwc_ep.dma_addr = pcd->setup_pkt_dma_handle;
++	dwc_otg_ep0_start_transfer(GET_CORE_IF(pcd), &ep0->dwc_ep);
++
++	/* Prepare for more SETUP Packets */
++	//ep0_out_start(GET_CORE_IF(pcd), pcd);
++}
++
++/**
++ * This function starts the Zero-Length Packet for the OUT status phase
++ * of a 2 stage control transfer.
++ */
++static inline void do_setup_out_status_phase(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
++	if (pcd->ep0state == EP0_STALL) {
++		DWC_DEBUGPL(DBG_PCD, "EP0 STALLED\n");
++		return;
++	}
++	pcd->ep0state = EP0_OUT_STATUS_PHASE;
++
++	DWC_DEBUGPL(DBG_PCD, "EP0 OUT ZLP\n");
++	ep0->dwc_ep.xfer_len = 0;
++	ep0->dwc_ep.xfer_count = 0;
++	ep0->dwc_ep.is_in = 0;
++	ep0->dwc_ep.dma_addr = pcd->setup_pkt_dma_handle;
++	dwc_otg_ep0_start_transfer(GET_CORE_IF(pcd), &ep0->dwc_ep);
++
++	/* Prepare for more SETUP Packets */
++	if (GET_CORE_IF(pcd)->dma_enable == 0) {
++		ep0_out_start(GET_CORE_IF(pcd), pcd);
++	}
++}
++
++/**
++ * Clear the EP halt (STALL) and if pending requests start the
++ * transfer.
++ */
++static inline void pcd_clear_halt(dwc_otg_pcd_t * pcd, dwc_otg_pcd_ep_t * ep)
++{
++	if (ep->dwc_ep.stall_clear_flag == 0)
++		dwc_otg_ep_clear_stall(GET_CORE_IF(pcd), &ep->dwc_ep);
++
++	/* Reactive the EP */
++	dwc_otg_ep_activate(GET_CORE_IF(pcd), &ep->dwc_ep);
++	if (ep->stopped) {
++		ep->stopped = 0;
++		/* If there is a request in the EP queue start it */
++
++		/** @todo FIXME: this causes an EP mismatch in DMA mode.
++		 * epmismatch not yet implemented. */
++
++		/*
++		 * Above fixme is solved by implmenting a tasklet to call the
++		 * start_next_request(), outside of interrupt context at some
++		 * time after the current time, after a clear-halt setup packet.
++		 * Still need to implement ep mismatch in the future if a gadget
++		 * ever uses more than one endpoint at once
++		 */
++		ep->queue_sof = 1;
++		DWC_TASK_SCHEDULE(pcd->start_xfer_tasklet);
++	}
++	/* Start Control Status Phase */
++	do_setup_in_status_phase(pcd);
++}
++
++/**
++ * This function is called when the SET_FEATURE TEST_MODE Setup packet
++ * is sent from the host.  The Device Control register is written with
++ * the Test Mode bits set to the specified Test Mode.  This is done as
++ * a tasklet so that the "Status" phase of the control transfer
++ * completes before transmitting the TEST packets.
++ *
++ * @todo This has not been tested since the tasklet struct was put
++ * into the PCD struct!
++ *
++ */
++void do_test_mode(void *data)
++{
++	dctl_data_t dctl;
++	dwc_otg_pcd_t *pcd = (dwc_otg_pcd_t *) data;
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	int test_mode = pcd->test_mode;
++
++//        DWC_WARN("%s() has not been tested since being rewritten!\n", __func__);
++
++	dctl.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dctl);
++	switch (test_mode) {
++	case 1:		// TEST_J
++		dctl.b.tstctl = 1;
++		break;
++
++	case 2:		// TEST_K
++		dctl.b.tstctl = 2;
++		break;
++
++	case 3:		// TEST_SE0_NAK
++		dctl.b.tstctl = 3;
++		break;
++
++	case 4:		// TEST_PACKET
++		dctl.b.tstctl = 4;
++		break;
++
++	case 5:		// TEST_FORCE_ENABLE
++		dctl.b.tstctl = 5;
++		break;
++	}
++	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32);
++}
++
++/**
++ * This function process the GET_STATUS Setup Commands.
++ */
++static inline void do_get_status(dwc_otg_pcd_t * pcd)
++{
++	usb_device_request_t ctrl = pcd->setup_pkt->req;
++	dwc_otg_pcd_ep_t *ep;
++	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
++	uint16_t *status = pcd->status_buf;
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++
++#ifdef DEBUG_EP0
++	DWC_DEBUGPL(DBG_PCD,
++		    "GET_STATUS %02x.%02x v%04x i%04x l%04x\n",
++		    ctrl.bmRequestType, ctrl.bRequest,
++		    UGETW(ctrl.wValue), UGETW(ctrl.wIndex),
++		    UGETW(ctrl.wLength));
++#endif
++
++	switch (UT_GET_RECIPIENT(ctrl.bmRequestType)) {
++	case UT_DEVICE:
++		if(UGETW(ctrl.wIndex) == 0xF000) { /* OTG Status selector */
++			DWC_PRINTF("wIndex - %d\n", UGETW(ctrl.wIndex));
++			DWC_PRINTF("OTG VERSION - %d\n", core_if->otg_ver);
++			DWC_PRINTF("OTG CAP - %d, %d\n",
++				   core_if->core_params->otg_cap,
++						DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE);
++			if (core_if->otg_ver == 1
++			    && core_if->core_params->otg_cap ==
++			    DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE) {
++				uint8_t *otgsts = (uint8_t*)pcd->status_buf;
++				*otgsts = (core_if->otg_sts & 0x1);
++				pcd->ep0_pending = 1;
++				ep0->dwc_ep.start_xfer_buff =
++				    (uint8_t *) otgsts;
++				ep0->dwc_ep.xfer_buff = (uint8_t *) otgsts;
++				ep0->dwc_ep.dma_addr =
++				    pcd->status_buf_dma_handle;
++				ep0->dwc_ep.xfer_len = 1;
++				ep0->dwc_ep.xfer_count = 0;
++				ep0->dwc_ep.total_len = ep0->dwc_ep.xfer_len;
++				dwc_otg_ep0_start_transfer(GET_CORE_IF(pcd),
++							   &ep0->dwc_ep);
++				return;
++			} else {
++				ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
++				return;
++			}
++			break;
++		} else {
++			*status = 0x1;	/* Self powered */
++			*status |= pcd->remote_wakeup_enable << 1;
++			break;
++		}
++	case UT_INTERFACE:
++		*status = 0;
++		break;
++
++	case UT_ENDPOINT:
++		ep = get_ep_by_addr(pcd, UGETW(ctrl.wIndex));
++		if (ep == 0 || UGETW(ctrl.wLength) > 2) {
++			ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
++			return;
++		}
++		/** @todo check for EP stall */
++		*status = ep->stopped;
++		break;
++	}
++	pcd->ep0_pending = 1;
++	ep0->dwc_ep.start_xfer_buff = (uint8_t *) status;
++	ep0->dwc_ep.xfer_buff = (uint8_t *) status;
++	ep0->dwc_ep.dma_addr = pcd->status_buf_dma_handle;
++	ep0->dwc_ep.xfer_len = 2;
++	ep0->dwc_ep.xfer_count = 0;
++	ep0->dwc_ep.total_len = ep0->dwc_ep.xfer_len;
++	dwc_otg_ep0_start_transfer(GET_CORE_IF(pcd), &ep0->dwc_ep);
++}
++
++/**
++ * This function process the SET_FEATURE Setup Commands.
++ */
++static inline void do_set_feature(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++	usb_device_request_t ctrl = pcd->setup_pkt->req;
++	dwc_otg_pcd_ep_t *ep = 0;
++	int32_t otg_cap_param = core_if->core_params->otg_cap;
++	gotgctl_data_t gotgctl = {.d32 = 0 };
++
++	DWC_DEBUGPL(DBG_PCD, "SET_FEATURE:%02x.%02x v%04x i%04x l%04x\n",
++		    ctrl.bmRequestType, ctrl.bRequest,
++		    UGETW(ctrl.wValue), UGETW(ctrl.wIndex),
++		    UGETW(ctrl.wLength));
++	DWC_DEBUGPL(DBG_PCD, "otg_cap=%d\n", otg_cap_param);
++
++	switch (UT_GET_RECIPIENT(ctrl.bmRequestType)) {
++	case UT_DEVICE:
++		switch (UGETW(ctrl.wValue)) {
++		case UF_DEVICE_REMOTE_WAKEUP:
++			pcd->remote_wakeup_enable = 1;
++			break;
++
++		case UF_TEST_MODE:
++			/* Setup the Test Mode tasklet to do the Test
++			 * Packet generation after the SETUP Status
++			 * phase has completed. */
++
++			/** @todo This has not been tested since the
++			 * tasklet struct was put into the PCD
++			 * struct! */
++			pcd->test_mode = UGETW(ctrl.wIndex) >> 8;
++			DWC_TASK_SCHEDULE(pcd->test_mode_tasklet);
++			break;
++
++		case UF_DEVICE_B_HNP_ENABLE:
++			DWC_DEBUGPL(DBG_PCDV,
++				    "SET_FEATURE: USB_DEVICE_B_HNP_ENABLE\n");
++
++			/* dev may initiate HNP */
++			if (otg_cap_param == DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE) {
++				pcd->b_hnp_enable = 1;
++				dwc_otg_pcd_update_otg(pcd, 0);
++				DWC_DEBUGPL(DBG_PCD, "Request B HNP\n");
++				/**@todo Is the gotgctl.devhnpen cleared
++				 * by a USB Reset? */
++				gotgctl.b.devhnpen = 1;
++				gotgctl.b.hnpreq = 1;
++				DWC_WRITE_REG32(&global_regs->gotgctl,
++						gotgctl.d32);
++			} else {
++				ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
++				return;
++			}
++			break;
++
++		case UF_DEVICE_A_HNP_SUPPORT:
++			/* RH port supports HNP */
++			DWC_DEBUGPL(DBG_PCDV,
++				    "SET_FEATURE: USB_DEVICE_A_HNP_SUPPORT\n");
++			if (otg_cap_param == DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE) {
++				pcd->a_hnp_support = 1;
++				dwc_otg_pcd_update_otg(pcd, 0);
++			} else {
++				ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
++				return;
++			}
++			break;
++
++		case UF_DEVICE_A_ALT_HNP_SUPPORT:
++			/* other RH port does */
++			DWC_DEBUGPL(DBG_PCDV,
++				    "SET_FEATURE: USB_DEVICE_A_ALT_HNP_SUPPORT\n");
++			if (otg_cap_param == DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE) {
++				pcd->a_alt_hnp_support = 1;
++				dwc_otg_pcd_update_otg(pcd, 0);
++			} else {
++				ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
++				return;
++			}
++			break;
++
++		default:
++			ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
++			return;
++
++		}
++		do_setup_in_status_phase(pcd);
++		break;
++
++	case UT_INTERFACE:
++		do_gadget_setup(pcd, &ctrl);
++		break;
++
++	case UT_ENDPOINT:
++		if (UGETW(ctrl.wValue) == UF_ENDPOINT_HALT) {
++			ep = get_ep_by_addr(pcd, UGETW(ctrl.wIndex));
++			if (ep == 0) {
++				ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
++				return;
++			}
++			ep->stopped = 1;
++			dwc_otg_ep_set_stall(core_if, &ep->dwc_ep);
++		}
++		do_setup_in_status_phase(pcd);
++		break;
++	}
++}
++
++/**
++ * This function process the CLEAR_FEATURE Setup Commands.
++ */
++static inline void do_clear_feature(dwc_otg_pcd_t * pcd)
++{
++	usb_device_request_t ctrl = pcd->setup_pkt->req;
++	dwc_otg_pcd_ep_t *ep = 0;
++
++	DWC_DEBUGPL(DBG_PCD,
++		    "CLEAR_FEATURE:%02x.%02x v%04x i%04x l%04x\n",
++		    ctrl.bmRequestType, ctrl.bRequest,
++		    UGETW(ctrl.wValue), UGETW(ctrl.wIndex),
++		    UGETW(ctrl.wLength));
++
++	switch (UT_GET_RECIPIENT(ctrl.bmRequestType)) {
++	case UT_DEVICE:
++		switch (UGETW(ctrl.wValue)) {
++		case UF_DEVICE_REMOTE_WAKEUP:
++			pcd->remote_wakeup_enable = 0;
++			break;
++
++		case UF_TEST_MODE:
++			/** @todo Add CLEAR_FEATURE for TEST modes. */
++			break;
++
++		default:
++			ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
++			return;
++		}
++		do_setup_in_status_phase(pcd);
++		break;
++
++	case UT_ENDPOINT:
++		ep = get_ep_by_addr(pcd, UGETW(ctrl.wIndex));
++		if (ep == 0) {
++			ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
++			return;
++		}
++
++		pcd_clear_halt(pcd, ep);
++
++		break;
++	}
++}
++
++/**
++ * This function process the SET_ADDRESS Setup Commands.
++ */
++static inline void do_set_address(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_dev_if_t *dev_if = GET_CORE_IF(pcd)->dev_if;
++	usb_device_request_t ctrl = pcd->setup_pkt->req;
++
++	if (ctrl.bmRequestType == UT_DEVICE) {
++		dcfg_data_t dcfg = {.d32 = 0 };
++
++#ifdef DEBUG_EP0
++//                      DWC_DEBUGPL(DBG_PCDV, "SET_ADDRESS:%d\n", ctrl.wValue);
++#endif
++		dcfg.b.devaddr = UGETW(ctrl.wValue);
++		DWC_MODIFY_REG32(&dev_if->dev_global_regs->dcfg, 0, dcfg.d32);
++		do_setup_in_status_phase(pcd);
++	}
++}
++
++/**
++ *	This function processes SETUP commands. In Linux, the USB Command
++ *	processing is done in two places - the first being the PCD and the
++ *	second in the Gadget Driver (for example, the File-Backed Storage
++ *	Gadget Driver).
++ *
++ * <table>
++ * <tr><td>Command	</td><td>Driver </td><td>Description</td></tr>
++ *
++ * <tr><td>GET_STATUS </td><td>PCD </td><td>Command is processed as
++ * defined in chapter 9 of the USB 2.0 Specification chapter 9
++ * </td></tr>
++ *
++ * <tr><td>CLEAR_FEATURE </td><td>PCD </td><td>The Device and Endpoint
++ * requests are the ENDPOINT_HALT feature is procesed, all others the
++ * interface requests are ignored.</td></tr>
++ *
++ * <tr><td>SET_FEATURE </td><td>PCD </td><td>The Device and Endpoint
++ * requests are processed by the PCD.  Interface requests are passed
++ * to the Gadget Driver.</td></tr>
++ *
++ * <tr><td>SET_ADDRESS </td><td>PCD </td><td>Program the DCFG reg,
++ * with device address received </td></tr>
++ *
++ * <tr><td>GET_DESCRIPTOR </td><td>Gadget Driver </td><td>Return the
++ * requested descriptor</td></tr>
++ *
++ * <tr><td>SET_DESCRIPTOR </td><td>Gadget Driver </td><td>Optional -
++ * not implemented by any of the existing Gadget Drivers.</td></tr>
++ *
++ * <tr><td>SET_CONFIGURATION </td><td>Gadget Driver </td><td>Disable
++ * all EPs and enable EPs for new configuration.</td></tr>
++ *
++ * <tr><td>GET_CONFIGURATION </td><td>Gadget Driver </td><td>Return
++ * the current configuration</td></tr>
++ *
++ * <tr><td>SET_INTERFACE </td><td>Gadget Driver </td><td>Disable all
++ * EPs and enable EPs for new configuration.</td></tr>
++ *
++ * <tr><td>GET_INTERFACE </td><td>Gadget Driver </td><td>Return the
++ * current interface.</td></tr>
++ *
++ * <tr><td>SYNC_FRAME </td><td>PCD </td><td>Display debug
++ * message.</td></tr>
++ * </table>
++ *
++ * When the SETUP Phase Done interrupt occurs, the PCD SETUP commands are
++ * processed by pcd_setup. Calling the Function Driver's setup function from
++ * pcd_setup processes the gadget SETUP commands.
++ */
++static inline void pcd_setup(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	usb_device_request_t ctrl = pcd->setup_pkt->req;
++	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
++
++	deptsiz0_data_t doeptsize0 = {.d32 = 0 };
++
++#ifdef DWC_UTE_CFI
++	int retval = 0;
++	struct cfi_usb_ctrlrequest cfi_req;
++#endif
++
++	doeptsize0.d32 = DWC_READ_REG32(&dev_if->out_ep_regs[0]->doeptsiz);
++
++	/** In BDMA more then 1 setup packet is not supported till 3.00a */
++	if (core_if->dma_enable && core_if->dma_desc_enable == 0
++	    && (doeptsize0.b.supcnt < 2)
++	    && (core_if->snpsid < OTG_CORE_REV_2_94a)) {
++		DWC_ERROR
++		    ("\n\n-----------	 CANNOT handle > 1 setup packet in DMA mode\n\n");
++	}
++	if ((core_if->snpsid >= OTG_CORE_REV_3_00a)
++	    && (core_if->dma_enable == 1) && (core_if->dma_desc_enable == 0)) {
++		ctrl =
++		    (pcd->setup_pkt +
++		     (3 - doeptsize0.b.supcnt - 1 +
++		      ep0->dwc_ep.stp_rollover))->req;
++	}
++#ifdef DEBUG_EP0
++	DWC_DEBUGPL(DBG_PCD, "SETUP %02x.%02x v%04x i%04x l%04x\n",
++		    ctrl.bmRequestType, ctrl.bRequest,
++		    UGETW(ctrl.wValue), UGETW(ctrl.wIndex),
++		    UGETW(ctrl.wLength));
++#endif
++
++	/* Clean up the request queue */
++	dwc_otg_request_nuke(ep0);
++	ep0->stopped = 0;
++
++	if (ctrl.bmRequestType & UE_DIR_IN) {
++		ep0->dwc_ep.is_in = 1;
++		pcd->ep0state = EP0_IN_DATA_PHASE;
++	} else {
++		ep0->dwc_ep.is_in = 0;
++		pcd->ep0state = EP0_OUT_DATA_PHASE;
++	}
++
++	if (UGETW(ctrl.wLength) == 0) {
++		ep0->dwc_ep.is_in = 1;
++		pcd->ep0state = EP0_IN_STATUS_PHASE;
++	}
++
++	if (UT_GET_TYPE(ctrl.bmRequestType) != UT_STANDARD) {
++
++#ifdef DWC_UTE_CFI
++		DWC_MEMCPY(&cfi_req, &ctrl, sizeof(usb_device_request_t));
++
++		//printk(KERN_ALERT "CFI: req_type=0x%02x; req=0x%02x\n",
++				ctrl.bRequestType, ctrl.bRequest);
++		if (UT_GET_TYPE(cfi_req.bRequestType) == UT_VENDOR) {
++			if (cfi_req.bRequest > 0xB0 && cfi_req.bRequest < 0xBF) {
++				retval = cfi_setup(pcd, &cfi_req);
++				if (retval < 0) {
++					ep0_do_stall(pcd, retval);
++					pcd->ep0_pending = 0;
++					return;
++				}
++
++				/* if need gadget setup then call it and check the retval */
++				if (pcd->cfi->need_gadget_att) {
++					retval =
++					    cfi_gadget_setup(pcd,
++							     &pcd->
++							     cfi->ctrl_req);
++					if (retval < 0) {
++						pcd->ep0_pending = 0;
++						return;
++					}
++				}
++
++				if (pcd->cfi->need_status_in_complete) {
++					do_setup_in_status_phase(pcd);
++				}
++				return;
++			}
++		}
++#endif
++
++		/* handle non-standard (class/vendor) requests in the gadget driver */
++		do_gadget_setup(pcd, &ctrl);
++		return;
++	}
++
++	/** @todo NGS: Handle bad setup packet? */
++
++///////////////////////////////////////////
++//// --- Standard Request handling --- ////
++
++	switch (ctrl.bRequest) {
++	case UR_GET_STATUS:
++		do_get_status(pcd);
++		break;
++
++	case UR_CLEAR_FEATURE:
++		do_clear_feature(pcd);
++		break;
++
++	case UR_SET_FEATURE:
++		do_set_feature(pcd);
++		break;
++
++	case UR_SET_ADDRESS:
++		do_set_address(pcd);
++		break;
++
++	case UR_SET_INTERFACE:
++	case UR_SET_CONFIG:
++//              _pcd->request_config = 1;       /* Configuration changed */
++		do_gadget_setup(pcd, &ctrl);
++		break;
++
++	case UR_SYNCH_FRAME:
++		do_gadget_setup(pcd, &ctrl);
++		break;
++
++	default:
++		/* Call the Gadget Driver's setup functions */
++		do_gadget_setup(pcd, &ctrl);
++		break;
++	}
++}
++
++/**
++ * This function completes the ep0 control transfer.
++ */
++static int32_t ep0_complete_request(dwc_otg_pcd_ep_t * ep)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(ep->pcd);
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	dwc_otg_dev_in_ep_regs_t *in_ep_regs =
++	    dev_if->in_ep_regs[ep->dwc_ep.num];
++#ifdef DEBUG_EP0
++	dwc_otg_dev_out_ep_regs_t *out_ep_regs =
++	    dev_if->out_ep_regs[ep->dwc_ep.num];
++#endif
++	deptsiz0_data_t deptsiz;
++	dev_dma_desc_sts_t desc_sts;
++	dwc_otg_pcd_request_t *req;
++	int is_last = 0;
++	dwc_otg_pcd_t *pcd = ep->pcd;
++
++#ifdef DWC_UTE_CFI
++	struct cfi_usb_ctrlrequest *ctrlreq;
++	int retval = -DWC_E_NOT_SUPPORTED;
++#endif
++
++        desc_sts.b.bytes = 0;
++
++	if (pcd->ep0_pending && DWC_CIRCLEQ_EMPTY(&ep->queue)) {
++		if (ep->dwc_ep.is_in) {
++#ifdef DEBUG_EP0
++			DWC_DEBUGPL(DBG_PCDV, "Do setup OUT status phase\n");
++#endif
++			do_setup_out_status_phase(pcd);
++		} else {
++#ifdef DEBUG_EP0
++			DWC_DEBUGPL(DBG_PCDV, "Do setup IN status phase\n");
++#endif
++
++#ifdef DWC_UTE_CFI
++			ctrlreq = &pcd->cfi->ctrl_req;
++
++			if (UT_GET_TYPE(ctrlreq->bRequestType) == UT_VENDOR) {
++				if (ctrlreq->bRequest > 0xB0
++				    && ctrlreq->bRequest < 0xBF) {
++
++					/* Return if the PCD failed to handle the request */
++					if ((retval =
++					     pcd->cfi->ops.
++					     ctrl_write_complete(pcd->cfi,
++								 pcd)) < 0) {
++						CFI_INFO
++						    ("ERROR setting a new value in the PCD(%d)\n",
++						     retval);
++						ep0_do_stall(pcd, retval);
++						pcd->ep0_pending = 0;
++						return 0;
++					}
++
++					/* If the gadget needs to be notified on the request */
++					if (pcd->cfi->need_gadget_att == 1) {
++						//retval = do_gadget_setup(pcd, &pcd->cfi->ctrl_req);
++						retval =
++						    cfi_gadget_setup(pcd,
++								     &pcd->cfi->
++								     ctrl_req);
++
++						/* Return from the function if the gadget failed to process
++						 * the request properly - this should never happen !!!
++						 */
++						if (retval < 0) {
++							CFI_INFO
++							    ("ERROR setting a new value in the gadget(%d)\n",
++							     retval);
++							pcd->ep0_pending = 0;
++							return 0;
++						}
++					}
++
++					CFI_INFO("%s: RETVAL=%d\n", __func__,
++						 retval);
++					/* If we hit here then the PCD and the gadget has properly
++					 * handled the request - so send the ZLP IN to the host.
++					 */
++					/* @todo: MAS - decide whether we need to start the setup
++					 * stage based on the need_setup value of the cfi object
++					 */
++					do_setup_in_status_phase(pcd);
++					pcd->ep0_pending = 0;
++					return 1;
++				}
++			}
++#endif
++
++			do_setup_in_status_phase(pcd);
++		}
++		pcd->ep0_pending = 0;
++		return 1;
++	}
++
++	if (DWC_CIRCLEQ_EMPTY(&ep->queue)) {
++		return 0;
++	}
++	req = DWC_CIRCLEQ_FIRST(&ep->queue);
++
++	if (pcd->ep0state == EP0_OUT_STATUS_PHASE
++	    || pcd->ep0state == EP0_IN_STATUS_PHASE) {
++		is_last = 1;
++	} else if (ep->dwc_ep.is_in) {
++		deptsiz.d32 = DWC_READ_REG32(&in_ep_regs->dieptsiz);
++		if (core_if->dma_desc_enable != 0)
++			desc_sts = dev_if->in_desc_addr->status;
++#ifdef DEBUG_EP0
++		DWC_DEBUGPL(DBG_PCDV, "%d len=%d  xfersize=%d pktcnt=%d\n",
++			    ep->dwc_ep.num, ep->dwc_ep.xfer_len,
++			    deptsiz.b.xfersize, deptsiz.b.pktcnt);
++#endif
++
++		if (((core_if->dma_desc_enable == 0)
++		     && (deptsiz.b.xfersize == 0))
++		    || ((core_if->dma_desc_enable != 0)
++			&& (desc_sts.b.bytes == 0))) {
++			req->actual = ep->dwc_ep.xfer_count;
++			/* Is a Zero Len Packet needed? */
++			if (req->sent_zlp) {
++#ifdef DEBUG_EP0
++				DWC_DEBUGPL(DBG_PCD, "Setup Rx ZLP\n");
++#endif
++				req->sent_zlp = 0;
++			}
++			do_setup_out_status_phase(pcd);
++		}
++	} else {
++		/* ep0-OUT */
++#ifdef DEBUG_EP0
++		deptsiz.d32 = DWC_READ_REG32(&out_ep_regs->doeptsiz);
++		DWC_DEBUGPL(DBG_PCDV, "%d len=%d xsize=%d pktcnt=%d\n",
++			    ep->dwc_ep.num, ep->dwc_ep.xfer_len,
++			    deptsiz.b.xfersize, deptsiz.b.pktcnt);
++#endif
++		req->actual = ep->dwc_ep.xfer_count;
++
++		/* Is a Zero Len Packet needed? */
++		if (req->sent_zlp) {
++#ifdef DEBUG_EP0
++			DWC_DEBUGPL(DBG_PCDV, "Setup Tx ZLP\n");
++#endif
++			req->sent_zlp = 0;
++		}
++		/* For older cores do setup in status phase in Slave/BDMA modes,
++		 * starting from 3.00 do that only in slave, and for DMA modes
++		 * just re-enable ep 0 OUT here*/
++		if (core_if->dma_enable == 0
++		    || (core_if->dma_desc_enable == 0
++			&& core_if->snpsid <= OTG_CORE_REV_2_94a)) {
++			do_setup_in_status_phase(pcd);
++		} else if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
++			DWC_DEBUGPL(DBG_PCDV,
++				    "Enable out ep before in status phase\n");
++			ep0_out_start(core_if, pcd);
++		}
++	}
++
++	/* Complete the request */
++	if (is_last) {
++		dwc_otg_request_done(ep, req, 0);
++		ep->dwc_ep.start_xfer_buff = 0;
++		ep->dwc_ep.xfer_buff = 0;
++		ep->dwc_ep.xfer_len = 0;
++		return 1;
++	}
++	return 0;
++}
++
++#ifdef DWC_UTE_CFI
++/**
++ * This function calculates traverses all the CFI DMA descriptors and
++ * and accumulates the bytes that are left to be transfered.
++ *
++ * @return The total bytes left to transfered, or a negative value as failure
++ */
++static inline int cfi_calc_desc_residue(dwc_otg_pcd_ep_t * ep)
++{
++	int32_t ret = 0;
++	int i;
++	struct dwc_otg_dma_desc *ddesc = NULL;
++	struct cfi_ep *cfiep;
++
++	/* See if the pcd_ep has its respective cfi_ep mapped */
++	cfiep = get_cfi_ep_by_pcd_ep(ep->pcd->cfi, ep);
++	if (!cfiep) {
++		CFI_INFO("%s: Failed to find ep\n", __func__);
++		return -1;
++	}
++
++	ddesc = ep->dwc_ep.descs;
++
++	for (i = 0; (i < cfiep->desc_count) && (i < MAX_DMA_DESCS_PER_EP); i++) {
++
++#if defined(PRINT_CFI_DMA_DESCS)
++		print_desc(ddesc, ep->ep.name, i);
++#endif
++		ret += ddesc->status.b.bytes;
++		ddesc++;
++	}
++
++	if (ret)
++		CFI_INFO("!!!!!!!!!! WARNING (%s) - residue=%d\n", __func__,
++			 ret);
++
++	return ret;
++}
++#endif
++
++/**
++ * This function completes the request for the EP. If there are
++ * additional requests for the EP in the queue they will be started.
++ */
++static void complete_ep(dwc_otg_pcd_ep_t * ep)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(ep->pcd);
++	struct device *dev = dwc_otg_pcd_to_dev(ep->pcd);
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	dwc_otg_dev_in_ep_regs_t *in_ep_regs =
++	    dev_if->in_ep_regs[ep->dwc_ep.num];
++	deptsiz_data_t deptsiz;
++	dev_dma_desc_sts_t desc_sts;
++	dwc_otg_pcd_request_t *req = 0;
++	dwc_otg_dev_dma_desc_t *dma_desc;
++	uint32_t byte_count = 0;
++	int is_last = 0;
++	int i;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s() %d-%s\n", __func__, ep->dwc_ep.num,
++		    (ep->dwc_ep.is_in ? "IN" : "OUT"));
++
++	/* Get any pending requests */
++	if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
++		req = DWC_CIRCLEQ_FIRST(&ep->queue);
++		if (!req) {
++			DWC_PRINTF("complete_ep 0x%p, req = NULL!\n", ep);
++			return;
++		}
++	} else {
++		DWC_PRINTF("complete_ep 0x%p, ep->queue empty!\n", ep);
++		return;
++	}
++
++	DWC_DEBUGPL(DBG_PCD, "Requests %d\n", ep->pcd->request_pending);
++
++	if (ep->dwc_ep.is_in) {
++		deptsiz.d32 = DWC_READ_REG32(&in_ep_regs->dieptsiz);
++
++		if (core_if->dma_enable) {
++			if (core_if->dma_desc_enable == 0) {
++				if (deptsiz.b.xfersize == 0
++				    && deptsiz.b.pktcnt == 0) {
++					byte_count =
++					    ep->dwc_ep.xfer_len -
++					    ep->dwc_ep.xfer_count;
++
++					ep->dwc_ep.xfer_buff += byte_count;
++					ep->dwc_ep.dma_addr += byte_count;
++					ep->dwc_ep.xfer_count += byte_count;
++
++					DWC_DEBUGPL(DBG_PCDV,
++						    "%d-%s len=%d  xfersize=%d pktcnt=%d\n",
++						    ep->dwc_ep.num,
++						    (ep->dwc_ep.
++						     is_in ? "IN" : "OUT"),
++						    ep->dwc_ep.xfer_len,
++						    deptsiz.b.xfersize,
++						    deptsiz.b.pktcnt);
++
++					if (ep->dwc_ep.xfer_len <
++					    ep->dwc_ep.total_len) {
++						dwc_otg_ep_start_transfer
++						    (core_if, &ep->dwc_ep);
++					} else if (ep->dwc_ep.sent_zlp) {
++						/*
++						 * This fragment of code should initiate 0
++						 * length transfer in case if it is queued
++						 * a transfer with size divisible to EPs max
++						 * packet size and with usb_request zero field
++						 * is set, which means that after data is transfered,
++						 * it is also should be transfered
++						 * a 0 length packet at the end. For Slave and
++						 * Buffer DMA modes in this case SW has
++						 * to initiate 2 transfers one with transfer size,
++						 * and the second with 0 size. For Descriptor
++						 * DMA mode SW is able to initiate a transfer,
++						 * which will handle all the packets including
++						 * the last  0 length.
++						 */
++						ep->dwc_ep.sent_zlp = 0;
++						dwc_otg_ep_start_zl_transfer
++						    (core_if, &ep->dwc_ep);
++					} else {
++						is_last = 1;
++					}
++				} else {
++					if (ep->dwc_ep.type ==
++					    DWC_OTG_EP_TYPE_ISOC) {
++						req->actual = 0;
++						dwc_otg_request_done(ep, req, 0);
++
++						ep->dwc_ep.start_xfer_buff = 0;
++						ep->dwc_ep.xfer_buff = 0;
++						ep->dwc_ep.xfer_len = 0;
++
++						/* If there is a request in the queue start it. */
++						start_next_request(ep);
++					} else
++						DWC_WARN
++						("Incomplete transfer (%d - %s [siz=%d pkt=%d])\n",
++						ep->dwc_ep.num,
++						(ep->dwc_ep.is_in ? "IN" : "OUT"),
++						deptsiz.b.xfersize,
++						deptsiz.b.pktcnt);
++				}
++			} else {
++				dma_desc = ep->dwc_ep.desc_addr;
++				byte_count = 0;
++				ep->dwc_ep.sent_zlp = 0;
++
++#ifdef DWC_UTE_CFI
++				CFI_INFO("%s: BUFFER_MODE=%d\n", __func__,
++					 ep->dwc_ep.buff_mode);
++				if (ep->dwc_ep.buff_mode != BM_STANDARD) {
++					int residue;
++
++					residue = cfi_calc_desc_residue(ep);
++					if (residue < 0)
++						return;
++
++					byte_count = residue;
++				} else {
++#endif
++					for (i = 0; i < ep->dwc_ep.desc_cnt;
++					     ++i) {
++					desc_sts = dma_desc->status;
++					byte_count += desc_sts.b.bytes;
++					dma_desc++;
++				}
++#ifdef DWC_UTE_CFI
++				}
++#endif
++				if (byte_count == 0) {
++					ep->dwc_ep.xfer_count =
++					    ep->dwc_ep.total_len;
++					is_last = 1;
++				} else {
++					DWC_WARN("Incomplete transfer\n");
++				}
++			}
++		} else {
++			if (deptsiz.b.xfersize == 0 && deptsiz.b.pktcnt == 0) {
++				DWC_DEBUGPL(DBG_PCDV,
++					    "%d-%s len=%d  xfersize=%d pktcnt=%d\n",
++					    ep->dwc_ep.num,
++					    ep->dwc_ep.is_in ? "IN" : "OUT",
++					    ep->dwc_ep.xfer_len,
++					    deptsiz.b.xfersize,
++					    deptsiz.b.pktcnt);
++
++				/*      Check if the whole transfer was completed,
++				 *      if no, setup transfer for next portion of data
++				 */
++				if (ep->dwc_ep.xfer_len < ep->dwc_ep.total_len) {
++					dwc_otg_ep_start_transfer(core_if,
++								  &ep->dwc_ep);
++				} else if (ep->dwc_ep.sent_zlp) {
++					/*
++					 * This fragment of code should initiate 0
++					 * length trasfer in case if it is queued
++					 * a trasfer with size divisible to EPs max
++					 * packet size and with usb_request zero field
++					 * is set, which means that after data is transfered,
++					 * it is also should be transfered
++					 * a 0 length packet at the end. For Slave and
++					 * Buffer DMA modes in this case SW has
++					 * to initiate 2 transfers one with transfer size,
++					 * and the second with 0 size. For Desriptor
++					 * DMA mode SW is able to initiate a transfer,
++					 * which will handle all the packets including
++					 * the last  0 legth.
++					 */
++					ep->dwc_ep.sent_zlp = 0;
++					dwc_otg_ep_start_zl_transfer(core_if,
++								     &ep->dwc_ep);
++				} else {
++					is_last = 1;
++				}
++			} else {
++				DWC_WARN
++				    ("Incomplete transfer (%d-%s [siz=%d pkt=%d])\n",
++				     ep->dwc_ep.num,
++				     (ep->dwc_ep.is_in ? "IN" : "OUT"),
++				     deptsiz.b.xfersize, deptsiz.b.pktcnt);
++			}
++		}
++	} else {
++		dwc_otg_dev_out_ep_regs_t *out_ep_regs =
++		    dev_if->out_ep_regs[ep->dwc_ep.num];
++		desc_sts.d32 = 0;
++		if (core_if->dma_enable) {
++			if (core_if->dma_desc_enable) {
++				dma_desc = ep->dwc_ep.desc_addr;
++				byte_count = 0;
++				ep->dwc_ep.sent_zlp = 0;
++
++#ifdef DWC_UTE_CFI
++				CFI_INFO("%s: BUFFER_MODE=%d\n", __func__,
++					 ep->dwc_ep.buff_mode);
++				if (ep->dwc_ep.buff_mode != BM_STANDARD) {
++					int residue;
++					residue = cfi_calc_desc_residue(ep);
++					if (residue < 0)
++						return;
++					byte_count = residue;
++				} else {
++#endif
++
++					for (i = 0; i < ep->dwc_ep.desc_cnt;
++					     ++i) {
++						desc_sts = dma_desc->status;
++						byte_count += desc_sts.b.bytes;
++						dma_desc++;
++					}
++
++#ifdef DWC_UTE_CFI
++				}
++#endif
++				/* Checking for interrupt Out transfers with not
++				 * dword aligned mps sizes
++				 */
++				if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_INTR &&
++							(ep->dwc_ep.maxpacket%4)) {
++					ep->dwc_ep.xfer_count =
++					    ep->dwc_ep.total_len - byte_count;
++					if ((ep->dwc_ep.xfer_len %
++					     ep->dwc_ep.maxpacket)
++					    && (ep->dwc_ep.xfer_len /
++						ep->dwc_ep.maxpacket <
++						MAX_DMA_DESC_CNT))
++						ep->dwc_ep.xfer_len -=
++						    (ep->dwc_ep.desc_cnt -
++						     1) * ep->dwc_ep.maxpacket +
++						    ep->dwc_ep.xfer_len %
++						    ep->dwc_ep.maxpacket;
++					else
++						ep->dwc_ep.xfer_len -=
++						    ep->dwc_ep.desc_cnt *
++						    ep->dwc_ep.maxpacket;
++					if (ep->dwc_ep.xfer_len > 0) {
++						dwc_otg_ep_start_transfer
++						    (core_if, &ep->dwc_ep);
++					} else {
++						is_last = 1;
++					}
++				} else {
++					ep->dwc_ep.xfer_count =
++					    ep->dwc_ep.total_len - byte_count +
++					    ((4 -
++					      (ep->dwc_ep.
++					       total_len & 0x3)) & 0x3);
++					is_last = 1;
++				}
++			} else {
++				deptsiz.d32 = 0;
++				deptsiz.d32 =
++				    DWC_READ_REG32(&out_ep_regs->doeptsiz);
++
++				byte_count = (ep->dwc_ep.xfer_len -
++					      ep->dwc_ep.xfer_count -
++					      deptsiz.b.xfersize);
++				ep->dwc_ep.xfer_buff += byte_count;
++				ep->dwc_ep.dma_addr += byte_count;
++				ep->dwc_ep.xfer_count += byte_count;
++
++				/*      Check if the whole transfer was completed,
++				 *      if no, setup transfer for next portion of data
++				 */
++				if (ep->dwc_ep.xfer_len < ep->dwc_ep.total_len) {
++					dwc_otg_ep_start_transfer(core_if,
++								  &ep->dwc_ep);
++				} else if (ep->dwc_ep.sent_zlp) {
++					/*
++					 * This fragment of code should initiate 0
++					 * length trasfer in case if it is queued
++					 * a trasfer with size divisible to EPs max
++					 * packet size and with usb_request zero field
++					 * is set, which means that after data is transfered,
++					 * it is also should be transfered
++					 * a 0 length packet at the end. For Slave and
++					 * Buffer DMA modes in this case SW has
++					 * to initiate 2 transfers one with transfer size,
++					 * and the second with 0 size. For Desriptor
++					 * DMA mode SW is able to initiate a transfer,
++					 * which will handle all the packets including
++					 * the last  0 legth.
++					 */
++					ep->dwc_ep.sent_zlp = 0;
++					dwc_otg_ep_start_zl_transfer(core_if,
++								     &ep->dwc_ep);
++				} else {
++					is_last = 1;
++				}
++			}
++		} else {
++			/*      Check if the whole transfer was completed,
++			 *      if no, setup transfer for next portion of data
++			 */
++			if (ep->dwc_ep.xfer_len < ep->dwc_ep.total_len) {
++				dwc_otg_ep_start_transfer(core_if, &ep->dwc_ep);
++			} else if (ep->dwc_ep.sent_zlp) {
++				/*
++				 * This fragment of code should initiate 0
++				 * length transfer in case if it is queued
++				 * a transfer with size divisible to EPs max
++				 * packet size and with usb_request zero field
++				 * is set, which means that after data is transfered,
++				 * it is also should be transfered
++				 * a 0 length packet at the end. For Slave and
++				 * Buffer DMA modes in this case SW has
++				 * to initiate 2 transfers one with transfer size,
++				 * and the second with 0 size. For Descriptor
++				 * DMA mode SW is able to initiate a transfer,
++				 * which will handle all the packets including
++				 * the last  0 length.
++				 */
++				ep->dwc_ep.sent_zlp = 0;
++				dwc_otg_ep_start_zl_transfer(core_if,
++							     &ep->dwc_ep);
++			} else {
++				is_last = 1;
++			}
++		}
++
++		DWC_DEBUGPL(DBG_PCDV,
++			    "addr %p,	 %d-%s len=%d cnt=%d xsize=%d pktcnt=%d\n",
++			    &out_ep_regs->doeptsiz, ep->dwc_ep.num,
++			    ep->dwc_ep.is_in ? "IN" : "OUT",
++			    ep->dwc_ep.xfer_len, ep->dwc_ep.xfer_count,
++			    deptsiz.b.xfersize, deptsiz.b.pktcnt);
++	}
++
++	/* Complete the request */
++	if (is_last) {
++#ifdef DWC_UTE_CFI
++		if (ep->dwc_ep.buff_mode != BM_STANDARD) {
++			req->actual = ep->dwc_ep.cfi_req_len - byte_count;
++		} else {
++#endif
++			req->actual = ep->dwc_ep.xfer_count;
++#ifdef DWC_UTE_CFI
++		}
++#endif
++		if (req->dw_align_buf) {
++			if (!ep->dwc_ep.is_in) {
++				dwc_memcpy(req->buf, req->dw_align_buf, req->length);
++			}
++			DWC_DMA_FREE(dev, req->length, req->dw_align_buf,
++				     req->dw_align_buf_dma);
++		}
++
++		dwc_otg_request_done(ep, req, 0);
++
++		ep->dwc_ep.start_xfer_buff = 0;
++		ep->dwc_ep.xfer_buff = 0;
++		ep->dwc_ep.xfer_len = 0;
++
++		/* If there is a request in the queue start it. */
++		start_next_request(ep);
++	}
++}
++
++#ifdef DWC_EN_ISOC
++
++/**
++ * This function BNA interrupt for Isochronous EPs
++ *
++ */
++static void dwc_otg_pcd_handle_iso_bna(dwc_otg_pcd_ep_t * ep)
++{
++	dwc_ep_t *dwc_ep = &ep->dwc_ep;
++	volatile uint32_t *addr;
++	depctl_data_t depctl = {.d32 = 0 };
++	dwc_otg_pcd_t *pcd = ep->pcd;
++	dwc_otg_dev_dma_desc_t *dma_desc;
++	int i;
++
++	dma_desc =
++	    dwc_ep->iso_desc_addr + dwc_ep->desc_cnt * (dwc_ep->proc_buf_num);
++
++	if (dwc_ep->is_in) {
++		dev_dma_desc_sts_t sts = {.d32 = 0 };
++		for (i = 0; i < dwc_ep->desc_cnt; ++i, ++dma_desc) {
++			sts.d32 = dma_desc->status.d32;
++			sts.b_iso_in.bs = BS_HOST_READY;
++			dma_desc->status.d32 = sts.d32;
++		}
++	} else {
++		dev_dma_desc_sts_t sts = {.d32 = 0 };
++		for (i = 0; i < dwc_ep->desc_cnt; ++i, ++dma_desc) {
++			sts.d32 = dma_desc->status.d32;
++			sts.b_iso_out.bs = BS_HOST_READY;
++			dma_desc->status.d32 = sts.d32;
++		}
++	}
++
++	if (dwc_ep->is_in == 0) {
++		addr =
++		    &GET_CORE_IF(pcd)->dev_if->out_ep_regs[dwc_ep->
++							   num]->doepctl;
++	} else {
++		addr =
++		    &GET_CORE_IF(pcd)->dev_if->in_ep_regs[dwc_ep->num]->diepctl;
++	}
++	depctl.b.epena = 1;
++	DWC_MODIFY_REG32(addr, depctl.d32, depctl.d32);
++}
++
++/**
++ * This function sets latest iso packet information(non-PTI mode)
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to start the transfer on.
++ *
++ */
++void set_current_pkt_info(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	deptsiz_data_t deptsiz = {.d32 = 0 };
++	dma_addr_t dma_addr;
++	uint32_t offset;
++
++	if (ep->proc_buf_num)
++		dma_addr = ep->dma_addr1;
++	else
++		dma_addr = ep->dma_addr0;
++
++	if (ep->is_in) {
++		deptsiz.d32 =
++		    DWC_READ_REG32(&core_if->dev_if->
++				   in_ep_regs[ep->num]->dieptsiz);
++		offset = ep->data_per_frame;
++	} else {
++		deptsiz.d32 =
++		    DWC_READ_REG32(&core_if->dev_if->
++				   out_ep_regs[ep->num]->doeptsiz);
++		offset =
++		    ep->data_per_frame +
++		    (0x4 & (0x4 - (ep->data_per_frame & 0x3)));
++	}
++
++	if (!deptsiz.b.xfersize) {
++		ep->pkt_info[ep->cur_pkt].length = ep->data_per_frame;
++		ep->pkt_info[ep->cur_pkt].offset =
++		    ep->cur_pkt_dma_addr - dma_addr;
++		ep->pkt_info[ep->cur_pkt].status = 0;
++	} else {
++		ep->pkt_info[ep->cur_pkt].length = ep->data_per_frame;
++		ep->pkt_info[ep->cur_pkt].offset =
++		    ep->cur_pkt_dma_addr - dma_addr;
++		ep->pkt_info[ep->cur_pkt].status = -DWC_E_NO_DATA;
++	}
++	ep->cur_pkt_addr += offset;
++	ep->cur_pkt_dma_addr += offset;
++	ep->cur_pkt++;
++}
++
++/**
++ * This function sets latest iso packet information(DDMA mode)
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param dwc_ep The EP to start the transfer on.
++ *
++ */
++static void set_ddma_iso_pkts_info(dwc_otg_core_if_t * core_if,
++				   dwc_ep_t * dwc_ep)
++{
++	dwc_otg_dev_dma_desc_t *dma_desc;
++	dev_dma_desc_sts_t sts = {.d32 = 0 };
++	iso_pkt_info_t *iso_packet;
++	uint32_t data_per_desc;
++	uint32_t offset;
++	int i, j;
++
++	iso_packet = dwc_ep->pkt_info;
++
++	/** Reinit closed DMA Descriptors*/
++	/** ISO OUT EP */
++	if (dwc_ep->is_in == 0) {
++		dma_desc =
++		    dwc_ep->iso_desc_addr +
++		    dwc_ep->desc_cnt * dwc_ep->proc_buf_num;
++		offset = 0;
++
++		for (i = 0; i < dwc_ep->desc_cnt - dwc_ep->pkt_per_frm;
++		     i += dwc_ep->pkt_per_frm) {
++			for (j = 0; j < dwc_ep->pkt_per_frm; ++j) {
++				data_per_desc =
++				    ((j + 1) * dwc_ep->maxpacket >
++				     dwc_ep->
++				     data_per_frame) ? dwc_ep->data_per_frame -
++				    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
++				data_per_desc +=
++				    (data_per_desc % 4) ? (4 -
++							   data_per_desc %
++							   4) : 0;
++
++				sts.d32 = dma_desc->status.d32;
++
++				/* Write status in iso_packet_decsriptor  */
++				iso_packet->status =
++				    sts.b_iso_out.rxsts +
++				    (sts.b_iso_out.bs ^ BS_DMA_DONE);
++				if (iso_packet->status) {
++					iso_packet->status = -DWC_E_NO_DATA;
++				}
++
++				/* Received data length */
++				if (!sts.b_iso_out.rxbytes) {
++					iso_packet->length =
++					    data_per_desc -
++					    sts.b_iso_out.rxbytes;
++				} else {
++					iso_packet->length =
++					    data_per_desc -
++					    sts.b_iso_out.rxbytes + (4 -
++								     dwc_ep->data_per_frame
++								     % 4);
++				}
++
++				iso_packet->offset = offset;
++
++				offset += data_per_desc;
++				dma_desc++;
++				iso_packet++;
++			}
++		}
++
++		for (j = 0; j < dwc_ep->pkt_per_frm - 1; ++j) {
++			data_per_desc =
++			    ((j + 1) * dwc_ep->maxpacket >
++			     dwc_ep->data_per_frame) ? dwc_ep->data_per_frame -
++			    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
++			data_per_desc +=
++			    (data_per_desc % 4) ? (4 - data_per_desc % 4) : 0;
++
++			sts.d32 = dma_desc->status.d32;
++
++			/* Write status in iso_packet_decsriptor  */
++			iso_packet->status =
++			    sts.b_iso_out.rxsts +
++			    (sts.b_iso_out.bs ^ BS_DMA_DONE);
++			if (iso_packet->status) {
++				iso_packet->status = -DWC_E_NO_DATA;
++			}
++
++			/* Received data length */
++			iso_packet->length =
++			    dwc_ep->data_per_frame - sts.b_iso_out.rxbytes;
++
++			iso_packet->offset = offset;
++
++			offset += data_per_desc;
++			iso_packet++;
++			dma_desc++;
++		}
++
++		sts.d32 = dma_desc->status.d32;
++
++		/* Write status in iso_packet_decsriptor  */
++		iso_packet->status =
++		    sts.b_iso_out.rxsts + (sts.b_iso_out.bs ^ BS_DMA_DONE);
++		if (iso_packet->status) {
++			iso_packet->status = -DWC_E_NO_DATA;
++		}
++		/* Received data length */
++		if (!sts.b_iso_out.rxbytes) {
++			iso_packet->length =
++			    dwc_ep->data_per_frame - sts.b_iso_out.rxbytes;
++		} else {
++			iso_packet->length =
++			    dwc_ep->data_per_frame - sts.b_iso_out.rxbytes +
++			    (4 - dwc_ep->data_per_frame % 4);
++		}
++
++		iso_packet->offset = offset;
++	} else {
++/** ISO IN EP */
++
++		dma_desc =
++		    dwc_ep->iso_desc_addr +
++		    dwc_ep->desc_cnt * dwc_ep->proc_buf_num;
++
++		for (i = 0; i < dwc_ep->desc_cnt - 1; i++) {
++			sts.d32 = dma_desc->status.d32;
++
++			/* Write status in iso packet descriptor */
++			iso_packet->status =
++			    sts.b_iso_in.txsts +
++			    (sts.b_iso_in.bs ^ BS_DMA_DONE);
++			if (iso_packet->status != 0) {
++				iso_packet->status = -DWC_E_NO_DATA;
++
++			}
++			/* Bytes has been transfered */
++			iso_packet->length =
++			    dwc_ep->data_per_frame - sts.b_iso_in.txbytes;
++
++			dma_desc++;
++			iso_packet++;
++		}
++
++		sts.d32 = dma_desc->status.d32;
++		while (sts.b_iso_in.bs == BS_DMA_BUSY) {
++			sts.d32 = dma_desc->status.d32;
++		}
++
++		/* Write status in iso packet descriptor ??? do be done with ERROR codes */
++		iso_packet->status =
++		    sts.b_iso_in.txsts + (sts.b_iso_in.bs ^ BS_DMA_DONE);
++		if (iso_packet->status != 0) {
++			iso_packet->status = -DWC_E_NO_DATA;
++		}
++
++		/* Bytes has been transfered */
++		iso_packet->length =
++		    dwc_ep->data_per_frame - sts.b_iso_in.txbytes;
++	}
++}
++
++/**
++ * This function reinitialize DMA Descriptors for Isochronous transfer
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param dwc_ep The EP to start the transfer on.
++ *
++ */
++static void reinit_ddma_iso_xfer(dwc_otg_core_if_t * core_if, dwc_ep_t * dwc_ep)
++{
++	int i, j;
++	dwc_otg_dev_dma_desc_t *dma_desc;
++	dma_addr_t dma_ad;
++	volatile uint32_t *addr;
++	dev_dma_desc_sts_t sts = {.d32 = 0 };
++	uint32_t data_per_desc;
++
++	if (dwc_ep->is_in == 0) {
++		addr = &core_if->dev_if->out_ep_regs[dwc_ep->num]->doepctl;
++	} else {
++		addr = &core_if->dev_if->in_ep_regs[dwc_ep->num]->diepctl;
++	}
++
++	if (dwc_ep->proc_buf_num == 0) {
++		/** Buffer 0 descriptors setup */
++		dma_ad = dwc_ep->dma_addr0;
++	} else {
++		/** Buffer 1 descriptors setup */
++		dma_ad = dwc_ep->dma_addr1;
++	}
++
++	/** Reinit closed DMA Descriptors*/
++	/** ISO OUT EP */
++	if (dwc_ep->is_in == 0) {
++		dma_desc =
++		    dwc_ep->iso_desc_addr +
++		    dwc_ep->desc_cnt * dwc_ep->proc_buf_num;
++
++		sts.b_iso_out.bs = BS_HOST_READY;
++		sts.b_iso_out.rxsts = 0;
++		sts.b_iso_out.l = 0;
++		sts.b_iso_out.sp = 0;
++		sts.b_iso_out.ioc = 0;
++		sts.b_iso_out.pid = 0;
++		sts.b_iso_out.framenum = 0;
++
++		for (i = 0; i < dwc_ep->desc_cnt - dwc_ep->pkt_per_frm;
++		     i += dwc_ep->pkt_per_frm) {
++			for (j = 0; j < dwc_ep->pkt_per_frm; ++j) {
++				data_per_desc =
++				    ((j + 1) * dwc_ep->maxpacket >
++				     dwc_ep->
++				     data_per_frame) ? dwc_ep->data_per_frame -
++				    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
++				data_per_desc +=
++				    (data_per_desc % 4) ? (4 -
++							   data_per_desc %
++							   4) : 0;
++				sts.b_iso_out.rxbytes = data_per_desc;
++				dma_desc->buf = dma_ad;
++				dma_desc->status.d32 = sts.d32;
++
++				dma_ad += data_per_desc;
++				dma_desc++;
++			}
++		}
++
++		for (j = 0; j < dwc_ep->pkt_per_frm - 1; ++j) {
++
++			data_per_desc =
++			    ((j + 1) * dwc_ep->maxpacket >
++			     dwc_ep->data_per_frame) ? dwc_ep->data_per_frame -
++			    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
++			data_per_desc +=
++			    (data_per_desc % 4) ? (4 - data_per_desc % 4) : 0;
++			sts.b_iso_out.rxbytes = data_per_desc;
++
++			dma_desc->buf = dma_ad;
++			dma_desc->status.d32 = sts.d32;
++
++			dma_desc++;
++			dma_ad += data_per_desc;
++		}
++
++		sts.b_iso_out.ioc = 1;
++		sts.b_iso_out.l = dwc_ep->proc_buf_num;
++
++		data_per_desc =
++		    ((j + 1) * dwc_ep->maxpacket >
++		     dwc_ep->data_per_frame) ? dwc_ep->data_per_frame -
++		    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
++		data_per_desc +=
++		    (data_per_desc % 4) ? (4 - data_per_desc % 4) : 0;
++		sts.b_iso_out.rxbytes = data_per_desc;
++
++		dma_desc->buf = dma_ad;
++		dma_desc->status.d32 = sts.d32;
++	} else {
++/** ISO IN EP */
++
++		dma_desc =
++		    dwc_ep->iso_desc_addr +
++		    dwc_ep->desc_cnt * dwc_ep->proc_buf_num;
++
++		sts.b_iso_in.bs = BS_HOST_READY;
++		sts.b_iso_in.txsts = 0;
++		sts.b_iso_in.sp = 0;
++		sts.b_iso_in.ioc = 0;
++		sts.b_iso_in.pid = dwc_ep->pkt_per_frm;
++		sts.b_iso_in.framenum = dwc_ep->next_frame;
++		sts.b_iso_in.txbytes = dwc_ep->data_per_frame;
++		sts.b_iso_in.l = 0;
++
++		for (i = 0; i < dwc_ep->desc_cnt - 1; i++) {
++			dma_desc->buf = dma_ad;
++			dma_desc->status.d32 = sts.d32;
++
++			sts.b_iso_in.framenum += dwc_ep->bInterval;
++			dma_ad += dwc_ep->data_per_frame;
++			dma_desc++;
++		}
++
++		sts.b_iso_in.ioc = 1;
++		sts.b_iso_in.l = dwc_ep->proc_buf_num;
++
++		dma_desc->buf = dma_ad;
++		dma_desc->status.d32 = sts.d32;
++
++		dwc_ep->next_frame =
++		    sts.b_iso_in.framenum + dwc_ep->bInterval * 1;
++	}
++	dwc_ep->proc_buf_num = (dwc_ep->proc_buf_num ^ 1) & 0x1;
++}
++
++/**
++ * This function is to handle Iso EP transfer complete interrupt
++ * in case Iso out packet was dropped
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param dwc_ep The EP for wihich transfer complete was asserted
++ *
++ */
++static uint32_t handle_iso_out_pkt_dropped(dwc_otg_core_if_t * core_if,
++					   dwc_ep_t * dwc_ep)
++{
++	uint32_t dma_addr;
++	uint32_t drp_pkt;
++	uint32_t drp_pkt_cnt;
++	deptsiz_data_t deptsiz = {.d32 = 0 };
++	depctl_data_t depctl = {.d32 = 0 };
++	int i;
++
++	deptsiz.d32 =
++	    DWC_READ_REG32(&core_if->dev_if->
++			   out_ep_regs[dwc_ep->num]->doeptsiz);
++
++	drp_pkt = dwc_ep->pkt_cnt - deptsiz.b.pktcnt;
++	drp_pkt_cnt = dwc_ep->pkt_per_frm - (drp_pkt % dwc_ep->pkt_per_frm);
++
++	/* Setting dropped packets status */
++	for (i = 0; i < drp_pkt_cnt; ++i) {
++		dwc_ep->pkt_info[drp_pkt].status = -DWC_E_NO_DATA;
++		drp_pkt++;
++		deptsiz.b.pktcnt--;
++	}
++
++	if (deptsiz.b.pktcnt > 0) {
++		deptsiz.b.xfersize =
++		    dwc_ep->xfer_len - (dwc_ep->pkt_cnt -
++					deptsiz.b.pktcnt) * dwc_ep->maxpacket;
++	} else {
++		deptsiz.b.xfersize = 0;
++		deptsiz.b.pktcnt = 0;
++	}
++
++	DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[dwc_ep->num]->doeptsiz,
++			deptsiz.d32);
++
++	if (deptsiz.b.pktcnt > 0) {
++		if (dwc_ep->proc_buf_num) {
++			dma_addr =
++			    dwc_ep->dma_addr1 + dwc_ep->xfer_len -
++			    deptsiz.b.xfersize;
++		} else {
++			dma_addr =
++			    dwc_ep->dma_addr0 + dwc_ep->xfer_len -
++			    deptsiz.b.xfersize;;
++		}
++
++		DWC_WRITE_REG32(&core_if->dev_if->
++				out_ep_regs[dwc_ep->num]->doepdma, dma_addr);
++
++		/** Re-enable endpoint, clear nak  */
++		depctl.d32 = 0;
++		depctl.b.epena = 1;
++		depctl.b.cnak = 1;
++
++		DWC_MODIFY_REG32(&core_if->dev_if->
++				 out_ep_regs[dwc_ep->num]->doepctl, depctl.d32,
++				 depctl.d32);
++		return 0;
++	} else {
++		return 1;
++	}
++}
++
++/**
++ * This function sets iso packets information(PTI mode)
++ *
++ * @param core_if Programming view of DWC_otg controller.
++ * @param ep The EP to start the transfer on.
++ *
++ */
++static uint32_t set_iso_pkts_info(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
++{
++	int i, j;
++	dma_addr_t dma_ad;
++	iso_pkt_info_t *packet_info = ep->pkt_info;
++	uint32_t offset;
++	uint32_t frame_data;
++	deptsiz_data_t deptsiz;
++
++	if (ep->proc_buf_num == 0) {
++		/** Buffer 0 descriptors setup */
++		dma_ad = ep->dma_addr0;
++	} else {
++		/** Buffer 1 descriptors setup */
++		dma_ad = ep->dma_addr1;
++	}
++
++	if (ep->is_in) {
++		deptsiz.d32 =
++		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
++				   dieptsiz);
++	} else {
++		deptsiz.d32 =
++		    DWC_READ_REG32(&core_if->dev_if->out_ep_regs[ep->num]->
++				   doeptsiz);
++	}
++
++	if (!deptsiz.b.xfersize) {
++		offset = 0;
++		for (i = 0; i < ep->pkt_cnt; i += ep->pkt_per_frm) {
++			frame_data = ep->data_per_frame;
++			for (j = 0; j < ep->pkt_per_frm; ++j) {
++
++				/* Packet status - is not set as initially
++				 * it is set to 0 and if packet was sent
++				 successfully, status field will remain 0*/
++
++				/* Bytes has been transfered */
++				packet_info->length =
++				    (ep->maxpacket <
++				     frame_data) ? ep->maxpacket : frame_data;
++
++				/* Received packet offset */
++				packet_info->offset = offset;
++				offset += packet_info->length;
++				frame_data -= packet_info->length;
++
++				packet_info++;
++			}
++		}
++		return 1;
++	} else {
++		/* This is a workaround for in case of Transfer Complete with
++		 * PktDrpSts interrupts merging - in this case Transfer complete
++		 * interrupt for Isoc Out Endpoint is asserted without PktDrpSts
++		 * set and with DOEPTSIZ register non zero. Investigations showed,
++		 * that this happens when Out packet is dropped, but because of
++		 * interrupts merging during first interrupt handling PktDrpSts
++		 * bit is cleared and for next merged interrupts it is not reset.
++		 * In this case SW hadles the interrupt as if PktDrpSts bit is set.
++		 */
++		if (ep->is_in) {
++			return 1;
++		} else {
++			return handle_iso_out_pkt_dropped(core_if, ep);
++		}
++	}
++}
++
++/**
++ * This function is to handle Iso EP transfer complete interrupt
++ *
++ * @param pcd The PCD
++ * @param ep The EP for which transfer complete was asserted
++ *
++ */
++static void complete_iso_ep(dwc_otg_pcd_t * pcd, dwc_otg_pcd_ep_t * ep)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(ep->pcd);
++	dwc_ep_t *dwc_ep = &ep->dwc_ep;
++	uint8_t is_last = 0;
++
++	if (ep->dwc_ep.next_frame == 0xffffffff) {
++		DWC_WARN("Next frame is not set!\n");
++		return;
++	}
++
++	if (core_if->dma_enable) {
++		if (core_if->dma_desc_enable) {
++			set_ddma_iso_pkts_info(core_if, dwc_ep);
++			reinit_ddma_iso_xfer(core_if, dwc_ep);
++			is_last = 1;
++		} else {
++			if (core_if->pti_enh_enable) {
++				if (set_iso_pkts_info(core_if, dwc_ep)) {
++					dwc_ep->proc_buf_num =
++					    (dwc_ep->proc_buf_num ^ 1) & 0x1;
++					dwc_otg_iso_ep_start_buf_transfer
++					    (core_if, dwc_ep);
++					is_last = 1;
++				}
++			} else {
++				set_current_pkt_info(core_if, dwc_ep);
++				if (dwc_ep->cur_pkt >= dwc_ep->pkt_cnt) {
++					is_last = 1;
++					dwc_ep->cur_pkt = 0;
++					dwc_ep->proc_buf_num =
++					    (dwc_ep->proc_buf_num ^ 1) & 0x1;
++					if (dwc_ep->proc_buf_num) {
++						dwc_ep->cur_pkt_addr =
++						    dwc_ep->xfer_buff1;
++						dwc_ep->cur_pkt_dma_addr =
++						    dwc_ep->dma_addr1;
++					} else {
++						dwc_ep->cur_pkt_addr =
++						    dwc_ep->xfer_buff0;
++						dwc_ep->cur_pkt_dma_addr =
++						    dwc_ep->dma_addr0;
++					}
++
++				}
++				dwc_otg_iso_ep_start_frm_transfer(core_if,
++								  dwc_ep);
++			}
++		}
++	} else {
++		set_current_pkt_info(core_if, dwc_ep);
++		if (dwc_ep->cur_pkt >= dwc_ep->pkt_cnt) {
++			is_last = 1;
++			dwc_ep->cur_pkt = 0;
++			dwc_ep->proc_buf_num = (dwc_ep->proc_buf_num ^ 1) & 0x1;
++			if (dwc_ep->proc_buf_num) {
++				dwc_ep->cur_pkt_addr = dwc_ep->xfer_buff1;
++				dwc_ep->cur_pkt_dma_addr = dwc_ep->dma_addr1;
++			} else {
++				dwc_ep->cur_pkt_addr = dwc_ep->xfer_buff0;
++				dwc_ep->cur_pkt_dma_addr = dwc_ep->dma_addr0;
++			}
++
++		}
++		dwc_otg_iso_ep_start_frm_transfer(core_if, dwc_ep);
++	}
++	if (is_last)
++		dwc_otg_iso_buffer_done(pcd, ep, ep->iso_req_handle);
++}
++#endif /* DWC_EN_ISOC */
++
++/**
++ * This function handle BNA interrupt for Non Isochronous EPs
++ *
++ */
++static void dwc_otg_pcd_handle_noniso_bna(dwc_otg_pcd_ep_t * ep)
++{
++	dwc_ep_t *dwc_ep = &ep->dwc_ep;
++	volatile uint32_t *addr;
++	depctl_data_t depctl = {.d32 = 0 };
++	dwc_otg_pcd_t *pcd = ep->pcd;
++	dwc_otg_dev_dma_desc_t *dma_desc;
++	dev_dma_desc_sts_t sts = {.d32 = 0 };
++	dwc_otg_core_if_t *core_if = ep->pcd->core_if;
++	int i, start;
++
++	if (!dwc_ep->desc_cnt)
++		DWC_WARN("Ep%d %s Descriptor count = %d \n", dwc_ep->num,
++			 (dwc_ep->is_in ? "IN" : "OUT"), dwc_ep->desc_cnt);
++
++	if (core_if->core_params->cont_on_bna && !dwc_ep->is_in
++							&& dwc_ep->type != DWC_OTG_EP_TYPE_CONTROL) {
++		uint32_t doepdma;
++		dwc_otg_dev_out_ep_regs_t *out_regs =
++			core_if->dev_if->out_ep_regs[dwc_ep->num];
++		doepdma = DWC_READ_REG32(&(out_regs->doepdma));
++		start = (doepdma - dwc_ep->dma_desc_addr)/sizeof(dwc_otg_dev_dma_desc_t);
++		dma_desc = &(dwc_ep->desc_addr[start]);
++	} else {
++		start = 0;
++		dma_desc = dwc_ep->desc_addr;
++	}
++
++
++	for (i = start; i < dwc_ep->desc_cnt; ++i, ++dma_desc) {
++		sts.d32 = dma_desc->status.d32;
++		sts.b.bs = BS_HOST_READY;
++		dma_desc->status.d32 = sts.d32;
++	}
++
++	if (dwc_ep->is_in == 0) {
++		addr =
++		    &GET_CORE_IF(pcd)->dev_if->out_ep_regs[dwc_ep->num]->
++		    doepctl;
++	} else {
++		addr =
++		    &GET_CORE_IF(pcd)->dev_if->in_ep_regs[dwc_ep->num]->diepctl;
++	}
++	depctl.b.epena = 1;
++	depctl.b.cnak = 1;
++	DWC_MODIFY_REG32(addr, 0, depctl.d32);
++}
++
++/**
++ * This function handles EP0 Control transfers.
++ *
++ * The state of the control transfers are tracked in
++ * <code>ep0state</code>.
++ */
++static void handle_ep0(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
++	dev_dma_desc_sts_t desc_sts;
++	deptsiz0_data_t deptsiz;
++	uint32_t byte_count;
++
++#ifdef DEBUG_EP0
++	DWC_DEBUGPL(DBG_PCDV, "%s()\n", __func__);
++	print_ep0_state(pcd);
++#endif
++
++//      DWC_PRINTF("HANDLE EP0\n");
++
++	switch (pcd->ep0state) {
++	case EP0_DISCONNECT:
++		break;
++
++	case EP0_IDLE:
++		pcd->request_config = 0;
++
++		pcd_setup(pcd);
++		break;
++
++	case EP0_IN_DATA_PHASE:
++#ifdef DEBUG_EP0
++		DWC_DEBUGPL(DBG_PCD, "DATA_IN EP%d-%s: type=%d, mps=%d\n",
++			    ep0->dwc_ep.num, (ep0->dwc_ep.is_in ? "IN" : "OUT"),
++			    ep0->dwc_ep.type, ep0->dwc_ep.maxpacket);
++#endif
++
++		if (core_if->dma_enable != 0) {
++			/*
++			 * For EP0 we can only program 1 packet at a time so we
++			 * need to do the make calculations after each complete.
++			 * Call write_packet to make the calculations, as in
++			 * slave mode, and use those values to determine if we
++			 * can complete.
++			 */
++			if (core_if->dma_desc_enable == 0) {
++				deptsiz.d32 =
++				    DWC_READ_REG32(&core_if->
++						   dev_if->in_ep_regs[0]->
++						   dieptsiz);
++				byte_count =
++				    ep0->dwc_ep.xfer_len - deptsiz.b.xfersize;
++			} else {
++				desc_sts =
++				    core_if->dev_if->in_desc_addr->status;
++				byte_count =
++				    ep0->dwc_ep.xfer_len - desc_sts.b.bytes;
++			}
++			ep0->dwc_ep.xfer_count += byte_count;
++			ep0->dwc_ep.xfer_buff += byte_count;
++			ep0->dwc_ep.dma_addr += byte_count;
++		}
++		if (ep0->dwc_ep.xfer_count < ep0->dwc_ep.total_len) {
++			dwc_otg_ep0_continue_transfer(GET_CORE_IF(pcd),
++						      &ep0->dwc_ep);
++			DWC_DEBUGPL(DBG_PCD, "CONTINUE TRANSFER\n");
++		} else if (ep0->dwc_ep.sent_zlp) {
++			dwc_otg_ep0_continue_transfer(GET_CORE_IF(pcd),
++						      &ep0->dwc_ep);
++			ep0->dwc_ep.sent_zlp = 0;
++			DWC_DEBUGPL(DBG_PCD, "CONTINUE TRANSFER sent zlp\n");
++		} else {
++			ep0_complete_request(ep0);
++			DWC_DEBUGPL(DBG_PCD, "COMPLETE TRANSFER\n");
++		}
++		break;
++	case EP0_OUT_DATA_PHASE:
++#ifdef DEBUG_EP0
++		DWC_DEBUGPL(DBG_PCD, "DATA_OUT EP%d-%s: type=%d, mps=%d\n",
++			    ep0->dwc_ep.num, (ep0->dwc_ep.is_in ? "IN" : "OUT"),
++			    ep0->dwc_ep.type, ep0->dwc_ep.maxpacket);
++#endif
++		if (core_if->dma_enable != 0) {
++			if (core_if->dma_desc_enable == 0) {
++				deptsiz.d32 =
++				    DWC_READ_REG32(&core_if->
++						   dev_if->out_ep_regs[0]->
++						   doeptsiz);
++				byte_count =
++				    ep0->dwc_ep.maxpacket - deptsiz.b.xfersize;
++			} else {
++				desc_sts =
++				    core_if->dev_if->out_desc_addr->status;
++				byte_count =
++				    ep0->dwc_ep.maxpacket - desc_sts.b.bytes;
++			}
++			ep0->dwc_ep.xfer_count += byte_count;
++			ep0->dwc_ep.xfer_buff += byte_count;
++			ep0->dwc_ep.dma_addr += byte_count;
++		}
++		if (ep0->dwc_ep.xfer_count < ep0->dwc_ep.total_len) {
++			dwc_otg_ep0_continue_transfer(GET_CORE_IF(pcd),
++						      &ep0->dwc_ep);
++			DWC_DEBUGPL(DBG_PCD, "CONTINUE TRANSFER\n");
++		} else if (ep0->dwc_ep.sent_zlp) {
++			dwc_otg_ep0_continue_transfer(GET_CORE_IF(pcd),
++						      &ep0->dwc_ep);
++			ep0->dwc_ep.sent_zlp = 0;
++			DWC_DEBUGPL(DBG_PCD, "CONTINUE TRANSFER sent zlp\n");
++		} else {
++			ep0_complete_request(ep0);
++			DWC_DEBUGPL(DBG_PCD, "COMPLETE TRANSFER\n");
++		}
++		break;
++
++	case EP0_IN_STATUS_PHASE:
++	case EP0_OUT_STATUS_PHASE:
++		DWC_DEBUGPL(DBG_PCD, "CASE: EP0_STATUS\n");
++		ep0_complete_request(ep0);
++		pcd->ep0state = EP0_IDLE;
++		ep0->stopped = 1;
++		ep0->dwc_ep.is_in = 0;	/* OUT for next SETUP */
++
++		/* Prepare for more SETUP Packets */
++		if (core_if->dma_enable) {
++			ep0_out_start(core_if, pcd);
++		}
++		break;
++
++	case EP0_STALL:
++		DWC_ERROR("EP0 STALLed, should not get here pcd_setup()\n");
++		break;
++	}
++#ifdef DEBUG_EP0
++	print_ep0_state(pcd);
++#endif
++}
++
++/**
++ * Restart transfer
++ */
++static void restart_transfer(dwc_otg_pcd_t * pcd, const uint32_t epnum)
++{
++	dwc_otg_core_if_t *core_if;
++	dwc_otg_dev_if_t *dev_if;
++	deptsiz_data_t dieptsiz = {.d32 = 0 };
++	dwc_otg_pcd_ep_t *ep;
++
++	ep = get_in_ep(pcd, epnum);
++
++#ifdef DWC_EN_ISOC
++	if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
++		return;
++	}
++#endif /* DWC_EN_ISOC  */
++
++	core_if = GET_CORE_IF(pcd);
++	dev_if = core_if->dev_if;
++
++	dieptsiz.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dieptsiz);
++
++	DWC_DEBUGPL(DBG_PCD, "xfer_buff=%p xfer_count=%0x xfer_len=%0x"
++		    " stopped=%d\n", ep->dwc_ep.xfer_buff,
++		    ep->dwc_ep.xfer_count, ep->dwc_ep.xfer_len, ep->stopped);
++	/*
++	 * If xfersize is 0 and pktcnt in not 0, resend the last packet.
++	 */
++	if (dieptsiz.b.pktcnt && dieptsiz.b.xfersize == 0 &&
++	    ep->dwc_ep.start_xfer_buff != 0) {
++		if (ep->dwc_ep.total_len <= ep->dwc_ep.maxpacket) {
++			ep->dwc_ep.xfer_count = 0;
++			ep->dwc_ep.xfer_buff = ep->dwc_ep.start_xfer_buff;
++			ep->dwc_ep.xfer_len = ep->dwc_ep.xfer_count;
++		} else {
++			ep->dwc_ep.xfer_count -= ep->dwc_ep.maxpacket;
++			/* convert packet size to dwords. */
++			ep->dwc_ep.xfer_buff -= ep->dwc_ep.maxpacket;
++			ep->dwc_ep.xfer_len = ep->dwc_ep.xfer_count;
++		}
++		ep->stopped = 0;
++		DWC_DEBUGPL(DBG_PCD, "xfer_buff=%p xfer_count=%0x "
++			    "xfer_len=%0x stopped=%d\n",
++			    ep->dwc_ep.xfer_buff,
++			    ep->dwc_ep.xfer_count, ep->dwc_ep.xfer_len,
++			    ep->stopped);
++		if (epnum == 0) {
++			dwc_otg_ep0_start_transfer(core_if, &ep->dwc_ep);
++		} else {
++			dwc_otg_ep_start_transfer(core_if, &ep->dwc_ep);
++		}
++	}
++}
++
++/*
++ * This function create new nextep sequnce based on Learn Queue.
++ *
++ * @param core_if Programming view of DWC_otg controller
++ */
++static void predict_nextep_seq( dwc_otg_core_if_t * core_if)
++{
++	dwc_otg_device_global_regs_t *dev_global_regs =
++	    core_if->dev_if->dev_global_regs;
++	const uint32_t TOKEN_Q_DEPTH = core_if->hwcfg2.b.dev_token_q_depth;
++	/* Number of Token Queue Registers */
++	const int DTKNQ_REG_CNT = (TOKEN_Q_DEPTH + 7) / 8;
++	dtknq1_data_t dtknqr1;
++	uint32_t in_tkn_epnums[4];
++	uint8_t seqnum[MAX_EPS_CHANNELS];
++	uint8_t intkn_seq[1 << 5];
++	grstctl_t resetctl = {.d32 = 0 };
++	uint8_t temp;
++	int ndx = 0;
++	int start = 0;
++	int end = 0;
++	int sort_done = 0;
++	int i = 0;
++	volatile uint32_t *addr = &dev_global_regs->dtknqr1;
++
++
++	DWC_DEBUGPL(DBG_PCD,"dev_token_q_depth=%d\n",TOKEN_Q_DEPTH);
++
++	/* Read the DTKNQ Registers */
++	for (i = 0; i < DTKNQ_REG_CNT; i++) {
++		in_tkn_epnums[i] = DWC_READ_REG32(addr);
++		DWC_DEBUGPL(DBG_PCDV, "DTKNQR%d=0x%08x\n", i + 1,
++			    in_tkn_epnums[i]);
++		if (addr == &dev_global_regs->dvbusdis) {
++			addr = &dev_global_regs->dtknqr3_dthrctl;
++		} else {
++			++addr;
++		}
++
++	}
++
++	/* Copy the DTKNQR1 data to the bit field. */
++	dtknqr1.d32 = in_tkn_epnums[0];
++	if (dtknqr1.b.wrap_bit) {
++		ndx = dtknqr1.b.intknwptr;
++		end = ndx -1;
++		if (end < 0)
++			end = TOKEN_Q_DEPTH -1;
++	} else {
++		ndx = 0;
++		end = dtknqr1.b.intknwptr -1;
++		if (end < 0)
++			end = 0;
++	}
++	start = ndx;
++
++	/* Fill seqnum[] by initial values: EP number + 31 */
++	for (i=0; i <= core_if->dev_if->num_in_eps; i++) {
++		seqnum[i] = i +31;
++	}
++
++	/* Fill intkn_seq[] from in_tkn_epnums[0] */
++	for (i=0; i < 6; i++)
++		intkn_seq[i] = (in_tkn_epnums[0] >> ((7-i) * 4)) & 0xf;
++
++	if (TOKEN_Q_DEPTH > 6) {
++		/* Fill intkn_seq[] from in_tkn_epnums[1] */
++		for (i=6; i < 14; i++)
++			intkn_seq[i] =
++			    (in_tkn_epnums[1] >> ((7 - (i - 6)) * 4)) & 0xf;
++	}
++
++	if (TOKEN_Q_DEPTH > 14) {
++		/* Fill intkn_seq[] from in_tkn_epnums[1] */
++		for (i=14; i < 22; i++)
++			intkn_seq[i] =
++			    (in_tkn_epnums[2] >> ((7 - (i - 14)) * 4)) & 0xf;
++	}
++
++	if (TOKEN_Q_DEPTH > 22) {
++		/* Fill intkn_seq[] from in_tkn_epnums[1] */
++		for (i=22; i < 30; i++)
++			intkn_seq[i] =
++			    (in_tkn_epnums[3] >> ((7 - (i - 22)) * 4)) & 0xf;
++	}
++
++	DWC_DEBUGPL(DBG_PCDV, "%s start=%d end=%d intkn_seq[]:\n", __func__,
++		    start, end);
++	for (i=0; i<TOKEN_Q_DEPTH; i++)
++		DWC_DEBUGPL(DBG_PCDV,"%d\n", intkn_seq[i]);
++
++	/* Update seqnum based on intkn_seq[] */
++	i = 0;
++	do {
++		seqnum[intkn_seq[ndx]] = i;
++		ndx++;
++		i++;
++		if (ndx == TOKEN_Q_DEPTH)
++			ndx = 0;
++	} while ( i < TOKEN_Q_DEPTH );
++
++	/* Mark non active EP's in seqnum[] by 0xff */
++	for (i=0; i<=core_if->dev_if->num_in_eps; i++) {
++		if (core_if->nextep_seq[i] == 0xff )
++			seqnum[i] = 0xff;
++	}
++
++	/* Sort seqnum[] */
++	sort_done = 0;
++	while (!sort_done) {
++		sort_done = 1;
++		for (i=0; i<core_if->dev_if->num_in_eps; i++) {
++			if (seqnum[i] > seqnum[i+1]) {
++				temp = seqnum[i];
++				seqnum[i] = seqnum[i+1];
++				seqnum[i+1] = temp;
++				sort_done = 0;
++			}
++		}
++	}
++
++	ndx = start + seqnum[0];
++	if (ndx >= TOKEN_Q_DEPTH)
++		ndx = ndx % TOKEN_Q_DEPTH;
++	core_if->first_in_nextep_seq = intkn_seq[ndx];
++
++	/* Update seqnum[] by EP numbers  */
++	for (i=0; i<=core_if->dev_if->num_in_eps; i++) {
++		ndx = start + i;
++		if (seqnum[i] < 31) {
++			ndx = start + seqnum[i];
++			if (ndx >= TOKEN_Q_DEPTH)
++				ndx = ndx % TOKEN_Q_DEPTH;
++			seqnum[i] = intkn_seq[ndx];
++		} else {
++			if (seqnum[i] < 0xff) {
++				seqnum[i] = seqnum[i] - 31;
++			} else {
++				break;
++			}
++		}
++	}
++
++	/* Update nextep_seq[] based on seqnum[] */
++	for (i=0; i<core_if->dev_if->num_in_eps; i++) {
++		if (seqnum[i] != 0xff) {
++			if (seqnum[i+1] != 0xff) {
++				core_if->nextep_seq[seqnum[i]] = seqnum[i+1];
++			} else {
++				core_if->nextep_seq[seqnum[i]] = core_if->first_in_nextep_seq;
++				break;
++			}
++		} else {
++			break;
++		}
++	}
++
++	DWC_DEBUGPL(DBG_PCDV, "%s first_in_nextep_seq= %2d; nextep_seq[]:\n",
++		__func__, core_if->first_in_nextep_seq);
++	for (i=0; i <= core_if->dev_if->num_in_eps; i++) {
++		DWC_DEBUGPL(DBG_PCDV,"%2d\n", core_if->nextep_seq[i]);
++	}
++
++	/* Flush the Learning Queue */
++	resetctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->grstctl);
++	resetctl.b.intknqflsh = 1;
++	DWC_WRITE_REG32(&core_if->core_global_regs->grstctl, resetctl.d32);
++
++
++}
++
++/**
++ * handle the IN EP disable interrupt.
++ */
++static inline void handle_in_ep_disable_intr(dwc_otg_pcd_t * pcd,
++					     const uint32_t epnum)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	deptsiz_data_t dieptsiz = {.d32 = 0 };
++	dctl_data_t dctl = {.d32 = 0 };
++	dwc_otg_pcd_ep_t *ep;
++	dwc_ep_t *dwc_ep;
++	gintmsk_data_t gintmsk_data;
++	depctl_data_t depctl;
++	uint32_t diepdma;
++	uint32_t remain_to_transfer = 0;
++	uint8_t i;
++	uint32_t xfer_size;
++
++	ep = get_in_ep(pcd, epnum);
++	dwc_ep = &ep->dwc_ep;
++
++	if (dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
++		dwc_otg_flush_tx_fifo(core_if, dwc_ep->tx_fifo_num);
++		complete_ep(ep);
++		return;
++	}
++
++	DWC_DEBUGPL(DBG_PCD, "diepctl%d=%0x\n", epnum,
++		    DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->diepctl));
++	dieptsiz.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dieptsiz);
++	depctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->diepctl);
++
++	DWC_DEBUGPL(DBG_ANY, "pktcnt=%d size=%d\n",
++		    dieptsiz.b.pktcnt, dieptsiz.b.xfersize);
++
++	if ((core_if->start_predict == 0) || (depctl.b.eptype & 1)) {
++		if (ep->stopped) {
++			if (core_if->en_multiple_tx_fifo)
++				/* Flush the Tx FIFO */
++				dwc_otg_flush_tx_fifo(core_if, dwc_ep->tx_fifo_num);
++			/* Clear the Global IN NP NAK */
++			dctl.d32 = 0;
++			dctl.b.cgnpinnak = 1;
++			DWC_MODIFY_REG32(&dev_if->dev_global_regs->dctl, dctl.d32, dctl.d32);
++			/* Restart the transaction */
++			if (dieptsiz.b.pktcnt != 0 || dieptsiz.b.xfersize != 0) {
++				restart_transfer(pcd, epnum);
++			}
++		} else {
++			/* Restart the transaction */
++			if (dieptsiz.b.pktcnt != 0 || dieptsiz.b.xfersize != 0) {
++				restart_transfer(pcd, epnum);
++			}
++			DWC_DEBUGPL(DBG_ANY, "STOPPED!!!\n");
++		}
++		return;
++	}
++
++	if (core_if->start_predict > 2) {	// NP IN EP
++		core_if->start_predict--;
++		return;
++	}
++
++	core_if->start_predict--;
++
++	if (core_if->start_predict == 1) {	// All NP IN Ep's disabled now
++
++		predict_nextep_seq(core_if);
++
++		/* Update all active IN EP's NextEP field based of nextep_seq[] */
++		for ( i = 0; i <= core_if->dev_if->num_in_eps; i++) {
++			depctl.d32 =
++			    DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
++			if (core_if->nextep_seq[i] != 0xff) {	// Active NP IN EP
++				depctl.b.nextep = core_if->nextep_seq[i];
++				DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepctl, depctl.d32);
++			}
++		}
++		/* Flush Shared NP TxFIFO */
++		dwc_otg_flush_tx_fifo(core_if, 0);
++		/* Rewind buffers */
++		if (!core_if->dma_desc_enable) {
++			i = core_if->first_in_nextep_seq;
++			do {
++				ep = get_in_ep(pcd, i);
++				dieptsiz.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->dieptsiz);
++				xfer_size = ep->dwc_ep.total_len - ep->dwc_ep.xfer_count;
++				if (xfer_size > ep->dwc_ep.maxxfer)
++					xfer_size = ep->dwc_ep.maxxfer;
++				depctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
++				if (dieptsiz.b.pktcnt != 0) {
++					if (xfer_size == 0) {
++						remain_to_transfer = 0;
++					} else {
++						if ((xfer_size % ep->dwc_ep.maxpacket) == 0) {
++							remain_to_transfer =
++								dieptsiz.b.pktcnt * ep->dwc_ep.maxpacket;
++						} else {
++							remain_to_transfer = ((dieptsiz.b.pktcnt -1) * ep->dwc_ep.maxpacket)
++								+ (xfer_size % ep->dwc_ep.maxpacket);
++						}
++					}
++					diepdma = DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepdma);
++					dieptsiz.b.xfersize = remain_to_transfer;
++					DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->dieptsiz, dieptsiz.d32);
++					diepdma = ep->dwc_ep.dma_addr + (xfer_size - remain_to_transfer);
++					DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepdma, diepdma);
++				}
++				i = core_if->nextep_seq[i];
++			} while (i != core_if->first_in_nextep_seq);
++		} else { // dma_desc_enable
++				DWC_PRINTF("%s Learning Queue not supported in DDMA\n", __func__);
++		}
++
++		/* Restart transfers in predicted sequences */
++		i = core_if->first_in_nextep_seq;
++		do {
++			dieptsiz.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->dieptsiz);
++			depctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
++			if (dieptsiz.b.pktcnt != 0) {
++				depctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
++				depctl.b.epena = 1;
++				depctl.b.cnak = 1;
++				DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepctl, depctl.d32);
++			}
++			i = core_if->nextep_seq[i];
++		} while (i != core_if->first_in_nextep_seq);
++
++		/* Clear the global non-periodic IN NAK handshake */
++		dctl.d32 = 0;
++		dctl.b.cgnpinnak = 1;
++		DWC_MODIFY_REG32(&dev_if->dev_global_regs->dctl, dctl.d32, dctl.d32);
++
++		/* Unmask EP Mismatch interrupt */
++		gintmsk_data.d32 = 0;
++		gintmsk_data.b.epmismatch = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, 0, gintmsk_data.d32);
++
++		core_if->start_predict = 0;
++
++	}
++}
++
++/**
++ * Handler for the IN EP timeout handshake interrupt.
++ */
++static inline void handle_in_ep_timeout_intr(dwc_otg_pcd_t * pcd,
++					     const uint32_t epnum)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++
++#ifdef DEBUG
++	deptsiz_data_t dieptsiz = {.d32 = 0 };
++	uint32_t num = 0;
++#endif
++	dctl_data_t dctl = {.d32 = 0 };
++	dwc_otg_pcd_ep_t *ep;
++
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++
++	ep = get_in_ep(pcd, epnum);
++
++	/* Disable the NP Tx Fifo Empty Interrrupt */
++	if (!core_if->dma_enable) {
++		intr_mask.b.nptxfempty = 1;
++		DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk,
++				 intr_mask.d32, 0);
++	}
++	/** @todo NGS Check EP type.
++	 * Implement for Periodic EPs */
++	/*
++	 * Non-periodic EP
++	 */
++	/* Enable the Global IN NAK Effective Interrupt */
++	intr_mask.b.ginnakeff = 1;
++	DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, 0, intr_mask.d32);
++
++	/* Set Global IN NAK */
++	dctl.b.sgnpinnak = 1;
++	DWC_MODIFY_REG32(&dev_if->dev_global_regs->dctl, dctl.d32, dctl.d32);
++
++	ep->stopped = 1;
++
++#ifdef DEBUG
++	dieptsiz.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[num]->dieptsiz);
++	DWC_DEBUGPL(DBG_ANY, "pktcnt=%d size=%d\n",
++		    dieptsiz.b.pktcnt, dieptsiz.b.xfersize);
++#endif
++
++#ifdef DISABLE_PERIODIC_EP
++	/*
++	 * Set the NAK bit for this EP to
++	 * start the disable process.
++	 */
++	diepctl.d32 = 0;
++	diepctl.b.snak = 1;
++	DWC_MODIFY_REG32(&dev_if->in_ep_regs[num]->diepctl, diepctl.d32,
++			 diepctl.d32);
++	ep->disabling = 1;
++	ep->stopped = 1;
++#endif
++}
++
++/**
++ * Handler for the IN EP NAK interrupt.
++ */
++static inline int32_t handle_in_ep_nak_intr(dwc_otg_pcd_t * pcd,
++					    const uint32_t epnum)
++{
++	/** @todo implement ISR */
++	dwc_otg_core_if_t *core_if;
++	diepmsk_data_t intr_mask = {.d32 = 0 };
++
++	DWC_PRINTF("INTERRUPT Handler not implemented for %s\n", "IN EP NAK");
++	core_if = GET_CORE_IF(pcd);
++	intr_mask.b.nak = 1;
++
++	if (core_if->multiproc_int_enable) {
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
++				 diepeachintmsk[epnum], intr_mask.d32, 0);
++	} else {
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->diepmsk,
++				 intr_mask.d32, 0);
++	}
++
++	return 1;
++}
++
++/**
++ * Handler for the OUT EP Babble interrupt.
++ */
++static inline int32_t handle_out_ep_babble_intr(dwc_otg_pcd_t * pcd,
++						const uint32_t epnum)
++{
++	/** @todo implement ISR */
++	dwc_otg_core_if_t *core_if;
++	doepmsk_data_t intr_mask = {.d32 = 0 };
++
++	DWC_PRINTF("INTERRUPT Handler not implemented for %s\n",
++		   "OUT EP Babble");
++	core_if = GET_CORE_IF(pcd);
++	intr_mask.b.babble = 1;
++
++	if (core_if->multiproc_int_enable) {
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
++				 doepeachintmsk[epnum], intr_mask.d32, 0);
++	} else {
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->doepmsk,
++				 intr_mask.d32, 0);
++	}
++
++	return 1;
++}
++
++/**
++ * Handler for the OUT EP NAK interrupt.
++ */
++static inline int32_t handle_out_ep_nak_intr(dwc_otg_pcd_t * pcd,
++					     const uint32_t epnum)
++{
++	/** @todo implement ISR */
++	dwc_otg_core_if_t *core_if;
++	doepmsk_data_t intr_mask = {.d32 = 0 };
++
++	DWC_DEBUGPL(DBG_ANY, "INTERRUPT Handler not implemented for %s\n", "OUT EP NAK");
++	core_if = GET_CORE_IF(pcd);
++	intr_mask.b.nak = 1;
++
++	if (core_if->multiproc_int_enable) {
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
++				 doepeachintmsk[epnum], intr_mask.d32, 0);
++	} else {
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->doepmsk,
++				 intr_mask.d32, 0);
++	}
++
++	return 1;
++}
++
++/**
++ * Handler for the OUT EP NYET interrupt.
++ */
++static inline int32_t handle_out_ep_nyet_intr(dwc_otg_pcd_t * pcd,
++					      const uint32_t epnum)
++{
++	/** @todo implement ISR */
++	dwc_otg_core_if_t *core_if;
++	doepmsk_data_t intr_mask = {.d32 = 0 };
++
++	DWC_PRINTF("INTERRUPT Handler not implemented for %s\n", "OUT EP NYET");
++	core_if = GET_CORE_IF(pcd);
++	intr_mask.b.nyet = 1;
++
++	if (core_if->multiproc_int_enable) {
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
++				 doepeachintmsk[epnum], intr_mask.d32, 0);
++	} else {
++		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->doepmsk,
++				 intr_mask.d32, 0);
++	}
++
++	return 1;
++}
++
++/**
++ * This interrupt indicates that an IN EP has a pending Interrupt.
++ * The sequence for handling the IN EP interrupt is shown below:
++ * -#	Read the Device All Endpoint Interrupt register
++ * -#	Repeat the following for each IN EP interrupt bit set (from
++ *		LSB to MSB).
++ * -#	Read the Device Endpoint Interrupt (DIEPINTn) register
++ * -#	If "Transfer Complete" call the request complete function
++ * -#	If "Endpoint Disabled" complete the EP disable procedure.
++ * -#	If "AHB Error Interrupt" log error
++ * -#	If "Time-out Handshake" log error
++ * -#	If "IN Token Received when TxFIFO Empty" write packet to Tx
++ *		FIFO.
++ * -#	If "IN Token EP Mismatch" (disable, this is handled by EP
++ *		Mismatch Interrupt)
++ */
++static int32_t dwc_otg_pcd_handle_in_ep_intr(dwc_otg_pcd_t * pcd)
++{
++#define CLEAR_IN_EP_INTR(__core_if,__epnum,__intr) \
++do { \
++		diepint_data_t diepint = {.d32=0}; \
++		diepint.b.__intr = 1; \
++		DWC_WRITE_REG32(&__core_if->dev_if->in_ep_regs[__epnum]->diepint, \
++		diepint.d32); \
++} while (0)
++
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
++	diepint_data_t diepint = {.d32 = 0 };
++	depctl_data_t depctl = {.d32 = 0 };
++	uint32_t ep_intr;
++	uint32_t epnum = 0;
++	dwc_otg_pcd_ep_t *ep;
++	dwc_ep_t *dwc_ep;
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, pcd);
++
++	/* Read in the device interrupt bits */
++	ep_intr = dwc_otg_read_dev_all_in_ep_intr(core_if);
++
++	/* Service the Device IN interrupts for each endpoint */
++	while (ep_intr) {
++		if (ep_intr & 0x1) {
++			uint32_t empty_msk;
++			/* Get EP pointer */
++			ep = get_in_ep(pcd, epnum);
++			dwc_ep = &ep->dwc_ep;
++
++			depctl.d32 =
++			    DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->diepctl);
++			empty_msk =
++			    DWC_READ_REG32(&dev_if->
++					   dev_global_regs->dtknqr4_fifoemptymsk);
++
++			DWC_DEBUGPL(DBG_PCDV,
++				    "IN EP INTERRUPT - %d\nepmty_msk - %8x  diepctl - %8x\n",
++				    epnum, empty_msk, depctl.d32);
++
++			DWC_DEBUGPL(DBG_PCD,
++				    "EP%d-%s: type=%d, mps=%d\n",
++				    dwc_ep->num, (dwc_ep->is_in ? "IN" : "OUT"),
++				    dwc_ep->type, dwc_ep->maxpacket);
++
++			diepint.d32 =
++			    dwc_otg_read_dev_in_ep_intr(core_if, dwc_ep);
++
++			DWC_DEBUGPL(DBG_PCDV,
++				    "EP %d Interrupt Register - 0x%x\n", epnum,
++				    diepint.d32);
++			/* Transfer complete */
++			if (diepint.b.xfercompl) {
++				/* Disable the NP Tx FIFO Empty
++				 * Interrupt */
++				if (core_if->en_multiple_tx_fifo == 0) {
++					intr_mask.b.nptxfempty = 1;
++					DWC_MODIFY_REG32
++					    (&core_if->core_global_regs->gintmsk,
++					     intr_mask.d32, 0);
++				} else {
++					/* Disable the Tx FIFO Empty Interrupt for this EP */
++					uint32_t fifoemptymsk =
++					    0x1 << dwc_ep->num;
++					DWC_MODIFY_REG32(&core_if->
++							 dev_if->dev_global_regs->dtknqr4_fifoemptymsk,
++							 fifoemptymsk, 0);
++				}
++				/* Clear the bit in DIEPINTn for this interrupt */
++				CLEAR_IN_EP_INTR(core_if, epnum, xfercompl);
++
++				/* Complete the transfer */
++				if (epnum == 0) {
++					handle_ep0(pcd);
++				}
++#ifdef DWC_EN_ISOC
++				else if (dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
++					if (!ep->stopped)
++						complete_iso_ep(pcd, ep);
++				}
++#endif /* DWC_EN_ISOC */
++#ifdef DWC_UTE_PER_IO
++				else if (dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
++					if (!ep->stopped)
++						complete_xiso_ep(ep);
++				}
++#endif /* DWC_UTE_PER_IO */
++				else {
++					if (dwc_ep->type == DWC_OTG_EP_TYPE_ISOC &&
++							dwc_ep->bInterval > 1) {
++						dwc_ep->frame_num += dwc_ep->bInterval;
++						if (dwc_ep->frame_num > 0x3FFF)
++						{
++							dwc_ep->frm_overrun = 1;
++							dwc_ep->frame_num &= 0x3FFF;
++						} else
++							dwc_ep->frm_overrun = 0;
++					}
++					complete_ep(ep);
++					if(diepint.b.nak)
++						CLEAR_IN_EP_INTR(core_if, epnum, nak);
++				}
++			}
++			/* Endpoint disable      */
++			if (diepint.b.epdisabled) {
++				DWC_DEBUGPL(DBG_ANY, "EP%d IN disabled\n",
++					    epnum);
++				handle_in_ep_disable_intr(pcd, epnum);
++
++				/* Clear the bit in DIEPINTn for this interrupt */
++				CLEAR_IN_EP_INTR(core_if, epnum, epdisabled);
++			}
++			/* AHB Error */
++			if (diepint.b.ahberr) {
++				DWC_ERROR("EP%d IN AHB Error\n", epnum);
++				/* Clear the bit in DIEPINTn for this interrupt */
++				CLEAR_IN_EP_INTR(core_if, epnum, ahberr);
++			}
++			/* TimeOUT Handshake (non-ISOC IN EPs) */
++			if (diepint.b.timeout) {
++				DWC_ERROR("EP%d IN Time-out\n", epnum);
++				handle_in_ep_timeout_intr(pcd, epnum);
++
++				CLEAR_IN_EP_INTR(core_if, epnum, timeout);
++			}
++			/** IN Token received with TxF Empty */
++			if (diepint.b.intktxfemp) {
++				DWC_DEBUGPL(DBG_ANY,
++					    "EP%d IN TKN TxFifo Empty\n",
++					    epnum);
++				if (!ep->stopped && epnum != 0) {
++
++					diepmsk_data_t diepmsk = {.d32 = 0 };
++					diepmsk.b.intktxfemp = 1;
++
++					if (core_if->multiproc_int_enable) {
++						DWC_MODIFY_REG32
++						    (&dev_if->dev_global_regs->diepeachintmsk
++						     [epnum], diepmsk.d32, 0);
++					} else {
++						DWC_MODIFY_REG32
++						    (&dev_if->dev_global_regs->diepmsk,
++						     diepmsk.d32, 0);
++					}
++				} else if (core_if->dma_desc_enable
++					   && epnum == 0
++					   && pcd->ep0state ==
++					   EP0_OUT_STATUS_PHASE) {
++					// EP0 IN set STALL
++					depctl.d32 =
++					    DWC_READ_REG32(&dev_if->in_ep_regs
++							   [epnum]->diepctl);
++
++					/* set the disable and stall bits */
++					if (depctl.b.epena) {
++						depctl.b.epdis = 1;
++					}
++					depctl.b.stall = 1;
++					DWC_WRITE_REG32(&dev_if->in_ep_regs
++							[epnum]->diepctl,
++							depctl.d32);
++				}
++				CLEAR_IN_EP_INTR(core_if, epnum, intktxfemp);
++			}
++			/** IN Token Received with EP mismatch */
++			if (diepint.b.intknepmis) {
++				DWC_DEBUGPL(DBG_ANY,
++					    "EP%d IN TKN EP Mismatch\n", epnum);
++				CLEAR_IN_EP_INTR(core_if, epnum, intknepmis);
++			}
++			/** IN Endpoint NAK Effective */
++			if (diepint.b.inepnakeff) {
++				DWC_DEBUGPL(DBG_ANY,
++					    "EP%d IN EP NAK Effective\n",
++					    epnum);
++				/* Periodic EP */
++				if (ep->disabling) {
++					depctl.d32 = 0;
++					depctl.b.snak = 1;
++					depctl.b.epdis = 1;
++					DWC_MODIFY_REG32(&dev_if->in_ep_regs
++							 [epnum]->diepctl,
++							 depctl.d32,
++							 depctl.d32);
++				}
++				CLEAR_IN_EP_INTR(core_if, epnum, inepnakeff);
++
++			}
++
++			/** IN EP Tx FIFO Empty Intr */
++			if (diepint.b.emptyintr) {
++				DWC_DEBUGPL(DBG_ANY,
++					    "EP%d Tx FIFO Empty Intr \n",
++					    epnum);
++				write_empty_tx_fifo(pcd, epnum);
++
++				CLEAR_IN_EP_INTR(core_if, epnum, emptyintr);
++
++			}
++
++			/** IN EP BNA Intr */
++			if (diepint.b.bna) {
++				CLEAR_IN_EP_INTR(core_if, epnum, bna);
++				if (core_if->dma_desc_enable) {
++#ifdef DWC_EN_ISOC
++					if (dwc_ep->type ==
++					    DWC_OTG_EP_TYPE_ISOC) {
++						/*
++						 * This checking is performed to prevent first "false" BNA
++						 * handling occuring right after reconnect
++						 */
++						if (dwc_ep->next_frame !=
++						    0xffffffff)
++							dwc_otg_pcd_handle_iso_bna(ep);
++					} else
++#endif				/* DWC_EN_ISOC */
++					{
++						dwc_otg_pcd_handle_noniso_bna(ep);
++					}
++				}
++			}
++			/* NAK Interrutp */
++			if (diepint.b.nak) {
++				DWC_DEBUGPL(DBG_ANY, "EP%d IN NAK Interrupt\n",
++					    epnum);
++				if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
++					depctl_data_t depctl;
++					if (ep->dwc_ep.frame_num == 0xFFFFFFFF) {
++						ep->dwc_ep.frame_num = core_if->frame_num;
++						if (ep->dwc_ep.bInterval > 1) {
++							depctl.d32 = 0;
++							depctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->diepctl);
++							if (ep->dwc_ep.frame_num & 0x1) {
++								depctl.b.setd1pid = 1;
++								depctl.b.setd0pid = 0;
++							} else {
++								depctl.b.setd0pid = 1;
++								depctl.b.setd1pid = 0;
++							}
++							DWC_WRITE_REG32(&dev_if->in_ep_regs[epnum]->diepctl, depctl.d32);
++						}
++						start_next_request(ep);
++					}
++					ep->dwc_ep.frame_num += ep->dwc_ep.bInterval;
++					if (dwc_ep->frame_num > 0x3FFF)	{
++						dwc_ep->frm_overrun = 1;
++						dwc_ep->frame_num &= 0x3FFF;
++					} else
++						dwc_ep->frm_overrun = 0;
++				}
++
++				CLEAR_IN_EP_INTR(core_if, epnum, nak);
++			}
++		}
++		epnum++;
++		ep_intr >>= 1;
++	}
++
++	return 1;
++#undef CLEAR_IN_EP_INTR
++}
++
++/**
++ * This interrupt indicates that an OUT EP has a pending Interrupt.
++ * The sequence for handling the OUT EP interrupt is shown below:
++ * -#	Read the Device All Endpoint Interrupt register
++ * -#	Repeat the following for each OUT EP interrupt bit set (from
++ *		LSB to MSB).
++ * -#	Read the Device Endpoint Interrupt (DOEPINTn) register
++ * -#	If "Transfer Complete" call the request complete function
++ * -#	If "Endpoint Disabled" complete the EP disable procedure.
++ * -#	If "AHB Error Interrupt" log error
++ * -#	If "Setup Phase Done" process Setup Packet (See Standard USB
++ *		Command Processing)
++ */
++static int32_t dwc_otg_pcd_handle_out_ep_intr(dwc_otg_pcd_t * pcd)
++{
++#define CLEAR_OUT_EP_INTR(__core_if,__epnum,__intr) \
++do { \
++		doepint_data_t doepint = {.d32=0}; \
++		doepint.b.__intr = 1; \
++		DWC_WRITE_REG32(&__core_if->dev_if->out_ep_regs[__epnum]->doepint, \
++		doepint.d32); \
++} while (0)
++
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	uint32_t ep_intr;
++	doepint_data_t doepint = {.d32 = 0 };
++	uint32_t epnum = 0;
++	dwc_otg_pcd_ep_t *ep;
++	dwc_ep_t *dwc_ep;
++	dctl_data_t dctl = {.d32 = 0 };
++	gintmsk_data_t gintmsk = {.d32 = 0 };
++
++
++	DWC_DEBUGPL(DBG_PCDV, "%s()\n", __func__);
++
++	/* Read in the device interrupt bits */
++	ep_intr = dwc_otg_read_dev_all_out_ep_intr(core_if);
++
++	while (ep_intr) {
++		if (ep_intr & 0x1) {
++			/* Get EP pointer */
++			ep = get_out_ep(pcd, epnum);
++			dwc_ep = &ep->dwc_ep;
++
++#ifdef VERBOSE
++			DWC_DEBUGPL(DBG_PCDV,
++				    "EP%d-%s: type=%d, mps=%d\n",
++				    dwc_ep->num, (dwc_ep->is_in ? "IN" : "OUT"),
++				    dwc_ep->type, dwc_ep->maxpacket);
++#endif
++			doepint.d32 =
++			    dwc_otg_read_dev_out_ep_intr(core_if, dwc_ep);
++			/* Moved this interrupt upper due to core deffect of asserting
++			 * OUT EP 0 xfercompl along with stsphsrcvd in BDMA */
++			if (doepint.b.stsphsercvd) {
++				deptsiz0_data_t deptsiz;
++				CLEAR_OUT_EP_INTR(core_if, epnum, stsphsercvd);
++				deptsiz.d32 =
++				    DWC_READ_REG32(&core_if->dev_if->
++						   out_ep_regs[0]->doeptsiz);
++				if (core_if->snpsid >= OTG_CORE_REV_3_00a
++				    && core_if->dma_enable
++				    && core_if->dma_desc_enable == 0
++				    && doepint.b.xfercompl
++				    && deptsiz.b.xfersize == 24) {
++					CLEAR_OUT_EP_INTR(core_if, epnum,
++							  xfercompl);
++					doepint.b.xfercompl = 0;
++					ep0_out_start(core_if, pcd);
++				}
++				if ((core_if->dma_desc_enable) ||
++				    (core_if->dma_enable
++				     && core_if->snpsid >=
++				     OTG_CORE_REV_3_00a)) {
++					do_setup_in_status_phase(pcd);
++				}
++			}
++			/* Transfer complete */
++			if (doepint.b.xfercompl) {
++
++				if (epnum == 0) {
++					/* Clear the bit in DOEPINTn for this interrupt */
++					CLEAR_OUT_EP_INTR(core_if, epnum, xfercompl);
++					if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
++						DWC_DEBUGPL(DBG_PCDV, "DOEPINT=%x doepint=%x\n",
++							DWC_READ_REG32(&core_if->dev_if->out_ep_regs[0]->doepint),
++							doepint.d32);
++						DWC_DEBUGPL(DBG_PCDV, "DOEPCTL=%x \n",
++							DWC_READ_REG32(&core_if->dev_if->out_ep_regs[0]->doepctl));
++
++						if (core_if->snpsid >= OTG_CORE_REV_3_00a
++							&& core_if->dma_enable == 0) {
++							doepint_data_t doepint;
++							doepint.d32 = DWC_READ_REG32(&core_if->dev_if->
++														out_ep_regs[0]->doepint);
++							if (pcd->ep0state == EP0_IDLE && doepint.b.sr) {
++								CLEAR_OUT_EP_INTR(core_if, epnum, sr);
++								goto exit_xfercompl;
++							}
++						}
++						/* In case of DDMA  look at SR bit to go to the Data Stage */
++						if (core_if->dma_desc_enable) {
++							dev_dma_desc_sts_t status = {.d32 = 0};
++							if (pcd->ep0state == EP0_IDLE) {
++								status.d32 = core_if->dev_if->setup_desc_addr[core_if->
++											dev_if->setup_desc_index]->status.d32;
++								if(pcd->data_terminated) {
++									 pcd->data_terminated = 0;
++									 status.d32 = core_if->dev_if->out_desc_addr->status.d32;
++									 dwc_memcpy(&pcd->setup_pkt->req, pcd->backup_buf, 8);
++								}
++								if (status.b.sr) {
++									if (doepint.b.setup) {
++										DWC_DEBUGPL(DBG_PCDV, "DMA DESC EP0_IDLE SR=1 setup=1\n");
++										/* Already started data stage, clear setup */
++										CLEAR_OUT_EP_INTR(core_if, epnum, setup);
++										doepint.b.setup = 0;
++										handle_ep0(pcd);
++										/* Prepare for more setup packets */
++										if (pcd->ep0state == EP0_IN_STATUS_PHASE ||
++											pcd->ep0state == EP0_IN_DATA_PHASE) {
++											ep0_out_start(core_if, pcd);
++										}
++
++										goto exit_xfercompl;
++									} else {
++										/* Prepare for more setup packets */
++										DWC_DEBUGPL(DBG_PCDV,
++											"EP0_IDLE SR=1 setup=0 new setup comes\n");
++										ep0_out_start(core_if, pcd);
++									}
++								}
++							} else {
++								dwc_otg_pcd_request_t *req;
++								dev_dma_desc_sts_t status = {.d32 = 0};
++								diepint_data_t diepint0;
++								diepint0.d32 = DWC_READ_REG32(&core_if->dev_if->
++															in_ep_regs[0]->diepint);
++
++								if (pcd->ep0state == EP0_STALL || pcd->ep0state == EP0_DISCONNECT) {
++									DWC_ERROR("EP0 is stalled/disconnected\n");
++								}
++
++								/* Clear IN xfercompl if set */
++								if (diepint0.b.xfercompl && (pcd->ep0state == EP0_IN_STATUS_PHASE
++									|| pcd->ep0state == EP0_IN_DATA_PHASE)) {
++									DWC_WRITE_REG32(&core_if->dev_if->
++										in_ep_regs[0]->diepint, diepint0.d32);
++								}
++
++								status.d32 = core_if->dev_if->setup_desc_addr[core_if->
++									dev_if->setup_desc_index]->status.d32;
++
++								if (ep->dwc_ep.xfer_count != ep->dwc_ep.total_len
++									&& (pcd->ep0state == EP0_OUT_DATA_PHASE))
++									status.d32 = core_if->dev_if->out_desc_addr->status.d32;
++								if (pcd->ep0state == EP0_OUT_STATUS_PHASE)
++									status.d32 = core_if->dev_if->
++									out_desc_addr->status.d32;
++
++								if (status.b.sr) {
++									if (DWC_CIRCLEQ_EMPTY(&ep->queue)) {
++										DWC_DEBUGPL(DBG_PCDV, "Request queue empty!!\n");
++									} else {
++										DWC_DEBUGPL(DBG_PCDV, "complete req!!\n");
++										req = DWC_CIRCLEQ_FIRST(&ep->queue);
++										if (ep->dwc_ep.xfer_count != ep->dwc_ep.total_len &&
++											pcd->ep0state == EP0_OUT_DATA_PHASE) {
++												/* Read arrived setup packet from req->buf */
++												dwc_memcpy(&pcd->setup_pkt->req,
++													req->buf + ep->dwc_ep.xfer_count, 8);
++										}
++										req->actual = ep->dwc_ep.xfer_count;
++										dwc_otg_request_done(ep, req, -ECONNRESET);
++										ep->dwc_ep.start_xfer_buff = 0;
++										ep->dwc_ep.xfer_buff = 0;
++										ep->dwc_ep.xfer_len = 0;
++									}
++									pcd->ep0state = EP0_IDLE;
++									if (doepint.b.setup) {
++										DWC_DEBUGPL(DBG_PCDV, "EP0_IDLE SR=1 setup=1\n");
++										/* Data stage started, clear setup */
++										CLEAR_OUT_EP_INTR(core_if, epnum, setup);
++										doepint.b.setup = 0;
++										handle_ep0(pcd);
++										/* Prepare for setup packets if ep0in was enabled*/
++										if (pcd->ep0state == EP0_IN_STATUS_PHASE) {
++											ep0_out_start(core_if, pcd);
++										}
++
++										goto exit_xfercompl;
++									} else {
++										/* Prepare for more setup packets */
++										DWC_DEBUGPL(DBG_PCDV,
++											"EP0_IDLE SR=1 setup=0 new setup comes 2\n");
++										ep0_out_start(core_if, pcd);
++									}
++								}
++							}
++						}
++						if (core_if->snpsid >= OTG_CORE_REV_2_94a && core_if->dma_enable
++							&& core_if->dma_desc_enable == 0) {
++							doepint_data_t doepint_temp = {.d32 = 0};
++							deptsiz0_data_t doeptsize0 = {.d32 = 0 };
++							doepint_temp.d32 = DWC_READ_REG32(&core_if->dev_if->
++															out_ep_regs[ep->dwc_ep.num]->doepint);
++							doeptsize0.d32 = DWC_READ_REG32(&core_if->dev_if->
++															out_ep_regs[ep->dwc_ep.num]->doeptsiz);
++							if (pcd->ep0state == EP0_IDLE) {
++								if (doepint_temp.b.sr) {
++									CLEAR_OUT_EP_INTR(core_if, epnum, sr);
++								}
++									doepint.d32 = DWC_READ_REG32(&core_if->dev_if->
++																	out_ep_regs[0]->doepint);
++									if (doeptsize0.b.supcnt == 3) {
++										DWC_DEBUGPL(DBG_ANY, "Rolling over!!!!!!!\n");
++										ep->dwc_ep.stp_rollover = 1;
++									}
++									if (doepint.b.setup) {
++retry:
++										/* Already started data stage, clear setup */
++										CLEAR_OUT_EP_INTR(core_if, epnum, setup);
++										doepint.b.setup = 0;
++										handle_ep0(pcd);
++										ep->dwc_ep.stp_rollover = 0;
++										/* Prepare for more setup packets */
++										if (pcd->ep0state == EP0_IN_STATUS_PHASE ||
++											pcd->ep0state == EP0_IN_DATA_PHASE) {
++											ep0_out_start(core_if, pcd);
++										}
++										goto exit_xfercompl;
++									} else {
++										/* Prepare for more setup packets */
++										DWC_DEBUGPL(DBG_ANY,
++											"EP0_IDLE SR=1 setup=0 new setup comes\n");
++										doepint.d32 = DWC_READ_REG32(&core_if->dev_if->
++																	out_ep_regs[0]->doepint);
++										if(doepint.b.setup)
++											goto retry;
++										ep0_out_start(core_if, pcd);
++									}
++							} else {
++								dwc_otg_pcd_request_t *req;
++								diepint_data_t diepint0 = {.d32 = 0};
++								doepint_data_t doepint_temp = {.d32 = 0};
++								depctl_data_t diepctl0;
++								diepint0.d32 = DWC_READ_REG32(&core_if->dev_if->
++																in_ep_regs[0]->diepint);
++								diepctl0.d32 = DWC_READ_REG32(&core_if->dev_if->
++																in_ep_regs[0]->diepctl);
++
++								if (pcd->ep0state == EP0_IN_DATA_PHASE
++									|| pcd->ep0state == EP0_IN_STATUS_PHASE) {
++									if (diepint0.b.xfercompl) {
++										DWC_WRITE_REG32(&core_if->dev_if->
++											in_ep_regs[0]->diepint, diepint0.d32);
++									}
++									if (diepctl0.b.epena) {
++										diepint_data_t diepint = {.d32 = 0};
++										diepctl0.b.snak = 1;
++										DWC_WRITE_REG32(&core_if->dev_if->
++														in_ep_regs[0]->diepctl, diepctl0.d32);
++										do {
++											dwc_udelay(10);
++											diepint.d32 = DWC_READ_REG32(&core_if->dev_if->
++												in_ep_regs[0]->diepint);
++										} while (!diepint.b.inepnakeff);
++										diepint.b.inepnakeff = 1;
++										DWC_WRITE_REG32(&core_if->dev_if->
++											in_ep_regs[0]->diepint, diepint.d32);
++										diepctl0.d32 = 0;
++										diepctl0.b.epdis = 1;
++										DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[0]->diepctl,
++														diepctl0.d32);
++										do {
++											dwc_udelay(10);
++											diepint.d32 = DWC_READ_REG32(&core_if->dev_if->
++												in_ep_regs[0]->diepint);
++										} while (!diepint.b.epdisabled);
++										diepint.b.epdisabled = 1;
++										DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[0]->diepint,
++															diepint.d32);
++									}
++								}
++								doepint_temp.d32 = DWC_READ_REG32(&core_if->dev_if->
++																out_ep_regs[ep->dwc_ep.num]->doepint);
++								if (doepint_temp.b.sr) {
++									CLEAR_OUT_EP_INTR(core_if, epnum, sr);
++									if (DWC_CIRCLEQ_EMPTY(&ep->queue)) {
++										DWC_DEBUGPL(DBG_PCDV, "Request queue empty!!\n");
++									} else {
++										DWC_DEBUGPL(DBG_PCDV, "complete req!!\n");
++										req = DWC_CIRCLEQ_FIRST(&ep->queue);
++										if (ep->dwc_ep.xfer_count != ep->dwc_ep.total_len &&
++											pcd->ep0state == EP0_OUT_DATA_PHASE) {
++												/* Read arrived setup packet from req->buf */
++												dwc_memcpy(&pcd->setup_pkt->req,
++													req->buf + ep->dwc_ep.xfer_count, 8);
++										}
++										req->actual = ep->dwc_ep.xfer_count;
++										dwc_otg_request_done(ep, req, -ECONNRESET);
++										ep->dwc_ep.start_xfer_buff = 0;
++										ep->dwc_ep.xfer_buff = 0;
++										ep->dwc_ep.xfer_len = 0;
++									}
++									pcd->ep0state = EP0_IDLE;
++									if (doepint.b.setup) {
++										DWC_DEBUGPL(DBG_PCDV, "EP0_IDLE SR=1 setup=1\n");
++										/* Data stage started, clear setup */
++										CLEAR_OUT_EP_INTR(core_if, epnum, setup);
++										doepint.b.setup = 0;
++										handle_ep0(pcd);
++										/* Prepare for setup packets if ep0in was enabled*/
++										if (pcd->ep0state == EP0_IN_STATUS_PHASE) {
++											ep0_out_start(core_if, pcd);
++										}
++										goto exit_xfercompl;
++									} else {
++										/* Prepare for more setup packets */
++										DWC_DEBUGPL(DBG_PCDV,
++											"EP0_IDLE SR=1 setup=0 new setup comes 2\n");
++										ep0_out_start(core_if, pcd);
++									}
++								}
++							}
++						}
++						if (core_if->dma_enable == 0 || pcd->ep0state != EP0_IDLE)
++							handle_ep0(pcd);
++exit_xfercompl:
++						DWC_DEBUGPL(DBG_PCDV, "DOEPINT=%x doepint=%x\n",
++							dwc_otg_read_dev_out_ep_intr(core_if, dwc_ep), doepint.d32);
++					} else {
++					if (core_if->dma_desc_enable == 0
++					    || pcd->ep0state != EP0_IDLE)
++						handle_ep0(pcd);
++					}
++#ifdef DWC_EN_ISOC
++				} else if (dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
++					if (doepint.b.pktdrpsts == 0) {
++						/* Clear the bit in DOEPINTn for this interrupt */
++						CLEAR_OUT_EP_INTR(core_if,
++								  epnum,
++								  xfercompl);
++						complete_iso_ep(pcd, ep);
++					} else {
++
++						doepint_data_t doepint = {.d32 = 0 };
++						doepint.b.xfercompl = 1;
++						doepint.b.pktdrpsts = 1;
++						DWC_WRITE_REG32
++						    (&core_if->dev_if->out_ep_regs
++						     [epnum]->doepint,
++						     doepint.d32);
++						if (handle_iso_out_pkt_dropped
++						    (core_if, dwc_ep)) {
++							complete_iso_ep(pcd,
++									ep);
++						}
++					}
++#endif /* DWC_EN_ISOC */
++#ifdef DWC_UTE_PER_IO
++				} else if (dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
++					CLEAR_OUT_EP_INTR(core_if, epnum, xfercompl);
++					if (!ep->stopped)
++						complete_xiso_ep(ep);
++#endif /* DWC_UTE_PER_IO */
++				} else {
++					/* Clear the bit in DOEPINTn for this interrupt */
++					CLEAR_OUT_EP_INTR(core_if, epnum,
++							  xfercompl);
++
++					if (core_if->core_params->dev_out_nak) {
++						DWC_TIMER_CANCEL(pcd->core_if->ep_xfer_timer[epnum]);
++						pcd->core_if->ep_xfer_info[epnum].state = 0;
++#ifdef DEBUG
++						print_memory_payload(pcd, dwc_ep);
++#endif
++					}
++					complete_ep(ep);
++				}
++
++			}
++
++			/* Endpoint disable      */
++			if (doepint.b.epdisabled) {
++
++				/* Clear the bit in DOEPINTn for this interrupt */
++				CLEAR_OUT_EP_INTR(core_if, epnum, epdisabled);
++				if (core_if->core_params->dev_out_nak) {
++#ifdef DEBUG
++					print_memory_payload(pcd, dwc_ep);
++#endif
++					/* In case of timeout condition */
++					if (core_if->ep_xfer_info[epnum].state == 2) {
++						dctl.d32 = DWC_READ_REG32(&core_if->dev_if->
++										dev_global_regs->dctl);
++						dctl.b.cgoutnak = 1;
++						DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl,
++																dctl.d32);
++						/* Unmask goutnakeff interrupt which was masked
++						 * during handle nak out interrupt */
++						gintmsk.b.goutnakeff = 1;
++						DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk,
++																0, gintmsk.d32);
++
++						complete_ep(ep);
++					}
++				}
++				if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC)
++				{
++					dctl_data_t dctl;
++					gintmsk_data_t intr_mask = {.d32 = 0};
++					dwc_otg_pcd_request_t *req = 0;
++
++					dctl.d32 = DWC_READ_REG32(&core_if->dev_if->
++						dev_global_regs->dctl);
++					dctl.b.cgoutnak = 1;
++					DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl,
++						dctl.d32);
++
++					intr_mask.d32 = 0;
++					intr_mask.b.incomplisoout = 1;
++
++					/* Get any pending requests */
++					if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
++						req = DWC_CIRCLEQ_FIRST(&ep->queue);
++						if (!req) {
++							DWC_PRINTF("complete_ep 0x%p, req = NULL!\n", ep);
++						} else {
++							dwc_otg_request_done(ep, req, 0);
++							start_next_request(ep);
++						}
++					} else {
++						DWC_PRINTF("complete_ep 0x%p, ep->queue empty!\n", ep);
++					}
++				}
++			}
++			/* AHB Error */
++			if (doepint.b.ahberr) {
++				DWC_ERROR("EP%d OUT AHB Error\n", epnum);
++				DWC_ERROR("EP%d DEPDMA=0x%08x \n",
++					  epnum, core_if->dev_if->out_ep_regs[epnum]->doepdma);
++				CLEAR_OUT_EP_INTR(core_if, epnum, ahberr);
++			}
++			/* Setup Phase Done (contorl EPs) */
++			if (doepint.b.setup) {
++#ifdef DEBUG_EP0
++				DWC_DEBUGPL(DBG_PCD, "EP%d SETUP Done\n", epnum);
++#endif
++				CLEAR_OUT_EP_INTR(core_if, epnum, setup);
++
++				handle_ep0(pcd);
++			}
++
++			/** OUT EP BNA Intr */
++			if (doepint.b.bna) {
++				CLEAR_OUT_EP_INTR(core_if, epnum, bna);
++				if (core_if->dma_desc_enable) {
++#ifdef DWC_EN_ISOC
++					if (dwc_ep->type ==
++					    DWC_OTG_EP_TYPE_ISOC) {
++						/*
++						 * This checking is performed to prevent first "false" BNA
++						 * handling occuring right after reconnect
++						 */
++						if (dwc_ep->next_frame !=
++						    0xffffffff)
++							dwc_otg_pcd_handle_iso_bna(ep);
++					} else
++#endif				/* DWC_EN_ISOC */
++					{
++						dwc_otg_pcd_handle_noniso_bna(ep);
++					}
++				}
++			}
++			/* Babble Interrupt */
++			if (doepint.b.babble) {
++				DWC_DEBUGPL(DBG_ANY, "EP%d OUT Babble\n",
++					    epnum);
++				handle_out_ep_babble_intr(pcd, epnum);
++
++				CLEAR_OUT_EP_INTR(core_if, epnum, babble);
++			}
++			if (doepint.b.outtknepdis) {
++				DWC_DEBUGPL(DBG_ANY, "EP%d OUT Token received when EP is \
++					disabled\n",epnum);
++				if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
++					doepmsk_data_t doepmsk = {.d32 = 0};
++					ep->dwc_ep.frame_num = core_if->frame_num;
++					if (ep->dwc_ep.bInterval > 1) {
++						depctl_data_t depctl;
++						depctl.d32 = DWC_READ_REG32(&core_if->dev_if->
++													out_ep_regs[epnum]->doepctl);
++						if (ep->dwc_ep.frame_num & 0x1) {
++							depctl.b.setd1pid = 1;
++							depctl.b.setd0pid = 0;
++						} else {
++							depctl.b.setd0pid = 1;
++							depctl.b.setd1pid = 0;
++						}
++						DWC_WRITE_REG32(&core_if->dev_if->
++										out_ep_regs[epnum]->doepctl, depctl.d32);
++					}
++					start_next_request(ep);
++					doepmsk.b.outtknepdis = 1;
++					DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->doepmsk,
++								 doepmsk.d32, 0);
++				}
++				CLEAR_OUT_EP_INTR(core_if, epnum, outtknepdis);
++			}
++
++			/* NAK Interrutp */
++			if (doepint.b.nak) {
++				DWC_DEBUGPL(DBG_ANY, "EP%d OUT NAK\n", epnum);
++				handle_out_ep_nak_intr(pcd, epnum);
++
++				CLEAR_OUT_EP_INTR(core_if, epnum, nak);
++			}
++			/* NYET Interrutp */
++			if (doepint.b.nyet) {
++				DWC_DEBUGPL(DBG_ANY, "EP%d OUT NYET\n", epnum);
++				handle_out_ep_nyet_intr(pcd, epnum);
++
++				CLEAR_OUT_EP_INTR(core_if, epnum, nyet);
++			}
++		}
++
++		epnum++;
++		ep_intr >>= 1;
++	}
++
++	return 1;
++
++#undef CLEAR_OUT_EP_INTR
++}
++static int drop_transfer(uint32_t trgt_fr, uint32_t curr_fr, uint8_t frm_overrun)
++{
++	int retval = 0;
++	if(!frm_overrun && curr_fr >= trgt_fr)
++		retval = 1;
++	else if (frm_overrun
++		 && (curr_fr >= trgt_fr && ((curr_fr - trgt_fr) < 0x3FFF / 2)))
++		retval = 1;
++	return retval;
++}
++/**
++ * Incomplete ISO IN Transfer Interrupt.
++ * This interrupt indicates one of the following conditions occurred
++ * while transmitting an ISOC transaction.
++ * - Corrupted IN Token for ISOC EP.
++ * - Packet not complete in FIFO.
++ * The follow actions will be taken:
++ *	-#	Determine the EP
++ *	-#	Set incomplete flag in dwc_ep structure
++ *	-#	Disable EP; when "Endpoint Disabled" interrupt is received
++ *		Flush FIFO
++ */
++static int32_t dwc_otg_pcd_handle_incomplete_isoc_in_intr(dwc_otg_pcd_t * pcd)
++{
++	gintsts_data_t gintsts;
++
++#ifdef DWC_EN_ISOC
++	dwc_otg_dev_if_t *dev_if;
++	deptsiz_data_t deptsiz = {.d32 = 0 };
++	depctl_data_t depctl = {.d32 = 0 };
++	dsts_data_t dsts = {.d32 = 0 };
++	dwc_ep_t *dwc_ep;
++	int i;
++
++	dev_if = GET_CORE_IF(pcd)->dev_if;
++
++	for (i = 1; i <= dev_if->num_in_eps; ++i) {
++		dwc_ep = &pcd->in_ep[i].dwc_ep;
++		if (dwc_ep->active && dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
++			deptsiz.d32 =
++			    DWC_READ_REG32(&dev_if->in_ep_regs[i]->dieptsiz);
++			depctl.d32 =
++			    DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
++
++			if (depctl.b.epdis && deptsiz.d32) {
++				set_current_pkt_info(GET_CORE_IF(pcd), dwc_ep);
++				if (dwc_ep->cur_pkt >= dwc_ep->pkt_cnt) {
++					dwc_ep->cur_pkt = 0;
++					dwc_ep->proc_buf_num =
++					    (dwc_ep->proc_buf_num ^ 1) & 0x1;
++
++					if (dwc_ep->proc_buf_num) {
++						dwc_ep->cur_pkt_addr =
++						    dwc_ep->xfer_buff1;
++						dwc_ep->cur_pkt_dma_addr =
++						    dwc_ep->dma_addr1;
++					} else {
++						dwc_ep->cur_pkt_addr =
++						    dwc_ep->xfer_buff0;
++						dwc_ep->cur_pkt_dma_addr =
++						    dwc_ep->dma_addr0;
++					}
++
++				}
++
++				dsts.d32 =
++				    DWC_READ_REG32(&GET_CORE_IF(pcd)->dev_if->
++						   dev_global_regs->dsts);
++				dwc_ep->next_frame = dsts.b.soffn;
++
++				dwc_otg_iso_ep_start_frm_transfer(GET_CORE_IF
++								  (pcd),
++								  dwc_ep);
++			}
++		}
++	}
++
++#else
++	depctl_data_t depctl = {.d32 = 0 };
++	dwc_ep_t *dwc_ep;
++	dwc_otg_dev_if_t *dev_if;
++	int i;
++	dev_if = GET_CORE_IF(pcd)->dev_if;
++
++	DWC_DEBUGPL(DBG_PCD,"Incomplete ISO IN \n");
++
++	for (i = 1; i <= dev_if->num_in_eps; ++i) {
++		dwc_ep = &pcd->in_ep[i-1].dwc_ep;
++		depctl.d32 =
++			DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
++		if (depctl.b.epena && dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
++			if (drop_transfer(dwc_ep->frame_num, GET_CORE_IF(pcd)->frame_num,
++							dwc_ep->frm_overrun))
++			{
++				depctl.d32 =
++					DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
++				depctl.b.snak = 1;
++				depctl.b.epdis = 1;
++				DWC_MODIFY_REG32(&dev_if->in_ep_regs[i]->diepctl, depctl.d32, depctl.d32);
++			}
++		}
++	}
++
++	/*intr_mask.b.incomplisoin = 1;
++	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
++			 intr_mask.d32, 0);	 */
++#endif				//DWC_EN_ISOC
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.incomplisoin = 1;
++	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
++			gintsts.d32);
++
++	return 1;
++}
++
++/**
++ * Incomplete ISO OUT Transfer Interrupt.
++ *
++ * This interrupt indicates that the core has dropped an ISO OUT
++ * packet. The following conditions can be the cause:
++ * - FIFO Full, the entire packet would not fit in the FIFO.
++ * - CRC Error
++ * - Corrupted Token
++ * The follow actions will be taken:
++ *	-#	Determine the EP
++ *	-#	Set incomplete flag in dwc_ep structure
++ *	-#	Read any data from the FIFO
++ *	-#	Disable EP. When "Endpoint Disabled" interrupt is received
++ *		re-enable EP.
++ */
++static int32_t dwc_otg_pcd_handle_incomplete_isoc_out_intr(dwc_otg_pcd_t * pcd)
++{
++
++	gintsts_data_t gintsts;
++
++#ifdef DWC_EN_ISOC
++	dwc_otg_dev_if_t *dev_if;
++	deptsiz_data_t deptsiz = {.d32 = 0 };
++	depctl_data_t depctl = {.d32 = 0 };
++	dsts_data_t dsts = {.d32 = 0 };
++	dwc_ep_t *dwc_ep;
++	int i;
++
++	dev_if = GET_CORE_IF(pcd)->dev_if;
++
++	for (i = 1; i <= dev_if->num_out_eps; ++i) {
++		dwc_ep = &pcd->in_ep[i].dwc_ep;
++		if (pcd->out_ep[i].dwc_ep.active &&
++		    pcd->out_ep[i].dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
++			deptsiz.d32 =
++			    DWC_READ_REG32(&dev_if->out_ep_regs[i]->doeptsiz);
++			depctl.d32 =
++			    DWC_READ_REG32(&dev_if->out_ep_regs[i]->doepctl);
++
++			if (depctl.b.epdis && deptsiz.d32) {
++				set_current_pkt_info(GET_CORE_IF(pcd),
++						     &pcd->out_ep[i].dwc_ep);
++				if (dwc_ep->cur_pkt >= dwc_ep->pkt_cnt) {
++					dwc_ep->cur_pkt = 0;
++					dwc_ep->proc_buf_num =
++					    (dwc_ep->proc_buf_num ^ 1) & 0x1;
++
++					if (dwc_ep->proc_buf_num) {
++						dwc_ep->cur_pkt_addr =
++						    dwc_ep->xfer_buff1;
++						dwc_ep->cur_pkt_dma_addr =
++						    dwc_ep->dma_addr1;
++					} else {
++						dwc_ep->cur_pkt_addr =
++						    dwc_ep->xfer_buff0;
++						dwc_ep->cur_pkt_dma_addr =
++						    dwc_ep->dma_addr0;
++					}
++
++				}
++
++				dsts.d32 =
++				    DWC_READ_REG32(&GET_CORE_IF(pcd)->dev_if->
++						   dev_global_regs->dsts);
++				dwc_ep->next_frame = dsts.b.soffn;
++
++				dwc_otg_iso_ep_start_frm_transfer(GET_CORE_IF
++								  (pcd),
++								  dwc_ep);
++			}
++		}
++	}
++#else
++	/** @todo implement ISR */
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++	dwc_otg_core_if_t *core_if;
++	deptsiz_data_t deptsiz = {.d32 = 0 };
++	depctl_data_t depctl = {.d32 = 0 };
++	dctl_data_t dctl = {.d32 = 0 };
++	dwc_ep_t *dwc_ep = NULL;
++	int i;
++	core_if = GET_CORE_IF(pcd);
++
++	for (i = 0; i < core_if->dev_if->num_out_eps; ++i) {
++		dwc_ep = &pcd->out_ep[i].dwc_ep;
++		depctl.d32 =
++			DWC_READ_REG32(&core_if->dev_if->out_ep_regs[dwc_ep->num]->doepctl);
++		if (depctl.b.epena && depctl.b.dpid == (core_if->frame_num & 0x1)) {
++			core_if->dev_if->isoc_ep = dwc_ep;
++			deptsiz.d32 =
++					DWC_READ_REG32(&core_if->dev_if->out_ep_regs[dwc_ep->num]->doeptsiz);
++				break;
++		}
++	}
++	dctl.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dctl);
++	gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
++	intr_mask.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
++
++	if (!intr_mask.b.goutnakeff) {
++		/* Unmask it */
++		intr_mask.b.goutnakeff = 1;
++		DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, intr_mask.d32);
++	}
++	if (!gintsts.b.goutnakeff) {
++		dctl.b.sgoutnak = 1;
++	}
++	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32);
++
++	depctl.d32 = DWC_READ_REG32(&core_if->dev_if->out_ep_regs[dwc_ep->num]->doepctl);
++	if (depctl.b.epena) {
++		depctl.b.epdis = 1;
++		depctl.b.snak = 1;
++	}
++	DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[dwc_ep->num]->doepctl, depctl.d32);
++
++	intr_mask.d32 = 0;
++	intr_mask.b.incomplisoout = 1;
++
++#endif /* DWC_EN_ISOC */
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.incomplisoout = 1;
++	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
++			gintsts.d32);
++
++	return 1;
++}
++
++/**
++ * This function handles the Global IN NAK Effective interrupt.
++ *
++ */
++static int32_t dwc_otg_pcd_handle_in_nak_effective(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_dev_if_t *dev_if = GET_CORE_IF(pcd)->dev_if;
++	depctl_data_t diepctl = {.d32 = 0 };
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++	gintsts_data_t gintsts;
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++	int i;
++
++	DWC_DEBUGPL(DBG_PCD, "Global IN NAK Effective\n");
++
++	/* Disable all active IN EPs */
++	for (i = 0; i <= dev_if->num_in_eps; i++) {
++		diepctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
++		if (!(diepctl.b.eptype & 1) && diepctl.b.epena) {
++			if (core_if->start_predict > 0)
++				core_if->start_predict++;
++			diepctl.b.epdis = 1;
++			diepctl.b.snak = 1;
++			DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepctl, diepctl.d32);
++		}
++	}
++
++
++	/* Disable the Global IN NAK Effective Interrupt */
++	intr_mask.b.ginnakeff = 1;
++	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
++			 intr_mask.d32, 0);
++
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.ginnakeff = 1;
++	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
++			gintsts.d32);
++
++	return 1;
++}
++
++/**
++ * OUT NAK Effective.
++ *
++ */
++static int32_t dwc_otg_pcd_handle_out_nak_effective(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_dev_if_t *dev_if = GET_CORE_IF(pcd)->dev_if;
++	gintmsk_data_t intr_mask = {.d32 = 0 };
++	gintsts_data_t gintsts;
++	depctl_data_t doepctl;
++	int i;
++
++	/* Disable the Global OUT NAK Effective Interrupt */
++	intr_mask.b.goutnakeff = 1;
++	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
++		intr_mask.d32, 0);
++
++	/* If DEV OUT NAK enabled*/
++	if (pcd->core_if->core_params->dev_out_nak) {
++		/* Run over all out endpoints to determine the ep number on
++		 * which the timeout has happened
++		 */
++		for (i = 0; i <= dev_if->num_out_eps; i++) {
++			if ( pcd->core_if->ep_xfer_info[i].state == 2 )
++				break;
++		}
++		if (i > dev_if->num_out_eps) {
++			dctl_data_t dctl;
++			dctl.d32 =
++			    DWC_READ_REG32(&dev_if->dev_global_regs->dctl);
++			dctl.b.cgoutnak = 1;
++			DWC_WRITE_REG32(&dev_if->dev_global_regs->dctl,
++				dctl.d32);
++			goto out;
++		}
++
++		/* Disable the endpoint */
++		doepctl.d32 = DWC_READ_REG32(&dev_if->out_ep_regs[i]->doepctl);
++		if (doepctl.b.epena) {
++			doepctl.b.epdis = 1;
++			doepctl.b.snak = 1;
++		}
++		DWC_WRITE_REG32(&dev_if->out_ep_regs[i]->doepctl, doepctl.d32);
++		return 1;
++	}
++	/* We come here from Incomplete ISO OUT handler */
++	if (dev_if->isoc_ep) {
++		dwc_ep_t *dwc_ep = (dwc_ep_t *)dev_if->isoc_ep;
++		uint32_t epnum = dwc_ep->num;
++		doepint_data_t doepint;
++		doepint.d32 =
++		    DWC_READ_REG32(&dev_if->out_ep_regs[dwc_ep->num]->doepint);
++		dev_if->isoc_ep = NULL;
++		doepctl.d32 =
++		    DWC_READ_REG32(&dev_if->out_ep_regs[epnum]->doepctl);
++		DWC_PRINTF("Before disable DOEPCTL = %08x\n", doepctl.d32);
++		if (doepctl.b.epena) {
++			doepctl.b.epdis = 1;
++			doepctl.b.snak = 1;
++		}
++		DWC_WRITE_REG32(&dev_if->out_ep_regs[epnum]->doepctl,
++				doepctl.d32);
++		return 1;
++	} else
++		DWC_PRINTF("INTERRUPT Handler not implemented for %s\n",
++			   "Global OUT NAK Effective\n");
++
++out:
++	/* Clear interrupt */
++	gintsts.d32 = 0;
++	gintsts.b.goutnakeff = 1;
++	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
++			gintsts.d32);
++
++	return 1;
++}
++
++/**
++ * PCD interrupt handler.
++ *
++ * The PCD handles the device interrupts.  Many conditions can cause a
++ * device interrupt. When an interrupt occurs, the device interrupt
++ * service routine determines the cause of the interrupt and
++ * dispatches handling to the appropriate function. These interrupt
++ * handling functions are described below.
++ *
++ * All interrupt registers are processed from LSB to MSB.
++ *
++ */
++int32_t dwc_otg_pcd_handle_intr(dwc_otg_pcd_t * pcd)
++{
++	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
++#ifdef VERBOSE
++	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
++#endif
++	gintsts_data_t gintr_status;
++	int32_t retval = 0;
++
++	/* Exit from ISR if core is hibernated */
++	if (core_if->hibernation_suspend == 1) {
++		return retval;
++	}
++#ifdef VERBOSE
++	DWC_DEBUGPL(DBG_ANY, "%s() gintsts=%08x	 gintmsk=%08x\n",
++		    __func__,
++		    DWC_READ_REG32(&global_regs->gintsts),
++		    DWC_READ_REG32(&global_regs->gintmsk));
++#endif
++
++	if (dwc_otg_is_device_mode(core_if)) {
++		DWC_SPINLOCK(pcd->lock);
++#ifdef VERBOSE
++		DWC_DEBUGPL(DBG_PCDV, "%s() gintsts=%08x  gintmsk=%08x\n",
++			    __func__,
++			    DWC_READ_REG32(&global_regs->gintsts),
++			    DWC_READ_REG32(&global_regs->gintmsk));
++#endif
++
++		gintr_status.d32 = dwc_otg_read_core_intr(core_if);
++
++		DWC_DEBUGPL(DBG_PCDV, "%s: gintsts&gintmsk=%08x\n",
++			    __func__, gintr_status.d32);
++
++		if (gintr_status.b.sofintr) {
++			retval |= dwc_otg_pcd_handle_sof_intr(pcd);
++		}
++		if (gintr_status.b.rxstsqlvl) {
++			retval |=
++			    dwc_otg_pcd_handle_rx_status_q_level_intr(pcd);
++		}
++		if (gintr_status.b.nptxfempty) {
++			retval |= dwc_otg_pcd_handle_np_tx_fifo_empty_intr(pcd);
++		}
++		if (gintr_status.b.goutnakeff) {
++			retval |= dwc_otg_pcd_handle_out_nak_effective(pcd);
++		}
++		if (gintr_status.b.i2cintr) {
++			retval |= dwc_otg_pcd_handle_i2c_intr(pcd);
++		}
++		if (gintr_status.b.erlysuspend) {
++			retval |= dwc_otg_pcd_handle_early_suspend_intr(pcd);
++		}
++		if (gintr_status.b.usbreset) {
++			retval |= dwc_otg_pcd_handle_usb_reset_intr(pcd);
++		}
++		if (gintr_status.b.enumdone) {
++			retval |= dwc_otg_pcd_handle_enum_done_intr(pcd);
++		}
++		if (gintr_status.b.isooutdrop) {
++			retval |=
++			    dwc_otg_pcd_handle_isoc_out_packet_dropped_intr
++			    (pcd);
++		}
++		if (gintr_status.b.eopframe) {
++			retval |=
++			    dwc_otg_pcd_handle_end_periodic_frame_intr(pcd);
++		}
++		if (gintr_status.b.inepint) {
++			if (!core_if->multiproc_int_enable) {
++				retval |= dwc_otg_pcd_handle_in_ep_intr(pcd);
++			}
++		}
++		if (gintr_status.b.outepintr) {
++			if (!core_if->multiproc_int_enable) {
++				retval |= dwc_otg_pcd_handle_out_ep_intr(pcd);
++			}
++		}
++		if (gintr_status.b.epmismatch) {
++			retval |= dwc_otg_pcd_handle_ep_mismatch_intr(pcd);
++		}
++		if (gintr_status.b.fetsusp) {
++			retval |= dwc_otg_pcd_handle_ep_fetsusp_intr(pcd);
++		}
++		if (gintr_status.b.ginnakeff) {
++			retval |= dwc_otg_pcd_handle_in_nak_effective(pcd);
++		}
++		if (gintr_status.b.incomplisoin) {
++			retval |=
++			    dwc_otg_pcd_handle_incomplete_isoc_in_intr(pcd);
++		}
++		if (gintr_status.b.incomplisoout) {
++			retval |=
++			    dwc_otg_pcd_handle_incomplete_isoc_out_intr(pcd);
++		}
++
++		/* In MPI mode Device Endpoints interrupts are asserted
++		 * without setting outepintr and inepint bits set, so these
++		 * Interrupt handlers are called without checking these bit-fields
++		 */
++		if (core_if->multiproc_int_enable) {
++			retval |= dwc_otg_pcd_handle_in_ep_intr(pcd);
++			retval |= dwc_otg_pcd_handle_out_ep_intr(pcd);
++		}
++#ifdef VERBOSE
++		DWC_DEBUGPL(DBG_PCDV, "%s() gintsts=%0x\n", __func__,
++			    DWC_READ_REG32(&global_regs->gintsts));
++#endif
++		DWC_SPINUNLOCK(pcd->lock);
++	}
++	return retval;
++}
++
++#endif /* DWC_HOST_ONLY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_pcd_linux.c
+@@ -0,0 +1,1262 @@
++ /* ==========================================================================
++  * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_pcd_linux.c $
++  * $Revision: #21 $
++  * $Date: 2012/08/10 $
++  * $Change: 2047372 $
++  *
++  * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++  * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++  * otherwise expressly agreed to in writing between Synopsys and you.
++  *
++  * The Software IS NOT an item of Licensed Software or Licensed Product under
++  * any End User Software License Agreement or Agreement for Licensed Product
++  * with Synopsys or any supplement thereto. You are permitted to use and
++  * redistribute this Software in source and binary forms, with or without
++  * modification, provided that redistributions of source code must retain this
++  * notice. You may not view, use, disclose, copy or distribute this file or
++  * any information contained herein except pursuant to this license grant from
++  * Synopsys. If you do not agree with this notice, including the disclaimer
++  * below, then you are not authorized to use the Software.
++  *
++  * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++  * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++  * DAMAGE.
++  * ========================================================================== */
++#ifndef DWC_HOST_ONLY
++
++/** @file
++ * This file implements the Peripheral Controller Driver.
++ *
++ * The Peripheral Controller Driver (PCD) is responsible for
++ * translating requests from the Function Driver into the appropriate
++ * actions on the DWC_otg controller. It isolates the Function Driver
++ * from the specifics of the controller by providing an API to the
++ * Function Driver.
++ *
++ * The Peripheral Controller Driver for Linux will implement the
++ * Gadget API, so that the existing Gadget drivers can be used.
++ * (Gadget Driver is the Linux terminology for a Function Driver.)
++ *
++ * The Linux Gadget API is defined in the header file
++ * <code><linux/usb_gadget.h></code>.  The USB EP operations API is
++ * defined in the structure <code>usb_ep_ops</code> and the USB
++ * Controller API is defined in the structure
++ * <code>usb_gadget_ops</code>.
++ *
++ */
++
++#include "dwc_otg_os_dep.h"
++#include "dwc_otg_pcd_if.h"
++#include "dwc_otg_pcd.h"
++#include "dwc_otg_driver.h"
++#include "dwc_otg_dbg.h"
++
++extern bool fiq_enable;
++
++static struct gadget_wrapper {
++	dwc_otg_pcd_t *pcd;
++
++	struct usb_gadget gadget;
++	struct usb_gadget_driver *driver;
++
++	struct usb_ep ep0;
++	struct usb_ep in_ep[16];
++	struct usb_ep out_ep[16];
++
++} *gadget_wrapper;
++
++/* Display the contents of the buffer */
++extern void dump_msg(const u8 * buf, unsigned int length);
++/**
++ * Get the dwc_otg_pcd_ep_t* from usb_ep* pointer - NULL in case
++ * if the endpoint is not found
++ */
++static struct dwc_otg_pcd_ep *ep_from_handle(dwc_otg_pcd_t * pcd, void *handle)
++{
++	int i;
++	if (pcd->ep0.priv == handle) {
++		return &pcd->ep0;
++	}
++
++	for (i = 0; i < MAX_EPS_CHANNELS - 1; i++) {
++		if (pcd->in_ep[i].priv == handle)
++			return &pcd->in_ep[i];
++		if (pcd->out_ep[i].priv == handle)
++			return &pcd->out_ep[i];
++	}
++
++	return NULL;
++}
++
++/* USB Endpoint Operations */
++/*
++ * The following sections briefly describe the behavior of the Gadget
++ * API endpoint operations implemented in the DWC_otg driver
++ * software. Detailed descriptions of the generic behavior of each of
++ * these functions can be found in the Linux header file
++ * include/linux/usb_gadget.h.
++ *
++ * The Gadget API provides wrapper functions for each of the function
++ * pointers defined in usb_ep_ops. The Gadget Driver calls the wrapper
++ * function, which then calls the underlying PCD function. The
++ * following sections are named according to the wrapper
++ * functions. Within each section, the corresponding DWC_otg PCD
++ * function name is specified.
++ *
++ */
++
++/**
++ * This function is called by the Gadget Driver for each EP to be
++ * configured for the current configuration (SET_CONFIGURATION).
++ *
++ * This function initializes the dwc_otg_ep_t data structure, and then
++ * calls dwc_otg_ep_activate.
++ */
++static int ep_enable(struct usb_ep *usb_ep,
++		     const struct usb_endpoint_descriptor *ep_desc)
++{
++	int retval;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%p)\n", __func__, usb_ep, ep_desc);
++
++	if (!usb_ep || !ep_desc || ep_desc->bDescriptorType != USB_DT_ENDPOINT) {
++		DWC_WARN("%s, bad ep or descriptor\n", __func__);
++		return -EINVAL;
++	}
++	if (usb_ep == &gadget_wrapper->ep0) {
++		DWC_WARN("%s, bad ep(0)\n", __func__);
++		return -EINVAL;
++	}
++
++	/* Check FIFO size? */
++	if (!ep_desc->wMaxPacketSize) {
++		DWC_WARN("%s, bad %s maxpacket\n", __func__, usb_ep->name);
++		return -ERANGE;
++	}
++
++	if (!gadget_wrapper->driver ||
++	    gadget_wrapper->gadget.speed == USB_SPEED_UNKNOWN) {
++		DWC_WARN("%s, bogus device state\n", __func__);
++		return -ESHUTDOWN;
++	}
++
++	/* Delete after check - MAS */
++#if 0
++	nat = (uint32_t) ep_desc->wMaxPacketSize;
++	printk(KERN_ALERT "%s: nat (before) =%d\n", __func__, nat);
++	nat = (nat >> 11) & 0x03;
++	printk(KERN_ALERT "%s: nat (after) =%d\n", __func__, nat);
++#endif
++	retval = dwc_otg_pcd_ep_enable(gadget_wrapper->pcd,
++				       (const uint8_t *)ep_desc,
++				       (void *)usb_ep);
++	if (retval) {
++		DWC_WARN("dwc_otg_pcd_ep_enable failed\n");
++		return -EINVAL;
++	}
++
++	usb_ep->maxpacket = le16_to_cpu(ep_desc->wMaxPacketSize);
++
++	return 0;
++}
++
++/**
++ * This function is called when an EP is disabled due to disconnect or
++ * change in configuration. Any pending requests will terminate with a
++ * status of -ESHUTDOWN.
++ *
++ * This function modifies the dwc_otg_ep_t data structure for this EP,
++ * and then calls dwc_otg_ep_deactivate.
++ */
++static int ep_disable(struct usb_ep *usb_ep)
++{
++	int retval;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, usb_ep);
++	if (!usb_ep) {
++		DWC_DEBUGPL(DBG_PCD, "%s, %s not enabled\n", __func__,
++			    usb_ep ? usb_ep->name : NULL);
++		return -EINVAL;
++	}
++
++	retval = dwc_otg_pcd_ep_disable(gadget_wrapper->pcd, usb_ep);
++	if (retval) {
++		retval = -EINVAL;
++	}
++
++	return retval;
++}
++
++/**
++ * This function allocates a request object to use with the specified
++ * endpoint.
++ *
++ * @param ep The endpoint to be used with with the request
++ * @param gfp_flags the GFP_* flags to use.
++ */
++static struct usb_request *dwc_otg_pcd_alloc_request(struct usb_ep *ep,
++						     gfp_t gfp_flags)
++{
++	struct usb_request *usb_req;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%d)\n", __func__, ep, gfp_flags);
++	if (0 == ep) {
++		DWC_WARN("%s() %s\n", __func__, "Invalid EP!\n");
++		return 0;
++	}
++	usb_req = kzalloc(sizeof(*usb_req), gfp_flags);
++	if (0 == usb_req) {
++		DWC_WARN("%s() %s\n", __func__, "request allocation failed!\n");
++		return 0;
++	}
++	usb_req->dma = DWC_DMA_ADDR_INVALID;
++
++	return usb_req;
++}
++
++/**
++ * This function frees a request object.
++ *
++ * @param ep The endpoint associated with the request
++ * @param req The request being freed
++ */
++static void dwc_otg_pcd_free_request(struct usb_ep *ep, struct usb_request *req)
++{
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%p)\n", __func__, ep, req);
++
++	if (0 == ep || 0 == req) {
++		DWC_WARN("%s() %s\n", __func__,
++			 "Invalid ep or req argument!\n");
++		return;
++	}
++
++	kfree(req);
++}
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
++/**
++ * This function allocates an I/O buffer to be used for a transfer
++ * to/from the specified endpoint.
++ *
++ * @param usb_ep The endpoint to be used with with the request
++ * @param bytes The desired number of bytes for the buffer
++ * @param dma Pointer to the buffer's DMA address; must be valid
++ * @param gfp_flags the GFP_* flags to use.
++ * @return address of a new buffer or null is buffer could not be allocated.
++ */
++static void *dwc_otg_pcd_alloc_buffer(struct usb_ep *usb_ep, unsigned bytes,
++				      dma_addr_t * dma, gfp_t gfp_flags)
++{
++	void *buf;
++	dwc_otg_pcd_t *pcd = 0;
++
++	pcd = gadget_wrapper->pcd;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%d,%p,%0x)\n", __func__, usb_ep, bytes,
++		    dma, gfp_flags);
++
++	/* Check dword alignment */
++	if ((bytes & 0x3UL) != 0) {
++		DWC_WARN("%s() Buffer size is not a multiple of"
++			 "DWORD size (%d)", __func__, bytes);
++	}
++
++	buf = dma_alloc_coherent(NULL, bytes, dma, gfp_flags);
++	WARN_ON(!buf);
++
++	/* Check dword alignment */
++	if (((int)buf & 0x3UL) != 0) {
++		DWC_WARN("%s() Buffer is not DWORD aligned (%p)",
++			 __func__, buf);
++	}
++
++	return buf;
++}
++
++/**
++ * This function frees an I/O buffer that was allocated by alloc_buffer.
++ *
++ * @param usb_ep the endpoint associated with the buffer
++ * @param buf address of the buffer
++ * @param dma The buffer's DMA address
++ * @param bytes The number of bytes of the buffer
++ */
++static void dwc_otg_pcd_free_buffer(struct usb_ep *usb_ep, void *buf,
++				    dma_addr_t dma, unsigned bytes)
++{
++	dwc_otg_pcd_t *pcd = 0;
++
++	pcd = gadget_wrapper->pcd;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%0x,%d)\n", __func__, buf, dma, bytes);
++
++	dma_free_coherent(NULL, bytes, buf, dma);
++}
++#endif
++
++/**
++ * This function is used to submit an I/O Request to an EP.
++ *
++ *	- When the request completes the request's completion callback
++ *	  is called to return the request to the driver.
++ *	- An EP, except control EPs, may have multiple requests
++ *	  pending.
++ *	- Once submitted the request cannot be examined or modified.
++ *	- Each request is turned into one or more packets.
++ *	- A BULK EP can queue any amount of data; the transfer is
++ *	  packetized.
++ *	- Zero length Packets are specified with the request 'zero'
++ *	  flag.
++ */
++static int ep_queue(struct usb_ep *usb_ep, struct usb_request *usb_req,
++		    gfp_t gfp_flags)
++{
++	dwc_otg_pcd_t *pcd;
++	struct dwc_otg_pcd_ep *ep = NULL;
++	int retval = 0, is_isoc_ep = 0;
++	dma_addr_t dma_addr = DWC_DMA_ADDR_INVALID;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%p,%d)\n",
++		    __func__, usb_ep, usb_req, gfp_flags);
++
++	if (!usb_req || !usb_req->complete || !usb_req->buf) {
++		DWC_WARN("bad params\n");
++		return -EINVAL;
++	}
++
++	if (!usb_ep) {
++		DWC_WARN("bad ep\n");
++		return -EINVAL;
++	}
++
++	pcd = gadget_wrapper->pcd;
++	if (!gadget_wrapper->driver ||
++	    gadget_wrapper->gadget.speed == USB_SPEED_UNKNOWN) {
++		DWC_DEBUGPL(DBG_PCDV, "gadget.speed=%d\n",
++			    gadget_wrapper->gadget.speed);
++		DWC_WARN("bogus device state\n");
++		return -ESHUTDOWN;
++	}
++
++	DWC_DEBUGPL(DBG_PCD, "%s queue req %p, len %d buf %p\n",
++		    usb_ep->name, usb_req, usb_req->length, usb_req->buf);
++
++	usb_req->status = -EINPROGRESS;
++	usb_req->actual = 0;
++
++	ep = ep_from_handle(pcd, usb_ep);
++	if (ep == NULL)
++		is_isoc_ep = 0;
++	else
++		is_isoc_ep = (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) ? 1 : 0;
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
++	dma_addr = usb_req->dma;
++#else
++	if (GET_CORE_IF(pcd)->dma_enable) {
++                dwc_otg_device_t *otg_dev = gadget_wrapper->pcd->otg_dev;
++                struct device *dev = NULL;
++
++                if (otg_dev != NULL)
++                        dev = DWC_OTG_OS_GETDEV(otg_dev->os_dep);
++
++		if (usb_req->length != 0 &&
++                    usb_req->dma == DWC_DMA_ADDR_INVALID) {
++                        dma_addr = dma_map_single(dev, usb_req->buf,
++                                                  usb_req->length,
++                                                  ep->dwc_ep.is_in ?
++                                                        DMA_TO_DEVICE:
++                                                        DMA_FROM_DEVICE);
++		}
++	}
++#endif
++
++#ifdef DWC_UTE_PER_IO
++	if (is_isoc_ep == 1) {
++		retval = dwc_otg_pcd_xiso_ep_queue(pcd, usb_ep, usb_req->buf, dma_addr,
++			usb_req->length, usb_req->zero, usb_req,
++			gfp_flags == GFP_ATOMIC ? 1 : 0, &usb_req->ext_req);
++		if (retval)
++			return -EINVAL;
++
++		return 0;
++	}
++#endif
++	retval = dwc_otg_pcd_ep_queue(pcd, usb_ep, usb_req->buf, dma_addr,
++				      usb_req->length, usb_req->zero, usb_req,
++				      gfp_flags == GFP_ATOMIC ? 1 : 0);
++	if (retval) {
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++/**
++ * This function cancels an I/O request from an EP.
++ */
++static int ep_dequeue(struct usb_ep *usb_ep, struct usb_request *usb_req)
++{
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%p)\n", __func__, usb_ep, usb_req);
++
++	if (!usb_ep || !usb_req) {
++		DWC_WARN("bad argument\n");
++		return -EINVAL;
++	}
++	if (!gadget_wrapper->driver ||
++	    gadget_wrapper->gadget.speed == USB_SPEED_UNKNOWN) {
++		DWC_WARN("bogus device state\n");
++		return -ESHUTDOWN;
++	}
++	if (dwc_otg_pcd_ep_dequeue(gadget_wrapper->pcd, usb_ep, usb_req)) {
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++/**
++ * usb_ep_set_halt stalls an endpoint.
++ *
++ * usb_ep_clear_halt clears an endpoint halt and resets its data
++ * toggle.
++ *
++ * Both of these functions are implemented with the same underlying
++ * function. The behavior depends on the value argument.
++ *
++ * @param[in] usb_ep the Endpoint to halt or clear halt.
++ * @param[in] value
++ *	- 0 means clear_halt.
++ *	- 1 means set_halt,
++ *	- 2 means clear stall lock flag.
++ *	- 3 means set  stall lock flag.
++ */
++static int ep_halt(struct usb_ep *usb_ep, int value)
++{
++	int retval = 0;
++
++	DWC_DEBUGPL(DBG_PCD, "HALT %s %d\n", usb_ep->name, value);
++
++	if (!usb_ep) {
++		DWC_WARN("bad ep\n");
++		return -EINVAL;
++	}
++
++	retval = dwc_otg_pcd_ep_halt(gadget_wrapper->pcd, usb_ep, value);
++	if (retval == -DWC_E_AGAIN) {
++		return -EAGAIN;
++	} else if (retval) {
++		retval = -EINVAL;
++	}
++
++	return retval;
++}
++
++//#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30))
++#if 0
++/**
++ * ep_wedge: sets the halt feature and ignores clear requests
++ *
++ * @usb_ep: the endpoint being wedged
++ *
++ * Use this to stall an endpoint and ignore CLEAR_FEATURE(HALT_ENDPOINT)
++ * requests. If the gadget driver clears the halt status, it will
++ * automatically unwedge the endpoint.
++ *
++ * Returns zero on success, else negative errno. *
++ * Check usb_ep_set_wedge() at "usb_gadget.h" for details
++ */
++static int ep_wedge(struct usb_ep *usb_ep)
++{
++	int retval = 0;
++
++	DWC_DEBUGPL(DBG_PCD, "WEDGE %s\n", usb_ep->name);
++
++	if (!usb_ep) {
++		DWC_WARN("bad ep\n");
++		return -EINVAL;
++	}
++
++	retval = dwc_otg_pcd_ep_wedge(gadget_wrapper->pcd, usb_ep);
++	if (retval == -DWC_E_AGAIN) {
++		retval = -EAGAIN;
++	} else if (retval) {
++		retval = -EINVAL;
++	}
++
++	return retval;
++}
++#endif
++
++#ifdef DWC_EN_ISOC
++/**
++ * This function is used to submit an ISOC Transfer Request to an EP.
++ *
++ *	- Every time a sync period completes the request's completion callback
++ *	  is called to provide data to the gadget driver.
++ *	- Once submitted the request cannot be modified.
++ *	- Each request is turned into periodic data packets untill ISO
++ *	  Transfer is stopped..
++ */
++static int iso_ep_start(struct usb_ep *usb_ep, struct usb_iso_request *req,
++			gfp_t gfp_flags)
++{
++	int retval = 0;
++
++	if (!req || !req->process_buffer || !req->buf0 || !req->buf1) {
++		DWC_WARN("bad params\n");
++		return -EINVAL;
++	}
++
++	if (!usb_ep) {
++		DWC_PRINTF("bad params\n");
++		return -EINVAL;
++	}
++
++	req->status = -EINPROGRESS;
++
++	retval =
++	    dwc_otg_pcd_iso_ep_start(gadget_wrapper->pcd, usb_ep, req->buf0,
++				     req->buf1, req->dma0, req->dma1,
++				     req->sync_frame, req->data_pattern_frame,
++				     req->data_per_frame,
++				     req->
++				     flags & USB_REQ_ISO_ASAP ? -1 :
++				     req->start_frame, req->buf_proc_intrvl,
++				     req, gfp_flags == GFP_ATOMIC ? 1 : 0);
++
++	if (retval) {
++		return -EINVAL;
++	}
++
++	return retval;
++}
++
++/**
++ * This function stops ISO EP Periodic Data Transfer.
++ */
++static int iso_ep_stop(struct usb_ep *usb_ep, struct usb_iso_request *req)
++{
++	int retval = 0;
++	if (!usb_ep) {
++		DWC_WARN("bad ep\n");
++	}
++
++	if (!gadget_wrapper->driver ||
++	    gadget_wrapper->gadget.speed == USB_SPEED_UNKNOWN) {
++		DWC_DEBUGPL(DBG_PCDV, "gadget.speed=%d\n",
++			    gadget_wrapper->gadget.speed);
++		DWC_WARN("bogus device state\n");
++	}
++
++	dwc_otg_pcd_iso_ep_stop(gadget_wrapper->pcd, usb_ep, req);
++	if (retval) {
++		retval = -EINVAL;
++	}
++
++	return retval;
++}
++
++static struct usb_iso_request *alloc_iso_request(struct usb_ep *ep,
++						 int packets, gfp_t gfp_flags)
++{
++	struct usb_iso_request *pReq = NULL;
++	uint32_t req_size;
++
++	req_size = sizeof(struct usb_iso_request);
++	req_size +=
++	    (2 * packets * (sizeof(struct usb_gadget_iso_packet_descriptor)));
++
++	pReq = kmalloc(req_size, gfp_flags);
++	if (!pReq) {
++		DWC_WARN("Can't allocate Iso Request\n");
++		return 0;
++	}
++	pReq->iso_packet_desc0 = (void *)(pReq + 1);
++
++	pReq->iso_packet_desc1 = pReq->iso_packet_desc0 + packets;
++
++	return pReq;
++}
++
++static void free_iso_request(struct usb_ep *ep, struct usb_iso_request *req)
++{
++	kfree(req);
++}
++
++static struct usb_isoc_ep_ops dwc_otg_pcd_ep_ops = {
++	.ep_ops = {
++		   .enable = ep_enable,
++		   .disable = ep_disable,
++
++		   .alloc_request = dwc_otg_pcd_alloc_request,
++		   .free_request = dwc_otg_pcd_free_request,
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
++		   .alloc_buffer = dwc_otg_pcd_alloc_buffer,
++		   .free_buffer = dwc_otg_pcd_free_buffer,
++#endif
++
++		   .queue = ep_queue,
++		   .dequeue = ep_dequeue,
++
++		   .set_halt = ep_halt,
++		   .fifo_status = 0,
++		   .fifo_flush = 0,
++		   },
++	.iso_ep_start = iso_ep_start,
++	.iso_ep_stop = iso_ep_stop,
++	.alloc_iso_request = alloc_iso_request,
++	.free_iso_request = free_iso_request,
++};
++
++#else
++
++	int (*enable) (struct usb_ep *ep,
++		const struct usb_endpoint_descriptor *desc);
++	int (*disable) (struct usb_ep *ep);
++
++	struct usb_request *(*alloc_request) (struct usb_ep *ep,
++		gfp_t gfp_flags);
++	void (*free_request) (struct usb_ep *ep, struct usb_request *req);
++
++	int (*queue) (struct usb_ep *ep, struct usb_request *req,
++		gfp_t gfp_flags);
++	int (*dequeue) (struct usb_ep *ep, struct usb_request *req);
++
++	int (*set_halt) (struct usb_ep *ep, int value);
++	int (*set_wedge) (struct usb_ep *ep);
++
++	int (*fifo_status) (struct usb_ep *ep);
++	void (*fifo_flush) (struct usb_ep *ep);
++static struct usb_ep_ops dwc_otg_pcd_ep_ops = {
++	.enable = ep_enable,
++	.disable = ep_disable,
++
++	.alloc_request = dwc_otg_pcd_alloc_request,
++	.free_request = dwc_otg_pcd_free_request,
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
++	.alloc_buffer = dwc_otg_pcd_alloc_buffer,
++	.free_buffer = dwc_otg_pcd_free_buffer,
++#else
++	/* .set_wedge = ep_wedge, */
++        .set_wedge = NULL, /* uses set_halt instead */
++#endif
++
++	.queue = ep_queue,
++	.dequeue = ep_dequeue,
++
++	.set_halt = ep_halt,
++	.fifo_status = 0,
++	.fifo_flush = 0,
++
++};
++
++#endif /* _EN_ISOC_ */
++/*	Gadget Operations */
++/**
++ * The following gadget operations will be implemented in the DWC_otg
++ * PCD. Functions in the API that are not described below are not
++ * implemented.
++ *
++ * The Gadget API provides wrapper functions for each of the function
++ * pointers defined in usb_gadget_ops. The Gadget Driver calls the
++ * wrapper function, which then calls the underlying PCD function. The
++ * following sections are named according to the wrapper functions
++ * (except for ioctl, which doesn't have a wrapper function). Within
++ * each section, the corresponding DWC_otg PCD function name is
++ * specified.
++ *
++ */
++
++/**
++ *Gets the USB Frame number of the last SOF.
++ */
++static int get_frame_number(struct usb_gadget *gadget)
++{
++	struct gadget_wrapper *d;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, gadget);
++
++	if (gadget == 0) {
++		return -ENODEV;
++	}
++
++	d = container_of(gadget, struct gadget_wrapper, gadget);
++	return dwc_otg_pcd_get_frame_number(d->pcd);
++}
++
++#ifdef CONFIG_USB_DWC_OTG_LPM
++static int test_lpm_enabled(struct usb_gadget *gadget)
++{
++	struct gadget_wrapper *d;
++
++	d = container_of(gadget, struct gadget_wrapper, gadget);
++
++	return dwc_otg_pcd_is_lpm_enabled(d->pcd);
++}
++#endif
++
++/**
++ * Initiates Session Request Protocol (SRP) to wakeup the host if no
++ * session is in progress. If a session is already in progress, but
++ * the device is suspended, remote wakeup signaling is started.
++ *
++ */
++static int wakeup(struct usb_gadget *gadget)
++{
++	struct gadget_wrapper *d;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, gadget);
++
++	if (gadget == 0) {
++		return -ENODEV;
++	} else {
++		d = container_of(gadget, struct gadget_wrapper, gadget);
++	}
++	dwc_otg_pcd_wakeup(d->pcd);
++	return 0;
++}
++
++static const struct usb_gadget_ops dwc_otg_pcd_ops = {
++	.get_frame = get_frame_number,
++	.wakeup = wakeup,
++#ifdef CONFIG_USB_DWC_OTG_LPM
++	.lpm_support = test_lpm_enabled,
++#endif
++	// current versions must always be self-powered
++};
++
++static int _setup(dwc_otg_pcd_t * pcd, uint8_t * bytes)
++{
++	int retval = -DWC_E_NOT_SUPPORTED;
++	if (gadget_wrapper->driver && gadget_wrapper->driver->setup) {
++		retval = gadget_wrapper->driver->setup(&gadget_wrapper->gadget,
++						       (struct usb_ctrlrequest
++							*)bytes);
++	}
++
++	if (retval == -ENOTSUPP) {
++		retval = -DWC_E_NOT_SUPPORTED;
++	} else if (retval < 0) {
++		retval = -DWC_E_INVALID;
++	}
++
++	return retval;
++}
++
++#ifdef DWC_EN_ISOC
++static int _isoc_complete(dwc_otg_pcd_t * pcd, void *ep_handle,
++			  void *req_handle, int proc_buf_num)
++{
++	int i, packet_count;
++	struct usb_gadget_iso_packet_descriptor *iso_packet = 0;
++	struct usb_iso_request *iso_req = req_handle;
++
++	if (proc_buf_num) {
++		iso_packet = iso_req->iso_packet_desc1;
++	} else {
++		iso_packet = iso_req->iso_packet_desc0;
++	}
++	packet_count =
++	    dwc_otg_pcd_get_iso_packet_count(pcd, ep_handle, req_handle);
++	for (i = 0; i < packet_count; ++i) {
++		int status;
++		int actual;
++		int offset;
++		dwc_otg_pcd_get_iso_packet_params(pcd, ep_handle, req_handle,
++						  i, &status, &actual, &offset);
++		switch (status) {
++		case -DWC_E_NO_DATA:
++			status = -ENODATA;
++			break;
++		default:
++			if (status) {
++				DWC_PRINTF("unknown status in isoc packet\n");
++			}
++
++		}
++		iso_packet[i].status = status;
++		iso_packet[i].offset = offset;
++		iso_packet[i].actual_length = actual;
++	}
++
++	iso_req->status = 0;
++	iso_req->process_buffer(ep_handle, iso_req);
++
++	return 0;
++}
++#endif /* DWC_EN_ISOC */
++
++#ifdef DWC_UTE_PER_IO
++/**
++ * Copy the contents of the extended request to the Linux usb_request's
++ * extended part and call the gadget's completion.
++ *
++ * @param pcd			Pointer to the pcd structure
++ * @param ep_handle		Void pointer to the usb_ep structure
++ * @param req_handle	Void pointer to the usb_request structure
++ * @param status		Request status returned from the portable logic
++ * @param ereq_port		Void pointer to the extended request structure
++ *						created in the the portable part that contains the
++ *						results of the processed iso packets.
++ */
++static int _xisoc_complete(dwc_otg_pcd_t * pcd, void *ep_handle,
++			   void *req_handle, int32_t status, void *ereq_port)
++{
++	struct dwc_ute_iso_req_ext *ereqorg = NULL;
++	struct dwc_iso_xreq_port *ereqport = NULL;
++	struct dwc_ute_iso_packet_descriptor *desc_org = NULL;
++	int i;
++	struct usb_request *req;
++	//struct dwc_ute_iso_packet_descriptor *
++	//int status = 0;
++
++	req = (struct usb_request *)req_handle;
++	ereqorg = &req->ext_req;
++	ereqport = (struct dwc_iso_xreq_port *)ereq_port;
++	desc_org = ereqorg->per_io_frame_descs;
++
++	if (req && req->complete) {
++		/* Copy the request data from the portable logic to our request */
++		for (i = 0; i < ereqport->pio_pkt_count; i++) {
++			desc_org[i].actual_length =
++			    ereqport->per_io_frame_descs[i].actual_length;
++			desc_org[i].status =
++			    ereqport->per_io_frame_descs[i].status;
++		}
++
++		switch (status) {
++		case -DWC_E_SHUTDOWN:
++			req->status = -ESHUTDOWN;
++			break;
++		case -DWC_E_RESTART:
++			req->status = -ECONNRESET;
++			break;
++		case -DWC_E_INVALID:
++			req->status = -EINVAL;
++			break;
++		case -DWC_E_TIMEOUT:
++			req->status = -ETIMEDOUT;
++			break;
++		default:
++			req->status = status;
++		}
++
++		/* And call the gadget's completion */
++		req->complete(ep_handle, req);
++	}
++
++	return 0;
++}
++#endif /* DWC_UTE_PER_IO */
++
++static int _complete(dwc_otg_pcd_t * pcd, void *ep_handle,
++		     void *req_handle, int32_t status, uint32_t actual)
++{
++	struct usb_request *req = (struct usb_request *)req_handle;
++#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,27)
++	struct dwc_otg_pcd_ep *ep = NULL;
++#endif
++
++	if (req && req->complete) {
++		switch (status) {
++		case -DWC_E_SHUTDOWN:
++			req->status = -ESHUTDOWN;
++			break;
++		case -DWC_E_RESTART:
++			req->status = -ECONNRESET;
++			break;
++		case -DWC_E_INVALID:
++			req->status = -EINVAL;
++			break;
++		case -DWC_E_TIMEOUT:
++			req->status = -ETIMEDOUT;
++			break;
++		default:
++			req->status = status;
++
++		}
++
++		req->actual = actual;
++		DWC_SPINUNLOCK(pcd->lock);
++		req->complete(ep_handle, req);
++		DWC_SPINLOCK(pcd->lock);
++	}
++#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,27)
++	ep = ep_from_handle(pcd, ep_handle);
++	if (GET_CORE_IF(pcd)->dma_enable) {
++                if (req->length != 0) {
++                        dwc_otg_device_t *otg_dev = gadget_wrapper->pcd->otg_dev;
++                        struct device *dev = NULL;
++
++                        if (otg_dev != NULL)
++                                  dev = DWC_OTG_OS_GETDEV(otg_dev->os_dep);
++
++			dma_unmap_single(dev, req->dma, req->length,
++                                         ep->dwc_ep.is_in ?
++                                                DMA_TO_DEVICE: DMA_FROM_DEVICE);
++                }
++	}
++#endif
++
++	return 0;
++}
++
++static int _connect(dwc_otg_pcd_t * pcd, int speed)
++{
++	gadget_wrapper->gadget.speed = speed;
++	return 0;
++}
++
++static int _disconnect(dwc_otg_pcd_t * pcd)
++{
++	if (gadget_wrapper->driver && gadget_wrapper->driver->disconnect) {
++		gadget_wrapper->driver->disconnect(&gadget_wrapper->gadget);
++	}
++	return 0;
++}
++
++static int _resume(dwc_otg_pcd_t * pcd)
++{
++	if (gadget_wrapper->driver && gadget_wrapper->driver->resume) {
++		gadget_wrapper->driver->resume(&gadget_wrapper->gadget);
++	}
++
++	return 0;
++}
++
++static int _suspend(dwc_otg_pcd_t * pcd)
++{
++	if (gadget_wrapper->driver && gadget_wrapper->driver->suspend) {
++		gadget_wrapper->driver->suspend(&gadget_wrapper->gadget);
++	}
++	return 0;
++}
++
++/**
++ * This function updates the otg values in the gadget structure.
++ */
++static int _hnp_changed(dwc_otg_pcd_t * pcd)
++{
++
++	if (!gadget_wrapper->gadget.is_otg)
++		return 0;
++
++	gadget_wrapper->gadget.b_hnp_enable = get_b_hnp_enable(pcd);
++	gadget_wrapper->gadget.a_hnp_support = get_a_hnp_support(pcd);
++	gadget_wrapper->gadget.a_alt_hnp_support = get_a_alt_hnp_support(pcd);
++	return 0;
++}
++
++static int _reset(dwc_otg_pcd_t * pcd)
++{
++	return 0;
++}
++
++#ifdef DWC_UTE_CFI
++static int _cfi_setup(dwc_otg_pcd_t * pcd, void *cfi_req)
++{
++	int retval = -DWC_E_INVALID;
++	if (gadget_wrapper->driver->cfi_feature_setup) {
++		retval =
++		    gadget_wrapper->driver->
++		    cfi_feature_setup(&gadget_wrapper->gadget,
++				      (struct cfi_usb_ctrlrequest *)cfi_req);
++	}
++
++	return retval;
++}
++#endif
++
++static const struct dwc_otg_pcd_function_ops fops = {
++	.complete = _complete,
++#ifdef DWC_EN_ISOC
++	.isoc_complete = _isoc_complete,
++#endif
++	.setup = _setup,
++	.disconnect = _disconnect,
++	.connect = _connect,
++	.resume = _resume,
++	.suspend = _suspend,
++	.hnp_changed = _hnp_changed,
++	.reset = _reset,
++#ifdef DWC_UTE_CFI
++	.cfi_setup = _cfi_setup,
++#endif
++#ifdef DWC_UTE_PER_IO
++	.xisoc_complete = _xisoc_complete,
++#endif
++};
++
++/**
++ * This function is the top level PCD interrupt handler.
++ */
++static irqreturn_t dwc_otg_pcd_irq(int irq, void *dev)
++{
++	dwc_otg_pcd_t *pcd = dev;
++	int32_t retval = IRQ_NONE;
++
++	retval = dwc_otg_pcd_handle_intr(pcd);
++	if (retval != 0) {
++		S3C2410X_CLEAR_EINTPEND();
++	}
++	return IRQ_RETVAL(retval);
++}
++
++/**
++ * This function initialized the usb_ep structures to there default
++ * state.
++ *
++ * @param d Pointer on gadget_wrapper.
++ */
++static void gadget_add_eps(struct gadget_wrapper *d)
++{
++	static const char *names[] = {
++
++		"ep0",
++		"ep1in",
++		"ep2in",
++		"ep3in",
++		"ep4in",
++		"ep5in",
++		"ep6in",
++		"ep7in",
++		"ep8in",
++		"ep9in",
++		"ep10in",
++		"ep11in",
++		"ep12in",
++		"ep13in",
++		"ep14in",
++		"ep15in",
++		"ep1out",
++		"ep2out",
++		"ep3out",
++		"ep4out",
++		"ep5out",
++		"ep6out",
++		"ep7out",
++		"ep8out",
++		"ep9out",
++		"ep10out",
++		"ep11out",
++		"ep12out",
++		"ep13out",
++		"ep14out",
++		"ep15out"
++	};
++
++	int i;
++	struct usb_ep *ep;
++	int8_t dev_endpoints;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s\n", __func__);
++
++	INIT_LIST_HEAD(&d->gadget.ep_list);
++	d->gadget.ep0 = &d->ep0;
++	d->gadget.speed = USB_SPEED_UNKNOWN;
++
++	INIT_LIST_HEAD(&d->gadget.ep0->ep_list);
++
++	/**
++	 * Initialize the EP0 structure.
++	 */
++	ep = &d->ep0;
++
++	/* Init the usb_ep structure. */
++	ep->name = names[0];
++	ep->ops = (struct usb_ep_ops *)&dwc_otg_pcd_ep_ops;
++
++	/**
++	 * @todo NGS: What should the max packet size be set to
++	 * here?  Before EP type is set?
++	 */
++	ep->maxpacket = MAX_PACKET_SIZE;
++	dwc_otg_pcd_ep_enable(d->pcd, NULL, ep);
++
++	list_add_tail(&ep->ep_list, &d->gadget.ep_list);
++
++	/**
++	 * Initialize the EP structures.
++	 */
++	dev_endpoints = d->pcd->core_if->dev_if->num_in_eps;
++
++	for (i = 0; i < dev_endpoints; i++) {
++		ep = &d->in_ep[i];
++
++		/* Init the usb_ep structure. */
++		ep->name = names[d->pcd->in_ep[i].dwc_ep.num];
++		ep->ops = (struct usb_ep_ops *)&dwc_otg_pcd_ep_ops;
++
++		/**
++		 * @todo NGS: What should the max packet size be set to
++		 * here?  Before EP type is set?
++		 */
++		ep->maxpacket = MAX_PACKET_SIZE;
++		list_add_tail(&ep->ep_list, &d->gadget.ep_list);
++	}
++
++	dev_endpoints = d->pcd->core_if->dev_if->num_out_eps;
++
++	for (i = 0; i < dev_endpoints; i++) {
++		ep = &d->out_ep[i];
++
++		/* Init the usb_ep structure. */
++		ep->name = names[15 + d->pcd->out_ep[i].dwc_ep.num];
++		ep->ops = (struct usb_ep_ops *)&dwc_otg_pcd_ep_ops;
++
++		/**
++		 * @todo NGS: What should the max packet size be set to
++		 * here?  Before EP type is set?
++		 */
++		ep->maxpacket = MAX_PACKET_SIZE;
++
++		list_add_tail(&ep->ep_list, &d->gadget.ep_list);
++	}
++
++	/* remove ep0 from the list.  There is a ep0 pointer. */
++	list_del_init(&d->ep0.ep_list);
++
++	d->ep0.maxpacket = MAX_EP0_SIZE;
++}
++
++/**
++ * This function releases the Gadget device.
++ * required by device_unregister().
++ *
++ * @todo Should this do something?	Should it free the PCD?
++ */
++static void dwc_otg_pcd_gadget_release(struct device *dev)
++{
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, dev);
++}
++
++static struct gadget_wrapper *alloc_wrapper(dwc_bus_dev_t *_dev)
++{
++	static char pcd_name[] = "dwc_otg_pcd";
++	dwc_otg_device_t *otg_dev = DWC_OTG_BUSDRVDATA(_dev);
++	struct gadget_wrapper *d;
++	int retval;
++
++	d = DWC_ALLOC(sizeof(*d));
++	if (d == NULL) {
++		return NULL;
++	}
++
++	memset(d, 0, sizeof(*d));
++
++	d->gadget.name = pcd_name;
++	d->pcd = otg_dev->pcd;
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30)
++	strcpy(d->gadget.dev.bus_id, "gadget");
++#else
++	dev_set_name(&d->gadget.dev, "%s", "gadget");
++#endif
++
++	d->gadget.dev.parent = &_dev->dev;
++	d->gadget.dev.release = dwc_otg_pcd_gadget_release;
++	d->gadget.ops = &dwc_otg_pcd_ops;
++	d->gadget.max_speed = dwc_otg_pcd_is_dualspeed(otg_dev->pcd) ? USB_SPEED_HIGH:USB_SPEED_FULL;
++	d->gadget.is_otg = dwc_otg_pcd_is_otg(otg_dev->pcd);
++
++	d->driver = 0;
++	/* Register the gadget device */
++	retval = device_register(&d->gadget.dev);
++	if (retval != 0) {
++		DWC_ERROR("device_register failed\n");
++		DWC_FREE(d);
++		return NULL;
++	}
++
++	return d;
++}
++
++static void free_wrapper(struct gadget_wrapper *d)
++{
++	if (d->driver) {
++		/* should have been done already by driver model core */
++		DWC_WARN("driver '%s' is still registered\n",
++			 d->driver->driver.name);
++#ifdef CONFIG_USB_GADGET
++		usb_gadget_unregister_driver(d->driver);
++#endif
++	}
++
++	device_unregister(&d->gadget.dev);
++	DWC_FREE(d);
++}
++
++/**
++ * This function initialized the PCD portion of the driver.
++ *
++ */
++int pcd_init(dwc_bus_dev_t *_dev)
++{
++	dwc_otg_device_t *otg_dev = DWC_OTG_BUSDRVDATA(_dev);
++	int retval = 0;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p) otg_dev=%p\n", __func__, _dev, otg_dev);
++
++	otg_dev->pcd = dwc_otg_pcd_init(otg_dev);
++
++	if (!otg_dev->pcd) {
++		DWC_ERROR("dwc_otg_pcd_init failed\n");
++		return -ENOMEM;
++	}
++
++	otg_dev->pcd->otg_dev = otg_dev;
++	gadget_wrapper = alloc_wrapper(_dev);
++
++	/*
++	 * Initialize EP structures
++	 */
++	gadget_add_eps(gadget_wrapper);
++	/*
++	 * Setup interupt handler
++	 */
++	DWC_DEBUGPL(DBG_ANY, "registering handler for irq%d\n",
++                    otg_dev->os_dep.irq_num);
++	retval = request_irq(otg_dev->os_dep.irq_num, dwc_otg_pcd_irq,
++			     IRQF_SHARED, gadget_wrapper->gadget.name,
++			     otg_dev->pcd);
++	if (retval != 0) {
++		DWC_ERROR("request of irq%d failed\n", otg_dev->os_dep.irq_num);
++		free_wrapper(gadget_wrapper);
++		return -EBUSY;
++	}
++
++	dwc_otg_pcd_start(gadget_wrapper->pcd, &fops);
++
++	return retval;
++}
++
++/**
++ * Cleanup the PCD.
++ */
++void pcd_remove(dwc_bus_dev_t *_dev)
++{
++	dwc_otg_device_t *otg_dev = DWC_OTG_BUSDRVDATA(_dev);
++	dwc_otg_pcd_t *pcd = otg_dev->pcd;
++
++	DWC_DEBUGPL(DBG_PCDV, "%s(%p) otg_dev %p\n", __func__, _dev, otg_dev);
++
++	/*
++	 * Free the IRQ
++	 */
++	free_irq(otg_dev->os_dep.irq_num, pcd);
++	dwc_otg_pcd_remove(otg_dev->pcd);
++	free_wrapper(gadget_wrapper);
++	otg_dev->pcd = 0;
++}
++
++#endif /* DWC_HOST_ONLY */
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/dwc_otg_regs.h
+@@ -0,0 +1,2550 @@
++/* ==========================================================================
++ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_regs.h $
++ * $Revision: #98 $
++ * $Date: 2012/08/10 $
++ * $Change: 2047372 $
++ *
++ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
++ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
++ * otherwise expressly agreed to in writing between Synopsys and you.
++ *
++ * The Software IS NOT an item of Licensed Software or Licensed Product under
++ * any End User Software License Agreement or Agreement for Licensed Product
++ * with Synopsys or any supplement thereto. You are permitted to use and
++ * redistribute this Software in source and binary forms, with or without
++ * modification, provided that redistributions of source code must retain this
++ * notice. You may not view, use, disclose, copy or distribute this file or
++ * any information contained herein except pursuant to this license grant from
++ * Synopsys. If you do not agree with this notice, including the disclaimer
++ * below, then you are not authorized to use the Software.
++ *
++ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
++ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ * ========================================================================== */
++
++#ifndef __DWC_OTG_REGS_H__
++#define __DWC_OTG_REGS_H__
++
++#include "dwc_otg_core_if.h"
++
++/**
++ * @file
++ *
++ * This file contains the data structures for accessing the DWC_otg core registers.
++ *
++ * The application interfaces with the HS OTG core by reading from and
++ * writing to the Control and Status Register (CSR) space through the
++ * AHB Slave interface. These registers are 32 bits wide, and the
++ * addresses are 32-bit-block aligned.
++ * CSRs are classified as follows:
++ * - Core Global Registers
++ * - Device Mode Registers
++ * - Device Global Registers
++ * - Device Endpoint Specific Registers
++ * - Host Mode Registers
++ * - Host Global Registers
++ * - Host Port CSRs
++ * - Host Channel Specific Registers
++ *
++ * Only the Core Global registers can be accessed in both Device and
++ * Host modes. When the HS OTG core is operating in one mode, either
++ * Device or Host, the application must not access registers from the
++ * other mode. When the core switches from one mode to another, the
++ * registers in the new mode of operation must be reprogrammed as they
++ * would be after a power-on reset.
++ */
++
++/****************************************************************************/
++/** DWC_otg Core registers .
++ * The dwc_otg_core_global_regs structure defines the size
++ * and relative field offsets for the Core Global registers.
++ */
++typedef struct dwc_otg_core_global_regs {
++	/** OTG Control and Status Register.  <i>Offset: 000h</i> */
++	volatile uint32_t gotgctl;
++	/** OTG Interrupt Register.	 <i>Offset: 004h</i> */
++	volatile uint32_t gotgint;
++	/**Core AHB Configuration Register.	 <i>Offset: 008h</i> */
++	volatile uint32_t gahbcfg;
++
++#define DWC_GLBINTRMASK		0x0001
++#define DWC_DMAENABLE		0x0020
++#define DWC_NPTXEMPTYLVL_EMPTY	0x0080
++#define DWC_NPTXEMPTYLVL_HALFEMPTY	0x0000
++#define DWC_PTXEMPTYLVL_EMPTY	0x0100
++#define DWC_PTXEMPTYLVL_HALFEMPTY	0x0000
++
++	/**Core USB Configuration Register.	 <i>Offset: 00Ch</i> */
++	volatile uint32_t gusbcfg;
++	/**Core Reset Register.	 <i>Offset: 010h</i> */
++	volatile uint32_t grstctl;
++	/**Core Interrupt Register.	 <i>Offset: 014h</i> */
++	volatile uint32_t gintsts;
++	/**Core Interrupt Mask Register.  <i>Offset: 018h</i> */
++	volatile uint32_t gintmsk;
++	/**Receive Status Queue Read Register (Read Only).	<i>Offset: 01Ch</i> */
++	volatile uint32_t grxstsr;
++	/**Receive Status Queue Read & POP Register (Read Only).  <i>Offset: 020h</i>*/
++	volatile uint32_t grxstsp;
++	/**Receive FIFO Size Register.	<i>Offset: 024h</i> */
++	volatile uint32_t grxfsiz;
++	/**Non Periodic Transmit FIFO Size Register.  <i>Offset: 028h</i> */
++	volatile uint32_t gnptxfsiz;
++	/**Non Periodic Transmit FIFO/Queue Status Register (Read
++	 * Only). <i>Offset: 02Ch</i> */
++	volatile uint32_t gnptxsts;
++	/**I2C Access Register.	 <i>Offset: 030h</i> */
++	volatile uint32_t gi2cctl;
++	/**PHY Vendor Control Register.	 <i>Offset: 034h</i> */
++	volatile uint32_t gpvndctl;
++	/**General Purpose Input/Output Register.  <i>Offset: 038h</i> */
++	volatile uint32_t ggpio;
++	/**User ID Register.  <i>Offset: 03Ch</i> */
++	volatile uint32_t guid;
++	/**Synopsys ID Register (Read Only).  <i>Offset: 040h</i> */
++	volatile uint32_t gsnpsid;
++	/**User HW Config1 Register (Read Only).  <i>Offset: 044h</i> */
++	volatile uint32_t ghwcfg1;
++	/**User HW Config2 Register (Read Only).  <i>Offset: 048h</i> */
++	volatile uint32_t ghwcfg2;
++#define DWC_SLAVE_ONLY_ARCH 0
++#define DWC_EXT_DMA_ARCH 1
++#define DWC_INT_DMA_ARCH 2
++
++#define DWC_MODE_HNP_SRP_CAPABLE	0
++#define DWC_MODE_SRP_ONLY_CAPABLE	1
++#define DWC_MODE_NO_HNP_SRP_CAPABLE		2
++#define DWC_MODE_SRP_CAPABLE_DEVICE		3
++#define DWC_MODE_NO_SRP_CAPABLE_DEVICE	4
++#define DWC_MODE_SRP_CAPABLE_HOST	5
++#define DWC_MODE_NO_SRP_CAPABLE_HOST	6
++
++	/**User HW Config3 Register (Read Only).  <i>Offset: 04Ch</i> */
++	volatile uint32_t ghwcfg3;
++	/**User HW Config4 Register (Read Only).  <i>Offset: 050h</i>*/
++	volatile uint32_t ghwcfg4;
++	/** Core LPM Configuration register <i>Offset: 054h</i>*/
++	volatile uint32_t glpmcfg;
++	/** Global PowerDn Register <i>Offset: 058h</i> */
++	volatile uint32_t gpwrdn;
++	/** Global DFIFO SW Config Register  <i>Offset: 05Ch</i> */
++	volatile uint32_t gdfifocfg;
++	/** ADP Control Register  <i>Offset: 060h</i> */
++	volatile uint32_t adpctl;
++	/** Reserved  <i>Offset: 064h-0FFh</i> */
++	volatile uint32_t reserved39[39];
++	/** Host Periodic Transmit FIFO Size Register. <i>Offset: 100h</i> */
++	volatile uint32_t hptxfsiz;
++	/** Device Periodic Transmit FIFO#n Register if dedicated fifos are disabled,
++		otherwise Device Transmit FIFO#n Register.
++	 * <i>Offset: 104h + (FIFO_Number-1)*04h, 1 <= FIFO Number <= 15 (1<=n<=15).</i> */
++	volatile uint32_t dtxfsiz[15];
++} dwc_otg_core_global_regs_t;
++
++/**
++ * This union represents the bit fields of the Core OTG Control
++ * and Status Register (GOTGCTL).  Set the bits using the bit
++ * fields then write the <i>d32</i> value to the register.
++ */
++typedef union gotgctl_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned sesreqscs:1;
++		unsigned sesreq:1;
++		unsigned vbvalidoven:1;
++		unsigned vbvalidovval:1;
++		unsigned avalidoven:1;
++		unsigned avalidovval:1;
++		unsigned bvalidoven:1;
++		unsigned bvalidovval:1;
++		unsigned hstnegscs:1;
++		unsigned hnpreq:1;
++		unsigned hstsethnpen:1;
++		unsigned devhnpen:1;
++		unsigned reserved12_15:4;
++		unsigned conidsts:1;
++		unsigned dbnctime:1;
++		unsigned asesvld:1;
++		unsigned bsesvld:1;
++		unsigned otgver:1;
++		unsigned reserved1:1;
++		unsigned multvalidbc:5;
++		unsigned chirpen:1;
++		unsigned reserved28_31:4;
++	} b;
++} gotgctl_data_t;
++
++/**
++ * This union represents the bit fields of the Core OTG Interrupt Register
++ * (GOTGINT).  Set/clear the bits using the bit fields then write the <i>d32</i>
++ * value to the register.
++ */
++typedef union gotgint_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** Current Mode */
++		unsigned reserved0_1:2;
++
++		/** Session End Detected */
++		unsigned sesenddet:1;
++
++		unsigned reserved3_7:5;
++
++		/** Session Request Success Status Change */
++		unsigned sesreqsucstschng:1;
++		/** Host Negotiation Success Status Change */
++		unsigned hstnegsucstschng:1;
++
++		unsigned reserved10_16:7;
++
++		/** Host Negotiation Detected */
++		unsigned hstnegdet:1;
++		/** A-Device Timeout Change */
++		unsigned adevtoutchng:1;
++		/** Debounce Done */
++		unsigned debdone:1;
++		/** Multi-Valued input changed */
++		unsigned mvic:1;
++
++		unsigned reserved31_21:11;
++
++	} b;
++} gotgint_data_t;
++
++/**
++ * This union represents the bit fields of the Core AHB Configuration
++ * Register (GAHBCFG). Set/clear the bits using the bit fields then
++ * write the <i>d32</i> value to the register.
++ */
++typedef union gahbcfg_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned glblintrmsk:1;
++#define DWC_GAHBCFG_GLBINT_ENABLE		1
++
++		unsigned hburstlen:4;
++#define DWC_GAHBCFG_INT_DMA_BURST_SINGLE	0
++#define DWC_GAHBCFG_INT_DMA_BURST_INCR		1
++#define DWC_GAHBCFG_INT_DMA_BURST_INCR4		3
++#define DWC_GAHBCFG_INT_DMA_BURST_INCR8		5
++#define DWC_GAHBCFG_INT_DMA_BURST_INCR16	7
++
++		unsigned dmaenable:1;
++#define DWC_GAHBCFG_DMAENABLE			1
++		unsigned reserved:1;
++		unsigned nptxfemplvl_txfemplvl:1;
++		unsigned ptxfemplvl:1;
++#define DWC_GAHBCFG_TXFEMPTYLVL_EMPTY		1
++#define DWC_GAHBCFG_TXFEMPTYLVL_HALFEMPTY	0
++		unsigned reserved9_20:12;
++		unsigned remmemsupp:1;
++		unsigned notialldmawrit:1;
++		unsigned ahbsingle:1;
++		unsigned reserved24_31:8;
++	} b;
++} gahbcfg_data_t;
++
++/**
++ * This union represents the bit fields of the Core USB Configuration
++ * Register (GUSBCFG). Set the bits using the bit fields then write
++ * the <i>d32</i> value to the register.
++ */
++typedef union gusbcfg_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned toutcal:3;
++		unsigned phyif:1;
++		unsigned ulpi_utmi_sel:1;
++		unsigned fsintf:1;
++		unsigned physel:1;
++		unsigned ddrsel:1;
++		unsigned srpcap:1;
++		unsigned hnpcap:1;
++		unsigned usbtrdtim:4;
++		unsigned reserved1:1;
++		unsigned phylpwrclksel:1;
++		unsigned otgutmifssel:1;
++		unsigned ulpi_fsls:1;
++		unsigned ulpi_auto_res:1;
++		unsigned ulpi_clk_sus_m:1;
++		unsigned ulpi_ext_vbus_drv:1;
++		unsigned ulpi_int_vbus_indicator:1;
++		unsigned term_sel_dl_pulse:1;
++		unsigned indicator_complement:1;
++		unsigned indicator_pass_through:1;
++		unsigned ulpi_int_prot_dis:1;
++		unsigned ic_usb_cap:1;
++		unsigned ic_traffic_pull_remove:1;
++		unsigned tx_end_delay:1;
++		unsigned force_host_mode:1;
++		unsigned force_dev_mode:1;
++		unsigned reserved31:1;
++	} b;
++} gusbcfg_data_t;
++
++/**
++ * This union represents the bit fields of the Core Reset Register
++ * (GRSTCTL).  Set/clear the bits using the bit fields then write the
++ * <i>d32</i> value to the register.
++ */
++typedef union grstctl_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** Core Soft Reset (CSftRst) (Device and Host)
++		 *
++		 * The application can flush the control logic in the
++		 * entire core using this bit. This bit resets the
++		 * pipelines in the AHB Clock domain as well as the
++		 * PHY Clock domain.
++		 *
++		 * The state machines are reset to an IDLE state, the
++		 * control bits in the CSRs are cleared, all the
++		 * transmit FIFOs and the receive FIFO are flushed.
++		 *
++		 * The status mask bits that control the generation of
++		 * the interrupt, are cleared, to clear the
++		 * interrupt. The interrupt status bits are not
++		 * cleared, so the application can get the status of
++		 * any events that occurred in the core after it has
++		 * set this bit.
++		 *
++		 * Any transactions on the AHB are terminated as soon
++		 * as possible following the protocol. Any
++		 * transactions on the USB are terminated immediately.
++		 *
++		 * The configuration settings in the CSRs are
++		 * unchanged, so the software doesn't have to
++		 * reprogram these registers (Device
++		 * Configuration/Host Configuration/Core System
++		 * Configuration/Core PHY Configuration).
++		 *
++		 * The application can write to this bit, any time it
++		 * wants to reset the core. This is a self clearing
++		 * bit and the core clears this bit after all the
++		 * necessary logic is reset in the core, which may
++		 * take several clocks, depending on the current state
++		 * of the core.
++		 */
++		unsigned csftrst:1;
++		/** Hclk Soft Reset
++		 *
++		 * The application uses this bit to reset the control logic in
++		 * the AHB clock domain. Only AHB clock domain pipelines are
++		 * reset.
++		 */
++		unsigned hsftrst:1;
++		/** Host Frame Counter Reset (Host Only)<br>
++		 *
++		 * The application can reset the (micro)frame number
++		 * counter inside the core, using this bit. When the
++		 * (micro)frame counter is reset, the subsequent SOF
++		 * sent out by the core, will have a (micro)frame
++		 * number of 0.
++		 */
++		unsigned hstfrm:1;
++		/** In Token Sequence Learning Queue Flush
++		 * (INTknQFlsh) (Device Only)
++		 */
++		unsigned intknqflsh:1;
++		/** RxFIFO Flush (RxFFlsh) (Device and Host)
++		 *
++		 * The application can flush the entire Receive FIFO
++		 * using this bit. The application must first
++		 * ensure that the core is not in the middle of a
++		 * transaction. The application should write into
++		 * this bit, only after making sure that neither the
++		 * DMA engine is reading from the RxFIFO nor the MAC
++		 * is writing the data in to the FIFO. The
++		 * application should wait until the bit is cleared
++		 * before performing any other operations. This bit
++		 * will takes 8 clocks (slowest of PHY or AHB clock)
++		 * to clear.
++		 */
++		unsigned rxfflsh:1;
++		/** TxFIFO Flush (TxFFlsh) (Device and Host).
++		 *
++		 * This bit is used to selectively flush a single or
++		 * all transmit FIFOs. The application must first
++		 * ensure that the core is not in the middle of a
++		 * transaction. The application should write into
++		 * this bit, only after making sure that neither the
++		 * DMA engine is writing into the TxFIFO nor the MAC
++		 * is reading the data out of the FIFO. The
++		 * application should wait until the core clears this
++		 * bit, before performing any operations. This bit
++		 * will takes 8 clocks (slowest of PHY or AHB clock)
++		 * to clear.
++		 */
++		unsigned txfflsh:1;
++
++		/** TxFIFO Number (TxFNum) (Device and Host).
++		 *
++		 * This is the FIFO number which needs to be flushed,
++		 * using the TxFIFO Flush bit. This field should not
++		 * be changed until the TxFIFO Flush bit is cleared by
++		 * the core.
++		 *	 - 0x0 : Non Periodic TxFIFO Flush
++		 *	 - 0x1 : Periodic TxFIFO #1 Flush in device mode
++		 *	   or Periodic TxFIFO in host mode
++		 *	 - 0x2 : Periodic TxFIFO #2 Flush in device mode.
++		 *	 - ...
++		 *	 - 0xF : Periodic TxFIFO #15 Flush in device mode
++		 *	 - 0x10: Flush all the Transmit NonPeriodic and
++		 *	   Transmit Periodic FIFOs in the core
++		 */
++		unsigned txfnum:5;
++		/** Reserved */
++		unsigned reserved11_29:19;
++		/** DMA Request Signal.	 Indicated DMA request is in
++		 * probress. Used for debug purpose. */
++		unsigned dmareq:1;
++		/** AHB Master Idle.  Indicates the AHB Master State
++		 * Machine is in IDLE condition. */
++		unsigned ahbidle:1;
++	} b;
++} grstctl_t;
++
++/**
++ * This union represents the bit fields of the Core Interrupt Mask
++ * Register (GINTMSK). Set/clear the bits using the bit fields then
++ * write the <i>d32</i> value to the register.
++ */
++typedef union gintmsk_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned reserved0:1;
++		unsigned modemismatch:1;
++		unsigned otgintr:1;
++		unsigned sofintr:1;
++		unsigned rxstsqlvl:1;
++		unsigned nptxfempty:1;
++		unsigned ginnakeff:1;
++		unsigned goutnakeff:1;
++		unsigned ulpickint:1;
++		unsigned i2cintr:1;
++		unsigned erlysuspend:1;
++		unsigned usbsuspend:1;
++		unsigned usbreset:1;
++		unsigned enumdone:1;
++		unsigned isooutdrop:1;
++		unsigned eopframe:1;
++		unsigned restoredone:1;
++		unsigned epmismatch:1;
++		unsigned inepintr:1;
++		unsigned outepintr:1;
++		unsigned incomplisoin:1;
++		unsigned incomplisoout:1;
++		unsigned fetsusp:1;
++		unsigned resetdet:1;
++		unsigned portintr:1;
++		unsigned hcintr:1;
++		unsigned ptxfempty:1;
++		unsigned lpmtranrcvd:1;
++		unsigned conidstschng:1;
++		unsigned disconnect:1;
++		unsigned sessreqintr:1;
++		unsigned wkupintr:1;
++	} b;
++} gintmsk_data_t;
++/**
++ * This union represents the bit fields of the Core Interrupt Register
++ * (GINTSTS).  Set/clear the bits using the bit fields then write the
++ * <i>d32</i> value to the register.
++ */
++typedef union gintsts_data {
++	/** raw register data */
++	uint32_t d32;
++#define DWC_SOF_INTR_MASK 0x0008
++	/** register bits */
++	struct {
++#define DWC_HOST_MODE 1
++		unsigned curmode:1;
++		unsigned modemismatch:1;
++		unsigned otgintr:1;
++		unsigned sofintr:1;
++		unsigned rxstsqlvl:1;
++		unsigned nptxfempty:1;
++		unsigned ginnakeff:1;
++		unsigned goutnakeff:1;
++		unsigned ulpickint:1;
++		unsigned i2cintr:1;
++		unsigned erlysuspend:1;
++		unsigned usbsuspend:1;
++		unsigned usbreset:1;
++		unsigned enumdone:1;
++		unsigned isooutdrop:1;
++		unsigned eopframe:1;
++		unsigned restoredone:1;
++		unsigned epmismatch:1;
++		unsigned inepint:1;
++		unsigned outepintr:1;
++		unsigned incomplisoin:1;
++		unsigned incomplisoout:1;
++		unsigned fetsusp:1;
++		unsigned resetdet:1;
++		unsigned portintr:1;
++		unsigned hcintr:1;
++		unsigned ptxfempty:1;
++		unsigned lpmtranrcvd:1;
++		unsigned conidstschng:1;
++		unsigned disconnect:1;
++		unsigned sessreqintr:1;
++		unsigned wkupintr:1;
++	} b;
++} gintsts_data_t;
++
++/**
++ * This union represents the bit fields in the Device Receive Status Read and
++ * Pop Registers (GRXSTSR, GRXSTSP) Read the register into the <i>d32</i>
++ * element then read out the bits using the <i>b</i>it elements.
++ */
++typedef union device_grxsts_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned epnum:4;
++		unsigned bcnt:11;
++		unsigned dpid:2;
++
++#define DWC_STS_DATA_UPDT		0x2	// OUT Data Packet
++#define DWC_STS_XFER_COMP		0x3	// OUT Data Transfer Complete
++
++#define DWC_DSTS_GOUT_NAK		0x1	// Global OUT NAK
++#define DWC_DSTS_SETUP_COMP		0x4	// Setup Phase Complete
++#define DWC_DSTS_SETUP_UPDT 0x6	// SETUP Packet
++		unsigned pktsts:4;
++		unsigned fn:4;
++		unsigned reserved25_31:7;
++	} b;
++} device_grxsts_data_t;
++
++/**
++ * This union represents the bit fields in the Host Receive Status Read and
++ * Pop Registers (GRXSTSR, GRXSTSP) Read the register into the <i>d32</i>
++ * element then read out the bits using the <i>b</i>it elements.
++ */
++typedef union host_grxsts_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned chnum:4;
++		unsigned bcnt:11;
++		unsigned dpid:2;
++
++		unsigned pktsts:4;
++#define DWC_GRXSTS_PKTSTS_IN			  0x2
++#define DWC_GRXSTS_PKTSTS_IN_XFER_COMP	  0x3
++#define DWC_GRXSTS_PKTSTS_DATA_TOGGLE_ERR 0x5
++#define DWC_GRXSTS_PKTSTS_CH_HALTED		  0x7
++
++		unsigned reserved21_31:11;
++	} b;
++} host_grxsts_data_t;
++
++/**
++ * This union represents the bit fields in the FIFO Size Registers (HPTXFSIZ,
++ * GNPTXFSIZ, DPTXFSIZn, DIEPTXFn). Read the register into the <i>d32</i> element
++ * then read out the bits using the <i>b</i>it elements.
++ */
++typedef union fifosize_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned startaddr:16;
++		unsigned depth:16;
++	} b;
++} fifosize_data_t;
++
++/**
++ * This union represents the bit fields in the Non-Periodic Transmit
++ * FIFO/Queue Status Register (GNPTXSTS). Read the register into the
++ * <i>d32</i> element then read out the bits using the <i>b</i>it
++ * elements.
++ */
++typedef union gnptxsts_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned nptxfspcavail:16;
++		unsigned nptxqspcavail:8;
++		/** Top of the Non-Periodic Transmit Request Queue
++		 *	- bit 24 - Terminate (Last entry for the selected
++		 *	  channel/EP)
++		 *	- bits 26:25 - Token Type
++		 *	  - 2'b00 - IN/OUT
++		 *	  - 2'b01 - Zero Length OUT
++		 *	  - 2'b10 - PING/Complete Split
++		 *	  - 2'b11 - Channel Halt
++		 *	- bits 30:27 - Channel/EP Number
++		 */
++		unsigned nptxqtop_terminate:1;
++		unsigned nptxqtop_token:2;
++		unsigned nptxqtop_chnep:4;
++		unsigned reserved:1;
++	} b;
++} gnptxsts_data_t;
++
++/**
++ * This union represents the bit fields in the Transmit
++ * FIFO Status Register (DTXFSTS). Read the register into the
++ * <i>d32</i> element then read out the bits using the <i>b</i>it
++ * elements.
++ */
++typedef union dtxfsts_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned txfspcavail:16;
++		unsigned reserved:16;
++	} b;
++} dtxfsts_data_t;
++
++/**
++ * This union represents the bit fields in the I2C Control Register
++ * (I2CCTL). Read the register into the <i>d32</i> element then read out the
++ * bits using the <i>b</i>it elements.
++ */
++typedef union gi2cctl_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned rwdata:8;
++		unsigned regaddr:8;
++		unsigned addr:7;
++		unsigned i2cen:1;
++		unsigned ack:1;
++		unsigned i2csuspctl:1;
++		unsigned i2cdevaddr:2;
++		unsigned i2cdatse0:1;
++		unsigned reserved:1;
++		unsigned rw:1;
++		unsigned bsydne:1;
++	} b;
++} gi2cctl_data_t;
++
++/**
++ * This union represents the bit fields in the PHY Vendor Control Register
++ * (GPVNDCTL). Read the register into the <i>d32</i> element then read out the
++ * bits using the <i>b</i>it elements.
++ */
++typedef union gpvndctl_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned regdata:8;
++		unsigned vctrl:8;
++		unsigned regaddr16_21:6;
++		unsigned regwr:1;
++		unsigned reserved23_24:2;
++		unsigned newregreq:1;
++		unsigned vstsbsy:1;
++		unsigned vstsdone:1;
++		unsigned reserved28_30:3;
++		unsigned disulpidrvr:1;
++	} b;
++} gpvndctl_data_t;
++
++/**
++ * This union represents the bit fields in the General Purpose
++ * Input/Output Register (GGPIO).
++ * Read the register into the <i>d32</i> element then read out the
++ * bits using the <i>b</i>it elements.
++ */
++typedef union ggpio_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned gpi:16;
++		unsigned gpo:16;
++	} b;
++} ggpio_data_t;
++
++/**
++ * This union represents the bit fields in the User ID Register
++ * (GUID). Read the register into the <i>d32</i> element then read out the
++ * bits using the <i>b</i>it elements.
++ */
++typedef union guid_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned rwdata:32;
++	} b;
++} guid_data_t;
++
++/**
++ * This union represents the bit fields in the Synopsys ID Register
++ * (GSNPSID). Read the register into the <i>d32</i> element then read out the
++ * bits using the <i>b</i>it elements.
++ */
++typedef union gsnpsid_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned rwdata:32;
++	} b;
++} gsnpsid_data_t;
++
++/**
++ * This union represents the bit fields in the User HW Config1
++ * Register.  Read the register into the <i>d32</i> element then read
++ * out the bits using the <i>b</i>it elements.
++ */
++typedef union hwcfg1_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned ep_dir0:2;
++		unsigned ep_dir1:2;
++		unsigned ep_dir2:2;
++		unsigned ep_dir3:2;
++		unsigned ep_dir4:2;
++		unsigned ep_dir5:2;
++		unsigned ep_dir6:2;
++		unsigned ep_dir7:2;
++		unsigned ep_dir8:2;
++		unsigned ep_dir9:2;
++		unsigned ep_dir10:2;
++		unsigned ep_dir11:2;
++		unsigned ep_dir12:2;
++		unsigned ep_dir13:2;
++		unsigned ep_dir14:2;
++		unsigned ep_dir15:2;
++	} b;
++} hwcfg1_data_t;
++
++/**
++ * This union represents the bit fields in the User HW Config2
++ * Register.  Read the register into the <i>d32</i> element then read
++ * out the bits using the <i>b</i>it elements.
++ */
++typedef union hwcfg2_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/* GHWCFG2 */
++		unsigned op_mode:3;
++#define DWC_HWCFG2_OP_MODE_HNP_SRP_CAPABLE_OTG 0
++#define DWC_HWCFG2_OP_MODE_SRP_ONLY_CAPABLE_OTG 1
++#define DWC_HWCFG2_OP_MODE_NO_HNP_SRP_CAPABLE_OTG 2
++#define DWC_HWCFG2_OP_MODE_SRP_CAPABLE_DEVICE 3
++#define DWC_HWCFG2_OP_MODE_NO_SRP_CAPABLE_DEVICE 4
++#define DWC_HWCFG2_OP_MODE_SRP_CAPABLE_HOST 5
++#define DWC_HWCFG2_OP_MODE_NO_SRP_CAPABLE_HOST 6
++
++		unsigned architecture:2;
++		unsigned point2point:1;
++		unsigned hs_phy_type:2;
++#define DWC_HWCFG2_HS_PHY_TYPE_NOT_SUPPORTED 0
++#define DWC_HWCFG2_HS_PHY_TYPE_UTMI 1
++#define DWC_HWCFG2_HS_PHY_TYPE_ULPI 2
++#define DWC_HWCFG2_HS_PHY_TYPE_UTMI_ULPI 3
++
++		unsigned fs_phy_type:2;
++		unsigned num_dev_ep:4;
++		unsigned num_host_chan:4;
++		unsigned perio_ep_supported:1;
++		unsigned dynamic_fifo:1;
++		unsigned multi_proc_int:1;
++		unsigned reserved21:1;
++		unsigned nonperio_tx_q_depth:2;
++		unsigned host_perio_tx_q_depth:2;
++		unsigned dev_token_q_depth:5;
++		unsigned otg_enable_ic_usb:1;
++	} b;
++} hwcfg2_data_t;
++
++/**
++ * This union represents the bit fields in the User HW Config3
++ * Register.  Read the register into the <i>d32</i> element then read
++ * out the bits using the <i>b</i>it elements.
++ */
++typedef union hwcfg3_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/* GHWCFG3 */
++		unsigned xfer_size_cntr_width:4;
++		unsigned packet_size_cntr_width:3;
++		unsigned otg_func:1;
++		unsigned i2c:1;
++		unsigned vendor_ctrl_if:1;
++		unsigned optional_features:1;
++		unsigned synch_reset_type:1;
++		unsigned adp_supp:1;
++		unsigned otg_enable_hsic:1;
++		unsigned bc_support:1;
++		unsigned otg_lpm_en:1;
++		unsigned dfifo_depth:16;
++	} b;
++} hwcfg3_data_t;
++
++/**
++ * This union represents the bit fields in the User HW Config4
++ * Register.  Read the register into the <i>d32</i> element then read
++ * out the bits using the <i>b</i>it elements.
++ */
++typedef union hwcfg4_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned num_dev_perio_in_ep:4;
++		unsigned power_optimiz:1;
++		unsigned min_ahb_freq:1;
++		unsigned hiber:1;
++		unsigned xhiber:1;
++		unsigned reserved:6;
++		unsigned utmi_phy_data_width:2;
++		unsigned num_dev_mode_ctrl_ep:4;
++		unsigned iddig_filt_en:1;
++		unsigned vbus_valid_filt_en:1;
++		unsigned a_valid_filt_en:1;
++		unsigned b_valid_filt_en:1;
++		unsigned session_end_filt_en:1;
++		unsigned ded_fifo_en:1;
++		unsigned num_in_eps:4;
++		unsigned desc_dma:1;
++		unsigned desc_dma_dyn:1;
++	} b;
++} hwcfg4_data_t;
++
++/**
++ * This union represents the bit fields of the Core LPM Configuration
++ * Register (GLPMCFG). Set the bits using bit fields then write
++ * the <i>d32</i> value to the register.
++ */
++typedef union glpmctl_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** LPM-Capable (LPMCap) (Device and Host)
++		 * The application uses this bit to control
++		 * the DWC_otg core LPM capabilities.
++		 */
++		unsigned lpm_cap_en:1;
++		/** LPM response programmed by application (AppL1Res) (Device)
++		 * Handshake response to LPM token pre-programmed
++		 * by device application software.
++		 */
++		unsigned appl_resp:1;
++		/** Host Initiated Resume Duration (HIRD) (Device and Host)
++		 * In Host mode this field indicates the value of HIRD
++		 * to be sent in an LPM transaction.
++		 * In Device mode this field is updated with the
++		 * Received LPM Token HIRD bmAttribute
++		 * when an ACK/NYET/STALL response is sent
++		 * to an LPM transaction.
++		 */
++		unsigned hird:4;
++		/** RemoteWakeEnable (bRemoteWake) (Device and Host)
++		 * In Host mode this bit indicates the value of remote
++		 * wake up to be sent in wIndex field of LPM transaction.
++		 * In Device mode this field is updated with the
++		 * Received LPM Token bRemoteWake bmAttribute
++		 * when an ACK/NYET/STALL response is sent
++		 * to an LPM transaction.
++		 */
++		unsigned rem_wkup_en:1;
++		/** Enable utmi_sleep_n (EnblSlpM) (Device and Host)
++		 * The application uses this bit to control
++		 * the utmi_sleep_n assertion to the PHY when in L1 state.
++		 */
++		unsigned en_utmi_sleep:1;
++		/** HIRD Threshold (HIRD_Thres) (Device and Host)
++		 */
++		unsigned hird_thres:5;
++		/** LPM Response (CoreL1Res) (Device and Host)
++		 * In Host mode this bit contains handsake response to
++		 * LPM transaction.
++		 * In Device mode the response of the core to
++		 * LPM transaction received is reflected in these two bits.
++			- 0x0 : ERROR (No handshake response)
++			- 0x1 : STALL
++			- 0x2 : NYET
++			- 0x3 : ACK
++		 */
++		unsigned lpm_resp:2;
++		/** Port Sleep Status (SlpSts) (Device and Host)
++		 * This bit is set as long as a Sleep condition
++		 * is present on the USB bus.
++		 */
++		unsigned prt_sleep_sts:1;
++		/** Sleep State Resume OK (L1ResumeOK) (Device and Host)
++		 * Indicates that the application or host
++		 * can start resume from Sleep state.
++		 */
++		unsigned sleep_state_resumeok:1;
++		/** LPM channel Index (LPM_Chnl_Indx) (Host)
++		 * The channel number on which the LPM transaction
++		 * has to be applied while sending
++		 * an LPM transaction to the local device.
++		 */
++		unsigned lpm_chan_index:4;
++		/** LPM Retry Count (LPM_Retry_Cnt) (Host)
++		 * Number host retries that would be performed
++		 * if the device response was not valid response.
++		 */
++		unsigned retry_count:3;
++		/** Send LPM Transaction (SndLPM) (Host)
++		 * When set by application software,
++		 * an LPM transaction containing two tokens
++		 * is sent.
++		 */
++		unsigned send_lpm:1;
++		/** LPM Retry status (LPM_RetryCnt_Sts) (Host)
++		 * Number of LPM Host Retries still remaining
++		 * to be transmitted for the current LPM sequence
++		 */
++		unsigned retry_count_sts:3;
++		unsigned reserved28_29:2;
++		/** In host mode once this bit is set, the host
++		 * configures to drive the HSIC Idle state on the bus.
++		 * It then waits for the  device to initiate the Connect sequence.
++		 * In device mode once this bit is set, the device waits for
++		 * the HSIC Idle line state on the bus. Upon receving the Idle
++		 * line state, it initiates the HSIC Connect sequence.
++		 */
++		unsigned hsic_connect:1;
++		/** This bit overrides and functionally inverts
++		 * the if_select_hsic input port signal.
++		 */
++		unsigned inv_sel_hsic:1;
++	} b;
++} glpmcfg_data_t;
++
++/**
++ * This union represents the bit fields of the Core ADP Timer, Control and
++ * Status Register (ADPTIMCTLSTS). Set the bits using bit fields then write
++ * the <i>d32</i> value to the register.
++ */
++typedef union adpctl_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** Probe Discharge (PRB_DSCHG)
++		 *  These bits set the times for TADP_DSCHG.
++		 *  These bits are defined as follows:
++		 *  2'b00 - 4 msec
++		 *  2'b01 - 8 msec
++		 *  2'b10 - 16 msec
++		 *  2'b11 - 32 msec
++		 */
++		unsigned prb_dschg:2;
++		/** Probe Delta (PRB_DELTA)
++		 *  These bits set the resolution for RTIM   value.
++		 *  The bits are defined in units of 32 kHz clock cycles as follows:
++		 *  2'b00  -  1 cycles
++		 *  2'b01  -  2 cycles
++		 *  2'b10 -  3 cycles
++		 *  2'b11 - 4 cycles
++		 *  For example if this value is chosen to 2'b01, it means that RTIM
++		 *  increments for every 3(three) 32Khz clock cycles.
++		 */
++		unsigned prb_delta:2;
++		/** Probe Period (PRB_PER)
++		 *  These bits sets the TADP_PRD as shown in Figure 4 as follows:
++		 *  2'b00  -  0.625 to 0.925 sec (typical 0.775 sec)
++		 *  2'b01  -  1.25 to 1.85 sec (typical 1.55 sec)
++		 *  2'b10  -  1.9 to 2.6 sec (typical 2.275 sec)
++		 *  2'b11  -  Reserved
++		 */
++		unsigned prb_per:2;
++		/** These bits capture the latest time it took for VBUS to ramp from
++		 *  VADP_SINK to VADP_PRB.
++		 *  0x000  -  1 cycles
++		 *  0x001  -  2 cycles
++		 *  0x002  -  3 cycles
++		 *  etc
++		 *  0x7FF  -  2048 cycles
++		 *  A time of 1024 cycles at 32 kHz corresponds to a time of 32 msec.
++		*/
++		unsigned rtim:11;
++		/** Enable Probe (EnaPrb)
++		 *  When programmed to 1'b1, the core performs a probe operation.
++		 *  This bit is valid only if OTG_Ver = 1'b1.
++		 */
++		unsigned enaprb:1;
++		/** Enable Sense (EnaSns)
++		 *  When programmed to 1'b1, the core performs a Sense operation.
++		 *  This bit is valid only if OTG_Ver = 1'b1.
++		 */
++		unsigned enasns:1;
++		/** ADP Reset (ADPRes)
++		 *  When set, ADP controller is reset.
++		 *  This bit is valid only if OTG_Ver = 1'b1.
++		 */
++		unsigned adpres:1;
++		/** ADP Enable (ADPEn)
++		 *  When set, the core performs either ADP probing or sensing
++		 *  based on EnaPrb or EnaSns.
++		 *  This bit is valid only if OTG_Ver = 1'b1.
++		 */
++		unsigned adpen:1;
++		/** ADP Probe Interrupt (ADP_PRB_INT)
++		 *  When this bit is set, it means that the VBUS
++		 *  voltage is greater than VADP_PRB or VADP_PRB is reached.
++		 *  This bit is valid only if OTG_Ver = 1'b1.
++		 */
++		unsigned adp_prb_int:1;
++		/**
++		 *  ADP Sense Interrupt (ADP_SNS_INT)
++		 *  When this bit is set, it means that the VBUS voltage is greater than
++		 *  VADP_SNS value or VADP_SNS is reached.
++		 *  This bit is valid only if OTG_Ver = 1'b1.
++		 */
++		unsigned adp_sns_int:1;
++		/** ADP Tomeout Interrupt (ADP_TMOUT_INT)
++		 *  This bit is relevant only for an ADP probe.
++		 *  When this bit is set, it means that the ramp time has
++		 *  completed ie ADPCTL.RTIM has reached its terminal value
++		 *  of 0x7FF.  This is a debug feature that allows software
++		 *  to read the ramp time after each cycle.
++		 *  This bit is valid only if OTG_Ver = 1'b1.
++		 */
++		unsigned adp_tmout_int:1;
++		/** ADP Probe Interrupt Mask (ADP_PRB_INT_MSK)
++		 *  When this bit is set, it unmasks the interrupt due to ADP_PRB_INT.
++		 *  This bit is valid only if OTG_Ver = 1'b1.
++		 */
++		unsigned adp_prb_int_msk:1;
++		/** ADP Sense Interrupt Mask (ADP_SNS_INT_MSK)
++		 *  When this bit is set, it unmasks the interrupt due to ADP_SNS_INT.
++		 *  This bit is valid only if OTG_Ver = 1'b1.
++		 */
++		unsigned adp_sns_int_msk:1;
++		/** ADP Timoeout Interrupt Mask (ADP_TMOUT_MSK)
++		 *  When this bit is set, it unmasks the interrupt due to ADP_TMOUT_INT.
++		 *  This bit is valid only if OTG_Ver = 1'b1.
++		 */
++		unsigned adp_tmout_int_msk:1;
++		/** Access Request
++		 * 2'b00 - Read/Write Valid (updated by the core)
++		 * 2'b01 - Read
++		 * 2'b00 - Write
++		 * 2'b00 - Reserved
++		 */
++		unsigned ar:2;
++		 /** Reserved */
++		unsigned reserved29_31:3;
++	} b;
++} adpctl_data_t;
++
++////////////////////////////////////////////
++// Device Registers
++/**
++ * Device Global Registers. <i>Offsets 800h-BFFh</i>
++ *
++ * The following structures define the size and relative field offsets
++ * for the Device Mode Registers.
++ *
++ * <i>These registers are visible only in Device mode and must not be
++ * accessed in Host mode, as the results are unknown.</i>
++ */
++typedef struct dwc_otg_dev_global_regs {
++	/** Device Configuration Register. <i>Offset 800h</i> */
++	volatile uint32_t dcfg;
++	/** Device Control Register. <i>Offset: 804h</i> */
++	volatile uint32_t dctl;
++	/** Device Status Register (Read Only). <i>Offset: 808h</i> */
++	volatile uint32_t dsts;
++	/** Reserved. <i>Offset: 80Ch</i> */
++	uint32_t unused;
++	/** Device IN Endpoint Common Interrupt Mask
++	 * Register. <i>Offset: 810h</i> */
++	volatile uint32_t diepmsk;
++	/** Device OUT Endpoint Common Interrupt Mask
++	 * Register. <i>Offset: 814h</i> */
++	volatile uint32_t doepmsk;
++	/** Device All Endpoints Interrupt Register.  <i>Offset: 818h</i> */
++	volatile uint32_t daint;
++	/** Device All Endpoints Interrupt Mask Register.  <i>Offset:
++	 * 81Ch</i> */
++	volatile uint32_t daintmsk;
++	/** Device IN Token Queue Read Register-1 (Read Only).
++	 * <i>Offset: 820h</i> */
++	volatile uint32_t dtknqr1;
++	/** Device IN Token Queue Read Register-2 (Read Only).
++	 * <i>Offset: 824h</i> */
++	volatile uint32_t dtknqr2;
++	/** Device VBUS	 discharge Register.  <i>Offset: 828h</i> */
++	volatile uint32_t dvbusdis;
++	/** Device VBUS Pulse Register.	 <i>Offset: 82Ch</i> */
++	volatile uint32_t dvbuspulse;
++	/** Device IN Token Queue Read Register-3 (Read Only). /
++	 *	Device Thresholding control register (Read/Write)
++	 * <i>Offset: 830h</i> */
++	volatile uint32_t dtknqr3_dthrctl;
++	/** Device IN Token Queue Read Register-4 (Read Only). /
++	 *	Device IN EPs empty Inr. Mask Register (Read/Write)
++	 * <i>Offset: 834h</i> */
++	volatile uint32_t dtknqr4_fifoemptymsk;
++	/** Device Each Endpoint Interrupt Register (Read Only). /
++	 * <i>Offset: 838h</i> */
++	volatile uint32_t deachint;
++	/** Device Each Endpoint Interrupt mask Register (Read/Write). /
++	 * <i>Offset: 83Ch</i> */
++	volatile uint32_t deachintmsk;
++	/** Device Each In Endpoint Interrupt mask Register (Read/Write). /
++	 * <i>Offset: 840h</i> */
++	volatile uint32_t diepeachintmsk[MAX_EPS_CHANNELS];
++	/** Device Each Out Endpoint Interrupt mask Register (Read/Write). /
++	 * <i>Offset: 880h</i> */
++	volatile uint32_t doepeachintmsk[MAX_EPS_CHANNELS];
++} dwc_otg_device_global_regs_t;
++
++/**
++ * This union represents the bit fields in the Device Configuration
++ * Register.  Read the register into the <i>d32</i> member then
++ * set/clear the bits using the <i>b</i>it elements.  Write the
++ * <i>d32</i> member to the dcfg register.
++ */
++typedef union dcfg_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** Device Speed */
++		unsigned devspd:2;
++		/** Non Zero Length Status OUT Handshake */
++		unsigned nzstsouthshk:1;
++#define DWC_DCFG_SEND_STALL 1
++
++		unsigned ena32khzs:1;
++		/** Device Addresses */
++		unsigned devaddr:7;
++		/** Periodic Frame Interval */
++		unsigned perfrint:2;
++#define DWC_DCFG_FRAME_INTERVAL_80 0
++#define DWC_DCFG_FRAME_INTERVAL_85 1
++#define DWC_DCFG_FRAME_INTERVAL_90 2
++#define DWC_DCFG_FRAME_INTERVAL_95 3
++
++		/** Enable Device OUT NAK for bulk in DDMA mode */
++		unsigned endevoutnak:1;
++
++		unsigned reserved14_17:4;
++		/** In Endpoint Mis-match count */
++		unsigned epmscnt:5;
++		/** Enable Descriptor DMA in Device mode */
++		unsigned descdma:1;
++		unsigned perschintvl:2;
++		unsigned resvalid:6;
++	} b;
++} dcfg_data_t;
++
++/**
++ * This union represents the bit fields in the Device Control
++ * Register.  Read the register into the <i>d32</i> member then
++ * set/clear the bits using the <i>b</i>it elements.
++ */
++typedef union dctl_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** Remote Wakeup */
++		unsigned rmtwkupsig:1;
++		/** Soft Disconnect */
++		unsigned sftdiscon:1;
++		/** Global Non-Periodic IN NAK Status */
++		unsigned gnpinnaksts:1;
++		/** Global OUT NAK Status */
++		unsigned goutnaksts:1;
++		/** Test Control */
++		unsigned tstctl:3;
++		/** Set Global Non-Periodic IN NAK */
++		unsigned sgnpinnak:1;
++		/** Clear Global Non-Periodic IN NAK */
++		unsigned cgnpinnak:1;
++		/** Set Global OUT NAK */
++		unsigned sgoutnak:1;
++		/** Clear Global OUT NAK */
++		unsigned cgoutnak:1;
++		/** Power-On Programming Done */
++		unsigned pwronprgdone:1;
++		/** Reserved */
++		unsigned reserved:1;
++		/** Global Multi Count */
++		unsigned gmc:2;
++		/** Ignore Frame Number for ISOC EPs */
++		unsigned ifrmnum:1;
++		/** NAK on Babble */
++		unsigned nakonbble:1;
++		/** Enable Continue on BNA */
++		unsigned encontonbna:1;
++
++		unsigned reserved18_31:14;
++	} b;
++} dctl_data_t;
++
++/**
++ * This union represents the bit fields in the Device Status
++ * Register.  Read the register into the <i>d32</i> member then
++ * set/clear the bits using the <i>b</i>it elements.
++ */
++typedef union dsts_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** Suspend Status */
++		unsigned suspsts:1;
++		/** Enumerated Speed */
++		unsigned enumspd:2;
++#define DWC_DSTS_ENUMSPD_HS_PHY_30MHZ_OR_60MHZ 0
++#define DWC_DSTS_ENUMSPD_FS_PHY_30MHZ_OR_60MHZ 1
++#define DWC_DSTS_ENUMSPD_LS_PHY_6MHZ		   2
++#define DWC_DSTS_ENUMSPD_FS_PHY_48MHZ		   3
++		/** Erratic Error */
++		unsigned errticerr:1;
++		unsigned reserved4_7:4;
++		/** Frame or Microframe Number of the received SOF */
++		unsigned soffn:14;
++		unsigned reserved22_31:10;
++	} b;
++} dsts_data_t;
++
++/**
++ * This union represents the bit fields in the Device IN EP Interrupt
++ * Register and the Device IN EP Common Mask Register.
++ *
++ * - Read the register into the <i>d32</i> member then set/clear the
++ *	 bits using the <i>b</i>it elements.
++ */
++typedef union diepint_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** Transfer complete mask */
++		unsigned xfercompl:1;
++		/** Endpoint disable mask */
++		unsigned epdisabled:1;
++		/** AHB Error mask */
++		unsigned ahberr:1;
++		/** TimeOUT Handshake mask (non-ISOC EPs) */
++		unsigned timeout:1;
++		/** IN Token received with TxF Empty mask */
++		unsigned intktxfemp:1;
++		/** IN Token Received with EP mismatch mask */
++		unsigned intknepmis:1;
++		/** IN Endpoint NAK Effective mask */
++		unsigned inepnakeff:1;
++		/** Reserved */
++		unsigned emptyintr:1;
++
++		unsigned txfifoundrn:1;
++
++		/** BNA Interrupt mask */
++		unsigned bna:1;
++
++		unsigned reserved10_12:3;
++		/** BNA Interrupt mask */
++		unsigned nak:1;
++
++		unsigned reserved14_31:18;
++	} b;
++} diepint_data_t;
++
++/**
++ * This union represents the bit fields in the Device IN EP
++ * Common/Dedicated Interrupt Mask Register.
++ */
++typedef union diepint_data diepmsk_data_t;
++
++/**
++ * This union represents the bit fields in the Device OUT EP Interrupt
++ * Registerand Device OUT EP Common Interrupt Mask Register.
++ *
++ * - Read the register into the <i>d32</i> member then set/clear the
++ *	 bits using the <i>b</i>it elements.
++ */
++typedef union doepint_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** Transfer complete */
++		unsigned xfercompl:1;
++		/** Endpoint disable  */
++		unsigned epdisabled:1;
++		/** AHB Error */
++		unsigned ahberr:1;
++		/** Setup Phase Done (contorl EPs) */
++		unsigned setup:1;
++		/** OUT Token Received when Endpoint Disabled */
++		unsigned outtknepdis:1;
++
++		unsigned stsphsercvd:1;
++		/** Back-to-Back SETUP Packets Received */
++		unsigned back2backsetup:1;
++
++		unsigned reserved7:1;
++		/** OUT packet Error */
++		unsigned outpkterr:1;
++		/** BNA Interrupt */
++		unsigned bna:1;
++
++		unsigned reserved10:1;
++		/** Packet Drop Status */
++		unsigned pktdrpsts:1;
++		/** Babble Interrupt */
++		unsigned babble:1;
++		/** NAK Interrupt */
++		unsigned nak:1;
++		/** NYET Interrupt */
++		unsigned nyet:1;
++		/** Bit indicating setup packet received */
++		unsigned sr:1;
++
++		unsigned reserved16_31:16;
++	} b;
++} doepint_data_t;
++
++/**
++ * This union represents the bit fields in the Device OUT EP
++ * Common/Dedicated Interrupt Mask Register.
++ */
++typedef union doepint_data doepmsk_data_t;
++
++/**
++ * This union represents the bit fields in the Device All EP Interrupt
++ * and Mask Registers.
++ * - Read the register into the <i>d32</i> member then set/clear the
++ *	 bits using the <i>b</i>it elements.
++ */
++typedef union daint_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** IN Endpoint bits */
++		unsigned in:16;
++		/** OUT Endpoint bits */
++		unsigned out:16;
++	} ep;
++	struct {
++		/** IN Endpoint bits */
++		unsigned inep0:1;
++		unsigned inep1:1;
++		unsigned inep2:1;
++		unsigned inep3:1;
++		unsigned inep4:1;
++		unsigned inep5:1;
++		unsigned inep6:1;
++		unsigned inep7:1;
++		unsigned inep8:1;
++		unsigned inep9:1;
++		unsigned inep10:1;
++		unsigned inep11:1;
++		unsigned inep12:1;
++		unsigned inep13:1;
++		unsigned inep14:1;
++		unsigned inep15:1;
++		/** OUT Endpoint bits */
++		unsigned outep0:1;
++		unsigned outep1:1;
++		unsigned outep2:1;
++		unsigned outep3:1;
++		unsigned outep4:1;
++		unsigned outep5:1;
++		unsigned outep6:1;
++		unsigned outep7:1;
++		unsigned outep8:1;
++		unsigned outep9:1;
++		unsigned outep10:1;
++		unsigned outep11:1;
++		unsigned outep12:1;
++		unsigned outep13:1;
++		unsigned outep14:1;
++		unsigned outep15:1;
++	} b;
++} daint_data_t;
++
++/**
++ * This union represents the bit fields in the Device IN Token Queue
++ * Read Registers.
++ * - Read the register into the <i>d32</i> member.
++ * - READ-ONLY Register
++ */
++typedef union dtknq1_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** In Token Queue Write Pointer */
++		unsigned intknwptr:5;
++		/** Reserved */
++		unsigned reserved05_06:2;
++		/** write pointer has wrapped. */
++		unsigned wrap_bit:1;
++		/** EP Numbers of IN Tokens 0 ... 4 */
++		unsigned epnums0_5:24;
++	} b;
++} dtknq1_data_t;
++
++/**
++ * This union represents Threshold control Register
++ * - Read and write the register into the <i>d32</i> member.
++ * - READ-WRITABLE Register
++ */
++typedef union dthrctl_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** non ISO Tx Thr. Enable */
++		unsigned non_iso_thr_en:1;
++		/** ISO Tx Thr. Enable */
++		unsigned iso_thr_en:1;
++		/** Tx Thr. Length */
++		unsigned tx_thr_len:9;
++		/** AHB Threshold ratio */
++		unsigned ahb_thr_ratio:2;
++		/** Reserved */
++		unsigned reserved13_15:3;
++		/** Rx Thr. Enable */
++		unsigned rx_thr_en:1;
++		/** Rx Thr. Length */
++		unsigned rx_thr_len:9;
++		unsigned reserved26:1;
++		/** Arbiter Parking Enable*/
++		unsigned arbprken:1;
++		/** Reserved */
++		unsigned reserved28_31:4;
++	} b;
++} dthrctl_data_t;
++
++/**
++ * Device Logical IN Endpoint-Specific Registers. <i>Offsets
++ * 900h-AFCh</i>
++ *
++ * There will be one set of endpoint registers per logical endpoint
++ * implemented.
++ *
++ * <i>These registers are visible only in Device mode and must not be
++ * accessed in Host mode, as the results are unknown.</i>
++ */
++typedef struct dwc_otg_dev_in_ep_regs {
++	/** Device IN Endpoint Control Register. <i>Offset:900h +
++	 * (ep_num * 20h) + 00h</i> */
++	volatile uint32_t diepctl;
++	/** Reserved. <i>Offset:900h + (ep_num * 20h) + 04h</i> */
++	uint32_t reserved04;
++	/** Device IN Endpoint Interrupt Register. <i>Offset:900h +
++	 * (ep_num * 20h) + 08h</i> */
++	volatile uint32_t diepint;
++	/** Reserved. <i>Offset:900h + (ep_num * 20h) + 0Ch</i> */
++	uint32_t reserved0C;
++	/** Device IN Endpoint Transfer Size
++	 * Register. <i>Offset:900h + (ep_num * 20h) + 10h</i> */
++	volatile uint32_t dieptsiz;
++	/** Device IN Endpoint DMA Address Register. <i>Offset:900h +
++	 * (ep_num * 20h) + 14h</i> */
++	volatile uint32_t diepdma;
++	/** Device IN Endpoint Transmit FIFO Status Register. <i>Offset:900h +
++	 * (ep_num * 20h) + 18h</i> */
++	volatile uint32_t dtxfsts;
++	/** Device IN Endpoint DMA Buffer Register. <i>Offset:900h +
++	 * (ep_num * 20h) + 1Ch</i> */
++	volatile uint32_t diepdmab;
++} dwc_otg_dev_in_ep_regs_t;
++
++/**
++ * Device Logical OUT Endpoint-Specific Registers. <i>Offsets:
++ * B00h-CFCh</i>
++ *
++ * There will be one set of endpoint registers per logical endpoint
++ * implemented.
++ *
++ * <i>These registers are visible only in Device mode and must not be
++ * accessed in Host mode, as the results are unknown.</i>
++ */
++typedef struct dwc_otg_dev_out_ep_regs {
++	/** Device OUT Endpoint Control Register. <i>Offset:B00h +
++	 * (ep_num * 20h) + 00h</i> */
++	volatile uint32_t doepctl;
++	/** Reserved. <i>Offset:B00h + (ep_num * 20h) + 04h</i> */
++	uint32_t reserved04;
++	/** Device OUT Endpoint Interrupt Register. <i>Offset:B00h +
++	 * (ep_num * 20h) + 08h</i> */
++	volatile uint32_t doepint;
++	/** Reserved. <i>Offset:B00h + (ep_num * 20h) + 0Ch</i> */
++	uint32_t reserved0C;
++	/** Device OUT Endpoint Transfer Size Register. <i>Offset:
++	 * B00h + (ep_num * 20h) + 10h</i> */
++	volatile uint32_t doeptsiz;
++	/** Device OUT Endpoint DMA Address Register. <i>Offset:B00h
++	 * + (ep_num * 20h) + 14h</i> */
++	volatile uint32_t doepdma;
++	/** Reserved. <i>Offset:B00h + 	 * (ep_num * 20h) + 18h</i> */
++	uint32_t unused;
++	/** Device OUT Endpoint DMA Buffer Register. <i>Offset:B00h
++	 * + (ep_num * 20h) + 1Ch</i> */
++	uint32_t doepdmab;
++} dwc_otg_dev_out_ep_regs_t;
++
++/**
++ * This union represents the bit fields in the Device EP Control
++ * Register.  Read the register into the <i>d32</i> member then
++ * set/clear the bits using the <i>b</i>it elements.
++ */
++typedef union depctl_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** Maximum Packet Size
++		 * IN/OUT EPn
++		 * IN/OUT EP0 - 2 bits
++		 *	 2'b00: 64 Bytes
++		 *	 2'b01: 32
++		 *	 2'b10: 16
++		 *	 2'b11: 8 */
++		unsigned mps:11;
++#define DWC_DEP0CTL_MPS_64	 0
++#define DWC_DEP0CTL_MPS_32	 1
++#define DWC_DEP0CTL_MPS_16	 2
++#define DWC_DEP0CTL_MPS_8	 3
++
++		/** Next Endpoint
++		 * IN EPn/IN EP0
++		 * OUT EPn/OUT EP0 - reserved */
++		unsigned nextep:4;
++
++		/** USB Active Endpoint */
++		unsigned usbactep:1;
++
++		/** Endpoint DPID (INTR/Bulk IN and OUT endpoints)
++		 * This field contains the PID of the packet going to
++		 * be received or transmitted on this endpoint. The
++		 * application should program the PID of the first
++		 * packet going to be received or transmitted on this
++		 * endpoint , after the endpoint is
++		 * activated. Application use the SetD1PID and
++		 * SetD0PID fields of this register to program either
++		 * D0 or D1 PID.
++		 *
++		 * The encoding for this field is
++		 *	 - 0: D0
++		 *	 - 1: D1
++		 */
++		unsigned dpid:1;
++
++		/** NAK Status */
++		unsigned naksts:1;
++
++		/** Endpoint Type
++		 *	2'b00: Control
++		 *	2'b01: Isochronous
++		 *	2'b10: Bulk
++		 *	2'b11: Interrupt */
++		unsigned eptype:2;
++
++		/** Snoop Mode
++		 * OUT EPn/OUT EP0
++		 * IN EPn/IN EP0 - reserved */
++		unsigned snp:1;
++
++		/** Stall Handshake */
++		unsigned stall:1;
++
++		/** Tx Fifo Number
++		 * IN EPn/IN EP0
++		 * OUT EPn/OUT EP0 - reserved */
++		unsigned txfnum:4;
++
++		/** Clear NAK */
++		unsigned cnak:1;
++		/** Set NAK */
++		unsigned snak:1;
++		/** Set DATA0 PID (INTR/Bulk IN and OUT endpoints)
++		 * Writing to this field sets the Endpoint DPID (DPID)
++		 * field in this register to DATA0. Set Even
++		 * (micro)frame (SetEvenFr) (ISO IN and OUT Endpoints)
++		 * Writing to this field sets the Even/Odd
++		 * (micro)frame (EO_FrNum) field to even (micro)
++		 * frame.
++		 */
++		unsigned setd0pid:1;
++		/** Set DATA1 PID (INTR/Bulk IN and OUT endpoints)
++		 * Writing to this field sets the Endpoint DPID (DPID)
++		 * field in this register to DATA1 Set Odd
++		 * (micro)frame (SetOddFr) (ISO IN and OUT Endpoints)
++		 * Writing to this field sets the Even/Odd
++		 * (micro)frame (EO_FrNum) field to odd (micro) frame.
++		 */
++		unsigned setd1pid:1;
++
++		/** Endpoint Disable */
++		unsigned epdis:1;
++		/** Endpoint Enable */
++		unsigned epena:1;
++	} b;
++} depctl_data_t;
++
++/**
++ * This union represents the bit fields in the Device EP Transfer
++ * Size Register.  Read the register into the <i>d32</i> member then
++ * set/clear the bits using the <i>b</i>it elements.
++ */
++typedef union deptsiz_data {
++		/** raw register data */
++	uint32_t d32;
++		/** register bits */
++	struct {
++		/** Transfer size */
++		unsigned xfersize:19;
++/** Max packet count for EP (pow(2,10)-1) */
++#define MAX_PKT_CNT 1023
++		/** Packet Count */
++		unsigned pktcnt:10;
++		/** Multi Count - Periodic IN endpoints */
++		unsigned mc:2;
++		unsigned reserved:1;
++	} b;
++} deptsiz_data_t;
++
++/**
++ * This union represents the bit fields in the Device EP 0 Transfer
++ * Size Register.  Read the register into the <i>d32</i> member then
++ * set/clear the bits using the <i>b</i>it elements.
++ */
++typedef union deptsiz0_data {
++		/** raw register data */
++	uint32_t d32;
++		/** register bits */
++	struct {
++		/** Transfer size */
++		unsigned xfersize:7;
++				/** Reserved */
++		unsigned reserved7_18:12;
++		/** Packet Count */
++		unsigned pktcnt:2;
++				/** Reserved */
++		unsigned reserved21_28:8;
++				/**Setup Packet Count (DOEPTSIZ0 Only) */
++		unsigned supcnt:2;
++		unsigned reserved31;
++	} b;
++} deptsiz0_data_t;
++
++/////////////////////////////////////////////////
++// DMA Descriptor Specific Structures
++//
++
++/** Buffer status definitions */
++
++#define BS_HOST_READY	0x0
++#define BS_DMA_BUSY		0x1
++#define BS_DMA_DONE		0x2
++#define BS_HOST_BUSY	0x3
++
++/** Receive/Transmit status definitions */
++
++#define RTS_SUCCESS		0x0
++#define RTS_BUFFLUSH	0x1
++#define RTS_RESERVED	0x2
++#define RTS_BUFERR		0x3
++
++/**
++ * This union represents the bit fields in the DMA Descriptor
++ * status quadlet. Read the quadlet into the <i>d32</i> member then
++ * set/clear the bits using the <i>b</i>it, <i>b_iso_out</i> and
++ * <i>b_iso_in</i> elements.
++ */
++typedef union dev_dma_desc_sts {
++		/** raw register data */
++	uint32_t d32;
++		/** quadlet bits */
++	struct {
++		/** Received number of bytes */
++		unsigned bytes:16;
++		/** NAK bit - only for OUT EPs */
++		unsigned nak:1;
++		unsigned reserved17_22:6;
++		/** Multiple Transfer - only for OUT EPs */
++		unsigned mtrf:1;
++		/** Setup Packet received - only for OUT EPs */
++		unsigned sr:1;
++		/** Interrupt On Complete */
++		unsigned ioc:1;
++		/** Short Packet */
++		unsigned sp:1;
++		/** Last */
++		unsigned l:1;
++		/** Receive Status */
++		unsigned sts:2;
++		/** Buffer Status */
++		unsigned bs:2;
++	} b;
++
++//#ifdef DWC_EN_ISOC
++		/** iso out quadlet bits */
++	struct {
++		/** Received number of bytes */
++		unsigned rxbytes:11;
++
++		unsigned reserved11:1;
++		/** Frame Number */
++		unsigned framenum:11;
++		/** Received ISO Data PID */
++		unsigned pid:2;
++		/** Interrupt On Complete */
++		unsigned ioc:1;
++		/** Short Packet */
++		unsigned sp:1;
++		/** Last */
++		unsigned l:1;
++		/** Receive Status */
++		unsigned rxsts:2;
++		/** Buffer Status */
++		unsigned bs:2;
++	} b_iso_out;
++
++		/** iso in quadlet bits */
++	struct {
++		/** Transmited number of bytes */
++		unsigned txbytes:12;
++		/** Frame Number */
++		unsigned framenum:11;
++		/** Transmited ISO Data PID */
++		unsigned pid:2;
++		/** Interrupt On Complete */
++		unsigned ioc:1;
++		/** Short Packet */
++		unsigned sp:1;
++		/** Last */
++		unsigned l:1;
++		/** Transmit Status */
++		unsigned txsts:2;
++		/** Buffer Status */
++		unsigned bs:2;
++	} b_iso_in;
++//#endif                                /* DWC_EN_ISOC */
++} dev_dma_desc_sts_t;
++
++/**
++ * DMA Descriptor structure
++ *
++ * DMA Descriptor structure contains two quadlets:
++ * Status quadlet and Data buffer pointer.
++ */
++typedef struct dwc_otg_dev_dma_desc {
++	/** DMA Descriptor status quadlet */
++	dev_dma_desc_sts_t status;
++	/** DMA Descriptor data buffer pointer */
++	uint32_t buf;
++} dwc_otg_dev_dma_desc_t;
++
++/**
++ * The dwc_otg_dev_if structure contains information needed to manage
++ * the DWC_otg controller acting in device mode. It represents the
++ * programming view of the device-specific aspects of the controller.
++ */
++typedef struct dwc_otg_dev_if {
++	/** Pointer to device Global registers.
++	 * Device Global Registers starting at offset 800h
++	 */
++	dwc_otg_device_global_regs_t *dev_global_regs;
++#define DWC_DEV_GLOBAL_REG_OFFSET 0x800
++
++	/**
++	 * Device Logical IN Endpoint-Specific Registers 900h-AFCh
++	 */
++	dwc_otg_dev_in_ep_regs_t *in_ep_regs[MAX_EPS_CHANNELS];
++#define DWC_DEV_IN_EP_REG_OFFSET 0x900
++#define DWC_EP_REG_OFFSET 0x20
++
++	/** Device Logical OUT Endpoint-Specific Registers B00h-CFCh */
++	dwc_otg_dev_out_ep_regs_t *out_ep_regs[MAX_EPS_CHANNELS];
++#define DWC_DEV_OUT_EP_REG_OFFSET 0xB00
++
++	/* Device configuration information */
++	uint8_t speed;				 /**< Device Speed	0: Unknown, 1: LS, 2:FS, 3: HS */
++	uint8_t num_in_eps;		 /**< Number # of Tx EP range: 0-15 exept ep0 */
++	uint8_t num_out_eps;		 /**< Number # of Rx EP range: 0-15 exept ep 0*/
++
++	/** Size of periodic FIFOs (Bytes) */
++	uint16_t perio_tx_fifo_size[MAX_PERIO_FIFOS];
++
++	/** Size of Tx FIFOs (Bytes) */
++	uint16_t tx_fifo_size[MAX_TX_FIFOS];
++
++	/** Thresholding enable flags and length varaiables **/
++	uint16_t rx_thr_en;
++	uint16_t iso_tx_thr_en;
++	uint16_t non_iso_tx_thr_en;
++
++	uint16_t rx_thr_length;
++	uint16_t tx_thr_length;
++
++	/**
++	 * Pointers to the DMA Descriptors for EP0 Control
++	 * transfers (virtual and physical)
++	 */
++
++	/** 2 descriptors for SETUP packets */
++	dwc_dma_t dma_setup_desc_addr[2];
++	dwc_otg_dev_dma_desc_t *setup_desc_addr[2];
++
++	/** Pointer to Descriptor with latest SETUP packet */
++	dwc_otg_dev_dma_desc_t *psetup;
++
++	/** Index of current SETUP handler descriptor */
++	uint32_t setup_desc_index;
++
++	/** Descriptor for Data In or Status In phases */
++	dwc_dma_t dma_in_desc_addr;
++	dwc_otg_dev_dma_desc_t *in_desc_addr;
++
++	/** Descriptor for Data Out or Status Out phases */
++	dwc_dma_t dma_out_desc_addr;
++	dwc_otg_dev_dma_desc_t *out_desc_addr;
++
++	/** Setup Packet Detected - if set clear NAK when queueing */
++	uint32_t spd;
++	/** Isoc ep pointer on which incomplete happens */
++	void *isoc_ep;
++
++} dwc_otg_dev_if_t;
++
++/////////////////////////////////////////////////
++// Host Mode Register Structures
++//
++/**
++ * The Host Global Registers structure defines the size and relative
++ * field offsets for the Host Mode Global Registers.  Host Global
++ * Registers offsets 400h-7FFh.
++*/
++typedef struct dwc_otg_host_global_regs {
++	/** Host Configuration Register.   <i>Offset: 400h</i> */
++	volatile uint32_t hcfg;
++	/** Host Frame Interval Register.	<i>Offset: 404h</i> */
++	volatile uint32_t hfir;
++	/** Host Frame Number / Frame Remaining Register. <i>Offset: 408h</i> */
++	volatile uint32_t hfnum;
++	/** Reserved.	<i>Offset: 40Ch</i> */
++	uint32_t reserved40C;
++	/** Host Periodic Transmit FIFO/ Queue Status Register. <i>Offset: 410h</i> */
++	volatile uint32_t hptxsts;
++	/** Host All Channels Interrupt Register. <i>Offset: 414h</i> */
++	volatile uint32_t haint;
++	/** Host All Channels Interrupt Mask Register. <i>Offset: 418h</i> */
++	volatile uint32_t haintmsk;
++	/** Host Frame List Base Address Register . <i>Offset: 41Ch</i> */
++	volatile uint32_t hflbaddr;
++} dwc_otg_host_global_regs_t;
++
++/**
++ * This union represents the bit fields in the Host Configuration Register.
++ * Read the register into the <i>d32</i> member then set/clear the bits using
++ * the <i>b</i>it elements. Write the <i>d32</i> member to the hcfg register.
++ */
++typedef union hcfg_data {
++	/** raw register data */
++	uint32_t d32;
++
++	/** register bits */
++	struct {
++		/** FS/LS Phy Clock Select */
++		unsigned fslspclksel:2;
++#define DWC_HCFG_30_60_MHZ 0
++#define DWC_HCFG_48_MHZ	   1
++#define DWC_HCFG_6_MHZ	   2
++
++		/** FS/LS Only Support */
++		unsigned fslssupp:1;
++		unsigned reserved3_6:4;
++		/** Enable 32-KHz Suspend Mode */
++		unsigned ena32khzs:1;
++		/** Resume Validation Periiod */
++		unsigned resvalid:8;
++		unsigned reserved16_22:7;
++		/** Enable Scatter/gather DMA in Host mode */
++		unsigned descdma:1;
++		/** Frame List Entries */
++		unsigned frlisten:2;
++		/** Enable Periodic Scheduling */
++		unsigned perschedena:1;
++		unsigned reserved27_30:4;
++		unsigned modechtimen:1;
++	} b;
++} hcfg_data_t;
++
++/**
++ * This union represents the bit fields in the Host Frame Remaing/Number
++ * Register.
++ */
++typedef union hfir_data {
++	/** raw register data */
++	uint32_t d32;
++
++	/** register bits */
++	struct {
++		unsigned frint:16;
++		unsigned hfirrldctrl:1;
++		unsigned reserved:15;
++	} b;
++} hfir_data_t;
++
++/**
++ * This union represents the bit fields in the Host Frame Remaing/Number
++ * Register.
++ */
++typedef union hfnum_data {
++	/** raw register data */
++	uint32_t d32;
++
++	/** register bits */
++	struct {
++		unsigned frnum:16;
++#define DWC_HFNUM_MAX_FRNUM 0x3FFF
++		unsigned frrem:16;
++	} b;
++} hfnum_data_t;
++
++typedef union hptxsts_data {
++	/** raw register data */
++	uint32_t d32;
++
++	/** register bits */
++	struct {
++		unsigned ptxfspcavail:16;
++		unsigned ptxqspcavail:8;
++		/** Top of the Periodic Transmit Request Queue
++		 *	- bit 24 - Terminate (last entry for the selected channel)
++		 *	- bits 26:25 - Token Type
++		 *	  - 2'b00 - Zero length
++		 *	  - 2'b01 - Ping
++		 *	  - 2'b10 - Disable
++		 *	- bits 30:27 - Channel Number
++		 *	- bit 31 - Odd/even microframe
++		 */
++		unsigned ptxqtop_terminate:1;
++		unsigned ptxqtop_token:2;
++		unsigned ptxqtop_chnum:4;
++		unsigned ptxqtop_odd:1;
++	} b;
++} hptxsts_data_t;
++
++/**
++ * This union represents the bit fields in the Host Port Control and Status
++ * Register. Read the register into the <i>d32</i> member then set/clear the
++ * bits using the <i>b</i>it elements. Write the <i>d32</i> member to the
++ * hprt0 register.
++ */
++typedef union hprt0_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned prtconnsts:1;
++		unsigned prtconndet:1;
++		unsigned prtena:1;
++		unsigned prtenchng:1;
++		unsigned prtovrcurract:1;
++		unsigned prtovrcurrchng:1;
++		unsigned prtres:1;
++		unsigned prtsusp:1;
++		unsigned prtrst:1;
++		unsigned reserved9:1;
++		unsigned prtlnsts:2;
++		unsigned prtpwr:1;
++		unsigned prttstctl:4;
++		unsigned prtspd:2;
++#define DWC_HPRT0_PRTSPD_HIGH_SPEED 0
++#define DWC_HPRT0_PRTSPD_FULL_SPEED 1
++#define DWC_HPRT0_PRTSPD_LOW_SPEED	2
++		unsigned reserved19_31:13;
++	} b;
++} hprt0_data_t;
++
++/**
++ * This union represents the bit fields in the Host All Interrupt
++ * Register.
++ */
++typedef union haint_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned ch0:1;
++		unsigned ch1:1;
++		unsigned ch2:1;
++		unsigned ch3:1;
++		unsigned ch4:1;
++		unsigned ch5:1;
++		unsigned ch6:1;
++		unsigned ch7:1;
++		unsigned ch8:1;
++		unsigned ch9:1;
++		unsigned ch10:1;
++		unsigned ch11:1;
++		unsigned ch12:1;
++		unsigned ch13:1;
++		unsigned ch14:1;
++		unsigned ch15:1;
++		unsigned reserved:16;
++	} b;
++
++	struct {
++		unsigned chint:16;
++		unsigned reserved:16;
++	} b2;
++} haint_data_t;
++
++/**
++ * This union represents the bit fields in the Host All Interrupt
++ * Register.
++ */
++typedef union haintmsk_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned ch0:1;
++		unsigned ch1:1;
++		unsigned ch2:1;
++		unsigned ch3:1;
++		unsigned ch4:1;
++		unsigned ch5:1;
++		unsigned ch6:1;
++		unsigned ch7:1;
++		unsigned ch8:1;
++		unsigned ch9:1;
++		unsigned ch10:1;
++		unsigned ch11:1;
++		unsigned ch12:1;
++		unsigned ch13:1;
++		unsigned ch14:1;
++		unsigned ch15:1;
++		unsigned reserved:16;
++	} b;
++
++	struct {
++		unsigned chint:16;
++		unsigned reserved:16;
++	} b2;
++} haintmsk_data_t;
++
++/**
++ * Host Channel Specific Registers. <i>500h-5FCh</i>
++ */
++typedef struct dwc_otg_hc_regs {
++	/** Host Channel 0 Characteristic Register. <i>Offset: 500h + (chan_num * 20h) + 00h</i> */
++	volatile uint32_t hcchar;
++	/** Host Channel 0 Split Control Register. <i>Offset: 500h + (chan_num * 20h) + 04h</i> */
++	volatile uint32_t hcsplt;
++	/** Host Channel 0 Interrupt Register. <i>Offset: 500h + (chan_num * 20h) + 08h</i> */
++	volatile uint32_t hcint;
++	/** Host Channel 0 Interrupt Mask Register. <i>Offset: 500h + (chan_num * 20h) + 0Ch</i> */
++	volatile uint32_t hcintmsk;
++	/** Host Channel 0 Transfer Size Register. <i>Offset: 500h + (chan_num * 20h) + 10h</i> */
++	volatile uint32_t hctsiz;
++	/** Host Channel 0 DMA Address Register. <i>Offset: 500h + (chan_num * 20h) + 14h</i> */
++	volatile uint32_t hcdma;
++	volatile uint32_t reserved;
++	/** Host Channel 0 DMA Buffer Address Register. <i>Offset: 500h + (chan_num * 20h) + 1Ch</i> */
++	volatile uint32_t hcdmab;
++} dwc_otg_hc_regs_t;
++
++/**
++ * This union represents the bit fields in the Host Channel Characteristics
++ * Register. Read the register into the <i>d32</i> member then set/clear the
++ * bits using the <i>b</i>it elements. Write the <i>d32</i> member to the
++ * hcchar register.
++ */
++typedef union hcchar_data {
++	/** raw register data */
++	uint32_t d32;
++
++	/** register bits */
++	struct {
++		/** Maximum packet size in bytes */
++		unsigned mps:11;
++
++		/** Endpoint number */
++		unsigned epnum:4;
++
++		/** 0: OUT, 1: IN */
++		unsigned epdir:1;
++
++		unsigned reserved:1;
++
++		/** 0: Full/high speed device, 1: Low speed device */
++		unsigned lspddev:1;
++
++		/** 0: Control, 1: Isoc, 2: Bulk, 3: Intr */
++		unsigned eptype:2;
++
++		/** Packets per frame for periodic transfers. 0 is reserved. */
++		unsigned multicnt:2;
++
++		/** Device address */
++		unsigned devaddr:7;
++
++		/**
++		 * Frame to transmit periodic transaction.
++		 * 0: even, 1: odd
++		 */
++		unsigned oddfrm:1;
++
++		/** Channel disable */
++		unsigned chdis:1;
++
++		/** Channel enable */
++		unsigned chen:1;
++	} b;
++} hcchar_data_t;
++
++typedef union hcsplt_data {
++	/** raw register data */
++	uint32_t d32;
++
++	/** register bits */
++	struct {
++		/** Port Address */
++		unsigned prtaddr:7;
++
++		/** Hub Address */
++		unsigned hubaddr:7;
++
++		/** Transaction Position */
++		unsigned xactpos:2;
++#define DWC_HCSPLIT_XACTPOS_MID 0
++#define DWC_HCSPLIT_XACTPOS_END 1
++#define DWC_HCSPLIT_XACTPOS_BEGIN 2
++#define DWC_HCSPLIT_XACTPOS_ALL 3
++
++		/** Do Complete Split */
++		unsigned compsplt:1;
++
++		/** Reserved */
++		unsigned reserved:14;
++
++		/** Split Enble */
++		unsigned spltena:1;
++	} b;
++} hcsplt_data_t;
++
++/**
++ * This union represents the bit fields in the Host All Interrupt
++ * Register.
++ */
++typedef union hcint_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** Transfer Complete */
++		unsigned xfercomp:1;
++		/** Channel Halted */
++		unsigned chhltd:1;
++		/** AHB Error */
++		unsigned ahberr:1;
++		/** STALL Response Received */
++		unsigned stall:1;
++		/** NAK Response Received */
++		unsigned nak:1;
++		/** ACK Response Received */
++		unsigned ack:1;
++		/** NYET Response Received */
++		unsigned nyet:1;
++		/** Transaction Err */
++		unsigned xacterr:1;
++		/** Babble Error */
++		unsigned bblerr:1;
++		/** Frame Overrun */
++		unsigned frmovrun:1;
++		/** Data Toggle Error */
++		unsigned datatglerr:1;
++		/** Buffer Not Available (only for DDMA mode) */
++		unsigned bna:1;
++		/** Exessive transaction error (only for DDMA mode) */
++		unsigned xcs_xact:1;
++		/** Frame List Rollover interrupt */
++		unsigned frm_list_roll:1;
++		/** Reserved */
++		unsigned reserved14_31:18;
++	} b;
++} hcint_data_t;
++
++/**
++ * This union represents the bit fields in the Host Channel Interrupt Mask
++ * Register. Read the register into the <i>d32</i> member then set/clear the
++ * bits using the <i>b</i>it elements. Write the <i>d32</i> member to the
++ * hcintmsk register.
++ */
++typedef union hcintmsk_data {
++	/** raw register data */
++	uint32_t d32;
++
++	/** register bits */
++	struct {
++		unsigned xfercompl:1;
++		unsigned chhltd:1;
++		unsigned ahberr:1;
++		unsigned stall:1;
++		unsigned nak:1;
++		unsigned ack:1;
++		unsigned nyet:1;
++		unsigned xacterr:1;
++		unsigned bblerr:1;
++		unsigned frmovrun:1;
++		unsigned datatglerr:1;
++		unsigned bna:1;
++		unsigned xcs_xact:1;
++		unsigned frm_list_roll:1;
++		unsigned reserved14_31:18;
++	} b;
++} hcintmsk_data_t;
++
++/**
++ * This union represents the bit fields in the Host Channel Transfer Size
++ * Register. Read the register into the <i>d32</i> member then set/clear the
++ * bits using the <i>b</i>it elements. Write the <i>d32</i> member to the
++ * hcchar register.
++ */
++
++typedef union hctsiz_data {
++	/** raw register data */
++	uint32_t d32;
++
++	/** register bits */
++	struct {
++		/** Total transfer size in bytes */
++		unsigned xfersize:19;
++
++		/** Data packets to transfer */
++		unsigned pktcnt:10;
++
++		/**
++		 * Packet ID for next data packet
++		 * 0: DATA0
++		 * 1: DATA2
++		 * 2: DATA1
++		 * 3: MDATA (non-Control), SETUP (Control)
++		 */
++		unsigned pid:2;
++#define DWC_HCTSIZ_DATA0 0
++#define DWC_HCTSIZ_DATA1 2
++#define DWC_HCTSIZ_DATA2 1
++#define DWC_HCTSIZ_MDATA 3
++#define DWC_HCTSIZ_SETUP 3
++
++		/** Do PING protocol when 1 */
++		unsigned dopng:1;
++	} b;
++
++	/** register bits */
++	struct {
++		/** Scheduling information */
++		unsigned schinfo:8;
++
++		/** Number of transfer descriptors.
++		 * Max value:
++		 * 64 in general,
++		 * 256 only for HS isochronous endpoint.
++		 */
++		unsigned ntd:8;
++
++		/** Data packets to transfer */
++		unsigned reserved16_28:13;
++
++		/**
++		 * Packet ID for next data packet
++		 * 0: DATA0
++		 * 1: DATA2
++		 * 2: DATA1
++		 * 3: MDATA (non-Control)
++		 */
++		unsigned pid:2;
++
++		/** Do PING protocol when 1 */
++		unsigned dopng:1;
++	} b_ddma;
++} hctsiz_data_t;
++
++/**
++ * This union represents the bit fields in the Host DMA Address
++ * Register used in Descriptor DMA mode.
++ */
++typedef union hcdma_data {
++	/** raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		unsigned reserved0_2:3;
++		/** Current Transfer Descriptor. Not used for ISOC */
++		unsigned ctd:8;
++		/** Start Address of Descriptor List */
++		unsigned dma_addr:21;
++	} b;
++} hcdma_data_t;
++
++/**
++ * This union represents the bit fields in the DMA Descriptor
++ * status quadlet for host mode. Read the quadlet into the <i>d32</i> member then
++ * set/clear the bits using the <i>b</i>it elements.
++ */
++typedef union host_dma_desc_sts {
++	/** raw register data */
++	uint32_t d32;
++	/** quadlet bits */
++
++	/* for non-isochronous  */
++	struct {
++		/** Number of bytes */
++		unsigned n_bytes:17;
++		/** QTD offset to jump when Short Packet received - only for IN EPs */
++		unsigned qtd_offset:6;
++		/**
++		 * Set to request the core to jump to alternate QTD if
++		 * Short Packet received - only for IN EPs
++		 */
++		unsigned a_qtd:1;
++		 /**
++		  * Setup Packet bit. When set indicates that buffer contains
++		  * setup packet.
++		  */
++		unsigned sup:1;
++		/** Interrupt On Complete */
++		unsigned ioc:1;
++		/** End of List */
++		unsigned eol:1;
++		unsigned reserved27:1;
++		/** Rx/Tx Status */
++		unsigned sts:2;
++#define DMA_DESC_STS_PKTERR	1
++		unsigned reserved30:1;
++		/** Active Bit */
++		unsigned a:1;
++	} b;
++	/* for isochronous */
++	struct {
++		/** Number of bytes */
++		unsigned n_bytes:12;
++		unsigned reserved12_24:13;
++		/** Interrupt On Complete */
++		unsigned ioc:1;
++		unsigned reserved26_27:2;
++		/** Rx/Tx Status */
++		unsigned sts:2;
++		unsigned reserved30:1;
++		/** Active Bit */
++		unsigned a:1;
++	} b_isoc;
++} host_dma_desc_sts_t;
++
++#define	MAX_DMA_DESC_SIZE		131071
++#define MAX_DMA_DESC_NUM_GENERIC	64
++#define MAX_DMA_DESC_NUM_HS_ISOC	256
++#define MAX_FRLIST_EN_NUM		64
++/**
++ * Host-mode DMA Descriptor structure
++ *
++ * DMA Descriptor structure contains two quadlets:
++ * Status quadlet and Data buffer pointer.
++ */
++typedef struct dwc_otg_host_dma_desc {
++	/** DMA Descriptor status quadlet */
++	host_dma_desc_sts_t status;
++	/** DMA Descriptor data buffer pointer */
++	uint32_t buf;
++} dwc_otg_host_dma_desc_t;
++
++/** OTG Host Interface Structure.
++ *
++ * The OTG Host Interface Structure structure contains information
++ * needed to manage the DWC_otg controller acting in host mode. It
++ * represents the programming view of the host-specific aspects of the
++ * controller.
++ */
++typedef struct dwc_otg_host_if {
++	/** Host Global Registers starting at offset 400h.*/
++	dwc_otg_host_global_regs_t *host_global_regs;
++#define DWC_OTG_HOST_GLOBAL_REG_OFFSET 0x400
++
++	/** Host Port 0 Control and Status Register */
++	volatile uint32_t *hprt0;
++#define DWC_OTG_HOST_PORT_REGS_OFFSET 0x440
++
++	/** Host Channel Specific Registers at offsets 500h-5FCh. */
++	dwc_otg_hc_regs_t *hc_regs[MAX_EPS_CHANNELS];
++#define DWC_OTG_HOST_CHAN_REGS_OFFSET 0x500
++#define DWC_OTG_CHAN_REGS_OFFSET 0x20
++
++	/* Host configuration information */
++	/** Number of Host Channels (range: 1-16) */
++	uint8_t num_host_channels;
++	/** Periodic EPs supported (0: no, 1: yes) */
++	uint8_t perio_eps_supported;
++	/** Periodic Tx FIFO Size (Only 1 host periodic Tx FIFO) */
++	uint16_t perio_tx_fifo_size;
++
++} dwc_otg_host_if_t;
++
++/**
++ * This union represents the bit fields in the Power and Clock Gating Control
++ * Register. Read the register into the <i>d32</i> member then set/clear the
++ * bits using the <i>b</i>it elements.
++ */
++typedef union pcgcctl_data {
++	/** raw register data */
++	uint32_t d32;
++
++	/** register bits */
++	struct {
++		/** Stop Pclk */
++		unsigned stoppclk:1;
++		/** Gate Hclk */
++		unsigned gatehclk:1;
++		/** Power Clamp */
++		unsigned pwrclmp:1;
++		/** Reset Power Down Modules */
++		unsigned rstpdwnmodule:1;
++		/** Reserved */
++		unsigned reserved:1;
++		/** Enable Sleep Clock Gating (Enbl_L1Gating) */
++		unsigned enbl_sleep_gating:1;
++		/** PHY In Sleep (PhySleep) */
++		unsigned phy_in_sleep:1;
++		/** Deep Sleep*/
++		unsigned deep_sleep:1;
++		unsigned resetaftsusp:1;
++		unsigned restoremode:1;
++		unsigned enbl_extnd_hiber:1;
++		unsigned extnd_hiber_pwrclmp:1;
++		unsigned extnd_hiber_switch:1;
++		unsigned ess_reg_restored:1;
++		unsigned prt_clk_sel:2;
++		unsigned port_power:1;
++		unsigned max_xcvrselect:2;
++		unsigned max_termsel:1;
++		unsigned mac_dev_addr:7;
++		unsigned p2hd_dev_enum_spd:2;
++		unsigned p2hd_prt_spd:2;
++		unsigned if_dev_mode:1;
++	} b;
++} pcgcctl_data_t;
++
++/**
++ * This union represents the bit fields in the Global Data FIFO Software
++ * Configuration Register. Read the register into the <i>d32</i> member then
++ * set/clear the bits using the <i>b</i>it elements.
++ */
++typedef union gdfifocfg_data {
++	/* raw register data */
++	uint32_t d32;
++	/** register bits */
++	struct {
++		/** OTG Data FIFO depth */
++		unsigned gdfifocfg:16;
++		/** Start address of EP info controller */
++		unsigned epinfobase:16;
++	} b;
++} gdfifocfg_data_t;
++
++/**
++ * This union represents the bit fields in the Global Power Down Register
++ * Register. Read the register into the <i>d32</i> member then set/clear the
++ * bits using the <i>b</i>it elements.
++ */
++typedef union gpwrdn_data {
++	/* raw register data */
++	uint32_t d32;
++
++	/** register bits */
++	struct {
++		/** PMU Interrupt Select */
++		unsigned pmuintsel:1;
++		/** PMU Active */
++		unsigned pmuactv:1;
++		/** Restore */
++		unsigned restore:1;
++		/** Power Down Clamp */
++		unsigned pwrdnclmp:1;
++		/** Power Down Reset */
++		unsigned pwrdnrstn:1;
++		/** Power Down Switch */
++		unsigned pwrdnswtch:1;
++		/** Disable VBUS */
++		unsigned dis_vbus:1;
++		/** Line State Change */
++		unsigned lnstschng:1;
++		/** Line state change mask */
++		unsigned lnstchng_msk:1;
++		/** Reset Detected */
++		unsigned rst_det:1;
++		/** Reset Detect mask */
++		unsigned rst_det_msk:1;
++		/** Disconnect Detected */
++		unsigned disconn_det:1;
++		/** Disconnect Detect mask */
++		unsigned disconn_det_msk:1;
++		/** Connect Detected*/
++		unsigned connect_det:1;
++		/** Connect Detected Mask*/
++		unsigned connect_det_msk:1;
++		/** SRP Detected */
++		unsigned srp_det:1;
++		/** SRP Detect mask */
++		unsigned srp_det_msk:1;
++		/** Status Change Interrupt */
++		unsigned sts_chngint:1;
++		/** Status Change Interrupt Mask */
++		unsigned sts_chngint_msk:1;
++		/** Line State */
++		unsigned linestate:2;
++		/** Indicates current mode(status of IDDIG signal) */
++		unsigned idsts:1;
++		/** B Session Valid signal status*/
++		unsigned bsessvld:1;
++		/** ADP Event Detected */
++		unsigned adp_int:1;
++		/** Multi Valued ID pin */
++		unsigned mult_val_id_bc:5;
++		/** Reserved 24_31 */
++		unsigned reserved29_31:3;
++	} b;
++} gpwrdn_data_t;
++
++#endif
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/test/Makefile
+@@ -0,0 +1,16 @@
++
++PERL=/usr/bin/perl
++PL_TESTS=test_sysfs.pl test_mod_param.pl
++
++.PHONY : test
++test : perl_tests
++
++perl_tests :
++	@echo
++	@echo Running perl tests
++	@for test in $(PL_TESTS); do \
++	  if $(PERL) ./$$test ; then \
++	    echo "=======> $$test, PASSED" ; \
++	  else echo "=======> $$test, FAILED" ; \
++	  fi \
++	done
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/test/dwc_otg_test.pm
+@@ -0,0 +1,337 @@
++package dwc_otg_test;
++
++use strict;
++use Exporter ();
++
++use vars qw(@ISA @EXPORT
++$sysfsdir $paramdir $errors $params
++);
++
++@ISA = qw(Exporter);
++
++#
++# Globals
++#
++$sysfsdir = "/sys/devices/lm0";
++$paramdir = "/sys/module/dwc_otg";
++$errors = 0;
++
++$params = [
++	   {
++	    NAME => "otg_cap",
++	    DEFAULT => 0,
++	    ENUM => [],
++	    LOW => 0,
++	    HIGH => 2
++	   },
++	   {
++	    NAME => "dma_enable",
++	    DEFAULT => 0,
++	    ENUM => [],
++	    LOW => 0,
++	    HIGH => 1
++	   },
++	   {
++	    NAME => "dma_burst_size",
++	    DEFAULT => 32,
++	    ENUM => [1, 4, 8, 16, 32, 64, 128, 256],
++	    LOW => 1,
++	    HIGH => 256
++	   },
++	   {
++	    NAME => "host_speed",
++	    DEFAULT => 0,
++	    ENUM => [],
++	    LOW => 0,
++	    HIGH => 1
++	   },
++	   {
++	    NAME => "host_support_fs_ls_low_power",
++	    DEFAULT => 0,
++	    ENUM => [],
++	    LOW => 0,
++	    HIGH => 1
++	   },
++	   {
++	    NAME => "host_ls_low_power_phy_clk",
++	    DEFAULT => 0,
++	    ENUM => [],
++	    LOW => 0,
++	    HIGH => 1
++	   },
++	   {
++	    NAME => "dev_speed",
++	    DEFAULT => 0,
++	    ENUM => [],
++	    LOW => 0,
++	    HIGH => 1
++	   },
++	   {
++	    NAME => "enable_dynamic_fifo",
++	    DEFAULT => 1,
++	    ENUM => [],
++	    LOW => 0,
++	    HIGH => 1
++	   },
++	   {
++	    NAME => "data_fifo_size",
++	    DEFAULT => 8192,
++	    ENUM => [],
++	    LOW => 32,
++	    HIGH => 32768
++	   },
++	   {
++	    NAME => "dev_rx_fifo_size",
++	    DEFAULT => 1064,
++	    ENUM => [],
++	    LOW => 16,
++	    HIGH => 32768
++	   },
++	   {
++	    NAME => "dev_nperio_tx_fifo_size",
++	    DEFAULT => 1024,
++	    ENUM => [],
++	    LOW => 16,
++	    HIGH => 32768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_1",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_2",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_3",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_4",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_5",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_6",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_7",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_8",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_9",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_10",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_11",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_12",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_13",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_14",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "dev_perio_tx_fifo_size_15",
++	    DEFAULT => 256,
++	    ENUM => [],
++	    LOW => 4,
++	    HIGH => 768
++	   },
++	   {
++	    NAME => "host_rx_fifo_size",
++	    DEFAULT => 1024,
++	    ENUM => [],
++	    LOW => 16,
++	    HIGH => 32768
++	   },
++	   {
++	    NAME => "host_nperio_tx_fifo_size",
++	    DEFAULT => 1024,
++	    ENUM => [],
++	    LOW => 16,
++	    HIGH => 32768
++	   },
++	   {
++	    NAME => "host_perio_tx_fifo_size",
++	    DEFAULT => 1024,
++	    ENUM => [],
++	    LOW => 16,
++	    HIGH => 32768
++	   },
++	   {
++	    NAME => "max_transfer_size",
++	    DEFAULT => 65535,
++	    ENUM => [],
++	    LOW => 2047,
++	    HIGH => 65535
++	   },
++	   {
++	    NAME => "max_packet_count",
++	    DEFAULT => 511,
++	    ENUM => [],
++	    LOW => 15,
++	    HIGH => 511
++	   },
++	   {
++	    NAME => "host_channels",
++	    DEFAULT => 12,
++	    ENUM => [],
++	    LOW => 1,
++	    HIGH => 16
++	   },
++	   {
++	    NAME => "dev_endpoints",
++	    DEFAULT => 6,
++	    ENUM => [],
++	    LOW => 1,
++	    HIGH => 15
++	   },
++	   {
++	    NAME => "phy_type",
++	    DEFAULT => 1,
++	    ENUM => [],
++	    LOW => 0,
++	    HIGH => 2
++	   },
++	   {
++	    NAME => "phy_utmi_width",
++	    DEFAULT => 16,
++	    ENUM => [8, 16],
++	    LOW => 8,
++	    HIGH => 16
++	   },
++	   {
++	    NAME => "phy_ulpi_ddr",
++	    DEFAULT => 0,
++	    ENUM => [],
++	    LOW => 0,
++	    HIGH => 1
++	   },
++	  ];
++
++
++#
++#
++sub check_arch {
++  $_ = `uname -m`;
++  chomp;
++  unless (m/armv4tl/) {
++    warn "# \n# Can't execute on $_.  Run on integrator platform.\n# \n";
++    return 0;
++  }
++  return 1;
++}
++
++#
++#
++sub load_module {
++  my $params = shift;
++  print "\nRemoving Module\n";
++  system "rmmod dwc_otg";
++  print "Loading Module\n";
++  if ($params ne "") {
++    print "Module Parameters: $params\n";
++  }
++  if (system("modprobe dwc_otg $params")) {
++    warn "Unable to load module\n";
++    return 0;
++  }
++  return 1;
++}
++
++#
++#
++sub test_status {
++  my $arg = shift;
++
++  print "\n";
++
++  if (defined $arg) {
++    warn "WARNING: $arg\n";
++  }
++
++  if ($errors > 0) {
++    warn "TEST FAILED with $errors errors\n";
++    return 0;
++  } else {
++    print "TEST PASSED\n";
++    return 0 if (defined $arg);
++  }
++  return 1;
++}
++
++#
++#
++@EXPORT = qw(
++$sysfsdir
++$paramdir
++$params
++$errors
++check_arch
++load_module
++test_status
++);
++
++1;
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/test/test_mod_param.pl
+@@ -0,0 +1,133 @@
++#!/usr/bin/perl -w
++#
++# Run this program on the integrator.
++#
++# - Tests module parameter default values.
++# - Tests setting of valid module parameter values via modprobe.
++# - Tests invalid module parameter values.
++# -----------------------------------------------------------------------------
++use strict;
++use dwc_otg_test;
++
++check_arch() or die;
++
++#
++#
++sub test {
++  my ($param,$expected) = @_;
++  my $value = get($param);
++
++  if ($value == $expected) {
++    print "$param = $value, okay\n";
++  }
++
++  else {
++    warn "ERROR: value of $param != $expected, $value\n";
++    $errors ++;
++  }
++}
++
++#
++#
++sub get {
++  my $param = shift;
++  my $tmp = `cat $paramdir/$param`;
++  chomp $tmp;
++  return $tmp;
++}
++
++#
++#
++sub test_main {
++
++  print "\nTesting Module Parameters\n";
++
++  load_module("") or die;
++
++  # Test initial values
++  print "\nTesting Default Values\n";
++  foreach (@{$params}) {
++    test ($_->{NAME}, $_->{DEFAULT});
++  }
++
++  # Test low value
++  print "\nTesting Low Value\n";
++  my $cmd_params = "";
++  foreach (@{$params}) {
++    $cmd_params = $cmd_params . "$_->{NAME}=$_->{LOW} ";
++  }
++  load_module($cmd_params) or die;
++
++  foreach (@{$params}) {
++    test ($_->{NAME}, $_->{LOW});
++  }
++
++  # Test high value
++  print "\nTesting High Value\n";
++  $cmd_params = "";
++  foreach (@{$params}) {
++    $cmd_params = $cmd_params . "$_->{NAME}=$_->{HIGH} ";
++  }
++  load_module($cmd_params) or die;
++
++  foreach (@{$params}) {
++    test ($_->{NAME}, $_->{HIGH});
++  }
++
++  # Test Enum
++  print "\nTesting Enumerated\n";
++  foreach (@{$params}) {
++    if (defined $_->{ENUM}) {
++      my $value;
++      foreach $value (@{$_->{ENUM}}) {
++	$cmd_params = "$_->{NAME}=$value";
++	load_module($cmd_params) or die;
++	test ($_->{NAME}, $value);
++      }
++    }
++  }
++
++  # Test Invalid Values
++  print "\nTesting Invalid Values\n";
++  $cmd_params = "";
++  foreach (@{$params}) {
++    $cmd_params = $cmd_params . sprintf "$_->{NAME}=%d ", $_->{LOW}-1;
++  }
++  load_module($cmd_params) or die;
++
++  foreach (@{$params}) {
++    test ($_->{NAME}, $_->{DEFAULT});
++  }
++
++  $cmd_params = "";
++  foreach (@{$params}) {
++    $cmd_params = $cmd_params . sprintf "$_->{NAME}=%d ", $_->{HIGH}+1;
++  }
++  load_module($cmd_params) or die;
++
++  foreach (@{$params}) {
++    test ($_->{NAME}, $_->{DEFAULT});
++  }
++
++  print "\nTesting Enumerated\n";
++  foreach (@{$params}) {
++    if (defined $_->{ENUM}) {
++      my $value;
++      foreach $value (@{$_->{ENUM}}) {
++	$value = $value + 1;
++	$cmd_params = "$_->{NAME}=$value";
++	load_module($cmd_params) or die;
++	test ($_->{NAME}, $_->{DEFAULT});
++	$value = $value - 2;
++	$cmd_params = "$_->{NAME}=$value";
++	load_module($cmd_params) or die;
++	test ($_->{NAME}, $_->{DEFAULT});
++      }
++    }
++  }
++
++  test_status() or die;
++}
++
++test_main();
++0;
+--- /dev/null
++++ b/drivers/usb/host/dwc_otg/test/test_sysfs.pl
+@@ -0,0 +1,193 @@
++#!/usr/bin/perl -w
++#
++# Run this program on the integrator
++# - Tests select sysfs attributes.
++# - Todo ... test more attributes, hnp/srp, buspower/bussuspend, etc.
++# -----------------------------------------------------------------------------
++use strict;
++use dwc_otg_test;
++
++check_arch() or die;
++
++#
++#
++sub test {
++  my ($attr,$expected) = @_;
++  my $string = get($attr);
++
++  if ($string eq $expected) {
++    printf("$attr = $string, okay\n");
++  }
++  else {
++    warn "ERROR: value of $attr != $expected, $string\n";
++    $errors ++;
++  }
++}
++
++#
++#
++sub set {
++  my ($reg, $value) = @_;
++  system "echo $value > $sysfsdir/$reg";
++}
++
++#
++#
++sub get {
++  my $attr = shift;
++  my $string = `cat $sysfsdir/$attr`;
++  chomp $string;
++  if ($string =~ m/\s\=\s/) {
++    my $tmp;
++    ($tmp, $string) = split /\s=\s/, $string;
++  }
++  return $string;
++}
++
++#
++#
++sub test_main {
++  print("\nTesting Sysfs Attributes\n");
++
++  load_module("") or die;
++
++  # Test initial values of regoffset/regvalue/guid/gsnpsid
++  print("\nTesting Default Values\n");
++
++  test("regoffset", "0xffffffff");
++  test("regvalue", "invalid offset");
++  test("guid", "0x12345678");	# this will fail if it has been changed
++  test("gsnpsid", "0x4f54200a");
++
++  # Test operation of regoffset/regvalue
++  print("\nTesting regoffset\n");
++  set('regoffset', '5a5a5a5a');
++  test("regoffset", "0xffffffff");
++
++  set('regoffset', '0');
++  test("regoffset", "0x00000000");
++
++  set('regoffset', '40000');
++  test("regoffset", "0x00000000");
++
++  set('regoffset', '3ffff');
++  test("regoffset", "0x0003ffff");
++
++  set('regoffset', '1');
++  test("regoffset", "0x00000001");
++
++  print("\nTesting regvalue\n");
++  set('regoffset', '3c');
++  test("regvalue", "0x12345678");
++  set('regvalue', '5a5a5a5a');
++  test("regvalue", "0x5a5a5a5a");
++  set('regvalue','a5a5a5a5');
++  test("regvalue", "0xa5a5a5a5");
++  set('guid','12345678');
++
++  # Test HNP Capable
++  print("\nTesting HNP Capable bit\n");
++  set('hnpcapable', '1');
++  test("hnpcapable", "0x1");
++  set('hnpcapable','0');
++  test("hnpcapable", "0x0");
++
++  set('regoffset','0c');
++
++  my $old = get('gusbcfg');
++  print("setting hnpcapable\n");
++  set('hnpcapable', '1');
++  test("hnpcapable", "0x1");
++  test('gusbcfg', sprintf "0x%08x", (oct ($old) | (1<<9)));
++  test('regvalue', sprintf "0x%08x", (oct ($old) | (1<<9)));
++
++  $old = get('gusbcfg');
++  print("clearing hnpcapable\n");
++  set('hnpcapable', '0');
++  test("hnpcapable", "0x0");
++  test ('gusbcfg', sprintf "0x%08x", oct ($old) & (~(1<<9)));
++  test ('regvalue', sprintf "0x%08x", oct ($old) & (~(1<<9)));
++
++  # Test SRP Capable
++  print("\nTesting SRP Capable bit\n");
++  set('srpcapable', '1');
++  test("srpcapable", "0x1");
++  set('srpcapable','0');
++  test("srpcapable", "0x0");
++
++  set('regoffset','0c');
++
++  $old = get('gusbcfg');
++  print("setting srpcapable\n");
++  set('srpcapable', '1');
++  test("srpcapable", "0x1");
++  test('gusbcfg', sprintf "0x%08x", (oct ($old) | (1<<8)));
++  test('regvalue', sprintf "0x%08x", (oct ($old) | (1<<8)));
++
++  $old = get('gusbcfg');
++  print("clearing srpcapable\n");
++  set('srpcapable', '0');
++  test("srpcapable", "0x0");
++  test('gusbcfg', sprintf "0x%08x", oct ($old) & (~(1<<8)));
++  test('regvalue', sprintf "0x%08x", oct ($old) & (~(1<<8)));
++
++  # Test GGPIO
++  print("\nTesting GGPIO\n");
++  set('ggpio','5a5a5a5a');
++  test('ggpio','0x5a5a0000');
++  set('ggpio','a5a5a5a5');
++  test('ggpio','0xa5a50000');
++  set('ggpio','11110000');
++  test('ggpio','0x11110000');
++  set('ggpio','00001111');
++  test('ggpio','0x00000000');
++
++  # Test DEVSPEED
++  print("\nTesting DEVSPEED\n");
++  set('regoffset','800');
++  $old = get('regvalue');
++  set('devspeed','0');
++  test('devspeed','0x0');
++  test('regvalue',sprintf("0x%08x", oct($old) & ~(0x3)));
++  set('devspeed','1');
++  test('devspeed','0x1');
++  test('regvalue',sprintf("0x%08x", oct($old) & ~(0x3) | 1));
++  set('devspeed','2');
++  test('devspeed','0x2');
++  test('regvalue',sprintf("0x%08x", oct($old) & ~(0x3) | 2));
++  set('devspeed','3');
++  test('devspeed','0x3');
++  test('regvalue',sprintf("0x%08x", oct($old) & ~(0x3) | 3));
++  set('devspeed','4');
++  test('devspeed','0x0');
++  test('regvalue',sprintf("0x%08x", oct($old) & ~(0x3)));
++  set('devspeed','5');
++  test('devspeed','0x1');
++  test('regvalue',sprintf("0x%08x", oct($old) & ~(0x3) | 1));
++
++
++  #  mode	Returns the current mode:0 for device mode1 for host mode	Read
++  #  hnp	Initiate the Host Negotiation Protocol.  Read returns the status.	Read/Write
++  #  srp	Initiate the Session Request Protocol.  Read returns the status.	Read/Write
++  #  buspower	Get or Set the Power State of the bus (0 - Off or 1 - On) 	Read/Write
++  #  bussuspend	Suspend the USB bus.	Read/Write
++  #  busconnected	Get the connection status of the bus 	Read
++
++  #  gotgctl	Get or set the Core Control Status Register.	Read/Write
++  ##  gusbcfg	Get or set the Core USB Configuration Register	Read/Write
++  #  grxfsiz	Get or set the Receive FIFO Size Register	Read/Write
++  #  gnptxfsiz	Get or set the non-periodic Transmit Size Register	Read/Write
++  #  gpvndctl	Get or set the PHY Vendor Control Register	Read/Write
++  ##  ggpio	Get the value in the lower 16-bits of the General Purpose IO Register or Set the upper 16 bits.	Read/Write
++  ##  guid	Get or set the value of the User ID Register	Read/Write
++  ##  gsnpsid	Get the value of the Synopsys ID Regester	Read
++  ##  devspeed	Get or set the device speed setting in the DCFG register	Read/Write
++  #  enumspeed	Gets the device enumeration Speed.	Read
++  #  hptxfsiz	Get the value of the Host Periodic Transmit FIFO	Read
++  #  hprt0	Get or Set the value in the Host Port Control and Status Register	Read/Write
++
++  test_status("TEST NYI") or die;
++}
++
++test_main();
++0;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0055-bcm2708_fb-Add-framebuffer-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0055-bcm2708_fb-Add-framebuffer-driver.patch
new file mode 100644
index 00000000..1381538e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0055-bcm2708_fb-Add-framebuffer-driver.patch
@@ -0,0 +1,4042 @@
+From 7aa95d41f1f61eb61d39347e2aaa51da2d2f4ee7 Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Wed, 17 Jun 2015 17:06:34 +0100
+Subject: [PATCH 055/697] bcm2708_fb: Add framebuffer driver
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+
+bcm2708_fb : Implement blanking support using the mailbox property interface
+
+bcm2708_fb: Add pan and vsync controls
+
+bcm2708_fb: DMA acceleration for fb_copyarea
+
+Based on http://www.raspberrypi.org/phpBB3/viewtopic.php?p=62425#p62425
+Also used Simon's dmaer_master module as a reference for tweaking DMA
+settings for better performance.
+
+For now busylooping only. IRQ support might be added later.
+With non-overclocked Raspberry Pi, the performance is ~360 MB/s
+for simple copy or ~260 MB/s for two-pass copy (used when dragging
+windows to the right).
+
+In the case of using DMA channel 0, the performance improves
+to ~440 MB/s.
+
+For comparison, VFP optimized CPU copy can only do ~114 MB/s in
+the same conditions (hindered by reading uncached source buffer).
+
+Signed-off-by: Siarhei Siamashka <siarhei.siamashka@gmail.com>
+
+bcm2708_fb: report number of dma copies
+
+Add a counter (exported via debugfs) reporting the
+number of dma copies that the framebuffer driver
+has done, in order to help evaluate different
+optimization strategies.
+
+Signed-off-by: Luke Diamand <luked@broadcom.com>
+
+bcm2708_fb: use IRQ for DMA copies
+
+The copyarea ioctl() uses DMA to speed things along. This
+was busy-waiting for completion. This change supports using
+an interrupt instead for larger transfers. For small
+transfers, busy-waiting is still likely to be faster.
+
+Signed-off-by: Luke Diamand <luke@diamand.org>
+
+bcm2708: Make ioctl logging quieter
+
+video: fbdev: bcm2708_fb: Don't panic on error
+
+No need to panic the kernel if the video driver fails.
+Just print a message and return an error.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+fbdev: bcm2708_fb: Add ARCH_BCM2835 support
+
+Add Device Tree support.
+Pass the device to dma_alloc_coherent() in order to get the
+correct bus address on ARCH_BCM2835.
+Use the new DMA legacy API header file.
+Including <mach/platform.h> is not necessary.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+BCM270x_DT: Add bcm2708-fb device
+
+Add bcm2708-fb to Device Tree and don't add the
+platform device when booting in DT mode.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+Cleanup of bcm2708_fb file to kernel coding standards
+
+Some minor change to function - remove a use of
+in_atomic, plus replacing various debug messages
+that manually specify the function name with
+("%s",.__func__)
+
+Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
+
+video: bcm2708_fb: Try allocating on the ARM and passing to VPU
+
+Currently the VPU allocates the contiguous buffer for the
+framebuffer.
+Try an alternate path first where we use dma_alloc_coherent
+and pass the buffer to the VPU. Should the VPU firmware not
+support that path, then free the buffer and revert to the
+old behaviour of using the VPU allocation.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+Pulled in the multi frame buffer support from the Pi3 repo
+
+fbdev: add FBIOCOPYAREA ioctl
+
+Based on the patch authored by Ali Gholami Rudi at
+    https://lkml.org/lkml/2009/7/13/153
+
+Provide an ioctl for userspace applications, but only if this operation
+is hardware accelerated (otherwide it does not make any sense).
+
+Signed-off-by: Siarhei Siamashka <siarhei.siamashka@gmail.com>
+
+bcm2708_fb: Add ioctl for reading gpu memory through dma
+
+video: bcm2708_fb: Add compat_ioctl support.
+
+When using a 64 bit kernel with 32 bit userspace we need
+compat ioctl handling for FBIODMACOPY as one of the
+parameters is a pointer.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+video: fbdev: bcm2708_fb: Use common compat header
+
+The definition of compat_ptr is now common for most platforms, but
+requires the inclusion of <linux/compat.h>.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+video: bcm2708_fb: Disable FB if no displays found
+
+If the firmware hasn't detected a display, the driver would assume
+one display was available, but because it had failed to retrieve the
+display size it would try to allocate a zero-sized buffer.
+
+Avoid the allocation failure by bailing out early if no display is
+found.
+
+See: https://github.com/raspberrypi/linux/issues/3598
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+bcm2708_fb: Fix a build warning
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/video/fbdev/Kconfig               |   15 +
+ drivers/video/fbdev/Makefile              |    1 +
+ drivers/video/fbdev/bcm2708_fb.c          | 1272 +++++++++++
+ drivers/video/fbdev/core/fb_chrdev.c      |   35 +
+ drivers/video/logo/logo_linux_clut224.ppm | 2483 ++++++++-------------
+ include/uapi/linux/fb.h                   |   12 +
+ 6 files changed, 2216 insertions(+), 1602 deletions(-)
+ create mode 100644 drivers/video/fbdev/bcm2708_fb.c
+
+--- a/drivers/video/fbdev/Kconfig
++++ b/drivers/video/fbdev/Kconfig
+@@ -61,6 +61,21 @@ config FB_MACMODES
+ 	tristate
+ 	depends on FB
+ 
++config FB_BCM2708
++	tristate "BCM2708 framebuffer support"
++	depends on FB && RASPBERRYPI_FIRMWARE
++	select FB_DEVICE
++	select FB_CFB_FILLRECT
++	select FB_CFB_COPYAREA
++	select FB_CFB_IMAGEBLIT
++	help
++	  This framebuffer device driver is for the BCM2708 framebuffer.
++
++	  If you want to compile this as a module (=code which can be
++	  inserted into and removed from the running kernel), say M
++	  here and read <file:Documentation/kbuild/modules.txt>.  The module
++	  will be called bcm2708_fb.
++
+ config FB_GRVGA
+ 	tristate "Aeroflex Gaisler framebuffer support"
+ 	depends on FB && SPARC
+--- a/drivers/video/fbdev/Makefile
++++ b/drivers/video/fbdev/Makefile
+@@ -12,6 +12,7 @@ obj-$(CONFIG_FB_SBUS)          += sbusli
+ obj-$(CONFIG_FB_WMT_GE_ROPS)   += wmt_ge_rops.o
+ 
+ # Hardware specific drivers go first
++obj-$(CONFIG_FB_BCM2708)	  += bcm2708_fb.o
+ obj-$(CONFIG_FB_AMIGA)            += amifb.o c2p_planar.o
+ obj-$(CONFIG_FB_ARC)              += arcfb.o
+ obj-$(CONFIG_FB_CLPS711X)	  += clps711x-fb.o
+--- /dev/null
++++ b/drivers/video/fbdev/bcm2708_fb.c
+@@ -0,0 +1,1272 @@
++/*
++ *  linux/drivers/video/bcm2708_fb.c
++ *
++ * Copyright (C) 2010 Broadcom
++ * Copyright (C) 2018 Raspberry Pi (Trading) Ltd
++ *
++ * This file is subject to the terms and conditions of the GNU General Public
++ * License.  See the file COPYING in the main directory of this archive
++ * for more details.
++ *
++ * Broadcom simple framebuffer driver
++ *
++ * This file is derived from cirrusfb.c
++ * Copyright 1999-2001 Jeff Garzik <jgarzik@pobox.com>
++ *
++ */
++
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/errno.h>
++#include <linux/string.h>
++#include <linux/slab.h>
++#include <linux/mm.h>
++#include <linux/fb.h>
++#include <linux/init.h>
++#include <linux/interrupt.h>
++#include <linux/ioport.h>
++#include <linux/list.h>
++#include <linux/platform_data/dma-bcm2708.h>
++#include <linux/platform_device.h>
++#include <linux/clk.h>
++#include <linux/printk.h>
++#include <linux/console.h>
++#include <linux/debugfs.h>
++#include <linux/uaccess.h>
++#include <linux/io.h>
++#include <linux/dma-mapping.h>
++#include <linux/cred.h>
++#include <soc/bcm2835/raspberrypi-firmware.h>
++#include <linux/mutex.h>
++#include <linux/compat.h>
++
++//#define BCM2708_FB_DEBUG
++#define MODULE_NAME "bcm2708_fb"
++
++#ifdef BCM2708_FB_DEBUG
++#define print_debug(fmt, ...) pr_debug("%s:%s:%d: " fmt, \
++			MODULE_NAME, __func__, __LINE__, ##__VA_ARGS__)
++#else
++#define print_debug(fmt, ...)
++#endif
++
++/* This is limited to 16 characters when displayed by X startup */
++static const char *bcm2708_name = "BCM2708 FB";
++
++#define DRIVER_NAME "bcm2708_fb"
++
++static int fbwidth = 800;	/* module parameter */
++static int fbheight = 480;	/* module parameter */
++static int fbdepth = 32;	/* module parameter */
++static int fbswap;		/* module parameter */
++
++static u32 dma_busy_wait_threshold = 1 << 15;
++module_param(dma_busy_wait_threshold, int, 0644);
++MODULE_PARM_DESC(dma_busy_wait_threshold, "Busy-wait for DMA completion below this area");
++
++struct fb_alloc_tags {
++	struct rpi_firmware_property_tag_header tag1;
++	u32 xres, yres;
++	struct rpi_firmware_property_tag_header tag2;
++	u32 xres_virtual, yres_virtual;
++	struct rpi_firmware_property_tag_header tag3;
++	u32 bpp;
++	struct rpi_firmware_property_tag_header tag4;
++	u32 xoffset, yoffset;
++	struct rpi_firmware_property_tag_header tag5;
++	u32 base, screen_size;
++	struct rpi_firmware_property_tag_header tag6;
++	u32 pitch;
++};
++
++struct bcm2708_fb_stats {
++	struct debugfs_regset32 regset;
++	u32 dma_copies;
++	u32 dma_irqs;
++};
++
++struct vc4_display_settings_t {
++	u32 display_num;
++	u32 width;
++	u32 height;
++	u32 depth;
++	u32 pitch;
++	u32 virtual_width;
++	u32 virtual_height;
++	u32 virtual_width_offset;
++	u32 virtual_height_offset;
++	unsigned long fb_bus_address;
++};
++
++struct bcm2708_fb_dev;
++
++struct bcm2708_fb {
++	struct fb_info fb;
++	struct platform_device *dev;
++	u32 cmap[16];
++	u32 gpu_cmap[256];
++	struct dentry *debugfs_dir;
++	struct dentry *debugfs_subdir;
++	unsigned long fb_bus_address;
++	struct { u32 base, length; } gpu;
++	struct vc4_display_settings_t display_settings;
++	struct debugfs_regset32 screeninfo_regset;
++	struct bcm2708_fb_dev *fbdev;
++	unsigned int image_size;
++	dma_addr_t dma_addr;
++	void *cpuaddr;
++};
++
++#define MAX_FRAMEBUFFERS 3
++
++struct bcm2708_fb_dev {
++	int firmware_supports_multifb;
++	/* Protects the DMA system from multiple FB access */
++	struct mutex dma_mutex;
++	int dma_chan;
++	int dma_irq;
++	void __iomem *dma_chan_base;
++	wait_queue_head_t dma_waitq;
++	bool disable_arm_alloc;
++	struct bcm2708_fb_stats dma_stats;
++	void *cb_base;	/* DMA control blocks */
++	dma_addr_t cb_handle;
++	int instance_count;
++	int num_displays;
++	struct rpi_firmware *fw;
++	struct bcm2708_fb displays[MAX_FRAMEBUFFERS];
++};
++
++#define to_bcm2708(info)	container_of(info, struct bcm2708_fb, fb)
++
++static void bcm2708_fb_debugfs_deinit(struct bcm2708_fb *fb)
++{
++	debugfs_remove_recursive(fb->debugfs_subdir);
++	fb->debugfs_subdir = NULL;
++
++	fb->fbdev->instance_count--;
++
++	if (!fb->fbdev->instance_count) {
++		debugfs_remove_recursive(fb->debugfs_dir);
++		fb->debugfs_dir = NULL;
++	}
++}
++
++static int bcm2708_fb_debugfs_init(struct bcm2708_fb *fb)
++{
++	char buf[3];
++	struct bcm2708_fb_dev *fbdev = fb->fbdev;
++
++	static struct debugfs_reg32 stats_registers[] = {
++	{"dma_copies", offsetof(struct bcm2708_fb_stats, dma_copies)},
++	{"dma_irqs",   offsetof(struct bcm2708_fb_stats, dma_irqs)},
++	};
++
++	static struct debugfs_reg32 screeninfo[] = {
++	{"width",	 offsetof(struct fb_var_screeninfo, xres)},
++	{"height",	 offsetof(struct fb_var_screeninfo, yres)},
++	{"bpp",		 offsetof(struct fb_var_screeninfo, bits_per_pixel)},
++	{"xres_virtual", offsetof(struct fb_var_screeninfo, xres_virtual)},
++	{"yres_virtual", offsetof(struct fb_var_screeninfo, yres_virtual)},
++	{"xoffset",	 offsetof(struct fb_var_screeninfo, xoffset)},
++	{"yoffset",	 offsetof(struct fb_var_screeninfo, yoffset)},
++	};
++
++	fb->debugfs_dir = debugfs_lookup(DRIVER_NAME, NULL);
++
++	if (!fb->debugfs_dir)
++		fb->debugfs_dir = debugfs_create_dir(DRIVER_NAME, NULL);
++
++	if (!fb->debugfs_dir) {
++		dev_warn(fb->fb.dev, "%s: could not create debugfs folder\n",
++			 __func__);
++		return -EFAULT;
++	}
++
++	snprintf(buf, sizeof(buf), "%u", fb->display_settings.display_num);
++
++	fb->debugfs_subdir = debugfs_create_dir(buf, fb->debugfs_dir);
++
++	if (!fb->debugfs_subdir) {
++		dev_warn(fb->fb.dev, "%s: could not create debugfs entry %u\n",
++			 __func__, fb->display_settings.display_num);
++		return -EFAULT;
++	}
++
++	fbdev->dma_stats.regset.regs = stats_registers;
++	fbdev->dma_stats.regset.nregs = ARRAY_SIZE(stats_registers);
++	fbdev->dma_stats.regset.base = &fbdev->dma_stats;
++
++	debugfs_create_regset32("dma_stats", 0444, fb->debugfs_subdir,
++				&fbdev->dma_stats.regset);
++
++	fb->screeninfo_regset.regs = screeninfo;
++	fb->screeninfo_regset.nregs = ARRAY_SIZE(screeninfo);
++	fb->screeninfo_regset.base = &fb->fb.var;
++
++	debugfs_create_regset32("screeninfo", 0444, fb->debugfs_subdir,
++				&fb->screeninfo_regset);
++
++	fbdev->instance_count++;
++
++	return 0;
++}
++
++static void set_display_num(struct bcm2708_fb *fb)
++{
++	if (fb && fb->fbdev && fb->fbdev->firmware_supports_multifb) {
++		u32 tmp = fb->display_settings.display_num;
++
++		if (rpi_firmware_property(fb->fbdev->fw,
++					  RPI_FIRMWARE_FRAMEBUFFER_SET_DISPLAY_NUM,
++					  &tmp,
++					  sizeof(tmp)))
++			dev_warn_once(fb->fb.dev,
++				      "Set display number call failed. Old GPU firmware?");
++	}
++}
++
++static int bcm2708_fb_set_bitfields(struct fb_var_screeninfo *var)
++{
++	int ret = 0;
++
++	memset(&var->transp, 0, sizeof(var->transp));
++
++	var->red.msb_right = 0;
++	var->green.msb_right = 0;
++	var->blue.msb_right = 0;
++
++	switch (var->bits_per_pixel) {
++	case 1:
++	case 2:
++	case 4:
++	case 8:
++		var->red.length = var->bits_per_pixel;
++		var->red.offset = 0;
++		var->green.length = var->bits_per_pixel;
++		var->green.offset = 0;
++		var->blue.length = var->bits_per_pixel;
++		var->blue.offset = 0;
++		break;
++	case 16:
++		var->red.length = 5;
++		var->blue.length = 5;
++		/*
++		 * Green length can be 5 or 6 depending whether
++		 * we're operating in RGB555 or RGB565 mode.
++		 */
++		if (var->green.length != 5 && var->green.length != 6)
++			var->green.length = 6;
++		break;
++	case 24:
++		var->red.length = 8;
++		var->blue.length = 8;
++		var->green.length = 8;
++		break;
++	case 32:
++		var->red.length = 8;
++		var->green.length = 8;
++		var->blue.length = 8;
++		var->transp.length = 8;
++		break;
++	default:
++		ret = -EINVAL;
++		break;
++	}
++
++	/*
++	 * >= 16bpp displays have separate colour component bitfields
++	 * encoded in the pixel data.  Calculate their position from
++	 * the bitfield length defined above.
++	 */
++	if (ret == 0 && var->bits_per_pixel >= 24 && fbswap) {
++		var->blue.offset = 0;
++		var->green.offset = var->blue.offset + var->blue.length;
++		var->red.offset = var->green.offset + var->green.length;
++		var->transp.offset = var->red.offset + var->red.length;
++	} else if (ret == 0 && var->bits_per_pixel >= 24) {
++		var->red.offset = 0;
++		var->green.offset = var->red.offset + var->red.length;
++		var->blue.offset = var->green.offset + var->green.length;
++		var->transp.offset = var->blue.offset + var->blue.length;
++	} else if (ret == 0 && var->bits_per_pixel >= 16) {
++		var->blue.offset = 0;
++		var->green.offset = var->blue.offset + var->blue.length;
++		var->red.offset = var->green.offset + var->green.length;
++		var->transp.offset = var->red.offset + var->red.length;
++	}
++
++	return ret;
++}
++
++static int bcm2708_fb_check_var(struct fb_var_screeninfo *var,
++				struct fb_info *info)
++{
++	/* info input, var output */
++	print_debug("%s(%p) %ux%u (%ux%u), %ul, %u\n",
++		    __func__, info, info->var.xres, info->var.yres,
++		    info->var.xres_virtual, info->var.yres_virtual,
++		    info->screen_size, info->var.bits_per_pixel);
++	print_debug("%s(%p) %ux%u (%ux%u), %u\n", __func__, var, var->xres,
++		    var->yres, var->xres_virtual, var->yres_virtual,
++		    var->bits_per_pixel);
++
++	if (!var->bits_per_pixel)
++		var->bits_per_pixel = 16;
++
++	if (bcm2708_fb_set_bitfields(var) != 0) {
++		pr_err("%s: invalid bits_per_pixel %d\n", __func__,
++		       var->bits_per_pixel);
++		return -EINVAL;
++	}
++
++	if (var->xres_virtual < var->xres)
++		var->xres_virtual = var->xres;
++	/* use highest possible virtual resolution */
++	if (var->yres_virtual == -1) {
++		var->yres_virtual = 480;
++
++		pr_err("%s: virtual resolution set to maximum of %dx%d\n",
++		       __func__, var->xres_virtual, var->yres_virtual);
++	}
++	if (var->yres_virtual < var->yres)
++		var->yres_virtual = var->yres;
++
++	if (var->xoffset < 0)
++		var->xoffset = 0;
++	if (var->yoffset < 0)
++		var->yoffset = 0;
++
++	/* truncate xoffset and yoffset to maximum if too high */
++	if (var->xoffset > var->xres_virtual - var->xres)
++		var->xoffset = var->xres_virtual - var->xres - 1;
++	if (var->yoffset > var->yres_virtual - var->yres)
++		var->yoffset = var->yres_virtual - var->yres - 1;
++
++	return 0;
++}
++
++static int bcm2708_fb_set_par(struct fb_info *info)
++{
++	struct bcm2708_fb *fb = to_bcm2708(info);
++	struct fb_alloc_tags fbinfo = {
++		.tag1 = { RPI_FIRMWARE_FRAMEBUFFER_SET_PHYSICAL_WIDTH_HEIGHT,
++			  8, 0, },
++			.xres = info->var.xres,
++			.yres = info->var.yres,
++		.tag2 = { RPI_FIRMWARE_FRAMEBUFFER_SET_VIRTUAL_WIDTH_HEIGHT,
++			  8, 0, },
++			.xres_virtual = info->var.xres_virtual,
++			.yres_virtual = info->var.yres_virtual,
++		.tag3 = { RPI_FIRMWARE_FRAMEBUFFER_SET_DEPTH, 4, 0 },
++			.bpp = info->var.bits_per_pixel,
++		.tag4 = { RPI_FIRMWARE_FRAMEBUFFER_SET_VIRTUAL_OFFSET, 8, 0 },
++			.xoffset = info->var.xoffset,
++			.yoffset = info->var.yoffset,
++		.tag5 = { RPI_FIRMWARE_FRAMEBUFFER_ALLOCATE, 8, 0 },
++			/* base and screen_size will be initialised later */
++		.tag6 = { RPI_FIRMWARE_FRAMEBUFFER_SET_PITCH, 4, 0 },
++			/* pitch will be initialised later */
++	};
++	int ret, image_size;
++
++	print_debug("%s(%p) %dx%d (%dx%d), %d, %d (display %d)\n", __func__,
++		    info,
++		    info->var.xres, info->var.yres, info->var.xres_virtual,
++		    info->var.yres_virtual, (int)info->screen_size,
++		    info->var.bits_per_pixel, value);
++
++	/* Need to set the display number to act on first
++	 * Cannot do it in the tag list because on older firmware the call
++	 * will fail and stop the rest of the list being executed.
++	 * We can ignore this call failing as the default at other end is 0
++	 */
++	set_display_num(fb);
++
++	/* Try allocating our own buffer. We can specify all the parameters */
++	image_size = ((info->var.xres * info->var.yres) *
++		      info->var.bits_per_pixel) >> 3;
++
++	if (!fb->fbdev->disable_arm_alloc &&
++	    (image_size != fb->image_size || !fb->dma_addr)) {
++		if (fb->dma_addr) {
++			dma_free_coherent(info->device, fb->image_size,
++					  fb->cpuaddr, fb->dma_addr);
++			fb->image_size = 0;
++			fb->cpuaddr = NULL;
++			fb->dma_addr = 0;
++		}
++
++		fb->cpuaddr = dma_alloc_coherent(info->device, image_size,
++						 &fb->dma_addr, GFP_KERNEL);
++
++		if (!fb->cpuaddr) {
++			fb->dma_addr = 0;
++			fb->fbdev->disable_arm_alloc = true;
++		} else {
++			fb->image_size = image_size;
++		}
++	}
++
++	if (fb->cpuaddr) {
++		fbinfo.base = fb->dma_addr;
++		fbinfo.screen_size = image_size;
++		fbinfo.pitch = (info->var.xres * info->var.bits_per_pixel) >> 3;
++
++		ret = rpi_firmware_property_list(fb->fbdev->fw, &fbinfo,
++						 sizeof(fbinfo));
++		if (ret || fbinfo.base != fb->dma_addr) {
++			/* Firmware either failed, or assigned a different base
++			 * address (ie it doesn't support being passed an FB
++			 * allocation).
++			 * Destroy the allocation, and don't try again.
++			 */
++			dma_free_coherent(info->device, fb->image_size,
++					  fb->cpuaddr, fb->dma_addr);
++			fb->image_size = 0;
++			fb->cpuaddr = NULL;
++			fb->dma_addr = 0;
++			fb->fbdev->disable_arm_alloc = true;
++		}
++	} else {
++		/* Our allocation failed - drop into the old scheme of
++		 * allocation by the VPU.
++		 */
++		ret = -ENOMEM;
++	}
++
++	if (ret) {
++		/* Old scheme:
++		 * - FRAMEBUFFER_ALLOCATE passes 0 for base and screen_size.
++		 * - GET_PITCH instead of SET_PITCH.
++		 */
++		fbinfo.base = 0;
++		fbinfo.screen_size = 0;
++		fbinfo.tag6.tag = RPI_FIRMWARE_FRAMEBUFFER_GET_PITCH;
++		fbinfo.pitch = 0;
++
++		ret = rpi_firmware_property_list(fb->fbdev->fw, &fbinfo,
++						 sizeof(fbinfo));
++		if (ret) {
++			dev_err(info->device,
++				"Failed to allocate GPU framebuffer (%d)\n",
++				ret);
++			return ret;
++		}
++	}
++
++	if (info->var.bits_per_pixel <= 8)
++		fb->fb.fix.visual = FB_VISUAL_PSEUDOCOLOR;
++	else
++		fb->fb.fix.visual = FB_VISUAL_TRUECOLOR;
++
++	fb->fb.fix.line_length = fbinfo.pitch;
++	fbinfo.base |= 0x40000000;
++	fb->fb_bus_address = fbinfo.base;
++	fbinfo.base &= ~0xc0000000;
++	fb->fb.fix.smem_start = fbinfo.base;
++	fb->fb.fix.smem_len = fbinfo.pitch * fbinfo.yres_virtual;
++	fb->fb.screen_size = fbinfo.screen_size;
++
++	if (!fb->dma_addr) {
++		if (fb->fb.screen_base)
++			iounmap(fb->fb.screen_base);
++
++		fb->fb.screen_base = ioremap_wc(fbinfo.base,
++						fb->fb.screen_size);
++	} else {
++		fb->fb.screen_base = fb->cpuaddr;
++	}
++
++	if (!fb->fb.screen_base) {
++		/* the console may currently be locked */
++		console_trylock();
++		console_unlock();
++		dev_err(info->device, "Failed to set screen_base\n");
++		return -ENOMEM;
++	}
++
++	print_debug("%s: start = %p,%p width=%d, height=%d, bpp=%d, pitch=%d size=%d\n",
++		    __func__, (void *)fb->fb.screen_base,
++		    (void *)fb->fb_bus_address, fbinfo.xres, fbinfo.yres,
++		    fbinfo.bpp, fbinfo.pitch, (int)fb->fb.screen_size);
++
++	return 0;
++}
++
++static inline u32 convert_bitfield(int val, struct fb_bitfield *bf)
++{
++	unsigned int mask = (1 << bf->length) - 1;
++
++	return (val >> (16 - bf->length) & mask) << bf->offset;
++}
++
++static int bcm2708_fb_setcolreg(unsigned int regno, unsigned int red,
++				unsigned int green, unsigned int blue,
++				unsigned int transp, struct fb_info *info)
++{
++	struct bcm2708_fb *fb = to_bcm2708(info);
++
++	if (fb->fb.var.bits_per_pixel <= 8) {
++		if (regno < 256) {
++			/* blue [23:16], green [15:8], red [7:0] */
++			fb->gpu_cmap[regno] = ((red   >> 8) & 0xff) << 0 |
++					      ((green >> 8) & 0xff) << 8 |
++					      ((blue  >> 8) & 0xff) << 16;
++		}
++		/* Hack: we need to tell GPU the palette has changed, but
++		 * currently bcm2708_fb_set_par takes noticeable time when
++		 * called for every (256) colour
++		 * So just call it for what looks like the last colour in a
++		 * list for now.
++		 */
++		if (regno == 15 || regno == 255) {
++			struct packet {
++				u32 offset;
++				u32 length;
++				u32 cmap[256];
++			} *packet;
++			int ret;
++
++			packet = kmalloc(sizeof(*packet), GFP_KERNEL);
++			if (!packet)
++				return -ENOMEM;
++			packet->offset = 0;
++			packet->length = regno + 1;
++			memcpy(packet->cmap, fb->gpu_cmap,
++			       sizeof(packet->cmap));
++
++			set_display_num(fb);
++
++			ret = rpi_firmware_property(fb->fbdev->fw,
++						    RPI_FIRMWARE_FRAMEBUFFER_SET_PALETTE,
++						    packet,
++						    (2 + packet->length) * sizeof(u32));
++			if (ret || packet->offset)
++				dev_err(info->device,
++					"Failed to set palette (%d,%u)\n",
++					ret, packet->offset);
++			kfree(packet);
++		}
++	} else if (regno < 16) {
++		fb->cmap[regno] = convert_bitfield(transp, &fb->fb.var.transp) |
++				  convert_bitfield(blue, &fb->fb.var.blue) |
++				  convert_bitfield(green, &fb->fb.var.green) |
++				  convert_bitfield(red, &fb->fb.var.red);
++	}
++	return regno > 255;
++}
++
++static int bcm2708_fb_blank(int blank_mode, struct fb_info *info)
++{
++	struct bcm2708_fb *fb = to_bcm2708(info);
++	u32 value;
++	int ret;
++
++	switch (blank_mode) {
++	case FB_BLANK_UNBLANK:
++		value = 0;
++		break;
++	case FB_BLANK_NORMAL:
++	case FB_BLANK_VSYNC_SUSPEND:
++	case FB_BLANK_HSYNC_SUSPEND:
++	case FB_BLANK_POWERDOWN:
++		value = 1;
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	set_display_num(fb);
++
++	ret = rpi_firmware_property(fb->fbdev->fw, RPI_FIRMWARE_FRAMEBUFFER_BLANK,
++				    &value, sizeof(value));
++
++	if (ret)
++		dev_err(info->device, "%s(%d) failed: %d\n", __func__,
++			blank_mode, ret);
++
++	return ret;
++}
++
++static int bcm2708_fb_pan_display(struct fb_var_screeninfo *var,
++				  struct fb_info *info)
++{
++	s32 result;
++
++	info->var.xoffset = var->xoffset;
++	info->var.yoffset = var->yoffset;
++	result = bcm2708_fb_set_par(info);
++	if (result != 0)
++		pr_err("%s(%u,%u) returns=%d\n", __func__, var->xoffset,
++		       var->yoffset, result);
++	return result;
++}
++
++static void dma_memcpy(struct bcm2708_fb *fb, dma_addr_t dst, dma_addr_t src,
++		       int size)
++{
++	struct bcm2708_fb_dev *fbdev = fb->fbdev;
++	struct bcm2708_dma_cb *cb = fbdev->cb_base;
++	int burst_size = (fbdev->dma_chan == 0) ? 8 : 2;
++
++	cb->info = BCM2708_DMA_BURST(burst_size) | BCM2708_DMA_S_WIDTH |
++		   BCM2708_DMA_S_INC | BCM2708_DMA_D_WIDTH |
++		   BCM2708_DMA_D_INC;
++	cb->dst = dst;
++	cb->src = src;
++	cb->length = size;
++	cb->stride = 0;
++	cb->pad[0] = 0;
++	cb->pad[1] = 0;
++	cb->next = 0;
++
++	// Not sure what to do if this gets a signal whilst waiting
++	if (mutex_lock_interruptible(&fbdev->dma_mutex))
++		return;
++
++	if (size < dma_busy_wait_threshold) {
++		bcm_dma_start(fbdev->dma_chan_base, fbdev->cb_handle);
++		bcm_dma_wait_idle(fbdev->dma_chan_base);
++	} else {
++		void __iomem *local_dma_chan = fbdev->dma_chan_base;
++
++		cb->info |= BCM2708_DMA_INT_EN;
++		bcm_dma_start(fbdev->dma_chan_base, fbdev->cb_handle);
++		while (bcm_dma_is_busy(local_dma_chan)) {
++			wait_event_interruptible(fbdev->dma_waitq,
++						 !bcm_dma_is_busy(local_dma_chan));
++		}
++		fbdev->dma_stats.dma_irqs++;
++	}
++	fbdev->dma_stats.dma_copies++;
++
++	mutex_unlock(&fbdev->dma_mutex);
++}
++
++/* address with no aliases */
++#define INTALIAS_NORMAL(x) ((x) & ~0xc0000000)
++/* cache coherent but non-allocating in L1 and L2 */
++#define INTALIAS_L1L2_NONALLOCATING(x) (((x) & ~0xc0000000) | 0x80000000)
++
++static long vc_mem_copy(struct bcm2708_fb *fb, struct fb_dmacopy *ioparam)
++{
++	size_t size = PAGE_SIZE;
++	u32 *buf = NULL;
++	dma_addr_t bus_addr;
++	long rc = 0;
++	size_t offset;
++
++	/* restrict this to root user */
++	if (!uid_eq(current_euid(), GLOBAL_ROOT_UID)) {
++		rc = -EFAULT;
++		goto out;
++	}
++
++	if (!fb->gpu.base || !fb->gpu.length) {
++		pr_err("[%s]: Unable to determine gpu memory (%x,%x)\n",
++		       __func__, fb->gpu.base, fb->gpu.length);
++		return -EFAULT;
++	}
++
++	if (INTALIAS_NORMAL(ioparam->src) < fb->gpu.base ||
++	    INTALIAS_NORMAL(ioparam->src) >= fb->gpu.base + fb->gpu.length) {
++		pr_err("[%s]: Invalid memory access %x (%x-%x)", __func__,
++		       INTALIAS_NORMAL(ioparam->src), fb->gpu.base,
++		       fb->gpu.base + fb->gpu.length);
++		return -EFAULT;
++	}
++
++	buf = dma_alloc_coherent(fb->fb.device, PAGE_ALIGN(size), &bus_addr,
++				 GFP_ATOMIC);
++	if (!buf) {
++		pr_err("[%s]: failed to dma_alloc_coherent(%zd)\n", __func__,
++		       size);
++		rc = -ENOMEM;
++		goto out;
++	}
++
++	for (offset = 0; offset < ioparam->length; offset += size) {
++		size_t remaining = ioparam->length - offset;
++		size_t s = min(size, remaining);
++		u8 *p = (u8 *)((uintptr_t)ioparam->src + offset);
++		u8 *q = (u8 *)ioparam->dst + offset;
++
++		dma_memcpy(fb, bus_addr,
++			   INTALIAS_L1L2_NONALLOCATING((u32)(uintptr_t)p),
++						       size);
++		if (copy_to_user(q, buf, s) != 0) {
++			pr_err("[%s]: failed to copy-to-user\n", __func__);
++			rc = -EFAULT;
++			goto out;
++		}
++	}
++out:
++	if (buf)
++		dma_free_coherent(fb->fb.device, PAGE_ALIGN(size), buf,
++				  bus_addr);
++	return rc;
++}
++
++static int bcm2708_ioctl(struct fb_info *info, unsigned int cmd,
++			 unsigned long arg)
++{
++	struct bcm2708_fb *fb = to_bcm2708(info);
++	u32 dummy = 0;
++	int ret;
++
++	switch (cmd) {
++	case FBIO_WAITFORVSYNC:
++		set_display_num(fb);
++
++		ret = rpi_firmware_property(fb->fbdev->fw,
++					    RPI_FIRMWARE_FRAMEBUFFER_SET_VSYNC,
++					    &dummy, sizeof(dummy));
++		break;
++
++	case FBIODMACOPY:
++	{
++		struct fb_dmacopy ioparam;
++		/* Get the parameter data.
++		 */
++		if (copy_from_user
++		    (&ioparam, (void *)arg, sizeof(ioparam))) {
++			pr_err("[%s]: failed to copy-from-user\n", __func__);
++			ret = -EFAULT;
++			break;
++		}
++		ret = vc_mem_copy(fb, &ioparam);
++		break;
++	}
++	default:
++		dev_dbg(info->device, "Unknown ioctl 0x%x\n", cmd);
++		return -ENOTTY;
++	}
++
++	if (ret)
++		dev_err(info->device, "ioctl 0x%x failed (%d)\n", cmd, ret);
++
++	return ret;
++}
++
++#ifdef CONFIG_COMPAT
++struct fb_dmacopy32 {
++	compat_uptr_t dst;
++	__u32 src;
++	__u32 length;
++};
++
++#define FBIODMACOPY32		_IOW('z', 0x22, struct fb_dmacopy32)
++
++static int bcm2708_compat_ioctl(struct fb_info *info, unsigned int cmd,
++				unsigned long arg)
++{
++	struct bcm2708_fb *fb = to_bcm2708(info);
++	int ret;
++
++	switch (cmd) {
++	case FBIODMACOPY32:
++	{
++		struct fb_dmacopy32 param32;
++		struct fb_dmacopy param;
++		/* Get the parameter data.
++		 */
++		if (copy_from_user(&param32, (void *)arg, sizeof(param32))) {
++			pr_err("[%s]: failed to copy-from-user\n", __func__);
++			ret = -EFAULT;
++			break;
++		}
++		param.dst = compat_ptr(param32.dst);
++		param.src = param32.src;
++		param.length = param32.length;
++		ret = vc_mem_copy(fb, &param);
++		break;
++	}
++	default:
++		ret = bcm2708_ioctl(info, cmd, arg);
++		break;
++	}
++	return ret;
++}
++#endif
++
++static void bcm2708_fb_fillrect(struct fb_info *info,
++				const struct fb_fillrect *rect)
++{
++	cfb_fillrect(info, rect);
++}
++
++/* A helper function for configuring dma control block */
++static void set_dma_cb(struct bcm2708_dma_cb *cb,
++		int        burst_size,
++		dma_addr_t dst,
++		int        dst_stride,
++		dma_addr_t src,
++		int        src_stride,
++		int        w,
++		int        h)
++{
++	cb->info = BCM2708_DMA_BURST(burst_size) | BCM2708_DMA_S_WIDTH |
++		BCM2708_DMA_S_INC | BCM2708_DMA_D_WIDTH |
++		BCM2708_DMA_D_INC | BCM2708_DMA_TDMODE;
++	cb->dst = dst;
++	cb->src = src;
++	/*
++	 * This is not really obvious from the DMA documentation,
++	 * but the top 16 bits must be programmmed to "height -1"
++	 * and not "height" in 2D mode.
++	 */
++	cb->length = ((h - 1) << 16) | w;
++	cb->stride = ((dst_stride - w) << 16) | (u16)(src_stride - w);
++	cb->pad[0] = 0;
++	cb->pad[1] = 0;
++}
++
++static void bcm2708_fb_copyarea(struct fb_info *info,
++				const struct fb_copyarea *region)
++{
++	struct bcm2708_fb *fb = to_bcm2708(info);
++	struct bcm2708_fb_dev *fbdev = fb->fbdev;
++	struct bcm2708_dma_cb *cb = fbdev->cb_base;
++	int bytes_per_pixel = (info->var.bits_per_pixel + 7) >> 3;
++
++	/* Channel 0 supports larger bursts and is a bit faster */
++	int burst_size = (fbdev->dma_chan == 0) ? 8 : 2;
++	int pixels = region->width * region->height;
++
++	/* If DMA is currently in use (ie being used on another FB), then
++	 * rather than wait for it to finish, just use the cfb_copyarea
++	 */
++	if (!mutex_trylock(&fbdev->dma_mutex) ||
++	    bytes_per_pixel > 4 ||
++	    info->var.xres * info->var.yres > 1920 * 1200 ||
++	    region->width <= 0 || region->width > info->var.xres ||
++	    region->height <= 0 || region->height > info->var.yres ||
++	    region->sx < 0 || region->sx >= info->var.xres ||
++	    region->sy < 0 || region->sy >= info->var.yres ||
++	    region->dx < 0 || region->dx >= info->var.xres ||
++	    region->dy < 0 || region->dy >= info->var.yres ||
++	    region->sx + region->width > info->var.xres ||
++	    region->dx + region->width > info->var.xres ||
++	    region->sy + region->height > info->var.yres ||
++	    region->dy + region->height > info->var.yres) {
++		cfb_copyarea(info, region);
++		return;
++	}
++
++	if (region->dy == region->sy && region->dx > region->sx) {
++		/*
++		 * A difficult case of overlapped copy. Because DMA can't
++		 * copy individual scanlines in backwards direction, we need
++		 * two-pass processing. We do it by programming a chain of dma
++		 * control blocks in the first 16K part of the buffer and use
++		 * the remaining 48K as the intermediate temporary scratch
++		 * buffer. The buffer size is sufficient to handle up to
++		 * 1920x1200 resolution at 32bpp pixel depth.
++		 */
++		int y;
++		dma_addr_t control_block_pa = fbdev->cb_handle;
++		dma_addr_t scratchbuf = fbdev->cb_handle + 16 * 1024;
++		int scanline_size = bytes_per_pixel * region->width;
++		int scanlines_per_cb = (64 * 1024 - 16 * 1024) / scanline_size;
++
++		for (y = 0; y < region->height; y += scanlines_per_cb) {
++			dma_addr_t src =
++				fb->fb_bus_address +
++				bytes_per_pixel * region->sx +
++				(region->sy + y) * fb->fb.fix.line_length;
++			dma_addr_t dst =
++				fb->fb_bus_address +
++				bytes_per_pixel * region->dx +
++				(region->dy + y) * fb->fb.fix.line_length;
++
++			if (region->height - y < scanlines_per_cb)
++				scanlines_per_cb = region->height - y;
++
++			set_dma_cb(cb, burst_size, scratchbuf, scanline_size,
++				   src, fb->fb.fix.line_length,
++				   scanline_size, scanlines_per_cb);
++			control_block_pa += sizeof(struct bcm2708_dma_cb);
++			cb->next = control_block_pa;
++			cb++;
++
++			set_dma_cb(cb, burst_size, dst, fb->fb.fix.line_length,
++				   scratchbuf, scanline_size,
++				   scanline_size, scanlines_per_cb);
++			control_block_pa += sizeof(struct bcm2708_dma_cb);
++			cb->next = control_block_pa;
++			cb++;
++		}
++		/* move the pointer back to the last dma control block */
++		cb--;
++	} else {
++		/* A single dma control block is enough. */
++		int sy, dy, stride;
++
++		if (region->dy <= region->sy) {
++			/* processing from top to bottom */
++			dy = region->dy;
++			sy = region->sy;
++			stride = fb->fb.fix.line_length;
++		} else {
++			/* processing from bottom to top */
++			dy = region->dy + region->height - 1;
++			sy = region->sy + region->height - 1;
++			stride = -fb->fb.fix.line_length;
++		}
++		set_dma_cb(cb, burst_size,
++			   fb->fb_bus_address + dy * fb->fb.fix.line_length +
++			   bytes_per_pixel * region->dx,
++			   stride,
++			   fb->fb_bus_address + sy * fb->fb.fix.line_length +
++			   bytes_per_pixel * region->sx,
++			   stride,
++			   region->width * bytes_per_pixel,
++			   region->height);
++	}
++
++	/* end of dma control blocks chain */
++	cb->next = 0;
++
++	if (pixels < dma_busy_wait_threshold) {
++		bcm_dma_start(fbdev->dma_chan_base, fbdev->cb_handle);
++		bcm_dma_wait_idle(fbdev->dma_chan_base);
++	} else {
++		void __iomem *local_dma_chan = fbdev->dma_chan_base;
++
++		cb->info |= BCM2708_DMA_INT_EN;
++		bcm_dma_start(fbdev->dma_chan_base, fbdev->cb_handle);
++		while (bcm_dma_is_busy(local_dma_chan)) {
++			wait_event_interruptible(fbdev->dma_waitq,
++						 !bcm_dma_is_busy(local_dma_chan));
++		}
++		fbdev->dma_stats.dma_irqs++;
++	}
++	fbdev->dma_stats.dma_copies++;
++
++	mutex_unlock(&fbdev->dma_mutex);
++}
++
++static void bcm2708_fb_imageblit(struct fb_info *info,
++				 const struct fb_image *image)
++{
++	cfb_imageblit(info, image);
++}
++
++static irqreturn_t bcm2708_fb_dma_irq(int irq, void *cxt)
++{
++	struct bcm2708_fb_dev *fbdev = cxt;
++
++	/* FIXME: should read status register to check if this is
++	 * actually interrupting us or not, in case this interrupt
++	 * ever becomes shared amongst several DMA channels
++	 *
++	 * readl(dma_chan_base + BCM2708_DMA_CS) & BCM2708_DMA_IRQ;
++	 */
++
++	/* acknowledge the interrupt */
++	writel(BCM2708_DMA_INT, fbdev->dma_chan_base + BCM2708_DMA_CS);
++
++	wake_up(&fbdev->dma_waitq);
++	return IRQ_HANDLED;
++}
++
++static struct fb_ops bcm2708_fb_ops = {
++	.owner = THIS_MODULE,
++	.fb_check_var = bcm2708_fb_check_var,
++	.fb_set_par = bcm2708_fb_set_par,
++	.fb_setcolreg = bcm2708_fb_setcolreg,
++	.fb_blank = bcm2708_fb_blank,
++	.fb_fillrect = bcm2708_fb_fillrect,
++	.fb_copyarea = bcm2708_fb_copyarea,
++	.fb_imageblit = bcm2708_fb_imageblit,
++	.fb_pan_display = bcm2708_fb_pan_display,
++	.fb_ioctl = bcm2708_ioctl,
++#ifdef CONFIG_COMPAT
++	.fb_compat_ioctl = bcm2708_compat_ioctl,
++#endif
++};
++
++static int bcm2708_fb_register(struct bcm2708_fb *fb)
++{
++	int ret;
++
++	fb->fb.fbops = &bcm2708_fb_ops;
++	fb->fb.flags = FBINFO_HWACCEL_COPYAREA;
++	fb->fb.pseudo_palette = fb->cmap;
++
++	strncpy(fb->fb.fix.id, bcm2708_name, sizeof(fb->fb.fix.id));
++	fb->fb.fix.type = FB_TYPE_PACKED_PIXELS;
++	fb->fb.fix.type_aux = 0;
++	fb->fb.fix.xpanstep = 1;
++	fb->fb.fix.ypanstep = 1;
++	fb->fb.fix.ywrapstep = 0;
++	fb->fb.fix.accel = FB_ACCEL_NONE;
++
++	/* If we have data from the VC4 on FB's, use that, otherwise use the
++	 * module parameters
++	 */
++	if (fb->display_settings.width) {
++		fb->fb.var.xres = fb->display_settings.width;
++		fb->fb.var.yres = fb->display_settings.height;
++		fb->fb.var.xres_virtual = fb->fb.var.xres;
++		fb->fb.var.yres_virtual = fb->fb.var.yres;
++		fb->fb.var.bits_per_pixel = fb->display_settings.depth;
++	} else {
++		fb->fb.var.xres = fbwidth;
++		fb->fb.var.yres = fbheight;
++		fb->fb.var.xres_virtual = fbwidth;
++		fb->fb.var.yres_virtual = fbheight;
++		fb->fb.var.bits_per_pixel = fbdepth;
++	}
++
++	fb->fb.var.vmode = FB_VMODE_NONINTERLACED;
++	fb->fb.var.activate = FB_ACTIVATE_NOW;
++	fb->fb.var.nonstd = 0;
++	fb->fb.var.height = -1;		/* height of picture in mm    */
++	fb->fb.var.width = -1;		/* width of picture in mm    */
++	fb->fb.var.accel_flags = 0;
++
++	fb->fb.monspecs.hfmin = 0;
++	fb->fb.monspecs.hfmax = 100000;
++	fb->fb.monspecs.vfmin = 0;
++	fb->fb.monspecs.vfmax = 400;
++	fb->fb.monspecs.dclkmin = 1000000;
++	fb->fb.monspecs.dclkmax = 100000000;
++
++	bcm2708_fb_set_bitfields(&fb->fb.var);
++
++	/*
++	 * Allocate colourmap.
++	 */
++	fb_set_var(&fb->fb, &fb->fb.var);
++
++	ret = bcm2708_fb_set_par(&fb->fb);
++
++	if (ret)
++		return ret;
++
++	ret = register_framebuffer(&fb->fb);
++
++	if (ret == 0)
++		goto out;
++
++	dev_warn(fb->fb.dev, "Unable to register framebuffer (%d)\n", ret);
++out:
++	return ret;
++}
++
++static int bcm2708_fb_probe(struct platform_device *dev)
++{
++	struct device_node *fw_np;
++	struct rpi_firmware *fw;
++	int ret, i;
++	u32 num_displays;
++	struct bcm2708_fb_dev *fbdev;
++	struct { u32 base, length; } gpu_mem;
++
++	fbdev = devm_kzalloc(&dev->dev, sizeof(*fbdev), GFP_KERNEL);
++
++	if (!fbdev)
++		return -ENOMEM;
++
++	fw_np = of_parse_phandle(dev->dev.of_node, "firmware", 0);
++
++/* Remove comment when booting without Device Tree is no longer supported
++ *	if (!fw_np) {
++ *		dev_err(&dev->dev, "Missing firmware node\n");
++ *		return -ENOENT;
++ *	}
++ */
++	fw = rpi_firmware_get(fw_np);
++	fbdev->fw = fw;
++
++	if (!fw)
++		return -EPROBE_DEFER;
++
++	ret = rpi_firmware_property(fw,
++				    RPI_FIRMWARE_FRAMEBUFFER_GET_NUM_DISPLAYS,
++				    &num_displays, sizeof(u32));
++
++	/* If we fail to get the number of displays, or it returns 0, then
++	 * assume old firmware that doesn't have the mailbox call, so just
++	 * set one display
++	 */
++	if (ret || num_displays == 0) {
++		dev_err(&dev->dev,
++			"Unable to determine number of FBs. Disabling driver.\n");
++		return -ENOENT;
++	} else {
++		fbdev->firmware_supports_multifb = 1;
++	}
++
++	if (num_displays > MAX_FRAMEBUFFERS) {
++		dev_warn(&dev->dev,
++			 "More displays reported from firmware than supported in driver (%u vs %u)",
++			 num_displays, MAX_FRAMEBUFFERS);
++		num_displays = MAX_FRAMEBUFFERS;
++	}
++
++	dev_info(&dev->dev, "FB found %d display(s)\n", num_displays);
++
++	/* Set up the DMA information. Note we have just one set of DMA
++	 * parameters to work with all the FB's so requires synchronising when
++	 * being used
++	 */
++
++	mutex_init(&fbdev->dma_mutex);
++
++	fbdev->cb_base = dma_alloc_wc(&dev->dev, SZ_64K,
++						&fbdev->cb_handle,
++						GFP_KERNEL);
++	if (!fbdev->cb_base) {
++		dev_err(&dev->dev, "cannot allocate DMA CBs\n");
++		ret = -ENOMEM;
++		goto free_fb;
++	}
++
++	ret = bcm_dma_chan_alloc(BCM_DMA_FEATURE_BULK,
++				 &fbdev->dma_chan_base,
++				 &fbdev->dma_irq);
++	if (ret < 0) {
++		dev_err(&dev->dev, "Couldn't allocate a DMA channel\n");
++		goto free_cb;
++	}
++	fbdev->dma_chan = ret;
++
++	ret = request_irq(fbdev->dma_irq, bcm2708_fb_dma_irq,
++			  0, "bcm2708_fb DMA", fbdev);
++	if (ret) {
++		dev_err(&dev->dev,
++			"Failed to request DMA irq\n");
++		goto free_dma_chan;
++	}
++
++	rpi_firmware_property(fbdev->fw,
++			      RPI_FIRMWARE_GET_VC_MEMORY,
++			      &gpu_mem, sizeof(gpu_mem));
++
++	for (i = 0; i < num_displays; i++) {
++		struct bcm2708_fb *fb = &fbdev->displays[i];
++
++		fb->display_settings.display_num = i;
++		fb->dev = dev;
++		fb->fb.device = &dev->dev;
++		fb->fbdev = fbdev;
++
++		fb->gpu.base = gpu_mem.base;
++		fb->gpu.length = gpu_mem.length;
++
++		if (fbdev->firmware_supports_multifb) {
++			ret = rpi_firmware_property(fw,
++						    RPI_FIRMWARE_FRAMEBUFFER_GET_DISPLAY_SETTINGS,
++						    &fb->display_settings,
++						    GET_DISPLAY_SETTINGS_PAYLOAD_SIZE);
++		} else {
++			memset(&fb->display_settings, 0,
++			       sizeof(fb->display_settings));
++		}
++
++		ret = bcm2708_fb_register(fb);
++
++		if (ret == 0) {
++			bcm2708_fb_debugfs_init(fb);
++
++			fbdev->num_displays++;
++
++			dev_info(&dev->dev,
++				 "Registered framebuffer for display %u, size %ux%u\n",
++				 fb->display_settings.display_num,
++				 fb->fb.var.xres,
++				 fb->fb.var.yres);
++		} else {
++			// Use this to flag if this FB entry is in use.
++			fb->fbdev = NULL;
++		}
++	}
++
++	// Did we actually successfully create any FB's?
++	if (fbdev->num_displays) {
++		init_waitqueue_head(&fbdev->dma_waitq);
++		platform_set_drvdata(dev, fbdev);
++		return ret;
++	}
++
++free_dma_chan:
++	bcm_dma_chan_free(fbdev->dma_chan);
++free_cb:
++	dma_free_wc(&dev->dev, SZ_64K, fbdev->cb_base,
++			      fbdev->cb_handle);
++free_fb:
++	dev_err(&dev->dev, "probe failed, err %d\n", ret);
++
++	return ret;
++}
++
++static void bcm2708_fb_remove(struct platform_device *dev)
++{
++	struct bcm2708_fb_dev *fbdev = platform_get_drvdata(dev);
++	int i;
++
++	platform_set_drvdata(dev, NULL);
++
++	for (i = 0; i < fbdev->num_displays; i++) {
++		if (fbdev->displays[i].fb.screen_base)
++			iounmap(fbdev->displays[i].fb.screen_base);
++
++		if (fbdev->displays[i].fbdev) {
++			unregister_framebuffer(&fbdev->displays[i].fb);
++			bcm2708_fb_debugfs_deinit(&fbdev->displays[i]);
++		}
++	}
++
++	dma_free_wc(&dev->dev, SZ_64K, fbdev->cb_base,
++			      fbdev->cb_handle);
++	bcm_dma_chan_free(fbdev->dma_chan);
++	free_irq(fbdev->dma_irq, fbdev);
++
++	mutex_destroy(&fbdev->dma_mutex);
++}
++
++static const struct of_device_id bcm2708_fb_of_match_table[] = {
++	{ .compatible = "brcm,bcm2708-fb", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, bcm2708_fb_of_match_table);
++
++static struct platform_driver bcm2708_fb_driver = {
++	.probe = bcm2708_fb_probe,
++	.remove = bcm2708_fb_remove,
++	.driver = {
++		  .name = DRIVER_NAME,
++		  .owner = THIS_MODULE,
++		  .of_match_table = bcm2708_fb_of_match_table,
++		  },
++};
++
++static int __init bcm2708_fb_init(void)
++{
++	return platform_driver_register(&bcm2708_fb_driver);
++}
++
++module_init(bcm2708_fb_init);
++
++static void __exit bcm2708_fb_exit(void)
++{
++	platform_driver_unregister(&bcm2708_fb_driver);
++}
++
++module_exit(bcm2708_fb_exit);
++
++module_param(fbwidth, int, 0644);
++module_param(fbheight, int, 0644);
++module_param(fbdepth, int, 0644);
++module_param(fbswap, int, 0644);
++
++MODULE_DESCRIPTION("BCM2708 framebuffer driver");
++MODULE_LICENSE("GPL");
++
++MODULE_PARM_DESC(fbwidth, "Width of ARM Framebuffer");
++MODULE_PARM_DESC(fbheight, "Height of ARM Framebuffer");
++MODULE_PARM_DESC(fbdepth, "Bit depth of ARM Framebuffer");
++MODULE_PARM_DESC(fbswap, "Swap order of red and blue in 24 and 32 bit modes");
+--- a/drivers/video/fbdev/core/fb_chrdev.c
++++ b/drivers/video/fbdev/core/fb_chrdev.c
+@@ -59,6 +59,30 @@ static ssize_t fb_write(struct file *fil
+ 	return info->fbops->fb_write(info, buf, count, ppos);
+ }
+ 
++static int fb_copyarea_user(struct fb_info *info,
++			    struct fb_copyarea *copy)
++{
++	int ret = 0;
++	lock_fb_info(info);
++	if (copy->dx >= info->var.xres ||
++	    copy->sx >= info->var.xres ||
++	    copy->width > info->var.xres ||
++	    copy->dy >= info->var.yres ||
++	    copy->sy >= info->var.yres ||
++	    copy->height > info->var.yres ||
++	    copy->dx + copy->width > info->var.xres ||
++	    copy->sx + copy->width > info->var.xres ||
++	    copy->dy + copy->height > info->var.yres ||
++	    copy->sy + copy->height > info->var.yres) {
++		ret = -EINVAL;
++		goto out;
++	}
++	info->fbops->fb_copyarea(info, copy);
++out:
++	unlock_fb_info(info);
++	return ret;
++}
++
+ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
+ 			unsigned long arg)
+ {
+@@ -67,6 +91,7 @@ static long do_fb_ioctl(struct fb_info *
+ 	struct fb_fix_screeninfo fix;
+ 	struct fb_cmap cmap_from;
+ 	struct fb_cmap_user cmap;
++	struct fb_copyarea copy;
+ 	void __user *argp = (void __user *)arg;
+ 	long ret = 0;
+ 
+@@ -148,6 +173,15 @@ static long do_fb_ioctl(struct fb_info *
+ 		unlock_fb_info(info);
+ 		console_unlock();
+ 		break;
++	case FBIOCOPYAREA:
++		if (info->flags & FBINFO_HWACCEL_COPYAREA) {
++			/* only provide this ioctl if it is accelerated */
++			if (copy_from_user(&copy, argp, sizeof(copy)))
++				return -EFAULT;
++			ret = fb_copyarea_user(info, &copy);
++			break;
++		}
++	fallthrough;
+ 	default:
+ 		lock_fb_info(info);
+ 		fb = info->fbops;
+@@ -287,6 +321,7 @@ static long fb_compat_ioctl(struct file
+ 	case FBIOPAN_DISPLAY:
+ 	case FBIOGET_CON2FBMAP:
+ 	case FBIOPUT_CON2FBMAP:
++	case FBIOCOPYAREA:
+ 		arg = (unsigned long) compat_ptr(arg);
+ 		fallthrough;
+ 	case FBIOBLANK:
+--- a/drivers/video/logo/logo_linux_clut224.ppm
++++ b/drivers/video/logo/logo_linux_clut224.ppm
+@@ -1,1604 +1,883 @@
+ P3
+-# Standard 224-color Linux logo
+-80 80
++63 80
+ 255
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  6   6   6   6   6   6  10  10  10  10  10  10
+- 10  10  10   6   6   6   6   6   6   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   6   6   6  10  10  10  14  14  14
+- 22  22  22  26  26  26  30  30  30  34  34  34
+- 30  30  30  30  30  30  26  26  26  18  18  18
+- 14  14  14  10  10  10   6   6   6   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   1   0   0   1   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  6   6   6  14  14  14  26  26  26  42  42  42
+- 54  54  54  66  66  66  78  78  78  78  78  78
+- 78  78  78  74  74  74  66  66  66  54  54  54
+- 42  42  42  26  26  26  18  18  18  10  10  10
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   1   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 22  22  22  42  42  42  66  66  66  86  86  86
+- 66  66  66  38  38  38  38  38  38  22  22  22
+- 26  26  26  34  34  34  54  54  54  66  66  66
+- 86  86  86  70  70  70  46  46  46  26  26  26
+- 14  14  14   6   6   6   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   1   0   0   1   0   0   1   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0  10  10  10  26  26  26
+- 50  50  50  82  82  82  58  58  58   6   6   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  6   6   6  54  54  54  86  86  86  66  66  66
+- 38  38  38  18  18  18   6   6   6   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   6   6   6  22  22  22  50  50  50
+- 78  78  78  34  34  34   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   6   6   6  70  70  70
+- 78  78  78  46  46  46  22  22  22   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   1   0   0   1   0   0   1   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  6   6   6  18  18  18  42  42  42  82  82  82
+- 26  26  26   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6  14  14  14
+- 46  46  46  34  34  34   6   6   6   2   2   6
+- 42  42  42  78  78  78  42  42  42  18  18  18
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   1   0   0   0   0   0   1   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+- 10  10  10  30  30  30  66  66  66  58  58  58
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6  26  26  26
+- 86  86  86 101 101 101  46  46  46  10  10  10
+-  2   2   6  58  58  58  70  70  70  34  34  34
+- 10  10  10   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   1   0   0   1   0   0   1   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+- 14  14  14  42  42  42  86  86  86  10  10  10
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6  30  30  30
+- 94  94  94  94  94  94  58  58  58  26  26  26
+-  2   2   6   6   6   6  78  78  78  54  54  54
+- 22  22  22   6   6   6   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+- 22  22  22  62  62  62  62  62  62   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6  26  26  26
+- 54  54  54  38  38  38  18  18  18  10  10  10
+-  2   2   6   2   2   6  34  34  34  82  82  82
+- 38  38  38  14  14  14   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   1   0   0   1   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+- 30  30  30  78  78  78  30  30  30   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6  10  10  10
+- 10  10  10   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6  78  78  78
+- 50  50  50  18  18  18   6   6   6   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   1   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 38  38  38  86  86  86  14  14  14   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6  54  54  54
+- 66  66  66  26  26  26   6   6   6   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   1   0   0   1   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  14  14  14
+- 42  42  42  82  82  82   2   2   6   2   2   6
+-  2   2   6   6   6   6  10  10  10   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   6   6   6
+- 14  14  14  10  10  10   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6  18  18  18
+- 82  82  82  34  34  34  10  10  10   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   1   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  14  14  14
+- 46  46  46  86  86  86   2   2   6   2   2   6
+-  6   6   6   6   6   6  22  22  22  34  34  34
+-  6   6   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6  18  18  18  34  34  34
+- 10  10  10  50  50  50  22  22  22   2   2   6
+-  2   2   6   2   2   6   2   2   6  10  10  10
+- 86  86  86  42  42  42  14  14  14   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   1   0   0   1   0   0   1   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  14  14  14
+- 46  46  46  86  86  86   2   2   6   2   2   6
+- 38  38  38 116 116 116  94  94  94  22  22  22
+- 22  22  22   2   2   6   2   2   6   2   2   6
+- 14  14  14  86  86  86 138 138 138 162 162 162
+-154 154 154  38  38  38  26  26  26   6   6   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 86  86  86  46  46  46  14  14  14   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  14  14  14
+- 46  46  46  86  86  86   2   2   6  14  14  14
+-134 134 134 198 198 198 195 195 195 116 116 116
+- 10  10  10   2   2   6   2   2   6   6   6   6
+-101  98  89 187 187 187 210 210 210 218 218 218
+-214 214 214 134 134 134  14  14  14   6   6   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 86  86  86  50  50  50  18  18  18   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   1   0   0   0
+-  0   0   1   0   0   1   0   0   1   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  14  14  14
+- 46  46  46  86  86  86   2   2   6  54  54  54
+-218 218 218 195 195 195 226 226 226 246 246 246
+- 58  58  58   2   2   6   2   2   6  30  30  30
+-210 210 210 253 253 253 174 174 174 123 123 123
+-221 221 221 234 234 234  74  74  74   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 70  70  70  58  58  58  22  22  22   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  14  14  14
+- 46  46  46  82  82  82   2   2   6 106 106 106
+-170 170 170  26  26  26  86  86  86 226 226 226
+-123 123 123  10  10  10  14  14  14  46  46  46
+-231 231 231 190 190 190   6   6   6  70  70  70
+- 90  90  90 238 238 238 158 158 158   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 70  70  70  58  58  58  22  22  22   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   1   0   0   0
+-  0   0   1   0   0   1   0   0   1   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  14  14  14
+- 42  42  42  86  86  86   6   6   6 116 116 116
+-106 106 106   6   6   6  70  70  70 149 149 149
+-128 128 128  18  18  18  38  38  38  54  54  54
+-221 221 221 106 106 106   2   2   6  14  14  14
+- 46  46  46 190 190 190 198 198 198   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 74  74  74  62  62  62  22  22  22   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   1   0   0   0
+-  0   0   1   0   0   0   0   0   1   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  14  14  14
+- 42  42  42  94  94  94  14  14  14 101 101 101
+-128 128 128   2   2   6  18  18  18 116 116 116
+-118  98  46 121  92   8 121  92   8  98  78  10
+-162 162 162 106 106 106   2   2   6   2   2   6
+-  2   2   6 195 195 195 195 195 195   6   6   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 74  74  74  62  62  62  22  22  22   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   1   0   0   1
+-  0   0   1   0   0   0   0   0   1   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 38  38  38  90  90  90  14  14  14  58  58  58
+-210 210 210  26  26  26  54  38   6 154 114  10
+-226 170  11 236 186  11 225 175  15 184 144  12
+-215 174  15 175 146  61  37  26   9   2   2   6
+- 70  70  70 246 246 246 138 138 138   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 70  70  70  66  66  66  26  26  26   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 38  38  38  86  86  86  14  14  14  10  10  10
+-195 195 195 188 164 115 192 133   9 225 175  15
+-239 182  13 234 190  10 232 195  16 232 200  30
+-245 207  45 241 208  19 232 195  16 184 144  12
+-218 194 134 211 206 186  42  42  42   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 50  50  50  74  74  74  30  30  30   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 34  34  34  86  86  86  14  14  14   2   2   6
+-121  87  25 192 133   9 219 162  10 239 182  13
+-236 186  11 232 195  16 241 208  19 244 214  54
+-246 218  60 246 218  38 246 215  20 241 208  19
+-241 208  19 226 184  13 121  87  25   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 50  50  50  82  82  82  34  34  34  10  10  10
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 34  34  34  82  82  82  30  30  30  61  42   6
+-180 123   7 206 145  10 230 174  11 239 182  13
+-234 190  10 238 202  15 241 208  19 246 218  74
+-246 218  38 246 215  20 246 215  20 246 215  20
+-226 184  13 215 174  15 184 144  12   6   6   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 26  26  26  94  94  94  42  42  42  14  14  14
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 30  30  30  78  78  78  50  50  50 104  69   6
+-192 133   9 216 158  10 236 178  12 236 186  11
+-232 195  16 241 208  19 244 214  54 245 215  43
+-246 215  20 246 215  20 241 208  19 198 155  10
+-200 144  11 216 158  10 156 118  10   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  6   6   6  90  90  90  54  54  54  18  18  18
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 30  30  30  78  78  78  46  46  46  22  22  22
+-137  92   6 210 162  10 239 182  13 238 190  10
+-238 202  15 241 208  19 246 215  20 246 215  20
+-241 208  19 203 166  17 185 133  11 210 150  10
+-216 158  10 210 150  10 102  78  10   2   2   6
+-  6   6   6  54  54  54  14  14  14   2   2   6
+-  2   2   6  62  62  62  74  74  74  30  30  30
+- 10  10  10   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 34  34  34  78  78  78  50  50  50   6   6   6
+- 94  70  30 139 102  15 190 146  13 226 184  13
+-232 200  30 232 195  16 215 174  15 190 146  13
+-168 122  10 192 133   9 210 150  10 213 154  11
+-202 150  34 182 157 106 101  98  89   2   2   6
+-  2   2   6  78  78  78 116 116 116  58  58  58
+-  2   2   6  22  22  22  90  90  90  46  46  46
+- 18  18  18   6   6   6   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 38  38  38  86  86  86  50  50  50   6   6   6
+-128 128 128 174 154 114 156 107  11 168 122  10
+-198 155  10 184 144  12 197 138  11 200 144  11
+-206 145  10 206 145  10 197 138  11 188 164 115
+-195 195 195 198 198 198 174 174 174  14  14  14
+-  2   2   6  22  22  22 116 116 116 116 116 116
+- 22  22  22   2   2   6  74  74  74  70  70  70
+- 30  30  30  10  10  10   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   6   6   6  18  18  18
+- 50  50  50 101 101 101  26  26  26  10  10  10
+-138 138 138 190 190 190 174 154 114 156 107  11
+-197 138  11 200 144  11 197 138  11 192 133   9
+-180 123   7 190 142  34 190 178 144 187 187 187
+-202 202 202 221 221 221 214 214 214  66  66  66
+-  2   2   6   2   2   6  50  50  50  62  62  62
+-  6   6   6   2   2   6  10  10  10  90  90  90
+- 50  50  50  18  18  18   6   6   6   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0  10  10  10  34  34  34
+- 74  74  74  74  74  74   2   2   6   6   6   6
+-144 144 144 198 198 198 190 190 190 178 166 146
+-154 121  60 156 107  11 156 107  11 168 124  44
+-174 154 114 187 187 187 190 190 190 210 210 210
+-246 246 246 253 253 253 253 253 253 182 182 182
+-  6   6   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6  62  62  62
+- 74  74  74  34  34  34  14  14  14   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0  10  10  10  22  22  22  54  54  54
+- 94  94  94  18  18  18   2   2   6  46  46  46
+-234 234 234 221 221 221 190 190 190 190 190 190
+-190 190 190 187 187 187 187 187 187 190 190 190
+-190 190 190 195 195 195 214 214 214 242 242 242
+-253 253 253 253 253 253 253 253 253 253 253 253
+- 82  82  82   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6  14  14  14
+- 86  86  86  54  54  54  22  22  22   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  6   6   6  18  18  18  46  46  46  90  90  90
+- 46  46  46  18  18  18   6   6   6 182 182 182
+-253 253 253 246 246 246 206 206 206 190 190 190
+-190 190 190 190 190 190 190 190 190 190 190 190
+-206 206 206 231 231 231 250 250 250 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-202 202 202  14  14  14   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 42  42  42  86  86  86  42  42  42  18  18  18
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+- 14  14  14  38  38  38  74  74  74  66  66  66
+-  2   2   6   6   6   6  90  90  90 250 250 250
+-253 253 253 253 253 253 238 238 238 198 198 198
+-190 190 190 190 190 190 195 195 195 221 221 221
+-246 246 246 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253  82  82  82   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6  78  78  78  70  70  70  34  34  34
+- 14  14  14   6   6   6   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  14  14  14
+- 34  34  34  66  66  66  78  78  78   6   6   6
+-  2   2   6  18  18  18 218 218 218 253 253 253
+-253 253 253 253 253 253 253 253 253 246 246 246
+-226 226 226 231 231 231 246 246 246 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 178 178 178   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6  18  18  18  90  90  90  62  62  62
+- 30  30  30  10  10  10   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0  10  10  10  26  26  26
+- 58  58  58  90  90  90  18  18  18   2   2   6
+-  2   2   6 110 110 110 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-250 250 250 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 231 231 231  18  18  18   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6  18  18  18  94  94  94
+- 54  54  54  26  26  26  10  10  10   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   6   6   6  22  22  22  50  50  50
+- 90  90  90  26  26  26   2   2   6   2   2   6
+- 14  14  14 195 195 195 250 250 250 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-250 250 250 242 242 242  54  54  54   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6  38  38  38
+- 86  86  86  50  50  50  22  22  22   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  6   6   6  14  14  14  38  38  38  82  82  82
+- 34  34  34   2   2   6   2   2   6   2   2   6
+- 42  42  42 195 195 195 246 246 246 253 253 253
+-253 253 253 253 253 253 253 253 253 250 250 250
+-242 242 242 242 242 242 250 250 250 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 250 250 250 246 246 246 238 238 238
+-226 226 226 231 231 231 101 101 101   6   6   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 38  38  38  82  82  82  42  42  42  14  14  14
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+- 10  10  10  26  26  26  62  62  62  66  66  66
+-  2   2   6   2   2   6   2   2   6   6   6   6
+- 70  70  70 170 170 170 206 206 206 234 234 234
+-246 246 246 250 250 250 250 250 250 238 238 238
+-226 226 226 231 231 231 238 238 238 250 250 250
+-250 250 250 250 250 250 246 246 246 231 231 231
+-214 214 214 206 206 206 202 202 202 202 202 202
+-198 198 198 202 202 202 182 182 182  18  18  18
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6  62  62  62  66  66  66  30  30  30
+- 10  10  10   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+- 14  14  14  42  42  42  82  82  82  18  18  18
+-  2   2   6   2   2   6   2   2   6  10  10  10
+- 94  94  94 182 182 182 218 218 218 242 242 242
+-250 250 250 253 253 253 253 253 253 250 250 250
+-234 234 234 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 246 246 246
+-238 238 238 226 226 226 210 210 210 202 202 202
+-195 195 195 195 195 195 210 210 210 158 158 158
+-  6   6   6  14  14  14  50  50  50  14  14  14
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   6   6   6  86  86  86  46  46  46
+- 18  18  18   6   6   6   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+- 22  22  22  54  54  54  70  70  70   2   2   6
+-  2   2   6  10  10  10   2   2   6  22  22  22
+-166 166 166 231 231 231 250 250 250 253 253 253
+-253 253 253 253 253 253 253 253 253 250 250 250
+-242 242 242 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 246 246 246
+-231 231 231 206 206 206 198 198 198 226 226 226
+- 94  94  94   2   2   6   6   6   6  38  38  38
+- 30  30  30   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6  62  62  62  66  66  66
+- 26  26  26  10  10  10   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 30  30  30  74  74  74  50  50  50   2   2   6
+- 26  26  26  26  26  26   2   2   6 106 106 106
+-238 238 238 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 246 246 246 218 218 218 202 202 202
+-210 210 210  14  14  14   2   2   6   2   2   6
+- 30  30  30  22  22  22   2   2   6   2   2   6
+-  2   2   6   2   2   6  18  18  18  86  86  86
+- 42  42  42  14  14  14   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  14  14  14
+- 42  42  42  90  90  90  22  22  22   2   2   6
+- 42  42  42   2   2   6  18  18  18 218 218 218
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 250 250 250 221 221 221
+-218 218 218 101 101 101   2   2   6  14  14  14
+- 18  18  18  38  38  38  10  10  10   2   2   6
+-  2   2   6   2   2   6   2   2   6  78  78  78
+- 58  58  58  22  22  22   6   6   6   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   6   6   6  18  18  18
+- 54  54  54  82  82  82   2   2   6  26  26  26
+- 22  22  22   2   2   6 123 123 123 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 250 250 250
+-238 238 238 198 198 198   6   6   6  38  38  38
+- 58  58  58  26  26  26  38  38  38   2   2   6
+-  2   2   6   2   2   6   2   2   6  46  46  46
+- 78  78  78  30  30  30  10  10  10   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0  10  10  10  30  30  30
+- 74  74  74  58  58  58   2   2   6  42  42  42
+-  2   2   6  22  22  22 231 231 231 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 250 250 250
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 246 246 246  46  46  46  38  38  38
+- 42  42  42  14  14  14  38  38  38  14  14  14
+-  2   2   6   2   2   6   2   2   6   6   6   6
+- 86  86  86  46  46  46  14  14  14   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   6   6   6  14  14  14  42  42  42
+- 90  90  90  18  18  18  18  18  18  26  26  26
+-  2   2   6 116 116 116 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 250 250 250 238 238 238
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253  94  94  94   6   6   6
+-  2   2   6   2   2   6  10  10  10  34  34  34
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 74  74  74  58  58  58  22  22  22   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0  10  10  10  26  26  26  66  66  66
+- 82  82  82   2   2   6  38  38  38   6   6   6
+- 14  14  14 210 210 210 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 246 246 246 242 242 242
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 144 144 144   2   2   6
+-  2   2   6   2   2   6   2   2   6  46  46  46
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 42  42  42  74  74  74  30  30  30  10  10  10
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  6   6   6  14  14  14  42  42  42  90  90  90
+- 26  26  26   6   6   6  42  42  42   2   2   6
+- 74  74  74 250 250 250 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 242 242 242 242 242 242
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 182 182 182   2   2   6
+-  2   2   6   2   2   6   2   2   6  46  46  46
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 10  10  10  86  86  86  38  38  38  10  10  10
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+- 10  10  10  26  26  26  66  66  66  82  82  82
+-  2   2   6  22  22  22  18  18  18   2   2   6
+-149 149 149 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 234 234 234 242 242 242
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 206 206 206   2   2   6
+-  2   2   6   2   2   6   2   2   6  38  38  38
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  6   6   6  86  86  86  46  46  46  14  14  14
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+- 18  18  18  46  46  46  86  86  86  18  18  18
+-  2   2   6  34  34  34  10  10  10   6   6   6
+-210 210 210 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 234 234 234 242 242 242
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 221 221 221   6   6   6
+-  2   2   6   2   2   6   6   6   6  30  30  30
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6  82  82  82  54  54  54  18  18  18
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 26  26  26  66  66  66  62  62  62   2   2   6
+-  2   2   6  38  38  38  10  10  10  26  26  26
+-238 238 238 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231 238 238 238
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231   6   6   6
+-  2   2   6   2   2   6  10  10  10  30  30  30
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6  66  66  66  58  58  58  22  22  22
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 38  38  38  78  78  78   6   6   6   2   2   6
+-  2   2   6  46  46  46  14  14  14  42  42  42
+-246 246 246 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231 242 242 242
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 234 234 234  10  10  10
+-  2   2   6   2   2   6  22  22  22  14  14  14
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6  66  66  66  62  62  62  22  22  22
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   6   6   6  18  18  18
+- 50  50  50  74  74  74   2   2   6   2   2   6
+- 14  14  14  70  70  70  34  34  34  62  62  62
+-250 250 250 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231 246 246 246
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 234 234 234  14  14  14
+-  2   2   6   2   2   6  30  30  30   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6  66  66  66  62  62  62  22  22  22
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   6   6   6  18  18  18
+- 54  54  54  62  62  62   2   2   6   2   2   6
+-  2   2   6  30  30  30  46  46  46  70  70  70
+-250 250 250 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231 246 246 246
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 226 226 226  10  10  10
+-  2   2   6   6   6   6  30  30  30   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6  66  66  66  58  58  58  22  22  22
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   6   6   6  22  22  22
+- 58  58  58  62  62  62   2   2   6   2   2   6
+-  2   2   6   2   2   6  30  30  30  78  78  78
+-250 250 250 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231 246 246 246
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 206 206 206   2   2   6
+- 22  22  22  34  34  34  18  14   6  22  22  22
+- 26  26  26  18  18  18   6   6   6   2   2   6
+-  2   2   6  82  82  82  54  54  54  18  18  18
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   6   6   6  26  26  26
+- 62  62  62 106 106 106  74  54  14 185 133  11
+-210 162  10 121  92   8   6   6   6  62  62  62
+-238 238 238 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231 246 246 246
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 158 158 158  18  18  18
+- 14  14  14   2   2   6   2   2   6   2   2   6
+-  6   6   6  18  18  18  66  66  66  38  38  38
+-  6   6   6  94  94  94  50  50  50  18  18  18
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+- 10  10  10  10  10  10  18  18  18  38  38  38
+- 78  78  78 142 134 106 216 158  10 242 186  14
+-246 190  14 246 190  14 156 118  10  10  10  10
+- 90  90  90 238 238 238 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231 250 250 250
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 246 230 190
+-238 204  91 238 204  91 181 142  44  37  26   9
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6  38  38  38  46  46  46
+- 26  26  26 106 106 106  54  54  54  18  18  18
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   6   6   6  14  14  14  22  22  22
+- 30  30  30  38  38  38  50  50  50  70  70  70
+-106 106 106 190 142  34 226 170  11 242 186  14
+-246 190  14 246 190  14 246 190  14 154 114  10
+-  6   6   6  74  74  74 226 226 226 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231 250 250 250
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 228 184  62
+-241 196  14 241 208  19 232 195  16  38  30  10
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   6   6   6  30  30  30  26  26  26
+-203 166  17 154 142  90  66  66  66  26  26  26
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  6   6   6  18  18  18  38  38  38  58  58  58
+- 78  78  78  86  86  86 101 101 101 123 123 123
+-175 146  61 210 150  10 234 174  13 246 186  14
+-246 190  14 246 190  14 246 190  14 238 190  10
+-102  78  10   2   2   6  46  46  46 198 198 198
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 234 234 234 242 242 242
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 224 178  62
+-242 186  14 241 196  14 210 166  10  22  18   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   6   6   6 121  92   8
+-238 202  15 232 195  16  82  82  82  34  34  34
+- 10  10  10   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+- 14  14  14  38  38  38  70  70  70 154 122  46
+-190 142  34 200 144  11 197 138  11 197 138  11
+-213 154  11 226 170  11 242 186  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-225 175  15  46  32   6   2   2   6  22  22  22
+-158 158 158 250 250 250 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 250 250 250 242 242 242 224 178  62
+-239 182  13 236 186  11 213 154  11  46  32   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6  61  42   6 225 175  15
+-238 190  10 236 186  11 112 100  78  42  42  42
+- 14  14  14   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+- 22  22  22  54  54  54 154 122  46 213 154  11
+-226 170  11 230 174  11 226 170  11 226 170  11
+-236 178  12 242 186  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-241 196  14 184 144  12  10  10  10   2   2   6
+-  6   6   6 116 116 116 242 242 242 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 231 231 231 198 198 198 214 170  54
+-236 178  12 236 178  12 210 150  10 137  92   6
+- 18  14   6   2   2   6   2   2   6   2   2   6
+-  6   6   6  70  47   6 200 144  11 236 178  12
+-239 182  13 239 182  13 124 112  88  58  58  58
+- 22  22  22   6   6   6   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 30  30  30  70  70  70 180 133  36 226 170  11
+-239 182  13 242 186  14 242 186  14 246 186  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 232 195  16  98  70   6   2   2   6
+-  2   2   6   2   2   6  66  66  66 221 221 221
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 206 206 206 198 198 198 214 166  58
+-230 174  11 230 174  11 216 158  10 192 133   9
+-163 110   8 116  81   8 102  78  10 116  81   8
+-167 114   7 197 138  11 226 170  11 239 182  13
+-242 186  14 242 186  14 162 146  94  78  78  78
+- 34  34  34  14  14  14   6   6   6   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+- 30  30  30  78  78  78 190 142  34 226 170  11
+-239 182  13 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 241 196  14 203 166  17  22  18   6
+-  2   2   6   2   2   6   2   2   6  38  38  38
+-218 218 218 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-250 250 250 206 206 206 198 198 198 202 162  69
+-226 170  11 236 178  12 224 166  10 210 150  10
+-200 144  11 197 138  11 192 133   9 197 138  11
+-210 150  10 226 170  11 242 186  14 246 190  14
+-246 190  14 246 186  14 225 175  15 124 112  88
+- 62  62  62  30  30  30  14  14  14   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 30  30  30  78  78  78 174 135  50 224 166  10
+-239 182  13 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 241 196  14 139 102  15
+-  2   2   6   2   2   6   2   2   6   2   2   6
+- 78  78  78 250 250 250 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-250 250 250 214 214 214 198 198 198 190 150  46
+-219 162  10 236 178  12 234 174  13 224 166  10
+-216 158  10 213 154  11 213 154  11 216 158  10
+-226 170  11 239 182  13 246 190  14 246 190  14
+-246 190  14 246 190  14 242 186  14 206 162  42
+-101 101 101  58  58  58  30  30  30  14  14  14
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 30  30  30  74  74  74 174 135  50 216 158  10
+-236 178  12 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 241 196  14 226 184  13
+- 61  42   6   2   2   6   2   2   6   2   2   6
+- 22  22  22 238 238 238 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 226 226 226 187 187 187 180 133  36
+-216 158  10 236 178  12 239 182  13 236 178  12
+-230 174  11 226 170  11 226 170  11 230 174  11
+-236 178  12 242 186  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 186  14 239 182  13
+-206 162  42 106 106 106  66  66  66  34  34  34
+- 14  14  14   6   6   6   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+- 26  26  26  70  70  70 163 133  67 213 154  11
+-236 178  12 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 241 196  14
+-190 146  13  18  14   6   2   2   6   2   2   6
+- 46  46  46 246 246 246 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 221 221 221  86  86  86 156 107  11
+-216 158  10 236 178  12 242 186  14 246 186  14
+-242 186  14 239 182  13 239 182  13 242 186  14
+-242 186  14 246 186  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-242 186  14 225 175  15 142 122  72  66  66  66
+- 30  30  30  10  10  10   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+- 26  26  26  70  70  70 163 133  67 210 150  10
+-236 178  12 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-232 195  16 121  92   8  34  34  34 106 106 106
+-221 221 221 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-242 242 242  82  82  82  18  14   6 163 110   8
+-216 158  10 236 178  12 242 186  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 242 186  14 163 133  67
+- 46  46  46  18  18  18   6   6   6   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  10  10  10
+- 30  30  30  78  78  78 163 133  67 210 150  10
+-236 178  12 246 186  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-241 196  14 215 174  15 190 178 144 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 218 218 218
+- 58  58  58   2   2   6  22  18   6 167 114   7
+-216 158  10 236 178  12 246 186  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 186  14 242 186  14 190 150  46
+- 54  54  54  22  22  22   6   6   6   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  14  14  14
+- 38  38  38  86  86  86 180 133  36 213 154  11
+-236 178  12 246 186  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 232 195  16 190 146  13 214 214 214
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 250 250 250 170 170 170  26  26  26
+-  2   2   6   2   2   6  37  26   9 163 110   8
+-219 162  10 239 182  13 246 186  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 186  14 236 178  12 224 166  10 142 122  72
+- 46  46  46  18  18  18   6   6   6   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   6   6   6  18  18  18
+- 50  50  50 109 106  95 192 133   9 224 166  10
+-242 186  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-242 186  14 226 184  13 210 162  10 142 110  46
+-226 226 226 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-198 198 198  66  66  66   2   2   6   2   2   6
+-  2   2   6   2   2   6  50  34   6 156 107  11
+-219 162  10 239 182  13 246 186  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 242 186  14
+-234 174  13 213 154  11 154 122  46  66  66  66
+- 30  30  30  10  10  10   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   6   6   6  22  22  22
+- 58  58  58 154 121  60 206 145  10 234 174  13
+-242 186  14 246 186  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 186  14 236 178  12 210 162  10 163 110   8
+- 61  42   6 138 138 138 218 218 218 250 250 250
+-253 253 253 253 253 253 253 253 253 250 250 250
+-242 242 242 210 210 210 144 144 144  66  66  66
+-  6   6   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6  61  42   6 163 110   8
+-216 158  10 236 178  12 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 239 182  13 230 174  11 216 158  10
+-190 142  34 124 112  88  70  70  70  38  38  38
+- 18  18  18   6   6   6   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   6   6   6  22  22  22
+- 62  62  62 168 124  44 206 145  10 224 166  10
+-236 178  12 239 182  13 242 186  14 242 186  14
+-246 186  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 236 178  12 216 158  10 175 118   6
+- 80  54   7   2   2   6   6   6   6  30  30  30
+- 54  54  54  62  62  62  50  50  50  38  38  38
+- 14  14  14   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   6   6   6  80  54   7 167 114   7
+-213 154  11 236 178  12 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 190  14 242 186  14 239 182  13 239 182  13
+-230 174  11 210 150  10 174 135  50 124 112  88
+- 82  82  82  54  54  54  34  34  34  18  18  18
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   6   6   6  18  18  18
+- 50  50  50 158 118  36 192 133   9 200 144  11
+-216 158  10 219 162  10 224 166  10 226 170  11
+-230 174  11 236 178  12 239 182  13 239 182  13
+-242 186  14 246 186  14 246 190  14 246 190  14
+-246 190  14 246 190  14 246 190  14 246 190  14
+-246 186  14 230 174  11 210 150  10 163 110   8
+-104  69   6  10  10  10   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   6   6   6  91  60   6 167 114   7
+-206 145  10 230 174  11 242 186  14 246 190  14
+-246 190  14 246 190  14 246 186  14 242 186  14
+-239 182  13 230 174  11 224 166  10 213 154  11
+-180 133  36 124 112  88  86  86  86  58  58  58
+- 38  38  38  22  22  22  10  10  10   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0  14  14  14
+- 34  34  34  70  70  70 138 110  50 158 118  36
+-167 114   7 180 123   7 192 133   9 197 138  11
+-200 144  11 206 145  10 213 154  11 219 162  10
+-224 166  10 230 174  11 239 182  13 242 186  14
+-246 186  14 246 186  14 246 186  14 246 186  14
+-239 182  13 216 158  10 185 133  11 152  99   6
+-104  69   6  18  14   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   2   2   6   2   2   6   2   2   6
+-  2   2   6   6   6   6  80  54   7 152  99   6
+-192 133   9 219 162  10 236 178  12 239 182  13
+-246 186  14 242 186  14 239 182  13 236 178  12
+-224 166  10 206 145  10 192 133   9 154 121  60
+- 94  94  94  62  62  62  42  42  42  22  22  22
+- 14  14  14   6   6   6   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+- 18  18  18  34  34  34  58  58  58  78  78  78
+-101  98  89 124 112  88 142 110  46 156 107  11
+-163 110   8 167 114   7 175 118   6 180 123   7
+-185 133  11 197 138  11 210 150  10 219 162  10
+-226 170  11 236 178  12 236 178  12 234 174  13
+-219 162  10 197 138  11 163 110   8 130  83   6
+- 91  60   6  10  10  10   2   2   6   2   2   6
+- 18  18  18  38  38  38  38  38  38  38  38  38
+- 38  38  38  38  38  38  38  38  38  38  38  38
+- 38  38  38  38  38  38  26  26  26   2   2   6
+-  2   2   6   6   6   6  70  47   6 137  92   6
+-175 118   6 200 144  11 219 162  10 230 174  11
+-234 174  13 230 174  11 219 162  10 210 150  10
+-192 133   9 163 110   8 124 112  88  82  82  82
+- 50  50  50  30  30  30  14  14  14   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  6   6   6  14  14  14  22  22  22  34  34  34
+- 42  42  42  58  58  58  74  74  74  86  86  86
+-101  98  89 122 102  70 130  98  46 121  87  25
+-137  92   6 152  99   6 163 110   8 180 123   7
+-185 133  11 197 138  11 206 145  10 200 144  11
+-180 123   7 156 107  11 130  83   6 104  69   6
+- 50  34   6  54  54  54 110 110 110 101  98  89
+- 86  86  86  82  82  82  78  78  78  78  78  78
+- 78  78  78  78  78  78  78  78  78  78  78  78
+- 78  78  78  82  82  82  86  86  86  94  94  94
+-106 106 106 101 101 101  86  66  34 124  80   6
+-156 107  11 180 123   7 192 133   9 200 144  11
+-206 145  10 200 144  11 192 133   9 175 118   6
+-139 102  15 109 106  95  70  70  70  42  42  42
+- 22  22  22  10  10  10   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   6   6   6  10  10  10
+- 14  14  14  22  22  22  30  30  30  38  38  38
+- 50  50  50  62  62  62  74  74  74  90  90  90
+-101  98  89 112 100  78 121  87  25 124  80   6
+-137  92   6 152  99   6 152  99   6 152  99   6
+-138  86   6 124  80   6  98  70   6  86  66  30
+-101  98  89  82  82  82  58  58  58  46  46  46
+- 38  38  38  34  34  34  34  34  34  34  34  34
+- 34  34  34  34  34  34  34  34  34  34  34  34
+- 34  34  34  34  34  34  38  38  38  42  42  42
+- 54  54  54  82  82  82  94  86  76  91  60   6
+-134  86   6 156 107  11 167 114   7 175 118   6
+-175 118   6 167 114   7 152  99   6 121  87  25
+-101  98  89  62  62  62  34  34  34  18  18  18
+-  6   6   6   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   6   6   6   6   6   6  10  10  10
+- 18  18  18  22  22  22  30  30  30  42  42  42
+- 50  50  50  66  66  66  86  86  86 101  98  89
+-106  86  58  98  70   6 104  69   6 104  69   6
+-104  69   6  91  60   6  82  62  34  90  90  90
+- 62  62  62  38  38  38  22  22  22  14  14  14
+- 10  10  10  10  10  10  10  10  10  10  10  10
+- 10  10  10  10  10  10   6   6   6  10  10  10
+- 10  10  10  10  10  10  10  10  10  14  14  14
+- 22  22  22  42  42  42  70  70  70  89  81  66
+- 80  54   7 104  69   6 124  80   6 137  92   6
+-134  86   6 116  81   8 100  82  52  86  86  86
+- 58  58  58  30  30  30  14  14  14   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   6   6   6  10  10  10  14  14  14
+- 18  18  18  26  26  26  38  38  38  54  54  54
+- 70  70  70  86  86  86  94  86  76  89  81  66
+- 89  81  66  86  86  86  74  74  74  50  50  50
+- 30  30  30  14  14  14   6   6   6   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  6   6   6  18  18  18  34  34  34  58  58  58
+- 82  82  82  89  81  66  89  81  66  89  81  66
+- 94  86  66  94  86  76  74  74  74  50  50  50
+- 26  26  26  14  14  14   6   6   6   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  6   6   6   6   6   6  14  14  14  18  18  18
+- 30  30  30  38  38  38  46  46  46  54  54  54
+- 50  50  50  42  42  42  30  30  30  18  18  18
+- 10  10  10   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   6   6   6  14  14  14  26  26  26
+- 38  38  38  50  50  50  58  58  58  58  58  58
+- 54  54  54  42  42  42  30  30  30  18  18  18
+- 10  10  10   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+-  6   6   6  10  10  10  14  14  14  18  18  18
+- 18  18  18  14  14  14  10  10  10   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   6   6   6
+- 14  14  14  18  18  18  22  22  22  22  22  22
+- 18  18  18  14  14  14  10  10  10   6   6   6
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
+-  0   0   0   0   0   0   0   0   0   0   0   0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 1 0  0 0 0  0 0 0  1 1 0
++0 1 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  1 1 0  0 0 0  0 0 0
++0 1 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  1 1 0
++10 15 3  2 3 1  12 18 4  42 61 14  19 27 6  11 16 4
++38 55 13  10 15 3  3 4 1  10 15 3  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  2 3 1
++12 18 4  1 1 0  23 34 8  31 45 11  10 15 3  32 47 11
++34 49 12  3 4 1  3 4 1  3 4 1  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  10 15 3  29 42 10  26 37 9  12 18 4
++55 80 19  81 118 28  55 80 19  92 132 31  106 153 36  69 100 23
++100 144 34  80 116 27  42 61 14  81 118 28  23 34 8  27 40 9
++15 21 5  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  1 1 0  29 42 10  15 21 5  50 72 17
++74 107 25  45 64 15  102 148 35  80 116 27  84 121 28  111 160 38
++69 100 23  65 94 22  81 118 28  29 42 10  17 25 6  29 42 10
++23 34 8  2 3 1  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  3 4 1
++15 21 5  15 21 5  34 49 12  101 146 34  111 161 38  97 141 33
++97 141 33  119 172 41  117 170 40  116 167 40  118 170 40  118 171 40
++117 169 40  118 170 40  111 160 38  118 170 40  96 138 32  89 128 30
++81 118 28  11 16 4  10 15 3  1 1 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++3 4 1  3 4 1  34 49 12  101 146 34  79 115 27  111 160 38
++114 165 39  113 163 39  118 170 40  117 169 40  118 171 40  117 169 40
++116 167 40  119 172 41  113 163 39  92 132 31  105 151 36  113 163 39
++75 109 26  19 27 6  16 23 5  11 16 4  0 1 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  10 15 3
++80 116 27  106 153 36  105 151 36  114 165 39  118 170 40  118 171 40
++118 171 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 170 40  117 169 40  118 170 40  118 170 40
++117 170 40  75 109 26  75 109 26  34 49 12  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  3 4 1
++64 92 22  65 94 22  100 144 34  118 171 40  118 170 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  118 171 41  118 170 40  117 169 40
++109 158 37  105 151 36  104 150 35  47 69 16  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++42 61 14  115 167 39  118 170 40  117 169 40  117 169 40  117 169 40
++117 170 40  117 170 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  118 170 40  96 138 32  17 25 6  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  47 69 16
++114 165 39  117 168 40  117 170 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  118 170 40  117 169 40  117 169 40  117 169 40
++117 170 40  119 172 41  96 138 32  12 18 4  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  10 15 3
++32 47 11  105 151 36  118 170 40  117 169 40  117 169 40  116 168 40
++109 157 37  111 160 38  117 169 40  118 171 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  118 171 40  69 100 23  2 3 1
++0 0 0  0 0 0  0 0 0  0 0 0  19 27 6  101 146 34
++118 171 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 170 40
++118 171 40  115 166 39  107 154 36  111 161 38  117 169 40  117 169 40
++117 169 40  118 171 40  75 109 26  19 27 6  2 3 1  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  16 23 5
++89 128 30  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++111 160 38  92 132 31  79 115 27  96 138 32  115 166 39  119 171 41
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  118 170 40  109 157 37  26 37 9
++0 0 0  0 0 0  0 0 0  0 0 0  64 92 22  118 171 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  118 170 40  118 171 40  109 157 37
++89 128 30  81 118 28  100 144 34  115 166 39  117 169 40  117 169 40
++117 169 40  117 170 40  113 163 39  60 86 20  1 1 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++27 40 9  96 138 32  118 170 40  117 169 40  117 169 40  117 169 40
++117 170 40  117 169 40  101 146 34  67 96 23  55 80 19  84 121 28
++113 163 39  119 171 41  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  119 171 41  65 94 22
++0 0 0  0 0 0  0 0 0  15 21 5  101 146 34  118 171 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  118 170 40  118 171 40  104 150 35  69 100 23  53 76 18
++81 118 28  111 160 38  118 170 40  117 169 40  117 169 40  117 169 40
++117 169 40  114 165 39  69 100 23  10 15 3  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  1 1 0
++31 45 11  77 111 26  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  118 170 40  116 168 40  92 132 31  47 69 16
++38 55 13  81 118 28  113 163 39  119 171 41  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  118 171 41  92 132 31
++10 15 3  0 0 0  0 0 0  36 52 12  115 166 39  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  118 170 40
++118 171 40  102 148 35  64 92 22  34 49 12  65 94 22  106 153 36
++118 171 40  117 170 40  117 169 40  117 169 40  117 169 40  117 169 40
++118 170 40  107 154 36  55 80 19  15 21 5  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++29 42 10  101 146 34  118 171 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  118 171 40  113 163 39
++75 109 26  27 40 9  36 52 12  89 128 30  116 167 40  118 171 40
++117 169 40  117 169 40  117 169 40  117 169 40  118 170 40  104 150 35
++16 23 5  0 0 0  0 0 0  53 76 18  118 171 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  119 171 41  109 157 37
++67 96 23  23 34 8  42 61 14  96 138 32  118 170 40  118 170 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  74 107 25  10 15 3  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  31 45 11  101 146 34  118 170 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++119 171 41  102 148 35  47 69 16  14 20 5  50 72 17  102 148 35
++118 171 40  117 169 40  117 169 40  117 169 40  118 170 40  102 148 35
++15 21 5  0 0 0  0 0 0  50 72 17  118 170 40  117 169 40
++117 169 40  117 169 40  118 170 40  116 167 40  84 121 28  27 40 9
++19 27 6  74 107 25  114 165 39  118 171 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  75 109 26  10 15 4  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  38 55 13  102 148 35  118 171 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  118 170 40  115 167 39  77 111 26  17 25 6  19 27 6
++77 111 26  115 166 39  118 170 40  117 169 40  119 172 41  81 118 28
++3 4 1  0 0 0  0 0 0  27 40 9  111 160 38  118 170 40
++117 169 40  118 171 40  105 151 36  50 72 17  10 15 3  38 55 13
++100 144 34  118 171 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  79 115 27  15 21 5  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  10 15 3  64 92 22  111 160 38  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  118 171 40  96 138 32  32 47 11
++3 4 1  50 72 17  107 154 36  120 173 41  105 151 36  31 45 11
++0 0 0  0 0 0  0 0 0  3 4 1  65 94 22  117 169 40
++118 170 40  89 128 30  26 37 9  3 4 1  60 86 20  111 161 38
++118 171 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++97 141 33  36 52 12  1 1 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  14 20 5  75 109 26  117 168 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  118 171 40  107 154 36
++45 64 15  2 3 1  31 45 11  75 109 26  32 47 11  0 1 0
++0 0 0  0 0 0  0 0 0  0 0 0  10 15 3  55 80 19
++65 94 22  11 16 4  11 16 4  75 109 26  116 168 40  118 170 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  118 170 40  107 154 36
++47 69 16  3 4 1  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  12 18 4  69 100 23  111 161 38  118 171 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  118 170 40
++111 160 38  50 72 17  2 3 1  2 3 1  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  1 1 0
++1 1 0  12 18 4  81 118 28  118 170 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 170 40  118 171 40  101 146 34
++42 61 14  2 3 1  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  3 4 1  36 52 12  89 128 30
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++118 171 41  101 146 34  14 20 5  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  47 69 16  118 170 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 170 40  111 160 38  69 100 23  19 27 6
++0 1 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  11 16 4  69 100 23
++115 167 39  119 172 41  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++119 172 41  75 109 26  3 4 1  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  23 34 8  106 153 36  118 170 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++117 169 40  118 170 40  119 172 41  105 151 36  42 61 14  2 3 1
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  1 1 0  15 21 5
++45 64 15  80 116 27  114 165 39  118 170 40  117 169 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  119 172 41
++97 141 33  20 30 7  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  1 1 0  53 76 18  114 165 39  118 171 40  117 169 40
++117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
++118 171 40  104 150 35  64 92 22  31 45 11  10 15 3  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  36 52 12  97 141 33  109 158 37  113 163 39  116 168 40
++117 169 40  117 170 40  118 170 40  119 172 41  115 167 39  84 121 28
++23 34 8  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  3 4 1  50 72 17  102 148 35  118 171 40
++119 171 41  118 170 40  117 169 40  117 169 40  115 166 39  111 161 38
++109 157 37  79 115 27  12 18 4  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  3 4 1  15 21 5  23 34 8  45 64 15  106 153 36
++116 167 40  111 160 38  101 146 34  79 115 27  42 61 14  10 15 3
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  1 1 0  20 30 7  60 86 20
++89 128 30  106 153 36  113 163 39  117 169 40  84 121 28  29 42 10
++19 27 6  10 15 3  2 3 1  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  16 23 5  38 55 13
++36 52 12  26 37 9  12 18 4  2 3 1  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  1 0 0  19 2 7  52 5 18
++78 7 27  88 8 31  81 7 29  56 5 19  25 2 9  3 0 1
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++3 4 1  19 27 6  31 45 11  38 55 13  32 47 11  3 4 1
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  3 0 1
++9 0 3  12 1 4  9 0 3  4 0 1  0 0 0  0 0 0
++0 0 0  0 0 0  28 3 10  99 9 35  156 14 55  182 16 64
++189 17 66  190 17 67  189 17 66  184 17 65  166 15 58  118 13 41
++45 4 16  3 0 1  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  11 1 4  52 5 18  101 9 35  134 12 47
++151 14 53  154 14 54  151 14 53  113 10 40  11 1 4  0 0 0
++3 0 1  67 6 24  159 14 56  190 17 67  190 17 67  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  191 17 67
++174 16 61  101 9 35  14 1 5  0 0 0  35 3 12  108 10 38
++122 11 43  122 11 43  112 10 39  87 8 30  50 5 17  13 1 5
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++3 0 1  56 5 19  141 13 49  182 16 64  191 17 67  191 17 67
++190 17 67  190 17 67  191 17 67  113 10 40  3 0 1  1 0 0
++79 7 28  180 16 63  190 17 67  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++189 17 66  188 17 66  122 11 43  11 1 4  41 4 14  176 16 62
++191 17 67  191 17 67  191 17 67  190 17 67  181 16 63  146 13 51
++75 7 26  10 1 4  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  7 1 2
++90 8 32  178 16 62  191 17 67  188 17 66  188 17 66  188 17 66
++188 17 66  190 17 67  141 13 49  22 2 8  0 0 0  41 4 14
++173 16 61  190 17 67  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  88 8 31  1 0 0  89 8 31
++185 17 65  189 17 66  188 17 66  188 17 66  189 17 66  191 17 67
++186 17 65  124 11 43  25 2 9  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  2 0 1  89 8 31
++184 17 65  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++190 17 67  151 14 53  34 3 12  0 0 0  0 0 0  79 7 28
++190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  191 17 67  146 13 51  9 1 3  7 1 2
++108 10 38  187 17 66  189 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  190 17 67  141 13 49  22 2 8  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  52 5 18  176 16 62
++189 17 66  188 17 66  188 17 66  188 17 66  188 17 66  190 17 67
++151 14 53  38 3 13  0 0 0  0 0 0  0 0 0  50 5 17
++180 16 63  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  191 17 67  141 13 49  7 1 3  0 0 0
++11 1 4  112 10 39  187 17 66  189 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  190 17 67  113 10 40  5 0 2  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  7 1 3  132 12 46  191 17 67
++188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  146 13 51
++35 3 12  0 0 0  0 0 0  0 0 0  0 0 0  5 0 2
++101 9 35  185 17 65  190 17 67  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  190 17 67  180 16 63  67 6 24  0 0 0  0 0 0
++0 0 0  11 1 4  108 10 38  186 17 65  189 17 66  188 17 66
++188 17 66  188 17 66  189 17 66  180 16 63  56 5 19  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  44 4 15  177 16 62  189 17 66
++188 17 66  188 17 66  189 17 66  189 17 66  134 12 47  28 3 10
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++8 1 3  79 7 28  159 14 56  188 17 66  191 17 67  190 17 67
++189 17 66  189 17 66  189 17 66  189 17 66  190 17 67  191 17 67
++188 17 66  158 14 55  72 7 25  4 0 1  0 0 0  0 0 0
++0 0 0  0 0 0  8 1 3  95 9 33  182 16 64  189 17 67
++188 17 66  188 17 66  188 17 66  191 17 67  122 11 43  3 0 1
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  88 8 31  190 17 67  188 17 66
++188 17 66  189 17 66  185 17 65  113 10 40  18 2 6  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  1 0 0  24 2 8  77 7 27  124 11 43  154 14 54
++168 15 59  173 16 61  173 16 61  168 15 59  154 14 54  124 11 43
++77 7 27  22 2 8  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  5 0 2  77 7 27  173 16 61
++190 17 67  188 17 66  188 17 66  190 17 67  164 15 57  23 2 8
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  1 0 0  118 13 41  191 17 67  188 17 66
++190 17 67  174 16 61  87 8 30  8 1 3  0 0 0  0 0 0
++0 0 0  0 0 0  10 1 4  29 3 10  40 4 14  36 3 13
++18 2 6  2 0 1  0 0 0  0 0 0  3 0 1  14 1 5
++26 2 9  33 3 11  32 3 11  25 2 9  13 1 5  3 0 1
++0 0 0  14 1 5  56 5 19  95 9 33  109 10 38  101 9 35
++77 7 27  35 3 12  5 0 2  0 0 0  1 0 0  56 5 19
++156 14 55  190 17 67  188 17 66  188 17 66  182 16 64  50 5 17
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  5 0 2  134 12 47  191 17 67  189 17 66
++151 14 53  52 5 18  2 0 1  0 0 0  0 0 0  1 0 0
++28 3 10  90 8 32  146 13 51  170 15 60  178 16 62  174 16 61
++158 14 55  112 10 39  40 4 14  1 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  3 0 1
++56 5 19  146 13 51  183 17 64  191 17 67  191 17 67  191 17 67
++188 17 66  173 16 61  122 11 43  41 4 14  1 0 0  0 0 0
++30 3 10  124 11 43  185 17 65  190 17 67  187 17 66  67 6 24
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  6 1 2  134 12 47  168 15 59  99 9 35
++21 2 7  0 0 0  0 0 0  0 0 0  6 1 2  77 7 27
++162 15 57  190 17 67  191 17 67  189 17 66  189 17 66  189 17 66
++190 17 67  191 17 67  169 15 59  75 7 26  3 0 1  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  2 0 1  79 7 28
++178 16 62  191 17 67  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  189 17 66  191 17 67  170 15 60  79 7 28  5 0 2
++0 0 0  10 1 3  78 7 27  159 14 56  188 17 66  75 7 26
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  1 0 0  35 3 12  29 3 10  2 0 1
++0 0 0  0 0 0  0 0 0  9 1 3  101 9 35  183 17 64
++190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  190 17 67  178 16 63  67 6 23  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  52 5 18  174 16 61
++190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  190 17 67  182 16 64  89 8 31
++4 0 1  0 0 0  0 0 0  25 2 9  73 7 26  31 3 11
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  4 0 1  98 9 34  187 17 66  189 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  190 17 67  158 14 55  25 2 9
++0 0 0  0 0 0  0 0 0  8 1 3  134 12 47  191 17 67
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  189 17 66  180 16 63
++68 6 24  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  6 1 2  19 2 7  3 0 1  0 0 0  0 0 0
++0 0 0  0 0 0  65 6 23  180 16 63  189 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  189 17 66  83 8 29
++0 0 0  0 0 0  0 0 0  41 4 14  177 16 62  189 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  190 17 67
++159 14 56  28 3 10  0 0 0  0 0 0  0 0 0  23 2 8
++41 4 14  5 0 2  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++23 2 8  113 10 40  159 14 56  65 6 23  0 0 0  0 0 0
++0 0 0  16 1 6  146 13 51  191 17 67  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  191 17 67  132 12 46
++5 0 2  0 0 0  0 0 0  77 7 27  189 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++190 17 67  98 9 34  0 0 0  0 0 0  12 1 4  134 12 47
++178 16 63  108 10 38  16 1 6  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  30 3 10
++141 13 49  190 17 67  191 17 67  134 12 47  6 1 2  0 0 0
++0 0 0  68 6 24  186 17 65  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  156 14 55
++14 1 5  0 0 0  0 0 0  98 9 34  191 17 67  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++190 17 67  156 14 55  19 2 7  0 0 0  47 4 16  181 16 63
++190 17 67  189 17 66  126 14 44  17 2 6  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  16 1 6  134 12 47
++191 17 67  188 17 66  190 17 67  162 15 57  19 2 7  0 0 0
++3 0 1  123 11 43  191 17 67  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  163 15 57
++20 2 7  0 0 0  0 0 0  101 9 35  191 17 67  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  182 16 64  52 5 18  0 0 0  73 7 26  188 17 66
++188 17 66  188 17 66  189 17 66  109 10 38  5 0 2  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  95 9 33  189 17 66
++188 17 66  188 17 66  189 17 66  171 15 60  29 3 10  0 0 0
++16 1 6  156 14 55  190 17 67  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  158 14 55
++17 2 6  0 0 0  0 0 0  85 8 30  190 17 67  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  189 17 66  81 7 29  0 0 0  85 8 30  190 17 67
++188 17 66  188 17 66  189 17 66  180 16 63  56 5 19  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  25 2 9  162 15 57  190 17 67
++188 17 66  188 17 66  189 17 66  173 16 61  31 3 11  0 0 0
++30 3 10  171 15 60  189 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  191 17 67  141 13 49
++7 1 2  0 0 0  0 0 0  56 5 19  183 17 64  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  191 17 67  98 9 34  0 0 0  88 8 31  190 17 67
++188 17 66  188 17 66  188 17 66  191 17 67  124 11 43  5 0 2
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  68 6 24  187 17 66  188 17 66
++188 17 66  188 17 66  189 17 66  170 15 60  28 3 10  0 0 0
++34 3 12  174 16 61  189 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  191 17 67  101 9 35
++0 0 0  0 0 0  0 0 0  21 2 7  159 14 56  190 17 67
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  191 17 67  98 9 34  0 0 0  81 7 29  189 17 66
++188 17 66  188 17 66  188 17 66  189 17 66  168 15 59  28 3 10
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  109 10 38  191 17 67  188 17 66
++188 17 66  188 17 66  190 17 67  163 15 57  21 2 7  0 0 0
++26 2 9  168 15 59  189 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  189 17 66  180 16 63  47 4 16
++0 0 0  0 0 0  0 0 0  0 0 0  108 10 38  190 17 67
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  189 17 66  78 7 27  0 0 0  68 6 24  187 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  183 17 64  56 5 19
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  3 0 1  131 12 46  191 17 67  188 17 66
++188 17 66  188 17 66  190 17 67  151 14 53  12 1 4  0 0 0
++11 1 4  146 13 51  190 17 67  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  191 17 67  126 14 44  7 1 2
++0 0 0  0 0 0  0 0 0  0 0 0  32 3 11  164 15 58
++190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++189 17 66  178 16 62  44 4 15  0 0 0  50 5 17  182 16 64
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  72 7 25
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  5 0 2  134 12 47  191 17 67  188 17 66
++188 17 66  188 17 66  191 17 67  131 12 46  3 0 1  0 0 0
++0 0 0  101 9 35  190 17 67  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  190 17 67  170 15 60  44 4 15  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  77 7 27
++183 17 64  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++191 17 67  134 12 47  9 1 3  0 0 0  31 3 11  171 15 60
++189 17 66  188 17 66  188 17 66  188 17 66  188 17 66  72 7 25
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  2 0 1  124 11 43  191 17 67  188 17 66
++188 17 66  188 17 66  191 17 67  101 9 35  0 0 0  0 0 0
++0 0 0  35 3 12  168 15 59  190 17 67  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  189 17 66  182 16 64  77 7 27  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  6 1 2
++99 9 35  185 17 65  189 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  189 17 66
++177 16 62  56 5 19  0 0 0  0 0 0  13 1 5  151 14 53
++190 17 67  188 17 66  188 17 66  188 17 66  185 17 65  56 5 19
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  99 9 35  191 17 67  188 17 66
++188 17 66  188 17 66  186 17 65  65 6 23  0 0 0  0 0 0
++0 0 0  0 0 0  79 7 28  182 16 64  190 17 67  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++191 17 67  177 16 62  83 8 29  4 0 1  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++8 1 3  89 8 31  175 16 62  191 17 67  189 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  181 16 63
++85 8 30  3 0 1  0 0 0  0 0 0  1 0 0  118 13 41
++191 17 67  188 17 66  188 17 66  189 17 66  173 16 61  34 3 12
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  56 5 19  183 17 64  188 17 66
++188 17 66  189 17 66  169 15 59  30 3 10  0 0 0  0 0 0
++0 0 0  0 0 0  5 0 2  83 8 29  173 16 61  191 17 67
++190 17 67  189 17 66  189 17 66  190 17 67  191 17 67  187 17 66
++151 14 53  56 5 19  3 0 1  0 0 0  16 1 6  50 5 17
++79 7 28  95 9 33  95 9 33  75 7 26  41 4 14  10 1 4
++0 0 0  2 0 1  50 5 17  132 12 46  178 16 62  190 17 67
++191 17 67  191 17 67  191 17 67  186 17 65  154 14 54  68 6 24
++4 0 1  0 0 0  0 0 0  0 0 0  0 0 0  72 7 25
++187 17 66  188 17 66  188 17 66  191 17 67  141 13 49  9 1 3
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  14 1 5  151 14 53  190 17 67
++188 17 66  191 17 67  131 12 46  5 0 2  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  2 0 1  44 4 15  113 10 40
++156 14 55  173 16 61  174 16 61  164 15 58  134 12 47  77 7 27
++18 2 6  0 0 0  16 1 6  85 8 30  151 14 53  182 16 64
++189 17 66  191 17 67  190 17 67  188 17 66  177 16 62  141 13 49
++68 6 24  8 1 3  0 0 0  8 1 3  44 4 15  88 8 31
++113 10 40  122 11 43  108 10 38  67 6 24  20 2 7  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  28 3 10
++166 15 58  190 17 67  188 17 66  187 17 66  79 7 28  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  73 7 26  185 17 65
++189 17 66  184 17 65  65 6 23  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  2 0 1
++17 2 6  32 3 11  34 3 12  22 2 8  6 1 2  0 0 0
++0 0 0  38 3 13  141 13 49  188 17 66  190 17 67  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  189 17 66  191 17 67
++184 17 65  122 11 43  21 2 7  0 0 0  0 0 0  0 0 0
++0 0 0  1 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  1 0 0
++108 10 38  191 17 67  191 17 67  141 13 49  16 1 6  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  8 1 3  112 10 39
++186 17 65  124 11 43  10 1 4  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++36 3 13  156 14 55  191 17 67  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++189 17 66  190 17 67  134 12 47  18 2 6  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  7 1 2  41 4 14  75 7 26  66 5 23  19 2 7
++26 2 9  144 13 50  154 14 54  40 4 14  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  13 1 5
++56 5 19  19 2 7  0 0 0  7 1 2  29 3 10  35 3 12
++19 2 7  2 0 1  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  13 1 5
++134 12 47  191 17 67  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  189 17 67  108 10 38  3 0 1  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  1 0 0
++40 4 14  124 11 43  177 16 62  188 17 66  187 17 66  144 13 50
++24 2 8  17 2 6  22 2 8  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  19 2 7  122 11 43  171 15 60  175 16 62
++159 14 56  112 10 39  40 4 14  2 0 1  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  72 7 25
++186 17 65  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  189 17 66  174 16 61  41 4 14  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  3 0 1  72 7 25
++168 15 59  191 17 67  189 17 66  188 17 66  188 17 66  190 17 67
++95 9 33  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  95 9 33  191 17 67  189 17 66  189 17 66
++190 17 67  191 17 67  171 15 60  90 8 32  12 1 4  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  5 0 2  132 12 46
++191 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  190 17 67  98 9 34  0 0 0
++0 0 0  0 0 0  0 0 0  5 0 2  88 8 31  180 16 63
++190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  191 17 67
++146 13 51  11 1 4  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  9 1 3  144 13 50  191 17 67  188 17 66  188 17 66
++188 17 66  188 17 66  189 17 66  187 17 66  123 11 43  20 2 7
++0 0 0  0 0 0  0 0 0  0 0 0  21 2 7  163 15 57
++190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  191 17 67  134 12 47  5 0 2
++0 0 0  0 0 0  3 0 1  88 8 31  182 16 64  189 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  189 17 66
++171 15 60  31 3 11  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  20 2 7  162 15 57  190 17 67  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  132 12 46
++20 2 7  0 0 0  0 0 0  0 0 0  32 3 11  173 16 61
++189 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  190 17 67  151 14 53  12 1 4
++0 0 0  0 0 0  72 7 25  180 16 63  189 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++181 16 63  47 4 16  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  21 2 7  163 15 57  190 17 67  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  190 17 67
++122 11 43  9 1 3  0 0 0  0 0 0  30 3 10  171 15 60
++189 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  190 17 67  146 13 51  10 1 4
++0 0 0  38 3 13  166 15 58  190 17 67  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++183 17 64  52 5 18  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  13 1 5  154 14 54  190 17 67  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++186 17 65  79 7 28  0 0 0  0 0 0  14 1 5  156 14 54
++190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  191 17 67  124 11 43  2 0 1
++5 0 2  122 11 43  191 17 67  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++182 16 64  47 4 16  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  3 0 1  126 14 44  191 17 67  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++190 17 67  158 14 55  23 2 8  0 0 0  1 0 0  113 10 40
++191 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  78 7 27  0 0 0
++47 4 16  177 16 62  189 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  189 17 66
++173 16 61  34 3 12  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  85 8 30  189 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  79 7 28  0 0 0  0 0 0  47 4 16
++175 16 62  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  190 17 67  156 14 55  22 2 8  0 0 0
++109 10 38  191 17 67  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  190 17 67
++151 14 53  13 1 5  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  35 3 12  173 16 61  189 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  191 17 67  134 12 47  7 1 2  0 0 0  3 0 1
++99 9 35  188 17 66  189 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  189 17 66  181 16 63  68 6 24  0 0 0  18 2 6
++156 14 55  190 17 67  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  190 17 67
++101 9 35  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  3 0 1  118 13 41  191 17 67  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  189 17 66  168 15 59  28 3 10  0 0 0  0 0 0
++12 1 4  113 10 40  187 17 66  189 17 67  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++190 17 67  180 16 63  88 8 31  4 0 1  0 0 0  47 4 16
++180 16 63  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  168 15 59
++36 3 13  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  38 3 13  164 15 58  190 17 67
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  182 16 64  50 5 17  0 0 0  0 0 0
++0 0 0  11 1 4  90 8 32  169 15 59  190 17 67  190 17 67
++189 17 66  189 17 66  189 17 66  189 17 66  191 17 67  189 17 66
++158 14 55  68 6 24  4 0 1  0 0 0  0 0 0  73 7 26
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  189 17 66  185 17 65  83 8 29
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  65 6 23  174 16 61
++190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  185 17 65  56 5 19  0 0 0  0 0 0
++0 0 0  0 0 0  2 0 1  35 3 12  99 9 35  146 13 51
++170 15 60  177 16 62  177 16 62  166 15 58  141 13 49  85 8 30
++24 2 8  0 0 0  0 0 0  0 0 0  0 0 0  85 8 30
++190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  189 17 66  112 10 39  8 1 3
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  1 0 0  68 6 24
++170 15 60  191 17 67  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  182 16 64  50 5 17  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  1 0 0  11 1 4
++28 3 10  40 4 14  38 3 13  25 2 9  8 1 3  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  78 7 27
++189 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  189 17 66  187 17 66  113 10 40  14 1 5  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  1 0 0
++47 4 16  141 13 49  186 17 65  191 17 67  190 17 67  189 17 66
++189 17 66  191 17 67  156 14 55  20 2 7  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  44 4 15
++178 16 62  190 17 67  188 17 66  188 17 66  188 17 66  190 17 67
++191 17 67  173 16 61  90 8 32  10 1 4  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  14 1 5  68 6 24  131 12 46  162 15 57  174 16 61
++171 15 60  146 13 51  56 5 19  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  3 0 1  14 1 5  29 3 10
++41 4 14  47 4 16  50 5 17  45 4 16  34 3 12  18 2 6
++5 0 2  0 0 0  0 0 0  0 0 0  0 0 0  5 0 2
++90 8 32  169 15 59  185 17 65  187 17 66  182 16 64  163 15 57
++113 10 40  41 4 14  2 0 1  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  5 0 2  21 2 7  34 3 12
++29 3 10  11 1 4  0 0 0  0 0 0  0 0 0  0 0 0
++3 0 1  32 3 11  79 7 28  124 11 43  154 14 54  171 15 60
++180 16 63  182 16 64  182 16 64  180 16 63  174 16 61  159 14 56
++132 12 46  88 8 31  34 3 12  3 0 1  0 0 0  0 0 0
++3 0 1  29 3 10  56 5 19  65 6 23  50 5 17  23 2 8
++3 0 1  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  25 2 9
++109 10 38  169 15 59  189 17 66  191 17 67  190 17 67  189 17 66
++189 17 66  188 17 66  188 17 66  188 17 66  189 17 66  190 17 67
++191 17 67  190 17 67  171 15 60  98 9 34  10 1 3  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  14 1 5  141 13 49
++191 17 67  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  189 17 67  186 17 65  65 6 23  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  23 2 8  166 15 58
++190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  189 17 66  176 16 62  45 4 16  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  1 0 0  83 8 29
++183 17 64  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++188 17 66  189 17 66  185 17 65  95 9 33  3 0 1  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  5 0 2
++85 8 30  176 16 62  191 17 67  188 17 66  188 17 66  188 17 66
++188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
++191 17 67  180 16 63  95 9 33  7 1 3  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++2 0 1  52 5 18  141 13 49  185 17 65  191 17 67  189 17 67
++189 17 66  188 17 66  188 17 66  189 17 66  191 17 67  187 17 66
++146 13 51  56 5 19  4 0 1  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  14 1 5  68 6 24  131 12 46  166 15 58
++180 16 63  183 17 64  180 16 63  168 15 59  134 12 47  75 7 26
++17 2 6  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  5 0 2  24 2 8
++44 4 15  52 5 18  45 4 16  26 2 9  6 1 2  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
++0 0 0  0 0 0  0 0 0
+--- a/include/uapi/linux/fb.h
++++ b/include/uapi/linux/fb.h
+@@ -36,6 +36,12 @@
+ #define FBIOPUT_MODEINFO        0x4617
+ #define FBIOGET_DISPINFO        0x4618
+ #define FBIO_WAITFORVSYNC	_IOW('F', 0x20, __u32)
++/*
++ * HACK: use 'z' in order not to clash with any other ioctl numbers which might
++ * be concurrently added to the mainline kernel
++ */
++#define FBIOCOPYAREA		_IOW('z', 0x21, struct fb_copyarea)
++#define FBIODMACOPY 		_IOW('z', 0x22, struct fb_dmacopy)
+ 
+ #define FB_TYPE_PACKED_PIXELS		0	/* Packed Pixels	*/
+ #define FB_TYPE_PLANES			1	/* Non interleaved planes */
+@@ -342,6 +348,12 @@ struct fb_copyarea {
+ 	__u32 sy;
+ };
+ 
++struct fb_dmacopy {
++	void *dst;
++	__u32 src;
++	__u32 length;
++};
++
+ struct fb_fillrect {
+ 	__u32 dx;	/* screen-relative */
+ 	__u32 dy;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0056-dmaengine-Add-support-for-BCM2708.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0056-dmaengine-Add-support-for-BCM2708.patch
new file mode 100644
index 00000000..b97a6463
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0056-dmaengine-Add-support-for-BCM2708.patch
@@ -0,0 +1,652 @@
+From 5a1882f4e4544a866f1b07a12bf352bac5a6f90f Mon Sep 17 00:00:00 2001
+From: Florian Meier <florian.meier@koalo.de>
+Date: Fri, 22 Nov 2013 14:22:53 +0100
+Subject: [PATCH 056/697] dmaengine: Add support for BCM2708
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Add support for DMA controller of BCM2708 as used in the Raspberry Pi.
+Currently it only supports cyclic DMA.
+
+Signed-off-by: Florian Meier <florian.meier@koalo.de>
+
+dmaengine: expand functionality by supporting scatter/gather transfers sdhci-bcm2708 and dma.c: fix for LITE channels
+
+DMA: fix cyclic LITE length overflow bug
+
+dmaengine: bcm2708: Remove chancnt affectations
+
+Mirror bcm2835-dma.c commit 9eba5536a7434c69d8c185d4bd1c70734d92287d:
+chancnt is already filled by dma_async_device_register, which uses the channel
+list to know how much channels there is.
+
+Since it's already filled, we can safely remove it from the drivers' probe
+function.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+dmaengine: bcm2708: overwrite dreq only if it is not set
+
+dreq is set when the DMA channel is fetched from Device Tree.
+slave_id is set using dmaengine_slave_config().
+Only overwrite dreq with slave_id if it is not set.
+
+dreq/slave_id in the cyclic DMA case is not touched, because I don't
+have hardware to test with.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+dmaengine: bcm2708: do device registration in the board file
+
+Don't register the device in the driver. Do it in the board file.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+dmaengine: bcm2708: don't restrict DT support to ARCH_BCM2835
+
+Both ARCH_BCM2835 and ARCH_BCM270x are built with OF now.
+Add Device Tree support to the non ARCH_BCM2835 case.
+Use the same driver name regardless of architecture.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+BCM270x_DT: add bcm2835-dma entry
+
+Add Device Tree entry for bcm2835-dma.
+The entry doesn't contain any resources since they are handled
+by the arch/arm/mach-bcm270x/dma.c driver.
+In non-DT mode, don't add the device in the board file.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+bcm2708-dmaengine: Add debug options
+
+BCM270x: Add memory and irq resources to dmaengine device and DT
+
+Prepare for merging of the legacy DMA API arch driver dma.c
+with bcm2708-dmaengine by adding memory and irq resources both
+to platform file device and Device Tree node.
+Don't use BCM_DMAMAN_DRIVER_NAME so we don't have to include mach/dma.h
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+dmaengine: bcm2708: Merge with arch dma.c driver and disable dma.c
+
+Merge the legacy DMA API driver with bcm2708-dmaengine.
+This is done so we can use bcm2708_fb on ARCH_BCM2835 (mailbox
+driver is also needed).
+
+Changes to the dma.c code:
+- Use BIT() macro.
+- Cutdown some comments to one line.
+- Add mutex to vc_dmaman and use this, since the dev lock is locked
+  during probing of the engine part.
+- Add global g_dmaman variable since drvdata is used by the engine part.
+- Restructure for readability:
+  vc_dmaman_chan_alloc()
+  vc_dmaman_chan_free()
+  bcm_dma_chan_free()
+- Restructure bcm_dma_chan_alloc() to simplify error handling.
+- Use device irq resources instead of hardcoded bcm_dma_irqs table.
+- Remove dev_dmaman_register() and code it directly.
+- Remove dev_dmaman_deregister() and code it directly.
+- Simplify bcm_dmaman_probe() using devm_* functions.
+- Get dmachans from DT if available.
+- Keep 'dma.dmachans' module argument name for backwards compatibility.
+
+Make it available on ARCH_BCM2835 as well.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+dmaengine: bcm2708: set residue_granularity field
+
+bcm2708-dmaengine supports residue reporting at burst level
+but didn't report this via the residue_granularity field.
+
+Without this field set properly we get playback issues with I2S cards.
+
+dmaengine: bcm2708-dmaengine: Fix memory leak when stopping a running transfer
+
+bcm2708-dmaengine: Use more DMA channels (but not 12)
+
+1) Only the bcm2708_fb drivers uses the legacy DMA API, and
+it requires a BULK-capable channel, so all other types
+(FAST, NORMAL and LITE) can be made available to the regular
+DMA API.
+
+2) DMA channels 11-14 share an interrupt. The driver can't
+handle this, so don't use channels 12-14 (12 was used, probably
+because it appears to have an interrupt, but in reality that
+interrupt is for activity on ANY channel). This may explain
+a lockup encountered when running out of DMA channels.
+
+The combined effect of this patch is to leave 7 DMA channels
+available + channel 0 for bcm2708_fb via the legacy API.
+
+See: https://github.com/raspberrypi/linux/issues/1110
+     https://github.com/raspberrypi/linux/issues/1108
+
+dmaengine: bcm2708: Make legacy API available for bcm2835-dma
+
+bcm2708_fb uses the legacy DMA API, so in order to start using
+bcm2835-dma, bcm2835-dma has to support the legacy API. Make this
+possible by exporting bcm_dmaman_probe() and bcm_dmaman_remove().
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+dmaengine: bcm2708: Change DT compatible string
+
+Both bcm2835-dma and bcm2708-dmaengine have the same compatible string.
+So change compatible to "brcm,bcm2708-dma".
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+dmaengine: bcm2708: Remove driver but keep legacy API
+
+Dropping non-DT support means we don't need this driver,
+but we still need the legacy DMA API.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+bcm2708-dmaengine - Fix arm64 portability/build issues
+
+dma-bcm2708: Fix module compilation of CONFIG_DMA_BCM2708
+
+bcm2708-dmaengine.c defines functions like bcm_dma_start which are
+defined as well in dma-bcm2708.h as inline versions when
+CONFIG_DMA_BCM2708 is not defined. This works fine when
+CONFIG_DMA_BCM2708 is built in, but when it is selected as module build
+fails with redefinition errors because in the build system when
+CONFIG_DMA_BCM2708 is selected as module, the macro becomes
+CONFIG_DMA_BCM2708_MODULE.
+
+This patch makes the header use CONFIG_DMA_BCM2708_MODULE too when
+available.
+
+Fixes https://github.com/raspberrypi/linux/issues/2056
+
+Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
+
+bcm2708-dmaengine: Use platform_get_irq
+
+The platform driver framework no longer creates IRQ resources for
+platform devices because they are expected to use platform_get_irq.
+This causes the bcm2808_fb acceleration to fail.
+
+Fix the problem by calling platform_get_irq as intended.
+
+See: https://github.com/raspberrypi/linux/issues/5131
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/dma/Kconfig                       |   6 +-
+ drivers/dma/Makefile                      |   1 +
+ drivers/dma/bcm2708-dmaengine.c           | 281 ++++++++++++++++++++++
+ include/linux/platform_data/dma-bcm2708.h | 143 +++++++++++
+ 4 files changed, 430 insertions(+), 1 deletion(-)
+ create mode 100644 drivers/dma/bcm2708-dmaengine.c
+ create mode 100644 include/linux/platform_data/dma-bcm2708.h
+
+--- a/drivers/dma/Kconfig
++++ b/drivers/dma/Kconfig
+@@ -136,7 +136,7 @@ config BCM_SBA_RAID
+ 
+ config DMA_BCM2835
+ 	tristate "BCM2835 DMA engine support"
+-	depends on ARCH_BCM2835 || ARCH_BCM2708 || ARCH_BCM2709
++	depends on ARCH_BCM2835
+ 	select DMA_ENGINE
+ 	select DMA_VIRTUAL_CHANNELS
+ 
+@@ -669,6 +669,10 @@ config UNIPHIER_XDMAC
+ 	  UniPhier platform. This DMA controller can transfer data from
+ 	  memory to memory, memory to peripheral and peripheral to memory.
+ 
++config DMA_BCM2708
++	tristate "BCM2708 DMA legacy API support"
++	depends on DMA_BCM2835
++
+ config XGENE_DMA
+ 	tristate "APM X-Gene DMA support"
+ 	depends on ARCH_XGENE || COMPILE_TEST
+--- a/drivers/dma/Makefile
++++ b/drivers/dma/Makefile
+@@ -22,6 +22,7 @@ obj-$(CONFIG_AT_HDMAC) += at_hdmac.o
+ obj-$(CONFIG_AT_XDMAC) += at_xdmac.o
+ obj-$(CONFIG_AXI_DMAC) += dma-axi-dmac.o
+ obj-$(CONFIG_BCM_SBA_RAID) += bcm-sba-raid.o
++obj-$(CONFIG_DMA_BCM2708) += bcm2708-dmaengine.o
+ obj-$(CONFIG_DMA_BCM2835) += bcm2835-dma.o
+ obj-$(CONFIG_DMA_JZ4780) += dma-jz4780.o
+ obj-$(CONFIG_DMA_SA11X0) += sa11x0-dma.o
+--- /dev/null
++++ b/drivers/dma/bcm2708-dmaengine.c
+@@ -0,0 +1,281 @@
++/*
++ * BCM2708 legacy DMA API
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#include <linux/init.h>
++#include <linux/interrupt.h>
++#include <linux/list.h>
++#include <linux/module.h>
++#include <linux/platform_data/dma-bcm2708.h>
++#include <linux/platform_device.h>
++#include <linux/slab.h>
++#include <linux/io.h>
++#include <linux/spinlock.h>
++
++#include "virt-dma.h"
++
++#define CACHE_LINE_MASK 31
++#define DEFAULT_DMACHAN_BITMAP 0x10  /* channel 4 only */
++
++/* valid only for channels 0 - 14, 15 has its own base address */
++#define BCM2708_DMA_CHAN(n)	((n) << 8) /* base address */
++#define BCM2708_DMA_CHANIO(dma_base, n) \
++	((void __iomem *)((char *)(dma_base) + BCM2708_DMA_CHAN(n)))
++
++struct vc_dmaman {
++	void __iomem *dma_base;
++	u32 chan_available; /* bitmap of available channels */
++	u32 has_feature[BCM_DMA_FEATURE_COUNT]; /* bitmap of feature presence */
++	struct mutex lock;
++};
++
++static struct device *dmaman_dev;	/* we assume there's only one! */
++static struct vc_dmaman *g_dmaman;	/* DMA manager */
++
++/* DMA Auxiliary Functions */
++
++/* A DMA buffer on an arbitrary boundary may separate a cache line into a
++   section inside the DMA buffer and another section outside it.
++   Even if we flush DMA buffers from the cache there is always the chance that
++   during a DMA someone will access the part of a cache line that is outside
++   the DMA buffer - which will then bring in unwelcome data.
++   Without being able to dictate our own buffer pools we must insist that
++   DMA buffers consist of a whole number of cache lines.
++*/
++extern int bcm_sg_suitable_for_dma(struct scatterlist *sg_ptr, int sg_len)
++{
++	int i;
++
++	for (i = 0; i < sg_len; i++) {
++		if (sg_ptr[i].offset & CACHE_LINE_MASK ||
++		    sg_ptr[i].length & CACHE_LINE_MASK)
++			return 0;
++	}
++
++	return 1;
++}
++EXPORT_SYMBOL_GPL(bcm_sg_suitable_for_dma);
++
++extern void bcm_dma_start(void __iomem *dma_chan_base,
++			  dma_addr_t control_block)
++{
++	dsb(sy);	/* ARM data synchronization (push) operation */
++
++	writel(control_block, dma_chan_base + BCM2708_DMA_ADDR);
++	writel(BCM2708_DMA_ACTIVE, dma_chan_base + BCM2708_DMA_CS);
++}
++EXPORT_SYMBOL_GPL(bcm_dma_start);
++
++extern void bcm_dma_wait_idle(void __iomem *dma_chan_base)
++{
++	dsb(sy);
++
++	/* ugly busy wait only option for now */
++	while (readl(dma_chan_base + BCM2708_DMA_CS) & BCM2708_DMA_ACTIVE)
++		cpu_relax();
++}
++EXPORT_SYMBOL_GPL(bcm_dma_wait_idle);
++
++extern bool bcm_dma_is_busy(void __iomem *dma_chan_base)
++{
++	dsb(sy);
++
++	return readl(dma_chan_base + BCM2708_DMA_CS) & BCM2708_DMA_ACTIVE;
++}
++EXPORT_SYMBOL_GPL(bcm_dma_is_busy);
++
++/* Complete an ongoing DMA (assuming its results are to be ignored)
++   Does nothing if there is no DMA in progress.
++   This routine waits for the current AXI transfer to complete before
++   terminating the current DMA. If the current transfer is hung on a DREQ used
++   by an uncooperative peripheral the AXI transfer may never complete.	In this
++   case the routine times out and return a non-zero error code.
++   Use of this routine doesn't guarantee that the ongoing or aborted DMA
++   does not produce an interrupt.
++*/
++extern int bcm_dma_abort(void __iomem *dma_chan_base)
++{
++	unsigned long int cs;
++	int rc = 0;
++
++	cs = readl(dma_chan_base + BCM2708_DMA_CS);
++
++	if (BCM2708_DMA_ACTIVE & cs) {
++		long int timeout = 10000;
++
++		/* write 0 to the active bit - pause the DMA */
++		writel(0, dma_chan_base + BCM2708_DMA_CS);
++
++		/* wait for any current AXI transfer to complete */
++		while (0 != (cs & BCM2708_DMA_ISPAUSED) && --timeout >= 0)
++			cs = readl(dma_chan_base + BCM2708_DMA_CS);
++
++		if (0 != (cs & BCM2708_DMA_ISPAUSED)) {
++			/* we'll un-pause when we set of our next DMA */
++			rc = -ETIMEDOUT;
++
++		} else if (BCM2708_DMA_ACTIVE & cs) {
++			/* terminate the control block chain */
++			writel(0, dma_chan_base + BCM2708_DMA_NEXTCB);
++
++			/* abort the whole DMA */
++			writel(BCM2708_DMA_ABORT | BCM2708_DMA_ACTIVE,
++			       dma_chan_base + BCM2708_DMA_CS);
++		}
++	}
++
++	return rc;
++}
++EXPORT_SYMBOL_GPL(bcm_dma_abort);
++
++ /* DMA Manager Device Methods */
++
++static void vc_dmaman_init(struct vc_dmaman *dmaman, void __iomem *dma_base,
++			   u32 chans_available)
++{
++	dmaman->dma_base = dma_base;
++	dmaman->chan_available = chans_available;
++	dmaman->has_feature[BCM_DMA_FEATURE_FAST_ORD] = 0x0c;  /* 2 & 3 */
++	dmaman->has_feature[BCM_DMA_FEATURE_BULK_ORD] = 0x01;  /* 0 */
++	dmaman->has_feature[BCM_DMA_FEATURE_NORMAL_ORD] = 0xfe;  /* 1 to 7 */
++	dmaman->has_feature[BCM_DMA_FEATURE_LITE_ORD] = 0x7f00;  /* 8 to 14 */
++}
++
++static int vc_dmaman_chan_alloc(struct vc_dmaman *dmaman,
++				unsigned required_feature_set)
++{
++	u32 chans;
++	int chan = 0;
++	int feature;
++
++	chans = dmaman->chan_available;
++	for (feature = 0; feature < BCM_DMA_FEATURE_COUNT; feature++)
++		/* select the subset of available channels with the desired
++		   features */
++		if (required_feature_set & (1 << feature))
++			chans &= dmaman->has_feature[feature];
++
++	if (!chans)
++		return -ENOENT;
++
++	/* return the ordinal of the first channel in the bitmap */
++	while (chans != 0 && (chans & 1) == 0) {
++		chans >>= 1;
++		chan++;
++	}
++	/* claim the channel */
++	dmaman->chan_available &= ~(1 << chan);
++
++	return chan;
++}
++
++static int vc_dmaman_chan_free(struct vc_dmaman *dmaman, int chan)
++{
++	if (chan < 0)
++		return -EINVAL;
++
++	if ((1 << chan) & dmaman->chan_available)
++		return -EIDRM;
++
++	dmaman->chan_available |= (1 << chan);
++
++	return 0;
++}
++
++/* DMA Manager Monitor */
++
++extern int bcm_dma_chan_alloc(unsigned required_feature_set,
++			      void __iomem **out_dma_base, int *out_dma_irq)
++{
++	struct vc_dmaman *dmaman = g_dmaman;
++	struct platform_device *pdev = to_platform_device(dmaman_dev);
++	int chan;
++	int irq;
++
++	if (!dmaman_dev)
++		return -ENODEV;
++
++	mutex_lock(&dmaman->lock);
++	chan = vc_dmaman_chan_alloc(dmaman, required_feature_set);
++	if (chan < 0)
++		goto out;
++
++	irq = platform_get_irq(pdev, (unsigned int)chan);
++	if (irq < 0) {
++		dev_err(dmaman_dev, "failed to get irq for DMA channel %d\n",
++			chan);
++		vc_dmaman_chan_free(dmaman, chan);
++		chan = -ENOENT;
++		goto out;
++	}
++
++	*out_dma_base = BCM2708_DMA_CHANIO(dmaman->dma_base, chan);
++	*out_dma_irq = irq;
++	dev_dbg(dmaman_dev,
++		"Legacy API allocated channel=%d, base=%p, irq=%i\n",
++		chan, *out_dma_base, *out_dma_irq);
++
++out:
++	mutex_unlock(&dmaman->lock);
++
++	return chan;
++}
++EXPORT_SYMBOL_GPL(bcm_dma_chan_alloc);
++
++extern int bcm_dma_chan_free(int channel)
++{
++	struct vc_dmaman *dmaman = g_dmaman;
++	int rc;
++
++	if (!dmaman_dev)
++		return -ENODEV;
++
++	mutex_lock(&dmaman->lock);
++	rc = vc_dmaman_chan_free(dmaman, channel);
++	mutex_unlock(&dmaman->lock);
++
++	return rc;
++}
++EXPORT_SYMBOL_GPL(bcm_dma_chan_free);
++
++int bcm_dmaman_probe(struct platform_device *pdev, void __iomem *base,
++		     u32 chans_available)
++{
++	struct device *dev = &pdev->dev;
++	struct vc_dmaman *dmaman;
++
++	dmaman = devm_kzalloc(dev, sizeof(*dmaman), GFP_KERNEL);
++	if (!dmaman)
++		return -ENOMEM;
++
++	mutex_init(&dmaman->lock);
++	vc_dmaman_init(dmaman, base, chans_available);
++	g_dmaman = dmaman;
++	dmaman_dev = dev;
++
++	dev_info(dev, "DMA legacy API manager, dmachans=0x%x\n",
++		 chans_available);
++
++	return 0;
++}
++EXPORT_SYMBOL(bcm_dmaman_probe);
++
++int bcm_dmaman_remove(struct platform_device *pdev)
++{
++	dmaman_dev = NULL;
++
++	return 0;
++}
++EXPORT_SYMBOL(bcm_dmaman_remove);
++
++MODULE_LICENSE("GPL");
+--- /dev/null
++++ b/include/linux/platform_data/dma-bcm2708.h
+@@ -0,0 +1,143 @@
++/*
++ *  Copyright (C) 2010 Broadcom
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#ifndef _PLAT_BCM2708_DMA_H
++#define _PLAT_BCM2708_DMA_H
++
++/* DMA CS Control and Status bits */
++#define BCM2708_DMA_ACTIVE	BIT(0)
++#define BCM2708_DMA_INT		BIT(2)
++#define BCM2708_DMA_ISPAUSED	BIT(4)  /* Pause requested or not active */
++#define BCM2708_DMA_ISHELD	BIT(5)  /* Is held by DREQ flow control */
++#define BCM2708_DMA_ERR		BIT(8)
++#define BCM2708_DMA_ABORT	BIT(30) /* stop current CB, go to next, WO */
++#define BCM2708_DMA_RESET	BIT(31) /* WO, self clearing */
++
++/* DMA control block "info" field bits */
++#define BCM2708_DMA_INT_EN	BIT(0)
++#define BCM2708_DMA_TDMODE	BIT(1)
++#define BCM2708_DMA_WAIT_RESP	BIT(3)
++#define BCM2708_DMA_D_INC	BIT(4)
++#define BCM2708_DMA_D_WIDTH	BIT(5)
++#define BCM2708_DMA_D_DREQ	BIT(6)
++#define BCM2708_DMA_S_INC	BIT(8)
++#define BCM2708_DMA_S_WIDTH	BIT(9)
++#define BCM2708_DMA_S_DREQ	BIT(10)
++
++#define	BCM2708_DMA_BURST(x)	(((x) & 0xf) << 12)
++#define	BCM2708_DMA_PER_MAP(x)	((x) << 16)
++#define	BCM2708_DMA_WAITS(x)	(((x) & 0x1f) << 21)
++
++#define BCM2708_DMA_DREQ_EMMC	11
++#define BCM2708_DMA_DREQ_SDHOST	13
++
++#define BCM2708_DMA_CS		0x00 /* Control and Status */
++#define BCM2708_DMA_ADDR	0x04
++/* the current control block appears in the following registers - read only */
++#define BCM2708_DMA_INFO	0x08
++#define BCM2708_DMA_SOURCE_AD	0x0c
++#define BCM2708_DMA_DEST_AD	0x10
++#define BCM2708_DMA_NEXTCB	0x1C
++#define BCM2708_DMA_DEBUG	0x20
++
++#define BCM2708_DMA4_CS		(BCM2708_DMA_CHAN(4) + BCM2708_DMA_CS)
++#define BCM2708_DMA4_ADDR	(BCM2708_DMA_CHAN(4) + BCM2708_DMA_ADDR)
++
++#define BCM2708_DMA_TDMODE_LEN(w, h) ((h) << 16 | (w))
++
++/* When listing features we can ask for when allocating DMA channels give
++   those with higher priority smaller ordinal numbers */
++#define BCM_DMA_FEATURE_FAST_ORD	0
++#define BCM_DMA_FEATURE_BULK_ORD	1
++#define BCM_DMA_FEATURE_NORMAL_ORD	2
++#define BCM_DMA_FEATURE_LITE_ORD	3
++#define BCM_DMA_FEATURE_FAST		BIT(BCM_DMA_FEATURE_FAST_ORD)
++#define BCM_DMA_FEATURE_BULK		BIT(BCM_DMA_FEATURE_BULK_ORD)
++#define BCM_DMA_FEATURE_NORMAL		BIT(BCM_DMA_FEATURE_NORMAL_ORD)
++#define BCM_DMA_FEATURE_LITE		BIT(BCM_DMA_FEATURE_LITE_ORD)
++#define BCM_DMA_FEATURE_COUNT		4
++
++struct bcm2708_dma_cb {
++	u32 info;
++	u32 src;
++	u32 dst;
++	u32 length;
++	u32 stride;
++	u32 next;
++	u32 pad[2];
++};
++
++struct scatterlist;
++struct platform_device;
++
++#if defined(CONFIG_DMA_BCM2708) || defined(CONFIG_DMA_BCM2708_MODULE)
++
++int bcm_sg_suitable_for_dma(struct scatterlist *sg_ptr, int sg_len);
++void bcm_dma_start(void __iomem *dma_chan_base, dma_addr_t control_block);
++void bcm_dma_wait_idle(void __iomem *dma_chan_base);
++bool bcm_dma_is_busy(void __iomem *dma_chan_base);
++int bcm_dma_abort(void __iomem *dma_chan_base);
++
++/* return channel no or -ve error */
++int bcm_dma_chan_alloc(unsigned preferred_feature_set,
++		       void __iomem **out_dma_base, int *out_dma_irq);
++int bcm_dma_chan_free(int channel);
++
++int bcm_dmaman_probe(struct platform_device *pdev, void __iomem *base,
++		     u32 chans_available);
++int bcm_dmaman_remove(struct platform_device *pdev);
++
++#else /* CONFIG_DMA_BCM2708 */
++
++static inline int bcm_sg_suitable_for_dma(struct scatterlist *sg_ptr,
++					  int sg_len)
++{
++	return 0;
++}
++
++static inline void bcm_dma_start(void __iomem *dma_chan_base,
++				 dma_addr_t control_block) { }
++
++static inline void bcm_dma_wait_idle(void __iomem *dma_chan_base) { }
++
++static inline bool bcm_dma_is_busy(void __iomem *dma_chan_base)
++{
++	return false;
++}
++
++static inline int bcm_dma_abort(void __iomem *dma_chan_base)
++{
++	return -EINVAL;
++}
++
++static inline int bcm_dma_chan_alloc(unsigned preferred_feature_set,
++				     void __iomem **out_dma_base,
++				     int *out_dma_irq)
++{
++	return -EINVAL;
++}
++
++static inline int bcm_dma_chan_free(int channel)
++{
++	return -EINVAL;
++}
++
++static inline int bcm_dmaman_probe(struct platform_device *pdev,
++				   void __iomem *base, u32 chans_available)
++{
++	return 0;
++}
++
++static inline int bcm_dmaman_remove(struct platform_device *pdev)
++{
++	return 0;
++}
++
++#endif /* CONFIG_DMA_BCM2708 || CONFIG_DMA_BCM2708_MODULE */
++
++#endif /* _PLAT_BCM2708_DMA_H */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0057-MMC-added-alternative-MMC-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0057-MMC-added-alternative-MMC-driver.patch
new file mode 100644
index 00000000..629fe1d9
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0057-MMC-added-alternative-MMC-driver.patch
@@ -0,0 +1,2021 @@
+From d98f5a40572162fddc284dee7b4f0cc7e66c6c06 Mon Sep 17 00:00:00 2001
+From: gellert <gellert@raspberrypi.org>
+Date: Fri, 15 Aug 2014 16:35:06 +0100
+Subject: [PATCH 057/697] MMC: added alternative MMC driver
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+mmc: Disable CMD23 transfers on all cards
+
+Pending wire-level investigation of these types of transfers
+and associated errors on bcm2835-mmc, disable for now. Fallback of
+CMD18/CMD25 transfers will be used automatically by the MMC layer.
+
+Reported/Tested-by: Gellert Weisz <gellert@raspberrypi.org>
+
+mmc: bcm2835-mmc: enable DT support for all architectures
+
+Both ARCH_BCM2835 and ARCH_BCM270x are built with OF now.
+Enable Device Tree support for all architectures.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+mmc: bcm2835-mmc: fix probe error handling
+
+Probe error handling is broken in several places.
+Simplify error handling by using device managed functions.
+Replace pr_{err,info} with dev_{err,info}.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+bcm2835-mmc: Add locks when accessing sdhost registers
+
+bcm2835-mmc: Add range of debug options for slowing things down
+
+bcm2835-mmc: Add option to disable some delays
+
+bcm2835-mmc: Add option to disable MMC_QUIRK_BLK_NO_CMD23
+
+bcm2835-mmc: Default to disabling MMC_QUIRK_BLK_NO_CMD23
+
+bcm2835-mmc: Adding overclocking option
+
+Allow a different clock speed to be substitued for a requested 50MHz.
+This option is exposed using the "overclock_50" DT parameter.
+Note that the mmc interface is restricted to EVEN integer divisions of
+250MHz, and the highest sensible option is 63 (250/4 = 62.5), the
+next being 125 (250/2) which is much too high.
+
+Use at your own risk.
+
+bcm2835-mmc: Round up the overclock, so 62 works for 62.5Mhz
+
+Also only warn once for each overclock setting.
+
+mmc: bcm2835-mmc: Make available on ARCH_BCM2835
+
+Make the bcm2835-mmc driver available for use on ARCH_BCM2835.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+BCM270x_DT: add bcm2835-mmc entry
+
+Add Device Tree entry for bcm2835-mmc.
+In non-DT mode, don't add the device in the board file.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+bcm2835-mmc: Don't overwrite MMC capabilities from DT
+
+bcm2835-mmc: Don't override bus width capabilities from devicetree
+
+Take out the force setting of the MMC_CAP_4_BIT_DATA host capability
+so that the result read from devicetree via mmc_of_parse() is
+preserved.
+
+bcm2835-mmc: Only claim one DMA channel
+
+With both MMC controllers enabled there are few DMA channels left. The
+bcm2835-mmc driver only uses DMA in one direction at a time, so it
+doesn't need to claim two channels.
+
+See: https://github.com/raspberrypi/linux/issues/1327
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-mmc: New timer API
+
+mmc: bcm2835-mmc: Support underclocking
+
+Support underclocking of the SD bus using the max-frequency DT property
+(which currently has no DT parameter). The sd_overclock parameter
+already provides another way to achieve the same thing which should be
+equivalent in end result, but it is a bug not to support max-frequency
+as well.
+
+See: https://github.com/raspberrypi/linux/issues/2350
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+mmc/bcm2835: Recover from MMC_SEND_EXT_CSD
+
+If the user issues an "mmc extcsd read", the SD controller receives
+what it thinks is a SEND_IF_COND command with an unexpected data block.
+The resulting operations leave the FSM stuck in READWAIT, a state which
+persists until the MMC framework resets the controller, by which point
+the root filesystem is likely to have been unmounted.
+
+A less heavyweight solution is to detect the condition and nudge the
+FSM by asserting the (self-clearing) FORCE_DATA_MODE bit.
+
+N.B. This workaround was essentially discovered by accident and without
+a full understanding the inner workings of the controller, so it is
+fortunate that the "fix" only modifies error paths.
+
+See: https://github.com/raspberrypi/linux/issues/2728
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-mmc: Fix DMA channel leak
+
+The BCM2835 MMC host driver requests a DMA channel on probe but neglects
+to release the channel in the probe error path and on driver unbind.
+
+I'm seeing this happen on every boot of the Compute Module 3: On first
+driver probe, DMA channel 2 is allocated and then leaked with a "could
+not get clk, deferring probe" message. On second driver probe, channel 4
+is allocated.
+
+Fix it.
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: Frank Pavlic <f.pavlic@kunbus.de>
+
+bcm2835-mmc: Fix struct mmc_host leak on probe
+
+The BCM2835 MMC host driver requests the bus address of the host's
+register map on probe.  If that fails, the driver leaks the struct
+mmc_host allocated earlier.
+
+Fix it.
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: Frank Pavlic <f.pavlic@kunbus.de>
+
+bcm2835-mmc: Fix duplicate free_irq() on remove
+
+The BCM2835 MMC host driver requests its interrupt as a device-managed
+resource, so the interrupt is automatically freed after the driver is
+unbound.
+
+However on driver unbind, bcm2835_mmc_remove() frees the interrupt
+explicitly to avoid invocation of the interrupt handler after driver
+structures have been torn down.
+
+The interrupt is thus freed twice, leading to a WARN splat in
+__free_irq().  Fix by not requesting the interrupt as a device-managed
+resource.
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: Frank Pavlic <f.pavlic@kunbus.de>
+
+bcm2835-mmc: Handle mmc_add_host() errors
+
+The BCM2835 MMC host driver calls mmc_add_host() but doesn't check its
+return value.  Errors occurring in that function are therefore not
+handled.  Fix it.
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: Frank Pavlic <f.pavlic@kunbus.de>
+
+bcm2835-mmc: Deduplicate reset of driver data on remove
+
+The BCM2835 MMC host driver sets the device's driver data pointer to
+NULL on ->remove() even though the driver core subsequently does the
+same in __device_release_driver().  Drop the duplicate assignment.
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: Frank Pavlic <f.pavlic@kunbus.de>
+
+bcm2835_mmc: Remove vestigial threaded IRQ
+
+With SDIO processing now managed by the MMC framework with a
+workqueue, the bcm2835_mmc driver no longer needs a threaded
+IRQ.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+Add missing dma_unmap_sg calls to free relevant swiotlb bounce buffers.
+This prevents DMA leaks.
+
+Signed-off-by: Yaroslav Rosomakho <yaroslavros@gmail.com>
+
+Limit max_req_size under arm64 (or any other platform that uses swiotlb) to prevent potential buffer overflow due to bouncing.
+
+Signed-off-by: Yaroslav Rosomakho <yaroslavros@gmail.com>
+
+mmc: sdhci: Silence MMC warnings
+
+When the MMC isn't plugged in, the driver will spam the console which is
+pretty annoying when using NFS.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+
+mmc: sdhci-iproc: Fix vmmc regulators on iProc
+
+The Linux support for controlling card power via regulators appears to
+be contentious. I would argue that the default behaviour is contrary to
+the SDHCI spec - turning off the power writes a reserved value to the
+SD Bus Voltage Select field of the Power Control Register, which
+seems to kill the Arasan/iProc controller - but fortunately there is a
+hook in sdhci_ops to override the behaviour. Borrow the implementation
+from sdhci_arasan_set_power.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-mmc: uninitialized_var is no more
+
+Revert "mmc: sdhci-iproc: Fix vmmc regulators on iProc"
+
+This reverts commit aed19399a01733dbad9be8bf026a4f7dd823b04f.
+
+Commit 6c92ae1e452f ("mmc: sdhci: Introduce sdhci_set_power_and_bus_voltage()")
+introduced a generic helper that does the same thing so use that instead in
+the following commit.
+
+Signed-off-by: Juerg Haefliger <juergh@canonical.com>
+
+mmc: sdhci-iproc: Fix vmmc regulators (pre-bcm2711)
+
+The Linux support for controlling card power via regulators appears to
+be contentious. I would argue that the default behaviour is contrary to
+the SDHCI spec - turning off the power writes a reserved value to the
+SD Bus Voltage Select field of the Power Control Register, which
+seems to kill the Arasan/iProc controller - but fortunately there is a
+hook in sdhci_ops to override the behaviour.
+
+Signed-off-by: Juerg Haefliger <juergh@canonical.com>
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+bcm2835-mmc: Honor return value of mmc_of_parse()
+
+bcm2835_mmc_probe() ignores errors returned by mmc_of_parse() and in
+particular ignores -EPROBE_DEFER, which may be returned if the power
+sequencing driver configured in the devicetree is compiled as a module.
+
+The user-visible result is that access to the SDIO device fails because
+its power sequencing requirements have not been observed.  Fix it.
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+
+bcm2835-mmc: Use phys addresses for slave DMA config
+
+Contrary to what struct snd_dmaengine_dai_dma_data suggests, the
+configuration of addresses of DMA slave interfaces should be done in
+CPU physical addresses.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/mmc/core/block.c       |   31 +-
+ drivers/mmc/core/core.c        |    3 +-
+ drivers/mmc/core/quirks.h      |    8 +
+ drivers/mmc/host/Kconfig       |   29 +
+ drivers/mmc/host/Makefile      |    1 +
+ drivers/mmc/host/bcm2835-mmc.c | 1560 ++++++++++++++++++++++++++++++++
+ drivers/mmc/host/sdhci-iproc.c |    1 +
+ drivers/mmc/host/sdhci.c       |    6 +-
+ include/linux/mmc/card.h       |    1 +
+ 9 files changed, 1635 insertions(+), 5 deletions(-)
+ create mode 100644 drivers/mmc/host/bcm2835-mmc.c
+
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -218,6 +218,13 @@ static DEFINE_MUTEX(open_lock);
+ module_param(perdev_minors, int, 0444);
+ MODULE_PARM_DESC(perdev_minors, "Minors numbers to allocate per device");
+ 
++/*
++ * Allow quirks to be overridden for the current card
++ */
++static char *card_quirks;
++module_param(card_quirks, charp, 0644);
++MODULE_PARM_DESC(card_quirks, "Force the use of the indicated quirks (a bitfield)");
++
+ static inline int mmc_blk_part_switch(struct mmc_card *card,
+ 				      unsigned int part_type);
+ static void mmc_blk_rw_rq_prep(struct mmc_queue_req *mqrq,
+@@ -3313,6 +3320,8 @@ static int mmc_blk_probe(struct mmc_card
+ {
+ 	struct mmc_blk_data *md;
+ 	int ret = 0;
++	char quirk_str[24];
++	char cap_str[10];
+ 
+ 	/*
+ 	 * Check that the card supports the command class(es) we need.
+@@ -3320,7 +3329,16 @@ static int mmc_blk_probe(struct mmc_card
+ 	if (!(card->csd.cmdclass & CCC_BLOCK_READ))
+ 		return -ENODEV;
+ 
+-	mmc_fixup_device(card, mmc_blk_fixups);
++	if (card_quirks) {
++		unsigned long quirks;
++		if (kstrtoul(card_quirks, 0, &quirks) == 0)
++			card->quirks = (unsigned int)quirks;
++		else
++			pr_err("mmc_block: Invalid card_quirks parameter '%s'\n",
++			       card_quirks);
++	}
++	else
++		mmc_fixup_device(card, mmc_blk_fixups);
+ 
+ 	card->complete_wq = alloc_workqueue("mmc_complete",
+ 					WQ_MEM_RECLAIM | WQ_HIGHPRI, 0);
+@@ -3335,6 +3353,17 @@ static int mmc_blk_probe(struct mmc_card
+ 		goto out_free;
+ 	}
+ 
++	string_get_size((u64)get_capacity(md->disk), 512, STRING_UNITS_2,
++			cap_str, sizeof(cap_str));
++	if (card->quirks)
++		snprintf(quirk_str, sizeof(quirk_str),
++			 " (quirks 0x%08x)", card->quirks);
++	else
++		quirk_str[0] = '\0';
++	pr_info("%s: %s %s %s%s%s\n",
++		md->disk->disk_name, mmc_card_id(card), mmc_card_name(card),
++		cap_str, md->read_only ? " (ro)" : "", quirk_str);
++
+ 	ret = mmc_blk_alloc_parts(card, md);
+ 	if (ret)
+ 		goto out;
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -1818,7 +1818,8 @@ EXPORT_SYMBOL(mmc_erase);
+ 
+ int mmc_can_erase(struct mmc_card *card)
+ {
+-	if (card->csd.cmdclass & CCC_ERASE && card->erase_size)
++	if (card->csd.cmdclass & CCC_ERASE && card->erase_size &&
++	    !(card->quirks & MMC_QUIRK_ERASE_BROKEN))
+ 		return 1;
+ 	return 0;
+ }
+--- a/drivers/mmc/core/quirks.h
++++ b/drivers/mmc/core/quirks.h
+@@ -143,6 +143,14 @@ static const struct mmc_fixup __maybe_un
+ 	MMC_FIXUP(CID_NAME_ANY, CID_MANFID_SANDISK_SD, 0x5344, add_quirk_sd,
+ 		  MMC_QUIRK_BROKEN_SD_DISCARD),
+ 
++	/*
++	 *  On some Kingston SD cards, multiple erases of less than 64
++	 *  sectors can cause corruption.
++	 */
++	MMC_FIXUP("SD16G", 0x41, 0x3432, add_quirk, MMC_QUIRK_ERASE_BROKEN),
++	MMC_FIXUP("SD32G", 0x41, 0x3432, add_quirk, MMC_QUIRK_ERASE_BROKEN),
++	MMC_FIXUP("SD64G", 0x41, 0x3432, add_quirk, MMC_QUIRK_ERASE_BROKEN),
++
+ 	END_FIXUP
+ };
+ 
+--- a/drivers/mmc/host/Kconfig
++++ b/drivers/mmc/host/Kconfig
+@@ -5,6 +5,35 @@
+ 
+ comment "MMC/SD/SDIO Host Controller Drivers"
+ 
++config MMC_BCM2835_MMC
++	tristate "MMC support on BCM2835"
++	depends on MACH_BCM2708 || MACH_BCM2709 || ARCH_BCM2835
++	help
++	  This selects the MMC Interface on BCM2835.
++
++	  If you have a controller with this interface, say Y or M here.
++
++	  If unsure, say N.
++
++config MMC_BCM2835_DMA
++	bool "DMA support on BCM2835 Arasan controller"
++	depends on MMC_BCM2835_MMC
++	help
++	  Enable DMA support on the Arasan SDHCI controller in Broadcom 2708
++	  based chips.
++
++	  If unsure, say N.
++
++config MMC_BCM2835_PIO_DMA_BARRIER
++	int "Block count limit for PIO transfers"
++	depends on MMC_BCM2835_MMC && MMC_BCM2835_DMA
++	range 0 256
++	default 2
++	help
++	  The inclusive limit in bytes under which PIO will be used instead of DMA
++
++	  If unsure, say 2 here.
++
+ config MMC_DEBUG
+ 	bool "MMC host drivers debugging"
+ 	depends on MMC != n
+--- a/drivers/mmc/host/Makefile
++++ b/drivers/mmc/host/Makefile
+@@ -22,6 +22,7 @@ obj-$(CONFIG_MMC_SDHCI_F_SDH30)	+= sdhci
+ obj-$(CONFIG_MMC_SDHCI_MILBEAUT)	+= sdhci-milbeaut.o
+ obj-$(CONFIG_MMC_SDHCI_SPEAR)	+= sdhci-spear.o
+ obj-$(CONFIG_MMC_SDHCI_AM654)	+= sdhci_am654.o
++obj-$(CONFIG_MMC_BCM2835_MMC)	+= bcm2835-mmc.o
+ obj-$(CONFIG_MMC_WBSD)		+= wbsd.o
+ obj-$(CONFIG_MMC_AU1X)		+= au1xmmc.o
+ obj-$(CONFIG_MMC_ALCOR)	+= alcor.o
+--- /dev/null
++++ b/drivers/mmc/host/bcm2835-mmc.c
+@@ -0,0 +1,1560 @@
++/*
++ * BCM2835 MMC host driver.
++ *
++ * Author:      Gellert Weisz <gellert@raspberrypi.org>
++ *              Copyright 2014
++ *
++ * Based on
++ *  sdhci-bcm2708.c by Broadcom
++ *  sdhci-bcm2835.c by Stephen Warren and Oleksandr Tymoshenko
++ *  sdhci.c and sdhci-pci.c by Pierre Ossman
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms and conditions of the GNU General Public License,
++ * version 2, as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
++ * more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#include <linux/delay.h>
++#include <linux/module.h>
++#include <linux/io.h>
++#include <linux/mmc/mmc.h>
++#include <linux/mmc/host.h>
++#include <linux/mmc/sd.h>
++#include <linux/scatterlist.h>
++#include <linux/of_address.h>
++#include <linux/of_irq.h>
++#include <linux/clk.h>
++#include <linux/platform_device.h>
++#include <linux/err.h>
++#include <linux/blkdev.h>
++#include <linux/dmaengine.h>
++#include <linux/dma-mapping.h>
++#include <linux/of_dma.h>
++#include <linux/swiotlb.h>
++
++#include "sdhci.h"
++
++
++#define DRIVER_NAME "mmc-bcm2835"
++
++#define DBG(f, x...) \
++pr_debug(DRIVER_NAME " [%s()]: " f, __func__, ## x)
++
++#ifndef CONFIG_MMC_BCM2835_DMA
++ #define FORCE_PIO
++#endif
++
++
++/* the inclusive limit in bytes under which PIO will be used instead of DMA */
++#ifdef CONFIG_MMC_BCM2835_PIO_DMA_BARRIER
++#define PIO_DMA_BARRIER CONFIG_MMC_BCM2835_PIO_DMA_BARRIER
++#else
++#define PIO_DMA_BARRIER 00
++#endif
++
++#define MIN_FREQ 400000
++#define TIMEOUT_VAL 0xE
++#define BCM2835_SDHCI_WRITE_DELAY(f)	(((2 * 1000000) / f) + 1)
++
++
++unsigned mmc_debug;
++unsigned mmc_debug2;
++
++struct bcm2835_host {
++	spinlock_t				lock;
++
++	void __iomem			*ioaddr;
++	u32						bus_addr;
++
++	struct mmc_host			*mmc;
++
++	u32						timeout;
++
++	int						clock;	/* Current clock speed */
++	u8						pwr;	/* Current voltage */
++
++	unsigned int			max_clk;		/* Max possible freq */
++	unsigned int			timeout_clk;	/* Timeout freq (KHz) */
++	unsigned int			clk_mul;		/* Clock Muliplier value */
++
++	struct tasklet_struct	finish_tasklet;		/* Tasklet structures */
++
++	struct timer_list		timer;			/* Timer for timeouts */
++
++	struct sg_mapping_iter	sg_miter;		/* SG state for PIO */
++	unsigned int			blocks;			/* remaining PIO blocks */
++
++	int						irq;			/* Device IRQ */
++
++
++	u32						ier;			/* cached registers */
++
++	struct mmc_request		*mrq;			/* Current request */
++	struct mmc_command		*cmd;			/* Current command */
++	struct mmc_data			*data;			/* Current data request */
++	unsigned int			data_early:1;		/* Data finished before cmd */
++
++	wait_queue_head_t		buf_ready_int;		/* Waitqueue for Buffer Read Ready interrupt */
++
++	u32						shadow;
++
++	/*DMA part*/
++	struct dma_chan			*dma_chan_rxtx;		/* DMA channel for reads and writes */
++	struct dma_slave_config		dma_cfg_rx;
++	struct dma_slave_config		dma_cfg_tx;
++	struct dma_async_tx_descriptor	*tx_desc;	/* descriptor */
++
++	bool					have_dma;
++	bool					use_dma;
++	bool					wait_for_dma;
++	/*end of DMA part*/
++
++	int						max_delay;	/* maximum length of time spent waiting */
++
++	int						flags;				/* Host attributes */
++#define SDHCI_REQ_USE_DMA	(1<<2)	/* Use DMA for this req. */
++#define SDHCI_DEVICE_DEAD	(1<<3)	/* Device unresponsive */
++#define SDHCI_AUTO_CMD12	(1<<6)	/* Auto CMD12 support */
++#define SDHCI_AUTO_CMD23	(1<<7)	/* Auto CMD23 support */
++#define SDHCI_SDIO_IRQ_ENABLED	(1<<9)	/* SDIO irq enabled */
++
++	u32				overclock_50;	/* frequency to use when 50MHz is requested (in MHz) */
++	u32				max_overclock;	/* Highest reported */
++};
++
++
++static inline void bcm2835_mmc_writel(struct bcm2835_host *host, u32 val, int reg, int from)
++{
++	unsigned delay;
++	lockdep_assert_held_once(&host->lock);
++	writel(val, host->ioaddr + reg);
++	udelay(BCM2835_SDHCI_WRITE_DELAY(max(host->clock, MIN_FREQ)));
++
++	delay = ((mmc_debug >> 16) & 0xf) << ((mmc_debug >> 20) & 0xf);
++	if (delay && !((1<<from) & mmc_debug2))
++		udelay(delay);
++}
++
++static inline void mmc_raw_writel(struct bcm2835_host *host, u32 val, int reg)
++{
++	unsigned delay;
++	lockdep_assert_held_once(&host->lock);
++	writel(val, host->ioaddr + reg);
++
++	delay = ((mmc_debug >> 24) & 0xf) << ((mmc_debug >> 28) & 0xf);
++	if (delay)
++		udelay(delay);
++}
++
++static inline u32 bcm2835_mmc_readl(struct bcm2835_host *host, int reg)
++{
++	lockdep_assert_held_once(&host->lock);
++	return readl(host->ioaddr + reg);
++}
++
++static inline void bcm2835_mmc_writew(struct bcm2835_host *host, u16 val, int reg)
++{
++	u32 oldval = (reg == SDHCI_COMMAND) ? host->shadow :
++		bcm2835_mmc_readl(host, reg & ~3);
++	u32 word_num = (reg >> 1) & 1;
++	u32 word_shift = word_num * 16;
++	u32 mask = 0xffff << word_shift;
++	u32 newval = (oldval & ~mask) | (val << word_shift);
++
++	if (reg == SDHCI_TRANSFER_MODE)
++		host->shadow = newval;
++	else
++		bcm2835_mmc_writel(host, newval, reg & ~3, 0);
++
++}
++
++static inline void bcm2835_mmc_writeb(struct bcm2835_host *host, u8 val, int reg)
++{
++	u32 oldval = bcm2835_mmc_readl(host, reg & ~3);
++	u32 byte_num = reg & 3;
++	u32 byte_shift = byte_num * 8;
++	u32 mask = 0xff << byte_shift;
++	u32 newval = (oldval & ~mask) | (val << byte_shift);
++
++	bcm2835_mmc_writel(host, newval, reg & ~3, 1);
++}
++
++
++static inline u16 bcm2835_mmc_readw(struct bcm2835_host *host, int reg)
++{
++	u32 val = bcm2835_mmc_readl(host, (reg & ~3));
++	u32 word_num = (reg >> 1) & 1;
++	u32 word_shift = word_num * 16;
++	u32 word = (val >> word_shift) & 0xffff;
++
++	return word;
++}
++
++static inline u8 bcm2835_mmc_readb(struct bcm2835_host *host, int reg)
++{
++	u32 val = bcm2835_mmc_readl(host, (reg & ~3));
++	u32 byte_num = reg & 3;
++	u32 byte_shift = byte_num * 8;
++	u32 byte = (val >> byte_shift) & 0xff;
++
++	return byte;
++}
++
++static void bcm2835_mmc_unsignal_irqs(struct bcm2835_host *host, u32 clear)
++{
++	u32 ier;
++
++	ier = bcm2835_mmc_readl(host, SDHCI_SIGNAL_ENABLE);
++	ier &= ~clear;
++	/* change which requests generate IRQs - makes no difference to
++	   the content of SDHCI_INT_STATUS, or the need to acknowledge IRQs */
++	bcm2835_mmc_writel(host, ier, SDHCI_SIGNAL_ENABLE, 2);
++}
++
++
++static void bcm2835_mmc_dumpregs(struct bcm2835_host *host)
++{
++	pr_debug(DRIVER_NAME ": =========== REGISTER DUMP (%s)===========\n",
++		mmc_hostname(host->mmc));
++
++	pr_debug(DRIVER_NAME ": Sys addr: 0x%08x | Version:  0x%08x\n",
++		bcm2835_mmc_readl(host, SDHCI_DMA_ADDRESS),
++		bcm2835_mmc_readw(host, SDHCI_HOST_VERSION));
++	pr_debug(DRIVER_NAME ": Blk size: 0x%08x | Blk cnt:  0x%08x\n",
++		bcm2835_mmc_readw(host, SDHCI_BLOCK_SIZE),
++		bcm2835_mmc_readw(host, SDHCI_BLOCK_COUNT));
++	pr_debug(DRIVER_NAME ": Argument: 0x%08x | Trn mode: 0x%08x\n",
++		bcm2835_mmc_readl(host, SDHCI_ARGUMENT),
++		bcm2835_mmc_readw(host, SDHCI_TRANSFER_MODE));
++	pr_debug(DRIVER_NAME ": Present:  0x%08x | Host ctl: 0x%08x\n",
++		bcm2835_mmc_readl(host, SDHCI_PRESENT_STATE),
++		bcm2835_mmc_readb(host, SDHCI_HOST_CONTROL));
++	pr_debug(DRIVER_NAME ": Power:    0x%08x | Blk gap:  0x%08x\n",
++		bcm2835_mmc_readb(host, SDHCI_POWER_CONTROL),
++		bcm2835_mmc_readb(host, SDHCI_BLOCK_GAP_CONTROL));
++	pr_debug(DRIVER_NAME ": Wake-up:  0x%08x | Clock:    0x%08x\n",
++		bcm2835_mmc_readb(host, SDHCI_WAKE_UP_CONTROL),
++		bcm2835_mmc_readw(host, SDHCI_CLOCK_CONTROL));
++	pr_debug(DRIVER_NAME ": Timeout:  0x%08x | Int stat: 0x%08x\n",
++		bcm2835_mmc_readb(host, SDHCI_TIMEOUT_CONTROL),
++		bcm2835_mmc_readl(host, SDHCI_INT_STATUS));
++	pr_debug(DRIVER_NAME ": Int enab: 0x%08x | Sig enab: 0x%08x\n",
++		bcm2835_mmc_readl(host, SDHCI_INT_ENABLE),
++		bcm2835_mmc_readl(host, SDHCI_SIGNAL_ENABLE));
++	pr_debug(DRIVER_NAME ": AC12 err: 0x%08x | Slot int: 0x%08x\n",
++		bcm2835_mmc_readw(host, SDHCI_AUTO_CMD_STATUS),
++		bcm2835_mmc_readw(host, SDHCI_SLOT_INT_STATUS));
++	pr_debug(DRIVER_NAME ": Caps:     0x%08x | Caps_1:   0x%08x\n",
++		bcm2835_mmc_readl(host, SDHCI_CAPABILITIES),
++		bcm2835_mmc_readl(host, SDHCI_CAPABILITIES_1));
++	pr_debug(DRIVER_NAME ": Cmd:      0x%08x | Max curr: 0x%08x\n",
++		bcm2835_mmc_readw(host, SDHCI_COMMAND),
++		bcm2835_mmc_readl(host, SDHCI_MAX_CURRENT));
++	pr_debug(DRIVER_NAME ": Host ctl2: 0x%08x\n",
++		bcm2835_mmc_readw(host, SDHCI_HOST_CONTROL2));
++
++	pr_debug(DRIVER_NAME ": ===========================================\n");
++}
++
++
++static void bcm2835_mmc_reset(struct bcm2835_host *host, u8 mask)
++{
++	unsigned long timeout;
++	unsigned long flags;
++
++	spin_lock_irqsave(&host->lock, flags);
++	bcm2835_mmc_writeb(host, mask, SDHCI_SOFTWARE_RESET);
++
++	if (mask & SDHCI_RESET_ALL)
++		host->clock = 0;
++
++	/* Wait max 100 ms */
++	timeout = 100;
++
++	/* hw clears the bit when it's done */
++	while (bcm2835_mmc_readb(host, SDHCI_SOFTWARE_RESET) & mask) {
++		if (timeout == 0) {
++			pr_err("%s: Reset 0x%x never completed.\n",
++				mmc_hostname(host->mmc), (int)mask);
++			bcm2835_mmc_dumpregs(host);
++			return;
++		}
++		timeout--;
++		spin_unlock_irqrestore(&host->lock, flags);
++		mdelay(1);
++		spin_lock_irqsave(&host->lock, flags);
++	}
++
++	if (100-timeout > 10 && 100-timeout > host->max_delay) {
++		host->max_delay = 100-timeout;
++		pr_warn("Warning: MMC controller hung for %d ms\n", host->max_delay);
++	}
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++
++static void bcm2835_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios);
++
++static void bcm2835_mmc_init(struct bcm2835_host *host, int soft)
++{
++	unsigned long flags;
++	if (soft)
++		bcm2835_mmc_reset(host, SDHCI_RESET_CMD|SDHCI_RESET_DATA);
++	else
++		bcm2835_mmc_reset(host, SDHCI_RESET_ALL);
++
++	host->ier = SDHCI_INT_BUS_POWER | SDHCI_INT_DATA_END_BIT |
++		    SDHCI_INT_DATA_CRC | SDHCI_INT_DATA_TIMEOUT |
++		    SDHCI_INT_INDEX | SDHCI_INT_END_BIT | SDHCI_INT_CRC |
++		    SDHCI_INT_TIMEOUT | SDHCI_INT_DATA_END |
++		    SDHCI_INT_RESPONSE;
++
++	spin_lock_irqsave(&host->lock, flags);
++	bcm2835_mmc_writel(host, host->ier, SDHCI_INT_ENABLE, 3);
++	bcm2835_mmc_writel(host, host->ier, SDHCI_SIGNAL_ENABLE, 3);
++	spin_unlock_irqrestore(&host->lock, flags);
++
++	if (soft) {
++		/* force clock reconfiguration */
++		host->clock = 0;
++		bcm2835_mmc_set_ios(host->mmc, &host->mmc->ios);
++	}
++}
++
++
++
++static void bcm2835_mmc_finish_data(struct bcm2835_host *host);
++
++static void bcm2835_mmc_dma_complete(void *param)
++{
++	struct bcm2835_host *host = param;
++	struct dma_chan *dma_chan;
++	unsigned long flags;
++	u32 dir_data;
++
++	spin_lock_irqsave(&host->lock, flags);
++
++	host->use_dma = false;
++
++	if (host->data) {
++		dma_chan = host->dma_chan_rxtx;
++		if (host->data->flags & MMC_DATA_WRITE)
++			dir_data = DMA_TO_DEVICE;
++		else
++			dir_data = DMA_FROM_DEVICE;
++		dma_unmap_sg(dma_chan->device->dev,
++		     host->data->sg, host->data->sg_len,
++		     dir_data);
++		if (! (host->data->flags & MMC_DATA_WRITE))
++			bcm2835_mmc_finish_data(host);
++	} else if (host->wait_for_dma) {
++		host->wait_for_dma = false;
++		tasklet_schedule(&host->finish_tasklet);
++	}
++
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++
++static void bcm2835_bcm2835_mmc_read_block_pio(struct bcm2835_host *host)
++{
++	unsigned long flags;
++	size_t blksize, len, chunk;
++
++	u32 scratch = 0;
++	u8 *buf;
++
++	blksize = host->data->blksz;
++	chunk = 0;
++
++	local_irq_save(flags);
++
++	while (blksize) {
++		if (!sg_miter_next(&host->sg_miter))
++			BUG();
++
++		len = min(host->sg_miter.length, blksize);
++
++		blksize -= len;
++		host->sg_miter.consumed = len;
++
++		buf = host->sg_miter.addr;
++
++		while (len) {
++			if (chunk == 0) {
++				scratch = bcm2835_mmc_readl(host, SDHCI_BUFFER);
++				chunk = 4;
++			}
++
++			*buf = scratch & 0xFF;
++
++			buf++;
++			scratch >>= 8;
++			chunk--;
++			len--;
++		}
++	}
++
++	sg_miter_stop(&host->sg_miter);
++
++	local_irq_restore(flags);
++}
++
++static void bcm2835_bcm2835_mmc_write_block_pio(struct bcm2835_host *host)
++{
++	unsigned long flags;
++	size_t blksize, len, chunk;
++	u32 scratch;
++	u8 *buf;
++
++	blksize = host->data->blksz;
++	chunk = 0;
++	chunk = 0;
++	scratch = 0;
++
++	local_irq_save(flags);
++
++	while (blksize) {
++		if (!sg_miter_next(&host->sg_miter))
++			BUG();
++
++		len = min(host->sg_miter.length, blksize);
++
++		blksize -= len;
++		host->sg_miter.consumed = len;
++
++		buf = host->sg_miter.addr;
++
++		while (len) {
++			scratch |= (u32)*buf << (chunk * 8);
++
++			buf++;
++			chunk++;
++			len--;
++
++			if ((chunk == 4) || ((len == 0) && (blksize == 0))) {
++				mmc_raw_writel(host, scratch, SDHCI_BUFFER);
++				chunk = 0;
++				scratch = 0;
++			}
++		}
++	}
++
++	sg_miter_stop(&host->sg_miter);
++
++	local_irq_restore(flags);
++}
++
++
++static void bcm2835_mmc_transfer_pio(struct bcm2835_host *host)
++{
++	u32 mask;
++
++	BUG_ON(!host->data);
++
++	if (host->blocks == 0)
++		return;
++
++	if (host->data->flags & MMC_DATA_READ)
++		mask = SDHCI_DATA_AVAILABLE;
++	else
++		mask = SDHCI_SPACE_AVAILABLE;
++
++	while (bcm2835_mmc_readl(host, SDHCI_PRESENT_STATE) & mask) {
++
++		if (host->data->flags & MMC_DATA_READ)
++			bcm2835_bcm2835_mmc_read_block_pio(host);
++		else
++			bcm2835_bcm2835_mmc_write_block_pio(host);
++
++		host->blocks--;
++
++		/* QUIRK used in sdhci.c removes the 'if' */
++		/* but it seems this is unnecessary */
++		if (host->blocks == 0)
++			break;
++
++
++	}
++}
++
++
++static void bcm2835_mmc_transfer_dma(struct bcm2835_host *host)
++{
++	u32 len, dir_data, dir_slave;
++	struct dma_async_tx_descriptor *desc = NULL;
++	struct dma_chan *dma_chan;
++
++
++	WARN_ON(!host->data);
++
++	if (!host->data)
++		return;
++
++	if (host->blocks == 0)
++		return;
++
++	dma_chan = host->dma_chan_rxtx;
++	if (host->data->flags & MMC_DATA_READ) {
++		dir_data = DMA_FROM_DEVICE;
++		dir_slave = DMA_DEV_TO_MEM;
++	} else {
++		dir_data = DMA_TO_DEVICE;
++		dir_slave = DMA_MEM_TO_DEV;
++	}
++
++	/* The parameters have already been validated, so this will not fail */
++	(void)dmaengine_slave_config(dma_chan,
++				     (dir_data == DMA_FROM_DEVICE) ?
++				     &host->dma_cfg_rx :
++				     &host->dma_cfg_tx);
++
++	BUG_ON(!dma_chan->device);
++	BUG_ON(!dma_chan->device->dev);
++	BUG_ON(!host->data->sg);
++
++	len = dma_map_sg(dma_chan->device->dev, host->data->sg,
++			 host->data->sg_len, dir_data);
++	if (len > 0) {
++		desc = dmaengine_prep_slave_sg(dma_chan, host->data->sg,
++					       len, dir_slave,
++					       DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
++	} else {
++		dev_err(mmc_dev(host->mmc), "dma_map_sg returned zero length\n");
++	}
++	if (desc) {
++		unsigned long flags;
++		spin_lock_irqsave(&host->lock, flags);
++		bcm2835_mmc_unsignal_irqs(host, SDHCI_INT_DATA_AVAIL |
++						    SDHCI_INT_SPACE_AVAIL);
++		host->tx_desc = desc;
++		desc->callback = bcm2835_mmc_dma_complete;
++		desc->callback_param = host;
++		spin_unlock_irqrestore(&host->lock, flags);
++		dmaengine_submit(desc);
++		dma_async_issue_pending(dma_chan);
++	} else {
++		dma_unmap_sg(dma_chan->device->dev, host->data->sg, len, dir_data);
++	}
++
++}
++
++
++
++static void bcm2835_mmc_set_transfer_irqs(struct bcm2835_host *host)
++{
++	u32 pio_irqs = SDHCI_INT_DATA_AVAIL | SDHCI_INT_SPACE_AVAIL;
++	u32 dma_irqs = SDHCI_INT_DMA_END | SDHCI_INT_ADMA_ERROR;
++
++	if (host->use_dma)
++		host->ier = (host->ier & ~pio_irqs) | dma_irqs;
++	else
++		host->ier = (host->ier & ~dma_irqs) | pio_irqs;
++
++	bcm2835_mmc_writel(host, host->ier, SDHCI_INT_ENABLE, 4);
++	bcm2835_mmc_writel(host, host->ier, SDHCI_SIGNAL_ENABLE, 4);
++}
++
++
++static void bcm2835_mmc_prepare_data(struct bcm2835_host *host, struct mmc_command *cmd)
++{
++	u8 count;
++	struct mmc_data *data = cmd->data;
++
++	WARN_ON(host->data);
++
++	if (data || (cmd->flags & MMC_RSP_BUSY)) {
++		count = TIMEOUT_VAL;
++		bcm2835_mmc_writeb(host, count, SDHCI_TIMEOUT_CONTROL);
++	}
++
++	if (!data)
++		return;
++
++	/* Sanity checks */
++	BUG_ON(data->blksz * data->blocks > 524288);
++	BUG_ON(data->blksz > host->mmc->max_blk_size);
++	BUG_ON(data->blocks > 65535);
++
++	host->data = data;
++	host->data_early = 0;
++	host->data->bytes_xfered = 0;
++
++
++	if (!(host->flags & SDHCI_REQ_USE_DMA)) {
++		int flags;
++
++		flags = SG_MITER_ATOMIC;
++		if (host->data->flags & MMC_DATA_READ)
++			flags |= SG_MITER_TO_SG;
++		else
++			flags |= SG_MITER_FROM_SG;
++		sg_miter_start(&host->sg_miter, data->sg, data->sg_len, flags);
++		host->blocks = data->blocks;
++	}
++
++	host->use_dma = host->have_dma && data->blocks > PIO_DMA_BARRIER;
++
++	bcm2835_mmc_set_transfer_irqs(host);
++
++	/* Set the DMA boundary value and block size */
++	bcm2835_mmc_writew(host, SDHCI_MAKE_BLKSZ(SDHCI_DEFAULT_BOUNDARY_ARG,
++		data->blksz), SDHCI_BLOCK_SIZE);
++	bcm2835_mmc_writew(host, data->blocks, SDHCI_BLOCK_COUNT);
++
++	BUG_ON(!host->data);
++}
++
++static void bcm2835_mmc_set_transfer_mode(struct bcm2835_host *host,
++	struct mmc_command *cmd)
++{
++	u16 mode;
++	struct mmc_data *data = cmd->data;
++
++	if (data == NULL) {
++		/* clear Auto CMD settings for no data CMDs */
++		mode = bcm2835_mmc_readw(host, SDHCI_TRANSFER_MODE);
++		bcm2835_mmc_writew(host, mode & ~(SDHCI_TRNS_AUTO_CMD12 |
++				SDHCI_TRNS_AUTO_CMD23), SDHCI_TRANSFER_MODE);
++		return;
++	}
++
++	WARN_ON(!host->data);
++
++	mode = SDHCI_TRNS_BLK_CNT_EN;
++
++	if ((mmc_op_multi(cmd->opcode) || data->blocks > 1)) {
++		mode |= SDHCI_TRNS_MULTI;
++
++		/*
++		 * If we are sending CMD23, CMD12 never gets sent
++		 * on successful completion (so no Auto-CMD12).
++		 */
++		if (!host->mrq->sbc && (host->flags & SDHCI_AUTO_CMD12))
++			mode |= SDHCI_TRNS_AUTO_CMD12;
++		else if (host->mrq->sbc && (host->flags & SDHCI_AUTO_CMD23)) {
++			mode |= SDHCI_TRNS_AUTO_CMD23;
++			bcm2835_mmc_writel(host, host->mrq->sbc->arg, SDHCI_ARGUMENT2, 5);
++		}
++	}
++
++	if (data->flags & MMC_DATA_READ)
++		mode |= SDHCI_TRNS_READ;
++	if (host->flags & SDHCI_REQ_USE_DMA)
++		mode |= SDHCI_TRNS_DMA;
++
++	bcm2835_mmc_writew(host, mode, SDHCI_TRANSFER_MODE);
++}
++
++static void bcm2835_mmc_send_command(struct bcm2835_host *host, struct mmc_command *cmd)
++{
++	int flags;
++	u32 mask;
++	unsigned long timeout;
++
++	WARN_ON(host->cmd);
++
++	/* Wait max 10 ms */
++	timeout = 1000;
++
++	mask = SDHCI_CMD_INHIBIT;
++	if ((cmd->data != NULL) || (cmd->flags & MMC_RSP_BUSY))
++		mask |= SDHCI_DATA_INHIBIT;
++
++	/* We shouldn't wait for data inihibit for stop commands, even
++	   though they might use busy signaling */
++	if (host->mrq->data && (cmd == host->mrq->data->stop))
++		mask &= ~SDHCI_DATA_INHIBIT;
++
++	while (bcm2835_mmc_readl(host, SDHCI_PRESENT_STATE) & mask) {
++		if (timeout == 0) {
++			pr_err("%s: Controller never released inhibit bit(s).\n",
++				mmc_hostname(host->mmc));
++			bcm2835_mmc_dumpregs(host);
++			cmd->error = -EIO;
++			tasklet_schedule(&host->finish_tasklet);
++			return;
++		}
++		timeout--;
++		udelay(10);
++	}
++
++	if ((1000-timeout)/100 > 1 && (1000-timeout)/100 > host->max_delay) {
++		host->max_delay = (1000-timeout)/100;
++		pr_warn("Warning: MMC controller hung for %d ms\n", host->max_delay);
++	}
++
++	timeout = jiffies;
++	if (!cmd->data && cmd->busy_timeout > 9000)
++		timeout += DIV_ROUND_UP(cmd->busy_timeout, 1000) * HZ + HZ;
++	else
++		timeout += 10 * HZ;
++	mod_timer(&host->timer, timeout);
++
++	host->cmd = cmd;
++	host->use_dma = false;
++
++	bcm2835_mmc_prepare_data(host, cmd);
++
++	bcm2835_mmc_writel(host, cmd->arg, SDHCI_ARGUMENT, 6);
++
++	bcm2835_mmc_set_transfer_mode(host, cmd);
++
++	if ((cmd->flags & MMC_RSP_136) && (cmd->flags & MMC_RSP_BUSY)) {
++		pr_err("%s: Unsupported response type!\n",
++			mmc_hostname(host->mmc));
++		cmd->error = -EINVAL;
++		tasklet_schedule(&host->finish_tasklet);
++		return;
++	}
++
++	if (!(cmd->flags & MMC_RSP_PRESENT))
++		flags = SDHCI_CMD_RESP_NONE;
++	else if (cmd->flags & MMC_RSP_136)
++		flags = SDHCI_CMD_RESP_LONG;
++	else if (cmd->flags & MMC_RSP_BUSY)
++		flags = SDHCI_CMD_RESP_SHORT_BUSY;
++	else
++		flags = SDHCI_CMD_RESP_SHORT;
++
++	if (cmd->flags & MMC_RSP_CRC)
++		flags |= SDHCI_CMD_CRC;
++	if (cmd->flags & MMC_RSP_OPCODE)
++		flags |= SDHCI_CMD_INDEX;
++
++	if (cmd->data)
++		flags |= SDHCI_CMD_DATA;
++
++	bcm2835_mmc_writew(host, SDHCI_MAKE_CMD(cmd->opcode, flags), SDHCI_COMMAND);
++}
++
++
++static void bcm2835_mmc_finish_data(struct bcm2835_host *host)
++{
++	struct mmc_data *data;
++
++	BUG_ON(!host->data);
++
++	data = host->data;
++	host->data = NULL;
++
++	if (data->error)
++		data->bytes_xfered = 0;
++	else
++		data->bytes_xfered = data->blksz * data->blocks;
++
++	/*
++	 * Need to send CMD12 if -
++	 * a) open-ended multiblock transfer (no CMD23)
++	 * b) error in multiblock transfer
++	 */
++	if (data->stop &&
++	    (data->error ||
++	     !host->mrq->sbc)) {
++
++		/*
++		 * The controller needs a reset of internal state machines
++		 * upon error conditions.
++		 */
++		if (data->error) {
++			bcm2835_mmc_reset(host, SDHCI_RESET_CMD);
++			bcm2835_mmc_reset(host, SDHCI_RESET_DATA);
++		}
++
++		bcm2835_mmc_send_command(host, data->stop);
++	} else if (host->use_dma) {
++		host->wait_for_dma = true;
++	} else {
++		tasklet_schedule(&host->finish_tasklet);
++	}
++}
++
++static void bcm2835_mmc_finish_command(struct bcm2835_host *host)
++{
++	int i;
++
++	BUG_ON(host->cmd == NULL);
++
++	if (host->cmd->flags & MMC_RSP_PRESENT) {
++		if (host->cmd->flags & MMC_RSP_136) {
++			/* CRC is stripped so we need to do some shifting. */
++			for (i = 0; i < 4; i++) {
++				host->cmd->resp[i] = bcm2835_mmc_readl(host,
++					SDHCI_RESPONSE + (3-i)*4) << 8;
++				if (i != 3)
++					host->cmd->resp[i] |=
++						bcm2835_mmc_readb(host,
++						SDHCI_RESPONSE + (3-i)*4-1);
++			}
++		} else {
++			host->cmd->resp[0] = bcm2835_mmc_readl(host, SDHCI_RESPONSE);
++		}
++	}
++
++	host->cmd->error = 0;
++
++	/* Finished CMD23, now send actual command. */
++	if (host->cmd == host->mrq->sbc) {
++		host->cmd = NULL;
++		bcm2835_mmc_send_command(host, host->mrq->cmd);
++
++		if (host->mrq->cmd->data && host->use_dma) {
++			/* DMA transfer starts now, PIO starts after interrupt */
++			bcm2835_mmc_transfer_dma(host);
++		}
++	} else {
++
++		/* Processed actual command. */
++		if (host->data && host->data_early)
++			bcm2835_mmc_finish_data(host);
++
++		if (!host->cmd->data)
++			tasklet_schedule(&host->finish_tasklet);
++
++		host->cmd = NULL;
++	}
++}
++
++
++static void bcm2835_mmc_timeout_timer(struct timer_list *t)
++{
++	struct bcm2835_host *host = from_timer(host, t, timer);
++	unsigned long flags;
++
++	spin_lock_irqsave(&host->lock, flags);
++
++	if (host->mrq) {
++		pr_err("%s: Timeout waiting for hardware interrupt.\n",
++			mmc_hostname(host->mmc));
++		bcm2835_mmc_dumpregs(host);
++
++		if (host->data) {
++			host->data->error = -ETIMEDOUT;
++			bcm2835_mmc_finish_data(host);
++		} else {
++			if (host->cmd)
++				host->cmd->error = -ETIMEDOUT;
++			else
++				host->mrq->cmd->error = -ETIMEDOUT;
++
++			tasklet_schedule(&host->finish_tasklet);
++		}
++	}
++
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++
++
++static void bcm2835_mmc_enable_sdio_irq_nolock(struct bcm2835_host *host, int enable)
++{
++	if (!(host->flags & SDHCI_DEVICE_DEAD)) {
++		if (enable)
++			host->ier |= SDHCI_INT_CARD_INT;
++		else
++			host->ier &= ~SDHCI_INT_CARD_INT;
++
++		bcm2835_mmc_writel(host, host->ier, SDHCI_INT_ENABLE, 7);
++		bcm2835_mmc_writel(host, host->ier, SDHCI_SIGNAL_ENABLE, 7);
++	}
++}
++
++static void bcm2835_mmc_enable_sdio_irq(struct mmc_host *mmc, int enable)
++{
++	struct bcm2835_host *host = mmc_priv(mmc);
++	unsigned long flags;
++
++	spin_lock_irqsave(&host->lock, flags);
++	if (enable)
++		host->flags |= SDHCI_SDIO_IRQ_ENABLED;
++	else
++		host->flags &= ~SDHCI_SDIO_IRQ_ENABLED;
++
++	bcm2835_mmc_enable_sdio_irq_nolock(host, enable);
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++
++static void bcm2835_mmc_cmd_irq(struct bcm2835_host *host, u32 intmask)
++{
++
++	BUG_ON(intmask == 0);
++
++	if (!host->cmd) {
++		pr_err("%s: Got command interrupt 0x%08x even "
++			"though no command operation was in progress.\n",
++			mmc_hostname(host->mmc), (unsigned)intmask);
++		bcm2835_mmc_dumpregs(host);
++		return;
++	}
++
++	if (intmask & SDHCI_INT_TIMEOUT)
++		host->cmd->error = -ETIMEDOUT;
++	else if (intmask & (SDHCI_INT_CRC | SDHCI_INT_END_BIT |
++			SDHCI_INT_INDEX)) {
++			host->cmd->error = -EILSEQ;
++	}
++
++	if (host->cmd->error) {
++		tasklet_schedule(&host->finish_tasklet);
++		return;
++	}
++
++	if (intmask & SDHCI_INT_RESPONSE)
++		bcm2835_mmc_finish_command(host);
++
++}
++
++static void bcm2835_mmc_data_irq(struct bcm2835_host *host, u32 intmask)
++{
++	struct dma_chan *dma_chan;
++	u32 dir_data;
++
++	BUG_ON(intmask == 0);
++
++	if (!host->data) {
++		/*
++		 * The "data complete" interrupt is also used to
++		 * indicate that a busy state has ended. See comment
++		 * above in sdhci_cmd_irq().
++		 */
++		if (host->cmd && (host->cmd->flags & MMC_RSP_BUSY)) {
++			if (intmask & SDHCI_INT_DATA_END) {
++				bcm2835_mmc_finish_command(host);
++				return;
++			}
++		}
++
++		pr_debug("%s: Got data interrupt 0x%08x even "
++			"though no data operation was in progress.\n",
++			mmc_hostname(host->mmc), (unsigned)intmask);
++		bcm2835_mmc_dumpregs(host);
++
++		return;
++	}
++
++	if (intmask & SDHCI_INT_DATA_TIMEOUT)
++		host->data->error = -ETIMEDOUT;
++	else if (intmask & SDHCI_INT_DATA_END_BIT)
++		host->data->error = -EILSEQ;
++	else if ((intmask & SDHCI_INT_DATA_CRC) &&
++		SDHCI_GET_CMD(bcm2835_mmc_readw(host, SDHCI_COMMAND))
++			!= MMC_BUS_TEST_R)
++		host->data->error = -EILSEQ;
++
++	if (host->use_dma) {
++		if  (host->data->flags & MMC_DATA_WRITE) {
++			/* IRQ handled here */
++
++			dma_chan = host->dma_chan_rxtx;
++			dir_data = DMA_TO_DEVICE;
++			dma_unmap_sg(dma_chan->device->dev,
++				 host->data->sg, host->data->sg_len,
++				 dir_data);
++
++			bcm2835_mmc_finish_data(host);
++		}
++
++	} else {
++		if (host->data->error)
++			bcm2835_mmc_finish_data(host);
++		else {
++			if (intmask & (SDHCI_INT_DATA_AVAIL | SDHCI_INT_SPACE_AVAIL))
++				bcm2835_mmc_transfer_pio(host);
++
++			if (intmask & SDHCI_INT_DATA_END) {
++				if (host->cmd) {
++					/*
++					 * Data managed to finish before the
++					 * command completed. Make sure we do
++					 * things in the proper order.
++					 */
++					host->data_early = 1;
++				} else {
++					bcm2835_mmc_finish_data(host);
++				}
++			}
++		}
++	}
++}
++
++
++static irqreturn_t bcm2835_mmc_irq(int irq, void *dev_id)
++{
++	irqreturn_t result = IRQ_NONE;
++	struct bcm2835_host *host = dev_id;
++	u32 intmask, mask, unexpected = 0;
++	int max_loops = 16;
++
++	spin_lock(&host->lock);
++
++	intmask = bcm2835_mmc_readl(host, SDHCI_INT_STATUS);
++
++	if (!intmask || intmask == 0xffffffff) {
++		result = IRQ_NONE;
++		goto out;
++	}
++
++	do {
++		/* Clear selected interrupts. */
++		mask = intmask & (SDHCI_INT_CMD_MASK | SDHCI_INT_DATA_MASK |
++				  SDHCI_INT_BUS_POWER);
++		bcm2835_mmc_writel(host, mask, SDHCI_INT_STATUS, 8);
++
++
++		if (intmask & SDHCI_INT_CMD_MASK)
++			bcm2835_mmc_cmd_irq(host, intmask & SDHCI_INT_CMD_MASK);
++
++		if (intmask & SDHCI_INT_DATA_MASK)
++			bcm2835_mmc_data_irq(host, intmask & SDHCI_INT_DATA_MASK);
++
++		if (intmask & SDHCI_INT_BUS_POWER)
++			pr_err("%s: Card is consuming too much power!\n",
++				mmc_hostname(host->mmc));
++
++		if (intmask & SDHCI_INT_CARD_INT) {
++			bcm2835_mmc_enable_sdio_irq_nolock(host, false);
++			sdio_signal_irq(host->mmc);
++		}
++
++		intmask &= ~(SDHCI_INT_CARD_INSERT | SDHCI_INT_CARD_REMOVE |
++			     SDHCI_INT_CMD_MASK | SDHCI_INT_DATA_MASK |
++			     SDHCI_INT_ERROR | SDHCI_INT_BUS_POWER |
++			     SDHCI_INT_CARD_INT);
++
++		if (intmask) {
++			unexpected |= intmask;
++			bcm2835_mmc_writel(host, intmask, SDHCI_INT_STATUS, 9);
++		}
++
++		if (result == IRQ_NONE)
++			result = IRQ_HANDLED;
++
++		intmask = bcm2835_mmc_readl(host, SDHCI_INT_STATUS);
++	} while (intmask && --max_loops);
++out:
++	spin_unlock(&host->lock);
++
++	if (unexpected) {
++		pr_err("%s: Unexpected interrupt 0x%08x.\n",
++			   mmc_hostname(host->mmc), unexpected);
++		bcm2835_mmc_dumpregs(host);
++	}
++
++	return result;
++}
++
++
++static void bcm2835_mmc_ack_sdio_irq(struct mmc_host *mmc)
++{
++	struct bcm2835_host *host = mmc_priv(mmc);
++	unsigned long flags;
++
++	spin_lock_irqsave(&host->lock, flags);
++	if (host->flags & SDHCI_SDIO_IRQ_ENABLED)
++		bcm2835_mmc_enable_sdio_irq_nolock(host, true);
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++
++static void bcm2835_mmc_set_clock(struct bcm2835_host *host, unsigned int clock)
++{
++	int div = 0; /* Initialized for compiler warning */
++	int real_div = div, clk_mul = 1;
++	u16 clk = 0;
++	unsigned long timeout;
++	unsigned int input_clock = clock;
++
++	if (host->overclock_50 && (clock == 50000000))
++		clock = host->overclock_50 * 1000000 + 999999;
++
++	host->mmc->actual_clock = 0;
++
++	bcm2835_mmc_writew(host, 0, SDHCI_CLOCK_CONTROL);
++
++	if (clock == 0)
++		return;
++
++	/* Version 3.00 divisors must be a multiple of 2. */
++	if (host->max_clk <= clock)
++		div = 1;
++	else {
++		for (div = 2; div < SDHCI_MAX_DIV_SPEC_300;
++			 div += 2) {
++			if ((host->max_clk / div) <= clock)
++				break;
++		}
++	}
++
++	real_div = div;
++	div >>= 1;
++
++	if (real_div)
++		clock = (host->max_clk * clk_mul) / real_div;
++	host->mmc->actual_clock = clock;
++
++	if ((clock > input_clock) && (clock > host->max_overclock)) {
++		pr_warn("%s: Overclocking to %dHz\n",
++			mmc_hostname(host->mmc), clock);
++		host->max_overclock = clock;
++	}
++
++	clk |= (div & SDHCI_DIV_MASK) << SDHCI_DIVIDER_SHIFT;
++	clk |= ((div & SDHCI_DIV_HI_MASK) >> SDHCI_DIV_MASK_LEN)
++		<< SDHCI_DIVIDER_HI_SHIFT;
++	clk |= SDHCI_CLOCK_INT_EN;
++	bcm2835_mmc_writew(host, clk, SDHCI_CLOCK_CONTROL);
++
++	/* Wait max 20 ms */
++	timeout = 20;
++	while (!((clk = bcm2835_mmc_readw(host, SDHCI_CLOCK_CONTROL))
++		& SDHCI_CLOCK_INT_STABLE)) {
++		if (timeout == 0) {
++			pr_err("%s: Internal clock never "
++				"stabilised.\n", mmc_hostname(host->mmc));
++			bcm2835_mmc_dumpregs(host);
++			return;
++		}
++		timeout--;
++		mdelay(1);
++	}
++
++	if (20-timeout > 10 && 20-timeout > host->max_delay) {
++		host->max_delay = 20-timeout;
++		pr_warn("Warning: MMC controller hung for %d ms\n", host->max_delay);
++	}
++
++	clk |= SDHCI_CLOCK_CARD_EN;
++	bcm2835_mmc_writew(host, clk, SDHCI_CLOCK_CONTROL);
++}
++
++static void bcm2835_mmc_request(struct mmc_host *mmc, struct mmc_request *mrq)
++{
++	struct bcm2835_host *host;
++	unsigned long flags;
++
++	host = mmc_priv(mmc);
++
++	spin_lock_irqsave(&host->lock, flags);
++
++	WARN_ON(host->mrq != NULL);
++
++	host->mrq = mrq;
++
++	if (mrq->sbc && !(host->flags & SDHCI_AUTO_CMD23))
++		bcm2835_mmc_send_command(host, mrq->sbc);
++	else
++		bcm2835_mmc_send_command(host, mrq->cmd);
++
++	spin_unlock_irqrestore(&host->lock, flags);
++
++	if (!(mrq->sbc && !(host->flags & SDHCI_AUTO_CMD23)) && mrq->cmd->data && host->use_dma) {
++		/* DMA transfer starts now, PIO starts after interrupt */
++		bcm2835_mmc_transfer_dma(host);
++	}
++}
++
++
++static void bcm2835_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
++{
++
++	struct bcm2835_host *host = mmc_priv(mmc);
++	unsigned long flags;
++	u8 ctrl;
++	u16 clk, ctrl_2;
++
++	pr_debug("bcm2835_mmc_set_ios: clock %d, pwr %d, bus_width %d, timing %d, vdd %d, drv_type %d\n",
++		 ios->clock, ios->power_mode, ios->bus_width,
++		 ios->timing, ios->signal_voltage, ios->drv_type);
++
++	spin_lock_irqsave(&host->lock, flags);
++
++	if (!ios->clock || ios->clock != host->clock) {
++		bcm2835_mmc_set_clock(host, ios->clock);
++		host->clock = ios->clock;
++	}
++
++	if (host->pwr != SDHCI_POWER_330) {
++		host->pwr = SDHCI_POWER_330;
++		bcm2835_mmc_writeb(host, SDHCI_POWER_330 | SDHCI_POWER_ON, SDHCI_POWER_CONTROL);
++	}
++
++	ctrl = bcm2835_mmc_readb(host, SDHCI_HOST_CONTROL);
++
++	/* set bus width */
++	ctrl &= ~SDHCI_CTRL_8BITBUS;
++	if (ios->bus_width == MMC_BUS_WIDTH_4)
++		ctrl |= SDHCI_CTRL_4BITBUS;
++	else
++		ctrl &= ~SDHCI_CTRL_4BITBUS;
++
++	ctrl &= ~SDHCI_CTRL_HISPD; /* NO_HISPD_BIT */
++
++
++	bcm2835_mmc_writeb(host, ctrl, SDHCI_HOST_CONTROL);
++	/*
++	 * We only need to set Driver Strength if the
++	 * preset value enable is not set.
++	 */
++	ctrl_2 = bcm2835_mmc_readw(host, SDHCI_HOST_CONTROL2);
++	ctrl_2 &= ~SDHCI_CTRL_DRV_TYPE_MASK;
++	if (ios->drv_type == MMC_SET_DRIVER_TYPE_A)
++		ctrl_2 |= SDHCI_CTRL_DRV_TYPE_A;
++	else if (ios->drv_type == MMC_SET_DRIVER_TYPE_C)
++		ctrl_2 |= SDHCI_CTRL_DRV_TYPE_C;
++
++	bcm2835_mmc_writew(host, ctrl_2, SDHCI_HOST_CONTROL2);
++
++	/* Reset SD Clock Enable */
++	clk = bcm2835_mmc_readw(host, SDHCI_CLOCK_CONTROL);
++	clk &= ~SDHCI_CLOCK_CARD_EN;
++	bcm2835_mmc_writew(host, clk, SDHCI_CLOCK_CONTROL);
++
++	/* Re-enable SD Clock */
++	bcm2835_mmc_set_clock(host, host->clock);
++	bcm2835_mmc_writeb(host, ctrl, SDHCI_HOST_CONTROL);
++
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++
++
++static struct mmc_host_ops bcm2835_ops = {
++	.request = bcm2835_mmc_request,
++	.set_ios = bcm2835_mmc_set_ios,
++	.enable_sdio_irq = bcm2835_mmc_enable_sdio_irq,
++	.ack_sdio_irq = bcm2835_mmc_ack_sdio_irq,
++};
++
++
++static void bcm2835_mmc_tasklet_finish(unsigned long param)
++{
++	struct bcm2835_host *host;
++	unsigned long flags;
++	struct mmc_request *mrq;
++
++	host = (struct bcm2835_host *)param;
++
++	spin_lock_irqsave(&host->lock, flags);
++
++	/*
++	 * If this tasklet gets rescheduled while running, it will
++	 * be run again afterwards but without any active request.
++	 */
++	if (!host->mrq) {
++		spin_unlock_irqrestore(&host->lock, flags);
++		return;
++	}
++
++	del_timer(&host->timer);
++
++	mrq = host->mrq;
++
++	/*
++	 * The controller needs a reset of internal state machines
++	 * upon error conditions.
++	 */
++	if (!(host->flags & SDHCI_DEVICE_DEAD) &&
++	    ((mrq->cmd && mrq->cmd->error) ||
++		 (mrq->data && (mrq->data->error ||
++		  (mrq->data->stop && mrq->data->stop->error))))) {
++
++		spin_unlock_irqrestore(&host->lock, flags);
++		bcm2835_mmc_reset(host, SDHCI_RESET_CMD);
++		bcm2835_mmc_reset(host, SDHCI_RESET_DATA);
++		spin_lock_irqsave(&host->lock, flags);
++	}
++
++	host->mrq = NULL;
++	host->cmd = NULL;
++	host->data = NULL;
++
++	spin_unlock_irqrestore(&host->lock, flags);
++	mmc_request_done(host->mmc, mrq);
++}
++
++
++
++static int bcm2835_mmc_add_host(struct bcm2835_host *host)
++{
++	struct mmc_host *mmc = host->mmc;
++	struct device *dev = mmc->parent;
++#ifndef FORCE_PIO
++	struct dma_slave_config cfg;
++#endif
++	int ret;
++
++	bcm2835_mmc_reset(host, SDHCI_RESET_ALL);
++
++	host->clk_mul = 0;
++
++	if (!mmc->f_max || mmc->f_max > host->max_clk)
++		mmc->f_max = host->max_clk;
++	mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_300;
++
++	/* SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK */
++	host->timeout_clk = mmc->f_max / 1000;
++	mmc->max_busy_timeout = (1 << 27) / host->timeout_clk;
++
++	/* host controller capabilities */
++	mmc->caps |= MMC_CAP_CMD23 | MMC_CAP_NEEDS_POLL |
++		MMC_CAP_SDIO_IRQ | MMC_CAP_SD_HIGHSPEED |
++		MMC_CAP_MMC_HIGHSPEED;
++
++	mmc->caps2 |= MMC_CAP2_SDIO_IRQ_NOTHREAD;
++
++	host->flags = SDHCI_AUTO_CMD23;
++
++	dev_info(dev, "mmc_debug:%x mmc_debug2:%x\n", mmc_debug, mmc_debug2);
++#ifdef FORCE_PIO
++	dev_info(dev, "Forcing PIO mode\n");
++	host->have_dma = false;
++#else
++	if (IS_ERR_OR_NULL(host->dma_chan_rxtx)) {
++		dev_err(dev, "%s: Unable to initialise DMA channel. Falling back to PIO\n",
++			DRIVER_NAME);
++		host->have_dma = false;
++	} else {
++		dev_info(dev, "DMA channel allocated");
++
++		cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
++		cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
++
++		/* Validate the slave configurations */
++
++		cfg.direction = DMA_MEM_TO_DEV;
++		cfg.src_addr = 0;
++		cfg.dst_addr = host->bus_addr + SDHCI_BUFFER;
++
++		ret = dmaengine_slave_config(host->dma_chan_rxtx, &cfg);
++
++		if (ret == 0) {
++			host->dma_cfg_tx = cfg;
++
++			cfg.direction = DMA_DEV_TO_MEM;
++			cfg.src_addr = host->bus_addr + SDHCI_BUFFER;
++			cfg.dst_addr = 0;
++
++			ret = dmaengine_slave_config(host->dma_chan_rxtx, &cfg);
++		}
++
++		if (ret == 0) {
++			host->dma_cfg_rx = cfg;
++
++			host->have_dma = true;
++		} else {
++			pr_err("%s: unable to configure DMA channel. "
++			       "Falling back to PIO\n",
++			       mmc_hostname(mmc));
++			dma_release_channel(host->dma_chan_rxtx);
++			host->dma_chan_rxtx = NULL;
++			host->have_dma = false;
++		}
++	}
++#endif
++	mmc->max_segs = 128;
++	mmc->max_req_size = min_t(size_t, 524288, dma_max_mapping_size(dev));
++	mmc->max_seg_size = mmc->max_req_size;
++	mmc->max_blk_size = 512;
++	mmc->max_blk_count =  65535;
++
++	/* report supported voltage ranges */
++	mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
++
++	tasklet_init(&host->finish_tasklet,
++		bcm2835_mmc_tasklet_finish, (unsigned long)host);
++
++	timer_setup(&host->timer, bcm2835_mmc_timeout_timer, 0);
++	init_waitqueue_head(&host->buf_ready_int);
++
++	bcm2835_mmc_init(host, 0);
++	ret = request_irq(host->irq, bcm2835_mmc_irq, IRQF_SHARED,
++				   mmc_hostname(mmc), host);
++	if (ret) {
++		dev_err(dev, "Failed to request IRQ %d: %d\n", host->irq, ret);
++		goto untasklet;
++	}
++
++	ret = mmc_add_host(mmc);
++	if (ret) {
++		dev_err(dev, "could not add MMC host\n");
++		goto free_irq;
++	}
++
++	return 0;
++
++free_irq:
++	free_irq(host->irq, host);
++untasklet:
++	tasklet_kill(&host->finish_tasklet);
++
++	return ret;
++}
++
++static int bcm2835_mmc_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct device_node *node = dev->of_node;
++	struct clk *clk;
++	struct resource *iomem;
++	struct bcm2835_host *host;
++	struct mmc_host *mmc;
++	int ret;
++
++	mmc = mmc_alloc_host(sizeof(*host), dev);
++	if (!mmc)
++		return -ENOMEM;
++
++	mmc->ops = &bcm2835_ops;
++	host = mmc_priv(mmc);
++	host->mmc = mmc;
++	host->timeout = msecs_to_jiffies(1000);
++	spin_lock_init(&host->lock);
++
++	host->ioaddr = devm_platform_get_and_ioremap_resource(pdev, 0, &iomem);
++	if (IS_ERR(host->ioaddr)) {
++		ret = PTR_ERR(host->ioaddr);
++		goto err;
++	}
++
++	host->bus_addr = iomem->start;
++
++#ifndef FORCE_PIO
++	if (node) {
++		host->dma_chan_rxtx = dma_request_slave_channel(dev, "rx-tx");
++		if (!host->dma_chan_rxtx)
++			host->dma_chan_rxtx =
++				dma_request_slave_channel(dev, "tx");
++		if (!host->dma_chan_rxtx)
++			host->dma_chan_rxtx =
++				dma_request_slave_channel(dev, "rx");
++	} else {
++		dma_cap_mask_t mask;
++
++		dma_cap_zero(mask);
++		/* we don't care about the channel, any would work */
++		dma_cap_set(DMA_SLAVE, mask);
++		host->dma_chan_rxtx = dma_request_channel(mask, NULL, NULL);
++	}
++#endif
++	clk = devm_clk_get(dev, NULL);
++	if (IS_ERR(clk)) {
++		ret = PTR_ERR(clk);
++		if (ret == -EPROBE_DEFER)
++			dev_info(dev, "could not get clk, deferring probe\n");
++		else
++			dev_err(dev, "could not get clk\n");
++		goto err;
++	}
++
++	host->max_clk = clk_get_rate(clk);
++
++	host->irq = platform_get_irq(pdev, 0);
++	if (host->irq <= 0) {
++		dev_err(dev, "get IRQ failed\n");
++		ret = -EINVAL;
++		goto err;
++	}
++
++	if (node) {
++		ret = mmc_of_parse(mmc);
++		if (ret)
++			goto err;
++
++		/* Read any custom properties */
++		of_property_read_u32(node,
++				     "brcm,overclock-50",
++				     &host->overclock_50);
++	} else {
++		mmc->caps |= MMC_CAP_4_BIT_DATA;
++	}
++
++	ret = bcm2835_mmc_add_host(host);
++	if (ret)
++		goto err;
++
++	platform_set_drvdata(pdev, host);
++
++	return 0;
++err:
++	if (host->dma_chan_rxtx)
++		dma_release_channel(host->dma_chan_rxtx);
++	mmc_free_host(mmc);
++
++	return ret;
++}
++
++static void bcm2835_mmc_remove(struct platform_device *pdev)
++{
++	struct bcm2835_host *host = platform_get_drvdata(pdev);
++	unsigned long flags;
++	int dead;
++	u32 scratch;
++
++	dead = 0;
++	scratch = bcm2835_mmc_readl(host, SDHCI_INT_STATUS);
++	if (scratch == (u32)-1)
++		dead = 1;
++
++
++	if (dead) {
++		spin_lock_irqsave(&host->lock, flags);
++
++		host->flags |= SDHCI_DEVICE_DEAD;
++
++		if (host->mrq) {
++			pr_err("%s: Controller removed during "
++				" transfer!\n", mmc_hostname(host->mmc));
++
++			host->mrq->cmd->error = -ENOMEDIUM;
++			tasklet_schedule(&host->finish_tasklet);
++		}
++
++		spin_unlock_irqrestore(&host->lock, flags);
++	}
++
++	mmc_remove_host(host->mmc);
++
++	if (!dead)
++		bcm2835_mmc_reset(host, SDHCI_RESET_ALL);
++
++	free_irq(host->irq, host);
++
++	del_timer_sync(&host->timer);
++
++	tasklet_kill(&host->finish_tasklet);
++
++	if (host->dma_chan_rxtx)
++		dma_release_channel(host->dma_chan_rxtx);
++
++	mmc_free_host(host->mmc);
++}
++
++
++static const struct of_device_id bcm2835_mmc_match[] = {
++	{ .compatible = "brcm,bcm2835-mmc" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, bcm2835_mmc_match);
++
++
++
++static struct platform_driver bcm2835_mmc_driver = {
++	.probe      = bcm2835_mmc_probe,
++	.remove     = bcm2835_mmc_remove,
++	.driver     = {
++		.name		= DRIVER_NAME,
++		.owner		= THIS_MODULE,
++		.of_match_table	= bcm2835_mmc_match,
++	},
++};
++module_platform_driver(bcm2835_mmc_driver);
++
++module_param(mmc_debug, uint, 0644);
++module_param(mmc_debug2, uint, 0644);
++MODULE_ALIAS("platform:mmc-bcm2835");
++MODULE_DESCRIPTION("BCM2835 SDHCI driver");
++MODULE_LICENSE("GPL v2");
++MODULE_AUTHOR("Gellert Weisz");
+--- a/drivers/mmc/host/sdhci-iproc.c
++++ b/drivers/mmc/host/sdhci-iproc.c
+@@ -198,6 +198,7 @@ static const struct sdhci_ops sdhci_ipro
+ 	.write_b = sdhci_iproc_writeb,
+ 	.set_clock = sdhci_set_clock,
+ 	.get_max_clock = sdhci_iproc_get_max_clock,
++	.set_power = sdhci_set_power_and_bus_voltage,
+ 	.set_bus_width = sdhci_set_bus_width,
+ 	.reset = sdhci_reset,
+ 	.set_uhs_signaling = sdhci_set_uhs_signaling,
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -40,7 +40,7 @@
+ 	pr_debug("%s: " DRIVER_NAME ": " f, mmc_hostname(host->mmc), ## x)
+ 
+ #define SDHCI_DUMP(f, x...) \
+-	pr_err("%s: " DRIVER_NAME ": " f, mmc_hostname(host->mmc), ## x)
++	pr_debug("%s: " DRIVER_NAME ": " f, mmc_hostname(host->mmc), ## x)
+ 
+ #define MAX_TUNING_LOOP 40
+ 
+@@ -3194,7 +3194,7 @@ static void sdhci_timeout_timer(struct t
+ 	spin_lock_irqsave(&host->lock, flags);
+ 
+ 	if (host->cmd && !sdhci_data_line_cmd(host->cmd)) {
+-		pr_err("%s: Timeout waiting for hardware cmd interrupt.\n",
++		pr_debug("%s: Timeout waiting for hardware cmd interrupt.\n",
+ 		       mmc_hostname(host->mmc));
+ 		sdhci_err_stats_inc(host, REQ_TIMEOUT);
+ 		sdhci_dumpregs(host);
+@@ -3217,7 +3217,7 @@ static void sdhci_timeout_data_timer(str
+ 
+ 	if (host->data || host->data_cmd ||
+ 	    (host->cmd && sdhci_data_line_cmd(host->cmd))) {
+-		pr_err("%s: Timeout waiting for hardware interrupt.\n",
++		pr_debug("%s: Timeout waiting for hardware interrupt.\n",
+ 		       mmc_hostname(host->mmc));
+ 		sdhci_err_stats_inc(host, REQ_TIMEOUT);
+ 		sdhci_dumpregs(host);
+--- a/include/linux/mmc/card.h
++++ b/include/linux/mmc/card.h
+@@ -295,6 +295,7 @@ struct mmc_card {
+ #define MMC_QUIRK_BROKEN_SD_CACHE	(1<<15)	/* Disable broken SD cache support */
+ #define MMC_QUIRK_BROKEN_CACHE_FLUSH	(1<<16)	/* Don't flush cache until the write has occurred */
+ #define MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY	(1<<17) /* Disable broken SD poweroff notify support */
++#define MMC_QUIRK_ERASE_BROKEN	(1<<31)		/* Skip erase */
+ 
+ 	bool			written_flag;	/* Indicates eMMC has been written since power on */
+ 	bool			reenable_cmdq;	/* Re-enable Command Queue */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0058-mmc-block-Don-t-do-single-sector-reads-during-recove.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0058-mmc-block-Don-t-do-single-sector-reads-during-recove.patch
new file mode 100644
index 00000000..42fe02eb
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0058-mmc-block-Don-t-do-single-sector-reads-during-recove.patch
@@ -0,0 +1,34 @@
+From 1d93086aea536ea7025cae7fa370c9c95faafe2e Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Mon, 16 May 2022 10:28:27 +0100
+Subject: [PATCH 058/697] mmc: block: Don't do single-sector reads during
+ recovery
+
+See https://github.com/raspberrypi/linux/issues/5019
+
+If an SD card has degraded performance such that IO operations time out
+then the MMC block layer will leak SG DMA mappings in the swiotlb during
+recovery. It retries the same SG and this causes the leak, as it is
+mapped twice - once in sdhci_pre_req() and again during single-block
+reads in sdhci_prepare_data().
+
+Resetting the card (including power-cycling if a regulator for vmmc is
+present) ought to be enough to recover a stuck state, so for now don't
+try single-block reads in the recovery path.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/core/block.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -2011,7 +2011,7 @@ static void mmc_blk_mq_rw_recovery(struc
+ 		return;
+ 	}
+ 
+-	if (rq_data_dir(req) == READ && brq->data.blocks >
++	if (0 && rq_data_dir(req) == READ && brq->data.blocks >
+ 			queue_physical_block_size(mq->queue) >> 9) {
+ 		/* Read one (native) sector at a time */
+ 		mmc_blk_read_single(mq, req);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0059-Adding-bcm2835-sdhost-driver-and-an-overlay-to-enabl.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0059-Adding-bcm2835-sdhost-driver-and-an-overlay-to-enabl.patch
new file mode 100644
index 00000000..e8f2ee78
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0059-Adding-bcm2835-sdhost-driver-and-an-overlay-to-enabl.patch
@@ -0,0 +1,2517 @@
+From 5ddb8eeec41a7f165f46ddcb5996bd1b2bd02459 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Wed, 25 Mar 2015 17:49:47 +0000
+Subject: [PATCH 059/697] Adding bcm2835-sdhost driver, and an overlay to
+ enable it
+
+BCM2835 has two SD card interfaces. This driver uses the other one.
+
+bcm2835-sdhost: Error handling fix, and code clarification
+
+bcm2835-sdhost: Adding overclocking option
+
+Allow a different clock speed to be substitued for a requested 50MHz.
+This option is exposed using the "overclock_50" DT parameter.
+Note that the sdhost interface is restricted to integer divisions of
+core_freq, and the highest sensible option for a core_freq of 250MHz
+is 84 (250/3 = 83.3MHz), the next being 125 (250/2) which is much too
+high.
+
+Use at your own risk.
+
+bcm2835-sdhost: Round up the overclock, so 62 works for 62.5Mhz
+
+Also only warn once for each overclock setting.
+
+bcm2835-sdhost: Improve error handling and recovery
+
+1) Expose the hw_reset method to the MMC framework, removing many
+   internal calls by the driver.
+
+2) Reduce overclock setting on error.
+
+3) Increase timeout to cope with high capacity cards.
+
+4) Add properties and parameters to control pio_limit and debug.
+
+5) Reduce messages at probe time.
+
+bcm2835-sdhost: Further improve overclock back-off
+
+bcm2835-sdhost: Clear HBLC for PIO mode
+
+Also update pio_limit default in overlay README.
+
+bcm2835-sdhost: Add the ERASE capability
+
+See: https://github.com/raspberrypi/linux/issues/1076
+
+bcm2835-sdhost: Ignore CRC7 for MMC CMD1
+
+It seems that the sdhost interface returns CRC7 errors for CMD1,
+which is the MMC-specific SEND_OP_COND. Returning these errors to
+the MMC layer causes a downward spiral, but ignoring them seems
+to be harmless.
+
+bcm2835-mmc/sdhost: Remove ARCH_BCM2835 differences
+
+The bcm2835-mmc driver (and -sdhost driver that copied from it)
+contains code to handle SDIO interrupts in a threaded interrupt
+handler rather than waking the MMC framework thread. The change
+follows a patch from Russell King that adds the facility as the
+preferred way of working.
+
+However, the new code path is only present in ARCH_BCM2835
+builds, which I have taken to be a way of testing the waters
+rather than making the change across the board; I can't see
+any technical reason why it wouldn't be enabled for MACH_BCM270X
+builds. So this patch standardises on the ARCH_BCM2835 code,
+removing the old code paths.
+
+bcm2835-sdhost: Don't log timeout errors unless debug=1
+
+The MMC card-discovery process generates timeouts. This is
+expected behaviour, so reporting it to the user serves no purpose.
+Suppress the reporting of timeout errors unless the debug flag
+is on.
+
+bcm2835-sdhost: Add workaround for odd behaviour on some cards
+
+For reasons not understood, the sdhost driver fails when reading
+sectors very near the end of some SD cards. The problem could
+be related to the similar issue that reading the final sector
+of any card as part of a multiple read never completes, and the
+workaround is an extension of the mechanism introduced to solve
+that problem which ensures those sectors are always read singly.
+
+bcm2835-sdhost: Major revision
+
+This is a significant revision of the bcm2835-sdhost driver. It
+improves on the original in a number of ways:
+
+1) Through the use of CMD23 for reads it appears to avoid problems
+   reading some sectors on certain high speed cards.
+2) Better atomicity to prevent crashes.
+3) Higher performance.
+4) Activity logging included, for easier diagnosis in the event
+   of a problem.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-sdhost: Restore ATOMIC flag to PIO sg mapping
+
+Allocation problems have been seen in a wireless driver, and
+this is the only change which might have been responsible.
+
+SQUASH: bcm2835-sdhost: Only claim one DMA channel
+
+With both MMC controllers enabled there are few DMA channels left. The
+bcm2835-sdhost driver only uses DMA in one direction at a time, so it
+doesn't need to claim two channels.
+
+See: https://github.com/raspberrypi/linux/issues/1327
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-sdhost: Workaround for "slow" sectors
+
+Some cards have been seen to cause timeouts after certain sectors are
+read. This workaround enforces a minimum delay between the stop after
+reading one of those sectors and a subsequent data command.
+
+Using CMD23 (SET_BLOCK_COUNT) avoids this problem, so good cards will
+not be penalised by this workaround.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-sdhost: Firmware manages the clock divisor
+
+The bcm2835-sdhost driver hands control of the CDIV clock divisor
+register to matching firmware, allowing it to adjust to a changing
+core clock. This removes the need to use the performance governor or
+to enable io_is_busy on the on-demand governor in order to get the
+best SD performance.
+
+N.B. As SD clocks must be an integer divisor of the core clock, it is
+possible that the SD clock for "turbo" mode can be different (even
+lower) than "normal" mode.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-sdhost: Reset the clock in task context
+
+Since reprogramming the clock can now involve a round-trip to the
+firmware it must not be done at atomic context, and a tasklet
+is not a task.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-sdhost: Don't exit cmd wait loop on error
+
+The FAIL flag can be set in the CMD register before command processing
+is complete, leading to spurious "failed to complete" errors. This has
+the effect of promoting harmless CRC7 errors during CMD1 processing
+into errors that can delay and even prevent booting.
+
+Also:
+1) Convert the last KERN_ERROR message in the register dumping to
+   KERN_INFO.
+2) Remove an unnecessary reset call from  bcm2835_sdhost_add_host.
+
+See: https://github.com/raspberrypi/linux/pull/1492
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-sdhost: mmc_card_blockaddr fix
+
+Get the definition of mmc_card_blockaddr from drivers/mmc/core/card.h.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-sdhost: New timer API
+
+mmc: bcm2835-sdhost: Support underclocking
+
+Support underclocking of the SD bus in two ways:
+1. using the max-frequency DT property (which currently has no DT
+   parameter), and
+2. using the exiting sd_overclock parameter.
+
+The two methods differ slightly - in the former the MMC subsystem is
+aware of the underclocking, while in the latter it isn't - but the
+end results should be the same.
+
+See: https://github.com/raspberrypi/linux/issues/2350
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+mmc: bcm2835-sdhost: Add include
+
+highmem.h (needed for kmap_atomic) is pulled in by one of the other
+include files, but only with some CONFIG settings. Make the inclusion
+explicit to cater for cases where the CONFIG setting is absent.
+
+See: https://github.com/raspberrypi/linux/issues/2366
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+mmc/bcm2835-sdhost: Recover from MMC_SEND_EXT_CSD
+
+If the user issues an "mmc extcsd read", the SD controller receives
+what it thinks is a SEND_IF_COND command with an unexpected data block.
+The resulting operations leave the FSM stuck in READWAIT, a state which
+persists until the MMC framework resets the controller, by which point
+the root filesystem is likely to have been unmounted.
+
+A less heavyweight solution is to detect the condition and nudge the
+FSM by asserting the (self-clearing) FORCE_DATA_MODE bit.
+
+N.B. This workaround was essentially discovered by accident and without
+a full understanding the inner workings of the controller, so it is
+fortunate that the "fix" only modifies error paths.
+
+See: https://github.com/raspberrypi/linux/issues/2728
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+mmc: bcm2835-sdhost: Fix warnings on arm64
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-sdhost: Allow for sg entries that cross pages
+
+The dma_complete handling code calculates a virtual address for a page
+then adds an offset, but if the offset is more than a page and HIGHMEM
+is in use then the summed address could be in an unmapped (or just
+incorrect) page.
+
+The upstream SDHOST driver allows for this possibility - copy the code
+that does so.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-sdhost: Fix DMA channel leak on error/remove
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+mmc: bcm2835-sdhost: Support 64-bit physical addresses
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+bcm2835-sdhost: Replace obsolete struct timeval
+
+struct timeval has been retired due to the impending linux 32-bit tv_sec
+rollover (only 18 years to go) - timespec64 is the obvious replacement.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+mmc: sdhost: Pass DT pointer to rpi_firmware_get
+
+Using the rpi_firmware API as intended allows proper reference counting
+of the firmware device and means we can remove a downstream patch to
+the firmware driver.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+bcm2835-sdhost: Use DT to configure logging
+
+Retrieve the system timer base address directly from DT.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+bcm2835-sdhost: Use phys addresses for slave DMA config
+
+Contrary to what struct snd_dmaengine_dai_dma_data suggests, the
+configuration of addresses of DMA slave interfaces should be done in
+CPU physical addresses.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+bcm2835-sdhost: Fail gracefully with bad dtb
+
+The logging timestamps depend on the existence of a bcm2835-system-timer
+node. If this node doesn't exist, leave the logging disabled rather than
+crashing.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/mmc/host/Kconfig          |   10 +
+ drivers/mmc/host/Makefile         |    1 +
+ drivers/mmc/host/bcm2835-sdhost.c | 2202 +++++++++++++++++++++++++++++
+ 3 files changed, 2213 insertions(+)
+ create mode 100644 drivers/mmc/host/bcm2835-sdhost.c
+
+--- a/drivers/mmc/host/Kconfig
++++ b/drivers/mmc/host/Kconfig
+@@ -34,6 +34,16 @@ config MMC_BCM2835_PIO_DMA_BARRIER
+ 
+ 	  If unsure, say 2 here.
+ 
++config MMC_BCM2835_SDHOST
++	tristate "Support for the SDHost controller on BCM2708/9"
++	depends on ARCH_BCM2835
++	help
++	  This selects the SDHost controller on BCM2835/6.
++
++	  If you have a controller with this interface, say Y or M here.
++
++	  If unsure, say N.
++
+ config MMC_DEBUG
+ 	bool "MMC host drivers debugging"
+ 	depends on MMC != n
+--- a/drivers/mmc/host/Makefile
++++ b/drivers/mmc/host/Makefile
+@@ -23,6 +23,7 @@ obj-$(CONFIG_MMC_SDHCI_MILBEAUT)	+= sdhc
+ obj-$(CONFIG_MMC_SDHCI_SPEAR)	+= sdhci-spear.o
+ obj-$(CONFIG_MMC_SDHCI_AM654)	+= sdhci_am654.o
+ obj-$(CONFIG_MMC_BCM2835_MMC)	+= bcm2835-mmc.o
++obj-$(CONFIG_MMC_BCM2835_SDHOST)	+= bcm2835-sdhost.o
+ obj-$(CONFIG_MMC_WBSD)		+= wbsd.o
+ obj-$(CONFIG_MMC_AU1X)		+= au1xmmc.o
+ obj-$(CONFIG_MMC_ALCOR)	+= alcor.o
+--- /dev/null
++++ b/drivers/mmc/host/bcm2835-sdhost.c
+@@ -0,0 +1,2202 @@
++/*
++ * BCM2835 SD host driver.
++ *
++ * Author:      Phil Elwell <phil@raspberrypi.org>
++ *              Copyright (C) 2015-2016 Raspberry Pi (Trading) Ltd.
++ *
++ * Based on
++ *  mmc-bcm2835.c by Gellert Weisz
++ * which is, in turn, based on
++ *  sdhci-bcm2708.c by Broadcom
++ *  sdhci-bcm2835.c by Stephen Warren and Oleksandr Tymoshenko
++ *  sdhci.c and sdhci-pci.c by Pierre Ossman
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms and conditions of the GNU General Public License,
++ * version 2, as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
++ * more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#define FIFO_READ_THRESHOLD     4
++#define FIFO_WRITE_THRESHOLD    4
++#define ALLOW_CMD23_READ        1
++#define ALLOW_CMD23_WRITE       0
++#define ENABLE_LOG              1
++#define SDDATA_FIFO_PIO_BURST   8
++#define CMD_DALLY_US            1
++
++#include <linux/delay.h>
++#include <linux/module.h>
++#include <linux/io.h>
++#include <linux/mmc/mmc.h>
++#include <linux/mmc/host.h>
++#include <linux/mmc/sd.h>
++#include <linux/mmc/sdio.h>
++#include <linux/scatterlist.h>
++#include <linux/of_address.h>
++#include <linux/of_irq.h>
++#include <linux/clk.h>
++#include <linux/platform_device.h>
++#include <linux/err.h>
++#include <linux/blkdev.h>
++#include <linux/dmaengine.h>
++#include <linux/dma-mapping.h>
++#include <linux/of_dma.h>
++#include <linux/time.h>
++#include <linux/workqueue.h>
++#include <linux/interrupt.h>
++#include <linux/highmem.h>
++#include <soc/bcm2835/raspberrypi-firmware.h>
++
++/* For mmc_card_blockaddr */
++#include "../core/card.h"
++
++#define DRIVER_NAME "sdhost-bcm2835"
++
++#define SDCMD  0x00 /* Command to SD card              - 16 R/W */
++#define SDARG  0x04 /* Argument to SD card             - 32 R/W */
++#define SDTOUT 0x08 /* Start value for timeout counter - 32 R/W */
++#define SDCDIV 0x0c /* Start value for clock divider   - 11 R/W */
++#define SDRSP0 0x10 /* SD card response (31:0)         - 32 R   */
++#define SDRSP1 0x14 /* SD card response (63:32)        - 32 R   */
++#define SDRSP2 0x18 /* SD card response (95:64)        - 32 R   */
++#define SDRSP3 0x1c /* SD card response (127:96)       - 32 R   */
++#define SDHSTS 0x20 /* SD host status                  - 11 R   */
++#define SDVDD  0x30 /* SD card power control           -  1 R/W */
++#define SDEDM  0x34 /* Emergency Debug Mode            - 13 R/W */
++#define SDHCFG 0x38 /* Host configuration              -  2 R/W */
++#define SDHBCT 0x3c /* Host byte count (debug)         - 32 R/W */
++#define SDDATA 0x40 /* Data to/from SD card            - 32 R/W */
++#define SDHBLC 0x50 /* Host block count (SDIO/SDHC)    -  9 R/W */
++
++#define SDCMD_NEW_FLAG                  0x8000
++#define SDCMD_FAIL_FLAG                 0x4000
++#define SDCMD_BUSYWAIT                  0x800
++#define SDCMD_NO_RESPONSE               0x400
++#define SDCMD_LONG_RESPONSE             0x200
++#define SDCMD_WRITE_CMD                 0x80
++#define SDCMD_READ_CMD                  0x40
++#define SDCMD_CMD_MASK                  0x3f
++
++#define SDCDIV_MAX_CDIV                 0x7ff
++
++#define SDHSTS_BUSY_IRPT                0x400
++#define SDHSTS_BLOCK_IRPT               0x200
++#define SDHSTS_SDIO_IRPT                0x100
++#define SDHSTS_REW_TIME_OUT             0x80
++#define SDHSTS_CMD_TIME_OUT             0x40
++#define SDHSTS_CRC16_ERROR              0x20
++#define SDHSTS_CRC7_ERROR               0x10
++#define SDHSTS_FIFO_ERROR               0x08
++/* Reserved */
++/* Reserved */
++#define SDHSTS_DATA_FLAG                0x01
++
++#define SDHSTS_TRANSFER_ERROR_MASK      (SDHSTS_CRC7_ERROR|SDHSTS_CRC16_ERROR|SDHSTS_REW_TIME_OUT|SDHSTS_FIFO_ERROR)
++#define SDHSTS_ERROR_MASK               (SDHSTS_CMD_TIME_OUT|SDHSTS_TRANSFER_ERROR_MASK)
++
++#define SDHCFG_BUSY_IRPT_EN     (1<<10)
++#define SDHCFG_BLOCK_IRPT_EN    (1<<8)
++#define SDHCFG_SDIO_IRPT_EN     (1<<5)
++#define SDHCFG_DATA_IRPT_EN     (1<<4)
++#define SDHCFG_SLOW_CARD        (1<<3)
++#define SDHCFG_WIDE_EXT_BUS     (1<<2)
++#define SDHCFG_WIDE_INT_BUS     (1<<1)
++#define SDHCFG_REL_CMD_LINE     (1<<0)
++
++#define SDEDM_FORCE_DATA_MODE   (1<<19)
++#define SDEDM_CLOCK_PULSE       (1<<20)
++#define SDEDM_BYPASS            (1<<21)
++
++#define SDEDM_WRITE_THRESHOLD_SHIFT 9
++#define SDEDM_READ_THRESHOLD_SHIFT 14
++#define SDEDM_THRESHOLD_MASK     0x1f
++
++#define SDEDM_FSM_MASK           0xf
++#define SDEDM_FSM_IDENTMODE      0x0
++#define SDEDM_FSM_DATAMODE       0x1
++#define SDEDM_FSM_READDATA       0x2
++#define SDEDM_FSM_WRITEDATA      0x3
++#define SDEDM_FSM_READWAIT       0x4
++#define SDEDM_FSM_READCRC        0x5
++#define SDEDM_FSM_WRITECRC       0x6
++#define SDEDM_FSM_WRITEWAIT1     0x7
++#define SDEDM_FSM_POWERDOWN      0x8
++#define SDEDM_FSM_POWERUP        0x9
++#define SDEDM_FSM_WRITESTART1    0xa
++#define SDEDM_FSM_WRITESTART2    0xb
++#define SDEDM_FSM_GENPULSES      0xc
++#define SDEDM_FSM_WRITEWAIT2     0xd
++#define SDEDM_FSM_STARTPOWDOWN   0xf
++
++#define SDDATA_FIFO_WORDS        16
++
++#define USE_CMD23_FLAGS          ((ALLOW_CMD23_READ * MMC_DATA_READ) | \
++				  (ALLOW_CMD23_WRITE * MMC_DATA_WRITE))
++
++#define MHZ 1000000
++
++
++struct bcm2835_host {
++	spinlock_t		lock;
++
++	struct rpi_firmware	*fw;
++
++	void __iomem		*ioaddr;
++	phys_addr_t		bus_addr;
++
++	struct mmc_host		*mmc;
++
++	u32			pio_timeout;	/* In jiffies */
++
++	int			clock;		/* Current clock speed */
++
++	bool			slow_card;	/* Force 11-bit divisor */
++
++	unsigned int		max_clk;	/* Max possible freq */
++
++	struct tasklet_struct	finish_tasklet;	/* Tasklet structures */
++
++	struct work_struct	cmd_wait_wq;	/* Workqueue function */
++
++	struct timer_list	timer;		/* Timer for timeouts */
++
++	struct sg_mapping_iter	sg_miter;	/* SG state for PIO */
++	unsigned int		blocks;		/* remaining PIO blocks */
++
++	int			irq;		/* Device IRQ */
++
++	u32			cmd_quick_poll_retries;
++	u32			ns_per_fifo_word;
++
++	/* cached registers */
++	u32			hcfg;
++	u32			cdiv;
++
++	struct mmc_request		*mrq;			/* Current request */
++	struct mmc_command		*cmd;			/* Current command */
++	struct mmc_data			*data;			/* Current data request */
++	unsigned int			data_complete:1;	/* Data finished before cmd */
++
++	unsigned int			flush_fifo:1;		/* Drain the fifo when finishing */
++
++	unsigned int			use_busy:1;		/* Wait for busy interrupt */
++
++	unsigned int			use_sbc:1;		/* Send CMD23 */
++
++	unsigned int			debug:1;		/* Enable debug output */
++	unsigned int			firmware_sets_cdiv:1;	/* Let the firmware manage the clock */
++	unsigned int			reset_clock:1;		/* Reset the clock fore the next request */
++
++	/*DMA part*/
++	struct dma_chan			*dma_chan_rxtx;		/* DMA channel for reads and writes */
++	struct dma_chan			*dma_chan;		/* Channel in use */
++	struct dma_slave_config		dma_cfg_rx;
++	struct dma_slave_config		dma_cfg_tx;
++	struct dma_async_tx_descriptor	*dma_desc;
++	u32				dma_dir;
++	u32				drain_words;
++	struct page 			*drain_page;
++	u32				drain_offset;
++
++	bool				allow_dma;
++	bool				use_dma;
++	/*end of DMA part*/
++
++	int				max_delay;	/* maximum length of time spent waiting */
++	struct timespec64		stop_time;	/* when the last stop was issued */
++	u32				delay_after_stop; /* minimum time between stop and subsequent data transfer */
++	u32				delay_after_this_stop; /* minimum time between this stop and subsequent data transfer */
++	u32				user_overclock_50; /* User's preferred frequency to use when 50MHz is requested (in MHz) */
++	u32				overclock_50;	/* frequency to use when 50MHz is requested (in MHz) */
++	u32				overclock;	/* Current frequency if overclocked, else zero */
++	u32				pio_limit;	/* Maximum block count for PIO (0 = always DMA) */
++
++	u32				sectors;	/* Cached card size in sectors */
++};
++
++#if ENABLE_LOG
++
++struct log_entry_struct {
++	char event[4];
++	u32 timestamp;
++	u32 param1;
++	u32 param2;
++};
++
++typedef struct log_entry_struct LOG_ENTRY_T;
++
++LOG_ENTRY_T *sdhost_log_buf;
++dma_addr_t sdhost_log_addr;
++static u32 sdhost_log_idx;
++static spinlock_t log_lock;
++static void __iomem *timer_base;
++
++#define LOG_ENTRIES (256*1)
++#define LOG_SIZE (sizeof(LOG_ENTRY_T)*LOG_ENTRIES)
++
++static void log_init(struct device *dev)
++{
++	struct device_node *np;
++
++	spin_lock_init(&log_lock);
++
++	np = of_find_compatible_node(NULL, NULL,
++				     "brcm,bcm2835-system-timer");
++	timer_base = of_iomap(np, 0);
++
++	if (timer_base) {
++		sdhost_log_buf = dma_alloc_coherent(dev, LOG_SIZE, &sdhost_log_addr,
++							GFP_KERNEL);
++		if (sdhost_log_buf)
++			pr_info("sdhost: log_buf @ %p (%llx)\n",
++				sdhost_log_buf, (u64)sdhost_log_addr);
++		else
++			pr_err("sdhost: failed to allocate log buf\n");
++	} else {
++		pr_err("sdhost: failed to remap timer - wrong dtb?\n");
++	}
++}
++
++static void log_event_impl(const char *event, u32 param1, u32 param2)
++{
++	if (sdhost_log_buf) {
++		LOG_ENTRY_T *entry;
++		unsigned long flags;
++
++		spin_lock_irqsave(&log_lock, flags);
++
++		entry = sdhost_log_buf + sdhost_log_idx;
++		memcpy(entry->event, event, 4);
++		entry->timestamp = (readl(timer_base + 4) & 0x3fffffff) +
++			(smp_processor_id()<<30);
++		entry->param1 = param1;
++		entry->param2 = param2;
++		sdhost_log_idx = (sdhost_log_idx + 1) % LOG_ENTRIES;
++
++		spin_unlock_irqrestore(&log_lock, flags);
++	}
++}
++
++static void log_dump(void)
++{
++	if (sdhost_log_buf) {
++		LOG_ENTRY_T *entry;
++		unsigned long flags;
++		int idx;
++
++		spin_lock_irqsave(&log_lock, flags);
++
++		idx = sdhost_log_idx;
++		do {
++			entry = sdhost_log_buf + idx;
++			if (entry->event[0] != '\0')
++				pr_info("[%08x] %.4s %x %x\n",
++				       entry->timestamp,
++				       entry->event,
++				       entry->param1,
++				       entry->param2);
++			idx = (idx + 1) % LOG_ENTRIES;
++		} while (idx != sdhost_log_idx);
++
++		spin_unlock_irqrestore(&log_lock, flags);
++	}
++}
++
++#define log_event(event, param1, param2) log_event_impl(event, (u32)(uintptr_t)param1, (u32)(uintptr_t)param2)
++
++#else
++
++#define log_init(x) (void)0
++#define log_event(event, param1, param2) (void)0
++#define log_dump() (void)0
++
++#endif
++
++static inline void bcm2835_sdhost_write(struct bcm2835_host *host, u32 val, int reg)
++{
++	writel(val, host->ioaddr + reg);
++}
++
++static inline u32 bcm2835_sdhost_read(struct bcm2835_host *host, int reg)
++{
++	return readl(host->ioaddr + reg);
++}
++
++static inline u32 bcm2835_sdhost_read_relaxed(struct bcm2835_host *host, int reg)
++{
++	return readl_relaxed(host->ioaddr + reg);
++}
++
++static void bcm2835_sdhost_dumpcmd(struct bcm2835_host *host,
++				   struct mmc_command *cmd,
++				   const char *label)
++{
++	if (cmd)
++		pr_info("%s:%c%s op %d arg 0x%x flags 0x%x - resp %08x %08x %08x %08x, err %d\n",
++			mmc_hostname(host->mmc),
++			(cmd == host->cmd) ? '>' : ' ',
++			label, cmd->opcode, cmd->arg, cmd->flags,
++			cmd->resp[0], cmd->resp[1], cmd->resp[2], cmd->resp[3],
++			cmd->error);
++}
++
++static void bcm2835_sdhost_dumpregs(struct bcm2835_host *host)
++{
++	if (host->mrq)
++	{
++		bcm2835_sdhost_dumpcmd(host, host->mrq->sbc, "sbc");
++		bcm2835_sdhost_dumpcmd(host, host->mrq->cmd, "cmd");
++		if (host->mrq->data)
++			pr_info("%s: data blocks %x blksz %x - err %d\n",
++			       mmc_hostname(host->mmc),
++			       host->mrq->data->blocks,
++			       host->mrq->data->blksz,
++			       host->mrq->data->error);
++		bcm2835_sdhost_dumpcmd(host, host->mrq->stop, "stop");
++	}
++
++	pr_info("%s: =========== REGISTER DUMP ===========\n",
++		mmc_hostname(host->mmc));
++
++	pr_info("%s: SDCMD  0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDCMD));
++	pr_info("%s: SDARG  0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDARG));
++	pr_info("%s: SDTOUT 0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDTOUT));
++	pr_info("%s: SDCDIV 0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDCDIV));
++	pr_info("%s: SDRSP0 0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDRSP0));
++	pr_info("%s: SDRSP1 0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDRSP1));
++	pr_info("%s: SDRSP2 0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDRSP2));
++	pr_info("%s: SDRSP3 0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDRSP3));
++	pr_info("%s: SDHSTS 0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDHSTS));
++	pr_info("%s: SDVDD  0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDVDD));
++	pr_info("%s: SDEDM  0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDEDM));
++	pr_info("%s: SDHCFG 0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDHCFG));
++	pr_info("%s: SDHBCT 0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDHBCT));
++	pr_info("%s: SDHBLC 0x%08x\n",
++		mmc_hostname(host->mmc),
++		bcm2835_sdhost_read(host, SDHBLC));
++
++	pr_info("%s: ===========================================\n",
++		mmc_hostname(host->mmc));
++}
++
++static void bcm2835_sdhost_set_power(struct bcm2835_host *host, bool on)
++{
++	bcm2835_sdhost_write(host, on ? 1 : 0, SDVDD);
++}
++
++static void bcm2835_sdhost_reset_internal(struct bcm2835_host *host)
++{
++	u32 temp;
++
++	if (host->debug)
++		pr_info("%s: reset\n", mmc_hostname(host->mmc));
++
++	bcm2835_sdhost_set_power(host, false);
++
++	bcm2835_sdhost_write(host, 0, SDCMD);
++	bcm2835_sdhost_write(host, 0, SDARG);
++	bcm2835_sdhost_write(host, 0xf00000, SDTOUT);
++	bcm2835_sdhost_write(host, 0, SDCDIV);
++	bcm2835_sdhost_write(host, 0x7f8, SDHSTS); /* Write 1s to clear */
++	bcm2835_sdhost_write(host, 0, SDHCFG);
++	bcm2835_sdhost_write(host, 0, SDHBCT);
++	bcm2835_sdhost_write(host, 0, SDHBLC);
++
++	/* Limit fifo usage due to silicon bug */
++	temp = bcm2835_sdhost_read(host, SDEDM);
++	temp &= ~((SDEDM_THRESHOLD_MASK<<SDEDM_READ_THRESHOLD_SHIFT) |
++		  (SDEDM_THRESHOLD_MASK<<SDEDM_WRITE_THRESHOLD_SHIFT));
++	temp |= (FIFO_READ_THRESHOLD << SDEDM_READ_THRESHOLD_SHIFT) |
++		(FIFO_WRITE_THRESHOLD << SDEDM_WRITE_THRESHOLD_SHIFT);
++	bcm2835_sdhost_write(host, temp, SDEDM);
++	mdelay(10);
++	bcm2835_sdhost_set_power(host, true);
++	mdelay(10);
++	host->clock = 0;
++	host->sectors = 0;
++	bcm2835_sdhost_write(host, host->hcfg, SDHCFG);
++	bcm2835_sdhost_write(host, SDCDIV_MAX_CDIV, SDCDIV);
++}
++
++#if 0 // todo fix
++static void bcm2835_sdhost_reset(struct mmc_host *mmc)
++{
++	struct bcm2835_host *host = mmc_priv(mmc);
++	unsigned long flags;
++	spin_lock_irqsave(&host->lock, flags);
++	log_event("RST<", 0, 0);
++
++	bcm2835_sdhost_reset_internal(host);
++
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++#endif
++
++static void bcm2835_sdhost_set_ios(struct mmc_host *mmc, struct mmc_ios *ios);
++
++static void bcm2835_sdhost_init(struct bcm2835_host *host, int soft)
++{
++	pr_debug("bcm2835_sdhost_init(%d)\n", soft);
++
++	/* Set interrupt enables */
++	host->hcfg = SDHCFG_BUSY_IRPT_EN;
++
++	bcm2835_sdhost_reset_internal(host);
++
++	if (soft) {
++		/* force clock reconfiguration */
++		host->clock = 0;
++		bcm2835_sdhost_set_ios(host->mmc, &host->mmc->ios);
++	}
++}
++
++static void bcm2835_sdhost_wait_transfer_complete(struct bcm2835_host *host)
++{
++	int timediff;
++	u32 alternate_idle;
++	u32 edm;
++
++	alternate_idle = (host->mrq->data->flags & MMC_DATA_READ) ?
++		SDEDM_FSM_READWAIT : SDEDM_FSM_WRITESTART1;
++
++	edm = bcm2835_sdhost_read(host, SDEDM);
++
++	log_event("WTC<", edm, 0);
++
++	timediff = 0;
++
++	while (1) {
++		u32 fsm = edm & SDEDM_FSM_MASK;
++		if ((fsm == SDEDM_FSM_IDENTMODE) ||
++		    (fsm == SDEDM_FSM_DATAMODE))
++			break;
++		if (fsm == alternate_idle) {
++			bcm2835_sdhost_write(host,
++					     edm | SDEDM_FORCE_DATA_MODE,
++					     SDEDM);
++			break;
++		}
++
++		timediff++;
++		if (timediff == 100000) {
++			pr_err("%s: wait_transfer_complete - still waiting after %d retries\n",
++			       mmc_hostname(host->mmc),
++			       timediff);
++			log_dump();
++			bcm2835_sdhost_dumpregs(host);
++			host->mrq->data->error = -ETIMEDOUT;
++			log_event("WTC!", edm, 0);
++			return;
++		}
++		cpu_relax();
++		edm = bcm2835_sdhost_read(host, SDEDM);
++	}
++	log_event("WTC>", edm, 0);
++}
++
++static void bcm2835_sdhost_finish_data(struct bcm2835_host *host);
++
++static void bcm2835_sdhost_dma_complete(void *param)
++{
++	struct bcm2835_host *host = param;
++	struct mmc_data *data = host->data;
++	unsigned long flags;
++
++	spin_lock_irqsave(&host->lock, flags);
++	log_event("DMA<", host->data, bcm2835_sdhost_read(host, SDHSTS));
++	log_event("DMA ", bcm2835_sdhost_read(host, SDCMD),
++		  bcm2835_sdhost_read(host, SDEDM));
++
++	if (host->dma_chan) {
++		dma_unmap_sg(host->dma_chan->device->dev,
++			     data->sg, data->sg_len,
++			     host->dma_dir);
++
++		host->dma_chan = NULL;
++	}
++
++	if (host->drain_words) {
++		void *page;
++		u32 *buf;
++
++		if (host->drain_offset & PAGE_MASK) {
++			host->drain_page += host->drain_offset >> PAGE_SHIFT;
++			host->drain_offset &= ~PAGE_MASK;
++		}
++
++		page = kmap_atomic(host->drain_page);
++		buf = page + host->drain_offset;
++
++		while (host->drain_words) {
++			u32 edm = bcm2835_sdhost_read(host, SDEDM);
++			if ((edm >> 4) & 0x1f)
++				*(buf++) = bcm2835_sdhost_read(host,
++							       SDDATA);
++			host->drain_words--;
++		}
++
++		kunmap_atomic(page);
++	}
++
++	bcm2835_sdhost_finish_data(host);
++
++	log_event("DMA>", host->data, 0);
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++
++static void bcm2835_sdhost_read_block_pio(struct bcm2835_host *host)
++{
++	unsigned long flags;
++	size_t blksize, len;
++	u32 *buf;
++	unsigned long wait_max;
++
++	blksize = host->data->blksz;
++
++	wait_max = jiffies + msecs_to_jiffies(host->pio_timeout);
++
++	local_irq_save(flags);
++
++	while (blksize) {
++		int copy_words;
++		u32 hsts = 0;
++
++		if (!sg_miter_next(&host->sg_miter)) {
++			host->data->error = -EINVAL;
++			break;
++		}
++
++		len = min(host->sg_miter.length, blksize);
++		if (len % 4) {
++			host->data->error = -EINVAL;
++			break;
++		}
++
++		blksize -= len;
++		host->sg_miter.consumed = len;
++
++		buf = (u32 *)host->sg_miter.addr;
++
++		copy_words = len/4;
++
++		while (copy_words) {
++			int burst_words, words;
++			u32 edm;
++
++			burst_words = SDDATA_FIFO_PIO_BURST;
++			if (burst_words > copy_words)
++				burst_words = copy_words;
++			edm = bcm2835_sdhost_read(host, SDEDM);
++			words = ((edm >> 4) & 0x1f);
++
++			if (words < burst_words) {
++				int fsm_state = (edm & SDEDM_FSM_MASK);
++				if ((fsm_state != SDEDM_FSM_READDATA) &&
++				    (fsm_state != SDEDM_FSM_READWAIT) &&
++				    (fsm_state != SDEDM_FSM_READCRC)) {
++					hsts = bcm2835_sdhost_read(host,
++								   SDHSTS);
++					pr_info("%s: fsm %x, hsts %x\n",
++					       mmc_hostname(host->mmc),
++					       fsm_state, hsts);
++					if (hsts & SDHSTS_ERROR_MASK)
++						break;
++				}
++
++				if (time_after(jiffies, wait_max)) {
++					pr_err("%s: PIO read timeout - EDM %x\n",
++					       mmc_hostname(host->mmc),
++					       edm);
++					hsts = SDHSTS_REW_TIME_OUT;
++					break;
++				}
++				ndelay((burst_words - words) *
++				       host->ns_per_fifo_word);
++				continue;
++			} else if (words > copy_words) {
++				words = copy_words;
++			}
++
++			copy_words -= words;
++
++			while (words) {
++				*(buf++) = bcm2835_sdhost_read(host, SDDATA);
++				words--;
++			}
++		}
++
++		if (hsts & SDHSTS_ERROR_MASK)
++			break;
++	}
++
++	sg_miter_stop(&host->sg_miter);
++
++	local_irq_restore(flags);
++}
++
++static void bcm2835_sdhost_write_block_pio(struct bcm2835_host *host)
++{
++	unsigned long flags;
++	size_t blksize, len;
++	u32 *buf;
++	unsigned long wait_max;
++
++	blksize = host->data->blksz;
++
++	wait_max = jiffies + msecs_to_jiffies(host->pio_timeout);
++
++	local_irq_save(flags);
++
++	while (blksize) {
++		int copy_words;
++		u32 hsts = 0;
++
++		if (!sg_miter_next(&host->sg_miter)) {
++			host->data->error = -EINVAL;
++			break;
++		}
++
++		len = min(host->sg_miter.length, blksize);
++		if (len % 4) {
++			host->data->error = -EINVAL;
++			break;
++		}
++
++		blksize -= len;
++		host->sg_miter.consumed = len;
++
++		buf = (u32 *)host->sg_miter.addr;
++
++		copy_words = len/4;
++
++		while (copy_words) {
++			int burst_words, words;
++			u32 edm;
++
++			burst_words = SDDATA_FIFO_PIO_BURST;
++			if (burst_words > copy_words)
++				burst_words = copy_words;
++			edm = bcm2835_sdhost_read(host, SDEDM);
++			words = SDDATA_FIFO_WORDS - ((edm >> 4) & 0x1f);
++
++			if (words < burst_words) {
++				int fsm_state = (edm & SDEDM_FSM_MASK);
++				if ((fsm_state != SDEDM_FSM_WRITEDATA) &&
++				    (fsm_state != SDEDM_FSM_WRITESTART1) &&
++				    (fsm_state != SDEDM_FSM_WRITESTART2)) {
++					hsts = bcm2835_sdhost_read(host,
++								   SDHSTS);
++					pr_info("%s: fsm %x, hsts %x\n",
++					       mmc_hostname(host->mmc),
++					       fsm_state, hsts);
++					if (hsts & SDHSTS_ERROR_MASK)
++						break;
++				}
++
++				if (time_after(jiffies, wait_max)) {
++					pr_err("%s: PIO write timeout - EDM %x\n",
++					       mmc_hostname(host->mmc),
++					       edm);
++					hsts = SDHSTS_REW_TIME_OUT;
++					break;
++				}
++				ndelay((burst_words - words) *
++				       host->ns_per_fifo_word);
++				continue;
++			} else if (words > copy_words) {
++				words = copy_words;
++			}
++
++			copy_words -= words;
++
++			while (words) {
++				bcm2835_sdhost_write(host, *(buf++), SDDATA);
++				words--;
++			}
++		}
++
++		if (hsts & SDHSTS_ERROR_MASK)
++			break;
++	}
++
++	sg_miter_stop(&host->sg_miter);
++
++	local_irq_restore(flags);
++}
++
++static void bcm2835_sdhost_transfer_pio(struct bcm2835_host *host)
++{
++	u32 sdhsts;
++	bool is_read;
++	BUG_ON(!host->data);
++	log_event("XFP<", host->data, host->blocks);
++
++	is_read = (host->data->flags & MMC_DATA_READ) != 0;
++	if (is_read)
++		bcm2835_sdhost_read_block_pio(host);
++	else
++		bcm2835_sdhost_write_block_pio(host);
++
++	sdhsts = bcm2835_sdhost_read(host, SDHSTS);
++	if (sdhsts & (SDHSTS_CRC16_ERROR |
++		      SDHSTS_CRC7_ERROR |
++		      SDHSTS_FIFO_ERROR)) {
++		pr_err("%s: %s transfer error - HSTS %x\n",
++		       mmc_hostname(host->mmc),
++		       is_read ? "read" : "write",
++		       sdhsts);
++		host->data->error = -EILSEQ;
++	} else if ((sdhsts & (SDHSTS_CMD_TIME_OUT |
++			      SDHSTS_REW_TIME_OUT))) {
++		pr_err("%s: %s timeout error - HSTS %x\n",
++		       mmc_hostname(host->mmc),
++		       is_read ? "read" : "write",
++		       sdhsts);
++		host->data->error = -ETIMEDOUT;
++	}
++	log_event("XFP>", host->data, host->blocks);
++}
++
++static void bcm2835_sdhost_prepare_dma(struct bcm2835_host *host,
++	struct mmc_data *data)
++{
++	int len, dir_data, dir_slave;
++	struct dma_async_tx_descriptor *desc = NULL;
++	struct dma_chan *dma_chan;
++
++	log_event("PRD<", data, 0);
++	pr_debug("bcm2835_sdhost_prepare_dma()\n");
++
++	dma_chan = host->dma_chan_rxtx;
++	if (data->flags & MMC_DATA_READ) {
++		dir_data = DMA_FROM_DEVICE;
++		dir_slave = DMA_DEV_TO_MEM;
++	} else {
++		dir_data = DMA_TO_DEVICE;
++		dir_slave = DMA_MEM_TO_DEV;
++	}
++	log_event("PRD1", dma_chan, 0);
++
++	BUG_ON(!dma_chan->device);
++	BUG_ON(!dma_chan->device->dev);
++	BUG_ON(!data->sg);
++
++	/* The block doesn't manage the FIFO DREQs properly for multi-block
++	   transfers, so don't attempt to DMA the final few words.
++	   Unfortunately this requires the final sg entry to be trimmed.
++	   N.B. This code demands that the overspill is contained in
++	   a single sg entry.
++	*/
++
++	host->drain_words = 0;
++	if ((data->blocks > 1) && (dir_data == DMA_FROM_DEVICE)) {
++		struct scatterlist *sg;
++		u32 len;
++		int i;
++
++		len = min((u32)(FIFO_READ_THRESHOLD - 1) * 4,
++			  (u32)data->blocks * data->blksz);
++
++		for_each_sg(data->sg, sg, data->sg_len, i) {
++			if (sg_is_last(sg)) {
++				BUG_ON(sg->length < len);
++				sg->length -= len;
++				host->drain_page = sg_page(sg);
++				host->drain_offset = sg->offset + sg->length;
++			}
++		}
++		host->drain_words = len/4;
++	}
++
++	/* The parameters have already been validated, so this will not fail */
++	(void)dmaengine_slave_config(dma_chan,
++				     (dir_data == DMA_FROM_DEVICE) ?
++				     &host->dma_cfg_rx :
++				     &host->dma_cfg_tx);
++
++	len = dma_map_sg(dma_chan->device->dev, data->sg, data->sg_len,
++			 dir_data);
++
++	log_event("PRD2", len, 0);
++	if (len > 0)
++		desc = dmaengine_prep_slave_sg(dma_chan, data->sg,
++					       len, dir_slave,
++					       DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
++	log_event("PRD3", desc, 0);
++
++	if (desc) {
++		desc->callback = bcm2835_sdhost_dma_complete;
++		desc->callback_param = host;
++		host->dma_desc = desc;
++		host->dma_chan = dma_chan;
++		host->dma_dir = dir_data;
++	}
++	log_event("PDM>", data, 0);
++}
++
++static void bcm2835_sdhost_start_dma(struct bcm2835_host *host)
++{
++	log_event("SDMA", host->data, host->dma_chan);
++	dmaengine_submit(host->dma_desc);
++	dma_async_issue_pending(host->dma_chan);
++}
++
++static void bcm2835_sdhost_set_transfer_irqs(struct bcm2835_host *host)
++{
++	u32 all_irqs = SDHCFG_DATA_IRPT_EN | SDHCFG_BLOCK_IRPT_EN |
++		SDHCFG_BUSY_IRPT_EN;
++	if (host->dma_desc)
++		host->hcfg = (host->hcfg & ~all_irqs) |
++			SDHCFG_BUSY_IRPT_EN;
++	else
++		host->hcfg = (host->hcfg & ~all_irqs) |
++			SDHCFG_DATA_IRPT_EN |
++			SDHCFG_BUSY_IRPT_EN;
++
++	bcm2835_sdhost_write(host, host->hcfg, SDHCFG);
++}
++
++static void bcm2835_sdhost_prepare_data(struct bcm2835_host *host, struct mmc_command *cmd)
++{
++	struct mmc_data *data = cmd->data;
++
++	WARN_ON(host->data);
++
++	host->data = data;
++	if (!data)
++		return;
++
++	/* Sanity checks */
++	BUG_ON(data->blksz * data->blocks > 524288);
++	BUG_ON(data->blksz > host->mmc->max_blk_size);
++	BUG_ON(data->blocks > 65535);
++
++	host->data_complete = 0;
++	host->flush_fifo = 0;
++	host->data->bytes_xfered = 0;
++
++	if (!host->sectors && host->mmc->card) {
++		struct mmc_card *card = host->mmc->card;
++		if (!mmc_card_sd(card) && mmc_card_blockaddr(card)) {
++			/*
++			 * The EXT_CSD sector count is in number of 512 byte
++			 * sectors.
++			 */
++			host->sectors = card->ext_csd.sectors;
++		} else {
++			/*
++			 * The CSD capacity field is in units of read_blkbits.
++			 * set_capacity takes units of 512 bytes.
++			 */
++			host->sectors = card->csd.capacity <<
++				(card->csd.read_blkbits - 9);
++		}
++	}
++
++	if (!host->dma_desc) {
++		/* Use PIO */
++		int flags = SG_MITER_ATOMIC;
++
++		if (data->flags & MMC_DATA_READ)
++			flags |= SG_MITER_TO_SG;
++		else
++			flags |= SG_MITER_FROM_SG;
++		sg_miter_start(&host->sg_miter, data->sg, data->sg_len, flags);
++		host->blocks = data->blocks;
++	}
++
++	bcm2835_sdhost_set_transfer_irqs(host);
++
++	bcm2835_sdhost_write(host, data->blksz, SDHBCT);
++	bcm2835_sdhost_write(host, data->blocks, SDHBLC);
++
++	BUG_ON(!host->data);
++}
++
++static bool bcm2835_sdhost_send_command(struct bcm2835_host *host,
++				 struct mmc_command *cmd)
++{
++	u32 sdcmd, sdhsts;
++	unsigned long timeout;
++	int delay;
++
++	WARN_ON(host->cmd);
++	log_event("CMD<", cmd->opcode, cmd->arg);
++
++	if (cmd->data)
++		pr_debug("%s: send_command %d 0x%x "
++			 "(flags 0x%x) - %s %d*%d\n",
++			 mmc_hostname(host->mmc),
++			 cmd->opcode, cmd->arg, cmd->flags,
++			 (cmd->data->flags & MMC_DATA_READ) ?
++			 "read" : "write", cmd->data->blocks,
++			 cmd->data->blksz);
++	else
++		pr_debug("%s: send_command %d 0x%x (flags 0x%x)\n",
++			 mmc_hostname(host->mmc),
++			 cmd->opcode, cmd->arg, cmd->flags);
++
++	/* Wait max 100 ms */
++	timeout = 10000;
++
++	while (bcm2835_sdhost_read(host, SDCMD) & SDCMD_NEW_FLAG) {
++		if (timeout == 0) {
++			pr_warn("%s: previous command never completed.\n",
++				mmc_hostname(host->mmc));
++			if (host->debug)
++				bcm2835_sdhost_dumpregs(host);
++			cmd->error = -EILSEQ;
++			tasklet_schedule(&host->finish_tasklet);
++			return false;
++		}
++		timeout--;
++		udelay(10);
++	}
++
++	delay = (10000 - timeout)/100;
++	if (delay > host->max_delay) {
++		host->max_delay = delay;
++		pr_warn("%s: controller hung for %d ms\n",
++			   mmc_hostname(host->mmc),
++			   host->max_delay);
++	}
++
++	timeout = jiffies;
++	if (!cmd->data && cmd->busy_timeout > 9000)
++		timeout += DIV_ROUND_UP(cmd->busy_timeout, 1000) * HZ + HZ;
++	else
++		timeout += 10 * HZ;
++	mod_timer(&host->timer, timeout);
++
++	host->cmd = cmd;
++
++	/* Clear any error flags */
++	sdhsts = bcm2835_sdhost_read(host, SDHSTS);
++	if (sdhsts & SDHSTS_ERROR_MASK)
++		bcm2835_sdhost_write(host, sdhsts, SDHSTS);
++
++	if ((cmd->flags & MMC_RSP_136) && (cmd->flags & MMC_RSP_BUSY)) {
++		pr_err("%s: unsupported response type!\n",
++			mmc_hostname(host->mmc));
++		cmd->error = -EINVAL;
++		tasklet_schedule(&host->finish_tasklet);
++		return false;
++	}
++
++	bcm2835_sdhost_prepare_data(host, cmd);
++
++	bcm2835_sdhost_write(host, cmd->arg, SDARG);
++
++	sdcmd = cmd->opcode & SDCMD_CMD_MASK;
++
++	host->use_busy = 0;
++	if (!(cmd->flags & MMC_RSP_PRESENT)) {
++		sdcmd |= SDCMD_NO_RESPONSE;
++	} else {
++		if (cmd->flags & MMC_RSP_136)
++			sdcmd |= SDCMD_LONG_RESPONSE;
++		if (cmd->flags & MMC_RSP_BUSY) {
++			sdcmd |= SDCMD_BUSYWAIT;
++			host->use_busy = 1;
++		}
++	}
++
++	if (cmd->data) {
++		log_event("CMDD", cmd->data->blocks, cmd->data->blksz);
++		if (host->delay_after_this_stop) {
++			struct timespec64 now;
++			int time_since_stop;
++
++			ktime_get_real_ts64(&now);
++			time_since_stop = now.tv_sec - host->stop_time.tv_sec;
++			if (time_since_stop < 2) {
++				/* Possibly less than one second */
++				time_since_stop = time_since_stop * 1000000 +
++					(now.tv_nsec - host->stop_time.tv_nsec)/1000;
++				if (time_since_stop <
++				    host->delay_after_this_stop)
++					udelay(host->delay_after_this_stop -
++					       time_since_stop);
++			}
++		}
++
++		host->delay_after_this_stop = host->delay_after_stop;
++		if ((cmd->data->flags & MMC_DATA_READ) && !host->use_sbc) {
++			/* See if read crosses one of the hazardous sectors */
++			u32 first_blk, last_blk;
++
++			/* Intentionally include the following sector because
++			   without CMD23/SBC the read may run on. */
++			first_blk = host->mrq->cmd->arg;
++			last_blk = first_blk + cmd->data->blocks;
++
++			if (((last_blk >= (host->sectors - 64)) &&
++			     (first_blk <= (host->sectors - 64))) ||
++			    ((last_blk >= (host->sectors - 32)) &&
++			     (first_blk <= (host->sectors - 32)))) {
++				host->delay_after_this_stop =
++					max(250u, host->delay_after_stop);
++			}
++		}
++
++		if (cmd->data->flags & MMC_DATA_WRITE)
++			sdcmd |= SDCMD_WRITE_CMD;
++		if (cmd->data->flags & MMC_DATA_READ)
++			sdcmd |= SDCMD_READ_CMD;
++	}
++
++	bcm2835_sdhost_write(host, sdcmd | SDCMD_NEW_FLAG, SDCMD);
++
++	return true;
++}
++
++static void bcm2835_sdhost_finish_command(struct bcm2835_host *host,
++					  unsigned long *irq_flags);
++static void bcm2835_sdhost_transfer_complete(struct bcm2835_host *host);
++
++static void bcm2835_sdhost_finish_data(struct bcm2835_host *host)
++{
++	struct mmc_data *data;
++
++	data = host->data;
++	BUG_ON(!data);
++
++	log_event("FDA<", host->mrq, host->cmd);
++	pr_debug("finish_data(error %d, stop %d, sbc %d)\n",
++	       data->error, data->stop ? 1 : 0,
++	       host->mrq->sbc ? 1 : 0);
++
++	host->hcfg &= ~(SDHCFG_DATA_IRPT_EN | SDHCFG_BLOCK_IRPT_EN);
++	bcm2835_sdhost_write(host, host->hcfg, SDHCFG);
++
++	data->bytes_xfered = data->error ? 0 : (data->blksz * data->blocks);
++
++	host->data_complete = 1;
++
++	if (host->cmd) {
++		/*
++		 * Data managed to finish before the
++		 * command completed. Make sure we do
++		 * things in the proper order.
++		 */
++		pr_debug("Finished early - HSTS %x\n",
++			 bcm2835_sdhost_read(host, SDHSTS));
++	}
++	else
++		bcm2835_sdhost_transfer_complete(host);
++	log_event("FDA>", host->mrq, host->cmd);
++}
++
++static void bcm2835_sdhost_transfer_complete(struct bcm2835_host *host)
++{
++	struct mmc_data *data;
++
++	BUG_ON(host->cmd);
++	BUG_ON(!host->data);
++	BUG_ON(!host->data_complete);
++
++	data = host->data;
++	host->data = NULL;
++
++	log_event("TCM<", data, data->error);
++	pr_debug("transfer_complete(error %d, stop %d)\n",
++	       data->error, data->stop ? 1 : 0);
++
++	/*
++	 * Need to send CMD12 if -
++	 * a) open-ended multiblock transfer (no CMD23)
++	 * b) error in multiblock transfer
++	 */
++	if (host->mrq->stop && (data->error || !host->use_sbc)) {
++		if (bcm2835_sdhost_send_command(host, host->mrq->stop)) {
++			/* No busy, so poll for completion */
++			if (!host->use_busy)
++				bcm2835_sdhost_finish_command(host, NULL);
++
++			if (host->delay_after_this_stop)
++				ktime_get_real_ts64(&host->stop_time);
++		}
++	} else {
++		bcm2835_sdhost_wait_transfer_complete(host);
++		tasklet_schedule(&host->finish_tasklet);
++	}
++	log_event("TCM>", data, 0);
++}
++
++/* If irq_flags is valid, the caller is in a thread context and is allowed
++   to sleep */
++static void bcm2835_sdhost_finish_command(struct bcm2835_host *host,
++					  unsigned long *irq_flags)
++{
++	u32 sdcmd;
++	u32 retries;
++#ifdef DEBUG
++	struct timespec64 before, after;
++	int timediff = 0;
++#endif
++
++	log_event("FCM<", host->mrq, host->cmd);
++	pr_debug("finish_command(%x)\n", bcm2835_sdhost_read(host, SDCMD));
++
++	BUG_ON(!host->cmd || !host->mrq);
++
++	/* Poll quickly at first */
++
++	retries = host->cmd_quick_poll_retries;
++	if (!retries) {
++		/* Work out how many polls take 1us by timing 10us */
++		struct timespec64 start, now;
++		int us_diff;
++
++		retries = 1;
++		do {
++			int i;
++
++			retries *= 2;
++
++			ktime_get_real_ts64(&start);
++
++			for (i = 0; i < retries; i++) {
++				cpu_relax();
++				sdcmd = bcm2835_sdhost_read(host, SDCMD);
++			}
++
++			ktime_get_real_ts64(&now);
++			us_diff = (now.tv_sec - start.tv_sec) * 1000000 +
++				(now.tv_nsec - start.tv_nsec)/1000;
++		} while (us_diff < 10);
++
++		host->cmd_quick_poll_retries = ((retries * us_diff + 9)*CMD_DALLY_US)/10 + 1;
++		retries = 1; // We've already waited long enough this time
++	}
++
++	for (sdcmd = bcm2835_sdhost_read(host, SDCMD);
++	     (sdcmd & SDCMD_NEW_FLAG) && retries;
++	     retries--) {
++		cpu_relax();
++		sdcmd = bcm2835_sdhost_read(host, SDCMD);
++	}
++
++	if (!retries) {
++		unsigned long wait_max;
++
++		if (!irq_flags) {
++			/* Schedule the work */
++			log_event("CWWQ", 0, 0);
++			schedule_work(&host->cmd_wait_wq);
++			return;
++		}
++
++		/* Wait max 100 ms */
++		wait_max = jiffies + msecs_to_jiffies(100);
++		while (time_before(jiffies, wait_max)) {
++			spin_unlock_irqrestore(&host->lock, *irq_flags);
++			usleep_range(1, 10);
++			spin_lock_irqsave(&host->lock, *irq_flags);
++			sdcmd = bcm2835_sdhost_read(host, SDCMD);
++			if (!(sdcmd & SDCMD_NEW_FLAG))
++				break;
++		}
++	}
++
++	/* Check for errors */
++	if (sdcmd & SDCMD_NEW_FLAG) {
++		if (host->debug) {
++			pr_err("%s: command %d never completed.\n",
++			       mmc_hostname(host->mmc), host->cmd->opcode);
++			bcm2835_sdhost_dumpregs(host);
++		}
++		host->cmd->error = -EILSEQ;
++		tasklet_schedule(&host->finish_tasklet);
++		return;
++	} else if (sdcmd & SDCMD_FAIL_FLAG) {
++		u32 sdhsts = bcm2835_sdhost_read(host, SDHSTS);
++
++		/* Clear the errors */
++		bcm2835_sdhost_write(host, SDHSTS_ERROR_MASK, SDHSTS);
++
++		if (host->debug)
++			pr_info("%s: error detected - CMD %x, HSTS %03x, EDM %x\n",
++				mmc_hostname(host->mmc), sdcmd, sdhsts,
++				bcm2835_sdhost_read(host, SDEDM));
++
++		if ((sdhsts & SDHSTS_CRC7_ERROR) &&
++		    (host->cmd->opcode == 1)) {
++			if (host->debug)
++				pr_info("%s: ignoring CRC7 error for CMD1\n",
++					mmc_hostname(host->mmc));
++		} else {
++			u32 edm, fsm;
++
++			if (sdhsts & SDHSTS_CMD_TIME_OUT) {
++				if (host->debug)
++					pr_warn("%s: command %d timeout\n",
++					       mmc_hostname(host->mmc),
++					       host->cmd->opcode);
++				host->cmd->error = -ETIMEDOUT;
++			} else {
++				pr_warn("%s: unexpected command %d error\n",
++				       mmc_hostname(host->mmc),
++				       host->cmd->opcode);
++				host->cmd->error = -EILSEQ;
++			}
++
++			edm = readl(host->ioaddr + SDEDM);
++			fsm = edm & SDEDM_FSM_MASK;
++			if (fsm == SDEDM_FSM_READWAIT ||
++			    fsm == SDEDM_FSM_WRITESTART1)
++				writel(edm | SDEDM_FORCE_DATA_MODE,
++				       host->ioaddr + SDEDM);
++			tasklet_schedule(&host->finish_tasklet);
++			return;
++		}
++	}
++
++	if (host->cmd->flags & MMC_RSP_PRESENT) {
++		if (host->cmd->flags & MMC_RSP_136) {
++			int i;
++			for (i = 0; i < 4; i++)
++				host->cmd->resp[3 - i] = bcm2835_sdhost_read(host, SDRSP0 + i*4);
++			pr_debug("%s: finish_command %08x %08x %08x %08x\n",
++				 mmc_hostname(host->mmc),
++				 host->cmd->resp[0], host->cmd->resp[1], host->cmd->resp[2], host->cmd->resp[3]);
++			log_event("RSP ", host->cmd->resp[0], host->cmd->resp[1]);
++		} else {
++			host->cmd->resp[0] = bcm2835_sdhost_read(host, SDRSP0);
++			pr_debug("%s: finish_command %08x\n",
++				 mmc_hostname(host->mmc),
++				 host->cmd->resp[0]);
++			log_event("RSP ", host->cmd->resp[0], 0);
++		}
++	}
++
++	if (host->cmd == host->mrq->sbc) {
++		/* Finished CMD23, now send actual command. */
++		host->cmd = NULL;
++		if (bcm2835_sdhost_send_command(host, host->mrq->cmd)) {
++			if (host->data && host->dma_desc)
++				/* DMA transfer starts now, PIO starts after irq */
++				bcm2835_sdhost_start_dma(host);
++
++			if (!host->use_busy)
++				bcm2835_sdhost_finish_command(host, NULL);
++		}
++	} else if (host->cmd == host->mrq->stop) {
++		/* Finished CMD12 */
++		tasklet_schedule(&host->finish_tasklet);
++	} else {
++		/* Processed actual command. */
++		host->cmd = NULL;
++		if (!host->data)
++			tasklet_schedule(&host->finish_tasklet);
++		else if (host->data_complete)
++			bcm2835_sdhost_transfer_complete(host);
++	}
++	log_event("FCM>", host->mrq, host->cmd);
++}
++
++static void bcm2835_sdhost_timeout(struct timer_list *t)
++{
++	struct bcm2835_host *host = from_timer(host, t, timer);
++	unsigned long flags;
++
++	spin_lock_irqsave(&host->lock, flags);
++	log_event("TIM<", 0, 0);
++
++	if (host->mrq) {
++		pr_err("%s: timeout waiting for hardware interrupt.\n",
++			mmc_hostname(host->mmc));
++		log_dump();
++		bcm2835_sdhost_dumpregs(host);
++
++		if (host->data) {
++			host->data->error = -ETIMEDOUT;
++			bcm2835_sdhost_finish_data(host);
++		} else {
++			if (host->cmd)
++				host->cmd->error = -ETIMEDOUT;
++			else
++				host->mrq->cmd->error = -ETIMEDOUT;
++
++			pr_debug("timeout_timer tasklet_schedule\n");
++			tasklet_schedule(&host->finish_tasklet);
++		}
++	}
++
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++
++static void bcm2835_sdhost_busy_irq(struct bcm2835_host *host, u32 intmask)
++{
++	log_event("IRQB", host->cmd, intmask);
++	if (!host->cmd) {
++		pr_err("%s: got command busy interrupt 0x%08x even "
++			"though no command operation was in progress.\n",
++			mmc_hostname(host->mmc), (unsigned)intmask);
++		bcm2835_sdhost_dumpregs(host);
++		return;
++	}
++
++	if (!host->use_busy) {
++		pr_err("%s: got command busy interrupt 0x%08x even "
++			"though not expecting one.\n",
++			mmc_hostname(host->mmc), (unsigned)intmask);
++		bcm2835_sdhost_dumpregs(host);
++		return;
++	}
++	host->use_busy = 0;
++
++	if (intmask & SDHSTS_ERROR_MASK)
++	{
++		pr_err("sdhost_busy_irq: intmask %x, data %p\n", intmask, host->mrq->data);
++		if (intmask & SDHSTS_CRC7_ERROR)
++			host->cmd->error = -EILSEQ;
++		else if (intmask & (SDHSTS_CRC16_ERROR |
++				    SDHSTS_FIFO_ERROR)) {
++			if (host->mrq->data)
++				host->mrq->data->error = -EILSEQ;
++			else
++				host->cmd->error = -EILSEQ;
++		} else if (intmask & SDHSTS_REW_TIME_OUT) {
++			if (host->mrq->data)
++				host->mrq->data->error = -ETIMEDOUT;
++			else
++				host->cmd->error = -ETIMEDOUT;
++		} else if (intmask & SDHSTS_CMD_TIME_OUT)
++			host->cmd->error = -ETIMEDOUT;
++
++		if (host->debug) {
++			log_dump();
++			bcm2835_sdhost_dumpregs(host);
++		}
++	}
++	else
++		bcm2835_sdhost_finish_command(host, NULL);
++}
++
++static void bcm2835_sdhost_data_irq(struct bcm2835_host *host, u32 intmask)
++{
++	/* There are no dedicated data/space available interrupt
++	   status bits, so it is necessary to use the single shared
++	   data/space available FIFO status bits. It is therefore not
++	   an error to get here when there is no data transfer in
++	   progress. */
++	log_event("IRQD", host->data, intmask);
++	if (!host->data)
++		return;
++
++	if (intmask & (SDHSTS_CRC16_ERROR |
++		       SDHSTS_FIFO_ERROR |
++		       SDHSTS_REW_TIME_OUT)) {
++		if (intmask & (SDHSTS_CRC16_ERROR |
++			       SDHSTS_FIFO_ERROR))
++			host->data->error = -EILSEQ;
++		else
++			host->data->error = -ETIMEDOUT;
++
++		if (host->debug) {
++			log_dump();
++			bcm2835_sdhost_dumpregs(host);
++		}
++	}
++
++	if (host->data->error) {
++		bcm2835_sdhost_finish_data(host);
++	} else if (host->data->flags & MMC_DATA_WRITE) {
++		/* Use the block interrupt for writes after the first block */
++		host->hcfg &= ~(SDHCFG_DATA_IRPT_EN);
++		host->hcfg |= SDHCFG_BLOCK_IRPT_EN;
++		bcm2835_sdhost_write(host, host->hcfg, SDHCFG);
++		bcm2835_sdhost_transfer_pio(host);
++	} else {
++		bcm2835_sdhost_transfer_pio(host);
++		host->blocks--;
++		if ((host->blocks == 0) || host->data->error)
++			bcm2835_sdhost_finish_data(host);
++	}
++}
++
++static void bcm2835_sdhost_block_irq(struct bcm2835_host *host, u32 intmask)
++{
++	log_event("IRQK", host->data, intmask);
++	if (!host->data) {
++		pr_err("%s: got block interrupt 0x%08x even "
++			"though no data operation was in progress.\n",
++			mmc_hostname(host->mmc), (unsigned)intmask);
++		bcm2835_sdhost_dumpregs(host);
++		return;
++	}
++
++	if (intmask & (SDHSTS_CRC16_ERROR |
++		       SDHSTS_FIFO_ERROR |
++		       SDHSTS_REW_TIME_OUT)) {
++		if (intmask & (SDHSTS_CRC16_ERROR |
++			       SDHSTS_FIFO_ERROR))
++			host->data->error = -EILSEQ;
++		else
++			host->data->error = -ETIMEDOUT;
++
++		if (host->debug) {
++			log_dump();
++			bcm2835_sdhost_dumpregs(host);
++		}
++	}
++
++	if (!host->dma_desc) {
++		BUG_ON(!host->blocks);
++		if (host->data->error || (--host->blocks == 0)) {
++			bcm2835_sdhost_finish_data(host);
++		} else {
++			bcm2835_sdhost_transfer_pio(host);
++		}
++	} else if (host->data->flags & MMC_DATA_WRITE) {
++		bcm2835_sdhost_finish_data(host);
++	}
++}
++
++static irqreturn_t bcm2835_sdhost_irq(int irq, void *dev_id)
++{
++	irqreturn_t result = IRQ_NONE;
++	struct bcm2835_host *host = dev_id;
++	u32 intmask;
++
++	spin_lock(&host->lock);
++
++	intmask = bcm2835_sdhost_read(host, SDHSTS);
++	log_event("IRQ<", intmask, 0);
++
++	bcm2835_sdhost_write(host,
++			     SDHSTS_BUSY_IRPT |
++			     SDHSTS_BLOCK_IRPT |
++			     SDHSTS_SDIO_IRPT |
++			     SDHSTS_DATA_FLAG,
++			     SDHSTS);
++
++	if (intmask & SDHSTS_BLOCK_IRPT) {
++		bcm2835_sdhost_block_irq(host, intmask);
++		result = IRQ_HANDLED;
++	}
++
++	if (intmask & SDHSTS_BUSY_IRPT) {
++		bcm2835_sdhost_busy_irq(host, intmask);
++		result = IRQ_HANDLED;
++	}
++
++	/* There is no true data interrupt status bit, so it is
++	   necessary to qualify the data flag with the interrupt
++	   enable bit */
++	if ((intmask & SDHSTS_DATA_FLAG) &&
++	    (host->hcfg & SDHCFG_DATA_IRPT_EN)) {
++		bcm2835_sdhost_data_irq(host, intmask);
++		result = IRQ_HANDLED;
++	}
++
++	log_event("IRQ>", bcm2835_sdhost_read(host, SDHSTS), 0);
++	spin_unlock(&host->lock);
++
++	return result;
++}
++
++static void bcm2835_sdhost_set_clock(struct bcm2835_host *host, unsigned int clock)
++{
++	int div = 0; /* Initialized for compiler warning */
++	unsigned int input_clock = clock;
++	unsigned long flags;
++
++	if (host->debug)
++		pr_info("%s: set_clock(%d)\n", mmc_hostname(host->mmc), clock);
++
++	if (host->overclock_50 && (clock == 50*MHZ))
++		clock = host->overclock_50 * MHZ + (MHZ - 1);
++
++	/* The SDCDIV register has 11 bits, and holds (div - 2).
++	   But in data mode the max is 50MHz wihout a minimum, and only the
++	   bottom 3 bits are used. Since the switch over is automatic (unless
++	   we have marked the card as slow...), chosen values have to make
++	   sense in both modes.
++	   Ident mode must be 100-400KHz, so can range check the requested
++	   clock. CMD15 must be used to return to data mode, so this can be
++	   monitored.
++
++	   clock 250MHz -> 0->125MHz, 1->83.3MHz, 2->62.5MHz, 3->50.0MHz
++                           4->41.7MHz, 5->35.7MHz, 6->31.3MHz, 7->27.8MHz
++
++			 623->400KHz/27.8MHz
++			 reset value (507)->491159/50MHz
++
++	   BUT, the 3-bit clock divisor in data mode is too small if the
++	   core clock is higher than 250MHz, so instead use the SLOW_CARD
++	   configuration bit to force the use of the ident clock divisor
++	   at all times.
++	*/
++
++	host->mmc->actual_clock = 0;
++
++	if (host->firmware_sets_cdiv) {
++		u32 msg[3] = { clock, 0, 0 };
++
++		rpi_firmware_property(host->fw,
++				      RPI_FIRMWARE_SET_SDHOST_CLOCK,
++				      &msg, sizeof(msg));
++
++		clock = max(msg[1], msg[2]);
++		spin_lock_irqsave(&host->lock, flags);
++	} else {
++		spin_lock_irqsave(&host->lock, flags);
++		if (clock < 100000) {
++			/* Can't stop the clock, but make it as slow as
++			 * possible to show willing
++			 */
++			host->cdiv = SDCDIV_MAX_CDIV;
++			bcm2835_sdhost_write(host, host->cdiv, SDCDIV);
++			spin_unlock_irqrestore(&host->lock, flags);
++			return;
++		}
++
++		div = host->max_clk / clock;
++		if (div < 2)
++			div = 2;
++		if ((host->max_clk / div) > clock)
++			div++;
++		div -= 2;
++
++		if (div > SDCDIV_MAX_CDIV)
++			div = SDCDIV_MAX_CDIV;
++
++		clock = host->max_clk / (div + 2);
++
++		host->cdiv = div;
++		bcm2835_sdhost_write(host, host->cdiv, SDCDIV);
++
++		if (host->debug)
++			pr_info("%s: clock=%d -> max_clk=%d, cdiv=%x "
++				"(actual clock %d)\n",
++				mmc_hostname(host->mmc), input_clock,
++				host->max_clk, host->cdiv,
++				clock);
++	}
++
++	/* Calibrate some delays */
++
++	host->ns_per_fifo_word = (1000000000/clock) *
++		((host->mmc->caps & MMC_CAP_4_BIT_DATA) ? 8 : 32);
++
++	if (input_clock == 50 * MHZ) {
++		if (clock > input_clock) {
++			/* Save the closest value, to make it easier
++			   to reduce in the event of error */
++			host->overclock_50 = (clock/MHZ);
++
++			if (clock != host->overclock) {
++				pr_info("%s: overclocking to %dHz\n",
++					mmc_hostname(host->mmc), clock);
++				host->overclock = clock;
++			}
++		} else if (host->overclock) {
++			host->overclock = 0;
++			if (clock == 50 * MHZ)
++				pr_warn("%s: cancelling overclock\n",
++					mmc_hostname(host->mmc));
++		}
++	} else if (input_clock == 0) {
++		/* Reset the preferred overclock when the clock is stopped.
++		 * This always happens during initialisation. */
++		host->overclock_50 = host->user_overclock_50;
++		host->overclock = 0;
++	}
++
++	/* Set the timeout to 500ms */
++	bcm2835_sdhost_write(host, clock/2, SDTOUT);
++
++	host->mmc->actual_clock = clock;
++	host->clock = input_clock;
++	host->reset_clock = 0;
++
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++
++static void bcm2835_sdhost_request(struct mmc_host *mmc, struct mmc_request *mrq)
++{
++	struct bcm2835_host *host;
++	unsigned long flags;
++	u32 edm, fsm;
++
++	host = mmc_priv(mmc);
++
++	if (host->debug) {
++		struct mmc_command *cmd = mrq->cmd;
++		BUG_ON(!cmd);
++		if (cmd->data)
++			pr_info("%s: cmd %d 0x%x (flags 0x%x) - %s %d*%d\n",
++				mmc_hostname(mmc),
++				cmd->opcode, cmd->arg, cmd->flags,
++				(cmd->data->flags & MMC_DATA_READ) ?
++				"read" : "write", cmd->data->blocks,
++				cmd->data->blksz);
++		else
++			pr_info("%s: cmd %d 0x%x (flags 0x%x)\n",
++				mmc_hostname(mmc),
++				cmd->opcode, cmd->arg, cmd->flags);
++	}
++
++	/* Reset the error statuses in case this is a retry */
++	if (mrq->sbc)
++		mrq->sbc->error = 0;
++	if (mrq->cmd)
++		mrq->cmd->error = 0;
++	if (mrq->data)
++		mrq->data->error = 0;
++	if (mrq->stop)
++		mrq->stop->error = 0;
++
++	if (mrq->data && !is_power_of_2(mrq->data->blksz)) {
++		pr_err("%s: unsupported block size (%d bytes)\n",
++		       mmc_hostname(mmc), mrq->data->blksz);
++		mrq->cmd->error = -EINVAL;
++		mmc_request_done(mmc, mrq);
++		return;
++	}
++
++	if (host->use_dma && mrq->data &&
++	    (mrq->data->blocks > host->pio_limit))
++		bcm2835_sdhost_prepare_dma(host, mrq->data);
++
++	if (host->reset_clock)
++	    bcm2835_sdhost_set_clock(host, host->clock);
++
++	spin_lock_irqsave(&host->lock, flags);
++
++	WARN_ON(host->mrq != NULL);
++	host->mrq = mrq;
++
++	edm = bcm2835_sdhost_read(host, SDEDM);
++	fsm = edm & SDEDM_FSM_MASK;
++
++	log_event("REQ<", mrq, edm);
++	if ((fsm != SDEDM_FSM_IDENTMODE) &&
++	    (fsm != SDEDM_FSM_DATAMODE)) {
++		log_event("REQ!", mrq, edm);
++		if (host->debug) {
++			pr_warn("%s: previous command (%d) not complete (EDM %x)\n",
++			       mmc_hostname(host->mmc),
++			       bcm2835_sdhost_read(host, SDCMD) & SDCMD_CMD_MASK,
++			       edm);
++			log_dump();
++			bcm2835_sdhost_dumpregs(host);
++		}
++		mrq->cmd->error = -EILSEQ;
++		tasklet_schedule(&host->finish_tasklet);
++		spin_unlock_irqrestore(&host->lock, flags);
++		return;
++	}
++
++	host->use_sbc = !!mrq->sbc &&
++		(host->mrq->data->flags & USE_CMD23_FLAGS);
++	if (host->use_sbc) {
++		if (bcm2835_sdhost_send_command(host, mrq->sbc)) {
++			if (!host->use_busy)
++				bcm2835_sdhost_finish_command(host, &flags);
++		}
++	} else if (bcm2835_sdhost_send_command(host, mrq->cmd)) {
++		if (host->data && host->dma_desc)
++			/* DMA transfer starts now, PIO starts after irq */
++			bcm2835_sdhost_start_dma(host);
++
++		if (!host->use_busy)
++			bcm2835_sdhost_finish_command(host, &flags);
++	}
++
++	log_event("CMD ", mrq->cmd->opcode,
++		   mrq->data ? (u32)mrq->data->blksz : 0);
++
++	log_event("REQ>", mrq, 0);
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++
++static void bcm2835_sdhost_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
++{
++
++	struct bcm2835_host *host = mmc_priv(mmc);
++	unsigned long flags;
++
++	if (host->debug)
++		pr_info("%s: ios clock %d, pwr %d, bus_width %d, "
++			"timing %d, vdd %d, drv_type %d\n",
++			mmc_hostname(mmc),
++			ios->clock, ios->power_mode, ios->bus_width,
++			ios->timing, ios->signal_voltage, ios->drv_type);
++
++	spin_lock_irqsave(&host->lock, flags);
++
++	log_event("IOS<", ios->clock, 0);
++
++	/* set bus width */
++	host->hcfg &= ~SDHCFG_WIDE_EXT_BUS;
++	if (ios->bus_width == MMC_BUS_WIDTH_4)
++		host->hcfg |= SDHCFG_WIDE_EXT_BUS;
++
++	host->hcfg |= SDHCFG_WIDE_INT_BUS;
++
++	/* Disable clever clock switching, to cope with fast core clocks */
++	host->hcfg |= SDHCFG_SLOW_CARD;
++
++	bcm2835_sdhost_write(host, host->hcfg, SDHCFG);
++
++	spin_unlock_irqrestore(&host->lock, flags);
++
++	if (!ios->clock || ios->clock != host->clock)
++		bcm2835_sdhost_set_clock(host, ios->clock);
++}
++
++static struct mmc_host_ops bcm2835_sdhost_ops = {
++	.request = bcm2835_sdhost_request,
++	.set_ios = bcm2835_sdhost_set_ios,
++// todo:fix	.hw_reset = bcm2835_sdhost_reset,
++};
++
++static void bcm2835_sdhost_cmd_wait_work(struct work_struct *work)
++{
++	struct bcm2835_host *host;
++	unsigned long flags;
++
++	host = container_of(work, struct bcm2835_host, cmd_wait_wq);
++
++	spin_lock_irqsave(&host->lock, flags);
++
++	log_event("CWK<", host->cmd, host->mrq);
++
++	/*
++	 * If this tasklet gets rescheduled while running, it will
++	 * be run again afterwards but without any active request.
++	 */
++	if (!host->mrq) {
++		spin_unlock_irqrestore(&host->lock, flags);
++		return;
++	}
++
++	bcm2835_sdhost_finish_command(host, &flags);
++
++	log_event("CWK>", host->cmd, 0);
++
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++
++static void bcm2835_sdhost_tasklet_finish(unsigned long param)
++{
++	struct bcm2835_host *host;
++	unsigned long flags;
++	struct mmc_request *mrq;
++	struct dma_chan *terminate_chan = NULL;
++
++	host = (struct bcm2835_host *)param;
++
++	spin_lock_irqsave(&host->lock, flags);
++
++	log_event("TSK<", host->mrq, 0);
++	/*
++	 * If this tasklet gets rescheduled while running, it will
++	 * be run again afterwards but without any active request.
++	 */
++	if (!host->mrq) {
++		spin_unlock_irqrestore(&host->lock, flags);
++		return;
++	}
++
++	del_timer(&host->timer);
++
++	mrq = host->mrq;
++
++	/* Drop the overclock after any data corruption, or after any
++	 * error while overclocked. Ignore errors for status commands,
++	 * as they are likely when a card is ejected. */
++	if (host->overclock) {
++		if ((mrq->cmd && mrq->cmd->error &&
++		     (mrq->cmd->opcode != MMC_SEND_STATUS)) ||
++		    (mrq->data && mrq->data->error) ||
++		    (mrq->stop && mrq->stop->error) ||
++		    (mrq->sbc && mrq->sbc->error)) {
++			host->overclock_50--;
++			pr_warn("%s: reducing overclock due to errors\n",
++				mmc_hostname(host->mmc));
++			host->reset_clock = 1;
++			mrq->cmd->error = -ETIMEDOUT;
++			mrq->cmd->retries = 1;
++		}
++	}
++
++	host->mrq = NULL;
++	host->cmd = NULL;
++	host->data = NULL;
++
++	host->dma_desc = NULL;
++	terminate_chan = host->dma_chan;
++	host->dma_chan = NULL;
++
++	spin_unlock_irqrestore(&host->lock, flags);
++
++	if (terminate_chan)
++	{
++		int err = dmaengine_terminate_all(terminate_chan);
++		if (err)
++			pr_err("%s: failed to terminate DMA (%d)\n",
++			       mmc_hostname(host->mmc), err);
++	}
++
++	/* The SDHOST block doesn't report any errors for a disconnected
++	   interface. All cards and SDIO devices should report some supported
++	   voltage range, so a zero response to SEND_OP_COND, IO_SEND_OP_COND
++	   or APP_SEND_OP_COND can be treated as an error. */
++	if (((mrq->cmd->opcode == MMC_SEND_OP_COND) ||
++	     (mrq->cmd->opcode == SD_IO_SEND_OP_COND) ||
++	     (mrq->cmd->opcode == SD_APP_OP_COND)) &&
++	    (mrq->cmd->error == 0) &&
++	    (mrq->cmd->resp[0] == 0)) {
++		mrq->cmd->error = -ETIMEDOUT;
++		if (host->debug)
++			pr_info("%s: faking timeout due to zero OCR\n",
++				mmc_hostname(host->mmc));
++	}
++
++	mmc_request_done(host->mmc, mrq);
++	log_event("TSK>", mrq, 0);
++}
++
++int bcm2835_sdhost_add_host(struct bcm2835_host *host)
++{
++	struct mmc_host *mmc;
++	struct dma_slave_config cfg;
++	char pio_limit_string[20];
++	int ret;
++
++	mmc = host->mmc;
++
++	if (!mmc->f_max || mmc->f_max > host->max_clk)
++		mmc->f_max = host->max_clk;
++	mmc->f_min = host->max_clk / SDCDIV_MAX_CDIV;
++
++	mmc->max_busy_timeout =  (~(unsigned int)0)/(mmc->f_max/1000);
++
++	pr_debug("f_max %d, f_min %d, max_busy_timeout %d\n",
++		 mmc->f_max, mmc->f_min, mmc->max_busy_timeout);
++
++	/* host controller capabilities */
++	mmc->caps |=
++		MMC_CAP_SD_HIGHSPEED | MMC_CAP_MMC_HIGHSPEED |
++		MMC_CAP_NEEDS_POLL | MMC_CAP_HW_RESET |
++		((ALLOW_CMD23_READ|ALLOW_CMD23_WRITE) * MMC_CAP_CMD23);
++
++	spin_lock_init(&host->lock);
++
++	if (host->allow_dma) {
++		if (IS_ERR_OR_NULL(host->dma_chan_rxtx)) {
++			pr_err("%s: unable to initialise DMA channel. "
++			       "Falling back to PIO\n",
++			       mmc_hostname(mmc));
++			host->use_dma = false;
++		} else {
++			cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
++			cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
++
++			/* Validate the slave configurations */
++
++			cfg.direction = DMA_MEM_TO_DEV;
++			cfg.src_addr = 0;
++			cfg.dst_addr = host->bus_addr + SDDATA;
++
++			ret = dmaengine_slave_config(host->dma_chan_rxtx, &cfg);
++
++			if (ret == 0) {
++				host->dma_cfg_tx = cfg;
++
++				cfg.direction = DMA_DEV_TO_MEM;
++				cfg.src_addr = host->bus_addr + SDDATA;
++				cfg.dst_addr = 0;
++
++				ret = dmaengine_slave_config(host->dma_chan_rxtx, &cfg);
++			}
++
++			if (ret == 0) {
++				host->dma_cfg_rx = cfg;
++
++				host->use_dma = true;
++			} else {
++				pr_err("%s: unable to configure DMA channel. "
++				       "Falling back to PIO\n",
++				       mmc_hostname(mmc));
++				dma_release_channel(host->dma_chan_rxtx);
++				host->dma_chan_rxtx = NULL;
++				host->use_dma = false;
++			}
++		}
++	} else {
++		host->use_dma = false;
++	}
++
++	mmc->max_segs = 128;
++	mmc->max_req_size = 524288;
++	mmc->max_seg_size = mmc->max_req_size;
++	mmc->max_blk_size = 512;
++	mmc->max_blk_count =  65535;
++
++	/* report supported voltage ranges */
++	mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
++
++	tasklet_init(&host->finish_tasklet,
++		bcm2835_sdhost_tasklet_finish, (unsigned long)host);
++
++	INIT_WORK(&host->cmd_wait_wq, bcm2835_sdhost_cmd_wait_work);
++
++	timer_setup(&host->timer, bcm2835_sdhost_timeout, 0);
++
++	bcm2835_sdhost_init(host, 0);
++
++	ret = request_irq(host->irq, bcm2835_sdhost_irq, 0 /*IRQF_SHARED*/,
++				  mmc_hostname(mmc), host);
++	if (ret) {
++		pr_err("%s: failed to request IRQ %d: %d\n",
++		       mmc_hostname(mmc), host->irq, ret);
++		goto untasklet;
++	}
++
++	mmc_add_host(mmc);
++
++	pio_limit_string[0] = '\0';
++	if (host->use_dma && (host->pio_limit > 0))
++		sprintf(pio_limit_string, " (>%d)", host->pio_limit);
++	pr_info("%s: %s loaded - DMA %s%s\n",
++		mmc_hostname(mmc), DRIVER_NAME,
++		host->use_dma ? "enabled" : "disabled",
++		pio_limit_string);
++
++	return 0;
++
++untasklet:
++	tasklet_kill(&host->finish_tasklet);
++
++	return ret;
++}
++
++static int bcm2835_sdhost_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct device_node *node = dev->of_node;
++	struct clk *clk;
++	struct resource *iomem;
++	struct bcm2835_host *host;
++	struct mmc_host *mmc;
++	u32 msg[3];
++	int ret;
++
++	pr_debug("bcm2835_sdhost_probe\n");
++	mmc = mmc_alloc_host(sizeof(*host), dev);
++	if (!mmc)
++		return -ENOMEM;
++
++	mmc->ops = &bcm2835_sdhost_ops;
++	host = mmc_priv(mmc);
++	host->mmc = mmc;
++	host->pio_timeout = msecs_to_jiffies(500);
++	host->pio_limit = 1;
++	host->max_delay = 1; /* Warn if over 1ms */
++	host->allow_dma = 1;
++	spin_lock_init(&host->lock);
++
++	host->ioaddr = devm_platform_get_and_ioremap_resource(pdev, 0, &iomem);
++	if (IS_ERR(host->ioaddr)) {
++		ret = PTR_ERR(host->ioaddr);
++		goto err;
++	}
++
++	host->bus_addr = iomem->start;
++
++	if (node) {
++		/* Read any custom properties */
++		of_property_read_u32(node,
++				     "brcm,delay-after-stop",
++				     &host->delay_after_stop);
++		of_property_read_u32(node,
++				     "brcm,overclock-50",
++				     &host->user_overclock_50);
++		of_property_read_u32(node,
++				     "brcm,pio-limit",
++				     &host->pio_limit);
++		host->allow_dma =
++			!of_property_read_bool(node, "brcm,force-pio");
++		host->debug = of_property_read_bool(node, "brcm,debug");
++	}
++
++	host->dma_chan = NULL;
++	host->dma_desc = NULL;
++
++	/* Formally recognise the other way of disabling DMA */
++	if (host->pio_limit == 0x7fffffff)
++		host->allow_dma = false;
++
++	if (host->allow_dma) {
++		if (node) {
++			host->dma_chan_rxtx =
++				dma_request_slave_channel(dev, "rx-tx");
++			if (!host->dma_chan_rxtx)
++				host->dma_chan_rxtx =
++					dma_request_slave_channel(dev, "tx");
++			if (!host->dma_chan_rxtx)
++				host->dma_chan_rxtx =
++					dma_request_slave_channel(dev, "rx");
++		} else {
++			dma_cap_mask_t mask;
++
++			dma_cap_zero(mask);
++			/* we don't care about the channel, any would work */
++			dma_cap_set(DMA_SLAVE, mask);
++			host->dma_chan_rxtx =
++				dma_request_channel(mask, NULL, NULL);
++		}
++	}
++
++	clk = devm_clk_get(dev, NULL);
++	if (IS_ERR(clk)) {
++		ret = PTR_ERR(clk);
++		if (ret == -EPROBE_DEFER)
++			dev_info(dev, "could not get clk, deferring probe\n");
++		else
++			dev_err(dev, "could not get clk\n");
++		goto err;
++	}
++
++	host->fw = rpi_firmware_get(
++		of_parse_phandle(dev->of_node, "firmware", 0));
++	if (!host->fw) {
++		ret = -EPROBE_DEFER;
++		goto err;
++	}
++
++	host->max_clk = clk_get_rate(clk);
++
++	host->irq = platform_get_irq(pdev, 0);
++	if (host->irq <= 0) {
++		dev_err(dev, "get IRQ failed\n");
++		ret = -EINVAL;
++		goto err;
++	}
++
++	pr_debug(" - max_clk %lx, irq %d\n",
++		 (unsigned long)host->max_clk,
++		 (int)host->irq);
++
++	log_init(dev);
++
++	if (node)
++		mmc_of_parse(mmc);
++	else
++		mmc->caps |= MMC_CAP_4_BIT_DATA;
++
++	msg[0] = 0;
++	msg[1] = ~0;
++	msg[2] = ~0;
++
++	rpi_firmware_property(host->fw,
++			      RPI_FIRMWARE_SET_SDHOST_CLOCK,
++			      &msg, sizeof(msg));
++
++	host->firmware_sets_cdiv = (msg[1] != ~0);
++
++	ret = bcm2835_sdhost_add_host(host);
++	if (ret)
++		goto err;
++
++	platform_set_drvdata(pdev, host);
++
++	pr_debug("bcm2835_sdhost_probe -> OK\n");
++
++	return 0;
++
++err:
++	pr_debug("bcm2835_sdhost_probe -> err %d\n", ret);
++	if (host->fw)
++		rpi_firmware_put(host->fw);
++	if (host->dma_chan_rxtx)
++		dma_release_channel(host->dma_chan_rxtx);
++	mmc_free_host(mmc);
++
++	return ret;
++}
++
++static void bcm2835_sdhost_remove(struct platform_device *pdev)
++{
++	struct bcm2835_host *host = platform_get_drvdata(pdev);
++
++	pr_debug("bcm2835_sdhost_remove\n");
++
++	mmc_remove_host(host->mmc);
++
++	bcm2835_sdhost_set_power(host, false);
++
++	free_irq(host->irq, host);
++
++	del_timer_sync(&host->timer);
++
++	tasklet_kill(&host->finish_tasklet);
++	rpi_firmware_put(host->fw);
++	if (host->dma_chan_rxtx)
++		dma_release_channel(host->dma_chan_rxtx);
++	mmc_free_host(host->mmc);
++	platform_set_drvdata(pdev, NULL);
++
++	pr_debug("bcm2835_sdhost_remove - OK\n");
++}
++
++static const struct of_device_id bcm2835_sdhost_match[] = {
++	{ .compatible = "brcm,bcm2835-sdhost" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, bcm2835_sdhost_match);
++
++static struct platform_driver bcm2835_sdhost_driver = {
++	.probe      = bcm2835_sdhost_probe,
++	.remove     = bcm2835_sdhost_remove,
++	.driver     = {
++		.name		= DRIVER_NAME,
++		.owner		= THIS_MODULE,
++		.of_match_table	= bcm2835_sdhost_match,
++	},
++};
++module_platform_driver(bcm2835_sdhost_driver);
++
++MODULE_ALIAS("platform:sdhost-bcm2835");
++MODULE_DESCRIPTION("BCM2835 SDHost driver");
++MODULE_LICENSE("GPL v2");
++MODULE_AUTHOR("Phil Elwell");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0060-vc_mem-Add-vc_mem-driver-for-querying-firmware-memor.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0060-vc_mem-Add-vc_mem-driver-for-querying-firmware-memor.patch
new file mode 100644
index 00000000..a5170f1e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0060-vc_mem-Add-vc_mem-driver-for-querying-firmware-memor.patch
@@ -0,0 +1,771 @@
+From 29d4966c087ed60cf8423ae91b2055b954a8ec42 Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Fri, 28 Oct 2016 15:36:43 +0100
+Subject: [PATCH 060/697] vc_mem: Add vc_mem driver for querying firmware
+ memory addresses
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+
+BCM270x: Move vc_mem
+
+Make the vc_mem module available for ARCH_BCM2835 by moving it.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+char: vc_mem: Fix up compat ioctls for 64bit kernel
+
+compat_ioctl wasn't defined, so 32bit user/64bit kernel
+always failed.
+VC_MEM_IOC_MEM_PHYS_ADDR was defined with parameter size
+unsigned long, so the ioctl cmd changes between sizes.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+char: vc_mem: Fix all coding style issues.
+
+Cleans up all checkpatch errors in vc_mem.c and vc_mem.h
+No functional change to the code.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+char: vc_mem: Delete dead code
+
+There are no error exists once device_create has succeeded, and
+therefore no need to call device_destroy from vc_mem_init.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+char: broadcom: vc_mem: Fix preprocessor conditional
+
+Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
+
+vc_mem: Add the DMA memcpy support from bcm2708_fb
+
+bcm2708_fb is disabled by the vc4-kms-v3d overlay, which means that the
+DMA memcpy support it provides is not available to allow vclog to read
+the VC logs from the top 16MB on Pi 2 and Pi 3. Add the code to the
+vc_mem driver, which will still be enabled.
+
+It ought to be possible to do a proper DMA_MEM_TO_MEM copy via the
+generic DMA customer API, but that can be a later step.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/char/broadcom/Kconfig   |  18 +
+ drivers/char/broadcom/Makefile  |   1 +
+ drivers/char/broadcom/vc_mem.c  | 635 ++++++++++++++++++++++++++++++++
+ include/linux/broadcom/vc_mem.h |  39 ++
+ 4 files changed, 693 insertions(+)
+ create mode 100644 drivers/char/broadcom/Kconfig
+ create mode 100644 drivers/char/broadcom/Makefile
+ create mode 100644 drivers/char/broadcom/vc_mem.c
+ create mode 100644 include/linux/broadcom/vc_mem.h
+
+--- /dev/null
++++ b/drivers/char/broadcom/Kconfig
+@@ -0,0 +1,18 @@
++#
++# Broadcom char driver config
++#
++
++menuconfig BRCM_CHAR_DRIVERS
++	bool "Broadcom Char Drivers"
++	help
++	  Broadcom's char drivers
++
++if BRCM_CHAR_DRIVERS
++
++config BCM2708_VCMEM
++	bool "Videocore Memory"
++        default y
++        help
++          Helper for videocore memory access and total size allocation.
++
++endif
+--- /dev/null
++++ b/drivers/char/broadcom/Makefile
+@@ -0,0 +1 @@
++obj-$(CONFIG_BCM2708_VCMEM)	+= vc_mem.o
+--- /dev/null
++++ b/drivers/char/broadcom/vc_mem.c
+@@ -0,0 +1,635 @@
++/*
++ * Copyright 2010 - 2011 Broadcom Corporation.  All rights reserved.
++ *
++ * Unless you and Broadcom execute a separate written software license
++ * agreement governing use of this software, this software is licensed to you
++ * under the terms of the GNU General Public License version 2, available at
++ * http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
++ *
++ * Notwithstanding the above, under no circumstances may you combine this
++ * software in any way with any other Broadcom software provided under a
++ * license other than the GPL, without Broadcom's express prior written
++ * consent.
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/fs.h>
++#include <linux/device.h>
++#include <linux/cdev.h>
++#include <linux/mm.h>
++#include <linux/slab.h>
++#include <linux/debugfs.h>
++#include <linux/uaccess.h>
++#include <linux/dma-mapping.h>
++#include <linux/broadcom/vc_mem.h>
++#include <linux/compat.h>
++#include <linux/of.h>
++#include <linux/of_platform.h>
++#include <linux/platform_device.h>
++#include <linux/platform_data/dma-bcm2708.h>
++#include <soc/bcm2835/raspberrypi-firmware.h>
++
++#define DRIVER_NAME  "vc-mem"
++
++/* N.B. These use a different magic value for compatibility with bmc7208_fb */
++#define VC_MEM_IOC_DMACOPY   _IOW('z', 0x22, struct vc_mem_dmacopy)
++#define VC_MEM_IOC_DMACOPY32 _IOW('z', 0x22, struct vc_mem_dmacopy32)
++
++/* address with no aliases */
++#define INTALIAS_NORMAL(x) ((x) & ~0xc0000000)
++/* cache coherent but non-allocating in L1 and L2 */
++#define INTALIAS_L1L2_NONALLOCATING(x) (((x) & ~0xc0000000) | 0x80000000)
++
++/* Device (/dev) related variables */
++static dev_t vc_mem_devnum;
++static struct class *vc_mem_class;
++static struct cdev vc_mem_cdev;
++static int vc_mem_inited;
++
++#ifdef CONFIG_DEBUG_FS
++static struct dentry *vc_mem_debugfs_entry;
++#endif
++
++struct vc_mem_dmacopy {
++	void *dst;
++	__u32 src;
++	__u32 length;
++};
++
++#ifdef CONFIG_COMPAT
++struct vc_mem_dmacopy32 {
++	compat_uptr_t dst;
++	__u32 src;
++	__u32 length;
++};
++#endif
++
++/*
++ * Videocore memory addresses and size
++ *
++ * Drivers that wish to know the videocore memory addresses and sizes should
++ * use these variables instead of the MM_IO_BASE and MM_ADDR_IO defines in
++ * headers. This allows the other drivers to not be tied down to a a certain
++ * address/size at compile time.
++ *
++ * In the future, the goal is to have the videocore memory virtual address and
++ * size be calculated at boot time rather than at compile time. The decision of
++ * where the videocore memory resides and its size would be in the hands of the
++ * bootloader (and/or kernel). When that happens, the values of these variables
++ * would be calculated and assigned in the init function.
++ */
++/* In the 2835 VC in mapped above ARM, but ARM has full access to VC space */
++unsigned long mm_vc_mem_phys_addr;
++EXPORT_SYMBOL(mm_vc_mem_phys_addr);
++unsigned int mm_vc_mem_size;
++EXPORT_SYMBOL(mm_vc_mem_size);
++unsigned int mm_vc_mem_base;
++EXPORT_SYMBOL(mm_vc_mem_base);
++
++static uint phys_addr;
++static uint mem_size;
++static uint mem_base;
++
++struct vc_mem_dma {
++	struct device *dev;
++	int dma_chan;
++	int dma_irq;
++	void __iomem *dma_chan_base;
++	wait_queue_head_t dma_waitq;
++	void *cb_base;	/* DMA control blocks */
++	dma_addr_t cb_handle;
++};
++
++struct { u32 base, length; } gpu_mem;
++static struct mutex dma_mutex;
++static struct vc_mem_dma vc_mem_dma;
++
++static int
++vc_mem_open(struct inode *inode, struct file *file)
++{
++	(void)inode;
++
++	pr_debug("%s: called file = 0x%p\n", __func__, file);
++
++	return 0;
++}
++
++static int
++vc_mem_release(struct inode *inode, struct file *file)
++{
++	(void)inode;
++
++	pr_debug("%s: called file = 0x%p\n", __func__, file);
++
++	return 0;
++}
++
++static void
++vc_mem_get_size(void)
++{
++}
++
++static void
++vc_mem_get_base(void)
++{
++}
++
++int
++vc_mem_get_current_size(void)
++{
++	return mm_vc_mem_size;
++}
++EXPORT_SYMBOL_GPL(vc_mem_get_current_size);
++
++static int
++vc_mem_dma_init(void)
++{
++	struct vc_mem_dma *vcdma = &vc_mem_dma;
++	struct platform_device *pdev;
++	struct device_node *fwnode;
++	struct rpi_firmware *fw;
++	struct device *dev;
++	u32 revision;
++	int rc;
++
++	if (vcdma->dev)
++		return 0;
++
++	fwnode = of_find_node_by_path("/system");
++	rc = of_property_read_u32(fwnode, "linux,revision", &revision);
++	revision = (revision >> 12) & 0xf;
++	if (revision != 1 && revision != 2) {
++		/* Only BCM2709 and BCM2710 may have logs where the ARMs
++		 * can't see them.
++		 */
++		return -ENXIO;
++	}
++
++	fwnode = rpi_firmware_find_node();
++	if (!fwnode)
++		return -ENXIO;
++
++	pdev = of_find_device_by_node(fwnode);
++	dev = &pdev->dev;
++
++	rc = dma_coerce_mask_and_coherent(dev, DMA_BIT_MASK(32));
++	if (rc)
++		return rc;
++
++	fw = rpi_firmware_get(fwnode);
++	if (!fw)
++		return -ENXIO;
++	rc = rpi_firmware_property(fw, RPI_FIRMWARE_GET_VC_MEMORY,
++				   &gpu_mem, sizeof(gpu_mem));
++	if (rc)
++		return rc;
++
++	gpu_mem.base = INTALIAS_NORMAL(gpu_mem.base);
++
++	if (!gpu_mem.base || !gpu_mem.length) {
++		dev_err(dev, "%s: unable to determine gpu memory (%x,%x)\n",
++			__func__, gpu_mem.base, gpu_mem.length);
++		return -EFAULT;
++	}
++
++	vcdma->cb_base = dma_alloc_wc(dev, SZ_4K, &vcdma->cb_handle, GFP_KERNEL);
++	if (!vcdma->cb_base) {
++		dev_err(dev, "failed to allocate DMA CBs\n");
++		return -ENOMEM;
++	}
++
++	rc = bcm_dma_chan_alloc(BCM_DMA_FEATURE_BULK,
++				&vcdma->dma_chan_base,
++				&vcdma->dma_irq);
++	if (rc < 0) {
++		dev_err(dev, "failed to allocate a DMA channel\n");
++		goto free_cb;
++	}
++
++	vcdma->dma_chan = rc;
++
++	init_waitqueue_head(&vcdma->dma_waitq);
++
++	vcdma->dev = dev;
++
++	return 0;
++
++free_cb:
++	dma_free_wc(dev, SZ_4K, vcdma->cb_base, vcdma->cb_handle);
++
++	return rc;
++}
++
++static void
++vc_mem_dma_uninit(void)
++{
++	struct vc_mem_dma *vcdma = &vc_mem_dma;
++
++	if (vcdma->dev) {
++		bcm_dma_chan_free(vcdma->dma_chan);
++		dma_free_wc(vcdma->dev, SZ_4K, vcdma->cb_base, vcdma->cb_handle);
++		vcdma->dev = NULL;
++	}
++}
++
++static int dma_memcpy(struct vc_mem_dma *vcdma, dma_addr_t dst, dma_addr_t src,
++		      int size)
++{
++	struct bcm2708_dma_cb *cb = vcdma->cb_base;
++	int burst_size = (vcdma->dma_chan == 0) ? 8 : 2;
++
++	cb->info = BCM2708_DMA_BURST(burst_size) | BCM2708_DMA_S_WIDTH |
++		   BCM2708_DMA_S_INC | BCM2708_DMA_D_WIDTH |
++		   BCM2708_DMA_D_INC;
++	cb->dst = dst;
++	cb->src = src;
++	cb->length = size;
++	cb->stride = 0;
++	cb->pad[0] = 0;
++	cb->pad[1] = 0;
++	cb->next = 0;
++
++	bcm_dma_start(vcdma->dma_chan_base, vcdma->cb_handle);
++	bcm_dma_wait_idle(vcdma->dma_chan_base);
++
++	return 0;
++}
++
++static long vc_mem_copy(struct vc_mem_dmacopy *ioparam)
++{
++	struct vc_mem_dma *vcdma = &vc_mem_dma;
++	size_t size = PAGE_SIZE;
++	const u32 dma_xfer_chunk = 256;
++	u32 *buf = NULL;
++	dma_addr_t bus_addr;
++	long rc = 0;
++	size_t offset;
++
++	/* restrict this to root user */
++	if (!uid_eq(current_euid(), GLOBAL_ROOT_UID))
++		return -EFAULT;
++
++	if (mutex_lock_interruptible(&dma_mutex))
++		return -EINTR;
++
++	rc = vc_mem_dma_init();
++	if (rc)
++		goto out;
++
++	vcdma = &vc_mem_dma;
++
++	if (INTALIAS_NORMAL(ioparam->src) < gpu_mem.base ||
++	    INTALIAS_NORMAL(ioparam->src) >= gpu_mem.base + gpu_mem.length) {
++		pr_err("%s: invalid memory access %x (%x-%x)", __func__,
++		       INTALIAS_NORMAL(ioparam->src), gpu_mem.base,
++		       gpu_mem.base + gpu_mem.length);
++		rc = -EFAULT;
++		goto out;
++	}
++
++	buf = dma_alloc_coherent(vcdma->dev, PAGE_ALIGN(size), &bus_addr,
++				 GFP_ATOMIC);
++	if (!buf) {
++		rc = -ENOMEM;
++		goto out;
++	}
++
++	for (offset = 0; offset < ioparam->length; offset += size) {
++		size_t remaining = ioparam->length - offset;
++		size_t s = min(size, remaining);
++		u8 *p = (u8 *)((uintptr_t)ioparam->src + offset);
++		u8 *q = (u8 *)ioparam->dst + offset;
++
++		rc = dma_memcpy(vcdma, bus_addr,
++				INTALIAS_L1L2_NONALLOCATING((u32)(uintptr_t)p),
++				(s + dma_xfer_chunk - 1) & ~(dma_xfer_chunk - 1));
++		if (rc) {
++			dev_err(vcdma->dev, "dma_memcpy failed\n");
++			break;
++		}
++		if (copy_to_user(q, buf, s) != 0) {
++			pr_err("%s: copy_to_user failed\n", __func__);
++			rc = -EFAULT;
++			break;
++		}
++	}
++
++out:
++	if (buf)
++		dma_free_coherent(vcdma->dev, PAGE_ALIGN(size), buf,
++				  bus_addr);
++
++	mutex_unlock(&dma_mutex);
++
++	return rc;
++}
++
++static long
++vc_mem_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
++{
++	int rc = 0;
++
++	(void) cmd;
++	(void) arg;
++
++	pr_debug("%s: called file = 0x%p, cmd %08x\n", __func__, file, cmd);
++
++	switch (cmd) {
++	case VC_MEM_IOC_MEM_PHYS_ADDR:
++		{
++			pr_debug("%s: VC_MEM_IOC_MEM_PHYS_ADDR=0x%p\n",
++				__func__, (void *)mm_vc_mem_phys_addr);
++
++			if (copy_to_user((void *)arg, &mm_vc_mem_phys_addr,
++					 sizeof(mm_vc_mem_phys_addr))) {
++				rc = -EFAULT;
++			}
++			break;
++		}
++	case VC_MEM_IOC_MEM_SIZE:
++		{
++			/* Get the videocore memory size first */
++			vc_mem_get_size();
++
++			pr_debug("%s: VC_MEM_IOC_MEM_SIZE=%x\n", __func__,
++				 mm_vc_mem_size);
++
++			if (copy_to_user((void *)arg, &mm_vc_mem_size,
++					 sizeof(mm_vc_mem_size))) {
++				rc = -EFAULT;
++			}
++			break;
++		}
++	case VC_MEM_IOC_MEM_BASE:
++		{
++			/* Get the videocore memory base */
++			vc_mem_get_base();
++
++			pr_debug("%s: VC_MEM_IOC_MEM_BASE=%x\n", __func__,
++				 mm_vc_mem_base);
++
++			if (copy_to_user((void *)arg, &mm_vc_mem_base,
++					 sizeof(mm_vc_mem_base))) {
++				rc = -EFAULT;
++			}
++			break;
++		}
++	case VC_MEM_IOC_MEM_LOAD:
++		{
++			/* Get the videocore memory base */
++			vc_mem_get_base();
++
++			pr_debug("%s: VC_MEM_IOC_MEM_LOAD=%x\n", __func__,
++				mm_vc_mem_base);
++
++			if (copy_to_user((void *)arg, &mm_vc_mem_base,
++					 sizeof(mm_vc_mem_base))) {
++				rc = -EFAULT;
++			}
++			break;
++		}
++	case VC_MEM_IOC_DMACOPY:
++		{
++			struct vc_mem_dmacopy ioparam;
++			/* Get the parameter data.
++			 */
++			if (copy_from_user
++			    (&ioparam, (void *)arg, sizeof(ioparam))) {
++				pr_err("%s: copy_from_user failed\n", __func__);
++				rc = -EFAULT;
++				break;
++			}
++
++			rc = vc_mem_copy(&ioparam);
++			break;
++		}
++	default:
++		{
++			return -ENOTTY;
++		}
++	}
++	pr_debug("%s: file = 0x%p returning %d\n", __func__, file, rc);
++
++	return rc;
++}
++
++#ifdef CONFIG_COMPAT
++static long
++vc_mem_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
++{
++	int rc = 0;
++
++	switch (cmd) {
++	case VC_MEM_IOC_MEM_PHYS_ADDR32:
++		pr_debug("%s: VC_MEM_IOC_MEM_PHYS_ADDR32=0x%p\n",
++			 __func__, (void *)mm_vc_mem_phys_addr);
++
++		/* This isn't correct, but will cover us for now as
++		 * VideoCore is 32bit only.
++		 */
++		if (copy_to_user((void *)arg, &mm_vc_mem_phys_addr,
++				 sizeof(compat_ulong_t)))
++			rc = -EFAULT;
++
++		break;
++
++	case VC_MEM_IOC_DMACOPY32:
++	{
++		struct vc_mem_dmacopy32 param32;
++		struct vc_mem_dmacopy param;
++		/* Get the parameter data.
++		 */
++		if (copy_from_user(&param32, (void *)arg, sizeof(param32))) {
++			pr_err("%s: copy_from_user failed\n", __func__);
++			rc = -EFAULT;
++			break;
++		}
++		param.dst = compat_ptr(param32.dst);
++		param.src = param32.src;
++		param.length = param32.length;
++		rc = vc_mem_copy(&param);
++		break;
++	}
++
++	default:
++		rc = vc_mem_ioctl(file, cmd, arg);
++		break;
++	}
++
++	return rc;
++}
++#endif
++
++static int
++vc_mem_mmap(struct file *filp, struct vm_area_struct *vma)
++{
++	int rc = 0;
++	unsigned long length = vma->vm_end - vma->vm_start;
++	unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
++
++	pr_debug("%s: vm_start = 0x%08lx vm_end = 0x%08lx vm_pgoff = 0x%08lx\n",
++		 __func__, (long)vma->vm_start, (long)vma->vm_end,
++		 (long)vma->vm_pgoff);
++
++	if (offset + length > mm_vc_mem_size) {
++		pr_err("%s: length %ld is too big\n", __func__, length);
++		return -EINVAL;
++	}
++	/* Do not cache the memory map */
++	vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
++
++	rc = remap_pfn_range(vma, vma->vm_start,
++			     (mm_vc_mem_phys_addr >> PAGE_SHIFT) +
++			     vma->vm_pgoff, length, vma->vm_page_prot);
++	if (rc)
++		pr_err("%s: remap_pfn_range failed (rc=%d)\n", __func__, rc);
++
++	return rc;
++}
++
++/* File Operations for the driver. */
++static const struct file_operations vc_mem_fops = {
++	.owner = THIS_MODULE,
++	.open = vc_mem_open,
++	.release = vc_mem_release,
++	.unlocked_ioctl = vc_mem_ioctl,
++#ifdef CONFIG_COMPAT
++	.compat_ioctl = vc_mem_compat_ioctl,
++#endif
++	.mmap = vc_mem_mmap,
++};
++
++#ifdef CONFIG_DEBUG_FS
++static void vc_mem_debugfs_deinit(void)
++{
++	debugfs_remove_recursive(vc_mem_debugfs_entry);
++	vc_mem_debugfs_entry = NULL;
++}
++
++
++static int vc_mem_debugfs_init(
++	struct device *dev)
++{
++	vc_mem_debugfs_entry = debugfs_create_dir(DRIVER_NAME, NULL);
++	if (!vc_mem_debugfs_entry) {
++		dev_warn(dev, "could not create debugfs entry\n");
++		return -EFAULT;
++	}
++
++	debugfs_create_x32("vc_mem_phys_addr",
++				0444,
++				vc_mem_debugfs_entry,
++				(u32 *)&mm_vc_mem_phys_addr);
++	debugfs_create_x32("vc_mem_size",
++				0444,
++				vc_mem_debugfs_entry,
++				(u32 *)&mm_vc_mem_size);
++	debugfs_create_x32("vc_mem_base",
++				0444,
++				vc_mem_debugfs_entry,
++				(u32 *)&mm_vc_mem_base);
++
++	return 0;
++}
++
++#endif /* CONFIG_DEBUG_FS */
++
++/* Module load/unload functions */
++
++static int __init
++vc_mem_init(void)
++{
++	int rc = -EFAULT;
++	struct device *dev;
++
++	pr_debug("%s: called\n", __func__);
++
++	mm_vc_mem_phys_addr = phys_addr;
++	mm_vc_mem_size = mem_size;
++	mm_vc_mem_base = mem_base;
++
++	vc_mem_get_size();
++
++	pr_info("vc-mem: phys_addr:0x%08lx mem_base=0x%08x mem_size:0x%08x(%u MiB)\n",
++		mm_vc_mem_phys_addr, mm_vc_mem_base, mm_vc_mem_size,
++		mm_vc_mem_size / (1024 * 1024));
++
++	rc = alloc_chrdev_region(&vc_mem_devnum, 0, 1, DRIVER_NAME);
++	if (rc < 0) {
++		pr_err("%s: alloc_chrdev_region failed (rc=%d)\n",
++		       __func__, rc);
++		goto out_err;
++	}
++
++	cdev_init(&vc_mem_cdev, &vc_mem_fops);
++	rc = cdev_add(&vc_mem_cdev, vc_mem_devnum, 1);
++	if (rc) {
++		pr_err("%s: cdev_add failed (rc=%d)\n", __func__, rc);
++		goto out_unregister;
++	}
++
++	vc_mem_class = class_create(DRIVER_NAME);
++	if (IS_ERR(vc_mem_class)) {
++		rc = PTR_ERR(vc_mem_class);
++		pr_err("%s: class_create failed (rc=%d)\n", __func__, rc);
++		goto out_cdev_del;
++	}
++
++	dev = device_create(vc_mem_class, NULL, vc_mem_devnum, NULL,
++			    DRIVER_NAME);
++	if (IS_ERR(dev)) {
++		rc = PTR_ERR(dev);
++		pr_err("%s: device_create failed (rc=%d)\n", __func__, rc);
++		goto out_class_destroy;
++	}
++
++#ifdef CONFIG_DEBUG_FS
++	/* don't fail if the debug entries cannot be created */
++	vc_mem_debugfs_init(dev);
++#endif
++
++	mutex_init(&dma_mutex);
++	vc_mem_inited = 1;
++	return 0;
++
++out_class_destroy:
++	class_destroy(vc_mem_class);
++	vc_mem_class = NULL;
++
++out_cdev_del:
++	cdev_del(&vc_mem_cdev);
++
++out_unregister:
++	unregister_chrdev_region(vc_mem_devnum, 1);
++
++out_err:
++	return -1;
++}
++
++static void __exit
++vc_mem_exit(void)
++{
++	pr_debug("%s: called\n", __func__);
++
++	vc_mem_dma_uninit();
++	if (vc_mem_inited) {
++#ifdef CONFIG_DEBUG_FS
++		vc_mem_debugfs_deinit();
++#endif
++		device_destroy(vc_mem_class, vc_mem_devnum);
++		class_destroy(vc_mem_class);
++		cdev_del(&vc_mem_cdev);
++		unregister_chrdev_region(vc_mem_devnum, 1);
++		vc_mem_inited = 0;
++	}
++}
++
++module_init(vc_mem_init);
++module_exit(vc_mem_exit);
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Broadcom Corporation");
++
++module_param(phys_addr, uint, 0644);
++module_param(mem_size, uint, 0644);
++module_param(mem_base, uint, 0644);
+--- /dev/null
++++ b/include/linux/broadcom/vc_mem.h
+@@ -0,0 +1,39 @@
++/*
++ * Copyright 2010 - 2011 Broadcom Corporation.  All rights reserved.
++ *
++ * Unless you and Broadcom execute a separate written software license
++ * agreement governing use of this software, this software is licensed to you
++ * under the terms of the GNU General Public License version 2, available at
++ * http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
++ *
++ * Notwithstanding the above, under no circumstances may you combine this
++ * software in any way with any other Broadcom software provided under a
++ * license other than the GPL, without Broadcom's express prior written
++ * consent.
++ */
++
++#ifndef _VC_MEM_H
++#define _VC_MEM_H
++
++#include <linux/ioctl.h>
++
++#define VC_MEM_IOC_MAGIC  'v'
++
++#define VC_MEM_IOC_MEM_PHYS_ADDR    _IOR(VC_MEM_IOC_MAGIC, 0, unsigned long)
++#define VC_MEM_IOC_MEM_SIZE         _IOR(VC_MEM_IOC_MAGIC, 1, unsigned int)
++#define VC_MEM_IOC_MEM_BASE         _IOR(VC_MEM_IOC_MAGIC, 2, unsigned int)
++#define VC_MEM_IOC_MEM_LOAD         _IOR(VC_MEM_IOC_MAGIC, 3, unsigned int)
++
++#ifdef __KERNEL__
++#define VC_MEM_TO_ARM_ADDR_MASK 0x3FFFFFFF
++
++extern unsigned long mm_vc_mem_phys_addr;
++extern unsigned int  mm_vc_mem_size;
++extern int vc_mem_get_current_size(void);
++#endif
++
++#ifdef CONFIG_COMPAT
++#define VC_MEM_IOC_MEM_PHYS_ADDR32  _IOR(VC_MEM_IOC_MAGIC, 0, compat_ulong_t)
++#endif
++
++#endif  /* _VC_MEM_H */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0061-Add-SMI-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0061-Add-SMI-driver.patch
new file mode 100644
index 00000000..8aef23ed
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0061-Add-SMI-driver.patch
@@ -0,0 +1,1970 @@
+From 2d1c8d6ada44835f7775dfd556b33dcea45ca8f6 Mon Sep 17 00:00:00 2001
+From: Luke Wren <wren6991@gmail.com>
+Date: Sat, 5 Sep 2015 01:14:45 +0100
+Subject: [PATCH 061/697] Add SMI driver
+
+Signed-off-by: Luke Wren <wren6991@gmail.com>
+
+MISC: bcm2835: smi: use clock manager and fix reload issues
+
+Use clock manager instead of self-made clockmanager.
+
+Also fix some error paths that showd up during development
+(especially missing release of dma resources on rmmod)
+
+Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
+
+bcm2835_smi: re-add dereference to fix DMA transfers
+
+bcm2835_smi_dev: Fix handling of word-odd lengths
+
+The read and write functions did not use the correct pointer offset
+when dealing with an odd number of bytes after a DMA transfer. Also,
+only handle the remaining odd bytes if the DMA transfer completed
+successfully.
+
+Submitted-by: @madimario (GitHub)
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+misc: bcm2835_smi: Use proper enum types for dma_{,un}map_single()
+
+Clang warns:
+
+  drivers/misc/bcm2835_smi.c:692:4: warning: implicit conversion from enumeration type 'enum dma_transfer_direction' to different enumeration type 'enum dma_data_direction' [-Wenum-conversion]
+                          DMA_MEM_TO_DEV);
+                          ^~~~~~~~~~~~~~~
+  ./include/linux/dma-mapping.h:406:66: note: expanded from macro 'dma_map_single'
+  #define dma_map_single(d, a, s, r) dma_map_single_attrs(d, a, s, r, 0)
+                                     ~~~~~~~~~~~~~~~~~~~~          ^
+  drivers/misc/bcm2835_smi.c:705:35: warning: implicit conversion from enumeration type 'enum dma_transfer_direction' to different enumeration type 'enum dma_data_direction' [-Wenum-conversion]
+                          (inst->dev, phy_addr, n_bytes, DMA_MEM_TO_DEV);
+                          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~
+  ./include/linux/dma-mapping.h:407:70: note: expanded from macro 'dma_unmap_single'
+  #define dma_unmap_single(d, a, s, r) dma_unmap_single_attrs(d, a, s, r, 0)
+                                       ~~~~~~~~~~~~~~~~~~~~~~          ^
+  drivers/misc/bcm2835_smi.c:751:12: warning: implicit conversion from enumeration type 'enum dma_transfer_direction' to different enumeration type 'enum dma_data_direction' [-Wenum-conversion]
+                                                       DMA_DEV_TO_MEM);
+                                                       ^~~~~~~~~~~~~~~
+  ./include/linux/dma-mapping.h:406:66: note: expanded from macro 'dma_map_single'
+  #define dma_map_single(d, a, s, r) dma_map_single_attrs(d, a, s, r, 0)
+                                     ~~~~~~~~~~~~~~~~~~~~          ^
+  drivers/misc/bcm2835_smi.c:761:50: warning: implicit conversion from enumeration type 'enum dma_transfer_direction' to different enumeration type 'enum dma_data_direction' [-Wenum-conversion]
+                  dma_unmap_single(inst->dev, phy_addr, n_bytes, DMA_DEV_TO_MEM);
+                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~
+  ./include/linux/dma-mapping.h:407:70: note: expanded from macro 'dma_unmap_single'
+  #define dma_unmap_single(d, a, s, r) dma_unmap_single_attrs(d, a, s, r, 0)
+                                       ~~~~~~~~~~~~~~~~~~~~~~          ^
+  4 warnings generated.
+
+Use the proper enumerated type to clear up the warning. There is not
+actually a bug here because the enumerated types have the same integer
+value:
+
+DMA_MEM_TO_DEV = DMA_TO_DEVICE = 1
+DMA_DEV_TO_MEM = DMA_FROM_DEVICE = 2
+
+Fixes: 93254d0f7bc8 ("Add SMI driver")
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+
+bcm2835-smi: Use phys addresses for slave DMA config
+
+Contrary to what struct snd_dmaengine_dai_dma_data suggests, the
+configuration of addresses of DMA slave interfaces should be done in
+CPU physical addresses.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ .../bindings/misc/brcm,bcm2835-smi-dev.txt    |  17 +
+ .../bindings/misc/brcm,bcm2835-smi.txt        |  48 +
+ drivers/char/broadcom/Kconfig                 |   9 +
+ drivers/char/broadcom/Makefile                |   1 +
+ drivers/char/broadcom/bcm2835_smi_dev.c       | 408 ++++++++
+ drivers/misc/Kconfig                          |   8 +
+ drivers/misc/Makefile                         |   1 +
+ drivers/misc/bcm2835_smi.c                    | 952 ++++++++++++++++++
+ include/linux/broadcom/bcm2835_smi.h          | 391 +++++++
+ 9 files changed, 1835 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/misc/brcm,bcm2835-smi-dev.txt
+ create mode 100644 Documentation/devicetree/bindings/misc/brcm,bcm2835-smi.txt
+ create mode 100644 drivers/char/broadcom/bcm2835_smi_dev.c
+ create mode 100644 drivers/misc/bcm2835_smi.c
+ create mode 100644 include/linux/broadcom/bcm2835_smi.h
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/misc/brcm,bcm2835-smi-dev.txt
+@@ -0,0 +1,17 @@
++* Broadcom BCM2835 SMI character device driver.
++
++SMI or secondary memory interface is a peripheral specific to certain Broadcom
++SOCs, and is helpful for talking to things like parallel-interface displays
++and NAND flashes (in fact, most things with a parallel register interface).
++
++This driver adds a character device which provides a user-space interface to
++an instance of the SMI driver.
++
++Required properties:
++- compatible: "brcm,bcm2835-smi-dev"
++- smi_handle: a phandle to the smi node.
++
++Optional properties:
++- None.
++
++
+--- /dev/null
++++ b/Documentation/devicetree/bindings/misc/brcm,bcm2835-smi.txt
+@@ -0,0 +1,48 @@
++* Broadcom BCM2835 SMI driver.
++
++SMI or secondary memory interface is a peripheral specific to certain Broadcom
++SOCs, and is helpful for talking to things like parallel-interface displays
++and NAND flashes (in fact, most things with a parallel register interface).
++
++Required properties:
++- compatible: "brcm,bcm2835-smi"
++- reg: Should contain location and length of SMI registers and SMI clkman regs
++- interrupts: *the* SMI interrupt.
++- pinctrl-names: should be "default".
++- pinctrl-0: the phandle of the gpio pin node.
++- brcm,smi-clock-source: the clock source for clkman
++- brcm,smi-clock-divisor: the integer clock divisor for clkman
++- dmas: the dma controller phandle and the DREQ number (4 on a 2835)
++- dma-names: the name used by the driver to request its channel.
++  Should be "rx-tx".
++
++Optional properties:
++- None.
++
++Examples:
++
++8 data pin configuration:
++
++smi: smi@7e600000 {
++	compatible = "brcm,bcm2835-smi";
++	reg = <0x7e600000 0x44>, <0x7e1010b0 0x8>;
++	interrupts = <2 16>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&smi_pins>;
++	brcm,smi-clock-source = <6>;
++	brcm,smi-clock-divisor = <4>;
++	dmas = <&dma 4>;
++	dma-names = "rx-tx";
++
++	status = "okay";
++};
++
++smi_pins: smi_pins {
++	brcm,pins = <2 3 4 5 6 7 8 9 10 11 12 13 14 15>;
++	/* Alt 1: SMI */
++	brcm,function = <5 5 5 5 5 5 5 5 5 5 5 5 5 5>;
++	/* /CS, /WE and /OE are pulled high, as they are
++	   generally active low signals */
++	brcm,pull = <2 2 2 2 2 2 0 0 0 0 0 0 0 0>;
++};
++
+--- a/drivers/char/broadcom/Kconfig
++++ b/drivers/char/broadcom/Kconfig
+@@ -16,3 +16,12 @@ config BCM2708_VCMEM
+           Helper for videocore memory access and total size allocation.
+ 
+ endif
++
++config BCM2835_SMI_DEV
++	tristate "Character device driver for BCM2835 Secondary Memory Interface"
++	depends on BCM2835_SMI
++	default m
++	help
++		This driver provides a character device interface (ioctl + read/write) to
++		Broadcom's Secondary Memory interface. The low-level functionality is provided
++		by the SMI driver itself.
+--- a/drivers/char/broadcom/Makefile
++++ b/drivers/char/broadcom/Makefile
+@@ -1 +1,2 @@
+ obj-$(CONFIG_BCM2708_VCMEM)	+= vc_mem.o
++obj-$(CONFIG_BCM2835_SMI_DEV)	+= bcm2835_smi_dev.o
+--- /dev/null
++++ b/drivers/char/broadcom/bcm2835_smi_dev.c
+@@ -0,0 +1,408 @@
++/**
++ * Character device driver for Broadcom Secondary Memory Interface
++ *
++ * Written by Luke Wren <luke@raspberrypi.org>
++ * Copyright (c) 2015, Raspberry Pi (Trading) Ltd.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions, and the following disclaimer,
++ *    without modification.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. The names of the above-listed copyright holders may not be used
++ *    to endorse or promote products derived from this software without
++ *    specific prior written permission.
++ *
++ * ALTERNATIVELY, this software may be distributed under the terms of the
++ * GNU General Public License ("GPL") version 2, as published by the Free
++ * Software Foundation.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
++ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
++ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
++ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
++ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
++ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/slab.h>
++#include <linux/mm.h>
++#include <linux/pagemap.h>
++#include <linux/fs.h>
++#include <linux/cdev.h>
++#include <linux/fs.h>
++
++#include <linux/broadcom/bcm2835_smi.h>
++
++#define DEVICE_NAME "bcm2835-smi-dev"
++#define DRIVER_NAME "smi-dev-bcm2835"
++#define DEVICE_MINOR 0
++
++static struct cdev bcm2835_smi_cdev;
++static dev_t bcm2835_smi_devid;
++static struct class *bcm2835_smi_class;
++static struct device *bcm2835_smi_dev;
++
++struct bcm2835_smi_dev_instance {
++	struct device *dev;
++};
++
++static struct bcm2835_smi_instance *smi_inst;
++static struct bcm2835_smi_dev_instance *inst;
++
++static const char *const ioctl_names[] = {
++	"READ_SETTINGS",
++	"WRITE_SETTINGS",
++	"ADDRESS"
++};
++
++/****************************************************************************
++*
++*   SMI chardev file ops
++*
++***************************************************************************/
++static long
++bcm2835_smi_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
++{
++	long ret = 0;
++
++	dev_info(inst->dev, "serving ioctl...");
++
++	switch (cmd) {
++	case BCM2835_SMI_IOC_GET_SETTINGS:{
++		struct smi_settings *settings;
++
++		dev_info(inst->dev, "Reading SMI settings to user.");
++		settings = bcm2835_smi_get_settings_from_regs(smi_inst);
++		if (copy_to_user((void *)arg, settings,
++				 sizeof(struct smi_settings)))
++			dev_err(inst->dev, "settings copy failed.");
++		break;
++	}
++	case BCM2835_SMI_IOC_WRITE_SETTINGS:{
++		struct smi_settings *settings;
++
++		dev_info(inst->dev, "Setting user's SMI settings.");
++		settings = bcm2835_smi_get_settings_from_regs(smi_inst);
++		if (copy_from_user(settings, (void *)arg,
++				   sizeof(struct smi_settings)))
++			dev_err(inst->dev, "settings copy failed.");
++		else
++			bcm2835_smi_set_regs_from_settings(smi_inst);
++		break;
++	}
++	case BCM2835_SMI_IOC_ADDRESS:
++		dev_info(inst->dev, "SMI address set: 0x%02x", (int)arg);
++		bcm2835_smi_set_address(smi_inst, arg);
++		break;
++	default:
++		dev_err(inst->dev, "invalid ioctl cmd: %d", cmd);
++		ret = -ENOTTY;
++		break;
++	}
++
++	return ret;
++}
++
++static int bcm2835_smi_open(struct inode *inode, struct file *file)
++{
++	int dev = iminor(inode);
++
++	dev_dbg(inst->dev, "SMI device opened.");
++
++	if (dev != DEVICE_MINOR) {
++		dev_err(inst->dev,
++			"bcm2835_smi_release: Unknown minor device: %d",
++			dev);
++		return -ENXIO;
++	}
++
++	return 0;
++}
++
++static int bcm2835_smi_release(struct inode *inode, struct file *file)
++{
++	int dev = iminor(inode);
++
++	if (dev != DEVICE_MINOR) {
++		dev_err(inst->dev,
++			"bcm2835_smi_release: Unknown minor device %d", dev);
++		return -ENXIO;
++	}
++
++	return 0;
++}
++
++static ssize_t dma_bounce_user(
++	enum dma_transfer_direction dma_dir,
++	char __user *user_ptr,
++	size_t count,
++	struct bcm2835_smi_bounce_info *bounce)
++{
++	int chunk_size;
++	int chunk_no = 0;
++	int count_left = count;
++
++	while (count_left) {
++		int rv;
++		void *buf;
++
++		/* Wait for current chunk to complete: */
++		if (down_timeout(&bounce->callback_sem,
++			msecs_to_jiffies(1000))) {
++			dev_err(inst->dev, "DMA bounce timed out");
++			count -= (count_left);
++			break;
++		}
++
++		if (bounce->callback_sem.count >= DMA_BOUNCE_BUFFER_COUNT - 1)
++			dev_err(inst->dev, "WARNING: Ring buffer overflow");
++		chunk_size = count_left > DMA_BOUNCE_BUFFER_SIZE ?
++			DMA_BOUNCE_BUFFER_SIZE : count_left;
++		buf = bounce->buffer[chunk_no % DMA_BOUNCE_BUFFER_COUNT];
++		if (dma_dir == DMA_DEV_TO_MEM)
++			rv = copy_to_user(user_ptr, buf, chunk_size);
++		else
++			rv = copy_from_user(buf, user_ptr, chunk_size);
++		if (rv)
++			dev_err(inst->dev, "copy_*_user() failed!: %d", rv);
++		user_ptr += chunk_size;
++		count_left -= chunk_size;
++		chunk_no++;
++	}
++	return count;
++}
++
++static ssize_t
++bcm2835_read_file(struct file *f, char __user *user_ptr,
++		  size_t count, loff_t *offs)
++{
++	int odd_bytes;
++	size_t count_check;
++
++	dev_dbg(inst->dev, "User reading %zu bytes from SMI.", count);
++	/* We don't want to DMA a number of bytes % 4 != 0 (32 bit FIFO) */
++	if (count > DMA_THRESHOLD_BYTES)
++		odd_bytes = count & 0x3;
++	else
++		odd_bytes = count;
++	count -= odd_bytes;
++	count_check = count;
++	if (count) {
++		struct bcm2835_smi_bounce_info *bounce;
++
++		count = bcm2835_smi_user_dma(smi_inst,
++			DMA_DEV_TO_MEM, user_ptr, count,
++			&bounce);
++		if (count)
++			count = dma_bounce_user(DMA_DEV_TO_MEM, user_ptr,
++				count, bounce);
++	}
++	if (odd_bytes && (count == count_check)) {
++		/* Read from FIFO directly if not using DMA */
++		uint8_t buf[DMA_THRESHOLD_BYTES];
++		unsigned long bytes_not_transferred;
++
++		bcm2835_smi_read_buf(smi_inst, buf, odd_bytes);
++		bytes_not_transferred = copy_to_user(user_ptr + count, buf, odd_bytes);
++		if (bytes_not_transferred)
++			dev_err(inst->dev, "copy_to_user() failed.");
++		count += odd_bytes - bytes_not_transferred;
++	}
++	return count;
++}
++
++static ssize_t
++bcm2835_write_file(struct file *f, const char __user *user_ptr,
++		   size_t count, loff_t *offs)
++{
++	int odd_bytes;
++	size_t count_check;
++
++	dev_dbg(inst->dev, "User writing %zu bytes to SMI.", count);
++	if (count > DMA_THRESHOLD_BYTES)
++		odd_bytes = count & 0x3;
++	else
++		odd_bytes = count;
++	count -= odd_bytes;
++	count_check = count;
++	if (count) {
++		struct bcm2835_smi_bounce_info *bounce;
++
++		count = bcm2835_smi_user_dma(smi_inst,
++			DMA_MEM_TO_DEV, (char __user *)user_ptr, count,
++			&bounce);
++		if (count)
++			count = dma_bounce_user(DMA_MEM_TO_DEV,
++				(char __user *)user_ptr,
++				count, bounce);
++	}
++	if (odd_bytes && (count == count_check)) {
++		uint8_t buf[DMA_THRESHOLD_BYTES];
++		unsigned long bytes_not_transferred;
++
++		bytes_not_transferred = copy_from_user(buf, user_ptr + count, odd_bytes);
++		if (bytes_not_transferred)
++			dev_err(inst->dev, "copy_from_user() failed.");
++		else
++			bcm2835_smi_write_buf(smi_inst, buf, odd_bytes);
++		count += odd_bytes - bytes_not_transferred;
++	}
++	return count;
++}
++
++static const struct file_operations
++bcm2835_smi_fops = {
++	.owner = THIS_MODULE,
++	.unlocked_ioctl = bcm2835_smi_ioctl,
++	.open = bcm2835_smi_open,
++	.release = bcm2835_smi_release,
++	.read = bcm2835_read_file,
++	.write = bcm2835_write_file,
++};
++
++
++/****************************************************************************
++*
++*   bcm2835_smi_probe - called when the driver is loaded.
++*
++***************************************************************************/
++
++static int bcm2835_smi_dev_probe(struct platform_device *pdev)
++{
++	int err;
++	void *ptr_err;
++	struct device *dev = &pdev->dev;
++	struct device_node *node = dev->of_node, *smi_node;
++
++	if (!node) {
++		dev_err(dev, "No device tree node supplied!");
++		return -EINVAL;
++	}
++
++	smi_node = of_parse_phandle(node, "smi_handle", 0);
++
++	if (!smi_node) {
++		dev_err(dev, "No such property: smi_handle");
++		return -ENXIO;
++	}
++
++	smi_inst = bcm2835_smi_get(smi_node);
++
++	if (!smi_inst)
++		return -EPROBE_DEFER;
++
++	/* Allocate buffers and instance data */
++
++	inst = devm_kzalloc(dev, sizeof(*inst), GFP_KERNEL);
++
++	if (!inst)
++		return -ENOMEM;
++
++	inst->dev = dev;
++
++	/* Create character device entries */
++
++	err = alloc_chrdev_region(&bcm2835_smi_devid,
++				  DEVICE_MINOR, 1, DEVICE_NAME);
++	if (err != 0) {
++		dev_err(inst->dev, "unable to allocate device number");
++		return -ENOMEM;
++	}
++	cdev_init(&bcm2835_smi_cdev, &bcm2835_smi_fops);
++	bcm2835_smi_cdev.owner = THIS_MODULE;
++	err = cdev_add(&bcm2835_smi_cdev, bcm2835_smi_devid, 1);
++	if (err != 0) {
++		dev_err(inst->dev, "unable to register device");
++		err = -ENOMEM;
++		goto failed_cdev_add;
++	}
++
++	/* Create sysfs entries */
++
++	bcm2835_smi_class = class_create(DEVICE_NAME);
++	ptr_err = bcm2835_smi_class;
++	if (IS_ERR(ptr_err))
++		goto failed_class_create;
++
++	bcm2835_smi_dev = device_create(bcm2835_smi_class, NULL,
++					bcm2835_smi_devid, NULL,
++					"smi");
++	ptr_err = bcm2835_smi_dev;
++	if (IS_ERR(ptr_err))
++		goto failed_device_create;
++
++	dev_info(inst->dev, "initialised");
++
++	return 0;
++
++failed_device_create:
++	class_destroy(bcm2835_smi_class);
++failed_class_create:
++	cdev_del(&bcm2835_smi_cdev);
++	err = PTR_ERR(ptr_err);
++failed_cdev_add:
++	unregister_chrdev_region(bcm2835_smi_devid, 1);
++	dev_err(dev, "could not load bcm2835_smi_dev");
++	return err;
++}
++
++/****************************************************************************
++*
++*   bcm2835_smi_remove - called when the driver is unloaded.
++*
++***************************************************************************/
++
++static void bcm2835_smi_dev_remove(struct platform_device *pdev)
++{
++	device_destroy(bcm2835_smi_class, bcm2835_smi_devid);
++	class_destroy(bcm2835_smi_class);
++	cdev_del(&bcm2835_smi_cdev);
++	unregister_chrdev_region(bcm2835_smi_devid, 1);
++
++	dev_info(inst->dev, "SMI character dev removed - OK");
++}
++
++/****************************************************************************
++*
++*   Register the driver with device tree
++*
++***************************************************************************/
++
++static const struct of_device_id bcm2835_smi_dev_of_match[] = {
++	{.compatible = "brcm,bcm2835-smi-dev",},
++	{ /* sentinel */ },
++};
++
++MODULE_DEVICE_TABLE(of, bcm2835_smi_dev_of_match);
++
++static struct platform_driver bcm2835_smi_dev_driver = {
++	.probe = bcm2835_smi_dev_probe,
++	.remove = bcm2835_smi_dev_remove,
++	.driver = {
++		   .name = DRIVER_NAME,
++		   .owner = THIS_MODULE,
++		   .of_match_table = bcm2835_smi_dev_of_match,
++		   },
++};
++
++module_platform_driver(bcm2835_smi_dev_driver);
++
++MODULE_ALIAS("platform:smi-dev-bcm2835");
++MODULE_LICENSE("GPL");
++MODULE_DESCRIPTION(
++	"Character device driver for BCM2835's secondary memory interface");
++MODULE_AUTHOR("Luke Wren <luke@raspberrypi.org>");
+--- a/drivers/misc/Kconfig
++++ b/drivers/misc/Kconfig
+@@ -9,6 +9,14 @@ config SENSORS_LIS3LV02D
+ 	tristate
+ 	depends on INPUT
+ 
++config BCM2835_SMI
++	tristate "Broadcom 283x Secondary Memory Interface driver"
++	depends on ARCH_BCM2835
++	default m
++	help
++		Driver for enabling and using Broadcom's Secondary/Slow Memory Interface.
++		Appears as /dev/bcm2835_smi. For ioctl interface see drivers/misc/bcm2835_smi.h
++
+ config AD525X_DPOT
+ 	tristate "Analog Devices Digital Potentiometers"
+ 	depends on (I2C || SPI) && SYSFS
+--- a/drivers/misc/Makefile
++++ b/drivers/misc/Makefile
+@@ -9,6 +9,7 @@ obj-$(CONFIG_AD525X_DPOT)	+= ad525x_dpot
+ obj-$(CONFIG_AD525X_DPOT_I2C)	+= ad525x_dpot-i2c.o
+ obj-$(CONFIG_AD525X_DPOT_SPI)	+= ad525x_dpot-spi.o
+ obj-$(CONFIG_ATMEL_SSC)		+= atmel-ssc.o
++obj-$(CONFIG_BCM2835_SMI)	+= bcm2835_smi.o
+ obj-$(CONFIG_DUMMY_IRQ)		+= dummy-irq.o
+ obj-$(CONFIG_ICS932S401)	+= ics932s401.o
+ obj-$(CONFIG_LKDTM)		+= lkdtm/
+--- /dev/null
++++ b/drivers/misc/bcm2835_smi.c
+@@ -0,0 +1,952 @@
++/**
++ * Broadcom Secondary Memory Interface driver
++ *
++ * Written by Luke Wren <luke@raspberrypi.org>
++ * Copyright (c) 2015, Raspberry Pi (Trading) Ltd.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions, and the following disclaimer,
++ *    without modification.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. The names of the above-listed copyright holders may not be used
++ *    to endorse or promote products derived from this software without
++ *    specific prior written permission.
++ *
++ * ALTERNATIVELY, this software may be distributed under the terms of the
++ * GNU General Public License ("GPL") version 2, as published by the Free
++ * Software Foundation.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
++ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
++ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
++ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
++ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
++ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++
++#include <linux/clk.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/of_address.h>
++#include <linux/of_platform.h>
++#include <linux/mm.h>
++#include <linux/slab.h>
++#include <linux/pagemap.h>
++#include <linux/dma-mapping.h>
++#include <linux/dmaengine.h>
++#include <linux/semaphore.h>
++#include <linux/spinlock.h>
++#include <linux/io.h>
++
++#define BCM2835_SMI_IMPLEMENTATION
++#include <linux/broadcom/bcm2835_smi.h>
++
++#define DRIVER_NAME "smi-bcm2835"
++
++#define N_PAGES_FROM_BYTES(n) ((n + PAGE_SIZE-1) / PAGE_SIZE)
++
++#define DMA_WRITE_TO_MEM true
++#define DMA_READ_FROM_MEM false
++
++struct bcm2835_smi_instance {
++	struct device *dev;
++	struct smi_settings settings;
++	__iomem void *smi_regs_ptr;
++	phys_addr_t smi_regs_busaddr;
++
++	struct dma_chan *dma_chan;
++	struct dma_slave_config dma_config;
++
++	struct bcm2835_smi_bounce_info bounce;
++
++	struct scatterlist buffer_sgl;
++
++	struct clk *clk;
++
++	/* Sometimes we are called into in an atomic context (e.g. by
++	   JFFS2 + MTD) so we can't use a mutex */
++	spinlock_t transaction_lock;
++};
++
++/****************************************************************************
++*
++*   SMI peripheral setup
++*
++***************************************************************************/
++
++static inline void write_smi_reg(struct bcm2835_smi_instance *inst,
++	u32 val, unsigned reg)
++{
++	writel(val, inst->smi_regs_ptr + reg);
++}
++
++static inline u32 read_smi_reg(struct bcm2835_smi_instance *inst, unsigned reg)
++{
++	return readl(inst->smi_regs_ptr + reg);
++}
++
++/* Token-paste macro for e.g SMIDSR_RSTROBE ->  value of SMIDSR_RSTROBE_MASK */
++#define _CONCAT(x, y) x##y
++#define CONCAT(x, y) _CONCAT(x, y)
++
++#define SET_BIT_FIELD(dest, field, bits) ((dest) = \
++	((dest) & ~CONCAT(field, _MASK)) | (((bits) << CONCAT(field, _OFFS))& \
++	 CONCAT(field, _MASK)))
++#define GET_BIT_FIELD(src, field) (((src) & \
++	CONCAT(field, _MASK)) >> CONCAT(field, _OFFS))
++
++static void smi_dump_context_labelled(struct bcm2835_smi_instance *inst,
++	const char *label)
++{
++	dev_err(inst->dev, "SMI context dump: %s", label);
++	dev_err(inst->dev, "SMICS:  0x%08x", read_smi_reg(inst, SMICS));
++	dev_err(inst->dev, "SMIL:   0x%08x", read_smi_reg(inst, SMIL));
++	dev_err(inst->dev, "SMIDSR: 0x%08x", read_smi_reg(inst, SMIDSR0));
++	dev_err(inst->dev, "SMIDSW: 0x%08x", read_smi_reg(inst, SMIDSW0));
++	dev_err(inst->dev, "SMIDC:  0x%08x", read_smi_reg(inst, SMIDC));
++	dev_err(inst->dev, "SMIFD:  0x%08x", read_smi_reg(inst, SMIFD));
++	dev_err(inst->dev, " ");
++}
++
++static inline void smi_dump_context(struct bcm2835_smi_instance *inst)
++{
++	smi_dump_context_labelled(inst, "");
++}
++
++static void smi_get_default_settings(struct bcm2835_smi_instance *inst)
++{
++	struct smi_settings *settings = &inst->settings;
++
++	settings->data_width = SMI_WIDTH_16BIT;
++	settings->pack_data = true;
++
++	settings->read_setup_time = 1;
++	settings->read_hold_time = 1;
++	settings->read_pace_time = 1;
++	settings->read_strobe_time = 3;
++
++	settings->write_setup_time = settings->read_setup_time;
++	settings->write_hold_time = settings->read_hold_time;
++	settings->write_pace_time = settings->read_pace_time;
++	settings->write_strobe_time = settings->read_strobe_time;
++
++	settings->dma_enable = true;
++	settings->dma_passthrough_enable = false;
++	settings->dma_read_thresh = 0x01;
++	settings->dma_write_thresh = 0x3f;
++	settings->dma_panic_read_thresh = 0x20;
++	settings->dma_panic_write_thresh = 0x20;
++}
++
++void bcm2835_smi_set_regs_from_settings(struct bcm2835_smi_instance *inst)
++{
++	struct smi_settings *settings = &inst->settings;
++	int smidsr_temp = 0, smidsw_temp = 0, smics_temp,
++	    smidcs_temp, smidc_temp = 0;
++
++	spin_lock(&inst->transaction_lock);
++
++	/* temporarily disable the peripheral: */
++	smics_temp = read_smi_reg(inst, SMICS);
++	write_smi_reg(inst, 0, SMICS);
++	smidcs_temp = read_smi_reg(inst, SMIDCS);
++	write_smi_reg(inst, 0, SMIDCS);
++
++	if (settings->pack_data)
++		smics_temp |= SMICS_PXLDAT;
++	else
++		smics_temp &= ~SMICS_PXLDAT;
++
++	SET_BIT_FIELD(smidsr_temp, SMIDSR_RWIDTH, settings->data_width);
++	SET_BIT_FIELD(smidsr_temp, SMIDSR_RSETUP, settings->read_setup_time);
++	SET_BIT_FIELD(smidsr_temp, SMIDSR_RHOLD, settings->read_hold_time);
++	SET_BIT_FIELD(smidsr_temp, SMIDSR_RPACE, settings->read_pace_time);
++	SET_BIT_FIELD(smidsr_temp, SMIDSR_RSTROBE, settings->read_strobe_time);
++	write_smi_reg(inst, smidsr_temp, SMIDSR0);
++
++	SET_BIT_FIELD(smidsw_temp, SMIDSW_WWIDTH, settings->data_width);
++	if (settings->data_width == SMI_WIDTH_8BIT)
++		smidsw_temp |= SMIDSW_WSWAP;
++	else
++		smidsw_temp &= ~SMIDSW_WSWAP;
++	SET_BIT_FIELD(smidsw_temp, SMIDSW_WSETUP, settings->write_setup_time);
++	SET_BIT_FIELD(smidsw_temp, SMIDSW_WHOLD, settings->write_hold_time);
++	SET_BIT_FIELD(smidsw_temp, SMIDSW_WPACE, settings->write_pace_time);
++	SET_BIT_FIELD(smidsw_temp, SMIDSW_WSTROBE,
++			settings->write_strobe_time);
++	write_smi_reg(inst, smidsw_temp, SMIDSW0);
++
++	SET_BIT_FIELD(smidc_temp, SMIDC_REQR, settings->dma_read_thresh);
++	SET_BIT_FIELD(smidc_temp, SMIDC_REQW, settings->dma_write_thresh);
++	SET_BIT_FIELD(smidc_temp, SMIDC_PANICR,
++		      settings->dma_panic_read_thresh);
++	SET_BIT_FIELD(smidc_temp, SMIDC_PANICW,
++		      settings->dma_panic_write_thresh);
++	if (settings->dma_passthrough_enable) {
++		smidc_temp |= SMIDC_DMAP;
++		smidsr_temp |= SMIDSR_RDREQ;
++		write_smi_reg(inst, smidsr_temp, SMIDSR0);
++		smidsw_temp |= SMIDSW_WDREQ;
++		write_smi_reg(inst, smidsw_temp, SMIDSW0);
++	} else
++		smidc_temp &= ~SMIDC_DMAP;
++	if (settings->dma_enable)
++		smidc_temp |= SMIDC_DMAEN;
++	else
++		smidc_temp &= ~SMIDC_DMAEN;
++
++	write_smi_reg(inst, smidc_temp, SMIDC);
++
++	/* re-enable (if was previously enabled) */
++	write_smi_reg(inst, smics_temp, SMICS);
++	write_smi_reg(inst, smidcs_temp, SMIDCS);
++
++	spin_unlock(&inst->transaction_lock);
++}
++EXPORT_SYMBOL(bcm2835_smi_set_regs_from_settings);
++
++struct smi_settings *bcm2835_smi_get_settings_from_regs
++	(struct bcm2835_smi_instance *inst)
++{
++	struct smi_settings *settings = &inst->settings;
++	int smidsr, smidsw, smidc;
++
++	spin_lock(&inst->transaction_lock);
++
++	smidsr = read_smi_reg(inst, SMIDSR0);
++	smidsw = read_smi_reg(inst, SMIDSW0);
++	smidc = read_smi_reg(inst, SMIDC);
++
++	settings->pack_data = (read_smi_reg(inst, SMICS) & SMICS_PXLDAT) ?
++	    true : false;
++
++	settings->data_width = GET_BIT_FIELD(smidsr, SMIDSR_RWIDTH);
++	settings->read_setup_time = GET_BIT_FIELD(smidsr, SMIDSR_RSETUP);
++	settings->read_hold_time = GET_BIT_FIELD(smidsr, SMIDSR_RHOLD);
++	settings->read_pace_time = GET_BIT_FIELD(smidsr, SMIDSR_RPACE);
++	settings->read_strobe_time = GET_BIT_FIELD(smidsr, SMIDSR_RSTROBE);
++
++	settings->write_setup_time = GET_BIT_FIELD(smidsw, SMIDSW_WSETUP);
++	settings->write_hold_time = GET_BIT_FIELD(smidsw, SMIDSW_WHOLD);
++	settings->write_pace_time = GET_BIT_FIELD(smidsw, SMIDSW_WPACE);
++	settings->write_strobe_time = GET_BIT_FIELD(smidsw, SMIDSW_WSTROBE);
++
++	settings->dma_read_thresh = GET_BIT_FIELD(smidc, SMIDC_REQR);
++	settings->dma_write_thresh = GET_BIT_FIELD(smidc, SMIDC_REQW);
++	settings->dma_panic_read_thresh = GET_BIT_FIELD(smidc, SMIDC_PANICR);
++	settings->dma_panic_write_thresh = GET_BIT_FIELD(smidc, SMIDC_PANICW);
++	settings->dma_passthrough_enable = (smidc & SMIDC_DMAP) ? true : false;
++	settings->dma_enable = (smidc & SMIDC_DMAEN) ? true : false;
++
++	spin_unlock(&inst->transaction_lock);
++
++	return settings;
++}
++EXPORT_SYMBOL(bcm2835_smi_get_settings_from_regs);
++
++static inline void smi_set_address(struct bcm2835_smi_instance *inst,
++	unsigned int address)
++{
++	int smia_temp = 0, smida_temp = 0;
++
++	SET_BIT_FIELD(smia_temp, SMIA_ADDR, address);
++	SET_BIT_FIELD(smida_temp, SMIDA_ADDR, address);
++
++	/* Write to both address registers - user doesn't care whether we're
++	   doing programmed or direct transfers. */
++	write_smi_reg(inst, smia_temp, SMIA);
++	write_smi_reg(inst, smida_temp, SMIDA);
++}
++
++static void smi_setup_regs(struct bcm2835_smi_instance *inst)
++{
++
++	dev_dbg(inst->dev, "Initialising SMI registers...");
++	/* Disable the peripheral if already enabled */
++	write_smi_reg(inst, 0, SMICS);
++	write_smi_reg(inst, 0, SMIDCS);
++
++	smi_get_default_settings(inst);
++	bcm2835_smi_set_regs_from_settings(inst);
++	smi_set_address(inst, 0);
++
++	write_smi_reg(inst, read_smi_reg(inst, SMICS) | SMICS_ENABLE, SMICS);
++	write_smi_reg(inst, read_smi_reg(inst, SMIDCS) | SMIDCS_ENABLE,
++		SMIDCS);
++}
++
++/****************************************************************************
++*
++*   Low-level SMI access functions
++*   Other modules should use the exported higher-level functions e.g.
++*   bcm2835_smi_write_buf() unless they have a good reason to use these
++*
++***************************************************************************/
++
++static inline uint32_t smi_read_single_word(struct bcm2835_smi_instance *inst)
++{
++	int timeout = 0;
++
++	write_smi_reg(inst, SMIDCS_ENABLE, SMIDCS);
++	write_smi_reg(inst, SMIDCS_ENABLE | SMIDCS_START, SMIDCS);
++	/* Make sure things happen in the right order...*/
++	mb();
++	while (!(read_smi_reg(inst, SMIDCS) & SMIDCS_DONE) &&
++		++timeout < 10000)
++		;
++	if (timeout < 10000)
++		return read_smi_reg(inst, SMIDD);
++
++	dev_err(inst->dev,
++		"SMI direct read timed out (is the clock set up correctly?)");
++	return 0;
++}
++
++static inline void smi_write_single_word(struct bcm2835_smi_instance *inst,
++	uint32_t data)
++{
++	int timeout = 0;
++
++	write_smi_reg(inst, SMIDCS_ENABLE | SMIDCS_WRITE, SMIDCS);
++	write_smi_reg(inst, data, SMIDD);
++	write_smi_reg(inst, SMIDCS_ENABLE | SMIDCS_WRITE | SMIDCS_START,
++		SMIDCS);
++
++	while (!(read_smi_reg(inst, SMIDCS) & SMIDCS_DONE) &&
++		++timeout < 10000)
++		;
++	if (timeout >= 10000)
++		dev_err(inst->dev,
++		"SMI direct write timed out (is the clock set up correctly?)");
++}
++
++/* Initiates a programmed read into the read FIFO. It is up to the caller to
++ * read data from the FIFO -  either via paced DMA transfer,
++ * or polling SMICS_RXD to check whether data is available.
++ * SMICS_ACTIVE will go low upon completion. */
++static void smi_init_programmed_read(struct bcm2835_smi_instance *inst,
++	int num_transfers)
++{
++	int smics_temp;
++
++	/* Disable the peripheral: */
++	smics_temp = read_smi_reg(inst, SMICS) & ~(SMICS_ENABLE | SMICS_WRITE);
++	write_smi_reg(inst, smics_temp, SMICS);
++	while (read_smi_reg(inst, SMICS) & SMICS_ENABLE)
++		;
++
++	/* Program the transfer count: */
++	write_smi_reg(inst, num_transfers, SMIL);
++
++	/* re-enable and start: */
++	smics_temp |= SMICS_ENABLE;
++	write_smi_reg(inst, smics_temp, SMICS);
++	smics_temp |= SMICS_CLEAR;
++	/* Just to be certain: */
++	mb();
++	while (read_smi_reg(inst, SMICS) & SMICS_ACTIVE)
++		;
++	write_smi_reg(inst, smics_temp, SMICS);
++	smics_temp |= SMICS_START;
++	write_smi_reg(inst, smics_temp, SMICS);
++}
++
++/* Initiates a programmed write sequence, using data from the write FIFO.
++ * It is up to the caller to initiate a DMA transfer before calling,
++ * or use another method to keep the write FIFO topped up.
++ * SMICS_ACTIVE will go low upon completion.
++ */
++static void smi_init_programmed_write(struct bcm2835_smi_instance *inst,
++	int num_transfers)
++{
++	int smics_temp;
++
++	/* Disable the peripheral: */
++	smics_temp = read_smi_reg(inst, SMICS) & ~SMICS_ENABLE;
++	write_smi_reg(inst, smics_temp, SMICS);
++	while (read_smi_reg(inst, SMICS) & SMICS_ENABLE)
++		;
++
++	/* Program the transfer count: */
++	write_smi_reg(inst, num_transfers, SMIL);
++
++	/* setup, re-enable and start: */
++	smics_temp |= SMICS_WRITE | SMICS_ENABLE;
++	write_smi_reg(inst, smics_temp, SMICS);
++	smics_temp |= SMICS_START;
++	write_smi_reg(inst, smics_temp, SMICS);
++}
++
++/* Initiate a read and then poll FIFO for data, reading out as it appears. */
++static void smi_read_fifo(struct bcm2835_smi_instance *inst,
++	uint32_t *dest, int n_bytes)
++{
++	if (read_smi_reg(inst, SMICS) & SMICS_RXD) {
++		smi_dump_context_labelled(inst,
++			"WARNING: read FIFO not empty at start of read call.");
++		while (read_smi_reg(inst, SMICS))
++			;
++	}
++
++	/* Dispatch the read: */
++	if (inst->settings.data_width == SMI_WIDTH_8BIT)
++		smi_init_programmed_read(inst, n_bytes);
++	else if (inst->settings.data_width == SMI_WIDTH_16BIT)
++		smi_init_programmed_read(inst, n_bytes / 2);
++	else {
++		dev_err(inst->dev, "Unsupported data width for read.");
++		return;
++	}
++
++	/* Poll FIFO to keep it empty */
++	while (!(read_smi_reg(inst, SMICS) & SMICS_DONE))
++		if (read_smi_reg(inst, SMICS) & SMICS_RXD)
++			*dest++ = read_smi_reg(inst, SMID);
++
++	/* Ensure that the FIFO is emptied */
++	if (read_smi_reg(inst, SMICS) & SMICS_RXD) {
++		int fifo_count;
++
++		fifo_count = GET_BIT_FIELD(read_smi_reg(inst, SMIFD),
++			SMIFD_FCNT);
++		while (fifo_count--)
++			*dest++ = read_smi_reg(inst, SMID);
++	}
++
++	if (!(read_smi_reg(inst, SMICS) & SMICS_DONE))
++		smi_dump_context_labelled(inst,
++			"WARNING: transaction finished but done bit not set.");
++
++	if (read_smi_reg(inst, SMICS) & SMICS_RXD)
++		smi_dump_context_labelled(inst,
++			"WARNING: read FIFO not empty at end of read call.");
++
++}
++
++/* Initiate a write, and then keep the FIFO topped up. */
++static void smi_write_fifo(struct bcm2835_smi_instance *inst,
++	uint32_t *src, int n_bytes)
++{
++	int i, timeout = 0;
++
++	/* Empty FIFOs if not already so */
++	if (!(read_smi_reg(inst, SMICS) & SMICS_TXE)) {
++		smi_dump_context_labelled(inst,
++		    "WARNING: write fifo not empty at start of write call.");
++		write_smi_reg(inst, read_smi_reg(inst, SMICS) | SMICS_CLEAR,
++			SMICS);
++	}
++
++	/* Initiate the transfer */
++	if (inst->settings.data_width == SMI_WIDTH_8BIT)
++		smi_init_programmed_write(inst, n_bytes);
++	else if (inst->settings.data_width == SMI_WIDTH_16BIT)
++		smi_init_programmed_write(inst, n_bytes / 2);
++	else {
++		dev_err(inst->dev, "Unsupported data width for write.");
++		return;
++	}
++	/* Fill the FIFO: */
++	for (i = 0; i < (n_bytes - 1) / 4 + 1; ++i) {
++		while (!(read_smi_reg(inst, SMICS) & SMICS_TXD))
++			;
++		write_smi_reg(inst, *src++, SMID);
++	}
++	/* Busy wait... */
++	while (!(read_smi_reg(inst, SMICS) & SMICS_DONE) && ++timeout <
++		1000000)
++		;
++	if (timeout >= 1000000)
++		smi_dump_context_labelled(inst,
++			"Timed out on write operation!");
++	if (!(read_smi_reg(inst, SMICS) & SMICS_TXE))
++		smi_dump_context_labelled(inst,
++			"WARNING: FIFO not empty at end of write operation.");
++}
++
++/****************************************************************************
++*
++*   SMI DMA operations
++*
++***************************************************************************/
++
++/* Disable SMI and put it into the correct direction before doing DMA setup.
++   Stops spurious DREQs during setup. Peripheral is re-enabled by init_*() */
++static void smi_disable(struct bcm2835_smi_instance *inst,
++	enum dma_transfer_direction direction)
++{
++	int smics_temp = read_smi_reg(inst, SMICS) & ~SMICS_ENABLE;
++
++	if (direction == DMA_DEV_TO_MEM)
++		smics_temp &= ~SMICS_WRITE;
++	else
++		smics_temp |= SMICS_WRITE;
++	write_smi_reg(inst, smics_temp, SMICS);
++	while (read_smi_reg(inst, SMICS) & SMICS_ACTIVE)
++		;
++}
++
++static struct scatterlist *smi_scatterlist_from_buffer(
++	struct bcm2835_smi_instance *inst,
++	dma_addr_t buf,
++	size_t len,
++	struct scatterlist *sg)
++{
++	sg_init_table(sg, 1);
++	sg_dma_address(sg) = buf;
++	sg_dma_len(sg) = len;
++	return sg;
++}
++
++static void smi_dma_callback_user_copy(void *param)
++{
++	/* Notify the bottom half that a chunk is ready for user copy */
++	struct bcm2835_smi_instance *inst =
++		(struct bcm2835_smi_instance *)param;
++
++	up(&inst->bounce.callback_sem);
++}
++
++/* Creates a descriptor, assigns the given callback, and submits the
++   descriptor to dmaengine. Does not block - can queue up multiple
++   descriptors and then wait for them all to complete.
++   sg_len is the number of control blocks, NOT the number of bytes.
++   dir can be DMA_MEM_TO_DEV or DMA_DEV_TO_MEM.
++   callback can be NULL - in this case it is not called. */
++static inline struct dma_async_tx_descriptor *smi_dma_submit_sgl(
++	struct bcm2835_smi_instance *inst,
++	struct scatterlist *sgl,
++	size_t sg_len,
++	enum dma_transfer_direction dir,
++	dma_async_tx_callback callback)
++{
++	struct dma_async_tx_descriptor *desc;
++
++	desc = dmaengine_prep_slave_sg(inst->dma_chan,
++				       sgl,
++				       sg_len,
++				       dir,
++				       DMA_PREP_INTERRUPT | DMA_CTRL_ACK |
++				       DMA_PREP_FENCE);
++	if (!desc) {
++		dev_err(inst->dev, "read_sgl: dma slave preparation failed!");
++		write_smi_reg(inst, read_smi_reg(inst, SMICS) & ~SMICS_ACTIVE,
++			SMICS);
++		while (read_smi_reg(inst, SMICS) & SMICS_ACTIVE)
++			cpu_relax();
++		write_smi_reg(inst, read_smi_reg(inst, SMICS) | SMICS_ACTIVE,
++			SMICS);
++		return NULL;
++	}
++	desc->callback = callback;
++	desc->callback_param = inst;
++	if (dmaengine_submit(desc) < 0)
++		return NULL;
++	return desc;
++}
++
++/* NB this function blocks until the transfer is complete */
++static void
++smi_dma_read_sgl(struct bcm2835_smi_instance *inst,
++	struct scatterlist *sgl, size_t sg_len, size_t n_bytes)
++{
++	struct dma_async_tx_descriptor *desc;
++
++	/* Disable SMI and set to read before dispatching DMA - if SMI is in
++	 * write mode and TX fifo is empty, it will generate a DREQ which may
++	 * cause the read DMA to complete before the SMI read command is even
++	 * dispatched! We want to dispatch DMA before SMI read so that reading
++	 * is gapless, for logic analyser.
++	 */
++
++	smi_disable(inst, DMA_DEV_TO_MEM);
++
++	desc = smi_dma_submit_sgl(inst, sgl, sg_len, DMA_DEV_TO_MEM, NULL);
++	dma_async_issue_pending(inst->dma_chan);
++
++	if (inst->settings.data_width == SMI_WIDTH_8BIT)
++		smi_init_programmed_read(inst, n_bytes);
++	else
++		smi_init_programmed_read(inst, n_bytes / 2);
++
++	if (dma_wait_for_async_tx(desc) == DMA_ERROR)
++		smi_dump_context_labelled(inst, "DMA timeout!");
++}
++
++static void
++smi_dma_write_sgl(struct bcm2835_smi_instance *inst,
++	struct scatterlist *sgl, size_t sg_len, size_t n_bytes)
++{
++	struct dma_async_tx_descriptor *desc;
++
++	if (inst->settings.data_width == SMI_WIDTH_8BIT)
++		smi_init_programmed_write(inst, n_bytes);
++	else
++		smi_init_programmed_write(inst, n_bytes / 2);
++
++	desc = smi_dma_submit_sgl(inst, sgl, sg_len, DMA_MEM_TO_DEV, NULL);
++	dma_async_issue_pending(inst->dma_chan);
++
++	if (dma_wait_for_async_tx(desc) == DMA_ERROR)
++		smi_dump_context_labelled(inst, "DMA timeout!");
++	else
++		/* Wait for SMI to finish our writes */
++		while (!(read_smi_reg(inst, SMICS) & SMICS_DONE))
++			cpu_relax();
++}
++
++ssize_t bcm2835_smi_user_dma(
++	struct bcm2835_smi_instance *inst,
++	enum dma_transfer_direction dma_dir,
++	char __user *user_ptr, size_t count,
++	struct bcm2835_smi_bounce_info **bounce)
++{
++	int chunk_no = 0, chunk_size, count_left = count;
++	struct scatterlist *sgl;
++	void (*init_trans_func)(struct bcm2835_smi_instance *, int);
++
++	spin_lock(&inst->transaction_lock);
++
++	if (dma_dir == DMA_DEV_TO_MEM)
++		init_trans_func = smi_init_programmed_read;
++	else
++		init_trans_func = smi_init_programmed_write;
++
++	smi_disable(inst, dma_dir);
++
++	sema_init(&inst->bounce.callback_sem, 0);
++	if (bounce)
++		*bounce = &inst->bounce;
++	while (count_left) {
++		chunk_size = count_left > DMA_BOUNCE_BUFFER_SIZE ?
++			DMA_BOUNCE_BUFFER_SIZE : count_left;
++		if (chunk_size == DMA_BOUNCE_BUFFER_SIZE) {
++			sgl =
++			&inst->bounce.sgl[chunk_no % DMA_BOUNCE_BUFFER_COUNT];
++		} else {
++			sgl = smi_scatterlist_from_buffer(
++				inst,
++				inst->bounce.phys[
++					chunk_no % DMA_BOUNCE_BUFFER_COUNT],
++				chunk_size,
++				&inst->buffer_sgl);
++		}
++
++		if (!smi_dma_submit_sgl(inst, sgl, 1, dma_dir,
++			smi_dma_callback_user_copy
++		)) {
++			dev_err(inst->dev, "sgl submit failed");
++			count = 0;
++			goto out;
++		}
++		count_left -= chunk_size;
++		chunk_no++;
++	}
++	dma_async_issue_pending(inst->dma_chan);
++
++	if (inst->settings.data_width == SMI_WIDTH_8BIT)
++		init_trans_func(inst, count);
++	else if (inst->settings.data_width == SMI_WIDTH_16BIT)
++		init_trans_func(inst, count / 2);
++out:
++	spin_unlock(&inst->transaction_lock);
++	return count;
++}
++EXPORT_SYMBOL(bcm2835_smi_user_dma);
++
++
++/****************************************************************************
++*
++*   High level buffer transfer functions - for use by other drivers
++*
++***************************************************************************/
++
++/* Buffer must be physically contiguous - i.e. kmalloc, not vmalloc! */
++void bcm2835_smi_write_buf(
++	struct bcm2835_smi_instance *inst,
++	const void *buf, size_t n_bytes)
++{
++	int odd_bytes = n_bytes & 0x3;
++
++	n_bytes -= odd_bytes;
++
++	spin_lock(&inst->transaction_lock);
++
++	if (n_bytes > DMA_THRESHOLD_BYTES) {
++		dma_addr_t phy_addr = dma_map_single(
++			inst->dev,
++			(void *)buf,
++			n_bytes,
++			DMA_TO_DEVICE);
++		struct scatterlist *sgl =
++			smi_scatterlist_from_buffer(inst, phy_addr, n_bytes,
++				&inst->buffer_sgl);
++
++		if (!sgl) {
++			smi_dump_context_labelled(inst,
++			"Error: could not create scatterlist for write!");
++			goto out;
++		}
++		smi_dma_write_sgl(inst, sgl, 1, n_bytes);
++
++		dma_unmap_single
++			(inst->dev, phy_addr, n_bytes, DMA_TO_DEVICE);
++	} else if (n_bytes) {
++		smi_write_fifo(inst, (uint32_t *) buf, n_bytes);
++	}
++	buf += n_bytes;
++
++	if (inst->settings.data_width == SMI_WIDTH_8BIT) {
++		while (odd_bytes--)
++			smi_write_single_word(inst, *(uint8_t *) (buf++));
++	} else {
++		while (odd_bytes >= 2) {
++			smi_write_single_word(inst, *(uint16_t *)buf);
++			buf += 2;
++			odd_bytes -= 2;
++		}
++		if (odd_bytes) {
++			/* Reading an odd number of bytes on a 16 bit bus is
++			   a user bug. It's kinder to fail early and tell them
++			   than to e.g. transparently give them the bottom byte
++			   of a 16 bit transfer. */
++			dev_err(inst->dev,
++		"WARNING: odd number of bytes specified for wide transfer.");
++			dev_err(inst->dev,
++		"At least one byte dropped as a result.");
++			dump_stack();
++		}
++	}
++out:
++	spin_unlock(&inst->transaction_lock);
++}
++EXPORT_SYMBOL(bcm2835_smi_write_buf);
++
++void bcm2835_smi_read_buf(struct bcm2835_smi_instance *inst,
++	void *buf, size_t n_bytes)
++{
++
++	/* SMI is inherently 32-bit, which causes surprising amounts of mess
++	   for bytes % 4 != 0. Easiest to avoid this mess altogether
++	   by handling remainder separately. */
++	int odd_bytes = n_bytes & 0x3;
++
++	spin_lock(&inst->transaction_lock);
++	n_bytes -= odd_bytes;
++	if (n_bytes > DMA_THRESHOLD_BYTES) {
++		dma_addr_t phy_addr = dma_map_single(inst->dev,
++						     buf, n_bytes,
++						     DMA_FROM_DEVICE);
++		struct scatterlist *sgl = smi_scatterlist_from_buffer(
++			inst, phy_addr, n_bytes,
++			&inst->buffer_sgl);
++		if (!sgl) {
++			smi_dump_context_labelled(inst,
++			"Error: could not create scatterlist for read!");
++			goto out;
++		}
++		smi_dma_read_sgl(inst, sgl, 1, n_bytes);
++		dma_unmap_single(inst->dev, phy_addr, n_bytes, DMA_FROM_DEVICE);
++	} else if (n_bytes) {
++		smi_read_fifo(inst, (uint32_t *)buf, n_bytes);
++	}
++	buf += n_bytes;
++
++	if (inst->settings.data_width == SMI_WIDTH_8BIT) {
++		while (odd_bytes--)
++			*((uint8_t *) (buf++)) = smi_read_single_word(inst);
++	} else {
++		while (odd_bytes >= 2) {
++			*(uint16_t *) buf = smi_read_single_word(inst);
++			buf += 2;
++			odd_bytes -= 2;
++		}
++		if (odd_bytes) {
++			dev_err(inst->dev,
++		"WARNING: odd number of bytes specified for wide transfer.");
++			dev_err(inst->dev,
++		"At least one byte dropped as a result.");
++			dump_stack();
++		}
++	}
++out:
++	spin_unlock(&inst->transaction_lock);
++}
++EXPORT_SYMBOL(bcm2835_smi_read_buf);
++
++void bcm2835_smi_set_address(struct bcm2835_smi_instance *inst,
++	unsigned int address)
++{
++	spin_lock(&inst->transaction_lock);
++	smi_set_address(inst, address);
++	spin_unlock(&inst->transaction_lock);
++}
++EXPORT_SYMBOL(bcm2835_smi_set_address);
++
++struct bcm2835_smi_instance *bcm2835_smi_get(struct device_node *node)
++{
++	struct platform_device *pdev;
++
++	if (!node)
++		return NULL;
++
++	pdev = of_find_device_by_node(node);
++	if (!pdev)
++		return NULL;
++
++	return platform_get_drvdata(pdev);
++}
++EXPORT_SYMBOL(bcm2835_smi_get);
++
++/****************************************************************************
++*
++*   bcm2835_smi_probe - called when the driver is loaded.
++*
++***************************************************************************/
++
++static int bcm2835_smi_dma_setup(struct bcm2835_smi_instance *inst)
++{
++	int i, rv = 0;
++
++	inst->dma_chan = dma_request_slave_channel(inst->dev, "rx-tx");
++
++	inst->dma_config.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
++	inst->dma_config.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
++	inst->dma_config.src_addr = inst->smi_regs_busaddr + SMID;
++	inst->dma_config.dst_addr = inst->dma_config.src_addr;
++	/* Direction unimportant - always overridden by prep_slave_sg */
++	inst->dma_config.direction = DMA_DEV_TO_MEM;
++	dmaengine_slave_config(inst->dma_chan, &inst->dma_config);
++	/* Alloc and map bounce buffers */
++	for (i = 0; i < DMA_BOUNCE_BUFFER_COUNT; ++i) {
++		inst->bounce.buffer[i] =
++		dmam_alloc_coherent(inst->dev, DMA_BOUNCE_BUFFER_SIZE,
++				&inst->bounce.phys[i],
++				GFP_KERNEL);
++		if (!inst->bounce.buffer[i]) {
++			dev_err(inst->dev, "Could not allocate buffer!");
++			rv = -ENOMEM;
++			break;
++		}
++		smi_scatterlist_from_buffer(
++			inst,
++			inst->bounce.phys[i],
++			DMA_BOUNCE_BUFFER_SIZE,
++			&inst->bounce.sgl[i]
++		);
++	}
++
++	return rv;
++}
++
++static int bcm2835_smi_probe(struct platform_device *pdev)
++{
++	int err;
++	struct device *dev = &pdev->dev;
++	struct device_node *node = dev->of_node;
++	struct resource *ioresource;
++	struct bcm2835_smi_instance *inst;
++
++	/* We require device tree support */
++	if (!node)
++		return -EINVAL;
++	/* Allocate buffers and instance data */
++	inst = devm_kzalloc(dev, sizeof(struct bcm2835_smi_instance),
++		GFP_KERNEL);
++	if (!inst)
++		return -ENOMEM;
++
++	inst->dev = dev;
++	spin_lock_init(&inst->transaction_lock);
++
++	inst->smi_regs_ptr = devm_platform_get_and_ioremap_resource(pdev, 0,
++								    &ioresource);
++	if (IS_ERR(inst->smi_regs_ptr)) {
++		err = PTR_ERR(inst->smi_regs_ptr);
++		goto err;
++	}
++	inst->smi_regs_busaddr = ioresource->start;
++
++	err = bcm2835_smi_dma_setup(inst);
++	if (err)
++		goto err;
++
++	/* request clock */
++	inst->clk = devm_clk_get(dev, NULL);
++	if (!inst->clk)
++		goto err;
++	clk_prepare_enable(inst->clk);
++
++	/* Finally, do peripheral setup */
++	smi_setup_regs(inst);
++
++	platform_set_drvdata(pdev, inst);
++
++	dev_info(inst->dev, "initialised");
++
++	return 0;
++err:
++	kfree(inst);
++	return err;
++}
++
++/****************************************************************************
++*
++*   bcm2835_smi_remove - called when the driver is unloaded.
++*
++***************************************************************************/
++
++static void bcm2835_smi_remove(struct platform_device *pdev)
++{
++	struct bcm2835_smi_instance *inst = platform_get_drvdata(pdev);
++	struct device *dev = inst->dev;
++
++	dmaengine_terminate_all(inst->dma_chan);
++	dma_release_channel(inst->dma_chan);
++
++	clk_disable_unprepare(inst->clk);
++
++	dev_info(dev, "SMI device removed - OK");
++}
++
++/****************************************************************************
++*
++*   Register the driver with device tree
++*
++***************************************************************************/
++
++static const struct of_device_id bcm2835_smi_of_match[] = {
++	{.compatible = "brcm,bcm2835-smi",},
++	{ /* sentinel */ },
++};
++
++MODULE_DEVICE_TABLE(of, bcm2835_smi_of_match);
++
++static struct platform_driver bcm2835_smi_driver = {
++	.probe = bcm2835_smi_probe,
++	.remove = bcm2835_smi_remove,
++	.driver = {
++		   .name = DRIVER_NAME,
++		   .owner = THIS_MODULE,
++		   .of_match_table = bcm2835_smi_of_match,
++		   },
++};
++
++module_platform_driver(bcm2835_smi_driver);
++
++MODULE_ALIAS("platform:smi-bcm2835");
++MODULE_LICENSE("GPL");
++MODULE_DESCRIPTION("Device driver for BCM2835's secondary memory interface");
++MODULE_AUTHOR("Luke Wren <luke@raspberrypi.org>");
+--- /dev/null
++++ b/include/linux/broadcom/bcm2835_smi.h
+@@ -0,0 +1,391 @@
++/**
++ * Declarations and definitions for Broadcom's Secondary Memory Interface
++ *
++ * Written by Luke Wren <luke@raspberrypi.org>
++ * Copyright (c) 2015, Raspberry Pi (Trading) Ltd.
++ * Copyright (c) 2010-2012 Broadcom. All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions, and the following disclaimer,
++ *    without modification.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. The names of the above-listed copyright holders may not be used
++ *    to endorse or promote products derived from this software without
++ *    specific prior written permission.
++ *
++ * ALTERNATIVELY, this software may be distributed under the terms of the
++ * GNU General Public License ("GPL") version 2, as published by the Free
++ * Software Foundation.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
++ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
++ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
++ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
++ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
++ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++
++#ifndef BCM2835_SMI_H
++#define BCM2835_SMI_H
++
++#include <linux/ioctl.h>
++
++#ifndef __KERNEL__
++#include <stdint.h>
++#include <stdbool.h>
++#endif
++
++#define BCM2835_SMI_IOC_MAGIC 0x1
++#define BCM2835_SMI_INVALID_HANDLE (~0)
++
++/* IOCTLs 0x100...0x1ff are not device-specific - we can use them */
++#define BCM2835_SMI_IOC_GET_SETTINGS    _IO(BCM2835_SMI_IOC_MAGIC, 0)
++#define BCM2835_SMI_IOC_WRITE_SETTINGS  _IO(BCM2835_SMI_IOC_MAGIC, 1)
++#define BCM2835_SMI_IOC_ADDRESS	 _IO(BCM2835_SMI_IOC_MAGIC, 2)
++#define BCM2835_SMI_IOC_MAX	     2
++
++#define SMI_WIDTH_8BIT 0
++#define SMI_WIDTH_16BIT 1
++#define SMI_WIDTH_9BIT 2
++#define SMI_WIDTH_18BIT 3
++
++/* max number of bytes where DMA will not be used */
++#define DMA_THRESHOLD_BYTES 128
++#define DMA_BOUNCE_BUFFER_SIZE (1024 * 1024 / 2)
++#define DMA_BOUNCE_BUFFER_COUNT 3
++
++
++struct smi_settings {
++	int data_width;
++	/* Whether or not to pack multiple SMI transfers into a
++	   single 32 bit FIFO word */
++	bool pack_data;
++
++	/* Timing for reads (writes the same but for WE)
++	 *
++	 * OE ----------+	   +--------------------
++	 *		|	   |
++	 *		+----------+
++	 * SD -<==============================>-----------
++	 * SA -<=========================================>-
++	 *    <-setup->  <-strobe ->  <-hold ->  <- pace ->
++	 */
++
++	int read_setup_time;
++	int read_hold_time;
++	int read_pace_time;
++	int read_strobe_time;
++
++	int write_setup_time;
++	int write_hold_time;
++	int write_pace_time;
++	int write_strobe_time;
++
++	bool dma_enable;		/* DREQs */
++	bool dma_passthrough_enable;	/* External DREQs */
++	int dma_read_thresh;
++	int dma_write_thresh;
++	int dma_panic_read_thresh;
++	int dma_panic_write_thresh;
++};
++
++/****************************************************************************
++*
++*   Declare exported SMI functions
++*
++***************************************************************************/
++
++#ifdef __KERNEL__
++
++#include <linux/dmaengine.h> /* for enum dma_transfer_direction */
++#include <linux/of.h>
++#include <linux/semaphore.h>
++
++struct bcm2835_smi_instance;
++
++struct bcm2835_smi_bounce_info {
++	struct semaphore callback_sem;
++	void *buffer[DMA_BOUNCE_BUFFER_COUNT];
++	dma_addr_t phys[DMA_BOUNCE_BUFFER_COUNT];
++	struct scatterlist sgl[DMA_BOUNCE_BUFFER_COUNT];
++};
++
++
++void bcm2835_smi_set_regs_from_settings(struct bcm2835_smi_instance *);
++
++struct smi_settings *bcm2835_smi_get_settings_from_regs(
++	struct bcm2835_smi_instance *inst);
++
++void bcm2835_smi_write_buf(
++	struct bcm2835_smi_instance *inst,
++	const void *buf,
++	size_t n_bytes);
++
++void bcm2835_smi_read_buf(
++	struct bcm2835_smi_instance *inst,
++	void *buf,
++	size_t n_bytes);
++
++void bcm2835_smi_set_address(struct bcm2835_smi_instance *inst,
++	unsigned int address);
++
++ssize_t bcm2835_smi_user_dma(
++	struct bcm2835_smi_instance *inst,
++	enum dma_transfer_direction dma_dir,
++	char __user *user_ptr,
++	size_t count,
++	struct bcm2835_smi_bounce_info **bounce);
++
++struct bcm2835_smi_instance *bcm2835_smi_get(struct device_node *node);
++
++#endif /* __KERNEL__ */
++
++/****************************************************************
++*
++*	Implementation-only declarations
++*
++****************************************************************/
++
++#ifdef BCM2835_SMI_IMPLEMENTATION
++
++/* Clock manager registers for SMI clock: */
++#define CM_SMI_BASE_ADDRESS ((BCM2708_PERI_BASE) + 0x1010b0)
++/* Clock manager "password" to protect registers from spurious writes */
++#define CM_PWD (0x5a << 24)
++
++#define CM_SMI_CTL	0x00
++#define CM_SMI_DIV	0x04
++
++#define CM_SMI_CTL_FLIP (1 << 8)
++#define CM_SMI_CTL_BUSY (1 << 7)
++#define CM_SMI_CTL_KILL (1 << 5)
++#define CM_SMI_CTL_ENAB (1 << 4)
++#define CM_SMI_CTL_SRC_MASK (0xf)
++#define CM_SMI_CTL_SRC_OFFS (0)
++
++#define CM_SMI_DIV_DIVI_MASK (0xf <<  12)
++#define CM_SMI_DIV_DIVI_OFFS (12)
++#define CM_SMI_DIV_DIVF_MASK (0xff << 4)
++#define CM_SMI_DIV_DIVF_OFFS (4)
++
++/* SMI register mapping:*/
++#define SMI_BASE_ADDRESS ((BCM2708_PERI_BASE) + 0x600000)
++
++#define SMICS	0x00	/* control + status register		*/
++#define SMIL	0x04	/* length/count (n external txfers)	*/
++#define SMIA	0x08	/* address register			*/
++#define SMID	0x0c	/* data register			*/
++#define SMIDSR0	0x10	/* device 0 read settings		*/
++#define SMIDSW0	0x14	/* device 0 write settings		*/
++#define SMIDSR1	0x18	/* device 1 read settings		*/
++#define SMIDSW1	0x1c	/* device 1 write settings		*/
++#define SMIDSR2	0x20	/* device 2 read settings		*/
++#define SMIDSW2	0x24	/* device 2 write settings		*/
++#define SMIDSR3	0x28	/* device 3 read settings		*/
++#define SMIDSW3	0x2c	/* device 3 write settings		*/
++#define SMIDC	0x30	/* DMA control registers		*/
++#define SMIDCS	0x34	/* direct control/status register	*/
++#define SMIDA	0x38	/* direct address register		*/
++#define SMIDD	0x3c	/* direct data registers		*/
++#define SMIFD	0x40	/* FIFO debug register			*/
++
++
++
++/* Control and Status register bits:
++ * SMICS_RXF	: RX fifo full: 1 when RX fifo is full
++ * SMICS_TXE	: TX fifo empty: 1 when empty.
++ * SMICS_RXD	: RX fifo contains data: 1 when there is data.
++ * SMICS_TXD	: TX fifo can accept data: 1 when true.
++ * SMICS_RXR	: RX fifo needs reading: 1 when fifo more than 3/4 full, or
++ *		  when "DONE" and fifo not emptied.
++ * SMICS_TXW	: TX fifo needs writing: 1 when less than 1/4 full.
++ * SMICS_AFERR	: AXI FIFO error: 1 when fifo read when empty or written
++ *		  when full. Write 1 to clear.
++ * SMICS_EDREQ	: 1 when external DREQ received.
++ * SMICS_PXLDAT	:  Pixel data:	write 1 to enable pixel transfer modes.
++ * SMICS_SETERR	: 1 if there was an error writing to setup regs (e.g.
++ *		  tx was in progress). Write 1 to clear.
++ * SMICS_PVMODE	: Set to 1 to enable pixel valve mode.
++ * SMICS_INTR	: Set to 1 to enable interrupt on RX.
++ * SMICS_INTT	: Set to 1 to enable interrupt on TX.
++ * SMICS_INTD	: Set to 1 to enable interrupt on DONE condition.
++ * SMICS_TEEN	: Tear effect mode enabled: Programmed transfers will wait
++ *		  for a TE trigger before writing.
++ * SMICS_PAD1	: Padding settings for external transfers. For writes: the
++ *		  number of bytes initially written to  the TX fifo that
++ * SMICS_PAD0	: should be ignored. For reads: the number of bytes that will
++ *		  be read before the data, and should be dropped.
++ * SMICS_WRITE	: Transfer direction: 1 = write to external device, 0 = read
++ * SMICS_CLEAR	: Write 1 to clear the FIFOs.
++ * SMICS_START	: Write 1 to start the programmed transfer.
++ * SMICS_ACTIVE	: Reads as 1 when a programmed transfer is underway.
++ * SMICS_DONE	: Reads as 1 when transfer finished. For RX, not set until
++ *		  FIFO emptied.
++ * SMICS_ENABLE	: Set to 1 to enable the SMI peripheral, 0 to disable.
++ */
++
++#define SMICS_RXF	(1 << 31)
++#define SMICS_TXE	(1 << 30)
++#define SMICS_RXD	(1 << 29)
++#define SMICS_TXD	(1 << 28)
++#define SMICS_RXR	(1 << 27)
++#define SMICS_TXW	(1 << 26)
++#define SMICS_AFERR	(1 << 25)
++#define SMICS_EDREQ	(1 << 15)
++#define SMICS_PXLDAT	(1 << 14)
++#define SMICS_SETERR	(1 << 13)
++#define SMICS_PVMODE	(1 << 12)
++#define SMICS_INTR	(1 << 11)
++#define SMICS_INTT	(1 << 10)
++#define SMICS_INTD	(1 << 9)
++#define SMICS_TEEN	(1 << 8)
++#define SMICS_PAD1	(1 << 7)
++#define SMICS_PAD0	(1 << 6)
++#define SMICS_WRITE	(1 << 5)
++#define SMICS_CLEAR	(1 << 4)
++#define SMICS_START	(1 << 3)
++#define SMICS_ACTIVE	(1 << 2)
++#define SMICS_DONE	(1 << 1)
++#define SMICS_ENABLE	(1 << 0)
++
++/* Address register bits: */
++
++#define SMIA_DEVICE_MASK ((1 << 9) | (1 << 8))
++#define SMIA_DEVICE_OFFS (8)
++#define SMIA_ADDR_MASK (0x3f)	/* bits 5 -> 0 */
++#define SMIA_ADDR_OFFS (0)
++
++/* DMA control register bits:
++ * SMIDC_DMAEN	: DMA enable: set 1: DMA requests will be issued.
++ * SMIDC_DMAP	: DMA passthrough: when set to 0, top two data pins are used by
++ *		  SMI as usual. When set to 1, the top two pins are used for
++ *		  external DREQs: pin 16 read request, 17 write.
++ * SMIDC_PANIC*	: Threshold at which DMA will panic during read/write.
++ * SMIDC_REQ*	: Threshold at which DMA will generate a DREQ.
++ */
++
++#define SMIDC_DMAEN		(1 << 28)
++#define SMIDC_DMAP		(1 << 24)
++#define SMIDC_PANICR_MASK	(0x3f << 18)
++#define SMIDC_PANICR_OFFS	(18)
++#define SMIDC_PANICW_MASK	(0x3f << 12)
++#define SMIDC_PANICW_OFFS	(12)
++#define SMIDC_REQR_MASK		(0x3f << 6)
++#define SMIDC_REQR_OFFS		(6)
++#define SMIDC_REQW_MASK		(0x3f)
++#define SMIDC_REQW_OFFS		(0)
++
++/* Device settings register bits: same for all 4 (or 3?) device register sets.
++ * Device read settings:
++ * SMIDSR_RWIDTH	: Read transfer width. 00 = 8bit, 01 = 16bit,
++ *			  10 = 18bit, 11 = 9bit.
++ * SMIDSR_RSETUP	: Read setup time: number of core cycles between chip
++ *			  select/address and read strobe. Min 1, max 64.
++ * SMIDSR_MODE68	: 1 for System 68 mode (i.e. enable + direction pins,
++ *			  rather than OE + WE pin)
++ * SMIDSR_FSETUP	: If set to 1, setup time only applies to first
++ *			  transfer after address change.
++ * SMIDSR_RHOLD		: Number of core cycles between read strobe going
++ *			  inactive and CS/address going inactive. Min 1, max 64
++ * SMIDSR_RPACEALL	: When set to 1, this device's RPACE value will always
++ *			  be used for the next transaction, even if it is not
++ *			  to this device.
++ * SMIDSR_RPACE		: Number of core cycles spent waiting between CS
++ *			  deassert and start of next transfer. Min 1, max 128
++ * SMIDSR_RDREQ		: 1 = use external DMA request on SD16 to pace reads
++ *			  from device. Must also set DMAP in SMICS.
++ * SMIDSR_RSTROBE	: Number of cycles to assert the read strobe.
++ *			  min 1, max 128.
++ */
++#define SMIDSR_RWIDTH_MASK	((1<<31)|(1<<30))
++#define SMIDSR_RWIDTH_OFFS	(30)
++#define SMIDSR_RSETUP_MASK	(0x3f << 24)
++#define SMIDSR_RSETUP_OFFS	(24)
++#define SMIDSR_MODE68		(1 << 23)
++#define SMIDSR_FSETUP		(1 << 22)
++#define SMIDSR_RHOLD_MASK	(0x3f << 16)
++#define SMIDSR_RHOLD_OFFS	(16)
++#define SMIDSR_RPACEALL		(1 << 15)
++#define SMIDSR_RPACE_MASK	(0x7f << 8)
++#define SMIDSR_RPACE_OFFS	(8)
++#define SMIDSR_RDREQ		(1 << 7)
++#define SMIDSR_RSTROBE_MASK	(0x7f)
++#define SMIDSR_RSTROBE_OFFS	(0)
++
++/* Device write settings:
++ * SMIDSW_WWIDTH	: Write transfer width. 00 = 8bit, 01 = 16bit,
++ *			  10= 18bit, 11 = 9bit.
++ * SMIDSW_WSETUP	: Number of cycles between CS assert and write strobe.
++ *			  Min 1, max 64.
++ * SMIDSW_WFORMAT	: Pixel format of input. 0 = 16bit RGB 565,
++ *			  1 = 32bit RGBA 8888
++ * SMIDSW_WSWAP		: 1 = swap pixel data bits. (Use with SMICS_PXLDAT)
++ * SMIDSW_WHOLD		: Time between WE deassert and CS deassert. 1 to 64
++ * SMIDSW_WPACEALL	: 1: this device's WPACE will be used for the next
++ *			  transfer, regardless of that transfer's device.
++ * SMIDSW_WPACE		: Cycles between CS deassert and next CS assert.
++ *			  Min 1, max 128
++ * SMIDSW_WDREQ		: Use external DREQ on pin 17 to pace writes. DMAP must
++ *			  be set in SMICS.
++ * SMIDSW_WSTROBE	: Number of cycles to assert the write strobe.
++ *			  Min 1, max 128
++ */
++#define SMIDSW_WWIDTH_MASK	 ((1<<31)|(1<<30))
++#define SMIDSW_WWIDTH_OFFS	(30)
++#define SMIDSW_WSETUP_MASK	(0x3f << 24)
++#define SMIDSW_WSETUP_OFFS	(24)
++#define SMIDSW_WFORMAT		(1 << 23)
++#define SMIDSW_WSWAP		(1 << 22)
++#define SMIDSW_WHOLD_MASK	(0x3f << 16)
++#define SMIDSW_WHOLD_OFFS	(16)
++#define SMIDSW_WPACEALL		(1 << 15)
++#define SMIDSW_WPACE_MASK	(0x7f << 8)
++#define SMIDSW_WPACE_OFFS	(8)
++#define SMIDSW_WDREQ		(1 << 7)
++#define SMIDSW_WSTROBE_MASK	 (0x7f)
++#define SMIDSW_WSTROBE_OFFS	 (0)
++
++/* Direct transfer control + status register
++ * SMIDCS_WRITE	: Direction of transfer: 1 -> write, 0 -> read
++ * SMIDCS_DONE	: 1 when a transfer has finished. Write 1 to clear.
++ * SMIDCS_START	: Write 1 to start a transfer, if one is not already underway.
++ * SMIDCE_ENABLE: Write 1 to enable SMI in direct mode.
++ */
++
++#define SMIDCS_WRITE		(1 << 3)
++#define SMIDCS_DONE		(1 << 2)
++#define SMIDCS_START		(1 << 1)
++#define SMIDCS_ENABLE		(1 << 0)
++
++/* Direct transfer address register
++ * SMIDA_DEVICE	: Indicates which of the device settings banks should be used.
++ * SMIDA_ADDR	: The value to be asserted on the address pins.
++ */
++
++#define SMIDA_DEVICE_MASK	((1<<9)|(1<<8))
++#define SMIDA_DEVICE_OFFS	(8)
++#define SMIDA_ADDR_MASK		(0x3f)
++#define SMIDA_ADDR_OFFS		(0)
++
++/* FIFO debug register
++ * SMIFD_FLVL	: The high-tide mark of FIFO count during the most recent txfer
++ * SMIFD_FCNT	: The current FIFO count.
++ */
++#define SMIFD_FLVL_MASK		(0x3f << 8)
++#define SMIFD_FLVL_OFFS		(8)
++#define SMIFD_FCNT_MASK		(0x3f)
++#define SMIFD_FCNT_OFFS		(0)
++
++#endif /* BCM2835_SMI_IMPLEMENTATION */
++
++#endif /* BCM2835_SMI_H */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0062-Add-Chris-Boot-s-i2c-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0062-Add-Chris-Boot-s-i2c-driver.patch
new file mode 100644
index 00000000..cfaf5e7f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0062-Add-Chris-Boot-s-i2c-driver.patch
@@ -0,0 +1,658 @@
+From c75556e9fd6f131f405726babfff4cc97ac0cfb9 Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Wed, 17 Jun 2015 15:44:08 +0100
+Subject: [PATCH 062/697] Add Chris Boot's i2c driver
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+i2c-bcm2708: fixed baudrate
+
+Fixed issue where the wrong CDIV value was set for baudrates below 3815 Hz (for 250MHz bus clock).
+In that case the computed CDIV value was more than 0xffff. However the CDIV register width is only 16 bits.
+This resulted in incorrect setting of CDIV and higher baudrate than intended.
+Example: 3500Hz -> CDIV=0x11704 -> CDIV(16bit)=0x1704 -> 42430Hz
+After correction: 3500Hz -> CDIV=0x11704 -> CDIV(16bit)=0xffff -> 3815Hz
+The correct baudrate is shown in the log after the cdiv > 0xffff correction.
+
+Perform I2C combined transactions when possible
+
+Perform I2C combined transactions whenever possible, within the
+restrictions of the Broadcomm Serial Controller.
+
+Disable DONE interrupt during TA poll
+
+Prevent interrupt from being triggered if poll is missed and transfer
+starts and finishes.
+
+i2c: Make combined transactions optional and disabled by default
+
+i2c: bcm2708: add device tree support
+
+Add DT support to driver and add to .dtsi file.
+Setup pins in .dts file.
+i2c is disabled by default.
+
+Signed-off-by: Noralf Tronnes <notro@tronnes.org>
+
+bcm2708: don't register i2c controllers when using DT
+
+The devices for the i2c controllers are in the Device Tree.
+Only register devices when not using DT.
+
+Signed-off-by: Noralf Tronnes <notro@tronnes.org>
+
+I2C: Only register the I2C device for the current board revision
+
+i2c_bcm2708: Fix clock reference counting
+
+Fix grabbing lock from atomic context in i2c driver
+
+2 main changes:
+- check for timeouts in the bcm2708_bsc_setup function as indicated by this comment:
+      /* poll for transfer start bit (should only take 1-20 polls) */
+  This implies that the setup function can now fail so account for this everywhere it's called
+- Removed the clk_get_rate call from inside the setup function as it locks a mutex and that's not ok since we call it from under a spin lock.
+
+i2c-bcm2708: When using DT, leave the GPIO setup to pinctrl
+
+i2c-bcm2708: Increase timeouts to allow larger transfers
+
+Use the timeout value provided by the I2C_TIMEOUT ioctl when waiting
+for completion. The default timeout is 1 second.
+
+See: https://github.com/raspberrypi/linux/issues/260
+
+i2c-bcm2708/BCM270X_DT: Add support for I2C2
+
+The third I2C bus (I2C2) is normally reserved for HDMI use. Careless
+use of this bus can break an attached display - use with caution.
+
+It is recommended to disable accesses by VideoCore by setting
+hdmi_ignore_edid=1 or hdmi_edid_file=1 in config.txt.
+
+The interface is disabled by default - enable using the
+i2c2_iknowwhatimdoing DT parameter.
+
+bcm2708-spi: Don't use static pin configuration with DT
+
+Also remove superfluous error checking - the SPI framework ensures the
+validity of the chip_select value.
+
+i2c-bcm2708: Remove non-DT support
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+Set the BSC_CLKT clock streching timeout to 35ms as per SMBus specs.
+
+Fixes i2c_bcm2708: Write to FIFO correctly - v2 (#1574)
+
+* i2c: fix i2c_bcm2708: Clear FIFO before sending data
+
+Make sure FIFO gets cleared before trying to send
+data in case of a repeated start (COMBINED=Y).
+
+* i2c: fix i2c_bcm2708: Only write to FIFO when not full
+
+Check if FIFO can accept data before writing.
+To avoid a peripheral read on the last iteration of a loop,
+both bcm2708_bsc_fifo_fill and ~drain are changed as well.
+---
+ drivers/i2c/busses/Kconfig       |  19 ++
+ drivers/i2c/busses/Makefile      |   2 +
+ drivers/i2c/busses/i2c-bcm2708.c | 510 +++++++++++++++++++++++++++++++
+ 3 files changed, 531 insertions(+)
+ create mode 100644 drivers/i2c/busses/i2c-bcm2708.c
+
+--- a/drivers/i2c/busses/Kconfig
++++ b/drivers/i2c/busses/Kconfig
+@@ -16,6 +16,25 @@ config I2C_CCGX_UCSI
+ 	  for Cypress CCGx Type-C controller. Individual bus drivers
+ 	  need to select this one on demand.
+ 
++config I2C_BCM2708
++	tristate "BCM2708 BSC"
++	depends on ARCH_BCM2835
++	help
++	  Enabling this option will add BSC (Broadcom Serial Controller)
++	  support for the BCM2708. BSC is a Broadcom proprietary bus compatible
++	  with I2C/TWI/SMBus.
++
++config I2C_BCM2708_BAUDRATE
++	prompt "BCM2708 I2C baudrate"
++	depends on I2C_BCM2708
++	int
++	default 100000
++	help
++	  Set the I2C baudrate. This will alter the default value. A
++	  different baudrate can be set by using a module parameter as well. If
++	  no parameter is provided when loading, this is the value that will be
++	  used.
++
+ config I2C_ALI1535
+ 	tristate "ALI 1535"
+ 	depends on PCI && HAS_IOPORT
+--- a/drivers/i2c/busses/Makefile
++++ b/drivers/i2c/busses/Makefile
+@@ -3,6 +3,8 @@
+ # Makefile for the i2c bus drivers.
+ #
+ 
++obj-$(CONFIG_I2C_BCM2708)	+= i2c-bcm2708.o
++
+ # ACPI drivers
+ obj-$(CONFIG_I2C_SCMI)		+= i2c-scmi.o
+ 
+--- /dev/null
++++ b/drivers/i2c/busses/i2c-bcm2708.c
+@@ -0,0 +1,510 @@
++/*
++ * Driver for Broadcom BCM2708 BSC Controllers
++ *
++ * Copyright (C) 2012 Chris Boot & Frank Buss
++ *
++ * This driver is inspired by:
++ * i2c-ocores.c, by Peter Korsgaard <jacmet@sunsite.dk>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/spinlock.h>
++#include <linux/clk.h>
++#include <linux/err.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/io.h>
++#include <linux/slab.h>
++#include <linux/i2c.h>
++#include <linux/interrupt.h>
++#include <linux/sched.h>
++#include <linux/wait.h>
++
++/* BSC register offsets */
++#define BSC_C			0x00
++#define BSC_S			0x04
++#define BSC_DLEN		0x08
++#define BSC_A			0x0c
++#define BSC_FIFO		0x10
++#define BSC_DIV			0x14
++#define BSC_DEL			0x18
++#define BSC_CLKT		0x1c
++
++/* Bitfields in BSC_C */
++#define BSC_C_I2CEN		0x00008000
++#define BSC_C_INTR		0x00000400
++#define BSC_C_INTT		0x00000200
++#define BSC_C_INTD		0x00000100
++#define BSC_C_ST		0x00000080
++#define BSC_C_CLEAR_1		0x00000020
++#define BSC_C_CLEAR_2		0x00000010
++#define BSC_C_READ		0x00000001
++
++/* Bitfields in BSC_S */
++#define BSC_S_CLKT		0x00000200
++#define BSC_S_ERR		0x00000100
++#define BSC_S_RXF		0x00000080
++#define BSC_S_TXE		0x00000040
++#define BSC_S_RXD		0x00000020
++#define BSC_S_TXD		0x00000010
++#define BSC_S_RXR		0x00000008
++#define BSC_S_TXW		0x00000004
++#define BSC_S_DONE		0x00000002
++#define BSC_S_TA		0x00000001
++
++#define I2C_WAIT_LOOP_COUNT	200
++
++#define DRV_NAME		"bcm2708_i2c"
++
++static unsigned int baudrate;
++module_param(baudrate, uint, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
++MODULE_PARM_DESC(baudrate, "The I2C baudrate");
++
++static bool combined = false;
++module_param(combined, bool, 0644);
++MODULE_PARM_DESC(combined, "Use combined transactions");
++
++struct bcm2708_i2c {
++	struct i2c_adapter adapter;
++
++	spinlock_t lock;
++	void __iomem *base;
++	int irq;
++	struct clk *clk;
++	u32 cdiv;
++	u32 clk_tout;
++
++	struct completion done;
++
++	struct i2c_msg *msg;
++	int pos;
++	int nmsgs;
++	bool error;
++};
++
++static inline u32 bcm2708_rd(struct bcm2708_i2c *bi, unsigned reg)
++{
++	return readl(bi->base + reg);
++}
++
++static inline void bcm2708_wr(struct bcm2708_i2c *bi, unsigned reg, u32 val)
++{
++	writel(val, bi->base + reg);
++}
++
++static inline void bcm2708_bsc_reset(struct bcm2708_i2c *bi)
++{
++	bcm2708_wr(bi, BSC_C, 0);
++	bcm2708_wr(bi, BSC_S, BSC_S_CLKT | BSC_S_ERR | BSC_S_DONE);
++}
++
++static inline void bcm2708_bsc_fifo_drain(struct bcm2708_i2c *bi)
++{
++	while ((bi->pos < bi->msg->len) && (bcm2708_rd(bi, BSC_S) & BSC_S_RXD))
++		bi->msg->buf[bi->pos++] = bcm2708_rd(bi, BSC_FIFO);
++}
++
++static inline void bcm2708_bsc_fifo_fill(struct bcm2708_i2c *bi)
++{
++	while ((bi->pos < bi->msg->len) && (bcm2708_rd(bi, BSC_S) & BSC_S_TXD))
++		bcm2708_wr(bi, BSC_FIFO, bi->msg->buf[bi->pos++]);
++}
++
++static inline int bcm2708_bsc_setup(struct bcm2708_i2c *bi)
++{
++	u32 cdiv, s, clk_tout;
++	u32 c = BSC_C_I2CEN | BSC_C_INTD | BSC_C_ST | BSC_C_CLEAR_1;
++	int wait_loops = I2C_WAIT_LOOP_COUNT;
++
++	/* Can't call clk_get_rate as it locks a mutex and here we are spinlocked.
++	 * Use the value that we cached in the probe.
++	 */
++	cdiv = bi->cdiv;
++	clk_tout = bi->clk_tout;
++
++	if (bi->msg->flags & I2C_M_RD)
++		c |= BSC_C_INTR | BSC_C_READ;
++	else
++		c |= BSC_C_INTT;
++
++	bcm2708_wr(bi, BSC_CLKT, clk_tout);
++	bcm2708_wr(bi, BSC_DIV, cdiv);
++	bcm2708_wr(bi, BSC_A, bi->msg->addr);
++	bcm2708_wr(bi, BSC_DLEN, bi->msg->len);
++	if (combined)
++	{
++		/* Do the next two messages meet combined transaction criteria?
++		   - Current message is a write, next message is a read
++		   - Both messages to same slave address
++		   - Write message can fit inside FIFO (16 bytes or less) */
++		if ( (bi->nmsgs > 1) &&
++			!(bi->msg[0].flags & I2C_M_RD) && (bi->msg[1].flags & I2C_M_RD) &&
++			 (bi->msg[0].addr == bi->msg[1].addr) && (bi->msg[0].len <= 16)) {
++
++			/* Clear FIFO */
++			bcm2708_wr(bi, BSC_C, BSC_C_CLEAR_1);
++
++			/* Fill FIFO with entire write message (16 byte FIFO) */
++			while (bi->pos < bi->msg->len) {
++				bcm2708_wr(bi, BSC_FIFO, bi->msg->buf[bi->pos++]);
++			}
++			/* Start write transfer (no interrupts, don't clear FIFO) */
++			bcm2708_wr(bi, BSC_C, BSC_C_I2CEN | BSC_C_ST);
++
++			/* poll for transfer start bit (should only take 1-20 polls) */
++			do {
++				s = bcm2708_rd(bi, BSC_S);
++			} while (!(s & (BSC_S_TA | BSC_S_ERR | BSC_S_CLKT | BSC_S_DONE)) && --wait_loops >= 0);
++
++			/* did we time out or some error occured? */
++			if (wait_loops < 0 || (s & (BSC_S_ERR | BSC_S_CLKT))) {
++				return -1;
++			}
++
++			/* Send next read message before the write transfer finishes. */
++			bi->nmsgs--;
++			bi->msg++;
++			bi->pos = 0;
++			bcm2708_wr(bi, BSC_DLEN, bi->msg->len);
++			c = BSC_C_I2CEN | BSC_C_INTD | BSC_C_INTR | BSC_C_ST | BSC_C_READ;
++		}
++	}
++	bcm2708_wr(bi, BSC_C, c);
++
++	return 0;
++}
++
++static irqreturn_t bcm2708_i2c_interrupt(int irq, void *dev_id)
++{
++	struct bcm2708_i2c *bi = dev_id;
++	bool handled = true;
++	u32 s;
++	int ret;
++
++	spin_lock(&bi->lock);
++
++	/* we may see camera interrupts on the "other" I2C channel
++		   Just return if we've not sent anything */
++	if (!bi->nmsgs || !bi->msg) {
++		goto early_exit;
++	}
++
++	s = bcm2708_rd(bi, BSC_S);
++
++	if (s & (BSC_S_CLKT | BSC_S_ERR)) {
++		bcm2708_bsc_reset(bi);
++		bi->error = true;
++
++		bi->msg = 0; /* to inform the that all work is done */
++		bi->nmsgs = 0;
++		/* wake up our bh */
++		complete(&bi->done);
++	} else if (s & BSC_S_DONE) {
++		bi->nmsgs--;
++
++		if (bi->msg->flags & I2C_M_RD) {
++			bcm2708_bsc_fifo_drain(bi);
++		}
++
++		bcm2708_bsc_reset(bi);
++
++		if (bi->nmsgs) {
++			/* advance to next message */
++			bi->msg++;
++			bi->pos = 0;
++			ret = bcm2708_bsc_setup(bi);
++			if (ret < 0) {
++				bcm2708_bsc_reset(bi);
++				bi->error = true;
++				bi->msg = 0; /* to inform the that all work is done */
++				bi->nmsgs = 0;
++				/* wake up our bh */
++				complete(&bi->done);
++				goto early_exit;
++			}
++		} else {
++			bi->msg = 0; /* to inform the that all work is done */
++			bi->nmsgs = 0;
++			/* wake up our bh */
++			complete(&bi->done);
++		}
++	} else if (s & BSC_S_TXW) {
++		bcm2708_bsc_fifo_fill(bi);
++	} else if (s & BSC_S_RXR) {
++		bcm2708_bsc_fifo_drain(bi);
++	} else {
++		handled = false;
++	}
++
++early_exit:
++	spin_unlock(&bi->lock);
++
++	return handled ? IRQ_HANDLED : IRQ_NONE;
++}
++
++static int bcm2708_i2c_master_xfer(struct i2c_adapter *adap,
++	struct i2c_msg *msgs, int num)
++{
++	struct bcm2708_i2c *bi = adap->algo_data;
++	unsigned long flags;
++	int ret;
++
++	spin_lock_irqsave(&bi->lock, flags);
++
++	reinit_completion(&bi->done);
++	bi->msg = msgs;
++	bi->pos = 0;
++	bi->nmsgs = num;
++	bi->error = false;
++
++	ret = bcm2708_bsc_setup(bi);
++
++	spin_unlock_irqrestore(&bi->lock, flags);
++
++	/* check the result of the setup */
++	if (ret < 0)
++	{
++		dev_err(&adap->dev, "transfer setup timed out\n");
++		goto error_timeout;
++	}
++
++	ret = wait_for_completion_timeout(&bi->done, adap->timeout);
++	if (ret == 0) {
++		dev_err(&adap->dev, "transfer timed out\n");
++		goto error_timeout;
++	}
++
++	ret = bi->error ? -EIO : num;
++	return ret;
++
++error_timeout:
++	spin_lock_irqsave(&bi->lock, flags);
++	bcm2708_bsc_reset(bi);
++	bi->msg = 0; /* to inform the interrupt handler that there's nothing else to be done */
++	bi->nmsgs = 0;
++	spin_unlock_irqrestore(&bi->lock, flags);
++	return -ETIMEDOUT;
++}
++
++static u32 bcm2708_i2c_functionality(struct i2c_adapter *adap)
++{
++	return I2C_FUNC_I2C | /*I2C_FUNC_10BIT_ADDR |*/ I2C_FUNC_SMBUS_EMUL;
++}
++
++static struct i2c_algorithm bcm2708_i2c_algorithm = {
++	.master_xfer = bcm2708_i2c_master_xfer,
++	.functionality = bcm2708_i2c_functionality,
++};
++
++static int bcm2708_i2c_probe(struct platform_device *pdev)
++{
++	struct resource *regs;
++	int irq, err = -ENOMEM;
++	struct clk *clk;
++	struct bcm2708_i2c *bi;
++	struct i2c_adapter *adap;
++	unsigned long bus_hz;
++	u32 cdiv, clk_tout;
++	u32 baud;
++
++	baud = CONFIG_I2C_BCM2708_BAUDRATE;
++
++	if (pdev->dev.of_node) {
++		u32 bus_clk_rate;
++		pdev->id = of_alias_get_id(pdev->dev.of_node, "i2c");
++		if (pdev->id < 0) {
++			dev_err(&pdev->dev, "alias is missing\n");
++			return -EINVAL;
++		}
++		if (!of_property_read_u32(pdev->dev.of_node,
++					"clock-frequency", &bus_clk_rate))
++			baud = bus_clk_rate;
++		else
++			dev_warn(&pdev->dev,
++				"Could not read clock-frequency property\n");
++	}
++
++	if (baudrate)
++		baud = baudrate;
++
++	regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	if (!regs) {
++		dev_err(&pdev->dev, "could not get IO memory\n");
++		return -ENXIO;
++	}
++
++	irq = platform_get_irq(pdev, 0);
++	if (irq < 0) {
++		dev_err(&pdev->dev, "could not get IRQ\n");
++		return irq;
++	}
++
++	clk = clk_get(&pdev->dev, NULL);
++	if (IS_ERR(clk)) {
++		dev_err(&pdev->dev, "could not find clk: %ld\n", PTR_ERR(clk));
++		return PTR_ERR(clk);
++	}
++
++	err = clk_prepare_enable(clk);
++	if (err) {
++		dev_err(&pdev->dev, "could not enable clk: %d\n", err);
++		goto out_clk_put;
++	}
++
++	bi = kzalloc(sizeof(*bi), GFP_KERNEL);
++	if (!bi)
++		goto out_clk_disable;
++
++	platform_set_drvdata(pdev, bi);
++
++	adap = &bi->adapter;
++	adap->class = I2C_CLASS_HWMON;
++	adap->algo = &bcm2708_i2c_algorithm;
++	adap->algo_data = bi;
++	adap->dev.parent = &pdev->dev;
++	adap->nr = pdev->id;
++	strscpy(adap->name, dev_name(&pdev->dev), sizeof(adap->name));
++	adap->dev.of_node = pdev->dev.of_node;
++
++	switch (pdev->id) {
++	case 0:
++		adap->class = I2C_CLASS_HWMON;
++		break;
++	case 1:
++		adap->class = I2C_CLASS_HWMON;
++		break;
++	case 2:
++		adap->class = I2C_CLASS_HWMON;
++		break;
++	default:
++		dev_err(&pdev->dev, "can only bind to BSC 0, 1 or 2\n");
++		err = -ENXIO;
++		goto out_free_bi;
++	}
++
++	spin_lock_init(&bi->lock);
++	init_completion(&bi->done);
++
++	bi->base = ioremap(regs->start, resource_size(regs));
++	if (!bi->base) {
++		dev_err(&pdev->dev, "could not remap memory\n");
++		goto out_free_bi;
++	}
++
++	bi->irq = irq;
++	bi->clk = clk;
++
++	err = request_irq(irq, bcm2708_i2c_interrupt, IRQF_SHARED,
++			dev_name(&pdev->dev), bi);
++	if (err) {
++		dev_err(&pdev->dev, "could not request IRQ: %d\n", err);
++		goto out_iounmap;
++	}
++
++	bcm2708_bsc_reset(bi);
++
++	err = i2c_add_numbered_adapter(adap);
++	if (err < 0) {
++		dev_err(&pdev->dev, "could not add I2C adapter: %d\n", err);
++		goto out_free_irq;
++	}
++
++	bus_hz = clk_get_rate(bi->clk);
++	cdiv = bus_hz / baud;
++	if (cdiv > 0xffff) {
++		cdiv = 0xffff;
++		baud = bus_hz / cdiv;
++	}
++
++	clk_tout = 35/1000*baud; //35ms timeout as per SMBus specs.
++	if (clk_tout > 0xffff)
++		clk_tout = 0xffff;
++	
++	bi->cdiv = cdiv;
++	bi->clk_tout = clk_tout;
++
++	dev_info(&pdev->dev, "BSC%d Controller at 0x%08lx (irq %d) (baudrate %d)\n",
++		pdev->id, (unsigned long)regs->start, irq, baud);
++
++	return 0;
++
++out_free_irq:
++	free_irq(bi->irq, bi);
++out_iounmap:
++	iounmap(bi->base);
++out_free_bi:
++	kfree(bi);
++out_clk_disable:
++	clk_disable_unprepare(clk);
++out_clk_put:
++	clk_put(clk);
++	return err;
++}
++
++static void bcm2708_i2c_remove(struct platform_device *pdev)
++{
++	struct bcm2708_i2c *bi = platform_get_drvdata(pdev);
++
++	platform_set_drvdata(pdev, NULL);
++
++	i2c_del_adapter(&bi->adapter);
++	free_irq(bi->irq, bi);
++	iounmap(bi->base);
++	clk_disable_unprepare(bi->clk);
++	clk_put(bi->clk);
++	kfree(bi);
++}
++
++static const struct of_device_id bcm2708_i2c_of_match[] = {
++        { .compatible = "brcm,bcm2708-i2c" },
++        {},
++};
++MODULE_DEVICE_TABLE(of, bcm2708_i2c_of_match);
++
++static struct platform_driver bcm2708_i2c_driver = {
++	.driver		= {
++		.name	= DRV_NAME,
++		.owner	= THIS_MODULE,
++		.of_match_table = bcm2708_i2c_of_match,
++	},
++	.probe		= bcm2708_i2c_probe,
++	.remove		= bcm2708_i2c_remove,
++};
++
++// module_platform_driver(bcm2708_i2c_driver);
++
++
++static int __init bcm2708_i2c_init(void)
++{
++	return platform_driver_register(&bcm2708_i2c_driver);
++}
++
++static void __exit bcm2708_i2c_exit(void)
++{
++	platform_driver_unregister(&bcm2708_i2c_driver);
++}
++
++module_init(bcm2708_i2c_init);
++module_exit(bcm2708_i2c_exit);
++
++
++
++MODULE_DESCRIPTION("BSC controller driver for Broadcom BCM2708");
++MODULE_AUTHOR("Chris Boot <bootc@bootc.net>");
++MODULE_LICENSE("GPL v2");
++MODULE_ALIAS("platform:" DRV_NAME);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0064-char-broadcom-Add-vcio-module.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0064-char-broadcom-Add-vcio-module.patch
new file mode 100644
index 00000000..158dbfc8
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0064-char-broadcom-Add-vcio-module.patch
@@ -0,0 +1,273 @@
+From f2158870e6bcba478fef6d8b84ed6a814d2d8374 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
+Date: Fri, 26 Jun 2015 14:27:06 +0200
+Subject: [PATCH 064/697] char: broadcom: Add vcio module
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Add module for accessing the mailbox property channel through
+/dev/vcio. Was previously in bcm2708-vcio.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+char: vcio: Add compat ioctl handling
+
+There was no compat ioctl handler, so 32 bit userspace on a
+64 bit kernel failed as IOCTL_MBOX_PROPERTY used the size
+of char*.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+char: vcio: Fail probe if rpi_firmware is not found.
+
+Device Tree is now the only supported config mechanism, therefore
+uncomment the block of code that fails the probe if the
+firmware node can't be found.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+drivers: char: vcio: Use common compat header
+
+The definition of compat_ptr is now common for most platforms, but
+requires the inclusion of <linux/compat.h>.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+char: vcio: Rewrite as a firmware node child
+
+The old vcio driver is a simple character device that manually locates
+the firmware driver. Initialising it before the firmware driver causes
+a failure, and no retries are attempted.
+
+Rewrite vcio as a platform driver that depends on a DT node for its
+instantiation and the location of the firmware driver, making use of
+the miscdevice framework to reduce the code size.
+
+N.B. Using miscdevice changes the udev SUBSYSTEM string, so a change
+to the companion udev rule is required in order to continue to set
+the correct device permissions, e.g.:
+
+    KERNEL="vcio", GROUP="video", MODE="0660"
+
+See: https://github.com/raspberrypi/linux/issues/4620
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/char/broadcom/Kconfig  |   6 ++
+ drivers/char/broadcom/Makefile |   1 +
+ drivers/char/broadcom/vcio.c   | 187 +++++++++++++++++++++++++++++++++
+ 3 files changed, 194 insertions(+)
+ create mode 100644 drivers/char/broadcom/vcio.c
+
+--- a/drivers/char/broadcom/Kconfig
++++ b/drivers/char/broadcom/Kconfig
+@@ -15,6 +15,12 @@ config BCM2708_VCMEM
+         help
+           Helper for videocore memory access and total size allocation.
+ 
++config BCM_VCIO
++	tristate "Mailbox userspace access"
++	depends on BCM2835_MBOX
++	help
++	  Gives access to the mailbox property channel from userspace.
++
+ endif
+ 
+ config BCM2835_SMI_DEV
+--- a/drivers/char/broadcom/Makefile
++++ b/drivers/char/broadcom/Makefile
+@@ -1,2 +1,3 @@
+ obj-$(CONFIG_BCM2708_VCMEM)	+= vc_mem.o
++obj-$(CONFIG_BCM_VCIO)		+= vcio.o
+ obj-$(CONFIG_BCM2835_SMI_DEV)	+= bcm2835_smi_dev.o
+--- /dev/null
++++ b/drivers/char/broadcom/vcio.c
+@@ -0,0 +1,187 @@
++/*
++ *  Copyright (C) 2010 Broadcom
++ *  Copyright (C) 2015 Noralf Trønnes
++ *  Copyright (C) 2021 Raspberry Pi (Trading) Ltd.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ *
++ */
++
++#include <linux/cdev.h>
++#include <linux/device.h>
++#include <linux/fs.h>
++#include <linux/init.h>
++#include <linux/ioctl.h>
++#include <linux/module.h>
++#include <linux/slab.h>
++#include <linux/uaccess.h>
++#include <linux/compat.h>
++#include <linux/miscdevice.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <soc/bcm2835/raspberrypi-firmware.h>
++
++#define MODULE_NAME "vcio"
++#define VCIO_IOC_MAGIC 100
++#define IOCTL_MBOX_PROPERTY _IOWR(VCIO_IOC_MAGIC, 0, char *)
++#ifdef CONFIG_COMPAT
++#define IOCTL_MBOX_PROPERTY32 _IOWR(VCIO_IOC_MAGIC, 0, compat_uptr_t)
++#endif
++
++struct vcio_data {
++	struct rpi_firmware *fw;
++	struct miscdevice misc_dev;
++};
++
++static int vcio_user_property_list(struct vcio_data *vcio, void *user)
++{
++	u32 *buf, size;
++	int ret;
++
++	/* The first 32-bit is the size of the buffer */
++	if (copy_from_user(&size, user, sizeof(size)))
++		return -EFAULT;
++
++	buf = kmalloc(size, GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++
++	if (copy_from_user(buf, user, size)) {
++		kfree(buf);
++		return -EFAULT;
++	}
++
++	/* Strip off protocol encapsulation */
++	ret = rpi_firmware_property_list(vcio->fw, &buf[2], size - 12);
++	if (ret) {
++		kfree(buf);
++		return ret;
++	}
++
++	buf[1] = RPI_FIRMWARE_STATUS_SUCCESS;
++	if (copy_to_user(user, buf, size))
++		ret = -EFAULT;
++
++	kfree(buf);
++
++	return ret;
++}
++
++static int vcio_device_open(struct inode *inode, struct file *file)
++{
++	try_module_get(THIS_MODULE);
++
++	return 0;
++}
++
++static int vcio_device_release(struct inode *inode, struct file *file)
++{
++	module_put(THIS_MODULE);
++
++	return 0;
++}
++
++static long vcio_device_ioctl(struct file *file, unsigned int ioctl_num,
++			      unsigned long ioctl_param)
++{
++	struct vcio_data *vcio = container_of(file->private_data,
++					      struct vcio_data, misc_dev);
++
++	switch (ioctl_num) {
++	case IOCTL_MBOX_PROPERTY:
++		return vcio_user_property_list(vcio, (void *)ioctl_param);
++	default:
++		pr_err("unknown ioctl: %x\n", ioctl_num);
++		return -EINVAL;
++	}
++}
++
++#ifdef CONFIG_COMPAT
++static long vcio_device_compat_ioctl(struct file *file, unsigned int ioctl_num,
++				     unsigned long ioctl_param)
++{
++	struct vcio_data *vcio = container_of(file->private_data,
++					      struct vcio_data, misc_dev);
++
++	switch (ioctl_num) {
++	case IOCTL_MBOX_PROPERTY32:
++		return vcio_user_property_list(vcio, compat_ptr(ioctl_param));
++	default:
++		pr_err("unknown ioctl: %x\n", ioctl_num);
++		return -EINVAL;
++	}
++}
++#endif
++
++const struct file_operations vcio_fops = {
++	.unlocked_ioctl = vcio_device_ioctl,
++#ifdef CONFIG_COMPAT
++	.compat_ioctl = vcio_device_compat_ioctl,
++#endif
++	.open = vcio_device_open,
++	.release = vcio_device_release,
++};
++
++static int vcio_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct device_node *np = dev->of_node;
++	struct device_node *fw_node;
++	struct rpi_firmware *fw;
++	struct vcio_data *vcio;
++
++	fw_node = of_get_parent(np);
++	if (!fw_node) {
++		dev_err(dev, "Missing firmware node\n");
++		return -ENOENT;
++	}
++
++	fw = rpi_firmware_get(fw_node);
++	of_node_put(fw_node);
++	if (!fw)
++		return -EPROBE_DEFER;
++
++	vcio = devm_kzalloc(dev, sizeof(struct vcio_data), GFP_KERNEL);
++	if (!vcio)
++		return -ENOMEM;
++
++	vcio->fw = fw;
++	vcio->misc_dev.fops = &vcio_fops;
++	vcio->misc_dev.minor = MISC_DYNAMIC_MINOR;
++	vcio->misc_dev.name = "vcio";
++	vcio->misc_dev.parent = dev;
++
++	return misc_register(&vcio->misc_dev);
++}
++
++static void vcio_remove(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++
++	misc_deregister(dev_get_drvdata(dev));
++}
++
++static const struct of_device_id vcio_ids[] = {
++	{ .compatible = "raspberrypi,vcio" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, vcio_ids);
++
++static struct platform_driver vcio_driver = {
++	.driver	= {
++		.name		= MODULE_NAME,
++		.of_match_table	= of_match_ptr(vcio_ids),
++	},
++	.probe	= vcio_probe,
++	.remove = vcio_remove,
++};
++
++module_platform_driver(vcio_driver);
++
++MODULE_AUTHOR("Gray Girling");
++MODULE_AUTHOR("Noralf Trønnes");
++MODULE_DESCRIPTION("Mailbox userspace access");
++MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:rpi-vcio");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0066-firmware-bcm2835-Support-ARCH_BCM270x.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0066-firmware-bcm2835-Support-ARCH_BCM270x.patch
new file mode 100644
index 00000000..a91b8ab3
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0066-firmware-bcm2835-Support-ARCH_BCM270x.patch
@@ -0,0 +1,74 @@
+From ec076200dd0eed1df5aa179babfa8b2723de88c1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
+Date: Fri, 26 Jun 2015 14:25:01 +0200
+Subject: [PATCH 066/697] firmware: bcm2835: Support ARCH_BCM270x
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Support booting without Device Tree.
+Turn on USB power.
+Load driver early because of lacking support for deferred probing
+in many drivers.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+
+firmware: bcm2835: Don't turn on USB power
+
+The raspberrypi-power driver is now used to turn on USB power.
+
+This partly reverts commit:
+firmware: bcm2835: Support ARCH_BCM270x
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+---
+ drivers/firmware/raspberrypi.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+--- a/drivers/firmware/raspberrypi.c
++++ b/drivers/firmware/raspberrypi.c
+@@ -34,6 +34,8 @@ struct rpi_firmware {
+ 	struct kref consumers;
+ };
+ 
++static struct platform_device *g_pdev;
++
+ static DEFINE_MUTEX(transaction_lock);
+ 
+ static void response_callback(struct mbox_client *cl, void *msg)
+@@ -301,6 +303,7 @@ static int rpi_firmware_probe(struct pla
+ 	kref_init(&fw->consumers);
+ 
+ 	platform_set_drvdata(pdev, fw);
++	g_pdev = pdev;
+ 
+ 	rpi_firmware_print_firmware_revision(fw);
+ 	rpi_register_hwmon_driver(dev, fw);
+@@ -329,6 +332,7 @@ static void rpi_firmware_remove(struct p
+ 	rpi_clk = NULL;
+ 
+ 	rpi_firmware_put(fw);
++	g_pdev = NULL;
+ }
+ 
+ static const struct of_device_id rpi_firmware_of_match[] = {
+@@ -408,7 +412,18 @@ static struct platform_driver rpi_firmwa
+ 	.shutdown	= rpi_firmware_shutdown,
+ 	.remove_new	= rpi_firmware_remove,
+ };
+-module_platform_driver(rpi_firmware_driver);
++
++static int __init rpi_firmware_init(void)
++{
++	return platform_driver_register(&rpi_firmware_driver);
++}
++core_initcall(rpi_firmware_init);
++
++static void __init rpi_firmware_exit(void)
++{
++	platform_driver_unregister(&rpi_firmware_driver);
++}
++module_exit(rpi_firmware_exit);
+ 
+ MODULE_AUTHOR("Eric Anholt <eric@anholt.net>");
+ MODULE_DESCRIPTION("Raspberry Pi firmware driver");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0067-leds-Add-the-input-trigger-for-pwr_led.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0067-leds-Add-the-input-trigger-for-pwr_led.patch
new file mode 100644
index 00000000..c24f7136
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0067-leds-Add-the-input-trigger-for-pwr_led.patch
@@ -0,0 +1,168 @@
+From 09656b6be61c38b287446ac2aade80fdf71636c9 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Fri, 6 Feb 2015 13:50:57 +0000
+Subject: [PATCH 067/697] leds: Add the "input" trigger, for pwr_led
+
+The "input" trigger makes the associated GPIO an input.  This is to support
+the Raspberry Pi PWR LED, which is driven by external hardware in normal use.
+
+N.B. pwr_led is not available on Model A or B boards.
+
+leds-gpio: Implement the brightness_get method
+
+The power LED uses some clever logic that means it is driven
+by a voltage measuring circuit when configured as input, otherwise
+it is driven by the GPIO output value. This patch wires up the
+brightness_get method for leds-gpio so that user-space can monitor
+the LED value via /sys/class/gpio/led1/brightness. Using the input
+trigger this returns an indication of the system power health,
+otherwise it is just whatever value the trigger has written most
+recently.
+
+See: https://github.com/raspberrypi/linux/issues/1064
+---
+ drivers/leds/leds-gpio.c             | 17 ++++++++-
+ drivers/leds/trigger/Kconfig         |  7 ++++
+ drivers/leds/trigger/Makefile        |  1 +
+ drivers/leds/trigger/ledtrig-input.c | 55 ++++++++++++++++++++++++++++
+ include/linux/leds.h                 |  3 ++
+ 5 files changed, 82 insertions(+), 1 deletion(-)
+ create mode 100644 drivers/leds/trigger/ledtrig-input.c
+
+--- a/drivers/leds/leds-gpio.c
++++ b/drivers/leds/leds-gpio.c
+@@ -52,8 +52,15 @@ static void gpio_led_set(struct led_clas
+ 		led_dat->platform_gpio_blink_set(led_dat->gpiod, level,
+ 						 NULL, NULL);
+ 		led_dat->blinking = 0;
++	} else if (led_dat->cdev.flags & SET_GPIO_INPUT) {
++		gpiod_direction_input(led_dat->gpiod);
++		led_dat->cdev.flags &= ~SET_GPIO_INPUT;
++	} else if (led_dat->cdev.flags & SET_GPIO_OUTPUT) {
++		gpiod_direction_output(led_dat->gpiod, level);
++		led_dat->cdev.flags &= ~SET_GPIO_OUTPUT;
+ 	} else {
+-		if (led_dat->can_sleep)
++		if (led_dat->can_sleep ||
++			(led_dat->cdev.flags & (SET_GPIO_INPUT | SET_GPIO_OUTPUT) ))
+ 			gpiod_set_value_cansleep(led_dat->gpiod, level);
+ 		else
+ 			gpiod_set_value(led_dat->gpiod, level);
+@@ -67,6 +74,13 @@ static int gpio_led_set_blocking(struct
+ 	return 0;
+ }
+ 
++static enum led_brightness gpio_led_get(struct led_classdev *led_cdev)
++{
++	struct gpio_led_data *led_dat =
++		container_of(led_cdev, struct gpio_led_data, cdev);
++	return gpiod_get_value_cansleep(led_dat->gpiod) ? LED_FULL : LED_OFF;
++}
++
+ static int gpio_blink_set(struct led_classdev *led_cdev,
+ 	unsigned long *delay_on, unsigned long *delay_off)
+ {
+@@ -96,6 +110,7 @@ static int create_gpio_led(const struct
+ 		led_dat->platform_gpio_blink_set = blink_set;
+ 		led_dat->cdev.blink_set = gpio_blink_set;
+ 	}
++	led_dat->cdev.brightness_get = gpio_led_get;
+ 	if (template->default_state == LEDS_GPIO_DEFSTATE_KEEP) {
+ 		state = gpiod_get_value_cansleep(led_dat->gpiod);
+ 		if (state < 0)
+--- a/drivers/leds/trigger/Kconfig
++++ b/drivers/leds/trigger/Kconfig
+@@ -113,6 +113,13 @@ config LEDS_TRIGGER_CAMERA
+ 	  This enables direct flash/torch on/off by the driver, kernel space.
+ 	  If unsure, say Y.
+ 
++config LEDS_TRIGGER_INPUT
++	tristate "LED Input Trigger"
++	depends on LEDS_TRIGGERS
++	help
++	  This allows the GPIOs assigned to be LEDs to be initialised to inputs.
++	  If unsure, say Y.
++
+ config LEDS_TRIGGER_PANIC
+ 	bool "LED Panic Trigger"
+ 	help
+--- a/drivers/leds/trigger/Makefile
++++ b/drivers/leds/trigger/Makefile
+@@ -11,6 +11,7 @@ obj-$(CONFIG_LEDS_TRIGGER_ACTIVITY)	+= l
+ obj-$(CONFIG_LEDS_TRIGGER_DEFAULT_ON)	+= ledtrig-default-on.o
+ obj-$(CONFIG_LEDS_TRIGGER_TRANSIENT)	+= ledtrig-transient.o
+ obj-$(CONFIG_LEDS_TRIGGER_CAMERA)	+= ledtrig-camera.o
++obj-$(CONFIG_LEDS_TRIGGER_INPUT)	+= ledtrig-input.o
+ obj-$(CONFIG_LEDS_TRIGGER_PANIC)	+= ledtrig-panic.o
+ obj-$(CONFIG_LEDS_TRIGGER_NETDEV)	+= ledtrig-netdev.o
+ obj-$(CONFIG_LEDS_TRIGGER_PATTERN)	+= ledtrig-pattern.o
+--- /dev/null
++++ b/drivers/leds/trigger/ledtrig-input.c
+@@ -0,0 +1,55 @@
++/*
++ * Set LED GPIO to Input "Trigger"
++ *
++ * Copyright 2015 Phil Elwell <phil@raspberrypi.org>
++ *
++ * Based on Nick Forbes's ledtrig-default-on.c.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ *
++ */
++
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/leds.h>
++#include <linux/gpio.h>
++#include "../leds.h"
++
++static int input_trig_activate(struct led_classdev *led_cdev)
++{
++	led_cdev->flags |= SET_GPIO_INPUT;
++	led_set_brightness(led_cdev, 0);
++	return 0;
++}
++
++static void input_trig_deactivate(struct led_classdev *led_cdev)
++{
++	led_cdev->flags |= SET_GPIO_OUTPUT;
++	led_set_brightness(led_cdev, 0);
++}
++
++static struct led_trigger input_led_trigger = {
++	.name     = "input",
++	.activate = input_trig_activate,
++	.deactivate = input_trig_deactivate,
++};
++
++static int __init input_trig_init(void)
++{
++	return led_trigger_register(&input_led_trigger);
++}
++
++static void __exit input_trig_exit(void)
++{
++	led_trigger_unregister(&input_led_trigger);
++}
++
++module_init(input_trig_init);
++module_exit(input_trig_exit);
++
++MODULE_AUTHOR("Phil Elwell <phil@raspberrypi.org>");
++MODULE_DESCRIPTION("Set LED GPIO to Input \"trigger\"");
++MODULE_LICENSE("GPL");
+--- a/include/linux/leds.h
++++ b/include/linux/leds.h
+@@ -109,6 +109,9 @@ struct led_classdev {
+ #define LED_INIT_DEFAULT_TRIGGER BIT(23)
+ #define LED_REJECT_NAME_CONFLICT BIT(24)
+ #define LED_MULTI_COLOR		BIT(25)
++	/* Additions for Raspberry Pi PWR LED */
++#define SET_GPIO_INPUT		BIT(30)
++#define SET_GPIO_OUTPUT		BIT(31)
+ 
+ 	/* set_brightness_work / blink_timer flags, atomic, private. */
+ 	unsigned long		work_flags;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0068-Added-Device-IDs-for-August-DVB-T-205.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0068-Added-Device-IDs-for-August-DVB-T-205.patch
new file mode 100644
index 00000000..84743721
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0068-Added-Device-IDs-for-August-DVB-T-205.patch
@@ -0,0 +1,22 @@
+From ac6c60609e5a8f1fc1e5aad48eea1340ed0fce98 Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Wed, 3 Jul 2013 00:54:08 +0100
+Subject: [PATCH 068/697] Added Device IDs for August DVB-T 205
+
+---
+ drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
++++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+@@ -1964,6 +1964,10 @@ static const struct usb_device_id rtl28x
+ 		&rtl28xxu_props, "Compro VideoMate U650F", NULL) },
+ 	{ DVB_USB_DEVICE(USB_VID_KWORLD_2, 0xd394,
+ 		&rtl28xxu_props, "MaxMedia HU394-T", NULL) },
++	{ DVB_USB_DEVICE(USB_VID_GTEK, 0xb803 /*USB_PID_AUGUST_DVBT205*/,
++		&rtl28xxu_props, "August DVB-T 205", NULL) },
++	{ DVB_USB_DEVICE(USB_VID_GTEK, 0xa803 /*USB_PID_AUGUST_DVBT205*/,
++		&rtl28xxu_props, "August DVB-T 205", NULL) },
+ 	{ DVB_USB_DEVICE(USB_VID_LEADTEK, 0x6a03,
+ 		&rtl28xxu_props, "Leadtek WinFast DTV Dongle mini", NULL) },
+ 	{ DVB_USB_DEVICE(USB_VID_GTEK, USB_PID_CPYTO_REDI_PC50A,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0069-Improve-__copy_to_user-and-__copy_from_user-performa.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0069-Improve-__copy_to_user-and-__copy_from_user-performa.patch
new file mode 100644
index 00000000..16f51168
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0069-Improve-__copy_to_user-and-__copy_from_user-performa.patch
@@ -0,0 +1,1598 @@
+From 4ac9ed0938a169f57e2f43a22726cfd0da90931d Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Mon, 28 Nov 2016 16:50:04 +0000
+Subject: [PATCH 069/697] Improve __copy_to_user and __copy_from_user
+ performance
+
+Provide a __copy_from_user that uses memcpy. On BCM2708, use
+optimised memcpy/memmove/memcmp/memset implementations.
+
+arch/arm: Add mmiocpy/set aliases for memcpy/set
+
+See: https://github.com/raspberrypi/linux/issues/1082
+
+copy_from_user: CPU_SW_DOMAIN_PAN compatibility
+
+The downstream copy_from_user acceleration must also play nice with
+CONFIG_CPU_SW_DOMAIN_PAN.
+
+See: https://github.com/raspberrypi/linux/issues/1381
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+Fix copy_from_user if BCM2835_FAST_MEMCPY=n
+
+The change which introduced CONFIG_BCM2835_FAST_MEMCPY unconditionally
+changed the behaviour of arm_copy_from_user. The page pinning code
+is not safe on ARMv7 if LPAE & high memory is enabled and causes
+crashes which look like PTE corruption.
+
+Make __copy_from_user_memcpy conditional on CONFIG_2835_FAST_MEMCPY=y
+which is really an ARMv6 / Pi1 optimization and not necessary on newer
+ARM processors.
+
+arm: fix mmap unlocks in uaccess_with_memcpy.c
+
+This is a regression that was added with the commit 192a4e923ef092924dd013e7326f2ec520ee4783 as of rpi-5.8.y, since that is when the move to the mmap locking API was introduced - d8ed45c5dcd455fc5848d47f86883a1b872ac0d0
+
+The issue is that when the patch to improve performance for the __copy_to_user and __copy_from_user functions were added for the Raspberry Pi, some of the mmaps were incorrectly mapped to write instead of read. This would cause a verity of issues, and in my case, prevent the booting of a squashfs filesystem on rpi-5.8-y and above. An example of the panic you would see from this can be seen at https://pastebin.com/raw/jBz5xCzL
+
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Christopher Blake <chrisrblake93@gmail.com>
+
+arch/arm: Add __memset alias to memset_rpi.S
+
+memset_rpi.S is an optimised memset implementation, but doesn't define
+__memset (which was just added to memset.S). As a result, building
+for the BCM2835 platform causes a link failure.
+
+Add __memset as yet another alias to our common implementation.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+arm: Fix custom rpi __memset32 and __memset64
+
+See: https://github.com/raspberrypi/linux/issues/4798
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+arm: Fix annoying .eh_frame section warnings
+
+Replace the cfi directives with the UNWIND equivalents. This prevents
+the .eh_frame section from being created, eliminating the warnings.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/include/asm/string.h      |   5 +
+ arch/arm/include/asm/uaccess.h     |   3 +
+ arch/arm/lib/Makefile              |  14 +-
+ arch/arm/lib/arm-mem.h             | 159 ++++++++++
+ arch/arm/lib/copy_from_user.S      |   4 +-
+ arch/arm/lib/exports_rpi.c         |  37 +++
+ arch/arm/lib/memcmp_rpi.S          | 285 +++++++++++++++++
+ arch/arm/lib/memcpy_rpi.S          |  65 ++++
+ arch/arm/lib/memcpymove.h          | 488 +++++++++++++++++++++++++++++
+ arch/arm/lib/memmove_rpi.S         |  63 ++++
+ arch/arm/lib/memset_rpi.S          | 132 ++++++++
+ arch/arm/lib/uaccess_with_memcpy.c | 127 +++++++-
+ arch/arm/mach-bcm/Kconfig          |   7 +
+ 13 files changed, 1384 insertions(+), 5 deletions(-)
+ create mode 100644 arch/arm/lib/arm-mem.h
+ create mode 100644 arch/arm/lib/exports_rpi.c
+ create mode 100644 arch/arm/lib/memcmp_rpi.S
+ create mode 100644 arch/arm/lib/memcpy_rpi.S
+ create mode 100644 arch/arm/lib/memcpymove.h
+ create mode 100644 arch/arm/lib/memmove_rpi.S
+ create mode 100644 arch/arm/lib/memset_rpi.S
+
+--- a/arch/arm/include/asm/string.h
++++ b/arch/arm/include/asm/string.h
+@@ -65,4 +65,9 @@ static inline void *memset64(uint64_t *p
+ 
+ #endif
+ 
++#ifdef CONFIG_BCM2835_FAST_MEMCPY
++#define __HAVE_ARCH_MEMCMP
++extern int memcmp(const void *, const void *, size_t);
++#endif
++
+ #endif
+--- a/arch/arm/include/asm/uaccess.h
++++ b/arch/arm/include/asm/uaccess.h
+@@ -533,6 +533,9 @@ do {									\
+ extern unsigned long __must_check
+ arm_copy_from_user(void *to, const void __user *from, unsigned long n);
+ 
++extern unsigned long __must_check
++__copy_from_user_std(void *to, const void __user *from, unsigned long n);
++
+ static inline unsigned long __must_check
+ raw_copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
+--- a/arch/arm/lib/Makefile
++++ b/arch/arm/lib/Makefile
+@@ -7,8 +7,8 @@
+ 
+ lib-y		:= changebit.o csumipv6.o csumpartial.o               \
+ 		   csumpartialcopy.o csumpartialcopyuser.o clearbit.o \
+-		   delay.o delay-loop.o findbit.o memchr.o memcpy.o   \
+-		   memmove.o memset.o setbit.o                        \
++		   delay.o delay-loop.o findbit.o memchr.o            \
++		   setbit.o                                           \
+ 		   strchr.o strrchr.o                                 \
+ 		   testchangebit.o testclearbit.o testsetbit.o        \
+ 		   ashldi3.o ashrdi3.o lshrdi3.o muldi3.o             \
+@@ -25,6 +25,16 @@ else
+   lib-y	+= backtrace.o
+ endif
+ 
++# Choose optimised implementations for Raspberry Pi
++ifeq ($(CONFIG_BCM2835_FAST_MEMCPY),y)
++  CFLAGS_uaccess_with_memcpy.o += -DCOPY_FROM_USER_THRESHOLD=1600
++  CFLAGS_uaccess_with_memcpy.o += -DCOPY_TO_USER_THRESHOLD=672
++  obj-$(CONFIG_MODULES) += exports_rpi.o
++  lib-y        += memcpy_rpi.o memmove_rpi.o memset_rpi.o memcmp_rpi.o
++else
++  lib-y        += memcpy.o memmove.o memset.o
++endif
++
+ # using lib_ here won't override already available weak symbols
+ obj-$(CONFIG_UACCESS_WITH_MEMCPY) += uaccess_with_memcpy.o
+ 
+--- /dev/null
++++ b/arch/arm/lib/arm-mem.h
+@@ -0,0 +1,159 @@
++/*
++Copyright (c) 2013, Raspberry Pi Foundation
++Copyright (c) 2013, RISC OS Open Ltd
++All rights reserved.
++
++Redistribution and use in source and binary forms, with or without
++modification, are permitted provided that the following conditions are met:
++    * Redistributions of source code must retain the above copyright
++      notice, this list of conditions and the following disclaimer.
++    * Redistributions in binary form must reproduce the above copyright
++      notice, this list of conditions and the following disclaimer in the
++      documentation and/or other materials provided with the distribution.
++    * Neither the name of the copyright holder nor the
++      names of its contributors may be used to endorse or promote products
++      derived from this software without specific prior written permission.
++
++THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
++ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
++WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
++DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY
++DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
++ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++*/
++
++.macro myfunc fname
++ .func fname
++ .global fname
++fname:
++.endm
++
++.macro preload_leading_step1  backwards, ptr, base
++/* If the destination is already 16-byte aligned, then we need to preload
++ * between 0 and prefetch_distance (inclusive) cache lines ahead so there
++ * are no gaps when the inner loop starts.
++ */
++ .if backwards
++        sub     ptr, base, #1
++        bic     ptr, ptr, #31
++ .else
++        bic     ptr, base, #31
++ .endif
++ .set OFFSET, 0
++ .rept prefetch_distance+1
++        pld     [ptr, #OFFSET]
++  .if backwards
++   .set OFFSET, OFFSET-32
++  .else
++   .set OFFSET, OFFSET+32
++  .endif
++ .endr
++.endm
++
++.macro preload_leading_step2  backwards, ptr, base, leading_bytes, tmp
++/* However, if the destination is not 16-byte aligned, we may need to
++ * preload one more cache line than that. The question we need to ask is:
++ * are the leading bytes more than the amount by which the source
++ * pointer will be rounded down for preloading, and if so, by how many
++ * cache lines?
++ */
++ .if backwards
++/* Here we compare against how many bytes we are into the
++ * cache line, counting down from the highest such address.
++ * Effectively, we want to calculate
++ *     leading_bytes = dst&15
++ *     cacheline_offset = 31-((src-leading_bytes-1)&31)
++ *     extra_needed = leading_bytes - cacheline_offset
++ * and test if extra_needed is <= 0, or rearranging:
++ *     leading_bytes + (src-leading_bytes-1)&31 <= 31
++ */
++        mov     tmp, base, lsl #32-5
++        sbc     tmp, tmp, leading_bytes, lsl #32-5
++        adds    tmp, tmp, leading_bytes, lsl #32-5
++        bcc     61f
++        pld     [ptr, #-32*(prefetch_distance+1)]
++ .else
++/* Effectively, we want to calculate
++ *     leading_bytes = (-dst)&15
++ *     cacheline_offset = (src+leading_bytes)&31
++ *     extra_needed = leading_bytes - cacheline_offset
++ * and test if extra_needed is <= 0.
++ */
++        mov     tmp, base, lsl #32-5
++        add     tmp, tmp, leading_bytes, lsl #32-5
++        rsbs    tmp, tmp, leading_bytes, lsl #32-5
++        bls     61f
++        pld     [ptr, #32*(prefetch_distance+1)]
++ .endif
++61:
++.endm
++
++.macro preload_trailing  backwards, base, remain, tmp
++        /* We need either 0, 1 or 2 extra preloads */
++ .if backwards
++        rsb     tmp, base, #0
++        mov     tmp, tmp, lsl #32-5
++ .else
++        mov     tmp, base, lsl #32-5
++ .endif
++        adds    tmp, tmp, remain, lsl #32-5
++        adceqs  tmp, tmp, #0
++        /* The instruction above has two effects: ensures Z is only
++         * set if C was clear (so Z indicates that both shifted quantities
++         * were 0), and clears C if Z was set (so C indicates that the sum
++         * of the shifted quantities was greater and not equal to 32) */
++        beq     82f
++ .if backwards
++        sub     tmp, base, #1
++        bic     tmp, tmp, #31
++ .else
++        bic     tmp, base, #31
++ .endif
++        bcc     81f
++ .if backwards
++        pld     [tmp, #-32*(prefetch_distance+1)]
++81:
++        pld     [tmp, #-32*prefetch_distance]
++ .else
++        pld     [tmp, #32*(prefetch_distance+2)]
++81:
++        pld     [tmp, #32*(prefetch_distance+1)]
++ .endif
++82:
++.endm
++
++.macro preload_all    backwards, narrow_case, shift, base, remain, tmp0, tmp1
++ .if backwards
++        sub     tmp0, base, #1
++        bic     tmp0, tmp0, #31
++        pld     [tmp0]
++        sub     tmp1, base, remain, lsl #shift
++ .else
++        bic     tmp0, base, #31
++        pld     [tmp0]
++        add     tmp1, base, remain, lsl #shift
++        sub     tmp1, tmp1, #1
++ .endif
++        bic     tmp1, tmp1, #31
++        cmp     tmp1, tmp0
++        beq     92f
++ .if narrow_case
++        /* In this case, all the data fits in either 1 or 2 cache lines */
++        pld     [tmp1]
++ .else
++91:
++  .if backwards
++        sub     tmp0, tmp0, #32
++  .else
++        add     tmp0, tmp0, #32
++  .endif
++        cmp     tmp0, tmp1
++        pld     [tmp0]
++        bne     91b
++ .endif
++92:
++.endm
+--- a/arch/arm/lib/copy_from_user.S
++++ b/arch/arm/lib/copy_from_user.S
+@@ -104,7 +104,8 @@ UNWIND( .save	{r0, r2, r3, \regs}		)
+ 
+ 	.text
+ 
+-ENTRY(arm_copy_from_user)
++ENTRY(__copy_from_user_std)
++WEAK(arm_copy_from_user)
+ #ifdef CONFIG_CPU_SPECTRE
+ 	ldr	r3, =TASK_SIZE
+ 	uaccess_mask_range_ptr r1, r2, r3, ip
+@@ -113,6 +114,7 @@ ENTRY(arm_copy_from_user)
+ #include "copy_template.S"
+ 
+ ENDPROC(arm_copy_from_user)
++ENDPROC(__copy_from_user_std)
+ 
+ 	.pushsection .text.fixup,"ax"
+ 	.align 0
+--- /dev/null
++++ b/arch/arm/lib/exports_rpi.c
+@@ -0,0 +1,37 @@
++/**
++ * Copyright (c) 2014, Raspberry Pi (Trading) Ltd.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions, and the following disclaimer,
++ *    without modification.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. The names of the above-listed copyright holders may not be used
++ *    to endorse or promote products derived from this software without
++ *    specific prior written permission.
++ *
++ * ALTERNATIVELY, this software may be distributed under the terms of the
++ * GNU General Public License ("GPL") version 2, as published by the Free
++ * Software Foundation.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
++ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
++ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
++ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
++ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
++ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++
++EXPORT_SYMBOL(memcmp);
+--- /dev/null
++++ b/arch/arm/lib/memcmp_rpi.S
+@@ -0,0 +1,285 @@
++/*
++Copyright (c) 2013, Raspberry Pi Foundation
++Copyright (c) 2013, RISC OS Open Ltd
++All rights reserved.
++
++Redistribution and use in source and binary forms, with or without
++modification, are permitted provided that the following conditions are met:
++    * Redistributions of source code must retain the above copyright
++      notice, this list of conditions and the following disclaimer.
++    * Redistributions in binary form must reproduce the above copyright
++      notice, this list of conditions and the following disclaimer in the
++      documentation and/or other materials provided with the distribution.
++    * Neither the name of the copyright holder nor the
++      names of its contributors may be used to endorse or promote products
++      derived from this software without specific prior written permission.
++
++THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
++ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
++WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
++DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY
++DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
++ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++*/
++
++#include <linux/linkage.h>
++#include "arm-mem.h"
++
++/* Prevent the stack from becoming executable */
++#if defined(__linux__) && defined(__ELF__)
++.section .note.GNU-stack,"",%progbits
++#endif
++
++    .text
++    .arch armv6
++    .object_arch armv4
++    .arm
++    .altmacro
++    .p2align 2
++
++.macro memcmp_process_head  unaligned
++ .if unaligned
++        ldr     DAT0, [S_1], #4
++        ldr     DAT1, [S_1], #4
++        ldr     DAT2, [S_1], #4
++        ldr     DAT3, [S_1], #4
++ .else
++        ldmia   S_1!, {DAT0, DAT1, DAT2, DAT3}
++ .endif
++        ldmia   S_2!, {DAT4, DAT5, DAT6, DAT7}
++.endm
++
++.macro memcmp_process_tail
++        cmp     DAT0, DAT4
++        cmpeq   DAT1, DAT5
++        cmpeq   DAT2, DAT6
++        cmpeq   DAT3, DAT7
++        bne     200f
++.endm
++
++.macro memcmp_leading_31bytes
++        movs    DAT0, OFF, lsl #31
++        ldrmib  DAT0, [S_1], #1
++        ldrcsh  DAT1, [S_1], #2
++        ldrmib  DAT4, [S_2], #1
++        ldrcsh  DAT5, [S_2], #2
++        movpl   DAT0, #0
++        movcc   DAT1, #0
++        movpl   DAT4, #0
++        movcc   DAT5, #0
++        submi   N, N, #1
++        subcs   N, N, #2
++        cmp     DAT0, DAT4
++        cmpeq   DAT1, DAT5
++        bne     200f
++        movs    DAT0, OFF, lsl #29
++        ldrmi   DAT0, [S_1], #4
++        ldrcs   DAT1, [S_1], #4
++        ldrcs   DAT2, [S_1], #4
++        ldrmi   DAT4, [S_2], #4
++        ldmcsia S_2!, {DAT5, DAT6}
++        movpl   DAT0, #0
++        movcc   DAT1, #0
++        movcc   DAT2, #0
++        movpl   DAT4, #0
++        movcc   DAT5, #0
++        movcc   DAT6, #0
++        submi   N, N, #4
++        subcs   N, N, #8
++        cmp     DAT0, DAT4
++        cmpeq   DAT1, DAT5
++        cmpeq   DAT2, DAT6
++        bne     200f
++        tst     OFF, #16
++        beq     105f
++        memcmp_process_head  1
++        sub     N, N, #16
++        memcmp_process_tail
++105:
++.endm
++
++.macro memcmp_trailing_15bytes  unaligned
++        movs    N, N, lsl #29
++ .if unaligned
++        ldrcs   DAT0, [S_1], #4
++        ldrcs   DAT1, [S_1], #4
++ .else
++        ldmcsia S_1!, {DAT0, DAT1}
++ .endif
++        ldrmi   DAT2, [S_1], #4
++        ldmcsia S_2!, {DAT4, DAT5}
++        ldrmi   DAT6, [S_2], #4
++        movcc   DAT0, #0
++        movcc   DAT1, #0
++        movpl   DAT2, #0
++        movcc   DAT4, #0
++        movcc   DAT5, #0
++        movpl   DAT6, #0
++        cmp     DAT0, DAT4
++        cmpeq   DAT1, DAT5
++        cmpeq   DAT2, DAT6
++        bne     200f
++        movs    N, N, lsl #2
++        ldrcsh  DAT0, [S_1], #2
++        ldrmib  DAT1, [S_1]
++        ldrcsh  DAT4, [S_2], #2
++        ldrmib  DAT5, [S_2]
++        movcc   DAT0, #0
++        movpl   DAT1, #0
++        movcc   DAT4, #0
++        movpl   DAT5, #0
++        cmp     DAT0, DAT4
++        cmpeq   DAT1, DAT5
++        bne     200f
++.endm
++
++.macro memcmp_long_inner_loop  unaligned
++110:
++        memcmp_process_head  unaligned
++        pld     [S_2, #prefetch_distance*32 + 16]
++        memcmp_process_tail
++        memcmp_process_head  unaligned
++        pld     [S_1, OFF]
++        memcmp_process_tail
++        subs    N, N, #32
++        bhs     110b
++        /* Just before the final (prefetch_distance+1) 32-byte blocks,
++         * deal with final preloads */
++        preload_trailing  0, S_1, N, DAT0
++        preload_trailing  0, S_2, N, DAT0
++        add     N, N, #(prefetch_distance+2)*32 - 16
++120:
++        memcmp_process_head  unaligned
++        memcmp_process_tail
++        subs    N, N, #16
++        bhs     120b
++        /* Trailing words and bytes */
++        tst     N, #15
++        beq     199f
++        memcmp_trailing_15bytes  unaligned
++199:    /* Reached end without detecting a difference */
++        mov     a1, #0
++        setend  le
++        pop     {DAT1-DAT6, pc}
++.endm
++
++.macro memcmp_short_inner_loop  unaligned
++        subs    N, N, #16     /* simplifies inner loop termination */
++        blo     122f
++120:
++        memcmp_process_head  unaligned
++        memcmp_process_tail
++        subs    N, N, #16
++        bhs     120b
++122:    /* Trailing words and bytes */
++        tst     N, #15
++        beq     199f
++        memcmp_trailing_15bytes  unaligned
++199:    /* Reached end without detecting a difference */
++        mov     a1, #0
++        setend  le
++        pop     {DAT1-DAT6, pc}
++.endm
++
++/*
++ * int memcmp(const void *s1, const void *s2, size_t n);
++ * On entry:
++ * a1 = pointer to buffer 1
++ * a2 = pointer to buffer 2
++ * a3 = number of bytes to compare (as unsigned chars)
++ * On exit:
++ * a1 = >0/=0/<0 if s1 >/=/< s2
++ */
++
++.set prefetch_distance, 2
++
++ENTRY(memcmp)
++        S_1     .req    a1
++        S_2     .req    a2
++        N       .req    a3
++        DAT0    .req    a4
++        DAT1    .req    v1
++        DAT2    .req    v2
++        DAT3    .req    v3
++        DAT4    .req    v4
++        DAT5    .req    v5
++        DAT6    .req    v6
++        DAT7    .req    ip
++        OFF     .req    lr
++
++        push    {DAT1-DAT6, lr}
++        setend  be /* lowest-addressed bytes are most significant */
++
++        /* To preload ahead as we go, we need at least (prefetch_distance+2) 32-byte blocks */
++        cmp     N, #(prefetch_distance+3)*32 - 1
++        blo     170f
++
++        /* Long case */
++        /* Adjust N so that the decrement instruction can also test for
++         * inner loop termination. We want it to stop when there are
++         * (prefetch_distance+1) complete blocks to go. */
++        sub     N, N, #(prefetch_distance+2)*32
++        preload_leading_step1  0, DAT0, S_1
++        preload_leading_step1  0, DAT1, S_2
++        tst     S_2, #31
++        beq     154f
++        rsb     OFF, S_2, #0 /* no need to AND with 15 here */
++        preload_leading_step2  0, DAT0, S_1, OFF, DAT2
++        preload_leading_step2  0, DAT1, S_2, OFF, DAT2
++        memcmp_leading_31bytes
++154:    /* Second source now cacheline (32-byte) aligned; we have at
++         * least one prefetch to go. */
++        /* Prefetch offset is best selected such that it lies in the
++         * first 8 of each 32 bytes - but it's just as easy to aim for
++         * the first one */
++        and     OFF, S_1, #31
++        rsb     OFF, OFF, #32*prefetch_distance
++        tst     S_1, #3
++        bne     140f
++        memcmp_long_inner_loop  0
++140:    memcmp_long_inner_loop  1
++
++170:    /* Short case */
++        teq     N, #0
++        beq     199f
++        preload_all 0, 0, 0, S_1, N, DAT0, DAT1
++        preload_all 0, 0, 0, S_2, N, DAT0, DAT1
++        tst     S_2, #3
++        beq     174f
++172:    subs    N, N, #1
++        blo     199f
++        ldrb    DAT0, [S_1], #1
++        ldrb    DAT4, [S_2], #1
++        cmp     DAT0, DAT4
++        bne     200f
++        tst     S_2, #3
++        bne     172b
++174:    /* Second source now 4-byte aligned; we have 0 or more bytes to go */
++        tst     S_1, #3
++        bne     140f
++        memcmp_short_inner_loop  0
++140:    memcmp_short_inner_loop  1
++
++200:    /* Difference found: determine sign. */
++        movhi   a1, #1
++        movlo   a1, #-1
++        setend  le
++        pop     {DAT1-DAT6, pc}
++
++        .unreq  S_1
++        .unreq  S_2
++        .unreq  N
++        .unreq  DAT0
++        .unreq  DAT1
++        .unreq  DAT2
++        .unreq  DAT3
++        .unreq  DAT4
++        .unreq  DAT5
++        .unreq  DAT6
++        .unreq  DAT7
++        .unreq  OFF
++ENDPROC(memcmp)
+--- /dev/null
++++ b/arch/arm/lib/memcpy_rpi.S
+@@ -0,0 +1,65 @@
++/*
++Copyright (c) 2013, Raspberry Pi Foundation
++Copyright (c) 2013, RISC OS Open Ltd
++All rights reserved.
++
++Redistribution and use in source and binary forms, with or without
++modification, are permitted provided that the following conditions are met:
++    * Redistributions of source code must retain the above copyright
++      notice, this list of conditions and the following disclaimer.
++    * Redistributions in binary form must reproduce the above copyright
++      notice, this list of conditions and the following disclaimer in the
++      documentation and/or other materials provided with the distribution.
++    * Neither the name of the copyright holder nor the
++      names of its contributors may be used to endorse or promote products
++      derived from this software without specific prior written permission.
++
++THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
++ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
++WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
++DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY
++DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
++ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++*/
++
++#include <linux/linkage.h>
++#include <asm/assembler.h>
++#include <asm/unwind.h>
++#include "arm-mem.h"
++#include "memcpymove.h"
++
++/* Prevent the stack from becoming executable */
++#if defined(__linux__) && defined(__ELF__)
++.section .note.GNU-stack,"",%progbits
++#endif
++
++    .text
++    .arch armv6
++    .object_arch armv4
++    .arm
++    .altmacro
++    .p2align 2
++
++/*
++ * void *memcpy(void * restrict s1, const void * restrict s2, size_t n);
++ * On entry:
++ * a1 = pointer to destination
++ * a2 = pointer to source
++ * a3 = number of bytes to copy
++ * On exit:
++ * a1 preserved
++ */
++
++.set prefetch_distance, 3
++
++ENTRY(mmiocpy)
++ENTRY(memcpy)
++ENTRY(__memcpy)
++        memcpy  0
++ENDPROC(__memcpy)
++ENDPROC(memcpy)
++ENDPROC(mmiocpy)
+--- /dev/null
++++ b/arch/arm/lib/memcpymove.h
+@@ -0,0 +1,488 @@
++/*
++Copyright (c) 2013, Raspberry Pi Foundation
++Copyright (c) 2013, RISC OS Open Ltd
++All rights reserved.
++
++Redistribution and use in source and binary forms, with or without
++modification, are permitted provided that the following conditions are met:
++    * Redistributions of source code must retain the above copyright
++      notice, this list of conditions and the following disclaimer.
++    * Redistributions in binary form must reproduce the above copyright
++      notice, this list of conditions and the following disclaimer in the
++      documentation and/or other materials provided with the distribution.
++    * Neither the name of the copyright holder nor the
++      names of its contributors may be used to endorse or promote products
++      derived from this software without specific prior written permission.
++
++THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
++ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
++WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
++DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY
++DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
++ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++*/
++
++.macro unaligned_words  backwards, align, use_pld, words, r0, r1, r2, r3, r4, r5, r6, r7, r8
++ .if words == 1
++  .if backwards
++        mov     r1, r0, lsl #32-align*8
++        ldr     r0, [S, #-4]!
++        orr     r1, r1, r0, lsr #align*8
++        str     r1, [D, #-4]!
++  .else
++        mov     r0, r1, lsr #align*8
++        ldr     r1, [S, #4]!
++        orr     r0, r0, r1, lsl #32-align*8
++        str     r0, [D], #4
++  .endif
++ .elseif words == 2
++  .if backwards
++        ldr     r1, [S, #-4]!
++        mov     r2, r0, lsl #32-align*8
++        ldr     r0, [S, #-4]!
++        orr     r2, r2, r1, lsr #align*8
++        mov     r1, r1, lsl #32-align*8
++        orr     r1, r1, r0, lsr #align*8
++        stmdb   D!, {r1, r2}
++  .else
++        ldr     r1, [S, #4]!
++        mov     r0, r2, lsr #align*8
++        ldr     r2, [S, #4]!
++        orr     r0, r0, r1, lsl #32-align*8
++        mov     r1, r1, lsr #align*8
++        orr     r1, r1, r2, lsl #32-align*8
++        stmia   D!, {r0, r1}
++  .endif
++ .elseif words == 4
++  .if backwards
++        ldmdb   S!, {r2, r3}
++        mov     r4, r0, lsl #32-align*8
++        ldmdb   S!, {r0, r1}
++        orr     r4, r4, r3, lsr #align*8
++        mov     r3, r3, lsl #32-align*8
++        orr     r3, r3, r2, lsr #align*8
++        mov     r2, r2, lsl #32-align*8
++        orr     r2, r2, r1, lsr #align*8
++        mov     r1, r1, lsl #32-align*8
++        orr     r1, r1, r0, lsr #align*8
++        stmdb   D!, {r1, r2, r3, r4}
++  .else
++        ldmib   S!, {r1, r2}
++        mov     r0, r4, lsr #align*8
++        ldmib   S!, {r3, r4}
++        orr     r0, r0, r1, lsl #32-align*8
++        mov     r1, r1, lsr #align*8
++        orr     r1, r1, r2, lsl #32-align*8
++        mov     r2, r2, lsr #align*8
++        orr     r2, r2, r3, lsl #32-align*8
++        mov     r3, r3, lsr #align*8
++        orr     r3, r3, r4, lsl #32-align*8
++        stmia   D!, {r0, r1, r2, r3}
++  .endif
++ .elseif words == 8
++  .if backwards
++        ldmdb   S!, {r4, r5, r6, r7}
++        mov     r8, r0, lsl #32-align*8
++        ldmdb   S!, {r0, r1, r2, r3}
++   .if use_pld
++        pld     [S, OFF]
++   .endif
++        orr     r8, r8, r7, lsr #align*8
++        mov     r7, r7, lsl #32-align*8
++        orr     r7, r7, r6, lsr #align*8
++        mov     r6, r6, lsl #32-align*8
++        orr     r6, r6, r5, lsr #align*8
++        mov     r5, r5, lsl #32-align*8
++        orr     r5, r5, r4, lsr #align*8
++        mov     r4, r4, lsl #32-align*8
++        orr     r4, r4, r3, lsr #align*8
++        mov     r3, r3, lsl #32-align*8
++        orr     r3, r3, r2, lsr #align*8
++        mov     r2, r2, lsl #32-align*8
++        orr     r2, r2, r1, lsr #align*8
++        mov     r1, r1, lsl #32-align*8
++        orr     r1, r1, r0, lsr #align*8
++        stmdb   D!, {r5, r6, r7, r8}
++        stmdb   D!, {r1, r2, r3, r4}
++  .else
++        ldmib   S!, {r1, r2, r3, r4}
++        mov     r0, r8, lsr #align*8
++        ldmib   S!, {r5, r6, r7, r8}
++   .if use_pld
++        pld     [S, OFF]
++   .endif
++        orr     r0, r0, r1, lsl #32-align*8
++        mov     r1, r1, lsr #align*8
++        orr     r1, r1, r2, lsl #32-align*8
++        mov     r2, r2, lsr #align*8
++        orr     r2, r2, r3, lsl #32-align*8
++        mov     r3, r3, lsr #align*8
++        orr     r3, r3, r4, lsl #32-align*8
++        mov     r4, r4, lsr #align*8
++        orr     r4, r4, r5, lsl #32-align*8
++        mov     r5, r5, lsr #align*8
++        orr     r5, r5, r6, lsl #32-align*8
++        mov     r6, r6, lsr #align*8
++        orr     r6, r6, r7, lsl #32-align*8
++        mov     r7, r7, lsr #align*8
++        orr     r7, r7, r8, lsl #32-align*8
++        stmia   D!, {r0, r1, r2, r3}
++        stmia   D!, {r4, r5, r6, r7}
++  .endif
++ .endif
++.endm
++
++.macro memcpy_leading_15bytes  backwards, align
++        movs    DAT1, DAT2, lsl #31
++        sub     N, N, DAT2
++ .if backwards
++        ldrmib  DAT0, [S, #-1]!
++        ldrcsh  DAT1, [S, #-2]!
++        strmib  DAT0, [D, #-1]!
++        strcsh  DAT1, [D, #-2]!
++ .else
++        ldrmib  DAT0, [S], #1
++        ldrcsh  DAT1, [S], #2
++        strmib  DAT0, [D], #1
++        strcsh  DAT1, [D], #2
++ .endif
++        movs    DAT1, DAT2, lsl #29
++ .if backwards
++        ldrmi   DAT0, [S, #-4]!
++  .if align == 0
++        ldmcsdb S!, {DAT1, DAT2}
++  .else
++        ldrcs   DAT2, [S, #-4]!
++        ldrcs   DAT1, [S, #-4]!
++  .endif
++        strmi   DAT0, [D, #-4]!
++        stmcsdb D!, {DAT1, DAT2}
++ .else
++        ldrmi   DAT0, [S], #4
++  .if align == 0
++        ldmcsia S!, {DAT1, DAT2}
++  .else
++        ldrcs   DAT1, [S], #4
++        ldrcs   DAT2, [S], #4
++  .endif
++        strmi   DAT0, [D], #4
++        stmcsia D!, {DAT1, DAT2}
++ .endif
++.endm
++
++.macro memcpy_trailing_15bytes  backwards, align
++        movs    N, N, lsl #29
++ .if backwards
++  .if align == 0
++        ldmcsdb S!, {DAT0, DAT1}
++  .else
++        ldrcs   DAT1, [S, #-4]!
++        ldrcs   DAT0, [S, #-4]!
++  .endif
++        ldrmi   DAT2, [S, #-4]!
++        stmcsdb D!, {DAT0, DAT1}
++        strmi   DAT2, [D, #-4]!
++ .else
++  .if align == 0
++        ldmcsia S!, {DAT0, DAT1}
++  .else
++        ldrcs   DAT0, [S], #4
++        ldrcs   DAT1, [S], #4
++  .endif
++        ldrmi   DAT2, [S], #4
++        stmcsia D!, {DAT0, DAT1}
++        strmi   DAT2, [D], #4
++ .endif
++        movs    N, N, lsl #2
++ .if backwards
++        ldrcsh  DAT0, [S, #-2]!
++        ldrmib  DAT1, [S, #-1]
++        strcsh  DAT0, [D, #-2]!
++        strmib  DAT1, [D, #-1]
++ .else
++        ldrcsh  DAT0, [S], #2
++        ldrmib  DAT1, [S]
++        strcsh  DAT0, [D], #2
++        strmib  DAT1, [D]
++ .endif
++.endm
++
++.macro memcpy_long_inner_loop  backwards, align
++ .if align != 0
++  .if backwards
++        ldr     DAT0, [S, #-align]!
++  .else
++        ldr     LAST, [S, #-align]!
++  .endif
++ .endif
++110:
++ .if align == 0
++  .if backwards
++        ldmdb   S!, {DAT0, DAT1, DAT2, DAT3, DAT4, DAT5, DAT6, LAST}
++        pld     [S, OFF]
++        stmdb   D!, {DAT4, DAT5, DAT6, LAST}
++        stmdb   D!, {DAT0, DAT1, DAT2, DAT3}
++  .else
++        ldmia   S!, {DAT0, DAT1, DAT2, DAT3, DAT4, DAT5, DAT6, LAST}
++        pld     [S, OFF]
++        stmia   D!, {DAT0, DAT1, DAT2, DAT3}
++        stmia   D!, {DAT4, DAT5, DAT6, LAST}
++  .endif
++ .else
++        unaligned_words  backwards, align, 1, 8, DAT0, DAT1, DAT2, DAT3, DAT4, DAT5, DAT6, DAT7, LAST
++ .endif
++        subs    N, N, #32
++        bhs     110b
++        /* Just before the final (prefetch_distance+1) 32-byte blocks, deal with final preloads */
++        preload_trailing  backwards, S, N, OFF
++        add     N, N, #(prefetch_distance+2)*32 - 32
++120:
++ .if align == 0
++  .if backwards
++        ldmdb   S!, {DAT0, DAT1, DAT2, DAT3, DAT4, DAT5, DAT6, LAST}
++        stmdb   D!, {DAT4, DAT5, DAT6, LAST}
++        stmdb   D!, {DAT0, DAT1, DAT2, DAT3}
++  .else
++        ldmia   S!, {DAT0, DAT1, DAT2, DAT3, DAT4, DAT5, DAT6, LAST}
++        stmia   D!, {DAT0, DAT1, DAT2, DAT3}
++        stmia   D!, {DAT4, DAT5, DAT6, LAST}
++  .endif
++ .else
++        unaligned_words  backwards, align, 0, 8, DAT0, DAT1, DAT2, DAT3, DAT4, DAT5, DAT6, DAT7, LAST
++ .endif
++        subs    N, N, #32
++        bhs     120b
++        tst     N, #16
++ .if align == 0
++  .if backwards
++        ldmnedb S!, {DAT0, DAT1, DAT2, LAST}
++        stmnedb D!, {DAT0, DAT1, DAT2, LAST}
++  .else
++        ldmneia S!, {DAT0, DAT1, DAT2, LAST}
++        stmneia D!, {DAT0, DAT1, DAT2, LAST}
++  .endif
++ .else
++        beq     130f
++        unaligned_words  backwards, align, 0, 4, DAT0, DAT1, DAT2, DAT3, LAST
++130:
++ .endif
++        /* Trailing words and bytes */
++        tst      N, #15
++        beq      199f
++ .if align != 0
++        add     S, S, #align
++ .endif
++        memcpy_trailing_15bytes  backwards, align
++199:
++        pop     {DAT3, DAT4, DAT5, DAT6, DAT7}
++        pop     {D, DAT1, DAT2, pc}
++.endm
++
++.macro memcpy_medium_inner_loop  backwards, align
++120:
++ .if backwards
++  .if align == 0
++        ldmdb   S!, {DAT0, DAT1, DAT2, LAST}
++  .else
++        ldr     LAST, [S, #-4]!
++        ldr     DAT2, [S, #-4]!
++        ldr     DAT1, [S, #-4]!
++        ldr     DAT0, [S, #-4]!
++  .endif
++        stmdb   D!, {DAT0, DAT1, DAT2, LAST}
++ .else
++  .if align == 0
++        ldmia   S!, {DAT0, DAT1, DAT2, LAST}
++  .else
++        ldr     DAT0, [S], #4
++        ldr     DAT1, [S], #4
++        ldr     DAT2, [S], #4
++        ldr     LAST, [S], #4
++  .endif
++        stmia   D!, {DAT0, DAT1, DAT2, LAST}
++ .endif
++        subs     N, N, #16
++        bhs      120b
++        /* Trailing words and bytes */
++        tst      N, #15
++        beq      199f
++        memcpy_trailing_15bytes  backwards, align
++199:
++        pop     {D, DAT1, DAT2, pc}
++.endm
++
++.macro memcpy_short_inner_loop  backwards, align
++        tst     N, #16
++ .if backwards
++  .if align == 0
++        ldmnedb S!, {DAT0, DAT1, DAT2, LAST}
++  .else
++        ldrne   LAST, [S, #-4]!
++        ldrne   DAT2, [S, #-4]!
++        ldrne   DAT1, [S, #-4]!
++        ldrne   DAT0, [S, #-4]!
++  .endif
++        stmnedb D!, {DAT0, DAT1, DAT2, LAST}
++ .else
++  .if align == 0
++        ldmneia S!, {DAT0, DAT1, DAT2, LAST}
++  .else
++        ldrne   DAT0, [S], #4
++        ldrne   DAT1, [S], #4
++        ldrne   DAT2, [S], #4
++        ldrne   LAST, [S], #4
++  .endif
++        stmneia D!, {DAT0, DAT1, DAT2, LAST}
++ .endif
++        memcpy_trailing_15bytes  backwards, align
++199:
++        pop     {D, DAT1, DAT2, pc}
++.endm
++
++.macro memcpy backwards
++        D       .req    a1
++        S       .req    a2
++        N       .req    a3
++        DAT0    .req    a4
++        DAT1    .req    v1
++        DAT2    .req    v2
++        DAT3    .req    v3
++        DAT4    .req    v4
++        DAT5    .req    v5
++        DAT6    .req    v6
++        DAT7    .req    sl
++        LAST    .req    ip
++        OFF     .req    lr
++
++        UNWIND( .fnstart )
++
++        push    {D, DAT1, DAT2, lr}
++        UNWIND( .fnend )
++
++        UNWIND( .fnstart )
++        UNWIND( .save {D, DAT1, DAT2, lr} )
++
++ .if backwards
++        add     D, D, N
++        add     S, S, N
++ .endif
++
++        /* See if we're guaranteed to have at least one 16-byte aligned 16-byte write */
++        cmp     N, #31
++        blo     170f
++        /* To preload ahead as we go, we need at least (prefetch_distance+2) 32-byte blocks */
++        cmp     N, #(prefetch_distance+3)*32 - 1
++        blo     160f
++
++        /* Long case */
++        push    {DAT3, DAT4, DAT5, DAT6, DAT7}
++        UNWIND( .fnend )
++
++        UNWIND( .fnstart )
++        UNWIND( .save {D, DAT1, DAT2, lr} )
++        UNWIND( .save {DAT3, DAT4, DAT5, DAT6, DAT7} )
++
++        /* Adjust N so that the decrement instruction can also test for
++         * inner loop termination. We want it to stop when there are
++         * (prefetch_distance+1) complete blocks to go. */
++        sub     N, N, #(prefetch_distance+2)*32
++        preload_leading_step1  backwards, DAT0, S
++ .if backwards
++        /* Bug in GAS: it accepts, but mis-assembles the instruction
++         * ands    DAT2, D, #60, 2
++         * which sets DAT2 to the number of leading bytes until destination is aligned and also clears C (sets borrow)
++         */
++        .word   0xE210513C
++        beq     154f
++ .else
++        ands    DAT2, D, #15
++        beq     154f
++        rsb     DAT2, DAT2, #16 /* number of leading bytes until destination aligned */
++ .endif
++        preload_leading_step2  backwards, DAT0, S, DAT2, OFF
++        memcpy_leading_15bytes backwards, 1
++154:    /* Destination now 16-byte aligned; we have at least one prefetch as well as at least one 16-byte output block */
++        /* Prefetch offset is best selected such that it lies in the first 8 of each 32 bytes - but it's just as easy to aim for the first one */
++ .if backwards
++        rsb     OFF, S, #3
++        and     OFF, OFF, #28
++        sub     OFF, OFF, #32*(prefetch_distance+1)
++ .else
++        and     OFF, S, #28
++        rsb     OFF, OFF, #32*prefetch_distance
++ .endif
++        movs    DAT0, S, lsl #31
++        bhi     157f
++        bcs     156f
++        bmi     155f
++        memcpy_long_inner_loop  backwards, 0
++155:    memcpy_long_inner_loop  backwards, 1
++156:    memcpy_long_inner_loop  backwards, 2
++157:    memcpy_long_inner_loop  backwards, 3
++
++        UNWIND( .fnend )
++
++        UNWIND( .fnstart )
++        UNWIND( .save {D, DAT1, DAT2, lr} )
++
++160:    /* Medium case */
++        preload_all  backwards, 0, 0, S, N, DAT2, OFF
++        sub     N, N, #16     /* simplifies inner loop termination */
++ .if backwards
++        ands    DAT2, D, #15
++        beq     164f
++ .else
++        ands    DAT2, D, #15
++        beq     164f
++        rsb     DAT2, DAT2, #16
++ .endif
++        memcpy_leading_15bytes backwards, align
++164:    /* Destination now 16-byte aligned; we have at least one 16-byte output block */
++        tst     S, #3
++        bne     140f
++        memcpy_medium_inner_loop  backwards, 0
++140:    memcpy_medium_inner_loop  backwards, 1
++
++170:    /* Short case, less than 31 bytes, so no guarantee of at least one 16-byte block */
++        teq     N, #0
++        beq     199f
++        preload_all  backwards, 1, 0, S, N, DAT2, LAST
++        tst     D, #3
++        beq     174f
++172:    subs    N, N, #1
++        blo     199f
++ .if backwards
++        ldrb    DAT0, [S, #-1]!
++        strb    DAT0, [D, #-1]!
++ .else
++        ldrb    DAT0, [S], #1
++        strb    DAT0, [D], #1
++ .endif
++        tst     D, #3
++        bne     172b
++174:    /* Destination now 4-byte aligned; we have 0 or more output bytes to go */
++        tst     S, #3
++        bne     140f
++        memcpy_short_inner_loop  backwards, 0
++140:    memcpy_short_inner_loop  backwards, 1
++
++        UNWIND( .fnend )
++
++        .unreq  D
++        .unreq  S
++        .unreq  N
++        .unreq  DAT0
++        .unreq  DAT1
++        .unreq  DAT2
++        .unreq  DAT3
++        .unreq  DAT4
++        .unreq  DAT5
++        .unreq  DAT6
++        .unreq  DAT7
++        .unreq  LAST
++        .unreq  OFF
++.endm
+--- /dev/null
++++ b/arch/arm/lib/memmove_rpi.S
+@@ -0,0 +1,63 @@
++/*
++Copyright (c) 2013, Raspberry Pi Foundation
++Copyright (c) 2013, RISC OS Open Ltd
++All rights reserved.
++
++Redistribution and use in source and binary forms, with or without
++modification, are permitted provided that the following conditions are met:
++    * Redistributions of source code must retain the above copyright
++      notice, this list of conditions and the following disclaimer.
++    * Redistributions in binary form must reproduce the above copyright
++      notice, this list of conditions and the following disclaimer in the
++      documentation and/or other materials provided with the distribution.
++    * Neither the name of the copyright holder nor the
++      names of its contributors may be used to endorse or promote products
++      derived from this software without specific prior written permission.
++
++THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
++ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
++WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
++DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY
++DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
++ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++*/
++
++#include <linux/linkage.h>
++#include <asm/assembler.h>
++#include <asm/unwind.h>
++#include "arm-mem.h"
++#include "memcpymove.h"
++
++/* Prevent the stack from becoming executable */
++#if defined(__linux__) && defined(__ELF__)
++.section .note.GNU-stack,"",%progbits
++#endif
++
++    .text
++    .arch armv6
++    .object_arch armv4
++    .arm
++    .altmacro
++    .p2align 2
++
++/*
++ * void *memmove(void *s1, const void *s2, size_t n);
++ * On entry:
++ * a1 = pointer to destination
++ * a2 = pointer to source
++ * a3 = number of bytes to copy
++ * On exit:
++ * a1 preserved
++ */
++
++.set prefetch_distance, 3
++
++ENTRY(memmove)
++        cmp     a2, a1
++        bpl     memcpy  /* pl works even over -1 - 0 and 0x7fffffff - 0x80000000 boundaries */
++        memcpy  1
++ENDPROC(memmove)
+--- /dev/null
++++ b/arch/arm/lib/memset_rpi.S
+@@ -0,0 +1,132 @@
++/*
++Copyright (c) 2013, Raspberry Pi Foundation
++Copyright (c) 2013, RISC OS Open Ltd
++All rights reserved.
++
++Redistribution and use in source and binary forms, with or without
++modification, are permitted provided that the following conditions are met:
++    * Redistributions of source code must retain the above copyright
++      notice, this list of conditions and the following disclaimer.
++    * Redistributions in binary form must reproduce the above copyright
++      notice, this list of conditions and the following disclaimer in the
++      documentation and/or other materials provided with the distribution.
++    * Neither the name of the copyright holder nor the
++      names of its contributors may be used to endorse or promote products
++      derived from this software without specific prior written permission.
++
++THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
++ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
++WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
++DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY
++DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
++ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++*/
++
++#include <linux/linkage.h>
++#include "arm-mem.h"
++
++/* Prevent the stack from becoming executable */
++#if defined(__linux__) && defined(__ELF__)
++.section .note.GNU-stack,"",%progbits
++#endif
++
++    .text
++    .arch armv6
++    .object_arch armv4
++    .arm
++    .altmacro
++    .p2align 2
++
++/*
++ *  void *memset(void *s, int c, size_t n);
++ *  On entry:
++ *  a1 = pointer to buffer to fill
++ *  a2 = byte pattern to fill with (caller-narrowed)
++ *  a3 = number of bytes to fill
++ *  On exit:
++ *  a1 preserved
++ */
++ENTRY(mmioset)
++ENTRY(memset)
++ENTRY(__memset)
++
++        S       .req    a1
++        DAT0    .req    a2
++        N       .req    a3
++        DAT1    .req    a4
++        DAT2    .req    ip
++        DAT3    .req    lr
++
++        orr     DAT0, DAT0, DAT0, lsl #8
++        orr     DAT0, DAT0, DAT0, lsl #16
++
++ENTRY(__memset32)
++        mov     DAT1, DAT0
++
++ENTRY(__memset64)
++        push    {S, lr}
++
++        /* See if we're guaranteed to have at least one 16-byte aligned 16-byte write */
++        cmp     N, #31
++        blo     170f
++
++161:    sub     N, N, #16     /* simplifies inner loop termination */
++        /* Leading words and bytes */
++        tst     S, #15
++        beq     164f
++        rsb     DAT3, S, #0   /* bits 0-3 = number of leading bytes until aligned */
++        movs    DAT2, DAT3, lsl #31
++        submi   N, N, #1
++        strmib  DAT0, [S], #1
++        subcs   N, N, #2
++        strcsh  DAT0, [S], #2
++        movs    DAT2, DAT3, lsl #29
++        submi   N, N, #4
++        strmi   DAT0, [S], #4
++        subcs   N, N, #8
++        stmcsia S!, {DAT0, DAT1}
++164:    /* Delayed set up of DAT2 and DAT3 so we could use them as scratch registers above */
++        mov     DAT2, DAT0
++        mov     DAT3, DAT1
++        /* Now the inner loop of 16-byte stores */
++165:    stmia   S!, {DAT0, DAT1, DAT2, DAT3}
++        subs    N, N, #16
++        bhs     165b
++166:    /* Trailing words and bytes */
++        movs    N, N, lsl #29
++        stmcsia S!, {DAT0, DAT1}
++        strmi   DAT0, [S], #4
++        movs    N, N, lsl #2
++        strcsh  DAT0, [S], #2
++        strmib  DAT0, [S]
++199:    pop     {S, pc}
++
++170:    /* Short case */
++        mov     DAT2, DAT0
++        mov     DAT3, DAT1
++        tst     S, #3
++        beq     174f
++172:    subs    N, N, #1
++        blo     199b
++        strb    DAT0, [S], #1
++        tst     S, #3
++        bne     172b
++174:    tst     N, #16
++        stmneia S!, {DAT0, DAT1, DAT2, DAT3}
++        b       166b
++
++        .unreq  S
++        .unreq  DAT0
++        .unreq  N
++        .unreq  DAT1
++        .unreq  DAT2
++        .unreq  DAT3
++ENDPROC(__memset64)
++ENDPROC(__memset32)
++ENDPROC(__memset)
++ENDPROC(memset)
++ENDPROC(mmioset)
+--- a/arch/arm/lib/uaccess_with_memcpy.c
++++ b/arch/arm/lib/uaccess_with_memcpy.c
+@@ -19,6 +19,14 @@
+ #include <asm/current.h>
+ #include <asm/page.h>
+ 
++#ifndef COPY_FROM_USER_THRESHOLD
++#define COPY_FROM_USER_THRESHOLD 64
++#endif
++
++#ifndef COPY_TO_USER_THRESHOLD
++#define COPY_TO_USER_THRESHOLD 64
++#endif
++
+ static int
+ pin_page_for_write(const void __user *_addr, pte_t **ptep, spinlock_t **ptlp)
+ {
+@@ -43,7 +51,7 @@ pin_page_for_write(const void __user *_a
+ 		return 0;
+ 
+ 	pmd = pmd_offset(pud, addr);
+-	if (unlikely(pmd_none(*pmd)))
++	if (unlikely(pmd_none(*pmd) || pmd_bad(*pmd)))
+ 		return 0;
+ 
+ 	/*
+@@ -89,6 +97,47 @@ pin_page_for_write(const void __user *_a
+ 	return 1;
+ }
+ 
++#ifdef CONFIG_BCM2835_FAST_MEMCPY
++static int
++pin_page_for_read(const void __user *_addr, pte_t **ptep, spinlock_t **ptlp)
++{
++	unsigned long addr = (unsigned long)_addr;
++	pgd_t *pgd;
++	p4d_t *p4d;
++	pmd_t *pmd;
++	pte_t *pte;
++	pud_t *pud;
++	spinlock_t *ptl;
++
++	pgd = pgd_offset(current->mm, addr);
++	if (unlikely(pgd_none(*pgd) || pgd_bad(*pgd)))
++		return 0;
++
++	p4d = p4d_offset(pgd, addr);
++	if (unlikely(p4d_none(*p4d) || p4d_bad(*p4d)))
++		return 0;
++
++	pud = pud_offset(p4d, addr);
++	if (unlikely(pud_none(*pud) || pud_bad(*pud)))
++		return 0;
++
++	pmd = pmd_offset(pud, addr);
++	if (unlikely(pmd_none(*pmd) || pmd_bad(*pmd)))
++		return 0;
++
++	pte = pte_offset_map_lock(current->mm, pmd, addr, &ptl);
++	if (unlikely(!pte_present(*pte) || !pte_young(*pte))) {
++		pte_unmap_unlock(pte, ptl);
++		return 0;
++	}
++
++	*ptep = pte;
++	*ptlp = ptl;
++
++	return 1;
++}
++#endif
++
+ static unsigned long noinline
+ __copy_to_user_memcpy(void __user *to, const void *from, unsigned long n)
+ {
+@@ -137,6 +186,54 @@ out:
+ 	return n;
+ }
+ 
++#ifdef CONFIG_BCM2835_FAST_MEMCPY
++static unsigned long noinline
++__copy_from_user_memcpy(void *to, const void __user *from, unsigned long n)
++{
++	unsigned long ua_flags;
++	int atomic;
++
++	/* the mmap semaphore is taken only if not in an atomic context */
++	atomic = in_atomic();
++
++	if (!atomic)
++		mmap_read_lock(current->mm);
++	while (n) {
++		pte_t *pte;
++		spinlock_t *ptl;
++		int tocopy;
++
++		while (!pin_page_for_read(from, &pte, &ptl)) {
++			char temp;
++			if (!atomic)
++				mmap_read_unlock(current->mm);
++			if (__get_user(temp, (char __user *)from))
++				goto out;
++			if (!atomic)
++				mmap_read_lock(current->mm);
++		}
++
++		tocopy = (~(unsigned long)from & ~PAGE_MASK) + 1;
++		if (tocopy > n)
++			tocopy = n;
++
++		ua_flags = uaccess_save_and_enable();
++		memcpy(to, (const void *)from, tocopy);
++		uaccess_restore(ua_flags);
++		to += tocopy;
++		from += tocopy;
++		n -= tocopy;
++
++		pte_unmap_unlock(pte, ptl);
++	}
++	if (!atomic)
++		mmap_read_unlock(current->mm);
++
++out:
++	return n;
++}
++#endif
++
+ unsigned long
+ arm_copy_to_user(void __user *to, const void *from, unsigned long n)
+ {
+@@ -147,7 +244,7 @@ arm_copy_to_user(void __user *to, const
+ 	 * With frame pointer disabled, tail call optimization kicks in
+ 	 * as well making this test almost invisible.
+ 	 */
+-	if (n < 64) {
++	if (n < COPY_TO_USER_THRESHOLD) {
+ 		unsigned long ua_flags = uaccess_save_and_enable();
+ 		n = __copy_to_user_std(to, from, n);
+ 		uaccess_restore(ua_flags);
+@@ -157,6 +254,32 @@ arm_copy_to_user(void __user *to, const
+ 	}
+ 	return n;
+ }
++
++unsigned long __must_check
++arm_copy_from_user(void *to, const void __user *from, unsigned long n)
++{
++#ifdef CONFIG_BCM2835_FAST_MEMCPY
++	/*
++	 * This test is stubbed out of the main function above to keep
++	 * the overhead for small copies low by avoiding a large
++	 * register dump on the stack just to reload them right away.
++	 * With frame pointer disabled, tail call optimization kicks in
++	 * as well making this test almost invisible.
++	 */
++	if (n < COPY_TO_USER_THRESHOLD) {
++		unsigned long ua_flags = uaccess_save_and_enable();
++		n = __copy_from_user_std(to, from, n);
++		uaccess_restore(ua_flags);
++	} else {
++		n = __copy_from_user_memcpy(to, from, n);
++	}
++#else
++	unsigned long ua_flags = uaccess_save_and_enable();
++	n = __copy_from_user_std(to, from, n);
++	uaccess_restore(ua_flags);
++#endif
++	return n;
++}
+ 	
+ static unsigned long noinline
+ __clear_user_memset(void __user *addr, unsigned long n)
+--- a/arch/arm/mach-bcm/Kconfig
++++ b/arch/arm/mach-bcm/Kconfig
+@@ -181,6 +181,13 @@ config ARCH_BCM_53573
+ 	  The base chip is BCM53573 and there are some packaging modifications
+ 	  like BCM47189 and BCM47452.
+ 
++config BCM2835_FAST_MEMCPY
++	bool "Enable optimized __copy_to_user and __copy_from_user"
++	depends on ARCH_BCM2835 && ARCH_MULTI_V6
++	default y
++	help
++	  Optimized versions of __copy_to_user and __copy_from_user for Pi1.
++
+ config ARCH_BRCMSTB
+ 	bool "Broadcom BCM7XXX based boards"
+ 	depends on ARCH_MULTI_V7
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0070-mfd-Add-Raspberry-Pi-Sense-HAT-core-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0070-mfd-Add-Raspberry-Pi-Sense-HAT-core-driver.patch
new file mode 100644
index 00000000..eb001b44
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0070-mfd-Add-Raspberry-Pi-Sense-HAT-core-driver.patch
@@ -0,0 +1,408 @@
+From 82aebddad0ceb9b44158f0cb87f5b34c2a647c42 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <pelwell@users.noreply.github.com>
+Date: Tue, 14 Jul 2015 14:32:47 +0100
+Subject: [PATCH 070/697] mfd: Add Raspberry Pi Sense HAT core driver
+
+mfd: Add rpi_sense_core of compatible string
+
+rpisense-fb: Set pseudo_pallete to prevent crash on fbcon takeover
+
+Signed-off-by: Serge Schneider <serge@raspberrypi.com>
+
+rpisense-fb: Add explicit fb_deferred_io_mmap hook
+
+As of commit [1], introduced in 5.18, fbdev drivers that use
+deferred IO and need mmap support must include an explicit fb_mmap
+pointer to the fb_deferred_io_mmap.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+[1] 590558510327 ("fbdev: Put mmap for deferred I/O into drivers")
+
+drivers: Remove downstream SenseHAT core and joystick drivers
+
+Parts of a SenseHAT driver have been submitted upstream using the
+simple-i2c-mfd framework. The joystick driver has been merged.
+
+It's been noted that there are several issues with the downstream
+joystick and core drivers, so remove these in favour of the upstream
+approach, and fix up the FB driver to match.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/video/fbdev/Kconfig              |  13 +
+ drivers/video/fbdev/Makefile             |   1 +
+ drivers/video/fbdev/rpisense-fb.c        | 295 +++++++++++++++++++++++
+ include/linux/mfd/rpisense/framebuffer.h |  35 +++
+ 4 files changed, 344 insertions(+)
+ create mode 100644 drivers/video/fbdev/rpisense-fb.c
+ create mode 100644 include/linux/mfd/rpisense/framebuffer.h
+
+--- a/drivers/video/fbdev/Kconfig
++++ b/drivers/video/fbdev/Kconfig
+@@ -1826,6 +1826,19 @@ config FB_SM712
+ 	  called sm712fb. If you want to compile it as a module, say M
+ 	  here and read <file:Documentation/kbuild/modules.rst>.
+ 
++config FB_RPISENSE
++	tristate "Raspberry Pi Sense HAT framebuffer"
++	depends on FB && I2C
++	select MFD_SIMPLE_MFD_I2C
++	select FB_SYS_FOPS
++	select FB_SYS_FILLRECT
++	select FB_SYS_COPYAREA
++	select FB_SYS_IMAGEBLIT
++	select FB_DEFERRED_IO
++
++	help
++	  This is the framebuffer driver for the Raspberry Pi Sense HAT
++
+ source "drivers/video/fbdev/omap/Kconfig"
+ source "drivers/video/fbdev/omap2/Kconfig"
+ source "drivers/video/fbdev/mmp/Kconfig"
+--- a/drivers/video/fbdev/Makefile
++++ b/drivers/video/fbdev/Makefile
+@@ -124,6 +124,7 @@ obj-$(CONFIG_FB_VGA16)            += vga
+ obj-$(CONFIG_FB_OF)               += offb.o
+ obj-$(CONFIG_FB_SSD1307)	  += ssd1307fb.o
+ obj-$(CONFIG_FB_SIMPLE)           += simplefb.o
++obj-$(CONFIG_FB_RPISENSE)	  += rpisense-fb.o
+ 
+ # the test framebuffer is last
+ obj-$(CONFIG_FB_VIRTUAL)          += vfb.o
+--- /dev/null
++++ b/drivers/video/fbdev/rpisense-fb.c
+@@ -0,0 +1,295 @@
++/*
++ * Raspberry Pi Sense HAT framebuffer driver
++ * http://raspberrypi.org
++ *
++ * Copyright (C) 2015 Raspberry Pi
++ *
++ * Author: Serge Schneider
++ *
++ *  This program is free software; you can redistribute  it and/or modify it
++ *  under  the terms of  the GNU General  Public License as published by the
++ *  Free Software Foundation;  either version 2 of the  License, or (at your
++ *  option) any later version.
++ *
++ */
++
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/errno.h>
++#include <linux/string.h>
++#include <linux/mm.h>
++#include <linux/slab.h>
++#include <linux/uaccess.h>
++#include <linux/delay.h>
++#include <linux/fb.h>
++#include <linux/init.h>
++#include <linux/vmalloc.h>
++#include <linux/platform_device.h>
++
++#include <linux/mfd/rpisense/framebuffer.h>
++
++static bool lowlight;
++module_param(lowlight, bool, 0);
++MODULE_PARM_DESC(lowlight, "Reduce LED matrix brightness to one third");
++
++struct rpisense_fb_param {
++	char __iomem *vmem;
++	u8 *vmem_work;
++	u32 vmemsize;
++	u8 *gamma;
++};
++
++static u8 gamma_default[32] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01,
++			       0x02, 0x02, 0x03, 0x03, 0x04, 0x05, 0x06, 0x07,
++			       0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0E, 0x0F, 0x11,
++			       0x12, 0x14, 0x15, 0x17, 0x19, 0x1B, 0x1D, 0x1F,};
++
++static u8 gamma_low[32] = {0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
++			   0x01, 0x01, 0x01, 0x01, 0x01, 0x02, 0x02, 0x02,
++			   0x03, 0x03, 0x03, 0x04, 0x04, 0x05, 0x05, 0x06,
++			   0x06, 0x07, 0x07, 0x08, 0x08, 0x09, 0x0A, 0x0A,};
++
++static u8 gamma_user[32];
++
++static u32 pseudo_palette[16];
++
++static struct rpisense_fb_param rpisense_fb_param = {
++	.vmem = NULL,
++	.vmemsize = 128,
++	.gamma = gamma_default,
++};
++
++static struct fb_deferred_io rpisense_fb_defio;
++
++static struct fb_fix_screeninfo rpisense_fb_fix = {
++	.id =		"RPi-Sense FB",
++	.type =		FB_TYPE_PACKED_PIXELS,
++	.visual =	FB_VISUAL_TRUECOLOR,
++	.xpanstep =	0,
++	.ypanstep =	0,
++	.ywrapstep =	0,
++	.accel =	FB_ACCEL_NONE,
++	.line_length =	16,
++};
++
++static struct fb_var_screeninfo rpisense_fb_var = {
++	.xres		= 8,
++	.yres		= 8,
++	.xres_virtual	= 8,
++	.yres_virtual	= 8,
++	.bits_per_pixel = 16,
++	.red		= {11, 5, 0},
++	.green		= {5, 6, 0},
++	.blue		= {0, 5, 0},
++};
++
++static ssize_t rpisense_fb_write(struct fb_info *info,
++				 const char __user *buf, size_t count,
++				 loff_t *ppos)
++{
++	ssize_t res = fb_sys_write(info, buf, count, ppos);
++
++	schedule_delayed_work(&info->deferred_work, rpisense_fb_defio.delay);
++	return res;
++}
++
++static void rpisense_fb_fillrect(struct fb_info *info,
++				 const struct fb_fillrect *rect)
++{
++	sys_fillrect(info, rect);
++	schedule_delayed_work(&info->deferred_work, rpisense_fb_defio.delay);
++}
++
++static void rpisense_fb_copyarea(struct fb_info *info,
++				 const struct fb_copyarea *area)
++{
++	sys_copyarea(info, area);
++	schedule_delayed_work(&info->deferred_work, rpisense_fb_defio.delay);
++}
++
++static void rpisense_fb_imageblit(struct fb_info *info,
++				  const struct fb_image *image)
++{
++	sys_imageblit(info, image);
++	schedule_delayed_work(&info->deferred_work, rpisense_fb_defio.delay);
++}
++
++static void rpisense_fb_deferred_io(struct fb_info *info,
++				    struct list_head *pagelist)
++{
++	int i;
++	int j;
++	u8 *vmem_work = rpisense_fb_param.vmem_work;
++	u16 *mem = (u16 *)rpisense_fb_param.vmem;
++	u8 *gamma = rpisense_fb_param.gamma;
++	struct rpisense_fb *rpisense_fb = info->par;
++
++	for (j = 0; j < 8; j++) {
++		for (i = 0; i < 8; i++) {
++			vmem_work[(j * 24) + i] =
++				gamma[(mem[(j * 8) + i] >> 11) & 0x1F];
++			vmem_work[(j * 24) + (i + 8)] =
++				gamma[(mem[(j * 8) + i] >> 6) & 0x1F];
++			vmem_work[(j * 24) + (i + 16)] =
++				gamma[(mem[(j * 8) + i]) & 0x1F];
++		}
++	}
++	regmap_bulk_write(rpisense_fb->regmap, 0, vmem_work, 192);
++}
++
++static struct fb_deferred_io rpisense_fb_defio = {
++	.delay		= HZ/100,
++	.deferred_io	= rpisense_fb_deferred_io,
++};
++
++static int rpisense_fb_ioctl(struct fb_info *info, unsigned int cmd,
++			     unsigned long arg)
++{
++	switch (cmd) {
++	case SENSEFB_FBIOGET_GAMMA:
++		if (copy_to_user((void __user *) arg, rpisense_fb_param.gamma,
++				 sizeof(u8[32])))
++			return -EFAULT;
++		return 0;
++	case SENSEFB_FBIOSET_GAMMA:
++		if (copy_from_user(gamma_user, (void __user *)arg,
++				   sizeof(u8[32])))
++			return -EFAULT;
++		rpisense_fb_param.gamma = gamma_user;
++		schedule_delayed_work(&info->deferred_work,
++				      rpisense_fb_defio.delay);
++		return 0;
++	case SENSEFB_FBIORESET_GAMMA:
++		switch (arg) {
++		case 0:
++			rpisense_fb_param.gamma = gamma_default;
++			break;
++		case 1:
++			rpisense_fb_param.gamma = gamma_low;
++			break;
++		case 2:
++			rpisense_fb_param.gamma = gamma_user;
++			break;
++		default:
++			return -EINVAL;
++		}
++		schedule_delayed_work(&info->deferred_work,
++				      rpisense_fb_defio.delay);
++		break;
++	default:
++		return -EINVAL;
++	}
++	return 0;
++}
++
++static struct fb_ops rpisense_fb_ops = {
++	.owner		= THIS_MODULE,
++	.fb_read	= fb_sys_read,
++	.fb_write	= rpisense_fb_write,
++	.fb_fillrect	= rpisense_fb_fillrect,
++	.fb_copyarea	= rpisense_fb_copyarea,
++	.fb_imageblit	= rpisense_fb_imageblit,
++	.fb_ioctl	= rpisense_fb_ioctl,
++	.fb_mmap	= fb_deferred_io_mmap,
++};
++
++static int rpisense_fb_probe(struct platform_device *pdev)
++{
++	struct fb_info *info;
++	int ret = -ENOMEM;
++	struct rpisense_fb *rpisense_fb;
++
++	info = framebuffer_alloc(sizeof(*rpisense_fb), &pdev->dev);
++	if (!info) {
++		dev_err(&pdev->dev, "Could not allocate framebuffer.\n");
++		goto err_malloc;
++	}
++
++	rpisense_fb = info->par;
++	platform_set_drvdata(pdev, rpisense_fb);
++
++	rpisense_fb->pdev = pdev;
++	rpisense_fb->regmap = dev_get_regmap(pdev->dev.parent, NULL);
++	if (!rpisense_fb->regmap) {
++		dev_err(&pdev->dev,
++			"unable to get sensehat regmap");
++		return -ENODEV;
++	}
++
++	rpisense_fb_param.vmem = vzalloc(rpisense_fb_param.vmemsize);
++	if (!rpisense_fb_param.vmem)
++		return ret;
++
++	rpisense_fb_param.vmem_work = devm_kmalloc(&pdev->dev, 193, GFP_KERNEL);
++	if (!rpisense_fb_param.vmem_work)
++		goto err_malloc;
++
++
++	rpisense_fb_fix.smem_start = (unsigned long)rpisense_fb_param.vmem;
++	rpisense_fb_fix.smem_len = rpisense_fb_param.vmemsize;
++
++	info->fbops = &rpisense_fb_ops;
++	info->fix = rpisense_fb_fix;
++	info->var = rpisense_fb_var;
++	info->fbdefio = &rpisense_fb_defio;
++	info->flags = FBINFO_VIRTFB;
++	info->screen_base = rpisense_fb_param.vmem;
++	info->screen_size = rpisense_fb_param.vmemsize;
++	info->pseudo_palette = pseudo_palette;
++
++	if (lowlight)
++		rpisense_fb_param.gamma = gamma_low;
++
++	fb_deferred_io_init(info);
++
++	ret = register_framebuffer(info);
++	if (ret < 0) {
++		dev_err(&pdev->dev, "Could not register framebuffer.\n");
++		goto err_fballoc;
++	}
++
++	fb_info(info, "%s frame buffer device\n", info->fix.id);
++	schedule_delayed_work(&info->deferred_work, rpisense_fb_defio.delay);
++	return 0;
++err_fballoc:
++	framebuffer_release(info);
++err_malloc:
++	vfree(rpisense_fb_param.vmem);
++	return ret;
++}
++
++static void rpisense_fb_remove(struct platform_device *pdev)
++{
++	struct rpisense_fb *rpisense_fb = platform_get_drvdata(pdev);
++	struct fb_info *info = rpisense_fb->info;
++
++	if (info) {
++		unregister_framebuffer(info);
++		fb_deferred_io_cleanup(info);
++		framebuffer_release(info);
++		vfree(rpisense_fb_param.vmem);
++	}
++}
++
++static const struct of_device_id rpisense_fb_id[] = {
++	{ .compatible = "raspberrypi,rpi-sense-fb" },
++	{ },
++};
++MODULE_DEVICE_TABLE(of, rpisense_fb_id);
++
++static struct platform_driver rpisense_fb_driver = {
++	.probe = rpisense_fb_probe,
++	.remove = rpisense_fb_remove,
++	.driver = {
++		.name = "rpi-sense-fb",
++		.owner = THIS_MODULE,
++		.of_match_table = rpisense_fb_id,
++	},
++};
++
++module_platform_driver(rpisense_fb_driver);
++
++MODULE_DESCRIPTION("Raspberry Pi Sense HAT framebuffer driver");
++MODULE_AUTHOR("Serge Schneider <serge@raspberrypi.org>");
++MODULE_LICENSE("GPL");
++
+--- /dev/null
++++ b/include/linux/mfd/rpisense/framebuffer.h
+@@ -0,0 +1,35 @@
++/*
++ * Raspberry Pi Sense HAT framebuffer driver
++ * http://raspberrypi.org
++ *
++ * Copyright (C) 2015 Raspberry Pi
++ *
++ * Author: Serge Schneider
++ *
++ *  This program is free software; you can redistribute  it and/or modify it
++ *  under  the terms of  the GNU General  Public License as published by the
++ *  Free Software Foundation;  either version 2 of the  License, or (at your
++ *  option) any later version.
++ *
++ */
++
++#ifndef __LINUX_RPISENSE_FB_H_
++#define __LINUX_RPISENSE_FB_H_
++
++#include <linux/regmap.h>
++
++#define SENSEFB_FBIO_IOC_MAGIC 0xF1
++
++#define SENSEFB_FBIOGET_GAMMA _IO(SENSEFB_FBIO_IOC_MAGIC, 0)
++#define SENSEFB_FBIOSET_GAMMA _IO(SENSEFB_FBIO_IOC_MAGIC, 1)
++#define SENSEFB_FBIORESET_GAMMA _IO(SENSEFB_FBIO_IOC_MAGIC, 2)
++
++struct rpisense;
++
++struct rpisense_fb {
++	struct fb_info *info;
++	struct platform_device *pdev;
++	struct regmap *regmap;
++};
++
++#endif
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0071-drivers-mfd-sensehat-Add-Raspberry-Pi-Sense-HAT-to-s.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0071-drivers-mfd-sensehat-Add-Raspberry-Pi-Sense-HAT-to-s.patch
new file mode 100644
index 00000000..f1aebd28
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0071-drivers-mfd-sensehat-Add-Raspberry-Pi-Sense-HAT-to-s.patch
@@ -0,0 +1,29 @@
+From 80ce6b7c548b4073c700b61e5b3a2171dbfd6b4b Mon Sep 17 00:00:00 2001
+From: Charles Mirabile <cmirabil@redhat.com>
+Date: Tue, 19 Apr 2022 16:51:53 -0400
+Subject: [PATCH 071/697] drivers/mfd: sensehat: Add Raspberry Pi Sense HAT to
+ simple_mfd_i2c
+
+This patch adds the compatible string for the Sense HAT device to
+the list of compatible strings in the simple_mfd_i2c driver so that
+it can match against the device and load its children and their drivers
+
+Co-developed-by: Mwesigwa Guma <mguma@redhat.com>
+Signed-off-by: Mwesigwa Guma <mguma@redhat.com>
+Co-developed-by: Joel Savitz <jsavitz@redhat.com>
+Signed-off-by: Joel Savitz <jsavitz@redhat.com>
+Signed-off-by: Charles Mirabile <cmirabil@redhat.com>
+---
+ drivers/mfd/simple-mfd-i2c.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mfd/simple-mfd-i2c.c
++++ b/drivers/mfd/simple-mfd-i2c.c
+@@ -88,6 +88,7 @@ static const struct of_device_id simple_
+ 	{ .compatible = "silergy,sy7636a", .data = &silergy_sy7636a},
+ 	{ .compatible = "maxim,max5970", .data = &maxim_max5970},
+ 	{ .compatible = "maxim,max5978", .data = &maxim_max5970},
++	{ .compatible = "raspberrypi,sensehat" },
+ 	{}
+ };
+ MODULE_DEVICE_TABLE(of, simple_mfd_i2c_of_match);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0072-Input-sensehat-joystick-Revert-to-downstream-keymap.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0072-Input-sensehat-joystick-Revert-to-downstream-keymap.patch
new file mode 100644
index 00000000..f2d41b25
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0072-Input-sensehat-joystick-Revert-to-downstream-keymap.patch
@@ -0,0 +1,28 @@
+From dceb771df6eabca41880cdc721b8b55a0bab226e Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 20 Sep 2024 16:16:02 +0100
+Subject: [PATCH 072/697] Input: sensehat-joystick : Revert to downstream
+ keymap
+
+Upstream chose to use BTN_DPAD_* and BTN_SELECT, whilst downstream
+had used KEY_*.
+
+Revert to the downstream map to avoid any regressions.
+(Ideally this would be read from DT)
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/input/joystick/sensehat-joystick.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/input/joystick/sensehat-joystick.c
++++ b/drivers/input/joystick/sensehat-joystick.c
+@@ -28,7 +28,7 @@ struct sensehat_joystick {
+ };
+ 
+ static const unsigned int keymap[] = {
+-	BTN_DPAD_DOWN, BTN_DPAD_RIGHT, BTN_DPAD_UP, BTN_SELECT, BTN_DPAD_LEFT,
++	KEY_DOWN, KEY_RIGHT, KEY_UP, KEY_ENTER, KEY_LEFT
+ };
+ 
+ static irqreturn_t sensehat_joystick_report(int irq, void *cookie)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0073-ASoC-Add-support-for-all-the-downstream-rpi-sound-ca.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0073-ASoC-Add-support-for-all-the-downstream-rpi-sound-ca.patch
new file mode 100644
index 00000000..5a2510d8
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0073-ASoC-Add-support-for-all-the-downstream-rpi-sound-ca.patch
@@ -0,0 +1,18637 @@
+From 2f1d9d98ea1de47044537bf98d368d46177fd797 Mon Sep 17 00:00:00 2001
+From: Florian Meier <florian.meier@koalo.de>
+Date: Mon, 25 Jan 2016 15:48:59 +0000
+Subject: [PATCH 073/697] ASoC: Add support for all the downstream rpi sound
+ card drivers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+ASoC: Add support for Rpi-DAC
+
+ASoC: Add prompt for ICS43432 codec
+
+Without a prompt string, a config setting can't be included in a
+defconfig. Give CONFIG_SND_SOC_ICS43432 a prompt so that Pi soundcards
+can use the driver.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+Add IQaudIO Sound Card support for Raspberry Pi
+
+Set a limit of 0dB on Digital Volume Control
+
+The main volume control in the PCM512x DAC has a range up to
++24dB. This is dangerously loud and can potentially cause massive
+clipping in the output stages. Therefore this sets a sensible
+limit of 0dB for this control.
+
+Allow up to 24dB digital gain to be applied when using IQAudIO DAC+
+
+24db_digital_gain DT param can be used to specify that PCM512x
+codec "Digital" volume control should not be limited to 0dB gain,
+and if specified will allow the full 24dB gain.
+
+Modify IQAudIO DAC+ ASoC driver to set card/dai config from dt
+
+Add the ability to set the card name, dai name and dai stream name, from
+dt config.
+
+Signed-off-by: DigitalDreamtime <clive.messer@digitaldreamtime.co.uk>
+
+IQaudIO: auto-mute for AMP+ and DigiAMP+
+
+IQAudIO amplifier mute via GPIO22. Add dt params for "one-shot" unmute
+and auto mute.
+
+Revision 2, auto mute implementing HiassofT suggestion to mute/unmute
+using set_bias_level, rather than startup/shutdown....
+"By default DAPM waits 5 seconds (pmdown_time) before shutting down
+playback streams so a close/stop immediately followed by open/start
+doesn't trigger an amp mute+unmute."
+
+Tested on both AMP+ (via DAC+) and DigiAMP+, with both options...
+
+dtoverlay=iqaudio-dacplus,unmute_amp
+ "one-shot" unmute when kernel module loads.
+
+dtoverlay=iqaudio-dacplus,auto_mute_amp
+ Unmute amp when ALSA device opened by a client. Mute, with 5 second delay
+ when ALSA device closed. (Re-opening the device within the 5 second close
+ window, will cancel mute.)
+
+Revision 4, using gpiod.
+
+Revision 5, clean-up formatting before adding mute code.
+ - Convert tab plus 4 space formatting to 2x tab
+ - Remove '// NOT USED' commented code
+
+Revision 6, don't attempt to "one-shot" unmute amp, unless card is
+successfully registered.
+
+Signed-off-by: DigitalDreamtime <clive.messer@digitaldreamtime.co.uk>
+
+ASoC: iqaudio-dac: fix S24_LE format
+
+Remove set_bclk_ratio call so 24-bit data is transmitted in
+24 bclk cycles.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+ASoC: iqaudio-dac: use modern dai_link style
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+Added support for HiFiBerry DAC+
+
+The driver is based on the HiFiBerry DAC driver. However HiFiBerry DAC+ uses
+a different codec chip (PCM5122), therefore a new driver is necessary.
+
+Add support for the HiFiBerry DAC+ Pro.
+
+The HiFiBerry DAC+ and DAC+ Pro products both use the existing bcm sound driver with the DAC+ Pro having a special clock device driver representing the two high precision oscillators.
+
+An addition bug fix is included for the PCM512x codec where by the physical size of the sample frame is used in the calculation of the LRCK divisor as it was found to be wrong when using 24-bit depth sample contained in a little endian 4-byte sample frame.
+
+Limit PCM512x "Digital" gain to 0dB by default with HiFiBerry DAC+
+
+24db_digital_gain DT param can be used to specify that PCM512x
+codec "Digital" volume control should not be limited to 0dB gain,
+and if specified will allow the full 24dB gain.
+
+Add dt param to force HiFiBerry DAC+ Pro into slave mode
+
+"dtoverlay=hifiberry-dacplus,slave"
+
+Add 'slave' param to use HiFiBerry DAC+ Pro in slave mode,
+with Pi as master for bit and frame clock.
+
+Signed-off-by: DigitalDreamtime <clive.messer@digitaldreamtime.co.uk>
+
+Fixed a bug when using 352.8kHz sample rate
+
+Signed-off-by: Daniel Matuschek <daniel@hifiberry.com>
+
+ASoC: pcm512x: revert downstream changes
+
+This partially reverts commit 185ea05465aac8bf02a0d2b2f4289d42c72870b7
+which was added by https://github.com/raspberrypi/linux/pull/1152
+
+The downstream pcm512x changes caused a regression, it broke normal
+use of the 24bit format with the codec, eg when using simple-audio-card.
+
+The actual bug with 24bit playback is the incorrect usage
+of physical_width in various drivers in the downstream tree
+which causes 24bit data to be transmitted with 32 clock
+cycles. So it's not the pcm512x that needs fixing, it's the
+soundcard drivers.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+ASoC: hifiberry_dacplus: fix S24_LE format
+
+Remove set_bclk_ratio call so 24-bit data is transmitted in
+24 bclk cycles.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+ASoC: hifiberry_dacplus: transmit S24_LE with 64 BCLK cycles
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+hifiberry_dacplus: switch to snd_soc_dai_set_bclk_ratio
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+ASoC: hifiberry_dacplus: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+Add driver for rpi-proto
+
+Forward port of 3.10.x driver from https://github.com/koalo
+We are using a custom board and would like to use rpi 3.18.x
+kernel. Patch works fine for our embedded system.
+
+URL to the audio chip:
+http://www.mikroe.com/add-on-boards/audio-voice/audio-codec-proto/
+
+Playback tested with devicetree enabled.
+
+Signed-off-by: Waldemar Brodkorb <wbrodkorb@conet.de>
+
+ASoC: rpi-proto: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+Add Support for JustBoom Audio boards
+
+justboom-dac: Adjust for ALSA API change
+
+As of 4.4, snd_soc_limit_volume now takes a struct snd_soc_card *
+rather than a struct snd_soc_codec *.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+ASoC: justboom-dac: fix S24_LE format
+
+Remove set_bclk_ratio call so 24-bit data is transmitted in
+24 bclk cycles.
+
+Also remove hw_params as it's no longer needed.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+ASoC: justboom-dac: use modern dai_link style
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+New AudioInjector.net Pi soundcard with low jitter audio in and out.
+
+Contains the sound/soc/bcm ALSA machine driver and necessary alterations to the Kconfig and Makefile.
+Adds the dts overlay and updates the Makefile and README.
+Updates the relevant defconfig files to enable building for the Raspberry Pi.
+Thanks to Phil Elwell (pelwell) for the review, simple-card concepts and discussion. Thanks to Clive Messer for overlay naming suggestions.
+
+Added support for headphones, microphone and bclk_ratio settings.
+
+This patch adds headphone and microphone capability to the Audio Injector sound card. The patch also sets the bit clock ratio for use in the bcm2835-i2s driver. The bcm2835-i2s can't handle an 8 kHz sample rate when the bit clock is at 12 MHz because its register is only 10 bits wide which can't represent the ch2 offset of 1508. For that reason, the rate constraint is added.
+
+ASoC: audioinjector-pi-soundcard: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+New driver for RRA DigiDAC1 soundcard using WM8741 + WM8804
+
+ASoC: digidac1-soundcard: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+Add support for Dion Audio LOCO DAC-AMP HAT
+
+Using dedicated machine driver and pcm5102a codec driver.
+
+Signed-off-by: DigitalDreamtime <clive.messer@digitaldreamtime.co.uk>
+
+ASoC: dionaudio_loco: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+Allo Piano DAC boards: Initial 2 channel (stereo) support (#1645)
+
+Add initial 2 channel (stereo) support for Allo Piano DAC (2.0/2.1) boards,
+using allo-piano-dac-pcm512x-audio overlay and allo-piano-dac ALSA ASoC
+machine driver.
+
+NB. The initial support is 2 channel (stereo) ONLY!
+(The Piano DAC 2.1 will only support 2 channel (stereo) left/right output,
+ pending an update to the upstream pcm512x codec driver, which will have
+ to be submitted via upstream. With the initial downstream support,
+ provided by this patch, the Piano DAC 2.1 subwoofer outputs will
+ not function.)
+
+Signed-off-by: Baswaraj K <jaikumar@cem-solutions.net>
+Signed-off-by: Clive Messer <clive.messer@digitaldreamtime.co.uk>
+Tested-by: Clive Messer <clive.messer@digitaldreamtime.co.uk>
+
+ASoC: allo-piano-dac: fix S24_LE format
+
+Remove set_bclk_ratio call so 24-bit data is transmitted in
+24 bclk cycles.
+
+Also remove hw_params and ops as they are no longer needed.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+ASoC: allo-piano-dac: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+Add support for Allo Piano DAC 2.1 plus add-on board for Raspberry Pi.
+
+The Piano DAC 2.1 has support for 4 channels with subwoofer.
+
+Signed-off-by: Baswaraj K <jaikumar@cem-solutions.net>
+Reviewed-by: Vijay Kumar B. <vijaykumar@zilogic.com>
+Reviewed-by: Raashid Muhammed <raashidmuhammed@zilogic.com>
+
+Add clock changes and mute gpios (#1938)
+
+Also improve code style and adhere to ALSA coding conventions.
+
+Signed-off-by: Baswaraj K <jaikumar@cem-solutions.net>
+Reviewed-by: Vijay Kumar B. <vijaykumar@zilogic.com>
+Reviewed-by: Raashid Muhammed <raashidmuhammed@zilogic.com>
+
+PianoPlus: Dual Mono & Dual Stereo features added (#2069)
+
+allo-piano-dac-plus: Master volume added + fixes
+
+Master volume added, which controls both DACs volumes.
+
+See: https://github.com/raspberrypi/linux/pull/2149
+
+Also fix initial max volume, default mode value, and unmute.
+
+Signed-off-by: allocom <sparky-dev@allo.com>
+
+ASoC: allo-piano-dac-plus: fix S24_LE format
+
+Remove set_bclk_ratio call so 24-bit data is transmitted in
+24 bclk cycles.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+sound: bcm: Fix memset dereference warning
+
+This warning appears with GCC 6.4.0 from toolchains.bootlin.com:
+
+../sound/soc/bcm/allo-piano-dac-plus.c: In function ‘snd_allo_piano_dac_init’:
+../sound/soc/bcm/allo-piano-dac-plus.c:711:30: warning: argument to ‘sizeof’ in ‘memset’ call is the same expression as the destination; did you mean to dereference it? [-Wsizeof-pointer-memaccess]
+  memset(glb_ptr, 0x00, sizeof(glb_ptr));
+                              ^
+
+Suggested-by: Phil Elwell <phil@raspberrypi.org>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+
+ASoC: allo-piano-dac-plus: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+Add support for Allo Boss DAC add-on board for Raspberry Pi. (#1924)
+
+Signed-off-by: Baswaraj K <jaikumar@cem-solutions.net>
+Reviewed-by: Deepak <deepak@zilogic.com>
+Reviewed-by: BabuSubashChandar <babusubashchandar@zilogic.com>
+
+Add support for new clock rate and mute gpios.
+
+Signed-off-by: Baswaraj K <jaikumar@cem-solutions.net>
+Reviewed-by: Deepak <deepak@zilogic.com>
+Reviewed-by: BabuSubashChandar <babusubashchandar@zilogic.com>
+
+ASoC: allo-boss-dac: fix S24_LE format
+
+Remove set_bclk_ratio call so 24-bit data is transmitted in
+24 bclk cycles.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+ASoC: allo-boss-dac: transmit S24_LE with 64 BCLK cycles
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+allo-boss-dac: switch to snd_soc_dai_set_bclk_ratio
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+ASoC: allo-boss-dac: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+Support for Blokas Labs pisound board
+
+Pisound dynamic overlay (#1760)
+
+Restructuring pisound-overlay.dts, so it can be loaded and unloaded dynamically using dtoverlay.
+
+Print a logline when the kernel module is removed.
+
+pisound improvements:
+
+* Added a writable sysfs object to enable scripts / user space software
+to blink MIDI activity LEDs for variable duration.
+* Improved hw_param constraints setting.
+* Added compatibility with S16_LE sample format.
+* Exposed some simple placeholder volume controls, so the card appears
+in volumealsa widget.
+
+Add missing SND_PISOUND selects dependency to SND_RAWMIDI
+
+Without it the Pisound module fails to compile.
+See https://github.com/raspberrypi/linux/issues/2366
+
+Updates for Pisound module code:
+
+	* Merged 'Fix a warning in DEBUG builds' (1c8b82b).
+	* Updating some strings and copyright information.
+	* Fix for handling high load of MIDI input and output.
+	* Use dual rate oversampling ratio for 96kHz instead of single
+	  rate one.
+
+Signed-off-by: Giedrius Trainavicius <giedrius@blokas.io>
+
+Fixing memset call in pisound.c
+
+Signed-off-by: Giedrius Trainavicius <giedrius@blokas.io>
+
+Fix for Pisound's MIDI Input getting blocked for a while in rare cases.
+
+There was a possible race condition which could lead to Input's FIFO queue
+to be underflown, causing high amount of processing in the worker thread for
+some period of time.
+
+Signed-off-by: Giedrius Trainavicius <giedrius@blokas.io>
+
+Fix for Pisound kernel module in Real Time kernel configuration.
+
+When handler of data_available interrupt is fired, queue_work ends up
+getting called and it can block on a spin lock which is not allowed in
+interrupt context. The fix was to run the handler from a thread context
+instead.
+
+Pisound: Remove spinlock usage around spi_sync
+
+ASoC: pisound: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+ASoC: pisound: fix the parameter for spi_device_match
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+ASoC: Add driver for Cirrus Logic Audio Card
+
+Note: due to problems with deferred probing of regulators
+the following softdep should be added to a modprobe.d file
+
+softdep arizona-spi pre: arizona-ldo1
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+ASoC: rpi-cirrus: use modern dai_link style
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+sound: Support for Dion Audio LOCO-V2 DAC-AMP HAT
+
+Signed-off-by: Miquel Blauw <info@dionaudio.nl>
+
+ASoC: dionaudio_loco-v2: fix S24_LE format
+
+Remove set_bclk_ratio call so 24-bit data is transmitted in
+24 bclk cycles.
+
+Also remove hw_params and ops as they are no longer needed.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+ASoC: dionaudio_loco-v2: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+Add support for Fe-Pi audio sound card. (#1867)
+
+Fe-Pi Audio Sound Card is based on NXP SGTL5000 codec.
+Mechanical specification of the board is the same the Raspberry Pi Zero.
+3.5mm jacks for Headphone/Mic, Line In, and Line Out.
+
+Signed-off-by: Henry Kupis <fe-pi@cox.net>
+
+ASoC: fe-pi-audio: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+Add support for the AudioInjector.net Octo sound card
+
+AudioInjector Octo: sample rates, regulators, reset
+
+This patch adds new sample rates to the Audioinjector Octo sound card. The
+new supported rates are (in kHz) :
+96, 48, 32, 24, 16, 8, 88.2, 44.1, 29.4, 22.05, 14.7
+
+Reference the bcm270x DT regulators in the overlay.
+
+This patch adds a reset GPIO for the AudioInjector.net octo sound card.
+
+Audioinjector octo : Make the playback and capture symmetric
+
+This patch ensures that the sample rate and channel count of the audioinjector
+octo sound card are symmetric.
+
+audioinjector-octo: Add continuous clock feature
+
+By user request, add a switch to prevent the clocks being stopped when
+the stream is paused, stopped or shutdown. Provide access to the switch
+by adding a 'non-stop-clocks' parameter to the audioinjector-addons
+overlay.
+
+See: https://github.com/raspberrypi/linux/issues/2409
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+sound: Fixes for audioinjector-octo under 4.19
+
+1. Move the DT alias declaration to the I2C shim in the cases
+where the shim is enabled. This works around a problem caused by a
+4.19 commit [1] that generates DT/OF uevents for I2C drivers.
+
+2. Fix the diagnostics in an error path of the soundcard driver to
+correctly identify the reason for the failure to load.
+
+3. Move the declaration of the clock node in the overlay outside
+the I2C node to avoid warnings.
+
+4. Sort the overlay nodes so that dependencies are only to earlier
+fragments, in an attempt to get runtime dtoverlay application to
+work (it still doesn't...)
+
+See: https://github.com/Audio-Injector/Octo/issues/14
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+[1] af503716ac14 ("i2c: core: report OF style module alias for devices registered via OF")
+
+ASoC: audioinjector-octo-soundcard: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+Driver support for Google voiceHAT soundcard.
+
+ASoC: googlevoicehat-codec: Use correct device when grabbing GPIO
+
+The fixup for the VoiceHAT in 4.18 incorrectly tried to find the
+sdmode GPIO pin under the card device, not the codec device.
+This failed, and therefore caused the device probe to fail.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+ASoC: googlevoicehat-codec: Reformat for kernel coding standards
+
+Fix all whitespace, indentation, and bracing errors.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+ASoC: googlevoicehat-codec: Make driver function structure const
+
+Make voicehat_component_driver a const structure.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+ASoC: googlevoicehat-codec: Only convert from ms to jiffies once
+
+Minor optimisation and allows to become checkpatch clean.
+A msec value is read out of DT or from a define, and convert once to
+jiffies, rather than every time that it is used.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+Driver and overlay for Allo Katana DAC
+
+Allo Katana DAC: Updated default values
+
+Signed-off-by: Jaikumar <jaikumar@cem-solutions.com>
+
+Added mute stream func
+
+Signed-off-by: Jaikumar <jaikumar@cem-solutions.net>
+
+codecs: Correct Katana minimum volume
+
+Update Katana minimum volume to get the exact 0.5 dB value in each step.
+
+Signed-off-by: Sudeep Kumar <sudeepkumar@cem-solutions.net>
+
+ASoC: Add generic RPI driver for simple soundcards.
+
+The RPI simple sound card driver provides a generic ALSA SOC card driver
+supporting a variety of Pi HAT soundcards. The intention is to avoid
+the duplication of code for cards that can't be fully supported by
+the soc simple/graph cards but are otherwise almost identical.
+
+This initial commit adds support for the ADAU1977 ADC, Google VoiceHat,
+HifiBerry AMP, HifiBerry DAC and RPI DAC.
+
+Signed-off-by: Tim Gover <tim.gover@raspberrypi.org>
+
+ASoC: Use correct card name in rpi-simple driver
+
+Use the specific card name from drvdata instead of the snd_rpi_simple
+
+rpi-simple-soundcard: Use nicer driver name "RPi-simple"
+
+Rename the driver from "RPI simple soundcard" to "RPi-simple" so that
+the driver name won't be mangled allowing to be used unaltered as the
+card conf filename.
+
+ASoC: rpi-simple-soundcard: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+ASoC: Add Kconfig and Makefile for sound/soc/bcm
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+
+ASoC: Create a generic Pi Hat WM8804 driver
+
+Reduce the amount of duplicated code by creating a generic driver for
+Pi Hat digi cards using the WM8804 codec.
+
+This replaces the
+Allo DigiOne, Hifiberry Digi/Pro, JustBoom Digi and IQAudIO Digi
+dedicate soundcard drivers with a generic driver.
+
+There are no significant changes to the runtime behavior of the drivers
+and end users should not have to change any configuration settings
+after upgrading.
+
+Minor changes
+* Check the return value of snd_soc_component_update_bits
+* Added some pr_debug tracing
+* Various checkpatch tidyups
+* Updated allodigi-one to use use 128FS at > 96 Khz. This appears to
+  be an omission in the original driver code so followed the Hifiberry
+  DAC driver approach.
+
+ASoC: rpi-wm8804-soundcard: use modern dai_link style
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+rpi-wm8804-soundcard: drop PWRDN register writes
+
+Since kernel 4.0 the PWRDN register bits are under DAPM
+control from the wm8804 driver.
+
+Drop code that modifies that register to avoid interfering
+with DAPM.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+rpi-wm8804-soundcard: configure wm8804 clocks only on rate change
+
+This should avoid clicks when stopping and immediately afterwards
+starting a stream with the same samplerate as before.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+rpi-wm8804-soundcard: Fixed MCLKDIV for Allo Digione
+
+The Allo Digione board wants a fixed MCLKDIV of 256.
+
+See: https://github.com/raspberrypi/linux/issues/3296
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+ASoC: Add support for AudioSense-Pi add-on soundcard
+
+AudioSense-Pi is a RPi HAT based on a TI's TLV320AIC32x4 stereo codec
+
+This hardware provides multiple audio I/O capabilities to the RPi.
+The codec connects to the RPi's SoC through the I2S Bus.
+
+The following devices can be connected through a 3.5mm jack
+	1. Line-In: Plain old audio in from mobile phones, PCs, etc.,
+	2. Mic-In: Connect a microphone
+	3. Line-Out: Connect the output to a speaker
+	4. Headphones: Connect a Headphone w or w/o microphones
+
+Multiple Inputs:
+	It supports the following combinations
+	1. Two stereo Line-Inputs and a microphone
+	2. One stereo Line-Input and two microphones
+	3. Two stereo Line-Inputs, a microphone and
+		one mono line-input (with h/w hack)
+	4. One stereo Line-Input, two microphones and
+		one mono line-input (with h/w hack)
+
+Multiple Outputs:
+	Audio output can be routed to the headphones or
+		speakers (with additional hardware)
+
+Signed-off-by: b-ak <anur.bhargav@gmail.com>
+
+ASoC: audiosense-pi: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+Added driver for the HiFiBerry DAC+ ADC (#2694)
+
+Signed-off-by: Daniel Matuschek <daniel@hifiberry.com>
+
+hifiberry_dacplusadc: switch to snd_soc_dai_set_bclk_ratio
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+ASoC: hifiberry_dacplusadc: fix DAI link setup
+
+The driver only defines a single DAI link and the code that tries
+to setup the second (non-existent) DAI link looks wrong - using dmic
+as a CPU/platform driver doesn't make any sense.
+
+The DT overlay doesn't define a dmic property, so the code was never
+executed (otherwise it would have resulted in a memory corruption).
+
+So drop the offending code to prevent issues if a dmic property
+should be added to the DT overlay.
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+ASoC: hifiberry_dacplusadc: use modern dai_link style
+
+Signed-off-by: Matthias Reichl <hias@horus.com>
+
+Audiophonics I-Sabre 9038Q2M DAC driver
+
+Signed-off-by: Audiophonics <contact@audiophonics.fr>
+
+ASoC: i-sabre-q2m: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+Added IQaudIO Pi-Codec board support (#2969)
+
+Add support for the IQaudIO Pi-Codec board.
+
+Signed-off-by: Gordon <gordon@iqaudio.com>
+
+Fixed 48k timing issue
+
+ASoC: iqaudio-codec: use modern dai_link style
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+
+adds the Hifiberry DAC+ADC PRO version
+
+This adds the driver for the DAC+ADC PRO version of the Hifiberry soundcard with software controlled PCM1863 ADC
+Signed-off-by: Joerg Schambacher joerg@i2audio.com
+
+Add Hifiberry DAC+DSP soundcard driver (#3224)
+
+Adds the driver for the Hifiberry DAC+DSP. It supports capture and
+playback depending on the DSP firmware.
+
+Signed-off-by: Joerg Schambacher <joerg@i2audio.com>
+
+Allow simultaneous use of JustBoom DAC and Digi
+
+Signed-off-by: Johannes Krude <johannes@krude.de>
+
+Pisound: MIDI communication fixes for scaled down CPU.
+
+* Increased maximum SPI communication speed to avoid running too slow
+  when the CPU is scaled down and losing MIDI data.
+
+* Keep track of buffer usage in millibytes for higher precision.
+
+Signed-off-by: Giedrius Trainavičius <giedrius@blokas.io>
+
+sound: Add the HiFiBerry DAC+HD version
+
+This adds the driver for the DAC+HD version supporting HiFiBerry's
+PCM179x based DACs. It also adds PLL control for clock generation.
+
+Signed-off-by: Joerg Schambacher <joerg@i2audio.com>
+
+Fix master mode settings of HiFiBerry DAC+ADC PRO card (#3424)
+
+This patch fixes the board DAI setting when in master-mode.
+Wrong setting could have caused random pop noise.
+
+Signed-off-by: Joerg Schambacher <joerg@i2audio.com>
+
+adds LED OFF feature to HiFiBerry DAC+ADC PRO sound card
+
+This adds a DT overlay parameter 'leds_off' which allows
+to switch off the onboard activity LEDs at all times
+which has been requested by some users.
+
+Signed-off-by: Joerg Schambacher <joerg@i2audio.com>
+
+adds LED OFF feature to HiFiBerry DAC+ADC sound card
+
+This adds a DT overlay parameter 'leds_off' which allows
+to switch off the onboard activity LEDs at all times
+which has been requested by some users.
+
+Signed-off-by: Joerg Schambacher <joerg@i2audio.com>
+
+adds LED OFF feature to HiFiBerry DAC+/DAC+PRO sound cards
+
+This adds a DT overlay parameter 'leds_off' which allows
+to switch off the onboard activity LEDs at all times
+which has been requested by some users.
+
+Signed-off-by: Joerg Schambacher <joerg@i2audio.com>
+
+pisound: Added reading Pisound board hardware revision and exposing it (#3425)
+
+pisound: Added reading Pisound board hardware revision and exposing it in kernel log and sysfs file:
+
+/sys/kernel/pisound/hw_version
+
+Signed-off-by: Giedrius <giedrius@blokas.io>
+
+Added driver for HiFiBerry Amp amplifier add-on board
+
+The driver contains a low-level hardware driver for the TAS5713 and the
+drivers for the Raspberry Pi I2S subsystem.
+
+TAS5713: return error if initialisation fails
+
+Existing TAS5713 driver logs errors during initialisation, but does not return
+an error code. Therefore even if initialisation fails, the driver will still be
+loaded, but won't work. This patch fixes this. I2C communication error will now
+reported correctly by a non-zero return code.
+
+HiFiBerry Amp: fix device-tree problems
+
+Some code to load the driver based on device-tree-overlays was missing. This is added by this patch.
+
+According to 5713 pdf doc CLOCK_CTRL is a readonly status register, and it behaves so. Remove useless setting
+
+sound: pcm512x-codec: Adding 352.8kHz samplerate support
+
+sound/soc: only first codec is master in multicodec setup
+
+When using multiple codecs, at most one codec should generate the master
+clock. All codecs except the first are therefore configured for slave
+mode.
+
+Signed-off-by: Johannes Krude <johannes@krude.de>
+
+ASoC: Fix snd_soc_get_pcm_runtime usage
+
+Commit [1] changed the snd_soc_get_pcm_runtime to take a dai_link
+pointer instead of a string. Patch up the downstream drivers to use
+the modified API.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+[1] 4468189ff307 ("ASoC: soc-core: find rtd via dai_link pointer at snd_soc_get_pcm_runtime()")
+
+Add support for the AudioInjector.net Isolated sound card
+
+This patch adds support for the Audio Injector Isolated sound card.
+
+Signed-off-by: Matt Flax <flatmax@flatmax.org>
+
+Add support for merus-amp soundcard and ma120x0p codec
+
+Add 96KHz rate support to MA120X0P codec and make enable and mute gpio
+pins optional.
+
+Signed-off-by: AMuszkat <ariel.muszkat@gmail.com>
+
+Fixes a problem with clock settings of HiFiBerry DAC+ADC PRO (#3545)
+
+This patch fixes a problem of the re-calculation of
+i2s-clock and -parameter settings when only the ADC is activated.
+
+Signed-off-by: Joerg Schambacher <joerg@i2audio.com>
+
+configs: Enable the AD193x codecs
+
+See: https://github.com/raspberrypi/linux/issues/2850
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+Switch to snd_soc_dai_set_bclk_ratio
+Replaces obsolete function snd_soc_dai_set_tdm_slot
+
+Signed-off-by: Joerg Schambacher <joerg@i2audio.com>
+
+Enhances the DAC+ driver to control the optional headphone amplifier
+
+Probes on the I2C bus for TPA6130A2, if successful, it sets DT-parameter
+'status' from 'disabled' to 'okay' using change_sets to enable
+the headphone control.
+
+Signed-off-by: Joerg Schambacher joerg@i2audio.com
+
+Update Allo Piano Dac Driver
+
+Add unique names to the individual dac coded drivers
+Remove some of the codec controls that are not used.
+
+Signed-off-by: Paul Hermann <paul@picoreplayer.org>
+
+Fixes an onboard clock detection problem of the PRO versions
+
+Increasing the sleep time after clock selection to 3-4ms
+allows the correct detection of all combinations of DAC+ Pro
+and DAC+ADC Pro sound cards and the various PI revisions.
+
+Signed-off-by: Joerg Schambacher <joerg@hifiberry.com>
+
+ASoC:ma120x0p: Increase maximum sample rate to 192KHz
+
+Change the maximum sample rate for the amplifier to
+192KHz as given in the Infineon specification.
+
+Signed-off-by: Joerg Schambacher <joerg@hifiberry.com>
+
+ASoC: ma120x0p: Remove unnecessary const specifier
+
+Clang warns:
+
+  sound/soc/codecs/ma120x0p.c:891:14: warning: duplicate 'const' declaration specifier [-Wduplicate-decl-specifier]
+  static const SOC_VALUE_ENUM_SINGLE_DECL(pwr_mode_ctrl,
+               ^
+  ./include/sound/soc.h:362:2: note: expanded from macro 'SOC_VALUE_ENUM_SINGLE_DECL'
+          SOC_VALUE_ENUM_DOUBLE_DECL(name, xreg, xshift, xshift, xmask, xtexts, xvalues)
+          ^
+  ./include/sound/soc.h:359:2: note: expanded from macro 'SOC_VALUE_ENUM_DOUBLE_DECL'
+          const struct soc_enum name = SOC_VALUE_ENUM_DOUBLE(xreg, xshift_l, xshift_r, xmask, \
+          ^
+  1 warning generated.
+
+SOC_VALUE_ENUM_DOUBLE_DECL already has a const specifier. Remove the duplicate
+const to clean up the warning.
+
+Fixes: 42444979e710 ("Add support for all the downstream rpi sound card drivers")
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+
+ASoC: bcm: allo-piano-dac-plus: Remove unnecessary const specifiers
+
+Clang warns:
+
+  sound/soc/bcm/allo-piano-dac-plus.c:66:14: warning: duplicate 'const' declaration specifier [-Wduplicate-decl-specifier]
+  static const SOC_ENUM_SINGLE_DECL(allo_piano_mode_enum,
+               ^
+  ./include/sound/soc.h:355:2: note: expanded from macro 'SOC_ENUM_SINGLE_DECL'
+          SOC_ENUM_DOUBLE_DECL(name, xreg, xshift, xshift, xtexts)
+          ^
+  ./include/sound/soc.h:352:2: note: expanded from macro 'SOC_ENUM_DOUBLE_DECL'
+          const struct soc_enum name = SOC_ENUM_DOUBLE(xreg, xshift_l, xshift_r, \
+          ^
+  sound/soc/bcm/allo-piano-dac-plus.c:75:14: warning: duplicate 'const' declaration specifier [-Wduplicate-decl-specifier]
+  static const SOC_ENUM_SINGLE_DECL(allo_piano_dual_mode_enum,
+               ^
+  ./include/sound/soc.h:355:2: note: expanded from macro 'SOC_ENUM_SINGLE_DECL'
+          SOC_ENUM_DOUBLE_DECL(name, xreg, xshift, xshift, xtexts)
+          ^
+  ./include/sound/soc.h:352:2: note: expanded from macro 'SOC_ENUM_DOUBLE_DECL'
+          const struct soc_enum name = SOC_ENUM_DOUBLE(xreg, xshift_l, xshift_r, \
+          ^
+  sound/soc/bcm/allo-piano-dac-plus.c:96:14: warning: duplicate 'const' declaration specifier [-Wduplicate-decl-specifier]
+  static const SOC_ENUM_SINGLE_DECL(allo_piano_enum,
+               ^
+  ./include/sound/soc.h:355:2: note: expanded from macro 'SOC_ENUM_SINGLE_DECL'
+          SOC_ENUM_DOUBLE_DECL(name, xreg, xshift, xshift, xtexts)
+          ^
+  ./include/sound/soc.h:352:2: note: expanded from macro 'SOC_ENUM_DOUBLE_DECL'
+          const struct soc_enum name = SOC_ENUM_DOUBLE(xreg, xshift_l, xshift_r, \
+          ^
+  3 warnings generated.
+
+SOC_VALUE_ENUM_DOUBLE_DECL already has a const specifier. Remove the duplicate
+const specifiers to clean up the warnings.
+
+Fixes: 42444979e710 ("Add support for all the downstream rpi sound card drivers")
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+
+rpi-simple-soundcard: Add Dion Audio KIWI streamer
+
+Signed-off-by: Miquel Blauw <miquelblauw@hotmail.com>
+
+rpi-simple-soundcard: adds definitions for the HiFiBerry AMP3 card
+
+Uses Infineon MA120x0 amplifier and supports full sample rate of 192ksps.
+
+Signed-off-by: Joerg Schambacher <joerg@hifiberry.com>
+
+sound: soc: bcm: Added Sound card driver for Dacberry400 Audio card for Raspberry Pi 400
+
+Added Sound card driver for DACberry400 Audio card.
+
+Signed-off-by: Ashish Vara <ashishhvara@gmail.com>
+
+ASoC:ma120x0p: Corrects the volume level display
+
+Fixes the wrongly changed 'limiter volume' display back to -50dB minimum
+and sets the correct minimum volume level to -144dB to be aligned with
+the controls and display in alsamixer etc.
+
+Signed-off-by: Joerg Schambacher <joerg@hifiberry.com>
+
+ASoC: bcm: Fix Rpi-PROTO and audioinjector.net Pi
+
+As of kernel 5.19 the WM8731 driver has separate I2C and SPI support
+modules. Change the Kconfig definitions for the audioinjector.net Pi
+and Rpi-PROTO soundcards to select SND_SOC_WM8731_I2C.
+
+See: https://github.com/raspberrypi/linux/issues/5364
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+ASoC: adau1977: Add correct compatible strings
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+ASoC: bcm2835-i2s: Use phys addresses for DAI DMA
+
+Contrary to what struct snd_dmaengine_dai_dma_data suggests, the
+configuration of addresses of DMA slave interfaces should be done in
+CPU physical addresses.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+rpi sound cards: Fix Codec Zero rate switching
+
+The Raspberry Pi Codec Zero (and IQaudIO Codec) don't notify the DA7213
+codec when it needs to change PLL frequencies. As a result, audio can
+be played at the wrong rate - play a 48kHz sound immediately after a
+44.1kHz sound to see the effect, but in some configurations the codec
+can lock into the wrong state and always get some rates wrong.
+
+Add the necessary notification to fix the issue.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+ASoC: dwc: Support set_bclk_ratio
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+ASoC: dwc: Add DMACR handling
+
+Add control of the DMACR register, which is required for paced DMA
+(i.e. DREQ) support.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+ASOC: dwc: Improve DMA shutdown
+
+Disabling the I2S interface with outstanding transfers prevents the
+DMAC from shutting down, so keep it partially active after a stop.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+ASOC: dwc: Fix 16-bit audio handling
+
+IMO the Synopsys datasheet could be clearer in this area, but it seems
+that the DMA data ports (DMATX and DMARX) expect left and right samples
+in alternate writes; if a stereo pair is pushed in a single 32-bit
+write, the upper half is ignored, leading to double speed audio with a
+confused stereo image. Make sure the necessary changes happen by
+updating the DMA configuration data in the hw_params method.
+
+The set_bclk_ratio change was made at a time when it looked like it
+could be causing an error, but I think the division of responsibilities
+is clearer this way (and the kernel log clearer without the info-level
+message).
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+ASoC: bcm: Remove dependency on BCM2835 I2S
+
+These soundcard drivers don't rely on a specific I2S interface, so
+remove the dependency declarations.
+
+See: https://github.com/raspberrypi/linux-2712/issues/111
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+ASoC: bcm: audioinjector_octo: Add soundcard "owner"
+
+See: https://github.com/raspberrypi/linux/issues/5697
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+Pisound: Don't export the button GPIO via sysfs GPIO class.
+
+Signed-off-by: Giedrius Trainavičius <giedrius@blokas.io>
+
+Pisound: Read out the SPI speed to use from the Device Tree.
+
+Signed-off-by: Giedrius Trainavičius <giedrius@blokas.io>
+
+ASoC: DACplus - fix 16bit sample support in clock consumer mode
+
+The former code did not adjust the physical sample width when
+in clock consumer mode and has taken the fixed 32 bit default.
+This has caused the audio to be played at half its frequency due to
+the fixed bclk_ratio of 64.
+
+Signed-off-by: Joerg Schambacher <joerg@hifiberry.com>
+
+ASoC: adds support for AMP4 Pro to the DAC Plus driver
+
+The AMP4 Pro is a I2S master mode capable amplifier with
+clean onboard clock generators.
+We can share the card driver between TAS575x amplifiers
+and the PCM512x DACs as they are SW compatible.
+From a HW perspective though we need to limit the sample
+rates to the standard audio rates to avoid running the
+onboard clocks through the PLL. Using the PLL would require
+even a different HW.
+DAI/stream name are also set accordingly to allow the user
+a convenient identification of the soundcard
+
+Needs the pcm512x driver with TAS575x support (already in
+upstream kernel).
+
+Signed-off-by: Joerg Schambacher <joerg@hifiberry.com>
+
+ASoC: DACplusADCPro - fix 16bit sample support in clock consumer mode
+
+The former code did not adjust the physical sample width when in
+clock consumer mode and has taken the fixed 32 bit default. This
+has caused the audio to be played at half its frequency due to
+the fixed bclk_ratio of 64.
+
+Problem appears only on PI5 as on the former PIs the I2S module
+did simply run at fixed 64x rate.
+
+Signed-off-by: Joerg Schambacher <joerg@hifiberry.com>
+
+Impliment driver support for Interlude Audio Digital Hat
+
+Implementing driver support for
+Interlude audio's WM8805 based digital hat
+by leveraging existing drivers
+
+ASOc: Add HiFiBerry DAC8X to the simple card driver
+
+Defines the settings for the 8 channel version of the standard
+DAC by overwriting the number of channels in the DAI defs.
+It can run in 8ch mode only on PI5 using the 4 lane data output
+of the designware I2S0 module.
+
+Signed-off-by: j-schambacher <joerg@hifiberry.com>
+
+ASoC: bcm: Use the correct sample width value
+
+ALSA's concept of the physical width of a sample is how much memory it
+occupies, including any padding. This not the same as the count of bits
+of actual sample content. In particular, S24_LE has a width of 24 bits
+but a physical width of 32 bits because there is a byte of padding with
+each sample.
+
+When calculating bclk_ratio, etc., it is width that matters, not
+physical width. Correct the error that has been replicated across the
+drivers for many Raspberry Pi-compatible soundcards.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+ASoC: dwc: Correct channel count reporting
+
+The DWC I2S driver treats the channel count register values as if they
+encode a power of two (2, 4, 8, 16), but they actually encode a
+multiple of 2 (2, 4, 6, 8).
+
+Also improve the error message when asked for an unsupported number
+of channels.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+ASoC: Fix 16bit sample support for Hifiberry DACplusADC
+
+Same issue as #5919.
+'width' needs to be set independent of clocking mode.
+
+Signed-off-by: j-schambacher <joerg@hifiberry.com>
+
+allo-boss-dac mute output when changing parameters
+
+Since I noticed that sometimes changing sample rates causes some digital
+quirks and noises, I've changed the function to mute the output before
+performing the changes and then unmute it when an error occurs or the
+parameters got set.
+
+Signed-off-by: Alessandro Marcon <marconalessandro04@gmail.com>
+
+ASoC: bcm: Use power-of-2 bclk_ratios
+
+The soundcard drivers originally used snd_pcm_format_physical_width,
+but a later commit changed that to snd_pcm_format_width because the
+in-memory sample storage width should not be a factor in determining
+the bclk_ratio. However, the physical width rounds the sample bits up
+to the nearest power of 2, which makes it easier to find integer clock
+divisors.
+
+Restore the old behaviour, but with an implementation that makes it
+clear what is going on.
+
+See: https://github.com/raspberrypi/linux/issues/6104
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+ASoC: bcm: Add "owner" info for more soundcards
+
+See: https://github.com/raspberrypi/linux/issues/5697
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+ASoC: da7213: Add a set_bclk_ratio method
+
+Following [1], it becomes harder for the CPU DAI to know the correct
+BCLK ratio. We can either bake the same knowledge into the sound card
+driver, or implement and use set_bclk_ratio on the codec. This commit
+does the latter.
+
+[1] commit c89e652e84f6 ("ASoC: da7213: Add support for mono, set
+frame width to 32 when possible")
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+iqaudio-codec: Use the codec's new set_bclk_ratio
+
+To ensure that the CPU DAI and codec agree over the BCLK ratio, impose
+a fixed value of 64 on both of them.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+ASoC: add driver for new HiFiBerry ADC only board(s)
+
+Adds the driver for the soon to be released first ADC only board.
+It includes the same ADC controls as used by the DAC+ADC Pro driver.
+
+Signed-off-by: j-schambacher <joerg@hifiberry.com>
+
+ASoC: add HiFiBerry ADC8x 8-channel ADC to simple-card-driver
+
+Definitions for the 8 channel ADC card. The card uses only
+HW-controlled devices which allows the uses of the 'dummy-dai'.
+It will run only on a PI5 as it requires the designware I2S0 module.
+
+The necessary output lanes I2S0_DI[0..3] are claimed from within the
+DT overlay.
+
+Signed-off-by: j-schambacher <joerg@hifiberry.com>
+---
+ .../devicetree/bindings/vendor-prefixes.txt   |  463 ++++++
+ .../devicetree/bindings/vendor-prefixes.yaml  |    2 +
+ drivers/clk/Kconfig                           |    6 +
+ drivers/clk/Makefile                          |    2 +
+ drivers/clk/clk-hifiberry-dachd.c             |  331 ++++
+ drivers/clk/clk-hifiberry-dacpro.c            |  180 +++
+ sound/soc/bcm/Kconfig                         |  284 ++++
+ sound/soc/bcm/Makefile                        |   73 +-
+ sound/soc/bcm/allo-boss-dac.c                 |  470 ++++++
+ sound/soc/bcm/allo-boss2-dac.c                | 1130 ++++++++++++++
+ sound/soc/bcm/allo-katana-codec.c             |  386 +++++
+ sound/soc/bcm/allo-piano-dac-plus.c           | 1063 +++++++++++++
+ sound/soc/bcm/allo-piano-dac.c                |  122 ++
+ .../bcm/audioinjector-isolated-soundcard.c    |  184 +++
+ sound/soc/bcm/audioinjector-octo-soundcard.c  |  347 +++++
+ sound/soc/bcm/audioinjector-pi-soundcard.c    |  190 +++
+ sound/soc/bcm/audiosense-pi.c                 |  247 +++
+ sound/soc/bcm/bcm2835-i2s.c                   |   26 +-
+ sound/soc/bcm/chipdip-dac.c                   |  275 ++++
+ sound/soc/bcm/dacberry400.c                   |  258 +++
+ sound/soc/bcm/digidac1-soundcard.c            |  421 +++++
+ sound/soc/bcm/dionaudio_loco-v2.c             |  118 ++
+ sound/soc/bcm/dionaudio_loco.c                |  121 ++
+ sound/soc/bcm/fe-pi-audio.c                   |  154 ++
+ sound/soc/bcm/googlevoicehat-codec.c          |  212 +++
+ sound/soc/bcm/hifiberry_adc.c                 |  174 +++
+ sound/soc/bcm/hifiberry_adc_controls.h        |  128 ++
+ sound/soc/bcm/hifiberry_dacplus.c             |  563 +++++++
+ sound/soc/bcm/hifiberry_dacplusadc.c          |  399 +++++
+ sound/soc/bcm/hifiberry_dacplusadcpro.c       |  498 ++++++
+ sound/soc/bcm/hifiberry_dacplusdsp.c          |   89 ++
+ sound/soc/bcm/hifiberry_dacplushd.c           |  233 +++
+ sound/soc/bcm/i-sabre-q2m.c                   |  159 ++
+ sound/soc/bcm/iqaudio-codec.c                 |  283 ++++
+ sound/soc/bcm/iqaudio-dac.c                   |  223 +++
+ sound/soc/bcm/justboom-both.c                 |  266 ++++
+ sound/soc/bcm/justboom-dac.c                  |  147 ++
+ sound/soc/bcm/pifi-40.c                       |  281 ++++
+ sound/soc/bcm/pisound.c                       | 1254 +++++++++++++++
+ sound/soc/bcm/rpi-cirrus.c                    | 1027 ++++++++++++
+ sound/soc/bcm/rpi-proto.c                     |  147 ++
+ sound/soc/bcm/rpi-simple-soundcard.c          |  560 +++++++
+ sound/soc/bcm/rpi-wm8804-soundcard.c          |  549 +++++++
+ sound/soc/codecs/Kconfig                      |   26 +-
+ sound/soc/codecs/Makefile                     |    9 +
+ sound/soc/codecs/adau1977-i2c.c               |   10 +
+ sound/soc/codecs/cs42xx8-i2c.c                |    9 +-
+ sound/soc/codecs/cs42xx8.c                    |   10 +
+ sound/soc/codecs/da7213.c                     |   21 +
+ sound/soc/codecs/da7213.h                     |    1 +
+ sound/soc/codecs/i-sabre-codec.c              |  389 +++++
+ sound/soc/codecs/i-sabre-codec.h              |   42 +
+ sound/soc/codecs/ma120x0p.c                   | 1380 +++++++++++++++++
+ sound/soc/codecs/pcm1794a.c                   |   68 +
+ sound/soc/codecs/pcm512x.c                    |    2 +-
+ sound/soc/codecs/tas5713.c                    |  360 +++++
+ sound/soc/codecs/tas5713.h                    |  210 +++
+ sound/soc/dwc/dwc-i2s.c                       |  149 +-
+ sound/soc/dwc/local.h                         |   12 +
+ sound/soc/soc-core.c                          |   10 +-
+ sound/usb/card.c                              |    8 +-
+ sound/usb/quirks.c                            |    2 +
+ 62 files changed, 16723 insertions(+), 40 deletions(-)
+ create mode 100644 Documentation/devicetree/bindings/vendor-prefixes.txt
+ create mode 100644 drivers/clk/clk-hifiberry-dachd.c
+ create mode 100644 drivers/clk/clk-hifiberry-dacpro.c
+ create mode 100644 sound/soc/bcm/allo-boss-dac.c
+ create mode 100644 sound/soc/bcm/allo-boss2-dac.c
+ create mode 100644 sound/soc/bcm/allo-katana-codec.c
+ create mode 100644 sound/soc/bcm/allo-piano-dac-plus.c
+ create mode 100644 sound/soc/bcm/allo-piano-dac.c
+ create mode 100644 sound/soc/bcm/audioinjector-isolated-soundcard.c
+ create mode 100644 sound/soc/bcm/audioinjector-octo-soundcard.c
+ create mode 100644 sound/soc/bcm/audioinjector-pi-soundcard.c
+ create mode 100644 sound/soc/bcm/audiosense-pi.c
+ create mode 100644 sound/soc/bcm/chipdip-dac.c
+ create mode 100644 sound/soc/bcm/dacberry400.c
+ create mode 100644 sound/soc/bcm/digidac1-soundcard.c
+ create mode 100644 sound/soc/bcm/dionaudio_loco-v2.c
+ create mode 100644 sound/soc/bcm/dionaudio_loco.c
+ create mode 100644 sound/soc/bcm/fe-pi-audio.c
+ create mode 100644 sound/soc/bcm/googlevoicehat-codec.c
+ create mode 100644 sound/soc/bcm/hifiberry_adc.c
+ create mode 100644 sound/soc/bcm/hifiberry_adc_controls.h
+ create mode 100644 sound/soc/bcm/hifiberry_dacplus.c
+ create mode 100644 sound/soc/bcm/hifiberry_dacplusadc.c
+ create mode 100644 sound/soc/bcm/hifiberry_dacplusadcpro.c
+ create mode 100644 sound/soc/bcm/hifiberry_dacplusdsp.c
+ create mode 100644 sound/soc/bcm/hifiberry_dacplushd.c
+ create mode 100644 sound/soc/bcm/i-sabre-q2m.c
+ create mode 100644 sound/soc/bcm/iqaudio-codec.c
+ create mode 100644 sound/soc/bcm/iqaudio-dac.c
+ create mode 100644 sound/soc/bcm/justboom-both.c
+ create mode 100644 sound/soc/bcm/justboom-dac.c
+ create mode 100644 sound/soc/bcm/pifi-40.c
+ create mode 100644 sound/soc/bcm/pisound.c
+ create mode 100644 sound/soc/bcm/rpi-cirrus.c
+ create mode 100644 sound/soc/bcm/rpi-proto.c
+ create mode 100644 sound/soc/bcm/rpi-simple-soundcard.c
+ create mode 100644 sound/soc/bcm/rpi-wm8804-soundcard.c
+ create mode 100644 sound/soc/codecs/i-sabre-codec.c
+ create mode 100644 sound/soc/codecs/i-sabre-codec.h
+ create mode 100644 sound/soc/codecs/ma120x0p.c
+ create mode 100644 sound/soc/codecs/pcm1794a.c
+ create mode 100644 sound/soc/codecs/tas5713.c
+ create mode 100644 sound/soc/codecs/tas5713.h
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
+@@ -0,0 +1,463 @@
++Device tree binding vendor prefix registry.  Keep list in alphabetical order.
++
++This isn't an exhaustive list, but you should add new prefixes to it before
++using them to avoid name-space collisions.
++
++abilis	Abilis Systems
++abracon	Abracon Corporation
++actions	Actions Semiconductor Co., Ltd.
++active-semi	Active-Semi International Inc
++ad	Avionic Design GmbH
++adafruit	Adafruit Industries, LLC
++adapteva	Adapteva, Inc.
++adaptrum	Adaptrum, Inc.
++adh	AD Holdings Plc.
++adi	Analog Devices, Inc.
++advantech	Advantech Corporation
++aeroflexgaisler	Aeroflex Gaisler AB
++al	Annapurna Labs
++allo	Allo.com
++allwinner	Allwinner Technology Co., Ltd.
++alphascale	AlphaScale Integrated Circuits Systems, Inc.
++altr	Altera Corp.
++amarula	Amarula Solutions
++amazon	Amazon.com, Inc.
++amcc	Applied Micro Circuits Corporation (APM, formally AMCC)
++amd	Advanced Micro Devices (AMD), Inc.
++amediatech	Shenzhen Amediatech Technology Co., Ltd
++amlogic	Amlogic, Inc.
++ampire	Ampire Co., Ltd.
++ams	AMS AG
++amstaos	AMS-Taos Inc.
++analogix	Analogix Semiconductor, Inc.
++andestech	Andes Technology Corporation
++apm	Applied Micro Circuits Corporation (APM)
++aptina	Aptina Imaging
++arasan	Arasan Chip Systems
++archermind ArcherMind Technology (Nanjing) Co., Ltd.
++arctic	Arctic Sand
++aries	Aries Embedded GmbH
++arm	ARM Ltd.
++armadeus	ARMadeus Systems SARL
++arrow	Arrow Electronics
++artesyn	Artesyn Embedded Technologies Inc.
++asahi-kasei	Asahi Kasei Corp.
++aspeed	ASPEED Technology Inc.
++asus	AsusTek Computer Inc.
++atlas	Atlas Scientific LLC
++atmel	Atmel Corporation
++auo	AU Optronics Corporation
++auvidea Auvidea GmbH
++avago	Avago Technologies
++avia	avia semiconductor
++avic	Shanghai AVIC Optoelectronics Co., Ltd.
++avnet	Avnet, Inc.
++axentia	Axentia Technologies AB
++axis	Axis Communications AB
++bananapi BIPAI KEJI LIMITED
++bhf	Beckhoff Automation GmbH & Co. KG
++bitmain	Bitmain Technologies
++blokaslabs	Vilniaus Blokas UAB
++boe	BOE Technology Group Co., Ltd.
++bosch	Bosch Sensortec GmbH
++boundary	Boundary Devices Inc.
++brcm	Broadcom Corporation
++buffalo	Buffalo, Inc.
++bticino Bticino International
++calxeda	Calxeda
++capella	Capella Microsystems, Inc
++cascoda	Cascoda, Ltd.
++catalyst	Catalyst Semiconductor, Inc.
++cavium	Cavium, Inc.
++cdns	Cadence Design Systems Inc.
++cdtech	CDTech(H.K.) Electronics Limited
++ceva	Ceva, Inc.
++chipidea	Chipidea, Inc
++chipone		ChipOne
++chipspark	ChipSPARK
++chrp	Common Hardware Reference Platform
++chunghwa	Chunghwa Picture Tubes Ltd.
++ciaa	Computadora Industrial Abierta Argentina
++cirrus	Cirrus Logic, Inc.
++cloudengines	Cloud Engines, Inc.
++cnm	Chips&Media, Inc.
++cnxt	Conexant Systems, Inc.
++compulab	CompuLab Ltd.
++cortina	Cortina Systems, Inc.
++cosmic	Cosmic Circuits
++crane	Crane Connectivity Solutions
++creative	Creative Technology Ltd
++crystalfontz	Crystalfontz America, Inc.
++csky	Hangzhou C-SKY Microsystems Co., Ltd
++cubietech	Cubietech, Ltd.
++cypress	Cypress Semiconductor Corporation
++cznic	CZ.NIC, z.s.p.o.
++dallas	Maxim Integrated Products (formerly Dallas Semiconductor)
++dataimage	DataImage, Inc.
++davicom	DAVICOM Semiconductor, Inc.
++delta	Delta Electronics, Inc.
++denx	Denx Software Engineering
++devantech	Devantech, Ltd.
++dh	DH electronics GmbH
++digi	Digi International Inc.
++digilent	Diglent, Inc.
++dioo	Dioo Microcircuit Co., Ltd
++dlc	DLC Display Co., Ltd.
++dlg	Dialog Semiconductor
++dlink	D-Link Corporation
++dmo	Data Modul AG
++domintech	Domintech Co., Ltd.
++dongwoon	Dongwoon Anatech
++dptechnics	DPTechnics
++dragino	Dragino Technology Co., Limited
++ea	Embedded Artists AB
++ebs-systart EBS-SYSTART GmbH
++ebv	EBV Elektronik
++eckelmann	Eckelmann AG
++edt	Emerging Display Technologies
++eeti	eGalax_eMPIA Technology Inc
++elan	Elan Microelectronic Corp.
++elgin	Elgin S/A.
++embest	Shenzhen Embest Technology Co., Ltd.
++emlid	Emlid, Ltd.
++emmicro	EM Microelectronic
++emtrion	emtrion GmbH
++endless	Endless Mobile, Inc.
++energymicro	Silicon Laboratories (formerly Energy Micro AS)
++engicam	Engicam S.r.l.
++epcos	EPCOS AG
++epfl	Ecole Polytechnique Fédérale de Lausanne
++epson	Seiko Epson Corp.
++est	ESTeem Wireless Modems
++ettus	NI Ettus Research
++eukrea  Eukréa Electromatique
++everest	Everest Semiconductor Co. Ltd.
++everspin	Everspin Technologies, Inc.
++exar	Exar Corporation
++excito	Excito
++ezchip	EZchip Semiconductor
++facebook	Facebook
++fairphone	Fairphone B.V.
++faraday	Faraday Technology Corporation
++fastrax	Fastrax Oy
++fcs	Fairchild Semiconductor
++feiyang	Shenzhen Fly Young Technology Co.,LTD.
++firefly	Firefly
++focaltech	FocalTech Systems Co.,Ltd
++friendlyarm	Guangzhou FriendlyARM Computer Tech Co., Ltd
++fsl	Freescale Semiconductor
++fujitsu	Fujitsu Ltd.
++gateworks	Gateworks Corporation
++gcw Game Consoles Worldwide
++ge	General Electric Company
++geekbuying	GeekBuying
++gef	GE Fanuc Intelligent Platforms Embedded Systems, Inc.
++GEFanuc	GE Fanuc Intelligent Platforms Embedded Systems, Inc.
++geniatech	Geniatech, Inc.
++giantec	Giantec Semiconductor, Inc.
++giantplus	Giantplus Technology Co., Ltd.
++globalscale	Globalscale Technologies, Inc.
++globaltop	GlobalTop Technology, Inc.
++gmt	Global Mixed-mode Technology, Inc.
++goodix	Shenzhen Huiding Technology Co., Ltd.
++google	Google, Inc.
++grinn	Grinn
++grmn	Garmin Limited
++gumstix	Gumstix, Inc.
++gw	Gateworks Corporation
++hannstar	HannStar Display Corporation
++haoyu	Haoyu Microelectronic Co. Ltd.
++hardkernel	Hardkernel Co., Ltd
++hideep	HiDeep Inc.
++himax	Himax Technologies, Inc.
++hisilicon	Hisilicon Limited.
++hit	Hitachi Ltd.
++hitex	Hitex Development Tools
++holt	Holt Integrated Circuits, Inc.
++honeywell	Honeywell
++hp	Hewlett Packard
++holtek	Holtek Semiconductor, Inc.
++hwacom	HwaCom Systems Inc.
++i2se	I2SE GmbH
++ibm	International Business Machines (IBM)
++icplus	IC Plus Corp.
++idt	Integrated Device Technologies, Inc.
++ifi	Ingenieurburo Fur Ic-Technologie (I/F/I)
++ilitek	ILI Technology Corporation (ILITEK)
++img	Imagination Technologies Ltd.
++infineon Infineon Technologies
++inforce	Inforce Computing
++ingenic	Ingenic Semiconductor
++innolux	Innolux Corporation
++inside-secure	INSIDE Secure
++intel	Intel Corporation
++intercontrol	Inter Control Group
++invensense	InvenSense Inc.
++inversepath	Inverse Path
++iom	Iomega Corporation
++isee	ISEE 2007 S.L.
++isil	Intersil
++issi	Integrated Silicon Solutions Inc.
++itead	ITEAD Intelligent Systems Co.Ltd
++iwave  iWave Systems Technologies Pvt. Ltd.
++jdi	Japan Display Inc.
++jedec	JEDEC Solid State Technology Association
++jianda	Jiandangjing Technology Co., Ltd.
++karo	Ka-Ro electronics GmbH
++keithkoep	Keith & Koep GmbH
++keymile	Keymile GmbH
++khadas	Khadas
++kiebackpeter    Kieback & Peter GmbH
++kinetic Kinetic Technologies
++kingdisplay	King & Display Technology Co., Ltd.
++kingnovel	Kingnovel Technology Co., Ltd.
++koe	Kaohsiung Opto-Electronics Inc.
++kosagi	Sutajio Ko-Usagi PTE Ltd.
++kyo	Kyocera Corporation
++lacie	LaCie
++laird	Laird PLC
++lantiq	Lantiq Semiconductor
++lattice	Lattice Semiconductor
++lego	LEGO Systems A/S
++lemaker	Shenzhen LeMaker Technology Co., Ltd.
++lenovo	Lenovo Group Ltd.
++lg	LG Corporation
++libretech	Shenzhen Libre Technology Co., Ltd
++licheepi	Lichee Pi
++linaro	Linaro Limited
++linksys	Belkin International, Inc. (Linksys)
++linux	Linux-specific binding
++linx	Linx Technologies
++lltc	Linear Technology Corporation
++logicpd	Logic PD, Inc.
++lsi	LSI Corp. (LSI Logic)
++lwn	Liebherr-Werk Nenzing GmbH
++macnica	Macnica Americas
++marvell	Marvell Technology Group Ltd.
++maxim	Maxim Integrated Products
++mbvl	Mobiveil Inc.
++mcube	mCube
++meas	Measurement Specialties
++mediatek	MediaTek Inc.
++megachips	MegaChips
++mele	Shenzhen MeLE Digital Technology Ltd.
++melexis	Melexis N.V.
++melfas	MELFAS Inc.
++mellanox	Mellanox Technologies
++memsic	MEMSIC Inc.
++merrii	Merrii Technology Co., Ltd.
++micrel	Micrel Inc.
++microchip	Microchip Technology Inc.
++microcrystal	Micro Crystal AG
++micron	Micron Technology Inc.
++mikroe		MikroElektronika d.o.o.
++minix	MINIX Technology Ltd.
++miramems	MiraMEMS Sensing Technology Co., Ltd.
++mitsubishi	Mitsubishi Electric Corporation
++mosaixtech	Mosaix Technologies, Inc.
++motorola	Motorola, Inc.
++moxa	Moxa Inc.
++mpl	MPL AG
++mqmaker	mqmaker Inc.
++mscc	Microsemi Corporation
++msi	Micro-Star International Co. Ltd.
++mti	Imagination Technologies Ltd. (formerly MIPS Technologies Inc.)
++multi-inno	Multi-Inno Technology Co.,Ltd
++mundoreader	Mundo Reader S.L.
++murata	Murata Manufacturing Co., Ltd.
++mxicy	Macronix International Co., Ltd.
++myir	MYIR Tech Limited
++national	National Semiconductor
++nec	NEC LCD Technologies, Ltd.
++neonode		Neonode Inc.
++netgear	NETGEAR
++netlogic	Broadcom Corporation (formerly NetLogic Microsystems)
++netron-dy	Netron DY
++netxeon		Shenzhen Netxeon Technology CO., LTD
++nexbox	Nexbox
++nextthing	Next Thing Co.
++newhaven	Newhaven Display International
++ni	National Instruments
++nintendo	Nintendo
++nlt	NLT Technologies, Ltd.
++nokia	Nokia
++nordic	Nordic Semiconductor
++novtech NovTech, Inc.
++nutsboard	NutsBoard
++nuvoton	Nuvoton Technology Corporation
++nvd	New Vision Display
++nvidia	NVIDIA
++nxp	NXP Semiconductors
++okaya	Okaya Electric America, Inc.
++oki	Oki Electric Industry Co., Ltd.
++olimex	OLIMEX Ltd.
++olpc	One Laptop Per Child
++onion	Onion Corporation
++onnn	ON Semiconductor Corp.
++ontat	On Tat Industrial Company
++opalkelly	Opal Kelly Incorporated
++opencores	OpenCores.org
++openrisc	OpenRISC.io
++option	Option NV
++oranth	Shenzhen Oranth Technology Co., Ltd.
++ORCL	Oracle Corporation
++orisetech	Orise Technology
++ortustech	Ortus Technology Co., Ltd.
++ovti	OmniVision Technologies
++oxsemi	Oxford Semiconductor, Ltd.
++panasonic	Panasonic Corporation
++parade	Parade Technologies Inc.
++pda	Precision Design Associates, Inc.
++pericom	Pericom Technology Inc.
++pervasive	Pervasive Displays, Inc.
++phicomm PHICOMM Co., Ltd.
++phytec	PHYTEC Messtechnik GmbH
++picochip	Picochip Ltd
++pine64	Pine64
++pixcir  PIXCIR MICROELECTRONICS Co., Ltd
++plantower Plantower Co., Ltd
++plathome	Plat'Home Co., Ltd.
++plda	PLDA
++plx	Broadcom Corporation (formerly PLX Technology)
++pni	PNI Sensor Corporation
++portwell	Portwell Inc.
++poslab	Poslab Technology Co., Ltd.
++powervr	PowerVR (deprecated, use img)
++probox2	PROBOX2 (by W2COMP Co., Ltd.)
++pulsedlight	PulsedLight, Inc
++qca	Qualcomm Atheros, Inc.
++qcom	Qualcomm Technologies, Inc
++qemu	QEMU, a generic and open source machine emulator and virtualizer
++qi	Qi Hardware
++qiaodian	QiaoDian XianShi Corporation
++qnap	QNAP Systems, Inc.
++radxa	Radxa
++raidsonic	RaidSonic Technology GmbH
++ralink	Mediatek/Ralink Technology Corp.
++ramtron	Ramtron International
++raspberrypi	Raspberry Pi Foundation
++raydium	Raydium Semiconductor Corp.
++rda	Unisoc Communications, Inc.
++realtek Realtek Semiconductor Corp.
++renesas	Renesas Electronics Corporation
++richtek	Richtek Technology Corporation
++ricoh	Ricoh Co. Ltd.
++rikomagic	Rikomagic Tech Corp. Ltd
++riscv	RISC-V Foundation
++rockchip	Fuzhou Rockchip Electronics Co., Ltd
++rohm	ROHM Semiconductor Co., Ltd
++roofull	Shenzhen Roofull Technology Co, Ltd
++samsung	Samsung Semiconductor
++samtec	Samtec/Softing company
++sancloud	Sancloud Ltd
++sandisk	Sandisk Corporation
++sbs	Smart Battery System
++schindler	Schindler
++seagate	Seagate Technology PLC
++semtech	Semtech Corporation
++sensirion	Sensirion AG
++sff	Small Form Factor Committee
++sgd	Solomon Goldentek Display Corporation
++sgx	SGX Sensortech
++sharp	Sharp Corporation
++shimafuji	Shimafuji Electric, Inc.
++si-en	Si-En Technology Ltd.
++sifive	SiFive, Inc.
++sigma	Sigma Designs, Inc.
++sii	Seiko Instruments, Inc.
++sil	Silicon Image
++silabs	Silicon Laboratories
++silead	Silead Inc.
++silergy	Silergy Corp.
++siliconmitus	Silicon Mitus, Inc.
++simtek
++sirf	SiRF Technology, Inc.
++sis	Silicon Integrated Systems Corp.
++sitronix	Sitronix Technology Corporation
++skyworks	Skyworks Solutions, Inc.
++smsc	Standard Microsystems Corporation
++snps	Synopsys, Inc.
++socionext	Socionext Inc.
++solidrun	SolidRun
++solomon        Solomon Systech Limited
++sony	Sony Corporation
++spansion	Spansion Inc.
++sprd	Spreadtrum Communications Inc.
++sst	Silicon Storage Technology, Inc.
++st	STMicroelectronics
++starry	Starry Electronic Technology (ShenZhen) Co., LTD
++startek	Startek
++ste	ST-Ericsson
++stericsson	ST-Ericsson
++summit	Summit microelectronics
++sunchip	Shenzhen Sunchip Technology Co., Ltd
++SUNW	Sun Microsystems, Inc
++swir	Sierra Wireless
++syna	Synaptics Inc.
++synology	Synology, Inc.
++tbs	TBS Technologies
++tbs-biometrics	Touchless Biometric Systems AG
++tcg	Trusted Computing Group
++tcl	Toby Churchill Ltd.
++technexion	TechNexion
++technologic	Technologic Systems
++tempo	Tempo Semiconductor
++techstar	Shenzhen Techstar Electronics Co., Ltd.
++terasic	Terasic Inc.
++thine	THine Electronics, Inc.
++ti	Texas Instruments
++tianma	Tianma Micro-electronics Co., Ltd.
++tlm	Trusted Logic Mobility
++tmt	Tecon Microprocessor Technologies, LLC.
++topeet  Topeet
++toradex	Toradex AG
++toshiba	Toshiba Corporation
++toumaz	Toumaz
++tpk	TPK U.S.A. LLC
++tplink	TP-LINK Technologies Co., Ltd.
++tpo	TPO
++tronfy	Tronfy
++tronsmart	Tronsmart
++truly	Truly Semiconductors Limited
++tsd	Theobroma Systems Design und Consulting GmbH
++tyan	Tyan Computer Corporation
++u-blox	u-blox
++ucrobotics	uCRobotics
++ubnt	Ubiquiti Networks
++udoo	Udoo
++uniwest	United Western Technologies Corp (UniWest)
++upisemi	uPI Semiconductor Corp.
++urt	United Radiant Technology Corporation
++usi	Universal Scientific Industrial Co., Ltd.
++v3	V3 Semiconductor
++vamrs	Vamrs Ltd.
++variscite	Variscite Ltd.
++via	VIA Technologies, Inc.
++virtio	Virtual I/O Device Specification, developed by the OASIS consortium
++vishay	Vishay Intertechnology, Inc
++vitesse	Vitesse Semiconductor Corporation
++vivante	Vivante Corporation
++vocore VoCore Studio
++voipac	Voipac Technologies s.r.o.
++vot	Vision Optical Technology Co., Ltd.
++wd	Western Digital Corp.
++wetek	WeTek Electronics, limited.
++wexler	Wexler
++whwave  Shenzhen whwave Electronics, Inc.
++wi2wi	Wi2Wi, Inc.
++winbond Winbond Electronics corp.
++winstar	Winstar Display Corp.
++wlf	Wolfson Microelectronics
++wm	Wondermedia Technologies, Inc.
++x-powers	X-Powers
++xes	Extreme Engineering Solutions (X-ES)
++xillybus	Xillybus Ltd.
++xlnx	Xilinx
++xunlong	Shenzhen Xunlong Software CO.,Limited
++ysoft	Y Soft Corporation a.s.
++zarlink	Zarlink Semiconductor
++zeitec	ZEITEC Semiconductor Co., LTD.
++zidoo	Shenzhen Zidoo Technology Co., Ltd.
++zii	Zodiac Inflight Innovations
++zte	ZTE Corp.
++zyxel	ZyXEL Communications Corp.
+--- a/Documentation/devicetree/bindings/vendor-prefixes.yaml
++++ b/Documentation/devicetree/bindings/vendor-prefixes.yaml
+@@ -216,6 +216,8 @@ patternProperties:
+     description: Shenzhen BigTree Tech Co., LTD
+   "^bitmain,.*":
+     description: Bitmain Technologies
++  "^blokaslabs,.*":
++    description: Vilniaus Blokas UAB
+   "^blutek,.*":
+     description: BluTek Power
+   "^boe,.*":
+--- a/drivers/clk/Kconfig
++++ b/drivers/clk/Kconfig
+@@ -98,6 +98,12 @@ config COMMON_CLK_HI655X
+ 	  multi-function device has one fixed-rate oscillator, clocked
+ 	  at 32KHz.
+ 
++config COMMON_CLK_HIFIBERRY_DACPLUSHD
++	tristate
++
++config COMMON_CLK_HIFIBERRY_DACPRO
++	tristate
++
+ config COMMON_CLK_SCMI
+ 	tristate "Clock driver controlled via SCMI interface"
+ 	depends on ARM_SCMI_PROTOCOL || COMPILE_TEST
+--- a/drivers/clk/Makefile
++++ b/drivers/clk/Makefile
+@@ -56,6 +56,8 @@ obj-$(CONFIG_COMMON_CLK_LAN966X)	+= clk-
+ obj-$(CONFIG_COMMON_CLK_LOCHNAGAR)	+= clk-lochnagar.o
+ obj-$(CONFIG_MACH_LOONGSON32)		+= clk-loongson1.o
+ obj-$(CONFIG_COMMON_CLK_LOONGSON2)	+= clk-loongson2.o
++obj-$(CONFIG_COMMON_CLK_HIFIBERRY_DACPRO)	+= clk-hifiberry-dacpro.o
++obj-$(CONFIG_COMMON_CLK_HIFIBERRY_DACPLUSHD)	+= clk-hifiberry-dachd.o
+ obj-$(CONFIG_COMMON_CLK_MAX77686)	+= clk-max77686.o
+ obj-$(CONFIG_COMMON_CLK_MAX9485)	+= clk-max9485.o
+ obj-$(CONFIG_ARCH_MILBEAUT_M10V)	+= clk-milbeaut.o
+--- /dev/null
++++ b/drivers/clk/clk-hifiberry-dachd.c
+@@ -0,0 +1,331 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Clock Driver for HiFiBerry DAC+ HD
++ *
++ * Author: Joerg Schambacher, i2Audio GmbH for HiFiBerry
++ *         Copyright 2020
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/clk-provider.h>
++#include <linux/clk.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/slab.h>
++#include <linux/platform_device.h>
++#include <linux/i2c.h>
++#include <linux/regmap.h>
++
++#define NO_PLL_RESET			0
++#define PLL_RESET			1
++#define HIFIBERRY_PLL_MAX_REGISTER	256
++#define DEFAULT_RATE			44100
++
++static struct reg_default hifiberry_pll_reg_defaults[] = {
++	{0x02, 0x53}, {0x03, 0x00}, {0x07, 0x20}, {0x0F, 0x00},
++	{0x10, 0x0D}, {0x11, 0x1D}, {0x12, 0x0D}, {0x13, 0x8C},
++	{0x14, 0x8C}, {0x15, 0x8C}, {0x16, 0x8C}, {0x17, 0x8C},
++	{0x18, 0x2A}, {0x1C, 0x00}, {0x1D, 0x0F}, {0x1F, 0x00},
++	{0x2A, 0x00}, {0x2C, 0x00}, {0x2F, 0x00}, {0x30, 0x00},
++	{0x31, 0x00}, {0x32, 0x00}, {0x34, 0x00}, {0x37, 0x00},
++	{0x38, 0x00}, {0x39, 0x00}, {0x3A, 0x00}, {0x3B, 0x01},
++	{0x3E, 0x00}, {0x3F, 0x00}, {0x40, 0x00}, {0x41, 0x00},
++	{0x5A, 0x00}, {0x5B, 0x00}, {0x95, 0x00}, {0x96, 0x00},
++	{0x97, 0x00}, {0x98, 0x00}, {0x99, 0x00}, {0x9A, 0x00},
++	{0x9B, 0x00}, {0xA2, 0x00}, {0xA3, 0x00}, {0xA4, 0x00},
++	{0xB7, 0x92},
++	{0x1A, 0x3D}, {0x1B, 0x09}, {0x1E, 0xF3}, {0x20, 0x13},
++	{0x21, 0x75}, {0x2B, 0x04}, {0x2D, 0x11}, {0x2E, 0xE0},
++	{0x3D, 0x7A},
++	{0x35, 0x9D}, {0x36, 0x00}, {0x3C, 0x42},
++	{ 177, 0xAC},
++};
++static struct reg_default common_pll_regs[HIFIBERRY_PLL_MAX_REGISTER];
++static int num_common_pll_regs;
++static struct reg_default dedicated_192k_pll_regs[HIFIBERRY_PLL_MAX_REGISTER];
++static int num_dedicated_192k_pll_regs;
++static struct reg_default dedicated_96k_pll_regs[HIFIBERRY_PLL_MAX_REGISTER];
++static int num_dedicated_96k_pll_regs;
++static struct reg_default dedicated_48k_pll_regs[HIFIBERRY_PLL_MAX_REGISTER];
++static int num_dedicated_48k_pll_regs;
++static struct reg_default dedicated_176k4_pll_regs[HIFIBERRY_PLL_MAX_REGISTER];
++static int num_dedicated_176k4_pll_regs;
++static struct reg_default dedicated_88k2_pll_regs[HIFIBERRY_PLL_MAX_REGISTER];
++static int num_dedicated_88k2_pll_regs;
++static struct reg_default dedicated_44k1_pll_regs[HIFIBERRY_PLL_MAX_REGISTER];
++static int num_dedicated_44k1_pll_regs;
++
++/**
++ * struct clk_hifiberry_drvdata - Common struct to the HiFiBerry DAC HD Clk
++ * @hw: clk_hw for the common clk framework
++ */
++struct clk_hifiberry_drvdata {
++	struct regmap *regmap;
++	struct clk *clk;
++	struct clk_hw hw;
++	unsigned long rate;
++};
++
++#define to_hifiberry_clk(_hw) \
++	container_of(_hw, struct clk_hifiberry_drvdata, hw)
++
++static int clk_hifiberry_dachd_write_pll_regs(struct regmap *regmap,
++				struct reg_default *regs,
++				int num, int do_pll_reset)
++{
++	int i;
++	int ret = 0;
++	char pll_soft_reset[] = { 177, 0xAC, };
++
++	for (i = 0; i < num; i++) {
++		ret |= regmap_write(regmap, regs[i].reg, regs[i].def);
++		if (ret)
++			return ret;
++	}
++	if (do_pll_reset) {
++		ret |= regmap_write(regmap, pll_soft_reset[0],
++						pll_soft_reset[1]);
++		mdelay(10);
++	}
++	return ret;
++}
++
++static unsigned long clk_hifiberry_dachd_recalc_rate(struct clk_hw *hw,
++	unsigned long parent_rate)
++{
++	return to_hifiberry_clk(hw)->rate;
++}
++
++static long clk_hifiberry_dachd_round_rate(struct clk_hw *hw,
++	unsigned long rate, unsigned long *parent_rate)
++{
++	return rate;
++}
++
++static int clk_hifiberry_dachd_set_rate(struct clk_hw *hw,
++	unsigned long rate, unsigned long parent_rate)
++{
++	int ret;
++	struct clk_hifiberry_drvdata *drvdata = to_hifiberry_clk(hw);
++
++	switch (rate) {
++	case 44100:
++		ret = clk_hifiberry_dachd_write_pll_regs(drvdata->regmap,
++			dedicated_44k1_pll_regs, num_dedicated_44k1_pll_regs,
++			PLL_RESET);
++		break;
++	case 88200:
++		ret = clk_hifiberry_dachd_write_pll_regs(drvdata->regmap,
++			dedicated_88k2_pll_regs, num_dedicated_88k2_pll_regs,
++			PLL_RESET);
++		break;
++	case 176400:
++		ret = clk_hifiberry_dachd_write_pll_regs(drvdata->regmap,
++			dedicated_176k4_pll_regs, num_dedicated_176k4_pll_regs,
++			PLL_RESET);
++		break;
++	case 48000:
++		ret = clk_hifiberry_dachd_write_pll_regs(drvdata->regmap,
++			dedicated_48k_pll_regs,	num_dedicated_48k_pll_regs,
++			PLL_RESET);
++		break;
++	case 96000:
++		ret = clk_hifiberry_dachd_write_pll_regs(drvdata->regmap,
++			dedicated_96k_pll_regs,	num_dedicated_96k_pll_regs,
++			PLL_RESET);
++		break;
++	case 192000:
++		ret = clk_hifiberry_dachd_write_pll_regs(drvdata->regmap,
++			dedicated_192k_pll_regs, num_dedicated_192k_pll_regs,
++			PLL_RESET);
++		break;
++	default:
++		ret = -EINVAL;
++		break;
++	}
++	to_hifiberry_clk(hw)->rate = rate;
++
++	return ret;
++}
++
++const struct clk_ops clk_hifiberry_dachd_rate_ops = {
++	.recalc_rate = clk_hifiberry_dachd_recalc_rate,
++	.round_rate = clk_hifiberry_dachd_round_rate,
++	.set_rate = clk_hifiberry_dachd_set_rate,
++};
++
++static int clk_hifiberry_get_prop_values(struct device *dev,
++					char *prop_name,
++					struct reg_default *regs)
++{
++	int ret;
++	int i;
++	u8 tmp[2 * HIFIBERRY_PLL_MAX_REGISTER];
++
++	ret = of_property_read_variable_u8_array(dev->of_node, prop_name,
++			tmp, 0, 2 * HIFIBERRY_PLL_MAX_REGISTER);
++	if (ret < 0)
++		return ret;
++	if (ret & 1) {
++		dev_err(dev,
++			"%s <%s> -> #%i odd number of bytes for reg/val pairs!",
++			__func__,
++			prop_name,
++			ret);
++		return -EINVAL;
++	}
++	ret /= 2;
++	for (i = 0; i < ret; i++) {
++		regs[i].reg = (u32)tmp[2 * i];
++		regs[i].def = (u32)tmp[2 * i + 1];
++	}
++	return ret;
++}
++
++
++static int clk_hifiberry_dachd_dt_parse(struct device *dev)
++{
++	num_common_pll_regs = clk_hifiberry_get_prop_values(dev,
++				"common_pll_regs", common_pll_regs);
++	num_dedicated_44k1_pll_regs = clk_hifiberry_get_prop_values(dev,
++				"44k1_pll_regs", dedicated_44k1_pll_regs);
++	num_dedicated_88k2_pll_regs = clk_hifiberry_get_prop_values(dev,
++				"88k2_pll_regs", dedicated_88k2_pll_regs);
++	num_dedicated_176k4_pll_regs = clk_hifiberry_get_prop_values(dev,
++				"176k4_pll_regs", dedicated_176k4_pll_regs);
++	num_dedicated_48k_pll_regs = clk_hifiberry_get_prop_values(dev,
++				"48k_pll_regs", dedicated_48k_pll_regs);
++	num_dedicated_96k_pll_regs = clk_hifiberry_get_prop_values(dev,
++				"96k_pll_regs", dedicated_96k_pll_regs);
++	num_dedicated_192k_pll_regs = clk_hifiberry_get_prop_values(dev,
++				"192k_pll_regs", dedicated_192k_pll_regs);
++	return 0;
++}
++
++
++static int clk_hifiberry_dachd_remove(struct device *dev)
++{
++	of_clk_del_provider(dev->of_node);
++	return 0;
++}
++
++const struct regmap_config hifiberry_pll_regmap = {
++	.reg_bits = 8,
++	.val_bits = 8,
++	.max_register = HIFIBERRY_PLL_MAX_REGISTER,
++	.reg_defaults = hifiberry_pll_reg_defaults,
++	.num_reg_defaults = ARRAY_SIZE(hifiberry_pll_reg_defaults),
++	.cache_type = REGCACHE_RBTREE,
++};
++EXPORT_SYMBOL_GPL(hifiberry_pll_regmap);
++
++
++static int clk_hifiberry_dachd_i2c_probe(struct i2c_client *i2c)
++{
++	struct clk_hifiberry_drvdata *hdclk;
++	int ret = 0;
++	struct clk_init_data init;
++	struct device *dev = &i2c->dev;
++	struct device_node *dev_node = dev->of_node;
++	struct regmap_config config = hifiberry_pll_regmap;
++
++	hdclk = devm_kzalloc(&i2c->dev,
++			sizeof(struct clk_hifiberry_drvdata), GFP_KERNEL);
++	if (!hdclk)
++		return -ENOMEM;
++
++	i2c_set_clientdata(i2c, hdclk);
++
++	hdclk->regmap = devm_regmap_init_i2c(i2c, &config);
++
++	if (IS_ERR(hdclk->regmap))
++		return PTR_ERR(hdclk->regmap);
++
++	/* start PLL to allow detection of DAC */
++	ret = clk_hifiberry_dachd_write_pll_regs(hdclk->regmap,
++				hifiberry_pll_reg_defaults,
++				ARRAY_SIZE(hifiberry_pll_reg_defaults),
++				PLL_RESET);
++	if (ret)
++		return ret;
++
++	clk_hifiberry_dachd_dt_parse(dev);
++
++	/* restart PLL with configs from DTB */
++	ret = clk_hifiberry_dachd_write_pll_regs(hdclk->regmap, common_pll_regs,
++					num_common_pll_regs, PLL_RESET);
++	if (ret)
++		return ret;
++
++	init.name = "clk-hifiberry-dachd";
++	init.ops = &clk_hifiberry_dachd_rate_ops;
++	init.flags = 0;
++	init.parent_names = NULL;
++	init.num_parents = 0;
++
++	hdclk->hw.init = &init;
++
++	hdclk->clk = devm_clk_register(dev, &hdclk->hw);
++	if (IS_ERR(hdclk->clk)) {
++		dev_err(dev, "unable to register %s\n",	init.name);
++		return PTR_ERR(hdclk->clk);
++	}
++
++	ret = of_clk_add_provider(dev_node, of_clk_src_simple_get, hdclk->clk);
++	if (ret != 0) {
++		dev_err(dev, "Cannot of_clk_add_provider");
++		return ret;
++	}
++
++	ret = clk_set_rate(hdclk->hw.clk, DEFAULT_RATE);
++	if (ret != 0) {
++		dev_err(dev, "Cannot set rate : %d\n",	ret);
++		return -EINVAL;
++	}
++
++	return ret;
++}
++
++static void clk_hifiberry_dachd_i2c_remove(struct i2c_client *i2c)
++{
++	clk_hifiberry_dachd_remove(&i2c->dev);
++}
++
++static const struct i2c_device_id clk_hifiberry_dachd_i2c_id[] = {
++	{ "dachd-clk", },
++	{ }
++};
++MODULE_DEVICE_TABLE(i2c, clk_hifiberry_dachd_i2c_id);
++
++static const struct of_device_id clk_hifiberry_dachd_of_match[] = {
++	{ .compatible = "hifiberry,dachd-clk", },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, clk_hifiberry_dachd_of_match);
++
++static struct i2c_driver clk_hifiberry_dachd_i2c_driver = {
++	.probe		= clk_hifiberry_dachd_i2c_probe,
++	.remove		= clk_hifiberry_dachd_i2c_remove,
++	.id_table	= clk_hifiberry_dachd_i2c_id,
++	.driver		= {
++		.name	= "dachd-clk",
++		.of_match_table = of_match_ptr(clk_hifiberry_dachd_of_match),
++	},
++};
++
++module_i2c_driver(clk_hifiberry_dachd_i2c_driver);
++
++
++MODULE_DESCRIPTION("HiFiBerry DAC+ HD clock driver");
++MODULE_AUTHOR("Joerg Schambacher <joerg@i2audio.com>");
++MODULE_LICENSE("GPL v2");
++MODULE_ALIAS("platform:clk-hifiberry-dachd");
+--- /dev/null
++++ b/drivers/clk/clk-hifiberry-dacpro.c
+@@ -0,0 +1,180 @@
++/*
++ * Clock Driver for HiFiBerry DAC Pro
++ *
++ * Author: Stuart MacLean
++ *         Copyright 2015
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/clk-provider.h>
++#include <linux/clkdev.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/slab.h>
++#include <linux/platform_device.h>
++
++struct ext_clk_rates {
++	/* Clock rate of CLK44EN attached to GPIO6 pin */
++	unsigned long clk_44en;
++	/* Clock rate of CLK48EN attached to GPIO3 pin */
++	unsigned long clk_48en;
++};
++
++/**
++ * struct hifiberry_dacpro_clk - Common struct to the HiFiBerry DAC Pro
++ * @hw: clk_hw for the common clk framework
++ * @mode: 0 => CLK44EN, 1 => CLK48EN
++ */
++struct clk_hifiberry_hw {
++	struct clk_hw hw;
++	uint8_t mode;
++	struct ext_clk_rates clk_rates;
++};
++
++#define to_hifiberry_clk(_hw) container_of(_hw, struct clk_hifiberry_hw, hw)
++
++static const struct ext_clk_rates hifiberry_dacpro_clks = {
++	.clk_44en = 22579200UL,
++	.clk_48en = 24576000UL,
++};
++
++static const struct ext_clk_rates allo_dac_clks = {
++	.clk_44en = 45158400UL,
++	.clk_48en = 49152000UL,
++};
++
++static const struct of_device_id clk_hifiberry_dacpro_dt_ids[] = {
++	{ .compatible = "hifiberry,dacpro-clk", &hifiberry_dacpro_clks },
++	{ .compatible = "allo,dac-clk", &allo_dac_clks },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, clk_hifiberry_dacpro_dt_ids);
++
++static unsigned long clk_hifiberry_dacpro_recalc_rate(struct clk_hw *hw,
++	unsigned long parent_rate)
++{
++	struct clk_hifiberry_hw *clk = to_hifiberry_clk(hw);
++	return (clk->mode == 0) ? clk->clk_rates.clk_44en :
++		clk->clk_rates.clk_48en;
++}
++
++static long clk_hifiberry_dacpro_round_rate(struct clk_hw *hw,
++	unsigned long rate, unsigned long *parent_rate)
++{
++	struct clk_hifiberry_hw *clk = to_hifiberry_clk(hw);
++	long actual_rate;
++
++	if (rate <= clk->clk_rates.clk_44en) {
++		actual_rate = (long)clk->clk_rates.clk_44en;
++	} else if (rate >= clk->clk_rates.clk_48en) {
++		actual_rate = (long)clk->clk_rates.clk_48en;
++	} else {
++		long diff44Rate = (long)(rate - clk->clk_rates.clk_44en);
++		long diff48Rate = (long)(clk->clk_rates.clk_48en - rate);
++
++		if (diff44Rate < diff48Rate)
++			actual_rate = (long)clk->clk_rates.clk_44en;
++		else
++			actual_rate = (long)clk->clk_rates.clk_48en;
++	}
++	return actual_rate;
++}
++
++
++static int clk_hifiberry_dacpro_set_rate(struct clk_hw *hw,
++	unsigned long rate, unsigned long parent_rate)
++{
++	struct clk_hifiberry_hw *clk = to_hifiberry_clk(hw);
++	unsigned long actual_rate;
++
++	actual_rate = (unsigned long)clk_hifiberry_dacpro_round_rate(hw, rate,
++		&parent_rate);
++	clk->mode = (actual_rate == clk->clk_rates.clk_44en) ? 0 : 1;
++	return 0;
++}
++
++
++const struct clk_ops clk_hifiberry_dacpro_rate_ops = {
++	.recalc_rate = clk_hifiberry_dacpro_recalc_rate,
++	.round_rate = clk_hifiberry_dacpro_round_rate,
++	.set_rate = clk_hifiberry_dacpro_set_rate,
++};
++
++static int clk_hifiberry_dacpro_probe(struct platform_device *pdev)
++{
++	const struct of_device_id *of_id;
++	struct clk_hifiberry_hw *proclk;
++	struct clk *clk;
++	struct device *dev;
++	struct clk_init_data init;
++	int ret;
++
++	dev = &pdev->dev;
++	of_id = of_match_node(clk_hifiberry_dacpro_dt_ids, dev->of_node);
++	if (!of_id)
++		return -EINVAL;
++
++	proclk = kzalloc(sizeof(struct clk_hifiberry_hw), GFP_KERNEL);
++	if (!proclk)
++		return -ENOMEM;
++
++	init.name = "clk-hifiberry-dacpro";
++	init.ops = &clk_hifiberry_dacpro_rate_ops;
++	init.flags = 0;
++	init.parent_names = NULL;
++	init.num_parents = 0;
++
++	proclk->mode = 0;
++	proclk->hw.init = &init;
++	memcpy(&proclk->clk_rates, of_id->data, sizeof(proclk->clk_rates));
++
++	clk = devm_clk_register(dev, &proclk->hw);
++	if (!IS_ERR(clk)) {
++		ret = of_clk_add_provider(dev->of_node, of_clk_src_simple_get,
++			clk);
++	} else {
++		dev_err(dev, "Fail to register clock driver\n");
++		kfree(proclk);
++		ret = PTR_ERR(clk);
++	}
++	return ret;
++}
++
++static void clk_hifiberry_dacpro_remove(struct platform_device *pdev)
++{
++	of_clk_del_provider(pdev->dev.of_node);
++}
++
++static struct platform_driver clk_hifiberry_dacpro_driver = {
++	.probe = clk_hifiberry_dacpro_probe,
++	.remove = clk_hifiberry_dacpro_remove,
++	.driver = {
++		.name = "clk-hifiberry-dacpro",
++		.of_match_table = clk_hifiberry_dacpro_dt_ids,
++	},
++};
++
++static int __init clk_hifiberry_dacpro_init(void)
++{
++	return platform_driver_register(&clk_hifiberry_dacpro_driver);
++}
++core_initcall(clk_hifiberry_dacpro_init);
++
++static void __exit clk_hifiberry_dacpro_exit(void)
++{
++	platform_driver_unregister(&clk_hifiberry_dacpro_driver);
++}
++module_exit(clk_hifiberry_dacpro_exit);
++
++MODULE_DESCRIPTION("HiFiBerry DAC Pro clock driver");
++MODULE_LICENSE("GPL v2");
++MODULE_ALIAS("platform:clk-hifiberry-dacpro");
+--- a/sound/soc/bcm/Kconfig
++++ b/sound/soc/bcm/Kconfig
+@@ -26,3 +26,287 @@ config SND_BCM63XX_I2S_WHISTLER
+ 	  DSL/PON chips (bcm63158, bcm63178)
+ 
+ 	  If you don't know what to do here, say N
++
++config SND_BCM2708_SOC_CHIPDIP_DAC
++         tristate "Support for the ChipDip DAC"
++         help
++          Say Y or M if you want to add support for the ChipDip DAC soundcard
++
++config SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD
++	tristate "Support for Google voiceHAT soundcard"
++	select SND_SOC_VOICEHAT
++	select SND_RPI_SIMPLE_SOUNDCARD
++	help
++          Say Y or M if you want to add support for voiceHAT soundcard.
++
++config SND_BCM2708_SOC_HIFIBERRY_ADC
++        tristate "Support for HifiBerry ADC"
++        select SND_SOC_PCM186X_I2C
++        select SND_RPI_HIFIBERRY_ADC
++        help
++         Say Y or M if you want to add support for HifiBerry ADC.
++         Use this module for HiFiBerry's ADC-only sound cards
++
++config SND_BCM2708_SOC_HIFIBERRY_ADC8X
++        tristate "Support for HifiBerry ADC8X"
++        select SND_RPI_SIMPLE_SOUNDCARD
++        help
++         Say Y or M if you want to add support for HifiBerry ADC8X.
++         Note: ADC8X only works on PI5
++
++config SND_BCM2708_SOC_HIFIBERRY_DAC
++        tristate "Support for HifiBerry DAC and DAC8X"
++        select SND_SOC_PCM5102A
++        select SND_RPI_SIMPLE_SOUNDCARD
++        help
++         Say Y or M if you want to add support for HifiBerry DAC and DAC8X.
++         Note: DAC8X only works on PI5
++
++config SND_BCM2708_SOC_HIFIBERRY_DACPLUS
++        tristate "Support for HifiBerry DAC+"
++        select SND_SOC_PCM512x
++        select SND_SOC_TPA6130A2
++        select COMMON_CLK_HIFIBERRY_DACPRO
++        help
++         Say Y or M if you want to add support for HifiBerry DAC+.
++
++config SND_BCM2708_SOC_HIFIBERRY_DACPLUSHD
++        tristate "Support for HifiBerry DAC+ HD"
++        select SND_SOC_PCM179X_I2C
++        select COMMON_CLK_HIFIBERRY_DACPLUSHD
++        help
++         Say Y or M if you want to add support for HifiBerry DAC+ HD.
++
++config SND_BCM2708_SOC_HIFIBERRY_DACPLUSADC
++        tristate "Support for HifiBerry DAC+ADC"
++        select SND_SOC_PCM512x_I2C
++	select SND_SOC_DMIC
++        select COMMON_CLK_HIFIBERRY_DACPRO
++        help
++         Say Y or M if you want to add support for HifiBerry DAC+ADC.
++
++config SND_BCM2708_SOC_HIFIBERRY_DACPLUSADCPRO
++        tristate "Support for HifiBerry DAC+ADC PRO"
++        select SND_SOC_PCM512x_I2C
++        select SND_SOC_PCM186X_I2C
++        select SND_SOC_TPA6130A2
++        select COMMON_CLK_HIFIBERRY_DACPRO
++        help
++         Say Y or M if you want to add support for HifiBerry DAC+ADC PRO.
++
++config SND_BCM2708_SOC_HIFIBERRY_DACPLUSDSP
++        tristate "Support for HifiBerry DAC+DSP"
++	select SND_RPI_SIMPLE_SOUNDCARD
++        help
++         Say Y or M if you want to add support for HifiBerry DSP-DAC.
++
++config SND_BCM2708_SOC_HIFIBERRY_DIGI
++        tristate "Support for HifiBerry Digi"
++        select SND_SOC_WM8804
++        help
++         Say Y or M if you want to add support for HifiBerry Digi S/PDIF output board.
++
++config SND_BCM2708_SOC_HIFIBERRY_AMP
++        tristate "Support for the HifiBerry Amp"
++        select SND_SOC_TAS5713
++        select SND_RPI_SIMPLE_SOUNDCARD
++        help
++         Say Y or M if you want to add support for the HifiBerry Amp amplifier board.
++
++config SND_BCM2708_SOC_PIFI_40
++         tristate "Support for the PiFi-40 amp"
++         select SND_SOC_TAS571X
++         select SND_PIFI_40
++         help
++          Say Y or M if you want to add support for the PiFi40 amp board
++
++config SND_BCM2708_SOC_RPI_CIRRUS
++        tristate "Support for Cirrus Logic Audio Card"
++        select SND_SOC_WM5102
++        select SND_SOC_WM8804
++        help
++         Say Y or M if you want to add support for the Wolfson and
++         Cirrus Logic audio cards.
++
++config SND_BCM2708_SOC_RPI_DAC
++        tristate "Support for RPi-DAC"
++        select SND_SOC_PCM1794A
++        select SND_RPI_SIMPLE_SOUNDCARD
++        help
++         Say Y or M if you want to add support for RPi-DAC.
++
++config SND_BCM2708_SOC_RPI_PROTO
++	tristate "Support for Rpi-PROTO"
++	select SND_SOC_WM8731_I2C
++	help
++	  Say Y or M if you want to add support for Audio Codec Board PROTO (WM8731).
++
++config SND_BCM2708_SOC_JUSTBOOM_BOTH
++	tristate "Support for simultaneous JustBoom Digi and JustBoom DAC"
++	select SND_SOC_WM8804
++	select SND_SOC_PCM512x
++	help
++		Say Y or M if you want to add support for simultaneous
++		JustBoom Digi and JustBoom DAC.
++
++		This is not the right choice if you only have one but both of
++		these cards.
++
++config SND_BCM2708_SOC_JUSTBOOM_DAC
++	tristate "Support for JustBoom DAC"
++	select SND_SOC_PCM512x
++	help
++	  Say Y or M if you want to add support for JustBoom DAC.
++
++config SND_BCM2708_SOC_JUSTBOOM_DIGI
++	tristate "Support for JustBoom Digi"
++	select SND_SOC_WM8804
++        select SND_RPI_WM8804_SOUNDCARD
++	help
++	  Say Y or M if you want to add support for JustBoom Digi.
++
++config SND_BCM2708_SOC_IQAUDIO_CODEC
++	tristate "Support for IQaudIO-CODEC"
++	select SND_SOC_DA7213
++	help
++	  Say Y or M if you want to add support for IQaudIO-CODEC.
++
++config SND_BCM2708_SOC_IQAUDIO_DAC
++	tristate "Support for IQaudIO-DAC"
++	select SND_SOC_PCM512x_I2C
++	help
++	  Say Y or M if you want to add support for IQaudIO-DAC.
++
++config SND_BCM2708_SOC_IQAUDIO_DIGI
++	tristate "Support for IQAudIO Digi"
++	select SND_SOC_WM8804
++	select SND_RPI_WM8804_SOUNDCARD
++	help
++	  Say Y or M if you want to add support for IQAudIO Digital IO board.
++
++config SND_BCM2708_SOC_I_SABRE_Q2M
++        tristate "Support for Audiophonics I-Sabre Q2M DAC"
++        select SND_SOC_I_SABRE_CODEC
++        help
++        Say Y or M if you want to add support for Audiophonics I-SABRE Q2M DAC
++
++config SND_BCM2708_SOC_ADAU1977_ADC
++	tristate "Support for ADAU1977 ADC"
++	select SND_SOC_ADAU1977_I2C
++	select SND_RPI_SIMPLE_SOUNDCARD
++	help
++	  Say Y or M if you want to add support for ADAU1977 ADC.
++
++config SND_AUDIOINJECTOR_PI_SOUNDCARD
++	tristate "Support for audioinjector.net Pi add on soundcard"
++	select SND_SOC_WM8731_I2C
++	help
++	  Say Y or M if you want to add support for audioinjector.net Pi Hat
++
++config SND_AUDIOINJECTOR_OCTO_SOUNDCARD
++	tristate "Support for audioinjector.net Octo channel (Hat) soundcard"
++	select SND_SOC_CS42XX8_I2C
++	help
++	  Say Y or M if you want to add support for audioinjector.net octo add on
++
++config SND_AUDIOINJECTOR_ISOLATED_SOUNDCARD
++	tristate "Support for audioinjector.net isolated DAC and ADC soundcard"
++	select SND_SOC_CS4271_I2C
++	help
++	  Say Y or M if you want to add support for audioinjector.net isolated soundcard
++
++config SND_AUDIOSENSE_PI
++	tristate "Support for AudioSense Add-On Soundcard"
++	select SND_SOC_TLV320AIC32X4_I2C
++	help
++	  Say Y or M if you want to add support for tlv320aic32x4 add-on
++
++config SND_DIGIDAC1_SOUNDCARD
++        tristate "Support for Red Rocks Audio DigiDAC1"
++        select SND_SOC_WM8804
++        select SND_SOC_WM8741
++        help
++         Say Y or M if you want to add support for Red Rocks Audio DigiDAC1 board.
++
++config SND_BCM2708_SOC_DIONAUDIO_LOCO
++	tristate "Support for Dion Audio LOCO DAC-AMP"
++	select SND_SOC_PCM5102a
++	help
++	  Say Y or M if you want to add support for Dion Audio LOCO.
++
++config SND_BCM2708_SOC_DIONAUDIO_LOCO_V2
++	tristate "Support for Dion Audio LOCO-V2 DAC-AMP"
++	select SND_SOC_PCM5122
++	help
++	  Say Y or M if you want to add support for Dion Audio LOCO-V2.
++
++config SND_BCM2708_SOC_ALLO_PIANO_DAC
++	tristate "Support for Allo Piano DAC"
++	select SND_SOC_PCM512x_I2C
++	help
++	  Say Y or M if you want to add support for Allo Piano DAC.
++
++config SND_BCM2708_SOC_ALLO_PIANO_DAC_PLUS
++	tristate "Support for Allo Piano DAC Plus"
++	select SND_SOC_PCM512x_I2C
++	help
++	  Say Y or M if you want to add support for Allo Piano DAC Plus.
++
++config SND_BCM2708_SOC_ALLO_BOSS_DAC
++	tristate "Support for Allo Boss DAC"
++	select SND_SOC_PCM512x_I2C
++	select COMMON_CLK_HIFIBERRY_DACPRO
++	help
++	  Say Y or M if you want to add support for Allo Boss DAC.
++
++config SND_BCM2708_SOC_ALLO_BOSS2_DAC
++	tristate "Support for Allo Boss2 DAC"
++	depends on I2C
++	select REGMAP_I2C
++	select SND_AUDIO_GRAPH_CARD
++	help
++	  Say Y or M if you want to add support for Allo Boss2 DAC.
++
++config SND_BCM2708_SOC_ALLO_DIGIONE
++	tristate "Support for Allo DigiOne"
++	select SND_SOC_WM8804
++	select SND_RPI_WM8804_SOUNDCARD
++	help
++	  Say Y or M if you want to add support for Allo DigiOne.
++
++config SND_BCM2708_SOC_ALLO_KATANA_DAC
++	tristate "Support for Allo Katana DAC"
++	depends on I2C
++	select REGMAP_I2C
++	select SND_AUDIO_GRAPH_CARD
++	help
++	  Say Y or M if you want to add support for Allo Katana DAC.
++
++config SND_BCM2708_SOC_FE_PI_AUDIO
++	tristate "Support for Fe-Pi-Audio"
++	select SND_SOC_SGTL5000
++	help
++	  Say Y or M if you want to add support for Fe-Pi-Audio.
++
++config SND_PISOUND
++	tristate "Support for Blokas Labs pisound"
++	select SND_RAWMIDI
++	help
++	  Say Y or M if you want to add support for Blokas Labs pisound.
++
++config SND_RPI_SIMPLE_SOUNDCARD
++	tristate "Support for Raspberry Pi simple soundcards"
++	help
++	  Say Y or M if you want to add support Raspbery Pi simple soundcards
++
++config SND_RPI_WM8804_SOUNDCARD
++	tristate "Support for Raspberry Pi generic WM8804 soundcards"
++	help
++	  Say Y or M if you want to add support for the Raspberry Pi
++          generic driver for WM8804 based soundcards.
++
++config SND_DACBERRY400
++	tristate "Support for DACBERRY400 Soundcard"
++	select SND_SOC_TLV320AIC3X_I2C
++	help
++	  Say Y or M if you want to add support for tlv320aic3x add-on
+--- a/sound/soc/bcm/Makefile
++++ b/sound/soc/bcm/Makefile
+@@ -12,4 +12,75 @@ obj-$(CONFIG_SND_SOC_CYGNUS) += snd-soc-
+ # BCM63XX Platform Support
+ snd-soc-63xx-y := bcm63xx-i2s-whistler.o bcm63xx-pcm-whistler.o
+ 
+-obj-$(CONFIG_SND_BCM63XX_I2S_WHISTLER) += snd-soc-63xx.o
+\ No newline at end of file
++obj-$(CONFIG_SND_BCM63XX_I2S_WHISTLER) += snd-soc-63xx.o
++
++# Google voiceHAT custom codec support
++snd-soc-googlevoicehat-codec-objs := googlevoicehat-codec.o
++
++# BCM2708 Machine Support
++snd-soc-hifiberry-adc-objs := hifiberry_adc.o
++snd-soc-hifiberry-dacplus-objs := hifiberry_dacplus.o
++snd-soc-hifiberry-dacplushd-objs := hifiberry_dacplushd.o
++snd-soc-hifiberry-dacplusadc-objs := hifiberry_dacplusadc.o
++snd-soc-hifiberry-dacplusadcpro-objs := hifiberry_dacplusadcpro.o
++snd-soc-hifiberry-dacplusdsp-objs := hifiberry_dacplusdsp.o
++snd-soc-justboom-both-objs := justboom-both.o
++snd-soc-justboom-dac-objs := justboom-dac.o
++snd-soc-rpi-cirrus-objs := rpi-cirrus.o
++snd-soc-rpi-proto-objs := rpi-proto.o
++snd-soc-iqaudio-codec-objs := iqaudio-codec.o
++snd-soc-iqaudio-dac-objs := iqaudio-dac.o
++ snd-soc-i-sabre-q2m-objs := i-sabre-q2m.o
++snd-soc-audioinjector-pi-soundcard-objs := audioinjector-pi-soundcard.o
++snd-soc-audioinjector-octo-soundcard-objs := audioinjector-octo-soundcard.o
++snd-soc-audioinjector-isolated-soundcard-objs := audioinjector-isolated-soundcard.o
++snd-soc-audiosense-pi-objs := audiosense-pi.o
++snd-soc-digidac1-soundcard-objs := digidac1-soundcard.o
++snd-soc-dionaudio-loco-objs := dionaudio_loco.o
++snd-soc-dionaudio-loco-v2-objs := dionaudio_loco-v2.o
++snd-soc-allo-boss-dac-objs := allo-boss-dac.o
++snd-soc-allo-boss2-dac-objs := allo-boss2-dac.o
++snd-soc-allo-piano-dac-objs := allo-piano-dac.o
++snd-soc-allo-piano-dac-plus-objs := allo-piano-dac-plus.o
++snd-soc-allo-katana-codec-objs := allo-katana-codec.o
++snd-soc-pisound-objs := pisound.o
++snd-soc-fe-pi-audio-objs := fe-pi-audio.o
++snd-soc-rpi-simple-soundcard-objs := rpi-simple-soundcard.o
++snd-soc-rpi-wm8804-soundcard-objs := rpi-wm8804-soundcard.o
++snd-soc-pifi-40-objs := pifi-40.o
++snd-soc-chipdip-dac-objs := chipdip-dac.o
++snd-soc-dacberry400-objs := dacberry400.o
++
++obj-$(CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD)  += snd-soc-googlevoicehat-codec.o
++obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_ADC) += snd-soc-hifiberry-adc.o
++obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS) += snd-soc-hifiberry-dacplus.o
++obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSHD) += snd-soc-hifiberry-dacplushd.o
++obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADC) += snd-soc-hifiberry-dacplusadc.o
++obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADCPRO) += snd-soc-hifiberry-dacplusadcpro.o
++obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSDSP) += snd-soc-hifiberry-dacplusdsp.o
++obj-$(CONFIG_SND_BCM2708_SOC_JUSTBOOM_BOTH) += snd-soc-justboom-both.o
++obj-$(CONFIG_SND_BCM2708_SOC_JUSTBOOM_DAC) += snd-soc-justboom-dac.o
++obj-$(CONFIG_SND_BCM2708_SOC_RPI_CIRRUS) += snd-soc-rpi-cirrus.o
++obj-$(CONFIG_SND_BCM2708_SOC_RPI_PROTO) += snd-soc-rpi-proto.o
++obj-$(CONFIG_SND_BCM2708_SOC_IQAUDIO_CODEC) += snd-soc-iqaudio-codec.o
++obj-$(CONFIG_SND_BCM2708_SOC_IQAUDIO_DAC) += snd-soc-iqaudio-dac.o
++obj-$(CONFIG_SND_BCM2708_SOC_I_SABRE_Q2M) += snd-soc-i-sabre-q2m.o
++obj-$(CONFIG_SND_AUDIOINJECTOR_PI_SOUNDCARD) += snd-soc-audioinjector-pi-soundcard.o
++obj-$(CONFIG_SND_AUDIOINJECTOR_OCTO_SOUNDCARD) += snd-soc-audioinjector-octo-soundcard.o
++obj-$(CONFIG_SND_AUDIOINJECTOR_ISOLATED_SOUNDCARD) += snd-soc-audioinjector-isolated-soundcard.o
++obj-$(CONFIG_SND_AUDIOSENSE_PI) += snd-soc-audiosense-pi.o
++obj-$(CONFIG_SND_DIGIDAC1_SOUNDCARD) += snd-soc-digidac1-soundcard.o
++obj-$(CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO) += snd-soc-dionaudio-loco.o
++obj-$(CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO_V2) += snd-soc-dionaudio-loco-v2.o
++obj-$(CONFIG_SND_BCM2708_SOC_ALLO_BOSS_DAC) += snd-soc-allo-boss-dac.o
++obj-$(CONFIG_SND_BCM2708_SOC_ALLO_BOSS2_DAC) += snd-soc-allo-boss2-dac.o
++obj-$(CONFIG_SND_BCM2708_SOC_ALLO_PIANO_DAC) += snd-soc-allo-piano-dac.o
++obj-$(CONFIG_SND_BCM2708_SOC_ALLO_PIANO_DAC_PLUS) += snd-soc-allo-piano-dac-plus.o
++obj-$(CONFIG_SND_BCM2708_SOC_ALLO_KATANA_DAC) += snd-soc-allo-katana-codec.o
++obj-$(CONFIG_SND_PISOUND) += snd-soc-pisound.o
++obj-$(CONFIG_SND_BCM2708_SOC_FE_PI_AUDIO) += snd-soc-fe-pi-audio.o
++obj-$(CONFIG_SND_RPI_SIMPLE_SOUNDCARD) += snd-soc-rpi-simple-soundcard.o
++obj-$(CONFIG_SND_RPI_WM8804_SOUNDCARD) += snd-soc-rpi-wm8804-soundcard.o
++obj-$(CONFIG_SND_BCM2708_SOC_PIFI_40) += snd-soc-pifi-40.o
++obj-$(CONFIG_SND_BCM2708_SOC_CHIPDIP_DAC) += snd-soc-chipdip-dac.o
++obj-$(CONFIG_SND_DACBERRY400) += snd-soc-dacberry400.o
+--- /dev/null
++++ b/sound/soc/bcm/allo-boss-dac.c
+@@ -0,0 +1,470 @@
++/*
++ * ALSA ASoC Machine Driver for Allo Boss DAC
++ *
++ * Author:	Baswaraj K <jaikumar@cem-solutions.net>
++ *		Copyright 2017
++ *		based on code by Daniel Matuschek,
++ *				 Stuart MacLean <stuart@hifiberry.com>
++ *		based on code by Florian Meier <florian.meier@koalo.de>
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/gpio/consumer.h>
++#include <linux/platform_device.h>
++#include <linux/clk.h>
++#include <linux/delay.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include "../codecs/pcm512x.h"
++
++#define ALLO_BOSS_NOCLOCK 0
++#define ALLO_BOSS_CLK44EN 1
++#define ALLO_BOSS_CLK48EN 2
++
++struct pcm512x_priv {
++	struct regmap *regmap;
++	struct clk *sclk;
++};
++
++static struct gpio_desc *mute_gpio;
++
++/* Clock rate of CLK44EN attached to GPIO6 pin */
++#define CLK_44EN_RATE 45158400UL
++/* Clock rate of CLK48EN attached to GPIO3 pin */
++#define CLK_48EN_RATE 49152000UL
++
++static bool slave;
++static bool snd_soc_allo_boss_master;
++static bool digital_gain_0db_limit = true;
++
++static void snd_allo_boss_select_clk(struct snd_soc_component *component,
++	int clk_id)
++{
++	switch (clk_id) {
++	case ALLO_BOSS_NOCLOCK:
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x00);
++		break;
++	case ALLO_BOSS_CLK44EN:
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x20);
++		break;
++	case ALLO_BOSS_CLK48EN:
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x04);
++		break;
++	}
++}
++
++static void snd_allo_boss_clk_gpio(struct snd_soc_component *component)
++{
++	snd_soc_component_update_bits(component, PCM512x_GPIO_EN, 0x24, 0x24);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_3, 0x0f, 0x02);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_6, 0x0f, 0x02);
++}
++
++static bool snd_allo_boss_is_sclk(struct snd_soc_component *component)
++{
++	unsigned int sck;
++
++	sck = snd_soc_component_read(component, PCM512x_RATE_DET_4);
++	return (!(sck & 0x40));
++}
++
++static bool snd_allo_boss_is_sclk_sleep(
++	struct snd_soc_component *component)
++{
++	msleep(2);
++	return snd_allo_boss_is_sclk(component);
++}
++
++static bool snd_allo_boss_is_master_card(struct snd_soc_component *component)
++{
++	bool isClk44EN, isClk48En, isNoClk;
++
++	snd_allo_boss_clk_gpio(component);
++
++	snd_allo_boss_select_clk(component, ALLO_BOSS_CLK44EN);
++	isClk44EN = snd_allo_boss_is_sclk_sleep(component);
++
++	snd_allo_boss_select_clk(component, ALLO_BOSS_NOCLOCK);
++	isNoClk = snd_allo_boss_is_sclk_sleep(component);
++
++	snd_allo_boss_select_clk(component, ALLO_BOSS_CLK48EN);
++	isClk48En = snd_allo_boss_is_sclk_sleep(component);
++
++	return (isClk44EN && isClk48En && !isNoClk);
++}
++
++static int snd_allo_boss_clk_for_rate(int sample_rate)
++{
++	int type;
++
++	switch (sample_rate) {
++	case 11025:
++	case 22050:
++	case 44100:
++	case 88200:
++	case 176400:
++	case 352800:
++		type = ALLO_BOSS_CLK44EN;
++		break;
++	default:
++		type = ALLO_BOSS_CLK48EN;
++		break;
++	}
++	return type;
++}
++
++static void snd_allo_boss_set_sclk(struct snd_soc_component *component,
++	int sample_rate)
++{
++	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
++
++	if (!IS_ERR(pcm512x->sclk)) {
++		int ctype;
++
++		ctype =	snd_allo_boss_clk_for_rate(sample_rate);
++		clk_set_rate(pcm512x->sclk, (ctype == ALLO_BOSS_CLK44EN)
++				? CLK_44EN_RATE : CLK_48EN_RATE);
++		snd_allo_boss_select_clk(component, ctype);
++	}
++}
++
++static int snd_allo_boss_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++	struct pcm512x_priv *priv = snd_soc_component_get_drvdata(component);
++
++	if (slave)
++		snd_soc_allo_boss_master = false;
++	else
++		snd_soc_allo_boss_master =
++			snd_allo_boss_is_master_card(component);
++
++	if (snd_soc_allo_boss_master) {
++		struct snd_soc_dai_link *dai = rtd->dai_link;
++
++		dai->name = "BossDAC";
++		dai->stream_name = "Boss DAC HiFi [Master]";
++		dai->dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
++			| SND_SOC_DAIFMT_CBM_CFM;
++
++		snd_soc_component_update_bits(component, PCM512x_BCLK_LRCLK_CFG, 0x31, 0x11);
++		snd_soc_component_update_bits(component, PCM512x_MASTER_MODE, 0x03, 0x03);
++		snd_soc_component_update_bits(component, PCM512x_MASTER_CLKDIV_2, 0x7f, 63);
++		/*
++		* Default sclk to CLK_48EN_RATE, otherwise codec
++		*  pcm512x_dai_startup_master method could call
++		*  snd_pcm_hw_constraint_ratnums using CLK_44EN/64
++		*  which will mask 384k sample rate.
++		*/
++		if (!IS_ERR(priv->sclk))
++			clk_set_rate(priv->sclk, CLK_48EN_RATE);
++	} else {
++		priv->sclk = ERR_PTR(-ENOENT);
++	}
++
++	snd_soc_component_update_bits(component, PCM512x_GPIO_EN, 0x08, 0x08);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_4, 0x0f, 0x02);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
++
++	if (digital_gain_0db_limit) {
++		int ret;
++		struct snd_soc_card *card = rtd->card;
++
++		ret = snd_soc_limit_volume(card, "Digital Playback Volume",
++				207);
++		if (ret < 0)
++			dev_warn(card->dev, "Failed to set volume limit: %d\n",
++					ret);
++	}
++
++	return 0;
++}
++
++static int snd_allo_boss_update_rate_den(
++	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
++	struct snd_ratnum *rats_no_pll;
++	unsigned int num = 0, den = 0;
++	int err;
++
++	rats_no_pll = devm_kzalloc(rtd->dev, sizeof(*rats_no_pll), GFP_KERNEL);
++	if (!rats_no_pll)
++		return -ENOMEM;
++
++	rats_no_pll->num = clk_get_rate(pcm512x->sclk) / 64;
++	rats_no_pll->den_min = 1;
++	rats_no_pll->den_max = 128;
++	rats_no_pll->den_step = 1;
++
++	err = snd_interval_ratnum(hw_param_interval(params,
++		SNDRV_PCM_HW_PARAM_RATE), 1, rats_no_pll, &num, &den);
++	if (err >= 0 && den) {
++		params->rate_num = num;
++		params->rate_den = den;
++	}
++
++	devm_kfree(rtd->dev, rats_no_pll);
++	return 0;
++}
++
++static void snd_allo_boss_gpio_mute(struct snd_soc_card *card)
++{
++	if (mute_gpio)
++		gpiod_set_value_cansleep(mute_gpio, 1);
++}
++
++static void snd_allo_boss_gpio_unmute(struct snd_soc_card *card)
++{
++	if (mute_gpio)
++		gpiod_set_value_cansleep(mute_gpio, 0);
++}
++
++static int snd_allo_boss_set_bias_level(struct snd_soc_card *card,
++	struct snd_soc_dapm_context *dapm, enum snd_soc_bias_level level)
++{
++	struct snd_soc_pcm_runtime *rtd;
++	struct snd_soc_dai *codec_dai;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++	codec_dai = snd_soc_rtd_to_codec(rtd, 0);
++
++	if (dapm->dev != codec_dai->dev)
++		return 0;
++
++	switch (level) {
++	case SND_SOC_BIAS_PREPARE:
++		if (dapm->bias_level != SND_SOC_BIAS_STANDBY)
++			break;
++		/* UNMUTE DAC */
++		snd_allo_boss_gpio_unmute(card);
++		break;
++
++	case SND_SOC_BIAS_STANDBY:
++		if (dapm->bias_level != SND_SOC_BIAS_PREPARE)
++			break;
++		/* MUTE DAC */
++		snd_allo_boss_gpio_mute(card);
++		break;
++
++	default:
++		break;
++	}
++
++	return 0;
++}
++
++static int snd_allo_boss_hw_params(
++	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
++{
++	int ret = 0;
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	int channels = params_channels(params);
++	int width = snd_pcm_format_width(params_format(params));
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_card *card = rtd->card;
++
++	/* Using powers of 2 allows for an integer clock divisor */
++	width = width <= 16 ? 16 : 32;
++
++	/* Mute before changing sample rate */
++	snd_allo_boss_gpio_mute(card);
++
++	if (snd_soc_allo_boss_master) {
++		snd_allo_boss_set_sclk(component, params_rate(params));
++
++		ret = snd_allo_boss_update_rate_den(substream, params);
++		if (ret)
++			goto error;
++	}
++
++	ret = snd_soc_dai_set_bclk_ratio(snd_soc_rtd_to_cpu(rtd, 0), channels * width);
++
++	if (ret)
++		goto error;
++
++	ret = snd_soc_dai_set_bclk_ratio(snd_soc_rtd_to_codec(rtd, 0), channels * width);
++
++	if (ret)
++		goto error;
++
++	/* Unmute after setting parameters or having an error */
++error:
++	snd_allo_boss_gpio_unmute(card);
++
++	return ret;
++}
++
++static int snd_allo_boss_startup(
++	struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_card *card = rtd->card;
++
++	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
++	snd_allo_boss_gpio_mute(card);
++
++	if (snd_soc_allo_boss_master) {
++		struct pcm512x_priv *priv = snd_soc_component_get_drvdata(component);
++		/*
++		 * Default sclk to CLK_48EN_RATE, otherwise codec
++		 * pcm512x_dai_startup_master method could call
++		 * snd_pcm_hw_constraint_ratnums using CLK_44EN/64
++		 * which will mask 384k sample rate.
++		 */
++		if (!IS_ERR(priv->sclk))
++			clk_set_rate(priv->sclk, CLK_48EN_RATE);
++	}
++
++	return 0;
++}
++
++static void snd_allo_boss_shutdown(
++	struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++
++	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08, 0x00);
++}
++
++static int snd_allo_boss_prepare(
++	struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_card *card = rtd->card;
++
++	snd_allo_boss_gpio_unmute(card);
++	return 0;
++}
++/* machine stream operations */
++static struct snd_soc_ops snd_allo_boss_ops = {
++	.hw_params = snd_allo_boss_hw_params,
++	.startup = snd_allo_boss_startup,
++	.shutdown = snd_allo_boss_shutdown,
++	.prepare = snd_allo_boss_prepare,
++};
++
++SND_SOC_DAILINK_DEFS(allo_boss,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm512x.1-004d", "pcm512x-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_allo_boss_dai[] = {
++{
++	.name		= "Boss DAC",
++	.stream_name	= "Boss DAC HiFi",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S |
++			  SND_SOC_DAIFMT_NB_NF |
++			  SND_SOC_DAIFMT_CBS_CFS,
++	.ops		= &snd_allo_boss_ops,
++	.init		= snd_allo_boss_init,
++	SND_SOC_DAILINK_REG(allo_boss),
++},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_allo_boss = {
++	.name         = "BossDAC",
++	.owner        = THIS_MODULE,
++	.dai_link     = snd_allo_boss_dai,
++	.num_links    = ARRAY_SIZE(snd_allo_boss_dai),
++};
++
++static int snd_allo_boss_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++
++	snd_allo_boss.dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai;
++
++		dai = &snd_allo_boss_dai[0];
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++					    "i2s-controller", 0);
++
++		if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++		}
++
++		digital_gain_0db_limit = !of_property_read_bool(
++			pdev->dev.of_node, "allo,24db_digital_gain");
++		slave = of_property_read_bool(pdev->dev.of_node,
++						"allo,slave");
++
++		mute_gpio = devm_gpiod_get_optional(&pdev->dev, "mute",
++							GPIOD_OUT_LOW);
++		if (IS_ERR(mute_gpio)) {
++			ret = PTR_ERR(mute_gpio);
++			dev_err(&pdev->dev,
++				"failed to get mute gpio: %d\n", ret);
++			return ret;
++		}
++
++		if (mute_gpio)
++			snd_allo_boss.set_bias_level =
++				snd_allo_boss_set_bias_level;
++
++		ret = snd_soc_register_card(&snd_allo_boss);
++		if (ret) {
++			dev_err(&pdev->dev,
++				"snd_soc_register_card() failed: %d\n", ret);
++			return ret;
++		}
++
++		if (mute_gpio)
++			snd_allo_boss_gpio_mute(&snd_allo_boss);
++
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++static void snd_allo_boss_remove(struct platform_device *pdev)
++{
++	snd_allo_boss_gpio_mute(&snd_allo_boss);
++	snd_soc_unregister_card(&snd_allo_boss);
++}
++
++static const struct of_device_id snd_allo_boss_of_match[] = {
++	{ .compatible = "allo,boss-dac", },
++	{ /* sentinel */ },
++};
++MODULE_DEVICE_TABLE(of, snd_allo_boss_of_match);
++
++static struct platform_driver snd_allo_boss_driver = {
++	.driver = {
++		.name   = "snd-allo-boss-dac",
++		.owner  = THIS_MODULE,
++		.of_match_table = snd_allo_boss_of_match,
++	},
++	.probe          = snd_allo_boss_probe,
++	.remove         = snd_allo_boss_remove,
++};
++
++module_platform_driver(snd_allo_boss_driver);
++
++MODULE_AUTHOR("Baswaraj K <jaikumar@cem-solutions.net>");
++MODULE_DESCRIPTION("ALSA ASoC Machine Driver for Allo Boss DAC");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/allo-boss2-dac.c
+@@ -0,0 +1,1130 @@
++/*
++ * Driver for the ALLO KATANA CODEC
++ *
++ * Author: Jaikumar <sudeepkumar@cem-solutions.net>
++ *		Copyright 2018
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/moduleparam.h>
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/delay.h>
++#include <linux/gpio.h>
++#include <linux/gpio/consumer.h>
++#include <linux/platform_device.h>
++#include <linux/pm.h>
++#include <linux/i2c.h>
++#include <linux/of_device.h>
++#include <linux/regmap.h>
++#include <linux/slab.h>
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/soc-dapm.h>
++#include <sound/initval.h>
++#include <sound/tlv.h>
++#include <linux/of_gpio.h>
++#include <linux/regulator/consumer.h>
++#include <linux/pm_runtime.h>
++#include <linux/of_irq.h>
++#include <linux/completion.h>
++#include <linux/mutex.h>
++#include <linux/workqueue.h>
++#include <sound/jack.h>
++
++#include "../codecs/cs43130.h"
++
++#include <linux/clk.h>
++#include <linux/gcd.h>
++#define DEBUG
++
++#define CS43130_DSD_EN_MASK             0x10
++#define CS43130_PDN_DONE_INT_MASK        0x00
++
++static struct gpio_desc *snd_allo_clk44gpio;
++static struct gpio_desc *snd_allo_clk48gpio;
++
++struct  cs43130_priv {
++	struct snd_soc_component        *component;
++	struct regmap                   *regmap;
++	struct regulator_bulk_data      supplies[CS43130_NUM_SUPPLIES];
++	struct gpio_desc                *reset_gpio;
++	unsigned int                    dev_id; /* codec device ID */
++	int                             xtal_ibias;
++	/* shared by both DAIs */
++	struct mutex                    clk_mutex;
++	int                             clk_req;
++	bool                            pll_bypass;
++	struct completion               xtal_rdy;
++	struct completion               pll_rdy;
++	unsigned int                    mclk;
++	unsigned int                    mclk_int;
++	int                             mclk_int_src;
++
++	/* DAI specific */
++	struct cs43130_dai              dais[CS43130_DAI_ID_MAX];
++
++	/* HP load specific */
++	bool                            dc_meas;
++	bool                            ac_meas;
++	bool                            hpload_done;
++	struct completion               hpload_evt;
++	unsigned int                    hpload_stat;
++	u16                             hpload_dc[2];
++	u16                             dc_threshold[CS43130_DC_THRESHOLD];
++	u16                             ac_freq[CS43130_AC_FREQ];
++	u16                             hpload_ac[CS43130_AC_FREQ][2];
++	struct workqueue_struct         *wq;
++	struct work_struct              work;
++	struct snd_soc_jack             jack;
++};
++
++static const struct reg_default cs43130_reg_defaults[] = {
++	{CS43130_SYS_CLK_CTL_1, 0x06},
++	{CS43130_SP_SRATE, 0x01},
++	{CS43130_SP_BITSIZE, 0x05},
++	{CS43130_PAD_INT_CFG, 0x03},
++	{CS43130_PWDN_CTL, 0xFE},
++	{CS43130_CRYSTAL_SET, 0x04},
++	{CS43130_PLL_SET_1, 0x00},
++	{CS43130_PLL_SET_2, 0x00},
++	{CS43130_PLL_SET_3, 0x00},
++	{CS43130_PLL_SET_4, 0x00},
++	{CS43130_PLL_SET_5, 0x40},
++	{CS43130_PLL_SET_6, 0x10},
++	{CS43130_PLL_SET_7, 0x80},
++	{CS43130_PLL_SET_8, 0x03},
++	{CS43130_PLL_SET_9, 0x02},
++	{CS43130_PLL_SET_10, 0x02},
++	{CS43130_CLKOUT_CTL, 0x00},
++	{CS43130_ASP_NUM_1, 0x01},
++	{CS43130_ASP_NUM_2, 0x00},
++	{CS43130_ASP_DEN_1, 0x08},
++	{CS43130_ASP_DEN_2, 0x00},
++	{CS43130_ASP_LRCK_HI_TIME_1, 0x1F},
++	{CS43130_ASP_LRCK_HI_TIME_2, 0x00},
++	{CS43130_ASP_LRCK_PERIOD_1, 0x3F},
++	{CS43130_ASP_LRCK_PERIOD_2, 0x00},
++	{CS43130_ASP_CLOCK_CONF, 0x0C},
++	{CS43130_ASP_FRAME_CONF, 0x0A},
++	{CS43130_XSP_NUM_1, 0x01},
++	{CS43130_XSP_NUM_2, 0x00},
++	{CS43130_XSP_DEN_1, 0x02},
++	{CS43130_XSP_DEN_2, 0x00},
++	{CS43130_XSP_LRCK_HI_TIME_1, 0x1F},
++	{CS43130_XSP_LRCK_HI_TIME_2, 0x00},
++	{CS43130_XSP_LRCK_PERIOD_1, 0x3F},
++	{CS43130_XSP_LRCK_PERIOD_2, 0x00},
++	{CS43130_XSP_CLOCK_CONF, 0x0C},
++	{CS43130_XSP_FRAME_CONF, 0x0A},
++	{CS43130_ASP_CH_1_LOC, 0x00},
++	{CS43130_ASP_CH_2_LOC, 0x00},
++	{CS43130_ASP_CH_1_SZ_EN, 0x06},
++	{CS43130_ASP_CH_2_SZ_EN, 0x0E},
++	{CS43130_XSP_CH_1_LOC, 0x00},
++	{CS43130_XSP_CH_2_LOC, 0x00},
++	{CS43130_XSP_CH_1_SZ_EN, 0x06},
++	{CS43130_XSP_CH_2_SZ_EN, 0x0E},
++	{CS43130_DSD_VOL_B, 0x78},
++	{CS43130_DSD_VOL_A, 0x78},
++	{CS43130_DSD_PATH_CTL_1, 0xA8},
++	{CS43130_DSD_INT_CFG, 0x00},
++	{CS43130_DSD_PATH_CTL_2, 0x02},
++	{CS43130_DSD_PCM_MIX_CTL, 0x00},
++	{CS43130_DSD_PATH_CTL_3, 0x40},
++	{CS43130_HP_OUT_CTL_1, 0x30},
++	{CS43130_PCM_FILT_OPT, 0x02},
++	{CS43130_PCM_VOL_B, 0x78},
++	{CS43130_PCM_VOL_A, 0x78},
++	{CS43130_PCM_PATH_CTL_1, 0xA8},
++	{CS43130_PCM_PATH_CTL_2, 0x00},
++	{CS43130_CLASS_H_CTL, 0x1E},
++	{CS43130_HP_DETECT, 0x04},
++	{CS43130_HP_LOAD_1, 0x00},
++	{CS43130_HP_MEAS_LOAD_1, 0x00},
++	{CS43130_HP_MEAS_LOAD_2, 0x00},
++	{CS43130_INT_MASK_1, 0xFF},
++	{CS43130_INT_MASK_2, 0xFF},
++	{CS43130_INT_MASK_3, 0xFF},
++	{CS43130_INT_MASK_4, 0xFF},
++	{CS43130_INT_MASK_5, 0xFF},
++};
++static bool cs43130_volatile_register(struct device *dev, unsigned int reg)
++{
++	switch (reg) {
++	case CS43130_INT_STATUS_1 ... CS43130_INT_STATUS_5:
++	case CS43130_HP_DC_STAT_1 ... CS43130_HP_DC_STAT_2:
++	case CS43130_HP_AC_STAT_1 ... CS43130_HP_AC_STAT_2:
++		return true;
++	default:
++		return false;
++	}
++}
++
++static const char * const pcm_spd_texts[] = {
++	"Fast",
++	"Slow",
++};
++
++static SOC_ENUM_SINGLE_DECL(pcm_spd_enum, CS43130_PCM_FILT_OPT, 7,
++			pcm_spd_texts);
++
++static const SNDRV_CTL_TLVD_DECLARE_DB_MINMAX(master_tlv, -12750, 0);
++
++static const struct snd_kcontrol_new cs43130_controls[] = {
++	SOC_DOUBLE_R_TLV("Master Playback Volume", CS43130_PCM_VOL_B,
++			CS43130_PCM_VOL_A, 0, 255, 1, master_tlv),
++	SOC_DOUBLE("Master Playback Switch", CS43130_PCM_PATH_CTL_1,
++			0, 1, 1, 1),
++	SOC_DOUBLE_R_TLV("Digital Playback Volume", CS43130_DSD_VOL_B,
++			CS43130_DSD_VOL_A, 0, 255, 1, master_tlv),
++	SOC_DOUBLE("Digital Playback Switch", CS43130_DSD_PATH_CTL_1,
++			0, 1, 1, 1),
++	SOC_SINGLE("HV_Enable", CS43130_HP_OUT_CTL_1, 0, 1, 0),
++	SOC_ENUM("PCM Filter Speed", pcm_spd_enum),
++	SOC_SINGLE("PCM Phase Compensation", CS43130_PCM_FILT_OPT, 6, 1, 0),
++	SOC_SINGLE("PCM Nonoversample Emulate", CS43130_PCM_FILT_OPT, 5, 1, 0),
++	SOC_SINGLE("PCM High-pass Filter", CS43130_PCM_FILT_OPT, 1, 1, 0),
++	SOC_SINGLE("PCM De-emphasis Filter", CS43130_PCM_FILT_OPT, 0, 1, 0),
++};
++
++static bool cs43130_readable_register(struct device *dev, unsigned int reg)
++{
++	switch (reg) {
++	case CS43130_DEVID_AB ... CS43130_SYS_CLK_CTL_1:
++	case CS43130_SP_SRATE ... CS43130_PAD_INT_CFG:
++	case CS43130_PWDN_CTL:
++	case CS43130_CRYSTAL_SET:
++	case CS43130_PLL_SET_1 ... CS43130_PLL_SET_5:
++	case CS43130_PLL_SET_6:
++	case CS43130_PLL_SET_7:
++	case CS43130_PLL_SET_8:
++	case CS43130_PLL_SET_9:
++	case CS43130_PLL_SET_10:
++	case CS43130_CLKOUT_CTL:
++	case CS43130_ASP_NUM_1 ... CS43130_ASP_FRAME_CONF:
++	case CS43130_XSP_NUM_1 ... CS43130_XSP_FRAME_CONF:
++	case CS43130_ASP_CH_1_LOC:
++	case CS43130_ASP_CH_2_LOC:
++	case CS43130_ASP_CH_1_SZ_EN:
++	case CS43130_ASP_CH_2_SZ_EN:
++	case CS43130_XSP_CH_1_LOC:
++	case CS43130_XSP_CH_2_LOC:
++	case CS43130_XSP_CH_1_SZ_EN:
++	case CS43130_XSP_CH_2_SZ_EN:
++	case CS43130_DSD_VOL_B ... CS43130_DSD_PATH_CTL_3:
++	case CS43130_HP_OUT_CTL_1:
++	case CS43130_PCM_FILT_OPT ... CS43130_PCM_PATH_CTL_2:
++	case CS43130_CLASS_H_CTL:
++	case CS43130_HP_DETECT:
++	case CS43130_HP_STATUS:
++	case CS43130_HP_LOAD_1:
++	case CS43130_HP_MEAS_LOAD_1:
++	case CS43130_HP_MEAS_LOAD_2:
++	case CS43130_HP_DC_STAT_1:
++	case CS43130_HP_DC_STAT_2:
++	case CS43130_HP_AC_STAT_1:
++	case CS43130_HP_AC_STAT_2:
++	case CS43130_HP_LOAD_STAT:
++	case CS43130_INT_STATUS_1 ... CS43130_INT_STATUS_5:
++	case CS43130_INT_MASK_1 ... CS43130_INT_MASK_5:
++		return true;
++	default:
++		return false;
++	}
++}
++static bool cs43130_precious_register(struct device *dev, unsigned int reg)
++{
++	switch (reg) {
++	case CS43130_INT_STATUS_1 ... CS43130_INT_STATUS_5:
++		return true;
++	default:
++		return false;
++	}
++}
++static int cs43130_pcm_pdn(struct snd_soc_component *component)
++{
++	struct cs43130_priv *cs43130 =
++				snd_soc_component_get_drvdata(component);
++	int ret;
++	unsigned int reg, pdn_int;
++
++	regmap_write(cs43130->regmap, CS43130_DSD_PATH_CTL_2, 0x02);
++	regmap_update_bits(cs43130->regmap, CS43130_INT_MASK_1,
++			CS43130_PDN_DONE_INT_MASK, 0);
++	regmap_update_bits(cs43130->regmap, CS43130_PWDN_CTL,
++			CS43130_PDN_HP_MASK, 1 << CS43130_PDN_HP_SHIFT);
++	usleep_range(10, 50);
++	ret = regmap_read(cs43130->regmap, CS43130_INT_STATUS_1, &reg);
++	pdn_int = reg & 0xFE;
++	regmap_update_bits(cs43130->regmap, CS43130_PWDN_CTL,
++			CS43130_PDN_ASP_MASK, 1 << CS43130_PDN_ASP_SHIFT);
++	return 0;
++
++}
++static int cs43130_pwr_up_asp_dac(struct snd_soc_component *component)
++{
++	struct cs43130_priv *cs43130 =
++				snd_soc_component_get_drvdata(component);
++
++	regmap_update_bits(cs43130->regmap, CS43130_PAD_INT_CFG,
++			CS43130_ASP_3ST_MASK, 0);
++	regmap_write(cs43130->regmap, CS43130_DXD1, 0x99);
++	regmap_write(cs43130->regmap, CS43130_DXD13, 0x20);
++	regmap_update_bits(cs43130->regmap, CS43130_PWDN_CTL,
++			CS43130_PDN_ASP_MASK, 0);
++	regmap_update_bits(cs43130->regmap, CS43130_PWDN_CTL,
++			CS43130_PDN_HP_MASK, 0);
++	usleep_range(10000, 12000);
++	regmap_write(cs43130->regmap, CS43130_DXD1, 0x00);
++	regmap_write(cs43130->regmap, CS43130_DXD13, 0x00);
++	return 0;
++}
++static int cs43130_change_clksrc(struct snd_soc_component *component,
++				enum cs43130_mclk_src_sel src)
++{
++	int ret;
++	struct cs43130_priv *cs43130 =
++				snd_soc_component_get_drvdata(component);
++	int mclk_int_decoded;
++
++	if (src == cs43130->mclk_int_src) {
++		/* clk source has not changed */
++		return 0;
++	}
++	switch (cs43130->mclk_int) {
++	case CS43130_MCLK_22M:
++		mclk_int_decoded = CS43130_MCLK_22P5;
++		break;
++	case CS43130_MCLK_24M:
++		mclk_int_decoded = CS43130_MCLK_24P5;
++		break;
++	default:
++		dev_err(component->dev, "Invalid MCLK INT freq: %u\n",
++			cs43130->mclk_int);
++		return -EINVAL;
++	}
++
++	switch (src) {
++	case CS43130_MCLK_SRC_EXT:
++		cs43130->pll_bypass = true;
++		cs43130->mclk_int_src = CS43130_MCLK_SRC_EXT;
++		if (cs43130->xtal_ibias == CS43130_XTAL_UNUSED) {
++			regmap_update_bits(cs43130->regmap, CS43130_PWDN_CTL,
++					CS43130_PDN_XTAL_MASK,
++					1 << CS43130_PDN_XTAL_SHIFT);
++		} else {
++			reinit_completion(&cs43130->xtal_rdy);
++			regmap_update_bits(cs43130->regmap, CS43130_INT_MASK_1,
++					CS43130_XTAL_RDY_INT_MASK, 0);
++			regmap_update_bits(cs43130->regmap, CS43130_PWDN_CTL,
++					CS43130_PDN_XTAL_MASK, 0);
++			ret = wait_for_completion_timeout(&cs43130->xtal_rdy,
++					msecs_to_jiffies(100));
++			regmap_update_bits(cs43130->regmap, CS43130_INT_MASK_1,
++					CS43130_XTAL_RDY_INT_MASK,
++					1 << CS43130_XTAL_RDY_INT_SHIFT);
++			if (ret == 0) {
++				dev_err(component->dev, "Timeout waiting for XTAL_READY interrupt\n");
++				return -ETIMEDOUT;
++			}
++		}
++	regmap_update_bits(cs43130->regmap, CS43130_SYS_CLK_CTL_1,
++				CS43130_MCLK_SRC_SEL_MASK,
++				src << CS43130_MCLK_SRC_SEL_SHIFT);
++	regmap_update_bits(cs43130->regmap, CS43130_SYS_CLK_CTL_1,
++				CS43130_MCLK_INT_MASK,
++				mclk_int_decoded << CS43130_MCLK_INT_SHIFT);
++	usleep_range(150, 200);
++	regmap_update_bits(cs43130->regmap, CS43130_PWDN_CTL,
++				CS43130_PDN_PLL_MASK,
++				1 << CS43130_PDN_PLL_SHIFT);
++	break;
++	case CS43130_MCLK_SRC_RCO:
++		cs43130->mclk_int_src = CS43130_MCLK_SRC_RCO;
++
++		regmap_update_bits(cs43130->regmap, CS43130_SYS_CLK_CTL_1,
++				CS43130_MCLK_SRC_SEL_MASK,
++				src << CS43130_MCLK_SRC_SEL_SHIFT);
++		regmap_update_bits(cs43130->regmap, CS43130_SYS_CLK_CTL_1,
++				CS43130_MCLK_INT_MASK,
++				CS43130_MCLK_22P5 << CS43130_MCLK_INT_SHIFT);
++		usleep_range(150, 200);
++		regmap_update_bits(cs43130->regmap, CS43130_PWDN_CTL,
++				CS43130_PDN_XTAL_MASK,
++				1 << CS43130_PDN_XTAL_SHIFT);
++		regmap_update_bits(cs43130->regmap, CS43130_PWDN_CTL,
++				CS43130_PDN_PLL_MASK,
++				1 << CS43130_PDN_PLL_SHIFT);
++	break;
++	default:
++		dev_err(component->dev, "Invalid MCLK source value\n");
++		return -EINVAL;
++	}
++
++	return 0;
++}
++static const struct cs43130_bitwidth_map cs43130_bitwidth_table[] = {
++	{8,     CS43130_SP_BIT_SIZE_8,  CS43130_CH_BIT_SIZE_8},
++	{16,    CS43130_SP_BIT_SIZE_16, CS43130_CH_BIT_SIZE_16},
++	{24,    CS43130_SP_BIT_SIZE_24, CS43130_CH_BIT_SIZE_24},
++	{32,    CS43130_SP_BIT_SIZE_32, CS43130_CH_BIT_SIZE_32},
++};
++
++static const struct cs43130_bitwidth_map *cs43130_get_bitwidth_table(
++					unsigned int bitwidth)
++{
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(cs43130_bitwidth_table); i++) {
++		if (cs43130_bitwidth_table[i].bitwidth == bitwidth)
++			return &cs43130_bitwidth_table[i];
++	}
++
++	return NULL;
++}
++static int cs43130_set_bitwidth(int dai_id, unsigned int bitwidth_dai,
++				struct regmap *regmap)
++{
++	const struct cs43130_bitwidth_map *bw_map;
++
++	bw_map = cs43130_get_bitwidth_table(bitwidth_dai);
++	if (!bw_map)
++		return -EINVAL;
++
++	switch (dai_id) {
++	case CS43130_ASP_PCM_DAI:
++	case CS43130_ASP_DOP_DAI:
++		regmap_update_bits(regmap, CS43130_ASP_CH_1_SZ_EN,
++				CS43130_CH_BITSIZE_MASK, bw_map->ch_bit);
++		regmap_update_bits(regmap, CS43130_ASP_CH_2_SZ_EN,
++				CS43130_CH_BITSIZE_MASK, bw_map->ch_bit);
++		regmap_update_bits(regmap, CS43130_SP_BITSIZE,
++				CS43130_ASP_BITSIZE_MASK, bw_map->sp_bit);
++		break;
++	case CS43130_XSP_DOP_DAI:
++		regmap_update_bits(regmap, CS43130_XSP_CH_1_SZ_EN,
++				CS43130_CH_BITSIZE_MASK, bw_map->ch_bit);
++		regmap_update_bits(regmap, CS43130_XSP_CH_2_SZ_EN,
++				CS43130_CH_BITSIZE_MASK, bw_map->ch_bit);
++		regmap_update_bits(regmap, CS43130_SP_BITSIZE,
++				CS43130_XSP_BITSIZE_MASK, bw_map->sp_bit <<
++				CS43130_XSP_BITSIZE_SHIFT);
++	break;
++	default:
++		return -EINVAL;
++	}
++
++	return 0;
++}
++static const struct cs43130_rate_map cs43130_rate_table[] = {
++	{32000,         CS43130_ASP_SPRATE_32K},
++	{44100,         CS43130_ASP_SPRATE_44_1K},
++	{48000,         CS43130_ASP_SPRATE_48K},
++	{88200,         CS43130_ASP_SPRATE_88_2K},
++	{96000,         CS43130_ASP_SPRATE_96K},
++	{176400,        CS43130_ASP_SPRATE_176_4K},
++	{192000,        CS43130_ASP_SPRATE_192K},
++	{352800,        CS43130_ASP_SPRATE_352_8K},
++	{384000,        CS43130_ASP_SPRATE_384K},
++};
++
++static const struct cs43130_rate_map *cs43130_get_rate_table(int fs)
++{
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(cs43130_rate_table); i++) {
++		if (cs43130_rate_table[i].fs == fs)
++			return &cs43130_rate_table[i];
++	}
++
++	return NULL;
++}
++
++static const struct cs43130_clk_gen *cs43130_get_clk_gen(int mclk_int, int fs,
++	const struct cs43130_clk_gen *clk_gen_table, int len_clk_gen_table)
++{
++	int i;
++
++	for (i = 0; i < len_clk_gen_table; i++) {
++		if (clk_gen_table[i].mclk_int == mclk_int &&
++					clk_gen_table[i].fs == fs)
++			return &clk_gen_table[i];
++	}
++	return NULL;
++}
++
++static int cs43130_set_sp_fmt(int dai_id, unsigned int bitwidth_sclk,
++				struct snd_pcm_hw_params *params,
++				struct cs43130_priv *cs43130)
++{
++	u16 frm_size;
++	u16 hi_size;
++	u8 frm_delay;
++	u8 frm_phase;
++	u8 frm_data;
++	u8 sclk_edge;
++	u8 lrck_edge;
++	u8 clk_data;
++	u8 loc_ch1;
++	u8 loc_ch2;
++	u8 dai_mode_val;
++	const struct cs43130_clk_gen *clk_gen;
++
++	switch (cs43130->dais[dai_id].dai_format) {
++	case SND_SOC_DAIFMT_I2S:
++		hi_size = bitwidth_sclk;
++		frm_delay = 2;
++		frm_phase = 0;
++		break;
++	case SND_SOC_DAIFMT_LEFT_J:
++		hi_size = bitwidth_sclk;
++		frm_delay = 2;
++		frm_phase = 1;
++		break;
++	case SND_SOC_DAIFMT_DSP_A:
++		hi_size = 1;
++		frm_delay = 2;
++		frm_phase = 1;
++		break;
++	case SND_SOC_DAIFMT_DSP_B:
++		hi_size = 1;
++		frm_delay = 0;
++		frm_phase = 1;
++		break;
++	default:
++		return -EINVAL;
++	}
++	switch (cs43130->dais[dai_id].dai_mode) {
++	case SND_SOC_DAIFMT_CBS_CFS:
++		dai_mode_val = 0;
++		break;
++	case SND_SOC_DAIFMT_CBM_CFM:
++		dai_mode_val = 1;
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	frm_size = bitwidth_sclk * params_channels(params);
++	sclk_edge = 1;
++	lrck_edge = 0;
++	loc_ch1 = 0;
++	loc_ch2 = bitwidth_sclk * (params_channels(params) - 1);
++
++	frm_data = frm_delay & CS43130_SP_FSD_MASK;
++	frm_data |= (frm_phase << CS43130_SP_STP_SHIFT) & CS43130_SP_STP_MASK;
++
++	clk_data = lrck_edge & CS43130_SP_LCPOL_IN_MASK;
++	clk_data |= (lrck_edge << CS43130_SP_LCPOL_OUT_SHIFT) &
++			CS43130_SP_LCPOL_OUT_MASK;
++	clk_data |= (sclk_edge << CS43130_SP_SCPOL_IN_SHIFT) &
++			CS43130_SP_SCPOL_IN_MASK;
++	clk_data |= (sclk_edge << CS43130_SP_SCPOL_OUT_SHIFT) &
++			CS43130_SP_SCPOL_OUT_MASK;
++	clk_data |= (dai_mode_val << CS43130_SP_MODE_SHIFT) &
++			CS43130_SP_MODE_MASK;
++	switch (dai_id) {
++	case CS43130_ASP_PCM_DAI:
++	case CS43130_ASP_DOP_DAI:
++		regmap_update_bits(cs43130->regmap, CS43130_ASP_LRCK_PERIOD_1,
++			CS43130_SP_LCPR_DATA_MASK, (frm_size - 1) >>
++			CS43130_SP_LCPR_LSB_DATA_SHIFT);
++		regmap_update_bits(cs43130->regmap, CS43130_ASP_LRCK_PERIOD_2,
++			CS43130_SP_LCPR_DATA_MASK, (frm_size - 1) >>
++			CS43130_SP_LCPR_MSB_DATA_SHIFT);
++		regmap_update_bits(cs43130->regmap, CS43130_ASP_LRCK_HI_TIME_1,
++			CS43130_SP_LCHI_DATA_MASK, (hi_size - 1) >>
++			CS43130_SP_LCHI_LSB_DATA_SHIFT);
++		regmap_update_bits(cs43130->regmap, CS43130_ASP_LRCK_HI_TIME_2,
++			CS43130_SP_LCHI_DATA_MASK, (hi_size - 1) >>
++			CS43130_SP_LCHI_MSB_DATA_SHIFT);
++		regmap_write(cs43130->regmap, CS43130_ASP_FRAME_CONF, frm_data);
++		regmap_write(cs43130->regmap, CS43130_ASP_CH_1_LOC, loc_ch1);
++		regmap_write(cs43130->regmap, CS43130_ASP_CH_2_LOC, loc_ch2);
++		regmap_update_bits(cs43130->regmap, CS43130_ASP_CH_1_SZ_EN,
++			CS43130_CH_EN_MASK, 1 << CS43130_CH_EN_SHIFT);
++		regmap_update_bits(cs43130->regmap, CS43130_ASP_CH_2_SZ_EN,
++			CS43130_CH_EN_MASK, 1 << CS43130_CH_EN_SHIFT);
++		regmap_write(cs43130->regmap, CS43130_ASP_CLOCK_CONF, clk_data);
++		break;
++	case CS43130_XSP_DOP_DAI:
++		regmap_update_bits(cs43130->regmap, CS43130_XSP_LRCK_PERIOD_1,
++			CS43130_SP_LCPR_DATA_MASK, (frm_size - 1) >>
++			CS43130_SP_LCPR_LSB_DATA_SHIFT);
++		regmap_update_bits(cs43130->regmap, CS43130_XSP_LRCK_PERIOD_2,
++			CS43130_SP_LCPR_DATA_MASK, (frm_size - 1) >>
++			CS43130_SP_LCPR_MSB_DATA_SHIFT);
++		regmap_update_bits(cs43130->regmap, CS43130_XSP_LRCK_HI_TIME_1,
++			CS43130_SP_LCHI_DATA_MASK, (hi_size - 1) >>
++			CS43130_SP_LCHI_LSB_DATA_SHIFT);
++		regmap_update_bits(cs43130->regmap, CS43130_XSP_LRCK_HI_TIME_2,
++			CS43130_SP_LCHI_DATA_MASK, (hi_size - 1) >>
++			CS43130_SP_LCHI_MSB_DATA_SHIFT);
++		regmap_write(cs43130->regmap, CS43130_XSP_FRAME_CONF, frm_data);
++		regmap_write(cs43130->regmap, CS43130_XSP_CH_1_LOC, loc_ch1);
++		regmap_write(cs43130->regmap, CS43130_XSP_CH_2_LOC, loc_ch2);
++		regmap_update_bits(cs43130->regmap, CS43130_XSP_CH_1_SZ_EN,
++			CS43130_CH_EN_MASK, 1 << CS43130_CH_EN_SHIFT);
++		regmap_update_bits(cs43130->regmap, CS43130_XSP_CH_2_SZ_EN,
++			CS43130_CH_EN_MASK, 1 << CS43130_CH_EN_SHIFT);
++		regmap_write(cs43130->regmap, CS43130_XSP_CLOCK_CONF, clk_data);
++		break;
++	default:
++		return -EINVAL;
++	}
++	switch (frm_size) {
++	case 16:
++		clk_gen = cs43130_get_clk_gen(cs43130->mclk_int,
++						params_rate(params),
++						cs43130_16_clk_gen,
++						ARRAY_SIZE(cs43130_16_clk_gen));
++		break;
++	case 32:
++		clk_gen = cs43130_get_clk_gen(cs43130->mclk_int,
++						params_rate(params),
++						cs43130_32_clk_gen,
++						ARRAY_SIZE(cs43130_32_clk_gen));
++		break;
++	case 48:
++		clk_gen = cs43130_get_clk_gen(cs43130->mclk_int,
++						params_rate(params),
++						cs43130_48_clk_gen,
++						ARRAY_SIZE(cs43130_48_clk_gen));
++		break;
++	case 64:
++		clk_gen = cs43130_get_clk_gen(cs43130->mclk_int,
++						params_rate(params),
++						cs43130_64_clk_gen,
++						ARRAY_SIZE(cs43130_64_clk_gen));
++		break;
++	default:
++		return -EINVAL;
++	}
++	if (!clk_gen)
++		return -EINVAL;
++	switch (dai_id) {
++	case CS43130_ASP_PCM_DAI:
++	case CS43130_ASP_DOP_DAI:
++		regmap_write(cs43130->regmap, CS43130_ASP_DEN_1,
++				(clk_gen->v.denominator & CS43130_SP_M_LSB_DATA_MASK) >>
++				CS43130_SP_M_LSB_DATA_SHIFT);
++		regmap_write(cs43130->regmap, CS43130_ASP_DEN_2,
++				(clk_gen->v.denominator & CS43130_SP_M_MSB_DATA_MASK) >>
++				CS43130_SP_M_MSB_DATA_SHIFT);
++		regmap_write(cs43130->regmap, CS43130_ASP_NUM_1,
++				(clk_gen->v.numerator & CS43130_SP_N_LSB_DATA_MASK) >>
++				CS43130_SP_N_LSB_DATA_SHIFT);
++		regmap_write(cs43130->regmap, CS43130_ASP_NUM_2,
++				(clk_gen->v.numerator & CS43130_SP_N_MSB_DATA_MASK) >>
++				CS43130_SP_N_MSB_DATA_SHIFT);
++		break;
++	case CS43130_XSP_DOP_DAI:
++		regmap_write(cs43130->regmap, CS43130_XSP_DEN_1,
++				(clk_gen->v.denominator & CS43130_SP_M_LSB_DATA_MASK) >>
++				CS43130_SP_M_LSB_DATA_SHIFT);
++		regmap_write(cs43130->regmap, CS43130_XSP_DEN_2,
++				(clk_gen->v.denominator & CS43130_SP_M_MSB_DATA_MASK) >>
++				CS43130_SP_M_MSB_DATA_SHIFT);
++		regmap_write(cs43130->regmap, CS43130_XSP_NUM_1,
++				(clk_gen->v.numerator & CS43130_SP_N_LSB_DATA_MASK) >>
++				CS43130_SP_N_LSB_DATA_SHIFT);
++		regmap_write(cs43130->regmap, CS43130_XSP_NUM_2,
++				(clk_gen->v.numerator & CS43130_SP_N_MSB_DATA_MASK) >>
++				CS43130_SP_N_MSB_DATA_SHIFT);
++		break;
++	default:
++		return -EINVAL;
++	}
++	return 0;
++}
++
++static int cs43130_hw_params(struct snd_pcm_substream *substream,
++				struct snd_pcm_hw_params *params,
++				struct snd_soc_dai *dai)
++{
++	struct snd_soc_component *component = dai->component;
++	struct cs43130_priv *cs43130 =
++				snd_soc_component_get_drvdata(component);
++	const struct cs43130_rate_map *rate_map;
++	unsigned int sclk = cs43130->dais[dai->id].sclk;
++	unsigned int bitwidth_sclk;
++	unsigned int bitwidth_dai = (unsigned int)(params_width(params));
++	unsigned int dop_rate = (unsigned int)(params_rate(params));
++	unsigned int required_clk, ret;
++	u8 dsd_speed;
++
++	cs43130->pll_bypass = true;
++	cs43130_pcm_pdn(component);
++	mutex_lock(&cs43130->clk_mutex);
++	if (!cs43130->clk_req) {
++		/* no DAI is currently using clk */
++		if (!(CS43130_MCLK_22M % params_rate(params))) {
++			required_clk = CS43130_MCLK_22M;
++			cs43130->mclk_int =  CS43130_MCLK_22M;
++			gpiod_set_value_cansleep(snd_allo_clk44gpio, 1);
++			gpiod_set_value_cansleep(snd_allo_clk48gpio, 0);
++			usleep_range(13500, 14000);
++		} else {
++			required_clk = CS43130_MCLK_24M;
++			cs43130->mclk_int =  CS43130_MCLK_24M;
++			gpiod_set_value_cansleep(snd_allo_clk48gpio, 1);
++			gpiod_set_value_cansleep(snd_allo_clk44gpio, 0);
++			usleep_range(13500, 14000);
++		}
++		if (cs43130->pll_bypass)
++			cs43130_change_clksrc(component, CS43130_MCLK_SRC_EXT);
++		else
++			cs43130_change_clksrc(component, CS43130_MCLK_SRC_PLL);
++	}
++
++	cs43130->clk_req++;
++	mutex_unlock(&cs43130->clk_mutex);
++
++	switch (dai->id) {
++	case CS43130_ASP_DOP_DAI:
++	case CS43130_XSP_DOP_DAI:
++		/* DoP bitwidth is always 24-bit */
++		bitwidth_dai = 24;
++		sclk = params_rate(params) * bitwidth_dai *
++				params_channels(params);
++
++		switch (params_rate(params)) {
++		case 176400:
++			dsd_speed = 0;
++			break;
++		case 352800:
++			dsd_speed = 1;
++			break;
++		default:
++			dev_err(component->dev, "Rate(%u) not supported\n",
++				params_rate(params));
++			return -EINVAL;
++		}
++
++		regmap_update_bits(cs43130->regmap, CS43130_DSD_PATH_CTL_2,
++					CS43130_DSD_SPEED_MASK,
++					dsd_speed << CS43130_DSD_SPEED_SHIFT);
++		break;
++	case CS43130_ASP_PCM_DAI:
++		rate_map = cs43130_get_rate_table(params_rate(params));
++		if (!rate_map)
++			return -EINVAL;
++
++		regmap_write(cs43130->regmap, CS43130_SP_SRATE, rate_map->val);
++		if ((dop_rate == 176400) && (bitwidth_dai == 24)) {
++			dsd_speed = 0;
++			regmap_update_bits(cs43130->regmap,
++					CS43130_DSD_PATH_CTL_2,
++					CS43130_DSD_SPEED_MASK,
++					dsd_speed << CS43130_DSD_SPEED_SHIFT);
++			regmap_update_bits(cs43130->regmap,
++					CS43130_DSD_PATH_CTL_2,
++					CS43130_DSD_SRC_MASK,
++					CS43130_DSD_SRC_ASP <<
++					CS43130_DSD_SRC_SHIFT);
++			regmap_update_bits(cs43130->regmap,
++					CS43130_DSD_PATH_CTL_2,
++					CS43130_DSD_EN_MASK, 0x01 <<
++					CS43130_DSD_EN_SHIFT);
++		}
++		break;
++	default:
++		dev_err(component->dev, "Invalid DAI (%d)\n", dai->id);
++		return -EINVAL;
++	}
++
++	switch (dai->id) {
++	case CS43130_ASP_DOP_DAI:
++		regmap_update_bits(cs43130->regmap, CS43130_DSD_PATH_CTL_2,
++				CS43130_DSD_SRC_MASK, CS43130_DSD_SRC_ASP <<
++				CS43130_DSD_SRC_SHIFT);
++		regmap_update_bits(cs43130->regmap, CS43130_DSD_PATH_CTL_2,
++				CS43130_DSD_EN_MASK, 0x01 <<
++				CS43130_DSD_EN_SHIFT);
++		break;
++	case CS43130_XSP_DOP_DAI:
++		regmap_update_bits(cs43130->regmap, CS43130_DSD_PATH_CTL_2,
++				CS43130_DSD_SRC_MASK, CS43130_DSD_SRC_XSP <<
++				CS43130_DSD_SRC_SHIFT);
++		break;
++	}
++	if (!sclk && cs43130->dais[dai->id].dai_mode ==
++						SND_SOC_DAIFMT_CBM_CFM) {
++		/* Calculate SCLK in master mode if unassigned */
++		sclk = params_rate(params) * bitwidth_dai *
++				params_channels(params);
++	}
++	if (!sclk) {
++		/* at this point, SCLK must be set */
++		dev_err(component->dev, "SCLK freq is not set\n");
++		return -EINVAL;
++	}
++
++	bitwidth_sclk = (sclk / params_rate(params)) / params_channels(params);
++	if (bitwidth_sclk < bitwidth_dai) {
++		dev_err(component->dev, "Format not supported: SCLK freq is too low\n");
++		return -EINVAL;
++	}
++
++	dev_dbg(component->dev,
++		"sclk = %u, fs = %d, bitwidth_dai = %u\n",
++		sclk, params_rate(params), bitwidth_dai);
++
++	dev_dbg(component->dev,
++		"bitwidth_sclk = %u, num_ch = %u\n",
++		bitwidth_sclk, params_channels(params));
++
++	cs43130_set_bitwidth(dai->id, bitwidth_dai, cs43130->regmap);
++	cs43130_set_sp_fmt(dai->id, bitwidth_sclk, params, cs43130);
++	ret = cs43130_pwr_up_asp_dac(component);
++	return 0;
++}
++
++static int cs43130_hw_free(struct snd_pcm_substream *substream,
++					struct snd_soc_dai *dai)
++{
++	struct snd_soc_component *component = dai->component;
++	struct cs43130_priv *cs43130 =
++				snd_soc_component_get_drvdata(component);
++
++	mutex_lock(&cs43130->clk_mutex);
++	cs43130->clk_req--;
++	if (!cs43130->clk_req) {
++		/* no DAI is currently using clk */
++		cs43130_change_clksrc(component, CS43130_MCLK_SRC_RCO);
++		cs43130_pcm_pdn(component);
++	}
++	mutex_unlock(&cs43130->clk_mutex);
++
++	return 0;
++}
++
++static const unsigned int cs43130_asp_src_rates[] = {
++	32000, 44100, 48000, 88200, 96000, 176400, 192000
++};
++
++static const struct snd_pcm_hw_constraint_list cs43130_asp_constraints = {
++	.count  = ARRAY_SIZE(cs43130_asp_src_rates),
++	.list   = cs43130_asp_src_rates,
++};
++
++static int cs43130_pcm_startup(struct snd_pcm_substream *substream,
++					struct snd_soc_dai *dai)
++{
++	return snd_pcm_hw_constraint_list(substream->runtime, 0,
++					SNDRV_PCM_HW_PARAM_RATE,
++					&cs43130_asp_constraints);
++}
++
++static int cs43130_pcm_set_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
++{
++	struct snd_soc_component *component = codec_dai->component;
++	struct cs43130_priv *cs43130 =
++				snd_soc_component_get_drvdata(component);
++
++	switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
++	case SND_SOC_DAIFMT_CBS_CFS:
++		cs43130->dais[codec_dai->id].dai_mode = SND_SOC_DAIFMT_CBS_CFS;
++		break;
++	case SND_SOC_DAIFMT_CBM_CFM:
++		cs43130->dais[codec_dai->id].dai_mode = SND_SOC_DAIFMT_CBM_CFM;
++		break;
++	default:
++		dev_err(component->dev, "unsupported mode\n");
++		return -EINVAL;
++	}
++
++	switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
++	case SND_SOC_DAIFMT_I2S:
++		cs43130->dais[codec_dai->id].dai_format = SND_SOC_DAIFMT_I2S;
++		break;
++	case SND_SOC_DAIFMT_LEFT_J:
++		cs43130->dais[codec_dai->id].dai_format = SND_SOC_DAIFMT_LEFT_J;
++		break;
++	default:
++		dev_err(component->dev,
++			"unsupported audio format\n");
++		return -EINVAL;
++	}
++
++	dev_dbg(component->dev, "dai_id = %d,  dai_mode = %u, dai_format = %u\n",
++			codec_dai->id,
++			cs43130->dais[codec_dai->id].dai_mode,
++			cs43130->dais[codec_dai->id].dai_format);
++
++	return 0;
++}
++
++static int cs43130_set_sysclk(struct snd_soc_dai *codec_dai,
++					int clk_id, unsigned int freq, int dir)
++{
++	struct snd_soc_component *component = codec_dai->component;
++	struct cs43130_priv *cs43130 =
++				snd_soc_component_get_drvdata(component);
++
++	cs43130->dais[codec_dai->id].sclk = freq;
++	dev_dbg(component->dev, "dai_id = %d,  sclk = %u\n", codec_dai->id,
++				cs43130->dais[codec_dai->id].sclk);
++
++	return 0;
++}
++
++static int cs43130_component_set_sysclk(struct snd_soc_component *component,
++					int clk_id, int source,
++					unsigned int freq, int dir)
++{
++	struct cs43130_priv *cs43130 =
++				snd_soc_component_get_drvdata(component);
++
++	dev_dbg(component->dev, "clk_id = %d, source = %d, freq = %d, dir = %d\n",
++		clk_id, source, freq, dir);
++
++	switch (freq) {
++	case CS43130_MCLK_22M:
++	case CS43130_MCLK_24M:
++		cs43130->mclk = freq;
++		break;
++	default:
++		dev_err(component->dev, "Invalid MCLK INT freq: %u\n", freq);
++		return -EINVAL;
++	}
++
++	if (source == CS43130_MCLK_SRC_EXT) {
++		cs43130->pll_bypass = true;
++	} else {
++		dev_err(component->dev, "Invalid MCLK source\n");
++		return -EINVAL;
++	}
++
++	return 0;
++}
++static u16 const cs43130_ac_freq[CS43130_AC_FREQ] = {
++	24,
++	43,
++	93,
++	200,
++	431,
++	928,
++	2000,
++	4309,
++	9283,
++	20000,
++};
++static const struct snd_soc_dai_ops cs43130_dai_ops = {
++	.startup        = cs43130_pcm_startup,
++	.hw_params	= cs43130_hw_params,
++	.hw_free        = cs43130_hw_free,
++	.set_sysclk     = cs43130_set_sysclk,
++	.set_fmt        = cs43130_pcm_set_fmt,
++};
++
++static struct snd_soc_dai_driver cs43130_codec_dai = {
++	.name = "allo-cs43130",
++	.playback = {
++		.stream_name = "Playback",
++		.channels_min = 2,
++		.channels_max = 2,
++		.rates = SNDRV_PCM_RATE_CONTINUOUS,
++		.rate_min = 44100,
++		.rate_max = 192000,
++		.formats = SNDRV_PCM_FMTBIT_S16_LE |
++			SNDRV_PCM_FMTBIT_S24_LE |
++			SNDRV_PCM_FMTBIT_S32_LE
++
++	},
++	.ops = &cs43130_dai_ops,
++};
++
++static struct snd_soc_component_driver cs43130_component_driver = {
++	.idle_bias_on           = true,
++	.controls		= cs43130_controls,
++	.num_controls		= ARRAY_SIZE(cs43130_controls),
++	.set_sysclk             = cs43130_component_set_sysclk,
++	.idle_bias_on           = 1,
++	.use_pmdown_time        = 1,
++	.endianness             = 1,
++};
++
++static const struct regmap_config cs43130_regmap = {
++	.reg_bits               = 24,
++	.pad_bits               = 8,
++	.val_bits               = 8,
++
++	.max_register           = CS43130_LASTREG,
++	.reg_defaults           = cs43130_reg_defaults,
++	.num_reg_defaults       = ARRAY_SIZE(cs43130_reg_defaults),
++	.readable_reg           = cs43130_readable_register,
++	.precious_reg           = cs43130_precious_register,
++	.volatile_reg           = cs43130_volatile_register,
++	.cache_type             = REGCACHE_RBTREE,
++	/* needed for regcache_sync */
++	.use_single_read        = true,
++	.use_single_write       = true,
++};
++
++static u16 const cs43130_dc_threshold[CS43130_DC_THRESHOLD] = {
++	50,
++	120,
++};
++
++static int cs43130_handle_device_data(struct i2c_client *i2c_client,
++					struct cs43130_priv *cs43130)
++{
++	struct device_node *np = i2c_client->dev.of_node;
++	unsigned int val;
++	int i;
++
++	if (of_property_read_u32(np, "cirrus,xtal-ibias", &val) < 0) {
++	/* Crystal is unused. System clock is used for external MCLK */
++		cs43130->xtal_ibias = CS43130_XTAL_UNUSED;
++		return 0;
++	}
++
++	switch (val) {
++	case 1:
++		cs43130->xtal_ibias = CS43130_XTAL_IBIAS_7_5UA;
++		break;
++	case 2:
++		cs43130->xtal_ibias = CS43130_XTAL_IBIAS_12_5UA;
++		break;
++	case 3:
++		cs43130->xtal_ibias = CS43130_XTAL_IBIAS_15UA;
++		break;
++	default:
++		dev_err(&i2c_client->dev,
++			"Invalid cirrus,xtal-ibias value: %d\n", val);
++		return -EINVAL;
++	}
++
++	cs43130->dc_meas = of_property_read_bool(np, "cirrus,dc-measure");
++	cs43130->ac_meas = of_property_read_bool(np, "cirrus,ac-measure");
++
++	if (of_property_read_u16_array(np, "cirrus,ac-freq", cs43130->ac_freq,
++					CS43130_AC_FREQ) < 0) {
++		for (i = 0; i < CS43130_AC_FREQ; i++)
++			cs43130->ac_freq[i] = cs43130_ac_freq[i];
++	}
++
++	if (of_property_read_u16_array(np, "cirrus,dc-threshold",
++					cs43130->dc_threshold,
++					CS43130_DC_THRESHOLD) < 0) {
++		for (i = 0; i < CS43130_DC_THRESHOLD; i++)
++			cs43130->dc_threshold[i] = cs43130_dc_threshold[i];
++	}
++
++	return 0;
++}
++
++
++static int allo_cs43130_component_probe(struct i2c_client *i2c)
++{
++	struct regmap *regmap;
++	struct regmap_config config = cs43130_regmap;
++	struct device *dev = &i2c->dev;
++	struct cs43130_priv *cs43130;
++	unsigned int devid = 0;
++	unsigned int reg;
++	int ret;
++
++	regmap = devm_regmap_init_i2c(i2c, &config);
++	if (IS_ERR(regmap))
++		return PTR_ERR(regmap);
++
++	cs43130 = devm_kzalloc(dev, sizeof(struct cs43130_priv),
++					GFP_KERNEL);
++	if (!cs43130)
++		return -ENOMEM;
++
++	dev_set_drvdata(dev, cs43130);
++	cs43130->regmap = regmap;
++
++	if (i2c->dev.of_node) {
++		ret = cs43130_handle_device_data(i2c, cs43130);
++		if (ret != 0)
++			return ret;
++	}
++	usleep_range(2000, 2050);
++
++	ret = regmap_read(cs43130->regmap, CS43130_DEVID_AB, &reg);
++	devid = (reg & 0xFF) << 12;
++	ret = regmap_read(cs43130->regmap, CS43130_DEVID_CD, &reg);
++	devid |= (reg & 0xFF) << 4;
++	ret = regmap_read(cs43130->regmap, CS43130_DEVID_E, &reg);
++	devid |= (reg & 0xF0) >> 4;
++	if (devid != CS43198_CHIP_ID) {
++		dev_err(dev, "Failed to read Chip or wrong Chip id: %d\n", ret);
++		return ret;
++	}
++
++	cs43130->mclk_int_src = CS43130_MCLK_SRC_RCO;
++	msleep(20);
++
++	ret = snd_soc_register_component(dev, &cs43130_component_driver,
++				    &cs43130_codec_dai, 1);
++	if (ret != 0) {
++		dev_err(dev, "failed to register codec: %d\n", ret);
++		return ret;
++	}
++	regmap_update_bits(cs43130->regmap, CS43130_PAD_INT_CFG,
++			CS43130_ASP_3ST_MASK, 0);
++	regmap_update_bits(cs43130->regmap, CS43130_PAD_INT_CFG,
++			CS43130_XSP_3ST_MASK, 1);
++	regmap_update_bits(cs43130->regmap, CS43130_PWDN_CTL,
++			CS43130_PDN_HP_MASK, 1 << CS43130_PDN_HP_SHIFT);
++	msleep(20);
++	regmap_write(cs43130->regmap, CS43130_CLASS_H_CTL, 0x06);
++	snd_allo_clk44gpio = devm_gpiod_get(dev, "clock44", GPIOD_OUT_HIGH);
++	if (IS_ERR(snd_allo_clk44gpio))
++		dev_err(dev, "devm_gpiod_get() failed\n");
++
++	snd_allo_clk48gpio = devm_gpiod_get(dev, "clock48", GPIOD_OUT_LOW);
++	if (IS_ERR(snd_allo_clk48gpio))
++		dev_err(dev, "devm_gpiod_get() failed\n");
++
++	return 0;
++}
++
++static void allo_cs43130_component_remove(struct i2c_client *i2c)
++{
++	snd_soc_unregister_component(&i2c->dev);
++}
++
++static const struct i2c_device_id allo_cs43130_component_id[] = {
++	{ "allo-cs43198", },
++	{ }
++};
++MODULE_DEVICE_TABLE(i2c, allo_cs43130_component_id);
++
++static const struct of_device_id allo_cs43130_codec_of_match[] = {
++	{ .compatible = "allo,allo-cs43198", },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, allo_cs43130_codec_of_match);
++
++static struct i2c_driver allo_cs43130_component_driver = {
++	.probe		= allo_cs43130_component_probe,
++	.remove		= allo_cs43130_component_remove,
++	.id_table	= allo_cs43130_component_id,
++	.driver		= {
++	.name		= "allo-cs43198",
++	.of_match_table = allo_cs43130_codec_of_match,
++	},
++};
++
++module_i2c_driver(allo_cs43130_component_driver);
++
++MODULE_DESCRIPTION("ASoC Allo Boss2 Codec Driver");
++MODULE_AUTHOR("Sudeepkumar <sudeepkumar@cem-solutions.net>");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/allo-katana-codec.c
+@@ -0,0 +1,386 @@
++/*
++ * Driver for the ALLO KATANA CODEC
++ *
++ * Author: Jaikumar <jaikumar@cem-solutions.net>
++ *		Copyright 2018
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/clk.h>
++#include <linux/kernel.h>
++#include <linux/regmap.h>
++#include <linux/regulator/consumer.h>
++#include <linux/gcd.h>
++#include <sound/soc.h>
++#include <sound/soc-dapm.h>
++#include <sound/pcm_params.h>
++#include <sound/tlv.h>
++#include <linux/i2c.h>
++
++
++#define KATANA_CODEC_CHIP_ID		0x30
++#define KATANA_CODEC_VIRT_BASE		0x100
++#define KATANA_CODEC_PAGE		0
++
++#define KATANA_CODEC_CHIP_ID_REG	(KATANA_CODEC_VIRT_BASE + 0)
++#define KATANA_CODEC_RESET		(KATANA_CODEC_VIRT_BASE + 1)
++#define KATANA_CODEC_VOLUME_1		(KATANA_CODEC_VIRT_BASE + 2)
++#define KATANA_CODEC_VOLUME_2		(KATANA_CODEC_VIRT_BASE + 3)
++#define KATANA_CODEC_MUTE		(KATANA_CODEC_VIRT_BASE + 4)
++#define KATANA_CODEC_DSP_PROGRAM	(KATANA_CODEC_VIRT_BASE + 5)
++#define KATANA_CODEC_DEEMPHASIS		(KATANA_CODEC_VIRT_BASE + 6)
++#define KATANA_CODEC_DOP		(KATANA_CODEC_VIRT_BASE + 7)
++#define KATANA_CODEC_FORMAT		(KATANA_CODEC_VIRT_BASE + 8)
++#define KATANA_CODEC_COMMAND		(KATANA_CODEC_VIRT_BASE + 9)
++#define KATANA_CODEC_MUTE_STREAM	(KATANA_CODEC_VIRT_BASE + 10)
++
++#define KATANA_CODEC_MAX_REGISTER	(KATANA_CODEC_VIRT_BASE + 10)
++
++#define KATANA_CODEC_FMT		0xff
++#define KATANA_CODEC_CHAN_MONO		0x00
++#define KATANA_CODEC_CHAN_STEREO	0x80
++#define KATANA_CODEC_ALEN_16		0x10
++#define KATANA_CODEC_ALEN_24		0x20
++#define KATANA_CODEC_ALEN_32		0x30
++#define KATANA_CODEC_RATE_11025		0x01
++#define KATANA_CODEC_RATE_22050		0x02
++#define KATANA_CODEC_RATE_32000		0x03
++#define KATANA_CODEC_RATE_44100		0x04
++#define KATANA_CODEC_RATE_48000		0x05
++#define KATANA_CODEC_RATE_88200		0x06
++#define KATANA_CODEC_RATE_96000		0x07
++#define KATANA_CODEC_RATE_176400	0x08
++#define KATANA_CODEC_RATE_192000	0x09
++#define KATANA_CODEC_RATE_352800	0x0a
++#define KATANA_CODEC_RATE_384000	0x0b
++
++
++struct katana_codec_priv {
++	struct regmap *regmap;
++	int fmt;
++};
++
++static const struct reg_default katana_codec_reg_defaults[] = {
++	{ KATANA_CODEC_RESET,		0x00 },
++	{ KATANA_CODEC_VOLUME_1,	0xF0 },
++	{ KATANA_CODEC_VOLUME_2,	0xF0 },
++	{ KATANA_CODEC_MUTE,		0x00 },
++	{ KATANA_CODEC_DSP_PROGRAM,	0x04 },
++	{ KATANA_CODEC_DEEMPHASIS,	0x00 },
++	{ KATANA_CODEC_DOP,		0x00 },
++	{ KATANA_CODEC_FORMAT,		0xb4 },
++};
++
++static const char * const katana_codec_dsp_program_texts[] = {
++	"Linear Phase Fast Roll-off Filter",
++	"Linear Phase Slow Roll-off Filter",
++	"Minimum Phase Fast Roll-off Filter",
++	"Minimum Phase Slow Roll-off Filter",
++	"Apodizing Fast Roll-off Filter",
++	"Corrected Minimum Phase Fast Roll-off Filter",
++	"Brick Wall Filter",
++};
++
++static const unsigned int katana_codec_dsp_program_values[] = {
++	0,
++	1,
++	2,
++	3,
++	4,
++	6,
++	7,
++};
++
++static SOC_VALUE_ENUM_SINGLE_DECL(katana_codec_dsp_program,
++				  KATANA_CODEC_DSP_PROGRAM, 0, 0x07,
++				  katana_codec_dsp_program_texts,
++				  katana_codec_dsp_program_values);
++
++static const char * const katana_codec_deemphasis_texts[] = {
++	"Bypass",
++	"32kHz",
++	"44.1kHz",
++	"48kHz",
++};
++
++static const unsigned int katana_codec_deemphasis_values[] = {
++	0,
++	1,
++	2,
++	3,
++};
++
++static SOC_VALUE_ENUM_SINGLE_DECL(katana_codec_deemphasis,
++				  KATANA_CODEC_DEEMPHASIS, 0, 0x03,
++				  katana_codec_deemphasis_texts,
++				  katana_codec_deemphasis_values);
++
++static const SNDRV_CTL_TLVD_DECLARE_DB_MINMAX(master_tlv, -12750, 0);
++
++static const struct snd_kcontrol_new katana_codec_controls[] = {
++	SOC_DOUBLE_R_TLV("Master Playback Volume", KATANA_CODEC_VOLUME_1,
++			KATANA_CODEC_VOLUME_2, 0, 255, 1, master_tlv),
++	SOC_DOUBLE("Master Playback Switch", KATANA_CODEC_MUTE, 0, 0, 1, 1),
++	SOC_ENUM("DSP Program Route", katana_codec_dsp_program),
++	SOC_ENUM("Deemphasis Route", katana_codec_deemphasis),
++	SOC_SINGLE("DoP Playback Switch", KATANA_CODEC_DOP, 0, 1, 1)
++};
++
++static bool katana_codec_readable_register(struct device *dev,
++				unsigned int reg)
++{
++	switch (reg) {
++	case KATANA_CODEC_CHIP_ID_REG:
++		return true;
++	default:
++		return reg < 0xff;
++	}
++}
++
++static int katana_codec_hw_params(struct snd_pcm_substream *substream,
++			     struct snd_pcm_hw_params *params,
++			     struct snd_soc_dai *dai)
++{
++	struct snd_soc_component *component = dai->component;
++	struct katana_codec_priv *katana_codec =
++		snd_soc_component_get_drvdata(component);
++	int fmt = 0;
++	int ret;
++
++	dev_dbg(component->card->dev, "hw_params %u Hz, %u channels, %u bits\n",
++			params_rate(params),
++			params_channels(params),
++			params_width(params));
++
++	switch (katana_codec->fmt & SND_SOC_DAIFMT_MASTER_MASK) {
++	case SND_SOC_DAIFMT_CBM_CFM: // master
++		if (params_channels(params) == 2)
++			fmt = KATANA_CODEC_CHAN_STEREO;
++		else
++			fmt = KATANA_CODEC_CHAN_MONO;
++
++		switch (params_width(params)) {
++		case 16:
++			fmt |= KATANA_CODEC_ALEN_16;
++			break;
++		case 24:
++			fmt |= KATANA_CODEC_ALEN_24;
++			break;
++		case 32:
++			fmt |= KATANA_CODEC_ALEN_32;
++			break;
++		default:
++			dev_err(component->card->dev, "Bad frame size: %d\n",
++					params_width(params));
++			return -EINVAL;
++		}
++
++		switch (params_rate(params)) {
++		case 44100:
++			fmt |= KATANA_CODEC_RATE_44100;
++			break;
++		case 48000:
++			fmt |= KATANA_CODEC_RATE_48000;
++			break;
++		case 88200:
++			fmt |= KATANA_CODEC_RATE_88200;
++			break;
++		case 96000:
++			fmt |= KATANA_CODEC_RATE_96000;
++			break;
++		case 176400:
++			fmt |= KATANA_CODEC_RATE_176400;
++			break;
++		case 192000:
++			fmt |= KATANA_CODEC_RATE_192000;
++			break;
++		case 352800:
++			fmt |= KATANA_CODEC_RATE_352800;
++			break;
++		case 384000:
++			fmt |= KATANA_CODEC_RATE_384000;
++			break;
++		default:
++			dev_err(component->card->dev, "Bad sample rate: %d\n",
++					params_rate(params));
++			return -EINVAL;
++		}
++
++		ret = regmap_write(katana_codec->regmap, KATANA_CODEC_FORMAT,
++					fmt);
++		if (ret != 0) {
++			dev_err(component->card->dev, "Failed to set format: %d\n", ret);
++			return ret;
++		}
++		break;
++
++	case SND_SOC_DAIFMT_CBS_CFS:
++		break;
++
++	default:
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++static int katana_codec_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
++{
++	struct snd_soc_component *component = dai->component;
++	struct katana_codec_priv *katana_codec =
++		snd_soc_component_get_drvdata(component);
++
++	katana_codec->fmt = fmt;
++
++	return 0;
++}
++
++static int katana_codec_dai_mute_stream(struct snd_soc_dai *dai, int mute,
++						int stream)
++{
++	struct snd_soc_component *component = dai->component;
++	struct katana_codec_priv *katana_codec =
++		snd_soc_component_get_drvdata(component);
++	int ret = 0;
++
++	ret = regmap_write(katana_codec->regmap, KATANA_CODEC_MUTE_STREAM,
++				mute);
++	if (ret != 0) {
++		dev_err(component->card->dev, "Failed to set mute: %d\n", ret);
++		return ret;
++	}
++	return ret;
++}
++
++static const struct snd_soc_dai_ops katana_codec_dai_ops = {
++	.mute_stream = katana_codec_dai_mute_stream,
++	.hw_params = katana_codec_hw_params,
++	.set_fmt = katana_codec_set_fmt,
++};
++
++static struct snd_soc_dai_driver katana_codec_dai = {
++	.name = "allo-katana-codec",
++	.playback = {
++		.stream_name = "Playback",
++		.channels_min = 2,
++		.channels_max = 2,
++		.rates = SNDRV_PCM_RATE_CONTINUOUS,
++		.rate_min = 44100,
++		.rate_max = 384000,
++		.formats = SNDRV_PCM_FMTBIT_S16_LE |
++			SNDRV_PCM_FMTBIT_S32_LE
++	},
++	.ops = &katana_codec_dai_ops,
++};
++
++static struct snd_soc_component_driver katana_codec_component_driver = {
++	.idle_bias_on = true,
++
++	.controls		= katana_codec_controls,
++	.num_controls	= ARRAY_SIZE(katana_codec_controls),
++};
++
++static const struct regmap_range_cfg katana_codec_range = {
++	.name = "Pages", .range_min = KATANA_CODEC_VIRT_BASE,
++	.range_max = KATANA_CODEC_MAX_REGISTER,
++	.selector_reg = KATANA_CODEC_PAGE,
++	.selector_mask = 0xff,
++	.window_start = 0, .window_len = 0x100,
++};
++
++const struct regmap_config katana_codec_regmap = {
++	.reg_bits = 8,
++	.val_bits = 8,
++
++	.ranges = &katana_codec_range,
++	.num_ranges = 1,
++
++	.max_register = KATANA_CODEC_MAX_REGISTER,
++	.readable_reg = katana_codec_readable_register,
++	.reg_defaults = katana_codec_reg_defaults,
++	.num_reg_defaults = ARRAY_SIZE(katana_codec_reg_defaults),
++	.cache_type = REGCACHE_RBTREE,
++};
++
++static int allo_katana_component_probe(struct i2c_client *i2c)
++{
++	struct regmap *regmap;
++	struct regmap_config config = katana_codec_regmap;
++	struct device *dev = &i2c->dev;
++	struct katana_codec_priv *katana_codec;
++	unsigned int chip_id = 0;
++	int ret;
++
++	regmap = devm_regmap_init_i2c(i2c, &config);
++	if (IS_ERR(regmap))
++		return PTR_ERR(regmap);
++
++	katana_codec = devm_kzalloc(dev, sizeof(struct katana_codec_priv),
++					GFP_KERNEL);
++	if (!katana_codec)
++		return -ENOMEM;
++
++	dev_set_drvdata(dev, katana_codec);
++	katana_codec->regmap = regmap;
++
++	ret = regmap_read(regmap, KATANA_CODEC_CHIP_ID_REG, &chip_id);
++	if ((ret != 0) || (chip_id != KATANA_CODEC_CHIP_ID)) {
++		dev_err(dev, "Failed to read Chip or wrong Chip id: %d\n", ret);
++		return ret;
++	}
++	regmap_update_bits(regmap, KATANA_CODEC_RESET, 0x01, 0x01);
++	msleep(10);
++
++	ret = snd_soc_register_component(dev, &katana_codec_component_driver,
++				    &katana_codec_dai, 1);
++	if (ret != 0) {
++		dev_err(dev, "failed to register codec: %d\n", ret);
++		return ret;
++	}
++
++	return 0;
++}
++
++static void allo_katana_component_remove(struct i2c_client *i2c)
++{
++	snd_soc_unregister_component(&i2c->dev);
++}
++
++static const struct i2c_device_id allo_katana_component_id[] = {
++	{ "allo-katana-codec", },
++	{ }
++};
++MODULE_DEVICE_TABLE(i2c, allo_katana_component_id);
++
++static const struct of_device_id allo_katana_codec_of_match[] = {
++	{ .compatible = "allo,allo-katana-codec", },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, allo_katana_codec_of_match);
++
++static struct i2c_driver allo_katana_component_driver = {
++	.probe		= allo_katana_component_probe,
++	.remove		= allo_katana_component_remove,
++	.id_table	= allo_katana_component_id,
++	.driver		= {
++	.name		= "allo-katana-codec",
++	.of_match_table = allo_katana_codec_of_match,
++	},
++};
++
++module_i2c_driver(allo_katana_component_driver);
++
++MODULE_DESCRIPTION("ASoC Allo Katana Codec Driver");
++MODULE_AUTHOR("Jaikumar <jaikumar@cem-solutions.net>");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/allo-piano-dac-plus.c
+@@ -0,0 +1,1063 @@
++/*
++ * ALSA ASoC Machine Driver for Allo Piano DAC Plus Subwoofer
++ *
++ * Author:	Baswaraj K <jaikumar@cem-solutions.net>
++ *		Copyright 2020
++ *		based on code by David Knell <david.knell@gmail.com)
++ *		based on code by Daniel Matuschek <info@crazy-audio.com>
++ *		based on code by Florian Meier <florian.meier@koalo.de>
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/gpio/consumer.h>
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <linux/firmware.h>
++#include <linux/delay.h>
++#include <sound/tlv.h>
++#include "../codecs/pcm512x.h"
++
++#define P_DAC_LEFT_MUTE		0x10
++#define P_DAC_RIGHT_MUTE	0x01
++#define P_DAC_MUTE		0x11
++#define P_DAC_UNMUTE		0x00
++#define P_MUTE			1
++#define P_UNMUTE		0
++
++struct dsp_code {
++	char i2c_addr;
++	char offset;
++	char val;
++};
++
++struct glb_pool {
++	struct mutex lock;
++	unsigned int dual_mode;
++	unsigned int set_lowpass;
++	unsigned int set_mode;
++	unsigned int set_rate;
++	unsigned int dsp_page_number;
++};
++
++static bool digital_gain_0db_limit = true;
++bool glb_mclk;
++
++static struct gpio_desc *mute_gpio[2];
++
++static const char * const allo_piano_mode_texts[] = {
++	"None",
++	"2.0",
++	"2.1",
++	"2.2",
++};
++
++static SOC_ENUM_SINGLE_DECL(allo_piano_mode_enum,
++		0, 0, allo_piano_mode_texts);
++
++static const char * const allo_piano_dual_mode_texts[] = {
++	"None",
++	"Dual-Mono",
++	"Dual-Stereo",
++};
++
++static SOC_ENUM_SINGLE_DECL(allo_piano_dual_mode_enum,
++		0, 0, allo_piano_dual_mode_texts);
++
++static const char * const allo_piano_dsp_low_pass_texts[] = {
++	"60",
++	"70",
++	"80",
++	"90",
++	"100",
++	"110",
++	"120",
++	"130",
++	"140",
++	"150",
++	"160",
++	"170",
++	"180",
++	"190",
++	"200",
++};
++
++static SOC_ENUM_SINGLE_DECL(allo_piano_enum,
++		0, 0, allo_piano_dsp_low_pass_texts);
++
++static int __snd_allo_piano_dsp_program(struct snd_soc_pcm_runtime *rtd,
++		unsigned int mode, unsigned int rate, unsigned int lowpass)
++{
++	const struct firmware *fw;
++	struct snd_soc_card *card = rtd->card;
++	struct glb_pool *glb_ptr = card->drvdata;
++	char firmware_name[60];
++	int ret = 0, dac = 0;
++
++	if (rate <= 46000)
++		rate = 44100;
++	else if (rate <= 68000)
++		rate = 48000;
++	else if (rate <= 92000)
++		rate = 88200;
++	else if (rate <= 136000)
++		rate = 96000;
++	else if (rate <= 184000)
++		rate = 176400;
++	else
++		rate = 192000;
++
++	if (lowpass > 14)
++		glb_ptr->set_lowpass = lowpass = 0;
++
++	if (mode > 3)
++		glb_ptr->set_mode = mode = 0;
++
++	if (mode > 0)
++		glb_ptr->dual_mode = 0;
++
++	/* same configuration loaded */
++	if ((rate == glb_ptr->set_rate) && (lowpass == glb_ptr->set_lowpass)
++			&& (mode == glb_ptr->set_mode))
++		return 0;
++
++	switch (mode) {
++	case 0: /* None */
++		return 1;
++
++	case 1: /* 2.0 */
++		snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 0)->component,
++				PCM512x_MUTE, P_DAC_UNMUTE);
++		snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 1)->component,
++				PCM512x_MUTE, P_DAC_MUTE);
++		glb_ptr->set_rate = rate;
++		glb_ptr->set_mode = mode;
++		glb_ptr->set_lowpass = lowpass;
++		return 1;
++
++	default:
++		snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 0)->component,
++				PCM512x_MUTE, P_DAC_UNMUTE);
++		snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 1)->component,
++				PCM512x_MUTE, P_DAC_UNMUTE);
++	}
++
++	for (dac = 0; dac < rtd->dai_link->num_codecs; dac++) {
++		struct dsp_code *dsp_code_read;
++		int i = 1;
++
++		if (dac == 0) { /* high */
++			snprintf(firmware_name, sizeof(firmware_name),
++				"allo/piano/2.2/allo-piano-dsp-%d-%d-%d.bin",
++				rate, ((lowpass * 10) + 60), dac);
++		} else { /* low */
++			snprintf(firmware_name, sizeof(firmware_name),
++				"allo/piano/2.%d/allo-piano-dsp-%d-%d-%d.bin",
++				(mode - 1), rate, ((lowpass * 10) + 60), dac);
++		}
++
++		dev_info(rtd->card->dev, "Dsp Firmware File Name: %s\n",
++				firmware_name);
++
++		ret = request_firmware(&fw, firmware_name, rtd->card->dev);
++		if (ret < 0) {
++			dev_err(rtd->card->dev,
++				"Error: Allo Piano Firmware %s missing. %d\n",
++				firmware_name, ret);
++			goto err;
++		}
++
++		while (i < (fw->size - 1)) {
++			dsp_code_read = (struct dsp_code *)&fw->data[i];
++
++			if (dsp_code_read->offset == 0) {
++				glb_ptr->dsp_page_number = dsp_code_read->val;
++				ret = snd_soc_component_write(snd_soc_rtd_to_codec(rtd, dac)->component,
++						PCM512x_PAGE_BASE(0),
++						dsp_code_read->val);
++
++			} else if (dsp_code_read->offset != 0) {
++				ret = snd_soc_component_write(snd_soc_rtd_to_codec(rtd, dac)->component,
++					(PCM512x_PAGE_BASE(
++						glb_ptr->dsp_page_number) +
++					dsp_code_read->offset),
++					dsp_code_read->val);
++			}
++			if (ret < 0) {
++				dev_err(rtd->card->dev,
++					"Failed to write Register: %d\n", ret);
++				release_firmware(fw);
++				goto err;
++			}
++			i = i + 3;
++		}
++		release_firmware(fw);
++	}
++	glb_ptr->set_rate = rate;
++	glb_ptr->set_mode = mode;
++	glb_ptr->set_lowpass = lowpass;
++	return 1;
++
++err:
++	return ret;
++}
++
++static int snd_allo_piano_dsp_program(struct snd_soc_pcm_runtime *rtd,
++		unsigned int mode, unsigned int rate, unsigned int lowpass)
++{
++	struct snd_soc_card *card = rtd->card;
++	struct glb_pool *glb_ptr = card->drvdata;
++	int ret = 0;
++
++	mutex_lock(&glb_ptr->lock);
++
++	ret = __snd_allo_piano_dsp_program(rtd, mode, rate, lowpass);
++
++	mutex_unlock(&glb_ptr->lock);
++
++	return ret;
++}
++
++static int snd_allo_piano_dual_mode_get(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct glb_pool *glb_ptr = card->drvdata;
++
++	ucontrol->value.integer.value[0] = glb_ptr->dual_mode;
++
++	return 0;
++}
++
++static int snd_allo_piano_dual_mode_put(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct glb_pool *glb_ptr = card->drvdata;
++	struct snd_soc_pcm_runtime *rtd;
++	struct snd_card *snd_card_ptr = card->snd_card;
++	struct snd_kcontrol *kctl;
++	struct soc_mixer_control *mc;
++	unsigned int left_val = 0, right_val = 0;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++
++	if (ucontrol->value.integer.value[0] > 0) {
++		glb_ptr->dual_mode = ucontrol->value.integer.value[0];
++		glb_ptr->set_mode = 0;
++	} else {
++		if (glb_ptr->set_mode <= 0) {
++			glb_ptr->dual_mode = 1;
++			glb_ptr->set_mode = 0;
++		} else {
++			glb_ptr->dual_mode = 0;
++			return 0;
++		}
++	}
++
++	if (glb_ptr->dual_mode == 1) { // Dual Mono
++		snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 0)->component,
++				PCM512x_MUTE, P_DAC_RIGHT_MUTE);
++		snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 1)->component,
++				PCM512x_MUTE, P_DAC_LEFT_MUTE);
++		snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 0)->component,
++				PCM512x_DIGITAL_VOLUME_3, 0xff);
++		snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 1)->component,
++				PCM512x_DIGITAL_VOLUME_2, 0xff);
++
++		list_for_each_entry(kctl, &snd_card_ptr->controls, list) {
++			if (!strncmp(kctl->id.name, "Main Digital Playback Volume",
++				sizeof(kctl->id.name))) {
++				mc = (struct soc_mixer_control *)
++					kctl->private_value;
++				mc->rreg = mc->reg;
++				break;
++			}
++			if (!strncmp(kctl->id.name, "Sub Digital Playback Volume",
++				sizeof(kctl->id.name))) {
++				mc = (struct soc_mixer_control *)
++					kctl->private_value;
++				mc->rreg = mc->reg;
++				break;
++			}
++		}
++	} else {
++		left_val = snd_soc_component_read(snd_soc_rtd_to_codec(rtd, 0)->component,
++						PCM512x_DIGITAL_VOLUME_2);
++		right_val = snd_soc_component_read(snd_soc_rtd_to_codec(rtd, 1)->component,
++						PCM512x_DIGITAL_VOLUME_3);
++
++		list_for_each_entry(kctl, &snd_card_ptr->controls, list) {
++			if (!strncmp(kctl->id.name, "Main Digital Playback Volume",
++				sizeof(kctl->id.name))) {
++				mc = (struct soc_mixer_control *)
++					kctl->private_value;
++				mc->rreg = PCM512x_DIGITAL_VOLUME_3;
++				break;
++			}
++			if (!strncmp(kctl->id.name, "Sub Digital Playback Volume",
++				sizeof(kctl->id.name))) {
++				mc = (struct soc_mixer_control *)
++					kctl->private_value;
++				mc->rreg = PCM512x_DIGITAL_VOLUME_2;
++				break;
++			}
++		}
++
++		snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 0)->component,
++				PCM512x_DIGITAL_VOLUME_3, left_val);
++		snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 1)->component,
++				PCM512x_DIGITAL_VOLUME_2, right_val);
++		snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 0)->component,
++				PCM512x_MUTE, P_DAC_UNMUTE);
++		snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 1)->component,
++				PCM512x_MUTE, P_DAC_UNMUTE);
++	}
++
++	return 0;
++}
++
++static int snd_allo_piano_mode_get(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct glb_pool *glb_ptr = card->drvdata;
++
++	ucontrol->value.integer.value[0] = glb_ptr->set_mode;
++	return 0;
++}
++
++static int snd_allo_piano_mode_put(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct snd_soc_pcm_runtime *rtd;
++	struct glb_pool *glb_ptr = card->drvdata;
++	struct snd_card *snd_card_ptr = card->snd_card;
++	struct snd_kcontrol *kctl;
++	struct soc_mixer_control *mc;
++	unsigned int left_val = 0, right_val = 0;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++
++	if ((glb_ptr->dual_mode == 1) &&
++			(ucontrol->value.integer.value[0] > 0)) {
++		left_val = snd_soc_component_read(snd_soc_rtd_to_codec(rtd, 0)->component,
++						PCM512x_DIGITAL_VOLUME_2);
++		right_val = snd_soc_component_read(snd_soc_rtd_to_codec(rtd, 1)->component,
++						PCM512x_DIGITAL_VOLUME_2);
++
++		list_for_each_entry(kctl, &snd_card_ptr->controls, list) {
++			if (!strncmp(kctl->id.name, "Main Digital Playback Volume",
++				sizeof(kctl->id.name))) {
++				mc = (struct soc_mixer_control *)
++					kctl->private_value;
++				mc->rreg = PCM512x_DIGITAL_VOLUME_3;
++				break;
++			}
++			if (!strncmp(kctl->id.name, "Sub Digital Playback Volume",
++				sizeof(kctl->id.name))) {
++				mc = (struct soc_mixer_control *)
++					kctl->private_value;
++				mc->rreg = PCM512x_DIGITAL_VOLUME_2;
++				break;
++			}
++		}
++		snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 0)->component,
++				PCM512x_DIGITAL_VOLUME_3, left_val);
++		snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 1)->component,
++				PCM512x_DIGITAL_VOLUME_3, right_val);
++	}
++
++	return(snd_allo_piano_dsp_program(rtd,
++				ucontrol->value.integer.value[0],
++				glb_ptr->set_rate, glb_ptr->set_lowpass));
++}
++
++static int snd_allo_piano_lowpass_get(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct glb_pool *glb_ptr = card->drvdata;
++
++	ucontrol->value.integer.value[0] = glb_ptr->set_lowpass;
++	return 0;
++}
++
++static int snd_allo_piano_lowpass_put(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct snd_soc_pcm_runtime *rtd;
++	struct glb_pool *glb_ptr = card->drvdata;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++	return(snd_allo_piano_dsp_program(rtd,
++				glb_ptr->set_mode, glb_ptr->set_rate,
++				ucontrol->value.integer.value[0]));
++}
++
++static int pcm512x_get_reg_sub(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct soc_mixer_control *mc =
++		(struct soc_mixer_control *)kcontrol->private_value;
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct glb_pool *glb_ptr = card->drvdata;
++	struct snd_soc_pcm_runtime *rtd;
++	unsigned int left_val = 0;
++	unsigned int right_val = 0;
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++
++	right_val = snd_soc_component_read(snd_soc_rtd_to_codec(rtd, 1)->component,
++			PCM512x_DIGITAL_VOLUME_3);
++	if (glb_ptr->dual_mode != 1) {
++		left_val = snd_soc_component_read(snd_soc_rtd_to_codec(rtd, 1)->component,
++				PCM512x_DIGITAL_VOLUME_2);
++
++	} else {
++		left_val = right_val;
++	}
++
++	ucontrol->value.integer.value[0] =
++				(~(left_val >> mc->shift)) & mc->max;
++	ucontrol->value.integer.value[1] =
++				(~(right_val >> mc->shift)) & mc->max;
++
++	return 0;
++}
++
++static int pcm512x_set_reg_sub(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct soc_mixer_control *mc =
++		(struct soc_mixer_control *)kcontrol->private_value;
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct glb_pool *glb_ptr = card->drvdata;
++	struct snd_soc_pcm_runtime *rtd;
++	unsigned int left_val = (ucontrol->value.integer.value[0] & mc->max);
++	unsigned int right_val = (ucontrol->value.integer.value[1] & mc->max);
++	int ret = 0;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++
++	if (digital_gain_0db_limit) {
++		ret = snd_soc_limit_volume(card, "Subwoofer Playback Volume",
++					207);
++		if (ret < 0)
++			dev_warn(card->dev, "Failed to set volume limit: %d\n",
++				ret);
++	}
++
++	// When in Dual Mono, Sub vol control should not set anything.
++	if (glb_ptr->dual_mode != 1) { //Not in Dual Mono mode
++
++		ret = snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 1)->component,
++				PCM512x_DIGITAL_VOLUME_2, (~left_val));
++		if (ret < 0)
++			return ret;
++
++		ret = snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 1)->component,
++				PCM512x_DIGITAL_VOLUME_3, (~right_val));
++		if (ret < 0)
++			return ret;
++
++	}
++
++	return 1;
++}
++
++static int pcm512x_get_reg_sub_switch(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct snd_soc_pcm_runtime *rtd;
++	int val = 0;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++	val = snd_soc_component_read(snd_soc_rtd_to_codec(rtd, 1)->component, PCM512x_MUTE);
++
++	ucontrol->value.integer.value[0] =
++			(val & P_DAC_LEFT_MUTE) ? P_UNMUTE : P_MUTE;
++	ucontrol->value.integer.value[1] =
++			(val & P_DAC_RIGHT_MUTE) ? P_UNMUTE : P_MUTE;
++
++	return val;
++}
++
++static int pcm512x_set_reg_sub_switch(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct snd_soc_pcm_runtime *rtd;
++	struct glb_pool *glb_ptr = card->drvdata;
++	unsigned int left_val = (ucontrol->value.integer.value[0]);
++	unsigned int right_val = (ucontrol->value.integer.value[1]);
++	int ret = 0;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++	if (glb_ptr->set_mode != 1) {
++		ret = snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 1)->component, PCM512x_MUTE,
++				~((left_val & 0x01)<<4 | (right_val & 0x01)));
++		if (ret < 0)
++			return ret;
++	}
++	return 1;
++
++}
++
++static int pcm512x_get_reg_master(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct soc_mixer_control *mc =
++		(struct soc_mixer_control *)kcontrol->private_value;
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct glb_pool *glb_ptr = card->drvdata;
++	struct snd_soc_pcm_runtime *rtd;
++	unsigned int left_val = 0, right_val = 0;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++
++	left_val = snd_soc_component_read(snd_soc_rtd_to_codec(rtd, 0)->component,
++			PCM512x_DIGITAL_VOLUME_2);
++
++	if (glb_ptr->dual_mode == 1) {  // in Dual Mono mode
++		right_val = snd_soc_component_read(snd_soc_rtd_to_codec(rtd, 1)->component,
++				PCM512x_DIGITAL_VOLUME_3);
++	} else {
++		right_val = snd_soc_component_read(snd_soc_rtd_to_codec(rtd, 0)->component,
++				PCM512x_DIGITAL_VOLUME_3);
++	}
++
++	ucontrol->value.integer.value[0] =
++		(~(left_val  >> mc->shift)) & mc->max;
++	ucontrol->value.integer.value[1] =
++		(~(right_val >> mc->shift)) & mc->max;
++
++	return 0;
++}
++
++static int pcm512x_set_reg_master(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct soc_mixer_control *mc =
++		(struct soc_mixer_control *)kcontrol->private_value;
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct glb_pool *glb_ptr = card->drvdata;
++	struct snd_soc_pcm_runtime *rtd;
++	unsigned int left_val = (ucontrol->value.integer.value[0] & mc->max);
++	unsigned int right_val = (ucontrol->value.integer.value[1] & mc->max);
++	int ret = 0;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++
++	if (digital_gain_0db_limit) {
++		ret = snd_soc_limit_volume(card, "Master Playback Volume",
++					207);
++		if (ret < 0)
++			dev_warn(card->dev, "Failed to set volume limit: %d\n",
++				ret);
++	}
++
++	if (glb_ptr->dual_mode == 1) { //in Dual Mono Mode
++
++		ret = snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 0)->component,
++				PCM512x_DIGITAL_VOLUME_2, (~left_val));
++		if (ret < 0)
++			return ret;
++
++		ret = snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 1)->component,
++				PCM512x_DIGITAL_VOLUME_3, (~right_val));
++		if (ret < 0)
++			return ret;
++
++	} else {
++
++		ret = snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 0)->component,
++				PCM512x_DIGITAL_VOLUME_2, (~left_val));
++		if (ret < 0)
++			return ret;
++
++		ret = snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 0)->component,
++				PCM512x_DIGITAL_VOLUME_3, (~right_val));
++		if (ret < 0)
++			return ret;
++
++	}
++	return 1;
++}
++
++static int pcm512x_get_reg_master_switch(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct glb_pool *glb_ptr = card->drvdata;
++	struct snd_soc_pcm_runtime *rtd;
++	int val = 0;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++
++	val = snd_soc_component_read(snd_soc_rtd_to_codec(rtd, 0)->component, PCM512x_MUTE);
++
++	ucontrol->value.integer.value[0] =
++			(val & P_DAC_LEFT_MUTE) ? P_UNMUTE : P_MUTE;
++
++	if (glb_ptr->dual_mode == 1) {
++		val = snd_soc_component_read(snd_soc_rtd_to_codec(rtd, 1)->component, PCM512x_MUTE);
++	}
++	ucontrol->value.integer.value[1] =
++			(val & P_DAC_RIGHT_MUTE) ? P_UNMUTE : P_MUTE;
++
++	return val;
++}
++
++static int pcm512x_set_reg_master_switch(struct snd_kcontrol *kcontrol,
++		struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct snd_soc_pcm_runtime *rtd;
++	struct glb_pool *glb_ptr = card->drvdata;
++	unsigned int left_val = (ucontrol->value.integer.value[0]);
++	unsigned int right_val = (ucontrol->value.integer.value[1]);
++	int ret = 0;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++	if (glb_ptr->dual_mode == 1) {
++		ret = snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 0)->component, PCM512x_MUTE,
++				~((left_val & 0x01)<<4));
++		if (ret < 0)
++			return ret;
++		ret = snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 1)->component, PCM512x_MUTE,
++				~((right_val & 0x01)));
++		if (ret < 0)
++			return ret;
++
++	} else if (glb_ptr->set_mode == 1) {
++		ret = snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 0)->component, PCM512x_MUTE,
++				~((left_val & 0x01)<<4 | (right_val & 0x01)));
++		if (ret < 0)
++			return ret;
++
++	} else {
++		ret = snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 0)->component, PCM512x_MUTE,
++				~((left_val & 0x01)<<4 | (right_val & 0x01)));
++		if (ret < 0)
++			return ret;
++
++		ret = snd_soc_component_write(snd_soc_rtd_to_codec(rtd, 1)->component, PCM512x_MUTE,
++				~((left_val & 0x01)<<4 | (right_val & 0x01)));
++		if (ret < 0)
++			return ret;
++	}
++	return 1;
++}
++
++static const DECLARE_TLV_DB_SCALE(digital_tlv_sub, -10350, 50, 1);
++static const DECLARE_TLV_DB_SCALE(digital_tlv_master, -10350, 50, 1);
++
++static const struct snd_kcontrol_new allo_piano_controls[] = {
++	SOC_ENUM_EXT("Subwoofer mode Route",
++			allo_piano_mode_enum,
++			snd_allo_piano_mode_get,
++			snd_allo_piano_mode_put),
++
++	SOC_ENUM_EXT("Dual Mode Route",
++			allo_piano_dual_mode_enum,
++			snd_allo_piano_dual_mode_get,
++			snd_allo_piano_dual_mode_put),
++
++	SOC_ENUM_EXT("Lowpass Route", allo_piano_enum,
++			snd_allo_piano_lowpass_get,
++			snd_allo_piano_lowpass_put),
++
++	SOC_DOUBLE_R_EXT_TLV("Subwoofer Playback Volume",
++			PCM512x_DIGITAL_VOLUME_2,
++			PCM512x_DIGITAL_VOLUME_3, 0, 255, 1,
++			pcm512x_get_reg_sub,
++			pcm512x_set_reg_sub,
++			digital_tlv_sub),
++
++	SOC_DOUBLE_EXT("Subwoofer Playback Switch",
++			PCM512x_MUTE,
++			PCM512x_RQML_SHIFT,
++			PCM512x_RQMR_SHIFT, 1, 1,
++			pcm512x_get_reg_sub_switch,
++			pcm512x_set_reg_sub_switch),
++
++	SOC_DOUBLE_R_EXT_TLV("Master Playback Volume",
++			PCM512x_DIGITAL_VOLUME_2,
++			PCM512x_DIGITAL_VOLUME_3, 0, 255, 1,
++			pcm512x_get_reg_master,
++			pcm512x_set_reg_master,
++			digital_tlv_master),
++
++	SOC_DOUBLE_EXT("Master Playback Switch",
++			PCM512x_MUTE,
++			PCM512x_RQML_SHIFT,
++			PCM512x_RQMR_SHIFT, 1, 1,
++			pcm512x_get_reg_master_switch,
++			pcm512x_set_reg_master_switch),
++};
++
++static const char * const codec_ctl_pfx[] = { "Main", "Sub" };
++static const char * const codec_ctl_name[] = {
++	"Digital Playback Volume",
++	"Digital Playback Switch",
++	"Auto Mute Mono Switch",
++	"Auto Mute Switch",
++	"Auto Mute Time Left",
++	"Auto Mute Time Right",
++	"Clock Missing Period",
++	"Max Overclock DAC",
++	"Max Overclock DSP",
++	"Max Overclock PLL",
++	"Volume Ramp Down Emergency Rate",
++	"Volume Ramp Down Emergency Step",
++	"Volume Ramp Up Rate",
++	"Volume Ramp Down Rate",
++	"Volume Ramp Up Step",
++	"Volume Ramp Down Step"
++};
++
++static int snd_allo_piano_dac_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_card *card = rtd->card;
++	struct glb_pool *glb_ptr;
++	struct snd_kcontrol *kctl;
++	int i, j;
++
++	glb_ptr = kzalloc(sizeof(struct glb_pool), GFP_KERNEL);
++	if (!glb_ptr)
++		return -ENOMEM;
++
++	card->drvdata = glb_ptr;
++	glb_ptr->dual_mode = 2;
++	glb_ptr->set_mode = 0;
++
++	mutex_init(&glb_ptr->lock);
++
++	if (digital_gain_0db_limit) {
++		int ret;
++
++		//Set volume limit on both dacs
++		for (i = 0; i < ARRAY_SIZE(codec_ctl_pfx); i++) {
++			char cname[256];
++
++			sprintf(cname, "%s %s", codec_ctl_pfx[i], codec_ctl_name[0]);
++			ret = snd_soc_limit_volume(card, cname, 207);
++			if (ret < 0)
++				dev_warn(card->dev, "Failed to set volume limit: %d\n",
++					ret);
++		}
++	}
++
++	// Remove codec controls
++	for (i = 0; i < ARRAY_SIZE(codec_ctl_pfx); i++) {
++		for (j = 0; j < ARRAY_SIZE(codec_ctl_name); j++) {
++			char cname[256];
++
++			sprintf(cname, "%s %s", codec_ctl_pfx[i], codec_ctl_name[j]);
++			kctl = snd_soc_card_get_kcontrol(card, cname);
++			if (!kctl) {
++				dev_err(rtd->card->dev, "Control %s not found\n",
++				       cname);
++			} else {
++				kctl->vd[0].access =
++					SNDRV_CTL_ELEM_ACCESS_READWRITE;
++				snd_ctl_remove(card->snd_card, kctl);
++			}
++		}
++	}
++
++	return 0;
++}
++
++static void snd_allo_piano_gpio_mute(struct snd_soc_card *card)
++{
++	if (mute_gpio[0])
++		gpiod_set_value_cansleep(mute_gpio[0], P_MUTE);
++
++	if (mute_gpio[1])
++		gpiod_set_value_cansleep(mute_gpio[1], P_MUTE);
++}
++
++static void snd_allo_piano_gpio_unmute(struct snd_soc_card *card)
++{
++	if (mute_gpio[0])
++		gpiod_set_value_cansleep(mute_gpio[0], P_UNMUTE);
++
++	if (mute_gpio[1])
++		gpiod_set_value_cansleep(mute_gpio[1], P_UNMUTE);
++}
++
++static int snd_allo_piano_set_bias_level(struct snd_soc_card *card,
++	struct snd_soc_dapm_context *dapm, enum snd_soc_bias_level level)
++{
++	struct snd_soc_pcm_runtime *rtd;
++	struct snd_soc_dai *codec_dai;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++	codec_dai = snd_soc_rtd_to_codec(rtd, 0);
++
++	if (dapm->dev != codec_dai->dev)
++		return 0;
++
++	switch (level) {
++	case SND_SOC_BIAS_PREPARE:
++		if (dapm->bias_level != SND_SOC_BIAS_STANDBY)
++			break;
++		/* UNMUTE DAC */
++		snd_allo_piano_gpio_unmute(card);
++		break;
++
++	case SND_SOC_BIAS_STANDBY:
++		if (dapm->bias_level != SND_SOC_BIAS_PREPARE)
++			break;
++		/* MUTE DAC */
++		snd_allo_piano_gpio_mute(card);
++		break;
++
++	default:
++		break;
++	}
++
++	return 0;
++}
++
++static int snd_allo_piano_dac_startup(
++	struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_card *card = rtd->card;
++
++	snd_allo_piano_gpio_mute(card);
++
++	return 0;
++}
++
++static int snd_allo_piano_dac_hw_params(
++		struct snd_pcm_substream *substream,
++		struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	unsigned int rate = params_rate(params);
++	struct snd_soc_card *card = rtd->card;
++	struct glb_pool *glb_ptr = card->drvdata;
++	int ret = 0, val = 0, dac;
++
++	for (dac = 0; (glb_mclk && dac < 2); dac++) {
++		/* Configure the PLL clock reference for both the Codecs */
++		val = snd_soc_component_read(snd_soc_rtd_to_codec(rtd, dac)->component,
++					PCM512x_RATE_DET_4);
++
++		if (val & 0x40) {
++			snd_soc_component_write(snd_soc_rtd_to_codec(rtd, dac)->component,
++					PCM512x_PLL_REF,
++					PCM512x_SREF_BCK);
++
++			dev_info(snd_soc_rtd_to_codec(rtd, dac)->component->dev,
++				"Setting BCLK as input clock & Enable PLL\n");
++		} else {
++			snd_soc_component_write(snd_soc_rtd_to_codec(rtd, dac)->component,
++					PCM512x_PLL_EN,
++					0x00);
++
++			snd_soc_component_write(snd_soc_rtd_to_codec(rtd, dac)->component,
++					PCM512x_PLL_REF,
++					PCM512x_SREF_SCK);
++
++			dev_info(snd_soc_rtd_to_codec(rtd, dac)->component->dev,
++				"Setting SCLK as input clock & disabled PLL\n");
++		}
++	}
++
++	ret = snd_allo_piano_dsp_program(rtd, glb_ptr->set_mode, rate,
++						glb_ptr->set_lowpass);
++	if (ret < 0)
++		return ret;
++
++	return ret;
++}
++
++static int snd_allo_piano_dac_prepare(
++	struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_card *card = rtd->card;
++
++	snd_allo_piano_gpio_unmute(card);
++
++	return 0;
++}
++
++/* machine stream operations */
++static struct snd_soc_ops snd_allo_piano_dac_ops = {
++	.startup = snd_allo_piano_dac_startup,
++	.hw_params = snd_allo_piano_dac_hw_params,
++	.prepare = snd_allo_piano_dac_prepare,
++};
++
++static struct snd_soc_dai_link_component allo_piano_2_1_codecs[] = {
++	{
++		.dai_name = "pcm512x-hifi",
++	},
++	{
++		.dai_name = "pcm512x-hifi",
++	},
++};
++
++SND_SOC_DAILINK_DEFS(allo_piano_dai_plus,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm512x.1-004c", "pcm512x-hifi"),
++			   COMP_CODEC("pcm512x.1-004d", "pcm512x-hifi")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_allo_piano_dac_dai[] = {
++	{
++		.name		= "PianoDACPlus",
++		.stream_name	= "PianoDACPlus",
++		.dai_fmt	= SND_SOC_DAIFMT_I2S |
++				SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBS_CFS,
++		.ops		= &snd_allo_piano_dac_ops,
++		.init		= snd_allo_piano_dac_init,
++		SND_SOC_DAILINK_REG(allo_piano_dai_plus),
++	},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_allo_piano_dac = {
++	.name = "PianoDACPlus",
++	.owner = THIS_MODULE,
++	.dai_link = snd_allo_piano_dac_dai,
++	.num_links = ARRAY_SIZE(snd_allo_piano_dac_dai),
++	.controls = allo_piano_controls,
++	.num_controls = ARRAY_SIZE(allo_piano_controls),
++};
++
++static int snd_allo_piano_dac_probe(struct platform_device *pdev)
++{
++	struct snd_soc_card *card = &snd_allo_piano_dac;
++	int ret = 0, i = 0;
++
++	card->dev = &pdev->dev;
++	platform_set_drvdata(pdev, &snd_allo_piano_dac);
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai;
++
++		dai = &snd_allo_piano_dac_dai[0];
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++						"i2s-controller", 0);
++		if (i2s_node) {
++			for (i = 0; i < card->num_links; i++) {
++				dai->cpus->dai_name = NULL;
++				dai->cpus->of_node = i2s_node;
++				dai->platforms->name = NULL;
++				dai->platforms->of_node = i2s_node;
++			}
++		}
++		digital_gain_0db_limit =
++			!of_property_read_bool(pdev->dev.of_node,
++						"allo,24db_digital_gain");
++
++		glb_mclk = of_property_read_bool(pdev->dev.of_node,
++						"allo,glb_mclk");
++
++		allo_piano_2_1_codecs[0].of_node =
++			of_parse_phandle(pdev->dev.of_node, "audio-codec", 0);
++		if (!allo_piano_2_1_codecs[0].of_node) {
++			dev_err(&pdev->dev,
++				"Property 'audio-codec' missing or invalid\n");
++			return -EINVAL;
++		}
++
++		allo_piano_2_1_codecs[1].of_node =
++			of_parse_phandle(pdev->dev.of_node, "audio-codec", 1);
++		if (!allo_piano_2_1_codecs[1].of_node) {
++			dev_err(&pdev->dev,
++				"Property 'audio-codec' missing or invalid\n");
++			return -EINVAL;
++		}
++
++		mute_gpio[0] = devm_gpiod_get_optional(&pdev->dev, "mute1",
++							GPIOD_OUT_LOW);
++		if (IS_ERR(mute_gpio[0])) {
++			ret = PTR_ERR(mute_gpio[0]);
++			dev_err(&pdev->dev,
++				"failed to get mute1 gpio6: %d\n", ret);
++			return ret;
++		}
++
++		mute_gpio[1] = devm_gpiod_get_optional(&pdev->dev, "mute2",
++							GPIOD_OUT_LOW);
++		if (IS_ERR(mute_gpio[1])) {
++			ret = PTR_ERR(mute_gpio[1]);
++			dev_err(&pdev->dev,
++				"failed to get mute2 gpio25: %d\n", ret);
++			return ret;
++		}
++
++		if (mute_gpio[0] && mute_gpio[1])
++			snd_allo_piano_dac.set_bias_level =
++				snd_allo_piano_set_bias_level;
++
++		ret = snd_soc_register_card(&snd_allo_piano_dac);
++		if (ret < 0) {
++			dev_err(&pdev->dev,
++				"snd_soc_register_card() failed: %d\n", ret);
++			return ret;
++		}
++
++		if ((mute_gpio[0]) && (mute_gpio[1]))
++			snd_allo_piano_gpio_mute(&snd_allo_piano_dac);
++
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++static void snd_allo_piano_dac_remove(struct platform_device *pdev)
++{
++	struct snd_soc_card *card = platform_get_drvdata(pdev);
++
++	kfree(&card->drvdata);
++	snd_allo_piano_gpio_mute(&snd_allo_piano_dac);
++	snd_soc_unregister_card(&snd_allo_piano_dac);
++}
++
++static const struct of_device_id snd_allo_piano_dac_of_match[] = {
++	{ .compatible = "allo,piano-dac-plus", },
++	{ /* sentinel */ },
++};
++
++MODULE_DEVICE_TABLE(of, snd_allo_piano_dac_of_match);
++
++static struct platform_driver snd_allo_piano_dac_driver = {
++	.driver = {
++		.name = "snd-allo-piano-dac-plus",
++		.owner = THIS_MODULE,
++		.of_match_table = snd_allo_piano_dac_of_match,
++	},
++	.probe = snd_allo_piano_dac_probe,
++	.remove = snd_allo_piano_dac_remove,
++};
++
++module_platform_driver(snd_allo_piano_dac_driver);
++
++MODULE_AUTHOR("Baswaraj K <jaikumar@cem-solutions.net>");
++MODULE_DESCRIPTION("ALSA ASoC Machine Driver for Allo Piano DAC Plus");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/allo-piano-dac.c
+@@ -0,0 +1,122 @@
++/*
++ * ALSA ASoC Machine Driver for Allo Piano DAC
++ *
++ * Author:	Baswaraj K <jaikumar@cem-solutions.net>
++ *		Copyright 2016
++ *		based on code by Daniel Matuschek <info@crazy-audio.com>
++ *		based on code by Florian Meier <florian.meier@koalo.de>
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++
++static bool digital_gain_0db_limit = true;
++
++static int snd_allo_piano_dac_init(struct snd_soc_pcm_runtime *rtd)
++{
++	if (digital_gain_0db_limit) {
++		int ret;
++		struct snd_soc_card *card = rtd->card;
++
++		ret = snd_soc_limit_volume(card, "Digital Playback Volume",
++					   207);
++		if (ret < 0)
++			dev_warn(card->dev, "Failed to set volume limit: %d\n",
++				 ret);
++	}
++
++	return 0;
++}
++
++SND_SOC_DAILINK_DEFS(allo_piano_dai,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm512x.1-004c", "pcm512x-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_allo_piano_dac_dai[] = {
++{
++	.name		= "Piano DAC",
++	.stream_name	= "Piano DAC HiFi",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S |
++			  SND_SOC_DAIFMT_NB_NF |
++			  SND_SOC_DAIFMT_CBS_CFS,
++	.init		= snd_allo_piano_dac_init,
++	SND_SOC_DAILINK_REG(allo_piano_dai),
++},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_allo_piano_dac = {
++	.name         = "PianoDAC",
++	.owner        = THIS_MODULE,
++	.dai_link     = snd_allo_piano_dac_dai,
++	.num_links    = ARRAY_SIZE(snd_allo_piano_dac_dai),
++};
++
++static int snd_allo_piano_dac_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++
++	snd_allo_piano_dac.dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai;
++
++		dai = &snd_allo_piano_dac_dai[0];
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++					    "i2s-controller", 0);
++
++		if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++		}
++
++		digital_gain_0db_limit = !of_property_read_bool(
++			pdev->dev.of_node, "allo,24db_digital_gain");
++	}
++
++	ret = devm_snd_soc_register_card(&pdev->dev, &snd_allo_piano_dac);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev,
++			"snd_soc_register_card() failed: %d\n", ret);
++
++	return ret;
++}
++
++static const struct of_device_id snd_allo_piano_dac_of_match[] = {
++	{ .compatible = "allo,piano-dac", },
++	{ /* sentinel */ },
++};
++MODULE_DEVICE_TABLE(of, snd_allo_piano_dac_of_match);
++
++static struct platform_driver snd_allo_piano_dac_driver = {
++	.driver = {
++		.name   = "snd-allo-piano-dac",
++		.owner  = THIS_MODULE,
++		.of_match_table = snd_allo_piano_dac_of_match,
++	},
++	.probe          = snd_allo_piano_dac_probe,
++};
++
++module_platform_driver(snd_allo_piano_dac_driver);
++
++MODULE_AUTHOR("Baswaraj K <jaikumar@cem-solutions.net>");
++MODULE_DESCRIPTION("ALSA ASoC Machine Driver for Allo Piano DAC");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/audioinjector-isolated-soundcard.c
+@@ -0,0 +1,184 @@
++/*
++ * ASoC Driver for AudioInjector.net isolated soundcard
++ *
++ *  Created on: 20-February-2020
++ *      Author: flatmax@flatmax.org
++ *              based on audioinjector-octo-soundcard.c
++ *
++ * Copyright (C) 2020 Flatmax Pty. Ltd.
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/types.h>
++#include <linux/gpio/consumer.h>
++
++#include <sound/core.h>
++#include <sound/soc.h>
++#include <sound/pcm_params.h>
++#include <sound/control.h>
++
++static struct gpio_desc *mute_gpio;
++
++static const unsigned int audioinjector_isolated_rates[] = {
++	192000, 96000, 48000, 32000, 24000, 16000, 8000
++};
++
++static struct snd_pcm_hw_constraint_list audioinjector_isolated_constraints = {
++	.list = audioinjector_isolated_rates,
++	.count = ARRAY_SIZE(audioinjector_isolated_rates),
++};
++
++static int audioinjector_isolated_dai_init(struct snd_soc_pcm_runtime *rtd)
++{
++	int ret=snd_soc_dai_set_sysclk(snd_soc_rtd_to_codec(rtd, 0), 0, 24576000, 0);
++	if (ret)
++		return ret;
++
++	return snd_soc_dai_set_bclk_ratio(snd_soc_rtd_to_cpu(rtd, 0), 64);
++}
++
++static int audioinjector_isolated_startup(struct snd_pcm_substream *substream)
++{
++	snd_pcm_hw_constraint_list(substream->runtime, 0,
++				SNDRV_PCM_HW_PARAM_RATE, &audioinjector_isolated_constraints);
++
++	return 0;
++}
++
++static int audioinjector_isolated_trigger(struct snd_pcm_substream *substream,
++								int cmd){
++
++	switch (cmd) {
++	case SNDRV_PCM_TRIGGER_STOP:
++	case SNDRV_PCM_TRIGGER_SUSPEND:
++	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
++		gpiod_set_value(mute_gpio, 0);
++		break;
++	case SNDRV_PCM_TRIGGER_START:
++	case SNDRV_PCM_TRIGGER_RESUME:
++	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
++		gpiod_set_value(mute_gpio, 1);
++		break;
++	default:
++		return -EINVAL;
++	}
++	return 0;
++}
++
++static struct snd_soc_ops audioinjector_isolated_ops = {
++	.startup	= audioinjector_isolated_startup,
++	.trigger = audioinjector_isolated_trigger,
++};
++
++SND_SOC_DAILINK_DEFS(audioinjector_isolated,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("cs4271.1-0010", "cs4271-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link audioinjector_isolated_dai[] = {
++	{
++		.name = "AudioInjector ISO",
++		.stream_name = "AI-HIFI",
++		.ops = &audioinjector_isolated_ops,
++		.init = audioinjector_isolated_dai_init,
++		.symmetric_rate = 1,
++		.symmetric_channels = 1,
++		.dai_fmt = SND_SOC_DAIFMT_CBM_CFM|SND_SOC_DAIFMT_I2S|SND_SOC_DAIFMT_NB_NF,
++		SND_SOC_DAILINK_REG(audioinjector_isolated),
++	}
++};
++
++static const struct snd_soc_dapm_widget audioinjector_isolated_widgets[] = {
++	SND_SOC_DAPM_OUTPUT("OUTPUTS"),
++	SND_SOC_DAPM_INPUT("INPUTS"),
++};
++
++static const struct snd_soc_dapm_route audioinjector_isolated_route[] = {
++	/* Balanced outputs */
++	{"OUTPUTS", NULL, "AOUTA+"},
++	{"OUTPUTS", NULL, "AOUTA-"},
++	{"OUTPUTS", NULL, "AOUTB+"},
++	{"OUTPUTS", NULL, "AOUTB-"},
++
++	/* Balanced inputs */
++	{"AINA", NULL, "INPUTS"},
++	{"AINB", NULL, "INPUTS"},
++};
++
++static struct snd_soc_card snd_soc_audioinjector_isolated = {
++	.name = "audioinjector-isolated-soundcard",
++	.owner = THIS_MODULE,
++	.dai_link = audioinjector_isolated_dai,
++	.num_links = ARRAY_SIZE(audioinjector_isolated_dai),
++
++	.dapm_widgets = audioinjector_isolated_widgets,
++	.num_dapm_widgets = ARRAY_SIZE(audioinjector_isolated_widgets),
++	.dapm_routes = audioinjector_isolated_route,
++	.num_dapm_routes = ARRAY_SIZE(audioinjector_isolated_route),
++};
++
++static int audioinjector_isolated_probe(struct platform_device *pdev)
++{
++	struct snd_soc_card *card = &snd_soc_audioinjector_isolated;
++	int ret;
++
++	card->dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct snd_soc_dai_link *dai = &audioinjector_isolated_dai[0];
++		struct device_node *i2s_node =
++					of_parse_phandle(pdev->dev.of_node, "i2s-controller", 0);
++
++		if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++		} else {
++				dev_err(&pdev->dev,
++				"i2s-controller missing or invalid in DT\n");
++				return -EINVAL;
++		}
++
++		mute_gpio = devm_gpiod_get_optional(&pdev->dev, "mute", GPIOD_OUT_LOW);
++		if (IS_ERR(mute_gpio)){
++			dev_err(&pdev->dev, "mute gpio not found in dt overlay\n");
++			return PTR_ERR(mute_gpio);
++		}
++	}
++
++	ret = devm_snd_soc_register_card(&pdev->dev, card);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev, "snd_soc_register_card failed (%d)\n", ret);
++	return ret;
++}
++
++static const struct of_device_id audioinjector_isolated_of_match[] = {
++	{ .compatible = "ai,audioinjector-isolated-soundcard", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, audioinjector_isolated_of_match);
++
++static struct platform_driver audioinjector_isolated_driver = {
++	.driver	= {
++		.name			= "audioinjector-isolated",
++		.owner			= THIS_MODULE,
++		.of_match_table = audioinjector_isolated_of_match,
++	},
++	.probe	= audioinjector_isolated_probe,
++};
++
++module_platform_driver(audioinjector_isolated_driver);
++MODULE_AUTHOR("Matt Flax <flatmax@flatmax.org>");
++MODULE_DESCRIPTION("AudioInjector.net isolated Soundcard");
++MODULE_LICENSE("GPL v2");
++MODULE_ALIAS("platform:audioinjector-isolated-soundcard");
+--- /dev/null
++++ b/sound/soc/bcm/audioinjector-octo-soundcard.c
+@@ -0,0 +1,347 @@
++/*
++ * ASoC Driver for AudioInjector Pi octo channel soundcard (hat)
++ *
++ *  Created on: 27-October-2016
++ *      Author: flatmax@flatmax.org
++ *              based on audioinjector-pi-soundcard.c
++ *
++ * Copyright (C) 2016 Flatmax Pty. Ltd.
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/types.h>
++#include <linux/gpio/consumer.h>
++
++#include <sound/core.h>
++#include <sound/soc.h>
++#include <sound/pcm_params.h>
++#include <sound/control.h>
++
++static struct gpio_descs *mult_gpios;
++static struct gpio_desc *codec_rst_gpio;
++static unsigned int audioinjector_octo_rate;
++static bool non_stop_clocks;
++
++static const unsigned int audioinjector_octo_rates[] = {
++	96000, 48000, 32000, 24000, 16000, 8000, 88200, 44100, 29400, 22050, 14700,
++};
++
++static struct snd_pcm_hw_constraint_list audioinjector_octo_constraints = {
++	.list = audioinjector_octo_rates,
++	.count = ARRAY_SIZE(audioinjector_octo_rates),
++};
++
++static int audioinjector_octo_dai_init(struct snd_soc_pcm_runtime *rtd)
++{
++	return snd_soc_dai_set_bclk_ratio(snd_soc_rtd_to_cpu(rtd, 0), 64);
++}
++
++static int audioinjector_octo_startup(struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	snd_soc_rtd_to_cpu(rtd, 0)->driver->playback.channels_min = 8;
++	snd_soc_rtd_to_cpu(rtd, 0)->driver->playback.channels_max = 8;
++	snd_soc_rtd_to_cpu(rtd, 0)->driver->capture.channels_min = 8;
++	snd_soc_rtd_to_cpu(rtd, 0)->driver->capture.channels_max = 8;
++	snd_soc_rtd_to_codec(rtd, 0)->driver->capture.channels_max = 8;
++
++	snd_pcm_hw_constraint_list(substream->runtime, 0,
++				SNDRV_PCM_HW_PARAM_RATE,
++				&audioinjector_octo_constraints);
++
++	return 0;
++}
++
++static void audioinjector_octo_shutdown(struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	snd_soc_rtd_to_cpu(rtd, 0)->driver->playback.channels_min = 2;
++	snd_soc_rtd_to_cpu(rtd, 0)->driver->playback.channels_max = 2;
++	snd_soc_rtd_to_cpu(rtd, 0)->driver->capture.channels_min = 2;
++	snd_soc_rtd_to_cpu(rtd, 0)->driver->capture.channels_max = 2;
++	snd_soc_rtd_to_codec(rtd, 0)->driver->capture.channels_max = 6;
++}
++
++static int audioinjector_octo_hw_params(struct snd_pcm_substream *substream,
++	struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++
++	// set codec DAI configuration
++	int ret = snd_soc_dai_set_fmt(snd_soc_rtd_to_codec(rtd, 0),
++			SND_SOC_DAIFMT_CBS_CFS|SND_SOC_DAIFMT_DSP_A|
++			SND_SOC_DAIFMT_NB_NF);
++	if (ret < 0)
++		return ret;
++
++	// set cpu DAI configuration
++	ret = snd_soc_dai_set_fmt(snd_soc_rtd_to_cpu(rtd, 0),
++			SND_SOC_DAIFMT_CBM_CFM|SND_SOC_DAIFMT_I2S|
++			SND_SOC_DAIFMT_NB_NF);
++	if (ret < 0)
++		return ret;
++
++	audioinjector_octo_rate = params_rate(params);
++
++	// Set the correct sysclock for the codec
++	switch (audioinjector_octo_rate) {
++	case 96000:
++	case 48000:
++		return snd_soc_dai_set_sysclk(snd_soc_rtd_to_codec(rtd, 0), 0, 49152000,
++									0);
++		break;
++	case 24000:
++		return snd_soc_dai_set_sysclk(snd_soc_rtd_to_codec(rtd, 0), 0, 49152000/2,
++									0);
++		break;
++	case 32000:
++	case 16000:
++		return snd_soc_dai_set_sysclk(snd_soc_rtd_to_codec(rtd, 0), 0, 49152000/3,
++									0);
++		break;
++	case 8000:
++		return snd_soc_dai_set_sysclk(snd_soc_rtd_to_codec(rtd, 0), 0, 49152000/6,
++									0);
++		break;
++	case 88200:
++	case 44100:
++		return snd_soc_dai_set_sysclk(snd_soc_rtd_to_codec(rtd, 0), 0, 45185400,
++									0);
++		break;
++	case 22050:
++		return snd_soc_dai_set_sysclk(snd_soc_rtd_to_codec(rtd, 0), 0, 45185400/2,
++									0);
++		break;
++	case 29400:
++	case 14700:
++		return snd_soc_dai_set_sysclk(snd_soc_rtd_to_codec(rtd, 0), 0, 45185400/3,
++									0);
++		break;
++	default:
++		return -EINVAL;
++	}
++}
++
++static int audioinjector_octo_trigger(struct snd_pcm_substream *substream,
++								int cmd){
++	DECLARE_BITMAP(mult, 4);
++
++	memset(mult, 0, sizeof(mult));
++
++	switch (cmd) {
++	case SNDRV_PCM_TRIGGER_STOP:
++	case SNDRV_PCM_TRIGGER_SUSPEND:
++	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
++		if (!non_stop_clocks)
++			break;
++		fallthrough;
++	case SNDRV_PCM_TRIGGER_START:
++	case SNDRV_PCM_TRIGGER_RESUME:
++	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
++		switch (audioinjector_octo_rate) {
++		case 96000:
++			__assign_bit(3, mult, 1);
++			fallthrough;
++		case 88200:
++			__assign_bit(1, mult, 1);
++			__assign_bit(2, mult, 1);
++			break;
++		case 48000:
++			__assign_bit(3, mult, 1);
++			fallthrough;
++		case 44100:
++			__assign_bit(2, mult, 1);
++			break;
++		case 32000:
++			__assign_bit(3, mult, 1);
++			fallthrough;
++		case 29400:
++			__assign_bit(0, mult, 1);
++			__assign_bit(1, mult, 1);
++			break;
++		case 24000:
++			__assign_bit(3, mult, 1);
++			fallthrough;
++		case 22050:
++			__assign_bit(1, mult, 1);
++			break;
++		case 16000:
++			__assign_bit(3, mult, 1);
++			fallthrough;
++		case 14700:
++			__assign_bit(0, mult, 1);
++			break;
++		case 8000:
++			__assign_bit(3, mult, 1);
++			break;
++		default:
++			return -EINVAL;
++		}
++		break;
++	default:
++		return -EINVAL;
++	}
++	gpiod_set_array_value_cansleep(mult_gpios->ndescs, mult_gpios->desc,
++				       NULL, mult);
++
++	return 0;
++}
++
++static struct snd_soc_ops audioinjector_octo_ops = {
++	.startup	= audioinjector_octo_startup,
++	.shutdown	= audioinjector_octo_shutdown,
++	.hw_params = audioinjector_octo_hw_params,
++	.trigger = audioinjector_octo_trigger,
++};
++
++SND_SOC_DAILINK_DEFS(audioinjector_octo,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC(NULL, "cs42448")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link audioinjector_octo_dai[] = {
++	{
++		.name = "AudioInjector Octo",
++		.stream_name = "AudioInject-HIFI",
++		.ops = &audioinjector_octo_ops,
++		.init = audioinjector_octo_dai_init,
++		.symmetric_rate = 1,
++		.symmetric_channels = 1,
++		SND_SOC_DAILINK_REG(audioinjector_octo),
++	},
++};
++
++static const struct snd_soc_dapm_widget audioinjector_octo_widgets[] = {
++	SND_SOC_DAPM_OUTPUT("OUTPUTS0"),
++	SND_SOC_DAPM_OUTPUT("OUTPUTS1"),
++	SND_SOC_DAPM_OUTPUT("OUTPUTS2"),
++	SND_SOC_DAPM_OUTPUT("OUTPUTS3"),
++	SND_SOC_DAPM_INPUT("INPUTS0"),
++	SND_SOC_DAPM_INPUT("INPUTS1"),
++	SND_SOC_DAPM_INPUT("INPUTS2"),
++};
++
++static const struct snd_soc_dapm_route audioinjector_octo_route[] = {
++	/* Balanced outputs */
++	{"OUTPUTS0", NULL, "AOUT1L"},
++	{"OUTPUTS0", NULL, "AOUT1R"},
++	{"OUTPUTS1", NULL, "AOUT2L"},
++	{"OUTPUTS1", NULL, "AOUT2R"},
++	{"OUTPUTS2", NULL, "AOUT3L"},
++	{"OUTPUTS2", NULL, "AOUT3R"},
++	{"OUTPUTS3", NULL, "AOUT4L"},
++	{"OUTPUTS3", NULL, "AOUT4R"},
++
++	/* Balanced inputs */
++	{"AIN1L", NULL, "INPUTS0"},
++	{"AIN1R", NULL, "INPUTS0"},
++	{"AIN2L", NULL, "INPUTS1"},
++	{"AIN2R", NULL, "INPUTS1"},
++	{"AIN3L", NULL, "INPUTS2"},
++	{"AIN3R", NULL, "INPUTS2"},
++};
++
++static struct snd_soc_card snd_soc_audioinjector_octo = {
++	.name = "audioinjector-octo-soundcard",
++	.owner = THIS_MODULE,
++	.dai_link = audioinjector_octo_dai,
++	.num_links = ARRAY_SIZE(audioinjector_octo_dai),
++
++	.dapm_widgets = audioinjector_octo_widgets,
++	.num_dapm_widgets = ARRAY_SIZE(audioinjector_octo_widgets),
++	.dapm_routes = audioinjector_octo_route,
++	.num_dapm_routes = ARRAY_SIZE(audioinjector_octo_route),
++};
++
++static int audioinjector_octo_probe(struct platform_device *pdev)
++{
++	struct snd_soc_card *card = &snd_soc_audioinjector_octo;
++	int ret;
++
++	card->dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct snd_soc_dai_link *dai = &audioinjector_octo_dai[0];
++		struct device_node *i2s_node =
++					of_parse_phandle(pdev->dev.of_node,
++							"i2s-controller", 0);
++		struct device_node *codec_node =
++					of_parse_phandle(pdev->dev.of_node,
++								"codec", 0);
++
++		mult_gpios = devm_gpiod_get_array_optional(&pdev->dev, "mult",
++								GPIOD_OUT_LOW);
++		if (IS_ERR(mult_gpios))
++			return PTR_ERR(mult_gpios);
++
++		codec_rst_gpio = devm_gpiod_get_optional(&pdev->dev, "reset",
++								GPIOD_OUT_LOW);
++		if (IS_ERR(codec_rst_gpio))
++			return PTR_ERR(codec_rst_gpio);
++
++		non_stop_clocks = of_property_read_bool(pdev->dev.of_node, "non-stop-clocks");
++
++		if (codec_rst_gpio)
++			gpiod_set_value(codec_rst_gpio, 1);
++		msleep(500);
++		if (codec_rst_gpio)
++			gpiod_set_value(codec_rst_gpio, 0);
++		msleep(500);
++		if (codec_rst_gpio)
++			gpiod_set_value(codec_rst_gpio, 1);
++		msleep(500);
++
++		if (i2s_node && codec_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++			dai->codecs->name = NULL;
++			dai->codecs->of_node = codec_node;
++		} else
++			if (!i2s_node) {
++				dev_err(&pdev->dev,
++				"i2s-controller missing or invalid in DT\n");
++				return -EINVAL;
++			} else {
++				dev_err(&pdev->dev,
++				"Property 'codec' missing or invalid\n");
++				return -EINVAL;
++			}
++	}
++
++	ret = devm_snd_soc_register_card(&pdev->dev, card);
++	if (ret != 0)
++		dev_err(&pdev->dev, "snd_soc_register_card failed (%d)\n", ret);
++	return ret;
++}
++
++static const struct of_device_id audioinjector_octo_of_match[] = {
++	{ .compatible = "ai,audioinjector-octo-soundcard", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, audioinjector_octo_of_match);
++
++static struct platform_driver audioinjector_octo_driver = {
++	.driver	= {
++		.name			= "audioinjector-octo",
++		.owner			= THIS_MODULE,
++		.of_match_table = audioinjector_octo_of_match,
++	},
++	.probe	= audioinjector_octo_probe,
++};
++
++module_platform_driver(audioinjector_octo_driver);
++MODULE_AUTHOR("Matt Flax <flatmax@flatmax.org>");
++MODULE_DESCRIPTION("AudioInjector.net octo Soundcard");
++MODULE_LICENSE("GPL v2");
++MODULE_ALIAS("platform:audioinjector-octo-soundcard");
+--- /dev/null
++++ b/sound/soc/bcm/audioinjector-pi-soundcard.c
+@@ -0,0 +1,190 @@
++/*
++ * ASoC Driver for AudioInjector Pi add on soundcard
++ *
++ *  Created on: 13-May-2016
++ *      Author: flatmax@flatmax.org
++ *              based on code by  Cliff Cai <Cliff.Cai@analog.com> for the ssm2602 machine blackfin.
++ *              with help from Lars-Peter Clausen for simplifying the original code to use the dai_fmt field.
++ *		i2s_node code taken from the other sound/soc/bcm machine drivers.
++ *
++ * Copyright (C) 2016 Flatmax Pty. Ltd.
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/types.h>
++
++#include <sound/core.h>
++#include <sound/soc.h>
++#include <sound/pcm_params.h>
++#include <sound/control.h>
++
++#include "../codecs/wm8731.h"
++
++static const unsigned int bcm2835_rates_12000000[] = {
++	8000, 16000, 32000, 44100, 48000, 96000, 88200,
++};
++
++static struct snd_pcm_hw_constraint_list bcm2835_constraints_12000000 = {
++	.list = bcm2835_rates_12000000,
++	.count = ARRAY_SIZE(bcm2835_rates_12000000),
++};
++
++static int snd_audioinjector_pi_soundcard_startup(struct snd_pcm_substream *substream)
++{
++	/* Setup constraints, because there is a 12 MHz XTAL on the board */
++	snd_pcm_hw_constraint_list(substream->runtime, 0,
++				SNDRV_PCM_HW_PARAM_RATE,
++				&bcm2835_constraints_12000000);
++	return 0;
++}
++
++static int snd_audioinjector_pi_soundcard_hw_params(struct snd_pcm_substream *substream,
++				       struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
++
++	switch (params_rate(params)){
++		case 8000:
++			return snd_soc_dai_set_bclk_ratio(cpu_dai, 1);
++		case 16000:
++			return snd_soc_dai_set_bclk_ratio(cpu_dai, 750);
++		case 32000:
++			return snd_soc_dai_set_bclk_ratio(cpu_dai, 375);
++		case 44100:
++			return snd_soc_dai_set_bclk_ratio(cpu_dai, 272);
++		case 48000:
++			return snd_soc_dai_set_bclk_ratio(cpu_dai, 250);
++		case 88200:
++			return snd_soc_dai_set_bclk_ratio(cpu_dai, 136);
++		case 96000:
++			return snd_soc_dai_set_bclk_ratio(cpu_dai, 125);
++		default:
++			return snd_soc_dai_set_bclk_ratio(cpu_dai, 125);
++	}
++}
++
++/* machine stream operations */
++static struct snd_soc_ops snd_audioinjector_pi_soundcard_ops = {
++	.startup = snd_audioinjector_pi_soundcard_startup,
++	.hw_params = snd_audioinjector_pi_soundcard_hw_params,
++};
++
++static int audioinjector_pi_soundcard_dai_init(struct snd_soc_pcm_runtime *rtd)
++{
++	return snd_soc_dai_set_sysclk(snd_soc_rtd_to_codec(rtd, 0), WM8731_SYSCLK_XTAL, 12000000, SND_SOC_CLOCK_IN);
++}
++
++SND_SOC_DAILINK_DEFS(audioinjector_pi,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("wm8731.1-001a", "wm8731-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2835-i2s.0")));
++
++static struct snd_soc_dai_link audioinjector_pi_soundcard_dai[] = {
++	{
++		.name = "AudioInjector audio",
++		.stream_name = "AudioInjector audio",
++		.ops = &snd_audioinjector_pi_soundcard_ops,
++		.init = audioinjector_pi_soundcard_dai_init,
++		.dai_fmt = SND_SOC_DAIFMT_CBM_CFM|SND_SOC_DAIFMT_I2S|SND_SOC_DAIFMT_NB_NF,
++		SND_SOC_DAILINK_REG(audioinjector_pi),
++	},
++};
++
++static const struct snd_soc_dapm_widget wm8731_dapm_widgets[] = {
++	SND_SOC_DAPM_HP("Headphone Jack", NULL),
++	SND_SOC_DAPM_SPK("Ext Spk", NULL),
++	SND_SOC_DAPM_LINE("Line In Jacks", NULL),
++	SND_SOC_DAPM_MIC("Microphone", NULL),
++};
++
++static const struct snd_soc_dapm_route audioinjector_audio_map[] = {
++	/* headphone connected to LHPOUT, RHPOUT */
++	{"Headphone Jack", NULL, "LHPOUT"},
++	{"Headphone Jack", NULL, "RHPOUT"},
++
++	/* speaker connected to LOUT, ROUT */
++	{"Ext Spk", NULL, "ROUT"},
++	{"Ext Spk", NULL, "LOUT"},
++
++	/* line inputs */
++	{"Line In Jacks", NULL, "Line Input"},
++
++	/* mic is connected to Mic Jack, with WM8731 Mic Bias */
++	{"Microphone", NULL, "Mic Bias"},
++};
++
++static struct snd_soc_card snd_soc_audioinjector = {
++	.name = "audioinjector-pi-soundcard",
++	.owner = THIS_MODULE,
++	.dai_link = audioinjector_pi_soundcard_dai,
++	.num_links = ARRAY_SIZE(audioinjector_pi_soundcard_dai),
++
++	.dapm_widgets = wm8731_dapm_widgets,
++	.num_dapm_widgets = ARRAY_SIZE(wm8731_dapm_widgets),
++	.dapm_routes = audioinjector_audio_map,
++	.num_dapm_routes = ARRAY_SIZE(audioinjector_audio_map),
++};
++
++static int audioinjector_pi_soundcard_probe(struct platform_device *pdev)
++{
++	struct snd_soc_card *card = &snd_soc_audioinjector;
++	int ret;
++	
++	card->dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct snd_soc_dai_link *dai = &audioinjector_pi_soundcard_dai[0];
++		struct device_node *i2s_node = of_parse_phandle(pdev->dev.of_node,
++								"i2s-controller", 0);
++
++		if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++		} else
++			if (!dai->cpus->of_node) {
++				dev_err(&pdev->dev, "Property 'i2s-controller' missing or invalid\n");
++				return -EINVAL;
++			}
++	}
++
++	if ((ret = devm_snd_soc_register_card(&pdev->dev, card)))
++		return dev_err_probe(&pdev->dev, ret, "%s\n", __func__);
++
++	dev_info(&pdev->dev, "successfully loaded\n");
++
++	return ret;
++}
++
++static const struct of_device_id audioinjector_pi_soundcard_of_match[] = {
++	{ .compatible = "ai,audioinjector-pi-soundcard", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, audioinjector_pi_soundcard_of_match);
++
++static struct platform_driver audioinjector_pi_soundcard_driver = {
++       .driver         = {
++		.name   = "audioinjector-stereo",
++		.owner  = THIS_MODULE,
++		.of_match_table = audioinjector_pi_soundcard_of_match,
++       },
++       .probe          = audioinjector_pi_soundcard_probe,
++};
++
++module_platform_driver(audioinjector_pi_soundcard_driver);
++MODULE_AUTHOR("Matt Flax <flatmax@flatmax.org>");
++MODULE_DESCRIPTION("AudioInjector.net Pi Soundcard");
++MODULE_LICENSE("GPL v2");
++MODULE_ALIAS("platform:audioinjector-pi-soundcard");
++
+--- /dev/null
++++ b/sound/soc/bcm/audiosense-pi.c
+@@ -0,0 +1,247 @@
++/*
++ * ASoC Driver for AudioSense add on soundcard
++ * Author:
++ *	Bhargav A K <anur.bhargav@gmail.com>
++ *	Copyright 2017
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/clk.h>
++#include <linux/i2c.h>
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++#include <sound/control.h>
++
++#include <sound/tlv320aic32x4.h>
++#include "../codecs/tlv320aic32x4.h"
++
++#define AIC32X4_SYSCLK_XTAL	0x00
++
++/*
++ * Setup Codec Sample Rates and Channels
++ * Supported Rates:
++ *	8000, 11025, 16000, 22050, 32000, 44100, 48000, 64000, 88200, 96000,
++ */
++static const unsigned int audiosense_pi_rate[] = {
++	48000,
++};
++
++static struct snd_pcm_hw_constraint_list audiosense_constraints_rates = {
++	.list = audiosense_pi_rate,
++	.count = ARRAY_SIZE(audiosense_pi_rate),
++};
++
++static const unsigned int audiosense_pi_channels[] = {
++	2,
++};
++
++static struct snd_pcm_hw_constraint_list audiosense_constraints_ch = {
++	.count = ARRAY_SIZE(audiosense_pi_channels),
++	.list = audiosense_pi_channels,
++	.mask = 0,
++};
++
++/* Setup DAPM widgets and paths */
++static const struct snd_soc_dapm_widget audiosense_pi_dapm_widgets[] = {
++	SND_SOC_DAPM_HP("Headphone Jack", NULL),
++	SND_SOC_DAPM_LINE("Line Out", NULL),
++	SND_SOC_DAPM_LINE("Line In", NULL),
++	SND_SOC_DAPM_INPUT("CM_L"),
++	SND_SOC_DAPM_INPUT("CM_R"),
++};
++
++static const struct snd_soc_dapm_route audiosense_pi_audio_map[] = {
++	/* Line Inputs are connected to
++	 * (IN1_L | IN1_R)
++	 * (IN2_L | IN2_R)
++	 * (IN3_L | IN3_R)
++	 */
++	{"IN1_L", NULL, "Line In"},
++	{"IN1_R", NULL, "Line In"},
++	{"IN2_L", NULL, "Line In"},
++	{"IN2_R", NULL, "Line In"},
++	{"IN3_L", NULL, "Line In"},
++	{"IN3_R", NULL, "Line In"},
++
++	/* Mic is connected to IN2_L and IN2_R */
++	{"Left ADC", NULL, "Mic Bias"},
++	{"Right ADC", NULL, "Mic Bias"},
++
++	/* Headphone connected to HPL, HPR */
++	{"Headphone Jack", NULL, "HPL"},
++	{"Headphone Jack", NULL, "HPR"},
++
++	/* Speakers connected to LOL and LOR */
++	{"Line Out", NULL, "LOL"},
++	{"Line Out", NULL, "LOR"},
++};
++
++static int audiosense_pi_card_init(struct snd_soc_pcm_runtime *rtd)
++{
++	/* TODO: init of the codec specific dapm data, ignore suspend/resume */
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++
++	snd_soc_component_update_bits(component, AIC32X4_MICBIAS, 0x78,
++				      AIC32X4_MICBIAS_LDOIN |
++				      AIC32X4_MICBIAS_2075V);
++	snd_soc_component_update_bits(component, AIC32X4_PWRCFG, 0x08,
++				      AIC32X4_AVDDWEAKDISABLE);
++	snd_soc_component_update_bits(component, AIC32X4_LDOCTL, 0x01,
++				      AIC32X4_LDOCTLEN);
++
++	return 0;
++}
++
++static int audiosense_pi_card_hw_params(
++		struct snd_pcm_substream *substream,
++		struct snd_pcm_hw_params *params)
++{
++	int ret = 0;
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_dai *codec_dai = snd_soc_rtd_to_codec(rtd, 0);
++
++	/* Set the codec system clock, there is a 12 MHz XTAL on the board */
++	ret = snd_soc_dai_set_sysclk(codec_dai, AIC32X4_SYSCLK_XTAL,
++				     12000000, SND_SOC_CLOCK_IN);
++	if (ret) {
++		dev_err(rtd->card->dev,
++			"could not set codec driver clock params\n");
++		return ret;
++	}
++	return 0;
++}
++
++static int audiosense_pi_card_startup(struct snd_pcm_substream *substream)
++{
++	struct snd_pcm_runtime *runtime = substream->runtime;
++
++	/*
++	 * Set codec to 48Khz Sampling, Stereo I/O and 16 bit audio
++	 */
++	runtime->hw.channels_max = 2;
++	snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS,
++				   &audiosense_constraints_ch);
++
++	runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE;
++	snd_pcm_hw_constraint_msbits(runtime, 0, 16, 16);
++
++
++	snd_pcm_hw_constraint_list(substream->runtime, 0,
++				   SNDRV_PCM_HW_PARAM_RATE,
++				   &audiosense_constraints_rates);
++	return 0;
++}
++
++static struct snd_soc_ops audiosense_pi_card_ops = {
++	.startup = audiosense_pi_card_startup,
++	.hw_params = audiosense_pi_card_hw_params,
++};
++
++SND_SOC_DAILINK_DEFS(audiosense_pi,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("tlv320aic32x4.1-0018", "tlv320aic32x4-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link audiosense_pi_card_dai[] = {
++	{
++		.name           = "TLV320AIC3204 Audio",
++		.stream_name    = "TLV320AIC3204 Hifi Audio",
++		.dai_fmt        = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++			SND_SOC_DAIFMT_CBM_CFM,
++		.ops            = &audiosense_pi_card_ops,
++		.init           = audiosense_pi_card_init,
++		SND_SOC_DAILINK_REG(audiosense_pi),
++	},
++};
++
++static struct snd_soc_card audiosense_pi_card = {
++	.name		= "audiosense-pi",
++	.driver_name	= "audiosense-pi",
++	.dai_link	= audiosense_pi_card_dai,
++	.owner		= THIS_MODULE,
++	.num_links	= ARRAY_SIZE(audiosense_pi_card_dai),
++	.dapm_widgets	= audiosense_pi_dapm_widgets,
++	.num_dapm_widgets = ARRAY_SIZE(audiosense_pi_dapm_widgets),
++	.dapm_routes	= audiosense_pi_audio_map,
++	.num_dapm_routes = ARRAY_SIZE(audiosense_pi_audio_map),
++};
++
++static int audiosense_pi_card_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++	struct snd_soc_card *card = &audiosense_pi_card;
++	struct snd_soc_dai_link *dai = &audiosense_pi_card_dai[0];
++	struct device_node *i2s_node = pdev->dev.of_node;
++
++	card->dev = &pdev->dev;
++
++	if (!dai) {
++		dev_err(&pdev->dev, "DAI not found. Missing or Invalid\n");
++		return -EINVAL;
++	}
++
++	i2s_node = of_parse_phandle(pdev->dev.of_node, "i2s-controller", 0);
++	if (!i2s_node) {
++		dev_err(&pdev->dev,
++			"Property 'i2s-controller' missing or invalid\n");
++		return -EINVAL;
++	}
++
++	dai->cpus->dai_name = NULL;
++	dai->cpus->of_node = i2s_node;
++	dai->platforms->name = NULL;
++	dai->platforms->of_node = i2s_node;
++
++	of_node_put(i2s_node);
++
++	ret = snd_soc_register_card(card);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev,
++			"snd_soc_register_card() failed: %d\n", ret);
++
++	return ret;
++}
++
++static void audiosense_pi_card_remove(struct platform_device *pdev)
++{
++	struct snd_soc_card *card = platform_get_drvdata(pdev);
++
++	snd_soc_unregister_card(card);
++}
++
++static const struct of_device_id audiosense_pi_card_of_match[] = {
++	{ .compatible = "as,audiosense-pi", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, audiosense_pi_card_of_match);
++
++static struct platform_driver audiosense_pi_card_driver = {
++	.driver = {
++		.name = "audiosense-snd-card",
++		.owner = THIS_MODULE,
++		.of_match_table = audiosense_pi_card_of_match,
++	},
++	.probe = audiosense_pi_card_probe,
++	.remove = audiosense_pi_card_remove,
++};
++
++module_platform_driver(audiosense_pi_card_driver);
++
++MODULE_AUTHOR("Bhargav AK <anur.bhargav@gmail.com>");
++MODULE_DESCRIPTION("ASoC Driver for TLV320AIC3204 Audio");
++MODULE_LICENSE("GPL v2");
++MODULE_ALIAS("platform:audiosense-pi");
++
+--- a/sound/soc/bcm/bcm2835-i2s.c
++++ b/sound/soc/bcm/bcm2835-i2s.c
+@@ -30,7 +30,6 @@
+ #include <linux/init.h>
+ #include <linux/io.h>
+ #include <linux/module.h>
+-#include <linux/of_address.h>
+ #include <linux/slab.h>
+ 
+ #include <sound/core.h>
+@@ -620,6 +619,10 @@ static int bcm2835_i2s_prepare(struct sn
+ 	struct bcm2835_i2s_dev *dev = snd_soc_dai_get_drvdata(dai);
+ 	uint32_t cs_reg;
+ 
++	snd_pcm_hw_constraint_minmax(substream->runtime,
++		SNDRV_PCM_HW_PARAM_PERIOD_BYTES, 256,
++					~0);
++
+ 	/*
+ 	 * Clear both FIFOs if the one that should be started
+ 	 * is not empty at the moment. This should only happen
+@@ -701,6 +704,10 @@ static int bcm2835_i2s_startup(struct sn
+ 	/* Should this still be running stop it */
+ 	bcm2835_i2s_stop_clock(dev);
+ 
++	snd_pcm_hw_constraint_minmax(substream->runtime,
++				     SNDRV_PCM_HW_PARAM_PERIOD_BYTES,
++				     256, ~0);
++
+ 	/* Enable PCM block */
+ 	regmap_update_bits(dev->i2s_regmap, BCM2835_I2S_CS_A_REG,
+ 			BCM2835_I2S_EN, BCM2835_I2S_EN);
+@@ -830,8 +837,7 @@ static int bcm2835_i2s_probe(struct plat
+ 	struct bcm2835_i2s_dev *dev;
+ 	int ret;
+ 	void __iomem *base;
+-	const __be32 *addr;
+-	dma_addr_t dma_base;
++	struct resource *res;
+ 
+ 	dev = devm_kzalloc(&pdev->dev, sizeof(*dev),
+ 			   GFP_KERNEL);
+@@ -846,7 +852,7 @@ static int bcm2835_i2s_probe(struct plat
+ 				     "could not get clk\n");
+ 
+ 	/* Request ioarea */
+-	base = devm_platform_ioremap_resource(pdev, 0);
++	base = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
+ 	if (IS_ERR(base))
+ 		return PTR_ERR(base);
+ 
+@@ -855,19 +861,11 @@ static int bcm2835_i2s_probe(struct plat
+ 	if (IS_ERR(dev->i2s_regmap))
+ 		return PTR_ERR(dev->i2s_regmap);
+ 
+-	/* Set the DMA address - we have to parse DT ourselves */
+-	addr = of_get_address(pdev->dev.of_node, 0, NULL, NULL);
+-	if (!addr) {
+-		dev_err(&pdev->dev, "could not get DMA-register address\n");
+-		return -EINVAL;
+-	}
+-	dma_base = be32_to_cpup(addr);
+-
+ 	dev->dma_data[SNDRV_PCM_STREAM_PLAYBACK].addr =
+-		dma_base + BCM2835_I2S_FIFO_A_REG;
++		res->start + BCM2835_I2S_FIFO_A_REG;
+ 
+ 	dev->dma_data[SNDRV_PCM_STREAM_CAPTURE].addr =
+-		dma_base + BCM2835_I2S_FIFO_A_REG;
++		res->start + BCM2835_I2S_FIFO_A_REG;
+ 
+ 	/* Set the bus width */
+ 	dev->dma_data[SNDRV_PCM_STREAM_PLAYBACK].addr_width =
+--- /dev/null
++++ b/sound/soc/bcm/chipdip-dac.c
+@@ -0,0 +1,275 @@
++/*
++ * ASoC Driver for ChipDip DAC
++ *
++ * Author:	Evgenij Sapunov
++ *		Copyright 2021
++ *		based on code by Milan Neskovic <info@justboom.co>
++ *		based on code by Jaikumar <jaikumar@cem-solutions.net>
++ *
++ * Thanks to Phil Elwell (pelwell) for help.
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/gpio/consumer.h>
++#include <linux/platform_device.h>
++#include <linux/delay.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++
++#define SR_BIT_0                  0 //sample rate bits
++#define SR_BIT_1                  1
++#define SR_BIT_2                  2
++#define BD_BIT_0                  3 //bit depth bits
++#define BD_BIT_1                  4
++
++#define SAMPLE_RATE_MASK_44_1     0
++#define SAMPLE_RATE_MASK_48       (1 << SR_BIT_0)
++#define SAMPLE_RATE_MASK_88_2     ((1 << SR_BIT_2) | (1 << SR_BIT_1))
++#define SAMPLE_RATE_MASK_96       (1 << SR_BIT_1)
++#define SAMPLE_RATE_MASK_176_4    ((1 << SR_BIT_2) | (1 << SR_BIT_1) | (1 << SR_BIT_0))
++#define SAMPLE_RATE_MASK_192      ((1 << SR_BIT_1) | (1 << SR_BIT_0))
++#define SAMPLE_RATE_MASK          ((1 << SR_BIT_2) | (1 << SR_BIT_1) | (1 << SR_BIT_0))
++
++#define BIT_DEPTH_MASK_16         0
++#define BIT_DEPTH_MASK_24         (1 << BD_BIT_0)
++#define BIT_DEPTH_MASK_32         (1 << BD_BIT_1)
++#define BIT_DEPTH_MASK            ((1 << BD_BIT_1) | (1 << BD_BIT_0))
++
++#define MUTE_ACTIVE               0
++#define MUTE_NOT_ACTIVE           1
++
++#define HW_PARAMS_GPIO_COUNT      5
++
++static struct gpio_desc *mute_gpio;
++static struct gpio_desc *sdwn_gpio;
++static struct gpio_desc *hw_params_gpios[HW_PARAMS_GPIO_COUNT];
++static int current_width;
++static int current_rate;
++
++static void snd_rpi_chipdip_dac_gpio_array_set(int value);
++static void snd_rpi_chipdip_dac_gpio_set(struct gpio_desc *gpio_item, int value);
++
++static void snd_rpi_chipdip_dac_gpio_array_set(int value)
++{
++	int i = 0;
++
++	for (i = 0; i < HW_PARAMS_GPIO_COUNT; i++)
++		snd_rpi_chipdip_dac_gpio_set(hw_params_gpios[i], ((value >> i) & 1));
++}
++
++static void snd_rpi_chipdip_dac_gpio_set(struct gpio_desc *gpio_item, int value)
++{
++	if (gpio_item)
++		gpiod_set_value_cansleep(gpio_item, value);
++}
++
++static int snd_rpi_chipdip_dac_init(struct snd_soc_pcm_runtime *rtd)
++{
++	return 0;
++}
++
++static int snd_rpi_chipdip_dac_hw_params(struct snd_pcm_substream *substream,
++					 struct snd_pcm_hw_params *params)
++{
++	int ret = 0;
++	int gpio_change_pending = 0;
++	int sample_rate_state = 0;
++	int bit_depth_state = 0;
++	int param_value = params_width(params);
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++
++	ret = snd_soc_dai_set_bclk_ratio(snd_soc_rtd_to_cpu(rtd, 0), 2 * 32);
++
++	if (current_width != param_value) {
++		current_width = param_value;
++		gpio_change_pending = 1;
++
++		switch (param_value) {
++		case 16:
++			bit_depth_state = BIT_DEPTH_MASK_16;
++			break;
++		case 24:
++			bit_depth_state = BIT_DEPTH_MASK_24;
++			break;
++		case 32:
++			bit_depth_state = BIT_DEPTH_MASK_32;
++			break;
++		default:
++			return -EINVAL;
++		}
++	}
++
++	param_value = params_rate(params);
++	if (current_rate != param_value) {
++		current_rate = param_value;
++		gpio_change_pending = 1;
++
++		switch (param_value) {
++		case 44100:
++			sample_rate_state = SAMPLE_RATE_MASK_44_1;
++			break;
++		case 48000:
++			sample_rate_state = SAMPLE_RATE_MASK_48;
++			break;
++		case 88200:
++			sample_rate_state = SAMPLE_RATE_MASK_88_2;
++			break;
++		case 96000:
++			sample_rate_state = SAMPLE_RATE_MASK_96;
++			break;
++		case 176400:
++			sample_rate_state = SAMPLE_RATE_MASK_176_4;
++			break;
++		case 192000:
++			sample_rate_state = SAMPLE_RATE_MASK_192;
++			break;
++		default:
++			return -EINVAL;
++		}
++	}
++
++	if (gpio_change_pending) {
++		snd_rpi_chipdip_dac_gpio_set(mute_gpio, MUTE_ACTIVE);
++		snd_rpi_chipdip_dac_gpio_array_set(bit_depth_state | sample_rate_state);
++		msleep(300);
++		snd_rpi_chipdip_dac_gpio_set(mute_gpio, MUTE_NOT_ACTIVE);
++	}
++
++	return ret;
++}
++
++static int snd_rpi_chipdip_dac_startup(struct snd_pcm_substream *substream)
++{
++	return 0;
++}
++
++static void snd_rpi_chipdip_dac_shutdown(struct snd_pcm_substream *substream)
++{
++
++}
++
++/* machine stream operations */
++static struct snd_soc_ops snd_rpi_chipdip_dac_ops = {
++	.hw_params = snd_rpi_chipdip_dac_hw_params,
++	.startup = snd_rpi_chipdip_dac_startup,
++	.shutdown = snd_rpi_chipdip_dac_shutdown,
++};
++
++SND_SOC_DAILINK_DEFS(hifi,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("spdif-transmitter", "dit-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_chipdip_dac_dai[] = {
++{
++	.name		= "ChipDip DAC",
++	.stream_name	= "ChipDip DAC HiFi",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBM_CFM,
++	.ops		= &snd_rpi_chipdip_dac_ops,
++	.init		= snd_rpi_chipdip_dac_init,
++	SND_SOC_DAILINK_REG(hifi),
++},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_chipdip_dac = {
++	.name         = "ChipDipDAC",
++	.driver_name  = "ChipdipDac",
++	.owner        = THIS_MODULE,
++	.dai_link     = snd_rpi_chipdip_dac_dai,
++	.num_links    = ARRAY_SIZE(snd_rpi_chipdip_dac_dai),
++};
++
++static int snd_rpi_chipdip_dac_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++	int i = 0;
++
++	snd_rpi_chipdip_dac.dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai = &snd_rpi_chipdip_dac_dai[0];
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++					"i2s-controller", 0);
++
++		if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++		}
++	}
++
++	hw_params_gpios[SR_BIT_0] = devm_gpiod_get_optional(&pdev->dev, "sr0", GPIOD_OUT_LOW);
++	hw_params_gpios[SR_BIT_1] = devm_gpiod_get_optional(&pdev->dev, "sr1", GPIOD_OUT_LOW);
++	hw_params_gpios[SR_BIT_2] = devm_gpiod_get_optional(&pdev->dev, "sr2", GPIOD_OUT_LOW);
++	hw_params_gpios[BD_BIT_0] = devm_gpiod_get_optional(&pdev->dev, "res0", GPIOD_OUT_LOW);
++	hw_params_gpios[BD_BIT_1] = devm_gpiod_get_optional(&pdev->dev, "res1", GPIOD_OUT_LOW);
++	mute_gpio = devm_gpiod_get_optional(&pdev->dev, "mute", GPIOD_OUT_LOW);
++	sdwn_gpio = devm_gpiod_get_optional(&pdev->dev, "sdwn", GPIOD_OUT_HIGH);
++
++	for (i = 0; i < HW_PARAMS_GPIO_COUNT; i++) {
++		if (IS_ERR(hw_params_gpios[i])) {
++			ret = PTR_ERR(hw_params_gpios[i]);
++			dev_err(&pdev->dev, "failed to get hw_params gpio: %d\n", ret);
++			return ret;
++		}
++	}
++
++	if (IS_ERR(mute_gpio)) {
++		ret = PTR_ERR(mute_gpio);
++		dev_err(&pdev->dev, "failed to get mute gpio: %d\n", ret);
++		return ret;
++	}
++
++	if (IS_ERR(sdwn_gpio)) {
++		ret = PTR_ERR(sdwn_gpio);
++		dev_err(&pdev->dev, "failed to get sdwn gpio: %d\n", ret);
++		return ret;
++	}
++
++	snd_rpi_chipdip_dac_gpio_set(sdwn_gpio, 1);
++
++	ret = devm_snd_soc_register_card(&pdev->dev, &snd_rpi_chipdip_dac);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev,
++			"snd_soc_register_card() failed: %d\n", ret);
++
++	return ret;
++}
++
++static const struct of_device_id snd_rpi_chipdip_dac_of_match[] = {
++	{ .compatible = "chipdip,chipdip-dac", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, snd_rpi_chipdip_dac_of_match);
++
++static struct platform_driver snd_rpi_chipdip_dac_driver = {
++	.driver = {
++		.name   = "snd-rpi-chipdip-dac",
++		.owner  = THIS_MODULE,
++		.of_match_table = snd_rpi_chipdip_dac_of_match,
++	},
++	.probe          = snd_rpi_chipdip_dac_probe,
++};
++
++module_platform_driver(snd_rpi_chipdip_dac_driver);
++
++MODULE_AUTHOR("Evgenij Sapunov <evgenij.sapunov@chipdip.ru>");
++MODULE_DESCRIPTION("ASoC Driver for ChipDip DAC");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/dacberry400.c
+@@ -0,0 +1,258 @@
++/*
++ * ASoC Driver for Dacberry400 soundcard
++ * Author:
++ *      Ashish Vara<ashishhvara@gmail.com>
++ *      Copyright 2022
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/gpio/consumer.h>
++#include <linux/platform_device.h>
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++#include <linux/i2c.h>
++#include <linux/acpi.h>
++#include <linux/slab.h>
++#include "../sound/soc/codecs/tlv320aic3x.h"
++
++static const struct snd_kcontrol_new dacberry400_controls[] = {
++	SOC_DAPM_PIN_SWITCH("MIC Jack"),
++	SOC_DAPM_PIN_SWITCH("Line In"),
++	SOC_DAPM_PIN_SWITCH("Line Out"),
++	SOC_DAPM_PIN_SWITCH("Headphone Jack"),
++};
++
++static const struct snd_soc_dapm_widget dacberry400_widgets[] = {
++	SND_SOC_DAPM_HP("Headphone Jack", NULL),
++	SND_SOC_DAPM_MIC("MIC Jack", NULL),
++	SND_SOC_DAPM_LINE("Line In", NULL),
++	SND_SOC_DAPM_LINE("Line Out", NULL),
++};
++
++static const struct snd_soc_dapm_route dacberry400_audio_map[] = {
++	{"Headphone Jack", NULL, "HPLOUT"},
++	{"Headphone Jack", NULL, "HPROUT"},
++
++	{"LINE1L", NULL, "Line In"},
++	{"LINE1R", NULL, "Line In"},
++
++	{"Line Out", NULL, "LLOUT"},
++	{"Line Out", NULL, "RLOUT"},
++
++	{"MIC3L", NULL, "MIC Jack"},
++	{"MIC3R", NULL, "MIC Jack"},
++};
++
++static int snd_rpi_dacberry400_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_dai *codec_dai = snd_soc_rtd_to_codec(rtd, 0);
++	struct snd_soc_component *component = codec_dai->component;
++	int ret;
++
++	ret = snd_soc_dai_set_sysclk(codec_dai, 2, 12000000,
++					SND_SOC_CLOCK_OUT);
++
++	if (ret && ret != -ENOTSUPP)
++		goto err;
++
++	snd_soc_component_write(component, HPRCOM_CFG, 0x20);
++	snd_soc_component_write(component, DACL1_2_HPLOUT_VOL, 0x80);
++	snd_soc_component_write(component, DACR1_2_HPROUT_VOL, 0x80);
++err:
++	return ret;
++}
++
++static int snd_rpi_dacberry400_set_bias_level(struct snd_soc_card *card,
++	struct snd_soc_dapm_context *dapm, enum snd_soc_bias_level level)
++{
++	struct snd_soc_pcm_runtime *rtd;
++	struct snd_soc_dai *codec_dai;
++	struct snd_soc_component *component;
++	struct dacberry_priv *aic3x;
++	u8 hpcom_reg = 0;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++	codec_dai = snd_soc_rtd_to_codec(rtd, 0);
++	component = codec_dai->component;
++	aic3x = snd_soc_component_get_drvdata(component);
++	if (dapm->dev != codec_dai->dev)
++		return 0;
++
++	switch (level) {
++	case SND_SOC_BIAS_PREPARE:
++		if (dapm->bias_level != SND_SOC_BIAS_STANDBY)
++			break;
++		/* UNMUTE ADC/DAC */
++		hpcom_reg = snd_soc_component_read(component, HPLCOM_CFG);
++		snd_soc_component_write(component, HPLCOM_CFG, hpcom_reg | 0x20);
++		snd_soc_component_write(component, LINE1R_2_RADC_CTRL, 0x04);
++		snd_soc_component_write(component, LINE1L_2_LADC_CTRL, 0x04);
++		snd_soc_component_write(component, LADC_VOL, 0x00);
++		snd_soc_component_write(component, RADC_VOL, 0x00);
++		pr_info("%s: unmute ADC/DAC\n", __func__);
++		break;
++
++	case SND_SOC_BIAS_STANDBY:
++		if (dapm->bias_level != SND_SOC_BIAS_PREPARE)
++			break;
++		/* MUTE ADC/DAC */
++		snd_soc_component_write(component, LDAC_VOL, 0x80);
++		snd_soc_component_write(component, RDAC_VOL, 0x80);
++		snd_soc_component_write(component, LADC_VOL, 0x80);
++		snd_soc_component_write(component, RADC_VOL, 0x80);
++		snd_soc_component_write(component, LINE1R_2_RADC_CTRL, 0x00);
++		snd_soc_component_write(component, LINE1L_2_LADC_CTRL, 0x00);
++		snd_soc_component_write(component, HPLCOM_CFG, 0x00);
++		pr_info("%s: mute ADC/DAC\n", __func__);
++		break;
++	default:
++		break;
++	}
++
++	return 0;
++}
++
++static int snd_rpi_dacberry400_hw_params(struct snd_pcm_substream *substream,
++					   struct snd_pcm_hw_params *params)
++{
++	int ret = 0;
++	u8 data;
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_dai *codec_dai = snd_soc_rtd_to_codec(rtd, 0);
++	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
++	struct snd_soc_component *component = codec_dai->component;
++	int fsref = (params_rate(params) % 11025 == 0) ? 44100 : 48000;
++	int channels = params_channels(params);
++	int width = 32;
++	u8 clock = 0;
++
++	data = (LDAC2LCH | RDAC2RCH);
++	data |= (fsref == 44100) ? FSREF_44100 : FSREF_48000;
++	if (params_rate(params) >= 64000)
++		data |= DUAL_RATE_MODE;
++	ret = snd_soc_component_write(component, 0x7, data);
++	width = params_width(params);
++
++	clock = snd_soc_component_read(component, 2);
++
++	ret = snd_soc_dai_set_bclk_ratio(cpu_dai, channels*width);
++
++	return ret;
++}
++
++static const struct snd_soc_ops snd_rpi_dacberry400_ops = {
++	.hw_params = snd_rpi_dacberry400_hw_params,
++};
++
++
++SND_SOC_DAILINK_DEFS(rpi_dacberry400,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2835-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("tlv320aic3x.1-0018", "tlv320aic3x-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2835-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_dacberry400_dai[] = {
++{
++	.dai_fmt		= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++					SND_SOC_DAIFMT_CBS_CFS,
++	.init			= snd_rpi_dacberry400_init,
++	.ops			= &snd_rpi_dacberry400_ops,
++	.symmetric_rate		= 1,
++	SND_SOC_DAILINK_REG(rpi_dacberry400),
++},
++};
++
++static struct snd_soc_card snd_rpi_dacberry400 = {
++	.owner			= THIS_MODULE,
++	.dai_link		= snd_rpi_dacberry400_dai,
++	.num_links		= ARRAY_SIZE(snd_rpi_dacberry400_dai),
++	.controls		= dacberry400_controls,
++	.num_controls		= ARRAY_SIZE(dacberry400_controls),
++	.dapm_widgets		= dacberry400_widgets,
++	.num_dapm_widgets	= ARRAY_SIZE(dacberry400_widgets),
++	.dapm_routes		= dacberry400_audio_map,
++	.num_dapm_routes	= ARRAY_SIZE(dacberry400_audio_map),
++	.set_bias_level		= snd_rpi_dacberry400_set_bias_level,
++};
++
++static int snd_rpi_dacberry400_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++
++	snd_rpi_dacberry400.dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_card *card = &snd_rpi_dacberry400;
++		struct snd_soc_dai_link *dai = &snd_rpi_dacberry400_dai[0];
++
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++					    "i2s-controller", 0);
++		if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++			of_node_put(i2s_node);
++		}
++
++		if (of_property_read_string(pdev->dev.of_node, "card_name",
++					    &card->name))
++			card->name = "tlvaudioCODEC";
++
++		if (of_property_read_string(pdev->dev.of_node, "dai_name",
++					    &dai->name))
++			dai->name = "tlvaudio CODEC";
++
++	}
++
++	ret = snd_soc_register_card(&snd_rpi_dacberry400);
++	if (ret) {
++		if (ret != -EPROBE_DEFER)
++			dev_err(&pdev->dev,
++				"snd_soc_register_card() failed: %d\n", ret);
++		return ret;
++	}
++
++	return 0;
++}
++
++static void snd_rpi_dacberry400_remove(struct platform_device *pdev)
++{
++	snd_soc_unregister_card(&snd_rpi_dacberry400);
++}
++
++static const struct of_device_id dacberry400_match_id[] = {
++	{ .compatible = "osaelectronics,dacberry400",},
++	{},
++};
++MODULE_DEVICE_TABLE(of, dacberry400_match_id);
++
++static struct platform_driver snd_rpi_dacberry400_driver = {
++	.driver = {
++		.name = "snd-rpi-dacberry400",
++		.owner = THIS_MODULE,
++		.of_match_table = dacberry400_match_id,
++	},
++	.probe = snd_rpi_dacberry400_probe,
++	.remove = snd_rpi_dacberry400_remove,
++};
++
++module_platform_driver(snd_rpi_dacberry400_driver);
++
++MODULE_AUTHOR("Ashish Vara");
++MODULE_DESCRIPTION("Dacberry400 sound card driver");
++MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:dacberry400");
++MODULE_SOFTDEP("pre: snd-soc-tlv320aic3x");
+--- /dev/null
++++ b/sound/soc/bcm/digidac1-soundcard.c
+@@ -0,0 +1,421 @@
++/*
++ * ASoC Driver for RRA DigiDAC1
++ * Copyright 2016
++ * Author: José M. Tasende <vintage@redrocksaudio.es>
++ * based on the HifiBerry DAC driver by Florian Meier <florian.meier@koalo.de>
++ * and the Wolfson card driver by Nikesh Oswal, <Nikesh.Oswal@wolfsonmicro.com>
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/i2c.h>
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++#include <sound/soc-dapm.h>
++#include <sound/tlv.h>
++#include <linux/regulator/consumer.h>
++
++#include "../codecs/wm8804.h"
++#include "../codecs/wm8741.h"
++
++#define WM8741_NUM_SUPPLIES 2
++
++/* codec private data */
++struct wm8741_priv {
++	struct wm8741_platform_data pdata;
++	struct regmap *regmap;
++	struct regulator_bulk_data supplies[WM8741_NUM_SUPPLIES];
++	unsigned int sysclk;
++	const struct snd_pcm_hw_constraint_list *sysclk_constraints;
++};
++
++static int samplerate = 44100;
++
++/* New Alsa Controls not exposed by original wm8741 codec driver	*/
++/* in actual driver the att. adjustment is wrong because		*/
++/* this DAC has a coarse attenuation register with 4dB steps		*/
++/* and a fine level register with 0.125dB steps				*/
++/* each register has 32 steps so combining both we have	1024 steps	*/
++/* of 0.125 dB.								*/
++/* The original level controls from driver are removed at startup	*/
++/* and replaced by the corrected ones.					*/
++/* The same wm8741 driver can be used for wm8741 and wm8742 devices	*/
++
++static const DECLARE_TLV_DB_SCALE(dac_tlv_fine, 0, 13, 0);
++static const DECLARE_TLV_DB_SCALE(dac_tlv_coarse, -12700, 400, 1);
++static const char *w8741_dither[4] = {"Off", "RPDF", "TPDF", "HPDF"};
++static const char *w8741_filter[5] = {
++		"Type 1", "Type 2", "Type 3", "Type 4", "Type 5"};
++static const char *w8741_switch[2] = {"Off", "On"};
++static const struct soc_enum w8741_enum[] = {
++SOC_ENUM_SINGLE(WM8741_MODE_CONTROL_2, 0, 4, w8741_dither),/* dithering type */
++SOC_ENUM_SINGLE(WM8741_FILTER_CONTROL, 0, 5, w8741_filter),/* filter type */
++SOC_ENUM_SINGLE(WM8741_FORMAT_CONTROL, 6, 2, w8741_switch),/* phase invert */
++SOC_ENUM_SINGLE(WM8741_VOLUME_CONTROL, 0, 2, w8741_switch),/* volume ramp */
++SOC_ENUM_SINGLE(WM8741_VOLUME_CONTROL, 3, 2, w8741_switch),/* soft mute */
++};
++
++static const struct snd_kcontrol_new w8741_snd_controls_stereo[] = {
++SOC_DOUBLE_R_TLV("DAC Fine Playback Volume", WM8741_DACLLSB_ATTENUATION,
++		WM8741_DACRLSB_ATTENUATION, 0, 31, 1, dac_tlv_fine),
++SOC_DOUBLE_R_TLV("Digital Playback Volume", WM8741_DACLMSB_ATTENUATION,
++		WM8741_DACRMSB_ATTENUATION, 0, 31, 1, dac_tlv_coarse),
++SOC_ENUM("DAC Dither", w8741_enum[0]),
++SOC_ENUM("DAC Digital Filter", w8741_enum[1]),
++SOC_ENUM("DAC Phase Invert", w8741_enum[2]),
++SOC_ENUM("DAC Volume Ramp", w8741_enum[3]),
++SOC_ENUM("DAC Soft Mute", w8741_enum[4]),
++};
++
++static const struct snd_kcontrol_new w8741_snd_controls_mono_left[] = {
++SOC_SINGLE_TLV("DAC Fine Playback Volume", WM8741_DACLLSB_ATTENUATION,
++		0, 31, 0, dac_tlv_fine),
++SOC_SINGLE_TLV("Digital Playback Volume", WM8741_DACLMSB_ATTENUATION,
++		0, 31, 1, dac_tlv_coarse),
++SOC_ENUM("DAC Dither", w8741_enum[0]),
++SOC_ENUM("DAC Digital Filter", w8741_enum[1]),
++SOC_ENUM("DAC Phase Invert", w8741_enum[2]),
++SOC_ENUM("DAC Volume Ramp", w8741_enum[3]),
++SOC_ENUM("DAC Soft Mute", w8741_enum[4]),
++};
++
++static const struct snd_kcontrol_new w8741_snd_controls_mono_right[] = {
++SOC_SINGLE_TLV("DAC Fine Playback Volume", WM8741_DACRLSB_ATTENUATION,
++	0, 31, 0, dac_tlv_fine),
++SOC_SINGLE_TLV("Digital Playback Volume", WM8741_DACRMSB_ATTENUATION,
++	0, 31, 1, dac_tlv_coarse),
++SOC_ENUM("DAC Dither", w8741_enum[0]),
++SOC_ENUM("DAC Digital Filter", w8741_enum[1]),
++SOC_ENUM("DAC Phase Invert", w8741_enum[2]),
++SOC_ENUM("DAC Volume Ramp", w8741_enum[3]),
++SOC_ENUM("DAC Soft Mute", w8741_enum[4]),
++};
++
++static int w8741_add_controls(struct snd_soc_component *component)
++{
++	struct wm8741_priv *wm8741 = snd_soc_component_get_drvdata(component);
++
++	switch (wm8741->pdata.diff_mode) {
++	case WM8741_DIFF_MODE_STEREO:
++	case WM8741_DIFF_MODE_STEREO_REVERSED:
++		snd_soc_add_component_controls(component,
++				w8741_snd_controls_stereo,
++				ARRAY_SIZE(w8741_snd_controls_stereo));
++		break;
++	case WM8741_DIFF_MODE_MONO_LEFT:
++		snd_soc_add_component_controls(component,
++				w8741_snd_controls_mono_left,
++				ARRAY_SIZE(w8741_snd_controls_mono_left));
++		break;
++	case WM8741_DIFF_MODE_MONO_RIGHT:
++		snd_soc_add_component_controls(component,
++				w8741_snd_controls_mono_right,
++				ARRAY_SIZE(w8741_snd_controls_mono_right));
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++static int digidac1_soundcard_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_card *card = rtd->card;
++	struct snd_soc_pcm_runtime *wm8741_rtd;
++	struct snd_soc_component *wm8741_component;
++	struct snd_card *sound_card = card->snd_card;
++	struct snd_kcontrol *kctl;
++	int ret;
++
++	wm8741_rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[1]);
++	if (!wm8741_rtd) {
++		dev_warn(card->dev, "digidac1_soundcard_init: couldn't get wm8741 rtd\n");
++		return -EFAULT;
++	}
++	wm8741_component = snd_soc_rtd_to_codec(wm8741_rtd, 0)->component;
++	ret = w8741_add_controls(wm8741_component);
++	if (ret < 0)
++		dev_warn(card->dev, "Failed to add new wm8741 controls: %d\n",
++		ret);
++
++	/* enable TX output */
++	snd_soc_component_update_bits(component, WM8804_PWRDN, 0x4, 0x0);
++
++	kctl = snd_soc_card_get_kcontrol(card,
++		"Playback Volume");
++	if (kctl) {
++		kctl->vd[0].access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
++		snd_ctl_remove(sound_card, kctl);
++		}
++	kctl = snd_soc_card_get_kcontrol(card,
++		"Fine Playback Volume");
++	if (kctl) {
++		kctl->vd[0].access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
++		snd_ctl_remove(sound_card, kctl);
++		}
++	return 0;
++}
++
++static int digidac1_soundcard_startup(struct snd_pcm_substream *substream)
++{
++	/* turn on wm8804 digital output */
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_card *card = rtd->card;
++	struct snd_soc_pcm_runtime *wm8741_rtd;
++	struct snd_soc_component *wm8741_component;
++
++	snd_soc_component_update_bits(component, WM8804_PWRDN, 0x3c, 0x00);
++	wm8741_rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[1]);
++	if (!wm8741_rtd) {
++		dev_warn(card->dev, "digidac1_soundcard_startup: couldn't get WM8741 rtd\n");
++		return -EFAULT;
++	}
++	wm8741_component = snd_soc_rtd_to_codec(wm8741_rtd, 0)->component;
++
++	/* latch wm8741 level */
++	snd_soc_component_update_bits(wm8741_component, WM8741_DACLLSB_ATTENUATION,
++		WM8741_UPDATELL, WM8741_UPDATELL);
++	snd_soc_component_update_bits(wm8741_component, WM8741_DACLMSB_ATTENUATION,
++		WM8741_UPDATELM, WM8741_UPDATELM);
++	snd_soc_component_update_bits(wm8741_component, WM8741_DACRLSB_ATTENUATION,
++		WM8741_UPDATERL, WM8741_UPDATERL);
++	snd_soc_component_update_bits(wm8741_component, WM8741_DACRMSB_ATTENUATION,
++		WM8741_UPDATERM, WM8741_UPDATERM);
++
++	return 0;
++}
++
++static void digidac1_soundcard_shutdown(struct snd_pcm_substream *substream)
++{
++	/* turn off wm8804 digital output */
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++
++	snd_soc_component_update_bits(component, WM8804_PWRDN, 0x3c, 0x3c);
++}
++
++static int digidac1_soundcard_hw_params(struct snd_pcm_substream *substream,
++				       struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_dai *codec_dai = snd_soc_rtd_to_codec(rtd, 0);
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
++	struct snd_soc_card *card = rtd->card;
++	struct snd_soc_pcm_runtime *wm8741_rtd;
++	struct snd_soc_component *wm8741_component;
++
++	int sysclk = 27000000;
++	long mclk_freq = 0;
++	int mclk_div = 1;
++	int sampling_freq = 1;
++	int ret;
++
++	wm8741_rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[1]);
++	if (!wm8741_rtd) {
++		dev_warn(card->dev, "digidac1_soundcard_hw_params: couldn't get WM8741 rtd\n");
++		return -EFAULT;
++	}
++	wm8741_component = snd_soc_rtd_to_codec(wm8741_rtd, 0)->component;
++	samplerate = params_rate(params);
++
++	if (samplerate <= 96000) {
++		mclk_freq = samplerate*256;
++		mclk_div = WM8804_MCLKDIV_256FS;
++	} else {
++		mclk_freq = samplerate*128;
++		mclk_div = WM8804_MCLKDIV_128FS;
++		}
++
++	switch (samplerate) {
++	case 32000:
++		sampling_freq = 0x03;
++		break;
++	case 44100:
++		sampling_freq = 0x00;
++		break;
++	case 48000:
++		sampling_freq = 0x02;
++		break;
++	case 88200:
++		sampling_freq = 0x08;
++		break;
++	case 96000:
++		sampling_freq = 0x0a;
++		break;
++	case 176400:
++		sampling_freq = 0x0c;
++		break;
++	case 192000:
++		sampling_freq = 0x0e;
++		break;
++	default:
++		dev_err(card->dev,
++		"Failed to set WM8804 SYSCLK, unsupported samplerate %d\n",
++		samplerate);
++	}
++
++	snd_soc_dai_set_clkdiv(codec_dai, WM8804_MCLK_DIV, mclk_div);
++	snd_soc_dai_set_pll(codec_dai, 0, 0, sysclk, mclk_freq);
++
++	ret = snd_soc_dai_set_sysclk(codec_dai, WM8804_TX_CLKSRC_PLL,
++		sysclk, SND_SOC_CLOCK_OUT);
++	if (ret < 0) {
++		dev_err(card->dev,
++		"Failed to set WM8804 SYSCLK: %d\n", ret);
++		return ret;
++	}
++	/* Enable wm8804 TX output */
++	snd_soc_component_update_bits(component, WM8804_PWRDN, 0x4, 0x0);
++
++	/* wm8804 Power on */
++	snd_soc_component_update_bits(component, WM8804_PWRDN, 0x9, 0);
++
++	/* wm8804 set sampling frequency status bits */
++	snd_soc_component_update_bits(component, WM8804_SPDTX4, 0x0f, sampling_freq);
++
++	/* Now update wm8741 registers for the correct oversampling */
++	if (samplerate <= 48000)
++		snd_soc_component_update_bits(wm8741_component, WM8741_MODE_CONTROL_1,
++		 WM8741_OSR_MASK, 0x00);
++	else if (samplerate <= 96000)
++		snd_soc_component_update_bits(wm8741_component, WM8741_MODE_CONTROL_1,
++		 WM8741_OSR_MASK, 0x20);
++	else
++		snd_soc_component_update_bits(wm8741_component, WM8741_MODE_CONTROL_1,
++		 WM8741_OSR_MASK, 0x40);
++
++	/* wm8741 bit size */
++	switch (params_width(params)) {
++	case 16:
++		snd_soc_component_update_bits(wm8741_component, WM8741_FORMAT_CONTROL,
++		 WM8741_IWL_MASK, 0x00);
++		break;
++	case 20:
++		snd_soc_component_update_bits(wm8741_component, WM8741_FORMAT_CONTROL,
++		 WM8741_IWL_MASK, 0x01);
++		break;
++	case 24:
++		snd_soc_component_update_bits(wm8741_component, WM8741_FORMAT_CONTROL,
++		 WM8741_IWL_MASK, 0x02);
++		break;
++	case 32:
++		snd_soc_component_update_bits(wm8741_component, WM8741_FORMAT_CONTROL,
++		 WM8741_IWL_MASK, 0x03);
++		break;
++	default:
++		dev_dbg(card->dev, "wm8741_hw_params:    Unsupported bit size param = %d",
++			params_width(params));
++		return -EINVAL;
++	}
++
++	return snd_soc_dai_set_bclk_ratio(cpu_dai, 64);
++}
++/* machine stream operations */
++static struct snd_soc_ops digidac1_soundcard_ops = {
++	.hw_params	= digidac1_soundcard_hw_params,
++	.startup	= digidac1_soundcard_startup,
++	.shutdown	= digidac1_soundcard_shutdown,
++};
++
++SND_SOC_DAILINK_DEFS(digidac1,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("wm8804.1-003b", "wm8804-spdif")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2835-i2s.0")));
++
++SND_SOC_DAILINK_DEFS(digidac11,
++	DAILINK_COMP_ARRAY(COMP_CPU("wm8804-spdif")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("wm8741.1-001a", "wm8741")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link digidac1_soundcard_dai[] = {
++	{
++	.name		= "RRA DigiDAC1",
++	.stream_name	= "RRA DigiDAC1 HiFi",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBM_CFM,
++	.ops		= &digidac1_soundcard_ops,
++	.init		= digidac1_soundcard_init,
++	SND_SOC_DAILINK_REG(digidac1),
++	},
++	{
++	.name		= "RRA DigiDAC11",
++	.stream_name	= "RRA DigiDAC11 HiFi",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S
++			| SND_SOC_DAIFMT_NB_NF
++			| SND_SOC_DAIFMT_CBS_CFS,
++	SND_SOC_DAILINK_REG(digidac11),
++	},
++};
++
++/* audio machine driver */
++static struct snd_soc_card digidac1_soundcard = {
++	.name		= "digidac1-soundcard",
++	.owner		= THIS_MODULE,
++	.dai_link	= digidac1_soundcard_dai,
++	.num_links	= ARRAY_SIZE(digidac1_soundcard_dai),
++};
++
++static int digidac1_soundcard_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++
++	digidac1_soundcard.dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai = &digidac1_soundcard_dai[0];
++
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++					"i2s-controller", 0);
++
++		if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++		}
++	}
++
++	ret = devm_snd_soc_register_card(&pdev->dev, &digidac1_soundcard);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n",
++			ret);
++
++	return ret;
++}
++
++static const struct of_device_id digidac1_soundcard_of_match[] = {
++	{ .compatible = "rra,digidac1-soundcard", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, digidac1_soundcard_of_match);
++
++static struct platform_driver digidac1_soundcard_driver = {
++	.driver = {
++			.name		= "digidac1-audio",
++			.owner		= THIS_MODULE,
++			.of_match_table	= digidac1_soundcard_of_match,
++	},
++	.probe		= digidac1_soundcard_probe,
++};
++
++module_platform_driver(digidac1_soundcard_driver);
++
++MODULE_AUTHOR("José M. Tasende <vintage@redrocksaudio.es>");
++MODULE_DESCRIPTION("ASoC Driver for RRA DigiDAC1");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/dionaudio_loco-v2.c
+@@ -0,0 +1,118 @@
++/*
++ * ASoC Driver for Dion Audio LOCO-V2 DAC-AMP
++ *
++ * Author:      Miquel Blauw <info@dionaudio.nl>
++ *              Copyright 2017
++ *
++ * Based on the software of the RPi-DAC writen by Florian Meier
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++
++static bool digital_gain_0db_limit = true;
++
++static int snd_rpi_dionaudio_loco_v2_init(struct snd_soc_pcm_runtime *rtd)
++{
++	if (digital_gain_0db_limit) {
++		int ret;
++		struct snd_soc_card *card = rtd->card;
++
++		ret = snd_soc_limit_volume(card, "Digital Playback Volume", 207);
++		if (ret < 0)
++			dev_warn(card->dev, "Failed to set volume limit: %d\n", ret);
++	}
++
++	return 0;
++}
++
++SND_SOC_DAILINK_DEFS(dionaudio_loco_v2,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm512x.1-004d", "pcm512x-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_dionaudio_loco_v2_dai[] = {
++{
++	.name		= "DionAudio LOCO-V2",
++	.stream_name	= "DionAudio LOCO-V2 DAC-AMP",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++			  SND_SOC_DAIFMT_CBS_CFS,
++	.init		= snd_rpi_dionaudio_loco_v2_init,
++	SND_SOC_DAILINK_REG(dionaudio_loco_v2),
++},};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_dionaudio_loco_v2 = {
++	.name         = "Dion Audio LOCO-V2",
++	.owner        = THIS_MODULE,
++	.dai_link     = snd_rpi_dionaudio_loco_v2_dai,
++	.num_links    = ARRAY_SIZE(snd_rpi_dionaudio_loco_v2_dai),
++};
++
++static int snd_rpi_dionaudio_loco_v2_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++
++	snd_rpi_dionaudio_loco_v2.dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai =
++					&snd_rpi_dionaudio_loco_v2_dai[0];
++
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++					    "i2s-controller", 0);
++		if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++		}
++
++		digital_gain_0db_limit = !of_property_read_bool(
++			pdev->dev.of_node, "dionaudio,24db_digital_gain");
++	}
++
++	ret = devm_snd_soc_register_card(&pdev->dev, &snd_rpi_dionaudio_loco_v2);
++	if (ret)
++		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n",
++			ret);
++
++	return ret;
++}
++
++static const struct of_device_id dionaudio_of_match[] = {
++	{ .compatible = "dionaudio,dionaudio-loco-v2", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, dionaudio_of_match);
++
++static struct platform_driver snd_rpi_dionaudio_loco_v2_driver = {
++	.driver = {
++		.name   = "snd-rpi-dionaudio-loco-v2",
++		.owner  = THIS_MODULE,
++		.of_match_table = dionaudio_of_match,
++	},
++	.probe          = snd_rpi_dionaudio_loco_v2_probe,
++};
++
++module_platform_driver(snd_rpi_dionaudio_loco_v2_driver);
++
++MODULE_AUTHOR("Miquel Blauw <info@dionaudio.nl>");
++MODULE_DESCRIPTION("ASoC Driver for DionAudio LOCO-V2");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/dionaudio_loco.c
+@@ -0,0 +1,121 @@
++/*
++ * ASoC Driver for Dion Audio LOCO DAC-AMP
++ *
++ * Author:      Miquel Blauw <info@dionaudio.nl>
++ *              Copyright 2016
++ *
++ * Based on the software of the RPi-DAC writen by Florian Meier
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++
++static int snd_rpi_dionaudio_loco_hw_params(
++	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
++
++	unsigned int sample_bits =
++		snd_pcm_format_width(params_format(params));
++
++	/* Using powers of 2 allows for an integer clock divisor */
++	sample_bits = sample_bits <= 16 ? 16 : 32;
++
++	return snd_soc_dai_set_bclk_ratio(cpu_dai, sample_bits * 2);
++}
++
++/* machine stream operations */
++static struct snd_soc_ops snd_rpi_dionaudio_loco_ops = {
++	.hw_params = snd_rpi_dionaudio_loco_hw_params,
++};
++
++SND_SOC_DAILINK_DEFS(dionaudio_loco,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm5102a-codec", "pcm5102a-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_dionaudio_loco_dai[] = {
++{
++	.name		= "DionAudio LOCO",
++	.stream_name	= "DionAudio LOCO DAC-AMP",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S |
++			  SND_SOC_DAIFMT_NB_NF |
++			  SND_SOC_DAIFMT_CBS_CFS,
++	.ops		= &snd_rpi_dionaudio_loco_ops,
++	SND_SOC_DAILINK_REG(dionaudio_loco),
++},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_dionaudio_loco = {
++	.name		= "snd_rpi_dionaudio_loco",
++	.owner		= THIS_MODULE,
++	.dai_link	= snd_rpi_dionaudio_loco_dai,
++	.num_links	= ARRAY_SIZE(snd_rpi_dionaudio_loco_dai),
++};
++
++static int snd_rpi_dionaudio_loco_probe(struct platform_device *pdev)
++{
++	struct device_node *np;
++	int ret = 0;
++
++	snd_rpi_dionaudio_loco.dev = &pdev->dev;
++
++	np = pdev->dev.of_node;
++	if (np) {
++		struct snd_soc_dai_link *dai = &snd_rpi_dionaudio_loco_dai[0];
++		struct device_node *i2s_np;
++
++		i2s_np = of_parse_phandle(np, "i2s-controller", 0);
++		if (i2s_np) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_np;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_np;
++		}
++	}
++
++	ret = devm_snd_soc_register_card(&pdev->dev, &snd_rpi_dionaudio_loco);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n",
++			ret);
++
++	return ret;
++}
++
++static const struct of_device_id snd_rpi_dionaudio_loco_of_match[] = {
++	{ .compatible = "dionaudio,loco-pcm5242-tpa3118", },
++	{ /* sentinel */ },
++};
++MODULE_DEVICE_TABLE(of, snd_rpi_dionaudio_loco_of_match);
++
++static struct platform_driver snd_rpi_dionaudio_loco_driver = {
++	.driver = {
++		.name		= "snd-dionaudio-loco",
++		.owner		= THIS_MODULE,
++		.of_match_table	= snd_rpi_dionaudio_loco_of_match,
++	},
++	.probe  = snd_rpi_dionaudio_loco_probe,
++};
++
++module_platform_driver(snd_rpi_dionaudio_loco_driver);
++
++MODULE_AUTHOR("Miquel Blauw <info@dionaudio.nl>");
++MODULE_DESCRIPTION("ASoC Driver for DionAudio LOCO");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/fe-pi-audio.c
+@@ -0,0 +1,154 @@
++/*
++ * ASoC Driver for Fe-Pi Audio Sound Card
++ *
++ * Author:	Henry Kupis <kuupaz@gmail.com>
++ *		Copyright 2016
++ *		based on code by Florian Meier <florian.meier@koalo.de>
++ *		based on code by Shawn Guo <shawn.guo@linaro.org>
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/io.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++
++#include "../codecs/sgtl5000.h"
++
++static int snd_fe_pi_audio_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_card *card = rtd->card;
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++
++	snd_soc_dapm_force_enable_pin(&card->dapm, "LO");
++	snd_soc_dapm_force_enable_pin(&card->dapm, "ADC");
++	snd_soc_dapm_force_enable_pin(&card->dapm, "DAC");
++	snd_soc_dapm_force_enable_pin(&card->dapm, "HP");
++	snd_soc_component_update_bits(component, SGTL5000_CHIP_ANA_POWER,
++			SGTL5000_VAG_POWERUP, SGTL5000_VAG_POWERUP);
++
++	return 0;
++}
++
++static int snd_fe_pi_audio_hw_params(struct snd_pcm_substream *substream,
++	struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct device *dev = rtd->card->dev;
++	struct snd_soc_dai *codec_dai = snd_soc_rtd_to_codec(rtd, 0);
++
++	int ret;
++
++	/* Set SGTL5000's SYSCLK */
++	ret = snd_soc_dai_set_sysclk(codec_dai, SGTL5000_SYSCLK, 12288000, SND_SOC_CLOCK_IN);
++	if (ret) {
++		dev_err(dev, "could not set codec driver clock params\n");
++		return ret;
++	}
++
++	return 0;
++}
++
++
++static struct snd_soc_ops snd_fe_pi_audio_ops = {
++	.hw_params = snd_fe_pi_audio_hw_params,
++};
++
++SND_SOC_DAILINK_DEFS(fe_pi,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("sgtl5000.1-000a", "sgtl5000")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_fe_pi_audio_dai[] = {
++	{
++		.name		= "FE-PI",
++		.stream_name	= "Fe-Pi HiFi",
++		.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++					SND_SOC_DAIFMT_CBM_CFM,
++		.ops		= &snd_fe_pi_audio_ops,
++		.init		= snd_fe_pi_audio_init,
++		SND_SOC_DAILINK_REG(fe_pi),
++	},
++};
++
++static const struct snd_soc_dapm_route fe_pi_audio_dapm_routes[] = {
++	{"ADC", NULL, "Mic Bias"},
++};
++
++
++static struct snd_soc_card fe_pi_audio = {
++	.name         = "Fe-Pi Audio",
++	.owner        = THIS_MODULE,
++	.dai_link     = snd_fe_pi_audio_dai,
++	.num_links    = ARRAY_SIZE(snd_fe_pi_audio_dai),
++
++	.dapm_routes = fe_pi_audio_dapm_routes,
++	.num_dapm_routes = ARRAY_SIZE(fe_pi_audio_dapm_routes),
++};
++
++static int snd_fe_pi_audio_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++	struct snd_soc_card *card = &fe_pi_audio;
++	struct device_node *np = pdev->dev.of_node;
++	struct device_node *i2s_node;
++	struct snd_soc_dai_link *dai = &snd_fe_pi_audio_dai[0];
++
++	fe_pi_audio.dev = &pdev->dev;
++
++	i2s_node = of_parse_phandle(np, "i2s-controller", 0);
++	if (!i2s_node) {
++		dev_err(&pdev->dev, "i2s_node phandle missing or invalid\n");
++		return -EINVAL;
++	}
++
++	dai->cpus->dai_name = NULL;
++	dai->cpus->of_node = i2s_node;
++	dai->platforms->name = NULL;
++	dai->platforms->of_node = i2s_node;
++
++	of_node_put(i2s_node);
++
++	card->dev = &pdev->dev;
++	platform_set_drvdata(pdev, card);
++
++	ret = devm_snd_soc_register_card(&pdev->dev, card);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n", ret);
++
++	return ret;
++}
++
++static const struct of_device_id snd_fe_pi_audio_of_match[] = {
++	{ .compatible = "fe-pi,fe-pi-audio", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, snd_fe_pi_audio_of_match);
++
++static struct platform_driver snd_fe_pi_audio_driver = {
++        .driver = {
++                .name   = "snd-fe-pi-audio",
++                .owner  = THIS_MODULE,
++                .of_match_table = snd_fe_pi_audio_of_match,
++        },
++        .probe          = snd_fe_pi_audio_probe,
++};
++
++module_platform_driver(snd_fe_pi_audio_driver);
++
++MODULE_AUTHOR("Henry Kupis <fe-pi@cox.net>");
++MODULE_DESCRIPTION("ASoC Driver for Fe-Pi Audio");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/googlevoicehat-codec.c
+@@ -0,0 +1,212 @@
++/*
++ * Driver for the Google voiceHAT audio codec for Raspberry Pi.
++ *
++ * Author:	Peter Malkin <petermalkin@google.com>
++ *		Copyright 2016
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/device.h>
++#include <linux/err.h>
++#include <linux/gpio.h>
++#include <linux/gpio/consumer.h>
++#include <linux/init.h>
++#include <linux/kernel.h>
++#include <linux/mod_devicetable.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/version.h>
++#include <sound/pcm.h>
++#include <sound/soc.h>
++#include <sound/soc-dai.h>
++#include <sound/soc-dapm.h>
++
++#define ICS43432_RATE_MIN_HZ	7190  /* from data sheet */
++#define ICS43432_RATE_MAX_HZ	52800 /* from data sheet */
++/* Delay in enabling SDMODE after clock settles to remove pop */
++#define SDMODE_DELAY_MS		5
++
++struct voicehat_priv {
++	struct delayed_work enable_sdmode_work;
++	struct gpio_desc *sdmode_gpio;
++	unsigned long sdmode_delay_jiffies;
++};
++
++static void voicehat_enable_sdmode_work(struct work_struct *work)
++{
++	struct voicehat_priv *voicehat = container_of(work,
++						      struct voicehat_priv,
++						      enable_sdmode_work.work);
++	gpiod_set_value(voicehat->sdmode_gpio, 1);
++}
++
++static int voicehat_component_probe(struct snd_soc_component *component)
++{
++	struct voicehat_priv *voicehat =
++				snd_soc_component_get_drvdata(component);
++
++	voicehat->sdmode_gpio = devm_gpiod_get(component->dev, "sdmode",
++					       GPIOD_OUT_LOW);
++	if (IS_ERR(voicehat->sdmode_gpio)) {
++		dev_err(component->dev, "Unable to allocate GPIO pin\n");
++		return PTR_ERR(voicehat->sdmode_gpio);
++	}
++
++	INIT_DELAYED_WORK(&voicehat->enable_sdmode_work,
++			  voicehat_enable_sdmode_work);
++	return 0;
++}
++
++static void voicehat_component_remove(struct snd_soc_component *component)
++{
++	struct voicehat_priv *voicehat =
++				snd_soc_component_get_drvdata(component);
++
++	cancel_delayed_work_sync(&voicehat->enable_sdmode_work);
++}
++
++static const struct snd_soc_dapm_widget voicehat_dapm_widgets[] = {
++	SND_SOC_DAPM_OUTPUT("Speaker"),
++};
++
++static const struct snd_soc_dapm_route voicehat_dapm_routes[] = {
++	{"Speaker", NULL, "HiFi Playback"},
++};
++
++static const struct snd_soc_component_driver voicehat_component_driver = {
++	.probe = voicehat_component_probe,
++	.remove = voicehat_component_remove,
++	.dapm_widgets = voicehat_dapm_widgets,
++	.num_dapm_widgets = ARRAY_SIZE(voicehat_dapm_widgets),
++	.dapm_routes = voicehat_dapm_routes,
++	.num_dapm_routes = ARRAY_SIZE(voicehat_dapm_routes),
++};
++
++static int voicehat_daiops_trigger(struct snd_pcm_substream *substream, int cmd,
++				   struct snd_soc_dai *dai)
++{
++	struct snd_soc_component *component = dai->component;
++	struct voicehat_priv *voicehat = snd_soc_component_get_drvdata(component);
++
++	if (voicehat->sdmode_delay_jiffies == 0)
++		return 0;
++
++	dev_dbg(dai->dev, "CMD             %d", cmd);
++	dev_dbg(dai->dev, "Playback Active %d", dai->stream[SNDRV_PCM_STREAM_PLAYBACK].active);
++	dev_dbg(dai->dev, "Capture Active  %d", dai->stream[SNDRV_PCM_STREAM_CAPTURE].active);
++
++	switch (cmd) {
++	case SNDRV_PCM_TRIGGER_START:
++	case SNDRV_PCM_TRIGGER_RESUME:
++	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
++		if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
++			dev_info(dai->dev, "Enabling audio amp...\n");
++			queue_delayed_work(
++				system_power_efficient_wq,
++				&voicehat->enable_sdmode_work,
++				voicehat->sdmode_delay_jiffies);
++		}
++		break;
++	case SNDRV_PCM_TRIGGER_STOP:
++	case SNDRV_PCM_TRIGGER_SUSPEND:
++	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
++		if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
++			cancel_delayed_work(&voicehat->enable_sdmode_work);
++			dev_info(dai->dev, "Disabling audio amp...\n");
++			gpiod_set_value(voicehat->sdmode_gpio, 0);
++		}
++		break;
++	}
++	return 0;
++}
++
++static const struct snd_soc_dai_ops voicehat_dai_ops = {
++	.trigger = voicehat_daiops_trigger,
++};
++
++static struct snd_soc_dai_driver voicehat_dai = {
++	.name = "voicehat-hifi",
++	.capture = {
++		.stream_name = "HiFi Capture",
++		.channels_min = 2,
++		.channels_max = 2,
++		.rates = SNDRV_PCM_RATE_48000,
++		.formats = SNDRV_PCM_FMTBIT_S32_LE
++	},
++	.playback = {
++		.stream_name = "HiFi Playback",
++		.channels_min = 2,
++		.channels_max = 2,
++		.rates = SNDRV_PCM_RATE_48000,
++		.formats = SNDRV_PCM_FMTBIT_S32_LE
++	},
++	.ops = &voicehat_dai_ops,
++	.symmetric_rate = 1
++};
++
++#ifdef CONFIG_OF
++static const struct of_device_id voicehat_ids[] = {
++		{ .compatible = "google,voicehat", }, {}
++	};
++	MODULE_DEVICE_TABLE(of, voicehat_ids);
++#endif
++
++static int voicehat_platform_probe(struct platform_device *pdev)
++{
++	struct voicehat_priv *voicehat;
++	unsigned int sdmode_delay;
++	int ret;
++
++	voicehat = devm_kzalloc(&pdev->dev, sizeof(*voicehat), GFP_KERNEL);
++	if (!voicehat)
++		return -ENOMEM;
++
++	ret = device_property_read_u32(&pdev->dev, "voicehat_sdmode_delay",
++				       &sdmode_delay);
++
++	if (ret) {
++		sdmode_delay = SDMODE_DELAY_MS;
++		dev_info(&pdev->dev,
++			 "property 'voicehat_sdmode_delay' not found default 5 mS");
++	} else {
++		dev_info(&pdev->dev, "property 'voicehat_sdmode_delay' found delay= %d mS",
++			 sdmode_delay);
++	}
++	voicehat->sdmode_delay_jiffies = msecs_to_jiffies(sdmode_delay);
++
++	dev_set_drvdata(&pdev->dev, voicehat);
++
++	return snd_soc_register_component(&pdev->dev,
++					  &voicehat_component_driver,
++					  &voicehat_dai,
++					  1);
++}
++
++static void voicehat_platform_remove(struct platform_device *pdev)
++{
++	snd_soc_unregister_component(&pdev->dev);
++}
++
++static struct platform_driver voicehat_driver = {
++	.driver = {
++		.name = "voicehat-codec",
++		.of_match_table = of_match_ptr(voicehat_ids),
++	},
++	.probe = voicehat_platform_probe,
++	.remove = voicehat_platform_remove,
++};
++
++module_platform_driver(voicehat_driver);
++
++MODULE_DESCRIPTION("Google voiceHAT Codec driver");
++MODULE_AUTHOR("Peter Malkin <petermalkin@google.com>");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/hifiberry_adc.c
+@@ -0,0 +1,174 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * ASoC Driver for HiFiBerry ADC
++ *
++ * Author:	Joerg Schambacher <joerg@hifiberry.com>
++ *		Copyright 2024
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/kernel.h>
++#include <linux/clk.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/slab.h>
++#include <linux/delay.h>
++#include <linux/i2c.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++#include <sound/tlv.h>
++
++#include "../codecs/pcm186x.h"
++#include "hifiberry_adc_controls.h"
++
++static bool leds_off;
++
++static int pcm1863_add_controls(struct snd_soc_component *component)
++{
++	snd_soc_add_component_controls(component,
++			pcm1863_snd_controls_card,
++			ARRAY_SIZE(pcm1863_snd_controls_card));
++	return 0;
++}
++
++static int snd_rpi_hifiberry_adc_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_dai *codec_dai = snd_soc_rtd_to_codec(rtd, 0);
++	struct snd_soc_component *adc = codec_dai->component;
++	int ret;
++
++	ret = pcm1863_add_controls(adc);
++	if (ret < 0)
++		dev_warn(rtd->dev, "Failed to add pcm1863 controls: %d\n",
++		ret);
++
++	codec_dai->driver->capture.rates =
++		SNDRV_PCM_RATE_44100 | SNDRV_PCM_RATE_48000 |
++		SNDRV_PCM_RATE_88200 | SNDRV_PCM_RATE_96000 |
++		SNDRV_PCM_RATE_176400 | SNDRV_PCM_RATE_192000;
++
++	/* set GPIO2 to output, GPIO3 input */
++	snd_soc_component_write(adc, PCM186X_GPIO3_2_CTRL, 0x00);
++	snd_soc_component_write(adc, PCM186X_GPIO3_2_DIR_CTRL, 0x04);
++	if (leds_off)
++		snd_soc_component_update_bits(adc, PCM186X_GPIO_IN_OUT, 0x40, 0x00);
++	else
++		snd_soc_component_update_bits(adc, PCM186X_GPIO_IN_OUT, 0x40, 0x40);
++
++	return 0;
++}
++
++static int snd_rpi_hifiberry_adc_hw_params(
++	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
++{
++	int ret = 0;
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	int channels = params_channels(params);
++	int width =  snd_pcm_format_width(params_format(params));
++
++	/* Using powers of 2 allows for an integer clock divisor */
++	width = width <= 16 ? 16 : 32;
++
++	ret = snd_soc_dai_set_bclk_ratio(snd_soc_rtd_to_cpu(rtd, 0), channels * width);
++	return ret;
++}
++
++/* machine stream operations */
++static const struct snd_soc_ops snd_rpi_hifiberry_adc_ops = {
++	.hw_params = snd_rpi_hifiberry_adc_hw_params,
++};
++
++SND_SOC_DAILINK_DEFS(hifi,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm186x.1-004a", "pcm1863-aif")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_hifiberry_adc_dai[] = {
++{
++	.name		= "HiFiBerry ADC",
++	.stream_name	= "HiFiBerry ADC HiFi",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBS_CFS,
++	.ops		= &snd_rpi_hifiberry_adc_ops,
++	.init		= snd_rpi_hifiberry_adc_init,
++	SND_SOC_DAILINK_REG(hifi),
++},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_hifiberry_adc = {
++	.name         = "snd_rpi_hifiberry_adc",
++	.driver_name  = "HifiberryAdc",
++	.owner        = THIS_MODULE,
++	.dai_link     = snd_rpi_hifiberry_adc_dai,
++	.num_links    = ARRAY_SIZE(snd_rpi_hifiberry_adc_dai),
++};
++
++static int snd_rpi_hifiberry_adc_probe(struct platform_device *pdev)
++{
++	int ret = 0, i = 0;
++	struct snd_soc_card *card = &snd_rpi_hifiberry_adc;
++
++	snd_rpi_hifiberry_adc.dev = &pdev->dev;
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai;
++
++		dai = &snd_rpi_hifiberry_adc_dai[0];
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++			"i2s-controller", 0);
++		if (i2s_node) {
++			for (i = 0; i < card->num_links; i++) {
++				dai->cpus->dai_name = NULL;
++				dai->cpus->of_node = i2s_node;
++				dai->platforms->name = NULL;
++				dai->platforms->of_node = i2s_node;
++			}
++		}
++	}
++	leds_off = of_property_read_bool(pdev->dev.of_node,
++					"hifiberry-adc,leds_off");
++	ret = snd_soc_register_card(&snd_rpi_hifiberry_adc);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev,
++			"snd_soc_register_card() failed: %d\n", ret);
++
++	return ret;
++}
++
++static const struct of_device_id snd_rpi_hifiberry_adc_of_match[] = {
++	{ .compatible = "hifiberry,hifiberry-adc", },
++	{},
++};
++
++MODULE_DEVICE_TABLE(of, snd_rpi_hifiberry_adc_of_match);
++
++static struct platform_driver snd_rpi_hifiberry_adc_driver = {
++	.driver = {
++		.name   = "snd-rpi-hifiberry-adc",
++		.owner  = THIS_MODULE,
++		.of_match_table = snd_rpi_hifiberry_adc_of_match,
++	},
++	.probe          = snd_rpi_hifiberry_adc_probe,
++};
++
++module_platform_driver(snd_rpi_hifiberry_adc_driver);
++
++MODULE_AUTHOR("Joerg Schambacher <joerg@hifiberry.com>");
++MODULE_DESCRIPTION("ASoC Driver for HiFiBerry ADC");
++MODULE_LICENSE("GPL");
+--- /dev/null
++++ b/sound/soc/bcm/hifiberry_adc_controls.h
+@@ -0,0 +1,128 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * ALSA mixer/Kcontrol definitions common to HiFiBerry ADCs
++ *
++ * used by	DAC+ADC Pro (hifiberry_dacplusadcpro.c),
++ *		ADC (hifiberry_adc.c)
++ *
++ * Author:	Joerg Schambacher <joerg@hifiberry.com>
++ *		Copyright 2024
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++static const unsigned int pcm186x_adc_input_channel_sel_value[] = {
++	0x00, 0x01, 0x02, 0x03, 0x10
++};
++
++static const char * const pcm186x_adcl_input_channel_sel_text[] = {
++	"No Select",
++	"VINL1[SE]",					/* Default for ADCL */
++	"VINL2[SE]",
++	"VINL2[SE] + VINL1[SE]",
++	"{VIN1P, VIN1M}[DIFF]"
++};
++
++static const char * const pcm186x_adcr_input_channel_sel_text[] = {
++	"No Select",
++	"VINR1[SE]",					/* Default for ADCR */
++	"VINR2[SE]",
++	"VINR2[SE] + VINR1[SE]",
++	"{VIN2P, VIN2M}[DIFF]"
++};
++
++static const struct soc_enum pcm186x_adc_input_channel_sel[] = {
++	SOC_VALUE_ENUM_SINGLE(PCM186X_ADC1_INPUT_SEL_L, 0,
++			      PCM186X_ADC_INPUT_SEL_MASK,
++			      ARRAY_SIZE(pcm186x_adcl_input_channel_sel_text),
++			      pcm186x_adcl_input_channel_sel_text,
++			      pcm186x_adc_input_channel_sel_value),
++	SOC_VALUE_ENUM_SINGLE(PCM186X_ADC1_INPUT_SEL_R, 0,
++			      PCM186X_ADC_INPUT_SEL_MASK,
++			      ARRAY_SIZE(pcm186x_adcr_input_channel_sel_text),
++			      pcm186x_adcr_input_channel_sel_text,
++			      pcm186x_adc_input_channel_sel_value),
++};
++
++static const unsigned int pcm186x_mic_bias_sel_value[] = {
++	0x00, 0x01, 0x11
++};
++
++static const char * const pcm186x_mic_bias_sel_text[] = {
++	"Mic Bias off",
++	"Mic Bias on",
++	"Mic Bias with Bypass Resistor"
++};
++
++static const struct soc_enum pcm186x_mic_bias_sel[] = {
++	SOC_VALUE_ENUM_SINGLE(PCM186X_MIC_BIAS_CTRL, 0,
++			      GENMASK(4, 0),
++			      ARRAY_SIZE(pcm186x_mic_bias_sel_text),
++			      pcm186x_mic_bias_sel_text,
++			      pcm186x_mic_bias_sel_value),
++};
++
++static const unsigned int pcm186x_gain_sel_value[] = {
++	0xe8, 0xe9, 0xea, 0xeb, 0xec, 0xed, 0xee, 0xef,
++	0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
++	0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff,
++	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
++	0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
++	0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
++	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
++	0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
++	0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
++	0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
++	0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
++	0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
++	0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f,
++	0x50
++};
++
++static const char * const pcm186x_gain_sel_text[] = {
++	"-12.0dB", "-11.5dB", "-11.0dB", "-10.5dB", "-10.0dB", "-9.5dB",
++	"-9.0dB", "-8.5dB", "-8.0dB", "-7.5dB", "-7.0dB", "-6.5dB",
++	"-6.0dB", "-5.5dB", "-5.0dB", "-4.5dB", "-4.0dB", "-3.5dB",
++	"-3.0dB", "-2.5dB", "-2.0dB", "-1.5dB", "-1.0dB", "-0.5dB",
++	"0.0dB", "0.5dB", "1.0dB", "1.5dB", "2.0dB", "2.5dB",
++	"3.0dB", "3.5dB", "4.0dB", "4.5dB", "5.0dB", "5.5dB",
++	"6.0dB", "6.5dB", "7.0dB", "7.5dB", "8.0dB", "8.5dB",
++	"9.0dB", "9.5dB", "10.0dB", "10.5dB", "11.0dB", "11.5dB",
++	"12.0dB", "12.5dB", "13.0dB", "13.5dB", "14.0dB", "14.5dB",
++	"15.0dB", "15.5dB", "16.0dB", "16.5dB", "17.0dB", "17.5dB",
++	"18.0dB", "18.5dB", "19.0dB", "19.5dB", "20.0dB", "20.5dB",
++	"21.0dB", "21.5dB", "22.0dB", "22.5dB", "23.0dB", "23.5dB",
++	"24.0dB", "24.5dB", "25.0dB", "25.5dB", "26.0dB", "26.5dB",
++	"27.0dB", "27.5dB", "28.0dB", "28.5dB", "29.0dB", "29.5dB",
++	"30.0dB", "30.5dB", "31.0dB", "31.5dB", "32.0dB", "32.5dB",
++	"33.0dB", "33.5dB", "34.0dB", "34.5dB", "35.0dB", "35.5dB",
++	"36.0dB", "36.5dB", "37.0dB", "37.5dB", "38.0dB", "38.5dB",
++	"39.0dB", "39.5dB", "40.0dB"};
++
++static const struct soc_enum pcm186x_gain_sel[] = {
++	SOC_VALUE_ENUM_SINGLE(PCM186X_PGA_VAL_CH1_L, 0,
++			      0xff,
++			      ARRAY_SIZE(pcm186x_gain_sel_text),
++			      pcm186x_gain_sel_text,
++			      pcm186x_gain_sel_value),
++	SOC_VALUE_ENUM_SINGLE(PCM186X_PGA_VAL_CH1_R, 0,
++			      0xff,
++			      ARRAY_SIZE(pcm186x_gain_sel_text),
++			      pcm186x_gain_sel_text,
++			      pcm186x_gain_sel_value),
++};
++
++static const struct snd_kcontrol_new pcm1863_snd_controls_card[] = {
++	SOC_ENUM("ADC Left Input", pcm186x_adc_input_channel_sel[0]),
++	SOC_ENUM("ADC Right Input", pcm186x_adc_input_channel_sel[1]),
++	SOC_ENUM("ADC Mic Bias", pcm186x_mic_bias_sel),
++	SOC_ENUM("PGA Gain Left", pcm186x_gain_sel[0]),
++	SOC_ENUM("PGA Gain Right", pcm186x_gain_sel[1]),
++};
+--- /dev/null
++++ b/sound/soc/bcm/hifiberry_dacplus.c
+@@ -0,0 +1,563 @@
++/*
++ * ASoC Driver for HiFiBerry DAC+ / DAC Pro / AMP100
++ *
++ * Author:	Daniel Matuschek, Stuart MacLean <stuart@hifiberry.com>
++ *		Copyright 2014-2015
++ *		based on code by Florian Meier <florian.meier@koalo.de>
++ *		Headphone/AMP100 Joerg Schambacher <joerg@hifiberry.com>
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/gpio/consumer.h>
++#include <../drivers/gpio/gpiolib.h>
++#include <linux/platform_device.h>
++#include <linux/kernel.h>
++#include <linux/clk.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/slab.h>
++#include <linux/delay.h>
++#include <linux/i2c.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++
++#include "../codecs/pcm512x.h"
++
++#define HIFIBERRY_DACPRO_NOCLOCK 0
++#define HIFIBERRY_DACPRO_CLK44EN 1
++#define HIFIBERRY_DACPRO_CLK48EN 2
++
++struct pcm512x_priv {
++	struct regmap *regmap;
++	struct clk *sclk;
++};
++
++/* Clock rate of CLK44EN attached to GPIO6 pin */
++#define CLK_44EN_RATE 22579200UL
++/* Clock rate of CLK48EN attached to GPIO3 pin */
++#define CLK_48EN_RATE 24576000UL
++
++static bool slave;
++static bool snd_rpi_hifiberry_is_dacpro;
++static bool digital_gain_0db_limit = true;
++static bool leds_off;
++static bool auto_mute;
++static int mute_ext_ctl;
++static int mute_ext;
++static bool tas_device;
++static struct gpio_desc *snd_mute_gpio;
++static struct gpio_desc *snd_reset_gpio;
++static struct snd_soc_card snd_rpi_hifiberry_dacplus;
++
++static const u32 master_dai_rates[] = {
++	44100, 48000, 88200, 96000,
++	176400, 192000, 352800, 384000,
++};
++
++static const struct snd_pcm_hw_constraint_list constraints_master = {
++	.count = ARRAY_SIZE(master_dai_rates),
++	.list  = master_dai_rates,
++};
++
++static int snd_rpi_hifiberry_dacplus_mute_set(int mute)
++{
++	gpiod_set_value_cansleep(snd_mute_gpio, mute);
++	return 1;
++}
++
++static int snd_rpi_hifiberry_dacplus_mute_get(struct snd_kcontrol *kcontrol,
++				struct snd_ctl_elem_value *ucontrol)
++{
++	ucontrol->value.integer.value[0] = mute_ext;
++
++	return 0;
++}
++
++static int snd_rpi_hifiberry_dacplus_mute_put(struct snd_kcontrol *kcontrol,
++				struct snd_ctl_elem_value *ucontrol)
++{
++	if (mute_ext == ucontrol->value.integer.value[0])
++		return 0;
++
++	mute_ext = ucontrol->value.integer.value[0];
++
++	return snd_rpi_hifiberry_dacplus_mute_set(mute_ext);
++}
++
++static const char * const mute_text[] = {"Play", "Mute"};
++static const struct soc_enum hb_dacplus_opt_mute_enum =
++	SOC_ENUM_SINGLE_EXT(2, mute_text);
++
++static const struct snd_kcontrol_new hb_dacplus_opt_mute_controls[] = {
++	SOC_ENUM_EXT("Mute(ext)", hb_dacplus_opt_mute_enum,
++			      snd_rpi_hifiberry_dacplus_mute_get,
++			      snd_rpi_hifiberry_dacplus_mute_put),
++};
++
++static void snd_rpi_hifiberry_dacplus_select_clk(struct snd_soc_component *component,
++	int clk_id)
++{
++	switch (clk_id) {
++	case HIFIBERRY_DACPRO_NOCLOCK:
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x00);
++		break;
++	case HIFIBERRY_DACPRO_CLK44EN:
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x20);
++		break;
++	case HIFIBERRY_DACPRO_CLK48EN:
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x04);
++		break;
++	}
++	usleep_range(3000, 4000);
++}
++
++static void snd_rpi_hifiberry_dacplus_clk_gpio(struct snd_soc_component *component)
++{
++	snd_soc_component_update_bits(component, PCM512x_GPIO_EN, 0x24, 0x24);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_3, 0x0f, 0x02);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_6, 0x0f, 0x02);
++}
++
++static bool snd_rpi_hifiberry_dacplus_is_sclk(struct snd_soc_component *component)
++{
++	unsigned int sck;
++
++	sck = snd_soc_component_read(component, PCM512x_RATE_DET_4);
++	return (!(sck & 0x40));
++}
++
++static bool snd_rpi_hifiberry_dacplus_is_pro_card(struct snd_soc_component *component)
++{
++	bool isClk44EN, isClk48En, isNoClk;
++
++	snd_rpi_hifiberry_dacplus_clk_gpio(component);
++
++	snd_rpi_hifiberry_dacplus_select_clk(component, HIFIBERRY_DACPRO_CLK44EN);
++	isClk44EN = snd_rpi_hifiberry_dacplus_is_sclk(component);
++
++	snd_rpi_hifiberry_dacplus_select_clk(component, HIFIBERRY_DACPRO_NOCLOCK);
++	isNoClk = snd_rpi_hifiberry_dacplus_is_sclk(component);
++
++	snd_rpi_hifiberry_dacplus_select_clk(component, HIFIBERRY_DACPRO_CLK48EN);
++	isClk48En = snd_rpi_hifiberry_dacplus_is_sclk(component);
++
++	return (isClk44EN && isClk48En && !isNoClk);
++}
++
++static int snd_rpi_hifiberry_dacplus_clk_for_rate(int sample_rate)
++{
++	int type;
++
++	switch (sample_rate) {
++	case 11025:
++	case 22050:
++	case 44100:
++	case 88200:
++	case 176400:
++	case 352800:
++		type = HIFIBERRY_DACPRO_CLK44EN;
++		break;
++	default:
++		type = HIFIBERRY_DACPRO_CLK48EN;
++		break;
++	}
++	return type;
++}
++
++static void snd_rpi_hifiberry_dacplus_set_sclk(struct snd_soc_component *component,
++	int sample_rate)
++{
++	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
++
++	if (!IS_ERR(pcm512x->sclk)) {
++		int ctype;
++
++		ctype = snd_rpi_hifiberry_dacplus_clk_for_rate(sample_rate);
++		clk_set_rate(pcm512x->sclk, (ctype == HIFIBERRY_DACPRO_CLK44EN)
++			? CLK_44EN_RATE : CLK_48EN_RATE);
++		snd_rpi_hifiberry_dacplus_select_clk(component, ctype);
++	}
++}
++
++static int snd_rpi_hifiberry_dacplus_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++	struct pcm512x_priv *priv;
++	struct snd_soc_card *card = &snd_rpi_hifiberry_dacplus;
++
++	if (slave)
++		snd_rpi_hifiberry_is_dacpro = false;
++	else
++		snd_rpi_hifiberry_is_dacpro =
++				snd_rpi_hifiberry_dacplus_is_pro_card(component);
++
++	if (snd_rpi_hifiberry_is_dacpro) {
++		struct snd_soc_dai_link *dai = rtd->dai_link;
++
++		if (tas_device) {
++			dai->name = "HiFiBerry AMP4 Pro";
++			dai->stream_name = "HiFiBerry AMP4 Pro HiFi";
++		} else {
++			dai->name = "HiFiBerry DAC+ Pro";
++			dai->stream_name = "HiFiBerry DAC+ Pro HiFi";
++		}
++		dai->dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
++			| SND_SOC_DAIFMT_CBM_CFM;
++
++		snd_soc_component_update_bits(component, PCM512x_BCLK_LRCLK_CFG, 0x31, 0x11);
++		snd_soc_component_update_bits(component, PCM512x_MASTER_MODE, 0x03, 0x03);
++		snd_soc_component_update_bits(component, PCM512x_MASTER_CLKDIV_2, 0x7f, 63);
++	} else {
++		priv = snd_soc_component_get_drvdata(component);
++		priv->sclk = ERR_PTR(-ENOENT);
++	}
++
++	snd_soc_component_update_bits(component, PCM512x_GPIO_EN, 0x08, 0x08);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_4, 0x0f, 0x02);
++	if (leds_off)
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08, 0x00);
++	else
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
++
++	if (digital_gain_0db_limit) {
++		int ret;
++		struct snd_soc_card *card = rtd->card;
++
++		ret = snd_soc_limit_volume(card, "Digital Playback Volume", 207);
++		if (ret < 0)
++			dev_warn(card->dev, "Failed to set volume limit: %d\n", ret);
++	}
++	if (snd_reset_gpio) {
++		gpiod_set_value_cansleep(snd_reset_gpio, 0);
++		msleep(1);
++		gpiod_set_value_cansleep(snd_reset_gpio, 1);
++		msleep(1);
++		gpiod_set_value_cansleep(snd_reset_gpio, 0);
++	}
++
++	if (mute_ext_ctl)
++		snd_soc_add_card_controls(card,	hb_dacplus_opt_mute_controls,
++				ARRAY_SIZE(hb_dacplus_opt_mute_controls));
++
++	if (snd_mute_gpio)
++		gpiod_set_value_cansleep(snd_mute_gpio,	mute_ext);
++
++	return 0;
++}
++
++static int snd_rpi_hifiberry_dacplus_update_rate_den(
++	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
++	struct snd_ratnum *rats_no_pll;
++	unsigned int num = 0, den = 0;
++	int err;
++
++	rats_no_pll = devm_kzalloc(rtd->dev, sizeof(*rats_no_pll), GFP_KERNEL);
++	if (!rats_no_pll)
++		return -ENOMEM;
++
++	rats_no_pll->num = clk_get_rate(pcm512x->sclk) / 64;
++	rats_no_pll->den_min = 1;
++	rats_no_pll->den_max = 128;
++	rats_no_pll->den_step = 1;
++
++	err = snd_interval_ratnum(hw_param_interval(params,
++		SNDRV_PCM_HW_PARAM_RATE), 1, rats_no_pll, &num, &den);
++	if (err >= 0 && den) {
++		params->rate_num = num;
++		params->rate_den = den;
++	}
++
++	devm_kfree(rtd->dev, rats_no_pll);
++	return 0;
++}
++
++static int snd_rpi_hifiberry_dacplus_hw_params(
++	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
++{
++	int ret = 0;
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	int channels = params_channels(params);
++	int width = snd_pcm_format_width(params_format(params));
++
++	/* Using powers of 2 allows for an integer clock divisor */
++	width = width <= 16 ? 16 : 32;
++
++	if (snd_rpi_hifiberry_is_dacpro) {
++		struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++
++		snd_rpi_hifiberry_dacplus_set_sclk(component,
++			params_rate(params));
++
++		ret = snd_rpi_hifiberry_dacplus_update_rate_den(
++			substream, params);
++	}
++
++	ret = snd_soc_dai_set_bclk_ratio(snd_soc_rtd_to_cpu(rtd, 0), channels * width);
++	if (ret)
++		return ret;
++	ret = snd_soc_dai_set_bclk_ratio(snd_soc_rtd_to_codec(rtd, 0), channels * width);
++	return ret;
++}
++
++static int snd_rpi_hifiberry_dacplus_startup(
++	struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++	int ret;
++
++	if (tas_device && !slave) {
++		ret = snd_pcm_hw_constraint_list(substream->runtime, 0,
++					  SNDRV_PCM_HW_PARAM_RATE,
++					  &constraints_master);
++		if (ret < 0) {
++			dev_err(rtd->card->dev,
++				"Cannot apply constraints for sample rates\n");
++			return ret;
++		}
++	}
++
++	if (auto_mute)
++		gpiod_set_value_cansleep(snd_mute_gpio, 0);
++	if (leds_off)
++		return 0;
++	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
++	return 0;
++}
++
++static void snd_rpi_hifiberry_dacplus_shutdown(
++	struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++
++	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08, 0x00);
++	if (auto_mute)
++		gpiod_set_value_cansleep(snd_mute_gpio, 1);
++}
++
++/* machine stream operations */
++static const struct snd_soc_ops snd_rpi_hifiberry_dacplus_ops = {
++	.hw_params = snd_rpi_hifiberry_dacplus_hw_params,
++	.startup = snd_rpi_hifiberry_dacplus_startup,
++	.shutdown = snd_rpi_hifiberry_dacplus_shutdown,
++};
++
++SND_SOC_DAILINK_DEFS(rpi_hifiberry_dacplus,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm512x.1-004d", "pcm512x-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_hifiberry_dacplus_dai[] = {
++{
++	.name		= "HiFiBerry DAC+",
++	.stream_name	= "HiFiBerry DAC+ HiFi",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBS_CFS,
++	.ops		= &snd_rpi_hifiberry_dacplus_ops,
++	.init		= snd_rpi_hifiberry_dacplus_init,
++	SND_SOC_DAILINK_REG(rpi_hifiberry_dacplus),
++},
++};
++
++/* aux device for optional headphone amp */
++static struct snd_soc_aux_dev hifiberry_dacplus_aux_devs[] = {
++	{
++		.dlc = {
++			.name = "tpa6130a2.1-0060",
++		},
++	},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_hifiberry_dacplus = {
++	.name         = "snd_rpi_hifiberry_dacplus",
++	.driver_name  = "HifiberryDacp",
++	.owner        = THIS_MODULE,
++	.dai_link     = snd_rpi_hifiberry_dacplus_dai,
++	.num_links    = ARRAY_SIZE(snd_rpi_hifiberry_dacplus_dai),
++};
++
++static int hb_hp_detect(void)
++{
++	struct i2c_adapter *adap = i2c_get_adapter(1);
++	int ret;
++	struct i2c_client tpa_i2c_client = {
++		.addr = 0x60,
++		.adapter = adap,
++	};
++
++	if (!adap)
++		return -EPROBE_DEFER;	/* I2C module not yet available */
++
++	ret = i2c_smbus_read_byte(&tpa_i2c_client) >= 0;
++	i2c_put_adapter(adap);
++	return ret;
++};
++
++static struct property tpa_enable_prop = {
++	       .name = "status",
++	       .length = 4 + 1, /* length 'okay' + 1 */
++	       .value = "okay",
++	};
++
++static int snd_rpi_hifiberry_dacplus_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++	struct snd_soc_card *card = &snd_rpi_hifiberry_dacplus;
++	int len;
++	struct device_node *tpa_node;
++	struct device_node *tas_node;
++	struct property *tpa_prop;
++	struct of_changeset ocs;
++	struct property *pp;
++	int tmp;
++
++	/* probe for head phone amp */
++	ret = hb_hp_detect();
++	if (ret < 0)
++		return ret;
++	if (ret) {
++		card->aux_dev = hifiberry_dacplus_aux_devs;
++		card->num_aux_devs =
++				ARRAY_SIZE(hifiberry_dacplus_aux_devs);
++		tpa_node = of_find_compatible_node(NULL, NULL, "ti,tpa6130a2");
++		tpa_prop = of_find_property(tpa_node, "status", &len);
++
++		if (strcmp((char *)tpa_prop->value, "okay")) {
++			/* and activate headphone using change_sets */
++			dev_info(&pdev->dev, "activating headphone amplifier");
++			of_changeset_init(&ocs);
++			ret = of_changeset_update_property(&ocs, tpa_node,
++							&tpa_enable_prop);
++			if (ret) {
++				dev_err(&pdev->dev,
++				"cannot activate headphone amplifier\n");
++				return -ENODEV;
++			}
++			ret = of_changeset_apply(&ocs);
++			if (ret) {
++				dev_err(&pdev->dev,
++				"cannot activate headphone amplifier\n");
++				return -ENODEV;
++			}
++		}
++	}
++
++	tas_node = of_find_compatible_node(NULL, NULL, "ti,tas5756");
++	if (tas_node) {
++		tas_device = true;
++		dev_info(&pdev->dev, "TAS5756 device found!\n");
++	};
++
++	snd_rpi_hifiberry_dacplus.dev = &pdev->dev;
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai;
++
++		dai = &snd_rpi_hifiberry_dacplus_dai[0];
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++			"i2s-controller", 0);
++
++		if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++		}
++
++		digital_gain_0db_limit = !of_property_read_bool(
++			pdev->dev.of_node, "hifiberry,24db_digital_gain");
++		slave = of_property_read_bool(pdev->dev.of_node,
++						"hifiberry-dacplus,slave");
++		leds_off = of_property_read_bool(pdev->dev.of_node,
++						"hifiberry-dacplus,leds_off");
++		auto_mute = of_property_read_bool(pdev->dev.of_node,
++						"hifiberry-dacplus,auto_mute");
++
++		/*
++		 * check for HW MUTE as defined in DT-overlay
++		 * active high, therefore default to HIGH to MUTE
++		 */
++		snd_mute_gpio =	devm_gpiod_get_optional(&pdev->dev,
++						 "mute", GPIOD_OUT_HIGH);
++		if (IS_ERR(snd_mute_gpio)) {
++			dev_err(&pdev->dev, "Can't allocate GPIO (HW-MUTE)");
++			return PTR_ERR(snd_mute_gpio);
++		}
++
++		/* add ALSA control if requested in DT-overlay (AMP100) */
++		pp = of_find_property(pdev->dev.of_node,
++				"hifiberry-dacplus,mute_ext_ctl", &tmp);
++		if (pp) {
++			if (!of_property_read_u32(pdev->dev.of_node,
++				"hifiberry-dacplus,mute_ext_ctl", &mute_ext)) {
++				/* ALSA control will be used */
++				mute_ext_ctl = 1;
++			}
++		}
++
++		/* check for HW RESET (AMP100) */
++		snd_reset_gpio = devm_gpiod_get_optional(&pdev->dev,
++						"reset", GPIOD_OUT_HIGH);
++		if (IS_ERR(snd_reset_gpio)) {
++			dev_err(&pdev->dev, "Can't allocate GPIO (HW-RESET)");
++			return PTR_ERR(snd_reset_gpio);
++		}
++
++	}
++
++	ret = devm_snd_soc_register_card(&pdev->dev,
++			&snd_rpi_hifiberry_dacplus);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev,
++			"snd_soc_register_card() failed: %d\n", ret);
++	if (!ret) {
++		if (snd_mute_gpio)
++			dev_info(&pdev->dev, "GPIO%i for HW-MUTE selected",
++					gpio_chip_hwgpio(snd_mute_gpio));
++		if (snd_reset_gpio)
++			dev_info(&pdev->dev, "GPIO%i for HW-RESET selected",
++					gpio_chip_hwgpio(snd_reset_gpio));
++	}
++	return ret;
++}
++
++static const struct of_device_id snd_rpi_hifiberry_dacplus_of_match[] = {
++	{ .compatible = "hifiberry,hifiberry-dacplus", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, snd_rpi_hifiberry_dacplus_of_match);
++
++static struct platform_driver snd_rpi_hifiberry_dacplus_driver = {
++	.driver = {
++		.name   = "snd-rpi-hifiberry-dacplus",
++		.owner  = THIS_MODULE,
++		.of_match_table = snd_rpi_hifiberry_dacplus_of_match,
++	},
++	.probe          = snd_rpi_hifiberry_dacplus_probe,
++};
++
++module_platform_driver(snd_rpi_hifiberry_dacplus_driver);
++
++MODULE_AUTHOR("Daniel Matuschek <daniel@hifiberry.com>");
++MODULE_DESCRIPTION("ASoC Driver for HiFiBerry DAC+");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/hifiberry_dacplusadc.c
+@@ -0,0 +1,399 @@
++/*
++ * ASoC Driver for HiFiBerry DAC+ / DAC Pro with ADC
++ *
++ * Author:	Daniel Matuschek, Stuart MacLean <stuart@hifiberry.com>
++ *		Copyright 2014-2015
++ *		based on code by Florian Meier <florian.meier@koalo.de>
++ *		ADC added by Joerg Schambacher <joscha@schambacher.com>
++ *		Copyright 2018
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/kernel.h>
++#include <linux/clk.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/slab.h>
++#include <linux/delay.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++
++#include "../codecs/pcm512x.h"
++
++#define HIFIBERRY_DACPRO_NOCLOCK 0
++#define HIFIBERRY_DACPRO_CLK44EN 1
++#define HIFIBERRY_DACPRO_CLK48EN 2
++
++struct platform_device *dmic_codec_dev;
++
++struct pcm512x_priv {
++	struct regmap *regmap;
++	struct clk *sclk;
++};
++
++/* Clock rate of CLK44EN attached to GPIO6 pin */
++#define CLK_44EN_RATE 22579200UL
++/* Clock rate of CLK48EN attached to GPIO3 pin */
++#define CLK_48EN_RATE 24576000UL
++
++static bool slave;
++static bool snd_rpi_hifiberry_is_dacpro;
++static bool digital_gain_0db_limit = true;
++static bool leds_off;
++
++static void snd_rpi_hifiberry_dacplusadc_select_clk(struct snd_soc_component *component,
++	int clk_id)
++{
++	switch (clk_id) {
++	case HIFIBERRY_DACPRO_NOCLOCK:
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x00);
++		break;
++	case HIFIBERRY_DACPRO_CLK44EN:
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x20);
++		break;
++	case HIFIBERRY_DACPRO_CLK48EN:
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x04);
++		break;
++	}
++}
++
++static void snd_rpi_hifiberry_dacplusadc_clk_gpio(struct snd_soc_component *component)
++{
++	snd_soc_component_update_bits(component, PCM512x_GPIO_EN, 0x24, 0x24);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_3, 0x0f, 0x02);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_6, 0x0f, 0x02);
++}
++
++static bool snd_rpi_hifiberry_dacplusadc_is_sclk(struct snd_soc_component *component)
++{
++	unsigned int sck;
++
++	sck = snd_soc_component_read(component, PCM512x_RATE_DET_4);
++	return (!(sck & 0x40));
++}
++
++static bool snd_rpi_hifiberry_dacplusadc_is_sclk_sleep(
++	struct snd_soc_component *component)
++{
++	msleep(2);
++	return snd_rpi_hifiberry_dacplusadc_is_sclk(component);
++}
++
++static bool snd_rpi_hifiberry_dacplusadc_is_pro_card(struct snd_soc_component *component)
++{
++	bool isClk44EN, isClk48En, isNoClk;
++
++	snd_rpi_hifiberry_dacplusadc_clk_gpio(component);
++
++	snd_rpi_hifiberry_dacplusadc_select_clk(component, HIFIBERRY_DACPRO_CLK44EN);
++	isClk44EN = snd_rpi_hifiberry_dacplusadc_is_sclk_sleep(component);
++
++	snd_rpi_hifiberry_dacplusadc_select_clk(component, HIFIBERRY_DACPRO_NOCLOCK);
++	isNoClk = snd_rpi_hifiberry_dacplusadc_is_sclk_sleep(component);
++
++	snd_rpi_hifiberry_dacplusadc_select_clk(component, HIFIBERRY_DACPRO_CLK48EN);
++	isClk48En = snd_rpi_hifiberry_dacplusadc_is_sclk_sleep(component);
++
++	return (isClk44EN && isClk48En && !isNoClk);
++}
++
++static int snd_rpi_hifiberry_dacplusadc_clk_for_rate(int sample_rate)
++{
++	int type;
++
++	switch (sample_rate) {
++	case 11025:
++	case 22050:
++	case 44100:
++	case 88200:
++	case 176400:
++	case 352800:
++		type = HIFIBERRY_DACPRO_CLK44EN;
++		break;
++	default:
++		type = HIFIBERRY_DACPRO_CLK48EN;
++		break;
++	}
++	return type;
++}
++
++static void snd_rpi_hifiberry_dacplusadc_set_sclk(struct snd_soc_component *component,
++	int sample_rate)
++{
++	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
++
++	if (!IS_ERR(pcm512x->sclk)) {
++		int ctype;
++
++		ctype = snd_rpi_hifiberry_dacplusadc_clk_for_rate(sample_rate);
++		clk_set_rate(pcm512x->sclk, (ctype == HIFIBERRY_DACPRO_CLK44EN)
++			? CLK_44EN_RATE : CLK_48EN_RATE);
++		snd_rpi_hifiberry_dacplusadc_select_clk(component, ctype);
++	}
++}
++
++static int snd_rpi_hifiberry_dacplusadc_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++	struct pcm512x_priv *priv;
++
++	if (slave)
++		snd_rpi_hifiberry_is_dacpro = false;
++	else
++		snd_rpi_hifiberry_is_dacpro =
++				snd_rpi_hifiberry_dacplusadc_is_pro_card(component);
++
++	if (snd_rpi_hifiberry_is_dacpro) {
++		struct snd_soc_dai_link *dai = rtd->dai_link;
++
++		dai->name = "HiFiBerry ADCDAC+ Pro";
++		dai->stream_name = "HiFiBerry ADCDAC+ Pro HiFi";
++		dai->dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
++			| SND_SOC_DAIFMT_CBM_CFM;
++
++		snd_soc_component_update_bits(component, PCM512x_BCLK_LRCLK_CFG, 0x31, 0x11);
++		snd_soc_component_update_bits(component, PCM512x_MASTER_MODE, 0x03, 0x03);
++		snd_soc_component_update_bits(component, PCM512x_MASTER_CLKDIV_2, 0x7f, 63);
++	} else {
++		priv = snd_soc_component_get_drvdata(component);
++		priv->sclk = ERR_PTR(-ENOENT);
++	}
++
++	snd_soc_component_update_bits(component, PCM512x_GPIO_EN, 0x08, 0x08);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_4, 0x0f, 0x02);
++	if (leds_off)
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08, 0x00);
++	else
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
++
++	if (digital_gain_0db_limit) {
++		int ret;
++		struct snd_soc_card *card = rtd->card;
++
++		ret = snd_soc_limit_volume(card, "Digital Playback Volume", 207);
++		if (ret < 0)
++			dev_warn(card->dev, "Failed to set volume limit: %d\n", ret);
++	}
++
++	return 0;
++}
++
++static int snd_rpi_hifiberry_dacplusadc_update_rate_den(
++	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
++	struct snd_ratnum *rats_no_pll;
++	unsigned int num = 0, den = 0;
++	int err;
++
++	rats_no_pll = devm_kzalloc(rtd->dev, sizeof(*rats_no_pll), GFP_KERNEL);
++	if (!rats_no_pll)
++		return -ENOMEM;
++
++	rats_no_pll->num = clk_get_rate(pcm512x->sclk) / 64;
++	rats_no_pll->den_min = 1;
++	rats_no_pll->den_max = 128;
++	rats_no_pll->den_step = 1;
++
++	err = snd_interval_ratnum(hw_param_interval(params,
++		SNDRV_PCM_HW_PARAM_RATE), 1, rats_no_pll, &num, &den);
++	if (err >= 0 && den) {
++		params->rate_num = num;
++		params->rate_den = den;
++	}
++
++	devm_kfree(rtd->dev, rats_no_pll);
++	return 0;
++}
++
++static int snd_rpi_hifiberry_dacplusadc_hw_params(
++	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
++{
++	int ret = 0;
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	int channels = params_channels(params);
++	int width = snd_pcm_format_width(params_format(params));
++
++	/* Using powers of 2 allows for an integer clock divisor */
++	width = width <= 16 ? 16 : 32;
++
++	if (snd_rpi_hifiberry_is_dacpro) {
++		struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++
++		snd_rpi_hifiberry_dacplusadc_set_sclk(component,
++			params_rate(params));
++
++		ret = snd_rpi_hifiberry_dacplusadc_update_rate_den(
++			substream, params);
++	}
++
++	ret = snd_soc_dai_set_bclk_ratio(snd_soc_rtd_to_cpu(rtd, 0), channels * width);
++	if (ret)
++		return ret;
++	ret = snd_soc_dai_set_bclk_ratio(snd_soc_rtd_to_codec(rtd, 0), channels * width);
++	return ret;
++}
++
++static int hifiberry_dacplusadc_LED_cnt;
++
++static int snd_rpi_hifiberry_dacplusadc_startup(
++	struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++
++	if (leds_off)
++		return 0;
++	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1,
++					 0x08, 0x08);
++	hifiberry_dacplusadc_LED_cnt++;
++	return 0;
++}
++
++static void snd_rpi_hifiberry_dacplusadc_shutdown(
++	struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++
++	hifiberry_dacplusadc_LED_cnt--;
++	if (!hifiberry_dacplusadc_LED_cnt)
++		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1,
++						 0x08, 0x00);
++}
++
++/* machine stream operations */
++static struct snd_soc_ops snd_rpi_hifiberry_dacplusadc_ops = {
++	.hw_params = snd_rpi_hifiberry_dacplusadc_hw_params,
++	.startup = snd_rpi_hifiberry_dacplusadc_startup,
++	.shutdown = snd_rpi_hifiberry_dacplusadc_shutdown,
++};
++
++SND_SOC_DAILINK_DEFS(hifi,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm512x.1-004d", "pcm512x-hifi"),
++			   COMP_CODEC("dmic-codec", "dmic-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_hifiberry_dacplusadc_dai[] = {
++{
++	.name		= "HiFiBerry DAC+ADC",
++	.stream_name	= "HiFiBerry DAC+ADC HiFi",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBS_CFS,
++	.ops		= &snd_rpi_hifiberry_dacplusadc_ops,
++	.init		= snd_rpi_hifiberry_dacplusadc_init,
++	SND_SOC_DAILINK_REG(hifi),
++},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_hifiberry_dacplusadc = {
++	.name         = "snd_rpi_hifiberry_dacplusadc",
++	.driver_name  = "HifiberryDacpAdc",
++	.owner        = THIS_MODULE,
++	.dai_link     = snd_rpi_hifiberry_dacplusadc_dai,
++	.num_links    = ARRAY_SIZE(snd_rpi_hifiberry_dacplusadc_dai),
++};
++
++
++static int snd_rpi_hifiberry_dacplusadc_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++
++	snd_rpi_hifiberry_dacplusadc.dev = &pdev->dev;
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai;
++
++		dai = &snd_rpi_hifiberry_dacplusadc_dai[0];
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++			"i2s-controller", 0);
++		if (i2s_node) {
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->of_node = i2s_node;
++			dai->cpus->dai_name = NULL;
++			dai->platforms->name = NULL;
++		}
++	}
++	digital_gain_0db_limit = !of_property_read_bool(
++		pdev->dev.of_node, "hifiberry,24db_digital_gain");
++	slave = of_property_read_bool(pdev->dev.of_node,
++					"hifiberry-dacplusadc,slave");
++	leds_off = of_property_read_bool(pdev->dev.of_node,
++					"hifiberry-dacplusadc,leds_off");
++
++	ret = devm_snd_soc_register_card(&pdev->dev,
++						 &snd_rpi_hifiberry_dacplusadc);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev,
++			"snd_soc_register_card() failed: %d\n", ret);
++
++	return ret;
++}
++
++static const struct of_device_id snd_rpi_hifiberry_dacplusadc_of_match[] = {
++	{ .compatible = "hifiberry,hifiberry-dacplusadc", },
++	{},
++};
++
++MODULE_DEVICE_TABLE(of, snd_rpi_hifiberry_dacplusadc_of_match);
++
++static struct platform_driver snd_rpi_hifiberry_dacplusadc_driver = {
++	.driver = {
++		.name   = "snd-rpi-hifiberry-dacplusadc",
++		.owner  = THIS_MODULE,
++		.of_match_table = snd_rpi_hifiberry_dacplusadc_of_match,
++	},
++	.probe          = snd_rpi_hifiberry_dacplusadc_probe,
++};
++
++static int __init hifiberry_dacplusadc_init(void)
++{
++	int ret;
++
++	dmic_codec_dev = platform_device_register_simple("dmic-codec", -1, NULL,
++							 0);
++	if (IS_ERR(dmic_codec_dev)) {
++		pr_err("%s: dmic-codec device registration failed\n", __func__);
++		return PTR_ERR(dmic_codec_dev);
++	}
++
++	ret = platform_driver_register(&snd_rpi_hifiberry_dacplusadc_driver);
++	if (ret) {
++		pr_err("%s: platform driver registration failed\n", __func__);
++		platform_device_unregister(dmic_codec_dev);
++	}
++
++	return ret;
++}
++module_init(hifiberry_dacplusadc_init);
++
++static void __exit hifiberry_dacplusadc_exit(void)
++{
++	platform_driver_unregister(&snd_rpi_hifiberry_dacplusadc_driver);
++	platform_device_unregister(dmic_codec_dev);
++}
++module_exit(hifiberry_dacplusadc_exit);
++
++MODULE_AUTHOR("Joerg Schambacher <joscha@schambacher.com>");
++MODULE_AUTHOR("Daniel Matuschek <daniel@hifiberry.com>");
++MODULE_DESCRIPTION("ASoC Driver for HiFiBerry DAC+ADC");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/hifiberry_dacplusadcpro.c
+@@ -0,0 +1,498 @@
++/*
++ * ASoC Driver for HiFiBerry DAC+ / DAC Pro with ADC PRO Version (SW control)
++ *
++ * Author:	Daniel Matuschek, Stuart MacLean <stuart@hifiberry.com>
++ *		Copyright 2014-2015
++ *		based on code by Florian Meier <florian.meier@koalo.de>
++ *		ADC, HP added by Joerg Schambacher <joerg@hifiberry.com>
++ *		Copyright 2018-21
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/kernel.h>
++#include <linux/clk.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/slab.h>
++#include <linux/delay.h>
++#include <linux/i2c.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++#include <sound/tlv.h>
++
++#include "../codecs/pcm512x.h"
++#include "../codecs/pcm186x.h"
++#include "hifiberry_adc_controls.h"
++
++#define HIFIBERRY_DACPRO_NOCLOCK 0
++#define HIFIBERRY_DACPRO_CLK44EN 1
++#define HIFIBERRY_DACPRO_CLK48EN 2
++
++struct pcm512x_priv {
++	struct regmap *regmap;
++	struct clk *sclk;
++};
++
++/* Clock rate of CLK44EN attached to GPIO6 pin */
++#define CLK_44EN_RATE 22579200UL
++/* Clock rate of CLK48EN attached to GPIO3 pin */
++#define CLK_48EN_RATE 24576000UL
++
++static bool slave;
++static bool snd_rpi_hifiberry_is_dacpro;
++static bool digital_gain_0db_limit = true;
++static bool leds_off;
++
++static int pcm1863_add_controls(struct snd_soc_component *component)
++{
++	snd_soc_add_component_controls(component,
++			pcm1863_snd_controls_card,
++			ARRAY_SIZE(pcm1863_snd_controls_card));
++	return 0;
++}
++
++static void snd_rpi_hifiberry_dacplusadcpro_select_clk(
++					struct snd_soc_component *component, int clk_id)
++{
++	switch (clk_id) {
++	case HIFIBERRY_DACPRO_NOCLOCK:
++		snd_soc_component_update_bits(component,
++				PCM512x_GPIO_CONTROL_1, 0x24, 0x00);
++		break;
++	case HIFIBERRY_DACPRO_CLK44EN:
++		snd_soc_component_update_bits(component,
++				PCM512x_GPIO_CONTROL_1, 0x24, 0x20);
++		break;
++	case HIFIBERRY_DACPRO_CLK48EN:
++		snd_soc_component_update_bits(component,
++				PCM512x_GPIO_CONTROL_1, 0x24, 0x04);
++		break;
++	}
++	usleep_range(3000, 4000);
++}
++
++static void snd_rpi_hifiberry_dacplusadcpro_clk_gpio(struct snd_soc_component *component)
++{
++	snd_soc_component_update_bits(component, PCM512x_GPIO_EN, 0x24, 0x24);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_3, 0x0f, 0x02);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_6, 0x0f, 0x02);
++}
++
++static bool snd_rpi_hifiberry_dacplusadcpro_is_sclk(struct snd_soc_component *component)
++{
++	unsigned int sck;
++
++	sck = snd_soc_component_read(component, PCM512x_RATE_DET_4);
++	return (!(sck & 0x40));
++}
++
++static bool snd_rpi_hifiberry_dacplusadcpro_is_pro_card(struct snd_soc_component *component)
++{
++	bool isClk44EN, isClk48En, isNoClk;
++
++	snd_rpi_hifiberry_dacplusadcpro_clk_gpio(component);
++
++	snd_rpi_hifiberry_dacplusadcpro_select_clk(component, HIFIBERRY_DACPRO_CLK44EN);
++	isClk44EN = snd_rpi_hifiberry_dacplusadcpro_is_sclk(component);
++
++	snd_rpi_hifiberry_dacplusadcpro_select_clk(component, HIFIBERRY_DACPRO_NOCLOCK);
++	isNoClk = snd_rpi_hifiberry_dacplusadcpro_is_sclk(component);
++
++	snd_rpi_hifiberry_dacplusadcpro_select_clk(component, HIFIBERRY_DACPRO_CLK48EN);
++	isClk48En = snd_rpi_hifiberry_dacplusadcpro_is_sclk(component);
++
++	return (isClk44EN && isClk48En && !isNoClk);
++}
++
++static int snd_rpi_hifiberry_dacplusadcpro_clk_for_rate(int sample_rate)
++{
++	int type;
++
++	switch (sample_rate) {
++	case 11025:
++	case 22050:
++	case 44100:
++	case 88200:
++	case 176400:
++	case 352800:
++		type = HIFIBERRY_DACPRO_CLK44EN;
++		break;
++	default:
++		type = HIFIBERRY_DACPRO_CLK48EN;
++		break;
++	}
++	return type;
++}
++
++static void snd_rpi_hifiberry_dacplusadcpro_set_sclk(struct snd_soc_component *component,
++	int sample_rate)
++{
++	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
++
++	if (!IS_ERR(pcm512x->sclk)) {
++		int ctype;
++
++		ctype = snd_rpi_hifiberry_dacplusadcpro_clk_for_rate(sample_rate);
++		clk_set_rate(pcm512x->sclk, (ctype == HIFIBERRY_DACPRO_CLK44EN)
++			? CLK_44EN_RATE : CLK_48EN_RATE);
++		snd_rpi_hifiberry_dacplusadcpro_select_clk(component, ctype);
++	}
++}
++
++static int snd_rpi_hifiberry_dacplusadcpro_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_component *dac = snd_soc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_component *adc = snd_soc_rtd_to_codec(rtd, 1)->component;
++	struct snd_soc_dai_driver *adc_driver = snd_soc_rtd_to_codec(rtd, 1)->driver;
++	struct pcm512x_priv *priv;
++	int ret;
++
++	if (slave)
++		snd_rpi_hifiberry_is_dacpro = false;
++	else
++		snd_rpi_hifiberry_is_dacpro =
++				snd_rpi_hifiberry_dacplusadcpro_is_pro_card(dac);
++
++	if (snd_rpi_hifiberry_is_dacpro) {
++		struct snd_soc_dai_link *dai = rtd->dai_link;
++
++		dai->name = "HiFiBerry DAC+ADC Pro";
++		dai->stream_name = "HiFiBerry DAC+ADC Pro HiFi";
++		dai->dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
++			| SND_SOC_DAIFMT_CBM_CFM;
++
++		// set DAC DAI configuration
++		ret = snd_soc_dai_set_fmt(snd_soc_rtd_to_codec(rtd, 0),
++				SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
++			| SND_SOC_DAIFMT_CBM_CFM);
++		if (ret < 0)
++			return ret;
++
++		// set ADC DAI configuration
++		ret = snd_soc_dai_set_fmt(snd_soc_rtd_to_codec(rtd, 1),
++				SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
++			| SND_SOC_DAIFMT_CBS_CFS);
++		if (ret < 0)
++			return ret;
++
++		// set CPU DAI configuration
++		ret = snd_soc_dai_set_fmt(snd_soc_rtd_to_cpu(rtd, 0),
++			SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF | SND_SOC_DAIFMT_CBS_CFS);
++		if (ret < 0)
++			return ret;
++
++		snd_soc_component_update_bits(dac, PCM512x_BCLK_LRCLK_CFG, 0x31, 0x11);
++		snd_soc_component_update_bits(dac, PCM512x_MASTER_MODE, 0x03, 0x03);
++		snd_soc_component_update_bits(dac, PCM512x_MASTER_CLKDIV_2, 0x7f, 63);
++	} else {
++		priv = snd_soc_component_get_drvdata(dac);
++		priv->sclk = ERR_PTR(-ENOENT);
++	}
++
++	/* disable 24bit mode as long as I2S module does not have sign extension fixed */
++	adc_driver->capture.formats = SNDRV_PCM_FMTBIT_S32_LE | SNDRV_PCM_FMTBIT_S16_LE;
++
++	snd_soc_component_update_bits(dac, PCM512x_GPIO_EN, 0x08, 0x08);
++	snd_soc_component_update_bits(dac, PCM512x_GPIO_OUTPUT_4, 0x0f, 0x02);
++	if (leds_off)
++		snd_soc_component_update_bits(dac, PCM512x_GPIO_CONTROL_1, 0x08, 0x00);
++	else
++		snd_soc_component_update_bits(dac, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
++
++	ret = pcm1863_add_controls(adc);
++	if (ret < 0)
++		dev_warn(rtd->dev, "Failed to add pcm1863 controls: %d\n",
++		ret);
++
++	/* set GPIO2 to output, GPIO3 input */
++	snd_soc_component_write(adc, PCM186X_GPIO3_2_CTRL, 0x00);
++	snd_soc_component_write(adc, PCM186X_GPIO3_2_DIR_CTRL, 0x04);
++	if (leds_off)
++		snd_soc_component_update_bits(adc, PCM186X_GPIO_IN_OUT, 0x40, 0x00);
++	else
++		snd_soc_component_update_bits(adc, PCM186X_GPIO_IN_OUT, 0x40, 0x40);
++
++	if (digital_gain_0db_limit) {
++		int ret;
++		struct snd_soc_card *card = rtd->card;
++
++		ret = snd_soc_limit_volume(card, "Digital Playback Volume", 207);
++		if (ret < 0)
++			dev_warn(card->dev, "Failed to set volume limit: %d\n", ret);
++	}
++
++	return 0;
++}
++
++static int snd_rpi_hifiberry_dacplusadcpro_update_rate_den(
++	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component; /* only use DAC */
++	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
++	struct snd_ratnum *rats_no_pll;
++	unsigned int num = 0, den = 0;
++	int err;
++
++	rats_no_pll = devm_kzalloc(rtd->dev, sizeof(*rats_no_pll), GFP_KERNEL);
++	if (!rats_no_pll)
++		return -ENOMEM;
++
++	rats_no_pll->num = clk_get_rate(pcm512x->sclk) / 64;
++	rats_no_pll->den_min = 1;
++	rats_no_pll->den_max = 128;
++	rats_no_pll->den_step = 1;
++
++	err = snd_interval_ratnum(hw_param_interval(params,
++		SNDRV_PCM_HW_PARAM_RATE), 1, rats_no_pll, &num, &den);
++	if (err >= 0 && den) {
++		params->rate_num = num;
++		params->rate_den = den;
++	}
++
++	devm_kfree(rtd->dev, rats_no_pll);
++	return 0;
++}
++
++static int snd_rpi_hifiberry_dacplusadcpro_hw_params(
++	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
++{
++	int ret = 0;
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	int channels = params_channels(params);
++	int width = snd_pcm_format_width(params_format(params));
++	struct snd_soc_component *dac = snd_soc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_dai *dai = snd_soc_rtd_to_codec(rtd, 0);
++	struct snd_soc_dai_driver *drv = dai->driver;
++	const struct snd_soc_dai_ops *ops = drv->ops;
++
++	/* Using powers of 2 allows for an integer clock divisor */
++	width = width <= 16 ? 16 : 32;
++
++	if (snd_rpi_hifiberry_is_dacpro) {
++		snd_rpi_hifiberry_dacplusadcpro_set_sclk(dac,
++			params_rate(params));
++
++		ret = snd_rpi_hifiberry_dacplusadcpro_update_rate_den(
++			substream, params);
++		if (ret)
++			return ret;
++	}
++
++	ret = snd_soc_dai_set_bclk_ratio(snd_soc_rtd_to_cpu(rtd, 0), channels * width);
++	if (ret)
++		return ret;
++	ret = snd_soc_dai_set_bclk_ratio(snd_soc_rtd_to_codec(rtd, 0), channels * width);
++	if (ret)
++		return ret;
++	if (snd_rpi_hifiberry_is_dacpro && ops->hw_params)
++		ret = ops->hw_params(substream, params, dai);
++	return ret;
++}
++
++static int snd_rpi_hifiberry_dacplusadcpro_startup(
++	struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *dac = snd_soc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_component *adc = snd_soc_rtd_to_codec(rtd, 1)->component;
++
++	if (leds_off)
++		return 0;
++	/* switch on respective LED */
++	if (!substream->stream)
++		snd_soc_component_update_bits(dac, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
++	else
++		snd_soc_component_update_bits(adc, PCM186X_GPIO_IN_OUT, 0x40, 0x40);
++	return 0;
++}
++
++static void snd_rpi_hifiberry_dacplusadcpro_shutdown(
++	struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *dac = snd_soc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_component *adc = snd_soc_rtd_to_codec(rtd, 1)->component;
++
++	/* switch off respective LED */
++	if (!substream->stream)
++		snd_soc_component_update_bits(dac, PCM512x_GPIO_CONTROL_1, 0x08, 0x00);
++	else
++		snd_soc_component_update_bits(adc, PCM186X_GPIO_IN_OUT, 0x40, 0x00);
++}
++
++
++/* machine stream operations */
++static struct snd_soc_ops snd_rpi_hifiberry_dacplusadcpro_ops = {
++	.hw_params = snd_rpi_hifiberry_dacplusadcpro_hw_params,
++	.startup = snd_rpi_hifiberry_dacplusadcpro_startup,
++	.shutdown = snd_rpi_hifiberry_dacplusadcpro_shutdown,
++};
++
++SND_SOC_DAILINK_DEFS(hifi,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm512x.1-004d", "pcm512x-hifi"),
++			   COMP_CODEC("pcm186x.1-004a", "pcm1863-aif")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_hifiberry_dacplusadcpro_dai[] = {
++{
++	.name		= "HiFiBerry DAC+ADC PRO",
++	.stream_name	= "HiFiBerry DAC+ADC PRO HiFi",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBS_CFS,
++	.ops		= &snd_rpi_hifiberry_dacplusadcpro_ops,
++	.init		= snd_rpi_hifiberry_dacplusadcpro_init,
++	SND_SOC_DAILINK_REG(hifi),
++},
++};
++
++/* aux device for optional headphone amp */
++static struct snd_soc_aux_dev hifiberry_dacplusadcpro_aux_devs[] = {
++	{
++		.dlc = {
++			.name = "tpa6130a2.1-0060",
++		},
++	},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_hifiberry_dacplusadcpro = {
++	.name         = "snd_rpi_hifiberry_dacplusadcpro",
++	.driver_name  = "HifiberryDacpAdcPro",
++	.owner        = THIS_MODULE,
++	.dai_link     = snd_rpi_hifiberry_dacplusadcpro_dai,
++	.num_links    = ARRAY_SIZE(snd_rpi_hifiberry_dacplusadcpro_dai),
++};
++
++static int hb_hp_detect(void)
++{
++	struct i2c_adapter *adap = i2c_get_adapter(1);
++	int ret;
++	struct i2c_client tpa_i2c_client = {
++		.addr = 0x60,
++		.adapter = adap,
++	};
++
++	if (!adap)
++		return -EPROBE_DEFER;	/* I2C module not yet available */
++
++	ret = i2c_smbus_read_byte(&tpa_i2c_client) >= 0;
++	i2c_put_adapter(adap);
++	return ret;
++};
++
++static struct property tpa_enable_prop = {
++	       .name = "status",
++	       .length = 4 + 1, /* length 'okay' + 1 */
++	       .value = "okay",
++	};
++
++static int snd_rpi_hifiberry_dacplusadcpro_probe(struct platform_device *pdev)
++{
++	int ret = 0, i = 0;
++	struct snd_soc_card *card = &snd_rpi_hifiberry_dacplusadcpro;
++	struct device_node *tpa_node;
++	struct property *tpa_prop;
++	struct of_changeset ocs;
++	int len;
++
++	/* probe for head phone amp */
++	ret = hb_hp_detect();
++	if (ret < 0)
++		return ret;
++	if (ret) {
++		card->aux_dev = hifiberry_dacplusadcpro_aux_devs;
++		card->num_aux_devs =
++				ARRAY_SIZE(hifiberry_dacplusadcpro_aux_devs);
++		tpa_node = of_find_compatible_node(NULL, NULL, "ti,tpa6130a2");
++		tpa_prop = of_find_property(tpa_node, "status", &len);
++
++		if (strcmp((char *)tpa_prop->value, "okay")) {
++			/* and activate headphone using change_sets */
++			dev_info(&pdev->dev, "activating headphone amplifier");
++			of_changeset_init(&ocs);
++			ret = of_changeset_update_property(&ocs, tpa_node,
++							&tpa_enable_prop);
++			if (ret) {
++				dev_err(&pdev->dev,
++				"cannot activate headphone amplifier\n");
++				return -ENODEV;
++			}
++			ret = of_changeset_apply(&ocs);
++			if (ret) {
++				dev_err(&pdev->dev,
++				"cannot activate headphone amplifier\n");
++				return -ENODEV;
++			}
++		}
++	}
++
++	snd_rpi_hifiberry_dacplusadcpro.dev = &pdev->dev;
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai;
++
++		dai = &snd_rpi_hifiberry_dacplusadcpro_dai[0];
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++			"i2s-controller", 0);
++		if (i2s_node) {
++			for (i = 0; i < card->num_links; i++) {
++				dai->cpus->dai_name = NULL;
++				dai->cpus->of_node = i2s_node;
++				dai->platforms->name = NULL;
++				dai->platforms->of_node = i2s_node;
++			}
++		}
++	}
++	digital_gain_0db_limit = !of_property_read_bool(
++		pdev->dev.of_node, "hifiberry-dacplusadcpro,24db_digital_gain");
++	slave = of_property_read_bool(pdev->dev.of_node,
++					"hifiberry-dacplusadcpro,slave");
++	leds_off = of_property_read_bool(pdev->dev.of_node,
++					"hifiberry-dacplusadcpro,leds_off");
++	ret = snd_soc_register_card(&snd_rpi_hifiberry_dacplusadcpro);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev,
++			"snd_soc_register_card() failed: %d\n", ret);
++
++	return ret;
++}
++
++static const struct of_device_id snd_rpi_hifiberry_dacplusadcpro_of_match[] = {
++	{ .compatible = "hifiberry,hifiberry-dacplusadcpro", },
++	{},
++};
++
++MODULE_DEVICE_TABLE(of, snd_rpi_hifiberry_dacplusadcpro_of_match);
++
++static struct platform_driver snd_rpi_hifiberry_dacplusadcpro_driver = {
++	.driver = {
++		.name   = "snd-rpi-hifiberry-dacplusadcpro",
++		.owner  = THIS_MODULE,
++		.of_match_table = snd_rpi_hifiberry_dacplusadcpro_of_match,
++	},
++	.probe          = snd_rpi_hifiberry_dacplusadcpro_probe,
++};
++
++module_platform_driver(snd_rpi_hifiberry_dacplusadcpro_driver);
++
++MODULE_AUTHOR("Joerg Schambacher <joerg@hifiberry.com>");
++MODULE_AUTHOR("Daniel Matuschek <daniel@hifiberry.com>");
++MODULE_DESCRIPTION("ASoC Driver for HiFiBerry DAC+ADC");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/hifiberry_dacplusdsp.c
+@@ -0,0 +1,89 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * ASoC Driver for HiFiBerry DAC + DSP
++ *
++ * Author:	Joerg Schambacher <joscha@schambacher.com>
++ *		Copyright 2018
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <sound/soc.h>
++
++static struct snd_soc_component_driver dacplusdsp_component_driver;
++
++static struct snd_soc_dai_driver dacplusdsp_dai = {
++	.name = "dacplusdsp-hifi",
++	.capture = {
++		.stream_name = "DAC+DSP Capture",
++		.channels_min = 2,
++		.channels_max = 2,
++		.rates = SNDRV_PCM_RATE_CONTINUOUS,
++		.formats = SNDRV_PCM_FMTBIT_S16_LE |
++			   SNDRV_PCM_FMTBIT_S24_LE |
++			   SNDRV_PCM_FMTBIT_S32_LE,
++	},
++	.playback = {
++		.stream_name = "DACP+DSP Playback",
++		.channels_min = 2,
++		.channels_max = 2,
++		.rates = SNDRV_PCM_RATE_CONTINUOUS,
++		.formats = SNDRV_PCM_FMTBIT_S16_LE |
++			   SNDRV_PCM_FMTBIT_S24_LE |
++			   SNDRV_PCM_FMTBIT_S32_LE,
++	},
++	.symmetric_rate = 1};
++
++#ifdef CONFIG_OF
++static const struct of_device_id dacplusdsp_ids[] = {
++	{
++		.compatible = "hifiberry,dacplusdsp",
++	},
++	{} };
++MODULE_DEVICE_TABLE(of, dacplusdsp_ids);
++#endif
++
++static int dacplusdsp_platform_probe(struct platform_device *pdev)
++{
++	int ret;
++
++	ret = snd_soc_register_component(&pdev->dev,
++			&dacplusdsp_component_driver, &dacplusdsp_dai, 1);
++	if (ret) {
++		pr_alert("snd_soc_register_component failed\n");
++		return ret;
++	}
++
++	return 0;
++}
++
++static void dacplusdsp_platform_remove(struct platform_device *pdev)
++{
++	snd_soc_unregister_component(&pdev->dev);
++}
++
++static struct platform_driver dacplusdsp_driver = {
++	.driver = {
++		.name = "hifiberry-dacplusdsp-codec",
++		.of_match_table = of_match_ptr(dacplusdsp_ids),
++		},
++		.probe = dacplusdsp_platform_probe,
++		.remove = dacplusdsp_platform_remove,
++};
++
++module_platform_driver(dacplusdsp_driver);
++
++MODULE_AUTHOR("Joerg Schambacher <joerg@i2audio.com>");
++MODULE_DESCRIPTION("ASoC Driver for HiFiBerry DAC+DSP");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/hifiberry_dacplushd.c
+@@ -0,0 +1,233 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * ASoC Driver for HiFiBerry DAC+ HD
++ *
++ * Author:	Joerg Schambacher, i2Audio GmbH for HiFiBerry
++ *		Copyright 2020
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/kernel.h>
++#include <linux/delay.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/delay.h>
++#include <linux/gpio.h>
++#include <linux/gpio/consumer.h>
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <linux/i2c.h>
++#include <linux/clk.h>
++
++#include "../codecs/pcm179x.h"
++
++#define DEFAULT_RATE		44100
++
++struct brd_drv_data {
++	struct regmap *regmap;
++	struct clk *sclk;
++};
++
++static struct brd_drv_data drvdata;
++static struct gpio_desc *reset_gpio;
++static const unsigned int hb_dacplushd_rates[] = {
++	192000, 96000, 48000, 176400, 88200, 44100,
++};
++
++static struct snd_pcm_hw_constraint_list hb_dacplushd_constraints = {
++	.list = hb_dacplushd_rates,
++	.count = ARRAY_SIZE(hb_dacplushd_rates),
++};
++
++static int snd_rpi_hb_dacplushd_startup(struct snd_pcm_substream *substream)
++{
++	/* constraints for standard sample rates */
++	snd_pcm_hw_constraint_list(substream->runtime, 0,
++				SNDRV_PCM_HW_PARAM_RATE,
++				&hb_dacplushd_constraints);
++	return 0;
++}
++
++static void snd_rpi_hifiberry_dacplushd_set_sclk(
++		struct snd_soc_component *component,
++		int sample_rate)
++{
++	if (!IS_ERR(drvdata.sclk))
++		clk_set_rate(drvdata.sclk, sample_rate);
++}
++
++static int snd_rpi_hifiberry_dacplushd_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_dai_link *dai = rtd->dai_link;
++	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
++
++	dai->name = "HiFiBerry DAC+ HD";
++	dai->stream_name = "HiFiBerry DAC+ HD HiFi";
++	dai->dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
++		| SND_SOC_DAIFMT_CBM_CFM;
++
++	/* allow only fixed 32 clock counts per channel */
++	snd_soc_dai_set_bclk_ratio(cpu_dai, 32*2);
++
++	return 0;
++}
++
++static int snd_rpi_hifiberry_dacplushd_hw_params(
++	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
++{
++	int ret = 0;
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++
++	snd_rpi_hifiberry_dacplushd_set_sclk(component, params_rate(params));
++	return ret;
++}
++
++/* machine stream operations */
++static struct snd_soc_ops snd_rpi_hifiberry_dacplushd_ops = {
++	.startup = snd_rpi_hb_dacplushd_startup,
++	.hw_params = snd_rpi_hifiberry_dacplushd_hw_params,
++};
++
++SND_SOC_DAILINK_DEFS(hifi,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm179x.1-004c", "pcm179x-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++
++static struct snd_soc_dai_link snd_rpi_hifiberry_dacplushd_dai[] = {
++{
++	.name		= "HiFiBerry DAC+ HD",
++	.stream_name	= "HiFiBerry DAC+ HD HiFi",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBS_CFS,
++	.ops		= &snd_rpi_hifiberry_dacplushd_ops,
++	.init		= snd_rpi_hifiberry_dacplushd_init,
++	SND_SOC_DAILINK_REG(hifi),
++},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_hifiberry_dacplushd = {
++	.name         = "snd_rpi_hifiberry_dacplushd",
++	.driver_name  = "HifiberryDacplusHD",
++	.owner        = THIS_MODULE,
++	.dai_link     = snd_rpi_hifiberry_dacplushd_dai,
++	.num_links    = ARRAY_SIZE(snd_rpi_hifiberry_dacplushd_dai),
++};
++
++static int snd_rpi_hifiberry_dacplushd_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++	static int dac_reset_done;
++	struct device *dev = &pdev->dev;
++	struct device_node *dev_node = dev->of_node;
++
++	snd_rpi_hifiberry_dacplushd.dev = &pdev->dev;
++
++	/* get GPIO and release DAC from RESET */
++	if (!dac_reset_done) {
++		reset_gpio = gpiod_get(&pdev->dev, "reset", GPIOD_OUT_LOW);
++		if (IS_ERR(reset_gpio)) {
++			dev_err(&pdev->dev, "gpiod_get() failed\n");
++			return -EINVAL;
++		}
++		dac_reset_done = 1;
++	}
++	if (!IS_ERR(reset_gpio))
++		gpiod_set_value(reset_gpio, 0);
++	msleep(1);
++	if (!IS_ERR(reset_gpio))
++		gpiod_set_value(reset_gpio, 1);
++	msleep(1);
++	if (!IS_ERR(reset_gpio))
++		gpiod_set_value(reset_gpio, 0);
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai;
++
++		dai = &snd_rpi_hifiberry_dacplushd_dai[0];
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++			"i2s-controller", 0);
++
++		if (i2s_node) {
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->of_node = i2s_node;
++			dai->cpus->dai_name = NULL;
++			dai->platforms->name = NULL;
++		} else {
++			return -EPROBE_DEFER;
++		}
++
++	}
++
++	ret = devm_snd_soc_register_card(&pdev->dev,
++			&snd_rpi_hifiberry_dacplushd);
++	if (ret && ret != -EPROBE_DEFER) {
++		dev_err(&pdev->dev,
++			"snd_soc_register_card() failed: %d\n", ret);
++		return ret;
++	}
++	if (ret == -EPROBE_DEFER)
++		return ret;
++
++	dev_set_drvdata(dev, &drvdata);
++	if (dev_node == NULL) {
++		dev_err(&pdev->dev, "Device tree node not found\n");
++		return -ENODEV;
++	}
++
++	drvdata.sclk = devm_clk_get(dev, NULL);
++	if (IS_ERR(drvdata.sclk)) {
++		drvdata.sclk = ERR_PTR(-ENOENT);
++		return -ENODEV;
++	}
++
++	clk_set_rate(drvdata.sclk, DEFAULT_RATE);
++
++	return ret;
++}
++
++static void snd_rpi_hifiberry_dacplushd_remove(struct platform_device *pdev)
++{
++	/* put DAC into RESET and release GPIO */
++	gpiod_set_value(reset_gpio, 0);
++	gpiod_put(reset_gpio);
++}
++
++static const struct of_device_id snd_rpi_hifiberry_dacplushd_of_match[] = {
++	{ .compatible = "hifiberry,hifiberry-dacplushd", },
++	{},
++};
++
++MODULE_DEVICE_TABLE(of, snd_rpi_hifiberry_dacplushd_of_match);
++
++static struct platform_driver snd_rpi_hifiberry_dacplushd_driver = {
++	.driver = {
++		.name   = "snd-rpi-hifiberry-dacplushd",
++		.owner  = THIS_MODULE,
++		.of_match_table = snd_rpi_hifiberry_dacplushd_of_match,
++	},
++	.probe          = snd_rpi_hifiberry_dacplushd_probe,
++	.remove		= snd_rpi_hifiberry_dacplushd_remove,
++};
++
++module_platform_driver(snd_rpi_hifiberry_dacplushd_driver);
++
++MODULE_AUTHOR("Joerg Schambacher <joerg@i2audio.com>");
++MODULE_DESCRIPTION("ASoC Driver for HiFiBerry DAC+ HD");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/i-sabre-q2m.c
+@@ -0,0 +1,159 @@
++/*
++ * ASoC Driver for I-Sabre Q2M
++ *
++ * Author: Satoru Kawase
++ * Modified by: Xiao Qingyong
++ * Update kernel v4.18+ by : Audiophonics
++ * 		Copyright 2018 Audiophonics
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/delay.h>
++#include <linux/fs.h>
++#include <asm/uaccess.h>
++#include <sound/core.h>
++#include <sound/soc.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++
++#include "../codecs/i-sabre-codec.h"
++
++
++static int snd_rpi_i_sabre_q2m_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++	unsigned int value;
++
++	/* Device ID */
++	value = snd_soc_component_read(component, ISABRECODEC_REG_01);
++	dev_info(component->card->dev, "Audiophonics Device ID : %02X\n", value);
++
++	/* API revision */
++	value = snd_soc_component_read(component, ISABRECODEC_REG_02);
++	dev_info(component->card->dev, "Audiophonics API revision : %02X\n", value);
++
++	return 0;
++}
++
++static int snd_rpi_i_sabre_q2m_hw_params(
++	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd     = substream->private_data;
++	struct snd_soc_dai         *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
++	int bclk_ratio;
++
++	/* Using powers of 2 allows for an integer clock divisor */
++	bclk_ratio = (snd_pcm_format_width(params_format(params)) <= 16 ? 16 : 32) *
++				 params_channels(params);
++	return snd_soc_dai_set_bclk_ratio(cpu_dai, bclk_ratio);
++}
++
++/* machine stream operations */
++static struct snd_soc_ops snd_rpi_i_sabre_q2m_ops = {
++	.hw_params = snd_rpi_i_sabre_q2m_hw_params,
++};
++
++SND_SOC_DAILINK_DEFS(rpi_i_sabre_q2m,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("i-sabre-codec-i2c.1-0048", "i-sabre-codec-dai")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_i_sabre_q2m_dai[] = {
++	{
++		.name           = "I-Sabre Q2M",
++		.stream_name    = "I-Sabre Q2M DAC",
++		.dai_fmt        = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
++						| SND_SOC_DAIFMT_CBS_CFS,
++		.init           = snd_rpi_i_sabre_q2m_init,
++		.ops            = &snd_rpi_i_sabre_q2m_ops,
++		SND_SOC_DAILINK_REG(rpi_i_sabre_q2m),
++	}
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_i_sabre_q2m = {
++	.name      = "I-Sabre Q2M DAC",
++	.owner     = THIS_MODULE,
++	.dai_link  = snd_rpi_i_sabre_q2m_dai,
++	.num_links = ARRAY_SIZE(snd_rpi_i_sabre_q2m_dai)
++};
++
++
++static int snd_rpi_i_sabre_q2m_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++
++	snd_rpi_i_sabre_q2m.dev = &pdev->dev;
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai;
++
++		dai = &snd_rpi_i_sabre_q2m_dai[0];
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++							"i2s-controller", 0);
++		if (i2s_node) {
++			dai->cpus->dai_name     = NULL;
++			dai->cpus->of_node      = i2s_node;
++			dai->platforms->name    = NULL;
++			dai->platforms->of_node = i2s_node;
++		} else {
++			dev_err(&pdev->dev,
++			    "Property 'i2s-controller' missing or invalid\n");
++			return (-EINVAL);
++		}
++
++		dai->name        = "I-Sabre Q2M";
++		dai->stream_name = "I-Sabre Q2M DAC";
++		dai->dai_fmt     = SND_SOC_DAIFMT_I2S
++					| SND_SOC_DAIFMT_NB_NF
++					| SND_SOC_DAIFMT_CBS_CFS;
++	}
++
++	/* Wait for registering codec driver */
++	mdelay(50);
++
++	ret = snd_soc_register_card(&snd_rpi_i_sabre_q2m);
++	if (ret) {
++		dev_err(&pdev->dev,
++			"snd_soc_register_card() failed: %d\n", ret);
++	}
++
++	return ret;
++}
++
++static void snd_rpi_i_sabre_q2m_remove(struct platform_device *pdev)
++{
++	snd_soc_unregister_card(&snd_rpi_i_sabre_q2m);
++}
++
++static const struct of_device_id snd_rpi_i_sabre_q2m_of_match[] = {
++	{ .compatible = "audiophonics,i-sabre-q2m", },
++	{}
++};
++MODULE_DEVICE_TABLE(of, snd_rpi_i_sabre_q2m_of_match);
++
++static struct platform_driver snd_rpi_i_sabre_q2m_driver = {
++	.driver = {
++		.name           = "snd-rpi-i-sabre-q2m",
++		.owner          = THIS_MODULE,
++		.of_match_table = snd_rpi_i_sabre_q2m_of_match,
++	},
++	.probe  = snd_rpi_i_sabre_q2m_probe,
++	.remove = snd_rpi_i_sabre_q2m_remove,
++};
++module_platform_driver(snd_rpi_i_sabre_q2m_driver);
++
++MODULE_DESCRIPTION("ASoC Driver for I-Sabre Q2M");
++MODULE_AUTHOR("Audiophonics <http://www.audiophonics.fr>");
++MODULE_LICENSE("GPL");
+--- /dev/null
++++ b/sound/soc/bcm/iqaudio-codec.c
+@@ -0,0 +1,283 @@
++/*
++ * ASoC Driver for IQaudIO Raspberry Pi Codec board
++ *
++ * Author:	Gordon Garrity <gordon@iqaudio.com>
++ *		(C) Copyright IQaudio Limited, 2017-2019
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/gpio/consumer.h>
++#include <linux/platform_device.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++
++#include <linux/acpi.h>
++#include <linux/slab.h>
++#include "../codecs/da7213.h"
++
++static int pll_out = DA7213_PLL_FREQ_OUT_90316800;
++
++static int snd_rpi_iqaudio_pll_control(struct snd_soc_dapm_widget *w,
++				       struct snd_kcontrol *k, int  event)
++{
++	int ret = 0;
++	struct snd_soc_dapm_context *dapm = w->dapm;
++	struct snd_soc_card *card = dapm->card;
++	struct snd_soc_pcm_runtime *rtd =
++		snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++	struct snd_soc_dai *codec_dai = snd_soc_rtd_to_codec(rtd, 0);
++
++	if (SND_SOC_DAPM_EVENT_OFF(event)) {
++		ret = snd_soc_dai_set_pll(codec_dai, 0, DA7213_SYSCLK_MCLK, 0,
++					  0);
++		if (ret)
++			dev_err(card->dev, "Failed to bypass PLL: %d\n", ret);
++		/* Allow PLL time to bypass */
++		msleep(100);
++	} else if (SND_SOC_DAPM_EVENT_ON(event)) {
++		ret = snd_soc_dai_set_pll(codec_dai, 0, DA7213_SYSCLK_PLL, 0,
++					  pll_out);
++		if (ret)
++			dev_err(card->dev, "Failed to enable PLL: %d\n", ret);
++		/* Allow PLL time to lock */
++		msleep(100);
++	}
++
++	return ret;
++}
++
++static int snd_rpi_iqaudio_post_dapm_event(struct snd_soc_dapm_widget *w,
++                              struct snd_kcontrol *kcontrol,
++                              int event)
++{
++     switch (event) {
++     case SND_SOC_DAPM_POST_PMU:
++           /* Delay for mic bias ramp */
++           msleep(1000);
++           break;
++     default:
++           break;
++     }
++
++     return 0;
++}
++
++static const struct snd_kcontrol_new dapm_controls[] = {
++	SOC_DAPM_PIN_SWITCH("HP Jack"),
++	SOC_DAPM_PIN_SWITCH("MIC Jack"),
++	SOC_DAPM_PIN_SWITCH("Onboard MIC"),
++	SOC_DAPM_PIN_SWITCH("AUX Jack"),
++};
++
++static const struct snd_soc_dapm_widget dapm_widgets[] = {
++	SND_SOC_DAPM_HP("HP Jack", NULL),
++	SND_SOC_DAPM_MIC("MIC Jack", NULL),
++	SND_SOC_DAPM_MIC("Onboard MIC", NULL),
++	SND_SOC_DAPM_LINE("AUX Jack", NULL),
++	SND_SOC_DAPM_SUPPLY("PLL Control", SND_SOC_NOPM, 0, 0,
++			    snd_rpi_iqaudio_pll_control,
++			    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
++	SND_SOC_DAPM_POST("Post Power Up Event", snd_rpi_iqaudio_post_dapm_event),
++};
++
++static const struct snd_soc_dapm_route audio_map[] = {
++	{"HP Jack", NULL, "HPL"},
++	{"HP Jack", NULL, "HPR"},
++	{"HP Jack", NULL, "PLL Control"},
++
++	{"AUXR", NULL, "AUX Jack"},
++	{"AUXL", NULL, "AUX Jack"},
++	{"AUX Jack", NULL, "PLL Control"},
++
++	/* Assume Mic1 is linked to Headset and Mic2 to on-board mic */
++	{"MIC1", NULL, "MIC Jack"},
++	{"MIC Jack", NULL, "PLL Control"},
++	{"MIC2", NULL, "Onboard MIC"},
++	{"Onboard MIC", NULL, "PLL Control"},
++};
++
++/* machine stream operations */
++
++static int snd_rpi_iqaudio_codec_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_dai *codec_dai = snd_soc_rtd_to_codec(rtd, 0);
++	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
++	int ret;
++
++	/*
++	 * Disable AUX Jack Pin by default to prevent PLL being enabled at
++	 * startup. This avoids holding the PLL to a fixed SR config for
++	 * subsequent streams.
++	 *
++	 * This pin can still be enabled later, as required by user-space.
++	 */
++	snd_soc_dapm_disable_pin(&rtd->card->dapm, "AUX Jack");
++	snd_soc_dapm_sync(&rtd->card->dapm);
++
++	/* Impose BCLK ratios otherwise the codec may cheat */
++	ret = snd_soc_dai_set_bclk_ratio(cpu_dai, 64);
++	if (ret) {
++		dev_err(rtd->dev, "Failed to set CPU BLCK ratio\n");
++		return ret;
++	}
++
++	ret = snd_soc_dai_set_bclk_ratio(codec_dai, 64);
++	if (ret) {
++		dev_err(rtd->dev, "Failed to set codec BCLK ratio\n");
++		return ret;
++	}
++
++	/* Set MCLK frequency to codec, onboard 11.2896MHz clock */
++	return snd_soc_dai_set_sysclk(codec_dai, DA7213_CLKSRC_MCLK, 11289600,
++				      SND_SOC_CLOCK_OUT);
++}
++
++static int snd_rpi_iqaudio_codec_hw_params(struct snd_pcm_substream *substream,
++					   struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_dai *codec_dai = snd_soc_rtd_to_codec(rtd, 0);
++	unsigned int samplerate = params_rate(params);
++
++	switch (samplerate) {
++	case  8000:
++	case 16000:
++	case 32000:
++	case 48000:
++	case 96000:
++		pll_out = DA7213_PLL_FREQ_OUT_98304000;
++		break;
++	case 44100:
++	case 88200:
++		pll_out = DA7213_PLL_FREQ_OUT_90316800;
++		break;
++	default:
++		dev_err(rtd->dev,"Unsupported samplerate %d\n", samplerate);
++		return -EINVAL;
++	}
++
++	return snd_soc_dai_set_pll(codec_dai, 0, DA7213_SYSCLK_PLL, 0, pll_out);
++}
++
++static const struct snd_soc_ops snd_rpi_iqaudio_codec_ops = {
++	.hw_params = snd_rpi_iqaudio_codec_hw_params,
++};
++
++SND_SOC_DAILINK_DEFS(rpi_iqaudio,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("da7213.1-001a", "da7213-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2835-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_iqaudio_codec_dai[] = {
++{
++	.dai_fmt 		= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++				  SND_SOC_DAIFMT_CBM_CFM,
++	.init			= snd_rpi_iqaudio_codec_init,
++	.ops			= &snd_rpi_iqaudio_codec_ops,
++	.symmetric_rate	= 1,
++	.symmetric_channels	= 1,
++	.symmetric_sample_bits	= 1,
++	SND_SOC_DAILINK_REG(rpi_iqaudio),
++},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_iqaudio_codec = {
++	.owner			= THIS_MODULE,
++	.dai_link		= snd_rpi_iqaudio_codec_dai,
++	.num_links		= ARRAY_SIZE(snd_rpi_iqaudio_codec_dai),
++	.controls		= dapm_controls,
++	.num_controls		= ARRAY_SIZE(dapm_controls),
++	.dapm_widgets		= dapm_widgets,
++	.num_dapm_widgets	= ARRAY_SIZE(dapm_widgets),
++	.dapm_routes		= audio_map,
++	.num_dapm_routes	= ARRAY_SIZE(audio_map),
++};
++
++static int snd_rpi_iqaudio_codec_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++
++	snd_rpi_iqaudio_codec.dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_card *card = &snd_rpi_iqaudio_codec;
++		struct snd_soc_dai_link *dai = &snd_rpi_iqaudio_codec_dai[0];
++
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++					    "i2s-controller", 0);
++		if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++		}
++
++		if (of_property_read_string(pdev->dev.of_node, "card_name",
++					    &card->name))
++			card->name = "IQaudIOCODEC";
++
++		if (of_property_read_string(pdev->dev.of_node, "dai_name",
++					    &dai->name))
++			dai->name = "IQaudIO CODEC";
++
++		if (of_property_read_string(pdev->dev.of_node,
++					"dai_stream_name", &dai->stream_name))
++			dai->stream_name = "IQaudIO CODEC HiFi v1.2";
++
++	}
++
++	ret = snd_soc_register_card(&snd_rpi_iqaudio_codec);
++	if (ret) {
++		if (ret != -EPROBE_DEFER)
++			dev_err(&pdev->dev,
++				"snd_soc_register_card() failed: %d\n", ret);
++		return ret;
++	}
++
++	return 0;
++}
++
++static void snd_rpi_iqaudio_codec_remove(struct platform_device *pdev)
++{
++	snd_soc_unregister_card(&snd_rpi_iqaudio_codec);
++}
++
++static const struct of_device_id iqaudio_of_match[] = {
++	{ .compatible = "iqaudio,iqaudio-codec", },
++	{},
++};
++
++MODULE_DEVICE_TABLE(of, iqaudio_of_match);
++
++static struct platform_driver snd_rpi_iqaudio_codec_driver = {
++	.driver = {
++		.name   = "snd-rpi-iqaudio-codec",
++		.owner  = THIS_MODULE,
++		.of_match_table = iqaudio_of_match,
++	},
++	.probe          = snd_rpi_iqaudio_codec_probe,
++	.remove         = snd_rpi_iqaudio_codec_remove,
++};
++
++
++
++module_platform_driver(snd_rpi_iqaudio_codec_driver);
++
++MODULE_AUTHOR("Gordon Garrity <gordon@iqaudio.com>");
++MODULE_DESCRIPTION("ASoC Driver for IQaudIO CODEC");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/iqaudio-dac.c
+@@ -0,0 +1,223 @@
++/*
++ * ASoC Driver for IQaudIO DAC
++ *
++ * Author:	Florian Meier <florian.meier@koalo.de>
++ *		Copyright 2013
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/gpio/consumer.h>
++#include <linux/platform_device.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++
++static bool digital_gain_0db_limit = true;
++
++static struct gpio_desc *mute_gpio;
++
++static int snd_rpi_iqaudio_dac_init(struct snd_soc_pcm_runtime *rtd)
++{
++	if (digital_gain_0db_limit)
++	{
++		int ret;
++		struct snd_soc_card *card = rtd->card;
++
++		ret = snd_soc_limit_volume(card, "Digital Playback Volume", 207);
++		if (ret < 0)
++			dev_warn(card->dev, "Failed to set volume limit: %d\n", ret);
++	}
++
++	return 0;
++}
++
++static void snd_rpi_iqaudio_gpio_mute(struct snd_soc_card *card)
++{
++	if (mute_gpio) {
++		dev_info(card->dev, "%s: muting amp using GPIO22\n",
++			 __func__);
++		gpiod_set_value_cansleep(mute_gpio, 0);
++	}
++}
++
++static void snd_rpi_iqaudio_gpio_unmute(struct snd_soc_card *card)
++{
++	if (mute_gpio) {
++		dev_info(card->dev, "%s: un-muting amp using GPIO22\n",
++			 __func__);
++		gpiod_set_value_cansleep(mute_gpio, 1);
++	}
++}
++
++static int snd_rpi_iqaudio_set_bias_level(struct snd_soc_card *card,
++	struct snd_soc_dapm_context *dapm, enum snd_soc_bias_level level)
++{
++	struct snd_soc_pcm_runtime *rtd;
++	struct snd_soc_dai *codec_dai;
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++	codec_dai = snd_soc_rtd_to_codec(rtd, 0);
++
++	if (dapm->dev != codec_dai->dev)
++		return 0;
++
++	switch (level) {
++	case SND_SOC_BIAS_PREPARE:
++		if (dapm->bias_level != SND_SOC_BIAS_STANDBY)
++			break;
++
++		/* UNMUTE AMP */
++		snd_rpi_iqaudio_gpio_unmute(card);
++
++		break;
++	case SND_SOC_BIAS_STANDBY:
++		if (dapm->bias_level != SND_SOC_BIAS_PREPARE)
++			break;
++
++		/* MUTE AMP */
++		snd_rpi_iqaudio_gpio_mute(card);
++
++		break;
++	default:
++		break;
++	}
++
++	return 0;
++}
++
++SND_SOC_DAILINK_DEFS(hifi,
++        DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++        DAILINK_COMP_ARRAY(COMP_CODEC("pcm512x.1-004c", "pcm512x-hifi")),
++        DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_iqaudio_dac_dai[] = {
++{
++	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBS_CFS,
++	.init		= snd_rpi_iqaudio_dac_init,
++	SND_SOC_DAILINK_REG(hifi),
++},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_iqaudio_dac = {
++	.owner        = THIS_MODULE,
++	.dai_link     = snd_rpi_iqaudio_dac_dai,
++	.num_links    = ARRAY_SIZE(snd_rpi_iqaudio_dac_dai),
++};
++
++static int snd_rpi_iqaudio_dac_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++	bool gpio_unmute = false;
++
++	snd_rpi_iqaudio_dac.dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_card *card = &snd_rpi_iqaudio_dac;
++		struct snd_soc_dai_link *dai = &snd_rpi_iqaudio_dac_dai[0];
++		bool auto_gpio_mute = false;
++
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++					    "i2s-controller", 0);
++		if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++		}
++
++		digital_gain_0db_limit = !of_property_read_bool(
++			pdev->dev.of_node, "iqaudio,24db_digital_gain");
++
++		if (of_property_read_string(pdev->dev.of_node, "card_name",
++					    &card->name))
++			card->name = "IQaudIODAC";
++
++		if (of_property_read_string(pdev->dev.of_node, "dai_name",
++					    &dai->name))
++			dai->name = "IQaudIO DAC";
++
++		if (of_property_read_string(pdev->dev.of_node,
++					"dai_stream_name", &dai->stream_name))
++			dai->stream_name = "IQaudIO DAC HiFi";
++
++		/* gpio_unmute - one time unmute amp using GPIO */
++		gpio_unmute = of_property_read_bool(pdev->dev.of_node,
++						    "iqaudio-dac,unmute-amp");
++
++		/* auto_gpio_mute - mute/unmute amp using GPIO */
++		auto_gpio_mute = of_property_read_bool(pdev->dev.of_node,
++						"iqaudio-dac,auto-mute-amp");
++
++		if (auto_gpio_mute || gpio_unmute) {
++			mute_gpio = devm_gpiod_get_optional(&pdev->dev, "mute",
++							    GPIOD_OUT_LOW);
++			if (IS_ERR(mute_gpio)) {
++				ret = PTR_ERR(mute_gpio);
++				dev_err(&pdev->dev,
++					"Failed to get mute gpio: %d\n", ret);
++				return ret;
++			}
++
++			if (auto_gpio_mute && mute_gpio)
++				snd_rpi_iqaudio_dac.set_bias_level =
++						snd_rpi_iqaudio_set_bias_level;
++		}
++	}
++
++	ret = snd_soc_register_card(&snd_rpi_iqaudio_dac);
++	if (ret) {
++		if (ret != -EPROBE_DEFER)
++			dev_err(&pdev->dev,
++				"snd_soc_register_card() failed: %d\n", ret);
++		return ret;
++	}
++
++	if (gpio_unmute && mute_gpio)
++		snd_rpi_iqaudio_gpio_unmute(&snd_rpi_iqaudio_dac);
++
++	return 0;
++}
++
++static void snd_rpi_iqaudio_dac_remove(struct platform_device *pdev)
++{
++	snd_rpi_iqaudio_gpio_mute(&snd_rpi_iqaudio_dac);
++
++	snd_soc_unregister_card(&snd_rpi_iqaudio_dac);
++}
++
++static const struct of_device_id iqaudio_of_match[] = {
++	{ .compatible = "iqaudio,iqaudio-dac", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, iqaudio_of_match);
++
++static struct platform_driver snd_rpi_iqaudio_dac_driver = {
++	.driver = {
++		.name   = "snd-rpi-iqaudio-dac",
++		.owner  = THIS_MODULE,
++		.of_match_table = iqaudio_of_match,
++	},
++	.probe          = snd_rpi_iqaudio_dac_probe,
++	.remove         = snd_rpi_iqaudio_dac_remove,
++};
++
++module_platform_driver(snd_rpi_iqaudio_dac_driver);
++
++MODULE_AUTHOR("Florian Meier <florian.meier@koalo.de>");
++MODULE_DESCRIPTION("ASoC Driver for IQAudio DAC");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/justboom-both.c
+@@ -0,0 +1,266 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * rpi--wm8804.c -- ALSA SoC Raspberry Pi soundcard.
++ *
++ * Authors: Johannes Krude <johannes@krude.de
++ *
++ * Driver for when connecting simultaneously justboom-digi and justboom-dac
++ *
++ * Based upon code from:
++ * justboom-digi.c
++ * by Milan Neskovic <info@justboom.co>
++ * justboom-dac.c
++ * by Milan Neskovic <info@justboom.co>
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++
++#include "../codecs/wm8804.h"
++#include "../codecs/pcm512x.h"
++
++
++static bool digital_gain_0db_limit = true;
++
++static int snd_rpi_justboom_both_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_component *digi = snd_soc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_component *dac = snd_soc_rtd_to_codec(rtd, 1)->component;
++
++	/* enable  TX output */
++	snd_soc_component_update_bits(digi, WM8804_PWRDN, 0x4, 0x0);
++
++	snd_soc_component_update_bits(dac, PCM512x_GPIO_EN, 0x08, 0x08);
++	snd_soc_component_update_bits(dac, PCM512x_GPIO_OUTPUT_4, 0xf, 0x02);
++	snd_soc_component_update_bits(dac, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
++
++	if (digital_gain_0db_limit) {
++		int ret;
++		struct snd_soc_card *card = rtd->card;
++
++		ret = snd_soc_limit_volume(card, "Digital Playback Volume",
++									207);
++		if (ret < 0)
++			dev_warn(card->dev, "Failed to set volume limit: %d\n",
++									ret);
++	}
++
++	return 0;
++}
++
++static int snd_rpi_justboom_both_hw_params(struct snd_pcm_substream *substream,
++				       struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_dai *codec_dai = snd_soc_rtd_to_codec(rtd, 0);
++	struct snd_soc_component *digi = snd_soc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
++
++	int sysclk = 27000000; /* This is fixed on this board */
++
++	long mclk_freq    = 0;
++	int mclk_div      = 1;
++	int sampling_freq = 1;
++
++	int ret;
++
++	int samplerate = params_rate(params);
++
++	if (samplerate <= 96000) {
++		mclk_freq = samplerate*256;
++		mclk_div  = WM8804_MCLKDIV_256FS;
++	} else {
++		mclk_freq = samplerate*128;
++		mclk_div  = WM8804_MCLKDIV_128FS;
++	}
++
++	switch (samplerate) {
++	case 32000:
++		sampling_freq = 0x03;
++		break;
++	case 44100:
++		sampling_freq = 0x00;
++		break;
++	case 48000:
++		sampling_freq = 0x02;
++		break;
++	case 88200:
++		sampling_freq = 0x08;
++		break;
++	case 96000:
++		sampling_freq = 0x0a;
++		break;
++	case 176400:
++		sampling_freq = 0x0c;
++		break;
++	case 192000:
++		sampling_freq = 0x0e;
++		break;
++	default:
++		dev_err(rtd->card->dev,
++		"Failed to set WM8804 SYSCLK, unsupported samplerate %d\n",
++		samplerate);
++	}
++
++	snd_soc_dai_set_clkdiv(codec_dai, WM8804_MCLK_DIV, mclk_div);
++	snd_soc_dai_set_pll(codec_dai, 0, 0, sysclk, mclk_freq);
++
++	ret = snd_soc_dai_set_sysclk(codec_dai, WM8804_TX_CLKSRC_PLL,
++					sysclk, SND_SOC_CLOCK_OUT);
++	if (ret < 0) {
++		dev_err(rtd->card->dev,
++		"Failed to set WM8804 SYSCLK: %d\n", ret);
++		return ret;
++	}
++
++	/* Enable TX output */
++	snd_soc_component_update_bits(digi, WM8804_PWRDN, 0x4, 0x0);
++
++	/* Power on */
++	snd_soc_component_update_bits(digi, WM8804_PWRDN, 0x9, 0);
++
++	/* set sampling frequency status bits */
++	snd_soc_component_update_bits(digi, WM8804_SPDTX4, 0x0f, sampling_freq);
++
++	return snd_soc_dai_set_bclk_ratio(cpu_dai, 64);
++}
++
++static int snd_rpi_justboom_both_startup(struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *digi = snd_soc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_component *dac = snd_soc_rtd_to_codec(rtd, 1)->component;
++
++	/* turn on digital output */
++	snd_soc_component_update_bits(digi, WM8804_PWRDN, 0x3c, 0x00);
++
++	snd_soc_component_update_bits(dac, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
++
++	return 0;
++}
++
++static void snd_rpi_justboom_both_shutdown(struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *digi = snd_soc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_component *dac = snd_soc_rtd_to_codec(rtd, 1)->component;
++
++	snd_soc_component_update_bits(dac, PCM512x_GPIO_CONTROL_1, 0x08, 0x00);
++
++	/* turn off output */
++	snd_soc_component_update_bits(digi, WM8804_PWRDN, 0x3c, 0x3c);
++}
++
++/* machine stream operations */
++static struct snd_soc_ops snd_rpi_justboom_both_ops = {
++	.hw_params = snd_rpi_justboom_both_hw_params,
++	.startup   = snd_rpi_justboom_both_startup,
++	.shutdown  = snd_rpi_justboom_both_shutdown,
++};
++
++SND_SOC_DAILINK_DEFS(rpi_justboom_both,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm512x.1-004d", "pcm512x-hifi"),
++			   COMP_CODEC("wm8804.1-003b", "wm8804-spdif")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_justboom_both_dai[] = {
++{
++	.name           = "JustBoom Digi",
++	.stream_name    = "JustBoom Digi HiFi",
++	.dai_fmt        = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++					SND_SOC_DAIFMT_CBM_CFM,
++	.ops            = &snd_rpi_justboom_both_ops,
++	.init           = snd_rpi_justboom_both_init,
++	SND_SOC_DAILINK_REG(rpi_justboom_both),
++},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_justboom_both = {
++	.name             = "snd_rpi_justboom_both",
++	.driver_name      = "JustBoomBoth",
++	.owner            = THIS_MODULE,
++	.dai_link         = snd_rpi_justboom_both_dai,
++	.num_links        = ARRAY_SIZE(snd_rpi_justboom_both_dai),
++};
++
++static int snd_rpi_justboom_both_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++	struct snd_soc_card *card = &snd_rpi_justboom_both;
++
++	snd_rpi_justboom_both.dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai = &snd_rpi_justboom_both_dai[0];
++
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++					    "i2s-controller", 0);
++
++		if (i2s_node) {
++			int i;
++
++			for (i = 0; i < card->num_links; i++) {
++				dai->cpus->dai_name = NULL;
++				dai->cpus->of_node = i2s_node;
++				dai->platforms->name = NULL;
++				dai->platforms->of_node = i2s_node;
++			}
++		}
++
++		digital_gain_0db_limit = !of_property_read_bool(
++			pdev->dev.of_node, "justboom,24db_digital_gain");
++	}
++
++	ret = snd_soc_register_card(card);
++	if (ret && ret != -EPROBE_DEFER) {
++		dev_err(&pdev->dev,
++			"snd_soc_register_card() failed: %d\n", ret);
++	}
++
++	return ret;
++}
++
++static void snd_rpi_justboom_both_remove(struct platform_device *pdev)
++{
++	snd_soc_unregister_card(&snd_rpi_justboom_both);
++}
++
++static const struct of_device_id snd_rpi_justboom_both_of_match[] = {
++	{ .compatible = "justboom,justboom-both", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, snd_rpi_justboom_both_of_match);
++
++static struct platform_driver snd_rpi_justboom_both_driver = {
++	.driver = {
++		.name   = "snd-rpi-justboom-both",
++		.owner  = THIS_MODULE,
++		.of_match_table = snd_rpi_justboom_both_of_match,
++	},
++	.probe          = snd_rpi_justboom_both_probe,
++	.remove         = snd_rpi_justboom_both_remove,
++};
++
++module_platform_driver(snd_rpi_justboom_both_driver);
++
++MODULE_AUTHOR("Johannes Krude <johannes@krude.de>");
++MODULE_DESCRIPTION("ASoC Driver for simultaneous use of JustBoom PI Digi & DAC HAT Sound Cards");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/justboom-dac.c
+@@ -0,0 +1,147 @@
++/*
++ * ASoC Driver for JustBoom DAC Raspberry Pi HAT Sound Card
++ *
++ * Author:	Milan Neskovic
++ *		Copyright 2016
++ *		based on code by Daniel Matuschek <info@crazy-audio.com>
++ *		based on code by Florian Meier <florian.meier@koalo.de>
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++
++#include "../codecs/pcm512x.h"
++
++static bool digital_gain_0db_limit = true;
++
++static int snd_rpi_justboom_dac_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++	snd_soc_component_update_bits(component, PCM512x_GPIO_EN, 0x08, 0x08);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_4, 0xf, 0x02);
++	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08,0x08);
++
++	if (digital_gain_0db_limit)
++	{
++		int ret;
++		struct snd_soc_card *card = rtd->card;
++
++		ret = snd_soc_limit_volume(card, "Digital Playback Volume", 207);
++		if (ret < 0)
++			dev_warn(card->dev, "Failed to set volume limit: %d\n", ret);
++	}
++
++	return 0;
++}
++
++static int snd_rpi_justboom_dac_startup(struct snd_pcm_substream *substream) {
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08,0x08);
++	return 0;
++}
++
++static void snd_rpi_justboom_dac_shutdown(struct snd_pcm_substream *substream) {
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08,0x00);
++}
++
++/* machine stream operations */
++static struct snd_soc_ops snd_rpi_justboom_dac_ops = {
++	.startup = snd_rpi_justboom_dac_startup,
++	.shutdown = snd_rpi_justboom_dac_shutdown,
++};
++
++SND_SOC_DAILINK_DEFS(hifi,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm512x.1-004d", "pcm512x-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_justboom_dac_dai[] = {
++{
++	.name		= "JustBoom DAC",
++	.stream_name	= "JustBoom DAC HiFi",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBS_CFS,
++	.ops		= &snd_rpi_justboom_dac_ops,
++	.init		= snd_rpi_justboom_dac_init,
++	SND_SOC_DAILINK_REG(hifi),
++},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_justboom_dac = {
++	.name         = "snd_rpi_justboom_dac",
++	.driver_name  = "JustBoomDac",
++	.owner        = THIS_MODULE,
++	.dai_link     = snd_rpi_justboom_dac_dai,
++	.num_links    = ARRAY_SIZE(snd_rpi_justboom_dac_dai),
++};
++
++static int snd_rpi_justboom_dac_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++
++	snd_rpi_justboom_dac.dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++	    struct device_node *i2s_node;
++	    struct snd_soc_dai_link *dai = &snd_rpi_justboom_dac_dai[0];
++	    i2s_node = of_parse_phandle(pdev->dev.of_node,
++					"i2s-controller", 0);
++
++	    if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++	    }
++
++	    digital_gain_0db_limit = !of_property_read_bool(
++			pdev->dev.of_node, "justboom,24db_digital_gain");
++	}
++
++	ret = devm_snd_soc_register_card(&pdev->dev, &snd_rpi_justboom_dac);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev,
++			"snd_soc_register_card() failed: %d\n", ret);
++
++	return ret;
++}
++
++static const struct of_device_id snd_rpi_justboom_dac_of_match[] = {
++	{ .compatible = "justboom,justboom-dac", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, snd_rpi_justboom_dac_of_match);
++
++static struct platform_driver snd_rpi_justboom_dac_driver = {
++	.driver = {
++		.name   = "snd-rpi-justboom-dac",
++		.owner  = THIS_MODULE,
++		.of_match_table = snd_rpi_justboom_dac_of_match,
++	},
++	.probe          = snd_rpi_justboom_dac_probe,
++};
++
++module_platform_driver(snd_rpi_justboom_dac_driver);
++
++MODULE_AUTHOR("Milan Neskovic <info@justboom.co>");
++MODULE_DESCRIPTION("ASoC Driver for JustBoom PI DAC HAT Sound Card");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/pifi-40.c
+@@ -0,0 +1,281 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * ALSA ASoC Machine Driver for PiFi-40
++ *
++ * Author:	David Knell <david.knell@gmail.com)
++ *		based on code by Daniel Matuschek <info@crazy-audio.com>
++ *		based on code by Florian Meier <florian.meier@koalo.de>
++ * Copyright (C) 2020
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/gpio/consumer.h>
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <linux/firmware.h>
++#include <linux/delay.h>
++#include <sound/tlv.h>
++
++static struct gpio_desc *pdn_gpio;
++static int vol = 0x30;
++
++// Volume control
++static int pifi_40_vol_get(struct snd_kcontrol *kcontrol,
++			   struct snd_ctl_elem_value *ucontrol)
++{
++	ucontrol->value.integer.value[0] = vol;
++	ucontrol->value.integer.value[1] = vol;
++	return 0;
++}
++
++static int pifi_40_vol_set(struct snd_kcontrol *kcontrol,
++			   struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct snd_soc_pcm_runtime *rtd;
++	unsigned int v = ucontrol->value.integer.value[0];
++	struct snd_soc_component *dac[2];
++
++	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
++	dac[0] = snd_soc_rtd_to_codec(rtd, 0)->component;
++	dac[1] = snd_soc_rtd_to_codec(rtd, 1)->component;
++
++	snd_soc_component_write(dac[0], 0x07, 255 - v);
++	snd_soc_component_write(dac[1], 0x07, 255 - v);
++
++	vol = v;
++	return 1;
++}
++
++static const DECLARE_TLV_DB_SCALE(digital_tlv_master, -10350, 50, 1);
++static const struct snd_kcontrol_new pifi_40_controls[] = {
++	SOC_DOUBLE_R_EXT_TLV("Master Volume", 0x00, 0x01,
++			     0x00, // Min
++			     0xff, // Max
++			     0x01, // Invert
++			     pifi_40_vol_get, pifi_40_vol_set,
++			     digital_tlv_master)
++};
++
++static const char * const codec_ctl_pfx[] = { "Left", "Right" };
++
++static const char * const codec_ctl_name[] = { "Master Volume",
++					"Speaker Volume",
++					"Speaker Switch" };
++
++static int snd_pifi_40_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_card *card = rtd->card;
++	struct snd_soc_component *dac[2];
++	struct snd_kcontrol *kctl;
++	int i, j;
++
++	dac[0] = snd_soc_rtd_to_codec(rtd, 0)->component;
++	dac[1] = snd_soc_rtd_to_codec(rtd, 1)->component;
++
++
++	// Set up cards - pulse power down first
++	gpiod_set_value_cansleep(pdn_gpio, 1);
++	usleep_range(1000, 10000);
++	gpiod_set_value_cansleep(pdn_gpio, 0);
++	usleep_range(20000, 30000);
++
++	// Oscillator trim
++	snd_soc_component_write(dac[0], 0x1b, 0);
++	snd_soc_component_write(dac[1], 0x1b, 0);
++	usleep_range(60000, 80000);
++
++	// Common setup
++	for (i = 0; i < 2; i++) {
++		// MCLK at 64fs, sample rate 44.1 or 48kHz
++		snd_soc_component_write(dac[i], 0x00, 0x60);
++
++		// Set up for PBTL
++		snd_soc_component_write(dac[i], 0x19, 0x3A);
++		snd_soc_component_write(dac[i], 0x25, 0x01103245);
++
++		// Master vol to -10db
++		snd_soc_component_write(dac[i], 0x07, 0x44);
++	}
++	// Inputs set to L and R respectively
++	snd_soc_component_write(dac[0], 0x20, 0x00017772);
++	snd_soc_component_write(dac[1], 0x20, 0x00107772);
++
++	// Remove codec controls
++	for (i = 0; i < 2; i++) {
++		for (j = 0; j < 3; j++) {
++			char cname[256];
++
++			sprintf(cname, "%s %s", codec_ctl_pfx[i],
++				codec_ctl_name[j]);
++			kctl = snd_soc_card_get_kcontrol(card, cname);
++			if (!kctl) {
++				pr_info("Control %s not found\n",
++				       cname);
++			} else {
++				kctl->vd[0].access =
++					SNDRV_CTL_ELEM_ACCESS_READWRITE;
++				snd_ctl_remove(card->snd_card, kctl);
++			}
++		}
++	}
++
++	return 0;
++}
++
++static int snd_pifi_40_hw_params(struct snd_pcm_substream *substream,
++				 struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
++
++	return snd_soc_dai_set_bclk_ratio(cpu_dai, 64);
++}
++
++static struct snd_soc_ops snd_pifi_40_ops = { .hw_params =
++						      snd_pifi_40_hw_params };
++
++static struct snd_soc_dai_link_component pifi_40_codecs[] = {
++	{
++		.dai_name = "tas571x-hifi",
++	},
++	{
++		.dai_name = "tas571x-hifi",
++	},
++};
++
++SND_SOC_DAILINK_DEFS(
++	pifi_40_dai, DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("tas571x.1-001a", "tas571x-hifi"),
++			   COMP_CODEC("tas571x.1-001b", "tas571x-hifi")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_pifi_40_dai[] = {
++	{
++		.name = "PiFi40",
++		.stream_name = "PiFi40",
++		.dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++			   SND_SOC_DAIFMT_CBS_CFS,
++		.ops = &snd_pifi_40_ops,
++		.init = snd_pifi_40_init,
++		SND_SOC_DAILINK_REG(pifi_40_dai),
++	},
++};
++
++// Machine driver
++static struct snd_soc_card snd_pifi_40 = {
++	.name = "PiFi40",
++	.owner = THIS_MODULE,
++	.dai_link = snd_pifi_40_dai,
++	.num_links = ARRAY_SIZE(snd_pifi_40_dai),
++	.controls = pifi_40_controls,
++	.num_controls = ARRAY_SIZE(pifi_40_controls)
++};
++
++static void snd_pifi_40_pdn(struct snd_soc_card *card, int on)
++{
++	if (pdn_gpio)
++		gpiod_set_value_cansleep(pdn_gpio, on ? 0 : 1);
++}
++
++static int snd_pifi_40_probe(struct platform_device *pdev)
++{
++	struct snd_soc_card *card = &snd_pifi_40;
++	int ret = 0, i = 0;
++
++	card->dev = &pdev->dev;
++	platform_set_drvdata(pdev, &snd_pifi_40);
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai;
++
++		dai = &snd_pifi_40_dai[0];
++		i2s_node = of_parse_phandle(pdev->dev.of_node, "i2s-controller",
++					    0);
++		if (i2s_node) {
++			for (i = 0; i < card->num_links; i++) {
++				dai->cpus->dai_name = NULL;
++				dai->cpus->of_node = i2s_node;
++				dai->platforms->name = NULL;
++				dai->platforms->of_node = i2s_node;
++			}
++		}
++
++		pifi_40_codecs[0].of_node =
++			of_parse_phandle(pdev->dev.of_node, "audio-codec", 0);
++		pifi_40_codecs[1].of_node =
++			of_parse_phandle(pdev->dev.of_node, "audio-codec", 1);
++		if (!pifi_40_codecs[0].of_node || !pifi_40_codecs[1].of_node) {
++			dev_err(&pdev->dev,
++				"Property 'audio-codec' missing or invalid\n");
++			return -EINVAL;
++		}
++
++		pdn_gpio = devm_gpiod_get_optional(&pdev->dev, "pdn",
++						   GPIOD_OUT_LOW);
++		if (IS_ERR(pdn_gpio)) {
++			ret = PTR_ERR(pdn_gpio);
++			dev_err(&pdev->dev, "failed to get pdn gpio: %d\n",
++				ret);
++			return ret;
++		}
++
++		ret = snd_soc_register_card(&snd_pifi_40);
++		if (ret < 0) {
++			dev_err(&pdev->dev,
++				"snd_soc_register_card() failed: %d\n", ret);
++			return ret;
++		}
++
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++static void snd_pifi_40_remove(struct platform_device *pdev)
++{
++	struct snd_soc_card *card = platform_get_drvdata(pdev);
++
++	kfree(&card->drvdata);
++	snd_pifi_40_pdn(&snd_pifi_40, 0);
++	snd_soc_unregister_card(&snd_pifi_40);
++}
++
++static const struct of_device_id snd_pifi_40_of_match[] = {
++	{
++		.compatible = "pifi,pifi-40",
++	},
++	{ /* sentinel */ },
++};
++
++MODULE_DEVICE_TABLE(of, snd_pifi_40_of_match);
++
++static struct platform_driver snd_pifi_40_driver = {
++	.driver = {
++		.name = "snd-pifi-40",
++		.owner = THIS_MODULE,
++		.of_match_table = snd_pifi_40_of_match,
++	},
++	.probe = snd_pifi_40_probe,
++	.remove = snd_pifi_40_remove,
++};
++
++module_platform_driver(snd_pifi_40_driver);
++
++MODULE_AUTHOR("David Knell <david.knell@gmail.com>");
++MODULE_DESCRIPTION("ALSA ASoC Machine Driver for PiFi-40");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/pisound.c
+@@ -0,0 +1,1254 @@
++/*
++ * Pisound Linux kernel module.
++ * Copyright (C) 2016-2024  Vilniaus Blokas UAB, https://blokas.io/pisound
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * as published by the Free Software Foundation; version 2 of the
++ * License.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
++ * MA  02110-1301, USA.
++ */
++
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/gpio.h>
++#include <linux/kobject.h>
++#include <linux/sysfs.h>
++#include <linux/delay.h>
++#include <linux/spi/spi.h>
++#include <linux/interrupt.h>
++#include <linux/kfifo.h>
++#include <linux/jiffies.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++#include <sound/rawmidi.h>
++#include <sound/asequencer.h>
++#include <sound/control.h>
++
++static int pisnd_spi_init(struct device *dev);
++static void pisnd_spi_uninit(void);
++
++static void pisnd_spi_flush(void);
++static void pisnd_spi_start(void);
++static uint8_t pisnd_spi_recv(uint8_t *buffer, uint8_t length);
++
++typedef void (*pisnd_spi_recv_cb)(void *data);
++static void pisnd_spi_set_callback(pisnd_spi_recv_cb cb, void *data);
++
++static const char *pisnd_spi_get_serial(void);
++static const char *pisnd_spi_get_id(void);
++static const char *pisnd_spi_get_fw_version(void);
++static const char *pisnd_spi_get_hw_version(void);
++
++static int pisnd_midi_init(struct snd_card *card);
++static void pisnd_midi_uninit(void);
++
++enum task_e {
++	TASK_PROCESS = 0,
++};
++
++static void pisnd_schedule_process(enum task_e task);
++
++#define PISOUND_LOG_PREFIX "pisound: "
++
++#ifdef PISOUND_DEBUG
++#	define printd(...) pr_alert(PISOUND_LOG_PREFIX __VA_ARGS__)
++#else
++#	define printd(...) do {} while (0)
++#endif
++
++#define printe(...) pr_err(PISOUND_LOG_PREFIX __VA_ARGS__)
++#define printi(...) pr_info(PISOUND_LOG_PREFIX __VA_ARGS__)
++
++static struct snd_rawmidi *g_rmidi;
++static struct snd_rawmidi_substream *g_midi_output_substream;
++
++static int pisnd_output_open(struct snd_rawmidi_substream *substream)
++{
++	g_midi_output_substream = substream;
++	return 0;
++}
++
++static int pisnd_output_close(struct snd_rawmidi_substream *substream)
++{
++	g_midi_output_substream = NULL;
++	return 0;
++}
++
++static void pisnd_output_trigger(
++	struct snd_rawmidi_substream *substream,
++	int up
++	)
++{
++	if (substream != g_midi_output_substream) {
++		printe("MIDI output trigger called for an unexpected stream!");
++		return;
++	}
++
++	if (!up)
++		return;
++
++	pisnd_spi_start();
++}
++
++static void pisnd_output_drain(struct snd_rawmidi_substream *substream)
++{
++	pisnd_spi_flush();
++}
++
++static int pisnd_input_open(struct snd_rawmidi_substream *substream)
++{
++	return 0;
++}
++
++static int pisnd_input_close(struct snd_rawmidi_substream *substream)
++{
++	return 0;
++}
++
++static void pisnd_midi_recv_callback(void *substream)
++{
++	uint8_t data[128];
++	uint8_t n = 0;
++
++	while ((n = pisnd_spi_recv(data, sizeof(data)))) {
++		int res = snd_rawmidi_receive(substream, data, n);
++		(void)res;
++		printd("midi recv %u bytes, res = %d\n", n, res);
++	}
++}
++
++static void pisnd_input_trigger(struct snd_rawmidi_substream *substream, int up)
++{
++	if (up) {
++		pisnd_spi_set_callback(pisnd_midi_recv_callback, substream);
++		pisnd_schedule_process(TASK_PROCESS);
++	} else {
++		pisnd_spi_set_callback(NULL, NULL);
++	}
++}
++
++static const struct snd_rawmidi_ops pisnd_output_ops = {
++	.open = pisnd_output_open,
++	.close = pisnd_output_close,
++	.trigger = pisnd_output_trigger,
++	.drain = pisnd_output_drain,
++};
++
++static const struct snd_rawmidi_ops pisnd_input_ops = {
++	.open = pisnd_input_open,
++	.close = pisnd_input_close,
++	.trigger = pisnd_input_trigger,
++};
++
++static void pisnd_get_port_info(
++	struct snd_rawmidi *rmidi,
++	int number,
++	struct snd_seq_port_info *seq_port_info
++	)
++{
++	seq_port_info->type =
++		SNDRV_SEQ_PORT_TYPE_MIDI_GENERIC |
++		SNDRV_SEQ_PORT_TYPE_HARDWARE |
++		SNDRV_SEQ_PORT_TYPE_PORT;
++	seq_port_info->midi_voices = 0;
++}
++
++static struct snd_rawmidi_global_ops pisnd_global_ops = {
++	.get_port_info = pisnd_get_port_info,
++};
++
++static int pisnd_midi_init(struct snd_card *card)
++{
++	int err;
++
++	g_midi_output_substream = NULL;
++
++	err = snd_rawmidi_new(card, "pisound MIDI", 0, 1, 1, &g_rmidi);
++
++	if (err < 0) {
++		printe("snd_rawmidi_new failed: %d\n", err);
++		return err;
++	}
++
++	strcpy(g_rmidi->name, "pisound MIDI ");
++	strcat(g_rmidi->name, pisnd_spi_get_serial());
++
++	g_rmidi->info_flags =
++		SNDRV_RAWMIDI_INFO_OUTPUT |
++		SNDRV_RAWMIDI_INFO_INPUT |
++		SNDRV_RAWMIDI_INFO_DUPLEX;
++
++	g_rmidi->ops = &pisnd_global_ops;
++
++	g_rmidi->private_data = (void *)0;
++
++	snd_rawmidi_set_ops(
++		g_rmidi,
++		SNDRV_RAWMIDI_STREAM_OUTPUT,
++		&pisnd_output_ops
++		);
++
++	snd_rawmidi_set_ops(
++		g_rmidi,
++		SNDRV_RAWMIDI_STREAM_INPUT,
++		&pisnd_input_ops
++		);
++
++	return 0;
++}
++
++static void pisnd_midi_uninit(void)
++{
++}
++
++static void *g_recvData;
++static pisnd_spi_recv_cb g_recvCallback;
++
++#define FIFO_SIZE 4096
++
++static char g_serial_num[11];
++static char g_id[25];
++enum { MAX_VERSION_STR_LEN = 6 };
++static char g_fw_version[MAX_VERSION_STR_LEN];
++static char g_hw_version[MAX_VERSION_STR_LEN];
++static u32 g_spi_speed_hz;
++
++static uint8_t g_ledFlashDuration;
++static bool    g_ledFlashDurationChanged;
++
++DEFINE_KFIFO(spi_fifo_in,  uint8_t, FIFO_SIZE);
++DEFINE_KFIFO(spi_fifo_out, uint8_t, FIFO_SIZE);
++
++static struct gpio_desc *data_available;
++static struct gpio_desc *spi_reset;
++
++static struct spi_device *pisnd_spi_device;
++
++static struct workqueue_struct *pisnd_workqueue;
++static struct work_struct pisnd_work_process;
++
++static void pisnd_work_handler(struct work_struct *work);
++
++static void spi_transfer(const uint8_t *txbuf, uint8_t *rxbuf, int len);
++static uint16_t spi_transfer16(uint16_t val);
++
++static int pisnd_init_workqueues(void)
++{
++	pisnd_workqueue = create_singlethread_workqueue("pisnd_workqueue");
++	INIT_WORK(&pisnd_work_process, pisnd_work_handler);
++
++	return 0;
++}
++
++static void pisnd_uninit_workqueues(void)
++{
++	flush_workqueue(pisnd_workqueue);
++	destroy_workqueue(pisnd_workqueue);
++
++	pisnd_workqueue = NULL;
++}
++
++static bool pisnd_spi_has_more(void)
++{
++	return gpiod_get_value(data_available);
++}
++
++static void pisnd_schedule_process(enum task_e task)
++{
++	if (pisnd_spi_device != NULL &&
++		pisnd_workqueue != NULL &&
++		!work_pending(&pisnd_work_process)
++		) {
++		printd("schedule: has more = %d\n", pisnd_spi_has_more());
++		if (task == TASK_PROCESS)
++			queue_work(pisnd_workqueue, &pisnd_work_process);
++	}
++}
++
++static irqreturn_t data_available_interrupt_handler(int irq, void *dev_id)
++{
++	if (irq == gpiod_to_irq(data_available) && pisnd_spi_has_more()) {
++		printd("schedule from irq\n");
++		pisnd_schedule_process(TASK_PROCESS);
++	}
++
++	return IRQ_HANDLED;
++}
++
++static uint16_t spi_transfer16(uint16_t val)
++{
++	uint8_t txbuf[2];
++	uint8_t rxbuf[2];
++
++	if (!pisnd_spi_device) {
++		printe("pisnd_spi_device null, returning\n");
++		return 0;
++	}
++
++	txbuf[0] = val >> 8;
++	txbuf[1] = val & 0xff;
++
++	spi_transfer(txbuf, rxbuf, sizeof(txbuf));
++
++	printd("received: %02x%02x\n", rxbuf[0], rxbuf[1]);
++
++	return (rxbuf[0] << 8) | rxbuf[1];
++}
++
++static void spi_transfer(const uint8_t *txbuf, uint8_t *rxbuf, int len)
++{
++	int err;
++	struct spi_transfer transfer;
++	struct spi_message msg;
++
++	memset(rxbuf, 0, len);
++
++	if (!pisnd_spi_device) {
++		printe("pisnd_spi_device null, returning\n");
++		return;
++	}
++
++	spi_message_init(&msg);
++
++	memset(&transfer, 0, sizeof(transfer));
++
++	transfer.tx_buf = txbuf;
++	transfer.rx_buf = rxbuf;
++	transfer.len = len;
++	transfer.speed_hz = g_spi_speed_hz;
++	transfer.delay.value = 10;
++	transfer.delay.unit = SPI_DELAY_UNIT_USECS;
++
++	spi_message_add_tail(&transfer, &msg);
++
++	err = spi_sync(pisnd_spi_device, &msg);
++
++	if (err < 0) {
++		printe("spi_sync error %d\n", err);
++		return;
++	}
++
++	printd("hasMore %d\n", pisnd_spi_has_more());
++}
++
++static int spi_read_bytes(char *dst, size_t length, uint8_t *bytesRead)
++{
++	uint16_t rx;
++	uint8_t size;
++	uint8_t i;
++
++	memset(dst, 0, length);
++	*bytesRead = 0;
++
++	rx = spi_transfer16(0);
++	if (!(rx >> 8))
++		return -EINVAL;
++
++	size = rx & 0xff;
++
++	if (size > length)
++		return -EINVAL;
++
++	for (i = 0; i < size; ++i) {
++		rx = spi_transfer16(0);
++		if (!(rx >> 8))
++			return -EINVAL;
++
++		dst[i] = rx & 0xff;
++	}
++
++	*bytesRead = i;
++
++	return 0;
++}
++
++static int spi_device_match(struct device *dev, const void *data)
++{
++	struct spi_device *spi = container_of(dev, struct spi_device, dev);
++
++	printd("      %s %s %dkHz %d bits mode=0x%02X\n",
++		spi->modalias, dev_name(dev), spi->max_speed_hz/1000,
++		spi->bits_per_word, spi->mode);
++
++	if (strcmp("pisound-spi", spi->modalias) == 0) {
++		printi("\tFound!\n");
++		return 1;
++	}
++
++	printe("\tNot found!\n");
++	return 0;
++}
++
++static struct spi_device *pisnd_spi_find_device(void)
++{
++	struct device *dev;
++
++	printi("Searching for spi device...\n");
++	dev = bus_find_device(&spi_bus_type, NULL, NULL, spi_device_match);
++	if (dev != NULL)
++		return container_of(dev, struct spi_device, dev);
++	else
++		return NULL;
++}
++
++static void pisnd_work_handler(struct work_struct *work)
++{
++	enum { TRANSFER_SIZE = 4 };
++	enum { PISOUND_OUTPUT_BUFFER_SIZE_MILLIBYTES = 127 * 1000 };
++	enum { MIDI_MILLIBYTES_PER_JIFFIE = (3125 * 1000) / HZ };
++	int out_buffer_used_millibytes = 0;
++	unsigned long now;
++	uint8_t val;
++	uint8_t txbuf[TRANSFER_SIZE];
++	uint8_t rxbuf[TRANSFER_SIZE];
++	uint8_t midibuf[TRANSFER_SIZE];
++	int i, n;
++	bool had_data;
++
++	unsigned long last_transfer_at = jiffies;
++
++	if (work == &pisnd_work_process) {
++		if (pisnd_spi_device == NULL)
++			return;
++
++		do {
++			if (g_midi_output_substream &&
++				kfifo_avail(&spi_fifo_out) >= sizeof(midibuf)) {
++
++				n = snd_rawmidi_transmit_peek(
++					g_midi_output_substream,
++					midibuf, sizeof(midibuf)
++				);
++
++				if (n > 0) {
++					for (i = 0; i < n; ++i)
++						kfifo_put(
++							&spi_fifo_out,
++							midibuf[i]
++							);
++					snd_rawmidi_transmit_ack(
++						g_midi_output_substream,
++						i
++						);
++				}
++			}
++
++			had_data = false;
++			memset(txbuf, 0, sizeof(txbuf));
++			for (i = 0; i < sizeof(txbuf) &&
++				((out_buffer_used_millibytes+1000 <
++				PISOUND_OUTPUT_BUFFER_SIZE_MILLIBYTES) ||
++				g_ledFlashDurationChanged);
++				i += 2) {
++
++				val = 0;
++
++				if (g_ledFlashDurationChanged) {
++					txbuf[i+0] = 0xf0;
++					txbuf[i+1] = g_ledFlashDuration;
++					g_ledFlashDuration = 0;
++					g_ledFlashDurationChanged = false;
++				} else if (kfifo_get(&spi_fifo_out, &val)) {
++					txbuf[i+0] = 0x0f;
++					txbuf[i+1] = val;
++					out_buffer_used_millibytes += 1000;
++				}
++			}
++
++			spi_transfer(txbuf, rxbuf, sizeof(txbuf));
++			/* Estimate the Pisound's MIDI output buffer usage, so
++			 * that we don't overflow it. Space in the buffer should
++			 * be becoming available at the UART MIDI byte transfer
++			 * rate.
++			 */
++			now = jiffies;
++			if (now != last_transfer_at) {
++				out_buffer_used_millibytes -=
++					(now - last_transfer_at) *
++					MIDI_MILLIBYTES_PER_JIFFIE;
++				if (out_buffer_used_millibytes < 0)
++					out_buffer_used_millibytes = 0;
++				last_transfer_at = now;
++			}
++
++			for (i = 0; i < sizeof(rxbuf); i += 2) {
++				if (rxbuf[i]) {
++					kfifo_put(&spi_fifo_in, rxbuf[i+1]);
++					if (kfifo_len(&spi_fifo_in) > 16 &&
++						g_recvCallback)
++						g_recvCallback(g_recvData);
++					had_data = true;
++				}
++			}
++		} while (had_data
++			|| !kfifo_is_empty(&spi_fifo_out)
++			|| pisnd_spi_has_more()
++			|| g_ledFlashDurationChanged
++			|| out_buffer_used_millibytes != 0
++			);
++
++		if (!kfifo_is_empty(&spi_fifo_in) && g_recvCallback)
++			g_recvCallback(g_recvData);
++	}
++}
++
++static int pisnd_spi_gpio_init(struct device *dev)
++{
++	spi_reset = gpiod_get_index(dev, "reset", 1, GPIOD_ASIS);
++	data_available = gpiod_get_index(dev, "data_available", 0, GPIOD_ASIS);
++
++	gpiod_direction_output(spi_reset, 1);
++	gpiod_direction_input(data_available);
++
++	/* Reset the slave. */
++	gpiod_set_value(spi_reset, false);
++	mdelay(1);
++	gpiod_set_value(spi_reset, true);
++
++	/* Give time for spi slave to start. */
++	mdelay(64);
++
++	return 0;
++}
++
++static void pisnd_spi_gpio_uninit(void)
++{
++	gpiod_set_value(spi_reset, false);
++	gpiod_put(spi_reset);
++	spi_reset = NULL;
++
++	gpiod_put(data_available);
++	data_available = NULL;
++}
++
++static int pisnd_spi_gpio_irq_init(struct device *dev)
++{
++	return request_threaded_irq(
++		gpiod_to_irq(data_available), NULL,
++		data_available_interrupt_handler,
++		IRQF_TIMER | IRQF_TRIGGER_RISING | IRQF_ONESHOT,
++		"data_available_int",
++		NULL
++		);
++}
++
++static void pisnd_spi_gpio_irq_uninit(void)
++{
++	free_irq(gpiod_to_irq(data_available), NULL);
++}
++
++static int spi_read_info(void)
++{
++	uint16_t tmp;
++	uint8_t count;
++	uint8_t n;
++	uint8_t i;
++	uint8_t j;
++	char buffer[257];
++	int ret;
++	char *p;
++
++	memset(g_serial_num, 0, sizeof(g_serial_num));
++	memset(g_fw_version, 0, sizeof(g_fw_version));
++	strcpy(g_hw_version, "1.0"); // Assume 1.0 hw version.
++	memset(g_id, 0, sizeof(g_id));
++
++	tmp = spi_transfer16(0);
++
++	if (!(tmp >> 8))
++		return -EINVAL;
++
++	count = tmp & 0xff;
++
++	for (i = 0; i < count; ++i) {
++		memset(buffer, 0, sizeof(buffer));
++		ret = spi_read_bytes(buffer, sizeof(buffer)-1, &n);
++
++		if (ret < 0)
++			return ret;
++
++		switch (i) {
++		case 0:
++			if (n != 2)
++				return -EINVAL;
++
++			snprintf(
++				g_fw_version,
++				MAX_VERSION_STR_LEN,
++				"%x.%02x",
++				buffer[0],
++				buffer[1]
++				);
++
++			g_fw_version[MAX_VERSION_STR_LEN-1] = '\0';
++			break;
++		case 3:
++			if (n != 2)
++				return -EINVAL;
++
++			snprintf(
++				g_hw_version,
++				MAX_VERSION_STR_LEN,
++				"%x.%x",
++				buffer[0],
++				buffer[1]
++			);
++
++			g_hw_version[MAX_VERSION_STR_LEN-1] = '\0';
++			break;
++		case 1:
++			if (n >= sizeof(g_serial_num))
++				return -EINVAL;
++
++			memcpy(g_serial_num, buffer, sizeof(g_serial_num));
++			break;
++		case 2:
++			{
++				if (n*2 >= sizeof(g_id))
++					return -EINVAL;
++
++				p = g_id;
++				for (j = 0; j < n; ++j)
++					p += sprintf(p, "%02x", buffer[j]);
++
++				*p = '\0';
++			}
++			break;
++		default:
++			break;
++		}
++	}
++
++	return 0;
++}
++
++static int pisnd_spi_init(struct device *dev)
++{
++	int ret;
++	struct spi_device *spi;
++
++	memset(g_serial_num, 0, sizeof(g_serial_num));
++	memset(g_id, 0, sizeof(g_id));
++	memset(g_fw_version, 0, sizeof(g_fw_version));
++	memset(g_hw_version, 0, sizeof(g_hw_version));
++
++	g_spi_speed_hz = 150000;
++	if (dev->of_node) {
++		struct device_node *spi_node;
++
++		spi_node = of_parse_phandle(
++			dev->of_node,
++			"spi-controller",
++			0
++			);
++
++		if (spi_node) {
++			ret = of_property_read_u32(spi_node, "spi-speed-hz", &g_spi_speed_hz);
++			if (ret != 0)
++				printe("Failed reading spi-speed-hz! (%d)\n", ret);
++
++			of_node_put(spi_node);
++		}
++	}
++	printi("Using SPI speed: %u\n", g_spi_speed_hz);
++
++	spi = pisnd_spi_find_device();
++
++	if (spi != NULL) {
++		printd("initializing spi!\n");
++		pisnd_spi_device = spi;
++		ret = spi_setup(pisnd_spi_device);
++	} else {
++		printe("SPI device not found, deferring!\n");
++		return -EPROBE_DEFER;
++	}
++
++	ret = pisnd_spi_gpio_init(dev);
++
++	if (ret < 0) {
++		printe("SPI GPIO init failed: %d\n", ret);
++		spi_dev_put(pisnd_spi_device);
++		pisnd_spi_device = NULL;
++		pisnd_spi_gpio_uninit();
++		return ret;
++	}
++
++	ret = spi_read_info();
++
++	if (ret < 0) {
++		printe("Reading card info failed: %d\n", ret);
++		spi_dev_put(pisnd_spi_device);
++		pisnd_spi_device = NULL;
++		pisnd_spi_gpio_uninit();
++		return ret;
++	}
++
++	/* Flash the LEDs. */
++	spi_transfer16(0xf008);
++
++	ret = pisnd_spi_gpio_irq_init(dev);
++	if (ret < 0) {
++		printe("SPI irq request failed: %d\n", ret);
++		spi_dev_put(pisnd_spi_device);
++		pisnd_spi_device = NULL;
++		pisnd_spi_gpio_irq_uninit();
++		pisnd_spi_gpio_uninit();
++	}
++
++	ret = pisnd_init_workqueues();
++	if (ret != 0) {
++		printe("Workqueue initialization failed: %d\n", ret);
++		spi_dev_put(pisnd_spi_device);
++		pisnd_spi_device = NULL;
++		pisnd_spi_gpio_irq_uninit();
++		pisnd_spi_gpio_uninit();
++		pisnd_uninit_workqueues();
++		return ret;
++	}
++
++	if (pisnd_spi_has_more()) {
++		printd("data is available, scheduling from init\n");
++		pisnd_schedule_process(TASK_PROCESS);
++	}
++
++	return 0;
++}
++
++static void pisnd_spi_uninit(void)
++{
++	pisnd_uninit_workqueues();
++
++	spi_dev_put(pisnd_spi_device);
++	pisnd_spi_device = NULL;
++
++	pisnd_spi_gpio_irq_uninit();
++	pisnd_spi_gpio_uninit();
++}
++
++static void pisnd_spi_flash_leds(uint8_t duration)
++{
++	g_ledFlashDuration = duration;
++	g_ledFlashDurationChanged = true;
++	printd("schedule from spi_flash_leds\n");
++	pisnd_schedule_process(TASK_PROCESS);
++}
++
++static void pisnd_spi_flush(void)
++{
++	while (!kfifo_is_empty(&spi_fifo_out)) {
++		pisnd_spi_start();
++		flush_workqueue(pisnd_workqueue);
++	}
++}
++
++static void pisnd_spi_start(void)
++{
++	printd("schedule from spi_start\n");
++	pisnd_schedule_process(TASK_PROCESS);
++}
++
++static uint8_t pisnd_spi_recv(uint8_t *buffer, uint8_t length)
++{
++	return kfifo_out(&spi_fifo_in, buffer, length);
++}
++
++static void pisnd_spi_set_callback(pisnd_spi_recv_cb cb, void *data)
++{
++	g_recvData = data;
++	g_recvCallback = cb;
++}
++
++static const char *pisnd_spi_get_serial(void)
++{
++	return g_serial_num;
++}
++
++static const char *pisnd_spi_get_id(void)
++{
++	return g_id;
++}
++
++static const char *pisnd_spi_get_fw_version(void)
++{
++	return g_fw_version;
++}
++
++static const char *pisnd_spi_get_hw_version(void)
++{
++	return g_hw_version;
++}
++
++static const struct of_device_id pisound_of_match[] = {
++	{ .compatible = "blokaslabs,pisound", },
++	{ .compatible = "blokaslabs,pisound-spi", },
++	{},
++};
++
++enum {
++	SWITCH = 0,
++	VOLUME = 1,
++};
++
++static int pisnd_ctl_info(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_info *uinfo)
++{
++	if (kcontrol->private_value == SWITCH) {
++		uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
++		uinfo->count = 1;
++		uinfo->value.integer.min = 0;
++		uinfo->value.integer.max = 1;
++		return 0;
++	} else if (kcontrol->private_value == VOLUME) {
++		uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
++		uinfo->count = 1;
++		uinfo->value.integer.min = 0;
++		uinfo->value.integer.max = 100;
++		return 0;
++	}
++	return -EINVAL;
++}
++
++static int pisnd_ctl_get(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_value *ucontrol)
++{
++	if (kcontrol->private_value == SWITCH) {
++		ucontrol->value.integer.value[0] = 1;
++		return 0;
++	} else if (kcontrol->private_value == VOLUME) {
++		ucontrol->value.integer.value[0] = 100;
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++static struct snd_kcontrol_new pisnd_ctl[] = {
++	{
++		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
++		.name = "PCM Playback Switch",
++		.index = 0,
++		.private_value = SWITCH,
++		.access = SNDRV_CTL_ELEM_ACCESS_READ,
++		.info = pisnd_ctl_info,
++		.get = pisnd_ctl_get,
++	},
++	{
++		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
++		.name = "PCM Playback Volume",
++		.index = 0,
++		.private_value = VOLUME,
++		.access = SNDRV_CTL_ELEM_ACCESS_READ,
++		.info = pisnd_ctl_info,
++		.get = pisnd_ctl_get,
++	},
++};
++
++static int pisnd_ctl_init(struct snd_card *card)
++{
++	int err, i;
++
++	for (i = 0; i < ARRAY_SIZE(pisnd_ctl); ++i) {
++		err = snd_ctl_add(card, snd_ctl_new1(&pisnd_ctl[i], NULL));
++		if (err < 0)
++			return err;
++	}
++
++	return 0;
++}
++
++static int pisnd_ctl_uninit(void)
++{
++	return 0;
++}
++
++static struct gpio_desc *osr0, *osr1, *osr2;
++static struct gpio_desc *reset;
++
++static int pisnd_hw_params(
++	struct snd_pcm_substream *substream,
++	struct snd_pcm_hw_params *params
++	)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
++
++	/* Pisound runs on fixed 32 clock counts per channel,
++	 * as generated by the master ADC.
++	 */
++	snd_soc_dai_set_bclk_ratio(cpu_dai, 32*2);
++
++	printd("rate   = %d\n", params_rate(params));
++	printd("ch     = %d\n", params_channels(params));
++	printd("bits   = %u\n",
++		snd_pcm_format_width(params_format(params)));
++	printd("format = %d\n", params_format(params));
++
++	gpiod_set_value(reset, false);
++
++	switch (params_rate(params)) {
++	case 48000:
++		gpiod_set_value(osr0, true);
++		gpiod_set_value(osr1, false);
++		gpiod_set_value(osr2, false);
++		break;
++	case 96000:
++		gpiod_set_value(osr0, true);
++		gpiod_set_value(osr1, false);
++		gpiod_set_value(osr2, true);
++		break;
++	case 192000:
++		gpiod_set_value(osr0, true);
++		gpiod_set_value(osr1, true);
++		gpiod_set_value(osr2, true);
++		break;
++	default:
++		printe("Unsupported rate %u!\n", params_rate(params));
++		return -EINVAL;
++	}
++
++	gpiod_set_value(reset, true);
++
++	return 0;
++}
++
++static unsigned int rates[3] = {
++	48000, 96000, 192000
++};
++
++static struct snd_pcm_hw_constraint_list constraints_rates = {
++	.count = ARRAY_SIZE(rates),
++	.list = rates,
++	.mask = 0,
++};
++
++static int pisnd_startup(struct snd_pcm_substream *substream)
++{
++	int err = snd_pcm_hw_constraint_list(
++		substream->runtime,
++		0,
++		SNDRV_PCM_HW_PARAM_RATE,
++		&constraints_rates
++		);
++
++	if (err < 0)
++		return err;
++
++	err = snd_pcm_hw_constraint_single(
++		substream->runtime,
++		SNDRV_PCM_HW_PARAM_CHANNELS,
++		2
++		);
++
++	if (err < 0)
++		return err;
++
++	err = snd_pcm_hw_constraint_mask64(
++		substream->runtime,
++		SNDRV_PCM_HW_PARAM_FORMAT,
++		SNDRV_PCM_FMTBIT_S16_LE |
++		SNDRV_PCM_FMTBIT_S24_LE |
++		SNDRV_PCM_FMTBIT_S32_LE
++		);
++
++	if (err < 0)
++		return err;
++
++	return 0;
++}
++
++static const struct snd_soc_ops pisnd_ops = {
++	.startup = pisnd_startup,
++	.hw_params = pisnd_hw_params,
++};
++
++SND_SOC_DAILINK_DEFS(pisnd,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_DUMMY()),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link pisnd_dai[] = {
++	{
++		.name           = "pisound",
++		.stream_name    = "pisound",
++		.dai_fmt        =
++			SND_SOC_DAIFMT_I2S |
++			SND_SOC_DAIFMT_NB_NF |
++			SND_SOC_DAIFMT_CBM_CFM,
++		.ops            = &pisnd_ops,
++		SND_SOC_DAILINK_REG(pisnd),
++	},
++};
++
++static int pisnd_card_probe(struct snd_soc_card *card)
++{
++	int err = pisnd_midi_init(card->snd_card);
++
++	if (err < 0) {
++		printe("pisnd_midi_init failed: %d\n", err);
++		return err;
++	}
++
++	err = pisnd_ctl_init(card->snd_card);
++	if (err < 0) {
++		printe("pisnd_ctl_init failed: %d\n", err);
++		return err;
++	}
++
++	return 0;
++}
++
++static int pisnd_card_remove(struct snd_soc_card *card)
++{
++	pisnd_ctl_uninit();
++	pisnd_midi_uninit();
++	return 0;
++}
++
++static struct snd_soc_card pisnd_card = {
++	.name         = "pisound",
++	.owner        = THIS_MODULE,
++	.dai_link     = pisnd_dai,
++	.num_links    = ARRAY_SIZE(pisnd_dai),
++	.probe        = pisnd_card_probe,
++	.remove       = pisnd_card_remove,
++};
++
++static int pisnd_init_gpio(struct device *dev)
++{
++	osr0 = gpiod_get_index(dev, "osr", 0, GPIOD_ASIS);
++	osr1 = gpiod_get_index(dev, "osr", 1, GPIOD_ASIS);
++	osr2 = gpiod_get_index(dev, "osr", 2, GPIOD_ASIS);
++
++	reset = gpiod_get_index(dev, "reset", 0, GPIOD_ASIS);
++
++	gpiod_direction_output(osr0,  1);
++	gpiod_direction_output(osr1,  1);
++	gpiod_direction_output(osr2,  1);
++	gpiod_direction_output(reset, 1);
++
++	gpiod_set_value(reset, false);
++	gpiod_set_value(osr0,   true);
++	gpiod_set_value(osr1,  false);
++	gpiod_set_value(osr2,  false);
++	gpiod_set_value(reset,  true);
++
++	return 0;
++}
++
++static int pisnd_uninit_gpio(void)
++{
++	int i;
++
++	struct gpio_desc **gpios[] = {
++		&osr0, &osr1, &osr2, &reset,
++	};
++
++	for (i = 0; i < ARRAY_SIZE(gpios); ++i) {
++		if (*gpios[i] == NULL) {
++			printd("weird, GPIO[%d] is NULL already\n", i);
++			continue;
++		}
++
++		gpiod_put(*gpios[i]);
++		*gpios[i] = NULL;
++	}
++
++	return 0;
++}
++
++static struct kobject *pisnd_kobj;
++
++static ssize_t pisnd_serial_show(
++	struct kobject *kobj,
++	struct kobj_attribute *attr,
++	char *buf
++	)
++{
++	return sprintf(buf, "%s\n", pisnd_spi_get_serial());
++}
++
++static ssize_t pisnd_id_show(
++	struct kobject *kobj,
++	struct kobj_attribute *attr,
++	char *buf
++	)
++{
++	return sprintf(buf, "%s\n", pisnd_spi_get_id());
++}
++
++static ssize_t pisnd_fw_version_show(
++	struct kobject *kobj,
++	struct kobj_attribute *attr,
++	char *buf
++	)
++{
++	return sprintf(buf, "%s\n", pisnd_spi_get_fw_version());
++}
++
++static ssize_t pisnd_hw_version_show(
++	struct kobject *kobj,
++	struct kobj_attribute *attr,
++	char *buf
++)
++{
++	return sprintf(buf, "%s\n", pisnd_spi_get_hw_version());
++}
++
++static ssize_t pisnd_led_store(
++	struct kobject *kobj,
++	struct kobj_attribute *attr,
++	const char *buf,
++	size_t length
++	)
++{
++	uint32_t timeout;
++	int err;
++
++	err = kstrtou32(buf, 10, &timeout);
++
++	if (err == 0 && timeout <= 255)
++		pisnd_spi_flash_leds(timeout);
++
++	return length;
++}
++
++static struct kobj_attribute pisnd_serial_attribute =
++	__ATTR(serial, 0444, pisnd_serial_show, NULL);
++static struct kobj_attribute pisnd_id_attribute =
++	__ATTR(id, 0444, pisnd_id_show, NULL);
++static struct kobj_attribute pisnd_fw_version_attribute =
++	__ATTR(version, 0444, pisnd_fw_version_show, NULL);
++static struct kobj_attribute pisnd_hw_version_attribute =
++__ATTR(hw_version, 0444, pisnd_hw_version_show, NULL);
++static struct kobj_attribute pisnd_led_attribute =
++	__ATTR(led, 0644, NULL, pisnd_led_store);
++
++static struct attribute *attrs[] = {
++	&pisnd_serial_attribute.attr,
++	&pisnd_id_attribute.attr,
++	&pisnd_fw_version_attribute.attr,
++	&pisnd_hw_version_attribute.attr,
++	&pisnd_led_attribute.attr,
++	NULL
++};
++
++static struct attribute_group attr_group = { .attrs = attrs };
++
++static int pisnd_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++	int i;
++
++	ret = pisnd_spi_init(&pdev->dev);
++	if (ret < 0) {
++		printe("pisnd_spi_init failed: %d\n", ret);
++		return ret;
++	}
++
++	printi("Detected Pisound card:\n");
++	printi("\tSerial:           %s\n", pisnd_spi_get_serial());
++	printi("\tFirmware Version: %s\n", pisnd_spi_get_fw_version());
++	printi("\tHardware Version: %s\n", pisnd_spi_get_hw_version());
++	printi("\tId:               %s\n", pisnd_spi_get_id());
++
++	pisnd_kobj = kobject_create_and_add("pisound", kernel_kobj);
++	if (!pisnd_kobj) {
++		pisnd_spi_uninit();
++		return -ENOMEM;
++	}
++
++	ret = sysfs_create_group(pisnd_kobj, &attr_group);
++	if (ret < 0) {
++		pisnd_spi_uninit();
++		kobject_put(pisnd_kobj);
++		return -ENOMEM;
++	}
++
++	pisnd_init_gpio(&pdev->dev);
++	pisnd_card.dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++
++		i2s_node = of_parse_phandle(
++			pdev->dev.of_node,
++			"i2s-controller",
++			0
++			);
++
++		for (i = 0; i < pisnd_card.num_links; ++i) {
++			struct snd_soc_dai_link *dai = &pisnd_dai[i];
++
++			if (i2s_node) {
++				dai->cpus->dai_name = NULL;
++				dai->cpus->of_node = i2s_node;
++				dai->platforms->name = NULL;
++				dai->platforms->of_node = i2s_node;
++				dai->stream_name = pisnd_spi_get_serial();
++			}
++		}
++	}
++
++	ret = snd_soc_register_card(&pisnd_card);
++
++	if (ret < 0) {
++		if (ret != -EPROBE_DEFER)
++			printe("snd_soc_register_card() failed: %d\n", ret);
++		pisnd_uninit_gpio();
++		kobject_put(pisnd_kobj);
++		pisnd_spi_uninit();
++	}
++
++	return ret;
++}
++
++static void pisnd_remove(struct platform_device *pdev)
++{
++	printi("Unloading.\n");
++
++	if (pisnd_kobj) {
++		kobject_put(pisnd_kobj);
++		pisnd_kobj = NULL;
++	}
++
++	pisnd_spi_uninit();
++
++	/* Turn off */
++	gpiod_set_value(reset, false);
++	pisnd_uninit_gpio();
++
++	snd_soc_unregister_card(&pisnd_card);
++}
++
++MODULE_DEVICE_TABLE(of, pisound_of_match);
++
++static struct platform_driver pisnd_driver = {
++	.driver = {
++		.name           = "snd-rpi-pisound",
++		.owner          = THIS_MODULE,
++		.of_match_table = pisound_of_match,
++	},
++	.probe              = pisnd_probe,
++	.remove             = pisnd_remove,
++};
++
++module_platform_driver(pisnd_driver);
++
++MODULE_AUTHOR("Giedrius Trainavicius <giedrius@blokas.io>");
++MODULE_DESCRIPTION("ASoC Driver for Pisound, https://blokas.io/pisound");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/rpi-cirrus.c
+@@ -0,0 +1,1027 @@
++/*
++ * ASoC machine driver for Cirrus Logic Audio Card
++ * (with WM5102 and WM8804 codecs)
++ *
++ * Copyright 2015-2017 Matthias Reichl <hias@horus.com>
++ *
++ * Based on rpi-cirrus-sound-pi driver (c) Wolfson / Cirrus Logic Inc.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/module.h>
++#include <linux/mutex.h>
++#include <linux/slab.h>
++#include <linux/list.h>
++#include <linux/delay.h>
++#include <sound/pcm_params.h>
++
++#include <linux/mfd/arizona/registers.h>
++
++#include "../codecs/wm5102.h"
++#include "../codecs/wm8804.h"
++
++#define WM8804_CLKOUT_HZ 12000000
++
++#define RPI_CIRRUS_DEFAULT_RATE 44100
++#define WM5102_MAX_SYSCLK_1 49152000 /* max sysclk for 4K family */
++#define WM5102_MAX_SYSCLK_2 45158400 /* max sysclk for 11.025K family */
++
++static inline unsigned int calc_sysclk(unsigned int rate)
++{
++	return (rate % 4000) ? WM5102_MAX_SYSCLK_2 : WM5102_MAX_SYSCLK_1;
++}
++
++enum {
++	DAI_WM5102 = 0,
++	DAI_WM8804,
++};
++
++struct rpi_cirrus_priv {
++	/* mutex for synchronzing FLL1 access with DAPM */
++	struct mutex lock;
++	unsigned int card_rate;
++	int sync_path_enable;
++	int fll1_freq; /* negative means RefClock in spdif rx case */
++
++	/* track hw params/free for substreams */
++	unsigned int params_set;
++	unsigned int min_rate_idx, max_rate_idx;
++	unsigned char iec958_status[4];
++};
++
++/* helper functions */
++static inline struct snd_soc_pcm_runtime *get_wm5102_runtime(
++	struct snd_soc_card *card) {
++	return snd_soc_get_pcm_runtime(card, &card->dai_link[DAI_WM5102]);
++}
++
++static inline struct snd_soc_pcm_runtime *get_wm8804_runtime(
++	struct snd_soc_card *card) {
++	return snd_soc_get_pcm_runtime(card, &card->dai_link[DAI_WM8804]);
++}
++
++
++struct rate_info {
++	unsigned int value;
++	char *text;
++};
++
++static struct rate_info min_rates[] = {
++	{     0, "off"},
++	{ 32000, "32kHz"},
++	{ 44100, "44.1kHz"}
++};
++
++#define NUM_MIN_RATES ARRAY_SIZE(min_rates)
++
++static int rpi_cirrus_min_rate_info(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_info *uinfo)
++{
++	uinfo->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
++	uinfo->count = 1;
++	uinfo->value.enumerated.items = NUM_MIN_RATES;
++
++	if (uinfo->value.enumerated.item >= NUM_MIN_RATES)
++		uinfo->value.enumerated.item = NUM_MIN_RATES - 1;
++	strcpy(uinfo->value.enumerated.name,
++		min_rates[uinfo->value.enumerated.item].text);
++	return 0;
++}
++
++static int rpi_cirrus_min_rate_get(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++
++	ucontrol->value.enumerated.item[0] = priv->min_rate_idx;
++	return 0;
++}
++
++static int rpi_cirrus_min_rate_put(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++	int changed = 0;
++
++	if (priv->min_rate_idx != ucontrol->value.enumerated.item[0]) {
++		changed = 1;
++		priv->min_rate_idx = ucontrol->value.enumerated.item[0];
++	}
++
++	return changed;
++}
++
++static struct rate_info max_rates[] = {
++	{     0, "off"},
++	{ 48000, "48kHz"},
++	{ 96000, "96kHz"}
++};
++
++#define NUM_MAX_RATES ARRAY_SIZE(max_rates)
++
++static int rpi_cirrus_max_rate_info(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_info *uinfo)
++{
++	uinfo->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
++	uinfo->count = 1;
++	uinfo->value.enumerated.items = NUM_MAX_RATES;
++	if (uinfo->value.enumerated.item >= NUM_MAX_RATES)
++		uinfo->value.enumerated.item = NUM_MAX_RATES - 1;
++	strcpy(uinfo->value.enumerated.name,
++		max_rates[uinfo->value.enumerated.item].text);
++	return 0;
++}
++
++static int rpi_cirrus_max_rate_get(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++
++	ucontrol->value.enumerated.item[0] = priv->max_rate_idx;
++	return 0;
++}
++
++static int rpi_cirrus_max_rate_put(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++	int changed = 0;
++
++	if (priv->max_rate_idx != ucontrol->value.enumerated.item[0]) {
++		changed = 1;
++		priv->max_rate_idx = ucontrol->value.enumerated.item[0];
++	}
++
++	return changed;
++}
++
++static int rpi_cirrus_spdif_info(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_info *uinfo)
++{
++	uinfo->type = SNDRV_CTL_ELEM_TYPE_IEC958;
++	uinfo->count = 1;
++	return 0;
++}
++
++static int rpi_cirrus_spdif_playback_get(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++	int i;
++
++	for (i = 0; i < 4; i++)
++		ucontrol->value.iec958.status[i] = priv->iec958_status[i];
++
++	return 0;
++}
++
++static int rpi_cirrus_spdif_playback_put(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct snd_soc_component *wm8804_component =
++		snd_soc_rtd_to_codec(get_wm8804_runtime(card), 0)->component;
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++	unsigned char *stat = priv->iec958_status;
++	unsigned char *ctrl_stat = ucontrol->value.iec958.status;
++	unsigned int mask;
++	int i, changed = 0;
++
++	for (i = 0; i < 4; i++) {
++		mask = (i == 3) ? 0x3f : 0xff;
++		if ((ctrl_stat[i] & mask) != (stat[i] & mask)) {
++			changed = 1;
++			stat[i] = ctrl_stat[i] & mask;
++			snd_soc_component_update_bits(wm8804_component,
++				WM8804_SPDTX1 + i, mask, stat[i]);
++		}
++	}
++
++	return changed;
++}
++
++static int rpi_cirrus_spdif_mask_get(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_value *ucontrol)
++{
++	ucontrol->value.iec958.status[0] = 0xff;
++	ucontrol->value.iec958.status[1] = 0xff;
++	ucontrol->value.iec958.status[2] = 0xff;
++	ucontrol->value.iec958.status[3] = 0x3f;
++
++	return 0;
++}
++
++static int rpi_cirrus_spdif_capture_get(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct snd_soc_component *wm8804_component =
++		snd_soc_rtd_to_codec(get_wm8804_runtime(card), 0)->component;
++	unsigned int val, mask;
++	int i;
++
++	for (i = 0; i < 4; i++) {
++		val = snd_soc_component_read(wm8804_component,
++			WM8804_RXCHAN1 + i);
++		mask = (i == 3) ? 0x3f : 0xff;
++		ucontrol->value.iec958.status[i] = val & mask;
++	}
++
++	return 0;
++}
++
++#define SPDIF_FLAG_CTRL(desc, reg, bit, invert) \
++{ \
++		.access =  SNDRV_CTL_ELEM_ACCESS_READ \
++			   | SNDRV_CTL_ELEM_ACCESS_VOLATILE, \
++		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER, \
++		.name =    SNDRV_CTL_NAME_IEC958("", CAPTURE, NONE) \
++				desc " Flag", \
++		.info =    snd_ctl_boolean_mono_info, \
++		.get =     rpi_cirrus_spdif_status_flag_get, \
++		.private_value = \
++			(bit) | ((reg) << 8) | ((invert) << 16) \
++}
++
++static int rpi_cirrus_spdif_status_flag_get(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct snd_soc_component *wm8804_component =
++		snd_soc_rtd_to_codec(get_wm8804_runtime(card), 0)->component;
++
++	unsigned int bit = kcontrol->private_value & 0xff;
++	unsigned int reg = (kcontrol->private_value >> 8) & 0xff;
++	unsigned int invert = (kcontrol->private_value >> 16) & 0xff;
++	unsigned int val;
++	bool flag;
++
++	val = snd_soc_component_read(wm8804_component, reg);
++
++	flag = val & (1 << bit);
++
++	ucontrol->value.integer.value[0] = invert ? !flag : flag;
++
++	return 0;
++}
++
++static const char * const recovered_frequency_texts[] = {
++	"176.4/192 kHz",
++	"88.2/96 kHz",
++	"44.1/48 kHz",
++	"32 kHz"
++};
++
++#define NUM_RECOVERED_FREQUENCIES \
++	ARRAY_SIZE(recovered_frequency_texts)
++
++static int rpi_cirrus_recovered_frequency_info(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_info *uinfo)
++{
++	uinfo->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
++	uinfo->count = 1;
++	uinfo->value.enumerated.items = NUM_RECOVERED_FREQUENCIES;
++	if (uinfo->value.enumerated.item >= NUM_RECOVERED_FREQUENCIES)
++		uinfo->value.enumerated.item = NUM_RECOVERED_FREQUENCIES - 1;
++	strcpy(uinfo->value.enumerated.name,
++		recovered_frequency_texts[uinfo->value.enumerated.item]);
++	return 0;
++}
++
++static int rpi_cirrus_recovered_frequency_get(struct snd_kcontrol *kcontrol,
++	struct snd_ctl_elem_value *ucontrol)
++{
++	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
++	struct snd_soc_component *wm8804_component =
++		snd_soc_rtd_to_codec(get_wm8804_runtime(card), 0)->component;
++	unsigned int val;
++
++	val = snd_soc_component_read(wm8804_component, WM8804_SPDSTAT);
++
++	ucontrol->value.enumerated.item[0] = (val >> 4) & 0x03;
++	return 0;
++}
++
++static const struct snd_kcontrol_new rpi_cirrus_controls[] = {
++	{
++		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER,
++		.name =    "Min Sample Rate",
++		.info =    rpi_cirrus_min_rate_info,
++		.get =     rpi_cirrus_min_rate_get,
++		.put =     rpi_cirrus_min_rate_put,
++	},
++	{
++		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER,
++		.name =    "Max Sample Rate",
++		.info =    rpi_cirrus_max_rate_info,
++		.get =     rpi_cirrus_max_rate_get,
++		.put =     rpi_cirrus_max_rate_put,
++	},
++	{
++		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER,
++		.name =    SNDRV_CTL_NAME_IEC958("", PLAYBACK, DEFAULT),
++		.info =    rpi_cirrus_spdif_info,
++		.get =     rpi_cirrus_spdif_playback_get,
++		.put =     rpi_cirrus_spdif_playback_put,
++	},
++	{
++		.access =  SNDRV_CTL_ELEM_ACCESS_READ
++			   | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
++		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER,
++		.name =    SNDRV_CTL_NAME_IEC958("", CAPTURE, DEFAULT),
++		.info =    rpi_cirrus_spdif_info,
++		.get =     rpi_cirrus_spdif_capture_get,
++	},
++	{
++		.access =  SNDRV_CTL_ELEM_ACCESS_READ,
++		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER,
++		.name =    SNDRV_CTL_NAME_IEC958("", PLAYBACK, MASK),
++		.info =    rpi_cirrus_spdif_info,
++		.get =     rpi_cirrus_spdif_mask_get,
++	},
++	{
++		.access =  SNDRV_CTL_ELEM_ACCESS_READ
++			   | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
++		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER,
++		.name =    SNDRV_CTL_NAME_IEC958("", CAPTURE, NONE)
++				"Recovered Frequency",
++		.info =    rpi_cirrus_recovered_frequency_info,
++		.get =     rpi_cirrus_recovered_frequency_get,
++	},
++	SPDIF_FLAG_CTRL("Audio", WM8804_SPDSTAT, 0, 1),
++	SPDIF_FLAG_CTRL("Non-PCM", WM8804_SPDSTAT, 1, 0),
++	SPDIF_FLAG_CTRL("Copyright", WM8804_SPDSTAT, 2, 1),
++	SPDIF_FLAG_CTRL("De-Emphasis", WM8804_SPDSTAT, 3, 0),
++	SPDIF_FLAG_CTRL("Lock", WM8804_SPDSTAT, 6, 1),
++	SPDIF_FLAG_CTRL("Invalid", WM8804_INTSTAT, 1, 0),
++	SPDIF_FLAG_CTRL("TransErr", WM8804_INTSTAT, 3, 0),
++};
++
++static const char * const linein_micbias_texts[] = {
++	"off", "on",
++};
++
++static SOC_ENUM_SINGLE_VIRT_DECL(linein_micbias_enum,
++	linein_micbias_texts);
++
++static const struct snd_kcontrol_new linein_micbias_mux =
++	SOC_DAPM_ENUM("Route", linein_micbias_enum);
++
++static int rpi_cirrus_spdif_rx_enable_event(struct snd_soc_dapm_widget *w,
++	struct snd_kcontrol *kcontrol, int event);
++
++const struct snd_soc_dapm_widget rpi_cirrus_dapm_widgets[] = {
++	SND_SOC_DAPM_MIC("DMIC", NULL),
++	SND_SOC_DAPM_MIC("Headset Mic", NULL),
++	SND_SOC_DAPM_INPUT("Line Input"),
++	SND_SOC_DAPM_MIC("Line Input with Micbias", NULL),
++	SND_SOC_DAPM_MUX("Line Input Micbias", SND_SOC_NOPM, 0, 0,
++		&linein_micbias_mux),
++	SND_SOC_DAPM_INPUT("dummy SPDIF in"),
++	SND_SOC_DAPM_PGA_E("dummy SPDIFRX", SND_SOC_NOPM, 0, 0, NULL, 0,
++		rpi_cirrus_spdif_rx_enable_event,
++		SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
++	SND_SOC_DAPM_INPUT("Dummy Input"),
++	SND_SOC_DAPM_OUTPUT("Dummy Output"),
++};
++
++const struct snd_soc_dapm_route rpi_cirrus_dapm_routes[] = {
++	{ "IN1L", NULL, "Headset Mic" },
++	{ "IN1R", NULL, "Headset Mic" },
++	{ "Headset Mic", NULL, "MICBIAS1" },
++
++	{ "IN2L", NULL, "DMIC" },
++	{ "IN2R", NULL, "DMIC" },
++	{ "DMIC", NULL, "MICBIAS2" },
++
++	{ "IN3L", NULL, "Line Input Micbias" },
++	{ "IN3R", NULL, "Line Input Micbias" },
++
++	{ "Line Input Micbias", "off", "Line Input" },
++	{ "Line Input Micbias", "on", "Line Input with Micbias" },
++
++	/* Make sure MICVDD is enabled, otherwise we get noise */
++	{ "Line Input", NULL, "MICVDD" },
++	{ "Line Input with Micbias", NULL, "MICBIAS3" },
++
++	/* Dummy routes to check whether SPDIF RX is enabled or not */
++	{"dummy SPDIFRX", NULL, "dummy SPDIF in"},
++	{"AIFTX", NULL, "dummy SPDIFRX"},
++
++	/*
++	 * Dummy routes to keep wm5102 from staying off on
++	 * playback/capture if all mixers are off.
++	 */
++	{ "Dummy Output", NULL, "AIF1RX1" },
++	{ "Dummy Output", NULL, "AIF1RX2" },
++	{ "AIF1TX1", NULL, "Dummy Input" },
++	{ "AIF1TX2", NULL, "Dummy Input" },
++};
++
++static int rpi_cirrus_clear_flls(struct snd_soc_card *card,
++	struct snd_soc_component *wm5102_component) {
++
++	int ret1, ret2;
++
++	ret1 = snd_soc_component_set_pll(wm5102_component,
++		WM5102_FLL1, ARIZONA_FLL_SRC_NONE, 0, 0);
++	ret2 = snd_soc_component_set_pll(wm5102_component,
++		WM5102_FLL1_REFCLK, ARIZONA_FLL_SRC_NONE, 0, 0);
++
++	if (ret1) {
++		dev_warn(card->dev,
++			"setting FLL1 to zero failed: %d\n", ret1);
++		return ret1;
++	}
++	if (ret2) {
++		dev_warn(card->dev,
++			"setting FLL1_REFCLK to zero failed: %d\n", ret2);
++		return ret2;
++	}
++	return 0;
++}
++
++static int rpi_cirrus_set_fll(struct snd_soc_card *card,
++	struct snd_soc_component *wm5102_component, unsigned int clk_freq)
++{
++	int ret = snd_soc_component_set_pll(wm5102_component,
++		WM5102_FLL1,
++		ARIZONA_CLK_SRC_MCLK1,
++		WM8804_CLKOUT_HZ,
++		clk_freq);
++	if (ret)
++		dev_err(card->dev, "Failed to set FLL1 to %d: %d\n",
++			clk_freq, ret);
++
++	usleep_range(1000, 2000);
++	return ret;
++}
++
++static int rpi_cirrus_set_fll_refclk(struct snd_soc_card *card,
++	struct snd_soc_component *wm5102_component,
++	unsigned int clk_freq, unsigned int aif2_freq)
++{
++	int ret = snd_soc_component_set_pll(wm5102_component,
++		WM5102_FLL1_REFCLK,
++		ARIZONA_CLK_SRC_MCLK1,
++		WM8804_CLKOUT_HZ,
++		clk_freq);
++	if (ret) {
++		dev_err(card->dev,
++			"Failed to set FLL1_REFCLK to %d: %d\n",
++			clk_freq, ret);
++		return ret;
++	}
++
++	ret = snd_soc_component_set_pll(wm5102_component,
++		WM5102_FLL1,
++		ARIZONA_CLK_SRC_AIF2BCLK,
++		aif2_freq, clk_freq);
++	if (ret)
++		dev_err(card->dev,
++			"Failed to set FLL1 with Sync Clock %d to %d: %d\n",
++			aif2_freq, clk_freq, ret);
++
++	usleep_range(1000, 2000);
++	return ret;
++}
++
++static int rpi_cirrus_spdif_rx_enable_event(struct snd_soc_dapm_widget *w,
++	struct snd_kcontrol *kcontrol, int event)
++{
++	struct snd_soc_card *card = w->dapm->card;
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++	struct snd_soc_component *wm5102_component =
++		snd_soc_rtd_to_codec(get_wm5102_runtime(card), 0)->component;
++
++	unsigned int clk_freq, aif2_freq;
++	int ret = 0;
++
++	switch (event) {
++	case SND_SOC_DAPM_POST_PMU:
++		mutex_lock(&priv->lock);
++
++		/* Enable sync path in case of SPDIF capture use case */
++
++		clk_freq = calc_sysclk(priv->card_rate);
++		aif2_freq = 64 * priv->card_rate;
++
++		dev_dbg(card->dev,
++			"spdif_rx: changing FLL1 to use Ref Clock clk: %d spdif: %d\n",
++			clk_freq, aif2_freq);
++
++		ret = rpi_cirrus_clear_flls(card, wm5102_component);
++		if (ret) {
++			dev_err(card->dev, "spdif_rx: failed to clear FLLs\n");
++			goto out;
++		}
++
++		ret = rpi_cirrus_set_fll_refclk(card, wm5102_component,
++			clk_freq, aif2_freq);
++
++		if (ret) {
++			dev_err(card->dev, "spdif_rx: failed to set FLLs\n");
++			goto out;
++		}
++
++		/* set to negative to indicate we're doing spdif rx */
++		priv->fll1_freq = -clk_freq;
++		priv->sync_path_enable = 1;
++		break;
++
++	case SND_SOC_DAPM_POST_PMD:
++		mutex_lock(&priv->lock);
++		priv->sync_path_enable = 0;
++		break;
++
++	default:
++		return 0;
++	}
++
++out:
++	mutex_unlock(&priv->lock);
++	return ret;
++}
++
++static int rpi_cirrus_set_bias_level(struct snd_soc_card *card,
++	struct snd_soc_dapm_context *dapm,
++	enum snd_soc_bias_level level)
++{
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++	struct snd_soc_pcm_runtime *wm5102_runtime = get_wm5102_runtime(card);
++	struct snd_soc_component *wm5102_component =
++		snd_soc_rtd_to_codec(wm5102_runtime, 0)->component;
++
++	int ret = 0;
++	unsigned int clk_freq;
++
++	if (dapm->dev != snd_soc_rtd_to_codec(wm5102_runtime, 0)->dev)
++		return 0;
++
++	switch (level) {
++	case SND_SOC_BIAS_PREPARE:
++		if (dapm->bias_level == SND_SOC_BIAS_ON)
++			break;
++
++		mutex_lock(&priv->lock);
++
++		if (!priv->sync_path_enable) {
++			clk_freq = calc_sysclk(priv->card_rate);
++
++			dev_dbg(card->dev,
++				"set_bias: changing FLL1 from %d to %d\n",
++				priv->fll1_freq, clk_freq);
++
++			ret = rpi_cirrus_set_fll(card,
++				wm5102_component, clk_freq);
++			if (ret)
++				dev_err(card->dev,
++					"set_bias: Failed to set FLL1\n");
++			else
++				priv->fll1_freq = clk_freq;
++		}
++		mutex_unlock(&priv->lock);
++		break;
++	default:
++		break;
++	}
++
++	return ret;
++}
++
++static int rpi_cirrus_set_bias_level_post(struct snd_soc_card *card,
++	struct snd_soc_dapm_context *dapm,
++	enum snd_soc_bias_level level)
++{
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++	struct snd_soc_pcm_runtime *wm5102_runtime = get_wm5102_runtime(card);
++	struct snd_soc_component *wm5102_component =
++		snd_soc_rtd_to_codec(wm5102_runtime, 0)->component;
++
++	if (dapm->dev != snd_soc_rtd_to_codec(wm5102_runtime, 0)->dev)
++		return 0;
++
++	switch (level) {
++	case SND_SOC_BIAS_STANDBY:
++		mutex_lock(&priv->lock);
++
++		dev_dbg(card->dev,
++			"set_bias_post: changing FLL1 from %d to off\n",
++				priv->fll1_freq);
++
++		if (rpi_cirrus_clear_flls(card, wm5102_component))
++			dev_err(card->dev,
++				"set_bias_post: failed to clear FLLs\n");
++		else
++			priv->fll1_freq = 0;
++
++		mutex_unlock(&priv->lock);
++
++		break;
++	default:
++		break;
++	}
++
++	return 0;
++}
++
++static int rpi_cirrus_set_wm8804_pll(struct snd_soc_card *card,
++	struct snd_soc_dai *wm8804_dai, unsigned int rate)
++{
++	int ret;
++
++	/* use 256fs */
++	unsigned int clk_freq = rate * 256;
++
++	ret = snd_soc_dai_set_pll(wm8804_dai, 0, 0,
++		WM8804_CLKOUT_HZ, clk_freq);
++	if (ret) {
++		dev_err(card->dev,
++			"Failed to set WM8804 PLL to %d: %d\n", clk_freq, ret);
++		return ret;
++	}
++
++	/* Set MCLK as PLL Output */
++	ret = snd_soc_dai_set_sysclk(wm8804_dai,
++		WM8804_TX_CLKSRC_PLL, clk_freq, 0);
++	if (ret) {
++		dev_err(card->dev,
++			"Failed to set MCLK as PLL Output: %d\n", ret);
++		return ret;
++	}
++
++	return ret;
++}
++
++static int rpi_cirrus_startup(struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_card *card = rtd->card;
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++	unsigned int min_rate = min_rates[priv->min_rate_idx].value;
++	unsigned int max_rate = max_rates[priv->max_rate_idx].value;
++
++	if (min_rate || max_rate) {
++		if (max_rate == 0)
++			max_rate = UINT_MAX;
++
++		dev_dbg(card->dev,
++			"startup: limiting rate to %u-%u\n",
++			min_rate, max_rate);
++
++		snd_pcm_hw_constraint_minmax(substream->runtime,
++			SNDRV_PCM_HW_PARAM_RATE, min_rate, max_rate);
++	}
++
++	return 0;
++}
++
++static struct snd_soc_pcm_stream rpi_cirrus_dai_link2_params = {
++	.formats = SNDRV_PCM_FMTBIT_S24_LE,
++	.channels_min = 2,
++	.channels_max = 2,
++	.rate_min = RPI_CIRRUS_DEFAULT_RATE,
++	.rate_max = RPI_CIRRUS_DEFAULT_RATE,
++};
++
++static int rpi_cirrus_hw_params(struct snd_pcm_substream *substream,
++	struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_card *card = rtd->card;
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++	struct snd_soc_dai *bcm_i2s_dai = snd_soc_rtd_to_cpu(rtd, 0);
++	struct snd_soc_component *wm5102_component = snd_soc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_dai *wm8804_dai = snd_soc_rtd_to_codec(get_wm8804_runtime(card), 0);
++
++	int ret;
++
++	unsigned int width = snd_pcm_format_width(params_format(params));
++	unsigned int rate = params_rate(params);
++	unsigned int clk_freq = calc_sysclk(rate);
++
++	/* Using powers of 2 allows for an integer clock divisor */
++	width = width <= 16 ? 16 : 32;
++
++	mutex_lock(&priv->lock);
++
++	dev_dbg(card->dev, "hw_params: setting rate to %d\n", rate);
++
++	ret = snd_soc_dai_set_bclk_ratio(bcm_i2s_dai, 2 * width);
++	if (ret) {
++		dev_err(card->dev, "set_bclk_ratio failed: %d\n", ret);
++		goto out;
++	}
++
++	ret = snd_soc_dai_set_tdm_slot(snd_soc_rtd_to_codec(rtd, 0), 0x03, 0x03, 2, width);
++	if (ret) {
++		dev_err(card->dev, "set_tdm_slot failed: %d\n", ret);
++		goto out;
++	}
++
++	/* WM8804 supports sample rates from 32k only */
++	if (rate >= 32000) {
++		ret = rpi_cirrus_set_wm8804_pll(card, wm8804_dai, rate);
++		if (ret)
++			goto out;
++	}
++
++	ret = snd_soc_component_set_sysclk(wm5102_component,
++		ARIZONA_CLK_SYSCLK,
++		ARIZONA_CLK_SRC_FLL1,
++		clk_freq,
++		SND_SOC_CLOCK_IN);
++	if (ret) {
++		dev_err(card->dev, "Failed to set SYSCLK: %d\n", ret);
++		goto out;
++	}
++
++	if ((priv->fll1_freq > 0) && (priv->fll1_freq != clk_freq)) {
++		dev_dbg(card->dev,
++			"hw_params: changing FLL1 from %d to %d\n",
++			priv->fll1_freq, clk_freq);
++
++		if (rpi_cirrus_clear_flls(card, wm5102_component)) {
++			dev_err(card->dev, "hw_params: failed to clear FLLs\n");
++			goto out;
++		}
++
++		if (rpi_cirrus_set_fll(card, wm5102_component, clk_freq)) {
++			dev_err(card->dev, "hw_params: failed to set FLL\n");
++			goto out;
++		}
++
++		priv->fll1_freq = clk_freq;
++	}
++
++	priv->card_rate = rate;
++	rpi_cirrus_dai_link2_params.rate_min = rate;
++	rpi_cirrus_dai_link2_params.rate_max = rate;
++
++	priv->params_set |= 1 << substream->stream;
++
++out:
++	mutex_unlock(&priv->lock);
++
++	return ret;
++}
++
++static int rpi_cirrus_hw_free(struct snd_pcm_substream *substream)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_card *card = rtd->card;
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++	struct snd_soc_component *wm5102_component = snd_soc_rtd_to_codec(rtd, 0)->component;
++	int ret;
++	unsigned int old_params_set = priv->params_set;
++
++	priv->params_set &= ~(1 << substream->stream);
++
++	/* disable sysclk if this was the last open stream */
++	if (priv->params_set == 0 && old_params_set) {
++		dev_dbg(card->dev,
++			"hw_free: Setting SYSCLK to Zero\n");
++
++		ret = snd_soc_component_set_sysclk(wm5102_component,
++			ARIZONA_CLK_SYSCLK,
++			ARIZONA_CLK_SRC_FLL1,
++			0,
++			SND_SOC_CLOCK_IN);
++		if (ret)
++			dev_err(card->dev,
++				"hw_free: Failed to set SYSCLK to Zero: %d\n",
++				ret);
++	}
++	return 0;
++}
++
++static int rpi_cirrus_init_wm5102(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++	int ret;
++
++	/* no 32kHz input, derive it from sysclk if needed  */
++	snd_soc_component_update_bits(component,
++			ARIZONA_CLOCK_32K_1, ARIZONA_CLK_32K_SRC_MASK, 2);
++
++	if (rpi_cirrus_clear_flls(rtd->card, component))
++		dev_warn(rtd->card->dev,
++			"init_wm5102: failed to clear FLLs\n");
++
++	ret = snd_soc_component_set_sysclk(component,
++		ARIZONA_CLK_SYSCLK, ARIZONA_CLK_SRC_FLL1,
++		0, SND_SOC_CLOCK_IN);
++	if (ret) {
++		dev_err(rtd->card->dev,
++			"Failed to set SYSCLK to Zero: %d\n", ret);
++		return ret;
++	}
++
++	return 0;
++}
++
++static int rpi_cirrus_init_wm8804(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_dai *codec_dai = snd_soc_rtd_to_codec(rtd, 0);
++	struct snd_soc_component *component = codec_dai->component;
++	struct snd_soc_card *card = rtd->card;
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++	unsigned int val, mask;
++	int i, ret;
++
++	for (i = 0; i < 4; i++) {
++		val = snd_soc_component_read(component,
++			WM8804_SPDTX1 + i);
++		mask = (i == 3) ? 0x3f : 0xff;
++		priv->iec958_status[i] = val & mask;
++	}
++
++	/* Setup for 256fs */
++	ret = snd_soc_dai_set_clkdiv(codec_dai,
++		WM8804_MCLK_DIV, WM8804_MCLKDIV_256FS);
++	if (ret) {
++		dev_err(card->dev,
++			"init_wm8804: Failed to set MCLK_DIV to 256fs: %d\n",
++			ret);
++		return ret;
++	}
++
++	/* Output OSC on CLKOUT */
++	ret = snd_soc_dai_set_sysclk(codec_dai,
++		WM8804_CLKOUT_SRC_OSCCLK, WM8804_CLKOUT_HZ, 0);
++	if (ret)
++		dev_err(card->dev,
++			"init_wm8804: Failed to set CLKOUT as OSC Frequency: %d\n",
++			ret);
++
++	/* Init PLL with default samplerate */
++	ret = rpi_cirrus_set_wm8804_pll(card, codec_dai,
++		RPI_CIRRUS_DEFAULT_RATE);
++	if (ret)
++		dev_err(card->dev,
++			"init_wm8804: Failed to setup PLL for %dHz: %d\n",
++			RPI_CIRRUS_DEFAULT_RATE, ret);
++
++	return ret;
++}
++
++static struct snd_soc_ops rpi_cirrus_ops = {
++	.startup = rpi_cirrus_startup,
++	.hw_params = rpi_cirrus_hw_params,
++	.hw_free = rpi_cirrus_hw_free,
++};
++
++SND_SOC_DAILINK_DEFS(wm5102,
++     DAILINK_COMP_ARRAY(COMP_EMPTY()),
++     DAILINK_COMP_ARRAY(COMP_CODEC("wm5102-codec", "wm5102-aif1")),
++     DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++SND_SOC_DAILINK_DEFS(wm8804,
++     DAILINK_COMP_ARRAY(COMP_CPU("wm5102-aif2")),
++     DAILINK_COMP_ARRAY(COMP_CODEC("wm8804.1-003b", "wm8804-spdif")));
++
++static struct snd_soc_dai_link rpi_cirrus_dai[] = {
++	[DAI_WM5102] = {
++		.name		= "WM5102",
++		.stream_name	= "WM5102 AiFi",
++		.dai_fmt	=   SND_SOC_DAIFMT_I2S
++				  | SND_SOC_DAIFMT_NB_NF
++				  | SND_SOC_DAIFMT_CBM_CFM,
++		.ops		= &rpi_cirrus_ops,
++		.init		= rpi_cirrus_init_wm5102,
++		SND_SOC_DAILINK_REG(wm5102),
++	},
++	[DAI_WM8804] = {
++		.name		= "WM5102 SPDIF",
++		.stream_name	= "SPDIF Tx/Rx",
++		.dai_fmt	=   SND_SOC_DAIFMT_I2S
++				  | SND_SOC_DAIFMT_NB_NF
++				  | SND_SOC_DAIFMT_CBM_CFM,
++		.ignore_suspend = 1,
++		.c2c_params	= &rpi_cirrus_dai_link2_params,
++		.init		= rpi_cirrus_init_wm8804,
++		SND_SOC_DAILINK_REG(wm8804),
++	},
++};
++
++
++static int rpi_cirrus_late_probe(struct snd_soc_card *card)
++{
++	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
++	struct snd_soc_pcm_runtime *wm5102_runtime = get_wm5102_runtime(card);
++	struct snd_soc_pcm_runtime *wm8804_runtime = get_wm8804_runtime(card);
++	int ret;
++
++	dev_dbg(card->dev, "iec958_bits: %02x %02x %02x %02x\n",
++		priv->iec958_status[0],
++		priv->iec958_status[1],
++		priv->iec958_status[2],
++		priv->iec958_status[3]);
++
++	ret = snd_soc_dai_set_sysclk(
++		snd_soc_rtd_to_codec(wm5102_runtime, 0), ARIZONA_CLK_SYSCLK, 0, 0);
++	if (ret) {
++		dev_err(card->dev,
++			"Failed to set WM5102 codec dai clk domain: %d\n", ret);
++		return ret;
++	}
++
++	ret = snd_soc_dai_set_sysclk(
++		snd_soc_rtd_to_cpu(wm8804_runtime, 0), ARIZONA_CLK_SYSCLK, 0, 0);
++	if (ret)
++		dev_err(card->dev,
++			"Failed to set WM8804 codec dai clk domain: %d\n", ret);
++
++	return ret;
++}
++
++/* audio machine driver */
++static struct snd_soc_card rpi_cirrus_card = {
++	.name			= "RPi-Cirrus",
++	.driver_name		= "RPiCirrus",
++	.owner			= THIS_MODULE,
++	.dai_link		= rpi_cirrus_dai,
++	.num_links		= ARRAY_SIZE(rpi_cirrus_dai),
++	.late_probe		= rpi_cirrus_late_probe,
++	.controls		= rpi_cirrus_controls,
++	.num_controls		= ARRAY_SIZE(rpi_cirrus_controls),
++	.dapm_widgets		= rpi_cirrus_dapm_widgets,
++	.num_dapm_widgets	= ARRAY_SIZE(rpi_cirrus_dapm_widgets),
++	.dapm_routes		= rpi_cirrus_dapm_routes,
++	.num_dapm_routes	= ARRAY_SIZE(rpi_cirrus_dapm_routes),
++	.set_bias_level		= rpi_cirrus_set_bias_level,
++	.set_bias_level_post	= rpi_cirrus_set_bias_level_post,
++};
++
++static int rpi_cirrus_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++	struct rpi_cirrus_priv *priv;
++	struct device_node *i2s_node;
++
++	priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	priv->min_rate_idx = 1; /* min samplerate 32kHz */
++	priv->card_rate = RPI_CIRRUS_DEFAULT_RATE;
++
++	mutex_init(&priv->lock);
++
++	snd_soc_card_set_drvdata(&rpi_cirrus_card, priv);
++
++	if (!pdev->dev.of_node)
++		return -ENODEV;
++
++	i2s_node = of_parse_phandle(
++			pdev->dev.of_node, "i2s-controller", 0);
++	if (!i2s_node) {
++		dev_err(&pdev->dev, "i2s-controller missing in DT\n");
++		return -ENODEV;
++	}
++
++	rpi_cirrus_dai[DAI_WM5102].cpus->of_node = i2s_node;
++	rpi_cirrus_dai[DAI_WM5102].platforms->of_node = i2s_node;
++
++	rpi_cirrus_card.dev = &pdev->dev;
++
++	ret = devm_snd_soc_register_card(&pdev->dev, &rpi_cirrus_card);
++	if (ret) {
++		if (ret == -EPROBE_DEFER)
++			dev_dbg(&pdev->dev,
++				"register card requested probe deferral\n");
++		else
++			dev_err(&pdev->dev,
++				"Failed to register card: %d\n", ret);
++	}
++
++	return ret;
++}
++
++static const struct of_device_id rpi_cirrus_of_match[] = {
++	{ .compatible = "wlf,rpi-cirrus", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, rpi_cirrus_of_match);
++
++static struct platform_driver rpi_cirrus_driver = {
++	.driver	= {
++		.name   = "snd-rpi-cirrus",
++		.of_match_table = of_match_ptr(rpi_cirrus_of_match),
++	},
++	.probe	= rpi_cirrus_probe,
++};
++
++module_platform_driver(rpi_cirrus_driver);
++
++MODULE_AUTHOR("Matthias Reichl <hias@horus.com>");
++MODULE_DESCRIPTION("ASoC driver for Cirrus Logic Audio Card");
++MODULE_LICENSE("GPL");
+--- /dev/null
++++ b/sound/soc/bcm/rpi-proto.c
+@@ -0,0 +1,147 @@
++/*
++ * ASoC driver for PROTO AudioCODEC (with a WM8731)
++ * connected to a Raspberry Pi
++ *
++ * Author:      Florian Meier, <koalo@koalo.de>
++ *	      Copyright 2013
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/soc.h>
++#include <sound/jack.h>
++
++#include "../codecs/wm8731.h"
++
++static const unsigned int wm8731_rates_12288000[] = {
++	8000, 32000, 48000, 96000,
++};
++
++static struct snd_pcm_hw_constraint_list wm8731_constraints_12288000 = {
++	.list = wm8731_rates_12288000,
++	.count = ARRAY_SIZE(wm8731_rates_12288000),
++};
++
++static int snd_rpi_proto_startup(struct snd_pcm_substream *substream)
++{
++	/* Setup constraints, because there is a 12.288 MHz XTAL on the board */
++	snd_pcm_hw_constraint_list(substream->runtime, 0,
++				SNDRV_PCM_HW_PARAM_RATE,
++				&wm8731_constraints_12288000);
++	return 0;
++}
++
++static int snd_rpi_proto_hw_params(struct snd_pcm_substream *substream,
++				       struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_dai *codec_dai = snd_soc_rtd_to_codec(rtd, 0);
++	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
++	int sysclk = 12288000; /* This is fixed on this board */
++
++	/* Set proto bclk */
++	int ret = snd_soc_dai_set_bclk_ratio(cpu_dai,32*2);
++	if (ret < 0){
++		dev_err(rtd->card->dev,
++				"Failed to set BCLK ratio %d\n", ret);
++		return ret;
++	}
++
++	/* Set proto sysclk */
++	ret = snd_soc_dai_set_sysclk(codec_dai, WM8731_SYSCLK_XTAL,
++			sysclk, SND_SOC_CLOCK_IN);
++	if (ret < 0) {
++		dev_err(rtd->card->dev,
++				"Failed to set WM8731 SYSCLK: %d\n", ret);
++		return ret;
++	}
++
++	return 0;
++}
++
++/* machine stream operations */
++static struct snd_soc_ops snd_rpi_proto_ops = {
++	.startup = snd_rpi_proto_startup,
++	.hw_params = snd_rpi_proto_hw_params,
++};
++
++SND_SOC_DAILINK_DEFS(rpi_proto,
++	DAILINK_COMP_ARRAY(COMP_CPU("bcm2708-i2s.0")),
++	DAILINK_COMP_ARRAY(COMP_CODEC("wm8731.1-001a", "wm8731-hifi")),
++	DAILINK_COMP_ARRAY(COMP_PLATFORM("bcm2708-i2s.0")));
++
++static struct snd_soc_dai_link snd_rpi_proto_dai[] = {
++{
++	.name		= "WM8731",
++	.stream_name	= "WM8731 HiFi",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S
++				| SND_SOC_DAIFMT_NB_NF
++				| SND_SOC_DAIFMT_CBM_CFM,
++	.ops		= &snd_rpi_proto_ops,
++	SND_SOC_DAILINK_REG(rpi_proto),
++},
++};
++
++/* audio machine driver */
++static struct snd_soc_card snd_rpi_proto = {
++	.name		= "snd_rpi_proto",
++	.owner		= THIS_MODULE,
++	.dai_link	= snd_rpi_proto_dai,
++	.num_links	= ARRAY_SIZE(snd_rpi_proto_dai),
++};
++
++static int snd_rpi_proto_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++
++	snd_rpi_proto.dev = &pdev->dev;
++
++	if (pdev->dev.of_node) {
++		struct device_node *i2s_node;
++		struct snd_soc_dai_link *dai = &snd_rpi_proto_dai[0];
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++				            "i2s-controller", 0);
++
++		if (i2s_node) {
++			dai->cpus->dai_name = NULL;
++			dai->cpus->of_node = i2s_node;
++			dai->platforms->name = NULL;
++			dai->platforms->of_node = i2s_node;
++		}
++	}
++
++	ret = devm_snd_soc_register_card(&pdev->dev, &snd_rpi_proto);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev,
++				"snd_soc_register_card() failed: %d\n", ret);
++
++	return ret;
++}
++
++static const struct of_device_id snd_rpi_proto_of_match[] = {
++	{ .compatible = "rpi,rpi-proto", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, snd_rpi_proto_of_match);
++
++static struct platform_driver snd_rpi_proto_driver = {
++	.driver = {
++		.name   = "snd-rpi-proto",
++		.owner  = THIS_MODULE,
++		.of_match_table = snd_rpi_proto_of_match,
++	},
++	.probe	  = snd_rpi_proto_probe,
++};
++
++module_platform_driver(snd_rpi_proto_driver);
++
++MODULE_AUTHOR("Florian Meier");
++MODULE_DESCRIPTION("ASoC Driver for Raspberry Pi connected to PROTO board (WM8731)");
++MODULE_LICENSE("GPL");
+--- /dev/null
++++ b/sound/soc/bcm/rpi-simple-soundcard.c
+@@ -0,0 +1,560 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * rpi-simple-soundcard.c -- ALSA SoC Raspberry Pi soundcard.
++ *
++ * Copyright (C) 2018 Raspberry Pi.
++ *
++ * Authors: Tim Gover <tim.gover@raspberrypi.org>
++ *
++ * Based on code:
++ * hifiberry_amp.c, hifiberry_dac.c, rpi-dac.c
++ * by Florian Meier <florian.meier@koalo.de>
++ *
++ * googlevoicehat-soundcard.c
++ * by Peter Malkin <petermalkin@google.com>
++ *
++ * adau1977-adc.c
++ * by Andrey Grodzovsky <andrey2805@gmail.com>
++ *
++ * merus-amp.c
++ * by Ariel Muszkat <ariel.muszkat@gmail.com>
++ *		Jorgen Kragh Jakobsen <jorgen.kraghjakobsen@infineon.com>
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/gpio/consumer.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++
++/* Parameters for generic RPI functions */
++struct snd_rpi_simple_drvdata {
++	struct snd_soc_dai_link *dai;
++	const char* card_name;
++	unsigned int fixed_bclk_ratio;
++};
++
++static struct snd_soc_card snd_rpi_simple = {
++	.driver_name  = "RPi-simple",
++	.owner        = THIS_MODULE,
++	.dai_link     = NULL,
++	.num_links    = 1, /* Only a single DAI supported at the moment */
++};
++
++static int snd_rpi_simple_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_rpi_simple_drvdata *drvdata =
++		snd_soc_card_get_drvdata(rtd->card);
++	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
++
++	if (drvdata->fixed_bclk_ratio > 0)
++		return snd_soc_dai_set_bclk_ratio(cpu_dai,
++				drvdata->fixed_bclk_ratio);
++
++	return 0;
++}
++
++static int pifi_mini_210_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_component *dac;
++	struct gpio_desc *pdn_gpio, *rst_gpio;
++	struct snd_soc_dai *codec_dai;
++	int ret;
++
++	snd_rpi_simple_init(rtd);
++	codec_dai = snd_soc_rtd_to_codec(rtd, 0);
++
++	dac = codec_dai[0].component;
++
++	pdn_gpio = devm_gpiod_get_optional(snd_rpi_simple.dev, "pdn",
++						GPIOD_OUT_LOW);
++	if (IS_ERR(pdn_gpio)) {
++		ret = PTR_ERR(pdn_gpio);
++		dev_err(snd_rpi_simple.dev, "failed to get pdn gpio: %d\n", ret);
++		return ret;
++	}
++
++	rst_gpio = devm_gpiod_get_optional(snd_rpi_simple.dev, "rst",
++						GPIOD_OUT_LOW);
++	if (IS_ERR(rst_gpio)) {
++		ret = PTR_ERR(rst_gpio);
++		dev_err(snd_rpi_simple.dev, "failed to get rst gpio: %d\n", ret);
++		return ret;
++	}
++
++	// Set up cards - pulse power down and reset first, then
++	// set up according to datasheet
++	gpiod_set_value_cansleep(pdn_gpio, 1);
++	gpiod_set_value_cansleep(rst_gpio, 1);
++	usleep_range(1000, 10000);
++	gpiod_set_value_cansleep(pdn_gpio, 0);
++	usleep_range(20000, 30000);
++	gpiod_set_value_cansleep(rst_gpio, 0);
++	usleep_range(20000, 30000);
++
++	// Oscillator trim
++	snd_soc_component_write(dac, 0x1b, 0);
++	usleep_range(60000, 80000);
++
++	// MCLK at 64fs, sample rate 44.1 or 48kHz
++	snd_soc_component_write(dac, 0x00, 0x60);
++
++	// Set up for BTL - AD/BD mode - AD is 0x00107772, BD is 0x00987772
++	snd_soc_component_write(dac, 0x20, 0x00107772);
++
++	// End mute
++	snd_soc_component_write(dac, 0x05, 0x00);
++
++	return 0;
++}
++
++static int snd_rpi_simple_hw_params(struct snd_pcm_substream *substream,
++		struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
++	struct snd_rpi_simple_drvdata *drvdata;
++	unsigned int sample_bits;
++
++	drvdata = snd_soc_card_get_drvdata(rtd->card);
++
++	if (drvdata->fixed_bclk_ratio > 0)
++		return 0; // BCLK is configured in .init
++
++	/* The simple drivers just set the bclk_ratio to sample_bits * 2 so
++	 * hard-code this for now, but sticking to powers of 2 to allow for
++	 * integer clock divisors. More complex drivers could just replace
++	 * the hw_params routine.
++	 */
++	sample_bits = snd_pcm_format_width(params_format(params));
++	sample_bits = sample_bits <= 16 ? 16 : 32;
++
++	return snd_soc_dai_set_bclk_ratio(cpu_dai, sample_bits * 2);
++}
++
++static struct snd_soc_ops snd_rpi_simple_ops = {
++	.hw_params = snd_rpi_simple_hw_params,
++};
++
++static int snd_merus_amp_hw_params(struct snd_pcm_substream *substream,
++		struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream);
++	int rate;
++
++	rate = params_rate(params);
++	if (rate > 48000) {
++		dev_err(rtd->card->dev,
++		"Unsupported samplerate %d\n",
++		rate);
++		return -EINVAL;
++	}
++	return 0;
++}
++
++static struct snd_soc_ops snd_merus_amp_ops = {
++	.hw_params = snd_merus_amp_hw_params,
++};
++
++enum adau1977_clk_id {
++	ADAU1977_SYSCLK,
++};
++
++enum adau1977_sysclk_src {
++	ADAU1977_SYSCLK_SRC_MCLK,
++	ADAU1977_SYSCLK_SRC_LRCLK,
++};
++
++static int adau1977_init(struct snd_soc_pcm_runtime *rtd)
++{
++	int ret;
++	struct snd_soc_dai *codec_dai = snd_soc_rtd_to_codec(rtd, 0);
++
++	ret = snd_soc_dai_set_tdm_slot(codec_dai, 0, 0, 0, 0);
++	if (ret < 0)
++		return ret;
++
++	return snd_soc_component_set_sysclk(codec_dai->component,
++			ADAU1977_SYSCLK, ADAU1977_SYSCLK_SRC_MCLK,
++			11289600, SND_SOC_CLOCK_IN);
++}
++
++SND_SOC_DAILINK_DEFS(adau1977,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("adau1977.1-0011", "adau1977-hifi")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_rpi_adau1977_dai[] = {
++	{
++	.name           = "adau1977",
++	.stream_name    = "ADAU1977",
++	.init           = adau1977_init,
++	.dai_fmt = SND_SOC_DAIFMT_I2S |
++		SND_SOC_DAIFMT_NB_NF |
++		SND_SOC_DAIFMT_CBM_CFM,
++	SND_SOC_DAILINK_REG(adau1977),
++	},
++};
++
++static struct snd_rpi_simple_drvdata drvdata_adau1977 = {
++	.card_name = "snd_rpi_adau1977_adc",
++	.dai       = snd_rpi_adau1977_dai,
++};
++
++SND_SOC_DAILINK_DEFS(gvchat,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("voicehat-codec", "voicehat-hifi")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_googlevoicehat_soundcard_dai[] = {
++{
++	.name           = "Google voiceHAT SoundCard",
++	.stream_name    = "Google voiceHAT SoundCard HiFi",
++	.dai_fmt        =  SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBS_CFS,
++	SND_SOC_DAILINK_REG(gvchat),
++},
++};
++
++static struct snd_rpi_simple_drvdata drvdata_googlevoicehat = {
++	.card_name = "snd_rpi_googlevoicehat_soundcard",
++	.dai       = snd_googlevoicehat_soundcard_dai,
++};
++
++SND_SOC_DAILINK_DEFS(hifiberry_dacplusdsp,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("dacplusdsp-codec", "dacplusdsp-hifi")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_hifiberrydacplusdsp_soundcard_dai[] = {
++{
++	.name           = "Hifiberry DAC+DSP SoundCard",
++	.stream_name    = "Hifiberry DAC+DSP SoundCard HiFi",
++	.dai_fmt        =  SND_SOC_DAIFMT_I2S |
++			   SND_SOC_DAIFMT_NB_NF |
++			   SND_SOC_DAIFMT_CBS_CFS,
++	SND_SOC_DAILINK_REG(hifiberry_dacplusdsp),
++},
++};
++
++static struct snd_rpi_simple_drvdata drvdata_hifiberrydacplusdsp = {
++	.card_name = "snd_rpi_hifiberrydacplusdsp_soundcard",
++	.dai       = snd_hifiberrydacplusdsp_soundcard_dai,
++};
++
++SND_SOC_DAILINK_DEFS(hifiberry_adc,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("snd-soc-dummy", "snd-soc-dummy-dai")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static int hifiberry_adc8x_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_dai *codec_dai = snd_soc_rtd_to_codec(rtd, 0);
++
++	/* set limits of 8 channels and 192ksps sample rate
++	 */
++	codec_dai->driver->capture.channels_max = 8;
++	codec_dai->driver->capture.rates = SNDRV_PCM_RATE_8000_192000;
++
++	return 0;
++}
++
++static struct snd_soc_dai_link snd_hifiberry_adc8x_dai[] = {
++	{
++		.name           = "HifiBerry ADC8x",
++		.stream_name    = "HifiBerry ADC8x HiFi",
++		.dai_fmt        = SND_SOC_DAIFMT_I2S |
++					SND_SOC_DAIFMT_NB_NF |
++					SND_SOC_DAIFMT_CBS_CFS,
++		.init           = hifiberry_adc8x_init,
++		SND_SOC_DAILINK_REG(hifiberry_adc),
++	},
++};
++
++static struct snd_rpi_simple_drvdata drvdata_hifiberry_adc8x = {
++	.card_name = "snd_rpi_hifiberry_adc8x",
++	.dai       = snd_hifiberry_adc8x_dai,
++	.fixed_bclk_ratio = 64,
++};
++
++SND_SOC_DAILINK_DEFS(hifiberry_amp,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("tas5713.1-001b", "tas5713-hifi")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_hifiberry_amp_dai[] = {
++	{
++		.name           = "HifiBerry AMP",
++		.stream_name    = "HifiBerry AMP HiFi",
++		.dai_fmt        = SND_SOC_DAIFMT_I2S |
++					SND_SOC_DAIFMT_NB_NF |
++					SND_SOC_DAIFMT_CBS_CFS,
++		SND_SOC_DAILINK_REG(hifiberry_amp),
++	},
++};
++
++static struct snd_rpi_simple_drvdata drvdata_hifiberry_amp = {
++	.card_name        = "snd_rpi_hifiberry_amp",
++	.dai              = snd_hifiberry_amp_dai,
++	.fixed_bclk_ratio = 64,
++};
++
++SND_SOC_DAILINK_DEFS(hifiberry_amp3,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("ma120x0p.1-0020", "ma120x0p-amp")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_hifiberry_amp3_dai[] = {
++	{
++		.name		= "HifiberryAmp3",
++		.stream_name	= "Hifiberry Amp3",
++		.dai_fmt	= SND_SOC_DAIFMT_I2S |
++					SND_SOC_DAIFMT_NB_NF |
++					SND_SOC_DAIFMT_CBS_CFS,
++		SND_SOC_DAILINK_REG(hifiberry_amp3),
++	},
++};
++
++static struct snd_rpi_simple_drvdata drvdata_hifiberry_amp3 = {
++	.card_name	 = "snd_rpi_hifiberry_amp3",
++	.dai		 = snd_hifiberry_amp3_dai,
++	.fixed_bclk_ratio = 64,
++};
++
++SND_SOC_DAILINK_DEFS(hifiberry_dac,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm5102a-codec", "pcm5102a-hifi")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_hifiberry_dac_dai[] = {
++	{
++		.name           = "HifiBerry DAC",
++		.stream_name    = "HifiBerry DAC HiFi",
++		.dai_fmt        = SND_SOC_DAIFMT_I2S |
++					SND_SOC_DAIFMT_NB_NF |
++					SND_SOC_DAIFMT_CBS_CFS,
++		SND_SOC_DAILINK_REG(hifiberry_dac),
++	},
++};
++
++static struct snd_rpi_simple_drvdata drvdata_hifiberry_dac = {
++	.card_name = "snd_rpi_hifiberry_dac",
++	.dai       = snd_hifiberry_dac_dai,
++};
++
++static int hifiberry_dac8x_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_dai *codec_dai = snd_soc_rtd_to_codec(rtd, 0);
++
++	/* override the defaults to reflect 4 x PCM5102A on the card
++	 * and limit the sample rate to 192ksps
++	 */
++	codec_dai->driver->playback.channels_max = 8;
++	codec_dai->driver->playback.rates = SNDRV_PCM_RATE_8000_192000;
++
++	return 0;
++}
++
++static struct snd_soc_dai_link snd_hifiberry_dac8x_dai[] = {
++	{
++		.name           = "HifiBerry DAC8x",
++		.stream_name    = "HifiBerry DAC8x HiFi",
++		.dai_fmt        = SND_SOC_DAIFMT_I2S |
++					SND_SOC_DAIFMT_NB_NF |
++					SND_SOC_DAIFMT_CBS_CFS,
++		.init           = hifiberry_dac8x_init,
++		SND_SOC_DAILINK_REG(hifiberry_dac),
++	},
++};
++
++static struct snd_rpi_simple_drvdata drvdata_hifiberry_dac8x = {
++	.card_name = "snd_rpi_hifiberry_dac8x",
++	.dai       = snd_hifiberry_dac8x_dai,
++	.fixed_bclk_ratio = 64,
++};
++
++SND_SOC_DAILINK_DEFS(dionaudio_kiwi,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm1794a-codec", "pcm1794a-hifi")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_dionaudio_kiwi_dai[] = {
++{
++	.name		= "DionAudio KIWI",
++	.stream_name	= "DionAudio KIWI STREAMER",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBS_CFS,
++	SND_SOC_DAILINK_REG(dionaudio_kiwi),
++},
++};
++
++static struct snd_rpi_simple_drvdata drvdata_dionaudio_kiwi = {
++	.card_name        = "snd_rpi_dionaudio_kiwi",
++	.dai              = snd_dionaudio_kiwi_dai,
++	.fixed_bclk_ratio = 64,
++};
++
++SND_SOC_DAILINK_DEFS(rpi_dac,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("pcm1794a-codec", "pcm1794a-hifi")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_rpi_dac_dai[] = {
++{
++	.name		= "RPi-DAC",
++	.stream_name	= "RPi-DAC HiFi",
++	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBS_CFS,
++	SND_SOC_DAILINK_REG(rpi_dac),
++},
++};
++
++static struct snd_rpi_simple_drvdata drvdata_rpi_dac = {
++	.card_name        = "snd_rpi_rpi_dac",
++	.dai              = snd_rpi_dac_dai,
++	.fixed_bclk_ratio = 64,
++};
++
++SND_SOC_DAILINK_DEFS(merus_amp,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("ma120x0p.1-0020", "ma120x0p-amp")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_merus_amp_dai[] = {
++	{
++		.name           = "MerusAmp",
++		.stream_name    = "Merus Audio Amp",
++		.ops		= &snd_merus_amp_ops,
++		.dai_fmt        = SND_SOC_DAIFMT_I2S |
++					SND_SOC_DAIFMT_NB_NF |
++					SND_SOC_DAIFMT_CBS_CFS,
++		SND_SOC_DAILINK_REG(merus_amp),
++	},
++};
++
++static struct snd_rpi_simple_drvdata drvdata_merus_amp = {
++	.card_name        = "snd_rpi_merus_amp",
++	.dai              = snd_merus_amp_dai,
++	.fixed_bclk_ratio = 64,
++};
++
++SND_SOC_DAILINK_DEFS(pifi_mini_210,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("tas571x.1-001a", "tas571x-hifi")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_pifi_mini_210_dai[] = {
++	{
++		.name           = "PiFi Mini 210",
++		.stream_name    = "PiFi Mini 210 HiFi",
++		.init			= pifi_mini_210_init,
++		.dai_fmt        = SND_SOC_DAIFMT_I2S |
++					SND_SOC_DAIFMT_NB_NF |
++					SND_SOC_DAIFMT_CBS_CFS,
++		SND_SOC_DAILINK_REG(pifi_mini_210),
++	},
++};
++
++static struct snd_rpi_simple_drvdata drvdata_pifi_mini_210 = {
++	.card_name        = "snd_pifi_mini_210",
++	.dai              = snd_pifi_mini_210_dai,
++	.fixed_bclk_ratio = 64,
++};
++
++static const struct of_device_id snd_rpi_simple_of_match[] = {
++	{ .compatible = "adi,adau1977-adc",
++		.data = (void *) &drvdata_adau1977 },
++	{ .compatible = "googlevoicehat,googlevoicehat-soundcard",
++		.data = (void *) &drvdata_googlevoicehat },
++	{ .compatible = "hifiberrydacplusdsp,hifiberrydacplusdsp-soundcard",
++		.data = (void *) &drvdata_hifiberrydacplusdsp },
++	{ .compatible = "hifiberry,hifiberry-adc8x",
++		.data = (void *) &drvdata_hifiberry_adc8x },
++	{ .compatible = "hifiberry,hifiberry-amp",
++		.data = (void *) &drvdata_hifiberry_amp },
++	{ .compatible = "hifiberry,hifiberry-amp3",
++		.data = (void *) &drvdata_hifiberry_amp3 },
++	{ .compatible = "hifiberry,hifiberry-dac",
++		.data = (void *) &drvdata_hifiberry_dac },
++	{ .compatible = "hifiberry,hifiberry-dac8x",
++		.data = (void *) &drvdata_hifiberry_dac8x },
++	{ .compatible = "dionaudio,dionaudio-kiwi",
++		.data = (void *) &drvdata_dionaudio_kiwi },
++	{ .compatible = "rpi,rpi-dac", &drvdata_rpi_dac},
++	{ .compatible = "merus,merus-amp",
++		.data = (void *) &drvdata_merus_amp },
++	{ .compatible = "pifi,pifi-mini-210",
++		.data = (void *) &drvdata_pifi_mini_210 },
++	{},
++};
++
++static int snd_rpi_simple_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++	const struct of_device_id *of_id;
++
++	snd_rpi_simple.dev = &pdev->dev;
++	of_id = of_match_node(snd_rpi_simple_of_match, pdev->dev.of_node);
++
++	if (pdev->dev.of_node && of_id->data) {
++		struct device_node *i2s_node;
++		struct snd_rpi_simple_drvdata *drvdata =
++			(struct snd_rpi_simple_drvdata *) of_id->data;
++		struct snd_soc_dai_link *dai = drvdata->dai;
++
++		snd_soc_card_set_drvdata(&snd_rpi_simple, drvdata);
++
++		/* More complex drivers might override individual functions */
++		if (!dai->init)
++			dai->init = snd_rpi_simple_init;
++		if (!dai->ops)
++			dai->ops = &snd_rpi_simple_ops;
++
++		snd_rpi_simple.name = drvdata->card_name;
++
++		snd_rpi_simple.dai_link = dai;
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++				"i2s-controller", 0);
++		if (!i2s_node) {
++			pr_err("Failed to find i2s-controller DT node\n");
++			return -ENODEV;
++		}
++
++		dai->cpus->of_node = i2s_node;
++		dai->platforms->of_node = i2s_node;
++	}
++
++	ret = devm_snd_soc_register_card(&pdev->dev, &snd_rpi_simple);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev, "Failed to register card %d\n", ret);
++
++	return ret;
++}
++
++static struct platform_driver snd_rpi_simple_driver = {
++	.driver = {
++		.name   = "snd-rpi-simple",
++		.owner  = THIS_MODULE,
++		.of_match_table = snd_rpi_simple_of_match,
++	},
++	.probe          = snd_rpi_simple_probe,
++};
++MODULE_DEVICE_TABLE(of, snd_rpi_simple_of_match);
++
++module_platform_driver(snd_rpi_simple_driver);
++
++MODULE_AUTHOR("Tim Gover <tim.gover@raspberrypi.org>");
++MODULE_DESCRIPTION("ASoC Raspberry Pi simple soundcard driver ");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/bcm/rpi-wm8804-soundcard.c
+@@ -0,0 +1,549 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * rpi--wm8804.c -- ALSA SoC Raspberry Pi soundcard.
++ *
++ * Copyright (C) 2018 Raspberry Pi.
++ *
++ * Authors: Tim Gover <tim.gover@raspberrypi.org>
++ *
++ * Generic driver for Pi Hat WM8804 digi sounds cards
++ *
++ * Based upon code from:
++ * justboom-digi.c
++ * by Milan Neskovic <info@justboom.co>
++ *
++ * iqaudio_digi.c
++ * by Daniel Matuschek <info@crazy-audio.com>
++ *
++ * allo-digione.c
++ * by Baswaraj <jaikumar@cem-solutions.net>
++ *
++ * hifiberry-digi.c
++ * Daniel Matuschek <info@crazy-audio.com>
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/gpio/consumer.h>
++#include <linux/platform_device.h>
++#include <linux/module.h>
++#include <linux/delay.h>
++
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++
++#include "../codecs/wm8804.h"
++
++struct wm8804_clk_cfg {
++	unsigned int sysclk_freq;
++	unsigned int mclk_freq;
++	unsigned int mclk_div;
++};
++
++/* Parameters for generic functions */
++struct snd_rpi_wm8804_drvdata {
++	/* Required - pointer to the DAI structure */
++	struct snd_soc_dai_link *dai;
++	/* Required - snd_soc_card name */
++	const char *card_name;
++	/* Optional DT node names if card info is defined in DT */
++	const char *card_name_dt;
++	const char *dai_name_dt;
++	const char *dai_stream_name_dt;
++	/* Optional probe extension - called prior to register_card */
++	int (*probe)(struct platform_device *pdev);
++};
++
++static struct gpio_desc *snd_clk44gpio;
++static struct gpio_desc *snd_clk48gpio;
++static int wm8804_samplerate = 0;
++static struct gpio_desc *led_gpio_1;
++static struct gpio_desc *led_gpio_2;
++static struct gpio_desc *led_gpio_3;
++static struct gpio_desc *custom_reset;
++
++/* Forward declarations */
++static struct snd_soc_dai_link snd_allo_digione_dai[];
++static struct snd_soc_card snd_rpi_wm8804;
++
++
++#define CLK_44EN_RATE 22579200UL
++#define CLK_48EN_RATE 24576000UL
++
++static const char * const wm8805_input_select_text[] = {
++	"Rx 0",
++	"Rx 1",
++	"Rx 2",
++	"Rx 3",
++	"Rx 4",
++	"Rx 5",
++	"Rx 6",
++	"Rx 7"
++};
++
++static const unsigned int wm8805_input_channel_select_value[] = {
++	0, 1, 2, 3, 4, 5, 6, 7
++};
++
++static const struct soc_enum wm8805_input_channel_sel[] = {
++	SOC_VALUE_ENUM_SINGLE(WM8804_PLL6, 0, 7, ARRAY_SIZE(wm8805_input_select_text),
++	wm8805_input_select_text, wm8805_input_channel_select_value),
++};
++
++static const struct snd_kcontrol_new wm8805_input_controls_card[] = {
++	SOC_ENUM("Select Input Channel", wm8805_input_channel_sel[0]),
++};
++
++static int wm8805_add_input_controls(struct snd_soc_component *component)
++{
++	snd_soc_add_component_controls(component, wm8805_input_controls_card,
++	ARRAY_SIZE(wm8805_input_controls_card));
++	return 0;
++}
++
++static unsigned int snd_rpi_wm8804_enable_clock(unsigned int samplerate)
++{
++	switch (samplerate) {
++	case 11025:
++	case 22050:
++	case 44100:
++	case 88200:
++	case 176400:
++		gpiod_set_value_cansleep(snd_clk44gpio, 1);
++		gpiod_set_value_cansleep(snd_clk48gpio, 0);
++		return CLK_44EN_RATE;
++	default:
++		gpiod_set_value_cansleep(snd_clk48gpio, 1);
++		gpiod_set_value_cansleep(snd_clk44gpio, 0);
++		return CLK_48EN_RATE;
++	}
++}
++
++static void snd_rpi_wm8804_clk_cfg(unsigned int samplerate,
++		struct wm8804_clk_cfg *clk_cfg)
++{
++	clk_cfg->sysclk_freq = 27000000;
++
++	if (samplerate <= 96000 ||
++	    snd_rpi_wm8804.dai_link == snd_allo_digione_dai) {
++		clk_cfg->mclk_freq = samplerate * 256;
++		clk_cfg->mclk_div = WM8804_MCLKDIV_256FS;
++	} else {
++		clk_cfg->mclk_freq = samplerate * 128;
++		clk_cfg->mclk_div = WM8804_MCLKDIV_128FS;
++	}
++
++	if (!(IS_ERR(snd_clk44gpio) || IS_ERR(snd_clk48gpio)))
++		clk_cfg->sysclk_freq = snd_rpi_wm8804_enable_clock(samplerate);
++}
++
++static int snd_rpi_wm8804_hw_params(struct snd_pcm_substream *substream,
++		struct snd_pcm_hw_params *params)
++{
++	struct snd_soc_pcm_runtime *rtd = substream->private_data;
++	struct snd_soc_dai *codec_dai = snd_soc_rtd_to_codec(rtd, 0);
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
++	int sampling_freq = 1;
++	int ret;
++	struct wm8804_clk_cfg clk_cfg;
++	int samplerate = params_rate(params);
++
++	if (samplerate == wm8804_samplerate)
++		return 0;
++
++	/* clear until all clocks are setup properly */
++	wm8804_samplerate = 0;
++
++	snd_rpi_wm8804_clk_cfg(samplerate, &clk_cfg);
++
++	pr_debug("%s samplerate: %d mclk_freq: %u mclk_div: %u sysclk: %u\n",
++			__func__, samplerate, clk_cfg.mclk_freq,
++			clk_cfg.mclk_div, clk_cfg.sysclk_freq);
++
++	switch (samplerate) {
++	case 32000:
++		sampling_freq = 0x03;
++		break;
++	case 44100:
++		sampling_freq = 0x00;
++		break;
++	case 48000:
++		sampling_freq = 0x02;
++		break;
++	case 88200:
++		sampling_freq = 0x08;
++		break;
++	case 96000:
++		sampling_freq = 0x0a;
++		break;
++	case 176400:
++		sampling_freq = 0x0c;
++		break;
++	case 192000:
++		sampling_freq = 0x0e;
++		break;
++	default:
++		dev_err(rtd->card->dev,
++		"Failed to set WM8804 SYSCLK, unsupported samplerate %d\n",
++		samplerate);
++	}
++
++	snd_soc_dai_set_clkdiv(codec_dai, WM8804_MCLK_DIV, clk_cfg.mclk_div);
++	snd_soc_dai_set_pll(codec_dai, 0, 0,
++			clk_cfg.sysclk_freq, clk_cfg.mclk_freq);
++
++	ret = snd_soc_dai_set_sysclk(codec_dai, WM8804_TX_CLKSRC_PLL,
++			clk_cfg.sysclk_freq, SND_SOC_CLOCK_OUT);
++	if (ret < 0) {
++		dev_err(rtd->card->dev,
++		"Failed to set WM8804 SYSCLK: %d\n", ret);
++		return ret;
++	}
++
++	wm8804_samplerate = samplerate;
++
++	/* set sampling frequency status bits */
++	snd_soc_component_update_bits(component, WM8804_SPDTX4, 0x0f,
++			sampling_freq);
++
++	return snd_soc_dai_set_bclk_ratio(cpu_dai, 64);
++}
++
++static struct snd_soc_ops snd_rpi_wm8804_ops = {
++	.hw_params = snd_rpi_wm8804_hw_params,
++};
++
++static int snd_interlude_audio_hw_params(struct snd_pcm_substream *substream,
++		struct snd_pcm_hw_params *params)
++{
++	int ret = snd_rpi_wm8804_hw_params(substream, params);
++	int samplerate = params_rate(params);
++
++	switch (samplerate) {
++	case 44100:
++		gpiod_set_value_cansleep(led_gpio_1, 1);
++		gpiod_set_value_cansleep(led_gpio_2, 0);
++		gpiod_set_value_cansleep(led_gpio_3, 0);
++		break;
++	case 48000:
++		gpiod_set_value_cansleep(led_gpio_1, 1);
++		gpiod_set_value_cansleep(led_gpio_2, 0);
++		gpiod_set_value_cansleep(led_gpio_3, 0);
++		break;
++	case 88200:
++		gpiod_set_value_cansleep(led_gpio_1, 0);
++		gpiod_set_value_cansleep(led_gpio_2, 1);
++		gpiod_set_value_cansleep(led_gpio_3, 0);
++		break;
++	case 96000:
++		gpiod_set_value_cansleep(led_gpio_1, 0);
++		gpiod_set_value_cansleep(led_gpio_2, 1);
++		gpiod_set_value_cansleep(led_gpio_3, 0);
++		break;
++	case 176400:
++		gpiod_set_value_cansleep(led_gpio_1, 0);
++		gpiod_set_value_cansleep(led_gpio_2, 0);
++		gpiod_set_value_cansleep(led_gpio_3, 1);
++		break;
++	case 192000:
++		gpiod_set_value_cansleep(led_gpio_1, 0);
++		gpiod_set_value_cansleep(led_gpio_2, 0);
++		gpiod_set_value_cansleep(led_gpio_3, 1);
++		break;
++	default:
++		break;
++	}
++	return ret;
++}
++
++const struct snd_soc_ops interlude_audio_digital_dai_ops = {
++	.hw_params = snd_interlude_audio_hw_params,
++};
++
++SND_SOC_DAILINK_DEFS(justboom_digi,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_justboom_digi_dai[] = {
++{
++	.name        = "JustBoom Digi",
++	.stream_name = "JustBoom Digi HiFi",
++	SND_SOC_DAILINK_REG(justboom_digi),
++},
++};
++
++static struct snd_rpi_wm8804_drvdata drvdata_justboom_digi = {
++	.card_name            = "snd_rpi_justboom_digi",
++	.dai                  = snd_justboom_digi_dai,
++};
++
++SND_SOC_DAILINK_DEFS(iqaudio_digi,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_iqaudio_digi_dai[] = {
++{
++	.name        = "IQAudIO Digi",
++	.stream_name = "IQAudIO Digi HiFi",
++	SND_SOC_DAILINK_REG(iqaudio_digi),
++},
++};
++
++static struct snd_rpi_wm8804_drvdata drvdata_iqaudio_digi = {
++	.card_name          = "IQAudIODigi",
++	.dai                = snd_iqaudio_digi_dai,
++	.card_name_dt       = "wm8804-digi,card-name",
++	.dai_name_dt        = "wm8804-digi,dai-name",
++	.dai_stream_name_dt = "wm8804-digi,dai-stream-name",
++};
++
++static int snd_allo_digione_probe(struct platform_device *pdev)
++{
++	pr_debug("%s\n", __func__);
++
++	if (IS_ERR(snd_clk44gpio) || IS_ERR(snd_clk48gpio)) {
++		dev_err(&pdev->dev, "devm_gpiod_get() failed\n");
++		return -EINVAL;
++	}
++	return 0;
++}
++
++SND_SOC_DAILINK_DEFS(allo_digione,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_allo_digione_dai[] = {
++{
++	.name        = "Allo DigiOne",
++	.stream_name = "Allo DigiOne HiFi",
++	SND_SOC_DAILINK_REG(allo_digione),
++},
++};
++
++static struct snd_rpi_wm8804_drvdata drvdata_allo_digione = {
++	.card_name = "snd_allo_digione",
++	.dai       = snd_allo_digione_dai,
++	.probe     = snd_allo_digione_probe,
++};
++
++SND_SOC_DAILINK_DEFS(hifiberry_digi,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static struct snd_soc_dai_link snd_hifiberry_digi_dai[] = {
++{
++	.name        = "HifiBerry Digi",
++	.stream_name = "HifiBerry Digi HiFi",
++	SND_SOC_DAILINK_REG(hifiberry_digi),
++},
++};
++
++static int snd_hifiberry_digi_probe(struct platform_device *pdev)
++{
++	pr_debug("%s\n", __func__);
++
++	if (IS_ERR(snd_clk44gpio) || IS_ERR(snd_clk48gpio))
++		return 0;
++
++	snd_hifiberry_digi_dai->name = "HiFiBerry Digi+ Pro";
++	snd_hifiberry_digi_dai->stream_name = "HiFiBerry Digi+ Pro HiFi";
++	return 0;
++}
++
++static struct snd_rpi_wm8804_drvdata drvdata_hifiberry_digi = {
++	.card_name = "snd_rpi_hifiberry_digi",
++	.dai       = snd_hifiberry_digi_dai,
++	.probe     = snd_hifiberry_digi_probe,
++};
++
++SND_SOC_DAILINK_DEFS(interlude_audio_digital,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
++static int snd_interlude_audio_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct snd_soc_component *component =  snd_soc_rtd_to_codec(rtd, 0)->component;
++	int ret;
++
++	ret = wm8805_add_input_controls(component);
++	if (ret != 0)
++		pr_err("failed to add input controls");
++
++	return 0;
++}
++
++
++static struct snd_soc_dai_link snd_interlude_audio_digital_dai[] = {
++{
++	.name        = "Interlude Audio Digital",
++	.stream_name = "Interlude Audio Digital HiFi",
++	.init        = snd_interlude_audio_init,
++	.ops		 = &interlude_audio_digital_dai_ops,
++	SND_SOC_DAILINK_REG(interlude_audio_digital),
++},
++};
++
++
++static int snd_interlude_audio_digital_probe(struct platform_device *pdev)
++{
++	if (IS_ERR(snd_clk44gpio) || IS_ERR(snd_clk48gpio))
++		return 0;
++
++	custom_reset = devm_gpiod_get(&pdev->dev, "reset", GPIOD_OUT_LOW);
++	gpiod_set_value_cansleep(custom_reset, 0);
++	mdelay(10);
++	gpiod_set_value_cansleep(custom_reset, 1);
++
++	snd_interlude_audio_digital_dai->name = "Interlude Audio Digital";
++	snd_interlude_audio_digital_dai->stream_name = "Interlude Audio Digital HiFi";
++	led_gpio_1 = devm_gpiod_get(&pdev->dev, "led1", GPIOD_OUT_LOW);
++	led_gpio_2 = devm_gpiod_get(&pdev->dev, "led2", GPIOD_OUT_LOW);
++	led_gpio_3 = devm_gpiod_get(&pdev->dev, "led3", GPIOD_OUT_LOW);
++	return 0;
++}
++
++
++static struct snd_rpi_wm8804_drvdata drvdata_interlude_audio_digital = {
++	.card_name = "snd_IA_Digital_Hat",
++	.dai       = snd_interlude_audio_digital_dai,
++	.probe     = snd_interlude_audio_digital_probe,
++};
++
++static const struct of_device_id snd_rpi_wm8804_of_match[] = {
++	{ .compatible = "justboom,justboom-digi",
++		.data = (void *) &drvdata_justboom_digi },
++	{ .compatible = "iqaudio,wm8804-digi",
++		.data = (void *) &drvdata_iqaudio_digi },
++	{ .compatible = "allo,allo-digione",
++		.data = (void *) &drvdata_allo_digione },
++	{ .compatible = "hifiberry,hifiberry-digi",
++		.data = (void *) &drvdata_hifiberry_digi },
++	{ .compatible = "interludeaudio,interludeaudio-digital",
++		.data = (void *) &drvdata_interlude_audio_digital },
++	{},
++};
++
++static struct snd_soc_card snd_rpi_wm8804 = {
++	.driver_name  = "RPi-WM8804",
++	.owner        = THIS_MODULE,
++	.dai_link     = NULL,
++	.num_links    = 1,
++};
++
++static int snd_rpi_wm8804_probe(struct platform_device *pdev)
++{
++	int ret = 0;
++	const struct of_device_id *of_id;
++
++	snd_rpi_wm8804.dev = &pdev->dev;
++	of_id = of_match_node(snd_rpi_wm8804_of_match, pdev->dev.of_node);
++
++	if (pdev->dev.of_node && of_id->data) {
++		struct device_node *i2s_node;
++		struct snd_rpi_wm8804_drvdata *drvdata =
++			(struct snd_rpi_wm8804_drvdata *) of_id->data;
++		struct snd_soc_dai_link *dai = drvdata->dai;
++
++		snd_soc_card_set_drvdata(&snd_rpi_wm8804, drvdata);
++
++		if (!dai->ops)
++			dai->ops = &snd_rpi_wm8804_ops;
++		if (!dai->codecs->dai_name)
++			dai->codecs->dai_name = "wm8804-spdif";
++		if (!dai->codecs->name)
++			dai->codecs->name = "wm8804.1-003b";
++		if (!dai->dai_fmt)
++			dai->dai_fmt = SND_SOC_DAIFMT_I2S |
++				SND_SOC_DAIFMT_NB_NF |
++				SND_SOC_DAIFMT_CBM_CFM;
++
++		snd_rpi_wm8804.dai_link = dai;
++		i2s_node = of_parse_phandle(pdev->dev.of_node,
++				"i2s-controller", 0);
++		if (!i2s_node) {
++			pr_err("Failed to find i2s-controller DT node\n");
++			return -ENODEV;
++		}
++
++		snd_rpi_wm8804.name = drvdata->card_name;
++
++		/* If requested by in drvdata get card & DAI names from DT */
++		if (drvdata->card_name_dt)
++			of_property_read_string(i2s_node,
++					drvdata->card_name_dt,
++					&snd_rpi_wm8804.name);
++
++		if (drvdata->dai_name_dt)
++			of_property_read_string(i2s_node,
++					drvdata->dai_name_dt,
++					&dai->name);
++
++		if (drvdata->dai_stream_name_dt)
++			of_property_read_string(i2s_node,
++					drvdata->dai_stream_name_dt,
++					&dai->stream_name);
++
++		dai->cpus->of_node = i2s_node;
++		dai->platforms->of_node = i2s_node;
++
++		/*
++		 * clk44gpio and clk48gpio are not required by all cards so
++		 * don't check the error status.
++		 */
++		snd_clk44gpio =
++			devm_gpiod_get(&pdev->dev, "clock44", GPIOD_OUT_LOW);
++
++		snd_clk48gpio =
++			devm_gpiod_get(&pdev->dev, "clock48", GPIOD_OUT_LOW);
++
++		if (drvdata->probe) {
++			ret = drvdata->probe(pdev);
++			if (ret < 0) {
++				dev_err(&pdev->dev, "Custom probe failed %d\n",
++						ret);
++				return ret;
++			}
++		}
++
++		pr_debug("%s card: %s dai: %s stream: %s\n", __func__,
++				snd_rpi_wm8804.name,
++				dai->name, dai->stream_name);
++	}
++
++	ret = devm_snd_soc_register_card(&pdev->dev, &snd_rpi_wm8804);
++	if (ret && ret != -EPROBE_DEFER)
++		dev_err(&pdev->dev, "Failed to register card %d\n", ret);
++
++	return ret;
++}
++
++static struct platform_driver snd_rpi_wm8804_driver = {
++	.driver = {
++		.name           = "snd-rpi-wm8804",
++		.owner          = THIS_MODULE,
++		.of_match_table = snd_rpi_wm8804_of_match,
++	},
++	.probe  = snd_rpi_wm8804_probe,
++};
++MODULE_DEVICE_TABLE(of, snd_rpi_wm8804_of_match);
++
++module_platform_driver(snd_rpi_wm8804_driver);
++
++MODULE_AUTHOR("Tim Gover <tim.gover@raspberrypi.org>");
++MODULE_DESCRIPTION("ASoC Raspberry Pi Hat generic digi driver for WM8804 based cards");
++MODULE_LICENSE("GPL v2");
+--- a/sound/soc/codecs/Kconfig
++++ b/sound/soc/codecs/Kconfig
+@@ -125,6 +125,7 @@ config SND_SOC_ALL_CODECS
+ 	imply SND_SOC_IDT821034
+ 	imply SND_SOC_INNO_RK3036
+ 	imply SND_SOC_ISABELLE
++	imply SND_SOC_I_SABRE_CODEC
+ 	imply SND_SOC_JZ4740_CODEC
+ 	imply SND_SOC_JZ4725B_CODEC
+ 	imply SND_SOC_JZ4760_CODEC
+@@ -132,6 +133,7 @@ config SND_SOC_ALL_CODECS
+ 	imply SND_SOC_LM4857
+ 	imply SND_SOC_LM49453
+ 	imply SND_SOC_LOCHNAGAR_SC
++	imply SND_SOC_MA120X0P
+ 	imply SND_SOC_MAX98088
+ 	imply SND_SOC_MAX98090
+ 	imply SND_SOC_MAX98095
+@@ -175,6 +177,7 @@ config SND_SOC_ALL_CODECS
+ 	imply SND_SOC_PCM179X_SPI
+ 	imply SND_SOC_PCM186X_I2C
+ 	imply SND_SOC_PCM186X_SPI
++	imply SND_SOC_PCM1794A
+ 	imply SND_SOC_PCM3008
+ 	imply SND_SOC_PCM3060_I2C
+ 	imply SND_SOC_PCM3060_SPI
+@@ -267,6 +270,7 @@ config SND_SOC_ALL_CODECS
+ 	imply SND_SOC_TLV320ADCX140
+ 	imply SND_SOC_TLV320AIC23_I2C
+ 	imply SND_SOC_TLV320AIC23_SPI
++	imply SND_SOC_TAS5713
+ 	imply SND_SOC_TLV320AIC26
+ 	imply SND_SOC_TLV320AIC31XX
+ 	imply SND_SOC_TLV320AIC32X4_I2C
+@@ -424,12 +428,12 @@ config SND_SOC_AD193X
+ 	tristate
+ 
+ config SND_SOC_AD193X_SPI
+-	tristate
++	tristate "Analog Devices AU193X CODEC - SPI"
+ 	depends on SPI_MASTER
+ 	select SND_SOC_AD193X
+ 
+ config SND_SOC_AD193X_I2C
+-	tristate
++	tristate "Analog Devices AU193X CODEC - I2C"
+ 	depends on I2C
+ 	select SND_SOC_AD193X
+ 
+@@ -1230,6 +1234,13 @@ config SND_SOC_LOCHNAGAR_SC
+ 	  This driver support the sound card functionality of the Cirrus
+ 	  Logic Lochnagar audio development board.
+ 
++config SND_SOC_MA120X0P
++	tristate "Infineon Merus(TM) MA120X0P Multilevel Class-D Audio amplifiers"
++	depends on I2C
++	help
++		Enable support for Infineon MA120X0P Multilevel Class-D audio power
++		amplifiers.
++
+ config SND_SOC_MADERA
+ 	tristate
+ 	default y if SND_SOC_CS47L15=y
+@@ -1639,6 +1650,10 @@ config SND_SOC_RT5616
+ 	tristate "Realtek RT5616 CODEC"
+ 	depends on I2C
+ 
++config SND_SOC_PCM1794A
++	tristate
++	depends on I2C
++
+ config SND_SOC_RT5631
+ 	tristate "Realtek ALC5631/RT5631 CODEC"
+ 	depends on I2C
+@@ -1996,6 +2011,9 @@ config SND_SOC_TFA9879
+ 	tristate "NXP Semiconductors TFA9879 amplifier"
+ 	depends on I2C
+ 
++config SND_SOC_TAS5713
++	tristate
++
+ config SND_SOC_TFA989X
+ 	tristate "NXP/Goodix TFA989X (TFA1) amplifiers"
+ 	depends on I2C
+@@ -2596,4 +2614,8 @@ config SND_SOC_LPASS_TX_MACRO
+ 	select SND_SOC_LPASS_MACRO_COMMON
+ 	tristate "Qualcomm TX Macro in LPASS(Low Power Audio SubSystem)"
+ 
++config SND_SOC_I_SABRE_CODEC
++	tristate "Audiophonics I-SABRE Codec"
++	depends on I2C
++
+ endmenu
+--- a/sound/soc/codecs/Makefile
++++ b/sound/soc/codecs/Makefile
+@@ -820,3 +820,12 @@ obj-$(CONFIG_SND_SOC_LPASS_TX_MACRO)	+=
+ 
+ # Mux
+ obj-$(CONFIG_SND_SOC_SIMPLE_MUX)	+= snd-soc-simple-mux.o
++
++snd-soc-i-sabre-codec-objs := i-sabre-codec.o
++snd-soc-ma120x0p-objs := ma120x0p.o
++snd-soc-pcm1794a-objs := pcm1794a.o
++snd-soc-tas5713-objs := tas5713.o
++obj-$(CONFIG_SND_SOC_I_SABRE_CODEC)    += snd-soc-i-sabre-codec.o
++obj-$(CONFIG_SND_SOC_MA120X0P)   += snd-soc-ma120x0p.o
++obj-$(CONFIG_SND_SOC_PCM1794A) += snd-soc-pcm1794a.o
++obj-$(CONFIG_SND_SOC_TAS5713)  += snd-soc-tas5713.o
+--- a/sound/soc/codecs/adau1977-i2c.c
++++ b/sound/soc/codecs/adau1977-i2c.c
+@@ -38,9 +38,19 @@ static const struct i2c_device_id adau19
+ };
+ MODULE_DEVICE_TABLE(i2c, adau1977_i2c_ids);
+ 
++static const struct of_device_id adau1977_of_ids[] = {
++	{ .compatible = "adi,adau1977", },
++	{ .compatible = "adi,adau1978", },
++	{ .compatible = "adi,adau1979", },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, adau1977_of_ids);
++
++
+ static struct i2c_driver adau1977_i2c_driver = {
+ 	.driver = {
+ 		.name = "adau1977",
++		.of_match_table = adau1977_of_ids,
+ 	},
+ 	.probe = adau1977_i2c_probe,
+ 	.id_table = adau1977_i2c_ids,
+--- a/sound/soc/codecs/cs42xx8-i2c.c
++++ b/sound/soc/codecs/cs42xx8-i2c.c
+@@ -58,11 +58,18 @@ static const struct i2c_device_id cs42xx
+ };
+ MODULE_DEVICE_TABLE(i2c, cs42xx8_i2c_id);
+ 
++const struct of_device_id cs42xx8_i2c_of_match[] = {
++	{ .compatible = "cirrus,cs42448", .data = &cs42448_data, },
++	{ .compatible = "cirrus,cs42888", .data = &cs42888_data, },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, cs42xx8_i2c_of_match);
++
+ static struct i2c_driver cs42xx8_i2c_driver = {
+ 	.driver = {
+ 		.name = "cs42xx8",
+ 		.pm = &cs42xx8_pm,
+-		.of_match_table = cs42xx8_of_match,
++		.of_match_table = cs42xx8_i2c_of_match,
+ 	},
+ 	.probe = cs42xx8_i2c_probe,
+ 	.remove = cs42xx8_i2c_remove,
+--- a/sound/soc/codecs/cs42xx8.c
++++ b/sound/soc/codecs/cs42xx8.c
+@@ -510,6 +510,16 @@ const struct cs42xx8_driver_data cs42888
+ };
+ EXPORT_SYMBOL_GPL(cs42888_data);
+ 
++const struct of_device_id cs42xx8_of_match[] = {
++	{ .compatible = "cirrus,cs42448", .data = &cs42448_data, },
++	{ .compatible = "cirrus,cs42888", .data = &cs42888_data, },
++	{ /* sentinel */ }
++};
++#if !IS_ENABLED(CONFIG_SND_SOC_CS42XX8_I2C)
++MODULE_DEVICE_TABLE(of, cs42xx8_of_match);
++EXPORT_SYMBOL_GPL(cs42xx8_of_match);
++#endif
++
+ int cs42xx8_probe(struct device *dev, struct regmap *regmap, struct cs42xx8_driver_data *drvdata)
+ {
+ 	struct cs42xx8_priv *cs42xx8;
+--- a/sound/soc/codecs/da7213.c
++++ b/sound/soc/codecs/da7213.c
+@@ -1346,6 +1346,8 @@ static int da7213_hw_params(struct snd_p
+ 	switch (params_width(params)) {
+ 	case 16:
+ 		dai_ctrl |= DA7213_DAI_WORD_LENGTH_S16_LE;
++		if (da7213->bclk_ratio == 64)
++			break;
+ 		dai_clk_mode = DA7213_DAI_BCLKS_PER_WCLK_32; /* 32bit for 1ch and 2ch */
+ 		break;
+ 	case 20:
+@@ -1361,6 +1363,9 @@ static int da7213_hw_params(struct snd_p
+ 		return -EINVAL;
+ 	}
+ 
++	if (da7213->bclk_ratio == 32 && params_width(params) != 16)
++		return -EINVAL;
++
+ 	/* Set sampling rate */
+ 	switch (params_rate(params)) {
+ 	case 8000:
+@@ -1523,6 +1528,21 @@ static int da7213_set_dai_fmt(struct snd
+ 	return 0;
+ }
+ 
++static int da7213_set_bclk_ratio(struct snd_soc_dai *dai, unsigned int ratio)
++{
++	struct snd_soc_component *component = dai->component;
++	struct da7213_priv *da7213 = snd_soc_component_get_drvdata(component);
++
++	if (ratio != 32 && ratio != 64) {
++		dev_err(component->dev, "Invalid bclk ratio %d\n", ratio);
++		return -EINVAL;
++	}
++
++	da7213->bclk_ratio = ratio;
++
++	return 0;
++}
++
+ static int da7213_mute(struct snd_soc_dai *dai, int mute, int direction)
+ {
+ 	struct snd_soc_component *component = dai->component;
+@@ -1735,6 +1755,7 @@ static const u64 da7213_dai_formats =
+ static const struct snd_soc_dai_ops da7213_dai_ops = {
+ 	.hw_params	= da7213_hw_params,
+ 	.set_fmt	= da7213_set_dai_fmt,
++	.set_bclk_ratio	= da7213_set_bclk_ratio,
+ 	.mute_stream	= da7213_mute,
+ 	.no_capture_mute = 1,
+ 	.auto_selectable_formats	= &da7213_dai_formats,
+--- a/sound/soc/codecs/da7213.h
++++ b/sound/soc/codecs/da7213.h
+@@ -600,6 +600,7 @@ struct da7213_priv {
+ 	struct clk *mclk;
+ 	unsigned int mclk_rate;
+ 	unsigned int out_rate;
++	unsigned int bclk_ratio;
+ 	int clk_src;
+ 	bool master;
+ 	bool alc_calib_auto;
+--- /dev/null
++++ b/sound/soc/codecs/i-sabre-codec.c
+@@ -0,0 +1,389 @@
++/*
++ * Driver for I-Sabre Q2M
++ *
++ * Author: Satoru Kawase
++ * Modified by: Xiao Qingyong
++ * Modified by: JC BARBAUD (Mute)
++ * Update kernel v4.18+ by : Audiophonics
++ * 		Copyright 2018 Audiophonics
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/regmap.h>
++#include <linux/i2c.h>
++#include <sound/soc.h>
++#include <sound/pcm_params.h>
++#include <sound/tlv.h>
++
++#include "i-sabre-codec.h"
++
++
++/* I-Sabre Q2M Codec Private Data */
++struct i_sabre_codec_priv {
++	struct regmap *regmap;
++	unsigned int fmt;
++};
++
++
++/* I-Sabre Q2M Codec Default Register Value */
++static const struct reg_default i_sabre_codec_reg_defaults[] = {
++	{ ISABRECODEC_REG_10, 0x00 },
++	{ ISABRECODEC_REG_20, 0x00 },
++	{ ISABRECODEC_REG_21, 0x00 },
++	{ ISABRECODEC_REG_22, 0x00 },
++	{ ISABRECODEC_REG_24, 0x00 },
++};
++
++
++static bool i_sabre_codec_writeable(struct device *dev, unsigned int reg)
++{
++	switch (reg) {
++	case ISABRECODEC_REG_10:
++	case ISABRECODEC_REG_20:
++	case ISABRECODEC_REG_21:
++	case ISABRECODEC_REG_22:
++	case ISABRECODEC_REG_24:
++		return true;
++
++	default:
++		return false;
++	}
++}
++
++static bool i_sabre_codec_readable(struct device *dev, unsigned int reg)
++{
++	switch (reg) {
++	case ISABRECODEC_REG_01:
++	case ISABRECODEC_REG_02:
++	case ISABRECODEC_REG_10:
++	case ISABRECODEC_REG_20:
++	case ISABRECODEC_REG_21:
++	case ISABRECODEC_REG_22:
++	case ISABRECODEC_REG_24:
++		return true;
++
++	default:
++		return false;
++	}
++}
++
++static bool i_sabre_codec_volatile(struct device *dev, unsigned int reg)
++{
++	switch (reg) {
++	case ISABRECODEC_REG_01:
++	case ISABRECODEC_REG_02:
++		return true;
++
++	default:
++		return false;
++	}
++}
++
++
++/* Volume Scale */
++static const DECLARE_TLV_DB_SCALE(volume_tlv, -10000, 100, 0);
++
++
++/* Filter Type */
++static const char * const fir_filter_type_texts[] = {
++	"brick wall",
++	"corrected minimum phase fast",
++	"minimum phase slow",
++	"minimum phase fast",
++	"linear phase slow",
++	"linear phase fast",
++	"apodizing fast",
++};
++
++static SOC_ENUM_SINGLE_DECL(i_sabre_fir_filter_type_enum,
++				ISABRECODEC_REG_22, 0, fir_filter_type_texts);
++
++
++/* I2S / SPDIF Select */
++static const char * const iis_spdif_sel_texts[] = {
++	"I2S",
++	"SPDIF",
++};
++
++static SOC_ENUM_SINGLE_DECL(i_sabre_iis_spdif_sel_enum,
++				ISABRECODEC_REG_24, 0, iis_spdif_sel_texts);
++
++
++/* Control */
++static const struct snd_kcontrol_new i_sabre_codec_controls[] = {
++SOC_SINGLE_RANGE_TLV("Digital Playback Volume", ISABRECODEC_REG_20, 0, 0, 100, 1, volume_tlv),
++SOC_SINGLE("Digital Playback Switch", ISABRECODEC_REG_21, 0, 1, 1),
++SOC_ENUM("FIR Filter Type", i_sabre_fir_filter_type_enum),
++SOC_ENUM("I2S/SPDIF Select", i_sabre_iis_spdif_sel_enum),
++};
++
++
++static const u32 i_sabre_codec_dai_rates_slave[] = {
++	8000, 11025, 16000, 22050, 32000,
++	44100, 48000, 64000, 88200, 96000,
++	176400, 192000, 352800, 384000,
++	705600, 768000, 1411200, 1536000
++};
++
++static const struct snd_pcm_hw_constraint_list constraints_slave = {
++	.list  = i_sabre_codec_dai_rates_slave,
++	.count = ARRAY_SIZE(i_sabre_codec_dai_rates_slave),
++};
++
++static int i_sabre_codec_dai_startup_slave(
++		struct snd_pcm_substream *substream, struct snd_soc_dai *dai)
++{
++	struct snd_soc_component *component = dai->component;
++	int ret;
++
++	ret = snd_pcm_hw_constraint_list(substream->runtime,
++			0, SNDRV_PCM_HW_PARAM_RATE, &constraints_slave);
++	if (ret != 0) {
++		dev_err(component->card->dev, "Failed to setup rates constraints: %d\n", ret);
++	}
++
++	return ret;
++}
++
++static int i_sabre_codec_dai_startup(
++		struct snd_pcm_substream *substream, struct snd_soc_dai *dai)
++{
++	struct snd_soc_component      *component = dai->component;
++	struct i_sabre_codec_priv *i_sabre_codec
++					= snd_soc_component_get_drvdata(component);
++
++	switch (i_sabre_codec->fmt & SND_SOC_DAIFMT_MASTER_MASK) {
++	case SND_SOC_DAIFMT_CBS_CFS:
++		return i_sabre_codec_dai_startup_slave(substream, dai);
++
++	default:
++		return (-EINVAL);
++	}
++}
++
++static int i_sabre_codec_hw_params(
++	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params,
++	struct snd_soc_dai *dai)
++{
++	struct snd_soc_component      *component = dai->component;
++	struct i_sabre_codec_priv *i_sabre_codec
++					= snd_soc_component_get_drvdata(component);
++	unsigned int daifmt;
++	int format_width;
++
++	dev_dbg(component->card->dev, "hw_params %u Hz, %u channels\n",
++			params_rate(params), params_channels(params));
++
++	/* Check I2S Format (Bit Size) */
++	format_width = snd_pcm_format_width(params_format(params));
++	if ((format_width != 32) && (format_width != 16)) {
++		dev_err(component->card->dev, "Bad frame size: %d\n",
++				snd_pcm_format_width(params_format(params)));
++		return (-EINVAL);
++	}
++
++	/* Check Slave Mode */
++	daifmt = i_sabre_codec->fmt & SND_SOC_DAIFMT_MASTER_MASK;
++	if (daifmt != SND_SOC_DAIFMT_CBS_CFS) {
++		return (-EINVAL);
++	}
++
++	/* Notify Sampling Frequency  */
++	switch (params_rate(params))
++	{
++	case 44100:
++	case 48000:
++	case 88200:
++	case 96000:
++	case 176400:
++	case 192000:
++		snd_soc_component_update_bits(component, ISABRECODEC_REG_10, 0x01, 0x00);
++		break;
++
++	case 352800:
++	case 384000:
++	case 705600:
++	case 768000:
++	case 1411200:
++	case 1536000:
++		snd_soc_component_update_bits(component, ISABRECODEC_REG_10, 0x01, 0x01);
++		break;
++	}
++
++	return 0;
++}
++
++static int i_sabre_codec_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
++{
++	struct snd_soc_component      *component = dai->component;
++	struct i_sabre_codec_priv *i_sabre_codec
++					= snd_soc_component_get_drvdata(component);
++
++	/* interface format */
++	switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
++	case SND_SOC_DAIFMT_I2S:
++		break;
++
++	case SND_SOC_DAIFMT_RIGHT_J:
++	case SND_SOC_DAIFMT_LEFT_J:
++	default:
++		return (-EINVAL);
++	}
++
++	/* clock inversion */
++	if ((fmt & SND_SOC_DAIFMT_INV_MASK) != SND_SOC_DAIFMT_NB_NF) {
++		return (-EINVAL);
++	}
++
++	/* Set Audio Data Format */
++	i_sabre_codec->fmt = fmt;
++
++	return 0;
++}
++
++static int i_sabre_codec_dac_mute(struct snd_soc_dai *dai, int mute, int direction)
++{
++	struct snd_soc_component *component = dai->component;
++
++	if (mute) {
++		snd_soc_component_update_bits(component, ISABRECODEC_REG_21, 0x01, 0x01);
++	} else {
++		snd_soc_component_update_bits(component, ISABRECODEC_REG_21, 0x01, 0x00);
++	}
++
++	return 0;
++}
++
++
++static const struct snd_soc_dai_ops i_sabre_codec_dai_ops = {
++	.startup      = i_sabre_codec_dai_startup,
++	.hw_params    = i_sabre_codec_hw_params,
++	.set_fmt      = i_sabre_codec_set_fmt,
++	.mute_stream  = i_sabre_codec_dac_mute,
++};
++
++static struct snd_soc_dai_driver i_sabre_codec_dai = {
++	.name = "i-sabre-codec-dai",
++	.playback = {
++		.stream_name  = "Playback",
++		.channels_min = 2,
++		.channels_max = 2,
++		.rates = SNDRV_PCM_RATE_CONTINUOUS,
++		.rate_min = 8000,
++		.rate_max = 1536000,
++		.formats      = SNDRV_PCM_FMTBIT_S16_LE
++				| SNDRV_PCM_FMTBIT_S32_LE,
++	},
++	.ops = &i_sabre_codec_dai_ops,
++};
++
++static struct snd_soc_component_driver i_sabre_codec_codec_driver = {
++		.controls         = i_sabre_codec_controls,
++		.num_controls     = ARRAY_SIZE(i_sabre_codec_controls),
++};
++
++
++static const struct regmap_config i_sabre_codec_regmap = {
++	.reg_bits         = 8,
++	.val_bits         = 8,
++	.max_register     = ISABRECODEC_MAX_REG,
++
++	.reg_defaults     = i_sabre_codec_reg_defaults,
++	.num_reg_defaults = ARRAY_SIZE(i_sabre_codec_reg_defaults),
++
++	.writeable_reg    = i_sabre_codec_writeable,
++	.readable_reg     = i_sabre_codec_readable,
++	.volatile_reg     = i_sabre_codec_volatile,
++
++	.cache_type       = REGCACHE_RBTREE,
++};
++
++
++static int i_sabre_codec_probe(struct device *dev, struct regmap *regmap)
++{
++	struct i_sabre_codec_priv *i_sabre_codec;
++	int ret;
++
++	i_sabre_codec = devm_kzalloc(dev, sizeof(*i_sabre_codec), GFP_KERNEL);
++	if (!i_sabre_codec) {
++		dev_err(dev, "devm_kzalloc");
++		return (-ENOMEM);
++	}
++
++	i_sabre_codec->regmap = regmap;
++
++	dev_set_drvdata(dev, i_sabre_codec);
++
++	ret = snd_soc_register_component(dev,
++			&i_sabre_codec_codec_driver, &i_sabre_codec_dai, 1);
++	if (ret != 0) {
++		dev_err(dev, "Failed to register CODEC: %d\n", ret);
++		return ret;
++	}
++
++	return 0;
++}
++
++static void i_sabre_codec_remove(struct device *dev)
++{
++	snd_soc_unregister_component(dev);
++}
++
++
++static int i_sabre_codec_i2c_probe(struct i2c_client *i2c)
++{
++	struct regmap *regmap;
++
++	regmap = devm_regmap_init_i2c(i2c, &i_sabre_codec_regmap);
++	if (IS_ERR(regmap)) {
++		return PTR_ERR(regmap);
++	}
++
++	return i_sabre_codec_probe(&i2c->dev, regmap);
++}
++
++static void i_sabre_codec_i2c_remove(struct i2c_client *i2c)
++{
++	i_sabre_codec_remove(&i2c->dev);
++}
++
++
++static const struct i2c_device_id i_sabre_codec_i2c_id[] = {
++	{ "i-sabre-codec", },
++	{ }
++};
++MODULE_DEVICE_TABLE(i2c, i_sabre_codec_i2c_id);
++
++static const struct of_device_id i_sabre_codec_of_match[] = {
++	{ .compatible = "audiophonics,i-sabre-codec", },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, i_sabre_codec_of_match);
++
++static struct i2c_driver i_sabre_codec_i2c_driver = {
++	.driver = {
++		.name           = "i-sabre-codec-i2c",
++		.owner          = THIS_MODULE,
++		.of_match_table = of_match_ptr(i_sabre_codec_of_match),
++	},
++	.probe    = i_sabre_codec_i2c_probe,
++	.remove   = i_sabre_codec_i2c_remove,
++	.id_table = i_sabre_codec_i2c_id,
++};
++module_i2c_driver(i_sabre_codec_i2c_driver);
++
++
++MODULE_DESCRIPTION("ASoC I-Sabre Q2M codec driver");
++MODULE_AUTHOR("Audiophonics <http://www.audiophonics.fr>");
++MODULE_LICENSE("GPL");
+--- /dev/null
++++ b/sound/soc/codecs/i-sabre-codec.h
+@@ -0,0 +1,42 @@
++/*
++ * Driver for I-Sabre Q2M
++ *
++ * Author: Satoru Kawase
++ * Modified by: Xiao Qingyong
++ *      Copyright 2018 Audiophonics
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#ifndef _SND_SOC_ISABRECODEC
++#define _SND_SOC_ISABRECODEC
++
++
++/* ISABRECODEC Register Address */
++#define ISABRECODEC_REG_01	0x01	/* Virtual Device ID  :  0x01 = es9038q2m */
++#define ISABRECODEC_REG_02	0x02	/* API revision       :  0x01 = Revision 01 */
++#define ISABRECODEC_REG_10	0x10	/* 0x01 = above 192kHz, 0x00 = otherwise */
++#define ISABRECODEC_REG_20	0x20	/* 0 - 100 (decimal value, 0 = min., 100 = max.) */
++#define ISABRECODEC_REG_21	0x21	/* 0x00 = Mute OFF, 0x01 = Mute ON */
++#define ISABRECODEC_REG_22	0x22	
++/*
++   0x00 = brick wall,
++   0x01 = corrected minimum phase fast,
++   0x02 = minimum phase slow,
++   0x03 = minimum phase fast,
++   0x04 = linear phase slow,
++   0x05 = linear phase fast,
++   0x06 = apodizing fast,
++*/
++//#define ISABRECODEC_REG_23	0x23	/* reserved */
++#define ISABRECODEC_REG_24	0x24	/* 0x00 = I2S, 0x01 = SPDIF */
++#define ISABRECODEC_MAX_REG	0x24	/* Maximum Register Number */
++
++#endif /* _SND_SOC_ISABRECODEC */
+--- /dev/null
++++ b/sound/soc/codecs/ma120x0p.c
+@@ -0,0 +1,1380 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * ASoC Driver for Infineon Merus(TM) ma120x0p multi-level class-D amplifier
++ *
++ * Authors:	Ariel Muszkat <ariel.muszkat@gmail.com>
++ * Jorgen Kragh Jakobsen <jorgen.kraghjakobsen@infineon.com>
++ *
++ * Copyright (C) 2019 Infineon Technologies AG
++ *
++ */
++#include <linux/module.h>
++#include <linux/moduleparam.h>
++#include <linux/init.h>
++#include <linux/delay.h>
++#include <linux/pm_runtime.h>
++#include <linux/i2c.h>
++#include <linux/of_device.h>
++#include <linux/spi/spi.h>
++#include <linux/regmap.h>
++#include <linux/regulator/consumer.h>
++#include <linux/slab.h>
++#include <linux/gpio/consumer.h>
++#include <linux/gpio.h>
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/soc-dapm.h>
++#include <sound/initval.h>
++#include <sound/tlv.h>
++#include <linux/interrupt.h>
++
++#include <linux/kernel.h>
++#include <linux/string.h>
++#include <linux/fs.h>
++#include <linux/uaccess.h>
++
++#ifndef _MA120X0P_
++#define _MA120X0P_
++//------------------------------------------------------------------manualPM---
++// Select Manual PowerMode control
++#define ma_manualpm__a 0
++#define ma_manualpm__len 1
++#define ma_manualpm__mask 0x40
++#define ma_manualpm__shift 0x06
++#define ma_manualpm__reset 0x00
++//--------------------------------------------------------------------pm_man---
++// manual selected power mode
++#define ma_pm_man__a 0
++#define ma_pm_man__len 2
++#define ma_pm_man__mask 0x30
++#define ma_pm_man__shift 0x04
++#define ma_pm_man__reset 0x03
++//------------------------------------------ ----------------------mthr_1to2---
++// mod. index threshold value for pm1=>pm2 change.
++#define ma_mthr_1to2__a 1
++#define ma_mthr_1to2__len 8
++#define ma_mthr_1to2__mask 0xff
++#define ma_mthr_1to2__shift 0x00
++#define ma_mthr_1to2__reset 0x3c
++//-----------------------------------------------------------------mthr_2to1---
++// mod. index threshold value for pm2=>pm1 change.
++#define ma_mthr_2to1__a 2
++#define ma_mthr_2to1__len 8
++#define ma_mthr_2to1__mask 0xff
++#define ma_mthr_2to1__shift 0x00
++#define ma_mthr_2to1__reset 0x32
++//-----------------------------------------------------------------mthr_2to3---
++// mod. index threshold value for pm2=>pm3 change.
++#define ma_mthr_2to3__a 3
++#define ma_mthr_2to3__len 8
++#define ma_mthr_2to3__mask 0xff
++#define ma_mthr_2to3__shift 0x00
++#define ma_mthr_2to3__reset 0x5a
++//-----------------------------------------------------------------mthr_3to2---
++// mod. index threshold value for pm3=>pm2 change.
++#define ma_mthr_3to2__a 4
++#define ma_mthr_3to2__len 8
++#define ma_mthr_3to2__mask 0xff
++#define ma_mthr_3to2__shift 0x00
++#define ma_mthr_3to2__reset 0x50
++//-------------------------------------------------------------pwmclkdiv_nom---
++// pwm default clock divider value
++#define ma_pwmclkdiv_nom__a 8
++#define ma_pwmclkdiv_nom__len 8
++#define ma_pwmclkdiv_nom__mask 0xff
++#define ma_pwmclkdiv_nom__shift 0x00
++#define ma_pwmclkdiv_nom__reset 0x26
++//--------- ----------------------------------------------------ocp_latch_en---
++// high to use permanently latching level-2 ocp
++#define ma_ocp_latch_en__a 10
++#define ma_ocp_latch_en__len 1
++#define ma_ocp_latch_en__mask 0x02
++#define ma_ocp_latch_en__shift 0x01
++#define ma_ocp_latch_en__reset 0x00
++//---------------------------------------------------------------lf_clamp_en---
++// high (default) to enable lf int2+3 clamping on clip
++#define ma_lf_clamp_en__a 10
++#define ma_lf_clamp_en__len 1
++#define ma_lf_clamp_en__mask 0x80
++#define ma_lf_clamp_en__shift 0x07
++#define ma_lf_clamp_en__reset 0x00
++//-------------------------------------------------------pmcfg_btl_b.modtype---
++//
++#define ma_pmcfg_btl_b__modtype__a 18
++#define ma_pmcfg_btl_b__modtype__len 2
++#define ma_pmcfg_btl_b__modtype__mask 0x18
++#define ma_pmcfg_btl_b__modtype__shift 0x03
++#define ma_pmcfg_btl_b__modtype__reset 0x02
++//-------------------------------------------------------pmcfg_btl_b.freqdiv---
++#define ma_pmcfg_btl_b__freqdiv__a 18
++#define ma_pmcfg_btl_b__freqdiv__len 2
++#define ma_pmcfg_btl_b__freqdiv__mask 0x06
++#define ma_pmcfg_btl_b__freqdiv__shift 0x01
++#define ma_pmcfg_btl_b__freqdiv__reset 0x01
++//----------------------------------------------------pmcfg_btl_b.lf_gain_ol---
++//
++#define ma_pmcfg_btl_b__lf_gain_ol__a 18
++#define ma_pmcfg_btl_b__lf_gain_ol__len 1
++#define ma_pmcfg_btl_b__lf_gain_ol__mask 0x01
++#define ma_pmcfg_btl_b__lf_gain_ol__shift 0x00
++#define ma_pmcfg_btl_b__lf_gain_ol__reset 0x01
++//-------------------------------------------------------pmcfg_btl_c.freqdiv---
++//
++#define ma_pmcfg_btl_c__freqdiv__a 19
++#define ma_pmcfg_btl_c__freqdiv__len 2
++#define ma_pmcfg_btl_c__freqdiv__mask 0x06
++#define ma_pmcfg_btl_c__freqdiv__shift 0x01
++#define ma_pmcfg_btl_c__freqdiv__reset 0x01
++//-------------------------------------------------------pmcfg_btl_c.modtype---
++//
++#define ma_pmcfg_btl_c__modtype__a 19
++#define ma_pmcfg_btl_c__modtype__len 2
++#define ma_pmcfg_btl_c__modtype__mask 0x18
++#define ma_pmcfg_btl_c__modtype__shift 0x03
++#define ma_pmcfg_btl_c__modtype__reset 0x01
++//----------------------------------------------------pmcfg_btl_c.lf_gain_ol---
++//
++#define ma_pmcfg_btl_c__lf_gain_ol__a 19
++#define ma_pmcfg_btl_c__lf_gain_ol__len 1
++#define ma_pmcfg_btl_c__lf_gain_ol__mask 0x01
++#define ma_pmcfg_btl_c__lf_gain_ol__shift 0x00
++#define ma_pmcfg_btl_c__lf_gain_ol__reset 0x00
++//-------------------------------------------------------pmcfg_btl_d.modtype---
++//
++#define ma_pmcfg_btl_d__modtype__a 20
++#define ma_pmcfg_btl_d__modtype__len 2
++#define ma_pmcfg_btl_d__modtype__mask 0x18
++#define ma_pmcfg_btl_d__modtype__shift 0x03
++#define ma_pmcfg_btl_d__modtype__reset 0x02
++//-------------------------------------------------------pmcfg_btl_d.freqdiv---
++//
++#define ma_pmcfg_btl_d__freqdiv__a 20
++#define ma_pmcfg_btl_d__freqdiv__len 2
++#define ma_pmcfg_btl_d__freqdiv__mask 0x06
++#define ma_pmcfg_btl_d__freqdiv__shift 0x01
++#define ma_pmcfg_btl_d__freqdiv__reset 0x02
++//----------------------------------------------------pmcfg_btl_d.lf_gain_ol---
++//
++#define ma_pmcfg_btl_d__lf_gain_ol__a 20
++#define ma_pmcfg_btl_d__lf_gain_ol__len 1
++#define ma_pmcfg_btl_d__lf_gain_ol__mask 0x01
++#define ma_pmcfg_btl_d__lf_gain_ol__shift 0x00
++#define ma_pmcfg_btl_d__lf_gain_ol__reset 0x00
++//------------ -------------------------------------------pmcfg_se_a.modtype---
++//
++#define ma_pmcfg_se_a__modtype__a 21
++#define ma_pmcfg_se_a__modtype__len 2
++#define ma_pmcfg_se_a__modtype__mask 0x18
++#define ma_pmcfg_se_a__modtype__shift 0x03
++#define ma_pmcfg_se_a__modtype__reset 0x01
++//--------------------------------------------------------pmcfg_se_a.freqdiv---
++//
++#define ma_pmcfg_se_a__freqdiv__a 21
++#define ma_pmcfg_se_a__freqdiv__len 2
++#define ma_pmcfg_se_a__freqdiv__mask 0x06
++#define ma_pmcfg_se_a__freqdiv__shift 0x01
++#define ma_pmcfg_se_a__freqdiv__reset 0x00
++//-----------------------------------------------------pmcfg_se_a.lf_gain_ol---
++//
++#define ma_pmcfg_se_a__lf_gain_ol__a 21
++#define ma_pmcfg_se_a__lf_gain_ol__len 1
++#define ma_pmcfg_se_a__lf_gain_ol__mask 0x01
++#define ma_pmcfg_se_a__lf_gain_ol__shift 0x00
++#define ma_pmcfg_se_a__lf_gain_ol__reset 0x01
++//-----------------------------------------------------pmcfg_se_b.lf_gain_ol---
++//
++#define ma_pmcfg_se_b__lf_gain_ol__a 22
++#define ma_pmcfg_se_b__lf_gain_ol__len 1
++#define ma_pmcfg_se_b__lf_gain_ol__mask 0x01
++#define ma_pmcfg_se_b__lf_gain_ol__shift 0x00
++#define ma_pmcfg_se_b__lf_gain_ol__reset 0x00
++//--------------------------------------------------------pmcfg_se_b.freqdiv---
++//
++#define ma_pmcfg_se_b__freqdiv__a 22
++#define ma_pmcfg_se_b__freqdiv__len 2
++#define ma_pmcfg_se_b__freqdiv__mask 0x06
++#define ma_pmcfg_se_b__freqdiv__shift 0x01
++#define ma_pmcfg_se_b__freqdiv__reset 0x01
++//--------------------------------------------------------pmcfg_se_b.modtype---
++//
++#define ma_pmcfg_se_b__modtype__a 22
++#define ma_pmcfg_se_b__modtype__len 2
++#define ma_pmcfg_se_b__modtype__mask 0x18
++#define ma_pmcfg_se_b__modtype__shift 0x03
++#define ma_pmcfg_se_b__modtype__reset 0x01
++//----------------------------------------------------------balwaitcount_pm1---
++// pm1 balancing period.
++#define ma_balwaitcount_pm1__a 23
++#define ma_balwaitcount_pm1__len 8
++#define ma_balwaitcount_pm1__mask 0xff
++#define ma_balwaitcount_pm1__shift 0x00
++#define ma_balwaitcount_pm1__reset 0x14
++//----------------------------------------------------------balwaitcount_pm2---
++// pm2 balancing period.
++#define ma_balwaitcount_pm2__a 24
++#define ma_balwaitcount_pm2__len 8
++#define ma_balwaitcount_pm2__mask 0xff
++#define ma_balwaitcount_pm2__shift 0x00
++#define ma_balwaitcount_pm2__reset 0x14
++//----------------------------------------------------------balwaitcount_pm3---
++// pm3 balancing period.
++#define ma_balwaitcount_pm3__a 25
++#define ma_balwaitcount_pm3__len 8
++#define ma_balwaitcount_pm3__mask 0xff
++#define ma_balwaitcount_pm3__shift 0x00
++#define ma_balwaitcount_pm3__reset 0x1a
++//-------------------------------------------------------------usespread_pm1---
++// pm1 pwm spread-spectrum mode on/off.
++#define ma_usespread_pm1__a 26
++#define ma_usespread_pm1__len 1
++#define ma_usespread_pm1__mask 0x40
++#define ma_usespread_pm1__shift 0x06
++#define ma_usespread_pm1__reset 0x00
++//---------------------------------------------------------------dtsteps_pm1---
++// pm1 dead time setting [10ns steps].
++#define ma_dtsteps_pm1__a 26
++#define ma_dtsteps_pm1__len 3
++#define ma_dtsteps_pm1__mask 0x38
++#define ma_dtsteps_pm1__shift 0x03
++#define ma_dtsteps_pm1__reset 0x04
++//---------------------------------------------------------------baltype_pm1---
++// pm1 balancing sensor scheme.
++#define ma_baltype_pm1__a 26
++#define ma_baltype_pm1__len 3
++#define ma_baltype_pm1__mask 0x07
++#define ma_baltype_pm1__shift 0x00
++#define ma_baltype_pm1__reset 0x00
++//-------------------------------------------------------------usespread_pm2---
++// pm2 pwm spread-spectrum mode on/off.
++#define ma_usespread_pm2__a 27
++#define ma_usespread_pm2__len 1
++#define ma_usespread_pm2__mask 0x40
++#define ma_usespread_pm2__shift 0x06
++#define ma_usespread_pm2__reset 0x00
++//---------------------------------------------------------------dtsteps_pm2---
++// pm2 dead time setting [10ns steps].
++#define ma_dtsteps_pm2__a 27
++#define ma_dtsteps_pm2__len 3
++#define ma_dtsteps_pm2__mask 0x38
++#define ma_dtsteps_pm2__shift 0x03
++#define ma_dtsteps_pm2__reset 0x03
++//---------------------------------------------------------------baltype_pm2---
++// pm2 balancing sensor scheme.
++#define ma_baltype_pm2__a 27
++#define ma_baltype_pm2__len 3
++#define ma_baltype_pm2__mask 0x07
++#define ma_baltype_pm2__shift 0x00
++#define ma_baltype_pm2__reset 0x01
++//-------------------------------------------------------------usespread_pm3---
++// pm3 pwm spread-spectrum mode on/off.
++#define ma_usespread_pm3__a 28
++#define ma_usespread_pm3__len 1
++#define ma_usespread_pm3__mask 0x40
++#define ma_usespread_pm3__shift 0x06
++#define ma_usespread_pm3__reset 0x00
++//---------------------------------------------------------------dtsteps_pm3---
++// pm3 dead time setting [10ns steps].
++#define ma_dtsteps_pm3__a 28
++#define ma_dtsteps_pm3__len 3
++#define ma_dtsteps_pm3__mask 0x38
++#define ma_dtsteps_pm3__shift 0x03
++#define ma_dtsteps_pm3__reset 0x01
++//---------------------------------------------------------------baltype_pm3---
++// pm3 balancing sensor scheme.
++#define ma_baltype_pm3__a 28
++#define ma_baltype_pm3__len 3
++#define ma_baltype_pm3__mask 0x07
++#define ma_baltype_pm3__shift 0x00
++#define ma_baltype_pm3__reset 0x03
++//-----------------------------------------------------------------pmprofile---
++// pm profile select. valid presets: 0-1-2-3-4. 5=> custom profile.
++#define ma_pmprofile__a 29
++#define ma_pmprofile__len 3
++#define ma_pmprofile__mask 0x07
++#define ma_pmprofile__shift 0x00
++#define ma_pmprofile__reset 0x00
++//-------------------------------------------------------------------pm3_man---
++// custom profile pm3 contents. 0=>a,  1=>b,  2=>c,  3=>d
++#define ma_pm3_man__a 30
++#define ma_pm3_man__len 2
++#define ma_pm3_man__mask 0x30
++#define ma_pm3_man__shift 0x04
++#define ma_pm3_man__reset 0x02
++//-------------------------------------------------------------------pm2_man---
++// custom profile pm2 contents. 0=>a,  1=>b,  2=>c,  3=>d
++#define ma_pm2_man__a 30
++#define ma_pm2_man__len 2
++#define ma_pm2_man__mask 0x0c
++#define ma_pm2_man__shift 0x02
++#define ma_pm2_man__reset 0x03
++//-------------------------------------------------------------------pm1_man---
++// custom profile pm1 contents. 0=>a,  1=>b,  2=>c,  3=>d
++#define ma_pm1_man__a 30
++#define ma_pm1_man__len 2
++#define ma_pm1_man__mask 0x03
++#define ma_pm1_man__shift 0x00
++#define ma_pm1_man__reset 0x03
++//-----------------------------------------------------------ocp_latch_clear---
++// low-high clears current ocp latched condition.
++#define ma_ocp_latch_clear__a 32
++#define ma_ocp_latch_clear__len 1
++#define ma_ocp_latch_clear__mask 0x80
++#define ma_ocp_latch_clear__shift 0x07
++#define ma_ocp_latch_clear__reset 0x00
++//-------------------------------------------------------------audio_in_mode---
++// audio input mode; 0-1-2-3-4-5
++#define ma_audio_in_mode__a 37
++#define ma_audio_in_mode__len 3
++#define ma_audio_in_mode__mask 0xe0
++#define ma_audio_in_mode__shift 0x05
++#define ma_audio_in_mode__reset 0x00
++//-----------------------------------------------------------------eh_dcshdn---
++// high to enable dc protection
++#define ma_eh_dcshdn__a 38
++#define ma_eh_dcshdn__len 1
++#define ma_eh_dcshdn__mask 0x04
++#define ma_eh_dcshdn__shift 0x02
++#define ma_eh_dcshdn__reset 0x01
++//---------------------------------------------------------audio_in_mode_ext---
++// if set,  audio_in_mode is controlled from audio_in_mode register. if not set
++//audio_in_mode is set from fuse bank setting
++#define ma_audio_in_mode_ext__a 39
++#define ma_audio_in_mode_ext__len 1
++#define ma_audio_in_mode_ext__mask 0x20
++#define ma_audio_in_mode_ext__shift 0x05
++#define ma_audio_in_mode_ext__reset 0x00
++//------------------------------------------------------------------eh_clear---
++// flip to clear error registers
++#define ma_eh_clear__a 45
++#define ma_eh_clear__len 1
++#define ma_eh_clear__mask 0x04
++#define ma_eh_clear__shift 0x02
++#define ma_eh_clear__reset 0x00
++//----------------------------------------------------------thermal_compr_en---
++// enable otw-contr.  input compression?
++#define ma_thermal_compr_en__a 45
++#define ma_thermal_compr_en__len 1
++#define ma_thermal_compr_en__mask 0x20
++#define ma_thermal_compr_en__shift 0x05
++#define ma_thermal_compr_en__reset 0x01
++//---------------------------------------------------------------system_mute---
++// 1 = mute system,  0 = normal operation
++#define ma_system_mute__a 45
++#define ma_system_mute__len 1
++#define ma_system_mute__mask 0x40
++#define ma_system_mute__shift 0x06
++#define ma_system_mute__reset 0x00
++//------------------------------------------------------thermal_compr_max_db---
++// audio limiter max thermal reduction
++#define ma_thermal_compr_max_db__a 46
++#define ma_thermal_compr_max_db__len 3
++#define ma_thermal_compr_max_db__mask 0x07
++#define ma_thermal_compr_max_db__shift 0x00
++#define ma_thermal_compr_max_db__reset 0x04
++//---------------------------------------------------------audio_proc_enable---
++// enable audio proc,  bypass if not enabled
++#define ma_audio_proc_enable__a 53
++#define ma_audio_proc_enable__len 1
++#define ma_audio_proc_enable__mask 0x08
++#define ma_audio_proc_enable__shift 0x03
++#define ma_audio_proc_enable__reset 0x00
++//--------------------------------------------------------audio_proc_release---
++// 00:slow,  01:normal,  10:fast
++#define ma_audio_proc_release__a 53
++#define ma_audio_proc_release__len 2
++#define ma_audio_proc_release__mask 0x30
++#define ma_audio_proc_release__shift 0x04
++#define ma_audio_proc_release__reset 0x00
++//---------------------------------------------------------audio_proc_attack---
++// 00:slow,  01:normal,  10:fast
++#define ma_audio_proc_attack__a 53
++#define ma_audio_proc_attack__len 2
++#define ma_audio_proc_attack__mask 0xc0
++#define ma_audio_proc_attack__shift 0x06
++#define ma_audio_proc_attack__reset 0x00
++//----------------------------------------------------------------i2s_format---
++// i2s basic data format,  000 = std. i2s,  001 = left justified (default)
++#define ma_i2s_format__a 53
++#define ma_i2s_format__len 3
++#define ma_i2s_format__mask 0x07
++#define ma_i2s_format__shift 0x00
++#define ma_i2s_format__reset 0x01
++//--------------------------------------------------audio_proc_limiterenable---
++// 1: enable limiter,  0: disable limiter
++#define ma_audio_proc_limiterenable__a 54
++#define ma_audio_proc_limiterenable__len 1
++#define ma_audio_proc_limiterenable__mask 0x40
++#define ma_audio_proc_limiterenable__shift 0x06
++#define ma_audio_proc_limiterenable__reset 0x00
++//-----------------------------------------------------------audio_proc_mute---
++// 1: mute,  0: unmute
++#define ma_audio_proc_mute__a 54
++#define ma_audio_proc_mute__len 1
++#define ma_audio_proc_mute__mask 0x80
++#define ma_audio_proc_mute__shift 0x07
++#define ma_audio_proc_mute__reset 0x00
++//---------------------------------------------------------------i2s_sck_pol---
++// i2s sck polarity cfg. 0 = rising edge data change
++#define ma_i2s_sck_pol__a 54
++#define ma_i2s_sck_pol__len 1
++#define ma_i2s_sck_pol__mask 0x01
++#define ma_i2s_sck_pol__shift 0x00
++#define ma_i2s_sck_pol__reset 0x01
++//-------------------------------------------------------------i2s_framesize---
++// i2s word length. 00 = 32bit,  01 = 24bit
++#define ma_i2s_framesize__a 54
++#define ma_i2s_framesize__len 2
++#define ma_i2s_framesize__mask 0x18
++#define ma_i2s_framesize__shift 0x03
++#define ma_i2s_framesize__reset 0x00
++//----------------------------------------------------------------i2s_ws_pol---
++// i2s ws polarity. 0 = low first
++#define ma_i2s_ws_pol__a 54
++#define ma_i2s_ws_pol__len 1
++#define ma_i2s_ws_pol__mask 0x02
++#define ma_i2s_ws_pol__shift 0x01
++#define ma_i2s_ws_pol__reset 0x00
++//-----------------------------------------------------------------i2s_order---
++// i2s word bit order. 0 = msb first
++#define ma_i2s_order__a 54
++#define ma_i2s_order__len 1
++#define ma_i2s_order__mask 0x04
++#define ma_i2s_order__shift 0x02
++#define ma_i2s_order__reset 0x00
++//------------------------------------------------------------i2s_rightfirst---
++// i2s l/r word order; 0 = left first
++#define ma_i2s_rightfirst__a 54
++#define ma_i2s_rightfirst__len 1
++#define ma_i2s_rightfirst__mask 0x20
++#define ma_i2s_rightfirst__shift 0x05
++#define ma_i2s_rightfirst__reset 0x00
++//-------------------------------------------------------------vol_db_master---
++// master volume db
++#define ma_vol_db_master__a 64
++#define ma_vol_db_master__len 8
++#define ma_vol_db_master__mask 0xff
++#define ma_vol_db_master__shift 0x00
++#define ma_vol_db_master__reset 0x18
++//------------------------------------------------------------vol_lsb_master---
++// master volume lsb 1/4 steps
++#define ma_vol_lsb_master__a 65
++#define ma_vol_lsb_master__len 2
++#define ma_vol_lsb_master__mask 0x03
++#define ma_vol_lsb_master__shift 0x00
++#define ma_vol_lsb_master__reset 0x00
++//----------------------------------------------------------------vol_db_ch0---
++// volume channel 0
++#define ma_vol_db_ch0__a 66
++#define ma_vol_db_ch0__len 8
++#define ma_vol_db_ch0__mask 0xff
++#define ma_vol_db_ch0__shift 0x00
++#define ma_vol_db_ch0__reset 0x18
++//----------------------------------------------------------------vol_db_ch1---
++// volume channel 1
++#define ma_vol_db_ch1__a 67
++#define ma_vol_db_ch1__len 8
++#define ma_vol_db_ch1__mask 0xff
++#define ma_vol_db_ch1__shift 0x00
++#define ma_vol_db_ch1__reset 0x18
++//----------------------------------------------------------------vol_db_ch2---
++// volume channel 2
++#define ma_vol_db_ch2__a 68
++#define ma_vol_db_ch2__len 8
++#define ma_vol_db_ch2__mask 0xff
++#define ma_vol_db_ch2__shift 0x00
++#define ma_vol_db_ch2__reset 0x18
++//----------------------------------------------------------------vol_db_ch3---
++// volume channel 3
++#define ma_vol_db_ch3__a 69
++#define ma_vol_db_ch3__len 8
++#define ma_vol_db_ch3__mask 0xff
++#define ma_vol_db_ch3__shift 0x00
++#define ma_vol_db_ch3__reset 0x18
++//---------------------------------------------------------------vol_lsb_ch0---
++// volume channel 1 - 1/4 steps
++#define ma_vol_lsb_ch0__a 70
++#define ma_vol_lsb_ch0__len 2
++#define ma_vol_lsb_ch0__mask 0x03
++#define ma_vol_lsb_ch0__shift 0x00
++#define ma_vol_lsb_ch0__reset 0x00
++//---------------------------------------------------------------vol_lsb_ch1---
++// volume channel 3 - 1/4 steps
++#define ma_vol_lsb_ch1__a 70
++#define ma_vol_lsb_ch1__len 2
++#define ma_vol_lsb_ch1__mask 0x0c
++#define ma_vol_lsb_ch1__shift 0x02
++#define ma_vol_lsb_ch1__reset 0x00
++//---------------------------------------------------------------vol_lsb_ch2---
++// volume channel 2 - 1/4 steps
++#define ma_vol_lsb_ch2__a 70
++#define ma_vol_lsb_ch2__len 2
++#define ma_vol_lsb_ch2__mask 0x30
++#define ma_vol_lsb_ch2__shift 0x04
++#define ma_vol_lsb_ch2__reset 0x00
++//---------------------------------------------------------------vol_lsb_ch3---
++// volume channel 3 - 1/4 steps
++#define ma_vol_lsb_ch3__a 70
++#define ma_vol_lsb_ch3__len 2
++#define ma_vol_lsb_ch3__mask 0xc0
++#define ma_vol_lsb_ch3__shift 0x06
++#define ma_vol_lsb_ch3__reset 0x00
++//----------------------------------------------------------------thr_db_ch0---
++// thr_db channel 0
++#define ma_thr_db_ch0__a 71
++#define ma_thr_db_ch0__len 8
++#define ma_thr_db_ch0__mask 0xff
++#define ma_thr_db_ch0__shift 0x00
++#define ma_thr_db_ch0__reset 0x18
++//----------------------------------------------------------------thr_db_ch1---
++// thr db ch1
++#define ma_thr_db_ch1__a 72
++#define ma_thr_db_ch1__len 8
++#define ma_thr_db_ch1__mask 0xff
++#define ma_thr_db_ch1__shift 0x00
++#define ma_thr_db_ch1__reset 0x18
++//----------------------------------------------------------------thr_db_ch2---
++// thr db ch2
++#define ma_thr_db_ch2__a 73
++#define ma_thr_db_ch2__len 8
++#define ma_thr_db_ch2__mask 0xff
++#define ma_thr_db_ch2__shift 0x00
++#define ma_thr_db_ch2__reset 0x18
++//----------------------------------------------------------------thr_db_ch3---
++// threshold db ch3
++#define ma_thr_db_ch3__a 74
++#define ma_thr_db_ch3__len 8
++#define ma_thr_db_ch3__mask 0xff
++#define ma_thr_db_ch3__shift 0x00
++#define ma_thr_db_ch3__reset 0x18
++//---------------------------------------------------------------thr_lsb_ch0---
++// thr lsb ch0
++#define ma_thr_lsb_ch0__a 75
++#define ma_thr_lsb_ch0__len 2
++#define ma_thr_lsb_ch0__mask 0x03
++#define ma_thr_lsb_ch0__shift 0x00
++#define ma_thr_lsb_ch0__reset 0x00
++//---------------------------------------------------------------thr_lsb_ch1---
++// thr lsb ch1
++#define ma_thr_lsb_ch1__a 75
++#define ma_thr_lsb_ch1__len 2
++#define ma_thr_lsb_ch1__mask 0x0c
++#define ma_thr_lsb_ch1__shift 0x02
++#define ma_thr_lsb_ch1__reset 0x00
++//---------------------------------------------------------------thr_lsb_ch2---
++// thr lsb ch2 1/4 db step
++#define ma_thr_lsb_ch2__a 75
++#define ma_thr_lsb_ch2__len 2
++#define ma_thr_lsb_ch2__mask 0x30
++#define ma_thr_lsb_ch2__shift 0x04
++#define ma_thr_lsb_ch2__reset 0x00
++//---------------------------------------------------------------thr_lsb_ch3---
++// threshold lsb ch3
++#define ma_thr_lsb_ch3__a 75
++#define ma_thr_lsb_ch3__len 2
++#define ma_thr_lsb_ch3__mask 0xc0
++#define ma_thr_lsb_ch3__shift 0x06
++#define ma_thr_lsb_ch3__reset 0x00
++//-----------------------------------------------------------dcu_mon0.pm_mon---
++// power mode monitor channel 0
++#define ma_dcu_mon0__pm_mon__a 96
++#define ma_dcu_mon0__pm_mon__len 2
++#define ma_dcu_mon0__pm_mon__mask 0x03
++#define ma_dcu_mon0__pm_mon__shift 0x00
++#define ma_dcu_mon0__pm_mon__reset 0x00
++//-----------------------------------------------------dcu_mon0.freqmode_mon---
++// frequence mode monitor channel 0
++#define ma_dcu_mon0__freqmode_mon__a 96
++#define ma_dcu_mon0__freqmode_mon__len 3
++#define ma_dcu_mon0__freqmode_mon__mask 0x70
++#define ma_dcu_mon0__freqmode_mon__shift 0x04
++#define ma_dcu_mon0__freqmode_mon__reset 0x00
++//-------------------------------------------------------dcu_mon0.pps_passed---
++// dcu0 pps completion indicator
++#define ma_dcu_mon0__pps_passed__a 96
++#define ma_dcu_mon0__pps_passed__len 1
++#define ma_dcu_mon0__pps_passed__mask 0x80
++#define ma_dcu_mon0__pps_passed__shift 0x07
++#define ma_dcu_mon0__pps_passed__reset 0x00
++//----------------------------------------------------------dcu_mon0.ocp_mon---
++// ocp monitor channel 0
++#define ma_dcu_mon0__ocp_mon__a 97
++#define ma_dcu_mon0__ocp_mon__len 1
++#define ma_dcu_mon0__ocp_mon__mask 0x01
++#define ma_dcu_mon0__ocp_mon__shift 0x00
++#define ma_dcu_mon0__ocp_mon__reset 0x00
++//--------------------------------------------------------dcu_mon0.vcfly1_ok---
++// cfly1 protection monitor channel 0.
++#define ma_dcu_mon0__vcfly1_ok__a 97
++#define ma_dcu_mon0__vcfly1_ok__len 1
++#define ma_dcu_mon0__vcfly1_ok__mask 0x02
++#define ma_dcu_mon0__vcfly1_ok__shift 0x01
++#define ma_dcu_mon0__vcfly1_ok__reset 0x00
++//--------------------------------------------------------dcu_mon0.vcfly2_ok---
++// cfly2 protection monitor channel 0.
++#define ma_dcu_mon0__vcfly2_ok__a 97
++#define ma_dcu_mon0__vcfly2_ok__len 1
++#define ma_dcu_mon0__vcfly2_ok__mask 0x04
++#define ma_dcu_mon0__vcfly2_ok__shift 0x02
++#define ma_dcu_mon0__vcfly2_ok__reset 0x00
++//----------------------------------------------------------dcu_mon0.pvdd_ok---
++// dcu0 pvdd monitor
++#define ma_dcu_mon0__pvdd_ok__a 97
++#define ma_dcu_mon0__pvdd_ok__len 1
++#define ma_dcu_mon0__pvdd_ok__mask 0x08
++#define ma_dcu_mon0__pvdd_ok__shift 0x03
++#define ma_dcu_mon0__pvdd_ok__reset 0x00
++//-----------------------------------------------------------dcu_mon0.vdd_ok---
++// dcu0 vdd monitor
++#define ma_dcu_mon0__vdd_ok__a 97
++#define ma_dcu_mon0__vdd_ok__len 1
++#define ma_dcu_mon0__vdd_ok__mask 0x10
++#define ma_dcu_mon0__vdd_ok__shift 0x04
++#define ma_dcu_mon0__vdd_ok__reset 0x00
++//-------------------------------------------------------------dcu_mon0.mute---
++// dcu0 mute monitor
++#define ma_dcu_mon0__mute__a 97
++#define ma_dcu_mon0__mute__len 1
++#define ma_dcu_mon0__mute__mask 0x20
++#define ma_dcu_mon0__mute__shift 0x05
++#define ma_dcu_mon0__mute__reset 0x00
++//------------------------------------------------------------dcu_mon0.m_mon---
++// m sense monitor channel 0
++#define ma_dcu_mon0__m_mon__a 98
++#define ma_dcu_mon0__m_mon__len 8
++#define ma_dcu_mon0__m_mon__mask 0xff
++#define ma_dcu_mon0__m_mon__shift 0x00
++#define ma_dcu_mon0__m_mon__reset 0x00
++//-----------------------------------------------------------dcu_mon1.pm_mon---
++// power mode monitor channel 1
++#define ma_dcu_mon1__pm_mon__a 100
++#define ma_dcu_mon1__pm_mon__len 2
++#define ma_dcu_mon1__pm_mon__mask 0x03
++#define ma_dcu_mon1__pm_mon__shift 0x00
++#define ma_dcu_mon1__pm_mon__reset 0x00
++//-----------------------------------------------------dcu_mon1.freqmode_mon---
++// frequence mode monitor channel 1
++#define ma_dcu_mon1__freqmode_mon__a 100
++#define ma_dcu_mon1__freqmode_mon__len 3
++#define ma_dcu_mon1__freqmode_mon__mask 0x70
++#define ma_dcu_mon1__freqmode_mon__shift 0x04
++#define ma_dcu_mon1__freqmode_mon__reset 0x00
++//-------------------------------------------------------dcu_mon1.pps_passed---
++// dcu1 pps completion indicator
++#define ma_dcu_mon1__pps_passed__a 100
++#define ma_dcu_mon1__pps_passed__len 1
++#define ma_dcu_mon1__pps_passed__mask 0x80
++#define ma_dcu_mon1__pps_passed__shift 0x07
++#define ma_dcu_mon1__pps_passed__reset 0x00
++//----------------------------------------------------------dcu_mon1.ocp_mon---
++// ocp monitor channel 1
++#define ma_dcu_mon1__ocp_mon__a 101
++#define ma_dcu_mon1__ocp_mon__len 1
++#define ma_dcu_mon1__ocp_mon__mask 0x01
++#define ma_dcu_mon1__ocp_mon__shift 0x00
++#define ma_dcu_mon1__ocp_mon__reset 0x00
++//--------------------------------------------------------dcu_mon1.vcfly1_ok---
++// cfly1 protcetion monitor channel 1
++#define ma_dcu_mon1__vcfly1_ok__a 101
++#define ma_dcu_mon1__vcfly1_ok__len 1
++#define ma_dcu_mon1__vcfly1_ok__mask 0x02
++#define ma_dcu_mon1__vcfly1_ok__shift 0x01
++#define ma_dcu_mon1__vcfly1_ok__reset 0x00
++//--------------------------------------------------------dcu_mon1.vcfly2_ok---
++// cfly2 protection monitor channel 1
++#define ma_dcu_mon1__vcfly2_ok__a 101
++#define ma_dcu_mon1__vcfly2_ok__len 1
++#define ma_dcu_mon1__vcfly2_ok__mask 0x04
++#define ma_dcu_mon1__vcfly2_ok__shift 0x02
++#define ma_dcu_mon1__vcfly2_ok__reset 0x00
++//----------------------------------------------------------dcu_mon1.pvdd_ok---
++// dcu1 pvdd monitor
++#define ma_dcu_mon1__pvdd_ok__a 101
++#define ma_dcu_mon1__pvdd_ok__len 1
++#define ma_dcu_mon1__pvdd_ok__mask 0x08
++#define ma_dcu_mon1__pvdd_ok__shift 0x03
++#define ma_dcu_mon1__pvdd_ok__reset 0x00
++//-----------------------------------------------------------dcu_mon1.vdd_ok---
++// dcu1 vdd monitor
++#define ma_dcu_mon1__vdd_ok__a 101
++#define ma_dcu_mon1__vdd_ok__len 1
++#define ma_dcu_mon1__vdd_ok__mask 0x10
++#define ma_dcu_mon1__vdd_ok__shift 0x04
++#define ma_dcu_mon1__vdd_ok__reset 0x00
++//-------------------------------------------------------------dcu_mon1.mute---
++// dcu1 mute monitor
++#define ma_dcu_mon1__mute__a 101
++#define ma_dcu_mon1__mute__len 1
++#define ma_dcu_mon1__mute__mask 0x20
++#define ma_dcu_mon1__mute__shift 0x05
++#define ma_dcu_mon1__mute__reset 0x00
++//------------------------------------------------------------dcu_mon1.m_mon---
++// m sense monitor channel 1
++#define ma_dcu_mon1__m_mon__a 102
++#define ma_dcu_mon1__m_mon__len 8
++#define ma_dcu_mon1__m_mon__mask 0xff
++#define ma_dcu_mon1__m_mon__shift 0x00
++#define ma_dcu_mon1__m_mon__reset 0x00
++//--------------------------------------------------------dcu_mon0.sw_enable---
++// dcu0 switch enable monitor
++#define ma_dcu_mon0__sw_enable__a 104
++#define ma_dcu_mon0__sw_enable__len 1
++#define ma_dcu_mon0__sw_enable__mask 0x40
++#define ma_dcu_mon0__sw_enable__shift 0x06
++#define ma_dcu_mon0__sw_enable__reset 0x00
++//--------------------------------------------------------dcu_mon1.sw_enable---
++// dcu1 switch enable monitor
++#define ma_dcu_mon1__sw_enable__a 104
++#define ma_dcu_mon1__sw_enable__len 1
++#define ma_dcu_mon1__sw_enable__mask 0x80
++#define ma_dcu_mon1__sw_enable__shift 0x07
++#define ma_dcu_mon1__sw_enable__reset 0x00
++//------------------------------------------------------------hvboot0_ok_mon---
++// hvboot0_ok for test/debug
++#define ma_hvboot0_ok_mon__a 105
++#define ma_hvboot0_ok_mon__len 1
++#define ma_hvboot0_ok_mon__mask 0x40
++#define ma_hvboot0_ok_mon__shift 0x06
++#define ma_hvboot0_ok_mon__reset 0x00
++//------------------------------------------------------------hvboot1_ok_mon---
++// hvboot1_ok for test/debug
++#define ma_hvboot1_ok_mon__a 105
++#define ma_hvboot1_ok_mon__len 1
++#define ma_hvboot1_ok_mon__mask 0x80
++#define ma_hvboot1_ok_mon__shift 0x07
++#define ma_hvboot1_ok_mon__reset 0x00
++//-----------------------------------------------------------------error_acc---
++// accumulated errors,  at and after triggering
++#define ma_error_acc__a 109
++#define ma_error_acc__len 8
++#define ma_error_acc__mask 0xff
++#define ma_error_acc__shift 0x00
++#define ma_error_acc__reset 0x00
++//-------------------------------------------------------------i2s_data_rate---
++// detected i2s data rate: 00/01/10 = x1/x2/x4
++#define ma_i2s_data_rate__a 116
++#define ma_i2s_data_rate__len 2
++#define ma_i2s_data_rate__mask 0x03
++#define ma_i2s_data_rate__shift 0x00
++#define ma_i2s_data_rate__reset 0x00
++//---------------------------------------------------------audio_in_mode_mon---
++// audio input mode monitor
++#define ma_audio_in_mode_mon__a 116
++#define ma_audio_in_mode_mon__len 3
++#define ma_audio_in_mode_mon__mask 0x1c
++#define ma_audio_in_mode_mon__shift 0x02
++#define ma_audio_in_mode_mon__reset 0x00
++//------------------------------------------------------------------msel_mon---
++// msel[2:0] monitor register
++#define ma_msel_mon__a 117
++#define ma_msel_mon__len 3
++#define ma_msel_mon__mask 0x07
++#define ma_msel_mon__shift 0x00
++#define ma_msel_mon__reset 0x00
++//---------------------------------------------------------------------error---
++// current error flag monitor reg - for app. ctrl.
++#define ma_error__a 124
++#define ma_error__len 8
++#define ma_error__mask 0xff
++#define ma_error__shift 0x00
++#define ma_error__reset 0x00
++//----------------------------------------------------audio_proc_limiter_mon---
++// b7-b4: channel 3-0 limiter active
++#define ma_audio_proc_limiter_mon__a 126
++#define ma_audio_proc_limiter_mon__len 4
++#define ma_audio_proc_limiter_mon__mask 0xf0
++#define ma_audio_proc_limiter_mon__shift 0x04
++#define ma_audio_proc_limiter_mon__reset 0x00
++//-------------------------------------------------------audio_proc_clip_mon---
++// b3-b0: channel 3-0 clipping monitor
++#define ma_audio_proc_clip_mon__a 126
++#define ma_audio_proc_clip_mon__len 4
++#define ma_audio_proc_clip_mon__mask 0x0f
++#define ma_audio_proc_clip_mon__shift 0x00
++#define ma_audio_proc_clip_mon__reset 0x00
++#endif
++
++#define SOC_ENUM_ERR(xname, xenum)\
++{	.iface = SNDRV_CTL_ELEM_IFACE_MIXER, .name = (xname),\
++	.access = SNDRV_CTL_ELEM_ACCESS_READ,\
++	.info = snd_soc_info_enum_double,\
++	.get = snd_soc_get_enum_double, .put = snd_soc_put_enum_double,\
++	.private_value = (unsigned long)&(xenum) }
++
++static struct i2c_client *i2c;
++
++struct ma120x0p_priv {
++	struct regmap *regmap;
++	int mclk_div;
++	struct snd_soc_component *component;
++	struct gpio_desc *enable_gpio;
++	struct gpio_desc *mute_gpio;
++	struct gpio_desc *booster_gpio;
++	struct gpio_desc *error_gpio;
++};
++
++static struct ma120x0p_priv *priv_data;
++
++//Used to share the IRQ number within this file
++static unsigned int irqNumber;
++
++// Function prototype for the custom IRQ handler function
++static irqreturn_t ma120x0p_irq_handler(int irq, void *data);
++
++//Alsa Controls
++static const char * const limenable_text[] = {"Bypassed", "Enabled"};
++static const char * const limatack_text[] = {"Slow", "Normal", "Fast"};
++static const char * const limrelease_text[] = {"Slow", "Normal", "Fast"};
++
++static const char * const err_flycap_text[] = {"Ok", "Error"};
++static const char * const err_overcurr_text[] = {"Ok", "Error"};
++static const char * const err_pllerr_text[] = {"Ok", "Error"};
++static const char * const err_pvddunder_text[] = {"Ok", "Error"};
++static const char * const err_overtempw_text[] = {"Ok", "Error"};
++static const char * const err_overtempe_text[] = {"Ok", "Error"};
++static const char * const err_pinlowimp_text[] = {"Ok", "Error"};
++static const char * const err_dcprot_text[] = {"Ok", "Error"};
++
++static const char * const pwr_mode_prof_text[] = {"PMF0", "PMF1", "PMF2",
++"PMF3", "PMF4"};
++
++static const struct soc_enum lim_enable_ctrl =
++	SOC_ENUM_SINGLE(ma_audio_proc_limiterenable__a,
++		ma_audio_proc_limiterenable__shift,
++		ma_audio_proc_limiterenable__len + 1,
++		limenable_text);
++static const struct soc_enum limatack_ctrl =
++	SOC_ENUM_SINGLE(ma_audio_proc_attack__a,
++		ma_audio_proc_attack__shift,
++		ma_audio_proc_attack__len + 1,
++		limatack_text);
++static const struct soc_enum limrelease_ctrl =
++	SOC_ENUM_SINGLE(ma_audio_proc_release__a,
++		ma_audio_proc_release__shift,
++		ma_audio_proc_release__len + 1,
++		limrelease_text);
++static const struct soc_enum err_flycap_ctrl =
++	SOC_ENUM_SINGLE(ma_error__a, 0, 3, err_flycap_text);
++static const struct soc_enum err_overcurr_ctrl =
++	SOC_ENUM_SINGLE(ma_error__a, 1, 3, err_overcurr_text);
++static const struct soc_enum err_pllerr_ctrl =
++	SOC_ENUM_SINGLE(ma_error__a, 2, 3, err_pllerr_text);
++static const struct soc_enum err_pvddunder_ctrl =
++	SOC_ENUM_SINGLE(ma_error__a, 3, 3, err_pvddunder_text);
++static const struct soc_enum err_overtempw_ctrl =
++	SOC_ENUM_SINGLE(ma_error__a, 4, 3, err_overtempw_text);
++static const struct soc_enum err_overtempe_ctrl =
++	SOC_ENUM_SINGLE(ma_error__a, 5, 3, err_overtempe_text);
++static const struct soc_enum err_pinlowimp_ctrl =
++	SOC_ENUM_SINGLE(ma_error__a, 6, 3, err_pinlowimp_text);
++static const struct soc_enum err_dcprot_ctrl =
++	SOC_ENUM_SINGLE(ma_error__a, 7, 3, err_dcprot_text);
++static const struct soc_enum pwr_mode_prof_ctrl =
++	SOC_ENUM_SINGLE(ma_pmprofile__a, ma_pmprofile__shift, 5,
++		pwr_mode_prof_text);
++
++static const char * const pwr_mode_texts[] = {
++		"Dynamic power mode",
++		"Power mode 1",
++		"Power mode 2",
++		"Power mode 3",
++	};
++
++static const int pwr_mode_values[] = {
++		0x10,
++		0x50,
++		0x60,
++		0x70,
++	};
++
++static SOC_VALUE_ENUM_SINGLE_DECL(pwr_mode_ctrl,
++	ma_pm_man__a, 0, 0x70,
++	pwr_mode_texts,
++	pwr_mode_values);
++
++static const DECLARE_TLV_DB_SCALE(ma120x0p_vol_tlv, -14400, 100,  0);
++static const DECLARE_TLV_DB_SCALE(ma120x0p_lim_tlv, -5000, 100,  0);
++static const DECLARE_TLV_DB_SCALE(ma120x0p_lr_tlv, -5000, 100,  0);
++
++static const struct snd_kcontrol_new ma120x0p_snd_controls[] = {
++	//Master Volume
++	SOC_SINGLE_RANGE_TLV("A.Mstr Vol Volume",
++		ma_vol_db_master__a, 0, 0x18, 0xa8, 1, ma120x0p_vol_tlv),
++
++	//L-R Volume ch0
++	SOC_SINGLE_RANGE_TLV("B.L Vol Volume",
++		ma_vol_db_ch0__a, 0, 0x18, 0x4a, 1, ma120x0p_lr_tlv),
++	SOC_SINGLE_RANGE_TLV("C.R Vol Volume",
++		ma_vol_db_ch1__a, 0, 0x18, 0x4a, 1, ma120x0p_lr_tlv),
++
++	//L-R Limiter Threshold ch0-ch1
++	SOC_DOUBLE_R_RANGE_TLV("D.Lim thresh Volume",
++		ma_thr_db_ch0__a, ma_thr_db_ch1__a, 0, 0x0e, 0x4a, 1,
++		ma120x0p_lim_tlv),
++
++	//Enum Switches/Selectors
++	//SOC_ENUM("E.AudioProc Mute", audioproc_mute_ctrl),
++	SOC_ENUM("F.Limiter Enable", lim_enable_ctrl),
++	SOC_ENUM("G.Limiter Attck", limatack_ctrl),
++	SOC_ENUM("H.Limiter Rls", limrelease_ctrl),
++
++	//Enum Error Monitor (read-only)
++	SOC_ENUM_ERR("I.Err flycap", err_flycap_ctrl),
++	SOC_ENUM_ERR("J.Err overcurr", err_overcurr_ctrl),
++	SOC_ENUM_ERR("K.Err pllerr", err_pllerr_ctrl),
++	SOC_ENUM_ERR("L.Err pvddunder", err_pvddunder_ctrl),
++	SOC_ENUM_ERR("M.Err overtempw", err_overtempw_ctrl),
++	SOC_ENUM_ERR("N.Err overtempe", err_overtempe_ctrl),
++	SOC_ENUM_ERR("O.Err pinlowimp", err_pinlowimp_ctrl),
++	SOC_ENUM_ERR("P.Err dcprot", err_dcprot_ctrl),
++
++	//Power modes profiles
++	SOC_ENUM("Q.PM Prof", pwr_mode_prof_ctrl),
++
++	// Power mode selection (Dynamic,1,2,3)
++	SOC_ENUM("R.Power Mode", pwr_mode_ctrl),
++};
++
++//Machine Driver
++static int ma120x0p_hw_params(struct snd_pcm_substream *substream,
++	struct snd_pcm_hw_params *params, struct snd_soc_dai *dai)
++{
++	u16 blen = 0x00;
++
++	struct snd_soc_component *component = dai->component;
++
++	priv_data->component = component;
++
++	switch (params_format(params)) {
++	case SNDRV_PCM_FORMAT_S16_LE:
++		blen = 0x10;
++		break;
++	case SNDRV_PCM_FORMAT_S24_LE:
++		blen = 0x00;
++		break;
++	case SNDRV_PCM_FORMAT_S32_LE:
++		blen = 0x00;
++		break;
++	default:
++		dev_err(dai->dev, "Unsupported word length: %u\n",
++		params_format(params));
++		return -EINVAL;
++	}
++
++	// set word length
++	snd_soc_component_update_bits(component, ma_i2s_framesize__a,
++		ma_i2s_framesize__mask, blen);
++
++	return 0;
++}
++
++static int ma120x0p_mute_stream(struct snd_soc_dai *dai, int mute, int stream)
++{
++	int val = 0;
++
++	struct ma120x0p_priv *ma120x0p;
++
++	struct snd_soc_component *component = dai->component;
++
++	ma120x0p = snd_soc_component_get_drvdata(component);
++
++	if (mute)
++		val = 0;
++	else
++		val = 1;
++
++	gpiod_set_value_cansleep(priv_data->mute_gpio, val);
++
++	return 0;
++}
++
++static const struct snd_soc_dai_ops ma120x0p_dai_ops = {
++	.hw_params		=	ma120x0p_hw_params,
++	.mute_stream	=	ma120x0p_mute_stream,
++};
++
++static struct snd_soc_dai_driver ma120x0p_dai = {
++	.name		= "ma120x0p-amp",
++	.playback	=	{
++		.stream_name	= "Playback",
++		.channels_min	= 2,
++		.channels_max	= 2,
++		.rates = SNDRV_PCM_RATE_CONTINUOUS,
++		.rate_min = 44100,
++		.rate_max = 192000,
++		.formats = SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S32_LE
++	},
++	.ops        = &ma120x0p_dai_ops,
++};
++
++//Codec Driver
++static int ma120x0p_clear_err(struct snd_soc_component *component)
++{
++	int ret = 0;
++
++	struct ma120x0p_priv *ma120x0p;
++
++	ma120x0p = snd_soc_component_get_drvdata(component);
++
++	ret = snd_soc_component_update_bits(component,
++		ma_eh_clear__a, ma_eh_clear__mask, 0x00);
++	if (ret < 0)
++		return ret;
++
++	ret = snd_soc_component_update_bits(component,
++		ma_eh_clear__a, ma_eh_clear__mask, 0x04);
++	if (ret < 0)
++		return ret;
++
++	ret = snd_soc_component_update_bits(component,
++		ma_eh_clear__a, ma_eh_clear__mask, 0x00);
++	if (ret < 0)
++		return ret;
++
++	return 0;
++}
++
++static void ma120x0p_remove(struct snd_soc_component *component)
++{
++	struct ma120x0p_priv *ma120x0p;
++
++	ma120x0p = snd_soc_component_get_drvdata(component);
++}
++
++static int ma120x0p_probe(struct snd_soc_component *component)
++{
++	struct ma120x0p_priv *ma120x0p;
++
++	int ret = 0;
++
++	i2c = container_of(component->dev, struct i2c_client, dev);
++
++	ma120x0p = snd_soc_component_get_drvdata(component);
++
++	//Reset error
++	ma120x0p_clear_err(component);
++	if (ret < 0)
++		return ret;
++
++	// set serial audio format I2S and enable audio processor
++	ret = snd_soc_component_write(component, ma_i2s_format__a, 0x08);
++	if (ret < 0)
++		return ret;
++
++	// Enable audio limiter
++	ret = snd_soc_component_update_bits(component,
++		ma_audio_proc_limiterenable__a,
++		ma_audio_proc_limiterenable__mask, 0x40);
++	if (ret < 0)
++		return ret;
++
++	// Set lim attack to fast
++	ret = snd_soc_component_update_bits(component,
++		ma_audio_proc_attack__a, ma_audio_proc_attack__mask, 0x80);
++	if (ret < 0)
++		return ret;
++
++	// Set lim attack to low
++	ret = snd_soc_component_update_bits(component,
++		ma_audio_proc_release__a, ma_audio_proc_release__mask, 0x00);
++	if (ret < 0)
++		return ret;
++
++	// set volume to 0dB
++	ret = snd_soc_component_write(component, ma_vol_db_master__a, 0x18);
++	if (ret < 0)
++		return ret;
++
++	// set ch0 lim thresh to -15dB
++	ret = snd_soc_component_write(component, ma_thr_db_ch0__a, 0x27);
++	if (ret < 0)
++		return ret;
++
++	// set ch1 lim thresh to -15dB
++	ret = snd_soc_component_write(component, ma_thr_db_ch1__a, 0x27);
++	if (ret < 0)
++		return ret;
++
++	//Check for errors
++	ret = snd_soc_component_test_bits(component, ma_error_acc__a, 0x00, 0);
++	if (ret < 0)
++		return ret;
++	ret = snd_soc_component_test_bits(component, ma_error_acc__a, 0x01, 0);
++	if (ret < 0)
++		return ret;
++	ret = snd_soc_component_test_bits(component, ma_error_acc__a, 0x02, 0);
++	if (ret < 0)
++		return ret;
++	ret = snd_soc_component_test_bits(component, ma_error_acc__a, 0x08, 0);
++	if (ret < 0)
++		return ret;
++	ret = snd_soc_component_test_bits(component, ma_error_acc__a, 0x10, 0);
++	if (ret < 0)
++		return ret;
++	ret = snd_soc_component_test_bits(component, ma_error_acc__a, 0x20, 0);
++	if (ret < 0)
++		return ret;
++	ret = snd_soc_component_test_bits(component, ma_error_acc__a, 0x40, 0);
++	if (ret < 0)
++		return ret;
++	ret = snd_soc_component_test_bits(component, ma_error_acc__a, 0x80, 0);
++	if (ret < 0)
++		return ret;
++
++	return 0;
++}
++
++static int ma120x0p_set_bias_level(struct snd_soc_component *component,
++	enum snd_soc_bias_level level)
++{
++	int ret = 0;
++
++	struct ma120x0p_priv *ma120x0p;
++
++	ma120x0p = snd_soc_component_get_drvdata(component);
++
++	switch (level) {
++	case SND_SOC_BIAS_ON:
++		break;
++
++	case SND_SOC_BIAS_PREPARE:
++		break;
++
++	case SND_SOC_BIAS_STANDBY:
++		ret = gpiod_get_value_cansleep(priv_data->enable_gpio);
++		if (ret != 0) {
++			dev_err(component->dev, "Device ma120x0p disabled in STANDBY BIAS: %d\n",
++			ret);
++			return ret;
++		}
++		break;
++
++	case SND_SOC_BIAS_OFF:
++		break;
++	}
++
++	return 0;
++}
++
++static const struct snd_soc_dapm_widget ma120x0p_dapm_widgets[] = {
++	SND_SOC_DAPM_OUTPUT("OUT_A"),
++	SND_SOC_DAPM_OUTPUT("OUT_B"),
++};
++
++static const struct snd_soc_dapm_route ma120x0p_dapm_routes[] = {
++	{ "OUT_B",  NULL, "Playback" },
++	{ "OUT_A",  NULL, "Playback" },
++};
++
++static const struct snd_soc_component_driver ma120x0p_component_driver = {
++	.probe = ma120x0p_probe,
++	.remove = ma120x0p_remove,
++	.set_bias_level = ma120x0p_set_bias_level,
++	.dapm_widgets		= ma120x0p_dapm_widgets,
++	.num_dapm_widgets	= ARRAY_SIZE(ma120x0p_dapm_widgets),
++	.dapm_routes		= ma120x0p_dapm_routes,
++	.num_dapm_routes	= ARRAY_SIZE(ma120x0p_dapm_routes),
++	.controls = ma120x0p_snd_controls,
++	.num_controls = ARRAY_SIZE(ma120x0p_snd_controls),
++	.use_pmdown_time	= 1,
++	.endianness		= 1,
++};
++
++//I2C Driver
++static const struct reg_default ma120x0p_reg_defaults[] = {
++	{	0x01,	0x3c	},
++};
++
++static bool ma120x0p_reg_volatile(struct device *dev, unsigned int reg)
++{
++	switch (reg) {
++	case ma_error__a:
++			return true;
++	default:
++			return false;
++	}
++}
++
++static const struct of_device_id ma120x0p_of_match[] = {
++	{ .compatible = "ma,ma120x0p", },
++	{ }
++};
++
++MODULE_DEVICE_TABLE(of, ma120x0p_of_match);
++
++static struct regmap_config ma120x0p_regmap_config = {
++	.reg_bits = 8,
++	.val_bits = 8,
++
++	.max_register = 255,
++	.volatile_reg = ma120x0p_reg_volatile,
++
++	.cache_type = REGCACHE_RBTREE,
++	.reg_defaults = ma120x0p_reg_defaults,
++	.num_reg_defaults = ARRAY_SIZE(ma120x0p_reg_defaults),
++};
++
++static int ma120x0p_i2c_probe(struct i2c_client *i2c)
++{
++	int ret;
++
++	priv_data = devm_kzalloc(&i2c->dev, sizeof(*priv_data), GFP_KERNEL);
++	if (!priv_data)
++		return -ENOMEM;
++	i2c_set_clientdata(i2c, priv_data);
++
++	priv_data->regmap = devm_regmap_init_i2c(i2c, &ma120x0p_regmap_config);
++	if (IS_ERR(priv_data->regmap)) {
++		ret = PTR_ERR(priv_data->regmap);
++		return ret;
++	}
++
++	//Startup sequence
++
++	//Make sure the device is muted
++	priv_data->mute_gpio = devm_gpiod_get_optional(&i2c->dev, "mute_gp",
++		GPIOD_OUT_LOW);
++	if (IS_ERR(priv_data->mute_gpio)) {
++		ret = PTR_ERR(priv_data->mute_gpio);
++		dev_err(&i2c->dev, "Failed to get mute gpio line: %d\n", ret);
++		return ret;
++	}
++	msleep(50);
++
++// MA120xx0P devices are usually powered by an integrated boost converter.
++// An option GPIO control line is provided to enable the booster properly and
++// in sync with the enable and mute GPIO lines.
++	priv_data->booster_gpio = devm_gpiod_get_optional(&i2c->dev,
++		"booster_gp", GPIOD_OUT_LOW);
++	if (IS_ERR(priv_data->booster_gpio)) {
++		ret = PTR_ERR(priv_data->booster_gpio);
++		dev_err(&i2c->dev,
++		"Failed to get booster enable gpio line: %d\n", ret);
++		return ret;
++	}
++	msleep(50);
++
++	//Enable booster and wait 200ms until stable PVDD
++	gpiod_set_value_cansleep(priv_data->booster_gpio, 1);
++	msleep(200);
++
++	//Enable ma120x0pp
++	priv_data->enable_gpio = devm_gpiod_get_optional(&i2c->dev,
++		"enable_gp", GPIOD_OUT_LOW);
++	if (IS_ERR(priv_data->enable_gpio)) {
++		ret = PTR_ERR(priv_data->enable_gpio);
++		dev_err(&i2c->dev,
++		"Failed to get ma120x0p enable gpio line: %d\n", ret);
++		return ret;
++	}
++	msleep(50);
++
++	//Optional use of ma120x0pp error line as an interrupt trigger to
++	//platform GPIO.
++	//Get error input gpio ma120x0p
++	priv_data->error_gpio = devm_gpiod_get_optional(&i2c->dev,
++		 "error_gp", GPIOD_IN);
++	if (IS_ERR(priv_data->error_gpio)) {
++		ret = PTR_ERR(priv_data->error_gpio);
++		dev_err(&i2c->dev,
++			"Failed to get ma120x0p error gpio line: %d\n", ret);
++		return ret;
++	}
++
++	if (priv_data->error_gpio != NULL) {
++		irqNumber = gpiod_to_irq(priv_data->error_gpio);
++
++		ret = devm_request_threaded_irq(&i2c->dev,
++			 irqNumber, ma120x0p_irq_handler,
++			 NULL, IRQF_TRIGGER_FALLING,
++			 "ma120x0p", priv_data);
++		if (ret != 0)
++			dev_warn(&i2c->dev, "Failed to request IRQ: %d\n",
++				ret);
++	}
++
++	ret = devm_snd_soc_register_component(&i2c->dev,
++		&ma120x0p_component_driver, &ma120x0p_dai, 1);
++
++	return ret;
++}
++
++static irqreturn_t ma120x0p_irq_handler(int irq, void *data)
++{
++	gpiod_set_value_cansleep(priv_data->mute_gpio, 0);
++	gpiod_set_value_cansleep(priv_data->enable_gpio, 1);
++	return IRQ_HANDLED;
++}
++
++static void ma120x0p_i2c_remove(struct i2c_client *i2c)
++{
++	snd_soc_unregister_component(&i2c->dev);
++	i2c_set_clientdata(i2c, NULL);
++
++	gpiod_set_value_cansleep(priv_data->mute_gpio, 0);
++	msleep(30);
++	gpiod_set_value_cansleep(priv_data->enable_gpio, 1);
++	msleep(200);
++	gpiod_set_value_cansleep(priv_data->booster_gpio, 0);
++	msleep(200);
++
++	kfree(priv_data);
++}
++
++static void ma120x0p_i2c_shutdown(struct i2c_client *i2c)
++{
++	snd_soc_unregister_component(&i2c->dev);
++	i2c_set_clientdata(i2c, NULL);
++
++	gpiod_set_value_cansleep(priv_data->mute_gpio, 0);
++	msleep(30);
++	gpiod_set_value_cansleep(priv_data->enable_gpio, 1);
++	msleep(200);
++	gpiod_set_value_cansleep(priv_data->booster_gpio, 0);
++	msleep(200);
++
++	kfree(priv_data);
++}
++
++static const struct i2c_device_id ma120x0p_i2c_id[] = {
++	{ "ma120x0p", 0 },
++	{ }
++};
++
++MODULE_DEVICE_TABLE(i2c, ma120x0p_i2c_id);
++
++static struct i2c_driver ma120x0p_i2c_driver = {
++	.driver = {
++		.name = "ma120x0p",
++		.owner = THIS_MODULE,
++		.of_match_table = ma120x0p_of_match,
++	},
++	.probe = ma120x0p_i2c_probe,
++	.remove = ma120x0p_i2c_remove,
++	.shutdown = ma120x0p_i2c_shutdown,
++	.id_table = ma120x0p_i2c_id
++};
++
++static int __init ma120x0p_modinit(void)
++{
++	int ret = 0;
++
++	ret = i2c_add_driver(&ma120x0p_i2c_driver);
++	if (ret != 0) {
++		pr_err("Failed to register MA120X0P I2C driver: %d\n", ret);
++		return ret;
++	}
++	return ret;
++}
++module_init(ma120x0p_modinit);
++
++static void __exit ma120x0p_exit(void)
++{
++	i2c_del_driver(&ma120x0p_i2c_driver);
++}
++module_exit(ma120x0p_exit);
++
++MODULE_AUTHOR("Ariel Muszkat ariel.muszkat@gmail.com>");
++MODULE_DESCRIPTION("ASoC driver for ma120x0p");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/codecs/pcm1794a.c
+@@ -0,0 +1,68 @@
++/*
++ * Driver for the PCM1794A codec
++ *
++ * Author:	Florian Meier <florian.meier@koalo.de>
++ *		Copyright 2013
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++
++#include <sound/soc.h>
++
++static struct snd_soc_dai_driver pcm1794a_dai = {
++	.name = "pcm1794a-hifi",
++	.playback = {
++		.channels_min = 2,
++		.channels_max = 2,
++		.rates = SNDRV_PCM_RATE_8000_192000,
++		.formats = SNDRV_PCM_FMTBIT_S16_LE |
++			   SNDRV_PCM_FMTBIT_S24_LE
++	},
++};
++
++static struct snd_soc_component_driver soc_component_dev_pcm1794a;
++
++static int pcm1794a_probe(struct platform_device *pdev)
++{
++	return snd_soc_register_component(&pdev->dev, &soc_component_dev_pcm1794a,
++			&pcm1794a_dai, 1);
++}
++
++static void pcm1794a_remove(struct platform_device *pdev)
++{
++	snd_soc_unregister_component(&pdev->dev);
++}
++
++static const struct of_device_id pcm1794a_of_match[] = {
++	{ .compatible = "ti,pcm1794a", },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, pcm1794a_of_match);
++
++static struct platform_driver pcm1794a_component_driver = {
++	.probe 		= pcm1794a_probe,
++	.remove 	= pcm1794a_remove,
++	.driver		= {
++		.name	= "pcm1794a-codec",
++		.owner	= THIS_MODULE,
++		.of_match_table = of_match_ptr(pcm1794a_of_match),
++	},
++};
++
++module_platform_driver(pcm1794a_component_driver);
++
++MODULE_DESCRIPTION("ASoC PCM1794A codec driver");
++MODULE_AUTHOR("Florian Meier <florian.meier@koalo.de>");
++MODULE_LICENSE("GPL v2");
+--- a/sound/soc/codecs/pcm512x.c
++++ b/sound/soc/codecs/pcm512x.c
+@@ -537,7 +537,7 @@ static unsigned long pcm512x_ncp_target(
+ 
+ static const u32 pcm512x_dai_rates[] = {
+ 	8000, 11025, 16000, 22050, 32000, 44100, 48000, 64000,
+-	88200, 96000, 176400, 192000, 384000,
++	88200, 96000, 176400, 192000, 352800, 384000,
+ };
+ 
+ static const struct snd_pcm_hw_constraint_list constraints_slave = {
+--- /dev/null
++++ b/sound/soc/codecs/tas5713.c
+@@ -0,0 +1,360 @@
++/*
++ * ASoC Driver for TAS5713
++ *
++ * Author:	Sebastian Eickhoff <basti.eickhoff@googlemail.com>
++ *		Copyright 2014
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#include <linux/module.h>
++#include <linux/moduleparam.h>
++#include <linux/init.h>
++#include <linux/delay.h>
++#include <linux/pm.h>
++#include <linux/i2c.h>
++#include <linux/of_device.h>
++#include <linux/spi/spi.h>
++#include <linux/regmap.h>
++#include <linux/regulator/consumer.h>
++#include <linux/slab.h>
++#include <sound/core.h>
++#include <sound/pcm.h>
++#include <sound/pcm_params.h>
++#include <sound/soc.h>
++#include <sound/initval.h>
++#include <sound/tlv.h>
++
++#include <linux/kernel.h>
++#include <linux/string.h>
++#include <linux/fs.h>
++#include <asm/uaccess.h>
++
++#include "tas5713.h"
++
++
++static struct i2c_client *i2c;
++
++struct tas5713_priv {
++	struct regmap *regmap;
++	int mclk_div;
++	struct snd_soc_component *component;
++};
++
++static struct tas5713_priv *priv_data;
++
++
++
++
++/*
++ *    _   _    ___   _      ___         _           _
++ *   /_\ | |  / __| /_\    / __|___ _ _| |_ _ _ ___| |___
++ *  / _ \| |__\__ \/ _ \  | (__/ _ \ ' \  _| '_/ _ \ (_-<
++ * /_/ \_\____|___/_/ \_\  \___\___/_||_\__|_| \___/_/__/
++ *
++ */
++
++static const DECLARE_TLV_DB_SCALE(tas5713_vol_tlv, -10000, 50, 1);
++
++
++static const struct snd_kcontrol_new tas5713_snd_controls[] = {
++	SOC_SINGLE_TLV  ("Master"    , TAS5713_VOL_MASTER, 0, 248, 1, tas5713_vol_tlv),
++	SOC_DOUBLE_R_TLV("Channels"  , TAS5713_VOL_CH1, TAS5713_VOL_CH2, 0, 248, 1, tas5713_vol_tlv)
++};
++
++
++
++
++/*
++ *  __  __         _    _            ___      _
++ * |  \/  |__ _ __| |_ (_)_ _  ___  |   \ _ _(_)_ _____ _ _
++ * | |\/| / _` / _| ' \| | ' \/ -_) | |) | '_| \ V / -_) '_|
++ * |_|  |_\__,_\__|_||_|_|_||_\___| |___/|_| |_|\_/\___|_|
++ *
++ */
++
++static int tas5713_hw_params(struct snd_pcm_substream *substream,
++			    struct snd_pcm_hw_params *params,
++			    struct snd_soc_dai *dai)
++{
++	u16 blen = 0x00;
++
++	struct snd_soc_component *component = dai->component;
++	priv_data->component = component;
++
++	switch (params_format(params)) {
++	case SNDRV_PCM_FORMAT_S16_LE:
++		blen = 0x03;
++		break;
++	case SNDRV_PCM_FORMAT_S20_3LE:
++		blen = 0x1;
++		break;
++	case SNDRV_PCM_FORMAT_S24_LE:
++		blen = 0x04;
++		break;
++	case SNDRV_PCM_FORMAT_S32_LE:
++		blen = 0x05;
++		break;
++	default:
++		dev_err(dai->dev, "Unsupported word length: %u\n",
++			params_format(params));
++		return -EINVAL;
++	}
++
++	// set word length
++	snd_soc_component_update_bits(component, TAS5713_SERIAL_DATA_INTERFACE, 0x7, blen);
++
++	return 0;
++}
++
++
++static int tas5713_mute_stream(struct snd_soc_dai *dai, int mute, int stream)
++{
++	unsigned int val = 0;
++
++	struct tas5713_priv *tas5713;
++	struct snd_soc_component *component = dai->component;
++	tas5713 = snd_soc_component_get_drvdata(component);
++
++	if (mute) {
++		val = TAS5713_SOFT_MUTE_ALL;
++	}
++
++	return regmap_write(tas5713->regmap, TAS5713_SOFT_MUTE, val);
++}
++
++
++static const struct snd_soc_dai_ops tas5713_dai_ops = {
++	.hw_params 		= tas5713_hw_params,
++	.mute_stream	= tas5713_mute_stream,
++};
++
++
++static struct snd_soc_dai_driver tas5713_dai = {
++	.name		= "tas5713-hifi",
++	.playback 	= {
++		.stream_name	= "Playback",
++		.channels_min	= 2,
++		.channels_max	= 2,
++		.rates		    = SNDRV_PCM_RATE_8000_48000,
++		.formats	    = (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S32_LE ),
++	},
++	.ops        = &tas5713_dai_ops,
++};
++
++
++
++
++/*
++ *   ___         _          ___      _
++ *  / __|___  __| |___ __  |   \ _ _(_)_ _____ _ _
++ * | (__/ _ \/ _` / -_) _| | |) | '_| \ V / -_) '_|
++ *  \___\___/\__,_\___\__| |___/|_| |_|\_/\___|_|
++ *
++ */
++
++static void tas5713_remove(struct snd_soc_component *component)
++{
++	struct tas5713_priv *tas5713;
++
++	tas5713 = snd_soc_component_get_drvdata(component);
++}
++
++
++static int tas5713_probe(struct snd_soc_component *component)
++{
++	struct tas5713_priv *tas5713;
++	int i, ret;
++
++	i2c = container_of(component->dev, struct i2c_client, dev);
++
++	tas5713 = snd_soc_component_get_drvdata(component);
++
++	// Reset error
++	ret = snd_soc_component_write(component, TAS5713_ERROR_STATUS, 0x00);
++	if (ret < 0) return ret;
++
++	// Trim oscillator
++	ret = snd_soc_component_write(component, TAS5713_OSC_TRIM, 0x00);
++	if (ret < 0) return ret;
++	msleep(1000);
++
++	// Reset error
++	ret = snd_soc_component_write(component, TAS5713_ERROR_STATUS, 0x00);
++	if (ret < 0) return ret;
++
++	// I2S 24bit
++	ret = snd_soc_component_write(component, TAS5713_SERIAL_DATA_INTERFACE, 0x05);
++	if (ret < 0) return ret;
++
++	// Unmute
++	ret = snd_soc_component_write(component, TAS5713_SYSTEM_CTRL2, 0x00);
++	if (ret < 0) return ret;
++	ret = snd_soc_component_write(component, TAS5713_SOFT_MUTE, 0x00);
++	if (ret < 0) return ret;
++
++	// Set volume to 0db
++	ret = snd_soc_component_write(component, TAS5713_VOL_MASTER, 0x00);
++	if (ret < 0) return ret;
++
++	// Now start programming the default initialization sequence
++	for (i = 0; i < ARRAY_SIZE(tas5713_init_sequence); ++i) {
++		ret = i2c_master_send(i2c,
++				     tas5713_init_sequence[i].data,
++				     tas5713_init_sequence[i].size);
++		if (ret < 0) {
++			printk(KERN_INFO "TAS5713 CODEC PROBE: InitSeq returns: %d\n", ret);
++		}
++	}
++
++	// Unmute
++	ret = snd_soc_component_write(component, TAS5713_SYSTEM_CTRL2, 0x00);
++	if (ret < 0) return ret;
++
++	return 0;
++}
++
++
++static struct snd_soc_component_driver soc_codec_dev_tas5713 = {
++	.probe = tas5713_probe,
++	.remove = tas5713_remove,
++	.controls = tas5713_snd_controls,
++	.num_controls = ARRAY_SIZE(tas5713_snd_controls),
++};
++
++
++
++
++/*
++ *   ___ ___ ___   ___      _
++ *  |_ _|_  ) __| |   \ _ _(_)_ _____ _ _
++ *   | | / / (__  | |) | '_| \ V / -_) '_|
++ *  |___/___\___| |___/|_| |_|\_/\___|_|
++ *
++ */
++
++static const struct reg_default tas5713_reg_defaults[] = {
++	{ 0x07 ,0x80 },     // R7  - VOL_MASTER    - -40dB
++	{ 0x08 ,  30 },     // R8  - VOL_CH1	   -   0dB
++	{ 0x09 ,  30 },     // R9  - VOL_CH2       -   0dB
++	{ 0x0A ,0x80 },     // R10 - VOL_HEADPHONE - -40dB
++};
++
++
++static bool tas5713_reg_volatile(struct device *dev, unsigned int reg)
++{
++	switch (reg) {
++		case TAS5713_DEVICE_ID:
++		case TAS5713_ERROR_STATUS:
++		case TAS5713_CLOCK_CTRL:
++			return true;
++	default:
++			return false;
++	}
++}
++
++
++static const struct of_device_id tas5713_of_match[] = {
++	{ .compatible = "ti,tas5713", },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, tas5713_of_match);
++
++
++static struct regmap_config tas5713_regmap_config = {
++	.reg_bits = 8,
++	.val_bits = 8,
++
++	.max_register = TAS5713_MAX_REGISTER,
++	.volatile_reg = tas5713_reg_volatile,
++
++	.cache_type = REGCACHE_RBTREE,
++	.reg_defaults = tas5713_reg_defaults,
++	.num_reg_defaults = ARRAY_SIZE(tas5713_reg_defaults),
++};
++
++
++static int tas5713_i2c_probe(struct i2c_client *i2c)
++{
++	int ret;
++
++	priv_data = devm_kzalloc(&i2c->dev, sizeof *priv_data, GFP_KERNEL);
++	if (!priv_data)
++		return -ENOMEM;
++
++	priv_data->regmap = devm_regmap_init_i2c(i2c, &tas5713_regmap_config);
++	if (IS_ERR(priv_data->regmap)) {
++		ret = PTR_ERR(priv_data->regmap);
++		return ret;
++	}
++
++	i2c_set_clientdata(i2c, priv_data);
++
++	ret = snd_soc_register_component(&i2c->dev,
++				     &soc_codec_dev_tas5713, &tas5713_dai, 1);
++
++	return ret;
++}
++
++
++static void tas5713_i2c_remove(struct i2c_client *i2c)
++{
++	snd_soc_unregister_component(&i2c->dev);
++	i2c_set_clientdata(i2c, NULL);
++
++	kfree(priv_data);
++}
++
++
++static const struct i2c_device_id tas5713_i2c_id[] = {
++	{ "tas5713", 0 },
++	{ }
++};
++
++MODULE_DEVICE_TABLE(i2c, tas5713_i2c_id);
++
++
++static struct i2c_driver tas5713_i2c_driver = {
++	.driver = {
++		.name = "tas5713",
++		.owner = THIS_MODULE,
++		.of_match_table = tas5713_of_match,
++	},
++	.probe = tas5713_i2c_probe,
++	.remove = tas5713_i2c_remove,
++	.id_table = tas5713_i2c_id
++};
++
++
++static int __init tas5713_modinit(void)
++{
++	int ret = 0;
++
++	ret = i2c_add_driver(&tas5713_i2c_driver);
++	if (ret) {
++		printk(KERN_ERR "Failed to register tas5713 I2C driver: %d\n",
++		       ret);
++	}
++
++	return ret;
++}
++module_init(tas5713_modinit);
++
++
++static void __exit tas5713_exit(void)
++{
++	i2c_del_driver(&tas5713_i2c_driver);
++}
++module_exit(tas5713_exit);
++
++
++MODULE_AUTHOR("Sebastian Eickhoff <basti.eickhoff@googlemail.com>");
++MODULE_DESCRIPTION("ASoC driver for TAS5713");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/sound/soc/codecs/tas5713.h
+@@ -0,0 +1,210 @@
++/*
++ * ASoC Driver for TAS5713
++ *
++ * Author:      Sebastian Eickhoff <basti.eickhoff@googlemail.com>
++ *              Copyright 2014
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ */
++
++#ifndef _TAS5713_H
++#define _TAS5713_H
++
++
++// TAS5713 I2C-bus register addresses
++
++#define TAS5713_CLOCK_CTRL              0x00
++#define TAS5713_DEVICE_ID               0x01
++#define TAS5713_ERROR_STATUS            0x02
++#define TAS5713_SYSTEM_CTRL1            0x03
++#define TAS5713_SERIAL_DATA_INTERFACE   0x04
++#define TAS5713_SYSTEM_CTRL2            0x05
++#define TAS5713_SOFT_MUTE               0x06
++#define TAS5713_VOL_MASTER              0x07
++#define TAS5713_VOL_CH1                 0x08
++#define TAS5713_VOL_CH2                 0x09
++#define TAS5713_VOL_HEADPHONE           0x0A
++#define TAS5713_VOL_CONFIG              0x0E
++#define TAS5713_MODULATION_LIMIT        0x10
++#define TAS5713_IC_DLY_CH1              0x11
++#define TAS5713_IC_DLY_CH2              0x12
++#define TAS5713_IC_DLY_CH3              0x13
++#define TAS5713_IC_DLY_CH4              0x14
++
++#define TAS5713_START_STOP_PERIOD       0x1A
++#define TAS5713_OSC_TRIM                0x1B
++#define TAS5713_BKND_ERR                0x1C
++
++#define TAS5713_INPUT_MUX               0x20
++#define TAS5713_SRC_SELECT_CH4          0x21
++#define TAS5713_PWM_MUX                 0x25
++
++#define TAS5713_CH1_BQ0                 0x29
++#define TAS5713_CH1_BQ1                 0x2A
++#define TAS5713_CH1_BQ2                 0x2B
++#define TAS5713_CH1_BQ3                 0x2C
++#define TAS5713_CH1_BQ4                 0x2D
++#define TAS5713_CH1_BQ5                 0x2E
++#define TAS5713_CH1_BQ6                 0x2F
++#define TAS5713_CH1_BQ7                 0x58
++#define TAS5713_CH1_BQ8                 0x59
++
++#define TAS5713_CH2_BQ0                 0x30
++#define TAS5713_CH2_BQ1                 0x31
++#define TAS5713_CH2_BQ2                 0x32
++#define TAS5713_CH2_BQ3                 0x33
++#define TAS5713_CH2_BQ4                 0x34
++#define TAS5713_CH2_BQ5                 0x35
++#define TAS5713_CH2_BQ6                 0x36
++#define TAS5713_CH2_BQ7                 0x5C
++#define TAS5713_CH2_BQ8                 0x5D
++
++#define TAS5713_CH4_BQ0                 0x5A
++#define TAS5713_CH4_BQ1                 0x5B
++#define TAS5713_CH3_BQ0                 0x5E
++#define TAS5713_CH3_BQ1                 0x5F
++
++#define TAS5713_DRC1_SOFTENING_FILTER_ALPHA_OMEGA       0x3B
++#define TAS5713_DRC1_ATTACK_RELEASE_RATE                0x3C
++#define TAS5713_DRC2_SOFTENING_FILTER_ALPHA_OMEGA       0x3E
++#define TAS5713_DRC2_ATTACK_RELEASE_RATE                0x3F
++#define TAS5713_DRC1_ATTACK_RELEASE_THRES               0x40
++#define TAS5713_DRC2_ATTACK_RELEASE_THRES               0x43
++#define TAS5713_DRC_CTRL                                0x46
++
++#define TAS5713_BANK_SW_CTRL            0x50
++#define TAS5713_CH1_OUTPUT_MIXER        0x51
++#define TAS5713_CH2_OUTPUT_MIXER        0x52
++#define TAS5713_CH1_INPUT_MIXER         0x53
++#define TAS5713_CH2_INPUT_MIXER         0x54
++#define TAS5713_OUTPUT_POST_SCALE       0x56
++#define TAS5713_OUTPUT_PRESCALE         0x57
++
++#define TAS5713_IDF_POST_SCALE          0x62
++
++#define TAS5713_CH1_INLINE_MIXER        0x70
++#define TAS5713_CH1_INLINE_DRC_EN_MIXER 0x71
++#define TAS5713_CH1_R_CHANNEL_MIXER     0x72
++#define TAS5713_CH1_L_CHANNEL_MIXER     0x73
++#define TAS5713_CH2_INLINE_MIXER        0x74
++#define TAS5713_CH2_INLINE_DRC_EN_MIXER 0x75
++#define TAS5713_CH2_L_CHANNEL_MIXER     0x76
++#define TAS5713_CH2_R_CHANNEL_MIXER     0x77
++
++#define TAS5713_UPDATE_DEV_ADDR_KEY     0xF8
++#define TAS5713_UPDATE_DEV_ADDR_REG     0xF9
++
++#define TAS5713_REGISTER_COUNT          0x46
++#define TAS5713_MAX_REGISTER            0xF9
++
++
++// Bitmasks for registers
++#define TAS5713_SOFT_MUTE_ALL           0x07
++
++
++
++struct tas5713_init_command {
++        const int size;
++        const char *const data;
++};
++
++static const struct tas5713_init_command tas5713_init_sequence[] = {
++
++        // Trim oscillator
++    { .size = 2,  .data = "\x1B\x00" },
++    // System control register 1 (0x03): block DC
++    { .size = 2,  .data = "\x03\x80" },
++    // Mute everything
++    { .size = 2,  .data = "\x05\x40" },
++    // Modulation limit register (0x10): 97.7%
++    { .size = 2,  .data = "\x10\x02" },
++    // Interchannel delay registers
++    // (0x11, 0x12, 0x13, and 0x14): BD mode
++    { .size = 2,  .data = "\x11\xB8" },
++    { .size = 2,  .data = "\x12\x60" },
++    { .size = 2,  .data = "\x13\xA0" },
++    { .size = 2,  .data = "\x14\x48" },
++    // PWM shutdown group register (0x19): no shutdown
++    { .size = 2,  .data = "\x19\x00" },
++    // Input multiplexer register (0x20): BD mode
++    { .size = 2,  .data = "\x20\x00\x89\x77\x72" },
++    // PWM output mux register (0x25)
++    // Channel 1 --> OUTA, channel 1 neg --> OUTB
++    // Channel 2 --> OUTC, channel 2 neg --> OUTD
++    { .size = 5,  .data = "\x25\x01\x02\x13\x45" },
++    // DRC control (0x46): DRC off
++    { .size = 5,  .data = "\x46\x00\x00\x00\x00" },
++    // BKND_ERR register (0x1C): 299ms reset period
++    { .size = 2,  .data = "\x1C\x07" },
++    // Mute channel 3
++    { .size = 2,  .data = "\x0A\xFF" },
++    // Volume configuration register (0x0E): volume slew 512 steps
++    { .size = 2,  .data = "\x0E\x90" },
++    // Clock control register (0x00): 44/48kHz, MCLK=64xfs
++    { .size = 2,  .data = "\x00\x60" },
++    // Bank switch and eq control (0x50): no bank switching
++    { .size = 5,  .data = "\x50\x00\x00\x00\x00" },
++    // Volume registers (0x07, 0x08, 0x09, 0x0A)
++    { .size = 2,  .data = "\x07\x20" },
++    { .size = 2,  .data = "\x08\x30" },
++    { .size = 2,  .data = "\x09\x30" },
++    { .size = 2,  .data = "\x0A\xFF" },
++    // 0x72, 0x73, 0x76, 0x77 input mixer:
++    // no intermix between channels
++    { .size = 5,  .data = "\x72\x00\x00\x00\x00" },
++    { .size = 5,  .data = "\x73\x00\x80\x00\x00" },
++    { .size = 5,  .data = "\x76\x00\x00\x00\x00" },
++    { .size = 5,  .data = "\x77\x00\x80\x00\x00" },
++    // 0x70, 0x71, 0x74, 0x75 inline DRC mixer:
++    // no inline DRC inmix
++    { .size = 5,  .data = "\x70\x00\x80\x00\x00" },
++    { .size = 5,  .data = "\x71\x00\x00\x00\x00" },
++    { .size = 5,  .data = "\x74\x00\x80\x00\x00" },
++    { .size = 5,  .data = "\x75\x00\x00\x00\x00" },
++    // 0x56, 0x57 Output scale
++    { .size = 5,  .data = "\x56\x00\x80\x00\x00" },
++    { .size = 5,  .data = "\x57\x00\x02\x00\x00" },
++    // 0x3B, 0x3c
++    { .size = 9,  .data = "\x3B\x00\x08\x00\x00\x00\x78\x00\x00" },
++    { .size = 9,  .data = "\x3C\x00\x00\x01\x00\xFF\xFF\xFF\x00" },
++    { .size = 9,  .data = "\x3E\x00\x08\x00\x00\x00\x78\x00\x00" },
++    { .size = 9,  .data = "\x3F\x00\x00\x01\x00\xFF\xFF\xFF\x00" },
++    { .size = 9,  .data = "\x40\x00\x00\x01\x00\xFF\xFF\xFF\x00" },
++    { .size = 9,  .data = "\x43\x00\x00\x01\x00\xFF\xFF\xFF\x00" },
++    // 0x51, 0x52: output mixer
++    { .size = 9,  .data = "\x51\x00\x80\x00\x00\x00\x00\x00\x00" },
++    { .size = 9,  .data = "\x52\x00\x80\x00\x00\x00\x00\x00\x00" },
++    // PEQ defaults
++    { .size = 21,  .data = "\x29\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x2A\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x2B\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x2C\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x2D\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x2E\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x2F\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x30\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x31\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x32\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x33\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x34\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x35\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x36\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x58\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x59\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x5C\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x5D\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x5E\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x5F\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x5A\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++    { .size = 21,  .data = "\x5B\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
++};
++
++
++#endif  /* _TAS5713_H */
+--- a/sound/soc/dwc/dwc-i2s.c
++++ b/sound/soc/dwc/dwc-i2s.c
+@@ -211,12 +211,21 @@ static void i2s_start(struct dw_i2s_dev
+ static void i2s_stop(struct dw_i2s_dev *dev,
+ 		struct snd_pcm_substream *substream)
+ {
++	if (dev->is_jh7110) {
++		struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream);
++		struct snd_soc_dai_link *dai_link = rtd->dai_link;
+ 
++		dai_link->trigger_stop = SND_SOC_TRIGGER_ORDER_LDC;
++	}
++	i2s_clear_irqs(dev, substream->stream);
++
++	i2s_disable_irqs(dev, substream->stream, 8);
++}
++
++static void i2s_pause(struct dw_i2s_dev *dev,
++		struct snd_pcm_substream *substream)
++{
+ 	i2s_clear_irqs(dev, substream->stream);
+-	if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+-		i2s_write_reg(dev->i2s_base, ITER, 0);
+-	else
+-		i2s_write_reg(dev->i2s_base, IRER, 0);
+ 
+ 	if (dev->use_pio || dev->is_jh7110)
+ 		i2s_disable_irqs(dev, substream->stream, 8);
+@@ -225,14 +234,39 @@ static void i2s_stop(struct dw_i2s_dev *
+ 
+ 	if (!dev->active) {
+ 		i2s_write_reg(dev->i2s_base, CER, 0);
+-		i2s_write_reg(dev->i2s_base, IER, 0);
++		/* Keep the device enabled until the shutdown - do not clear IER */
+ 	}
+ }
+ 
++static void dw_i2s_config(struct dw_i2s_dev *dev, int stream);
+ static int dw_i2s_startup(struct snd_pcm_substream *substream,
+ 			  struct snd_soc_dai *cpu_dai)
+ {
+ 	struct dw_i2s_dev *dev = snd_soc_dai_get_drvdata(cpu_dai);
++	union dw_i2s_snd_dma_data *dma_data = NULL;
++	u32 dmacr;
++
++	dev_dbg(dev->dev, "%s(%s)\n", __func__, substream->name);
++	if (!(dev->capability & DWC_I2S_RECORD) &&
++	    substream->stream == SNDRV_PCM_STREAM_CAPTURE)
++		return -EINVAL;
++
++	if (!(dev->capability & DWC_I2S_PLAY) &&
++	    substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
++		return -EINVAL;
++
++	dw_i2s_config(dev, substream->stream);
++	dmacr = i2s_read_reg(dev->i2s_base, I2S_DMACR);
++	if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
++		dma_data = &dev->play_dma_data;
++		dmacr |= DMACR_DMAEN_TX;
++	} else if (substream->stream == SNDRV_PCM_STREAM_CAPTURE) {
++		dma_data = &dev->capture_dma_data;
++		dmacr |= DMACR_DMAEN_RX;
++	}
++
++	snd_soc_dai_set_dma_data(cpu_dai, substream, (void *)dma_data);
++	i2s_write_reg(dev->i2s_base, I2S_DMACR, dmacr);
+ 
+ 	if (dev->is_jh7110) {
+ 		struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream);
+@@ -244,14 +278,41 @@ static int dw_i2s_startup(struct snd_pcm
+ 	return 0;
+ }
+ 
++static void dw_i2s_shutdown(struct snd_pcm_substream *substream,
++			    struct snd_soc_dai *dai)
++{
++	struct dw_i2s_dev *dev = snd_soc_dai_get_drvdata(dai);
++
++	dev_dbg(dev->dev, "%s(%s)\n", __func__, substream->name);
++	i2s_disable_channels(dev, substream->stream);
++	if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
++		i2s_write_reg(dev->i2s_base, ITER, 0);
++	else
++		i2s_write_reg(dev->i2s_base, IRER, 0);
++
++	i2s_disable_irqs(dev, substream->stream, 8);
++
++	if (!dev->active) {
++		i2s_write_reg(dev->i2s_base, CER, 0);
++		i2s_write_reg(dev->i2s_base, IER, 0);
++	}
++}
++
+ static void dw_i2s_config(struct dw_i2s_dev *dev, int stream)
+ {
+ 	u32 ch_reg;
+ 	struct i2s_clk_config_data *config = &dev->config;
+-
++	u32 dmacr;
+ 
+ 	i2s_disable_channels(dev, stream);
+ 
++	dmacr = i2s_read_reg(dev->i2s_base, I2S_DMACR);
++
++	if (stream == SNDRV_PCM_STREAM_PLAYBACK)
++		dmacr &= ~(DMACR_DMAEN_TXCH0 * 0xf);
++	else
++		dmacr &= ~(DMACR_DMAEN_RXCH0 * 0xf);
++
+ 	for (ch_reg = 0; ch_reg < (config->chan_nr / 2); ch_reg++) {
+ 		if (stream == SNDRV_PCM_STREAM_PLAYBACK) {
+ 			i2s_write_reg(dev->i2s_base, TCR(ch_reg),
+@@ -260,6 +321,7 @@ static void dw_i2s_config(struct dw_i2s_
+ 				      dev->fifo_th - 1);
+ 			i2s_write_reg(dev->i2s_base, TER(ch_reg), TER_TXCHEN |
+ 				      dev->tdm_mask << TER_TXSLOT_SHIFT);
++			dmacr |= (DMACR_DMAEN_TXCH0 << ch_reg);
+ 		} else {
+ 			i2s_write_reg(dev->i2s_base, RCR(ch_reg),
+ 				      dev->xfer_resolution);
+@@ -267,9 +329,11 @@ static void dw_i2s_config(struct dw_i2s_
+ 				      dev->fifo_th - 1);
+ 			i2s_write_reg(dev->i2s_base, RER(ch_reg), RER_RXCHEN |
+ 				      dev->tdm_mask << RER_RXSLOT_SHIFT);
++			dmacr |= (DMACR_DMAEN_RXCH0 << ch_reg);
+ 		}
+-
+ 	}
++
++	i2s_write_reg(dev->i2s_base, I2S_DMACR, dmacr);
+ }
+ 
+ static int dw_i2s_hw_params(struct snd_pcm_substream *substream,
+@@ -277,24 +341,32 @@ static int dw_i2s_hw_params(struct snd_p
+ {
+ 	struct dw_i2s_dev *dev = snd_soc_dai_get_drvdata(dai);
+ 	struct i2s_clk_config_data *config = &dev->config;
++	union dw_i2s_snd_dma_data *dma_data = NULL;
+ 	int ret;
+ 
++	if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
++		dma_data = &dev->play_dma_data;
++	else if (substream->stream == SNDRV_PCM_STREAM_CAPTURE)
++		dma_data = &dev->capture_dma_data;
++	else
++		return -1;
++
+ 	switch (params_format(params)) {
+ 	case SNDRV_PCM_FORMAT_S16_LE:
+ 		config->data_width = 16;
+-		dev->ccr = 0x00;
++		dma_data->dt.addr_width = 2;
+ 		dev->xfer_resolution = 0x02;
+ 		break;
+ 
+ 	case SNDRV_PCM_FORMAT_S24_LE:
+ 		config->data_width = 24;
+-		dev->ccr = 0x08;
++		dma_data->dt.addr_width = 4;
+ 		dev->xfer_resolution = 0x04;
+ 		break;
+ 
+ 	case SNDRV_PCM_FORMAT_S32_LE:
+ 		config->data_width = 32;
+-		dev->ccr = 0x10;
++		dma_data->dt.addr_width = 4;
+ 		dev->xfer_resolution = 0x05;
+ 		break;
+ 
+@@ -315,17 +387,37 @@ static int dw_i2s_hw_params(struct snd_p
+ 	case TWO_CHANNEL_SUPPORT:
+ 		break;
+ 	default:
+-		dev_err(dev->dev, "channel not supported\n");
++		dev_err(dev->dev, "channel count %d not supported\n", config->chan_nr);
+ 		return -EINVAL;
+ 	}
+ 
+ 	dw_i2s_config(dev, substream->stream);
+ 
+-	i2s_write_reg(dev->i2s_base, CCR, dev->ccr);
+-
+ 	config->sample_rate = params_rate(params);
+ 
+ 	if (dev->capability & DW_I2S_MASTER) {
++		u32 frame_length = config->data_width * 2;
++
++		if (dev->bclk_ratio)
++			frame_length = dev->bclk_ratio;
++
++		switch (frame_length) {
++		case 32:
++			dev->ccr = 0x00;
++			break;
++
++		case 48:
++			dev->ccr = 0x08;
++			break;
++
++		case 64:
++			dev->ccr = 0x10;
++			break;
++
++		default:
++			return -EINVAL;
++		}
++
+ 		if (dev->i2s_clk_cfg) {
+ 			ret = dev->i2s_clk_cfg(config);
+ 			if (ret < 0) {
+@@ -333,8 +425,7 @@ static int dw_i2s_hw_params(struct snd_p
+ 				return ret;
+ 			}
+ 		} else {
+-			u32 bitclk = config->sample_rate *
+-					config->data_width * 2;
++			u32 bitclk = config->sample_rate * frame_length;
+ 
+ 			ret = clk_set_rate(dev->clk, bitclk);
+ 			if (ret) {
+@@ -343,6 +434,8 @@ static int dw_i2s_hw_params(struct snd_p
+ 				return ret;
+ 			}
+ 		}
++
++		i2s_write_reg(dev->i2s_base, CCR, dev->ccr);
+ 	}
+ 	return 0;
+ }
+@@ -374,9 +467,12 @@ static int dw_i2s_trigger(struct snd_pcm
+ 		i2s_start(dev, substream);
+ 		break;
+ 
++	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
++		dev->active--;
++		i2s_pause(dev, substream);
++		break;
+ 	case SNDRV_PCM_TRIGGER_STOP:
+ 	case SNDRV_PCM_TRIGGER_SUSPEND:
+-	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+ 		dev->active--;
+ 		i2s_stop(dev, substream);
+ 		break;
+@@ -460,6 +556,18 @@ static int dw_i2s_set_tdm_slot(struct sn
+ 	return 0;
+ }
+ 
++static int dw_i2s_set_bclk_ratio(struct snd_soc_dai *cpu_dai,
++				 unsigned int ratio)
++{
++	struct dw_i2s_dev *dev = snd_soc_dai_get_drvdata(cpu_dai);
++
++	dev_dbg(dev->dev, "%s(%d)\n", __func__, ratio);
++
++	dev->bclk_ratio = ratio;
++
++	return 0;
++}
++
+ static int dw_i2s_dai_probe(struct snd_soc_dai *dai)
+ {
+ 	struct dw_i2s_dev *dev = snd_soc_dai_get_drvdata(dai);
+@@ -471,11 +579,13 @@ static int dw_i2s_dai_probe(struct snd_s
+ static const struct snd_soc_dai_ops dw_i2s_dai_ops = {
+ 	.probe		= dw_i2s_dai_probe,
+ 	.startup	= dw_i2s_startup,
++	.shutdown	= dw_i2s_shutdown,
+ 	.hw_params	= dw_i2s_hw_params,
+ 	.prepare	= dw_i2s_prepare,
+ 	.trigger	= dw_i2s_trigger,
+ 	.set_fmt	= dw_i2s_set_fmt,
+ 	.set_tdm_slot	= dw_i2s_set_tdm_slot,
++	.set_bclk_ratio	= dw_i2s_set_bclk_ratio,
+ };
+ 
+ #ifdef CONFIG_PM
+@@ -606,7 +716,7 @@ static int dw_configure_dai(struct dw_i2
+ 			idx = 1;
+ 		dw_i2s_dai->playback.channels_min = MIN_CHANNEL_NUM;
+ 		dw_i2s_dai->playback.channels_max =
+-				1 << (COMP1_TX_CHANNELS(comp1) + 1);
++				2 * (COMP1_TX_CHANNELS(comp1) + 1);
+ 		dw_i2s_dai->playback.formats = formats[idx];
+ 		dw_i2s_dai->playback.rates = rates;
+ 	}
+@@ -620,7 +730,7 @@ static int dw_configure_dai(struct dw_i2
+ 			idx = 1;
+ 		dw_i2s_dai->capture.channels_min = MIN_CHANNEL_NUM;
+ 		dw_i2s_dai->capture.channels_max =
+-				1 << (COMP1_RX_CHANNELS(comp1) + 1);
++				2 * (COMP1_RX_CHANNELS(comp1) + 1);
+ 		dw_i2s_dai->capture.formats = formats[idx];
+ 		dw_i2s_dai->capture.rates = rates;
+ 	}
+@@ -702,7 +812,7 @@ static int dw_configure_dai_by_dt(struct
+ 	u32 idx2;
+ 	int ret;
+ 
+-	ret = dw_configure_dai(dev, dw_i2s_dai, SNDRV_PCM_RATE_8000_192000);
++	ret = dw_configure_dai(dev, dw_i2s_dai, SNDRV_PCM_RATE_8000_384000);
+ 	if (ret < 0)
+ 		return ret;
+ 
+@@ -968,6 +1078,7 @@ static int dw_i2s_probe(struct platform_
+ 		}
+ 	}
+ 
++	dev->bclk_ratio = 0;
+ 	dev->i2s_reg_comp1 = I2S_COMP_PARAM_1;
+ 	dev->i2s_reg_comp2 = I2S_COMP_PARAM_2;
+ 	if (pdata) {
+--- a/sound/soc/dwc/local.h
++++ b/sound/soc/dwc/local.h
+@@ -63,6 +63,17 @@
+ #define TER_TXSLOT_SHIFT	8
+ #define TER_TXCHEN	BIT(0)
+ 
++#define DMACR_DMAEN_TX		BIT(17)
++#define DMACR_DMAEN_RX		BIT(16)
++#define DMACR_DMAEN_TXCH3	BIT(11)
++#define DMACR_DMAEN_TXCH2	BIT(10)
++#define DMACR_DMAEN_TXCH1	BIT(9)
++#define DMACR_DMAEN_TXCH0	BIT(8)
++#define DMACR_DMAEN_RXCH3	BIT(3)
++#define DMACR_DMAEN_RXCH2	BIT(2)
++#define DMACR_DMAEN_RXCH1	BIT(1)
++#define DMACR_DMAEN_RXCH0	BIT(0)
++
+ /* I2SCOMPRegisters */
+ #define I2S_COMP_PARAM_2	0x01F0
+ #define I2S_COMP_PARAM_1	0x01F4
+@@ -117,6 +128,7 @@ struct dw_i2s_dev {
+ 	unsigned int quirks;
+ 	unsigned int i2s_reg_comp1;
+ 	unsigned int i2s_reg_comp2;
++	unsigned int bclk_ratio;
+ 	struct device *dev;
+ 	u32 ccr;
+ 	u32 xfer_resolution;
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -1434,7 +1434,15 @@ int snd_soc_runtime_set_dai_fmt(struct s
+ 		return 0;
+ 
+ 	for_each_rtd_codec_dais(rtd, i, codec_dai) {
+-		ret = snd_soc_dai_set_fmt(codec_dai, dai_fmt);
++		unsigned int codec_dai_fmt = dai_fmt;
++
++		// there can only be one master when using multiple codecs
++		if (i && (codec_dai_fmt & SND_SOC_DAIFMT_MASTER_MASK)) {
++			codec_dai_fmt &= ~SND_SOC_DAIFMT_MASTER_MASK;
++			codec_dai_fmt |= SND_SOC_DAIFMT_CBS_CFS;
++		}
++
++		ret = snd_soc_dai_set_fmt(codec_dai, codec_dai_fmt);
+ 		if (ret != 0 && ret != -ENOTSUPP)
+ 			return ret;
+ 	}
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -869,8 +869,14 @@ static int usb_audio_probe(struct usb_in
+ 	if (ignore_ctl_error)
+ 		chip->quirk_flags |= QUIRK_FLAG_IGNORE_CTL_ERROR;
+ 
+-	if (chip->quirk_flags & QUIRK_FLAG_DISABLE_AUTOSUSPEND)
++	if (chip->quirk_flags & QUIRK_FLAG_DISABLE_AUTOSUSPEND) {
++		/*
++		* Grab the interface, because on a webcam uvcvideo may race
++		* with snd-usb-audio during probe and re-enable autosuspend.
++		*/
++		usb_autopm_get_interface(intf);
+ 		usb_disable_autosuspend(interface_to_usbdev(intf));
++	}
+ 
+ 	/*
+ 	 * For devices with more than one control interface, we assume the
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -2345,6 +2345,8 @@ static const struct usb_audio_quirk_flag
+ 		   QUIRK_FLAG_ALIGN_TRANSFER),
+ 	DEVICE_FLG(0x534d, 0x2109, /* MacroSilicon MS2109 */
+ 		   QUIRK_FLAG_ALIGN_TRANSFER),
++	DEVICE_FLG(0x09da, 0x2695, /* A4Tech FHD 1080p webcam */
++		   QUIRK_FLAG_DISABLE_AUTOSUSPEND | QUIRK_FLAG_GET_SAMPLE_RATE),
+ 
+ 	/* Vendor matches */
+ 	VENDOR_FLG(0x045e, /* MS Lifecam */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0074-rpi_display-add-backlight-driver-and-overlay.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0074-rpi_display-add-backlight-driver-and-overlay.patch
new file mode 100644
index 00000000..a7718319
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0074-rpi_display-add-backlight-driver-and-overlay.patch
@@ -0,0 +1,171 @@
+From ebc0dcfb01af90c5fb64b6bd13d8cd8ff53b67fa Mon Sep 17 00:00:00 2001
+From: P33M <P33M@github.com>
+Date: Wed, 21 Oct 2015 14:55:21 +0100
+Subject: [PATCH 074/697] rpi_display: add backlight driver and overlay
+
+Add a mailbox-driven backlight controller for the Raspberry Pi DSI
+touchscreen display. Requires updated GPU firmware to recognise the
+mailbox request.
+
+Signed-off-by: Gordon Hollingworth <gordon@raspberrypi.org>
+
+Add Raspberry Pi firmware driver to the dependencies of backlight driver
+
+Otherwise the backlight driver fails to build if the firmware
+loading driver is not in the kernel
+
+Signed-off-by: Alex Riesen <alexander.riesen@cetitec.com>
+---
+ drivers/video/backlight/Kconfig         |   7 ++
+ drivers/video/backlight/Makefile        |   1 +
+ drivers/video/backlight/rpi_backlight.c | 118 ++++++++++++++++++++++++
+ 3 files changed, 126 insertions(+)
+ create mode 100644 drivers/video/backlight/rpi_backlight.c
+
+--- a/drivers/video/backlight/Kconfig
++++ b/drivers/video/backlight/Kconfig
+@@ -249,6 +249,13 @@ config BACKLIGHT_PWM
+ 	  If you have a LCD backlight adjustable by PWM, say Y to enable
+ 	  this driver.
+ 
++config BACKLIGHT_RPI
++	tristate "Raspberry Pi display firmware driven backlight"
++	depends on RASPBERRYPI_FIRMWARE
++	help
++	  If you have the Raspberry Pi DSI touchscreen display, say Y to
++	  enable the mailbox-controlled backlight driver.
++
+ config BACKLIGHT_DA903X
+ 	tristate "Backlight Driver for DA9030/DA9034 using WLED"
+ 	depends on PMIC_DA903X
+--- a/drivers/video/backlight/Makefile
++++ b/drivers/video/backlight/Makefile
+@@ -52,6 +52,7 @@ obj-$(CONFIG_BACKLIGHT_PANDORA)		+= pand
+ obj-$(CONFIG_BACKLIGHT_PCF50633)	+= pcf50633-backlight.o
+ obj-$(CONFIG_BACKLIGHT_PWM)		+= pwm_bl.o
+ obj-$(CONFIG_BACKLIGHT_QCOM_WLED)	+= qcom-wled.o
++obj-$(CONFIG_BACKLIGHT_RPI)			+= rpi_backlight.o
+ obj-$(CONFIG_BACKLIGHT_RT4831)		+= rt4831-backlight.o
+ obj-$(CONFIG_BACKLIGHT_SAHARA)		+= kb3886_bl.o
+ obj-$(CONFIG_BACKLIGHT_SKY81452)	+= sky81452-backlight.o
+--- /dev/null
++++ b/drivers/video/backlight/rpi_backlight.c
+@@ -0,0 +1,118 @@
++/*
++ * rpi_bl.c - Backlight controller through VPU
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/backlight.h>
++#include <linux/err.h>
++#include <linux/fb.h>
++#include <linux/gpio.h>
++#include <linux/init.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/of_gpio.h>
++#include <linux/platform_device.h>
++#include <linux/slab.h>
++#include <soc/bcm2835/raspberrypi-firmware.h>
++
++struct rpi_backlight {
++	struct device *dev;
++	struct device *fbdev;
++	struct rpi_firmware *fw;
++};
++
++static int rpi_backlight_update_status(struct backlight_device *bl)
++{
++	struct rpi_backlight *gbl = bl_get_data(bl);
++	int brightness = bl->props.brightness;
++	int ret;
++
++	if (bl->props.power != FB_BLANK_UNBLANK ||
++	    bl->props.state & (BL_CORE_SUSPENDED | BL_CORE_FBBLANK))
++		brightness = 0;
++
++	ret = rpi_firmware_property(gbl->fw,
++			RPI_FIRMWARE_FRAMEBUFFER_SET_BACKLIGHT,
++			&brightness, sizeof(brightness));
++	if (ret) {
++		dev_err(gbl->dev, "Failed to set brightness\n");
++		return ret;
++	}
++
++	if (brightness < 0) {
++		dev_err(gbl->dev, "Backlight change failed\n");
++		return -EAGAIN;
++	}
++
++	return 0;
++}
++
++static const struct backlight_ops rpi_backlight_ops = {
++	.options	= BL_CORE_SUSPENDRESUME,
++	.update_status	= rpi_backlight_update_status,
++};
++
++static int rpi_backlight_probe(struct platform_device *pdev)
++{
++	struct backlight_properties props;
++	struct backlight_device *bl;
++	struct rpi_backlight *gbl;
++	struct device_node *fw_node;
++
++	gbl = devm_kzalloc(&pdev->dev, sizeof(*gbl), GFP_KERNEL);
++	if (gbl == NULL)
++		return -ENOMEM;
++
++	gbl->dev = &pdev->dev;
++
++	fw_node = of_parse_phandle(pdev->dev.of_node, "firmware", 0);
++	if (!fw_node) {
++		dev_err(&pdev->dev, "Missing firmware node\n");
++		return -ENOENT;
++	}
++
++	gbl->fw = rpi_firmware_get(fw_node);
++	if (!gbl->fw)
++		return -EPROBE_DEFER;
++
++	memset(&props, 0, sizeof(props));
++	props.type = BACKLIGHT_RAW;
++	props.max_brightness = 255;
++	bl = devm_backlight_device_register(&pdev->dev, dev_name(&pdev->dev),
++					&pdev->dev, gbl, &rpi_backlight_ops,
++					&props);
++	if (IS_ERR(bl)) {
++		dev_err(&pdev->dev, "failed to register backlight\n");
++		return PTR_ERR(bl);
++	}
++
++	bl->props.brightness = 255;
++	backlight_update_status(bl);
++
++	platform_set_drvdata(pdev, bl);
++	return 0;
++}
++
++static const struct of_device_id rpi_backlight_of_match[] = {
++	{ .compatible = "raspberrypi,rpi-backlight" },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, rpi_backlight_of_match);
++
++static struct platform_driver rpi_backlight_driver = {
++	.driver		= {
++		.name		= "rpi-backlight",
++		.of_match_table = of_match_ptr(rpi_backlight_of_match),
++	},
++	.probe		= rpi_backlight_probe,
++};
++
++module_platform_driver(rpi_backlight_driver);
++
++MODULE_AUTHOR("Gordon Hollingworth <gordon@raspberrypi.org>");
++MODULE_DESCRIPTION("Raspberry Pi mailbox based Backlight Driver");
++MODULE_LICENSE("GPL");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0075-bcm2835-virtgpio-Virtual-GPIO-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0075-bcm2835-virtgpio-Virtual-GPIO-driver.patch
new file mode 100644
index 00000000..d73cf8ca
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0075-bcm2835-virtgpio-Virtual-GPIO-driver.patch
@@ -0,0 +1,275 @@
+From bca457f76477ff2de37e830cf6590617d694a10c Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Tue, 23 Feb 2016 19:56:04 +0000
+Subject: [PATCH 075/697] bcm2835-virtgpio: Virtual GPIO driver
+
+Add a virtual GPIO driver that uses the firmware mailbox interface to
+request that the VPU toggles LEDs.
+
+gpio: bcm-virt: Fix the get() method
+
+The get() method does not understand the on-the-wire encoding of the
+remote GPIO states, thinking they are simple on/off bits when they are
+really pairs of 16-bit counts. Rewrite the get() handler to return the
+value last written, which will eventually match the actual GPIO state
+if there are no other changes.
+
+See: https://github.com/raspberrypi/linux/issues/4638
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+bcm2835-virtgpio: Update for Linux 6.6
+
+The gpio subsystem is happier if the gpiochip is given a parent, and
+if it doesn't have a fixed base gpio number. While we're in here,
+use the fact that the firmware node is the parent to locate it,
+and use the devm_ version of rpi_firmware_get.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/gpio/Kconfig         |   6 +
+ drivers/gpio/Makefile        |   1 +
+ drivers/gpio/gpio-bcm-virt.c | 212 +++++++++++++++++++++++++++++++++++
+ 3 files changed, 219 insertions(+)
+ create mode 100644 drivers/gpio/gpio-bcm-virt.c
+
+--- a/drivers/gpio/Kconfig
++++ b/drivers/gpio/Kconfig
+@@ -216,6 +216,12 @@ config GPIO_BCM_XGS_IPROC
+ 	help
+ 	  Say yes here to enable GPIO support for Broadcom XGS iProc SoCs.
+ 
++config GPIO_BCM_VIRT
++	bool "Broadcom Virt GPIO"
++	depends on OF_GPIO && RASPBERRYPI_FIRMWARE && (ARCH_BCM2835 || COMPILE_TEST)
++	help
++	  Turn on virtual GPIO support for Broadcom BCM283X chips.
++
+ config GPIO_BRCMSTB
+ 	tristate "BRCMSTB GPIO support"
+ 	default y if (ARCH_BRCMSTB || BMIPS_GENERIC)
+--- a/drivers/gpio/Makefile
++++ b/drivers/gpio/Makefile
+@@ -39,6 +39,7 @@ obj-$(CONFIG_GPIO_ASPEED_SGPIO)		+= gpio
+ obj-$(CONFIG_GPIO_ATH79)		+= gpio-ath79.o
+ obj-$(CONFIG_GPIO_BCM_KONA)		+= gpio-bcm-kona.o
+ obj-$(CONFIG_GPIO_BCM_XGS_IPROC)	+= gpio-xgs-iproc.o
++obj-$(CONFIG_GPIO_BCM_VIRT)		+= gpio-bcm-virt.o
+ obj-$(CONFIG_GPIO_BD71815)		+= gpio-bd71815.o
+ obj-$(CONFIG_GPIO_BD71828)		+= gpio-bd71828.o
+ obj-$(CONFIG_GPIO_BD9571MWV)		+= gpio-bd9571mwv.o
+--- /dev/null
++++ b/drivers/gpio/gpio-bcm-virt.c
+@@ -0,0 +1,212 @@
++/*
++ *  brcmvirt GPIO driver
++ *
++ *  Copyright (C) 2012,2013 Dom Cobley <popcornmix@gmail.com>
++ *  Based on gpio-clps711x.c by Alexander Shiyan <shc_work@mail.ru>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ */
++
++#include <linux/err.h>
++#include <linux/gpio/driver.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/dma-mapping.h>
++#include <soc/bcm2835/raspberrypi-firmware.h>
++
++#define MODULE_NAME "brcmvirt-gpio"
++#define NUM_GPIO 2
++
++struct brcmvirt_gpio {
++	struct gpio_chip	gc;
++	u32 __iomem		*ts_base;
++	/* two packed 16-bit counts of enabled and disables
++           Allows host to detect a brief enable that was missed */
++	u32			enables_disables[NUM_GPIO];
++	dma_addr_t		bus_addr;
++};
++
++static int brcmvirt_gpio_dir_in(struct gpio_chip *gc, unsigned off)
++{
++	struct brcmvirt_gpio *gpio;
++	gpio = container_of(gc, struct brcmvirt_gpio, gc);
++	return -EINVAL;
++}
++
++static int brcmvirt_gpio_dir_out(struct gpio_chip *gc, unsigned off, int val)
++{
++	struct brcmvirt_gpio *gpio;
++	gpio = container_of(gc, struct brcmvirt_gpio, gc);
++	return 0;
++}
++
++static int brcmvirt_gpio_get(struct gpio_chip *gc, unsigned off)
++{
++	struct brcmvirt_gpio *gpio;
++	unsigned v;
++	gpio = container_of(gc, struct brcmvirt_gpio, gc);
++	v = readl(gpio->ts_base + off);
++	return (s16)((v >> 16) - v) > 0;
++}
++
++static void brcmvirt_gpio_set(struct gpio_chip *gc, unsigned off, int val)
++{
++	struct brcmvirt_gpio *gpio;
++	u16 enables, disables;
++	s16 diff;
++	bool lit;
++	gpio = container_of(gc, struct brcmvirt_gpio, gc);
++	enables  = gpio->enables_disables[off] >> 16;
++	disables = gpio->enables_disables[off] >>  0;
++	diff = (s16)(enables - disables);
++	lit = diff > 0;
++	if ((val && lit) || (!val && !lit))
++		return;
++	if (val)
++		enables++;
++	else
++		disables++;
++	diff = (s16)(enables - disables);
++	BUG_ON(diff != 0 && diff != 1);
++	gpio->enables_disables[off] = (enables << 16) | (disables << 0);
++	writel(gpio->enables_disables[off], gpio->ts_base + off);
++}
++
++static int brcmvirt_gpio_probe(struct platform_device *pdev)
++{
++	int err = 0;
++	struct device *dev = &pdev->dev;
++	struct device_node *np = dev_of_node(dev);
++	struct device_node *fw_node;
++	struct rpi_firmware *fw;
++	struct brcmvirt_gpio *ucb;
++	u32 gpiovirtbuf;
++
++	fw_node = of_get_parent(np);
++	if (!fw_node) {
++		dev_err(dev, "Missing firmware node\n");
++		return -ENOENT;
++	}
++
++	fw = devm_rpi_firmware_get(&pdev->dev, fw_node);
++	of_node_put(fw_node);
++	if (!fw)
++		return -EPROBE_DEFER;
++
++	ucb = devm_kzalloc(dev, sizeof *ucb, GFP_KERNEL);
++	if (!ucb) {
++		err = -EINVAL;
++		goto out;
++	}
++
++	ucb->ts_base = dma_alloc_coherent(dev, PAGE_SIZE, &ucb->bus_addr, GFP_KERNEL);
++	if (!ucb->ts_base) {
++		pr_err("[%s]: failed to dma_alloc_coherent(%ld)\n",
++				__func__, PAGE_SIZE);
++		err = -ENOMEM;
++		goto out;
++	}
++
++	gpiovirtbuf = (u32)ucb->bus_addr;
++	err = rpi_firmware_property(fw, RPI_FIRMWARE_FRAMEBUFFER_SET_GPIOVIRTBUF,
++				    &gpiovirtbuf, sizeof(gpiovirtbuf));
++
++	if (err || gpiovirtbuf != 0) {
++		dev_warn(dev, "Failed to set gpiovirtbuf, trying to get err:%x\n", err);
++		dma_free_coherent(dev, PAGE_SIZE, ucb->ts_base, ucb->bus_addr);
++		ucb->ts_base = 0;
++		ucb->bus_addr = 0;
++	}
++
++	if (!ucb->ts_base) {
++		err = rpi_firmware_property(fw, RPI_FIRMWARE_FRAMEBUFFER_GET_GPIOVIRTBUF,
++					    &gpiovirtbuf, sizeof(gpiovirtbuf));
++
++		if (err) {
++			dev_err(dev, "Failed to get gpiovirtbuf\n");
++			goto out;
++		}
++
++		if (!gpiovirtbuf) {
++			dev_err(dev, "No virtgpio buffer\n");
++			err = -ENOENT;
++			goto out;
++		}
++
++		// mmap the physical memory
++		gpiovirtbuf &= ~0xc0000000;
++		ucb->ts_base = ioremap(gpiovirtbuf, 4096);
++		if (ucb->ts_base == NULL) {
++			dev_err(dev, "Failed to map physical address\n");
++			err = -ENOENT;
++			goto out;
++		}
++		ucb->bus_addr = 0;
++	}
++	ucb->gc.parent = dev;
++	ucb->gc.label = MODULE_NAME;
++	ucb->gc.owner = THIS_MODULE;
++	ucb->gc.base = -1;
++	ucb->gc.ngpio = NUM_GPIO;
++
++	ucb->gc.direction_input = brcmvirt_gpio_dir_in;
++	ucb->gc.direction_output = brcmvirt_gpio_dir_out;
++	ucb->gc.get = brcmvirt_gpio_get;
++	ucb->gc.set = brcmvirt_gpio_set;
++	ucb->gc.can_sleep = true;
++
++	err = gpiochip_add_data(&ucb->gc, NULL);
++	if (err)
++		goto out;
++
++	platform_set_drvdata(pdev, ucb);
++
++	return 0;
++out:
++	if (ucb->bus_addr) {
++		dma_free_coherent(dev, PAGE_SIZE, ucb->ts_base, ucb->bus_addr);
++		ucb->bus_addr = 0;
++		ucb->ts_base = NULL;
++	} else if (ucb->ts_base) {
++		iounmap(ucb->ts_base);
++		ucb->ts_base = NULL;
++	}
++	return err;
++}
++
++static void brcmvirt_gpio_remove(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct brcmvirt_gpio *ucb = platform_get_drvdata(pdev);
++
++	gpiochip_remove(&ucb->gc);
++	if (ucb->bus_addr)
++		dma_free_coherent(dev, PAGE_SIZE, ucb->ts_base, ucb->bus_addr);
++	else if (ucb->ts_base)
++		iounmap(ucb->ts_base);
++}
++
++static const struct of_device_id __maybe_unused brcmvirt_gpio_ids[] = {
++	{ .compatible = "brcm,bcm2835-virtgpio" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, brcmvirt_gpio_ids);
++
++static struct platform_driver brcmvirt_gpio_driver = {
++	.driver	= {
++		.name		= MODULE_NAME,
++		.owner		= THIS_MODULE,
++		.of_match_table	= of_match_ptr(brcmvirt_gpio_ids),
++	},
++	.probe	= brcmvirt_gpio_probe,
++	.remove	= brcmvirt_gpio_remove,
++};
++module_platform_driver(brcmvirt_gpio_driver);
++
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Dom Cobley <popcornmix@gmail.com>");
++MODULE_DESCRIPTION("brcmvirt GPIO driver");
++MODULE_ALIAS("platform:brcmvirt-gpio");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0076-OF-DT-Overlay-configfs-interface.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0076-OF-DT-Overlay-configfs-interface.patch
new file mode 100644
index 00000000..7c17092b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0076-OF-DT-Overlay-configfs-interface.patch
@@ -0,0 +1,408 @@
+From ee77b24e7973982d4ad0a768fa281ee3a1dbac3f Mon Sep 17 00:00:00 2001
+From: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
+Date: Wed, 3 Dec 2014 13:23:28 +0200
+Subject: [PATCH 076/697] OF: DT-Overlay configfs interface
+
+This is a port of Pantelis Antoniou's v3 port that makes use of the
+new upstreamed configfs support for binary attributes.
+
+Original commit message:
+
+Add a runtime interface to using configfs for generic device tree overlay
+usage. With it its possible to use device tree overlays without having
+to use a per-platform overlay manager.
+
+Please see Documentation/devicetree/configfs-overlays.txt for more info.
+
+Changes since v2:
+- Removed ifdef CONFIG_OF_OVERLAY (since for now it's required)
+- Created a documentation entry
+- Slight rewording in Kconfig
+
+Changes since v1:
+- of_resolve() -> of_resolve_phandles().
+
+Originally-signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+DT configfs: Fix build errors on other platforms
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+DT configfs: fix build error
+
+There is an error when compiling rpi-4.6.y branch:
+  CC      drivers/of/configfs.o
+drivers/of/configfs.c:291:21: error: initialization from incompatible pointer type [-Werror=incompatible-pointer-types]
+   .default_groups = of_cfs_def_groups,
+                     ^
+drivers/of/configfs.c:291:21: note: (near initialization for 'of_cfs_subsys.su_group.default_groups.next')
+
+The .default_groups is linked list since commit
+1ae1602de028acaa42a0f6ff18d19756f8e825c6.
+This commit uses configfs_add_default_group to fix this problem.
+
+Signed-off-by: Slawomir Stepien <sst@poczta.fm>
+
+configfs: New of_overlay API
+
+of: configfs: Use of_overlay_fdt_apply API call
+
+The published API to the dynamic overlay application mechanism now
+takes a Flattened Device Tree blob as input so that it can manage the
+lifetime of the unflattened tree. Conveniently, the new API call -
+of_overlay_fdt_apply - is virtually a drop-in replacement for
+create_overlay, which can now be deleted.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ .../devicetree/configfs-overlays.txt          |  31 ++
+ drivers/of/Kconfig                            |  11 +
+ drivers/of/Makefile                           |   1 +
+ drivers/of/configfs.c                         | 277 ++++++++++++++++++
+ 4 files changed, 320 insertions(+)
+ create mode 100644 Documentation/devicetree/configfs-overlays.txt
+ create mode 100644 drivers/of/configfs.c
+
+--- /dev/null
++++ b/Documentation/devicetree/configfs-overlays.txt
+@@ -0,0 +1,31 @@
++Howto use the configfs overlay interface.
++
++A device-tree configfs entry is created in /config/device-tree/overlays
++and and it is manipulated using standard file system I/O.
++Note that this is a debug level interface, for use by developers and
++not necessarily something accessed by normal users due to the
++security implications of having direct access to the kernel's device tree.
++
++* To create an overlay you mkdir the directory:
++
++	# mkdir /config/device-tree/overlays/foo
++
++* Either you echo the overlay firmware file to the path property file.
++
++	# echo foo.dtbo >/config/device-tree/overlays/foo/path
++
++* Or you cat the contents of the overlay to the dtbo file
++
++	# cat foo.dtbo >/config/device-tree/overlays/foo/dtbo
++
++The overlay file will be applied, and devices will be created/destroyed
++as required.
++
++To remove it simply rmdir the directory.
++
++	# rmdir /config/device-tree/overlays/foo
++
++The rationalle of the dual interface (firmware & direct copy) is that each is
++better suited to different use patterns. The firmware interface is what's
++intended to be used by hardware managers in the kernel, while the copy interface
++make sense for developers (since it avoids problems with namespaces).
+--- a/drivers/of/Kconfig
++++ b/drivers/of/Kconfig
+@@ -120,4 +120,15 @@ config OF_OVERLAY_KUNIT_TEST
+ config OF_NUMA
+ 	bool
+ 
++config OF_DMA_DEFAULT_COHERENT
++	# arches should select this if DMA is coherent by default for OF devices
++	bool
++
++config OF_CONFIGFS
++	bool "Device Tree Overlay ConfigFS interface"
++	select CONFIGFS_FS
++	select OF_OVERLAY
++	help
++	  Enable a simple user-space driven DT overlay interface.
++
+ endif # OF
+--- a/drivers/of/Makefile
++++ b/drivers/of/Makefile
+@@ -1,6 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ obj-y = base.o cpu.o device.o module.o platform.o property.o
+ obj-$(CONFIG_OF_KOBJ) += kobj.o
++obj-$(CONFIG_OF_CONFIGFS) += configfs.o
+ obj-$(CONFIG_OF_DYNAMIC) += dynamic.o
+ obj-$(CONFIG_OF_FLATTREE) += fdt.o empty_root.dtb.o
+ obj-$(CONFIG_OF_EARLY_FLATTREE) += fdt_address.o
+--- /dev/null
++++ b/drivers/of/configfs.c
+@@ -0,0 +1,277 @@
++/*
++ * Configfs entries for device-tree
++ *
++ * Copyright (C) 2013 - Pantelis Antoniou <panto@antoniou-consulting.com>
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * as published by the Free Software Foundation; either version
++ * 2 of the License, or (at your option) any later version.
++ */
++#include <linux/ctype.h>
++#include <linux/cpu.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/of_fdt.h>
++#include <linux/spinlock.h>
++#include <linux/slab.h>
++#include <linux/proc_fs.h>
++#include <linux/configfs.h>
++#include <linux/types.h>
++#include <linux/stat.h>
++#include <linux/limits.h>
++#include <linux/file.h>
++#include <linux/vmalloc.h>
++#include <linux/firmware.h>
++#include <linux/sizes.h>
++
++#include "of_private.h"
++
++struct cfs_overlay_item {
++	struct config_item	item;
++
++	char			path[PATH_MAX];
++
++	const struct firmware	*fw;
++	struct device_node	*overlay;
++	int			ov_id;
++
++	void			*dtbo;
++	int			dtbo_size;
++};
++
++static inline struct cfs_overlay_item *to_cfs_overlay_item(
++		struct config_item *item)
++{
++	return item ? container_of(item, struct cfs_overlay_item, item) : NULL;
++}
++
++static ssize_t cfs_overlay_item_path_show(struct config_item *item,
++		char *page)
++{
++	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
++	return sprintf(page, "%s\n", overlay->path);
++}
++
++static ssize_t cfs_overlay_item_path_store(struct config_item *item,
++		const char *page, size_t count)
++{
++	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
++	const char *p = page;
++	char *s;
++	int err;
++
++	/* if it's set do not allow changes */
++	if (overlay->path[0] != '\0' || overlay->dtbo_size > 0)
++		return -EPERM;
++
++	/* copy to path buffer (and make sure it's always zero terminated */
++	count = snprintf(overlay->path, sizeof(overlay->path) - 1, "%s", p);
++	overlay->path[sizeof(overlay->path) - 1] = '\0';
++
++	/* strip trailing newlines */
++	s = overlay->path + strlen(overlay->path);
++	while (s > overlay->path && *--s == '\n')
++		*s = '\0';
++
++	pr_debug("%s: path is '%s'\n", __func__, overlay->path);
++
++	err = request_firmware(&overlay->fw, overlay->path, NULL);
++	if (err != 0)
++		goto out_err;
++
++	err = of_overlay_fdt_apply((void *)overlay->fw->data,
++				   (u32)overlay->fw->size, &overlay->ov_id, NULL);
++	if (err != 0)
++		goto out_err;
++
++	return count;
++
++out_err:
++
++	release_firmware(overlay->fw);
++	overlay->fw = NULL;
++
++	overlay->path[0] = '\0';
++	return err;
++}
++
++static ssize_t cfs_overlay_item_status_show(struct config_item *item,
++		char *page)
++{
++	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
++
++	return sprintf(page, "%s\n",
++			overlay->ov_id > 0 ? "applied" : "unapplied");
++}
++
++CONFIGFS_ATTR(cfs_overlay_item_, path);
++CONFIGFS_ATTR_RO(cfs_overlay_item_, status);
++
++static struct configfs_attribute *cfs_overlay_attrs[] = {
++	&cfs_overlay_item_attr_path,
++	&cfs_overlay_item_attr_status,
++	NULL,
++};
++
++static ssize_t cfs_overlay_item_dtbo_read(struct config_item *item,
++		void *buf, size_t max_count)
++{
++	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
++
++	pr_debug("%s: buf=%p max_count=%zu\n", __func__,
++			buf, max_count);
++
++	if (overlay->dtbo == NULL)
++		return 0;
++
++	/* copy if buffer provided */
++	if (buf != NULL) {
++		/* the buffer must be large enough */
++		if (overlay->dtbo_size > max_count)
++			return -ENOSPC;
++
++		memcpy(buf, overlay->dtbo, overlay->dtbo_size);
++	}
++
++	return overlay->dtbo_size;
++}
++
++static ssize_t cfs_overlay_item_dtbo_write(struct config_item *item,
++		const void *buf, size_t count)
++{
++	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
++	int err;
++
++	/* if it's set do not allow changes */
++	if (overlay->path[0] != '\0' || overlay->dtbo_size > 0)
++		return -EPERM;
++
++	/* copy the contents */
++	overlay->dtbo = kmemdup(buf, count, GFP_KERNEL);
++	if (overlay->dtbo == NULL)
++		return -ENOMEM;
++
++	overlay->dtbo_size = count;
++
++	err = of_overlay_fdt_apply(overlay->dtbo, overlay->dtbo_size,
++				   &overlay->ov_id, NULL);
++	if (err != 0)
++		goto out_err;
++
++	return count;
++
++out_err:
++	kfree(overlay->dtbo);
++	overlay->dtbo = NULL;
++	overlay->dtbo_size = 0;
++	overlay->ov_id = 0;
++
++	return err;
++}
++
++CONFIGFS_BIN_ATTR(cfs_overlay_item_, dtbo, NULL, SZ_1M);
++
++static struct configfs_bin_attribute *cfs_overlay_bin_attrs[] = {
++	&cfs_overlay_item_attr_dtbo,
++	NULL,
++};
++
++static void cfs_overlay_release(struct config_item *item)
++{
++	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
++
++	if (overlay->ov_id > 0)
++		of_overlay_remove(&overlay->ov_id);
++	if (overlay->fw)
++		release_firmware(overlay->fw);
++	/* kfree with NULL is safe */
++	kfree(overlay->dtbo);
++	kfree(overlay);
++}
++
++static struct configfs_item_operations cfs_overlay_item_ops = {
++	.release	= cfs_overlay_release,
++};
++
++static struct config_item_type cfs_overlay_type = {
++	.ct_item_ops	= &cfs_overlay_item_ops,
++	.ct_attrs	= cfs_overlay_attrs,
++	.ct_bin_attrs	= cfs_overlay_bin_attrs,
++	.ct_owner	= THIS_MODULE,
++};
++
++static struct config_item *cfs_overlay_group_make_item(
++		struct config_group *group, const char *name)
++{
++	struct cfs_overlay_item *overlay;
++
++	overlay = kzalloc(sizeof(*overlay), GFP_KERNEL);
++	if (!overlay)
++		return ERR_PTR(-ENOMEM);
++
++	config_item_init_type_name(&overlay->item, name, &cfs_overlay_type);
++	return &overlay->item;
++}
++
++static void cfs_overlay_group_drop_item(struct config_group *group,
++		struct config_item *item)
++{
++	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
++
++	config_item_put(&overlay->item);
++}
++
++static struct configfs_group_operations overlays_ops = {
++	.make_item	= cfs_overlay_group_make_item,
++	.drop_item	= cfs_overlay_group_drop_item,
++};
++
++static struct config_item_type overlays_type = {
++	.ct_group_ops   = &overlays_ops,
++	.ct_owner       = THIS_MODULE,
++};
++
++static struct configfs_group_operations of_cfs_ops = {
++	/* empty - we don't allow anything to be created */
++};
++
++static struct config_item_type of_cfs_type = {
++	.ct_group_ops   = &of_cfs_ops,
++	.ct_owner       = THIS_MODULE,
++};
++
++struct config_group of_cfs_overlay_group;
++
++static struct configfs_subsystem of_cfs_subsys = {
++	.su_group = {
++		.cg_item = {
++			.ci_namebuf = "device-tree",
++			.ci_type = &of_cfs_type,
++		},
++	},
++	.su_mutex = __MUTEX_INITIALIZER(of_cfs_subsys.su_mutex),
++};
++
++static int __init of_cfs_init(void)
++{
++	int ret;
++
++	pr_info("%s\n", __func__);
++
++	config_group_init(&of_cfs_subsys.su_group);
++	config_group_init_type_name(&of_cfs_overlay_group, "overlays",
++			&overlays_type);
++	configfs_add_default_group(&of_cfs_overlay_group,
++			&of_cfs_subsys.su_group);
++
++	ret = configfs_register_subsystem(&of_cfs_subsys);
++	if (ret != 0) {
++		pr_err("%s: failed to register subsys\n", __func__);
++		goto out;
++	}
++	pr_info("%s: OK\n", __func__);
++out:
++	return ret;
++}
++late_initcall(of_cfs_init);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0077-brcm-adds-support-for-BCM43341-wifi.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0077-brcm-adds-support-for-BCM43341-wifi.patch
new file mode 100644
index 00000000..07cc7b32
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0077-brcm-adds-support-for-BCM43341-wifi.patch
@@ -0,0 +1,102 @@
+From 111148df28ac59821f28f19727fe41d3b54ebb1a Mon Sep 17 00:00:00 2001
+From: Cheong2K <cheong@redbear.cc>
+Date: Fri, 26 Feb 2016 18:20:10 +0800
+Subject: [PATCH 077/697] brcm: adds support for BCM43341 wifi
+
+brcmfmac: Disable power management
+
+Disable wireless power saving in the brcmfmac WLAN driver. This is a
+temporary measure until the connectivity loss resulting from power
+saving is resolved.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+brcmfmac: Use original country code as a fallback
+
+Commit 73345fd212980d2e28a5c6d83801c903bd773680:
+
+    brcmfmac: Configure country code using device specific settings
+
+prevents region codes from working on devices that lack a region code
+translation table. In the event of an absent table, preserve the old
+behaviour of using the provided code as-is.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+brcmfmac: Plug memory leak in brcmf_fill_bss_param
+
+See: https://github.com/raspberrypi/linux/issues/1471
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+brcmfmac: do not use internal roaming engine by default
+
+Some evidence of curing disconnects with this disabled, so make it a default.
+Can be overridden with module parameter roamoff=0
+See: http://projectable.me/optimize-my-pi-wi-fi/
+
+brcmfmac: Change stop_ap sequence
+
+Patch from Broadcom/Cypress to resolve a customer error
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+Revert "brcmfmac: Disable power management"
+
+Shortly after the release of the Pi 3B, a loss of SSH connectivity
+over WiFi was traced to the power management handling, so power
+management was disabled. And so it has remained ever since.
+
+Enabling power management saves 55mA (~270mW) on a Pi 4B, so is very
+much worth the minimal effort of reverting this patch, which was
+squashed and rebased many times since then to the commit hash is
+meaningless.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c   | 2 +-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c     | 3 ++-
+ 3 files changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -3299,7 +3299,7 @@ brcmf_cfg80211_set_power_mgmt(struct wip
+ 		brcmf_dbg(INFO, "Do not enable power save for P2P clients\n");
+ 		pm = PM_OFF;
+ 	}
+-	brcmf_dbg(INFO, "power save %s\n", (pm ? "enabled" : "disabled"));
++	brcmf_err("power save %s\n", (pm ? "enabled" : "disabled"));
+ 
+ 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, pm);
+ 	if (err) {
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -59,7 +59,7 @@ static int brcmf_fcmode;
+ module_param_named(fcmode, brcmf_fcmode, int, 0);
+ MODULE_PARM_DESC(fcmode, "Mode of firmware signalled flow control");
+ 
+-static int brcmf_roamoff;
++static int brcmf_roamoff = 1;
+ module_param_named(roamoff, brcmf_roamoff, int, 0400);
+ MODULE_PARM_DESC(roamoff, "Do not use internal roaming engine");
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -609,6 +609,7 @@ BRCMF_FW_DEF(4329, "brcmfmac4329-sdio");
+ BRCMF_FW_DEF(4330, "brcmfmac4330-sdio");
+ BRCMF_FW_DEF(4334, "brcmfmac4334-sdio");
+ BRCMF_FW_DEF(43340, "brcmfmac43340-sdio");
++BRCMF_FW_DEF(43341, "brcmfmac43341-sdio");
+ BRCMF_FW_DEF(4335, "brcmfmac4335-sdio");
+ BRCMF_FW_DEF(43362, "brcmfmac43362-sdio");
+ BRCMF_FW_DEF(4339, "brcmfmac4339-sdio");
+@@ -641,7 +642,7 @@ static const struct brcmf_firmware_mappi
+ 	BRCMF_FW_ENTRY(BRCM_CC_4330_CHIP_ID, 0xFFFFFFFF, 4330),
+ 	BRCMF_FW_ENTRY(BRCM_CC_4334_CHIP_ID, 0xFFFFFFFF, 4334),
+ 	BRCMF_FW_ENTRY(BRCM_CC_43340_CHIP_ID, 0xFFFFFFFF, 43340),
+-	BRCMF_FW_ENTRY(BRCM_CC_43341_CHIP_ID, 0xFFFFFFFF, 43340),
++	BRCMF_FW_ENTRY(BRCM_CC_43341_CHIP_ID, 0xFFFFFFFF, 43341),
+ 	BRCMF_FW_ENTRY(BRCM_CC_4335_CHIP_ID, 0xFFFFFFFF, 4335),
+ 	BRCMF_FW_ENTRY(BRCM_CC_43362_CHIP_ID, 0xFFFFFFFE, 43362),
+ 	BRCMF_FW_ENTRY(BRCM_CC_4339_CHIP_ID, 0xFFFFFFFF, 4339),
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0078-hci_h5-Don-t-send-conf_req-when-ACTIVE.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0078-hci_h5-Don-t-send-conf_req-when-ACTIVE.patch
new file mode 100644
index 00000000..d5e0c265
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0078-hci_h5-Don-t-send-conf_req-when-ACTIVE.patch
@@ -0,0 +1,23 @@
+From 556ef1576e1a0353e94ab2a28ceb37e5887e96eb Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Thu, 17 Dec 2015 13:37:07 +0000
+Subject: [PATCH 078/697] hci_h5: Don't send conf_req when ACTIVE
+
+Without this patch, a modem and kernel can continuously bombard each
+other with conf_req and conf_rsp messages, in a demented game of tag.
+---
+ drivers/bluetooth/hci_h5.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/bluetooth/hci_h5.c
++++ b/drivers/bluetooth/hci_h5.c
+@@ -358,7 +358,8 @@ static void h5_handle_internal_rx(struct
+ 		h5_link_control(hu, conf_req, 3);
+ 	} else if (memcmp(data, conf_req, 2) == 0) {
+ 		h5_link_control(hu, conf_rsp, 2);
+-		h5_link_control(hu, conf_req, 3);
++		if (h5->state != H5_ACTIVE)
++		    h5_link_control(hu, conf_req, 3);
+ 	} else if (memcmp(data, conf_rsp, 2) == 0) {
+ 		if (H5_HDR_LEN(hdr) > 2)
+ 			h5->tx_win = (data[2] & 0x07);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0079-ARM64-Round-Robin-dispatch-IRQs-between-CPUs.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0079-ARM64-Round-Robin-dispatch-IRQs-between-CPUs.patch
new file mode 100644
index 00000000..9322936f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0079-ARM64-Round-Robin-dispatch-IRQs-between-CPUs.patch
@@ -0,0 +1,138 @@
+From 9d49c9632feb3e9037ccd7cfe629b4c65e1c2c1c Mon Sep 17 00:00:00 2001
+From: Michael Zoran <mzoran@crowfest.net>
+Date: Sat, 14 Jan 2017 21:43:57 -0800
+Subject: [PATCH 079/697] ARM64: Round-Robin dispatch IRQs between CPUs.
+
+IRQ-CPU mapping is round robined on ARM64 to increase
+concurrency and allow multiple interrupts to be serviced
+at a time.  This reduces the need for FIQ.
+
+Signed-off-by: Michael Zoran <mzoran@crowfest.net>
+
+drivers: irqchip: irq-bcm2835: Concurrency fix
+
+The commit shown in Fixes: aims to improve interrupt throughput by
+getting the handlers invoked on different CPU cores. It does so (*) by
+using an irq_ack hook to change the interrupt routing.
+
+Unfortunately, the IRQ status bits must be cleared at source, which only
+happens once the interrupt handler has run - there is no easy way for
+one core to claim one of the IRQs before sending the remainder to the
+next core on the list, so waking another core immediately results in a
+race with a chance of both cores handling the same IRQ. It is probably
+for this reason that the routing change is deferred to irq_ack, but that
+doesn't guarantee no clashes - after irq_ack is called, control returns
+to bcm2836_chained_handler_irq which proceeds to check for other pending
+IRQs at a time when the next core is probably doing the same thing.
+
+Since the whole point of the original commit is to distribute the IRQ
+handling, there is no reason to attempt to handle multiple IRQs in one
+interrupt callback, so the problem can be solved (or at least made much
+harder to reproduce) by changing a "while" into an "if", so that each
+invocation only handles one IRQ.
+
+(*) I'm not convinced it's as effective as claimed since irq_ack is
+called _after_ the interrupt handler, but the author thought it made a
+difference.
+
+See: https://github.com/raspberrypi/linux/issues/5214
+     https://github.com/raspberrypi/linux/pull/1794
+
+Fixes: fd4c9785bde8 ("ARM64: Round-Robin dispatch IRQs between CPUs.")
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+irqchip: irq-bcm2836: Avoid prototype warning
+
+Declare bcm2836_arm_irqchip_spin_gpu_irq in irq-bcm2836.h to avoid a
+compiler warning about a missing prototype.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/irqchip/irq-bcm2835.c       | 16 +++++++++++++++-
+ drivers/irqchip/irq-bcm2836.c       | 21 +++++++++++++++++++++
+ include/linux/irqchip/irq-bcm2836.h |  2 ++
+ 3 files changed, 38 insertions(+), 1 deletion(-)
+
+--- a/drivers/irqchip/irq-bcm2835.c
++++ b/drivers/irqchip/irq-bcm2835.c
+@@ -40,6 +40,7 @@
+ #include <linux/of_address.h>
+ #include <linux/of_irq.h>
+ #include <linux/irqchip.h>
++#include <linux/irqchip/irq-bcm2836.h>
+ #include <linux/irqdomain.h>
+ 
+ #include <asm/exception.h>
+@@ -154,12 +155,24 @@ static void armctrl_unmask_irq(struct ir
+ 	}
+ }
+ 
++#ifdef CONFIG_ARM64
++
++static void armctrl_ack_irq(struct irq_data *d)
++{
++	bcm2836_arm_irqchip_spin_gpu_irq();
++}
++
++#endif
++
+ static struct irq_chip armctrl_chip = {
+ 	.name = "ARMCTRL-level",
+ 	.irq_mask = armctrl_mask_irq,
+ 	.irq_unmask = armctrl_unmask_irq,
+ 	.flags = IRQCHIP_MASK_ON_SUSPEND |
+ 		 IRQCHIP_SKIP_SET_WAKE,
++#ifdef CONFIG_ARM64
++	.irq_ack    = armctrl_ack_irq
++#endif
+ };
+ 
+ static int armctrl_xlate(struct irq_domain *d, struct device_node *ctrlr,
+@@ -332,7 +345,8 @@ static void bcm2836_chained_handle_irq(s
+ {
+ 	u32 hwirq;
+ 
+-	while ((hwirq = get_next_armctrl_hwirq()) != ~0)
++	hwirq = get_next_armctrl_hwirq();
++	if (hwirq != ~0)
+ 		generic_handle_domain_irq(intc.domain, hwirq);
+ }
+ 
+--- a/drivers/irqchip/irq-bcm2836.c
++++ b/drivers/irqchip/irq-bcm2836.c
+@@ -87,6 +87,27 @@ static void bcm2836_arm_irqchip_unmask_g
+ {
+ }
+ 
++#ifdef CONFIG_ARM64
++
++void bcm2836_arm_irqchip_spin_gpu_irq(void)
++{
++	u32 i;
++	void __iomem *gpurouting = (intc.base + LOCAL_GPU_ROUTING);
++	u32 routing_val = readl(gpurouting);
++
++	for (i = 1; i <= 3; i++) {
++		u32 new_routing_val = (routing_val + i) & 3;
++
++		if (cpu_active(new_routing_val)) {
++			writel(new_routing_val, gpurouting);
++			return;
++		}
++	}
++}
++EXPORT_SYMBOL(bcm2836_arm_irqchip_spin_gpu_irq);
++
++#endif
++
+ static struct irq_chip bcm2836_arm_irqchip_gpu = {
+ 	.name		= "bcm2836-gpu",
+ 	.irq_mask	= bcm2836_arm_irqchip_mask_gpu_irq,
+--- a/include/linux/irqchip/irq-bcm2836.h
++++ b/include/linux/irqchip/irq-bcm2836.h
+@@ -59,3 +59,5 @@
+ #define LOCAL_IRQ_GPU_FAST	8
+ #define LOCAL_IRQ_PMU_FAST	9
+ #define LAST_IRQ		LOCAL_IRQ_PMU_FAST
++
++void bcm2836_arm_irqchip_spin_gpu_irq(void);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0080-ARM64-Force-hardware-emulation-of-deprecated-instruc.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0080-ARM64-Force-hardware-emulation-of-deprecated-instruc.patch
new file mode 100644
index 00000000..a91bddd5
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0080-ARM64-Force-hardware-emulation-of-deprecated-instruc.patch
@@ -0,0 +1,27 @@
+From c4d6ab27980e6ca023af27d9de3fba173276a922 Mon Sep 17 00:00:00 2001
+From: Michael Zoran <mzoran@crowfest.net>
+Date: Sat, 11 Feb 2017 01:18:31 -0800
+Subject: [PATCH 080/697] ARM64: Force hardware emulation of deprecated
+ instructions.
+
+---
+ arch/arm64/kernel/armv8_deprecated.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/arch/arm64/kernel/armv8_deprecated.c
++++ b/arch/arm64/kernel/armv8_deprecated.c
+@@ -540,9 +540,14 @@ static void __init register_insn_emulati
+ 
+ 	switch (insn->status) {
+ 	case INSN_DEPRECATED:
++#if 0
+ 		insn->current_mode = INSN_EMULATE;
+ 		/* Disable the HW mode if it was turned on at early boot time */
+ 		run_all_cpu_set_hw_mode(insn, false);
++#else
++		insn->current_mode = INSN_HW;
++		run_all_cpu_set_hw_mode(insn, true);
++#endif
+ 		insn->max = INSN_HW;
+ 		break;
+ 	case INSN_OBSOLETE:
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0081-AXI-performance-monitor-driver-2222.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0081-AXI-performance-monitor-driver-2222.patch
new file mode 100644
index 00000000..e0b2eee7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0081-AXI-performance-monitor-driver-2222.patch
@@ -0,0 +1,887 @@
+From 5a907fe6189e15007f7c56203cae757ca09c18b8 Mon Sep 17 00:00:00 2001
+From: James Hughes <JamesH65@users.noreply.github.com>
+Date: Tue, 14 Nov 2017 15:13:15 +0000
+Subject: [PATCH 081/697] AXI performance monitor driver (#2222)
+
+Uses the debugfs I/F to provide access to the AXI
+bus performance monitors.
+
+Requires the new mailbox peripheral access for access
+to the VPU performance registers, system bus access
+is done using direct register reads.
+
+Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
+
+raspberrypi_axi_monitor: suppress warning
+
+Suppress the following warning by casting the pointer to and uintptr_t
+before to u32:
+
+Signed-off-by: Matteo Croce <mcroce@redhat.com>
+
+perf/raspberry: Add support for 2712 axi performance monitors
+
+Also handle 2711 correctly which has a different configuration
+from 2835.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/perf/Kconfig                   |   8 +
+ drivers/perf/Makefile                  |   1 +
+ drivers/perf/raspberrypi_axi_monitor.c | 826 +++++++++++++++++++++++++
+ 3 files changed, 835 insertions(+)
+ create mode 100644 drivers/perf/raspberrypi_axi_monitor.c
+
+--- a/drivers/perf/Kconfig
++++ b/drivers/perf/Kconfig
+@@ -251,6 +251,14 @@ config ALIBABA_UNCORE_DRW_PMU
+ 	  Support for Driveway PMU events monitoring on Yitian 710 DDR
+ 	  Sub-system.
+ 
++config RPI_AXIPERF
++        depends on ARCH_BCM2835
++        tristate "RaspberryPi AXI Performance monitors"
++        default n
++        help
++          Say y if you want to use Raspberry Pi AXI performance monitors, m if
++          you want to build it as a module.
++
+ source "drivers/perf/hisilicon/Kconfig"
+ 
+ config MARVELL_CN10K_DDR_PMU
+--- a/drivers/perf/Makefile
++++ b/drivers/perf/Makefile
+@@ -32,3 +32,4 @@ obj-$(CONFIG_DWC_PCIE_PMU) += dwc_pcie_p
+ obj-$(CONFIG_ARM_CORESIGHT_PMU_ARCH_SYSTEM_PMU) += arm_cspmu/
+ obj-$(CONFIG_MESON_DDR_PMU) += amlogic/
+ obj-$(CONFIG_CXL_PMU) += cxl_pmu.o
++obj-$(CONFIG_RPI_AXIPERF) += raspberrypi_axi_monitor.o
+--- /dev/null
++++ b/drivers/perf/raspberrypi_axi_monitor.c
+@@ -0,0 +1,826 @@
++/*
++ * raspberrypi_axi_monitor.c
++ *
++ * Author: james.hughes@raspberrypi.org
++ *
++ * Raspberry Pi AXI performance counters.
++ *
++ * Copyright (C) 2017 Raspberry Pi Trading Ltd.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/debugfs.h>
++#include <linux/devcoredump.h>
++#include <linux/device.h>
++#include <linux/kthread.h>
++#include <linux/module.h>
++#include <linux/netdevice.h>
++#include <linux/mutex.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++
++#include <soc/bcm2835/raspberrypi-firmware.h>
++
++#define NUM_MONITORS 2
++#define NUM_BUS_WATCHERS_PER_MONITOR 3
++
++#define SYSTEM_MONITOR 0
++#define VPU_MONITOR 1
++
++#define MAX_BUSES 16
++#define DEFAULT_SAMPLE_TIME 100
++
++#define NUM_BUS_WATCHER_RESULTS 11
++
++struct bus_watcher_data {
++	union	{
++		u32 results[NUM_BUS_WATCHER_RESULTS];
++		struct {
++			u32 atrans;
++			u32 atwait;
++			u32 amax;
++			u32 wtrans;
++			u32 wtwait;
++			u32 wmax;
++			u32 rtrans;
++			u32 rtwait;
++			u32 rmax;
++			u32 rpend;
++			u32 ratrans;
++		};
++	};
++};
++
++
++struct rpi_axiperf {
++	struct platform_device *dev;
++	struct dentry *root_folder;
++
++	struct task_struct *monitor_thread;
++	struct mutex lock;
++
++	struct rpi_firmware *firmware;
++
++	/* Sample time spent on for each bus */
++	int sample_time;
++
++	/* chip specific bus config */
++	const struct bwconfig_config *config;
++
++	/* Now storage for the per monitor settings and the resulting
++	 * performance figures
++	 */
++	struct {
++		/* Bit field of buses we want to monitor */
++		int bus_enabled;
++		/* Bit field of buses to filter by */
++		int bus_filter;
++		/* The current buses being monitored on this monitor */
++		int current_bus[NUM_BUS_WATCHERS_PER_MONITOR];
++		/* The last bus monitored on this monitor */
++		int last_monitored;
++
++		/* Set true if this mailbox must use the mailbox interface
++		 * rather than access registers directly.
++		 */
++		int use_mailbox_interface;
++
++		/* Current result values */
++		struct bus_watcher_data results[MAX_BUSES];
++
++		struct dentry *debugfs_entry;
++		void __iomem *base_address;
++
++	}  monitor[NUM_MONITORS];
++
++};
++
++static struct rpi_axiperf *state;
++
++/* Two monitors, System and VPU, each with the following register sets.
++ * Each monitor can only monitor one bus at a time, so we time share them,
++ * giving each bus 100ms (default, settable via debugfs) of time on its
++ * associated monitor
++ * Record results from the three Bus watchers per monitor and push to the sysfs
++ */
++
++/* general registers */
++const int GEN_CTRL;
++
++const int GEN_CTL_ENABLE_BIT	= BIT(0);
++const int GEN_CTL_RESET_BIT	= BIT(1);
++const int GEN_CTL_WATCH_BIT	= BIT(2);
++
++/* Bus watcher registers */
++const int BW_PITCH		= 0x40;
++
++const int BW0_CTRL		= 0x40;
++const int BW1_CTRL		= 0x80;
++const int BW2_CTRL		= 0xc0;
++
++const int BW_ATRANS_OFFSET	= 0x04;
++const int BW_ATWAIT_OFFSET	= 0x08;
++const int BW_AMAX_OFFSET	= 0x0c;
++const int BW_WTRANS_OFFSET	= 0x10;
++const int BW_WTWAIT_OFFSET	= 0x14;
++const int BW_WMAX_OFFSET	= 0x18;
++const int BW_RTRANS_OFFSET	= 0x1c;
++const int BW_RTWAIT_OFFSET	= 0x20;
++const int BW_RMAX_OFFSET	= 0x24;
++
++const int BW_CTRL_RESET_BIT	= BIT(31);
++const int BW_CTRL_ENABLE_BIT	= BIT(30);
++const int BW_CTRL_ENABLE_ID_FILTER_BIT	= BIT(29);
++const int BW_CTRL_LIMIT_HALT_BIT	= BIT(28);
++
++const int BW_CTRL_SOURCE_SHIFT	= 8;
++const int BW_CTRL_SOURCE_MASK	= GENMASK(12, 8); // 5 bits
++const int BW_CTRL_BUS_WATCH_SHIFT;
++const int BW_CTRL_BUS_WATCH_MASK = GENMASK(5, 0); // 6 bits
++const int BW_CTRL_BUS_FILTER_SHIFT = 8;
++
++static const char *bus_filter_strings[] = {
++	"",
++	"CORE0_V",
++	"ICACHE0",
++	"DCACHE0",
++	"CORE1_V",
++	"ICACHE1",
++	"DCACHE1",
++	"L2_MAIN",
++	"HOST_PORT",
++	"HOST_PORT2",
++	"HVS",
++	"ISP",
++	"VIDEO_DCT",
++	"VIDEO_SD2AXI",
++	"CAM0",
++	"CAM1",
++	"DMA0",
++	"DMA1",
++	"DMA2_VPU",
++	"JPEG",
++	"VIDEO_CME",
++	"TRANSPOSER",
++	"VIDEO_FME",
++	"CCP2TX",
++	"USB",
++	"V3D0",
++	"V3D1",
++	"V3D2",
++	"AVE",
++	"DEBUG",
++	"CPU",
++	"M30"
++};
++
++static const char * const bus_filter_strings_2711[] = {
++	"AIO",
++	"CORE0_V",
++	"ICACHE0",
++	"DCACHE0",
++	"CORE1_V",
++	"ICACHE1",
++	"DCACHE1",
++	"L2_MAIN",
++	"ARGON",
++	"PCIE",
++	"HVS",
++	"ISP",
++	"VIDEO_DCT",
++	"VIDEO_SD2AXI",
++	"CAM0",
++	"CAM1",
++	"DMA0",
++	"DMA1",
++	"DMA2",
++	"JPEG",
++	"VIDEO_CME",
++	"TRANSPOSER",
++	"VIDEO_FME",
++	"GIGE",
++	"USB",
++	"V3D0",
++	"V3D1",
++	"V3D2",
++	"GISB_AXI",
++	"DEBUG",
++	"ARM",
++	"EMMCSTB",
++};
++
++static const char * const bus_filter_strings_2712[] = {
++	"",
++	"VPU_UC0",
++	"VPU_IC0",
++	"VPU_DC0",
++	"VPU_UC1",
++	"VPU_IC1",
++	"VPU_DC1",
++	"VPU_L2",
++	"DMA2",
++	"VPU_DEBUG",
++	"ARM",
++	"DMA0",
++	"DMA1",
++	"RAAGA",
++	"BBSI",
++	"PCIE0",
++	"PCIE1",
++	"PCIE2",
++	"UMR",
++	"SAGE",
++	"HVDP",
++	"BSP",
++	"HVS",
++	"HVS_WMK",
++	"MOP0",
++	"MOP1",
++	"MBVN",
++	"DSI",
++	"XPT",
++	"EMMC0",
++	"GENET",
++	"USB",
++	"ARGON",
++	"UNICAM",
++	"PISP",
++	"PISPFE",
++	"JPEG",
++	"EMMC1",
++	"EMMC2",
++	"TRC",
++	"BSTM0",
++	"BSTM1",
++	"BSTM0_SEC",
++	"BSTM1_SEC",
++	"AIO",
++	"MAP",
++	"SYS_DMA",
++	"MMUCACHE0",
++	"MMUCACHE1",
++	"MPUCACHE0",
++	"MPUCACHE1",
++};
++
++static const char *system_bus_string[] = {
++	"DMA_L2",
++	"TRANS",
++	"JPEG",
++	"SYSTEM_UC",
++	"DMA_UC",
++	"SYSTEM_L2",
++	"CCP2TX",
++	"MPHI_RX",
++	"MPHI_TX",
++	"HVS",
++	"H264",
++	"ISP",
++	"V3D",
++	"PERIPHERAL",
++	"CPU_UC",
++	"CPU_L2"
++};
++
++static const char * const system_bus_string_2711[] = {
++	"DMA_L2",
++	"TRANS",
++	"JPEG",
++	"VPU_UC",
++	"DMA_UC",
++	"SYSTEM_L2",
++	"HVS",
++	"ARGON",
++	"H264",
++	"PERIPHERAL",
++	"ARM_UC",
++	"ARM_L2",
++};
++
++static const char * const system_bus_string_2712[] = {
++	"VPU_UC",
++	"DISPLAY_TOP",
++	"V3D",
++	"ARM",
++	"XPT",
++	"BSTM_TOP",
++	"PCIE_01",
++	"ARGON_TOP",
++	"ARB3",
++	"SRC",
++	"HVDP",
++	"PER",
++	"SYSTEM_L2",
++};
++
++static const char *vpu_bus_string[] = {
++	"VPU1_D_L2",
++	"VPU0_D_L2",
++	"VPU1_I_L2",
++	"VPU0_I_L2",
++	"SYSTEM_L2",
++	"L2_FLUSH",
++	"DMA_L2",
++	"VPU1_D_UC",
++	"VPU0_D_UC",
++	"VPU1_I_UC",
++	"VPU0_I_UC",
++	"SYSTEM_UC",
++	"L2_OUT",
++	"DMA_UC",
++	"SDRAM",
++	"L2_IN"
++};
++
++static const char * const vpu_bus_string_2711[] = {
++	"VPU1_D_L2",
++	"VPU0_D_L2",
++	"VPU1_I_L2",
++	"VPU0_I_L2",
++	"SYSTEM_L2",
++	"DMA_L2",
++	"VPU1_D_UC",
++	"VPU0_D_UC",
++	"VPU1_I_UC",
++	"VPU0_I_UC",
++	"VPU_UC",
++	"L2_OUT",
++	"DMA_UC",
++	"L2_IN"
++};
++
++static const char * const vpu_bus_string_2712[] = {
++	"VPU1_D_L2",
++	"VPU0_D_L2",
++	"VPU1_I_L2",
++	"VPU0_I_L2",
++	"SYSTEM_L2",
++	"DMA_L2",
++	"VPU1_D_UC",
++	"VPU0_D_UC",
++	"VPU1_I_UC",
++	"VPU0_I_UC",
++	"VPU_UC",
++	"L2_OUT",
++	"DMA_UC",
++	"L2_IN"
++};
++
++struct bwconfig_config {
++	const char * const *bus_filter_strings;
++	const int num_bus_filters;
++	const char * const *system_bus_string;
++	const int num_system_buses;
++	const char * const *vpu_bus_string;
++	const int num_vpu_buses;
++};
++
++static const struct bwconfig_config config_2835 = {
++	bus_filter_strings, ARRAY_SIZE(bus_filter_strings),
++	system_bus_string, ARRAY_SIZE(system_bus_string),
++	vpu_bus_string, ARRAY_SIZE(vpu_bus_string),
++};
++
++static const struct bwconfig_config config_2711 = {
++	bus_filter_strings_2711, ARRAY_SIZE(bus_filter_strings_2711),
++	system_bus_string_2711, ARRAY_SIZE(system_bus_string_2711),
++	vpu_bus_string_2711, ARRAY_SIZE(vpu_bus_string_2711),
++};
++
++static const struct bwconfig_config config_2712 = {
++	bus_filter_strings_2712, ARRAY_SIZE(bus_filter_strings_2712),
++	system_bus_string_2712, ARRAY_SIZE(system_bus_string_2712),
++	vpu_bus_string_2712, ARRAY_SIZE(vpu_bus_string_2712),
++};
++
++static const char *monitor_name[] = {
++	"System",
++	"VPU"
++};
++
++static inline void write_reg(int monitor, int reg, u32 value)
++{
++	writel(value, state->monitor[monitor].base_address + reg);
++}
++
++static inline u32 read_reg(int monitor, u32 reg)
++{
++	return readl(state->monitor[monitor].base_address + reg);
++}
++
++static void read_bus_watcher(int monitor, int watcher, u32 *results)
++{
++	if (state->monitor[monitor].use_mailbox_interface) {
++		/* We have NUM_BUS_WATCHER_RESULTS results, plus the overheads
++		 * of start address and length
++		 */
++		u32 tmp[NUM_BUS_WATCHER_RESULTS+2];
++		int err;
++
++		tmp[0] = (u32)(uintptr_t)(state->monitor[monitor].base_address + watcher
++				+ BW_ATRANS_OFFSET);
++		tmp[1] = NUM_BUS_WATCHER_RESULTS;
++
++		err = rpi_firmware_property(state->firmware,
++					    RPI_FIRMWARE_GET_PERIPH_REG,
++					    tmp, sizeof(tmp));
++
++		if (err < 0 || tmp[1] != NUM_BUS_WATCHER_RESULTS)
++			dev_err_once(&state->dev->dev,
++				     "Failed to read bus watcher");
++		else
++			memcpy(results, &tmp[2],
++			       NUM_BUS_WATCHER_RESULTS * sizeof(u32));
++	} else {
++		int i;
++		void __iomem *addr = state->monitor[monitor].base_address
++				+ watcher + BW_ATRANS_OFFSET;
++		for (i = 0; i < NUM_BUS_WATCHER_RESULTS; i++, addr += 4)
++			*results++ = readl(addr);
++	}
++}
++
++static void set_monitor_control(int monitor, u32 set)
++{
++	if (state->monitor[monitor].use_mailbox_interface) {
++		u32 tmp[3] = {(u32)(uintptr_t)(state->monitor[monitor].base_address +
++				GEN_CTRL), 1, set};
++		int err = rpi_firmware_property(state->firmware,
++						RPI_FIRMWARE_SET_PERIPH_REG,
++						tmp, sizeof(tmp));
++
++		if (err < 0 || tmp[1] != 1)
++			dev_err_once(&state->dev->dev,
++				"Failed to set monitor control");
++	} else
++		write_reg(monitor, GEN_CTRL, set);
++}
++
++static void set_bus_watcher_control(int monitor, int watcher, u32 set)
++{
++	if (state->monitor[monitor].use_mailbox_interface) {
++		u32 tmp[3] = {(u32)(uintptr_t)(state->monitor[monitor].base_address +
++				    watcher), 1, set};
++		int err = rpi_firmware_property(state->firmware,
++						RPI_FIRMWARE_SET_PERIPH_REG,
++						tmp, sizeof(tmp));
++		if (err < 0 || tmp[1] != 1)
++			dev_err_once(&state->dev->dev,
++				"Failed to set bus watcher control");
++	} else
++		write_reg(monitor, watcher, set);
++}
++
++static void monitor(struct rpi_axiperf *state)
++{
++	int monitor, num_buses[NUM_MONITORS];
++
++	mutex_lock(&state->lock);
++
++	for (monitor = 0; monitor < NUM_MONITORS; monitor++) {
++		typeof(state->monitor[0]) *mon = &(state->monitor[monitor]);
++
++		/* Anything enabled? */
++		if (mon->bus_enabled == 0) {
++			/* No, disable all monitoring for this monitor */
++			set_monitor_control(monitor, GEN_CTL_RESET_BIT);
++		} else {
++			int i;
++
++			/* Find out how many busses we want to monitor, and
++			 * spread our 3 actual monitors over them
++			 */
++			num_buses[monitor] = hweight32(mon->bus_enabled);
++			num_buses[monitor] = min(num_buses[monitor],
++						 NUM_BUS_WATCHERS_PER_MONITOR);
++
++			for (i = 0; i < num_buses[monitor]; i++) {
++				int bus_control;
++
++				do {
++					mon->last_monitored++;
++					mon->last_monitored &= 0xf;
++				} while ((mon->bus_enabled &
++					 (1 << mon->last_monitored)) == 0);
++
++				mon->current_bus[i] = mon->last_monitored;
++
++				/* Reset the counters */
++				set_bus_watcher_control(monitor,
++							BW0_CTRL +
++							i*BW_PITCH,
++							BW_CTRL_RESET_BIT);
++
++				bus_control = BW_CTRL_ENABLE_BIT |
++						mon->current_bus[i];
++
++				if (mon->bus_filter) {
++					bus_control |=
++						BW_CTRL_ENABLE_ID_FILTER_BIT;
++					bus_control |=
++						((mon->bus_filter & 0x1f)
++						<< BW_CTRL_BUS_FILTER_SHIFT);
++				}
++
++				// Start capture
++				set_bus_watcher_control(monitor,
++							BW0_CTRL + i*BW_PITCH,
++							bus_control);
++			}
++		}
++
++		/* start monitoring */
++		set_monitor_control(monitor, GEN_CTL_ENABLE_BIT | GEN_CTL_WATCH_BIT);
++	}
++
++	mutex_unlock(&state->lock);
++
++	msleep(state->sample_time);
++
++	/* Now read the results */
++
++	mutex_lock(&state->lock);
++	for (monitor = 0; monitor < NUM_MONITORS; monitor++) {
++		typeof(state->monitor[0]) *mon = &(state->monitor[monitor]);
++
++		/* Anything enabled? */
++		if (mon->bus_enabled == 0) {
++			/* No, disable all monitoring for this monitor */
++			set_monitor_control(monitor, 0);
++		} else {
++			int i;
++
++			for (i = 0; i < num_buses[monitor]; i++) {
++				int bus = mon->current_bus[i];
++
++				read_bus_watcher(monitor,
++					BW0_CTRL + i*BW_PITCH,
++					(u32 *)&mon->results[bus].results);
++			}
++		}
++	}
++	mutex_unlock(&state->lock);
++}
++
++static int monitor_thread(void *data)
++{
++	struct rpi_axiperf *state  = data;
++
++	while (1) {
++		monitor(state);
++
++		if (kthread_should_stop())
++			return 0;
++	}
++	return 0;
++}
++
++static ssize_t myreader(struct file *fp, char __user *user_buffer,
++			size_t count, loff_t *position)
++{
++#define INIT_BUFF_SIZE 2048
++
++	int i;
++	int idx = (int)(uintptr_t)(fp->private_data);
++	int num_buses, cnt;
++	char *string_buffer;
++	int buff_size = INIT_BUFF_SIZE;
++	char *p;
++	typeof(state->monitor[0]) *mon = &(state->monitor[idx]);
++	const struct bwconfig_config *config = state->config;
++
++	if (idx < 0 || idx > NUM_MONITORS)
++		idx = 0;
++
++	num_buses = idx == SYSTEM_MONITOR ? config->num_system_buses : config->num_vpu_buses;
++
++	string_buffer = kmalloc(buff_size, GFP_KERNEL);
++
++	if (!string_buffer) {
++		dev_err(&state->dev->dev,
++				"Failed temporary string allocation\n");
++		return 0;
++	}
++
++	p = string_buffer;
++
++	mutex_lock(&state->lock);
++
++	if (mon->bus_filter) {
++		int filt = min(mon->bus_filter & 0x1f, config->num_bus_filters);
++
++		cnt = snprintf(p, buff_size,
++			       "\nMonitoring transactions from %s only\n",
++			       config->bus_filter_strings[filt]);
++		p += cnt;
++		buff_size -= cnt;
++	}
++
++	cnt = snprintf(p, buff_size, "     Bus    |    Atrans    Atwait      AMax    Wtrans    Wtwait      WMax    Rtrans    Rtwait      RMax     RPend   RAtrans\n"
++				     "===========================================================================================================================\n");
++
++	if (cnt >= buff_size)
++		goto done;
++
++	p += cnt;
++	buff_size -= cnt;
++
++#define M(x) ((x) >= 1000000000 ? (x)/1000000 : (x) >= 1000 ? (x)/1000 : (x))
++#define N(x) ((x) >= 1000000000 ? 'M' : (x) >= 1000 ? 'K' : ' ')
++
++	for (i = 0; i < num_buses; i++) {
++		if (mon->bus_enabled & (1 << i)) {
++			typeof(mon->results[0]) *res = &(mon->results[i]);
++
++			cnt = snprintf(p, buff_size,
++					"%11s | %8u%c %8u%c %8u%c %8u%c %8u%c %8u%c %8u%c %8u%c %8u%c %8u%c %8u%c\n",
++					idx == SYSTEM_MONITOR ?
++						config->system_bus_string[i] :
++						config->vpu_bus_string[i],
++					M(res->atrans), N(res->atrans),
++					M(res->atwait), N(res->atwait),
++					M(res->amax), N(res->amax),
++					M(res->wtrans), N(res->wtrans),
++					M(res->wtwait), N(res->wtwait),
++					M(res->wmax), N(res->wmax),
++					M(res->rtrans), N(res->rtrans),
++					M(res->rtwait), N(res->rtwait),
++					M(res->rmax), N(res->rmax),
++					M(res->rpend), N(res->rpend),
++					M(res->ratrans), N(res->ratrans)
++					);
++			if (cnt >= buff_size)
++				goto done;
++
++			p += cnt;
++			buff_size -= cnt;
++		}
++	}
++
++	mutex_unlock(&state->lock);
++
++done:
++
++	/* did the last string entry exceeed our buffer size? ie out of string
++	 * buffer space. Null terminate, use what we have.
++	 */
++	if (cnt >= buff_size) {
++		buff_size = 0;
++		string_buffer[INIT_BUFF_SIZE] = 0;
++	}
++
++	cnt = simple_read_from_buffer(user_buffer, count, position,
++				      string_buffer,
++				      INIT_BUFF_SIZE - buff_size);
++
++	kfree(string_buffer);
++
++	return cnt;
++}
++
++static ssize_t mywriter(struct file *fp, const char __user *user_buffer,
++			size_t count, loff_t *position)
++{
++	int idx = (int)(uintptr_t)(fp->private_data);
++
++	if (idx < 0 || idx > NUM_MONITORS)
++		idx = 0;
++
++	/* At the moment, this does nothing, but in the future it could be
++	 * used to reset counters etc
++	 */
++	return count;
++}
++
++static const struct file_operations fops_debug = {
++	.read = myreader,
++	.write = mywriter,
++	.open = simple_open
++};
++
++static int rpi_axiperf_probe(struct platform_device *pdev)
++{
++	int ret = 0, i;
++	struct device *dev = &pdev->dev;
++	struct device_node *np = dev->of_node;
++	struct device_node *fw_node;
++
++	state = kzalloc(sizeof(struct rpi_axiperf), GFP_KERNEL);
++	if (!state)
++		return -ENOMEM;
++
++	state->config = of_device_get_match_data(dev);
++	if (!state->config)
++		return -EINVAL;
++
++	/* Get the firmware handle for future rpi-firmware-xxx calls */
++	fw_node = of_parse_phandle(np, "firmware", 0);
++	if (!fw_node) {
++		dev_err(dev, "Missing firmware node\n");
++		return -ENOENT;
++	}
++
++	state->firmware = rpi_firmware_get(fw_node);
++	if (!state->firmware)
++		return -EPROBE_DEFER;
++
++	/* Special case for the VPU monitor, we must use the mailbox interface
++	 * as it is not accessible from the ARM address space.
++	 */
++	state->monitor[VPU_MONITOR].use_mailbox_interface = 1;
++	state->monitor[SYSTEM_MONITOR].use_mailbox_interface = 0;
++
++	for (i = 0; i < NUM_MONITORS; i++) {
++		if (state->monitor[i].use_mailbox_interface) {
++			 of_property_read_u32_index(np, "reg", i*2,
++				(u32 *)(&state->monitor[i].base_address));
++		} else {
++			struct resource *resource =
++				platform_get_resource(pdev, IORESOURCE_MEM, i);
++
++			state->monitor[i].base_address =
++				devm_ioremap_resource(&pdev->dev, resource);
++		}
++
++		if (IS_ERR(state->monitor[i].base_address))
++			return PTR_ERR(state->monitor[i].base_address);
++
++		/* Enable all buses by default */
++		state->monitor[i].bus_enabled = 0xffff;
++	}
++
++	state->dev = pdev;
++	platform_set_drvdata(pdev, state);
++
++	state->sample_time = DEFAULT_SAMPLE_TIME;
++
++	/* Set up all the debugfs stuff */
++	state->root_folder = debugfs_create_dir(KBUILD_MODNAME, NULL);
++
++	for (i = 0; i < NUM_MONITORS; i++) {
++		state->monitor[i].debugfs_entry =
++			debugfs_create_dir(monitor_name[i], state->root_folder);
++		if (IS_ERR(state->monitor[i].debugfs_entry))
++			state->monitor[i].debugfs_entry = NULL;
++
++		debugfs_create_file("data", 0444,
++				    state->monitor[i].debugfs_entry,
++				    (void *)(uintptr_t)i, &fops_debug);
++		debugfs_create_u32("enable", 0644,
++				   state->monitor[i].debugfs_entry,
++				   &state->monitor[i].bus_enabled);
++		debugfs_create_u32("filter", 0644,
++				   state->monitor[i].debugfs_entry,
++				   &state->monitor[i].bus_filter);
++		debugfs_create_u32("sample_time", 0644,
++				   state->monitor[i].debugfs_entry,
++				   &state->sample_time);
++	}
++
++	mutex_init(&state->lock);
++
++	state->monitor_thread = kthread_run(monitor_thread, state,
++					    "rpi-axiperfmon");
++
++	return ret;
++
++}
++
++static void rpi_axiperf_remove(struct platform_device *dev)
++{
++	kthread_stop(state->monitor_thread);
++
++	debugfs_remove_recursive(state->root_folder);
++	state->root_folder = NULL;
++}
++
++static const struct of_device_id rpi_axiperf_match[] = {
++	{ .compatible = "brcm,bcm2835-axiperf",
++	  .data = &config_2835 },
++	{ .compatible = "brcm,bcm2711-axiperf",
++	  .data = &config_2711 },
++	{ .compatible = "brcm,bcm2712-axiperf",
++	  .data = &config_2712 },
++	{},
++};
++MODULE_DEVICE_TABLE(of, rpi_axiperf_match);
++
++static struct platform_driver rpi_axiperf_driver  = {
++	.probe =	rpi_axiperf_probe,
++	.remove =	rpi_axiperf_remove,
++	.driver = {
++		.name   = "rpi-bcm2835-axiperf",
++		.of_match_table = of_match_ptr(rpi_axiperf_match),
++	},
++};
++
++module_platform_driver(rpi_axiperf_driver);
++
++/* Module information */
++MODULE_AUTHOR("James Hughes <james.hughes@raspberrypi.org>");
++MODULE_DESCRIPTION("RPI AXI Performance monitor driver");
++MODULE_LICENSE("GPL");
++
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0082-ARM-bcm2835-Set-Serial-number-and-Revision.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0082-ARM-bcm2835-Set-Serial-number-and-Revision.patch
new file mode 100644
index 00000000..adc64eaf
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0082-ARM-bcm2835-Set-Serial-number-and-Revision.patch
@@ -0,0 +1,63 @@
+From 503201eacd4f72aa986cc167909410c48f91025a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
+Date: Wed, 3 Jun 2015 12:26:13 +0200
+Subject: [PATCH 082/697] ARM: bcm2835: Set Serial number and Revision
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The VideoCore bootloader passes in Serial number and
+Revision number through Device Tree. Make these available to
+userspace through /proc/cpuinfo.
+
+Mainline status:
+
+There is a commit in linux-next that standardize passing the serial
+number through Device Tree (string: /serial-number):
+ARM: 8355/1: arch: Show the serial number from devicetree in cpuinfo
+
+There was an attempt to do the same with the revision number, but it
+didn't get in:
+[PATCH v2 1/2] arm: devtree: Set system_rev from DT revision
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+---
+ arch/arm/mach-bcm/board_bcm2835.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/arch/arm/mach-bcm/board_bcm2835.c
++++ b/arch/arm/mach-bcm/board_bcm2835.c
+@@ -6,12 +6,25 @@
+ #include <linux/init.h>
+ #include <linux/irqchip.h>
+ #include <linux/of_address.h>
++#include <asm/system_info.h>
+ 
+ #include <asm/mach/arch.h>
+ #include <asm/mach/map.h>
+ 
+ #include "platsmp.h"
+ 
++static void __init bcm2835_init(void)
++{
++	struct device_node *np = of_find_node_by_path("/system");
++	u32 val;
++	u64 val64;
++
++	if (!of_property_read_u32(np, "linux,revision", &val))
++		system_rev = val;
++	if (!of_property_read_u64(np, "linux,serial", &val64))
++		system_serial_low = val64;
++}
++
+ static const char * const bcm2835_compat[] = {
+ #ifdef CONFIG_ARCH_MULTI_V6
+ 	"brcm,bcm2835",
+@@ -24,6 +37,7 @@ static const char * const bcm2835_compat
+ };
+ 
+ DT_MACHINE_START(BCM2835, "BCM2835")
++	.init_machine = bcm2835_init,
+ 	.dt_compat = bcm2835_compat,
+ 	.smp = smp_ops(bcm2836_smp_ops),
+ MACHINE_END
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0083-dwc-otg-FIQ-Fix-bad-mode-in-data-abort-handler.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0083-dwc-otg-FIQ-Fix-bad-mode-in-data-abort-handler.patch
new file mode 100644
index 00000000..ef2e29c7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0083-dwc-otg-FIQ-Fix-bad-mode-in-data-abort-handler.patch
@@ -0,0 +1,116 @@
+From 2487ab4d7856ee30d05ec9d78afdabb35db2b70e Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Mon, 16 Jul 2018 14:40:13 +0100
+Subject: [PATCH 083/697] dwc-otg: FIQ: Fix "bad mode in data abort handler"
+
+Create a semi-static mapping for the USB registers early in the boot
+process, before additional kernel threads are started, so all threads
+will have the mappings from the start. This avoids the need for
+data aborts to lazily update them.
+
+See: https://github.com/raspberrypi/linux/issues/2450
+
+Signed-off-by: Floris Bos <bos@je-eigen-domein.nl>
+---
+ arch/arm/mach-bcm/board_bcm2835.c | 69 +++++++++++++++++++++++++++++++
+ 1 file changed, 69 insertions(+)
+
+--- a/arch/arm/mach-bcm/board_bcm2835.c
++++ b/arch/arm/mach-bcm/board_bcm2835.c
+@@ -6,6 +6,7 @@
+ #include <linux/init.h>
+ #include <linux/irqchip.h>
+ #include <linux/of_address.h>
++#include <linux/of_fdt.h>
+ #include <asm/system_info.h>
+ 
+ #include <asm/mach/arch.h>
+@@ -13,6 +14,9 @@
+ 
+ #include "platsmp.h"
+ 
++#define BCM2835_USB_VIRT_BASE   0xf0980000
++#define BCM2835_USB_VIRT_MPHI   0xf0006000
++
+ static void __init bcm2835_init(void)
+ {
+ 	struct device_node *np = of_find_node_by_path("/system");
+@@ -25,6 +29,70 @@ static void __init bcm2835_init(void)
+ 		system_serial_low = val64;
+ }
+ 
++/*
++ * We need to map registers that are going to be accessed by the FIQ
++ * very early, before any kernel threads are spawned. Because if done
++ * later, the mapping tables are not updated instantly but lazily upon
++ * first access through a data abort handler. While that is fine
++ * when executing regular kernel code, if the first access in a specific
++ * thread happens while running FIQ code this will result in a panic.
++ *
++ * For more background see the following old mailing list thread:
++ * https://www.spinics.net/lists/arm-kernel/msg325250.html
++ */
++static int __init bcm2835_map_usb(unsigned long node, const char *uname,
++					int depth, void *data)
++{
++	struct map_desc map[2];
++	const __be32 *reg;
++	int len;
++	unsigned long p2b_offset = *((unsigned long *) data);
++
++	if (!of_flat_dt_is_compatible(node, "brcm,bcm2708-usb"))
++		return 0;
++	reg = of_get_flat_dt_prop(node, "reg", &len);
++	if (!reg || len != (sizeof(unsigned long) * 4))
++		return 0;
++
++	/* Use information about the physical addresses of the
++	 * registers from the device tree, but use legacy
++	 * iotable_init() static mapping function to map them,
++	 * as ioremap() is not functional at this stage in boot.
++	 */
++	map[0].virtual = (unsigned long) BCM2835_USB_VIRT_BASE;
++	map[0].pfn = __phys_to_pfn(be32_to_cpu(reg[0]) - p2b_offset);
++	map[0].length = be32_to_cpu(reg[1]);
++	map[0].type = MT_DEVICE;
++	map[1].virtual = (unsigned long) BCM2835_USB_VIRT_MPHI;
++	map[1].pfn = __phys_to_pfn(be32_to_cpu(reg[2]) - p2b_offset);
++	map[1].length = be32_to_cpu(reg[3]);
++	map[1].type = MT_DEVICE;
++		iotable_init(map, 2);
++
++	return 1;
++}
++
++static void __init bcm2835_map_io(void)
++{
++	const __be32 *ranges;
++	int soc, len;
++	unsigned long p2b_offset;
++
++	debug_ll_io_init();
++
++	/* Find out how to map bus to physical address first from soc/ranges */
++	soc = of_get_flat_dt_subnode_by_name(of_get_flat_dt_root(), "soc");
++	if (soc < 0)
++		return;
++	ranges = of_get_flat_dt_prop(soc, "ranges", &len);
++	if (!ranges || len < (sizeof(unsigned long) * 3))
++		return;
++	p2b_offset = be32_to_cpu(ranges[0]) - be32_to_cpu(ranges[1]);
++
++	/* Now search for bcm2708-usb node in device tree */
++	of_scan_flat_dt(bcm2835_map_usb, &p2b_offset);
++}
++
+ static const char * const bcm2835_compat[] = {
+ #ifdef CONFIG_ARCH_MULTI_V6
+ 	"brcm,bcm2835",
+@@ -37,6 +105,7 @@ static const char * const bcm2835_compat
+ };
+ 
+ DT_MACHINE_START(BCM2835, "BCM2835")
++	.map_io = bcm2835_map_io,
+ 	.init_machine = bcm2835_init,
+ 	.dt_compat = bcm2835_compat,
+ 	.smp = smp_ops(bcm2836_smp_ops),
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0084-ARM-Activate-FIQs-to-avoid-__irq_startup-warnings.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0084-ARM-Activate-FIQs-to-avoid-__irq_startup-warnings.patch
new file mode 100644
index 00000000..5064e162
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0084-ARM-Activate-FIQs-to-avoid-__irq_startup-warnings.patch
@@ -0,0 +1,36 @@
+From 477c8c6ba92831dfd66b19348b44d95df3da6a5c Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Mon, 11 Dec 2017 09:18:32 +0000
+Subject: [PATCH 084/697] ARM: Activate FIQs to avoid __irq_startup warnings
+
+There is a new test in __irq_startup that the IRQ is activated, which
+hasn't been the case for FIQs since they bypass some of the usual setup.
+
+Augment enable_fiq to include a call to irq_activate to avoid the
+warning.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ arch/arm/kernel/fiq.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/arm/kernel/fiq.c
++++ b/arch/arm/kernel/fiq.c
+@@ -57,6 +57,8 @@
+ static unsigned long dfl_fiq_insn;
+ static struct pt_regs dfl_fiq_regs;
+ 
++extern int irq_activate(struct irq_desc *desc);
++
+ /* Default reacquire function
+  * - we always relinquish FIQ control
+  * - we always reacquire FIQ control
+@@ -141,6 +143,8 @@ static int fiq_start;
+ 
+ void enable_fiq(int fiq)
+ {
++	struct irq_desc *desc = irq_to_desc(fiq + fiq_start);
++	irq_activate(desc);
+ 	enable_irq(fiq + fiq_start);
+ }
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0085-i2c-gpio-Also-set-bus-numbers-from-reg-property.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0085-i2c-gpio-Also-set-bus-numbers-from-reg-property.patch
new file mode 100644
index 00000000..4251f5d1
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0085-i2c-gpio-Also-set-bus-numbers-from-reg-property.patch
@@ -0,0 +1,35 @@
+From bd97ce931bb969e1c375d9d5e1b82d6e697791d8 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Tue, 20 Feb 2018 10:07:27 +0000
+Subject: [PATCH 085/697] i2c-gpio: Also set bus numbers from reg property
+
+I2C busses can be assigned specific bus numbers using aliases in
+Device Tree - string properties where the name is the alias and the
+value is the path to the node. The current DT parameter mechanism
+does not allow property names to be derived from a parameter value
+in any way, so it isn't possible to generate unique or matching
+aliases for nodes from an overlay that can generate multiple
+instances, e.g. i2c-gpio.
+
+Work around this limitation (at least temporarily) by allowing
+the i2c adapter number to be initialised from the "reg" property
+if present.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/i2c/busses/i2c-gpio.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-gpio.c
++++ b/drivers/i2c/busses/i2c-gpio.c
+@@ -428,7 +428,9 @@ static int i2c_gpio_probe(struct platfor
+ 	adap->dev.parent = dev;
+ 	device_set_node(&adap->dev, fwnode);
+ 
+-	adap->nr = pdev->id;
++	if (pdev->id != PLATFORM_DEVID_NONE || !pdev->dev.of_node ||
++	    of_property_read_u32(pdev->dev.of_node, "reg", &adap->nr))
++		adap->nr = pdev->id;
+ 	ret = i2c_bit_add_numbered_bus(adap);
+ 	if (ret)
+ 		return ret;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0086-added-capture_clear-option-to-pps-gpio-via-dtoverlay.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0086-added-capture_clear-option-to-pps-gpio-via-dtoverlay.patch
new file mode 100644
index 00000000..36529acc
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0086-added-capture_clear-option-to-pps-gpio-via-dtoverlay.patch
@@ -0,0 +1,22 @@
+From 3b24e2cc8ee5b363537f47afe3dc49b0a71d2afa Mon Sep 17 00:00:00 2001
+From: hdoverobinson <hdoverobinson@gmail.com>
+Date: Tue, 13 Mar 2018 06:58:39 -0400
+Subject: [PATCH 086/697] added capture_clear option to pps-gpio via dtoverlay
+ (#2433)
+
+---
+ drivers/pps/clients/pps-gpio.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/pps/clients/pps-gpio.c
++++ b/drivers/pps/clients/pps-gpio.c
+@@ -113,6 +113,9 @@ static int pps_gpio_setup(struct device
+ 	data->assert_falling_edge =
+ 		device_property_read_bool(dev, "assert-falling-edge");
+ 
++	data->capture_clear =
++		device_property_read_bool(dev, "capture-clear");
++
+ 	data->echo_pin = devm_gpiod_get_optional(dev, "echo", GPIOD_OUT_LOW);
+ 	if (IS_ERR(data->echo_pin))
+ 		return dev_err_probe(dev, PTR_ERR(data->echo_pin),
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0087-hid-Reduce-default-mouse-polling-interval-to-60Hz.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0087-hid-Reduce-default-mouse-polling-interval-to-60Hz.patch
new file mode 100644
index 00000000..4b26e072
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0087-hid-Reduce-default-mouse-polling-interval-to-60Hz.patch
@@ -0,0 +1,46 @@
+From e0fa936ac8cd90ae9f8b2b7e2f849390a907329f Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Mon, 14 Jul 2014 22:02:09 +0100
+Subject: [PATCH 087/697] hid: Reduce default mouse polling interval to 60Hz
+
+Reduces overhead when using X
+
+usbhid: call usb_fixup_endpoint after mangling intervals
+
+Lets the mousepoll override mechanism work with xhci.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
+---
+ drivers/hid/usbhid/hid-core.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/hid/usbhid/hid-core.c
++++ b/drivers/hid/usbhid/hid-core.c
+@@ -46,7 +46,7 @@
+  * Module parameters.
+  */
+ 
+-static unsigned int hid_mousepoll_interval;
++static unsigned int hid_mousepoll_interval = ~0;
+ module_param_named(mousepoll, hid_mousepoll_interval, uint, 0644);
+ MODULE_PARM_DESC(mousepoll, "Polling interval of mice");
+ 
+@@ -1113,7 +1113,9 @@ static int usbhid_start(struct hid_devic
+ 		 */
+ 		switch (hid->collection->usage) {
+ 		case HID_GD_MOUSE:
+-			if (hid_mousepoll_interval > 0)
++			if (hid_mousepoll_interval == ~0 && interval < 16)
++				interval = 16;
++			else if (hid_mousepoll_interval != ~0 && hid_mousepoll_interval != 0)
+ 				interval = hid_mousepoll_interval;
+ 			break;
+ 		case HID_GD_JOYSTICK:
+@@ -1125,6 +1127,7 @@ static int usbhid_start(struct hid_devic
+ 				interval = hid_kbpoll_interval;
+ 			break;
+ 		}
++		usb_fixup_endpoint(dev, endpoint->bEndpointAddress, interval);
+ 
+ 		ret = -ENOMEM;
+ 		if (usb_endpoint_dir_in(endpoint)) {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0088-firmware-raspberrypi-Notify-firmware-of-a-reboot.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0088-firmware-raspberrypi-Notify-firmware-of-a-reboot.patch
new file mode 100644
index 00000000..329757ca
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0088-firmware-raspberrypi-Notify-firmware-of-a-reboot.patch
@@ -0,0 +1,84 @@
+From ae63a39b401e76766b95b706e815660def7c6dcd Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Sat, 12 May 2018 21:35:43 +0100
+Subject: [PATCH 088/697] firmware/raspberrypi: Notify firmware of a reboot
+
+Register for reboot notifications, sending RPI_FIRMWARE_NOTIFY_REBOOT
+over the mailbox interface on reception.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/firmware/raspberrypi.c | 40 +++++++++++++++++++++++++++++++++-
+ 1 file changed, 39 insertions(+), 1 deletion(-)
+
+--- a/drivers/firmware/raspberrypi.c
++++ b/drivers/firmware/raspberrypi.c
+@@ -14,6 +14,7 @@
+ #include <linux/of.h>
+ #include <linux/of_platform.h>
+ #include <linux/platform_device.h>
++#include <linux/reboot.h>
+ #include <linux/slab.h>
+ #include <soc/bcm2835/raspberrypi-firmware.h>
+ 
+@@ -182,6 +183,26 @@ int rpi_firmware_property(struct rpi_fir
+ }
+ EXPORT_SYMBOL_GPL(rpi_firmware_property);
+ 
++static int rpi_firmware_notify_reboot(struct notifier_block *nb,
++				      unsigned long action,
++				      void *data)
++{
++	struct rpi_firmware *fw;
++	struct platform_device *pdev = g_pdev;
++
++	if (!pdev)
++		return 0;
++
++	fw = platform_get_drvdata(pdev);
++	if (!fw)
++		return 0;
++
++	(void)rpi_firmware_property(fw, RPI_FIRMWARE_NOTIFY_REBOOT,
++				    0, 0);
++
++	return 0;
++}
++
+ static void
+ rpi_firmware_print_firmware_revision(struct rpi_firmware *fw)
+ {
+@@ -413,15 +434,32 @@ static struct platform_driver rpi_firmwa
+ 	.remove_new	= rpi_firmware_remove,
+ };
+ 
++static struct notifier_block rpi_firmware_reboot_notifier = {
++	.notifier_call = rpi_firmware_notify_reboot,
++};
++
+ static int __init rpi_firmware_init(void)
+ {
+-	return platform_driver_register(&rpi_firmware_driver);
++	int ret = register_reboot_notifier(&rpi_firmware_reboot_notifier);
++	if (ret)
++		goto out1;
++	ret = platform_driver_register(&rpi_firmware_driver);
++	if (ret)
++		goto out2;
++
++	return 0;
++
++out2:
++	unregister_reboot_notifier(&rpi_firmware_reboot_notifier);
++out1:
++	return ret;
+ }
+ core_initcall(rpi_firmware_init);
+ 
+ static void __init rpi_firmware_exit(void)
+ {
+ 	platform_driver_unregister(&rpi_firmware_driver);
++	unregister_reboot_notifier(&rpi_firmware_reboot_notifier);
+ }
+ module_exit(rpi_firmware_exit);
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0089-irqchip-irq-bcm2835-Calc.-FIQ_START-at-boot-time.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0089-irqchip-irq-bcm2835-Calc.-FIQ_START-at-boot-time.patch
new file mode 100644
index 00000000..abd3c234
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0089-irqchip-irq-bcm2835-Calc.-FIQ_START-at-boot-time.patch
@@ -0,0 +1,66 @@
+From 590d329717464417244843f07141551927ba6dac Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Thu, 14 Jun 2018 11:21:04 +0100
+Subject: [PATCH 089/697] irqchip: irq-bcm2835: Calc. FIQ_START at boot-time
+
+ad83c7cb2f37 ("irqchip/irq-bcm2836: Add support for DT interrupt polarity")
+changed the way that the BCM2836/7 local interrupts are mapped; instead
+of being pre-mapped they are now mapped on-demand. A side effect of this
+change is that the call to irq_of_parse_and_map from armctrl_of_init
+creates a new mapping, forming a gap between the IRQs and the FIQs. This
+ gap breaks the FIQ<->IRQ mapping which up to now has been done by assuming:
+
+1) that the value of FIQ_START is the same as the number of normal IRQs
+that will be mapped (still true), and
+
+2) that this value is also the offset between an IRQ and its equivalent
+FIQ (which is no longer the case).
+
+Remove both assumptions by measuring the interval between the last IRQ
+and the last FIQ, passing it as the parameter to init_FIQ().
+
+Fixes: https://github.com/raspberrypi/linux/issues/2432
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/irqchip/irq-bcm2835.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/irqchip/irq-bcm2835.c
++++ b/drivers/irqchip/irq-bcm2835.c
+@@ -75,8 +75,6 @@
+ #define NR_BANKS		3
+ #define IRQS_PER_BANK		32
+ #define NUMBER_IRQS		MAKE_HWIRQ(NR_BANKS, 0)
+-#undef FIQ_START
+-#define FIQ_START		(NR_IRQS_BANK0 + MAKE_HWIRQ(NR_BANKS - 1, 0))
+ 
+ static const int reg_pending[] __initconst = { 0x00, 0x04, 0x08 };
+ static const int reg_enable[] __initconst = { 0x18, 0x10, 0x14 };
+@@ -205,7 +203,7 @@ static int __init armctrl_of_init(struct
+ 				  bool is_2836)
+ {
+ 	void __iomem *base;
+-	int irq, b, i;
++	int irq = 0, last_irq, b, i;
+ 	u32 reg;
+ 
+ 	base = of_iomap(node, 0);
+@@ -245,6 +243,8 @@ static int __init armctrl_of_init(struct
+ 		pr_err(FW_BUG "Bootloader left fiq enabled\n");
+ 	}
+ 
++	last_irq = irq;
++
+ 	if (is_2836) {
+ 		int parent_irq = irq_of_parse_and_map(node, 0);
+ 
+@@ -275,7 +275,7 @@ static int __init armctrl_of_init(struct
+ 		}
+ 	}
+ #ifndef CONFIG_ARM64
+-	init_FIQ(FIQ_START);
++	init_FIQ(irq - last_irq);
+ #endif
+ 
+ 	return 0;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0090-brcmfmac-Re-enable-firmware-roaming-support.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0090-brcmfmac-Re-enable-firmware-roaming-support.patch
new file mode 100644
index 00000000..44d2f14b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0090-brcmfmac-Re-enable-firmware-roaming-support.patch
@@ -0,0 +1,29 @@
+From 9677dfed46ff080ea6fb5049149b5fc2e2511093 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Wed, 20 Jun 2018 12:20:01 +0100
+Subject: [PATCH 090/697] brcmfmac: Re-enable firmware roaming support
+
+As of 4.18, a firmware that implements the update_connect_params
+method but doesn't claim to support roaming causes an error. We
+disabled firmware roaming in 4.4 [1] because it appeared to
+prevent disconnects, but let's try with the current firmware to see
+if things have improved.
+
+[1] https://github.com/raspberrypi/linux/commit/dd9188011786fb62a7960922f31e8e086fb2009b
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -59,7 +59,7 @@ static int brcmf_fcmode;
+ module_param_named(fcmode, brcmf_fcmode, int, 0);
+ MODULE_PARM_DESC(fcmode, "Mode of firmware signalled flow control");
+ 
+-static int brcmf_roamoff = 1;
++static int brcmf_roamoff;
+ module_param_named(roamoff, brcmf_roamoff, int, 0400);
+ MODULE_PARM_DESC(roamoff, "Do not use internal roaming engine");
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0091-cxd2880-CXD2880_SPI_DRV-should-select-DVB_CXD2880-wi.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0091-cxd2880-CXD2880_SPI_DRV-should-select-DVB_CXD2880-wi.patch
new file mode 100644
index 00000000..f269ac21
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0091-cxd2880-CXD2880_SPI_DRV-should-select-DVB_CXD2880-wi.patch
@@ -0,0 +1,20 @@
+From 01680d48f35a23b6cb565d80d9e984c5e3c1388a Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Mon, 17 Sep 2018 17:31:18 +0100
+Subject: [PATCH 091/697] cxd2880: CXD2880_SPI_DRV should select DVB_CXD2880
+ with MEDIA_SUBDRV_AUTOSELECT
+
+---
+ drivers/media/spi/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/spi/Kconfig
++++ b/drivers/media/spi/Kconfig
+@@ -9,6 +9,7 @@ menu "Media SPI Adapters"
+ config CXD2880_SPI_DRV
+ 	tristate "Sony CXD2880 SPI support"
+ 	depends on DVB_CORE && SPI
++	select DVB_CXD2880 if MEDIA_SUBDRV_AUTOSELECT
+ 	default m if !MEDIA_SUBDRV_AUTOSELECT
+ 	help
+ 	  Choose if you would like to have SPI interface support for Sony CXD2880.
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0092-firmware-raspberrypi-Add-backward-compatible-get_thr.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0092-firmware-raspberrypi-Add-backward-compatible-get_thr.patch
new file mode 100644
index 00000000..33eb3c20
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0092-firmware-raspberrypi-Add-backward-compatible-get_thr.patch
@@ -0,0 +1,79 @@
+From c032deca20b5517d082cb71f13c870d638d1ff3b Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Sat, 13 Oct 2018 13:31:21 +0200
+Subject: [PATCH 092/697] firmware: raspberrypi: Add backward compatible
+ get_throttled
+
+Avoid a hard userspace ABI change by adding a compatible get_throttled
+sysfs entry. Its value is now feed by the GET_THROTTLED requests of the
+new hwmon driver. The first access to get_throttled will generate
+a warning.
+
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+---
+ drivers/firmware/raspberrypi.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+--- a/drivers/firmware/raspberrypi.c
++++ b/drivers/firmware/raspberrypi.c
+@@ -33,6 +33,7 @@ struct rpi_firmware {
+ 	u32 enabled;
+ 
+ 	struct kref consumers;
++	u32 get_throttled;
+ };
+ 
+ static struct platform_device *g_pdev;
+@@ -179,6 +180,12 @@ int rpi_firmware_property(struct rpi_fir
+ 
+ 	kfree(data);
+ 
++	if ((tag == RPI_FIRMWARE_GET_THROTTLED) &&
++	     memcmp(&fw->get_throttled, tag_data, sizeof(fw->get_throttled))) {
++		memcpy(&fw->get_throttled, tag_data, sizeof(fw->get_throttled));
++		sysfs_notify(&fw->cl.dev->kobj, NULL, "get_throttled");
++	}
++
+ 	return ret;
+ }
+ EXPORT_SYMBOL_GPL(rpi_firmware_property);
+@@ -203,6 +210,27 @@ static int rpi_firmware_notify_reboot(st
+ 	return 0;
+ }
+ 
++static ssize_t get_throttled_show(struct device *dev,
++				  struct device_attribute *attr, char *buf)
++{
++	struct rpi_firmware *fw = dev_get_drvdata(dev);
++
++	WARN_ONCE(1, "deprecated, use hwmon sysfs instead\n");
++
++	return sprintf(buf, "%x\n", fw->get_throttled);
++}
++
++static DEVICE_ATTR_RO(get_throttled);
++
++static struct attribute *rpi_firmware_dev_attrs[] = {
++	&dev_attr_get_throttled.attr,
++	NULL,
++};
++
++static const struct attribute_group rpi_firmware_dev_group = {
++	.attrs = rpi_firmware_dev_attrs,
++};
++
+ static void
+ rpi_firmware_print_firmware_revision(struct rpi_firmware *fw)
+ {
+@@ -232,6 +260,11 @@ rpi_register_hwmon_driver(struct device
+ 
+ 	rpi_hwmon = platform_device_register_data(dev, "raspberrypi-hwmon",
+ 						  -1, NULL, 0);
++
++	if (!IS_ERR_OR_NULL(rpi_hwmon)) {
++		if (devm_device_add_group(dev, &rpi_firmware_dev_group))
++			dev_err(dev, "Failed to create get_trottled attr\n");
++	}
+ }
+ 
+ static void rpi_register_clk_driver(struct device *dev)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0093-firmware-raspberrypi-Report-the-fw-variant-during-pr.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0093-firmware-raspberrypi-Report-the-fw-variant-during-pr.patch
new file mode 100644
index 00000000..d31aae92
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0093-firmware-raspberrypi-Report-the-fw-variant-during-pr.patch
@@ -0,0 +1,89 @@
+From c87dbd4dd422e0b4fb150492aeb75e796d79d2e6 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Thu, 10 Jan 2019 17:58:06 +0000
+Subject: [PATCH 093/697] firmware: raspberrypi: Report the fw variant during
+ probe
+
+The driver already reported the firmware build date during probe.
+The mailbox calls have been extended to also report the variant
+ 1 = standard start.elf
+ 2 = start_x.elf (includes camera stack)
+ 3 = start_db.elf (includes assert logging)
+ 4 = start_cd.elf (cutdown version for smallest memory footprint).
+Log the variant during probe.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+firmware: raspberrypi: Report the fw git hash during probe
+
+The firmware can now report the git hash from which it was built
+via the mailbox, so report it during probe.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/firmware/raspberrypi.c | 40 +++++++++++++++++++++++++++++++++-
+ 1 file changed, 39 insertions(+), 1 deletion(-)
+
+--- a/drivers/firmware/raspberrypi.c
++++ b/drivers/firmware/raspberrypi.c
+@@ -236,6 +236,15 @@ rpi_firmware_print_firmware_revision(str
+ {
+ 	time64_t date_and_time;
+ 	u32 packet;
++	static const char * const variant_strs[] = {
++		"unknown",
++		"start",
++		"start_x",
++		"start_db",
++		"start_cd",
++	};
++	const char *variant_str = "cmd unsupported";
++	u32 variant;
+ 	int ret = rpi_firmware_property(fw,
+ 					RPI_FIRMWARE_GET_FIRMWARE_REVISION,
+ 					&packet, sizeof(packet));
+@@ -245,7 +254,35 @@ rpi_firmware_print_firmware_revision(str
+ 
+ 	/* This is not compatible with y2038 */
+ 	date_and_time = packet;
+-	dev_info(fw->cl.dev, "Attached to firmware from %ptT\n", &date_and_time);
++
++	ret = rpi_firmware_property(fw, RPI_FIRMWARE_GET_FIRMWARE_VARIANT,
++				    &variant, sizeof(variant));
++
++	if (!ret) {
++		if (variant >= ARRAY_SIZE(variant_strs))
++			variant = 0;
++		variant_str = variant_strs[variant];
++	}
++
++	dev_info(fw->cl.dev,
++		 "Attached to firmware from %ptT, variant %s\n",
++		 &date_and_time, variant_str);
++}
++
++static void
++rpi_firmware_print_firmware_hash(struct rpi_firmware *fw)
++{
++	u32 hash[5];
++	int ret = rpi_firmware_property(fw,
++					RPI_FIRMWARE_GET_FIRMWARE_HASH,
++					hash, sizeof(hash));
++
++	if (ret)
++		return;
++
++	dev_info(fw->cl.dev,
++		 "Firmware hash is %08x%08x%08x%08x%08x\n",
++		 hash[0], hash[1], hash[2], hash[3], hash[4]);
+ }
+ 
+ static void
+@@ -360,6 +397,7 @@ static int rpi_firmware_probe(struct pla
+ 	g_pdev = pdev;
+ 
+ 	rpi_firmware_print_firmware_revision(fw);
++	rpi_firmware_print_firmware_hash(fw);
+ 	rpi_register_hwmon_driver(dev, fw);
+ 	rpi_register_clk_driver(dev);
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0094-net-lan78xx-Disable-TCP-Segmentation-Offload-TSO.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0094-net-lan78xx-Disable-TCP-Segmentation-Offload-TSO.patch
new file mode 100644
index 00000000..a9089cbf
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0094-net-lan78xx-Disable-TCP-Segmentation-Offload-TSO.patch
@@ -0,0 +1,56 @@
+From 25db57002e41c9258d08a6ee818a8dcfe97d44f3 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Wed, 13 Jun 2018 15:21:10 +0100
+Subject: [PATCH 094/697] net: lan78xx: Disable TCP Segmentation Offload (TSO)
+
+TSO seems to be having issues when packets are dropped and the
+remote end uses Selective Acknowledge (SACK) to denote that
+data is missing. The missing data is never resent, so the
+connection eventually stalls.
+
+There is a module parameter of enable_tso added to allow
+further debugging without forcing a rebuild of the kernel.
+
+https://github.com/raspberrypi/linux/issues/2449
+https://github.com/raspberrypi/linux/issues/2482
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/net/usb/lan78xx.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -604,6 +604,15 @@ static int lan78xx_alloc_tx_resources(st
+ 				      dev->n_tx_urbs, dev->tx_urb_size, dev);
+ }
+ 
++/* TSO seems to be having some issue with Selective Acknowledge (SACK) that
++ * results in lost data never being retransmitted.
++ * Disable it by default now, but adds a module parameter to enable it for
++ * debug purposes (the full cause is not currently understood).
++ */
++static bool enable_tso;
++module_param(enable_tso, bool, 0644);
++MODULE_PARM_DESC(enable_tso, "Enables TCP segmentation offload");
++
+ static int lan78xx_read_reg(struct lan78xx_net *dev, u32 index, u32 *data)
+ {
+ 	u32 *buf;
+@@ -3444,8 +3453,14 @@ static int lan78xx_bind(struct lan78xx_n
+ 	if (DEFAULT_RX_CSUM_ENABLE)
+ 		dev->net->features |= NETIF_F_RXCSUM;
+ 
+-	if (DEFAULT_TSO_CSUM_ENABLE)
+-		dev->net->features |= NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_SG;
++	if (DEFAULT_TSO_CSUM_ENABLE) {
++		dev->net->features |= NETIF_F_SG;
++		/* Use module parameter to control TCP segmentation offload as
++		 * it appears to cause issues.
++		 */
++		if (enable_tso)
++			dev->net->features |= NETIF_F_TSO | NETIF_F_TSO6;
++	}
+ 
+ 	if (DEFAULT_VLAN_RX_OFFLOAD)
+ 		dev->net->features |= NETIF_F_HW_VLAN_CTAG_RX;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0095-net-lan78xx-Support-auto-downshift-to-100Mb-s.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0095-net-lan78xx-Support-auto-downshift-to-100Mb-s.patch
new file mode 100644
index 00000000..62f5a58e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0095-net-lan78xx-Support-auto-downshift-to-100Mb-s.patch
@@ -0,0 +1,91 @@
+From 019f4fcddce3981bf1496670da91c8c7e6845eec Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Mon, 26 Nov 2018 19:46:58 +0000
+Subject: [PATCH 095/697] net: lan78xx: Support auto-downshift to 100Mb/s
+
+Ethernet cables with faulty or missing pairs (specifically pairs C and
+D) allow auto-negotiation to 1000Mbs, but do not support the successful
+establishment of a link. Add a DT property, "microchip,downshift-after",
+to configure the number of auto-negotiation failures after which it
+falls back to 100Mbs. Valid values are 2, 3, 4, 5 and 0, where 0 means
+never downshift.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ .../bindings/net/microchip,lan78xx.txt        |  3 +++
+ drivers/net/phy/microchip.c                   | 27 +++++++++++++++++++
+ include/linux/microchipphy.h                  |  8 ++++++
+ 3 files changed, 38 insertions(+)
+
+--- a/Documentation/devicetree/bindings/net/microchip,lan78xx.txt
++++ b/Documentation/devicetree/bindings/net/microchip,lan78xx.txt
+@@ -14,6 +14,9 @@ Optional properties of the embedded PHY:
+ - microchip,led-modes: a 0..4 element vector, with each element configuring
+   the operating mode of an LED. Omitted LEDs are turned off. Allowed values
+   are defined in "include/dt-bindings/net/microchip-lan78xx.h".
++- microchip,downshift-after: sets the number of failed auto-negotiation
++  attempts after which the link is downgraded from 1000BASE-T. Should be one of
++  2, 3, 4, 5 or 0, where 0 means never downshift.
+ 
+ Example:
+ 
+--- a/drivers/net/phy/microchip.c
++++ b/drivers/net/phy/microchip.c
+@@ -239,6 +239,7 @@ static int lan88xx_probe(struct phy_devi
+ 	struct device *dev = &phydev->mdio.dev;
+ 	struct lan88xx_priv *priv;
+ 	u32 led_modes[4];
++	u32 downshift_after = 0;
+ 	int len;
+ 
+ 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+@@ -268,6 +269,32 @@ static int lan88xx_probe(struct phy_devi
+ 		return -EINVAL;
+ 	}
+ 
++	if (!of_property_read_u32(dev->of_node,
++				  "microchip,downshift-after",
++				  &downshift_after)) {
++		u32 mask = LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_MASK;
++		u32 val= LAN78XX_PHY_CTRL3_AUTO_DOWNSHIFT;
++
++		switch (downshift_after) {
++		case 2:	val |= LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_2;
++			break;
++		case 3:	val |= LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_3;
++			break;
++		case 4:	val |= LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_4;
++			break;
++		case 5:	val |= LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_5;
++			break;
++		case 0: // Disable completely
++			mask = LAN78XX_PHY_CTRL3_AUTO_DOWNSHIFT;
++			val = 0;
++			break;
++		default:
++			return -EINVAL;
++		}
++		(void)phy_modify_paged(phydev, 1, LAN78XX_PHY_CTRL3,
++				       mask, val);
++	}
++
+ 	/* these values can be used to identify internal PHY */
+ 	priv->chip_id = phy_read_mmd(phydev, 3, LAN88XX_MMD3_CHIP_ID);
+ 	priv->chip_rev = phy_read_mmd(phydev, 3, LAN88XX_MMD3_CHIP_REV);
+--- a/include/linux/microchipphy.h
++++ b/include/linux/microchipphy.h
+@@ -61,6 +61,14 @@
+ /* Registers specific to the LAN7800/LAN7850 embedded phy */
+ #define LAN78XX_PHY_LED_MODE_SELECT		(0x1D)
+ 
++#define LAN78XX_PHY_CTRL3			(0x14)
++#define LAN78XX_PHY_CTRL3_AUTO_DOWNSHIFT	(0x0010)
++#define LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_MASK	(0x000c)
++#define LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_2	(0x0000)
++#define LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_3	(0x0004)
++#define LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_4	(0x0008)
++#define LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_5	(0x000c)
++
+ /* DSP registers */
+ #define PHY_ARDENNES_MMD_DEV_3_PHY_CFG		(0x806A)
+ #define PHY_ARDENNES_MMD_DEV_3_PHY_CFG_ZD_DLY_EN_	(0x2000)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0096-lan78xx-Debounce-link-events-to-minimize-poll-storm.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0096-lan78xx-Debounce-link-events-to-minimize-poll-storm.patch
new file mode 100644
index 00000000..e646f652
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0096-lan78xx-Debounce-link-events-to-minimize-poll-storm.patch
@@ -0,0 +1,45 @@
+From 411c8c532bf720664c5dfda033491cd5153cee85 Mon Sep 17 00:00:00 2001
+From: Joshua Emele <jemele@acm.org>
+Date: Wed, 7 Nov 2018 16:07:40 -0800
+Subject: [PATCH 096/697] lan78xx: Debounce link events to minimize poll storm
+
+The bInterval is set to 4 (i.e. 8 microframes => 1ms) and the only bit
+that the driver pays attention to is "link was reset". If there's a
+flapping status bit in that endpoint data, (such as if PHY negotiation
+needs a few tries to get a stable link) then polling at a slower rate
+would act as a de-bounce.
+
+See: https://github.com/raspberrypi/linux/issues/2447
+---
+ drivers/net/usb/lan78xx.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -613,6 +613,11 @@ static bool enable_tso;
+ module_param(enable_tso, bool, 0644);
+ MODULE_PARM_DESC(enable_tso, "Enables TCP segmentation offload");
+ 
++#define INT_URB_MICROFRAMES_PER_MS	8
++static int int_urb_interval_ms = 8;
++module_param(int_urb_interval_ms, int, 0);
++MODULE_PARM_DESC(int_urb_interval_ms, "Override usb interrupt urb interval");
++
+ static int lan78xx_read_reg(struct lan78xx_net *dev, u32 index, u32 *data)
+ {
+ 	u32 *buf;
+@@ -4430,7 +4435,13 @@ static int lan78xx_probe(struct usb_inte
+ 	if (ret < 0)
+ 		goto out4;
+ 
+-	period = ep_intr->desc.bInterval;
++	if (int_urb_interval_ms <= 0)
++		period = ep_intr->desc.bInterval;
++	else
++		period = int_urb_interval_ms * INT_URB_MICROFRAMES_PER_MS;
++
++	netif_notice(dev, probe, netdev, "int urb period %d\n", period);
++
+ 	maxp = usb_maxpacket(dev->udev, dev->pipe_intr);
+ 
+ 	dev->urb_intr = usb_alloc_urb(0, GFP_KERNEL);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0097-net-lan78xx-Ack-pending-PHY-ints-when-resetting.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0097-net-lan78xx-Ack-pending-PHY-ints-when-resetting.patch
new file mode 100644
index 00000000..48d98d74
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0097-net-lan78xx-Ack-pending-PHY-ints-when-resetting.patch
@@ -0,0 +1,32 @@
+From 36daab2dfb621c983dd7d9c62fbfb86bbda7e131 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 15 Dec 2020 16:38:37 +0000
+Subject: [PATCH 097/697] net: lan78xx: Ack pending PHY ints when resetting
+
+lan78xx_link_reset explicitly clears the MAC's view of the PHY's IRQ
+status. In doing so it potentially leaves the PHY with a pending
+interrupt that will never be acknowledged, at which point no further
+interrupts will be generated.
+
+Avoid the problem by acknowledging any pending PHY interrupt after
+clearing the MAC's status bit.
+
+See: https://github.com/raspberrypi/linux/issues/2937
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/net/usb/lan78xx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -1435,6 +1435,9 @@ static int lan78xx_link_reset(struct lan
+ 	if (unlikely(ret < 0))
+ 		return ret;
+ 
++	/* Acknowledge any pending PHY interrupt, lest it be the last */
++	phy_read(phydev, LAN88XX_INT_STS);
++
+ 	mutex_lock(&phydev->lock);
+ 	phy_read_status(phydev);
+ 	link = phydev->link;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0098-Patching-lan78xx-for-SOF_TIMESTAMPING_TX_SOFTWARE-su.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0098-Patching-lan78xx-for-SOF_TIMESTAMPING_TX_SOFTWARE-su.patch
new file mode 100644
index 00000000..286246eb
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0098-Patching-lan78xx-for-SOF_TIMESTAMPING_TX_SOFTWARE-su.patch
@@ -0,0 +1,20 @@
+From 5bb9dff1dfb80acb9caac699e56832b776d0af47 Mon Sep 17 00:00:00 2001
+From: tiagofreire-pt <41837236+tiagofreire-pt@users.noreply.github.com>
+Date: Sat, 29 Jan 2022 10:01:36 +0000
+Subject: [PATCH 098/697] Patching lan78xx for SOF_TIMESTAMPING_TX_SOFTWARE
+ support
+
+---
+ drivers/net/usb/lan78xx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -1935,6 +1935,7 @@ static const struct ethtool_ops lan78xx_
+ 	.set_link_ksettings = lan78xx_set_link_ksettings,
+ 	.get_regs_len	= lan78xx_get_regs_len,
+ 	.get_regs	= lan78xx_get_regs,
++	.get_ts_info    = ethtool_op_get_ts_info,
+ };
+ 
+ static void lan78xx_init_mac_address(struct lan78xx_net *dev)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0099-lan78xx-Enable-LEDs-and-auto-negotiation.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0099-lan78xx-Enable-LEDs-and-auto-negotiation.patch
new file mode 100644
index 00000000..d5a0f255
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0099-lan78xx-Enable-LEDs-and-auto-negotiation.patch
@@ -0,0 +1,49 @@
+From 360bfdf87620dd2d5504877e2da07704ef349932 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Tue, 17 Oct 2017 15:04:29 +0100
+Subject: [PATCH 099/697] lan78xx: Enable LEDs and auto-negotiation
+
+For applications of the LAN78xx that don't have valid programmed
+EEPROMs or OTPs, enabling both LEDs and auto-negotiation by default
+seems reasonable.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/net/usb/lan78xx.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -2897,6 +2897,11 @@ static int lan78xx_reset(struct lan78xx_
+ 	int ret;
+ 	u32 buf;
+ 	u8 sig;
++	bool has_eeprom;
++	bool has_otp;
++
++	has_eeprom = !lan78xx_read_eeprom(dev, 0, 0, NULL);
++	has_otp = !lan78xx_read_otp(dev, 0, 0, NULL);
+ 
+ 	ret = lan78xx_read_reg(dev, HW_CFG, &buf);
+ 	if (ret < 0)
+@@ -2963,6 +2968,10 @@ static int lan78xx_reset(struct lan78xx_
+ 	buf |= HW_CFG_CLK125_EN_;
+ 	buf |= HW_CFG_REFCLK25_EN_;
+ 
++	/* If no valid EEPROM and no valid OTP, enable the LEDs by default */
++	if (!has_eeprom && !has_otp)
++	    buf |= HW_CFG_LED0_EN_ | HW_CFG_LED1_EN_;
++
+ 	ret = lan78xx_write_reg(dev, HW_CFG, buf);
+ 	if (ret < 0)
+ 		return ret;
+@@ -3065,6 +3074,9 @@ static int lan78xx_reset(struct lan78xx_
+ 			buf |= MAC_CR_AUTO_DUPLEX_ | MAC_CR_AUTO_SPEED_;
+ 		}
+ 	}
++	/* If no valid EEPROM and no valid OTP, enable AUTO negotiation */
++	if (!has_eeprom && !has_otp)
++	    buf |= MAC_CR_AUTO_DUPLEX_ | MAC_CR_AUTO_SPEED_;
+ 	ret = lan78xx_write_reg(dev, MAC_CR, buf);
+ 	if (ret < 0)
+ 		return ret;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0100-media-tc358743-Increase-FIFO-level-to-374.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0100-media-tc358743-Increase-FIFO-level-to-374.patch
new file mode 100644
index 00000000..ffaf9abe
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0100-media-tc358743-Increase-FIFO-level-to-374.patch
@@ -0,0 +1,31 @@
+From 63b70709d87f1afa05a4d90413abde19ee137af5 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Wed, 31 Oct 2018 14:56:59 +0000
+Subject: [PATCH 100/697] media: tc358743: Increase FIFO level to 374.
+
+The existing fixed value of 16 worked for UYVY 720P60 over
+2 lanes at 594MHz, or UYVY 1080P60 over 4 lanes. (RGB888
+1080P60 needs 6 lanes at 594MHz).
+It doesn't allow for lower resolutions to work as the FIFO
+underflows.
+
+374 is required for 1080P24-30 UYVY over 2 lanes @ 972Mbit/s, but
+>374 means that the FIFO underflows on 1080P50 UYVY over 2 lanes
+@ 972Mbit/s.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/media/i2c/tc358743.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -1942,7 +1942,7 @@ static int tc358743_probe_of(struct tc35
+ 	state->pdata.ddc5v_delay = DDC5V_DELAY_100_MS;
+ 	state->pdata.enable_hdcp = false;
+ 	/* A FIFO level of 16 should be enough for 2-lane 720p60 at 594 MHz. */
+-	state->pdata.fifo_level = 16;
++	state->pdata.fifo_level = 374;
+ 	/*
+ 	 * The PLL input clock is obtained by dividing refclk by pll_prd.
+ 	 * It must be between 6 MHz and 40 MHz, lower frequency is better.
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0101-media-tc358743-Add-support-for-972Mbit-s-link-freq.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0101-media-tc358743-Add-support-for-972Mbit-s-link-freq.patch
new file mode 100644
index 00000000..038075f3
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0101-media-tc358743-Add-support-for-972Mbit-s-link-freq.patch
@@ -0,0 +1,91 @@
+From 6bdc682efda1798faad0b32ea9a92778e5ce8c87 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Wed, 31 Oct 2018 14:57:21 +0000
+Subject: [PATCH 101/697] media: tc358743: Add support for 972Mbit/s link freq.
+
+Adds register setups for running the CSI lanes at 972Mbit/s,
+which allows 1080P50 UYVY down 2 lanes.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+media: tc358743: Add support for 972Mbit/s link freq.
+
+Adds register setups for running the CSI lanes at 972Mbit/s,
+which allows 1080P50 UYVY down 2 lanes.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+media: i2c: tc358743: Fix fallthrough warning
+
+Signed-off-by: Jacko Dirks <jdirks.linuxdev@gmail.com>
+---
+ drivers/media/i2c/tc358743.c | 48 +++++++++++++++++++++++++-----------
+ 1 file changed, 34 insertions(+), 14 deletions(-)
+
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -1962,6 +1962,7 @@ static int tc358743_probe_of(struct tc35
+ 	/*
+ 	 * The CSI bps per lane must be between 62.5 Mbps and 1 Gbps.
+ 	 * The default is 594 Mbps for 4-lane 1080p60 or 2-lane 720p60.
++	 * 972 Mbps allows 1080P50 UYVY over 2-lane.
+ 	 */
+ 	bps_pr_lane = 2 * endpoint.link_frequencies[0];
+ 	if (bps_pr_lane < 62500000U || bps_pr_lane > 1000000000U) {
+@@ -1975,23 +1976,42 @@ static int tc358743_probe_of(struct tc35
+ 			       state->pdata.refclk_hz * state->pdata.pll_prd;
+ 
+ 	/*
+-	 * FIXME: These timings are from REF_02 for 594 Mbps per lane (297 MHz
+-	 * link frequency). In principle it should be possible to calculate
++	 * FIXME: These timings are from REF_02 for 594 or 972 Mbps per lane
++	 * (297 MHz or 486 MHz link frequency).
++	 * In principle it should be possible to calculate
+ 	 * them based on link frequency and resolution.
+ 	 */
+-	if (bps_pr_lane != 594000000U)
++	switch (bps_pr_lane) {
++	default:
+ 		dev_warn(dev, "untested bps per lane: %u bps\n", bps_pr_lane);
+-	state->pdata.lineinitcnt = 0xe80;
+-	state->pdata.lptxtimecnt = 0x003;
+-	/* tclk-preparecnt: 3, tclk-zerocnt: 20 */
+-	state->pdata.tclk_headercnt = 0x1403;
+-	state->pdata.tclk_trailcnt = 0x00;
+-	/* ths-preparecnt: 3, ths-zerocnt: 1 */
+-	state->pdata.ths_headercnt = 0x0103;
+-	state->pdata.twakeup = 0x4882;
+-	state->pdata.tclk_postcnt = 0x008;
+-	state->pdata.ths_trailcnt = 0x2;
+-	state->pdata.hstxvregcnt = 0;
++		fallthrough;
++	case 594000000U:
++		state->pdata.lineinitcnt = 0xe80;
++		state->pdata.lptxtimecnt = 0x003;
++		/* tclk-preparecnt: 3, tclk-zerocnt: 20 */
++		state->pdata.tclk_headercnt = 0x1403;
++		state->pdata.tclk_trailcnt = 0x00;
++		/* ths-preparecnt: 3, ths-zerocnt: 1 */
++		state->pdata.ths_headercnt = 0x0103;
++		state->pdata.twakeup = 0x4882;
++		state->pdata.tclk_postcnt = 0x008;
++		state->pdata.ths_trailcnt = 0x2;
++		state->pdata.hstxvregcnt = 0;
++		break;
++	case 972000000U:
++		state->pdata.lineinitcnt = 0x1b58;
++		state->pdata.lptxtimecnt = 0x007;
++		/* tclk-preparecnt: 6, tclk-zerocnt: 40 */
++		state->pdata.tclk_headercnt = 0x2806;
++		state->pdata.tclk_trailcnt = 0x00;
++		/* ths-preparecnt: 6, ths-zerocnt: 8 */
++		state->pdata.ths_headercnt = 0x0806;
++		state->pdata.twakeup = 0x4268;
++		state->pdata.tclk_postcnt = 0x008;
++		state->pdata.ths_trailcnt = 0x5;
++		state->pdata.hstxvregcnt = 0;
++		break;
++	}
+ 
+ 	state->reset_gpio = devm_gpiod_get_optional(dev, "reset",
+ 						    GPIOD_OUT_LOW);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0102-media-tc358743-Check-I2C-succeeded-during-probe.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0102-media-tc358743-Check-I2C-succeeded-during-probe.patch
new file mode 100644
index 00000000..e808e6e8
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0102-media-tc358743-Check-I2C-succeeded-during-probe.patch
@@ -0,0 +1,98 @@
+From ffe6b9c74a772bbecf6ea09c3dd097901c2048ef Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Wed, 31 Oct 2018 14:57:34 +0000
+Subject: [PATCH 102/697] media: tc358743: Check I2C succeeded during probe.
+
+The probe for the TC358743 reads the CHIPID register from
+the device and compares it to the expected value of 0.
+If the I2C request fails then that also returns 0, so
+the driver loads thinking that the device is there.
+
+Generally I2C communications are reliable so there is
+limited need to check the return value on every transfer,
+therefore only amend the one read during probe to check
+for I2C errors.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/media/i2c/tc358743.c | 27 +++++++++++++++++++++++----
+ 1 file changed, 23 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -110,7 +110,7 @@ static inline struct tc358743_state *to_
+ 
+ /* --------------- I2C --------------- */
+ 
+-static void i2c_rd(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n)
++static int i2c_rd(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n)
+ {
+ 	struct tc358743_state *state = to_state(sd);
+ 	struct i2c_client *client = state->i2c_client;
+@@ -136,6 +136,7 @@ static void i2c_rd(struct v4l2_subdev *s
+ 		v4l2_err(sd, "%s: reading register 0x%x from 0x%x failed: %d\n",
+ 				__func__, reg, client->addr, err);
+ 	}
++	return err != ARRAY_SIZE(msgs);
+ }
+ 
+ static void i2c_wr(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n)
+@@ -192,15 +193,24 @@ static void i2c_wr(struct v4l2_subdev *s
+ 	}
+ }
+ 
+-static noinline u32 i2c_rdreg(struct v4l2_subdev *sd, u16 reg, u32 n)
++static noinline u32 i2c_rdreg_err(struct v4l2_subdev *sd, u16 reg, u32 n,
++				  int *err)
+ {
++	int error;
+ 	__le32 val = 0;
+ 
+-	i2c_rd(sd, reg, (u8 __force *)&val, n);
++	error = i2c_rd(sd, reg, (u8 __force *)&val, n);
++	if (err)
++		*err = error;
+ 
+ 	return le32_to_cpu(val);
+ }
+ 
++static inline u32 i2c_rdreg(struct v4l2_subdev *sd, u16 reg, u32 n)
++{
++	return i2c_rdreg_err(sd, reg, n, NULL);
++}
++
+ static noinline void i2c_wrreg(struct v4l2_subdev *sd, u16 reg, u32 val, u32 n)
+ {
+ 	__le32 raw = cpu_to_le32(val);
+@@ -229,6 +239,13 @@ static u16 i2c_rd16(struct v4l2_subdev *
+ 	return i2c_rdreg(sd, reg, 2);
+ }
+ 
++static int i2c_rd16_err(struct v4l2_subdev *sd, u16 reg, u16 *value)
++{
++	int err;
++	*value = i2c_rdreg_err(sd, reg, 2, &err);
++	return err;
++}
++
+ static void i2c_wr16(struct v4l2_subdev *sd, u16 reg, u16 val)
+ {
+ 	i2c_wrreg(sd, reg, val, 2);
+@@ -2050,6 +2067,7 @@ static int tc358743_probe(struct i2c_cli
+ 	struct tc358743_platform_data *pdata = client->dev.platform_data;
+ 	struct v4l2_subdev *sd;
+ 	u16 irq_mask = MASK_HDMI_MSK | MASK_CSI_MSK;
++	u16 chipid;
+ 	int err;
+ 
+ 	if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_BYTE_DATA))
+@@ -2081,7 +2099,8 @@ static int tc358743_probe(struct i2c_cli
+ 	sd->flags |= V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS;
+ 
+ 	/* i2c access */
+-	if ((i2c_rd16(sd, CHIPID) & MASK_CHIPID) != 0) {
++	if (i2c_rd16_err(sd, CHIPID, &chipid) ||
++	    (chipid & MASK_CHIPID) != 0) {
+ 		v4l2_info(sd, "not a TC358743 on address 0x%x\n",
+ 			  client->addr << 1);
+ 		return -ENODEV;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0103-media-adv7180-Default-to-the-first-valid-input.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0103-media-adv7180-Default-to-the-first-valid-input.patch
new file mode 100644
index 00000000..c8533ca4
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0103-media-adv7180-Default-to-the-first-valid-input.patch
@@ -0,0 +1,45 @@
+From 2904284caace567741621bf4d1f1edb7685ce9ac Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Wed, 31 Oct 2018 14:57:46 +0000
+Subject: [PATCH 103/697] media: adv7180: Default to the first valid input
+
+The hardware default is differential CVBS on AIN1 & 2, which
+isn't very useful.
+
+Select the first input that is defined as valid for the
+chip variant (typically CVBS_AIN1).
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/media/i2c/adv7180.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -1352,6 +1352,7 @@ static const struct adv7180_chip_info ad
+ static int init_device(struct adv7180_state *state)
+ {
+ 	int ret;
++	int i;
+ 
+ 	mutex_lock(&state->mutex);
+ 
+@@ -1399,6 +1400,18 @@ static int init_device(struct adv7180_st
+ 			goto out_unlock;
+ 	}
+ 
++	/* Select first valid input */
++	for (i = 0; i < 32; i++) {
++		if (BIT(i) & state->chip_info->valid_input_mask) {
++			ret = state->chip_info->select_input(state, i);
++
++			if (ret == 0) {
++				state->input = i;
++				break;
++			}
++		}
++	}
++
+ out_unlock:
+ 	mutex_unlock(&state->mutex);
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0104-media-adv7180-Add-YPrPb-support-for-ADV7282M.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0104-media-adv7180-Add-YPrPb-support-for-ADV7282M.patch
new file mode 100644
index 00000000..88b8018f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0104-media-adv7180-Add-YPrPb-support-for-ADV7282M.patch
@@ -0,0 +1,24 @@
+From 574a32c1fa8e3c8bba75f90a2d0a8db25eca983f Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Wed, 31 Oct 2018 14:57:56 +0000
+Subject: [PATCH 104/697] media: adv7180: Add YPrPb support for ADV7282M
+
+The ADV7282M can support YPbPr on AIN1-3, but this was
+not selectable from the driver. Add it to the list of
+supported input modes.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/media/i2c/adv7180.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -1341,6 +1341,7 @@ static const struct adv7180_chip_info ad
+ 		BIT(ADV7182_INPUT_SVIDEO_AIN1_AIN2) |
+ 		BIT(ADV7182_INPUT_SVIDEO_AIN3_AIN4) |
+ 		BIT(ADV7182_INPUT_SVIDEO_AIN7_AIN8) |
++		BIT(ADV7182_INPUT_YPRPB_AIN1_AIN2_AIN3) |
+ 		BIT(ADV7182_INPUT_DIFF_CVBS_AIN1_AIN2) |
+ 		BIT(ADV7182_INPUT_DIFF_CVBS_AIN3_AIN4) |
+ 		BIT(ADV7182_INPUT_DIFF_CVBS_AIN7_AIN8),
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0105-media-videodev2-Add-helper-defines-for-printing-FOUR.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0105-media-videodev2-Add-helper-defines-for-printing-FOUR.patch
new file mode 100644
index 00000000..d65a285e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0105-media-videodev2-Add-helper-defines-for-printing-FOUR.patch
@@ -0,0 +1,28 @@
+From 7d6b3cd287c1feef542d9d514b90525552698dcf Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Wed, 31 Oct 2018 14:58:08 +0000
+Subject: [PATCH 105/697] media: videodev2: Add helper defines for printing
+ FOURCCs
+
+New helper defines that allow printing of a FOURCC using
+printf(V4L2_FOURCC_CONV, V4L2_FOURCC_CONV_ARGS(fourcc));
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ include/uapi/linux/videodev2.h | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -82,6 +82,11 @@
+ 	((__u32)(a) | ((__u32)(b) << 8) | ((__u32)(c) << 16) | ((__u32)(d) << 24))
+ #define v4l2_fourcc_be(a, b, c, d)	(v4l2_fourcc(a, b, c, d) | (1U << 31))
+ 
++#define V4L2_FOURCC_CONV "%c%c%c%c%s"
++#define V4L2_FOURCC_CONV_ARGS(fourcc) \
++	(fourcc) & 0x7f, ((fourcc) >> 8) & 0x7f, ((fourcc) >> 16) & 0x7f, \
++	((fourcc) >> 24) & 0x7f, (fourcc) & BIT(31) ? "-BE" : ""
++
+ /*
+  *	E N U M S
+  */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0106-dt-bindings-Document-BCM283x-CSI2-CCP2-receiver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0106-dt-bindings-Document-BCM283x-CSI2-CCP2-receiver.patch
new file mode 100644
index 00000000..8df6bd4e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0106-dt-bindings-Document-BCM283x-CSI2-CCP2-receiver.patch
@@ -0,0 +1,103 @@
+From 81969a2dd3a650a493a24a17c0f81ff1d69055f3 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Wed, 31 Oct 2018 14:59:06 +0000
+Subject: [PATCH 106/697] dt-bindings: Document BCM283x CSI2/CCP2 receiver
+
+Document the DT bindings for the CSI2/CCP2 receiver peripheral
+(known as Unicam) on BCM283x SoCs.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Acked-by: Rob Herring <robh@kernel.org>
+---
+ .../bindings/media/bcm2835-unicam.txt         | 85 +++++++++++++++++++
+ 1 file changed, 85 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/media/bcm2835-unicam.txt
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/bcm2835-unicam.txt
+@@ -0,0 +1,85 @@
++Broadcom BCM283x Camera Interface (Unicam)
++------------------------------------------
++
++The Unicam block on BCM283x SoCs is the receiver for either
++CSI-2 or CCP2 data from image sensors or similar devices.
++
++The main platform using this SoC is the Raspberry Pi family of boards.
++On the Pi the VideoCore firmware can also control this hardware block,
++and driving it from two different processors will cause issues.
++To avoid this, the firmware checks the device tree configuration
++during boot. If it finds device tree nodes called csi0 or csi1 then
++it will stop the firmware accessing the block, and it can then
++safely be used via the device tree binding.
++
++Required properties:
++===================
++- compatible	: must be "brcm,bcm2835-unicam".
++- reg		: physical base address and length of the register sets for the
++		  device.
++- interrupts	: should contain the IRQ line for this Unicam instance.
++- clocks	: list of clock specifiers, corresponding to entries in
++		  clock-names property.
++- clock-names	: must contain an "lp" entry, matching entries in the
++		  clocks property.
++
++Unicam supports a single port node. It should contain one 'port' child node
++with child 'endpoint' node. Please refer to the bindings defined in
++Documentation/devicetree/bindings/media/video-interfaces.txt.
++
++Within the endpoint node the "remote-endpoint" and "data-lanes" properties
++are mandatory.
++Data lane reordering is not supported so the data lanes must be in order,
++starting at 1. The number of data lanes should represent the number of
++usable lanes for the hardware block. That may be limited by either the SoC or
++how the platform presents the interface, and the lower value must be used.
++
++Lane reordering is not supported on the clock lane either, so the optional
++property "clock-lane" will implicitly be <0>.
++Similarly lane inversion is not supported, therefore "lane-polarities" will
++implicitly be <0 0 0 0 0>.
++Neither of these values will be checked.
++
++Example:
++	csi1: csi1@7e801000 {
++		compatible = "brcm,bcm2835-unicam";
++		reg = <0x7e801000 0x800>,
++		      <0x7e802004 0x4>;
++		interrupts = <2 7>;
++		clocks = <&clocks BCM2835_CLOCK_CAM1>;
++		clock-names = "lp";
++
++		port {
++			csi1_ep: endpoint {
++				remote-endpoint = <&tc358743_0>;
++				data-lanes = <1 2>;
++			};
++		};
++	};
++
++	i2c0: i2c@7e205000 {
++		tc358743: csi-hdmi-bridge@0f {
++			compatible = "toshiba,tc358743";
++			reg = <0x0f>;
++
++			clocks = <&tc358743_clk>;
++			clock-names = "refclk";
++
++			tc358743_clk: bridge-clk {
++				compatible = "fixed-clock";
++				#clock-cells = <0>;
++				clock-frequency = <27000000>;
++			};
++
++			port {
++				tc358743_0: endpoint {
++					remote-endpoint = <&csi1_ep>;
++					clock-lanes = <0>;
++					data-lanes = <1 2>;
++					clock-noncontinuous;
++					link-frequencies =
++						/bits/ 64 <297000000>;
++				};
++			};
++		};
++	};
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0107-media-tc358743-Return-an-appropriate-colorspace-from.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0107-media-tc358743-Return-an-appropriate-colorspace-from.patch
new file mode 100644
index 00000000..f627dbb0
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0107-media-tc358743-Return-an-appropriate-colorspace-from.patch
@@ -0,0 +1,110 @@
+From 8328c5f6bfcc6ffc6584e6ac053af7c2f343e574 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Thu, 22 Nov 2018 17:31:06 +0000
+Subject: [PATCH 107/697] media: tc358743: Return an appropriate colorspace
+ from tc358743_set_fmt
+
+When calling tc358743_set_fmt, the code was calling tc358743_get_fmt
+to choose a valid format. However that sets the colorspace
+based on what was read back from the chip. When you set the format,
+then the driver would choose and program the colorspace based
+on the format code.
+
+The result was that if you called try or set format for UYVY
+when the current format was RGB3 then you would get told sRGB,
+and try RGB3 when current was UYVY and you would get told
+SMPTE170M.
+
+The value programmed into the chip is determined by this driver,
+therefore there is no need to read back the value. Return the
+colorspace based on the format set/tried instead.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+media: i2c: tc358743: Only allow supported pixel fmts in set_fmt
+
+Fix commit "media: tc358743: Return an appropriate colorspace from
+tc358743_set_fmt" to ensure that the format passed in to set_fmt
+is checked to be valid, and reset to the current format if not.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/tc358743.c | 44 ++++++++++++++----------------------
+ 1 file changed, 17 insertions(+), 27 deletions(-)
+
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -1677,12 +1677,23 @@ static int tc358743_enum_mbus_code(struc
+ 	return 0;
+ }
+ 
++static u32 tc358743_g_colorspace(u32 code)
++{
++	switch (code) {
++	case MEDIA_BUS_FMT_RGB888_1X24:
++		return V4L2_COLORSPACE_SRGB;
++	case MEDIA_BUS_FMT_UYVY8_1X16:
++		return V4L2_COLORSPACE_SMPTE170M;
++	default:
++		return 0;
++	}
++}
++
+ static int tc358743_get_fmt(struct v4l2_subdev *sd,
+ 		struct v4l2_subdev_state *sd_state,
+ 		struct v4l2_subdev_format *format)
+ {
+ 	struct tc358743_state *state = to_state(sd);
+-	u8 vi_rep = i2c_rd8(sd, VI_REP);
+ 
+ 	if (format->pad != 0)
+ 		return -EINVAL;
+@@ -1692,23 +1703,7 @@ static int tc358743_get_fmt(struct v4l2_
+ 	format->format.height = state->timings.bt.height;
+ 	format->format.field = V4L2_FIELD_NONE;
+ 
+-	switch (vi_rep & MASK_VOUT_COLOR_SEL) {
+-	case MASK_VOUT_COLOR_RGB_FULL:
+-	case MASK_VOUT_COLOR_RGB_LIMITED:
+-		format->format.colorspace = V4L2_COLORSPACE_SRGB;
+-		break;
+-	case MASK_VOUT_COLOR_601_YCBCR_LIMITED:
+-	case MASK_VOUT_COLOR_601_YCBCR_FULL:
+-		format->format.colorspace = V4L2_COLORSPACE_SMPTE170M;
+-		break;
+-	case MASK_VOUT_COLOR_709_YCBCR_FULL:
+-	case MASK_VOUT_COLOR_709_YCBCR_LIMITED:
+-		format->format.colorspace = V4L2_COLORSPACE_REC709;
+-		break;
+-	default:
+-		format->format.colorspace = 0;
+-		break;
+-	}
++	format->format.colorspace = tc358743_g_colorspace(format->format.code);
+ 
+ 	return 0;
+ }
+@@ -1722,19 +1717,14 @@ static int tc358743_set_fmt(struct v4l2_
+ 	u32 code = format->format.code; /* is overwritten by get_fmt */
+ 	int ret = tc358743_get_fmt(sd, sd_state, format);
+ 
+-	format->format.code = code;
++	if (code == MEDIA_BUS_FMT_RGB888_1X24 ||
++	    code == MEDIA_BUS_FMT_UYVY8_1X16)
++		format->format.code = code;
++	format->format.colorspace = tc358743_g_colorspace(format->format.code);
+ 
+ 	if (ret)
+ 		return ret;
+ 
+-	switch (code) {
+-	case MEDIA_BUS_FMT_RGB888_1X24:
+-	case MEDIA_BUS_FMT_UYVY8_1X16:
+-		break;
+-	default:
+-		return -EINVAL;
+-	}
+-
+ 	if (format->which == V4L2_SUBDEV_FORMAT_TRY)
+ 		return 0;
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0108-staging-mmal-vchiq-Avoid-use-of-bool-in-structures.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0108-staging-mmal-vchiq-Avoid-use-of-bool-in-structures.patch
new file mode 100644
index 00000000..cbaff633
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0108-staging-mmal-vchiq-Avoid-use-of-bool-in-structures.patch
@@ -0,0 +1,24 @@
+From 91f00d25037cc688bcbfdd9bd800d210e1664401 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Mon, 29 Oct 2018 16:20:46 +0000
+Subject: [PATCH 108/697] staging: mmal-vchiq: Avoid use of bool in structures
+
+Fixes up a checkpatch error "Avoid using bool structure members
+because of possible alignment issues".
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+@@ -1774,7 +1774,7 @@ int vchiq_mmal_component_enable(struct v
+ 
+ 	ret = enable_component(instance, component);
+ 	if (ret == 0)
+-		component->enabled = true;
++		component->enabled = 1;
+ 
+ 	mutex_unlock(&instance->vchiq_mutex);
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0109-staging-mmal-vchiq-Add-support-for-event-callbacks.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0109-staging-mmal-vchiq-Add-support-for-event-callbacks.patch
new file mode 100644
index 00000000..6a941691
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0109-staging-mmal-vchiq-Add-support-for-event-callbacks.patch
@@ -0,0 +1,356 @@
+From fcecc17e3bf2a3cc274d53b554a3ad8103083693 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Mon, 24 Sep 2018 18:15:38 +0100
+Subject: [PATCH 109/697] staging: mmal-vchiq: Add support for event callbacks.
+
+(Preparation for the codec driver).
+The codec uses the event mechanism to report things such as
+resolution changes. It is signalled by the cmd field of the buffer
+being non-zero.
+
+Add support for passing this information out to the client.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ .../vc04_services/vchiq-mmal/mmal-common.h    |   1 +
+ .../vc04_services/vchiq-mmal/mmal-msg.h       |  35 ++++
+ .../vc04_services/vchiq-mmal/mmal-vchiq.c     | 170 ++++++++++++++++--
+ .../vc04_services/vchiq-mmal/mmal-vchiq.h     |   4 +
+ 4 files changed, 196 insertions(+), 14 deletions(-)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-common.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-common.h
+@@ -50,6 +50,7 @@ struct mmal_buffer {
+ 
+ 	struct mmal_msg_context *msg_context;
+ 
++	u32 cmd;		/* MMAL command. 0=data. */
+ 	unsigned long length;
+ 	u32 mmal_flags;
+ 	s64 dts;
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-msg.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-msg.h
+@@ -346,6 +346,41 @@ struct mmal_msg_port_parameter_get_reply
+ /* event messages */
+ #define MMAL_WORKER_EVENT_SPACE 256
+ 
++/* Four CC's for events */
++#define MMAL_FOURCC(a, b, c, d) ((a) | (b << 8) | (c << 16) | (d << 24))
++
++#define MMAL_EVENT_ERROR		MMAL_FOURCC('E', 'R', 'R', 'O')
++#define MMAL_EVENT_EOS			MMAL_FOURCC('E', 'E', 'O', 'S')
++#define MMAL_EVENT_FORMAT_CHANGED	MMAL_FOURCC('E', 'F', 'C', 'H')
++#define MMAL_EVENT_PARAMETER_CHANGED	MMAL_FOURCC('E', 'P', 'C', 'H')
++
++/* Structs for each of the event message payloads */
++struct mmal_msg_event_eos {
++	u32 port_type;	/**< Type of port that received the end of stream */
++	u32 port_index;	/**< Index of port that received the end of stream */
++};
++
++/** Format changed event data. */
++struct mmal_msg_event_format_changed {
++	/* Minimum size of buffers the port requires */
++	u32 buffer_size_min;
++	/* Minimum number of buffers the port requires */
++	u32 buffer_num_min;
++	/* Size of buffers the port recommends for optimal performance.
++	 * A value of zero means no special recommendation.
++	 */
++	u32 buffer_size_recommended;
++	/* Number of buffers the port recommends for optimal
++	 * performance. A value of zero means no special recommendation.
++	 */
++	u32 buffer_num_recommended;
++
++	u32 es_ptr;
++	struct mmal_es_format format;
++	union mmal_es_specific_format es;
++	u8 extradata[MMAL_FORMAT_EXTRADATA_MAX_SIZE];
++};
++
+ struct mmal_msg_event_to_host {
+ 	u32 client_component;	/* component context */
+ 
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+@@ -144,6 +144,8 @@ struct mmal_msg_context {
+ 			/* Presentation and Decode timestamps */
+ 			s64 pts;
+ 			s64 dts;
++			/* MMAL buffer command flag */
++			u32 cmd;
+ 
+ 			int status;	/* context status */
+ 
+@@ -231,18 +233,6 @@ release_msg_context(struct mmal_msg_cont
+ 	kfree(msg_context);
+ }
+ 
+-/* deals with receipt of event to host message */
+-static void event_to_host_cb(struct vchiq_mmal_instance *instance,
+-			     struct mmal_msg *msg, u32 msg_len)
+-{
+-	pr_debug("unhandled event\n");
+-	pr_debug("component:%u port type:%d num:%d cmd:0x%x length:%d\n",
+-		 msg->u.event_to_host.client_component,
+-		 msg->u.event_to_host.port_type,
+-		 msg->u.event_to_host.port_num,
+-		 msg->u.event_to_host.cmd, msg->u.event_to_host.length);
+-}
+-
+ /* workqueue scheduled callback
+  *
+  * we do this because it is important we do not call any other vchiq
+@@ -264,13 +254,18 @@ static void buffer_work_cb(struct work_s
+ 	buffer->mmal_flags = msg_context->u.bulk.mmal_flags;
+ 	buffer->dts = msg_context->u.bulk.dts;
+ 	buffer->pts = msg_context->u.bulk.pts;
++	buffer->cmd = msg_context->u.bulk.cmd;
+ 
+-	atomic_dec(&msg_context->u.bulk.port->buffers_with_vpu);
++	if (!buffer->cmd)
++		atomic_dec(&msg_context->u.bulk.port->buffers_with_vpu);
+ 
+ 	msg_context->u.bulk.port->buffer_cb(msg_context->u.bulk.instance,
+ 					    msg_context->u.bulk.port,
+ 					    msg_context->u.bulk.status,
+ 					    msg_context->u.bulk.buffer);
++
++	if (buffer->cmd)
++		mutex_unlock(&msg_context->u.bulk.port->event_context_mutex);
+ }
+ 
+ /* workqueue scheduled callback to handle receiving buffers
+@@ -348,6 +343,7 @@ static int bulk_receive(struct vchiq_mma
+ 	msg_context->u.bulk.buffer_used = rd_len;
+ 	msg_context->u.bulk.dts = msg->u.buffer_from_host.buffer_header.dts;
+ 	msg_context->u.bulk.pts = msg->u.buffer_from_host.buffer_header.pts;
++	msg_context->u.bulk.cmd = msg->u.buffer_from_host.buffer_header.cmd;
+ 
+ 	queue_work(msg_context->instance->bulk_wq,
+ 		   &msg_context->u.bulk.buffer_to_host_work);
+@@ -450,6 +446,103 @@ buffer_from_host(struct vchiq_mmal_insta
+ 	return ret;
+ }
+ 
++/* deals with receipt of event to host message */
++static void event_to_host_cb(struct vchiq_mmal_instance *instance,
++			     struct mmal_msg *msg, u32 msg_len)
++{
++	/* FIXME: Not going to work on 64 bit */
++	struct vchiq_mmal_component *component =
++		(struct vchiq_mmal_component *)msg->u.event_to_host.client_component;
++	struct vchiq_mmal_port *port = NULL;
++	struct mmal_msg_context *msg_context;
++	u32 port_num = msg->u.event_to_host.port_num;
++
++	if (msg->u.buffer_from_host.drvbuf.magic == MMAL_MAGIC) {
++		pr_err("%s: MMAL_MSG_TYPE_BUFFER_TO_HOST with bad magic\n",
++		       __func__);
++		return;
++	}
++
++	switch (msg->u.event_to_host.port_type) {
++	case MMAL_PORT_TYPE_CONTROL:
++		if (port_num) {
++			pr_err("%s: port_num of %u >= number of ports 1",
++			       __func__, port_num);
++			return;
++		}
++		port = &component->control;
++		break;
++	case MMAL_PORT_TYPE_INPUT:
++		if (port_num >= component->inputs) {
++			pr_err("%s: port_num of %u >= number of ports %u",
++			       __func__, port_num,
++			       port_num >= component->inputs);
++			return;
++		}
++		port = &component->input[port_num];
++		break;
++	case MMAL_PORT_TYPE_OUTPUT:
++		if (port_num >= component->outputs) {
++			pr_err("%s: port_num of %u >= number of ports %u",
++			       __func__, port_num,
++			       port_num >= component->outputs);
++			return;
++		}
++		port = &component->output[port_num];
++		break;
++	case MMAL_PORT_TYPE_CLOCK:
++		if (port_num >= component->clocks) {
++			pr_err("%s: port_num of %u >= number of ports %u",
++			       __func__, port_num,
++			       port_num >= component->clocks);
++			return;
++		}
++		port = &component->clock[port_num];
++		break;
++	default:
++		break;
++	}
++
++	if (!mutex_trylock(&port->event_context_mutex)) {
++		pr_err("dropping event 0x%x\n", msg->u.event_to_host.cmd);
++		return;
++	}
++	msg_context = port->event_context;
++
++	if (msg->h.status != MMAL_MSG_STATUS_SUCCESS) {
++		/* message reception had an error */
++		//pr_warn
++		pr_err("%s: error %d in reply\n", __func__, msg->h.status);
++
++		msg_context->u.bulk.status = msg->h.status;
++	} else if (msg->u.event_to_host.length > MMAL_WORKER_EVENT_SPACE) {
++		/* data is not in message, queue a bulk receive */
++		pr_err("%s: payload not in message - bulk receive??! NOT SUPPORTED\n",
++		       __func__);
++		msg_context->u.bulk.status = -1;
++	} else {
++		memcpy(msg_context->u.bulk.buffer->buffer,
++		       msg->u.event_to_host.data,
++		       msg->u.event_to_host.length);
++
++		msg_context->u.bulk.buffer_used =
++		    msg->u.event_to_host.length;
++
++		msg_context->u.bulk.mmal_flags = 0;
++		msg_context->u.bulk.dts = MMAL_TIME_UNKNOWN;
++		msg_context->u.bulk.pts = MMAL_TIME_UNKNOWN;
++		msg_context->u.bulk.cmd = msg->u.event_to_host.cmd;
++
++		pr_debug("event component:%u port type:%d num:%d cmd:0x%x length:%d\n",
++			 msg->u.event_to_host.client_component,
++			 msg->u.event_to_host.port_type,
++			 msg->u.event_to_host.port_num,
++			 msg->u.event_to_host.cmd, msg->u.event_to_host.length);
++	}
++
++	schedule_work(&msg_context->u.bulk.work);
++}
++
+ /* deals with receipt of buffer to host message */
+ static void buffer_to_host_cb(struct vchiq_mmal_instance *instance,
+ 			      struct mmal_msg *msg, u32 msg_len)
+@@ -1331,6 +1424,7 @@ static int port_disable(struct vchiq_mma
+ 				mmalbuf->mmal_flags = 0;
+ 				mmalbuf->dts = MMAL_TIME_UNKNOWN;
+ 				mmalbuf->pts = MMAL_TIME_UNKNOWN;
++				mmalbuf->cmd = 0;
+ 				port->buffer_cb(instance,
+ 						port, 0, mmalbuf);
+ 			}
+@@ -1632,6 +1726,43 @@ int mmal_vchi_buffer_cleanup(struct mmal
+ }
+ EXPORT_SYMBOL_GPL(mmal_vchi_buffer_cleanup);
+ 
++static void init_event_context(struct vchiq_mmal_instance *instance,
++			       struct vchiq_mmal_port *port)
++{
++	struct mmal_msg_context *ctx = get_msg_context(instance);
++
++	mutex_init(&port->event_context_mutex);
++
++	port->event_context = ctx;
++	ctx->u.bulk.instance = instance;
++	ctx->u.bulk.port = port;
++	ctx->u.bulk.buffer =
++		kzalloc(sizeof(*ctx->u.bulk.buffer), GFP_KERNEL);
++	if (!ctx->u.bulk.buffer)
++		goto release_msg_context;
++	ctx->u.bulk.buffer->buffer = kzalloc(MMAL_WORKER_EVENT_SPACE,
++					     GFP_KERNEL);
++	if (!ctx->u.bulk.buffer->buffer)
++		goto release_buffer;
++
++	INIT_WORK(&ctx->u.bulk.work, buffer_work_cb);
++	return;
++
++release_buffer:
++	kfree(ctx->u.bulk.buffer);
++release_msg_context:
++	release_msg_context(ctx);
++}
++
++static void free_event_context(struct vchiq_mmal_port *port)
++{
++	struct mmal_msg_context *ctx = port->event_context;
++
++	kfree(ctx->u.bulk.buffer->buffer);
++	kfree(ctx->u.bulk.buffer);
++	release_msg_context(ctx);
++}
++
+ /* Initialise a mmal component and its ports
+  *
+  */
+@@ -1681,6 +1812,7 @@ int vchiq_mmal_component_init(struct vch
+ 	ret = port_info_get(instance, &component->control);
+ 	if (ret < 0)
+ 		goto release_component;
++	init_event_context(instance, &component->control);
+ 
+ 	for (idx = 0; idx < component->inputs; idx++) {
+ 		component->input[idx].type = MMAL_PORT_TYPE_INPUT;
+@@ -1691,6 +1823,7 @@ int vchiq_mmal_component_init(struct vch
+ 		ret = port_info_get(instance, &component->input[idx]);
+ 		if (ret < 0)
+ 			goto release_component;
++		init_event_context(instance, &component->input[idx]);
+ 	}
+ 
+ 	for (idx = 0; idx < component->outputs; idx++) {
+@@ -1702,6 +1835,7 @@ int vchiq_mmal_component_init(struct vch
+ 		ret = port_info_get(instance, &component->output[idx]);
+ 		if (ret < 0)
+ 			goto release_component;
++		init_event_context(instance, &component->output[idx]);
+ 	}
+ 
+ 	for (idx = 0; idx < component->clocks; idx++) {
+@@ -1713,6 +1847,7 @@ int vchiq_mmal_component_init(struct vch
+ 		ret = port_info_get(instance, &component->clock[idx]);
+ 		if (ret < 0)
+ 			goto release_component;
++		init_event_context(instance, &component->clock[idx]);
+ 	}
+ 
+ 	*component_out = component;
+@@ -1738,7 +1873,7 @@ EXPORT_SYMBOL_GPL(vchiq_mmal_component_i
+ int vchiq_mmal_component_finalise(struct vchiq_mmal_instance *instance,
+ 				  struct vchiq_mmal_component *component)
+ {
+-	int ret;
++	int ret, idx;
+ 
+ 	if (mutex_lock_interruptible(&instance->vchiq_mutex))
+ 		return -EINTR;
+@@ -1750,6 +1885,13 @@ int vchiq_mmal_component_finalise(struct
+ 
+ 	component->in_use = false;
+ 
++	for (idx = 0; idx < component->inputs; idx++)
++		free_event_context(&component->input[idx]);
++	for (idx = 0; idx < component->outputs; idx++)
++		free_event_context(&component->output[idx]);
++	for (idx = 0; idx < component->clocks; idx++)
++		free_event_context(&component->clock[idx]);
++
+ 	mutex_unlock(&instance->vchiq_mutex);
+ 
+ 	return ret;
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
+@@ -79,6 +79,10 @@ struct vchiq_mmal_port {
+ 	vchiq_mmal_buffer_cb buffer_cb;
+ 	/* callback context */
+ 	void *cb_ctx;
++
++	/* ensure serialised use of the one event context structure */
++	struct mutex event_context_mutex;
++	struct mmal_msg_context *event_context;
+ };
+ 
+ struct vchiq_mmal_component {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0110-staging-vc04_services-Support-sending-data-to-MMAL-p.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0110-staging-vc04_services-Support-sending-data-to-MMAL-p.patch
new file mode 100644
index 00000000..5f5c677a
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0110-staging-vc04_services-Support-sending-data-to-MMAL-p.patch
@@ -0,0 +1,42 @@
+From 041d9b50765fe587aafa4752dd7ca9cdba485b78 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Mon, 24 Sep 2018 18:26:02 +0100
+Subject: [PATCH 110/697] staging: vc04_services: Support sending data to MMAL
+ ports
+
+Add the ability to send data to ports. This only supports
+zero copy mode as the required bulk transfer setup calls
+are not done.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ .../vc04_services/vchiq-mmal/mmal-vchiq.c      | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+@@ -420,11 +420,19 @@ buffer_from_host(struct vchiq_mmal_insta
+ 	m.u.buffer_from_host.buffer_header.data =
+ 		(u32)(unsigned long)buf->buffer;
+ 	m.u.buffer_from_host.buffer_header.alloc_size = buf->buffer_size;
+-	m.u.buffer_from_host.buffer_header.length = 0;	/* nothing used yet */
+-	m.u.buffer_from_host.buffer_header.offset = 0;	/* no offset */
+-	m.u.buffer_from_host.buffer_header.flags = 0;	/* no flags */
+-	m.u.buffer_from_host.buffer_header.pts = MMAL_TIME_UNKNOWN;
+-	m.u.buffer_from_host.buffer_header.dts = MMAL_TIME_UNKNOWN;
++	if (port->type == MMAL_PORT_TYPE_OUTPUT) {
++		m.u.buffer_from_host.buffer_header.length = 0;
++		m.u.buffer_from_host.buffer_header.offset = 0;
++		m.u.buffer_from_host.buffer_header.flags = 0;
++		m.u.buffer_from_host.buffer_header.pts = MMAL_TIME_UNKNOWN;
++		m.u.buffer_from_host.buffer_header.dts = MMAL_TIME_UNKNOWN;
++	} else {
++		m.u.buffer_from_host.buffer_header.length = buf->length;
++		m.u.buffer_from_host.buffer_header.offset = 0;
++		m.u.buffer_from_host.buffer_header.flags = buf->mmal_flags;
++		m.u.buffer_from_host.buffer_header.pts = buf->pts;
++		m.u.buffer_from_host.buffer_header.dts = buf->dts;
++	}
+ 
+ 	/* clear buffer type specific data */
+ 	memset(&m.u.buffer_from_host.buffer_header_type_specific, 0,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0111-media-videobuf2-Allow-exporting-of-a-struct-dmabuf.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0111-media-videobuf2-Allow-exporting-of-a-struct-dmabuf.patch
new file mode 100644
index 00000000..42f26979
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0111-media-videobuf2-Allow-exporting-of-a-struct-dmabuf.patch
@@ -0,0 +1,82 @@
+From bfe08d43dbdf649ac3badae3676da56a1a739182 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Mon, 29 Oct 2018 17:57:45 +0000
+Subject: [PATCH 111/697] media: videobuf2: Allow exporting of a struct dmabuf
+
+videobuf2 only allowed exporting a dmabuf as a file descriptor,
+but there are instances where having the struct dma_buf is
+useful within the kernel.
+
+Split the current implementation into two, one step which
+exports a struct dma_buf, and the second which converts that
+into an fd.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ .../media/common/videobuf2/videobuf2-core.c   | 21 ++++++++++++++++---
+ include/media/videobuf2-core.h                | 15 +++++++++++++
+ 2 files changed, 33 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/common/videobuf2/videobuf2-core.c
++++ b/drivers/media/common/videobuf2/videobuf2-core.c
+@@ -2424,11 +2424,11 @@ static int __find_plane_by_offset(struct
+ 	return 0;
+ }
+ 
+-int vb2_core_expbuf(struct vb2_queue *q, int *fd, unsigned int type,
+-		    struct vb2_buffer *vb, unsigned int plane, unsigned int flags)
++int vb2_core_expbuf_dmabuf(struct vb2_queue *q, unsigned int type,
++			   struct vb2_buffer *vb, unsigned int plane,
++			   unsigned int flags, struct dma_buf **dmabuf)
+ {
+ 	struct vb2_plane *vb_plane;
+-	int ret;
+ 	struct dma_buf *dbuf;
+ 
+ 	if (q->memory != VB2_MEMORY_MMAP) {
+@@ -2473,6 +2473,21 @@ int vb2_core_expbuf(struct vb2_queue *q,
+ 		return -EINVAL;
+ 	}
+ 
++	*dmabuf = dbuf;
++	return 0;
++}
++EXPORT_SYMBOL_GPL(vb2_core_expbuf_dmabuf);
++
++int vb2_core_expbuf(struct vb2_queue *q, int *fd, unsigned int type,
++		    struct vb2_buffer *vb, unsigned int plane, unsigned int flags)
++{
++	struct dma_buf *dbuf;
++	int ret;
++
++	ret = vb2_core_expbuf_dmabuf(q, type, vb, plane, flags, &dbuf);
++	if (ret)
++		return ret;
++
+ 	ret = dma_buf_fd(dbuf, flags & ~O_ACCMODE);
+ 	if (ret < 0) {
+ 		dprintk(q, 3, "buffer %d, plane %d failed to export (%d)\n",
+--- a/include/media/videobuf2-core.h
++++ b/include/media/videobuf2-core.h
+@@ -968,6 +968,21 @@ int vb2_core_streamon(struct vb2_queue *
+ int vb2_core_streamoff(struct vb2_queue *q, unsigned int type);
+ 
+ /**
++ * vb2_core_expbuf_dmabuf() - Export a buffer as a dma_buf structure
++ * @q:         videobuf2 queue
++ * @type:      buffer type
++ * @index:     id number of the buffer
++ * @plane:     index of the plane to be exported, 0 for single plane queues
++ * @flags:     flags for newly created file, currently only O_CLOEXEC is
++ *             supported, refer to manual of open syscall for more details
++ * @dmabuf:    Returns the dmabuf pointer
++ *
++ */
++int vb2_core_expbuf_dmabuf(struct vb2_queue *q, unsigned int type,
++			   struct vb2_buffer *vb, unsigned int plane,
++			   unsigned int flags, struct dma_buf **dmabuf);
++
++/**
+  * vb2_core_expbuf() - Export a buffer as a file descriptor.
+  * @q:		pointer to &struct vb2_queue with videobuf2 queue.
+  * @fd:		pointer to the file descriptor associated with DMABUF
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0112-staging-mmal-vchiq-Fix-client_component-for-64-bit-k.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0112-staging-mmal-vchiq-Fix-client_component-for-64-bit-k.patch
new file mode 100644
index 00000000..0e8e301c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0112-staging-mmal-vchiq-Fix-client_component-for-64-bit-k.patch
@@ -0,0 +1,35 @@
+From f7c57d94a19178638dd96a4182ac9a7c68220daf Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Tue, 22 Jan 2019 12:04:09 +0000
+Subject: [PATCH 112/697] staging: mmal-vchiq: Fix client_component for 64 bit
+ kernel
+
+The MMAL client_component field is used with the event
+mechanism to allow the client to identify the component for
+which the event is generated.
+The field is only 32bits in size, therefore we can't use a
+pointer to the component in a 64 bit kernel.
+
+Component handles are already held in an array per VCHI
+instance, so use the array index as the client_component handle
+to avoid having to create a new IDR for this purpose.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+@@ -458,9 +458,9 @@ buffer_from_host(struct vchiq_mmal_insta
+ static void event_to_host_cb(struct vchiq_mmal_instance *instance,
+ 			     struct mmal_msg *msg, u32 msg_len)
+ {
+-	/* FIXME: Not going to work on 64 bit */
++	int comp_idx = msg->u.event_to_host.client_component;
+ 	struct vchiq_mmal_component *component =
+-		(struct vchiq_mmal_component *)msg->u.event_to_host.client_component;
++					&instance->component[comp_idx];
+ 	struct vchiq_mmal_port *port = NULL;
+ 	struct mmal_msg_context *msg_context;
+ 	u32 port_num = msg->u.event_to_host.port_num;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0113-staging-mmal_vchiq-Add-in-the-Bayer-encoding-formats.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0113-staging-mmal_vchiq-Add-in-the-Bayer-encoding-formats.patch
new file mode 100644
index 00000000..65e42137
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0113-staging-mmal_vchiq-Add-in-the-Bayer-encoding-formats.patch
@@ -0,0 +1,51 @@
+From dba6e096a3061a7fbdae5bac72c9f2d46eb1266c Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Wed, 13 Feb 2019 12:33:29 +0000
+Subject: [PATCH 113/697] staging: mmal_vchiq: Add in the Bayer encoding
+ formats
+
+The list of formats was copied before Bayer support was added.
+The ISP supports Bayer and is being supported by the bcm2835_codec
+driver, so add in the encodings for them.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ .../vc04_services/vchiq-mmal/mmal-encodings.h | 27 +++++++++++++++++++
+ 1 file changed, 27 insertions(+)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h
+@@ -69,6 +69,33 @@
+  */
+ #define MMAL_ENCODING_OPAQUE           MMAL_FOURCC('O', 'P', 'Q', 'V')
+ 
++/* Bayer formats
++ * FourCC values copied from V4L2 where defined.
++ */
++/* 8 bit per pixel Bayer formats. */
++#define MMAL_ENCODING_BAYER_SBGGR8     MMAL_FOURCC('B', 'A', '8', '1')
++#define MMAL_ENCODING_BAYER_SGBRG8     MMAL_FOURCC('G', 'B', 'R', 'G')
++#define MMAL_ENCODING_BAYER_SGRBG8     MMAL_FOURCC('G', 'R', 'B', 'G')
++#define MMAL_ENCODING_BAYER_SRGGB8     MMAL_FOURCC('R', 'G', 'G', 'B')
++
++/* 10 bit per pixel packed Bayer formats. */
++#define MMAL_ENCODING_BAYER_SBGGR10P   MMAL_FOURCC('p', 'B', 'A', 'A')
++#define MMAL_ENCODING_BAYER_SGRBG10P   MMAL_FOURCC('p', 'g', 'A', 'A')
++#define MMAL_ENCODING_BAYER_SGBRG10P   MMAL_FOURCC('p', 'G', 'A', 'A')
++#define MMAL_ENCODING_BAYER_SRGGB10P   MMAL_FOURCC('p', 'R', 'A', 'A')
++
++/* 12 bit per pixel packed Bayer formats. */
++#define MMAL_ENCODING_BAYER_SBGGR12P   MMAL_FOURCC('p', 'B', '1', '2')
++#define MMAL_ENCODING_BAYER_SGRBG12P   MMAL_FOURCC('p', 'g', '1', '2')
++#define MMAL_ENCODING_BAYER_SGBRG12P   MMAL_FOURCC('p', 'G', '1', '2')
++#define MMAL_ENCODING_BAYER_SRGGB12P   MMAL_FOURCC('p', 'R', '1', '2')
++
++/* 16 bit per pixel Bayer formats. */
++#define MMAL_ENCODING_BAYER_SBGGR16    MMAL_FOURCC('B', 'G', '1', '6')
++#define MMAL_ENCODING_BAYER_SGBRG16    MMAL_FOURCC('G', 'B', '1', '6')
++#define MMAL_ENCODING_BAYER_SGRBG16    MMAL_FOURCC('G', 'R', '1', '6')
++#define MMAL_ENCODING_BAYER_SRGGB16    MMAL_FOURCC('R', 'G', '1', '6')
++
+ /** An EGL image handle
+  */
+ #define MMAL_ENCODING_EGL_IMAGE        MMAL_FOURCC('E', 'G', 'L', 'I')
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0114-staging-mmal-vchiq-Update-mmal_parameters.h-with-rec.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0114-staging-mmal-vchiq-Update-mmal_parameters.h-with-rec.patch
new file mode 100644
index 00000000..2fd8f5e4
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0114-staging-mmal-vchiq-Update-mmal_parameters.h-with-rec.patch
@@ -0,0 +1,56 @@
+From 294ec14d79b182ea37fd6b7e9d4615901f12e0f9 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Mon, 18 Feb 2019 15:52:29 +0000
+Subject: [PATCH 114/697] staging: mmal-vchiq: Update mmal_parameters.h with
+ recently defined params
+
+mmal_parameters.h hasn't been updated to reflect additions made
+over the last few years. Update it to reflect the currently
+supported parameters.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ .../vchiq-mmal/mmal-parameters.h              | 32 ++++++++++++++++++-
+ 1 file changed, 31 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
+@@ -577,7 +577,37 @@ enum mmal_parameter_video_type {
+ 	MMAL_PARAMETER_VIDEO_ENCODE_H264_LOW_DELAY_HRD_FLAG,
+ 
+ 	/**< @ref MMAL_PARAMETER_BOOLEAN_T */
+-	MMAL_PARAMETER_VIDEO_ENCODE_INLINE_HEADER
++	MMAL_PARAMETER_VIDEO_ENCODE_INLINE_HEADER,
++
++	/**< Take a @ref MMAL_PARAMETER_BOOLEAN_T. */
++	MMAL_PARAMETER_VIDEO_ENCODE_SEI_ENABLE,
++
++	/**< Take a @ref MMAL_PARAMETER_BOOLEAN_T. */
++	MMAL_PARAMETER_VIDEO_ENCODE_INLINE_VECTORS,
++
++	/**< Take a @ref MMAL_PARAMETER_VIDEO_RENDER_STATS_T. */
++	MMAL_PARAMETER_VIDEO_RENDER_STATS,
++
++	/**< Take a @ref MMAL_PARAMETER_VIDEO_INTERLACE_TYPE_T. */
++	MMAL_PARAMETER_VIDEO_INTERLACE_TYPE,
++
++	/**< Takes a @ref MMAL_PARAMETER_BOOLEAN_T */
++	MMAL_PARAMETER_VIDEO_INTERPOLATE_TIMESTAMPS,
++
++	/**< Takes a @ref MMAL_PARAMETER_BOOLEAN_T */
++	MMAL_PARAMETER_VIDEO_ENCODE_SPS_TIMING,
++
++	/**< Takes a @ref MMAL_PARAMETER_UINT32_T */
++	MMAL_PARAMETER_VIDEO_MAX_NUM_CALLBACKS,
++
++	/**< Takes a @ref MMAL_PARAMETER_SOURCE_PATTERN_T */
++	MMAL_PARAMETER_VIDEO_SOURCE_PATTERN,
++
++	/**< Takes a @ref MMAL_PARAMETER_BOOLEAN_T */
++	MMAL_PARAMETER_VIDEO_ENCODE_SEPARATE_NAL_BUFS,
++
++	/**< Takes a @ref MMAL_PARAMETER_UINT32_T */
++	MMAL_PARAMETER_VIDEO_DROPPABLE_PFRAME_LENGTH,
+ };
+ 
+ /** Valid mirror modes */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0115-staging-mmal-vchiq-Free-the-event-context-for-contro.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0115-staging-mmal-vchiq-Free-the-event-context-for-contro.patch
new file mode 100644
index 00000000..afa555e6
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0115-staging-mmal-vchiq-Free-the-event-context-for-contro.patch
@@ -0,0 +1,28 @@
+From 0234158a6e8e74590eee9039509af651105b9c77 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Wed, 1 May 2019 13:27:23 +0100
+Subject: [PATCH 115/697] staging: mmal-vchiq: Free the event context for
+ control ports
+
+vchiq_mmal_component_init calls init_event_context for the
+control port, but vchiq_mmal_component_finalise didn't free
+it, causing a memory leak..
+
+Add the free call.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+@@ -1900,6 +1900,8 @@ int vchiq_mmal_component_finalise(struct
+ 	for (idx = 0; idx < component->clocks; idx++)
+ 		free_event_context(&component->clock[idx]);
+ 
++	free_event_context(&component->control);
++
+ 	mutex_unlock(&instance->vchiq_mutex);
+ 
+ 	return ret;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0116-staging-mmal-vchiq-Fix-memory-leak-in-error-path.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0116-staging-mmal-vchiq-Fix-memory-leak-in-error-path.patch
new file mode 100644
index 00000000..7ea467d1
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0116-staging-mmal-vchiq-Fix-memory-leak-in-error-path.patch
@@ -0,0 +1,76 @@
+From 4588a604b9a42eca0a32e93e1e21a09676d136c5 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Thu, 2 May 2019 15:50:01 +0100
+Subject: [PATCH 116/697] staging: mmal-vchiq: Fix memory leak in error path
+
+On error, vchiq_mmal_component_init could leave the
+event context allocated for ports.
+Clean them up in the error path.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ .../vc04_services/vchiq-mmal/mmal-vchiq.c     | 29 +++++++++++++------
+ 1 file changed, 20 insertions(+), 9 deletions(-)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+@@ -1766,9 +1766,26 @@ static void free_event_context(struct vc
+ {
+ 	struct mmal_msg_context *ctx = port->event_context;
+ 
++	if (!ctx)
++		return;
++
+ 	kfree(ctx->u.bulk.buffer->buffer);
+ 	kfree(ctx->u.bulk.buffer);
+ 	release_msg_context(ctx);
++	port->event_context = NULL;
++}
++
++static void release_all_event_contexts(struct vchiq_mmal_component *component)
++{
++	int idx;
++
++	for (idx = 0; idx < component->inputs; idx++)
++		free_event_context(&component->input[idx]);
++	for (idx = 0; idx < component->outputs; idx++)
++		free_event_context(&component->output[idx]);
++	for (idx = 0; idx < component->clocks; idx++)
++		free_event_context(&component->clock[idx]);
++	free_event_context(&component->control);
+ }
+ 
+ /* Initialise a mmal component and its ports
+@@ -1866,6 +1883,7 @@ int vchiq_mmal_component_init(struct vch
+ 
+ release_component:
+ 	destroy_component(instance, component);
++	release_all_event_contexts(component);
+ unlock:
+ 	if (component)
+ 		component->in_use = false;
+@@ -1881,7 +1899,7 @@ EXPORT_SYMBOL_GPL(vchiq_mmal_component_i
+ int vchiq_mmal_component_finalise(struct vchiq_mmal_instance *instance,
+ 				  struct vchiq_mmal_component *component)
+ {
+-	int ret, idx;
++	int ret;
+ 
+ 	if (mutex_lock_interruptible(&instance->vchiq_mutex))
+ 		return -EINTR;
+@@ -1893,14 +1911,7 @@ int vchiq_mmal_component_finalise(struct
+ 
+ 	component->in_use = false;
+ 
+-	for (idx = 0; idx < component->inputs; idx++)
+-		free_event_context(&component->input[idx]);
+-	for (idx = 0; idx < component->outputs; idx++)
+-		free_event_context(&component->output[idx]);
+-	for (idx = 0; idx < component->clocks; idx++)
+-		free_event_context(&component->clock[idx]);
+-
+-	free_event_context(&component->control);
++	release_all_event_contexts(component);
+ 
+ 	mutex_unlock(&instance->vchiq_mutex);
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0117-w1-w1-gpio-Make-GPIO-an-output-for-strong-pullup.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0117-w1-w1-gpio-Make-GPIO-an-output-for-strong-pullup.patch
new file mode 100644
index 00000000..491aaa81
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0117-w1-w1-gpio-Make-GPIO-an-output-for-strong-pullup.patch
@@ -0,0 +1,169 @@
+From d795a4c6d8a7a1f354f0963306123fb44c7a02dc Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Wed, 12 Jun 2019 17:15:05 +0100
+Subject: [PATCH 117/697] w1: w1-gpio: Make GPIO an output for strong pullup
+
+The logic to drive the data line high to implement a strong pullup
+assumed that the pin was already an output - setting a value does
+not change an input.
+
+See: https://github.com/raspberrypi/firmware/issues/1143
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+drivers: w1-gpio: add flag to force read-polling while delaying
+
+On Pi 5, the link to RP1 will bounce in and out of L1 depending on
+inactivity timers at both the RC and EP end. Unfortunately for
+bitbashing 1-wire, this means that on an otherwise idle Pi 5 many of the
+reads/writes to GPIO registers are delayed by up to 8us which causes
+mis-sampling of read data and trashes write bits.
+
+By issuing dummy reads at a rate greater than the link inactivity
+timeout while spinning on a delay, PCIe stays in L0 which does not incur
+additional latency.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+drivers: w1-gpio: Fixup uninitialised variable use in w1_gpio_probe
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/w1/masters/w1-gpio.c |  5 ++++-
+ drivers/w1/w1_io.c           | 37 ++++++++++++++++++++++++------------
+ include/linux/w1.h           |  5 +++++
+ 3 files changed, 34 insertions(+), 13 deletions(-)
+
+--- a/drivers/w1/masters/w1-gpio.c
++++ b/drivers/w1/masters/w1-gpio.c
+@@ -35,7 +35,7 @@ static u8 w1_gpio_set_pullup(void *data,
+ 			 * This will OVERRIDE open drain emulation and force-pull
+ 			 * the line high for some time.
+ 			 */
+-			gpiod_set_raw_value(ddata->gpiod, 1);
++			gpiod_direction_output_raw(ddata->gpiod, 1);
+ 			msleep(ddata->pullup_duration);
+ 			/*
+ 			 * This will simply set the line as input since we are doing
+@@ -89,6 +89,9 @@ static int w1_gpio_probe(struct platform
+ 	if (!master)
+ 		return -ENOMEM;
+ 
++	if (device_property_present(dev, "raspberrypi,delay-needs-poll"))
++		master->delay_needs_poll = true;
++
+ 	ddata->gpiod = devm_gpiod_get_index(dev, NULL, 0, gflags);
+ 	if (IS_ERR(ddata->gpiod))
+ 		return dev_err_probe(dev, PTR_ERR(ddata->gpiod), "gpio_request (pin) failed\n");
+--- a/drivers/w1/w1_io.c
++++ b/drivers/w1/w1_io.c
+@@ -6,6 +6,7 @@
+ #include <asm/io.h>
+ 
+ #include <linux/delay.h>
++#include <linux/ktime.h>
+ #include <linux/moduleparam.h>
+ #include <linux/module.h>
+ 
+@@ -36,9 +37,21 @@ static u8 w1_crc8_table[] = {
+ 	116, 42, 200, 150, 21, 75, 169, 247, 182, 232, 10, 84, 215, 137, 107, 53
+ };
+ 
+-static void w1_delay(unsigned long tm)
++static void w1_delay(struct w1_master *dev, unsigned long tm)
+ {
+-	udelay(tm * w1_delay_parm);
++	ktime_t start, delta;
++
++	if (!dev->bus_master->delay_needs_poll) {
++		udelay(tm * w1_delay_parm);
++		return;
++	}
++
++	start = ktime_get();
++	delta = ktime_add(start, ns_to_ktime(1000 * tm * w1_delay_parm));
++	do {
++		dev->bus_master->read_bit(dev->bus_master->data);
++		udelay(1);
++	} while (ktime_before(ktime_get(), delta));
+ }
+ 
+ static void w1_write_bit(struct w1_master *dev, int bit);
+@@ -77,14 +90,14 @@ static void w1_write_bit(struct w1_maste
+ 
+ 	if (bit) {
+ 		dev->bus_master->write_bit(dev->bus_master->data, 0);
+-		w1_delay(6);
++		w1_delay(dev, 6);
+ 		dev->bus_master->write_bit(dev->bus_master->data, 1);
+-		w1_delay(64);
++		w1_delay(dev, 64);
+ 	} else {
+ 		dev->bus_master->write_bit(dev->bus_master->data, 0);
+-		w1_delay(60);
++		w1_delay(dev, 60);
+ 		dev->bus_master->write_bit(dev->bus_master->data, 1);
+-		w1_delay(10);
++		w1_delay(dev, 10);
+ 	}
+ 
+ 	if(w1_disable_irqs) local_irq_restore(flags);
+@@ -164,14 +177,14 @@ static u8 w1_read_bit(struct w1_master *
+ 	/* sample timing is critical here */
+ 	local_irq_save(flags);
+ 	dev->bus_master->write_bit(dev->bus_master->data, 0);
+-	w1_delay(6);
++	w1_delay(dev, 6);
+ 	dev->bus_master->write_bit(dev->bus_master->data, 1);
+-	w1_delay(9);
++	w1_delay(dev, 9);
+ 
+ 	result = dev->bus_master->read_bit(dev->bus_master->data);
+ 	local_irq_restore(flags);
+ 
+-	w1_delay(55);
++	w1_delay(dev, 55);
+ 
+ 	return result & 0x1;
+ }
+@@ -333,16 +346,16 @@ int w1_reset_bus(struct w1_master *dev)
+ 		 * cpu for such a short amount of time AND get it back in
+ 		 * the maximum amount of time.
+ 		 */
+-		w1_delay(500);
++		w1_delay(dev, 500);
+ 		dev->bus_master->write_bit(dev->bus_master->data, 1);
+-		w1_delay(70);
++		w1_delay(dev, 70);
+ 
+ 		result = dev->bus_master->read_bit(dev->bus_master->data) & 0x1;
+ 		/* minimum 70 (above) + 430 = 500 us
+ 		 * There aren't any timing requirements between a reset and
+ 		 * the following transactions.  Sleeping is safe here.
+ 		 */
+-		/* w1_delay(430); min required time */
++		/* w1_delay(dev, 430); min required time */
+ 		msleep(1);
+ 	}
+ 
+--- a/include/linux/w1.h
++++ b/include/linux/w1.h
+@@ -122,6 +122,9 @@ typedef void (*w1_slave_found_callback)(
+  * @dev_id: Optional device id string, which w1 slaves could use for
+  * creating names, which then give a connection to the w1 master
+  *
++ * @delay_needs_poll: work around jitter introduced with GPIO controllers
++ * accessed over PCIe (RP1)
++ *
+  * Note: read_bit and write_bit are very low level functions and should only
+  * be used with hardware that doesn't really support 1-wire operations,
+  * like a parallel/serial port.
+@@ -156,6 +159,8 @@ struct w1_bus_master {
+ 		u8, w1_slave_found_callback);
+ 
+ 	char		*dev_id;
++
++	bool		delay_needs_poll;
+ };
+ 
+ /**
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0118-arm-bcm2835-Fix-FIQ-early-ioremap.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0118-arm-bcm2835-Fix-FIQ-early-ioremap.patch
new file mode 100644
index 00000000..3fcd8e76
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0118-arm-bcm2835-Fix-FIQ-early-ioremap.patch
@@ -0,0 +1,73 @@
+From 9e8e86f517762d2550e5691fe6582da2fca7ef28 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Wed, 20 Feb 2019 08:49:39 +0000
+Subject: [PATCH 118/697] arm: bcm2835: Fix FIQ early ioremap
+
+The ioremapping creates mappings within the vmalloc area. The
+equivalent early function, create_mapping, now checks that the
+requested explicit virtual address is between VMALLOC_START and
+VMALLOC_END. As there is no reason to have any correlation between
+the physical and virtual addresses, put the required mappings at
+VMALLOC_START and above.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ arch/arm/mach-bcm/board_bcm2835.c | 21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+--- a/arch/arm/mach-bcm/board_bcm2835.c
++++ b/arch/arm/mach-bcm/board_bcm2835.c
+@@ -5,17 +5,20 @@
+ 
+ #include <linux/init.h>
+ #include <linux/irqchip.h>
++#include <linux/mm.h>
+ #include <linux/of_address.h>
+ #include <linux/of_fdt.h>
+ #include <asm/system_info.h>
+ 
+ #include <asm/mach/arch.h>
+ #include <asm/mach/map.h>
++#include <asm/memory.h>
++#include <asm/pgtable.h>
+ 
+ #include "platsmp.h"
+ 
+-#define BCM2835_USB_VIRT_BASE   0xf0980000
+-#define BCM2835_USB_VIRT_MPHI   0xf0006000
++#define BCM2835_USB_VIRT_BASE   (VMALLOC_START)
++#define BCM2835_USB_VIRT_MPHI   (VMALLOC_START + 0x10000)
+ 
+ static void __init bcm2835_init(void)
+ {
+@@ -74,20 +77,26 @@ static int __init bcm2835_map_usb(unsign
+ 
+ static void __init bcm2835_map_io(void)
+ {
+-	const __be32 *ranges;
++	const __be32 *ranges, *address_cells;
++	unsigned long root, addr_cells;
+ 	int soc, len;
+ 	unsigned long p2b_offset;
+ 
+ 	debug_ll_io_init();
+ 
++	root = of_get_flat_dt_root();
+ 	/* Find out how to map bus to physical address first from soc/ranges */
+-	soc = of_get_flat_dt_subnode_by_name(of_get_flat_dt_root(), "soc");
++	soc = of_get_flat_dt_subnode_by_name(root, "soc");
+ 	if (soc < 0)
+ 		return;
++	address_cells = of_get_flat_dt_prop(root, "#address-cells", &len);
++	if (!address_cells || len < (sizeof(unsigned long)))
++		return;
++	addr_cells = be32_to_cpu(address_cells[0]);
+ 	ranges = of_get_flat_dt_prop(soc, "ranges", &len);
+-	if (!ranges || len < (sizeof(unsigned long) * 3))
++	if (!ranges || len < (sizeof(unsigned long) * (2 + addr_cells)))
+ 		return;
+-	p2b_offset = be32_to_cpu(ranges[0]) - be32_to_cpu(ranges[1]);
++	p2b_offset = be32_to_cpu(ranges[0]) - be32_to_cpu(ranges[addr_cells]);
+ 
+ 	/* Now search for bcm2708-usb node in device tree */
+ 	of_scan_flat_dt(bcm2835_map_usb, &p2b_offset);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0119-arm-bcm2835-DMA-can-only-address-1GB.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0119-arm-bcm2835-DMA-can-only-address-1GB.patch
new file mode 100644
index 00000000..a5be57f3
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0119-arm-bcm2835-DMA-can-only-address-1GB.patch
@@ -0,0 +1,25 @@
+From f5bb76c1e52dc1c50c5eba0c608a00b964d792bb Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Wed, 29 May 2019 15:47:42 +0100
+Subject: [PATCH 119/697] arm: bcm2835: DMA can only address 1GB
+
+The legacy peripherals can only address the first gigabyte of RAM, so
+ensure that DMA allocations are restricted to that region.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ arch/arm/mach-bcm/board_bcm2835.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/arm/mach-bcm/board_bcm2835.c
++++ b/arch/arm/mach-bcm/board_bcm2835.c
+@@ -114,6 +114,9 @@ static const char * const bcm2835_compat
+ };
+ 
+ DT_MACHINE_START(BCM2835, "BCM2835")
++#if defined(CONFIG_ZONE_DMA) && defined(CONFIG_ARM_LPAE)
++	.dma_zone_size	= SZ_1G,
++#endif
+ 	.map_io = bcm2835_map_io,
+ 	.init_machine = bcm2835_init,
+ 	.dt_compat = bcm2835_compat,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0120-hwrng-iproc-rng200-Add-BCM2838-support.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0120-hwrng-iproc-rng200-Add-BCM2838-support.patch
new file mode 100644
index 00000000..0d2d0f8f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0120-hwrng-iproc-rng200-Add-BCM2838-support.patch
@@ -0,0 +1,161 @@
+From 49d614d0a0143b24e4a7266c2245c723c478dc3a Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <wahrenst@gmx.net>
+Date: Sat, 4 May 2019 17:06:15 +0200
+Subject: [PATCH 120/697] hwrng: iproc-rng200: Add BCM2838 support
+
+The HWRNG on the BCM2838 is compatible to iproc-rng200, so add the
+support to this driver instead of bcm2835-rng.
+
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+
+hwrng: iproc-rng200: Correct SoC name
+
+The Pi 4 SoC is called BCM2711, not BCM2838.
+
+Fixes: "hwrng: iproc-rng200: Add BCM2838 support"
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/char/hw_random/Kconfig        |  2 +-
+ drivers/char/hw_random/iproc-rng200.c | 79 ++++++++++++++++++++++++++-
+ 2 files changed, 77 insertions(+), 4 deletions(-)
+
+--- a/drivers/char/hw_random/Kconfig
++++ b/drivers/char/hw_random/Kconfig
+@@ -105,7 +105,7 @@ config HW_RANDOM_IPROC_RNG200
+ 	default HW_RANDOM
+ 	help
+ 	  This driver provides kernel-side support for the RNG200
+-	  hardware found on the Broadcom iProc and STB SoCs.
++	  hardware found on the Broadcom iProc, BCM2711 and STB SoCs.
+ 
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called iproc-rng200
+--- a/drivers/char/hw_random/iproc-rng200.c
++++ b/drivers/char/hw_random/iproc-rng200.c
+@@ -13,6 +13,7 @@
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/mod_devicetable.h>
++#include <linux/of.h>
+ #include <linux/platform_device.h>
+ #include <linux/delay.h>
+ 
+@@ -20,6 +21,7 @@
+ #define RNG_CTRL_OFFSET					0x00
+ #define RNG_CTRL_RNG_RBGEN_MASK				0x00001FFF
+ #define RNG_CTRL_RNG_RBGEN_ENABLE			0x00000001
++#define RNG_CTRL_RNG_DIV_CTRL_SHIFT			13
+ 
+ #define RNG_SOFT_RESET_OFFSET				0x04
+ #define RNG_SOFT_RESET					0x00000001
+@@ -27,16 +29,23 @@
+ #define RBG_SOFT_RESET_OFFSET				0x08
+ #define RBG_SOFT_RESET					0x00000001
+ 
++#define RNG_TOTAL_BIT_COUNT_OFFSET			0x0C
++
++#define RNG_TOTAL_BIT_COUNT_THRESHOLD_OFFSET		0x10
++
+ #define RNG_INT_STATUS_OFFSET				0x18
+ #define RNG_INT_STATUS_MASTER_FAIL_LOCKOUT_IRQ_MASK	0x80000000
+ #define RNG_INT_STATUS_STARTUP_TRANSITIONS_MET_IRQ_MASK	0x00020000
+ #define RNG_INT_STATUS_NIST_FAIL_IRQ_MASK		0x00000020
+ #define RNG_INT_STATUS_TOTAL_BITS_COUNT_IRQ_MASK	0x00000001
+ 
++#define RNG_INT_ENABLE_OFFSET				0x1C
++
+ #define RNG_FIFO_DATA_OFFSET				0x20
+ 
+ #define RNG_FIFO_COUNT_OFFSET				0x24
+ #define RNG_FIFO_COUNT_RNG_FIFO_COUNT_MASK		0x000000FF
++#define RNG_FIFO_COUNT_RNG_FIFO_THRESHOLD_SHIFT		8
+ 
+ struct iproc_rng200_dev {
+ 	struct hwrng rng;
+@@ -157,6 +166,64 @@ static int iproc_rng200_init(struct hwrn
+ 	return 0;
+ }
+ 
++static int bcm2711_rng200_read(struct hwrng *rng, void *buf, size_t max,
++			       bool wait)
++{
++	struct iproc_rng200_dev *priv = to_rng_priv(rng);
++	u32 max_words = max / sizeof(u32);
++	u32 num_words, count, val;
++
++	/* ensure warm up period has elapsed */
++	while (1) {
++		val = ioread32(priv->base + RNG_TOTAL_BIT_COUNT_OFFSET);
++		if (val > 16)
++			break;
++		cpu_relax();
++	}
++
++	/* ensure fifo is not empty */
++	while (1) {
++		num_words = ioread32(priv->base + RNG_FIFO_COUNT_OFFSET) &
++			    RNG_FIFO_COUNT_RNG_FIFO_COUNT_MASK;
++		if (num_words)
++			break;
++		if (!wait)
++			return 0;
++		cpu_relax();
++	}
++
++	if (num_words > max_words)
++		num_words = max_words;
++
++	for (count = 0; count < num_words; count++) {
++		((u32 *)buf)[count] = ioread32(priv->base +
++					       RNG_FIFO_DATA_OFFSET);
++	}
++
++	return num_words * sizeof(u32);
++}
++
++static int bcm2711_rng200_init(struct hwrng *rng)
++{
++	struct iproc_rng200_dev *priv = to_rng_priv(rng);
++	uint32_t val;
++
++	if (ioread32(priv->base + RNG_CTRL_OFFSET) & RNG_CTRL_RNG_RBGEN_MASK)
++		return 0;
++
++	/* initial numbers generated are "less random" so will be discarded */
++	val = 0x40000;
++	iowrite32(val, priv->base + RNG_TOTAL_BIT_COUNT_THRESHOLD_OFFSET);
++	/* min fifo count to generate full interrupt */
++	val = 2 << RNG_FIFO_COUNT_RNG_FIFO_THRESHOLD_SHIFT;
++	iowrite32(val, priv->base + RNG_FIFO_COUNT_OFFSET);
++	/* enable the rng - 1Mhz sample rate */
++	val = (0x3 << RNG_CTRL_RNG_DIV_CTRL_SHIFT) | RNG_CTRL_RNG_RBGEN_MASK;
++	iowrite32(val, priv->base + RNG_CTRL_OFFSET);
++
++	return 0;
++}
++
+ static void iproc_rng200_cleanup(struct hwrng *rng)
+ {
+ 	struct iproc_rng200_dev *priv = to_rng_priv(rng);
+@@ -183,11 +250,17 @@ static int iproc_rng200_probe(struct pla
+ 
+ 	dev_set_drvdata(dev, priv);
+ 
+-	priv->rng.name = "iproc-rng200";
+-	priv->rng.read = iproc_rng200_read;
+-	priv->rng.init = iproc_rng200_init;
++	priv->rng.name = pdev->name;
+ 	priv->rng.cleanup = iproc_rng200_cleanup;
+ 
++	if (of_device_is_compatible(dev->of_node, "brcm,bcm2711-rng200")) {
++		priv->rng.init = bcm2711_rng200_init;
++		priv->rng.read = bcm2711_rng200_read;
++	} else {
++		priv->rng.init = iproc_rng200_init;
++		priv->rng.read = iproc_rng200_read;
++	}
++
+ 	/* Register driver */
+ 	ret = devm_hwrng_register(dev, &priv->rng);
+ 	if (ret) {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0121-bcmgenet-constrain-max-DMA-burst-length.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0121-bcmgenet-constrain-max-DMA-burst-length.patch
new file mode 100644
index 00000000..6e0bd98e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0121-bcmgenet-constrain-max-DMA-burst-length.patch
@@ -0,0 +1,20 @@
+From abe61e71759bf806fd9da9bf0d46b5b4c9c44801 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.org>
+Date: Wed, 12 Sep 2018 14:44:53 +0100
+Subject: [PATCH 121/697] bcmgenet: constrain max DMA burst length
+
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+@@ -31,7 +31,7 @@
+ #define ENET_PAD		8
+ #define ENET_MAX_MTU_SIZE	(ETH_DATA_LEN + ETH_HLEN + VLAN_HLEN + \
+ 				 ENET_BRCM_TAG_LEN + ETH_FCS_LEN + ENET_PAD)
+-#define DMA_MAX_BURST_LENGTH    0x10
++#define DMA_MAX_BURST_LENGTH    0x08
+ 
+ /* misc. configuration */
+ #define MAX_NUM_OF_FS_RULES		16
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0122-bcmgenet-Better-coalescing-parameter-defaults.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0122-bcmgenet-Better-coalescing-parameter-defaults.patch
new file mode 100644
index 00000000..e331858f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0122-bcmgenet-Better-coalescing-parameter-defaults.patch
@@ -0,0 +1,43 @@
+From 2135ae3c60f80bd39eddda8db673cc45c8e3ac12 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Wed, 27 Mar 2019 13:45:46 +0000
+Subject: [PATCH 122/697] bcmgenet: Better coalescing parameter defaults
+
+Set defaults for TX and RX packet coalescing to be equivalent to:
+
+  # ethtool -C eth0 tx-frames 10
+  # ethtool -C eth0 rx-usecs 50
+
+This may be something we want to set via DT parameters in the
+future.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -2664,7 +2664,7 @@ static void bcmgenet_init_tx_ring(struct
+ 
+ 	bcmgenet_tdma_ring_writel(priv, index, 0, TDMA_PROD_INDEX);
+ 	bcmgenet_tdma_ring_writel(priv, index, 0, TDMA_CONS_INDEX);
+-	bcmgenet_tdma_ring_writel(priv, index, 1, DMA_MBUF_DONE_THRESH);
++	bcmgenet_tdma_ring_writel(priv, index, 10, DMA_MBUF_DONE_THRESH);
+ 	/* Disable rate control for now */
+ 	bcmgenet_tdma_ring_writel(priv, index, flow_period_val,
+ 				  TDMA_FLOW_PERIOD);
+@@ -4139,9 +4139,12 @@ static int bcmgenet_probe(struct platfor
+ 	netif_set_real_num_rx_queues(priv->dev, priv->hw_params->rx_queues + 1);
+ 
+ 	/* Set default coalescing parameters */
+-	for (i = 0; i < priv->hw_params->rx_queues; i++)
++	for (i = 0; i < priv->hw_params->rx_queues; i++) {
+ 		priv->rx_rings[i].rx_max_coalesced_frames = 1;
++		priv->rx_rings[i].rx_coalesce_usecs = 50;
++	}
+ 	priv->rx_rings[DESC_INDEX].rx_max_coalesced_frames = 1;
++	priv->rx_rings[DESC_INDEX].rx_coalesce_usecs = 50;
+ 
+ 	/* libphy will determine the link state */
+ 	netif_carrier_off(dev);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0123-net-genet-enable-link-energy-detect-powerdown-for-ex.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0123-net-genet-enable-link-energy-detect-powerdown-for-ex.patch
new file mode 100644
index 00000000..24349e88
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0123-net-genet-enable-link-energy-detect-powerdown-for-ex.patch
@@ -0,0 +1,31 @@
+From bdecd2a7131cf0eb8ced63808153cc8846abd115 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.org>
+Date: Tue, 14 May 2019 17:17:59 +0100
+Subject: [PATCH 123/697] net: genet: enable link energy detect powerdown for
+ external PHYs
+
+There are several warts surrounding bcmgenet_mii_probe() as this
+function is called from ndo_open, but it's calling registration-type
+functions. The probe should be called at probe time and refactored
+such that the PHY device data can be extracted to limit the scope
+of this flag to Broadcom PHYs.
+
+For now, pass this flag in as it puts our attached PHY into a low-power
+state when disconnected.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
+---
+ drivers/net/ethernet/broadcom/genet/bcmmii.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+@@ -310,6 +310,8 @@ int bcmgenet_mii_probe(struct net_device
+ 	/* Communicate the integrated PHY revision */
+ 	if (priv->internal_phy)
+ 		phy_flags = priv->gphy_rev;
++	else
++		phy_flags = PHY_BRCM_AUTO_PWRDWN_ENABLE;
+ 
+ 	/* This is an ugly quirk but we have not been correctly interpreting
+ 	 * the phy_interface values and we have done that across different
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0124-usb-add-plumbing-for-updating-interrupt-endpoint-int.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0124-usb-add-plumbing-for-updating-interrupt-endpoint-int.patch
new file mode 100644
index 00000000..badcf568
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0124-usb-add-plumbing-for-updating-interrupt-endpoint-int.patch
@@ -0,0 +1,104 @@
+From aaa32e0cd47c0f685a297c216a9747da33ab357f Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.org>
+Date: Tue, 11 Jun 2019 10:55:00 +0100
+Subject: [PATCH 124/697] usb: add plumbing for updating interrupt endpoint
+ interval state
+
+xHCI caches device and endpoint data after the interface is configured,
+so an explicit command needs to be issued for any device driver wanting
+to alter the polling interval of an endpoint.
+
+Add usb_fixup_endpoint() to allow drivers to do this. The fixup must be
+called after calculating endpoint bandwidth requirements but before any
+URBs are submitted.
+
+If polling intervals are shortened, any bandwidth reservations are no
+longer valid but in practice polling intervals are only ever relaxed.
+
+Limit the scope to interrupt transfers for now.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
+---
+ drivers/usb/core/hcd.c     | 10 ++++++++++
+ drivers/usb/core/message.c | 15 +++++++++++++++
+ include/linux/usb.h        |  2 ++
+ include/linux/usb/hcd.h    |  7 +++++++
+ 4 files changed, 34 insertions(+)
+
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -1953,6 +1953,16 @@ reset:
+ 	return ret;
+ }
+ 
++void usb_hcd_fixup_endpoint(struct usb_device *udev,
++			    struct usb_host_endpoint *ep, int interval)
++{
++	struct usb_hcd *hcd;
++
++	hcd = bus_to_hcd(udev->bus);
++	if (hcd->driver->fixup_endpoint)
++		hcd->driver->fixup_endpoint(hcd, udev, ep, interval);
++}
++
+ /* Disables the endpoint: synchronizes with the hcd to make sure all
+  * endpoint state is gone from hardware.  usb_hcd_flush_endpoint() must
+  * have been called previously.  Use for set_configuration, set_interface,
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -1267,6 +1267,21 @@ static void remove_intf_ep_devs(struct u
+ 	intf->ep_devs_created = 0;
+ }
+ 
++void usb_fixup_endpoint(struct usb_device *dev, int epaddr, int interval)
++{
++	unsigned int epnum = epaddr & USB_ENDPOINT_NUMBER_MASK;
++	struct usb_host_endpoint *ep;
++
++	if (usb_endpoint_out(epaddr))
++		ep = dev->ep_out[epnum];
++	else
++		ep = dev->ep_in[epnum];
++
++	if (ep && usb_endpoint_xfer_int(&ep->desc))
++		usb_hcd_fixup_endpoint(dev, ep, interval);
++}
++EXPORT_SYMBOL_GPL(usb_fixup_endpoint);
++
+ /**
+  * usb_disable_endpoint -- Disable an endpoint by address
+  * @dev: the device whose endpoint is being disabled
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -1873,6 +1873,8 @@ extern int usb_clear_halt(struct usb_dev
+ extern int usb_reset_configuration(struct usb_device *dev);
+ extern int usb_set_interface(struct usb_device *dev, int ifnum, int alternate);
+ extern void usb_reset_endpoint(struct usb_device *dev, unsigned int epaddr);
++extern void usb_fixup_endpoint(struct usb_device *dev, int epaddr,
++			       int interval);
+ 
+ /* this request isn't really synchronous, but it belongs with the others */
+ extern int usb_driver_set_configuration(struct usb_device *udev, int config);
+--- a/include/linux/usb/hcd.h
++++ b/include/linux/usb/hcd.h
+@@ -372,6 +372,11 @@ struct hc_driver {
+ 		 * or bandwidth constraints.
+ 		 */
+ 	void	(*reset_bandwidth)(struct usb_hcd *, struct usb_device *);
++		/* Override the endpoint-derived interval
++		 * (if there is any cached hardware state).
++		 */
++	void	(*fixup_endpoint)(struct usb_hcd *hcd, struct usb_device *udev,
++				  struct usb_host_endpoint *ep, int interval);
+ 		/* Set the hardware-chosen device address */
+ 	int	(*address_device)(struct usb_hcd *, struct usb_device *udev,
+ 				  unsigned int timeout_ms);
+@@ -437,6 +442,8 @@ extern void usb_hcd_unmap_urb_setup_for_
+ extern void usb_hcd_unmap_urb_for_dma(struct usb_hcd *, struct urb *);
+ extern void usb_hcd_flush_endpoint(struct usb_device *udev,
+ 		struct usb_host_endpoint *ep);
++extern void usb_hcd_fixup_endpoint(struct usb_device *udev,
++		struct usb_host_endpoint *ep, int interval);
+ extern void usb_hcd_disable_endpoint(struct usb_device *udev,
+ 		struct usb_host_endpoint *ep);
+ extern void usb_hcd_reset_endpoint(struct usb_device *udev,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0125-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0125-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch
new file mode 100644
index 00000000..96b61cfb
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0125-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch
@@ -0,0 +1,135 @@
+From 911ff427baaac6ddc2ed295250f61eef2c93a9e5 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.org>
+Date: Tue, 11 Jun 2019 11:33:39 +0100
+Subject: [PATCH 125/697] xhci: implement xhci_fixup_endpoint for interval
+ adjustments
+
+Must be called in a non-atomic context, after the endpoint
+has been registered with the hardware via xhci_add_endpoint
+and before the first URB is submitted for the endpoint.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
+---
+ drivers/usb/host/xhci.c | 104 ++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 104 insertions(+)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1538,6 +1538,109 @@ static int xhci_check_ep0_maxpacket(stru
+ }
+ 
+ /*
++ * RPI: Fixup endpoint intervals when requested
++ * - Check interval versus the (cached) endpoint context
++ * - set the endpoint interval to the new value
++ * - force an endpoint configure command
++ * XXX: bandwidth is not recalculated. We should probably do that.
++ */
++
++static unsigned int xhci_get_endpoint_flag_from_index(unsigned int ep_index)
++{
++	return 1 << (ep_index + 1);
++}
++
++static void xhci_fixup_endpoint(struct usb_hcd *hcd, struct usb_device *udev,
++				struct usb_host_endpoint *ep, int interval)
++{
++	struct xhci_hcd *xhci;
++	struct xhci_ep_ctx *ep_ctx_out, *ep_ctx_in;
++	struct xhci_command *command;
++	struct xhci_input_control_ctx *ctrl_ctx;
++	struct xhci_virt_device *vdev;
++	int xhci_interval;
++	int ret;
++	int ep_index;
++	unsigned long flags;
++	u32 ep_info_tmp;
++
++	xhci = hcd_to_xhci(hcd);
++	ep_index = xhci_get_endpoint_index(&ep->desc);
++
++	/* FS/LS interval translations */
++	if ((udev->speed == USB_SPEED_FULL ||
++	     udev->speed == USB_SPEED_LOW))
++		interval *= 8;
++
++	mutex_lock(&xhci->mutex);
++
++	spin_lock_irqsave(&xhci->lock, flags);
++
++	vdev = xhci->devs[udev->slot_id];
++	/* Get context-derived endpoint interval */
++	ep_ctx_out = xhci_get_ep_ctx(xhci, vdev->out_ctx, ep_index);
++	ep_ctx_in = xhci_get_ep_ctx(xhci, vdev->in_ctx, ep_index);
++	xhci_interval = EP_INTERVAL_TO_UFRAMES(le32_to_cpu(ep_ctx_out->ep_info));
++
++	if (interval == xhci_interval) {
++		spin_unlock_irqrestore(&xhci->lock, flags);
++		mutex_unlock(&xhci->mutex);
++		return;
++	}
++
++	xhci_dbg(xhci, "Fixup interval=%d xhci_interval=%d\n",
++		 interval, xhci_interval);
++	command = xhci_alloc_command_with_ctx(xhci, true, GFP_ATOMIC);
++	if (!command) {
++		/* Failure here is benign, poll at the original rate */
++		spin_unlock_irqrestore(&xhci->lock, flags);
++		mutex_unlock(&xhci->mutex);
++		return;
++	}
++
++	/* xHCI uses exponents for intervals... */
++	xhci_interval = fls(interval) - 1;
++	xhci_interval = clamp_val(xhci_interval, 3, 10);
++	ep_info_tmp = le32_to_cpu(ep_ctx_out->ep_info);
++	ep_info_tmp &= ~EP_INTERVAL(255);
++	ep_info_tmp |= EP_INTERVAL(xhci_interval);
++
++	/* Keep the endpoint context up-to-date while issuing the command. */
++	xhci_endpoint_copy(xhci, vdev->in_ctx,
++			   vdev->out_ctx, ep_index);
++	ep_ctx_in->ep_info = cpu_to_le32(ep_info_tmp);
++
++	/*
++	 * We need to drop the lock, so take an explicit copy
++	 * of the ep context.
++	 */
++	xhci_endpoint_copy(xhci, command->in_ctx, vdev->in_ctx, ep_index);
++
++	ctrl_ctx = xhci_get_input_control_ctx(command->in_ctx);
++	if (!ctrl_ctx) {
++		xhci_warn(xhci,
++			  "%s: Could not get input context, bad type.\n",
++			  __func__);
++		spin_unlock_irqrestore(&xhci->lock, flags);
++		xhci_free_command(xhci, command);
++		mutex_unlock(&xhci->mutex);
++		return;
++	}
++	ctrl_ctx->add_flags = xhci_get_endpoint_flag_from_index(ep_index);
++	ctrl_ctx->drop_flags = 0;
++
++	spin_unlock_irqrestore(&xhci->lock, flags);
++
++	ret = xhci_configure_endpoint(xhci, udev, command,
++				      false, false);
++	if (ret)
++		xhci_warn(xhci, "%s: Configure endpoint failed: %d\n",
++			  __func__, ret);
++	xhci_free_command(xhci, command);
++	mutex_unlock(&xhci->mutex);
++}
++
++/*
+  * non-error returns are a promise to giveback() the urb later
+  * we drop ownership so next owner (or urb unlink) can get it
+  */
+@@ -5402,6 +5505,7 @@ static const struct hc_driver xhci_hc_dr
+ 	.endpoint_reset =	xhci_endpoint_reset,
+ 	.check_bandwidth =	xhci_check_bandwidth,
+ 	.reset_bandwidth =	xhci_reset_bandwidth,
++	.fixup_endpoint =	xhci_fixup_endpoint,
+ 	.address_device =	xhci_address_device,
+ 	.enable_device =	xhci_enable_device,
+ 	.update_hub_device =	xhci_update_hub_device,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0126-usb-xhci-workaround-for-bogus-SET_DEQ_PENDING-endpoi.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0126-usb-xhci-workaround-for-bogus-SET_DEQ_PENDING-endpoi.patch
new file mode 100644
index 00000000..8f31c3b2
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0126-usb-xhci-workaround-for-bogus-SET_DEQ_PENDING-endpoi.patch
@@ -0,0 +1,41 @@
+From 279d68acdba3daa0f17837eae4f99aada24741fb Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 11 Aug 2021 15:33:57 +0100
+Subject: [PATCH 126/697] usb: xhci: workaround for bogus SET_DEQ_PENDING
+ endpoint state
+
+See https://github.com/raspberrypi/linux/issues/3981
+
+An unknown unsafe memory access can result in the ep_state variable
+in xhci_virt_ep being trampled with a stuck SET_DEQ_PENDING state
+despite successful completion of a Set TR Deq Pointer command.
+
+All URB enqueue/dequeue calls for the endpoint will fail in this state
+so no transfers are possible until the device is reconnected.
+
+As a workaround, clear the flag if we see it set and issue a new Set
+TR Deq command anyway - this should be harmless, as a prior Set TR Deq
+command will only have been issued in the Stopped state, and if the
+endpoint is Running then the controller is required to ignore it and
+respond with a Context State Error event TRB.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/host/xhci-ring.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -719,9 +719,9 @@ static int xhci_move_dequeue_past_td(str
+ 	}
+ 
+ 	if ((ep->ep_state & SET_DEQ_PENDING)) {
+-		xhci_warn(xhci, "Set TR Deq already pending, don't submit for 0x%pad\n",
+-			  &addr);
+-		return -EBUSY;
++		xhci_warn(xhci, "WARN A Set TR Deq Ptr command is pending for slot %u ep %u\n",
++			  slot_id, ep_index);
++		ep->ep_state &= ~SET_DEQ_PENDING;
+ 	}
+ 
+ 	/* This function gets called from contexts where it cannot sleep */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0127-usb-xhci-drop-and-add-the-endpoint-context-in-xhci_f.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0127-usb-xhci-drop-and-add-the-endpoint-context-in-xhci_f.patch
new file mode 100644
index 00000000..89d0d488
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0127-usb-xhci-drop-and-add-the-endpoint-context-in-xhci_f.patch
@@ -0,0 +1,30 @@
+From f2e6fd8f42a90254b8980bc195395a0a60a1efd5 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Fri, 10 Mar 2023 14:21:42 +0000
+Subject: [PATCH 127/697] usb: xhci: drop and add the endpoint context in
+ xhci_fixup_endpoint()
+
+Setting both the Drop and Add bits on the input context prevents the
+corruption of split transactions seen with the BCM2711 XHCI controller,
+which is a dwc3 variant.
+
+This is a downstream feature that allows usbhid to restrict polling
+intervals on mice and keyboards, and was only tested on a VL805 which
+didn't complain about the fact the endpoint got added twice.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/host/xhci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1627,7 +1627,7 @@ static void xhci_fixup_endpoint(struct u
+ 		return;
+ 	}
+ 	ctrl_ctx->add_flags = xhci_get_endpoint_flag_from_index(ep_index);
+-	ctrl_ctx->drop_flags = 0;
++	ctrl_ctx->drop_flags = ctrl_ctx->add_flags;
+ 
+ 	spin_unlock_irqrestore(&xhci->lock, flags);
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0128-ARM-bcm-Backport-BCM2711-support-from-upstream.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0128-ARM-bcm-Backport-BCM2711-support-from-upstream.patch
new file mode 100644
index 00000000..470d422c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0128-ARM-bcm-Backport-BCM2711-support-from-upstream.patch
@@ -0,0 +1,41 @@
+From 8ca03a1786874c0e30b8ea107fab7a7c85777bee Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Tue, 11 Jun 2019 17:38:28 +0100
+Subject: [PATCH 128/697] ARM: bcm: Backport BCM2711 support from upstream
+
+Make the BCM2711 a different machine, but keep it in board_bcm2835.
+
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+---
+ arch/arm/mach-bcm/board_bcm2835.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/mach-bcm/board_bcm2835.c
++++ b/arch/arm/mach-bcm/board_bcm2835.c
+@@ -114,11 +114,25 @@ static const char * const bcm2835_compat
+ };
+ 
+ DT_MACHINE_START(BCM2835, "BCM2835")
++	.map_io = bcm2835_map_io,
++	.init_machine = bcm2835_init,
++	.dt_compat = bcm2835_compat,
++	.smp = smp_ops(bcm2836_smp_ops),
++MACHINE_END
++
++static const char * const bcm2711_compat[] = {
++#ifdef CONFIG_ARCH_MULTI_V7
++	"brcm,bcm2711",
++#endif
++	NULL
++};
++
++DT_MACHINE_START(BCM2711, "BCM2711")
+ #if defined(CONFIG_ZONE_DMA) && defined(CONFIG_ARM_LPAE)
+ 	.dma_zone_size	= SZ_1G,
+ #endif
+ 	.map_io = bcm2835_map_io,
+ 	.init_machine = bcm2835_init,
+-	.dt_compat = bcm2835_compat,
++	.dt_compat = bcm2711_compat,
+ 	.smp = smp_ops(bcm2836_smp_ops),
+ MACHINE_END
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0129-i2c-bcm2835-Set-clock-stretch-timeout-to-35ms.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0129-i2c-bcm2835-Set-clock-stretch-timeout-to-35ms.patch
new file mode 100644
index 00000000..2b6104e7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0129-i2c-bcm2835-Set-clock-stretch-timeout-to-35ms.patch
@@ -0,0 +1,47 @@
+From afe2553b025f2212c709641d8ae06f9e4901f68b Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Fri, 12 Jul 2019 15:38:35 +0100
+Subject: [PATCH 129/697] i2c: bcm2835: Set clock-stretch timeout to 35ms
+
+The BCM2835 I2C blocks have a register to set the clock-stretch
+timeout - how long the device is allowed to hold SCL low - in bus
+cycles. The current driver doesn't write to the register, therefore
+the default value of 64 cycles is being used for all devices.
+
+Set the timeout to the value recommended for SMBus - 35ms.
+
+See: https://github.com/raspberrypi/linux/issues/3064
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/i2c/busses/i2c-bcm2835.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-bcm2835.c
++++ b/drivers/i2c/busses/i2c-bcm2835.c
+@@ -193,6 +193,7 @@ static int clk_bcm2835_i2c_set_rate(stru
+ {
+ 	struct clk_bcm2835_i2c *div = to_clk_bcm2835_i2c(hw);
+ 	u32 redl, fedl;
++	u32 clk_tout;
+ 	u32 divider = clk_bcm2835_i2c_calc_divider(rate, parent_rate);
+ 
+ 	if (divider == -EINVAL)
+@@ -216,6 +217,17 @@ static int clk_bcm2835_i2c_set_rate(stru
+ 	bcm2835_i2c_writel(div->i2c_dev, BCM2835_I2C_DEL,
+ 			   (fedl << BCM2835_I2C_FEDL_SHIFT) |
+ 			   (redl << BCM2835_I2C_REDL_SHIFT));
++
++	/*
++	 * Set the clock stretch timeout to the SMBUs-recommended 35ms.
++	 */
++	if (rate > 0xffff*1000/35)
++	    clk_tout = 0xffff;
++	else
++	    clk_tout = 35*rate/1000;
++
++	bcm2835_i2c_writel(div->i2c_dev, BCM2835_I2C_CLKT, clk_tout);
++
+ 	return 0;
+ }
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0130-drm-v3d-Clock-V3D-down-when-not-in-use.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0130-drm-v3d-Clock-V3D-down-when-not-in-use.patch
new file mode 100644
index 00000000..0a5b7b03
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0130-drm-v3d-Clock-V3D-down-when-not-in-use.patch
@@ -0,0 +1,205 @@
+From 30fca659de0e9b218c8fde6aaf889a65a699f32f Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Wed, 31 Jan 2024 18:48:01 +0000
+Subject: [PATCH 130/697] drm/v3d: Clock V3D down when not in use.
+
+My various attempts at re-enabling runtime PM have failed, so just
+crank the clock down when V3D is idle to reduce power consumption.
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+
+drm/v3d: Plug dma_fence leak
+
+The irq_fence and done_fence are given a reference that is never
+released. The necessary dma_fence_put()s seem to have been
+deleted in error in an earlier commit.
+
+Fixes: 0b73676836b2 ("drm/v3d: Clock V3D down when not in use.")
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+
+v3d_drv: Handle missing clock more gracefully
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+
+v3d_gem: Kick the clock so firmware knows we are using firmware clock interface
+
+Setting the v3d clock to low value allows firmware to handle dvfs in case
+where v3d hardware is not being actively used (e.g. console use).
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+---
+ drivers/gpu/drm/v3d/v3d_drv.c    | 17 ++++++++++
+ drivers/gpu/drm/v3d/v3d_drv.h    |  7 ++++
+ drivers/gpu/drm/v3d/v3d_gem.c    |  3 ++
+ drivers/gpu/drm/v3d/v3d_submit.c | 56 ++++++++++++++++++++++++++++++++
+ 4 files changed, 83 insertions(+)
+
+--- a/drivers/gpu/drm/v3d/v3d_drv.c
++++ b/drivers/gpu/drm/v3d/v3d_drv.c
+@@ -321,6 +321,21 @@ static int v3d_platform_drm_probe(struct
+ 		}
+ 	}
+ 
++	v3d->clk = devm_clk_get(dev, NULL);
++	if (IS_ERR_OR_NULL(v3d->clk)) {
++		if (PTR_ERR(v3d->clk) != -EPROBE_DEFER)
++			dev_err(dev, "Failed to get clock (%ld)\n", PTR_ERR(v3d->clk));
++		return PTR_ERR(v3d->clk);
++	}
++	v3d->clk_up_rate = clk_get_rate(v3d->clk);
++	/* For downclocking, drop it to the minimum frequency we can get from
++	 * the CPRMAN clock generator dividing off our parent.  The divider is
++	 * 4 bits, but ask for just higher than that so that rounding doesn't
++	 * make cprman reject our rate.
++	 */
++	v3d->clk_down_rate =
++		(clk_get_rate(clk_get_parent(v3d->clk)) / (1 << 4)) + 10000;
++
+ 	if (v3d->ver < 41) {
+ 		ret = map_regs(v3d, &v3d->gca_regs, "gca");
+ 		if (ret)
+@@ -349,6 +364,8 @@ static int v3d_platform_drm_probe(struct
+ 	ret = v3d_sysfs_init(dev);
+ 	if (ret)
+ 		goto drm_unregister;
++	ret = clk_set_rate(v3d->clk, v3d->clk_down_rate);
++	WARN_ON_ONCE(ret != 0);
+ 
+ 	return 0;
+ 
+--- a/drivers/gpu/drm/v3d/v3d_drv.h
++++ b/drivers/gpu/drm/v3d/v3d_drv.h
+@@ -113,6 +113,12 @@ struct v3d_dev {
+ 	void __iomem *bridge_regs;
+ 	void __iomem *gca_regs;
+ 	struct clk *clk;
++	struct delayed_work clk_down_work;
++	unsigned long clk_up_rate, clk_down_rate;
++	struct mutex clk_lock;
++	u32 clk_refcount;
++	bool clk_up;
++
+ 	struct reset_control *reset;
+ 
+ 	/* Virtual and DMA addresses of the single shared page table. */
+@@ -589,3 +595,4 @@ int v3d_perfmon_get_counter_ioctl(struct
+ /* v3d_sysfs.c */
+ int v3d_sysfs_init(struct device *dev);
+ void v3d_sysfs_destroy(struct device *dev);
++void v3d_submit_init(struct drm_device *dev);
+--- a/drivers/gpu/drm/v3d/v3d_gem.c
++++ b/drivers/gpu/drm/v3d/v3d_gem.c
+@@ -4,6 +4,7 @@
+ #include <linux/device.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/io.h>
++#include <linux/clk.h>
+ #include <linux/module.h>
+ #include <linux/platform_device.h>
+ #include <linux/reset.h>
+@@ -269,6 +270,8 @@ v3d_gem_init(struct drm_device *dev)
+ 	if (ret)
+ 		return ret;
+ 
++	v3d_submit_init(dev);
++
+ 	/* Note: We don't allocate address 0.  Various bits of HW
+ 	 * treat 0 as special, such as the occlusion query counters
+ 	 * where 0 means "disabled".
+--- a/drivers/gpu/drm/v3d/v3d_submit.c
++++ b/drivers/gpu/drm/v3d/v3d_submit.c
+@@ -5,11 +5,52 @@
+  */
+ 
+ #include <drm/drm_syncobj.h>
++#include <linux/clk.h>
+ 
+ #include "v3d_drv.h"
+ #include "v3d_regs.h"
+ #include "v3d_trace.h"
+ 
++static void
++v3d_clock_down_work(struct work_struct *work)
++{
++	struct v3d_dev *v3d =
++		container_of(work, struct v3d_dev, clk_down_work.work);
++	int ret;
++
++	ret = clk_set_rate(v3d->clk, v3d->clk_down_rate);
++	v3d->clk_up = false;
++	WARN_ON_ONCE(ret != 0);
++}
++
++static void
++v3d_clock_up_get(struct v3d_dev *v3d)
++{
++	mutex_lock(&v3d->clk_lock);
++	if (v3d->clk_refcount++ == 0) {
++		cancel_delayed_work_sync(&v3d->clk_down_work);
++		if (!v3d->clk_up)  {
++			int ret;
++
++			ret = clk_set_rate(v3d->clk, v3d->clk_up_rate);
++			WARN_ON_ONCE(ret != 0);
++			v3d->clk_up = true;
++		}
++	}
++	mutex_unlock(&v3d->clk_lock);
++}
++
++static void
++v3d_clock_up_put(struct v3d_dev *v3d)
++{
++	mutex_lock(&v3d->clk_lock);
++	if (--v3d->clk_refcount == 0) {
++		schedule_delayed_work(&v3d->clk_down_work,
++			msecs_to_jiffies(100));
++	}
++	mutex_unlock(&v3d->clk_lock);
++}
++
+ /* Takes the reservation lock on all the BOs being referenced, so that
+  * at queue submit time we can update the reservations.
+  *
+@@ -87,6 +128,7 @@ static void
+ v3d_job_free(struct kref *ref)
+ {
+ 	struct v3d_job *job = container_of(ref, struct v3d_job, refcount);
++	struct v3d_dev *v3d = job->v3d;
+ 	int i;
+ 
+ 	if (job->bo) {
+@@ -98,6 +140,8 @@ v3d_job_free(struct kref *ref)
+ 	dma_fence_put(job->irq_fence);
+ 	dma_fence_put(job->done_fence);
+ 
++	v3d_clock_up_put(v3d);
++
+ 	if (job->perfmon)
+ 		v3d_perfmon_put(job->perfmon);
+ 
+@@ -199,6 +243,7 @@ v3d_job_init(struct v3d_dev *v3d, struct
+ 			goto fail_deps;
+ 	}
+ 
++	v3d_clock_up_get(v3d);
+ 	kref_init(&job->refcount);
+ 
+ 	return 0;
+@@ -1393,3 +1438,14 @@ fail:
+ 
+ 	return ret;
+ }
++
++void v3d_submit_init(struct drm_device *dev) {
++	struct v3d_dev *v3d = to_v3d_dev(dev);
++
++	mutex_init(&v3d->clk_lock);
++	INIT_DELAYED_WORK(&v3d->clk_down_work, v3d_clock_down_work);
++
++	/* kick the clock so firmware knows we are using firmware clock interface */
++	v3d_clock_up_get(v3d);
++	v3d_clock_up_put(v3d);
++}
+\ No newline at end of file
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0131-drm-v3d-Switch-clock-setting-to-new-api.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0131-drm-v3d-Switch-clock-setting-to-new-api.patch
new file mode 100644
index 00000000..0d9f971f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0131-drm-v3d-Switch-clock-setting-to-new-api.patch
@@ -0,0 +1,74 @@
+From 89cd0a4f03905f359dd42726f3b40c83891fa804 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Wed, 20 Apr 2022 18:08:38 +0100
+Subject: [PATCH 131/697] drm/v3d: Switch clock setting to new api
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+drm/v3d: Convert to new clock range API
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/v3d/v3d_drv.c | 23 +++++++++++++++++++++--
+ 1 file changed, 21 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/v3d/v3d_drv.c
++++ b/drivers/gpu/drm/v3d/v3d_drv.c
+@@ -17,6 +17,7 @@
+ #include <linux/dma-mapping.h>
+ #include <linux/io.h>
+ #include <linux/module.h>
++#include <linux/of.h>
+ #include <linux/of_platform.h>
+ #include <linux/platform_device.h>
+ #include <linux/sched/clock.h>
+@@ -24,6 +25,9 @@
+ 
+ #include <drm/drm_drv.h>
+ #include <drm/drm_managed.h>
++
++#include <soc/bcm2835/raspberrypi-firmware.h>
++
+ #include <uapi/drm/v3d_drm.h>
+ 
+ #include "v3d_drv.h"
+@@ -263,6 +267,8 @@ map_regs(struct v3d_dev *v3d, void __iom
+ static int v3d_platform_drm_probe(struct platform_device *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
++	struct rpi_firmware *firmware;
++	struct device_node *node;
+ 	struct drm_device *drm;
+ 	struct v3d_dev *v3d;
+ 	int ret;
+@@ -327,7 +333,20 @@ static int v3d_platform_drm_probe(struct
+ 			dev_err(dev, "Failed to get clock (%ld)\n", PTR_ERR(v3d->clk));
+ 		return PTR_ERR(v3d->clk);
+ 	}
+-	v3d->clk_up_rate = clk_get_rate(v3d->clk);
++
++	node = rpi_firmware_find_node();
++	if (!node)
++		return -EINVAL;
++
++	firmware = rpi_firmware_get(node);
++	of_node_put(node);
++	if (!firmware)
++		return -EPROBE_DEFER;
++
++	v3d->clk_up_rate = rpi_firmware_clk_get_max_rate(firmware,
++							 RPI_FIRMWARE_V3D_CLK_ID);
++	rpi_firmware_put(firmware);
++
+ 	/* For downclocking, drop it to the minimum frequency we can get from
+ 	 * the CPRMAN clock generator dividing off our parent.  The divider is
+ 	 * 4 bits, but ask for just higher than that so that rounding doesn't
+@@ -364,7 +383,7 @@ static int v3d_platform_drm_probe(struct
+ 	ret = v3d_sysfs_init(dev);
+ 	if (ret)
+ 		goto drm_unregister;
+-	ret = clk_set_rate(v3d->clk, v3d->clk_down_rate);
++	ret = clk_set_min_rate(v3d->clk, v3d->clk_down_rate);
+ 	WARN_ON_ONCE(ret != 0);
+ 
+ 	return 0;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0132-hid-usb-Add-device-quirks-for-Freeway-Airmouse-T3-an.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0132-hid-usb-Add-device-quirks-for-Freeway-Airmouse-T3-an.patch
new file mode 100644
index 00000000..2c51cba4
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0132-hid-usb-Add-device-quirks-for-Freeway-Airmouse-T3-an.patch
@@ -0,0 +1,63 @@
+From a4d0ac617c4bf53834a6c7e010291cafa5550621 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.org>
+Date: Thu, 1 Aug 2019 16:41:20 +0100
+Subject: [PATCH 132/697] hid: usb: Add device quirks for Freeway Airmouse T3
+ and MX3
+
+These wireless mouse/keyboard combo remote control devices specify
+multiple "wheel" events in their report descriptors. The wheel events
+are incorrectly defined and apparently map to accelerometer data, leading
+to spurious mouse scroll events being generated at an extreme rate when
+the device is moved.
+
+As a workaround, use HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE to mask
+feeding the extra wheel events to the input subsystem.
+
+See: https://github.com/raspberrypi/firmware/issues/1189
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
+---
+ drivers/hid/hid-ids.h    | 6 ++++++
+ drivers/hid/hid-quirks.c | 2 ++
+ 2 files changed, 8 insertions(+)
+
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -243,6 +243,9 @@
+ #define USB_VENDOR_ID_BAANTO		0x2453
+ #define USB_DEVICE_ID_BAANTO_MT_190W2	0x0100
+ 
++#define USB_VENDOR_ID_BEKEN		0x25a7
++#define USB_DEVICE_ID_AIRMOUSE_T3	0x2402
++
+ #define USB_VENDOR_ID_BELKIN		0x050d
+ #define USB_DEVICE_ID_FLIP_KVM		0x3201
+ 
+@@ -1417,6 +1420,9 @@
+ #define USB_VENDOR_ID_XIAOMI		0x2717
+ #define USB_DEVICE_ID_MI_SILENT_MOUSE	0x5014
+ 
++#define USB_VENDOR_ID_XENTA			0x1d57
++#define USB_DEVICE_ID_AIRMOUSE_MX3		0xad03
++
+ #define USB_VENDOR_ID_XIN_MO			0x16c0
+ #define USB_DEVICE_ID_XIN_MO_DUAL_ARCADE	0x05e1
+ #define USB_DEVICE_ID_THT_2P_ARCADE		0x75e1
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -42,6 +42,7 @@ static const struct hid_device_id hid_qu
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS682), HID_QUIRK_NOGET },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS692), HID_QUIRK_NOGET },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM), HID_QUIRK_NOGET },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_BEKEN, USB_DEVICE_ID_AIRMOUSE_T3), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_MULTI_TOUCH), HID_QUIRK_MULTI_INPUT },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE2), HID_QUIRK_ALWAYS_POLL },
+@@ -209,6 +210,7 @@ static const struct hid_device_id hid_qu
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_QUAD_USB_JOYPAD), HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_XIN_MO_DUAL_ARCADE), HID_QUIRK_MULTI_INPUT },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_GROUP_AUDIO), HID_QUIRK_NOGET },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_XENTA, USB_DEVICE_ID_AIRMOUSE_MX3), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ 
+ 	{ 0 }
+ };
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0133-net-bcmgenet-Workaround-2-for-Pi4-Ethernet-fail.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0133-net-bcmgenet-Workaround-2-for-Pi4-Ethernet-fail.patch
new file mode 100644
index 00000000..1d38fac6
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0133-net-bcmgenet-Workaround-2-for-Pi4-Ethernet-fail.patch
@@ -0,0 +1,51 @@
+From ae34e68406d1e4a7c06c476709d84199377df1ac Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Fri, 9 Aug 2019 08:51:43 +0100
+Subject: [PATCH 133/697] net: bcmgenet: Workaround #2 for Pi4 Ethernet fail
+
+Some combinations of Pi 4Bs and Ethernet switches don't reliably get a
+DCHP-assigned IP address, leaving the unit with a self=assigned 169.254
+address. In the failure case, the Pi is left able to receive packets
+but not send them, suggesting that the MAC<->PHY link is getting into
+a bad state.
+
+It has been found empirically that skipping a reset step by the genet
+driver prevents the failures. No downsides have been discovered yet,
+and unlike the forced renegotiation it doesn't increase the time to
+get an IP address, so the workaround is enabled by default; add
+
+  genet.skip_umac_reset=n
+
+to the command line to disable it.
+
+See: https://github.com/raspberrypi/linux/issues/3108
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -67,6 +67,9 @@
+ 
+ /* Forward declarations */
+ static void bcmgenet_set_rx_mode(struct net_device *dev);
++static bool skip_umac_reset = true;
++module_param(skip_umac_reset, bool, 0444);
++MODULE_PARM_DESC(skip_umac_reset, "Skip UMAC reset step");
+ 
+ static inline void bcmgenet_writel(u32 value, void __iomem *offset)
+ {
+@@ -2493,6 +2496,11 @@ static void reset_umac(struct bcmgenet_p
+ 	bcmgenet_rbuf_ctrl_set(priv, 0);
+ 	udelay(10);
+ 
++	if (skip_umac_reset) {
++		pr_warn("Skipping UMAC reset\n");
++		return;
++	}
++
+ 	/* issue soft reset and disable MAC while updating its registers */
+ 	spin_lock_bh(&priv->reg_lock);
+ 	bcmgenet_umac_writel(priv, CMD_SW_RESET, UMAC_CMD);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0134-arch-arm-Add-model-string-to-cpuinfo.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0134-arch-arm-Add-model-string-to-cpuinfo.patch
new file mode 100644
index 00000000..34c8e887
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0134-arch-arm-Add-model-string-to-cpuinfo.patch
@@ -0,0 +1,36 @@
+From 00aa02d67990be2205e24848109cfb00e5bffc84 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Tue, 3 Sep 2019 18:16:56 +0100
+Subject: [PATCH 134/697] arch/arm: Add model string to cpuinfo
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ arch/arm/kernel/setup.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/arch/arm/kernel/setup.c
++++ b/arch/arm/kernel/setup.c
+@@ -1266,6 +1266,8 @@ static int c_show(struct seq_file *m, vo
+ {
+ 	int i, j;
+ 	u32 cpuid;
++	struct device_node *np;
++	const char *model;
+ 
+ 	for_each_online_cpu(i) {
+ 		/*
+@@ -1325,6 +1327,14 @@ static int c_show(struct seq_file *m, vo
+ 	seq_printf(m, "Revision\t: %04x\n", system_rev);
+ 	seq_printf(m, "Serial\t\t: %s\n", system_serial);
+ 
++	np = of_find_node_by_path("/");
++	if (np) {
++		if (!of_property_read_string(np, "model",
++					     &model))
++			seq_printf(m, "Model\t\t: %s\n", model);
++		of_node_put(np);
++	}
++
+ 	return 0;
+ }
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0135-arch-arm64-Add-Revision-Serial-Model-to-cpuinfo.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0135-arch-arm64-Add-Revision-Serial-Model-to-cpuinfo.patch
new file mode 100644
index 00000000..d435aac6
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0135-arch-arm64-Add-Revision-Serial-Model-to-cpuinfo.patch
@@ -0,0 +1,57 @@
+From 3152340c00fd70b0dcf89a18724fd2fc1698430e Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Tue, 3 Sep 2019 18:17:25 +0100
+Subject: [PATCH 135/697] arch/arm64: Add Revision, Serial, Model to cpuinfo
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ arch/arm64/kernel/cpuinfo.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+--- a/arch/arm64/kernel/cpuinfo.c
++++ b/arch/arm64/kernel/cpuinfo.c
+@@ -17,6 +17,8 @@
+ #include <linux/elf.h>
+ #include <linux/init.h>
+ #include <linux/kernel.h>
++#include <linux/of.h>
++#include <linux/of_platform.h>
+ #include <linux/personality.h>
+ #include <linux/preempt.h>
+ #include <linux/printk.h>
+@@ -195,6 +197,10 @@ static int c_show(struct seq_file *m, vo
+ {
+ 	int i, j;
+ 	bool compat = personality(current->personality) == PER_LINUX32;
++	struct device_node *np;
++	const char *model;
++	const char *serial;
++	u32 revision;
+ 
+ 	for_each_online_cpu(i) {
+ 		struct cpuinfo_arm64 *cpuinfo = &per_cpu(cpu_data, i);
+@@ -255,6 +261,24 @@ static int c_show(struct seq_file *m, vo
+ 		seq_printf(m, "CPU revision\t: %d\n\n", MIDR_REVISION(midr));
+ 	}
+ 
++	np = of_find_node_by_path("/system");
++	if (np) {
++		if (!of_property_read_u32(np, "linux,revision", &revision))
++			seq_printf(m, "Revision\t: %04x\n", revision);
++		of_node_put(np);
++	}
++
++	np = of_find_node_by_path("/");
++	if (np) {
++		if (!of_property_read_string(np, "serial-number",
++					     &serial))
++			seq_printf(m, "Serial\t\t: %s\n", serial);
++		if (!of_property_read_string(np, "model",
++					     &model))
++			seq_printf(m, "Model\t\t: %s\n", model);
++		of_node_put(np);
++	}
++
+ 	return 0;
+ }
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0136-media-i2c-imx477-Support-for-the-Sony-IMX477-sensor.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0136-media-i2c-imx477-Support-for-the-Sony-IMX477-sensor.patch
new file mode 100644
index 00000000..5587ccf9
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0136-media-i2c-imx477-Support-for-the-Sony-IMX477-sensor.patch
@@ -0,0 +1,2816 @@
+From 3cfb7cebd2070706a79e4a0a7efd5508ede11936 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Thu, 7 May 2020 15:50:54 +0100
+Subject: [PATCH 136/697] media: i2c: imx477: Support for the Sony IMX477
+ sensor
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+dt-bindings: media: i2c: Add IMX477 CMOS sensor binding
+
+Add YAML device tree binding for IMX477 CMOS image sensor.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: Add driver for Sony IMX477 sensor
+
+Adds a driver for the 12MPix Sony IMX477 CSI2 sensor.
+Whilst the sensor supports 2 or 4 CSI2 data lanes, this driver
+currently only supports 2 lanes.
+
+The following Bayer modes are currently available:
+
+4056x3040 12-bit @ 10fps
+2028x1520 12-bit (binned) @ 40fps
+2028x1050 12-bit (cropped/binned) @ 50fps
+1012x760 10-bit (scaled) @ 120 fps
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Add support for adaptive frame control
+
+Use V4L2_CID_EXPOSURE_AUTO_PRIORITY to control if the driver should
+automatically adjust the sensor frame length based on exposure time,
+allowing variable frame rates and longer exposures.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Return correct result on sensor id verification
+
+The test should return -EIO if the register read id does not match
+the expected sensor id.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Parse and register properties
+
+Parse device properties and register controls for them using the V4L2
+fwnode properties helpers.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+media: i2c: imx477: Selection compliance fixes
+
+To comply with the intended usage of the V4L2 selection target when
+used to retrieve a sensor image properties, adjust the rectangles
+returned by the imx477 driver.
+
+The top/left crop coordinates of the TGT_CROP rectangle were set to
+(0, 0) instead of (8, 16) which is the offset from the larger physical
+pixel array rectangle. This was also a mismatch with the default values
+crop rectangle value, so this is corrected. Found with v4l2-compliance.
+
+While at it, add V4L2_SEL_TGT_CROP_BOUNDS support: CROP_DEFAULT and
+CROP_BOUNDS have the same size as the non-active pixels are not readable
+using the selection API. Found with v4l2-compliance.
+
+This commit mirrors 543790f777ba1b3264c168c653db6d415e7c983f done for
+the imx219 sensor.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Remove auto frame length adjusting
+
+The V4L2_CID_EXPOSURE_AUTO_PRIORITY was used to let the sensor control
+frame length (effectively framerate) based on the requested exposure
+time requested. Remove this feature as it is never used, and goes
+against how V4L2 likes to handle exposure and vblank controls.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Add very long exposure control to the driver
+
+Add support for very long exposures by using the exposure multiplier
+register. Userland does not need to pass any additional controls to
+enable long exposures, it simply requests a larger vblank to extend the
+exposure control range appropriately.
+
+Currently, since hblank is fixed, a maximum of approximately 124 seconds
+of exposure time can be used. In a future change, hblank could also be
+controlled in userland to give over 200 seconds of exposure time.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Fix crop height for 2028x1080 mode
+
+The crop height for this mode was set at 2600 lines, it should be 2160
+lines instead.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Replace existing 1012x760 mode
+
+The existing 1012x760 120 fps mode has significant IQ problem using
+the internal sensor scaler. Replace this mode with a 1332x990 120 fps
+mode instead. This new mode has a smaller field of view, but does not
+suffer from the bad IQ of the original mode.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Remove internal v4l2_mbus_framefmt from the state
+
+The only field in this struct that is used is the format code, so
+replace the struct with this single field.
+
+Save the format code in imx477_set_pad_format() when setting up a new
+mode so that imx477_get_pad_format() performs the right lookup.
+Otherwise, this caused a bug where the mode lookup occurred on the
+12-bit table rather than the 10-bit table.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Remove unused function parameter
+
+The struct imx477 *ctrl parameter is not used in the function
+imx477_adjust_exposure_range(), so remove it.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Fix for long exposure limit calculations
+
+Do not scale IMX477_EXPOSURE_OFFSET with the long exposure factor during
+the limit calculations. This allows larger exposure times, and does seem to be
+what the sensor is doing internally.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Extend driver to support imx378 sensor
+
+The imx378 sensor is almost identical to the imx477 and can be
+supported as a "compatible" sensor with just a few extra register
+writes.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+media: i2c: imx477: Fix framerates for 1332x990 mode
+
+The imx477 driver's line length for this mode had not been updated to
+the value supplied to us by the sensor manufacturer. With this
+correction the sensor delivers the framerates that are expected.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+media: i2c: imx477: Allow control of on-sensor DPC
+
+A module parameter "dpc_enable" is added to allow the control of the
+sensor's on-board DPC (Defective Pixel Correction) function.
+
+This is a global setting to be configured before using the sensor;
+there is no intention that this would ever be changed on-the-fly.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+media: i2c: imx477: Sensor should report RAW color space
+
+Tested on Raspberry Pi running libcamera.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+media: i2c: imx477: Add vsync trigger_mode parameter
+
+trigger_mode == 0 (default) => no effect / no registers written
+trigger_mode == 1           => source
+trigger_mode == 2           => sink
+
+This can be set e.g. in /boot/cmdline.txt as imx477.trigger_mode=N
+
+Signed-off-by: Jonas Jacob <jonas.jacob@neocortexvision.com>
+
+media: i2c: Update imx477 Kconfig entry
+
+Bring the IMX477 Kconfig declaration in line with upstream entries.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+media: i2c: imx477: Correct minimum exposure lines
+
+The minimum number of exposure lines value (IMX477_EXPOSURE_MIN) was
+previously 20 but this is not correct. The datasheet is not completely
+explicit, however the new value of 4 has been tested with all the
+sensor modes supported by this driver, and matches the lowest exposure
+value of 114us that could be achieved wtih Raspberry Pi's legacy
+firmware driver.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+media: i2c: imx477: Allow dynamic horizontal blanking control
+
+Currently, the V4L2_CID_HBLANK control is marked as read-only. Remove this
+restriction and allow userland to modify the control if needed.
+
+Set the maximum limit of the line length to 0xfff0.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Reset hblank on mode switch
+
+Reset the hblank control to the minimum value on every mode switch. This is to
+account for userland instances that do not yet control hblank, otherwise it
+gets set to a non-optimal value.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Do not unconditionally adjust hblank and vblank limits
+
+On a mode change, only call imx477_set_framing_limits() to adjust the hblank
+and vblank limits if the new mode is different from the existing mode. This
+preserves any manual control values the user might have set.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+driver: media: i2c: imx477: Re-enable temperature sensor
+
+The temperature sensor enable register write got lost at some point.
+Re-enable it.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: i2c: imx477: Fix locking in imx477_init_controls()
+
+The driver does not lock the imx477 mutex when calling
+imx477_set_framing_limits(), leading to:
+
+WARNING: CPU: 3 PID: 426 at drivers/media/v4l2-core/v4l2-ctrls-api.c:934 __v4l2_ctrl_modify_range+0x1a0/0x210 [
+videodev]
+
+Fix this by taking the lock.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+drivers: media: imx477: Disable the scaler
+
+The horizontal scaler was enabled for the 2028x1520 and 2028x1080 modes,
+with a scale factor of 1. It caused a single column of bad pixels on the
+right edge of the image. Since scaling is not needed for these modes,
+disable it entirely.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+drivers: media: imx477: Set horizontal binning when disabling the scaler
+
+The horizontal scaler has been disabled but actually the sensor is not
+binning horizontally, resulting in images that are stretched 2x
+horizontally (missing the right half of the field of view completely).
+
+Therefore we must additionally set the horizontal binning mode. There
+is only marginal change in output quality and noise levels.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+Fixes: f075893e9b0e ("drivers: media: imx477: Disable the scaler")
+
+drivers: media: imx477: Add V4L2_CID_LINK_FREQ control
+
+Add V4L2_CID_LINK_FREQ as a read-only control with a value of 450 Mhz.
+This will be used by the CFE driver to corretly setup the DPHY timing
+parameters in the CSI-2 block.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+drivers: media: imx477: Correctly set IMX477_PIXEL_RATE as a r/o control
+
+This control is meant to be read-only, mark it as such.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+drivers: media: i2c: imx296,imx477: Configure tigger_mode every time
+
+Don't assume the camera has been reset each time we start streaming,
+but always write registers relating to trigger_mode, even in mode 0.
+
+IMX477: Stop driving XVS on stop streaming, to avoid spurious pulses.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+
+media: i2c: imx477: Squash fixes
+
+imx477: make trigger-mode more configurable
+
+Allow trigger-mode to be overridden using device tree so that it can be
+set per camera. Previously the mode could only be changed using a module
+parameter, which would then affect all cameras.
+
+Signed-off-by: Erik Botö <erik.boto@gmail.com>
+
+drivers: media: imx477: Add V4L2_CID_LINK_FREQ control
+
+Add V4L2_CID_LINK_FREQ as a read-only control with a value of 450 Mhz.
+This will be used by the CFE driver to corretly setup the DPHY timing
+parameters in the CSI-2 block.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../devicetree/bindings/media/i2c/imx477.yaml |  113 +
+ MAINTAINERS                                   |    8 +
+ drivers/media/i2c/Kconfig                     |   11 +
+ drivers/media/i2c/Makefile                    |    1 +
+ drivers/media/i2c/imx477.c                    | 2339 +++++++++++++++++
+ 5 files changed, 2472 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/media/i2c/imx477.yaml
+ create mode 100644 drivers/media/i2c/imx477.c
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/i2c/imx477.yaml
+@@ -0,0 +1,113 @@
++# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/media/i2c/imx477.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Sony 1/2.3-Inch 12Mpixel CMOS Digital Image Sensor
++
++maintainers:
++  - Naushir Patuck <naush@raspberypi.com>
++
++description: |-
++  The Sony IMX477 is a 1/2.3-inch CMOS active pixel digital image sensor
++  with an active array size of 4056H x 3040V. It is programmable through
++  I2C interface. The I2C address is fixed to 0x1A as per sensor data sheet.
++  Image data is sent through MIPI CSI-2, which is configured as either 2 or
++  4 data lanes.
++
++properties:
++  compatible:
++    const: sony,imx477
++
++  reg:
++    description: I2C device address
++    maxItems: 1
++
++  clocks:
++    maxItems: 1
++
++  VDIG-supply:
++    description:
++      Digital I/O voltage supply, 1.05 volts
++
++  VANA-supply:
++    description:
++      Analog voltage supply, 2.8 volts
++
++  VDDL-supply:
++    description:
++      Digital core voltage supply, 1.8 volts
++
++  reset-gpios:
++    description: |-
++      Reference to the GPIO connected to the xclr pin, if any.
++      Must be released (set high) after all all supplies and INCK are applied.
++
++  # See ../video-interfaces.txt for more details
++  port:
++    type: object
++    properties:
++      endpoint:
++        type: object
++        properties:
++          data-lanes:
++            description: |-
++              The sensor supports either two-lane, or four-lane operation.
++              For two-lane operation the property must be set to <1 2>.
++            items:
++              - const: 1
++              - const: 2
++
++          clock-noncontinuous:
++            type: boolean
++            description: |-
++              MIPI CSI-2 clock is non-continuous if this property is present,
++              otherwise it's continuous.
++
++          link-frequencies:
++            allOf:
++              - $ref: /schemas/types.yaml#/definitions/uint64-array
++            description:
++              Allowed data bus frequencies.
++
++        required:
++          - link-frequencies
++
++required:
++  - compatible
++  - reg
++  - clocks
++  - VANA-supply
++  - VDIG-supply
++  - VDDL-supply
++  - port
++
++additionalProperties: false
++
++examples:
++  - |
++    i2c0 {
++        #address-cells = <1>;
++        #size-cells = <0>;
++
++        imx477: sensor@10 {
++            compatible = "sony,imx477";
++            reg = <0x1a>;
++            clocks = <&imx477_clk>;
++            VANA-supply = <&imx477_vana>;   /* 2.8v */
++            VDIG-supply = <&imx477_vdig>;   /* 1.05v */
++            VDDL-supply = <&imx477_vddl>;   /* 1.8v */
++
++            port {
++                imx477_0: endpoint {
++                    remote-endpoint = <&csi1_ep>;
++                    data-lanes = <1 2>;
++                    clock-noncontinuous;
++                    link-frequencies = /bits/ 64 <450000000>;
++                };
++            };
++        };
++    };
++
++...
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -21540,6 +21540,14 @@ T:	git git://linuxtv.org/media.git
+ F:	Documentation/devicetree/bindings/media/i2c/sony,imx415.yaml
+ F:	drivers/media/i2c/imx415.c
+ 
++SONY IMX477 SENSOR DRIVER
++M:	Raspberry Pi Kernel Maintenance <kernel-list@raspberrypi.com>
++L:	linux-media@vger.kernel.org
++S:	Maintained
++T:	git git://linuxtv.org/media_tree.git
++F:	Documentation/devicetree/bindings/media/i2c/imx477.yaml
++F:	drivers/media/i2c/imx477.c
++
+ SONY MEMORYSTICK SUBSYSTEM
+ M:	Maxim Levitsky <maximlevitsky@gmail.com>
+ M:	Alex Dubov <oakad@yahoo.com>
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -971,6 +971,17 @@ config VIDEO_UDA1342
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called uda1342.
+ 
++config VIDEO_IMX477
++	tristate "Sony IMX477 sensor support"
++	depends on I2C && VIDEO_DEV
++	select VIDEO_V4L2_SUBDEV_API
++	help
++	  This is a Video4Linux2 sensor driver for the Sony
++	  IMX477 camera. Also supports the Sony IMX378.
++
++	  To compile this driver as a module, choose M here: the
++	  module will be called imx477.
++
+ config VIDEO_VP27SMPX
+ 	tristate "Panasonic VP27's internal MPX"
+ 	depends on VIDEO_DEV && I2C
+--- a/drivers/media/i2c/Makefile
++++ b/drivers/media/i2c/Makefile
+@@ -59,6 +59,7 @@ obj-$(CONFIG_VIDEO_IMX335) += imx335.o
+ obj-$(CONFIG_VIDEO_IMX355) += imx355.o
+ obj-$(CONFIG_VIDEO_IMX412) += imx412.o
+ obj-$(CONFIG_VIDEO_IMX415) += imx415.o
++obj-$(CONFIG_VIDEO_IMX477) += imx477.o
+ obj-$(CONFIG_VIDEO_IR_I2C) += ir-kbd-i2c.o
+ obj-$(CONFIG_VIDEO_ISL7998X) += isl7998x.o
+ obj-$(CONFIG_VIDEO_KS0127) += ks0127.o
+--- /dev/null
++++ b/drivers/media/i2c/imx477.c
+@@ -0,0 +1,2339 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * A V4L2 driver for Sony IMX477 cameras.
++ * Copyright (C) 2020, Raspberry Pi (Trading) Ltd
++ *
++ * Based on Sony imx219 camera driver
++ * Copyright (C) 2019-2020 Raspberry Pi (Trading) Ltd
++ */
++#include <linux/unaligned.h>
++#include <linux/clk.h>
++#include <linux/delay.h>
++#include <linux/gpio/consumer.h>
++#include <linux/i2c.h>
++#include <linux/module.h>
++#include <linux/of_device.h>
++#include <linux/pm_runtime.h>
++#include <linux/regulator/consumer.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-event.h>
++#include <media/v4l2-fwnode.h>
++#include <media/v4l2-mediabus.h>
++
++static int dpc_enable = 1;
++module_param(dpc_enable, int, 0644);
++MODULE_PARM_DESC(dpc_enable, "Enable on-sensor DPC");
++
++static int trigger_mode;
++module_param(trigger_mode, int, 0644);
++MODULE_PARM_DESC(trigger_mode, "Set vsync trigger mode: 1=source, 2=sink");
++
++#define IMX477_REG_VALUE_08BIT		1
++#define IMX477_REG_VALUE_16BIT		2
++
++/* Chip ID */
++#define IMX477_REG_CHIP_ID		0x0016
++#define IMX477_CHIP_ID			0x0477
++#define IMX378_CHIP_ID			0x0378
++
++#define IMX477_REG_MODE_SELECT		0x0100
++#define IMX477_MODE_STANDBY		0x00
++#define IMX477_MODE_STREAMING		0x01
++
++#define IMX477_REG_ORIENTATION		0x101
++
++#define IMX477_XCLK_FREQ		24000000
++
++#define IMX477_DEFAULT_LINK_FREQ	450000000
++
++/* Pixel rate is fixed at 840MHz for all the modes */
++#define IMX477_PIXEL_RATE		840000000
++
++/* V_TIMING internal */
++#define IMX477_REG_FRAME_LENGTH		0x0340
++#define IMX477_FRAME_LENGTH_MAX		0xffdc
++
++/* H_TIMING internal */
++#define IMX477_REG_LINE_LENGTH		0x0342
++#define IMX477_LINE_LENGTH_MAX		0xfff0
++
++/* Long exposure multiplier */
++#define IMX477_LONG_EXP_SHIFT_MAX	7
++#define IMX477_LONG_EXP_SHIFT_REG	0x3100
++
++/* Exposure control */
++#define IMX477_REG_EXPOSURE		0x0202
++#define IMX477_EXPOSURE_OFFSET		22
++#define IMX477_EXPOSURE_MIN		4
++#define IMX477_EXPOSURE_STEP		1
++#define IMX477_EXPOSURE_DEFAULT		0x640
++#define IMX477_EXPOSURE_MAX		(IMX477_FRAME_LENGTH_MAX - \
++					 IMX477_EXPOSURE_OFFSET)
++
++/* Analog gain control */
++#define IMX477_REG_ANALOG_GAIN		0x0204
++#define IMX477_ANA_GAIN_MIN		0
++#define IMX477_ANA_GAIN_MAX		978
++#define IMX477_ANA_GAIN_STEP		1
++#define IMX477_ANA_GAIN_DEFAULT		0x0
++
++/* Digital gain control */
++#define IMX477_REG_DIGITAL_GAIN		0x020e
++#define IMX477_DGTL_GAIN_MIN		0x0100
++#define IMX477_DGTL_GAIN_MAX		0xffff
++#define IMX477_DGTL_GAIN_DEFAULT	0x0100
++#define IMX477_DGTL_GAIN_STEP		1
++
++/* Test Pattern Control */
++#define IMX477_REG_TEST_PATTERN		0x0600
++#define IMX477_TEST_PATTERN_DISABLE	0
++#define IMX477_TEST_PATTERN_SOLID_COLOR	1
++#define IMX477_TEST_PATTERN_COLOR_BARS	2
++#define IMX477_TEST_PATTERN_GREY_COLOR	3
++#define IMX477_TEST_PATTERN_PN9		4
++
++/* Test pattern colour components */
++#define IMX477_REG_TEST_PATTERN_R	0x0602
++#define IMX477_REG_TEST_PATTERN_GR	0x0604
++#define IMX477_REG_TEST_PATTERN_B	0x0606
++#define IMX477_REG_TEST_PATTERN_GB	0x0608
++#define IMX477_TEST_PATTERN_COLOUR_MIN	0
++#define IMX477_TEST_PATTERN_COLOUR_MAX	0x0fff
++#define IMX477_TEST_PATTERN_COLOUR_STEP	1
++#define IMX477_TEST_PATTERN_R_DEFAULT	IMX477_TEST_PATTERN_COLOUR_MAX
++#define IMX477_TEST_PATTERN_GR_DEFAULT	0
++#define IMX477_TEST_PATTERN_B_DEFAULT	0
++#define IMX477_TEST_PATTERN_GB_DEFAULT	0
++
++/* Trigger mode */
++#define IMX477_REG_MC_MODE		0x3f0b
++#define IMX477_REG_MS_SEL		0x3041
++#define IMX477_REG_XVS_IO_CTRL		0x3040
++#define IMX477_REG_EXTOUT_EN		0x4b81
++
++/* Embedded metadata stream structure */
++#define IMX477_EMBEDDED_LINE_WIDTH 16384
++#define IMX477_NUM_EMBEDDED_LINES 1
++
++enum pad_types {
++	IMAGE_PAD,
++	METADATA_PAD,
++	NUM_PADS
++};
++
++/* IMX477 native and active pixel array size. */
++#define IMX477_NATIVE_WIDTH		4072U
++#define IMX477_NATIVE_HEIGHT		3176U
++#define IMX477_PIXEL_ARRAY_LEFT		8U
++#define IMX477_PIXEL_ARRAY_TOP		16U
++#define IMX477_PIXEL_ARRAY_WIDTH	4056U
++#define IMX477_PIXEL_ARRAY_HEIGHT	3040U
++
++struct imx477_reg {
++	u16 address;
++	u8 val;
++};
++
++struct imx477_reg_list {
++	unsigned int num_of_regs;
++	const struct imx477_reg *regs;
++};
++
++/* Mode : resolution and related config&values */
++struct imx477_mode {
++	/* Frame width */
++	unsigned int width;
++
++	/* Frame height */
++	unsigned int height;
++
++	/* H-timing in pixels */
++	unsigned int line_length_pix;
++
++	/* Analog crop rectangle. */
++	struct v4l2_rect crop;
++
++	/* Highest possible framerate. */
++	struct v4l2_fract timeperframe_min;
++
++	/* Default framerate. */
++	struct v4l2_fract timeperframe_default;
++
++	/* Default register values */
++	struct imx477_reg_list reg_list;
++};
++
++static const s64 imx477_link_freq_menu[] = {
++	IMX477_DEFAULT_LINK_FREQ,
++};
++
++static const struct imx477_reg mode_common_regs[] = {
++	{0x0136, 0x18},
++	{0x0137, 0x00},
++	{0x0138, 0x01},
++	{0xe000, 0x00},
++	{0xe07a, 0x01},
++	{0x0808, 0x02},
++	{0x4ae9, 0x18},
++	{0x4aea, 0x08},
++	{0xf61c, 0x04},
++	{0xf61e, 0x04},
++	{0x4ae9, 0x21},
++	{0x4aea, 0x80},
++	{0x38a8, 0x1f},
++	{0x38a9, 0xff},
++	{0x38aa, 0x1f},
++	{0x38ab, 0xff},
++	{0x55d4, 0x00},
++	{0x55d5, 0x00},
++	{0x55d6, 0x07},
++	{0x55d7, 0xff},
++	{0x55e8, 0x07},
++	{0x55e9, 0xff},
++	{0x55ea, 0x00},
++	{0x55eb, 0x00},
++	{0x574c, 0x07},
++	{0x574d, 0xff},
++	{0x574e, 0x00},
++	{0x574f, 0x00},
++	{0x5754, 0x00},
++	{0x5755, 0x00},
++	{0x5756, 0x07},
++	{0x5757, 0xff},
++	{0x5973, 0x04},
++	{0x5974, 0x01},
++	{0x5d13, 0xc3},
++	{0x5d14, 0x58},
++	{0x5d15, 0xa3},
++	{0x5d16, 0x1d},
++	{0x5d17, 0x65},
++	{0x5d18, 0x8c},
++	{0x5d1a, 0x06},
++	{0x5d1b, 0xa9},
++	{0x5d1c, 0x45},
++	{0x5d1d, 0x3a},
++	{0x5d1e, 0xab},
++	{0x5d1f, 0x15},
++	{0x5d21, 0x0e},
++	{0x5d22, 0x52},
++	{0x5d23, 0xaa},
++	{0x5d24, 0x7d},
++	{0x5d25, 0x57},
++	{0x5d26, 0xa8},
++	{0x5d37, 0x5a},
++	{0x5d38, 0x5a},
++	{0x5d77, 0x7f},
++	{0x7b75, 0x0e},
++	{0x7b76, 0x0b},
++	{0x7b77, 0x08},
++	{0x7b78, 0x0a},
++	{0x7b79, 0x47},
++	{0x7b7c, 0x00},
++	{0x7b7d, 0x00},
++	{0x8d1f, 0x00},
++	{0x8d27, 0x00},
++	{0x9004, 0x03},
++	{0x9200, 0x50},
++	{0x9201, 0x6c},
++	{0x9202, 0x71},
++	{0x9203, 0x00},
++	{0x9204, 0x71},
++	{0x9205, 0x01},
++	{0x9371, 0x6a},
++	{0x9373, 0x6a},
++	{0x9375, 0x64},
++	{0x991a, 0x00},
++	{0x996b, 0x8c},
++	{0x996c, 0x64},
++	{0x996d, 0x50},
++	{0x9a4c, 0x0d},
++	{0x9a4d, 0x0d},
++	{0xa001, 0x0a},
++	{0xa003, 0x0a},
++	{0xa005, 0x0a},
++	{0xa006, 0x01},
++	{0xa007, 0xc0},
++	{0xa009, 0xc0},
++	{0x3d8a, 0x01},
++	{0x4421, 0x04},
++	{0x7b3b, 0x01},
++	{0x7b4c, 0x00},
++	{0x9905, 0x00},
++	{0x9907, 0x00},
++	{0x9909, 0x00},
++	{0x990b, 0x00},
++	{0x9944, 0x3c},
++	{0x9947, 0x3c},
++	{0x994a, 0x8c},
++	{0x994b, 0x50},
++	{0x994c, 0x1b},
++	{0x994d, 0x8c},
++	{0x994e, 0x50},
++	{0x994f, 0x1b},
++	{0x9950, 0x8c},
++	{0x9951, 0x1b},
++	{0x9952, 0x0a},
++	{0x9953, 0x8c},
++	{0x9954, 0x1b},
++	{0x9955, 0x0a},
++	{0x9a13, 0x04},
++	{0x9a14, 0x04},
++	{0x9a19, 0x00},
++	{0x9a1c, 0x04},
++	{0x9a1d, 0x04},
++	{0x9a26, 0x05},
++	{0x9a27, 0x05},
++	{0x9a2c, 0x01},
++	{0x9a2d, 0x03},
++	{0x9a2f, 0x05},
++	{0x9a30, 0x05},
++	{0x9a41, 0x00},
++	{0x9a46, 0x00},
++	{0x9a47, 0x00},
++	{0x9c17, 0x35},
++	{0x9c1d, 0x31},
++	{0x9c29, 0x50},
++	{0x9c3b, 0x2f},
++	{0x9c41, 0x6b},
++	{0x9c47, 0x2d},
++	{0x9c4d, 0x40},
++	{0x9c6b, 0x00},
++	{0x9c71, 0xc8},
++	{0x9c73, 0x32},
++	{0x9c75, 0x04},
++	{0x9c7d, 0x2d},
++	{0x9c83, 0x40},
++	{0x9c94, 0x3f},
++	{0x9c95, 0x3f},
++	{0x9c96, 0x3f},
++	{0x9c97, 0x00},
++	{0x9c98, 0x00},
++	{0x9c99, 0x00},
++	{0x9c9a, 0x3f},
++	{0x9c9b, 0x3f},
++	{0x9c9c, 0x3f},
++	{0x9ca0, 0x0f},
++	{0x9ca1, 0x0f},
++	{0x9ca2, 0x0f},
++	{0x9ca3, 0x00},
++	{0x9ca4, 0x00},
++	{0x9ca5, 0x00},
++	{0x9ca6, 0x1e},
++	{0x9ca7, 0x1e},
++	{0x9ca8, 0x1e},
++	{0x9ca9, 0x00},
++	{0x9caa, 0x00},
++	{0x9cab, 0x00},
++	{0x9cac, 0x09},
++	{0x9cad, 0x09},
++	{0x9cae, 0x09},
++	{0x9cbd, 0x50},
++	{0x9cbf, 0x50},
++	{0x9cc1, 0x50},
++	{0x9cc3, 0x40},
++	{0x9cc5, 0x40},
++	{0x9cc7, 0x40},
++	{0x9cc9, 0x0a},
++	{0x9ccb, 0x0a},
++	{0x9ccd, 0x0a},
++	{0x9d17, 0x35},
++	{0x9d1d, 0x31},
++	{0x9d29, 0x50},
++	{0x9d3b, 0x2f},
++	{0x9d41, 0x6b},
++	{0x9d47, 0x42},
++	{0x9d4d, 0x5a},
++	{0x9d6b, 0x00},
++	{0x9d71, 0xc8},
++	{0x9d73, 0x32},
++	{0x9d75, 0x04},
++	{0x9d7d, 0x42},
++	{0x9d83, 0x5a},
++	{0x9d94, 0x3f},
++	{0x9d95, 0x3f},
++	{0x9d96, 0x3f},
++	{0x9d97, 0x00},
++	{0x9d98, 0x00},
++	{0x9d99, 0x00},
++	{0x9d9a, 0x3f},
++	{0x9d9b, 0x3f},
++	{0x9d9c, 0x3f},
++	{0x9d9d, 0x1f},
++	{0x9d9e, 0x1f},
++	{0x9d9f, 0x1f},
++	{0x9da0, 0x0f},
++	{0x9da1, 0x0f},
++	{0x9da2, 0x0f},
++	{0x9da3, 0x00},
++	{0x9da4, 0x00},
++	{0x9da5, 0x00},
++	{0x9da6, 0x1e},
++	{0x9da7, 0x1e},
++	{0x9da8, 0x1e},
++	{0x9da9, 0x00},
++	{0x9daa, 0x00},
++	{0x9dab, 0x00},
++	{0x9dac, 0x09},
++	{0x9dad, 0x09},
++	{0x9dae, 0x09},
++	{0x9dc9, 0x0a},
++	{0x9dcb, 0x0a},
++	{0x9dcd, 0x0a},
++	{0x9e17, 0x35},
++	{0x9e1d, 0x31},
++	{0x9e29, 0x50},
++	{0x9e3b, 0x2f},
++	{0x9e41, 0x6b},
++	{0x9e47, 0x2d},
++	{0x9e4d, 0x40},
++	{0x9e6b, 0x00},
++	{0x9e71, 0xc8},
++	{0x9e73, 0x32},
++	{0x9e75, 0x04},
++	{0x9e94, 0x0f},
++	{0x9e95, 0x0f},
++	{0x9e96, 0x0f},
++	{0x9e97, 0x00},
++	{0x9e98, 0x00},
++	{0x9e99, 0x00},
++	{0x9ea0, 0x0f},
++	{0x9ea1, 0x0f},
++	{0x9ea2, 0x0f},
++	{0x9ea3, 0x00},
++	{0x9ea4, 0x00},
++	{0x9ea5, 0x00},
++	{0x9ea6, 0x3f},
++	{0x9ea7, 0x3f},
++	{0x9ea8, 0x3f},
++	{0x9ea9, 0x00},
++	{0x9eaa, 0x00},
++	{0x9eab, 0x00},
++	{0x9eac, 0x09},
++	{0x9ead, 0x09},
++	{0x9eae, 0x09},
++	{0x9ec9, 0x0a},
++	{0x9ecb, 0x0a},
++	{0x9ecd, 0x0a},
++	{0x9f17, 0x35},
++	{0x9f1d, 0x31},
++	{0x9f29, 0x50},
++	{0x9f3b, 0x2f},
++	{0x9f41, 0x6b},
++	{0x9f47, 0x42},
++	{0x9f4d, 0x5a},
++	{0x9f6b, 0x00},
++	{0x9f71, 0xc8},
++	{0x9f73, 0x32},
++	{0x9f75, 0x04},
++	{0x9f94, 0x0f},
++	{0x9f95, 0x0f},
++	{0x9f96, 0x0f},
++	{0x9f97, 0x00},
++	{0x9f98, 0x00},
++	{0x9f99, 0x00},
++	{0x9f9a, 0x2f},
++	{0x9f9b, 0x2f},
++	{0x9f9c, 0x2f},
++	{0x9f9d, 0x00},
++	{0x9f9e, 0x00},
++	{0x9f9f, 0x00},
++	{0x9fa0, 0x0f},
++	{0x9fa1, 0x0f},
++	{0x9fa2, 0x0f},
++	{0x9fa3, 0x00},
++	{0x9fa4, 0x00},
++	{0x9fa5, 0x00},
++	{0x9fa6, 0x1e},
++	{0x9fa7, 0x1e},
++	{0x9fa8, 0x1e},
++	{0x9fa9, 0x00},
++	{0x9faa, 0x00},
++	{0x9fab, 0x00},
++	{0x9fac, 0x09},
++	{0x9fad, 0x09},
++	{0x9fae, 0x09},
++	{0x9fc9, 0x0a},
++	{0x9fcb, 0x0a},
++	{0x9fcd, 0x0a},
++	{0xa14b, 0xff},
++	{0xa151, 0x0c},
++	{0xa153, 0x50},
++	{0xa155, 0x02},
++	{0xa157, 0x00},
++	{0xa1ad, 0xff},
++	{0xa1b3, 0x0c},
++	{0xa1b5, 0x50},
++	{0xa1b9, 0x00},
++	{0xa24b, 0xff},
++	{0xa257, 0x00},
++	{0xa2ad, 0xff},
++	{0xa2b9, 0x00},
++	{0xb21f, 0x04},
++	{0xb35c, 0x00},
++	{0xb35e, 0x08},
++	{0x0112, 0x0c},
++	{0x0113, 0x0c},
++	{0x0114, 0x01},
++	{0x0350, 0x00},
++	{0xbcf1, 0x02},
++	{0x3ff9, 0x01},
++};
++
++/* 12 mpix 10fps */
++static const struct imx477_reg mode_4056x3040_regs[] = {
++	{0x0342, 0x5d},
++	{0x0343, 0xc0},
++	{0x0344, 0x00},
++	{0x0345, 0x00},
++	{0x0346, 0x00},
++	{0x0347, 0x00},
++	{0x0348, 0x0f},
++	{0x0349, 0xd7},
++	{0x034a, 0x0b},
++	{0x034b, 0xdf},
++	{0x00e3, 0x00},
++	{0x00e4, 0x00},
++	{0x00fc, 0x0a},
++	{0x00fd, 0x0a},
++	{0x00fe, 0x0a},
++	{0x00ff, 0x0a},
++	{0x0220, 0x00},
++	{0x0221, 0x11},
++	{0x0381, 0x01},
++	{0x0383, 0x01},
++	{0x0385, 0x01},
++	{0x0387, 0x01},
++	{0x0900, 0x00},
++	{0x0901, 0x11},
++	{0x0902, 0x02},
++	{0x3140, 0x02},
++	{0x3c00, 0x00},
++	{0x3c01, 0x03},
++	{0x3c02, 0xa2},
++	{0x3f0d, 0x01},
++	{0x5748, 0x07},
++	{0x5749, 0xff},
++	{0x574a, 0x00},
++	{0x574b, 0x00},
++	{0x7b75, 0x0a},
++	{0x7b76, 0x0c},
++	{0x7b77, 0x07},
++	{0x7b78, 0x06},
++	{0x7b79, 0x3c},
++	{0x7b53, 0x01},
++	{0x9369, 0x5a},
++	{0x936b, 0x55},
++	{0x936d, 0x28},
++	{0x9304, 0x00},
++	{0x9305, 0x00},
++	{0x9e9a, 0x2f},
++	{0x9e9b, 0x2f},
++	{0x9e9c, 0x2f},
++	{0x9e9d, 0x00},
++	{0x9e9e, 0x00},
++	{0x9e9f, 0x00},
++	{0xa2a9, 0x60},
++	{0xa2b7, 0x00},
++	{0x0401, 0x00},
++	{0x0404, 0x00},
++	{0x0405, 0x10},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x0f},
++	{0x040d, 0xd8},
++	{0x040e, 0x0b},
++	{0x040f, 0xe0},
++	{0x034c, 0x0f},
++	{0x034d, 0xd8},
++	{0x034e, 0x0b},
++	{0x034f, 0xe0},
++	{0x0301, 0x05},
++	{0x0303, 0x02},
++	{0x0305, 0x04},
++	{0x0306, 0x01},
++	{0x0307, 0x5e},
++	{0x0309, 0x0c},
++	{0x030b, 0x02},
++	{0x030d, 0x02},
++	{0x030e, 0x00},
++	{0x030f, 0x96},
++	{0x0310, 0x01},
++	{0x0820, 0x07},
++	{0x0821, 0x08},
++	{0x0822, 0x00},
++	{0x0823, 0x00},
++	{0x080a, 0x00},
++	{0x080b, 0x7f},
++	{0x080c, 0x00},
++	{0x080d, 0x4f},
++	{0x080e, 0x00},
++	{0x080f, 0x77},
++	{0x0810, 0x00},
++	{0x0811, 0x5f},
++	{0x0812, 0x00},
++	{0x0813, 0x57},
++	{0x0814, 0x00},
++	{0x0815, 0x4f},
++	{0x0816, 0x01},
++	{0x0817, 0x27},
++	{0x0818, 0x00},
++	{0x0819, 0x3f},
++	{0xe04c, 0x00},
++	{0xe04d, 0x7f},
++	{0xe04e, 0x00},
++	{0xe04f, 0x1f},
++	{0x3e20, 0x01},
++	{0x3e37, 0x00},
++	{0x3f50, 0x00},
++	{0x3f56, 0x02},
++	{0x3f57, 0xae},
++};
++
++/* 2x2 binned. 40fps */
++static const struct imx477_reg mode_2028x1520_regs[] = {
++	{0x0342, 0x31},
++	{0x0343, 0xc4},
++	{0x0344, 0x00},
++	{0x0345, 0x00},
++	{0x0346, 0x00},
++	{0x0347, 0x00},
++	{0x0348, 0x0f},
++	{0x0349, 0xd7},
++	{0x034a, 0x0b},
++	{0x034b, 0xdf},
++	{0x0220, 0x00},
++	{0x0221, 0x11},
++	{0x0381, 0x01},
++	{0x0383, 0x01},
++	{0x0385, 0x01},
++	{0x0387, 0x01},
++	{0x0900, 0x01},
++	{0x0901, 0x22},
++	{0x0902, 0x02},
++	{0x3140, 0x02},
++	{0x3c00, 0x00},
++	{0x3c01, 0x03},
++	{0x3c02, 0xa2},
++	{0x3f0d, 0x01},
++	{0x5748, 0x07},
++	{0x5749, 0xff},
++	{0x574a, 0x00},
++	{0x574b, 0x00},
++	{0x7b53, 0x01},
++	{0x9369, 0x73},
++	{0x936b, 0x64},
++	{0x936d, 0x5f},
++	{0x9304, 0x00},
++	{0x9305, 0x00},
++	{0x9e9a, 0x2f},
++	{0x9e9b, 0x2f},
++	{0x9e9c, 0x2f},
++	{0x9e9d, 0x00},
++	{0x9e9e, 0x00},
++	{0x9e9f, 0x00},
++	{0xa2a9, 0x60},
++	{0xa2b7, 0x00},
++	{0x0401, 0x00},
++	{0x0404, 0x00},
++	{0x0405, 0x20},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x0f},
++	{0x040d, 0xd8},
++	{0x040e, 0x0b},
++	{0x040f, 0xe0},
++	{0x034c, 0x07},
++	{0x034d, 0xec},
++	{0x034e, 0x05},
++	{0x034f, 0xf0},
++	{0x0301, 0x05},
++	{0x0303, 0x02},
++	{0x0305, 0x04},
++	{0x0306, 0x01},
++	{0x0307, 0x5e},
++	{0x0309, 0x0c},
++	{0x030b, 0x02},
++	{0x030d, 0x02},
++	{0x030e, 0x00},
++	{0x030f, 0x96},
++	{0x0310, 0x01},
++	{0x0820, 0x07},
++	{0x0821, 0x08},
++	{0x0822, 0x00},
++	{0x0823, 0x00},
++	{0x080a, 0x00},
++	{0x080b, 0x7f},
++	{0x080c, 0x00},
++	{0x080d, 0x4f},
++	{0x080e, 0x00},
++	{0x080f, 0x77},
++	{0x0810, 0x00},
++	{0x0811, 0x5f},
++	{0x0812, 0x00},
++	{0x0813, 0x57},
++	{0x0814, 0x00},
++	{0x0815, 0x4f},
++	{0x0816, 0x01},
++	{0x0817, 0x27},
++	{0x0818, 0x00},
++	{0x0819, 0x3f},
++	{0xe04c, 0x00},
++	{0xe04d, 0x7f},
++	{0xe04e, 0x00},
++	{0xe04f, 0x1f},
++	{0x3e20, 0x01},
++	{0x3e37, 0x00},
++	{0x3f50, 0x00},
++	{0x3f56, 0x01},
++	{0x3f57, 0x6c},
++};
++
++/* 1080p cropped mode */
++static const struct imx477_reg mode_2028x1080_regs[] = {
++	{0x0342, 0x31},
++	{0x0343, 0xc4},
++	{0x0344, 0x00},
++	{0x0345, 0x00},
++	{0x0346, 0x01},
++	{0x0347, 0xb8},
++	{0x0348, 0x0f},
++	{0x0349, 0xd7},
++	{0x034a, 0x0a},
++	{0x034b, 0x27},
++	{0x0220, 0x00},
++	{0x0221, 0x11},
++	{0x0381, 0x01},
++	{0x0383, 0x01},
++	{0x0385, 0x01},
++	{0x0387, 0x01},
++	{0x0900, 0x01},
++	{0x0901, 0x22},
++	{0x0902, 0x02},
++	{0x3140, 0x02},
++	{0x3c00, 0x00},
++	{0x3c01, 0x03},
++	{0x3c02, 0xa2},
++	{0x3f0d, 0x01},
++	{0x5748, 0x07},
++	{0x5749, 0xff},
++	{0x574a, 0x00},
++	{0x574b, 0x00},
++	{0x7b53, 0x01},
++	{0x9369, 0x73},
++	{0x936b, 0x64},
++	{0x936d, 0x5f},
++	{0x9304, 0x00},
++	{0x9305, 0x00},
++	{0x9e9a, 0x2f},
++	{0x9e9b, 0x2f},
++	{0x9e9c, 0x2f},
++	{0x9e9d, 0x00},
++	{0x9e9e, 0x00},
++	{0x9e9f, 0x00},
++	{0xa2a9, 0x60},
++	{0xa2b7, 0x00},
++	{0x0401, 0x00},
++	{0x0404, 0x00},
++	{0x0405, 0x20},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x0f},
++	{0x040d, 0xd8},
++	{0x040e, 0x04},
++	{0x040f, 0x38},
++	{0x034c, 0x07},
++	{0x034d, 0xec},
++	{0x034e, 0x04},
++	{0x034f, 0x38},
++	{0x0301, 0x05},
++	{0x0303, 0x02},
++	{0x0305, 0x04},
++	{0x0306, 0x01},
++	{0x0307, 0x5e},
++	{0x0309, 0x0c},
++	{0x030b, 0x02},
++	{0x030d, 0x02},
++	{0x030e, 0x00},
++	{0x030f, 0x96},
++	{0x0310, 0x01},
++	{0x0820, 0x07},
++	{0x0821, 0x08},
++	{0x0822, 0x00},
++	{0x0823, 0x00},
++	{0x080a, 0x00},
++	{0x080b, 0x7f},
++	{0x080c, 0x00},
++	{0x080d, 0x4f},
++	{0x080e, 0x00},
++	{0x080f, 0x77},
++	{0x0810, 0x00},
++	{0x0811, 0x5f},
++	{0x0812, 0x00},
++	{0x0813, 0x57},
++	{0x0814, 0x00},
++	{0x0815, 0x4f},
++	{0x0816, 0x01},
++	{0x0817, 0x27},
++	{0x0818, 0x00},
++	{0x0819, 0x3f},
++	{0xe04c, 0x00},
++	{0xe04d, 0x7f},
++	{0xe04e, 0x00},
++	{0xe04f, 0x1f},
++	{0x3e20, 0x01},
++	{0x3e37, 0x00},
++	{0x3f50, 0x00},
++	{0x3f56, 0x01},
++	{0x3f57, 0x6c},
++};
++
++/* 4x4 binned. 120fps */
++static const struct imx477_reg mode_1332x990_regs[] = {
++	{0x420b, 0x01},
++	{0x990c, 0x00},
++	{0x990d, 0x08},
++	{0x9956, 0x8c},
++	{0x9957, 0x64},
++	{0x9958, 0x50},
++	{0x9a48, 0x06},
++	{0x9a49, 0x06},
++	{0x9a4a, 0x06},
++	{0x9a4b, 0x06},
++	{0x9a4c, 0x06},
++	{0x9a4d, 0x06},
++	{0x0112, 0x0a},
++	{0x0113, 0x0a},
++	{0x0114, 0x01},
++	{0x0342, 0x1a},
++	{0x0343, 0x08},
++	{0x0340, 0x04},
++	{0x0341, 0x1a},
++	{0x0344, 0x00},
++	{0x0345, 0x00},
++	{0x0346, 0x02},
++	{0x0347, 0x10},
++	{0x0348, 0x0f},
++	{0x0349, 0xd7},
++	{0x034a, 0x09},
++	{0x034b, 0xcf},
++	{0x00e3, 0x00},
++	{0x00e4, 0x00},
++	{0x00fc, 0x0a},
++	{0x00fd, 0x0a},
++	{0x00fe, 0x0a},
++	{0x00ff, 0x0a},
++	{0xe013, 0x00},
++	{0x0220, 0x00},
++	{0x0221, 0x11},
++	{0x0381, 0x01},
++	{0x0383, 0x01},
++	{0x0385, 0x01},
++	{0x0387, 0x01},
++	{0x0900, 0x01},
++	{0x0901, 0x22},
++	{0x0902, 0x02},
++	{0x3140, 0x02},
++	{0x3c00, 0x00},
++	{0x3c01, 0x01},
++	{0x3c02, 0x9c},
++	{0x3f0d, 0x00},
++	{0x5748, 0x00},
++	{0x5749, 0x00},
++	{0x574a, 0x00},
++	{0x574b, 0xa4},
++	{0x7b75, 0x0e},
++	{0x7b76, 0x09},
++	{0x7b77, 0x08},
++	{0x7b78, 0x06},
++	{0x7b79, 0x34},
++	{0x7b53, 0x00},
++	{0x9369, 0x73},
++	{0x936b, 0x64},
++	{0x936d, 0x5f},
++	{0x9304, 0x03},
++	{0x9305, 0x80},
++	{0x9e9a, 0x2f},
++	{0x9e9b, 0x2f},
++	{0x9e9c, 0x2f},
++	{0x9e9d, 0x00},
++	{0x9e9e, 0x00},
++	{0x9e9f, 0x00},
++	{0xa2a9, 0x27},
++	{0xa2b7, 0x03},
++	{0x0401, 0x00},
++	{0x0404, 0x00},
++	{0x0405, 0x10},
++	{0x0408, 0x01},
++	{0x0409, 0x5c},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x05},
++	{0x040d, 0x34},
++	{0x040e, 0x03},
++	{0x040f, 0xde},
++	{0x034c, 0x05},
++	{0x034d, 0x34},
++	{0x034e, 0x03},
++	{0x034f, 0xde},
++	{0x0301, 0x05},
++	{0x0303, 0x02},
++	{0x0305, 0x02},
++	{0x0306, 0x00},
++	{0x0307, 0xaf},
++	{0x0309, 0x0a},
++	{0x030b, 0x02},
++	{0x030d, 0x02},
++	{0x030e, 0x00},
++	{0x030f, 0x96},
++	{0x0310, 0x01},
++	{0x0820, 0x07},
++	{0x0821, 0x08},
++	{0x0822, 0x00},
++	{0x0823, 0x00},
++	{0x080a, 0x00},
++	{0x080b, 0x7f},
++	{0x080c, 0x00},
++	{0x080d, 0x4f},
++	{0x080e, 0x00},
++	{0x080f, 0x77},
++	{0x0810, 0x00},
++	{0x0811, 0x5f},
++	{0x0812, 0x00},
++	{0x0813, 0x57},
++	{0x0814, 0x00},
++	{0x0815, 0x4f},
++	{0x0816, 0x01},
++	{0x0817, 0x27},
++	{0x0818, 0x00},
++	{0x0819, 0x3f},
++	{0xe04c, 0x00},
++	{0xe04d, 0x5f},
++	{0xe04e, 0x00},
++	{0xe04f, 0x1f},
++	{0x3e20, 0x01},
++	{0x3e37, 0x00},
++	{0x3f50, 0x00},
++	{0x3f56, 0x00},
++	{0x3f57, 0xbf},
++};
++
++/* Mode configs */
++static const struct imx477_mode supported_modes_12bit[] = {
++	{
++		/* 12MPix 10fps mode */
++		.width = 4056,
++		.height = 3040,
++		.line_length_pix = 0x5dc0,
++		.crop = {
++			.left = IMX477_PIXEL_ARRAY_LEFT,
++			.top = IMX477_PIXEL_ARRAY_TOP,
++			.width = 4056,
++			.height = 3040,
++		},
++		.timeperframe_min = {
++			.numerator = 100,
++			.denominator = 1000
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 1000
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_4056x3040_regs),
++			.regs = mode_4056x3040_regs,
++		},
++	},
++	{
++		/* 2x2 binned 40fps mode */
++		.width = 2028,
++		.height = 1520,
++		.line_length_pix = 0x31c4,
++		.crop = {
++			.left = IMX477_PIXEL_ARRAY_LEFT,
++			.top = IMX477_PIXEL_ARRAY_TOP,
++			.width = 4056,
++			.height = 3040,
++		},
++		.timeperframe_min = {
++			.numerator = 100,
++			.denominator = 4000
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 3000
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_2028x1520_regs),
++			.regs = mode_2028x1520_regs,
++		},
++	},
++	{
++		/* 1080p 50fps cropped mode */
++		.width = 2028,
++		.height = 1080,
++		.line_length_pix = 0x31c4,
++		.crop = {
++			.left = IMX477_PIXEL_ARRAY_LEFT,
++			.top = IMX477_PIXEL_ARRAY_TOP + 440,
++			.width = 4056,
++			.height = 2160,
++		},
++		.timeperframe_min = {
++			.numerator = 100,
++			.denominator = 5000
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 3000
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_2028x1080_regs),
++			.regs = mode_2028x1080_regs,
++		},
++	}
++};
++
++static const struct imx477_mode supported_modes_10bit[] = {
++	{
++		/* 120fps. 2x2 binned and cropped */
++		.width = 1332,
++		.height = 990,
++		.line_length_pix = 6664,
++		.crop = {
++			/*
++			 * FIXME: the analog crop rectangle is actually
++			 * programmed with a horizontal displacement of 0
++			 * pixels, not 4. It gets shrunk after going through
++			 * the scaler. Move this information to the compose
++			 * rectangle once the driver is expanded to represent
++			 * its processing blocks with multiple subdevs.
++			 */
++			.left = IMX477_PIXEL_ARRAY_LEFT + 696,
++			.top = IMX477_PIXEL_ARRAY_TOP + 528,
++			.width = 2664,
++			.height = 1980,
++		},
++		.timeperframe_min = {
++			.numerator = 100,
++			.denominator = 12000
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 12000
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_1332x990_regs),
++			.regs = mode_1332x990_regs,
++		}
++	}
++};
++
++/*
++ * The supported formats.
++ * This table MUST contain 4 entries per format, to cover the various flip
++ * combinations in the order
++ * - no flip
++ * - h flip
++ * - v flip
++ * - h&v flips
++ */
++static const u32 codes[] = {
++	/* 12-bit modes. */
++	MEDIA_BUS_FMT_SRGGB12_1X12,
++	MEDIA_BUS_FMT_SGRBG12_1X12,
++	MEDIA_BUS_FMT_SGBRG12_1X12,
++	MEDIA_BUS_FMT_SBGGR12_1X12,
++	/* 10-bit modes. */
++	MEDIA_BUS_FMT_SRGGB10_1X10,
++	MEDIA_BUS_FMT_SGRBG10_1X10,
++	MEDIA_BUS_FMT_SGBRG10_1X10,
++	MEDIA_BUS_FMT_SBGGR10_1X10,
++};
++
++static const char * const imx477_test_pattern_menu[] = {
++	"Disabled",
++	"Color Bars",
++	"Solid Color",
++	"Grey Color Bars",
++	"PN9"
++};
++
++static const int imx477_test_pattern_val[] = {
++	IMX477_TEST_PATTERN_DISABLE,
++	IMX477_TEST_PATTERN_COLOR_BARS,
++	IMX477_TEST_PATTERN_SOLID_COLOR,
++	IMX477_TEST_PATTERN_GREY_COLOR,
++	IMX477_TEST_PATTERN_PN9,
++};
++
++/* regulator supplies */
++static const char * const imx477_supply_name[] = {
++	/* Supplies can be enabled in any order */
++	"VANA",  /* Analog (2.8V) supply */
++	"VDIG",  /* Digital Core (1.05V) supply */
++	"VDDL",  /* IF (1.8V) supply */
++};
++
++#define IMX477_NUM_SUPPLIES ARRAY_SIZE(imx477_supply_name)
++
++/*
++ * Initialisation delay between XCLR low->high and the moment when the sensor
++ * can start capture (i.e. can leave software standby), given by T7 in the
++ * datasheet is 8ms.  This does include I2C setup time as well.
++ *
++ * Note, that delay between XCLR low->high and reading the CCI ID register (T6
++ * in the datasheet) is much smaller - 600us.
++ */
++#define IMX477_XCLR_MIN_DELAY_US	8000
++#define IMX477_XCLR_DELAY_RANGE_US	1000
++
++struct imx477_compatible_data {
++	unsigned int chip_id;
++	struct imx477_reg_list extra_regs;
++};
++
++struct imx477 {
++	struct v4l2_subdev sd;
++	struct media_pad pad[NUM_PADS];
++
++	unsigned int fmt_code;
++
++	struct clk *xclk;
++	u32 xclk_freq;
++
++	struct gpio_desc *reset_gpio;
++	struct regulator_bulk_data supplies[IMX477_NUM_SUPPLIES];
++
++	struct v4l2_ctrl_handler ctrl_handler;
++	/* V4L2 Controls */
++	struct v4l2_ctrl *pixel_rate;
++	struct v4l2_ctrl *link_freq;
++	struct v4l2_ctrl *exposure;
++	struct v4l2_ctrl *vflip;
++	struct v4l2_ctrl *hflip;
++	struct v4l2_ctrl *vblank;
++	struct v4l2_ctrl *hblank;
++
++	/* Current mode */
++	const struct imx477_mode *mode;
++
++	/* Trigger mode */
++	int trigger_mode_of;
++
++	/*
++	 * Mutex for serialized access:
++	 * Protect sensor module set pad format and start/stop streaming safely.
++	 */
++	struct mutex mutex;
++
++	/* Streaming on/off */
++	bool streaming;
++
++	/* Rewrite common registers on stream on? */
++	bool common_regs_written;
++
++	/* Current long exposure factor in use. Set through V4L2_CID_VBLANK */
++	unsigned int long_exp_shift;
++
++	/* Any extra information related to different compatible sensors */
++	const struct imx477_compatible_data *compatible_data;
++};
++
++static inline struct imx477 *to_imx477(struct v4l2_subdev *_sd)
++{
++	return container_of(_sd, struct imx477, sd);
++}
++
++static inline void get_mode_table(unsigned int code,
++				  const struct imx477_mode **mode_list,
++				  unsigned int *num_modes)
++{
++	switch (code) {
++	/* 12-bit */
++	case MEDIA_BUS_FMT_SRGGB12_1X12:
++	case MEDIA_BUS_FMT_SGRBG12_1X12:
++	case MEDIA_BUS_FMT_SGBRG12_1X12:
++	case MEDIA_BUS_FMT_SBGGR12_1X12:
++		*mode_list = supported_modes_12bit;
++		*num_modes = ARRAY_SIZE(supported_modes_12bit);
++		break;
++	/* 10-bit */
++	case MEDIA_BUS_FMT_SRGGB10_1X10:
++	case MEDIA_BUS_FMT_SGRBG10_1X10:
++	case MEDIA_BUS_FMT_SGBRG10_1X10:
++	case MEDIA_BUS_FMT_SBGGR10_1X10:
++		*mode_list = supported_modes_10bit;
++		*num_modes = ARRAY_SIZE(supported_modes_10bit);
++		break;
++	default:
++		*mode_list = NULL;
++		*num_modes = 0;
++	}
++}
++
++/* Read registers up to 2 at a time */
++static int imx477_read_reg(struct imx477 *imx477, u16 reg, u32 len, u32 *val)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx477->sd);
++	struct i2c_msg msgs[2];
++	u8 addr_buf[2] = { reg >> 8, reg & 0xff };
++	u8 data_buf[4] = { 0, };
++	int ret;
++
++	if (len > 4)
++		return -EINVAL;
++
++	/* Write register address */
++	msgs[0].addr = client->addr;
++	msgs[0].flags = 0;
++	msgs[0].len = ARRAY_SIZE(addr_buf);
++	msgs[0].buf = addr_buf;
++
++	/* Read data from register */
++	msgs[1].addr = client->addr;
++	msgs[1].flags = I2C_M_RD;
++	msgs[1].len = len;
++	msgs[1].buf = &data_buf[4 - len];
++
++	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
++	if (ret != ARRAY_SIZE(msgs))
++		return -EIO;
++
++	*val = get_unaligned_be32(data_buf);
++
++	return 0;
++}
++
++/* Write registers up to 2 at a time */
++static int imx477_write_reg(struct imx477 *imx477, u16 reg, u32 len, u32 val)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx477->sd);
++	u8 buf[6];
++
++	if (len > 4)
++		return -EINVAL;
++
++	put_unaligned_be16(reg, buf);
++	put_unaligned_be32(val << (8 * (4 - len)), buf + 2);
++	if (i2c_master_send(client, buf, len + 2) != len + 2)
++		return -EIO;
++
++	return 0;
++}
++
++/* Write a list of registers */
++static int imx477_write_regs(struct imx477 *imx477,
++			     const struct imx477_reg *regs, u32 len)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx477->sd);
++	unsigned int i;
++	int ret;
++
++	for (i = 0; i < len; i++) {
++		ret = imx477_write_reg(imx477, regs[i].address, 1, regs[i].val);
++		if (ret) {
++			dev_err_ratelimited(&client->dev,
++					    "Failed to write reg 0x%4.4x. error = %d\n",
++					    regs[i].address, ret);
++
++			return ret;
++		}
++	}
++
++	return 0;
++}
++
++/* Get bayer order based on flip setting. */
++static u32 imx477_get_format_code(struct imx477 *imx477, u32 code)
++{
++	unsigned int i;
++
++	lockdep_assert_held(&imx477->mutex);
++
++	for (i = 0; i < ARRAY_SIZE(codes); i++)
++		if (codes[i] == code)
++			break;
++
++	if (i >= ARRAY_SIZE(codes))
++		i = 0;
++
++	i = (i & ~3) | (imx477->vflip->val ? 2 : 0) |
++	    (imx477->hflip->val ? 1 : 0);
++
++	return codes[i];
++}
++
++static void imx477_set_default_format(struct imx477 *imx477)
++{
++	/* Set default mode to max resolution */
++	imx477->mode = &supported_modes_12bit[0];
++	imx477->fmt_code = MEDIA_BUS_FMT_SRGGB12_1X12;
++}
++
++static int imx477_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
++{
++	struct imx477 *imx477 = to_imx477(sd);
++	struct v4l2_mbus_framefmt *try_fmt_img =
++		v4l2_subdev_state_get_format(fh->state, IMAGE_PAD);
++	struct v4l2_mbus_framefmt *try_fmt_meta =
++		v4l2_subdev_state_get_format(fh->state, METADATA_PAD);
++	struct v4l2_rect *try_crop;
++
++	mutex_lock(&imx477->mutex);
++
++	/* Initialize try_fmt for the image pad */
++	try_fmt_img->width = supported_modes_12bit[0].width;
++	try_fmt_img->height = supported_modes_12bit[0].height;
++	try_fmt_img->code = imx477_get_format_code(imx477,
++						   MEDIA_BUS_FMT_SRGGB12_1X12);
++	try_fmt_img->field = V4L2_FIELD_NONE;
++
++	/* Initialize try_fmt for the embedded metadata pad */
++	try_fmt_meta->width = IMX477_EMBEDDED_LINE_WIDTH;
++	try_fmt_meta->height = IMX477_NUM_EMBEDDED_LINES;
++	try_fmt_meta->code = MEDIA_BUS_FMT_SENSOR_DATA;
++	try_fmt_meta->field = V4L2_FIELD_NONE;
++
++	/* Initialize try_crop */
++	try_crop = v4l2_subdev_state_get_crop(fh->state, IMAGE_PAD);
++	try_crop->left = IMX477_PIXEL_ARRAY_LEFT;
++	try_crop->top = IMX477_PIXEL_ARRAY_TOP;
++	try_crop->width = IMX477_PIXEL_ARRAY_WIDTH;
++	try_crop->height = IMX477_PIXEL_ARRAY_HEIGHT;
++
++	mutex_unlock(&imx477->mutex);
++
++	return 0;
++}
++
++static void imx477_adjust_exposure_range(struct imx477 *imx477)
++{
++	int exposure_max, exposure_def;
++
++	/* Honour the VBLANK limits when setting exposure. */
++	exposure_max = imx477->mode->height + imx477->vblank->val -
++		       IMX477_EXPOSURE_OFFSET;
++	exposure_def = min(exposure_max, imx477->exposure->val);
++	__v4l2_ctrl_modify_range(imx477->exposure, imx477->exposure->minimum,
++				 exposure_max, imx477->exposure->step,
++				 exposure_def);
++}
++
++static int imx477_set_frame_length(struct imx477 *imx477, unsigned int val)
++{
++	int ret = 0;
++
++	imx477->long_exp_shift = 0;
++
++	while (val > IMX477_FRAME_LENGTH_MAX) {
++		imx477->long_exp_shift++;
++		val >>= 1;
++	}
++
++	ret = imx477_write_reg(imx477, IMX477_REG_FRAME_LENGTH,
++			       IMX477_REG_VALUE_16BIT, val);
++	if (ret)
++		return ret;
++
++	return imx477_write_reg(imx477, IMX477_LONG_EXP_SHIFT_REG,
++				IMX477_REG_VALUE_08BIT, imx477->long_exp_shift);
++}
++
++static int imx477_set_ctrl(struct v4l2_ctrl *ctrl)
++{
++	struct imx477 *imx477 =
++		container_of(ctrl->handler, struct imx477, ctrl_handler);
++	struct i2c_client *client = v4l2_get_subdevdata(&imx477->sd);
++	int ret = 0;
++
++	/*
++	 * The VBLANK control may change the limits of usable exposure, so check
++	 * and adjust if necessary.
++	 */
++	if (ctrl->id == V4L2_CID_VBLANK)
++		imx477_adjust_exposure_range(imx477);
++
++	/*
++	 * Applying V4L2 control value only happens
++	 * when power is up for streaming
++	 */
++	if (pm_runtime_get_if_in_use(&client->dev) == 0)
++		return 0;
++
++	switch (ctrl->id) {
++	case V4L2_CID_ANALOGUE_GAIN:
++		ret = imx477_write_reg(imx477, IMX477_REG_ANALOG_GAIN,
++				       IMX477_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_EXPOSURE:
++		ret = imx477_write_reg(imx477, IMX477_REG_EXPOSURE,
++				       IMX477_REG_VALUE_16BIT, ctrl->val >>
++							imx477->long_exp_shift);
++		break;
++	case V4L2_CID_DIGITAL_GAIN:
++		ret = imx477_write_reg(imx477, IMX477_REG_DIGITAL_GAIN,
++				       IMX477_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN:
++		ret = imx477_write_reg(imx477, IMX477_REG_TEST_PATTERN,
++				       IMX477_REG_VALUE_16BIT,
++				       imx477_test_pattern_val[ctrl->val]);
++		break;
++	case V4L2_CID_TEST_PATTERN_RED:
++		ret = imx477_write_reg(imx477, IMX477_REG_TEST_PATTERN_R,
++				       IMX477_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN_GREENR:
++		ret = imx477_write_reg(imx477, IMX477_REG_TEST_PATTERN_GR,
++				       IMX477_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN_BLUE:
++		ret = imx477_write_reg(imx477, IMX477_REG_TEST_PATTERN_B,
++				       IMX477_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN_GREENB:
++		ret = imx477_write_reg(imx477, IMX477_REG_TEST_PATTERN_GB,
++				       IMX477_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_HFLIP:
++	case V4L2_CID_VFLIP:
++		ret = imx477_write_reg(imx477, IMX477_REG_ORIENTATION, 1,
++				       imx477->hflip->val |
++				       imx477->vflip->val << 1);
++		break;
++	case V4L2_CID_VBLANK:
++		ret = imx477_set_frame_length(imx477,
++					      imx477->mode->height + ctrl->val);
++		break;
++	case V4L2_CID_HBLANK:
++		ret = imx477_write_reg(imx477, IMX477_REG_LINE_LENGTH, 2,
++				       imx477->mode->width + ctrl->val);
++		break;
++	default:
++		dev_info(&client->dev,
++			 "ctrl(id:0x%x,val:0x%x) is not handled\n",
++			 ctrl->id, ctrl->val);
++		ret = -EINVAL;
++		break;
++	}
++
++	pm_runtime_put(&client->dev);
++
++	return ret;
++}
++
++static const struct v4l2_ctrl_ops imx477_ctrl_ops = {
++	.s_ctrl = imx477_set_ctrl,
++};
++
++static int imx477_enum_mbus_code(struct v4l2_subdev *sd,
++				 struct v4l2_subdev_state *sd_state,
++				 struct v4l2_subdev_mbus_code_enum *code)
++{
++	struct imx477 *imx477 = to_imx477(sd);
++
++	if (code->pad >= NUM_PADS)
++		return -EINVAL;
++
++	if (code->pad == IMAGE_PAD) {
++		if (code->index >= (ARRAY_SIZE(codes) / 4))
++			return -EINVAL;
++
++		code->code = imx477_get_format_code(imx477,
++						    codes[code->index * 4]);
++	} else {
++		if (code->index > 0)
++			return -EINVAL;
++
++		code->code = MEDIA_BUS_FMT_SENSOR_DATA;
++	}
++
++	return 0;
++}
++
++static int imx477_enum_frame_size(struct v4l2_subdev *sd,
++				  struct v4l2_subdev_state *sd_state,
++				  struct v4l2_subdev_frame_size_enum *fse)
++{
++	struct imx477 *imx477 = to_imx477(sd);
++
++	if (fse->pad >= NUM_PADS)
++		return -EINVAL;
++
++	if (fse->pad == IMAGE_PAD) {
++		const struct imx477_mode *mode_list;
++		unsigned int num_modes;
++
++		get_mode_table(fse->code, &mode_list, &num_modes);
++
++		if (fse->index >= num_modes)
++			return -EINVAL;
++
++		if (fse->code != imx477_get_format_code(imx477, fse->code))
++			return -EINVAL;
++
++		fse->min_width = mode_list[fse->index].width;
++		fse->max_width = fse->min_width;
++		fse->min_height = mode_list[fse->index].height;
++		fse->max_height = fse->min_height;
++	} else {
++		if (fse->code != MEDIA_BUS_FMT_SENSOR_DATA || fse->index > 0)
++			return -EINVAL;
++
++		fse->min_width = IMX477_EMBEDDED_LINE_WIDTH;
++		fse->max_width = fse->min_width;
++		fse->min_height = IMX477_NUM_EMBEDDED_LINES;
++		fse->max_height = fse->min_height;
++	}
++
++	return 0;
++}
++
++static void imx477_reset_colorspace(struct v4l2_mbus_framefmt *fmt)
++{
++	fmt->colorspace = V4L2_COLORSPACE_RAW;
++	fmt->ycbcr_enc = V4L2_MAP_YCBCR_ENC_DEFAULT(fmt->colorspace);
++	fmt->quantization = V4L2_MAP_QUANTIZATION_DEFAULT(true,
++							  fmt->colorspace,
++							  fmt->ycbcr_enc);
++	fmt->xfer_func = V4L2_MAP_XFER_FUNC_DEFAULT(fmt->colorspace);
++}
++
++static void imx477_update_image_pad_format(struct imx477 *imx477,
++					   const struct imx477_mode *mode,
++					   struct v4l2_subdev_format *fmt)
++{
++	fmt->format.width = mode->width;
++	fmt->format.height = mode->height;
++	fmt->format.field = V4L2_FIELD_NONE;
++	imx477_reset_colorspace(&fmt->format);
++}
++
++static void imx477_update_metadata_pad_format(struct v4l2_subdev_format *fmt)
++{
++	fmt->format.width = IMX477_EMBEDDED_LINE_WIDTH;
++	fmt->format.height = IMX477_NUM_EMBEDDED_LINES;
++	fmt->format.code = MEDIA_BUS_FMT_SENSOR_DATA;
++	fmt->format.field = V4L2_FIELD_NONE;
++}
++
++static int imx477_get_pad_format(struct v4l2_subdev *sd,
++				 struct v4l2_subdev_state *sd_state,
++				 struct v4l2_subdev_format *fmt)
++{
++	struct imx477 *imx477 = to_imx477(sd);
++
++	if (fmt->pad >= NUM_PADS)
++		return -EINVAL;
++
++	mutex_lock(&imx477->mutex);
++
++	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++		struct v4l2_mbus_framefmt *try_fmt =
++			v4l2_subdev_state_get_format(sd_state,
++						   fmt->pad);
++		/* update the code which could change due to vflip or hflip: */
++		try_fmt->code = fmt->pad == IMAGE_PAD ?
++				imx477_get_format_code(imx477, try_fmt->code) :
++				MEDIA_BUS_FMT_SENSOR_DATA;
++		fmt->format = *try_fmt;
++	} else {
++		if (fmt->pad == IMAGE_PAD) {
++			imx477_update_image_pad_format(imx477, imx477->mode,
++						       fmt);
++			fmt->format.code =
++			       imx477_get_format_code(imx477, imx477->fmt_code);
++		} else {
++			imx477_update_metadata_pad_format(fmt);
++		}
++	}
++
++	mutex_unlock(&imx477->mutex);
++	return 0;
++}
++
++static
++unsigned int imx477_get_frame_length(const struct imx477_mode *mode,
++				     const struct v4l2_fract *timeperframe)
++{
++	u64 frame_length;
++
++	frame_length = (u64)timeperframe->numerator * IMX477_PIXEL_RATE;
++	do_div(frame_length,
++	       (u64)timeperframe->denominator * mode->line_length_pix);
++
++	if (WARN_ON(frame_length > IMX477_FRAME_LENGTH_MAX))
++		frame_length = IMX477_FRAME_LENGTH_MAX;
++
++	return max_t(unsigned int, frame_length, mode->height);
++}
++
++static void imx477_set_framing_limits(struct imx477 *imx477)
++{
++	unsigned int frm_length_min, frm_length_default, hblank_min;
++	const struct imx477_mode *mode = imx477->mode;
++
++	frm_length_min = imx477_get_frame_length(mode, &mode->timeperframe_min);
++	frm_length_default =
++		     imx477_get_frame_length(mode, &mode->timeperframe_default);
++
++	/* Default to no long exposure multiplier. */
++	imx477->long_exp_shift = 0;
++
++	/* Update limits and set FPS to default */
++	__v4l2_ctrl_modify_range(imx477->vblank, frm_length_min - mode->height,
++				 ((1 << IMX477_LONG_EXP_SHIFT_MAX) *
++					IMX477_FRAME_LENGTH_MAX) - mode->height,
++				 1, frm_length_default - mode->height);
++
++	/* Setting this will adjust the exposure limits as well. */
++	__v4l2_ctrl_s_ctrl(imx477->vblank, frm_length_default - mode->height);
++
++	hblank_min = mode->line_length_pix - mode->width;
++	__v4l2_ctrl_modify_range(imx477->hblank, hblank_min,
++				 IMX477_LINE_LENGTH_MAX, 1, hblank_min);
++	__v4l2_ctrl_s_ctrl(imx477->hblank, hblank_min);
++}
++
++static int imx477_set_pad_format(struct v4l2_subdev *sd,
++				 struct v4l2_subdev_state *sd_state,
++				 struct v4l2_subdev_format *fmt)
++{
++	struct v4l2_mbus_framefmt *framefmt;
++	const struct imx477_mode *mode;
++	struct imx477 *imx477 = to_imx477(sd);
++
++	if (fmt->pad >= NUM_PADS)
++		return -EINVAL;
++
++	mutex_lock(&imx477->mutex);
++
++	if (fmt->pad == IMAGE_PAD) {
++		const struct imx477_mode *mode_list;
++		unsigned int num_modes;
++
++		/* Bayer order varies with flips */
++		fmt->format.code = imx477_get_format_code(imx477,
++							  fmt->format.code);
++
++		get_mode_table(fmt->format.code, &mode_list, &num_modes);
++
++		mode = v4l2_find_nearest_size(mode_list,
++					      num_modes,
++					      width, height,
++					      fmt->format.width,
++					      fmt->format.height);
++		imx477_update_image_pad_format(imx477, mode, fmt);
++		if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++			framefmt = v4l2_subdev_state_get_format(sd_state,
++							      fmt->pad);
++			*framefmt = fmt->format;
++		} else if (imx477->mode != mode) {
++			imx477->mode = mode;
++			imx477->fmt_code = fmt->format.code;
++			imx477_set_framing_limits(imx477);
++		}
++	} else {
++		if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++			framefmt = v4l2_subdev_state_get_format(sd_state,
++							      fmt->pad);
++			*framefmt = fmt->format;
++		} else {
++			/* Only one embedded data mode is supported */
++			imx477_update_metadata_pad_format(fmt);
++		}
++	}
++
++	mutex_unlock(&imx477->mutex);
++
++	return 0;
++}
++
++static const struct v4l2_rect *
++__imx477_get_pad_crop(struct imx477 *imx477,
++		      struct v4l2_subdev_state *sd_state,
++		      unsigned int pad, enum v4l2_subdev_format_whence which)
++{
++	switch (which) {
++	case V4L2_SUBDEV_FORMAT_TRY:
++		return v4l2_subdev_state_get_crop(sd_state, pad);
++	case V4L2_SUBDEV_FORMAT_ACTIVE:
++		return &imx477->mode->crop;
++	}
++
++	return NULL;
++}
++
++static int imx477_get_selection(struct v4l2_subdev *sd,
++				struct v4l2_subdev_state *sd_state,
++				struct v4l2_subdev_selection *sel)
++{
++	switch (sel->target) {
++	case V4L2_SEL_TGT_CROP: {
++		struct imx477 *imx477 = to_imx477(sd);
++
++		mutex_lock(&imx477->mutex);
++		sel->r = *__imx477_get_pad_crop(imx477, sd_state, sel->pad,
++						sel->which);
++		mutex_unlock(&imx477->mutex);
++
++		return 0;
++	}
++
++	case V4L2_SEL_TGT_NATIVE_SIZE:
++		sel->r.left = 0;
++		sel->r.top = 0;
++		sel->r.width = IMX477_NATIVE_WIDTH;
++		sel->r.height = IMX477_NATIVE_HEIGHT;
++
++		return 0;
++
++	case V4L2_SEL_TGT_CROP_DEFAULT:
++	case V4L2_SEL_TGT_CROP_BOUNDS:
++		sel->r.left = IMX477_PIXEL_ARRAY_LEFT;
++		sel->r.top = IMX477_PIXEL_ARRAY_TOP;
++		sel->r.width = IMX477_PIXEL_ARRAY_WIDTH;
++		sel->r.height = IMX477_PIXEL_ARRAY_HEIGHT;
++
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++/* Start streaming */
++static int imx477_start_streaming(struct imx477 *imx477)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx477->sd);
++	const struct imx477_reg_list *reg_list;
++	const struct imx477_reg_list *extra_regs;
++	int ret, tm;
++
++	if (!imx477->common_regs_written) {
++		ret = imx477_write_regs(imx477, mode_common_regs,
++					ARRAY_SIZE(mode_common_regs));
++		if (!ret) {
++			extra_regs = &imx477->compatible_data->extra_regs;
++			ret = imx477_write_regs(imx477,	extra_regs->regs,
++						extra_regs->num_of_regs);
++		}
++
++		if (ret) {
++			dev_err(&client->dev, "%s failed to set common settings\n",
++				__func__);
++			return ret;
++		}
++		imx477->common_regs_written = true;
++	}
++
++	/* Apply default values of current mode */
++	reg_list = &imx477->mode->reg_list;
++	ret = imx477_write_regs(imx477, reg_list->regs, reg_list->num_of_regs);
++	if (ret) {
++		dev_err(&client->dev, "%s failed to set mode\n", __func__);
++		return ret;
++	}
++
++	/* Set on-sensor DPC. */
++	imx477_write_reg(imx477, 0x0b05, IMX477_REG_VALUE_08BIT, !!dpc_enable);
++	imx477_write_reg(imx477, 0x0b06, IMX477_REG_VALUE_08BIT, !!dpc_enable);
++
++	/* Apply customized values from user */
++	ret =  __v4l2_ctrl_handler_setup(imx477->sd.ctrl_handler);
++	if (ret)
++		return ret;
++
++	/* Set vsync trigger mode: 0=standalone, 1=source, 2=sink */
++	tm = (imx477->trigger_mode_of >= 0) ? imx477->trigger_mode_of : trigger_mode;
++	imx477_write_reg(imx477, IMX477_REG_MC_MODE,
++			 IMX477_REG_VALUE_08BIT, (tm > 0) ? 1 : 0);
++	imx477_write_reg(imx477, IMX477_REG_MS_SEL,
++			 IMX477_REG_VALUE_08BIT, (tm <= 1) ? 1 : 0);
++	imx477_write_reg(imx477, IMX477_REG_XVS_IO_CTRL,
++			 IMX477_REG_VALUE_08BIT, (tm == 1) ? 1 : 0);
++	imx477_write_reg(imx477, IMX477_REG_EXTOUT_EN,
++			 IMX477_REG_VALUE_08BIT, (tm == 1) ? 1 : 0);
++
++	/* set stream on register */
++	return imx477_write_reg(imx477, IMX477_REG_MODE_SELECT,
++				IMX477_REG_VALUE_08BIT, IMX477_MODE_STREAMING);
++}
++
++/* Stop streaming */
++static void imx477_stop_streaming(struct imx477 *imx477)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx477->sd);
++	int ret;
++
++	/* set stream off register */
++	ret = imx477_write_reg(imx477, IMX477_REG_MODE_SELECT,
++			       IMX477_REG_VALUE_08BIT, IMX477_MODE_STANDBY);
++	if (ret)
++		dev_err(&client->dev, "%s failed to set stream\n", __func__);
++
++	/* Stop driving XVS out (there is still a weak pull-up) */
++	imx477_write_reg(imx477, IMX477_REG_EXTOUT_EN,
++			 IMX477_REG_VALUE_08BIT, 0);
++}
++
++static int imx477_set_stream(struct v4l2_subdev *sd, int enable)
++{
++	struct imx477 *imx477 = to_imx477(sd);
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++	int ret = 0;
++
++	mutex_lock(&imx477->mutex);
++	if (imx477->streaming == enable) {
++		mutex_unlock(&imx477->mutex);
++		return 0;
++	}
++
++	if (enable) {
++		ret = pm_runtime_get_sync(&client->dev);
++		if (ret < 0) {
++			pm_runtime_put_noidle(&client->dev);
++			goto err_unlock;
++		}
++
++		/*
++		 * Apply default & customized values
++		 * and then start streaming.
++		 */
++		ret = imx477_start_streaming(imx477);
++		if (ret)
++			goto err_rpm_put;
++	} else {
++		imx477_stop_streaming(imx477);
++		pm_runtime_put(&client->dev);
++	}
++
++	imx477->streaming = enable;
++
++	/* vflip and hflip cannot change during streaming */
++	__v4l2_ctrl_grab(imx477->vflip, enable);
++	__v4l2_ctrl_grab(imx477->hflip, enable);
++
++	mutex_unlock(&imx477->mutex);
++
++	return ret;
++
++err_rpm_put:
++	pm_runtime_put(&client->dev);
++err_unlock:
++	mutex_unlock(&imx477->mutex);
++
++	return ret;
++}
++
++/* Power/clock management functions */
++static int imx477_power_on(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx477 *imx477 = to_imx477(sd);
++	int ret;
++
++	ret = regulator_bulk_enable(IMX477_NUM_SUPPLIES,
++				    imx477->supplies);
++	if (ret) {
++		dev_err(&client->dev, "%s: failed to enable regulators\n",
++			__func__);
++		return ret;
++	}
++
++	ret = clk_prepare_enable(imx477->xclk);
++	if (ret) {
++		dev_err(&client->dev, "%s: failed to enable clock\n",
++			__func__);
++		goto reg_off;
++	}
++
++	gpiod_set_value_cansleep(imx477->reset_gpio, 1);
++	usleep_range(IMX477_XCLR_MIN_DELAY_US,
++		     IMX477_XCLR_MIN_DELAY_US + IMX477_XCLR_DELAY_RANGE_US);
++
++	return 0;
++
++reg_off:
++	regulator_bulk_disable(IMX477_NUM_SUPPLIES, imx477->supplies);
++	return ret;
++}
++
++static int imx477_power_off(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx477 *imx477 = to_imx477(sd);
++
++	gpiod_set_value_cansleep(imx477->reset_gpio, 0);
++	regulator_bulk_disable(IMX477_NUM_SUPPLIES, imx477->supplies);
++	clk_disable_unprepare(imx477->xclk);
++
++	/* Force reprogramming of the common registers when powered up again. */
++	imx477->common_regs_written = false;
++
++	return 0;
++}
++
++static int __maybe_unused imx477_suspend(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx477 *imx477 = to_imx477(sd);
++
++	if (imx477->streaming)
++		imx477_stop_streaming(imx477);
++
++	return 0;
++}
++
++static int __maybe_unused imx477_resume(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx477 *imx477 = to_imx477(sd);
++	int ret;
++
++	if (imx477->streaming) {
++		ret = imx477_start_streaming(imx477);
++		if (ret)
++			goto error;
++	}
++
++	return 0;
++
++error:
++	imx477_stop_streaming(imx477);
++	imx477->streaming = 0;
++	return ret;
++}
++
++static int imx477_get_regulators(struct imx477 *imx477)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx477->sd);
++	unsigned int i;
++
++	for (i = 0; i < IMX477_NUM_SUPPLIES; i++)
++		imx477->supplies[i].supply = imx477_supply_name[i];
++
++	return devm_regulator_bulk_get(&client->dev,
++				       IMX477_NUM_SUPPLIES,
++				       imx477->supplies);
++}
++
++/* Verify chip ID */
++static int imx477_identify_module(struct imx477 *imx477, u32 expected_id)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx477->sd);
++	int ret;
++	u32 val;
++
++	ret = imx477_read_reg(imx477, IMX477_REG_CHIP_ID,
++			      IMX477_REG_VALUE_16BIT, &val);
++	if (ret) {
++		dev_err(&client->dev, "failed to read chip id %x, with error %d\n",
++			expected_id, ret);
++		return ret;
++	}
++
++	if (val != expected_id) {
++		dev_err(&client->dev, "chip id mismatch: %x!=%x\n",
++			expected_id, val);
++		return -EIO;
++	}
++
++	dev_info(&client->dev, "Device found is imx%x\n", val);
++
++	return 0;
++}
++
++static const struct v4l2_subdev_core_ops imx477_core_ops = {
++	.subscribe_event = v4l2_ctrl_subdev_subscribe_event,
++	.unsubscribe_event = v4l2_event_subdev_unsubscribe,
++};
++
++static const struct v4l2_subdev_video_ops imx477_video_ops = {
++	.s_stream = imx477_set_stream,
++};
++
++static const struct v4l2_subdev_pad_ops imx477_pad_ops = {
++	.enum_mbus_code = imx477_enum_mbus_code,
++	.get_fmt = imx477_get_pad_format,
++	.set_fmt = imx477_set_pad_format,
++	.get_selection = imx477_get_selection,
++	.enum_frame_size = imx477_enum_frame_size,
++};
++
++static const struct v4l2_subdev_ops imx477_subdev_ops = {
++	.core = &imx477_core_ops,
++	.video = &imx477_video_ops,
++	.pad = &imx477_pad_ops,
++};
++
++static const struct v4l2_subdev_internal_ops imx477_internal_ops = {
++	.open = imx477_open,
++};
++
++/* Initialize control handlers */
++static int imx477_init_controls(struct imx477 *imx477)
++{
++	struct v4l2_ctrl_handler *ctrl_hdlr;
++	struct i2c_client *client = v4l2_get_subdevdata(&imx477->sd);
++	struct v4l2_fwnode_device_properties props;
++	unsigned int i;
++	int ret;
++
++	ctrl_hdlr = &imx477->ctrl_handler;
++	ret = v4l2_ctrl_handler_init(ctrl_hdlr, 16);
++	if (ret)
++		return ret;
++
++	mutex_init(&imx477->mutex);
++	ctrl_hdlr->lock = &imx477->mutex;
++
++	/* By default, PIXEL_RATE is read only */
++	imx477->pixel_rate = v4l2_ctrl_new_std(ctrl_hdlr, &imx477_ctrl_ops,
++					       V4L2_CID_PIXEL_RATE,
++					       IMX477_PIXEL_RATE,
++					       IMX477_PIXEL_RATE, 1,
++					       IMX477_PIXEL_RATE);
++	if (imx477->pixel_rate)
++		imx477->pixel_rate->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++
++	/* LINK_FREQ is also read only */
++	imx477->link_freq =
++		v4l2_ctrl_new_int_menu(ctrl_hdlr, &imx477_ctrl_ops,
++				       V4L2_CID_LINK_FREQ,
++				       ARRAY_SIZE(imx477_link_freq_menu) - 1, 0,
++				       imx477_link_freq_menu);
++	if (imx477->link_freq)
++		imx477->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++
++	/*
++	 * Create the controls here, but mode specific limits are setup
++	 * in the imx477_set_framing_limits() call below.
++	 */
++	imx477->vblank = v4l2_ctrl_new_std(ctrl_hdlr, &imx477_ctrl_ops,
++					   V4L2_CID_VBLANK, 0, 0xffff, 1, 0);
++	imx477->hblank = v4l2_ctrl_new_std(ctrl_hdlr, &imx477_ctrl_ops,
++					   V4L2_CID_HBLANK, 0, 0xffff, 1, 0);
++
++	imx477->exposure = v4l2_ctrl_new_std(ctrl_hdlr, &imx477_ctrl_ops,
++					     V4L2_CID_EXPOSURE,
++					     IMX477_EXPOSURE_MIN,
++					     IMX477_EXPOSURE_MAX,
++					     IMX477_EXPOSURE_STEP,
++					     IMX477_EXPOSURE_DEFAULT);
++
++	v4l2_ctrl_new_std(ctrl_hdlr, &imx477_ctrl_ops, V4L2_CID_ANALOGUE_GAIN,
++			  IMX477_ANA_GAIN_MIN, IMX477_ANA_GAIN_MAX,
++			  IMX477_ANA_GAIN_STEP, IMX477_ANA_GAIN_DEFAULT);
++
++	v4l2_ctrl_new_std(ctrl_hdlr, &imx477_ctrl_ops, V4L2_CID_DIGITAL_GAIN,
++			  IMX477_DGTL_GAIN_MIN, IMX477_DGTL_GAIN_MAX,
++			  IMX477_DGTL_GAIN_STEP, IMX477_DGTL_GAIN_DEFAULT);
++
++	imx477->hflip = v4l2_ctrl_new_std(ctrl_hdlr, &imx477_ctrl_ops,
++					  V4L2_CID_HFLIP, 0, 1, 1, 0);
++	if (imx477->hflip)
++		imx477->hflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++
++	imx477->vflip = v4l2_ctrl_new_std(ctrl_hdlr, &imx477_ctrl_ops,
++					  V4L2_CID_VFLIP, 0, 1, 1, 0);
++	if (imx477->vflip)
++		imx477->vflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++
++	v4l2_ctrl_new_std_menu_items(ctrl_hdlr, &imx477_ctrl_ops,
++				     V4L2_CID_TEST_PATTERN,
++				     ARRAY_SIZE(imx477_test_pattern_menu) - 1,
++				     0, 0, imx477_test_pattern_menu);
++	for (i = 0; i < 4; i++) {
++		/*
++		 * The assumption is that
++		 * V4L2_CID_TEST_PATTERN_GREENR == V4L2_CID_TEST_PATTERN_RED + 1
++		 * V4L2_CID_TEST_PATTERN_BLUE   == V4L2_CID_TEST_PATTERN_RED + 2
++		 * V4L2_CID_TEST_PATTERN_GREENB == V4L2_CID_TEST_PATTERN_RED + 3
++		 */
++		v4l2_ctrl_new_std(ctrl_hdlr, &imx477_ctrl_ops,
++				  V4L2_CID_TEST_PATTERN_RED + i,
++				  IMX477_TEST_PATTERN_COLOUR_MIN,
++				  IMX477_TEST_PATTERN_COLOUR_MAX,
++				  IMX477_TEST_PATTERN_COLOUR_STEP,
++				  IMX477_TEST_PATTERN_COLOUR_MAX);
++		/* The "Solid color" pattern is white by default */
++	}
++
++	if (ctrl_hdlr->error) {
++		ret = ctrl_hdlr->error;
++		dev_err(&client->dev, "%s control init failed (%d)\n",
++			__func__, ret);
++		goto error;
++	}
++
++	ret = v4l2_fwnode_device_parse(&client->dev, &props);
++	if (ret)
++		goto error;
++
++	ret = v4l2_ctrl_new_fwnode_properties(ctrl_hdlr, &imx477_ctrl_ops,
++					      &props);
++	if (ret)
++		goto error;
++
++	imx477->sd.ctrl_handler = ctrl_hdlr;
++
++	mutex_lock(&imx477->mutex);
++
++	/* Setup exposure and frame/line length limits. */
++	imx477_set_framing_limits(imx477);
++
++	mutex_unlock(&imx477->mutex);
++
++	return 0;
++
++error:
++	v4l2_ctrl_handler_free(ctrl_hdlr);
++	mutex_destroy(&imx477->mutex);
++
++	return ret;
++}
++
++static void imx477_free_controls(struct imx477 *imx477)
++{
++	v4l2_ctrl_handler_free(imx477->sd.ctrl_handler);
++	mutex_destroy(&imx477->mutex);
++}
++
++static int imx477_check_hwcfg(struct device *dev)
++{
++	struct fwnode_handle *endpoint;
++	struct v4l2_fwnode_endpoint ep_cfg = {
++		.bus_type = V4L2_MBUS_CSI2_DPHY
++	};
++	int ret = -EINVAL;
++
++	endpoint = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
++	if (!endpoint) {
++		dev_err(dev, "endpoint node not found\n");
++		return -EINVAL;
++	}
++
++	if (v4l2_fwnode_endpoint_alloc_parse(endpoint, &ep_cfg)) {
++		dev_err(dev, "could not parse endpoint\n");
++		goto error_out;
++	}
++
++	/* Check the number of MIPI CSI2 data lanes */
++	if (ep_cfg.bus.mipi_csi2.num_data_lanes != 2) {
++		dev_err(dev, "only 2 data lanes are currently supported\n");
++		goto error_out;
++	}
++
++	/* Check the link frequency set in device tree */
++	if (!ep_cfg.nr_of_link_frequencies) {
++		dev_err(dev, "link-frequency property not found in DT\n");
++		goto error_out;
++	}
++
++	if (ep_cfg.nr_of_link_frequencies != 1 ||
++	    ep_cfg.link_frequencies[0] != IMX477_DEFAULT_LINK_FREQ) {
++		dev_err(dev, "Link frequency not supported: %lld\n",
++			ep_cfg.link_frequencies[0]);
++		goto error_out;
++	}
++
++	ret = 0;
++
++error_out:
++	v4l2_fwnode_endpoint_free(&ep_cfg);
++	fwnode_handle_put(endpoint);
++
++	return ret;
++}
++
++static const struct imx477_compatible_data imx477_compatible = {
++	.chip_id = IMX477_CHIP_ID,
++	.extra_regs = {
++		.num_of_regs = 0,
++		.regs = NULL
++	}
++};
++
++static const struct imx477_reg imx378_regs[] = {
++	{0x3e35, 0x01},
++	{0x4421, 0x08},
++	{0x3ff9, 0x00},
++};
++
++static const struct imx477_compatible_data imx378_compatible = {
++	.chip_id = IMX378_CHIP_ID,
++	.extra_regs = {
++		.num_of_regs = ARRAY_SIZE(imx378_regs),
++		.regs = imx378_regs
++	}
++};
++
++static const struct of_device_id imx477_dt_ids[] = {
++	{ .compatible = "sony,imx477", .data = &imx477_compatible },
++	{ .compatible = "sony,imx378", .data = &imx378_compatible },
++	{ /* sentinel */ }
++};
++
++static int imx477_probe(struct i2c_client *client)
++{
++	struct device *dev = &client->dev;
++	struct imx477 *imx477;
++	const struct of_device_id *match;
++	int ret;
++	u32 tm_of;
++
++	imx477 = devm_kzalloc(&client->dev, sizeof(*imx477), GFP_KERNEL);
++	if (!imx477)
++		return -ENOMEM;
++
++	v4l2_i2c_subdev_init(&imx477->sd, client, &imx477_subdev_ops);
++
++	match = of_match_device(imx477_dt_ids, dev);
++	if (!match)
++		return -ENODEV;
++	imx477->compatible_data =
++		(const struct imx477_compatible_data *)match->data;
++
++	/* Check the hardware configuration in device tree */
++	if (imx477_check_hwcfg(dev))
++		return -EINVAL;
++
++	/* Default the trigger mode from OF to -1, which means invalid */
++	ret = of_property_read_u32(dev->of_node, "trigger-mode", &tm_of);
++	imx477->trigger_mode_of = (ret == 0) ? tm_of : -1;
++
++	/* Get system clock (xclk) */
++	imx477->xclk = devm_clk_get(dev, NULL);
++	if (IS_ERR(imx477->xclk)) {
++		dev_err(dev, "failed to get xclk\n");
++		return PTR_ERR(imx477->xclk);
++	}
++
++	imx477->xclk_freq = clk_get_rate(imx477->xclk);
++	if (imx477->xclk_freq != IMX477_XCLK_FREQ) {
++		dev_err(dev, "xclk frequency not supported: %d Hz\n",
++			imx477->xclk_freq);
++		return -EINVAL;
++	}
++
++	ret = imx477_get_regulators(imx477);
++	if (ret) {
++		dev_err(dev, "failed to get regulators\n");
++		return ret;
++	}
++
++	/* Request optional enable pin */
++	imx477->reset_gpio = devm_gpiod_get_optional(dev, "reset",
++						     GPIOD_OUT_HIGH);
++
++	/*
++	 * The sensor must be powered for imx477_identify_module()
++	 * to be able to read the CHIP_ID register
++	 */
++	ret = imx477_power_on(dev);
++	if (ret)
++		return ret;
++
++	ret = imx477_identify_module(imx477, imx477->compatible_data->chip_id);
++	if (ret)
++		goto error_power_off;
++
++	/* Initialize default format */
++	imx477_set_default_format(imx477);
++
++	/* Enable runtime PM and turn off the device */
++	pm_runtime_set_active(dev);
++	pm_runtime_enable(dev);
++	pm_runtime_idle(dev);
++
++	/* This needs the pm runtime to be registered. */
++	ret = imx477_init_controls(imx477);
++	if (ret)
++		goto error_power_off;
++
++	/* Initialize subdev */
++	imx477->sd.internal_ops = &imx477_internal_ops;
++	imx477->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE |
++			    V4L2_SUBDEV_FL_HAS_EVENTS;
++	imx477->sd.entity.function = MEDIA_ENT_F_CAM_SENSOR;
++
++	/* Initialize source pads */
++	imx477->pad[IMAGE_PAD].flags = MEDIA_PAD_FL_SOURCE;
++	imx477->pad[METADATA_PAD].flags = MEDIA_PAD_FL_SOURCE;
++
++	ret = media_entity_pads_init(&imx477->sd.entity, NUM_PADS, imx477->pad);
++	if (ret) {
++		dev_err(dev, "failed to init entity pads: %d\n", ret);
++		goto error_handler_free;
++	}
++
++	ret = v4l2_async_register_subdev_sensor(&imx477->sd);
++	if (ret < 0) {
++		dev_err(dev, "failed to register sensor sub-device: %d\n", ret);
++		goto error_media_entity;
++	}
++
++	return 0;
++
++error_media_entity:
++	media_entity_cleanup(&imx477->sd.entity);
++
++error_handler_free:
++	imx477_free_controls(imx477);
++
++error_power_off:
++	pm_runtime_disable(&client->dev);
++	pm_runtime_set_suspended(&client->dev);
++	imx477_power_off(&client->dev);
++
++	return ret;
++}
++
++static void imx477_remove(struct i2c_client *client)
++{
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx477 *imx477 = to_imx477(sd);
++
++	v4l2_async_unregister_subdev(sd);
++	media_entity_cleanup(&sd->entity);
++	imx477_free_controls(imx477);
++
++	pm_runtime_disable(&client->dev);
++	if (!pm_runtime_status_suspended(&client->dev))
++		imx477_power_off(&client->dev);
++	pm_runtime_set_suspended(&client->dev);
++}
++
++MODULE_DEVICE_TABLE(of, imx477_dt_ids);
++
++static const struct dev_pm_ops imx477_pm_ops = {
++	SET_SYSTEM_SLEEP_PM_OPS(imx477_suspend, imx477_resume)
++	SET_RUNTIME_PM_OPS(imx477_power_off, imx477_power_on, NULL)
++};
++
++static struct i2c_driver imx477_i2c_driver = {
++	.driver = {
++		.name = "imx477",
++		.of_match_table	= imx477_dt_ids,
++		.pm = &imx477_pm_ops,
++	},
++	.probe = imx477_probe,
++	.remove = imx477_remove,
++};
++
++module_i2c_driver(imx477_i2c_driver);
++
++MODULE_AUTHOR("Naushir Patuck <naush@raspberrypi.com>");
++MODULE_DESCRIPTION("Sony IMX477 sensor driver");
++MODULE_LICENSE("GPL v2");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0137-media-i2c-imx519-Support-for-the-Sony-IMX519-sensor.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0137-media-i2c-imx519-Support-for-the-Sony-IMX519-sensor.patch
new file mode 100644
index 00000000..866eb08a
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0137-media-i2c-imx519-Support-for-the-Sony-IMX519-sensor.patch
@@ -0,0 +1,2390 @@
+From 5372030fc09b9019e32ef60abeb93592fee62b7e Mon Sep 17 00:00:00 2001
+From: Lee Jackson <info@arducam.com>
+Date: Fri, 27 Aug 2021 14:36:55 +0800
+Subject: [PATCH 137/697] media: i2c: imx519: Support for the Sony IMX519
+ sensor
+
+dt-bindings: media: i2c: Add IMX519 CMOS sensor binding
+
+Add YAML device tree binding for IMX519 CMOS image sensor, and
+the relevant MAINTAINERS entries.
+
+Signed-off-by: Lee Jackson <info@arducam.com>
+
+media: i2c: Add driver for IMX519 sensor
+
+Adds a driver for the 16MPix IMX519 CSI2 sensor.
+Whilst the sensor supports 2 or 4 CSI2 data lanes, this driver
+currently only supports 2 lanes.
+
+The following Bayer modes are currently available:
+
+4656x3496 10-bit @ 10fps
+3840x2160 10-bit (cropped) @ 21fps
+2328x1748 10-bit (binned) @ 30fps
+1920x1080 10-bit (cropped/binned) @ 60fps
+1280x720 10-bit (cropped/binned) @ 120fps
+
+Signed-off-by: Lee Jackson <info@arducam.com>
+
+media: i2c: imx519: Advertise embedded data node on media pad 1
+
+This commit updates the imx519 driver to adverise support for embedded
+data streams.
+
+The imx519 sensor subdevice overloads the media pad to differentiate
+between image stream (pad 0) and embedded data stream (pad 1) when
+performing the v4l2_subdev_pad_ops functions.
+
+Signed-off-by: Lee Jackson <info@arducam.com>
+
+media: i2c: imx519: Sensor should report RAW color space
+
+Tested on Raspberry Pi running libcamera.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+media: i2c: Update imx519 Kconfig entry
+
+Bring the IMX519 Kconfig declaration in line with the upstream entries.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+media: i2c: Add PDAF support for IMX519
+
+Add PDAF support for IMX519, and reduce the pixel rate to 426666667,
+link freq to 408000000.
+
+Signed-off-by: Lee Jackson <lee.jackson@arducam.com>
+
+drivers: media: imx519: Add V4L2_CID_LINK_FREQ control
+
+Add V4L2_CID_LINK_FREQ as a read-only control with a value of 408 Mhz.
+This will be used by the CFE driver to corretly setup the DPHY timing
+parameters in the CSI-2 block.
+
+Signed-off-by: Lee Jackson <lee.jackson@arducam.com>
+
+media: i2c: imx519: Squash fixes
+---
+ .../devicetree/bindings/media/i2c/imx519.yaml |  113 +
+ MAINTAINERS                                   |    8 +
+ drivers/media/i2c/Kconfig                     |   11 +
+ drivers/media/i2c/Makefile                    |    1 +
+ drivers/media/i2c/imx519.c                    | 2146 +++++++++++++++++
+ 5 files changed, 2279 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/media/i2c/imx519.yaml
+ create mode 100644 drivers/media/i2c/imx519.c
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/i2c/imx519.yaml
+@@ -0,0 +1,113 @@
++# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/media/i2c/imx519.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Sony 1/2.5-Inch 16Mpixel CMOS Digital Image Sensor
++
++maintainers:
++  - Lee Jackson <info@arducam.com>
++
++description: |-
++  The Sony IMX519 is a 1/2.5-inch CMOS active pixel digital image sensor
++  with an active array size of 4656H x 3496V. It is programmable through
++  I2C interface. The I2C address is fixed to 0x1A as per sensor data sheet.
++  Image data is sent through MIPI CSI-2, which is configured as either 2 or
++  4 data lanes.
++
++properties:
++  compatible:
++    const: sony,imx519
++
++  reg:
++    description: I2C device address
++    maxItems: 1
++
++  clocks:
++    maxItems: 1
++
++  VDIG-supply:
++    description:
++      Digital I/O voltage supply, 1.05 volts
++
++  VANA-supply:
++    description:
++      Analog voltage supply, 2.8 volts
++
++  VDDL-supply:
++    description:
++      Digital core voltage supply, 1.8 volts
++
++  reset-gpios:
++    description: |-
++      Reference to the GPIO connected to the xclr pin, if any.
++      Must be released (set high) after all supplies and INCK are applied.
++
++  # See ../video-interfaces.txt for more details
++  port:
++    type: object
++    properties:
++      endpoint:
++        type: object
++        properties:
++          data-lanes:
++            description: |-
++              The sensor supports either two-lane, or four-lane operation.
++              For two-lane operation the property must be set to <1 2>.
++            items:
++              - const: 1
++              - const: 2
++
++          clock-noncontinuous:
++            type: boolean
++            description: |-
++              MIPI CSI-2 clock is non-continuous if this property is present,
++              otherwise it's continuous.
++
++          link-frequencies:
++            allOf:
++              - $ref: /schemas/types.yaml#/definitions/uint64-array
++            description:
++              Allowed data bus frequencies.
++
++        required:
++          - link-frequencies
++
++required:
++  - compatible
++  - reg
++  - clocks
++  - VANA-supply
++  - VDIG-supply
++  - VDDL-supply
++  - port
++
++additionalProperties: false
++
++examples:
++  - |
++    i2c0 {
++        #address-cells = <1>;
++        #size-cells = <0>;
++
++        imx519: sensor@1a {
++            compatible = "sony,imx519";
++            reg = <0x1a>;
++            clocks = <&imx519_clk>;
++            VANA-supply = <&imx519_vana>;   /* 2.8v */
++            VDIG-supply = <&imx519_vdig>;   /* 1.05v */
++            VDDL-supply = <&imx519_vddl>;   /* 1.8v */
++
++            port {
++                imx519_0: endpoint {
++                    remote-endpoint = <&csi1_ep>;
++                    data-lanes = <1 2>;
++                    clock-noncontinuous;
++                    link-frequencies = /bits/ 64 <493500000>;
++                };
++            };
++        };
++    };
++
++...
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -21548,6 +21548,14 @@ T:	git git://linuxtv.org/media_tree.git
+ F:	Documentation/devicetree/bindings/media/i2c/imx477.yaml
+ F:	drivers/media/i2c/imx477.c
+ 
++SONY IMX519 SENSOR DRIVER
++M:	Arducam Kernel Maintenance <info@arducam.com>
++L:	linux-media@vger.kernel.org
++S:	Maintained
++T:	git git://linuxtv.org/media_tree.git
++F:	Documentation/devicetree/bindings/media/i2c/imx519.yaml
++F:	drivers/media/i2c/imx519.c
++
+ SONY MEMORYSTICK SUBSYSTEM
+ M:	Maxim Levitsky <maximlevitsky@gmail.com>
+ M:	Alex Dubov <oakad@yahoo.com>
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -264,6 +264,17 @@ config VIDEO_IMX415
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called imx415.
+ 
++config VIDEO_IMX519
++	tristate "Arducam IMX519 sensor support"
++	depends on I2C && VIDEO_DEV
++	select VIDEO_V4L2_SUBDEV_API
++	help
++	  This is a Video4Linux2 sensor driver for the Arducam
++	  IMX519 camera.
++
++	  To compile this driver as a module, choose M here: the
++	  module will be called IMX519.
++
+ config VIDEO_MAX9271_LIB
+ 	tristate
+ 
+--- a/drivers/media/i2c/Makefile
++++ b/drivers/media/i2c/Makefile
+@@ -60,6 +60,7 @@ obj-$(CONFIG_VIDEO_IMX355) += imx355.o
+ obj-$(CONFIG_VIDEO_IMX412) += imx412.o
+ obj-$(CONFIG_VIDEO_IMX415) += imx415.o
+ obj-$(CONFIG_VIDEO_IMX477) += imx477.o
++obj-$(CONFIG_VIDEO_IMX519) += imx519.o
+ obj-$(CONFIG_VIDEO_IR_I2C) += ir-kbd-i2c.o
+ obj-$(CONFIG_VIDEO_ISL7998X) += isl7998x.o
+ obj-$(CONFIG_VIDEO_KS0127) += ks0127.o
+--- /dev/null
++++ b/drivers/media/i2c/imx519.c
+@@ -0,0 +1,2146 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * A V4L2 driver for Sony IMX519 cameras.
++ * Copyright (C) 2021 Arducam Technology co., Ltd.
++ *
++ * Based on Sony IMX477 camera driver
++ * Copyright (C) 2020 Raspberry Pi (Trading) Ltd
++ */
++#include <linux/unaligned.h>
++#include <linux/clk.h>
++#include <linux/delay.h>
++#include <linux/gpio/consumer.h>
++#include <linux/i2c.h>
++#include <linux/module.h>
++#include <linux/of_device.h>
++#include <linux/pm_runtime.h>
++#include <linux/regulator/consumer.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-event.h>
++#include <media/v4l2-fwnode.h>
++#include <media/v4l2-mediabus.h>
++
++#define IMX519_REG_VALUE_08BIT		1
++#define IMX519_REG_VALUE_16BIT		2
++
++/* Chip ID */
++#define IMX519_REG_CHIP_ID		0x0016
++#define IMX519_CHIP_ID			0x0519
++
++#define IMX519_REG_MODE_SELECT		0x0100
++#define IMX519_MODE_STANDBY		0x00
++#define IMX519_MODE_STREAMING		0x01
++
++#define IMX519_REG_ORIENTATION		0x101
++
++#define IMX519_XCLK_FREQ		24000000
++
++#define IMX519_DEFAULT_LINK_FREQ	408000000
++
++/* Pixel rate is fixed at 426MHz for all the modes */
++#define IMX519_PIXEL_RATE		426666667
++
++/* V_TIMING internal */
++#define IMX519_REG_FRAME_LENGTH		0x0340
++#define IMX519_FRAME_LENGTH_MAX		0xffdc
++
++/* Long exposure multiplier */
++#define IMX519_LONG_EXP_SHIFT_MAX	7
++#define IMX519_LONG_EXP_SHIFT_REG	0x3100
++
++/* Exposure control */
++#define IMX519_REG_EXPOSURE		0x0202
++#define IMX519_EXPOSURE_OFFSET		32
++#define IMX519_EXPOSURE_MIN		20
++#define IMX519_EXPOSURE_STEP		1
++#define IMX519_EXPOSURE_DEFAULT		0x3e8
++#define IMX519_EXPOSURE_MAX		(IMX519_FRAME_LENGTH_MAX - \
++					 IMX519_EXPOSURE_OFFSET)
++
++/* Analog gain control */
++#define IMX519_REG_ANALOG_GAIN		0x0204
++#define IMX519_ANA_GAIN_MIN		0
++#define IMX519_ANA_GAIN_MAX		960
++#define IMX519_ANA_GAIN_STEP		1
++#define IMX519_ANA_GAIN_DEFAULT		0x0
++
++/* Digital gain control */
++#define IMX519_REG_DIGITAL_GAIN		0x020e
++#define IMX519_DGTL_GAIN_MIN		0x0100
++#define IMX519_DGTL_GAIN_MAX		0xffff
++#define IMX519_DGTL_GAIN_DEFAULT	0x0100
++#define IMX519_DGTL_GAIN_STEP		1
++
++/* Test Pattern Control */
++#define IMX519_REG_TEST_PATTERN		0x0600
++#define IMX519_TEST_PATTERN_DISABLE	0
++#define IMX519_TEST_PATTERN_SOLID_COLOR	1
++#define IMX519_TEST_PATTERN_COLOR_BARS	2
++#define IMX519_TEST_PATTERN_GREY_COLOR	3
++#define IMX519_TEST_PATTERN_PN9		4
++
++/* Test pattern colour components */
++#define IMX519_REG_TEST_PATTERN_R	0x0602
++#define IMX519_REG_TEST_PATTERN_GR	0x0604
++#define IMX519_REG_TEST_PATTERN_B	0x0606
++#define IMX519_REG_TEST_PATTERN_GB	0x0608
++#define IMX519_TEST_PATTERN_COLOUR_MIN	0
++#define IMX519_TEST_PATTERN_COLOUR_MAX	0x0fff
++#define IMX519_TEST_PATTERN_COLOUR_STEP	1
++#define IMX519_TEST_PATTERN_R_DEFAULT	IMX519_TEST_PATTERN_COLOUR_MAX
++#define IMX519_TEST_PATTERN_GR_DEFAULT	0
++#define IMX519_TEST_PATTERN_B_DEFAULT	0
++#define IMX519_TEST_PATTERN_GB_DEFAULT	0
++
++/* Embedded metadata stream structure */
++#define IMX519_EMBEDDED_LINE_WIDTH (5820 * 3)
++#define IMX519_NUM_EMBEDDED_LINES 1
++
++enum pad_types {
++	IMAGE_PAD,
++	METADATA_PAD,
++	NUM_PADS
++};
++
++/* IMX519 native and active pixel array size. */
++#define IMX519_NATIVE_WIDTH		4672U
++#define IMX519_NATIVE_HEIGHT		3648U
++#define IMX519_PIXEL_ARRAY_LEFT		8U
++#define IMX519_PIXEL_ARRAY_TOP		48U
++#define IMX519_PIXEL_ARRAY_WIDTH	4656U
++#define IMX519_PIXEL_ARRAY_HEIGHT	3496U
++
++struct imx519_reg {
++	u16 address;
++	u8 val;
++};
++
++struct imx519_reg_list {
++	unsigned int num_of_regs;
++	const struct imx519_reg *regs;
++};
++
++/* Mode : resolution and related config&values */
++struct imx519_mode {
++	/* Frame width */
++	unsigned int width;
++
++	/* Frame height */
++	unsigned int height;
++
++	/* H-timing in pixels */
++	unsigned int line_length_pix;
++
++	/* Analog crop rectangle. */
++	struct v4l2_rect crop;
++
++	/* Highest possible framerate. */
++	struct v4l2_fract timeperframe_min;
++
++	/* Default framerate. */
++	struct v4l2_fract timeperframe_default;
++
++	/* Default register values */
++	struct imx519_reg_list reg_list;
++};
++
++static const s64 imx519_link_freq_menu[] = {
++	IMX519_DEFAULT_LINK_FREQ,
++};
++
++static const struct imx519_reg mode_common_regs[] = {
++	{0x0100, 0x00},
++	{0x0136, 0x18},
++	{0x0137, 0x00},
++	{0x3c7e, 0x01},
++	{0x3c7f, 0x07},
++	{0x3020, 0x00},
++	{0x3e35, 0x01},
++	{0x3f7f, 0x01},
++	{0x5609, 0x57},
++	{0x5613, 0x51},
++	{0x561f, 0x5e},
++	{0x5623, 0xd2},
++	{0x5637, 0x11},
++	{0x5657, 0x11},
++	{0x5659, 0x12},
++	{0x5733, 0x60},
++	{0x5905, 0x57},
++	{0x590f, 0x51},
++	{0x591b, 0x5e},
++	{0x591f, 0xd2},
++	{0x5933, 0x11},
++	{0x5953, 0x11},
++	{0x5955, 0x12},
++	{0x5a2f, 0x60},
++	{0x5a85, 0x57},
++	{0x5a8f, 0x51},
++	{0x5a9b, 0x5e},
++	{0x5a9f, 0xd2},
++	{0x5ab3, 0x11},
++	{0x5ad3, 0x11},
++	{0x5ad5, 0x12},
++	{0x5baf, 0x60},
++	{0x5c15, 0x2a},
++	{0x5c17, 0x80},
++	{0x5c19, 0x31},
++	{0x5c1b, 0x87},
++	{0x5c25, 0x25},
++	{0x5c27, 0x7b},
++	{0x5c29, 0x2a},
++	{0x5c2b, 0x80},
++	{0x5c2d, 0x31},
++	{0x5c2f, 0x87},
++	{0x5c35, 0x2b},
++	{0x5c37, 0x81},
++	{0x5c39, 0x31},
++	{0x5c3b, 0x87},
++	{0x5c45, 0x25},
++	{0x5c47, 0x7b},
++	{0x5c49, 0x2a},
++	{0x5c4b, 0x80},
++	{0x5c4d, 0x31},
++	{0x5c4f, 0x87},
++	{0x5c55, 0x2d},
++	{0x5c57, 0x83},
++	{0x5c59, 0x32},
++	{0x5c5b, 0x88},
++	{0x5c65, 0x29},
++	{0x5c67, 0x7f},
++	{0x5c69, 0x2e},
++	{0x5c6b, 0x84},
++	{0x5c6d, 0x32},
++	{0x5c6f, 0x88},
++	{0x5e69, 0x04},
++	{0x5e9d, 0x00},
++	{0x5f18, 0x10},
++	{0x5f1a, 0x0e},
++	{0x5f20, 0x12},
++	{0x5f22, 0x10},
++	{0x5f24, 0x0e},
++	{0x5f28, 0x10},
++	{0x5f2a, 0x0e},
++	{0x5f30, 0x12},
++	{0x5f32, 0x10},
++	{0x5f34, 0x0e},
++	{0x5f38, 0x0f},
++	{0x5f39, 0x0d},
++	{0x5f3c, 0x11},
++	{0x5f3d, 0x0f},
++	{0x5f3e, 0x0d},
++	{0x5f61, 0x07},
++	{0x5f64, 0x05},
++	{0x5f67, 0x03},
++	{0x5f6a, 0x03},
++	{0x5f6d, 0x07},
++	{0x5f70, 0x07},
++	{0x5f73, 0x05},
++	{0x5f76, 0x02},
++	{0x5f79, 0x07},
++	{0x5f7c, 0x07},
++	{0x5f7f, 0x07},
++	{0x5f82, 0x07},
++	{0x5f85, 0x03},
++	{0x5f88, 0x02},
++	{0x5f8b, 0x01},
++	{0x5f8e, 0x01},
++	{0x5f91, 0x04},
++	{0x5f94, 0x05},
++	{0x5f97, 0x02},
++	{0x5f9d, 0x07},
++	{0x5fa0, 0x07},
++	{0x5fa3, 0x07},
++	{0x5fa6, 0x07},
++	{0x5fa9, 0x03},
++	{0x5fac, 0x01},
++	{0x5faf, 0x01},
++	{0x5fb5, 0x03},
++	{0x5fb8, 0x02},
++	{0x5fbb, 0x01},
++	{0x5fc1, 0x07},
++	{0x5fc4, 0x07},
++	{0x5fc7, 0x07},
++	{0x5fd1, 0x00},
++	{0x6302, 0x79},
++	{0x6305, 0x78},
++	{0x6306, 0xa5},
++	{0x6308, 0x03},
++	{0x6309, 0x20},
++	{0x630b, 0x0a},
++	{0x630d, 0x48},
++	{0x630f, 0x06},
++	{0x6311, 0xa4},
++	{0x6313, 0x03},
++	{0x6314, 0x20},
++	{0x6316, 0x0a},
++	{0x6317, 0x31},
++	{0x6318, 0x4a},
++	{0x631a, 0x06},
++	{0x631b, 0x40},
++	{0x631c, 0xa4},
++	{0x631e, 0x03},
++	{0x631f, 0x20},
++	{0x6321, 0x0a},
++	{0x6323, 0x4a},
++	{0x6328, 0x80},
++	{0x6329, 0x01},
++	{0x632a, 0x30},
++	{0x632b, 0x02},
++	{0x632c, 0x20},
++	{0x632d, 0x02},
++	{0x632e, 0x30},
++	{0x6330, 0x60},
++	{0x6332, 0x90},
++	{0x6333, 0x01},
++	{0x6334, 0x30},
++	{0x6335, 0x02},
++	{0x6336, 0x20},
++	{0x6338, 0x80},
++	{0x633a, 0xa0},
++	{0x633b, 0x01},
++	{0x633c, 0x60},
++	{0x633d, 0x02},
++	{0x633e, 0x60},
++	{0x633f, 0x01},
++	{0x6340, 0x30},
++	{0x6341, 0x02},
++	{0x6342, 0x20},
++	{0x6343, 0x03},
++	{0x6344, 0x80},
++	{0x6345, 0x03},
++	{0x6346, 0x90},
++	{0x6348, 0xf0},
++	{0x6349, 0x01},
++	{0x634a, 0x20},
++	{0x634b, 0x02},
++	{0x634c, 0x10},
++	{0x634d, 0x03},
++	{0x634e, 0x60},
++	{0x6350, 0xa0},
++	{0x6351, 0x01},
++	{0x6352, 0x60},
++	{0x6353, 0x02},
++	{0x6354, 0x50},
++	{0x6355, 0x02},
++	{0x6356, 0x60},
++	{0x6357, 0x01},
++	{0x6358, 0x30},
++	{0x6359, 0x02},
++	{0x635a, 0x30},
++	{0x635b, 0x03},
++	{0x635c, 0x90},
++	{0x635f, 0x01},
++	{0x6360, 0x10},
++	{0x6361, 0x01},
++	{0x6362, 0x40},
++	{0x6363, 0x02},
++	{0x6364, 0x50},
++	{0x6368, 0x70},
++	{0x636a, 0xa0},
++	{0x636b, 0x01},
++	{0x636c, 0x50},
++	{0x637d, 0xe4},
++	{0x637e, 0xb4},
++	{0x638c, 0x8e},
++	{0x638d, 0x38},
++	{0x638e, 0xe3},
++	{0x638f, 0x4c},
++	{0x6390, 0x30},
++	{0x6391, 0xc3},
++	{0x6392, 0xae},
++	{0x6393, 0xba},
++	{0x6394, 0xeb},
++	{0x6395, 0x6e},
++	{0x6396, 0x34},
++	{0x6397, 0xe3},
++	{0x6398, 0xcf},
++	{0x6399, 0x3c},
++	{0x639a, 0xf3},
++	{0x639b, 0x0c},
++	{0x639c, 0x30},
++	{0x639d, 0xc1},
++	{0x63b9, 0xa3},
++	{0x63ba, 0xfe},
++	{0x7600, 0x01},
++	{0x79a0, 0x01},
++	{0x79a1, 0x01},
++	{0x79a2, 0x01},
++	{0x79a3, 0x01},
++	{0x79a4, 0x01},
++	{0x79a5, 0x20},
++	{0x79a9, 0x00},
++	{0x79aa, 0x01},
++	{0x79ad, 0x00},
++	{0x79af, 0x00},
++	{0x8173, 0x01},
++	{0x835c, 0x01},
++	{0x8a74, 0x01},
++	{0x8c1f, 0x00},
++	{0x8c27, 0x00},
++	{0x8c3b, 0x03},
++	{0x9004, 0x0b},
++	{0x920c, 0x6a},
++	{0x920d, 0x22},
++	{0x920e, 0x6a},
++	{0x920f, 0x23},
++	{0x9214, 0x6a},
++	{0x9215, 0x20},
++	{0x9216, 0x6a},
++	{0x9217, 0x21},
++	{0x9385, 0x3e},
++	{0x9387, 0x1b},
++	{0x938d, 0x4d},
++	{0x938f, 0x43},
++	{0x9391, 0x1b},
++	{0x9395, 0x4d},
++	{0x9397, 0x43},
++	{0x9399, 0x1b},
++	{0x939d, 0x3e},
++	{0x939f, 0x2f},
++	{0x93a5, 0x43},
++	{0x93a7, 0x2f},
++	{0x93a9, 0x2f},
++	{0x93ad, 0x34},
++	{0x93af, 0x2f},
++	{0x93b5, 0x3e},
++	{0x93b7, 0x2f},
++	{0x93bd, 0x4d},
++	{0x93bf, 0x43},
++	{0x93c1, 0x2f},
++	{0x93c5, 0x4d},
++	{0x93c7, 0x43},
++	{0x93c9, 0x2f},
++	{0x974b, 0x02},
++	{0x995c, 0x8c},
++	{0x995d, 0x00},
++	{0x995e, 0x00},
++	{0x9963, 0x64},
++	{0x9964, 0x50},
++	{0xaa0a, 0x26},
++	{0xae03, 0x04},
++	{0xae04, 0x03},
++	{0xae05, 0x03},
++	{0xbc1c, 0x08},
++	{0xbcf1, 0x02},
++	{0x38a3, 0x00},
++};
++
++/* 16 mpix 10fps */
++static const struct imx519_reg mode_4656x3496_regs[] = {
++	{0x0111, 0x02},
++	{0x0112, 0x0a},
++	{0x0113, 0x0a},
++	{0x0114, 0x01},
++	{0x0342, 0x31},
++	{0x0343, 0x6a},
++	{0x0340, 0x0d},
++	{0x0341, 0xf4},
++	{0x0344, 0x00},
++	{0x0345, 0x00},
++	{0x0346, 0x00},
++	{0x0347, 0x00},
++	{0x0348, 0x12},
++	{0x0349, 0x2f},
++	{0x034a, 0x0d},
++	{0x034b, 0xa7},
++	{0x0220, 0x00},
++	{0x0221, 0x11},
++	{0x0222, 0x01},
++	{0x0900, 0x00},
++	{0x0901, 0x11},
++	{0x0902, 0x0a},
++	{0x3f4c, 0x01},
++	{0x3f4d, 0x01},
++	{0x4254, 0x7f},
++	{0x0401, 0x00},
++	{0x0404, 0x00},
++	{0x0405, 0x10},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x12},
++	{0x040d, 0x30},
++	{0x040e, 0x0d},
++	{0x040f, 0xa8},
++	{0x034c, 0x12},
++	{0x034d, 0x30},
++	{0x034e, 0x0d},
++	{0x034f, 0xa8},
++	{0x0301, 0x06},
++	{0x0303, 0x04},
++	{0x0305, 0x06},
++	{0x0306, 0x01},
++	{0x0307, 0x40},
++	{0x0309, 0x0a},
++	{0x030b, 0x02},
++	{0x030d, 0x04},
++	{0x030e, 0x01},
++	{0x030f, 0x10},
++	{0x0310, 0x01},
++	{0x0820, 0x0a},
++	{0x0821, 0x20},
++	{0x0822, 0x00},
++	{0x0823, 0x00},
++	{0x3e20, 0x01},
++	{0x3e37, 0x01},
++	{0x3e3b, 0x00},
++	{0x38a4, 0x00},
++	{0x38a5, 0x00},
++	{0x38a6, 0x00},
++	{0x38a7, 0x00},
++	{0x38a8, 0x01},
++	{0x38a9, 0x23},
++	{0x38aa, 0x01},
++	{0x38ab, 0x23},
++	{0x0106, 0x00},
++	{0x0b00, 0x00},
++	{0x3230, 0x00},
++	{0x3f14, 0x01},
++	{0x3f3c, 0x01},
++	{0x3f0d, 0x0a},
++	{0x3fbc, 0x00},
++	{0x3c06, 0x00},
++	{0x3c07, 0x48},
++	{0x3c0a, 0x00},
++	{0x3c0b, 0x00},
++	{0x3f78, 0x00},
++	{0x3f79, 0x40},
++	{0x3f7c, 0x00},
++	{0x3f7d, 0x00},
++};
++
++/* 4k 21fps mode */
++static const struct imx519_reg mode_3840x2160_regs[] = {
++	{0x0111, 0x02},
++	{0x0112, 0x0a},
++	{0x0113, 0x0a},
++	{0x0114, 0x01},
++	{0x0342, 0x28},
++	{0x0343, 0xf6},
++	{0x0340, 0x08},
++	{0x0341, 0xd4},
++	{0x0344, 0x01},
++	{0x0345, 0x98},
++	{0x0346, 0x02},
++	{0x0347, 0xa0},
++	{0x0348, 0x10},
++	{0x0349, 0x97},
++	{0x034a, 0x0b},
++	{0x034b, 0x17},
++	{0x0220, 0x00},
++	{0x0221, 0x11},
++	{0x0222, 0x01},
++	{0x0900, 0x00},
++	{0x0901, 0x11},
++	{0x0902, 0x0a},
++	{0x3f4c, 0x01},
++	{0x3f4d, 0x01},
++	{0x4254, 0x7f},
++	{0x0401, 0x00},
++	{0x0404, 0x00},
++	{0x0405, 0x10},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x0f},
++	{0x040d, 0x00},
++	{0x040e, 0x08},
++	{0x040f, 0x70},
++	{0x034c, 0x0f},
++	{0x034d, 0x00},
++	{0x034e, 0x08},
++	{0x034f, 0x70},
++	{0x0301, 0x06},
++	{0x0303, 0x04},
++	{0x0305, 0x06},
++	{0x0306, 0x01},
++	{0x0307, 0x40},
++	{0x0309, 0x0a},
++	{0x030b, 0x02},
++	{0x030d, 0x04},
++	{0x030e, 0x01},
++	{0x030f, 0x10},
++	{0x0310, 0x01},
++	{0x0820, 0x0a},
++	{0x0821, 0x20},
++	{0x0822, 0x00},
++	{0x0823, 0x00},
++	{0x3e20, 0x01},
++	{0x3e37, 0x01},
++	{0x3e3b, 0x00},
++	{0x38a4, 0x00},
++	{0x38a5, 0x00},
++	{0x38a6, 0x00},
++	{0x38a7, 0x00},
++	{0x38a8, 0x00},
++	{0x38a9, 0xf0},
++	{0x38aa, 0x00},
++	{0x38ab, 0xb4},
++	{0x0106, 0x00},
++	{0x0b00, 0x00},
++	{0x3230, 0x00},
++	{0x3f14, 0x01},
++	{0x3f3c, 0x01},
++	{0x3f0d, 0x0a},
++	{0x3fbc, 0x00},
++	{0x3c06, 0x00},
++	{0x3c07, 0x48},
++	{0x3c0a, 0x00},
++	{0x3c0b, 0x00},
++	{0x3f78, 0x00},
++	{0x3f79, 0x40},
++	{0x3f7c, 0x00},
++	{0x3f7d, 0x00},
++};
++
++/* 2x2 binned 30fps mode */
++static const struct imx519_reg mode_2328x1748_regs[] = {
++	{0x0111, 0x02},
++	{0x0112, 0x0a},
++	{0x0113, 0x0a},
++	{0x0114, 0x01},
++	{0x0342, 0x19},
++	{0x0343, 0x70},
++	{0x0340, 0x08},
++	{0x0341, 0x88},
++	{0x0344, 0x00},
++	{0x0345, 0x00},
++	{0x0346, 0x00},
++	{0x0347, 0x00},
++	{0x0348, 0x12},
++	{0x0349, 0x2f},
++	{0x034a, 0x0d},
++	{0x034b, 0xa7},
++	{0x0220, 0x00},
++	{0x0221, 0x11},
++	{0x0222, 0x01},
++	{0x0900, 0x01},
++	{0x0901, 0x22},
++	{0x0902, 0x0a},
++	{0x3f4c, 0x05},
++	{0x3f4d, 0x03},
++	{0x4254, 0x7f},
++	{0x0401, 0x00},
++	{0x0404, 0x00},
++	{0x0405, 0x10},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x09},
++	{0x040d, 0x18},
++	{0x040e, 0x06},
++	{0x040f, 0xd4},
++	{0x034c, 0x09},
++	{0x034d, 0x18},
++	{0x034e, 0x06},
++	{0x034f, 0xd4},
++	{0x0301, 0x06},
++	{0x0303, 0x04},
++	{0x0305, 0x06},
++	{0x0306, 0x01},
++	{0x0307, 0x40},
++	{0x0309, 0x0a},
++	{0x030b, 0x02},
++	{0x030d, 0x04},
++	{0x030e, 0x01},
++	{0x030f, 0x10},
++	{0x0310, 0x01},
++	{0x0820, 0x0a},
++	{0x0821, 0x20},
++	{0x0822, 0x00},
++	{0x0823, 0x00},
++	{0x3e20, 0x01},
++	{0x3e37, 0x01},
++	{0x3e3b, 0x00},
++	{0x38a4, 0x00},
++	{0x38a5, 0x00},
++	{0x38a6, 0x00},
++	{0x38a7, 0x00},
++	{0x38a8, 0x00},
++	{0x38a9, 0x91},
++	{0x38aa, 0x00},
++	{0x38ab, 0x91},
++	{0x0106, 0x00},
++	{0x0b00, 0x00},
++	{0x3230, 0x00},
++	{0x3f14, 0x01},
++	{0x3f3c, 0x01},
++	{0x3f0d, 0x0a},
++	{0x3fbc, 0x00},
++	{0x3c06, 0x00},
++	{0x3c07, 0x48},
++	{0x3c0a, 0x00},
++	{0x3c0b, 0x00},
++	{0x3f78, 0x00},
++	{0x3f79, 0x40},
++	{0x3f7c, 0x00},
++	{0x3f7d, 0x00},
++};
++
++/* 1080p 60fps mode */
++static const struct imx519_reg mode_1920x1080_regs[] = {
++	{0x0111, 0x02},
++	{0x0112, 0x0a},
++	{0x0113, 0x0a},
++	{0x0114, 0x01},
++	{0x0342, 0x17},
++	{0x0343, 0x8b},
++	{0x0340, 0x04},
++	{0x0341, 0x9c},
++	{0x0344, 0x01},
++	{0x0345, 0x98},
++	{0x0346, 0x02},
++	{0x0347, 0xa2},
++	{0x0348, 0x10},
++	{0x0349, 0x97},
++	{0x034a, 0x0b},
++	{0x034b, 0x15},
++	{0x0220, 0x00},
++	{0x0221, 0x11},
++	{0x0222, 0x01},
++	{0x0900, 0x01},
++	{0x0901, 0x22},
++	{0x0902, 0x0a},
++	{0x3f4c, 0x05},
++	{0x3f4d, 0x03},
++	{0x4254, 0x7f},
++	{0x0401, 0x00},
++	{0x0404, 0x00},
++	{0x0405, 0x10},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x07},
++	{0x040d, 0x80},
++	{0x040e, 0x04},
++	{0x040f, 0x38},
++	{0x034c, 0x07},
++	{0x034d, 0x80},
++	{0x034e, 0x04},
++	{0x034f, 0x38},
++	{0x0301, 0x06},
++	{0x0303, 0x04},
++	{0x0305, 0x06},
++	{0x0306, 0x01},
++	{0x0307, 0x40},
++	{0x0309, 0x0a},
++	{0x030b, 0x02},
++	{0x030d, 0x04},
++	{0x030e, 0x01},
++	{0x030f, 0x10},
++	{0x0310, 0x01},
++	{0x0820, 0x0a},
++	{0x0821, 0x20},
++	{0x0822, 0x00},
++	{0x0823, 0x00},
++	{0x3e20, 0x01},
++	{0x3e37, 0x01},
++	{0x3e3b, 0x00},
++	{0x38a4, 0x00},
++	{0x38a5, 0x00},
++	{0x38a6, 0x00},
++	{0x38a7, 0x00},
++	{0x38a8, 0x00},
++	{0x38a9, 0x78},
++	{0x38aa, 0x00},
++	{0x38ab, 0x5a},
++	{0x0106, 0x00},
++	{0x0b00, 0x00},
++	{0x3230, 0x00},
++	{0x3f14, 0x01},
++	{0x3f3c, 0x01},
++	{0x3f0d, 0x0a},
++	{0x3fbc, 0x00},
++	{0x3c06, 0x00},
++	{0x3c07, 0x48},
++	{0x3c0a, 0x00},
++	{0x3c0b, 0x00},
++	{0x3f78, 0x00},
++	{0x3f79, 0x40},
++	{0x3f7c, 0x00},
++	{0x3f7d, 0x00},
++};
++
++/* 720p 120fps mode */
++static const struct imx519_reg mode_1280x720_regs[] = {
++	{0x0111, 0x02},
++	{0x0112, 0x0a},
++	{0x0113, 0x0a},
++	{0x0114, 0x01},
++	{0x0342, 0x18},
++	{0x0343, 0x00},
++	{0x0340, 0x03},
++	{0x0341, 0x34},
++	{0x0344, 0x04},
++	{0x0345, 0x18},
++	{0x0346, 0x04},
++	{0x0347, 0x12},
++	{0x0348, 0x0e},
++	{0x0349, 0x17},
++	{0x034a, 0x09},
++	{0x034b, 0xb6},
++	{0x0220, 0x00},
++	{0x0221, 0x11},
++	{0x0222, 0x01},
++	{0x0900, 0x01},
++	{0x0901, 0x22},
++	{0x0902, 0x0a},
++	{0x3f4c, 0x05},
++	{0x3f4d, 0x03},
++	{0x4254, 0x7f},
++	{0x0401, 0x00},
++	{0x0404, 0x00},
++	{0x0405, 0x10},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x05},
++	{0x040d, 0x00},
++	{0x040e, 0x02},
++	{0x040f, 0xd0},
++	{0x034c, 0x05},
++	{0x034d, 0x00},
++	{0x034e, 0x02},
++	{0x034f, 0xd0},
++	{0x0301, 0x06},
++	{0x0303, 0x04},
++	{0x0305, 0x06},
++	{0x0306, 0x01},
++	{0x0307, 0x40},
++	{0x0309, 0x0a},
++	{0x030b, 0x02},
++	{0x030d, 0x04},
++	{0x030e, 0x01},
++	{0x030f, 0x10},
++	{0x0310, 0x01},
++	{0x0820, 0x0a},
++	{0x0821, 0x20},
++	{0x0822, 0x00},
++	{0x0823, 0x00},
++	{0x3e20, 0x01},
++	{0x3e37, 0x01},
++	{0x3e3b, 0x00},
++	{0x38a4, 0x00},
++	{0x38a5, 0x00},
++	{0x38a6, 0x00},
++	{0x38a7, 0x00},
++	{0x38a8, 0x00},
++	{0x38a9, 0x50},
++	{0x38aa, 0x00},
++	{0x38ab, 0x3c},
++	{0x0106, 0x00},
++	{0x0b00, 0x00},
++	{0x3230, 0x00},
++	{0x3f14, 0x01},
++	{0x3f3c, 0x01},
++	{0x3f0d, 0x0a},
++	{0x3fbc, 0x00},
++	{0x3c06, 0x00},
++	{0x3c07, 0x48},
++	{0x3c0a, 0x00},
++	{0x3c0b, 0x00},
++	{0x3f78, 0x00},
++	{0x3f79, 0x40},
++	{0x3f7c, 0x00},
++	{0x3f7d, 0x00},
++};
++
++/* Mode configs */
++static const struct imx519_mode supported_modes_10bit[] = {
++	{
++		.width = 4656,
++		.height = 3496,
++		.line_length_pix = 0x316a,
++		.crop = {
++			.left = IMX519_PIXEL_ARRAY_LEFT,
++			.top = IMX519_PIXEL_ARRAY_TOP,
++			.width = 4656,
++			.height = 3496,
++		},
++		.timeperframe_min = {
++			.numerator = 100,
++			.denominator = 900
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 900
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_4656x3496_regs),
++			.regs = mode_4656x3496_regs,
++		}
++	},
++	{
++		.width = 3840,
++		.height = 2160,
++		.line_length_pix = 0x28f6,
++		.crop = {
++			.left = IMX519_PIXEL_ARRAY_LEFT + 408,
++			.top = IMX519_PIXEL_ARRAY_TOP + 672,
++			.width = 3840,
++			.height = 2160,
++		},
++		.timeperframe_min = {
++			.numerator = 100,
++			.denominator = 1800
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 1800
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_3840x2160_regs),
++			.regs = mode_3840x2160_regs,
++		}
++	},
++	{
++		.width = 2328,
++		.height = 1748,
++		.line_length_pix = 0x1970,
++		.crop = {
++			.left = IMX519_PIXEL_ARRAY_LEFT,
++			.top = IMX519_PIXEL_ARRAY_TOP,
++			.width = 4656,
++			.height = 3496,
++		},
++		.timeperframe_min = {
++			.numerator = 100,
++			.denominator = 3000
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 3000
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_2328x1748_regs),
++			.regs = mode_2328x1748_regs,
++		}
++	},
++	{
++		.width = 1920,
++		.height = 1080,
++		.line_length_pix = 0x178b,
++		.crop = {
++			.left = IMX519_PIXEL_ARRAY_LEFT + 408,
++			.top = IMX519_PIXEL_ARRAY_TOP + 674,
++			.width = 3840,
++			.height = 2160,
++		},
++		.timeperframe_min = {
++			.numerator = 100,
++			.denominator = 6000
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 6000
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_1920x1080_regs),
++			.regs = mode_1920x1080_regs,
++		}
++	},
++	{
++		.width = 1280,
++		.height = 720,
++		.line_length_pix = 0x1800,
++		.crop = {
++			.left = IMX519_PIXEL_ARRAY_LEFT + 1048,
++			.top = IMX519_PIXEL_ARRAY_TOP + 1042,
++			.width = 2560,
++			.height = 1440,
++		},
++		.timeperframe_min = {
++			.numerator = 100,
++			.denominator = 8000
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 8000
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_1280x720_regs),
++			.regs = mode_1280x720_regs,
++		}
++	}
++};
++
++/*
++ * The supported formats.
++ * This table MUST contain 4 entries per format, to cover the various flip
++ * combinations in the order
++ * - no flip
++ * - h flip
++ * - v flip
++ * - h&v flips
++ */
++static const u32 codes[] = {
++	/* 10-bit modes. */
++	MEDIA_BUS_FMT_SRGGB10_1X10,
++	MEDIA_BUS_FMT_SGRBG10_1X10,
++	MEDIA_BUS_FMT_SGBRG10_1X10,
++	MEDIA_BUS_FMT_SBGGR10_1X10,
++};
++
++static const char * const imx519_test_pattern_menu[] = {
++	"Disabled",
++	"Color Bars",
++	"Solid Color",
++	"Grey Color Bars",
++	"PN9"
++};
++
++static const int imx519_test_pattern_val[] = {
++	IMX519_TEST_PATTERN_DISABLE,
++	IMX519_TEST_PATTERN_COLOR_BARS,
++	IMX519_TEST_PATTERN_SOLID_COLOR,
++	IMX519_TEST_PATTERN_GREY_COLOR,
++	IMX519_TEST_PATTERN_PN9,
++};
++
++/* regulator supplies */
++static const char * const imx519_supply_name[] = {
++	/* Supplies can be enabled in any order */
++	"VANA",  /* Analog (2.8V) supply */
++	"VDIG",  /* Digital Core (1.05V) supply */
++	"VDDL",  /* IF (1.8V) supply */
++};
++
++#define IMX519_NUM_SUPPLIES ARRAY_SIZE(imx519_supply_name)
++
++/*
++ * Initialisation delay between XCLR low->high and the moment when the sensor
++ * can start capture (i.e. can leave software standby), given by T7 in the
++ * datasheet is 8ms.  This does include I2C setup time as well.
++ *
++ * Note, that delay between XCLR low->high and reading the CCI ID register (T6
++ * in the datasheet) is much smaller - 600us.
++ */
++#define IMX519_XCLR_MIN_DELAY_US	8000
++#define IMX519_XCLR_DELAY_RANGE_US	1000
++
++struct imx519 {
++	struct v4l2_subdev sd;
++	struct media_pad pad[NUM_PADS];
++
++	unsigned int fmt_code;
++
++	struct clk *xclk;
++
++	struct gpio_desc *reset_gpio;
++	struct regulator_bulk_data supplies[IMX519_NUM_SUPPLIES];
++
++	struct v4l2_ctrl_handler ctrl_handler;
++	/* V4L2 Controls */
++	struct v4l2_ctrl *pixel_rate;
++	struct v4l2_ctrl *exposure;
++	struct v4l2_ctrl *vflip;
++	struct v4l2_ctrl *hflip;
++	struct v4l2_ctrl *vblank;
++	struct v4l2_ctrl *hblank;
++
++	/* Current mode */
++	const struct imx519_mode *mode;
++
++	/*
++	 * Mutex for serialized access:
++	 * Protect sensor module set pad format and start/stop streaming safely.
++	 */
++	struct mutex mutex;
++
++	/* Streaming on/off */
++	bool streaming;
++
++	/* Rewrite common registers on stream on? */
++	bool common_regs_written;
++
++	/* Current long exposure factor in use. Set through V4L2_CID_VBLANK */
++	unsigned int long_exp_shift;
++};
++
++static inline struct imx519 *to_imx519(struct v4l2_subdev *_sd)
++{
++	return container_of(_sd, struct imx519, sd);
++}
++
++/* Read registers up to 2 at a time */
++static int imx519_read_reg(struct imx519 *imx519, u16 reg, u32 len, u32 *val)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx519->sd);
++	struct i2c_msg msgs[2];
++	u8 addr_buf[2] = { reg >> 8, reg & 0xff };
++	u8 data_buf[4] = { 0, };
++	int ret;
++
++	if (len > 4)
++		return -EINVAL;
++
++	/* Write register address */
++	msgs[0].addr = client->addr;
++	msgs[0].flags = 0;
++	msgs[0].len = ARRAY_SIZE(addr_buf);
++	msgs[0].buf = addr_buf;
++
++	/* Read data from register */
++	msgs[1].addr = client->addr;
++	msgs[1].flags = I2C_M_RD;
++	msgs[1].len = len;
++	msgs[1].buf = &data_buf[4 - len];
++
++	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
++	if (ret != ARRAY_SIZE(msgs))
++		return -EIO;
++
++	*val = get_unaligned_be32(data_buf);
++
++	return 0;
++}
++
++/* Write registers up to 2 at a time */
++static int imx519_write_reg(struct imx519 *imx519, u16 reg, u32 len, u32 val)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx519->sd);
++	u8 buf[6];
++
++	if (len > 4)
++		return -EINVAL;
++
++	put_unaligned_be16(reg, buf);
++	put_unaligned_be32(val << (8 * (4 - len)), buf + 2);
++	if (i2c_master_send(client, buf, len + 2) != len + 2)
++		return -EIO;
++
++	return 0;
++}
++
++/* Write a list of registers */
++static int imx519_write_regs(struct imx519 *imx519,
++			     const struct imx519_reg *regs, u32 len)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx519->sd);
++	unsigned int i;
++	int ret;
++
++	for (i = 0; i < len; i++) {
++		ret = imx519_write_reg(imx519, regs[i].address, 1, regs[i].val);
++		if (ret) {
++			dev_err_ratelimited(&client->dev,
++					    "Failed to write reg 0x%4.4x. error = %d\n",
++					    regs[i].address, ret);
++
++			return ret;
++		}
++	}
++
++	return 0;
++}
++
++/* Get bayer order based on flip setting. */
++static u32 imx519_get_format_code(struct imx519 *imx519)
++{
++	unsigned int i;
++
++	lockdep_assert_held(&imx519->mutex);
++
++	i = (imx519->vflip->val ? 2 : 0) |
++	    (imx519->hflip->val ? 1 : 0);
++
++	return codes[i];
++}
++
++static int imx519_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
++{
++	struct imx519 *imx519 = to_imx519(sd);
++	struct v4l2_mbus_framefmt *try_fmt_img =
++		v4l2_subdev_state_get_format(fh->state, IMAGE_PAD);
++	struct v4l2_mbus_framefmt *try_fmt_meta =
++		v4l2_subdev_state_get_format(fh->state, METADATA_PAD);
++	struct v4l2_rect *try_crop;
++
++	mutex_lock(&imx519->mutex);
++
++	/* Initialize try_fmt for the image pad */
++	try_fmt_img->width = supported_modes_10bit[0].width;
++	try_fmt_img->height = supported_modes_10bit[0].height;
++	try_fmt_img->code = imx519_get_format_code(imx519);
++	try_fmt_img->field = V4L2_FIELD_NONE;
++
++	/* Initialize try_fmt for the embedded metadata pad */
++	try_fmt_meta->width = IMX519_EMBEDDED_LINE_WIDTH;
++	try_fmt_meta->height = IMX519_NUM_EMBEDDED_LINES;
++	try_fmt_meta->code = MEDIA_BUS_FMT_SENSOR_DATA;
++	try_fmt_meta->field = V4L2_FIELD_NONE;
++
++	/* Initialize try_crop */
++	try_crop = v4l2_subdev_state_get_crop(fh->state, IMAGE_PAD);
++	try_crop->left = IMX519_PIXEL_ARRAY_LEFT;
++	try_crop->top = IMX519_PIXEL_ARRAY_TOP;
++	try_crop->width = IMX519_PIXEL_ARRAY_WIDTH;
++	try_crop->height = IMX519_PIXEL_ARRAY_HEIGHT;
++
++	mutex_unlock(&imx519->mutex);
++
++	return 0;
++}
++
++static void imx519_adjust_exposure_range(struct imx519 *imx519)
++{
++	int exposure_max, exposure_def;
++
++	/* Honour the VBLANK limits when setting exposure. */
++	exposure_max = imx519->mode->height + imx519->vblank->val -
++		       IMX519_EXPOSURE_OFFSET;
++	exposure_def = min(exposure_max, imx519->exposure->val);
++	__v4l2_ctrl_modify_range(imx519->exposure, imx519->exposure->minimum,
++				 exposure_max, imx519->exposure->step,
++				 exposure_def);
++}
++
++static int imx519_set_frame_length(struct imx519 *imx519, unsigned int val)
++{
++	int ret = 0;
++
++	imx519->long_exp_shift = 0;
++
++	while (val > IMX519_FRAME_LENGTH_MAX) {
++		imx519->long_exp_shift++;
++		val >>= 1;
++	}
++
++	ret = imx519_write_reg(imx519, IMX519_REG_FRAME_LENGTH,
++			       IMX519_REG_VALUE_16BIT, val);
++	if (ret)
++		return ret;
++
++	return imx519_write_reg(imx519, IMX519_LONG_EXP_SHIFT_REG,
++				IMX519_REG_VALUE_08BIT, imx519->long_exp_shift);
++}
++
++static int imx519_set_ctrl(struct v4l2_ctrl *ctrl)
++{
++	struct imx519 *imx519 =
++		container_of(ctrl->handler, struct imx519, ctrl_handler);
++	struct i2c_client *client = v4l2_get_subdevdata(&imx519->sd);
++	int ret = 0;
++
++	/*
++	 * The VBLANK control may change the limits of usable exposure, so check
++	 * and adjust if necessary.
++	 */
++	if (ctrl->id == V4L2_CID_VBLANK)
++		imx519_adjust_exposure_range(imx519);
++
++	/*
++	 * Applying V4L2 control value only happens
++	 * when power is up for streaming
++	 */
++	if (pm_runtime_get_if_in_use(&client->dev) == 0)
++		return 0;
++
++	switch (ctrl->id) {
++	case V4L2_CID_ANALOGUE_GAIN:
++		ret = imx519_write_reg(imx519, IMX519_REG_ANALOG_GAIN,
++				       IMX519_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_EXPOSURE:
++		ret = imx519_write_reg(imx519, IMX519_REG_EXPOSURE,
++				       IMX519_REG_VALUE_16BIT, ctrl->val >>
++							imx519->long_exp_shift);
++		break;
++	case V4L2_CID_DIGITAL_GAIN:
++		ret = imx519_write_reg(imx519, IMX519_REG_DIGITAL_GAIN,
++				       IMX519_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN:
++		ret = imx519_write_reg(imx519, IMX519_REG_TEST_PATTERN,
++				       IMX519_REG_VALUE_16BIT,
++				       imx519_test_pattern_val[ctrl->val]);
++		break;
++	case V4L2_CID_TEST_PATTERN_RED:
++		ret = imx519_write_reg(imx519, IMX519_REG_TEST_PATTERN_R,
++				       IMX519_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN_GREENR:
++		ret = imx519_write_reg(imx519, IMX519_REG_TEST_PATTERN_GR,
++				       IMX519_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN_BLUE:
++		ret = imx519_write_reg(imx519, IMX519_REG_TEST_PATTERN_B,
++				       IMX519_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN_GREENB:
++		ret = imx519_write_reg(imx519, IMX519_REG_TEST_PATTERN_GB,
++				       IMX519_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_HFLIP:
++	case V4L2_CID_VFLIP:
++		ret = imx519_write_reg(imx519, IMX519_REG_ORIENTATION, 1,
++				       imx519->hflip->val |
++				       imx519->vflip->val << 1);
++		break;
++	case V4L2_CID_VBLANK:
++		ret = imx519_set_frame_length(imx519,
++					      imx519->mode->height + ctrl->val);
++		break;
++	default:
++		dev_info(&client->dev,
++			 "ctrl(id:0x%x,val:0x%x) is not handled\n",
++			 ctrl->id, ctrl->val);
++		ret = -EINVAL;
++		break;
++	}
++
++	pm_runtime_put(&client->dev);
++
++	return ret;
++}
++
++static const struct v4l2_ctrl_ops imx519_ctrl_ops = {
++	.s_ctrl = imx519_set_ctrl,
++};
++
++static int imx519_enum_mbus_code(struct v4l2_subdev *sd,
++				 struct v4l2_subdev_state *sd_state,
++				 struct v4l2_subdev_mbus_code_enum *code)
++{
++	struct imx519 *imx519 = to_imx519(sd);
++
++	if (code->pad >= NUM_PADS)
++		return -EINVAL;
++
++	if (code->pad == IMAGE_PAD) {
++		if (code->index > 0)
++			return -EINVAL;
++
++		code->code = imx519_get_format_code(imx519);
++	} else {
++		if (code->index > 0)
++			return -EINVAL;
++
++		code->code = MEDIA_BUS_FMT_SENSOR_DATA;
++	}
++
++	return 0;
++}
++
++static int imx519_enum_frame_size(struct v4l2_subdev *sd,
++				  struct v4l2_subdev_state *sd_state,
++				  struct v4l2_subdev_frame_size_enum *fse)
++{
++	struct imx519 *imx519 = to_imx519(sd);
++
++	if (fse->pad >= NUM_PADS)
++		return -EINVAL;
++
++	if (fse->pad == IMAGE_PAD) {
++		if (fse->index >= ARRAY_SIZE(supported_modes_10bit))
++			return -EINVAL;
++
++		if (fse->code != imx519_get_format_code(imx519))
++			return -EINVAL;
++
++		fse->min_width = supported_modes_10bit[fse->index].width;
++		fse->max_width = fse->min_width;
++		fse->min_height = supported_modes_10bit[fse->index].height;
++		fse->max_height = fse->min_height;
++	} else {
++		if (fse->code != MEDIA_BUS_FMT_SENSOR_DATA || fse->index > 0)
++			return -EINVAL;
++
++		fse->min_width = IMX519_EMBEDDED_LINE_WIDTH;
++		fse->max_width = fse->min_width;
++		fse->min_height = IMX519_NUM_EMBEDDED_LINES;
++		fse->max_height = fse->min_height;
++	}
++
++	return 0;
++}
++
++static void imx519_reset_colorspace(struct v4l2_mbus_framefmt *fmt)
++{
++	fmt->colorspace = V4L2_COLORSPACE_RAW;
++	fmt->ycbcr_enc = V4L2_MAP_YCBCR_ENC_DEFAULT(fmt->colorspace);
++	fmt->quantization = V4L2_MAP_QUANTIZATION_DEFAULT(true,
++							  fmt->colorspace,
++							  fmt->ycbcr_enc);
++	fmt->xfer_func = V4L2_MAP_XFER_FUNC_DEFAULT(fmt->colorspace);
++}
++
++static void imx519_update_image_pad_format(struct imx519 *imx519,
++					   const struct imx519_mode *mode,
++					   struct v4l2_subdev_format *fmt)
++{
++	fmt->format.width = mode->width;
++	fmt->format.height = mode->height;
++	fmt->format.field = V4L2_FIELD_NONE;
++	imx519_reset_colorspace(&fmt->format);
++}
++
++static void imx519_update_metadata_pad_format(struct v4l2_subdev_format *fmt)
++{
++	fmt->format.width = IMX519_EMBEDDED_LINE_WIDTH;
++	fmt->format.height = IMX519_NUM_EMBEDDED_LINES;
++	fmt->format.code = MEDIA_BUS_FMT_SENSOR_DATA;
++	fmt->format.field = V4L2_FIELD_NONE;
++}
++
++static int imx519_get_pad_format(struct v4l2_subdev *sd,
++				 struct v4l2_subdev_state *sd_state,
++				 struct v4l2_subdev_format *fmt)
++{
++	struct imx519 *imx519 = to_imx519(sd);
++
++	if (fmt->pad >= NUM_PADS)
++		return -EINVAL;
++
++	mutex_lock(&imx519->mutex);
++
++	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++		struct v4l2_mbus_framefmt *try_fmt =
++			v4l2_subdev_state_get_format(sd_state,
++						   fmt->pad);
++		/* update the code which could change due to vflip or hflip: */
++		try_fmt->code = fmt->pad == IMAGE_PAD ?
++				imx519_get_format_code(imx519) :
++				MEDIA_BUS_FMT_SENSOR_DATA;
++		fmt->format = *try_fmt;
++	} else {
++		if (fmt->pad == IMAGE_PAD) {
++			imx519_update_image_pad_format(imx519, imx519->mode,
++						       fmt);
++			fmt->format.code =
++			       imx519_get_format_code(imx519);
++		} else {
++			imx519_update_metadata_pad_format(fmt);
++		}
++	}
++
++	mutex_unlock(&imx519->mutex);
++	return 0;
++}
++
++static
++unsigned int imx519_get_frame_length(const struct imx519_mode *mode,
++				     const struct v4l2_fract *timeperframe)
++{
++	u64 frame_length;
++
++	frame_length = (u64)timeperframe->numerator * IMX519_PIXEL_RATE;
++	do_div(frame_length,
++	       (u64)timeperframe->denominator * mode->line_length_pix);
++
++	if (WARN_ON(frame_length > IMX519_FRAME_LENGTH_MAX))
++		frame_length = IMX519_FRAME_LENGTH_MAX;
++
++	return max_t(unsigned int, frame_length, mode->height);
++}
++
++static void imx519_set_framing_limits(struct imx519 *imx519)
++{
++	unsigned int frm_length_min, frm_length_default, hblank;
++	const struct imx519_mode *mode = imx519->mode;
++
++	frm_length_min = imx519_get_frame_length(mode, &mode->timeperframe_min);
++	frm_length_default =
++		     imx519_get_frame_length(mode, &mode->timeperframe_default);
++
++	/* Default to no long exposure multiplier. */
++	imx519->long_exp_shift = 0;
++
++	/* Update limits and set FPS to default */
++	__v4l2_ctrl_modify_range(imx519->vblank, frm_length_min - mode->height,
++				 ((1 << IMX519_LONG_EXP_SHIFT_MAX) *
++					IMX519_FRAME_LENGTH_MAX) - mode->height,
++				 1, frm_length_default - mode->height);
++
++	/* Setting this will adjust the exposure limits as well. */
++	__v4l2_ctrl_s_ctrl(imx519->vblank, frm_length_default - mode->height);
++
++	/*
++	 * Currently PPL is fixed to the mode specified value, so hblank
++	 * depends on mode->width only, and is not changeable in any
++	 * way other than changing the mode.
++	 */
++	hblank = mode->line_length_pix - mode->width;
++	__v4l2_ctrl_modify_range(imx519->hblank, hblank, hblank, 1, hblank);
++}
++
++static int imx519_set_pad_format(struct v4l2_subdev *sd,
++				 struct v4l2_subdev_state *sd_state,
++				 struct v4l2_subdev_format *fmt)
++{
++	struct v4l2_mbus_framefmt *framefmt;
++	const struct imx519_mode *mode;
++	struct imx519 *imx519 = to_imx519(sd);
++
++	if (fmt->pad >= NUM_PADS)
++		return -EINVAL;
++
++	mutex_lock(&imx519->mutex);
++
++	if (fmt->pad == IMAGE_PAD) {
++		/* Bayer order varies with flips */
++		fmt->format.code = imx519_get_format_code(imx519);
++
++		mode = v4l2_find_nearest_size(supported_modes_10bit,
++					      ARRAY_SIZE(supported_modes_10bit),
++					      width, height,
++					      fmt->format.width,
++					      fmt->format.height);
++		imx519_update_image_pad_format(imx519, mode, fmt);
++		if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++			framefmt = v4l2_subdev_state_get_format(sd_state,
++							      fmt->pad);
++			*framefmt = fmt->format;
++		} else {
++			imx519->mode = mode;
++			imx519->fmt_code = fmt->format.code;
++			imx519_set_framing_limits(imx519);
++		}
++	} else {
++		if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++			framefmt = v4l2_subdev_state_get_format(sd_state,
++							      fmt->pad);
++			*framefmt = fmt->format;
++		} else {
++			/* Only one embedded data mode is supported */
++			imx519_update_metadata_pad_format(fmt);
++		}
++	}
++
++	mutex_unlock(&imx519->mutex);
++
++	return 0;
++}
++
++static const struct v4l2_rect *
++__imx519_get_pad_crop(struct imx519 *imx519, struct v4l2_subdev_state *sd_state,
++		      unsigned int pad, enum v4l2_subdev_format_whence which)
++{
++	switch (which) {
++	case V4L2_SUBDEV_FORMAT_TRY:
++		return v4l2_subdev_state_get_crop(sd_state, pad);
++	case V4L2_SUBDEV_FORMAT_ACTIVE:
++		return &imx519->mode->crop;
++	}
++
++	return NULL;
++}
++
++static int imx519_get_selection(struct v4l2_subdev *sd,
++				struct v4l2_subdev_state *sd_state,
++				struct v4l2_subdev_selection *sel)
++{
++	switch (sel->target) {
++	case V4L2_SEL_TGT_CROP: {
++		struct imx519 *imx519 = to_imx519(sd);
++
++		mutex_lock(&imx519->mutex);
++		sel->r = *__imx519_get_pad_crop(imx519, sd_state, sel->pad,
++						sel->which);
++		mutex_unlock(&imx519->mutex);
++
++		return 0;
++	}
++
++	case V4L2_SEL_TGT_NATIVE_SIZE:
++		sel->r.left = 0;
++		sel->r.top = 0;
++		sel->r.width = IMX519_NATIVE_WIDTH;
++		sel->r.height = IMX519_NATIVE_HEIGHT;
++
++		return 0;
++
++	case V4L2_SEL_TGT_CROP_DEFAULT:
++	case V4L2_SEL_TGT_CROP_BOUNDS:
++		sel->r.left = IMX519_PIXEL_ARRAY_LEFT;
++		sel->r.top = IMX519_PIXEL_ARRAY_TOP;
++		sel->r.width = IMX519_PIXEL_ARRAY_WIDTH;
++		sel->r.height = IMX519_PIXEL_ARRAY_HEIGHT;
++
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++/* Start streaming */
++static int imx519_start_streaming(struct imx519 *imx519)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx519->sd);
++	const struct imx519_reg_list *reg_list;
++	int ret;
++
++	if (!imx519->common_regs_written) {
++		ret = imx519_write_regs(imx519, mode_common_regs,
++					ARRAY_SIZE(mode_common_regs));
++
++		if (ret) {
++			dev_err(&client->dev, "%s failed to set common settings\n",
++				__func__);
++			return ret;
++		}
++		imx519->common_regs_written = true;
++	}
++
++	/* Apply default values of current mode */
++	reg_list = &imx519->mode->reg_list;
++	ret = imx519_write_regs(imx519, reg_list->regs, reg_list->num_of_regs);
++	if (ret) {
++		dev_err(&client->dev, "%s failed to set mode\n", __func__);
++		return ret;
++	}
++
++	/* Apply customized values from user */
++	ret =  __v4l2_ctrl_handler_setup(imx519->sd.ctrl_handler);
++	if (ret)
++		return ret;
++
++	/* set stream on register */
++	return imx519_write_reg(imx519, IMX519_REG_MODE_SELECT,
++				IMX519_REG_VALUE_08BIT, IMX519_MODE_STREAMING);
++}
++
++/* Stop streaming */
++static void imx519_stop_streaming(struct imx519 *imx519)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx519->sd);
++	int ret;
++
++	/* set stream off register */
++	ret = imx519_write_reg(imx519, IMX519_REG_MODE_SELECT,
++			       IMX519_REG_VALUE_08BIT, IMX519_MODE_STANDBY);
++	if (ret)
++		dev_err(&client->dev, "%s failed to set stream\n", __func__);
++}
++
++static int imx519_set_stream(struct v4l2_subdev *sd, int enable)
++{
++	struct imx519 *imx519 = to_imx519(sd);
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++	int ret = 0;
++
++	mutex_lock(&imx519->mutex);
++	if (imx519->streaming == enable) {
++		mutex_unlock(&imx519->mutex);
++		return 0;
++	}
++
++	if (enable) {
++		ret = pm_runtime_get_sync(&client->dev);
++		if (ret < 0) {
++			pm_runtime_put_noidle(&client->dev);
++			goto err_unlock;
++		}
++
++		/*
++		 * Apply default & customized values
++		 * and then start streaming.
++		 */
++		ret = imx519_start_streaming(imx519);
++		if (ret)
++			goto err_rpm_put;
++	} else {
++		imx519_stop_streaming(imx519);
++		pm_runtime_put(&client->dev);
++	}
++
++	imx519->streaming = enable;
++
++	/* vflip and hflip cannot change during streaming */
++	__v4l2_ctrl_grab(imx519->vflip, enable);
++	__v4l2_ctrl_grab(imx519->hflip, enable);
++
++	mutex_unlock(&imx519->mutex);
++
++	return ret;
++
++err_rpm_put:
++	pm_runtime_put(&client->dev);
++err_unlock:
++	mutex_unlock(&imx519->mutex);
++
++	return ret;
++}
++
++/* Power/clock management functions */
++static int imx519_power_on(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx519 *imx519 = to_imx519(sd);
++	int ret;
++
++	ret = regulator_bulk_enable(IMX519_NUM_SUPPLIES,
++				    imx519->supplies);
++	if (ret) {
++		dev_err(&client->dev, "%s: failed to enable regulators\n",
++			__func__);
++		return ret;
++	}
++
++	ret = clk_prepare_enable(imx519->xclk);
++	if (ret) {
++		dev_err(&client->dev, "%s: failed to enable clock\n",
++			__func__);
++		goto reg_off;
++	}
++
++	gpiod_set_value_cansleep(imx519->reset_gpio, 1);
++	usleep_range(IMX519_XCLR_MIN_DELAY_US,
++		     IMX519_XCLR_MIN_DELAY_US + IMX519_XCLR_DELAY_RANGE_US);
++
++	return 0;
++
++reg_off:
++	regulator_bulk_disable(IMX519_NUM_SUPPLIES, imx519->supplies);
++	return ret;
++}
++
++static int imx519_power_off(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx519 *imx519 = to_imx519(sd);
++
++	gpiod_set_value_cansleep(imx519->reset_gpio, 0);
++	regulator_bulk_disable(IMX519_NUM_SUPPLIES, imx519->supplies);
++	clk_disable_unprepare(imx519->xclk);
++
++	/* Force reprogramming of the common registers when powered up again. */
++	imx519->common_regs_written = false;
++
++	return 0;
++}
++
++static int __maybe_unused imx519_suspend(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx519 *imx519 = to_imx519(sd);
++
++	if (imx519->streaming)
++		imx519_stop_streaming(imx519);
++
++	return 0;
++}
++
++static int __maybe_unused imx519_resume(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx519 *imx519 = to_imx519(sd);
++	int ret;
++
++	if (imx519->streaming) {
++		ret = imx519_start_streaming(imx519);
++		if (ret)
++			goto error;
++	}
++
++	return 0;
++
++error:
++	imx519_stop_streaming(imx519);
++	imx519->streaming = 0;
++	return ret;
++}
++
++static int imx519_get_regulators(struct imx519 *imx519)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx519->sd);
++	unsigned int i;
++
++	for (i = 0; i < IMX519_NUM_SUPPLIES; i++)
++		imx519->supplies[i].supply = imx519_supply_name[i];
++
++	return devm_regulator_bulk_get(&client->dev,
++				       IMX519_NUM_SUPPLIES,
++				       imx519->supplies);
++}
++
++/* Verify chip ID */
++static int imx519_identify_module(struct imx519 *imx519, u32 expected_id)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx519->sd);
++	int ret;
++	u32 val;
++
++	ret = imx519_read_reg(imx519, IMX519_REG_CHIP_ID,
++			      IMX519_REG_VALUE_16BIT, &val);
++	if (ret) {
++		dev_err(&client->dev, "failed to read chip id %x, with error %d\n",
++			expected_id, ret);
++		return ret;
++	}
++
++	if (val != expected_id) {
++		dev_err(&client->dev, "chip id mismatch: %x!=%x\n",
++			expected_id, val);
++		return -EIO;
++	}
++
++	dev_info(&client->dev, "Device found is imx%x\n", val);
++
++	return 0;
++}
++
++static const struct v4l2_subdev_core_ops imx519_core_ops = {
++	.subscribe_event = v4l2_ctrl_subdev_subscribe_event,
++	.unsubscribe_event = v4l2_event_subdev_unsubscribe,
++};
++
++static const struct v4l2_subdev_video_ops imx519_video_ops = {
++	.s_stream = imx519_set_stream,
++};
++
++static const struct v4l2_subdev_pad_ops imx519_pad_ops = {
++	.enum_mbus_code = imx519_enum_mbus_code,
++	.get_fmt = imx519_get_pad_format,
++	.set_fmt = imx519_set_pad_format,
++	.get_selection = imx519_get_selection,
++	.enum_frame_size = imx519_enum_frame_size,
++};
++
++static const struct v4l2_subdev_ops imx519_subdev_ops = {
++	.core = &imx519_core_ops,
++	.video = &imx519_video_ops,
++	.pad = &imx519_pad_ops,
++};
++
++static const struct v4l2_subdev_internal_ops imx519_internal_ops = {
++	.open = imx519_open,
++};
++
++/* Initialize control handlers */
++static int imx519_init_controls(struct imx519 *imx519)
++{
++	struct v4l2_ctrl_handler *ctrl_hdlr;
++	struct i2c_client *client = v4l2_get_subdevdata(&imx519->sd);
++	struct v4l2_fwnode_device_properties props;
++	struct v4l2_ctrl *link_freq;
++	unsigned int i;
++	int ret;
++
++	ctrl_hdlr = &imx519->ctrl_handler;
++	ret = v4l2_ctrl_handler_init(ctrl_hdlr, 16);
++	if (ret)
++		return ret;
++
++	mutex_init(&imx519->mutex);
++	ctrl_hdlr->lock = &imx519->mutex;
++
++	/* By default, PIXEL_RATE is read only */
++	imx519->pixel_rate = v4l2_ctrl_new_std(ctrl_hdlr, &imx519_ctrl_ops,
++					       V4L2_CID_PIXEL_RATE,
++					       IMX519_PIXEL_RATE,
++					       IMX519_PIXEL_RATE, 1,
++					       IMX519_PIXEL_RATE);
++
++	/* LINK_FREQ is also read only */
++	link_freq =
++		v4l2_ctrl_new_int_menu(ctrl_hdlr, &imx519_ctrl_ops,
++				       V4L2_CID_LINK_FREQ,
++				       ARRAY_SIZE(imx519_link_freq_menu) - 1, 0,
++				       imx519_link_freq_menu);
++	if (link_freq)
++		link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++
++	/*
++	 * Create the controls here, but mode specific limits are setup
++	 * in the imx519_set_framing_limits() call below.
++	 */
++	imx519->vblank = v4l2_ctrl_new_std(ctrl_hdlr, &imx519_ctrl_ops,
++					   V4L2_CID_VBLANK, 0, 0xffff, 1, 0);
++	imx519->hblank = v4l2_ctrl_new_std(ctrl_hdlr, &imx519_ctrl_ops,
++					   V4L2_CID_HBLANK, 0, 0xffff, 1, 0);
++
++	/* HBLANK is read-only for now, but does change with mode. */
++	if (imx519->hblank)
++		imx519->hblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++
++	imx519->exposure = v4l2_ctrl_new_std(ctrl_hdlr, &imx519_ctrl_ops,
++					     V4L2_CID_EXPOSURE,
++					     IMX519_EXPOSURE_MIN,
++					     IMX519_EXPOSURE_MAX,
++					     IMX519_EXPOSURE_STEP,
++					     IMX519_EXPOSURE_DEFAULT);
++
++	v4l2_ctrl_new_std(ctrl_hdlr, &imx519_ctrl_ops, V4L2_CID_ANALOGUE_GAIN,
++			  IMX519_ANA_GAIN_MIN, IMX519_ANA_GAIN_MAX,
++			  IMX519_ANA_GAIN_STEP, IMX519_ANA_GAIN_DEFAULT);
++
++	v4l2_ctrl_new_std(ctrl_hdlr, &imx519_ctrl_ops, V4L2_CID_DIGITAL_GAIN,
++			  IMX519_DGTL_GAIN_MIN, IMX519_DGTL_GAIN_MAX,
++			  IMX519_DGTL_GAIN_STEP, IMX519_DGTL_GAIN_DEFAULT);
++
++	imx519->hflip = v4l2_ctrl_new_std(ctrl_hdlr, &imx519_ctrl_ops,
++					  V4L2_CID_HFLIP, 0, 1, 1, 0);
++	if (imx519->hflip)
++		imx519->hflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++
++	imx519->vflip = v4l2_ctrl_new_std(ctrl_hdlr, &imx519_ctrl_ops,
++					  V4L2_CID_VFLIP, 0, 1, 1, 0);
++	if (imx519->vflip)
++		imx519->vflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++
++	v4l2_ctrl_new_std_menu_items(ctrl_hdlr, &imx519_ctrl_ops,
++				     V4L2_CID_TEST_PATTERN,
++				     ARRAY_SIZE(imx519_test_pattern_menu) - 1,
++				     0, 0, imx519_test_pattern_menu);
++	for (i = 0; i < 4; i++) {
++		/*
++		 * The assumption is that
++		 * V4L2_CID_TEST_PATTERN_GREENR == V4L2_CID_TEST_PATTERN_RED + 1
++		 * V4L2_CID_TEST_PATTERN_BLUE   == V4L2_CID_TEST_PATTERN_RED + 2
++		 * V4L2_CID_TEST_PATTERN_GREENB == V4L2_CID_TEST_PATTERN_RED + 3
++		 */
++		v4l2_ctrl_new_std(ctrl_hdlr, &imx519_ctrl_ops,
++				  V4L2_CID_TEST_PATTERN_RED + i,
++				  IMX519_TEST_PATTERN_COLOUR_MIN,
++				  IMX519_TEST_PATTERN_COLOUR_MAX,
++				  IMX519_TEST_PATTERN_COLOUR_STEP,
++				  IMX519_TEST_PATTERN_COLOUR_MAX);
++		/* The "Solid color" pattern is white by default */
++	}
++
++	if (ctrl_hdlr->error) {
++		ret = ctrl_hdlr->error;
++		dev_err(&client->dev, "%s control init failed (%d)\n",
++			__func__, ret);
++		goto error;
++	}
++
++	ret = v4l2_fwnode_device_parse(&client->dev, &props);
++	if (ret)
++		goto error;
++
++	ret = v4l2_ctrl_new_fwnode_properties(ctrl_hdlr, &imx519_ctrl_ops,
++					      &props);
++	if (ret)
++		goto error;
++
++	imx519->sd.ctrl_handler = ctrl_hdlr;
++
++	/* Setup exposure and frame/line length limits. */
++	imx519_set_framing_limits(imx519);
++
++	return 0;
++
++error:
++	v4l2_ctrl_handler_free(ctrl_hdlr);
++	mutex_destroy(&imx519->mutex);
++
++	return ret;
++}
++
++static void imx519_free_controls(struct imx519 *imx519)
++{
++	v4l2_ctrl_handler_free(imx519->sd.ctrl_handler);
++	mutex_destroy(&imx519->mutex);
++}
++
++static int imx519_check_hwcfg(struct device *dev)
++{
++	struct fwnode_handle *endpoint;
++	struct v4l2_fwnode_endpoint ep_cfg = {
++		.bus_type = V4L2_MBUS_CSI2_DPHY
++	};
++	int ret = -EINVAL;
++
++	endpoint = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
++	if (!endpoint) {
++		dev_err(dev, "endpoint node not found\n");
++		return -EINVAL;
++	}
++
++	if (v4l2_fwnode_endpoint_alloc_parse(endpoint, &ep_cfg)) {
++		dev_err(dev, "could not parse endpoint\n");
++		goto error_out;
++	}
++
++	/* Check the number of MIPI CSI2 data lanes */
++	if (ep_cfg.bus.mipi_csi2.num_data_lanes != 2) {
++		dev_err(dev, "only 2 data lanes are currently supported\n");
++		goto error_out;
++	}
++
++	/* Check the link frequency set in device tree */
++	if (!ep_cfg.nr_of_link_frequencies) {
++		dev_err(dev, "link-frequency property not found in DT\n");
++		goto error_out;
++	}
++
++	if (ep_cfg.nr_of_link_frequencies != 1 ||
++	    ep_cfg.link_frequencies[0] != IMX519_DEFAULT_LINK_FREQ) {
++		dev_err(dev, "Link frequency not supported: %lld\n",
++			ep_cfg.link_frequencies[0]);
++		goto error_out;
++	}
++
++	ret = 0;
++
++error_out:
++	v4l2_fwnode_endpoint_free(&ep_cfg);
++	fwnode_handle_put(endpoint);
++
++	return ret;
++}
++
++static const struct of_device_id imx519_dt_ids[] = {
++	{ .compatible = "sony,imx519"},
++	{ /* sentinel */ }
++};
++
++static int imx519_probe(struct i2c_client *client)
++{
++	struct device *dev = &client->dev;
++	struct imx519 *imx519;
++	const struct of_device_id *match;
++	u32 xclk_freq;
++	int ret;
++
++	imx519 = devm_kzalloc(&client->dev, sizeof(*imx519), GFP_KERNEL);
++	if (!imx519)
++		return -ENOMEM;
++
++	v4l2_i2c_subdev_init(&imx519->sd, client, &imx519_subdev_ops);
++
++	match = of_match_device(imx519_dt_ids, dev);
++	if (!match)
++		return -ENODEV;
++
++	/* Check the hardware configuration in device tree */
++	if (imx519_check_hwcfg(dev))
++		return -EINVAL;
++
++	/* Get system clock (xclk) */
++	imx519->xclk = devm_clk_get(dev, NULL);
++	if (IS_ERR(imx519->xclk)) {
++		dev_err(dev, "failed to get xclk\n");
++		return PTR_ERR(imx519->xclk);
++	}
++
++	xclk_freq = clk_get_rate(imx519->xclk);
++	if (xclk_freq != IMX519_XCLK_FREQ) {
++		dev_err(dev, "xclk frequency not supported: %d Hz\n",
++			xclk_freq);
++		return -EINVAL;
++	}
++
++	ret = imx519_get_regulators(imx519);
++	if (ret) {
++		dev_err(dev, "failed to get regulators\n");
++		return ret;
++	}
++
++	/* Request optional enable pin */
++	imx519->reset_gpio = devm_gpiod_get_optional(dev, "reset",
++						     GPIOD_OUT_HIGH);
++
++	/*
++	 * The sensor must be powered for imx519_identify_module()
++	 * to be able to read the CHIP_ID register
++	 */
++	ret = imx519_power_on(dev);
++	if (ret)
++		return ret;
++
++	ret = imx519_identify_module(imx519, IMX519_CHIP_ID);
++	if (ret)
++		goto error_power_off;
++
++	/* Set default mode to max resolution */
++	imx519->mode = &supported_modes_10bit[0];
++	imx519->fmt_code = MEDIA_BUS_FMT_SRGGB10_1X10;
++
++	/* Enable runtime PM and turn off the device */
++	pm_runtime_set_active(dev);
++	pm_runtime_enable(dev);
++	pm_runtime_idle(dev);
++
++	/* This needs the pm runtime to be registered. */
++	ret = imx519_init_controls(imx519);
++	if (ret)
++		goto error_power_off;
++
++	/* Initialize subdev */
++	imx519->sd.internal_ops = &imx519_internal_ops;
++	imx519->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE |
++			    V4L2_SUBDEV_FL_HAS_EVENTS;
++	imx519->sd.entity.function = MEDIA_ENT_F_CAM_SENSOR;
++
++	/* Initialize source pads */
++	imx519->pad[IMAGE_PAD].flags = MEDIA_PAD_FL_SOURCE;
++	imx519->pad[METADATA_PAD].flags = MEDIA_PAD_FL_SOURCE;
++
++	ret = media_entity_pads_init(&imx519->sd.entity, NUM_PADS, imx519->pad);
++	if (ret) {
++		dev_err(dev, "failed to init entity pads: %d\n", ret);
++		goto error_handler_free;
++	}
++
++	ret = v4l2_async_register_subdev_sensor(&imx519->sd);
++	if (ret < 0) {
++		dev_err(dev, "failed to register sensor sub-device: %d\n", ret);
++		goto error_media_entity;
++	}
++
++	return 0;
++
++error_media_entity:
++	media_entity_cleanup(&imx519->sd.entity);
++
++error_handler_free:
++	imx519_free_controls(imx519);
++
++error_power_off:
++	pm_runtime_disable(&client->dev);
++	pm_runtime_set_suspended(&client->dev);
++	imx519_power_off(&client->dev);
++
++	return ret;
++}
++
++static void imx519_remove(struct i2c_client *client)
++{
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx519 *imx519 = to_imx519(sd);
++
++	v4l2_async_unregister_subdev(sd);
++	media_entity_cleanup(&sd->entity);
++	imx519_free_controls(imx519);
++
++	pm_runtime_disable(&client->dev);
++	if (!pm_runtime_status_suspended(&client->dev))
++		imx519_power_off(&client->dev);
++	pm_runtime_set_suspended(&client->dev);
++}
++
++MODULE_DEVICE_TABLE(of, imx519_dt_ids);
++
++static const struct dev_pm_ops imx519_pm_ops = {
++	SET_SYSTEM_SLEEP_PM_OPS(imx519_suspend, imx519_resume)
++	SET_RUNTIME_PM_OPS(imx519_power_off, imx519_power_on, NULL)
++};
++
++static struct i2c_driver imx519_i2c_driver = {
++	.driver = {
++		.name = "imx519",
++		.of_match_table	= imx519_dt_ids,
++		.pm = &imx519_pm_ops,
++	},
++	.probe = imx519_probe,
++	.remove = imx519_remove,
++};
++
++module_i2c_driver(imx519_i2c_driver);
++
++MODULE_AUTHOR("Lee Jackson <info@arducam.com>");
++MODULE_DESCRIPTION("Sony IMX519 sensor driver");
++MODULE_LICENSE("GPL v2");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0138-drivers-media-imx296-Disable-2x2-binned-mode.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0138-drivers-media-imx296-Disable-2x2-binned-mode.patch
new file mode 100644
index 00000000..b6881259
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0138-drivers-media-imx296-Disable-2x2-binned-mode.patch
@@ -0,0 +1,63 @@
+From 52743d83bbfb44642f913d8571f5494cd5938f18 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Wed, 31 May 2023 15:51:58 +0100
+Subject: [PATCH 138/697] drivers: media: imx296: Disable 2x2 binned mode
+
+Disable enumerating and setting of the 2x2 binned mode entirely as it
+does not seem to work for either mono or colour sensor variants.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/i2c/imx296.c | 34 +++++++---------------------------
+ 1 file changed, 7 insertions(+), 27 deletions(-)
+
+--- a/drivers/media/i2c/imx296.c
++++ b/drivers/media/i2c/imx296.c
+@@ -664,7 +664,11 @@ static int imx296_enum_frame_size(struct
+ 
+ 	format = v4l2_subdev_state_get_format(state, fse->pad);
+ 
+-	if (fse->index >= 2 || fse->code != format->code)
++	/*
++	 * Binning does not seem to work on either mono or colour sensor
++	 * variants. Disable enumerating the binned frame size for now.
++	 */
++	if (fse->index >= 1 || fse->code != format->code)
+ 		return -EINVAL;
+ 
+ 	fse->min_width = IMX296_PIXEL_ARRAY_WIDTH / (fse->index + 1);
+@@ -686,32 +690,8 @@ static int imx296_set_format(struct v4l2
+ 	crop = v4l2_subdev_state_get_crop(state, fmt->pad);
+ 	format = v4l2_subdev_state_get_format(state, fmt->pad);
+ 
+-	/*
+-	 * Binning is only allowed when cropping is disabled according to the
+-	 * documentation. This should be double-checked.
+-	 */
+-	if (crop->width == IMX296_PIXEL_ARRAY_WIDTH &&
+-	    crop->height == IMX296_PIXEL_ARRAY_HEIGHT) {
+-		unsigned int width;
+-		unsigned int height;
+-		unsigned int hratio;
+-		unsigned int vratio;
+-
+-		/* Clamp the width and height to avoid dividing by zero. */
+-		width = clamp_t(unsigned int, fmt->format.width,
+-				crop->width / 2, crop->width);
+-		height = clamp_t(unsigned int, fmt->format.height,
+-				 crop->height / 2, crop->height);
+-
+-		hratio = DIV_ROUND_CLOSEST(crop->width, width);
+-		vratio = DIV_ROUND_CLOSEST(crop->height, height);
+-
+-		format->width = crop->width / hratio;
+-		format->height = crop->height / vratio;
+-	} else {
+-		format->width = crop->width;
+-		format->height = crop->height;
+-	}
++	format->width = crop->width;
++	format->height = crop->height;
+ 
+ 	format->code = sensor->mono ? MEDIA_BUS_FMT_Y10_1X10
+ 		     : MEDIA_BUS_FMT_SBGGR10_1X10;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0139-drivers-media-imx296-Add-standby-delay-during-probe.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0139-drivers-media-imx296-Add-standby-delay-during-probe.patch
new file mode 100644
index 00000000..65bf0fc5
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0139-drivers-media-imx296-Add-standby-delay-during-probe.patch
@@ -0,0 +1,26 @@
+From 9657789d284088c4a30634eb802b330df49fdc5f Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Fri, 28 Jul 2023 12:00:40 +0100
+Subject: [PATCH 139/697] drivers: media: imx296: Add standby delay during
+ probe
+
+Add a 2-5ms delay when coming out of standby and before reading the
+sensor info register durning probe, as instructed by the datasheet. This
+standby delay is already present when the sensor starts streaming.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/i2c/imx296.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/media/i2c/imx296.c
++++ b/drivers/media/i2c/imx296.c
+@@ -934,6 +934,8 @@ static int imx296_identify_model(struct
+ 		return ret;
+ 	}
+ 
++	usleep_range(2000, 5000);
++
+ 	ret = imx296_read(sensor, IMX296_SENSOR_INFO);
+ 	if (ret < 0) {
+ 		dev_err(sensor->dev, "failed to read sensor information (%d)\n",
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0140-drivers-media-imx296-Updated-imx296-driver-for-exter.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0140-drivers-media-imx296-Updated-imx296-driver-for-exter.patch
new file mode 100644
index 00000000..70dd6bf1
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0140-drivers-media-imx296-Updated-imx296-driver-for-exter.patch
@@ -0,0 +1,40 @@
+From 11a086ad55bdca4d064c749d2a29e11c02bac0c5 Mon Sep 17 00:00:00 2001
+From: Ben Benson <ben.benson@raspberrypi.com>
+Date: Fri, 21 Jul 2023 15:59:51 +0100
+Subject: [PATCH 140/697] drivers: media: imx296: Updated imx296 driver for
+ external trigger
+
+Updated imx296 driver to support external trigger mode via XTR pin.
+Added module parameter to control this mode.
+
+Signed-off-by: Ben Benson <ben.benson@raspberrypi.com>
+---
+ drivers/media/i2c/imx296.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/media/i2c/imx296.c
++++ b/drivers/media/i2c/imx296.c
+@@ -20,6 +20,10 @@
+ #include <media/v4l2-fwnode.h>
+ #include <media/v4l2-subdev.h>
+ 
++static int trigger_mode;
++module_param(trigger_mode, int, 0644);
++MODULE_PARM_DESC(trigger_mode, "Set trigger mode: 0=default, 1=XTRIG");
++
+ #define IMX296_PIXEL_ARRAY_WIDTH			1456
+ #define IMX296_PIXEL_ARRAY_HEIGHT			1088
+ 
+@@ -578,6 +582,12 @@ static int imx296_stream_on(struct imx29
+ 
+ 	imx296_write(sensor, IMX296_CTRL00, 0, &ret);
+ 	usleep_range(2000, 5000);
++
++	if (trigger_mode == 1) {
++		imx296_write(sensor, IMX296_CTRL0B, IMX296_CTRL0B_TRIGEN, &ret);
++		imx296_write(sensor, IMX296_LOWLAGTRG,  IMX296_LOWLAGTRG_FAST, &ret);
++	}
++
+ 	imx296_write(sensor, IMX296_CTRL0A, 0, &ret);
+ 
+ 	return ret;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0141-drivers-media-i2c-imx296-imx477-Configure-tigger_mod.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0141-drivers-media-i2c-imx296-imx477-Configure-tigger_mod.patch
new file mode 100644
index 00000000..4ba23aa5
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0141-drivers-media-i2c-imx296-imx477-Configure-tigger_mod.patch
@@ -0,0 +1,34 @@
+From e9c42f1df45aac1ed146f5e21d0a7bfe5e3f34a3 Mon Sep 17 00:00:00 2001
+From: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+Date: Wed, 6 Dec 2023 14:27:57 +0000
+Subject: [PATCH 141/697] drivers: media: i2c: imx296,imx477: Configure
+ tigger_mode every time
+
+Don't assume the camera has been reset each time we start streaming,
+but always write registers relating to trigger_mode, even in mode 0.
+
+IMX477: Stop driving XVS on stop streaming, to avoid spurious pulses.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+---
+ drivers/media/i2c/imx296.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/i2c/imx296.c
++++ b/drivers/media/i2c/imx296.c
+@@ -583,10 +583,11 @@ static int imx296_stream_on(struct imx29
+ 	imx296_write(sensor, IMX296_CTRL00, 0, &ret);
+ 	usleep_range(2000, 5000);
+ 
+-	if (trigger_mode == 1) {
+-		imx296_write(sensor, IMX296_CTRL0B, IMX296_CTRL0B_TRIGEN, &ret);
+-		imx296_write(sensor, IMX296_LOWLAGTRG,  IMX296_LOWLAGTRG_FAST, &ret);
+-	}
++	/* external trigger mode: 0=normal, 1=triggered */
++	imx296_write(sensor, IMX296_CTRL0B,
++		     (trigger_mode == 1) ? IMX296_CTRL0B_TRIGEN : 0, &ret);
++	imx296_write(sensor, IMX296_LOWLAGTRG,
++		     (trigger_mode == 1) ? IMX296_LOWLAGTRG_FAST : 0, &ret);
+ 
+ 	imx296_write(sensor, IMX296_CTRL0A, 0, &ret);
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0142-media-i2c-imx296-Updated-register-setting-to-fix-Fas.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0142-media-i2c-imx296-Updated-register-setting-to-fix-Fas.patch
new file mode 100644
index 00000000..64bc7d2d
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0142-media-i2c-imx296-Updated-register-setting-to-fix-Fas.patch
@@ -0,0 +1,25 @@
+From 9aab3fcc4159271ded9c04d40891415ec7178267 Mon Sep 17 00:00:00 2001
+From: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+Date: Mon, 4 Mar 2024 16:59:54 +0000
+Subject: [PATCH 142/697] media: i2c: imx296: Updated register setting to fix
+ Fast Trigger
+
+In Fast Trigger mode (external shutter control), FE packet was
+not sent at end of frame. Sony recommend this change to fix it.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+---
+ drivers/media/i2c/imx296.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/imx296.c
++++ b/drivers/media/i2c/imx296.c
+@@ -472,7 +472,7 @@ static const struct {
+ 	{ IMX296_REG_8BIT(0x30a4), 0x5f },
+ 	{ IMX296_REG_8BIT(0x30a8), 0x91 },
+ 	{ IMX296_REG_8BIT(0x30ac), 0x28 },
+-	{ IMX296_REG_8BIT(0x30af), 0x09 },
++	{ IMX296_REG_8BIT(0x30af), 0x0b },
+ 	{ IMX296_REG_8BIT(0x30df), 0x00 },
+ 	{ IMX296_REG_8BIT(0x3165), 0x00 },
+ 	{ IMX296_REG_8BIT(0x3169), 0x10 },
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0143-media-i2c-imx296-Get-sensor-crop-working.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0143-media-i2c-imx296-Get-sensor-crop-working.patch
new file mode 100644
index 00000000..979a7521
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0143-media-i2c-imx296-Get-sensor-crop-working.patch
@@ -0,0 +1,35 @@
+From ed2113ef18c6dc0887c583bba36e821134c2a8f2 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Tue, 14 Mar 2023 10:10:01 +0000
+Subject: [PATCH 143/697] media: i2c: imx296: Get sensor crop working
+
+Add a missing register write (MIPIC_AREA3W) when setting up a crop
+window in the sensor to get this functionality working.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/i2c/imx296.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/media/i2c/imx296.c
++++ b/drivers/media/i2c/imx296.c
+@@ -175,6 +175,7 @@ MODULE_PARM_DESC(trigger_mode, "Set trig
+ #define IMX296_CKREQSEL					IMX296_REG_8BIT(0x4101)
+ #define IMX296_CKREQSEL_HS				BIT(2)
+ #define IMX296_GTTABLENUM				IMX296_REG_8BIT(0x4114)
++#define IMX296_MIPIC_AREA3W				IMX296_REG_16BIT(0x4182)
+ #define IMX296_CTRL418C					IMX296_REG_8BIT(0x418c)
+ 
+ struct imx296_clk_params {
+@@ -530,8 +531,11 @@ static int imx296_setup(struct imx296 *s
+ 		imx296_write(sensor, IMX296_FID0_ROIPV1, crop->top, &ret);
+ 		imx296_write(sensor, IMX296_FID0_ROIWH1, crop->width, &ret);
+ 		imx296_write(sensor, IMX296_FID0_ROIWV1, crop->height, &ret);
++		imx296_write(sensor, IMX296_MIPIC_AREA3W, crop->height, &ret);
+ 	} else {
+ 		imx296_write(sensor, IMX296_FID0_ROI, 0, &ret);
++		imx296_write(sensor, IMX296_MIPIC_AREA3W,
++			     IMX296_PIXEL_ARRAY_HEIGHT, &ret);
+ 	}
+ 
+ 	imx296_write(sensor, IMX296_CTRL0D,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0144-media-i2c-imx296-Add-helper-for-hblank-control.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0144-media-i2c-imx296-Add-helper-for-hblank-control.patch
new file mode 100644
index 00000000..0c52f25b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0144-media-i2c-imx296-Add-helper-for-hblank-control.patch
@@ -0,0 +1,84 @@
+From 219186e70ad651128bcb49134eb55e4be5c2dedf Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Tue, 14 Mar 2023 12:56:14 +0000
+Subject: [PATCH 144/697] media: i2c: imx296: Add helper for hblank control
+
+Add a helper function to setup the horizontal blanking control. Update
+the control limits on set_format as the horizontal blanking time must
+remain constant regardless of sensor output width.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/i2c/imx296.c | 44 ++++++++++++++++++++++++++------------
+ 1 file changed, 30 insertions(+), 14 deletions(-)
+
+--- a/drivers/media/i2c/imx296.c
++++ b/drivers/media/i2c/imx296.c
+@@ -388,10 +388,36 @@ static const struct v4l2_ctrl_ops imx296
+ 	.s_ctrl = imx296_s_ctrl,
+ };
+ 
++static void imx296_setup_hblank(struct imx296 *sensor, unsigned int width)
++{
++	/*
++	 * Horizontal blanking is controlled through the HMAX register, which
++	 * contains a line length in contains a line length in units of an
++	 * internal 74.25 MHz clock derived from the INCLK. The HMAX value is
++	 * currently fixed to 1100, convert it to a number of pixels based on
++	 * the nominal pixel rate.
++	 *
++	 * Horizontal blanking is fixed, regardless of the crop width, so
++	 * ensure the hblank limits are adjusted to account for this.
++	 */
++	unsigned int hblank = 1100 * 1188000000ULL / 10 / 74250000 - width;
++
++	if (!sensor->hblank) {
++		sensor->hblank = v4l2_ctrl_new_std(&sensor->ctrls,
++						   &imx296_ctrl_ops,
++						   V4L2_CID_HBLANK, hblank,
++						   hblank, 1, hblank);
++		if (sensor->hblank)
++			sensor->hblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++	} else {
++		__v4l2_ctrl_modify_range(sensor->hblank, hblank, hblank, 1,
++					 hblank);
++	}
++}
++
+ static int imx296_ctrls_init(struct imx296 *sensor)
+ {
+ 	struct v4l2_fwnode_device_properties props;
+-	unsigned int hblank;
+ 	int ret;
+ 
+ 	ret = v4l2_fwnode_device_parse(sensor->dev, &props);
+@@ -406,19 +432,7 @@ static int imx296_ctrls_init(struct imx2
+ 			  V4L2_CID_ANALOGUE_GAIN, IMX296_GAIN_MIN,
+ 			  IMX296_GAIN_MAX, 1, IMX296_GAIN_MIN);
+ 
+-	/*
+-	 * Horizontal blanking is controlled through the HMAX register, which
+-	 * contains a line length in INCK clock units. The INCK frequency is
+-	 * fixed to 74.25 MHz. The HMAX value is currently fixed to 1100,
+-	 * convert it to a number of pixels based on the nominal pixel rate.
+-	 */
+-	hblank = 1100 * 1188000000ULL / 10 / 74250000
+-	       - IMX296_PIXEL_ARRAY_WIDTH;
+-	sensor->hblank = v4l2_ctrl_new_std(&sensor->ctrls, &imx296_ctrl_ops,
+-					   V4L2_CID_HBLANK, hblank, hblank, 1,
+-					   hblank);
+-	if (sensor->hblank)
+-		sensor->hblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++	imx296_setup_hblank(sensor, IMX296_PIXEL_ARRAY_WIDTH);
+ 
+ 	sensor->vblank = v4l2_ctrl_new_std(&sensor->ctrls, &imx296_ctrl_ops,
+ 					   V4L2_CID_VBLANK, 30,
+@@ -708,6 +722,8 @@ static int imx296_set_format(struct v4l2
+ 	format->width = crop->width;
+ 	format->height = crop->height;
+ 
++	imx296_setup_hblank(sensor, format->width);
++
+ 	format->code = sensor->mono ? MEDIA_BUS_FMT_Y10_1X10
+ 		     : MEDIA_BUS_FMT_SBGGR10_1X10;
+ 	format->field = V4L2_FIELD_NONE;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0145-media-i2c-imx296-Set-a-1-frame-gain-delay.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0145-media-i2c-imx296-Set-a-1-frame-gain-delay.patch
new file mode 100644
index 00000000..c3cb0f54
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0145-media-i2c-imx296-Set-a-1-frame-gain-delay.patch
@@ -0,0 +1,25 @@
+From d04e841924fd1a074438ff3f5f5b293c422d7d38 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Tue, 14 Mar 2023 10:46:46 +0000
+Subject: [PATCH 145/697] media: i2c: imx296: Set a 1 frame gain delay
+
+Set the gain delay to 1 frame in the sensor. This avoids any race
+condition or ambiguity over when the setting is applied through
+userland.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/i2c/imx296.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/imx296.c
++++ b/drivers/media/i2c/imx296.c
+@@ -588,7 +588,7 @@ static int imx296_setup(struct imx296 *s
+ 	imx296_write(sensor, IMX296_CTRL418C, sensor->clk_params->ctrl418c,
+ 		     &ret);
+ 
+-	imx296_write(sensor, IMX296_GAINDLY, IMX296_GAINDLY_NONE, &ret);
++	imx296_write(sensor, IMX296_GAINDLY, IMX296_GAINDLY_1FRAME, &ret);
+ 	imx296_write(sensor, IMX296_BLKLEVEL, 0x03c, &ret);
+ 
+ 	return ret;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0146-media-i2c-imx296-Add-horizontal-vertical-flip-suppor.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0146-media-i2c-imx296-Add-horizontal-vertical-flip-suppor.patch
new file mode 100644
index 00000000..7095d248
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0146-media-i2c-imx296-Add-horizontal-vertical-flip-suppor.patch
@@ -0,0 +1,158 @@
+From 1cf0c2a79736f0ecc2c48080f84a295b409c7199 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Tue, 14 Mar 2023 11:00:48 +0000
+Subject: [PATCH 146/697] media: i2c: imx296: Add horizontal/vertical flip
+ support
+
+Add support for setting horizontal and/or vertial flips in the IMX296
+sensor through the V4L2_CID_HFLIP and V4L2_CID_VFLIP controls.
+
+Add a new helper function to return the media bus format code that
+depends on the sensor flips.
+
+Grab the V4L2_CID_HFLIP and V4L2_CID_VFLIP controls on stream on, and
+release on stream off to ensure flips cannot be changed while the sensor
+is streaming.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/i2c/imx296.c | 65 +++++++++++++++++++++++++++++++++++---
+ 1 file changed, 60 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/i2c/imx296.c
++++ b/drivers/media/i2c/imx296.c
+@@ -212,6 +212,8 @@ struct imx296 {
+ 	struct v4l2_ctrl_handler ctrls;
+ 	struct v4l2_ctrl *hblank;
+ 	struct v4l2_ctrl *vblank;
++	struct v4l2_ctrl *vflip;
++	struct v4l2_ctrl *hflip;
+ };
+ 
+ static inline struct imx296 *to_imx296(struct v4l2_subdev *sd)
+@@ -253,6 +255,36 @@ static int imx296_write(struct imx296 *s
+ 	return ret;
+ }
+ 
++/*
++ * The supported formats.
++ * This table MUST contain 4 entries per format, to cover the various flip
++ * combinations in the order
++ * - no flip
++ * - h flip
++ * - v flip
++ * - h&v flips
++ */
++static const u32 mbus_codes[] = {
++	/* 10-bit modes. */
++	MEDIA_BUS_FMT_SRGGB10_1X10,
++	MEDIA_BUS_FMT_SGRBG10_1X10,
++	MEDIA_BUS_FMT_SGBRG10_1X10,
++	MEDIA_BUS_FMT_SBGGR10_1X10,
++};
++
++static u32 imx296_mbus_code(const struct imx296 *sensor)
++{
++	unsigned int i = 0;
++
++	if (sensor->mono)
++		return MEDIA_BUS_FMT_Y10_1X10;
++
++	if (sensor->vflip && sensor->hflip)
++		i = (sensor->vflip->val ? 2 : 0) | (sensor->hflip->val ? 1 : 0);
++
++	return mbus_codes[i];
++}
++
+ static int imx296_power_on(struct imx296 *sensor)
+ {
+ 	int ret;
+@@ -347,6 +379,13 @@ static int imx296_s_ctrl(struct v4l2_ctr
+ 			     &ret);
+ 		break;
+ 
++	case V4L2_CID_HFLIP:
++	case V4L2_CID_VFLIP:
++		imx296_write(sensor, IMX296_CTRL0E,
++			     sensor->vflip->val | (sensor->hflip->val << 1),
++			     &ret);
++		break;
++
+ 	case V4L2_CID_TEST_PATTERN:
+ 		if (ctrl->val) {
+ 			imx296_write(sensor, IMX296_PGHPOS, 8, &ret);
+@@ -432,6 +471,16 @@ static int imx296_ctrls_init(struct imx2
+ 			  V4L2_CID_ANALOGUE_GAIN, IMX296_GAIN_MIN,
+ 			  IMX296_GAIN_MAX, 1, IMX296_GAIN_MIN);
+ 
++	sensor->hflip = v4l2_ctrl_new_std(&sensor->ctrls, &imx296_ctrl_ops,
++					  V4L2_CID_HFLIP, 0, 1, 1, 0);
++	if (sensor->hflip && !sensor->mono)
++		sensor->hflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++
++	sensor->vflip = v4l2_ctrl_new_std(&sensor->ctrls, &imx296_ctrl_ops,
++					  V4L2_CID_VFLIP, 0, 1, 1, 0);
++	if (sensor->vflip && !sensor->mono)
++		sensor->vflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++
+ 	imx296_setup_hblank(sensor, IMX296_PIXEL_ARRAY_WIDTH);
+ 
+ 	sensor->vblank = v4l2_ctrl_new_std(&sensor->ctrls, &imx296_ctrl_ops,
+@@ -609,6 +658,10 @@ static int imx296_stream_on(struct imx29
+ 
+ 	imx296_write(sensor, IMX296_CTRL0A, 0, &ret);
+ 
++	/* vflip and hflip cannot change during streaming */
++	__v4l2_ctrl_grab(sensor->vflip, 1);
++	__v4l2_ctrl_grab(sensor->hflip, 1);
++
+ 	return ret;
+ }
+ 
+@@ -619,6 +672,9 @@ static int imx296_stream_off(struct imx2
+ 	imx296_write(sensor, IMX296_CTRL0A, IMX296_CTRL0A_XMSTA, &ret);
+ 	imx296_write(sensor, IMX296_CTRL00, IMX296_CTRL00_STANDBY, &ret);
+ 
++	__v4l2_ctrl_grab(sensor->vflip, 0);
++	__v4l2_ctrl_grab(sensor->hflip, 0);
++
+ 	return ret;
+ }
+ 
+@@ -679,8 +735,7 @@ static int imx296_enum_mbus_code(struct
+ 	if (code->index != 0)
+ 		return -EINVAL;
+ 
+-	code->code = sensor->mono ? MEDIA_BUS_FMT_Y10_1X10
+-		   : MEDIA_BUS_FMT_SBGGR10_1X10;
++	code->code = imx296_mbus_code(sensor);
+ 
+ 	return 0;
+ }
+@@ -690,6 +745,7 @@ static int imx296_enum_frame_size(struct
+ 				  struct v4l2_subdev_frame_size_enum *fse)
+ {
+ 	const struct v4l2_mbus_framefmt *format;
++	struct imx296 *sensor = to_imx296(sd);
+ 
+ 	format = v4l2_subdev_state_get_format(state, fse->pad);
+ 
+@@ -697,7 +753,7 @@ static int imx296_enum_frame_size(struct
+ 	 * Binning does not seem to work on either mono or colour sensor
+ 	 * variants. Disable enumerating the binned frame size for now.
+ 	 */
+-	if (fse->index >= 1 || fse->code != format->code)
++	if (fse->index >= 1 || fse->code != imx296_mbus_code(sensor))
+ 		return -EINVAL;
+ 
+ 	fse->min_width = IMX296_PIXEL_ARRAY_WIDTH / (fse->index + 1);
+@@ -724,8 +780,7 @@ static int imx296_set_format(struct v4l2
+ 
+ 	imx296_setup_hblank(sensor, format->width);
+ 
+-	format->code = sensor->mono ? MEDIA_BUS_FMT_Y10_1X10
+-		     : MEDIA_BUS_FMT_SBGGR10_1X10;
++	format->code = imx296_mbus_code(sensor);
+ 	format->field = V4L2_FIELD_NONE;
+ 	format->colorspace = V4L2_COLORSPACE_RAW;
+ 	format->ycbcr_enc = V4L2_YCBCR_ENC_DEFAULT;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0147-media-i2c-imx296-Adjust-cropping-limits.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0147-media-i2c-imx296-Adjust-cropping-limits.patch
new file mode 100644
index 00000000..450d38e6
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0147-media-i2c-imx296-Adjust-cropping-limits.patch
@@ -0,0 +1,28 @@
+From b0e32b89bfb37573457881f43a26176478c1ae50 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Thu, 16 Mar 2023 09:29:41 +0000
+Subject: [PATCH 147/697] media: i2c: imx296: Adjust cropping limits
+
+Through emperical testing, the sensor can crop upto a 96x88 window to
+produce a valid Bayer frame. Adjust the ROIWH1_MIN ROIWV1_MIN
+appropriately for this limit.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/i2c/imx296.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/imx296.c
++++ b/drivers/media/i2c/imx296.c
+@@ -154,9 +154,9 @@ MODULE_PARM_DESC(trigger_mode, "Set trig
+ #define IMX296_FID0_ROIPH1				IMX296_REG_16BIT(0x3310)
+ #define IMX296_FID0_ROIPV1				IMX296_REG_16BIT(0x3312)
+ #define IMX296_FID0_ROIWH1				IMX296_REG_16BIT(0x3314)
+-#define IMX296_FID0_ROIWH1_MIN				80
++#define IMX296_FID0_ROIWH1_MIN				96
+ #define IMX296_FID0_ROIWV1				IMX296_REG_16BIT(0x3316)
+-#define IMX296_FID0_ROIWV1_MIN				4
++#define IMX296_FID0_ROIWV1_MIN				88
+ 
+ #define IMX296_CM_HSST_STARTTMG				IMX296_REG_16BIT(0x4018)
+ #define IMX296_CM_HSST_ENDTMG				IMX296_REG_16BIT(0x401a)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0148-Documentation-devicetree-Add-documentation-for-imx37.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0148-Documentation-devicetree-Add-documentation-for-imx37.patch
new file mode 100644
index 00000000..34d59adc
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0148-Documentation-devicetree-Add-documentation-for-imx37.patch
@@ -0,0 +1,142 @@
+From 75981c30ee2c8ea2f76ae57506b8e6f70e4925b4 Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.com>
+Date: Tue, 29 Jun 2021 14:38:23 +0100
+Subject: [PATCH 148/697] Documentation: devicetree: Add documentation for
+ imx378 sensor
+
+The imx378 sensor is compatible with the imx477 and shares common
+device tree settings.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ .../devicetree/bindings/media/i2c/imx378.yaml | 113 ++++++++++++++++++
+ MAINTAINERS                                   |   1 +
+ 2 files changed, 114 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/media/i2c/imx378.yaml
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/i2c/imx378.yaml
+@@ -0,0 +1,113 @@
++# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/media/i2c/imx378.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Sony 1/2.3-Inch 12Mpixel CMOS Digital Image Sensor
++
++maintainers:
++  - Naushir Patuck <naush@raspberypi.com>
++
++description: |-
++  The Sony IMX378 is a 1/2.3-inch CMOS active pixel digital image sensor
++  with an active array size of 4056H x 3040V. It is programmable through
++  I2C interface. The I2C address is fixed to 0x1A as per sensor data sheet.
++  Image data is sent through MIPI CSI-2, which is configured as either 2 or
++  4 data lanes.
++
++properties:
++  compatible:
++    const: sony,imx378
++
++  reg:
++    description: I2C device address
++    maxItems: 1
++
++  clocks:
++    maxItems: 1
++
++  VDIG-supply:
++    description:
++      Digital I/O voltage supply, 1.05 volts
++
++  VANA-supply:
++    description:
++      Analog voltage supply, 2.8 volts
++
++  VDDL-supply:
++    description:
++      Digital core voltage supply, 1.8 volts
++
++  reset-gpios:
++    description: |-
++      Reference to the GPIO connected to the xclr pin, if any.
++      Must be released (set high) after all supplies and INCK are applied.
++
++  # See ../video-interfaces.txt for more details
++  port:
++    type: object
++    properties:
++      endpoint:
++        type: object
++        properties:
++          data-lanes:
++            description: |-
++              The sensor supports either two-lane, or four-lane operation.
++              For two-lane operation the property must be set to <1 2>.
++            items:
++              - const: 1
++              - const: 2
++
++          clock-noncontinuous:
++            type: boolean
++            description: |-
++              MIPI CSI-2 clock is non-continuous if this property is present,
++              otherwise it's continuous.
++
++          link-frequencies:
++            allOf:
++              - $ref: /schemas/types.yaml#/definitions/uint64-array
++            description:
++              Allowed data bus frequencies.
++
++        required:
++          - link-frequencies
++
++required:
++  - compatible
++  - reg
++  - clocks
++  - VANA-supply
++  - VDIG-supply
++  - VDDL-supply
++  - port
++
++additionalProperties: false
++
++examples:
++  - |
++    i2c0 {
++        #address-cells = <1>;
++        #size-cells = <0>;
++
++        imx378: sensor@10 {
++            compatible = "sony,imx378";
++            reg = <0x1a>;
++            clocks = <&imx378_clk>;
++            VANA-supply = <&imx378_vana>;   /* 2.8v */
++            VDIG-supply = <&imx378_vdig>;   /* 1.05v */
++            VDDL-supply = <&imx378_vddl>;   /* 1.8v */
++
++            port {
++                imx378_0: endpoint {
++                    remote-endpoint = <&csi1_ep>;
++                    data-lanes = <1 2>;
++                    clock-noncontinuous;
++                    link-frequencies = /bits/ 64 <450000000>;
++                };
++            };
++        };
++    };
++
++...
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -21545,6 +21545,7 @@ M:	Raspberry Pi Kernel Maintenance <kern
+ L:	linux-media@vger.kernel.org
+ S:	Maintained
+ T:	git git://linuxtv.org/media_tree.git
++F:	Documentation/devicetree/bindings/media/i2c/imx378.yaml
+ F:	Documentation/devicetree/bindings/media/i2c/imx477.yaml
+ F:	drivers/media/i2c/imx477.c
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0149-v4l2-Add-a-Greyworld-AWB-mode.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0149-v4l2-Add-a-Greyworld-AWB-mode.patch
new file mode 100644
index 00000000..9950672d
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0149-v4l2-Add-a-Greyworld-AWB-mode.patch
@@ -0,0 +1,23 @@
+From 07c0a0307c7bbbb55056b274301205e4ebe5e72b Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Fri, 6 Sep 2019 15:04:51 +0100
+Subject: [PATCH 149/697] v4l2: Add a Greyworld AWB mode.
+
+Adds a simple greyworld white balance preset, mainly for use
+with cameras without an IR filter (eg Raspberry Pi NoIR)
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ include/uapi/linux/v4l2-controls.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/uapi/linux/v4l2-controls.h
++++ b/include/uapi/linux/v4l2-controls.h
+@@ -1018,6 +1018,7 @@ enum v4l2_auto_n_preset_white_balance {
+ 	V4L2_WHITE_BALANCE_FLASH		= 7,
+ 	V4L2_WHITE_BALANCE_CLOUDY		= 8,
+ 	V4L2_WHITE_BALANCE_SHADE		= 9,
++	V4L2_WHITE_BALANCE_GREYWORLD		= 10,
+ };
+ 
+ #define V4L2_CID_WIDE_DYNAMIC_RANGE		(V4L2_CID_CAMERA_CLASS_BASE+21)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0150-staging-bcm2835-camera-Add-greyworld-AWB-mode.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0150-staging-bcm2835-camera-Add-greyworld-AWB-mode.patch
new file mode 100644
index 00000000..fe33bff4
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0150-staging-bcm2835-camera-Add-greyworld-AWB-mode.patch
@@ -0,0 +1,48 @@
+From 335d64c78fabcb7abafcbadef2a696b027a375cc Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Fri, 6 Sep 2019 15:13:06 +0100
+Subject: [PATCH 150/697] staging: bcm2835-camera: Add greyworld AWB mode
+
+This is mainly used for the NoIR camera which has no IR
+filter and can completely confuse normal AWB presets.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/staging/vc04_services/bcm2835-camera/controls.c   | 8 ++++++--
+ .../staging/vc04_services/vchiq-mmal/mmal-parameters.h    | 1 +
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-camera/controls.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/controls.c
+@@ -468,6 +468,10 @@ static int ctrl_set_awb_mode(struct bcm2
+ 	case V4L2_WHITE_BALANCE_SHADE:
+ 		u32_value = MMAL_PARAM_AWBMODE_SHADE;
+ 		break;
++
++	case V4L2_WHITE_BALANCE_GREYWORLD:
++		u32_value = MMAL_PARAM_AWBMODE_GREYWORLD;
++		break;
+ 	}
+ 
+ 	return vchiq_mmal_port_parameter_set(dev->instance, control,
+@@ -1046,8 +1050,8 @@ static const struct bcm2835_mmal_v4l2_ct
+ 	{
+ 		.id = V4L2_CID_AUTO_N_PRESET_WHITE_BALANCE,
+ 		.type = MMAL_CONTROL_TYPE_STD_MENU,
+-		.min = ~0x3ff,
+-		.max = V4L2_WHITE_BALANCE_SHADE,
++		.min = ~0x7ff,
++		.max = V4L2_WHITE_BALANCE_GREYWORLD,
+ 		.def = V4L2_WHITE_BALANCE_AUTO,
+ 		.step = 0,
+ 		.imenu = NULL,
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
+@@ -310,6 +310,7 @@ enum mmal_parameter_awbmode {
+ 	MMAL_PARAM_AWBMODE_INCANDESCENT,
+ 	MMAL_PARAM_AWBMODE_FLASH,
+ 	MMAL_PARAM_AWBMODE_HORIZON,
++	MMAL_PARAM_AWBMODE_GREYWORLD,
+ };
+ 
+ enum mmal_parameter_imagefx {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0151-media-v4l2-Add-Greyworld-AWB-control-name.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0151-media-v4l2-Add-Greyworld-AWB-control-name.patch
new file mode 100644
index 00000000..4a0e8999
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0151-media-v4l2-Add-Greyworld-AWB-control-name.patch
@@ -0,0 +1,24 @@
+From c2a4d4e9aafdc9d647ce2cbbfe2ddb5f98aca2d0 Mon Sep 17 00:00:00 2001
+From: John Cox <jc@kynesim.co.uk>
+Date: Fri, 6 Aug 2021 14:32:44 +0100
+Subject: [PATCH 151/697] media: v4l2: Add Greyworld AWB control name
+
+Add name for greyworld to white_balance preset names.
+This patch previously applied to v4l2-ctrl.c but that was split
+and deleted.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+---
+ drivers/media/v4l2-core/v4l2-ctrls-defs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/v4l2-core/v4l2-ctrls-defs.c
++++ b/drivers/media/v4l2-core/v4l2-ctrls-defs.c
+@@ -228,6 +228,7 @@ const char * const *v4l2_ctrl_get_menu(u
+ 		"Flash",
+ 		"Cloudy",
+ 		"Shade",
++		"Greyworld",
+ 		NULL,
+ 	};
+ 	static const char * const camera_iso_sensitivity_auto[] = {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0152-dt-bindings-Add-binding-for-the-Infineon-IRS1125-sen.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0152-dt-bindings-Add-binding-for-the-Infineon-IRS1125-sen.patch
new file mode 100644
index 00000000..4977528d
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0152-dt-bindings-Add-binding-for-the-Infineon-IRS1125-sen.patch
@@ -0,0 +1,66 @@
+From 5ba1ac01a04e676de8944c4b7ac01ab0beb3c4d7 Mon Sep 17 00:00:00 2001
+From: Markus Proeller <markus.proeller@pieye.org>
+Date: Thu, 10 Oct 2019 19:12:08 +0200
+Subject: [PATCH 152/697] dt-bindings: Add binding for the Infineon IRS1125
+ sensor
+
+Adds a binding for the Infineon IRS1125 time-of-flight depth
+sensor.
+
+Signed-off-by: Markus Proeller <markus.proeller@pieye.org>
+---
+ .../devicetree/bindings/media/i2c/irs1125.txt | 48 +++++++++++++++++++
+ 1 file changed, 48 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/media/i2c/irs1125.txt
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/i2c/irs1125.txt
+@@ -0,0 +1,48 @@
++* Infineon irs1125 time of flight sensor
++
++The Infineon irs1125 is a time of flight digital image sensor with
++an active array size of 352H x 286V. It is programmable through I2C
++interface. The I2C address defaults to 0x3D, but can be reconfigured
++to address 0x3C or 0x41 via I2C commands. Image data is sent through
++MIPI CSI-2, which is configured as either 1 or 2 data lanes.
++
++Required Properties:
++- compatible: value should be "infineon,irs1125" for irs1125 sensor
++- reg: I2C bus address of the device
++- clocks: reference to the xclk input clock.
++- pwdn-gpios: reference to the GPIO connected to the reset pin.
++	      This is an active low signal to the iirs1125.
++
++The irs1125 device node should contain one 'port' child node with
++an 'endpoint' subnode. For further reading on port node refer to
++Documentation/devicetree/bindings/media/video-interfaces.txt.
++
++Endpoint node required properties for CSI-2 connection are:
++- remote-endpoint: a phandle to the bus receiver's endpoint node.
++- clock-lanes: should be set to <0> (clock lane on hardware lane 0)
++- data-lanes: should be set to <1> or <1 2> (one or two lane CSI-2
++  supported)
++
++Example:
++	sensor@10 {
++		compatible = "infineon,irs1125";
++		reg = <0x3D>;
++		#address-cells = <1>;
++		#size-cells = <0>;
++		clocks = <&irs1125_clk>;
++		pwdn-gpios = <&gpio 5 0>;
++
++		irs1125_clk: camera-clk {
++			compatible = "fixed-clock";
++			#clock-cells = <0>;
++			clock-frequency = <26000000>;
++		};
++
++		port {
++			sensor_out: endpoint {
++				remote-endpoint = <&csiss_in>;
++				clock-lanes = <0>;
++				data-lanes = <1 2>;
++			};
++		};
++	};
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0153-media-i2c-Add-a-driver-for-the-Infineon-IRS1125-dept.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0153-media-i2c-Add-a-driver-for-the-Infineon-IRS1125-dept.patch
new file mode 100644
index 00000000..80468d4d
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0153-media-i2c-Add-a-driver-for-the-Infineon-IRS1125-dept.patch
@@ -0,0 +1,1493 @@
+From 0b4293bb94d645d3524dca47e8ce35cf7c7dbc37 Mon Sep 17 00:00:00 2001
+From: Markus Proeller <markus.proeller@pieye.org>
+Date: Thu, 10 Oct 2019 19:12:36 +0200
+Subject: [PATCH 153/697] media: i2c: Add a driver for the Infineon IRS1125
+ depth sensor
+
+The Infineon IRS1125 is a time of flight depth sensor that
+has a CSI-2 interface.
+
+Add a V4L2 subdevice driver for this device.
+
+Signed-off-by: Markus Proeller <markus.proeller@pieye.org>
+
+media: irs1125: Using i2c_transfer for ic2 reads
+
+Reading data over i2c is done by using i2c_transfer to ensure that this
+operation can't be interrupted.
+
+Signed-off-by: Markus Proeller <markus.proeller@pieye.org>
+
+media: irs1125: Refactoring and debug messages
+
+Changed some variable names to comply with checkpatch --strict mode.
+Debug messages added.
+
+Signed-off-by: Markus Proeller <markus.proeller@pieye.org>
+
+media: irs1125: Atomic access to imager reconfiguration
+
+Instead of changing the exposure and framerate settings for all sequences,
+they can be changed for every sequence individually now. Therefore the
+IRS1125_CID_SAFE_RECONFIG ctrl has been removed and replaced by
+IRS1125_CID_SAFE_RECONFIG_S<seq_num>_EXPO and *_FRAME ctrls.
+
+The consistency check in the sequence ctrl IRS1125_CID_SEQ_CONFIG
+is removed.
+
+Signed-off-by: Markus Proeller <markus.proeller@pieye.org>
+
+media: irs1125: Keep HW in sync after imager reset
+
+When closing the video device, the irs1125 is put in power down state.
+To keep V4L2 ctrls and the HW in sync, v4l2_ctrl_handler_setup is
+called after power up.
+
+The compound ctrl IRS1125_CID_MOD_PLL however has a default value
+of all zeros, which puts the imager into a non responding state.
+Thus, this ctrl is not written by the driver into HW after power up.
+The userspace has to take care to write senseful data.
+
+Signed-off-by: Markus Proeller <markus.proeller@pieye.org>
+
+media: i2c: add ov9281 driver.
+
+Change-Id: I7b77250bbc56d2f861450cf77271ad15f9b88ab1
+Signed-off-by: Zefa Chen <zefa.chen@rock-chips.com>
+
+media: i2c: ov9281: fix mclk issue when probe multiple camera.
+
+Takes the ov9281 part only from the Rockchip's patch.
+
+Change-Id: I30e833baf2c1bb07d6d87ddb3b00759ab45a90e4
+Signed-off-by: Zefa Chen <zefa.chen@rock-chips.com>
+
+media: i2c: ov9281: add enum_frame_interval function for iq tool 2.2 and hal3
+
+Adds the ov9281 parts of the Rockchip patch adding enum_frame_interval to
+a large number of drivers.
+
+Change-Id: I03344cd6cf278dd7c18fce8e97479089ef185a5c
+Signed-off-by: Zefa Chen <zefa.chen@rock-chips.com>
+
+media: i2c: ov9281: Fixup for recent kernel releases, and remove custom code
+
+The Rockchip driver was based on a 4.4 kernel, and had several custom
+Rockchip parts.
+
+Update to 5.4 kernel APIs, with the relevant controls required by
+libcamera, and remove custom Rockchip parts.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: ov9281: Read chip ID via 2 reads
+
+Vision Components have made an OV9281 module which blocks reading
+back the majority of registers to comply with NDAs, and in doing
+so doesn't allow auto-increment register reading as used when
+reading the chip ID.
+
+Use two reads and manually combine the results.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: ov9281: Add support for 8 bit readout
+
+The sensor supports 8 bit mode as well as 10bit, so add the
+relevant code to allow selection of this.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: ov9281: Add 1280x720 and 640x480 modes
+
+Breaks out common register set and adds the different registers
+for 1280x720 (cropped) and 640x480 (skipped) modes
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+Fixed picture line bug in all ov9281 modes
+
+Signed-off-by: Mathias Anhalt <mathiasanhalt@web.de>
+
+Added hflip and vflip controls to ov9281
+
+Signed-off-by: Mathias Anhalt <mathiasanhalt@web.de>
+
+media: i2c: ov9281: Remove override of subdev name
+
+From the original Rockchip driver, the subdev was renamed
+from the default to being "mov9281 <dev_name>" whereas the
+default would have been "ov9281 <dev_name>".
+
+Remove the override to drop back to the default rather than
+a vendor custom string.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: v4l2-subdev: add subdev-wide state struct
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+media: i2c: ov9281: Add fwnode properties controls
+
+Add call to v4l2_ctrl_new_fwnode_properties to read and
+create the fwnode based controls.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: ov9281: Sensor should report RAW color space
+
+Tested on Raspberry Pi running libcamera.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+Partial revert "media: i2c: add ov9281 driver."
+
+This partially reverts commit 84e98e3a4f3eecb168ceb80231c3e8252929892e.
+
+The commit had merged some changes to other drivers with adding the ov9281
+driver. Only the ov9281 parts have been reverted.
+
+media: i2c: Update irs1125 Kconfig entry
+
+Bring the IRS1125 Kconfig declaration in line with upstream entries.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/media/i2c/Kconfig   |   12 +
+ drivers/media/i2c/Makefile  |    1 +
+ drivers/media/i2c/irs1125.c | 1197 +++++++++++++++++++++++++++++++++++
+ drivers/media/i2c/irs1125.h |   95 +++
+ 4 files changed, 1305 insertions(+)
+ create mode 100644 drivers/media/i2c/irs1125.c
+ create mode 100644 drivers/media/i2c/irs1125.h
+
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -1346,6 +1346,18 @@ config VIDEO_TW9910
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called tw9910.
+ 
++config VIDEO_IRS1125
++	tristate "Infineon IRS1125 sensor support"
++	depends on I2C && VIDEO_DEV
++	select VIDEO_V4L2_SUBDEV_API
++	select V4L2_FWNODE
++	help
++	  This is a Video4Linux2 sensor-level driver for the Infineon
++	  IRS1125 camera.
++
++	  To compile this driver as a module, choose M here: the
++	  module will be called irs1125.
++
+ config VIDEO_VPX3220
+ 	tristate "vpx3220a, vpx3216b & vpx3214c video decoders"
+ 	depends on VIDEO_DEV && I2C
+--- a/drivers/media/i2c/Makefile
++++ b/drivers/media/i2c/Makefile
+@@ -62,6 +62,7 @@ obj-$(CONFIG_VIDEO_IMX415) += imx415.o
+ obj-$(CONFIG_VIDEO_IMX477) += imx477.o
+ obj-$(CONFIG_VIDEO_IMX519) += imx519.o
+ obj-$(CONFIG_VIDEO_IR_I2C) += ir-kbd-i2c.o
++obj-$(CONFIG_VIDEO_IRS1125) += irs1125.o
+ obj-$(CONFIG_VIDEO_ISL7998X) += isl7998x.o
+ obj-$(CONFIG_VIDEO_KS0127) += ks0127.o
+ obj-$(CONFIG_VIDEO_LM3560) += lm3560.o
+--- /dev/null
++++ b/drivers/media/i2c/irs1125.c
+@@ -0,0 +1,1197 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * A V4L2 driver for Infineon IRS1125 TOF cameras.
++ * Copyright (C) 2018, pieye GmbH
++ *
++ * Based on V4L2 OmniVision OV5647 Image Sensor driver
++ * Copyright (C) 2016 Ramiro Oliveira <roliveir@synopsys.com>
++ *
++ * DT / fwnode changes, and GPIO control taken from ov5640.c
++ * Copyright (C) 2011-2013 Freescale Semiconductor, Inc. All Rights Reserved.
++ * Copyright (C) 2014-2017 Mentor Graphics Inc.
++ *
++ */
++
++#include "irs1125.h"
++#include <linux/clk.h>
++#include <linux/delay.h>
++#include <linux/firmware.h>
++#include <linux/gpio/consumer.h>
++#include <linux/i2c.h>
++#include <linux/init.h>
++#include <linux/io.h>
++#include <linux/module.h>
++#include <linux/of_graph.h>
++#include <linux/slab.h>
++#include <linux/types.h>
++#include <linux/videodev2.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-fwnode.h>
++#include <media/v4l2-image-sizes.h>
++#include <media/v4l2-mediabus.h>
++
++#define CHECK_BIT(val, pos) ((val) & BIT(pos))
++
++#define SENSOR_NAME "irs1125"
++
++#define RESET_ACTIVE_DELAY_MS	 20
++
++#define IRS1125_ALTERNATE_FW "irs1125_af.bin"
++
++#define IRS1125_REG_SAFE_RECONFIG	0xA850
++#define IRS1125_REG_CSICFG		0xA882
++#define IRS1125_REG_DESIGN_STEP		0xB0AD
++#define IRS1125_REG_EFUSEVAL2		0xB09F
++#define IRS1125_REG_EFUSEVAL3		0xB0A0
++#define IRS1125_REG_EFUSEVAL4		0xB0A1
++#define IRS1125_REG_DMEM_SHADOW		0xC320
++
++#define IRS1125_DESIGN_STEP_EXPECTED	0x0a12
++
++#define IRS1125_ROW_START_DEF		0
++#define IRS1125_COLUMN_START_DEF	0
++#define IRS1125_WINDOW_HEIGHT_DEF	288
++#define IRS1125_WINDOW_WIDTH_DEF	352
++
++struct regval_list {
++	u16 addr;
++	u16 data;
++};
++
++struct irs1125 {
++	struct v4l2_subdev sd;
++	struct media_pad pad;
++	/* the parsed DT endpoint info */
++	struct v4l2_fwnode_endpoint ep;
++
++	struct clk *xclk;
++	struct v4l2_ctrl_handler ctrl_handler;
++
++	/* To serialize asynchronus callbacks */
++	struct mutex lock;
++
++	/* image data layout */
++	unsigned int num_seq;
++
++	/* reset pin */
++	struct gpio_desc *reset;
++
++	/* V4l2 Controls to grab */
++	struct v4l2_ctrl *ctrl_modplls;
++	struct v4l2_ctrl *ctrl_numseq;
++
++	int power_count;
++	bool mod_pll_init;
++};
++
++static inline struct irs1125 *to_state(struct v4l2_subdev *sd)
++{
++	return container_of(sd, struct irs1125, sd);
++}
++
++static const char *expo_ctrl_names[IRS1125_NUM_SEQ_ENTRIES] = {
++	"safe reconfiguration of exposure of sequence 0",
++	"safe reconfiguration of exposure of sequence 1",
++	"safe reconfiguration of exposure of sequence 2",
++	"safe reconfiguration of exposure of sequence 3",
++	"safe reconfiguration of exposure of sequence 4",
++	"safe reconfiguration of exposure of sequence 5",
++	"safe reconfiguration of exposure of sequence 6",
++	"safe reconfiguration of exposure of sequence 7",
++	"safe reconfiguration of exposure of sequence 8",
++	"safe reconfiguration of exposure of sequence 9",
++	"safe reconfiguration of exposure of sequence 10",
++	"safe reconfiguration of exposure of sequence 11",
++	"safe reconfiguration of exposure of sequence 12",
++	"safe reconfiguration of exposure of sequence 13",
++	"safe reconfiguration of exposure of sequence 14",
++	"safe reconfiguration of exposure of sequence 15",
++	"safe reconfiguration of exposure of sequence 16",
++	"safe reconfiguration of exposure of sequence 17",
++	"safe reconfiguration of exposure of sequence 18",
++	"safe reconfiguration of exposure of sequence 19",
++};
++
++static const char *frame_ctrl_names[IRS1125_NUM_SEQ_ENTRIES] = {
++	"safe reconfiguration of framerate of sequence 0",
++	"safe reconfiguration of framerate of sequence 1",
++	"safe reconfiguration of framerate of sequence 2",
++	"safe reconfiguration of framerate of sequence 3",
++	"safe reconfiguration of framerate of sequence 4",
++	"safe reconfiguration of framerate of sequence 5",
++	"safe reconfiguration of framerate of sequence 6",
++	"safe reconfiguration of framerate of sequence 7",
++	"safe reconfiguration of framerate of sequence 8",
++	"safe reconfiguration of framerate of sequence 9",
++	"safe reconfiguration of framerate of sequence 10",
++	"safe reconfiguration of framerate of sequence 11",
++	"safe reconfiguration of framerate of sequence 12",
++	"safe reconfiguration of framerate of sequence 13",
++	"safe reconfiguration of framerate of sequence 14",
++	"safe reconfiguration of framerate of sequence 15",
++	"safe reconfiguration of framerate of sequence 16",
++	"safe reconfiguration of framerate of sequence 17",
++	"safe reconfiguration of framerate of sequence 18",
++	"safe reconfiguration of framerate of sequence 19",
++};
++
++static struct regval_list irs1125_26mhz[] = {
++	{0xB017, 0x0413},
++	{0xB086, 0x3535},
++	{0xB0AE, 0xEF02},
++	{0xA000, 0x0004},
++	{0xFFFF, 100},
++
++	{0xB062, 0x6383},
++	{0xB063, 0x55A8},
++	{0xB068, 0x7628},
++	{0xB069, 0x03E2},
++
++	{0xFFFF, 100},
++	{0xB05A, 0x01C5},
++	{0xB05C, 0x0206},
++	{0xB05D, 0x01C5},
++	{0xB05F, 0x0206},
++	{0xB016, 0x1335},
++	{0xFFFF, 100},
++	{0xA893, 0x8261},
++	{0xA894, 0x89d8},
++	{0xA895, 0x131d},
++	{0xA896, 0x4251},
++	{0xA897, 0x9D8A},
++	{0xA898, 0x0BD8},
++	{0xA899, 0x2245},
++	{0xA89A, 0xAB9B},
++	{0xA89B, 0x03B9},
++	{0xA89C, 0x8041},
++	{0xA89D, 0xE07E},
++	{0xA89E, 0x0307},
++	{0xFFFF, 100},
++	{0xA88D, 0x0004},
++	{0xA800, 0x0E68},
++	{0xA801, 0x0000},
++	{0xA802, 0x000C},
++	{0xA803, 0x0000},
++	{0xA804, 0x0E68},
++	{0xA805, 0x0000},
++	{0xA806, 0x0440},
++	{0xA807, 0x0000},
++	{0xA808, 0x0E68},
++	{0xA809, 0x0000},
++	{0xA80A, 0x0884},
++	{0xA80B, 0x0000},
++	{0xA80C, 0x0E68},
++	{0xA80D, 0x0000},
++	{0xA80E, 0x0CC8},
++	{0xA80F, 0x0000},
++	{0xA810, 0x0E68},
++	{0xA811, 0x0000},
++	{0xA812, 0x2000},
++	{0xA813, 0x0000},
++	{0xA882, 0x0081},
++	{0xA88C, 0x403A},
++	{0xA88F, 0x031E},
++	{0xA892, 0x0351},
++	{0x9813, 0x13FF},
++	{0x981B, 0x7608},
++
++	{0xB008, 0x0000},
++	{0xB015, 0x1513},
++
++	{0xFFFF, 100}
++};
++
++static struct regval_list irs1125_seq_cfg_init[] = {
++	{0xC3A0, 0x823D},
++	{0xC3A1, 0xB13B},
++	{0xC3A2, 0x0313},
++	{0xC3A3, 0x4659},
++	{0xC3A4, 0xC4EC},
++	{0xC3A5, 0x03CE},
++	{0xC3A6, 0x4259},
++	{0xC3A7, 0xC4EC},
++	{0xC3A8, 0x03CE},
++	{0xC3A9, 0x8839},
++	{0xC3AA, 0x89D8},
++	{0xC3AB, 0x031D},
++
++	{0xC24C, 0x5529},
++	{0xC24D, 0x0000},
++	{0xC24E, 0x1200},
++	{0xC24F, 0x6CB2},
++	{0xC250, 0x0000},
++	{0xC251, 0x5529},
++	{0xC252, 0x42F4},
++	{0xC253, 0xD1AF},
++	{0xC254, 0x8A18},
++	{0xC255, 0x0002},
++	{0xC256, 0x5529},
++	{0xC257, 0x6276},
++	{0xC258, 0x11A7},
++	{0xC259, 0xD907},
++	{0xC25A, 0x0000},
++	{0xC25B, 0x5529},
++	{0xC25C, 0x07E0},
++	{0xC25D, 0x7BFE},
++	{0xC25E, 0x6402},
++	{0xC25F, 0x0019},
++
++	{0xC3AC, 0x0007},
++	{0xC3AD, 0xED88},
++	{0xC320, 0x003E},
++	{0xC321, 0x0000},
++	{0xC322, 0x2000},
++	{0xC323, 0x0000},
++	{0xC324, 0x0271},
++	{0xC325, 0x0000},
++	{0xC326, 0x000C},
++	{0xC327, 0x0000},
++	{0xC328, 0x0271},
++	{0xC329, 0x0000},
++	{0xC32A, 0x0440},
++	{0xC32B, 0x0000},
++	{0xC32C, 0x0271},
++	{0xC32D, 0x0000},
++	{0xC32E, 0x0884},
++	{0xC32F, 0x0000},
++	{0xC330, 0x0271},
++	{0xC331, 0x0000},
++	{0xC332, 0x0CC8},
++	{0xC333, 0x0000},
++	{0xA88D, 0x0004},
++
++	{0xA890, 0x0000},
++	{0xC219, 0x0002},
++	{0xC21A, 0x0000},
++	{0xC21B, 0x0000},
++	{0xC21C, 0x00CD},
++	{0xC21D, 0x0009},
++	{0xC21E, 0x00CD},
++	{0xC21F, 0x0009},
++
++	{0xA87C, 0x0000},
++	{0xC032, 0x0001},
++	{0xC034, 0x0000},
++	{0xC035, 0x0001},
++	{0xC039, 0x0000},
++	{0xC401, 0x0002},
++
++	{0xFFFF, 1}
++};
++
++static int irs1125_write(struct v4l2_subdev *sd, u16 reg, u16 val)
++{
++	int ret;
++	unsigned char data[4] = { reg >> 8, reg & 0xff, val >> 8, val & 0xff};
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++
++	ret = i2c_master_send(client, data, 4);
++	if (ret < 0)
++		dev_err(&client->dev, "%s: i2c write error, reg: %x\n",
++			__func__, reg);
++
++	dev_dbg(&client->dev, "write addr 0x%04x, val 0x%04x\n", reg, val);
++	return ret;
++}
++
++static int irs1125_read(struct v4l2_subdev *sd, u16 reg, u16 *val)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++	struct i2c_msg msgs[2];
++	u8 addr_buf[2] = { reg >> 8, reg & 0xff };
++	u8 data_buf[2] = { 0, };
++	int ret;
++
++	/* Write register address */
++	msgs[0].addr = client->addr;
++	msgs[0].flags = 0;
++	msgs[0].len = ARRAY_SIZE(addr_buf);
++	msgs[0].buf = addr_buf;
++
++	/* Read data from register */
++	msgs[1].addr = client->addr;
++	msgs[1].flags = I2C_M_RD;
++	msgs[1].len = 2;
++	msgs[1].buf = data_buf;
++
++	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
++	if (ret != ARRAY_SIZE(msgs)) {
++		if (ret >= 0)
++			ret = -EIO;
++		return ret;
++	}
++
++	*val = data_buf[1] | (data_buf[0] << 8);
++
++	return 0;
++}
++
++static int irs1125_write_array(struct v4l2_subdev *sd,
++			       struct regval_list *regs, int array_size)
++{
++	int i, ret;
++
++	for (i = 0; i < array_size; i++) {
++		if (regs[i].addr == 0xFFFF) {
++			msleep(regs[i].data);
++		} else {
++			ret = irs1125_write(sd, regs[i].addr, regs[i].data);
++			if (ret < 0)
++				return ret;
++		}
++	}
++
++	return 0;
++}
++
++static int irs1125_stream_on(struct v4l2_subdev *sd)
++{
++	int ret;
++	struct irs1125 *irs1125 = to_state(sd);
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++
++	v4l2_ctrl_grab(irs1125->ctrl_numseq, 1);
++	v4l2_ctrl_grab(irs1125->ctrl_modplls, 1);
++
++	ret = irs1125_write(sd, 0xC400, 0x0001);
++	if (ret < 0) {
++		dev_err(&client->dev, "error enabling firmware: %d", ret);
++		return ret;
++	}
++
++	msleep(100);
++
++	return irs1125_write(sd, 0xA87C, 0x0001);
++}
++
++static int irs1125_stream_off(struct v4l2_subdev *sd)
++{
++	int ret;
++	struct irs1125 *irs1125 = to_state(sd);
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++
++	v4l2_ctrl_grab(irs1125->ctrl_numseq, 0);
++	v4l2_ctrl_grab(irs1125->ctrl_modplls, 0);
++
++	ret = irs1125_write(sd, 0xA87C, 0x0000);
++	if (ret < 0) {
++		dev_err(&client->dev, "error disabling trigger: %d", ret);
++		return ret;
++	}
++
++	msleep(100);
++
++	return irs1125_write(sd, 0xC400, 0x0002);
++}
++
++static int __sensor_init(struct v4l2_subdev *sd)
++{
++	unsigned int cnt, idx;
++	int ret;
++	u16 val;
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++	struct irs1125 *irs1125 = to_state(sd);
++	const struct firmware *fw;
++	struct regval_list *reg_data;
++
++	cnt = 0;
++	while (1) {
++		ret = irs1125_read(sd, 0xC40F, &val);
++		if (ret < 0) {
++			dev_err(&client->dev, "read register 0xC40F failed\n");
++			return ret;
++		}
++		if (CHECK_BIT(val, 14) == 0)
++			break;
++
++		if (cnt >= 5) {
++			dev_err(&client->dev, "timeout waiting for 0xC40F\n");
++			return -EAGAIN;
++		}
++
++		cnt++;
++	}
++
++	ret = irs1125_write_array(sd, irs1125_26mhz,
++				  ARRAY_SIZE(irs1125_26mhz));
++	if (ret < 0) {
++		dev_err(&client->dev, "write sensor default regs error\n");
++		return ret;
++	}
++
++	/* set CSI-2 number of data lanes */
++	if (irs1125->ep.bus.mipi_csi2.num_data_lanes == 1) {
++		val = 0x0001;
++	} else if (irs1125->ep.bus.mipi_csi2.num_data_lanes == 2) {
++		val = 0x0081;
++	} else {
++		dev_err(&client->dev, "invalid number of data lanes %d\n",
++			irs1125->ep.bus.mipi_csi2.num_data_lanes);
++		return -EINVAL;
++	}
++
++	ret = irs1125_write(sd, IRS1125_REG_CSICFG, val);
++	if (ret < 0) {
++		dev_err(&client->dev, "write sensor csi2 config error\n");
++		return ret;
++	}
++
++	/* request the firmware, this will block and timeout */
++	ret = request_firmware(&fw, IRS1125_ALTERNATE_FW, &client->dev);
++	if (ret) {
++		dev_err(&client->dev,
++			"did not find the firmware file '%s' (status %d)\n",
++			IRS1125_ALTERNATE_FW, ret);
++		return ret;
++	}
++
++	if (fw->size % 4) {
++		dev_err(&client->dev, "firmware file '%s' invalid\n",
++			IRS1125_ALTERNATE_FW);
++		release_firmware(fw);
++		return -EINVAL;
++	}
++
++	for (idx = 0; idx < fw->size; idx += 4)	{
++		reg_data = (struct regval_list *)&fw->data[idx];
++		ret = irs1125_write(sd, reg_data->addr, reg_data->data);
++		if (ret < 0) {
++			dev_err(&client->dev, "firmware write error\n");
++			release_firmware(fw);
++			return ret;
++		}
++	}
++	release_firmware(fw);
++
++	ret = irs1125_write_array(sd, irs1125_seq_cfg_init,
++				  ARRAY_SIZE(irs1125_seq_cfg_init));
++	if (ret < 0) {
++		dev_err(&client->dev, "write default sequence failed\n");
++		return ret;
++	}
++
++	irs1125->mod_pll_init = true;
++	v4l2_ctrl_handler_setup(&irs1125->ctrl_handler);
++	irs1125->mod_pll_init = false;
++
++	return irs1125_write(sd, 0xA87C, 0x0001);
++}
++
++static int irs1125_sensor_power(struct v4l2_subdev *sd, int on)
++{
++	int ret = 0;
++	struct irs1125 *irs1125 = to_state(sd);
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++
++	mutex_lock(&irs1125->lock);
++
++	if (on && !irs1125->power_count) {
++		gpiod_set_value_cansleep(irs1125->reset, 1);
++		msleep(RESET_ACTIVE_DELAY_MS);
++
++		ret = clk_prepare_enable(irs1125->xclk);
++		if (ret < 0) {
++			dev_err(&client->dev, "clk prepare enable failed\n");
++			goto out;
++		}
++
++		ret = __sensor_init(sd);
++		if (ret < 0) {
++			clk_disable_unprepare(irs1125->xclk);
++			dev_err(&client->dev,
++				"Camera not available, check Power\n");
++			goto out;
++		}
++	} else if (!on && irs1125->power_count == 1) {
++		gpiod_set_value_cansleep(irs1125->reset, 0);
++	}
++
++	/* Update the power count. */
++	irs1125->power_count += on ? 1 : -1;
++	WARN_ON(irs1125->power_count < 0);
++
++out:
++	mutex_unlock(&irs1125->lock);
++
++	return ret;
++}
++
++#ifdef CONFIG_VIDEO_ADV_DEBUG
++static int irs1125_sensor_get_register(struct v4l2_subdev *sd,
++				       struct v4l2_dbg_register *reg)
++{
++	u16 val;
++	int ret;
++
++	ret = irs1125_read(sd, reg->reg & 0xffff, &val);
++	if (ret < 0)
++		return ret;
++
++	reg->val = val;
++	reg->size = 1;
++
++	return 0;
++}
++
++static int irs1125_sensor_set_register(struct v4l2_subdev *sd,
++				       const struct v4l2_dbg_register *reg)
++{
++	return irs1125_write(sd, reg->reg & 0xffff, reg->val & 0xffff);
++}
++#endif
++
++static const struct v4l2_subdev_core_ops irs1125_subdev_core_ops = {
++	.s_power = irs1125_sensor_power,
++#ifdef CONFIG_VIDEO_ADV_DEBUG
++	.g_register = irs1125_sensor_get_register,
++	.s_register = irs1125_sensor_set_register,
++#endif
++};
++
++static int irs1125_s_stream(struct v4l2_subdev *sd, int enable)
++{
++	if (enable)
++		return irs1125_stream_on(sd);
++	else
++		return irs1125_stream_off(sd);
++}
++
++static const struct v4l2_subdev_video_ops irs1125_subdev_video_ops = {
++	.s_stream = irs1125_s_stream,
++};
++
++static int irs1125_enum_mbus_code(struct v4l2_subdev *sd,
++				  struct v4l2_subdev_state *sd_state,
++				  struct v4l2_subdev_mbus_code_enum *code)
++{
++	if (code->index > 0)
++		return -EINVAL;
++
++	code->code = MEDIA_BUS_FMT_Y12_1X12;
++
++	return 0;
++}
++
++static int irs1125_set_get_fmt(struct v4l2_subdev *sd,
++			       struct v4l2_subdev_state *sd_state,
++			       struct v4l2_subdev_format *format)
++{
++	struct v4l2_mbus_framefmt *fmt = &format->format;
++	struct irs1125 *irs1125 = to_state(sd);
++
++	if (format->pad != 0)
++		return -EINVAL;
++
++	/* Only one format is supported, so return that */
++	memset(fmt, 0, sizeof(*fmt));
++	fmt->code = MEDIA_BUS_FMT_Y12_1X12;
++	fmt->colorspace = V4L2_COLORSPACE_RAW;
++	fmt->field = V4L2_FIELD_NONE;
++	fmt->width = IRS1125_WINDOW_WIDTH_DEF;
++	fmt->height = IRS1125_WINDOW_HEIGHT_DEF * irs1125->num_seq;
++
++	return 0;
++}
++
++static const struct v4l2_subdev_pad_ops irs1125_subdev_pad_ops = {
++	.enum_mbus_code = irs1125_enum_mbus_code,
++	.set_fmt = irs1125_set_get_fmt,
++	.get_fmt = irs1125_set_get_fmt,
++};
++
++static const struct v4l2_subdev_ops irs1125_subdev_ops = {
++	.core = &irs1125_subdev_core_ops,
++	.video = &irs1125_subdev_video_ops,
++	.pad = &irs1125_subdev_pad_ops,
++};
++
++static int irs1125_s_ctrl(struct v4l2_ctrl *ctrl)
++{
++	struct irs1125 *dev = container_of(ctrl->handler,
++					struct irs1125, ctrl_handler);
++	struct i2c_client *client = v4l2_get_subdevdata(&dev->sd);
++	int err = 0, i;
++
++	switch (ctrl->id) {
++	case IRS1125_CID_SAFE_RECONFIG_S0_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S0_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S1_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S1_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S2_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S2_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S3_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S3_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S4_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S4_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S5_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S5_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S6_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S6_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S7_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S7_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S8_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S8_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S9_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S9_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S10_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S10_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S11_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S11_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S12_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S12_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S13_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S13_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S14_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S14_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S15_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S15_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S16_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S16_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S17_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S17_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S18_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S18_FRAME:
++	case IRS1125_CID_SAFE_RECONFIG_S19_EXPO:
++	case IRS1125_CID_SAFE_RECONFIG_S19_FRAME: {
++		unsigned int offset = ctrl->id -
++			IRS1125_CID_SAFE_RECONFIG_S0_EXPO;
++
++		err = irs1125_write(&dev->sd,
++				    IRS1125_REG_SAFE_RECONFIG + offset,
++				    ctrl->val);
++		break;
++	}
++	case IRS1125_CID_MOD_PLL: {
++		struct irs1125_mod_pll *mod_new;
++
++		if (dev->mod_pll_init)
++			break;
++
++		mod_new = (struct irs1125_mod_pll *)ctrl->p_new.p;
++		for (i = 0; i < IRS1125_NUM_MOD_PLLS; i++) {
++			unsigned int pll_offset, ssc_offset;
++
++			pll_offset = i * 3;
++			ssc_offset = i * 5;
++
++			err = irs1125_write(&dev->sd, 0xC3A0 + pll_offset,
++					    mod_new[i].pllcfg1);
++			if (err < 0)
++				break;
++
++			err = irs1125_write(&dev->sd, 0xC3A1 + pll_offset,
++					    mod_new[i].pllcfg2);
++			if (err < 0)
++				break;
++
++			err = irs1125_write(&dev->sd, 0xC3A2 + pll_offset,
++					    mod_new[i].pllcfg3);
++			if (err < 0)
++				break;
++
++			err = irs1125_write(&dev->sd, 0xC24C + ssc_offset,
++					    mod_new[i].pllcfg4);
++			if (err < 0)
++				break;
++
++			err = irs1125_write(&dev->sd, 0xC24D + ssc_offset,
++					    mod_new[i].pllcfg5);
++			if (err < 0)
++				break;
++
++			err = irs1125_write(&dev->sd, 0xC24E + ssc_offset,
++					    mod_new[i].pllcfg6);
++			if (err < 0)
++				break;
++
++			err = irs1125_write(&dev->sd, 0xC24F + ssc_offset,
++					    mod_new[i].pllcfg7);
++			if (err < 0)
++				break;
++
++			err = irs1125_write(&dev->sd, 0xC250 + ssc_offset,
++					    mod_new[i].pllcfg8);
++			if (err < 0)
++				break;
++		}
++		break;
++	}
++	case IRS1125_CID_SEQ_CONFIG: {
++		struct irs1125_seq_cfg *cfg_new;
++
++		cfg_new = (struct irs1125_seq_cfg *)ctrl->p_new.p;
++		for (i = 0; i < IRS1125_NUM_SEQ_ENTRIES; i++) {
++			unsigned int seq_offset = i * 4;
++			u16 addr, val;
++
++			addr = IRS1125_REG_DMEM_SHADOW + seq_offset;
++			val = cfg_new[i].exposure;
++			err = irs1125_write(&dev->sd, addr, val);
++			if (err < 0)
++				break;
++
++			addr = IRS1125_REG_DMEM_SHADOW + 1 + seq_offset;
++			val = cfg_new[i].framerate;
++			err = irs1125_write(&dev->sd, addr, val);
++			if (err < 0)
++				break;
++
++			addr = IRS1125_REG_DMEM_SHADOW + 2 + seq_offset;
++			val = cfg_new[i].ps;
++			err = irs1125_write(&dev->sd, addr, val);
++			if (err < 0)
++				break;
++
++			addr = IRS1125_REG_DMEM_SHADOW + 3 + seq_offset;
++			val = cfg_new[i].pll;
++			err = irs1125_write(&dev->sd, addr, val);
++			if (err < 0)
++				break;
++		}
++		break;
++	}
++	case IRS1125_CID_NUM_SEQS:
++		err = irs1125_write(&dev->sd, 0xA88D, ctrl->val - 1);
++		if (err >= 0)
++			dev->num_seq = ctrl->val;
++		break;
++	case IRS1125_CID_CONTINUOUS_TRIG:
++		if (ctrl->val == 0)
++			err = irs1125_write(&dev->sd, 0xA87C, 0);
++		else
++			err = irs1125_write(&dev->sd, 0xA87C, 1);
++		break;
++	case IRS1125_CID_TRIGGER:
++		if (ctrl->val != 0) {
++			err = irs1125_write(&dev->sd, 0xA87C, 1);
++			if (err >= 0)
++				err = irs1125_write(&dev->sd, 0xA87C, 0);
++		}
++		break;
++	case IRS1125_CID_RECONFIG:
++		if (ctrl->val != 0)
++			err = irs1125_write(&dev->sd, 0xA87A, 1);
++		break;
++	case IRS1125_CID_ILLU_ON:
++		if (ctrl->val == 0)
++			err = irs1125_write(&dev->sd, 0xA892, 0x377);
++		else
++			err = irs1125_write(&dev->sd, 0xA892, 0x355);
++		break;
++	default:
++		break;
++	}
++
++	if (err < 0)
++		dev_err(&client->dev, "Error executing control ID: %d, val %d, err %d",
++			ctrl->id, ctrl->val, err);
++	else
++		err = 0;
++
++	return err;
++}
++
++static const struct v4l2_ctrl_ops irs1125_ctrl_ops = {
++	.s_ctrl = irs1125_s_ctrl,
++};
++
++static const struct v4l2_ctrl_config irs1125_custom_ctrls[] = {
++	{
++		.ops = &irs1125_ctrl_ops,
++		.id = IRS1125_CID_NUM_SEQS,
++		.name = "Change number of sequences",
++		.type = V4L2_CTRL_TYPE_INTEGER,
++		.flags = V4L2_CTRL_FLAG_MODIFY_LAYOUT,
++		.min = 1,
++		.max = 20,
++		.step = 1,
++		.def = 5,
++	}, {
++		.ops = &irs1125_ctrl_ops,
++		.id = IRS1125_CID_MOD_PLL,
++		.name = "Reconfigure modulation PLLs",
++		.type = V4L2_CTRL_TYPE_U16,
++		.flags = V4L2_CTRL_FLAG_HAS_PAYLOAD,
++		.min = 0,
++		.max = U16_MAX,
++		.step = 1,
++		.def = 0,
++		.elem_size = sizeof(u16),
++		.dims = {sizeof(struct irs1125_mod_pll) / sizeof(u16),
++			IRS1125_NUM_MOD_PLLS}
++	}, {
++		.ops = &irs1125_ctrl_ops,
++		.id = IRS1125_CID_SEQ_CONFIG,
++		.name = "Change sequence settings",
++		.type = V4L2_CTRL_TYPE_U16,
++		.flags = V4L2_CTRL_FLAG_HAS_PAYLOAD,
++		.min = 0,
++		.max = U16_MAX,
++		.step = 1,
++		.def = 0,
++		.elem_size = sizeof(u16),
++		.dims = {sizeof(struct irs1125_seq_cfg) / sizeof(u16),
++			IRS1125_NUM_SEQ_ENTRIES}
++	}, {
++		.ops = &irs1125_ctrl_ops,
++		.id = IRS1125_CID_CONTINUOUS_TRIG,
++		.name = "Enable/disable continuous trigger",
++		.type = V4L2_CTRL_TYPE_BOOLEAN,
++		.flags = V4L2_CTRL_FLAG_EXECUTE_ON_WRITE,
++		.min = 0,
++		.max = 1,
++		.step = 1,
++		.def = 0
++	}, {
++		.ops = &irs1125_ctrl_ops,
++		.id = IRS1125_CID_TRIGGER,
++		.name = "Capture a single sequence",
++		.type = V4L2_CTRL_TYPE_BOOLEAN,
++		.flags = V4L2_CTRL_FLAG_EXECUTE_ON_WRITE,
++		.min = 0,
++		.max = 1,
++		.step = 1,
++		.def = 0
++	}, {
++		.ops = &irs1125_ctrl_ops,
++		.id = IRS1125_CID_RECONFIG,
++		.name = "Trigger imager reconfiguration",
++		.type = V4L2_CTRL_TYPE_BOOLEAN,
++		.flags = V4L2_CTRL_FLAG_EXECUTE_ON_WRITE,
++		.min = 0,
++		.max = 1,
++		.step = 1,
++		.def = 0
++	}, {
++		.ops = &irs1125_ctrl_ops,
++		.id = IRS1125_CID_ILLU_ON,
++		.name = "Turn illu on or off",
++		.type = V4L2_CTRL_TYPE_BOOLEAN,
++		.flags = V4L2_CTRL_FLAG_EXECUTE_ON_WRITE,
++		.min = 0,
++		.max = 1,
++		.step = 1,
++		.def = 1
++	}, {
++		.ops = &irs1125_ctrl_ops,
++		.id = IRS1125_CID_IDENT0,
++		.name = "Get ident 0 information",
++		.type = V4L2_CTRL_TYPE_INTEGER,
++		.flags = V4L2_CTRL_FLAG_READ_ONLY,
++		.min = S32_MIN,
++		.max = S32_MAX,
++		.step = 1,
++		.def = 0
++	}, {
++		.ops = &irs1125_ctrl_ops,
++		.id = IRS1125_CID_IDENT1,
++		.name = "Get ident 1 information",
++		.type = V4L2_CTRL_TYPE_INTEGER,
++		.flags = V4L2_CTRL_FLAG_READ_ONLY,
++		.min = S32_MIN,
++		.max = S32_MAX,
++		.step = 1,
++		.def = 0
++	}, {
++		.ops = &irs1125_ctrl_ops,
++		.id = IRS1125_CID_IDENT2,
++		.name = "Get ident 2 information",
++		.type = V4L2_CTRL_TYPE_INTEGER,
++		.flags = V4L2_CTRL_FLAG_READ_ONLY,
++		.min = S32_MIN,
++		.max = S32_MAX,
++		.step = 1,
++		.def = 0
++	}
++};
++
++static int irs1125_detect(struct v4l2_subdev *sd)
++{
++	u16 read;
++	int ret;
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++
++	ret = irs1125_read(sd, IRS1125_REG_DESIGN_STEP, &read);
++	if (ret < 0) {
++		dev_err(&client->dev, "error reading from i2c\n");
++		return ret;
++	}
++
++	if (read != IRS1125_DESIGN_STEP_EXPECTED) {
++		dev_err(&client->dev, "Design step expected 0x%x got 0x%x",
++			IRS1125_DESIGN_STEP_EXPECTED, read);
++		return -ENODEV;
++	}
++
++	return 0;
++}
++
++static int irs1125_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
++{
++	struct v4l2_mbus_framefmt *format =
++	v4l2_subdev_state_get_format(fh->state, 0);
++
++	format->code = MEDIA_BUS_FMT_Y12_1X12;
++	format->width = IRS1125_WINDOW_WIDTH_DEF;
++	format->height = IRS1125_WINDOW_HEIGHT_DEF;
++	format->field = V4L2_FIELD_NONE;
++	format->colorspace = V4L2_COLORSPACE_RAW;
++
++	return 0;
++}
++
++static const struct v4l2_subdev_internal_ops irs1125_subdev_internal_ops = {
++	.open = irs1125_open,
++};
++
++static int irs1125_ctrls_init(struct irs1125 *sensor, struct device *dev)
++{
++	struct v4l2_ctrl *ctrl;
++	int err, i;
++	struct v4l2_ctrl_handler *hdl = &sensor->ctrl_handler;
++	struct v4l2_ctrl_config ctrl_cfg = {
++		.ops = &irs1125_ctrl_ops,
++		.type = V4L2_CTRL_TYPE_INTEGER,
++		.min = 0,
++		.max = U16_MAX,
++		.step = 1,
++		.def = 0x1000
++	};
++
++	v4l2_ctrl_handler_init(hdl, ARRAY_SIZE(irs1125_custom_ctrls));
++
++	for (i = 0; i < ARRAY_SIZE(irs1125_custom_ctrls); i++)	{
++		ctrl = v4l2_ctrl_new_custom(hdl, &irs1125_custom_ctrls[i],
++					    NULL);
++		if (!ctrl)
++			dev_err(dev, "Failed to init custom control %s\n",
++				irs1125_custom_ctrls[i].name);
++		else if (irs1125_custom_ctrls[i].id == IRS1125_CID_NUM_SEQS)
++			sensor->ctrl_numseq = ctrl;
++		else if (irs1125_custom_ctrls[i].id == IRS1125_CID_MOD_PLL)
++			sensor->ctrl_modplls = ctrl;
++	}
++
++	if (hdl->error)	{
++		dev_err(dev, "Error %d adding controls\n", hdl->error);
++		err = hdl->error;
++		goto error_ctrls;
++	}
++
++	for (i = 0; i < IRS1125_NUM_SEQ_ENTRIES; i++) {
++		ctrl_cfg.name = expo_ctrl_names[i];
++		ctrl_cfg.id = IRS1125_CID_SAFE_RECONFIG_S0_EXPO + i * 2;
++		ctrl = v4l2_ctrl_new_custom(hdl, &ctrl_cfg,
++					    NULL);
++		if (!ctrl)
++			dev_err(dev, "Failed to init exposure control %s\n",
++				ctrl_cfg.name);
++	}
++
++	ctrl_cfg.def = 0;
++	for (i = 0; i < IRS1125_NUM_SEQ_ENTRIES; i++) {
++		ctrl_cfg.name = frame_ctrl_names[i];
++		ctrl_cfg.id = IRS1125_CID_SAFE_RECONFIG_S0_FRAME + i * 2;
++		ctrl = v4l2_ctrl_new_custom(hdl, &ctrl_cfg,
++					    NULL);
++		if (!ctrl)
++			dev_err(dev, "Failed to init framerate control %s\n",
++				ctrl_cfg.name);
++	}
++
++	sensor->sd.ctrl_handler = hdl;
++	return 0;
++
++error_ctrls:
++	v4l2_ctrl_handler_free(&sensor->ctrl_handler);
++	return -err;
++}
++
++static int irs1125_ident_setup(struct irs1125 *sensor, struct device *dev)
++{
++	int ret;
++	struct v4l2_ctrl *ctrl;
++	struct v4l2_subdev *sd;
++	u16 read;
++
++	sd = &sensor->sd;
++
++	ctrl = v4l2_ctrl_find(&sensor->ctrl_handler, IRS1125_CID_IDENT0);
++	if (!ctrl) {
++		dev_err(dev, "could not find device ctrl.\n");
++		return -EINVAL;
++	}
++
++	ret = irs1125_read(sd, IRS1125_REG_EFUSEVAL2, &read);
++	if (ret < 0) {
++		dev_err(dev, "error reading from i2c\n");
++		return -EIO;
++	}
++
++	v4l2_ctrl_s_ctrl(ctrl, read);
++
++	ctrl = v4l2_ctrl_find(&sensor->ctrl_handler, IRS1125_CID_IDENT1);
++	if (!ctrl) {
++		dev_err(dev, "could not find device ctrl.\n");
++		return -EINVAL;
++	}
++
++	ret = irs1125_read(sd, IRS1125_REG_EFUSEVAL3, &read);
++	if (ret < 0) {
++		dev_err(dev, "error reading from i2c\n");
++		return -EIO;
++	}
++
++	v4l2_ctrl_s_ctrl(ctrl, read);
++
++	ctrl = v4l2_ctrl_find(&sensor->ctrl_handler, IRS1125_CID_IDENT2);
++	if (!ctrl) {
++		dev_err(dev, "could not find device ctrl.\n");
++		return -EINVAL;
++	}
++
++	ret = irs1125_read(sd, IRS1125_REG_EFUSEVAL4, &read);
++	if (ret < 0) {
++		dev_err(dev, "error reading from i2c\n");
++		return -EIO;
++	}
++	v4l2_ctrl_s_ctrl(ctrl, read & 0xFFFC);
++
++	return 0;
++}
++
++static int irs1125_probe(struct i2c_client *client)
++{
++	struct device *dev = &client->dev;
++	struct irs1125 *sensor;
++	int ret;
++	struct fwnode_handle *endpoint;
++	u32 xclk_freq;
++	int gpio_num;
++
++	sensor = devm_kzalloc(dev, sizeof(*sensor), GFP_KERNEL);
++	if (!sensor)
++		return -ENOMEM;
++
++	v4l2_i2c_subdev_init(&sensor->sd, client, &irs1125_subdev_ops);
++
++	/* Get CSI2 bus config */
++	endpoint = fwnode_graph_get_next_endpoint(dev_fwnode(dev),
++						  NULL);
++	if (!endpoint) {
++		dev_err(dev, "endpoint node not found\n");
++		return -EINVAL;
++	}
++
++	ret = v4l2_fwnode_endpoint_parse(endpoint, &sensor->ep);
++	fwnode_handle_put(endpoint);
++	if (ret) {
++		dev_err(dev, "Could not parse endpoint\n");
++		return ret;
++	}
++
++	/* get system clock (xclk) */
++	sensor->xclk = devm_clk_get(dev, NULL);
++	if (IS_ERR(sensor->xclk)) {
++		dev_err(dev, "could not get xclk");
++		return PTR_ERR(sensor->xclk);
++	}
++
++	xclk_freq = clk_get_rate(sensor->xclk);
++	if (xclk_freq != 26000000) {
++		dev_err(dev, "Unsupported clock frequency: %u\n", xclk_freq);
++		return -EINVAL;
++	}
++
++	sensor->num_seq = 5;
++
++	/* Request the power down GPIO */
++	sensor->reset = devm_gpiod_get(&client->dev, "pwdn",
++				       GPIOD_OUT_LOW);
++
++	if (IS_ERR(sensor->reset)) {
++		dev_err(dev, "could not get reset");
++		return PTR_ERR(sensor->reset);
++	}
++
++	gpio_num = desc_to_gpio(sensor->reset);
++	dev_dbg(&client->dev, "reset on GPIO num %d\n", gpio_num);
++
++	mutex_init(&sensor->lock);
++
++	ret = irs1125_ctrls_init(sensor, dev);
++	if (ret < 0)
++		goto mutex_remove;
++
++	sensor->sd.internal_ops = &irs1125_subdev_internal_ops;
++	sensor->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
++	sensor->sd.entity.function = MEDIA_ENT_F_CAM_SENSOR;
++	sensor->pad.flags = MEDIA_PAD_FL_SOURCE;
++	ret = media_entity_pads_init(&sensor->sd.entity, 1, &sensor->pad);
++	if (ret < 0)
++		goto mutex_remove;
++
++	gpiod_set_value_cansleep(sensor->reset, 1);
++	msleep(RESET_ACTIVE_DELAY_MS);
++
++	ret = irs1125_detect(&sensor->sd);
++	if (ret < 0)
++		goto error;
++
++	ret = irs1125_ident_setup(sensor, dev);
++	if (ret < 0)
++		goto error;
++
++	gpiod_set_value_cansleep(sensor->reset, 0);
++
++	ret = v4l2_async_register_subdev(&sensor->sd);
++	if (ret < 0)
++		goto error;
++
++	dev_dbg(dev, "Infineon IRS1125 camera driver probed\n");
++
++	return 0;
++
++error:
++	media_entity_cleanup(&sensor->sd.entity);
++mutex_remove:
++	mutex_destroy(&sensor->lock);
++	return ret;
++}
++
++static void irs1125_remove(struct i2c_client *client)
++{
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct irs1125 *irs1125 = to_state(sd);
++
++	v4l2_async_unregister_subdev(&irs1125->sd);
++	media_entity_cleanup(&irs1125->sd.entity);
++	v4l2_device_unregister_subdev(sd);
++	mutex_destroy(&irs1125->lock);
++	v4l2_ctrl_handler_free(&irs1125->ctrl_handler);
++}
++
++#if IS_ENABLED(CONFIG_OF)
++static const struct of_device_id irs1125_of_match[] = {
++	{ .compatible = "infineon,irs1125" },
++	{ /* sentinel */ },
++};
++MODULE_DEVICE_TABLE(of, irs1125_of_match);
++#endif
++
++static struct i2c_driver irs1125_driver = {
++	.driver = {
++		.of_match_table = of_match_ptr(irs1125_of_match),
++		.name	 = SENSOR_NAME,
++	},
++	.probe		= irs1125_probe,
++	.remove		= irs1125_remove,
++};
++
++module_i2c_driver(irs1125_driver);
++
++MODULE_AUTHOR("Markus Proeller <markus.proeller@pieye.org>");
++MODULE_DESCRIPTION("Infineon irs1125 sensor driver");
++MODULE_LICENSE("GPL v2");
++
+--- /dev/null
++++ b/drivers/media/i2c/irs1125.h
+@@ -0,0 +1,95 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * A V4L2 driver for Infineon IRS1125 TOF cameras.
++ * Copyright (C) 2018, pieye GmbH
++ *
++ * Based on V4L2 OmniVision OV5647 Image Sensor driver
++ * Copyright (C) 2016 Ramiro Oliveira <roliveir@synopsys.com>
++ *
++ * DT / fwnode changes, and GPIO control taken from ov5640.c
++ * Copyright (C) 2011-2013 Freescale Semiconductor, Inc. All Rights Reserved.
++ * Copyright (C) 2014-2017 Mentor Graphics Inc.
++ *
++ */
++
++#ifndef IRS1125_H
++#define IRS1125_H
++
++#include <linux/v4l2-controls.h>
++#include <linux/types.h>
++
++#define IRS1125_NUM_SEQ_ENTRIES 20
++#define IRS1125_NUM_MOD_PLLS 4
++
++#define IRS1125_CID_CUSTOM_BASE			(V4L2_CID_USER_BASE | 0xf000)
++#define IRS1125_CID_CONTINUOUS_TRIG		(IRS1125_CID_CUSTOM_BASE + 1)
++#define IRS1125_CID_TRIGGER			(IRS1125_CID_CUSTOM_BASE + 2)
++#define IRS1125_CID_RECONFIG			(IRS1125_CID_CUSTOM_BASE + 3)
++#define IRS1125_CID_ILLU_ON			(IRS1125_CID_CUSTOM_BASE + 4)
++#define IRS1125_CID_NUM_SEQS			(IRS1125_CID_CUSTOM_BASE + 5)
++#define IRS1125_CID_MOD_PLL			(IRS1125_CID_CUSTOM_BASE + 6)
++#define IRS1125_CID_SEQ_CONFIG			(IRS1125_CID_CUSTOM_BASE + 7)
++#define IRS1125_CID_IDENT0			(IRS1125_CID_CUSTOM_BASE + 8)
++#define IRS1125_CID_IDENT1			(IRS1125_CID_CUSTOM_BASE + 9)
++#define IRS1125_CID_IDENT2			(IRS1125_CID_CUSTOM_BASE + 10)
++#define IRS1125_CID_SAFE_RECONFIG_S0_EXPO	(IRS1125_CID_CUSTOM_BASE + 11)
++#define IRS1125_CID_SAFE_RECONFIG_S0_FRAME	(IRS1125_CID_CUSTOM_BASE + 12)
++#define IRS1125_CID_SAFE_RECONFIG_S1_EXPO	(IRS1125_CID_CUSTOM_BASE + 13)
++#define IRS1125_CID_SAFE_RECONFIG_S1_FRAME	(IRS1125_CID_CUSTOM_BASE + 14)
++#define IRS1125_CID_SAFE_RECONFIG_S2_EXPO	(IRS1125_CID_CUSTOM_BASE + 15)
++#define IRS1125_CID_SAFE_RECONFIG_S2_FRAME	(IRS1125_CID_CUSTOM_BASE + 16)
++#define IRS1125_CID_SAFE_RECONFIG_S3_EXPO	(IRS1125_CID_CUSTOM_BASE + 17)
++#define IRS1125_CID_SAFE_RECONFIG_S3_FRAME	(IRS1125_CID_CUSTOM_BASE + 18)
++#define IRS1125_CID_SAFE_RECONFIG_S4_EXPO	(IRS1125_CID_CUSTOM_BASE + 19)
++#define IRS1125_CID_SAFE_RECONFIG_S4_FRAME	(IRS1125_CID_CUSTOM_BASE + 20)
++#define IRS1125_CID_SAFE_RECONFIG_S5_EXPO	(IRS1125_CID_CUSTOM_BASE + 21)
++#define IRS1125_CID_SAFE_RECONFIG_S5_FRAME	(IRS1125_CID_CUSTOM_BASE + 22)
++#define IRS1125_CID_SAFE_RECONFIG_S6_EXPO	(IRS1125_CID_CUSTOM_BASE + 23)
++#define IRS1125_CID_SAFE_RECONFIG_S6_FRAME	(IRS1125_CID_CUSTOM_BASE + 24)
++#define IRS1125_CID_SAFE_RECONFIG_S7_EXPO	(IRS1125_CID_CUSTOM_BASE + 25)
++#define IRS1125_CID_SAFE_RECONFIG_S7_FRAME	(IRS1125_CID_CUSTOM_BASE + 26)
++#define IRS1125_CID_SAFE_RECONFIG_S8_EXPO	(IRS1125_CID_CUSTOM_BASE + 27)
++#define IRS1125_CID_SAFE_RECONFIG_S8_FRAME	(IRS1125_CID_CUSTOM_BASE + 28)
++#define IRS1125_CID_SAFE_RECONFIG_S9_EXPO	(IRS1125_CID_CUSTOM_BASE + 29)
++#define IRS1125_CID_SAFE_RECONFIG_S9_FRAME	(IRS1125_CID_CUSTOM_BASE + 30)
++#define IRS1125_CID_SAFE_RECONFIG_S10_EXPO	(IRS1125_CID_CUSTOM_BASE + 31)
++#define IRS1125_CID_SAFE_RECONFIG_S10_FRAME	(IRS1125_CID_CUSTOM_BASE + 32)
++#define IRS1125_CID_SAFE_RECONFIG_S11_EXPO	(IRS1125_CID_CUSTOM_BASE + 33)
++#define IRS1125_CID_SAFE_RECONFIG_S11_FRAME	(IRS1125_CID_CUSTOM_BASE + 34)
++#define IRS1125_CID_SAFE_RECONFIG_S12_EXPO	(IRS1125_CID_CUSTOM_BASE + 35)
++#define IRS1125_CID_SAFE_RECONFIG_S12_FRAME	(IRS1125_CID_CUSTOM_BASE + 36)
++#define IRS1125_CID_SAFE_RECONFIG_S13_EXPO	(IRS1125_CID_CUSTOM_BASE + 37)
++#define IRS1125_CID_SAFE_RECONFIG_S13_FRAME	(IRS1125_CID_CUSTOM_BASE + 38)
++#define IRS1125_CID_SAFE_RECONFIG_S14_EXPO	(IRS1125_CID_CUSTOM_BASE + 39)
++#define IRS1125_CID_SAFE_RECONFIG_S14_FRAME	(IRS1125_CID_CUSTOM_BASE + 40)
++#define IRS1125_CID_SAFE_RECONFIG_S15_EXPO	(IRS1125_CID_CUSTOM_BASE + 41)
++#define IRS1125_CID_SAFE_RECONFIG_S15_FRAME	(IRS1125_CID_CUSTOM_BASE + 42)
++#define IRS1125_CID_SAFE_RECONFIG_S16_EXPO	(IRS1125_CID_CUSTOM_BASE + 43)
++#define IRS1125_CID_SAFE_RECONFIG_S16_FRAME	(IRS1125_CID_CUSTOM_BASE + 44)
++#define IRS1125_CID_SAFE_RECONFIG_S17_EXPO	(IRS1125_CID_CUSTOM_BASE + 45)
++#define IRS1125_CID_SAFE_RECONFIG_S17_FRAME	(IRS1125_CID_CUSTOM_BASE + 46)
++#define IRS1125_CID_SAFE_RECONFIG_S18_EXPO	(IRS1125_CID_CUSTOM_BASE + 47)
++#define IRS1125_CID_SAFE_RECONFIG_S18_FRAME	(IRS1125_CID_CUSTOM_BASE + 48)
++#define IRS1125_CID_SAFE_RECONFIG_S19_EXPO	(IRS1125_CID_CUSTOM_BASE + 49)
++#define IRS1125_CID_SAFE_RECONFIG_S19_FRAME	(IRS1125_CID_CUSTOM_BASE + 50)
++
++struct irs1125_seq_cfg {
++	__u16 exposure;
++	__u16 framerate;
++	__u16 ps;
++	__u16 pll;
++};
++
++struct irs1125_mod_pll {
++	__u16 pllcfg1;
++	__u16 pllcfg2;
++	__u16 pllcfg3;
++	__u16 pllcfg4;
++	__u16 pllcfg5;
++	__u16 pllcfg6;
++	__u16 pllcfg7;
++	__u16 pllcfg8;
++};
++
++#endif /* IRS1125 */
++
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0154-drm-v3d-Suppress-all-but-the-first-MMU-error.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0154-drm-v3d-Suppress-all-but-the-first-MMU-error.patch
new file mode 100644
index 00000000..46c170cc
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0154-drm-v3d-Suppress-all-but-the-first-MMU-error.patch
@@ -0,0 +1,39 @@
+From 8afee8e7407eb6066517b8c47331accb8bd86c19 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Mon, 11 Nov 2019 20:18:08 +0000
+Subject: [PATCH 154/697] drm/v3d: Suppress all but the first MMU error
+
+The v3d driver currently encounters a lot of MMU PTE exceptions, so
+only log the first to avoid swamping the kernel log.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/gpu/drm/v3d/v3d_irq.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/v3d/v3d_irq.c
++++ b/drivers/gpu/drm/v3d/v3d_irq.c
+@@ -185,6 +185,7 @@ v3d_hub_irq(int irq, void *arg)
+ 			"GMP",
+ 		};
+ 		const char *client = "?";
++		static int logged_error;
+ 
+ 		V3D_WRITE(V3D_MMU_CTL, V3D_READ(V3D_MMU_CTL));
+ 
+@@ -194,6 +195,7 @@ v3d_hub_irq(int irq, void *arg)
+ 				client = v3d41_axi_ids[axi_id];
+ 		}
+ 
++		if (!logged_error)
+ 		dev_err(v3d->drm.dev, "MMU error from client %s (%d) at 0x%llx%s%s%s\n",
+ 			client, axi_id, (long long)vio_addr,
+ 			((intsts & V3D_HUB_INT_MMU_WRV) ?
+@@ -202,6 +204,7 @@ v3d_hub_irq(int irq, void *arg)
+ 			 ", pte invalid" : ""),
+ 			((intsts & V3D_HUB_INT_MMU_CAP) ?
+ 			 ", cap exceeded" : ""));
++		logged_error = 1;
+ 		status = IRQ_HANDLED;
+ 	}
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0155-staging-vchiq_arm-Register-vcsm-cma-as-a-platform-dr.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0155-staging-vchiq_arm-Register-vcsm-cma-as-a-platform-dr.patch
new file mode 100644
index 00000000..8cf601f7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0155-staging-vchiq_arm-Register-vcsm-cma-as-a-platform-dr.patch
@@ -0,0 +1,40 @@
+From 542b513f6325010dfc4e82d442c3756dd1e498a7 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 6 Nov 2019 13:57:48 +0000
+Subject: [PATCH 155/697] staging: vchiq_arm: Register vcsm-cma as a platform
+ driver
+
+Following the same pattern as bcm2835-camera and bcm2835-audio,
+register the vcsm-cma driver as a platform driver
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+@@ -66,6 +66,7 @@
+  */
+ static struct vchiq_device *bcm2835_audio;
+ static struct vchiq_device *bcm2835_camera;
++static struct vchiq_device *vcsm_cma;
+ 
+ static const struct vchiq_platform_info bcm2835_info = {
+ 	.cache_line_size = 32,
+@@ -1760,6 +1761,7 @@ static int vchiq_probe(struct platform_d
+ 		goto error_exit;
+ 	}
+ 
++	vcsm_cma = vchiq_device_register(&pdev->dev, "vcsm-cma");
+ 	bcm2835_audio = vchiq_device_register(&pdev->dev, "bcm2835-audio");
+ 	bcm2835_camera = vchiq_device_register(&pdev->dev, "bcm2835-camera");
+ 
+@@ -1778,6 +1780,7 @@ static void vchiq_remove(struct platform
+ 
+ 	vchiq_device_unregister(bcm2835_audio);
+ 	vchiq_device_unregister(bcm2835_camera);
++	vchiq_device_unregister(vcsm_cma);
+ 	vchiq_debugfs_deinit();
+ 	vchiq_deregister_chrdev();
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0156-staging-vchiq_arm-Register-bcm2835-codec-as-a-platfo.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0156-staging-vchiq_arm-Register-bcm2835-codec-as-a-platfo.patch
new file mode 100644
index 00000000..e7667601
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0156-staging-vchiq_arm-Register-bcm2835-codec-as-a-platfo.patch
@@ -0,0 +1,40 @@
+From 148a5c56ddeb4c66f5c0bb4cda9c7610698ebb20 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 6 Nov 2019 13:57:58 +0000
+Subject: [PATCH 156/697] staging: vchiq_arm: Register bcm2835-codec as a
+ platform driver
+
+Following the same pattern as bcm2835-camera and bcm2835-audio,
+register the V4L2 codec driver as a platform driver
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+@@ -66,6 +66,7 @@
+  */
+ static struct vchiq_device *bcm2835_audio;
+ static struct vchiq_device *bcm2835_camera;
++static struct vchiq_device *bcm2835_codec;
+ static struct vchiq_device *vcsm_cma;
+ 
+ static const struct vchiq_platform_info bcm2835_info = {
+@@ -1762,6 +1763,7 @@ static int vchiq_probe(struct platform_d
+ 	}
+ 
+ 	vcsm_cma = vchiq_device_register(&pdev->dev, "vcsm-cma");
++	bcm2835_codec = vchiq_device_register(&pdev->dev, "bcm2835-codec");
+ 	bcm2835_audio = vchiq_device_register(&pdev->dev, "bcm2835-audio");
+ 	bcm2835_camera = vchiq_device_register(&pdev->dev, "bcm2835-camera");
+ 
+@@ -1780,6 +1782,7 @@ static void vchiq_remove(struct platform
+ 
+ 	vchiq_device_unregister(bcm2835_audio);
+ 	vchiq_device_unregister(bcm2835_camera);
++	vchiq_device_unregister(bcm2835_codec);
+ 	vchiq_device_unregister(vcsm_cma);
+ 	vchiq_debugfs_deinit();
+ 	vchiq_deregister_chrdev();
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0157-net-phy-broadcom-Allow-ethernet-LED-mode-to-be-set-v.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0157-net-phy-broadcom-Allow-ethernet-LED-mode-to-be-set-v.patch
new file mode 100644
index 00000000..7c8ec13e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0157-net-phy-broadcom-Allow-ethernet-LED-mode-to-be-set-v.patch
@@ -0,0 +1,77 @@
+From 0fabd5e4fd945d5b81a760a45c55cb2cc1b0c404 Mon Sep 17 00:00:00 2001
+From: James Hughes <james.hughes@raspberrypi.org>
+Date: Thu, 31 Oct 2019 14:39:44 +0000
+Subject: [PATCH 157/697] net: phy: broadcom: Allow ethernet LED mode to be set
+ via device tree
+
+Add device tree entries and code to allow the specification of
+the lighting modes for the LED's on the ethernet connector.
+
+Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
+
+net:phy:2711 Change the default ethernet LED actions
+
+This should return default behaviour back to that of previous
+releases.
+
+net: phy: broadcom: Make LEDs 3+4 shadow LEDs 1+2
+
+CM4 uses BCM54210PE, which supports 2 additional LEDs, choosing LED3
+for the amber LED because it shows activity by default (LED4 is not
+connected). However, this makes it uncontrollable by the eth_led<n>
+dtparams which target LEDs 1+2.
+
+Solve the problem by making LEDs 3+4 mirror LEDs 1+2 (which is much
+simpler than adding baseboard-specific overrides, but comes with a
+risk of making one of the LEDs redundant).
+
+See: https://github.com/raspberrypi/linux/issues/5289
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/net/phy/broadcom.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/phy/broadcom.c
++++ b/drivers/net/phy/broadcom.c
+@@ -430,6 +430,9 @@ static int bcm54811_config_init(struct p
+ static int bcm54xx_config_init(struct phy_device *phydev)
+ {
+ 	int reg, err, val;
++	u32 led_modes[] = {BCM_LED_MULTICOLOR_LINK_ACT,
++			   BCM_LED_MULTICOLOR_LINK};
++	struct device_node *np = phydev->mdio.dev.of_node;
+ 
+ 	reg = phy_read(phydev, MII_BCM54XX_ECR);
+ 	if (reg < 0)
+@@ -488,10 +491,10 @@ static int bcm54xx_config_init(struct ph
+ 
+ 	bcm54xx_phydsp_config(phydev);
+ 
++	of_property_read_u32_array(np, "led-modes", led_modes, 2);
++
+ 	/* For non-SFP setups, encode link speed into LED1 and LED3 pair
+ 	 * (green/amber).
+-	 * Also flash these two LEDs on activity. This means configuring
+-	 * them for MULTICOLOR and encoding link/activity into them.
+ 	 * Don't do this for devices on an SFP module, since some of these
+ 	 * use the LED outputs to control the SFP LOS signal, and changing
+ 	 * these settings will cause LOS to malfunction.
+@@ -500,10 +503,15 @@ static int bcm54xx_config_init(struct ph
+ 		val = BCM54XX_SHD_LEDS1_LED1(BCM_LED_SRC_MULTICOLOR1) |
+ 			BCM54XX_SHD_LEDS1_LED3(BCM_LED_SRC_MULTICOLOR1);
+ 		bcm_phy_write_shadow(phydev, BCM54XX_SHD_LEDS1, val);
++		/* BCM54210PE controls two extra LEDs with the next register.
++		 * Make them shadow the first pair of LEDs - useful on CM4 which
++		 * uses LED3 for ETH_LEDY instead of LED1.
++		 */
++		bcm_phy_write_shadow(phydev, BCM54XX_SHD_LEDS1 + 1, val);
+ 
+ 		val = BCM_LED_MULTICOLOR_IN_PHASE |
+-			BCM54XX_SHD_LEDS1_LED1(BCM_LED_MULTICOLOR_LINK_ACT) |
+-			BCM54XX_SHD_LEDS1_LED3(BCM_LED_MULTICOLOR_LINK_ACT);
++			BCM54XX_SHD_LEDS1_LED1(led_modes[0]) |
++			BCM54XX_SHD_LEDS1_LED3(led_modes[1]);
+ 		bcm_phy_write_exp(phydev, BCM_EXP_MULTICOLOR, val);
+ 	}
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0158-phy-broadcom-split-out-the-BCM54213PE-from-the-BCM54.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0158-phy-broadcom-split-out-the-BCM54213PE-from-the-BCM54.patch
new file mode 100644
index 00000000..fa37ab7f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0158-phy-broadcom-split-out-the-BCM54213PE-from-the-BCM54.patch
@@ -0,0 +1,71 @@
+From 8e5a4239c49cfccbec359ca09d36a1807a1a4500 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.org>
+Date: Tue, 14 May 2019 17:00:41 +0100
+Subject: [PATCH 158/697] phy: broadcom: split out the BCM54213PE from the
+ BCM54210E IDs
+
+The last nibble is a revision ID, and the 54213pe is a later rev
+than the 54210e. Running the 54210e setup code on a 54213pe results
+in a broken RGMII interface.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
+---
+ drivers/net/phy/broadcom.c | 15 ++++++++++++---
+ include/linux/brcmphy.h    |  1 +
+ 2 files changed, 13 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/phy/broadcom.c
++++ b/drivers/net/phy/broadcom.c
+@@ -297,7 +297,8 @@ static void bcm54xx_adjust_rxrefclk(stru
+ 	    BRCM_PHY_MODEL(phydev) != PHY_ID_BCM50610M &&
+ 	    BRCM_PHY_MODEL(phydev) != PHY_ID_BCM54210E &&
+ 	    BRCM_PHY_MODEL(phydev) != PHY_ID_BCM54810 &&
+-	    BRCM_PHY_MODEL(phydev) != PHY_ID_BCM54811)
++	    BRCM_PHY_MODEL(phydev) != PHY_ID_BCM54811 &&
++	    BRCM_PHY_MODEL(phydev) != PHY_ID_BCM54213PE)
+ 		return;
+ 
+ 	val = bcm_phy_read_shadow(phydev, BCM54XX_SHD_SCR3);
+@@ -1444,7 +1445,7 @@ static struct phy_driver broadcom_driver
+ 	.link_change_notify	= bcm54xx_link_change_notify,
+ }, {
+ 	.phy_id		= PHY_ID_BCM54210E,
+-	.phy_id_mask	= 0xfffffff0,
++	.phy_id_mask	= 0xffffffff,
+ 	.name		= "Broadcom BCM54210E",
+ 	/* PHY_GBIT_FEATURES */
+ 	.flags		= PHY_ALWAYS_CALL_SUSPEND,
+@@ -1462,6 +1463,13 @@ static struct phy_driver broadcom_driver
+ 	.set_wol	= bcm54xx_phy_set_wol,
+ 	.led_brightness_set	= bcm_phy_led_brightness_set,
+ }, {
++	.phy_id		= PHY_ID_BCM54213PE,
++	.phy_id_mask	= 0xffffffff,
++	.name		= "Broadcom BCM54213PE",
++	/* PHY_GBIT_FEATURES */
++	.config_init	= bcm54xx_config_init,
++	.config_intr	= bcm_phy_config_intr,
++}, {
+ 	.phy_id		= PHY_ID_BCM5461,
+ 	.phy_id_mask	= 0xfffffff0,
+ 	.name		= "Broadcom BCM5461",
+@@ -1728,7 +1736,8 @@ module_phy_driver(broadcom_drivers);
+ static struct mdio_device_id __maybe_unused broadcom_tbl[] = {
+ 	{ PHY_ID_BCM5411, 0xfffffff0 },
+ 	{ PHY_ID_BCM5421, 0xfffffff0 },
+-	{ PHY_ID_BCM54210E, 0xfffffff0 },
++	{ PHY_ID_BCM54210E, 0xffffffff },
++	{ PHY_ID_BCM54213PE, 0xffffffff },
+ 	{ PHY_ID_BCM5461, 0xfffffff0 },
+ 	{ PHY_ID_BCM54612E, 0xfffffff0 },
+ 	{ PHY_ID_BCM54616S, 0xfffffff0 },
+--- a/include/linux/brcmphy.h
++++ b/include/linux/brcmphy.h
+@@ -24,6 +24,7 @@
+ #define PHY_ID_BCM5411			0x00206070
+ #define PHY_ID_BCM5421			0x002060e0
+ #define PHY_ID_BCM54210E		0x600d84a0
++#define PHY_ID_BCM54213PE		0x600d84a2
+ #define PHY_ID_BCM5464			0x002060b0
+ #define PHY_ID_BCM5461			0x002060c0
+ #define PHY_ID_BCM54612E		0x03625e60
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0159-phy-broadcom-Add-bcm54213pe-configuration.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0159-phy-broadcom-Add-bcm54213pe-configuration.patch
new file mode 100644
index 00000000..f291de7e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0159-phy-broadcom-Add-bcm54213pe-configuration.patch
@@ -0,0 +1,34 @@
+From 22abbbae0b13dab17640493a220c586a0475bb1c Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 29 Oct 2020 14:10:56 +0000
+Subject: [PATCH 159/697] phy: broadcom: Add bcm54213pe configuration
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/net/phy/broadcom.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/net/phy/broadcom.c
++++ b/drivers/net/phy/broadcom.c
+@@ -126,6 +126,11 @@ static int bcm54210e_config_init(struct
+ 	return 0;
+ }
+ 
++static int bcm54213pe_config_init(struct phy_device *phydev)
++{
++	return bcm54210e_config_init(phydev);
++}
++
+ static int bcm54612e_config_init(struct phy_device *phydev)
+ {
+ 	int reg;
+@@ -471,6 +476,9 @@ static int bcm54xx_config_init(struct ph
+ 	case PHY_ID_BCM54612E:
+ 		err = bcm54612e_config_init(phydev);
+ 		break;
++	case PHY_ID_BCM54213PE:
++		err = bcm54213pe_config_init(phydev);
++		break;
+ 	case PHY_ID_BCM54616S:
+ 		err = bcm54616s_config_init(phydev);
+ 		break;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0160-net-phy-broadcom-optionally-enable-link-down-powersa.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0160-net-phy-broadcom-optionally-enable-link-down-powersa.patch
new file mode 100644
index 00000000..a591a03b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0160-net-phy-broadcom-optionally-enable-link-down-powersa.patch
@@ -0,0 +1,26 @@
+From fd508ca8cf9443c9b7f5a8ddf8e1d01cbc600df4 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Mon, 22 May 2023 15:31:17 +0100
+Subject: [PATCH 160/697] net: phy: broadcom: optionally enable link-down
+ powersave based on DT
+
+It's really a function of the board whether or not to use this feature
+as it may require MAC compatibility as well as interop testing.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/net/phy/broadcom.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/phy/broadcom.c
++++ b/drivers/net/phy/broadcom.c
+@@ -463,6 +463,9 @@ static int bcm54xx_config_init(struct ph
+ 	    (phydev->dev_flags & PHY_BRCM_CLEAR_RGMII_MODE))
+ 		bcm_phy_write_shadow(phydev, BCM54XX_SHD_RGMII_MODE, 0);
+ 
++	if (of_property_read_bool(np, "brcm,powerdown-enable"))
++		phydev->dev_flags |= PHY_BRCM_AUTO_PWRDWN_ENABLE;
++
+ 	bcm54xx_adjust_rxrefclk(phydev);
+ 
+ 	switch (BRCM_PHY_MODEL(phydev)) {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0161-net-phy-BCM54210PE-does-not-support-PTP.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0161-net-phy-BCM54210PE-does-not-support-PTP.patch
new file mode 100644
index 00000000..1798b99f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0161-net-phy-BCM54210PE-does-not-support-PTP.patch
@@ -0,0 +1,44 @@
+From 4bac48c501fe87dfadd3f97809801768989c2c26 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Sat, 5 Nov 2022 11:46:08 +0000
+Subject: [PATCH 161/697] net: phy: BCM54210PE does not support PTP
+
+BCM54213PE is an Ethernet PHY that supports PTP hardware timestamping.
+BCM54210PW ia another Ethernet PHY, but one without PTP support.
+Unfortunately the two PHYs return the same ID when queried, so some
+extra information is required to determine whether the PHY is PTP-
+capable.
+
+There are two Raspberry Pi products that use these PHYs - Pi 4B and
+CM4 - and fortunately they use different PHY addresses, so use that as
+a differentiator. Choose to treat a PHY with the same ID but another
+address as a BCM54210PE, which seems more common.
+
+See: https://github.com/raspberrypi/linux/issues/5104
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/net/phy/bcm-phy-ptp.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/net/phy/bcm-phy-ptp.c
++++ b/drivers/net/phy/bcm-phy-ptp.c
+@@ -913,6 +913,18 @@ struct bcm_ptp_private *bcm_ptp_probe(st
+ 	switch (BRCM_PHY_MODEL(phydev)) {
+ 	case PHY_ID_BCM54210E:
+ 		break;
++#ifdef PHY_ID_BCM54213PE
++	case PHY_ID_BCM54213PE:
++		switch (phydev->mdio.addr) {
++		case 0: // CM4 - this is a BCM54210PE which supports PTP
++			break;
++		case 1: //  4B - this is a BCM54213PE which doesn't
++			return NULL;
++		default: // Unknown - assume it's BCM54210PE
++			break;
++		}
++		break;
++#endif
+ 	default:
+ 		return NULL;
+ 	}
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0162-staging-vchiq_arm-Set-up-dma-ranges-on-child-devices.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0162-staging-vchiq_arm-Set-up-dma-ranges-on-child-devices.patch
new file mode 100644
index 00000000..b9dc3924
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0162-staging-vchiq_arm-Set-up-dma-ranges-on-child-devices.patch
@@ -0,0 +1,255 @@
+From 9cbaa6f00fcae127ae79aa1c817bf856cc66693d Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Tue, 29 Jan 2019 16:13:25 +0000
+Subject: [PATCH 162/697] staging: vchiq_arm: Set up dma ranges on child
+ devices
+
+The VCHIQ driver now loads the audio, camera, codec, and vc-sm
+drivers as platform drivers. However they were not being given
+the correct DMA configuration.
+
+Call of_dma_configure with the parent (VCHIQ) parameters to be
+inherited by the child.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+staging: vchiq: Use the old dma controller for OF config on platform devices
+
+vchiq on Pi4 is no longer under the soc node, therefore it
+doesn't get the dma-ranges for the VPU.
+
+Switch to using the configuration of the old dma controller as
+that will set the dma-ranges correctly.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+
+staging: vchiq_arm: Give vchiq children DT nodes
+
+vchiq kernel clients are now instantiated as platform drivers rather
+than using DT, but the children of the vchiq interface may still
+benefit from access to DT properties. Give them the option of a
+a sub-node of the vchiq parent for configuration and to allow
+them to be disabled.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+staging: vchiq_arm: Add 36-bit address support
+
+Conditional on a new compatible string, change the pagelist encoding
+such that the top 24 bits are the pfn, leaving 8 bits for run length
+(-1), giving a 36-bit address range.
+
+Manage the split between addresses for the VPU and addresses for the
+40-bit DMA controller with a dedicated DMA device pointer that on non-
+BCM2711 platforms is the same as the main VCHIQ device. This allows
+the VCHIQ node to stay in the usual place in the DT.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+staging: vchiq_arm: children inherit DMA config
+
+Although it is no longer necessary for vchiq's children to have a
+different DMA configuration to the parent, they do still need to
+explicitly to have their DMA configuration set - to be that of the
+parent.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ .../interface/vchiq_arm/vchiq_arm.c           | 105 ++++++++++++++----
+ .../interface/vchiq_arm/vchiq_arm.h           |   1 +
+ 2 files changed, 87 insertions(+), 19 deletions(-)
+
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+@@ -20,6 +20,7 @@
+ #include <linux/completion.h>
+ #include <linux/list.h>
+ #include <linux/of.h>
++#include <linux/of_platform.h>
+ #include <linux/platform_device.h>
+ #include <linux/compat.h>
+ #include <linux/dma-mapping.h>
+@@ -77,6 +78,11 @@ static const struct vchiq_platform_info
+ 	.cache_line_size = 64,
+ };
+ 
++static const struct vchiq_platform_info bcm2711_info = {
++	.cache_line_size = 64,
++	.use_36bit_addrs = true,
++};
++
+ struct vchiq_arm_state {
+ 	/* Keepalive-related data */
+ 	struct task_struct *ka_thread;
+@@ -123,6 +129,9 @@ struct vchiq_pagelist_info {
+ 	unsigned int scatterlist_mapped;
+ };
+ 
++static unsigned int g_use_36bit_addrs = 0;
++static struct device *g_dma_dev;
++
+ static int
+ vchiq_blocking_bulk_transfer(struct vchiq_instance *instance, unsigned int handle, void *data,
+ 			     unsigned int size, enum vchiq_bulk_dir dir);
+@@ -152,7 +161,7 @@ static void
+ cleanup_pagelistinfo(struct vchiq_instance *instance, struct vchiq_pagelist_info *pagelistinfo)
+ {
+ 	if (pagelistinfo->scatterlist_mapped) {
+-		dma_unmap_sg(instance->state->dev, pagelistinfo->scatterlist,
++		dma_unmap_sg(g_dma_dev, pagelistinfo->scatterlist,
+ 			     pagelistinfo->num_pages, pagelistinfo->dma_dir);
+ 	}
+ 
+@@ -364,7 +373,7 @@ create_pagelist(struct vchiq_instance *i
+ 		count -= len;
+ 	}
+ 
+-	dma_buffers = dma_map_sg(instance->state->dev,
++	dma_buffers = dma_map_sg(g_dma_dev,
+ 				 scatterlist,
+ 				 num_pages,
+ 				 pagelistinfo->dma_dir);
+@@ -378,22 +387,58 @@ create_pagelist(struct vchiq_instance *i
+ 
+ 	/* Combine adjacent blocks for performance */
+ 	k = 0;
+-	for_each_sg(scatterlist, sg, dma_buffers, i) {
+-		unsigned int len = sg_dma_len(sg);
+-		dma_addr_t addr = sg_dma_address(sg);
+-
+-		/* Note: addrs is the address + page_count - 1
+-		 * The firmware expects blocks after the first to be page-
+-		 * aligned and a multiple of the page size
+-		 */
+-		WARN_ON(len == 0);
+-		WARN_ON(i && (i != (dma_buffers - 1)) && (len & ~PAGE_MASK));
+-		WARN_ON(i && (addr & ~PAGE_MASK));
+-		if (is_adjacent_block(addrs, addr, k))
+-			addrs[k - 1] += ((len + PAGE_SIZE - 1) >> PAGE_SHIFT);
+-		else
+-			addrs[k++] = (addr & PAGE_MASK) |
+-				(((len + PAGE_SIZE - 1) >> PAGE_SHIFT) - 1);
++	if (g_use_36bit_addrs) {
++		for_each_sg(scatterlist, sg, dma_buffers, i) {
++			unsigned int len = sg_dma_len(sg);
++			dma_addr_t addr = sg_dma_address(sg);
++			u32 page_id = (u32)((addr >> 4) & ~0xff);
++			u32 sg_pages = (len + PAGE_SIZE - 1) >> PAGE_SHIFT;
++
++			/* Note: addrs is the address + page_count - 1
++			 * The firmware expects blocks after the first to be page-
++			 * aligned and a multiple of the page size
++			 */
++			WARN_ON(len == 0);
++			WARN_ON(i &&
++				(i != (dma_buffers - 1)) && (len & ~PAGE_MASK));
++			WARN_ON(i && (addr & ~PAGE_MASK));
++			WARN_ON(upper_32_bits(addr) > 0xf);
++
++			if (k > 0 &&
++			    ((addrs[k - 1] & ~0xff) +
++			     (((addrs[k - 1] & 0xff) + 1) << 8)
++			     == page_id)) {
++				u32 inc_pages = min(sg_pages,
++						    0xff - (addrs[k - 1] & 0xff));
++				addrs[k - 1] += inc_pages;
++				page_id += inc_pages << 8;
++				sg_pages -= inc_pages;
++			}
++			while (sg_pages) {
++				u32 inc_pages = min(sg_pages, 0x100u);
++				addrs[k++] = page_id | (inc_pages - 1);
++				page_id += inc_pages << 8;
++				sg_pages -= inc_pages;
++			}
++		}
++	} else {
++		for_each_sg(scatterlist, sg, dma_buffers, i) {
++			unsigned int len = sg_dma_len(sg);
++			dma_addr_t addr = sg_dma_address(sg);
++
++			/* Note: addrs is the address + page_count - 1
++			 * The firmware expects blocks after the first to be page-
++			 * aligned and a multiple of the page size
++			 */
++			WARN_ON(len == 0);
++			WARN_ON(i && (i != (dma_buffers - 1)) && (len & ~PAGE_MASK));
++			WARN_ON(i && (addr & ~PAGE_MASK));
++			if (is_adjacent_block(addrs, addr, k))
++				addrs[k - 1] += ((len + PAGE_SIZE - 1) >> PAGE_SHIFT);
++			else
++				addrs[k++] = (addr & PAGE_MASK) |
++					(((len + PAGE_SIZE - 1) >> PAGE_SHIFT) - 1);
++		}
+ 	}
+ 
+ 	/* Partial cache lines (fragments) require special measures */
+@@ -439,7 +484,7 @@ free_pagelist(struct vchiq_instance *ins
+ 	 * NOTE: dma_unmap_sg must be called before the
+ 	 * cpu can touch any of the data/pages.
+ 	 */
+-	dma_unmap_sg(instance->state->dev, pagelistinfo->scatterlist,
++	dma_unmap_sg(g_dma_dev, pagelistinfo->scatterlist,
+ 		     pagelistinfo->num_pages, pagelistinfo->dma_dir);
+ 	pagelistinfo->scatterlist_mapped = 0;
+ 
+@@ -494,6 +539,7 @@ free_pagelist(struct vchiq_instance *ins
+ static int vchiq_platform_init(struct platform_device *pdev, struct vchiq_state *state)
+ {
+ 	struct device *dev = &pdev->dev;
++	struct device *dma_dev = NULL;
+ 	struct vchiq_drv_mgmt *drv_mgmt = platform_get_drvdata(pdev);
+ 	struct rpi_firmware *fw = drv_mgmt->fw;
+ 	struct vchiq_slot_zero *vchiq_slot_zero;
+@@ -514,6 +560,24 @@ static int vchiq_platform_init(struct pl
+ 
+ 	drv_mgmt->fragments_size = 2 * drv_mgmt->info->cache_line_size;
+ 
++	if (drv_mgmt->info->use_36bit_addrs) {
++		struct device_node *dma_node =
++			of_find_compatible_node(NULL, NULL, "brcm,bcm2711-dma");
++
++		if (dma_node) {
++			struct platform_device *pdev;
++
++			pdev = of_find_device_by_node(dma_node);
++			if (pdev)
++				dma_dev = &pdev->dev;
++			of_node_put(dma_node);
++			g_use_36bit_addrs = true;
++		} else {
++			dev_err(dev, "40-bit DMA controller not found\n");
++			return -EINVAL;
++		}
++	}
++
+ 	/* Allocate space for the channels in coherent memory */
+ 	slot_mem_size = PAGE_ALIGN(TOTAL_SLOTS * VCHIQ_SLOT_SIZE);
+ 	frag_mem_size = PAGE_ALIGN(drv_mgmt->fragments_size * MAX_FRAGMENTS);
+@@ -581,6 +645,8 @@ static int vchiq_platform_init(struct pl
+ 		return -ENXIO;
+ 	}
+ 
++	g_dma_dev = dma_dev ?: dev;
++
+ 	dev_dbg(&pdev->dev, "arm: vchiq_init - done (slots %pK, phys %pad)\n",
+ 		vchiq_slot_zero, &slot_phys);
+ 
+@@ -1711,6 +1777,7 @@ void vchiq_platform_conn_state_changed(s
+ static const struct of_device_id vchiq_of_match[] = {
+ 	{ .compatible = "brcm,bcm2835-vchiq", .data = &bcm2835_info },
+ 	{ .compatible = "brcm,bcm2836-vchiq", .data = &bcm2836_info },
++	{ .compatible = "brcm,bcm2711-vchiq", .data = &bcm2711_info },
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(of, vchiq_of_match);
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.h
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.h
+@@ -32,6 +32,7 @@ enum USE_TYPE_E {
+ 
+ struct vchiq_platform_info {
+ 	unsigned int cache_line_size;
++	bool use_36bit_addrs;
+ };
+ 
+ struct vchiq_drv_mgmt {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0163-staging-vchiq_arm-Usa-a-DMA-pool-for-small-bulks.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0163-staging-vchiq_arm-Usa-a-DMA-pool-for-small-bulks.patch
new file mode 100644
index 00000000..8aae8fdc
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0163-staging-vchiq_arm-Usa-a-DMA-pool-for-small-bulks.patch
@@ -0,0 +1,118 @@
+From f8ce7f7757f956a457dff0cac4d193669d34ff9b Mon Sep 17 00:00:00 2001
+From: detule <ogjoneski@gmail.com>
+Date: Tue, 2 Oct 2018 04:10:08 -0400
+Subject: [PATCH 163/697] staging: vchiq_arm: Usa a DMA pool for small bulks
+
+During a bulk transfer we request a DMA allocation to hold the
+scatter-gather list.  Most of the time, this allocation is small
+(<< PAGE_SIZE), however it can be requested at a high enough frequency
+to cause fragmentation and/or stress the CMA allocator (think time
+spent in compaction here, or during allocations elsewhere).
+
+Implement a pool to serve up small DMA allocations, falling back
+to a coherent allocation if the request is greater than
+VCHIQ_DMA_POOL_SIZE.
+
+Signed-off-by: Oliver Gjoneski <ogjoneski@gmail.com>
+---
+ .../interface/vchiq_arm/vchiq_arm.c           | 33 ++++++++++++++++---
+ 1 file changed, 29 insertions(+), 4 deletions(-)
+
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+@@ -24,6 +24,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/compat.h>
+ #include <linux/dma-mapping.h>
++#include <linux/dmapool.h>
+ #include <linux/rcupdate.h>
+ #include <linux/delay.h>
+ #include <linux/slab.h>
+@@ -53,6 +54,8 @@
+ 
+ #define ARM_DS_ACTIVE	BIT(2)
+ 
++#define VCHIQ_DMA_POOL_SIZE PAGE_SIZE
++
+ /* Override the default prefix, which would be vchiq_arm (from the filename) */
+ #undef MODULE_PARAM_PREFIX
+ #define MODULE_PARAM_PREFIX DEVICE_NAME "."
+@@ -121,6 +124,7 @@ struct vchiq_pagelist_info {
+ 	struct pagelist *pagelist;
+ 	size_t pagelist_buffer_size;
+ 	dma_addr_t dma_addr;
++	bool is_from_pool;
+ 	enum dma_data_direction dma_dir;
+ 	unsigned int num_pages;
+ 	unsigned int pages_need_release;
+@@ -129,6 +133,7 @@ struct vchiq_pagelist_info {
+ 	unsigned int scatterlist_mapped;
+ };
+ 
++static struct dma_pool *g_dma_pool;
+ static unsigned int g_use_36bit_addrs = 0;
+ static struct device *g_dma_dev;
+ 
+@@ -168,8 +173,13 @@ cleanup_pagelistinfo(struct vchiq_instan
+ 	if (pagelistinfo->pages_need_release)
+ 		unpin_user_pages(pagelistinfo->pages, pagelistinfo->num_pages);
+ 
+-	dma_free_coherent(instance->state->dev, pagelistinfo->pagelist_buffer_size,
+-			  pagelistinfo->pagelist, pagelistinfo->dma_addr);
++	if (pagelistinfo->is_from_pool) {
++		dma_pool_free(g_dma_pool, pagelistinfo->pagelist,
++			      pagelistinfo->dma_addr);
++	} else {
++		dma_free_coherent(instance->state->dev, pagelistinfo->pagelist_buffer_size,
++				  pagelistinfo->pagelist, pagelistinfo->dma_addr);
++	}
+ }
+ 
+ static inline bool
+@@ -255,6 +265,7 @@ create_pagelist(struct vchiq_instance *i
+ 	u32 *addrs;
+ 	unsigned int num_pages, offset, i, k;
+ 	int actual_pages;
++	bool is_from_pool;
+ 	size_t pagelist_size;
+ 	struct scatterlist *scatterlist, *sg;
+ 	int dma_buffers;
+@@ -286,8 +297,14 @@ create_pagelist(struct vchiq_instance *i
+ 	/* Allocate enough storage to hold the page pointers and the page
+ 	 * list
+ 	 */
+-	pagelist = dma_alloc_coherent(instance->state->dev, pagelist_size, &dma_addr,
+-				      GFP_KERNEL);
++	if (pagelist_size > VCHIQ_DMA_POOL_SIZE) {
++		pagelist = dma_alloc_coherent(instance->state->dev, pagelist_size, &dma_addr,
++					      GFP_KERNEL);
++		is_from_pool = false;
++	} else {
++		pagelist = dma_pool_alloc(g_dma_pool, GFP_KERNEL, &dma_addr);
++		is_from_pool = true;
++	}
+ 
+ 	dev_dbg(instance->state->dev, "arm: %pK\n", pagelist);
+ 
+@@ -308,6 +325,7 @@ create_pagelist(struct vchiq_instance *i
+ 	pagelistinfo->pagelist = pagelist;
+ 	pagelistinfo->pagelist_buffer_size = pagelist_size;
+ 	pagelistinfo->dma_addr = dma_addr;
++	pagelistinfo->is_from_pool = is_from_pool;
+ 	pagelistinfo->dma_dir =  (type == PAGELIST_WRITE) ?
+ 				  DMA_TO_DEVICE : DMA_FROM_DEVICE;
+ 	pagelistinfo->num_pages = num_pages;
+@@ -646,6 +664,13 @@ static int vchiq_platform_init(struct pl
+ 	}
+ 
+ 	g_dma_dev = dma_dev ?: dev;
++	g_dma_pool = dmam_pool_create("vchiq_scatter_pool", dev,
++				      VCHIQ_DMA_POOL_SIZE,
++				      drv_mgmt->info->cache_line_size, 0);
++	if (!g_dma_pool) {
++		dev_err(dev, "failed to create dma pool");
++		return -ENOMEM;
++	}
+ 
+ 	dev_dbg(&pdev->dev, "arm: vchiq_init - done (slots %pK, phys %pad)\n",
+ 		vchiq_slot_zero, &slot_phys);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0164-staging-vchiq-Load-bcm2835_isp-driver-from-vchiq.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0164-staging-vchiq-Load-bcm2835_isp-driver-from-vchiq.patch
new file mode 100644
index 00000000..d6d28dce
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0164-staging-vchiq-Load-bcm2835_isp-driver-from-vchiq.patch
@@ -0,0 +1,39 @@
+From 5d01578659c164c4f81f7c5f526179fadfa3f83d Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Wed, 22 Apr 2020 08:32:32 +0100
+Subject: [PATCH 164/697] staging: vchiq: Load bcm2835_isp driver from vchiq
+
+bcmn2835_isp is a platform driver dependent on vchiq,
+therefore add the load/unload functions for it to vchiq.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+@@ -71,6 +71,7 @@
+ static struct vchiq_device *bcm2835_audio;
+ static struct vchiq_device *bcm2835_camera;
+ static struct vchiq_device *bcm2835_codec;
++static struct vchiq_device *bcm2835_isp;
+ static struct vchiq_device *vcsm_cma;
+ 
+ static const struct vchiq_platform_info bcm2835_info = {
+@@ -1858,6 +1859,7 @@ static int vchiq_probe(struct platform_d
+ 	bcm2835_codec = vchiq_device_register(&pdev->dev, "bcm2835-codec");
+ 	bcm2835_audio = vchiq_device_register(&pdev->dev, "bcm2835-audio");
+ 	bcm2835_camera = vchiq_device_register(&pdev->dev, "bcm2835-camera");
++	bcm2835_isp = vchiq_device_register(&pdev->dev, "bcm2835-isp");
+ 
+ 	return 0;
+ 
+@@ -1872,6 +1874,7 @@ static void vchiq_remove(struct platform
+ 	struct vchiq_drv_mgmt *mgmt = dev_get_drvdata(&pdev->dev);
+ 	struct vchiq_arm_state *arm_state;
+ 
++	vchiq_device_unregister(bcm2835_isp);
+ 	vchiq_device_unregister(bcm2835_audio);
+ 	vchiq_device_unregister(bcm2835_camera);
+ 	vchiq_device_unregister(bcm2835_codec);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0165-pinctrl-bcm2835-Remove-gpiochip-on-error.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0165-pinctrl-bcm2835-Remove-gpiochip-on-error.patch
new file mode 100644
index 00000000..337a1471
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0165-pinctrl-bcm2835-Remove-gpiochip-on-error.patch
@@ -0,0 +1,25 @@
+From 487b952347dd4b9fa9f0e89dd2c3b60f5a6ba69b Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Mon, 6 Jan 2020 16:04:30 +0000
+Subject: [PATCH 165/697] pinctrl: bcm2835: Remove gpiochip on error
+
+A failure in gpiochip_irqchip_add leads to a leak of a gpiochip. Fix
+the leak with the use of devm_gpiochip_add_data.
+
+Fixes: 85ae9e512f43 ("pinctrl: bcm2835: switch to GPIOLIB_IRQCHIP")
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/pinctrl/bcm/pinctrl-bcm2835.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
++++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+@@ -1423,7 +1423,7 @@ static int bcm2835_pinctrl_probe(struct
+ 	girq->default_type = IRQ_TYPE_NONE;
+ 	girq->handler = handle_level_irq;
+ 
+-	err = gpiochip_add_data(&pc->gpio_chip, pc);
++	err = devm_gpiochip_add_data(dev, &pc->gpio_chip, pc);
+ 	if (err) {
+ 		dev_err(dev, "could not add GPIO chip\n");
+ 		goto out_remove;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0166-of-overlay-Correct-symbol-path-fixups.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0166-of-overlay-Correct-symbol-path-fixups.patch
new file mode 100644
index 00000000..b8398d51
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0166-of-overlay-Correct-symbol-path-fixups.patch
@@ -0,0 +1,37 @@
+From 9005a1b89b6adcf60ec6f01d20142a5de201a911 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 6 Feb 2020 12:23:15 +0000
+Subject: [PATCH 166/697] of: overlay: Correct symbol path fixups
+
+When symbols from overlays are added to the live tree their paths must
+be rebased. The translated symbol is normally the result of joining
+the fragment-relative path (with a leading "/") to the target path
+(either copied directly from the "target-path" property or resolved
+from the phandle). This translation fails when the target is the root
+node (a common case for Raspberry Pi overlays) because the resulting
+path starts with a double slash. For example, if target-path is "/" and
+the fragment adds a node called "newnode", the label associated with
+that node will be assigned the path "//newnode", which can't be found
+in the tree.
+
+Fix the failure case by explicitly replacing a target path of "/" with
+an empty string.
+
+Fixes: d1651b03c2df ("of: overlay: add overlay symbols to live device tree")
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/of/overlay.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/of/overlay.c
++++ b/drivers/of/overlay.c
+@@ -241,6 +241,8 @@ static struct property *dup_and_fixup_sy
+ 	if (!target_path)
+ 		return NULL;
+ 	target_path_len = strlen(target_path);
++	if (!strcmp(target_path, "/"))
++		target_path_len = 0;
+ 
+ 	new_prop = kzalloc(sizeof(*new_prop), GFP_KERNEL);
+ 	if (!new_prop)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0167-dt-bindings-pci-Add-DT-docs-for-Brcmstb-PCIe-device.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0167-dt-bindings-pci-Add-DT-docs-for-Brcmstb-PCIe-device.patch
new file mode 100644
index 00000000..172da645
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0167-dt-bindings-pci-Add-DT-docs-for-Brcmstb-PCIe-device.patch
@@ -0,0 +1,77 @@
+From 3169aec21edac1d26ff0604445885f9648d7a97c Mon Sep 17 00:00:00 2001
+From: Jim Quinlan <jim2101024@gmail.com>
+Date: Mon, 15 Jan 2018 18:28:39 -0500
+Subject: [PATCH 167/697] dt-bindings: pci: Add DT docs for Brcmstb PCIe device
+
+The DT bindings description of the Brcmstb PCIe device is described.  This
+node can be used by almost all Broadcom settop box chips, using
+ARM, ARM64, or MIPS CPU architectures.
+
+Signed-off-by: Jim Quinlan <jim2101024@gmail.com>
+---
+ .../devicetree/bindings/pci/brcmstb-pcie.txt  | 59 +++++++++++++++++++
+ 1 file changed, 59 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/pci/brcmstb-pcie.txt
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/pci/brcmstb-pcie.txt
+@@ -0,0 +1,59 @@
++Brcmstb PCIe Host Controller Device Tree Bindings
++
++Required Properties:
++- compatible
++  "brcm,bcm7425-pcie" -- for 7425 family MIPS-based SOCs.
++  "brcm,bcm7435-pcie" -- for 7435 family MIPS-based SOCs.
++  "brcm,bcm7445-pcie" -- for 7445 and later ARM based SOCs (not including
++      the 7278).
++  "brcm,bcm7278-pcie"  -- for 7278 family ARM-based SOCs.
++
++- reg -- the register start address and length for the PCIe reg block.
++- interrupts -- two interrupts are specified; the first interrupt is for
++     the PCI host controller and the second is for MSI if the built-in
++     MSI controller is to be used.
++- interrupt-names -- names of the interrupts (above): "pcie" and "msi".
++- #address-cells -- set to <3>.
++- #size-cells -- set to <2>.
++- #interrupt-cells: set to <1>.
++- interrupt-map-mask and interrupt-map, standard PCI properties to define the
++     mapping of the PCIe interface to interrupt numbers.
++- ranges: ranges for the PCI memory and I/O regions.
++- linux,pci-domain -- should be unique per host controller.
++
++Optional Properties:
++- clocks -- phandle of pcie clock.
++- clock-names -- set to "sw_pcie" if clocks is used.
++- dma-ranges -- Specifies the inbound memory mapping regions when
++     an "identity map" is not possible.
++- msi-controller -- this property is typically specified to have the
++     PCIe controller use its internal MSI controller.
++- msi-parent -- set to use an external MSI interrupt controller.
++- brcm,enable-ssc -- (boolean) indicates usage of spread-spectrum clocking.
++- max-link-speed --  (integer) indicates desired generation of link:
++     1 => 2.5 Gbps (gen1), 2 => 5.0 Gbps (gen2), 3 => 8.0 Gbps (gen3).
++
++Example Node:
++
++pcie0: pcie@f0460000 {
++		reg = <0x0 0xf0460000 0x0 0x9310>;
++		interrupts = <0x0 0x0 0x4>;
++		compatible = "brcm,bcm7445-pcie";
++		#address-cells = <3>;
++		#size-cells = <2>;
++		ranges = <0x02000000 0x00000000 0x00000000 0x00000000 0xc0000000 0x00000000 0x08000000
++			  0x02000000 0x00000000 0x08000000 0x00000000 0xc8000000 0x00000000 0x08000000>;
++		#interrupt-cells = <1>;
++		interrupt-map-mask = <0 0 0 7>;
++		interrupt-map = <0 0 0 1 &intc 0 47 3
++				 0 0 0 2 &intc 0 48 3
++				 0 0 0 3 &intc 0 49 3
++				 0 0 0 4 &intc 0 50 3>;
++		clocks = <&sw_pcie0>;
++		clock-names = "sw_pcie";
++		msi-parent = <&pcie0>;  /* use PCIe's internal MSI controller */
++		msi-controller;         /* use PCIe's internal MSI controller */
++		brcm,ssc;
++		max-link-speed = <1>;
++		linux,pci-domain = <0>;
++	};
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0168-bcmgenet-Disable-skip_umac_reset-by-default.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0168-bcmgenet-Disable-skip_umac_reset-by-default.patch
new file mode 100644
index 00000000..f23be80d
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0168-bcmgenet-Disable-skip_umac_reset-by-default.patch
@@ -0,0 +1,23 @@
+From 928c1d437be377c42cddeb75c7e195de0635df1d Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Wed, 1 Apr 2020 11:22:44 +0100
+Subject: [PATCH 168/697] bcmgenet: Disable skip_umac_reset by default
+
+Possible fixed upstream by 'net: bcmgenet: keep MAC in reset until PHY is up'
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -67,7 +67,7 @@
+ 
+ /* Forward declarations */
+ static void bcmgenet_set_rx_mode(struct net_device *dev);
+-static bool skip_umac_reset = true;
++static bool skip_umac_reset = false;
+ module_param(skip_umac_reset, bool, 0444);
+ MODULE_PARM_DESC(skip_umac_reset, "Skip UMAC reset step");
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0169-media-videodev2.h-Add-a-format-for-column-YUV4-2-0-m.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0169-media-videodev2.h-Add-a-format-for-column-YUV4-2-0-m.patch
new file mode 100644
index 00000000..5d53661b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0169-media-videodev2.h-Add-a-format-for-column-YUV4-2-0-m.patch
@@ -0,0 +1,309 @@
+From 650ca9fa241303afb287837d36464c4e66f8a6b6 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 24 Jan 2020 14:28:21 +0000
+Subject: [PATCH 169/697] media: videodev2.h: Add a format for column YUV4:2:0
+ modes
+
+Some of the Broadcom codec blocks use a column based YUV4:2:0 image
+format, so add the documentation and defines for both 8 and 10 bit
+versions.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../media/v4l/pixfmt-nv12-col128.rst          | 215 ++++++++++++++++++
+ .../media/v4l/pixfmt-yuv-planar.rst           |  12 +
+ .../userspace-api/media/v4l/yuv-formats.rst   |  19 ++
+ drivers/media/v4l2-core/v4l2-ioctl.c          |   2 +
+ include/uapi/linux/videodev2.h                |   4 +
+ 5 files changed, 252 insertions(+)
+ create mode 100644 Documentation/userspace-api/media/v4l/pixfmt-nv12-col128.rst
+
+--- /dev/null
++++ b/Documentation/userspace-api/media/v4l/pixfmt-nv12-col128.rst
+@@ -0,0 +1,215 @@
++.. Permission is granted to copy, distribute and/or modify this
++.. document under the terms of the GNU Free Documentation License,
++.. Version 1.1 or any later version published by the Free Software
++.. Foundation, with no Invariant Sections, no Front-Cover Texts
++.. and no Back-Cover Texts. A copy of the license is included at
++.. Documentation/media/uapi/fdl-appendix.rst.
++..
++.. TODO: replace it to GFDL-1.1-or-later WITH no-invariant-sections
++
++.. _V4L2_PIX_FMT_NV12_COL128:
++.. _V4L2_PIX_FMT_NV12_10_COL128:
++
++********************************************************************************
++V4L2_PIX_FMT_NV12_COL128, V4L2_PIX_FMT_NV12_10_COL128
++********************************************************************************
++
++
++V4L2_PIX_FMT_NV21_COL128
++Formats with ½ horizontal and vertical chroma resolution. This format
++has two planes - one for luminance and one for chrominance. Chroma
++samples are interleaved. The difference to ``V4L2_PIX_FMT_NV12`` is the
++memory layout. The image is split into columns of 128 bytes wide rather than
++being in raster order.
++
++V4L2_PIX_FMT_NV12_10_COL128
++Follows the same pattern as ``V4L2_PIX_FMT_NV21_COL128`` with 128 byte, but is
++a 10bit format with 3 10-bit samples being packed into 4 bytes. Each 128 byte
++wide column therefore contains 96 samples.
++
++
++Description
++===========
++
++This is the two-plane versions of the YUV 4:2:0 format where data is
++grouped into 128 byte wide columns. The three components are separated into
++two sub-images or planes. The Y plane has one byte per pixel and pixels
++are grouped into 128 byte wide columns. The CbCr plane has the same width,
++in bytes, as the Y plane (and the image), but is half as tall in pixels.
++The chroma plane is also in 128 byte columns, reflecting 64 Cb and 64 Cr
++samples.
++
++The chroma samples for a column follow the luma samples. If there is any
++paddding, then that will be reflected via the selection API.
++The luma height must be a multiple of 2 lines.
++
++The normal bytesperline is effectively fixed at 128. However the format
++requires knowledge of the stride between columns, therefore the bytesperline
++value has been repurposed to denote the number of 128 byte long lines between
++the start of each column.
++
++**Byte Order.**
++
++
++.. flat-table::
++    :header-rows:  0
++    :stub-columns: 0
++    :widths: 12 12 12 12 12 4 12 12 12 12
++
++    * - start + 0:
++      - Y'\ :sub:`0,0`
++      - Y'\ :sub:`0,1`
++      - Y'\ :sub:`0,2`
++      - Y'\ :sub:`0,3`
++      - ...
++      - Y'\ :sub:`0,124`
++      - Y'\ :sub:`0,125`
++      - Y'\ :sub:`0,126`
++      - Y'\ :sub:`0,127`
++    * - start + 128:
++      - Y'\ :sub:`1,0`
++      - Y'\ :sub:`1,1`
++      - Y'\ :sub:`1,2`
++      - Y'\ :sub:`1,3`
++      - ...
++      - Y'\ :sub:`1,124`
++      - Y'\ :sub:`1,125`
++      - Y'\ :sub:`1,126`
++      - Y'\ :sub:`1,127`
++    * - start + 256:
++      - Y'\ :sub:`2,0`
++      - Y'\ :sub:`2,1`
++      - Y'\ :sub:`2,2`
++      - Y'\ :sub:`2,3`
++      - ...
++      - Y'\ :sub:`2,124`
++      - Y'\ :sub:`2,125`
++      - Y'\ :sub:`2,126`
++      - Y'\ :sub:`2,127`
++    * - ...
++      - ...
++      - ...
++      - ...
++      - ...
++      - ...
++      - ...
++      - ...
++    * - start + ((height-1) * 128):
++      - Y'\ :sub:`height-1,0`
++      - Y'\ :sub:`height-1,1`
++      - Y'\ :sub:`height-1,2`
++      - Y'\ :sub:`height-1,3`
++      - ...
++      - Y'\ :sub:`height-1,124`
++      - Y'\ :sub:`height-1,125`
++      - Y'\ :sub:`height-1,126`
++      - Y'\ :sub:`height-1,127`
++    * - start + ((height) * 128):
++      - Cb\ :sub:`0,0`
++      - Cr\ :sub:`0,0`
++      - Cb\ :sub:`0,1`
++      - Cr\ :sub:`0,1`
++      - ...
++      - Cb\ :sub:`0,62`
++      - Cr\ :sub:`0,62`
++      - Cb\ :sub:`0,63`
++      - Cr\ :sub:`0,63`
++    * - start + ((height+1) * 128):
++      - Cb\ :sub:`1,0`
++      - Cr\ :sub:`1,0`
++      - Cb\ :sub:`1,1`
++      - Cr\ :sub:`1,1`
++      - ...
++      - Cb\ :sub:`1,62`
++      - Cr\ :sub:`1,62`
++      - Cb\ :sub:`1,63`
++      - Cr\ :sub:`1,63`
++    * - ...
++      - ...
++      - ...
++      - ...
++      - ...
++      - ...
++      - ...
++      - ...
++    * - start + ((height+(height/2)-1) * 128):
++      - Cb\ :sub:`(height/2)-1,0`
++      - Cr\ :sub:`(height/2)-1,0`
++      - Cb\ :sub:`(height/2)-1,1`
++      - Cr\ :sub:`(height/2)-1,1`
++      - ...
++      - Cb\ :sub:`(height/2)-1,62`
++      - Cr\ :sub:`(height/2)-1,62`
++      - Cb\ :sub:`(height/2)-1,63`
++      - Cr\ :sub:`(height/2)-1,63`
++    * - start + (bytesperline * 128):
++      - Y'\ :sub:`0,128`
++      - Y'\ :sub:`0,129`
++      - Y'\ :sub:`0,130`
++      - Y'\ :sub:`0,131`
++      - ...
++      - Y'\ :sub:`0,252`
++      - Y'\ :sub:`0,253`
++      - Y'\ :sub:`0,254`
++      - Y'\ :sub:`0,255`
++    * - ...
++      - ...
++      - ...
++      - ...
++      - ...
++      - ...
++      - ...
++      - ...
++
++V4L2_PIX_FMT_NV12_10_COL128 uses the same 128 byte column structure, but
++encodes 10-bit YUV.
++3 10-bit values are packed into 4 bytes as bits 9:0, 19:10, and 29:20, with
++bits 30 & 31 unused. For the luma plane, bits 9:0 are Y0, 19:10 are Y1, and
++29:20 are Y2. For the chroma plane the samples always come in pairs of Cr
++and Cb, so it needs to be considered 6 values packed in 8 bytes.
++
++Bit-packed representation.
++
++.. raw:: latex
++
++    \small
++
++.. tabularcolumns:: |p{1.2cm}||p{1.2cm}||p{1.2cm}||p{1.2cm}|p{3.2cm}|p{3.2cm}|
++
++.. flat-table::
++    :header-rows:  0
++    :stub-columns: 0
++    :widths: 8 8 8 8
++
++    * - Y'\ :sub:`00[7:0]`
++      - Y'\ :sub:`01[5:0] (bits 7--2)` Y'\ :sub:`00[9:8]`\ (bits 1--0)
++      - Y'\ :sub:`02[3:0] (bits 7--4)` Y'\ :sub:`01[9:6]`\ (bits 3--0)
++      - unused (bits 7--6)` Y'\ :sub:`02[9:4]`\ (bits 5--0)
++
++.. raw:: latex
++
++    \small
++
++.. tabularcolumns:: |p{1.2cm}||p{1.2cm}||p{1.2cm}||p{1.2cm}|p{3.2cm}|p{3.2cm}|
++
++.. flat-table::
++    :header-rows:  0
++    :stub-columns: 0
++    :widths: 12 12 12 12 12 12 12 12
++
++    * - Cb\ :sub:`00[7:0]`
++      - Cr\ :sub:`00[5:0]`\ (bits 7--2) Cb\ :sub:`00[9:8]`\ (bits 1--0)
++      - Cb\ :sub:`01[3:0]`\ (bits 7--4) Cr\ :sub:`00[9:6]`\ (bits 3--0)
++      - unused (bits 7--6) Cb\ :sub:`02[9:4]`\ (bits 5--0)
++      - Cr\ :sub:`01[7:0]`
++      - Cb\ :sub:`02[5:0]`\ (bits 7--2) Cr\ :sub:`01[9:8]`\ (bits 1--0)
++      - Cr\ :sub:`02[3:0]`\ (bits 7--4) Cb\ :sub:`02[9:6]`\ (bits 3--0)
++      - unused (bits 7--6) Cr\ :sub:`02[9:4]`\ (bits 5--0)
++
++.. raw:: latex
++
++    \normalsize
++
++
++
++
+--- a/Documentation/userspace-api/media/v4l/pixfmt-yuv-planar.rst
++++ b/Documentation/userspace-api/media/v4l/pixfmt-yuv-planar.rst
+@@ -828,6 +828,18 @@ Data in the 12 high bits, zeros in the 4
+       - Cr\ :sub:`11`
+ 
+ 
++V4L2_PIX_FMT_NV12_COL128
++------------------------
++
++``V4L2_PIX_FMT_NV12_COL128`` is the tiled version of
++``V4L2_PIX_FMT_NV12`` with the image broken down into 128 pixel wide columns of
++Y followed by the associated combined CbCr plane.
++The normal bytesperline is effectively fixed at 128. However the format
++requires knowledge of the stride between columns, therefore the bytesperline
++value has been repurposed to denote the number of 128 byte long lines between
++the start of each column.
++
++
+ Fully Planar YUV Formats
+ ========================
+ 
+--- a/Documentation/userspace-api/media/v4l/yuv-formats.rst
++++ b/Documentation/userspace-api/media/v4l/yuv-formats.rst
+@@ -270,4 +270,23 @@ image.
+     pixfmt-y8i
+     pixfmt-y12i
+     pixfmt-uv8
++    pixfmt-yuyv
++    pixfmt-uyvy
++    pixfmt-yvyu
++    pixfmt-vyuy
++    pixfmt-y41p
++    pixfmt-yuv420
++    pixfmt-yuv420m
++    pixfmt-yuv422m
++    pixfmt-yuv444m
++    pixfmt-yuv410
++    pixfmt-yuv422p
++    pixfmt-yuv411p
++    pixfmt-nv12
++    pixfmt-nv12m
++    pixfmt-nv12mt
++    pixfmt-nv12-col128
++    pixfmt-nv16
++    pixfmt-nv16m
++    pixfmt-nv24
+     pixfmt-m420
+--- a/drivers/media/v4l2-core/v4l2-ioctl.c
++++ b/drivers/media/v4l2-core/v4l2-ioctl.c
+@@ -1378,6 +1378,8 @@ static void v4l_fill_fmtdesc(struct v4l2
+ 	case V4L2_PIX_FMT_NV12MT:	descr = "Y/UV 4:2:0 (64x32 MB, N-C)"; break;
+ 	case V4L2_PIX_FMT_NV12MT_16X16:	descr = "Y/UV 4:2:0 (16x16 MB, N-C)"; break;
+ 	case V4L2_PIX_FMT_P012M:	descr = "12-bit Y/UV 4:2:0 (N-C)"; break;
++	case V4L2_PIX_FMT_NV12_COL128:  descr = "Y/CbCr 4:2:0 (128b cols)"; break;
++	case V4L2_PIX_FMT_NV12_10_COL128: descr = "10-bit Y/CbCr 4:2:0 (128b cols)"; break;
+ 	case V4L2_PIX_FMT_YUV420M:	descr = "Planar YUV 4:2:0 (N-C)"; break;
+ 	case V4L2_PIX_FMT_YVU420M:	descr = "Planar YVU 4:2:0 (N-C)"; break;
+ 	case V4L2_PIX_FMT_YUV422M:	descr = "Planar YUV 4:2:2 (N-C)"; break;
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -815,6 +815,10 @@ struct v4l2_pix_format {
+ #define V4L2_PIX_FMT_QC10C    v4l2_fourcc('Q', '1', '0', 'C') /* Qualcomm 10-bit compressed */
+ #define V4L2_PIX_FMT_AJPG     v4l2_fourcc('A', 'J', 'P', 'G') /* Aspeed JPEG */
+ #define V4L2_PIX_FMT_HEXTILE  v4l2_fourcc('H', 'X', 'T', 'L') /* Hextile compressed */
++#define V4L2_PIX_FMT_NV12_COL128 v4l2_fourcc('N', 'C', '1', '2') /* 12  Y/CbCr 4:2:0 128 pixel wide column */
++#define V4L2_PIX_FMT_NV12_10_COL128 v4l2_fourcc('N', 'C', '3', '0')
++								/* Y/CbCr 4:2:0 10bpc, 3x10 packed as 4 bytes in
++								 * a 128 bytes / 96 pixel wide column */
+ 
+ /* 10bit raw packed, 32 bytes for every 25 pixels, last LSB 6 bits unused */
+ #define V4L2_PIX_FMT_IPU3_SBGGR10	v4l2_fourcc('i', 'p', '3', 'b') /* IPU3 packed 10-bit BGGR bayer */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0170-media-dt-bindings-media-Add-binding-for-the-Raspberr.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0170-media-dt-bindings-media-Add-binding-for-the-Raspberr.patch
new file mode 100644
index 00000000..d78f1323
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0170-media-dt-bindings-media-Add-binding-for-the-Raspberr.patch
@@ -0,0 +1,106 @@
+From c35cb4f46082ff6da3f881ebc4fb743bc9e35807 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 17 Mar 2020 10:53:16 +0000
+Subject: [PATCH 170/697] media: dt-bindings: media: Add binding for the
+ Raspberry PI HEVC decoder
+
+Adds a binding for the HEVC decoder found on the BCM2711 / Raspberry Pi 4.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../bindings/media/rpivid_hevc.yaml           | 72 +++++++++++++++++++
+ MAINTAINERS                                   |  7 ++
+ 2 files changed, 79 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/media/rpivid_hevc.yaml
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/rpivid_hevc.yaml
+@@ -0,0 +1,72 @@
++# SPDX-License-Identifier: GPL-2.0-only
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/media/rpivid_hevc.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Raspberry Pi HEVC Decoder
++
++maintainers:
++  - Raspberry Pi <kernel-list@raspberrypi.com>
++
++description: |-
++  The Camera Adaptation Layer (CAL) is a key component for image capture
++  applications. The capture module provides the system interface and the
++  processing capability to connect CSI2 image-sensor modules to the
++  DRA72x device.
++
++properties:
++  compatible:
++    enum:
++      - raspberrypi,rpivid-vid-decoder
++
++  reg:
++    minItems: 2
++    items:
++      - description: The HEVC main register region
++      - description: The Interrupt controller register region
++
++  reg-names:
++    minItems: 2
++    items:
++      - const: hevc
++      - const: intc
++
++  interrupts:
++    maxItems: 1
++
++  clocks:
++    items:
++      - description: The HEVC block clock
++
++  clock-names:
++    items:
++      - const: hevc
++
++required:
++  - compatible
++  - reg
++  - reg-names
++  - interrupts
++  - clocks
++
++additionalProperties: false
++
++examples:
++  - |
++    #include <dt-bindings/interrupt-controller/arm-gic.h>
++
++    video-codec@7eb10000 {
++        compatible = "raspberrypi,rpivid-vid-decoder";
++        reg = <0x0 0x7eb10000 0x1000>,	/* INTC */
++              <0x0 0x7eb00000 0x10000>; /* HEVC */
++        reg-names = "intc",
++                    "hevc";
++
++        interrupts = <GIC_SPI 98 IRQ_TYPE_LEVEL_HIGH>;
++
++        clocks = <&clk 0>;
++        clock-names = "hevc";
++    };
++
++...
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -4374,6 +4374,13 @@ S:	Maintained
+ F:	Documentation/devicetree/bindings/media/brcm,bcm2835-unicam.yaml
+ F:	drivers/media/platform/broadcom/bcm2835-unicam*
+ 
++BROADCOM BCM2711 HEVC DECODER
++M:	Raspberry Pi Kernel Maintenance <kernel-list@raspberrypi.com>
++L:	linux-media@vger.kernel.org
++S:	Maintained
++F:	Documentation/devicetree/bindings/media/rpivid_hevc.jaml
++F:	drivers/staging/media/rpivid
++
+ BROADCOM BCM47XX MIPS ARCHITECTURE
+ M:	Hauke Mehrtens <hauke@hauke-m.de>
+ M:	Rafał Miłecki <zajec5@gmail.com>
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0171-RFC-media-Add-media_request_-pin-unpin-API.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0171-RFC-media-Add-media_request_-pin-unpin-API.patch
new file mode 100644
index 00000000..6bf04e17
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0171-RFC-media-Add-media_request_-pin-unpin-API.patch
@@ -0,0 +1,94 @@
+From f42cb1e118f7e7b3596c24ac20adf5fd122192e5 Mon Sep 17 00:00:00 2001
+From: Ezequiel Garcia <ezequiel@collabora.com>
+Date: Sun, 21 Mar 2021 16:38:54 -0300
+Subject: [PATCH 171/697] RFC: media: Add media_request_{pin,unpin} API
+
+This is probably not the API we will want to add, but it
+should show what semantics are needed by drivers.
+
+The goal is to allow the OUTPUT (aka source) buffer and the
+controls associated to a request to be released from the request,
+and in particular return the OUTPUT buffer back to userspace,
+without signalling the media request fd.
+
+This is useful for devices that are able to pre-process
+the OUTPUT buffer, therefore able to release it before
+the decoding is finished. These drivers should signal
+the media request fd only after the CAPTURE buffer is done.
+
+Tested-by: John Cox <jc@kynesim.co.uk>
+Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
+---
+ drivers/media/mc/mc-request.c | 35 +++++++++++++++++++++++++++++++++++
+ include/media/media-request.h | 12 ++++++++++++
+ 2 files changed, 47 insertions(+)
+
+--- a/drivers/media/mc/mc-request.c
++++ b/drivers/media/mc/mc-request.c
+@@ -505,3 +505,38 @@ unlock:
+ 		media_request_put(req);
+ }
+ EXPORT_SYMBOL_GPL(media_request_object_complete);
++
++void media_request_pin(struct media_request *req)
++{
++	unsigned long flags;
++
++	spin_lock_irqsave(&req->lock, flags);
++	if (WARN_ON(req->state != MEDIA_REQUEST_STATE_QUEUED))
++		goto unlock;
++	req->num_incomplete_objects++;
++unlock:
++	spin_unlock_irqrestore(&req->lock, flags);
++}
++EXPORT_SYMBOL_GPL(media_request_pin);
++
++void media_request_unpin(struct media_request *req)
++{
++	unsigned long flags;
++	bool completed = false;
++
++	spin_lock_irqsave(&req->lock, flags);
++	if (WARN_ON(!req->num_incomplete_objects) ||
++	    WARN_ON(req->state != MEDIA_REQUEST_STATE_QUEUED))
++		goto unlock;
++
++	if (!--req->num_incomplete_objects) {
++		req->state = MEDIA_REQUEST_STATE_COMPLETE;
++		wake_up_interruptible_all(&req->poll_wait);
++		completed = true;
++	}
++unlock:
++	spin_unlock_irqrestore(&req->lock, flags);
++	if (completed)
++		media_request_put(req);
++}
++EXPORT_SYMBOL_GPL(media_request_unpin);
+--- a/include/media/media-request.h
++++ b/include/media/media-request.h
+@@ -189,6 +189,10 @@ static inline void media_request_get(str
+  */
+ void media_request_put(struct media_request *req);
+ 
++void media_request_pin(struct media_request *req);
++
++void media_request_unpin(struct media_request *req);
++
+ /**
+  * media_request_get_by_fd - Get a media request by fd
+  *
+@@ -228,6 +232,14 @@ static inline void media_request_put(str
+ {
+ }
+ 
++static inline void media_request_pin(struct media_request *req)
++{
++}
++
++static inline void media_request_unpin(struct media_request *req)
++{
++}
++
+ static inline struct media_request *
+ media_request_get_by_fd(struct media_device *mdev, int request_fd)
+ {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0172-staging-media-rpivid-Add-Raspberry-Pi-V4L2-H265-deco.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0172-staging-media-rpivid-Add-Raspberry-Pi-V4L2-H265-deco.patch
new file mode 100644
index 00000000..b4c03632
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0172-staging-media-rpivid-Add-Raspberry-Pi-V4L2-H265-deco.patch
@@ -0,0 +1,5275 @@
+From 3337afc3db3f519bcbdc06f2b3680d6f5b254350 Mon Sep 17 00:00:00 2001
+From: John Cox <jc@kynesim.co.uk>
+Date: Thu, 5 Mar 2020 18:30:41 +0000
+Subject: [PATCH 172/697] staging: media: rpivid: Add Raspberry Pi V4L2 H265
+ decoder
+
+This driver is for the HEVC/H265 decoder block on the Raspberry
+Pi 4, and conforms to the V4L2 stateless decoder API.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+staging: media: rpivid: Select MEDIA_CONTROLLER and MEDIA_CONTROLLER_REQUEST_API
+
+MEDIA_CONTROLLER_REQUEST_API is a hidden option. If rpivid depends on it,
+the user would need to first enable another driver that selects
+MEDIA_CONTROLLER_REQUEST_API, and only then rpivid would become available.
+
+By selecting it instead of depending on it, it becomes possible to enable
+rpivid without having to enable other potentially unnecessary drivers.
+
+Signed-off-by: Hristo Venev <hristo@venev.name>
+
+rpivid_h265: Fix width/height typo
+
+Signed-off-by: popcornmix <popcornmix@gmail.com>
+
+rpivid_h625: Fix build warnings
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+staging: rpivid: Fix crash when CMA alloc fails
+
+If realloc to increase coeff size fails then attempt to re-allocate
+the original size.  If that also fails then flag a fatal error to abort
+all further decode.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+rpivid: Request maximum hevc clock
+
+Query maximum and minimum clock from driver
+and use those
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+rpivid: Switch to new clock api
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+rpivid: Only clk_request_done once
+
+Fixes: 25486f49bfe2e3ae13b90478d1eebd91413136ad
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+media: rpivid: Remove the need to have num_entry_points set
+
+VAAPI H265 has num entry points but never sets it. Allow a VAAPI
+shim to work without requiring rewriting the VAAPI driver.
+num_entry_points can be calculated from the slice_segment_addr
+of the next slice so delay processing until we have that.
+
+Also includes some minor cosmetics.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Convert to MPLANE
+
+Use multi-planar interface rather than single plane interface. This
+allows dmabufs holding compressed data to be resized.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Add an enable count to irq claim Qs
+
+Add an enable count to the irq Q structures to allow the irq logic to
+block further callbacks if resources associated with the irq are not
+yet available.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Add a Pass0 to accumulate slices and rework job finish
+
+Due to overheads in assembling controls and requests it is worth having
+the slice assembly phase separate from the h/w pass1 processing. Create
+a queue to service pass1 rather than have the pass1 finished callback
+trigger the next slice job.
+
+This requires a rework of the logic that splits up the buffer and
+request done events. This code contains two ways of doing that, we use
+Ezequiel Garcias <ezequiel@collabora.com> solution, but expect that
+in the future this will be handled by the framework in a cleaner manner.
+
+Fix up the handling of some of the memory exhaustion crashes uncovered
+in the process of writing this code.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Map cmd buffer directly
+
+It is unnecessary to have a separate dmabuf to hold the cmd buffer.
+Map it directly from the kmalloc.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Improve values returned when setting output format
+
+Guess a better value for the compressed bitstream buffer size
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Improve stream_on/off conformance & clock setup
+
+Fix stream on & off such that failures leave the driver in the correct
+state.  Ensure that the clock is on when we are streaming and off when
+all contexts attached to this device have stopped streaming.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Improve SPS/PPS error handling/validation
+
+Move size and width checking from bitstream processing to control
+validation
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Fix H265 aux ent reuse of the same slot
+
+It is legitimate, though unusual, for an aux ent associated with a slot
+to be selected in phase 0 before a previous selection has been used and
+released in phase 2. Fix such that if the slot is found to be in use
+that the aux ent associated with it is reused rather than an new aux
+ent being created. This fixes a problem where when the first aux ent
+was released the second was lost track of.
+
+This bug spotted in Nick's testing. It may explain some other occasional,
+unreliable decode error reports where dmesg included "Missing DPB AUX
+ent" logging.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Update to compile with new hevc decode params
+
+DPB entries have moved from slice params to the new decode params
+attribute - update to deal with this.  Also fixes fallthrough
+warnings which seem to be new in 5.14.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Make slice ctrl dynamic
+
+Allows the user to submit a whole frames worth of slice headers in
+one lump along with a single bitstream dmabuf for the whole lot.
+This saves potentially a lot of bitstream copying.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Only create aux entries for H265 if needed
+
+Only create aux entries of mv info for frames where that info might
+be used by a later frame.  This saves some memory bandwidth and
+potentially some memory.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Avoid returning EINVAL to a G_FMT ioctl
+
+V4L2 spec says that G/S/TRY_FMT IOCTLs should never return errors for
+anything other than wrong buffer types. Improve the capture format
+function such that this is so and unsupported values get converted
+to supported ones properly.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Remove unused ctx state variable and defines
+
+Remove unused ctx state tracking variable and associated defines.
+Their presence implies they might be used, but they aren't.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Ensure IRQs have completed before uniniting context
+
+Before uniniting the decode context sync with the IRQ queues to ensure
+that decode no longer has any buffers in use.  This fixes a problem that
+manifested as ffmpeg leaking CMA buffers when it did a stream off on
+OUTPUT before CAPTURE, though in reality it was probably much more
+dangerous than that.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: remove min_buffers_needed from src queue
+
+Remove min_buffers_needed=1 from src queue init. Src buffers are bound
+to media requests therefore this setting is not needed and generates
+a WARN in kernel 5.16.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+rpivid: Use clk_get_max_rate()
+
+The driver was using clk_round_rate() to figure out the maximum clock
+rate that was allowed for the HEVC clock.
+
+Since we have a function to return it directly now, let's use it.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+
+media: rpivid: Apply V4L2 stateless API changes
+
+media: rpivid: Fix fallthrough warning
+
+Replace old-style /* FALLTHRU */ with fallthrough;
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Set min value as well as max for HEVC_DECODE_MODE
+
+As only one value can be accepted set both min and max to that value.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: rpivid: Accept ANNEX_B start codes
+
+Allow the START_CODE control to take ANNEX_B as a value. This makes no
+difference to any part of the decode process as the added bytes are in
+data that we ignore. This helps my testing and may help userland code
+that expects to send those bytes.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+rpivid: Convert to new clock rate API
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+
+media/rpivid: Allow use of iommu in rpivid
+
+In order to use iommu on hevc set dma mask_and_coherent in probe.
+I am assured dma_set_mask_and_coherent is benign on Pi4 (which has
+no iommu) and it seems to be so in practice.
+Also adds a bit of debug to make internal buffer allocation failure
+easier to spot in future
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media/rpivid: Make SPS / PPS optional in a request
+
+SPS & PPS are optional in requests. Fix. The framework keeps the last
+value so this is mostly a matter of changing .required to false when
+requesting the controls. Check that SPS has ever been set on frame
+start, PPS is valid if all zeros so is at best tricky to check.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+---
+ drivers/media/v4l2-core/v4l2-mem2mem.c      |    2 -
+ drivers/staging/media/Kconfig               |    2 +
+ drivers/staging/media/Makefile              |    1 +
+ drivers/staging/media/rpivid/Kconfig        |   16 +
+ drivers/staging/media/rpivid/Makefile       |    5 +
+ drivers/staging/media/rpivid/rpivid.c       |  464 ++++
+ drivers/staging/media/rpivid/rpivid.h       |  203 ++
+ drivers/staging/media/rpivid/rpivid_dec.c   |   96 +
+ drivers/staging/media/rpivid/rpivid_dec.h   |   19 +
+ drivers/staging/media/rpivid/rpivid_h265.c  | 2712 +++++++++++++++++++
+ drivers/staging/media/rpivid/rpivid_hw.c    |  383 +++
+ drivers/staging/media/rpivid/rpivid_hw.h    |  303 +++
+ drivers/staging/media/rpivid/rpivid_video.c |  691 +++++
+ drivers/staging/media/rpivid/rpivid_video.h |   38 +
+ 14 files changed, 4933 insertions(+), 2 deletions(-)
+ create mode 100644 drivers/staging/media/rpivid/Kconfig
+ create mode 100644 drivers/staging/media/rpivid/Makefile
+ create mode 100644 drivers/staging/media/rpivid/rpivid.c
+ create mode 100644 drivers/staging/media/rpivid/rpivid.h
+ create mode 100644 drivers/staging/media/rpivid/rpivid_dec.c
+ create mode 100644 drivers/staging/media/rpivid/rpivid_dec.h
+ create mode 100644 drivers/staging/media/rpivid/rpivid_h265.c
+ create mode 100644 drivers/staging/media/rpivid/rpivid_hw.c
+ create mode 100644 drivers/staging/media/rpivid/rpivid_hw.h
+ create mode 100644 drivers/staging/media/rpivid/rpivid_video.c
+ create mode 100644 drivers/staging/media/rpivid/rpivid_video.h
+
+--- a/drivers/media/v4l2-core/v4l2-mem2mem.c
++++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
+@@ -495,8 +495,6 @@ void v4l2_m2m_job_finish(struct v4l2_m2m
+ 	 * holding capture buffers. Those should use
+ 	 * v4l2_m2m_buf_done_and_job_finish() instead.
+ 	 */
+-	WARN_ON(m2m_ctx->out_q_ctx.q.subsystem_flags &
+-		VB2_V4L2_FL_SUPPORTS_M2M_HOLD_CAPTURE_BUF);
+ 	spin_lock_irqsave(&m2m_dev->job_spinlock, flags);
+ 	schedule_next = _v4l2_m2m_job_finish(m2m_dev, m2m_ctx);
+ 	spin_unlock_irqrestore(&m2m_dev->job_spinlock, flags);
+--- a/drivers/staging/media/Kconfig
++++ b/drivers/staging/media/Kconfig
+@@ -36,6 +36,8 @@ source "drivers/staging/media/omap4iss/K
+ 
+ source "drivers/staging/media/rkvdec/Kconfig"
+ 
++source "drivers/staging/media/rpivid/Kconfig"
++
+ source "drivers/staging/media/starfive/Kconfig"
+ 
+ source "drivers/staging/media/sunxi/Kconfig"
+--- a/drivers/staging/media/Makefile
++++ b/drivers/staging/media/Makefile
+@@ -6,6 +6,7 @@ obj-$(CONFIG_VIDEO_MAX96712)	+= max96712
+ obj-$(CONFIG_VIDEO_MESON_VDEC)	+= meson/vdec/
+ obj-$(CONFIG_VIDEO_OMAP4)	+= omap4iss/
+ obj-$(CONFIG_VIDEO_ROCKCHIP_VDEC)	+= rkvdec/
++obj-$(CONFIG_VIDEO_RPIVID)	+= rpivid/
+ obj-$(CONFIG_VIDEO_STARFIVE_CAMSS)	+= starfive/
+ obj-$(CONFIG_VIDEO_SUNXI)	+= sunxi/
+ obj-$(CONFIG_VIDEO_TEGRA)	+= tegra-video/
+--- /dev/null
++++ b/drivers/staging/media/rpivid/Kconfig
+@@ -0,0 +1,16 @@
++# SPDX-License-Identifier: GPL-2.0
++
++config VIDEO_RPIVID
++	tristate "Rpi H265 driver"
++	depends on VIDEO_DEV && VIDEO_DEV
++	depends on OF
++	select MEDIA_CONTROLLER
++	select MEDIA_CONTROLLER_REQUEST_API
++	select VIDEOBUF2_DMA_CONTIG
++	select V4L2_MEM2MEM_DEV
++	help
++	  Support for the Rpi H265 h/w decoder.
++
++	  To compile this driver as a module, choose M here: the module
++	  will be called rpivid-hevc.
++
+--- /dev/null
++++ b/drivers/staging/media/rpivid/Makefile
+@@ -0,0 +1,5 @@
++# SPDX-License-Identifier: GPL-2.0
++obj-$(CONFIG_VIDEO_RPIVID) += rpivid-hevc.o
++
++rpivid-hevc-y = rpivid.o rpivid_video.o rpivid_dec.o \
++		 rpivid_hw.o rpivid_h265.o
+--- /dev/null
++++ b/drivers/staging/media/rpivid/rpivid.c
+@@ -0,0 +1,464 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Raspberry Pi HEVC driver
++ *
++ * Copyright (C) 2020 Raspberry Pi (Trading) Ltd
++ *
++ * Based on the Cedrus VPU driver, that is:
++ *
++ * Copyright (C) 2016 Florent Revest <florent.revest@free-electrons.com>
++ * Copyright (C) 2018 Paul Kocialkowski <paul.kocialkowski@bootlin.com>
++ * Copyright (C) 2018 Bootlin
++ */
++
++#include <linux/platform_device.h>
++#include <linux/module.h>
++#include <linux/of.h>
++
++#include <media/v4l2-device.h>
++#include <media/v4l2-ioctl.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-mem2mem.h>
++
++#include "rpivid.h"
++#include "rpivid_video.h"
++#include "rpivid_hw.h"
++#include "rpivid_dec.h"
++
++/*
++ * Default /dev/videoN node number.
++ * Deliberately avoid the very low numbers as these are often taken by webcams
++ * etc, and simple apps tend to only go for /dev/video0.
++ */
++static int video_nr = 19;
++module_param(video_nr, int, 0644);
++MODULE_PARM_DESC(video_nr, "decoder video device number");
++
++static const struct rpivid_control rpivid_ctrls[] = {
++	{
++		.cfg = {
++			.id	= V4L2_CID_STATELESS_HEVC_SPS,
++			.ops	= &rpivid_hevc_sps_ctrl_ops,
++		},
++		.required	= false,
++	},
++	{
++		.cfg = {
++			.id	= V4L2_CID_STATELESS_HEVC_PPS,
++			.ops	= &rpivid_hevc_pps_ctrl_ops,
++		},
++		.required	= false,
++	},
++	{
++		.cfg = {
++			.id = V4L2_CID_STATELESS_HEVC_SCALING_MATRIX,
++		},
++		.required	= false,
++	},
++	{
++		.cfg = {
++			.id	= V4L2_CID_STATELESS_HEVC_DECODE_PARAMS,
++		},
++		.required	= true,
++	},
++	{
++		.cfg = {
++			.name	= "Slice param array",
++			.id	= V4L2_CID_STATELESS_HEVC_SLICE_PARAMS,
++			.type	= V4L2_CTRL_TYPE_HEVC_SLICE_PARAMS,
++			.flags	= V4L2_CTRL_FLAG_DYNAMIC_ARRAY,
++			.dims	= { 0x1000 },
++		},
++		.required	= true,
++	},
++	{
++		.cfg = {
++			.id	= V4L2_CID_STATELESS_HEVC_DECODE_MODE,
++			.min	= V4L2_STATELESS_HEVC_DECODE_MODE_SLICE_BASED,
++			.max	= V4L2_STATELESS_HEVC_DECODE_MODE_SLICE_BASED,
++			.def	= V4L2_STATELESS_HEVC_DECODE_MODE_SLICE_BASED,
++		},
++		.required	= false,
++	},
++	{
++		.cfg = {
++			.id	= V4L2_CID_STATELESS_HEVC_START_CODE,
++			.min	= V4L2_STATELESS_HEVC_START_CODE_NONE,
++			.max	= V4L2_STATELESS_HEVC_START_CODE_ANNEX_B,
++			.def	= V4L2_STATELESS_HEVC_START_CODE_NONE,
++		},
++		.required	= false,
++	},
++};
++
++#define rpivid_ctrls_COUNT	ARRAY_SIZE(rpivid_ctrls)
++
++struct v4l2_ctrl *rpivid_find_ctrl(struct rpivid_ctx *ctx, u32 id)
++{
++	unsigned int i;
++
++	for (i = 0; ctx->ctrls[i]; i++)
++		if (ctx->ctrls[i]->id == id)
++			return ctx->ctrls[i];
++
++	return NULL;
++}
++
++void *rpivid_find_control_data(struct rpivid_ctx *ctx, u32 id)
++{
++	struct v4l2_ctrl *const ctrl = rpivid_find_ctrl(ctx, id);
++
++	return !ctrl ? NULL : ctrl->p_cur.p;
++}
++
++static int rpivid_init_ctrls(struct rpivid_dev *dev, struct rpivid_ctx *ctx)
++{
++	struct v4l2_ctrl_handler *hdl = &ctx->hdl;
++	struct v4l2_ctrl *ctrl;
++	unsigned int ctrl_size;
++	unsigned int i;
++
++	v4l2_ctrl_handler_init(hdl, rpivid_ctrls_COUNT);
++	if (hdl->error) {
++		v4l2_err(&dev->v4l2_dev,
++			 "Failed to initialize control handler\n");
++		return hdl->error;
++	}
++
++	ctrl_size = sizeof(ctrl) * rpivid_ctrls_COUNT + 1;
++
++	ctx->ctrls = kzalloc(ctrl_size, GFP_KERNEL);
++	if (!ctx->ctrls)
++		return -ENOMEM;
++
++	for (i = 0; i < rpivid_ctrls_COUNT; i++) {
++		ctrl = v4l2_ctrl_new_custom(hdl, &rpivid_ctrls[i].cfg,
++					    ctx);
++		if (hdl->error) {
++			v4l2_err(&dev->v4l2_dev,
++				 "Failed to create new custom control id=%#x\n",
++				 rpivid_ctrls[i].cfg.id);
++
++			v4l2_ctrl_handler_free(hdl);
++			kfree(ctx->ctrls);
++			return hdl->error;
++		}
++
++		ctx->ctrls[i] = ctrl;
++	}
++
++	ctx->fh.ctrl_handler = hdl;
++	v4l2_ctrl_handler_setup(hdl);
++
++	return 0;
++}
++
++static int rpivid_request_validate(struct media_request *req)
++{
++	struct media_request_object *obj;
++	struct v4l2_ctrl_handler *parent_hdl, *hdl;
++	struct rpivid_ctx *ctx = NULL;
++	struct v4l2_ctrl *ctrl_test;
++	unsigned int count;
++	unsigned int i;
++
++	list_for_each_entry(obj, &req->objects, list) {
++		struct vb2_buffer *vb;
++
++		if (vb2_request_object_is_buffer(obj)) {
++			vb = container_of(obj, struct vb2_buffer, req_obj);
++			ctx = vb2_get_drv_priv(vb->vb2_queue);
++
++			break;
++		}
++	}
++
++	if (!ctx)
++		return -ENOENT;
++
++	count = vb2_request_buffer_cnt(req);
++	if (!count) {
++		v4l2_info(&ctx->dev->v4l2_dev,
++			  "No buffer was provided with the request\n");
++		return -ENOENT;
++	} else if (count > 1) {
++		v4l2_info(&ctx->dev->v4l2_dev,
++			  "More than one buffer was provided with the request\n");
++		return -EINVAL;
++	}
++
++	parent_hdl = &ctx->hdl;
++
++	hdl = v4l2_ctrl_request_hdl_find(req, parent_hdl);
++	if (!hdl) {
++		v4l2_info(&ctx->dev->v4l2_dev, "Missing codec control(s)\n");
++		return -ENOENT;
++	}
++
++	for (i = 0; i < rpivid_ctrls_COUNT; i++) {
++		if (!rpivid_ctrls[i].required)
++			continue;
++
++		ctrl_test =
++			v4l2_ctrl_request_hdl_ctrl_find(hdl,
++							rpivid_ctrls[i].cfg.id);
++		if (!ctrl_test) {
++			v4l2_info(&ctx->dev->v4l2_dev,
++				  "Missing required codec control\n");
++			v4l2_ctrl_request_hdl_put(hdl);
++			return -ENOENT;
++		}
++	}
++
++	v4l2_ctrl_request_hdl_put(hdl);
++
++	return vb2_request_validate(req);
++}
++
++static int rpivid_open(struct file *file)
++{
++	struct rpivid_dev *dev = video_drvdata(file);
++	struct rpivid_ctx *ctx = NULL;
++	int ret;
++
++	if (mutex_lock_interruptible(&dev->dev_mutex))
++		return -ERESTARTSYS;
++
++	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
++	if (!ctx) {
++		mutex_unlock(&dev->dev_mutex);
++		ret = -ENOMEM;
++		goto err_unlock;
++	}
++
++	mutex_init(&ctx->ctx_mutex);
++
++	v4l2_fh_init(&ctx->fh, video_devdata(file));
++	file->private_data = &ctx->fh;
++	ctx->dev = dev;
++
++	ret = rpivid_init_ctrls(dev, ctx);
++	if (ret)
++		goto err_free;
++
++	ctx->fh.m2m_ctx = v4l2_m2m_ctx_init(dev->m2m_dev, ctx,
++					    &rpivid_queue_init);
++	if (IS_ERR(ctx->fh.m2m_ctx)) {
++		ret = PTR_ERR(ctx->fh.m2m_ctx);
++		goto err_ctrls;
++	}
++
++	/* The only bit of format info that we can guess now is H265 src
++	 * Everything else we need more info for
++	 */
++	rpivid_prepare_src_format(&ctx->src_fmt);
++
++	v4l2_fh_add(&ctx->fh);
++
++	mutex_unlock(&dev->dev_mutex);
++
++	return 0;
++
++err_ctrls:
++	v4l2_ctrl_handler_free(&ctx->hdl);
++err_free:
++	mutex_destroy(&ctx->ctx_mutex);
++	kfree(ctx);
++err_unlock:
++	mutex_unlock(&dev->dev_mutex);
++
++	return ret;
++}
++
++static int rpivid_release(struct file *file)
++{
++	struct rpivid_dev *dev = video_drvdata(file);
++	struct rpivid_ctx *ctx = container_of(file->private_data,
++					      struct rpivid_ctx, fh);
++
++	mutex_lock(&dev->dev_mutex);
++
++	v4l2_fh_del(&ctx->fh);
++	v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
++
++	v4l2_ctrl_handler_free(&ctx->hdl);
++	kfree(ctx->ctrls);
++
++	v4l2_fh_exit(&ctx->fh);
++	mutex_destroy(&ctx->ctx_mutex);
++
++	kfree(ctx);
++
++	mutex_unlock(&dev->dev_mutex);
++
++	return 0;
++}
++
++static const struct v4l2_file_operations rpivid_fops = {
++	.owner		= THIS_MODULE,
++	.open		= rpivid_open,
++	.release	= rpivid_release,
++	.poll		= v4l2_m2m_fop_poll,
++	.unlocked_ioctl	= video_ioctl2,
++	.mmap		= v4l2_m2m_fop_mmap,
++};
++
++static const struct video_device rpivid_video_device = {
++	.name		= RPIVID_NAME,
++	.vfl_dir	= VFL_DIR_M2M,
++	.fops		= &rpivid_fops,
++	.ioctl_ops	= &rpivid_ioctl_ops,
++	.minor		= -1,
++	.release	= video_device_release_empty,
++	.device_caps	= V4L2_CAP_VIDEO_M2M_MPLANE | V4L2_CAP_STREAMING,
++};
++
++static const struct v4l2_m2m_ops rpivid_m2m_ops = {
++	.device_run	= rpivid_device_run,
++};
++
++static const struct media_device_ops rpivid_m2m_media_ops = {
++	.req_validate	= rpivid_request_validate,
++	.req_queue	= v4l2_m2m_request_queue,
++};
++
++static int rpivid_probe(struct platform_device *pdev)
++{
++	struct rpivid_dev *dev;
++	struct video_device *vfd;
++	int ret;
++
++	dev = devm_kzalloc(&pdev->dev, sizeof(*dev), GFP_KERNEL);
++	if (!dev)
++		return -ENOMEM;
++
++	dev->vfd = rpivid_video_device;
++	dev->dev = &pdev->dev;
++	dev->pdev = pdev;
++
++	ret = 0;
++	ret = rpivid_hw_probe(dev);
++	if (ret) {
++		dev_err(&pdev->dev, "Failed to probe hardware\n");
++		return ret;
++	}
++
++	dev->dec_ops = &rpivid_dec_ops_h265;
++
++	mutex_init(&dev->dev_mutex);
++
++	ret = v4l2_device_register(&pdev->dev, &dev->v4l2_dev);
++	if (ret) {
++		dev_err(&pdev->dev, "Failed to register V4L2 device\n");
++		return ret;
++	}
++
++	vfd = &dev->vfd;
++	vfd->lock = &dev->dev_mutex;
++	vfd->v4l2_dev = &dev->v4l2_dev;
++
++	snprintf(vfd->name, sizeof(vfd->name), "%s", rpivid_video_device.name);
++	video_set_drvdata(vfd, dev);
++
++	ret = dma_set_mask_and_coherent(dev->dev, DMA_BIT_MASK(36));
++	if (ret) {
++		v4l2_err(&dev->v4l2_dev,
++			 "Failed dma_set_mask_and_coherent\n");
++		goto err_v4l2;
++	}
++
++	dev->m2m_dev = v4l2_m2m_init(&rpivid_m2m_ops);
++	if (IS_ERR(dev->m2m_dev)) {
++		v4l2_err(&dev->v4l2_dev,
++			 "Failed to initialize V4L2 M2M device\n");
++		ret = PTR_ERR(dev->m2m_dev);
++
++		goto err_v4l2;
++	}
++
++	dev->mdev.dev = &pdev->dev;
++	strscpy(dev->mdev.model, RPIVID_NAME, sizeof(dev->mdev.model));
++	strscpy(dev->mdev.bus_info, "platform:" RPIVID_NAME,
++		sizeof(dev->mdev.bus_info));
++
++	media_device_init(&dev->mdev);
++	dev->mdev.ops = &rpivid_m2m_media_ops;
++	dev->v4l2_dev.mdev = &dev->mdev;
++
++	ret = video_register_device(vfd, VFL_TYPE_VIDEO, video_nr);
++	if (ret) {
++		v4l2_err(&dev->v4l2_dev, "Failed to register video device\n");
++		goto err_m2m;
++	}
++
++	v4l2_info(&dev->v4l2_dev,
++		  "Device registered as /dev/video%d\n", vfd->num);
++
++	ret = v4l2_m2m_register_media_controller(dev->m2m_dev, vfd,
++						 MEDIA_ENT_F_PROC_VIDEO_DECODER);
++	if (ret) {
++		v4l2_err(&dev->v4l2_dev,
++			 "Failed to initialize V4L2 M2M media controller\n");
++		goto err_video;
++	}
++
++	ret = media_device_register(&dev->mdev);
++	if (ret) {
++		v4l2_err(&dev->v4l2_dev, "Failed to register media device\n");
++		goto err_m2m_mc;
++	}
++
++	platform_set_drvdata(pdev, dev);
++
++	return 0;
++
++err_m2m_mc:
++	v4l2_m2m_unregister_media_controller(dev->m2m_dev);
++err_video:
++	video_unregister_device(&dev->vfd);
++err_m2m:
++	v4l2_m2m_release(dev->m2m_dev);
++err_v4l2:
++	v4l2_device_unregister(&dev->v4l2_dev);
++
++	return ret;
++}
++
++static void rpivid_remove(struct platform_device *pdev)
++{
++	struct rpivid_dev *dev = platform_get_drvdata(pdev);
++
++	if (media_devnode_is_registered(dev->mdev.devnode)) {
++		media_device_unregister(&dev->mdev);
++		v4l2_m2m_unregister_media_controller(dev->m2m_dev);
++		media_device_cleanup(&dev->mdev);
++	}
++
++	v4l2_m2m_release(dev->m2m_dev);
++	video_unregister_device(&dev->vfd);
++	v4l2_device_unregister(&dev->v4l2_dev);
++
++	rpivid_hw_remove(dev);
++}
++
++static const struct of_device_id rpivid_dt_match[] = {
++	{
++		.compatible = "raspberrypi,rpivid-vid-decoder",
++	},
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, rpivid_dt_match);
++
++static struct platform_driver rpivid_driver = {
++	.probe		= rpivid_probe,
++	.remove		= rpivid_remove,
++	.driver		= {
++		.name = RPIVID_NAME,
++		.of_match_table	= of_match_ptr(rpivid_dt_match),
++	},
++};
++module_platform_driver(rpivid_driver);
++
++MODULE_LICENSE("GPL v2");
++MODULE_AUTHOR("John Cox <jc@kynesim.co.uk>");
++MODULE_DESCRIPTION("Raspberry Pi HEVC V4L2 driver");
+--- /dev/null
++++ b/drivers/staging/media/rpivid/rpivid.h
+@@ -0,0 +1,203 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * Raspberry Pi HEVC driver
++ *
++ * Copyright (C) 2020 Raspberry Pi (Trading) Ltd
++ *
++ * Based on the Cedrus VPU driver, that is:
++ *
++ * Copyright (C) 2016 Florent Revest <florent.revest@free-electrons.com>
++ * Copyright (C) 2018 Paul Kocialkowski <paul.kocialkowski@bootlin.com>
++ * Copyright (C) 2018 Bootlin
++ */
++
++#ifndef _RPIVID_H_
++#define _RPIVID_H_
++
++#include <linux/clk.h>
++#include <linux/platform_device.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-mem2mem.h>
++#include <media/videobuf2-v4l2.h>
++#include <media/videobuf2-dma-contig.h>
++
++#define OPT_DEBUG_POLL_IRQ  0
++
++#define RPIVID_DEC_ENV_COUNT 6
++#define RPIVID_P1BUF_COUNT 3
++#define RPIVID_P2BUF_COUNT 3
++
++#define RPIVID_NAME			"rpivid"
++
++#define RPIVID_CAPABILITY_UNTILED	BIT(0)
++#define RPIVID_CAPABILITY_H265_DEC	BIT(1)
++
++#define RPIVID_QUIRK_NO_DMA_OFFSET	BIT(0)
++
++enum rpivid_irq_status {
++	RPIVID_IRQ_NONE,
++	RPIVID_IRQ_ERROR,
++	RPIVID_IRQ_OK,
++};
++
++struct rpivid_control {
++	struct v4l2_ctrl_config cfg;
++	unsigned char		required:1;
++};
++
++struct rpivid_h265_run {
++	u32 slice_ents;
++	const struct v4l2_ctrl_hevc_sps			*sps;
++	const struct v4l2_ctrl_hevc_pps			*pps;
++	const struct v4l2_ctrl_hevc_decode_params      	*dec;
++	const struct v4l2_ctrl_hevc_slice_params	*slice_params;
++	const struct v4l2_ctrl_hevc_scaling_matrix	*scaling_matrix;
++};
++
++struct rpivid_run {
++	struct vb2_v4l2_buffer	*src;
++	struct vb2_v4l2_buffer	*dst;
++
++	struct rpivid_h265_run	h265;
++};
++
++struct rpivid_buffer {
++	struct v4l2_m2m_buffer          m2m_buf;
++};
++
++struct rpivid_dec_state;
++struct rpivid_dec_env;
++
++struct rpivid_gptr {
++	size_t size;
++	__u8 *ptr;
++	dma_addr_t addr;
++	unsigned long attrs;
++};
++
++struct rpivid_dev;
++typedef void (*rpivid_irq_callback)(struct rpivid_dev *dev, void *ctx);
++
++struct rpivid_q_aux;
++#define RPIVID_AUX_ENT_COUNT VB2_MAX_FRAME
++
++struct rpivid_ctx {
++	struct v4l2_fh			fh;
++	struct rpivid_dev		*dev;
++
++	struct v4l2_pix_format_mplane	src_fmt;
++	struct v4l2_pix_format_mplane	dst_fmt;
++	int dst_fmt_set;
++
++	int 				src_stream_on;
++	int 				dst_stream_on;
++
++	// fatal_err is set if an error has occurred s.t. decode cannot
++	// continue (such as running out of CMA)
++	int fatal_err;
++
++	/* Lock for queue operations */
++	struct mutex			ctx_mutex;
++
++	struct v4l2_ctrl_handler	hdl;
++	struct v4l2_ctrl		**ctrls;
++
++	/* Decode state - stateless decoder my *** */
++	/* state contains stuff that is only needed in phase0
++	 * it could be held in dec_env but that would be wasteful
++	 */
++	struct rpivid_dec_state *state;
++	struct rpivid_dec_env *dec0;
++
++	/* Spinlock protecting dec_free */
++	spinlock_t dec_lock;
++	struct rpivid_dec_env *dec_free;
++
++	struct rpivid_dec_env *dec_pool;
++
++	unsigned int p1idx;
++	atomic_t p1out;
++	struct rpivid_gptr bitbufs[RPIVID_P1BUF_COUNT];
++
++	/* *** Should be in dev *** */
++	unsigned int p2idx;
++	struct rpivid_gptr pu_bufs[RPIVID_P2BUF_COUNT];
++	struct rpivid_gptr coeff_bufs[RPIVID_P2BUF_COUNT];
++
++	/* Spinlock protecting aux_free */
++	spinlock_t aux_lock;
++	struct rpivid_q_aux *aux_free;
++
++	struct rpivid_q_aux *aux_ents[RPIVID_AUX_ENT_COUNT];
++
++	unsigned int colmv_stride;
++	unsigned int colmv_picsize;
++};
++
++struct rpivid_dec_ops {
++	void (*setup)(struct rpivid_ctx *ctx, struct rpivid_run *run);
++	int (*start)(struct rpivid_ctx *ctx);
++	void (*stop)(struct rpivid_ctx *ctx);
++	void (*trigger)(struct rpivid_ctx *ctx);
++};
++
++struct rpivid_variant {
++	unsigned int	capabilities;
++	unsigned int	quirks;
++	unsigned int	mod_rate;
++};
++
++struct rpivid_hw_irq_ent;
++
++#define RPIVID_ICTL_ENABLE_UNLIMITED (-1)
++
++struct rpivid_hw_irq_ctrl {
++	/* Spinlock protecting claim and tail */
++	spinlock_t lock;
++	struct rpivid_hw_irq_ent *claim;
++	struct rpivid_hw_irq_ent *tail;
++
++	/* Ent for pending irq - also prevents sched */
++	struct rpivid_hw_irq_ent *irq;
++	/* Non-zero => do not start a new job - outer layer sched pending */
++	int no_sched;
++	/* Enable count. -1 always OK, 0 do not sched, +ve shed & count down */
++	int enable;
++	/* Thread CB requested */
++	bool thread_reqed;
++};
++
++struct rpivid_dev {
++	struct v4l2_device	v4l2_dev;
++	struct video_device	vfd;
++	struct media_device	mdev;
++	struct media_pad	pad[2];
++	struct platform_device	*pdev;
++	struct device		*dev;
++	struct v4l2_m2m_dev	*m2m_dev;
++	const struct rpivid_dec_ops *dec_ops;
++
++	/* Device file mutex */
++	struct mutex		dev_mutex;
++
++	void __iomem		*base_irq;
++	void __iomem		*base_h265;
++
++	struct clk		*clock;
++	unsigned long		max_clock_rate;
++
++	int			cache_align;
++
++	struct rpivid_hw_irq_ctrl ic_active1;
++	struct rpivid_hw_irq_ctrl ic_active2;
++};
++
++extern const struct rpivid_dec_ops rpivid_dec_ops_h265;
++extern const struct v4l2_ctrl_ops rpivid_hevc_sps_ctrl_ops;
++extern const struct v4l2_ctrl_ops rpivid_hevc_pps_ctrl_ops;
++
++struct v4l2_ctrl *rpivid_find_ctrl(struct rpivid_ctx *ctx, u32 id);
++void *rpivid_find_control_data(struct rpivid_ctx *ctx, u32 id);
++
++#endif
+--- /dev/null
++++ b/drivers/staging/media/rpivid/rpivid_dec.c
+@@ -0,0 +1,96 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Raspberry Pi HEVC driver
++ *
++ * Copyright (C) 2020 Raspberry Pi (Trading) Ltd
++ *
++ * Based on the Cedrus VPU driver, that is:
++ *
++ * Copyright (C) 2016 Florent Revest <florent.revest@free-electrons.com>
++ * Copyright (C) 2018 Paul Kocialkowski <paul.kocialkowski@bootlin.com>
++ * Copyright (C) 2018 Bootlin
++ */
++
++#include <media/v4l2-device.h>
++#include <media/v4l2-ioctl.h>
++#include <media/v4l2-event.h>
++#include <media/v4l2-mem2mem.h>
++
++#include "rpivid.h"
++#include "rpivid_dec.h"
++
++void rpivid_device_run(void *priv)
++{
++	struct rpivid_ctx *const ctx = priv;
++	struct rpivid_dev *const dev = ctx->dev;
++	struct rpivid_run run = {};
++	struct media_request *src_req;
++
++	run.src = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
++	run.dst = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx);
++
++	if (!run.src || !run.dst) {
++		v4l2_err(&dev->v4l2_dev, "%s: Missing buffer: src=%p, dst=%p\n",
++			 __func__, run.src, run.dst);
++		goto fail;
++	}
++
++	/* Apply request(s) controls */
++	src_req = run.src->vb2_buf.req_obj.req;
++	if (!src_req) {
++		v4l2_err(&dev->v4l2_dev, "%s: Missing request\n", __func__);
++		goto fail;
++	}
++
++	v4l2_ctrl_request_setup(src_req, &ctx->hdl);
++
++	switch (ctx->src_fmt.pixelformat) {
++	case V4L2_PIX_FMT_HEVC_SLICE:
++	{
++		const struct v4l2_ctrl *ctrl;
++
++		run.h265.sps =
++			rpivid_find_control_data(ctx,
++						 V4L2_CID_STATELESS_HEVC_SPS);
++		run.h265.pps =
++			rpivid_find_control_data(ctx,
++						 V4L2_CID_STATELESS_HEVC_PPS);
++		run.h265.dec =
++			rpivid_find_control_data(ctx,
++						 V4L2_CID_STATELESS_HEVC_DECODE_PARAMS);
++
++		ctrl = rpivid_find_ctrl(ctx,
++					V4L2_CID_STATELESS_HEVC_SLICE_PARAMS);
++		if (!ctrl || !ctrl->elems) {
++			v4l2_err(&dev->v4l2_dev, "%s: Missing slice params\n",
++				 __func__);
++			goto fail;
++		}
++		run.h265.slice_ents = ctrl->elems;
++		run.h265.slice_params = ctrl->p_cur.p;
++
++		run.h265.scaling_matrix =
++			rpivid_find_control_data(ctx,
++						 V4L2_CID_STATELESS_HEVC_SCALING_MATRIX);
++		break;
++	}
++
++	default:
++		break;
++	}
++
++	v4l2_m2m_buf_copy_metadata(run.src, run.dst, true);
++
++	dev->dec_ops->setup(ctx, &run);
++
++	/* Complete request(s) controls */
++	v4l2_ctrl_request_complete(src_req, &ctx->hdl);
++
++	dev->dec_ops->trigger(ctx);
++	return;
++
++fail:
++	/* We really shouldn't get here but tidy up what we can */
++	v4l2_m2m_buf_done_and_job_finish(dev->m2m_dev, ctx->fh.m2m_ctx,
++					 VB2_BUF_STATE_ERROR);
++}
+--- /dev/null
++++ b/drivers/staging/media/rpivid/rpivid_dec.h
+@@ -0,0 +1,19 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * Raspberry Pi HEVC driver
++ *
++ * Copyright (C) 2020 Raspberry Pi (Trading) Ltd
++ *
++ * Based on the Cedrus VPU driver, that is:
++ *
++ * Copyright (C) 2016 Florent Revest <florent.revest@free-electrons.com>
++ * Copyright (C) 2018 Paul Kocialkowski <paul.kocialkowski@bootlin.com>
++ * Copyright (C) 2018 Bootlin
++ */
++
++#ifndef _RPIVID_DEC_H_
++#define _RPIVID_DEC_H_
++
++void rpivid_device_run(void *priv);
++
++#endif
+--- /dev/null
++++ b/drivers/staging/media/rpivid/rpivid_h265.c
+@@ -0,0 +1,2712 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * Raspberry Pi HEVC driver
++ *
++ * Copyright (C) 2020 Raspberry Pi (Trading) Ltd
++ *
++ * Based on the Cedrus VPU driver, that is:
++ *
++ * Copyright (C) 2016 Florent Revest <florent.revest@free-electrons.com>
++ * Copyright (C) 2018 Paul Kocialkowski <paul.kocialkowski@bootlin.com>
++ * Copyright (C) 2018 Bootlin
++ */
++
++#include <linux/delay.h>
++#include <linux/types.h>
++
++#include <media/videobuf2-dma-contig.h>
++
++#include "rpivid.h"
++#include "rpivid_hw.h"
++#include "rpivid_video.h"
++
++#define DEBUG_TRACE_P1_CMD 0
++#define DEBUG_TRACE_EXECUTION 0
++
++#define USE_REQUEST_PIN 1
++
++#if DEBUG_TRACE_EXECUTION
++#define xtrace_in(dev_, de_)\
++	v4l2_info(&(dev_)->v4l2_dev, "%s[%d]: in\n",   __func__,\
++		  (de_) == NULL ? -1 : (de_)->decode_order)
++#define xtrace_ok(dev_, de_)\
++	v4l2_info(&(dev_)->v4l2_dev, "%s[%d]: ok\n",   __func__,\
++		  (de_) == NULL ? -1 : (de_)->decode_order)
++#define xtrace_fin(dev_, de_)\
++	v4l2_info(&(dev_)->v4l2_dev, "%s[%d]: finish\n", __func__,\
++		  (de_) == NULL ? -1 : (de_)->decode_order)
++#define xtrace_fail(dev_, de_)\
++	v4l2_info(&(dev_)->v4l2_dev, "%s[%d]: FAIL\n", __func__,\
++		  (de_) == NULL ? -1 : (de_)->decode_order)
++#else
++#define xtrace_in(dev_, de_)
++#define xtrace_ok(dev_, de_)
++#define xtrace_fin(dev_, de_)
++#define xtrace_fail(dev_, de_)
++#endif
++
++enum hevc_slice_type {
++	HEVC_SLICE_B = 0,
++	HEVC_SLICE_P = 1,
++	HEVC_SLICE_I = 2,
++};
++
++enum hevc_layer { L0 = 0, L1 = 1 };
++
++static int gptr_alloc(struct rpivid_dev *const dev, struct rpivid_gptr *gptr,
++		      size_t size, unsigned long attrs)
++{
++	gptr->size = size;
++	gptr->attrs = attrs;
++	gptr->addr = 0;
++	gptr->ptr = dma_alloc_attrs(dev->dev, gptr->size, &gptr->addr,
++				    GFP_KERNEL, gptr->attrs);
++	return !gptr->ptr ? -ENOMEM : 0;
++}
++
++static void gptr_free(struct rpivid_dev *const dev,
++		      struct rpivid_gptr *const gptr)
++{
++	if (gptr->ptr)
++		dma_free_attrs(dev->dev, gptr->size, gptr->ptr, gptr->addr,
++			       gptr->attrs);
++	gptr->size = 0;
++	gptr->ptr = NULL;
++	gptr->addr = 0;
++	gptr->attrs = 0;
++}
++
++/* Realloc but do not copy
++ *
++ * Frees then allocs.
++ * If the alloc fails then it attempts to re-allocote the old size
++ * On error then check gptr->ptr to determine if anything is currently
++ * allocated.
++ */
++static int gptr_realloc_new(struct rpivid_dev * const dev,
++			    struct rpivid_gptr * const gptr, size_t size)
++{
++	const size_t old_size = gptr->size;
++
++	if (size == gptr->size)
++		return 0;
++
++	if (gptr->ptr)
++		dma_free_attrs(dev->dev, gptr->size, gptr->ptr,
++			       gptr->addr, gptr->attrs);
++
++	gptr->addr = 0;
++	gptr->size = size;
++	gptr->ptr = dma_alloc_attrs(dev->dev, gptr->size,
++				    &gptr->addr, GFP_KERNEL, gptr->attrs);
++
++	if (!gptr->ptr) {
++		gptr->addr = 0;
++		gptr->size = old_size;
++		gptr->ptr = dma_alloc_attrs(dev->dev, gptr->size,
++					    &gptr->addr, GFP_KERNEL, gptr->attrs);
++		if (!gptr->ptr) {
++			gptr->size = 0;
++			gptr->addr = 0;
++			gptr->attrs = 0;
++		}
++		return -ENOMEM;
++	}
++
++	return 0;
++}
++
++static size_t next_size(const size_t x)
++{
++	return rpivid_round_up_size(x + 1);
++}
++
++#define NUM_SCALING_FACTORS 4064 /* Not a typo = 0xbe0 + 0x400 */
++
++#define AXI_BASE64 0
++
++#define PROB_BACKUP ((20 << 12) + (20 << 6) + (0 << 0))
++#define PROB_RELOAD ((20 << 12) + (20 << 0) + (0 << 6))
++
++#define HEVC_MAX_REFS V4L2_HEVC_DPB_ENTRIES_NUM_MAX
++
++//////////////////////////////////////////////////////////////////////////////
++
++struct rpi_cmd {
++	u32 addr;
++	u32 data;
++} __packed;
++
++struct rpivid_q_aux {
++	unsigned int refcount;
++	unsigned int q_index;
++	struct rpivid_q_aux *next;
++	struct rpivid_gptr col;
++};
++
++//////////////////////////////////////////////////////////////////////////////
++
++enum rpivid_decode_state {
++	RPIVID_DECODE_SLICE_START,
++	RPIVID_DECODE_SLICE_CONTINUE,
++	RPIVID_DECODE_ERROR_CONTINUE,
++	RPIVID_DECODE_ERROR_DONE,
++	RPIVID_DECODE_PHASE1,
++	RPIVID_DECODE_END,
++};
++
++struct rpivid_dec_env {
++	struct rpivid_ctx *ctx;
++	struct rpivid_dec_env *next;
++
++	enum rpivid_decode_state state;
++	unsigned int decode_order;
++	int p1_status;		/* P1 status - what to realloc */
++
++	struct rpi_cmd *cmd_fifo;
++	unsigned int cmd_len, cmd_max;
++	unsigned int num_slice_msgs;
++	unsigned int pic_width_in_ctbs_y;
++	unsigned int pic_height_in_ctbs_y;
++	unsigned int dpbno_col;
++	u32 reg_slicestart;
++	int collocated_from_l0_flag;
++	/*
++	 * Last CTB/Tile X,Y processed by (wpp_)entry_point
++	 * Could be in _state as P0 only but needs updating where _state
++	 * is const
++	 */
++	unsigned int entry_ctb_x;
++	unsigned int entry_ctb_y;
++	unsigned int entry_tile_x;
++	unsigned int entry_tile_y;
++	unsigned int entry_qp;
++	u32 entry_slice;
++
++	u32 rpi_config2;
++	u32 rpi_framesize;
++	u32 rpi_currpoc;
++
++	struct vb2_v4l2_buffer *frame_buf; // Detached dest buffer
++	struct vb2_v4l2_buffer *src_buf;   // Detached src buffer
++	unsigned int frame_c_offset;
++	unsigned int frame_stride;
++	dma_addr_t frame_addr;
++	dma_addr_t ref_addrs[16];
++	struct rpivid_q_aux *frame_aux;
++	struct rpivid_q_aux *col_aux;
++
++	dma_addr_t cmd_addr;
++	size_t cmd_size;
++
++	dma_addr_t pu_base_vc;
++	dma_addr_t coeff_base_vc;
++	u32 pu_stride;
++	u32 coeff_stride;
++
++	struct rpivid_gptr *bit_copy_gptr;
++	size_t bit_copy_len;
++
++#define SLICE_MSGS_MAX (2 * HEVC_MAX_REFS * 8 + 3)
++	u16 slice_msgs[SLICE_MSGS_MAX];
++	u8 scaling_factors[NUM_SCALING_FACTORS];
++
++#if USE_REQUEST_PIN
++	struct media_request *req_pin;
++#else
++	struct media_request_object *req_obj;
++#endif
++	struct rpivid_hw_irq_ent irq_ent;
++};
++
++#define member_size(type, member) sizeof(((type *)0)->member)
++
++struct rpivid_dec_state {
++	struct v4l2_ctrl_hevc_sps sps;
++	struct v4l2_ctrl_hevc_pps pps;
++
++	// Helper vars & tables derived from sps/pps
++	unsigned int log2_ctb_size;     /* log2 width of a CTB */
++	unsigned int ctb_width;         /* Width in CTBs */
++	unsigned int ctb_height;        /* Height in CTBs */
++	unsigned int ctb_size;          /* Pic area in CTBs */
++	unsigned int tile_width;        /* Width in tiles */
++	unsigned int tile_height;       /* Height in tiles */
++
++	int *col_bd;
++	int *row_bd;
++	int *ctb_addr_rs_to_ts;
++	int *ctb_addr_ts_to_rs;
++
++	// Aux starage for DPB
++	// Hold refs
++	struct rpivid_q_aux *ref_aux[HEVC_MAX_REFS];
++	struct rpivid_q_aux *frame_aux;
++
++	// Slice vars
++	unsigned int slice_idx;
++	bool slice_temporal_mvp;  /* Slice flag but constant for frame */
++	bool use_aux;
++	bool mk_aux;
++
++	// Temp vars per run - don't actually need to persist
++	u8 *src_buf;
++	dma_addr_t src_addr;
++	const struct v4l2_ctrl_hevc_slice_params *sh;
++	const struct v4l2_ctrl_hevc_decode_params *dec;
++	unsigned int nb_refs[2];
++	unsigned int slice_qp;
++	unsigned int max_num_merge_cand; // 0 if I-slice
++	bool dependent_slice_segment_flag;
++
++	unsigned int start_ts;          /* slice_segment_addr -> ts */
++	unsigned int start_ctb_x;       /* CTB X,Y of start_ts */
++	unsigned int start_ctb_y;
++	unsigned int prev_ctb_x;        /* CTB X,Y of start_ts - 1 */
++	unsigned int prev_ctb_y;
++};
++
++#if !USE_REQUEST_PIN
++static void dst_req_obj_release(struct media_request_object *object)
++{
++	kfree(object);
++}
++
++static const struct media_request_object_ops dst_req_obj_ops = {
++	.release = dst_req_obj_release,
++};
++#endif
++
++static inline int clip_int(const int x, const int lo, const int hi)
++{
++	return x < lo ? lo : x > hi ? hi : x;
++}
++
++//////////////////////////////////////////////////////////////////////////////
++// Phase 1 command and bit FIFOs
++
++#if DEBUG_TRACE_P1_CMD
++static int p1_z;
++#endif
++
++static int cmds_check_space(struct rpivid_dec_env *const de, unsigned int n)
++{
++	struct rpi_cmd *a;
++	unsigned int newmax;
++
++	if (n > 0x100000) {
++		v4l2_err(&de->ctx->dev->v4l2_dev,
++			 "%s: n %u implausible\n", __func__, n);
++		return -ENOMEM;
++	}
++
++	if (de->cmd_len + n <= de->cmd_max)
++		return 0;
++
++	newmax = roundup_pow_of_two(de->cmd_len + n);
++
++	a = krealloc(de->cmd_fifo, newmax * sizeof(struct rpi_cmd),
++		     GFP_KERNEL);
++	if (!a) {
++		v4l2_err(&de->ctx->dev->v4l2_dev,
++			 "Failed cmd buffer realloc from %u to %u\n",
++			 de->cmd_max, newmax);
++		return -ENOMEM;
++	}
++	v4l2_info(&de->ctx->dev->v4l2_dev,
++		  "cmd buffer realloc from %u to %u\n", de->cmd_max, newmax);
++
++	de->cmd_fifo = a;
++	de->cmd_max = newmax;
++	return 0;
++}
++
++// ???? u16 addr - put in u32
++static void p1_apb_write(struct rpivid_dec_env *const de, const u16 addr,
++			 const u32 data)
++{
++	if (de->cmd_len >= de->cmd_max) {
++		v4l2_err(&de->ctx->dev->v4l2_dev,
++			 "%s: Overflow @ %d\n", __func__, de->cmd_len);
++		return;
++	}
++
++	de->cmd_fifo[de->cmd_len].addr = addr;
++	de->cmd_fifo[de->cmd_len].data = data;
++
++#if DEBUG_TRACE_P1_CMD
++	if (++p1_z < 256) {
++		v4l2_info(&de->ctx->dev->v4l2_dev, "[%02x] %x %x\n",
++			  de->cmd_len, addr, data);
++	}
++#endif
++	de->cmd_len++;
++}
++
++static int ctb_to_tile(unsigned int ctb, unsigned int *bd, int num)
++{
++	int i;
++
++	for (i = 1; ctb >= bd[i]; i++)
++		; // bd[] has num+1 elements; bd[0]=0;
++	return i - 1;
++}
++
++static unsigned int ctb_to_tile_x(const struct rpivid_dec_state *const s,
++				  const unsigned int ctb_x)
++{
++	return ctb_to_tile(ctb_x, s->col_bd, s->tile_width);
++}
++
++static unsigned int ctb_to_tile_y(const struct rpivid_dec_state *const s,
++				  const unsigned int ctb_y)
++{
++	return ctb_to_tile(ctb_y, s->row_bd, s->tile_height);
++}
++
++static void aux_q_free(struct rpivid_ctx *const ctx,
++		       struct rpivid_q_aux *const aq)
++{
++	struct rpivid_dev *const dev = ctx->dev;
++
++	gptr_free(dev, &aq->col);
++	kfree(aq);
++}
++
++static struct rpivid_q_aux *aux_q_alloc(struct rpivid_ctx *const ctx,
++					const unsigned int q_index)
++{
++	struct rpivid_dev *const dev = ctx->dev;
++	struct rpivid_q_aux *const aq = kzalloc(sizeof(*aq), GFP_KERNEL);
++
++	if (!aq)
++		return NULL;
++
++	if (gptr_alloc(dev, &aq->col, ctx->colmv_picsize,
++		       DMA_ATTR_FORCE_CONTIGUOUS | DMA_ATTR_NO_KERNEL_MAPPING))
++		goto fail;
++
++	/*
++	 * Spinlock not required as called in P0 only and
++	 * aux checks done by _new
++	 */
++	aq->refcount = 1;
++	aq->q_index = q_index;
++	ctx->aux_ents[q_index] = aq;
++	return aq;
++
++fail:
++	kfree(aq);
++	return NULL;
++}
++
++static struct rpivid_q_aux *aux_q_new(struct rpivid_ctx *const ctx,
++				      const unsigned int q_index)
++{
++	struct rpivid_q_aux *aq;
++	unsigned long lockflags;
++
++	spin_lock_irqsave(&ctx->aux_lock, lockflags);
++	/*
++	 * If we already have this allocated to a slot then use that
++	 * and assume that it will all work itself out in the pipeline
++	 */
++	if ((aq = ctx->aux_ents[q_index]) != NULL) {
++		++aq->refcount;
++	} else if ((aq = ctx->aux_free) != NULL) {
++		ctx->aux_free = aq->next;
++		aq->next = NULL;
++		aq->refcount = 1;
++		aq->q_index = q_index;
++		ctx->aux_ents[q_index] = aq;
++	}
++	spin_unlock_irqrestore(&ctx->aux_lock, lockflags);
++
++	if (!aq)
++		aq = aux_q_alloc(ctx, q_index);
++
++	return aq;
++}
++
++static struct rpivid_q_aux *aux_q_ref_idx(struct rpivid_ctx *const ctx,
++					  const int q_index)
++{
++	unsigned long lockflags;
++	struct rpivid_q_aux *aq;
++
++	spin_lock_irqsave(&ctx->aux_lock, lockflags);
++	if ((aq = ctx->aux_ents[q_index]) != NULL)
++		++aq->refcount;
++	spin_unlock_irqrestore(&ctx->aux_lock, lockflags);
++
++	return aq;
++}
++
++static struct rpivid_q_aux *aux_q_ref(struct rpivid_ctx *const ctx,
++				      struct rpivid_q_aux *const aq)
++{
++	if (aq) {
++		unsigned long lockflags;
++
++		spin_lock_irqsave(&ctx->aux_lock, lockflags);
++
++		++aq->refcount;
++
++		spin_unlock_irqrestore(&ctx->aux_lock, lockflags);
++	}
++	return aq;
++}
++
++static void aux_q_release(struct rpivid_ctx *const ctx,
++			  struct rpivid_q_aux **const paq)
++{
++	struct rpivid_q_aux *const aq = *paq;
++	unsigned long lockflags;
++
++	if (!aq)
++		return;
++
++	*paq = NULL;
++
++	spin_lock_irqsave(&ctx->aux_lock, lockflags);
++	if (--aq->refcount == 0) {
++		aq->next = ctx->aux_free;
++		ctx->aux_free = aq;
++		ctx->aux_ents[aq->q_index] = NULL;
++		aq->q_index = ~0U;
++	}
++	spin_unlock_irqrestore(&ctx->aux_lock, lockflags);
++}
++
++static void aux_q_init(struct rpivid_ctx *const ctx)
++{
++	spin_lock_init(&ctx->aux_lock);
++	ctx->aux_free = NULL;
++}
++
++static void aux_q_uninit(struct rpivid_ctx *const ctx)
++{
++	struct rpivid_q_aux *aq;
++
++	ctx->colmv_picsize = 0;
++	ctx->colmv_stride = 0;
++	while ((aq = ctx->aux_free) != NULL) {
++		ctx->aux_free = aq->next;
++		aux_q_free(ctx, aq);
++	}
++}
++
++//////////////////////////////////////////////////////////////////////////////
++
++/*
++ * Initialisation process for context variables (CABAC init)
++ * see H.265 9.3.2.2
++ *
++ * N.B. If comparing with FFmpeg note that this h/w uses slightly different
++ * offsets to FFmpegs array
++ */
++
++/* Actual number of values */
++#define RPI_PROB_VALS 154U
++/* Rounded up as we copy words */
++#define RPI_PROB_ARRAY_SIZE ((154 + 3) & ~3)
++
++/* Initialiser values - see tables H.265 9-4 through 9-42 */
++static const u8 prob_init[3][156] = {
++	{
++		153, 200, 139, 141, 157, 154, 154, 154, 154, 154, 184, 154, 154,
++		154, 184, 63,  154, 154, 154, 154, 154, 154, 154, 154, 154, 154,
++		154, 154, 154, 153, 138, 138, 111, 141, 94,  138, 182, 154, 154,
++		154, 140, 92,  137, 138, 140, 152, 138, 139, 153, 74,  149, 92,
++		139, 107, 122, 152, 140, 179, 166, 182, 140, 227, 122, 197, 110,
++		110, 124, 125, 140, 153, 125, 127, 140, 109, 111, 143, 127, 111,
++		79,  108, 123, 63,  110, 110, 124, 125, 140, 153, 125, 127, 140,
++		109, 111, 143, 127, 111, 79,  108, 123, 63,  91,  171, 134, 141,
++		138, 153, 136, 167, 152, 152, 139, 139, 111, 111, 125, 110, 110,
++		94,  124, 108, 124, 107, 125, 141, 179, 153, 125, 107, 125, 141,
++		179, 153, 125, 107, 125, 141, 179, 153, 125, 140, 139, 182, 182,
++		152, 136, 152, 136, 153, 136, 139, 111, 136, 139, 111, 0,   0,
++	},
++	{
++		153, 185, 107, 139, 126, 197, 185, 201, 154, 149, 154, 139, 154,
++		154, 154, 152, 110, 122, 95,  79,  63,  31,  31,  153, 153, 168,
++		140, 198, 79,  124, 138, 94,  153, 111, 149, 107, 167, 154, 154,
++		154, 154, 196, 196, 167, 154, 152, 167, 182, 182, 134, 149, 136,
++		153, 121, 136, 137, 169, 194, 166, 167, 154, 167, 137, 182, 125,
++		110, 94,  110, 95,  79,  125, 111, 110, 78,  110, 111, 111, 95,
++		94,  108, 123, 108, 125, 110, 94,  110, 95,  79,  125, 111, 110,
++		78,  110, 111, 111, 95,  94,  108, 123, 108, 121, 140, 61,  154,
++		107, 167, 91,  122, 107, 167, 139, 139, 155, 154, 139, 153, 139,
++		123, 123, 63,  153, 166, 183, 140, 136, 153, 154, 166, 183, 140,
++		136, 153, 154, 166, 183, 140, 136, 153, 154, 170, 153, 123, 123,
++		107, 121, 107, 121, 167, 151, 183, 140, 151, 183, 140, 0,   0,
++	},
++	{
++		153, 160, 107, 139, 126, 197, 185, 201, 154, 134, 154, 139, 154,
++		154, 183, 152, 154, 137, 95,  79,  63,  31,  31,  153, 153, 168,
++		169, 198, 79,  224, 167, 122, 153, 111, 149, 92,  167, 154, 154,
++		154, 154, 196, 167, 167, 154, 152, 167, 182, 182, 134, 149, 136,
++		153, 121, 136, 122, 169, 208, 166, 167, 154, 152, 167, 182, 125,
++		110, 124, 110, 95,  94,  125, 111, 111, 79,  125, 126, 111, 111,
++		79,  108, 123, 93,  125, 110, 124, 110, 95,  94,  125, 111, 111,
++		79,  125, 126, 111, 111, 79,  108, 123, 93,  121, 140, 61,  154,
++		107, 167, 91,  107, 107, 167, 139, 139, 170, 154, 139, 153, 139,
++		123, 123, 63,  124, 166, 183, 140, 136, 153, 154, 166, 183, 140,
++		136, 153, 154, 166, 183, 140, 136, 153, 154, 170, 153, 138, 138,
++		122, 121, 122, 121, 167, 151, 183, 140, 151, 183, 140, 0,   0,
++	},
++};
++
++#define CMDS_WRITE_PROB ((RPI_PROB_ARRAY_SIZE / 4) + 1)
++static void write_prob(struct rpivid_dec_env *const de,
++		       const struct rpivid_dec_state *const s)
++{
++	u8 dst[RPI_PROB_ARRAY_SIZE];
++
++	const unsigned int init_type =
++		((s->sh->flags & V4L2_HEVC_SLICE_PARAMS_FLAG_CABAC_INIT) != 0 &&
++		 s->sh->slice_type != HEVC_SLICE_I) ?
++			s->sh->slice_type + 1 :
++			2 - s->sh->slice_type;
++	const u8 *p = prob_init[init_type];
++	const int q = clip_int(s->slice_qp, 0, 51);
++	unsigned int i;
++
++	for (i = 0; i < RPI_PROB_VALS; i++) {
++		int init_value = p[i];
++		int m = (init_value >> 4) * 5 - 45;
++		int n = ((init_value & 15) << 3) - 16;
++		int pre = 2 * (((m * q) >> 4) + n) - 127;
++
++		pre ^= pre >> 31;
++		if (pre > 124)
++			pre = 124 + (pre & 1);
++		dst[i] = pre;
++	}
++	for (i = RPI_PROB_VALS; i != RPI_PROB_ARRAY_SIZE; ++i)
++		dst[i] = 0;
++
++	for (i = 0; i < RPI_PROB_ARRAY_SIZE; i += 4)
++		p1_apb_write(de, 0x1000 + i,
++			     dst[i] + (dst[i + 1] << 8) + (dst[i + 2] << 16) +
++				     (dst[i + 3] << 24));
++
++	/*
++	 * Having written the prob array back it up
++	 * This is not always needed but is a small overhead that simplifies
++	 * (and speeds up) some multi-tile & WPP scenarios
++	 * There are no scenarios where having written a prob we ever want
++	 * a previous (non-initial) state back
++	 */
++	p1_apb_write(de, RPI_TRANSFER, PROB_BACKUP);
++}
++
++#define CMDS_WRITE_SCALING_FACTORS NUM_SCALING_FACTORS
++static void write_scaling_factors(struct rpivid_dec_env *const de)
++{
++	int i;
++	const u8 *p = (u8 *)de->scaling_factors;
++
++	for (i = 0; i < NUM_SCALING_FACTORS; i += 4, p += 4)
++		p1_apb_write(de, 0x2000 + i,
++			     p[0] + (p[1] << 8) + (p[2] << 16) + (p[3] << 24));
++}
++
++static inline __u32 dma_to_axi_addr(dma_addr_t a)
++{
++	return (__u32)(a >> 6);
++}
++
++#define CMDS_WRITE_BITSTREAM 4
++static int write_bitstream(struct rpivid_dec_env *const de,
++			   const struct rpivid_dec_state *const s)
++{
++	// Note that FFmpeg V4L2 does not remove emulation prevention bytes,
++	// so this is matched in the configuration here.
++	// Whether that is the correct behaviour or not is not clear in the
++	// spec.
++	const int rpi_use_emu = 1;
++	unsigned int offset = s->sh->data_byte_offset;
++	const unsigned int len = (s->sh->bit_size + 7) / 8 - offset;
++	dma_addr_t addr;
++
++	if (s->src_addr != 0) {
++		addr = s->src_addr + offset;
++	} else {
++		if (len + de->bit_copy_len > de->bit_copy_gptr->size) {
++			v4l2_warn(&de->ctx->dev->v4l2_dev,
++				  "Bit copy buffer overflow: size=%zu, offset=%zu, len=%u\n",
++				  de->bit_copy_gptr->size,
++				  de->bit_copy_len, len);
++			return -ENOMEM;
++		}
++		memcpy(de->bit_copy_gptr->ptr + de->bit_copy_len,
++		       s->src_buf + offset, len);
++		addr = de->bit_copy_gptr->addr + de->bit_copy_len;
++		de->bit_copy_len += (len + 63) & ~63;
++	}
++	offset = addr & 63;
++
++	p1_apb_write(de, RPI_BFBASE, dma_to_axi_addr(addr));
++	p1_apb_write(de, RPI_BFNUM, len);
++	p1_apb_write(de, RPI_BFCONTROL, offset + (1 << 7)); // Stop
++	p1_apb_write(de, RPI_BFCONTROL, offset + (rpi_use_emu << 6));
++	return 0;
++}
++
++//////////////////////////////////////////////////////////////////////////////
++
++/*
++ * The slice constant part of the slice register - width and height need to
++ * be ORed in later as they are per-tile / WPP-row
++ */
++static u32 slice_reg_const(const struct rpivid_dec_state *const s)
++{
++	u32 x = (s->max_num_merge_cand << 0) |
++		(s->nb_refs[L0] << 4) |
++		(s->nb_refs[L1] << 8) |
++		(s->sh->slice_type << 12);
++
++	if (s->sh->flags & V4L2_HEVC_SLICE_PARAMS_FLAG_SLICE_SAO_LUMA)
++		x |= BIT(14);
++	if (s->sh->flags & V4L2_HEVC_SLICE_PARAMS_FLAG_SLICE_SAO_CHROMA)
++		x |= BIT(15);
++	if (s->sh->slice_type == HEVC_SLICE_B &&
++	    (s->sh->flags & V4L2_HEVC_SLICE_PARAMS_FLAG_MVD_L1_ZERO))
++		x |= BIT(16);
++
++	return x;
++}
++
++//////////////////////////////////////////////////////////////////////////////
++
++#define CMDS_NEW_SLICE_SEGMENT (4 + CMDS_WRITE_SCALING_FACTORS)
++static void new_slice_segment(struct rpivid_dec_env *const de,
++			      const struct rpivid_dec_state *const s)
++{
++	const struct v4l2_ctrl_hevc_sps *const sps = &s->sps;
++	const struct v4l2_ctrl_hevc_pps *const pps = &s->pps;
++
++	p1_apb_write(de,
++		     RPI_SPS0,
++		     ((sps->log2_min_luma_coding_block_size_minus3 + 3) << 0) |
++		     (s->log2_ctb_size << 4) |
++		     ((sps->log2_min_luma_transform_block_size_minus2 + 2)
++							<< 8) |
++		     ((sps->log2_min_luma_transform_block_size_minus2 + 2 +
++		       sps->log2_diff_max_min_luma_transform_block_size)
++						<< 12) |
++		     ((sps->bit_depth_luma_minus8 + 8) << 16) |
++		     ((sps->bit_depth_chroma_minus8 + 8) << 20) |
++		     (sps->max_transform_hierarchy_depth_intra << 24) |
++		     (sps->max_transform_hierarchy_depth_inter << 28));
++
++	p1_apb_write(de,
++		     RPI_SPS1,
++		     ((sps->pcm_sample_bit_depth_luma_minus1 + 1) << 0) |
++		     ((sps->pcm_sample_bit_depth_chroma_minus1 + 1) << 4) |
++		     ((sps->log2_min_pcm_luma_coding_block_size_minus3 + 3)
++						<< 8) |
++		     ((sps->log2_min_pcm_luma_coding_block_size_minus3 + 3 +
++		       sps->log2_diff_max_min_pcm_luma_coding_block_size)
++						<< 12) |
++		     (((sps->flags & V4L2_HEVC_SPS_FLAG_SEPARATE_COLOUR_PLANE) ?
++				0 : sps->chroma_format_idc) << 16) |
++		     ((!!(sps->flags & V4L2_HEVC_SPS_FLAG_AMP_ENABLED)) << 18) |
++		     ((!!(sps->flags & V4L2_HEVC_SPS_FLAG_PCM_ENABLED)) << 19) |
++		     ((!!(sps->flags & V4L2_HEVC_SPS_FLAG_SCALING_LIST_ENABLED))
++						<< 20) |
++		     ((!!(sps->flags &
++			   V4L2_HEVC_SPS_FLAG_STRONG_INTRA_SMOOTHING_ENABLED))
++						<< 21));
++
++	p1_apb_write(de,
++		     RPI_PPS,
++		     ((s->log2_ctb_size - pps->diff_cu_qp_delta_depth) << 0) |
++		     ((!!(pps->flags & V4L2_HEVC_PPS_FLAG_CU_QP_DELTA_ENABLED))
++						 << 4) |
++		     ((!!(pps->flags &
++				V4L2_HEVC_PPS_FLAG_TRANSQUANT_BYPASS_ENABLED))
++						 << 5) |
++		     ((!!(pps->flags & V4L2_HEVC_PPS_FLAG_TRANSFORM_SKIP_ENABLED))
++						 << 6) |
++		     ((!!(pps->flags &
++				V4L2_HEVC_PPS_FLAG_SIGN_DATA_HIDING_ENABLED))
++						<< 7) |
++		     (((pps->pps_cb_qp_offset + s->sh->slice_cb_qp_offset) & 255)
++						<< 8) |
++		     (((pps->pps_cr_qp_offset + s->sh->slice_cr_qp_offset) & 255)
++						<< 16) |
++		     ((!!(pps->flags &
++				V4L2_HEVC_PPS_FLAG_CONSTRAINED_INTRA_PRED))
++						<< 24));
++
++	if (!s->start_ts &&
++	    (sps->flags & V4L2_HEVC_SPS_FLAG_SCALING_LIST_ENABLED) != 0)
++		write_scaling_factors(de);
++
++	if (!s->dependent_slice_segment_flag) {
++		int ctb_col = s->sh->slice_segment_addr %
++							de->pic_width_in_ctbs_y;
++		int ctb_row = s->sh->slice_segment_addr /
++							de->pic_width_in_ctbs_y;
++
++		de->reg_slicestart = (ctb_col << 0) + (ctb_row << 16);
++	}
++
++	p1_apb_write(de, RPI_SLICESTART, de->reg_slicestart);
++}
++
++//////////////////////////////////////////////////////////////////////////////
++// Slice messages
++
++static void msg_slice(struct rpivid_dec_env *const de, const u16 msg)
++{
++	de->slice_msgs[de->num_slice_msgs++] = msg;
++}
++
++#define CMDS_PROGRAM_SLICECMDS (1 + SLICE_MSGS_MAX)
++static void program_slicecmds(struct rpivid_dec_env *const de,
++			      const int sliceid)
++{
++	int i;
++
++	p1_apb_write(de, RPI_SLICECMDS, de->num_slice_msgs + (sliceid << 8));
++
++	for (i = 0; i < de->num_slice_msgs; i++)
++		p1_apb_write(de, 0x4000 + 4 * i, de->slice_msgs[i] & 0xffff);
++}
++
++// NoBackwardPredictionFlag 8.3.5
++// Simply checks POCs
++static int has_backward(const struct v4l2_hevc_dpb_entry *const dpb,
++			const __u8 *const idx, const unsigned int n,
++			const s32 cur_poc)
++{
++	unsigned int i;
++
++	for (i = 0; i < n; ++i) {
++		if (cur_poc < dpb[idx[i]].pic_order_cnt_val)
++			return 0;
++	}
++	return 1;
++}
++
++static void pre_slice_decode(struct rpivid_dec_env *const de,
++			     const struct rpivid_dec_state *const s)
++{
++	const struct v4l2_ctrl_hevc_slice_params *const sh = s->sh;
++	const struct v4l2_ctrl_hevc_decode_params *const dec = s->dec;
++	int weighted_pred_flag, idx;
++	u16 cmd_slice;
++	unsigned int collocated_from_l0_flag;
++
++	de->num_slice_msgs = 0;
++
++	cmd_slice = 0;
++	if (sh->slice_type == HEVC_SLICE_I)
++		cmd_slice = 1;
++	if (sh->slice_type == HEVC_SLICE_P)
++		cmd_slice = 2;
++	if (sh->slice_type == HEVC_SLICE_B)
++		cmd_slice = 3;
++
++	cmd_slice |= (s->nb_refs[L0] << 2) | (s->nb_refs[L1] << 6) |
++		     (s->max_num_merge_cand << 11);
++
++	collocated_from_l0_flag =
++		!s->slice_temporal_mvp ||
++		sh->slice_type != HEVC_SLICE_B ||
++		(sh->flags & V4L2_HEVC_SLICE_PARAMS_FLAG_COLLOCATED_FROM_L0);
++	cmd_slice |= collocated_from_l0_flag << 14;
++
++	if (sh->slice_type == HEVC_SLICE_P || sh->slice_type == HEVC_SLICE_B) {
++		// Flag to say all reference pictures are from the past
++		const int no_backward_pred_flag =
++			has_backward(dec->dpb, sh->ref_idx_l0, s->nb_refs[L0],
++				     sh->slice_pic_order_cnt) &&
++			has_backward(dec->dpb, sh->ref_idx_l1, s->nb_refs[L1],
++				     sh->slice_pic_order_cnt);
++		cmd_slice |= no_backward_pred_flag << 10;
++		msg_slice(de, cmd_slice);
++
++		if (s->slice_temporal_mvp) {
++			const __u8 *const rpl = collocated_from_l0_flag ?
++						sh->ref_idx_l0 : sh->ref_idx_l1;
++			de->dpbno_col = rpl[sh->collocated_ref_idx];
++			//v4l2_info(&de->ctx->dev->v4l2_dev,
++			//	    "L0=%d col_ref_idx=%d,
++			//          dpb_no=%d\n", collocated_from_l0_flag,
++			//          sh->collocated_ref_idx, de->dpbno_col);
++		}
++
++		// Write reference picture descriptions
++		weighted_pred_flag =
++			sh->slice_type == HEVC_SLICE_P ?
++				!!(s->pps.flags & V4L2_HEVC_PPS_FLAG_WEIGHTED_PRED) :
++				!!(s->pps.flags & V4L2_HEVC_PPS_FLAG_WEIGHTED_BIPRED);
++
++		for (idx = 0; idx < s->nb_refs[L0]; ++idx) {
++			unsigned int dpb_no = sh->ref_idx_l0[idx];
++			//v4l2_info(&de->ctx->dev->v4l2_dev,
++			//	  "L0[%d]=dpb[%d]\n", idx, dpb_no);
++
++			msg_slice(de,
++				  dpb_no |
++				  ((dec->dpb[dpb_no].flags &
++					V4L2_HEVC_DPB_ENTRY_LONG_TERM_REFERENCE) ?
++						 (1 << 4) : 0) |
++				  (weighted_pred_flag ? (3 << 5) : 0));
++			msg_slice(de, dec->dpb[dpb_no].pic_order_cnt_val & 0xffff);
++
++			if (weighted_pred_flag) {
++				const struct v4l2_hevc_pred_weight_table
++					*const w = &sh->pred_weight_table;
++				const int luma_weight_denom =
++					(1 << w->luma_log2_weight_denom);
++				const unsigned int chroma_log2_weight_denom =
++					(w->luma_log2_weight_denom +
++					 w->delta_chroma_log2_weight_denom);
++				const int chroma_weight_denom =
++					(1 << chroma_log2_weight_denom);
++
++				msg_slice(de,
++					  w->luma_log2_weight_denom |
++					  (((w->delta_luma_weight_l0[idx] +
++					     luma_weight_denom) & 0x1ff)
++						 << 3));
++				msg_slice(de, w->luma_offset_l0[idx] & 0xff);
++				msg_slice(de,
++					  chroma_log2_weight_denom |
++					  (((w->delta_chroma_weight_l0[idx][0] +
++					     chroma_weight_denom) & 0x1ff)
++						   << 3));
++				msg_slice(de,
++					  w->chroma_offset_l0[idx][0] & 0xff);
++				msg_slice(de,
++					  chroma_log2_weight_denom |
++					  (((w->delta_chroma_weight_l0[idx][1] +
++					     chroma_weight_denom) & 0x1ff)
++						   << 3));
++				msg_slice(de,
++					  w->chroma_offset_l0[idx][1] & 0xff);
++			}
++		}
++
++		for (idx = 0; idx < s->nb_refs[L1]; ++idx) {
++			unsigned int dpb_no = sh->ref_idx_l1[idx];
++			//v4l2_info(&de->ctx->dev->v4l2_dev,
++			//          "L1[%d]=dpb[%d]\n", idx, dpb_no);
++			msg_slice(de,
++				  dpb_no |
++				  ((dec->dpb[dpb_no].flags &
++					 V4L2_HEVC_DPB_ENTRY_LONG_TERM_REFERENCE) ?
++						 (1 << 4) : 0) |
++					(weighted_pred_flag ? (3 << 5) : 0));
++			msg_slice(de, dec->dpb[dpb_no].pic_order_cnt_val & 0xffff);
++			if (weighted_pred_flag) {
++				const struct v4l2_hevc_pred_weight_table
++					*const w = &sh->pred_weight_table;
++				const int luma_weight_denom =
++					(1 << w->luma_log2_weight_denom);
++				const unsigned int chroma_log2_weight_denom =
++					(w->luma_log2_weight_denom +
++					 w->delta_chroma_log2_weight_denom);
++				const int chroma_weight_denom =
++					(1 << chroma_log2_weight_denom);
++
++				msg_slice(de,
++					  w->luma_log2_weight_denom |
++					  (((w->delta_luma_weight_l1[idx] +
++					     luma_weight_denom) & 0x1ff) << 3));
++				msg_slice(de, w->luma_offset_l1[idx] & 0xff);
++				msg_slice(de,
++					  chroma_log2_weight_denom |
++					  (((w->delta_chroma_weight_l1[idx][0] +
++					     chroma_weight_denom) & 0x1ff)
++							<< 3));
++				msg_slice(de,
++					  w->chroma_offset_l1[idx][0] & 0xff);
++				msg_slice(de,
++					  chroma_log2_weight_denom |
++					  (((w->delta_chroma_weight_l1[idx][1] +
++					     chroma_weight_denom) & 0x1ff)
++						   << 3));
++				msg_slice(de,
++					  w->chroma_offset_l1[idx][1] & 0xff);
++			}
++		}
++	} else {
++		msg_slice(de, cmd_slice);
++	}
++
++	msg_slice(de,
++		  (sh->slice_beta_offset_div2 & 15) |
++		  ((sh->slice_tc_offset_div2 & 15) << 4) |
++		  ((sh->flags &
++		    V4L2_HEVC_SLICE_PARAMS_FLAG_SLICE_DEBLOCKING_FILTER_DISABLED) ?
++						1 << 8 : 0) |
++		  ((sh->flags &
++			  V4L2_HEVC_SLICE_PARAMS_FLAG_SLICE_LOOP_FILTER_ACROSS_SLICES_ENABLED) ?
++						1 << 9 : 0) |
++		  ((s->pps.flags &
++			  V4L2_HEVC_PPS_FLAG_LOOP_FILTER_ACROSS_TILES_ENABLED) ?
++						1 << 10 : 0));
++
++	msg_slice(de, ((sh->slice_cr_qp_offset & 31) << 5) +
++		       (sh->slice_cb_qp_offset & 31)); // CMD_QPOFF
++}
++
++#define CMDS_WRITE_SLICE 1
++static void write_slice(struct rpivid_dec_env *const de,
++			const struct rpivid_dec_state *const s,
++			const u32 slice_const,
++			const unsigned int ctb_col,
++			const unsigned int ctb_row)
++{
++	const unsigned int cs = (1 << s->log2_ctb_size);
++	const unsigned int w_last = s->sps.pic_width_in_luma_samples & (cs - 1);
++	const unsigned int h_last = s->sps.pic_height_in_luma_samples & (cs - 1);
++
++	p1_apb_write(de, RPI_SLICE,
++		     slice_const |
++		     ((ctb_col + 1 < s->ctb_width || !w_last ?
++				cs : w_last) << 17) |
++		     ((ctb_row + 1 < s->ctb_height || !h_last ?
++				cs : h_last) << 24));
++}
++
++#define PAUSE_MODE_WPP  1
++#define PAUSE_MODE_TILE 0xffff
++
++/*
++ * N.B. This can be called to fill in data from the previous slice so must not
++ * use any state data that may change from slice to slice (e.g. qp)
++ */
++#define CMDS_NEW_ENTRY_POINT (6 + CMDS_WRITE_SLICE)
++static void new_entry_point(struct rpivid_dec_env *const de,
++			    const struct rpivid_dec_state *const s,
++			    const bool do_bte,
++			    const bool reset_qp_y,
++			    const u32 pause_mode,
++			    const unsigned int tile_x,
++			    const unsigned int tile_y,
++			    const unsigned int ctb_col,
++			    const unsigned int ctb_row,
++			    const unsigned int slice_qp,
++			    const u32 slice_const)
++{
++	const unsigned int endx = s->col_bd[tile_x + 1] - 1;
++	const unsigned int endy = (pause_mode == PAUSE_MODE_WPP) ?
++		ctb_row : s->row_bd[tile_y + 1] - 1;
++
++	p1_apb_write(de, RPI_TILESTART,
++		     s->col_bd[tile_x] | (s->row_bd[tile_y] << 16));
++	p1_apb_write(de, RPI_TILEEND, endx | (endy << 16));
++
++	if (do_bte)
++		p1_apb_write(de, RPI_BEGINTILEEND, endx | (endy << 16));
++
++	write_slice(de, s, slice_const, endx, endy);
++
++	if (reset_qp_y) {
++		unsigned int sps_qp_bd_offset =
++			6 * s->sps.bit_depth_luma_minus8;
++
++		p1_apb_write(de, RPI_QP, sps_qp_bd_offset + slice_qp);
++	}
++
++	p1_apb_write(de, RPI_MODE,
++		     pause_mode |
++			((endx == s->ctb_width - 1) << 17) |
++			((endy == s->ctb_height - 1) << 18));
++
++	p1_apb_write(de, RPI_CONTROL, (ctb_col << 0) | (ctb_row << 16));
++
++	de->entry_tile_x = tile_x;
++	de->entry_tile_y = tile_y;
++	de->entry_ctb_x = ctb_col;
++	de->entry_ctb_y = ctb_row;
++	de->entry_qp = slice_qp;
++	de->entry_slice = slice_const;
++}
++
++//////////////////////////////////////////////////////////////////////////////
++// Wavefront mode
++
++#define CMDS_WPP_PAUSE 4
++static void wpp_pause(struct rpivid_dec_env *const de, int ctb_row)
++{
++	p1_apb_write(de, RPI_STATUS, (ctb_row << 18) | 0x25);
++	p1_apb_write(de, RPI_TRANSFER, PROB_BACKUP);
++	p1_apb_write(de, RPI_MODE,
++		     ctb_row == de->pic_height_in_ctbs_y - 1 ?
++							0x70000 : 0x30000);
++	p1_apb_write(de, RPI_CONTROL, (ctb_row << 16) + 2);
++}
++
++#define CMDS_WPP_ENTRY_FILL_1 (CMDS_WPP_PAUSE + 2 + CMDS_NEW_ENTRY_POINT)
++static int wpp_entry_fill(struct rpivid_dec_env *const de,
++			  const struct rpivid_dec_state *const s,
++			  const unsigned int last_y)
++{
++	int rv;
++	const unsigned int last_x = s->ctb_width - 1;
++
++	rv = cmds_check_space(de, CMDS_WPP_ENTRY_FILL_1 *
++				  (last_y - de->entry_ctb_y));
++	if (rv)
++		return rv;
++
++	while (de->entry_ctb_y < last_y) {
++		/* wpp_entry_x/y set by wpp_entry_point */
++		if (s->ctb_width > 2)
++			wpp_pause(de, de->entry_ctb_y);
++		p1_apb_write(de, RPI_STATUS,
++			     (de->entry_ctb_y << 18) | (last_x << 5) | 2);
++
++		/* if width == 1 then the saved state is the init one */
++		if (s->ctb_width == 2)
++			p1_apb_write(de, RPI_TRANSFER, PROB_BACKUP);
++		else
++			p1_apb_write(de, RPI_TRANSFER, PROB_RELOAD);
++
++		new_entry_point(de, s, false, true, PAUSE_MODE_WPP,
++				0, 0, 0, de->entry_ctb_y + 1,
++				de->entry_qp, de->entry_slice);
++	}
++	return 0;
++}
++
++static int wpp_end_previous_slice(struct rpivid_dec_env *const de,
++				  const struct rpivid_dec_state *const s)
++{
++	int rv;
++
++	rv = wpp_entry_fill(de, s, s->prev_ctb_y);
++	if (rv)
++		return rv;
++
++	rv = cmds_check_space(de, CMDS_WPP_PAUSE + 2);
++	if (rv)
++		return rv;
++
++	if (de->entry_ctb_x < 2 &&
++	    (de->entry_ctb_y < s->start_ctb_y || s->start_ctb_x > 2) &&
++	    s->ctb_width > 2)
++		wpp_pause(de, s->prev_ctb_y);
++	p1_apb_write(de, RPI_STATUS,
++		     1 | (s->prev_ctb_x << 5) | (s->prev_ctb_y << 18));
++	if (s->start_ctb_x == 2 ||
++	    (s->ctb_width == 2 && de->entry_ctb_y < s->start_ctb_y))
++		p1_apb_write(de, RPI_TRANSFER, PROB_BACKUP);
++	return 0;
++}
++
++/* Only main profile supported so WPP => !Tiles which makes some of the
++ * next chunk code simpler
++ */
++static int wpp_decode_slice(struct rpivid_dec_env *const de,
++			    const struct rpivid_dec_state *const s,
++			    bool last_slice)
++{
++	bool reset_qp_y = true;
++	const bool indep = !s->dependent_slice_segment_flag;
++	int rv;
++
++	if (s->start_ts) {
++		rv = wpp_end_previous_slice(de, s);
++		if (rv)
++			return rv;
++	}
++	pre_slice_decode(de, s);
++
++	rv = cmds_check_space(de,
++			      CMDS_WRITE_BITSTREAM +
++				CMDS_WRITE_PROB +
++				CMDS_PROGRAM_SLICECMDS +
++				CMDS_NEW_SLICE_SEGMENT +
++				CMDS_NEW_ENTRY_POINT);
++	if (rv)
++		return rv;
++
++	rv = write_bitstream(de, s);
++	if (rv)
++		return rv;
++
++	if (!s->start_ts || indep || s->ctb_width == 1)
++		write_prob(de, s);
++	else if (!s->start_ctb_x)
++		p1_apb_write(de, RPI_TRANSFER, PROB_RELOAD);
++	else
++		reset_qp_y = false;
++
++	program_slicecmds(de, s->slice_idx);
++	new_slice_segment(de, s);
++	new_entry_point(de, s, indep, reset_qp_y, PAUSE_MODE_WPP,
++			0, 0, s->start_ctb_x, s->start_ctb_y,
++			s->slice_qp, slice_reg_const(s));
++
++	if (last_slice) {
++		rv = wpp_entry_fill(de, s, s->ctb_height - 1);
++		if (rv)
++			return rv;
++
++		rv = cmds_check_space(de, CMDS_WPP_PAUSE + 1);
++		if (rv)
++			return rv;
++
++		if (de->entry_ctb_x < 2 && s->ctb_width > 2)
++			wpp_pause(de, s->ctb_height - 1);
++
++		p1_apb_write(de, RPI_STATUS,
++			     1 | ((s->ctb_width - 1) << 5) |
++				((s->ctb_height - 1) << 18));
++	}
++	return 0;
++}
++
++//////////////////////////////////////////////////////////////////////////////
++// Tiles mode
++
++// Guarantees 1 cmd entry free on exit
++static int tile_entry_fill(struct rpivid_dec_env *const de,
++			   const struct rpivid_dec_state *const s,
++			   const unsigned int last_tile_x,
++			   const unsigned int last_tile_y)
++{
++	while (de->entry_tile_y < last_tile_y ||
++	       (de->entry_tile_y == last_tile_y &&
++		de->entry_tile_x < last_tile_x)) {
++		int rv;
++		unsigned int t_x = de->entry_tile_x;
++		unsigned int t_y = de->entry_tile_y;
++		const unsigned int last_x = s->col_bd[t_x + 1] - 1;
++		const unsigned int last_y = s->row_bd[t_y + 1] - 1;
++
++		// One more than needed here
++		rv = cmds_check_space(de, CMDS_NEW_ENTRY_POINT + 3);
++		if (rv)
++			return rv;
++
++		p1_apb_write(de, RPI_STATUS,
++			     2 | (last_x << 5) | (last_y << 18));
++		p1_apb_write(de, RPI_TRANSFER, PROB_RELOAD);
++
++		// Inc tile
++		if (++t_x >= s->tile_width) {
++			t_x = 0;
++			++t_y;
++		}
++
++		new_entry_point(de, s, false, true, PAUSE_MODE_TILE,
++				t_x, t_y, s->col_bd[t_x], s->row_bd[t_y],
++				de->entry_qp, de->entry_slice);
++	}
++	return 0;
++}
++
++/*
++ * Write STATUS register with expected end CTU address of previous slice
++ */
++static int end_previous_slice(struct rpivid_dec_env *const de,
++			      const struct rpivid_dec_state *const s)
++{
++	int rv;
++
++	rv = tile_entry_fill(de, s,
++			     ctb_to_tile_x(s, s->prev_ctb_x),
++			     ctb_to_tile_y(s, s->prev_ctb_y));
++	if (rv)
++		return rv;
++
++	p1_apb_write(de, RPI_STATUS,
++		     1 | (s->prev_ctb_x << 5) | (s->prev_ctb_y << 18));
++	return 0;
++}
++
++static int decode_slice(struct rpivid_dec_env *const de,
++			const struct rpivid_dec_state *const s,
++			bool last_slice)
++{
++	bool reset_qp_y;
++	unsigned int tile_x = ctb_to_tile_x(s, s->start_ctb_x);
++	unsigned int tile_y = ctb_to_tile_y(s, s->start_ctb_y);
++	int rv;
++
++	if (s->start_ts) {
++		rv = end_previous_slice(de, s);
++		if (rv)
++			return rv;
++	}
++
++	rv = cmds_check_space(de,
++			      CMDS_WRITE_BITSTREAM +
++				CMDS_WRITE_PROB +
++				CMDS_PROGRAM_SLICECMDS +
++				CMDS_NEW_SLICE_SEGMENT +
++				CMDS_NEW_ENTRY_POINT);
++	if (rv)
++		return rv;
++
++	pre_slice_decode(de, s);
++	rv = write_bitstream(de, s);
++	if (rv)
++		return rv;
++
++	reset_qp_y = !s->start_ts ||
++		!s->dependent_slice_segment_flag ||
++		tile_x != ctb_to_tile_x(s, s->prev_ctb_x) ||
++		tile_y != ctb_to_tile_y(s, s->prev_ctb_y);
++	if (reset_qp_y)
++		write_prob(de, s);
++
++	program_slicecmds(de, s->slice_idx);
++	new_slice_segment(de, s);
++	new_entry_point(de, s, !s->dependent_slice_segment_flag, reset_qp_y,
++			PAUSE_MODE_TILE,
++			tile_x, tile_y, s->start_ctb_x, s->start_ctb_y,
++			s->slice_qp, slice_reg_const(s));
++
++	/*
++	 * If this is the last slice then fill in the other tile entries
++	 * now, otherwise this will be done at the start of the next slice
++	 * when it will be known where this slice finishes
++	 */
++	if (last_slice) {
++		rv = tile_entry_fill(de, s,
++				     s->tile_width - 1,
++				     s->tile_height - 1);
++		if (rv)
++			return rv;
++		p1_apb_write(de, RPI_STATUS,
++			     1 | ((s->ctb_width - 1) << 5) |
++				((s->ctb_height - 1) << 18));
++	}
++	return 0;
++}
++
++//////////////////////////////////////////////////////////////////////////////
++// Scaling factors
++
++static void expand_scaling_list(const unsigned int size_id,
++				u8 *const dst0,
++				const u8 *const src0, uint8_t dc)
++{
++	u8 *d;
++	unsigned int x, y;
++
++	switch (size_id) {
++	case 0:
++		memcpy(dst0, src0, 16);
++		break;
++	case 1:
++		memcpy(dst0, src0, 64);
++		break;
++	case 2:
++		d = dst0;
++
++		for (y = 0; y != 16; y++) {
++			const u8 *s = src0 + (y >> 1) * 8;
++
++			for (x = 0; x != 8; ++x) {
++				*d++ = *s;
++				*d++ = *s++;
++			}
++		}
++		dst0[0] = dc;
++		break;
++	default:
++		d = dst0;
++
++		for (y = 0; y != 32; y++) {
++			const u8 *s = src0 + (y >> 2) * 8;
++
++			for (x = 0; x != 8; ++x) {
++				*d++ = *s;
++				*d++ = *s;
++				*d++ = *s;
++				*d++ = *s++;
++			}
++		}
++		dst0[0] = dc;
++		break;
++	}
++}
++
++static void populate_scaling_factors(const struct rpivid_run *const run,
++				     struct rpivid_dec_env *const de,
++				     const struct rpivid_dec_state *const s)
++{
++	const struct v4l2_ctrl_hevc_scaling_matrix *const sl =
++		run->h265.scaling_matrix;
++	// Array of constants for scaling factors
++	static const u32 scaling_factor_offsets[4][6] = {
++		// MID0    MID1    MID2    MID3    MID4    MID5
++		// SID0 (4x4)
++		{ 0x0000, 0x0010, 0x0020, 0x0030, 0x0040, 0x0050 },
++		// SID1 (8x8)
++		{ 0x0060, 0x00A0, 0x00E0, 0x0120, 0x0160, 0x01A0 },
++		// SID2 (16x16)
++		{ 0x01E0, 0x02E0, 0x03E0, 0x04E0, 0x05E0, 0x06E0 },
++		// SID3 (32x32)
++		{ 0x07E0, 0x0BE0, 0x0000, 0x0000, 0x0000, 0x0000 }
++	};
++
++	unsigned int mid;
++
++	for (mid = 0; mid < 6; mid++)
++		expand_scaling_list(0, de->scaling_factors +
++					    scaling_factor_offsets[0][mid],
++				    sl->scaling_list_4x4[mid], 0);
++	for (mid = 0; mid < 6; mid++)
++		expand_scaling_list(1, de->scaling_factors +
++					    scaling_factor_offsets[1][mid],
++				    sl->scaling_list_8x8[mid], 0);
++	for (mid = 0; mid < 6; mid++)
++		expand_scaling_list(2, de->scaling_factors +
++					    scaling_factor_offsets[2][mid],
++				    sl->scaling_list_16x16[mid],
++				    sl->scaling_list_dc_coef_16x16[mid]);
++	for (mid = 0; mid < 2; mid++)
++		expand_scaling_list(3, de->scaling_factors +
++					    scaling_factor_offsets[3][mid],
++				    sl->scaling_list_32x32[mid],
++				    sl->scaling_list_dc_coef_32x32[mid]);
++}
++
++static void free_ps_info(struct rpivid_dec_state *const s)
++{
++	kfree(s->ctb_addr_rs_to_ts);
++	s->ctb_addr_rs_to_ts = NULL;
++	kfree(s->ctb_addr_ts_to_rs);
++	s->ctb_addr_ts_to_rs = NULL;
++
++	kfree(s->col_bd);
++	s->col_bd = NULL;
++	kfree(s->row_bd);
++	s->row_bd = NULL;
++}
++
++static unsigned int tile_width(const struct rpivid_dec_state *const s,
++			       const unsigned int t_x)
++{
++	return s->col_bd[t_x + 1] - s->col_bd[t_x];
++}
++
++static unsigned int tile_height(const struct rpivid_dec_state *const s,
++				const unsigned int t_y)
++{
++	return s->row_bd[t_y + 1] - s->row_bd[t_y];
++}
++
++static void fill_rs_to_ts(struct rpivid_dec_state *const s)
++{
++	unsigned int ts = 0;
++	unsigned int t_y;
++	unsigned int tr_rs = 0;
++
++	for (t_y = 0; t_y != s->tile_height; ++t_y) {
++		const unsigned int t_h = tile_height(s, t_y);
++		unsigned int t_x;
++		unsigned int tc_rs = tr_rs;
++
++		for (t_x = 0; t_x != s->tile_width; ++t_x) {
++			const unsigned int t_w = tile_width(s, t_x);
++			unsigned int y;
++			unsigned int rs = tc_rs;
++
++			for (y = 0; y != t_h; ++y) {
++				unsigned int x;
++
++				for (x = 0; x != t_w; ++x) {
++					s->ctb_addr_rs_to_ts[rs + x] = ts;
++					s->ctb_addr_ts_to_rs[ts] = rs + x;
++					++ts;
++				}
++				rs += s->ctb_width;
++			}
++			tc_rs += t_w;
++		}
++		tr_rs += t_h * s->ctb_width;
++	}
++}
++
++static int updated_ps(struct rpivid_dec_state *const s)
++{
++	unsigned int i;
++
++	free_ps_info(s);
++
++	// Inferred parameters
++	s->log2_ctb_size = s->sps.log2_min_luma_coding_block_size_minus3 + 3 +
++			   s->sps.log2_diff_max_min_luma_coding_block_size;
++
++	s->ctb_width = (s->sps.pic_width_in_luma_samples +
++			(1 << s->log2_ctb_size) - 1) >>
++		       s->log2_ctb_size;
++	s->ctb_height = (s->sps.pic_height_in_luma_samples +
++			 (1 << s->log2_ctb_size) - 1) >>
++			s->log2_ctb_size;
++	s->ctb_size = s->ctb_width * s->ctb_height;
++
++	// Inferred parameters
++
++	s->ctb_addr_rs_to_ts = kmalloc_array(s->ctb_size,
++					     sizeof(*s->ctb_addr_rs_to_ts),
++					     GFP_KERNEL);
++	if (!s->ctb_addr_rs_to_ts)
++		goto fail;
++	s->ctb_addr_ts_to_rs = kmalloc_array(s->ctb_size,
++					     sizeof(*s->ctb_addr_ts_to_rs),
++					     GFP_KERNEL);
++	if (!s->ctb_addr_ts_to_rs)
++		goto fail;
++
++	if (!(s->pps.flags & V4L2_HEVC_PPS_FLAG_TILES_ENABLED)) {
++		s->tile_width = 1;
++		s->tile_height = 1;
++	} else {
++		s->tile_width = s->pps.num_tile_columns_minus1 + 1;
++		s->tile_height = s->pps.num_tile_rows_minus1 + 1;
++	}
++
++	s->col_bd = kmalloc((s->tile_width + 1) * sizeof(*s->col_bd),
++			    GFP_KERNEL);
++	if (!s->col_bd)
++		goto fail;
++	s->row_bd = kmalloc((s->tile_height + 1) * sizeof(*s->row_bd),
++			    GFP_KERNEL);
++	if (!s->row_bd)
++		goto fail;
++
++	s->col_bd[0] = 0;
++	for (i = 1; i < s->tile_width; i++)
++		s->col_bd[i] = s->col_bd[i - 1] +
++			s->pps.column_width_minus1[i - 1] + 1;
++	s->col_bd[s->tile_width] = s->ctb_width;
++
++	s->row_bd[0] = 0;
++	for (i = 1; i < s->tile_height; i++)
++		s->row_bd[i] = s->row_bd[i - 1] +
++			s->pps.row_height_minus1[i - 1] + 1;
++	s->row_bd[s->tile_height] = s->ctb_height;
++
++	fill_rs_to_ts(s);
++	return 0;
++
++fail:
++	free_ps_info(s);
++	/* Set invalid to force reload */
++	s->sps.pic_width_in_luma_samples = 0;
++	return -ENOMEM;
++}
++
++static int write_cmd_buffer(struct rpivid_dev *const dev,
++			    struct rpivid_dec_env *const de,
++			    const struct rpivid_dec_state *const s)
++{
++	const size_t cmd_size = ALIGN(de->cmd_len * sizeof(de->cmd_fifo[0]),
++				      dev->cache_align);
++
++	de->cmd_addr = dma_map_single(dev->dev, de->cmd_fifo,
++				      cmd_size, DMA_TO_DEVICE);
++	if (dma_mapping_error(dev->dev, de->cmd_addr)) {
++		v4l2_err(&dev->v4l2_dev,
++			 "Map cmd buffer (%zu): FAILED\n", cmd_size);
++		return -ENOMEM;
++	}
++	de->cmd_size = cmd_size;
++	return 0;
++}
++
++static void setup_colmv(struct rpivid_ctx *const ctx, struct rpivid_run *run,
++			struct rpivid_dec_state *const s)
++{
++	ctx->colmv_stride = ALIGN(s->sps.pic_width_in_luma_samples, 64);
++	ctx->colmv_picsize = ctx->colmv_stride *
++		(ALIGN(s->sps.pic_height_in_luma_samples, 64) >> 4);
++}
++
++// Can be called from irq context
++static struct rpivid_dec_env *dec_env_new(struct rpivid_ctx *const ctx)
++{
++	struct rpivid_dec_env *de;
++	unsigned long lock_flags;
++
++	spin_lock_irqsave(&ctx->dec_lock, lock_flags);
++
++	de = ctx->dec_free;
++	if (de) {
++		ctx->dec_free = de->next;
++		de->next = NULL;
++		de->state = RPIVID_DECODE_SLICE_START;
++	}
++
++	spin_unlock_irqrestore(&ctx->dec_lock, lock_flags);
++	return de;
++}
++
++// Can be called from irq context
++static void dec_env_delete(struct rpivid_dec_env *const de)
++{
++	struct rpivid_ctx * const ctx = de->ctx;
++	unsigned long lock_flags;
++
++	if (de->cmd_size) {
++		dma_unmap_single(ctx->dev->dev, de->cmd_addr, de->cmd_size,
++				 DMA_TO_DEVICE);
++		de->cmd_size = 0;
++	}
++
++	aux_q_release(ctx, &de->frame_aux);
++	aux_q_release(ctx, &de->col_aux);
++
++	spin_lock_irqsave(&ctx->dec_lock, lock_flags);
++
++	de->state = RPIVID_DECODE_END;
++	de->next = ctx->dec_free;
++	ctx->dec_free = de;
++
++	spin_unlock_irqrestore(&ctx->dec_lock, lock_flags);
++}
++
++static void dec_env_uninit(struct rpivid_ctx *const ctx)
++{
++	unsigned int i;
++
++	if (ctx->dec_pool) {
++		for (i = 0; i != RPIVID_DEC_ENV_COUNT; ++i) {
++			struct rpivid_dec_env *const de = ctx->dec_pool + i;
++
++			kfree(de->cmd_fifo);
++		}
++
++		kfree(ctx->dec_pool);
++	}
++
++	ctx->dec_pool = NULL;
++	ctx->dec_free = NULL;
++}
++
++static int dec_env_init(struct rpivid_ctx *const ctx)
++{
++	unsigned int i;
++
++	ctx->dec_pool = kzalloc(sizeof(*ctx->dec_pool) * RPIVID_DEC_ENV_COUNT,
++				GFP_KERNEL);
++	if (!ctx->dec_pool)
++		return -1;
++
++	spin_lock_init(&ctx->dec_lock);
++
++	// Build free chain
++	ctx->dec_free = ctx->dec_pool;
++	for (i = 0; i != RPIVID_DEC_ENV_COUNT - 1; ++i)
++		ctx->dec_pool[i].next = ctx->dec_pool + i + 1;
++
++	// Fill in other bits
++	for (i = 0; i != RPIVID_DEC_ENV_COUNT; ++i) {
++		struct rpivid_dec_env *const de = ctx->dec_pool + i;
++
++		de->ctx = ctx;
++		de->decode_order = i;
++//		de->cmd_max = 1024;
++		de->cmd_max = 8096;
++		de->cmd_fifo = kmalloc_array(de->cmd_max,
++					     sizeof(struct rpi_cmd),
++					     GFP_KERNEL);
++		if (!de->cmd_fifo)
++			goto fail;
++	}
++
++	return 0;
++
++fail:
++	dec_env_uninit(ctx);
++	return -1;
++}
++
++// Assume that we get exactly the same DPB for every slice
++// it makes no real sense otherwise
++#if V4L2_HEVC_DPB_ENTRIES_NUM_MAX > 16
++#error HEVC_DPB_ENTRIES > h/w slots
++#endif
++
++static u32 mk_config2(const struct rpivid_dec_state *const s)
++{
++	const struct v4l2_ctrl_hevc_sps *const sps = &s->sps;
++	const struct v4l2_ctrl_hevc_pps *const pps = &s->pps;
++	u32 c;
++	// BitDepthY
++	c = (sps->bit_depth_luma_minus8 + 8) << 0;
++	 // BitDepthC
++	c |= (sps->bit_depth_chroma_minus8 + 8) << 4;
++	 // BitDepthY
++	if (sps->bit_depth_luma_minus8)
++		c |= BIT(8);
++	// BitDepthC
++	if (sps->bit_depth_chroma_minus8)
++		c |= BIT(9);
++	c |= s->log2_ctb_size << 10;
++	if (pps->flags & V4L2_HEVC_PPS_FLAG_CONSTRAINED_INTRA_PRED)
++		c |= BIT(13);
++	if (sps->flags & V4L2_HEVC_SPS_FLAG_STRONG_INTRA_SMOOTHING_ENABLED)
++		c |= BIT(14);
++	if (s->mk_aux)
++		c |= BIT(15); /* Write motion vectors to external memory */
++	c |= (pps->log2_parallel_merge_level_minus2 + 2) << 16;
++	if (s->slice_temporal_mvp)
++		c |= BIT(19);
++	if (sps->flags & V4L2_HEVC_SPS_FLAG_PCM_LOOP_FILTER_DISABLED)
++		c |= BIT(20);
++	c |= (pps->pps_cb_qp_offset & 31) << 21;
++	c |= (pps->pps_cr_qp_offset & 31) << 26;
++	return c;
++}
++
++static inline bool is_ref_unit_type(const unsigned int nal_unit_type)
++{
++	/* From Table 7-1
++	 * True for 1, 3, 5, 7, 9, 11, 13, 15
++	 */
++	return (nal_unit_type & ~0xe) != 0;
++}
++
++static void rpivid_h265_setup(struct rpivid_ctx *ctx, struct rpivid_run *run)
++{
++	struct rpivid_dev *const dev = ctx->dev;
++	const struct v4l2_ctrl_hevc_decode_params *const dec =
++						run->h265.dec;
++	/* sh0 used where slice header contents should be constant over all
++	 * slices, or first slice of frame
++	 */
++	const struct v4l2_ctrl_hevc_slice_params *const sh0 =
++					run->h265.slice_params;
++	struct rpivid_q_aux *dpb_q_aux[V4L2_HEVC_DPB_ENTRIES_NUM_MAX];
++	struct rpivid_dec_state *const s = ctx->state;
++	struct vb2_queue *vq;
++	struct rpivid_dec_env *de = ctx->dec0;
++	unsigned int prev_rs;
++	unsigned int i;
++	int rv;
++	bool slice_temporal_mvp;
++	bool frame_end;
++
++	xtrace_in(dev, de);
++	s->sh = NULL;  // Avoid use until in the slice loop
++
++	frame_end =
++		((run->src->flags & V4L2_BUF_FLAG_M2M_HOLD_CAPTURE_BUF) == 0);
++
++	slice_temporal_mvp = (sh0->flags &
++		   V4L2_HEVC_SLICE_PARAMS_FLAG_SLICE_TEMPORAL_MVP_ENABLED);
++
++	if (de && de->state != RPIVID_DECODE_END) {
++		switch (de->state) {
++		case RPIVID_DECODE_SLICE_CONTINUE:
++			// Expected state
++			break;
++		default:
++			v4l2_err(&dev->v4l2_dev, "%s: Unexpected state: %d\n",
++				 __func__, de->state);
++			fallthrough;
++		case RPIVID_DECODE_ERROR_CONTINUE:
++			// Uncleared error - fail now
++			goto fail;
++		}
++
++		if (s->slice_temporal_mvp != slice_temporal_mvp) {
++			v4l2_warn(&dev->v4l2_dev,
++				  "Slice Temporal MVP non-constant\n");
++			goto fail;
++		}
++	} else {
++		/* Frame start */
++		unsigned int ctb_size_y;
++		bool sps_changed = false;
++
++		if (!is_sps_set(run->h265.sps)) {
++			v4l2_warn(&dev->v4l2_dev, "SPS never set\n");
++			goto fail;
++		}
++		// Can't check for PPS easily as all 0's looks valid to me
++
++		if (memcmp(&s->sps, run->h265.sps, sizeof(s->sps)) != 0) {
++			/* SPS changed */
++			v4l2_info(&dev->v4l2_dev, "SPS changed\n");
++			memcpy(&s->sps, run->h265.sps, sizeof(s->sps));
++			sps_changed = true;
++		}
++		if (sps_changed ||
++		    memcmp(&s->pps, run->h265.pps, sizeof(s->pps)) != 0) {
++			/* SPS changed */
++			v4l2_info(&dev->v4l2_dev, "PPS changed\n");
++			memcpy(&s->pps, run->h265.pps, sizeof(s->pps));
++
++			/* Recalc stuff as required */
++			rv = updated_ps(s);
++			if (rv)
++				goto fail;
++		}
++
++		de = dec_env_new(ctx);
++		if (!de) {
++			v4l2_err(&dev->v4l2_dev,
++				 "Failed to find free decode env\n");
++			goto fail;
++		}
++		ctx->dec0 = de;
++
++		ctb_size_y =
++			1U << (s->sps.log2_min_luma_coding_block_size_minus3 +
++			       3 +
++			       s->sps.log2_diff_max_min_luma_coding_block_size);
++
++		de->pic_width_in_ctbs_y =
++			(s->sps.pic_width_in_luma_samples + ctb_size_y - 1) /
++				ctb_size_y; // 7-15
++		de->pic_height_in_ctbs_y =
++			(s->sps.pic_height_in_luma_samples + ctb_size_y - 1) /
++				ctb_size_y; // 7-17
++		de->cmd_len = 0;
++		de->dpbno_col = ~0U;
++
++		de->bit_copy_gptr = ctx->bitbufs + ctx->p1idx;
++		de->bit_copy_len = 0;
++
++		de->frame_c_offset = ctx->dst_fmt.height * 128;
++		de->frame_stride = ctx->dst_fmt.plane_fmt[0].bytesperline * 128;
++		de->frame_addr =
++			vb2_dma_contig_plane_dma_addr(&run->dst->vb2_buf, 0);
++		de->frame_aux = NULL;
++
++		if (s->sps.bit_depth_luma_minus8 !=
++		    s->sps.bit_depth_chroma_minus8) {
++			v4l2_warn(&dev->v4l2_dev,
++				  "Chroma depth (%d) != Luma depth (%d)\n",
++				  s->sps.bit_depth_chroma_minus8 + 8,
++				  s->sps.bit_depth_luma_minus8 + 8);
++			goto fail;
++		}
++		if (s->sps.bit_depth_luma_minus8 == 0) {
++			if (ctx->dst_fmt.pixelformat !=
++						V4L2_PIX_FMT_NV12_COL128) {
++				v4l2_err(&dev->v4l2_dev,
++					 "Pixel format %#x != NV12_COL128 for 8-bit output",
++					 ctx->dst_fmt.pixelformat);
++				goto fail;
++			}
++		} else if (s->sps.bit_depth_luma_minus8 == 2) {
++			if (ctx->dst_fmt.pixelformat !=
++						V4L2_PIX_FMT_NV12_10_COL128) {
++				v4l2_err(&dev->v4l2_dev,
++					 "Pixel format %#x != NV12_10_COL128 for 10-bit output",
++					 ctx->dst_fmt.pixelformat);
++				goto fail;
++			}
++		} else {
++			v4l2_warn(&dev->v4l2_dev,
++				  "Luma depth (%d) unsupported\n",
++				  s->sps.bit_depth_luma_minus8 + 8);
++			goto fail;
++		}
++		if (run->dst->vb2_buf.num_planes != 1) {
++			v4l2_warn(&dev->v4l2_dev, "Capture planes (%d) != 1\n",
++				  run->dst->vb2_buf.num_planes);
++			goto fail;
++		}
++		if (run->dst->planes[0].length <
++		    ctx->dst_fmt.plane_fmt[0].sizeimage) {
++			v4l2_warn(&dev->v4l2_dev,
++				  "Capture plane[0] length (%d) < sizeimage (%d)\n",
++				  run->dst->planes[0].length,
++				  ctx->dst_fmt.plane_fmt[0].sizeimage);
++			goto fail;
++		}
++
++		// Fill in ref planes with our address s.t. if we mess
++		// up refs somehow then we still have a valid address
++		// entry
++		for (i = 0; i != 16; ++i)
++			de->ref_addrs[i] = de->frame_addr;
++
++		/*
++		 * Stash initial temporal_mvp flag
++		 * This must be the same for all pic slices (7.4.7.1)
++		 */
++		s->slice_temporal_mvp = slice_temporal_mvp;
++
++		/*
++		 * Need Aux ents for all (ref) DPB ents if temporal MV could
++		 * be enabled for any pic
++		 */
++		s->use_aux = ((s->sps.flags &
++			       V4L2_HEVC_SPS_FLAG_SPS_TEMPORAL_MVP_ENABLED) != 0);
++		s->mk_aux = s->use_aux &&
++			    (s->sps.sps_max_sub_layers_minus1 >= sh0->nuh_temporal_id_plus1 ||
++			     is_ref_unit_type(sh0->nal_unit_type));
++
++		// Phase 2 reg pre-calc
++		de->rpi_config2 = mk_config2(s);
++		de->rpi_framesize = (s->sps.pic_height_in_luma_samples << 16) |
++				    s->sps.pic_width_in_luma_samples;
++		de->rpi_currpoc = sh0->slice_pic_order_cnt;
++
++		if (s->sps.flags &
++		    V4L2_HEVC_SPS_FLAG_SPS_TEMPORAL_MVP_ENABLED) {
++			setup_colmv(ctx, run, s);
++		}
++
++		s->slice_idx = 0;
++
++		if (sh0->slice_segment_addr != 0) {
++			v4l2_warn(&dev->v4l2_dev,
++				  "New frame but segment_addr=%d\n",
++				  sh0->slice_segment_addr);
++			goto fail;
++		}
++
++		/* Allocate a bitbuf if we need one - don't need one if single
++		 * slice as we can use the src buf directly
++		 */
++		if (!frame_end && !de->bit_copy_gptr->ptr) {
++			size_t bits_alloc;
++			bits_alloc = rpivid_bit_buf_size(s->sps.pic_width_in_luma_samples,
++							 s->sps.pic_height_in_luma_samples,
++							 s->sps.bit_depth_luma_minus8);
++
++			if (gptr_alloc(dev, de->bit_copy_gptr,
++				       bits_alloc,
++				       DMA_ATTR_FORCE_CONTIGUOUS) != 0) {
++				v4l2_err(&dev->v4l2_dev,
++					 "Unable to alloc buf (%zu) for bit copy\n",
++					 bits_alloc);
++				goto fail;
++			}
++			v4l2_info(&dev->v4l2_dev,
++				  "Alloc buf (%zu) for bit copy OK\n",
++				  bits_alloc);
++		}
++	}
++
++	// Either map src buffer or use directly
++	s->src_addr = 0;
++	s->src_buf = NULL;
++
++	if (frame_end)
++		s->src_addr = vb2_dma_contig_plane_dma_addr(&run->src->vb2_buf,
++							    0);
++	if (!s->src_addr)
++		s->src_buf = vb2_plane_vaddr(&run->src->vb2_buf, 0);
++	if (!s->src_addr && !s->src_buf) {
++		v4l2_err(&dev->v4l2_dev, "Failed to map src buffer\n");
++		goto fail;
++	}
++
++	// Pre calc a few things
++	s->dec = dec;
++	for (i = 0; i != run->h265.slice_ents; ++i) {
++		const struct v4l2_ctrl_hevc_slice_params *const sh = sh0 + i;
++		const bool last_slice = frame_end && i + 1 == run->h265.slice_ents;
++
++		s->sh = sh;
++
++		if (run->src->planes[0].bytesused < (sh->bit_size + 7) / 8) {
++			v4l2_warn(&dev->v4l2_dev,
++				  "Bit size %d > bytesused %d\n",
++				  sh->bit_size, run->src->planes[0].bytesused);
++			goto fail;
++		}
++		if (sh->data_byte_offset >= sh->bit_size / 8) {
++			v4l2_warn(&dev->v4l2_dev,
++				  "Bit size %u < Byte offset %u * 8\n",
++				  sh->bit_size, sh->data_byte_offset);
++			goto fail;
++		}
++
++		s->slice_qp = 26 + s->pps.init_qp_minus26 + sh->slice_qp_delta;
++		s->max_num_merge_cand = sh->slice_type == HEVC_SLICE_I ?
++						0 :
++						(5 - sh->five_minus_max_num_merge_cand);
++		s->dependent_slice_segment_flag =
++			((sh->flags &
++			  V4L2_HEVC_SLICE_PARAMS_FLAG_DEPENDENT_SLICE_SEGMENT) != 0);
++
++		s->nb_refs[0] = (sh->slice_type == HEVC_SLICE_I) ?
++					0 :
++					sh->num_ref_idx_l0_active_minus1 + 1;
++		s->nb_refs[1] = (sh->slice_type != HEVC_SLICE_B) ?
++					0 :
++					sh->num_ref_idx_l1_active_minus1 + 1;
++
++		if (s->sps.flags & V4L2_HEVC_SPS_FLAG_SCALING_LIST_ENABLED)
++			populate_scaling_factors(run, de, s);
++
++		/* Calc all the random coord info to avoid repeated conversion in/out */
++		s->start_ts = s->ctb_addr_rs_to_ts[sh->slice_segment_addr];
++		s->start_ctb_x = sh->slice_segment_addr % de->pic_width_in_ctbs_y;
++		s->start_ctb_y = sh->slice_segment_addr / de->pic_width_in_ctbs_y;
++		/* Last CTB of previous slice */
++		prev_rs = !s->start_ts ? 0 : s->ctb_addr_ts_to_rs[s->start_ts - 1];
++		s->prev_ctb_x = prev_rs % de->pic_width_in_ctbs_y;
++		s->prev_ctb_y = prev_rs / de->pic_width_in_ctbs_y;
++
++		if ((s->pps.flags & V4L2_HEVC_PPS_FLAG_ENTROPY_CODING_SYNC_ENABLED))
++			rv = wpp_decode_slice(de, s, last_slice);
++		else
++			rv = decode_slice(de, s, last_slice);
++		if (rv)
++			goto fail;
++
++		++s->slice_idx;
++	}
++
++	if (!frame_end) {
++		xtrace_ok(dev, de);
++		return;
++	}
++
++	// Frame end
++	memset(dpb_q_aux, 0,
++	       sizeof(*dpb_q_aux) * V4L2_HEVC_DPB_ENTRIES_NUM_MAX);
++
++	// Locate ref frames
++	// At least in the current implementation this is constant across all
++	// slices. If this changes we will need idx mapping code.
++	// Uses sh so here rather than trigger
++
++	vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx,
++			     V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
++
++	if (!vq) {
++		v4l2_err(&dev->v4l2_dev, "VQ gone!\n");
++		goto fail;
++	}
++
++	//        v4l2_info(&dev->v4l2_dev, "rpivid_h265_end of frame\n");
++	if (write_cmd_buffer(dev, de, s))
++		goto fail;
++
++	for (i = 0; i < dec->num_active_dpb_entries; ++i) {
++		struct vb2_buffer *buf = vb2_find_buffer(vq, dec->dpb[i].timestamp);
++		if (!buf) {
++			v4l2_warn(&dev->v4l2_dev,
++				  "Missing DPB ent %d, timestamp=%lld\n",
++				  i, (long long)dec->dpb[i].timestamp);
++			continue;
++		}
++
++		if (s->use_aux) {
++			int buffer_index = buf->index;
++			dpb_q_aux[i] = aux_q_ref_idx(ctx, buffer_index);
++			if (!dpb_q_aux[i])
++				v4l2_warn(&dev->v4l2_dev,
++					  "Missing DPB AUX ent %d, timestamp=%lld, index=%d\n",
++					  i, (long long)dec->dpb[i].timestamp,
++					  buffer_index);
++		}
++
++		de->ref_addrs[i] =
++			vb2_dma_contig_plane_dma_addr(buf, 0);
++	}
++
++	// Move DPB from temp
++	for (i = 0; i != V4L2_HEVC_DPB_ENTRIES_NUM_MAX; ++i) {
++		aux_q_release(ctx, &s->ref_aux[i]);
++		s->ref_aux[i] = dpb_q_aux[i];
++	}
++	// Unref the old frame aux too - it is either in the DPB or not
++	// now
++	aux_q_release(ctx, &s->frame_aux);
++
++	if (s->mk_aux) {
++		s->frame_aux = aux_q_new(ctx, run->dst->vb2_buf.index);
++
++		if (!s->frame_aux) {
++			v4l2_err(&dev->v4l2_dev,
++				 "Failed to obtain aux storage for frame\n");
++			goto fail;
++		}
++
++		de->frame_aux = aux_q_ref(ctx, s->frame_aux);
++	}
++
++	if (de->dpbno_col != ~0U) {
++		if (de->dpbno_col >= dec->num_active_dpb_entries) {
++			v4l2_err(&dev->v4l2_dev,
++				 "Col ref index %d >= %d\n",
++				 de->dpbno_col,
++				 dec->num_active_dpb_entries);
++		} else {
++			// Standard requires that the col pic is
++			// constant for the duration of the pic
++			// (text of collocated_ref_idx in H265-2 2018
++			// 7.4.7.1)
++
++			// Spot the collocated ref in passing
++			de->col_aux = aux_q_ref(ctx,
++						dpb_q_aux[de->dpbno_col]);
++
++			if (!de->col_aux) {
++				v4l2_warn(&dev->v4l2_dev,
++					  "Missing DPB ent for col\n");
++				// Probably need to abort if this fails
++				// as P2 may explode on bad data
++				goto fail;
++			}
++		}
++	}
++
++	de->state = RPIVID_DECODE_PHASE1;
++	xtrace_ok(dev, de);
++	return;
++
++fail:
++	if (de)
++		// Actual error reporting happens in Trigger
++		de->state = frame_end ? RPIVID_DECODE_ERROR_DONE :
++					RPIVID_DECODE_ERROR_CONTINUE;
++	xtrace_fail(dev, de);
++}
++
++//////////////////////////////////////////////////////////////////////////////
++// Handle PU and COEFF stream overflow
++
++// Returns:
++// -1  Phase 1 decode error
++//  0  OK
++// >0  Out of space (bitmask)
++
++#define STATUS_COEFF_EXHAUSTED	8
++#define STATUS_PU_EXHAUSTED	16
++
++static int check_status(const struct rpivid_dev *const dev)
++{
++	const u32 cfstatus = apb_read(dev, RPI_CFSTATUS);
++	const u32 cfnum = apb_read(dev, RPI_CFNUM);
++	u32 status = apb_read(dev, RPI_STATUS);
++
++	// Handle PU and COEFF stream overflow
++
++	// this is the definition of successful completion of phase 1
++	// it assures that status register is zero and all blocks in each tile
++	// have completed
++	if (cfstatus == cfnum)
++		return 0;	//No error
++
++	status &= (STATUS_PU_EXHAUSTED | STATUS_COEFF_EXHAUSTED);
++	if (status)
++		return status;
++
++	return -1;
++}
++
++static void phase2_cb(struct rpivid_dev *const dev, void *v)
++{
++	struct rpivid_dec_env *const de = v;
++
++	xtrace_in(dev, de);
++
++	/* Done with buffers - allow new P1 */
++	rpivid_hw_irq_active1_enable_claim(dev, 1);
++
++	v4l2_m2m_buf_done(de->frame_buf, VB2_BUF_STATE_DONE);
++	de->frame_buf = NULL;
++
++#if USE_REQUEST_PIN
++	media_request_unpin(de->req_pin);
++	de->req_pin = NULL;
++#else
++	media_request_object_complete(de->req_obj);
++	de->req_obj = NULL;
++#endif
++
++	xtrace_ok(dev, de);
++	dec_env_delete(de);
++}
++
++static void phase2_claimed(struct rpivid_dev *const dev, void *v)
++{
++	struct rpivid_dec_env *const de = v;
++	unsigned int i;
++
++	xtrace_in(dev, de);
++
++	apb_write_vc_addr(dev, RPI_PURBASE, de->pu_base_vc);
++	apb_write_vc_len(dev, RPI_PURSTRIDE, de->pu_stride);
++	apb_write_vc_addr(dev, RPI_COEFFRBASE, de->coeff_base_vc);
++	apb_write_vc_len(dev, RPI_COEFFRSTRIDE, de->coeff_stride);
++
++	apb_write_vc_addr(dev, RPI_OUTYBASE, de->frame_addr);
++	apb_write_vc_addr(dev, RPI_OUTCBASE,
++			  de->frame_addr + de->frame_c_offset);
++	apb_write_vc_len(dev, RPI_OUTYSTRIDE, de->frame_stride);
++	apb_write_vc_len(dev, RPI_OUTCSTRIDE, de->frame_stride);
++
++	//    v4l2_info(&dev->v4l2_dev, "Frame: Y=%llx, C=%llx, Stride=%x\n",
++	//              de->frame_addr, de->frame_addr + de->frame_c_offset,
++	//              de->frame_stride);
++
++	for (i = 0; i < 16; i++) {
++		// Strides are in fact unused but fill in anyway
++		apb_write_vc_addr(dev, 0x9000 + 16 * i, de->ref_addrs[i]);
++		apb_write_vc_len(dev, 0x9004 + 16 * i, de->frame_stride);
++		apb_write_vc_addr(dev, 0x9008 + 16 * i,
++				  de->ref_addrs[i] + de->frame_c_offset);
++		apb_write_vc_len(dev, 0x900C + 16 * i, de->frame_stride);
++	}
++
++	apb_write(dev, RPI_CONFIG2, de->rpi_config2);
++	apb_write(dev, RPI_FRAMESIZE, de->rpi_framesize);
++	apb_write(dev, RPI_CURRPOC, de->rpi_currpoc);
++	//    v4l2_info(&dev->v4l2_dev, "Config2=%#x, FrameSize=%#x, POC=%#x\n",
++	//    de->rpi_config2, de->rpi_framesize, de->rpi_currpoc);
++
++	// collocated reads/writes
++	apb_write_vc_len(dev, RPI_COLSTRIDE,
++			 de->ctx->colmv_stride); // Read vals
++	apb_write_vc_len(dev, RPI_MVSTRIDE,
++			 de->ctx->colmv_stride); // Write vals
++	apb_write_vc_addr(dev, RPI_MVBASE,
++			  !de->frame_aux ? 0 : de->frame_aux->col.addr);
++	apb_write_vc_addr(dev, RPI_COLBASE,
++			  !de->col_aux ? 0 : de->col_aux->col.addr);
++
++	//v4l2_info(&dev->v4l2_dev,
++	//	   "Mv=%llx, Col=%llx, Stride=%x, Buf=%llx->%llx\n",
++	//	   de->rpi_mvbase, de->rpi_colbase, de->ctx->colmv_stride,
++	//	   de->ctx->colmvbuf.addr, de->ctx->colmvbuf.addr +
++	//	   de->ctx->colmvbuf.size);
++
++	rpivid_hw_irq_active2_irq(dev, &de->irq_ent, phase2_cb, de);
++
++	apb_write_final(dev, RPI_NUMROWS, de->pic_height_in_ctbs_y);
++
++	xtrace_ok(dev, de);
++}
++
++static void phase1_claimed(struct rpivid_dev *const dev, void *v);
++
++// release any and all objects associated with de
++// and reenable phase 1 if required
++static void phase1_err_fin(struct rpivid_dev *const dev,
++			   struct rpivid_ctx *const ctx,
++			   struct rpivid_dec_env *const de)
++{
++	/* Return all detached buffers */
++	if (de->src_buf)
++		v4l2_m2m_buf_done(de->src_buf, VB2_BUF_STATE_ERROR);
++	de->src_buf = NULL;
++	if (de->frame_buf)
++		v4l2_m2m_buf_done(de->frame_buf, VB2_BUF_STATE_ERROR);
++	de->frame_buf = NULL;
++#if USE_REQUEST_PIN
++	if (de->req_pin)
++		media_request_unpin(de->req_pin);
++	de->req_pin = NULL;
++#else
++	if (de->req_obj)
++		media_request_object_complete(de->req_obj);
++	de->req_obj = NULL;
++#endif
++
++	dec_env_delete(de);
++
++	/* Reenable phase 0 if we were blocking */
++	if (atomic_add_return(-1, &ctx->p1out) >= RPIVID_P1BUF_COUNT - 1)
++		v4l2_m2m_job_finish(dev->m2m_dev, ctx->fh.m2m_ctx);
++
++	/* Done with P1-P2 buffers - allow new P1 */
++	rpivid_hw_irq_active1_enable_claim(dev, 1);
++}
++
++static void phase1_thread(struct rpivid_dev *const dev, void *v)
++{
++	struct rpivid_dec_env *const de = v;
++	struct rpivid_ctx *const ctx = de->ctx;
++
++	struct rpivid_gptr *const pu_gptr = ctx->pu_bufs + ctx->p2idx;
++	struct rpivid_gptr *const coeff_gptr = ctx->coeff_bufs + ctx->p2idx;
++
++	xtrace_in(dev, de);
++
++	if (de->p1_status & STATUS_PU_EXHAUSTED) {
++		if (gptr_realloc_new(dev, pu_gptr, next_size(pu_gptr->size))) {
++			v4l2_err(&dev->v4l2_dev,
++				 "%s: PU realloc (%zx) failed\n",
++				 __func__, pu_gptr->size);
++			goto fail;
++		}
++		v4l2_info(&dev->v4l2_dev, "%s: PU realloc (%zx) OK\n",
++			  __func__, pu_gptr->size);
++	}
++
++	if (de->p1_status & STATUS_COEFF_EXHAUSTED) {
++		if (gptr_realloc_new(dev, coeff_gptr,
++				     next_size(coeff_gptr->size))) {
++			v4l2_err(&dev->v4l2_dev,
++				 "%s: Coeff realloc (%zx) failed\n",
++				 __func__, coeff_gptr->size);
++			goto fail;
++		}
++		v4l2_info(&dev->v4l2_dev, "%s: Coeff realloc (%zx) OK\n",
++			  __func__, coeff_gptr->size);
++	}
++
++	phase1_claimed(dev, de);
++	xtrace_ok(dev, de);
++	return;
++
++fail:
++	if (!pu_gptr->addr || !coeff_gptr->addr) {
++		v4l2_err(&dev->v4l2_dev,
++			 "%s: Fatal: failed to reclaim old alloc\n",
++			 __func__);
++		ctx->fatal_err = 1;
++	}
++	xtrace_fail(dev, de);
++	phase1_err_fin(dev, ctx, de);
++}
++
++/* Always called in irq context (this is good) */
++static void phase1_cb(struct rpivid_dev *const dev, void *v)
++{
++	struct rpivid_dec_env *const de = v;
++	struct rpivid_ctx *const ctx = de->ctx;
++
++	xtrace_in(dev, de);
++
++	de->p1_status = check_status(dev);
++
++	if (de->p1_status != 0) {
++		v4l2_info(&dev->v4l2_dev, "%s: Post wait: %#x\n",
++			  __func__, de->p1_status);
++
++		if (de->p1_status < 0)
++			goto fail;
++
++		/* Need to realloc - push onto a thread rather than IRQ */
++		rpivid_hw_irq_active1_thread(dev, &de->irq_ent,
++					     phase1_thread, de);
++		return;
++	}
++
++	v4l2_m2m_buf_done(de->src_buf, VB2_BUF_STATE_DONE);
++	de->src_buf = NULL;
++
++	/* All phase1 error paths done - it is safe to inc p2idx */
++	ctx->p2idx =
++		(ctx->p2idx + 1 >= RPIVID_P2BUF_COUNT) ? 0 : ctx->p2idx + 1;
++
++	/* Renable the next setup if we were blocking */
++	if (atomic_add_return(-1, &ctx->p1out) >= RPIVID_P1BUF_COUNT - 1) {
++		xtrace_fin(dev, de);
++		v4l2_m2m_job_finish(dev->m2m_dev, ctx->fh.m2m_ctx);
++	}
++
++	rpivid_hw_irq_active2_claim(dev, &de->irq_ent, phase2_claimed, de);
++
++	xtrace_ok(dev, de);
++	return;
++
++fail:
++	xtrace_fail(dev, de);
++	phase1_err_fin(dev, ctx, de);
++}
++
++static void phase1_claimed(struct rpivid_dev *const dev, void *v)
++{
++	struct rpivid_dec_env *const de = v;
++	struct rpivid_ctx *const ctx = de->ctx;
++
++	const struct rpivid_gptr * const pu_gptr = ctx->pu_bufs + ctx->p2idx;
++	const struct rpivid_gptr * const coeff_gptr = ctx->coeff_bufs +
++						      ctx->p2idx;
++
++	xtrace_in(dev, de);
++
++	if (ctx->fatal_err)
++		goto fail;
++
++	de->pu_base_vc = pu_gptr->addr;
++	de->pu_stride =
++		ALIGN_DOWN(pu_gptr->size / de->pic_height_in_ctbs_y, 64);
++
++	de->coeff_base_vc = coeff_gptr->addr;
++	de->coeff_stride =
++		ALIGN_DOWN(coeff_gptr->size / de->pic_height_in_ctbs_y, 64);
++
++	/* phase1_claimed blocked until cb_phase1 completed so p2idx inc
++	 * in cb_phase1 after error detection
++	 */
++
++	apb_write_vc_addr(dev, RPI_PUWBASE, de->pu_base_vc);
++	apb_write_vc_len(dev, RPI_PUWSTRIDE, de->pu_stride);
++	apb_write_vc_addr(dev, RPI_COEFFWBASE, de->coeff_base_vc);
++	apb_write_vc_len(dev, RPI_COEFFWSTRIDE, de->coeff_stride);
++
++	// Trigger command FIFO
++	apb_write(dev, RPI_CFNUM, de->cmd_len);
++
++	// Claim irq
++	rpivid_hw_irq_active1_irq(dev, &de->irq_ent, phase1_cb, de);
++
++	// And start the h/w
++	apb_write_vc_addr_final(dev, RPI_CFBASE, de->cmd_addr);
++
++	xtrace_ok(dev, de);
++	return;
++
++fail:
++	xtrace_fail(dev, de);
++	phase1_err_fin(dev, ctx, de);
++}
++
++static void dec_state_delete(struct rpivid_ctx *const ctx)
++{
++	unsigned int i;
++	struct rpivid_dec_state *const s = ctx->state;
++
++	if (!s)
++		return;
++	ctx->state = NULL;
++
++	free_ps_info(s);
++
++	for (i = 0; i != HEVC_MAX_REFS; ++i)
++		aux_q_release(ctx, &s->ref_aux[i]);
++	aux_q_release(ctx, &s->frame_aux);
++
++	kfree(s);
++}
++
++struct irq_sync {
++	atomic_t done;
++	wait_queue_head_t wq;
++	struct rpivid_hw_irq_ent irq_ent;
++};
++
++static void phase2_sync_claimed(struct rpivid_dev *const dev, void *v)
++{
++	struct irq_sync *const sync = v;
++
++	atomic_set(&sync->done, 1);
++	wake_up(&sync->wq);
++}
++
++static void phase1_sync_claimed(struct rpivid_dev *const dev, void *v)
++{
++	struct irq_sync *const sync = v;
++
++	rpivid_hw_irq_active1_enable_claim(dev, 1);
++	rpivid_hw_irq_active2_claim(dev, &sync->irq_ent, phase2_sync_claimed, sync);
++}
++
++/* Sync with IRQ operations
++ *
++ * Claims phase1 and phase2 in turn and waits for the phase2 claim so any
++ * pending IRQ ops will have completed by the time this returns
++ *
++ * phase1 has counted enables so must reenable once claimed
++ * phase2 has unlimited enables
++ */
++static void irq_sync(struct rpivid_dev *const dev)
++{
++	struct irq_sync sync;
++
++	atomic_set(&sync.done, 0);
++	init_waitqueue_head(&sync.wq);
++
++	rpivid_hw_irq_active1_claim(dev, &sync.irq_ent, phase1_sync_claimed, &sync);
++	wait_event(sync.wq, atomic_read(&sync.done));
++}
++
++static void h265_ctx_uninit(struct rpivid_dev *const dev, struct rpivid_ctx *ctx)
++{
++	unsigned int i;
++
++	dec_env_uninit(ctx);
++	dec_state_delete(ctx);
++
++	// dec_env & state must be killed before this to release the buffer to
++	// the free pool
++	aux_q_uninit(ctx);
++
++	for (i = 0; i != ARRAY_SIZE(ctx->bitbufs); ++i)
++		gptr_free(dev, ctx->bitbufs + i);
++	for (i = 0; i != ARRAY_SIZE(ctx->pu_bufs); ++i)
++		gptr_free(dev, ctx->pu_bufs + i);
++	for (i = 0; i != ARRAY_SIZE(ctx->coeff_bufs); ++i)
++		gptr_free(dev, ctx->coeff_bufs + i);
++}
++
++static void rpivid_h265_stop(struct rpivid_ctx *ctx)
++{
++	struct rpivid_dev *const dev = ctx->dev;
++
++	v4l2_info(&dev->v4l2_dev, "%s\n", __func__);
++
++	irq_sync(dev);
++	h265_ctx_uninit(dev, ctx);
++}
++
++static int rpivid_h265_start(struct rpivid_ctx *ctx)
++{
++	struct rpivid_dev *const dev = ctx->dev;
++	unsigned int i;
++
++	unsigned int w = ctx->dst_fmt.width;
++	unsigned int h = ctx->dst_fmt.height;
++	unsigned int wxh;
++	size_t pu_alloc;
++	size_t coeff_alloc;
++
++#if DEBUG_TRACE_P1_CMD
++	p1_z = 0;
++#endif
++
++	// Generate a sanitised WxH for memory alloc
++	// Assume HD if unset
++	if (w == 0)
++		w = 1920;
++	if (w > 4096)
++		w = 4096;
++	if (h == 0)
++		h = 1088;
++	if (h > 4096)
++		h = 4096;
++	wxh = w * h;
++
++	v4l2_info(&dev->v4l2_dev, "%s: (%dx%d)\n", __func__,
++		  ctx->dst_fmt.width, ctx->dst_fmt.height);
++
++	ctx->fatal_err = 0;
++	ctx->dec0 = NULL;
++	ctx->state = kzalloc(sizeof(*ctx->state), GFP_KERNEL);
++	if (!ctx->state) {
++		v4l2_err(&dev->v4l2_dev, "Failed to allocate decode state\n");
++		goto fail;
++	}
++
++	if (dec_env_init(ctx) != 0) {
++		v4l2_err(&dev->v4l2_dev, "Failed to allocate decode envs\n");
++		goto fail;
++	}
++
++	// Finger in the air PU & Coeff alloc
++	// Will be realloced if too small
++	coeff_alloc = rpivid_round_up_size(wxh);
++	pu_alloc = rpivid_round_up_size(wxh / 4);
++	for (i = 0; i != ARRAY_SIZE(ctx->pu_bufs); ++i) {
++		// Don't actually need a kernel mapping here
++		if (gptr_alloc(dev, ctx->pu_bufs + i, pu_alloc,
++			       DMA_ATTR_NO_KERNEL_MAPPING)) {
++			v4l2_err(&dev->v4l2_dev,
++				 "Failed to alloc %#zx PU%d buffer\n",
++				 pu_alloc, i);
++			goto fail;
++		}
++		if (gptr_alloc(dev, ctx->coeff_bufs + i, coeff_alloc,
++			       DMA_ATTR_NO_KERNEL_MAPPING)) {
++			v4l2_err(&dev->v4l2_dev,
++				 "Failed to alloc %#zx Coeff%d buffer\n",
++				 pu_alloc, i);
++			goto fail;
++		}
++	}
++	aux_q_init(ctx);
++
++	return 0;
++
++fail:
++	h265_ctx_uninit(dev, ctx);
++	return -ENOMEM;
++}
++
++static void rpivid_h265_trigger(struct rpivid_ctx *ctx)
++{
++	struct rpivid_dev *const dev = ctx->dev;
++	struct rpivid_dec_env *const de = ctx->dec0;
++
++	xtrace_in(dev, de);
++
++	switch (!de ? RPIVID_DECODE_ERROR_CONTINUE : de->state) {
++	case RPIVID_DECODE_SLICE_START:
++		de->state = RPIVID_DECODE_SLICE_CONTINUE;
++		fallthrough;
++	case RPIVID_DECODE_SLICE_CONTINUE:
++		v4l2_m2m_buf_done_and_job_finish(dev->m2m_dev, ctx->fh.m2m_ctx,
++						 VB2_BUF_STATE_DONE);
++		xtrace_ok(dev, de);
++		break;
++
++	default:
++		v4l2_err(&dev->v4l2_dev, "%s: Unexpected state: %d\n", __func__,
++			 de->state);
++		fallthrough;
++	case RPIVID_DECODE_ERROR_DONE:
++		ctx->dec0 = NULL;
++		dec_env_delete(de);
++		fallthrough;
++	case RPIVID_DECODE_ERROR_CONTINUE:
++		xtrace_fin(dev, de);
++		v4l2_m2m_buf_done_and_job_finish(dev->m2m_dev, ctx->fh.m2m_ctx,
++						 VB2_BUF_STATE_ERROR);
++		break;
++
++	case RPIVID_DECODE_PHASE1:
++		ctx->dec0 = NULL;
++
++#if !USE_REQUEST_PIN
++		/* Alloc a new request object - needs to be alloced dynamically
++		 * as the media request will release it some random time after
++		 * it is completed
++		 */
++		de->req_obj = kmalloc(sizeof(*de->req_obj), GFP_KERNEL);
++		if (!de->req_obj) {
++			xtrace_fail(dev, de);
++			dec_env_delete(de);
++			v4l2_m2m_buf_done_and_job_finish(dev->m2m_dev,
++							 ctx->fh.m2m_ctx,
++							 VB2_BUF_STATE_ERROR);
++			break;
++		}
++		media_request_object_init(de->req_obj);
++#warning probably needs to _get the req obj too
++#endif
++		ctx->p1idx = (ctx->p1idx + 1 >= RPIVID_P1BUF_COUNT) ?
++							0 : ctx->p1idx + 1;
++
++		/* We know we have src & dst so no need to test */
++		de->src_buf = v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
++		de->frame_buf = v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
++
++#if USE_REQUEST_PIN
++		de->req_pin = de->src_buf->vb2_buf.req_obj.req;
++		media_request_pin(de->req_pin);
++#else
++		media_request_object_bind(de->src_buf->vb2_buf.req_obj.req,
++					  &dst_req_obj_ops, de, false,
++					  de->req_obj);
++#endif
++
++		/* We could get rid of the src buffer here if we've already
++		 * copied it, but we don't copy the last buffer unless it
++		 * didn't return a contig dma addr and that shouldn't happen
++		 */
++
++		/* Enable the next setup if our Q isn't too big */
++		if (atomic_add_return(1, &ctx->p1out) < RPIVID_P1BUF_COUNT) {
++			xtrace_fin(dev, de);
++			v4l2_m2m_job_finish(dev->m2m_dev, ctx->fh.m2m_ctx);
++		}
++
++		rpivid_hw_irq_active1_claim(dev, &de->irq_ent, phase1_claimed,
++					    de);
++		xtrace_ok(dev, de);
++		break;
++	}
++}
++
++const struct rpivid_dec_ops rpivid_dec_ops_h265 = {
++	.setup = rpivid_h265_setup,
++	.start = rpivid_h265_start,
++	.stop = rpivid_h265_stop,
++	.trigger = rpivid_h265_trigger,
++};
++
++static int try_ctrl_sps(struct v4l2_ctrl *ctrl)
++{
++	const struct v4l2_ctrl_hevc_sps *const sps = ctrl->p_new.p_hevc_sps;
++	struct rpivid_ctx *const ctx = ctrl->priv;
++	struct rpivid_dev *const dev = ctx->dev;
++
++	if (sps->chroma_format_idc != 1) {
++		v4l2_warn(&dev->v4l2_dev,
++			  "Chroma format (%d) unsupported\n",
++			  sps->chroma_format_idc);
++		return -EINVAL;
++	}
++
++	if (sps->bit_depth_luma_minus8 != 0 &&
++	    sps->bit_depth_luma_minus8 != 2) {
++		v4l2_warn(&dev->v4l2_dev,
++			  "Luma depth (%d) unsupported\n",
++			  sps->bit_depth_luma_minus8 + 8);
++		return -EINVAL;
++	}
++
++	if (sps->bit_depth_luma_minus8 != sps->bit_depth_chroma_minus8) {
++		v4l2_warn(&dev->v4l2_dev,
++			  "Chroma depth (%d) != Luma depth (%d)\n",
++			  sps->bit_depth_chroma_minus8 + 8,
++			  sps->bit_depth_luma_minus8 + 8);
++		return -EINVAL;
++	}
++
++	if (!sps->pic_width_in_luma_samples ||
++	    !sps->pic_height_in_luma_samples ||
++	    sps->pic_width_in_luma_samples > 4096 ||
++	    sps->pic_height_in_luma_samples > 4096) {
++		v4l2_warn(&dev->v4l2_dev,
++			  "Bad sps width (%u) x height (%u)\n",
++			  sps->pic_width_in_luma_samples,
++			  sps->pic_height_in_luma_samples);
++		return -EINVAL;
++	}
++
++	if (!ctx->dst_fmt_set)
++		return 0;
++
++	if ((sps->bit_depth_luma_minus8 == 0 &&
++	     ctx->dst_fmt.pixelformat != V4L2_PIX_FMT_NV12_COL128) ||
++	    (sps->bit_depth_luma_minus8 == 2 &&
++	     ctx->dst_fmt.pixelformat != V4L2_PIX_FMT_NV12_10_COL128)) {
++		v4l2_warn(&dev->v4l2_dev,
++			  "SPS luma depth %d does not match capture format\n",
++			  sps->bit_depth_luma_minus8 + 8);
++		return -EINVAL;
++	}
++
++	if (sps->pic_width_in_luma_samples > ctx->dst_fmt.width ||
++	    sps->pic_height_in_luma_samples > ctx->dst_fmt.height) {
++		v4l2_warn(&dev->v4l2_dev,
++			  "SPS size (%dx%d) > capture size (%d,%d)\n",
++			  sps->pic_width_in_luma_samples,
++			  sps->pic_height_in_luma_samples,
++			  ctx->dst_fmt.width,
++			  ctx->dst_fmt.height);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++const struct v4l2_ctrl_ops rpivid_hevc_sps_ctrl_ops = {
++	.try_ctrl = try_ctrl_sps,
++};
++
++static int try_ctrl_pps(struct v4l2_ctrl *ctrl)
++{
++	const struct v4l2_ctrl_hevc_pps *const pps = ctrl->p_new.p_hevc_pps;
++	struct rpivid_ctx *const ctx = ctrl->priv;
++	struct rpivid_dev *const dev = ctx->dev;
++
++	if ((pps->flags &
++	     V4L2_HEVC_PPS_FLAG_ENTROPY_CODING_SYNC_ENABLED) &&
++	    (pps->flags &
++	     V4L2_HEVC_PPS_FLAG_TILES_ENABLED) &&
++	    (pps->num_tile_columns_minus1 || pps->num_tile_rows_minus1)) {
++		v4l2_warn(&dev->v4l2_dev,
++			  "WPP + Tiles not supported\n");
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++const struct v4l2_ctrl_ops rpivid_hevc_pps_ctrl_ops = {
++	.try_ctrl = try_ctrl_pps,
++};
++
+--- /dev/null
++++ b/drivers/staging/media/rpivid/rpivid_hw.c
+@@ -0,0 +1,383 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Raspberry Pi HEVC driver
++ *
++ * Copyright (C) 2020 Raspberry Pi (Trading) Ltd
++ *
++ * Based on the Cedrus VPU driver, that is:
++ *
++ * Copyright (C) 2016 Florent Revest <florent.revest@free-electrons.com>
++ * Copyright (C) 2018 Paul Kocialkowski <paul.kocialkowski@bootlin.com>
++ * Copyright (C) 2018 Bootlin
++ */
++#include <linux/clk.h>
++#include <linux/component.h>
++#include <linux/dma-mapping.h>
++#include <linux/interrupt.h>
++#include <linux/io.h>
++#include <linux/of_reserved_mem.h>
++#include <linux/of_device.h>
++#include <linux/of_platform.h>
++#include <linux/platform_device.h>
++#include <linux/regmap.h>
++#include <linux/reset.h>
++
++#include <media/videobuf2-core.h>
++#include <media/v4l2-mem2mem.h>
++
++#include <soc/bcm2835/raspberrypi-firmware.h>
++
++#include "rpivid.h"
++#include "rpivid_hw.h"
++
++static void pre_irq(struct rpivid_dev *dev, struct rpivid_hw_irq_ent *ient,
++		    rpivid_irq_callback cb, void *v,
++		    struct rpivid_hw_irq_ctrl *ictl)
++{
++	unsigned long flags;
++
++	if (ictl->irq) {
++		v4l2_err(&dev->v4l2_dev, "Attempt to claim IRQ when already claimed\n");
++		return;
++	}
++
++	ient->cb = cb;
++	ient->v = v;
++
++	spin_lock_irqsave(&ictl->lock, flags);
++	ictl->irq = ient;
++	ictl->no_sched++;
++	spin_unlock_irqrestore(&ictl->lock, flags);
++}
++
++/* Should be called from inside ictl->lock */
++static inline bool sched_enabled(const struct rpivid_hw_irq_ctrl * const ictl)
++{
++	return ictl->no_sched <= 0 && ictl->enable;
++}
++
++/* Should be called from inside ictl->lock & after checking sched_enabled() */
++static inline void set_claimed(struct rpivid_hw_irq_ctrl * const ictl)
++{
++	if (ictl->enable > 0)
++		--ictl->enable;
++	ictl->no_sched = 1;
++}
++
++/* Should be called from inside ictl->lock */
++static struct rpivid_hw_irq_ent *get_sched(struct rpivid_hw_irq_ctrl * const ictl)
++{
++	struct rpivid_hw_irq_ent *ient;
++
++	if (!sched_enabled(ictl))
++		return NULL;
++
++	ient = ictl->claim;
++	if (!ient)
++		return NULL;
++	ictl->claim = ient->next;
++
++	set_claimed(ictl);
++	return ient;
++}
++
++/* Run a callback & check to see if there is anything else to run */
++static void sched_cb(struct rpivid_dev * const dev,
++		     struct rpivid_hw_irq_ctrl * const ictl,
++		     struct rpivid_hw_irq_ent *ient)
++{
++	while (ient) {
++		unsigned long flags;
++
++		ient->cb(dev, ient->v);
++
++		spin_lock_irqsave(&ictl->lock, flags);
++
++		/* Always dec no_sched after cb exec - must have been set
++		 * on entry to cb
++		 */
++		--ictl->no_sched;
++		ient = get_sched(ictl);
++
++		spin_unlock_irqrestore(&ictl->lock, flags);
++	}
++}
++
++/* Should only ever be called from its own IRQ cb so no lock required */
++static void pre_thread(struct rpivid_dev *dev,
++		       struct rpivid_hw_irq_ent *ient,
++		       rpivid_irq_callback cb, void *v,
++		       struct rpivid_hw_irq_ctrl *ictl)
++{
++	ient->cb = cb;
++	ient->v = v;
++	ictl->irq = ient;
++	ictl->thread_reqed = true;
++	ictl->no_sched++;	/* This is unwound in do_thread */
++}
++
++// Called in irq context
++static void do_irq(struct rpivid_dev * const dev,
++		   struct rpivid_hw_irq_ctrl * const ictl)
++{
++	struct rpivid_hw_irq_ent *ient;
++	unsigned long flags;
++
++	spin_lock_irqsave(&ictl->lock, flags);
++	ient = ictl->irq;
++	ictl->irq = NULL;
++	spin_unlock_irqrestore(&ictl->lock, flags);
++
++	sched_cb(dev, ictl, ient);
++}
++
++static void do_claim(struct rpivid_dev * const dev,
++		     struct rpivid_hw_irq_ent *ient,
++		     const rpivid_irq_callback cb, void * const v,
++		     struct rpivid_hw_irq_ctrl * const ictl)
++{
++	unsigned long flags;
++
++	ient->next = NULL;
++	ient->cb = cb;
++	ient->v = v;
++
++	spin_lock_irqsave(&ictl->lock, flags);
++
++	if (ictl->claim) {
++		// If we have a Q then add to end
++		ictl->tail->next = ient;
++		ictl->tail = ient;
++		ient = NULL;
++	} else if (!sched_enabled(ictl)) {
++		// Empty Q but other activity in progress so Q
++		ictl->claim = ient;
++		ictl->tail = ient;
++		ient = NULL;
++	} else {
++		// Nothing else going on - schedule immediately and
++		// prevent anything else scheduling claims
++		set_claimed(ictl);
++	}
++
++	spin_unlock_irqrestore(&ictl->lock, flags);
++
++	sched_cb(dev, ictl, ient);
++}
++
++/* Enable n claims.
++ * n < 0   set to unlimited (default on init)
++ * n = 0   if previously unlimited then disable otherwise nop
++ * n > 0   if previously unlimited then set to n enables
++ *         otherwise add n enables
++ * The enable count is automatically decremented every time a claim is run
++ */
++static void do_enable_claim(struct rpivid_dev * const dev,
++			    int n,
++			    struct rpivid_hw_irq_ctrl * const ictl)
++{
++	unsigned long flags;
++	struct rpivid_hw_irq_ent *ient;
++
++	spin_lock_irqsave(&ictl->lock, flags);
++	ictl->enable = n < 0 ? -1 : ictl->enable <= 0 ? n : ictl->enable + n;
++	ient = get_sched(ictl);
++	spin_unlock_irqrestore(&ictl->lock, flags);
++
++	sched_cb(dev, ictl, ient);
++}
++
++static void ictl_init(struct rpivid_hw_irq_ctrl * const ictl, int enables)
++{
++	spin_lock_init(&ictl->lock);
++	ictl->claim = NULL;
++	ictl->tail = NULL;
++	ictl->irq = NULL;
++	ictl->no_sched = 0;
++	ictl->enable = enables;
++	ictl->thread_reqed = false;
++}
++
++static void ictl_uninit(struct rpivid_hw_irq_ctrl * const ictl)
++{
++	// Nothing to do
++}
++
++#if !OPT_DEBUG_POLL_IRQ
++static irqreturn_t rpivid_irq_irq(int irq, void *data)
++{
++	struct rpivid_dev * const dev = data;
++	__u32 ictrl;
++
++	ictrl = irq_read(dev, ARG_IC_ICTRL);
++	if (!(ictrl & ARG_IC_ICTRL_ALL_IRQ_MASK)) {
++		v4l2_warn(&dev->v4l2_dev, "IRQ but no IRQ bits set\n");
++		return IRQ_NONE;
++	}
++
++	// Cancel any/all irqs
++	irq_write(dev, ARG_IC_ICTRL, ictrl & ~ARG_IC_ICTRL_SET_ZERO_MASK);
++
++	// Service Active2 before Active1 so Phase 1 can transition to Phase 2
++	// without delay
++	if (ictrl & ARG_IC_ICTRL_ACTIVE2_INT_SET)
++		do_irq(dev, &dev->ic_active2);
++	if (ictrl & ARG_IC_ICTRL_ACTIVE1_INT_SET)
++		do_irq(dev, &dev->ic_active1);
++
++	return dev->ic_active1.thread_reqed || dev->ic_active2.thread_reqed ?
++		IRQ_WAKE_THREAD : IRQ_HANDLED;
++}
++
++static void do_thread(struct rpivid_dev * const dev,
++		      struct rpivid_hw_irq_ctrl *const ictl)
++{
++	unsigned long flags;
++	struct rpivid_hw_irq_ent *ient = NULL;
++
++	spin_lock_irqsave(&ictl->lock, flags);
++
++	if (ictl->thread_reqed) {
++		ient = ictl->irq;
++		ictl->thread_reqed = false;
++		ictl->irq = NULL;
++	}
++
++	spin_unlock_irqrestore(&ictl->lock, flags);
++
++	sched_cb(dev, ictl, ient);
++}
++
++static irqreturn_t rpivid_irq_thread(int irq, void *data)
++{
++	struct rpivid_dev * const dev = data;
++
++	do_thread(dev, &dev->ic_active1);
++	do_thread(dev, &dev->ic_active2);
++
++	return IRQ_HANDLED;
++}
++#endif
++
++/* May only be called from Active1 CB
++ * IRQs should not be expected until execution continues in the cb
++ */
++void rpivid_hw_irq_active1_thread(struct rpivid_dev *dev,
++				  struct rpivid_hw_irq_ent *ient,
++				  rpivid_irq_callback thread_cb, void *ctx)
++{
++	pre_thread(dev, ient, thread_cb, ctx, &dev->ic_active1);
++}
++
++void rpivid_hw_irq_active1_enable_claim(struct rpivid_dev *dev,
++					int n)
++{
++	do_enable_claim(dev, n, &dev->ic_active1);
++}
++
++void rpivid_hw_irq_active1_claim(struct rpivid_dev *dev,
++				 struct rpivid_hw_irq_ent *ient,
++				 rpivid_irq_callback ready_cb, void *ctx)
++{
++	do_claim(dev, ient, ready_cb, ctx, &dev->ic_active1);
++}
++
++void rpivid_hw_irq_active1_irq(struct rpivid_dev *dev,
++			       struct rpivid_hw_irq_ent *ient,
++			       rpivid_irq_callback irq_cb, void *ctx)
++{
++	pre_irq(dev, ient, irq_cb, ctx, &dev->ic_active1);
++}
++
++void rpivid_hw_irq_active2_claim(struct rpivid_dev *dev,
++				 struct rpivid_hw_irq_ent *ient,
++				 rpivid_irq_callback ready_cb, void *ctx)
++{
++	do_claim(dev, ient, ready_cb, ctx, &dev->ic_active2);
++}
++
++void rpivid_hw_irq_active2_irq(struct rpivid_dev *dev,
++			       struct rpivid_hw_irq_ent *ient,
++			       rpivid_irq_callback irq_cb, void *ctx)
++{
++	pre_irq(dev, ient, irq_cb, ctx, &dev->ic_active2);
++}
++
++int rpivid_hw_probe(struct rpivid_dev *dev)
++{
++	struct rpi_firmware *firmware;
++	struct device_node *node;
++	struct resource *res;
++	__u32 irq_stat;
++	int irq_dec;
++	int ret = 0;
++
++	ictl_init(&dev->ic_active1, RPIVID_P2BUF_COUNT);
++	ictl_init(&dev->ic_active2, RPIVID_ICTL_ENABLE_UNLIMITED);
++
++	res = platform_get_resource_byname(dev->pdev, IORESOURCE_MEM, "intc");
++	if (!res)
++		return -ENODEV;
++
++	dev->base_irq = devm_ioremap(dev->dev, res->start, resource_size(res));
++	if (IS_ERR(dev->base_irq))
++		return PTR_ERR(dev->base_irq);
++
++	res = platform_get_resource_byname(dev->pdev, IORESOURCE_MEM, "hevc");
++	if (!res)
++		return -ENODEV;
++
++	dev->base_h265 = devm_ioremap(dev->dev, res->start, resource_size(res));
++	if (IS_ERR(dev->base_h265))
++		return PTR_ERR(dev->base_h265);
++
++	dev->clock = devm_clk_get(&dev->pdev->dev, "hevc");
++	if (IS_ERR(dev->clock))
++		return PTR_ERR(dev->clock);
++
++	node = rpi_firmware_find_node();
++	if (!node)
++		return -EINVAL;
++
++	firmware = rpi_firmware_get(node);
++	of_node_put(node);
++	if (!firmware)
++		return -EPROBE_DEFER;
++
++	dev->max_clock_rate = rpi_firmware_clk_get_max_rate(firmware,
++							    RPI_FIRMWARE_HEVC_CLK_ID);
++	rpi_firmware_put(firmware);
++
++	dev->cache_align = dma_get_cache_alignment();
++
++	// Disable IRQs & reset anything pending
++	irq_write(dev, 0,
++		  ARG_IC_ICTRL_ACTIVE1_EN_SET | ARG_IC_ICTRL_ACTIVE2_EN_SET);
++	irq_stat = irq_read(dev, 0);
++	irq_write(dev, 0, irq_stat);
++
++#if !OPT_DEBUG_POLL_IRQ
++	irq_dec = platform_get_irq(dev->pdev, 0);
++	if (irq_dec <= 0)
++		return irq_dec;
++	ret = devm_request_threaded_irq(dev->dev, irq_dec,
++					rpivid_irq_irq,
++					rpivid_irq_thread,
++					0, dev_name(dev->dev), dev);
++	if (ret) {
++		dev_err(dev->dev, "Failed to request IRQ - %d\n", ret);
++
++		return ret;
++	}
++#endif
++	return ret;
++}
++
++void rpivid_hw_remove(struct rpivid_dev *dev)
++{
++	// IRQ auto freed on unload so no need to do it here
++	// ioremap auto freed on unload
++	ictl_uninit(&dev->ic_active1);
++	ictl_uninit(&dev->ic_active2);
++}
++
+--- /dev/null
++++ b/drivers/staging/media/rpivid/rpivid_hw.h
+@@ -0,0 +1,303 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * Raspberry Pi HEVC driver
++ *
++ * Copyright (C) 2020 Raspberry Pi (Trading) Ltd
++ *
++ * Based on the Cedrus VPU driver, that is:
++ *
++ * Copyright (C) 2016 Florent Revest <florent.revest@free-electrons.com>
++ * Copyright (C) 2018 Paul Kocialkowski <paul.kocialkowski@bootlin.com>
++ * Copyright (C) 2018 Bootlin
++ */
++
++#ifndef _RPIVID_HW_H_
++#define _RPIVID_HW_H_
++
++struct rpivid_hw_irq_ent {
++	struct rpivid_hw_irq_ent *next;
++	rpivid_irq_callback cb;
++	void *v;
++};
++
++/* Phase 1 Register offsets */
++
++#define RPI_SPS0 0
++#define RPI_SPS1 4
++#define RPI_PPS 8
++#define RPI_SLICE 12
++#define RPI_TILESTART 16
++#define RPI_TILEEND 20
++#define RPI_SLICESTART 24
++#define RPI_MODE 28
++#define RPI_LEFT0 32
++#define RPI_LEFT1 36
++#define RPI_LEFT2 40
++#define RPI_LEFT3 44
++#define RPI_QP 48
++#define RPI_CONTROL 52
++#define RPI_STATUS 56
++#define RPI_VERSION 60
++#define RPI_BFBASE 64
++#define RPI_BFNUM 68
++#define RPI_BFCONTROL 72
++#define RPI_BFSTATUS 76
++#define RPI_PUWBASE 80
++#define RPI_PUWSTRIDE 84
++#define RPI_COEFFWBASE 88
++#define RPI_COEFFWSTRIDE 92
++#define RPI_SLICECMDS 96
++#define RPI_BEGINTILEEND 100
++#define RPI_TRANSFER 104
++#define RPI_CFBASE 108
++#define RPI_CFNUM 112
++#define RPI_CFSTATUS 116
++
++/* Phase 2 Register offsets */
++
++#define RPI_PURBASE 0x8000
++#define RPI_PURSTRIDE 0x8004
++#define RPI_COEFFRBASE 0x8008
++#define RPI_COEFFRSTRIDE 0x800C
++#define RPI_NUMROWS 0x8010
++#define RPI_CONFIG2 0x8014
++#define RPI_OUTYBASE 0x8018
++#define RPI_OUTYSTRIDE 0x801C
++#define RPI_OUTCBASE 0x8020
++#define RPI_OUTCSTRIDE 0x8024
++#define RPI_STATUS2 0x8028
++#define RPI_FRAMESIZE 0x802C
++#define RPI_MVBASE 0x8030
++#define RPI_MVSTRIDE 0x8034
++#define RPI_COLBASE 0x8038
++#define RPI_COLSTRIDE 0x803C
++#define RPI_CURRPOC 0x8040
++
++/*
++ * Write a general register value
++ * Order is unimportant
++ */
++static inline void apb_write(const struct rpivid_dev * const dev,
++			     const unsigned int offset, const u32 val)
++{
++	writel_relaxed(val, dev->base_h265 + offset);
++}
++
++/* Write the final register value that actually starts the phase */
++static inline void apb_write_final(const struct rpivid_dev * const dev,
++				   const unsigned int offset, const u32 val)
++{
++	writel(val, dev->base_h265 + offset);
++}
++
++static inline u32 apb_read(const struct rpivid_dev * const dev,
++			   const unsigned int offset)
++{
++	return readl(dev->base_h265 + offset);
++}
++
++static inline void irq_write(const struct rpivid_dev * const dev,
++			     const unsigned int offset, const u32 val)
++{
++	writel(val, dev->base_irq + offset);
++}
++
++static inline u32 irq_read(const struct rpivid_dev * const dev,
++			   const unsigned int offset)
++{
++	return readl(dev->base_irq + offset);
++}
++
++static inline void apb_write_vc_addr(const struct rpivid_dev * const dev,
++				     const unsigned int offset,
++				     const dma_addr_t a)
++{
++	apb_write(dev, offset, (u32)(a >> 6));
++}
++
++static inline void apb_write_vc_addr_final(const struct rpivid_dev * const dev,
++					   const unsigned int offset,
++					   const dma_addr_t a)
++{
++	apb_write_final(dev, offset, (u32)(a >> 6));
++}
++
++static inline void apb_write_vc_len(const struct rpivid_dev * const dev,
++				    const unsigned int offset,
++				    const unsigned int x)
++{
++	apb_write(dev, offset, (x + 63) >> 6);
++}
++
++/* *ARG_IC_ICTRL - Interrupt control for ARGON Core*
++ * Offset (byte space) = 40'h2b10000
++ * Physical Address (byte space) = 40'h7eb10000
++ * Verilog Macro Address = `ARG_IC_REG_START + `ARGON_INTCTRL_ICTRL
++ * Reset Value = 32'b100x100x_100xxxxx_xxxxxxx0_x100x100
++ * Access = RW (32-bit only)
++ * Interrupt control logic for ARGON Core.
++ */
++#define ARG_IC_ICTRL 0
++
++/* acc=LWC ACTIVE1_INT FIELD ACCESS: LWC
++ *
++ * Interrupt 1
++ * This is set and held when an hevc_active1 interrupt edge is detected
++ * The polarity of the edge is set by the ACTIVE1_EDGE field
++ * Write a 1 to this bit to clear down the latched interrupt
++ * The latched interrupt is only enabled out onto the interrupt line if
++ * ACTIVE1_EN is set
++ * Reset value is *0* decimal.
++ */
++#define ARG_IC_ICTRL_ACTIVE1_INT_SET		BIT(0)
++
++/* ACTIVE1_EDGE Sets the polarity of the interrupt edge detection logic
++ * This logic detects edges of the hevc_active1 line from the argon core
++ * 0 = negedge, 1 = posedge
++ * Reset value is *0* decimal.
++ */
++#define ARG_IC_ICTRL_ACTIVE1_EDGE_SET		BIT(1)
++
++/* ACTIVE1_EN Enables ACTIVE1_INT out onto the argon interrupt line.
++ * If this isn't set, the interrupt logic will work but no interrupt will be
++ * set to the interrupt controller
++ * Reset value is *1* decimal.
++ *
++ * [JC] The above appears to be a lie - if unset then b0 is never set
++ */
++#define ARG_IC_ICTRL_ACTIVE1_EN_SET		BIT(2)
++
++/* acc=RO ACTIVE1_STATUS FIELD ACCESS: RO
++ *
++ * The current status of the hevc_active1 signal
++ */
++#define ARG_IC_ICTRL_ACTIVE1_STATUS_SET		BIT(3)
++
++/* acc=LWC ACTIVE2_INT FIELD ACCESS: LWC
++ *
++ * Interrupt 2
++ * This is set and held when an hevc_active2 interrupt edge is detected
++ * The polarity of the edge is set by the ACTIVE2_EDGE field
++ * Write a 1 to this bit to clear down the latched interrupt
++ * The latched interrupt is only enabled out onto the interrupt line if
++ * ACTIVE2_EN is set
++ * Reset value is *0* decimal.
++ */
++#define ARG_IC_ICTRL_ACTIVE2_INT_SET		BIT(4)
++
++/* ACTIVE2_EDGE Sets the polarity of the interrupt edge detection logic
++ * This logic detects edges of the hevc_active2 line from the argon core
++ * 0 = negedge, 1 = posedge
++ * Reset value is *0* decimal.
++ */
++#define ARG_IC_ICTRL_ACTIVE2_EDGE_SET		BIT(5)
++
++/* ACTIVE2_EN Enables ACTIVE2_INT out onto the argon interrupt line.
++ * If this isn't set, the interrupt logic will work but no interrupt will be
++ * set to the interrupt controller
++ * Reset value is *1* decimal.
++ */
++#define ARG_IC_ICTRL_ACTIVE2_EN_SET		BIT(6)
++
++/* acc=RO ACTIVE2_STATUS FIELD ACCESS: RO
++ *
++ * The current status of the hevc_active2 signal
++ */
++#define ARG_IC_ICTRL_ACTIVE2_STATUS_SET		BIT(7)
++
++/* TEST_INT Forces the argon int high for test purposes.
++ * Reset value is *0* decimal.
++ */
++#define ARG_IC_ICTRL_TEST_INT			BIT(8)
++#define ARG_IC_ICTRL_SPARE			BIT(9)
++
++/* acc=RO VP9_INTERRUPT_STATUS FIELD ACCESS: RO
++ *
++ * The current status of the vp9_interrupt signal
++ */
++#define ARG_IC_ICTRL_VP9_INTERRUPT_STATUS	BIT(10)
++
++/* AIO_INT_ENABLE 1 = Or the AIO int in with the Argon int so the VPU can see
++ * it
++ * 0 = the AIO int is masked. (It should still be connected to the GIC though).
++ */
++#define ARG_IC_ICTRL_AIO_INT_ENABLE		BIT(20)
++#define ARG_IC_ICTRL_H264_ACTIVE_INT		BIT(21)
++#define ARG_IC_ICTRL_H264_ACTIVE_EDGE		BIT(22)
++#define ARG_IC_ICTRL_H264_ACTIVE_EN		BIT(23)
++#define ARG_IC_ICTRL_H264_ACTIVE_STATUS		BIT(24)
++#define ARG_IC_ICTRL_H264_INTERRUPT_INT		BIT(25)
++#define ARG_IC_ICTRL_H264_INTERRUPT_EDGE	BIT(26)
++#define ARG_IC_ICTRL_H264_INTERRUPT_EN		BIT(27)
++
++/* acc=RO H264_INTERRUPT_STATUS FIELD ACCESS: RO
++ *
++ * The current status of the h264_interrupt signal
++ */
++#define ARG_IC_ICTRL_H264_INTERRUPT_STATUS	BIT(28)
++
++/* acc=LWC VP9_INTERRUPT_INT FIELD ACCESS: LWC
++ *
++ * Interrupt 1
++ * This is set and held when an vp9_interrupt interrupt edge is detected
++ * The polarity of the edge is set by the VP9_INTERRUPT_EDGE field
++ * Write a 1 to this bit to clear down the latched interrupt
++ * The latched interrupt is only enabled out onto the interrupt line if
++ * VP9_INTERRUPT_EN is set
++ * Reset value is *0* decimal.
++ */
++#define ARG_IC_ICTRL_VP9_INTERRUPT_INT		BIT(29)
++
++/* VP9_INTERRUPT_EDGE Sets the polarity of the interrupt edge detection logic
++ * This logic detects edges of the vp9_interrupt line from the argon h264 core
++ * 0 = negedge, 1 = posedge
++ * Reset value is *0* decimal.
++ */
++#define ARG_IC_ICTRL_VP9_INTERRUPT_EDGE		BIT(30)
++
++/* VP9_INTERRUPT_EN Enables VP9_INTERRUPT_INT out onto the argon interrupt line.
++ * If this isn't set, the interrupt logic will work but no interrupt will be
++ * set to the interrupt controller
++ * Reset value is *1* decimal.
++ */
++#define ARG_IC_ICTRL_VP9_INTERRUPT_EN		BIT(31)
++
++/* Bits 19:12, 11 reserved - read ?, write 0 */
++#define ARG_IC_ICTRL_SET_ZERO_MASK		((0xff << 12) | BIT(11))
++
++/* All IRQ bits */
++#define ARG_IC_ICTRL_ALL_IRQ_MASK   (\
++		ARG_IC_ICTRL_VP9_INTERRUPT_INT  |\
++		ARG_IC_ICTRL_H264_INTERRUPT_INT |\
++		ARG_IC_ICTRL_ACTIVE1_INT_SET    |\
++		ARG_IC_ICTRL_ACTIVE2_INT_SET)
++
++/* Regulate claim Q */
++void rpivid_hw_irq_active1_enable_claim(struct rpivid_dev *dev,
++					int n);
++/* Auto release once all CBs called */
++void rpivid_hw_irq_active1_claim(struct rpivid_dev *dev,
++				 struct rpivid_hw_irq_ent *ient,
++				 rpivid_irq_callback ready_cb, void *ctx);
++/* May only be called in claim cb */
++void rpivid_hw_irq_active1_irq(struct rpivid_dev *dev,
++			       struct rpivid_hw_irq_ent *ient,
++			       rpivid_irq_callback irq_cb, void *ctx);
++/* May only be called in irq cb */
++void rpivid_hw_irq_active1_thread(struct rpivid_dev *dev,
++				  struct rpivid_hw_irq_ent *ient,
++				  rpivid_irq_callback thread_cb, void *ctx);
++
++/* Auto release once all CBs called */
++void rpivid_hw_irq_active2_claim(struct rpivid_dev *dev,
++				 struct rpivid_hw_irq_ent *ient,
++				 rpivid_irq_callback ready_cb, void *ctx);
++/* May only be called in claim cb */
++void rpivid_hw_irq_active2_irq(struct rpivid_dev *dev,
++			       struct rpivid_hw_irq_ent *ient,
++			       rpivid_irq_callback irq_cb, void *ctx);
++
++int rpivid_hw_probe(struct rpivid_dev *dev);
++void rpivid_hw_remove(struct rpivid_dev *dev);
++
++#endif
+--- /dev/null
++++ b/drivers/staging/media/rpivid/rpivid_video.c
+@@ -0,0 +1,691 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Raspberry Pi HEVC driver
++ *
++ * Copyright (C) 2020 Raspberry Pi (Trading) Ltd
++ *
++ * Based on the Cedrus VPU driver, that is:
++ *
++ * Copyright (C) 2016 Florent Revest <florent.revest@free-electrons.com>
++ * Copyright (C) 2018 Paul Kocialkowski <paul.kocialkowski@bootlin.com>
++ * Copyright (C) 2018 Bootlin
++ */
++
++#include <media/videobuf2-dma-contig.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-ioctl.h>
++#include <media/v4l2-event.h>
++#include <media/v4l2-mem2mem.h>
++
++#include "rpivid.h"
++#include "rpivid_hw.h"
++#include "rpivid_video.h"
++#include "rpivid_dec.h"
++
++#define RPIVID_DECODE_SRC	BIT(0)
++#define RPIVID_DECODE_DST	BIT(1)
++
++#define RPIVID_MIN_WIDTH	16U
++#define RPIVID_MIN_HEIGHT	16U
++#define RPIVID_DEFAULT_WIDTH	1920U
++#define RPIVID_DEFAULT_HEIGHT	1088U
++#define RPIVID_MAX_WIDTH	4096U
++#define RPIVID_MAX_HEIGHT	4096U
++
++static inline struct rpivid_ctx *rpivid_file2ctx(struct file *file)
++{
++	return container_of(file->private_data, struct rpivid_ctx, fh);
++}
++
++/* constrain x to y,y*2 */
++static inline unsigned int constrain2x(unsigned int x, unsigned int y)
++{
++	return (x < y) ?
++			y :
++			(x > y * 2) ? y : x;
++}
++
++size_t rpivid_round_up_size(const size_t x)
++{
++	/* Admit no size < 256 */
++	const unsigned int n = x < 256 ? 8 : ilog2(x);
++
++	return x >= (3 << n) ? 4 << n : (3 << n);
++}
++
++size_t rpivid_bit_buf_size(unsigned int w, unsigned int h, unsigned int bits_minus8)
++{
++	const size_t wxh = w * h;
++	size_t bits_alloc;
++
++	/* Annex A gives a min compression of 2 @ lvl 3.1
++	 * (wxh <= 983040) and min 4 thereafter but avoid
++	 * the odity of 983041 having a lower limit than
++	 * 983040.
++	 * Multiply by 3/2 for 4:2:0
++	 */
++	bits_alloc = wxh < 983040 ? wxh * 3 / 4 :
++		wxh < 983040 * 2 ? 983040 * 3 / 4 :
++		wxh * 3 / 8;
++	/* Allow for bit depth */
++	bits_alloc += (bits_alloc * bits_minus8) / 8;
++	return rpivid_round_up_size(bits_alloc);
++}
++
++void rpivid_prepare_src_format(struct v4l2_pix_format_mplane *pix_fmt)
++{
++	size_t size;
++	u32 w;
++	u32 h;
++
++	w = pix_fmt->width;
++	h = pix_fmt->height;
++	if (!w || !h) {
++		w = RPIVID_DEFAULT_WIDTH;
++		h = RPIVID_DEFAULT_HEIGHT;
++	}
++	if (w > RPIVID_MAX_WIDTH)
++		w = RPIVID_MAX_WIDTH;
++	if (h > RPIVID_MAX_HEIGHT)
++		h = RPIVID_MAX_HEIGHT;
++
++	if (!pix_fmt->plane_fmt[0].sizeimage ||
++	    pix_fmt->plane_fmt[0].sizeimage > SZ_32M) {
++		/* Unspecified or way too big - pick max for size */
++		size = rpivid_bit_buf_size(w, h, 2);
++	}
++	/* Set a minimum */
++	size = max_t(u32, SZ_4K, pix_fmt->plane_fmt[0].sizeimage);
++
++	pix_fmt->pixelformat = V4L2_PIX_FMT_HEVC_SLICE;
++	pix_fmt->width = w;
++	pix_fmt->height = h;
++	pix_fmt->num_planes = 1;
++	pix_fmt->field = V4L2_FIELD_NONE;
++	/* Zero bytes per line for encoded source. */
++	pix_fmt->plane_fmt[0].bytesperline = 0;
++	pix_fmt->plane_fmt[0].sizeimage = size;
++}
++
++/* Take any pix_format and make it valid */
++static void rpivid_prepare_dst_format(struct v4l2_pix_format_mplane *pix_fmt)
++{
++	unsigned int width = pix_fmt->width;
++	unsigned int height = pix_fmt->height;
++	unsigned int sizeimage = pix_fmt->plane_fmt[0].sizeimage;
++	unsigned int bytesperline = pix_fmt->plane_fmt[0].bytesperline;
++
++	if (!width)
++		width = RPIVID_DEFAULT_WIDTH;
++	if (width > RPIVID_MAX_WIDTH)
++		width = RPIVID_MAX_WIDTH;
++	if (!height)
++		height = RPIVID_DEFAULT_HEIGHT;
++	if (height > RPIVID_MAX_HEIGHT)
++		height = RPIVID_MAX_HEIGHT;
++
++	/* For column formats set bytesperline to column height (stride2) */
++	switch (pix_fmt->pixelformat) {
++	default:
++		pix_fmt->pixelformat = V4L2_PIX_FMT_NV12_COL128;
++		fallthrough;
++	case V4L2_PIX_FMT_NV12_COL128:
++		/* Width rounds up to columns */
++		width = ALIGN(width, 128);
++
++		/* 16 aligned height - not sure we even need that */
++		height = ALIGN(height, 16);
++		/* column height
++		 * Accept suggested shape if at least min & < 2 * min
++		 */
++		bytesperline = constrain2x(bytesperline, height * 3 / 2);
++
++		/* image size
++		 * Again allow plausible variation in case added padding is
++		 * required
++		 */
++		sizeimage = constrain2x(sizeimage, bytesperline * width);
++		break;
++
++	case V4L2_PIX_FMT_NV12_10_COL128:
++		/* width in pixels (3 pels = 4 bytes) rounded to 128 byte
++		 * columns
++		 */
++		width = ALIGN(((width + 2) / 3), 32) * 3;
++
++		/* 16-aligned height. */
++		height = ALIGN(height, 16);
++
++		/* column height
++		 * Accept suggested shape if at least min & < 2 * min
++		 */
++		bytesperline = constrain2x(bytesperline, height * 3 / 2);
++
++		/* image size
++		 * Again allow plausible variation in case added padding is
++		 * required
++		 */
++		sizeimage = constrain2x(sizeimage,
++					bytesperline * width * 4 / 3);
++		break;
++	}
++
++	pix_fmt->width = width;
++	pix_fmt->height = height;
++
++	pix_fmt->field = V4L2_FIELD_NONE;
++	pix_fmt->plane_fmt[0].bytesperline = bytesperline;
++	pix_fmt->plane_fmt[0].sizeimage = sizeimage;
++	pix_fmt->num_planes = 1;
++}
++
++static int rpivid_querycap(struct file *file, void *priv,
++			   struct v4l2_capability *cap)
++{
++	strscpy(cap->driver, RPIVID_NAME, sizeof(cap->driver));
++	strscpy(cap->card, RPIVID_NAME, sizeof(cap->card));
++	snprintf(cap->bus_info, sizeof(cap->bus_info),
++		 "platform:%s", RPIVID_NAME);
++
++	return 0;
++}
++
++static int rpivid_enum_fmt_vid_out(struct file *file, void *priv,
++				   struct v4l2_fmtdesc *f)
++{
++	// Input formats
++
++	// H.265 Slice only currently
++	if (f->index == 0) {
++		f->pixelformat = V4L2_PIX_FMT_HEVC_SLICE;
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++static int rpivid_hevc_validate_sps(const struct v4l2_ctrl_hevc_sps * const sps)
++{
++	const unsigned int ctb_log2_size_y =
++			sps->log2_min_luma_coding_block_size_minus3 + 3 +
++			sps->log2_diff_max_min_luma_coding_block_size;
++	const unsigned int min_tb_log2_size_y =
++			sps->log2_min_luma_transform_block_size_minus2 + 2;
++	const unsigned int max_tb_log2_size_y = min_tb_log2_size_y +
++			sps->log2_diff_max_min_luma_transform_block_size;
++
++	/* Local limitations */
++	if (sps->pic_width_in_luma_samples < 32 ||
++	    sps->pic_width_in_luma_samples > 4096)
++		return 0;
++	if (sps->pic_height_in_luma_samples < 32 ||
++	    sps->pic_height_in_luma_samples > 4096)
++		return 0;
++	if (!(sps->bit_depth_luma_minus8 == 0 ||
++	      sps->bit_depth_luma_minus8 == 2))
++		return 0;
++	if (sps->bit_depth_luma_minus8 != sps->bit_depth_chroma_minus8)
++		return 0;
++	if (sps->chroma_format_idc != 1)
++		return 0;
++
++	/*  Limits from H.265 7.4.3.2.1 */
++	if (sps->log2_max_pic_order_cnt_lsb_minus4 > 12)
++		return 0;
++	if (sps->sps_max_dec_pic_buffering_minus1 > 15)
++		return 0;
++	if (sps->sps_max_num_reorder_pics >
++				sps->sps_max_dec_pic_buffering_minus1)
++		return 0;
++	if (ctb_log2_size_y > 6)
++		return 0;
++	if (max_tb_log2_size_y > 5)
++		return 0;
++	if (max_tb_log2_size_y > ctb_log2_size_y)
++		return 0;
++	if (sps->max_transform_hierarchy_depth_inter >
++				(ctb_log2_size_y - min_tb_log2_size_y))
++		return 0;
++	if (sps->max_transform_hierarchy_depth_intra >
++				(ctb_log2_size_y - min_tb_log2_size_y))
++		return 0;
++	/* Check pcm stuff */
++	if (sps->num_short_term_ref_pic_sets > 64)
++		return 0;
++	if (sps->num_long_term_ref_pics_sps > 32)
++		return 0;
++	return 1;
++}
++
++static u32 pixelformat_from_sps(const struct v4l2_ctrl_hevc_sps * const sps,
++				const int index)
++{
++	u32 pf = 0;
++
++	if (!is_sps_set(sps) || !rpivid_hevc_validate_sps(sps)) {
++		/* Treat this as an error? For now return both */
++		if (index == 0)
++			pf = V4L2_PIX_FMT_NV12_COL128;
++		else if (index == 1)
++			pf = V4L2_PIX_FMT_NV12_10_COL128;
++	} else if (index == 0) {
++		if (sps->bit_depth_luma_minus8 == 0)
++			pf = V4L2_PIX_FMT_NV12_COL128;
++		else if (sps->bit_depth_luma_minus8 == 2)
++			pf = V4L2_PIX_FMT_NV12_10_COL128;
++	}
++
++	return pf;
++}
++
++static struct v4l2_pix_format_mplane
++rpivid_hevc_default_dst_fmt(struct rpivid_ctx * const ctx)
++{
++	const struct v4l2_ctrl_hevc_sps * const sps =
++		rpivid_find_control_data(ctx, V4L2_CID_STATELESS_HEVC_SPS);
++	struct v4l2_pix_format_mplane pix_fmt;
++
++	memset(&pix_fmt, 0, sizeof(pix_fmt));
++	if (is_sps_set(sps)) {
++		pix_fmt.width = sps->pic_width_in_luma_samples;
++		pix_fmt.height = sps->pic_height_in_luma_samples;
++		pix_fmt.pixelformat = pixelformat_from_sps(sps, 0);
++	}
++
++	rpivid_prepare_dst_format(&pix_fmt);
++	return pix_fmt;
++}
++
++static u32 rpivid_hevc_get_dst_pixelformat(struct rpivid_ctx * const ctx,
++					   const int index)
++{
++	const struct v4l2_ctrl_hevc_sps * const sps =
++		rpivid_find_control_data(ctx, V4L2_CID_STATELESS_HEVC_SPS);
++
++	return pixelformat_from_sps(sps, index);
++}
++
++static int rpivid_enum_fmt_vid_cap(struct file *file, void *priv,
++				   struct v4l2_fmtdesc *f)
++{
++	struct rpivid_ctx * const ctx = rpivid_file2ctx(file);
++
++	const u32 pf = rpivid_hevc_get_dst_pixelformat(ctx, f->index);
++
++	if (pf == 0)
++		return -EINVAL;
++
++	f->pixelformat = pf;
++	return 0;
++}
++
++/*
++ * get dst format - sets it to default if otherwise unset
++ * returns a pointer to the struct as a convienience
++ */
++static struct v4l2_pix_format_mplane *get_dst_fmt(struct rpivid_ctx *const ctx)
++{
++	if (!ctx->dst_fmt_set)
++		ctx->dst_fmt = rpivid_hevc_default_dst_fmt(ctx);
++	return &ctx->dst_fmt;
++}
++
++static int rpivid_g_fmt_vid_cap(struct file *file, void *priv,
++				struct v4l2_format *f)
++{
++	struct rpivid_ctx *ctx = rpivid_file2ctx(file);
++
++	f->fmt.pix_mp = *get_dst_fmt(ctx);
++	return 0;
++}
++
++static int rpivid_g_fmt_vid_out(struct file *file, void *priv,
++				struct v4l2_format *f)
++{
++	struct rpivid_ctx *ctx = rpivid_file2ctx(file);
++
++	f->fmt.pix_mp = ctx->src_fmt;
++	return 0;
++}
++
++static inline void copy_color(struct v4l2_pix_format_mplane *d,
++			      const struct v4l2_pix_format_mplane *s)
++{
++	d->colorspace   = s->colorspace;
++	d->xfer_func    = s->xfer_func;
++	d->ycbcr_enc    = s->ycbcr_enc;
++	d->quantization = s->quantization;
++}
++
++static int rpivid_try_fmt_vid_cap(struct file *file, void *priv,
++				  struct v4l2_format *f)
++{
++	struct rpivid_ctx *ctx = rpivid_file2ctx(file);
++	const struct v4l2_ctrl_hevc_sps * const sps =
++		rpivid_find_control_data(ctx, V4L2_CID_STATELESS_HEVC_SPS);
++	u32 pixelformat;
++	int i;
++
++	for (i = 0; (pixelformat = pixelformat_from_sps(sps, i)) != 0; i++) {
++		if (f->fmt.pix_mp.pixelformat == pixelformat)
++			break;
++	}
++
++	// We don't have any way of finding out colourspace so believe
++	// anything we are told - take anything set in src as a default
++	if (f->fmt.pix_mp.colorspace == V4L2_COLORSPACE_DEFAULT)
++		copy_color(&f->fmt.pix_mp, &ctx->src_fmt);
++
++	f->fmt.pix_mp.pixelformat = pixelformat;
++	rpivid_prepare_dst_format(&f->fmt.pix_mp);
++	return 0;
++}
++
++static int rpivid_try_fmt_vid_out(struct file *file, void *priv,
++				  struct v4l2_format *f)
++{
++	rpivid_prepare_src_format(&f->fmt.pix_mp);
++	return 0;
++}
++
++static int rpivid_s_fmt_vid_cap(struct file *file, void *priv,
++				struct v4l2_format *f)
++{
++	struct rpivid_ctx *ctx = rpivid_file2ctx(file);
++	struct vb2_queue *vq;
++	int ret;
++
++	vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, f->type);
++	if (vb2_is_busy(vq))
++		return -EBUSY;
++
++	ret = rpivid_try_fmt_vid_cap(file, priv, f);
++	if (ret)
++		return ret;
++
++	ctx->dst_fmt = f->fmt.pix_mp;
++	ctx->dst_fmt_set = 1;
++
++	return 0;
++}
++
++static int rpivid_s_fmt_vid_out(struct file *file, void *priv,
++				struct v4l2_format *f)
++{
++	struct rpivid_ctx *ctx = rpivid_file2ctx(file);
++	struct vb2_queue *vq;
++	int ret;
++
++	vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, f->type);
++	if (vb2_is_busy(vq))
++		return -EBUSY;
++
++	ret = rpivid_try_fmt_vid_out(file, priv, f);
++	if (ret)
++		return ret;
++
++	ctx->src_fmt = f->fmt.pix_mp;
++	ctx->dst_fmt_set = 0;  // Setting src invalidates dst
++
++	vq->subsystem_flags |=
++		VB2_V4L2_FL_SUPPORTS_M2M_HOLD_CAPTURE_BUF;
++
++	/* Propagate colorspace information to capture. */
++	copy_color(&ctx->dst_fmt, &f->fmt.pix_mp);
++	return 0;
++}
++
++const struct v4l2_ioctl_ops rpivid_ioctl_ops = {
++	.vidioc_querycap		= rpivid_querycap,
++
++	.vidioc_enum_fmt_vid_cap	= rpivid_enum_fmt_vid_cap,
++	.vidioc_g_fmt_vid_cap_mplane	= rpivid_g_fmt_vid_cap,
++	.vidioc_try_fmt_vid_cap_mplane	= rpivid_try_fmt_vid_cap,
++	.vidioc_s_fmt_vid_cap_mplane	= rpivid_s_fmt_vid_cap,
++
++	.vidioc_enum_fmt_vid_out	= rpivid_enum_fmt_vid_out,
++	.vidioc_g_fmt_vid_out_mplane	= rpivid_g_fmt_vid_out,
++	.vidioc_try_fmt_vid_out_mplane	= rpivid_try_fmt_vid_out,
++	.vidioc_s_fmt_vid_out_mplane	= rpivid_s_fmt_vid_out,
++
++	.vidioc_reqbufs			= v4l2_m2m_ioctl_reqbufs,
++	.vidioc_querybuf		= v4l2_m2m_ioctl_querybuf,
++	.vidioc_qbuf			= v4l2_m2m_ioctl_qbuf,
++	.vidioc_dqbuf			= v4l2_m2m_ioctl_dqbuf,
++	.vidioc_prepare_buf		= v4l2_m2m_ioctl_prepare_buf,
++	.vidioc_create_bufs		= v4l2_m2m_ioctl_create_bufs,
++	.vidioc_expbuf			= v4l2_m2m_ioctl_expbuf,
++
++	.vidioc_streamon		= v4l2_m2m_ioctl_streamon,
++	.vidioc_streamoff		= v4l2_m2m_ioctl_streamoff,
++
++	.vidioc_try_decoder_cmd		= v4l2_m2m_ioctl_stateless_try_decoder_cmd,
++	.vidioc_decoder_cmd		= v4l2_m2m_ioctl_stateless_decoder_cmd,
++
++	.vidioc_subscribe_event		= v4l2_ctrl_subscribe_event,
++	.vidioc_unsubscribe_event	= v4l2_event_unsubscribe,
++};
++
++static int rpivid_queue_setup(struct vb2_queue *vq, unsigned int *nbufs,
++			      unsigned int *nplanes, unsigned int sizes[],
++			      struct device *alloc_devs[])
++{
++	struct rpivid_ctx *ctx = vb2_get_drv_priv(vq);
++	struct v4l2_pix_format_mplane *pix_fmt;
++
++	if (V4L2_TYPE_IS_OUTPUT(vq->type))
++		pix_fmt = &ctx->src_fmt;
++	else
++		pix_fmt = get_dst_fmt(ctx);
++
++	if (*nplanes) {
++		if (sizes[0] < pix_fmt->plane_fmt[0].sizeimage)
++			return -EINVAL;
++	} else {
++		sizes[0] = pix_fmt->plane_fmt[0].sizeimage;
++		*nplanes = 1;
++	}
++
++	return 0;
++}
++
++static void rpivid_queue_cleanup(struct vb2_queue *vq, u32 state)
++{
++	struct rpivid_ctx *ctx = vb2_get_drv_priv(vq);
++	struct vb2_v4l2_buffer *vbuf;
++
++	for (;;) {
++		if (V4L2_TYPE_IS_OUTPUT(vq->type))
++			vbuf = v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
++		else
++			vbuf = v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
++
++		if (!vbuf)
++			return;
++
++		v4l2_ctrl_request_complete(vbuf->vb2_buf.req_obj.req,
++					   &ctx->hdl);
++		v4l2_m2m_buf_done(vbuf, state);
++	}
++}
++
++static int rpivid_buf_out_validate(struct vb2_buffer *vb)
++{
++	struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
++
++	vbuf->field = V4L2_FIELD_NONE;
++	return 0;
++}
++
++static int rpivid_buf_prepare(struct vb2_buffer *vb)
++{
++	struct vb2_queue *vq = vb->vb2_queue;
++	struct rpivid_ctx *ctx = vb2_get_drv_priv(vq);
++	struct v4l2_pix_format_mplane *pix_fmt;
++
++	if (V4L2_TYPE_IS_OUTPUT(vq->type))
++		pix_fmt = &ctx->src_fmt;
++	else
++		pix_fmt = &ctx->dst_fmt;
++
++	if (vb2_plane_size(vb, 0) < pix_fmt->plane_fmt[0].sizeimage)
++		return -EINVAL;
++
++	vb2_set_plane_payload(vb, 0, pix_fmt->plane_fmt[0].sizeimage);
++
++	return 0;
++}
++
++/* Only stops the clock if streaom off on both output & capture */
++static void stop_clock(struct rpivid_dev *dev, struct rpivid_ctx *ctx)
++{
++	if (ctx->src_stream_on ||
++	    ctx->dst_stream_on)
++		return;
++
++	clk_set_min_rate(dev->clock, 0);
++	clk_disable_unprepare(dev->clock);
++}
++
++/* Always starts the clock if it isn't already on this ctx */
++static int start_clock(struct rpivid_dev *dev, struct rpivid_ctx *ctx)
++{
++	int rv;
++
++	rv = clk_set_min_rate(dev->clock, dev->max_clock_rate);
++	if (rv) {
++		dev_err(dev->dev, "Failed to set clock rate\n");
++		return rv;
++	}
++
++	rv = clk_prepare_enable(dev->clock);
++	if (rv) {
++		dev_err(dev->dev, "Failed to enable clock\n");
++		return rv;
++	}
++
++	return 0;
++}
++
++static int rpivid_start_streaming(struct vb2_queue *vq, unsigned int count)
++{
++	struct rpivid_ctx *ctx = vb2_get_drv_priv(vq);
++	struct rpivid_dev *dev = ctx->dev;
++	int ret = 0;
++
++	if (!V4L2_TYPE_IS_OUTPUT(vq->type)) {
++		ctx->dst_stream_on = 1;
++		goto ok;
++	}
++
++	if (ctx->src_fmt.pixelformat != V4L2_PIX_FMT_HEVC_SLICE) {
++		ret = -EINVAL;
++		goto fail_cleanup;
++	}
++
++	if (ctx->src_stream_on)
++		goto ok;
++
++	ret = start_clock(dev, ctx);
++	if (ret)
++		goto fail_cleanup;
++
++	if (dev->dec_ops->start)
++		ret = dev->dec_ops->start(ctx);
++	if (ret)
++		goto fail_stop_clock;
++
++	ctx->src_stream_on = 1;
++ok:
++	return 0;
++
++fail_stop_clock:
++	stop_clock(dev, ctx);
++fail_cleanup:
++	v4l2_err(&dev->v4l2_dev, "%s: qtype=%d: FAIL\n", __func__, vq->type);
++	rpivid_queue_cleanup(vq, VB2_BUF_STATE_QUEUED);
++	return ret;
++}
++
++static void rpivid_stop_streaming(struct vb2_queue *vq)
++{
++	struct rpivid_ctx *ctx = vb2_get_drv_priv(vq);
++	struct rpivid_dev *dev = ctx->dev;
++
++	if (V4L2_TYPE_IS_OUTPUT(vq->type)) {
++		ctx->src_stream_on = 0;
++		if (dev->dec_ops->stop)
++			dev->dec_ops->stop(ctx);
++	} else {
++		ctx->dst_stream_on = 0;
++	}
++
++	rpivid_queue_cleanup(vq, VB2_BUF_STATE_ERROR);
++
++	vb2_wait_for_all_buffers(vq);
++
++	stop_clock(dev, ctx);
++}
++
++static void rpivid_buf_queue(struct vb2_buffer *vb)
++{
++	struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
++	struct rpivid_ctx *ctx = vb2_get_drv_priv(vb->vb2_queue);
++
++	v4l2_m2m_buf_queue(ctx->fh.m2m_ctx, vbuf);
++}
++
++static void rpivid_buf_request_complete(struct vb2_buffer *vb)
++{
++	struct rpivid_ctx *ctx = vb2_get_drv_priv(vb->vb2_queue);
++
++	v4l2_ctrl_request_complete(vb->req_obj.req, &ctx->hdl);
++}
++
++static struct vb2_ops rpivid_qops = {
++	.queue_setup		= rpivid_queue_setup,
++	.buf_prepare		= rpivid_buf_prepare,
++	.buf_queue		= rpivid_buf_queue,
++	.buf_out_validate	= rpivid_buf_out_validate,
++	.buf_request_complete	= rpivid_buf_request_complete,
++	.start_streaming	= rpivid_start_streaming,
++	.stop_streaming		= rpivid_stop_streaming,
++	.wait_prepare		= vb2_ops_wait_prepare,
++	.wait_finish		= vb2_ops_wait_finish,
++};
++
++int rpivid_queue_init(void *priv, struct vb2_queue *src_vq,
++		      struct vb2_queue *dst_vq)
++{
++	struct rpivid_ctx *ctx = priv;
++	int ret;
++
++	src_vq->type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE;
++	src_vq->io_modes = VB2_MMAP | VB2_DMABUF;
++	src_vq->drv_priv = ctx;
++	src_vq->buf_struct_size = sizeof(struct rpivid_buffer);
++	src_vq->ops = &rpivid_qops;
++	src_vq->mem_ops = &vb2_dma_contig_memops;
++	src_vq->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;
++	src_vq->lock = &ctx->ctx_mutex;
++	src_vq->dev = ctx->dev->dev;
++	src_vq->supports_requests = true;
++	src_vq->requires_requests = true;
++
++	ret = vb2_queue_init(src_vq);
++	if (ret)
++		return ret;
++
++	dst_vq->type = V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE;
++	dst_vq->io_modes = VB2_MMAP | VB2_DMABUF;
++	dst_vq->drv_priv = ctx;
++	dst_vq->buf_struct_size = sizeof(struct rpivid_buffer);
++	dst_vq->min_queued_buffers = 1;
++	dst_vq->ops = &rpivid_qops;
++	dst_vq->mem_ops = &vb2_dma_contig_memops;
++	dst_vq->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;
++	dst_vq->lock = &ctx->ctx_mutex;
++	dst_vq->dev = ctx->dev->dev;
++
++	return vb2_queue_init(dst_vq);
++}
+--- /dev/null
++++ b/drivers/staging/media/rpivid/rpivid_video.h
+@@ -0,0 +1,38 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * Raspberry Pi HEVC driver
++ *
++ * Copyright (C) 2020 Raspberry Pi (Trading) Ltd
++ *
++ * Based on the Cedrus VPU driver, that is:
++ *
++ * Copyright (C) 2016 Florent Revest <florent.revest@free-electrons.com>
++ * Copyright (C) 2018 Paul Kocialkowski <paul.kocialkowski@bootlin.com>
++ * Copyright (C) 2018 Bootlin
++ */
++
++#ifndef _RPIVID_VIDEO_H_
++#define _RPIVID_VIDEO_H_
++
++struct rpivid_format {
++	u32		pixelformat;
++	u32		directions;
++	unsigned int	capabilities;
++};
++
++static inline int is_sps_set(const struct v4l2_ctrl_hevc_sps * const sps)
++{
++	return sps && sps->pic_width_in_luma_samples != 0;
++}
++
++extern const struct v4l2_ioctl_ops rpivid_ioctl_ops;
++
++int rpivid_queue_init(void *priv, struct vb2_queue *src_vq,
++		      struct vb2_queue *dst_vq);
++
++size_t rpivid_bit_buf_size(unsigned int w, unsigned int h, unsigned int bits_minus8);
++size_t rpivid_round_up_size(const size_t x);
++
++void rpivid_prepare_src_format(struct v4l2_pix_format_mplane *pix_fmt);
++
++#endif
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0173-spi-Force-CS_HIGH-if-GPIO-descriptors-are-used.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0173-spi-Force-CS_HIGH-if-GPIO-descriptors-are-used.patch
new file mode 100644
index 00000000..92180189
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0173-spi-Force-CS_HIGH-if-GPIO-descriptors-are-used.patch
@@ -0,0 +1,57 @@
+From 1fe5681305f726515de7dceb825ca822afce5e1f Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 17 Apr 2020 10:46:19 +0100
+Subject: [PATCH 173/697] spi: Force CS_HIGH if GPIO descriptors are used
+
+Commit f3186dd87669 ("spi: Optionally use GPIO descriptors for CS GPIOs")
+amended of_spi_parse_dt() to always set SPI_CS_HIGH for SPI slaves whose
+Chip Select is defined by a "cs-gpios" devicetree property.
+
+This change breaks drivers whose probe functions set the mode field of
+the spi_device because in doing so they clear the SPI_CS_HIGH flag.
+
+Fix by setting SPI_CS_HIGH in spi_setup (under the same conditions as
+in of_spi_parse_dt()).
+
+See also: 83b2a8fe43bd ("spi: spidev: Fix CS polarity if GPIO descriptors are used")
+
+Fixes: f3186dd87669 ("spi: Optionally use GPIO descriptors for CS GPIOs")
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+SQUASH: spi: Demote SPI_CS_HIGH warning to KERN_DEBUG
+
+This warning is unavoidable from a client's perspective and
+doesn't indicate anything wrong (just surprising).
+
+SQUASH with "spi: use_gpio_descriptor fixup moved to spi_setup"
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/spi/spi.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -3897,6 +3897,7 @@ static int spi_set_cs_timing(struct spi_
+  */
+ int spi_setup(struct spi_device *spi)
+ {
++	struct spi_controller *ctlr = spi->controller;
+ 	unsigned	bad_bits, ugly_bits;
+ 	int		status;
+ 
+@@ -3923,6 +3924,14 @@ int spi_setup(struct spi_device *spi)
+ 			"setup: MOSI configured to idle low and high at the same time.\n");
+ 		return -EINVAL;
+ 	}
++
++	if (ctlr->use_gpio_descriptors && ctlr->cs_gpiods &&
++	    ctlr->cs_gpiods[spi->chip_select[0]] && !(spi->mode & SPI_CS_HIGH)) {
++		dev_dbg(&spi->dev,
++			"setup: forcing CS_HIGH (use_gpio_descriptors)\n");
++		spi->mode |= SPI_CS_HIGH;
++	}
++
+ 	/*
+ 	 * Help drivers fail *cleanly* when they need options
+ 	 * that aren't supported with their current controller.
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0174-media-uapi-v4l2-core-Add-sensor-ancillary-data-V4L2-.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0174-media-uapi-v4l2-core-Add-sensor-ancillary-data-V4L2-.patch
new file mode 100644
index 00000000..6c41bbde
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0174-media-uapi-v4l2-core-Add-sensor-ancillary-data-V4L2-.patch
@@ -0,0 +1,85 @@
+From 144bb8fc5e3f331ab11af4abb18d91ab51cb1ba9 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Wed, 1 Apr 2020 08:46:29 +0100
+Subject: [PATCH 174/697] media: uapi: v4l2-core: Add sensor ancillary data
+ V4L2 foucc type.
+
+Add V4L2_META_FMT_SENSOR_DATA format 4CC.
+
+This new format will be used by the BCM2835 Unicam device to return
+out camera sensor embedded data.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../userspace-api/media/v4l/meta-formats.rst  |  1 +
+ .../media/v4l/pixfmt-meta-sensor-data.rst     | 32 +++++++++++++++++++
+ drivers/media/v4l2-core/v4l2-ioctl.c          |  1 +
+ include/uapi/linux/videodev2.h                |  1 +
+ 4 files changed, 35 insertions(+)
+ create mode 100644 Documentation/userspace-api/media/v4l/pixfmt-meta-sensor-data.rst
+
+--- a/Documentation/userspace-api/media/v4l/meta-formats.rst
++++ b/Documentation/userspace-api/media/v4l/meta-formats.rst
+@@ -17,6 +17,7 @@ These formats are used for the :ref:`met
+     metafmt-intel-ipu3
+     metafmt-pisp-be
+     metafmt-rkisp1
++    metafmt-sensor-data
+     metafmt-uvc
+     metafmt-vivid
+     metafmt-vsp1-hgo
+--- /dev/null
++++ b/Documentation/userspace-api/media/v4l/pixfmt-meta-sensor-data.rst
+@@ -0,0 +1,32 @@
++.. Permission is granted to copy, distribute and/or modify this
++.. document under the terms of the GNU Free Documentation License,
++.. Version 1.1 or any later version published by the Free Software
++.. Foundation, with no Invariant Sections, no Front-Cover Texts
++.. and no Back-Cover Texts. A copy of the license is included at
++.. Documentation/media/uapi/fdl-appendix.rst.
++..
++.. TODO: replace it to GFDL-1.1-or-later WITH no-invariant-sections
++
++.. _v4l2-meta-fmt-sensor-data:
++
++***********************************
++V4L2_META_FMT_SENSOR_DATA  ('SENS')
++***********************************
++
++Sensor Ancillary Metadata
++
++Description
++===========
++
++This format describes ancillary data generated by a camera sensor and
++transmitted over a stream on the camera bus. Sensor vendors generally have their
++own custom format for this ancillary data. Some vendors follow a generic
++CSI-2/SMIA embedded data format as described in the `CSI-2 specification.
++<https://mipi.org/specifications/csi-2>`_
++
++The size of the embedded buffer is defined as a single line with a pixel width
++width specified in bytes. This is obtained by a call to the
++:c:type:`VIDIOC_SUBDEV_G_FMT` ioctl on the sensor subdevice where the ``pad``
++field in :c:type:`v4l2_subdev_format` is set to 1.  Note that this size is fixed
++and cannot be modified with a call to :c:type:`VIDIOC_SUBDEV_S_FMT`.
++
+--- a/drivers/media/v4l2-core/v4l2-ioctl.c
++++ b/drivers/media/v4l2-core/v4l2-ioctl.c
+@@ -1476,6 +1476,7 @@ static void v4l_fill_fmtdesc(struct v4l2
+ 	case V4L2_META_FMT_GENERIC_CSI2_16:	descr = "8-bit Generic Meta, 16b CSI-2"; break;
+ 	case V4L2_META_FMT_GENERIC_CSI2_20:	descr = "8-bit Generic Meta, 20b CSI-2"; break;
+ 	case V4L2_META_FMT_GENERIC_CSI2_24:	descr = "8-bit Generic Meta, 24b CSI-2"; break;
++	case V4L2_META_FMT_SENSOR_DATA:	descr = "Sensor Ancillary Metadata"; break;
+ 
+ 	default:
+ 		/* Compressed formats */
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -860,6 +860,7 @@ struct v4l2_pix_format {
+ #define V4L2_META_FMT_UVC         v4l2_fourcc('U', 'V', 'C', 'H') /* UVC Payload Header metadata */
+ #define V4L2_META_FMT_D4XX        v4l2_fourcc('D', '4', 'X', 'X') /* D4XX Payload Header metadata */
+ #define V4L2_META_FMT_VIVID	  v4l2_fourcc('V', 'I', 'V', 'D') /* Vivid Metadata */
++#define V4L2_META_FMT_SENSOR_DATA v4l2_fourcc('S', 'E', 'N', 'S') /* Sensor Ancillary metadata */
+ 
+ /* Vendor specific - used for RK_ISP1 camera sub-system */
+ #define V4L2_META_FMT_RK_ISP1_PARAMS	v4l2_fourcc('R', 'K', '1', 'P') /* Rockchip ISP1 3A Parameters */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0175-media-uapi-Add-MEDIA_BUS_FMT_SENSOR_DATA-media-bus-f.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0175-media-uapi-Add-MEDIA_BUS_FMT_SENSOR_DATA-media-bus-f.patch
new file mode 100644
index 00000000..43b7d935
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0175-media-uapi-Add-MEDIA_BUS_FMT_SENSOR_DATA-media-bus-f.patch
@@ -0,0 +1,61 @@
+From 40919b1ceb5ae5c09cc1a0fafd723ef90556bec0 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Tue, 21 Jan 2020 14:06:47 +0000
+Subject: [PATCH 175/697] media: uapi: Add MEDIA_BUS_FMT_SENSOR_DATA media bus
+ format
+
+This patch adds MEDIA_BUS_FMT_SENSOR_DATA used by the bcm2835-unicam
+driver to support CSI-2 embedded data streams from camera sensors.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../media/v4l/subdev-formats.rst              | 30 +++++++++++++++++++
+ include/uapi/linux/media-bus-format.h         |  3 ++
+ 2 files changed, 33 insertions(+)
+
+--- a/Documentation/userspace-api/media/v4l/subdev-formats.rst
++++ b/Documentation/userspace-api/media/v4l/subdev-formats.rst
+@@ -8561,3 +8561,33 @@ and finally the bit number in subscript.
+       - x
+       - x
+       - x
++
++.. _v4l2-mbus-sensor-data:
++
++Sensor Ancillary Metadata Formats
++^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
++
++This section lists ancillary data generated by a camera sensor and
++transmitted over a stream on the camera bus.
++
++The following table lists the existing sensor ancillary metadata formats:
++
++
++.. _v4l2-mbus-pixelcode-sensor-metadata:
++
++.. tabularcolumns:: |p{8.0cm}|p{1.4cm}|p{7.7cm}|
++
++.. flat-table:: Sensor ancillary metadata formats
++    :header-rows:  1
++    :stub-columns: 0
++
++    * - Identifier
++      - Code
++      - Comments
++    * .. _MEDIA_BUS_FMT_SENSOR_DATA:
++
++      - MEDIA_BUS_FMT_SENSOR_DATA
++      - 0x7001
++      - Sensor vendor specific ancillary metadata. Some vendors follow a generic
++        CSI-2/SMIA embedded data format as described in the `CSI-2 specification.
++	<https://mipi.org/specifications/csi-2>`_
+--- a/include/uapi/linux/media-bus-format.h
++++ b/include/uapi/linux/media-bus-format.h
+@@ -183,4 +183,7 @@
+ #define MEDIA_BUS_FMT_META_20			0x8006
+ #define MEDIA_BUS_FMT_META_24			0x8007
+ 
++/* Sensor ancillary metadata formats - next is 0x7002 */
++#define MEDIA_BUS_FMT_SENSOR_DATA		0x7002
++
+ #endif /* __LINUX_MEDIA_BUS_FORMAT_H */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0176-media-uapi-v4l2-core-Add-ISP-statistics-output-V4L2-.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0176-media-uapi-v4l2-core-Add-ISP-statistics-output-V4L2-.patch
new file mode 100644
index 00000000..39656e56
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0176-media-uapi-v4l2-core-Add-ISP-statistics-output-V4L2-.patch
@@ -0,0 +1,94 @@
+From 63862b177d94fdbff1d8c4567f4bec5c08a6b72a Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Thu, 23 Apr 2020 10:20:26 +0100
+Subject: [PATCH 176/697] media: uapi: v4l2-core: Add ISP statistics output
+ V4L2 fourcc type
+
+Add V4L2_META_FMT_BCM2835_ISP_STATS V4L2 format type.
+
+This new format will be used by the BCM2835 ISP device to return
+out ISP statistics for 3A.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../userspace-api/media/v4l/meta-formats.rst  |  1 +
+ .../v4l/pixfmt-meta-bcm2835-isp-stats.rst     | 41 +++++++++++++++++++
+ drivers/media/v4l2-core/v4l2-ioctl.c          |  1 +
+ include/uapi/linux/videodev2.h                |  1 +
+ 4 files changed, 44 insertions(+)
+ create mode 100644 Documentation/userspace-api/media/v4l/pixfmt-meta-bcm2835-isp-stats.rst
+
+--- a/Documentation/userspace-api/media/v4l/meta-formats.rst
++++ b/Documentation/userspace-api/media/v4l/meta-formats.rst
+@@ -12,6 +12,7 @@ These formats are used for the :ref:`met
+ .. toctree::
+     :maxdepth: 1
+ 
++    metafmt-bcm2835-isp-stats
+     metafmt-d4xx
+     metafmt-generic
+     metafmt-intel-ipu3
+--- /dev/null
++++ b/Documentation/userspace-api/media/v4l/pixfmt-meta-bcm2835-isp-stats.rst
+@@ -0,0 +1,41 @@
++.. Permission is granted to copy, distribute and/or modify this
++.. document under the terms of the GNU Free Documentation License,
++.. Version 1.1 or any later version published by the Free Software
++.. Foundation, with no Invariant Sections, no Front-Cover Texts
++.. and no Back-Cover Texts. A copy of the license is included at
++.. Documentation/media/uapi/fdl-appendix.rst.
++..
++.. TODO: replace it to GFDL-1.1-or-later WITH no-invariant-sections
++
++.. _v4l2-meta-fmt-bcm2835-isp-stats:
++
++*****************************************
++V4L2_META_FMT_BCM2835_ISP_STATS  ('BSTA')
++*****************************************
++
++BCM2835 ISP Statistics
++
++Description
++===========
++
++The BCM2835 ISP hardware calculate image statistics for an input Bayer frame.
++These statistics are obtained from the "bcm2835-isp0-capture3" device node
++using the :c:type:`v4l2_meta_format` interface. They are formatted as described
++by the :c:type:`bcm2835_isp_stats` structure below.
++
++.. code-block:: c
++
++	#define DEFAULT_AWB_REGIONS_X 16
++	#define DEFAULT_AWB_REGIONS_Y 12
++
++	#define NUM_HISTOGRAMS 2
++	#define NUM_HISTOGRAM_BINS 128
++	#define AWB_REGIONS (DEFAULT_AWB_REGIONS_X * DEFAULT_AWB_REGIONS_Y)
++	#define FLOATING_REGIONS 16
++	#define AGC_REGIONS 16
++	#define FOCUS_REGIONS 12
++
++.. kernel-doc:: include/uapi/linux/bcm2835-isp.h
++   :functions: bcm2835_isp_stats_hist bcm2835_isp_stats_region
++	             bcm2835_isp_stats_focus bcm2835_isp_stats
++
+--- a/drivers/media/v4l2-core/v4l2-ioctl.c
++++ b/drivers/media/v4l2-core/v4l2-ioctl.c
+@@ -1477,6 +1477,7 @@ static void v4l_fill_fmtdesc(struct v4l2
+ 	case V4L2_META_FMT_GENERIC_CSI2_20:	descr = "8-bit Generic Meta, 20b CSI-2"; break;
+ 	case V4L2_META_FMT_GENERIC_CSI2_24:	descr = "8-bit Generic Meta, 24b CSI-2"; break;
+ 	case V4L2_META_FMT_SENSOR_DATA:	descr = "Sensor Ancillary Metadata"; break;
++	case V4L2_META_FMT_BCM2835_ISP_STATS: descr = "BCM2835 ISP Image Statistics"; break;
+ 
+ 	default:
+ 		/* Compressed formats */
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -861,6 +861,7 @@ struct v4l2_pix_format {
+ #define V4L2_META_FMT_D4XX        v4l2_fourcc('D', '4', 'X', 'X') /* D4XX Payload Header metadata */
+ #define V4L2_META_FMT_VIVID	  v4l2_fourcc('V', 'I', 'V', 'D') /* Vivid Metadata */
+ #define V4L2_META_FMT_SENSOR_DATA v4l2_fourcc('S', 'E', 'N', 'S') /* Sensor Ancillary metadata */
++#define V4L2_META_FMT_BCM2835_ISP_STATS v4l2_fourcc('B', 'S', 'T', 'A') /* BCM2835 ISP image statistics output */
+ 
+ /* Vendor specific - used for RK_ISP1 camera sub-system */
+ #define V4L2_META_FMT_RK_ISP1_PARAMS	v4l2_fourcc('R', 'K', '1', 'P') /* Rockchip ISP1 3A Parameters */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0177-media-uapi-v4l-ctrls-Add-CID-base-for-the-bcm2835-is.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0177-media-uapi-v4l-ctrls-Add-CID-base-for-the-bcm2835-is.patch
new file mode 100644
index 00000000..1127ef81
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0177-media-uapi-v4l-ctrls-Add-CID-base-for-the-bcm2835-is.patch
@@ -0,0 +1,169 @@
+From 7a4c784da0cadf342b35064a015a4da1e46e95c6 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Tue, 21 Apr 2020 15:06:19 +0100
+Subject: [PATCH 177/697] media: uapi: v4l-ctrls: Add CID base for the
+ bcm2835-isp driver
+
+We are reserving controls for the new bcm2835-isp driver.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../admin-guide/media/bcm2835-isp.rst         | 127 ++++++++++++++++++
+ .../userspace-api/media/drivers/index.rst     |   1 +
+ include/uapi/linux/v4l2-controls.h            |   4 +
+ 3 files changed, 132 insertions(+)
+ create mode 100644 Documentation/admin-guide/media/bcm2835-isp.rst
+
+--- /dev/null
++++ b/Documentation/admin-guide/media/bcm2835-isp.rst
+@@ -0,0 +1,127 @@
++.. SPDX-License-Identifier: GPL-2.0
++
++BCM2835 ISP Driver
++==================
++
++Introduction
++------------
++
++The BCM2835 Image Sensor Pipeline (ISP) is a fixed function hardware pipeline
++for performing image processing operations.  Images are fed to the input
++of the ISP through memory frame buffers.  These images may be in various YUV,
++RGB, or Bayer formats.  A typical use case would have Bayer images obtained from
++an image sensor by the BCM2835 Unicam peripheral, written to a memory
++frame buffer, and finally fed into the input of the ISP.  Two concurrent output
++images may be generated in YUV or RGB format at different resolutions.
++Statistics output is also generated for Bayer input images.
++
++The bcm2835-isp driver exposes the following media pads as V4L2 device nodes:
++
++.. tabularcolumns:: |l|l|l|l|
++
++.. cssclass: longtable
++
++.. flat-table::
++
++    * - *Pad*
++      - *Direction*
++      - *Purpose*
++      - *Formats*
++
++    * - "bcm2835-isp0-output0"
++      - sink
++      - Accepts Bayer, RGB or YUV format frame buffers as input to the ISP HW
++        pipeline.
++      - :ref:`RAW8 <V4L2-PIX-FMT-SRGGB8>`,
++        :ref:`RAW10P <V4L2-PIX-FMT-SRGGB10P>`,
++        :ref:`RAW12P <V4L2-PIX-FMT-SRGGB12P>`,
++        :ref:`RAW14P <V4L2-PIX-FMT-SRGGB14P>`,
++        :ref:`RAW16 <V4L2-PIX-FMT-SRGGB16>`,
++        :ref:`RGB24/BGR24 <V4L2-PIX-FMT-RGB24>`,
++        :ref:`YUYV <V4L2-PIX-FMT-YUYV>`,
++        :ref:`YVYU <V4L2-PIX-FMT-YVYU>`,
++        :ref:`UYVY <V4L2-PIX-FMT-UYVY>`,
++        :ref:`VYUY <V4L2-PIX-FMT-VYUY>`,
++        :ref:`YUV420/YVU420 <V4L2-PIX-FMT-YUV420>`
++
++    * - "bcm2835-isp0-capture1"
++      - source
++      - High resolution YUV or RGB processed output from the ISP.
++      - :ref:`RGB565 <V4L2-PIX-FMT-RGB565>`,
++        :ref:`RGB24/BGR24 <V4L2-PIX-FMT-RGB24>`,
++        :ref:`ABGR32 <V4L2-PIX-FMT-ABGR32>`,
++        :ref:`YUYV <V4L2-PIX-FMT-YUYV>`,
++        :ref:`YVYU <V4L2-PIX-FMT-YVYU>`,
++        :ref:`UYVY <V4L2-PIX-FMT-UYVY>`,
++        :ref:`VYUY <V4L2-PIX-FMT-VYUY>`.
++        :ref:`YUV420/YVU420 <V4L2-PIX-FMT-YUV420>`,
++        :ref:`NV12/NV21 <V4L2-PIX-FMT-NV12>`,
++
++    * - "bcm2835-isp0-capture2"
++      - source
++      - Low resolution YUV processed output from the ISP. The output of
++        this pad cannot have a resolution larger than the "bcm2835-isp0-capture1" pad in any dimension.
++      - :ref:`YUYV <V4L2-PIX-FMT-YUYV>`,
++        :ref:`YVYU <V4L2-PIX-FMT-YVYU>`,
++        :ref:`UYVY <V4L2-PIX-FMT-UYVY>`,
++        :ref:`VYUY <V4L2-PIX-FMT-VYUY>`.
++        :ref:`YUV420/YVU420 <V4L2-PIX-FMT-YUV420>`,
++        :ref:`NV12/NV21 <V4L2-PIX-FMT-NV12>`,
++
++    * - "bcm2835-isp0-capture1"
++      - source
++      - Image statistics calculated from the input image provided on the
++        "bcm2835-isp0-output0" pad.  Statistics are only available for Bayer
++        format input images.
++      - :ref:`v4l2-meta-fmt-bcm2835-isp-stats`.
++
++Pipeline Configuration
++----------------------
++
++The ISP pipeline can be configure through user-space by calling
++:ref:`VIDIOC_S_EXT_CTRLS <VIDIOC_G_EXT_CTRLS>` on the “bcm2835-isp0-output0”
++node with the appropriate parameters as shown in the table below.
++
++.. tabularcolumns:: |p{2cm}|p{5.0cm}|
++
++.. cssclass: longtable
++
++.. flat-table::
++
++    * - *id*
++      - *Parameter*
++
++    * - ``V4L2_CID_USER_BCM2835_ISP_CC_MATRIX``
++      - struct :c:type:`bcm2835_isp_custom_ccm`
++
++    * - ``V4L2_CID_USER_BCM2835_ISP_LENS_SHADING``
++      - struct :c:type:`bcm2835_isp_lens_shading`
++
++    * - ``V4L2_CID_USER_BCM2835_ISP_BLACK_LEVEL``
++      - struct :c:type:`bcm2835_isp_black_level`
++
++    * - ``V4L2_CID_USER_BCM2835_ISP_GEQ``
++      - struct :c:type:`bcm2835_isp_geq`
++
++    * - ``V4L2_CID_USER_BCM2835_ISP_GAMMA``
++      - struct :c:type:`bcm2835_isp_gamma`
++
++    * - ``V4L2_CID_USER_BCM2835_ISP_DENOISE``
++      - struct :c:type:`bcm2835_isp_denoise`
++
++    * - ``V4L2_CID_USER_BCM2835_ISP_SHARPEN``
++      - struct :c:type:`bcm2835_isp_sharpen`
++
++    * - ``V4L2_CID_USER_BCM2835_ISP_DPC``
++      - struct :c:type:`bcm2835_isp_dpc`
++
++++++++++++++++++++++++++
++Configuration Parameters
++++++++++++++++++++++++++
++
++.. kernel-doc:: include/uapi/linux/bcm2835-isp.h
++   :functions: bcm2835_isp_rational bcm2835_isp_ccm bcm2835_isp_custom_ccm
++                bcm2835_isp_gain_format bcm2835_isp_lens_shading
++                bcm2835_isp_black_level bcm2835_isp_geq bcm2835_isp_gamma
++                bcm2835_isp_denoise bcm2835_isp_sharpen
++                bcm2835_isp_dpc_mode bcm2835_isp_dpc
+--- a/Documentation/userspace-api/media/drivers/index.rst
++++ b/Documentation/userspace-api/media/drivers/index.rst
+@@ -32,6 +32,7 @@ For more details see the file COPYING in
+ 	cx2341x-uapi
+ 	dw100
+ 	imx-uapi
++	bcm2835-isp
+ 	max2175
+ 	npcm-video
+ 	omap3isp-uapi
+--- a/include/uapi/linux/v4l2-controls.h
++++ b/include/uapi/linux/v4l2-controls.h
+@@ -215,6 +215,10 @@ enum v4l2_colorfx {
+  */
+ #define V4L2_CID_USER_THP7312_BASE		(V4L2_CID_USER_BASE + 0x11c0)
+ 
++/* The base for the bcm2835-isp driver controls.
++ * We reserve 16 controls for this driver. */
++#define V4L2_CID_USER_BCM2835_ISP_BASE		(V4L2_CID_USER_BASE + 0x10f0)
++
+ /* MPEG-class control IDs */
+ /* The MPEG controls are applicable to all codec controls
+  * and the 'MPEG' part of the define is historical */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0178-staging-vc04_services-mmal-vchiq-Update-parameters-l.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0178-staging-vc04_services-mmal-vchiq-Update-parameters-l.patch
new file mode 100644
index 00000000..81ebe762
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0178-staging-vc04_services-mmal-vchiq-Update-parameters-l.patch
@@ -0,0 +1,28 @@
+From a8715ab1e22a019285b4d6fff49d6a27ba174821 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 15 May 2020 13:42:10 +0100
+Subject: [PATCH 178/697] staging: vc04_services: mmal-vchiq: Update parameters
+ list
+
+Adds in a couple of new MMAL parameter defines.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
+@@ -609,6 +609,12 @@ enum mmal_parameter_video_type {
+ 
+ 	/**< Takes a @ref MMAL_PARAMETER_UINT32_T */
+ 	MMAL_PARAMETER_VIDEO_DROPPABLE_PFRAME_LENGTH,
++
++	/**< Take a @ref MMAL_PARAMETER_VIDEO_STALL_T */
++	MMAL_PARAMETER_VIDEO_STALL_THRESHOLD,
++
++	/**< Take a @ref MMAL_PARAMETER_BOOLEAN_T */
++	MMAL_PARAMETER_VIDEO_ENCODE_HEADERS_WITH_FRAME,
+ };
+ 
+ /** Valid mirror modes */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0179-staging-vc04_services-bcm2835-camera-Request-headers.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0179-staging-vc04_services-bcm2835-camera-Request-headers.patch
new file mode 100644
index 00000000..ebdfbdd2
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0179-staging-vc04_services-bcm2835-camera-Request-headers.patch
@@ -0,0 +1,30 @@
+From 4051f5b2ce60a589f1af19275b9f0e29df811a43 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 15 May 2020 13:48:59 +0100
+Subject: [PATCH 179/697] staging:vc04_services: bcm2835-camera: Request
+ headers with I-frame
+
+V4L2 wishes to have the codec header bytes in the same buffer as the
+first encoded frame, so it does become 1-in 1-out for encoding.
+The firmware now has an option to do this, so enable it.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../staging/vc04_services/bcm2835-camera/bcm2835-camera.c   | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+@@ -1726,6 +1726,12 @@ static int mmal_init(struct bcm2835_mmal
+ 					      MMAL_PARAMETER_MINIMISE_FRAGMENTATION,
+ 					      &enable,
+ 					      sizeof(enable));
++
++		/* Enable inserting headers into the first frame */
++		vchiq_mmal_port_parameter_set(dev->instance,
++					      &dev->component[COMP_VIDEO_ENCODE]->control,
++					      MMAL_PARAMETER_VIDEO_ENCODE_HEADERS_WITH_FRAME,
++					      &enable, sizeof(enable));
+ 	}
+ 	ret = bcm2835_mmal_set_all_camera_controls(dev);
+ 	if (ret < 0) {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0180-gpiolib-Don-t-prevent-IRQ-usage-of-output-GPIOs.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0180-gpiolib-Don-t-prevent-IRQ-usage-of-output-GPIOs.patch
new file mode 100644
index 00000000..251558a2
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0180-gpiolib-Don-t-prevent-IRQ-usage-of-output-GPIOs.patch
@@ -0,0 +1,50 @@
+From 331c34340ffd3be68bda49b63d6e369604296e81 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Tue, 24 Apr 2018 14:42:27 +0100
+Subject: [PATCH 180/697] gpiolib: Don't prevent IRQ usage of output GPIOs
+
+Upstream Linux deems using output GPIOs to generate IRQs as a bogus
+use case, even though the BCM2835 GPIO controller is capable of doing
+so. A number of users would like to make use of this facility, so
+disable the checks.
+
+See: https://github.com/raspberrypi/linux/issues/2527
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/gpio/gpiolib.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -51,6 +51,8 @@
+  * GPIOs can sometimes cost only an instruction or two per bit.
+  */
+ 
++#define dont_test_bit(b,d) (0)
++
+ /* Device and char device-related information */
+ static DEFINE_IDA(gpio_ida);
+ static dev_t gpio_devt;
+@@ -2814,8 +2816,8 @@ int gpiod_direction_output(struct gpio_d
+ 		value = !!value;
+ 
+ 	/* GPIOs used for enabled IRQs shall not be set as output */
+-	if (test_bit(FLAG_USED_AS_IRQ, &flags) &&
+-	    test_bit(FLAG_IRQ_IS_ENABLED, &flags)) {
++	if (dont_test_bit(FLAG_USED_AS_IRQ, &flags) &&
++	    dont_test_bit(FLAG_IRQ_IS_ENABLED, &flags)) {
+ 		gpiod_err(desc,
+ 			  "%s: tried to set a GPIO tied to an IRQ as output\n",
+ 			  __func__);
+@@ -3750,8 +3752,8 @@ int gpiochip_lock_as_irq(struct gpio_chi
+ 	}
+ 
+ 	/* To be valid for IRQ the line needs to be input or open drain */
+-	if (test_bit(FLAG_IS_OUT, &desc->flags) &&
+-	    !test_bit(FLAG_OPEN_DRAIN, &desc->flags)) {
++	if (dont_test_bit(FLAG_IS_OUT, &desc->flags) &&
++	    !dont_test_bit(FLAG_OPEN_DRAIN, &desc->flags)) {
+ 		chip_err(gc,
+ 			 "%s: tried to flag a GPIO set as output for IRQ\n",
+ 			 __func__);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0181-brcmfmac-Prefer-a-ccode-from-OTP-over-nvram-file.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0181-brcmfmac-Prefer-a-ccode-from-OTP-over-nvram-file.patch
new file mode 100644
index 00000000..a88bd1fa
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0181-brcmfmac-Prefer-a-ccode-from-OTP-over-nvram-file.patch
@@ -0,0 +1,130 @@
+From 11eff4f1b213f002c9750b136a0916f8f976c260 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 26 Jun 2020 11:51:05 +0100
+Subject: [PATCH 181/697] brcmfmac: Prefer a ccode from OTP over nvram file
+
+Allow the nvram file to set a default ccode (regulatory domain) without
+overriding one set in OTP.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c    | 39 +++++++++++++------
+ .../broadcom/brcm80211/brcmfmac/firmware.c    | 21 +++++++++-
+ 2 files changed, 47 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -9,6 +9,7 @@
+ #include <linux/etherdevice.h>
+ #include <linux/module.h>
+ #include <linux/vmalloc.h>
++#include <linux/ctype.h>
+ #include <net/cfg80211.h>
+ #include <net/netlink.h>
+ #include <uapi/linux/if_arp.h>
+@@ -8184,31 +8185,45 @@ static void brcmf_cfg80211_reg_notifier(
+ 	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
+ 	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_fil_country_le ccreq;
++	char *alpha2;
+ 	s32 err;
+ 	int i;
+ 
+-	/* The country code gets set to "00" by default at boot, ignore */
+-	if (req->alpha2[0] == '0' && req->alpha2[1] == '0')
++	err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
++	if (err) {
++		bphy_err(drvr, "Country code iovar returned err = %d\n", err);
+ 		return;
++	}
++
++	/* The country code gets set to "00" by default at boot - substitute
++	 * any saved ccode from the nvram file unless there is a valid code
++	 * already set.
++	 */
++	alpha2 = req->alpha2;
++	if (alpha2[0] == '0' && alpha2[1] == '0') {
++		extern char saved_ccode[2];
++
++		if ((isupper(ccreq.country_abbrev[0]) &&
++		     isupper(ccreq.country_abbrev[1])) ||
++		    !saved_ccode[0])
++			return;
++		alpha2 = saved_ccode;
++		pr_debug("brcmfmac: substituting saved ccode %c%c\n",
++			 alpha2[0], alpha2[1]);
++	}
+ 
+ 	/* ignore non-ISO3166 country codes */
+ 	for (i = 0; i < 2; i++)
+-		if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
++		if (alpha2[i] < 'A' || alpha2[i] > 'Z') {
+ 			bphy_err(drvr, "not an ISO3166 code (0x%02x 0x%02x)\n",
+-				 req->alpha2[0], req->alpha2[1]);
++				 alpha2[0], alpha2[1]);
+ 			return;
+ 		}
+ 
+ 	brcmf_dbg(TRACE, "Enter: initiator=%d, alpha=%c%c\n", req->initiator,
+-		  req->alpha2[0], req->alpha2[1]);
+-
+-	err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
+-	if (err) {
+-		bphy_err(drvr, "Country code iovar returned err = %d\n", err);
+-		return;
+-	}
++		  alpha2[0], alpha2[1]);
+ 
+-	err = brcmf_translate_country_code(ifp->drvr, req->alpha2, &ccreq);
++	err = brcmf_translate_country_code(ifp->drvr, alpha2, &ccreq);
+ 	if (err)
+ 		return;
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -10,6 +10,7 @@
+ #include <linux/firmware.h>
+ #include <linux/module.h>
+ #include <linux/bcm47xx_nvram.h>
++#include <linux/ctype.h>
+ 
+ #include "debug.h"
+ #include "firmware.h"
+@@ -32,6 +33,8 @@ enum nvram_parser_state {
+ 	END
+ };
+ 
++char saved_ccode[2] = {};
++
+ /**
+  * struct nvram_parser - internal info for parser.
+  *
+@@ -562,11 +565,27 @@ static int brcmf_fw_request_nvram_done(c
+ 			goto fail;
+ 	}
+ 
+-	if (data)
++	if (data) {
++		char *ccode = strnstr((char *)data, "ccode=", data_len);
++		/* Ensure this is a whole token */
++		if (ccode && ((void *)ccode == (void *)data || isspace(ccode[-1]))) {
++			/* Comment out the line */
++			ccode[0] = '#';
++			ccode += 6;
++			if (isupper(ccode[0]) && isupper(ccode[1]) &&
++			    isspace(ccode[2])) {
++				pr_debug("brcmfmac: intercepting ccode=%c%c\n",
++					 ccode[0], ccode[1]);
++				saved_ccode[0] = ccode[0];
++				saved_ccode[1] = ccode[1];
++			}
++		};
++
+ 		nvram = brcmf_fw_nvram_strip(data, data_len, &nvram_length,
+ 					     fwctx->req->domain_nr,
+ 					     fwctx->req->bus_nr,
+ 					     fwctx->dev);
++	}
+ 
+ 	if (free_bcm47xx_nvram)
+ 		bcm47xx_nvram_release_contents(data);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0182-media-bcm2835-unicam-Driver-for-CCP2-CSI2-camera-int.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0182-media-bcm2835-unicam-Driver-for-CCP2-CSI2-camera-int.patch
new file mode 100644
index 00000000..90375749
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0182-media-bcm2835-unicam-Driver-for-CCP2-CSI2-camera-int.patch
@@ -0,0 +1,3144 @@
+From 1281be9698a7449b041ef6b15c857f57ca2a2235 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Mon, 4 May 2020 12:25:41 +0300
+Subject: [PATCH 182/697] media: bcm2835-unicam: Driver for CCP2/CSI2 camera
+ interface
+
+Add a driver for the Unicam camera receiver block on BCM283x processors.
+Compared to the bcm2835-camera driver present in staging, this driver
+handles the Unicam block only (CSI-2 receiver), and doesn't depend on
+the VC4 firmware running on the VPU.
+
+The commit is made up of a series of changes cherry-picked from the
+rpi-5.4.y branch of https://github.com/raspberrypi/linux/ with
+additional enhancements, forward-ported to the mainline kernel.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reported-by: kbuild test robot <lkp@intel.com>
+---
+ drivers/media/platform/bcm2835/Kconfig        |   21 +
+ drivers/media/platform/bcm2835/Makefile       |    3 +
+ .../media/platform/bcm2835/bcm2835-unicam.c   | 2825 +++++++++++++++++
+ .../media/platform/bcm2835/vc4-regs-unicam.h  |  253 ++
+ 4 files changed, 3102 insertions(+)
+ create mode 100644 drivers/media/platform/bcm2835/Kconfig
+ create mode 100644 drivers/media/platform/bcm2835/Makefile
+ create mode 100644 drivers/media/platform/bcm2835/bcm2835-unicam.c
+ create mode 100644 drivers/media/platform/bcm2835/vc4-regs-unicam.h
+
+--- /dev/null
++++ b/drivers/media/platform/bcm2835/Kconfig
+@@ -0,0 +1,21 @@
++# Broadcom VideoCore4 V4L2 camera support
++
++config VIDEO_BCM2835_UNICAM
++	tristate "Broadcom BCM283x/BCM271x Unicam video capture driver"
++	depends on VIDEO_DEV
++	depends on ARCH_BCM2835 || COMPILE_TEST
++	select VIDEO_V4L2_SUBDEV_API
++	select MEDIA_CONTROLLER
++	select VIDEOBUF2_DMA_CONTIG
++	select V4L2_FWNODE
++	help
++	  Say Y here to enable support for the BCM283x/BCM271x CSI-2 receiver.
++	  This is a V4L2 driver that controls the CSI-2 receiver directly,
++	  independently from the VC4 firmware.
++	  This driver is mutually exclusive with the use of bcm2835-camera. The
++	  firmware will disable all access to the peripheral from within the
++	  firmware if it finds a DT node using it, and bcm2835-camera will
++	  therefore fail to probe.
++
++	  To compile this driver as a module, choose M here. The module will be
++	  called bcm2835-unicam.
+--- /dev/null
++++ b/drivers/media/platform/bcm2835/Makefile
+@@ -0,0 +1,3 @@
++# Makefile for BCM2835 Unicam driver
++
++obj-$(CONFIG_VIDEO_BCM2835_UNICAM) += bcm2835-unicam.o
+--- /dev/null
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -0,0 +1,2825 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * BCM2835 Unicam Capture Driver
++ *
++ * Copyright (C) 2017-2020 - Raspberry Pi (Trading) Ltd.
++ *
++ * Dave Stevenson <dave.stevenson@raspberrypi.com>
++ *
++ * Based on TI am437x driver by
++ *   Benoit Parrot <bparrot@ti.com>
++ *   Lad, Prabhakar <prabhakar.csengg@gmail.com>
++ *
++ * and TI CAL camera interface driver by
++ *    Benoit Parrot <bparrot@ti.com>
++ *
++ *
++ * There are two camera drivers in the kernel for BCM283x - this one
++ * and bcm2835-camera (currently in staging).
++ *
++ * This driver directly controls the Unicam peripheral - there is no
++ * involvement with the VideoCore firmware. Unicam receives CSI-2 or
++ * CCP2 data and writes it into SDRAM.
++ * The only potential processing options are to repack Bayer data into an
++ * alternate format, and applying windowing.
++ * The repacking does not shift the data, so can repack V4L2_PIX_FMT_Sxxxx10P
++ * to V4L2_PIX_FMT_Sxxxx10, or V4L2_PIX_FMT_Sxxxx12P to V4L2_PIX_FMT_Sxxxx12,
++ * but not generically up to V4L2_PIX_FMT_Sxxxx16. The driver will add both
++ * formats where the relevant formats are defined, and will automatically
++ * configure the repacking as required.
++ * Support for windowing may be added later.
++ *
++ * It should be possible to connect this driver to any sensor with a
++ * suitable output interface and V4L2 subdevice driver.
++ *
++ * bcm2835-camera uses the VideoCore firmware to control the sensor,
++ * Unicam, ISP, and all tuner control loops. Fully processed frames are
++ * delivered to the driver by the firmware. It only has sensor drivers
++ * for Omnivision OV5647, and Sony IMX219 sensors.
++ *
++ * The two drivers are mutually exclusive for the same Unicam instance.
++ * The VideoCore firmware checks the device tree configuration during boot.
++ * If it finds device tree nodes called csi0 or csi1 it will block the
++ * firmware from accessing the peripheral, and bcm2835-camera will
++ * not be able to stream data.
++ */
++
++#include <linux/clk.h>
++#include <linux/delay.h>
++#include <linux/device.h>
++#include <linux/dma-mapping.h>
++#include <linux/err.h>
++#include <linux/init.h>
++#include <linux/interrupt.h>
++#include <linux/io.h>
++#include <linux/module.h>
++#include <linux/of_device.h>
++#include <linux/of_graph.h>
++#include <linux/pinctrl/consumer.h>
++#include <linux/platform_device.h>
++#include <linux/pm_runtime.h>
++#include <linux/slab.h>
++#include <linux/uaccess.h>
++#include <linux/videodev2.h>
++
++#include <media/v4l2-common.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-dev.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-dv-timings.h>
++#include <media/v4l2-event.h>
++#include <media/v4l2-ioctl.h>
++#include <media/v4l2-fwnode.h>
++#include <media/videobuf2-dma-contig.h>
++
++#include <media/v4l2-async.h>
++
++#include "vc4-regs-unicam.h"
++
++#define UNICAM_MODULE_NAME	"unicam"
++#define UNICAM_VERSION		"0.1.0"
++
++static int debug;
++module_param(debug, int, 0644);
++MODULE_PARM_DESC(debug, "Debug level 0-3");
++
++#define unicam_dbg(level, dev, fmt, arg...)	\
++		v4l2_dbg(level, debug, &(dev)->v4l2_dev, fmt, ##arg)
++#define unicam_info(dev, fmt, arg...)	\
++		v4l2_info(&(dev)->v4l2_dev, fmt, ##arg)
++#define unicam_err(dev, fmt, arg...)	\
++		v4l2_err(&(dev)->v4l2_dev, fmt, ##arg)
++
++/*
++ * To protect against a dodgy sensor driver never returning an error from
++ * enum_mbus_code, set a maximum index value to be used.
++ */
++#define MAX_ENUM_MBUS_CODE	128
++
++/*
++ * Stride is a 16 bit register, but also has to be a multiple of 32.
++ */
++#define BPL_ALIGNMENT		32
++#define MAX_BYTESPERLINE	((1 << 16) - BPL_ALIGNMENT)
++/*
++ * Max width is therefore determined by the max stride divided by
++ * the number of bits per pixel. Take 32bpp as a
++ * worst case.
++ * No imposed limit on the height, so adopt a square image for want
++ * of anything better.
++ */
++#define MAX_WIDTH		(MAX_BYTESPERLINE / 4)
++#define MAX_HEIGHT		MAX_WIDTH
++/* Define a nominal minimum image size */
++#define MIN_WIDTH		16
++#define MIN_HEIGHT		16
++/* Default size of the embedded buffer */
++#define UNICAM_EMBEDDED_SIZE	8192
++
++/*
++ * Size of the dummy buffer. Can be any size really, but the DMA
++ * allocation works in units of page sizes.
++ */
++#define DUMMY_BUF_SIZE		(PAGE_SIZE)
++
++enum pad_types {
++	IMAGE_PAD,
++	METADATA_PAD,
++	MAX_NODES
++};
++
++/*
++ * struct unicam_fmt - Unicam media bus format information
++ * @pixelformat: V4L2 pixel format FCC identifier. 0 if n/a.
++ * @repacked_fourcc: V4L2 pixel format FCC identifier if the data is expanded
++ * out to 16bpp. 0 if n/a.
++ * @code: V4L2 media bus format code.
++ * @depth: Bits per pixel as delivered from the source.
++ * @csi_dt: CSI data type.
++ * @check_variants: Flag to denote that there are multiple mediabus formats
++ *		still in the list that could match this V4L2 format.
++ */
++struct unicam_fmt {
++	u32	fourcc;
++	u32	repacked_fourcc;
++	u32	code;
++	u8	depth;
++	u8	csi_dt;
++	u8	check_variants;
++};
++
++static const struct unicam_fmt formats[] = {
++	/* YUV Formats */
++	{
++		.fourcc		= V4L2_PIX_FMT_YUYV,
++		.code		= MEDIA_BUS_FMT_YUYV8_2X8,
++		.depth		= 16,
++		.csi_dt		= 0x1e,
++		.check_variants = 1,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_UYVY,
++		.code		= MEDIA_BUS_FMT_UYVY8_2X8,
++		.depth		= 16,
++		.csi_dt		= 0x1e,
++		.check_variants = 1,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_YVYU,
++		.code		= MEDIA_BUS_FMT_YVYU8_2X8,
++		.depth		= 16,
++		.csi_dt		= 0x1e,
++		.check_variants = 1,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_VYUY,
++		.code		= MEDIA_BUS_FMT_VYUY8_2X8,
++		.depth		= 16,
++		.csi_dt		= 0x1e,
++		.check_variants = 1,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_YUYV,
++		.code		= MEDIA_BUS_FMT_YUYV8_1X16,
++		.depth		= 16,
++		.csi_dt		= 0x1e,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_UYVY,
++		.code		= MEDIA_BUS_FMT_UYVY8_1X16,
++		.depth		= 16,
++		.csi_dt		= 0x1e,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_YVYU,
++		.code		= MEDIA_BUS_FMT_YVYU8_1X16,
++		.depth		= 16,
++		.csi_dt		= 0x1e,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_VYUY,
++		.code		= MEDIA_BUS_FMT_VYUY8_1X16,
++		.depth		= 16,
++		.csi_dt		= 0x1e,
++	}, {
++	/* RGB Formats */
++		.fourcc		= V4L2_PIX_FMT_RGB565, /* gggbbbbb rrrrrggg */
++		.code		= MEDIA_BUS_FMT_RGB565_2X8_LE,
++		.depth		= 16,
++		.csi_dt		= 0x22,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_RGB565X, /* rrrrrggg gggbbbbb */
++		.code		= MEDIA_BUS_FMT_RGB565_2X8_BE,
++		.depth		= 16,
++		.csi_dt		= 0x22
++	}, {
++		.fourcc		= V4L2_PIX_FMT_RGB555, /* gggbbbbb arrrrrgg */
++		.code		= MEDIA_BUS_FMT_RGB555_2X8_PADHI_LE,
++		.depth		= 16,
++		.csi_dt		= 0x21,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_RGB555X, /* arrrrrgg gggbbbbb */
++		.code		= MEDIA_BUS_FMT_RGB555_2X8_PADHI_BE,
++		.depth		= 16,
++		.csi_dt		= 0x21,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_RGB24, /* rgb */
++		.code		= MEDIA_BUS_FMT_RGB888_1X24,
++		.depth		= 24,
++		.csi_dt		= 0x24,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_BGR24, /* bgr */
++		.code		= MEDIA_BUS_FMT_BGR888_1X24,
++		.depth		= 24,
++		.csi_dt		= 0x24,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_RGB32, /* argb */
++		.code		= MEDIA_BUS_FMT_ARGB8888_1X32,
++		.depth		= 32,
++		.csi_dt		= 0x0,
++	}, {
++	/* Bayer Formats */
++		.fourcc		= V4L2_PIX_FMT_SBGGR8,
++		.code		= MEDIA_BUS_FMT_SBGGR8_1X8,
++		.depth		= 8,
++		.csi_dt		= 0x2a,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SGBRG8,
++		.code		= MEDIA_BUS_FMT_SGBRG8_1X8,
++		.depth		= 8,
++		.csi_dt		= 0x2a,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SGRBG8,
++		.code		= MEDIA_BUS_FMT_SGRBG8_1X8,
++		.depth		= 8,
++		.csi_dt		= 0x2a,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SRGGB8,
++		.code		= MEDIA_BUS_FMT_SRGGB8_1X8,
++		.depth		= 8,
++		.csi_dt		= 0x2a,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SBGGR10P,
++		.repacked_fourcc = V4L2_PIX_FMT_SBGGR10,
++		.code		= MEDIA_BUS_FMT_SBGGR10_1X10,
++		.depth		= 10,
++		.csi_dt		= 0x2b,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SGBRG10P,
++		.repacked_fourcc = V4L2_PIX_FMT_SGBRG10,
++		.code		= MEDIA_BUS_FMT_SGBRG10_1X10,
++		.depth		= 10,
++		.csi_dt		= 0x2b,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SGRBG10P,
++		.repacked_fourcc = V4L2_PIX_FMT_SGRBG10,
++		.code		= MEDIA_BUS_FMT_SGRBG10_1X10,
++		.depth		= 10,
++		.csi_dt		= 0x2b,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SRGGB10P,
++		.repacked_fourcc = V4L2_PIX_FMT_SRGGB10,
++		.code		= MEDIA_BUS_FMT_SRGGB10_1X10,
++		.depth		= 10,
++		.csi_dt		= 0x2b,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SBGGR12P,
++		.repacked_fourcc = V4L2_PIX_FMT_SBGGR12,
++		.code		= MEDIA_BUS_FMT_SBGGR12_1X12,
++		.depth		= 12,
++		.csi_dt		= 0x2c,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SGBRG12P,
++		.repacked_fourcc = V4L2_PIX_FMT_SGBRG12,
++		.code		= MEDIA_BUS_FMT_SGBRG12_1X12,
++		.depth		= 12,
++		.csi_dt		= 0x2c,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SGRBG12P,
++		.repacked_fourcc = V4L2_PIX_FMT_SGRBG12,
++		.code		= MEDIA_BUS_FMT_SGRBG12_1X12,
++		.depth		= 12,
++		.csi_dt		= 0x2c,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SRGGB12P,
++		.repacked_fourcc = V4L2_PIX_FMT_SRGGB12,
++		.code		= MEDIA_BUS_FMT_SRGGB12_1X12,
++		.depth		= 12,
++		.csi_dt		= 0x2c,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SBGGR14P,
++		.code		= MEDIA_BUS_FMT_SBGGR14_1X14,
++		.depth		= 14,
++		.csi_dt		= 0x2d,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SGBRG14P,
++		.code		= MEDIA_BUS_FMT_SGBRG14_1X14,
++		.depth		= 14,
++		.csi_dt		= 0x2d,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SGRBG14P,
++		.code		= MEDIA_BUS_FMT_SGRBG14_1X14,
++		.depth		= 14,
++		.csi_dt		= 0x2d,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SRGGB14P,
++		.code		= MEDIA_BUS_FMT_SRGGB14_1X14,
++		.depth		= 14,
++		.csi_dt		= 0x2d,
++	}, {
++	/*
++	 * 16 bit Bayer formats could be supported, but there is no CSI2
++	 * data_type defined for raw 16, and no sensors that produce it at
++	 * present.
++	 */
++
++	/* Greyscale formats */
++		.fourcc		= V4L2_PIX_FMT_GREY,
++		.code		= MEDIA_BUS_FMT_Y8_1X8,
++		.depth		= 8,
++		.csi_dt		= 0x2a,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_Y10P,
++		.repacked_fourcc = V4L2_PIX_FMT_Y10,
++		.code		= MEDIA_BUS_FMT_Y10_1X10,
++		.depth		= 10,
++		.csi_dt		= 0x2b,
++	}, {
++		/* NB There is no packed V4L2 fourcc for this format. */
++		.repacked_fourcc = V4L2_PIX_FMT_Y12,
++		.code		= MEDIA_BUS_FMT_Y12_1X12,
++		.depth		= 12,
++		.csi_dt		= 0x2c,
++	},
++	/* Embedded data format */
++	{
++		.fourcc		= V4L2_META_FMT_SENSOR_DATA,
++		.code		= MEDIA_BUS_FMT_SENSOR_DATA,
++		.depth		= 8,
++	}
++};
++
++struct unicam_buffer {
++	struct vb2_v4l2_buffer vb;
++	struct list_head list;
++};
++
++static inline struct unicam_buffer *to_unicam_buffer(struct vb2_buffer *vb)
++{
++	return container_of(vb, struct unicam_buffer, vb.vb2_buf);
++}
++
++struct unicam_node {
++	bool registered;
++	int open;
++	bool streaming;
++	unsigned int pad_id;
++	/* Pointer pointing to current v4l2_buffer */
++	struct unicam_buffer *cur_frm;
++	/* Pointer pointing to next v4l2_buffer */
++	struct unicam_buffer *next_frm;
++	/* video capture */
++	const struct unicam_fmt *fmt;
++	/* Used to store current pixel format */
++	struct v4l2_format v_fmt;
++	/* Used to store current mbus frame format */
++	struct v4l2_mbus_framefmt m_fmt;
++	/* Buffer queue used in video-buf */
++	struct vb2_queue buffer_queue;
++	/* Queue of filled frames */
++	struct list_head dma_queue;
++	/* IRQ lock for DMA queue */
++	spinlock_t dma_queue_lock;
++	/* lock used to access this structure */
++	struct mutex lock;
++	/* Identifies video device for this channel */
++	struct video_device video_dev;
++	/* Pointer to the parent handle */
++	struct unicam_device *dev;
++	struct media_pad pad;
++	unsigned int embedded_lines;
++	/*
++	 * Dummy buffer intended to be used by unicam
++	 * if we have no other queued buffers to swap to.
++	 */
++	void *dummy_buf_cpu_addr;
++	dma_addr_t dummy_buf_dma_addr;
++};
++
++struct unicam_device {
++	struct kref kref;
++
++	/* V4l2 specific parameters */
++	struct v4l2_async_subdev asd;
++
++	/* peripheral base address */
++	void __iomem *base;
++	/* clock gating base address */
++	void __iomem *clk_gate_base;
++	/* clock handle */
++	struct clk *clock;
++	/* V4l2 device */
++	struct v4l2_device v4l2_dev;
++	struct media_device mdev;
++
++	/* parent device */
++	struct platform_device *pdev;
++	/* subdevice async Notifier */
++	struct v4l2_async_notifier notifier;
++	unsigned int sequence;
++
++	/* ptr to  sub device */
++	struct v4l2_subdev *sensor;
++	/* Pad config for the sensor */
++	struct v4l2_subdev_pad_config *sensor_config;
++
++	enum v4l2_mbus_type bus_type;
++	/*
++	 * Stores bus.mipi_csi2.flags for CSI2 sensors, or
++	 * bus.mipi_csi1.strobe for CCP2.
++	 */
++	unsigned int bus_flags;
++	unsigned int max_data_lanes;
++	unsigned int active_data_lanes;
++	bool sensor_embedded_data;
++
++	struct unicam_node node[MAX_NODES];
++	struct v4l2_ctrl_handler ctrl_handler;
++};
++
++static inline struct unicam_device *
++to_unicam_device(struct v4l2_device *v4l2_dev)
++{
++	return container_of(v4l2_dev, struct unicam_device, v4l2_dev);
++}
++
++/* Hardware access */
++static inline void clk_write(struct unicam_device *dev, u32 val)
++{
++	writel(val | 0x5a000000, dev->clk_gate_base);
++}
++
++static inline u32 reg_read(struct unicam_device *dev, u32 offset)
++{
++	return readl(dev->base + offset);
++}
++
++static inline void reg_write(struct unicam_device *dev, u32 offset, u32 val)
++{
++	writel(val, dev->base + offset);
++}
++
++static inline int get_field(u32 value, u32 mask)
++{
++	return (value & mask) >> __ffs(mask);
++}
++
++static inline void set_field(u32 *valp, u32 field, u32 mask)
++{
++	u32 val = *valp;
++
++	val &= ~mask;
++	val |= (field << __ffs(mask)) & mask;
++	*valp = val;
++}
++
++static inline u32 reg_read_field(struct unicam_device *dev, u32 offset,
++				 u32 mask)
++{
++	return get_field(reg_read(dev, offset), mask);
++}
++
++static inline void reg_write_field(struct unicam_device *dev, u32 offset,
++				   u32 field, u32 mask)
++{
++	u32 val = reg_read(dev, offset);
++
++	set_field(&val, field, mask);
++	reg_write(dev, offset, val);
++}
++
++/* Power management functions */
++static inline int unicam_runtime_get(struct unicam_device *dev)
++{
++	return pm_runtime_get_sync(&dev->pdev->dev);
++}
++
++static inline void unicam_runtime_put(struct unicam_device *dev)
++{
++	pm_runtime_put_sync(&dev->pdev->dev);
++}
++
++/* Format setup functions */
++static const struct unicam_fmt *find_format_by_code(u32 code)
++{
++	unsigned int i;
++
++	for (i = 0; i < ARRAY_SIZE(formats); i++) {
++		if (formats[i].code == code)
++			return &formats[i];
++	}
++
++	return NULL;
++}
++
++static int check_mbus_format(struct unicam_device *dev,
++			     const struct unicam_fmt *format)
++{
++	unsigned int i;
++	int ret = 0;
++
++	for (i = 0; !ret && i < MAX_ENUM_MBUS_CODE; i++) {
++		struct v4l2_subdev_mbus_code_enum mbus_code = {
++			.index = i,
++			.pad = IMAGE_PAD,
++			.which = V4L2_SUBDEV_FORMAT_ACTIVE,
++		};
++
++		ret = v4l2_subdev_call(dev->sensor, pad, enum_mbus_code,
++				       NULL, &mbus_code);
++
++		if (!ret && mbus_code.code == format->code)
++			return 1;
++	}
++
++	return 0;
++}
++
++static const struct unicam_fmt *find_format_by_pix(struct unicam_device *dev,
++						   u32 pixelformat)
++{
++	unsigned int i;
++
++	for (i = 0; i < ARRAY_SIZE(formats); i++) {
++		if (formats[i].fourcc == pixelformat ||
++		    formats[i].repacked_fourcc == pixelformat) {
++			if (formats[i].check_variants &&
++			    !check_mbus_format(dev, &formats[i]))
++				continue;
++			return &formats[i];
++		}
++	}
++
++	return NULL;
++}
++
++static inline unsigned int bytes_per_line(u32 width,
++					  const struct unicam_fmt *fmt,
++					  u32 v4l2_fourcc)
++{
++	if (v4l2_fourcc == fmt->repacked_fourcc)
++		/* Repacking always goes to 16bpp */
++		return ALIGN(width << 1, BPL_ALIGNMENT);
++	else
++		return ALIGN((width * fmt->depth) >> 3, BPL_ALIGNMENT);
++}
++
++static int __subdev_get_format(struct unicam_device *dev,
++			       struct v4l2_mbus_framefmt *fmt, int pad_id)
++{
++	struct v4l2_subdev_format sd_fmt = {
++		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
++		.pad = pad_id
++	};
++	int ret;
++
++	ret = v4l2_subdev_call(dev->sensor, pad, get_fmt, dev->sensor_config,
++			       &sd_fmt);
++	if (ret < 0)
++		return ret;
++
++	*fmt = sd_fmt.format;
++
++	unicam_dbg(1, dev, "%s %dx%d code:%04x\n", __func__,
++		   fmt->width, fmt->height, fmt->code);
++
++	return 0;
++}
++
++static int __subdev_set_format(struct unicam_device *dev,
++			       struct v4l2_mbus_framefmt *fmt, int pad_id)
++{
++	struct v4l2_subdev_format sd_fmt = {
++		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
++		.pad = pad_id
++	};
++	int ret;
++
++	sd_fmt.format = *fmt;
++
++	ret = v4l2_subdev_call(dev->sensor, pad, set_fmt, dev->sensor_config,
++			       &sd_fmt);
++	if (ret < 0)
++		return ret;
++
++	*fmt = sd_fmt.format;
++
++	if (pad_id == IMAGE_PAD)
++		unicam_dbg(1, dev, "%s %dx%d code:%04x\n", __func__, fmt->width,
++			   fmt->height, fmt->code);
++	else
++		unicam_dbg(1, dev, "%s Embedded data code:%04x\n", __func__,
++			   sd_fmt.format.code);
++
++	return 0;
++}
++
++static int unicam_calc_format_size_bpl(struct unicam_device *dev,
++				       const struct unicam_fmt *fmt,
++				       struct v4l2_format *f)
++{
++	unsigned int min_bytesperline;
++
++	v4l_bound_align_image(&f->fmt.pix.width, MIN_WIDTH, MAX_WIDTH, 2,
++			      &f->fmt.pix.height, MIN_HEIGHT, MAX_HEIGHT, 0,
++			      0);
++
++	min_bytesperline = bytes_per_line(f->fmt.pix.width, fmt,
++					  f->fmt.pix.pixelformat);
++
++	if (f->fmt.pix.bytesperline > min_bytesperline &&
++	    f->fmt.pix.bytesperline <= MAX_BYTESPERLINE)
++		f->fmt.pix.bytesperline = ALIGN(f->fmt.pix.bytesperline,
++						BPL_ALIGNMENT);
++	else
++		f->fmt.pix.bytesperline = min_bytesperline;
++
++	f->fmt.pix.sizeimage = f->fmt.pix.height * f->fmt.pix.bytesperline;
++
++	unicam_dbg(3, dev, "%s: fourcc: %08X size: %dx%d bpl:%d img_size:%d\n",
++		   __func__,
++		   f->fmt.pix.pixelformat,
++		   f->fmt.pix.width, f->fmt.pix.height,
++		   f->fmt.pix.bytesperline, f->fmt.pix.sizeimage);
++
++	return 0;
++}
++
++static int unicam_reset_format(struct unicam_node *node)
++{
++	struct unicam_device *dev = node->dev;
++	struct v4l2_mbus_framefmt mbus_fmt;
++	int ret;
++
++	if (dev->sensor_embedded_data || node->pad_id != METADATA_PAD) {
++		ret = __subdev_get_format(dev, &mbus_fmt, node->pad_id);
++		if (ret) {
++			unicam_err(dev, "Failed to get_format - ret %d\n", ret);
++			return ret;
++		}
++
++		if (mbus_fmt.code != node->fmt->code) {
++			unicam_err(dev, "code mismatch - fmt->code %08x, mbus_fmt.code %08x\n",
++				   node->fmt->code, mbus_fmt.code);
++			return ret;
++		}
++	}
++
++	if (node->pad_id == IMAGE_PAD) {
++		v4l2_fill_pix_format(&node->v_fmt.fmt.pix, &mbus_fmt);
++		node->v_fmt.type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
++		unicam_calc_format_size_bpl(dev, node->fmt, &node->v_fmt);
++	} else {
++		node->v_fmt.type = V4L2_BUF_TYPE_META_CAPTURE;
++		node->v_fmt.fmt.meta.dataformat = V4L2_META_FMT_SENSOR_DATA;
++		if (dev->sensor_embedded_data) {
++			node->v_fmt.fmt.meta.buffersize =
++					mbus_fmt.width * mbus_fmt.height;
++			node->embedded_lines = mbus_fmt.height;
++		} else {
++			node->v_fmt.fmt.meta.buffersize = UNICAM_EMBEDDED_SIZE;
++			node->embedded_lines = 1;
++		}
++	}
++
++	node->m_fmt = mbus_fmt;
++	return 0;
++}
++
++static void unicam_wr_dma_addr(struct unicam_device *dev, dma_addr_t dmaaddr,
++			       unsigned int buffer_size, int pad_id)
++{
++	dma_addr_t endaddr = dmaaddr + buffer_size;
++
++	/*
++	 * dmaaddr and endaddr should be a 32-bit address with the top two bits
++	 * set to 0x3 to signify uncached access through the Videocore memory
++	 * controller.
++	 */
++	WARN_ON((dmaaddr >> 30) != 0x3 || (endaddr >> 30) != 0x3);
++
++	if (pad_id == IMAGE_PAD) {
++		reg_write(dev, UNICAM_IBSA0, dmaaddr);
++		reg_write(dev, UNICAM_IBEA0, endaddr);
++	} else {
++		reg_write(dev, UNICAM_DBSA0, dmaaddr);
++		reg_write(dev, UNICAM_DBEA0, endaddr);
++	}
++}
++
++static inline unsigned int unicam_get_lines_done(struct unicam_device *dev)
++{
++	dma_addr_t start_addr, cur_addr;
++	unsigned int stride = dev->node[IMAGE_PAD].v_fmt.fmt.pix.bytesperline;
++	struct unicam_buffer *frm = dev->node[IMAGE_PAD].cur_frm;
++
++	if (!frm)
++		return 0;
++
++	start_addr = vb2_dma_contig_plane_dma_addr(&frm->vb.vb2_buf, 0);
++	cur_addr = reg_read(dev, UNICAM_IBWP);
++	return (unsigned int)(cur_addr - start_addr) / stride;
++}
++
++static inline void unicam_schedule_next_buffer(struct unicam_node *node)
++{
++	struct unicam_device *dev = node->dev;
++	struct unicam_buffer *buf;
++	unsigned int size;
++	dma_addr_t addr;
++
++	buf = list_first_entry(&node->dma_queue, struct unicam_buffer, list);
++	node->next_frm = buf;
++	list_del(&buf->list);
++
++	addr = vb2_dma_contig_plane_dma_addr(&buf->vb.vb2_buf, 0);
++	size = (node->pad_id == IMAGE_PAD) ?
++			node->v_fmt.fmt.pix.sizeimage :
++			node->v_fmt.fmt.meta.buffersize;
++
++	unicam_wr_dma_addr(dev, addr, size, node->pad_id);
++}
++
++static inline void unicam_schedule_dummy_buffer(struct unicam_node *node)
++{
++	struct unicam_device *dev = node->dev;
++
++	unicam_dbg(3, dev, "Scheduling dummy buffer for node %d\n",
++		   node->pad_id);
++
++	unicam_wr_dma_addr(dev, node->dummy_buf_dma_addr, DUMMY_BUF_SIZE,
++			   node->pad_id);
++	node->next_frm = NULL;
++}
++
++static inline void unicam_process_buffer_complete(struct unicam_node *node,
++						  unsigned int sequence)
++{
++	node->cur_frm->vb.field = node->m_fmt.field;
++	node->cur_frm->vb.sequence = sequence;
++
++	vb2_buffer_done(&node->cur_frm->vb.vb2_buf, VB2_BUF_STATE_DONE);
++}
++
++static bool unicam_all_nodes_streaming(struct unicam_device *dev)
++{
++	bool ret;
++
++	ret = dev->node[IMAGE_PAD].open && dev->node[IMAGE_PAD].streaming;
++	ret &= !dev->node[METADATA_PAD].open ||
++	       dev->node[METADATA_PAD].streaming;
++	return ret;
++}
++
++static bool unicam_all_nodes_disabled(struct unicam_device *dev)
++{
++	return !dev->node[IMAGE_PAD].streaming &&
++	       !dev->node[METADATA_PAD].streaming;
++}
++
++static void unicam_queue_event_sof(struct unicam_device *unicam)
++{
++	struct v4l2_event event = {
++		.type = V4L2_EVENT_FRAME_SYNC,
++		.u.frame_sync.frame_sequence = unicam->sequence,
++	};
++
++	v4l2_event_queue(&unicam->node[IMAGE_PAD].video_dev, &event);
++}
++
++/*
++ * unicam_isr : ISR handler for unicam capture
++ * @irq: irq number
++ * @dev_id: dev_id ptr
++ *
++ * It changes status of the captured buffer, takes next buffer from the queue
++ * and sets its address in unicam registers
++ */
++static irqreturn_t unicam_isr(int irq, void *dev)
++{
++	struct unicam_device *unicam = dev;
++	unsigned int lines_done = unicam_get_lines_done(dev);
++	unsigned int sequence = unicam->sequence;
++	unsigned int i;
++	u32 ista, sta;
++	u64 ts;
++
++	/*
++	 * Don't service interrupts if not streaming.
++	 * Avoids issues if the VPU should enable the
++	 * peripheral without the kernel knowing (that
++	 * shouldn't happen, but causes issues if it does).
++	 */
++	if (unicam_all_nodes_disabled(unicam))
++		return IRQ_NONE;
++
++	sta = reg_read(unicam, UNICAM_STA);
++	/* Write value back to clear the interrupts */
++	reg_write(unicam, UNICAM_STA, sta);
++
++	ista = reg_read(unicam, UNICAM_ISTA);
++	/* Write value back to clear the interrupts */
++	reg_write(unicam, UNICAM_ISTA, ista);
++
++	unicam_dbg(3, unicam, "ISR: ISTA: 0x%X, STA: 0x%X, sequence %d, lines done %d",
++		   ista, sta, sequence, lines_done);
++
++	if (!(sta & (UNICAM_IS | UNICAM_PI0)))
++		return IRQ_HANDLED;
++
++	/*
++	 * We must run the frame end handler first. If we have a valid next_frm
++	 * and we get a simultaneout FE + FS interrupt, running the FS handler
++	 * first would null out the next_frm ptr and we would have lost the
++	 * buffer forever.
++	 */
++	if (ista & UNICAM_FEI || sta & UNICAM_PI0) {
++		/*
++		 * Ensure we have swapped buffers already as we can't
++		 * stop the peripheral. If no buffer is available, use a
++		 * dummy buffer to dump out frames until we get a new buffer
++		 * to use.
++		 */
++		for (i = 0; i < ARRAY_SIZE(unicam->node); i++) {
++			if (!unicam->node[i].streaming)
++				continue;
++
++			if (unicam->node[i].cur_frm)
++				unicam_process_buffer_complete(&unicam->node[i],
++							       sequence);
++			unicam->node[i].cur_frm = unicam->node[i].next_frm;
++		}
++		unicam->sequence++;
++	}
++
++	if (ista & UNICAM_FSI) {
++		/*
++		 * Timestamp is to be when the first data byte was captured,
++		 * aka frame start.
++		 */
++		ts = ktime_get_ns();
++		for (i = 0; i < ARRAY_SIZE(unicam->node); i++) {
++			if (!unicam->node[i].streaming)
++				continue;
++
++			if (unicam->node[i].cur_frm)
++				unicam->node[i].cur_frm->vb.vb2_buf.timestamp =
++								ts;
++			/*
++			 * Set the next frame output to go to a dummy frame
++			 * if we have not managed to obtain another frame
++			 * from the queue.
++			 */
++			unicam_schedule_dummy_buffer(&unicam->node[i]);
++		}
++
++		unicam_queue_event_sof(unicam);
++	}
++
++	/*
++	 * Cannot swap buffer at frame end, there may be a race condition
++	 * where the HW does not actually swap it if the new frame has
++	 * already started.
++	 */
++	if (ista & (UNICAM_FSI | UNICAM_LCI) && !(ista & UNICAM_FEI)) {
++		for (i = 0; i < ARRAY_SIZE(unicam->node); i++) {
++			if (!unicam->node[i].streaming)
++				continue;
++
++			spin_lock(&unicam->node[i].dma_queue_lock);
++			if (!list_empty(&unicam->node[i].dma_queue) &&
++			    !unicam->node[i].next_frm)
++				unicam_schedule_next_buffer(&unicam->node[i]);
++			spin_unlock(&unicam->node[i].dma_queue_lock);
++		}
++	}
++
++	if (reg_read(unicam, UNICAM_ICTL) & UNICAM_FCM) {
++		/* Switch out of trigger mode if selected */
++		reg_write_field(unicam, UNICAM_ICTL, 1, UNICAM_TFC);
++		reg_write_field(unicam, UNICAM_ICTL, 0, UNICAM_FCM);
++	}
++	return IRQ_HANDLED;
++}
++
++static int unicam_querycap(struct file *file, void *priv,
++			   struct v4l2_capability *cap)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	strlcpy(cap->driver, UNICAM_MODULE_NAME, sizeof(cap->driver));
++	strlcpy(cap->card, UNICAM_MODULE_NAME, sizeof(cap->card));
++
++	snprintf(cap->bus_info, sizeof(cap->bus_info),
++		 "platform:%s", dev_name(&dev->pdev->dev));
++
++	cap->capabilities |= V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_META_CAPTURE;
++
++	return 0;
++}
++
++static int unicam_enum_fmt_vid_cap(struct file *file, void  *priv,
++				   struct v4l2_fmtdesc *f)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	unsigned int index = 0;
++	unsigned int i;
++	int ret = 0;
++
++	if (node->pad_id != IMAGE_PAD)
++		return -EINVAL;
++
++	for (i = 0; !ret && i < MAX_ENUM_MBUS_CODE; i++) {
++		struct v4l2_subdev_mbus_code_enum mbus_code = {
++			.index = i,
++			.pad = IMAGE_PAD,
++			.which = V4L2_SUBDEV_FORMAT_ACTIVE,
++		};
++		const struct unicam_fmt *fmt;
++
++		ret = v4l2_subdev_call(dev->sensor, pad, enum_mbus_code,
++				       NULL, &mbus_code);
++		if (ret < 0) {
++			unicam_dbg(2, dev,
++				   "subdev->enum_mbus_code idx %d returned %d - index invalid\n",
++				   i, ret);
++			return -EINVAL;
++		}
++
++		fmt = find_format_by_code(mbus_code.code);
++		if (fmt) {
++			if (fmt->fourcc) {
++				if (index == f->index) {
++					f->pixelformat = fmt->fourcc;
++					break;
++				}
++				index++;
++			}
++			if (fmt->repacked_fourcc) {
++				if (index == f->index) {
++					f->pixelformat = fmt->repacked_fourcc;
++					break;
++				}
++				index++;
++			}
++		}
++	}
++
++	return 0;
++}
++
++static int unicam_g_fmt_vid_cap(struct file *file, void *priv,
++				struct v4l2_format *f)
++{
++	struct v4l2_mbus_framefmt mbus_fmt = {0};
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	const struct unicam_fmt *fmt = NULL;
++	int ret;
++
++	if (node->pad_id != IMAGE_PAD)
++		return -EINVAL;
++
++	/*
++	 * If a flip has occurred in the sensor, the fmt code might have
++	 * changed. So we will need to re-fetch the format from the subdevice.
++	 */
++	ret = __subdev_get_format(dev, &mbus_fmt, node->pad_id);
++	if (ret)
++		return -EINVAL;
++
++	/* Find the V4L2 format from mbus code. We must match a known format. */
++	fmt = find_format_by_code(mbus_fmt.code);
++	if (!fmt)
++		return -EINVAL;
++
++	node->fmt = fmt;
++	node->v_fmt.fmt.pix.pixelformat = fmt->fourcc;
++	*f = node->v_fmt;
++
++	return 0;
++}
++
++static
++const struct unicam_fmt *get_first_supported_format(struct unicam_device *dev)
++{
++	struct v4l2_subdev_mbus_code_enum mbus_code;
++	const struct unicam_fmt *fmt = NULL;
++	unsigned int i;
++	int ret;
++
++	for (i = 0; ret != -EINVAL && ret != -ENOIOCTLCMD; ++i) {
++		memset(&mbus_code, 0, sizeof(mbus_code));
++		mbus_code.index = i;
++		mbus_code.pad = IMAGE_PAD;
++		mbus_code.which = V4L2_SUBDEV_FORMAT_ACTIVE;
++
++		ret = v4l2_subdev_call(dev->sensor, pad, enum_mbus_code, NULL,
++				       &mbus_code);
++		if (ret < 0) {
++			unicam_dbg(2, dev,
++				   "subdev->enum_mbus_code idx %u returned %d - continue\n",
++				   i, ret);
++			continue;
++		}
++
++		unicam_dbg(2, dev, "subdev %s: code: 0x%08x idx: %u\n",
++			   dev->sensor->name, mbus_code.code, i);
++
++		fmt = find_format_by_code(mbus_code.code);
++		unicam_dbg(2, dev, "fmt 0x%08x returned as %p, V4L2 FOURCC 0x%08x, csi_dt 0x%02x\n",
++			   mbus_code.code, fmt, fmt ? fmt->fourcc : 0,
++			   fmt ? fmt->csi_dt : 0);
++		if (fmt)
++			return fmt;
++	}
++
++	return NULL;
++}
++
++static int unicam_try_fmt_vid_cap(struct file *file, void *priv,
++				  struct v4l2_format *f)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	struct v4l2_subdev_format sd_fmt = {
++		.which = V4L2_SUBDEV_FORMAT_TRY,
++		.pad = IMAGE_PAD
++	};
++	struct v4l2_mbus_framefmt *mbus_fmt = &sd_fmt.format;
++	const struct unicam_fmt *fmt;
++	int ret;
++
++	if (node->pad_id != IMAGE_PAD)
++		return -EINVAL;
++
++	fmt = find_format_by_pix(dev, f->fmt.pix.pixelformat);
++	if (!fmt) {
++		/*
++		 * Pixel format not supported by unicam. Choose the first
++		 * supported format, and let the sensor choose something else.
++		 */
++		unicam_dbg(3, dev, "Fourcc format (0x%08x) not found. Use first format.\n",
++			   f->fmt.pix.pixelformat);
++
++		fmt = &formats[0];
++		f->fmt.pix.pixelformat = fmt->fourcc;
++	}
++
++	v4l2_fill_mbus_format(mbus_fmt, &f->fmt.pix, fmt->code);
++	/*
++	 * No support for receiving interlaced video, so never
++	 * request it from the sensor subdev.
++	 */
++	mbus_fmt->field = V4L2_FIELD_NONE;
++
++	ret = v4l2_subdev_call(dev->sensor, pad, set_fmt, dev->sensor_config,
++			       &sd_fmt);
++	if (ret && ret != -ENOIOCTLCMD && ret != -ENODEV)
++		return ret;
++
++	if (mbus_fmt->field != V4L2_FIELD_NONE)
++		unicam_info(dev, "Sensor trying to send interlaced video - results may be unpredictable\n");
++
++	v4l2_fill_pix_format(&f->fmt.pix, &sd_fmt.format);
++	if (mbus_fmt->code != fmt->code) {
++		/* Sensor has returned an alternate format */
++		fmt = find_format_by_code(mbus_fmt->code);
++		if (!fmt) {
++			/*
++			 * The alternate format is one unicam can't support.
++			 * Find the first format that is supported by both, and
++			 * then set that.
++			 */
++			fmt = get_first_supported_format(dev);
++			mbus_fmt->code = fmt->code;
++
++			ret = v4l2_subdev_call(dev->sensor, pad, set_fmt,
++					       dev->sensor_config, &sd_fmt);
++			if (ret && ret != -ENOIOCTLCMD && ret != -ENODEV)
++				return ret;
++
++			if (mbus_fmt->field != V4L2_FIELD_NONE)
++				unicam_info(dev, "Sensor trying to send interlaced video - results may be unpredictable\n");
++
++			v4l2_fill_pix_format(&f->fmt.pix, &sd_fmt.format);
++
++			if (mbus_fmt->code != fmt->code) {
++				/*
++				 * We've set a format that the sensor reports
++				 * as being supported, but it refuses to set it.
++				 * Not much else we can do.
++				 * Assume that the sensor driver may accept the
++				 * format when it is set (rather than tried).
++				 */
++				unicam_err(dev, "Sensor won't accept default format, and Unicam can't support sensor default\n");
++			}
++		}
++
++		if (fmt->fourcc)
++			f->fmt.pix.pixelformat = fmt->fourcc;
++		else
++			f->fmt.pix.pixelformat = fmt->repacked_fourcc;
++	}
++
++	return unicam_calc_format_size_bpl(dev, fmt, f);
++}
++
++static int unicam_s_fmt_vid_cap(struct file *file, void *priv,
++				struct v4l2_format *f)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	struct vb2_queue *q = &node->buffer_queue;
++	struct v4l2_mbus_framefmt mbus_fmt = {0};
++	const struct unicam_fmt *fmt;
++	int ret;
++
++	if (vb2_is_busy(q))
++		return -EBUSY;
++
++	ret = unicam_try_fmt_vid_cap(file, priv, f);
++	if (ret < 0)
++		return ret;
++
++	fmt = find_format_by_pix(dev, f->fmt.pix.pixelformat);
++	if (!fmt) {
++		/*
++		 * Unknown pixel format - adopt a default.
++		 * This shouldn't happen as try_fmt should have resolved any
++		 * issues first.
++		 */
++		fmt = get_first_supported_format(dev);
++		if (!fmt)
++			/*
++			 * It shouldn't be possible to get here with no
++			 * supported formats
++			 */
++			return -EINVAL;
++		f->fmt.pix.pixelformat = fmt->fourcc;
++		return -EINVAL;
++	}
++
++	v4l2_fill_mbus_format(&mbus_fmt, &f->fmt.pix, fmt->code);
++
++	ret = __subdev_set_format(dev, &mbus_fmt, node->pad_id);
++	if (ret) {
++		unicam_dbg(3, dev, "%s __subdev_set_format failed %d\n",
++			   __func__, ret);
++		return ret;
++	}
++
++	/* Just double check nothing has gone wrong */
++	if (mbus_fmt.code != fmt->code) {
++		unicam_dbg(3, dev,
++			   "%s subdev changed format on us, this should not happen\n",
++			   __func__);
++		return -EINVAL;
++	}
++
++	node->fmt = fmt;
++	node->v_fmt.fmt.pix.pixelformat = f->fmt.pix.pixelformat;
++	node->v_fmt.fmt.pix.bytesperline = f->fmt.pix.bytesperline;
++	unicam_reset_format(node);
++
++	unicam_dbg(3, dev,
++		   "%s %dx%d, mbus_fmt 0x%08X, V4L2 pix 0x%08X.\n",
++		   __func__, node->v_fmt.fmt.pix.width,
++		   node->v_fmt.fmt.pix.height, mbus_fmt.code,
++		   node->v_fmt.fmt.pix.pixelformat);
++
++	*f = node->v_fmt;
++
++	return 0;
++}
++
++static int unicam_enum_fmt_meta_cap(struct file *file, void *priv,
++				    struct v4l2_fmtdesc *f)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	const struct unicam_fmt *fmt;
++	u32 code;
++	int ret = 0;
++
++	if (node->pad_id != METADATA_PAD || f->index != 0)
++		return -EINVAL;
++
++	if (dev->sensor_embedded_data) {
++		struct v4l2_subdev_mbus_code_enum mbus_code = {
++			.index = f->index,
++			.which = V4L2_SUBDEV_FORMAT_ACTIVE,
++			.pad = METADATA_PAD,
++		};
++
++		ret = v4l2_subdev_call(dev->sensor, pad, enum_mbus_code, NULL,
++				       &mbus_code);
++		if (ret < 0) {
++			unicam_dbg(2, dev,
++				   "subdev->enum_mbus_code idx 0 returned %d - index invalid\n",
++				   ret);
++			return -EINVAL;
++		}
++
++		code = mbus_code.code;
++	} else {
++		code = MEDIA_BUS_FMT_SENSOR_DATA;
++	}
++
++	fmt = find_format_by_code(code);
++	if (fmt)
++		f->pixelformat = fmt->fourcc;
++
++	return 0;
++}
++
++static int unicam_g_fmt_meta_cap(struct file *file, void *priv,
++				 struct v4l2_format *f)
++{
++	struct unicam_node *node = video_drvdata(file);
++
++	if (node->pad_id != METADATA_PAD)
++		return -EINVAL;
++
++	*f = node->v_fmt;
++
++	return 0;
++}
++
++static int unicam_queue_setup(struct vb2_queue *vq,
++			      unsigned int *nbuffers,
++			      unsigned int *nplanes,
++			      unsigned int sizes[],
++			      struct device *alloc_devs[])
++{
++	struct unicam_node *node = vb2_get_drv_priv(vq);
++	struct unicam_device *dev = node->dev;
++	unsigned int size = node->pad_id == IMAGE_PAD ?
++				    node->v_fmt.fmt.pix.sizeimage :
++				    node->v_fmt.fmt.meta.buffersize;
++
++	if (vq->num_buffers + *nbuffers < 3)
++		*nbuffers = 3 - vq->num_buffers;
++
++	if (*nplanes) {
++		if (sizes[0] < size) {
++			unicam_err(dev, "sizes[0] %i < size %u\n", sizes[0],
++				   size);
++			return -EINVAL;
++		}
++		size = sizes[0];
++	}
++
++	*nplanes = 1;
++	sizes[0] = size;
++
++	return 0;
++}
++
++static int unicam_buffer_prepare(struct vb2_buffer *vb)
++{
++	struct unicam_node *node = vb2_get_drv_priv(vb->vb2_queue);
++	struct unicam_device *dev = node->dev;
++	struct unicam_buffer *buf = to_unicam_buffer(vb);
++	unsigned long size;
++
++	if (WARN_ON(!node->fmt))
++		return -EINVAL;
++
++	size = node->pad_id == IMAGE_PAD ? node->v_fmt.fmt.pix.sizeimage :
++					   node->v_fmt.fmt.meta.buffersize;
++	if (vb2_plane_size(vb, 0) < size) {
++		unicam_err(dev, "data will not fit into plane (%lu < %lu)\n",
++			   vb2_plane_size(vb, 0), size);
++		return -EINVAL;
++	}
++
++	vb2_set_plane_payload(&buf->vb.vb2_buf, 0, size);
++	return 0;
++}
++
++static void unicam_buffer_queue(struct vb2_buffer *vb)
++{
++	struct unicam_node *node = vb2_get_drv_priv(vb->vb2_queue);
++	struct unicam_buffer *buf = to_unicam_buffer(vb);
++	unsigned long flags;
++
++	spin_lock_irqsave(&node->dma_queue_lock, flags);
++	list_add_tail(&buf->list, &node->dma_queue);
++	spin_unlock_irqrestore(&node->dma_queue_lock, flags);
++}
++
++static void unicam_set_packing_config(struct unicam_device *dev)
++{
++	u32 pack, unpack;
++	u32 val;
++
++	if (dev->node[IMAGE_PAD].v_fmt.fmt.pix.pixelformat ==
++	    dev->node[IMAGE_PAD].fmt->fourcc) {
++		unpack = UNICAM_PUM_NONE;
++		pack = UNICAM_PPM_NONE;
++	} else {
++		switch (dev->node[IMAGE_PAD].fmt->depth) {
++		case 8:
++			unpack = UNICAM_PUM_UNPACK8;
++			break;
++		case 10:
++			unpack = UNICAM_PUM_UNPACK10;
++			break;
++		case 12:
++			unpack = UNICAM_PUM_UNPACK12;
++			break;
++		case 14:
++			unpack = UNICAM_PUM_UNPACK14;
++			break;
++		case 16:
++			unpack = UNICAM_PUM_UNPACK16;
++			break;
++		default:
++			unpack = UNICAM_PUM_NONE;
++			break;
++		}
++
++		/* Repacking is always to 16bpp */
++		pack = UNICAM_PPM_PACK16;
++	}
++
++	val = 0;
++	set_field(&val, unpack, UNICAM_PUM_MASK);
++	set_field(&val, pack, UNICAM_PPM_MASK);
++	reg_write(dev, UNICAM_IPIPE, val);
++}
++
++static void unicam_cfg_image_id(struct unicam_device *dev)
++{
++	if (dev->bus_type == V4L2_MBUS_CSI2_DPHY) {
++		/* CSI2 mode, hardcode VC 0 for now. */
++		reg_write(dev, UNICAM_IDI0,
++			  (0 << 6) | dev->node[IMAGE_PAD].fmt->csi_dt);
++	} else {
++		/* CCP2 mode */
++		reg_write(dev, UNICAM_IDI0,
++			  0x80 | dev->node[IMAGE_PAD].fmt->csi_dt);
++	}
++}
++
++static void unicam_enable_ed(struct unicam_device *dev)
++{
++	u32 val = reg_read(dev, UNICAM_DCS);
++
++	set_field(&val, 2, UNICAM_EDL_MASK);
++	/* Do not wrap at the end of the embedded data buffer */
++	set_field(&val, 0, UNICAM_DBOB);
++
++	reg_write(dev, UNICAM_DCS, val);
++}
++
++static void unicam_start_rx(struct unicam_device *dev, dma_addr_t *addr)
++{
++	int line_int_freq = dev->node[IMAGE_PAD].v_fmt.fmt.pix.height >> 2;
++	unsigned int size, i;
++	u32 val;
++
++	if (line_int_freq < 128)
++		line_int_freq = 128;
++
++	/* Enable lane clocks */
++	val = 1;
++	for (i = 0; i < dev->active_data_lanes; i++)
++		val = val << 2 | 1;
++	clk_write(dev, val);
++
++	/* Basic init */
++	reg_write(dev, UNICAM_CTRL, UNICAM_MEM);
++
++	/* Enable analogue control, and leave in reset. */
++	val = UNICAM_AR;
++	set_field(&val, 7, UNICAM_CTATADJ_MASK);
++	set_field(&val, 7, UNICAM_PTATADJ_MASK);
++	reg_write(dev, UNICAM_ANA, val);
++	usleep_range(1000, 2000);
++
++	/* Come out of reset */
++	reg_write_field(dev, UNICAM_ANA, 0, UNICAM_AR);
++
++	/* Peripheral reset */
++	reg_write_field(dev, UNICAM_CTRL, 1, UNICAM_CPR);
++	reg_write_field(dev, UNICAM_CTRL, 0, UNICAM_CPR);
++
++	reg_write_field(dev, UNICAM_CTRL, 0, UNICAM_CPE);
++
++	/* Enable Rx control. */
++	val = reg_read(dev, UNICAM_CTRL);
++	if (dev->bus_type == V4L2_MBUS_CSI2_DPHY) {
++		set_field(&val, UNICAM_CPM_CSI2, UNICAM_CPM_MASK);
++		set_field(&val, UNICAM_DCM_STROBE, UNICAM_DCM_MASK);
++	} else {
++		set_field(&val, UNICAM_CPM_CCP2, UNICAM_CPM_MASK);
++		set_field(&val, dev->bus_flags, UNICAM_DCM_MASK);
++	}
++	/* Packet framer timeout */
++	set_field(&val, 0xf, UNICAM_PFT_MASK);
++	set_field(&val, 128, UNICAM_OET_MASK);
++	reg_write(dev, UNICAM_CTRL, val);
++
++	reg_write(dev, UNICAM_IHWIN, 0);
++	reg_write(dev, UNICAM_IVWIN, 0);
++
++	/* AXI bus access QoS setup */
++	val = reg_read(dev, UNICAM_PRI);
++	set_field(&val, 0, UNICAM_BL_MASK);
++	set_field(&val, 0, UNICAM_BS_MASK);
++	set_field(&val, 0xe, UNICAM_PP_MASK);
++	set_field(&val, 8, UNICAM_NP_MASK);
++	set_field(&val, 2, UNICAM_PT_MASK);
++	set_field(&val, 1, UNICAM_PE);
++	reg_write(dev, UNICAM_PRI, val);
++
++	reg_write_field(dev, UNICAM_ANA, 0, UNICAM_DDL);
++
++	/* Always start in trigger frame capture mode (UNICAM_FCM set) */
++	val = UNICAM_FSIE | UNICAM_FEIE | UNICAM_FCM | UNICAM_IBOB;
++	set_field(&val, line_int_freq, UNICAM_LCIE_MASK);
++	reg_write(dev, UNICAM_ICTL, val);
++	reg_write(dev, UNICAM_STA, UNICAM_STA_MASK_ALL);
++	reg_write(dev, UNICAM_ISTA, UNICAM_ISTA_MASK_ALL);
++
++	/* tclk_term_en */
++	reg_write_field(dev, UNICAM_CLT, 2, UNICAM_CLT1_MASK);
++	/* tclk_settle */
++	reg_write_field(dev, UNICAM_CLT, 6, UNICAM_CLT2_MASK);
++	/* td_term_en */
++	reg_write_field(dev, UNICAM_DLT, 2, UNICAM_DLT1_MASK);
++	/* ths_settle */
++	reg_write_field(dev, UNICAM_DLT, 6, UNICAM_DLT2_MASK);
++	/* trx_enable */
++	reg_write_field(dev, UNICAM_DLT, 0, UNICAM_DLT3_MASK);
++
++	reg_write_field(dev, UNICAM_CTRL, 0, UNICAM_SOE);
++
++	/* Packet compare setup - required to avoid missing frame ends */
++	val = 0;
++	set_field(&val, 1, UNICAM_PCE);
++	set_field(&val, 1, UNICAM_GI);
++	set_field(&val, 1, UNICAM_CPH);
++	set_field(&val, 0, UNICAM_PCVC_MASK);
++	set_field(&val, 1, UNICAM_PCDT_MASK);
++	reg_write(dev, UNICAM_CMP0, val);
++
++	/* Enable clock lane and set up terminations */
++	val = 0;
++	if (dev->bus_type == V4L2_MBUS_CSI2_DPHY) {
++		/* CSI2 */
++		set_field(&val, 1, UNICAM_CLE);
++		set_field(&val, 1, UNICAM_CLLPE);
++		if (dev->bus_flags & V4L2_MBUS_CSI2_CONTINUOUS_CLOCK) {
++			set_field(&val, 1, UNICAM_CLTRE);
++			set_field(&val, 1, UNICAM_CLHSE);
++		}
++	} else {
++		/* CCP2 */
++		set_field(&val, 1, UNICAM_CLE);
++		set_field(&val, 1, UNICAM_CLHSE);
++		set_field(&val, 1, UNICAM_CLTRE);
++	}
++	reg_write(dev, UNICAM_CLK, val);
++
++	/*
++	 * Enable required data lanes with appropriate terminations.
++	 * The same value needs to be written to UNICAM_DATn registers for
++	 * the active lanes, and 0 for inactive ones.
++	 */
++	val = 0;
++	if (dev->bus_type == V4L2_MBUS_CSI2_DPHY) {
++		/* CSI2 */
++		set_field(&val, 1, UNICAM_DLE);
++		set_field(&val, 1, UNICAM_DLLPE);
++		if (dev->bus_flags & V4L2_MBUS_CSI2_CONTINUOUS_CLOCK) {
++			set_field(&val, 1, UNICAM_DLTRE);
++			set_field(&val, 1, UNICAM_DLHSE);
++		}
++	} else {
++		/* CCP2 */
++		set_field(&val, 1, UNICAM_DLE);
++		set_field(&val, 1, UNICAM_DLHSE);
++		set_field(&val, 1, UNICAM_DLTRE);
++	}
++	reg_write(dev, UNICAM_DAT0, val);
++
++	if (dev->active_data_lanes == 1)
++		val = 0;
++	reg_write(dev, UNICAM_DAT1, val);
++
++	if (dev->max_data_lanes > 2) {
++		/*
++		 * Registers UNICAM_DAT2 and UNICAM_DAT3 only valid if the
++		 * instance supports more than 2 data lanes.
++		 */
++		if (dev->active_data_lanes == 2)
++			val = 0;
++		reg_write(dev, UNICAM_DAT2, val);
++
++		if (dev->active_data_lanes == 3)
++			val = 0;
++		reg_write(dev, UNICAM_DAT3, val);
++	}
++
++	reg_write(dev, UNICAM_IBLS,
++		  dev->node[IMAGE_PAD].v_fmt.fmt.pix.bytesperline);
++	size = dev->node[IMAGE_PAD].v_fmt.fmt.pix.sizeimage;
++	unicam_wr_dma_addr(dev, addr[IMAGE_PAD], size, IMAGE_PAD);
++	unicam_set_packing_config(dev);
++	unicam_cfg_image_id(dev);
++
++	val = reg_read(dev, UNICAM_MISC);
++	set_field(&val, 1, UNICAM_FL0);
++	set_field(&val, 1, UNICAM_FL1);
++	reg_write(dev, UNICAM_MISC, val);
++
++	if (dev->node[METADATA_PAD].streaming && dev->sensor_embedded_data) {
++		size = dev->node[METADATA_PAD].v_fmt.fmt.meta.buffersize;
++		unicam_enable_ed(dev);
++		unicam_wr_dma_addr(dev, addr[METADATA_PAD], size, METADATA_PAD);
++	}
++
++	/* Enable peripheral */
++	reg_write_field(dev, UNICAM_CTRL, 1, UNICAM_CPE);
++
++	/* Load image pointers */
++	reg_write_field(dev, UNICAM_ICTL, 1, UNICAM_LIP_MASK);
++
++	/* Load embedded data buffer pointers if needed */
++	if (dev->node[METADATA_PAD].streaming && dev->sensor_embedded_data)
++		reg_write_field(dev, UNICAM_DCS, 1, UNICAM_LDP);
++
++	/*
++	 * Enable trigger only for the first frame to
++	 * sync correctly to the FS from the source.
++	 */
++	reg_write_field(dev, UNICAM_ICTL, 1, UNICAM_TFC);
++}
++
++static void unicam_disable(struct unicam_device *dev)
++{
++	/* Analogue lane control disable */
++	reg_write_field(dev, UNICAM_ANA, 1, UNICAM_DDL);
++
++	/* Stop the output engine */
++	reg_write_field(dev, UNICAM_CTRL, 1, UNICAM_SOE);
++
++	/* Disable the data lanes. */
++	reg_write(dev, UNICAM_DAT0, 0);
++	reg_write(dev, UNICAM_DAT1, 0);
++
++	if (dev->max_data_lanes > 2) {
++		reg_write(dev, UNICAM_DAT2, 0);
++		reg_write(dev, UNICAM_DAT3, 0);
++	}
++
++	/* Peripheral reset */
++	reg_write_field(dev, UNICAM_CTRL, 1, UNICAM_CPR);
++	usleep_range(50, 100);
++	reg_write_field(dev, UNICAM_CTRL, 0, UNICAM_CPR);
++
++	/* Disable peripheral */
++	reg_write_field(dev, UNICAM_CTRL, 0, UNICAM_CPE);
++
++	/* Clear ED setup */
++	reg_write(dev, UNICAM_DCS, 0);
++
++	/* Disable all lane clocks */
++	clk_write(dev, 0);
++}
++
++static void unicam_return_buffers(struct unicam_node *node)
++{
++	struct unicam_buffer *buf, *tmp;
++	unsigned long flags;
++
++	spin_lock_irqsave(&node->dma_queue_lock, flags);
++	list_for_each_entry_safe(buf, tmp, &node->dma_queue, list) {
++		list_del(&buf->list);
++		vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
++	}
++
++	if (node->cur_frm)
++		vb2_buffer_done(&node->cur_frm->vb.vb2_buf,
++				VB2_BUF_STATE_ERROR);
++	if (node->next_frm && node->cur_frm != node->next_frm)
++		vb2_buffer_done(&node->next_frm->vb.vb2_buf,
++				VB2_BUF_STATE_ERROR);
++
++	node->cur_frm = NULL;
++	node->next_frm = NULL;
++	spin_unlock_irqrestore(&node->dma_queue_lock, flags);
++}
++
++static int unicam_start_streaming(struct vb2_queue *vq, unsigned int count)
++{
++	struct unicam_node *node = vb2_get_drv_priv(vq);
++	struct unicam_device *dev = node->dev;
++	dma_addr_t buffer_addr[MAX_NODES] = { 0 };
++	unsigned long flags;
++	unsigned int i;
++	int ret;
++
++	node->streaming = true;
++	if (!unicam_all_nodes_streaming(dev)) {
++		unicam_dbg(3, dev, "Not all nodes are streaming yet.");
++		return 0;
++	}
++
++	dev->sequence = 0;
++	ret = unicam_runtime_get(dev);
++	if (ret < 0) {
++		unicam_dbg(3, dev, "unicam_runtime_get failed\n");
++		goto err_streaming;
++	}
++
++	/*
++	 * TODO: Retrieve the number of active data lanes from the connected
++	 * subdevice.
++	 */
++	dev->active_data_lanes = dev->max_data_lanes;
++
++	ret = clk_set_rate(dev->clock, 100 * 1000 * 1000);
++	if (ret) {
++		unicam_err(dev, "failed to set up clock\n");
++		goto err_pm_put;
++	}
++
++	ret = clk_prepare_enable(dev->clock);
++	if (ret) {
++		unicam_err(dev, "Failed to enable CSI clock: %d\n", ret);
++		goto err_pm_put;
++	}
++
++	for (i = 0; i < ARRAY_SIZE(dev->node); i++) {
++		struct unicam_buffer *buf;
++
++		if (!dev->node[i].streaming)
++			continue;
++
++		spin_lock_irqsave(&dev->node[i].dma_queue_lock, flags);
++		buf = list_first_entry(&dev->node[i].dma_queue,
++				       struct unicam_buffer, list);
++		dev->node[i].cur_frm = buf;
++		dev->node[i].next_frm = buf;
++		list_del(&buf->list);
++		spin_unlock_irqrestore(&dev->node[i].dma_queue_lock, flags);
++
++		buffer_addr[i] =
++			vb2_dma_contig_plane_dma_addr(&buf->vb.vb2_buf, 0);
++	}
++
++	unicam_start_rx(dev, buffer_addr);
++
++	ret = v4l2_subdev_call(dev->sensor, video, s_stream, 1);
++	if (ret < 0) {
++		unicam_err(dev, "stream on failed in subdev\n");
++		goto err_disable_unicam;
++	}
++
++	return 0;
++
++err_disable_unicam:
++	unicam_disable(dev);
++	clk_disable_unprepare(dev->clock);
++err_pm_put:
++	unicam_runtime_put(dev);
++err_streaming:
++	unicam_return_buffers(node);
++	node->streaming = false;
++
++	return ret;
++}
++
++static void unicam_stop_streaming(struct vb2_queue *vq)
++{
++	struct unicam_node *node = vb2_get_drv_priv(vq);
++	struct unicam_device *dev = node->dev;
++
++	node->streaming = false;
++
++	if (node->pad_id == IMAGE_PAD) {
++		/*
++		 * Stop streaming the sensor and disable the peripheral.
++		 * We cannot continue streaming embedded data with the
++		 * image pad disabled.
++		 */
++		if (v4l2_subdev_call(dev->sensor, video, s_stream, 0) < 0)
++			unicam_err(dev, "stream off failed in subdev\n");
++
++		unicam_disable(dev);
++		clk_disable_unprepare(dev->clock);
++		unicam_runtime_put(dev);
++
++	} else if (node->pad_id == METADATA_PAD) {
++		/*
++		 * Allow the hardware to spin in the dummy buffer.
++		 * This is only really needed if the embedded data pad is
++		 * disabled before the image pad.
++		 */
++		unicam_wr_dma_addr(dev, node->dummy_buf_dma_addr,
++				   DUMMY_BUF_SIZE, METADATA_PAD);
++	}
++
++	/* Clear all queued buffers for the node */
++	unicam_return_buffers(node);
++}
++
++static int unicam_enum_input(struct file *file, void *priv,
++			     struct v4l2_input *inp)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	if (inp->index != 0)
++		return -EINVAL;
++
++	inp->type = V4L2_INPUT_TYPE_CAMERA;
++	if (v4l2_subdev_has_op(dev->sensor, video, s_dv_timings)) {
++		inp->capabilities = V4L2_IN_CAP_DV_TIMINGS;
++		inp->std = 0;
++	} else if (v4l2_subdev_has_op(dev->sensor, video, s_std)) {
++		inp->capabilities = V4L2_IN_CAP_STD;
++		if (v4l2_subdev_call(dev->sensor, video, g_tvnorms, &inp->std)
++					< 0)
++			inp->std = V4L2_STD_ALL;
++	} else {
++		inp->capabilities = 0;
++		inp->std = 0;
++	}
++	sprintf(inp->name, "Camera 0");
++	return 0;
++}
++
++static int unicam_g_input(struct file *file, void *priv, unsigned int *i)
++{
++	*i = 0;
++
++	return 0;
++}
++
++static int unicam_s_input(struct file *file, void *priv, unsigned int i)
++{
++	/*
++	 * FIXME: Ideally we would like to be able to query the source
++	 * subdevice for information over the input connectors it supports,
++	 * and map that through in to a call to video_ops->s_routing.
++	 * There is no infrastructure support for defining that within
++	 * devicetree at present. Until that is implemented we can't
++	 * map a user physical connector number to s_routing input number.
++	 */
++	if (i > 0)
++		return -EINVAL;
++
++	return 0;
++}
++
++static int unicam_querystd(struct file *file, void *priv,
++			   v4l2_std_id *std)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, video, querystd, std);
++}
++
++static int unicam_g_std(struct file *file, void *priv, v4l2_std_id *std)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, video, g_std, std);
++}
++
++static int unicam_s_std(struct file *file, void *priv, v4l2_std_id std)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	int ret;
++	v4l2_std_id current_std;
++
++	ret = v4l2_subdev_call(dev->sensor, video, g_std, &current_std);
++	if (ret)
++		return ret;
++
++	if (std == current_std)
++		return 0;
++
++	if (vb2_is_busy(&node->buffer_queue))
++		return -EBUSY;
++
++	ret = v4l2_subdev_call(dev->sensor, video, s_std, std);
++
++	/* Force recomputation of bytesperline */
++	node->v_fmt.fmt.pix.bytesperline = 0;
++
++	unicam_reset_format(node);
++
++	return ret;
++}
++
++static int unicam_s_edid(struct file *file, void *priv, struct v4l2_edid *edid)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, pad, set_edid, edid);
++}
++
++static int unicam_g_edid(struct file *file, void *priv, struct v4l2_edid *edid)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, pad, get_edid, edid);
++}
++
++static int unicam_s_selection(struct file *file, void *priv,
++			      struct v4l2_selection *sel)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	struct v4l2_subdev_selection sdsel = {
++		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
++		.target = sel->target,
++		.flags = sel->flags,
++		.r = sel->r,
++	};
++
++	return v4l2_subdev_call(dev->sensor, pad, set_selection, NULL, &sdsel);
++}
++
++static int unicam_g_selection(struct file *file, void *priv,
++			      struct v4l2_selection *sel)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	struct v4l2_subdev_selection sdsel = {
++		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
++		.target = sel->target,
++	};
++	int ret;
++
++	ret = v4l2_subdev_call(dev->sensor, pad, get_selection, NULL, &sdsel);
++	if (!ret)
++		sel->r = sdsel.r;
++
++	return ret;
++}
++
++static int unicam_enum_framesizes(struct file *file, void *priv,
++				  struct v4l2_frmsizeenum *fsize)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	const struct unicam_fmt *fmt;
++	struct v4l2_subdev_frame_size_enum fse;
++	int ret;
++
++	/* check for valid format */
++	fmt = find_format_by_pix(dev, fsize->pixel_format);
++	if (!fmt) {
++		unicam_dbg(3, dev, "Invalid pixel code: %x\n",
++			   fsize->pixel_format);
++		return -EINVAL;
++	}
++	fse.code = fmt->code;
++
++	fse.which = V4L2_SUBDEV_FORMAT_ACTIVE;
++	fse.index = fsize->index;
++	fse.pad = node->pad_id;
++
++	ret = v4l2_subdev_call(dev->sensor, pad, enum_frame_size, NULL, &fse);
++	if (ret)
++		return ret;
++
++	unicam_dbg(1, dev, "%s: index: %d code: %x W:[%d,%d] H:[%d,%d]\n",
++		   __func__, fse.index, fse.code, fse.min_width, fse.max_width,
++		   fse.min_height, fse.max_height);
++
++	fsize->type = V4L2_FRMSIZE_TYPE_DISCRETE;
++	fsize->discrete.width = fse.max_width;
++	fsize->discrete.height = fse.max_height;
++
++	return 0;
++}
++
++static int unicam_enum_frameintervals(struct file *file, void *priv,
++				      struct v4l2_frmivalenum *fival)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	const struct unicam_fmt *fmt;
++	struct v4l2_subdev_frame_interval_enum fie = {
++		.index = fival->index,
++		.width = fival->width,
++		.height = fival->height,
++		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
++	};
++	int ret;
++
++	fmt = find_format_by_pix(dev, fival->pixel_format);
++	if (!fmt)
++		return -EINVAL;
++
++	fie.code = fmt->code;
++	ret = v4l2_subdev_call(dev->sensor, pad, enum_frame_interval,
++			       NULL, &fie);
++	if (ret)
++		return ret;
++
++	fival->type = V4L2_FRMIVAL_TYPE_DISCRETE;
++	fival->discrete = fie.interval;
++
++	return 0;
++}
++
++static int unicam_g_parm(struct file *file, void *fh, struct v4l2_streamparm *a)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_g_parm_cap(video_devdata(file), dev->sensor, a);
++}
++
++static int unicam_s_parm(struct file *file, void *fh, struct v4l2_streamparm *a)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_s_parm_cap(video_devdata(file), dev->sensor, a);
++}
++
++static int unicam_g_dv_timings(struct file *file, void *priv,
++			       struct v4l2_dv_timings *timings)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, video, g_dv_timings, timings);
++}
++
++static int unicam_s_dv_timings(struct file *file, void *priv,
++			       struct v4l2_dv_timings *timings)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	struct v4l2_dv_timings current_timings;
++	int ret;
++
++	ret = v4l2_subdev_call(dev->sensor, video, g_dv_timings,
++			       &current_timings);
++
++	if (v4l2_match_dv_timings(timings, &current_timings, 0, false))
++		return 0;
++
++	if (vb2_is_busy(&node->buffer_queue))
++		return -EBUSY;
++
++	ret = v4l2_subdev_call(dev->sensor, video, s_dv_timings, timings);
++
++	/* Force recomputation of bytesperline */
++	node->v_fmt.fmt.pix.bytesperline = 0;
++
++	unicam_reset_format(node);
++
++	return ret;
++}
++
++static int unicam_query_dv_timings(struct file *file, void *priv,
++				   struct v4l2_dv_timings *timings)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, video, query_dv_timings, timings);
++}
++
++static int unicam_enum_dv_timings(struct file *file, void *priv,
++				  struct v4l2_enum_dv_timings *timings)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, pad, enum_dv_timings, timings);
++}
++
++static int unicam_dv_timings_cap(struct file *file, void *priv,
++				 struct v4l2_dv_timings_cap *cap)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, pad, dv_timings_cap, cap);
++}
++
++static int unicam_subscribe_event(struct v4l2_fh *fh,
++				  const struct v4l2_event_subscription *sub)
++{
++	switch (sub->type) {
++	case V4L2_EVENT_FRAME_SYNC:
++		return v4l2_event_subscribe(fh, sub, 2, NULL);
++	case V4L2_EVENT_SOURCE_CHANGE:
++		return v4l2_event_subscribe(fh, sub, 4, NULL);
++	}
++
++	return v4l2_ctrl_subscribe_event(fh, sub);
++}
++
++static int unicam_log_status(struct file *file, void *fh)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	u32 reg;
++
++	/* status for sub devices */
++	v4l2_device_call_all(&dev->v4l2_dev, 0, core, log_status);
++
++	unicam_info(dev, "-----Receiver status-----\n");
++	unicam_info(dev, "V4L2 width/height:   %ux%u\n",
++		    node->v_fmt.fmt.pix.width, node->v_fmt.fmt.pix.height);
++	unicam_info(dev, "Mediabus format:     %08x\n", node->fmt->code);
++	unicam_info(dev, "V4L2 format:         %08x\n",
++		    node->v_fmt.fmt.pix.pixelformat);
++	reg = reg_read(dev, UNICAM_IPIPE);
++	unicam_info(dev, "Unpacking/packing:   %u / %u\n",
++		    get_field(reg, UNICAM_PUM_MASK),
++		    get_field(reg, UNICAM_PPM_MASK));
++	unicam_info(dev, "----Live data----\n");
++	unicam_info(dev, "Programmed stride:   %4u\n",
++		    reg_read(dev, UNICAM_IBLS));
++	unicam_info(dev, "Detected resolution: %ux%u\n",
++		    reg_read(dev, UNICAM_IHSTA),
++		    reg_read(dev, UNICAM_IVSTA));
++	unicam_info(dev, "Write pointer:       %08x\n",
++		    reg_read(dev, UNICAM_IBWP));
++
++	return 0;
++}
++
++static void unicam_notify(struct v4l2_subdev *sd,
++			  unsigned int notification, void *arg)
++{
++	struct unicam_device *dev = to_unicam_device(sd->v4l2_dev);
++
++	switch (notification) {
++	case V4L2_DEVICE_NOTIFY_EVENT:
++		v4l2_event_queue(&dev->node[IMAGE_PAD].video_dev, arg);
++		break;
++	default:
++		break;
++	}
++}
++
++static const struct vb2_ops unicam_video_qops = {
++	.wait_prepare		= vb2_ops_wait_prepare,
++	.wait_finish		= vb2_ops_wait_finish,
++	.queue_setup		= unicam_queue_setup,
++	.buf_prepare		= unicam_buffer_prepare,
++	.buf_queue		= unicam_buffer_queue,
++	.start_streaming	= unicam_start_streaming,
++	.stop_streaming		= unicam_stop_streaming,
++};
++
++/*
++ * unicam_v4l2_open : This function is based on the v4l2_fh_open helper
++ * function. It has been augmented to handle sensor subdevice power management,
++ */
++static int unicam_v4l2_open(struct file *file)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	int ret;
++
++	mutex_lock(&node->lock);
++
++	ret = v4l2_fh_open(file);
++	if (ret) {
++		unicam_err(dev, "v4l2_fh_open failed\n");
++		goto unlock;
++	}
++
++	node->open++;
++
++	if (!v4l2_fh_is_singular_file(file))
++		goto unlock;
++
++	ret = v4l2_subdev_call(dev->sensor, core, s_power, 1);
++	if (ret < 0 && ret != -ENOIOCTLCMD) {
++		v4l2_fh_release(file);
++		node->open--;
++		goto unlock;
++	}
++
++	ret = 0;
++
++unlock:
++	mutex_unlock(&node->lock);
++	return ret;
++}
++
++static int unicam_v4l2_release(struct file *file)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	struct v4l2_subdev *sd = dev->sensor;
++	bool fh_singular;
++	int ret;
++
++	mutex_lock(&node->lock);
++
++	fh_singular = v4l2_fh_is_singular_file(file);
++
++	ret = _vb2_fop_release(file, NULL);
++
++	if (fh_singular)
++		v4l2_subdev_call(sd, core, s_power, 0);
++
++	node->open--;
++	mutex_unlock(&node->lock);
++
++	return ret;
++}
++
++/* unicam capture driver file operations */
++static const struct v4l2_file_operations unicam_fops = {
++	.owner		= THIS_MODULE,
++	.open		= unicam_v4l2_open,
++	.release	= unicam_v4l2_release,
++	.read		= vb2_fop_read,
++	.poll		= vb2_fop_poll,
++	.unlocked_ioctl	= video_ioctl2,
++	.mmap		= vb2_fop_mmap,
++};
++
++/* unicam capture ioctl operations */
++static const struct v4l2_ioctl_ops unicam_ioctl_ops = {
++	.vidioc_querycap		= unicam_querycap,
++	.vidioc_enum_fmt_vid_cap	= unicam_enum_fmt_vid_cap,
++	.vidioc_g_fmt_vid_cap		= unicam_g_fmt_vid_cap,
++	.vidioc_s_fmt_vid_cap		= unicam_s_fmt_vid_cap,
++	.vidioc_try_fmt_vid_cap		= unicam_try_fmt_vid_cap,
++
++	.vidioc_enum_fmt_meta_cap	= unicam_enum_fmt_meta_cap,
++	.vidioc_g_fmt_meta_cap		= unicam_g_fmt_meta_cap,
++	.vidioc_s_fmt_meta_cap		= unicam_g_fmt_meta_cap,
++	.vidioc_try_fmt_meta_cap	= unicam_g_fmt_meta_cap,
++
++	.vidioc_enum_input		= unicam_enum_input,
++	.vidioc_g_input			= unicam_g_input,
++	.vidioc_s_input			= unicam_s_input,
++
++	.vidioc_querystd		= unicam_querystd,
++	.vidioc_s_std			= unicam_s_std,
++	.vidioc_g_std			= unicam_g_std,
++
++	.vidioc_g_edid			= unicam_g_edid,
++	.vidioc_s_edid			= unicam_s_edid,
++
++	.vidioc_enum_framesizes		= unicam_enum_framesizes,
++	.vidioc_enum_frameintervals	= unicam_enum_frameintervals,
++
++	.vidioc_g_selection		= unicam_g_selection,
++	.vidioc_s_selection		= unicam_s_selection,
++
++	.vidioc_g_parm			= unicam_g_parm,
++	.vidioc_s_parm			= unicam_s_parm,
++
++	.vidioc_s_dv_timings		= unicam_s_dv_timings,
++	.vidioc_g_dv_timings		= unicam_g_dv_timings,
++	.vidioc_query_dv_timings	= unicam_query_dv_timings,
++	.vidioc_enum_dv_timings		= unicam_enum_dv_timings,
++	.vidioc_dv_timings_cap		= unicam_dv_timings_cap,
++
++	.vidioc_reqbufs			= vb2_ioctl_reqbufs,
++	.vidioc_create_bufs		= vb2_ioctl_create_bufs,
++	.vidioc_prepare_buf		= vb2_ioctl_prepare_buf,
++	.vidioc_querybuf		= vb2_ioctl_querybuf,
++	.vidioc_qbuf			= vb2_ioctl_qbuf,
++	.vidioc_dqbuf			= vb2_ioctl_dqbuf,
++	.vidioc_expbuf			= vb2_ioctl_expbuf,
++	.vidioc_streamon		= vb2_ioctl_streamon,
++	.vidioc_streamoff		= vb2_ioctl_streamoff,
++
++	.vidioc_log_status		= unicam_log_status,
++	.vidioc_subscribe_event		= unicam_subscribe_event,
++	.vidioc_unsubscribe_event	= v4l2_event_unsubscribe,
++};
++
++static int
++unicam_async_bound(struct v4l2_async_notifier *notifier,
++		   struct v4l2_subdev *subdev,
++		   struct v4l2_async_subdev *asd)
++{
++	struct unicam_device *unicam = to_unicam_device(notifier->v4l2_dev);
++
++	if (unicam->sensor) {
++		unicam_info(unicam, "Rejecting subdev %s (Already set!!)",
++			    subdev->name);
++		return 0;
++	}
++
++	unicam->sensor = subdev;
++	unicam_dbg(1, unicam, "Using sensor %s for capture\n", subdev->name);
++
++	return 0;
++}
++
++static void unicam_release(struct kref *kref)
++{
++	struct unicam_device *unicam =
++		container_of(kref, struct unicam_device, kref);
++
++	v4l2_ctrl_handler_free(&unicam->ctrl_handler);
++	media_device_cleanup(&unicam->mdev);
++
++	if (unicam->sensor_config)
++		v4l2_subdev_free_pad_config(unicam->sensor_config);
++
++	kfree(unicam);
++}
++
++static void unicam_put(struct unicam_device *unicam)
++{
++	kref_put(&unicam->kref, unicam_release);
++}
++
++static void unicam_get(struct unicam_device *unicam)
++{
++	kref_get(&unicam->kref);
++}
++
++static void unicam_node_release(struct video_device *vdev)
++{
++	struct unicam_node *node = video_get_drvdata(vdev);
++
++	unicam_put(node->dev);
++}
++
++static int register_node(struct unicam_device *unicam, struct unicam_node *node,
++			 enum v4l2_buf_type type, int pad_id)
++{
++	struct video_device *vdev;
++	struct vb2_queue *q;
++	struct v4l2_mbus_framefmt mbus_fmt = {0};
++	const struct unicam_fmt *fmt;
++	int ret;
++
++	if (pad_id == IMAGE_PAD) {
++		ret = __subdev_get_format(unicam, &mbus_fmt, pad_id);
++		if (ret) {
++			unicam_err(unicam, "Failed to get_format - ret %d\n",
++				   ret);
++			return ret;
++		}
++
++		fmt = find_format_by_code(mbus_fmt.code);
++		if (!fmt) {
++			/*
++			 * Find the first format that the sensor and unicam both
++			 * support
++			 */
++			fmt = get_first_supported_format(unicam);
++
++			if (!fmt)
++				/* No compatible formats */
++				return -EINVAL;
++
++			mbus_fmt.code = fmt->code;
++			ret = __subdev_set_format(unicam, &mbus_fmt, pad_id);
++			if (ret)
++				return -EINVAL;
++		}
++		if (mbus_fmt.field != V4L2_FIELD_NONE) {
++			/* Interlaced not supported - disable it now. */
++			mbus_fmt.field = V4L2_FIELD_NONE;
++			ret = __subdev_set_format(unicam, &mbus_fmt, pad_id);
++			if (ret)
++				return -EINVAL;
++		}
++
++		node->v_fmt.fmt.pix.pixelformat = fmt->fourcc ? fmt->fourcc
++						: fmt->repacked_fourcc;
++	} else {
++		/* Fix this node format as embedded data. */
++		fmt = find_format_by_code(MEDIA_BUS_FMT_SENSOR_DATA);
++		node->v_fmt.fmt.meta.dataformat = fmt->fourcc;
++	}
++
++	node->dev = unicam;
++	node->pad_id = pad_id;
++	node->fmt = fmt;
++
++	/* Read current subdev format */
++	unicam_reset_format(node);
++
++	if (v4l2_subdev_has_op(unicam->sensor, video, s_std)) {
++		v4l2_std_id tvnorms;
++
++		if (WARN_ON(!v4l2_subdev_has_op(unicam->sensor, video,
++						g_tvnorms)))
++			/*
++			 * Subdevice should not advertise s_std but not
++			 * g_tvnorms
++			 */
++			return -EINVAL;
++
++		ret = v4l2_subdev_call(unicam->sensor, video,
++				       g_tvnorms, &tvnorms);
++		if (WARN_ON(ret))
++			return -EINVAL;
++		node->video_dev.tvnorms |= tvnorms;
++	}
++
++	spin_lock_init(&node->dma_queue_lock);
++	mutex_init(&node->lock);
++
++	vdev = &node->video_dev;
++	if (pad_id == IMAGE_PAD) {
++		/* Add controls from the subdevice */
++		ret = v4l2_ctrl_add_handler(&unicam->ctrl_handler,
++					    unicam->sensor->ctrl_handler, NULL,
++					    true);
++		if (ret < 0)
++			return ret;
++
++		/*
++		 * If the sensor subdevice has any controls, associate the node
++		 *  with the ctrl handler to allow access from userland.
++		 */
++		if (!list_empty(&unicam->ctrl_handler.ctrls))
++			vdev->ctrl_handler = &unicam->ctrl_handler;
++	}
++
++	q = &node->buffer_queue;
++	q->type = type;
++	q->io_modes = VB2_MMAP | VB2_DMABUF | VB2_READ;
++	q->drv_priv = node;
++	q->ops = &unicam_video_qops;
++	q->mem_ops = &vb2_dma_contig_memops;
++	q->buf_struct_size = sizeof(struct unicam_buffer);
++	q->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
++	q->lock = &node->lock;
++	q->min_buffers_needed = 2;
++	q->dev = &unicam->pdev->dev;
++
++	ret = vb2_queue_init(q);
++	if (ret) {
++		unicam_err(unicam, "vb2_queue_init() failed\n");
++		return ret;
++	}
++
++	INIT_LIST_HEAD(&node->dma_queue);
++
++	vdev->release = unicam_node_release;
++	vdev->fops = &unicam_fops;
++	vdev->ioctl_ops = &unicam_ioctl_ops;
++	vdev->v4l2_dev = &unicam->v4l2_dev;
++	vdev->vfl_dir = VFL_DIR_RX;
++	vdev->queue = q;
++	vdev->lock = &node->lock;
++	vdev->device_caps = (pad_id == IMAGE_PAD) ?
++			    (V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING) :
++			    (V4L2_CAP_META_CAPTURE | V4L2_CAP_STREAMING);
++
++	/* Define the device names */
++	snprintf(vdev->name, sizeof(vdev->name), "%s-%s", UNICAM_MODULE_NAME,
++		 pad_id == IMAGE_PAD ? "image" : "embedded");
++
++	video_set_drvdata(vdev, node);
++	if (pad_id == IMAGE_PAD)
++		vdev->entity.flags |= MEDIA_ENT_FL_DEFAULT;
++	node->pad.flags = MEDIA_PAD_FL_SINK;
++	media_entity_pads_init(&vdev->entity, 1, &node->pad);
++
++	node->dummy_buf_cpu_addr = dma_alloc_coherent(&unicam->pdev->dev,
++						      DUMMY_BUF_SIZE,
++						      &node->dummy_buf_dma_addr,
++						      GFP_KERNEL);
++	if (!node->dummy_buf_cpu_addr) {
++		unicam_err(unicam, "Unable to allocate dummy buffer.\n");
++		return -ENOMEM;
++	}
++
++	if (pad_id == METADATA_PAD) {
++		v4l2_disable_ioctl(vdev, VIDIOC_DQEVENT);
++		v4l2_disable_ioctl(vdev, VIDIOC_SUBSCRIBE_EVENT);
++		v4l2_disable_ioctl(vdev, VIDIOC_UNSUBSCRIBE_EVENT);
++	}
++	if (pad_id == METADATA_PAD ||
++	    !v4l2_subdev_has_op(unicam->sensor, video, s_std)) {
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_STD);
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_STD);
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_ENUMSTD);
++	}
++	if (pad_id == METADATA_PAD ||
++	    !v4l2_subdev_has_op(unicam->sensor, video, querystd))
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_QUERYSTD);
++	if (pad_id == METADATA_PAD ||
++	    !v4l2_subdev_has_op(unicam->sensor, video, s_dv_timings)) {
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_EDID);
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_EDID);
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_DV_TIMINGS_CAP);
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_DV_TIMINGS);
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_DV_TIMINGS);
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_ENUM_DV_TIMINGS);
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_QUERY_DV_TIMINGS);
++	}
++	if (pad_id == METADATA_PAD ||
++	    !v4l2_subdev_has_op(unicam->sensor, pad, enum_frame_interval))
++		v4l2_disable_ioctl(&node->video_dev,
++				   VIDIOC_ENUM_FRAMEINTERVALS);
++	if (pad_id == METADATA_PAD ||
++	    !v4l2_subdev_has_op(unicam->sensor, video, g_frame_interval))
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_PARM);
++	if (pad_id == METADATA_PAD ||
++	    !v4l2_subdev_has_op(unicam->sensor, video, s_frame_interval))
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_PARM);
++
++	if (pad_id == METADATA_PAD ||
++	    !v4l2_subdev_has_op(unicam->sensor, pad, enum_frame_size))
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_ENUM_FRAMESIZES);
++
++	if (node->pad_id == METADATA_PAD ||
++	    !v4l2_subdev_has_op(unicam->sensor, pad, set_selection))
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_SELECTION);
++
++	if (node->pad_id == METADATA_PAD ||
++	    !v4l2_subdev_has_op(unicam->sensor, pad, get_selection))
++		v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_SELECTION);
++
++	ret = video_register_device(vdev, VFL_TYPE_VIDEO, -1);
++	if (ret) {
++		unicam_err(unicam, "Unable to register video device %s\n",
++			   vdev->name);
++		return ret;
++	}
++
++	/*
++	 * Acquire a reference to unicam, which will be released when the video
++	 * device will be unregistered and userspace will have closed all open
++	 * file handles.
++	 */
++	unicam_get(unicam);
++	node->registered = true;
++
++	if (pad_id != METADATA_PAD || unicam->sensor_embedded_data) {
++		ret = media_create_pad_link(&unicam->sensor->entity, pad_id,
++					    &node->video_dev.entity, 0,
++					    MEDIA_LNK_FL_ENABLED |
++					    MEDIA_LNK_FL_IMMUTABLE);
++		if (ret)
++			unicam_err(unicam, "Unable to create pad link for %s\n",
++				   vdev->name);
++	}
++
++	return ret;
++}
++
++static void unregister_nodes(struct unicam_device *unicam)
++{
++	unsigned int i;
++
++	for (i = 0; i < ARRAY_SIZE(unicam->node); i++) {
++		struct unicam_node *node = &unicam->node[i];
++
++		if (node->dummy_buf_cpu_addr) {
++			dma_free_coherent(&unicam->pdev->dev, DUMMY_BUF_SIZE,
++					  node->dummy_buf_cpu_addr,
++					  node->dummy_buf_dma_addr);
++		}
++
++		if (node->registered) {
++			node->registered = false;
++			video_unregister_device(&node->video_dev);
++		}
++	}
++}
++
++static int unicam_probe_complete(struct unicam_device *unicam)
++{
++	int ret;
++
++	unicam->v4l2_dev.notify = unicam_notify;
++
++	unicam->sensor_config = v4l2_subdev_alloc_pad_config(unicam->sensor);
++	if (!unicam->sensor_config)
++		return -ENOMEM;
++
++	unicam->sensor_embedded_data = (unicam->sensor->entity.num_pads >= 2);
++
++	ret = register_node(unicam, &unicam->node[IMAGE_PAD],
++			    V4L2_BUF_TYPE_VIDEO_CAPTURE, IMAGE_PAD);
++	if (ret) {
++		unicam_err(unicam, "Unable to register image video device.\n");
++		goto unregister;
++	}
++
++	ret = register_node(unicam, &unicam->node[METADATA_PAD],
++			    V4L2_BUF_TYPE_META_CAPTURE, METADATA_PAD);
++	if (ret) {
++		unicam_err(unicam, "Unable to register metadata video device.\n");
++		goto unregister;
++	}
++
++	ret = v4l2_device_register_ro_subdev_nodes(&unicam->v4l2_dev);
++	if (ret) {
++		unicam_err(unicam, "Unable to register subdev nodes.\n");
++		goto unregister;
++	}
++
++	/*
++	 * Release the initial reference, all references are now owned by the
++	 * video devices.
++	 */
++	unicam_put(unicam);
++	return 0;
++
++unregister:
++	unregister_nodes(unicam);
++	unicam_put(unicam);
++
++	return ret;
++}
++
++static int unicam_async_complete(struct v4l2_async_notifier *notifier)
++{
++	struct unicam_device *unicam = to_unicam_device(notifier->v4l2_dev);
++
++	return unicam_probe_complete(unicam);
++}
++
++static const struct v4l2_async_notifier_operations unicam_async_ops = {
++	.bound = unicam_async_bound,
++	.complete = unicam_async_complete,
++};
++
++static int of_unicam_connect_subdevs(struct unicam_device *dev)
++{
++	struct platform_device *pdev = dev->pdev;
++	struct v4l2_fwnode_endpoint ep = { 0 };
++	struct device_node *ep_node;
++	struct device_node *sensor_node;
++	unsigned int lane;
++	int ret = -EINVAL;
++
++	if (of_property_read_u32(pdev->dev.of_node, "brcm,num-data-lanes",
++				 &dev->max_data_lanes) < 0) {
++		unicam_err(dev, "number of data lanes not set\n");
++		return -EINVAL;
++	}
++
++	/* Get the local endpoint and remote device. */
++	ep_node = of_graph_get_next_endpoint(pdev->dev.of_node, NULL);
++	if (!ep_node) {
++		unicam_dbg(3, dev, "can't get next endpoint\n");
++		return -EINVAL;
++	}
++
++	unicam_dbg(3, dev, "ep_node is %pOF\n", ep_node);
++
++	sensor_node = of_graph_get_remote_port_parent(ep_node);
++	if (!sensor_node) {
++		unicam_dbg(3, dev, "can't get remote parent\n");
++		goto cleanup_exit;
++	}
++
++	unicam_dbg(1, dev, "found subdevice %pOF\n", sensor_node);
++
++	/* Parse the local endpoint and validate its configuration. */
++	v4l2_fwnode_endpoint_parse(of_fwnode_handle(ep_node), &ep);
++
++	unicam_dbg(3, dev, "parsed local endpoint, bus_type %u\n",
++		   ep.bus_type);
++
++	dev->bus_type = ep.bus_type;
++
++	switch (ep.bus_type) {
++	case V4L2_MBUS_CSI2_DPHY:
++		switch (ep.bus.mipi_csi2.num_data_lanes) {
++		case 1:
++		case 2:
++		case 4:
++			break;
++
++		default:
++			unicam_err(dev, "subdevice %pOF: %u data lanes not supported\n",
++				   sensor_node,
++				   ep.bus.mipi_csi2.num_data_lanes);
++			goto cleanup_exit;
++		}
++
++		for (lane = 0; lane < ep.bus.mipi_csi2.num_data_lanes; lane++) {
++			if (ep.bus.mipi_csi2.data_lanes[lane] != lane + 1) {
++				unicam_err(dev, "subdevice %pOF: data lanes reordering not supported\n",
++					   sensor_node);
++				goto cleanup_exit;
++			}
++		}
++
++		if (ep.bus.mipi_csi2.num_data_lanes > dev->max_data_lanes) {
++			unicam_err(dev, "subdevice requires %u data lanes when %u are supported\n",
++				   ep.bus.mipi_csi2.num_data_lanes,
++				   dev->max_data_lanes);
++		}
++
++		dev->max_data_lanes = ep.bus.mipi_csi2.num_data_lanes;
++		dev->bus_flags = ep.bus.mipi_csi2.flags;
++
++		break;
++
++	case V4L2_MBUS_CCP2:
++		if (ep.bus.mipi_csi1.clock_lane != 0 ||
++		    ep.bus.mipi_csi1.data_lane != 1) {
++			unicam_err(dev, "subdevice %pOF: unsupported lanes configuration\n",
++				   sensor_node);
++			goto cleanup_exit;
++		}
++
++		dev->max_data_lanes = 1;
++		dev->bus_flags = ep.bus.mipi_csi1.strobe;
++		break;
++
++	default:
++		/* Unsupported bus type */
++		unicam_err(dev, "subdevice %pOF: unsupported bus type %u\n",
++			   sensor_node, ep.bus_type);
++		goto cleanup_exit;
++	}
++
++	unicam_dbg(3, dev, "subdevice %pOF: %s bus, %u data lanes, flags=0x%08x\n",
++		   sensor_node,
++		   dev->bus_type == V4L2_MBUS_CSI2_DPHY ? "CSI-2" : "CCP2",
++		   dev->max_data_lanes, dev->bus_flags);
++
++	/* Initialize and register the async notifier. */
++	v4l2_async_nf_init(&dev->notifier);
++	dev->notifier.ops = &unicam_async_ops;
++
++	dev->asd.match_type = V4L2_ASYNC_MATCH_FWNODE;
++	dev->asd.match.fwnode = of_fwnode_handle(sensor_node);
++	ret = __v4l2_async_nf_add_subdev(&dev->notifier, &dev->asd);
++	if (ret) {
++		unicam_err(dev, "Error adding subdevice: %d\n", ret);
++		goto cleanup_exit;
++	}
++
++	ret = v4l2_async_nf_register(&dev->v4l2_dev, &dev->notifier);
++	if (ret) {
++		unicam_err(dev, "Error registering async notifier: %d\n", ret);
++		ret = -EINVAL;
++	}
++
++cleanup_exit:
++	of_node_put(sensor_node);
++	of_node_put(ep_node);
++
++	return ret;
++}
++
++static int unicam_probe(struct platform_device *pdev)
++{
++	struct unicam_device *unicam;
++	int ret;
++
++	unicam = kzalloc(sizeof(*unicam), GFP_KERNEL);
++	if (!unicam)
++		return -ENOMEM;
++
++	kref_init(&unicam->kref);
++	unicam->pdev = pdev;
++
++	unicam->base = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(unicam->base)) {
++		unicam_err(unicam, "Failed to get main io block\n");
++		ret = PTR_ERR(unicam->base);
++		goto err_unicam_put;
++	}
++
++	unicam->clk_gate_base = devm_platform_ioremap_resource(pdev, 1);
++	if (IS_ERR(unicam->clk_gate_base)) {
++		unicam_err(unicam, "Failed to get 2nd io block\n");
++		ret = PTR_ERR(unicam->clk_gate_base);
++		goto err_unicam_put;
++	}
++
++	unicam->clock = devm_clk_get(&pdev->dev, "lp");
++	if (IS_ERR(unicam->clock)) {
++		unicam_err(unicam, "Failed to get clock\n");
++		ret = PTR_ERR(unicam->clock);
++		goto err_unicam_put;
++	}
++
++	ret = platform_get_irq(pdev, 0);
++	if (ret <= 0) {
++		dev_err(&pdev->dev, "No IRQ resource\n");
++		ret = -EINVAL;
++		goto err_unicam_put;
++	}
++
++	ret = devm_request_irq(&pdev->dev, ret, unicam_isr, 0,
++			       "unicam_capture0", unicam);
++	if (ret) {
++		dev_err(&pdev->dev, "Unable to request interrupt\n");
++		ret = -EINVAL;
++		goto err_unicam_put;
++	}
++
++	unicam->mdev.dev = &pdev->dev;
++	strscpy(unicam->mdev.model, UNICAM_MODULE_NAME,
++		sizeof(unicam->mdev.model));
++	strscpy(unicam->mdev.serial, "", sizeof(unicam->mdev.serial));
++	snprintf(unicam->mdev.bus_info, sizeof(unicam->mdev.bus_info),
++		 "platform:%s", dev_name(&pdev->dev));
++	unicam->mdev.hw_revision = 0;
++
++	media_device_init(&unicam->mdev);
++
++	unicam->v4l2_dev.mdev = &unicam->mdev;
++
++	ret = v4l2_device_register(&pdev->dev, &unicam->v4l2_dev);
++	if (ret) {
++		unicam_err(unicam,
++			   "Unable to register v4l2 device.\n");
++		goto err_unicam_put;
++	}
++
++	ret = media_device_register(&unicam->mdev);
++	if (ret < 0) {
++		unicam_err(unicam,
++			   "Unable to register media-controller device.\n");
++		goto err_v4l2_unregister;
++	}
++
++	/* Reserve space for the controls */
++	ret = v4l2_ctrl_handler_init(&unicam->ctrl_handler, 16);
++	if (ret < 0)
++		goto err_media_unregister;
++
++	/* set the driver data in platform device */
++	platform_set_drvdata(pdev, unicam);
++
++	ret = of_unicam_connect_subdevs(unicam);
++	if (ret) {
++		dev_err(&pdev->dev, "Failed to connect subdevs\n");
++		goto err_media_unregister;
++	}
++
++	/* Enable the block power domain */
++	pm_runtime_enable(&pdev->dev);
++
++	return 0;
++
++err_media_unregister:
++	media_device_unregister(&unicam->mdev);
++err_v4l2_unregister:
++	v4l2_device_unregister(&unicam->v4l2_dev);
++err_unicam_put:
++	unicam_put(unicam);
++
++	return ret;
++}
++
++static void unicam_remove(struct platform_device *pdev)
++{
++	struct unicam_device *unicam = platform_get_drvdata(pdev);
++
++	unicam_dbg(2, unicam, "%s\n", __func__);
++
++	v4l2_async_nf_unregister(&unicam->notifier);
++	v4l2_device_unregister(&unicam->v4l2_dev);
++	media_device_unregister(&unicam->mdev);
++	unregister_nodes(unicam);
++
++	pm_runtime_disable(&pdev->dev);
++}
++
++static const struct of_device_id unicam_of_match[] = {
++	{ .compatible = "brcm,bcm2835-unicam", },
++	{ /* sentinel */ },
++};
++MODULE_DEVICE_TABLE(of, unicam_of_match);
++
++static struct platform_driver unicam_driver = {
++	.probe		= unicam_probe,
++	.remove		= unicam_remove,
++	.driver = {
++		.name	= UNICAM_MODULE_NAME,
++		.of_match_table = of_match_ptr(unicam_of_match),
++	},
++};
++
++module_platform_driver(unicam_driver);
++
++MODULE_AUTHOR("Dave Stevenson <dave.stevenson@raspberrypi.com>");
++MODULE_DESCRIPTION("BCM2835 Unicam driver");
++MODULE_LICENSE("GPL");
++MODULE_VERSION(UNICAM_VERSION);
+--- /dev/null
++++ b/drivers/media/platform/bcm2835/vc4-regs-unicam.h
+@@ -0,0 +1,253 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++
++/*
++ * Copyright (C) 2017-2020 Raspberry Pi Trading.
++ * Dave Stevenson <dave.stevenson@raspberrypi.com>
++ */
++
++#ifndef VC4_REGS_UNICAM_H
++#define VC4_REGS_UNICAM_H
++
++/*
++ * The following values are taken from files found within the code drop
++ * made by Broadcom for the BCM21553 Graphics Driver, predominantly in
++ * brcm_usrlib/dag/vmcsx/vcinclude/hardware_vc4.h.
++ * They have been modified to be only the register offset.
++ */
++#define UNICAM_CTRL	0x000
++#define UNICAM_STA	0x004
++#define UNICAM_ANA	0x008
++#define UNICAM_PRI	0x00c
++#define UNICAM_CLK	0x010
++#define UNICAM_CLT	0x014
++#define UNICAM_DAT0	0x018
++#define UNICAM_DAT1	0x01c
++#define UNICAM_DAT2	0x020
++#define UNICAM_DAT3	0x024
++#define UNICAM_DLT	0x028
++#define UNICAM_CMP0	0x02c
++#define UNICAM_CMP1	0x030
++#define UNICAM_CAP0	0x034
++#define UNICAM_CAP1	0x038
++#define UNICAM_ICTL	0x100
++#define UNICAM_ISTA	0x104
++#define UNICAM_IDI0	0x108
++#define UNICAM_IPIPE	0x10c
++#define UNICAM_IBSA0	0x110
++#define UNICAM_IBEA0	0x114
++#define UNICAM_IBLS	0x118
++#define UNICAM_IBWP	0x11c
++#define UNICAM_IHWIN	0x120
++#define UNICAM_IHSTA	0x124
++#define UNICAM_IVWIN	0x128
++#define UNICAM_IVSTA	0x12c
++#define UNICAM_ICC	0x130
++#define UNICAM_ICS	0x134
++#define UNICAM_IDC	0x138
++#define UNICAM_IDPO	0x13c
++#define UNICAM_IDCA	0x140
++#define UNICAM_IDCD	0x144
++#define UNICAM_IDS	0x148
++#define UNICAM_DCS	0x200
++#define UNICAM_DBSA0	0x204
++#define UNICAM_DBEA0	0x208
++#define UNICAM_DBWP	0x20c
++#define UNICAM_DBCTL	0x300
++#define UNICAM_IBSA1	0x304
++#define UNICAM_IBEA1	0x308
++#define UNICAM_IDI1	0x30c
++#define UNICAM_DBSA1	0x310
++#define UNICAM_DBEA1	0x314
++#define UNICAM_MISC	0x400
++
++/*
++ * The following bitmasks are from the kernel released by Broadcom
++ * for Android - https://android.googlesource.com/kernel/bcm/
++ * The Rhea, Hawaii, and Java chips all contain the same VideoCore4
++ * Unicam block as BCM2835, as defined in eg
++ * arch/arm/mach-rhea/include/mach/rdb_A0/brcm_rdb_cam.h and similar.
++ * Values reworked to use the kernel BIT and GENMASK macros.
++ *
++ * Some of the bit mnenomics have been amended to match the datasheet.
++ */
++/* UNICAM_CTRL Register */
++#define UNICAM_CPE		BIT(0)
++#define UNICAM_MEM		BIT(1)
++#define UNICAM_CPR		BIT(2)
++#define UNICAM_CPM_MASK		GENMASK(3, 3)
++#define UNICAM_CPM_CSI2		0
++#define UNICAM_CPM_CCP2		1
++#define UNICAM_SOE		BIT(4)
++#define UNICAM_DCM_MASK		GENMASK(5, 5)
++#define UNICAM_DCM_STROBE	0
++#define UNICAM_DCM_DATA		1
++#define UNICAM_SLS		BIT(6)
++#define UNICAM_PFT_MASK		GENMASK(11, 8)
++#define UNICAM_OET_MASK		GENMASK(20, 12)
++
++/* UNICAM_STA Register */
++#define UNICAM_SYN		BIT(0)
++#define UNICAM_CS		BIT(1)
++#define UNICAM_SBE		BIT(2)
++#define UNICAM_PBE		BIT(3)
++#define UNICAM_HOE		BIT(4)
++#define UNICAM_PLE		BIT(5)
++#define UNICAM_SSC		BIT(6)
++#define UNICAM_CRCE		BIT(7)
++#define UNICAM_OES		BIT(8)
++#define UNICAM_IFO		BIT(9)
++#define UNICAM_OFO		BIT(10)
++#define UNICAM_BFO		BIT(11)
++#define UNICAM_DL		BIT(12)
++#define UNICAM_PS		BIT(13)
++#define UNICAM_IS		BIT(14)
++#define UNICAM_PI0		BIT(15)
++#define UNICAM_PI1		BIT(16)
++#define UNICAM_FSI_S		BIT(17)
++#define UNICAM_FEI_S		BIT(18)
++#define UNICAM_LCI_S		BIT(19)
++#define UNICAM_BUF0_RDY		BIT(20)
++#define UNICAM_BUF0_NO		BIT(21)
++#define UNICAM_BUF1_RDY		BIT(22)
++#define UNICAM_BUF1_NO		BIT(23)
++#define UNICAM_DI		BIT(24)
++
++#define UNICAM_STA_MASK_ALL \
++		(UNICAM_DL + \
++		UNICAM_SBE + \
++		UNICAM_PBE + \
++		UNICAM_HOE + \
++		UNICAM_PLE + \
++		UNICAM_SSC + \
++		UNICAM_CRCE + \
++		UNICAM_IFO + \
++		UNICAM_OFO + \
++		UNICAM_PS + \
++		UNICAM_PI0 + \
++		UNICAM_PI1)
++
++/* UNICAM_ANA Register */
++#define UNICAM_APD		BIT(0)
++#define UNICAM_BPD		BIT(1)
++#define UNICAM_AR		BIT(2)
++#define UNICAM_DDL		BIT(3)
++#define UNICAM_CTATADJ_MASK	GENMASK(7, 4)
++#define UNICAM_PTATADJ_MASK	GENMASK(11, 8)
++
++/* UNICAM_PRI Register */
++#define UNICAM_PE		BIT(0)
++#define UNICAM_PT_MASK		GENMASK(2, 1)
++#define UNICAM_NP_MASK		GENMASK(7, 4)
++#define UNICAM_PP_MASK		GENMASK(11, 8)
++#define UNICAM_BS_MASK		GENMASK(15, 12)
++#define UNICAM_BL_MASK		GENMASK(17, 16)
++
++/* UNICAM_CLK Register */
++#define UNICAM_CLE		BIT(0)
++#define UNICAM_CLPD		BIT(1)
++#define UNICAM_CLLPE		BIT(2)
++#define UNICAM_CLHSE		BIT(3)
++#define UNICAM_CLTRE		BIT(4)
++#define UNICAM_CLAC_MASK	GENMASK(8, 5)
++#define UNICAM_CLSTE		BIT(29)
++
++/* UNICAM_CLT Register */
++#define UNICAM_CLT1_MASK	GENMASK(7, 0)
++#define UNICAM_CLT2_MASK	GENMASK(15, 8)
++
++/* UNICAM_DATn Registers */
++#define UNICAM_DLE		BIT(0)
++#define UNICAM_DLPD		BIT(1)
++#define UNICAM_DLLPE		BIT(2)
++#define UNICAM_DLHSE		BIT(3)
++#define UNICAM_DLTRE		BIT(4)
++#define UNICAM_DLSM		BIT(5)
++#define UNICAM_DLFO		BIT(28)
++#define UNICAM_DLSTE		BIT(29)
++
++#define UNICAM_DAT_MASK_ALL (UNICAM_DLSTE + UNICAM_DLFO)
++
++/* UNICAM_DLT Register */
++#define UNICAM_DLT1_MASK	GENMASK(7, 0)
++#define UNICAM_DLT2_MASK	GENMASK(15, 8)
++#define UNICAM_DLT3_MASK	GENMASK(23, 16)
++
++/* UNICAM_ICTL Register */
++#define UNICAM_FSIE		BIT(0)
++#define UNICAM_FEIE		BIT(1)
++#define UNICAM_IBOB		BIT(2)
++#define UNICAM_FCM		BIT(3)
++#define UNICAM_TFC		BIT(4)
++#define UNICAM_LIP_MASK		GENMASK(6, 5)
++#define UNICAM_LCIE_MASK	GENMASK(28, 16)
++
++/* UNICAM_IDI0/1 Register */
++#define UNICAM_ID0_MASK		GENMASK(7, 0)
++#define UNICAM_ID1_MASK		GENMASK(15, 8)
++#define UNICAM_ID2_MASK		GENMASK(23, 16)
++#define UNICAM_ID3_MASK		GENMASK(31, 24)
++
++/* UNICAM_ISTA Register */
++#define UNICAM_FSI		BIT(0)
++#define UNICAM_FEI		BIT(1)
++#define UNICAM_LCI		BIT(2)
++
++#define UNICAM_ISTA_MASK_ALL (UNICAM_FSI + UNICAM_FEI + UNICAM_LCI)
++
++/* UNICAM_IPIPE Register */
++#define UNICAM_PUM_MASK		GENMASK(2, 0)
++		/* Unpacking modes */
++		#define UNICAM_PUM_NONE		0
++		#define UNICAM_PUM_UNPACK6	1
++		#define UNICAM_PUM_UNPACK7	2
++		#define UNICAM_PUM_UNPACK8	3
++		#define UNICAM_PUM_UNPACK10	4
++		#define UNICAM_PUM_UNPACK12	5
++		#define UNICAM_PUM_UNPACK14	6
++		#define UNICAM_PUM_UNPACK16	7
++#define UNICAM_DDM_MASK		GENMASK(6, 3)
++#define UNICAM_PPM_MASK		GENMASK(9, 7)
++		/* Packing modes */
++		#define UNICAM_PPM_NONE		0
++		#define UNICAM_PPM_PACK8	1
++		#define UNICAM_PPM_PACK10	2
++		#define UNICAM_PPM_PACK12	3
++		#define UNICAM_PPM_PACK14	4
++		#define UNICAM_PPM_PACK16	5
++#define UNICAM_DEM_MASK		GENMASK(11, 10)
++#define UNICAM_DEBL_MASK	GENMASK(14, 12)
++#define UNICAM_ICM_MASK		GENMASK(16, 15)
++#define UNICAM_IDM_MASK		GENMASK(17, 17)
++
++/* UNICAM_ICC Register */
++#define UNICAM_ICFL_MASK	GENMASK(4, 0)
++#define UNICAM_ICFH_MASK	GENMASK(9, 5)
++#define UNICAM_ICST_MASK	GENMASK(12, 10)
++#define UNICAM_ICLT_MASK	GENMASK(15, 13)
++#define UNICAM_ICLL_MASK	GENMASK(31, 16)
++
++/* UNICAM_DCS Register */
++#define UNICAM_DIE		BIT(0)
++#define UNICAM_DIM		BIT(1)
++#define UNICAM_DBOB		BIT(3)
++#define UNICAM_FDE		BIT(4)
++#define UNICAM_LDP		BIT(5)
++#define UNICAM_EDL_MASK		GENMASK(15, 8)
++
++/* UNICAM_DBCTL Register */
++#define UNICAM_DBEN		BIT(0)
++#define UNICAM_BUF0_IE		BIT(1)
++#define UNICAM_BUF1_IE		BIT(2)
++
++/* UNICAM_CMP[0,1] register */
++#define UNICAM_PCE		BIT(31)
++#define UNICAM_GI		BIT(9)
++#define UNICAM_CPH		BIT(8)
++#define UNICAM_PCVC_MASK	GENMASK(7, 6)
++#define UNICAM_PCDT_MASK	GENMASK(5, 0)
++
++/* UNICAM_MISC register */
++#define UNICAM_FL0		BIT(6)
++#define UNICAM_FL1		BIT(9)
++
++#endif
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0183-media-bcm2835-unicam-Add-support-for-get_mbus_config.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0183-media-bcm2835-unicam-Add-support-for-get_mbus_config.patch
new file mode 100644
index 00000000..916d11e3
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0183-media-bcm2835-unicam-Add-support-for-get_mbus_config.patch
@@ -0,0 +1,56 @@
+From 6451c613fb65875635b63a1a62b355028457c428 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 23 Jun 2020 14:32:51 +0100
+Subject: [PATCH 183/697] media: bcm2835-unicam: Add support for
+ get_mbus_config to set num lanes
+
+Use the get_mbus_config pad subdev call to allow a source to use
+fewer than the number of CSI2 lanes defined in device tree.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../media/platform/bcm2835/bcm2835-unicam.c   | 31 ++++++++++++++++---
+ 1 file changed, 27 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -1641,12 +1641,35 @@ static int unicam_start_streaming(struct
+ 		goto err_streaming;
+ 	}
+ 
+-	/*
+-	 * TODO: Retrieve the number of active data lanes from the connected
+-	 * subdevice.
+-	 */
+ 	dev->active_data_lanes = dev->max_data_lanes;
+ 
++	if (dev->bus_type == V4L2_MBUS_CSI2_DPHY) {
++		struct v4l2_mbus_config mbus_config = { 0 };
++
++		ret = v4l2_subdev_call(dev->sensor, pad, get_mbus_config,
++				       0, &mbus_config);
++		if (ret < 0 && ret != -ENOIOCTLCMD) {
++			unicam_dbg(3, dev, "g_mbus_config failed\n");
++			goto err_pm_put;
++		}
++
++		dev->active_data_lanes =
++			(mbus_config.flags & V4L2_MBUS_CSI2_LANE_MASK) >>
++					__ffs(V4L2_MBUS_CSI2_LANE_MASK);
++		if (!dev->active_data_lanes)
++			dev->active_data_lanes = dev->max_data_lanes;
++		if (dev->active_data_lanes > dev->max_data_lanes) {
++			unicam_err(dev, "Device has requested %u data lanes, which is >%u configured in DT\n",
++				   dev->active_data_lanes,
++				   dev->max_data_lanes);
++			ret = -EINVAL;
++			goto err_pm_put;
++		}
++	}
++
++	unicam_dbg(1, dev, "Running with %u data lanes\n",
++		   dev->active_data_lanes);
++
+ 	ret = clk_set_rate(dev->clock, 100 * 1000 * 1000);
+ 	if (ret) {
+ 		unicam_err(dev, "failed to set up clock\n");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0184-media-bcm2835-unicam-Avoid-gcc-warning-over-0-on-end.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0184-media-bcm2835-unicam-Avoid-gcc-warning-over-0-on-end.patch
new file mode 100644
index 00000000..ce1f6ef7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0184-media-bcm2835-unicam-Avoid-gcc-warning-over-0-on-end.patch
@@ -0,0 +1,27 @@
+From a94fd27f2f4b48ae20a656686285e44cbbe0c0d6 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 26 Jun 2020 15:53:44 +0100
+Subject: [PATCH 184/697] media: bcm2835-unicam: Avoid gcc warning over {0} on
+ endpoint
+
+Older gcc versions object to = { 0 } initialisation if the first
+elemtn in the structure is a substructure.
+
+Use = { } to avoid this compiler warning.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -2588,7 +2588,7 @@ static const struct v4l2_async_notifier_
+ static int of_unicam_connect_subdevs(struct unicam_device *dev)
+ {
+ 	struct platform_device *pdev = dev->pdev;
+-	struct v4l2_fwnode_endpoint ep = { 0 };
++	struct v4l2_fwnode_endpoint ep = { };
+ 	struct device_node *ep_node;
+ 	struct device_node *sensor_node;
+ 	unsigned int lane;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0185-serial-8250-bcm2835aux-defer-if-clock-is-zero.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0185-serial-8250-bcm2835aux-defer-if-clock-is-zero.patch
new file mode 100644
index 00000000..57e14290
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0185-serial-8250-bcm2835aux-defer-if-clock-is-zero.patch
@@ -0,0 +1,28 @@
+From 484d89cbb8151253babc79f9a7f323b241909b10 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 2 Jul 2020 13:53:20 +0100
+Subject: [PATCH 185/697] serial: 8250: bcm2835aux - defer if clock is zero
+
+See: https://github.com/raspberrypi/linux/issues/3700
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/tty/serial/8250/8250_bcm2835aux.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/tty/serial/8250/8250_bcm2835aux.c
++++ b/drivers/tty/serial/8250/8250_bcm2835aux.c
+@@ -156,6 +156,13 @@ static int bcm2835aux_serial_probe(struc
+ 	 */
+ 	up.port.uartclk *= 2;
+ 
++	/* The clock is only queried at probe time, which means we get one shot
++	 * at this. A zero clock is never going to work and is almost certainly
++	 * due to a parent not being ready, so prefer to defer.
++	 */
++	if (!up.port.uartclk)
++	    return -EPROBE_DEFER;
++
+ 	/* register the port */
+ 	ret = serial8250_register_8250_port(&up);
+ 	if (ret < 0) {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0186-media-bcm2835-unicam-Reinstate-V4L2_CAP_READWRITE-in.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0186-media-bcm2835-unicam-Reinstate-V4L2_CAP_READWRITE-in.patch
new file mode 100644
index 00000000..687fe146
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0186-media-bcm2835-unicam-Reinstate-V4L2_CAP_READWRITE-in.patch
@@ -0,0 +1,28 @@
+From 10c043a14825801348dc48e9bbedab1e71a180b0 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 7 Jul 2020 14:23:40 +0100
+Subject: [PATCH 186/697] media: bcm2835-unicam: Reinstate V4L2_CAP_READWRITE
+ in the caps
+
+v4l2-compliance throws a failure if the device doesn't advertise
+V4L2_CAP_READWRITE but allows read or write operations.
+We do support read, so reinstate the flag.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -2410,8 +2410,8 @@ static int register_node(struct unicam_d
+ 	vdev->queue = q;
+ 	vdev->lock = &node->lock;
+ 	vdev->device_caps = (pad_id == IMAGE_PAD) ?
+-			    (V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING) :
+-			    (V4L2_CAP_META_CAPTURE | V4L2_CAP_STREAMING);
++				V4L2_CAP_VIDEO_CAPTURE : V4L2_CAP_META_CAPTURE;
++	vdev->device_caps |= V4L2_CAP_READWRITE | V4L2_CAP_STREAMING;
+ 
+ 	/* Define the device names */
+ 	snprintf(vdev->name, sizeof(vdev->name), "%s-%s", UNICAM_MODULE_NAME,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0187-media-bcm2835-unicam-Ensure-type-is-VIDEO_CAPTURE-in.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0187-media-bcm2835-unicam-Ensure-type-is-VIDEO_CAPTURE-in.patch
new file mode 100644
index 00000000..4ad7d7e2
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0187-media-bcm2835-unicam-Ensure-type-is-VIDEO_CAPTURE-in.patch
@@ -0,0 +1,36 @@
+From 2c9caaaf083d6ff350aefc60a084e04e24850f18 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 7 Jul 2020 14:52:43 +0100
+Subject: [PATCH 187/697] media: bcm2835-unicam: Ensure type is VIDEO_CAPTURE
+ in [g|s]_selection
+
+[g|s]_selection pass in a buffer type that needs to be validated
+before passing on to the sensor subdev.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -1877,6 +1877,9 @@ static int unicam_s_selection(struct fil
+ 		.r = sel->r,
+ 	};
+ 
++	if (sel->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
++		return -EINVAL;
++
+ 	return v4l2_subdev_call(dev->sensor, pad, set_selection, NULL, &sdsel);
+ }
+ 
+@@ -1891,6 +1894,9 @@ static int unicam_g_selection(struct fil
+ 	};
+ 	int ret;
+ 
++	if (sel->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
++		return -EINVAL;
++
+ 	ret = v4l2_subdev_call(dev->sensor, pad, get_selection, NULL, &sdsel);
+ 	if (!ret)
+ 		sel->r = sdsel.r;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0188-media-bcm2835-unicam-Set-VPU-min-clock-freq-to-250Mh.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0188-media-bcm2835-unicam-Set-VPU-min-clock-freq-to-250Mh.patch
new file mode 100644
index 00000000..9a21c947
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0188-media-bcm2835-unicam-Set-VPU-min-clock-freq-to-250Mh.patch
@@ -0,0 +1,127 @@
+From 357779c9389450754631bb3180a671cd6f0389ef Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Mon, 11 May 2020 13:02:22 +0100
+Subject: [PATCH 188/697] media: bcm2835: unicam: Set VPU min clock freq to
+ 250Mhz.
+
+When streaming with Unicam, the VPU must have a clock frequency of at
+least 250Mhz.  Otherwise, the input fifos could overrun, causing
+image corruption.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../media/platform/bcm2835/bcm2835-unicam.c   | 49 +++++++++++++++++--
+ 1 file changed, 44 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -91,6 +91,11 @@ MODULE_PARM_DESC(debug, "Debug level 0-3
+ 		v4l2_err(&(dev)->v4l2_dev, fmt, ##arg)
+ 
+ /*
++ * Unicam must request a minimum of 250Mhz from the VPU clock.
++ * Otherwise the input FIFOs overrun and cause image corruption.
++ */
++#define MIN_VPU_CLOCK_RATE (250 * 1000 * 1000)
++/*
+  * To protect against a dodgy sensor driver never returning an error from
+  * enum_mbus_code, set a maximum index value to be used.
+  */
+@@ -409,8 +414,10 @@ struct unicam_device {
+ 	void __iomem *base;
+ 	/* clock gating base address */
+ 	void __iomem *clk_gate_base;
+-	/* clock handle */
++	/* lp clock handle */
+ 	struct clk *clock;
++	/* vpu clock handle */
++	struct clk *vpu_clock;
+ 	/* V4l2 device */
+ 	struct v4l2_device v4l2_dev;
+ 	struct media_device mdev;
+@@ -1670,16 +1677,28 @@ static int unicam_start_streaming(struct
+ 	unicam_dbg(1, dev, "Running with %u data lanes\n",
+ 		   dev->active_data_lanes);
+ 
+-	ret = clk_set_rate(dev->clock, 100 * 1000 * 1000);
++	ret = clk_set_min_rate(dev->vpu_clock, MIN_VPU_CLOCK_RATE);
++	if (ret) {
++		unicam_err(dev, "failed to set up VPU clock\n");
++		goto err_pm_put;
++	}
++
++	ret = clk_prepare_enable(dev->vpu_clock);
+ 	if (ret) {
+-		unicam_err(dev, "failed to set up clock\n");
++		unicam_err(dev, "Failed to enable VPU clock: %d\n", ret);
+ 		goto err_pm_put;
+ 	}
+ 
++	ret = clk_set_rate(dev->clock, 100 * 1000 * 1000);
++	if (ret) {
++		unicam_err(dev, "failed to set up CSI clock\n");
++		goto err_vpu_clock;
++	}
++
+ 	ret = clk_prepare_enable(dev->clock);
+ 	if (ret) {
+ 		unicam_err(dev, "Failed to enable CSI clock: %d\n", ret);
+-		goto err_pm_put;
++		goto err_vpu_clock;
+ 	}
+ 
+ 	for (i = 0; i < ARRAY_SIZE(dev->node); i++) {
+@@ -1713,6 +1732,11 @@ static int unicam_start_streaming(struct
+ err_disable_unicam:
+ 	unicam_disable(dev);
+ 	clk_disable_unprepare(dev->clock);
++err_vpu_clock:
++	ret = clk_set_min_rate(dev->vpu_clock, 0);
++	if (ret)
++		unicam_err(dev, "failed to reset the VPU clock\n");
++	clk_disable_unprepare(dev->vpu_clock);
+ err_pm_put:
+ 	unicam_runtime_put(dev);
+ err_streaming:
+@@ -1730,6 +1754,8 @@ static void unicam_stop_streaming(struct
+ 	node->streaming = false;
+ 
+ 	if (node->pad_id == IMAGE_PAD) {
++		int ret;
++
+ 		/*
+ 		 * Stop streaming the sensor and disable the peripheral.
+ 		 * We cannot continue streaming embedded data with the
+@@ -1739,6 +1765,12 @@ static void unicam_stop_streaming(struct
+ 			unicam_err(dev, "stream off failed in subdev\n");
+ 
+ 		unicam_disable(dev);
++
++		ret = clk_set_min_rate(dev->vpu_clock, 0);
++		if (ret)
++			unicam_err(dev, "failed to reset the min VPU clock\n");
++
++		clk_disable_unprepare(dev->vpu_clock);
+ 		clk_disable_unprepare(dev->clock);
+ 		unicam_runtime_put(dev);
+ 
+@@ -2742,11 +2774,18 @@ static int unicam_probe(struct platform_
+ 
+ 	unicam->clock = devm_clk_get(&pdev->dev, "lp");
+ 	if (IS_ERR(unicam->clock)) {
+-		unicam_err(unicam, "Failed to get clock\n");
++		unicam_err(unicam, "Failed to get lp clock\n");
+ 		ret = PTR_ERR(unicam->clock);
+ 		goto err_unicam_put;
+ 	}
+ 
++	unicam->vpu_clock = devm_clk_get(&pdev->dev, "vpu");
++	if (IS_ERR(unicam->vpu_clock)) {
++		unicam_err(unicam, "Failed to get vpu clock\n");
++		ret = PTR_ERR(unicam->vpu_clock);
++		goto err_unicam_put;
++	}
++
+ 	ret = platform_get_irq(pdev, 0);
+ 	if (ret <= 0) {
+ 		dev_err(&pdev->dev, "No IRQ resource\n");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0189-dt-bindings-bcm2835-unicam-Update-documentation-with.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0189-dt-bindings-bcm2835-unicam-Update-documentation-with.patch
new file mode 100644
index 00000000..f4e6e24b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0189-dt-bindings-bcm2835-unicam-Update-documentation-with.patch
@@ -0,0 +1,38 @@
+From dafde791a14b35c5828d2cba9bb8d204e3e6cc72 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Mon, 11 May 2020 13:06:27 +0100
+Subject: [PATCH 189/697] dt-bindings: bcm2835-unicam: Update documentation
+ with new clock params
+
+Update the documentation to reflect the new "VPU" clock needed
+by the bcm2835-unicam driver.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../devicetree/bindings/media/bcm2835-unicam.txt          | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/Documentation/devicetree/bindings/media/bcm2835-unicam.txt
++++ b/Documentation/devicetree/bindings/media/bcm2835-unicam.txt
+@@ -20,7 +20,7 @@ Required properties:
+ - interrupts	: should contain the IRQ line for this Unicam instance.
+ - clocks	: list of clock specifiers, corresponding to entries in
+ 		  clock-names property.
+-- clock-names	: must contain an "lp" entry, matching entries in the
++- clock-names	: must contain "lp" and "vpu" entries, matching entries in the
+ 		  clocks property.
+ 
+ Unicam supports a single port node. It should contain one 'port' child node
+@@ -46,9 +46,9 @@ Example:
+ 		reg = <0x7e801000 0x800>,
+ 		      <0x7e802004 0x4>;
+ 		interrupts = <2 7>;
+-		clocks = <&clocks BCM2835_CLOCK_CAM1>;
+-		clock-names = "lp";
+-
++		clocks = <&clocks BCM2835_CLOCK_CAM1>,
++			 <&firmware_clocks 4>;
++		clock-names = "lp", "vpu";
+ 		port {
+ 			csi1_ep: endpoint {
+ 				remote-endpoint = <&tc358743_0>;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0190-leds-Add-the-actpwr-trigger.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0190-leds-Add-the-actpwr-trigger.patch
new file mode 100644
index 00000000..989c3cf3
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0190-leds-Add-the-actpwr-trigger.patch
@@ -0,0 +1,235 @@
+From 6e661357cd8abc6f5c91c1d6f016bc769ca2a911 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 13 Jul 2020 10:33:19 +0100
+Subject: [PATCH 190/697] leds: Add the actpwr trigger
+
+The actpwr trigger is a meta trigger that cycles between an inverted
+mmc0 and default-on. It is written in a way that could fairly easily
+be generalised to support alternative sets of source triggers.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/leds/trigger/Kconfig          |  11 ++
+ drivers/leds/trigger/Makefile         |   1 +
+ drivers/leds/trigger/ledtrig-actpwr.c | 190 ++++++++++++++++++++++++++
+ 3 files changed, 202 insertions(+)
+ create mode 100644 drivers/leds/trigger/ledtrig-actpwr.c
+
+--- a/drivers/leds/trigger/Kconfig
++++ b/drivers/leds/trigger/Kconfig
+@@ -168,4 +168,15 @@ config LEDS_TRIGGER_INPUT_EVENTS
+ 
+ 	  When build as a module this driver will be called ledtrig-input-events.
+ 
++config LEDS_TRIGGER_ACTPWR
++	tristate "ACT/PWR Input Trigger"
++	depends on LEDS_TRIGGERS
++	help
++	  This trigger is intended for platforms that have one software-
++	  controllable LED and no dedicated activity or power LEDs, hence the
++	  need to make the one LED perform both functions. It cycles between
++	  default-on and an inverted mmc0 every 500ms, guaranteeing that it is
++	  on for at least half of the time.
++	  If unsure, say N.
++
+ endif # LEDS_TRIGGERS
+--- a/drivers/leds/trigger/Makefile
++++ b/drivers/leds/trigger/Makefile
+@@ -17,3 +17,4 @@ obj-$(CONFIG_LEDS_TRIGGER_NETDEV)	+= led
+ obj-$(CONFIG_LEDS_TRIGGER_PATTERN)	+= ledtrig-pattern.o
+ obj-$(CONFIG_LEDS_TRIGGER_TTY)		+= ledtrig-tty.o
+ obj-$(CONFIG_LEDS_TRIGGER_INPUT_EVENTS)	+= ledtrig-input-events.o
++obj-$(CONFIG_LEDS_TRIGGER_ACTPWR)	+= ledtrig-actpwr.o
+--- /dev/null
++++ b/drivers/leds/trigger/ledtrig-actpwr.c
+@@ -0,0 +1,190 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Activity/power trigger
++ *
++ * Copyright (C) 2020 Raspberry Pi (Trading) Ltd.
++ *
++ * Based on Atsushi Nemoto's ledtrig-heartbeat.c, although there may be
++ * nothing left of the original now.
++ */
++
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/timer.h>
++#include <linux/leds.h>
++#include "../leds.h"
++
++enum {
++	TRIG_ACT,
++	TRIG_PWR,
++
++	TRIG_COUNT
++};
++
++struct actpwr_trig_src {
++	const char *name;
++	int interval;
++	bool invert;
++};
++
++struct actpwr_vled {
++	struct led_classdev cdev;
++	struct actpwr_trig_data *parent;
++	enum led_brightness value;
++	unsigned int interval;
++	bool invert;
++};
++
++struct actpwr_trig_data {
++	struct led_trigger trig;
++	struct actpwr_vled virt_leds[TRIG_COUNT];
++	struct actpwr_vled *active;
++	struct timer_list timer;
++	int next_active;
++};
++
++static int actpwr_trig_activate(struct led_classdev *led_cdev);
++static void actpwr_trig_deactivate(struct led_classdev *led_cdev);
++
++static const struct actpwr_trig_src actpwr_trig_sources[TRIG_COUNT] = {
++	[TRIG_ACT] = { "mmc0", 500, true },
++	[TRIG_PWR] = { "default-on", 500, false },
++};
++
++static struct actpwr_trig_data actpwr_data = {
++	{
++		.name     = "actpwr",
++		.activate = actpwr_trig_activate,
++		.deactivate = actpwr_trig_deactivate,
++	}
++};
++
++static void actpwr_brightness_set(struct led_classdev *led_cdev,
++				  enum led_brightness value)
++{
++	struct actpwr_vled *vled = container_of(led_cdev, struct actpwr_vled,
++					       cdev);
++	struct actpwr_trig_data *trig = vled->parent;
++
++	if (vled->invert)
++		value = !value;
++	vled->value = value;
++
++	if (vled == trig->active)
++		led_trigger_event(&trig->trig, value);
++}
++
++static int actpwr_brightness_set_blocking(struct led_classdev *led_cdev,
++					  enum led_brightness value)
++{
++	actpwr_brightness_set(led_cdev, value);
++	return 0;
++}
++
++static enum led_brightness actpwr_brightness_get(struct led_classdev *led_cdev)
++{
++	struct actpwr_vled *vled = container_of(led_cdev, struct actpwr_vled,
++					      cdev);
++
++	return vled->value;
++}
++
++static void actpwr_trig_cycle(struct timer_list *t)
++{
++	struct actpwr_trig_data *trig  = &actpwr_data;
++	struct actpwr_vled *active;
++
++	active = &trig->virt_leds[trig->next_active];
++	trig->active = active;
++	trig->next_active = (trig->next_active + 1) % TRIG_COUNT;
++
++	led_trigger_event(&trig->trig, active->value);
++
++	mod_timer(&trig->timer, jiffies + msecs_to_jiffies(active->interval));
++}
++
++static int actpwr_trig_activate(struct led_classdev *led_cdev)
++{
++	struct actpwr_trig_data *trig  = &actpwr_data;
++
++	/* Start the timer if this is the first LED */
++	if (!trig->active)
++		actpwr_trig_cycle(&trig->timer);
++	else
++		led_set_brightness_nosleep(led_cdev, trig->active->value);
++
++	return 0;
++}
++
++static void actpwr_trig_deactivate(struct led_classdev *led_cdev)
++{
++	struct actpwr_trig_data *trig  = &actpwr_data;
++
++	if (list_empty(&trig->trig.led_cdevs)) {
++		del_timer_sync(&trig->timer);
++		trig->active = NULL;
++	}
++}
++
++static int __init actpwr_trig_init(void)
++{
++	struct actpwr_trig_data *trig  = &actpwr_data;
++	int ret = 0;
++	int i;
++
++	timer_setup(&trig->timer, actpwr_trig_cycle, 0);
++
++	/* Register one "LED" for each source trigger */
++	for (i = 0; i < TRIG_COUNT; i++)
++	{
++		struct actpwr_vled *vled = &trig->virt_leds[i];
++		struct led_classdev *cdev = &vled->cdev;
++		const struct actpwr_trig_src *src = &actpwr_trig_sources[i];
++
++		vled->parent = trig;
++		vled->interval = src->interval;
++		vled->invert = src->invert;
++		cdev->name = src->name;
++		cdev->brightness_set = actpwr_brightness_set;
++		cdev->brightness_set_blocking = actpwr_brightness_set_blocking;
++		cdev->brightness_get = actpwr_brightness_get;
++		cdev->default_trigger = src->name;
++		ret = led_classdev_register(NULL, cdev);
++		if (ret)
++			goto error_classdev;
++	}
++
++	ret = led_trigger_register(&trig->trig);
++	if (ret)
++		goto error_classdev;
++
++	return 0;
++
++error_classdev:
++	while (i > 0)
++	{
++		i--;
++		led_classdev_unregister(&trig->virt_leds[i].cdev);
++	}
++
++	return ret;
++}
++
++static void __exit actpwr_trig_exit(void)
++{
++	int i;
++
++	led_trigger_unregister(&actpwr_data.trig);
++	for (i = 0; i < TRIG_COUNT; i++)
++	{
++		led_classdev_unregister(&actpwr_data.virt_leds[i].cdev);
++	}
++}
++
++module_init(actpwr_trig_init);
++module_exit(actpwr_trig_exit);
++
++MODULE_AUTHOR("Phil Elwell <phil@raspberrypi.com>");
++MODULE_DESCRIPTION("ACT/PWR LED trigger");
++MODULE_LICENSE("GPL v2");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0191-media-bcm2835-unicam-Drop-WARN-on-uing-direct-cache-.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0191-media-bcm2835-unicam-Drop-WARN-on-uing-direct-cache-.patch
new file mode 100644
index 00000000..6dd78621
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0191-media-bcm2835-unicam-Drop-WARN-on-uing-direct-cache-.patch
@@ -0,0 +1,34 @@
+From b968423cc335c19db7a515295d45a034006f62e8 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 27 Aug 2020 16:30:26 +0100
+Subject: [PATCH 191/697] media: bcm2835-unicam: Drop WARN on uing direct cache
+ alias
+
+Pi 0&1 pass all ARM accesses through the VPU L2 cache, therefore
+the dma-ranges property sets the cache alias bits to other
+than the direct alias, hence this WARN was firing.
+
+It was overprotective coding, so assume that everything is OK
+with the dma-ranges, and remove the WARN.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -701,13 +701,6 @@ static void unicam_wr_dma_addr(struct un
+ {
+ 	dma_addr_t endaddr = dmaaddr + buffer_size;
+ 
+-	/*
+-	 * dmaaddr and endaddr should be a 32-bit address with the top two bits
+-	 * set to 0x3 to signify uncached access through the Videocore memory
+-	 * controller.
+-	 */
+-	WARN_ON((dmaaddr >> 30) != 0x3 || (endaddr >> 30) != 0x3);
+-
+ 	if (pad_id == IMAGE_PAD) {
+ 		reg_write(dev, UNICAM_IBSA0, dmaaddr);
+ 		reg_write(dev, UNICAM_IBEA0, endaddr);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0192-media-bcm2835-unicam-Always-service-interrupts.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0192-media-bcm2835-unicam-Always-service-interrupts.patch
new file mode 100644
index 00000000..e07bde50
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0192-media-bcm2835-unicam-Always-service-interrupts.patch
@@ -0,0 +1,51 @@
+From 8caf37520a4cbcb554445ab3760b204a0e899016 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 13 May 2020 18:28:27 +0100
+Subject: [PATCH 192/697] media: bcm2835-unicam: Always service interrupts
+
+From when bringing up the driver, there was a check in the isr
+to ignore interrupts (claiming them handled) should the driver
+not be streaming.
+
+The VPU now will not register a camera driver if it finds a
+CSI2 node enabled in device tree, therefore this flawed check is
+redundant.
+
+https://github.com/raspberrypi/linux/issues/3602
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 15 ---------------
+ 1 file changed, 15 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -774,12 +774,6 @@ static bool unicam_all_nodes_streaming(s
+ 	return ret;
+ }
+ 
+-static bool unicam_all_nodes_disabled(struct unicam_device *dev)
+-{
+-	return !dev->node[IMAGE_PAD].streaming &&
+-	       !dev->node[METADATA_PAD].streaming;
+-}
+-
+ static void unicam_queue_event_sof(struct unicam_device *unicam)
+ {
+ 	struct v4l2_event event = {
+@@ -807,15 +801,6 @@ static irqreturn_t unicam_isr(int irq, v
+ 	u32 ista, sta;
+ 	u64 ts;
+ 
+-	/*
+-	 * Don't service interrupts if not streaming.
+-	 * Avoids issues if the VPU should enable the
+-	 * peripheral without the kernel knowing (that
+-	 * shouldn't happen, but causes issues if it does).
+-	 */
+-	if (unicam_all_nodes_disabled(unicam))
+-		return IRQ_NONE;
+-
+ 	sta = reg_read(unicam, UNICAM_STA);
+ 	/* Write value back to clear the interrupts */
+ 	reg_write(unicam, UNICAM_STA, sta);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0193-media-bcm2835-unicam-Fix-uninitialized-warning.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0193-media-bcm2835-unicam-Fix-uninitialized-warning.patch
new file mode 100644
index 00000000..f5c9a2d0
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0193-media-bcm2835-unicam-Fix-uninitialized-warning.patch
@@ -0,0 +1,21 @@
+From 5b4e324f89b07a7374a9f8748a9c19376ae834d2 Mon Sep 17 00:00:00 2001
+From: Jacko Dirks <jdirks.linuxdev@gmail.com>
+Date: Tue, 5 May 2020 14:33:31 +0200
+Subject: [PATCH 193/697] media: bcm2835: unicam: Fix uninitialized warning
+
+Signed-off-by: Jacko Dirks <jdirks.linuxdev@gmail.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -996,7 +996,7 @@ const struct unicam_fmt *get_first_suppo
+ 	struct v4l2_subdev_mbus_code_enum mbus_code;
+ 	const struct unicam_fmt *fmt = NULL;
+ 	unsigned int i;
+-	int ret;
++	int ret = 0;
+ 
+ 	for (i = 0; ret != -EINVAL && ret != -ENOIOCTLCMD; ++i) {
+ 		memset(&mbus_code, 0, sizeof(mbus_code));
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0194-media-bcm2835-unicam-Fixup-review-comments-from-Hans.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0194-media-bcm2835-unicam-Fixup-review-comments-from-Hans.patch
new file mode 100644
index 00000000..3c7178f8
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0194-media-bcm2835-unicam-Fixup-review-comments-from-Hans.patch
@@ -0,0 +1,215 @@
+From bf223a7597c539daaca4eede593f032bd7b1c7c3 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 23 Jun 2020 15:14:05 +0100
+Subject: [PATCH 194/697] media: bcm2835-unicam: Fixup review comments from
+ Hans.
+
+Updates the driver based on the upstream review comments from
+Hans Verkuil at https://patchwork.linuxtv.org/patch/63531/
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../media/platform/bcm2835/bcm2835-unicam.c   | 70 ++++++++-----------
+ 1 file changed, 31 insertions(+), 39 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /*
+- * BCM2835 Unicam Capture Driver
++ * BCM283x / BCM271x Unicam Capture Driver
+  *
+  * Copyright (C) 2017-2020 - Raspberry Pi (Trading) Ltd.
+  *
+@@ -563,9 +563,8 @@ static const struct unicam_fmt *find_for
+ 	return NULL;
+ }
+ 
+-static inline unsigned int bytes_per_line(u32 width,
+-					  const struct unicam_fmt *fmt,
+-					  u32 v4l2_fourcc)
++static unsigned int bytes_per_line(u32 width, const struct unicam_fmt *fmt,
++				   u32 v4l2_fourcc)
+ {
+ 	if (v4l2_fourcc == fmt->repacked_fourcc)
+ 		/* Repacking always goes to 16bpp */
+@@ -710,7 +709,7 @@ static void unicam_wr_dma_addr(struct un
+ 	}
+ }
+ 
+-static inline unsigned int unicam_get_lines_done(struct unicam_device *dev)
++static unsigned int unicam_get_lines_done(struct unicam_device *dev)
+ {
+ 	dma_addr_t start_addr, cur_addr;
+ 	unsigned int stride = dev->node[IMAGE_PAD].v_fmt.fmt.pix.bytesperline;
+@@ -724,7 +723,7 @@ static inline unsigned int unicam_get_li
+ 	return (unsigned int)(cur_addr - start_addr) / stride;
+ }
+ 
+-static inline void unicam_schedule_next_buffer(struct unicam_node *node)
++static void unicam_schedule_next_buffer(struct unicam_node *node)
+ {
+ 	struct unicam_device *dev = node->dev;
+ 	struct unicam_buffer *buf;
+@@ -743,7 +742,7 @@ static inline void unicam_schedule_next_
+ 	unicam_wr_dma_addr(dev, addr, size, node->pad_id);
+ }
+ 
+-static inline void unicam_schedule_dummy_buffer(struct unicam_node *node)
++static void unicam_schedule_dummy_buffer(struct unicam_node *node)
+ {
+ 	struct unicam_device *dev = node->dev;
+ 
+@@ -755,8 +754,8 @@ static inline void unicam_schedule_dummy
+ 	node->next_frm = NULL;
+ }
+ 
+-static inline void unicam_process_buffer_complete(struct unicam_node *node,
+-						  unsigned int sequence)
++static void unicam_process_buffer_complete(struct unicam_node *node,
++					   unsigned int sequence)
+ {
+ 	node->cur_frm->vb.field = node->m_fmt.field;
+ 	node->cur_frm->vb.sequence = sequence;
+@@ -764,16 +763,6 @@ static inline void unicam_process_buffer
+ 	vb2_buffer_done(&node->cur_frm->vb.vb2_buf, VB2_BUF_STATE_DONE);
+ }
+ 
+-static bool unicam_all_nodes_streaming(struct unicam_device *dev)
+-{
+-	bool ret;
+-
+-	ret = dev->node[IMAGE_PAD].open && dev->node[IMAGE_PAD].streaming;
+-	ret &= !dev->node[METADATA_PAD].open ||
+-	       dev->node[METADATA_PAD].streaming;
+-	return ret;
+-}
+-
+ static void unicam_queue_event_sof(struct unicam_device *unicam)
+ {
+ 	struct v4l2_event event = {
+@@ -896,8 +885,8 @@ static int unicam_querycap(struct file *
+ 	struct unicam_node *node = video_drvdata(file);
+ 	struct unicam_device *dev = node->dev;
+ 
+-	strlcpy(cap->driver, UNICAM_MODULE_NAME, sizeof(cap->driver));
+-	strlcpy(cap->card, UNICAM_MODULE_NAME, sizeof(cap->card));
++	strscpy(cap->driver, UNICAM_MODULE_NAME, sizeof(cap->driver));
++	strscpy(cap->card, UNICAM_MODULE_NAME, sizeof(cap->card));
+ 
+ 	snprintf(cap->bus_info, sizeof(cap->bus_info),
+ 		 "platform:%s", dev_name(&dev->pdev->dev));
+@@ -990,8 +979,8 @@ static int unicam_g_fmt_vid_cap(struct f
+ 	return 0;
+ }
+ 
+-static
+-const struct unicam_fmt *get_first_supported_format(struct unicam_device *dev)
++static const struct unicam_fmt *
++get_first_supported_format(struct unicam_device *dev)
+ {
+ 	struct v4l2_subdev_mbus_code_enum mbus_code;
+ 	const struct unicam_fmt *fmt = NULL;
+@@ -1581,7 +1570,8 @@ static void unicam_disable(struct unicam
+ 	clk_write(dev, 0);
+ }
+ 
+-static void unicam_return_buffers(struct unicam_node *node)
++static void unicam_return_buffers(struct unicam_node *node,
++				  enum vb2_buffer_state state)
+ {
+ 	struct unicam_buffer *buf, *tmp;
+ 	unsigned long flags;
+@@ -1589,15 +1579,15 @@ static void unicam_return_buffers(struct
+ 	spin_lock_irqsave(&node->dma_queue_lock, flags);
+ 	list_for_each_entry_safe(buf, tmp, &node->dma_queue, list) {
+ 		list_del(&buf->list);
+-		vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
++		vb2_buffer_done(&buf->vb.vb2_buf, state);
+ 	}
+ 
+ 	if (node->cur_frm)
+ 		vb2_buffer_done(&node->cur_frm->vb.vb2_buf,
+-				VB2_BUF_STATE_ERROR);
++				state);
+ 	if (node->next_frm && node->cur_frm != node->next_frm)
+ 		vb2_buffer_done(&node->next_frm->vb.vb2_buf,
+-				VB2_BUF_STATE_ERROR);
++				state);
+ 
+ 	node->cur_frm = NULL;
+ 	node->next_frm = NULL;
+@@ -1614,7 +1604,13 @@ static int unicam_start_streaming(struct
+ 	int ret;
+ 
+ 	node->streaming = true;
+-	if (!unicam_all_nodes_streaming(dev)) {
++	if (!(dev->node[IMAGE_PAD].open && dev->node[IMAGE_PAD].streaming &&
++	      (!dev->node[METADATA_PAD].open ||
++	       dev->node[METADATA_PAD].streaming))) {
++		/*
++		 * Metadata pad must be enabled before image pad if it is
++		 * wanted.
++		 */
+ 		unicam_dbg(3, dev, "Not all nodes are streaming yet.");
+ 		return 0;
+ 	}
+@@ -1718,7 +1714,7 @@ err_vpu_clock:
+ err_pm_put:
+ 	unicam_runtime_put(dev);
+ err_streaming:
+-	unicam_return_buffers(node);
++	unicam_return_buffers(node, VB2_BUF_STATE_QUEUED);
+ 	node->streaming = false;
+ 
+ 	return ret;
+@@ -1763,7 +1759,7 @@ static void unicam_stop_streaming(struct
+ 	}
+ 
+ 	/* Clear all queued buffers for the node */
+-	unicam_return_buffers(node);
++	unicam_return_buffers(node, VB2_BUF_STATE_ERROR);
+ }
+ 
+ static int unicam_enum_input(struct file *file, void *priv,
+@@ -1781,14 +1777,13 @@ static int unicam_enum_input(struct file
+ 		inp->std = 0;
+ 	} else if (v4l2_subdev_has_op(dev->sensor, video, s_std)) {
+ 		inp->capabilities = V4L2_IN_CAP_STD;
+-		if (v4l2_subdev_call(dev->sensor, video, g_tvnorms, &inp->std)
+-					< 0)
++		if (v4l2_subdev_call(dev->sensor, video, g_tvnorms, &inp->std) < 0)
+ 			inp->std = V4L2_STD_ALL;
+ 	} else {
+ 		inp->capabilities = 0;
+ 		inp->std = 0;
+ 	}
+-	sprintf(inp->name, "Camera 0");
++	snprintf(inp->name, sizeof(inp->name), "Camera 0");
+ 	return 0;
+ }
+ 
+@@ -2017,6 +2012,9 @@ static int unicam_s_dv_timings(struct fi
+ 	ret = v4l2_subdev_call(dev->sensor, video, g_dv_timings,
+ 			       &current_timings);
+ 
++	if (ret < 0)
++		return ret;
++
+ 	if (v4l2_match_dv_timings(timings, &current_timings, 0, false))
+ 		return 0;
+ 
+@@ -2447,12 +2445,6 @@ static int register_node(struct unicam_d
+ 		unicam_err(unicam, "Unable to allocate dummy buffer.\n");
+ 		return -ENOMEM;
+ 	}
+-
+-	if (pad_id == METADATA_PAD) {
+-		v4l2_disable_ioctl(vdev, VIDIOC_DQEVENT);
+-		v4l2_disable_ioctl(vdev, VIDIOC_SUBSCRIBE_EVENT);
+-		v4l2_disable_ioctl(vdev, VIDIOC_UNSUBSCRIBE_EVENT);
+-	}
+ 	if (pad_id == METADATA_PAD ||
+ 	    !v4l2_subdev_has_op(unicam->sensor, video, s_std)) {
+ 		v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_STD);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0195-media-bcm2835-unicam-Retain-packing-information-on-G.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0195-media-bcm2835-unicam-Retain-packing-information-on-G.patch
new file mode 100644
index 00000000..290585a6
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0195-media-bcm2835-unicam-Retain-packing-information-on-G.patch
@@ -0,0 +1,48 @@
+From cfd96bd191b3b54dee3b0d00ede5638415a44497 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 19 May 2020 11:46:47 +0100
+Subject: [PATCH 195/697] media: bcm2835-unicam: Retain packing information on
+ G_FMT
+
+The change to retrieve the pixel format always on g_fmt didn't
+check whether the native or unpacked version of the format
+had been requested, and always returned the packed one.
+Correct this so that the packing setting is retained whereever
+possible.
+
+Fixes "9d59e89 media: bcm2835-unicam: Re-fetch mbus code from subdev
+on a g_fmt call"
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../media/platform/bcm2835/bcm2835-unicam.c   | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -972,8 +972,23 @@ static int unicam_g_fmt_vid_cap(struct f
+ 	if (!fmt)
+ 		return -EINVAL;
+ 
+-	node->fmt = fmt;
+-	node->v_fmt.fmt.pix.pixelformat = fmt->fourcc;
++	if (node->fmt != fmt) {
++		/*
++		 * The sensor format has changed so the pixelformat needs to
++		 * be updated. Try and retain the packed/unpacked choice if
++		 * at all possible.
++		 */
++		if (node->fmt->repacked_fourcc ==
++						node->v_fmt.fmt.pix.pixelformat)
++			/* Using the repacked format */
++			node->v_fmt.fmt.pix.pixelformat = fmt->repacked_fourcc;
++		else
++			/* Using the native format */
++			node->v_fmt.fmt.pix.pixelformat = fmt->fourcc;
++
++		node->fmt = fmt;
++	}
++
+ 	*f = node->v_fmt;
+ 
+ 	return 0;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0196-media-bcm2835-unicam-change-minimum-number-of-vb2_qu.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0196-media-bcm2835-unicam-change-minimum-number-of-vb2_qu.patch
new file mode 100644
index 00000000..ec2699c7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0196-media-bcm2835-unicam-change-minimum-number-of-vb2_qu.patch
@@ -0,0 +1,28 @@
+From 7e94ba7f10ff70a889290a3a79fa9f02628bf54f Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.com>
+Date: Thu, 28 May 2020 11:09:48 +0100
+Subject: [PATCH 196/697] media: bcm2835-unicam: change minimum number of
+ vb2_queue buffers to 1
+
+Since the unicam driver was modified to write to a dummy buffer when no
+user-supplied buffer is available, it can now write to and return a
+buffer even when there's only a single one. Enable this by changing the
+min_buffers_needed in the vb2_queue; it will be useful for enabling
+still captures without allocating more memory than absolutely necessary.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -2420,7 +2420,7 @@ static int register_node(struct unicam_d
+ 	q->buf_struct_size = sizeof(struct unicam_buffer);
+ 	q->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
+ 	q->lock = &node->lock;
+-	q->min_buffers_needed = 2;
++	q->min_queued_buffers = 1;
+ 	q->dev = &unicam->pdev->dev;
+ 
+ 	ret = vb2_queue_init(q);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0197-staging-fbtft-Add-support-for-display-variants.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0197-staging-fbtft-Add-support-for-display-variants.patch
new file mode 100644
index 00000000..363c4a24
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0197-staging-fbtft-Add-support-for-display-variants.patch
@@ -0,0 +1,293 @@
+From 2a04a963e08f2589ce239f3d209397a07ee1ca4f Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 1 Sep 2020 18:15:27 +0100
+Subject: [PATCH 197/697] staging/fbtft: Add support for display variants
+
+Display variants are intended as a replacement for the now-deleted
+fbtft_device drivers. Drivers can register additional compatible
+strings with a custom callback that can make the required changes
+to the fbtft_display structure.
+
+Start the ball rolling by adding adafruit18, adafruit18_green and
+sainsmart18 displays.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/staging/fbtft/fb_st7735r.c |  38 +++++++++-
+ drivers/staging/fbtft/fbtft-core.c |  16 ++++-
+ drivers/staging/fbtft/fbtft.h      | 112 +++++++++++++++++++----------
+ 3 files changed, 126 insertions(+), 40 deletions(-)
+
+--- a/drivers/staging/fbtft/fb_st7735r.c
++++ b/drivers/staging/fbtft/fb_st7735r.c
+@@ -16,6 +16,10 @@
+ #define DEFAULT_GAMMA   "0F 1A 0F 18 2F 28 20 22 1F 1B 23 37 00 07 02 10\n" \
+ 			"0F 1B 0F 17 33 2C 29 2E 30 30 39 3F 00 07 03 10"
+ 
++#define ADAFRUIT18_GAMMA \
++			"02 1c 07 12 37 32 29 2d 29 25 2B 39 00 01 03 10\n" \
++			"03 1d 07 06 2E 2C 29 2D 2E 2E 37 3F 00 00 02 10"
++
+ static const s16 default_init_sequence[] = {
+ 	-1, MIPI_DCS_SOFT_RESET,
+ 	-2, 150,                               /* delay */
+@@ -94,6 +98,14 @@ static void set_addr_win(struct fbtft_pa
+ 	write_reg(par, MIPI_DCS_WRITE_MEMORY_START);
+ }
+ 
++static void adafruit18_green_tab_set_addr_win(struct fbtft_par *par,
++					      int xs, int ys, int xe, int ye)
++{
++	write_reg(par, 0x2A, 0, xs + 2, 0, xe + 2);
++	write_reg(par, 0x2B, 0, ys + 1, 0, ye + 1);
++	write_reg(par, 0x2C);
++}
++
+ #define MY BIT(7)
+ #define MX BIT(6)
+ #define MV BIT(5)
+@@ -174,12 +186,36 @@ static struct fbtft_display display = {
+ 	},
+ };
+ 
+-FBTFT_REGISTER_DRIVER(DRVNAME, "sitronix,st7735r", &display);
++static int variant_adafruit18(struct fbtft_display *display)
++{
++	display->gamma = ADAFRUIT18_GAMMA;
++	return 0;
++}
++
++static int variant_adafruit18_green(struct fbtft_display *display)
++{
++	display->gamma = ADAFRUIT18_GAMMA;
++	display->fbtftops.set_addr_win = adafruit18_green_tab_set_addr_win;
++	return 0;
++}
++
++FBTFT_REGISTER_DRIVER_START(&display)
++FBTFT_COMPATIBLE("sitronix,st7735r")
++FBTFT_COMPATIBLE("fbtft,sainsmart18")
++FBTFT_VARIANT_COMPATIBLE("fbtft,adafruit18", variant_adafruit18)
++FBTFT_VARIANT_COMPATIBLE("fbtft,adafruit18_green", variant_adafruit18_green)
++FBTFT_REGISTER_DRIVER_END(DRVNAME, &display);
+ 
+ MODULE_ALIAS("spi:" DRVNAME);
+ MODULE_ALIAS("platform:" DRVNAME);
+ MODULE_ALIAS("spi:st7735r");
+ MODULE_ALIAS("platform:st7735r");
++MODULE_ALIAS("spi:sainsmart18");
++MODULE_ALIAS("platform:sainsmart");
++MODULE_ALIAS("spi:adafruit18");
++MODULE_ALIAS("platform:adafruit18");
++MODULE_ALIAS("spi:adafruit18_green");
++MODULE_ALIAS("platform:adafruit18_green");
+ 
+ MODULE_DESCRIPTION("FB driver for the ST7735R LCD Controller");
+ MODULE_AUTHOR("Noralf Tronnes");
+--- a/drivers/staging/fbtft/fbtft-core.c
++++ b/drivers/staging/fbtft/fbtft-core.c
+@@ -24,6 +24,8 @@
+ #include <linux/platform_device.h>
+ #include <linux/property.h>
+ #include <linux/spinlock.h>
++#include <linux/of.h>
++#include <linux/of_device.h>
+ 
+ #include <video/mipi_display.h>
+ 
+@@ -1131,6 +1133,7 @@ static struct fbtft_platform_data *fbtft
+  * @display: Display properties
+  * @sdev: SPI device
+  * @pdev: Platform device
++ * @dt_ids: Compatible string table
+  *
+  * Allocates, initializes and registers a framebuffer
+  *
+@@ -1140,12 +1143,15 @@ static struct fbtft_platform_data *fbtft
+  */
+ int fbtft_probe_common(struct fbtft_display *display,
+ 		       struct spi_device *sdev,
+-		       struct platform_device *pdev)
++		       struct platform_device *pdev,
++		       const struct of_device_id *dt_ids)
+ {
+ 	struct device *dev;
+ 	struct fb_info *info;
+ 	struct fbtft_par *par;
+ 	struct fbtft_platform_data *pdata;
++	const struct of_device_id *match;
++	int (*variant)(struct fbtft_display *);
+ 	int ret;
+ 
+ 	if (sdev)
+@@ -1158,6 +1164,14 @@ int fbtft_probe_common(struct fbtft_disp
+ 		pdata = fbtft_properties_read(dev);
+ 		if (IS_ERR(pdata))
+ 			return PTR_ERR(pdata);
++		match = of_match_device(dt_ids, dev);
++		if (match && match->data) {
++			/* apply the variant */
++			variant = match->data;
++			ret = (*variant)(display);
++			if (ret)
++				return ret;
++		}
+ 	}
+ 
+ 	info = fbtft_framebuffer_alloc(display, dev, pdata);
+--- a/drivers/staging/fbtft/fbtft.h
++++ b/drivers/staging/fbtft/fbtft.h
+@@ -253,7 +253,8 @@ void fbtft_register_backlight(struct fbt
+ void fbtft_unregister_backlight(struct fbtft_par *par);
+ int fbtft_init_display(struct fbtft_par *par);
+ int fbtft_probe_common(struct fbtft_display *display, struct spi_device *sdev,
+-		       struct platform_device *pdev);
++		       struct platform_device *pdev,
++		       const struct of_device_id *dt_ids);
+ void fbtft_remove_common(struct device *dev, struct fb_info *info);
+ 
+ /* fbtft-io.c */
+@@ -274,42 +275,25 @@ void fbtft_write_reg8_bus9(struct fbtft_
+ void fbtft_write_reg16_bus8(struct fbtft_par *par, int len, ...);
+ void fbtft_write_reg16_bus16(struct fbtft_par *par, int len, ...);
+ 
+-#define FBTFT_DT_TABLE(_compatible)						\
+-static const struct of_device_id dt_ids[] = {					\
+-	{ .compatible = _compatible },						\
+-	{},									\
+-};										\
+-MODULE_DEVICE_TABLE(of, dt_ids);
+-
+-#define FBTFT_SPI_DRIVER(_name, _compatible, _display, _spi_ids)		\
+-										\
+-static int fbtft_driver_probe_spi(struct spi_device *spi)			\
+-{										\
+-	return fbtft_probe_common(_display, spi, NULL);				\
+-}										\
+-										\
+-static void fbtft_driver_remove_spi(struct spi_device *spi)			\
+-{										\
+-	struct fb_info *info = spi_get_drvdata(spi);				\
+-										\
+-	fbtft_remove_common(&spi->dev, info);					\
+-}										\
+-										\
+-static struct spi_driver fbtft_driver_spi_driver = {				\
+-	.driver = {								\
+-		.name = _name,							\
+-		.of_match_table = dt_ids,					\
+-	},									\
+-	.id_table = _spi_ids,							\
+-	.probe = fbtft_driver_probe_spi,					\
+-	.remove = fbtft_driver_remove_spi,					\
+-};
+-
+-#define FBTFT_REGISTER_DRIVER(_name, _compatible, _display)                \
++#define FBTFT_REGISTER_DRIVER_START(_display)                              \
++									   \
++static const struct of_device_id dt_ids[];                                 \
++									   \
++static int fbtft_driver_probe_spi(struct spi_device *spi)                  \
++{                                                                          \
++	return fbtft_probe_common(_display, spi, NULL, dt_ids);	           \
++}                                                                          \
++									   \
++static void fbtft_driver_remove_spi(struct spi_device *spi)                 \
++{                                                                          \
++	struct fb_info *info = spi_get_drvdata(spi);                       \
++									   \
++	fbtft_remove_common(&spi->dev, info);                              \
++}                                                                          \
+ 									   \
+ static int fbtft_driver_probe_pdev(struct platform_device *pdev)           \
+ {                                                                          \
+-	return fbtft_probe_common(_display, NULL, pdev);                   \
++	return fbtft_probe_common(_display, NULL, pdev, dt_ids);           \
+ }                                                                          \
+ 									   \
+ static void fbtft_driver_remove_pdev(struct platform_device *pdev)	   \
+@@ -319,9 +303,30 @@ static void fbtft_driver_remove_pdev(str
+ 	fbtft_remove_common(&pdev->dev, info);                             \
+ }                                                                          \
+ 									   \
+-FBTFT_DT_TABLE(_compatible)						   \
++static const struct of_device_id dt_ids[] = {
++
++#define FBTFT_COMPATIBLE(_compatible)                                      \
++	{ .compatible = _compatible },
++
++#define FBTFT_VARIANT_COMPATIBLE(_compatible, _variant)                    \
++	{ .compatible = _compatible, .data = _variant },
++
++#define FBTFT_REGISTER_DRIVER_END(_name, _display)                         \
+ 									   \
+-FBTFT_SPI_DRIVER(_name, _compatible, _display, NULL)			   \
++	{},                                                                \
++};                                                                         \
++									   \
++MODULE_DEVICE_TABLE(of, dt_ids);                                           \
++									   \
++									   \
++static struct spi_driver fbtft_driver_spi_driver = {                       \
++	.driver = {                                                        \
++		.name   = _name,                                           \
++		.of_match_table = dt_ids,                                  \
++	},                                                                 \
++	.probe  = fbtft_driver_probe_spi,                                  \
++	.remove = fbtft_driver_remove_spi,                                 \
++};                                                                         \
+ 									   \
+ static struct platform_driver fbtft_driver_platform_driver = {             \
+ 	.driver = {                                                        \
+@@ -357,18 +362,49 @@ module_exit(fbtft_driver_module_exit);
+ 
+ #define FBTFT_REGISTER_SPI_DRIVER(_name, _comp_vend, _comp_dev, _display)	\
+ 										\
+-FBTFT_DT_TABLE(_comp_vend "," _comp_dev)					\
++static const struct of_device_id dt_ids[] = {					\
++	{ .compatible = _comp_vend "," _comp_dev },				\
++	{},									\
++};										\
++										\
++static int fbtft_driver_probe_spi(struct spi_device *spi)			\
++{										\
++	return fbtft_probe_common(_display, spi, NULL, dt_ids);			\
++}										\
++										\
++static void fbtft_driver_remove_spi(struct spi_device *spi)			\
++{										\
++	struct fb_info *info = spi_get_drvdata(spi);				\
++										\
++	fbtft_remove_common(&spi->dev, info);					\
++}										\
++										\
++MODULE_DEVICE_TABLE(of, dt_ids);						\
+ 										\
+ static const struct spi_device_id spi_ids[] = {					\
+ 	{ .name = _comp_dev },							\
+ 	{},									\
+ };										\
++										\
+ MODULE_DEVICE_TABLE(spi, spi_ids);						\
+ 										\
+-FBTFT_SPI_DRIVER(_name, _comp_vend "," _comp_dev, _display, spi_ids)		\
++static struct spi_driver fbtft_driver_spi_driver = {				\
++	.driver = {								\
++		.name  = _name,							\
++		.of_match_table = dt_ids,					\
++	},									\
++	.id_table = spi_ids,							\
++	.probe  = fbtft_driver_probe_spi,					\
++	.remove = fbtft_driver_remove_spi,					\
++};										\
+ 										\
+ module_spi_driver(fbtft_driver_spi_driver);
+ 
++#define FBTFT_REGISTER_DRIVER(_name, _compatible, _display)                \
++	FBTFT_REGISTER_DRIVER_START(_display)                              \
++	FBTFT_COMPATIBLE(_compatible)                                      \
++	FBTFT_REGISTER_DRIVER_END(_name, _display)
++
+ /* Debug macros */
+ 
+ /* shorthand debug levels */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0198-brcmfmac-Increase-power-saving-delay-to-2s.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0198-brcmfmac-Increase-power-saving-delay-to-2s.patch
new file mode 100644
index 00000000..4eebff41
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0198-brcmfmac-Increase-power-saving-delay-to-2s.patch
@@ -0,0 +1,33 @@
+From ad145e9663609e215904494c841982ba806b2756 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 3 Feb 2020 09:32:22 +0000
+Subject: [PATCH 198/697] brcmfmac: Increase power saving delay to 2s
+
+Increase the delay before entering the lower power state to 2 seconds
+(the maximum allowed) in order to reduce the packet latencies,
+particularly for inbound packets.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -3300,7 +3300,7 @@ brcmf_cfg80211_set_power_mgmt(struct wip
+ 		brcmf_dbg(INFO, "Do not enable power save for P2P clients\n");
+ 		pm = PM_OFF;
+ 	}
+-	brcmf_err("power save %s\n", (pm ? "enabled" : "disabled"));
++	brcmf_info("power save %s\n", (pm ? "enabled" : "disabled"));
+ 
+ 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, pm);
+ 	if (err) {
+@@ -3310,6 +3310,7 @@ brcmf_cfg80211_set_power_mgmt(struct wip
+ 			bphy_err(drvr, "error (%d)\n", err);
+ 	}
+ 
++	timeout = 2000; /* 2000ms - the maximum */
+ 	err = brcmf_fil_iovar_int_set(ifp, "pm2_sleep_ret",
+ 				min_t(u32, timeout, BRCMF_PS_MAX_TIMEOUT_MS));
+ 	if (err)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0199-staging-bcm2835-camera-Replace-deprecated-V4L2_PIX_F.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0199-staging-bcm2835-camera-Replace-deprecated-V4L2_PIX_F.patch
new file mode 100644
index 00000000..69dfc9c9
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0199-staging-bcm2835-camera-Replace-deprecated-V4L2_PIX_F.patch
@@ -0,0 +1,30 @@
+From e6eb204d10dd5de4fe6e4a3cb8502ddde1008175 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 8 Oct 2020 15:35:14 +0100
+Subject: [PATCH 199/697] staging: bcm2835-camera: Replace deprecated
+ V4L2_PIX_FMT_BGR32
+
+V4L2_PIX_FMT_BGR32 is deprecated as it is ambiguous over where
+the alpha byte is. Cheese/GStreamer appear to get it wrong for
+one, and qv4l2 gets red and blue swapped.
+
+Swap to the newer V4L2_PIX_FMT_BGRX32 format.
+
+https://www.raspberrypi.org/forums/viewtopic.php?f=38&t=267736&p=1738912
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+@@ -177,7 +177,7 @@ static struct mmal_fmt formats[] = {
+ 		.ybbp = 1,
+ 		.remove_padding = true,
+ 	}, {
+-		.fourcc = V4L2_PIX_FMT_BGR32,
++		.fourcc = V4L2_PIX_FMT_BGRX32,
+ 		.mmal = MMAL_ENCODING_BGRA,
+ 		.depth = 32,
+ 		.mmal_component = COMP_CAMERA,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0200-staging-vc04_services-Add-new-vc-sm-cma-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0200-staging-vc04_services-Add-new-vc-sm-cma-driver.patch
new file mode 100644
index 00000000..c35ed3b6
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0200-staging-vc04_services-Add-new-vc-sm-cma-driver.patch
@@ -0,0 +1,2880 @@
+From 428de8426de2a6a3243eba9d386ac87b4bd3f2cc Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 8 Oct 2020 18:49:52 +0100
+Subject: [PATCH 200/697] staging: vc04_services: Add new vc-sm-cma driver
+
+Add Broadcom VideoCore Shared Memory support.
+
+This new driver allows contiguous memory blocks to be imported
+into the VideoCore VPU memory map, and manages the lifetime of
+those objects, only releasing the source dmabuf once the VPU has
+confirmed it has finished with it.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: vcsm-cma: Fix memory leak from not detaching dmabuf
+
+When importing there was a missing call to detach the buffer,
+so each import leaked the sg table entry.
+
+Actually the release process for both locally allocated and
+imported buffers is identical, so fix them to both use the same
+function.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/vc-sm-cma: Avoid log spamming on Pi0/1 over cache alias.
+
+Pi 0/1 use the 0x80000000 cache alias as the ARM also sees the world
+through the VPU L2 cache.
+vc-sm-cma was trying to ensure it was in an uncached alias (0xc), and
+complaining on every allocation if it weren't. Reduce this logging.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+vc-sm-cma: Restore correct cache maintainance operations
+
+We have been using the more expensive flush operations rather than
+invalidate and clean since kernel rpi-5.9.y
+
+These are exposed with:
+52f1453513ba95084ab811a030032fe605b0cbe2 Re-expose some dmi APIs for use in VCSM
+
+But I believe that commit was dropped when (non-cma) vc-sm was dropped,
+and didn't get updated when the commit was restored
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+staging: vc04_services: Fix clang14 warning
+
+Insert a break to fix a fallthrough warning from clang14. Since the
+fallthrough was to another break, this is a cosmetic change.
+
+See: https://github.com/raspberrypi/linux/issues/5078
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+vc04_services/vc-sm-cma: Handle upstream require vchiq_instance to be passed around
+
+vc04_services/vc-sm-cma: Switch one-bit bitfields to bool
+
+Clang 16 warns:
+
+../drivers/staging/vc04_services/vc-sm-cma/vc_sm.c:816:19: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion]
+        buffer->imported = 1;
+                         ^ ~
+../drivers/staging/vc04_services/vc-sm-cma/vc_sm.c:822:17: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion]
+        buffer->in_use = 1;
+                       ^ ~
+2 warnings generated.
+
+Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
+
+vc04_services: vcsm-cma: Detach from the correct dmabuf
+
+Commit d3292daee319 ("dma-buf: Make locking consistent in dma_buf_detach()")
+added checking that the same dmabuf for which dma_buf_attach
+was called is passed into dma_buf_detach, which flagged up
+that vcsm-cma was passing in the wrong dmabuf.
+
+Correct this so that we don't get the WARN on every dma_buf
+release.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/staging/vc04_services/Kconfig         |    2 +
+ drivers/staging/vc04_services/Makefile        |    1 +
+ .../include/linux/broadcom/vc_sm_cma_ioctl.h  |  114 ++
+ .../staging/vc04_services/vc-sm-cma/Kconfig   |   10 +
+ .../staging/vc04_services/vc-sm-cma/Makefile  |   12 +
+ drivers/staging/vc04_services/vc-sm-cma/TODO  |    1 +
+ .../staging/vc04_services/vc-sm-cma/vc_sm.c   | 1603 +++++++++++++++++
+ .../staging/vc04_services/vc-sm-cma/vc_sm.h   |   84 +
+ .../vc04_services/vc-sm-cma/vc_sm_cma_vchi.c  |  511 ++++++
+ .../vc04_services/vc-sm-cma/vc_sm_cma_vchi.h  |   63 +
+ .../vc04_services/vc-sm-cma/vc_sm_defs.h      |  297 +++
+ .../vc04_services/vc-sm-cma/vc_sm_knl.h       |   28 +
+ 12 files changed, 2726 insertions(+)
+ create mode 100644 drivers/staging/vc04_services/include/linux/broadcom/vc_sm_cma_ioctl.h
+ create mode 100644 drivers/staging/vc04_services/vc-sm-cma/Kconfig
+ create mode 100644 drivers/staging/vc04_services/vc-sm-cma/Makefile
+ create mode 100644 drivers/staging/vc04_services/vc-sm-cma/TODO
+ create mode 100644 drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+ create mode 100644 drivers/staging/vc04_services/vc-sm-cma/vc_sm.h
+ create mode 100644 drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c
+ create mode 100644 drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.h
+ create mode 100644 drivers/staging/vc04_services/vc-sm-cma/vc_sm_defs.h
+ create mode 100644 drivers/staging/vc04_services/vc-sm-cma/vc_sm_knl.h
+
+--- a/drivers/staging/vc04_services/Kconfig
++++ b/drivers/staging/vc04_services/Kconfig
+@@ -50,6 +50,8 @@ source "drivers/staging/vc04_services/bc
+ 
+ source "drivers/staging/vc04_services/bcm2835-camera/Kconfig"
+ 
++source "drivers/staging/vc04_services/vc-sm-cma/Kconfig"
++
+ source "drivers/staging/vc04_services/vchiq-mmal/Kconfig"
+ 
+ endif
+--- a/drivers/staging/vc04_services/Makefile
++++ b/drivers/staging/vc04_services/Makefile
+@@ -14,4 +14,5 @@ endif
+ obj-$(CONFIG_SND_BCM2835)		+= bcm2835-audio/
+ obj-$(CONFIG_VIDEO_BCM2835)		+= bcm2835-camera/
+ obj-$(CONFIG_BCM2835_VCHIQ_MMAL)	+= vchiq-mmal/
++obj-$(CONFIG_BCM_VC_SM_CMA)		+= vc-sm-cma/
+ 
+--- /dev/null
++++ b/drivers/staging/vc04_services/include/linux/broadcom/vc_sm_cma_ioctl.h
+@@ -0,0 +1,114 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++
++/*
++ * Copyright 2019 Raspberry Pi (Trading) Ltd.  All rights reserved.
++ *
++ * Based on vmcs_sm_ioctl.h Copyright Broadcom Corporation.
++ */
++
++#ifndef __VC_SM_CMA_IOCTL_H
++#define __VC_SM_CMA_IOCTL_H
++
++/* ---- Include Files ---------------------------------------------------- */
++
++#if defined(__KERNEL__)
++#include <linux/types.h>	/* Needed for standard types */
++#else
++#include <stdint.h>
++#endif
++
++#include <linux/ioctl.h>
++
++/* ---- Constants and Types ---------------------------------------------- */
++
++#define VC_SM_CMA_RESOURCE_NAME               32
++#define VC_SM_CMA_RESOURCE_NAME_DEFAULT       "sm-host-resource"
++
++/* Type define used to create unique IOCTL number */
++#define VC_SM_CMA_MAGIC_TYPE                  'J'
++
++/* IOCTL commands on /dev/vc-sm-cma */
++enum vc_sm_cma_cmd_e {
++	VC_SM_CMA_CMD_ALLOC = 0x5A,	/* Start at 0x5A arbitrarily */
++
++	VC_SM_CMA_CMD_IMPORT_DMABUF,
++
++	VC_SM_CMA_CMD_CLEAN_INVALID2,
++
++	VC_SM_CMA_CMD_LAST	/* Do not delete */
++};
++
++/* Cache type supported, conveniently matches the user space definition in
++ * user-vcsm.h.
++ */
++enum vc_sm_cma_cache_e {
++	VC_SM_CMA_CACHE_NONE,
++	VC_SM_CMA_CACHE_HOST,
++	VC_SM_CMA_CACHE_VC,
++	VC_SM_CMA_CACHE_BOTH,
++};
++
++/* IOCTL Data structures */
++struct vc_sm_cma_ioctl_alloc {
++	/* user -> kernel */
++	__u32 size;
++	__u32 num;
++	__u32 cached;		/* enum vc_sm_cma_cache_e */
++	__u32 pad;
++	__u8 name[VC_SM_CMA_RESOURCE_NAME];
++
++	/* kernel -> user */
++	__s32 handle;
++	__u32 vc_handle;
++	__u64 dma_addr;
++};
++
++struct vc_sm_cma_ioctl_import_dmabuf {
++	/* user -> kernel */
++	__s32 dmabuf_fd;
++	__u32 cached;		/* enum vc_sm_cma_cache_e */
++	__u8 name[VC_SM_CMA_RESOURCE_NAME];
++
++	/* kernel -> user */
++	__s32 handle;
++	__u32 vc_handle;
++	__u32 size;
++	__u32 pad;
++	__u64 dma_addr;
++};
++
++/*
++ * Cache functions to be set to struct vc_sm_cma_ioctl_clean_invalid2
++ * invalidate_mode.
++ */
++#define VC_SM_CACHE_OP_NOP       0x00
++#define VC_SM_CACHE_OP_INV       0x01
++#define VC_SM_CACHE_OP_CLEAN     0x02
++#define VC_SM_CACHE_OP_FLUSH     0x03
++
++struct vc_sm_cma_ioctl_clean_invalid2 {
++	__u32 op_count;
++	__u32 pad;
++	struct vc_sm_cma_ioctl_clean_invalid_block {
++		__u32 invalidate_mode;
++		__u32 block_count;
++		void *  __user start_address;
++		__u32 block_size;
++		__u32 inter_block_stride;
++	} s[0];
++};
++
++/* IOCTL numbers */
++#define VC_SM_CMA_IOCTL_MEM_ALLOC\
++	_IOR(VC_SM_CMA_MAGIC_TYPE, VC_SM_CMA_CMD_ALLOC,\
++	 struct vc_sm_cma_ioctl_alloc)
++
++#define VC_SM_CMA_IOCTL_MEM_IMPORT_DMABUF\
++	_IOR(VC_SM_CMA_MAGIC_TYPE, VC_SM_CMA_CMD_IMPORT_DMABUF,\
++	 struct vc_sm_cma_ioctl_import_dmabuf)
++
++#define VC_SM_CMA_IOCTL_MEM_CLEAN_INVALID2\
++	_IOR(VC_SM_CMA_MAGIC_TYPE, VC_SM_CMA_CMD_CLEAN_INVALID2,\
++	 struct vc_sm_cma_ioctl_clean_invalid2)
++
++#endif /* __VC_SM_CMA_IOCTL_H */
+--- /dev/null
++++ b/drivers/staging/vc04_services/vc-sm-cma/Kconfig
+@@ -0,0 +1,10 @@
++config BCM_VC_SM_CMA
++	tristate "VideoCore Shared Memory (CMA) driver"
++	select BCM2835_VCHIQ
++	select RBTREE
++	select DMA_SHARED_BUFFER
++	help
++	  Say Y here to enable the shared memory interface that
++	  supports sharing dmabufs with VideoCore.
++	  This operates over the VCHIQ interface to a service
++	  running on VideoCore.
+--- /dev/null
++++ b/drivers/staging/vc04_services/vc-sm-cma/Makefile
+@@ -0,0 +1,12 @@
++ccflags-y += \
++	-I$(srctree)/$(src)/../ \
++	-I$(srctree)/$(src)/../interface/vchiq_arm\
++	-I$(srctree)/$(src)/../include
++
++ccflags-y += \
++	-D__VCCOREVER__=0
++
++vc-sm-cma-$(CONFIG_BCM_VC_SM_CMA) := \
++	vc_sm.o vc_sm_cma_vchi.o
++
++obj-$(CONFIG_BCM_VC_SM_CMA) += vc-sm-cma.o
+--- /dev/null
++++ b/drivers/staging/vc04_services/vc-sm-cma/TODO
+@@ -0,0 +1 @@
++No currently outstanding tasks except some clean-up.
+--- /dev/null
++++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+@@ -0,0 +1,1603 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * VideoCore Shared Memory driver using CMA.
++ *
++ * Copyright: 2018, Raspberry Pi (Trading) Ltd
++ * Dave Stevenson <dave.stevenson@raspberrypi.org>
++ *
++ * Based on vmcs_sm driver from Broadcom Corporation for some API,
++ * and taking some code for buffer allocation and dmabuf handling from
++ * videobuf2.
++ *
++ *
++ * This driver has 3 main uses:
++ * 1) Allocating buffers for the kernel or userspace that can be shared with the
++ *    VPU.
++ * 2) Importing dmabufs from elsewhere for sharing with the VPU.
++ * 3) Allocating buffers for use by the VPU.
++ *
++ * In the first and second cases the native handle is a dmabuf. Releasing the
++ * resource inherently comes from releasing the dmabuf, and this will trigger
++ * unmapping on the VPU. The underlying allocation and our buffer structure are
++ * retained until the VPU has confirmed that it has finished with it.
++ *
++ * For the VPU allocations the VPU is responsible for triggering the release,
++ * and therefore the released message decrements the dma_buf refcount (with the
++ * VPU mapping having already been marked as released).
++ */
++
++/* ---- Include Files ----------------------------------------------------- */
++#include <linux/cdev.h>
++#include <linux/device.h>
++#include <linux/debugfs.h>
++#include <linux/dma-mapping.h>
++#include <linux/dma-buf.h>
++#include <linux/errno.h>
++#include <linux/fs.h>
++#include <linux/kernel.h>
++#include <linux/list.h>
++#include <linux/miscdevice.h>
++#include <linux/module.h>
++#include <linux/mm.h>
++#include <linux/of_device.h>
++#include <linux/platform_device.h>
++#include <linux/proc_fs.h>
++#include <linux/slab.h>
++#include <linux/seq_file.h>
++#include <linux/syscalls.h>
++#include <linux/types.h>
++#include <asm/cacheflush.h>
++
++#include "vchiq_connected.h"
++#include "vc_sm_cma_vchi.h"
++
++#include "vc_sm.h"
++#include "vc_sm_knl.h"
++#include <linux/broadcom/vc_sm_cma_ioctl.h>
++
++MODULE_IMPORT_NS(DMA_BUF);
++
++/* ---- Private Constants and Types --------------------------------------- */
++
++#define DEVICE_NAME		"vcsm-cma"
++#define DEVICE_MINOR		0
++
++#define VC_SM_RESOURCE_NAME_DEFAULT       "sm-host-resource"
++
++#define VC_SM_DIR_ROOT_NAME	"vcsm-cma"
++#define VC_SM_STATE		"state"
++
++/* Private file data associated with each opened device. */
++struct vc_sm_privdata_t {
++	pid_t pid;                      /* PID of creator. */
++
++	int restart_sys;		/* Tracks restart on interrupt. */
++	enum vc_sm_msg_type int_action;	/* Interrupted action. */
++	u32 int_trans_id;		/* Interrupted transaction. */
++};
++
++typedef int (*VC_SM_SHOW) (struct seq_file *s, void *v);
++struct sm_pde_t {
++	VC_SM_SHOW show;          /* Debug fs function hookup. */
++	struct dentry *dir_entry; /* Debug fs directory entry. */
++	void *priv_data;          /* Private data */
++};
++
++/* Global state information. */
++struct sm_state_t {
++	struct platform_device *pdev;
++
++	struct miscdevice misc_dev;
++
++	struct sm_instance *sm_handle;	/* Handle for videocore service. */
++
++	spinlock_t kernelid_map_lock;	/* Spinlock protecting kernelid_map */
++	struct idr kernelid_map;
++
++	struct mutex map_lock;          /* Global map lock. */
++	struct list_head buffer_list;	/* List of buffer. */
++
++	struct vc_sm_privdata_t *data_knl;  /* Kernel internal data tracking. */
++	struct vc_sm_privdata_t *vpu_allocs; /* All allocations from the VPU */
++	struct dentry *dir_root;	/* Debug fs entries root. */
++	struct sm_pde_t dir_state;	/* Debug fs entries state sub-tree. */
++
++	bool require_released_callback;	/* VPU will send a released msg when it
++					 * has finished with a resource.
++					 */
++	u32 int_trans_id;		/* Interrupted transaction. */
++	struct vchiq_instance *vchiq_instance;
++};
++
++struct vc_sm_dma_buf_attachment {
++	struct device *dev;
++	struct sg_table sg_table;
++	struct list_head list;
++	enum dma_data_direction	dma_dir;
++};
++
++/* ---- Private Variables ----------------------------------------------- */
++
++static struct sm_state_t *sm_state;
++static int sm_inited;
++
++/* ---- Private Function Prototypes -------------------------------------- */
++
++/* ---- Private Functions ------------------------------------------------ */
++
++static int get_kernel_id(struct vc_sm_buffer *buffer)
++{
++	int handle;
++
++	spin_lock(&sm_state->kernelid_map_lock);
++	handle = idr_alloc(&sm_state->kernelid_map, buffer, 0, 0, GFP_KERNEL);
++	spin_unlock(&sm_state->kernelid_map_lock);
++
++	return handle;
++}
++
++static struct vc_sm_buffer *lookup_kernel_id(int handle)
++{
++	return idr_find(&sm_state->kernelid_map, handle);
++}
++
++static void free_kernel_id(int handle)
++{
++	spin_lock(&sm_state->kernelid_map_lock);
++	idr_remove(&sm_state->kernelid_map, handle);
++	spin_unlock(&sm_state->kernelid_map_lock);
++}
++
++static int vc_sm_cma_seq_file_show(struct seq_file *s, void *v)
++{
++	struct sm_pde_t *sm_pde;
++
++	sm_pde = (struct sm_pde_t *)(s->private);
++
++	if (sm_pde && sm_pde->show)
++		sm_pde->show(s, v);
++
++	return 0;
++}
++
++static int vc_sm_cma_single_open(struct inode *inode, struct file *file)
++{
++	return single_open(file, vc_sm_cma_seq_file_show, inode->i_private);
++}
++
++static const struct file_operations vc_sm_cma_debug_fs_fops = {
++	.open = vc_sm_cma_single_open,
++	.read = seq_read,
++	.llseek = seq_lseek,
++	.release = single_release,
++};
++
++static int vc_sm_cma_global_state_show(struct seq_file *s, void *v)
++{
++	struct vc_sm_buffer *resource = NULL;
++	int resource_count = 0;
++
++	if (!sm_state)
++		return 0;
++
++	seq_printf(s, "\nVC-ServiceHandle     %p\n", sm_state->sm_handle);
++
++	/* Log all applicable mapping(s). */
++
++	mutex_lock(&sm_state->map_lock);
++	seq_puts(s, "\nResources\n");
++	if (!list_empty(&sm_state->buffer_list)) {
++		list_for_each_entry(resource, &sm_state->buffer_list,
++				    global_buffer_list) {
++			resource_count++;
++
++			seq_printf(s, "\nResource                %p\n",
++				   resource);
++			seq_printf(s, "           NAME         %s\n",
++				   resource->name);
++			seq_printf(s, "           SIZE         %zu\n",
++				   resource->size);
++			seq_printf(s, "           DMABUF       %p\n",
++				   resource->dma_buf);
++			if (resource->imported) {
++				seq_printf(s, "           ATTACH       %p\n",
++					   resource->import.attach);
++				seq_printf(s, "           SGT          %p\n",
++					   resource->import.sgt);
++			} else {
++				seq_printf(s, "           SGT          %p\n",
++					   resource->alloc.sg_table);
++			}
++			seq_printf(s, "           DMA_ADDR     %pad\n",
++				   &resource->dma_addr);
++			seq_printf(s, "           VC_HANDLE     %08x\n",
++				   resource->vc_handle);
++			seq_printf(s, "           VC_MAPPING    %d\n",
++				   resource->vpu_state);
++		}
++	}
++	seq_printf(s, "\n\nTotal resource count:   %d\n\n", resource_count);
++
++	mutex_unlock(&sm_state->map_lock);
++
++	return 0;
++}
++
++/*
++ * Adds a buffer to the private data list which tracks all the allocated
++ * data.
++ */
++static void vc_sm_add_resource(struct vc_sm_privdata_t *privdata,
++			       struct vc_sm_buffer *buffer)
++{
++	mutex_lock(&sm_state->map_lock);
++	list_add(&buffer->global_buffer_list, &sm_state->buffer_list);
++	mutex_unlock(&sm_state->map_lock);
++
++	pr_debug("[%s]: added buffer %p (name %s, size %zu)\n",
++		 __func__, buffer, buffer->name, buffer->size);
++}
++
++/*
++ * Cleans up imported dmabuf.
++ * Should be called with mutex held.
++ */
++static void vc_sm_clean_up_dmabuf(struct vc_sm_buffer *buffer)
++{
++	if (!buffer->imported)
++		return;
++
++	/* Handle cleaning up imported dmabufs */
++	if (buffer->import.sgt) {
++		dma_buf_unmap_attachment(buffer->import.attach,
++					 buffer->import.sgt,
++					 DMA_BIDIRECTIONAL);
++		buffer->import.sgt = NULL;
++	}
++	if (buffer->import.attach) {
++		dma_buf_detach(buffer->import.dma_buf, buffer->import.attach);
++		buffer->import.attach = NULL;
++	}
++}
++
++/*
++ * Instructs VPU to decrement the refcount on a buffer.
++ */
++static void vc_sm_vpu_free(struct vc_sm_buffer *buffer)
++{
++	if (buffer->vc_handle && buffer->vpu_state == VPU_MAPPED) {
++		struct vc_sm_free_t free = { buffer->vc_handle, 0 };
++		int status = vc_sm_cma_vchi_free(sm_state->sm_handle, &free,
++					     &sm_state->int_trans_id);
++		if (status != 0 && status != -EINTR) {
++			pr_err("[%s]: failed to free memory on videocore (status: %u, trans_id: %u)\n",
++			       __func__, status, sm_state->int_trans_id);
++		}
++
++		if (sm_state->require_released_callback) {
++			/* Need to wait for the VPU to confirm the free. */
++
++			/* Retain a reference on this until the VPU has
++			 * released it
++			 */
++			buffer->vpu_state = VPU_UNMAPPING;
++		} else {
++			buffer->vpu_state = VPU_NOT_MAPPED;
++			buffer->vc_handle = 0;
++		}
++	}
++}
++
++/*
++ * Release an allocation.
++ * All refcounting is done via the dma buf object.
++ *
++ * Must be called with the mutex held. The function will either release the
++ * mutex (if defering the release) or destroy it. The caller must therefore not
++ * reuse the buffer on return.
++ */
++static void vc_sm_release_resource(struct vc_sm_buffer *buffer)
++{
++	pr_debug("[%s]: buffer %p (name %s, size %zu), imported %u\n",
++		 __func__, buffer, buffer->name, buffer->size,
++		 buffer->imported);
++
++	if (buffer->vc_handle) {
++		/* We've sent the unmap request but not had the response. */
++		pr_debug("[%s]: Waiting for VPU unmap response on %p\n",
++			 __func__, buffer);
++		goto defer;
++	}
++	if (buffer->in_use) {
++		/* dmabuf still in use - we await the release */
++		pr_debug("[%s]: buffer %p is still in use\n", __func__, buffer);
++		goto defer;
++	}
++
++	/* Release the allocation (whether imported dmabuf or CMA allocation) */
++	if (buffer->imported) {
++		if (buffer->import.dma_buf)
++			dma_buf_put(buffer->import.dma_buf);
++		else
++			pr_err("%s: Imported dmabuf already been put for buf %p\n",
++			       __func__, buffer);
++		buffer->import.dma_buf = NULL;
++	} else {
++		dma_free_coherent(&sm_state->pdev->dev, buffer->size,
++				  buffer->cookie, buffer->dma_addr);
++	}
++
++	/* Free our buffer. Start by removing it from the list */
++	mutex_lock(&sm_state->map_lock);
++	list_del(&buffer->global_buffer_list);
++	mutex_unlock(&sm_state->map_lock);
++
++	pr_debug("%s: Release our allocation - done\n", __func__);
++	mutex_unlock(&buffer->lock);
++
++	mutex_destroy(&buffer->lock);
++
++	kfree(buffer);
++	return;
++
++defer:
++	mutex_unlock(&buffer->lock);
++}
++
++/* Create support for private data tracking. */
++static struct vc_sm_privdata_t *vc_sm_cma_create_priv_data(pid_t id)
++{
++	char alloc_name[32];
++	struct vc_sm_privdata_t *file_data = NULL;
++
++	/* Allocate private structure. */
++	file_data = kzalloc(sizeof(*file_data), GFP_KERNEL);
++
++	if (!file_data)
++		return NULL;
++
++	snprintf(alloc_name, sizeof(alloc_name), "%d", id);
++
++	file_data->pid = id;
++
++	return file_data;
++}
++
++/* Dma buf operations for use with our own allocations */
++
++static int vc_sm_dma_buf_attach(struct dma_buf *dmabuf,
++				struct dma_buf_attachment *attachment)
++
++{
++	struct vc_sm_dma_buf_attachment *a;
++	struct sg_table *sgt;
++	struct vc_sm_buffer *buf = dmabuf->priv;
++	struct scatterlist *rd, *wr;
++	int ret, i;
++
++	a = kzalloc(sizeof(*a), GFP_KERNEL);
++	if (!a)
++		return -ENOMEM;
++
++	pr_debug("%s dmabuf %p attachment %p\n", __func__, dmabuf, attachment);
++
++	mutex_lock(&buf->lock);
++
++	INIT_LIST_HEAD(&a->list);
++
++	sgt = &a->sg_table;
++
++	/* Copy the buf->base_sgt scatter list to the attachment, as we can't
++	 * map the same scatter list to multiple attachments at the same time.
++	 */
++	ret = sg_alloc_table(sgt, buf->alloc.sg_table->orig_nents, GFP_KERNEL);
++	if (ret) {
++		kfree(a);
++		return -ENOMEM;
++	}
++
++	rd = buf->alloc.sg_table->sgl;
++	wr = sgt->sgl;
++	for (i = 0; i < sgt->orig_nents; ++i) {
++		sg_set_page(wr, sg_page(rd), rd->length, rd->offset);
++		rd = sg_next(rd);
++		wr = sg_next(wr);
++	}
++
++	a->dma_dir = DMA_NONE;
++	attachment->priv = a;
++
++	list_add(&a->list, &buf->attachments);
++	mutex_unlock(&buf->lock);
++
++	return 0;
++}
++
++static void vc_sm_dma_buf_detach(struct dma_buf *dmabuf,
++				 struct dma_buf_attachment *attachment)
++{
++	struct vc_sm_dma_buf_attachment *a = attachment->priv;
++	struct vc_sm_buffer *buf = dmabuf->priv;
++	struct sg_table *sgt;
++
++	pr_debug("%s dmabuf %p attachment %p\n", __func__, dmabuf, attachment);
++	if (!a)
++		return;
++
++	sgt = &a->sg_table;
++
++	/* release the scatterlist cache */
++	if (a->dma_dir != DMA_NONE)
++		dma_unmap_sg(attachment->dev, sgt->sgl, sgt->orig_nents,
++			     a->dma_dir);
++	sg_free_table(sgt);
++
++	mutex_lock(&buf->lock);
++	list_del(&a->list);
++	mutex_unlock(&buf->lock);
++
++	kfree(a);
++}
++
++static struct sg_table *vc_sm_map_dma_buf(struct dma_buf_attachment *attachment,
++					  enum dma_data_direction direction)
++{
++	struct vc_sm_dma_buf_attachment *a = attachment->priv;
++	/* stealing dmabuf mutex to serialize map/unmap operations */
++	struct sg_table *table;
++
++	pr_debug("%s attachment %p\n", __func__, attachment);
++	table = &a->sg_table;
++
++	/* return previously mapped sg table */
++	if (a->dma_dir == direction) {
++		return table;
++	}
++
++	/* release any previous cache */
++	if (a->dma_dir != DMA_NONE) {
++		dma_unmap_sg(attachment->dev, table->sgl, table->orig_nents,
++			     a->dma_dir);
++		a->dma_dir = DMA_NONE;
++	}
++
++	/* mapping to the client with new direction */
++	table->nents = dma_map_sg(attachment->dev, table->sgl,
++				  table->orig_nents, direction);
++	if (!table->nents) {
++		pr_err("failed to map scatterlist\n");
++		return ERR_PTR(-EIO);
++	}
++
++	a->dma_dir = direction;
++
++	pr_debug("%s attachment %p\n", __func__, attachment);
++	return table;
++}
++
++static void vc_sm_unmap_dma_buf(struct dma_buf_attachment *attachment,
++				struct sg_table *table,
++				enum dma_data_direction direction)
++{
++	pr_debug("%s attachment %p\n", __func__, attachment);
++	dma_unmap_sg(attachment->dev, table->sgl, table->nents, direction);
++}
++
++static int vc_sm_dmabuf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma)
++{
++	struct vc_sm_buffer *buf = dmabuf->priv;
++	int ret;
++
++	pr_debug("%s dmabuf %p, buf %p, vm_start %08lX\n", __func__, dmabuf,
++		 buf, vma->vm_start);
++
++	/* now map it to userspace */
++	vma->vm_pgoff = 0;
++
++	ret = dma_mmap_coherent(&sm_state->pdev->dev, vma, buf->cookie,
++				buf->dma_addr, buf->size);
++
++	if (ret) {
++		pr_err("Remapping memory failed, error: %d\n", ret);
++		return ret;
++	}
++
++	vm_flags_reset(vma, vma->vm_flags | VM_DONTEXPAND | VM_DONTDUMP);
++
++	if (ret)
++		pr_err("%s: failure mapping buffer to userspace\n",
++		       __func__);
++
++	return ret;
++}
++
++static void vc_sm_dma_buf_release(struct dma_buf *dmabuf)
++{
++	struct vc_sm_buffer *buffer;
++
++	if (!dmabuf)
++		return;
++
++	buffer = (struct vc_sm_buffer *)dmabuf->priv;
++
++	mutex_lock(&buffer->lock);
++
++	pr_debug("%s dmabuf %p, buffer %p\n", __func__, dmabuf, buffer);
++
++	buffer->in_use = false;
++
++	/* Unmap on the VPU */
++	vc_sm_vpu_free(buffer);
++	pr_debug("%s vpu_free done\n", __func__);
++
++	/* Unmap our dma_buf object (the vc_sm_buffer remains until released
++	 * on the VPU).
++	 */
++	vc_sm_clean_up_dmabuf(buffer);
++	pr_debug("%s clean_up dmabuf done\n", __func__);
++
++	/* buffer->lock will be destroyed by vc_sm_release_resource if finished
++	 * with, otherwise unlocked. Do NOT unlock here.
++	 */
++	vc_sm_release_resource(buffer);
++	pr_debug("%s done\n", __func__);
++}
++
++static int vc_sm_dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
++					  enum dma_data_direction direction)
++{
++	struct vc_sm_buffer *buf;
++	struct vc_sm_dma_buf_attachment *a;
++
++	if (!dmabuf)
++		return -EFAULT;
++
++	buf = dmabuf->priv;
++	if (!buf)
++		return -EFAULT;
++
++	mutex_lock(&buf->lock);
++
++	list_for_each_entry(a, &buf->attachments, list) {
++		dma_sync_sg_for_cpu(a->dev, a->sg_table.sgl,
++				    a->sg_table.nents, direction);
++	}
++	mutex_unlock(&buf->lock);
++
++	return 0;
++}
++
++static int vc_sm_dma_buf_end_cpu_access(struct dma_buf *dmabuf,
++					enum dma_data_direction direction)
++{
++	struct vc_sm_buffer *buf;
++	struct vc_sm_dma_buf_attachment *a;
++
++	if (!dmabuf)
++		return -EFAULT;
++	buf = dmabuf->priv;
++	if (!buf)
++		return -EFAULT;
++
++	mutex_lock(&buf->lock);
++
++	list_for_each_entry(a, &buf->attachments, list) {
++		dma_sync_sg_for_device(a->dev, a->sg_table.sgl,
++				       a->sg_table.nents, direction);
++	}
++	mutex_unlock(&buf->lock);
++
++	return 0;
++}
++
++static const struct dma_buf_ops dma_buf_ops = {
++	.map_dma_buf = vc_sm_map_dma_buf,
++	.unmap_dma_buf = vc_sm_unmap_dma_buf,
++	.mmap = vc_sm_dmabuf_mmap,
++	.release = vc_sm_dma_buf_release,
++	.attach = vc_sm_dma_buf_attach,
++	.detach = vc_sm_dma_buf_detach,
++	.begin_cpu_access = vc_sm_dma_buf_begin_cpu_access,
++	.end_cpu_access = vc_sm_dma_buf_end_cpu_access,
++};
++
++/* Dma_buf operations for chaining through to an imported dma_buf */
++
++static
++int vc_sm_import_dma_buf_attach(struct dma_buf *dmabuf,
++				struct dma_buf_attachment *attachment)
++{
++	struct vc_sm_buffer *buf = dmabuf->priv;
++
++	if (!buf->imported)
++		return -EINVAL;
++	return buf->import.dma_buf->ops->attach(buf->import.dma_buf,
++						attachment);
++}
++
++static
++void vc_sm_import_dma_buf_detatch(struct dma_buf *dmabuf,
++				  struct dma_buf_attachment *attachment)
++{
++	struct vc_sm_buffer *buf = dmabuf->priv;
++
++	if (!buf->imported)
++		return;
++	buf->import.dma_buf->ops->detach(buf->import.dma_buf, attachment);
++}
++
++static
++struct sg_table *vc_sm_import_map_dma_buf(struct dma_buf_attachment *attachment,
++					  enum dma_data_direction direction)
++{
++	struct vc_sm_buffer *buf = attachment->dmabuf->priv;
++
++	if (!buf->imported)
++		return NULL;
++	return buf->import.dma_buf->ops->map_dma_buf(attachment,
++						     direction);
++}
++
++static
++void vc_sm_import_unmap_dma_buf(struct dma_buf_attachment *attachment,
++				struct sg_table *table,
++				enum dma_data_direction direction)
++{
++	struct vc_sm_buffer *buf = attachment->dmabuf->priv;
++
++	if (!buf->imported)
++		return;
++	buf->import.dma_buf->ops->unmap_dma_buf(attachment, table, direction);
++}
++
++static
++int vc_sm_import_dmabuf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma)
++{
++	struct vc_sm_buffer *buf = dmabuf->priv;
++
++	pr_debug("%s: mmap dma_buf %p, buf %p, imported db %p\n", __func__,
++		 dmabuf, buf, buf->import.dma_buf);
++	if (!buf->imported) {
++		pr_err("%s: mmap dma_buf %p- not an imported buffer\n",
++		       __func__, dmabuf);
++		return -EINVAL;
++	}
++	return buf->import.dma_buf->ops->mmap(buf->import.dma_buf, vma);
++}
++
++static
++int vc_sm_import_dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
++					  enum dma_data_direction direction)
++{
++	struct vc_sm_buffer *buf = dmabuf->priv;
++
++	if (!buf->imported)
++		return -EINVAL;
++	return buf->import.dma_buf->ops->begin_cpu_access(buf->import.dma_buf,
++							  direction);
++}
++
++static
++int vc_sm_import_dma_buf_end_cpu_access(struct dma_buf *dmabuf,
++					enum dma_data_direction direction)
++{
++	struct vc_sm_buffer *buf = dmabuf->priv;
++
++	if (!buf->imported)
++		return -EINVAL;
++	return buf->import.dma_buf->ops->end_cpu_access(buf->import.dma_buf,
++							  direction);
++}
++
++static const struct dma_buf_ops dma_buf_import_ops = {
++	.map_dma_buf = vc_sm_import_map_dma_buf,
++	.unmap_dma_buf = vc_sm_import_unmap_dma_buf,
++	.mmap = vc_sm_import_dmabuf_mmap,
++	.release = vc_sm_dma_buf_release,
++	.attach = vc_sm_import_dma_buf_attach,
++	.detach = vc_sm_import_dma_buf_detatch,
++	.begin_cpu_access = vc_sm_import_dma_buf_begin_cpu_access,
++	.end_cpu_access = vc_sm_import_dma_buf_end_cpu_access,
++};
++
++/* Import a dma_buf to be shared with VC. */
++static int
++vc_sm_cma_import_dmabuf_internal(struct vc_sm_privdata_t *private,
++				 struct dma_buf *dma_buf,
++				 int fd,
++				 struct dma_buf **imported_buf)
++{
++	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
++	struct vc_sm_buffer *buffer = NULL;
++	struct vc_sm_import import = { };
++	struct vc_sm_import_result result = { };
++	struct dma_buf_attachment *attach = NULL;
++	struct sg_table *sgt = NULL;
++	dma_addr_t dma_addr;
++	u32 cache_alias;
++	int ret = 0;
++	int status;
++
++	/* Setup our allocation parameters */
++	pr_debug("%s: importing dma_buf %p/fd %d\n", __func__, dma_buf, fd);
++
++	if (fd < 0)
++		get_dma_buf(dma_buf);
++	else
++		dma_buf = dma_buf_get(fd);
++
++	if (!dma_buf)
++		return -EINVAL;
++
++	attach = dma_buf_attach(dma_buf, &sm_state->pdev->dev);
++	if (IS_ERR(attach)) {
++		ret = PTR_ERR(attach);
++		goto error;
++	}
++
++	sgt = dma_buf_map_attachment(attach, DMA_BIDIRECTIONAL);
++	if (IS_ERR(sgt)) {
++		ret = PTR_ERR(sgt);
++		goto error;
++	}
++
++	/* Verify that the address block is contiguous */
++	if (sgt->nents != 1) {
++		ret = -ENOMEM;
++		goto error;
++	}
++
++	/* Allocate local buffer to track this allocation. */
++	buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);
++	if (!buffer) {
++		ret = -ENOMEM;
++		goto error;
++	}
++
++	import.type = VC_SM_ALLOC_NON_CACHED;
++	dma_addr = sg_dma_address(sgt->sgl);
++	import.addr = (u32)dma_addr;
++	cache_alias = import.addr & 0xC0000000;
++	if (cache_alias != 0xC0000000 && cache_alias != 0x80000000) {
++		pr_err("%s: Expecting an uncached alias for dma_addr %pad\n",
++		       __func__, &dma_addr);
++		/* Note that this assumes we're on >= Pi2, but it implies a
++		 * DT configuration error.
++		 */
++		import.addr |= 0xC0000000;
++	}
++	import.size = sg_dma_len(sgt->sgl);
++	import.allocator = current->tgid;
++	import.kernel_id = get_kernel_id(buffer);
++
++	memcpy(import.name, VC_SM_RESOURCE_NAME_DEFAULT,
++	       sizeof(VC_SM_RESOURCE_NAME_DEFAULT));
++
++	pr_debug("[%s]: attempt to import \"%s\" data - type %u, addr %pad, size %u.\n",
++		 __func__, import.name, import.type, &dma_addr, import.size);
++
++	/* Allocate the videocore buffer. */
++	status = vc_sm_cma_vchi_import(sm_state->sm_handle, &import, &result,
++				       &sm_state->int_trans_id);
++	if (status == -EINTR) {
++		pr_debug("[%s]: requesting import memory action restart (trans_id: %u)\n",
++			 __func__, sm_state->int_trans_id);
++		ret = -ERESTARTSYS;
++		private->restart_sys = -EINTR;
++		private->int_action = VC_SM_MSG_TYPE_IMPORT;
++		goto error;
++	} else if (status || !result.res_handle) {
++		pr_debug("[%s]: failed to import memory on videocore (status: %u, trans_id: %u)\n",
++			 __func__, status, sm_state->int_trans_id);
++		ret = -ENOMEM;
++		goto error;
++	}
++
++	mutex_init(&buffer->lock);
++	INIT_LIST_HEAD(&buffer->attachments);
++	memcpy(buffer->name, import.name,
++	       min(sizeof(buffer->name), sizeof(import.name) - 1));
++
++	/* Keep track of the buffer we created. */
++	buffer->private = private;
++	buffer->vc_handle = result.res_handle;
++	buffer->size = import.size;
++	buffer->vpu_state = VPU_MAPPED;
++
++	buffer->imported = true;
++	buffer->import.dma_buf = dma_buf;
++
++	buffer->import.attach = attach;
++	buffer->import.sgt = sgt;
++	buffer->dma_addr = dma_addr;
++	buffer->in_use = true;
++	buffer->kernel_id = import.kernel_id;
++
++	/*
++	 * We're done - we need to export a new dmabuf chaining through most
++	 * functions, but enabling us to release our own internal references
++	 * here.
++	 */
++	exp_info.ops = &dma_buf_import_ops;
++	exp_info.size = import.size;
++	exp_info.flags = O_RDWR;
++	exp_info.priv = buffer;
++
++	buffer->dma_buf = dma_buf_export(&exp_info);
++	if (IS_ERR(buffer->dma_buf)) {
++		ret = PTR_ERR(buffer->dma_buf);
++		goto error;
++	}
++
++	vc_sm_add_resource(private, buffer);
++
++	*imported_buf = buffer->dma_buf;
++
++	return 0;
++
++error:
++	if (result.res_handle) {
++		struct vc_sm_free_t free = { result.res_handle, 0 };
++
++		vc_sm_cma_vchi_free(sm_state->sm_handle, &free,
++				    &sm_state->int_trans_id);
++	}
++	free_kernel_id(import.kernel_id);
++	kfree(buffer);
++	if (sgt)
++		dma_buf_unmap_attachment(attach, sgt, DMA_BIDIRECTIONAL);
++	if (attach)
++		dma_buf_detach(dma_buf, attach);
++	dma_buf_put(dma_buf);
++	return ret;
++}
++
++static int vc_sm_cma_vpu_alloc(u32 size, u32 align, const char *name,
++			       u32 mem_handle, struct vc_sm_buffer **ret_buffer)
++{
++	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
++	struct vc_sm_buffer *buffer = NULL;
++	struct sg_table *sgt;
++	int aligned_size;
++	int ret = 0;
++
++	/* Align to the user requested align */
++	aligned_size = ALIGN(size, align);
++	/* and then to a page boundary */
++	aligned_size = PAGE_ALIGN(aligned_size);
++
++	if (!aligned_size)
++		return -EINVAL;
++
++	/* Allocate local buffer to track this allocation. */
++	buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);
++	if (!buffer)
++		return -ENOMEM;
++
++	mutex_init(&buffer->lock);
++	/* Acquire the mutex as vc_sm_release_resource will release it in the
++	 * error path.
++	 */
++	mutex_lock(&buffer->lock);
++
++	buffer->cookie = dma_alloc_coherent(&sm_state->pdev->dev,
++					    aligned_size, &buffer->dma_addr,
++					    GFP_KERNEL);
++	if (!buffer->cookie) {
++		pr_err("[%s]: dma_alloc_coherent alloc of %d bytes failed\n",
++		       __func__, aligned_size);
++		ret = -ENOMEM;
++		goto error;
++	}
++
++	pr_debug("[%s]: alloc of %d bytes success\n",
++		 __func__, aligned_size);
++
++	sgt = kmalloc(sizeof(*sgt), GFP_KERNEL);
++	if (!sgt) {
++		ret = -ENOMEM;
++		goto error;
++	}
++
++	ret = dma_get_sgtable(&sm_state->pdev->dev, sgt, buffer->cookie,
++			      buffer->dma_addr, buffer->size);
++	if (ret < 0) {
++		pr_err("failed to get scatterlist from DMA API\n");
++		kfree(sgt);
++		ret = -ENOMEM;
++		goto error;
++	}
++	buffer->alloc.sg_table = sgt;
++
++	INIT_LIST_HEAD(&buffer->attachments);
++
++	memcpy(buffer->name, name,
++	       min(sizeof(buffer->name), strlen(name)));
++
++	exp_info.ops = &dma_buf_ops;
++	exp_info.size = aligned_size;
++	exp_info.flags = O_RDWR;
++	exp_info.priv = buffer;
++
++	buffer->dma_buf = dma_buf_export(&exp_info);
++	if (IS_ERR(buffer->dma_buf)) {
++		ret = PTR_ERR(buffer->dma_buf);
++		goto error;
++	}
++	buffer->dma_addr = (u32)sg_dma_address(buffer->alloc.sg_table->sgl);
++	if ((buffer->dma_addr & 0xC0000000) != 0xC0000000) {
++		pr_warn_once("%s: Expecting an uncached alias for dma_addr %pad\n",
++			     __func__, &buffer->dma_addr);
++		buffer->dma_addr |= 0xC0000000;
++	}
++	buffer->private = sm_state->vpu_allocs;
++
++	buffer->vc_handle = mem_handle;
++	buffer->vpu_state = VPU_MAPPED;
++	buffer->vpu_allocated = 1;
++	buffer->size = size;
++	/*
++	 * Create an ID that will be passed along with our message so
++	 * that when we service the release reply, we can look up which
++	 * resource is being released.
++	 */
++	buffer->kernel_id = get_kernel_id(buffer);
++
++	vc_sm_add_resource(sm_state->vpu_allocs, buffer);
++
++	mutex_unlock(&buffer->lock);
++
++	*ret_buffer = buffer;
++	return 0;
++error:
++	if (buffer)
++		vc_sm_release_resource(buffer);
++	return ret;
++}
++
++static void
++vc_sm_vpu_event(struct sm_instance *instance, struct vc_sm_result_t *reply,
++		int reply_len)
++{
++	switch (reply->trans_id & ~0x80000000) {
++	case VC_SM_MSG_TYPE_CLIENT_VERSION:
++	{
++		/* Acknowledge that the firmware supports the version command */
++		pr_debug("%s: firmware acked version msg. Require release cb\n",
++			 __func__);
++		sm_state->require_released_callback = true;
++	}
++	break;
++	case VC_SM_MSG_TYPE_RELEASED:
++	{
++		struct vc_sm_released *release = (struct vc_sm_released *)reply;
++		struct vc_sm_buffer *buffer =
++					lookup_kernel_id(release->kernel_id);
++		if (!buffer) {
++			pr_err("%s: VC released a buffer that is already released, kernel_id %d\n",
++			       __func__, release->kernel_id);
++			break;
++		}
++		mutex_lock(&buffer->lock);
++
++		pr_debug("%s: Released addr %08x, size %u, id %08x, mem_handle %08x\n",
++			 __func__, release->addr, release->size,
++			 release->kernel_id, release->vc_handle);
++
++		buffer->vc_handle = 0;
++		buffer->vpu_state = VPU_NOT_MAPPED;
++		free_kernel_id(release->kernel_id);
++
++		if (buffer->vpu_allocated) {
++			/* VPU allocation, so release the dmabuf which will
++			 * trigger the clean up.
++			 */
++			mutex_unlock(&buffer->lock);
++			dma_buf_put(buffer->dma_buf);
++		} else {
++			vc_sm_release_resource(buffer);
++		}
++	}
++	break;
++	case VC_SM_MSG_TYPE_VC_MEM_REQUEST:
++	{
++		struct vc_sm_buffer *buffer = NULL;
++		struct vc_sm_vc_mem_request *req =
++					(struct vc_sm_vc_mem_request *)reply;
++		struct vc_sm_vc_mem_request_result reply;
++		int ret;
++
++		pr_debug("%s: Request %u bytes of memory, align %d name %s, trans_id %08x\n",
++			 __func__, req->size, req->align, req->name,
++			 req->trans_id);
++		ret = vc_sm_cma_vpu_alloc(req->size, req->align, req->name,
++					  req->vc_handle, &buffer);
++
++		reply.trans_id = req->trans_id;
++		if (!ret) {
++			reply.addr = buffer->dma_addr;
++			reply.kernel_id = buffer->kernel_id;
++			pr_debug("%s: Allocated resource buffer %p, addr %pad\n",
++				 __func__, buffer, &buffer->dma_addr);
++		} else {
++			pr_err("%s: Allocation failed size %u, name %s, vc_handle %u\n",
++			       __func__, req->size, req->name, req->vc_handle);
++			reply.addr = 0;
++			reply.kernel_id = 0;
++		}
++		vc_sm_vchi_client_vc_mem_req_reply(sm_state->sm_handle, &reply,
++						   &sm_state->int_trans_id);
++		break;
++	}
++	break;
++	default:
++		pr_err("%s: Unknown vpu cmd %x\n", __func__, reply->trans_id);
++		break;
++	}
++}
++
++/* Userspace handling */
++/*
++ * Open the device.  Creates a private state to help track all allocation
++ * associated with this device.
++ */
++static int vc_sm_cma_open(struct inode *inode, struct file *file)
++{
++	/* Make sure the device was started properly. */
++	if (!sm_state) {
++		pr_err("[%s]: invalid device\n", __func__);
++		return -EPERM;
++	}
++
++	file->private_data = vc_sm_cma_create_priv_data(current->tgid);
++	if (!file->private_data) {
++		pr_err("[%s]: failed to create data tracker\n", __func__);
++
++		return -ENOMEM;
++	}
++
++	return 0;
++}
++
++/*
++ * Close the vcsm-cma device.
++ * All allocations are file descriptors to the dmabuf objects, so we will get
++ * the clean up request on those as those are cleaned up.
++ */
++static int vc_sm_cma_release(struct inode *inode, struct file *file)
++{
++	struct vc_sm_privdata_t *file_data =
++	    (struct vc_sm_privdata_t *)file->private_data;
++	int ret = 0;
++
++	/* Make sure the device was started properly. */
++	if (!sm_state || !file_data) {
++		pr_err("[%s]: invalid device\n", __func__);
++		ret = -EPERM;
++		goto out;
++	}
++
++	pr_debug("[%s]: using private data %p\n", __func__, file_data);
++
++	/* Terminate the private data. */
++	kfree(file_data);
++
++out:
++	return ret;
++}
++
++/*
++ * Allocate a shared memory handle and block.
++ * Allocation is from CMA, and then imported into the VPU mappings.
++ */
++static int vc_sm_cma_ioctl_alloc(struct vc_sm_privdata_t *private,
++			  struct vc_sm_cma_ioctl_alloc *ioparam)
++{
++	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
++	struct vc_sm_buffer *buffer = NULL;
++	struct vc_sm_import import = { 0 };
++	struct vc_sm_import_result result = { 0 };
++	struct dma_buf *dmabuf = NULL;
++	struct sg_table *sgt;
++	int aligned_size;
++	int ret = 0;
++	int status;
++	int fd = -1;
++
++	aligned_size = PAGE_ALIGN(ioparam->size);
++
++	if (!aligned_size)
++		return -EINVAL;
++
++	/* Allocate local buffer to track this allocation. */
++	buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);
++	if (!buffer) {
++		ret = -ENOMEM;
++		goto error;
++	}
++
++	buffer->cookie = dma_alloc_coherent(&sm_state->pdev->dev,
++					    aligned_size,
++					    &buffer->dma_addr,
++					    GFP_KERNEL);
++	if (!buffer->cookie) {
++		pr_err("[%s]: dma_alloc_coherent alloc of %d bytes failed\n",
++		       __func__, aligned_size);
++		ret = -ENOMEM;
++		goto error;
++	}
++
++	import.type = VC_SM_ALLOC_NON_CACHED;
++	import.allocator = current->tgid;
++
++	if (*ioparam->name)
++		memcpy(import.name, ioparam->name, sizeof(import.name) - 1);
++	else
++		memcpy(import.name, VC_SM_RESOURCE_NAME_DEFAULT,
++		       sizeof(VC_SM_RESOURCE_NAME_DEFAULT));
++
++	mutex_init(&buffer->lock);
++	INIT_LIST_HEAD(&buffer->attachments);
++	memcpy(buffer->name, import.name,
++	       min(sizeof(buffer->name), sizeof(import.name) - 1));
++
++	exp_info.ops = &dma_buf_ops;
++	exp_info.size = aligned_size;
++	exp_info.flags = O_RDWR;
++	exp_info.priv = buffer;
++
++	dmabuf = dma_buf_export(&exp_info);
++	if (IS_ERR(dmabuf)) {
++		ret = PTR_ERR(dmabuf);
++		goto error;
++	}
++	buffer->dma_buf = dmabuf;
++
++	import.addr = buffer->dma_addr;
++	import.size = aligned_size;
++	import.kernel_id = get_kernel_id(buffer);
++
++	/* Wrap it into a videocore buffer. */
++	status = vc_sm_cma_vchi_import(sm_state->sm_handle, &import, &result,
++				       &sm_state->int_trans_id);
++	if (status == -EINTR) {
++		pr_debug("[%s]: requesting import memory action restart (trans_id: %u)\n",
++			 __func__, sm_state->int_trans_id);
++		ret = -ERESTARTSYS;
++		private->restart_sys = -EINTR;
++		private->int_action = VC_SM_MSG_TYPE_IMPORT;
++		goto error;
++	} else if (status || !result.res_handle) {
++		pr_err("[%s]: failed to import memory on videocore (status: %u, trans_id: %u)\n",
++		       __func__, status, sm_state->int_trans_id);
++		ret = -ENOMEM;
++		goto error;
++	}
++
++	/* Keep track of the buffer we created. */
++	buffer->private = private;
++	buffer->vc_handle = result.res_handle;
++	buffer->size = import.size;
++	buffer->vpu_state = VPU_MAPPED;
++	buffer->kernel_id = import.kernel_id;
++
++	sgt = kmalloc(sizeof(*sgt), GFP_KERNEL);
++	if (!sgt) {
++		ret = -ENOMEM;
++		goto error;
++	}
++
++	ret = dma_get_sgtable(&sm_state->pdev->dev, sgt, buffer->cookie,
++			      buffer->dma_addr, buffer->size);
++	if (ret < 0) {
++		/* FIXME: error handling */
++		pr_err("failed to get scatterlist from DMA API\n");
++		kfree(sgt);
++		ret = -ENOMEM;
++		goto error;
++	}
++	buffer->alloc.sg_table = sgt;
++
++	fd = dma_buf_fd(dmabuf, O_CLOEXEC);
++	if (fd < 0)
++		goto error;
++
++	vc_sm_add_resource(private, buffer);
++
++	pr_debug("[%s]: Added resource as fd %d, buffer %p, private %p, dma_addr %pad\n",
++		 __func__, fd, buffer, private, &buffer->dma_addr);
++
++	/* We're done */
++	ioparam->handle = fd;
++	ioparam->vc_handle = buffer->vc_handle;
++	ioparam->dma_addr = buffer->dma_addr;
++	return 0;
++
++error:
++	pr_err("[%s]: something failed - cleanup. ret %d\n", __func__, ret);
++
++	if (dmabuf) {
++		/* dmabuf has been exported, therefore allow dmabuf cleanup to
++		 * deal with this
++		 */
++		dma_buf_put(dmabuf);
++	} else {
++		/* No dmabuf, therefore just free the buffer here */
++		if (buffer->cookie)
++			dma_free_coherent(&sm_state->pdev->dev, buffer->size,
++					  buffer->cookie, buffer->dma_addr);
++		kfree(buffer);
++	}
++	return ret;
++}
++
++static long vc_sm_cma_ioctl(struct file *file, unsigned int cmd,
++			    unsigned long arg)
++{
++	int ret = 0;
++	unsigned int cmdnr = _IOC_NR(cmd);
++	struct vc_sm_privdata_t *file_data =
++	    (struct vc_sm_privdata_t *)file->private_data;
++
++	/* Validate we can work with this device. */
++	if (!sm_state || !file_data) {
++		pr_err("[%s]: invalid device\n", __func__);
++		return -EPERM;
++	}
++
++	/* Action is a re-post of a previously interrupted action? */
++	if (file_data->restart_sys == -EINTR) {
++		pr_debug("[%s]: clean up of action %u (trans_id: %u) following EINTR\n",
++			 __func__, file_data->int_action,
++			 file_data->int_trans_id);
++
++		file_data->restart_sys = 0;
++	}
++
++	/* Now process the command. */
++	switch (cmdnr) {
++		/* New memory allocation.
++		 */
++	case VC_SM_CMA_CMD_ALLOC:
++	{
++		struct vc_sm_cma_ioctl_alloc ioparam;
++
++		/* Get the parameter data. */
++		if (copy_from_user
++		    (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
++			pr_err("[%s]: failed to copy-from-user for cmd %x\n",
++			       __func__, cmdnr);
++			ret = -EFAULT;
++			break;
++		}
++
++		ret = vc_sm_cma_ioctl_alloc(file_data, &ioparam);
++		if (!ret &&
++		    (copy_to_user((void *)arg, &ioparam,
++				  sizeof(ioparam)) != 0)) {
++			/* FIXME: Release allocation */
++			pr_err("[%s]: failed to copy-to-user for cmd %x\n",
++			       __func__, cmdnr);
++			ret = -EFAULT;
++		}
++		break;
++	}
++
++	case VC_SM_CMA_CMD_IMPORT_DMABUF:
++	{
++		struct vc_sm_cma_ioctl_import_dmabuf ioparam;
++		struct dma_buf *new_dmabuf;
++
++		/* Get the parameter data. */
++		if (copy_from_user
++		    (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
++			pr_err("[%s]: failed to copy-from-user for cmd %x\n",
++			       __func__, cmdnr);
++			ret = -EFAULT;
++			break;
++		}
++
++		ret = vc_sm_cma_import_dmabuf_internal(file_data,
++						       NULL,
++						       ioparam.dmabuf_fd,
++						       &new_dmabuf);
++
++		if (!ret) {
++			struct vc_sm_buffer *buf = new_dmabuf->priv;
++
++			ioparam.size = buf->size;
++			ioparam.handle = dma_buf_fd(new_dmabuf,
++						    O_CLOEXEC);
++			ioparam.vc_handle = buf->vc_handle;
++			ioparam.dma_addr = buf->dma_addr;
++
++			if (ioparam.handle < 0 ||
++			    (copy_to_user((void *)arg, &ioparam,
++					  sizeof(ioparam)) != 0)) {
++				dma_buf_put(new_dmabuf);
++				/* FIXME: Release allocation */
++				ret = -EFAULT;
++			}
++		}
++		break;
++	}
++
++	default:
++		pr_debug("[%s]: cmd %x tgid %u, owner %u\n", __func__, cmdnr,
++			 current->tgid, file_data->pid);
++
++		ret = -EINVAL;
++		break;
++	}
++
++	return ret;
++}
++
++#ifdef CONFIG_COMPAT
++struct vc_sm_cma_ioctl_clean_invalid2_32 {
++	u32 op_count;
++	struct vc_sm_cma_ioctl_clean_invalid_block_32 {
++		u16 invalidate_mode;
++		u16 block_count;
++		compat_uptr_t start_address;
++		u32 block_size;
++		u32 inter_block_stride;
++	} s[0];
++};
++
++#define VC_SM_CMA_CMD_CLEAN_INVALID2_32\
++	_IOR(VC_SM_CMA_MAGIC_TYPE, VC_SM_CMA_CMD_CLEAN_INVALID2,\
++	 struct vc_sm_cma_ioctl_clean_invalid2_32)
++
++static long vc_sm_cma_compat_ioctl(struct file *file, unsigned int cmd,
++				   unsigned long arg)
++{
++	switch (cmd) {
++	case VC_SM_CMA_CMD_CLEAN_INVALID2_32:
++		/* FIXME */
++		return -EINVAL;
++
++	default:
++		return vc_sm_cma_ioctl(file, cmd, arg);
++	}
++}
++#endif
++
++/* Device operations that we managed in this driver. */
++static const struct file_operations vc_sm_ops = {
++	.owner = THIS_MODULE,
++	.unlocked_ioctl = vc_sm_cma_ioctl,
++#ifdef CONFIG_COMPAT
++	.compat_ioctl = vc_sm_cma_compat_ioctl,
++#endif
++	.open = vc_sm_cma_open,
++	.release = vc_sm_cma_release,
++};
++
++/* Driver load/unload functions */
++/* Videocore connected.  */
++static void vc_sm_connected_init(void)
++{
++	int ret;
++	struct vc_sm_version version;
++	struct vc_sm_result_t version_result;
++
++	pr_info("[%s]: start\n", __func__);
++
++	/*
++	 * Initialize and create a VCHI connection for the shared memory service
++	 * running on videocore.
++	 */
++	ret = vchiq_initialise(&sm_state->vchiq_instance);
++	if (ret) {
++		pr_err("[%s]: failed to initialise VCHI instance (ret=%d)\n",
++		       __func__, ret);
++
++		return;
++	}
++
++	ret = vchiq_connect(sm_state->vchiq_instance);
++	if (ret) {
++		pr_err("[%s]: failed to connect VCHI instance (ret=%d)\n",
++		       __func__, ret);
++
++		return;
++	}
++
++	/* Initialize an instance of the shared memory service. */
++	sm_state->sm_handle = vc_sm_cma_vchi_init(sm_state->vchiq_instance, 1,
++						  vc_sm_vpu_event);
++	if (!sm_state->sm_handle) {
++		pr_err("[%s]: failed to initialize shared memory service\n",
++		       __func__);
++
++		return;
++	}
++
++	/* Create a debug fs directory entry (root). */
++	sm_state->dir_root = debugfs_create_dir(VC_SM_DIR_ROOT_NAME, NULL);
++
++	sm_state->dir_state.show = &vc_sm_cma_global_state_show;
++	sm_state->dir_state.dir_entry =
++		debugfs_create_file(VC_SM_STATE, 0444, sm_state->dir_root,
++				    &sm_state->dir_state,
++				    &vc_sm_cma_debug_fs_fops);
++
++	INIT_LIST_HEAD(&sm_state->buffer_list);
++
++	/* Create a shared memory device. */
++	sm_state->misc_dev.minor = MISC_DYNAMIC_MINOR;
++	sm_state->misc_dev.name = DEVICE_NAME;
++	sm_state->misc_dev.fops = &vc_sm_ops;
++	sm_state->misc_dev.parent = NULL;
++	/* Temporarily set as 666 until udev rules have been sorted */
++	sm_state->misc_dev.mode = 0666;
++	ret = misc_register(&sm_state->misc_dev);
++	if (ret) {
++		pr_err("vcsm-cma: failed to register misc device.\n");
++		goto err_remove_debugfs;
++	}
++
++	sm_state->data_knl = vc_sm_cma_create_priv_data(0);
++	if (!sm_state->data_knl) {
++		pr_err("[%s]: failed to create kernel private data tracker\n",
++		       __func__);
++		goto err_remove_misc_dev;
++	}
++
++	version.version = 2;
++	ret = vc_sm_cma_vchi_client_version(sm_state->sm_handle, &version,
++					    &version_result,
++					    &sm_state->int_trans_id);
++	if (ret) {
++		pr_err("[%s]: Failed to send version request %d\n", __func__,
++		       ret);
++	}
++
++	/* Done! */
++	sm_inited = 1;
++	pr_info("[%s]: installed successfully\n", __func__);
++	return;
++
++err_remove_misc_dev:
++	misc_deregister(&sm_state->misc_dev);
++err_remove_debugfs:
++	debugfs_remove_recursive(sm_state->dir_root);
++	vc_sm_cma_vchi_stop(sm_state->vchiq_instance, &sm_state->sm_handle);
++}
++
++/* Driver loading. */
++static int bcm2835_vc_sm_cma_probe(struct platform_device *pdev)
++{
++	pr_info("%s: Videocore shared memory driver\n", __func__);
++
++	sm_state = devm_kzalloc(&pdev->dev, sizeof(*sm_state), GFP_KERNEL);
++	if (!sm_state)
++		return -ENOMEM;
++	sm_state->pdev = pdev;
++	mutex_init(&sm_state->map_lock);
++
++	spin_lock_init(&sm_state->kernelid_map_lock);
++	idr_init_base(&sm_state->kernelid_map, 1);
++
++	pdev->dev.dma_parms = devm_kzalloc(&pdev->dev,
++					   sizeof(*pdev->dev.dma_parms),
++					   GFP_KERNEL);
++	/* dma_set_max_seg_size checks if dma_parms is NULL. */
++	dma_set_max_seg_size(&pdev->dev, 0x3FFFFFFF);
++
++	vchiq_add_connected_callback(vc_sm_connected_init);
++	return 0;
++}
++
++/* Driver unloading. */
++static int bcm2835_vc_sm_cma_remove(struct platform_device *pdev)
++{
++	pr_debug("[%s]: start\n", __func__);
++	if (sm_inited) {
++		misc_deregister(&sm_state->misc_dev);
++
++		/* Remove all proc entries. */
++		debugfs_remove_recursive(sm_state->dir_root);
++
++		/* Stop the videocore shared memory service. */
++		vc_sm_cma_vchi_stop(sm_state->vchiq_instance, &sm_state->sm_handle);
++	}
++
++	if (sm_state) {
++		idr_destroy(&sm_state->kernelid_map);
++
++		/* Free the memory for the state structure. */
++		mutex_destroy(&sm_state->map_lock);
++	}
++
++	pr_debug("[%s]: end\n", __func__);
++	return 0;
++}
++
++/* Kernel API calls */
++/* Get an internal resource handle mapped from the external one. */
++int vc_sm_cma_int_handle(void *handle)
++{
++	struct dma_buf *dma_buf = (struct dma_buf *)handle;
++	struct vc_sm_buffer *buf;
++
++	/* Validate we can work with this device. */
++	if (!sm_state || !handle) {
++		pr_err("[%s]: invalid input\n", __func__);
++		return 0;
++	}
++
++	buf = (struct vc_sm_buffer *)dma_buf->priv;
++	return buf->vc_handle;
++}
++EXPORT_SYMBOL_GPL(vc_sm_cma_int_handle);
++
++/* Free a previously allocated shared memory handle and block. */
++int vc_sm_cma_free(void *handle)
++{
++	struct dma_buf *dma_buf = (struct dma_buf *)handle;
++
++	/* Validate we can work with this device. */
++	if (!sm_state || !handle) {
++		pr_err("[%s]: invalid input\n", __func__);
++		return -EPERM;
++	}
++
++	pr_debug("%s: handle %p/dmabuf %p\n", __func__, handle, dma_buf);
++
++	dma_buf_put(dma_buf);
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(vc_sm_cma_free);
++
++/* Import a dmabuf to be shared with VC. */
++int vc_sm_cma_import_dmabuf(struct dma_buf *src_dmabuf, void **handle)
++{
++	struct dma_buf *new_dma_buf;
++	int ret;
++
++	/* Validate we can work with this device. */
++	if (!sm_state || !src_dmabuf || !handle) {
++		pr_err("[%s]: invalid input\n", __func__);
++		return -EPERM;
++	}
++
++	ret = vc_sm_cma_import_dmabuf_internal(sm_state->data_knl, src_dmabuf,
++					       -1, &new_dma_buf);
++
++	if (!ret) {
++		pr_debug("%s: imported to ptr %p\n", __func__, new_dma_buf);
++
++		/* Assign valid handle at this time.*/
++		*handle = new_dma_buf;
++	} else {
++		/*
++		 * succeeded in importing the dma_buf, but then
++		 * failed to look it up again. How?
++		 * Release the fd again.
++		 */
++		pr_err("%s: imported vc_sm_cma_get_buffer failed %d\n",
++		       __func__, ret);
++	}
++
++	return ret;
++}
++EXPORT_SYMBOL_GPL(vc_sm_cma_import_dmabuf);
++
++static struct platform_driver bcm2835_vcsm_cma_driver = {
++	.probe = bcm2835_vc_sm_cma_probe,
++	.remove = bcm2835_vc_sm_cma_remove,
++	.driver = {
++		   .name = DEVICE_NAME,
++		   .owner = THIS_MODULE,
++		   },
++};
++
++module_platform_driver(bcm2835_vcsm_cma_driver);
++
++MODULE_AUTHOR("Dave Stevenson");
++MODULE_DESCRIPTION("VideoCore CMA Shared Memory Driver");
++MODULE_LICENSE("GPL v2");
++MODULE_ALIAS("platform:vcsm-cma");
+--- /dev/null
++++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.h
+@@ -0,0 +1,84 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++
++/*
++ * VideoCore Shared Memory driver using CMA.
++ *
++ * Copyright: 2018, Raspberry Pi (Trading) Ltd
++ *
++ */
++
++#ifndef VC_SM_H
++#define VC_SM_H
++
++#include <linux/device.h>
++#include <linux/dma-direction.h>
++#include <linux/kref.h>
++#include <linux/mm_types.h>
++#include <linux/mutex.h>
++#include <linux/rbtree.h>
++#include <linux/sched.h>
++#include <linux/shrinker.h>
++#include <linux/types.h>
++#include <linux/miscdevice.h>
++
++#define VC_SM_MAX_NAME_LEN 32
++
++enum vc_sm_vpu_mapping_state {
++	VPU_NOT_MAPPED,
++	VPU_MAPPED,
++	VPU_UNMAPPING
++};
++
++struct vc_sm_alloc_data {
++	unsigned long num_pages;
++	void *priv_virt;
++	struct sg_table *sg_table;
++};
++
++struct vc_sm_imported {
++	struct dma_buf *dma_buf;
++	struct dma_buf_attachment *attach;
++	struct sg_table *sgt;
++};
++
++struct vc_sm_buffer {
++	struct list_head global_buffer_list;	/* Global list of buffers. */
++
++	/* Index in the kernel_id idr so that we can find the
++	 * mmal_msg_context again when servicing the VCHI reply.
++	 */
++	int kernel_id;
++
++	size_t size;
++
++	/* Lock over all the following state for this buffer */
++	struct mutex lock;
++	struct list_head attachments;
++
++	char name[VC_SM_MAX_NAME_LEN];
++
++	bool in_use:1;   /* Kernel is still using this resource */
++	bool imported:1; /* Imported dmabuf */
++
++	enum vc_sm_vpu_mapping_state vpu_state;
++	u32 vc_handle;	/* VideoCore handle for this buffer */
++	int vpu_allocated;	/*
++				 * The VPU made this allocation. Release the
++				 * local dma_buf when the VPU releases the
++				 * resource.
++				 */
++
++	/* DMABUF related fields */
++	struct dma_buf *dma_buf;
++	dma_addr_t dma_addr;
++	void *cookie;
++
++	struct vc_sm_privdata_t *private;
++
++	union {
++		struct vc_sm_alloc_data alloc;
++		struct vc_sm_imported import;
++	};
++};
++
++#endif
+--- /dev/null
++++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c
+@@ -0,0 +1,511 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * VideoCore Shared Memory CMA allocator
++ *
++ * Copyright: 2018, Raspberry Pi (Trading) Ltd
++ * Copyright 2011-2012 Broadcom Corporation.  All rights reserved.
++ *
++ * Based on vmcs_sm driver from Broadcom Corporation.
++ *
++ */
++
++/* ---- Include Files ----------------------------------------------------- */
++#include <linux/completion.h>
++#include <linux/kernel.h>
++#include <linux/kthread.h>
++#include <linux/list.h>
++#include <linux/mutex.h>
++#include <linux/semaphore.h>
++#include <linux/slab.h>
++#include <linux/types.h>
++
++#include "vc_sm_cma_vchi.h"
++
++#define VC_SM_VER  1
++#define VC_SM_MIN_VER 0
++
++/* ---- Private Constants and Types -------------------------------------- */
++
++/* Command blocks come from a pool */
++#define SM_MAX_NUM_CMD_RSP_BLKS 32
++
++/* The number of supported connections */
++#define SM_MAX_NUM_CONNECTIONS 3
++
++struct sm_cmd_rsp_blk {
++	struct list_head head;	/* To create lists */
++	/* To be signaled when the response is there */
++	struct completion cmplt;
++
++	u32 id;
++	u16 length;
++
++	u8 msg[VC_SM_MAX_MSG_LEN];
++
++	uint32_t wait:1;
++	uint32_t sent:1;
++	uint32_t alloc:1;
++
++};
++
++struct sm_instance {
++	u32 num_connections;
++	unsigned int service_handle[SM_MAX_NUM_CONNECTIONS];
++	struct task_struct *io_thread;
++	struct completion io_cmplt;
++
++	vpu_event_cb vpu_event;
++
++	/* Mutex over the following lists */
++	struct mutex lock;
++	u32 trans_id;
++	struct list_head cmd_list;
++	struct list_head rsp_list;
++	struct list_head dead_list;
++
++	struct sm_cmd_rsp_blk free_blk[SM_MAX_NUM_CMD_RSP_BLKS];
++
++	/* Mutex over the free_list */
++	struct mutex free_lock;
++	struct list_head free_list;
++
++	struct semaphore free_sema;
++	struct vchiq_instance *vchiq_instance;
++};
++
++/* ---- Private Variables ------------------------------------------------ */
++
++/* ---- Private Function Prototypes -------------------------------------- */
++
++/* ---- Private Functions ------------------------------------------------ */
++static int
++bcm2835_vchi_msg_queue(struct vchiq_instance *vchiq_instance, unsigned int handle,
++		       void *data,
++		       unsigned int size)
++{
++	return vchiq_queue_kernel_message(vchiq_instance, handle, data, size);
++}
++
++static struct
++sm_cmd_rsp_blk *vc_vchi_cmd_create(struct sm_instance *instance,
++				   enum vc_sm_msg_type id, void *msg,
++				   u32 size, int wait)
++{
++	struct sm_cmd_rsp_blk *blk;
++	struct vc_sm_msg_hdr_t *hdr;
++
++	if (down_interruptible(&instance->free_sema)) {
++		blk = kmalloc(sizeof(*blk), GFP_KERNEL);
++		if (!blk)
++			return NULL;
++
++		blk->alloc = 1;
++		init_completion(&blk->cmplt);
++	} else {
++		mutex_lock(&instance->free_lock);
++		blk =
++		    list_first_entry(&instance->free_list,
++				     struct sm_cmd_rsp_blk, head);
++		list_del(&blk->head);
++		mutex_unlock(&instance->free_lock);
++	}
++
++	blk->sent = 0;
++	blk->wait = wait;
++	blk->length = sizeof(*hdr) + size;
++
++	hdr = (struct vc_sm_msg_hdr_t *)blk->msg;
++	hdr->type = id;
++	mutex_lock(&instance->lock);
++	instance->trans_id++;
++	/*
++	 * Retain the top bit for identifying asynchronous events, or VPU cmds.
++	 */
++	instance->trans_id &= ~0x80000000;
++	hdr->trans_id = instance->trans_id;
++	blk->id = instance->trans_id;
++	mutex_unlock(&instance->lock);
++
++	if (size)
++		memcpy(hdr->body, msg, size);
++
++	return blk;
++}
++
++static void
++vc_vchi_cmd_delete(struct sm_instance *instance, struct sm_cmd_rsp_blk *blk)
++{
++	if (blk->alloc) {
++		kfree(blk);
++		return;
++	}
++
++	mutex_lock(&instance->free_lock);
++	list_add(&blk->head, &instance->free_list);
++	mutex_unlock(&instance->free_lock);
++	up(&instance->free_sema);
++}
++
++static void vc_sm_cma_vchi_rx_ack(struct sm_instance *instance,
++				  struct sm_cmd_rsp_blk *cmd,
++				  struct vc_sm_result_t *reply,
++				  u32 reply_len)
++{
++	mutex_lock(&instance->lock);
++	list_for_each_entry(cmd,
++			    &instance->rsp_list,
++			    head) {
++		if (cmd->id == reply->trans_id)
++			break;
++	}
++	mutex_unlock(&instance->lock);
++
++	if (&cmd->head == &instance->rsp_list) {
++		//pr_debug("%s: received response %u, throw away...",
++		pr_err("%s: received response %u, throw away...",
++		       __func__,
++		       reply->trans_id);
++	} else if (reply_len > sizeof(cmd->msg)) {
++		pr_err("%s: reply too big (%u) %u, throw away...",
++		       __func__, reply_len,
++		     reply->trans_id);
++	} else {
++		memcpy(cmd->msg, reply,
++		       reply_len);
++		complete(&cmd->cmplt);
++	}
++}
++
++static int vc_sm_cma_vchi_videocore_io(void *arg)
++{
++	struct sm_instance *instance = arg;
++	struct sm_cmd_rsp_blk *cmd = NULL, *cmd_tmp;
++	struct vc_sm_result_t *reply;
++	struct vchiq_header *header;
++	s32 status;
++	int svc_use = 1;
++
++	while (1) {
++		if (svc_use)
++			vchiq_release_service(instance->vchiq_instance, instance->service_handle[0]);
++		svc_use = 0;
++
++		if (wait_for_completion_interruptible(&instance->io_cmplt))
++			continue;
++		vchiq_use_service(instance->vchiq_instance, instance->service_handle[0]);
++		svc_use = 1;
++
++		do {
++			/*
++			 * Get new command and move it to response list
++			 */
++			mutex_lock(&instance->lock);
++			if (list_empty(&instance->cmd_list)) {
++				/* no more commands to process */
++				mutex_unlock(&instance->lock);
++				break;
++			}
++			cmd = list_first_entry(&instance->cmd_list,
++					       struct sm_cmd_rsp_blk, head);
++			list_move(&cmd->head, &instance->rsp_list);
++			cmd->sent = 1;
++			mutex_unlock(&instance->lock);
++			/* Send the command */
++			status =
++				bcm2835_vchi_msg_queue(instance->vchiq_instance,
++						       instance->service_handle[0],
++						       cmd->msg, cmd->length);
++			if (status) {
++				pr_err("%s: failed to queue message (%d)",
++				       __func__, status);
++			}
++
++			/* If no reply is needed then we're done */
++			if (!cmd->wait) {
++				mutex_lock(&instance->lock);
++				list_del(&cmd->head);
++				mutex_unlock(&instance->lock);
++				vc_vchi_cmd_delete(instance, cmd);
++				continue;
++			}
++
++			if (status) {
++				complete(&cmd->cmplt);
++				continue;
++			}
++
++		} while (1);
++
++		while ((header = vchiq_msg_hold(instance->vchiq_instance,
++						instance->service_handle[0]))) {
++			reply = (struct vc_sm_result_t *)header->data;
++			if (reply->trans_id & 0x80000000) {
++				/* Async event or cmd from the VPU */
++				if (instance->vpu_event)
++					instance->vpu_event(instance, reply,
++							    header->size);
++			} else {
++				vc_sm_cma_vchi_rx_ack(instance, cmd, reply,
++						      header->size);
++			}
++
++			vchiq_release_message(instance->vchiq_instance,
++					      instance->service_handle[0],
++					      header);
++		}
++
++		/* Go through the dead list and free them */
++		mutex_lock(&instance->lock);
++		list_for_each_entry_safe(cmd, cmd_tmp, &instance->dead_list,
++					 head) {
++			list_del(&cmd->head);
++			vc_vchi_cmd_delete(instance, cmd);
++		}
++		mutex_unlock(&instance->lock);
++	}
++
++	return 0;
++}
++
++static int vc_sm_cma_vchi_callback(struct vchiq_instance *vchiq_instance,
++						 enum vchiq_reason reason,
++						 struct vchiq_header *header,
++						 unsigned int handle, void *userdata)
++{
++	struct sm_instance *instance = vchiq_get_service_userdata(vchiq_instance, handle);
++
++	switch (reason) {
++	case VCHIQ_MESSAGE_AVAILABLE:
++		vchiq_msg_queue_push(vchiq_instance, handle, header);
++		complete(&instance->io_cmplt);
++		break;
++
++	case VCHIQ_SERVICE_CLOSED:
++		pr_info("%s: service CLOSED!!", __func__);
++		break;
++
++	default:
++		break;
++	}
++
++	return 0;
++}
++
++struct sm_instance *vc_sm_cma_vchi_init(struct vchiq_instance *vchiq_instance,
++					unsigned int num_connections,
++					vpu_event_cb vpu_event)
++{
++	u32 i;
++	struct sm_instance *instance;
++	int status;
++
++	pr_debug("%s: start", __func__);
++
++	if (num_connections > SM_MAX_NUM_CONNECTIONS) {
++		pr_err("%s: unsupported number of connections %u (max=%u)",
++		       __func__, num_connections, SM_MAX_NUM_CONNECTIONS);
++
++		goto err_null;
++	}
++	/* Allocate memory for this instance */
++	instance = kzalloc(sizeof(*instance), GFP_KERNEL);
++
++	/* Misc initialisations */
++	mutex_init(&instance->lock);
++	init_completion(&instance->io_cmplt);
++	INIT_LIST_HEAD(&instance->cmd_list);
++	INIT_LIST_HEAD(&instance->rsp_list);
++	INIT_LIST_HEAD(&instance->dead_list);
++	INIT_LIST_HEAD(&instance->free_list);
++	sema_init(&instance->free_sema, SM_MAX_NUM_CMD_RSP_BLKS);
++	mutex_init(&instance->free_lock);
++	for (i = 0; i < SM_MAX_NUM_CMD_RSP_BLKS; i++) {
++		init_completion(&instance->free_blk[i].cmplt);
++		list_add(&instance->free_blk[i].head, &instance->free_list);
++	}
++
++	instance->vchiq_instance = vchiq_instance;
++
++	/* Open the VCHI service connections */
++	instance->num_connections = num_connections;
++	for (i = 0; i < num_connections; i++) {
++		struct vchiq_service_params_kernel params = {
++			.version = VC_SM_VER,
++			.version_min = VC_SM_MIN_VER,
++			.fourcc = VCHIQ_MAKE_FOURCC('S', 'M', 'E', 'M'),
++			.callback = vc_sm_cma_vchi_callback,
++			.userdata = instance,
++		};
++
++		status = vchiq_open_service(vchiq_instance, &params,
++					    &instance->service_handle[i]);
++		if (status) {
++			pr_err("%s: failed to open VCHI service (%d)",
++			       __func__, status);
++
++			goto err_close_services;
++		}
++	}
++	/* Create the thread which takes care of all io to/from videoocore. */
++	instance->io_thread = kthread_create(&vc_sm_cma_vchi_videocore_io,
++					     (void *)instance, "SMIO");
++	if (!instance->io_thread) {
++		pr_err("%s: failed to create SMIO thread", __func__);
++
++		goto err_close_services;
++	}
++	instance->vpu_event = vpu_event;
++	set_user_nice(instance->io_thread, -10);
++	wake_up_process(instance->io_thread);
++
++	pr_debug("%s: success - instance %p", __func__, instance);
++	return instance;
++
++err_close_services:
++	for (i = 0; i < instance->num_connections; i++) {
++		if (instance->service_handle[i])
++			vchiq_close_service(vchiq_instance, instance->service_handle[i]);
++	}
++	kfree(instance);
++err_null:
++	pr_debug("%s: FAILED", __func__);
++	return NULL;
++}
++
++int vc_sm_cma_vchi_stop(struct vchiq_instance *vchiq_instance, struct sm_instance **handle)
++{
++	struct sm_instance *instance;
++	u32 i;
++
++	if (!handle) {
++		pr_err("%s: invalid pointer to handle %p", __func__, handle);
++		goto lock;
++	}
++
++	if (!*handle) {
++		pr_err("%s: invalid handle %p", __func__, *handle);
++		goto lock;
++	}
++
++	instance = *handle;
++
++	/* Close all VCHI service connections */
++	for (i = 0; i < instance->num_connections; i++) {
++		vchiq_use_service(vchiq_instance, instance->service_handle[i]);
++		vchiq_close_service(vchiq_instance, instance->service_handle[i]);
++	}
++
++	kfree(instance);
++
++	*handle = NULL;
++	return 0;
++
++lock:
++	return -EINVAL;
++}
++
++static int vc_sm_cma_vchi_send_msg(struct sm_instance *handle,
++				   enum vc_sm_msg_type msg_id, void *msg,
++				   u32 msg_size, void *result, u32 result_size,
++				   u32 *cur_trans_id, u8 wait_reply)
++{
++	int status = 0;
++	struct sm_instance *instance = handle;
++	struct sm_cmd_rsp_blk *cmd_blk;
++
++	if (!handle) {
++		pr_err("%s: invalid handle", __func__);
++		return -EINVAL;
++	}
++	if (!msg) {
++		pr_err("%s: invalid msg pointer", __func__);
++		return -EINVAL;
++	}
++
++	cmd_blk =
++	    vc_vchi_cmd_create(instance, msg_id, msg, msg_size, wait_reply);
++	if (!cmd_blk) {
++		pr_err("[%s]: failed to allocate global tracking resource",
++		       __func__);
++		return -ENOMEM;
++	}
++
++	if (cur_trans_id)
++		*cur_trans_id = cmd_blk->id;
++
++	mutex_lock(&instance->lock);
++	list_add_tail(&cmd_blk->head, &instance->cmd_list);
++	mutex_unlock(&instance->lock);
++	complete(&instance->io_cmplt);
++
++	if (!wait_reply)
++		/* We're done */
++		return 0;
++
++	/* Wait for the response */
++	if (wait_for_completion_interruptible(&cmd_blk->cmplt)) {
++		mutex_lock(&instance->lock);
++		if (!cmd_blk->sent) {
++			list_del(&cmd_blk->head);
++			mutex_unlock(&instance->lock);
++			vc_vchi_cmd_delete(instance, cmd_blk);
++			return -ENXIO;
++		}
++
++		list_move(&cmd_blk->head, &instance->dead_list);
++		mutex_unlock(&instance->lock);
++		complete(&instance->io_cmplt);
++		return -EINTR;	/* We're done */
++	}
++
++	if (result && result_size) {
++		memcpy(result, cmd_blk->msg, result_size);
++	} else {
++		struct vc_sm_result_t *res =
++			(struct vc_sm_result_t *)cmd_blk->msg;
++		status = (res->success == 0) ? 0 : -ENXIO;
++	}
++
++	mutex_lock(&instance->lock);
++	list_del(&cmd_blk->head);
++	mutex_unlock(&instance->lock);
++	vc_vchi_cmd_delete(instance, cmd_blk);
++	return status;
++}
++
++int vc_sm_cma_vchi_free(struct sm_instance *handle, struct vc_sm_free_t *msg,
++			u32 *cur_trans_id)
++{
++	return vc_sm_cma_vchi_send_msg(handle, VC_SM_MSG_TYPE_FREE,
++				   msg, sizeof(*msg), 0, 0, cur_trans_id, 0);
++}
++
++int vc_sm_cma_vchi_import(struct sm_instance *handle, struct vc_sm_import *msg,
++			  struct vc_sm_import_result *result, u32 *cur_trans_id)
++{
++	return vc_sm_cma_vchi_send_msg(handle, VC_SM_MSG_TYPE_IMPORT,
++				   msg, sizeof(*msg), result, sizeof(*result),
++				   cur_trans_id, 1);
++}
++
++int vc_sm_cma_vchi_client_version(struct sm_instance *handle,
++				  struct vc_sm_version *msg,
++				  struct vc_sm_result_t *result,
++				  u32 *cur_trans_id)
++{
++	return vc_sm_cma_vchi_send_msg(handle, VC_SM_MSG_TYPE_CLIENT_VERSION,
++				   //msg, sizeof(*msg), result, sizeof(*result),
++				   //cur_trans_id, 1);
++				   msg, sizeof(*msg), NULL, 0,
++				   cur_trans_id, 0);
++}
++
++int vc_sm_vchi_client_vc_mem_req_reply(struct sm_instance *handle,
++				       struct vc_sm_vc_mem_request_result *msg,
++				       uint32_t *cur_trans_id)
++{
++	return vc_sm_cma_vchi_send_msg(handle,
++				       VC_SM_MSG_TYPE_VC_MEM_REQUEST_REPLY,
++				       msg, sizeof(*msg), 0, 0, cur_trans_id,
++				       0);
++}
+--- /dev/null
++++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.h
+@@ -0,0 +1,63 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++
++/*
++ * VideoCore Shared Memory CMA allocator
++ *
++ * Copyright: 2018, Raspberry Pi (Trading) Ltd
++ * Copyright 2011-2012 Broadcom Corporation.  All rights reserved.
++ *
++ * Based on vmcs_sm driver from Broadcom Corporation.
++ *
++ */
++
++#ifndef __VC_SM_CMA_VCHI_H__INCLUDED__
++#define __VC_SM_CMA_VCHI_H__INCLUDED__
++
++#include <linux/raspberrypi/vchiq.h>
++
++#include "vc_sm_defs.h"
++
++/*
++ * Forward declare.
++ */
++struct sm_instance;
++
++typedef void (*vpu_event_cb)(struct sm_instance *instance,
++			     struct vc_sm_result_t *reply, int reply_len);
++
++/*
++ * Initialize the shared memory service, opens up vchi connection to talk to it.
++ */
++struct sm_instance *vc_sm_cma_vchi_init(struct vchiq_instance *vchi_instance,
++					unsigned int num_connections,
++					vpu_event_cb vpu_event);
++
++/*
++ * Terminates the shared memory service.
++ */
++int vc_sm_cma_vchi_stop(struct vchiq_instance *vchi_instance, struct sm_instance **handle);
++
++/*
++ * Ask the shared memory service to free up some memory that was previously
++ * allocated by the vc_sm_cma_vchi_alloc function call.
++ */
++int vc_sm_cma_vchi_free(struct sm_instance *handle, struct vc_sm_free_t *msg,
++			u32 *cur_trans_id);
++
++/*
++ * Import a contiguous block of memory and wrap it in a GPU MEM_HANDLE_T.
++ */
++int vc_sm_cma_vchi_import(struct sm_instance *handle, struct vc_sm_import *msg,
++			  struct vc_sm_import_result *result,
++			  u32 *cur_trans_id);
++
++int vc_sm_cma_vchi_client_version(struct sm_instance *handle,
++				  struct vc_sm_version *msg,
++				  struct vc_sm_result_t *result,
++				  u32 *cur_trans_id);
++
++int vc_sm_vchi_client_vc_mem_req_reply(struct sm_instance *handle,
++				       struct vc_sm_vc_mem_request_result *msg,
++				       uint32_t *cur_trans_id);
++
++#endif /* __VC_SM_CMA_VCHI_H__INCLUDED__ */
+--- /dev/null
++++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_defs.h
+@@ -0,0 +1,297 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++
++/*
++ * VideoCore Shared Memory CMA allocator
++ *
++ * Copyright: 2018, Raspberry Pi (Trading) Ltd
++ *
++ * Based on vc_sm_defs.h from the vmcs_sm driver Copyright Broadcom Corporation.
++ * All IPC messages are copied across to this file, even if the vc-sm-cma
++ * driver is not currently using them.
++ *
++ ****************************************************************************
++ */
++
++#ifndef __VC_SM_DEFS_H__INCLUDED__
++#define __VC_SM_DEFS_H__INCLUDED__
++
++/* Maximum message length */
++#define VC_SM_MAX_MSG_LEN (sizeof(union vc_sm_msg_union_t) + \
++	sizeof(struct vc_sm_msg_hdr_t))
++#define VC_SM_MAX_RSP_LEN (sizeof(union vc_sm_msg_union_t))
++
++/* Resource name maximum size */
++#define VC_SM_RESOURCE_NAME 32
++
++/*
++ * Version to be reported to the VPU
++ * VPU assumes 0 (aka 1) which does not require the released callback, nor
++ * expect the client to handle VC_MEM_REQUESTS.
++ * Version 2 requires the released callback, and must support VC_MEM_REQUESTS.
++ */
++#define VC_SM_PROTOCOL_VERSION	2
++
++enum vc_sm_msg_type {
++	/* Message types supported for HOST->VC direction */
++
++	/* Allocate shared memory block */
++	VC_SM_MSG_TYPE_ALLOC,
++	/* Lock allocated shared memory block */
++	VC_SM_MSG_TYPE_LOCK,
++	/* Unlock allocated shared memory block */
++	VC_SM_MSG_TYPE_UNLOCK,
++	/* Unlock allocated shared memory block, do not answer command */
++	VC_SM_MSG_TYPE_UNLOCK_NOANS,
++	/* Free shared memory block */
++	VC_SM_MSG_TYPE_FREE,
++	/* Resize a shared memory block */
++	VC_SM_MSG_TYPE_RESIZE,
++	/* Walk the allocated shared memory block(s) */
++	VC_SM_MSG_TYPE_WALK_ALLOC,
++
++	/* A previously applied action will need to be reverted */
++	VC_SM_MSG_TYPE_ACTION_CLEAN,
++
++	/*
++	 * Import a physical address and wrap into a MEM_HANDLE_T.
++	 * Release with VC_SM_MSG_TYPE_FREE.
++	 */
++	VC_SM_MSG_TYPE_IMPORT,
++	/*
++	 *Tells VC the protocol version supported by this client.
++	 * 2 supports the async/cmd messages from the VPU for final release
++	 * of memory, and for VC allocations.
++	 */
++	VC_SM_MSG_TYPE_CLIENT_VERSION,
++	/* Response to VC request for memory */
++	VC_SM_MSG_TYPE_VC_MEM_REQUEST_REPLY,
++
++	/*
++	 * Asynchronous/cmd messages supported for VC->HOST direction.
++	 * Signalled by setting the top bit in vc_sm_result_t trans_id.
++	 */
++
++	/*
++	 * VC has finished with an imported memory allocation.
++	 * Release any Linux reference counts on the underlying block.
++	 */
++	VC_SM_MSG_TYPE_RELEASED,
++	/* VC request for memory */
++	VC_SM_MSG_TYPE_VC_MEM_REQUEST,
++
++	VC_SM_MSG_TYPE_MAX
++};
++
++/* Type of memory to be allocated */
++enum vc_sm_alloc_type_t {
++	VC_SM_ALLOC_CACHED,
++	VC_SM_ALLOC_NON_CACHED,
++};
++
++/* Message header for all messages in HOST->VC direction */
++struct vc_sm_msg_hdr_t {
++	u32 type;
++	u32 trans_id;
++	u8 body[0];
++
++};
++
++/* Request to allocate memory (HOST->VC) */
++struct vc_sm_alloc_t {
++	/* type of memory to allocate */
++	enum vc_sm_alloc_type_t type;
++	/* byte amount of data to allocate per unit */
++	u32 base_unit;
++	/* number of unit to allocate */
++	u32 num_unit;
++	/* alignment to be applied on allocation */
++	u32 alignment;
++	/* identity of who allocated this block */
++	u32 allocator;
++	/* resource name (for easier tracking on vc side) */
++	char name[VC_SM_RESOURCE_NAME];
++
++};
++
++/* Result of a requested memory allocation (VC->HOST) */
++struct vc_sm_alloc_result_t {
++	/* Transaction identifier */
++	u32 trans_id;
++
++	/* Resource handle */
++	u32 res_handle;
++	/* Pointer to resource buffer */
++	u32 res_mem;
++	/* Resource base size (bytes) */
++	u32 res_base_size;
++	/* Resource number */
++	u32 res_num;
++
++};
++
++/* Request to free a previously allocated memory (HOST->VC) */
++struct vc_sm_free_t {
++	/* Resource handle (returned from alloc) */
++	u32 res_handle;
++	/* Resource buffer (returned from alloc) */
++	u32 res_mem;
++
++};
++
++/* Request to lock a previously allocated memory (HOST->VC) */
++struct vc_sm_lock_unlock_t {
++	/* Resource handle (returned from alloc) */
++	u32 res_handle;
++	/* Resource buffer (returned from alloc) */
++	u32 res_mem;
++
++};
++
++/* Request to resize a previously allocated memory (HOST->VC) */
++struct vc_sm_resize_t {
++	/* Resource handle (returned from alloc) */
++	u32 res_handle;
++	/* Resource buffer (returned from alloc) */
++	u32 res_mem;
++	/* Resource *new* size requested (bytes) */
++	u32 res_new_size;
++
++};
++
++/* Result of a requested memory lock (VC->HOST) */
++struct vc_sm_lock_result_t {
++	/* Transaction identifier */
++	u32 trans_id;
++
++	/* Resource handle */
++	u32 res_handle;
++	/* Pointer to resource buffer */
++	u32 res_mem;
++	/*
++	 * Pointer to former resource buffer if the memory
++	 * was reallocated
++	 */
++	u32 res_old_mem;
++
++};
++
++/* Generic result for a request (VC->HOST) */
++struct vc_sm_result_t {
++	/* Transaction identifier */
++	u32 trans_id;
++
++	s32 success;
++
++};
++
++/* Request to revert a previously applied action (HOST->VC) */
++struct vc_sm_action_clean_t {
++	/* Action of interest */
++	enum vc_sm_msg_type res_action;
++	/* Transaction identifier for the action of interest */
++	u32 action_trans_id;
++
++};
++
++/* Request to remove all data associated with a given allocator (HOST->VC) */
++struct vc_sm_free_all_t {
++	/* Allocator identifier */
++	u32 allocator;
++};
++
++/* Request to import memory (HOST->VC) */
++struct vc_sm_import {
++	/* type of memory to allocate */
++	enum vc_sm_alloc_type_t type;
++	/* pointer to the VC (ie physical) address of the allocated memory */
++	u32 addr;
++	/* size of buffer */
++	u32 size;
++	/* opaque handle returned in RELEASED messages */
++	u32 kernel_id;
++	/* Allocator identifier */
++	u32 allocator;
++	/* resource name (for easier tracking on vc side) */
++	char     name[VC_SM_RESOURCE_NAME];
++};
++
++/* Result of a requested memory import (VC->HOST) */
++struct vc_sm_import_result {
++	/* Transaction identifier */
++	u32 trans_id;
++
++	/* Resource handle */
++	u32 res_handle;
++};
++
++/* Notification that VC has finished with an allocation (VC->HOST) */
++struct vc_sm_released {
++	/* cmd type / trans_id */
++	u32 cmd;
++
++	/* pointer to the VC (ie physical) address of the allocated memory */
++	u32 addr;
++	/* size of buffer */
++	u32 size;
++	/* opaque handle returned in RELEASED messages */
++	u32 kernel_id;
++	u32 vc_handle;
++};
++
++/*
++ * Client informing VC as to the protocol version it supports.
++ * >=2 requires the released callback, and supports VC asking for memory.
++ * Failure means that the firmware doesn't support this call, and therefore the
++ * client should either fail, or NOT rely on getting the released callback.
++ */
++struct vc_sm_version {
++	u32 version;
++};
++
++/* Request FROM VideoCore for some memory */
++struct vc_sm_vc_mem_request {
++	/* cmd type */
++	u32 cmd;
++
++	/* trans_id (from VPU) */
++	u32 trans_id;
++	/* size of buffer */
++	u32 size;
++	/* alignment of buffer */
++	u32 align;
++	/* resource name (for easier tracking) */
++	char     name[VC_SM_RESOURCE_NAME];
++	/* VPU handle for the resource */
++	u32 vc_handle;
++};
++
++/* Response from the kernel to provide the VPU with some memory */
++struct vc_sm_vc_mem_request_result {
++	/* Transaction identifier for the VPU */
++	u32 trans_id;
++	/* pointer to the physical address of the allocated memory */
++	u32 addr;
++	/* opaque handle returned in RELEASED messages */
++	u32 kernel_id;
++};
++
++/* Union of ALL messages */
++union vc_sm_msg_union_t {
++	struct vc_sm_alloc_t alloc;
++	struct vc_sm_alloc_result_t alloc_result;
++	struct vc_sm_free_t free;
++	struct vc_sm_lock_unlock_t lock_unlock;
++	struct vc_sm_action_clean_t action_clean;
++	struct vc_sm_resize_t resize;
++	struct vc_sm_lock_result_t lock_result;
++	struct vc_sm_result_t result;
++	struct vc_sm_free_all_t free_all;
++	struct vc_sm_import import;
++	struct vc_sm_import_result import_result;
++	struct vc_sm_version version;
++	struct vc_sm_released released;
++	struct vc_sm_vc_mem_request vc_request;
++	struct vc_sm_vc_mem_request_result vc_request_result;
++};
++
++#endif /* __VC_SM_DEFS_H__INCLUDED__ */
+--- /dev/null
++++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_knl.h
+@@ -0,0 +1,28 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++
++/*
++ * VideoCore Shared Memory CMA allocator
++ *
++ * Copyright: 2018, Raspberry Pi (Trading) Ltd
++ *
++ * Based on vc_sm_defs.h from the vmcs_sm driver Copyright Broadcom Corporation.
++ *
++ */
++
++#ifndef __VC_SM_KNL_H__INCLUDED__
++#define __VC_SM_KNL_H__INCLUDED__
++
++#if !defined(__KERNEL__)
++#error "This interface is for kernel use only..."
++#endif
++
++/* Free a previously allocated or imported shared memory handle and block. */
++int vc_sm_cma_free(void *handle);
++
++/* Get an internal resource handle mapped from the external one. */
++int vc_sm_cma_int_handle(void *handle);
++
++/* Import a block of memory into the GPU space. */
++int vc_sm_cma_import_dmabuf(struct dma_buf *dmabuf, void **handle);
++
++#endif /* __VC_SM_KNL_H__INCLUDED__ */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0201-staging-vchiq-mmal-Add-support-for-14bit-Bayer.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0201-staging-vchiq-mmal-Add-support-for-14bit-Bayer.patch
new file mode 100644
index 00000000..6d296a07
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0201-staging-vchiq-mmal-Add-support-for-14bit-Bayer.patch
@@ -0,0 +1,27 @@
+From 650f470394ef5e367f23a4c96d046c691cb42069 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 6 May 2020 18:09:04 +0100
+Subject: [PATCH 201/697] staging: vchiq-mmal: Add support for 14bit Bayer
+
+Add in the missing defines.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h
+@@ -90,6 +90,12 @@
+ #define MMAL_ENCODING_BAYER_SGBRG12P   MMAL_FOURCC('p', 'G', '1', '2')
+ #define MMAL_ENCODING_BAYER_SRGGB12P   MMAL_FOURCC('p', 'R', '1', '2')
+ 
++//14 bit per pixel Bayer formats.
++#define MMAL_ENCODING_BAYER_SBGGR14P   MMAL_FOURCC('p', 'B', 'E', 'E')
++#define MMAL_ENCODING_BAYER_SGBRG14P   MMAL_FOURCC('p', 'G', 'E', 'E')
++#define MMAL_ENCODING_BAYER_SGRBG14P   MMAL_FOURCC('p', 'g', 'E', 'E')
++#define MMAL_ENCODING_BAYER_SRGGB14P   MMAL_FOURCC('p', 'R', 'E', 'E')
++
+ /* 16 bit per pixel Bayer formats. */
+ #define MMAL_ENCODING_BAYER_SBGGR16    MMAL_FOURCC('B', 'G', '1', '6')
+ #define MMAL_ENCODING_BAYER_SGBRG16    MMAL_FOURCC('G', 'B', '1', '6')
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0202-staging-mmal-vchiq-Add-monochrome-image-formats.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0202-staging-mmal-vchiq-Add-monochrome-image-formats.patch
new file mode 100644
index 00000000..931e6367
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0202-staging-mmal-vchiq-Add-monochrome-image-formats.patch
@@ -0,0 +1,29 @@
+From e3318518b1a62ce42f028a88c259afdd138cbfb5 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 6 May 2020 18:11:14 +0100
+Subject: [PATCH 202/697] staging: mmal-vchiq: Add monochrome image formats
+
+Adds support for monochrome image formats in the various
+MIPI packings.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h
+@@ -102,6 +102,13 @@
+ #define MMAL_ENCODING_BAYER_SGRBG16    MMAL_FOURCC('G', 'R', '1', '6')
+ #define MMAL_ENCODING_BAYER_SRGGB16    MMAL_FOURCC('R', 'G', '1', '6')
+ 
++/* MIPI packed monochrome images */
++#define MMAL_ENCODING_GREY    MMAL_FOURCC('G', 'R', 'E', 'Y')
++#define MMAL_ENCODING_Y10P    MMAL_FOURCC('Y', '1', '0', 'P')
++#define MMAL_ENCODING_Y12P    MMAL_FOURCC('Y', '1', '2', 'P')
++#define MMAL_ENCODING_Y14P    MMAL_FOURCC('Y', '1', '4', 'P')
++#define MMAL_ENCODING_Y16     MMAL_FOURCC('Y', '1', '6', ' ')
++
+ /** An EGL image handle
+  */
+ #define MMAL_ENCODING_EGL_IMAGE        MMAL_FOURCC('E', 'G', 'L', 'I')
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0203-staging-mmal-vchiq-Use-vc-sm-cma-to-support-zero-cop.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0203-staging-mmal-vchiq-Use-vc-sm-cma-to-support-zero-cop.patch
new file mode 100644
index 00000000..e223218f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0203-staging-mmal-vchiq-Use-vc-sm-cma-to-support-zero-cop.patch
@@ -0,0 +1,178 @@
+From 3f4e4fbccba7a48f61b7227483ee18386d7a62ad Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Tue, 25 Sep 2018 16:07:55 +0100
+Subject: [PATCH 203/697] staging: mmal-vchiq: Use vc-sm-cma to support zero
+ copy
+
+With the vc-sm-cma driver we can support zero copy of buffers between
+the kernel and VPU. Add this support to mmal-vchiq.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+vc-sm-cma: fixed kbuild problem
+
+error logs:
+  drivers/staging/vc04_services/vc-sm-cma/Kconfig:1:error: recursive dependency detected!
+  drivers/staging/vc04_services/vc-sm-cma/Kconfig:1:      symbol BCM_VC_SM_CMA is selected by BCM2835_VCHIQ_MMAL
+  drivers/staging/vc04_services/vchiq-mmal/Kconfig:1:     symbol BCM2835_VCHIQ_MMAL depends on BCM2835_VCHIQ
+  drivers/staging/vc04_services/Kconfig:14:       symbol BCM2835_VCHIQ is selected by BCM_VC_SM_CMA
+  For a resolution refer to Documentation/kbuild/kconfig-language.rst
+  subsection "Kconfig recursive dependency limitations"
+
+Tested-by: make ARCH=arm64 bcm2711_defconfig
+Test platform: fedora 33
+Branch: rpi-5.10.y
+---
+ .../staging/vc04_services/vchiq-mmal/Kconfig  |  3 +-
+ .../vc04_services/vchiq-mmal/mmal-common.h    |  4 ++
+ .../vc04_services/vchiq-mmal/mmal-vchiq.c     | 66 ++++++++++++++++++-
+ .../vc04_services/vchiq-mmal/mmal-vchiq.h     |  1 +
+ 4 files changed, 71 insertions(+), 3 deletions(-)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/Kconfig
++++ b/drivers/staging/vc04_services/vchiq-mmal/Kconfig
+@@ -1,6 +1,7 @@
+ config BCM2835_VCHIQ_MMAL
+ 	tristate "BCM2835 MMAL VCHIQ service"
+-	depends on BCM2835_VCHIQ
++	select BCM2835_VCHIQ
++	select BCM_VC_SM_CMA
+ 	help
+ 	  Enables the MMAL API over VCHIQ interface as used for the
+ 	  majority of the multimedia services on VideoCore.
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-common.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-common.h
+@@ -50,6 +50,10 @@ struct mmal_buffer {
+ 
+ 	struct mmal_msg_context *msg_context;
+ 
++	struct dma_buf *dma_buf;/* Exported dmabuf fd from videobuf2 */
++	void *vcsm_handle;	/* VCSM handle having imported the dmabuf */
++	u32 vc_handle;		/* VC handle to that dmabuf */
++
+ 	u32 cmd;		/* MMAL command. 0=data. */
+ 	unsigned long length;
+ 	u32 mmal_flags;
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+@@ -28,9 +28,12 @@
+ #include "../include/linux/raspberrypi/vchiq.h"
+ #include "../interface/vchiq_arm/vchiq_arm.h"
+ #include "mmal-common.h"
++#include "mmal-parameters.h"
+ #include "mmal-vchiq.h"
+ #include "mmal-msg.h"
+ 
++#include "../vc-sm-cma/vc_sm_knl.h"
++
+ /*
+  * maximum number of components supported.
+  * This matches the maximum permitted by default on the VPU
+@@ -417,8 +420,13 @@ buffer_from_host(struct vchiq_mmal_insta
+ 
+ 	/* buffer header */
+ 	m.u.buffer_from_host.buffer_header.cmd = 0;
+-	m.u.buffer_from_host.buffer_header.data =
+-		(u32)(unsigned long)buf->buffer;
++	if (port->zero_copy) {
++		m.u.buffer_from_host.buffer_header.data = buf->vc_handle;
++	} else {
++		m.u.buffer_from_host.buffer_header.data =
++			(u32)(unsigned long)buf->buffer;
++	}
++
+ 	m.u.buffer_from_host.buffer_header.alloc_size = buf->buffer_size;
+ 	if (port->type == MMAL_PORT_TYPE_OUTPUT) {
+ 		m.u.buffer_from_host.buffer_header.length = 0;
+@@ -584,6 +592,22 @@ static void buffer_to_host_cb(struct vch
+ 
+ 		msg_context->u.bulk.status = msg->h.status;
+ 
++	} else if (msg->u.buffer_from_host.is_zero_copy) {
++		/*
++		 * Zero copy buffer, so nothing to do.
++		 * Copy buffer info and make callback.
++		 */
++		msg_context->u.bulk.buffer_used =
++				msg->u.buffer_from_host.buffer_header.length;
++		msg_context->u.bulk.mmal_flags =
++				msg->u.buffer_from_host.buffer_header.flags;
++		msg_context->u.bulk.dts =
++				msg->u.buffer_from_host.buffer_header.dts;
++		msg_context->u.bulk.pts =
++				msg->u.buffer_from_host.buffer_header.pts;
++		msg_context->u.bulk.cmd =
++				msg->u.buffer_from_host.buffer_header.cmd;
++
+ 	} else if (msg->u.buffer_from_host.buffer_header.length == 0) {
+ 		/* empty buffer */
+ 		if (msg->u.buffer_from_host.buffer_header.flags &
+@@ -1529,6 +1553,9 @@ int vchiq_mmal_port_parameter_set(struct
+ 
+ 	mutex_unlock(&instance->vchiq_mutex);
+ 
++	if (parameter == MMAL_PARAMETER_ZERO_COPY && !ret)
++		port->zero_copy = !!(*(bool *)value);
++
+ 	return ret;
+ }
+ EXPORT_SYMBOL_GPL(vchiq_mmal_port_parameter_set);
+@@ -1697,6 +1724,31 @@ int vchiq_mmal_submit_buffer(struct vchi
+ 	unsigned long flags = 0;
+ 	int ret;
+ 
++	/*
++	 * We really want to do this in mmal_vchi_buffer_init but can't as
++	 * videobuf2 won't let us have the dmabuf there.
++	 */
++	if (port->zero_copy && buffer->dma_buf && !buffer->vcsm_handle) {
++		pr_debug("%s: import dmabuf %p\n", __func__, buffer->dma_buf);
++		ret = vc_sm_cma_import_dmabuf(buffer->dma_buf,
++					      &buffer->vcsm_handle);
++		if (ret) {
++			pr_err("%s: vc_sm_import_dmabuf_fd failed, ret %d\n",
++			       __func__, ret);
++			return ret;
++		}
++
++		buffer->vc_handle = vc_sm_cma_int_handle(buffer->vcsm_handle);
++		if (!buffer->vc_handle) {
++			pr_err("%s: vc_sm_int_handle failed %d\n",
++			       __func__, ret);
++			vc_sm_cma_free(buffer->vcsm_handle);
++			return ret;
++		}
++		pr_debug("%s: import dmabuf %p - got vc handle %08X\n",
++			 __func__, buffer->dma_buf, buffer->vc_handle);
++	}
++
+ 	ret = buffer_from_host(instance, port, buffer);
+ 	if (ret == -EINVAL) {
+ 		/* Port is disabled. Queue for when it is enabled. */
+@@ -1730,6 +1782,16 @@ int mmal_vchi_buffer_cleanup(struct mmal
+ 		release_msg_context(msg_context);
+ 	buf->msg_context = NULL;
+ 
++	if (buf->vcsm_handle) {
++		int ret;
++
++		pr_debug("%s: vc_sm_cma_free on handle %p\n", __func__,
++			 buf->vcsm_handle);
++		ret = vc_sm_cma_free(buf->vcsm_handle);
++		if (ret)
++			pr_err("%s: vcsm_free failed, ret %d\n", __func__, ret);
++		buf->vcsm_handle = 0;
++	}
+ 	return 0;
+ }
+ EXPORT_SYMBOL_GPL(mmal_vchi_buffer_cleanup);
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
+@@ -49,6 +49,7 @@ typedef void (*vchiq_mmal_buffer_cb)(str
+ 
+ struct vchiq_mmal_port {
+ 	bool enabled;
++	u32 zero_copy:1;
+ 	u32 handle;
+ 	u32 type; /* port type, cached to use on port info set */
+ 	u32 index; /* port index, cached to use on port info set */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0204-staging-vc04_services-Add-a-V4L2-M2M-codec-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0204-staging-vc04_services-Add-a-V4L2-M2M-codec-driver.patch
new file mode 100644
index 00000000..23d9d985
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0204-staging-vc04_services-Add-a-V4L2-M2M-codec-driver.patch
@@ -0,0 +1,4704 @@
+From 6180940bd540c62c3c9300b031a1e7202de688da Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 8 Oct 2020 20:24:12 +0100
+Subject: [PATCH 204/697] staging: vc04_services: Add a V4L2 M2M codec driver
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This adds a V4L2 memory to memory device that wraps the MMAL
+video decode and video_encode components for H264 and MJPEG encode
+and decode, MPEG4, H263, and VP8 decode (and MPEG2 decode
+if the appropriate licence has been purchased).
+
+This patch squashes all the work done in developing the driver
+on the Raspberry Pi rpi-5.4.y kernel branch.
+Thanks to Kieran Bingham, Aman Gupta, Chen-Yu Tsai, and
+Marek Behún for their contributions. Please refer to the
+rpi-5.4.y branch for the full history.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Ensure OUTPUT timestamps are always forwarded
+
+The firmware by default tries to ensure that decoded frame
+timestamps always increment. This is counter to the V4L2 API
+which wants exactly the OUTPUT queue timestamps passed to the
+CAPTURE queue buffers.
+
+Disable the firmware option.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/vc04_services/codec: Add support for CID MPEG_HEADER_MODE
+
+Control V4L2_CID_MPEG_VIDEO_HEADER_MODE controls whether the encoder
+is meant to emit the header bytes as a separate packet or with the
+first encoded frame.
+Add support for it.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/vc04_services/codec: Clear last buf dequeued flag on START
+
+It appears that the V4L2 M2M framework requires the driver to manually
+call vb2_clear_last_buffer_dequeued on the CAPTURE queue during a
+V4L2_DEC_CMD_START.
+Add such a call.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/vc04-services/codec: Fix logical precedence issue
+
+Two issues identified with operator precedence in logical
+expressions. Fix them.
+
+https://github.com/raspberrypi/linux/issues/4040
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+vc04_services: bcm2835-codec: Switch to s32fract
+
+staging/bcm2835-codec: Add the unpacked (16bpp) raw formats
+
+Now that the firmware supports the unpacked (16bpp) variants
+of the MIPI raw formats, add the mappings.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Log the number of excess supported formats
+
+When logging that the firmware has provided more supported formats
+than we had allocated storage for, log the number allocated and
+returned.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Add support for pixel aspect ratio
+
+If the format is detected by the driver and a V4L2_EVENT_SOURCE_CHANGE
+event is generated, then pass on the pixel aspect ratio as well.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Implement additional g_selection calls for decode
+
+v4l_cropcap calls our vidioc_g_pixelaspect function to get the pixel
+aspect ratio, but also calls g_selection for V4L2_SEL_TGT_CROP_BOUNDS
+and V4L2_SEL_TGT_CROP_DEFAULT. Whilst it allows for vidioc_g_pixelaspect
+not to be implemented, it doesn't allow for either of the other two.
+
+Add in support for the additional selection targets.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Add VC-1 support.
+
+Providing the relevant licence has been purchased, then Pi0-3
+can decode VC-1.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Fix support for levels 4.1 and 4.2
+
+The driver said it supported H264 levels 4.1 and 4.2, but
+was missing the V4L2 to MMAL mappings.
+
+Add in those mappings.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Set the colourspace appropriately for RGB formats
+
+Video decode supports YUV and RGB formats. YUV needs to report SMPTE170M
+or REC709 appropriately, whilst RGB should report SRGB.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Pass corrupt frame flag.
+
+MMAL has the flag MMAL_BUFFER_HEADER_FLAG_CORRUPTED but that
+wasn't being passed through, so add it.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Do not update crop from S_FMT after res change
+
+During decode, setting the CAPTURE queue format was setting the crop
+rectangle to the requested height before aligning up the format to
+cater for simple clients that weren't expecting to deal with cropping
+and the SELECTION API.
+This caused problems on some resolution change events if the client
+didn't also then use the selection API.
+
+Disable the crop update after a resolution change.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+bcm2835: Allow compressed frames to set sizeimage (#4386)
+
+Allow the user to set sizeimage in TRY_FMT and S_FMT if the format
+flags have V4L2_FMT_FLAG_COMPRESSED set
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+staging/bcm2835-codec: Change the default codec res to 32x32
+
+In order to effectively guarantee that a V4L2_EVENT_SOURCE_CHANGE
+event occurs, adopt a default resolution of 32x32 so that it
+is incredibly unlikely to be decoding a stream of that resolution
+and therefore failing to note a "change" requiring the event.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Add support for decoding interlaced streams
+
+The video decoder can support decoding interlaced streams, so add
+the required plumbing to signal this correctly.
+
+The encoder and ISP do NOT support interlaced data, so trying to
+configure an interlaced format on those nodes will be rejected.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Correct ENUM_FRAMESIZES stepsize to 2
+
+Being YUV420 formats, the step size is always 2 to avoid part
+chroma subsampling.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Return buffers to QUEUED not ERROR state
+
+Should start_streaming fail, or buffers be queued during
+stop_streaming, they should be returned to the core as QUEUED
+and not (as currently) as ERROR.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835_codec: Log MMAL flags in hex
+
+The flags is a bitmask, so it's far easier to interpret as hex
+data instead of decimal.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: bcm2835-codec: Allow custom specified strides/bytesperline.
+
+If the client provides a bytesperline value in try_fmt/s_fmt then
+validate it and correct if necessary.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835_codec: Add support for image_fx to deinterlace
+
+Adds another /dev/video node wrapping image_fx doing deinterlace.
+
+Co-developed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+staging/bcm2835-v4l2_codec: Fix for encode selection API
+
+Matches correct behaviour from DECODE and DEINTERLACE
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+staging: bcm2835-codec: Allow decode res changed before STREAMON(CAPTURE)
+
+The V4L2 stateful video decoder API requires that you can STREAMON
+on only the OUTPUT queue, feed in buffers, and wait for the
+SOURCE_CHANGE event.
+This requires that we enable the MMAL output port at the same time
+as the input port, because the output port is the one that creates
+the SOURCE_CHANGED event.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Do not send buffers to the VPU unless streaming
+
+With video decode we now enable both input and output ports on
+the component. This means that buffers will get passed to the VPU
+earlier than desired if they are queued befoer STREAMON.
+
+Check that the queue is streaming before sending buffers to the VPU.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: bcm2835-codec: Format changed should trigger drain
+
+When a format changed event occurs, the spec says that it
+triggers an implicit drain, and that needs to be signalled
+via -EPIPE.
+
+For BCM2835, the format changed event happens at the point
+the format change occurs, so no further buffers exist from
+before the resolution changed point. We therefore signal the
+last buffer immediately.
+We don't have a V4L2 available to us at this point, so set
+the videobuf2 queue last_buffer_dequeued flag directly.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: bcm2835-codec: Signal the firmware to stop on all changes
+
+The firmware defaults to not stopping video decode if only the
+pixel aspect ratio or colourspace change. V4L2 requires us
+to stop decoding on any change, therefore tell the firmware
+of the desire for this alternate behaviour.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: bcm2835-codec: Queue flushed buffers instead of completing
+
+When a buffer is returned on a port that is disabled, return it
+to the videobuf2 QUEUED state instead of DONE which returns it
+to the client.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: bcm2835_codec: Correct flushing code for refcounting
+
+Completions don't reference count, so setting the completion
+on the first buffer returned and then not reinitialising it
+means that the flush function doesn't behave as intended.
+
+Signal the completion when the last buffer is returned.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: bcm2835-codec: Ensure all ctrls are set on streamon
+
+Currently the code was only setting some controls from
+bcm2835_codec_set_ctrls, but it's simpler to use
+v4l2_ctrl_handler_setup to avoid forgetting to adding new
+controls to the list.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: bcm2835-codec: Add support for H&V Flips to ISP
+
+The ISP can do H & V flips whilst resizing or converting
+the image, so expose that via V4L2_CID_[H|V]FLIP.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+bcm2835-v4l2-codec: Remove advertised support of VP8
+
+The support for this format by firmware is very limited
+and won't be faster than the arm.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+Pass V4L2_CID_MPEG_VIDEO_H264_MIN_QP/MAX_QP to bcm2835-v4l2-codec
+
+Following raspberrypi/linux#4704. This is necessary to set up
+quantization for variable bitrate to avoid video flickering.
+
+staging/bcm2835-codec: bytesperline for YUV420/YVU420 needs to be 64
+
+Matching https://github.com/raspberrypi/linux/pull/4419, the ISP
+block (which is also used on the input of the encoder, and output
+of the decoder) needs the base address of all planes to be aligned
+to multiples of 32. This includes the chroma planes of YUV420 and
+YVU420.
+If the height is only a multiple of 2 (not 4), then you get an odd
+number of lines in the second plane, which means the 3rd plane
+starts at a multiple of bytesperline/2.
+
+Set the minimum bytesperline alignment to 64 for those formats
+so that the plane alignment is always right.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-codec: Allow a different stride alignment per role
+
+Deinterlace and decode aren't affected in the same way as encode
+and ISP by the alignment requirement on 3 plane YUV420.
+Decode would be affected, but it always aligns the height up to
+a macroblock, and uses the selection API to reflect that.
+
+Add in the facility to set the bytesperline alignment per role.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: vc04_services: codec: Add support for V4L2_PIX_FMT_RGBA32 format
+
+We already support V4L2_PIX_FMT_BGR32 which is the same thing with red
+and blue swapped, so it makes sense to include this variant as well.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+bcm2835-codec: Return empty buffers to the VPU instead of queueing to vbuf2
+
+The encoder can skip frames totally should rate control overshoot
+the target bitrate too far. In this situation it generates an
+output buffer of length 0.
+V4L2 treats a buffer of length 0 as an end of stream flag, which is
+not appropriate in this case, therefore we can not return that buffer
+to the client.
+
+The driver was returning the buffer to videobuf2 in the QUEUED state,
+however that buffer was then not dequeued again, so the number of
+buffers was reduced each time this happened. In the pathological
+case of using GStreamer's videotestsrc in mode 1 for noise, this happens
+sufficiently frequently to totally stall the pipeline.
+
+If the port is still enabled then return the buffer straight back to
+the VPU rather than to videobuf2.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+vc04_services: bcm2835-codec: Add support for V4L2_PIX_FMT_NV12_COL128
+
+V4L2_PIX_FMT_NV12_COL128 is supported by the ISP and the input of
+video_encode, output of video_decode, and both input and output
+of the ISP.
+
+Add in the plumbing to support the format on those ports.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+vc04_services: bcm2835-codec: Set crop_height for compressed formats
+
+In particular for the encoder where the CAPTURE format dictates
+the parameters given to the codec we need to be able to set the
+value passed as the crop_height for the compressed format.
+There's no crop available for cropped modes, so always set
+crop_height to the requested height.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+vc04_services: bcm2835-codec: Set port format from s_selection
+
+s_selection allows the crop region of an uncompressed pixel
+format to be specified, but it wasn't passing the setting on to
+the firmware. Depending on call order this would potentially
+mean that the crop wasn't actioned.
+
+Set the port format on s_selection if we have a component created.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+bcm2835-codec: /dev/video31 as interface to image_encode JPEG encoder
+
+Signed-off-by: Maxim Devaev <mdevaev@gmail.com>
+
+bcm2835-v4l2-codec: support H.264 5.0 and 5.1 levels
+
+vc04_services: bcm2835-codec:  Remove redundant role check
+
+vidioc_try_encoder_cmd checks the role, but the ioctl is disabled
+for any roles in which it is invalid.
+
+Remove the redundant check.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+vc04_services: bcm2835-codec: Allow encoder_cmd on ISP and deinterlace
+
+ISP and deinterlace also need a mechanism for passing effectively
+an EOS through the pipeline to signal when all buffers have been
+processed.
+
+VIDIOC_ENCODER_CMD does exactly this for encoders, so reuse the same
+function for ISP and deinterlace.
+(VIDIOC_DECODER_CMD is slightly different in that it also passes
+details of when and how to stop, so is not as relevant).
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+vc04_services: bcm2835_codec: Allow larger images through the ISP
+
+Whilst the codecs are restricted to 1920x1080 / 1080x1920, the ISP
+isn't, but the limits advertised via V4L2 was 1920x1920 for all
+roles.
+
+Increase the limit to 16k x 16k for the ISP.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: bcm2835-v4l2-codec: Enable selection ioctl for ISP
+
+The ISP cases do nothing. Remove the break that separates them from the
+deinterlace case so they now do the same as deinterlace. This enables
+simple width & height setting, but does not enable setting left and
+top coordinates.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+media: bcm2835-v4l2-codec: Add profile & level ctrls to decode
+
+In order to support discovery of what profile & levels are supported by
+stateful decoders implement the profile and level controls where they
+are defined by V4L2.
+
+Signed-off-by: John Cox <jc@kynesim.co.uk>
+
+vc04_services: bcm2835_codec: Ignore READ_ONLY ctrls in s_ctrl
+
+In adding the MPEG2/MPEG4/H264 level and profile controls to
+the decoder, they weren't declared as read-only, nor handlers
+added to bcm2835_codec_s_ctrl. That resulted in an error message
+"Invalid control" being logged every time v4l2_ctrl_handler_setup
+was called from bcm2835_codec_create_component.
+
+Define those controls as read only, and exit early from s_ctrl
+on read only controls.
+
+Fixes: "media: bcm2835-v4l2-codec: Add profile & level ctrls to decode"
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+vc04_services: bcm2835_codec: Set MPEG2_LEVEL control to READ_ONLY
+
+V4L2_CID_MPEG_VIDEO_MPEG2_LEVEL  was missed from
+"vc04_services: bcm2835_codec: Ignore READ_ONLY ctrls in s_ctrl"
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: bcm2835-codec: Add V4L2_CID_MPEG_VIDEO_B_FRAMES control
+
+FFmpeg insists on trying to set V4L2_CID_MPEG_VIDEO_B_FRAMES to
+0, and generates an error should it fail.
+As our encoder doesn't support B frames, add a stub handler for
+it to silence FFmpeg.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: bcm2835-codec: Add support for V4L2_CID_MPEG_VIDEO_GOP_SIZE
+
+For H264, V4L2_CID_MPEG_VIDEO_H264_I_PERIOD is meant to be the intra
+I-frame period, whilst V4L2_CID_MPEG_VIDEO_GOP_SIZE is the intra IDR
+frame period.
+The firmware encoder doesn't produce I-frames that aren't IDR as well,
+therefore V4L2_CID_MPEG_VIDEO_GOP_SIZE is technically the correct
+control, however users may have adopted V4L2_CID_MPEG_VIDEO_H264_I_PERIOD.
+
+Add support for V4L2_CID_MPEG_VIDEO_GOP_SIZE controlling the encoder,
+and have VIDIOC_S_CTRL for V4L2_CID_MPEG_VIDEO_H264_I_PERIOD update
+the value for V4L2_CID_MPEG_VIDEO_GOP_SIZE (the reverse is not
+implemented).
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: bcm2835-codec: Add missing alignment for V4L2_PIX_FMT_RGBA32
+
+The patch adding image encode (JPEG) to the driver missed adding
+the alignment constraint for V4L2_PIX_FMT_RGBA32, which meant
+it ended up giving a stride and size of 0.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: bcm2835-codec: Downgrade the level for a debug message
+
+The debug message from bcm2835_codec_buf_prepare when the buffer
+size is incorrect can be a little spammy if the application isn't
+careful on how it drives it, therefore drop the priority of the
+message.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+vc04_services: bcm2835-codec: Correct alignment requirements for YUYV
+
+The firmware wants the YUYV format stride alignment to be to a multiple
+of 32pixels / 64 bytes. The kernel driver was configuring it to a multiple
+of 16 pixels / 32 bytes, which then failed when it tried starting to
+stream.
+
+Correct the alignment requirements.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: bcm2835-codec: Fix up for 6.8 - use ignore_cap_streaming
+
+Drops downstream patch to v4l2_mem2mem, and uses the new mainline
+flag to achieve the same functionality
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: bcm2835-codec: 32bpp RGB formats need a 64byte alignment
+
+The firmware needs 16 pixel alignment on RGBx 32bpp formats, which
+would be 64 byte. The driver was only setting 32byte alignment.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: bcm2835_codec: Pass framerate to the component if set late
+
+For video encoding, if the framerate was set after the component
+was created, then it wasn't set correctly on the port, and an
+old value was encoded in the bitstream.
+
+Update the port status when the framerate is set.
+
+https://github.com/raspberrypi/rpicam-apps/issues/664
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: vc04_services: bcm2835-codec: Drop include Makefile directive
+
+Drop the include directive. They can break the build, when one only
+wants to build a subdirectory. Replace with "../" for the includes in
+the bcm2835-v4l2-codec instead.
+
+The fix is equivalent to the four patches between 29d49a76c5b2
+("staging: vc04_services: bcm2835-audio: Drop include Makefile
+directive")...2529ca211402 ("staging: vc04_services: interface: Drop
+include Makefile directive")
+
+Fixes: afaec52747b3 ("staging: vc04_services: Add a V4L2 M2M codec driver")
+Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+
+staging: vc04_services: bcm2835-v4l2-codec: Register with vchiq_bus_type
+
+Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+
+staging: vc04_services: bcm2835-codec: Explicitly set DMA mask
+
+The platform model originally handled the DMA mask. Now that
+we are on the vchiq_bus we need to explicitly set this.
+
+Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+
+staging: bcm2835-codec: Disable HEADER_ON_OPEN for video encode
+
+Video encode can defer generating the header until the first
+frame is presented, which allows it to take the colourspace
+information from the frame rather than just the format.
+
+Enable that for the V4L2 driver now that the firmware populates
+all the parameters.
+
+https://github.com/raspberrypi/firmware/issues/1885
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: bcm2835-codec: Add support for H264 level 5.0 and 5.1
+
+We do NOT claim to support decoding in real-time for these levels,
+but can transcode some content, and handle 1920x1200.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+vc04_services: codec: Allocate the max number of buffers on the VPU
+
+The VPU's API can't match the use of VIDIOC_CREATE_BUFS to add buffers
+to the internal pool whilst a port is enabled, therefore allocate
+the maximum number of buffers possible in V4L2 to avoid the issue.
+As these are only buffer headers, the overhead is relatively small.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/staging/vc04_services/Kconfig         |    1 +
+ drivers/staging/vc04_services/Makefile        |    1 +
+ .../vc04_services/bcm2835-codec/Kconfig       |   11 +
+ .../vc04_services/bcm2835-codec/Makefile      |    7 +
+ .../staging/vc04_services/bcm2835-codec/TODO  |    1 +
+ .../bcm2835-codec/bcm2835-v4l2-codec.c        | 4026 +++++++++++++++++
+ .../vchiq-mmal/mmal-parameters.h              |    8 +
+ 7 files changed, 4055 insertions(+)
+ create mode 100644 drivers/staging/vc04_services/bcm2835-codec/Kconfig
+ create mode 100644 drivers/staging/vc04_services/bcm2835-codec/Makefile
+ create mode 100644 drivers/staging/vc04_services/bcm2835-codec/TODO
+ create mode 100644 drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+
+--- a/drivers/staging/vc04_services/Kconfig
++++ b/drivers/staging/vc04_services/Kconfig
+@@ -51,6 +51,7 @@ source "drivers/staging/vc04_services/bc
+ source "drivers/staging/vc04_services/bcm2835-camera/Kconfig"
+ 
+ source "drivers/staging/vc04_services/vc-sm-cma/Kconfig"
++source "drivers/staging/vc04_services/bcm2835-codec/Kconfig"
+ 
+ source "drivers/staging/vc04_services/vchiq-mmal/Kconfig"
+ 
+--- a/drivers/staging/vc04_services/Makefile
++++ b/drivers/staging/vc04_services/Makefile
+@@ -15,4 +15,5 @@ obj-$(CONFIG_SND_BCM2835)		+= bcm2835-au
+ obj-$(CONFIG_VIDEO_BCM2835)		+= bcm2835-camera/
+ obj-$(CONFIG_BCM2835_VCHIQ_MMAL)	+= vchiq-mmal/
+ obj-$(CONFIG_BCM_VC_SM_CMA)		+= vc-sm-cma/
++obj-$(CONFIG_VIDEO_CODEC_BCM2835)	+= bcm2835-codec/
+ 
+--- /dev/null
++++ b/drivers/staging/vc04_services/bcm2835-codec/Kconfig
+@@ -0,0 +1,11 @@
++config VIDEO_CODEC_BCM2835
++	tristate "BCM2835 Video codec support"
++	depends on MEDIA_SUPPORT && MEDIA_CONTROLLER
++	depends on VIDEO_DEV && (ARCH_BCM2835 || COMPILE_TEST)
++	select BCM2835_VCHIQ_MMAL
++	select VIDEOBUF2_DMA_CONTIG
++	select V4L2_MEM2MEM_DEV
++	help
++	  Say Y here to enable the V4L2 video codecs for
++	  Broadcom BCM2835 SoC. This operates over the VCHIQ interface
++	  to a service running on VideoCore.
+--- /dev/null
++++ b/drivers/staging/vc04_services/bcm2835-codec/Makefile
+@@ -0,0 +1,7 @@
++# SPDX-License-Identifier: GPL-2.0
++bcm2835-codec-objs := bcm2835-v4l2-codec.o
++
++obj-$(CONFIG_VIDEO_CODEC_BCM2835) += bcm2835-codec.o
++
++ccflags-y += \
++	-D__VCCOREVER__=0x04000000
+--- /dev/null
++++ b/drivers/staging/vc04_services/bcm2835-codec/TODO
+@@ -0,0 +1 @@
++No issues. Depends on VCHIQ which is in staging.
+\ No newline at end of file
+--- /dev/null
++++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+@@ -0,0 +1,4026 @@
++// SPDX-License-Identifier: GPL-2.0
++
++/*
++ * A v4l2-mem2mem device that wraps the video codec MMAL component.
++ *
++ * Copyright 2018 Raspberry Pi (Trading) Ltd.
++ * Author: Dave Stevenson (dave.stevenson@raspberrypi.com)
++ *
++ * Loosely based on the vim2m virtual driver by Pawel Osciak
++ * Copyright (c) 2009-2010 Samsung Electronics Co., Ltd.
++ * Pawel Osciak, <pawel@osciak.com>
++ * Marek Szyprowski, <m.szyprowski@samsung.com>
++ *
++ * Whilst this driver uses the v4l2_mem2mem framework, it does not need the
++ * scheduling aspects, so will always take the buffers, pass them to the VPU,
++ * and then signal the job as complete.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; either version 2 of the
++ * License, or (at your option) any later version
++ */
++#include <linux/module.h>
++#include <linux/delay.h>
++#include <linux/fs.h>
++#include <linux/timer.h>
++#include <linux/sched.h>
++#include <linux/slab.h>
++#include <linux/syscalls.h>
++
++#include <media/v4l2-mem2mem.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-ioctl.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-event.h>
++#include <media/videobuf2-dma-contig.h>
++
++#include "../interface/vchiq_arm/vchiq_bus.h"
++
++#include "../vchiq-mmal/mmal-encodings.h"
++#include "../vchiq-mmal/mmal-msg.h"
++#include "../vchiq-mmal/mmal-parameters.h"
++#include "../vchiq-mmal/mmal-vchiq.h"
++
++MODULE_IMPORT_NS(DMA_BUF);
++
++/*
++ * Default /dev/videoN node numbers for decode and encode.
++ * Deliberately avoid the very low numbers as these are often taken by webcams
++ * etc, and simple apps tend to only go for /dev/video0.
++ */
++static int decode_video_nr = 10;
++module_param(decode_video_nr, int, 0644);
++MODULE_PARM_DESC(decode_video_nr, "decoder video device number");
++
++static int encode_video_nr = 11;
++module_param(encode_video_nr, int, 0644);
++MODULE_PARM_DESC(encode_video_nr, "encoder video device number");
++
++static int isp_video_nr = 12;
++module_param(isp_video_nr, int, 0644);
++MODULE_PARM_DESC(isp_video_nr, "isp video device number");
++
++static int deinterlace_video_nr = 18;
++module_param(deinterlace_video_nr, int, 0644);
++MODULE_PARM_DESC(deinterlace_video_nr, "deinterlace video device number");
++
++static int encode_image_nr = 31;
++module_param(encode_image_nr, int, 0644);
++MODULE_PARM_DESC(encode_image_nr, "encoder image device number");
++
++/*
++ * Workaround for GStreamer v4l2convert component not considering Bayer formats
++ * as raw, and therefore not considering a V4L2 device that supports them as
++ * a suitable candidate.
++ */
++static bool disable_bayer;
++module_param(disable_bayer, bool, 0644);
++MODULE_PARM_DESC(disable_bayer, "Disable support for Bayer formats");
++
++static unsigned int debug;
++module_param(debug, uint, 0644);
++MODULE_PARM_DESC(debug, "activates debug info (0-3)");
++
++static bool advanced_deinterlace = true;
++module_param(advanced_deinterlace, bool, 0644);
++MODULE_PARM_DESC(advanced_deinterlace, "Use advanced deinterlace");
++
++static int field_override;
++module_param(field_override, int, 0644);
++MODULE_PARM_DESC(field_override, "force TB(8)/BT(9) field");
++
++enum bcm2835_codec_role {
++	DECODE,
++	ENCODE,
++	ISP,
++	DEINTERLACE,
++	ENCODE_IMAGE,
++	NUM_ROLES
++};
++
++static const char * const roles[] = {
++	"decode",
++	"encode",
++	"isp",
++	"image_fx",
++	"encode_image",
++};
++
++static const char * const components[] = {
++	"ril.video_decode",
++	"ril.video_encode",
++	"ril.isp",
++	"ril.image_fx",
++	"ril.image_encode",
++};
++
++/* Timeout for stop_streaming to allow all buffers to return */
++#define COMPLETE_TIMEOUT (2 * HZ)
++
++#define MIN_W		32
++#define MIN_H		32
++#define MAX_W_CODEC	1920
++#define MAX_H_CODEC	1920
++#define MAX_W_ISP	16384
++#define MAX_H_ISP	16384
++#define BPL_ALIGN	32
++/*
++ * The decoder spec supports the V4L2_EVENT_SOURCE_CHANGE event, but the docs
++ * seem to want it to always be generated on startup, which prevents the client
++ * from configuring the CAPTURE queue based on any parsing it has already done
++ * which may save time and allow allocation of CAPTURE buffers early. Surely
++ * SOURCE_CHANGE means something has changed, not just "always notify".
++ *
++ * For those clients that don't set the CAPTURE resolution, adopt a default
++ * resolution that is seriously unlikely to be correct, therefore almost
++ * guaranteed to get the SOURCE_CHANGE event.
++ */
++#define DEFAULT_WIDTH	32
++#define DEFAULT_HEIGHT	32
++/*
++ * The unanswered question - what is the maximum size of a compressed frame?
++ * V4L2 mandates that the encoded frame must fit in a single buffer. Sizing
++ * that buffer is a compromise between wasting memory and risking not fitting.
++ * The 1080P version of Big Buck Bunny has some frames that exceed 512kB.
++ * Adopt a moderately arbitrary split at 720P for switching between 512 and
++ * 768kB buffers.
++ */
++#define DEF_COMP_BUF_SIZE_GREATER_720P	(768 << 10)
++#define DEF_COMP_BUF_SIZE_720P_OR_LESS	(512 << 10)
++/* JPEG image can be very large. For paranoid reasons 4MB is used */
++#define DEF_COMP_BUF_SIZE_JPEG (4096 << 10)
++
++/* Flags that indicate a format can be used for capture/output */
++#define MEM2MEM_CAPTURE		BIT(0)
++#define MEM2MEM_OUTPUT		BIT(1)
++
++#define MEM2MEM_NAME		"bcm2835-codec"
++
++struct bcm2835_codec_fmt {
++	u32	fourcc;
++	int	depth;
++	u8	bytesperline_align[NUM_ROLES];
++	u32	flags;
++	u32	mmal_fmt;
++	int	size_multiplier_x2;
++	bool	is_bayer;
++};
++
++static const struct bcm2835_codec_fmt supported_formats[] = {
++	{
++		/* YUV formats */
++		.fourcc			= V4L2_PIX_FMT_YUV420,
++		.depth			= 8,
++		.bytesperline_align	= { 32, 64, 64, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_I420,
++		.size_multiplier_x2	= 3,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_YVU420,
++		.depth			= 8,
++		.bytesperline_align	= { 32, 64, 64, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_YV12,
++		.size_multiplier_x2	= 3,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_NV12,
++		.depth			= 8,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_NV12,
++		.size_multiplier_x2	= 3,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_NV21,
++		.depth			= 8,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_NV21,
++		.size_multiplier_x2	= 3,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_RGB565,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_RGB16,
++		.size_multiplier_x2	= 2,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_YUYV,
++		.depth			= 16,
++		.bytesperline_align	= { 64, 64, 64, 64, 64 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_YUYV,
++		.size_multiplier_x2	= 2,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_UYVY,
++		.depth			= 16,
++		.bytesperline_align	= { 64, 64, 64, 64, 64 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_UYVY,
++		.size_multiplier_x2	= 2,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_YVYU,
++		.depth			= 16,
++		.bytesperline_align	= { 64, 64, 64, 64, 64 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_YVYU,
++		.size_multiplier_x2	= 2,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_VYUY,
++		.depth			= 16,
++		.bytesperline_align	= { 64, 64, 64, 64, 64 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_VYUY,
++		.size_multiplier_x2	= 2,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_NV12_COL128,
++		.depth			= 8,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_YUVUV128,
++		.size_multiplier_x2	= 3,
++	}, {
++		/* RGB formats */
++		.fourcc			= V4L2_PIX_FMT_RGB24,
++		.depth			= 24,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_RGB24,
++		.size_multiplier_x2	= 2,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_BGR24,
++		.depth			= 24,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BGR24,
++		.size_multiplier_x2	= 2,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_BGR32,
++		.depth			= 32,
++		.bytesperline_align	= { 64, 64, 64, 64, 64 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BGRA,
++		.size_multiplier_x2	= 2,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_RGBA32,
++		.depth			= 32,
++		.bytesperline_align	= { 64, 64, 64, 64, 64 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_RGBA,
++		.size_multiplier_x2	= 2,
++	}, {
++		/* Bayer formats */
++		/* 8 bit */
++		.fourcc			= V4L2_PIX_FMT_SRGGB8,
++		.depth			= 8,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SRGGB8,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SBGGR8,
++		.depth			= 8,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SBGGR8,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGRBG8,
++		.depth			= 8,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGRBG8,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGBRG8,
++		.depth			= 8,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGBRG8,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		/* 10 bit */
++		.fourcc			= V4L2_PIX_FMT_SRGGB10P,
++		.depth			= 10,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SRGGB10P,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SBGGR10P,
++		.depth			= 10,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SBGGR10P,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGRBG10P,
++		.depth			= 10,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGRBG10P,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGBRG10P,
++		.depth			= 10,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGBRG10P,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		/* 12 bit */
++		.fourcc			= V4L2_PIX_FMT_SRGGB12P,
++		.depth			= 12,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SRGGB12P,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SBGGR12P,
++		.depth			= 12,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SBGGR12P,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGRBG12P,
++		.depth			= 12,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGRBG12P,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGBRG12P,
++		.depth			= 12,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGBRG12P,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		/* 14 bit */
++		.fourcc			= V4L2_PIX_FMT_SRGGB14P,
++		.depth			= 14,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SRGGB14P,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SBGGR14P,
++		.depth			= 14,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SBGGR14P,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGRBG14P,
++		.depth			= 14,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGRBG14P,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGBRG14P,
++		.depth			= 14,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGBRG14P,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		/* 16 bit */
++		.fourcc			= V4L2_PIX_FMT_SRGGB16,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SRGGB16,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SBGGR16,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SBGGR16,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGRBG16,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGRBG16,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGBRG16,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGBRG16,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		/* Bayer formats unpacked to 16bpp */
++		/* 10 bit */
++		.fourcc			= V4L2_PIX_FMT_SRGGB10,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SRGGB10,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SBGGR10,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SBGGR10,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGRBG10,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGRBG10,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGBRG10,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGBRG10,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		/* 12 bit */
++		.fourcc			= V4L2_PIX_FMT_SRGGB12,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SRGGB12,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SBGGR12,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SBGGR12,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGRBG12,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGRBG12,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGBRG12,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGBRG12,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		/* 14 bit */
++		.fourcc			= V4L2_PIX_FMT_SRGGB14,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SRGGB14,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SBGGR14,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SBGGR14,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGRBG14,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGRBG14,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_SGBRG14,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_BAYER_SGBRG14,
++		.size_multiplier_x2	= 2,
++		.is_bayer		= true,
++	}, {
++		/* Monochrome MIPI formats */
++		/* 8 bit */
++		.fourcc			= V4L2_PIX_FMT_GREY,
++		.depth			= 8,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_GREY,
++		.size_multiplier_x2	= 2,
++	}, {
++		/* 10 bit */
++		.fourcc			= V4L2_PIX_FMT_Y10P,
++		.depth			= 10,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_Y10P,
++		.size_multiplier_x2	= 2,
++	}, {
++		/* 12 bit */
++		.fourcc			= V4L2_PIX_FMT_Y12P,
++		.depth			= 12,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_Y12P,
++		.size_multiplier_x2	= 2,
++	}, {
++		/* 14 bit */
++		.fourcc			= V4L2_PIX_FMT_Y14P,
++		.depth			= 14,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_Y14P,
++		.size_multiplier_x2	= 2,
++	}, {
++		/* 16 bit */
++		.fourcc			= V4L2_PIX_FMT_Y16,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_Y16,
++		.size_multiplier_x2	= 2,
++	}, {
++		/* 10 bit as 16bpp */
++		.fourcc			= V4L2_PIX_FMT_Y10,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_Y10,
++		.size_multiplier_x2	= 2,
++	}, {
++		/* 12 bit as 16bpp */
++		.fourcc			= V4L2_PIX_FMT_Y12,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_Y12,
++		.size_multiplier_x2	= 2,
++	}, {
++		/* 14 bit as 16bpp */
++		.fourcc			= V4L2_PIX_FMT_Y14,
++		.depth			= 16,
++		.bytesperline_align	= { 32, 32, 32, 32, 32 },
++		.flags			= 0,
++		.mmal_fmt		= MMAL_ENCODING_Y14,
++		.size_multiplier_x2	= 2,
++	}, {
++		/* Compressed formats */
++		.fourcc			= V4L2_PIX_FMT_H264,
++		.depth			= 0,
++		.flags			= V4L2_FMT_FLAG_COMPRESSED,
++		.mmal_fmt		= MMAL_ENCODING_H264,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_JPEG,
++		.depth			= 0,
++		.flags			= V4L2_FMT_FLAG_COMPRESSED,
++		.mmal_fmt		= MMAL_ENCODING_JPEG,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_MJPEG,
++		.depth			= 0,
++		.flags			= V4L2_FMT_FLAG_COMPRESSED,
++		.mmal_fmt		= MMAL_ENCODING_MJPEG,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_MPEG4,
++		.depth			= 0,
++		.flags			= V4L2_FMT_FLAG_COMPRESSED,
++		.mmal_fmt		= MMAL_ENCODING_MP4V,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_H263,
++		.depth			= 0,
++		.flags			= V4L2_FMT_FLAG_COMPRESSED,
++		.mmal_fmt		= MMAL_ENCODING_H263,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_MPEG2,
++		.depth			= 0,
++		.flags			= V4L2_FMT_FLAG_COMPRESSED,
++		.mmal_fmt		= MMAL_ENCODING_MP2V,
++	}, {
++		.fourcc			= V4L2_PIX_FMT_VC1_ANNEX_G,
++		.depth			= 0,
++		.flags			= V4L2_FMT_FLAG_COMPRESSED,
++		.mmal_fmt		= MMAL_ENCODING_WVC1,
++	}
++};
++
++struct bcm2835_codec_fmt_list {
++	struct bcm2835_codec_fmt *list;
++	unsigned int num_entries;
++};
++
++struct m2m_mmal_buffer {
++	struct v4l2_m2m_buffer	m2m;
++	struct mmal_buffer	mmal;
++};
++
++/* Per-queue, driver-specific private data */
++struct bcm2835_codec_q_data {
++	/*
++	 * These parameters should be treated as gospel, with everything else
++	 * being determined from them.
++	 */
++	/* Buffer width/height */
++	unsigned int		bytesperline;
++	unsigned int		height;
++	/* Crop size used for selection handling */
++	unsigned int		crop_width;
++	unsigned int		crop_height;
++	bool			selection_set;
++	struct v4l2_fract	aspect_ratio;
++	enum v4l2_field		field;
++
++	unsigned int		sizeimage;
++	unsigned int		sequence;
++	struct bcm2835_codec_fmt	*fmt;
++
++	/* One extra buffer header so we can send an EOS. */
++	struct m2m_mmal_buffer	eos_buffer;
++	bool			eos_buffer_in_use;	/* debug only */
++};
++
++struct bcm2835_codec_dev {
++	struct vchiq_device    *device;
++
++	/* v4l2 devices */
++	struct v4l2_device	v4l2_dev;
++	struct video_device	vfd;
++	/* mutex for the v4l2 device */
++	struct mutex		dev_mutex;
++	atomic_t		num_inst;
++
++	/* allocated mmal instance and components */
++	enum bcm2835_codec_role	role;
++	/* The list of formats supported on input and output queues. */
++	struct bcm2835_codec_fmt_list	supported_fmts[2];
++
++	/*
++	 * Max size supported varies based on role. Store during
++	 * bcm2835_codec_create for use later.
++	 */
++	unsigned int max_w;
++	unsigned int max_h;
++
++	struct vchiq_mmal_instance	*instance;
++
++	struct v4l2_m2m_dev	*m2m_dev;
++};
++
++struct bcm2835_codec_ctx {
++	struct v4l2_fh		fh;
++	struct bcm2835_codec_dev	*dev;
++
++	struct v4l2_ctrl_handler hdl;
++	struct v4l2_ctrl *gop_size;
++
++	struct vchiq_mmal_component  *component;
++	bool component_enabled;
++
++	enum v4l2_colorspace	colorspace;
++	enum v4l2_ycbcr_encoding ycbcr_enc;
++	enum v4l2_xfer_func	xfer_func;
++	enum v4l2_quantization	quant;
++
++	int hflip;
++	int vflip;
++
++	/* Source and destination queue data */
++	struct bcm2835_codec_q_data   q_data[2];
++	s32  bitrate;
++	unsigned int	framerate_num;
++	unsigned int	framerate_denom;
++
++	bool aborting;
++	int num_ip_buffers;
++	int num_op_buffers;
++	struct completion frame_cmplt;
++};
++
++struct bcm2835_codec_driver {
++	struct vchiq_device    *device;
++	struct media_device	mdev;
++
++	struct bcm2835_codec_dev *encode;
++	struct bcm2835_codec_dev *decode;
++	struct bcm2835_codec_dev *isp;
++	struct bcm2835_codec_dev *deinterlace;
++	struct bcm2835_codec_dev *encode_image;
++};
++
++enum {
++	V4L2_M2M_SRC = 0,
++	V4L2_M2M_DST = 1,
++};
++
++static const struct bcm2835_codec_fmt *get_fmt(u32 mmal_fmt)
++{
++	unsigned int i;
++
++	for (i = 0; i < ARRAY_SIZE(supported_formats); i++) {
++		if (supported_formats[i].mmal_fmt == mmal_fmt &&
++		    (!disable_bayer || !supported_formats[i].is_bayer))
++			return &supported_formats[i];
++	}
++	return NULL;
++}
++
++static inline
++struct bcm2835_codec_fmt_list *get_format_list(struct bcm2835_codec_dev *dev,
++					       bool capture)
++{
++	return &dev->supported_fmts[capture ? 1 : 0];
++}
++
++static
++struct bcm2835_codec_fmt *get_default_format(struct bcm2835_codec_dev *dev,
++					     bool capture)
++{
++	return &dev->supported_fmts[capture ? 1 : 0].list[0];
++}
++
++static
++struct bcm2835_codec_fmt *find_format_pix_fmt(u32 pix_fmt,
++					      struct bcm2835_codec_dev *dev,
++					      bool capture)
++{
++	struct bcm2835_codec_fmt *fmt;
++	unsigned int k;
++	struct bcm2835_codec_fmt_list *fmts =
++					&dev->supported_fmts[capture ? 1 : 0];
++
++	for (k = 0; k < fmts->num_entries; k++) {
++		fmt = &fmts->list[k];
++		if (fmt->fourcc == pix_fmt)
++			break;
++	}
++	if (k == fmts->num_entries)
++		return NULL;
++
++	return &fmts->list[k];
++}
++
++static inline
++struct bcm2835_codec_fmt *find_format(struct v4l2_format *f,
++				      struct bcm2835_codec_dev *dev,
++				      bool capture)
++{
++	return find_format_pix_fmt(f->fmt.pix_mp.pixelformat, dev, capture);
++}
++
++static inline struct bcm2835_codec_ctx *file2ctx(struct file *file)
++{
++	return container_of(file->private_data, struct bcm2835_codec_ctx, fh);
++}
++
++static struct bcm2835_codec_q_data *get_q_data(struct bcm2835_codec_ctx *ctx,
++					       enum v4l2_buf_type type)
++{
++	switch (type) {
++	case V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE:
++		return &ctx->q_data[V4L2_M2M_SRC];
++	case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE:
++		return &ctx->q_data[V4L2_M2M_DST];
++	default:
++		v4l2_err(&ctx->dev->v4l2_dev, "%s: Invalid queue type %u\n",
++			 __func__, type);
++		break;
++	}
++	return NULL;
++}
++
++static struct vchiq_mmal_port *get_port_data(struct bcm2835_codec_ctx *ctx,
++					     enum v4l2_buf_type type)
++{
++	if (!ctx->component)
++		return NULL;
++
++	switch (type) {
++	case V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE:
++		return &ctx->component->input[0];
++	case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE:
++		return &ctx->component->output[0];
++	default:
++		v4l2_err(&ctx->dev->v4l2_dev, "%s: Invalid queue type %u\n",
++			 __func__, type);
++		break;
++	}
++	return NULL;
++}
++
++/*
++ * mem2mem callbacks
++ */
++
++/*
++ * job_ready() - check whether an instance is ready to be scheduled to run
++ */
++static int job_ready(void *priv)
++{
++	struct bcm2835_codec_ctx *ctx = priv;
++
++	if (!v4l2_m2m_num_src_bufs_ready(ctx->fh.m2m_ctx) &&
++	    !v4l2_m2m_num_dst_bufs_ready(ctx->fh.m2m_ctx))
++		return 0;
++
++	return 1;
++}
++
++static void job_abort(void *priv)
++{
++	struct bcm2835_codec_ctx *ctx = priv;
++
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s\n", __func__);
++	/* Will cancel the transaction in the next interrupt handler */
++	ctx->aborting = 1;
++}
++
++static inline unsigned int get_sizeimage(int bpl, int width, int height,
++					 struct bcm2835_codec_fmt *fmt)
++{
++	if (fmt->flags & V4L2_FMT_FLAG_COMPRESSED) {
++		if (fmt->fourcc == V4L2_PIX_FMT_JPEG)
++			return DEF_COMP_BUF_SIZE_JPEG;
++
++		if (width * height > 1280 * 720)
++			return DEF_COMP_BUF_SIZE_GREATER_720P;
++		else
++			return DEF_COMP_BUF_SIZE_720P_OR_LESS;
++	}
++
++	if (fmt->fourcc != V4L2_PIX_FMT_NV12_COL128)
++		return (bpl * height * fmt->size_multiplier_x2) >> 1;
++
++	/*
++	 * V4L2_PIX_FMT_NV12_COL128 is 128 pixel wide columns.
++	 * bytesperline is the column stride in lines, so multiply by
++	 * the number of columns and 128.
++	 */
++	return (ALIGN(width, 128) * bpl);
++}
++
++static inline unsigned int get_bytesperline(int width, int height,
++					    struct bcm2835_codec_fmt *fmt,
++					    enum bcm2835_codec_role role)
++{
++	if (fmt->fourcc != V4L2_PIX_FMT_NV12_COL128)
++		return ALIGN((width * fmt->depth) >> 3,
++			     fmt->bytesperline_align[role]);
++
++	/*
++	 * V4L2_PIX_FMT_NV12_COL128 passes the column stride in lines via
++	 * bytesperline.
++	 * The minimum value for this is sufficient for the base luma and chroma
++	 * with no padding.
++	 */
++	return (height * 3) >> 1;
++}
++
++static void setup_mmal_port_format(struct bcm2835_codec_ctx *ctx,
++				   struct bcm2835_codec_q_data *q_data,
++				   struct vchiq_mmal_port *port)
++{
++	port->format.encoding = q_data->fmt->mmal_fmt;
++	port->format.flags = 0;
++
++	if (!(q_data->fmt->flags & V4L2_FMT_FLAG_COMPRESSED)) {
++		if (q_data->fmt->mmal_fmt != MMAL_ENCODING_YUVUV128) {
++			/* Raw image format - set width/height */
++			port->es.video.width = (q_data->bytesperline << 3) /
++							q_data->fmt->depth;
++			port->es.video.height = q_data->height;
++			port->es.video.crop.width = q_data->crop_width;
++			port->es.video.crop.height = q_data->crop_height;
++		} else {
++			/* NV12_COL128 / YUVUV128 column format */
++			/* Column stride in lines */
++			port->es.video.width = q_data->bytesperline;
++			port->es.video.height = q_data->height;
++			port->es.video.crop.width = q_data->crop_width;
++			port->es.video.crop.height = q_data->crop_height;
++			port->format.flags = MMAL_ES_FORMAT_FLAG_COL_FMTS_WIDTH_IS_COL_STRIDE;
++		}
++		port->es.video.frame_rate.numerator = ctx->framerate_num;
++		port->es.video.frame_rate.denominator = ctx->framerate_denom;
++	} else {
++		/* Compressed format - leave resolution as 0 for decode */
++		if (ctx->dev->role == DECODE) {
++			port->es.video.width = 0;
++			port->es.video.height = 0;
++			port->es.video.crop.width = 0;
++			port->es.video.crop.height = 0;
++		} else {
++			port->es.video.width = q_data->crop_width;
++			port->es.video.height = q_data->height;
++			port->es.video.crop.width = q_data->crop_width;
++			port->es.video.crop.height = q_data->crop_height;
++			port->format.bitrate = ctx->bitrate;
++			port->es.video.frame_rate.numerator = ctx->framerate_num;
++			port->es.video.frame_rate.denominator = ctx->framerate_denom;
++		}
++	}
++	port->es.video.crop.x = 0;
++	port->es.video.crop.y = 0;
++
++	port->current_buffer.size = q_data->sizeimage;
++};
++
++static void ip_buffer_cb(struct vchiq_mmal_instance *instance,
++			 struct vchiq_mmal_port *port, int status,
++			 struct mmal_buffer *mmal_buf)
++{
++	struct bcm2835_codec_ctx *ctx = port->cb_ctx/*, *curr_ctx*/;
++	struct m2m_mmal_buffer *buf =
++			container_of(mmal_buf, struct m2m_mmal_buffer, mmal);
++
++	v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s: port %p buf %p length %lu, flags %x\n",
++		 __func__, port, mmal_buf, mmal_buf->length,
++		 mmal_buf->mmal_flags);
++
++	if (buf == &ctx->q_data[V4L2_M2M_SRC].eos_buffer) {
++		/* Do we need to add lcoking to prevent multiple submission of
++		 * the EOS, and therefore handle mutliple return here?
++		 */
++		v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: eos buffer returned.\n",
++			 __func__);
++		ctx->q_data[V4L2_M2M_SRC].eos_buffer_in_use = false;
++		return;
++	}
++
++	if (status) {
++		/* error in transfer */
++		if (buf)
++			/* there was a buffer with the error so return it */
++			vb2_buffer_done(&buf->m2m.vb.vb2_buf,
++					VB2_BUF_STATE_ERROR);
++		return;
++	}
++	if (mmal_buf->cmd) {
++		v4l2_err(&ctx->dev->v4l2_dev, "%s: Not expecting cmd msgs on ip callback - %08x\n",
++			 __func__, mmal_buf->cmd);
++		/*
++		 * CHECKME: Should we return here. The buffer shouldn't have a
++		 * message context or vb2 buf associated.
++		 */
++	}
++
++	v4l2_dbg(3, debug, &ctx->dev->v4l2_dev, "%s: no error. Return buffer %p\n",
++		 __func__, &buf->m2m.vb.vb2_buf);
++	vb2_buffer_done(&buf->m2m.vb.vb2_buf,
++			port->enabled ? VB2_BUF_STATE_DONE :
++					VB2_BUF_STATE_QUEUED);
++
++	ctx->num_ip_buffers++;
++	v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s: done %d input buffers\n",
++		 __func__, ctx->num_ip_buffers);
++
++	if (!port->enabled && atomic_read(&port->buffers_with_vpu))
++		complete(&ctx->frame_cmplt);
++}
++
++static void queue_res_chg_event(struct bcm2835_codec_ctx *ctx)
++{
++	static const struct v4l2_event ev_src_ch = {
++		.type = V4L2_EVENT_SOURCE_CHANGE,
++		.u.src_change.changes =
++		V4L2_EVENT_SRC_CH_RESOLUTION,
++	};
++
++	v4l2_event_queue_fh(&ctx->fh, &ev_src_ch);
++}
++
++static void send_eos_event(struct bcm2835_codec_ctx *ctx)
++{
++	static const struct v4l2_event ev = {
++		.type = V4L2_EVENT_EOS,
++	};
++
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "Sending EOS event\n");
++
++	v4l2_event_queue_fh(&ctx->fh, &ev);
++}
++
++static void color_mmal2v4l(struct bcm2835_codec_ctx *ctx, u32 encoding,
++			   u32 color_space)
++{
++	int is_rgb;
++
++	switch (encoding) {
++	case MMAL_ENCODING_I420:
++	case MMAL_ENCODING_YV12:
++	case MMAL_ENCODING_NV12:
++	case MMAL_ENCODING_NV21:
++	case V4L2_PIX_FMT_YUYV:
++	case V4L2_PIX_FMT_YVYU:
++	case V4L2_PIX_FMT_UYVY:
++	case V4L2_PIX_FMT_VYUY:
++		/* YUV based colourspaces */
++		switch (color_space) {
++		case MMAL_COLOR_SPACE_ITUR_BT601:
++			ctx->colorspace = V4L2_COLORSPACE_SMPTE170M;
++			break;
++
++		case MMAL_COLOR_SPACE_ITUR_BT709:
++			ctx->colorspace = V4L2_COLORSPACE_REC709;
++			break;
++		default:
++			break;
++		}
++		break;
++	default:
++		/* RGB based colourspaces */
++		ctx->colorspace = V4L2_COLORSPACE_SRGB;
++		break;
++	}
++	ctx->xfer_func = V4L2_MAP_XFER_FUNC_DEFAULT(ctx->colorspace);
++	ctx->ycbcr_enc = V4L2_MAP_YCBCR_ENC_DEFAULT(ctx->colorspace);
++	is_rgb = ctx->colorspace == V4L2_COLORSPACE_SRGB;
++	ctx->quant = V4L2_MAP_QUANTIZATION_DEFAULT(is_rgb, ctx->colorspace,
++						   ctx->ycbcr_enc);
++}
++
++static void handle_fmt_changed(struct bcm2835_codec_ctx *ctx,
++			       struct mmal_buffer *mmal_buf)
++{
++	struct bcm2835_codec_q_data *q_data;
++	struct mmal_msg_event_format_changed *format =
++		(struct mmal_msg_event_format_changed *)mmal_buf->buffer;
++	struct mmal_parameter_video_interlace_type interlace;
++	int interlace_size = sizeof(interlace);
++	struct vb2_queue *vq;
++	int ret;
++
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: Format changed: buff size min %u, rec %u, buff num min %u, rec %u\n",
++		 __func__,
++		 format->buffer_size_min,
++		 format->buffer_size_recommended,
++		 format->buffer_num_min,
++		 format->buffer_num_recommended
++		);
++	if (format->format.type != MMAL_ES_TYPE_VIDEO) {
++		v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: Format changed but not video %u\n",
++			 __func__, format->format.type);
++		return;
++	}
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: Format changed to %ux%u, crop %ux%u, colourspace %08X\n",
++		 __func__, format->es.video.width, format->es.video.height,
++		 format->es.video.crop.width, format->es.video.crop.height,
++		 format->es.video.color_space);
++
++	q_data = get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: Format was %ux%u, crop %ux%u\n",
++		 __func__, q_data->bytesperline, q_data->height,
++		 q_data->crop_width, q_data->crop_height);
++
++	q_data->crop_width = format->es.video.crop.width;
++	q_data->crop_height = format->es.video.crop.height;
++	/*
++	 * Stop S_FMT updating crop_height should it be unaligned.
++	 * Client can still update the crop region via S_SELECTION should it
++	 * really want to, but the decoder is likely to complain that the
++	 * format then doesn't match.
++	 */
++	q_data->selection_set = true;
++	q_data->bytesperline = get_bytesperline(format->es.video.width,
++						format->es.video.height,
++						q_data->fmt, ctx->dev->role);
++
++	q_data->height = format->es.video.height;
++	q_data->sizeimage = format->buffer_size_min;
++	if (format->es.video.color_space)
++		color_mmal2v4l(ctx, format->format.encoding,
++			       format->es.video.color_space);
++
++	q_data->aspect_ratio.numerator = format->es.video.par.numerator;
++	q_data->aspect_ratio.denominator = format->es.video.par.denominator;
++
++	ret = vchiq_mmal_port_parameter_get(ctx->dev->instance,
++					    &ctx->component->output[0],
++					    MMAL_PARAMETER_VIDEO_INTERLACE_TYPE,
++					    &interlace,
++					    &interlace_size);
++	if (!ret) {
++		switch (interlace.mode) {
++		case MMAL_INTERLACE_PROGRESSIVE:
++		default:
++			q_data->field = V4L2_FIELD_NONE;
++			break;
++		case MMAL_INTERLACE_FIELDS_INTERLEAVED_UPPER_FIRST:
++			q_data->field = V4L2_FIELD_INTERLACED_TB;
++			break;
++		case MMAL_INTERLACE_FIELDS_INTERLEAVED_LOWER_FIRST:
++			q_data->field = V4L2_FIELD_INTERLACED_BT;
++			break;
++		}
++		v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: interlace mode %u, v4l2 field %u\n",
++			 __func__, interlace.mode, q_data->field);
++	} else {
++		q_data->field = V4L2_FIELD_NONE;
++	}
++
++	vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
++	if (vq->streaming)
++		vq->last_buffer_dequeued = true;
++
++	queue_res_chg_event(ctx);
++}
++
++static void op_buffer_cb(struct vchiq_mmal_instance *instance,
++			 struct vchiq_mmal_port *port, int status,
++			 struct mmal_buffer *mmal_buf)
++{
++	struct bcm2835_codec_ctx *ctx = port->cb_ctx;
++	enum vb2_buffer_state buf_state = VB2_BUF_STATE_DONE;
++	struct m2m_mmal_buffer *buf;
++	struct vb2_v4l2_buffer *vb2;
++
++	v4l2_dbg(2, debug, &ctx->dev->v4l2_dev,
++		 "%s: status:%d, buf:%p, length:%lu, flags %04x, pts %lld\n",
++		 __func__, status, mmal_buf, mmal_buf->length,
++		 mmal_buf->mmal_flags, mmal_buf->pts);
++
++	buf = container_of(mmal_buf, struct m2m_mmal_buffer, mmal);
++	vb2 = &buf->m2m.vb;
++
++	if (status) {
++		/* error in transfer */
++		if (vb2) {
++			/* there was a buffer with the error so return it */
++			vb2_buffer_done(&vb2->vb2_buf, VB2_BUF_STATE_ERROR);
++		}
++		return;
++	}
++
++	if (mmal_buf->cmd) {
++		switch (mmal_buf->cmd) {
++		case MMAL_EVENT_FORMAT_CHANGED:
++		{
++			handle_fmt_changed(ctx, mmal_buf);
++			break;
++		}
++		default:
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: Unexpected event on output callback - %08x\n",
++				 __func__, mmal_buf->cmd);
++			break;
++		}
++		return;
++	}
++
++	v4l2_dbg(3, debug, &ctx->dev->v4l2_dev, "%s: length %lu, flags %x, idx %u\n",
++		 __func__, mmal_buf->length, mmal_buf->mmal_flags,
++		 vb2->vb2_buf.index);
++
++	if (mmal_buf->length == 0) {
++		/* stream ended, or buffer being returned during disable. */
++		v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s: Empty buffer - flags %04x",
++			 __func__, mmal_buf->mmal_flags);
++		if (!(mmal_buf->mmal_flags & MMAL_BUFFER_HEADER_FLAG_EOS)) {
++			if (!port->enabled) {
++				vb2_buffer_done(&vb2->vb2_buf, VB2_BUF_STATE_QUEUED);
++				if (atomic_read(&port->buffers_with_vpu))
++					complete(&ctx->frame_cmplt);
++			} else {
++				vchiq_mmal_submit_buffer(ctx->dev->instance,
++							 &ctx->component->output[0],
++							 mmal_buf);
++			}
++			return;
++		}
++	}
++	if (mmal_buf->mmal_flags & MMAL_BUFFER_HEADER_FLAG_EOS) {
++		/* EOS packet from the VPU */
++		send_eos_event(ctx);
++		vb2->flags |= V4L2_BUF_FLAG_LAST;
++	}
++
++	if (mmal_buf->mmal_flags & MMAL_BUFFER_HEADER_FLAG_CORRUPTED)
++		buf_state = VB2_BUF_STATE_ERROR;
++
++	/* vb2 timestamps in nsecs, mmal in usecs */
++	vb2->vb2_buf.timestamp = mmal_buf->pts * 1000;
++
++	vb2_set_plane_payload(&vb2->vb2_buf, 0, mmal_buf->length);
++	switch (mmal_buf->mmal_flags &
++				(MMAL_BUFFER_HEADER_VIDEO_FLAG_INTERLACED |
++				 MMAL_BUFFER_HEADER_VIDEO_FLAG_TOP_FIELD_FIRST)) {
++	case 0:
++	case MMAL_BUFFER_HEADER_VIDEO_FLAG_TOP_FIELD_FIRST: /* Bogus */
++		vb2->field = V4L2_FIELD_NONE;
++		break;
++	case MMAL_BUFFER_HEADER_VIDEO_FLAG_INTERLACED:
++		vb2->field = V4L2_FIELD_INTERLACED_BT;
++		break;
++	case (MMAL_BUFFER_HEADER_VIDEO_FLAG_INTERLACED |
++	      MMAL_BUFFER_HEADER_VIDEO_FLAG_TOP_FIELD_FIRST):
++		vb2->field = V4L2_FIELD_INTERLACED_TB;
++		break;
++	}
++
++	if (mmal_buf->mmal_flags & MMAL_BUFFER_HEADER_FLAG_KEYFRAME)
++		vb2->flags |= V4L2_BUF_FLAG_KEYFRAME;
++
++	vb2_buffer_done(&vb2->vb2_buf, buf_state);
++	ctx->num_op_buffers++;
++
++	v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s: done %d output buffers\n",
++		 __func__, ctx->num_op_buffers);
++
++	if (!port->enabled && atomic_read(&port->buffers_with_vpu))
++		complete(&ctx->frame_cmplt);
++}
++
++/* vb2_to_mmal_buffer() - converts vb2 buffer header to MMAL
++ *
++ * Copies all the required fields from a VB2 buffer to the MMAL buffer header,
++ * ready for sending to the VPU.
++ */
++static void vb2_to_mmal_buffer(struct m2m_mmal_buffer *buf,
++			       struct vb2_v4l2_buffer *vb2)
++{
++	u64 pts;
++
++	buf->mmal.mmal_flags = 0;
++	if (vb2->flags & V4L2_BUF_FLAG_KEYFRAME)
++		buf->mmal.mmal_flags |= MMAL_BUFFER_HEADER_FLAG_KEYFRAME;
++
++	/*
++	 * Adding this means that the data must be framed correctly as one frame
++	 * per buffer. The underlying decoder has no such requirement, but it
++	 * will reduce latency as the bistream parser will be kicked immediately
++	 * to parse the frame, rather than relying on its own heuristics for
++	 * when to wake up.
++	 */
++	buf->mmal.mmal_flags |= MMAL_BUFFER_HEADER_FLAG_FRAME_END;
++
++	buf->mmal.length = vb2->vb2_buf.planes[0].bytesused;
++	/*
++	 * Minor ambiguity in the V4L2 spec as to whether passing in a 0 length
++	 * buffer, or one with V4L2_BUF_FLAG_LAST set denotes end of stream.
++	 * Handle either.
++	 */
++	if (!buf->mmal.length || vb2->flags & V4L2_BUF_FLAG_LAST)
++		buf->mmal.mmal_flags |= MMAL_BUFFER_HEADER_FLAG_EOS;
++
++	/* vb2 timestamps in nsecs, mmal in usecs */
++	pts = vb2->vb2_buf.timestamp;
++	do_div(pts, 1000);
++	buf->mmal.pts = pts;
++	buf->mmal.dts = MMAL_TIME_UNKNOWN;
++
++	switch (field_override ? field_override : vb2->field) {
++	default:
++	case V4L2_FIELD_NONE:
++		break;
++	case V4L2_FIELD_INTERLACED_BT:
++		buf->mmal.mmal_flags |= MMAL_BUFFER_HEADER_VIDEO_FLAG_INTERLACED;
++		break;
++	case V4L2_FIELD_INTERLACED_TB:
++		buf->mmal.mmal_flags |= MMAL_BUFFER_HEADER_VIDEO_FLAG_INTERLACED |
++					MMAL_BUFFER_HEADER_VIDEO_FLAG_TOP_FIELD_FIRST;
++		break;
++	}
++}
++
++/* device_run() - prepares and starts the device
++ *
++ * This simulates all the immediate preparations required before starting
++ * a device. This will be called by the framework when it decides to schedule
++ * a particular instance.
++ */
++static void device_run(void *priv)
++{
++	struct bcm2835_codec_ctx *ctx = priv;
++	struct bcm2835_codec_dev *dev = ctx->dev;
++	struct vb2_v4l2_buffer *src_buf, *dst_buf;
++	struct m2m_mmal_buffer *src_m2m_buf = NULL, *dst_m2m_buf = NULL;
++	struct v4l2_m2m_buffer *m2m;
++	int ret;
++
++	v4l2_dbg(3, debug, &ctx->dev->v4l2_dev, "%s: off we go\n", __func__);
++
++	if (ctx->fh.m2m_ctx->out_q_ctx.q.streaming) {
++		src_buf = v4l2_m2m_buf_remove(&ctx->fh.m2m_ctx->out_q_ctx);
++		if (src_buf) {
++			m2m = container_of(src_buf, struct v4l2_m2m_buffer, vb);
++			src_m2m_buf = container_of(m2m, struct m2m_mmal_buffer,
++						   m2m);
++			vb2_to_mmal_buffer(src_m2m_buf, src_buf);
++
++			ret = vchiq_mmal_submit_buffer(dev->instance,
++						       &ctx->component->input[0],
++						       &src_m2m_buf->mmal);
++			v4l2_dbg(3, debug, &ctx->dev->v4l2_dev,
++				 "%s: Submitted ip buffer len %lu, pts %llu, flags %04x\n",
++				 __func__, src_m2m_buf->mmal.length,
++				 src_m2m_buf->mmal.pts,
++				 src_m2m_buf->mmal.mmal_flags);
++			if (ret)
++				v4l2_err(&ctx->dev->v4l2_dev,
++					 "%s: Failed submitting ip buffer\n",
++					 __func__);
++		}
++	}
++
++	if (ctx->fh.m2m_ctx->cap_q_ctx.q.streaming) {
++		dst_buf = v4l2_m2m_buf_remove(&ctx->fh.m2m_ctx->cap_q_ctx);
++		if (dst_buf) {
++			m2m = container_of(dst_buf, struct v4l2_m2m_buffer, vb);
++			dst_m2m_buf = container_of(m2m, struct m2m_mmal_buffer,
++						   m2m);
++			vb2_to_mmal_buffer(dst_m2m_buf, dst_buf);
++
++			v4l2_dbg(3, debug, &ctx->dev->v4l2_dev,
++				 "%s: Submitted op buffer\n", __func__);
++			ret = vchiq_mmal_submit_buffer(dev->instance,
++						       &ctx->component->output[0],
++						       &dst_m2m_buf->mmal);
++			if (ret)
++				v4l2_err(&ctx->dev->v4l2_dev,
++					 "%s: Failed submitting op buffer\n",
++					 __func__);
++		}
++	}
++
++	v4l2_dbg(3, debug, &ctx->dev->v4l2_dev, "%s: Submitted src %p, dst %p\n",
++		 __func__, src_m2m_buf, dst_m2m_buf);
++
++	/* Complete the job here. */
++	v4l2_m2m_job_finish(ctx->dev->m2m_dev, ctx->fh.m2m_ctx);
++}
++
++/*
++ * video ioctls
++ */
++static int vidioc_querycap(struct file *file, void *priv,
++			   struct v4l2_capability *cap)
++{
++	struct bcm2835_codec_dev *dev = video_drvdata(file);
++
++	strncpy(cap->driver, MEM2MEM_NAME, sizeof(cap->driver) - 1);
++	strncpy(cap->card, dev->vfd.name, sizeof(cap->card) - 1);
++	snprintf(cap->bus_info, sizeof(cap->bus_info), "platform:%s",
++		 MEM2MEM_NAME);
++	return 0;
++}
++
++static int enum_fmt(struct v4l2_fmtdesc *f, struct bcm2835_codec_ctx *ctx,
++		    bool capture)
++{
++	struct bcm2835_codec_fmt *fmt;
++	struct bcm2835_codec_fmt_list *fmts =
++					get_format_list(ctx->dev, capture);
++
++	if (f->index < fmts->num_entries) {
++		/* Format found */
++		fmt = &fmts->list[f->index];
++		f->pixelformat = fmt->fourcc;
++		f->flags = fmt->flags;
++		return 0;
++	}
++
++	/* Format not found */
++	return -EINVAL;
++}
++
++static int vidioc_enum_fmt_vid_cap(struct file *file, void *priv,
++				   struct v4l2_fmtdesc *f)
++{
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++
++	return enum_fmt(f, ctx, true);
++}
++
++static int vidioc_enum_fmt_vid_out(struct file *file, void *priv,
++				   struct v4l2_fmtdesc *f)
++{
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++
++	return enum_fmt(f, ctx, false);
++}
++
++static int vidioc_g_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f)
++{
++	struct vb2_queue *vq;
++	struct bcm2835_codec_q_data *q_data;
++
++	vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, f->type);
++	if (!vq)
++		return -EINVAL;
++
++	q_data = get_q_data(ctx, f->type);
++
++	f->fmt.pix_mp.width			= q_data->crop_width;
++	f->fmt.pix_mp.height			= q_data->height;
++	f->fmt.pix_mp.pixelformat		= q_data->fmt->fourcc;
++	f->fmt.pix_mp.field			= q_data->field;
++	f->fmt.pix_mp.colorspace		= ctx->colorspace;
++	f->fmt.pix_mp.plane_fmt[0].sizeimage	= q_data->sizeimage;
++	f->fmt.pix_mp.plane_fmt[0].bytesperline	= q_data->bytesperline;
++	f->fmt.pix_mp.num_planes		= 1;
++	f->fmt.pix_mp.ycbcr_enc			= ctx->ycbcr_enc;
++	f->fmt.pix_mp.quantization		= ctx->quant;
++	f->fmt.pix_mp.xfer_func			= ctx->xfer_func;
++
++	memset(f->fmt.pix_mp.plane_fmt[0].reserved, 0,
++	       sizeof(f->fmt.pix_mp.plane_fmt[0].reserved));
++
++	return 0;
++}
++
++static int vidioc_g_fmt_vid_out(struct file *file, void *priv,
++				struct v4l2_format *f)
++{
++	return vidioc_g_fmt(file2ctx(file), f);
++}
++
++static int vidioc_g_fmt_vid_cap(struct file *file, void *priv,
++				struct v4l2_format *f)
++{
++	return vidioc_g_fmt(file2ctx(file), f);
++}
++
++static int vidioc_try_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f,
++			  struct bcm2835_codec_fmt *fmt)
++{
++	unsigned int sizeimage, min_bytesperline;
++
++	/*
++	 * The V4L2 specification requires the driver to correct the format
++	 * struct if any of the dimensions is unsupported
++	 */
++	if (f->fmt.pix_mp.width > ctx->dev->max_w)
++		f->fmt.pix_mp.width = ctx->dev->max_w;
++	if (f->fmt.pix_mp.height > ctx->dev->max_h)
++		f->fmt.pix_mp.height = ctx->dev->max_h;
++
++	if (!(fmt->flags & V4L2_FMT_FLAG_COMPRESSED)) {
++		/* Only clip min w/h on capture. Treat 0x0 as unknown. */
++		if (f->fmt.pix_mp.width < MIN_W)
++			f->fmt.pix_mp.width = MIN_W;
++		if (f->fmt.pix_mp.height < MIN_H)
++			f->fmt.pix_mp.height = MIN_H;
++
++		/*
++		 * For decoders and image encoders the buffer must have
++		 * a vertical alignment of 16 lines.
++		 * The selection will reflect any cropping rectangle when only
++		 * some of the pixels are active.
++		 */
++		if (ctx->dev->role == DECODE || ctx->dev->role == ENCODE_IMAGE)
++			f->fmt.pix_mp.height = ALIGN(f->fmt.pix_mp.height, 16);
++	}
++	f->fmt.pix_mp.num_planes = 1;
++	min_bytesperline = get_bytesperline(f->fmt.pix_mp.width,
++					    f->fmt.pix_mp.height,
++					    fmt, ctx->dev->role);
++	if (f->fmt.pix_mp.plane_fmt[0].bytesperline < min_bytesperline)
++		f->fmt.pix_mp.plane_fmt[0].bytesperline = min_bytesperline;
++	f->fmt.pix_mp.plane_fmt[0].bytesperline =
++		ALIGN(f->fmt.pix_mp.plane_fmt[0].bytesperline,
++		      fmt->bytesperline_align[ctx->dev->role]);
++
++	sizeimage = get_sizeimage(f->fmt.pix_mp.plane_fmt[0].bytesperline,
++				  f->fmt.pix_mp.width, f->fmt.pix_mp.height,
++				  fmt);
++	/*
++	 * Drivers must set sizeimage for uncompressed formats
++	 * Compressed formats allow the client to request an alternate
++	 * size for the buffer.
++	 */
++	if (!(fmt->flags & V4L2_FMT_FLAG_COMPRESSED) ||
++	    f->fmt.pix_mp.plane_fmt[0].sizeimage < sizeimage)
++		f->fmt.pix_mp.plane_fmt[0].sizeimage = sizeimage;
++
++	memset(f->fmt.pix_mp.plane_fmt[0].reserved, 0,
++	       sizeof(f->fmt.pix_mp.plane_fmt[0].reserved));
++
++	if (ctx->dev->role == DECODE || ctx->dev->role == DEINTERLACE) {
++		switch (f->fmt.pix_mp.field) {
++		/*
++		 * All of this is pretty much guesswork as we'll set the
++		 * interlace format correctly come format changed, and signal
++		 * it appropriately on each buffer.
++		 */
++		default:
++		case V4L2_FIELD_NONE:
++		case V4L2_FIELD_ANY:
++			f->fmt.pix_mp.field = V4L2_FIELD_NONE;
++			break;
++		case V4L2_FIELD_INTERLACED:
++			f->fmt.pix_mp.field = V4L2_FIELD_INTERLACED;
++			break;
++		case V4L2_FIELD_TOP:
++		case V4L2_FIELD_BOTTOM:
++		case V4L2_FIELD_INTERLACED_TB:
++			f->fmt.pix_mp.field = V4L2_FIELD_INTERLACED_TB;
++			break;
++		case V4L2_FIELD_INTERLACED_BT:
++			f->fmt.pix_mp.field = V4L2_FIELD_INTERLACED_BT;
++			break;
++		}
++	} else {
++		f->fmt.pix_mp.field = V4L2_FIELD_NONE;
++	}
++
++	return 0;
++}
++
++static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
++				  struct v4l2_format *f)
++{
++	struct bcm2835_codec_fmt *fmt;
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++
++	fmt = find_format(f, ctx->dev, true);
++	if (!fmt) {
++		f->fmt.pix_mp.pixelformat = get_default_format(ctx->dev,
++							       true)->fourcc;
++		fmt = find_format(f, ctx->dev, true);
++	}
++
++	return vidioc_try_fmt(ctx, f, fmt);
++}
++
++static int vidioc_try_fmt_vid_out(struct file *file, void *priv,
++				  struct v4l2_format *f)
++{
++	struct bcm2835_codec_fmt *fmt;
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++
++	fmt = find_format(f, ctx->dev, false);
++	if (!fmt) {
++		f->fmt.pix_mp.pixelformat = get_default_format(ctx->dev,
++							       false)->fourcc;
++		fmt = find_format(f, ctx->dev, false);
++	}
++
++	if (!f->fmt.pix_mp.colorspace)
++		f->fmt.pix_mp.colorspace = ctx->colorspace;
++
++	return vidioc_try_fmt(ctx, f, fmt);
++}
++
++static int vidioc_s_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f,
++			unsigned int requested_height)
++{
++	struct bcm2835_codec_q_data *q_data;
++	struct vb2_queue *vq;
++	struct vchiq_mmal_port *port;
++	bool update_capture_port = false;
++	bool reenable_port = false;
++	int ret;
++
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev,	"Setting format for type %d, wxh: %dx%d, fmt: %08x, size %u\n",
++		 f->type, f->fmt.pix_mp.width, f->fmt.pix_mp.height,
++		 f->fmt.pix_mp.pixelformat,
++		 f->fmt.pix_mp.plane_fmt[0].sizeimage);
++
++	vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, f->type);
++	if (!vq)
++		return -EINVAL;
++
++	q_data = get_q_data(ctx, f->type);
++	if (!q_data)
++		return -EINVAL;
++
++	if (vb2_is_busy(vq)) {
++		v4l2_err(&ctx->dev->v4l2_dev, "%s queue busy\n", __func__);
++		return -EBUSY;
++	}
++
++	q_data->fmt = find_format(f, ctx->dev,
++				  f->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
++	q_data->crop_width = f->fmt.pix_mp.width;
++	q_data->height = f->fmt.pix_mp.height;
++	if (!q_data->selection_set ||
++	    (q_data->fmt->flags & V4L2_FMT_FLAG_COMPRESSED))
++		q_data->crop_height = requested_height;
++
++	/*
++	 * Copying the behaviour of vicodec which retains a single set of
++	 * colorspace parameters for both input and output.
++	 */
++	ctx->colorspace = f->fmt.pix_mp.colorspace;
++	ctx->xfer_func = f->fmt.pix_mp.xfer_func;
++	ctx->ycbcr_enc = f->fmt.pix_mp.ycbcr_enc;
++	ctx->quant = f->fmt.pix_mp.quantization;
++
++	q_data->field = f->fmt.pix_mp.field;
++
++	/* All parameters should have been set correctly by try_fmt */
++	q_data->bytesperline = f->fmt.pix_mp.plane_fmt[0].bytesperline;
++	q_data->sizeimage = f->fmt.pix_mp.plane_fmt[0].sizeimage;
++
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev,	"Calculated bpl as %u, size %u\n",
++		 q_data->bytesperline, q_data->sizeimage);
++
++	if ((ctx->dev->role == DECODE || ctx->dev->role == ENCODE_IMAGE) &&
++	    q_data->fmt->flags & V4L2_FMT_FLAG_COMPRESSED &&
++	    q_data->crop_width && q_data->height) {
++		/*
++		 * On the decoder or image encoder, if provided with
++		 * a resolution on the input side, then replicate that
++		 * to the output side.
++		 * GStreamer appears not to support V4L2_EVENT_SOURCE_CHANGE,
++		 * nor set up a resolution on the output side, therefore
++		 * we can't decode anything at a resolution other than the
++		 * default one.
++		 */
++		struct bcm2835_codec_q_data *q_data_dst =
++						&ctx->q_data[V4L2_M2M_DST];
++
++		q_data_dst->crop_width = q_data->crop_width;
++		q_data_dst->crop_height = q_data->crop_height;
++		q_data_dst->height = ALIGN(q_data->crop_height, 16);
++
++		q_data_dst->bytesperline =
++			get_bytesperline(f->fmt.pix_mp.width,
++					 f->fmt.pix_mp.height,
++					 q_data_dst->fmt, ctx->dev->role);
++		q_data_dst->sizeimage = get_sizeimage(q_data_dst->bytesperline,
++						      q_data_dst->crop_width,
++						      q_data_dst->height,
++						      q_data_dst->fmt);
++		update_capture_port = true;
++	}
++
++	/* If we have a component then setup the port as well */
++	port = get_port_data(ctx, vq->type);
++	if (!port)
++		return 0;
++
++	if (port->enabled) {
++		unsigned int num_buffers;
++
++		/*
++		 * This should only ever happen with DECODE and the MMAL output
++		 * port that has been enabled for resolution changed events.
++		 * In this case no buffers have been allocated or sent to the
++		 * component, so warn on that.
++		 */
++		WARN_ON(ctx->dev->role != DECODE ||
++			f->type != V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE ||
++			atomic_read(&port->buffers_with_vpu));
++
++		/*
++		 * Disable will reread the port format, so retain buffer count.
++		 */
++		num_buffers = port->current_buffer.num;
++
++		ret = vchiq_mmal_port_disable(ctx->dev->instance, port);
++		if (ret)
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: Error disabling port update buffer count, ret %d\n",
++				 __func__, ret);
++
++		port->current_buffer.num = num_buffers;
++
++		reenable_port = true;
++	}
++
++	setup_mmal_port_format(ctx, q_data, port);
++	ret = vchiq_mmal_port_set_format(ctx->dev->instance, port);
++	if (ret) {
++		v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed vchiq_mmal_port_set_format on port, ret %d\n",
++			 __func__, ret);
++		ret = -EINVAL;
++	}
++
++	if (q_data->sizeimage < port->minimum_buffer.size) {
++		v4l2_err(&ctx->dev->v4l2_dev, "%s: Current buffer size of %u < min buf size %u - driver mismatch to MMAL\n",
++			 __func__, q_data->sizeimage,
++			 port->minimum_buffer.size);
++	}
++
++	if (reenable_port) {
++		ret = vchiq_mmal_port_enable(ctx->dev->instance,
++					     port,
++					     op_buffer_cb);
++		if (ret)
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed enabling o/p port, ret %d\n",
++				 __func__, ret);
++	}
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev,	"Set format for type %d, wxh: %dx%d, fmt: %08x, size %u\n",
++		 f->type, q_data->crop_width, q_data->height,
++		 q_data->fmt->fourcc, q_data->sizeimage);
++
++	if (update_capture_port) {
++		struct vchiq_mmal_port *port_dst = &ctx->component->output[0];
++		struct bcm2835_codec_q_data *q_data_dst =
++						&ctx->q_data[V4L2_M2M_DST];
++
++		setup_mmal_port_format(ctx, q_data_dst, port_dst);
++		ret = vchiq_mmal_port_set_format(ctx->dev->instance, port_dst);
++		if (ret) {
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed vchiq_mmal_port_set_format on output port, ret %d\n",
++				 __func__, ret);
++			ret = -EINVAL;
++		}
++	}
++	return ret;
++}
++
++static int vidioc_s_fmt_vid_cap(struct file *file, void *priv,
++				struct v4l2_format *f)
++{
++	unsigned int height = f->fmt.pix_mp.height;
++	int ret;
++
++	ret = vidioc_try_fmt_vid_cap(file, priv, f);
++	if (ret)
++		return ret;
++
++	return vidioc_s_fmt(file2ctx(file), f, height);
++}
++
++static int vidioc_s_fmt_vid_out(struct file *file, void *priv,
++				struct v4l2_format *f)
++{
++	unsigned int height = f->fmt.pix_mp.height;
++	int ret;
++
++	ret = vidioc_try_fmt_vid_out(file, priv, f);
++	if (ret)
++		return ret;
++
++	ret = vidioc_s_fmt(file2ctx(file), f, height);
++	return ret;
++}
++
++static int vidioc_g_selection(struct file *file, void *priv,
++			      struct v4l2_selection *s)
++{
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++	struct bcm2835_codec_q_data *q_data;
++
++	/*
++	 * The selection API takes V4L2_BUF_TYPE_VIDEO_CAPTURE and
++	 * V4L2_BUF_TYPE_VIDEO_OUTPUT, even if the device implements the MPLANE
++	 * API. The V4L2 core will have converted the MPLANE variants to
++	 * non-MPLANE.
++	 * Open code this instead of using get_q_data in this case.
++	 */
++	switch (s->type) {
++	case V4L2_BUF_TYPE_VIDEO_CAPTURE:
++		/* CAPTURE on encoder is not valid. */
++		if (ctx->dev->role == ENCODE || ctx->dev->role == ENCODE_IMAGE)
++			return -EINVAL;
++		q_data = &ctx->q_data[V4L2_M2M_DST];
++		break;
++	case V4L2_BUF_TYPE_VIDEO_OUTPUT:
++		/* OUTPUT on deoder is not valid. */
++		if (ctx->dev->role == DECODE)
++			return -EINVAL;
++		q_data = &ctx->q_data[V4L2_M2M_SRC];
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	switch (ctx->dev->role) {
++	case DECODE:
++		switch (s->target) {
++		case V4L2_SEL_TGT_COMPOSE_DEFAULT:
++		case V4L2_SEL_TGT_COMPOSE:
++			s->r.left = 0;
++			s->r.top = 0;
++			s->r.width = q_data->crop_width;
++			s->r.height = q_data->crop_height;
++			break;
++		case V4L2_SEL_TGT_COMPOSE_BOUNDS:
++			s->r.left = 0;
++			s->r.top = 0;
++			s->r.width = q_data->crop_width;
++			s->r.height = q_data->crop_height;
++			break;
++		case V4L2_SEL_TGT_CROP_BOUNDS:
++		case V4L2_SEL_TGT_CROP_DEFAULT:
++			s->r.left = 0;
++			s->r.top = 0;
++			s->r.width = (q_data->bytesperline << 3) /
++						q_data->fmt->depth;
++			s->r.height = q_data->height;
++			break;
++		default:
++			return -EINVAL;
++		}
++		break;
++	case ENCODE:
++	case ENCODE_IMAGE:
++		switch (s->target) {
++		case V4L2_SEL_TGT_CROP_DEFAULT:
++		case V4L2_SEL_TGT_CROP_BOUNDS:
++			s->r.top = 0;
++			s->r.left = 0;
++			s->r.width = q_data->bytesperline;
++			s->r.height = q_data->height;
++			break;
++		case V4L2_SEL_TGT_CROP:
++			s->r.top = 0;
++			s->r.left = 0;
++			s->r.width = q_data->crop_width;
++			s->r.height = q_data->crop_height;
++			break;
++		default:
++			return -EINVAL;
++		}
++		break;
++	case ISP:
++	case DEINTERLACE:
++		if (s->type == V4L2_BUF_TYPE_VIDEO_CAPTURE) {
++			switch (s->target) {
++			case V4L2_SEL_TGT_COMPOSE_DEFAULT:
++			case V4L2_SEL_TGT_COMPOSE:
++				s->r.left = 0;
++				s->r.top = 0;
++				s->r.width = q_data->crop_width;
++				s->r.height = q_data->crop_height;
++				break;
++			case V4L2_SEL_TGT_COMPOSE_BOUNDS:
++				s->r.left = 0;
++				s->r.top = 0;
++				s->r.width = q_data->crop_width;
++				s->r.height = q_data->crop_height;
++				break;
++			default:
++				return -EINVAL;
++			}
++		} else {
++			/* must be V4L2_BUF_TYPE_VIDEO_OUTPUT */
++			switch (s->target) {
++			case V4L2_SEL_TGT_CROP_DEFAULT:
++			case V4L2_SEL_TGT_CROP_BOUNDS:
++				s->r.top = 0;
++				s->r.left = 0;
++				s->r.width = q_data->bytesperline;
++				s->r.height = q_data->height;
++				break;
++			case V4L2_SEL_TGT_CROP:
++				s->r.top = 0;
++				s->r.left = 0;
++				s->r.width = q_data->crop_width;
++				s->r.height = q_data->crop_height;
++				break;
++			default:
++				return -EINVAL;
++			}
++		}
++		break;
++	case NUM_ROLES:
++		break;
++	}
++
++	return 0;
++}
++
++static int vidioc_s_selection(struct file *file, void *priv,
++			      struct v4l2_selection *s)
++{
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++	struct bcm2835_codec_q_data *q_data = NULL;
++	struct vchiq_mmal_port *port = NULL;
++	int ret;
++
++	/*
++	 * The selection API takes V4L2_BUF_TYPE_VIDEO_CAPTURE and
++	 * V4L2_BUF_TYPE_VIDEO_OUTPUT, even if the device implements the MPLANE
++	 * API. The V4L2 core will have converted the MPLANE variants to
++	 * non-MPLANE.
++	 *
++	 * Open code this instead of using get_q_data in this case.
++	 */
++	switch (s->type) {
++	case V4L2_BUF_TYPE_VIDEO_CAPTURE:
++		/* CAPTURE on encoder is not valid. */
++		if (ctx->dev->role == ENCODE || ctx->dev->role == ENCODE_IMAGE)
++			return -EINVAL;
++		q_data = &ctx->q_data[V4L2_M2M_DST];
++		if (ctx->component)
++			port = &ctx->component->output[0];
++		break;
++	case V4L2_BUF_TYPE_VIDEO_OUTPUT:
++		/* OUTPUT on deoder is not valid. */
++		if (ctx->dev->role == DECODE)
++			return -EINVAL;
++		q_data = &ctx->q_data[V4L2_M2M_SRC];
++		if (ctx->component)
++			port = &ctx->component->input[0];
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: ctx %p, type %d, q_data %p, target %d, rect x/y %d/%d, w/h %ux%u\n",
++		 __func__, ctx, s->type, q_data, s->target, s->r.left, s->r.top,
++		 s->r.width, s->r.height);
++
++	switch (ctx->dev->role) {
++	case DECODE:
++		switch (s->target) {
++		case V4L2_SEL_TGT_COMPOSE:
++			/* Accept cropped image */
++			s->r.left = 0;
++			s->r.top = 0;
++			s->r.width = min(s->r.width, q_data->crop_width);
++			s->r.height = min(s->r.height, q_data->height);
++			q_data->crop_width = s->r.width;
++			q_data->crop_height = s->r.height;
++			q_data->selection_set = true;
++			break;
++		default:
++			return -EINVAL;
++		}
++		break;
++	case ENCODE:
++	case ENCODE_IMAGE:
++		switch (s->target) {
++		case V4L2_SEL_TGT_CROP:
++			/* Only support crop from (0,0) */
++			s->r.top = 0;
++			s->r.left = 0;
++			s->r.width = min(s->r.width, q_data->crop_width);
++			s->r.height = min(s->r.height, q_data->height);
++			q_data->crop_width = s->r.width;
++			q_data->crop_height = s->r.height;
++			q_data->selection_set = true;
++			break;
++		default:
++			return -EINVAL;
++		}
++		break;
++	case ISP:
++	case DEINTERLACE:
++		if (s->type == V4L2_BUF_TYPE_VIDEO_CAPTURE) {
++			switch (s->target) {
++			case V4L2_SEL_TGT_COMPOSE:
++				/* Accept cropped image */
++				s->r.left = 0;
++				s->r.top = 0;
++				s->r.width = min(s->r.width, q_data->crop_width);
++				s->r.height = min(s->r.height, q_data->height);
++				q_data->crop_width = s->r.width;
++				q_data->crop_height = s->r.height;
++				q_data->selection_set = true;
++				break;
++			default:
++				return -EINVAL;
++			}
++			break;
++		} else {
++			/* must be V4L2_BUF_TYPE_VIDEO_OUTPUT */
++			switch (s->target) {
++			case V4L2_SEL_TGT_CROP:
++				/* Only support crop from (0,0) */
++				s->r.top = 0;
++				s->r.left = 0;
++				s->r.width = min(s->r.width, q_data->crop_width);
++				s->r.height = min(s->r.height, q_data->height);
++				q_data->crop_width = s->r.width;
++				q_data->crop_height = s->r.height;
++				q_data->selection_set = true;
++				break;
++			default:
++				return -EINVAL;
++			}
++			break;
++		}
++	case NUM_ROLES:
++		break;
++	}
++
++	if (!port)
++		return 0;
++
++	setup_mmal_port_format(ctx, q_data, port);
++	ret = vchiq_mmal_port_set_format(ctx->dev->instance, port);
++	if (ret) {
++		v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed vchiq_mmal_port_set_format on port, ret %d\n",
++			 __func__, ret);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++static int vidioc_s_parm(struct file *file, void *priv,
++			 struct v4l2_streamparm *parm)
++{
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++	struct bcm2835_codec_q_data *q_data = &ctx->q_data[V4L2_M2M_DST];
++	struct vchiq_mmal_port *port;
++	int ret;
++
++	if (parm->type != V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE)
++		return -EINVAL;
++
++	if (!parm->parm.output.timeperframe.denominator ||
++	    !parm->parm.output.timeperframe.numerator)
++		return -EINVAL;
++
++	ctx->framerate_num =
++			parm->parm.output.timeperframe.denominator;
++	ctx->framerate_denom =
++			parm->parm.output.timeperframe.numerator;
++
++	parm->parm.output.capability = V4L2_CAP_TIMEPERFRAME;
++
++	/*
++	 * If we have a component then setup the port as well.
++	 * NB Framerate is passed to MMAL via the DST port, whilst V4L2 uses the
++	 * OUTPUT queue.
++	 */
++	port = get_port_data(ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
++	if (!port)
++		return 0;
++
++	if (port->enabled) {
++		struct s32_fract frame_rate = { ctx->framerate_num,
++						ctx->framerate_denom };
++
++		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						    &ctx->component->output[0],
++						    MMAL_PARAMETER_VIDEO_FRAME_RATE,
++						    &frame_rate,
++						    sizeof(frame_rate));
++
++		return ret;
++	}
++
++	setup_mmal_port_format(ctx, q_data, port);
++	ret = vchiq_mmal_port_set_format(ctx->dev->instance, port);
++	if (ret) {
++		v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed vchiq_mmal_port_set_format on port, ret %d\n",
++			 __func__, ret);
++		ret = -EINVAL;
++	}
++
++	if (q_data->sizeimage < port->minimum_buffer.size) {
++		v4l2_err(&ctx->dev->v4l2_dev, "%s: Current buffer size of %u < min buf size %u - driver mismatch to MMAL\n",
++			 __func__, q_data->sizeimage,
++			 port->minimum_buffer.size);
++		ret = -EINVAL;
++	}
++
++	return ret;
++}
++
++static int vidioc_g_parm(struct file *file, void *priv,
++			 struct v4l2_streamparm *parm)
++{
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++
++	if (parm->type != V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE)
++		return -EINVAL;
++
++	parm->parm.output.capability = V4L2_CAP_TIMEPERFRAME;
++	parm->parm.output.timeperframe.denominator =
++			ctx->framerate_num;
++	parm->parm.output.timeperframe.numerator =
++			ctx->framerate_denom;
++
++	return 0;
++}
++
++static int vidioc_g_pixelaspect(struct file *file, void *fh, int type,
++				struct v4l2_fract *f)
++{
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++
++	/*
++	 * The selection API takes V4L2_BUF_TYPE_VIDEO_CAPTURE and
++	 * V4L2_BUF_TYPE_VIDEO_OUTPUT, even if the device implements the MPLANE
++	 * API. The V4L2 core will have converted the MPLANE variants to
++	 * non-MPLANE.
++	 * Open code this instead of using get_q_data in this case.
++	 */
++	if (ctx->dev->role != DECODE)
++		return -ENOIOCTLCMD;
++
++	if (type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
++		return -EINVAL;
++
++	*f = ctx->q_data[V4L2_M2M_DST].aspect_ratio;
++
++	return 0;
++}
++
++static int vidioc_subscribe_evt(struct v4l2_fh *fh,
++				const struct v4l2_event_subscription *sub)
++{
++	switch (sub->type) {
++	case V4L2_EVENT_EOS:
++		return v4l2_event_subscribe(fh, sub, 2, NULL);
++	case V4L2_EVENT_SOURCE_CHANGE:
++		return v4l2_src_change_event_subscribe(fh, sub);
++	default:
++		return v4l2_ctrl_subscribe_event(fh, sub);
++	}
++}
++
++static int bcm2835_codec_set_level_profile(struct bcm2835_codec_ctx *ctx,
++					   struct v4l2_ctrl *ctrl)
++{
++	struct mmal_parameter_video_profile param;
++	int param_size = sizeof(param);
++	int ret;
++
++	/*
++	 * Level and Profile are set via the same MMAL parameter.
++	 * Retrieve the current settings and amend the one that has changed.
++	 */
++	ret = vchiq_mmal_port_parameter_get(ctx->dev->instance,
++					    &ctx->component->output[0],
++					    MMAL_PARAMETER_PROFILE,
++					    &param,
++					    &param_size);
++	if (ret)
++		return ret;
++
++	switch (ctrl->id) {
++	case V4L2_CID_MPEG_VIDEO_H264_PROFILE:
++		switch (ctrl->val) {
++		case V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE:
++			param.profile = MMAL_VIDEO_PROFILE_H264_BASELINE;
++			break;
++		case V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE:
++			param.profile =
++				MMAL_VIDEO_PROFILE_H264_CONSTRAINED_BASELINE;
++			break;
++		case V4L2_MPEG_VIDEO_H264_PROFILE_MAIN:
++			param.profile = MMAL_VIDEO_PROFILE_H264_MAIN;
++			break;
++		case V4L2_MPEG_VIDEO_H264_PROFILE_HIGH:
++			param.profile = MMAL_VIDEO_PROFILE_H264_HIGH;
++			break;
++		default:
++			/* Should never get here */
++			break;
++		}
++		break;
++
++	case V4L2_CID_MPEG_VIDEO_H264_LEVEL:
++		switch (ctrl->val) {
++		case V4L2_MPEG_VIDEO_H264_LEVEL_1_0:
++			param.level = MMAL_VIDEO_LEVEL_H264_1;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_1B:
++			param.level = MMAL_VIDEO_LEVEL_H264_1b;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_1_1:
++			param.level = MMAL_VIDEO_LEVEL_H264_11;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_1_2:
++			param.level = MMAL_VIDEO_LEVEL_H264_12;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_1_3:
++			param.level = MMAL_VIDEO_LEVEL_H264_13;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_2_0:
++			param.level = MMAL_VIDEO_LEVEL_H264_2;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_2_1:
++			param.level = MMAL_VIDEO_LEVEL_H264_21;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_2_2:
++			param.level = MMAL_VIDEO_LEVEL_H264_22;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_3_0:
++			param.level = MMAL_VIDEO_LEVEL_H264_3;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_3_1:
++			param.level = MMAL_VIDEO_LEVEL_H264_31;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_3_2:
++			param.level = MMAL_VIDEO_LEVEL_H264_32;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_4_0:
++			param.level = MMAL_VIDEO_LEVEL_H264_4;
++			break;
++		/*
++		 * Note that the hardware spec is level 4.0. Levels above that
++		 * are there for correctly encoding the headers and may not
++		 * be able to keep up with real-time.
++		 */
++		case V4L2_MPEG_VIDEO_H264_LEVEL_4_1:
++			param.level = MMAL_VIDEO_LEVEL_H264_41;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_4_2:
++			param.level = MMAL_VIDEO_LEVEL_H264_42;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_5_0:
++			param.level = MMAL_VIDEO_LEVEL_H264_5;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_5_1:
++			param.level = MMAL_VIDEO_LEVEL_H264_51;
++			break;
++		default:
++			/* Should never get here */
++			break;
++		}
++	}
++	ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
++					    &ctx->component->output[0],
++					    MMAL_PARAMETER_PROFILE,
++					    &param,
++					    param_size);
++
++	return ret;
++}
++
++static int bcm2835_codec_s_ctrl(struct v4l2_ctrl *ctrl)
++{
++	struct bcm2835_codec_ctx *ctx =
++		container_of(ctrl->handler, struct bcm2835_codec_ctx, hdl);
++	int ret = 0;
++
++	if (ctrl->flags & V4L2_CTRL_FLAG_READ_ONLY)
++		return 0;
++
++	switch (ctrl->id) {
++	case V4L2_CID_MPEG_VIDEO_BITRATE:
++		ctx->bitrate = ctrl->val;
++		if (!ctx->component)
++			break;
++
++		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						    &ctx->component->output[0],
++						    MMAL_PARAMETER_VIDEO_BIT_RATE,
++						    &ctrl->val,
++						    sizeof(ctrl->val));
++		break;
++
++	case V4L2_CID_MPEG_VIDEO_BITRATE_MODE: {
++		u32 bitrate_mode;
++
++		if (!ctx->component)
++			break;
++
++		switch (ctrl->val) {
++		default:
++		case V4L2_MPEG_VIDEO_BITRATE_MODE_VBR:
++			bitrate_mode = MMAL_VIDEO_RATECONTROL_VARIABLE;
++			break;
++		case V4L2_MPEG_VIDEO_BITRATE_MODE_CBR:
++			bitrate_mode = MMAL_VIDEO_RATECONTROL_CONSTANT;
++			break;
++		}
++
++		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						    &ctx->component->output[0],
++						    MMAL_PARAMETER_RATECONTROL,
++						    &bitrate_mode,
++						    sizeof(bitrate_mode));
++		break;
++	}
++	case V4L2_CID_MPEG_VIDEO_REPEAT_SEQ_HEADER:
++		if (!ctx->component)
++			break;
++
++		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						    &ctx->component->output[0],
++						    MMAL_PARAMETER_VIDEO_ENCODE_INLINE_HEADER,
++						    &ctrl->val,
++						    sizeof(ctrl->val));
++		break;
++
++	case V4L2_CID_MPEG_VIDEO_HEADER_MODE:
++		if (!ctx->component)
++			break;
++
++		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						    &ctx->component->output[0],
++						    MMAL_PARAMETER_VIDEO_ENCODE_HEADERS_WITH_FRAME,
++						    &ctrl->val,
++						    sizeof(ctrl->val));
++		break;
++
++	case V4L2_CID_MPEG_VIDEO_H264_I_PERIOD:
++		/*
++		 * Incorrect initial implementation meant that H264_I_PERIOD
++		 * was implemented to control intra-I period. As the MMAL
++		 * encoder never produces I-frames that aren't IDR frames, it
++		 * should actually have been GOP_SIZE.
++		 * Support both controls, but writing to H264_I_PERIOD will
++		 * update GOP_SIZE.
++		 */
++		__v4l2_ctrl_s_ctrl(ctx->gop_size, ctrl->val);
++	fallthrough;
++	case V4L2_CID_MPEG_VIDEO_GOP_SIZE:
++		if (!ctx->component)
++			break;
++
++		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						    &ctx->component->output[0],
++						    MMAL_PARAMETER_INTRAPERIOD,
++						    &ctrl->val,
++						    sizeof(ctrl->val));
++		break;
++
++	case V4L2_CID_MPEG_VIDEO_H264_PROFILE:
++	case V4L2_CID_MPEG_VIDEO_H264_LEVEL:
++		if (!ctx->component)
++			break;
++
++		ret = bcm2835_codec_set_level_profile(ctx, ctrl);
++		break;
++
++	case V4L2_CID_MPEG_VIDEO_H264_MIN_QP:
++		if (!ctx->component)
++			break;
++
++		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						    &ctx->component->output[0],
++						    MMAL_PARAMETER_VIDEO_ENCODE_MIN_QUANT,
++						    &ctrl->val,
++						    sizeof(ctrl->val));
++		break;
++
++	case V4L2_CID_MPEG_VIDEO_H264_MAX_QP:
++		if (!ctx->component)
++			break;
++
++		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						    &ctx->component->output[0],
++						    MMAL_PARAMETER_VIDEO_ENCODE_MAX_QUANT,
++						    &ctrl->val,
++						    sizeof(ctrl->val));
++		break;
++
++	case V4L2_CID_MPEG_VIDEO_FORCE_KEY_FRAME: {
++		u32 mmal_bool = 1;
++
++		if (!ctx->component)
++			break;
++
++		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						    &ctx->component->output[0],
++						    MMAL_PARAMETER_VIDEO_REQUEST_I_FRAME,
++						    &mmal_bool,
++						    sizeof(mmal_bool));
++		break;
++	}
++	case V4L2_CID_HFLIP:
++	case V4L2_CID_VFLIP: {
++		u32 u32_value;
++
++		if (ctrl->id == V4L2_CID_HFLIP)
++			ctx->hflip = ctrl->val;
++		else
++			ctx->vflip = ctrl->val;
++
++		if (!ctx->component)
++			break;
++
++		if (ctx->hflip && ctx->vflip)
++			u32_value = MMAL_PARAM_MIRROR_BOTH;
++		else if (ctx->hflip)
++			u32_value = MMAL_PARAM_MIRROR_HORIZONTAL;
++		else if (ctx->vflip)
++			u32_value = MMAL_PARAM_MIRROR_VERTICAL;
++		else
++			u32_value = MMAL_PARAM_MIRROR_NONE;
++
++		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						    &ctx->component->input[0],
++						    MMAL_PARAMETER_MIRROR,
++						    &u32_value,
++						    sizeof(u32_value));
++		break;
++	}
++	case V4L2_CID_MPEG_VIDEO_B_FRAMES:
++		ret = 0;
++		break;
++
++	case V4L2_CID_JPEG_COMPRESSION_QUALITY:
++		if (!ctx->component)
++			break;
++
++		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						    &ctx->component->output[0],
++						    MMAL_PARAMETER_JPEG_Q_FACTOR,
++						    &ctrl->val,
++						    sizeof(ctrl->val));
++		break;
++
++	default:
++		v4l2_err(&ctx->dev->v4l2_dev, "Invalid control %08x\n", ctrl->id);
++		return -EINVAL;
++	}
++
++	if (ret)
++		v4l2_err(&ctx->dev->v4l2_dev, "Failed setting ctrl %08x, ret %d\n",
++			 ctrl->id, ret);
++	return ret ? -EINVAL : 0;
++}
++
++static const struct v4l2_ctrl_ops bcm2835_codec_ctrl_ops = {
++	.s_ctrl = bcm2835_codec_s_ctrl,
++};
++
++static int vidioc_try_decoder_cmd(struct file *file, void *priv,
++				  struct v4l2_decoder_cmd *cmd)
++{
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++
++	if (ctx->dev->role != DECODE)
++		return -EINVAL;
++
++	switch (cmd->cmd) {
++	case V4L2_DEC_CMD_STOP:
++		if (cmd->flags & V4L2_DEC_CMD_STOP_TO_BLACK) {
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: DEC cmd->flags=%u stop to black not supported",
++				 __func__, cmd->flags);
++			return -EINVAL;
++		}
++		break;
++	case V4L2_DEC_CMD_START:
++		break;
++	default:
++		return -EINVAL;
++	}
++	return 0;
++}
++
++static int vidioc_decoder_cmd(struct file *file, void *priv,
++			      struct v4l2_decoder_cmd *cmd)
++{
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++	struct bcm2835_codec_q_data *q_data = &ctx->q_data[V4L2_M2M_SRC];
++	struct vb2_queue *dst_vq;
++	int ret;
++
++	v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s, cmd %u", __func__,
++		 cmd->cmd);
++	ret = vidioc_try_decoder_cmd(file, priv, cmd);
++	if (ret)
++		return ret;
++
++	switch (cmd->cmd) {
++	case V4L2_DEC_CMD_STOP:
++		if (q_data->eos_buffer_in_use)
++			v4l2_err(&ctx->dev->v4l2_dev, "EOS buffers already in use\n");
++		q_data->eos_buffer_in_use = true;
++
++		q_data->eos_buffer.mmal.buffer_size = 0;
++		q_data->eos_buffer.mmal.length = 0;
++		q_data->eos_buffer.mmal.mmal_flags =
++						MMAL_BUFFER_HEADER_FLAG_EOS;
++		q_data->eos_buffer.mmal.pts = 0;
++		q_data->eos_buffer.mmal.dts = 0;
++
++		if (!ctx->component)
++			break;
++
++		ret = vchiq_mmal_submit_buffer(ctx->dev->instance,
++					       &ctx->component->input[0],
++					       &q_data->eos_buffer.mmal);
++		if (ret)
++			v4l2_err(&ctx->dev->v4l2_dev,
++				 "%s: EOS buffer submit failed %d\n",
++				 __func__, ret);
++
++		break;
++
++	case V4L2_DEC_CMD_START:
++		dst_vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx,
++					 V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
++		vb2_clear_last_buffer_dequeued(dst_vq);
++		break;
++
++	default:
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++static int vidioc_try_encoder_cmd(struct file *file, void *priv,
++				  struct v4l2_encoder_cmd *cmd)
++{
++	switch (cmd->cmd) {
++	case V4L2_ENC_CMD_STOP:
++		break;
++
++	case V4L2_ENC_CMD_START:
++		/* Do we need to do anything here? */
++		break;
++	default:
++		return -EINVAL;
++	}
++	return 0;
++}
++
++static int vidioc_encoder_cmd(struct file *file, void *priv,
++			      struct v4l2_encoder_cmd *cmd)
++{
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++	struct bcm2835_codec_q_data *q_data = &ctx->q_data[V4L2_M2M_SRC];
++	int ret;
++
++	v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s, cmd %u", __func__,
++		 cmd->cmd);
++	ret = vidioc_try_encoder_cmd(file, priv, cmd);
++	if (ret)
++		return ret;
++
++	switch (cmd->cmd) {
++	case V4L2_ENC_CMD_STOP:
++		if (q_data->eos_buffer_in_use)
++			v4l2_err(&ctx->dev->v4l2_dev, "EOS buffers already in use\n");
++		q_data->eos_buffer_in_use = true;
++
++		q_data->eos_buffer.mmal.buffer_size = 0;
++		q_data->eos_buffer.mmal.length = 0;
++		q_data->eos_buffer.mmal.mmal_flags =
++						MMAL_BUFFER_HEADER_FLAG_EOS;
++		q_data->eos_buffer.mmal.pts = 0;
++		q_data->eos_buffer.mmal.dts = 0;
++
++		if (!ctx->component)
++			break;
++
++		ret = vchiq_mmal_submit_buffer(ctx->dev->instance,
++					       &ctx->component->input[0],
++					       &q_data->eos_buffer.mmal);
++		if (ret)
++			v4l2_err(&ctx->dev->v4l2_dev,
++				 "%s: EOS buffer submit failed %d\n",
++				 __func__, ret);
++
++		break;
++	case V4L2_ENC_CMD_START:
++		/* Do we need to do anything here? */
++		break;
++
++	default:
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++static int vidioc_enum_framesizes(struct file *file, void *fh,
++				  struct v4l2_frmsizeenum *fsize)
++{
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++	struct bcm2835_codec_fmt *fmt;
++
++	fmt = find_format_pix_fmt(fsize->pixel_format, file2ctx(file)->dev,
++				  true);
++	if (!fmt)
++		fmt = find_format_pix_fmt(fsize->pixel_format,
++					  file2ctx(file)->dev,
++					  false);
++
++	if (!fmt)
++		return -EINVAL;
++
++	if (fsize->index)
++		return -EINVAL;
++
++	fsize->type = V4L2_FRMSIZE_TYPE_STEPWISE;
++
++	fsize->stepwise.min_width = MIN_W;
++	fsize->stepwise.max_width = ctx->dev->max_w;
++	fsize->stepwise.step_width = 2;
++	fsize->stepwise.min_height = MIN_H;
++	fsize->stepwise.max_height = ctx->dev->max_h;
++	fsize->stepwise.step_height = 2;
++
++	return 0;
++}
++
++static const struct v4l2_ioctl_ops bcm2835_codec_ioctl_ops = {
++	.vidioc_querycap	= vidioc_querycap,
++
++	.vidioc_enum_fmt_vid_cap = vidioc_enum_fmt_vid_cap,
++	.vidioc_g_fmt_vid_cap_mplane	= vidioc_g_fmt_vid_cap,
++	.vidioc_try_fmt_vid_cap_mplane	= vidioc_try_fmt_vid_cap,
++	.vidioc_s_fmt_vid_cap_mplane	= vidioc_s_fmt_vid_cap,
++
++	.vidioc_enum_fmt_vid_out = vidioc_enum_fmt_vid_out,
++	.vidioc_g_fmt_vid_out_mplane	= vidioc_g_fmt_vid_out,
++	.vidioc_try_fmt_vid_out_mplane	= vidioc_try_fmt_vid_out,
++	.vidioc_s_fmt_vid_out_mplane	= vidioc_s_fmt_vid_out,
++
++	.vidioc_reqbufs		= v4l2_m2m_ioctl_reqbufs,
++	.vidioc_querybuf	= v4l2_m2m_ioctl_querybuf,
++	.vidioc_qbuf		= v4l2_m2m_ioctl_qbuf,
++	.vidioc_dqbuf		= v4l2_m2m_ioctl_dqbuf,
++	.vidioc_prepare_buf	= v4l2_m2m_ioctl_prepare_buf,
++	.vidioc_create_bufs	= v4l2_m2m_ioctl_create_bufs,
++	.vidioc_expbuf		= v4l2_m2m_ioctl_expbuf,
++
++	.vidioc_streamon	= v4l2_m2m_ioctl_streamon,
++	.vidioc_streamoff	= v4l2_m2m_ioctl_streamoff,
++
++	.vidioc_g_selection	= vidioc_g_selection,
++	.vidioc_s_selection	= vidioc_s_selection,
++
++	.vidioc_g_parm		= vidioc_g_parm,
++	.vidioc_s_parm		= vidioc_s_parm,
++
++	.vidioc_g_pixelaspect	= vidioc_g_pixelaspect,
++
++	.vidioc_subscribe_event = vidioc_subscribe_evt,
++	.vidioc_unsubscribe_event = v4l2_event_unsubscribe,
++
++	.vidioc_decoder_cmd = vidioc_decoder_cmd,
++	.vidioc_try_decoder_cmd = vidioc_try_decoder_cmd,
++	.vidioc_encoder_cmd = vidioc_encoder_cmd,
++	.vidioc_try_encoder_cmd = vidioc_try_encoder_cmd,
++	.vidioc_enum_framesizes = vidioc_enum_framesizes,
++};
++
++static int bcm2835_codec_create_component(struct bcm2835_codec_ctx *ctx)
++{
++	struct bcm2835_codec_dev *dev = ctx->dev;
++	unsigned int enable = 1;
++	int ret;
++
++	ret = vchiq_mmal_component_init(dev->instance, components[dev->role],
++					&ctx->component);
++	if (ret < 0) {
++		v4l2_err(&dev->v4l2_dev, "%s: failed to create component %s\n",
++			 __func__, components[dev->role]);
++		return -ENOMEM;
++	}
++
++	vchiq_mmal_port_parameter_set(dev->instance, &ctx->component->input[0],
++				      MMAL_PARAMETER_ZERO_COPY, &enable,
++				      sizeof(enable));
++	vchiq_mmal_port_parameter_set(dev->instance, &ctx->component->output[0],
++				      MMAL_PARAMETER_ZERO_COPY, &enable,
++				      sizeof(enable));
++
++	if (dev->role == DECODE) {
++		/*
++		 * Disable firmware option that ensures decoded timestamps
++		 * always increase.
++		 */
++		enable = 0;
++		vchiq_mmal_port_parameter_set(dev->instance,
++					      &ctx->component->output[0],
++					      MMAL_PARAMETER_VIDEO_VALIDATE_TIMESTAMPS,
++					      &enable,
++					      sizeof(enable));
++		/*
++		 * Enable firmware option to stop on colourspace and pixel
++		 * aspect ratio changed
++		 */
++		enable = 1;
++		vchiq_mmal_port_parameter_set(dev->instance,
++					      &ctx->component->control,
++					      MMAL_PARAMETER_VIDEO_STOP_ON_PAR_COLOUR_CHANGE,
++					      &enable,
++					      sizeof(enable));
++	} else if (dev->role == DEINTERLACE) {
++		/* Select the default deinterlace algorithm. */
++		int half_framerate = 0;
++		int default_frame_interval = -1; /* don't interpolate */
++		int frame_type = 5; /* 0=progressive, 3=TFF, 4=BFF, 5=see frame */
++		int use_qpus = 0;
++		enum mmal_parameter_imagefx effect =
++			advanced_deinterlace && ctx->q_data[V4L2_M2M_SRC].crop_width <= 800 ?
++			MMAL_PARAM_IMAGEFX_DEINTERLACE_ADV :
++			MMAL_PARAM_IMAGEFX_DEINTERLACE_FAST;
++		struct mmal_parameter_imagefx_parameters params = {
++			.effect = effect,
++			.num_effect_params = 4,
++			.effect_parameter = { frame_type,
++					      default_frame_interval,
++					      half_framerate,
++					      use_qpus },
++		};
++
++		vchiq_mmal_port_parameter_set(dev->instance,
++					      &ctx->component->output[0],
++					      MMAL_PARAMETER_IMAGE_EFFECT_PARAMETERS,
++					      &params,
++					      sizeof(params));
++
++	} else if (dev->role == ENCODE) {
++		enable = 0;
++		vchiq_mmal_port_parameter_set(dev->instance,
++					      &ctx->component->control,
++					      MMAL_PARAMETER_VIDEO_ENCODE_HEADER_ON_OPEN,
++					      &enable,
++					      sizeof(enable));
++	} else if (dev->role == ENCODE_IMAGE) {
++		enable = 0;
++		vchiq_mmal_port_parameter_set(dev->instance,
++					      &ctx->component->control,
++					      MMAL_PARAMETER_EXIF_DISABLE,
++					      &enable,
++					      sizeof(enable));
++		enable = 1;
++		vchiq_mmal_port_parameter_set(dev->instance,
++					      &ctx->component->output[0],
++						  MMAL_PARAMETER_JPEG_IJG_SCALING,
++					      &enable,
++					      sizeof(enable));
++	}
++
++	setup_mmal_port_format(ctx, &ctx->q_data[V4L2_M2M_SRC],
++			       &ctx->component->input[0]);
++	ctx->component->input[0].cb_ctx = ctx;
++
++	setup_mmal_port_format(ctx, &ctx->q_data[V4L2_M2M_DST],
++			       &ctx->component->output[0]);
++	ctx->component->output[0].cb_ctx = ctx;
++
++	ret = vchiq_mmal_port_set_format(dev->instance,
++					 &ctx->component->input[0]);
++	if (ret < 0) {
++		v4l2_dbg(1, debug, &dev->v4l2_dev,
++			 "%s: vchiq_mmal_port_set_format ip port failed\n",
++			 __func__);
++		goto destroy_component;
++	}
++
++	ret = vchiq_mmal_port_set_format(dev->instance,
++					 &ctx->component->output[0]);
++	if (ret < 0) {
++		v4l2_dbg(1, debug, &dev->v4l2_dev,
++			 "%s: vchiq_mmal_port_set_format op port failed\n",
++			 __func__);
++		goto destroy_component;
++	}
++
++	if (dev->role == ENCODE || dev->role == ENCODE_IMAGE) {
++		u32 param = 1;
++
++		if (ctx->q_data[V4L2_M2M_SRC].sizeimage <
++			ctx->component->output[0].minimum_buffer.size)
++			v4l2_err(&dev->v4l2_dev, "buffer size mismatch sizeimage %u < min size %u\n",
++				 ctx->q_data[V4L2_M2M_SRC].sizeimage,
++				 ctx->component->output[0].minimum_buffer.size);
++
++		if (dev->role == ENCODE) {
++			/* Enable SPS Timing header so framerate information is encoded
++			 * in the H264 header.
++			 */
++			vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						      &ctx->component->output[0],
++						      MMAL_PARAMETER_VIDEO_ENCODE_SPS_TIMING,
++						      &param, sizeof(param));
++
++			/* Enable inserting headers into the first frame */
++			vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						      &ctx->component->control,
++						      MMAL_PARAMETER_VIDEO_ENCODE_HEADERS_WITH_FRAME,
++						      &param, sizeof(param));
++			/*
++			 * Avoid fragmenting the buffers over multiple frames (unless
++			 * the frame is bigger than the whole buffer)
++			 */
++			vchiq_mmal_port_parameter_set(ctx->dev->instance,
++						      &ctx->component->control,
++						      MMAL_PARAMETER_MINIMISE_FRAGMENTATION,
++						      &param, sizeof(param));
++		}
++	} else {
++		if (ctx->q_data[V4L2_M2M_DST].sizeimage <
++			ctx->component->output[0].minimum_buffer.size)
++			v4l2_err(&dev->v4l2_dev, "buffer size mismatch sizeimage %u < min size %u\n",
++				 ctx->q_data[V4L2_M2M_DST].sizeimage,
++				 ctx->component->output[0].minimum_buffer.size);
++	}
++
++	/* Now we have a component we can set all the ctrls */
++	ret = v4l2_ctrl_handler_setup(&ctx->hdl);
++
++	v4l2_dbg(2, debug, &dev->v4l2_dev, "%s: component created as %s\n",
++		 __func__, components[dev->role]);
++
++	return 0;
++
++destroy_component:
++	vchiq_mmal_component_finalise(ctx->dev->instance, ctx->component);
++	ctx->component = NULL;
++
++	return ret;
++}
++
++/*
++ * Queue operations
++ */
++
++static int bcm2835_codec_queue_setup(struct vb2_queue *vq,
++				     unsigned int *nbuffers,
++				     unsigned int *nplanes,
++				     unsigned int sizes[],
++				     struct device *alloc_devs[])
++{
++	struct bcm2835_codec_ctx *ctx = vb2_get_drv_priv(vq);
++	struct bcm2835_codec_q_data *q_data;
++	struct vchiq_mmal_port *port;
++	unsigned int size;
++
++	q_data = get_q_data(ctx, vq->type);
++	if (!q_data)
++		return -EINVAL;
++
++	if (!ctx->component)
++		if (bcm2835_codec_create_component(ctx))
++			return -EINVAL;
++
++	port = get_port_data(ctx, vq->type);
++
++	size = q_data->sizeimage;
++
++	if (*nplanes)
++		return sizes[0] < size ? -EINVAL : 0;
++
++	*nplanes = 1;
++
++	sizes[0] = size;
++	port->current_buffer.size = size;
++
++	if (*nbuffers < port->minimum_buffer.num)
++		*nbuffers = port->minimum_buffer.num;
++
++	/*
++	 * The VPU uses this number to allocate a pool of headers at port_enable.
++	 * We can't increase it later, so use of CREATE_BUFS is going to result
++	 * in bad things happening. Adopt worst-case allocation, and add one
++	 * buffer to take an EOS
++	 */
++	port->current_buffer.num = VB2_MAX_FRAME + 1;
++
++	return 0;
++}
++
++static int bcm2835_codec_mmal_buf_cleanup(struct mmal_buffer *mmal_buf)
++{
++	mmal_vchi_buffer_cleanup(mmal_buf);
++
++	if (mmal_buf->dma_buf) {
++		dma_buf_put(mmal_buf->dma_buf);
++		mmal_buf->dma_buf = NULL;
++	}
++
++	return 0;
++}
++
++static int bcm2835_codec_buf_init(struct vb2_buffer *vb)
++{
++	struct bcm2835_codec_ctx *ctx = vb2_get_drv_priv(vb->vb2_queue);
++	struct vb2_v4l2_buffer *vb2 = to_vb2_v4l2_buffer(vb);
++	struct v4l2_m2m_buffer *m2m = container_of(vb2, struct v4l2_m2m_buffer,
++						   vb);
++	struct m2m_mmal_buffer *buf = container_of(m2m, struct m2m_mmal_buffer,
++						   m2m);
++
++	v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s: ctx:%p, vb %p\n",
++		 __func__, ctx, vb);
++	buf->mmal.buffer = vb2_plane_vaddr(&buf->m2m.vb.vb2_buf, 0);
++	buf->mmal.buffer_size = vb2_plane_size(&buf->m2m.vb.vb2_buf, 0);
++
++	mmal_vchi_buffer_init(ctx->dev->instance, &buf->mmal);
++
++	return 0;
++}
++
++static int bcm2835_codec_buf_prepare(struct vb2_buffer *vb)
++{
++	struct bcm2835_codec_ctx *ctx = vb2_get_drv_priv(vb->vb2_queue);
++	struct bcm2835_codec_q_data *q_data;
++	struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
++	struct v4l2_m2m_buffer *m2m = container_of(vbuf, struct v4l2_m2m_buffer,
++						   vb);
++	struct m2m_mmal_buffer *buf = container_of(m2m, struct m2m_mmal_buffer,
++						   m2m);
++	struct dma_buf *dma_buf;
++	int ret;
++
++	v4l2_dbg(4, debug, &ctx->dev->v4l2_dev, "%s: type: %d ptr %p\n",
++		 __func__, vb->vb2_queue->type, vb);
++
++	q_data = get_q_data(ctx, vb->vb2_queue->type);
++	if (V4L2_TYPE_IS_OUTPUT(vb->vb2_queue->type)) {
++		if (vbuf->field == V4L2_FIELD_ANY)
++			vbuf->field = V4L2_FIELD_NONE;
++	}
++
++	if (vb2_plane_size(vb, 0) < q_data->sizeimage) {
++		v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s data will not fit into plane (%lu < %lu)\n",
++			 __func__, vb2_plane_size(vb, 0),
++			 (long)q_data->sizeimage);
++		return -EINVAL;
++	}
++
++	if (!V4L2_TYPE_IS_OUTPUT(vb->vb2_queue->type))
++		vb2_set_plane_payload(vb, 0, q_data->sizeimage);
++
++	switch (vb->memory) {
++	case VB2_MEMORY_DMABUF:
++		dma_buf = dma_buf_get(vb->planes[0].m.fd);
++
++		if (dma_buf != buf->mmal.dma_buf) {
++			/* dmabuf either hasn't already been mapped, or it has
++			 * changed.
++			 */
++			if (buf->mmal.dma_buf) {
++				v4l2_err(&ctx->dev->v4l2_dev,
++					 "%s Buffer changed - why did the core not call cleanup?\n",
++					 __func__);
++				bcm2835_codec_mmal_buf_cleanup(&buf->mmal);
++			}
++
++			buf->mmal.dma_buf = dma_buf;
++		} else {
++			/* We already have a reference count on the dmabuf, so
++			 * release the one we acquired above.
++			 */
++			dma_buf_put(dma_buf);
++		}
++		ret = 0;
++		break;
++	case VB2_MEMORY_MMAP:
++		/*
++		 * We want to do this at init, but vb2_core_expbuf checks that
++		 * the index < q->num_buffers, and q->num_buffers only gets
++		 * updated once all the buffers are allocated.
++		 */
++		if (!buf->mmal.dma_buf) {
++			ret = vb2_core_expbuf_dmabuf(vb->vb2_queue,
++						     vb->vb2_queue->type,
++						     vb, 0, O_CLOEXEC,
++						     &buf->mmal.dma_buf);
++			if (ret)
++				v4l2_err(&ctx->dev->v4l2_dev,
++					 "%s: Failed to expbuf idx %d, ret %d\n",
++					 __func__, vb->index, ret);
++		} else {
++			ret = 0;
++		}
++		break;
++	default:
++		ret = -EINVAL;
++		break;
++	}
++
++	return ret;
++}
++
++static void bcm2835_codec_buf_queue(struct vb2_buffer *vb)
++{
++	struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
++	struct bcm2835_codec_ctx *ctx = vb2_get_drv_priv(vb->vb2_queue);
++
++	v4l2_dbg(4, debug, &ctx->dev->v4l2_dev, "%s: type: %d ptr %p vbuf->flags %u, seq %u, bytesused %u\n",
++		 __func__, vb->vb2_queue->type, vb, vbuf->flags, vbuf->sequence,
++		 vb->planes[0].bytesused);
++	v4l2_m2m_buf_queue(ctx->fh.m2m_ctx, vbuf);
++}
++
++static void bcm2835_codec_buffer_cleanup(struct vb2_buffer *vb)
++{
++	struct bcm2835_codec_ctx *ctx = vb2_get_drv_priv(vb->vb2_queue);
++	struct vb2_v4l2_buffer *vb2 = to_vb2_v4l2_buffer(vb);
++	struct v4l2_m2m_buffer *m2m = container_of(vb2, struct v4l2_m2m_buffer,
++						   vb);
++	struct m2m_mmal_buffer *buf = container_of(m2m, struct m2m_mmal_buffer,
++						   m2m);
++
++	v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s: ctx:%p, vb %p\n",
++		 __func__, ctx, vb);
++
++	bcm2835_codec_mmal_buf_cleanup(&buf->mmal);
++}
++
++static void bcm2835_codec_flush_buffers(struct bcm2835_codec_ctx *ctx,
++					struct vchiq_mmal_port *port)
++{
++	int ret;
++
++	if (atomic_read(&port->buffers_with_vpu)) {
++		v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: Waiting for buffers to be returned - %d outstanding\n",
++			 __func__, atomic_read(&port->buffers_with_vpu));
++		ret = wait_for_completion_timeout(&ctx->frame_cmplt,
++						  COMPLETE_TIMEOUT);
++		if (ret <= 0) {
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: Timeout waiting for buffers to be returned - %d outstanding\n",
++				 __func__,
++				 atomic_read(&port->buffers_with_vpu));
++		}
++	}
++}
++static int bcm2835_codec_start_streaming(struct vb2_queue *q,
++					 unsigned int count)
++{
++	struct bcm2835_codec_ctx *ctx = vb2_get_drv_priv(q);
++	struct bcm2835_codec_dev *dev = ctx->dev;
++	struct bcm2835_codec_q_data *q_data = get_q_data(ctx, q->type);
++	struct vchiq_mmal_port *port = get_port_data(ctx, q->type);
++	int ret = 0;
++
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: type: %d count %d\n",
++		 __func__, q->type, count);
++	q_data->sequence = 0;
++
++	if (!ctx->component_enabled) {
++		ret = vchiq_mmal_component_enable(dev->instance,
++						  ctx->component);
++		if (ret)
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed enabling component, ret %d\n",
++				 __func__, ret);
++		ctx->component_enabled = true;
++	}
++
++	if (port->enabled) {
++		unsigned int num_buffers;
++
++		init_completion(&ctx->frame_cmplt);
++
++		/*
++		 * This should only ever happen with DECODE and the MMAL output
++		 * port that has been enabled for resolution changed events.
++		 * In this case no buffers have been allocated or sent to the
++		 * component, so warn on that.
++		 */
++		WARN_ON(ctx->dev->role != DECODE);
++		WARN_ON(q->type != V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
++		WARN_ON(atomic_read(&port->buffers_with_vpu));
++
++		/*
++		 * Disable will reread the port format, so retain buffer count.
++		 */
++		num_buffers = port->current_buffer.num;
++
++		ret = vchiq_mmal_port_disable(dev->instance, port);
++		if (ret)
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: Error disabling port update buffer count, ret %d\n",
++				 __func__, ret);
++		bcm2835_codec_flush_buffers(ctx, port);
++		port->current_buffer.num = num_buffers;
++	}
++
++	if (count < port->minimum_buffer.num)
++		count = port->minimum_buffer.num;
++
++	if (port->current_buffer.num < count + 1) {
++		v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s: ctx:%p, buffer count changed %u to %u\n",
++			 __func__, ctx, port->current_buffer.num, count + 1);
++
++		port->current_buffer.num = count + 1;
++		ret = vchiq_mmal_port_set_format(dev->instance, port);
++		if (ret)
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: Error updating buffer count, ret %d\n",
++				 __func__, ret);
++	}
++
++	if (dev->role == DECODE &&
++	    q->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE &&
++	    !ctx->component->output[0].enabled) {
++		/*
++		 * Decode needs to enable the MMAL output/V4L2 CAPTURE
++		 * port at this point too so that we have everything
++		 * set up for dynamic resolution changes.
++		 */
++		ret = vchiq_mmal_port_enable(dev->instance,
++					     &ctx->component->output[0],
++					     op_buffer_cb);
++		if (ret)
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed enabling o/p port, ret %d\n",
++				 __func__, ret);
++	}
++
++	if (q->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
++		/*
++		 * Create the EOS buffer.
++		 * We only need the MMAL part, and want to NOT attach a memory
++		 * buffer to it as it should only take flags.
++		 */
++		memset(&q_data->eos_buffer, 0, sizeof(q_data->eos_buffer));
++		mmal_vchi_buffer_init(dev->instance,
++				      &q_data->eos_buffer.mmal);
++		q_data->eos_buffer_in_use = false;
++
++		ret = vchiq_mmal_port_enable(dev->instance,
++					     port,
++					     ip_buffer_cb);
++		if (ret)
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed enabling i/p port, ret %d\n",
++				 __func__, ret);
++	} else {
++		if (!port->enabled) {
++			ret = vchiq_mmal_port_enable(dev->instance,
++						     port,
++						     op_buffer_cb);
++			if (ret)
++				v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed enabling o/p port, ret %d\n",
++					 __func__, ret);
++		}
++	}
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: Done, ret %d\n",
++		 __func__, ret);
++	return ret;
++}
++
++static void bcm2835_codec_stop_streaming(struct vb2_queue *q)
++{
++	struct bcm2835_codec_ctx *ctx = vb2_get_drv_priv(q);
++	struct bcm2835_codec_dev *dev = ctx->dev;
++	struct bcm2835_codec_q_data *q_data = get_q_data(ctx, q->type);
++	struct vchiq_mmal_port *port = get_port_data(ctx, q->type);
++	struct vb2_v4l2_buffer *vbuf;
++	int ret;
++
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: type: %d - return buffers\n",
++		 __func__, q->type);
++
++	init_completion(&ctx->frame_cmplt);
++
++	/* Clear out all buffers held by m2m framework */
++	for (;;) {
++		if (V4L2_TYPE_IS_OUTPUT(q->type))
++			vbuf = v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
++		else
++			vbuf = v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
++		if (!vbuf)
++			break;
++		v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: return buffer %p\n",
++			 __func__, vbuf);
++
++		v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_QUEUED);
++	}
++
++	/* Disable MMAL port - this will flush buffers back */
++	ret = vchiq_mmal_port_disable(dev->instance, port);
++	if (ret)
++		v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed disabling %s port, ret %d\n",
++			 __func__, V4L2_TYPE_IS_OUTPUT(q->type) ? "i/p" : "o/p",
++			 ret);
++
++	bcm2835_codec_flush_buffers(ctx, port);
++
++	if (dev->role == DECODE &&
++	    q->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE &&
++	    ctx->component->input[0].enabled) {
++		/*
++		 * For decode we need to keep the MMAL output port enabled for
++		 * resolution changed events whenever the input is enabled.
++		 */
++		ret = vchiq_mmal_port_enable(dev->instance,
++					     &ctx->component->output[0],
++					     op_buffer_cb);
++		if (ret)
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed enabling o/p port, ret %d\n",
++				 __func__, ret);
++	}
++
++	/* If both ports disabled, then disable the component */
++	if (ctx->component_enabled &&
++	    !ctx->component->input[0].enabled &&
++	    !ctx->component->output[0].enabled) {
++		ret = vchiq_mmal_component_disable(dev->instance,
++						   ctx->component);
++		if (ret)
++			v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed enabling component, ret %d\n",
++				 __func__, ret);
++		ctx->component_enabled = false;
++	}
++
++	if (V4L2_TYPE_IS_OUTPUT(q->type))
++		mmal_vchi_buffer_cleanup(&q_data->eos_buffer.mmal);
++
++	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: done\n", __func__);
++}
++
++static const struct vb2_ops bcm2835_codec_qops = {
++	.queue_setup	 = bcm2835_codec_queue_setup,
++	.buf_init	 = bcm2835_codec_buf_init,
++	.buf_prepare	 = bcm2835_codec_buf_prepare,
++	.buf_queue	 = bcm2835_codec_buf_queue,
++	.buf_cleanup	 = bcm2835_codec_buffer_cleanup,
++	.start_streaming = bcm2835_codec_start_streaming,
++	.stop_streaming  = bcm2835_codec_stop_streaming,
++	.wait_prepare	 = vb2_ops_wait_prepare,
++	.wait_finish	 = vb2_ops_wait_finish,
++};
++
++static int queue_init(void *priv, struct vb2_queue *src_vq,
++		      struct vb2_queue *dst_vq)
++{
++	struct bcm2835_codec_ctx *ctx = priv;
++	int ret;
++
++	src_vq->type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE;
++	src_vq->io_modes = VB2_MMAP | VB2_DMABUF;
++	src_vq->drv_priv = ctx;
++	src_vq->buf_struct_size = sizeof(struct m2m_mmal_buffer);
++	src_vq->ops = &bcm2835_codec_qops;
++	src_vq->mem_ops = &vb2_dma_contig_memops;
++	src_vq->dev = &ctx->dev->device->dev;
++	src_vq->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;
++	src_vq->lock = &ctx->dev->dev_mutex;
++
++	ret = vb2_queue_init(src_vq);
++	if (ret)
++		return ret;
++
++	dst_vq->type = V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE;
++	dst_vq->io_modes = VB2_MMAP | VB2_DMABUF;
++	dst_vq->drv_priv = ctx;
++	dst_vq->buf_struct_size = sizeof(struct m2m_mmal_buffer);
++	dst_vq->ops = &bcm2835_codec_qops;
++	dst_vq->mem_ops = &vb2_dma_contig_memops;
++	dst_vq->dev = &ctx->dev->device->dev;
++	dst_vq->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;
++	dst_vq->lock = &ctx->dev->dev_mutex;
++
++	return vb2_queue_init(dst_vq);
++}
++
++static void dec_add_profile_ctrls(struct bcm2835_codec_dev *const dev,
++				  struct v4l2_ctrl_handler *const hdl)
++{
++	struct v4l2_ctrl *ctrl;
++	unsigned int i;
++	const struct bcm2835_codec_fmt_list *const list = &dev->supported_fmts[0];
++
++	for (i = 0; i < list->num_entries; ++i) {
++		switch (list->list[i].fourcc) {
++		case V4L2_PIX_FMT_H264:
++			ctrl = v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++						      V4L2_CID_MPEG_VIDEO_H264_LEVEL,
++						      V4L2_MPEG_VIDEO_H264_LEVEL_5_1,
++						      ~(BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_0) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1B) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_1) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_2) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_3) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_0) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_1) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_2) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_0) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_1) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_2) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_0) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_1) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_2) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_0) |
++							BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_1)),
++						       V4L2_MPEG_VIDEO_H264_LEVEL_4_0);
++			ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++			ctrl = v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++						      V4L2_CID_MPEG_VIDEO_H264_PROFILE,
++						      V4L2_MPEG_VIDEO_H264_PROFILE_HIGH,
++						      ~(BIT(V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE) |
++							BIT(V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE) |
++							BIT(V4L2_MPEG_VIDEO_H264_PROFILE_MAIN) |
++							BIT(V4L2_MPEG_VIDEO_H264_PROFILE_HIGH)),
++						       V4L2_MPEG_VIDEO_H264_PROFILE_HIGH);
++			ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++			break;
++		case V4L2_PIX_FMT_MPEG2:
++			ctrl = v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++						      V4L2_CID_MPEG_VIDEO_MPEG2_LEVEL,
++						      V4L2_MPEG_VIDEO_MPEG2_LEVEL_HIGH,
++						      ~(BIT(V4L2_MPEG_VIDEO_MPEG2_LEVEL_LOW) |
++							BIT(V4L2_MPEG_VIDEO_MPEG2_LEVEL_MAIN) |
++							BIT(V4L2_MPEG_VIDEO_MPEG2_LEVEL_HIGH_1440) |
++							BIT(V4L2_MPEG_VIDEO_MPEG2_LEVEL_HIGH)),
++						      V4L2_MPEG_VIDEO_MPEG2_LEVEL_MAIN);
++			ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++			ctrl = v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++						      V4L2_CID_MPEG_VIDEO_MPEG2_PROFILE,
++						      V4L2_MPEG_VIDEO_MPEG2_PROFILE_MAIN,
++						      ~(BIT(V4L2_MPEG_VIDEO_MPEG2_PROFILE_SIMPLE) |
++							BIT(V4L2_MPEG_VIDEO_MPEG2_PROFILE_MAIN)),
++						      V4L2_MPEG_VIDEO_MPEG2_PROFILE_MAIN);
++			ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++			break;
++		case V4L2_PIX_FMT_MPEG4:
++			ctrl = v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++						      V4L2_CID_MPEG_VIDEO_MPEG4_LEVEL,
++						      V4L2_MPEG_VIDEO_MPEG4_LEVEL_5,
++						      ~(BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_0) |
++							BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_0B) |
++							BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_1) |
++							BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_2) |
++							BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_3) |
++							BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_3B) |
++							BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_4) |
++							BIT(V4L2_MPEG_VIDEO_MPEG4_LEVEL_5)),
++						      V4L2_MPEG_VIDEO_MPEG4_LEVEL_4);
++			ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++			ctrl = v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++						      V4L2_CID_MPEG_VIDEO_MPEG4_PROFILE,
++						      V4L2_MPEG_VIDEO_MPEG4_PROFILE_ADVANCED_SIMPLE,
++						      ~(BIT(V4L2_MPEG_VIDEO_MPEG4_PROFILE_SIMPLE) |
++							BIT(V4L2_MPEG_VIDEO_MPEG4_PROFILE_ADVANCED_SIMPLE)),
++						      V4L2_MPEG_VIDEO_MPEG4_PROFILE_ADVANCED_SIMPLE);
++			ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++			break;
++		/* No profiles defined by V4L2 */
++		case V4L2_PIX_FMT_H263:
++		case V4L2_PIX_FMT_JPEG:
++		case V4L2_PIX_FMT_MJPEG:
++		case V4L2_PIX_FMT_VC1_ANNEX_G:
++		default:
++			break;
++		}
++	}
++}
++
++/*
++ * File operations
++ */
++static int bcm2835_codec_open(struct file *file)
++{
++	struct bcm2835_codec_dev *dev = video_drvdata(file);
++	struct bcm2835_codec_ctx *ctx = NULL;
++	struct v4l2_ctrl_handler *hdl;
++	int rc = 0;
++
++	if (mutex_lock_interruptible(&dev->dev_mutex)) {
++		v4l2_err(&dev->v4l2_dev, "Mutex fail\n");
++		return -ERESTARTSYS;
++	}
++	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
++	if (!ctx) {
++		rc = -ENOMEM;
++		goto open_unlock;
++	}
++
++	ctx->q_data[V4L2_M2M_SRC].fmt = get_default_format(dev, false);
++	ctx->q_data[V4L2_M2M_DST].fmt = get_default_format(dev, true);
++
++	ctx->q_data[V4L2_M2M_SRC].crop_width = DEFAULT_WIDTH;
++	ctx->q_data[V4L2_M2M_SRC].crop_height = DEFAULT_HEIGHT;
++	ctx->q_data[V4L2_M2M_SRC].height = DEFAULT_HEIGHT;
++	ctx->q_data[V4L2_M2M_SRC].bytesperline =
++			get_bytesperline(DEFAULT_WIDTH, DEFAULT_HEIGHT,
++					 ctx->q_data[V4L2_M2M_SRC].fmt,
++					 dev->role);
++	ctx->q_data[V4L2_M2M_SRC].sizeimage =
++		get_sizeimage(ctx->q_data[V4L2_M2M_SRC].bytesperline,
++			      ctx->q_data[V4L2_M2M_SRC].crop_width,
++			      ctx->q_data[V4L2_M2M_SRC].height,
++			      ctx->q_data[V4L2_M2M_SRC].fmt);
++	ctx->q_data[V4L2_M2M_SRC].field = V4L2_FIELD_NONE;
++
++	ctx->q_data[V4L2_M2M_DST].crop_width = DEFAULT_WIDTH;
++	ctx->q_data[V4L2_M2M_DST].crop_height = DEFAULT_HEIGHT;
++	ctx->q_data[V4L2_M2M_DST].height = DEFAULT_HEIGHT;
++	ctx->q_data[V4L2_M2M_DST].bytesperline =
++			get_bytesperline(DEFAULT_WIDTH, DEFAULT_HEIGHT,
++					 ctx->q_data[V4L2_M2M_DST].fmt,
++					 dev->role);
++	ctx->q_data[V4L2_M2M_DST].sizeimage =
++		get_sizeimage(ctx->q_data[V4L2_M2M_DST].bytesperline,
++			      ctx->q_data[V4L2_M2M_DST].crop_width,
++			      ctx->q_data[V4L2_M2M_DST].height,
++			      ctx->q_data[V4L2_M2M_DST].fmt);
++	ctx->q_data[V4L2_M2M_DST].aspect_ratio.numerator = 1;
++	ctx->q_data[V4L2_M2M_DST].aspect_ratio.denominator = 1;
++	ctx->q_data[V4L2_M2M_DST].field = V4L2_FIELD_NONE;
++
++	ctx->colorspace = V4L2_COLORSPACE_REC709;
++	ctx->bitrate = 10 * 1000 * 1000;
++
++	ctx->framerate_num = 30;
++	ctx->framerate_denom = 1;
++
++	/* Initialise V4L2 contexts */
++	v4l2_fh_init(&ctx->fh, video_devdata(file));
++	file->private_data = &ctx->fh;
++	ctx->dev = dev;
++	hdl = &ctx->hdl;
++	switch (dev->role) {
++	case ENCODE:
++	{
++		/* Encode controls */
++		v4l2_ctrl_handler_init(hdl, 13);
++
++		v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++				       V4L2_CID_MPEG_VIDEO_BITRATE_MODE,
++				       V4L2_MPEG_VIDEO_BITRATE_MODE_CBR, 0,
++				       V4L2_MPEG_VIDEO_BITRATE_MODE_VBR);
++		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
++				  V4L2_CID_MPEG_VIDEO_BITRATE,
++				  25 * 1000, 25 * 1000 * 1000,
++				  25 * 1000, 10 * 1000 * 1000);
++		v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++				       V4L2_CID_MPEG_VIDEO_HEADER_MODE,
++				       V4L2_MPEG_VIDEO_HEADER_MODE_JOINED_WITH_1ST_FRAME,
++				       0, V4L2_MPEG_VIDEO_HEADER_MODE_JOINED_WITH_1ST_FRAME);
++		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
++				  V4L2_CID_MPEG_VIDEO_REPEAT_SEQ_HEADER,
++				  0, 1,
++				  1, 0);
++		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
++				  V4L2_CID_MPEG_VIDEO_H264_I_PERIOD,
++				  0, 0x7FFFFFFF,
++				  1, 60);
++		v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++				       V4L2_CID_MPEG_VIDEO_H264_LEVEL,
++				       V4L2_MPEG_VIDEO_H264_LEVEL_5_1,
++				       ~(BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_0) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1B) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_1) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_2) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_3) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_0) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_1) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_2) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_0) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_1) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_2) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_0) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_1) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_2) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_0) |
++					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_1)),
++				       V4L2_MPEG_VIDEO_H264_LEVEL_4_0);
++		v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
++				       V4L2_CID_MPEG_VIDEO_H264_PROFILE,
++				       V4L2_MPEG_VIDEO_H264_PROFILE_HIGH,
++				       ~(BIT(V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE) |
++					 BIT(V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE) |
++					 BIT(V4L2_MPEG_VIDEO_H264_PROFILE_MAIN) |
++					 BIT(V4L2_MPEG_VIDEO_H264_PROFILE_HIGH)),
++					V4L2_MPEG_VIDEO_H264_PROFILE_HIGH);
++		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
++				  V4L2_CID_MPEG_VIDEO_H264_MIN_QP,
++				  0, 51,
++				  1, 20);
++		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
++				  V4L2_CID_MPEG_VIDEO_H264_MAX_QP,
++				  0, 51,
++				  1, 51);
++		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
++				  V4L2_CID_MPEG_VIDEO_FORCE_KEY_FRAME,
++				  0, 0, 0, 0);
++		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
++				  V4L2_CID_MPEG_VIDEO_B_FRAMES,
++				  0, 0,
++				  1, 0);
++		ctx->gop_size = v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
++						  V4L2_CID_MPEG_VIDEO_GOP_SIZE,
++						  0, 0x7FFFFFFF, 1, 60);
++		if (hdl->error) {
++			rc = hdl->error;
++			goto free_ctrl_handler;
++		}
++		ctx->fh.ctrl_handler = hdl;
++		v4l2_ctrl_handler_setup(hdl);
++	}
++	break;
++	case DECODE:
++	{
++		v4l2_ctrl_handler_init(hdl, 1 + dev->supported_fmts[0].num_entries * 2);
++
++		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
++				  V4L2_CID_MIN_BUFFERS_FOR_CAPTURE,
++				  1, 1, 1, 1);
++		dec_add_profile_ctrls(dev, hdl);
++		if (hdl->error) {
++			rc = hdl->error;
++			goto free_ctrl_handler;
++		}
++		ctx->fh.ctrl_handler = hdl;
++		v4l2_ctrl_handler_setup(hdl);
++	}
++	break;
++	case ISP:
++	{
++		v4l2_ctrl_handler_init(hdl, 2);
++
++		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
++				  V4L2_CID_HFLIP,
++				  1, 0, 1, 0);
++		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
++				  V4L2_CID_VFLIP,
++				  1, 0, 1, 0);
++		if (hdl->error) {
++			rc = hdl->error;
++			goto free_ctrl_handler;
++		}
++		ctx->fh.ctrl_handler = hdl;
++		v4l2_ctrl_handler_setup(hdl);
++	}
++	break;
++	case DEINTERLACE:
++	{
++		v4l2_ctrl_handler_init(hdl, 0);
++	}
++	break;
++	case ENCODE_IMAGE:
++	{
++		/* Encode image controls */
++		v4l2_ctrl_handler_init(hdl, 1);
++
++		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
++				  V4L2_CID_JPEG_COMPRESSION_QUALITY,
++				  1, 100,
++				  1, 80);
++		if (hdl->error) {
++			rc = hdl->error;
++			goto free_ctrl_handler;
++		}
++		ctx->fh.ctrl_handler = hdl;
++		v4l2_ctrl_handler_setup(hdl);
++	}
++	break;
++	case NUM_ROLES:
++	break;
++	}
++
++	ctx->fh.m2m_ctx = v4l2_m2m_ctx_init(dev->m2m_dev, ctx, &queue_init);
++
++	if (IS_ERR(ctx->fh.m2m_ctx)) {
++		rc = PTR_ERR(ctx->fh.m2m_ctx);
++
++		goto free_ctrl_handler;
++	}
++
++	/* Set both queues as buffered as we have buffering in the VPU. That
++	 * means that we will be scheduled whenever either an input or output
++	 * buffer is available (otherwise one of each are required).
++	 */
++	v4l2_m2m_set_src_buffered(ctx->fh.m2m_ctx, true);
++	v4l2_m2m_set_dst_buffered(ctx->fh.m2m_ctx, true);
++
++	ctx->fh.m2m_ctx->ignore_cap_streaming = true;
++
++	v4l2_fh_add(&ctx->fh);
++	atomic_inc(&dev->num_inst);
++
++	mutex_unlock(&dev->dev_mutex);
++	return 0;
++
++free_ctrl_handler:
++	v4l2_ctrl_handler_free(hdl);
++	kfree(ctx);
++open_unlock:
++	mutex_unlock(&dev->dev_mutex);
++	return rc;
++}
++
++static int bcm2835_codec_release(struct file *file)
++{
++	struct bcm2835_codec_dev *dev = video_drvdata(file);
++	struct bcm2835_codec_ctx *ctx = file2ctx(file);
++
++	v4l2_dbg(1, debug, &dev->v4l2_dev, "%s: Releasing instance %p\n",
++		 __func__, ctx);
++
++	v4l2_fh_del(&ctx->fh);
++	v4l2_fh_exit(&ctx->fh);
++	v4l2_ctrl_handler_free(&ctx->hdl);
++	mutex_lock(&dev->dev_mutex);
++	v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
++
++	if (ctx->component)
++		vchiq_mmal_component_finalise(dev->instance, ctx->component);
++
++	mutex_unlock(&dev->dev_mutex);
++	kfree(ctx);
++
++	atomic_dec(&dev->num_inst);
++
++	return 0;
++}
++
++static const struct v4l2_file_operations bcm2835_codec_fops = {
++	.owner		= THIS_MODULE,
++	.open		= bcm2835_codec_open,
++	.release	= bcm2835_codec_release,
++	.poll		= v4l2_m2m_fop_poll,
++	.unlocked_ioctl	= video_ioctl2,
++	.mmap		= v4l2_m2m_fop_mmap,
++};
++
++static const struct video_device bcm2835_codec_videodev = {
++	.name		= MEM2MEM_NAME,
++	.vfl_dir	= VFL_DIR_M2M,
++	.fops		= &bcm2835_codec_fops,
++	.ioctl_ops	= &bcm2835_codec_ioctl_ops,
++	.minor		= -1,
++	.release	= video_device_release_empty,
++};
++
++static const struct v4l2_m2m_ops m2m_ops = {
++	.device_run	= device_run,
++	.job_ready	= job_ready,
++	.job_abort	= job_abort,
++};
++
++/* Size of the array to provide to the VPU when asking for the list of supported
++ * formats.
++ * The ISP component currently advertises 62 input formats, so add a small
++ * overhead on that.
++ */
++#define MAX_SUPPORTED_ENCODINGS 70
++
++/* Populate dev->supported_fmts with the formats supported by those ports. */
++static int bcm2835_codec_get_supported_fmts(struct bcm2835_codec_dev *dev)
++{
++	struct bcm2835_codec_fmt *list;
++	struct vchiq_mmal_component *component;
++	u32 fourccs[MAX_SUPPORTED_ENCODINGS];
++	u32 param_size = sizeof(fourccs);
++	unsigned int i, j, num_encodings;
++	int ret;
++
++	ret = vchiq_mmal_component_init(dev->instance, components[dev->role],
++					&component);
++	if (ret < 0) {
++		v4l2_err(&dev->v4l2_dev, "%s: failed to create component %s\n",
++			 __func__, components[dev->role]);
++		return -ENOMEM;
++	}
++
++	ret = vchiq_mmal_port_parameter_get(dev->instance,
++					    &component->input[0],
++					    MMAL_PARAMETER_SUPPORTED_ENCODINGS,
++					    &fourccs,
++					    &param_size);
++
++	if (ret) {
++		if (ret == MMAL_MSG_STATUS_ENOSPC) {
++			v4l2_err(&dev->v4l2_dev,
++				 "%s: port has more encodings than we provided space for. Some are dropped (%zu vs %u).\n",
++				 __func__, param_size / sizeof(u32),
++				 MAX_SUPPORTED_ENCODINGS);
++			num_encodings = MAX_SUPPORTED_ENCODINGS;
++		} else {
++			v4l2_err(&dev->v4l2_dev, "%s: get_param ret %u.\n",
++				 __func__, ret);
++			ret = -EINVAL;
++			goto destroy_component;
++		}
++	} else {
++		num_encodings = param_size / sizeof(u32);
++	}
++
++	/* Assume at this stage that all encodings will be supported in V4L2.
++	 * Any that aren't supported will waste a very small amount of memory.
++	 */
++	list = devm_kzalloc(&dev->device->dev,
++			    sizeof(struct bcm2835_codec_fmt) * num_encodings,
++			    GFP_KERNEL);
++	if (!list) {
++		ret = -ENOMEM;
++		goto destroy_component;
++	}
++	dev->supported_fmts[0].list = list;
++
++	for (i = 0, j = 0; i < num_encodings; i++) {
++		const struct bcm2835_codec_fmt *fmt = get_fmt(fourccs[i]);
++
++		if (fmt) {
++			list[j] = *fmt;
++			j++;
++		}
++	}
++	dev->supported_fmts[0].num_entries = j;
++
++	param_size = sizeof(fourccs);
++	ret = vchiq_mmal_port_parameter_get(dev->instance,
++					    &component->output[0],
++					    MMAL_PARAMETER_SUPPORTED_ENCODINGS,
++					    &fourccs,
++					    &param_size);
++
++	if (ret) {
++		if (ret == MMAL_MSG_STATUS_ENOSPC) {
++			v4l2_err(&dev->v4l2_dev,
++				 "%s: port has more encodings than we provided space for. Some are dropped (%zu vs %u).\n",
++				 __func__, param_size / sizeof(u32),
++				 MAX_SUPPORTED_ENCODINGS);
++			num_encodings = MAX_SUPPORTED_ENCODINGS;
++		} else {
++			ret = -EINVAL;
++			goto destroy_component;
++		}
++	} else {
++		num_encodings = param_size / sizeof(u32);
++	}
++	/* Assume at this stage that all encodings will be supported in V4L2. */
++	list = devm_kzalloc(&dev->device->dev,
++			    sizeof(struct bcm2835_codec_fmt) * num_encodings,
++			    GFP_KERNEL);
++	if (!list) {
++		ret = -ENOMEM;
++		goto destroy_component;
++	}
++	dev->supported_fmts[1].list = list;
++
++	for (i = 0, j = 0; i < num_encodings; i++) {
++		const struct bcm2835_codec_fmt *fmt = get_fmt(fourccs[i]);
++
++		if (fmt) {
++			list[j] = *fmt;
++			j++;
++		}
++	}
++	dev->supported_fmts[1].num_entries = j;
++
++	ret = 0;
++
++destroy_component:
++	vchiq_mmal_component_finalise(dev->instance, component);
++
++	return ret;
++}
++
++static int bcm2835_codec_create(struct bcm2835_codec_driver *drv,
++				struct bcm2835_codec_dev **new_dev,
++				enum bcm2835_codec_role role)
++{
++	struct vchiq_device *device = drv->device;
++	struct bcm2835_codec_dev *dev;
++	struct video_device *vfd;
++	int function;
++	int video_nr;
++	int ret;
++
++	dev = devm_kzalloc(&device->dev, sizeof(*dev), GFP_KERNEL);
++	if (!dev)
++		return -ENOMEM;
++
++	dev->device = device;
++
++	dev->role = role;
++
++	ret = vchiq_mmal_init(&device->dev, &dev->instance);
++	if (ret)
++		return ret;
++
++	ret = bcm2835_codec_get_supported_fmts(dev);
++	if (ret)
++		goto vchiq_finalise;
++
++	atomic_set(&dev->num_inst, 0);
++	mutex_init(&dev->dev_mutex);
++
++	/* Initialise the video device */
++	dev->vfd = bcm2835_codec_videodev;
++
++	vfd = &dev->vfd;
++	vfd->lock = &dev->dev_mutex;
++	vfd->v4l2_dev = &dev->v4l2_dev;
++	vfd->device_caps = V4L2_CAP_VIDEO_M2M_MPLANE | V4L2_CAP_STREAMING;
++	vfd->v4l2_dev->mdev = &drv->mdev;
++
++	ret = v4l2_device_register(&device->dev, &dev->v4l2_dev);
++	if (ret)
++		goto vchiq_finalise;
++
++	dev->max_w = MAX_W_CODEC;
++	dev->max_h = MAX_H_CODEC;
++
++	switch (role) {
++	case DECODE:
++		v4l2_disable_ioctl(vfd, VIDIOC_ENCODER_CMD);
++		v4l2_disable_ioctl(vfd, VIDIOC_TRY_ENCODER_CMD);
++		v4l2_disable_ioctl(vfd, VIDIOC_S_PARM);
++		v4l2_disable_ioctl(vfd, VIDIOC_G_PARM);
++		function = MEDIA_ENT_F_PROC_VIDEO_DECODER;
++		video_nr = decode_video_nr;
++		break;
++	case ENCODE:
++		v4l2_disable_ioctl(vfd, VIDIOC_DECODER_CMD);
++		v4l2_disable_ioctl(vfd, VIDIOC_TRY_DECODER_CMD);
++		function = MEDIA_ENT_F_PROC_VIDEO_ENCODER;
++		video_nr = encode_video_nr;
++		break;
++	case ISP:
++		v4l2_disable_ioctl(vfd, VIDIOC_DECODER_CMD);
++		v4l2_disable_ioctl(vfd, VIDIOC_TRY_DECODER_CMD);
++		v4l2_disable_ioctl(vfd, VIDIOC_S_PARM);
++		v4l2_disable_ioctl(vfd, VIDIOC_G_PARM);
++		function = MEDIA_ENT_F_PROC_VIDEO_SCALER;
++		video_nr = isp_video_nr;
++		dev->max_w = MAX_W_ISP;
++		dev->max_h = MAX_H_ISP;
++		break;
++	case DEINTERLACE:
++		v4l2_disable_ioctl(vfd, VIDIOC_DECODER_CMD);
++		v4l2_disable_ioctl(vfd, VIDIOC_TRY_DECODER_CMD);
++		v4l2_disable_ioctl(vfd, VIDIOC_S_PARM);
++		v4l2_disable_ioctl(vfd, VIDIOC_G_PARM);
++		function = MEDIA_ENT_F_PROC_VIDEO_PIXEL_FORMATTER;
++		video_nr = deinterlace_video_nr;
++		break;
++	case ENCODE_IMAGE:
++		v4l2_disable_ioctl(vfd, VIDIOC_DECODER_CMD);
++		v4l2_disable_ioctl(vfd, VIDIOC_TRY_DECODER_CMD);
++		function = MEDIA_ENT_F_PROC_VIDEO_ENCODER;
++		video_nr = encode_image_nr;
++		break;
++	default:
++		ret = -EINVAL;
++		goto unreg_dev;
++	}
++
++	ret = video_register_device(vfd, VFL_TYPE_VIDEO, video_nr);
++	if (ret) {
++		v4l2_err(&dev->v4l2_dev, "Failed to register video device\n");
++		goto unreg_dev;
++	}
++
++	video_set_drvdata(vfd, dev);
++	snprintf(vfd->name, sizeof(vfd->name), "%s-%s",
++		 bcm2835_codec_videodev.name, roles[role]);
++	v4l2_info(&dev->v4l2_dev, "Device registered as /dev/video%d\n",
++		  vfd->num);
++
++	*new_dev = dev;
++
++	dev->m2m_dev = v4l2_m2m_init(&m2m_ops);
++	if (IS_ERR(dev->m2m_dev)) {
++		v4l2_err(&dev->v4l2_dev, "Failed to init mem2mem device\n");
++		ret = PTR_ERR(dev->m2m_dev);
++		goto err_m2m;
++	}
++
++	ret = v4l2_m2m_register_media_controller(dev->m2m_dev, vfd, function);
++	if (ret)
++		goto err_m2m;
++
++	v4l2_info(&dev->v4l2_dev, "Loaded V4L2 %s\n",
++		  roles[role]);
++	return 0;
++
++err_m2m:
++	v4l2_m2m_release(dev->m2m_dev);
++	video_unregister_device(&dev->vfd);
++unreg_dev:
++	v4l2_device_unregister(&dev->v4l2_dev);
++vchiq_finalise:
++	vchiq_mmal_finalise(dev->instance);
++	return ret;
++}
++
++static int bcm2835_codec_destroy(struct bcm2835_codec_dev *dev)
++{
++	if (!dev)
++		return -ENODEV;
++
++	v4l2_info(&dev->v4l2_dev, "Removing " MEM2MEM_NAME ", %s\n",
++		  roles[dev->role]);
++	v4l2_m2m_unregister_media_controller(dev->m2m_dev);
++	v4l2_m2m_release(dev->m2m_dev);
++	video_unregister_device(&dev->vfd);
++	v4l2_device_unregister(&dev->v4l2_dev);
++	vchiq_mmal_finalise(dev->instance);
++
++	return 0;
++}
++
++static int bcm2835_codec_probe(struct vchiq_device *device)
++{
++	struct bcm2835_codec_driver *drv;
++	struct media_device *mdev;
++	int ret = 0;
++
++	ret = dma_set_mask_and_coherent(&device->dev, DMA_BIT_MASK(32));
++	if (ret) {
++		dev_err(&device->dev, "dma_set_mask_and_coherent failed: %d\n",
++			ret);
++		return ret;
++	}
++
++	drv = devm_kzalloc(&device->dev, sizeof(*drv), GFP_KERNEL);
++	if (!drv)
++		return -ENOMEM;
++
++	drv->device = device;
++	mdev = &drv->mdev;
++	mdev->dev = &device->dev;
++
++	strscpy(mdev->model, bcm2835_codec_videodev.name, sizeof(mdev->model));
++	strscpy(mdev->serial, "0000", sizeof(mdev->serial));
++	snprintf(mdev->bus_info, sizeof(mdev->bus_info), "vchiq:%s",
++		 MEM2MEM_NAME);
++
++	/* This should return the vgencmd version information or such .. */
++	mdev->hw_revision = 1;
++	media_device_init(mdev);
++
++	ret = bcm2835_codec_create(drv, &drv->decode, DECODE);
++	if (ret)
++		goto out;
++
++	ret = bcm2835_codec_create(drv, &drv->encode, ENCODE);
++	if (ret)
++		goto out;
++
++	ret = bcm2835_codec_create(drv, &drv->isp, ISP);
++	if (ret)
++		goto out;
++
++	ret = bcm2835_codec_create(drv, &drv->deinterlace, DEINTERLACE);
++	if (ret)
++		goto out;
++
++	ret = bcm2835_codec_create(drv, &drv->encode_image, ENCODE_IMAGE);
++	if (ret)
++		goto out;
++
++	/* Register the media device node */
++	if (media_device_register(mdev) < 0)
++		goto out;
++
++	vchiq_set_drvdata(device, drv);
++
++	return 0;
++
++out:
++	if (drv->encode_image) {
++		bcm2835_codec_destroy(drv->encode_image);
++		drv->encode_image = NULL;
++	}
++	if (drv->deinterlace) {
++		bcm2835_codec_destroy(drv->deinterlace);
++		drv->deinterlace = NULL;
++	}
++	if (drv->isp) {
++		bcm2835_codec_destroy(drv->isp);
++		drv->isp = NULL;
++	}
++	if (drv->encode) {
++		bcm2835_codec_destroy(drv->encode);
++		drv->encode = NULL;
++	}
++	if (drv->decode) {
++		bcm2835_codec_destroy(drv->decode);
++		drv->decode = NULL;
++	}
++	return ret;
++}
++
++static void bcm2835_codec_remove(struct vchiq_device *device)
++{
++	struct bcm2835_codec_driver *drv = vchiq_get_drvdata(device);
++
++	media_device_unregister(&drv->mdev);
++
++	bcm2835_codec_destroy(drv->encode_image);
++
++	bcm2835_codec_destroy(drv->deinterlace);
++
++	bcm2835_codec_destroy(drv->isp);
++
++	bcm2835_codec_destroy(drv->encode);
++
++	bcm2835_codec_destroy(drv->decode);
++
++	media_device_cleanup(&drv->mdev);
++}
++
++static struct vchiq_driver bcm2835_v4l2_codec_driver = {
++	.probe = bcm2835_codec_probe,
++	.remove = bcm2835_codec_remove,
++	.driver = {
++		   .name = "bcm2835-codec",
++		   .owner = THIS_MODULE,
++		   },
++};
++
++module_vchiq_driver(bcm2835_v4l2_codec_driver);
++
++MODULE_DESCRIPTION("BCM2835 codec V4L2 driver");
++MODULE_AUTHOR("Dave Stevenson, <dave.stevenson@raspberrypi.com>");
++MODULE_LICENSE("GPL");
++MODULE_VERSION("0.0.1");
++MODULE_ALIAS("vchiq:bcm2835-codec");
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
+@@ -223,6 +223,8 @@ enum mmal_parameter_camera_type {
+ 	MMAL_PARAMETER_SHUTTER_SPEED,
+ 		/**< Takes a @ref MMAL_PARAMETER_AWB_GAINS_T */
+ 	MMAL_PARAMETER_CUSTOM_AWB_GAINS,
++		/**< Takes a @ref MMAL_PARAMETER_BOOLEAN_T */
++	MMAL_PARAMETER_JPEG_IJG_SCALING,
+ };
+ 
+ enum mmal_parameter_camera_config_timestamp_mode {
+@@ -615,6 +617,12 @@ enum mmal_parameter_video_type {
+ 
+ 	/**< Take a @ref MMAL_PARAMETER_BOOLEAN_T */
+ 	MMAL_PARAMETER_VIDEO_ENCODE_HEADERS_WITH_FRAME,
++
++	/**< Take a @ref MMAL_PARAMETER_BOOLEAN_T */
++	MMAL_PARAMETER_VIDEO_VALIDATE_TIMESTAMPS,
++
++	/**< Takes a @ref MMAL_PARAMETER_BOOLEAN_T */
++	MMAL_PARAMETER_VIDEO_STOP_ON_PAR_COLOUR_CHANGE,
+ };
+ 
+ /** Valid mirror modes */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0205-uapi-bcm2835-isp-Add-bcm2835-isp-uapi-header-file.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0205-uapi-bcm2835-isp-Add-bcm2835-isp-uapi-header-file.patch
new file mode 100644
index 00000000..556cf64a
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0205-uapi-bcm2835-isp-Add-bcm2835-isp-uapi-header-file.patch
@@ -0,0 +1,338 @@
+From b2849d11717406109a1d0953e019dd27f08fa9d9 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 12 Oct 2020 17:03:14 +0100
+Subject: [PATCH 205/697] uapi: bcm2835-isp: Add bcm2835-isp uapi header file
+
+This file defines the userland interface to the bcm2835-isp driver
+that will follow in a separate commit.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ include/uapi/linux/bcm2835-isp.h | 320 +++++++++++++++++++++++++++++++
+ 1 file changed, 320 insertions(+)
+ create mode 100644 include/uapi/linux/bcm2835-isp.h
+
+--- /dev/null
++++ b/include/uapi/linux/bcm2835-isp.h
+@@ -0,0 +1,320 @@
++/* SPDX-License-Identifier: ((GPL-2.0+ WITH Linux-syscall-note) OR BSD-3-Clause) */
++/*
++ * bcm2835-isp.h
++ *
++ * BCM2835 ISP driver - user space header file.
++ *
++ * Copyright © 2019-2020 Raspberry Pi (Trading) Ltd.
++ *
++ * Author: Naushir Patuck (naush@raspberrypi.com)
++ *
++ */
++
++#ifndef __BCM2835_ISP_H_
++#define __BCM2835_ISP_H_
++
++#include <linux/v4l2-controls.h>
++
++#define V4L2_CID_USER_BCM2835_ISP_CC_MATRIX	\
++				(V4L2_CID_USER_BCM2835_ISP_BASE + 0x0001)
++#define V4L2_CID_USER_BCM2835_ISP_LENS_SHADING	\
++				(V4L2_CID_USER_BCM2835_ISP_BASE + 0x0002)
++#define V4L2_CID_USER_BCM2835_ISP_BLACK_LEVEL	\
++				(V4L2_CID_USER_BCM2835_ISP_BASE + 0x0003)
++#define V4L2_CID_USER_BCM2835_ISP_GEQ		\
++				(V4L2_CID_USER_BCM2835_ISP_BASE + 0x0004)
++#define V4L2_CID_USER_BCM2835_ISP_GAMMA		\
++				(V4L2_CID_USER_BCM2835_ISP_BASE + 0x0005)
++#define V4L2_CID_USER_BCM2835_ISP_DENOISE	\
++				(V4L2_CID_USER_BCM2835_ISP_BASE + 0x0006)
++#define V4L2_CID_USER_BCM2835_ISP_SHARPEN	\
++				(V4L2_CID_USER_BCM2835_ISP_BASE + 0x0007)
++#define V4L2_CID_USER_BCM2835_ISP_DPC		\
++				(V4L2_CID_USER_BCM2835_ISP_BASE + 0x0008)
++
++/*
++ * All structs below are directly mapped onto the equivalent structs in
++ * drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
++ * for convenience.
++ */
++
++/**
++ * struct bcm2835_isp_rational - Rational value type.
++ *
++ * @num:	Numerator.
++ * @den:	Denominator.
++ */
++struct bcm2835_isp_rational {
++	__s32 num;
++	__u32 den;
++};
++
++/**
++ * struct bcm2835_isp_ccm - Colour correction matrix.
++ *
++ * @ccm:	3x3 correction matrix coefficients.
++ * @offsets:	1x3 correction offsets.
++ */
++struct bcm2835_isp_ccm {
++	struct bcm2835_isp_rational ccm[3][3];
++	__s32 offsets[3];
++};
++
++/**
++ * struct bcm2835_isp_custom_ccm - Custom CCM applied with the
++ *				   V4L2_CID_USER_BCM2835_ISP_CC_MATRIX ctrl.
++ *
++ * @enabled:	Enable custom CCM.
++ * @ccm:	Custom CCM coefficients and offsets.
++ */
++struct bcm2835_isp_custom_ccm {
++	__u32 enabled;
++	struct bcm2835_isp_ccm ccm;
++};
++
++/**
++ * enum bcm2835_isp_gain_format - format of the gains in the lens shading
++ *				  tables used with the
++ *				  V4L2_CID_USER_BCM2835_ISP_LENS_SHADING ctrl.
++ *
++ * @GAIN_FORMAT_U0P8_1:		Gains are u0.8 format, starting at 1.0
++ * @GAIN_FORMAT_U1P7_0:		Gains are u1.7 format, starting at 0.0
++ * @GAIN_FORMAT_U1P7_1:		Gains are u1.7 format, starting at 1.0
++ * @GAIN_FORMAT_U2P6_0:		Gains are u2.6 format, starting at 0.0
++ * @GAIN_FORMAT_U2P6_1:		Gains are u2.6 format, starting at 1.0
++ * @GAIN_FORMAT_U3P5_0:		Gains are u3.5 format, starting at 0.0
++ * @GAIN_FORMAT_U3P5_1:		Gains are u3.5 format, starting at 1.0
++ * @GAIN_FORMAT_U4P10:		Gains are u4.10 format, starting at 0.0
++ */
++enum bcm2835_isp_gain_format {
++	GAIN_FORMAT_U0P8_1 = 0,
++	GAIN_FORMAT_U1P7_0 = 1,
++	GAIN_FORMAT_U1P7_1 = 2,
++	GAIN_FORMAT_U2P6_0 = 3,
++	GAIN_FORMAT_U2P6_1 = 4,
++	GAIN_FORMAT_U3P5_0 = 5,
++	GAIN_FORMAT_U3P5_1 = 6,
++	GAIN_FORMAT_U4P10  = 7,
++};
++
++/**
++ * struct bcm2835_isp_lens_shading - Lens shading tables supplied with the
++ *				     V4L2_CID_USER_BCM2835_ISP_LENS_SHADING
++ *				     ctrl.
++ *
++ * @enabled:		Enable lens shading.
++ * @grid_cell_size:	Size of grid cells in samples (16, 32, 64, 128 or 256).
++ * @grid_width:		Width of lens shading tables in grid cells.
++ * @grid_stride:	Row to row distance (in grid cells) between grid cells
++ *			in the same horizontal location.
++ * @grid_height:	Height of lens shading tables in grid cells.
++ * @dmabuf:		dmabuf file handle containing the table.
++ * @ref_transform:	Reference transform - unsupported, please pass zero.
++ * @corner_sampled:	Whether the gains are sampled at the corner points
++ *			of the grid cells or in the cell centres.
++ * @gain_format:	Format of the gains (see enum &bcm2835_isp_gain_format).
++ */
++struct bcm2835_isp_lens_shading {
++	__u32 enabled;
++	__u32 grid_cell_size;
++	__u32 grid_width;
++	__u32 grid_stride;
++	__u32 grid_height;
++	__s32 dmabuf;
++	__u32 ref_transform;
++	__u32 corner_sampled;
++	__u32 gain_format;
++};
++
++/**
++ * struct bcm2835_isp_black_level - Sensor black level set with the
++ *				    V4L2_CID_USER_BCM2835_ISP_BLACK_LEVEL ctrl.
++ *
++ * @enabled:		Enable black level.
++ * @black_level_r:	Black level for red channel.
++ * @black_level_g:	Black level for green channels.
++ * @black_level_b:	Black level for blue channel.
++ */
++struct bcm2835_isp_black_level {
++	__u32 enabled;
++	__u16 black_level_r;
++	__u16 black_level_g;
++	__u16 black_level_b;
++	__u8 padding[2]; /* Unused */
++};
++
++/**
++ * struct bcm2835_isp_geq - Green equalisation parameters set with the
++ *			    V4L2_CID_USER_BCM2835_ISP_GEQ ctrl.
++ *
++ * @enabled:	Enable green equalisation.
++ * @offset:	Fixed offset of the green equalisation threshold.
++ * @slope:	Slope of the green equalisation threshold.
++ */
++struct bcm2835_isp_geq {
++	__u32 enabled;
++	__u32 offset;
++	struct bcm2835_isp_rational slope;
++};
++
++#define BCM2835_NUM_GAMMA_PTS 33
++
++/**
++ * struct bcm2835_isp_gamma - Gamma parameters set with the
++ *			      V4L2_CID_USER_BCM2835_ISP_GAMMA ctrl.
++ *
++ * @enabled:	Enable gamma adjustment.
++ * @X:		X values of the points defining the gamma curve.
++ *		Values should be scaled to 16 bits.
++ * @Y:		Y values of the points defining the gamma curve.
++ *		Values should be scaled to 16 bits.
++ */
++struct bcm2835_isp_gamma {
++	__u32 enabled;
++	__u16 x[BCM2835_NUM_GAMMA_PTS];
++	__u16 y[BCM2835_NUM_GAMMA_PTS];
++};
++
++/**
++ * struct bcm2835_isp_denoise - Denoise parameters set with the
++ *				V4L2_CID_USER_BCM2835_ISP_DENOISE ctrl.
++ *
++ * @enabled:	Enable denoise.
++ * @constant:	Fixed offset of the noise threshold.
++ * @slope:	Slope of the noise threshold.
++ * @strength:	Denoise strength between 0.0 (off) and 1.0 (maximum).
++ */
++struct bcm2835_isp_denoise {
++	__u32 enabled;
++	__u32 constant;
++	struct bcm2835_isp_rational slope;
++	struct bcm2835_isp_rational strength;
++};
++
++/**
++ * struct bcm2835_isp_sharpen - Sharpen parameters set with the
++ *				V4L2_CID_USER_BCM2835_ISP_SHARPEN ctrl.
++ *
++ * @enabled:	Enable sharpening.
++ * @threshold:	Threshold at which to start sharpening pixels.
++ * @strength:	Strength with which pixel sharpening increases.
++ * @limit:	Limit to the amount of sharpening applied.
++ */
++struct bcm2835_isp_sharpen {
++	__u32 enabled;
++	struct bcm2835_isp_rational threshold;
++	struct bcm2835_isp_rational strength;
++	struct bcm2835_isp_rational limit;
++};
++
++/**
++ * enum bcm2835_isp_dpc_mode - defective pixel correction (DPC) strength.
++ *
++ * @DPC_MODE_OFF:		No DPC.
++ * @DPC_MODE_NORMAL:		Normal DPC.
++ * @DPC_MODE_STRONG:		Strong DPC.
++ */
++enum bcm2835_isp_dpc_mode {
++	DPC_MODE_OFF = 0,
++	DPC_MODE_NORMAL = 1,
++	DPC_MODE_STRONG = 2,
++};
++
++/**
++ * struct bcm2835_isp_dpc - Defective pixel correction (DPC) parameters set
++ *			    with the V4L2_CID_USER_BCM2835_ISP_DPC ctrl.
++ *
++ * @enabled:	Enable DPC.
++ * @strength:	DPC strength (see enum &bcm2835_isp_dpc_mode).
++ */
++struct bcm2835_isp_dpc {
++	__u32 enabled;
++	__u32 strength;
++};
++
++/*
++ * ISP statistics structures.
++ *
++ * The bcm2835_isp_stats structure is generated at the output of the
++ * statistics node.  Note that this does not directly map onto the statistics
++ * output of the ISP HW.  Instead, the MMAL firmware code maps the HW statistics
++ * to the bcm2835_isp_stats structure.
++ */
++#define DEFAULT_AWB_REGIONS_X 16
++#define DEFAULT_AWB_REGIONS_Y 12
++
++#define NUM_HISTOGRAMS 2
++#define NUM_HISTOGRAM_BINS 128
++#define AWB_REGIONS (DEFAULT_AWB_REGIONS_X * DEFAULT_AWB_REGIONS_Y)
++#define FLOATING_REGIONS 16
++#define AGC_REGIONS 16
++#define FOCUS_REGIONS 12
++
++/**
++ * struct bcm2835_isp_stats_hist - Histogram statistics
++ *
++ * @r_hist:	Red channel histogram.
++ * @g_hist:	Combined green channel histogram.
++ * @b_hist:	Blue channel histogram.
++ */
++struct bcm2835_isp_stats_hist {
++	__u32 r_hist[NUM_HISTOGRAM_BINS];
++	__u32 g_hist[NUM_HISTOGRAM_BINS];
++	__u32 b_hist[NUM_HISTOGRAM_BINS];
++};
++
++/**
++ * struct bcm2835_isp_stats_region - Region sums.
++ *
++ * @counted:	The number of 2x2 bayer tiles accumulated.
++ * @notcounted:	The number of 2x2 bayer tiles not accumulated.
++ * @r_sum:	Total sum of counted pixels in the red channel for a region.
++ * @g_sum:	Total sum of counted pixels in the green channel for a region.
++ * @b_sum:	Total sum of counted pixels in the blue channel for a region.
++ */
++struct bcm2835_isp_stats_region {
++	__u32 counted;
++	__u32 notcounted;
++	__u64 r_sum;
++	__u64 g_sum;
++	__u64 b_sum;
++};
++
++/**
++ * struct bcm2835_isp_stats_focus - Focus statistics.
++ *
++ * @contrast_val:	Focus measure - accumulated output of the focus filter.
++ *			In the first dimension, index [0] counts pixels below a
++ *			preset threshold, and index [1] counts pixels above the
++ *			threshold.  In the second dimension, index [0] uses the
++ *			first predefined filter, and index [1] uses the second
++ *			predefined filter.
++ * @contrast_val_num:	The number of counted pixels in the above accumulation.
++ */
++struct bcm2835_isp_stats_focus {
++	__u64 contrast_val[2][2];
++	__u32 contrast_val_num[2][2];
++};
++
++/**
++ * struct bcm2835_isp_stats - ISP statistics.
++ *
++ * @version:		Version of the bcm2835_isp_stats structure.
++ * @size:		Size of the bcm2835_isp_stats structure.
++ * @hist:		Histogram statistics for the entire image.
++ * @awb_stats:		Statistics for the regions defined for AWB calculations.
++ * @floating_stats:	Statistics for arbitrarily placed (floating) regions.
++ * @agc_stats:		Statistics for the regions defined for AGC calculations.
++ * @focus_stats:	Focus filter statistics for the focus regions.
++ */
++struct bcm2835_isp_stats {
++	__u32 version;
++	__u32 size;
++	struct bcm2835_isp_stats_hist hist[NUM_HISTOGRAMS];
++	struct bcm2835_isp_stats_region awb_stats[AWB_REGIONS];
++	struct bcm2835_isp_stats_region floating_stats[FLOATING_REGIONS];
++	struct bcm2835_isp_stats_region agc_stats[AGC_REGIONS];
++	struct bcm2835_isp_stats_focus focus_stats[FOCUS_REGIONS];
++};
++
++#endif /* __BCM2835_ISP_H_ */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0206-staging-vc04_services-ISP-Add-a-more-complex-ISP-pro.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0206-staging-vc04_services-ISP-Add-a-more-complex-ISP-pro.patch
new file mode 100644
index 00000000..1da0f237
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0206-staging-vc04_services-ISP-Add-a-more-complex-ISP-pro.patch
@@ -0,0 +1,3127 @@
+From 5ab71159b7aba079dacfa119ece9425910a44645 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Thu, 23 Apr 2020 10:17:37 +0100
+Subject: [PATCH 206/697] staging: vc04_services: ISP: Add a more complex ISP
+ processing component
+
+Driver for the BCM2835 ISP hardware block.  This driver uses the MMAL
+component to program the ISP hardware through the VC firmware.
+
+The ISP component can produce two video stream outputs, and Bayer
+image statistics. This can't be encompassed in a simple V4L2
+M2M device, so create a new device that registers 4 video nodes.
+
+This patch squashes all the development patches from the earlier
+rpi-5.4.y branch into one
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+staging/bcm2835-isp: Add the unpacked (16bpp) raw formats
+
+Now that the firmware supports the unpacked (16bpp) variants
+of the MIPI raw formats, add the mappings.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging/bcm2835-isp: Log the number of excess supported formats
+
+When logging that the firmware has provided more supported formats
+than we had allocated storage for, log the number allocated and
+returned.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+staging: vc04_services: ISP: Add colour denoise control
+
+Add colour denoise control to the bcm2835 driver through a new v4l2
+control: V4L2_CID_USER_BCM2835_ISP_CDN.
+
+Add the accompanying MMAL configuration structure definitions as well.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+bcm2835-isp: Allow formats with different colour spaces.
+
+Each supported format now includes a mask showing the allowed colour
+spaces, as well as a default colour space for when one was not
+specified.
+
+Additionally we translate the colour space to mmal format and pass it
+over to the VideoCore.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+media: i2c: add ov9281 driver.
+
+Change-Id: I7b77250bbc56d2f861450cf77271ad15f9b88ab1
+Signed-off-by: Zefa Chen <zefa.chen@rock-chips.com>
+
+media: i2c: ov9281: fix mclk issue when probe multiple camera.
+
+Takes the ov9281 part only from the Rockchip's patch.
+
+Change-Id: I30e833baf2c1bb07d6d87ddb3b00759ab45a90e4
+Signed-off-by: Zefa Chen <zefa.chen@rock-chips.com>
+
+media: i2c: ov9281: add enum_frame_interval function for iq tool 2.2 and hal3
+
+Adds the ov9281 parts of the Rockchip patch adding enum_frame_interval to
+a large number of drivers.
+
+Change-Id: I03344cd6cf278dd7c18fce8e97479089ef185a5c
+Signed-off-by: Zefa Chen <zefa.chen@rock-chips.com>
+
+media: i2c: ov9281: Fixup for recent kernel releases, and remove custom code
+
+The Rockchip driver was based on a 4.4 kernel, and had several custom
+Rockchip parts.
+
+Update to 5.4 kernel APIs, with the relevant controls required by
+libcamera, and remove custom Rockchip parts.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: ov9281: Read chip ID via 2 reads
+
+Vision Components have made an OV9281 module which blocks reading
+back the majority of registers to comply with NDAs, and in doing
+so doesn't allow auto-increment register reading as used when
+reading the chip ID.
+
+Use two reads and manually combine the results.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: ov9281: Add support for 8 bit readout
+
+The sensor supports 8 bit mode as well as 10bit, so add the
+relevant code to allow selection of this.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: ov9281: Add 1280x720 and 640x480 modes
+
+Breaks out common register set and adds the different registers
+for 1280x720 (cropped) and 640x480 (skipped) modes
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+Fixed picture line bug in all ov9281 modes
+
+Signed-off-by: Mathias Anhalt <mathiasanhalt@web.de>
+
+Added hflip and vflip controls to ov9281
+
+Signed-off-by: Mathias Anhalt <mathiasanhalt@web.de>
+
+media: i2c: ov9281: Remove override of subdev name
+
+From the original Rockchip driver, the subdev was renamed
+from the default to being "mov9281 <dev_name>" whereas the
+default would have been "ov9281 <dev_name>".
+
+Remove the override to drop back to the default rather than
+a vendor custom string.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: v4l2-subdev: add subdev-wide state struct
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+media: i2c: ov9281: Add fwnode properties controls
+
+Add call to v4l2_ctrl_new_fwnode_properties to read and
+create the fwnode based controls.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: ov9281: Sensor should report RAW color space
+
+Tested on Raspberry Pi running libcamera.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+Partial revert "media: i2c: add ov9281 driver."
+
+This partially reverts commit 84e98e3a4f3eecb168ceb80231c3e8252929892e.
+
+The commit had merged some changes to other drivers with adding the ov9281
+driver. Only the ov9281 parts have been reverted.
+
+staging/bcm2835-isp: Fix compiler warning
+
+The result of dividing a u32 by a size_t is an unsigned int on arm32
+and a long unsigned int on arm64. Use "%zu" (the size_t format) to
+remove the build warning for 64-bit builds.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+staging: vc04_services: isp: Set the YUV420/YVU420 format stride to 64 bytes
+
+The bcm2835 ISP requires the base address of all input/output planes to have 32
+byte alignment. Using a Y stride of 32 bytes would not guarantee that the V
+plane would fulfil this, e.g. a height of 650 lines would mean the V plane
+buffer is not 32 byte aligned for YUV420 formats.
+
+Having a Y stride of 64 bytes would ensure both U and V planes have a 32 byte
+alignment, as the luma height will always be an even number of lines.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+vc04_services: isp: Report input node as wanting full range RAW color space
+
+RAW color spaces are more usually reported as having full range
+quantization.
+
+Tested using libcamera.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+drivers: bcm2835_isp: Allow multiple users for the ISP driver.
+
+Add a second (identical) set of device nodes to allow concurrent use of the ISP
+hardware by another user. This change effectively creates a second state
+structure (struct bcm2835_isp_dev) to maintain independent state for the second
+user. Node and media entity names are appened with the instance index
+appropriately.
+
+Further users can be added by changing the BCM2835_ISP_NUM_INSTANCES define.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+drivers: bcm2835_isp: Fix div by 0 bug.
+
+Fix a possible division by 0 bug when setting up the mmal port for the stats
+port.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+staging/bcm2835-isp: Fix cleanup after init fail
+
+bcm2835_isp_remove is called on an initialisation failure, but at that
+point the drvdata hasn't been set. This causes a crash when e.g. using
+the cutdown firmware (gpu_mem=16).
+
+Move platform_set_drvdata before the instance probing loop to avoid the
+problem.
+
+See: https://github.com/raspberrypi/linux/issues/4774
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+bcm2835-v4l2-isp: Add missing lock initialization
+
+ISP device allocation is dynamic hence the locks too.
+struct mutex queue_lock is not initialized which result in bug.
+
+Fixing same by initializing it.
+
+[   29.847138] INFO: trying to register non-static key.
+[   29.847156] The code is fine but needs lockdep annotation, or maybe
+[   29.847159] you didn't initialize this object before use?
+[   29.847161] turning off the locking correctness validator.
+[   29.847167] CPU: 1 PID: 343 Comm: v4l_id Tainted: G         C        5.15.11-rt24-v8+ #8
+[   29.847187] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT)
+[   29.847194] Call trace:
+[   29.847197]  dump_backtrace+0x0/0x1b8
+[   29.847227]  show_stack+0x20/0x30
+[   29.847240]  dump_stack_lvl+0x8c/0xb8
+[   29.847254]  dump_stack+0x18/0x34
+[   29.847263]  register_lock_class+0x494/0x4a0
+[   29.847278]  __lock_acquire+0x80/0x1680
+[   29.847289]  lock_acquire+0x214/0x3a0
+[   29.847300]  mutex_lock_nested+0x70/0xc8
+[   29.847312]  _vb2_fop_release+0x3c/0xa8 [videobuf2_v4l2]
+[   29.847346]  vb2_fop_release+0x34/0x60 [videobuf2_v4l2]
+[   29.847367]  v4l2_release+0xc8/0x108 [videodev]
+[   29.847453]  __fput+0x8c/0x258
+[   29.847476]  ____fput+0x18/0x28
+[   29.847487]  task_work_run+0x98/0x180
+[   29.847502]  do_notify_resume+0x228/0x3f8
+[   29.847515]  el0_svc+0xec/0xf0
+[   29.847523]  el0t_64_sync_handler+0x90/0xb8
+[   29.847531]  el0t_64_sync+0x180/0x184
+
+Signed-off-by: Padmanabha Srinivasaiah <treasure4paddy@gmail.com>
+
+staging: vc04_services: isp: Permit all sRGB colour spaces on ISP outputs
+
+ISP outputs actually support all colour spaces that are fundamentally
+sRGB underneath, regardless of whether an RGB or YUV output format is
+actually requested.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+drivers: staging: bcm2835-isp: Do not cleanup mmal vcsm buffer on stop_streaming
+
+On stop_streaming() the vcsm buffer handle gets released by the buffer cleanup
+code.  This will subsequently cause and error if userland re-queues the same
+buffer on the next start_streaming() call.
+
+Remove this cleanup code and rely on the vb2_ops->buf_cleanup() call to do the
+cleanups instead.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+drivers: staging: bcm2835-isp: Clear LS table handle in the firmware
+
+When all nodes have stopped streaming, ensure the firmware has released its
+handle on the LS table dmabuf. This is done by passing a null handle in the
+LS params.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+drivers: staging: bcm2835-isp: Respect caller's stride value
+
+The stride value reported for output image buffers should be at least
+as large as any value that was passed in by the caller (subject to
+correct alignment for the pixel format). If the value is zero (meaning
+no value was passed), or is too small, the minimum acceptable value
+will be substituted.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+staging: vc04_services: bcm2835-isp: Drop include Makefile directive
+
+Drop the include directive. They can break the build, when one only
+wants to build a subdirectory. Replace with "../" for the includes in
+the bcm2835-isp instead.
+
+The fix is equivalent to the four patches between 29d49a76c5b2
+("staging: vc04_services: bcm2835-audio: Drop include Makefile
+directive")...2529ca211402 ("staging: vc04_services: interface: Drop
+include Makefile directive")
+
+Fixes: c8f89c9551c1 ("staging: vc04_services: ISP: Add a more complex ISP processing component")
+Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+
+staging: vc04_services: bcm2835-v4l2-isp: Register with vchiq_bus_type
+
+Register the bcm2835-v4l2-isp driver with the vchiq_bus_type instead of
+using the platform driver/device.
+
+Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+
+staging: vc04_services: bcm2835-v4l2-isp: Explicitly set DMA mask
+
+The platform model originally handled the DMA mask. Now that
+we are on the vchiq_bus we need to explicitly set this.
+
+Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+---
+ MAINTAINERS                                   |    9 +
+ .../media/platform/bcm2835/bcm2835-unicam.c   |   20 +-
+ drivers/staging/vc04_services/Kconfig         |    1 +
+ drivers/staging/vc04_services/Makefile        |    1 +
+ .../staging/vc04_services/bcm2835-isp/Kconfig |   14 +
+ .../vc04_services/bcm2835-isp/Makefile        |    7 +
+ .../bcm2835-isp/bcm2835-isp-ctrls.h           |   72 +
+ .../bcm2835-isp/bcm2835-isp-fmts.h            |  558 +++++
+ .../bcm2835-isp/bcm2835-v4l2-isp.c            | 1824 +++++++++++++++++
+ .../vc04_services/vchiq-mmal/mmal-encodings.h |    4 +
+ .../vchiq-mmal/mmal-parameters.h              |  166 +-
+ 11 files changed, 2666 insertions(+), 10 deletions(-)
+ create mode 100644 drivers/staging/vc04_services/bcm2835-isp/Kconfig
+ create mode 100644 drivers/staging/vc04_services/bcm2835-isp/Makefile
+ create mode 100644 drivers/staging/vc04_services/bcm2835-isp/bcm2835-isp-ctrls.h
+ create mode 100644 drivers/staging/vc04_services/bcm2835-isp/bcm2835-isp-fmts.h
+ create mode 100644 drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -4374,6 +4374,15 @@ S:	Maintained
+ F:	Documentation/devicetree/bindings/media/brcm,bcm2835-unicam.yaml
+ F:	drivers/media/platform/broadcom/bcm2835-unicam*
+ 
++BROADCOM BCM2835 ISP DRIVER
++M:	Raspberry Pi Kernel Maintenance <kernel-list@raspberrypi.com>
++L:	linux-media@vger.kernel.org
++S:	Maintained
++F:	Documentation/media/uapi/v4l/pixfmt-meta-bcm2835-isp-stats.rst
++F:	Documentation/media/v4l-drivers/bcm2835-isp.rst
++F:	drivers/staging/vc04_services/bcm2835-isp
++F:	include/uapi/linux/bcm2835-isp.h
++
+ BROADCOM BCM2711 HEVC DECODER
+ M:	Raspberry Pi Kernel Maintenance <kernel-list@raspberrypi.com>
+ L:	linux-media@vger.kernel.org
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -431,7 +431,7 @@ struct unicam_device {
+ 	/* ptr to  sub device */
+ 	struct v4l2_subdev *sensor;
+ 	/* Pad config for the sensor */
+-	struct v4l2_subdev_pad_config *sensor_config;
++	struct v4l2_subdev_state *sensor_state;
+ 
+ 	enum v4l2_mbus_type bus_type;
+ 	/*
+@@ -582,7 +582,7 @@ static int __subdev_get_format(struct un
+ 	};
+ 	int ret;
+ 
+-	ret = v4l2_subdev_call(dev->sensor, pad, get_fmt, dev->sensor_config,
++	ret = v4l2_subdev_call(dev->sensor, pad, get_fmt, dev->sensor_state,
+ 			       &sd_fmt);
+ 	if (ret < 0)
+ 		return ret;
+@@ -606,7 +606,7 @@ static int __subdev_set_format(struct un
+ 
+ 	sd_fmt.format = *fmt;
+ 
+-	ret = v4l2_subdev_call(dev->sensor, pad, set_fmt, dev->sensor_config,
++	ret = v4l2_subdev_call(dev->sensor, pad, set_fmt, dev->sensor_state,
+ 			       &sd_fmt);
+ 	if (ret < 0)
+ 		return ret;
+@@ -1067,7 +1067,7 @@ static int unicam_try_fmt_vid_cap(struct
+ 	 */
+ 	mbus_fmt->field = V4L2_FIELD_NONE;
+ 
+-	ret = v4l2_subdev_call(dev->sensor, pad, set_fmt, dev->sensor_config,
++	ret = v4l2_subdev_call(dev->sensor, pad, set_fmt, dev->sensor_state,
+ 			       &sd_fmt);
+ 	if (ret && ret != -ENOIOCTLCMD && ret != -ENODEV)
+ 		return ret;
+@@ -1089,7 +1089,7 @@ static int unicam_try_fmt_vid_cap(struct
+ 			mbus_fmt->code = fmt->code;
+ 
+ 			ret = v4l2_subdev_call(dev->sensor, pad, set_fmt,
+-					       dev->sensor_config, &sd_fmt);
++					       dev->sensor_state, &sd_fmt);
+ 			if (ret && ret != -ENOIOCTLCMD && ret != -ENODEV)
+ 				return ret;
+ 
+@@ -2293,8 +2293,8 @@ static void unicam_release(struct kref *
+ 	v4l2_ctrl_handler_free(&unicam->ctrl_handler);
+ 	media_device_cleanup(&unicam->mdev);
+ 
+-	if (unicam->sensor_config)
+-		v4l2_subdev_free_pad_config(unicam->sensor_config);
++	if (unicam->sensor_state)
++		__v4l2_subdev_state_free(unicam->sensor_state);
+ 
+ 	kfree(unicam);
+ }
+@@ -2552,12 +2552,14 @@ static void unregister_nodes(struct unic
+ 
+ static int unicam_probe_complete(struct unicam_device *unicam)
+ {
++	static struct lock_class_key key;
+ 	int ret;
+ 
+ 	unicam->v4l2_dev.notify = unicam_notify;
+ 
+-	unicam->sensor_config = v4l2_subdev_alloc_pad_config(unicam->sensor);
+-	if (!unicam->sensor_config)
++	unicam->sensor_state = __v4l2_subdev_state_alloc(unicam->sensor,
++							 "unicam:async->lock", &key);
++	if (!unicam->sensor_state)
+ 		return -ENOMEM;
+ 
+ 	unicam->sensor_embedded_data = (unicam->sensor->entity.num_pads >= 2);
+--- a/drivers/staging/vc04_services/Kconfig
++++ b/drivers/staging/vc04_services/Kconfig
+@@ -52,6 +52,7 @@ source "drivers/staging/vc04_services/bc
+ 
+ source "drivers/staging/vc04_services/vc-sm-cma/Kconfig"
+ source "drivers/staging/vc04_services/bcm2835-codec/Kconfig"
++source "drivers/staging/vc04_services/bcm2835-isp/Kconfig"
+ 
+ source "drivers/staging/vc04_services/vchiq-mmal/Kconfig"
+ 
+--- a/drivers/staging/vc04_services/Makefile
++++ b/drivers/staging/vc04_services/Makefile
+@@ -16,4 +16,5 @@ obj-$(CONFIG_VIDEO_BCM2835)		+= bcm2835-
+ obj-$(CONFIG_BCM2835_VCHIQ_MMAL)	+= vchiq-mmal/
+ obj-$(CONFIG_BCM_VC_SM_CMA)		+= vc-sm-cma/
+ obj-$(CONFIG_VIDEO_CODEC_BCM2835)	+= bcm2835-codec/
++obj-$(CONFIG_VIDEO_ISP_BCM2835)		+= bcm2835-isp/
+ 
+--- /dev/null
++++ b/drivers/staging/vc04_services/bcm2835-isp/Kconfig
+@@ -0,0 +1,14 @@
++config VIDEO_ISP_BCM2835
++	tristate "BCM2835 ISP support"
++	depends on MEDIA_SUPPORT
++	depends on VIDEO_DEV && (ARCH_BCM2835 || COMPILE_TEST)
++	depends on MEDIA_CONTROLLER
++	select BCM2835_VCHIQ_MMAL
++	select VIDEOBUF2_DMA_CONTIG
++	help
++	  This is the V4L2 driver for the Broadcom BCM2835 ISP hardware.
++	  This operates over the VCHIQ interface to a service running on
++	  VideoCore.
++
++	  To compile this driver as a module, choose M here: the module
++	  will be called bcm2835-isp.
+--- /dev/null
++++ b/drivers/staging/vc04_services/bcm2835-isp/Makefile
+@@ -0,0 +1,7 @@
++# SPDX-License-Identifier: GPL-2.0
++bcm2835-isp-objs := bcm2835-v4l2-isp.o
++
++obj-$(CONFIG_VIDEO_ISP_BCM2835) += bcm2835-isp.o
++
++ccflags-y += \
++	-D__VCCOREVER__=0x04000000
+--- /dev/null
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-isp-ctrls.h
+@@ -0,0 +1,72 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * Broadcom BCM2835 ISP driver
++ *
++ * Copyright © 2019-2020 Raspberry Pi (Trading) Ltd.
++ *
++ * Author: Naushir Patuck (naush@raspberrypi.com)
++ *
++ */
++
++#ifndef BCM2835_ISP_CTRLS
++#define BCM2835_ISP_CTRLS
++
++#include <linux/bcm2835-isp.h>
++
++struct bcm2835_isp_custom_ctrl {
++	const char *name;
++	u32 id;
++	u32 size;
++	u32 flags;
++};
++
++static const struct bcm2835_isp_custom_ctrl custom_ctrls[] = {
++	{
++		.name	= "Colour Correction Matrix",
++		.id	= V4L2_CID_USER_BCM2835_ISP_CC_MATRIX,
++		.size	= sizeof(struct bcm2835_isp_custom_ccm),
++		.flags  = 0
++	}, {
++		.name	= "Lens Shading",
++		.id	= V4L2_CID_USER_BCM2835_ISP_LENS_SHADING,
++		.size	= sizeof(struct bcm2835_isp_lens_shading),
++		.flags  = V4L2_CTRL_FLAG_EXECUTE_ON_WRITE
++	}, {
++		.name	= "Black Level",
++		.id	= V4L2_CID_USER_BCM2835_ISP_BLACK_LEVEL,
++		.size	= sizeof(struct bcm2835_isp_black_level),
++		.flags  = 0
++	}, {
++		.name	= "Green Equalisation",
++		.id	= V4L2_CID_USER_BCM2835_ISP_GEQ,
++		.size	= sizeof(struct bcm2835_isp_geq),
++		.flags  = 0
++	}, {
++		.name	= "Gamma",
++		.id	= V4L2_CID_USER_BCM2835_ISP_GAMMA,
++		.size	= sizeof(struct bcm2835_isp_gamma),
++		.flags  = 0
++	}, {
++		.name	= "Sharpen",
++		.id	= V4L2_CID_USER_BCM2835_ISP_SHARPEN,
++		.size	= sizeof(struct bcm2835_isp_sharpen),
++		.flags  = 0
++	}, {
++		.name	= "Denoise",
++		.id	= V4L2_CID_USER_BCM2835_ISP_DENOISE,
++		.size	= sizeof(struct bcm2835_isp_denoise),
++		.flags  = 0
++	}, {
++		.name	= "Colour Denoise",
++		.id	= V4L2_CID_USER_BCM2835_ISP_CDN,
++		.size	= sizeof(struct bcm2835_isp_cdn),
++		.flags  = 0
++	}, {
++		.name	= "Defective Pixel Correction",
++		.id	= V4L2_CID_USER_BCM2835_ISP_DPC,
++		.size	= sizeof(struct bcm2835_isp_dpc),
++		.flags  = 0
++	}
++};
++
++#endif
+--- /dev/null
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-isp-fmts.h
+@@ -0,0 +1,558 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * Broadcom BCM2835 ISP driver
++ *
++ * Copyright © 2019-2020 Raspberry Pi (Trading) Ltd.
++ *
++ * Author: Naushir Patuck (naush@raspberrypi.com)
++ *
++ */
++
++#ifndef BCM2835_ISP_FMTS
++#define BCM2835_ISP_FMTS
++
++#include <linux/videodev2.h>
++#include "../vchiq-mmal/mmal-encodings.h"
++
++struct bcm2835_isp_fmt {
++	u32 fourcc;
++	int depth;
++	int bytesperline_align;
++	u32 mmal_fmt;
++	int size_multiplier_x2;
++	u32 colorspace_mask;
++	enum v4l2_colorspace colorspace_default;
++	unsigned int step_size;
++};
++
++#define V4L2_COLORSPACE_MASK(colorspace) BIT(colorspace)
++
++#define V4L2_COLORSPACE_MASK_JPEG V4L2_COLORSPACE_MASK(V4L2_COLORSPACE_JPEG)
++#define V4L2_COLORSPACE_MASK_SMPTE170M V4L2_COLORSPACE_MASK(V4L2_COLORSPACE_SMPTE170M)
++#define V4L2_COLORSPACE_MASK_REC709 V4L2_COLORSPACE_MASK(V4L2_COLORSPACE_REC709)
++#define V4L2_COLORSPACE_MASK_SRGB V4L2_COLORSPACE_MASK(V4L2_COLORSPACE_SRGB)
++#define V4L2_COLORSPACE_MASK_RAW V4L2_COLORSPACE_MASK(V4L2_COLORSPACE_RAW)
++
++/*
++ * All three colour spaces JPEG, SMPTE170M and REC709 are fundamentally sRGB
++ * underneath (as near as makes no difference to us), just with different YCbCr
++ * encodings. Therefore the ISP can generate sRGB on its main output and any of
++ * the others on its low resolution output. Applications should, when using both
++ * outputs, program the colour spaces on them to be the same, matching whatever
++ * is requested for the low resolution output, even if the main output is
++ * producing an RGB format. In turn this requires us to allow all these colour
++ * spaces for every YUV/RGB output format.
++ */
++#define V4L2_COLORSPACE_MASK_ALL_SRGB (V4L2_COLORSPACE_MASK_JPEG |	\
++				       V4L2_COLORSPACE_MASK_SRGB |	\
++				       V4L2_COLORSPACE_MASK_SMPTE170M |	\
++				       V4L2_COLORSPACE_MASK_REC709)
++
++static const struct bcm2835_isp_fmt supported_formats[] = {
++	{
++		/* YUV formats */
++		.fourcc		    = V4L2_PIX_FMT_YUV420,
++		.depth		    = 8,
++		.bytesperline_align = 64,
++		.mmal_fmt	    = MMAL_ENCODING_I420,
++		.size_multiplier_x2 = 3,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
++		.colorspace_default = V4L2_COLORSPACE_JPEG,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_YVU420,
++		.depth		    = 8,
++		.bytesperline_align = 64,
++		.mmal_fmt	    = MMAL_ENCODING_YV12,
++		.size_multiplier_x2 = 3,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
++		.colorspace_default = V4L2_COLORSPACE_SMPTE170M,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_NV12,
++		.depth		    = 8,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_NV12,
++		.size_multiplier_x2 = 3,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
++		.colorspace_default = V4L2_COLORSPACE_SMPTE170M,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_NV21,
++		.depth		    = 8,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_NV21,
++		.size_multiplier_x2 = 3,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
++		.colorspace_default = V4L2_COLORSPACE_SMPTE170M,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_YUYV,
++		.depth		    = 16,
++		.bytesperline_align = 64,
++		.mmal_fmt	    = MMAL_ENCODING_YUYV,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
++		.colorspace_default = V4L2_COLORSPACE_SMPTE170M,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_UYVY,
++		.depth		    = 16,
++		.bytesperline_align = 64,
++		.mmal_fmt	    = MMAL_ENCODING_UYVY,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
++		.colorspace_default = V4L2_COLORSPACE_SMPTE170M,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_YVYU,
++		.depth		    = 16,
++		.bytesperline_align = 64,
++		.mmal_fmt	    = MMAL_ENCODING_YVYU,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
++		.colorspace_default = V4L2_COLORSPACE_SMPTE170M,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_VYUY,
++		.depth		    = 16,
++		.bytesperline_align = 64,
++		.mmal_fmt	    = MMAL_ENCODING_VYUY,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
++		.colorspace_default = V4L2_COLORSPACE_SMPTE170M,
++		.step_size	    = 2,
++	}, {
++		/* RGB formats */
++		.fourcc		    = V4L2_PIX_FMT_RGB24,
++		.depth		    = 24,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_RGB24,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
++		.colorspace_default = V4L2_COLORSPACE_SRGB,
++		.step_size	    = 1,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_RGB565,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_RGB16,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
++		.colorspace_default = V4L2_COLORSPACE_SRGB,
++		.step_size	    = 1,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_BGR24,
++		.depth		    = 24,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BGR24,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
++		.colorspace_default = V4L2_COLORSPACE_SRGB,
++		.step_size	    = 1,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_XBGR32,
++		.depth		    = 32,
++		.bytesperline_align = 64,
++		.mmal_fmt	    = MMAL_ENCODING_BGRA,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
++		.colorspace_default = V4L2_COLORSPACE_SRGB,
++		.step_size	    = 1,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_RGBX32,
++		.depth		    = 32,
++		.bytesperline_align = 64,
++		.mmal_fmt	    = MMAL_ENCODING_RGBA,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
++		.colorspace_default = V4L2_COLORSPACE_SRGB,
++		.step_size	    = 1,
++	}, {
++		/* Bayer formats */
++		/* 8 bit */
++		.fourcc		    = V4L2_PIX_FMT_SRGGB8,
++		.depth		    = 8,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SRGGB8,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SBGGR8,
++		.depth		    = 8,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SBGGR8,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGRBG8,
++		.depth		    = 8,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGRBG8,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGBRG8,
++		.depth		    = 8,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGBRG8,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* 10 bit */
++		.fourcc		    = V4L2_PIX_FMT_SRGGB10P,
++		.depth		    = 10,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SRGGB10P,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SBGGR10P,
++		.depth		    = 10,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SBGGR10P,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGRBG10P,
++		.depth		    = 10,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGRBG10P,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGBRG10P,
++		.depth		    = 10,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGBRG10P,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* 12 bit */
++		.fourcc		    = V4L2_PIX_FMT_SRGGB12P,
++		.depth		    = 12,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SRGGB12P,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SBGGR12P,
++		.depth		    = 12,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SBGGR12P,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGRBG12P,
++		.depth		    = 12,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGRBG12P,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGBRG12P,
++		.depth		    = 12,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGBRG12P,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* 14 bit */
++		.fourcc		    = V4L2_PIX_FMT_SRGGB14P,
++		.depth		    = 14,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SRGGB14P,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SBGGR14P,
++		.depth		    = 14,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SBGGR14P,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGRBG14P,
++		.depth		    = 14,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGRBG14P,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGBRG14P,
++		.depth		    = 14,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGBRG14P,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* 16 bit */
++		.fourcc		    = V4L2_PIX_FMT_SRGGB16,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SRGGB16,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SBGGR16,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SBGGR16,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGRBG16,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGRBG16,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGBRG16,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGBRG16,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* Bayer formats unpacked to 16bpp */
++		/* 10 bit */
++		.fourcc		    = V4L2_PIX_FMT_SRGGB10,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SRGGB10,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SBGGR10,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SBGGR10,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGRBG10,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGRBG10,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGBRG10,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGBRG10,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* 12 bit */
++		.fourcc		    = V4L2_PIX_FMT_SRGGB12,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SRGGB12,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SBGGR12,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SBGGR12,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGRBG12,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGRBG12,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGBRG12,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGBRG12,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* 14 bit */
++		.fourcc		    = V4L2_PIX_FMT_SRGGB14,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SRGGB14,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SBGGR14,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SBGGR14,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGRBG14,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGRBG14,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_PIX_FMT_SGBRG14,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_BAYER_SGBRG14,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* Monochrome MIPI formats */
++		/* 8 bit */
++		.fourcc		    = V4L2_PIX_FMT_GREY,
++		.depth		    = 8,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_GREY,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* 10 bit */
++		.fourcc		    = V4L2_PIX_FMT_Y10P,
++		.depth		    = 10,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_Y10P,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* 12 bit */
++		.fourcc		    = V4L2_PIX_FMT_Y12P,
++		.depth		    = 12,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_Y12P,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* 14 bit */
++		.fourcc		    = V4L2_PIX_FMT_Y14P,
++		.depth		    = 14,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_Y14P,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* 16 bit */
++		.fourcc		    = V4L2_PIX_FMT_Y16,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_Y16,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* 10 bit as 16bpp */
++		.fourcc		    = V4L2_PIX_FMT_Y10,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_Y10,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* 12 bit as 16bpp */
++		.fourcc		    = V4L2_PIX_FMT_Y12,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_Y12,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		/* 14 bit as 16bpp */
++		.fourcc		    = V4L2_PIX_FMT_Y14,
++		.depth		    = 16,
++		.bytesperline_align = 32,
++		.mmal_fmt	    = MMAL_ENCODING_Y14,
++		.size_multiplier_x2 = 2,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_RAW,
++		.colorspace_default = V4L2_COLORSPACE_RAW,
++		.step_size	    = 2,
++	}, {
++		.fourcc		    = V4L2_META_FMT_BCM2835_ISP_STATS,
++		.depth		    = 8,
++		.mmal_fmt	    = MMAL_ENCODING_BRCM_STATS,
++		/* The rest are not valid fields for stats. */
++	}
++};
++
++#endif
+--- /dev/null
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
+@@ -0,0 +1,1824 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Broadcom BCM2835 ISP driver
++ *
++ * Copyright © 2019-2020 Raspberry Pi (Trading) Ltd.
++ *
++ * Author: Naushir Patuck (naush@raspberrypi.com)
++ *
++ */
++
++#include <linux/module.h>
++
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-event.h>
++#include <media/v4l2-ioctl.h>
++#include <media/videobuf2-dma-contig.h>
++
++#include "../interface/vchiq_arm/vchiq_bus.h"
++
++#include "../vchiq-mmal/mmal-msg.h"
++#include "../vchiq-mmal/mmal-parameters.h"
++#include "../vchiq-mmal/mmal-vchiq.h"
++
++#include "../vc-sm-cma/vc_sm_knl.h"
++
++#include "bcm2835-isp-ctrls.h"
++#include "bcm2835-isp-fmts.h"
++
++/*
++ * We want to instantiate 2 independent instances allowing 2 simultaneous users
++ * of the ISP hardware.
++ */
++#define BCM2835_ISP_NUM_INSTANCES 2
++
++MODULE_IMPORT_NS(DMA_BUF);
++
++static unsigned int debug;
++module_param(debug, uint, 0644);
++MODULE_PARM_DESC(debug, "activates debug info");
++
++static unsigned int video_nr[BCM2835_ISP_NUM_INSTANCES] = { 13, 20 };
++module_param_array(video_nr, uint, NULL, 0644);
++MODULE_PARM_DESC(video_nr, "base video device numbers");
++
++#define BCM2835_ISP_NAME "bcm2835-isp"
++#define BCM2835_ISP_ENTITY_NAME_LEN 32
++
++#define BCM2835_ISP_NUM_OUTPUTS 1
++#define BCM2835_ISP_NUM_CAPTURES 2
++#define BCM2835_ISP_NUM_METADATA 1
++
++#define BCM2835_ISP_NUM_NODES						\
++		(BCM2835_ISP_NUM_OUTPUTS + BCM2835_ISP_NUM_CAPTURES +	\
++		 BCM2835_ISP_NUM_METADATA)
++
++/* Default frame dimension of 1280 pixels. */
++#define DEFAULT_DIM 1280U
++/*
++ * Maximum frame dimension of 16384 pixels.  Even though the ISP runs in tiles,
++ * have a sensible limit so that we do not create an excessive number of tiles
++ * to process.
++ */
++#define MAX_DIM 16384U
++/*
++ * Minimum frame dimension of 64 pixels.  Anything lower, and the tiling
++ * algorithm may not be able to cope when applying filter context.
++ */
++#define MIN_DIM 64U
++
++/* Timeout for stop_streaming to allow all buffers to return */
++#define COMPLETE_TIMEOUT (2 * HZ)
++
++/* Per-queue, driver-specific private data */
++struct bcm2835_isp_q_data {
++	/*
++	 * These parameters should be treated as gospel, with everything else
++	 * being determined from them.
++	 */
++	unsigned int bytesperline;
++	unsigned int width;
++	unsigned int height;
++	unsigned int sizeimage;
++	enum v4l2_colorspace colorspace;
++	const struct bcm2835_isp_fmt *fmt;
++};
++
++/*
++ * Structure to describe a single node /dev/video<N> which represents a single
++ * input or output queue to the ISP device.
++ */
++struct bcm2835_isp_node {
++	int vfl_dir;
++	unsigned int id;
++	const char *name;
++	struct vchiq_mmal_port *port;
++	struct video_device vfd;
++	struct media_pad pad;
++	struct media_intf_devnode *intf_devnode;
++	struct media_link *intf_link;
++	struct mutex lock; /* top level device node lock */
++	struct mutex queue_lock;
++
++	struct vb2_queue queue;
++	unsigned int sequence;
++
++	/* The list of formats supported on the node. */
++	struct bcm2835_isp_fmt const **supported_fmts;
++	unsigned int num_supported_fmts;
++
++	struct bcm2835_isp_q_data q_data;
++
++	/* Parent device structure */
++	struct bcm2835_isp_dev *dev;
++
++	bool registered;
++	bool media_node_registered;
++};
++
++/*
++ * Structure representing the entire ISP device, comprising several input and
++ * output nodes /dev/video<N>.
++ */
++struct bcm2835_isp_dev {
++	struct v4l2_device v4l2_dev;
++	struct device *dev;
++	struct v4l2_ctrl_handler ctrl_handler;
++	struct media_device mdev;
++	struct media_entity entity;
++	bool media_device_registered;
++	bool media_entity_registered;
++	struct vchiq_mmal_instance *mmal_instance;
++	struct vchiq_mmal_component *component;
++	struct completion frame_cmplt;
++
++	struct bcm2835_isp_node node[BCM2835_ISP_NUM_NODES];
++	struct media_pad pad[BCM2835_ISP_NUM_NODES];
++	atomic_t num_streaming;
++
++	/* Image pipeline controls. */
++	int r_gain;
++	int b_gain;
++};
++
++struct bcm2835_isp_buffer {
++	struct vb2_v4l2_buffer vb;
++	struct mmal_buffer mmal;
++};
++
++static
++inline struct bcm2835_isp_dev *node_get_dev(struct bcm2835_isp_node *node)
++{
++	return node->dev;
++}
++
++static inline bool node_is_output(struct bcm2835_isp_node *node)
++{
++	return node->queue.type == V4L2_BUF_TYPE_VIDEO_OUTPUT;
++}
++
++static inline bool node_is_capture(struct bcm2835_isp_node *node)
++{
++	return node->queue.type == V4L2_BUF_TYPE_VIDEO_CAPTURE;
++}
++
++static inline bool node_is_stats(struct bcm2835_isp_node *node)
++{
++	return node->queue.type == V4L2_BUF_TYPE_META_CAPTURE;
++}
++
++static inline enum v4l2_buf_type index_to_queue_type(int index)
++{
++	if (index < BCM2835_ISP_NUM_OUTPUTS)
++		return V4L2_BUF_TYPE_VIDEO_OUTPUT;
++	else if (index < BCM2835_ISP_NUM_OUTPUTS + BCM2835_ISP_NUM_CAPTURES)
++		return V4L2_BUF_TYPE_VIDEO_CAPTURE;
++	else
++		return V4L2_BUF_TYPE_META_CAPTURE;
++}
++
++static int set_isp_param(struct bcm2835_isp_node *node, u32 parameter,
++			 void *value, u32 value_size)
++{
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++
++	return vchiq_mmal_port_parameter_set(dev->mmal_instance, node->port,
++					     parameter, value, value_size);
++}
++
++static int set_wb_gains(struct bcm2835_isp_node *node)
++{
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++	struct mmal_parameter_awbgains gains = {
++		.r_gain = { dev->r_gain, 1000 },
++		.b_gain = { dev->b_gain, 1000 }
++	};
++
++	return set_isp_param(node, MMAL_PARAMETER_CUSTOM_AWB_GAINS,
++			     &gains, sizeof(gains));
++}
++
++static int set_digital_gain(struct bcm2835_isp_node *node, uint32_t gain)
++{
++	struct s32_fract digital_gain = {
++		.numerator = gain,
++		.denominator = 1000
++	};
++
++	return set_isp_param(node, MMAL_PARAMETER_DIGITAL_GAIN,
++			     &digital_gain, sizeof(digital_gain));
++}
++
++static const struct bcm2835_isp_fmt *get_fmt(u32 mmal_fmt)
++{
++	unsigned int i;
++
++	for (i = 0; i < ARRAY_SIZE(supported_formats); i++) {
++		if (supported_formats[i].mmal_fmt == mmal_fmt)
++			return &supported_formats[i];
++	}
++	return NULL;
++}
++
++static const
++struct bcm2835_isp_fmt *find_format_by_fourcc(unsigned int fourcc,
++					      struct bcm2835_isp_node *node)
++{
++	const struct bcm2835_isp_fmt *fmt;
++	unsigned int i;
++
++	for (i = 0; i < node->num_supported_fmts; i++) {
++		fmt = node->supported_fmts[i];
++		if (fmt->fourcc == fourcc)
++			return fmt;
++	}
++
++	return NULL;
++}
++
++static const
++struct bcm2835_isp_fmt *find_format(struct v4l2_format *f,
++				    struct bcm2835_isp_node *node)
++{
++	return find_format_by_fourcc(node_is_stats(node) ?
++				     f->fmt.meta.dataformat :
++				     f->fmt.pix.pixelformat,
++				     node);
++}
++
++/* vb2_to_mmal_buffer() - converts vb2 buffer header to MMAL
++ *
++ * Copies all the required fields from a VB2 buffer to the MMAL buffer header,
++ * ready for sending to the VPU.
++ */
++static void vb2_to_mmal_buffer(struct mmal_buffer *buf,
++			       struct vb2_v4l2_buffer *vb2)
++{
++	u64 pts;
++
++	buf->mmal_flags = 0;
++	if (vb2->flags & V4L2_BUF_FLAG_KEYFRAME)
++		buf->mmal_flags |= MMAL_BUFFER_HEADER_FLAG_KEYFRAME;
++
++	/* Data must be framed correctly as one frame per buffer. */
++	buf->mmal_flags |= MMAL_BUFFER_HEADER_FLAG_FRAME_END;
++
++	buf->length = vb2->vb2_buf.planes[0].bytesused;
++	/*
++	 * Minor ambiguity in the V4L2 spec as to whether passing in a 0 length
++	 * buffer, or one with V4L2_BUF_FLAG_LAST set denotes end of stream.
++	 * Handle either.
++	 */
++	if (!buf->length || vb2->flags & V4L2_BUF_FLAG_LAST)
++		buf->mmal_flags |= MMAL_BUFFER_HEADER_FLAG_EOS;
++
++	/* vb2 timestamps in nsecs, mmal in usecs */
++	pts = vb2->vb2_buf.timestamp;
++	do_div(pts, 1000);
++	buf->pts = pts;
++	buf->dts = MMAL_TIME_UNKNOWN;
++}
++
++static void mmal_buffer_cb(struct vchiq_mmal_instance *instance,
++			   struct vchiq_mmal_port *port, int status,
++			   struct mmal_buffer *mmal_buf)
++{
++	struct bcm2835_isp_buffer *q_buf;
++	struct bcm2835_isp_node *node = port->cb_ctx;
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++	struct vb2_v4l2_buffer *vb2;
++
++	q_buf = container_of(mmal_buf, struct bcm2835_isp_buffer, mmal);
++	vb2 = &q_buf->vb;
++	v4l2_dbg(2, debug, &dev->v4l2_dev,
++		 "%s: port:%s[%d], status:%d, buf:%p, dmabuf:%p, length:%lu, flags %u, pts %lld\n",
++		 __func__, node_is_output(node) ? "input" : "output", node->id,
++		 status, mmal_buf, mmal_buf->dma_buf, mmal_buf->length,
++		 mmal_buf->mmal_flags, mmal_buf->pts);
++
++	if (mmal_buf->cmd)
++		v4l2_err(&dev->v4l2_dev,
++			 "%s: Unexpected event on output callback - %08x\n",
++			 __func__, mmal_buf->cmd);
++
++	if (status) {
++		/* error in transfer */
++		if (vb2) {
++			/* there was a buffer with the error so return it */
++			vb2_buffer_done(&vb2->vb2_buf, VB2_BUF_STATE_ERROR);
++		}
++		return;
++	}
++
++	/* vb2 timestamps in nsecs, mmal in usecs */
++	vb2->vb2_buf.timestamp = mmal_buf->pts * 1000;
++	vb2->sequence = node->sequence++;
++	vb2_set_plane_payload(&vb2->vb2_buf, 0, mmal_buf->length);
++	vb2_buffer_done(&vb2->vb2_buf, VB2_BUF_STATE_DONE);
++
++	if (!port->enabled)
++		complete(&dev->frame_cmplt);
++}
++
++struct colorspace_translation {
++	enum v4l2_colorspace v4l2_value;
++	u32 mmal_value;
++};
++
++static u32 translate_color_space(enum v4l2_colorspace color_space)
++{
++	static const struct colorspace_translation translations[] = {
++		{ V4L2_COLORSPACE_DEFAULT, MMAL_COLOR_SPACE_UNKNOWN },
++		{ V4L2_COLORSPACE_SMPTE170M, MMAL_COLOR_SPACE_ITUR_BT601 },
++		{ V4L2_COLORSPACE_SMPTE240M, MMAL_COLOR_SPACE_SMPTE240M },
++		{ V4L2_COLORSPACE_REC709, MMAL_COLOR_SPACE_ITUR_BT709 },
++		/* V4L2_COLORSPACE_BT878 unavailable */
++		{ V4L2_COLORSPACE_470_SYSTEM_M, MMAL_COLOR_SPACE_BT470_2_M },
++		{ V4L2_COLORSPACE_470_SYSTEM_BG, MMAL_COLOR_SPACE_BT470_2_BG },
++		{ V4L2_COLORSPACE_JPEG, MMAL_COLOR_SPACE_JPEG_JFIF },
++		/*
++		 * We don't have an encoding for SRGB as such, but VideoCore
++		 * will do the right thing if it gets "unknown".
++		 */
++		{ V4L2_COLORSPACE_SRGB, MMAL_COLOR_SPACE_UNKNOWN },
++		/* V4L2_COLORSPACE_OPRGB unavailable */
++		/* V4L2_COLORSPACE_BT2020 unavailable */
++		/* V4L2_COLORSPACE_RAW unavailable */
++		/* V4L2_COLORSPACE_DCI_P3 unavailable */
++	};
++
++	unsigned int i;
++
++	for (i = 0; i < ARRAY_SIZE(translations); i++) {
++		if (color_space == translations[i].v4l2_value)
++			return translations[i].mmal_value;
++	}
++
++	return MMAL_COLOR_SPACE_UNKNOWN;
++}
++
++static void setup_mmal_port_format(struct bcm2835_isp_node *node,
++				   struct vchiq_mmal_port *port)
++{
++	struct bcm2835_isp_q_data *q_data = &node->q_data;
++
++	port->format.encoding = q_data->fmt->mmal_fmt;
++	/* Raw image format - set width/height */
++	port->es.video.width = (q_data->bytesperline << 3) / q_data->fmt->depth;
++	port->es.video.height = q_data->height;
++	port->es.video.crop.width = q_data->width;
++	port->es.video.crop.height = q_data->height;
++	port->es.video.crop.x = 0;
++	port->es.video.crop.y = 0;
++	port->es.video.color_space = translate_color_space(q_data->colorspace);
++};
++
++static int setup_mmal_port(struct bcm2835_isp_node *node)
++{
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++	unsigned int enable = 1;
++	int ret;
++
++	v4l2_dbg(2, debug, &dev->v4l2_dev, "%s: setup %s[%d]\n", __func__,
++		 node->name, node->id);
++
++	vchiq_mmal_port_parameter_set(dev->mmal_instance, node->port,
++				      MMAL_PARAMETER_ZERO_COPY, &enable,
++				      sizeof(enable));
++	setup_mmal_port_format(node, node->port);
++	ret = vchiq_mmal_port_set_format(dev->mmal_instance, node->port);
++	if (ret < 0) {
++		v4l2_dbg(1, debug, &dev->v4l2_dev,
++			 "%s: vchiq_mmal_port_set_format failed\n",
++			 __func__);
++		return ret;
++	}
++
++	if (node->q_data.sizeimage < node->port->minimum_buffer.size) {
++		v4l2_err(&dev->v4l2_dev,
++			 "buffer size mismatch sizeimage %u < min size %u\n",
++			 node->q_data.sizeimage,
++			 node->port->minimum_buffer.size);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++static int bcm2835_isp_mmal_buf_cleanup(struct mmal_buffer *mmal_buf)
++{
++	mmal_vchi_buffer_cleanup(mmal_buf);
++
++	if (mmal_buf->dma_buf) {
++		dma_buf_put(mmal_buf->dma_buf);
++		mmal_buf->dma_buf = NULL;
++	}
++
++	return 0;
++}
++
++static int bcm2835_isp_node_queue_setup(struct vb2_queue *q,
++					unsigned int *nbuffers,
++					unsigned int *nplanes,
++					unsigned int sizes[],
++					struct device *alloc_devs[])
++{
++	struct bcm2835_isp_node *node = vb2_get_drv_priv(q);
++	unsigned int size;
++
++	if (setup_mmal_port(node))
++		return -EINVAL;
++
++	size = node->q_data.sizeimage;
++	if (size == 0) {
++		v4l2_info(&node_get_dev(node)->v4l2_dev,
++			  "%s: Image size unset in queue_setup for node %s[%d]\n",
++			  __func__, node->name, node->id);
++		return -EINVAL;
++	}
++
++	if (*nplanes)
++		return sizes[0] < size ? -EINVAL : 0;
++
++	*nplanes = 1;
++	sizes[0] = size;
++
++	node->port->current_buffer.size = size;
++
++	if (*nbuffers < node->port->minimum_buffer.num)
++		*nbuffers = node->port->minimum_buffer.num;
++
++	node->port->current_buffer.num = *nbuffers;
++
++	v4l2_dbg(2, debug, &node_get_dev(node)->v4l2_dev,
++		 "%s: Image size %u, nbuffers %u for node %s[%d]\n",
++		 __func__, sizes[0], *nbuffers, node->name, node->id);
++	return 0;
++}
++
++static int bcm2835_isp_buf_init(struct vb2_buffer *vb)
++{
++	struct bcm2835_isp_node *node = vb2_get_drv_priv(vb->vb2_queue);
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++	struct vb2_v4l2_buffer *vb2 = to_vb2_v4l2_buffer(vb);
++	struct bcm2835_isp_buffer *buf =
++		container_of(vb2, struct bcm2835_isp_buffer, vb);
++
++	v4l2_dbg(3, debug, &dev->v4l2_dev, "%s: vb %p\n", __func__, vb);
++
++	buf->mmal.buffer = vb2_plane_vaddr(&buf->vb.vb2_buf, 0);
++	buf->mmal.buffer_size = vb2_plane_size(&buf->vb.vb2_buf, 0);
++	mmal_vchi_buffer_init(dev->mmal_instance, &buf->mmal);
++	return 0;
++}
++
++static int bcm2835_isp_buf_prepare(struct vb2_buffer *vb)
++{
++	struct bcm2835_isp_node *node = vb2_get_drv_priv(vb->vb2_queue);
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++	struct vb2_v4l2_buffer *vb2 = to_vb2_v4l2_buffer(vb);
++	struct bcm2835_isp_buffer *buf =
++		container_of(vb2, struct bcm2835_isp_buffer, vb);
++	struct dma_buf *dma_buf;
++	int ret;
++
++	v4l2_dbg(3, debug, &dev->v4l2_dev, "%s: type: %d ptr %p\n",
++		 __func__, vb->vb2_queue->type, vb);
++
++	if (V4L2_TYPE_IS_OUTPUT(vb->vb2_queue->type)) {
++		if (vb2->field == V4L2_FIELD_ANY)
++			vb2->field = V4L2_FIELD_NONE;
++		if (vb2->field != V4L2_FIELD_NONE) {
++			v4l2_err(&dev->v4l2_dev,
++				 "%s field isn't supported\n", __func__);
++			return -EINVAL;
++		}
++	}
++
++	if (vb2_plane_size(vb, 0) < node->q_data.sizeimage) {
++		v4l2_err(&dev->v4l2_dev,
++			 "%s data will not fit into plane (%lu < %lu)\n",
++			 __func__, vb2_plane_size(vb, 0),
++			 (long)node->q_data.sizeimage);
++		return -EINVAL;
++	}
++
++	if (!V4L2_TYPE_IS_OUTPUT(vb->vb2_queue->type))
++		vb2_set_plane_payload(vb, 0, node->q_data.sizeimage);
++
++	switch (vb->memory) {
++	case VB2_MEMORY_DMABUF:
++		dma_buf = dma_buf_get(vb->planes[0].m.fd);
++
++		if (dma_buf != buf->mmal.dma_buf) {
++			/*
++			 * dmabuf either hasn't already been mapped, or it has
++			 * changed.
++			 */
++			if (buf->mmal.dma_buf) {
++				v4l2_err(&dev->v4l2_dev,
++					 "%s Buffer changed - why did the core not call cleanup?\n",
++					 __func__);
++				bcm2835_isp_mmal_buf_cleanup(&buf->mmal);
++			}
++
++			buf->mmal.dma_buf = dma_buf;
++		} else {
++			/*
++			 * Already have a reference to the buffer, so release it
++			 * here.
++			 */
++			dma_buf_put(dma_buf);
++		}
++		ret = 0;
++		break;
++	case VB2_MEMORY_MMAP:
++		/*
++		 * We want to do this at init, but vb2_core_expbuf checks that
++		 * the index < q->num_buffers, and q->num_buffers only gets
++		 * updated once all the buffers are allocated.
++		 */
++		if (!buf->mmal.dma_buf) {
++			ret = vb2_core_expbuf_dmabuf(vb->vb2_queue,
++						     vb->vb2_queue->type,
++						     vb, 0, O_CLOEXEC,
++						     &buf->mmal.dma_buf);
++			v4l2_dbg(3, debug, &dev->v4l2_dev,
++				 "%s: exporting ptr %p to dmabuf %p\n",
++				 __func__, vb, buf->mmal.dma_buf);
++			if (ret)
++				v4l2_err(&dev->v4l2_dev,
++					 "%s: Failed to expbuf idx %d, ret %d\n",
++					 __func__, vb->index, ret);
++		} else {
++			ret = 0;
++		}
++		break;
++	default:
++		ret = -EINVAL;
++		break;
++	}
++
++	return ret;
++}
++
++static void bcm2835_isp_node_buffer_queue(struct vb2_buffer *buf)
++{
++	struct bcm2835_isp_node *node = vb2_get_drv_priv(buf->vb2_queue);
++	struct vb2_v4l2_buffer *vbuf =
++		container_of(buf, struct vb2_v4l2_buffer, vb2_buf);
++	struct bcm2835_isp_buffer *buffer =
++		container_of(vbuf, struct bcm2835_isp_buffer, vb);
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++
++	v4l2_dbg(3, debug, &dev->v4l2_dev, "%s: node %s[%d], buffer %p\n",
++		 __func__, node->name, node->id, buffer);
++
++	vb2_to_mmal_buffer(&buffer->mmal, &buffer->vb);
++	v4l2_dbg(3, debug, &dev->v4l2_dev,
++		 "%s: node %s[%d] - submitting  mmal dmabuf %p\n", __func__,
++		 node->name, node->id, buffer->mmal.dma_buf);
++	vchiq_mmal_submit_buffer(dev->mmal_instance, node->port, &buffer->mmal);
++}
++
++static void bcm2835_isp_buffer_cleanup(struct vb2_buffer *vb)
++{
++	struct vb2_v4l2_buffer *vb2 = to_vb2_v4l2_buffer(vb);
++	struct bcm2835_isp_buffer *buffer =
++		container_of(vb2, struct bcm2835_isp_buffer, vb);
++
++	bcm2835_isp_mmal_buf_cleanup(&buffer->mmal);
++}
++
++static int bcm2835_isp_node_start_streaming(struct vb2_queue *q,
++					    unsigned int count)
++{
++	struct bcm2835_isp_node *node = vb2_get_drv_priv(q);
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++	int ret;
++
++	v4l2_dbg(1, debug, &dev->v4l2_dev, "%s: node %s[%d] (count %u)\n",
++		 __func__, node->name, node->id, count);
++
++	ret = vchiq_mmal_component_enable(dev->mmal_instance, dev->component);
++	if (ret) {
++		v4l2_err(&dev->v4l2_dev, "%s: Failed enabling component, ret %d\n",
++			 __func__, ret);
++		return -EIO;
++	}
++
++	node->sequence = 0;
++	node->port->cb_ctx = node;
++	ret = vchiq_mmal_port_enable(dev->mmal_instance, node->port,
++				     mmal_buffer_cb);
++	if (!ret)
++		atomic_inc(&dev->num_streaming);
++	else
++		v4l2_err(&dev->v4l2_dev,
++			 "%s: Failed enabling port, ret %d\n", __func__, ret);
++
++	return ret;
++}
++
++static void bcm2835_isp_node_stop_streaming(struct vb2_queue *q)
++{
++	struct bcm2835_isp_node *node = vb2_get_drv_priv(q);
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++	int ret;
++
++	v4l2_dbg(1, debug, &dev->v4l2_dev, "%s: node %s[%d], mmal port %p\n",
++		 __func__, node->name, node->id, node->port);
++
++	init_completion(&dev->frame_cmplt);
++
++	/* Disable MMAL port - this will flush buffers back */
++	ret = vchiq_mmal_port_disable(dev->mmal_instance, node->port);
++	if (ret)
++		v4l2_err(&dev->v4l2_dev,
++			 "%s: Failed disabling %s port, ret %d\n", __func__,
++			 node_is_output(node) ? "i/p" : "o/p",
++			 ret);
++
++	while (atomic_read(&node->port->buffers_with_vpu)) {
++		v4l2_dbg(1, debug, &dev->v4l2_dev,
++			 "%s: Waiting for buffers to be returned - %d outstanding\n",
++			 __func__, atomic_read(&node->port->buffers_with_vpu));
++		ret = wait_for_completion_timeout(&dev->frame_cmplt,
++						  COMPLETE_TIMEOUT);
++		if (ret <= 0) {
++			v4l2_err(&dev->v4l2_dev,
++				 "%s: Timeout waiting for buffers to be returned - %d outstanding\n",
++				 __func__,
++				 atomic_read(&node->port->buffers_with_vpu));
++			break;
++		}
++	}
++
++	atomic_dec(&dev->num_streaming);
++	/* If all ports disabled, then disable the component */
++	if (atomic_read(&dev->num_streaming) == 0) {
++		struct bcm2835_isp_lens_shading ls;
++		/*
++		 * The ISP component on the firmware has a reference to the
++		 * dmabuf handle for the lens shading table.  Pass a null handle
++		 * to remove that reference now.
++		 */
++		memset(&ls, 0, sizeof(ls));
++		/* Must set a valid grid size for the FW */
++		ls.grid_cell_size = 16;
++		set_isp_param(&dev->node[0],
++			      MMAL_PARAMETER_LENS_SHADING_OVERRIDE,
++			      &ls, sizeof(ls));
++
++		ret = vchiq_mmal_component_disable(dev->mmal_instance,
++						   dev->component);
++		if (ret) {
++			v4l2_err(&dev->v4l2_dev,
++				 "%s: Failed disabling component, ret %d\n",
++				 __func__, ret);
++		}
++	}
++
++	/*
++	 * Simply wait for any vb2 buffers to finish. We could take steps to
++	 * make them complete more quickly if we care, or even return them
++	 * ourselves.
++	 */
++	vb2_wait_for_all_buffers(&node->queue);
++}
++
++static const struct vb2_ops bcm2835_isp_node_queue_ops = {
++	.queue_setup		= bcm2835_isp_node_queue_setup,
++	.buf_init		= bcm2835_isp_buf_init,
++	.buf_prepare		= bcm2835_isp_buf_prepare,
++	.buf_queue		= bcm2835_isp_node_buffer_queue,
++	.buf_cleanup		= bcm2835_isp_buffer_cleanup,
++	.start_streaming	= bcm2835_isp_node_start_streaming,
++	.stop_streaming		= bcm2835_isp_node_stop_streaming,
++};
++
++static const
++struct bcm2835_isp_fmt *get_default_format(struct bcm2835_isp_node *node)
++{
++	return node->supported_fmts[0];
++}
++
++static inline unsigned int get_bytesperline(int width,
++					    const struct bcm2835_isp_fmt *fmt)
++{
++	/* GPU aligns 24bpp images to a multiple of 32 pixels (not bytes). */
++	if (fmt->depth == 24)
++		return ALIGN(width, 32) * 3;
++	else
++		return ALIGN((width * fmt->depth) >> 3, fmt->bytesperline_align);
++}
++
++static inline unsigned int get_sizeimage(int bpl, int width, int height,
++					 const struct bcm2835_isp_fmt *fmt)
++{
++	return (bpl * height * fmt->size_multiplier_x2) >> 1;
++}
++
++static int bcm2835_isp_s_ctrl(struct v4l2_ctrl *ctrl)
++{
++	struct bcm2835_isp_dev *dev =
++	      container_of(ctrl->handler, struct bcm2835_isp_dev, ctrl_handler);
++	struct bcm2835_isp_node *node = &dev->node[0];
++	int ret = 0;
++
++	/*
++	 * The ISP firmware driver will ensure these settings are applied on
++	 * a frame boundary, so we are safe to write them as they come in.
++	 *
++	 * Note that the bcm2835_isp_* param structures are identical to the
++	 * mmal-parameters.h definitions.  This avoids the need for unnecessary
++	 * field-by-field copying between structures.
++	 */
++	switch (ctrl->id) {
++	case V4L2_CID_RED_BALANCE:
++		dev->r_gain = ctrl->val;
++		ret = set_wb_gains(node);
++		break;
++	case V4L2_CID_BLUE_BALANCE:
++		dev->b_gain = ctrl->val;
++		ret = set_wb_gains(node);
++		break;
++	case V4L2_CID_DIGITAL_GAIN:
++		ret = set_digital_gain(node, ctrl->val);
++		break;
++	case V4L2_CID_USER_BCM2835_ISP_CC_MATRIX:
++		ret = set_isp_param(node, MMAL_PARAMETER_CUSTOM_CCM,
++				    ctrl->p_new.p_u8,
++				    sizeof(struct bcm2835_isp_custom_ccm));
++		break;
++	case V4L2_CID_USER_BCM2835_ISP_LENS_SHADING:
++	{
++		struct bcm2835_isp_lens_shading *v4l2_ls;
++		struct mmal_parameter_lens_shading_v2 ls;
++		struct dma_buf *dmabuf;
++		void *vcsm_handle;
++
++		v4l2_ls = (struct bcm2835_isp_lens_shading *)ctrl->p_new.p_u8;
++		/*
++		 * struct bcm2835_isp_lens_shading and struct
++		 * mmal_parameter_lens_shading_v2 match so that we can do a
++		 * simple memcpy here.
++		 * Only the dmabuf to the actual table needs any manipulation.
++		 */
++		memcpy(&ls, v4l2_ls, sizeof(ls));
++
++		dmabuf = dma_buf_get(v4l2_ls->dmabuf);
++		if (IS_ERR_OR_NULL(dmabuf))
++			return -EINVAL;
++
++		ret = vc_sm_cma_import_dmabuf(dmabuf, &vcsm_handle);
++		if (ret) {
++			dma_buf_put(dmabuf);
++			return -EINVAL;
++		}
++
++		ls.mem_handle_table = vc_sm_cma_int_handle(vcsm_handle);
++		if (ls.mem_handle_table)
++			/* The VPU will take a reference on the vcsm handle,
++			 * which in turn will retain a reference on the dmabuf.
++			 * This code can therefore safely release all
++			 * references to the buffer.
++			 */
++			ret = set_isp_param(node,
++					    MMAL_PARAMETER_LENS_SHADING_OVERRIDE,
++					    &ls,
++					    sizeof(ls));
++		else
++			ret = -EINVAL;
++
++		vc_sm_cma_free(vcsm_handle);
++		dma_buf_put(dmabuf);
++		break;
++	}
++	case V4L2_CID_USER_BCM2835_ISP_BLACK_LEVEL:
++		ret = set_isp_param(node, MMAL_PARAMETER_BLACK_LEVEL,
++				    ctrl->p_new.p_u8,
++				    sizeof(struct bcm2835_isp_black_level));
++		break;
++	case V4L2_CID_USER_BCM2835_ISP_GEQ:
++		ret = set_isp_param(node, MMAL_PARAMETER_GEQ,
++				    ctrl->p_new.p_u8,
++				    sizeof(struct bcm2835_isp_geq));
++		break;
++	case V4L2_CID_USER_BCM2835_ISP_GAMMA:
++		ret = set_isp_param(node, MMAL_PARAMETER_GAMMA,
++				    ctrl->p_new.p_u8,
++				    sizeof(struct bcm2835_isp_gamma));
++		break;
++	case V4L2_CID_USER_BCM2835_ISP_DENOISE:
++		ret = set_isp_param(node, MMAL_PARAMETER_DENOISE,
++				    ctrl->p_new.p_u8,
++				    sizeof(struct bcm2835_isp_denoise));
++		break;
++	case V4L2_CID_USER_BCM2835_ISP_CDN:
++		ret = set_isp_param(node, MMAL_PARAMETER_CDN,
++				    ctrl->p_new.p_u8,
++				    sizeof(struct bcm2835_isp_cdn));
++		break;
++	case V4L2_CID_USER_BCM2835_ISP_SHARPEN:
++		ret = set_isp_param(node, MMAL_PARAMETER_SHARPEN,
++				    ctrl->p_new.p_u8,
++				    sizeof(struct bcm2835_isp_sharpen));
++		break;
++	case V4L2_CID_USER_BCM2835_ISP_DPC:
++		ret = set_isp_param(node, MMAL_PARAMETER_DPC,
++				    ctrl->p_new.p_u8,
++				    sizeof(struct bcm2835_isp_dpc));
++		break;
++	default:
++		v4l2_info(&dev->v4l2_dev, "Unrecognised control\n");
++		ret = -EINVAL;
++	}
++
++	if (ret) {
++		v4l2_err(&dev->v4l2_dev, "%s: Failed setting ctrl \"%s\" (%08x), err %d\n",
++			 __func__, ctrl->name, ctrl->id, ret);
++		ret = -EIO;
++	}
++
++	return ret;
++}
++
++static const struct v4l2_ctrl_ops bcm2835_isp_ctrl_ops = {
++	.s_ctrl = bcm2835_isp_s_ctrl,
++};
++
++static const struct v4l2_file_operations bcm2835_isp_fops = {
++	.owner		= THIS_MODULE,
++	.open		= v4l2_fh_open,
++	.release	= vb2_fop_release,
++	.poll		= vb2_fop_poll,
++	.unlocked_ioctl = video_ioctl2,
++	.mmap		= vb2_fop_mmap
++};
++
++static int populate_qdata_fmt(struct v4l2_format *f,
++			      struct bcm2835_isp_node *node)
++{
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++	struct bcm2835_isp_q_data *q_data = &node->q_data;
++	int ret;
++
++	if (!node_is_stats(node)) {
++		v4l2_dbg(1, debug, &dev->v4l2_dev,
++			 "%s: Setting pix format for type %d, wxh: %ux%u, fmt: %08x, size %u\n",
++			 __func__, f->type, f->fmt.pix.width, f->fmt.pix.height,
++			 f->fmt.pix.pixelformat, f->fmt.pix.sizeimage);
++
++		q_data->fmt = find_format(f, node);
++		q_data->width = f->fmt.pix.width;
++		q_data->height = f->fmt.pix.height;
++		q_data->height = f->fmt.pix.height;
++
++		/* All parameters should have been set correctly by try_fmt */
++		q_data->bytesperline = f->fmt.pix.bytesperline;
++		q_data->sizeimage = f->fmt.pix.sizeimage;
++
++		/* We must indicate which of the allowed colour spaces we have. */
++		q_data->colorspace = f->fmt.pix.colorspace;
++	} else {
++		v4l2_dbg(1, debug, &dev->v4l2_dev,
++			 "%s: Setting meta format for fmt: %08x, size %u\n",
++			 __func__, f->fmt.meta.dataformat,
++			 f->fmt.meta.buffersize);
++
++		q_data->fmt = find_format(f, node);
++		q_data->width = 0;
++		q_data->height = 0;
++		q_data->bytesperline = 0;
++		q_data->sizeimage = f->fmt.meta.buffersize;
++
++		/* This won't mean anything for metadata, but may as well fill it in. */
++		q_data->colorspace = V4L2_COLORSPACE_DEFAULT;
++	}
++
++	v4l2_dbg(1, debug, &dev->v4l2_dev,
++		 "%s: Calculated bpl as %u, size %u\n", __func__,
++		 q_data->bytesperline, q_data->sizeimage);
++
++	setup_mmal_port_format(node, node->port);
++	ret = vchiq_mmal_port_set_format(dev->mmal_instance, node->port);
++	if (ret) {
++		v4l2_err(&dev->v4l2_dev,
++			 "%s: Failed vchiq_mmal_port_set_format on port, ret %d\n",
++			 __func__, ret);
++		ret = -EINVAL;
++	}
++
++	if (q_data->sizeimage < node->port->minimum_buffer.size) {
++		v4l2_err(&dev->v4l2_dev,
++			 "%s: Current buffer size of %u < min buf size %u - driver mismatch to MMAL\n",
++			 __func__,
++			 q_data->sizeimage,
++			 node->port->minimum_buffer.size);
++	}
++
++	v4l2_dbg(1, debug, &dev->v4l2_dev,
++		 "%s: Set format for type %d, wxh: %dx%d, fmt: %08x, size %u\n",
++		 __func__, f->type, q_data->width, q_data->height,
++		 q_data->fmt->fourcc, q_data->sizeimage);
++
++	return ret;
++}
++
++static int bcm2835_isp_node_querycap(struct file *file, void *priv,
++				     struct v4l2_capability *cap)
++{
++	strscpy(cap->driver, BCM2835_ISP_NAME, sizeof(cap->driver));
++	strscpy(cap->card, BCM2835_ISP_NAME, sizeof(cap->card));
++	snprintf(cap->bus_info, sizeof(cap->bus_info), "platform:%s",
++		 BCM2835_ISP_NAME);
++
++	return 0;
++}
++
++static int bcm2835_isp_node_g_fmt(struct file *file, void *priv,
++				  struct v4l2_format *f)
++{
++	struct bcm2835_isp_node *node = video_drvdata(file);
++
++	if (f->type != node->queue.type)
++		return -EINVAL;
++
++	if (node_is_stats(node)) {
++		f->fmt.meta.dataformat = V4L2_META_FMT_BCM2835_ISP_STATS;
++		f->fmt.meta.buffersize =
++			node->port->minimum_buffer.size;
++	} else {
++		struct bcm2835_isp_q_data *q_data = &node->q_data;
++
++		f->fmt.pix.width = q_data->width;
++		f->fmt.pix.height = q_data->height;
++		f->fmt.pix.field = V4L2_FIELD_NONE;
++		f->fmt.pix.pixelformat = q_data->fmt->fourcc;
++		f->fmt.pix.bytesperline = q_data->bytesperline;
++		f->fmt.pix.sizeimage = q_data->sizeimage;
++		f->fmt.pix.colorspace = q_data->colorspace;
++	}
++
++	return 0;
++}
++
++static int bcm2835_isp_node_enum_fmt(struct file *file, void  *priv,
++				     struct v4l2_fmtdesc *f)
++{
++	struct bcm2835_isp_node *node = video_drvdata(file);
++
++	if (f->type != node->queue.type)
++		return -EINVAL;
++
++	if (f->index < node->num_supported_fmts) {
++		/* Format found */
++		f->pixelformat = node->supported_fmts[f->index]->fourcc;
++		f->flags = 0;
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++static int bcm2835_isp_enum_framesizes(struct file *file, void *priv,
++				       struct v4l2_frmsizeenum *fsize)
++{
++	struct bcm2835_isp_node *node = video_drvdata(file);
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++	const struct bcm2835_isp_fmt *fmt;
++
++	if (node_is_stats(node) || fsize->index)
++		return -EINVAL;
++
++	fmt = find_format_by_fourcc(fsize->pixel_format, node);
++	if (!fmt) {
++		v4l2_err(&dev->v4l2_dev, "Invalid pixel code: %x\n",
++			 fsize->pixel_format);
++		return -EINVAL;
++	}
++
++	fsize->type = V4L2_FRMSIZE_TYPE_STEPWISE;
++	fsize->stepwise.min_width = MIN_DIM;
++	fsize->stepwise.max_width = MAX_DIM;
++	fsize->stepwise.step_width = fmt->step_size;
++
++	fsize->stepwise.min_height = MIN_DIM;
++	fsize->stepwise.max_height = MAX_DIM;
++	fsize->stepwise.step_height = fmt->step_size;
++
++	return 0;
++}
++
++static int bcm2835_isp_node_try_fmt(struct file *file, void *priv,
++				    struct v4l2_format *f)
++{
++	struct bcm2835_isp_node *node = video_drvdata(file);
++	const struct bcm2835_isp_fmt *fmt;
++
++	if (f->type != node->queue.type)
++		return -EINVAL;
++
++	fmt = find_format(f, node);
++	if (!fmt)
++		fmt = get_default_format(node);
++
++	if (!node_is_stats(node)) {
++		int is_rgb;
++
++		f->fmt.pix.width = max(min(f->fmt.pix.width, MAX_DIM),
++				       MIN_DIM);
++		f->fmt.pix.height = max(min(f->fmt.pix.height, MAX_DIM),
++					MIN_DIM);
++
++		f->fmt.pix.pixelformat = fmt->fourcc;
++
++		/*
++		 * Fill in the actual colour space when the requested one was
++		 * not supported. This also catches the case when the "default"
++		 * colour space was requested (as that's never in the mask).
++		 */
++		if (!(V4L2_COLORSPACE_MASK(f->fmt.pix.colorspace) & fmt->colorspace_mask))
++			f->fmt.pix.colorspace = fmt->colorspace_default;
++		/* In all cases, we only support the defaults for these: */
++		f->fmt.pix.ycbcr_enc = V4L2_MAP_YCBCR_ENC_DEFAULT(f->fmt.pix.colorspace);
++		f->fmt.pix.xfer_func = V4L2_MAP_XFER_FUNC_DEFAULT(f->fmt.pix.colorspace);
++		/* RAW counts as sRGB here so that we get full range. */
++		is_rgb = f->fmt.pix.colorspace == V4L2_COLORSPACE_SRGB ||
++			f->fmt.pix.colorspace == V4L2_COLORSPACE_RAW;
++		f->fmt.pix.quantization = V4L2_MAP_QUANTIZATION_DEFAULT(is_rgb, f->fmt.pix.colorspace,
++									f->fmt.pix.ycbcr_enc);
++
++		/* Respect any stride value (suitably aligned) that was requested. */
++		f->fmt.pix.bytesperline = max(get_bytesperline(f->fmt.pix.width, fmt),
++					      ALIGN(f->fmt.pix.bytesperline,
++						    fmt->bytesperline_align));
++		f->fmt.pix.field = V4L2_FIELD_NONE;
++		f->fmt.pix.sizeimage =
++			get_sizeimage(f->fmt.pix.bytesperline, f->fmt.pix.width,
++				      f->fmt.pix.height, fmt);
++	} else {
++		f->fmt.meta.dataformat = fmt->fourcc;
++		f->fmt.meta.buffersize = node->port->minimum_buffer.size;
++	}
++
++	return 0;
++}
++
++static int bcm2835_isp_node_s_fmt(struct file *file, void *priv,
++				  struct v4l2_format *f)
++{
++	struct bcm2835_isp_node *node = video_drvdata(file);
++	int ret;
++
++	if (f->type != node->queue.type)
++		return -EINVAL;
++
++	ret = bcm2835_isp_node_try_fmt(file, priv, f);
++	if (ret)
++		return ret;
++
++	v4l2_dbg(1, debug, &node_get_dev(node)->v4l2_dev,
++		 "%s: Set format for node %s[%d]\n",
++		 __func__, node->name, node->id);
++
++	return populate_qdata_fmt(f, node);
++}
++
++static int bcm2835_isp_node_s_selection(struct file *file, void *fh,
++					struct v4l2_selection *s)
++{
++	struct mmal_parameter_crop crop;
++	struct bcm2835_isp_node *node = video_drvdata(file);
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++
++	/* This return value is required fro V4L2 compliance. */
++	if (node_is_stats(node))
++		return -ENOTTY;
++
++	if (!s->r.width || !s->r.height)
++		return -EINVAL;
++
++	/* We can only set crop on the input. */
++	switch (s->target) {
++	case V4L2_SEL_TGT_CROP:
++		/*
++		 * Adjust the crop window if it goes outside of the frame
++		 * dimensions.
++		 */
++		s->r.left = min((unsigned int)max(s->r.left, 0),
++				node->q_data.width - MIN_DIM);
++		s->r.top = min((unsigned int)max(s->r.top, 0),
++			       node->q_data.height - MIN_DIM);
++		s->r.width = max(min(s->r.width,
++				     node->q_data.width - s->r.left), MIN_DIM);
++		s->r.height = max(min(s->r.height,
++				      node->q_data.height - s->r.top), MIN_DIM);
++		break;
++	case V4L2_SEL_TGT_CROP_DEFAULT:
++		/* Default (i.e. no) crop window. */
++		s->r.left = 0;
++		s->r.top = 0;
++		s->r.width = node->q_data.width;
++		s->r.height = node->q_data.height;
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	crop.rect.x = s->r.left;
++	crop.rect.y = s->r.top;
++	crop.rect.width = s->r.width;
++	crop.rect.height = s->r.height;
++
++	return vchiq_mmal_port_parameter_set(dev->mmal_instance, node->port,
++					     MMAL_PARAMETER_CROP,
++					     &crop, sizeof(crop));
++}
++
++static int bcm2835_isp_node_g_selection(struct file *file, void *fh,
++					struct v4l2_selection *s)
++{
++	struct mmal_parameter_crop crop;
++	struct bcm2835_isp_node *node = video_drvdata(file);
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++	u32 crop_size = sizeof(crop);
++	int ret;
++
++	/* We can only return out an input crop. */
++	switch (s->target) {
++	case V4L2_SEL_TGT_CROP:
++		ret = vchiq_mmal_port_parameter_get(dev->mmal_instance,
++						    node->port,
++						    MMAL_PARAMETER_CROP,
++						    &crop, &crop_size);
++		if (!ret) {
++			s->r.left = crop.rect.x;
++			s->r.top = crop.rect.y;
++			s->r.width = crop.rect.width;
++			s->r.height = crop.rect.height;
++		}
++		break;
++	case V4L2_SEL_TGT_CROP_DEFAULT:
++	case V4L2_SEL_TGT_CROP_BOUNDS:
++		/* Default (i.e. no) crop window. */
++		s->r.left = 0;
++		s->r.top = 0;
++		s->r.width = node->q_data.width;
++		s->r.height = node->q_data.height;
++		ret = 0;
++		break;
++	default:
++		ret =  -EINVAL;
++	}
++
++	return ret;
++}
++
++static int bcm3285_isp_subscribe_event(struct v4l2_fh *fh,
++				       const struct v4l2_event_subscription *s)
++{
++	switch (s->type) {
++	/* Cannot change source parameters dynamically at runtime. */
++	case V4L2_EVENT_SOURCE_CHANGE:
++		return -EINVAL;
++	case V4L2_EVENT_CTRL:
++		return v4l2_ctrl_subscribe_event(fh, s);
++	default:
++		return v4l2_event_subscribe(fh, s, 4, NULL);
++	}
++}
++
++static const struct v4l2_ioctl_ops bcm2835_isp_node_ioctl_ops = {
++	.vidioc_querycap		= bcm2835_isp_node_querycap,
++	.vidioc_g_fmt_vid_cap		= bcm2835_isp_node_g_fmt,
++	.vidioc_g_fmt_vid_out		= bcm2835_isp_node_g_fmt,
++	.vidioc_g_fmt_meta_cap		= bcm2835_isp_node_g_fmt,
++	.vidioc_s_fmt_vid_cap		= bcm2835_isp_node_s_fmt,
++	.vidioc_s_fmt_vid_out		= bcm2835_isp_node_s_fmt,
++	.vidioc_s_fmt_meta_cap		= bcm2835_isp_node_s_fmt,
++	.vidioc_try_fmt_vid_cap		= bcm2835_isp_node_try_fmt,
++	.vidioc_try_fmt_vid_out		= bcm2835_isp_node_try_fmt,
++	.vidioc_try_fmt_meta_cap	= bcm2835_isp_node_try_fmt,
++	.vidioc_s_selection		= bcm2835_isp_node_s_selection,
++	.vidioc_g_selection		= bcm2835_isp_node_g_selection,
++
++	.vidioc_enum_fmt_vid_cap	= bcm2835_isp_node_enum_fmt,
++	.vidioc_enum_fmt_vid_out	= bcm2835_isp_node_enum_fmt,
++	.vidioc_enum_fmt_meta_cap	= bcm2835_isp_node_enum_fmt,
++	.vidioc_enum_framesizes		= bcm2835_isp_enum_framesizes,
++
++	.vidioc_reqbufs			= vb2_ioctl_reqbufs,
++	.vidioc_querybuf		= vb2_ioctl_querybuf,
++	.vidioc_qbuf			= vb2_ioctl_qbuf,
++	.vidioc_dqbuf			= vb2_ioctl_dqbuf,
++	.vidioc_expbuf			= vb2_ioctl_expbuf,
++	.vidioc_create_bufs		= vb2_ioctl_create_bufs,
++	.vidioc_prepare_buf		= vb2_ioctl_prepare_buf,
++
++	.vidioc_streamon		= vb2_ioctl_streamon,
++	.vidioc_streamoff		= vb2_ioctl_streamoff,
++
++	.vidioc_subscribe_event		= bcm3285_isp_subscribe_event,
++	.vidioc_unsubscribe_event	= v4l2_event_unsubscribe,
++};
++
++/*
++ * Size of the array to provide to the VPU when asking for the list of supported
++ * formats.
++ *
++ * The ISP component currently advertises 62 input formats, so add a small
++ * overhead on that. Should the component advertise more formats then the excess
++ * will be dropped and a warning logged.
++ */
++#define MAX_SUPPORTED_ENCODINGS 70
++
++/* Populate node->supported_fmts with the formats supported by those ports. */
++static int bcm2835_isp_get_supported_fmts(struct bcm2835_isp_node *node)
++{
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++	struct bcm2835_isp_fmt const **list;
++	unsigned int i, j, num_encodings;
++	u32 fourccs[MAX_SUPPORTED_ENCODINGS];
++	u32 param_size = sizeof(fourccs);
++	int ret;
++
++	ret = vchiq_mmal_port_parameter_get(dev->mmal_instance, node->port,
++					    MMAL_PARAMETER_SUPPORTED_ENCODINGS,
++					    &fourccs, &param_size);
++
++	if (ret) {
++		if (ret == MMAL_MSG_STATUS_ENOSPC) {
++			v4l2_err(&dev->v4l2_dev,
++				 "%s: port has more encodings than we provided space for. Some are dropped (%zu vs %u).\n",
++				 __func__, param_size / sizeof(u32),
++				 MAX_SUPPORTED_ENCODINGS);
++			num_encodings = MAX_SUPPORTED_ENCODINGS;
++		} else {
++			v4l2_err(&dev->v4l2_dev, "%s: get_param ret %u.\n",
++				 __func__, ret);
++			return -EINVAL;
++		}
++	} else {
++		num_encodings = param_size / sizeof(u32);
++	}
++
++	/*
++	 * Assume at this stage that all encodings will be supported in V4L2.
++	 * Any that aren't supported will waste a very small amount of memory.
++	 */
++	list = devm_kzalloc(dev->dev,
++			    sizeof(struct bcm2835_isp_fmt *) * num_encodings,
++			    GFP_KERNEL);
++	if (!list)
++		return -ENOMEM;
++	node->supported_fmts = list;
++
++	for (i = 0, j = 0; i < num_encodings; i++) {
++		const struct bcm2835_isp_fmt *fmt = get_fmt(fourccs[i]);
++
++		if (fmt) {
++			list[j] = fmt;
++			j++;
++		}
++	}
++	node->num_supported_fmts = j;
++
++	return 0;
++}
++
++/*
++ * Register a device node /dev/video<N> to go along with one of the ISP's input
++ * or output nodes.
++ */
++static int register_node(struct bcm2835_isp_dev *dev,
++			 unsigned int instance,
++			 struct bcm2835_isp_node *node,
++			 int index)
++{
++	struct video_device *vfd;
++	struct vb2_queue *queue;
++	int ret;
++
++	mutex_init(&node->lock);
++	mutex_init(&node->queue_lock);
++
++	node->dev = dev;
++	vfd = &node->vfd;
++	queue = &node->queue;
++	queue->type = index_to_queue_type(index);
++	/*
++	 * Setup the node type-specific params.
++	 *
++	 * Only the OUTPUT node can set controls and crop windows. However,
++	 * we must allow the s/g_selection ioctl on the stats node as v4l2
++	 * compliance expects it to return a -ENOTTY, and the framework
++	 * does not handle it if the ioctl is disabled.
++	 */
++	switch (queue->type) {
++	case V4L2_BUF_TYPE_VIDEO_OUTPUT:
++		vfd->device_caps = V4L2_CAP_VIDEO_OUTPUT | V4L2_CAP_STREAMING;
++		node->id = index;
++		node->vfl_dir = VFL_DIR_TX;
++		node->name = "output";
++		node->port = &dev->component->input[node->id];
++		break;
++	case V4L2_BUF_TYPE_VIDEO_CAPTURE:
++		vfd->device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING;
++		/* First Capture node starts at id 0, etc. */
++		node->id = index - BCM2835_ISP_NUM_OUTPUTS;
++		node->vfl_dir = VFL_DIR_RX;
++		node->name = "capture";
++		node->port = &dev->component->output[node->id];
++		v4l2_disable_ioctl(&node->vfd, VIDIOC_S_CTRL);
++		v4l2_disable_ioctl(&node->vfd, VIDIOC_S_SELECTION);
++		v4l2_disable_ioctl(&node->vfd, VIDIOC_G_SELECTION);
++		break;
++	case V4L2_BUF_TYPE_META_CAPTURE:
++		vfd->device_caps = V4L2_CAP_META_CAPTURE | V4L2_CAP_STREAMING;
++		node->id = index - BCM2835_ISP_NUM_OUTPUTS;
++		node->vfl_dir = VFL_DIR_RX;
++		node->name = "stats";
++		node->port = &dev->component->output[node->id];
++		v4l2_disable_ioctl(&node->vfd, VIDIOC_S_CTRL);
++		v4l2_disable_ioctl(&node->vfd, VIDIOC_S_SELECTION);
++		v4l2_disable_ioctl(&node->vfd, VIDIOC_G_SELECTION);
++		break;
++	}
++
++	/* We use the selection API instead of the old crop API. */
++	v4l2_disable_ioctl(vfd, VIDIOC_CROPCAP);
++	v4l2_disable_ioctl(vfd, VIDIOC_G_CROP);
++	v4l2_disable_ioctl(vfd, VIDIOC_S_CROP);
++
++	ret = bcm2835_isp_get_supported_fmts(node);
++	if (ret)
++		return ret;
++
++	/* Initialise the video node. */
++	vfd->vfl_type	= VFL_TYPE_VIDEO;
++	vfd->fops	= &bcm2835_isp_fops,
++	vfd->ioctl_ops	= &bcm2835_isp_node_ioctl_ops,
++	vfd->minor	= -1,
++	vfd->release	= video_device_release_empty,
++	vfd->queue	= &node->queue;
++	vfd->lock	= &node->lock;
++	vfd->v4l2_dev	= &dev->v4l2_dev;
++	vfd->vfl_dir	= node->vfl_dir;
++
++	node->q_data.fmt = get_default_format(node);
++	node->q_data.width = DEFAULT_DIM;
++	node->q_data.height = DEFAULT_DIM;
++	node->q_data.bytesperline =
++		get_bytesperline(DEFAULT_DIM, node->q_data.fmt);
++	node->q_data.sizeimage = node_is_stats(node) ?
++				 node->port->recommended_buffer.size :
++				 get_sizeimage(node->q_data.bytesperline,
++					       node->q_data.width,
++					       node->q_data.height,
++					       node->q_data.fmt);
++	node->q_data.colorspace = node->q_data.fmt->colorspace_default;
++
++	queue->io_modes = VB2_MMAP | VB2_DMABUF;
++	queue->drv_priv = node;
++	queue->ops = &bcm2835_isp_node_queue_ops;
++	queue->mem_ops = &vb2_dma_contig_memops;
++	queue->buf_struct_size = sizeof(struct bcm2835_isp_buffer);
++	queue->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;
++	queue->dev = dev->dev;
++	queue->lock = &node->queue_lock;
++
++	ret = vb2_queue_init(queue);
++	if (ret < 0) {
++		v4l2_info(&dev->v4l2_dev, "vb2_queue_init failed\n");
++		return ret;
++	}
++
++	/* Set some controls and defaults, but only on the VIDEO_OUTPUT node. */
++	if (node_is_output(node)) {
++		unsigned int i;
++
++		/* Use this ctrl template to assign custom ISP ctrls. */
++		struct v4l2_ctrl_config ctrl_template = {
++			.ops		= &bcm2835_isp_ctrl_ops,
++			.type		= V4L2_CTRL_TYPE_U8,
++			.def		= 0,
++			.min		= 0x00,
++			.max		= 0xff,
++			.step		= 1,
++		};
++
++		/* 3 standard controls, and an array of custom controls */
++		ret = v4l2_ctrl_handler_init(&dev->ctrl_handler,
++					     3 + ARRAY_SIZE(custom_ctrls));
++		if (ret) {
++			v4l2_err(&dev->v4l2_dev, "ctrl_handler init failed (%d)\n",
++				 ret);
++			goto queue_cleanup;
++		}
++
++		dev->r_gain = 1000;
++		dev->b_gain = 1000;
++
++		v4l2_ctrl_new_std(&dev->ctrl_handler,  &bcm2835_isp_ctrl_ops,
++				  V4L2_CID_RED_BALANCE, 1, 0xffff, 1,
++				  dev->r_gain);
++
++		v4l2_ctrl_new_std(&dev->ctrl_handler, &bcm2835_isp_ctrl_ops,
++				  V4L2_CID_BLUE_BALANCE, 1, 0xffff, 1,
++				  dev->b_gain);
++
++		v4l2_ctrl_new_std(&dev->ctrl_handler, &bcm2835_isp_ctrl_ops,
++				  V4L2_CID_DIGITAL_GAIN, 1, 0xffff, 1, 1000);
++
++		for (i = 0; i < ARRAY_SIZE(custom_ctrls); i++) {
++			ctrl_template.name = custom_ctrls[i].name;
++			ctrl_template.id = custom_ctrls[i].id;
++			ctrl_template.dims[0] = custom_ctrls[i].size;
++			ctrl_template.flags = custom_ctrls[i].flags;
++			v4l2_ctrl_new_custom(&dev->ctrl_handler,
++					     &ctrl_template, NULL);
++		}
++
++		node->vfd.ctrl_handler = &dev->ctrl_handler;
++		if (dev->ctrl_handler.error) {
++			ret = dev->ctrl_handler.error;
++			v4l2_err(&dev->v4l2_dev, "controls init failed (%d)\n",
++				 ret);
++			v4l2_ctrl_handler_free(&dev->ctrl_handler);
++			goto ctrl_cleanup;
++		}
++	}
++
++	/* Define the device names */
++	snprintf(vfd->name, sizeof(node->vfd.name), "%s-%s%d", BCM2835_ISP_NAME,
++		 node->name, node->id);
++
++	ret = video_register_device(vfd, VFL_TYPE_VIDEO, video_nr[instance]);
++	if (ret) {
++		v4l2_err(&dev->v4l2_dev,
++			 "Failed to register video %s[%d] device node\n",
++			 node->name, node->id);
++		goto ctrl_cleanup;
++	}
++
++	node->registered = true;
++	video_set_drvdata(vfd, node);
++
++	v4l2_info(&dev->v4l2_dev,
++		  "Device node %s[%d] registered as /dev/video%d\n",
++		  node->name, node->id, vfd->num);
++
++	return 0;
++
++ctrl_cleanup:
++	if (node_is_output(node))
++		v4l2_ctrl_handler_free(&dev->ctrl_handler);
++queue_cleanup:
++	vb2_queue_release(&node->queue);
++	return ret;
++}
++
++/* Unregister one of the /dev/video<N> nodes associated with the ISP. */
++static void bcm2835_unregister_node(struct bcm2835_isp_node *node)
++{
++	struct bcm2835_isp_dev *dev = node_get_dev(node);
++
++	v4l2_info(&dev->v4l2_dev,
++		  "Unregistering node %s[%d] device node /dev/video%d\n",
++		  node->name, node->id, node->vfd.num);
++
++	if (node->registered) {
++		video_unregister_device(&node->vfd);
++		if (node_is_output(node))
++			v4l2_ctrl_handler_free(&dev->ctrl_handler);
++		vb2_queue_release(&node->queue);
++	}
++
++	/*
++	 * node->supported_fmts.list is free'd automatically
++	 * as a managed resource.
++	 */
++	node->supported_fmts = NULL;
++	node->num_supported_fmts = 0;
++	node->vfd.ctrl_handler = NULL;
++	node->registered = false;
++}
++
++static void media_controller_unregister(struct bcm2835_isp_dev *dev)
++{
++	unsigned int i;
++
++	v4l2_info(&dev->v4l2_dev, "Unregister from media controller\n");
++
++	if (dev->media_device_registered) {
++		media_device_unregister(&dev->mdev);
++		media_device_cleanup(&dev->mdev);
++		dev->media_device_registered = false;
++	}
++
++	kfree(dev->entity.name);
++	dev->entity.name = NULL;
++
++	if (dev->media_entity_registered) {
++		media_device_unregister_entity(&dev->entity);
++		dev->media_entity_registered = false;
++	}
++
++	for (i = 0; i < BCM2835_ISP_NUM_NODES; i++) {
++		struct bcm2835_isp_node *node = &dev->node[i];
++
++		if (node->media_node_registered) {
++			media_remove_intf_links(node->intf_link->intf);
++			media_entity_remove_links(&dev->node[i].vfd.entity);
++			media_devnode_remove(node->intf_devnode);
++			media_device_unregister_entity(&node->vfd.entity);
++			kfree(node->vfd.entity.name);
++		}
++		node->media_node_registered = false;
++	}
++
++	dev->v4l2_dev.mdev = NULL;
++}
++
++static int media_controller_register_node(struct bcm2835_isp_dev *dev, int num)
++{
++	struct bcm2835_isp_node *node = &dev->node[num];
++	struct media_entity *entity = &node->vfd.entity;
++	int output = node_is_output(node);
++	char *name;
++	int ret;
++
++	v4l2_info(&dev->v4l2_dev,
++		  "Register %s node %d with media controller\n",
++		  output ? "output" : "capture", num);
++	entity->obj_type = MEDIA_ENTITY_TYPE_VIDEO_DEVICE;
++	entity->function = MEDIA_ENT_F_IO_V4L;
++	entity->info.dev.major = VIDEO_MAJOR;
++	entity->info.dev.minor = node->vfd.minor;
++	name = kmalloc(BCM2835_ISP_ENTITY_NAME_LEN, GFP_KERNEL);
++	if (!name) {
++		ret = -ENOMEM;
++		goto error_no_mem;
++	}
++	snprintf(name, BCM2835_ISP_ENTITY_NAME_LEN, "%s0-%s%d",
++		 BCM2835_ISP_NAME, output ? "output" : "capture", num);
++	entity->name = name;
++	node->pad.flags = output ? MEDIA_PAD_FL_SOURCE : MEDIA_PAD_FL_SINK;
++	ret = media_entity_pads_init(entity, 1, &node->pad);
++	if (ret)
++		goto error_pads_init;
++	ret = media_device_register_entity(&dev->mdev, entity);
++	if (ret)
++		goto error_register_entity;
++
++	node->intf_devnode = media_devnode_create(&dev->mdev,
++						  MEDIA_INTF_T_V4L_VIDEO, 0,
++						  VIDEO_MAJOR, node->vfd.minor);
++	if (!node->intf_devnode) {
++		ret = -ENOMEM;
++		goto error_devnode_create;
++	}
++
++	node->intf_link = media_create_intf_link(entity,
++						 &node->intf_devnode->intf,
++						 MEDIA_LNK_FL_IMMUTABLE |
++						 MEDIA_LNK_FL_ENABLED);
++	if (!node->intf_link) {
++		ret = -ENOMEM;
++		goto error_create_intf_link;
++	}
++
++	if (output)
++		ret = media_create_pad_link(entity, 0, &dev->entity, num,
++					    MEDIA_LNK_FL_IMMUTABLE |
++						    MEDIA_LNK_FL_ENABLED);
++	else
++		ret = media_create_pad_link(&dev->entity, num, entity, 0,
++					    MEDIA_LNK_FL_IMMUTABLE |
++					    MEDIA_LNK_FL_ENABLED);
++	if (ret)
++		goto error_create_pad_link;
++
++	dev->node[num].media_node_registered = true;
++	return 0;
++
++error_create_pad_link:
++	media_remove_intf_links(&node->intf_devnode->intf);
++error_create_intf_link:
++	media_devnode_remove(node->intf_devnode);
++error_devnode_create:
++	media_device_unregister_entity(&node->vfd.entity);
++error_register_entity:
++error_pads_init:
++	kfree(entity->name);
++	entity->name = NULL;
++error_no_mem:
++	if (ret)
++		v4l2_info(&dev->v4l2_dev, "Error registering node\n");
++
++	return ret;
++}
++
++static int media_controller_register(struct bcm2835_isp_dev *dev)
++{
++	char *name;
++	unsigned int i;
++	int ret;
++
++	v4l2_dbg(2, debug, &dev->v4l2_dev, "Registering with media controller\n");
++	dev->mdev.dev = dev->dev;
++	strscpy(dev->mdev.model, "bcm2835-isp",
++		sizeof(dev->mdev.model));
++	strscpy(dev->mdev.bus_info, "platform:bcm2835-isp",
++		sizeof(dev->mdev.bus_info));
++	media_device_init(&dev->mdev);
++	dev->v4l2_dev.mdev = &dev->mdev;
++
++	v4l2_dbg(2, debug, &dev->v4l2_dev, "Register entity for nodes\n");
++
++	name = kmalloc(BCM2835_ISP_ENTITY_NAME_LEN, GFP_KERNEL);
++	if (!name) {
++		ret = -ENOMEM;
++		goto done;
++	}
++	snprintf(name, BCM2835_ISP_ENTITY_NAME_LEN, "bcm2835_isp0");
++	dev->entity.name = name;
++	dev->entity.obj_type = MEDIA_ENTITY_TYPE_BASE;
++	dev->entity.function = MEDIA_ENT_F_PROC_VIDEO_SCALER;
++
++	for (i = 0; i < BCM2835_ISP_NUM_NODES; i++) {
++		dev->pad[i].flags = node_is_output(&dev->node[i]) ?
++					MEDIA_PAD_FL_SINK : MEDIA_PAD_FL_SOURCE;
++	}
++
++	ret = media_entity_pads_init(&dev->entity, BCM2835_ISP_NUM_NODES,
++				     dev->pad);
++	if (ret)
++		goto done;
++
++	ret = media_device_register_entity(&dev->mdev, &dev->entity);
++	if (ret)
++		goto done;
++
++	dev->media_entity_registered = true;
++	for (i = 0; i < BCM2835_ISP_NUM_NODES; i++) {
++		ret = media_controller_register_node(dev, i);
++		if (ret)
++			goto done;
++	}
++
++	ret = media_device_register(&dev->mdev);
++	if (!ret)
++		dev->media_device_registered = true;
++done:
++	return ret;
++}
++
++static void bcm2835_isp_remove_instance(struct bcm2835_isp_dev *dev)
++{
++	unsigned int i;
++
++	media_controller_unregister(dev);
++
++	for (i = 0; i < BCM2835_ISP_NUM_NODES; i++)
++		bcm2835_unregister_node(&dev->node[i]);
++
++	v4l2_device_unregister(&dev->v4l2_dev);
++
++	if (dev->component)
++		vchiq_mmal_component_finalise(dev->mmal_instance,
++					      dev->component);
++
++	vchiq_mmal_finalise(dev->mmal_instance);
++}
++
++static int bcm2835_isp_probe_instance(struct vchiq_device *device,
++				      struct bcm2835_isp_dev **dev_int,
++				      unsigned int instance)
++{
++	struct bcm2835_isp_dev *dev;
++	unsigned int i;
++	int ret;
++
++	dev = devm_kzalloc(&device->dev, sizeof(*dev), GFP_KERNEL);
++	if (!dev)
++		return -ENOMEM;
++
++	*dev_int = dev;
++	dev->dev = &device->dev;
++
++	ret = v4l2_device_register(&device->dev, &dev->v4l2_dev);
++	if (ret)
++		return ret;
++
++	ret = vchiq_mmal_init(&device->dev, &dev->mmal_instance);
++	if (ret) {
++		v4l2_device_unregister(&dev->v4l2_dev);
++		return ret;
++	}
++
++	ret = vchiq_mmal_component_init(dev->mmal_instance, "ril.isp",
++					&dev->component);
++	if (ret) {
++		v4l2_err(&dev->v4l2_dev,
++			 "%s: failed to create ril.isp component\n", __func__);
++		return ret;
++	}
++
++	if (dev->component->inputs < BCM2835_ISP_NUM_OUTPUTS ||
++	    dev->component->outputs < BCM2835_ISP_NUM_CAPTURES +
++					BCM2835_ISP_NUM_METADATA) {
++		v4l2_err(&dev->v4l2_dev,
++			 "%s: ril.isp returned %d i/p (%d expected), %d o/p (%d expected) ports\n",
++			  __func__, dev->component->inputs,
++			  BCM2835_ISP_NUM_OUTPUTS,
++			  dev->component->outputs,
++			  BCM2835_ISP_NUM_CAPTURES + BCM2835_ISP_NUM_METADATA);
++		return -EINVAL;
++	}
++
++	atomic_set(&dev->num_streaming, 0);
++
++	for (i = 0; i < BCM2835_ISP_NUM_NODES; i++) {
++		struct bcm2835_isp_node *node = &dev->node[i];
++
++		ret = register_node(dev, instance, node, i);
++		if (ret)
++			return ret;
++	}
++
++	ret = media_controller_register(dev);
++	if (ret)
++		return ret;
++
++	return 0;
++}
++
++static void bcm2835_isp_remove(struct vchiq_device *device)
++{
++	struct bcm2835_isp_dev **bcm2835_isp_instances;
++	unsigned int i;
++
++	bcm2835_isp_instances = vchiq_get_drvdata(device);
++	for (i = 0; i < BCM2835_ISP_NUM_INSTANCES; i++) {
++		if (bcm2835_isp_instances[i])
++			bcm2835_isp_remove_instance(bcm2835_isp_instances[i]);
++	}
++}
++
++static int bcm2835_isp_probe(struct vchiq_device *device)
++{
++	struct bcm2835_isp_dev **bcm2835_isp_instances;
++	unsigned int i;
++	int ret;
++
++	ret = dma_set_mask_and_coherent(&device->dev, DMA_BIT_MASK(32));
++	if (ret) {
++		dev_err(&device->dev, "dma_set_mask_and_coherent failed: %d\n",
++			ret);
++		return ret;
++	}
++
++	bcm2835_isp_instances = devm_kzalloc(&device->dev,
++					     sizeof(bcm2835_isp_instances) *
++						      BCM2835_ISP_NUM_INSTANCES,
++					     GFP_KERNEL);
++	if (!bcm2835_isp_instances)
++		return -ENOMEM;
++
++	vchiq_set_drvdata(device, bcm2835_isp_instances);
++
++	for (i = 0; i < BCM2835_ISP_NUM_INSTANCES; i++) {
++		ret = bcm2835_isp_probe_instance(device,
++						 &bcm2835_isp_instances[i], i);
++		if (ret)
++			goto error;
++	}
++
++	dev_info(&device->dev, "Loaded V4L2 %s\n", BCM2835_ISP_NAME);
++	return 0;
++
++error:
++	bcm2835_isp_remove(device);
++
++	return ret;
++}
++
++static struct vchiq_driver bcm2835_isp_drv = {
++	.probe = bcm2835_isp_probe,
++	.remove = bcm2835_isp_remove,
++	.driver = {
++			.name = BCM2835_ISP_NAME,
++		  },
++};
++
++module_vchiq_driver(bcm2835_isp_drv);
++
++MODULE_DESCRIPTION("BCM2835 ISP driver");
++MODULE_AUTHOR("Naushir Patuck <naush@raspberrypi.com>");
++MODULE_LICENSE("GPL");
++MODULE_VERSION("1.0");
++MODULE_ALIAS("vchiq:bcm2835-isp");
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h
+@@ -113,6 +113,10 @@
+  */
+ #define MMAL_ENCODING_EGL_IMAGE        MMAL_FOURCC('E', 'G', 'L', 'I')
+ 
++/** ISP image statistics format
++ */
++#define MMAL_ENCODING_BRCM_STATS       MMAL_FOURCC('S', 'T', 'A', 'T')
++
+ /* }@ */
+ 
+ /** \name Pre-defined audio encodings */
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
+@@ -223,6 +223,64 @@ enum mmal_parameter_camera_type {
+ 	MMAL_PARAMETER_SHUTTER_SPEED,
+ 		/**< Takes a @ref MMAL_PARAMETER_AWB_GAINS_T */
+ 	MMAL_PARAMETER_CUSTOM_AWB_GAINS,
++		/**< Takes a @ref MMAL_PARAMETER_CAMERA_SETTINGS_T */
++	MMAL_PARAMETER_CAMERA_SETTINGS,
++		/**< Takes a @ref MMAL_PARAMETER_PRIVACY_INDICATOR_T */
++	MMAL_PARAMETER_PRIVACY_INDICATOR,
++		/**< Takes a @ref MMAL_PARAMETER_BOOLEAN_T */
++	MMAL_PARAMETER_VIDEO_DENOISE,
++		/**< Takes a @ref MMAL_PARAMETER_BOOLEAN_T */
++	MMAL_PARAMETER_STILLS_DENOISE,
++		/**< Takes a @ref MMAL_PARAMETER_CAMERA_ANNOTATE_T */
++	MMAL_PARAMETER_ANNOTATE,
++		/**< Takes a @ref MMAL_PARAMETER_STEREOSCOPIC_MODE_T */
++	MMAL_PARAMETER_STEREOSCOPIC_MODE,
++		/**< Takes a @ref MMAL_PARAMETER_CAMERA_INTERFACE_T */
++	MMAL_PARAMETER_CAMERA_INTERFACE,
++		/**< Takes a @ref MMAL_PARAMETER_CAMERA_CLOCKING_MODE_T */
++	MMAL_PARAMETER_CAMERA_CLOCKING_MODE,
++		/**< Takes a @ref MMAL_PARAMETER_CAMERA_RX_CONFIG_T */
++	MMAL_PARAMETER_CAMERA_RX_CONFIG,
++		/**< Takes a @ref MMAL_PARAMETER_CAMERA_RX_TIMING_T */
++	MMAL_PARAMETER_CAMERA_RX_TIMING,
++		/**< Takes a @ref MMAL_PARAMETER_UINT32_T */
++	MMAL_PARAMETER_DPF_CONFIG,
++
++	/* 0x50 */
++		/**< Takes a @ref MMAL_PARAMETER_UINT32_T */
++	MMAL_PARAMETER_JPEG_RESTART_INTERVAL,
++		/**< Takes a @ref MMAL_PARAMETER_UINT32_T */
++	MMAL_PARAMETER_CAMERA_ISP_BLOCK_OVERRIDE,
++		/**< Takes a @ref MMAL_PARAMETER_LENS_SHADING_T */
++	MMAL_PARAMETER_LENS_SHADING_OVERRIDE,
++		/**< Takes a @ref MMAL_PARAMETER_UINT32_T */
++	MMAL_PARAMETER_BLACK_LEVEL,
++		/**< Takes a @ref MMAL_PARAMETER_RESIZE_T */
++	MMAL_PARAMETER_RESIZE_PARAMS,
++		/**< Takes a @ref MMAL_PARAMETER_CROP_T */
++	MMAL_PARAMETER_CROP,
++		/**< Takes a @ref MMAL_PARAMETER_INT32_T */
++	MMAL_PARAMETER_OUTPUT_SHIFT,
++		/**< Takes a @ref MMAL_PARAMETER_INT32_T */
++	MMAL_PARAMETER_CCM_SHIFT,
++		/**< Takes a @ref MMAL_PARAMETER_CUSTOM_CCM_T */
++	MMAL_PARAMETER_CUSTOM_CCM,
++		/**< Takes a @ref MMAL_PARAMETER_RATIONAL_T */
++	MMAL_PARAMETER_ANALOG_GAIN,
++		/**< Takes a @ref MMAL_PARAMETER_RATIONAL_T */
++	MMAL_PARAMETER_DIGITAL_GAIN,
++		/**< Takes a @ref MMAL_PARAMETER_DENOISE_T */
++	MMAL_PARAMETER_DENOISE,
++		/**< Takes a @ref MMAL_PARAMETER_SHARPEN_T */
++	MMAL_PARAMETER_SHARPEN,
++		/**< Takes a @ref MMAL_PARAMETER_GEQ_T */
++	MMAL_PARAMETER_GEQ,
++		/**< Tales a @ref MMAP_PARAMETER_DPC_T */
++	MMAL_PARAMETER_DPC,
++		/**< Tales a @ref MMAP_PARAMETER_GAMMA_T */
++	MMAL_PARAMETER_GAMMA,
++		/**< Takes a @ref MMAL_PARAMETER_CDN_T */
++	MMAL_PARAMETER_CDN,
+ 		/**< Takes a @ref MMAL_PARAMETER_BOOLEAN_T */
+ 	MMAL_PARAMETER_JPEG_IJG_SCALING,
+ };
+@@ -791,7 +849,113 @@ struct mmal_parameter_camera_info {
+ 	struct mmal_parameter_camera_info_camera
+ 		cameras[MMAL_PARAMETER_CAMERA_INFO_MAX_CAMERAS];
+ 	struct mmal_parameter_camera_info_flash
+-				flashes[MMAL_PARAMETER_CAMERA_INFO_MAX_FLASHES];
++		flashes[MMAL_PARAMETER_CAMERA_INFO_MAX_FLASHES];
++};
++
++struct mmal_parameter_ccm {
++	struct s32_fract ccm[3][3];
++	s32 offsets[3];
++};
++
++struct mmal_parameter_custom_ccm {
++	u32 enabled; /**< Enable the custom CCM. */
++	struct mmal_parameter_ccm ccm; /**< CCM to be used. */
++};
++
++struct mmal_parameter_lens_shading {
++	u32 enabled;
++	u32 grid_cell_size;
++	u32 grid_width;
++	u32 grid_stride;
++	u32 grid_height;
++	u32 mem_handle_table;
++	u32 ref_transform;
++};
++
++enum mmal_parameter_ls_gain_format_type {
++	MMAL_PARAMETER_LS_GAIN_FORMAT_TYPE_U0P8_1 = 0,
++	MMAL_PARAMETER_LS_GAIN_FORMAT_TYPE_U1P7_0 = 1,
++	MMAL_PARAMETER_LS_GAIN_FORMAT_TYPE_U1P7_1 = 2,
++	MMAL_PARAMETER_LS_GAIN_FORMAT_TYPE_U2P6_0 = 3,
++	MMAL_PARAMETER_LS_GAIN_FORMAT_TYPE_U2P6_1 = 4,
++	MMAL_PARAMETER_LS_GAIN_FORMAT_TYPE_U3P5_0 = 5,
++	MMAL_PARAMETER_LS_GAIN_FORMAT_TYPE_U3P5_1 = 6,
++	MMAL_PARAMETER_LS_GAIN_FORMAT_TYPE_U4P10  = 7,
++	MMAL_PARAMETER_LS_GAIN_FORMAT_TYPE_DUMMY  = 0x7FFFFFFF
++};
++
++struct mmal_parameter_lens_shading_v2 {
++	u32 enabled;
++	u32 grid_cell_size;
++	u32 grid_width;
++	u32 grid_stride;
++	u32 grid_height;
++	u32 mem_handle_table;
++	u32 ref_transform;
++	u32 corner_sampled;
++	enum mmal_parameter_ls_gain_format_type gain_format;
++};
++
++struct mmal_parameter_black_level {
++	u32 enabled;
++	u16 black_level_r;
++	u16 black_level_g;
++	u16 black_level_b;
++	u8 pad_[2]; /* Unused */
++};
++
++struct mmal_parameter_geq {
++	u32 enabled;
++	u32 offset;
++	struct s32_fract slope;
++};
++
++#define MMAL_NUM_GAMMA_PTS 33
++struct mmal_parameter_gamma {
++	u32 enabled;
++	u16 x[MMAL_NUM_GAMMA_PTS];
++	u16 y[MMAL_NUM_GAMMA_PTS];
++};
++
++enum mmal_parameter_cdn_mode {
++	MMAL_PARAM_CDN_FAST = 0,
++	MMAL_PARAM_CDN_HIGH_QUALITY = 1,
++	MMAL_PARAM_CDN_DUMMY  = 0x7FFFFFFF
++};
++
++struct mmal_parameter_colour_denoise {
++	u32 enabled;
++	enum mmal_parameter_cdn_mode mode;
++};
++
++struct mmal_parameter_denoise {
++	u32 enabled;
++	u32 constant;
++	struct s32_fract slope;
++	struct s32_fract strength;
++};
++
++struct mmal_parameter_sharpen {
++	u32 enabled;
++	struct s32_fract threshold;
++	struct s32_fract strength;
++	struct s32_fract limit;
++};
++
++enum mmal_dpc_mode {
++	MMAL_DPC_MODE_OFF = 0,
++	MMAL_DPC_MODE_NORMAL = 1,
++	MMAL_DPC_MODE_STRONG = 2,
++	MMAL_DPC_MODE_MAX = 0x7FFFFFFF,
++};
++
++struct mmal_parameter_dpc {
++	u32 enabled;
++	u32 strength;
++};
++
++struct mmal_parameter_crop {
++	struct vchiq_mmal_rect rect;
+ };
+ 
+ #endif
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0207-gpio-Add-gpio-fsm-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0207-gpio-Add-gpio-fsm-driver.patch
new file mode 100644
index 00000000..c0ca506f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0207-gpio-Add-gpio-fsm-driver.patch
@@ -0,0 +1,1319 @@
+From bb27175147505327aff43132ecb3f7c2ac4045d1 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 30 Sep 2020 12:00:54 +0100
+Subject: [PATCH 207/697] gpio: Add gpio-fsm driver
+
+The gpio-fsm driver implements simple state machines that allow GPIOs
+to be controlled in response to inputs from other GPIOs - real and
+soft/virtual - and time delays. It can:
++ create dummy GPIOs for drivers that demand them,
++ drive multiple GPIOs from a single input, with optional delays,
++ add a debounce circuit to an input,
++ drive pattern sequences onto LEDs
+etc.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+gpio-fsm: Fix a build warning
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+gpio-fsm: Rename 'num-soft-gpios' to avoid warning
+
+As of 5.10, the Device Tree parser warns about properties that look
+like references to "suppliers" of various services. "num-soft-gpios"
+resembles a declaration of a GPIO called "num-soft", causing the value
+to be interpreted as a phandle, the owner of which is checked for a
+"#gpio-cells" property.
+
+To avoid this warning, rename the gpio-fsm property to "num-swgpios".
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+gpio-fsm: Show state info in /sys/class/gpio-fsm
+
+Add gpio-fsm sysfs entries under /sys/class/gpio-fsm. For each state
+machine show the current state, which state (if any) will be entered
+after a delay, and the current value of that delay.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+gpio-fsm: Fix shutdown timeout handling
+
+The driver is intended to jump directly to a shutdown state in the
+event of a timeout during shutdown, but the sense of the test was
+inverted.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+gpio-fsm: Clamp the delay time to zero
+
+The sysfs delay_ms value is calculated live, and it is possible for
+the time left to appear to be negative briefly if the timer handling
+hasn't completed. Ensure the displayed value never goes below zero,
+for the sake of appearances.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+gpio-fsm: Sort functions into a more logical order
+
+Move some functions into a more logical ordering. This change causes
+no functional change and is essentially cosmetic.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+gpio_fsm: Rework the atomic-vs-non-atomic split
+
+Partition the code to separate atomic and non-atomic methods so that
+none of them have to handle both cases. The result avoids using deferred
+work unless necessary, and should be easier to understand.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/gpio/Kconfig    |    9 +
+ drivers/gpio/Makefile   |    1 +
+ drivers/gpio/gpio-fsm.c | 1210 +++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 1220 insertions(+)
+ create mode 100644 drivers/gpio/gpio-fsm.c
+
+--- a/drivers/gpio/Kconfig
++++ b/drivers/gpio/Kconfig
+@@ -1375,6 +1375,15 @@ config GPIO_ELKHARTLAKE
+ 	  To compile this driver as a module, choose M here: the module will
+ 	  be called gpio-elkhartlake.
+ 
++config GPIO_FSM
++	tristate "GPIO FSM support"
++	help
++	  The GPIO FSM driver allows the creation of state machines for
++	  manipulating GPIOs (both real and virtual), with state transitions
++	  triggered by GPIO edges or delays.
++
++	  If unsure, say N.
++
+ config GPIO_JANZ_TTL
+ 	tristate "Janz VMOD-TTL Digital IO Module"
+ 	depends on MFD_JANZ_CMODIO
+--- a/drivers/gpio/Makefile
++++ b/drivers/gpio/Makefile
+@@ -65,6 +65,7 @@ obj-$(CONFIG_GPIO_EN7523)		+= gpio-en752
+ obj-$(CONFIG_GPIO_EP93XX)		+= gpio-ep93xx.o
+ obj-$(CONFIG_GPIO_EXAR)			+= gpio-exar.o
+ obj-$(CONFIG_GPIO_F7188X)		+= gpio-f7188x.o
++obj-$(CONFIG_GPIO_FSM)			+= gpio-fsm.o
+ obj-$(CONFIG_GPIO_FTGPIO010)		+= gpio-ftgpio010.o
+ obj-$(CONFIG_GPIO_FXL6408)		+= gpio-fxl6408.o
+ obj-$(CONFIG_GPIO_GE_FPGA)		+= gpio-ge.o
+--- /dev/null
++++ b/drivers/gpio/gpio-fsm.c
+@@ -0,0 +1,1210 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ *  GPIO FSM driver
++ *
++ *  This driver implements simple state machines that allow real GPIOs to be
++ *  controlled in response to inputs from other GPIOs - real and soft/virtual -
++ *  and time delays. It can:
++ *  + create dummy GPIOs for drivers that demand them
++ *  + drive multiple GPIOs from a single input,  with optional delays
++ *  + add a debounce circuit to an input
++ *  + drive pattern sequences onto LEDs
++ *  etc.
++ *
++ *  Copyright (C) 2020 Raspberry Pi (Trading) Ltd.
++ */
++
++#include <linux/err.h>
++#include <linux/gpio.h>
++#include <linux/gpio/driver.h>
++#include <linux/interrupt.h>
++#include <linux/kdev_t.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/sysfs.h>
++
++#include <dt-bindings/gpio/gpio-fsm.h>
++
++#define MODULE_NAME "gpio-fsm"
++
++#define GF_IO_TYPE(x) ((u32)(x) & 0xffff)
++#define GF_IO_INDEX(x) ((u32)(x) >> 16)
++
++enum {
++	SIGNAL_GPIO,
++	SIGNAL_SOFT
++};
++
++enum {
++	INPUT_GPIO,
++	INPUT_SOFT
++};
++
++enum {
++	SYM_UNDEFINED,
++	SYM_NAME,
++	SYM_SET,
++	SYM_START,
++	SYM_SHUTDOWN,
++
++	SYM_MAX
++};
++
++struct soft_gpio {
++	int dir;
++	int value;
++};
++
++struct input_gpio_state {
++	struct gpio_fsm *gf;
++	struct gpio_desc  *desc;
++	struct fsm_state *target;
++	int index;
++	int value;
++	int irq;
++	bool enabled;
++	bool active_low;
++};
++
++struct gpio_event {
++	int index;
++	int value;
++	struct fsm_state *target;
++};
++
++struct symtab_entry {
++	const char *name;
++	void *value;
++	struct symtab_entry *next;
++};
++
++struct output_signal {
++	u8 type;
++	u8 value;
++	u16 index;
++};
++
++struct fsm_state {
++	const char *name;
++	struct output_signal *signals;
++	struct gpio_event *gpio_events;
++	struct gpio_event *soft_events;
++	struct fsm_state *delay_target;
++	struct fsm_state *shutdown_target;
++	unsigned int num_signals;
++	unsigned int num_gpio_events;
++	unsigned int num_soft_events;
++	unsigned int delay_ms;
++	unsigned int shutdown_ms;
++};
++
++struct gpio_fsm {
++	struct gpio_chip gc;
++	struct device *dev;
++	spinlock_t spinlock;
++	struct work_struct work;
++	struct timer_list timer;
++	wait_queue_head_t shutdown_event;
++	struct fsm_state *states;
++	struct input_gpio_state *input_gpio_states;
++	struct gpio_descs *input_gpios;
++	struct gpio_descs *output_gpios;
++	struct soft_gpio *soft_gpios;
++	struct fsm_state *start_state;
++	struct fsm_state *shutdown_state;
++	unsigned int num_states;
++	unsigned int num_output_gpios;
++	unsigned int num_input_gpios;
++	unsigned int num_soft_gpios;
++	unsigned int shutdown_timeout_ms;
++	unsigned int shutdown_jiffies;
++
++	struct fsm_state *current_state;
++	struct fsm_state *next_state;
++	struct fsm_state *delay_target_state;
++	unsigned long delay_jiffies;
++	int delay_ms;
++	unsigned int debug;
++	bool shutting_down;
++	struct symtab_entry *symtab;
++};
++
++static struct symtab_entry *do_add_symbol(struct symtab_entry **symtab,
++					  const char *name, void *value)
++{
++	struct symtab_entry **p = symtab;
++
++	while (*p && strcmp((*p)->name, name))
++		p = &(*p)->next;
++
++	if (*p) {
++		/* This is an existing symbol */
++		if ((*p)->value) {
++			/* Already defined */
++			if (value) {
++				if ((uintptr_t)value < SYM_MAX)
++					return ERR_PTR(-EINVAL);
++				else
++					return ERR_PTR(-EEXIST);
++			}
++		} else {
++			/* Undefined */
++			(*p)->value = value;
++		}
++	} else {
++		/* This is a new symbol */
++		*p = kmalloc(sizeof(struct symtab_entry), GFP_KERNEL);
++		if (*p) {
++			(*p)->name = name;
++			(*p)->value = value;
++			(*p)->next = NULL;
++		}
++	}
++	return *p;
++}
++
++static int add_symbol(struct symtab_entry **symtab,
++		      const char *name, void *value)
++{
++	struct symtab_entry *sym = do_add_symbol(symtab, name, value);
++
++	return PTR_ERR_OR_ZERO(sym);
++}
++
++static struct symtab_entry *get_symbol(struct symtab_entry **symtab,
++				       const char *name)
++{
++	struct symtab_entry *sym = do_add_symbol(symtab, name, NULL);
++
++	if (IS_ERR(sym))
++		return NULL;
++	return sym;
++}
++
++static void free_symbols(struct symtab_entry **symtab)
++{
++	struct symtab_entry *sym = *symtab;
++	void *p;
++
++	*symtab = NULL;
++	while (sym) {
++		p = sym;
++		sym = sym->next;
++		kfree(p);
++	}
++}
++
++static void gpio_fsm_set_soft(struct gpio_fsm *gf,
++			      unsigned int off, int val);
++
++static void gpio_fsm_enter_state(struct gpio_fsm *gf,
++				 struct fsm_state *state)
++{
++	struct input_gpio_state *inp_state;
++	struct output_signal *signal;
++	struct gpio_event *event;
++	struct gpio_desc *gpiod;
++	struct soft_gpio *soft;
++	int value;
++	int i;
++
++	dev_dbg(gf->dev, "enter_state(%s)\n", state->name);
++
++	gf->current_state = state;
++	gf->delay_target_state = NULL;
++
++	// 1. Apply any listed signals
++	for (i = 0; i < state->num_signals; i++) {
++		signal = &state->signals[i];
++
++		if (gf->debug)
++			dev_info(gf->dev, "  set %s %d->%d\n",
++				 (signal->type == SIGNAL_GPIO) ? "GF_OUT" :
++				 "GF_SOFT",
++				 signal->index, signal->value);
++		switch (signal->type) {
++		case SIGNAL_GPIO:
++			gpiod = gf->output_gpios->desc[signal->index];
++			gpiod_set_value_cansleep(gpiod, signal->value);
++			break;
++		case SIGNAL_SOFT:
++			soft = &gf->soft_gpios[signal->index];
++			gpio_fsm_set_soft(gf, signal->index, signal->value);
++			break;
++		}
++	}
++
++	// 2. Exit if successfully reached shutdown state
++	if (gf->shutting_down && state == state->shutdown_target) {
++		wake_up(&gf->shutdown_event);
++		return;
++	}
++
++	// 3. Schedule a timer callback if shutting down
++	if (state->shutdown_target) {
++		// Remember the absolute shutdown time in case remove is called
++		// at a later time.
++		gf->shutdown_jiffies =
++			jiffies + msecs_to_jiffies(state->shutdown_ms);
++
++		if (gf->shutting_down) {
++			gf->delay_jiffies = gf->shutdown_jiffies;
++			gf->delay_target_state = state->shutdown_target;
++			gf->delay_ms = state->shutdown_ms;
++			mod_timer(&gf->timer, gf->delay_jiffies);
++		}
++	}
++
++	// During shutdown, skip everything else
++	if (gf->shutting_down)
++		return;
++
++	// Otherwise record what the shutdown time would be
++	gf->shutdown_jiffies = jiffies + msecs_to_jiffies(state->shutdown_ms);
++
++	// 4. Check soft inputs for transitions to take
++	for (i = 0; i < state->num_soft_events; i++) {
++		event = &state->soft_events[i];
++		if (gf->soft_gpios[event->index].value == event->value) {
++			if (gf->debug)
++				dev_info(gf->dev,
++					 "GF_SOFT %d=%d -> %s\n", event->index,
++					 event->value, event->target->name);
++			gpio_fsm_enter_state(gf, event->target);
++			return;
++		}
++	}
++
++	// 5. Check GPIOs for transitions to take, enabling the IRQs
++	for (i = 0; i < state->num_gpio_events; i++) {
++		event = &state->gpio_events[i];
++		inp_state = &gf->input_gpio_states[event->index];
++		inp_state->target = event->target;
++		inp_state->value = event->value;
++		inp_state->enabled = true;
++
++		value = gpiod_get_value_cansleep(gf->input_gpios->desc[event->index]);
++
++		// Clear stale event state
++		disable_irq(inp_state->irq);
++
++		irq_set_irq_type(inp_state->irq,
++				 (inp_state->value ^ inp_state->active_low) ?
++				 IRQF_TRIGGER_RISING : IRQF_TRIGGER_FALLING);
++		enable_irq(inp_state->irq);
++
++		if (value == event->value && inp_state->target) {
++			if (gf->debug)
++				dev_info(gf->dev,
++					 "GF_IN %d=%d -> %s\n", event->index,
++					 event->value, event->target->name);
++			gpio_fsm_enter_state(gf, event->target);
++			return;
++		}
++	}
++
++	// 6. Schedule a timer callback if delay_target
++	if (state->delay_target) {
++		gf->delay_target_state = state->delay_target;
++		gf->delay_jiffies = jiffies +
++			msecs_to_jiffies(state->delay_ms);
++		gf->delay_ms = state->delay_ms;
++		mod_timer(&gf->timer, gf->delay_jiffies);
++	}
++}
++
++static void gpio_fsm_go_to_state(struct gpio_fsm *gf,
++				 struct fsm_state *new_state)
++{
++	struct input_gpio_state *inp_state;
++	struct gpio_event *gp_ev;
++	struct fsm_state *state;
++	int i;
++
++	dev_dbg(gf->dev, "go_to_state(%s)\n",
++		  new_state ? new_state->name : "<unset>");
++
++	state = gf->current_state;
++
++	/* Disable any enabled GPIO IRQs */
++	for (i = 0; i < state->num_gpio_events; i++) {
++		gp_ev = &state->gpio_events[i];
++		inp_state = &gf->input_gpio_states[gp_ev->index];
++		if (inp_state->enabled) {
++			inp_state->enabled = false;
++			irq_set_irq_type(inp_state->irq,
++					 IRQF_TRIGGER_NONE);
++		}
++	}
++
++	gpio_fsm_enter_state(gf, new_state);
++}
++
++static void gpio_fsm_go_to_state_deferred(struct gpio_fsm *gf,
++					  struct fsm_state *new_state)
++{
++	struct input_gpio_state *inp_state;
++	struct gpio_event *gp_ev;
++	struct fsm_state *state;
++	int i;
++
++	dev_dbg(gf->dev, "go_to_state_deferred(%s)\n",
++		  new_state ? new_state->name : "<unset>");
++
++	spin_lock(&gf->spinlock);
++
++	if (gf->next_state) {
++		/* Something else has already requested a transition */
++		spin_unlock(&gf->spinlock);
++		return;
++	}
++
++	gf->next_state = new_state;
++	state = gf->current_state;
++
++	/* Disarm any GPIO IRQs */
++	for (i = 0; i < state->num_gpio_events; i++) {
++		gp_ev = &state->gpio_events[i];
++		inp_state = &gf->input_gpio_states[gp_ev->index];
++		inp_state->target = NULL;
++	}
++
++	spin_unlock(&gf->spinlock);
++
++	schedule_work(&gf->work);
++}
++
++static void gpio_fsm_work(struct work_struct *work)
++{
++	struct fsm_state *new_state;
++	struct gpio_fsm *gf;
++
++	gf = container_of(work, struct gpio_fsm, work);
++	spin_lock(&gf->spinlock);
++	new_state = gf->next_state;
++	gf->next_state = NULL;
++	spin_unlock(&gf->spinlock);
++
++	gpio_fsm_go_to_state(gf, new_state);
++}
++
++static irqreturn_t gpio_fsm_gpio_irq_handler(int irq, void *dev_id)
++{
++	struct input_gpio_state *inp_state = dev_id;
++	struct gpio_fsm *gf = inp_state->gf;
++	struct fsm_state *target;
++
++	target = inp_state->target;
++	if (!target)
++		return IRQ_NONE;
++
++	/* If the IRQ has fired then the desired state _must_ have occurred */
++	inp_state->enabled = false;
++	irq_set_irq_type(inp_state->irq, IRQF_TRIGGER_NONE);
++	if (gf->debug)
++		dev_info(gf->dev, "GF_IN %d->%d -> %s\n",
++			 inp_state->index, inp_state->value, target->name);
++	gpio_fsm_go_to_state_deferred(gf, target);
++	return IRQ_HANDLED;
++}
++
++static void gpio_fsm_timer(struct timer_list *timer)
++{
++	struct gpio_fsm *gf = container_of(timer, struct gpio_fsm, timer);
++	struct fsm_state *target;
++
++	target = gf->delay_target_state;
++	if (!target)
++		return;
++	if (gf->debug)
++		dev_info(gf->dev, "GF_DELAY %d -> %s\n", gf->delay_ms,
++			 target->name);
++
++	gpio_fsm_go_to_state_deferred(gf, target);
++}
++
++static int gpio_fsm_parse_signals(struct gpio_fsm *gf, struct fsm_state *state,
++				  struct property *prop)
++{
++	const __be32 *cells = prop->value;
++	struct output_signal *signal;
++	u32 io;
++	u32 type;
++	u32 index;
++	u32 value;
++	int ret = 0;
++	int i;
++
++	if (prop->length % 8) {
++		dev_err(gf->dev, "malformed set in state %s\n",
++			state->name);
++		return -EINVAL;
++	}
++
++	state->num_signals = prop->length/8;
++	state->signals = devm_kcalloc(gf->dev, state->num_signals,
++				      sizeof(struct output_signal),
++				      GFP_KERNEL);
++	for (i = 0; i < state->num_signals; i++) {
++		signal = &state->signals[i];
++		io = be32_to_cpu(cells[0]);
++		type = GF_IO_TYPE(io);
++		index = GF_IO_INDEX(io);
++		value = be32_to_cpu(cells[1]);
++
++		if (type != GF_OUT && type != GF_SOFT) {
++			dev_err(gf->dev,
++				"invalid set type %d in state %s\n",
++				type, state->name);
++			ret = -EINVAL;
++			break;
++		}
++		if (type == GF_OUT && index >= gf->num_output_gpios) {
++			dev_err(gf->dev,
++				"invalid GF_OUT number %d in state %s\n",
++				index, state->name);
++			ret = -EINVAL;
++			break;
++		}
++		if (type == GF_SOFT && index >= gf->num_soft_gpios) {
++			dev_err(gf->dev,
++				"invalid GF_SOFT number %d in state %s\n",
++				index, state->name);
++			ret = -EINVAL;
++			break;
++		}
++		if (value != 0 && value != 1) {
++			dev_err(gf->dev,
++				"invalid set value %d in state %s\n",
++				value, state->name);
++			ret = -EINVAL;
++			break;
++		}
++		signal->type = (type == GF_OUT) ? SIGNAL_GPIO : SIGNAL_SOFT;
++		signal->index = index;
++		signal->value = value;
++		cells += 2;
++	}
++
++	return ret;
++}
++
++static struct gpio_event *new_event(struct gpio_event **events, int *num_events)
++{
++	int num = ++(*num_events);
++	*events = krealloc(*events, num * sizeof(struct gpio_event),
++			   GFP_KERNEL);
++	return *events ? *events + (num - 1) : NULL;
++}
++
++static int gpio_fsm_parse_events(struct gpio_fsm *gf, struct fsm_state *state,
++			    struct property *prop)
++{
++	const __be32 *cells = prop->value;
++	struct symtab_entry *sym;
++	int num_cells;
++	int ret = 0;
++	int i;
++
++	if (prop->length % 8) {
++		dev_err(gf->dev,
++			"malformed transitions from state %s to state %s\n",
++			state->name, prop->name);
++		return -EINVAL;
++	}
++
++	sym = get_symbol(&gf->symtab, prop->name);
++	num_cells = prop->length / 4;
++	i = 0;
++	while (i < num_cells) {
++		struct gpio_event *gp_ev;
++		u32 event, param;
++		u32 index;
++
++		event = be32_to_cpu(cells[i++]);
++		param = be32_to_cpu(cells[i++]);
++		index = GF_IO_INDEX(event);
++
++		switch (GF_IO_TYPE(event)) {
++		case GF_IN:
++			if (index >= gf->num_input_gpios) {
++				dev_err(gf->dev,
++					"invalid GF_IN %d in transitions from state %s to state %s\n",
++					index, state->name, prop->name);
++				return -EINVAL;
++			}
++			if (param > 1) {
++				dev_err(gf->dev,
++					"invalid GF_IN value %d in transitions from state %s to state %s\n",
++					param, state->name, prop->name);
++				return -EINVAL;
++			}
++			gp_ev = new_event(&state->gpio_events,
++					  &state->num_gpio_events);
++			if (!gp_ev)
++				return -ENOMEM;
++			gp_ev->index = index;
++			gp_ev->value = param;
++			gp_ev->target = (struct fsm_state *)sym;
++			break;
++
++		case GF_SOFT:
++			if (index >= gf->num_soft_gpios) {
++				dev_err(gf->dev,
++					"invalid GF_SOFT %d in transitions from state %s to state %s\n",
++					index, state->name, prop->name);
++				return -EINVAL;
++			}
++			if (param > 1) {
++				dev_err(gf->dev,
++					"invalid GF_SOFT value %d in transitions from state %s to state %s\n",
++					param, state->name, prop->name);
++				return -EINVAL;
++			}
++			gp_ev = new_event(&state->soft_events,
++					  &state->num_soft_events);
++			if (!gp_ev)
++				return -ENOMEM;
++			gp_ev->index = index;
++			gp_ev->value = param;
++			gp_ev->target = (struct fsm_state *)sym;
++			break;
++
++		case GF_DELAY:
++			if (state->delay_target) {
++				dev_err(gf->dev,
++					"state %s has multiple GF_DELAYs\n",
++					state->name);
++				return -EINVAL;
++			}
++			state->delay_target = (struct fsm_state *)sym;
++			state->delay_ms = param;
++			break;
++
++		case GF_SHUTDOWN:
++			if (state->shutdown_target == state) {
++				dev_err(gf->dev,
++					"shutdown state %s has GF_SHUTDOWN\n",
++					state->name);
++				return -EINVAL;
++			} else if (state->shutdown_target) {
++				dev_err(gf->dev,
++					"state %s has multiple GF_SHUTDOWNs\n",
++					state->name);
++				return -EINVAL;
++			}
++			state->shutdown_target =
++				(struct fsm_state *)sym;
++			state->shutdown_ms = param;
++			break;
++
++		default:
++			dev_err(gf->dev,
++				"invalid event %08x in transitions from state %s to state %s\n",
++				event, state->name, prop->name);
++			return -EINVAL;
++		}
++	}
++	if (i != num_cells) {
++		dev_err(gf->dev,
++			"malformed transitions from state %s to state %s\n",
++			state->name, prop->name);
++		return -EINVAL;
++	}
++
++	return ret;
++}
++
++static int gpio_fsm_parse_state(struct gpio_fsm *gf,
++			   struct fsm_state *state,
++			   struct device_node *np)
++{
++	struct symtab_entry *sym;
++	struct property *prop;
++	int ret;
++
++	state->name = np->name;
++	ret = add_symbol(&gf->symtab, np->name, state);
++	if (ret) {
++		switch (ret) {
++		case -EINVAL:
++			dev_err(gf->dev, "'%s' is not a valid state name\n",
++				np->name);
++			break;
++		case -EEXIST:
++			dev_err(gf->dev, "state %s already defined\n",
++				np->name);
++			break;
++		default:
++			dev_err(gf->dev, "error %d adding state %s symbol\n",
++				ret, np->name);
++			break;
++		}
++		return ret;
++	}
++
++	for_each_property_of_node(np, prop) {
++		sym = get_symbol(&gf->symtab, prop->name);
++		if (!sym) {
++			ret = -ENOMEM;
++			break;
++		}
++
++		switch ((uintptr_t)sym->value) {
++		case SYM_SET:
++			ret = gpio_fsm_parse_signals(gf, state, prop);
++			break;
++		case SYM_START:
++			if (gf->start_state) {
++				dev_err(gf->dev, "multiple start states\n");
++				ret = -EINVAL;
++			} else {
++				gf->start_state = state;
++			}
++			break;
++		case SYM_SHUTDOWN:
++			state->shutdown_target = state;
++			gf->shutdown_state = state;
++			break;
++		case SYM_NAME:
++			/* Ignore */
++			break;
++		default:
++			/* A set of transition events to this state */
++			ret = gpio_fsm_parse_events(gf, state, prop);
++			break;
++		}
++	}
++
++	return ret;
++}
++
++static void dump_all(struct gpio_fsm *gf)
++{
++	int i, j;
++
++	dev_info(gf->dev, "Input GPIOs:\n");
++	for (i = 0; i < gf->num_input_gpios; i++)
++		dev_info(gf->dev, "  %d: %p\n", i,
++			 gf->input_gpios->desc[i]);
++
++	dev_info(gf->dev, "Output GPIOs:\n");
++	for (i = 0; i < gf->num_output_gpios; i++)
++		dev_info(gf->dev, "  %d: %p\n", i,
++			 gf->output_gpios->desc[i]);
++
++	dev_info(gf->dev, "Soft GPIOs:\n");
++	for (i = 0; i < gf->num_soft_gpios; i++)
++		dev_info(gf->dev, "  %d: %s %d\n", i,
++			 (gf->soft_gpios[i].dir == GPIOF_IN) ? "IN" : "OUT",
++			 gf->soft_gpios[i].value);
++
++	dev_info(gf->dev, "Start state: %s\n",
++		 gf->start_state ? gf->start_state->name : "-");
++
++	dev_info(gf->dev, "Shutdown timeout: %d ms\n",
++		 gf->shutdown_timeout_ms);
++
++	for (i = 0; i < gf->num_states; i++) {
++		struct fsm_state *state = &gf->states[i];
++
++		dev_info(gf->dev, "State %s:\n", state->name);
++
++		if (state->shutdown_target == state)
++			dev_info(gf->dev, "  Shutdown state\n");
++
++		dev_info(gf->dev, "  Signals:\n");
++		for (j = 0; j < state->num_signals; j++) {
++			struct output_signal *signal = &state->signals[j];
++
++			dev_info(gf->dev, "    %d: %s %d=%d\n", j,
++				 (signal->type == SIGNAL_GPIO) ? "GPIO" :
++								 "SOFT",
++				 signal->index, signal->value);
++		}
++
++		dev_info(gf->dev, "  GPIO events:\n");
++		for (j = 0; j < state->num_gpio_events; j++) {
++			struct gpio_event *event = &state->gpio_events[j];
++
++			dev_info(gf->dev, "    %d: %d=%d -> %s\n", j,
++				 event->index, event->value,
++				 event->target->name);
++		}
++
++		dev_info(gf->dev, "  Soft events:\n");
++		for (j = 0; j < state->num_soft_events; j++) {
++			struct gpio_event *event = &state->soft_events[j];
++
++			dev_info(gf->dev, "    %d: %d=%d -> %s\n", j,
++				 event->index, event->value,
++				 event->target->name);
++		}
++
++		if (state->delay_target)
++			dev_info(gf->dev, "  Delay: %d ms -> %s\n",
++				 state->delay_ms, state->delay_target->name);
++
++		if (state->shutdown_target && state->shutdown_target != state)
++			dev_info(gf->dev, "  Shutdown: %d ms -> %s\n",
++				 state->shutdown_ms,
++				 state->shutdown_target->name);
++	}
++	dev_info(gf->dev, "\n");
++}
++
++static int resolve_sym_to_state(struct gpio_fsm *gf, struct fsm_state **pstate)
++{
++	struct symtab_entry *sym = (struct symtab_entry *)*pstate;
++
++	if (!sym)
++		return -ENOMEM;
++
++	*pstate = sym->value;
++
++	if (!*pstate) {
++		dev_err(gf->dev, "state %s not defined\n",
++			sym->name);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++static void gpio_fsm_set_soft(struct gpio_fsm *gf,
++			      unsigned int off, int val)
++{
++	struct soft_gpio *sg = &gf->soft_gpios[off];
++	struct gpio_event *gp_ev;
++	struct fsm_state *state;
++	int i;
++
++	dev_dbg(gf->dev, "set(%d,%d)\n", off, val);
++	state = gf->current_state;
++	sg->value = val;
++	for (i = 0; i < state->num_soft_events; i++) {
++		gp_ev = &state->soft_events[i];
++		if (gp_ev->index == off && gp_ev->value == val) {
++			if (gf->debug)
++				dev_info(gf->dev,
++					 "GF_SOFT %d->%d -> %s\n", gp_ev->index,
++					 gp_ev->value, gp_ev->target->name);
++			gpio_fsm_go_to_state(gf, gp_ev->target);
++			break;
++		}
++	}
++}
++
++static int gpio_fsm_get(struct gpio_chip *gc, unsigned int off)
++{
++	struct gpio_fsm *gf = gpiochip_get_data(gc);
++	struct soft_gpio *sg;
++
++	if (off >= gf->num_soft_gpios)
++		return -EINVAL;
++	sg = &gf->soft_gpios[off];
++
++	return sg->value;
++}
++
++static void gpio_fsm_set(struct gpio_chip *gc, unsigned int off, int val)
++{
++	struct gpio_fsm *gf;
++
++	gf = gpiochip_get_data(gc);
++	if (off < gf->num_soft_gpios)
++		gpio_fsm_set_soft(gf, off, val);
++}
++
++static int gpio_fsm_get_direction(struct gpio_chip *gc, unsigned int off)
++{
++	struct gpio_fsm *gf = gpiochip_get_data(gc);
++	struct soft_gpio *sg;
++
++	if (off >= gf->num_soft_gpios)
++		return -EINVAL;
++	sg = &gf->soft_gpios[off];
++
++	return sg->dir;
++}
++
++static int gpio_fsm_direction_input(struct gpio_chip *gc, unsigned int off)
++{
++	struct gpio_fsm *gf = gpiochip_get_data(gc);
++	struct soft_gpio *sg;
++
++	if (off >= gf->num_soft_gpios)
++		return -EINVAL;
++	sg = &gf->soft_gpios[off];
++	sg->dir = GPIOF_IN;
++
++	return 0;
++}
++
++static int gpio_fsm_direction_output(struct gpio_chip *gc, unsigned int off,
++				       int value)
++{
++	struct gpio_fsm *gf = gpiochip_get_data(gc);
++	struct soft_gpio *sg;
++
++	if (off >= gf->num_soft_gpios)
++		return -EINVAL;
++	sg = &gf->soft_gpios[off];
++	sg->dir = GPIOF_OUT_INIT_LOW;
++	gpio_fsm_set_soft(gf, off, value);
++
++	return 0;
++}
++
++/*
++ * /sys/class/gpio-fsm/<fsm-name>/
++ *   /state ... the current state
++ */
++
++static ssize_t state_show(struct device *dev,
++			  struct device_attribute *attr, char *buf)
++{
++	const struct gpio_fsm *gf = dev_get_drvdata(dev);
++
++	return sprintf(buf, "%s\n", gf->current_state->name);
++}
++static DEVICE_ATTR_RO(state);
++
++static ssize_t delay_state_show(struct device *dev,
++			  struct device_attribute *attr, char *buf)
++{
++	const struct gpio_fsm *gf = dev_get_drvdata(dev);
++
++	return sprintf(buf, "%s\n",
++		       gf->delay_target_state ? gf->delay_target_state->name :
++		       "-");
++}
++
++static DEVICE_ATTR_RO(delay_state);
++
++static ssize_t delay_ms_show(struct device *dev,
++			     struct device_attribute *attr, char *buf)
++{
++	const struct gpio_fsm *gf = dev_get_drvdata(dev);
++	int jiffies_left;
++
++	jiffies_left = max((int)(gf->delay_jiffies - jiffies), 0);
++	return sprintf(buf,
++		       gf->delay_target_state ? "%u\n" : "-\n",
++		       jiffies_to_msecs(jiffies_left));
++}
++static DEVICE_ATTR_RO(delay_ms);
++
++static struct attribute *gpio_fsm_attrs[] = {
++	&dev_attr_state.attr,
++	&dev_attr_delay_state.attr,
++	&dev_attr_delay_ms.attr,
++	NULL,
++};
++
++static const struct attribute_group gpio_fsm_group = {
++	.attrs = gpio_fsm_attrs,
++	//.is_visible = gpio_is_visible,
++};
++
++static const struct attribute_group *gpio_fsm_groups[] = {
++	&gpio_fsm_group,
++	NULL
++};
++
++static struct attribute *gpio_fsm_class_attrs[] = {
++	// There are no top-level attributes
++	NULL,
++};
++ATTRIBUTE_GROUPS(gpio_fsm_class);
++
++static struct class gpio_fsm_class = {
++	.name =		MODULE_NAME,
++
++	.class_groups = gpio_fsm_class_groups,
++};
++
++static int gpio_fsm_probe(struct platform_device *pdev)
++{
++	struct input_gpio_state *inp_state;
++	struct device *dev = &pdev->dev;
++	struct device *sysfs_dev;
++	struct device_node *np = dev_of_node(dev);
++	struct device_node *cp;
++	struct gpio_fsm *gf;
++	u32 debug = 0;
++	int num_states;
++	u32 num_soft_gpios;
++	int ret;
++	int i;
++	static const char *const reserved_symbols[] = {
++		[SYM_NAME] = "name",
++		[SYM_SET] = "set",
++		[SYM_START] = "start_state",
++		[SYM_SHUTDOWN] = "shutdown_state",
++	};
++
++	if (of_property_read_u32(np, "num-swgpios", &num_soft_gpios) &&
++	    of_property_read_u32(np, "num-soft-gpios", &num_soft_gpios)) {
++		dev_err(dev, "missing 'num-swgpios' property\n");
++		return -EINVAL;
++	}
++
++	of_property_read_u32(np, "debug", &debug);
++
++	gf = devm_kzalloc(dev, sizeof(*gf), GFP_KERNEL);
++	if (!gf)
++		return -ENOMEM;
++
++	gf->dev = dev;
++	gf->debug = debug;
++
++	if (of_property_read_u32(np, "shutdown-timeout-ms",
++				 &gf->shutdown_timeout_ms))
++		gf->shutdown_timeout_ms = 5000;
++
++	gf->num_soft_gpios = num_soft_gpios;
++	gf->soft_gpios = devm_kcalloc(dev, num_soft_gpios,
++				      sizeof(struct soft_gpio), GFP_KERNEL);
++	if (!gf->soft_gpios)
++		return -ENOMEM;
++	for (i = 0; i < num_soft_gpios; i++) {
++		struct soft_gpio *sg = &gf->soft_gpios[i];
++
++		sg->dir = GPIOF_IN;
++		sg->value = 0;
++	}
++
++	gf->input_gpios = devm_gpiod_get_array_optional(dev, "input", GPIOD_IN);
++	if (IS_ERR(gf->input_gpios)) {
++		ret = PTR_ERR(gf->input_gpios);
++		dev_err(dev, "failed to get input gpios from DT - %d\n", ret);
++		return ret;
++	}
++	gf->num_input_gpios = (gf->input_gpios ? gf->input_gpios->ndescs : 0);
++
++	gf->input_gpio_states = devm_kcalloc(dev, gf->num_input_gpios,
++					     sizeof(struct input_gpio_state),
++					     GFP_KERNEL);
++	if (!gf->input_gpio_states)
++		return -ENOMEM;
++	for (i = 0; i < gf->num_input_gpios; i++) {
++		inp_state = &gf->input_gpio_states[i];
++		inp_state->desc = gf->input_gpios->desc[i];
++		inp_state->gf = gf;
++		inp_state->index = i;
++		inp_state->irq = gpiod_to_irq(inp_state->desc);
++		inp_state->active_low = gpiod_is_active_low(inp_state->desc);
++		if (inp_state->irq >= 0)
++			ret = devm_request_irq(gf->dev, inp_state->irq,
++					       gpio_fsm_gpio_irq_handler,
++					       IRQF_TRIGGER_NONE,
++					       dev_name(dev),
++					       inp_state);
++		else
++			ret = inp_state->irq;
++
++		if (ret) {
++			dev_err(dev,
++				"failed to get IRQ for input gpio - %d\n",
++				ret);
++			return ret;
++		}
++	}
++
++	gf->output_gpios = devm_gpiod_get_array_optional(dev, "output",
++							 GPIOD_OUT_LOW);
++	if (IS_ERR(gf->output_gpios)) {
++		ret = PTR_ERR(gf->output_gpios);
++		dev_err(dev, "failed to get output gpios from DT - %d\n", ret);
++		return ret;
++	}
++	gf->num_output_gpios = (gf->output_gpios ? gf->output_gpios->ndescs :
++				0);
++
++	num_states = of_get_child_count(np);
++	if (!num_states) {
++		dev_err(dev, "no states declared\n");
++		return -EINVAL;
++	}
++	gf->states = devm_kcalloc(dev, num_states,
++				  sizeof(struct fsm_state), GFP_KERNEL);
++	if (!gf->states)
++		return -ENOMEM;
++
++	// add reserved words to the symbol table
++	for (i = 0; i < ARRAY_SIZE(reserved_symbols); i++) {
++		if (reserved_symbols[i])
++			add_symbol(&gf->symtab, reserved_symbols[i],
++				   (void *)(uintptr_t)i);
++	}
++
++	// parse the state
++	for_each_child_of_node(np, cp) {
++		struct fsm_state *state = &gf->states[gf->num_states];
++
++		ret = gpio_fsm_parse_state(gf, state, cp);
++		if (ret)
++			return ret;
++		gf->num_states++;
++	}
++
++	if (!gf->start_state) {
++		dev_err(gf->dev, "no start state defined\n");
++		return -EINVAL;
++	}
++
++	// resolve symbol pointers into state pointers
++	for (i = 0; !ret && i < gf->num_states; i++) {
++		struct fsm_state *state = &gf->states[i];
++		int j;
++
++		for (j = 0; !ret && j < state->num_gpio_events; j++) {
++			struct gpio_event *ev = &state->gpio_events[j];
++
++			ret = resolve_sym_to_state(gf, &ev->target);
++		}
++
++		for (j = 0; !ret && j < state->num_soft_events; j++) {
++			struct gpio_event *ev = &state->soft_events[j];
++
++			ret = resolve_sym_to_state(gf, &ev->target);
++		}
++
++		if (!ret) {
++			resolve_sym_to_state(gf, &state->delay_target);
++			if (state->shutdown_target != state)
++				resolve_sym_to_state(gf,
++						     &state->shutdown_target);
++		}
++	}
++
++	if (!ret && gf->debug > 1)
++		dump_all(gf);
++
++	free_symbols(&gf->symtab);
++
++	if (ret)
++		return ret;
++
++	gf->gc.parent = dev;
++	gf->gc.label = np->name;
++	gf->gc.owner = THIS_MODULE;
++	gf->gc.base = -1;
++	gf->gc.ngpio = num_soft_gpios;
++
++	gf->gc.get_direction = gpio_fsm_get_direction;
++	gf->gc.direction_input = gpio_fsm_direction_input;
++	gf->gc.direction_output = gpio_fsm_direction_output;
++	gf->gc.get = gpio_fsm_get;
++	gf->gc.set = gpio_fsm_set;
++	gf->gc.can_sleep = true;
++	spin_lock_init(&gf->spinlock);
++	INIT_WORK(&gf->work, gpio_fsm_work);
++	timer_setup(&gf->timer, gpio_fsm_timer, 0);
++	init_waitqueue_head(&gf->shutdown_event);
++
++	platform_set_drvdata(pdev, gf);
++
++	sysfs_dev = device_create_with_groups(&gpio_fsm_class, dev,
++					      MKDEV(0, 0), gf,
++					      gpio_fsm_groups,
++					      "%s", np->name);
++	if (IS_ERR(sysfs_dev))
++		dev_err(gf->dev, "Error creating sysfs entry\n");
++
++	if (gf->debug)
++		dev_info(gf->dev, "Start -> %s\n", gf->start_state->name);
++
++	gpio_fsm_enter_state(gf, gf->start_state);
++
++	return devm_gpiochip_add_data(dev, &gf->gc, gf);
++}
++
++static void gpio_fsm_remove(struct platform_device *pdev)
++{
++	struct gpio_fsm *gf = platform_get_drvdata(pdev);
++	int i;
++
++	if (gf->shutdown_state) {
++		if (gf->debug)
++			dev_info(gf->dev, "Shutting down...\n");
++
++		spin_lock(&gf->spinlock);
++		gf->shutting_down = true;
++		if (gf->current_state->shutdown_target &&
++		    gf->current_state->shutdown_target != gf->current_state) {
++			gf->delay_target_state =
++				gf->current_state->shutdown_target;
++			mod_timer(&gf->timer, gf->shutdown_jiffies);
++		}
++		spin_unlock(&gf->spinlock);
++
++		wait_event_timeout(gf->shutdown_event,
++				   gf->current_state->shutdown_target ==
++				   gf->current_state,
++				   msecs_to_jiffies(gf->shutdown_timeout_ms));
++		/* On failure to reach a shutdown state, jump to one */
++		if (gf->current_state->shutdown_target != gf->current_state)
++			gpio_fsm_enter_state(gf, gf->shutdown_state);
++	}
++	cancel_work_sync(&gf->work);
++	del_timer_sync(&gf->timer);
++
++	/* Events aren't allocated from managed storage */
++	for (i = 0; i < gf->num_states; i++) {
++		kfree(gf->states[i].gpio_events);
++		kfree(gf->states[i].soft_events);
++	}
++	if (gf->debug)
++		dev_info(gf->dev, "Exiting\n");
++}
++
++static void gpio_fsm_shutdown(struct platform_device *pdev)
++{
++	gpio_fsm_remove(pdev);
++}
++
++static const struct of_device_id gpio_fsm_ids[] = {
++	{ .compatible = "rpi,gpio-fsm" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, gpio_fsm_ids);
++
++static struct platform_driver gpio_fsm_driver = {
++	.driver	= {
++		.name		= MODULE_NAME,
++		.of_match_table	= of_match_ptr(gpio_fsm_ids),
++	},
++	.probe = gpio_fsm_probe,
++	.remove = gpio_fsm_remove,
++	.shutdown = gpio_fsm_shutdown,
++};
++
++static int gpio_fsm_init(void)
++{
++	int ret;
++
++	ret = class_register(&gpio_fsm_class);
++	if (ret)
++		return ret;
++
++	ret = platform_driver_register(&gpio_fsm_driver);
++	if (ret)
++		class_unregister(&gpio_fsm_class);
++
++	return ret;
++}
++module_init(gpio_fsm_init);
++
++static void gpio_fsm_exit(void)
++{
++	platform_driver_unregister(&gpio_fsm_driver);
++	class_unregister(&gpio_fsm_class);
++}
++module_exit(gpio_fsm_exit);
++
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Phil Elwell <phil@raspberrypi.com>");
++MODULE_DESCRIPTION("GPIO FSM driver");
++MODULE_ALIAS("platform:gpio-fsm");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0208-watchdog-bcm2835-Ignore-params-after-the-partition-n.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0208-watchdog-bcm2835-Ignore-params-after-the-partition-n.patch
new file mode 100644
index 00000000..a010cc48
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0208-watchdog-bcm2835-Ignore-params-after-the-partition-n.patch
@@ -0,0 +1,29 @@
+From 9416b23f63a88b27d96d83e4b8ea79c02f53456c Mon Sep 17 00:00:00 2001
+From: Tim Gover <tim.gover@raspberrypi.org>
+Date: Thu, 22 Oct 2020 15:30:55 +0100
+Subject: [PATCH 208/697] watchdog: bcm2835: Ignore params after the partition
+ number
+
+Use sscanf to extract the partition number and ignore extra parameters
+which are only relevant to other reboot notifiers.
+---
+ drivers/watchdog/bcm2835_wdt.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/watchdog/bcm2835_wdt.c
++++ b/drivers/watchdog/bcm2835_wdt.c
+@@ -127,10 +127,12 @@ static int bcm2835_restart(struct watchd
+ {
+ 	struct bcm2835_wdt *wdt = watchdog_get_drvdata(wdog);
+ 
+-	unsigned long long val;
++	unsigned long val;
+ 	u8 partition = 0;
+ 
+-	if (data && !kstrtoull(data, 0, &val) && val <= 63)
++	// Allow extra arguments separated by spaces after
++	// the partition number.
++	if (data && sscanf(data, "%lu", &val) && val < 63)
+ 		partition = val;
+ 
+ 	__bcm2835_restart(wdt, partition);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0209-firmware-raspberrypi-Add-support-for-tryonce-reboot-.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0209-firmware-raspberrypi-Add-support-for-tryonce-reboot-.patch
new file mode 100644
index 00000000..3e69c42f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0209-firmware-raspberrypi-Add-support-for-tryonce-reboot-.patch
@@ -0,0 +1,60 @@
+From 308c5bdc8bac23577e2cf3b0676b93183e175aec Mon Sep 17 00:00:00 2001
+From: Tim Gover <tim.gover@raspberrypi.com>
+Date: Tue, 20 Oct 2020 11:55:37 +0100
+Subject: [PATCH 209/697] firmware: raspberrypi: Add support for tryonce reboot
+ flag
+
+Define a new mailbox (SET_REBOOT_FLAGS) which may be used to
+pass optional flags to the Raspberry Pi firmware that changes
+the behaviour of the bootloader and firmware during a reboot.
+
+Currently this just defines the 'tryboot' flag which causes
+the firmware to load tryboot.txt instead config.txt. This
+alternate configuration file can be used to specify the
+path of an alternate firmware and kernels allowing a fallback
+mechanism to be implemented for OS upgrades.
+---
+ drivers/firmware/raspberrypi.c | 25 +++++++++++++++++++++++--
+ 1 file changed, 23 insertions(+), 2 deletions(-)
+
+--- a/drivers/firmware/raspberrypi.c
++++ b/drivers/firmware/raspberrypi.c
+@@ -196,6 +196,7 @@ static int rpi_firmware_notify_reboot(st
+ {
+ 	struct rpi_firmware *fw;
+ 	struct platform_device *pdev = g_pdev;
++	u32 reboot_flags = 0;
+ 
+ 	if (!pdev)
+ 		return 0;
+@@ -204,8 +205,28 @@ static int rpi_firmware_notify_reboot(st
+ 	if (!fw)
+ 		return 0;
+ 
+-	(void)rpi_firmware_property(fw, RPI_FIRMWARE_NOTIFY_REBOOT,
+-				    0, 0);
++	// The partition id is the first parameter followed by zero or
++	// more flags separated by spaces indicating the reason for the reboot.
++	//
++	// 'tryboot': Sets a one-shot flag which is cleared upon reboot and
++	//            causes the tryboot.txt to be loaded instead of config.txt
++	//            by the bootloader and the start.elf firmware.
++	//
++	//            This is intended to allow automatic fallback to a known
++	//            good image if an OS/FW upgrade fails.
++	//
++	// N.B. The firmware mechanism for storing reboot flags may vary
++	// on different Raspberry Pi models.
++	if (data && strstr(data, " tryboot"))
++		reboot_flags |= 0x1;
++
++	// The mailbox might have been called earlier, directly via vcmailbox
++	// so only overwrite if reboot flags are passed to the reboot command.
++	if (reboot_flags)
++		(void)rpi_firmware_property(fw, RPI_FIRMWARE_SET_REBOOT_FLAGS,
++				&reboot_flags, sizeof(reboot_flags));
++
++	(void)rpi_firmware_property(fw, RPI_FIRMWARE_NOTIFY_REBOOT, NULL, 0);
+ 
+ 	return 0;
+ }
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0210-Input-edt-ft5x06-Poll-the-device-if-no-interrupt-is-.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0210-Input-edt-ft5x06-Poll-the-device-if-no-interrupt-is-.patch
new file mode 100644
index 00000000..21a816cb
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0210-Input-edt-ft5x06-Poll-the-device-if-no-interrupt-is-.patch
@@ -0,0 +1,340 @@
+From 3ce102ab49d08db6a961e38d9794a77db85ef3f0 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 6 Nov 2020 18:45:10 +0000
+Subject: [PATCH 210/697] Input: edt-ft5x06: Poll the device if no interrupt is
+ configured.
+
+Not all systems have the interrupt line wired up, so switch to
+polling the touchscreen off a timer if no interrupt line is
+configured.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+input: edt-ft5x06: Handle unreliable TOUCH_UP events
+
+The ft5x06 is unreliable in sending touch up events, so some
+touch IDs can become stuck in the detected state.
+
+Ensure that IDs that are unreported by the controller are
+released.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+input: edt-ft5x06: Only look at the number of points reported
+
+Register 0x02 in the FT5x06 is TD_STATUS containing the number
+of valid touch points being reported.
+
+Iterate over that number of points rather than all that are
+supported on the device.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+input: edt-ft5x06: Only read data for number of points reported
+
+Rather than always reading the maximum number of points supported
+by the chip (which may be as high as 10), read the number of
+active points first, and read data for just those.
+In most cases this will result in less data on the I2C bus,
+with only the maximum touch points taking more due to a second
+read that has to configure the start address.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+input: edt-ft5x06: Fix patch reading only the number of points reported
+
+Fix bad conflict resolution from upstream updates. Need to read
+from tsdata->tdata_offset bytes, not from tsdata->offset.
+Also fix logging of i2c read errors to cover both transactions.
+
+Fixes: 7216fcfe2e5f ("input: edt-ft5x06: Only read data for number of points reported")
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+Input: edt-ft54x6: Clean up timer and workqueue on remove
+
+If no interrupt is defined then a timer and workqueue are used
+to poll the controller.
+On remove these were not being cleaned up correctly.
+
+Fixes: ca61fdaba79f "Input: edt-ft5x06: Poll the device if no interrupt is
+configured."
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+input: touchscreen: edt-ft5x06: Suppress bogus data on startup
+
+When polled without the use of IRQ, FT5x06 registers may return
+undefined initial data, causing unwanted touches or event spamming.
+A simple way to filter this out is to suppress touches until the
+TD_STATUS register changes for the first time.
+
+Increase the delay before first polling to 300ms, to avoid
+transient I2C read flakiness that seems to occur after reset.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+
+input: edt-ft5x06: Include I2C details in names for the devices
+
+libinput uses the input device name alone. If you have two
+identical input devices, then there is no way to differentiate
+between them, and in the case of touchscreens that means no
+way to associate them with the appropriate display device.
+
+Add the I2C bus and address to the start of the input device
+name so that the name is always unique within the system.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+input: edt-ft5x06: Correct prefix length in snprintf
+
+snprintf takes the length of the array that we can print into,
+and has to fit the NULL terminator in there too.
+Printing the prefix is generally "12-3456 " which is 8 desired
+characters (the length of EDT_NAME_PREFIX_LEN) and the NULL.
+The space is therefore being truncated to fit the NULL in.
+
+Increase the length snprintf is allowed to use.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/input/touchscreen/edt-ft5x06.c | 124 ++++++++++++++++++++++---
+ 1 file changed, 109 insertions(+), 15 deletions(-)
+
+--- a/drivers/input/touchscreen/edt-ft5x06.c
++++ b/drivers/input/touchscreen/edt-ft5x06.c
+@@ -69,6 +69,7 @@
+ #define TOUCH_EVENT_RESERVED		0x03
+ 
+ #define EDT_NAME_LEN			23
++#define EDT_NAME_PREFIX_LEN		8
+ #define EDT_SWITCH_MODE_RETRIES		10
+ #define EDT_SWITCH_MODE_DELAY		5 /* msec */
+ #define EDT_RAW_DATA_RETRIES		100
+@@ -80,6 +81,10 @@
+ #define M06_REG_CMD(factory) ((factory) ? 0xf3 : 0xfc)
+ #define M06_REG_ADDR(factory, addr) ((factory) ? (addr) & 0x7f : (addr) & 0x3f)
+ 
++#define RESET_DELAY_MS			300	/* reset deassert to I2C */
++#define FIRST_POLL_DELAY_MS		300	/* in addition to the above */
++#define POLL_INTERVAL_MS		17	/* 17ms = 60fps */
++
+ enum edt_pmode {
+ 	EDT_PMODE_NOT_SUPPORTED,
+ 	EDT_PMODE_HIBERNATE,
+@@ -139,14 +144,19 @@ struct edt_ft5x06_ts_data {
+ 	u8 tdata_cmd;
+ 	int tdata_len;
+ 	int tdata_offset;
++	unsigned int known_ids;
+ 
+-	char name[EDT_NAME_LEN];
++	char name[EDT_NAME_PREFIX_LEN + EDT_NAME_LEN];
+ 	char fw_version[EDT_NAME_LEN];
++	int init_td_status;
+ 
+ 	struct edt_reg_addr reg_addr;
+ 	enum edt_ver version;
+ 	unsigned int crc_errors;
+ 	unsigned int header_errors;
++
++	struct timer_list timer;
++	struct work_struct work_i2c_poll;
+ };
+ 
+ struct edt_i2c_chip_data {
+@@ -303,17 +313,49 @@ static irqreturn_t edt_ft5x06_ts_isr(int
+ 	u8 rdbuf[63];
+ 	int i, type, x, y, id;
+ 	int error;
++	int num_points;
++	unsigned int active_ids = 0, known_ids = tsdata->known_ids;
++	long released_ids;
++	int b = 0;
+ 
+ 	memset(rdbuf, 0, sizeof(rdbuf));
+ 	error = regmap_bulk_read(tsdata->regmap, tsdata->tdata_cmd, rdbuf,
+ 				 tsdata->tdata_len);
++	if (tsdata->version == EDT_M06) {
++		num_points = tsdata->max_support_points;
++	} else {
++		/* Register 2 is TD_STATUS, containing the number of touch
++		 * points.
++		 */
++		num_points = min(rdbuf[2] & 0xf, tsdata->max_support_points);
++
++		/* When polling FT5x06 without IRQ: initial register contents
++		 * could be stale or undefined; discard all readings until
++		 * TD_STATUS changes for the first time (or num_points is 0).
++		 */
++		if (tsdata->init_td_status) {
++			if (tsdata->init_td_status < 0)
++				tsdata->init_td_status = rdbuf[2];
++
++			if (num_points && rdbuf[2] == tsdata->init_td_status)
++				goto out;
++
++			tsdata->init_td_status = 0;
++		}
++
++		if (!error && num_points)
++			error = regmap_bulk_read(tsdata->regmap,
++						 tsdata->tdata_offset,
++						 &rdbuf[tsdata->tdata_offset],
++						 tsdata->point_len * num_points);
++	}
+ 	if (error) {
+ 		dev_err_ratelimited(dev, "Unable to fetch data, error: %d\n",
+ 				    error);
+ 		goto out;
+ 	}
+ 
+-	for (i = 0; i < tsdata->max_support_points; i++) {
++	for (i = 0; i < num_points; i++) {
+ 		u8 *buf = &rdbuf[i * tsdata->point_len + tsdata->tdata_offset];
+ 
+ 		type = buf[0] >> 6;
+@@ -335,10 +377,25 @@ static irqreturn_t edt_ft5x06_ts_isr(int
+ 
+ 		input_mt_slot(tsdata->input, id);
+ 		if (input_mt_report_slot_state(tsdata->input, MT_TOOL_FINGER,
+-					       type != TOUCH_EVENT_UP))
++					       type != TOUCH_EVENT_UP)) {
+ 			touchscreen_report_pos(tsdata->input, &tsdata->prop,
+ 					       x, y, true);
++			active_ids |= BIT(id);
++		} else {
++			known_ids &= ~BIT(id);
++		}
++	}
++
++	/* One issue with the device is the TOUCH_UP message is not always
++	 * returned. Instead track which ids we know about and report when they
++	 * are no longer updated
++	 */
++	released_ids = known_ids & ~active_ids;
++	for_each_set_bit_from(b, &released_ids, tsdata->max_support_points) {
++		input_mt_slot(tsdata->input, b);
++		input_mt_report_slot_inactive(tsdata->input);
+ 	}
++	tsdata->known_ids = active_ids;
+ 
+ 	input_mt_report_pointer_emulation(tsdata->input, true);
+ 	input_sync(tsdata->input);
+@@ -347,6 +404,22 @@ out:
+ 	return IRQ_HANDLED;
+ }
+ 
++static void edt_ft5x06_ts_irq_poll_timer(struct timer_list *t)
++{
++	struct edt_ft5x06_ts_data *tsdata = from_timer(tsdata, t, timer);
++
++	schedule_work(&tsdata->work_i2c_poll);
++	mod_timer(&tsdata->timer, jiffies + msecs_to_jiffies(POLL_INTERVAL_MS));
++}
++
++static void edt_ft5x06_ts_work_i2c_poll(struct work_struct *work)
++{
++	struct edt_ft5x06_ts_data *tsdata = container_of(work,
++			struct edt_ft5x06_ts_data, work_i2c_poll);
++
++	edt_ft5x06_ts_isr(0, tsdata);
++}
++
+ struct edt_ft5x06_attribute {
+ 	struct device_attribute dattr;
+ 	size_t field_offset;
+@@ -862,6 +935,9 @@ static int edt_ft5x06_ts_identify(struct
+ 	char *model_name = tsdata->name;
+ 	char *fw_version = tsdata->fw_version;
+ 
++	snprintf(model_name, EDT_NAME_PREFIX_LEN + 1, "%s ", dev_name(&client->dev));
++	model_name += strlen(model_name);
++
+ 	/* see what we find if we assume it is a M06 *
+ 	 * if we get less than EDT_NAME_LEN, we don't want
+ 	 * to have garbage in there
+@@ -1050,20 +1126,23 @@ static void edt_ft5x06_ts_get_parameters
+ static void edt_ft5x06_ts_set_tdata_parameters(struct edt_ft5x06_ts_data *tsdata)
+ {
+ 	int crclen;
++	int points;
+ 
+ 	if (tsdata->version == EDT_M06) {
+ 		tsdata->tdata_cmd = 0xf9;
+ 		tsdata->tdata_offset = 5;
+ 		tsdata->point_len = 4;
+ 		crclen = 1;
++		points = tsdata->max_support_points;
+ 	} else {
+ 		tsdata->tdata_cmd = 0x0;
+ 		tsdata->tdata_offset = 3;
+ 		tsdata->point_len = 6;
+ 		crclen = 0;
++		points = 0;
+ 	}
+ 
+-	tsdata->tdata_len = tsdata->point_len * tsdata->max_support_points +
++	tsdata->tdata_len = tsdata->point_len * points +
+ 		tsdata->tdata_offset + crclen;
+ }
+ 
+@@ -1258,7 +1337,7 @@ static int edt_ft5x06_ts_probe(struct i2
+ 	if (tsdata->reset_gpio) {
+ 		usleep_range(5000, 6000);
+ 		gpiod_set_value_cansleep(tsdata->reset_gpio, 0);
+-		msleep(300);
++		msleep(RESET_DELAY_MS);
+ 	}
+ 
+ 	input = devm_input_allocate_device(&client->dev);
+@@ -1332,17 +1411,28 @@ static int edt_ft5x06_ts_probe(struct i2
+ 		return error;
+ 	}
+ 
+-	irq_flags = irq_get_trigger_type(client->irq);
+-	if (irq_flags == IRQF_TRIGGER_NONE)
+-		irq_flags = IRQF_TRIGGER_FALLING;
+-	irq_flags |= IRQF_ONESHOT;
+-
+-	error = devm_request_threaded_irq(&client->dev, client->irq,
+-					  NULL, edt_ft5x06_ts_isr, irq_flags,
+-					  client->name, tsdata);
+-	if (error) {
+-		dev_err(&client->dev, "Unable to request touchscreen IRQ.\n");
+-		return error;
++	if (client->irq) {
++		irq_flags = irq_get_trigger_type(client->irq);
++		if (irq_flags == IRQF_TRIGGER_NONE)
++			irq_flags = IRQF_TRIGGER_FALLING;
++		irq_flags |= IRQF_ONESHOT;
++
++		error = devm_request_threaded_irq(&client->dev, client->irq,
++						  NULL, edt_ft5x06_ts_isr,
++						  irq_flags, client->name,
++						  tsdata);
++		if (error) {
++			dev_err(&client->dev, "Unable to request touchscreen IRQ.\n");
++			return error;
++		}
++	} else {
++		tsdata->init_td_status = -1; /* filter bogus initial data */
++		INIT_WORK(&tsdata->work_i2c_poll,
++			  edt_ft5x06_ts_work_i2c_poll);
++		timer_setup(&tsdata->timer, edt_ft5x06_ts_irq_poll_timer, 0);
++		tsdata->timer.expires =
++			jiffies + msecs_to_jiffies(FIRST_POLL_DELAY_MS);
++		add_timer(&tsdata->timer);
+ 	}
+ 
+ 	error = input_register_device(input);
+@@ -1364,6 +1454,10 @@ static void edt_ft5x06_ts_remove(struct
+ {
+ 	struct edt_ft5x06_ts_data *tsdata = i2c_get_clientdata(client);
+ 
++	if (!client->irq) {
++		del_timer(&tsdata->timer);
++		cancel_work_sync(&tsdata->work_i2c_poll);
++	}
+ 	edt_ft5x06_ts_teardown_debugfs(tsdata);
+ }
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0211-dt-bindings-Add-compatible-for-BCM2711-DSI1.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0211-dt-bindings-Add-compatible-for-BCM2711-DSI1.patch
new file mode 100644
index 00000000..b5544246
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0211-dt-bindings-Add-compatible-for-BCM2711-DSI1.patch
@@ -0,0 +1,23 @@
+From 06140fc9c4991c9d0d3813a41f6bfc2da5848aed Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 12 Nov 2020 17:01:52 +0000
+Subject: [PATCH 211/697] dt-bindings: Add compatible for BCM2711 DSI1
+
+DSI1 on BCM2711 doesn't require the DMA workaround that is used
+on BCM2835/6/7, therefore it needs a new compatible string.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ Documentation/devicetree/bindings/display/brcm,bcm2835-dsi0.yaml | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/Documentation/devicetree/bindings/display/brcm,bcm2835-dsi0.yaml
++++ b/Documentation/devicetree/bindings/display/brcm,bcm2835-dsi0.yaml
+@@ -21,6 +21,7 @@ properties:
+       - brcm,bcm2711-dsi1
+       - brcm,bcm2835-dsi0
+       - brcm,bcm2835-dsi1
++      - brcm,bcm2711-dsi1
+ 
+   reg:
+     maxItems: 1
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0212-media-bcm2835-unicam-Correctly-handle-error-propagat.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0212-media-bcm2835-unicam-Correctly-handle-error-propagat.patch
new file mode 100644
index 00000000..33c0fccf
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0212-media-bcm2835-unicam-Correctly-handle-error-propagat.patch
@@ -0,0 +1,27 @@
+From 07105bcad99d040beeeaec5d2156f4f1ed9ed5a2 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Wed, 2 Dec 2020 15:22:23 +0000
+Subject: [PATCH 212/697] media: bcm2835-unicam: Correctly handle error
+ propagation for stream on
+
+On a failure in start_streaming(), the error code would not propagate to
+the calling function on all conditions. This would cause the userland
+caller to not know of the failure.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -1722,8 +1722,7 @@ err_disable_unicam:
+ 	unicam_disable(dev);
+ 	clk_disable_unprepare(dev->clock);
+ err_vpu_clock:
+-	ret = clk_set_min_rate(dev->vpu_clock, 0);
+-	if (ret)
++	if (clk_set_min_rate(dev->vpu_clock, 0))
+ 		unicam_err(dev, "failed to reset the VPU clock\n");
+ 	clk_disable_unprepare(dev->vpu_clock);
+ err_pm_put:
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0213-media-bcm2835-unicam-Return-early-from-stop_streamin.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0213-media-bcm2835-unicam-Return-early-from-stop_streamin.patch
new file mode 100644
index 00000000..1c53f9e4
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0213-media-bcm2835-unicam-Return-early-from-stop_streamin.patch
@@ -0,0 +1,64 @@
+From 09ca18da0f1a844be80337c81ca2f9ed77117d39 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Wed, 2 Dec 2020 15:26:09 +0000
+Subject: [PATCH 213/697] media: bcm2835-unicam: Return early from
+ stop_streaming() if stopped
+
+clk_disable_unprepare() is called unconditionally in stop_streaming().
+This is incorrect in the cases where start_streaming() fails, and
+unprepares all clocks as part of the failure cleanup. To avoid this,
+ensure that clk_disable_unprepare() is only called in stop_streaming()
+if the clocks are in a prepared state.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -418,6 +418,8 @@ struct unicam_device {
+ 	struct clk *clock;
+ 	/* vpu clock handle */
+ 	struct clk *vpu_clock;
++	/* clock status for error handling */
++	bool clocks_enabled;
+ 	/* V4l2 device */
+ 	struct v4l2_device v4l2_dev;
+ 	struct media_device mdev;
+@@ -1716,6 +1718,7 @@ static int unicam_start_streaming(struct
+ 		goto err_disable_unicam;
+ 	}
+ 
++	dev->clocks_enabled = true;
+ 	return 0;
+ 
+ err_disable_unicam:
+@@ -1742,8 +1745,6 @@ static void unicam_stop_streaming(struct
+ 	node->streaming = false;
+ 
+ 	if (node->pad_id == IMAGE_PAD) {
+-		int ret;
+-
+ 		/*
+ 		 * Stop streaming the sensor and disable the peripheral.
+ 		 * We cannot continue streaming embedded data with the
+@@ -1754,12 +1755,13 @@ static void unicam_stop_streaming(struct
+ 
+ 		unicam_disable(dev);
+ 
+-		ret = clk_set_min_rate(dev->vpu_clock, 0);
+-		if (ret)
+-			unicam_err(dev, "failed to reset the min VPU clock\n");
++		if (dev->clocks_enabled) {
++			if (clk_set_min_rate(dev->vpu_clock, 0))
++				unicam_err(dev, "failed to reset the min VPU clock\n");
+ 
+-		clk_disable_unprepare(dev->vpu_clock);
+-		clk_disable_unprepare(dev->clock);
++			clk_disable_unprepare(dev->vpu_clock);
++			clk_disable_unprepare(dev->clock);
++		}
+ 		unicam_runtime_put(dev);
+ 
+ 	} else if (node->pad_id == METADATA_PAD) {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0214-media-bcm2835-unicam-Clear-clock-state-when-stopping.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0214-media-bcm2835-unicam-Clear-clock-state-when-stopping.patch
new file mode 100644
index 00000000..9eb13287
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0214-media-bcm2835-unicam-Clear-clock-state-when-stopping.patch
@@ -0,0 +1,25 @@
+From 04b9ba65018e9d6de95e30956fd6b2f899a45d5f Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Wed, 2 Dec 2020 16:48:41 +0000
+Subject: [PATCH 214/697] media: bcm2835-unicam: Clear clock state when
+ stopping streaming
+
+Commit 65e08c465020d4c5b51afb452efc2246d80fd66f failed to clear the
+clock state when the device stopped streaming. Fix this, as it might
+again cause the same problems when doing an unprepare.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -1761,6 +1761,7 @@ static void unicam_stop_streaming(struct
+ 
+ 			clk_disable_unprepare(dev->vpu_clock);
+ 			clk_disable_unprepare(dev->clock);
++			dev->clocks_enabled = false;
+ 		}
+ 		unicam_runtime_put(dev);
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0215-PCI-brcmstb-Add-BCM2712-support.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0215-PCI-brcmstb-Add-BCM2712-support.patch
new file mode 100644
index 00000000..149a224a
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0215-PCI-brcmstb-Add-BCM2712-support.patch
@@ -0,0 +1,1235 @@
+From cbae17fd95c01508f740a29eca2f6461e3d79885 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 11 Jun 2020 09:57:03 +0100
+Subject: [PATCH 215/697] PCI: brcmstb: Add BCM2712 support
+
+PCI: brcmstb: Add DT property to control L1SS
+
+The BRCM PCIe block has controls to enable control of the CLKREQ#
+signal by the L1SS, and to gate the refclk with the CLKREQ# input.
+These controls are mutually exclusive - the upstream code sets the
+latter, but some use cases require the former.
+
+Add a Device Tree property - brcm,enable-l1ss - to switch to the
+L1SS configuration.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+PCI: brcmstb: Advertise MSI-X support
+
+Although the BRCMSTB PCIe interface doesn't technically support the
+MSI-X spec, in practise it seems to work provided no more than 32
+MSI-Xs are required. Add the required flag to the driver to allow
+experimentation with devices that demand MSI-X support.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+PCI: brcmstb: differing register offsets on 2712
+
+pcie-brcmstb: Add 2712 bridge reset support
+
+pcie: 2712 PORT_MASK and rescal support
+
+pcie-brcmstb: don't alter the L1SS debug register
+
+For reasons unknown, this disables the reference clock
+
+pcie-brcmstb: fix BAR2 enable and window decode
+
+Set UBUS ACCESS_EN to let inbound DMA work. Also BCM2712 has grown
+an index in the inbound window size decode register.
+
+PCIe: brcmstb: Enable support for 64 MSI-Xs
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+pcie-brcmstb: Suppress read error responses
+
+If the link is down or the EP fails to return a read completion, the
+RC's default behaviour is to return an AXI error. This causes fatal
+exceptions on A76, so it's better to respond with all 1s instead.
+
+pcie-brcmstb: increase UBUS timeout to cater for link retrain events
+
+pcie-brcmstb: Handle additional inbound regions
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+pcie-brcmstb: Add support for external MSI controller
+
+pcie-brcmstb: add a reasonable default traffic class to priority map
+
+BCM2712 supports multiple traffic classes (TCs) with independent
+maximally sized transfer queues for each TC. Traffic classes have no
+transaction ordering requirements between them, which facilitates
+out-of-order completions and arbitration between posted writes for
+data streams that have no dependence on each other.
+
+In addition to the above benefits of splitting endpoint traffic into
+individual queues, priorities can be assigned to traffic classes by
+a heuristic or deterministic mechanism. The heuristic elevates AXI
+QOS priority in accordance with the number of pending transfers in
+each TC's queue, but for true priority signalling a forwarding
+mechanism using vendor-defined messages is implemented.
+
+Receipt of a 3 DWORD VDM assigns a priority tag to a TC on-the-fly,
+and this tag corresponds to a configurable AXI QOS value.
+
+As a simple baseline, assign a linear map of AXI QOS to each tag.
+
+pcie: brcmstb: set up the VDM forwarding interface when setting up QoS
+
+pcie-brcmstb: clean up debug messages
+
+pcie-brcmstb: fix BCM2712A0 PHY PM errata
+
+The power management clock is 54MHz not 50MHz, so adjust the PM clock period
+to suit. Powering off the PHY PLL in L1.2 is unsafe, so force it on.
+
+pcie-brcmstb: set CLKREQ functionality according to link partner support
+
+The RC supports either L1 with clock PM or L1 sub-state control, not both
+at the same time. Examine the link partner's capabilities to determine
+which is the most suitable scheme to use.
+
+pcie: brcmstb: don't reset block bridges in suspend or removal cases
+
+BCM2712 has a single rescal block for all three root complexes, and
+holding PCIE1's bridge in reset will hang the chip if a different
+RC wants to access any of the rescal registers.
+
+pcie: brcmstb: guard 2712-specific setup with a RC type check
+
+BCM2711 doesn't implement the UBUS control registers.
+
+pcie: brcmstb: On 2712 keeping the PLL powered in L1.x is not required
+
+A separate misconfiguration when enabling SSC (the MDIO registers no
+longer do the same thing on BCM2712) had the side-effect of breaking
+PLL powerdown and resume sequencing.
+
+Allow entry into a true L1.2 state where analogue is depowered.
+
+pcie: brcmstb: Fix reset warning on probe failure
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+bcm2712: pcie: adjust PHY PLL setup to use a 54MHz input refclk
+
+Use canned MDIO writes from Broadcom that switch the ref_clk output
+pair to run from the internal fractional PLL, and set the internal PLL
+to expect a 54MHz input reference clock.
+
+Gen3 operation is not guaranteed to be stable in this setup, so default
+to gen2.
+
+This only works if the LCPLL is bypassed (requires latest bootloader).
+
+pcie: brcmstb: add missing register writes
+
+drivers: pcie: brcmstb: cater for BCM2712C0 bug dropping QoS on the floor
+
+The AXI QoS value extracted from the request fifo ends up as zero forever.
+Disabling this means that "panic" signalling doesn't do anything useful,
+but static priorites do work.
+
+Also align the selected TC:QoS map with RP1's expectations of service.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+drivers: pcie: brcmstb: shuffle TC priorities up to 8
+
+Use the range 8-11 which puts the highest below HVS but leaves space
+below for other 2712 masters.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+drivers: pcie: brcmstb: optionally enable QoS features by DT for BCM2712
+
+It's a bad idea to universally enable "realtime" priorities for TCs
+across all the RC instances on the chip. Endpoints other than RP1 may
+make use of these, so you don't want e.g. NVMe descriptor fetches getting
+higher priority than your remote display.
+
+Add two optional DT properties controlling the behaviour - FIFO-based
+backpressure QoS or "message-based". Message-based signalling is
+fundamentally broken due to a chip bug, so it collapses into a set of
+static assignments that RP1 needs.
+
+The default if neither property is specified is to assign everything a
+QoS of 0.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+drivers: pcie: brcmstb: adjust completion timeouts for bcm2712
+
+Setting the RC config retry timeout makes CRS auto-polling work, but
+the UBUS timeout will override the config retry. Both need to be large.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+PCI: brcmstb: Change RCB_{MPS,64B}_MODE bits
+
+Upstream commit [1] unconditionally sets the RCB_MPS and RCB_64B bits
+that govern where packets are split. We think this is potentially
+harmful, particularly on CM4 and Pi 5 where potentially any PCIe devices
+could be attached.
+
+Make RCB_MPS conditional on a DT property and never set RCB_64B.
+
+[1] commit 602fb860945f ("PCI: brcmstb: Set RCB_{MPS,64B}_MODE bits")
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+drivers: pci: brcmstb: optionally extend Tperst_clk time during link-up
+
+The RC has a feature that allows for manual control over the deassertion
+of the PERST# output pin, which allows the time between refclk active
+and reset deassert at the EP to be increased.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+PCI: brcmstb: fix broken brcm_pcie_mdio_write() polling
+
+MDIO_WR_DONE() tests bit 31, which is always 0 (==done) as
+readw_poll_timeout_atomic does a 16-bit read. Replace with the readl
+variant.
+
+Fixes: ca5dcc76314d ("PCI: brcmstb: Replace status loops with read_poll_timeout_atomic()")
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+PCI: brcmstb: resolve conflicts with upstream CLKREQ# selection
+
+This partially reverts commit 177baa7aeb3f ("Revert "PCI: brcmstb:
+Configure HW CLKREQ# mode appropriate for downstream device"")
+
+commit e2596dcf1e9d ("PCI: brcmstb: Configure HW CLKREQ# mode appropriate
+for downstream device") upstream.
+
+The upstream implementation should replace the downstream one.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+PCI: brcmstb: don't set bridge timeouts on BCM2712
+
+BCM2712 has a slightly different architecture to most other STB chips.
+
+Timeout values are internal to the core and are set in PCIE_MISC not
+PCIE_RGR1.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+PCI: brcmstb: Enable CRS software visibility after linkup
+
+It appears that bits in the Root Control Register are reset with
+perst_n, which means the PCI layer's call to enable CRS prior to
+adding/scanning the bus has no effect. Open-code the enable in
+brcm_pcie_start_link as a workaround.
+
+Without CRS visibility, configuration reads issued by the CPU don't
+retire if the endpoint returns a CRS response - the RC will poll until a
+(large) timeout is reached. This means the core can stall for a long
+time during boot.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+PCI: brcmstb: Set new flags to avoid QOS "holes" on BCM2712D0
+
+Set some flags present (and recommended) in 2712D0, but missing
+(and harmless) in 2712C1. In particular, EN_QOS_UPDATE_TIMING_FIX
+must be set to avoid spurious QOS=0 when the queue changes from
+empty to non-empty, to make D0 match the existing C1 behaviour.
+
+Not enabling "QOS forwarding", which still seems not to help.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+
+drivers: pcie-brcmstb: add best-effort workaround for QoS bug on bcm2712
+
+If a set of read requests are issued by an endpoint, they are streamed
+into a resynchronisation FIFO prior to exiting the RC. This FIFO has an
+edge case where it can drop QoS for a request to 0 if there's a single
+outstanding read request in the FIFO, and another is pushed when the
+FIFO is popped. Requests with a QoS of 0 can take hundreds of
+microseconds to complete.
+
+By adding an experimentally-determined amount of backpressure on the pop
+side, the critical level transition can largely be avoided.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/pci/controller/pcie-brcmstb.c | 660 ++++++++++++++++++++++++--
+ 1 file changed, 629 insertions(+), 31 deletions(-)
+
+--- a/drivers/pci/controller/pcie-brcmstb.c
++++ b/drivers/pci/controller/pcie-brcmstb.c
+@@ -48,10 +48,26 @@
+ #define PCIE_RC_CFG_PRIV1_LINK_CAPABILITY			0x04dc
+ #define  PCIE_RC_CFG_PRIV1_LINK_CAPABILITY_ASPM_SUPPORT_MASK	0xc00
+ 
++#define PCIE_RC_TL_VDM_CTL0				0x0a20
++#define  PCIE_RC_TL_VDM_CTL0_VDM_ENABLED_MASK		0x10000
++#define  PCIE_RC_TL_VDM_CTL0_VDM_IGNORETAG_MASK		0x20000
++#define  PCIE_RC_TL_VDM_CTL0_VDM_IGNOREVNDRID_MASK	0x40000
++
++#define PCIE_RC_TL_VDM_CTL1				0x0a0c
++#define  PCIE_RC_TL_VDM_CTL1_VDM_VNDRID0_MASK		0x0000ffff
++#define  PCIE_RC_TL_VDM_CTL1_VDM_VNDRID1_MASK		0xffff0000
++
++#define PCIE_RC_CFG_PRIV1_ROOT_CAP			0x4f8
++#define  PCIE_RC_CFG_PRIV1_ROOT_CAP_L1SS_MODE_MASK	0xf8
++
+ #define PCIE_RC_DL_MDIO_ADDR				0x1100
+ #define PCIE_RC_DL_MDIO_WR_DATA				0x1104
+ #define PCIE_RC_DL_MDIO_RD_DATA				0x1108
+ 
++#define PCIE_RC_PL_PHY_CTL_15				0x184c
++#define  PCIE_RC_PL_PHY_CTL_15_DIS_PLL_PD_MASK		0x400000
++#define  PCIE_RC_PL_PHY_CTL_15_PM_CLK_PERIOD_MASK	0xff
++
+ #define PCIE_MISC_MISC_CTRL				0x4008
+ #define  PCIE_MISC_MISC_CTRL_PCIE_RCB_64B_MODE_MASK	0x80
+ #define  PCIE_MISC_MISC_CTRL_PCIE_RCB_MPS_MODE_MASK	0x400
+@@ -82,9 +98,15 @@
+ #define PCIE_BRCM_MAX_INBOUND_WINS			16
+ #define PCIE_MISC_RC_BAR1_CONFIG_LO			0x402c
+ #define  PCIE_MISC_RC_BAR1_CONFIG_LO_SIZE_MASK		0x1f
++#define PCIE_MISC_RC_BAR1_CONFIG_HI			0x4030
+ 
+-#define PCIE_MISC_RC_BAR4_CONFIG_LO			0x40d4
+-
++#define PCIE_MISC_RC_BAR2_CONFIG_LO			0x4034
++#define  PCIE_MISC_RC_BAR2_CONFIG_LO_SIZE_MASK		0x1f
++#define PCIE_MISC_RC_BAR2_CONFIG_HI			0x4038
++
++#define PCIE_MISC_RC_BAR3_CONFIG_LO			0x403c
++#define  PCIE_MISC_RC_BAR3_CONFIG_LO_SIZE_MASK		0x1f
++#define PCIE_MISC_RC_BAR3_CONFIG_HI			0x4040
+ 
+ #define PCIE_MISC_MSI_BAR_CONFIG_LO			0x4044
+ #define PCIE_MISC_MSI_BAR_CONFIG_HI			0x4048
+@@ -93,12 +115,15 @@
+ #define  PCIE_MISC_MSI_DATA_CONFIG_VAL_32		0xffe06540
+ #define  PCIE_MISC_MSI_DATA_CONFIG_VAL_8		0xfff86540
+ 
++#define PCIE_MISC_RC_CONFIG_RETRY_TIMEOUT		0x405c
++
+ #define PCIE_MISC_PCIE_CTRL				0x4064
+ #define  PCIE_MISC_PCIE_CTRL_PCIE_L23_REQUEST_MASK	0x1
+ #define PCIE_MISC_PCIE_CTRL_PCIE_PERSTB_MASK		0x4
+ 
+ #define PCIE_MISC_PCIE_STATUS				0x4068
+ #define  PCIE_MISC_PCIE_STATUS_PCIE_PORT_MASK		0x80
++#define  PCIE_MISC_PCIE_STATUS_PCIE_PORT_MASK_2712	0x40
+ #define  PCIE_MISC_PCIE_STATUS_PCIE_DL_ACTIVE_MASK	0x20
+ #define  PCIE_MISC_PCIE_STATUS_PCIE_PHYLINKUP_MASK	0x10
+ #define  PCIE_MISC_PCIE_STATUS_PCIE_LINK_IN_L23_MASK	0x40
+@@ -124,14 +149,82 @@
+ 		PCIE_MISC_CPU_2_PCIE_MEM_WIN0_LIMIT_HI + ((win) * 8)
+ 
+ #define  PCIE_MISC_HARD_PCIE_HARD_DEBUG_CLKREQ_DEBUG_ENABLE_MASK	0x2
++#define  PCIE_MISC_HARD_PCIE_HARD_DEBUG_PERST_ASSERT_MASK		0x8
++#define  PCIE_MISC_HARD_PCIE_HARD_DEBUG_L1SS_ENABLE_MASK		0x200000
+ #define  PCIE_MISC_HARD_PCIE_HARD_DEBUG_SERDES_IDDQ_MASK		0x08000000
+ #define  PCIE_BMIPS_MISC_HARD_PCIE_HARD_DEBUG_SERDES_IDDQ_MASK		0x00800000
++#define  PCIE_CLKREQ_MASK \
++	  (PCIE_MISC_HARD_PCIE_HARD_DEBUG_CLKREQ_DEBUG_ENABLE_MASK | \
++	   PCIE_MISC_HARD_PCIE_HARD_DEBUG_L1SS_ENABLE_MASK)
+ 
+ 
+ #define PCIE_MISC_UBUS_BAR1_CONFIG_REMAP			0x40ac
+ #define  PCIE_MISC_UBUS_BAR1_CONFIG_REMAP_ACCESS_EN_MASK	BIT(0)
+ #define PCIE_MISC_UBUS_BAR4_CONFIG_REMAP			0x410c
+ 
++#define PCIE_MISC_CTRL_1					0x40A0
++#define  PCIE_MISC_CTRL_1_OUTBOUND_TC_MASK			0xf
++#define  PCIE_MISC_CTRL_1_OUTBOUND_NO_SNOOP_MASK		BIT(3)
++#define  PCIE_MISC_CTRL_1_OUTBOUND_RO_MASK			BIT(4)
++#define  PCIE_MISC_CTRL_1_EN_VDM_QOS_CONTROL_MASK		BIT(5)
++
++#define PCIE_MISC_UBUS_CTRL	0x40a4
++#define  PCIE_MISC_UBUS_CTRL_UBUS_PCIE_REPLY_ERR_DIS_MASK	BIT(13)
++#define  PCIE_MISC_UBUS_CTRL_UBUS_PCIE_REPLY_DECERR_DIS_MASK	BIT(19)
++
++#define PCIE_MISC_UBUS_TIMEOUT	0x40A8
++
++#define PCIE_MISC_UBUS_BAR1_CONFIG_REMAP	0x40ac
++#define  PCIE_MISC_UBUS_BAR1_CONFIG_REMAP_ACCESS_ENABLE_MASK	BIT(0)
++#define PCIE_MISC_UBUS_BAR1_CONFIG_REMAP_HI	0x40b0
++
++#define PCIE_MISC_UBUS_BAR2_CONFIG_REMAP	0x40b4
++#define  PCIE_MISC_UBUS_BAR2_CONFIG_REMAP_ACCESS_ENABLE_MASK	BIT(0)
++
++/* Additional RC BARs */
++#define  PCIE_MISC_RC_BAR_CONFIG_LO_SIZE_MASK		0x1f
++#define PCIE_MISC_RC_BAR4_CONFIG_LO			0x40d4
++#define PCIE_MISC_RC_BAR4_CONFIG_HI			0x40d8
++/* ... */
++#define PCIE_MISC_RC_BAR10_CONFIG_LO			0x4104
++#define PCIE_MISC_RC_BAR10_CONFIG_HI			0x4108
++
++#define PCIE_MISC_UBUS_BAR_CONFIG_REMAP_ENABLE		0x1
++#define PCIE_MISC_UBUS_BAR_CONFIG_REMAP_LO_MASK		0xfffff000
++#define PCIE_MISC_UBUS_BAR_CONFIG_REMAP_HI_MASK		0xff
++#define PCIE_MISC_UBUS_BAR4_CONFIG_REMAP_LO		0x410c
++#define PCIE_MISC_UBUS_BAR4_CONFIG_REMAP_HI		0x4110
++/* ... */
++#define PCIE_MISC_UBUS_BAR10_CONFIG_REMAP_LO		0x413c
++#define PCIE_MISC_UBUS_BAR10_CONFIG_REMAP_HI		0x4140
++
++/* AXI priority forwarding - automatic level-based */
++#define PCIE_MISC_TC_QUEUE_TO_QOS_MAP(x)		(0x4160 - (x) * 4)
++/* Defined in quarter-fullness */
++#define  QUEUE_THRESHOLD_34_TO_QOS_MAP_SHIFT		12
++#define  QUEUE_THRESHOLD_23_TO_QOS_MAP_SHIFT		8
++#define  QUEUE_THRESHOLD_12_TO_QOS_MAP_SHIFT		4
++#define  QUEUE_THRESHOLD_01_TO_QOS_MAP_SHIFT		0
++#define  QUEUE_THRESHOLD_MASK				0xf
++
++/* VDM messages indexing TCs to AXI priorities */
++/* Indexes 8-15 */
++#define PCIE_MISC_VDM_PRIORITY_TO_QOS_MAP_HI		0x4164
++/* Indexes 0-7 */
++#define PCIE_MISC_VDM_PRIORITY_TO_QOS_MAP_LO		0x4168
++#define  VDM_PRIORITY_TO_QOS_MAP_SHIFT(x)		(4 * (x))
++#define  VDM_PRIORITY_TO_QOS_MAP_MASK			0xf
++
++#define PCIE_MISC_AXI_INTF_CTRL 0x416C
++#define  AXI_EN_RCLK_QOS_ARRAY_FIX			BIT(13)
++#define  AXI_EN_QOS_UPDATE_TIMING_FIX			BIT(12)
++#define  AXI_DIS_QOS_GATING_IN_MASTER			BIT(11)
++#define  AXI_REQFIFO_EN_QOS_PROPAGATION			BIT(7)
++#define  AXI_BRIDGE_LOW_LATENCY_MODE			BIT(6)
++#define  AXI_MASTER_MAX_OUTSTANDING_REQUESTS_MASK	0x3f
++
++#define PCIE_MISC_AXI_READ_ERROR_DATA	0x4170
++
+ #define PCIE_MSI_INTR2_BASE		0x4500
+ 
+ /* Offsets from INTR2_CPU and MSI_INTR2 BASE offsets */
+@@ -220,6 +313,7 @@ enum pcie_soc_base {
+ 	BCM7425,
+ 	BCM7435,
+ 	BCM7712,
++	BCM2712,
+ };
+ 
+ struct inbound_win {
+@@ -251,7 +345,7 @@ struct brcm_msi {
+ 	struct mutex		lock; /* guards the alloc/free operations */
+ 	u64			target_addr;
+ 	int			irq;
+-	DECLARE_BITMAP(used, BRCM_INT_PCI_MSI_NR);
++	DECLARE_BITMAP(used, 64);
+ 	bool			legacy;
+ 	/* Some chips have MSIs in bits [31..24] of a shared register. */
+ 	int			legacy_shift;
+@@ -285,6 +379,10 @@ struct brcm_pcie {
+ 	bool			ep_wakeup_capable;
+ 	bool			has_phy;
+ 	u8			num_inbound_wins;
++	bool			l1ss;
++	bool			rcb_mps_mode;
++	u32			qos_map;
++	u32			tperst_clk_ms;
+ };
+ 
+ static inline bool is_bmips(const struct brcm_pcie *pcie)
+@@ -303,8 +401,8 @@ static int brcm_pcie_encode_ibar_size(u6
+ 	if (log2_in >= 12 && log2_in <= 15)
+ 		/* Covers 4KB to 32KB (inclusive) */
+ 		return (log2_in - 12) + 0x1c;
+-	else if (log2_in >= 16 && log2_in <= 35)
+-		/* Covers 64KB to 32GB, (inclusive) */
++	else if (log2_in >= 16 && log2_in <= 36)
++		/* Covers 64KB to 64GB, (inclusive) */
+ 		return log2_in - 15;
+ 	/* Something is awry so disable */
+ 	return 0;
+@@ -393,12 +491,43 @@ static int brcm_pcie_set_ssc(struct brcm
+ 	return ssc && pll ? 0 : -EIO;
+ }
+ 
++static void brcm_pcie_munge_pll(struct brcm_pcie *pcie)
++{
++	//print "MDIO block 0x1600 written per Dannys instruction"
++	//tmp = pcie_mdio_write(phyad, &h16&, &h50b9&)
++	//tmp = pcie_mdio_write(phyad, &h17&, &hbd1a&)
++	//tmp = pcie_mdio_write(phyad, &h1b&, &h5030&)
++	//tmp = pcie_mdio_write(phyad, &h1e&, &h0007&)
++
++	u32 tmp;
++	int ret, i;
++	u8 regs[] =  { 0x16,   0x17,   0x18,   0x19,   0x1b,   0x1c,   0x1e };
++	u16 data[] = { 0x50b9, 0xbda1, 0x0094, 0x97b4, 0x5030, 0x5030, 0x0007 };
++
++	ret = brcm_pcie_mdio_write(pcie->base, MDIO_PORT0, SET_ADDR_OFFSET,
++				0x1600);
++	for (i = 0; i < ARRAY_SIZE(regs); i++) {
++		brcm_pcie_mdio_read(pcie->base, MDIO_PORT0, regs[i], &tmp);
++		dev_dbg(pcie->dev, "PCIE MDIO pre_refclk 0x%02x = 0x%04x\n",
++			regs[i], tmp);
++	}
++	for (i = 0; i < ARRAY_SIZE(regs); i++) {
++		brcm_pcie_mdio_write(pcie->base, MDIO_PORT0, regs[i], data[i]);
++		brcm_pcie_mdio_read(pcie->base, MDIO_PORT0, regs[i], &tmp);
++		dev_dbg(pcie->dev, "PCIE MDIO post_refclk 0x%02x = 0x%04x\n",
++			regs[i], tmp);
++	}
++	usleep_range(100, 200);
++}
++
+ /* Limits operation to a specific generation (1, 2, or 3) */
+ static void brcm_pcie_set_gen(struct brcm_pcie *pcie, int gen)
+ {
+ 	u16 lnkctl2 = readw(pcie->base + BRCM_PCIE_CAP_REGS + PCI_EXP_LNKCTL2);
+ 	u32 lnkcap = readl(pcie->base + BRCM_PCIE_CAP_REGS + PCI_EXP_LNKCAP);
+ 
++	dev_info(pcie->dev, "Forcing gen %d\n", pcie->gen);
++
+ 	lnkcap = (lnkcap & ~PCI_EXP_LNKCAP_SLS) | gen;
+ 	writel(lnkcap, pcie->base + BRCM_PCIE_CAP_REGS + PCI_EXP_LNKCAP);
+ 
+@@ -450,6 +579,73 @@ static void brcm_pcie_set_outbound_win(s
+ 	writel(tmp, pcie->base + PCIE_MEM_WIN0_LIMIT_HI(win));
+ }
+ 
++static void brcm_pcie_set_tc_qos(struct brcm_pcie *pcie)
++{
++	int i;
++	u32 reg;
++
++	if (pcie->soc_base != BCM2712)
++		return;
++
++	/* Disable broken QOS forwarding search. Set chicken bits for 2712D0 */
++	reg = readl(pcie->base + PCIE_MISC_AXI_INTF_CTRL);
++	reg &= ~AXI_REQFIFO_EN_QOS_PROPAGATION;
++	reg |= AXI_EN_RCLK_QOS_ARRAY_FIX | AXI_EN_QOS_UPDATE_TIMING_FIX |
++		AXI_DIS_QOS_GATING_IN_MASTER;
++	writel(reg, pcie->base + PCIE_MISC_AXI_INTF_CTRL);
++
++	/*
++	 * If the QOS_UPDATE_TIMING_FIX bit is Reserved-0, then this is a
++	 * 2712C1 chip, or a single-lane RC. Use the best-effort alternative
++	 * which is to partially throttle AXI requests in-flight to the SDC.
++	 */
++	reg = readl(pcie->base + PCIE_MISC_AXI_INTF_CTRL);
++	if (!(reg & AXI_EN_QOS_UPDATE_TIMING_FIX)) {
++		reg &= ~AXI_MASTER_MAX_OUTSTANDING_REQUESTS_MASK;
++		reg |= 15;
++		writel(reg, pcie->base + PCIE_MISC_AXI_INTF_CTRL);
++	}
++
++	/* Disable VDM reception by default - QoS map defaults to 0 */
++	reg = readl(pcie->base + PCIE_MISC_CTRL_1);
++	reg &= ~PCIE_MISC_CTRL_1_EN_VDM_QOS_CONTROL_MASK;
++	writel(reg, pcie->base + PCIE_MISC_CTRL_1);
++
++	if (!of_property_read_u32(pcie->np, "brcm,fifo-qos-map", &pcie->qos_map)) {
++		/*
++		 * Backpressure mode - bottom 4 nibbles are QoS for each
++		 * quartile of FIFO level. Each TC gets the same map, because
++		 * this mode is intended for nonrealtime EPs.
++		 */
++
++		pcie->qos_map &= 0x0000ffff;
++		for (i = 0; i < 8; i++)
++			writel(pcie->qos_map, pcie->base + PCIE_MISC_TC_QUEUE_TO_QOS_MAP(i));
++
++		return;
++	}
++
++	if (!of_property_read_u32(pcie->np, "brcm,vdm-qos-map", &pcie->qos_map)) {
++
++		reg = readl(pcie->base + PCIE_MISC_CTRL_1);
++		reg |= PCIE_MISC_CTRL_1_EN_VDM_QOS_CONTROL_MASK;
++		writel(reg, pcie->base + PCIE_MISC_CTRL_1);
++
++		/* No forwarding means no point separating panic priorities from normal */
++		writel(pcie->qos_map, pcie->base + PCIE_MISC_VDM_PRIORITY_TO_QOS_MAP_LO);
++		writel(pcie->qos_map, pcie->base + PCIE_MISC_VDM_PRIORITY_TO_QOS_MAP_HI);
++
++		/* Match Vendor ID of 0 */
++		writel(0, pcie->base + PCIE_RC_TL_VDM_CTL1);
++		/* Forward VDMs to priority interface - at least the rx counters work */
++		reg = readl(pcie->base + PCIE_RC_TL_VDM_CTL0);
++		reg |= PCIE_RC_TL_VDM_CTL0_VDM_ENABLED_MASK |
++			PCIE_RC_TL_VDM_CTL0_VDM_IGNORETAG_MASK |
++			PCIE_RC_TL_VDM_CTL0_VDM_IGNOREVNDRID_MASK;
++		writel(reg, pcie->base + PCIE_RC_TL_VDM_CTL0);
++	}
++}
++
+ static struct irq_chip brcm_msi_irq_chip = {
+ 	.name            = "BRCM STB PCIe MSI",
+ 	.irq_ack         = irq_chip_ack_parent,
+@@ -458,8 +654,8 @@ static struct irq_chip brcm_msi_irq_chip
+ };
+ 
+ static struct msi_domain_info brcm_msi_domain_info = {
+-	.flags	= MSI_FLAG_USE_DEF_DOM_OPS | MSI_FLAG_USE_DEF_CHIP_OPS |
+-		  MSI_FLAG_NO_AFFINITY | MSI_FLAG_MULTI_PCI_MSI,
++	.flags	= (MSI_FLAG_USE_DEF_DOM_OPS | MSI_FLAG_USE_DEF_CHIP_OPS |
++			   MSI_FLAG_NO_AFFINITY | MSI_FLAG_MULTI_PCI_MSI | MSI_FLAG_PCI_MSIX),
+ 	.chip	= &brcm_msi_irq_chip,
+ };
+ 
+@@ -478,10 +674,23 @@ static void brcm_pcie_msi_isr(struct irq
+ 	status = readl(msi->intr_base + MSI_INT_STATUS);
+ 	status >>= msi->legacy_shift;
+ 
+-	for_each_set_bit(bit, &status, msi->nr) {
+-		int ret;
+-		ret = generic_handle_domain_irq(msi->inner_domain, bit);
+-		if (ret)
++	for_each_set_bit(bit, &status, BRCM_INT_PCI_MSI_NR/*msi->nr*/) {
++		unsigned long virq;
++		bool found = false;
++
++		virq = irq_find_mapping(msi->inner_domain, bit);
++		if (virq) {
++			found = true;
++			dev_dbg(dev, "MSI -> %ld\n", virq);
++			generic_handle_irq(virq);
++		}
++		virq = irq_find_mapping(msi->inner_domain, bit + 32);
++		if (virq) {
++			found = true;
++			dev_dbg(dev, "MSI -> %ld\n", virq);
++			generic_handle_irq(virq);
++		}
++		if (!found)
+ 			dev_dbg(dev, "unexpected MSI\n");
+ 	}
+ 
+@@ -494,13 +703,13 @@ static void brcm_msi_compose_msi_msg(str
+ 
+ 	msg->address_lo = lower_32_bits(msi->target_addr);
+ 	msg->address_hi = upper_32_bits(msi->target_addr);
+-	msg->data = (0xffff & PCIE_MISC_MSI_DATA_CONFIG_VAL_32) | data->hwirq;
++	msg->data = (0xffff & PCIE_MISC_MSI_DATA_CONFIG_VAL_32) | (data->hwirq & 0x1f);
+ }
+ 
+ static void brcm_msi_ack_irq(struct irq_data *data)
+ {
+ 	struct brcm_msi *msi = irq_data_get_irq_chip_data(data);
+-	const int shift_amt = data->hwirq + msi->legacy_shift;
++	const int shift_amt = (data->hwirq & 0x1f) + msi->legacy_shift;
+ 
+ 	writel(1 << shift_amt, msi->intr_base + MSI_INT_CLR);
+ }
+@@ -660,7 +869,7 @@ static int brcm_pcie_enable_msi(struct b
+ 		msi->legacy_shift = 24;
+ 	} else {
+ 		msi->intr_base = msi->base + PCIE_MSI_INTR2_BASE;
+-		msi->nr = BRCM_INT_PCI_MSI_NR;
++		msi->nr = 64; //BRCM_INT_PCI_MSI_NR;
+ 		msi->legacy_shift = 0;
+ 	}
+ 
+@@ -682,6 +891,9 @@ static bool brcm_pcie_rc_mode(struct brc
+ 	void __iomem *base = pcie->base;
+ 	u32 val = readl(base + PCIE_MISC_PCIE_STATUS);
+ 
++	if (pcie->soc_base == BCM2712)
++		return !!FIELD_GET(PCIE_MISC_PCIE_STATUS_PCIE_PORT_MASK_2712, val) | 1; //XXX
++
+ 	return !!FIELD_GET(PCIE_MISC_PCIE_STATUS_PCIE_PORT_MASK, val);
+ }
+ 
+@@ -774,6 +986,21 @@ static int brcm_pcie_bridge_sw_init_set_
+ 	return 0;
+ }
+ 
++static int brcm_pcie_bridge_sw_init_set_2712(struct brcm_pcie *pcie, u32 val)
++{
++	int ret;
++
++	if (WARN_ONCE(!pcie->bridge_reset, "missing bridge reset controller\n"))
++		return -EINVAL;
++
++	if (val)
++		ret = reset_control_assert(pcie->bridge_reset);
++	else
++		ret = reset_control_deassert(pcie->bridge_reset);
++
++	return ret;
++}
++
+ static int brcm_pcie_perst_set_4908(struct brcm_pcie *pcie, u32 val)
+ {
+ 	int ret;
+@@ -804,6 +1031,18 @@ static int brcm_pcie_perst_set_7278(stru
+ 	return 0;
+ }
+ 
++static int brcm_pcie_perst_set_2712(struct brcm_pcie *pcie, u32 val)
++{
++	u32 tmp;
++
++	/* Perst bit has moved and assert value is 0 */
++	tmp = readl(pcie->base + PCIE_MISC_PCIE_CTRL);
++	u32p_replace_bits(&tmp, !val, PCIE_MISC_PCIE_CTRL_PCIE_PERSTB_MASK);
++	writel(tmp, pcie->base +  PCIE_MISC_PCIE_CTRL);
++
++	return 0;
++}
++
+ static int brcm_pcie_perst_set_generic(struct brcm_pcie *pcie, u32 val)
+ {
+ 	u32 tmp;
+@@ -815,6 +1054,8 @@ static int brcm_pcie_perst_set_generic(s
+ 	return 0;
+ }
+ 
++
++#if 0
+ static void add_inbound_win(struct inbound_win *b, u8 *count, u64 size,
+ 			    u64 cpu_addr, u64 pci_offset)
+ {
+@@ -1017,17 +1258,137 @@ static void set_inbound_win_registers(st
+ 		}
+ 	}
+ }
++#endif
++
++static int brcm_pcie_get_rc_bar2_size_and_offset(struct brcm_pcie *pcie,
++							u64 *rc_bar2_size,
++							u64 *rc_bar2_offset)
++{
++	struct pci_host_bridge *bridge = pci_host_bridge_from_priv(pcie);
++	struct resource_entry *entry;
++	struct device *dev = pcie->dev;
++	u64 lowest_pcie_addr = ~(u64)0;
++	int ret, i = 0;
++	u64 size = 0;
++
++	resource_list_for_each_entry(entry, &bridge->dma_ranges) {
++		u64 pcie_beg = entry->res->start - entry->offset;
++
++		size += entry->res->end - entry->res->start + 1;
++		if (pcie_beg < lowest_pcie_addr)
++			lowest_pcie_addr = pcie_beg;
++		if (pcie->soc_base == BCM2711 || pcie->soc_base == BCM2712)
++			break; // Only consider the first entry
++	}
++
++	if (lowest_pcie_addr == ~(u64)0) {
++		dev_err(dev, "DT node has no dma-ranges\n");
++		return -EINVAL;
++	}
++
++	ret = of_property_read_variable_u64_array(pcie->np, "brcm,scb-sizes", pcie->memc_size, 1,
++						  PCIE_BRCM_MAX_MEMC);
++
++	if (ret <= 0) {
++		/* Make an educated guess */
++		pcie->num_memc = 1;
++		pcie->memc_size[0] = 1ULL << fls64(size - 1);
++	} else {
++		pcie->num_memc = ret;
++	}
++
++	/* Each memc is viewed through a "port" that is a power of 2 */
++	for (i = 0, size = 0; i < pcie->num_memc; i++)
++		size += pcie->memc_size[i];
++
++	/* System memory starts at this address in PCIe-space */
++	*rc_bar2_offset = lowest_pcie_addr;
++	/* The sum of all memc views must also be a power of 2 */
++	*rc_bar2_size = 1ULL << fls64(size - 1);
++
++	/*
++	 * We validate the inbound memory view even though we should trust
++	 * whatever the device-tree provides. This is because of an HW issue on
++	 * early Raspberry Pi 4's revisions (bcm2711). It turns out its
++	 * firmware has to dynamically edit dma-ranges due to a bug on the
++	 * PCIe controller integration, which prohibits any access above the
++	 * lower 3GB of memory. Given this, we decided to keep the dma-ranges
++	 * in check, avoiding hard to debug device-tree related issues in the
++	 * future:
++	 *
++	 * The PCIe host controller by design must set the inbound viewport to
++	 * be a contiguous arrangement of all of the system's memory.  In
++	 * addition, its size mut be a power of two.  To further complicate
++	 * matters, the viewport must start on a pcie-address that is aligned
++	 * on a multiple of its size.  If a portion of the viewport does not
++	 * represent system memory -- e.g. 3GB of memory requires a 4GB
++	 * viewport -- we can map the outbound memory in or after 3GB and even
++	 * though the viewport will overlap the outbound memory the controller
++	 * will know to send outbound memory downstream and everything else
++	 * upstream.
++	 *
++	 * For example:
++	 *
++	 * - The best-case scenario, memory up to 3GB, is to place the inbound
++	 *   region in the first 4GB of pcie-space, as some legacy devices can
++	 *   only address 32bits. We would also like to put the MSI under 4GB
++	 *   as well, since some devices require a 32bit MSI target address.
++	 *
++	 * - If the system memory is 4GB or larger we cannot start the inbound
++	 *   region at location 0 (since we have to allow some space for
++	 *   outbound memory @ 3GB). So instead it will  start at the 1x
++	 *   multiple of its size
++	 */
++	if (!*rc_bar2_size || (*rc_bar2_offset & (*rc_bar2_size - 1)) ||
++	    (*rc_bar2_offset < SZ_4G && *rc_bar2_offset > SZ_2G)) {
++		dev_err(dev, "Invalid rc_bar2_offset/size: size 0x%llx, off 0x%llx\n",
++			*rc_bar2_size, *rc_bar2_offset);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++static int brcm_pcie_get_rc_bar_n(struct brcm_pcie *pcie,
++				  int idx,
++				  u64 *rc_bar_cpu,
++				  u64 *rc_bar_size,
++				  u64 *rc_bar_pci)
++{
++	struct pci_host_bridge *bridge = pci_host_bridge_from_priv(pcie);
++	struct resource_entry *entry;
++	int i = 0;
++
++	resource_list_for_each_entry(entry, &bridge->dma_ranges) {
++		if (i == idx) {
++			*rc_bar_cpu  = entry->res->start;
++			*rc_bar_size = entry->res->end - entry->res->start + 1;
++			*rc_bar_pci = entry->res->start - entry->offset;
++			return 0;
++		}
++
++		i++;
++	}
++
++	return -EINVAL;
++}
+ 
+ static int brcm_pcie_setup(struct brcm_pcie *pcie)
+ {
++#if 0
+ 	struct inbound_win inbound_wins[PCIE_BRCM_MAX_INBOUND_WINS];
++#endif
++	u64 rc_bar2_offset, rc_bar2_size;
+ 	void __iomem *base = pcie->base;
+ 	struct pci_host_bridge *bridge;
+ 	struct resource_entry *entry;
+ 	u32 tmp, burst, aspm_support;
+ 	u8 num_out_wins = 0;
++#if 0
+ 	int num_inbound_wins = 0;
++#endif
+ 	int memc, ret;
++	int count, i;
+ 
+ 	/* Reset the bridge */
+ 	ret = pcie->bridge_sw_init_set(pcie, 1);
+@@ -1059,6 +1420,17 @@ static int brcm_pcie_setup(struct brcm_p
+ 	/* Wait for SerDes to be stable */
+ 	usleep_range(100, 200);
+ 
++	if (pcie->soc_base == BCM2712) {
++		/* Allow a 54MHz (xosc) refclk source */
++		brcm_pcie_munge_pll(pcie);
++		/* Fix for L1SS errata */
++		tmp = readl(base + PCIE_RC_PL_PHY_CTL_15);
++		tmp &= ~PCIE_RC_PL_PHY_CTL_15_PM_CLK_PERIOD_MASK;
++		/* PM clock period is 18.52ns (round down) */
++		tmp |= 0x12;
++		writel(tmp, base + PCIE_RC_PL_PHY_CTL_15);
++	}
++
+ 	/*
+ 	 * SCB_MAX_BURST_SIZE is a two bit field.  For GENERIC chips it
+ 	 * is encoded as 0=128, 1=256, 2=512, 3=Rsvd, for BCM7278 it
+@@ -1068,6 +1440,8 @@ static int brcm_pcie_setup(struct brcm_p
+ 		burst = 0x1; /* 256 bytes */
+ 	else if (pcie->soc_base == BCM2711)
+ 		burst = 0x0; /* 128 bytes */
++	else if (pcie->soc_base == BCM2712)
++		burst = 0x1; /* 128 bytes */
+ 	else if (pcie->soc_base == BCM7278)
+ 		burst = 0x3; /* 512 bytes */
+ 	else
+@@ -1075,27 +1449,38 @@ static int brcm_pcie_setup(struct brcm_p
+ 
+ 	/*
+ 	 * Set SCB_MAX_BURST_SIZE, CFG_READ_UR_MODE, SCB_ACCESS_EN,
+-	 * RCB_MPS_MODE, RCB_64B_MODE
++	 * RCB_MPS_MODE
+ 	 */
+ 	tmp = readl(base + PCIE_MISC_MISC_CTRL);
+ 	u32p_replace_bits(&tmp, 1, PCIE_MISC_MISC_CTRL_SCB_ACCESS_EN_MASK);
+ 	u32p_replace_bits(&tmp, 1, PCIE_MISC_MISC_CTRL_CFG_READ_UR_MODE_MASK);
+ 	u32p_replace_bits(&tmp, burst, PCIE_MISC_MISC_CTRL_MAX_BURST_SIZE_MASK);
+-	u32p_replace_bits(&tmp, 1, PCIE_MISC_MISC_CTRL_PCIE_RCB_MPS_MODE_MASK);
+-	u32p_replace_bits(&tmp, 1, PCIE_MISC_MISC_CTRL_PCIE_RCB_64B_MODE_MASK);
++	if (pcie->rcb_mps_mode)
++		u32p_replace_bits(&tmp, 1, PCIE_MISC_MISC_CTRL_PCIE_RCB_MPS_MODE_MASK);
+ 	writel(tmp, base + PCIE_MISC_MISC_CTRL);
+ 
+-	num_inbound_wins = brcm_pcie_get_inbound_wins(pcie, inbound_wins);
+-	if (num_inbound_wins < 0)
+-		return num_inbound_wins;
++	brcm_pcie_set_tc_qos(pcie);
+ 
+-	set_inbound_win_registers(pcie, inbound_wins, num_inbound_wins);
++	ret = brcm_pcie_get_rc_bar2_size_and_offset(pcie, &rc_bar2_size,
++						    &rc_bar2_offset);
++	if (ret)
++		return ret;
++
++	tmp = lower_32_bits(rc_bar2_offset);
++	u32p_replace_bits(&tmp, brcm_pcie_encode_ibar_size(rc_bar2_size),
++			  PCIE_MISC_RC_BAR2_CONFIG_LO_SIZE_MASK);
++	writel(tmp, base + PCIE_MISC_RC_BAR2_CONFIG_LO);
++	writel(upper_32_bits(rc_bar2_offset),
++	       base + PCIE_MISC_RC_BAR2_CONFIG_HI);
+ 
+ 	if (!brcm_pcie_rc_mode(pcie)) {
+ 		dev_err(pcie->dev, "PCIe RC controller misconfigured as Endpoint\n");
+ 		return -EINVAL;
+ 	}
+ 
++	tmp = readl(base + PCIE_MISC_UBUS_BAR2_CONFIG_REMAP);
++	u32p_replace_bits(&tmp, 1, PCIE_MISC_UBUS_BAR2_CONFIG_REMAP_ACCESS_ENABLE_MASK);
++	writel(tmp, base + PCIE_MISC_UBUS_BAR2_CONFIG_REMAP);
+ 	tmp = readl(base + PCIE_MISC_MISC_CTRL);
+ 	for (memc = 0; memc < pcie->num_memc; memc++) {
+ 		u32 scb_size_val = ilog2(pcie->memc_size[memc]) - 15;
+@@ -1109,6 +1494,29 @@ static int brcm_pcie_setup(struct brcm_p
+ 	}
+ 	writel(tmp, base + PCIE_MISC_MISC_CTRL);
+ 
++	if (pcie->soc_base == BCM2712) {
++		/* Suppress AXI error responses and return 1s for read failures */
++		tmp = readl(base + PCIE_MISC_UBUS_CTRL);
++		u32p_replace_bits(&tmp, 1, PCIE_MISC_UBUS_CTRL_UBUS_PCIE_REPLY_ERR_DIS_MASK);
++		u32p_replace_bits(&tmp, 1, PCIE_MISC_UBUS_CTRL_UBUS_PCIE_REPLY_DECERR_DIS_MASK);
++		writel(tmp, base + PCIE_MISC_UBUS_CTRL);
++		writel(0xffffffff, base + PCIE_MISC_AXI_READ_ERROR_DATA);
++
++		/*
++		 * Adjust timeouts. The UBUS timeout also affects CRS
++		 * completion retries, as the request will get terminated if
++		 * either timeout expires, so both have to be a large value
++		 * (in clocks of 750MHz).
++		 * Set UBUS timeout to 250ms, then set RC config retry timeout
++		 * to be ~240ms.
++		 *
++		 * Setting CRSVis=1 will stop the core from blocking on a CRS
++		 * response, but does require the device to be well-behaved...
++		 */
++		writel(0xB2D0000, base + PCIE_MISC_UBUS_TIMEOUT);
++		writel(0xABA0000, base + PCIE_MISC_RC_CONFIG_RETRY_TIMEOUT);
++	}
++
+ 	/*
+ 	 * We ideally want the MSI target address to be located in the 32bit
+ 	 * addressable memory area. Some devices might depend on it. This is
+@@ -1116,12 +1524,20 @@ static int brcm_pcie_setup(struct brcm_p
+ 	 * 4GB or when the inbound area is smaller than 4GB (taking into
+ 	 * account the rounding-up we're forced to perform).
+ 	 */
+-	if (inbound_wins[2].pci_offset >= SZ_4G ||
+-	    (inbound_wins[2].size + inbound_wins[2].pci_offset) < SZ_4G)
++	if (rc_bar2_offset >= SZ_4G || (rc_bar2_size + rc_bar2_offset) < SZ_4G)
+ 		pcie->msi_target_addr = BRCM_MSI_TARGET_ADDR_LT_4GB;
+ 	else
+ 		pcie->msi_target_addr = BRCM_MSI_TARGET_ADDR_GT_4GB;
+ 
++	/* disable the PCIe->GISB memory window (RC_BAR1) */
++	tmp = readl(base + PCIE_MISC_RC_BAR1_CONFIG_LO);
++	tmp &= ~PCIE_MISC_RC_BAR1_CONFIG_LO_SIZE_MASK;
++	writel(tmp, base + PCIE_MISC_RC_BAR1_CONFIG_LO);
++
++	/* disable the PCIe->SCB memory window (RC_BAR3) */
++	tmp = readl(base + PCIE_MISC_RC_BAR3_CONFIG_LO);
++	tmp &= ~PCIE_MISC_RC_BAR3_CONFIG_LO_SIZE_MASK;
++	writel(tmp, base + PCIE_MISC_RC_BAR3_CONFIG_LO);
+ 
+ 	/* Don't advertise L0s capability if 'aspm-no-l0s' */
+ 	aspm_support = PCIE_LINK_STATE_L1;
+@@ -1132,6 +1548,33 @@ static int brcm_pcie_setup(struct brcm_p
+ 		PCIE_RC_CFG_PRIV1_LINK_CAPABILITY_ASPM_SUPPORT_MASK);
+ 	writel(tmp, base + PCIE_RC_CFG_PRIV1_LINK_CAPABILITY);
+ 
++	/* program additional inbound windows (RC_BAR4..RC_BAR10) */
++	count = (pcie->soc_base == BCM2712) ? 7 : 0;
++	for (i = 0; i < count; i++) {
++		u64 bar_cpu, bar_size, bar_pci;
++
++		ret = brcm_pcie_get_rc_bar_n(pcie, 1 + i, &bar_cpu, &bar_size,
++					     &bar_pci);
++		if (ret)
++			break;
++
++		tmp = lower_32_bits(bar_pci);
++		u32p_replace_bits(&tmp, brcm_pcie_encode_ibar_size(bar_size),
++				  PCIE_MISC_RC_BAR_CONFIG_LO_SIZE_MASK);
++		writel(tmp, base + PCIE_MISC_RC_BAR4_CONFIG_LO + i * 8);
++		writel(upper_32_bits(bar_pci),
++		       base + PCIE_MISC_RC_BAR4_CONFIG_HI + i * 8);
++
++		tmp = upper_32_bits(bar_cpu) &
++			PCIE_MISC_UBUS_BAR_CONFIG_REMAP_HI_MASK;
++		writel(tmp,
++		       base + PCIE_MISC_UBUS_BAR4_CONFIG_REMAP_HI + i * 8);
++		tmp = lower_32_bits(bar_cpu) &
++			PCIE_MISC_UBUS_BAR_CONFIG_REMAP_LO_MASK;
++		writel(tmp | PCIE_MISC_UBUS_BAR_CONFIG_REMAP_ENABLE,
++		       base + PCIE_MISC_UBUS_BAR4_CONFIG_REMAP_LO + i * 8);
++	}
++
+ 	/*
+ 	 * For config space accesses on the RC, show the right class for
+ 	 * a PCIe-PCIe bridge (the default setting is to be EP mode).
+@@ -1181,6 +1624,87 @@ static int brcm_pcie_setup(struct brcm_p
+ 	return 0;
+ }
+ 
++/*
++ * This extends the timeout period for an access to an internal bus.  This
++ * access timeout may occur during L1SS sleep periods, even without the
++ * presence of a PCIe access.
++ */
++static void brcm_extend_rbus_timeout(struct brcm_pcie *pcie)
++{
++	/* TIMEOUT register is two registers before RGR1_SW_INIT_1 */
++	const unsigned int REG_OFFSET = PCIE_RGR1_SW_INIT_1(pcie) - 8;
++	u32 timeout_us = 4000000; /* 4 seconds, our setting for L1SS */
++
++	/* 7712 does not have this (RGR1) timer */
++	if (pcie->soc_base == BCM7712 || pcie->soc_base == BCM2712)
++		return;
++
++	/* Each unit in timeout register is 1/216,000,000 seconds */
++	writel(216 * timeout_us, pcie->base + REG_OFFSET);
++}
++
++static void brcm_config_clkreq(struct brcm_pcie *pcie)
++{
++	static const char err_msg[] = "invalid 'brcm,clkreq-mode' DT string\n";
++	const char *mode = "default";
++	u32 clkreq_cntl;
++	int ret, tmp;
++
++	ret = of_property_read_string(pcie->np, "brcm,clkreq-mode", &mode);
++	if (ret && ret != -EINVAL) {
++		dev_err(pcie->dev, err_msg);
++		mode = "safe";
++	}
++
++	/* Start out assuming safe mode (both mode bits cleared) */
++	clkreq_cntl = readl(pcie->base + HARD_DEBUG(pcie));
++	clkreq_cntl &= ~PCIE_CLKREQ_MASK;
++
++	if (strcmp(mode, "no-l1ss") == 0) {
++		/*
++		 * "no-l1ss" -- Provides Clock Power Management, L0s, and
++		 * L1, but cannot provide L1 substate (L1SS) power
++		 * savings. If the downstream device connected to the RC is
++		 * L1SS capable AND the OS enables L1SS, all PCIe traffic
++		 * may abruptly halt, potentially hanging the system.
++		 */
++		clkreq_cntl |= PCIE_MISC_HARD_PCIE_HARD_DEBUG_CLKREQ_DEBUG_ENABLE_MASK;
++		/*
++		 * We want to un-advertise L1 substates because if the OS
++		 * tries to configure the controller into using L1 substate
++		 * power savings it may fail or hang when the RC HW is in
++		 * "no-l1ss" mode.
++		 */
++		tmp = readl(pcie->base + PCIE_RC_CFG_PRIV1_ROOT_CAP);
++		u32p_replace_bits(&tmp, 2, PCIE_RC_CFG_PRIV1_ROOT_CAP_L1SS_MODE_MASK);
++		writel(tmp, pcie->base + PCIE_RC_CFG_PRIV1_ROOT_CAP);
++
++	} else if (strcmp(mode, "default") == 0) {
++		/*
++		 * "default" -- Provides L0s, L1, and L1SS, but not
++		 * compliant to provide Clock Power Management;
++		 * specifically, may not be able to meet the Tclron max
++		 * timing of 400ns as specified in "Dynamic Clock Control",
++		 * section 3.2.5.2.2 of the PCIe spec.  This situation is
++		 * atypical and should happen only with older devices.
++		 */
++		clkreq_cntl |= PCIE_MISC_HARD_PCIE_HARD_DEBUG_L1SS_ENABLE_MASK;
++		brcm_extend_rbus_timeout(pcie);
++
++	} else {
++		/*
++		 * "safe" -- No power savings; refclk is driven by RC
++		 * unconditionally.
++		 */
++		if (strcmp(mode, "safe") != 0)
++			dev_err(pcie->dev, err_msg);
++		mode = "safe";
++	}
++	writel(clkreq_cntl, pcie->base + HARD_DEBUG(pcie));
++
++	dev_info(pcie->dev, "clkreq-mode set to %s\n", mode);
++}
++
+ static int brcm_pcie_start_link(struct brcm_pcie *pcie)
+ {
+ 	struct device *dev = pcie->dev;
+@@ -1188,12 +1712,31 @@ static int brcm_pcie_start_link(struct b
+ 	u16 nlw, cls, lnksta;
+ 	bool ssc_good = false;
+ 	u32 tmp;
++	u16 tmp16;
+ 	int ret, i;
+ 
+ 	/* Unassert the fundamental reset */
+-	ret = pcie->perst_set(pcie, 0);
+-	if (ret)
+-		return ret;
++	if (pcie->tperst_clk_ms) {
++		/*
++		 * Increase Tperst_clk time by forcing PERST# output low while
++		 * the internal reset is released, so the PLL generates stable
++		 * refclk output further in advance of PERST# deassertion.
++		 */
++		tmp = readl(base + HARD_DEBUG(pcie));
++		u32p_replace_bits(&tmp, 1, PCIE_MISC_HARD_PCIE_HARD_DEBUG_PERST_ASSERT_MASK);
++		writel(tmp, base + HARD_DEBUG(pcie));
++
++		pcie->perst_set(pcie, 0);
++		msleep(pcie->tperst_clk_ms);
++
++		tmp = readl(base + HARD_DEBUG(pcie));
++		u32p_replace_bits(&tmp, 0, PCIE_MISC_HARD_PCIE_HARD_DEBUG_PERST_ASSERT_MASK);
++		writel(tmp, base + HARD_DEBUG(pcie));
++	} else {
++		ret = pcie->perst_set(pcie, 0);
++		if (ret)
++			return ret;
++	}
+ 
+ 	/*
+ 	 * Wait for 100ms after PERST# deassertion; see PCIe CEM specification
+@@ -1214,6 +1757,8 @@ static int brcm_pcie_start_link(struct b
+ 		return -ENODEV;
+ 	}
+ 
++	brcm_config_clkreq(pcie);
++
+ 	if (pcie->gen)
+ 		brcm_pcie_set_gen(pcie, pcie->gen);
+ 
+@@ -1233,13 +1778,15 @@ static int brcm_pcie_start_link(struct b
+ 		 ssc_good ? "(SSC)" : "(!SSC)");
+ 
+ 	/*
+-	 * Refclk from RC should be gated with CLKREQ# input when ASPM L0s,L1
+-	 * is enabled => setting the CLKREQ_DEBUG_ENABLE field to 1.
++	 * RootCtl bits are reset by perst_n, which undoes pci_enable_crs()
++	 * called prior to pci_add_new_bus() during probe. Re-enable here.
+ 	 */
+-	tmp = readl(base + PCIE_MISC_HARD_PCIE_HARD_DEBUG);
+-	tmp |= PCIE_MISC_HARD_PCIE_HARD_DEBUG_CLKREQ_DEBUG_ENABLE_MASK;
+-	writel(tmp, base + PCIE_MISC_HARD_PCIE_HARD_DEBUG);
+-
++	tmp16 = readw(base + BRCM_PCIE_CAP_REGS + PCI_EXP_RTCAP);
++	if (tmp16 & PCI_EXP_RTCAP_CRSVIS) {
++		tmp16 = readw(base + BRCM_PCIE_CAP_REGS + PCI_EXP_RTCTL);
++		u16p_replace_bits(&tmp16, 1, PCI_EXP_RTCTL_CRSSVE);
++		writew(tmp16, base + BRCM_PCIE_CAP_REGS + PCI_EXP_RTCTL);
++	}
+ 	return 0;
+ }
+ 
+@@ -1413,6 +1960,12 @@ static int brcm_pcie_turn_off(struct brc
+ 	u32p_replace_bits(&tmp, 1, PCIE_MISC_HARD_PCIE_HARD_DEBUG_SERDES_IDDQ_MASK);
+ 	writel(tmp, base + HARD_DEBUG(pcie));
+ 
++	/*
++	 * Shutting down this bridge on pcie1 means accesses to rescal block
++	 * will hang the chip if another RC wants to assert/deassert rescal.
++	 */
++	if (pcie->soc_base == BCM2712)
++		return 0;
+ 	/* Shutdown PCIe bridge */
+ 	ret = pcie->bridge_sw_init_set(pcie, 1);
+ 
+@@ -1608,6 +2161,13 @@ static const int pcie_offsets_bcm7712[]
+ 	[PCIE_INTR2_CPU_BASE]	= 0x4400,
+ };
+ 
++static const int pcie_offsets_bcm2712[] = {
++	[EXT_CFG_INDEX]		= 0x9000,
++	[EXT_CFG_DATA]		= 0x9004,
++	[PCIE_HARD_DEBUG]	= 0x4304,
++	[PCIE_INTR2_CPU_BASE]	= 0x4400,
++};
++
+ static const struct pcie_cfg_data generic_cfg = {
+ 	.offsets	= pcie_offsets,
+ 	.soc_base	= GENERIC,
+@@ -1673,6 +2233,13 @@ static const struct pcie_cfg_data bcm771
+ 	.num_inbound_wins = 10,
+ };
+ 
++static const struct pcie_cfg_data bcm2712_cfg = {
++	.offsets	= pcie_offsets_bcm2712,
++	.perst_set	= brcm_pcie_perst_set_2712,
++	.bridge_sw_init_set = brcm_pcie_bridge_sw_init_set_2712,
++	.soc_base	= BCM2712,
++};
++
+ static const struct of_device_id brcm_pcie_match[] = {
+ 	{ .compatible = "brcm,bcm2711-pcie", .data = &bcm2711_cfg },
+ 	{ .compatible = "brcm,bcm4908-pcie", .data = &bcm4908_cfg },
+@@ -1683,6 +2250,7 @@ static const struct of_device_id brcm_pc
+ 	{ .compatible = "brcm,bcm7435-pcie", .data = &bcm7435_cfg },
+ 	{ .compatible = "brcm,bcm7445-pcie", .data = &generic_cfg },
+ 	{ .compatible = "brcm,bcm7712-pcie", .data = &bcm7712_cfg },
++	{ .compatible = "brcm,bcm2712-pcie", .data = &bcm2712_cfg },
+ 	{},
+ };
+ 
+@@ -1742,6 +2310,9 @@ static int brcm_pcie_probe(struct platfo
+ 	pcie->gen = (ret < 0) ? 0 : ret;
+ 
+ 	pcie->ssc = of_property_read_bool(np, "brcm,enable-ssc");
++	pcie->l1ss = of_property_read_bool(np, "brcm,enable-l1ss");
++	pcie->rcb_mps_mode = of_property_read_bool(np, "brcm,enable-mps-rcb");
++	of_property_read_u32(np, "brcm,tperst-clk-ms", &pcie->tperst_clk_ms);
+ 
+ 	pcie->rescal = devm_reset_control_get_optional_shared(&pdev->dev, "rescal");
+ 	if (IS_ERR(pcie->rescal))
+@@ -1815,6 +2386,33 @@ static int brcm_pcie_probe(struct platfo
+ 			dev_err(pcie->dev, "probe of internal MSI failed");
+ 			goto fail;
+ 		}
++	} else if (pci_msi_enabled() && msi_np != pcie->np) {
++		/* Use RC_BAR1 for MIP access */
++		u64 msi_pci_addr;
++		u64 msi_phys_addr;
++
++		if (of_property_read_u64(msi_np, "brcm,msi-pci-addr", &msi_pci_addr)) {
++			dev_err(pcie->dev, "Unable to find MSI PCI address\n");
++			ret = -EINVAL;
++			goto fail;
++		}
++
++		if (of_property_read_u64(msi_np, "reg", &msi_phys_addr)) {
++			dev_err(pcie->dev, "Unable to find MSI physical address\n");
++			ret = -EINVAL;
++			goto fail;
++		}
++
++		writel(lower_32_bits(msi_pci_addr) | brcm_pcie_encode_ibar_size(0x1000),
++		       pcie->base + PCIE_MISC_RC_BAR1_CONFIG_LO);
++		writel(upper_32_bits(msi_pci_addr),
++		       pcie->base + PCIE_MISC_RC_BAR1_CONFIG_HI);
++
++		writel(lower_32_bits(msi_phys_addr) |
++		       PCIE_MISC_UBUS_BAR1_CONFIG_REMAP_ACCESS_ENABLE_MASK,
++		       pcie->base + PCIE_MISC_UBUS_BAR1_CONFIG_REMAP);
++		writel(upper_32_bits(msi_phys_addr),
++		       pcie->base + PCIE_MISC_UBUS_BAR1_CONFIG_REMAP_HI);
+ 	}
+ 
+ 	bridge->ops = pcie->soc_base == BCM7425 ? &brcm7425_pcie_ops : &brcm_pcie_ops;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0216-staging-vc04_services-Add-additional-unpacked-raw-fo.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0216-staging-vc04_services-Add-additional-unpacked-raw-fo.patch
new file mode 100644
index 00000000..08a456b9
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0216-staging-vc04_services-Add-additional-unpacked-raw-fo.patch
@@ -0,0 +1,51 @@
+From adb1d409530c0cfe6560e280a93ab8eff4439b5a Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 7 Jan 2021 10:43:20 +0000
+Subject: [PATCH 216/697] staging/vc04_services: Add additional unpacked raw
+ formats
+
+Support has been added for the unpacked (16bpp) versions of
+the MIPI raw 10, 12, and 14 formats, so add the 4CCs for them.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../vc04_services/vchiq-mmal/mmal-encodings.h | 22 +++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h
+@@ -102,12 +102,34 @@
+ #define MMAL_ENCODING_BAYER_SGRBG16    MMAL_FOURCC('G', 'R', '1', '6')
+ #define MMAL_ENCODING_BAYER_SRGGB16    MMAL_FOURCC('R', 'G', '1', '6')
+ 
++/* 10 bit per pixel unpacked (16bit) Bayer formats. */
++#define MMAL_ENCODING_BAYER_SBGGR10    MMAL_FOURCC('B', 'G', '1', '0')
++#define MMAL_ENCODING_BAYER_SGRBG10    MMAL_FOURCC('B', 'A', '1', '0')
++#define MMAL_ENCODING_BAYER_SGBRG10    MMAL_FOURCC('G', 'B', '1', '0')
++#define MMAL_ENCODING_BAYER_SRGGB10    MMAL_FOURCC('R', 'G', '1', '0')
++
++/* 12 bit per pixel unpacked (16bit) Bayer formats */
++#define MMAL_ENCODING_BAYER_SBGGR12    MMAL_FOURCC('B', 'G', '1', '2')
++#define MMAL_ENCODING_BAYER_SGRBG12    MMAL_FOURCC('B', 'A', '1', '2')
++#define MMAL_ENCODING_BAYER_SGBRG12    MMAL_FOURCC('G', 'B', '1', '2')
++#define MMAL_ENCODING_BAYER_SRGGB12    MMAL_FOURCC('R', 'G', '1', '2')
++
++/* 14 bit per pixel unpacked (16bit) Bayer formats */
++#define MMAL_ENCODING_BAYER_SBGGR14    MMAL_FOURCC('B', 'G', '1', '4')
++#define MMAL_ENCODING_BAYER_SGBRG14    MMAL_FOURCC('G', 'B', '1', '4')
++#define MMAL_ENCODING_BAYER_SGRBG14    MMAL_FOURCC('G', 'R', '1', '4')
++#define MMAL_ENCODING_BAYER_SRGGB14    MMAL_FOURCC('R', 'G', '1', '4')
++
+ /* MIPI packed monochrome images */
+ #define MMAL_ENCODING_GREY    MMAL_FOURCC('G', 'R', 'E', 'Y')
+ #define MMAL_ENCODING_Y10P    MMAL_FOURCC('Y', '1', '0', 'P')
+ #define MMAL_ENCODING_Y12P    MMAL_FOURCC('Y', '1', '2', 'P')
+ #define MMAL_ENCODING_Y14P    MMAL_FOURCC('Y', '1', '4', 'P')
+ #define MMAL_ENCODING_Y16     MMAL_FOURCC('Y', '1', '6', ' ')
++/* Unpacked monochrome formats (16bit per sample, but only N LSBs used) */
++#define MMAL_ENCODING_Y10     MMAL_FOURCC('Y', '1', '0', ' ')
++#define MMAL_ENCODING_Y12     MMAL_FOURCC('Y', '1', '2', ' ')
++#define MMAL_ENCODING_Y14     MMAL_FOURCC('Y', '1', '4', ' ')
+ 
+ /** An EGL image handle
+  */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0217-uapi-bcm2835-isp-Add-colour-denoise-configuration.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0217-uapi-bcm2835-isp-Add-colour-denoise-configuration.patch
new file mode 100644
index 00000000..b4ca9a78
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0217-uapi-bcm2835-isp-Add-colour-denoise-configuration.patch
@@ -0,0 +1,56 @@
+From d7ea768e2b1426c4bb88d138c2b5eeddd239591e Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Thu, 14 Jan 2021 09:18:42 +0000
+Subject: [PATCH 217/697] uapi: bcm2835-isp: Add colour denoise configuration
+
+Add a configuration structure for colour denoise to the bcm2835_isp
+driver.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ include/uapi/linux/bcm2835-isp.h | 27 +++++++++++++++++++++++++++
+ 1 file changed, 27 insertions(+)
+
+--- a/include/uapi/linux/bcm2835-isp.h
++++ b/include/uapi/linux/bcm2835-isp.h
+@@ -31,6 +31,8 @@
+ 				(V4L2_CID_USER_BCM2835_ISP_BASE + 0x0007)
+ #define V4L2_CID_USER_BCM2835_ISP_DPC		\
+ 				(V4L2_CID_USER_BCM2835_ISP_BASE + 0x0008)
++#define V4L2_CID_USER_BCM2835_ISP_CDN \
++				(V4L2_CID_USER_BCM2835_ISP_BASE + 0x0009)
+ 
+ /*
+  * All structs below are directly mapped onto the equivalent structs in
+@@ -176,6 +178,31 @@ struct bcm2835_isp_gamma {
+ };
+ 
+ /**
++ * enum bcm2835_isp_cdn_mode - Mode of operation for colour denoise.
++ *
++ * @CDN_MODE_FAST:		Fast (but lower quality) colour denoise
++ *				algorithm, typically used for video recording.
++ * @CDN_HIGH_QUALITY:		High quality (but slower) colour denoise
++ *				algorithm, typically used for stills capture.
++ */
++enum bcm2835_isp_cdn_mode {
++	CDN_MODE_FAST = 0,
++	CDN_MODE_HIGH_QUALITY = 1,
++};
++
++/**
++ * struct bcm2835_isp_cdn - Colour denoise parameters set with the
++ *			    V4L2_CID_USER_BCM2835_ISP_CDN ctrl.
++ *
++ * @enabled:	Enable colour denoise.
++ * @mode:	Colour denoise operating mode (see enum &bcm2835_isp_cdn_mode)
++ */
++struct bcm2835_isp_cdn {
++	__u32 enabled;
++	__u32 mode;
++};
++
++/**
+  * struct bcm2835_isp_denoise - Denoise parameters set with the
+  *				V4L2_CID_USER_BCM2835_ISP_DENOISE ctrl.
+  *
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0218-spi-bcm2835-Workaround-fix-for-zero-length-transfers.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0218-spi-bcm2835-Workaround-fix-for-zero-length-transfers.patch
new file mode 100644
index 00000000..96d21be8
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0218-spi-bcm2835-Workaround-fix-for-zero-length-transfers.patch
@@ -0,0 +1,50 @@
+From 4c3b008d34ce36a32f9e85bdb253db0c3f40e2d5 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 28 Jan 2021 11:30:04 +0000
+Subject: [PATCH 218/697] spi: bcm2835: Workaround/fix for zero-length
+ transfers
+
+A relatively recent commit ([1]) contained optimisation for the PIO
+SPI FIFO-filling functions. The commit message includes the phrase
+"[t]he blind and counted loops are always called with nonzero count".
+This is technically true, but it is still possible for count to become
+zero before the loop is entered - if tfr->len is zero. Moving the loop
+exit condition to the end of the loop saves a few cycles, but results
+in a near-infinite loop should the revised count be zero on entry.
+
+Strangely, zero-lengthed transfers aren't filtered by the SPI framework
+and, even more strangely, the Python3 spidev library is triggering them
+for no obvious reason.
+
+Avoid the problem completely by bailing out of the main transfer
+function early if trf->len is zero, although there may be a case for
+moving the mitigation into the framework.
+
+See: https://github.com/raspberrypi/linux/issues/4100
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+[1] 26751de25d25 ("spi: bcm2835: Micro-optimise FIFO loops")
+---
+ drivers/spi/spi-bcm2835.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/spi/spi-bcm2835.c
++++ b/drivers/spi/spi-bcm2835.c
+@@ -1059,6 +1059,16 @@ static int bcm2835_spi_transfer_one(stru
+ 	unsigned long hz_per_byte, byte_limit;
+ 	u32 cs = target->prepare_cs;
+ 
++	if (unlikely(!tfr->len)) {
++		static int warned;
++
++		if (!warned)
++			dev_warn(&spi->dev,
++				 "zero-length SPI transfer ignored\n");
++		warned = 1;
++		return 0;
++	}
++
+ 	/* set clock */
+ 	spi_hz = tfr->speed_hz;
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0219-media-bcm2835-unicam-Fix-bug-in-buffer-swapping-logi.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0219-media-bcm2835-unicam-Fix-bug-in-buffer-swapping-logi.patch
new file mode 100644
index 00000000..2088b2b2
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0219-media-bcm2835-unicam-Fix-bug-in-buffer-swapping-logi.patch
@@ -0,0 +1,75 @@
+From 2ed499cd6bb934e6fd66880ae45df33e02dd7312 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Fri, 5 Mar 2021 15:40:45 +0000
+Subject: [PATCH 219/697] media: bcm2835-unicam: Fix bug in buffer swapping
+ logic
+
+If multiple sets of interrupts occur simultaneously, it may be unsafe
+to swap buffers, as the hardware may already be re-using the current
+buffers. In such cases, avoid swapping buffers, and wait for the next
+opportunity at the Frame End interrupt to signal completion.
+
+Additionally, check the packet compare status when watching for frame
+end for buffers swaps, as this could also signify a frame end event.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../media/platform/bcm2835/bcm2835-unicam.c   | 21 ++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -790,6 +790,7 @@ static irqreturn_t unicam_isr(int irq, v
+ 	unsigned int sequence = unicam->sequence;
+ 	unsigned int i;
+ 	u32 ista, sta;
++	bool fe;
+ 	u64 ts;
+ 
+ 	sta = reg_read(unicam, UNICAM_STA);
+@@ -807,12 +808,18 @@ static irqreturn_t unicam_isr(int irq, v
+ 		return IRQ_HANDLED;
+ 
+ 	/*
++	 * Look for either the Frame End interrupt or the Packet Capture status
++	 * to signal a frame end.
++	 */
++	fe = (ista & UNICAM_FEI || sta & UNICAM_PI0);
++
++	/*
+ 	 * We must run the frame end handler first. If we have a valid next_frm
+ 	 * and we get a simultaneout FE + FS interrupt, running the FS handler
+ 	 * first would null out the next_frm ptr and we would have lost the
+ 	 * buffer forever.
+ 	 */
+-	if (ista & UNICAM_FEI || sta & UNICAM_PI0) {
++	if (fe) {
+ 		/*
+ 		 * Ensure we have swapped buffers already as we can't
+ 		 * stop the peripheral. If no buffer is available, use a
+@@ -823,7 +830,15 @@ static irqreturn_t unicam_isr(int irq, v
+ 			if (!unicam->node[i].streaming)
+ 				continue;
+ 
+-			if (unicam->node[i].cur_frm)
++			/*
++			 * If cur_frm == next_frm, it means we have not had
++			 * a chance to swap buffers, likely due to having
++			 * multiple interrupts occurring simultaneously (like FE
++			 * + FS + LS). In this case, we cannot signal the buffer
++			 * as complete, as the HW will reuse that buffer.
++			 */
++			if (unicam->node[i].cur_frm &&
++			    unicam->node[i].cur_frm != unicam->node[i].next_frm)
+ 				unicam_process_buffer_complete(&unicam->node[i],
+ 							       sequence);
+ 			unicam->node[i].cur_frm = unicam->node[i].next_frm;
+@@ -860,7 +875,7 @@ static irqreturn_t unicam_isr(int irq, v
+ 	 * where the HW does not actually swap it if the new frame has
+ 	 * already started.
+ 	 */
+-	if (ista & (UNICAM_FSI | UNICAM_LCI) && !(ista & UNICAM_FEI)) {
++	if (ista & (UNICAM_FSI | UNICAM_LCI) && !fe) {
+ 		for (i = 0; i < ARRAY_SIZE(unicam->node); i++) {
+ 			if (!unicam->node[i].streaming)
+ 				continue;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0220-Assign-crypto-aliases-to-different-AES-implementatio.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0220-Assign-crypto-aliases-to-different-AES-implementatio.patch
new file mode 100644
index 00000000..c5e76ab3
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0220-Assign-crypto-aliases-to-different-AES-implementatio.patch
@@ -0,0 +1,107 @@
+From 4cfeb535dd8bb40111bd0db2a795d2c4efb3dd4f Mon Sep 17 00:00:00 2001
+From: Ben Avison <bavison@riscosopen.org>
+Date: Mon, 8 Mar 2021 15:32:25 +0000
+Subject: [PATCH 220/697] Assign crypto aliases to different AES implementation
+ modules
+
+The kernel modules aes-neon-blk and aes-neon-bs perform poorly, at least on
+Cortex-A72 without crypto extensions. In fact, aes-arm64 outperforms them
+on benchmarks, despite it being a simpler implementation (only accelerating
+the single-block AES cipher).
+
+For modes of operation where multiple cipher blocks can be processed in
+parallel, aes-neon-bs outperforms aes-neon-blk by around 60-70% and aes-arm64
+is another 10-20% faster still. But the difference is even more marked with
+modes of operation with dependencies between neighbouring blocks, such as
+CBC encryption, which defeat parallelism: in these cases, aes-arm64 is
+typically around 250% faster than either aes-neon-blk or aes-neon-bs.
+
+The key trade-off with aes-arm64 is that the look-up tables are situated in
+RAM. This leaves them potentially open to cache timing attacks. The two other
+modules, by contrast, load the look-up tables into NEON registers and so are
+able to perform in constant time.
+
+This patch aims to load aes-arm64 more often.
+
+If none of the currently-loaded crypto modules implement a given algorithm,
+a new one is typically selected for loading using a platform-neutral alias
+describing the required algorithm. To enable users to still
+load aes-neon-blk or aes-neon-bs if they really want them, while still
+ensuring that aes-arm64 is usually selected, remove the aliases from
+aes-neonbs-glue.c and aes-glue.c and apply them to aes-cipher-glue.c, but
+still build the two NEON modules.
+
+Since aes-glue.c can also be used to build aes-ce-blk, leave them enabled
+if USE_V8_CRYPTO_EXTENSIONS is defined, to ensure they are selected if we
+in future use a CPU which has the crypto extensions enabled.
+
+Note that the algorithm priority specifiers are unchanged, so if
+aes-neon-bs is loaded at the same time as aes-arm64, the former will be
+used in preference. However, aes-neon-blk and aes-arm64 have tied priority,
+so whichever module was loaded first will be used (assuming aes-neon-bs is
+not loaded).
+
+Signed-off-by: Ben Avison <bavison@riscosopen.org>
+---
+ arch/arm64/crypto/aes-cipher-glue.c | 11 +++++++++++
+ arch/arm64/crypto/aes-glue.c        |  4 ++--
+ arch/arm64/crypto/aes-neonbs-glue.c |  5 -----
+ 3 files changed, 13 insertions(+), 7 deletions(-)
+
+--- a/arch/arm64/crypto/aes-cipher-glue.c
++++ b/arch/arm64/crypto/aes-cipher-glue.c
+@@ -9,6 +9,17 @@
+ #include <crypto/algapi.h>
+ #include <linux/module.h>
+ 
++MODULE_ALIAS_CRYPTO("ecb(aes)");
++MODULE_ALIAS_CRYPTO("cbc(aes)");
++MODULE_ALIAS_CRYPTO("ctr(aes)");
++MODULE_ALIAS_CRYPTO("xts(aes)");
++MODULE_ALIAS_CRYPTO("xctr(aes)");
++MODULE_ALIAS_CRYPTO("cts(cbc(aes))");
++MODULE_ALIAS_CRYPTO("essiv(cbc(aes),sha256)");
++MODULE_ALIAS_CRYPTO("cmac(aes)");
++MODULE_ALIAS_CRYPTO("xcbc(aes)");
++MODULE_ALIAS_CRYPTO("cbcmac(aes)");
++
+ asmlinkage void __aes_arm64_encrypt(u32 *rk, u8 *out, const u8 *in, int rounds);
+ asmlinkage void __aes_arm64_decrypt(u32 *rk, u8 *out, const u8 *in, int rounds);
+ 
+--- a/arch/arm64/crypto/aes-glue.c
++++ b/arch/arm64/crypto/aes-glue.c
+@@ -57,18 +57,18 @@ MODULE_DESCRIPTION("AES-ECB/CBC/CTR/XTS/
+ #define aes_mac_update		neon_aes_mac_update
+ MODULE_DESCRIPTION("AES-ECB/CBC/CTR/XTS/XCTR using ARMv8 NEON");
+ #endif
+-#if defined(USE_V8_CRYPTO_EXTENSIONS) || !IS_ENABLED(CONFIG_CRYPTO_AES_ARM64_BS)
++#if defined(USE_V8_CRYPTO_EXTENSIONS)
+ MODULE_ALIAS_CRYPTO("ecb(aes)");
+ MODULE_ALIAS_CRYPTO("cbc(aes)");
+ MODULE_ALIAS_CRYPTO("ctr(aes)");
+ MODULE_ALIAS_CRYPTO("xts(aes)");
+ MODULE_ALIAS_CRYPTO("xctr(aes)");
+-#endif
+ MODULE_ALIAS_CRYPTO("cts(cbc(aes))");
+ MODULE_ALIAS_CRYPTO("essiv(cbc(aes),sha256)");
+ MODULE_ALIAS_CRYPTO("cmac(aes)");
+ MODULE_ALIAS_CRYPTO("xcbc(aes)");
+ MODULE_ALIAS_CRYPTO("cbcmac(aes)");
++#endif
+ 
+ MODULE_AUTHOR("Ard Biesheuvel <ard.biesheuvel@linaro.org>");
+ MODULE_LICENSE("GPL v2");
+--- a/arch/arm64/crypto/aes-neonbs-glue.c
++++ b/arch/arm64/crypto/aes-neonbs-glue.c
+@@ -19,11 +19,6 @@ MODULE_AUTHOR("Ard Biesheuvel <ard.biesh
+ MODULE_DESCRIPTION("Bit sliced AES using NEON instructions");
+ MODULE_LICENSE("GPL v2");
+ 
+-MODULE_ALIAS_CRYPTO("ecb(aes)");
+-MODULE_ALIAS_CRYPTO("cbc(aes)");
+-MODULE_ALIAS_CRYPTO("ctr(aes)");
+-MODULE_ALIAS_CRYPTO("xts(aes)");
+-
+ asmlinkage void aesbs_convert_key(u8 out[], u32 const rk[], int rounds);
+ 
+ asmlinkage void aesbs_ecb_encrypt(u8 out[], u8 const in[], u8 const rk[],
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0221-media-ov5647-Fix-return-codes-from-ov5647_write-ov56.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0221-media-ov5647-Fix-return-codes-from-ov5647_write-ov56.patch
new file mode 100644
index 00000000..c54fd83a
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0221-media-ov5647-Fix-return-codes-from-ov5647_write-ov56.patch
@@ -0,0 +1,55 @@
+From 311da509316ec85f6ae7b90d2f4d8ddb97b803d3 Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.org>
+Date: Wed, 15 Jan 2020 13:40:38 +0000
+Subject: [PATCH 221/697] media: ov5647: Fix return codes from
+ ov5647_write/ov5647_read functions.
+
+Previously they were returning positive non-zero codes for success,
+which were getting passed up the call stack. Since release 4.19,
+do_dentry_open (fs/open.c) has been catching these and flagging an
+error. (So this driver has been broken since that date.)
+
+Fixes: 3c2472a [media] media: i2c: Add support for OV5647 sensor
+Signed-off-by: David Plowman <david.plowman@raspberrypi.org>
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/i2c/ov5647.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/i2c/ov5647.c
++++ b/drivers/media/i2c/ov5647.c
+@@ -601,7 +601,13 @@ static int ov5647_write16(struct v4l2_su
+ 	int ret;
+ 
+ 	ret = i2c_master_send(client, data, 4);
+-	if (ret < 0) {
++	/*
++	 * Writing the wrong number of bytes also needs to be flagged as an
++	 * error. Success needs to produce a 0 return code.
++	 */
++	if (ret == 4) {
++		ret = 0;
++	} else {
+ 		dev_dbg(&client->dev, "%s: i2c write error, reg: %x\n",
+ 			__func__, reg);
+ 		return ret;
+@@ -617,10 +623,17 @@ static int ov5647_write(struct v4l2_subd
+ 	int ret;
+ 
+ 	ret = i2c_master_send(client, data, 3);
+-	if (ret < 0) {
++	/*
++	 * Writing the wrong number of bytes also needs to be flagged as an
++	 * error. Success needs to produce a 0 return code.
++	 */
++	if (ret == 3) {
++		ret = 0;
++	} else {
+ 		dev_dbg(&client->dev, "%s: i2c write error, reg: %x\n",
+ 				__func__, reg);
+-		return ret;
++		if (ret >= 0)
++			ret = -EINVAL;
+ 	}
+ 
+ 	return 0;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0222-media-i2c-ov5647-Parse-and-register-properties.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0222-media-i2c-ov5647-Parse-and-register-properties.patch
new file mode 100644
index 00000000..ae2c1992
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0222-media-i2c-ov5647-Parse-and-register-properties.patch
@@ -0,0 +1,49 @@
+From fc9e87e73fc861d5b21973ab7ceb9a3a235b5b71 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Sat, 4 Jul 2020 01:45:08 +0300
+Subject: [PATCH 222/697] media: i2c: ov5647: Parse and register properties
+
+Parse device properties and register controls for them using the V4L2
+fwnode properties helpers.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+---
+ drivers/media/i2c/ov5647.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/ov5647.c
++++ b/drivers/media/i2c/ov5647.c
+@@ -1297,10 +1297,11 @@ static const struct v4l2_ctrl_ops ov5647
+ 	.s_ctrl = ov5647_s_ctrl,
+ };
+ 
+-static int ov5647_init_controls(struct ov5647 *sensor)
++static int ov5647_init_controls(struct ov5647 *sensor, struct device *dev)
+ {
+ 	struct i2c_client *client = v4l2_get_subdevdata(&sensor->sd);
+ 	int hblank, exposure_max, exposure_def;
++	struct v4l2_fwnode_device_properties props;
+ 
+ 	v4l2_ctrl_handler_init(&sensor->ctrls, 9);
+ 
+@@ -1351,6 +1352,11 @@ static int ov5647_init_controls(struct o
+ 				     ARRAY_SIZE(ov5647_test_pattern_menu) - 1,
+ 				     0, 0, ov5647_test_pattern_menu);
+ 
++	v4l2_fwnode_device_parse(dev, &props);
++
++	v4l2_ctrl_new_fwnode_properties(&sensor->ctrls, &ov5647_ctrl_ops,
++					&props);
++
+ 	if (sensor->ctrls.error)
+ 		goto handler_free;
+ 
+@@ -1434,7 +1440,7 @@ static int ov5647_probe(struct i2c_clien
+ 
+ 	sensor->mode = OV5647_DEFAULT_MODE;
+ 
+-	ret = ov5647_init_controls(sensor);
++	ret = ov5647_init_controls(sensor, dev);
+ 	if (ret)
+ 		goto mutex_destroy;
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0223-staging-bcm2835-camera-Add-support-for-DMABUFs.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0223-staging-bcm2835-camera-Add-support-for-DMABUFs.patch
new file mode 100644
index 00000000..3a30928c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0223-staging-bcm2835-camera-Add-support-for-DMABUFs.patch
@@ -0,0 +1,37 @@
+From 6b5beb7c157d27d69f3cbb7146573015e92a2445 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 17 Mar 2021 12:34:57 +0000
+Subject: [PATCH 223/697] staging/bcm2835-camera: Add support for DMABUFs
+
+DMABUFs are all handled by videobuf2, so there is no reason not
+to enable support for them.
+
+Note that this driver is still using the vmalloc allocator, so
+the buffers it allocates will not be compatible with the codec
+or ISP driver that require contiguous buffers. However this
+driver should be able to import the buffers allocated by them.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+@@ -1445,6 +1445,7 @@ static const struct v4l2_ioctl_ops camer
+ 	.vidioc_querybuf = vb2_ioctl_querybuf,
+ 	.vidioc_qbuf = vb2_ioctl_qbuf,
+ 	.vidioc_dqbuf = vb2_ioctl_dqbuf,
++	.vidioc_expbuf = vb2_ioctl_expbuf,
+ 	.vidioc_enum_framesizes = vidioc_enum_framesizes,
+ 	.vidioc_enum_frameintervals = vidioc_enum_frameintervals,
+ 	.vidioc_g_parm        = vidioc_g_parm,
+@@ -1930,7 +1931,7 @@ static int bcm2835_mmal_probe(struct vch
+ 		q = &dev->capture.vb_vidq;
+ 		memset(q, 0, sizeof(*q));
+ 		q->type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+-		q->io_modes = VB2_MMAP | VB2_USERPTR | VB2_READ;
++		q->io_modes = VB2_MMAP | VB2_USERPTR | VB2_READ | VB2_DMABUF;
+ 		q->drv_priv = dev;
+ 		q->buf_struct_size = sizeof(struct vb2_mmal_buffer);
+ 		q->ops = &bcm2835_mmal_video_qops;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0224-staging-fbtft-Add-minipitft13-variant.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0224-staging-fbtft-Add-minipitft13-variant.patch
new file mode 100644
index 00000000..e1bef6c2
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0224-staging-fbtft-Add-minipitft13-variant.patch
@@ -0,0 +1,104 @@
+From 7ed35f1379eca03b0b4b24c2930bacff414a01e1 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 19 Feb 2021 10:25:01 +0000
+Subject: [PATCH 224/697] staging: fbtft: Add minipitft13 variant
+
+The Adafruit Mini-PiTFT13 display needs offsets applying when rotated,
+so use the "variant" mechanism to select a custom set_addr_win method
+using a dedicated compatible string of "fbtft,minipitft13".
+
+See: https://github.com/raspberrypi/firmware/issues/1524
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/staging/fbtft/fb_st7789v.c | 44 +++++++++++++++++++++++++++++-
+ 1 file changed, 43 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/fbtft/fb_st7789v.c
++++ b/drivers/staging/fbtft/fb_st7789v.c
+@@ -75,6 +75,11 @@ enum st7789v_command {
+ 
+ static struct completion panel_te; /* completion for panel TE line */
+ static int irq_te; /* Linux IRQ for LCD TE line */
++static u32 col_offset = 0;
++static u32 row_offset = 0;
++static u8 col_hack_fix_offset = 0;
++static short x_offset = 0;
++static short y_offset = 0;
+ 
+ static irqreturn_t panel_te_handler(int irq, void *data)
+ {
+@@ -261,6 +266,22 @@ static int write_vmem(struct fbtft_par *
+ 	return ret;
+ }
+ 
++static void minipitft13_set_addr_win(struct fbtft_par *par, int xs, int ys,
++				     int xe, int ye)
++{
++	xs += x_offset;
++	xe += x_offset;
++	ys += y_offset;
++	ye += y_offset;
++	write_reg(par, MIPI_DCS_SET_COLUMN_ADDRESS,
++		  xs >> 8, xs & 0xFF, xe >> 8, xe & 0xFF);
++
++	write_reg(par, MIPI_DCS_SET_PAGE_ADDRESS,
++		  ys >> 8, ys & 0xFF, ye >> 8, ye & 0xFF);
++
++	write_reg(par, MIPI_DCS_WRITE_MEMORY_START);
++}
++
+ /**
+  * set_var() - apply LCD properties like rotation and BGR mode
+  *
+@@ -271,20 +292,32 @@ static int write_vmem(struct fbtft_par *
+ static int set_var(struct fbtft_par *par)
+ {
+ 	u8 madctl_par = 0;
++	struct fbtft_display *display = &par->pdata->display;
++	u32 width = display->width;
++	u32 height = display->height;
+ 
+ 	if (par->bgr)
+ 		madctl_par |= MADCTL_BGR;
+ 	switch (par->info->var.rotate) {
+ 	case 0:
++		x_offset = 0;
++		y_offset = 0;
+ 		break;
+ 	case 90:
+ 		madctl_par |= (MADCTL_MV | MADCTL_MY);
++		x_offset = (320 - height) - row_offset;
++		y_offset = (240 - width) - col_offset;
+ 		break;
+ 	case 180:
+ 		madctl_par |= (MADCTL_MX | MADCTL_MY);
++		x_offset = (240 - width) - col_offset + col_hack_fix_offset;
++		// hack tweak to account for extra pixel width to make even
++		y_offset = (320 - height) - row_offset;
+ 		break;
+ 	case 270:
+ 		madctl_par |= (MADCTL_MV | MADCTL_MX);
++		x_offset = row_offset;
++		y_offset = col_offset;
+ 		break;
+ 	default:
+ 		return -EINVAL;
+@@ -382,7 +415,16 @@ static struct fbtft_display display = {
+ 	},
+ };
+ 
+-FBTFT_REGISTER_DRIVER(DRVNAME, "sitronix,st7789v", &display);
++static int variant_minipitft13(struct fbtft_display *display)
++{
++	display->fbtftops.set_addr_win = minipitft13_set_addr_win;
++	return 0;
++}
++
++FBTFT_REGISTER_DRIVER_START(&display)
++FBTFT_COMPATIBLE("sitronix,st7789v")
++FBTFT_VARIANT_COMPATIBLE("fbtft,minipitft13", variant_minipitft13)
++FBTFT_REGISTER_DRIVER_END(DRVNAME, &display);
+ 
+ MODULE_ALIAS("spi:" DRVNAME);
+ MODULE_ALIAS("platform:" DRVNAME);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0225-staging-bcm2835-camera-Add-support-for-H264-levels-4.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0225-staging-bcm2835-camera-Add-support-for-H264-levels-4.patch
new file mode 100644
index 00000000..11583550
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0225-staging-bcm2835-camera-Add-support-for-H264-levels-4.patch
@@ -0,0 +1,58 @@
+From 00b3b969612d1883750a82a7f9ea8f27da08cdfd Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 25 Mar 2021 18:34:50 +0000
+Subject: [PATCH 225/697] staging/bcm2835-camera: Add support for H264 levels
+ 4.1 and 4.2
+
+Whilst the hardware can't achieve the limits of level 4.2 under
+all situations, it can exceed level 4.0.
+
+Allow selection of levels 4.1 and 4.2.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../vc04_services/bcm2835-camera/controls.c   | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-camera/controls.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/controls.c
+@@ -704,6 +704,8 @@ static int ctrl_set_video_encode_profile
+ 		case V4L2_MPEG_VIDEO_H264_LEVEL_3_1:
+ 		case V4L2_MPEG_VIDEO_H264_LEVEL_3_2:
+ 		case V4L2_MPEG_VIDEO_H264_LEVEL_4_0:
++		case V4L2_MPEG_VIDEO_H264_LEVEL_4_1:
++		case V4L2_MPEG_VIDEO_H264_LEVEL_4_2:
+ 			dev->capture.enc_level = ctrl->val;
+ 			break;
+ 		default:
+@@ -769,6 +771,17 @@ static int ctrl_set_video_encode_profile
+ 		case V4L2_MPEG_VIDEO_H264_LEVEL_4_0:
+ 			param.level = MMAL_VIDEO_LEVEL_H264_4;
+ 			break;
++		/*
++		 * Note that the hardware spec is level 4.0. Achieving levels
++		 * above that depend on exactly the resolution and frame rate
++		 * being requested.
++		 */
++		case V4L2_MPEG_VIDEO_H264_LEVEL_4_1:
++			param.level = MMAL_VIDEO_LEVEL_H264_41;
++			break;
++		case V4L2_MPEG_VIDEO_H264_LEVEL_4_2:
++			param.level = MMAL_VIDEO_LEVEL_H264_42;
++			break;
+ 		default:
+ 			/* Should never get here */
+ 			break;
+@@ -1218,8 +1231,10 @@ static const struct bcm2835_mmal_v4l2_ct
+ 			 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_0) |
+ 			 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_1) |
+ 			 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_2) |
+-			 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_0)),
+-		.max = V4L2_MPEG_VIDEO_H264_LEVEL_4_0,
++			 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_0) |
++			 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_1) |
++			 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_2)),
++		.max = V4L2_MPEG_VIDEO_H264_LEVEL_4_2,
+ 		.def = V4L2_MPEG_VIDEO_H264_LEVEL_4_0,
+ 		.step = 1,
+ 		.imenu = NULL,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0226-media-i2c-ov5647-Correct-pixel-array-offset.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0226-media-i2c-ov5647-Correct-pixel-array-offset.patch
new file mode 100644
index 00000000..241ea692
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0226-media-i2c-ov5647-Correct-pixel-array-offset.patch
@@ -0,0 +1,25 @@
+From 520e96ce3115f1dc5ed567e8e84375fc8675b882 Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.com>
+Date: Tue, 11 May 2021 12:52:26 +0100
+Subject: [PATCH 226/697] media: i2c: ov5647: Correct pixel array offset
+
+The top offset in the pixel array is actually 6 (see page 3-1 of the
+OV5647 data sheet).
+
+Fixes: f2f7ad5ce5e52 ("media: i2c: ov5647: Selection compliance fixes")
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ drivers/media/i2c/ov5647.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/ov5647.c
++++ b/drivers/media/i2c/ov5647.c
+@@ -69,7 +69,7 @@
+ #define OV5647_NATIVE_HEIGHT		1956U
+ 
+ #define OV5647_PIXEL_ARRAY_LEFT		16U
+-#define OV5647_PIXEL_ARRAY_TOP		16U
++#define OV5647_PIXEL_ARRAY_TOP		6U
+ #define OV5647_PIXEL_ARRAY_WIDTH	2592U
+ #define OV5647_PIXEL_ARRAY_HEIGHT	1944U
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0227-media-i2c-ov5647-Correct-minimum-VBLANK-value.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0227-media-i2c-ov5647-Correct-minimum-VBLANK-value.patch
new file mode 100644
index 00000000..1f5e7961
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0227-media-i2c-ov5647-Correct-minimum-VBLANK-value.patch
@@ -0,0 +1,26 @@
+From 73dcc67353c63911bec70cefa7064b144864572e Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.com>
+Date: Tue, 11 May 2021 12:57:22 +0100
+Subject: [PATCH 227/697] media: i2c: ov5647: Correct minimum VBLANK value
+
+Trial and error reveals that the minimum vblank value appears to be 24
+(the OV5647 data sheet does not give any clues). This fixes streaming
+lock-ups in full resolution mode.
+
+Fixes: 9b5a5ebedc303 ("media: i2c: ov5647: Add support for V4L2_CID_VBLANK")
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ drivers/media/i2c/ov5647.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/ov5647.c
++++ b/drivers/media/i2c/ov5647.c
+@@ -73,7 +73,7 @@
+ #define OV5647_PIXEL_ARRAY_WIDTH	2592U
+ #define OV5647_PIXEL_ARRAY_HEIGHT	1944U
+ 
+-#define OV5647_VBLANK_MIN		4
++#define OV5647_VBLANK_MIN		24
+ #define OV5647_VTS_MAX			32767
+ 
+ #define OV5647_EXPOSURE_MIN		4
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0228-media-i2c-ov5647-Fix-v4l2-compliance-failure-subscri.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0228-media-i2c-ov5647-Fix-v4l2-compliance-failure-subscri.patch
new file mode 100644
index 00000000..1d2397ea
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0228-media-i2c-ov5647-Fix-v4l2-compliance-failure-subscri.patch
@@ -0,0 +1,26 @@
+From 60b41bcd759606619d707500d8901810cbfc3fd9 Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.com>
+Date: Wed, 12 May 2021 07:39:21 +0100
+Subject: [PATCH 228/697] media: i2c: ov5647: Fix v4l2-compliance failure
+ subscribing to events
+
+Fixes the following v4l2-compliance failure:
+
+fail: v4l2-test-controls.cpp(871): subscribe event for control 'User Controls' failed test
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ drivers/media/i2c/ov5647.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/media/i2c/ov5647.c
++++ b/drivers/media/i2c/ov5647.c
+@@ -886,6 +886,8 @@ static const struct v4l2_subdev_core_ops
+ 	.g_register		= ov5647_sensor_get_register,
+ 	.s_register		= ov5647_sensor_set_register,
+ #endif
++	.subscribe_event = v4l2_ctrl_subdev_subscribe_event,
++	.unsubscribe_event = v4l2_event_subdev_unsubscribe,
+ };
+ 
+ static const struct v4l2_rect *
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0229-media-bcm2835-unicam-Forward-input-status-from-subde.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0229-media-bcm2835-unicam-Forward-input-status-from-subde.patch
new file mode 100644
index 00000000..ad9a7dfd
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0229-media-bcm2835-unicam-Forward-input-status-from-subde.patch
@@ -0,0 +1,53 @@
+From 68c563731feed3f9b045ebed774395b61d1baaa7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jakub=20Van=C4=9Bk?= <linuxtardis@gmail.com>
+Date: Wed, 7 Jul 2021 22:48:20 +0200
+Subject: [PATCH 229/697] media: bcm2835-unicam: Forward input status from
+ subdevice
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The vidioc_enum_input() v4l2 ioctl is capable of returning
+sensor/input status as well. This is used in current
+GStreamer HEAD for signal detection [1].
+
+bcm2835-unicam does handle this syscall, but it didn't ask
+the subdevice driver about the input status. The input then
+appeared as always present.
+
+This commit adds the necessary query. There is a precedent for
+this - the R-Car VIN V4L2 driver does a similar call [2].
+
+[1]: https://gitlab.freedesktop.org/gstreamer/gst-plugins-good/-/blob/ce0be27caf69aa9d96b73bc2b50737451b6f6936/sys/v4l2/gstv4l2src.c#L553
+[2]: https://github.com/raspberrypi/linux/blob/7fb9d006d3ff3baf2e205e0c85c4e4fd0a64fcd0/drivers/media/platform/rcar-vin/rcar-v4l2.c#L548
+
+Signed-off-by: Jakub Vaněk <linuxtardis@gmail.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -1799,6 +1799,7 @@ static int unicam_enum_input(struct file
+ {
+ 	struct unicam_node *node = video_drvdata(file);
+ 	struct unicam_device *dev = node->dev;
++	int ret;
+ 
+ 	if (inp->index != 0)
+ 		return -EINVAL;
+@@ -1815,6 +1816,14 @@ static int unicam_enum_input(struct file
+ 		inp->capabilities = 0;
+ 		inp->std = 0;
+ 	}
++
++	if (v4l2_subdev_has_op(dev->sensor, video, g_input_status)) {
++		ret = v4l2_subdev_call(dev->sensor, video, g_input_status,
++				       &inp->status);
++		if (ret < 0)
++			return ret;
++	}
++
+ 	snprintf(inp->name, sizeof(inp->name), "Camera 0");
+ 	return 0;
+ }
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0230-media-i2c-ov7251-Add-fwnode-properties-controls.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0230-media-i2c-ov7251-Add-fwnode-properties-controls.patch
new file mode 100644
index 00000000..05c58480
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0230-media-i2c-ov7251-Add-fwnode-properties-controls.patch
@@ -0,0 +1,48 @@
+From 31cdc6514c262ecfae749f1132aaacb3a9b25517 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 3 Aug 2021 11:33:33 +0100
+Subject: [PATCH 230/697] media: i2c: ov7251: Add fwnode properties controls
+
+Add call to v4l2_ctrl_new_fwnode_properties to read and
+create the fwnode based controls.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/ov7251.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/ov7251.c
++++ b/drivers/media/i2c/ov7251.c
+@@ -1562,7 +1562,7 @@ static int ov7251_init_ctrls(struct ov72
+ 	s64 pixel_rate;
+ 	int hblank;
+ 
+-	v4l2_ctrl_handler_init(&ov7251->ctrls, 7);
++	v4l2_ctrl_handler_init(&ov7251->ctrls, 9);
+ 	ov7251->ctrls.lock = &ov7251->lock;
+ 
+ 	v4l2_ctrl_new_std(&ov7251->ctrls, &ov7251_ctrl_ops,
+@@ -1621,6 +1621,7 @@ static int ov7251_init_ctrls(struct ov72
+ 
+ static int ov7251_probe(struct i2c_client *client)
+ {
++	struct v4l2_fwnode_device_properties props;
+ 	struct device *dev = &client->dev;
+ 	struct ov7251 *ov7251;
+ 	unsigned int rate = 0, clk_rate = 0;
+@@ -1711,6 +1712,15 @@ static int ov7251_probe(struct i2c_clien
+ 		goto destroy_mutex;
+ 	}
+ 
++	ret = v4l2_fwnode_device_parse(&client->dev, &props);
++	if (ret)
++		goto free_ctrl;
++
++	ret = v4l2_ctrl_new_fwnode_properties(&ov7251->ctrls, &ov7251_ctrl_ops,
++					      &props);
++	if (ret)
++		goto free_ctrl;
++
+ 	v4l2_i2c_subdev_init(&ov7251->sd, client, &ov7251_subdev_ops);
+ 	ov7251->sd.internal_ops = &ov7251_internal_ops;
+ 	ov7251->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0231-drm-panel-raspberrypi-touchscreen-Use-independent-I2.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0231-drm-panel-raspberrypi-touchscreen-Use-independent-I2.patch
new file mode 100644
index 00000000..b9d473d9
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0231-drm-panel-raspberrypi-touchscreen-Use-independent-I2.patch
@@ -0,0 +1,115 @@
+From 773b686ee792a1b8fa4857afa92347507742eae9 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 23 Apr 2020 10:17:18 +0100
+Subject: [PATCH 231/697] drm/panel/raspberrypi-touchscreen: Use independent
+ I2C actions with delay.
+
+We now have the hardware I2C controller pinmuxed to the drive the
+display I2C, but this controller does not support clock stretching.
+The Atmel micro-controller in the panel requires clock stretching
+to allow it to prepare any data to be read.
+
+Split the rpi_touchscreen_i2c_read into two independent transactions with
+a delay between them for the Atmel to prepare the data.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/panel/raspberrypi-ts: Insert delay before polling for startup state
+
+In switching to the hardware I2C controller there is an issue
+where we seem to not get back the correct state from the Pi
+touchscreen.
+Insert a delay before polling to avoid this condition.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/panel/raspberrypi-touchscreen: Handle I2C errors.
+
+rpi_touchscreen_i2c_read returns any errors from i2c_transfer,
+or the 8 bit received value.
+Check for error values before trying to process the data as
+valid.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/panel/raspberrypi-touchscreen: Insert more delays.
+
+This avoids failures in cases where the panel is enabled
+or re-probed very soon after being disabled or probed.
+These can occur because the Atmel device can mis-behave
+over I2C for a few ms after any write to the POWERON register.
+---
+ .../drm/panel/panel-raspberrypi-touchscreen.c | 44 +++++++++++++++++--
+ 1 file changed, 41 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
++++ b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
+@@ -218,7 +218,35 @@ static struct rpi_touchscreen *panel_to_
+ 
+ static int rpi_touchscreen_i2c_read(struct rpi_touchscreen *ts, u8 reg)
+ {
+-	return i2c_smbus_read_byte_data(ts->i2c, reg);
++	struct i2c_client *client = ts->i2c;
++	struct i2c_msg msgs[1];
++	u8 addr_buf[1] = { reg };
++	u8 data_buf[1] = { 0, };
++	int ret;
++
++	/* Write register address */
++	msgs[0].addr = client->addr;
++	msgs[0].flags = 0;
++	msgs[0].len = ARRAY_SIZE(addr_buf);
++	msgs[0].buf = addr_buf;
++
++	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
++	if (ret != ARRAY_SIZE(msgs))
++		return -EIO;
++
++	usleep_range(100, 300);
++
++	/* Read data from register */
++	msgs[0].addr = client->addr;
++	msgs[0].flags = I2C_M_RD;
++	msgs[0].len = 1;
++	msgs[0].buf = data_buf;
++
++	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
++	if (ret != ARRAY_SIZE(msgs))
++		return -EIO;
++
++	return data_buf[0];
+ }
+ 
+ static void rpi_touchscreen_i2c_write(struct rpi_touchscreen *ts,
+@@ -267,12 +295,21 @@ static int rpi_touchscreen_noop(struct d
+ static int rpi_touchscreen_prepare(struct drm_panel *panel)
+ {
+ 	struct rpi_touchscreen *ts = panel_to_ts(panel);
+-	int i;
++	int i, data;
+ 
++	/*
++	 * Power up the Toshiba bridge. The Atmel device can misbehave
++	 * over I2C for a few ms after writes to REG_POWERON (including the
++	 * write in rpi_touchscreen_disable()), so sleep before and after.
++	 * Also to ensure that the bridge has been off for at least 100ms.
++	 */
++	msleep(100);
+ 	rpi_touchscreen_i2c_write(ts, REG_POWERON, 1);
++	usleep_range(20000, 25000);
+ 	/* Wait for nPWRDWN to go low to indicate poweron is done. */
+ 	for (i = 0; i < 100; i++) {
+-		if (rpi_touchscreen_i2c_read(ts, REG_PORTB) & 1)
++		data = rpi_touchscreen_i2c_read(ts, REG_PORTB);
++		if (data >= 0 && (data & 1))
+ 			break;
+ 	}
+ 
+@@ -398,6 +435,7 @@ static int rpi_touchscreen_probe(struct
+ 
+ 	/* Turn off at boot, so we can cleanly sequence powering on. */
+ 	rpi_touchscreen_i2c_write(ts, REG_POWERON, 0);
++	usleep_range(20000, 25000);
+ 
+ 	/* Look up the DSI host.  It needs to probe before we do. */
+ 	endpoint = of_graph_get_next_endpoint(dev->of_node, NULL);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0232-drm-panel-simple-Add-a-timing-for-the-Raspberry-Pi-7.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0232-drm-panel-simple-Add-a-timing-for-the-Raspberry-Pi-7.patch
new file mode 100644
index 00000000..e05fc7f7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0232-drm-panel-simple-Add-a-timing-for-the-Raspberry-Pi-7.patch
@@ -0,0 +1,600 @@
+From 4f7cc5d640df86f18f161327e85006310e03b9f3 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 26 Mar 2021 17:06:36 +0000
+Subject: [PATCH 232/697] drm/panel-simple: Add a timing for the Raspberry Pi
+ 7" panel
+
+The Raspberry Pi 7" 800x480 panel uses a Toshiba TC358762 DSI
+to DPI bridge chip, so there is a requirement for the timings
+to be specified for the end panel. Add such a definition.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/panel-simple: Populate bpc when using panel-dpi
+
+panel-dpi doesn't know the bit depth, so in the same way that
+DPI is guessed for the connector type, guess that it'll be 8bpc.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/panel-simple: Allow the bus format to be read from DT for panel-dpi
+
+The "panel-dpi" compatible string configures panel from device tree,
+but it doesn't provide any way of configuring the bus format (colour
+representation), nor does it populate it.
+
+Add a DT parameter "bus-format" that allows the MEDIA_BUS_FMT_xxx value
+to be specified from device tree.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/panel: simple: add Geekworm MZP280 Panel
+
+Add support for the Geekworm MZP280 Panel
+
+Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
+Acked-by: Maxime Ripard <maxime@cerno.tech>
+
+drm/panel: simple: Add Innolux AT056tN53V1 5.6" VGA
+
+Add support for the Innolux AT056tN53V1 5.6" VGA (640x480) TFT LCD
+panel.
+
+Signed-off-by: Joerg Quinten <aBUGSworstnightmare@gmail.com>
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+drm/panel: simple: Alter the timing for the Pi 7" DSI display
+
+vc4 has always fixed up the timing, so the values defined have
+never actually appeared on the wire.
+The display appears to want a slightly longer HFP, so extend
+the timings and recompute the clock to give the same frame rate.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/panel: add panel-dsi
+
+Equivalent to panel-dpi for configuring a simple DSI panel with
+device tree side timings and bus settings.
+Motiviation is the same as for panel-dpi of wanting to support
+new simple panels without needing to patch the kernel.
+
+Signed-off-by: Timon Skerutsch <kernel@diodes-delight.com>
+
+drm/panel-simple: Remove custom handling of orientation
+
+The framework now handles reading orientation from DT, therefore
+remove the custom get_orientation hook from panel-simple.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/panel-simple: Fix 7inch panel mode for misalignment
+
+The 7inch panel is one line off the screen both horizontally
+and vertically.
+
+Alter the panel mode to correct this.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/panel-simple: Increase pixel clock on Pi 7inch panel
+
+The Toshiba bridge is very fussy and doesn't like the CM3
+output when being told to produce a 27.777MHz pixel clock, which
+is an almost perfect match to the DSI link integer divider.
+
+Increasing to 30MHz will switch the DSI link from 333MHz to 400MHz
+and makes the bridge happy with the same video timing as works
+on Pi4.
+(Pi4 will be using a link frequency of 375MHz due to a 3GHz
+parent PLL).
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../bindings/display/panel/panel-simple.yaml  |   2 +
+ .../media/v4l/subdev-formats.rst              | 111 ++++++++
+ drivers/gpu/drm/panel/panel-simple.c          | 237 ++++++++++++++++--
+ 3 files changed, 328 insertions(+), 22 deletions(-)
+
+--- a/Documentation/devicetree/bindings/display/panel/panel-simple.yaml
++++ b/Documentation/devicetree/bindings/display/panel/panel-simple.yaml
+@@ -154,6 +154,8 @@ properties:
+       - hit,tx23d38vm0caa
+         # Innolux AT043TN24 4.3" WQVGA TFT LCD panel
+       - innolux,at043tn24
++        # Innolux AT056tN53V1 5.6" VGA (640x480) TFT LCD panel
++      - innolux,at056tn53v1
+         # Innolux AT070TN92 7.0" WQVGA TFT LCD panel
+       - innolux,at070tn92
+         # Innolux G070ACE-L01 7" WVGA (800x480) TFT LCD panel
+--- a/Documentation/userspace-api/media/v4l/subdev-formats.rst
++++ b/Documentation/userspace-api/media/v4l/subdev-formats.rst
+@@ -625,6 +625,43 @@ The following tables list existing packe
+       - b\ :sub:`2`
+       - b\ :sub:`1`
+       - b\ :sub:`0`
++    * .. _MEDIA_BUS_FMT_RGB565_1X24_CPADHI:
++
++      - MEDIA_BUS_FMT_RGB565_1X24_CPADHI
++      - 0x1022
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      - 0
++      - 0
++      - 0
++      - r\ :sub:`4`
++      - r\ :sub:`3`
++      - r\ :sub:`2`
++      - r\ :sub:`1`
++      - r\ :sub:`0`
++      - 0
++      - 0
++      - g\ :sub:`5`
++      - g\ :sub:`4`
++      - g\ :sub:`3`
++      - g\ :sub:`2`
++      - g\ :sub:`1`
++      - g\ :sub:`0`
++      - 0
++      - 0
++      - 0
++      - b\ :sub:`4`
++      - b\ :sub:`3`
++      - b\ :sub:`2`
++      - b\ :sub:`1`
++      - b\ :sub:`0`
+     * .. _MEDIA-BUS-FMT-BGR565-2X8-BE:
+ 
+       - MEDIA_BUS_FMT_BGR565_2X8_BE
+@@ -913,6 +950,43 @@ The following tables list existing packe
+       - g\ :sub:`5`
+       - g\ :sub:`4`
+       - g\ :sub:`3`
++    * .. _MEDIA-BUS-FMT-BGR666-1X18:
++
++      - MEDIA_BUS_FMT-BGR666_1X18
++      - 0x1023
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      - b\ :sub:`5`
++      - b\ :sub:`4`
++      - b\ :sub:`3`
++      - b\ :sub:`2`
++      - b\ :sub:`1`
++      - b\ :sub:`0`
++      - g\ :sub:`5`
++      - g\ :sub:`4`
++      - g\ :sub:`3`
++      - g\ :sub:`2`
++      - g\ :sub:`1`
++      - g\ :sub:`0`
++      - r\ :sub:`5`
++      - r\ :sub:`4`
++      - r\ :sub:`3`
++      - r\ :sub:`2`
++      - r\ :sub:`1`
++      - r\ :sub:`0`
+     * .. _MEDIA-BUS-FMT-RGB666-1X18:
+ 
+       - MEDIA_BUS_FMT_RGB666_1X18
+@@ -1096,6 +1170,43 @@ The following tables list existing packe
+       - g\ :sub:`2`
+       - g\ :sub:`1`
+       - g\ :sub:`0`
++    * .. _MEDIA-BUS-FMT-BGR666-1X24_CPADHI:
++
++      - MEDIA_BUS_FMT_BGR666_1X24_CPADHI
++      - 0x1024
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      -
++      - 0
++      - 0
++      - b\ :sub:`5`
++      - b\ :sub:`4`
++      - b\ :sub:`3`
++      - b\ :sub:`2`
++      - b\ :sub:`1`
++      - b\ :sub:`0`
++      - 0
++      - 0
++      - g\ :sub:`5`
++      - g\ :sub:`4`
++      - g\ :sub:`3`
++      - g\ :sub:`2`
++      - g\ :sub:`1`
++      - g\ :sub:`0`
++      - 0
++      - 0
++      - r\ :sub:`5`
++      - r\ :sub:`4`
++      - r\ :sub:`3`
++      - r\ :sub:`2`
++      - r\ :sub:`1`
++      - r\ :sub:`0`
+     * .. _MEDIA-BUS-FMT-RGB666-1X24_CPADHI:
+ 
+       - MEDIA_BUS_FMT_RGB666_1X24_CPADHI
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -151,8 +151,6 @@ struct panel_simple {
+ 	const struct drm_edid *drm_edid;
+ 
+ 	struct drm_display_mode override_mode;
+-
+-	enum drm_panel_orientation orientation;
+ };
+ 
+ static inline struct panel_simple *to_panel_simple(struct drm_panel *panel)
+@@ -387,12 +385,6 @@ static int panel_simple_get_modes(struct
+ 	/* add hard-coded panel modes */
+ 	num += panel_simple_get_non_edid_modes(p, connector);
+ 
+-	/*
+-	 * TODO: Remove once all drm drivers call
+-	 * drm_connector_set_orientation_from_panel()
+-	 */
+-	drm_connector_set_panel_orientation(connector, p->orientation);
+-
+ 	return num;
+ }
+ 
+@@ -413,20 +405,12 @@ static int panel_simple_get_timings(stru
+ 	return p->desc->num_timings;
+ }
+ 
+-static enum drm_panel_orientation panel_simple_get_orientation(struct drm_panel *panel)
+-{
+-	struct panel_simple *p = to_panel_simple(panel);
+-
+-	return p->orientation;
+-}
+-
+ static const struct drm_panel_funcs panel_simple_funcs = {
+ 	.disable = panel_simple_disable,
+ 	.unprepare = panel_simple_unprepare,
+ 	.prepare = panel_simple_prepare,
+ 	.enable = panel_simple_enable,
+ 	.get_modes = panel_simple_get_modes,
+-	.get_orientation = panel_simple_get_orientation,
+ 	.get_timings = panel_simple_get_timings,
+ };
+ 
+@@ -463,6 +447,7 @@ static int panel_dpi_probe(struct device
+ 
+ 	of_property_read_u32(np, "width-mm", &desc->size.width);
+ 	of_property_read_u32(np, "height-mm", &desc->size.height);
++	of_property_read_u32(np, "bus-format", &desc->bus_format);
+ 
+ 	/* Extract bus_flags from display_timing */
+ 	bus_flags = 0;
+@@ -472,6 +457,8 @@ static int panel_dpi_probe(struct device
+ 
+ 	/* We do not know the connector for the DT node, so guess it */
+ 	desc->connector_type = DRM_MODE_CONNECTOR_DPI;
++	/* Likewise for the bit depth. */
++	desc->bpc = 8;
+ 
+ 	panel->desc = desc;
+ 
+@@ -595,12 +582,6 @@ static int panel_simple_probe(struct dev
+ 		return dev_err_probe(dev, PTR_ERR(panel->enable_gpio),
+ 				     "failed to request GPIO\n");
+ 
+-	err = of_drm_get_panel_orientation(dev->of_node, &panel->orientation);
+-	if (err) {
+-		dev_err(dev, "%pOF: failed to get orientation %d\n", dev->of_node, err);
+-		return err;
+-	}
+-
+ 	ddc = of_parse_phandle(dev->of_node, "ddc-i2c-bus", 0);
+ 	if (ddc) {
+ 		panel->ddc = of_find_i2c_adapter_by_node(ddc);
+@@ -2261,6 +2242,32 @@ static const struct panel_desc friendlya
+ 	},
+ };
+ 
++static const struct drm_display_mode geekworm_mzp280_mode = {
++	.clock = 32000,
++	.hdisplay = 480,
++	.hsync_start = 480 + 41,
++	.hsync_end = 480 + 41 + 20,
++	.htotal = 480 + 41 + 20 + 60,
++	.vdisplay = 640,
++	.vsync_start = 640 + 5,
++	.vsync_end = 640 + 5 + 10,
++	.vtotal = 640 + 5 + 10 + 10,
++	.flags = DRM_MODE_FLAG_NVSYNC | DRM_MODE_FLAG_NHSYNC,
++};
++
++static const struct panel_desc geekworm_mzp280 = {
++	.modes = &geekworm_mzp280_mode,
++	.num_modes = 1,
++	.bpc = 6,
++	.size = {
++		.width = 47,
++		.height = 61,
++	},
++	.bus_format = MEDIA_BUS_FMT_RGB565_1X24_CPADHI,
++	.bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_NEGEDGE,
++	.connector_type = DRM_MODE_CONNECTOR_DPI,
++};
++
+ static const struct drm_display_mode giantplus_gpg482739qs5_mode = {
+ 	.clock = 9000,
+ 	.hdisplay = 480,
+@@ -2441,6 +2448,38 @@ static const struct panel_desc innolux_a
+ 	.bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE,
+ };
+ 
++static const struct display_timing innolux_at056tn53v1_timing = {
++	.pixelclock = { 39700000, 39700000, 39700000},
++	.hactive = { 640, 640, 640 },
++	.hfront_porch = { 16, 16, 16 },
++	.hback_porch = { 134, 134, 134 },
++	.hsync_len = { 10, 10, 10},
++	.vactive = { 480, 480, 480 },
++	.vfront_porch = { 32, 32, 32},
++	.vback_porch = { 11, 11, 11 },
++	.vsync_len = { 2, 2, 2 },
++	.flags = DRM_MODE_FLAG_PVSYNC | DRM_MODE_FLAG_PHSYNC,
++};
++
++static const struct panel_desc innolux_at056tn53v1 = {
++	.timings = &innolux_at056tn53v1_timing,
++	.num_timings = 1,
++	.bpc = 6,
++	.size = {
++		.width = 112,
++		.height = 84,
++	},
++	.delay = {
++		.prepare = 50,
++		.enable = 200,
++		.disable = 110,
++		.unprepare = 200,
++	},
++	.bus_format = MEDIA_BUS_FMT_BGR666_1X24_CPADHI,
++	.bus_flags = DRM_BUS_FLAG_PIXDATA_SAMPLE_POSEDGE,
++	.connector_type = DRM_MODE_CONNECTOR_DPI,
++};
++
+ static const struct drm_display_mode innolux_at070tn92_mode = {
+ 	.clock = 33333,
+ 	.hdisplay = 800,
+@@ -3854,6 +3893,31 @@ static const struct panel_desc rocktech_
+ 	.connector_type = DRM_MODE_CONNECTOR_DPI,
+ };
+ 
++static const struct drm_display_mode raspberrypi_7inch_mode = {
++	.clock = 30000,
++	.hdisplay = 800,
++	.hsync_start = 800 + 131,
++	.hsync_end = 800 + 131 + 2,
++	.htotal = 800 + 131 + 2 + 45,
++	.vdisplay = 480,
++	.vsync_start = 480 + 7,
++	.vsync_end = 480 + 7 + 2,
++	.vtotal = 480 + 7 + 2 + 22,
++	.flags = DRM_MODE_FLAG_NVSYNC | DRM_MODE_FLAG_NHSYNC,
++};
++
++static const struct panel_desc raspberrypi_7inch = {
++	.modes = &raspberrypi_7inch_mode,
++	.num_modes = 1,
++	.bpc = 8,
++	.size = {
++		.width = 154,
++		.height = 86,
++	},
++	.bus_format = MEDIA_BUS_FMT_RGB888_1X24,
++	.connector_type = DRM_MODE_CONNECTOR_DSI,
++};
++
+ static const struct display_timing rocktech_rk070er9427_timing = {
+ 	.pixelclock = { 26400000, 33300000, 46800000 },
+ 	.hactive = { 800, 800, 800 },
+@@ -4798,6 +4862,9 @@ static const struct of_device_id platfor
+ 		.compatible = "friendlyarm,hd702e",
+ 		.data = &friendlyarm_hd702e,
+ 	}, {
++		.compatible = "geekworm,mzp280",
++		.data = &geekworm_mzp280,
++	}, {
+ 		.compatible = "giantplus,gpg482739qs5",
+ 		.data = &giantplus_gpg482739qs5
+ 	}, {
+@@ -4819,6 +4886,9 @@ static const struct of_device_id platfor
+ 		.compatible = "innolux,at043tn24",
+ 		.data = &innolux_at043tn24,
+ 	}, {
++		.compatible = "innolux,at056tn53v1",
++		.data = &innolux_at056tn53v1,
++	}, {
+ 		.compatible = "innolux,at070tn92",
+ 		.data = &innolux_at070tn92,
+ 	}, {
+@@ -4978,6 +5048,9 @@ static const struct of_device_id platfor
+ 		.compatible = "rocktech,rk043fn48h",
+ 		.data = &rocktech_rk043fn48h,
+ 	}, {
++		.compatible = "raspberrypi,7inch-dsi",
++		.data = &raspberrypi_7inch,
++	}, {
+ 		.compatible = "rocktech,rk070er9427",
+ 		.data = &rocktech_rk070er9427,
+ 	}, {
+@@ -5334,6 +5407,9 @@ static const struct panel_desc_dsi osd10
+ 	.lanes = 4,
+ };
+ 
++// for panels using generic panel-dsi binding
++static struct panel_desc_dsi panel_dsi;
++
+ static const struct of_device_id dsi_of_match[] = {
+ 	{
+ 		.compatible = "auo,b080uan01",
+@@ -5357,20 +5433,137 @@ static const struct of_device_id dsi_of_
+ 		.compatible = "osddisplays,osd101t2045-53ts",
+ 		.data = &osd101t2045_53ts
+ 	}, {
++		/* Must be the last entry */
++		.compatible = "panel-dsi",
++		.data = &panel_dsi,
++	}, {
+ 		/* sentinel */
+ 	}
+ };
+ MODULE_DEVICE_TABLE(of, dsi_of_match);
+ 
++
++/* Checks for DSI panel definition in device-tree, analog to panel_dpi */
++static int panel_dsi_dt_probe(struct device *dev,
++			  struct panel_desc_dsi *desc_dsi)
++{
++	struct panel_desc *desc;
++	struct display_timing *timing;
++	const struct device_node *np;
++	const char *dsi_color_format;
++	const char *dsi_mode_flags;
++	struct property *prop;
++	int dsi_lanes, ret;
++
++	np = dev->of_node;
++
++	desc = devm_kzalloc(dev, sizeof(*desc), GFP_KERNEL);
++	if (!desc)
++		return -ENOMEM;
++
++	timing = devm_kzalloc(dev, sizeof(*timing), GFP_KERNEL);
++	if (!timing)
++		return -ENOMEM;
++
++	ret = of_get_display_timing(np, "panel-timing", timing);
++	if (ret < 0) {
++		dev_err(dev, "%pOF: no panel-timing node found for \"panel-dsi\" binding\n",
++			np);
++		return ret;
++	}
++
++	desc->timings = timing;
++	desc->num_timings = 1;
++
++	of_property_read_u32(np, "width-mm", &desc->size.width);
++	of_property_read_u32(np, "height-mm", &desc->size.height);
++
++	dsi_lanes = drm_of_get_data_lanes_count_ep(np, 0, 0, 1, 4);
++
++	if (dsi_lanes < 0) {
++		dev_err(dev, "%pOF: no or too many data-lanes defined", np);
++		return dsi_lanes;
++	}
++
++	desc_dsi->lanes = dsi_lanes;
++
++	of_property_read_string(np, "dsi-color-format", &dsi_color_format);
++	if (!strcmp(dsi_color_format, "RGB888")) {
++		desc_dsi->format = MIPI_DSI_FMT_RGB888;
++		desc->bpc = 8;
++	} else if (!strcmp(dsi_color_format, "RGB565")) {
++		desc_dsi->format = MIPI_DSI_FMT_RGB565;
++		desc->bpc = 6;
++	} else if (!strcmp(dsi_color_format, "RGB666")) {
++		desc_dsi->format = MIPI_DSI_FMT_RGB666;
++		desc->bpc = 6;
++	} else if (!strcmp(dsi_color_format, "RGB666_PACKED")) {
++		desc_dsi->format = MIPI_DSI_FMT_RGB666_PACKED;
++		desc->bpc = 6;
++	} else {
++		dev_err(dev, "%pOF: no valid dsi-color-format defined", np);
++		return -EINVAL;
++	}
++
++
++	of_property_for_each_string(np, "mode", prop, dsi_mode_flags) {
++		if (!strcmp(dsi_mode_flags, "MODE_VIDEO"))
++			desc_dsi->flags |= MIPI_DSI_MODE_VIDEO;
++		else if (!strcmp(dsi_mode_flags, "MODE_VIDEO_BURST"))
++			desc_dsi->flags |= MIPI_DSI_MODE_VIDEO_BURST;
++		else if (!strcmp(dsi_mode_flags, "MODE_VIDEO_SYNC_PULSE"))
++			desc_dsi->flags |= MIPI_DSI_MODE_VIDEO_SYNC_PULSE;
++		else if (!strcmp(dsi_mode_flags, "MODE_VIDEO_AUTO_VERT"))
++			desc_dsi->flags |= MIPI_DSI_MODE_VIDEO_AUTO_VERT;
++		else if (!strcmp(dsi_mode_flags, "MODE_VIDEO_HSE"))
++			desc_dsi->flags |= MIPI_DSI_MODE_VIDEO_HSE;
++		else if (!strcmp(dsi_mode_flags, "MODE_VIDEO_NO_HFP"))
++			desc_dsi->flags |= MIPI_DSI_MODE_VIDEO_NO_HFP;
++		else if (!strcmp(dsi_mode_flags, "MODE_VIDEO_NO_HBP"))
++			desc_dsi->flags |= MIPI_DSI_MODE_VIDEO_NO_HBP;
++		else if (!strcmp(dsi_mode_flags, "MODE_VIDEO_NO_HSA"))
++			desc_dsi->flags |= MIPI_DSI_MODE_VIDEO_NO_HSA;
++		else if (!strcmp(dsi_mode_flags, "MODE_VSYNC_FLUSH"))
++			desc_dsi->flags |= MIPI_DSI_MODE_VSYNC_FLUSH;
++		else if (!strcmp(dsi_mode_flags, "MODE_NO_EOT_PACKET"))
++			desc_dsi->flags |= MIPI_DSI_MODE_NO_EOT_PACKET;
++		else if (!strcmp(dsi_mode_flags, "CLOCK_NON_CONTINUOUS"))
++			desc_dsi->flags |= MIPI_DSI_CLOCK_NON_CONTINUOUS;
++		else if (!strcmp(dsi_mode_flags, "MODE_LPM"))
++			desc_dsi->flags |= MIPI_DSI_MODE_LPM;
++		else if (!strcmp(dsi_mode_flags, "HS_PKT_END_ALIGNED"))
++			desc_dsi->flags |= MIPI_DSI_HS_PKT_END_ALIGNED;
++	}
++
++	desc->connector_type = DRM_MODE_CONNECTOR_DSI;
++	desc_dsi->desc = *desc;
++
++	return 0;
++}
++
+ static int panel_simple_dsi_probe(struct mipi_dsi_device *dsi)
+ {
+ 	const struct panel_desc_dsi *desc;
++	struct panel_desc_dsi *dt_desc;
+ 	int err;
+ 
+ 	desc = of_device_get_match_data(&dsi->dev);
+ 	if (!desc)
+ 		return -ENODEV;
+ 
++	if (desc == &panel_dsi) {
++		/* Handle the generic panel-dsi binding */
++		dt_desc = devm_kzalloc(&dsi->dev, sizeof(*dt_desc), GFP_KERNEL);
++		if (!dt_desc)
++			return -ENOMEM;
++
++		err = panel_dsi_dt_probe(&dsi->dev, dt_desc);
++		if (err < 0)
++			return err;
++
++		desc = dt_desc;
++	}
++
+ 	err = panel_simple_probe(&dsi->dev, &desc->desc);
+ 	if (err < 0)
+ 		return err;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0233-drm-panel-jdi-lt070me05000-Use-gpiod_set_value_cansl.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0233-drm-panel-jdi-lt070me05000-Use-gpiod_set_value_cansl.patch
new file mode 100644
index 00000000..b042c6f0
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0233-drm-panel-jdi-lt070me05000-Use-gpiod_set_value_cansl.patch
@@ -0,0 +1,85 @@
+From 1ca588d050d31214dd501fb444482c865f1e0f7d Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 15 Apr 2021 17:30:35 +0100
+Subject: [PATCH 233/697] drm/panel: jdi-lt070me05000: Use
+ gpiod_set_value_cansleep
+
+There is no reason why the control GPIOs for the panel can not
+be connected to I2C or similar GPIO interfaces that may need to
+sleep, therefore switch from gpiod_set_value to
+gpiod_set_value_cansleep calls to configure them.
+Without that you get complaints from gpiolib every time the state
+is changed.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm: panel: jdi-lt070me05000: Add prepare_upstream_first flag
+
+The panel driver wants to send DCS commands from the prepare
+hook, therefore the DSI host wants to be pre_enabled first.
+Set the flag to achieve this.
+
+https://forums.raspberrypi.com/viewtopic.php?t=354708
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../gpu/drm/panel/panel-jdi-lt070me05000.c    | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/panel/panel-jdi-lt070me05000.c
++++ b/drivers/gpu/drm/panel/panel-jdi-lt070me05000.c
+@@ -190,11 +190,11 @@ static int jdi_panel_unprepare(struct dr
+ 	if (ret < 0)
+ 		dev_err(dev, "regulator disable failed, %d\n", ret);
+ 
+-	gpiod_set_value(jdi->enable_gpio, 0);
++	gpiod_set_value_cansleep(jdi->enable_gpio, 0);
+ 
+-	gpiod_set_value(jdi->reset_gpio, 1);
++	gpiod_set_value_cansleep(jdi->reset_gpio, 1);
+ 
+-	gpiod_set_value(jdi->dcdc_en_gpio, 0);
++	gpiod_set_value_cansleep(jdi->dcdc_en_gpio, 0);
+ 
+ 	return 0;
+ }
+@@ -213,13 +213,13 @@ static int jdi_panel_prepare(struct drm_
+ 
+ 	msleep(20);
+ 
+-	gpiod_set_value(jdi->dcdc_en_gpio, 1);
++	gpiod_set_value_cansleep(jdi->dcdc_en_gpio, 1);
+ 	usleep_range(10, 20);
+ 
+-	gpiod_set_value(jdi->reset_gpio, 0);
++	gpiod_set_value_cansleep(jdi->reset_gpio, 0);
+ 	usleep_range(10, 20);
+ 
+-	gpiod_set_value(jdi->enable_gpio, 1);
++	gpiod_set_value_cansleep(jdi->enable_gpio, 1);
+ 	usleep_range(10, 20);
+ 
+ 	ret = jdi_panel_init(jdi);
+@@ -241,11 +241,11 @@ poweroff:
+ 	if (ret < 0)
+ 		dev_err(dev, "regulator disable failed, %d\n", ret);
+ 
+-	gpiod_set_value(jdi->enable_gpio, 0);
++	gpiod_set_value_cansleep(jdi->enable_gpio, 0);
+ 
+-	gpiod_set_value(jdi->reset_gpio, 1);
++	gpiod_set_value_cansleep(jdi->reset_gpio, 1);
+ 
+-	gpiod_set_value(jdi->dcdc_en_gpio, 0);
++	gpiod_set_value_cansleep(jdi->dcdc_en_gpio, 0);
+ 
+ 	return ret;
+ }
+@@ -402,6 +402,7 @@ static int jdi_panel_add(struct jdi_pane
+ 		return dev_err_probe(dev, PTR_ERR(jdi->backlight),
+ 				     "failed to register backlight %d\n", ret);
+ 
++	jdi->base.prepare_prev_first = true;
+ 	drm_panel_init(&jdi->base, &jdi->dsi->dev, &jdi_panel_funcs,
+ 		       DRM_MODE_CONNECTOR_DSI);
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0234-Extending-ili9881c-driver-support-for-nwe080-panel.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0234-Extending-ili9881c-driver-support-for-nwe080-panel.patch
new file mode 100644
index 00000000..e83c496c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0234-Extending-ili9881c-driver-support-for-nwe080-panel.patch
@@ -0,0 +1,1072 @@
+From 1c6fe0d217e3a6950d86043b8d2abd9fed6460b0 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Tue, 12 Sep 2023 20:11:26 +0100
+Subject: [PATCH 234/697] Extending ili9881c driver support for nwe080 panel
+
+Signed-off-by: Penk Chen <penk@cutiepi.io>
+
+drm/panel: ilitek-ili9881c: Clean up on mipi_dsi_attach failure
+
+mipi_dsi_attach is allowed to fail, and currently the probe
+code doesn't clean up (mainly drm_panel_remove) if this happens.
+
+Add cleanup code on failure.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/panel: panel-ilitek9881c: Add prepare_upstream_first flag
+
+The panel sends MIPI DCS commands during prepare and is expecting
+the bus to remain in LP-11 state in-between.
+
+Set the prepare_upstream_first flag so that the upstream DSI host
+is prepared / pre_enabled first, and therefore the bus is in a
+defined state.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/panel: panel-ilitek9881c: Use cansleep methods
+
+Use cansleep version of gpiod_set_value so external IO drivers (like
+via I2C) can be used.
+
+Signed-off-by: Mark Williams <mwp@mwp.id.au>
+
+drm/panel: panel-ilitek9881c: Crystalfontz support
+
+Add support for Crystalfontz CFAF7201280A0-050Tx panel.
+
+Signed-off-by: Mark Williams <mwp@mwp.id.au>
+
+drm/panel: ilitek-ili9881c: Allow configuration of the number of lanes
+
+Not all panels use all 4 data lanes, so allow configuration based
+on the compatible string.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/panel: ili9881: Add configuration for the new panels
+
+Add configuration for the 5" and 7" Raspberry Pi 720x1280
+DSI panels based on ili9881.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/panel/panel-ilitek-ili9881c.c | 928 +++++++++++++++++-
+ 1 file changed, 926 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
++++ b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
+@@ -1,6 +1,9 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /*
+  * Copyright (C) 2017-2018, Bootlin
++ * Copyright (C) 2021, Henson Li <henson@cutiepi.io>
++ * Copyright (C) 2021, Penk Chen <penk@cutiepi.io>
++ * Copyright (C) 2022, Mark Williams <mark@crystalfontz.com>
+  */
+ 
+ #include <linux/delay.h>
+@@ -42,6 +45,7 @@ struct ili9881c_desc {
+ 	const size_t init_length;
+ 	const struct drm_display_mode *mode;
+ 	const unsigned long mode_flags;
++	unsigned int lanes;
+ };
+ 
+ struct ili9881c {
+@@ -1223,6 +1227,815 @@ static const struct ili9881c_instr am800
+ 	ILI9881C_COMMAND_INSTR(MIPI_DCS_WRITE_POWER_SAVE, 0x00),
+ };
+ 
++static const struct ili9881c_instr nwe080_init[] = {
++	ILI9881C_SWITCH_PAGE_INSTR(3),
++	//GIP_1
++	ILI9881C_COMMAND_INSTR(0x01, 0x00),
++	ILI9881C_COMMAND_INSTR(0x02, 0x00),
++	ILI9881C_COMMAND_INSTR(0x03, 0x73),
++	ILI9881C_COMMAND_INSTR(0x04, 0x00),
++	ILI9881C_COMMAND_INSTR(0x05, 0x00),
++	ILI9881C_COMMAND_INSTR(0x06, 0x0A),
++	ILI9881C_COMMAND_INSTR(0x07, 0x00),
++	ILI9881C_COMMAND_INSTR(0x08, 0x00),
++	ILI9881C_COMMAND_INSTR(0x09, 0x20),
++	ILI9881C_COMMAND_INSTR(0x0a, 0x20),
++	ILI9881C_COMMAND_INSTR(0x0b, 0x00),
++	ILI9881C_COMMAND_INSTR(0x0c, 0x00),
++	ILI9881C_COMMAND_INSTR(0x0d, 0x00),
++	ILI9881C_COMMAND_INSTR(0x0e, 0x00),
++	ILI9881C_COMMAND_INSTR(0x0f, 0x1E),
++	ILI9881C_COMMAND_INSTR(0x10, 0x1E),
++	ILI9881C_COMMAND_INSTR(0x11, 0x00),
++	ILI9881C_COMMAND_INSTR(0x12, 0x00),
++	ILI9881C_COMMAND_INSTR(0x13, 0x00),
++	ILI9881C_COMMAND_INSTR(0x14, 0x00),
++	ILI9881C_COMMAND_INSTR(0x15, 0x00),
++	ILI9881C_COMMAND_INSTR(0x16, 0x00),
++	ILI9881C_COMMAND_INSTR(0x17, 0x00),
++	ILI9881C_COMMAND_INSTR(0x18, 0x00),
++	ILI9881C_COMMAND_INSTR(0x19, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1A, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1B, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1C, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1D, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1E, 0x40),
++	ILI9881C_COMMAND_INSTR(0x1F, 0x80),
++	ILI9881C_COMMAND_INSTR(0x20, 0x06),
++	ILI9881C_COMMAND_INSTR(0x21, 0x01),
++	ILI9881C_COMMAND_INSTR(0x22, 0x00),
++	ILI9881C_COMMAND_INSTR(0x23, 0x00),
++	ILI9881C_COMMAND_INSTR(0x24, 0x00),
++	ILI9881C_COMMAND_INSTR(0x25, 0x00),
++	ILI9881C_COMMAND_INSTR(0x26, 0x00),
++	ILI9881C_COMMAND_INSTR(0x27, 0x00),
++	ILI9881C_COMMAND_INSTR(0x28, 0x33),
++	ILI9881C_COMMAND_INSTR(0x29, 0x03),
++	ILI9881C_COMMAND_INSTR(0x2A, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2B, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2C, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2D, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2E, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2F, 0x00),
++
++	ILI9881C_COMMAND_INSTR(0x30, 0x00),
++	ILI9881C_COMMAND_INSTR(0x31, 0x00),
++	ILI9881C_COMMAND_INSTR(0x32, 0x00),
++	ILI9881C_COMMAND_INSTR(0x33, 0x00),
++	ILI9881C_COMMAND_INSTR(0x34, 0x04),
++	ILI9881C_COMMAND_INSTR(0x35, 0x00),
++	ILI9881C_COMMAND_INSTR(0x36, 0x00),
++	ILI9881C_COMMAND_INSTR(0x37, 0x00),
++	ILI9881C_COMMAND_INSTR(0x38, 0x3C),
++	ILI9881C_COMMAND_INSTR(0x39, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3A, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3B, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3C, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3D, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3E, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3F, 0x00),
++
++	ILI9881C_COMMAND_INSTR(0x40, 0x00),
++	ILI9881C_COMMAND_INSTR(0x41, 0x00),
++	ILI9881C_COMMAND_INSTR(0x42, 0x00),
++	ILI9881C_COMMAND_INSTR(0x43, 0x00),
++	ILI9881C_COMMAND_INSTR(0x44, 0x00),
++
++	ILI9881C_COMMAND_INSTR(0x50, 0x10),
++	ILI9881C_COMMAND_INSTR(0x51, 0x32),
++	ILI9881C_COMMAND_INSTR(0x52, 0x54),
++	ILI9881C_COMMAND_INSTR(0x53, 0x76),
++	ILI9881C_COMMAND_INSTR(0x54, 0x98),
++	ILI9881C_COMMAND_INSTR(0x55, 0xba),
++	ILI9881C_COMMAND_INSTR(0x56, 0x10),
++	ILI9881C_COMMAND_INSTR(0x57, 0x32),
++	ILI9881C_COMMAND_INSTR(0x58, 0x54),
++	ILI9881C_COMMAND_INSTR(0x59, 0x76),
++	ILI9881C_COMMAND_INSTR(0x5A, 0x98),
++	ILI9881C_COMMAND_INSTR(0x5B, 0xba),
++	ILI9881C_COMMAND_INSTR(0x5C, 0xdc),
++	ILI9881C_COMMAND_INSTR(0x5D, 0xfe),
++
++	//GIP_3
++	ILI9881C_COMMAND_INSTR(0x5E, 0x00),
++	ILI9881C_COMMAND_INSTR(0x5F, 0x01),
++	ILI9881C_COMMAND_INSTR(0x60, 0x00),
++	ILI9881C_COMMAND_INSTR(0x61, 0x15),
++	ILI9881C_COMMAND_INSTR(0x62, 0x14),
++	ILI9881C_COMMAND_INSTR(0x63, 0x0E),
++	ILI9881C_COMMAND_INSTR(0x64, 0x0F),
++	ILI9881C_COMMAND_INSTR(0x65, 0x0C),
++	ILI9881C_COMMAND_INSTR(0x66, 0x0D),
++	ILI9881C_COMMAND_INSTR(0x67, 0x06),
++	ILI9881C_COMMAND_INSTR(0x68, 0x02),
++	ILI9881C_COMMAND_INSTR(0x69, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6A, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6B, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6C, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6D, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6E, 0x07),
++	ILI9881C_COMMAND_INSTR(0x6F, 0x02),
++
++	ILI9881C_COMMAND_INSTR(0x70, 0x02),
++	ILI9881C_COMMAND_INSTR(0x71, 0x02),
++	ILI9881C_COMMAND_INSTR(0x72, 0x02),
++	ILI9881C_COMMAND_INSTR(0x73, 0x02),
++	ILI9881C_COMMAND_INSTR(0x74, 0x02),
++	ILI9881C_COMMAND_INSTR(0x75, 0x01),
++	ILI9881C_COMMAND_INSTR(0x76, 0x00),
++	ILI9881C_COMMAND_INSTR(0x77, 0x14),
++	ILI9881C_COMMAND_INSTR(0x78, 0x15),
++	ILI9881C_COMMAND_INSTR(0x79, 0x0E),
++	ILI9881C_COMMAND_INSTR(0x7A, 0x0F),
++	ILI9881C_COMMAND_INSTR(0x7B, 0x0C),
++	ILI9881C_COMMAND_INSTR(0x7C, 0x0D),
++	ILI9881C_COMMAND_INSTR(0x7D, 0x06),
++	ILI9881C_COMMAND_INSTR(0x7E, 0x02),
++	ILI9881C_COMMAND_INSTR(0x7F, 0x02),
++
++	ILI9881C_COMMAND_INSTR(0x80, 0x02),
++	ILI9881C_COMMAND_INSTR(0x81, 0x02),
++	ILI9881C_COMMAND_INSTR(0x82, 0x02),
++	ILI9881C_COMMAND_INSTR(0x83, 0x02),
++	ILI9881C_COMMAND_INSTR(0x84, 0x07),
++	ILI9881C_COMMAND_INSTR(0x85, 0x02),
++	ILI9881C_COMMAND_INSTR(0x86, 0x02),
++	ILI9881C_COMMAND_INSTR(0x87, 0x02),
++	ILI9881C_COMMAND_INSTR(0x88, 0x02),
++	ILI9881C_COMMAND_INSTR(0x89, 0x02),
++	ILI9881C_COMMAND_INSTR(0x8A, 0x02),
++
++	ILI9881C_SWITCH_PAGE_INSTR(4),
++	ILI9881C_COMMAND_INSTR(0x6C, 0x15),
++	ILI9881C_COMMAND_INSTR(0x6E, 0x2A),
++
++	//clamp 15V
++	ILI9881C_COMMAND_INSTR(0x6F, 0x35),
++	ILI9881C_COMMAND_INSTR(0x3A, 0x92),
++	ILI9881C_COMMAND_INSTR(0x8D, 0x1F),
++	ILI9881C_COMMAND_INSTR(0x87, 0xBA),
++	ILI9881C_COMMAND_INSTR(0x26, 0x76),
++	ILI9881C_COMMAND_INSTR(0xB2, 0xD1),
++	ILI9881C_COMMAND_INSTR(0xB5, 0x27),
++	ILI9881C_COMMAND_INSTR(0x31, 0x75),
++	ILI9881C_COMMAND_INSTR(0x30, 0x03),
++	ILI9881C_COMMAND_INSTR(0x3B, 0x98),
++	ILI9881C_COMMAND_INSTR(0x35, 0x17),
++	ILI9881C_COMMAND_INSTR(0x33, 0x14),
++	ILI9881C_COMMAND_INSTR(0x38, 0x01),
++	ILI9881C_COMMAND_INSTR(0x39, 0x00),
++
++	ILI9881C_SWITCH_PAGE_INSTR(1),
++	// direction rotate
++	//ILI9881C_COMMAND_INSTR(0x22, 0x0B),
++	ILI9881C_COMMAND_INSTR(0x22, 0x0A),
++	ILI9881C_COMMAND_INSTR(0x31, 0x00),
++	ILI9881C_COMMAND_INSTR(0x53, 0x63),
++	ILI9881C_COMMAND_INSTR(0x55, 0x69),
++	ILI9881C_COMMAND_INSTR(0x50, 0xC7),
++	ILI9881C_COMMAND_INSTR(0x51, 0xC2),
++	ILI9881C_COMMAND_INSTR(0x60, 0x26),
++
++	ILI9881C_COMMAND_INSTR(0xA0, 0x08),
++	ILI9881C_COMMAND_INSTR(0xA1, 0x0F),
++	ILI9881C_COMMAND_INSTR(0xA2, 0x25),
++	ILI9881C_COMMAND_INSTR(0xA3, 0x01),
++	ILI9881C_COMMAND_INSTR(0xA4, 0x23),
++	ILI9881C_COMMAND_INSTR(0xA5, 0x18),
++	ILI9881C_COMMAND_INSTR(0xA6, 0x11),
++	ILI9881C_COMMAND_INSTR(0xA7, 0x1A),
++	ILI9881C_COMMAND_INSTR(0xA8, 0x81),
++	ILI9881C_COMMAND_INSTR(0xA9, 0x19),
++	ILI9881C_COMMAND_INSTR(0xAA, 0x26),
++	ILI9881C_COMMAND_INSTR(0xAB, 0x7C),
++	ILI9881C_COMMAND_INSTR(0xAC, 0x24),
++	ILI9881C_COMMAND_INSTR(0xAD, 0x1E),
++	ILI9881C_COMMAND_INSTR(0xAE, 0x5C),
++	ILI9881C_COMMAND_INSTR(0xAF, 0x2A),
++	ILI9881C_COMMAND_INSTR(0xB0, 0x2B),
++	ILI9881C_COMMAND_INSTR(0xB1, 0x50),
++	ILI9881C_COMMAND_INSTR(0xB2, 0x5C),
++	ILI9881C_COMMAND_INSTR(0xB3, 0x39),
++
++	ILI9881C_COMMAND_INSTR(0xC0, 0x08),
++	ILI9881C_COMMAND_INSTR(0xC1, 0x1F),
++	ILI9881C_COMMAND_INSTR(0xC2, 0x24),
++	ILI9881C_COMMAND_INSTR(0xC3, 0x1D),
++	ILI9881C_COMMAND_INSTR(0xC4, 0x04),
++	ILI9881C_COMMAND_INSTR(0xC5, 0x32),
++	ILI9881C_COMMAND_INSTR(0xC6, 0x24),
++	ILI9881C_COMMAND_INSTR(0xC7, 0x1F),
++	ILI9881C_COMMAND_INSTR(0xC8, 0x90),
++	ILI9881C_COMMAND_INSTR(0xC9, 0x20),
++	ILI9881C_COMMAND_INSTR(0xCA, 0x2C),
++	ILI9881C_COMMAND_INSTR(0xCB, 0x82),
++	ILI9881C_COMMAND_INSTR(0xCC, 0x19),
++	ILI9881C_COMMAND_INSTR(0xCD, 0x22),
++	ILI9881C_COMMAND_INSTR(0xCE, 0x4E),
++	ILI9881C_COMMAND_INSTR(0xCF, 0x28),
++	ILI9881C_COMMAND_INSTR(0xD0, 0x2D),
++	ILI9881C_COMMAND_INSTR(0xD1, 0x51),
++	ILI9881C_COMMAND_INSTR(0xD2, 0x5D),
++	ILI9881C_COMMAND_INSTR(0xD3, 0x39),
++
++	ILI9881C_SWITCH_PAGE_INSTR(0),
++	//PWM
++	ILI9881C_COMMAND_INSTR(0x51, 0x0F),
++	ILI9881C_COMMAND_INSTR(0x52, 0xFF),
++	ILI9881C_COMMAND_INSTR(0x53, 0x2C),
++
++	ILI9881C_COMMAND_INSTR(0x11, 0x00),
++	ILI9881C_COMMAND_INSTR(0x29, 0x00),
++	ILI9881C_COMMAND_INSTR(0x35, 0x00),
++};
++
++static const struct ili9881c_instr cfaf7201280a0_050tx_init[] = {
++	//ILI9881C PAGE3
++	ILI9881C_SWITCH_PAGE_INSTR(3),
++	//GIP_1
++	ILI9881C_COMMAND_INSTR(0x01, 0x00), //added
++	ILI9881C_COMMAND_INSTR(0x02, 0x00),
++	ILI9881C_COMMAND_INSTR(0x03, 0x73),
++	ILI9881C_COMMAND_INSTR(0x04, 0x00),
++	ILI9881C_COMMAND_INSTR(0x05, 0x00),
++	ILI9881C_COMMAND_INSTR(0x06, 0x0A),
++	ILI9881C_COMMAND_INSTR(0x07, 0x00),
++	ILI9881C_COMMAND_INSTR(0x08, 0x00),
++	ILI9881C_COMMAND_INSTR(0x09, 0x01),
++	ILI9881C_COMMAND_INSTR(0x0A, 0x00),
++	ILI9881C_COMMAND_INSTR(0x0B, 0x00),
++	ILI9881C_COMMAND_INSTR(0x0C, 0x01),
++	ILI9881C_COMMAND_INSTR(0x0D, 0x00),
++	ILI9881C_COMMAND_INSTR(0x0E, 0x00),
++	ILI9881C_COMMAND_INSTR(0x0F, 0x1D),
++	ILI9881C_COMMAND_INSTR(0x10, 0x1D),
++	ILI9881C_COMMAND_INSTR(0x11, 0x00),
++	ILI9881C_COMMAND_INSTR(0x12, 0x00),
++	ILI9881C_COMMAND_INSTR(0x13, 0x00),
++	ILI9881C_COMMAND_INSTR(0x14, 0x00),
++	ILI9881C_COMMAND_INSTR(0x15, 0x00),
++	ILI9881C_COMMAND_INSTR(0x16, 0x00),
++	ILI9881C_COMMAND_INSTR(0x17, 0x00),
++	ILI9881C_COMMAND_INSTR(0x18, 0x00),
++	ILI9881C_COMMAND_INSTR(0x19, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1A, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1B, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1C, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1D, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1E, 0x40),
++	ILI9881C_COMMAND_INSTR(0x1F, 0x80),
++	ILI9881C_COMMAND_INSTR(0x20, 0x06),
++	ILI9881C_COMMAND_INSTR(0x21, 0x02),
++	ILI9881C_COMMAND_INSTR(0x22, 0x00),
++	ILI9881C_COMMAND_INSTR(0x23, 0x00),
++	ILI9881C_COMMAND_INSTR(0x24, 0x00),
++	ILI9881C_COMMAND_INSTR(0x25, 0x00),
++	ILI9881C_COMMAND_INSTR(0x26, 0x00),
++	ILI9881C_COMMAND_INSTR(0x27, 0x00),
++	ILI9881C_COMMAND_INSTR(0x28, 0x33),
++	ILI9881C_COMMAND_INSTR(0x29, 0x03),
++	ILI9881C_COMMAND_INSTR(0x2A, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2B, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2C, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2D, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2E, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2F, 0x00),
++	ILI9881C_COMMAND_INSTR(0x30, 0x00),
++	ILI9881C_COMMAND_INSTR(0x31, 0x00),
++	ILI9881C_COMMAND_INSTR(0x32, 0x00),
++	ILI9881C_COMMAND_INSTR(0x33, 0x00),
++	ILI9881C_COMMAND_INSTR(0x34, 0x04),
++	ILI9881C_COMMAND_INSTR(0x35, 0x00),
++	ILI9881C_COMMAND_INSTR(0x36, 0x00),
++	ILI9881C_COMMAND_INSTR(0x37, 0x00),
++	ILI9881C_COMMAND_INSTR(0x38, 0x3C),
++	ILI9881C_COMMAND_INSTR(0x39, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3A, 0x40),
++	ILI9881C_COMMAND_INSTR(0x3B, 0x40),
++	ILI9881C_COMMAND_INSTR(0x3C, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3D, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3E, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3F, 0x00),
++	ILI9881C_COMMAND_INSTR(0x40, 0x00),
++	ILI9881C_COMMAND_INSTR(0x41, 0x00),
++	ILI9881C_COMMAND_INSTR(0x42, 0x00),
++	ILI9881C_COMMAND_INSTR(0x43, 0x00),
++	ILI9881C_COMMAND_INSTR(0x44, 0x00),
++	//GIP_2
++	ILI9881C_COMMAND_INSTR(0x50, 0x01),
++	ILI9881C_COMMAND_INSTR(0x51, 0x23),
++	ILI9881C_COMMAND_INSTR(0x52, 0x45),
++	ILI9881C_COMMAND_INSTR(0x53, 0x67),
++	ILI9881C_COMMAND_INSTR(0x54, 0x89),
++	ILI9881C_COMMAND_INSTR(0x55, 0xAB),
++	ILI9881C_COMMAND_INSTR(0x56, 0x01),
++	ILI9881C_COMMAND_INSTR(0x57, 0x23),
++	ILI9881C_COMMAND_INSTR(0x58, 0x45),
++	ILI9881C_COMMAND_INSTR(0x59, 0x67),
++	ILI9881C_COMMAND_INSTR(0x5A, 0x89),
++	ILI9881C_COMMAND_INSTR(0x5B, 0xAB),
++	ILI9881C_COMMAND_INSTR(0x5C, 0xCD),
++	ILI9881C_COMMAND_INSTR(0x5D, 0xEF),
++	//GIP_3
++	ILI9881C_COMMAND_INSTR(0x5E, 0x11),
++	ILI9881C_COMMAND_INSTR(0x5F, 0x01),
++	ILI9881C_COMMAND_INSTR(0x60, 0x00),
++	ILI9881C_COMMAND_INSTR(0x61, 0x15),
++	ILI9881C_COMMAND_INSTR(0x62, 0x14),
++	ILI9881C_COMMAND_INSTR(0x63, 0x0E),
++	ILI9881C_COMMAND_INSTR(0x64, 0x0F),
++	ILI9881C_COMMAND_INSTR(0x65, 0x0C),
++	ILI9881C_COMMAND_INSTR(0x66, 0x0D),
++	ILI9881C_COMMAND_INSTR(0x67, 0x06),
++	ILI9881C_COMMAND_INSTR(0x68, 0x02),
++	ILI9881C_COMMAND_INSTR(0x69, 0x07),
++	ILI9881C_COMMAND_INSTR(0x6A, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6B, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6C, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6D, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6E, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6F, 0x02),
++	ILI9881C_COMMAND_INSTR(0x70, 0x02),
++	ILI9881C_COMMAND_INSTR(0x71, 0x02),
++	ILI9881C_COMMAND_INSTR(0x72, 0x02),
++	ILI9881C_COMMAND_INSTR(0x73, 0x02),
++	ILI9881C_COMMAND_INSTR(0x74, 0x02),
++	ILI9881C_COMMAND_INSTR(0x75, 0x01),
++	ILI9881C_COMMAND_INSTR(0x76, 0x00),
++	ILI9881C_COMMAND_INSTR(0x77, 0x14),
++	ILI9881C_COMMAND_INSTR(0x78, 0x15),
++	ILI9881C_COMMAND_INSTR(0x79, 0x0E),
++	ILI9881C_COMMAND_INSTR(0x7A, 0x0F),
++	ILI9881C_COMMAND_INSTR(0x7B, 0x0C),
++	ILI9881C_COMMAND_INSTR(0x7C, 0x0D),
++	ILI9881C_COMMAND_INSTR(0x7D, 0x06),
++	ILI9881C_COMMAND_INSTR(0x7E, 0x02),
++	ILI9881C_COMMAND_INSTR(0x7F, 0x07),
++	ILI9881C_COMMAND_INSTR(0x80, 0x02),
++	ILI9881C_COMMAND_INSTR(0x81, 0x02),
++	ILI9881C_COMMAND_INSTR(0x82, 0x02),
++	ILI9881C_COMMAND_INSTR(0x83, 0x02),
++	ILI9881C_COMMAND_INSTR(0x84, 0x02),
++	ILI9881C_COMMAND_INSTR(0x85, 0x02),
++	ILI9881C_COMMAND_INSTR(0x86, 0x02),
++	ILI9881C_COMMAND_INSTR(0x87, 0x02),
++	ILI9881C_COMMAND_INSTR(0x88, 0x02),
++	ILI9881C_COMMAND_INSTR(0x89, 0x02),
++	ILI9881C_COMMAND_INSTR(0x8A, 0x02),
++	//ILI9881C PAGE4
++	ILI9881C_SWITCH_PAGE_INSTR(4),
++	ILI9881C_COMMAND_INSTR(0x6C, 0x15),
++	ILI9881C_COMMAND_INSTR(0x6E, 0x2B),
++	// VGH & VGL OUTPUT
++	ILI9881C_COMMAND_INSTR(0x6F, 0x33),
++	ILI9881C_COMMAND_INSTR(0x8D, 0x18),
++	ILI9881C_COMMAND_INSTR(0x87, 0xBA),
++	ILI9881C_COMMAND_INSTR(0x26, 0x76),
++	//Reload Gamma setting
++	ILI9881C_COMMAND_INSTR(0xB2, 0xD1),
++	ILI9881C_COMMAND_INSTR(0xB5, 0x06),
++	ILI9881C_COMMAND_INSTR(0x3A, 0x24),
++	ILI9881C_COMMAND_INSTR(0x35, 0x1F),
++
++	//ILI9881C PAGE1
++	ILI9881C_SWITCH_PAGE_INSTR(1),
++	ILI9881C_COMMAND_INSTR(0x22, 0x09),
++	//Column inversion
++	ILI9881C_COMMAND_INSTR(0x31, 0x00),
++	ILI9881C_COMMAND_INSTR(0x40, 0x33),
++	ILI9881C_COMMAND_INSTR(0x53, 0xA2),
++	ILI9881C_COMMAND_INSTR(0x55, 0x92),
++	ILI9881C_COMMAND_INSTR(0x50, 0x96),
++	ILI9881C_COMMAND_INSTR(0x51, 0x96),
++	ILI9881C_COMMAND_INSTR(0x60, 0x22),
++	ILI9881C_COMMAND_INSTR(0x61, 0x00),
++	ILI9881C_COMMAND_INSTR(0x62, 0x19),
++	ILI9881C_COMMAND_INSTR(0x63, 0x00),
++	//---P-GAMMA START---
++	ILI9881C_COMMAND_INSTR(0xA0, 0x08),
++	ILI9881C_COMMAND_INSTR(0xA1, 0x11),
++	ILI9881C_COMMAND_INSTR(0xA2, 0x19),
++	ILI9881C_COMMAND_INSTR(0xA3, 0x0D),
++	ILI9881C_COMMAND_INSTR(0xA4, 0x0D),
++	ILI9881C_COMMAND_INSTR(0xA5, 0x1E),
++	ILI9881C_COMMAND_INSTR(0xA6, 0x14),
++	ILI9881C_COMMAND_INSTR(0xA7, 0x17),
++	ILI9881C_COMMAND_INSTR(0xA8, 0x4F),
++	ILI9881C_COMMAND_INSTR(0xA9, 0x1A),
++	ILI9881C_COMMAND_INSTR(0xAA, 0x27),
++	ILI9881C_COMMAND_INSTR(0xAB, 0x49),
++	ILI9881C_COMMAND_INSTR(0xAC, 0x1A),
++	ILI9881C_COMMAND_INSTR(0xAD, 0x18),
++	ILI9881C_COMMAND_INSTR(0xAE, 0x4C),
++	ILI9881C_COMMAND_INSTR(0xAF, 0x22),
++	ILI9881C_COMMAND_INSTR(0xB0, 0x27),
++	ILI9881C_COMMAND_INSTR(0xB1, 0x4B),
++	ILI9881C_COMMAND_INSTR(0xB2, 0x60),
++	ILI9881C_COMMAND_INSTR(0xB3, 0x39),
++	//--- N-GAMMA START---
++	ILI9881C_COMMAND_INSTR(0xC0, 0x08),
++	ILI9881C_COMMAND_INSTR(0xC1, 0x11),
++	ILI9881C_COMMAND_INSTR(0xC2, 0x19),
++	ILI9881C_COMMAND_INSTR(0xC3, 0x0D),
++	ILI9881C_COMMAND_INSTR(0xC4, 0x0D),
++	ILI9881C_COMMAND_INSTR(0xC5, 0x1E),
++	ILI9881C_COMMAND_INSTR(0xC6, 0x14),
++	ILI9881C_COMMAND_INSTR(0xC7, 0x17),
++	ILI9881C_COMMAND_INSTR(0xC8, 0x4F),
++	ILI9881C_COMMAND_INSTR(0xC9, 0x1A),
++	ILI9881C_COMMAND_INSTR(0xCA, 0x27),
++	ILI9881C_COMMAND_INSTR(0xCB, 0x49),
++	ILI9881C_COMMAND_INSTR(0xCC, 0x1A),
++	ILI9881C_COMMAND_INSTR(0xCD, 0x18),
++	ILI9881C_COMMAND_INSTR(0xCE, 0x4C),
++	ILI9881C_COMMAND_INSTR(0xCF, 0x33),
++	ILI9881C_COMMAND_INSTR(0xD0, 0x27),
++	ILI9881C_COMMAND_INSTR(0xD1, 0x4B),
++	ILI9881C_COMMAND_INSTR(0xD2, 0x60),
++	ILI9881C_COMMAND_INSTR(0xD3, 0x39),
++};
++
++static const struct ili9881c_instr rpi_5inch_init[] = {
++	ILI9881C_SWITCH_PAGE_INSTR(3),
++	ILI9881C_COMMAND_INSTR(0x01, 0x00),
++	ILI9881C_COMMAND_INSTR(0x02, 0x00),
++	ILI9881C_COMMAND_INSTR(0x03, 0x73),
++	ILI9881C_COMMAND_INSTR(0x04, 0x73),
++	ILI9881C_COMMAND_INSTR(0x05, 0x00),
++	ILI9881C_COMMAND_INSTR(0x06, 0x06),
++	ILI9881C_COMMAND_INSTR(0x07, 0x02),
++	ILI9881C_COMMAND_INSTR(0x08, 0x00),
++	ILI9881C_COMMAND_INSTR(0x09, 0x01),
++	ILI9881C_COMMAND_INSTR(0x0a, 0x01),
++	ILI9881C_COMMAND_INSTR(0x0b, 0x01),
++	ILI9881C_COMMAND_INSTR(0x0c, 0x01),
++	ILI9881C_COMMAND_INSTR(0x0d, 0x01),
++	ILI9881C_COMMAND_INSTR(0x0e, 0x01),
++	ILI9881C_COMMAND_INSTR(0x0f, 0x01),
++	ILI9881C_COMMAND_INSTR(0x10, 0x01),
++	ILI9881C_COMMAND_INSTR(0x11, 0x00),
++	ILI9881C_COMMAND_INSTR(0x12, 0x00),
++	ILI9881C_COMMAND_INSTR(0x13, 0x01),
++	ILI9881C_COMMAND_INSTR(0x14, 0x00),
++	ILI9881C_COMMAND_INSTR(0x15, 0x00),
++	ILI9881C_COMMAND_INSTR(0x16, 0x00),
++	ILI9881C_COMMAND_INSTR(0x17, 0x00),
++	ILI9881C_COMMAND_INSTR(0x18, 0x00),
++	ILI9881C_COMMAND_INSTR(0x19, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1a, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1b, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1c, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1d, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1e, 0xc0),
++	ILI9881C_COMMAND_INSTR(0x1f, 0x80),
++	ILI9881C_COMMAND_INSTR(0x20, 0x04),
++	ILI9881C_COMMAND_INSTR(0x21, 0x03),
++	ILI9881C_COMMAND_INSTR(0x22, 0x00),
++	ILI9881C_COMMAND_INSTR(0x23, 0x00),
++	ILI9881C_COMMAND_INSTR(0x24, 0x00),
++	ILI9881C_COMMAND_INSTR(0x25, 0x00),
++	ILI9881C_COMMAND_INSTR(0x26, 0x00),
++	ILI9881C_COMMAND_INSTR(0x27, 0x00),
++	ILI9881C_COMMAND_INSTR(0x28, 0x33),
++	ILI9881C_COMMAND_INSTR(0x29, 0x03),
++	ILI9881C_COMMAND_INSTR(0x2a, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2b, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2c, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2d, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2e, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2f, 0x00),
++	ILI9881C_COMMAND_INSTR(0x30, 0x00),
++	ILI9881C_COMMAND_INSTR(0x31, 0x00),
++	ILI9881C_COMMAND_INSTR(0x32, 0x00),
++	ILI9881C_COMMAND_INSTR(0x33, 0x00),
++	ILI9881C_COMMAND_INSTR(0x34, 0x03),
++	ILI9881C_COMMAND_INSTR(0x35, 0x00),
++	ILI9881C_COMMAND_INSTR(0x36, 0x03),
++	ILI9881C_COMMAND_INSTR(0x37, 0x00),
++	ILI9881C_COMMAND_INSTR(0x38, 0x00),
++	ILI9881C_COMMAND_INSTR(0x39, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3a, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3b, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3c, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3d, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3e, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3f, 0x00),
++	ILI9881C_COMMAND_INSTR(0x40, 0x00),
++	ILI9881C_COMMAND_INSTR(0x41, 0x00),
++	ILI9881C_COMMAND_INSTR(0x42, 0x00),
++	ILI9881C_COMMAND_INSTR(0x43, 0x00),
++	ILI9881C_COMMAND_INSTR(0x44, 0x00),
++	ILI9881C_COMMAND_INSTR(0x50, 0x01),
++	ILI9881C_COMMAND_INSTR(0x51, 0x23),
++	ILI9881C_COMMAND_INSTR(0x52, 0x45),
++	ILI9881C_COMMAND_INSTR(0x53, 0x67),
++	ILI9881C_COMMAND_INSTR(0x54, 0x89),
++	ILI9881C_COMMAND_INSTR(0x55, 0xab),
++	ILI9881C_COMMAND_INSTR(0x56, 0x01),
++	ILI9881C_COMMAND_INSTR(0x57, 0x23),
++	ILI9881C_COMMAND_INSTR(0x58, 0x45),
++	ILI9881C_COMMAND_INSTR(0x59, 0x67),
++	ILI9881C_COMMAND_INSTR(0x5a, 0x89),
++	ILI9881C_COMMAND_INSTR(0x5b, 0xab),
++	ILI9881C_COMMAND_INSTR(0x5c, 0xcd),
++	ILI9881C_COMMAND_INSTR(0x5d, 0xef),
++	ILI9881C_COMMAND_INSTR(0x5e, 0x10),
++	ILI9881C_COMMAND_INSTR(0x5f, 0x09),
++	ILI9881C_COMMAND_INSTR(0x60, 0x08),
++	ILI9881C_COMMAND_INSTR(0x61, 0x0f),
++	ILI9881C_COMMAND_INSTR(0x62, 0x0e),
++	ILI9881C_COMMAND_INSTR(0x63, 0x0d),
++	ILI9881C_COMMAND_INSTR(0x64, 0x0c),
++	ILI9881C_COMMAND_INSTR(0x65, 0x02),
++	ILI9881C_COMMAND_INSTR(0x66, 0x02),
++	ILI9881C_COMMAND_INSTR(0x67, 0x02),
++	ILI9881C_COMMAND_INSTR(0x68, 0x02),
++	ILI9881C_COMMAND_INSTR(0x69, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6a, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6b, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6c, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6d, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6e, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6f, 0x02),
++	ILI9881C_COMMAND_INSTR(0x70, 0x02),
++	ILI9881C_COMMAND_INSTR(0x71, 0x06),
++	ILI9881C_COMMAND_INSTR(0x72, 0x07),
++	ILI9881C_COMMAND_INSTR(0x73, 0x02),
++	ILI9881C_COMMAND_INSTR(0x74, 0x02),
++	ILI9881C_COMMAND_INSTR(0x75, 0x06),
++	ILI9881C_COMMAND_INSTR(0x76, 0x07),
++	ILI9881C_COMMAND_INSTR(0x77, 0x0e),
++	ILI9881C_COMMAND_INSTR(0x78, 0x0f),
++	ILI9881C_COMMAND_INSTR(0x79, 0x0c),
++	ILI9881C_COMMAND_INSTR(0x7a, 0x0d),
++	ILI9881C_COMMAND_INSTR(0x7b, 0x02),
++	ILI9881C_COMMAND_INSTR(0x7c, 0x02),
++	ILI9881C_COMMAND_INSTR(0x7d, 0x02),
++	ILI9881C_COMMAND_INSTR(0x7e, 0x02),
++	ILI9881C_COMMAND_INSTR(0x7f, 0x02),
++	ILI9881C_COMMAND_INSTR(0x80, 0x02),
++	ILI9881C_COMMAND_INSTR(0x81, 0x02),
++	ILI9881C_COMMAND_INSTR(0x82, 0x02),
++	ILI9881C_COMMAND_INSTR(0x83, 0x02),
++	ILI9881C_COMMAND_INSTR(0x84, 0x02),
++	ILI9881C_COMMAND_INSTR(0x85, 0x02),
++	ILI9881C_COMMAND_INSTR(0x86, 0x02),
++	ILI9881C_COMMAND_INSTR(0x87, 0x09),
++	ILI9881C_COMMAND_INSTR(0x88, 0x08),
++	ILI9881C_COMMAND_INSTR(0x89, 0x02),
++	ILI9881C_COMMAND_INSTR(0x8A, 0x02),
++	ILI9881C_SWITCH_PAGE_INSTR(4),
++	ILI9881C_COMMAND_INSTR(0x6C, 0x15),
++	ILI9881C_COMMAND_INSTR(0x6E, 0x2a),
++	ILI9881C_COMMAND_INSTR(0x6F, 0x57),
++	ILI9881C_COMMAND_INSTR(0x3A, 0xa4),
++	ILI9881C_COMMAND_INSTR(0x8D, 0x1a),
++	ILI9881C_COMMAND_INSTR(0x87, 0xba),
++	ILI9881C_COMMAND_INSTR(0x26, 0x76),
++	ILI9881C_COMMAND_INSTR(0xB2, 0xd1),
++	ILI9881C_SWITCH_PAGE_INSTR(1),
++	ILI9881C_COMMAND_INSTR(0x22, 0x0A),
++	ILI9881C_COMMAND_INSTR(0x31, 0x00),
++	ILI9881C_COMMAND_INSTR(0x53, 0x35),
++	ILI9881C_COMMAND_INSTR(0x55, 0x50),
++	ILI9881C_COMMAND_INSTR(0x50, 0xaf),
++	ILI9881C_COMMAND_INSTR(0x51, 0xaf),
++	ILI9881C_COMMAND_INSTR(0x60, 0x14),
++	ILI9881C_COMMAND_INSTR(0xA0, 0x08),
++	ILI9881C_COMMAND_INSTR(0xA1, 0x1d),
++	ILI9881C_COMMAND_INSTR(0xA2, 0x2c),
++	ILI9881C_COMMAND_INSTR(0xA3, 0x14),
++	ILI9881C_COMMAND_INSTR(0xA4, 0x19),
++	ILI9881C_COMMAND_INSTR(0xA5, 0x2e),
++	ILI9881C_COMMAND_INSTR(0xA6, 0x22),
++	ILI9881C_COMMAND_INSTR(0xA7, 0x23),
++	ILI9881C_COMMAND_INSTR(0xA8, 0x97),
++	ILI9881C_COMMAND_INSTR(0xA9, 0x1e),
++	ILI9881C_COMMAND_INSTR(0xAA, 0x29),
++	ILI9881C_COMMAND_INSTR(0xAB, 0x7b),
++	ILI9881C_COMMAND_INSTR(0xAC, 0x18),
++	ILI9881C_COMMAND_INSTR(0xAD, 0x17),
++	ILI9881C_COMMAND_INSTR(0xAE, 0x4b),
++	ILI9881C_COMMAND_INSTR(0xAF, 0x1f),
++	ILI9881C_COMMAND_INSTR(0xB0, 0x27),
++	ILI9881C_COMMAND_INSTR(0xB1, 0x52),
++	ILI9881C_COMMAND_INSTR(0xB2, 0x63),
++	ILI9881C_COMMAND_INSTR(0xB3, 0x39),
++	ILI9881C_COMMAND_INSTR(0xC0, 0x08),
++	ILI9881C_COMMAND_INSTR(0xC1, 0x1d),
++	ILI9881C_COMMAND_INSTR(0xC2, 0x2c),
++	ILI9881C_COMMAND_INSTR(0xC3, 0x14),
++	ILI9881C_COMMAND_INSTR(0xC4, 0x19),
++	ILI9881C_COMMAND_INSTR(0xC5, 0x2e),
++	ILI9881C_COMMAND_INSTR(0xC6, 0x22),
++	ILI9881C_COMMAND_INSTR(0xC7, 0x23),
++	ILI9881C_COMMAND_INSTR(0xC8, 0x97),
++	ILI9881C_COMMAND_INSTR(0xC9, 0x1e),
++	ILI9881C_COMMAND_INSTR(0xCA, 0x29),
++	ILI9881C_COMMAND_INSTR(0xCB, 0x7b),
++	ILI9881C_COMMAND_INSTR(0xCC, 0x18),
++	ILI9881C_COMMAND_INSTR(0xCD, 0x17),
++	ILI9881C_COMMAND_INSTR(0xCE, 0x4b),
++	ILI9881C_COMMAND_INSTR(0xCF, 0x1f),
++	ILI9881C_COMMAND_INSTR(0xD0, 0x27),
++	ILI9881C_COMMAND_INSTR(0xD1, 0x52),
++	ILI9881C_COMMAND_INSTR(0xD2, 0x63),
++	ILI9881C_COMMAND_INSTR(0xD3, 0x39),
++};
++
++static const struct ili9881c_instr rpi_7inch_init[] = {
++	ILI9881C_SWITCH_PAGE_INSTR(3),
++	ILI9881C_COMMAND_INSTR(0x01, 0x00),
++	ILI9881C_COMMAND_INSTR(0x02, 0x00),
++	ILI9881C_COMMAND_INSTR(0x03, 0x73),
++	ILI9881C_COMMAND_INSTR(0x04, 0x00),
++	ILI9881C_COMMAND_INSTR(0x05, 0x00),
++	ILI9881C_COMMAND_INSTR(0x06, 0x0a),
++	ILI9881C_COMMAND_INSTR(0x07, 0x00),
++	ILI9881C_COMMAND_INSTR(0x08, 0x00),
++	ILI9881C_COMMAND_INSTR(0x09, 0x61),
++	ILI9881C_COMMAND_INSTR(0x0a, 0x00),
++	ILI9881C_COMMAND_INSTR(0x0b, 0x00),
++	ILI9881C_COMMAND_INSTR(0x0c, 0x01),
++	ILI9881C_COMMAND_INSTR(0x0d, 0x00),
++	ILI9881C_COMMAND_INSTR(0x0e, 0x00),
++	ILI9881C_COMMAND_INSTR(0x0f, 0x61),
++	ILI9881C_COMMAND_INSTR(0x10, 0x61),
++	ILI9881C_COMMAND_INSTR(0x11, 0x00),
++	ILI9881C_COMMAND_INSTR(0x12, 0x00),
++	ILI9881C_COMMAND_INSTR(0x13, 0x00),
++	ILI9881C_COMMAND_INSTR(0x14, 0x00),
++	ILI9881C_COMMAND_INSTR(0x15, 0x00),
++	ILI9881C_COMMAND_INSTR(0x16, 0x00),
++	ILI9881C_COMMAND_INSTR(0x17, 0x00),
++	ILI9881C_COMMAND_INSTR(0x18, 0x00),
++	ILI9881C_COMMAND_INSTR(0x19, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1a, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1b, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1c, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1d, 0x00),
++	ILI9881C_COMMAND_INSTR(0x1e, 0x40),
++	ILI9881C_COMMAND_INSTR(0x1f, 0x80),
++	ILI9881C_COMMAND_INSTR(0x20, 0x06),
++	ILI9881C_COMMAND_INSTR(0x21, 0x01),
++	ILI9881C_COMMAND_INSTR(0x22, 0x00),
++	ILI9881C_COMMAND_INSTR(0x23, 0x00),
++	ILI9881C_COMMAND_INSTR(0x24, 0x00),
++	ILI9881C_COMMAND_INSTR(0x25, 0x00),
++	ILI9881C_COMMAND_INSTR(0x26, 0x00),
++	ILI9881C_COMMAND_INSTR(0x27, 0x00),
++	ILI9881C_COMMAND_INSTR(0x28, 0x33),
++	ILI9881C_COMMAND_INSTR(0x29, 0x03),
++	ILI9881C_COMMAND_INSTR(0x2a, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2b, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2c, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2d, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2e, 0x00),
++	ILI9881C_COMMAND_INSTR(0x2f, 0x00),
++	ILI9881C_COMMAND_INSTR(0x30, 0x00),
++	ILI9881C_COMMAND_INSTR(0x31, 0x00),
++	ILI9881C_COMMAND_INSTR(0x32, 0x00),
++	ILI9881C_COMMAND_INSTR(0x33, 0x00),
++	ILI9881C_COMMAND_INSTR(0x34, 0x04),
++	ILI9881C_COMMAND_INSTR(0x35, 0x00),
++	ILI9881C_COMMAND_INSTR(0x36, 0x00),
++	ILI9881C_COMMAND_INSTR(0x37, 0x00),
++	ILI9881C_COMMAND_INSTR(0x38, 0x3c),
++	ILI9881C_COMMAND_INSTR(0x39, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3a, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3b, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3c, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3d, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3e, 0x00),
++	ILI9881C_COMMAND_INSTR(0x3f, 0x00),
++	ILI9881C_COMMAND_INSTR(0x40, 0x00),
++	ILI9881C_COMMAND_INSTR(0x41, 0x00),
++	ILI9881C_COMMAND_INSTR(0x42, 0x00),
++	ILI9881C_COMMAND_INSTR(0x43, 0x00),
++	ILI9881C_COMMAND_INSTR(0x44, 0x00),
++	ILI9881C_COMMAND_INSTR(0x50, 0x10),
++	ILI9881C_COMMAND_INSTR(0x51, 0x32),
++	ILI9881C_COMMAND_INSTR(0x52, 0x54),
++	ILI9881C_COMMAND_INSTR(0x53, 0x76),
++	ILI9881C_COMMAND_INSTR(0x54, 0x98),
++	ILI9881C_COMMAND_INSTR(0x55, 0xba),
++	ILI9881C_COMMAND_INSTR(0x56, 0x10),
++	ILI9881C_COMMAND_INSTR(0x57, 0x32),
++	ILI9881C_COMMAND_INSTR(0x58, 0x54),
++	ILI9881C_COMMAND_INSTR(0x59, 0x76),
++	ILI9881C_COMMAND_INSTR(0x5a, 0x98),
++	ILI9881C_COMMAND_INSTR(0x5b, 0xba),
++	ILI9881C_COMMAND_INSTR(0x5c, 0xdc),
++	ILI9881C_COMMAND_INSTR(0x5d, 0xfe),
++	ILI9881C_COMMAND_INSTR(0x5e, 0x00),
++	ILI9881C_COMMAND_INSTR(0x5f, 0x0e),
++	ILI9881C_COMMAND_INSTR(0x60, 0x0f),
++	ILI9881C_COMMAND_INSTR(0x61, 0x0c),
++	ILI9881C_COMMAND_INSTR(0x62, 0x0d),
++	ILI9881C_COMMAND_INSTR(0x63, 0x06),
++	ILI9881C_COMMAND_INSTR(0x64, 0x07),
++	ILI9881C_COMMAND_INSTR(0x65, 0x02),
++	ILI9881C_COMMAND_INSTR(0x66, 0x02),
++	ILI9881C_COMMAND_INSTR(0x67, 0x02),
++	ILI9881C_COMMAND_INSTR(0x68, 0x02),
++	ILI9881C_COMMAND_INSTR(0x69, 0x01),
++	ILI9881C_COMMAND_INSTR(0x6a, 0x00),
++	ILI9881C_COMMAND_INSTR(0x6b, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6c, 0x15),
++	ILI9881C_COMMAND_INSTR(0x6d, 0x14),
++	ILI9881C_COMMAND_INSTR(0x6e, 0x02),
++	ILI9881C_COMMAND_INSTR(0x6f, 0x02),
++	ILI9881C_COMMAND_INSTR(0x70, 0x02),
++	ILI9881C_COMMAND_INSTR(0x71, 0x02),
++	ILI9881C_COMMAND_INSTR(0x72, 0x02),
++	ILI9881C_COMMAND_INSTR(0x73, 0x02),
++	ILI9881C_COMMAND_INSTR(0x74, 0x02),
++	ILI9881C_COMMAND_INSTR(0x75, 0x0e),
++	ILI9881C_COMMAND_INSTR(0x76, 0x0f),
++	ILI9881C_COMMAND_INSTR(0x77, 0x0c),
++	ILI9881C_COMMAND_INSTR(0x78, 0x0d),
++	ILI9881C_COMMAND_INSTR(0x79, 0x06),
++	ILI9881C_COMMAND_INSTR(0x7a, 0x07),
++	ILI9881C_COMMAND_INSTR(0x7b, 0x02),
++	ILI9881C_COMMAND_INSTR(0x7c, 0x02),
++	ILI9881C_COMMAND_INSTR(0x7d, 0x02),
++	ILI9881C_COMMAND_INSTR(0x7e, 0x02),
++	ILI9881C_COMMAND_INSTR(0x7f, 0x01),
++	ILI9881C_COMMAND_INSTR(0x80, 0x00),
++	ILI9881C_COMMAND_INSTR(0x81, 0x02),
++	ILI9881C_COMMAND_INSTR(0x82, 0x14),
++	ILI9881C_COMMAND_INSTR(0x83, 0x15),
++	ILI9881C_COMMAND_INSTR(0x84, 0x02),
++	ILI9881C_COMMAND_INSTR(0x85, 0x02),
++	ILI9881C_COMMAND_INSTR(0x86, 0x02),
++	ILI9881C_COMMAND_INSTR(0x87, 0x02),
++	ILI9881C_COMMAND_INSTR(0x88, 0x02),
++	ILI9881C_COMMAND_INSTR(0x89, 0x02),
++	ILI9881C_COMMAND_INSTR(0x8A, 0x02),
++	ILI9881C_SWITCH_PAGE_INSTR(4),
++	ILI9881C_COMMAND_INSTR(0x6C, 0x15),
++	ILI9881C_COMMAND_INSTR(0x6E, 0x2A),
++	ILI9881C_COMMAND_INSTR(0x6F, 0x33),
++	ILI9881C_COMMAND_INSTR(0x3B, 0x98),
++	ILI9881C_COMMAND_INSTR(0x3a, 0x94),
++	ILI9881C_COMMAND_INSTR(0x8D, 0x14),
++	ILI9881C_COMMAND_INSTR(0x87, 0xBA),
++	ILI9881C_COMMAND_INSTR(0x26, 0x76),
++	ILI9881C_COMMAND_INSTR(0xB2, 0xD1),
++	ILI9881C_COMMAND_INSTR(0xB5, 0x06),
++	ILI9881C_COMMAND_INSTR(0x38, 0x01),
++	ILI9881C_COMMAND_INSTR(0x39, 0x00),
++	ILI9881C_SWITCH_PAGE_INSTR(1),
++	ILI9881C_COMMAND_INSTR(0x22, 0x0A),
++	ILI9881C_COMMAND_INSTR(0x31, 0x00),
++	ILI9881C_COMMAND_INSTR(0x53, 0x7d),
++	ILI9881C_COMMAND_INSTR(0x55, 0x8f),
++	ILI9881C_COMMAND_INSTR(0x40, 0x33),
++	ILI9881C_COMMAND_INSTR(0x50, 0x96),
++	ILI9881C_COMMAND_INSTR(0x51, 0x96),
++	ILI9881C_COMMAND_INSTR(0x60, 0x23),
++	ILI9881C_COMMAND_INSTR(0xA0, 0x08),
++	ILI9881C_COMMAND_INSTR(0xA1, 0x1d),
++	ILI9881C_COMMAND_INSTR(0xA2, 0x2a),
++	ILI9881C_COMMAND_INSTR(0xA3, 0x10),
++	ILI9881C_COMMAND_INSTR(0xA4, 0x15),
++	ILI9881C_COMMAND_INSTR(0xA5, 0x28),
++	ILI9881C_COMMAND_INSTR(0xA6, 0x1c),
++	ILI9881C_COMMAND_INSTR(0xA7, 0x1d),
++	ILI9881C_COMMAND_INSTR(0xA8, 0x7e),
++	ILI9881C_COMMAND_INSTR(0xA9, 0x1d),
++	ILI9881C_COMMAND_INSTR(0xAA, 0x29),
++	ILI9881C_COMMAND_INSTR(0xAB, 0x6b),
++	ILI9881C_COMMAND_INSTR(0xAC, 0x1a),
++	ILI9881C_COMMAND_INSTR(0xAD, 0x18),
++	ILI9881C_COMMAND_INSTR(0xAE, 0x4b),
++	ILI9881C_COMMAND_INSTR(0xAF, 0x20),
++	ILI9881C_COMMAND_INSTR(0xB0, 0x27),
++	ILI9881C_COMMAND_INSTR(0xB1, 0x50),
++	ILI9881C_COMMAND_INSTR(0xB2, 0x64),
++	ILI9881C_COMMAND_INSTR(0xB3, 0x39),
++	ILI9881C_COMMAND_INSTR(0xC0, 0x08),
++	ILI9881C_COMMAND_INSTR(0xC1, 0x1d),
++	ILI9881C_COMMAND_INSTR(0xC2, 0x2a),
++	ILI9881C_COMMAND_INSTR(0xC3, 0x10),
++	ILI9881C_COMMAND_INSTR(0xC4, 0x15),
++	ILI9881C_COMMAND_INSTR(0xC5, 0x28),
++	ILI9881C_COMMAND_INSTR(0xC6, 0x1c),
++	ILI9881C_COMMAND_INSTR(0xC7, 0x1d),
++	ILI9881C_COMMAND_INSTR(0xC8, 0x7e),
++	ILI9881C_COMMAND_INSTR(0xC9, 0x1d),
++	ILI9881C_COMMAND_INSTR(0xCA, 0x29),
++	ILI9881C_COMMAND_INSTR(0xCB, 0x6b),
++	ILI9881C_COMMAND_INSTR(0xCC, 0x1a),
++	ILI9881C_COMMAND_INSTR(0xCD, 0x18),
++	ILI9881C_COMMAND_INSTR(0xCE, 0x4b),
++	ILI9881C_COMMAND_INSTR(0xCF, 0x20),
++	ILI9881C_COMMAND_INSTR(0xD0, 0x27),
++	ILI9881C_COMMAND_INSTR(0xD1, 0x50),
++	ILI9881C_COMMAND_INSTR(0xD2, 0x64),
++	ILI9881C_COMMAND_INSTR(0xD3, 0x39),
++};
++
+ static inline struct ili9881c *panel_to_ili9881c(struct drm_panel *panel)
+ {
+ 	return container_of(panel, struct ili9881c, panel);
+@@ -1441,6 +2254,71 @@ static const struct drm_display_mode am8
+ 	.height_mm	= 151,
+ };
+ 
++static const struct drm_display_mode nwe080_default_mode = {
++	.clock          = 71750,
++
++	.hdisplay       = 800,
++	.hsync_start    = 800 + 52,
++	.hsync_end      = 800 + 52 + 8,
++	.htotal         = 800 + 52 + 8 + 48,
++
++	.vdisplay       = 1280,
++	.vsync_start    = 1280 + 16,
++	.vsync_end      = 1280 + 16 + 6,
++	.vtotal         = 1280 + 16 + 6 + 15,
++
++	.width_mm       = 107,
++	.height_mm      = 170,
++};
++
++static const struct drm_display_mode cfaf7201280a0_050tx_default_mode = {
++	.clock		= 72830,
++	.hdisplay	= 720,
++	.hsync_start	= 720 + 87,
++	.hsync_end	= 720 + 87 + 20,
++	.htotal		= 720 + 87 + 20 + 87,
++	.vdisplay	= 1280,
++	.vsync_start	= 1280 + 16,
++	.vsync_end	= 1280 + 16 + 8,
++	.vtotal		= 1280 + 16 + 8 + 16,
++	.width_mm	= 62,
++	.height_mm	= 1108
++};
++
++static const struct drm_display_mode rpi_5inch_default_mode = {
++	.clock		= 83333,
++
++	.hdisplay	= 720,
++	.hsync_start	= 720 + 110,
++	.hsync_end	= 720 + 110 + 2,
++	.htotal		= 720 + 110 + 2 + 105,
++
++	.vdisplay	= 1280,
++	.vsync_start	= 1280 + 100,
++	.vsync_end	= 1280 + 100 + 2,
++	.vtotal		= 1280 + 100 + 2 + 100,
++
++	.width_mm	= 62,
++	.height_mm	= 110,
++};
++
++static const struct drm_display_mode rpi_7inch_default_mode = {
++	.clock          = 83330,
++
++	.hdisplay	= 720,
++	.hsync_start	= 720 + 239,
++	.hsync_end	= 720 + 239 + 33,
++	.htotal		= 720 + 239 + 33 + 50,
++
++	.vdisplay	= 1280,
++	.vsync_start	= 1280 + 20,
++	.vsync_end	= 1280 + 20 + 2,
++	.vtotal		= 1280 + 20 + 2 + 30,
++
++	.width_mm	= 90,
++	.height_mm	= 151,
++};
++
+ static int ili9881c_get_modes(struct drm_panel *panel,
+ 			      struct drm_connector *connector)
+ {
+@@ -1501,6 +2379,7 @@ static int ili9881c_dsi_probe(struct mip
+ 	ctx->dsi = dsi;
+ 	ctx->desc = of_device_get_match_data(&dsi->dev);
+ 
++	ctx->panel.prepare_prev_first = true;
+ 	drm_panel_init(&ctx->panel, &dsi->dev, &ili9881c_funcs,
+ 		       DRM_MODE_CONNECTOR_DSI);
+ 
+@@ -1531,9 +2410,13 @@ static int ili9881c_dsi_probe(struct mip
+ 
+ 	dsi->mode_flags = ctx->desc->mode_flags;
+ 	dsi->format = MIPI_DSI_FMT_RGB888;
+-	dsi->lanes = 4;
++	dsi->lanes = ctx->desc->lanes;
+ 
+-	return mipi_dsi_attach(dsi);
++	ret = mipi_dsi_attach(dsi);
++	if (ret)
++		drm_panel_remove(&ctx->panel);
++
++	return ret;
+ }
+ 
+ static void ili9881c_dsi_remove(struct mipi_dsi_device *dsi)
+@@ -1542,6 +2425,9 @@ static void ili9881c_dsi_remove(struct m
+ 
+ 	mipi_dsi_detach(dsi);
+ 	drm_panel_remove(&ctx->panel);
++
++	gpiod_set_value_cansleep(ctx->reset, 1);
++	regulator_disable(ctx->power);
+ }
+ 
+ static const struct ili9881c_desc lhr050h41_desc = {
+@@ -1549,6 +2435,7 @@ static const struct ili9881c_desc lhr050
+ 	.init_length = ARRAY_SIZE(lhr050h41_init),
+ 	.mode = &lhr050h41_default_mode,
+ 	.mode_flags = MIPI_DSI_MODE_VIDEO_SYNC_PULSE,
++	.lanes = 4,
+ };
+ 
+ static const struct ili9881c_desc k101_im2byl02_desc = {
+@@ -1556,6 +2443,7 @@ static const struct ili9881c_desc k101_i
+ 	.init_length = ARRAY_SIZE(k101_im2byl02_init),
+ 	.mode = &k101_im2byl02_default_mode,
+ 	.mode_flags = MIPI_DSI_MODE_VIDEO_SYNC_PULSE,
++	.lanes = 4,
+ };
+ 
+ static const struct ili9881c_desc kd050hdfia020_desc = {
+@@ -1580,6 +2468,7 @@ static const struct ili9881c_desc w55294
+ 	.mode = &w552946aba_default_mode,
+ 	.mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_BURST |
+ 		      MIPI_DSI_MODE_LPM | MIPI_DSI_MODE_NO_EOT_PACKET,
++	.lanes = 4,
+ };
+ 
+ static const struct ili9881c_desc am8001280g_desc = {
+@@ -1590,6 +2479,37 @@ static const struct ili9881c_desc am8001
+ 		      MIPI_DSI_CLOCK_NON_CONTINUOUS | MIPI_DSI_MODE_LPM,
+ };
+ 
++static const struct ili9881c_desc nwe080_desc = {
++	.init = nwe080_init,
++	.init_length = ARRAY_SIZE(nwe080_init),
++	.mode = &nwe080_default_mode,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_SYNC_PULSE | MIPI_DSI_MODE_VIDEO,
++};
++
++static const struct ili9881c_desc cfaf7201280a0_050tx_desc = {
++	.init = cfaf7201280a0_050tx_init,
++	.init_length = ARRAY_SIZE(cfaf7201280a0_050tx_init),
++	.mode = &cfaf7201280a0_050tx_default_mode,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_SYNC_PULSE | MIPI_DSI_MODE_VIDEO,
++	.lanes = 4,
++};
++
++static const struct ili9881c_desc rpi_5inch_desc = {
++	.init = rpi_5inch_init,
++	.init_length = ARRAY_SIZE(rpi_5inch_init),
++	.mode = &rpi_5inch_default_mode,
++	.mode_flags =  MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_LPM,
++	.lanes = 2,
++};
++
++static const struct ili9881c_desc rpi_7inch_desc = {
++	.init = rpi_7inch_init,
++	.init_length = ARRAY_SIZE(rpi_7inch_init),
++	.mode = &rpi_7inch_default_mode,
++	.mode_flags =  MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_LPM,
++	.lanes = 2,
++};
++
+ static const struct of_device_id ili9881c_of_match[] = {
+ 	{ .compatible = "bananapi,lhr050h41", .data = &lhr050h41_desc },
+ 	{ .compatible = "feixin,k101-im2byl02", .data = &k101_im2byl02_desc },
+@@ -1597,6 +2517,10 @@ static const struct of_device_id ili9881
+ 	{ .compatible = "tdo,tl050hdv35", .data = &tl050hdv35_desc },
+ 	{ .compatible = "wanchanglong,w552946aba", .data = &w552946aba_desc },
+ 	{ .compatible = "ampire,am8001280g", .data = &am8001280g_desc },
++	{ .compatible = "crystalfontz,cfaf7201280a0_050tx", .data = &cfaf7201280a0_050tx_desc },
++	{ .compatible = "nwe,nwe080", .data = &nwe080_desc },
++	{ .compatible = "raspberrypi,dsi-5inch", &rpi_5inch_desc },
++	{ .compatible = "raspberrypi,dsi-7inch", &rpi_7inch_desc },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(of, ili9881c_of_match);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0235-dt-bindings-ili9881c-add-compatible-string-for-new-p.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0235-dt-bindings-ili9881c-add-compatible-string-for-new-p.patch
new file mode 100644
index 00000000..c3a17957
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0235-dt-bindings-ili9881c-add-compatible-string-for-new-p.patch
@@ -0,0 +1,25 @@
+From 8e54de187ed97ab878894c232b5f4634fe7f1aa6 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 30 Nov 2020 13:29:30 +0000
+Subject: [PATCH 235/697] dt-bindings: ili9881c: add compatible string for new
+ panels
+
+This new panel uses the ILI9881C IC but needs an alternate
+init sequence, and therefore requires a new compatible string.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../devicetree/bindings/display/panel/ilitek,ili9881c.yaml      | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/Documentation/devicetree/bindings/display/panel/ilitek,ili9881c.yaml
++++ b/Documentation/devicetree/bindings/display/panel/ilitek,ili9881c.yaml
+@@ -22,6 +22,8 @@ properties:
+           - startek,kd050hdfia020
+           - tdo,tl050hdv35
+           - wanchanglong,w552946aba
++          - raspberrypi,dsi-5inch
++          - raspberrypi,dsi-7inch
+       - const: ilitek,ili9881c
+ 
+   reg:
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0236-drm-panel-Add-panel-driver-for-TDO-Y17B-based-panels.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0236-drm-panel-Add-panel-driver-for-TDO-Y17B-based-panels.patch
new file mode 100644
index 00000000..1eabbb37
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0236-drm-panel-Add-panel-driver-for-TDO-Y17B-based-panels.patch
@@ -0,0 +1,330 @@
+From ee83f60a866fd34ecfab90b0b7979a47edb753ef Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 26 Jan 2022 16:02:31 +0000
+Subject: [PATCH 236/697] drm/panel: Add panel driver for TDO Y17B based panels
+
+The Top DisplayOptoelectronics (TDO) T17B driver chip is used
+in the TL040HDS20CT panel (found in the Pimoroni HyperPixel4
+Square display) and potentially other displays.
+The driver chip supports SPI for  configuration and DPI
+video data.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/panel/Kconfig          |  11 +
+ drivers/gpu/drm/panel/Makefile         |   1 +
+ drivers/gpu/drm/panel/panel-tdo-y17p.c | 278 +++++++++++++++++++++++++
+ 3 files changed, 290 insertions(+)
+ create mode 100644 drivers/gpu/drm/panel/panel-tdo-y17p.c
+
+--- a/drivers/gpu/drm/panel/Kconfig
++++ b/drivers/gpu/drm/panel/Kconfig
+@@ -909,6 +909,17 @@ config DRM_PANEL_TDO_TL070WSH30
+ 	  24 bit RGB per pixel. It provides a MIPI DSI interface to
+ 	  the host, a built-in LED backlight and touch controller.
+ 
++config DRM_PANEL_TPO_Y17P
++	tristate "TDO Y17P-based panels"
++	depends on OF && SPI
++	select DRM_KMS_HELPER
++	depends on DRM_GEM_DMA_HELPER
++	depends on BACKLIGHT_CLASS_DEVICE
++	select DRM_MIPI_DBI
++	help
++	  Say Y if you want to enable support for panels based on the
++	  TDO Y17P controller.
++
+ config DRM_PANEL_TPO_TD028TTEC1
+ 	tristate "Toppoly (TPO) TD028TTEC1 panel driver"
+ 	depends on OF && SPI
+--- a/drivers/gpu/drm/panel/Makefile
++++ b/drivers/gpu/drm/panel/Makefile
+@@ -91,6 +91,7 @@ obj-$(CONFIG_DRM_PANEL_SONY_TD4353_JDI)
+ obj-$(CONFIG_DRM_PANEL_SONY_TULIP_TRULY_NT35521) += panel-sony-tulip-truly-nt35521.o
+ obj-$(CONFIG_DRM_PANEL_STARTEK_KD070FHFID015) += panel-startek-kd070fhfid015.o
+ obj-$(CONFIG_DRM_PANEL_TDO_TL070WSH30) += panel-tdo-tl070wsh30.o
++obj-$(CONFIG_DRM_PANEL_TPO_Y17P) += panel-tdo-y17p.o
+ obj-$(CONFIG_DRM_PANEL_TPO_TD028TTEC1) += panel-tpo-td028ttec1.o
+ obj-$(CONFIG_DRM_PANEL_TPO_TD043MTEA1) += panel-tpo-td043mtea1.o
+ obj-$(CONFIG_DRM_PANEL_TPO_TPG110) += panel-tpo-tpg110.o
+--- /dev/null
++++ b/drivers/gpu/drm/panel/panel-tdo-y17p.c
+@@ -0,0 +1,278 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * TDO Y17P TFT LCD drm_panel driver.
++ *
++ * SPI configured DPI display controller
++ * Copyright (C) 2022 Raspberry Pi Ltd
++ *
++ * Derived from drivers/drm/gpu/panel/panel-sitronix-st7789v.c
++ * Copyright (C) 2017 Free Electrons
++ */
++
++#include <drm/drm_modes.h>
++#include <drm/drm_panel.h>
++
++#include <linux/bitops.h>
++#include <linux/gpio/consumer.h>
++#include <linux/media-bus-format.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/of_device.h>
++#include <linux/regmap.h>
++#include <linux/regulator/consumer.h>
++#include <linux/spi/spi.h>
++
++#include <video/mipi_display.h>
++#include <video/of_videomode.h>
++#include <video/videomode.h>
++
++struct tdo_y17p {
++	struct drm_panel panel;
++	struct spi_device *spi;
++	struct gpio_desc *reset;
++	struct regulator *power;
++	u32 bus_format;
++};
++
++static const u16 panel_init[] = {
++	0x0ff, 0x1ff, 0x198, 0x106, 0x104, 0x101, 0x008, 0x110,
++	0x021, 0x109, 0x030, 0x102, 0x031, 0x100, 0x040, 0x110,
++	0x041, 0x155, 0x042, 0x102, 0x043, 0x109, 0x044, 0x107,
++	0x050, 0x178, 0x051, 0x178, 0x052, 0x100, 0x053, 0x16d,
++	0x060, 0x107, 0x061, 0x100, 0x062, 0x108, 0x063, 0x100,
++	0x0a0, 0x100, 0x0a1, 0x107, 0x0a2, 0x10c, 0x0a3, 0x10b,
++	0x0a4, 0x103, 0x0a5, 0x107, 0x0a6, 0x106, 0x0a7, 0x104,
++	0x0a8, 0x108, 0x0a9, 0x10c, 0x0aa, 0x113, 0x0ab, 0x106,
++	0x0ac, 0x10d, 0x0ad, 0x119, 0x0ae, 0x110, 0x0af, 0x100,
++	0x0c0, 0x100, 0x0c1, 0x107, 0x0c2, 0x10c, 0x0c3, 0x10b,
++	0x0c4, 0x103, 0x0c5, 0x107, 0x0c6, 0x107, 0x0c7, 0x104,
++	0x0c8, 0x108, 0x0c9, 0x10c, 0x0ca, 0x113, 0x0cb, 0x106,
++	0x0cc, 0x10d, 0x0cd, 0x118, 0x0ce, 0x110, 0x0cf, 0x100,
++	0x0ff, 0x1ff, 0x198, 0x106, 0x104, 0x106, 0x000, 0x120,
++	0x001, 0x10a, 0x002, 0x100, 0x003, 0x100, 0x004, 0x101,
++	0x005, 0x101, 0x006, 0x198, 0x007, 0x106, 0x008, 0x101,
++	0x009, 0x180, 0x00a, 0x100, 0x00b, 0x100, 0x00c, 0x101,
++	0x00d, 0x101, 0x00e, 0x100, 0x00f, 0x100, 0x010, 0x1f0,
++	0x011, 0x1f4, 0x012, 0x101, 0x013, 0x100, 0x014, 0x100,
++	0x015, 0x1c0, 0x016, 0x108, 0x017, 0x100, 0x018, 0x100,
++	0x019, 0x100, 0x01a, 0x100, 0x01b, 0x100, 0x01c, 0x100,
++	0x01d, 0x100, 0x020, 0x101, 0x021, 0x123, 0x022, 0x145,
++	0x023, 0x167, 0x024, 0x101, 0x025, 0x123, 0x026, 0x145,
++	0x027, 0x167, 0x030, 0x111, 0x031, 0x111, 0x032, 0x100,
++	0x033, 0x1ee, 0x034, 0x1ff, 0x035, 0x1bb, 0x036, 0x1aa,
++	0x037, 0x1dd, 0x038, 0x1cc, 0x039, 0x166, 0x03a, 0x177,
++	0x03b, 0x122, 0x03c, 0x122, 0x03d, 0x122, 0x03e, 0x122,
++	0x03f, 0x122, 0x040, 0x122, 0x052, 0x110, 0x053, 0x110,
++	0x0ff, 0x1ff, 0x198, 0x106, 0x104, 0x107, 0x018, 0x11d,
++	0x017, 0x122, 0x002, 0x177, 0x026, 0x1b2, 0x0e1, 0x179,
++	0x0ff, 0x1ff, 0x198, 0x106, 0x104, 0x100, 0x03a, 0x160,
++	0x035, 0x100, 0x011, 0x100,
++};
++
++#define NUM_INIT_REGS ARRAY_SIZE(panel_init)
++
++static inline struct tdo_y17p *panel_to_tdo_y17p(struct drm_panel *panel)
++{
++	return container_of(panel, struct tdo_y17p, panel);
++}
++
++static int tdo_y17p_write_msg(struct tdo_y17p *ctx, const u16 *msg, unsigned int len)
++{
++	struct spi_transfer xfer = { };
++	struct spi_message spi;
++
++	spi_message_init(&spi);
++
++	xfer.tx_buf = msg;
++	xfer.bits_per_word = 9;
++	xfer.len = sizeof(u16) * len;
++
++	spi_message_add_tail(&xfer, &spi);
++	return spi_sync(ctx->spi, &spi);
++}
++
++static const struct drm_display_mode tdo_y17pe_720x720_mode = {
++	.clock = 36720,
++	.hdisplay = 720,
++	.hsync_start = 720 + 20,
++	.hsync_end = 720 + 20 + 20,
++	.htotal = 720 + 20 + 20 + 40,
++	.vdisplay = 720,
++	.vsync_start = 720 + 15,
++	.vsync_end = 720 + 15 + 15,
++	.vtotal = 720 + 15 + 15 + 15,
++	.flags = DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC,
++};
++
++static int tdo_y17p_get_modes(struct drm_panel *panel,
++			      struct drm_connector *connector)
++{
++	struct tdo_y17p *ctx = panel_to_tdo_y17p(panel);
++	struct drm_display_mode *mode;
++
++	mode = drm_mode_duplicate(connector->dev, &tdo_y17pe_720x720_mode);
++	if (!mode) {
++		dev_err(panel->dev, "failed to add mode %ux%ux@%u\n",
++			tdo_y17pe_720x720_mode.hdisplay,
++			tdo_y17pe_720x720_mode.vdisplay,
++			drm_mode_vrefresh(&tdo_y17pe_720x720_mode));
++		return -ENOMEM;
++	}
++
++	drm_mode_set_name(mode);
++
++	mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
++	drm_mode_probed_add(connector, mode);
++
++	connector->display_info.width_mm = 72;
++	connector->display_info.height_mm = 72;
++	drm_display_info_set_bus_formats(&connector->display_info,
++					 &ctx->bus_format, 1);
++	connector->display_info.bus_flags = 0;
++
++	return 1;
++}
++
++static int tdo_y17p_prepare(struct drm_panel *panel)
++{
++	struct tdo_y17p *ctx = panel_to_tdo_y17p(panel);
++	int ret;
++
++	ret = regulator_enable(ctx->power);
++	if (ret)
++		return ret;
++
++	ret = tdo_y17p_write_msg(ctx, panel_init, NUM_INIT_REGS);
++
++	msleep(120);
++
++	return ret;
++}
++
++static int tdo_y17p_enable(struct drm_panel *panel)
++{
++	struct tdo_y17p *ctx = panel_to_tdo_y17p(panel);
++	const u16 msg[] = { MIPI_DCS_SET_DISPLAY_ON };
++	int ret;
++
++	ret = tdo_y17p_write_msg(ctx, msg, ARRAY_SIZE(msg));
++
++	return ret;
++}
++
++static int tdo_y17p_disable(struct drm_panel *panel)
++{
++	struct tdo_y17p *ctx = panel_to_tdo_y17p(panel);
++	const u16 msg[] = { MIPI_DCS_SET_DISPLAY_OFF };
++	int ret;
++
++	ret = tdo_y17p_write_msg(ctx, msg, ARRAY_SIZE(msg));
++
++	return ret;
++}
++
++static int tdo_y17p_unprepare(struct drm_panel *panel)
++{
++	struct tdo_y17p *ctx = panel_to_tdo_y17p(panel);
++	const u16 msg[] = { MIPI_DCS_ENTER_SLEEP_MODE };
++	int ret;
++
++	ret = tdo_y17p_write_msg(ctx, msg, ARRAY_SIZE(msg));
++
++	return ret;
++}
++
++static const struct drm_panel_funcs tdo_y17p_drm_funcs = {
++	.disable	= tdo_y17p_disable,
++	.enable		= tdo_y17p_enable,
++	.get_modes	= tdo_y17p_get_modes,
++	.prepare	= tdo_y17p_prepare,
++	.unprepare	= tdo_y17p_unprepare,
++};
++
++static const struct of_device_id tdo_y17p_of_match[] = {
++	{	.compatible = "tdo,tl040hds20ct",
++		.data = (void *)MEDIA_BUS_FMT_BGR888_1X24,
++	}, {
++		.compatible = "pimoroni,hyperpixel4square",
++		.data = (void *)MEDIA_BUS_FMT_BGR666_1X24_CPADHI,
++	}, {
++		.compatible = "tdo,y17p",
++		.data = (void *)MEDIA_BUS_FMT_BGR888_1X24,
++	}, {
++		/* sentinel */
++	}
++};
++MODULE_DEVICE_TABLE(of, tdo_y17p_of_match);
++
++static int tdo_y17p_probe(struct spi_device *spi)
++{
++	const struct of_device_id *id;
++	struct tdo_y17p *ctx;
++	int ret;
++
++	ctx = devm_kzalloc(&spi->dev, sizeof(*ctx), GFP_KERNEL);
++	if (!ctx)
++		return -ENOMEM;
++
++	id = of_match_node(tdo_y17p_of_match, spi->dev.of_node);
++	if (!id)
++		return -ENODEV;
++
++	ctx->bus_format = (u32)(uintptr_t)id->data;
++
++	spi_set_drvdata(spi, ctx);
++	ctx->spi = spi;
++
++	drm_panel_init(&ctx->panel, &spi->dev, &tdo_y17p_drm_funcs,
++		       DRM_MODE_CONNECTOR_DPI);
++
++	ctx->power = devm_regulator_get(&spi->dev, "power");
++	if (IS_ERR(ctx->power))
++		return PTR_ERR(ctx->power);
++
++	ctx->reset = devm_gpiod_get_optional(&spi->dev, "reset", GPIOD_OUT_LOW);
++	if (IS_ERR(ctx->reset)) {
++		dev_err(&spi->dev, "Couldn't get our reset line\n");
++		return PTR_ERR(ctx->reset);
++	}
++
++	ret = drm_panel_of_backlight(&ctx->panel);
++	if (ret)
++		return ret;
++
++	drm_panel_add(&ctx->panel);
++
++	return 0;
++}
++
++static void tdo_y17p_remove(struct spi_device *spi)
++{
++	struct tdo_y17p *ctx = spi_get_drvdata(spi);
++
++	drm_panel_remove(&ctx->panel);
++}
++
++static const struct spi_device_id tdo_y17p_ids[] = {
++	{ "tl040hds20ct", 0 },
++	{ "hyperpixel4square", 0 },
++	{ "y17p", 0 },
++	{ /* sentinel */ }
++};
++
++MODULE_DEVICE_TABLE(spi, tdo_y17p_ids);
++
++static struct spi_driver tdo_y17p_driver = {
++	.probe = tdo_y17p_probe,
++	.remove = tdo_y17p_remove,
++	.driver = {
++		.name = "tdo_y17p",
++		.of_match_table = tdo_y17p_of_match,
++	},
++	.id_table = tdo_y17p_ids,
++};
++module_spi_driver(tdo_y17p_driver);
++
++MODULE_AUTHOR("Dave Stevenson <dave.stevenson@raspberrypi.com>");
++MODULE_DESCRIPTION("TDO Y17P LCD panel driver");
++MODULE_LICENSE("GPL v2");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0237-drm-panel-Add-panel-driver-for-Waveshare-DSI-touchsc.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0237-drm-panel-Add-panel-driver-for-Waveshare-DSI-touchsc.patch
new file mode 100644
index 00000000..06e93032
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0237-drm-panel-Add-panel-driver-for-Waveshare-DSI-touchsc.patch
@@ -0,0 +1,568 @@
+From 4af2b1d11548354cac0bcc152a6377712a15b78a Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 14 Apr 2023 13:50:08 +0100
+Subject: [PATCH 237/697] drm/panel: Add panel driver for Waveshare DSI
+ touchscreens
+
+Waveshare sell a range of DSI panels of varying sizes, all
+using a common MCU to control the panel and backlight.
+
+Add a panel driver that supports these panels.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/panel: waveshare: Fix up timings for 10.1" panel
+
+The 10.1" panel doesn't work with the timings defined. vc4
+will always have been fixing up the timing due to the limited
+integer divider, so compute the fixed up mode and use it
+directly.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drivers/gpu/drm/panel:fix waveshare panel software restart/shutdown display is abnormal
+Fixed the screen stays white when the user restarts or shuts down
+
+Signed-off-by: eng33 <eng33@waveshare.com>
+
+ drivers/gpu/drm/panel:Modify the DSI mode to fix the problem that 7.9inch cannot be displayed
+
+Signed-off-by: eng33 <eng33@waveshare.com>
+
+ drivers/gpu/drm/panel:Modified the timing of 11.9inch to fix the issue that 11.9inch was displayed abnormally
+
+Signed-off-by: eng33 <eng33@waveshare.com>
+
+Driver:add waveshare 4inch dsi lcd (C) driver
+
+Signed-off-by: Eng33 <eng33@waveshare.net>
+
+drivers:gpu:drm:panel: Added waveshare 5.0inch, 6.25inch, and 8.8inch dsi screen devices
+
+Signed-off-by: eng33 <eng33@waveshare.com>
+---
+ drivers/gpu/drm/panel/Kconfig               |  10 +
+ drivers/gpu/drm/panel/Makefile              |   1 +
+ drivers/gpu/drm/panel/panel-waveshare-dsi.c | 488 ++++++++++++++++++++
+ 3 files changed, 499 insertions(+)
+ create mode 100644 drivers/gpu/drm/panel/panel-waveshare-dsi.c
+
+--- a/drivers/gpu/drm/panel/Kconfig
++++ b/drivers/gpu/drm/panel/Kconfig
+@@ -980,6 +980,16 @@ config DRM_PANEL_VISIONOX_VTDR6130
+ 	  Say Y here if you want to enable support for Visionox
+ 	  VTDR6130 1080x2400 AMOLED DSI panel.
+ 
++config DRM_PANEL_WAVESHARE_TOUCHSCREEN
++	tristate "Waveshare touchscreen panels"
++	depends on DRM_MIPI_DSI
++	depends on I2C
++	depends on BACKLIGHT_CLASS_DEVICE
++	help
++	  Say Y here if you want to enable support for the Waveshare
++	  DSI Touchscreens.  To compile this driver as a module,
++	  choose M here.
++
+ config DRM_PANEL_WIDECHIPS_WS2401
+ 	tristate "Widechips WS2401 DPI panel driver"
+ 	depends on SPI && GPIOLIB
+--- a/drivers/gpu/drm/panel/Makefile
++++ b/drivers/gpu/drm/panel/Makefile
+@@ -99,5 +99,6 @@ obj-$(CONFIG_DRM_PANEL_TRULY_NT35597_WQX
+ obj-$(CONFIG_DRM_PANEL_VISIONOX_RM69299) += panel-visionox-rm69299.o
+ obj-$(CONFIG_DRM_PANEL_VISIONOX_VTDR6130) += panel-visionox-vtdr6130.o
+ obj-$(CONFIG_DRM_PANEL_VISIONOX_R66451) += panel-visionox-r66451.o
++obj-$(CONFIG_DRM_PANEL_WAVESHARE_TOUCHSCREEN) += panel-waveshare-dsi.o
+ obj-$(CONFIG_DRM_PANEL_WIDECHIPS_WS2401) += panel-widechips-ws2401.o
+ obj-$(CONFIG_DRM_PANEL_XINPENG_XPP055C272) += panel-xinpeng-xpp055c272.o
+--- /dev/null
++++ b/drivers/gpu/drm/panel/panel-waveshare-dsi.c
+@@ -0,0 +1,488 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright © 2023 Raspberry Pi Ltd
++ *
++ * Based on panel-raspberrypi-touchscreen by Broadcom
++ */
++
++#include <linux/backlight.h>
++#include <linux/delay.h>
++#include <linux/err.h>
++#include <linux/fb.h>
++#include <linux/i2c.h>
++#include <linux/media-bus-format.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/of_device.h>
++#include <linux/of_graph.h>
++#include <linux/pm.h>
++
++#include <drm/drm_crtc.h>
++#include <drm/drm_device.h>
++#include <drm/drm_mipi_dsi.h>
++#include <drm/drm_panel.h>
++
++#define WS_DSI_DRIVER_NAME "ws-ts-dsi"
++
++struct ws_panel {
++	struct drm_panel base;
++	struct mipi_dsi_device *dsi;
++	struct i2c_client *i2c;
++	const struct drm_display_mode *mode;
++	enum drm_panel_orientation orientation;
++};
++
++/* 2.8inch 480x640
++ * https://www.waveshare.com/product/raspberry-pi/displays/2.8inch-dsi-lcd.htm
++ */
++static const struct drm_display_mode ws_panel_2_8_mode = {
++	.clock = 50000,
++	.hdisplay = 480,
++	.hsync_start = 480 + 150,
++	.hsync_end = 480 + 150 + 50,
++	.htotal = 480 + 150 + 50 + 150,
++	.vdisplay = 640,
++	.vsync_start = 640 + 150,
++	.vsync_end = 640 + 150 + 50,
++	.vtotal = 640 + 150 + 50 + 150,
++};
++
++/* 3.4inch 800x800 Round
++ * https://www.waveshare.com/product/displays/lcd-oled/3.4inch-dsi-lcd-c.htm
++ */
++static const struct drm_display_mode ws_panel_3_4_mode = {
++	.clock = 50000,
++	.hdisplay = 800,
++	.hsync_start = 800 + 32,
++	.hsync_end = 800 + 32 + 6,
++	.htotal = 800 + 32 + 6 + 120,
++	.vdisplay = 800,
++	.vsync_start = 800 + 8,
++	.vsync_end = 800 + 8 + 4,
++	.vtotal = 800 + 8 + 4 + 16,
++};
++
++/* 4.0inch 480x800
++ * https://www.waveshare.com/product/raspberry-pi/displays/4inch-dsi-lcd.htm
++ */
++static const struct drm_display_mode ws_panel_4_0_mode = {
++	.clock = 50000,
++	.hdisplay = 480,
++	.hsync_start = 480 + 150,
++	.hsync_end = 480 + 150 + 100,
++	.htotal = 480 + 150 + 100 + 150,
++	.vdisplay = 800,
++	.vsync_start = 800 + 20,
++	.vsync_end = 800 + 20 + 100,
++	.vtotal = 800 + 20 + 100 + 20,
++};
++
++/* 7.0inch C 1024x600
++ * https://www.waveshare.com/product/raspberry-pi/displays/lcd-oled/7inch-dsi-lcd-c-with-case-a.htm
++ */
++static const struct drm_display_mode ws_panel_7_0_c_mode = {
++	.clock = 50000,
++	.hdisplay = 1024,
++	.hsync_start = 1024 + 100,
++	.hsync_end = 1024 + 100 + 100,
++	.htotal = 1024 + 100 + 100 + 100,
++	.vdisplay = 600,
++	.vsync_start = 600 + 10,
++	.vsync_end = 600 + 10 + 10,
++	.vtotal = 600 + 10 + 10 + 10,
++};
++
++/* 7.9inch 400x1280
++ * https://www.waveshare.com/product/raspberry-pi/displays/7.9inch-dsi-lcd.htm
++ */
++static const struct drm_display_mode ws_panel_7_9_mode = {
++	.clock = 50000,
++	.hdisplay = 400,
++	.hsync_start = 400 + 40,
++	.hsync_end = 400 + 40 + 30,
++	.htotal = 400 + 40 + 30 + 40,
++	.vdisplay = 1280,
++	.vsync_start = 1280 + 20,
++	.vsync_end = 1280 + 20 + 10,
++	.vtotal = 1280 + 20 + 10 + 20,
++};
++
++/* 8.0inch or 10.1inch 1280x800
++ * https://www.waveshare.com/product/raspberry-pi/displays/8inch-dsi-lcd-c.htm
++ * https://www.waveshare.com/product/raspberry-pi/displays/10.1inch-dsi-lcd-c.htm
++ */
++static const struct drm_display_mode ws_panel_10_1_mode = {
++	.clock = 83333,
++	.hdisplay = 1280,
++	.hsync_start = 1280 + 156,
++	.hsync_end = 1280 + 156 + 20,
++	.htotal = 1280 + 156 + 20 + 40,
++	.vdisplay = 800,
++	.vsync_start = 800 + 40,
++	.vsync_end = 800 + 40 + 48,
++	.vtotal = 800 + 40 + 48 + 40,
++};
++
++/* 11.9inch 320x1480
++ * https://www.waveshare.com/product/raspberry-pi/displays/11.9inch-dsi-lcd.htm
++ */
++static const struct drm_display_mode ws_panel_11_9_mode = {
++	.clock = 50000,
++	.hdisplay = 320,
++	.hsync_start = 320 + 60,
++	.hsync_end = 320 + 60 + 60,
++	.htotal = 320 + 60 + 60 + 60,
++	.vdisplay = 1480,
++	.vsync_start = 1480 + 60,
++	.vsync_end = 1480 + 60 + 60,
++	.vtotal = 1480 + 60 + 60 + 60,
++};
++
++static const struct drm_display_mode ws_panel_4_mode = {
++	.clock = 50000,
++	.hdisplay = 720,
++	.hsync_start = 720 + 32,
++	.hsync_end = 720 + 32 + 200,
++	.htotal = 720 + 32 + 200 + 120,
++	.vdisplay = 720,
++	.vsync_start = 720 + 8,
++	.vsync_end = 720 + 8 + 4,
++	.vtotal = 720 + 8 + 4 + 16,
++};
++
++/* 5.0inch 720x1280
++ * https://www.waveshare.com/5inch-dsi-lcd-d.htm
++ */
++static const struct drm_display_mode ws_panel_5_0_mode = {
++	.clock = 83333,
++	.hdisplay = 720,
++	.hsync_start = 720 + 100,
++	.hsync_end = 720 + 100 + 80,
++	.htotal = 720 + 100 + 80 + 100,
++	.vdisplay = 1280,
++	.vsync_start = 1280 + 20,
++	.vsync_end = 1280 + 20 + 20,
++	.vtotal = 1280 + 20 + 20 + 20,
++};
++
++/* 6.25inch 720x1560
++ * https://www.waveshare.com/6.25inch-dsi-lcd.htm
++ */
++static const struct drm_display_mode ws_panel_6_25_mode = {
++	.clock = 83333,
++	.hdisplay = 720,
++	.hsync_start = 720 + 50,
++	.hsync_end = 720 + 50 + 50,
++	.htotal = 720 + 50 + 50 + 50,
++	.vdisplay = 1560,
++	.vsync_start = 1560 + 20,
++	.vsync_end = 1560 + 20 + 20,
++	.vtotal = 1560 + 20 + 20 + 20,
++};
++
++/* 8.8inch 480x1920
++ * https://www.waveshare.com/8.8inch-dsi-lcd.htm
++ */
++static const struct drm_display_mode ws_panel_8_8_mode = {
++	.clock = 83333,
++	.hdisplay = 480,
++	.hsync_start = 480 + 50,
++	.hsync_end = 480 + 50 + 50,
++	.htotal = 480 + 50 + 50 + 50,
++	.vdisplay = 1920,
++	.vsync_start = 1920 + 20,
++	.vsync_end = 1920 + 20 + 20,
++	.vtotal = 1920 + 20 + 20 + 20,
++};
++
++static struct ws_panel *panel_to_ts(struct drm_panel *panel)
++{
++	return container_of(panel, struct ws_panel, base);
++}
++
++static void ws_panel_i2c_write(struct ws_panel *ts, u8 reg, u8 val)
++{
++	int ret;
++
++	ret = i2c_smbus_write_byte_data(ts->i2c, reg, val);
++	if (ret)
++		dev_err(&ts->i2c->dev, "I2C write failed: %d\n", ret);
++}
++
++static int ws_panel_disable(struct drm_panel *panel)
++{
++	struct ws_panel *ts = panel_to_ts(panel);
++
++	ws_panel_i2c_write(ts, 0xad, 0x00);
++
++	return 0;
++}
++
++static int ws_panel_unprepare(struct drm_panel *panel)
++{
++	return 0;
++}
++
++static int ws_panel_prepare(struct drm_panel *panel)
++{
++	return 0;
++}
++
++static int ws_panel_enable(struct drm_panel *panel)
++{
++	struct ws_panel *ts = panel_to_ts(panel);
++
++	ws_panel_i2c_write(ts, 0xad, 0x01);
++
++	return 0;
++}
++
++static int ws_panel_get_modes(struct drm_panel *panel,
++			      struct drm_connector *connector)
++{
++	static const u32 bus_format = MEDIA_BUS_FMT_RGB888_1X24;
++	struct ws_panel *ts = panel_to_ts(panel);
++	struct drm_display_mode *mode;
++
++	mode = drm_mode_duplicate(connector->dev, ts->mode);
++	if (!mode) {
++		dev_err(panel->dev, "failed to add mode %ux%u@%u\n",
++			ts->mode->hdisplay,
++			ts->mode->vdisplay,
++			drm_mode_vrefresh(ts->mode));
++	}
++
++	mode->type |= DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
++
++	drm_mode_set_name(mode);
++
++	drm_mode_probed_add(connector, mode);
++
++	connector->display_info.bpc = 8;
++	connector->display_info.width_mm = 154;
++	connector->display_info.height_mm = 86;
++	drm_display_info_set_bus_formats(&connector->display_info,
++					 &bus_format, 1);
++
++	/*
++	 * TODO: Remove once all drm drivers call
++	 * drm_connector_set_orientation_from_panel()
++	 */
++	drm_connector_set_panel_orientation(connector, ts->orientation);
++
++	return 1;
++}
++
++static enum drm_panel_orientation ws_panel_get_orientation(struct drm_panel *panel)
++{
++	struct ws_panel *ts = panel_to_ts(panel);
++
++	return ts->orientation;
++}
++
++static const struct drm_panel_funcs ws_panel_funcs = {
++	.disable = ws_panel_disable,
++	.unprepare = ws_panel_unprepare,
++	.prepare = ws_panel_prepare,
++	.enable = ws_panel_enable,
++	.get_modes = ws_panel_get_modes,
++	.get_orientation = ws_panel_get_orientation,
++};
++
++static int ws_panel_bl_update_status(struct backlight_device *bl)
++{
++	struct ws_panel *ts = bl_get_data(bl);
++
++	ws_panel_i2c_write(ts, 0xab, 0xff - backlight_get_brightness(bl));
++	ws_panel_i2c_write(ts, 0xaa, 0x01);
++
++	return 0;
++}
++
++static const struct backlight_ops ws_panel_bl_ops = {
++	.update_status = ws_panel_bl_update_status,
++};
++
++static struct backlight_device *
++ws_panel_create_backlight(struct ws_panel *ts)
++{
++	struct device *dev = ts->base.dev;
++	const struct backlight_properties props = {
++		.type = BACKLIGHT_RAW,
++		.brightness = 255,
++		.max_brightness = 255,
++	};
++
++	return devm_backlight_device_register(dev, dev_name(dev), dev, ts,
++					      &ws_panel_bl_ops, &props);
++}
++
++static int ws_panel_probe(struct i2c_client *i2c)
++{
++	struct device *dev = &i2c->dev;
++	struct ws_panel *ts;
++	struct device_node *endpoint, *dsi_host_node;
++	struct mipi_dsi_host *host;
++	struct mipi_dsi_device_info info = {
++		.type = WS_DSI_DRIVER_NAME,
++		.channel = 0,
++		.node = NULL,
++	};
++	int ret;
++
++	ts = devm_kzalloc(dev, sizeof(*ts), GFP_KERNEL);
++	if (!ts)
++		return -ENOMEM;
++
++	ts->mode = of_device_get_match_data(dev);
++	if (!ts->mode)
++		return -EINVAL;
++
++	i2c_set_clientdata(i2c, ts);
++
++	ts->i2c = i2c;
++
++	ws_panel_i2c_write(ts, 0xc0, 0x01);
++	ws_panel_i2c_write(ts, 0xc2, 0x01);
++	ws_panel_i2c_write(ts, 0xac, 0x01);
++
++	ret = of_drm_get_panel_orientation(dev->of_node, &ts->orientation);
++	if (ret) {
++		dev_err(dev, "%pOF: failed to get orientation %d\n", dev->of_node, ret);
++		return ret;
++	}
++
++	/* Look up the DSI host.  It needs to probe before we do. */
++	endpoint = of_graph_get_next_endpoint(dev->of_node, NULL);
++	if (!endpoint)
++		return -ENODEV;
++
++	dsi_host_node = of_graph_get_remote_port_parent(endpoint);
++	if (!dsi_host_node)
++		goto error;
++
++	host = of_find_mipi_dsi_host_by_node(dsi_host_node);
++	of_node_put(dsi_host_node);
++	if (!host) {
++		of_node_put(endpoint);
++		return -EPROBE_DEFER;
++	}
++
++	info.node = of_graph_get_remote_port(endpoint);
++	if (!info.node)
++		goto error;
++
++	of_node_put(endpoint);
++
++	ts->dsi = devm_mipi_dsi_device_register_full(dev, host, &info);
++	if (IS_ERR(ts->dsi)) {
++		dev_err(dev, "DSI device registration failed: %ld\n",
++			PTR_ERR(ts->dsi));
++		return PTR_ERR(ts->dsi);
++	}
++
++	drm_panel_init(&ts->base, dev, &ws_panel_funcs,
++		       DRM_MODE_CONNECTOR_DSI);
++
++	ts->base.backlight = ws_panel_create_backlight(ts);
++	if (IS_ERR(ts->base.backlight)) {
++		ret = PTR_ERR(ts->base.backlight);
++		dev_err(dev, "Failed to create backlight: %d\n", ret);
++		return ret;
++	}
++
++	/* This appears last, as it's what will unblock the DSI host
++	 * driver's component bind function.
++	 */
++	drm_panel_add(&ts->base);
++
++	ts->dsi->mode_flags =  MIPI_DSI_MODE_VIDEO_HSE | MIPI_DSI_MODE_VIDEO |
++			   MIPI_DSI_CLOCK_NON_CONTINUOUS;
++	ts->dsi->format = MIPI_DSI_FMT_RGB888;
++	ts->dsi->lanes = 2;
++
++	ret = devm_mipi_dsi_attach(dev, ts->dsi);
++
++	if (ret)
++		dev_err(dev, "failed to attach dsi to host: %d\n", ret);
++
++	return 0;
++
++error:
++	of_node_put(endpoint);
++	return -ENODEV;
++}
++
++static void ws_panel_remove(struct i2c_client *i2c)
++{
++	struct ws_panel *ts = i2c_get_clientdata(i2c);
++
++	ws_panel_disable(&ts->base);
++
++	drm_panel_remove(&ts->base);
++}
++
++static void ws_panel_shutdown(struct i2c_client *i2c)
++{
++	struct ws_panel *ts = i2c_get_clientdata(i2c);
++
++	ws_panel_disable(&ts->base);
++}
++
++static const struct of_device_id ws_panel_of_ids[] = {
++	{
++		.compatible = "waveshare,2.8inch-panel",
++		.data = &ws_panel_2_8_mode,
++	}, {
++		.compatible = "waveshare,3.4inch-panel",
++		.data = &ws_panel_3_4_mode,
++	}, {
++		.compatible = "waveshare,4.0inch-panel",
++		.data = &ws_panel_4_0_mode,
++	}, {
++		.compatible = "waveshare,7.0inch-c-panel",
++		.data = &ws_panel_7_0_c_mode,
++	}, {
++		.compatible = "waveshare,7.9inch-panel",
++		.data = &ws_panel_7_9_mode,
++	}, {
++		.compatible = "waveshare,8.0inch-panel",
++		.data = &ws_panel_10_1_mode,
++	}, {
++		.compatible = "waveshare,10.1inch-panel",
++		.data = &ws_panel_10_1_mode,
++	}, {
++		.compatible = "waveshare,11.9inch-panel",
++		.data = &ws_panel_11_9_mode,
++	}, {
++		.compatible = "waveshare,4inch-panel",
++		.data = &ws_panel_4_mode,
++	}, {
++		.compatible = "waveshare,5.0inch-panel",
++		.data = &ws_panel_5_0_mode,
++	}, {
++		.compatible = "waveshare,6.25inch-panel",
++		.data = &ws_panel_6_25_mode,
++	}, {
++		.compatible = "waveshare,8.8inch-panel",
++		.data = &ws_panel_8_8_mode,
++	}, {
++		/* sentinel */
++	}
++};
++MODULE_DEVICE_TABLE(of, ws_panel_of_ids);
++
++static struct i2c_driver ws_panel_driver = {
++	.driver = {
++		.name = "ws_touchscreen",
++		.of_match_table = ws_panel_of_ids,
++	},
++	.probe = ws_panel_probe,
++	.remove = ws_panel_remove,
++	.shutdown = ws_panel_shutdown,
++};
++module_i2c_driver(ws_panel_driver);
++
++MODULE_AUTHOR("Dave Stevenson <dave.stevenson@raspberrypi.com>");
++MODULE_DESCRIPTION("Waveshare DSI panel driver");
++MODULE_LICENSE("GPL");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0238-dt-bindings-vendor-prefixes-Add-Geekworm.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0238-dt-bindings-vendor-prefixes-Add-Geekworm.patch
new file mode 100644
index 00000000..618e6ab9
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0238-dt-bindings-vendor-prefixes-Add-Geekworm.patch
@@ -0,0 +1,23 @@
+From c34a6df7f1ff7fc00fe43a86da0491d8166ad3fe Mon Sep 17 00:00:00 2001
+From: Chris Morgan <macromorgan@hotmail.com>
+Date: Fri, 28 Jan 2022 17:40:50 -0600
+Subject: [PATCH 238/697] dt-bindings: vendor-prefixes: Add Geekworm
+
+Add vendor prefix for Geekworm (https://geekworm.com).
+
+Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
+---
+ Documentation/devicetree/bindings/vendor-prefixes.yaml | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/Documentation/devicetree/bindings/vendor-prefixes.yaml
++++ b/Documentation/devicetree/bindings/vendor-prefixes.yaml
+@@ -559,6 +559,8 @@ patternProperties:
+     description: General Electric Company
+   "^geekbuying,.*":
+     description: GeekBuying
++  "^geekworm,.*":
++    description: Geekworm
+   "^gef,.*":
+     description: GE Fanuc Intelligent Platforms Embedded Systems, Inc.
+   "^GEFanuc,.*":
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0239-dt-bindings-display-simple-add-Geekworm-MZP280-Panel.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0239-dt-bindings-display-simple-add-Geekworm-MZP280-Panel.patch
new file mode 100644
index 00000000..5cca8cf6
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0239-dt-bindings-display-simple-add-Geekworm-MZP280-Panel.patch
@@ -0,0 +1,34 @@
+From f4a426f2f75d5e81da9e2aef7c6dfde1c2961665 Mon Sep 17 00:00:00 2001
+From: Chris Morgan <macromorgan@hotmail.com>
+Date: Fri, 28 Jan 2022 17:41:18 -0600
+Subject: [PATCH 239/697] dt-bindings: display: simple: add Geekworm MZP280
+ Panel
+
+The Geekworm MZP280 panel is a 480x640 (portrait) panel with a
+capacitive touch interface and a 40 pin header meant to interface
+directly with the Raspberry Pi. The screen is 2.8 inches diagonally,
+and there appear to be at least 4 distinct versions all with the same
+panel timings.
+
+Timings were derived from drivers posted on the github located here:
+https://github.com/tianyoujian/MZDPI/tree/master/vga
+
+Additional details about this panel family can be found here:
+https://wiki.geekworm.com/2.8_inch_Touch_Screen_for_Pi_zero
+
+Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
+---
+ .../devicetree/bindings/display/panel/panel-simple.yaml         | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/Documentation/devicetree/bindings/display/panel/panel-simple.yaml
++++ b/Documentation/devicetree/bindings/display/panel/panel-simple.yaml
+@@ -142,6 +142,8 @@ properties:
+       - frida,frd350h54004
+         # FriendlyELEC HD702E 800x1280 LCD panel
+       - friendlyarm,hd702e
++        # Geekworm MZP280 2.8" 480x640 LCD panel with capacitive touch
++      - geekworm,mzp280
+         # GiantPlus GPG48273QS5 4.3" (480x272) WQVGA TFT LCD panel
+       - giantplus,gpg48273qs5
+         # GiantPlus GPM940B0 3.0" QVGA TFT LCD panel
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0240-dt-bindings-display-panel-dsi-bindings.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0240-dt-bindings-display-panel-dsi-bindings.patch
new file mode 100644
index 00000000..971d522f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0240-dt-bindings-display-panel-dsi-bindings.patch
@@ -0,0 +1,136 @@
+From 12c3ba27ffbb886029e763d991b662c7cb585b43 Mon Sep 17 00:00:00 2001
+From: Timon Skerutsch <kernel@diodes-delight.com>
+Date: Mon, 13 Nov 2023 22:53:22 +0100
+Subject: [PATCH 240/697] dt-bindings: display: panel-dsi bindings
+
+Bindings for the panel-dsi specific additions to panel-simple.
+Allow for DSI specific bus settings and panel timing
+to be define in devicetree. Very similar to panel-dpi.
+
+Signed-off-by: Timon Skerutsch <kernel@diodes-delight.com>
+---
+ .../bindings/display/panel/panel-dsi.yaml     | 118 ++++++++++++++++++
+ 1 file changed, 118 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/display/panel/panel-dsi.yaml
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/display/panel/panel-dsi.yaml
+@@ -0,0 +1,118 @@
++# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/display/panel/panel-dsi.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Generic MIPI DSI Panel
++
++maintainers:
++  - Timon Skerutsch <kernel@diodes-delight.com>
++
++allOf:
++  - $ref: panel-common.yaml#
++
++properties:
++  compatible:
++    description:
++      Shall contain a panel specific compatible and "panel-dsi"
++      in that order.
++    items:
++      - {}
++      - const: panel-dsi
++
++  dsi-color-format:
++    description: |
++      The color format used by the panel. Only DSI supported formats are allowed.
++    enum:
++      - RGB888
++      - RGB666
++      - RGB666_PACKED
++      - RGB565
++
++  port:
++    $ref: /schemas/graph.yaml#/$defs/port-base
++    unevaluatedProperties: false
++    description:
++      Panel MIPI DSI input
++
++    properties:
++      endpoint:
++        $ref: /schemas/media/video-interfaces.yaml#
++        unevaluatedProperties: false
++
++        properties:
++          data-lanes: true
++
++        required:
++          - data-lanes
++
++  mode:
++    description: |
++      DSI mode flags. See DSI Specs for details.
++      These are driver independent features of the DSI bus.
++    items:
++      - const: MODE_VIDEO
++      - const: MODE_VIDEO_BURST
++      - const: MODE_VIDEO_SYNC_PULSE
++      - const: MODE_VIDEO_AUTO_VERT
++      - const: MODE_VIDEO_HSE
++      - const: MODE_VIDEO_NO_HFP
++      - const: MODE_VIDEO_NO_HBP
++      - const: MODE_VIDEO_NO_HSA
++      - const: MODE_VSYNC_FLUSH
++      - const: MODE_NO_EOT_PACKET
++      - const: CLOCK_NON_CONTINUOUS
++      - const: MODE_LPM
++      - const: HS_PKT_END_ALIGNED
++
++  reg: true
++  backlight: true
++  enable-gpios: true
++  width-mm: true
++  height-mm: true
++  panel-timing: true
++  power-supply: true
++  reset-gpios: true
++  ddc-i2c-bus: true
++
++required:
++  - panel-timing
++  - reg
++  - power-supply
++  - dsi-color-format
++  - port
++
++additionalProperties: false
++
++examples:
++  - |
++    panel {
++        compatible = "panel-mfgr,generic-dsi-panel","panel-dsi";
++        power-supply = <&vcc_supply>;
++        backlight = <&backlight>;
++        dsi-color-format = "RGB888";
++        reg = <0>;
++        mode = "MODE_VIDEO", "MODE_VIDEO_BURST", "MODE_NO_EOT_PACKET";
++
++        port {
++            panel_dsi_port: endpoint {
++                data-lanes = <1 2>;
++                remote-endpoint = <&dsi_out>;
++            };
++        };
++
++        panel-timing {
++            clock-frequency = <9200000>;
++            hactive = <800>;
++            vactive = <480>;
++            hfront-porch = <8>;
++            hback-porch = <4>;
++            hsync-len = <41>;
++            vback-porch = <2>;
++            vfront-porch = <4>;
++            vsync-len = <10>;
++        };
++    };
++
++...
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0241-staging-vchiq-mmal-Add-buffer-flags-for-interlaced-v.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0241-staging-vchiq-mmal-Add-buffer-flags-for-interlaced-v.patch
new file mode 100644
index 00000000..5eb08e0e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0241-staging-vchiq-mmal-Add-buffer-flags-for-interlaced-v.patch
@@ -0,0 +1,42 @@
+From 34309c41ef997606d30b62379221aa2c1be61f84 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Sun, 10 Jan 2021 19:05:17 +0000
+Subject: [PATCH 241/697] staging/vchiq-mmal: Add buffer flags for interlaced
+ video
+
+Add the buffer flags that the firmware uses to identify fields
+on interlaced video
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../vc04_services/vchiq-mmal/mmal-msg.h       | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-msg.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-msg.h
+@@ -253,6 +253,25 @@ struct mmal_msg_port_action_reply {
+ /* Signals that a buffer failed to be transmitted */
+ #define MMAL_BUFFER_HEADER_FLAG_TRANSMISSION_FAILED    BIT(10)
+ 
++/* Video buffer header flags
++ * videobufferheaderflags
++ * The following flags describe properties of a video buffer header.
++ * As there is no collision with the MMAL_BUFFER_HEADER_FLAGS_ defines, these
++ * flags will also be present in the MMAL_BUFFER_HEADER_T flags field.
++ */
++#define MMAL_BUFFER_HEADER_FLAG_FORMAT_SPECIFIC_START_BIT 16
++#define MMAL_BUFFER_HEADER_FLAG_FORMAT_SPECIFIC_START \
++			(1 << MMAL_BUFFER_HEADER_FLAG_FORMAT_SPECIFIC_START_BIT)
++/* Signals an interlaced video frame */
++#define MMAL_BUFFER_HEADER_VIDEO_FLAG_INTERLACED \
++			(MMAL_BUFFER_HEADER_FLAG_FORMAT_SPECIFIC_START << 0)
++/*
++ * Signals that the top field of the current interlaced frame should be
++ * displayed first
++ */
++#define MMAL_BUFFER_HEADER_VIDEO_FLAG_TOP_FIELD_FIRST \
++			(MMAL_BUFFER_HEADER_FLAG_FORMAT_SPECIFIC_START << 1)
++
+ struct mmal_driver_buffer {
+ 	u32 magic;
+ 	u32 component_handle;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0242-staging-vchiq-mmal-Add-parameters-for-interlaced-vid.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0242-staging-vchiq-mmal-Add-parameters-for-interlaced-vid.patch
new file mode 100644
index 00000000..eb55a68c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0242-staging-vchiq-mmal-Add-parameters-for-interlaced-vid.patch
@@ -0,0 +1,61 @@
+From 6018642cba8ad7bc439079160d8c86ab0ce52fdd Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 5 Aug 2021 16:38:34 +0100
+Subject: [PATCH 242/697] staging/vchiq-mmal: Add parameters for interlaced
+ video support
+
+Adds enum mmal_interlace_type and struct
+mmal_parameter_video_interlace_type to allow for querying the
+interlacing mode on decoders.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../vchiq-mmal/mmal-parameters.h              | 37 +++++++++++++++++++
+ 1 file changed, 37 insertions(+)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
+@@ -811,6 +811,43 @@ struct mmal_parameter_displayregion {
+ 	u32 alpha;
+ };
+ 
++enum mmal_interlace_type {
++	/* The data is not interlaced, it is progressive scan */
++	MMAL_INTERLACE_PROGRESSIVE,
++	/*
++	 * The data is interlaced, fields sent separately in temporal order, with
++	 * upper field first
++	 */
++	MMAL_INTERLACE_FIELD_SINGLE_UPPER_FIRST,
++	/*
++	 * The data is interlaced, fields sent separately in temporal order, with
++	 * lower field first
++	 */
++	MMAL_INTERLACE_FIELD_SINGLE_LOWER_FIRST,
++	/*
++	 * The data is interlaced, two fields sent together line interleaved,
++	 * with the upper field temporally earlier
++	 */
++	MMAL_INTERLACE_FIELDS_INTERLEAVED_UPPER_FIRST,
++	/*
++	 * The data is interlaced, two fields sent together line interleaved,
++	 * with the lower field temporally earlier
++	 */
++	MMAL_INTERLACE_FIELDS_INTERLEAVED_LOWER_FIRST,
++	/*
++	 * The stream may contain a mixture of progressive and interlaced
++	 * frames
++	 */
++	MMAL_INTERLACE_MIXED,
++
++	MMAL_INTERLACE_DUMMY = 0x7FFFFFFF
++};
++
++struct mmal_parameter_video_interlace_type {
++	enum mmal_interlace_type mode;	/* The interlace type of the content */
++	u32 bRepeatFirstField;		/* Whether to repeat the first field */
++};
++
+ #define MMAL_MAX_IMAGEFX_PARAMETERS 5
+ 
+ struct mmal_parameter_imagefx_parameters {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0243-staging-vchiq-mmal-Add-the-deinterlace-image-effects.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0243-staging-vchiq-mmal-Add-the-deinterlace-image-effects.patch
new file mode 100644
index 00000000..0dcddbd0
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0243-staging-vchiq-mmal-Add-the-deinterlace-image-effects.patch
@@ -0,0 +1,26 @@
+From 32f533879b35f4c57163597b930cfeb5bf589354 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 6 Aug 2021 15:44:21 +0100
+Subject: [PATCH 243/697] staging/vchiq-mmal: Add the deinterlace image effects
+ enums
+
+As we're wanting to wrap the image_fx component for deinterlacing,
+add the deinterlace algorithm values to enum mmal_parameter_imagefx
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
+@@ -397,6 +397,9 @@ enum mmal_parameter_imagefx {
+ 	MMAL_PARAM_IMAGEFX_COLOURPOINT,
+ 	MMAL_PARAM_IMAGEFX_COLOURBALANCE,
+ 	MMAL_PARAM_IMAGEFX_CARTOON,
++	MMAL_PARAM_IMAGEFX_DEINTERLACE_DOUBLE,
++	MMAL_PARAM_IMAGEFX_DEINTERLACE_ADV,
++	MMAL_PARAM_IMAGEFX_DEINTERLACE_FAST,
+ };
+ 
+ enum MMAL_PARAM_FLICKERAVOID {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0244-Add-Raspberry-Pi-PoE-HAT-support.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0244-Add-Raspberry-Pi-PoE-HAT-support.patch
new file mode 100644
index 00000000..f8b15857
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0244-Add-Raspberry-Pi-PoE-HAT-support.patch
@@ -0,0 +1,269 @@
+From b99d5852945a69676e656e40a99c9f485ec548e2 Mon Sep 17 00:00:00 2001
+From: Serge Schneider <serge@raspberrypi.com>
+Date: Mon, 2 Dec 2019 14:48:05 +0000
+Subject: [PATCH 244/697] Add Raspberry Pi PoE+ HAT support
+
+Signed-off-by: Serge Schneider <serge@raspberrypi.com>
+---
+ drivers/power/supply/Kconfig         |   7 +
+ drivers/power/supply/Makefile        |   1 +
+ drivers/power/supply/rpi_poe_power.c | 227 +++++++++++++++++++++++++++
+ 3 files changed, 235 insertions(+)
+ create mode 100644 drivers/power/supply/rpi_poe_power.c
+
+--- a/drivers/power/supply/Kconfig
++++ b/drivers/power/supply/Kconfig
+@@ -28,6 +28,13 @@ config POWER_SUPPLY_HWMON
+ 	  Say 'Y' here if you want power supplies to
+ 	  have hwmon sysfs interface too.
+ 
++config RPI_POE_POWER
++	tristate "Raspberry Pi PoE+ HAT power supply driver"
++	depends on RASPBERRYPI_FIRMWARE
++	help
++	  Say Y here to enable support for Raspberry Pi PoE+ (Power over Ethernet
++	  Plus) HAT current measurement.
++
+ config APM_POWER
+ 	tristate "APM emulation for class batteries"
+ 	depends on APM_EMULATION
+--- a/drivers/power/supply/Makefile
++++ b/drivers/power/supply/Makefile
+@@ -9,6 +9,7 @@ obj-$(CONFIG_POWER_SUPPLY)	+= power_supp
+ obj-$(CONFIG_POWER_SUPPLY_HWMON) += power_supply_hwmon.o
+ obj-$(CONFIG_GENERIC_ADC_BATTERY)	+= generic-adc-battery.o
+ 
++obj-$(CONFIG_RPI_POE_POWER)	+= rpi_poe_power.o
+ obj-$(CONFIG_APM_POWER)		+= apm_power.o
+ obj-$(CONFIG_AXP20X_POWER)	+= axp20x_usb_power.o
+ obj-$(CONFIG_IP5XXX_POWER)	+= ip5xxx_power.o
+--- /dev/null
++++ b/drivers/power/supply/rpi_poe_power.c
+@@ -0,0 +1,227 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * rpi-poe-power.c - Raspberry Pi PoE+ HAT power supply driver.
++ *
++ * Copyright (C) 2019 Raspberry Pi (Trading) Ltd.
++ * Based on axp20x_ac_power.c by Quentin Schulz <quentin.schulz@free-electrons.com>
++ *
++ * Author: Serge Schneider <serge@raspberrypi.org>
++ */
++
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/power_supply.h>
++#include <soc/bcm2835/raspberrypi-firmware.h>
++
++#define RPI_POE_ADC_REG			0x2
++#define RPI_POE_FLAG_REG		0x4
++
++#define RPI_POE_FLAG_AT			BIT(0)
++#define RPI_POE_FLAG_OC			BIT(1)
++
++#define RPI_POE_CURRENT_AF_MAX	(2500 * 1000)
++#define RPI_POE_CURRENT_AT_MAX	(5000 * 1000)
++
++#define DRVNAME "rpi-poe-power-supply"
++
++struct rpi_poe_power_supply_ctx {
++	struct power_supply *supply;
++	struct rpi_firmware *fw;
++};
++
++struct fw_tag_data_s {
++	u32 reg;
++	u32 val;
++	u32 ret;
++};
++
++static int write_reg(struct rpi_firmware *fw, u32 reg, u32 *val)
++{
++	struct fw_tag_data_s fw_tag_data = {
++		.reg = reg,
++		.val = *val
++	};
++	int ret;
++
++	ret = rpi_firmware_property(fw, RPI_FIRMWARE_SET_POE_HAT_VAL,
++				    &fw_tag_data, sizeof(fw_tag_data));
++	if (ret)
++		return ret;
++	else if (fw_tag_data.ret)
++		return -EIO;
++	return 0;
++}
++
++static int read_reg(struct rpi_firmware *fw, u32 reg, u32 *val)
++{
++	struct fw_tag_data_s fw_tag_data = {
++		.reg = reg,
++		.val = *val
++	};
++	int ret;
++
++	ret = rpi_firmware_property(fw, RPI_FIRMWARE_GET_POE_HAT_VAL,
++				    &fw_tag_data, sizeof(fw_tag_data));
++	if (ret)
++		return ret;
++	else if (fw_tag_data.ret)
++		return -EIO;
++
++	*val = fw_tag_data.val;
++	return 0;
++}
++
++static int rpi_poe_power_supply_get_property(struct power_supply *psy,
++					enum power_supply_property psp,
++					union power_supply_propval *r_val)
++{
++	struct rpi_poe_power_supply_ctx *ctx = power_supply_get_drvdata(psy);
++	int ret;
++	unsigned int val = 0;
++
++	switch (psp) {
++	case POWER_SUPPLY_PROP_HEALTH:
++		ret = read_reg(ctx->fw, RPI_POE_FLAG_REG, &val);
++		if (ret)
++			return ret;
++
++		if (val & RPI_POE_FLAG_OC) {
++			r_val->intval = POWER_SUPPLY_HEALTH_UNSPEC_FAILURE;
++			val = RPI_POE_FLAG_OC;
++			ret = write_reg(ctx->fw, RPI_POE_FLAG_REG, &val);
++			if (ret)
++				return ret;
++			return 0;
++		}
++
++		r_val->intval = POWER_SUPPLY_HEALTH_GOOD;
++		return 0;
++
++	case POWER_SUPPLY_PROP_ONLINE:
++		ret = read_reg(ctx->fw, RPI_POE_ADC_REG, &val);
++		if (ret)
++			return ret;
++
++		r_val->intval = (val > 5);
++		return 0;
++
++	case POWER_SUPPLY_PROP_CURRENT_AVG:
++		val = 50;
++		ret = read_reg(ctx->fw, RPI_POE_ADC_REG, &val);
++		if (ret)
++			return ret;
++		val = (val * 3300)/9821;
++		r_val->intval = val * 1000;
++		return 0;
++
++	case POWER_SUPPLY_PROP_CURRENT_NOW:
++		ret = read_reg(ctx->fw, RPI_POE_ADC_REG, &val);
++		if (ret)
++			return ret;
++		val = (val * 3300)/9821;
++		r_val->intval = val * 1000;
++		return 0;
++
++	case POWER_SUPPLY_PROP_CURRENT_MAX:
++		ret = read_reg(ctx->fw, RPI_POE_FLAG_REG, &val);
++		if (ret)
++			return ret;
++
++		if (val & RPI_POE_FLAG_AT) {
++			r_val->intval = RPI_POE_CURRENT_AT_MAX;
++			return 0;
++		}
++		r_val->intval = RPI_POE_CURRENT_AF_MAX;
++		return 0;
++
++	default:
++		return -EINVAL;
++	}
++
++	return -EINVAL;
++}
++
++static enum power_supply_property rpi_poe_power_supply_properties[] = {
++	POWER_SUPPLY_PROP_HEALTH,
++	POWER_SUPPLY_PROP_ONLINE,
++	POWER_SUPPLY_PROP_CURRENT_AVG,
++	POWER_SUPPLY_PROP_CURRENT_NOW,
++	POWER_SUPPLY_PROP_CURRENT_MAX,
++};
++
++static const struct power_supply_desc rpi_poe_power_supply_desc = {
++	.name = "rpi-poe",
++	.type = POWER_SUPPLY_TYPE_MAINS,
++	.properties = rpi_poe_power_supply_properties,
++	.num_properties = ARRAY_SIZE(rpi_poe_power_supply_properties),
++	.get_property = rpi_poe_power_supply_get_property,
++};
++
++static int rpi_poe_power_supply_probe(struct platform_device *pdev)
++{
++	struct power_supply_config psy_cfg = {};
++	struct rpi_poe_power_supply_ctx *ctx;
++	struct device_node *fw_node;
++	u32 revision;
++
++	if (!of_device_is_available(pdev->dev.of_node))
++		return -ENODEV;
++
++	fw_node = of_parse_phandle(pdev->dev.of_node, "firmware", 0);
++	if (!fw_node) {
++		dev_err(&pdev->dev, "Missing firmware node\n");
++		return -ENOENT;
++	}
++
++	ctx = devm_kzalloc(&pdev->dev, sizeof(*ctx), GFP_KERNEL);
++	if (!ctx)
++		return -ENOMEM;
++
++	ctx->fw = rpi_firmware_get(fw_node);
++	if (!ctx->fw)
++		return -EPROBE_DEFER;
++	if (rpi_firmware_property(ctx->fw,
++			RPI_FIRMWARE_GET_FIRMWARE_REVISION,
++			&revision, sizeof(revision))) {
++		dev_err(&pdev->dev, "Failed to get firmware revision\n");
++		return -ENOENT;
++	}
++	if (revision < 0x60af72e8) {
++		dev_err(&pdev->dev, "Unsupported firmware\n");
++		return -ENOENT;
++	}
++	platform_set_drvdata(pdev, ctx);
++
++	psy_cfg.of_node = pdev->dev.of_node;
++	psy_cfg.drv_data = ctx;
++
++	ctx->supply = devm_power_supply_register(&pdev->dev,
++						   &rpi_poe_power_supply_desc,
++						   &psy_cfg);
++	if (IS_ERR(ctx->supply))
++		return PTR_ERR(ctx->supply);
++
++	return 0;
++}
++
++static const struct of_device_id of_rpi_poe_power_supply_match[] = {
++	{ .compatible = "raspberrypi,rpi-poe-power-supply", },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, of_rpi_poe_power_supply_match);
++
++static struct platform_driver rpi_poe_power_supply_driver = {
++	.probe = rpi_poe_power_supply_probe,
++	.driver = {
++		.name = DRVNAME,
++		.of_match_table = of_rpi_poe_power_supply_match
++	},
++};
++
++module_platform_driver(rpi_poe_power_supply_driver);
++
++MODULE_AUTHOR("Serge Schneider <serge@raspberrypi.org>");
++MODULE_ALIAS("platform:" DRVNAME);
++MODULE_DESCRIPTION("Raspberry Pi PoE+ HAT power supply driver");
++MODULE_LICENSE("GPL");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0245-staging-mmal-vchiq-Add-module-parameter-to-enable-lo.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0245-staging-mmal-vchiq-Add-module-parameter-to-enable-lo.patch
new file mode 100644
index 00000000..b95fb3ed
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0245-staging-mmal-vchiq-Add-module-parameter-to-enable-lo.patch
@@ -0,0 +1,313 @@
+From 8e8fb17e6eeca226ae21722934b7594b9e1b5264 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 15 Sep 2021 17:54:11 +0100
+Subject: [PATCH 245/697] staging/mmal-vchiq: Add module parameter to enable
+ logging.
+
+Adds a module parameter "debug" to enable various logging levels.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../vc04_services/vchiq-mmal/mmal-vchiq.c     | 139 ++++++++++--------
+ 1 file changed, 77 insertions(+), 62 deletions(-)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+@@ -34,6 +34,16 @@
+ 
+ #include "../vc-sm-cma/vc_sm_knl.h"
+ 
++#define pr_dbg_lvl(__level, __debug, __fmt, __arg...)		\
++	do {							\
++		if (__debug >= (__level))			\
++			printk(KERN_DEBUG __fmt, ##__arg);	\
++	} while (0)
++
++static unsigned int debug;
++module_param(debug, uint, 0644);
++MODULE_PARM_DESC(debug, "activates debug info (0-3)");
++
+ /*
+  * maximum number of components supported.
+  * This matches the maximum permitted by default on the VPU
+@@ -381,7 +391,8 @@ buffer_from_host(struct vchiq_mmal_insta
+ 	if (!port->enabled)
+ 		return -EINVAL;
+ 
+-	pr_debug("instance:%u buffer:%p\n", instance->service_handle, buf);
++	pr_dbg_lvl(3, debug, "instance:%u buffer:%p\n",
++		   instance->service_handle, buf);
+ 
+ 	/* get context */
+ 	if (!buf->msg_context) {
+@@ -549,11 +560,11 @@ static void event_to_host_cb(struct vchi
+ 		msg_context->u.bulk.pts = MMAL_TIME_UNKNOWN;
+ 		msg_context->u.bulk.cmd = msg->u.event_to_host.cmd;
+ 
+-		pr_debug("event component:%u port type:%d num:%d cmd:0x%x length:%d\n",
+-			 msg->u.event_to_host.client_component,
+-			 msg->u.event_to_host.port_type,
+-			 msg->u.event_to_host.port_num,
+-			 msg->u.event_to_host.cmd, msg->u.event_to_host.length);
++		pr_dbg_lvl(3, debug, "event component:%u port type:%d num:%d cmd:0x%x length:%d\n",
++			   msg->u.event_to_host.client_component,
++			   msg->u.event_to_host.port_type,
++			   msg->u.event_to_host.port_num,
++			   msg->u.event_to_host.cmd, msg->u.event_to_host.length);
+ 	}
+ 
+ 	schedule_work(&msg_context->u.bulk.work);
+@@ -566,8 +577,8 @@ static void buffer_to_host_cb(struct vch
+ 	struct mmal_msg_context *msg_context;
+ 	u32 handle;
+ 
+-	pr_debug("%s: instance:%p msg:%p msg_len:%d\n",
+-		 __func__, instance, msg, msg_len);
++	pr_dbg_lvl(3, debug, "%s: instance:%p msg:%p msg_len:%d\n",
++		   __func__, instance, msg, msg_len);
+ 
+ 	if (msg->u.buffer_from_host.drvbuf.magic == MMAL_MAGIC) {
+ 		handle = msg->u.buffer_from_host.drvbuf.client_context;
+@@ -837,39 +848,42 @@ static int send_synchronous_mmal_msg(str
+ 
+ static void dump_port_info(struct vchiq_mmal_port *port)
+ {
+-	pr_debug("port handle:0x%x enabled:%d\n", port->handle, port->enabled);
++	pr_dbg_lvl(3, debug, "port handle:0x%x enabled:%d\n", port->handle,
++		   port->enabled);
+ 
+-	pr_debug("buffer minimum num:%d size:%d align:%d\n",
+-		 port->minimum_buffer.num,
+-		 port->minimum_buffer.size, port->minimum_buffer.alignment);
+-
+-	pr_debug("buffer recommended num:%d size:%d align:%d\n",
+-		 port->recommended_buffer.num,
+-		 port->recommended_buffer.size,
+-		 port->recommended_buffer.alignment);
+-
+-	pr_debug("buffer current values num:%d size:%d align:%d\n",
+-		 port->current_buffer.num,
+-		 port->current_buffer.size, port->current_buffer.alignment);
+-
+-	pr_debug("elementary stream: type:%d encoding:0x%x variant:0x%x\n",
+-		 port->format.type,
+-		 port->format.encoding, port->format.encoding_variant);
++	pr_dbg_lvl(3, debug, "buffer minimum num:%d size:%d align:%d\n",
++		   port->minimum_buffer.num,
++		   port->minimum_buffer.size, port->minimum_buffer.alignment);
++
++	pr_dbg_lvl(3, debug, "buffer recommended num:%d size:%d align:%d\n",
++		   port->recommended_buffer.num,
++		   port->recommended_buffer.size,
++		   port->recommended_buffer.alignment);
++
++	pr_dbg_lvl(3, debug, "buffer current values num:%d size:%d align:%d\n",
++		   port->current_buffer.num,
++		   port->current_buffer.size, port->current_buffer.alignment);
++
++	pr_dbg_lvl(3, debug, "elementary stream: type:%d encoding:0x%x variant:0x%x\n",
++		   port->format.type,
++		   port->format.encoding, port->format.encoding_variant);
+ 
+-	pr_debug("		    bitrate:%d flags:0x%x\n",
+-		 port->format.bitrate, port->format.flags);
++	pr_dbg_lvl(3, debug, "		    bitrate:%d flags:0x%x\n",
++		   port->format.bitrate, port->format.flags);
+ 
+ 	if (port->format.type == MMAL_ES_TYPE_VIDEO) {
+-		pr_debug
+-		    ("es video format: width:%d height:%d colourspace:0x%x\n",
++		pr_dbg_lvl(3, debug,
++		    "es video format: width:%d height:%d colourspace:0x%x\n",
+ 		     port->es.video.width, port->es.video.height,
+ 		     port->es.video.color_space);
+ 
+-		pr_debug("		 : crop xywh %d,%d,%d,%d\n",
++		pr_dbg_lvl(3, debug,
++			 "		 : crop xywh %d,%d,%d,%d\n",
+ 			 port->es.video.crop.x,
+ 			 port->es.video.crop.y,
+ 			 port->es.video.crop.width, port->es.video.crop.height);
+-		pr_debug("		 : framerate %d/%d  aspect %d/%d\n",
++		pr_dbg_lvl(3, debug,
++			 "		 : framerate %d/%d  aspect %d/%d\n",
+ 			 port->es.video.frame_rate.numerator,
+ 			 port->es.video.frame_rate.denominator,
+ 			 port->es.video.par.numerator, port->es.video.par.denominator);
+@@ -903,7 +917,7 @@ static int port_info_set(struct vchiq_mm
+ 	struct mmal_msg *rmsg;
+ 	struct vchiq_header *rmsg_handle;
+ 
+-	pr_debug("setting port info port %p\n", port);
++	pr_dbg_lvl(1, debug, "setting port info port %p\n", port);
+ 	if (!port)
+ 		return -1;
+ 	dump_port_info(port);
+@@ -946,8 +960,8 @@ static int port_info_set(struct vchiq_mm
+ 	/* return operation status */
+ 	ret = -rmsg->u.port_info_get_reply.status;
+ 
+-	pr_debug("%s:result:%d component:0x%x port:%d\n", __func__, ret,
+-		 port->component->handle, port->handle);
++	pr_dbg_lvl(1, debug, "%s:result:%d component:0x%x port:%d\n", __func__,
++		   ret, port->component->handle, port->handle);
+ 
+ release_msg:
+ 	vchiq_release_message(instance->vchiq_instance, instance->service_handle, rmsg_handle);
+@@ -1037,13 +1051,13 @@ static int port_info_get(struct vchiq_mm
+ 	       rmsg->u.port_info_get_reply.extradata,
+ 	       port->format.extradata_size);
+ 
+-	pr_debug("received port info\n");
++	pr_dbg_lvl(1, debug, "received port info\n");
+ 	dump_port_info(port);
+ 
+ release_msg:
+ 
+-	pr_debug("%s:result:%d component:0x%x port:%d\n",
+-		 __func__, ret, port->component->handle, port->handle);
++	pr_dbg_lvl(1, debug, "%s:result:%d component:0x%x port:%d\n",
++		   __func__, ret, port->component->handle, port->handle);
+ 
+ 	vchiq_release_message(instance->vchiq_instance, instance->service_handle, rmsg_handle);
+ 
+@@ -1089,9 +1103,9 @@ static int create_component(struct vchiq
+ 	component->outputs = rmsg->u.component_create_reply.output_num;
+ 	component->clocks = rmsg->u.component_create_reply.clock_num;
+ 
+-	pr_debug("Component handle:0x%x in:%d out:%d clock:%d\n",
+-		 component->handle,
+-		 component->inputs, component->outputs, component->clocks);
++	pr_dbg_lvl(2, debug, "Component handle:0x%x in:%d out:%d clock:%d\n",
++		   component->handle,
++		   component->inputs, component->outputs, component->clocks);
+ 
+ release_msg:
+ 	vchiq_release_message(instance->vchiq_instance, instance->service_handle, rmsg_handle);
+@@ -1260,10 +1274,9 @@ static int port_action_port(struct vchiq
+ 
+ 	ret = -rmsg->u.port_action_reply.status;
+ 
+-	pr_debug("%s:result:%d component:0x%x port:%d action:%s(%d)\n",
+-		 __func__,
+-		 ret, port->component->handle, port->handle,
+-		 port_action_type_names[action_type], action_type);
++	pr_dbg_lvl(2, debug, "%s:result:%d component:0x%x port:%d action:%s(%d)\n",
++		   __func__, ret, port->component->handle, port->handle,
++		   port_action_type_names[action_type], action_type);
+ 
+ release_msg:
+ 	vchiq_release_message(instance->vchiq_instance, instance->service_handle, rmsg_handle);
+@@ -1307,11 +1320,11 @@ static int port_action_handle(struct vch
+ 
+ 	ret = -rmsg->u.port_action_reply.status;
+ 
+-	pr_debug("%s:result:%d component:0x%x port:%d action:%s(%d) connect component:0x%x connect port:%d\n",
+-		 __func__,
+-		 ret, port->component->handle, port->handle,
+-		 port_action_type_names[action_type],
+-		 action_type, connect_component_handle, connect_port_handle);
++	pr_dbg_lvl(2, debug,
++		   "%s:result:%d component:0x%x port:%d action:%s(%d) connect component:0x%x connect port:%d\n",
++		   __func__, ret, port->component->handle, port->handle,
++		   port_action_type_names[action_type],
++		   action_type, connect_component_handle, connect_port_handle);
+ 
+ release_msg:
+ 	vchiq_release_message(instance->vchiq_instance, instance->service_handle, rmsg_handle);
+@@ -1350,9 +1363,9 @@ static int port_parameter_set(struct vch
+ 
+ 	ret = -rmsg->u.port_parameter_set_reply.status;
+ 
+-	pr_debug("%s:result:%d component:0x%x port:%d parameter:%d\n",
+-		 __func__,
+-		 ret, port->component->handle, port->handle, parameter_id);
++	pr_dbg_lvl(1, debug, "%s:result:%d component:0x%x port:%d parameter:%d\n",
++		   __func__, ret, port->component->handle, port->handle,
++		   parameter_id);
+ 
+ release_msg:
+ 	vchiq_release_message(instance->vchiq_instance, instance->service_handle, rmsg_handle);
+@@ -1410,8 +1423,9 @@ static int port_parameter_get(struct vch
+ 	/* Always report the size of the returned parameter to the caller */
+ 	*value_size = rmsg->u.port_parameter_get_reply.size;
+ 
+-	pr_debug("%s:result:%d component:0x%x port:%d parameter:%d\n", __func__,
+-		 ret, port->component->handle, port->handle, parameter_id);
++	pr_dbg_lvl(1, debug, "%s:result:%d component:0x%x port:%d parameter:%d\n",
++		   __func__, ret, port->component->handle, port->handle,
++		   parameter_id);
+ 
+ release_msg:
+ 	vchiq_release_message(instance->vchiq_instance, instance->service_handle, rmsg_handle);
+@@ -1668,7 +1682,7 @@ int vchiq_mmal_port_connect_tunnel(struc
+ 	if (!dst) {
+ 		/* do not make new connection */
+ 		ret = 0;
+-		pr_debug("not making new connection\n");
++		pr_dbg_lvl(3, debug, "not making new connection\n");
+ 		goto release_unlock;
+ 	}
+ 
+@@ -1686,14 +1700,14 @@ int vchiq_mmal_port_connect_tunnel(struc
+ 	/* set new format */
+ 	ret = port_info_set(instance, dst);
+ 	if (ret) {
+-		pr_debug("setting port info failed\n");
++		pr_dbg_lvl(1, debug, "setting port info failed\n");
+ 		goto release_unlock;
+ 	}
+ 
+ 	/* read what has actually been set */
+ 	ret = port_info_get(instance, dst);
+ 	if (ret) {
+-		pr_debug("read back port info failed\n");
++		pr_dbg_lvl(1, debug, "read back port info failed\n");
+ 		goto release_unlock;
+ 	}
+ 
+@@ -1702,9 +1716,9 @@ int vchiq_mmal_port_connect_tunnel(struc
+ 				 MMAL_MSG_PORT_ACTION_TYPE_CONNECT,
+ 				 dst->component->handle, dst->handle);
+ 	if (ret < 0) {
+-		pr_debug("connecting port %d:%d to %d:%d failed\n",
+-			 src->component->handle, src->handle,
+-			 dst->component->handle, dst->handle);
++		pr_dbg_lvl(2, debug, "connecting port %d:%d to %d:%d failed\n",
++			   src->component->handle, src->handle,
++			   dst->component->handle, dst->handle);
+ 		goto release_unlock;
+ 	}
+ 	src->connected = dst;
+@@ -1729,7 +1743,8 @@ int vchiq_mmal_submit_buffer(struct vchi
+ 	 * videobuf2 won't let us have the dmabuf there.
+ 	 */
+ 	if (port->zero_copy && buffer->dma_buf && !buffer->vcsm_handle) {
+-		pr_debug("%s: import dmabuf %p\n", __func__, buffer->dma_buf);
++		pr_dbg_lvl(2, debug, "%s: import dmabuf %p\n",
++			   __func__, buffer->dma_buf);
+ 		ret = vc_sm_cma_import_dmabuf(buffer->dma_buf,
+ 					      &buffer->vcsm_handle);
+ 		if (ret) {
+@@ -1745,8 +1760,8 @@ int vchiq_mmal_submit_buffer(struct vchi
+ 			vc_sm_cma_free(buffer->vcsm_handle);
+ 			return ret;
+ 		}
+-		pr_debug("%s: import dmabuf %p - got vc handle %08X\n",
+-			 __func__, buffer->dma_buf, buffer->vc_handle);
++		pr_dbg_lvl(2, debug, "%s: import dmabuf %p - got vc handle %08X\n",
++			   __func__, buffer->dma_buf, buffer->vc_handle);
+ 	}
+ 
+ 	ret = buffer_from_host(instance, port, buffer);
+@@ -1785,8 +1800,8 @@ int mmal_vchi_buffer_cleanup(struct mmal
+ 	if (buf->vcsm_handle) {
+ 		int ret;
+ 
+-		pr_debug("%s: vc_sm_cma_free on handle %p\n", __func__,
+-			 buf->vcsm_handle);
++		pr_dbg_lvl(2, debug, "%s: vc_sm_cma_free on handle %p\n", __func__,
++			   buf->vcsm_handle);
+ 		ret = vc_sm_cma_free(buf->vcsm_handle);
+ 		if (ret)
+ 			pr_err("%s: vcsm_free failed, ret %d\n", __func__, ret);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0246-staging-mmal-vchiq-Reset-buffers_with_vpu-on-port_en.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0246-staging-mmal-vchiq-Reset-buffers_with_vpu-on-port_en.patch
new file mode 100644
index 00000000..71250924
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0246-staging-mmal-vchiq-Reset-buffers_with_vpu-on-port_en.patch
@@ -0,0 +1,31 @@
+From bc95eb20b51249f1842d05152adb65081c85554c Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 21 Sep 2021 17:17:57 +0100
+Subject: [PATCH 246/697] staging: mmal-vchiq: Reset buffers_with_vpu on
+ port_enable
+
+Should we go through the timeout failure case with port_disable
+not returning all buffers for whatever reason, the
+buffers_with_vpu counter gets left at a non-zero value, which
+will cause reference counting issues should the instance be
+reused.
+
+Reset the count when the port is enabled again, but before
+any buffers have been sent to the VPU.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+@@ -1502,6 +1502,8 @@ static int port_enable(struct vchiq_mmal
+ 
+ 	port->enabled = true;
+ 
++	atomic_set(&port->buffers_with_vpu, 0);
++
+ 	if (port->buffer_cb) {
+ 		/* send buffer headers to videocore */
+ 		hdr_count = 1;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0247-hwmon-pwm-fan-Add-fan-speed-register-support.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0247-hwmon-pwm-fan-Add-fan-speed-register-support.patch
new file mode 100644
index 00000000..fa562c0c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0247-hwmon-pwm-fan-Add-fan-speed-register-support.patch
@@ -0,0 +1,164 @@
+From 6cb895f7dd055bf9dea8c3ac2d3769250d0f80e5 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 11 Jul 2023 10:17:29 +0100
+Subject: [PATCH 247/697] hwmon: (pwm-fan) Add fan speed register support
+
+Some platforms include a fan-speed register that reports RPM directly
+as an alternative to counting interrupts from the fan tachometer input.
+Add support for reading a register at a given offset (rpm-offset) within
+a block declared in another node (rpm-regmap). This indirection allows
+the usual address mapping to be performed, and for address sharing with
+another driver.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/hwmon/pwm-fan.c | 59 ++++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 52 insertions(+), 7 deletions(-)
+
+--- a/drivers/hwmon/pwm-fan.c
++++ b/drivers/hwmon/pwm-fan.c
+@@ -13,6 +13,7 @@
+ #include <linux/module.h>
+ #include <linux/mutex.h>
+ #include <linux/platform_device.h>
++#include <linux/of_address.h>
+ #include <linux/property.h>
+ #include <linux/pwm.h>
+ #include <linux/regulator/consumer.h>
+@@ -52,6 +53,9 @@ struct pwm_fan_ctx {
+ 	ktime_t sample_start;
+ 	struct timer_list rpm_timer;
+ 
++	void __iomem *rpm_regbase;
++	unsigned int rpm_offset;
++
+ 	unsigned int pwm_value;
+ 	unsigned int pwm_fan_state;
+ 	unsigned int pwm_fan_max_state;
+@@ -62,6 +66,10 @@ struct pwm_fan_ctx {
+ 	struct hwmon_channel_info fan_channel;
+ };
+ 
++static const u32 rpm_reg_channel_config[] = {
++	HWMON_F_INPUT, 0
++};
++
+ /* This handler assumes self resetting edge triggered interrupt. */
+ static irqreturn_t pulse_handler(int irq, void *dev_id)
+ {
+@@ -337,7 +345,10 @@ static int pwm_fan_read(struct device *d
+ 		}
+ 		return -EOPNOTSUPP;
+ 	case hwmon_fan:
+-		*val = ctx->tachs[channel].rpm;
++		if (ctx->rpm_regbase)
++			*val = (long)readl(ctx->rpm_regbase + ctx->rpm_offset);
++		else
++			*val = ctx->tachs[channel].rpm;
+ 		return 0;
+ 
+ 	default:
+@@ -470,6 +481,7 @@ static void pwm_fan_cleanup(void *__ctx)
+ 	/* Switch off everything */
+ 	ctx->enable_mode = pwm_disable_reg_disable;
+ 	pwm_fan_power_off(ctx, true);
++	iounmap(ctx->rpm_regbase);
+ }
+ 
+ static int pwm_fan_probe(struct platform_device *pdev)
+@@ -542,10 +554,23 @@ static int pwm_fan_probe(struct platform
+ 		return ret;
+ 
+ 	ctx->tach_count = platform_irq_count(pdev);
++	if (ctx->tach_count == 0) {
++		struct device_node *rpm_node;
++
++		rpm_node = of_parse_phandle(dev->of_node, "rpm-regmap", 0);
++		if (rpm_node)
++			ctx->rpm_regbase = of_iomap(rpm_node, 0);
++	}
++
+ 	if (ctx->tach_count < 0)
+ 		return dev_err_probe(dev, ctx->tach_count,
+ 				     "Could not get number of fan tachometer inputs\n");
+-	dev_dbg(dev, "%d fan tachometer inputs\n", ctx->tach_count);
++	if (IS_ERR(ctx->rpm_regbase))
++		return dev_err_probe(dev, PTR_ERR(ctx->rpm_regbase),
++				     "Could not get rpm reg\n");
++
++	dev_dbg(dev, "%d fan tachometer inputs, %d rpm regmap\n", ctx->tach_count,
++		!!ctx->rpm_regbase);
+ 
+ 	if (ctx->tach_count) {
+ 		channel_count++;	/* We also have a FAN channel. */
+@@ -576,12 +601,24 @@ static int pwm_fan_probe(struct platform
+ 
+ 		device_property_read_u32_array(dev, "pulses-per-revolution",
+ 					       ctx->pulses_per_revolution, ctx->tach_count);
++	} else if (ctx->rpm_regbase) {
++		channel_count++;	/* We also have a FAN channel. */
++		ctx->fan_channel.type = hwmon_fan;
++		ctx->fan_channel.config = rpm_reg_channel_config;
++
++		if (device_property_read_u32(dev, "rpm-offset", &ctx->rpm_offset)) {
++			dev_err(&pdev->dev, "unable to read 'rpm-offset'");
++			ret = -EINVAL;
++			goto error;
++		}
+ 	}
+ 
+ 	channels = devm_kcalloc(dev, channel_count + 1,
+ 				sizeof(struct hwmon_channel_info *), GFP_KERNEL);
+-	if (!channels)
+-		return -ENOMEM;
++	if (!channels) {
++		ret = -ENOMEM;
++		goto error;
++	}
+ 
+ 	channels[0] = HWMON_CHANNEL_INFO(pwm, HWMON_PWM_INPUT | HWMON_PWM_ENABLE);
+ 
+@@ -618,6 +655,8 @@ static int pwm_fan_probe(struct platform
+ 		mod_timer(&ctx->rpm_timer, jiffies + HZ);
+ 
+ 		channels[1] = &ctx->fan_channel;
++	} else if (ctx->rpm_regbase) {
++		channels[1] = &ctx->fan_channel;
+ 	}
+ 
+ 	ctx->info.ops = &pwm_fan_hwmon_ops;
+@@ -627,12 +666,13 @@ static int pwm_fan_probe(struct platform
+ 						     ctx, &ctx->info, NULL);
+ 	if (IS_ERR(hwmon)) {
+ 		dev_err(dev, "Failed to register hwmon device\n");
+-		return PTR_ERR(hwmon);
++		ret = PTR_ERR(hwmon);
++		goto error;
+ 	}
+ 
+ 	ret = pwm_fan_get_cooling_data(dev, ctx);
+ 	if (ret)
+-		return ret;
++		goto error;
+ 
+ 	ctx->pwm_fan_state = ctx->pwm_fan_max_state;
+ 	if (IS_ENABLED(CONFIG_THERMAL)) {
+@@ -643,12 +683,17 @@ static int pwm_fan_probe(struct platform
+ 			dev_err(dev,
+ 				"Failed to register pwm-fan as cooling device: %d\n",
+ 				ret);
+-			return ret;
++			goto error;
+ 		}
+ 		ctx->cdev = cdev;
+ 	}
+ 
+ 	return 0;
++
++error:
++	if (ctx->rpm_regbase)
++		iounmap(ctx->rpm_regbase);
++	return ret;
+ }
+ 
+ static void pwm_fan_shutdown(struct platform_device *pdev)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0248-drivers-gpio-Add-a-driver-that-wraps-the-PWM-API-as-.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0248-drivers-gpio-Add-a-driver-that-wraps-the-PWM-API-as-.patch
new file mode 100644
index 00000000..2de4c1f6
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0248-drivers-gpio-Add-a-driver-that-wraps-the-PWM-API-as-.patch
@@ -0,0 +1,196 @@
+From e0454e0d5ccae2f97bdee0ac301f972fabe2e01a Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 14 Oct 2021 11:09:18 +0100
+Subject: [PATCH 248/697] drivers/gpio: Add a driver that wraps the PWM API as
+ a GPIO controller
+
+For cases where spare PWM outputs are available, but are desired
+to be addressed a standard outputs instead.
+Wraps a PWM channel as a new GPIO chip with the one output.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+pwm: gpio-pwm: follow pwm_apply_might_sleep() rename
+
+Fixes: 03286093be68("drivers/gpio: Add a driver that wraps the PWM API as a GPIO controller")
+Signed-off-by: Ratchanan Srirattanamet <peathot@hotmail.com>
+---
+ drivers/gpio/Kconfig    |   8 +++
+ drivers/gpio/Makefile   |   1 +
+ drivers/gpio/gpio-pwm.c | 143 ++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 152 insertions(+)
+ create mode 100644 drivers/gpio/gpio-pwm.c
+
+--- a/drivers/gpio/Kconfig
++++ b/drivers/gpio/Kconfig
+@@ -555,6 +555,14 @@ config GPIO_PL061
+ 	help
+ 	  Say yes here to support the PrimeCell PL061 GPIO device.
+ 
++config GPIO_PWM
++	tristate "PWM chip GPIO"
++	depends on OF_GPIO
++	depends on PWM
++	help
++	  Turn on support for exposing a PWM chip as a GPIO
++	  driver.
++
+ config GPIO_PXA
+ 	bool "PXA GPIO support"
+ 	depends on ARCH_PXA || ARCH_MMP || COMPILE_TEST
+--- a/drivers/gpio/Makefile
++++ b/drivers/gpio/Makefile
+@@ -136,6 +136,7 @@ obj-$(CONFIG_GPIO_PCI_IDIO_16)		+= gpio-
+ obj-$(CONFIG_GPIO_PISOSR)		+= gpio-pisosr.o
+ obj-$(CONFIG_GPIO_PL061)		+= gpio-pl061.o
+ obj-$(CONFIG_GPIO_PMIC_EIC_SPRD)	+= gpio-pmic-eic-sprd.o
++obj-$(CONFIG_GPIO_PWM)			+= gpio-pwm.o
+ obj-$(CONFIG_GPIO_PXA)			+= gpio-pxa.o
+ obj-$(CONFIG_GPIO_RASPBERRYPI_EXP)	+= gpio-raspberrypi-exp.o
+ obj-$(CONFIG_GPIO_RC5T583)		+= gpio-rc5t583.o
+--- /dev/null
++++ b/drivers/gpio/gpio-pwm.c
+@@ -0,0 +1,143 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * GPIO driver wrapping PWM API
++ *
++ * PWM 0% and PWM 100% are equivalent to digital GPIO
++ * outputs, and there are times where it is useful to use
++ * PWM outputs as straight GPIOs (eg outputs of NXP PCA9685
++ * I2C PWM chip). This driver wraps the PWM API as a GPIO
++ * controller.
++ *
++ * Copyright (C) 2021 Raspberry Pi (Trading) Ltd.
++ */
++
++#include <linux/err.h>
++#include <linux/gpio/driver.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/pwm.h>
++
++struct pwm_gpio {
++	struct gpio_chip gc;
++	struct pwm_device **pwm;
++};
++
++static int pwm_gpio_get_direction(struct gpio_chip *gc, unsigned int off)
++{
++	return GPIO_LINE_DIRECTION_OUT;
++}
++
++static void pwm_gpio_set(struct gpio_chip *gc, unsigned int off, int val)
++{
++	struct pwm_gpio *pwm_gpio = gpiochip_get_data(gc);
++	struct pwm_state state;
++
++	pwm_get_state(pwm_gpio->pwm[off], &state);
++	state.duty_cycle = val ? state.period : 0;
++	pwm_apply_might_sleep(pwm_gpio->pwm[off], &state);
++}
++
++static int pwm_gpio_parse_dt(struct pwm_gpio *pwm_gpio,
++			     struct device *dev)
++{
++	struct device_node *node = dev->of_node;
++	struct pwm_state state;
++	int ret = 0, i, num_gpios;
++	const char *pwm_name;
++
++	if (!node)
++		return -ENODEV;
++
++	num_gpios = of_property_count_strings(node, "pwm-names");
++	if (num_gpios <= 0)
++		return 0;
++
++	pwm_gpio->pwm = devm_kzalloc(dev,
++				     sizeof(*pwm_gpio->pwm) * num_gpios,
++				     GFP_KERNEL);
++	if (!pwm_gpio->pwm)
++		return -ENOMEM;
++
++	for (i = 0; i < num_gpios; i++) {
++		ret = of_property_read_string_index(node, "pwm-names", i,
++						    &pwm_name);
++		if (ret) {
++			dev_err(dev, "unable to get pwm device index %d, name %s",
++				i, pwm_name);
++			goto error;
++		}
++
++		pwm_gpio->pwm[i] = devm_pwm_get(dev, pwm_name);
++		if (IS_ERR(pwm_gpio->pwm[i])) {
++			ret = PTR_ERR(pwm_gpio->pwm[i]);
++			if (ret != -EPROBE_DEFER)
++				dev_err(dev, "unable to request PWM\n");
++			goto error;
++		}
++
++		/* Sync up PWM state. */
++		pwm_init_state(pwm_gpio->pwm[i], &state);
++
++		state.duty_cycle = 0;
++		pwm_apply_might_sleep(pwm_gpio->pwm[i], &state);
++	}
++
++	pwm_gpio->gc.ngpio = num_gpios;
++
++error:
++	return ret;
++}
++
++static int pwm_gpio_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct pwm_gpio *pwm_gpio;
++	int ret;
++
++	pwm_gpio = devm_kzalloc(dev, sizeof(*pwm_gpio), GFP_KERNEL);
++	if (!pwm_gpio)
++		return -ENOMEM;
++
++	pwm_gpio->gc.parent = dev;
++	pwm_gpio->gc.label = "pwm-gpio";
++	pwm_gpio->gc.owner = THIS_MODULE;
++	pwm_gpio->gc.fwnode = dev->fwnode;
++	pwm_gpio->gc.base = -1;
++
++	pwm_gpio->gc.get_direction = pwm_gpio_get_direction;
++	pwm_gpio->gc.set = pwm_gpio_set;
++	pwm_gpio->gc.can_sleep = true;
++
++	ret = pwm_gpio_parse_dt(pwm_gpio, dev);
++	if (ret)
++		return ret;
++
++	if (!pwm_gpio->gc.ngpio)
++		return 0;
++
++	return devm_gpiochip_add_data(dev, &pwm_gpio->gc, pwm_gpio);
++}
++
++static void pwm_gpio_remove(struct platform_device *pdev)
++{
++}
++
++static const struct of_device_id pwm_gpio_of_match[] = {
++	{ .compatible = "pwm-gpio" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, pwm_gpio_of_match);
++
++static struct platform_driver pwm_gpio_driver = {
++	.driver	= {
++		.name		= "pwm-gpio",
++		.of_match_table	= of_match_ptr(pwm_gpio_of_match),
++	},
++	.probe	= pwm_gpio_probe,
++	.remove	= pwm_gpio_remove,
++};
++module_platform_driver(pwm_gpio_driver);
++
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Dave Stevenson <dave.stevenson@raspberrypi.com>");
++MODULE_DESCRIPTION("PWM GPIO driver");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0249-media-i2c-ov5647-Sensor-should-report-RAW-color-spac.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0249-media-i2c-ov5647-Sensor-should-report-RAW-color-spac.patch
new file mode 100644
index 00000000..91af6818
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0249-media-i2c-ov5647-Sensor-should-report-RAW-color-spac.patch
@@ -0,0 +1,51 @@
+From a723c1930e1fe4bde697767d63f1b9aa71bc5ad0 Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.com>
+Date: Thu, 21 Oct 2021 14:47:00 +0100
+Subject: [PATCH 249/697] media: i2c: ov5647: Sensor should report RAW color
+ space
+
+Tested on Raspberry Pi running libcamera.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ drivers/media/i2c/ov5647.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/i2c/ov5647.c
++++ b/drivers/media/i2c/ov5647.c
+@@ -508,7 +508,7 @@ static const struct ov5647_mode ov5647_m
+ 	{
+ 		.format = {
+ 			.code		= MEDIA_BUS_FMT_SBGGR10_1X10,
+-			.colorspace	= V4L2_COLORSPACE_SRGB,
++			.colorspace	= V4L2_COLORSPACE_RAW,
+ 			.field		= V4L2_FIELD_NONE,
+ 			.width		= 2592,
+ 			.height		= 1944
+@@ -529,7 +529,7 @@ static const struct ov5647_mode ov5647_m
+ 	{
+ 		.format = {
+ 			.code		= MEDIA_BUS_FMT_SBGGR10_1X10,
+-			.colorspace	= V4L2_COLORSPACE_SRGB,
++			.colorspace	= V4L2_COLORSPACE_RAW,
+ 			.field		= V4L2_FIELD_NONE,
+ 			.width		= 1920,
+ 			.height		= 1080
+@@ -550,7 +550,7 @@ static const struct ov5647_mode ov5647_m
+ 	{
+ 		.format = {
+ 			.code		= MEDIA_BUS_FMT_SBGGR10_1X10,
+-			.colorspace	= V4L2_COLORSPACE_SRGB,
++			.colorspace	= V4L2_COLORSPACE_RAW,
+ 			.field		= V4L2_FIELD_NONE,
+ 			.width		= 1296,
+ 			.height		= 972
+@@ -571,7 +571,7 @@ static const struct ov5647_mode ov5647_m
+ 	{
+ 		.format = {
+ 			.code		= MEDIA_BUS_FMT_SBGGR10_1X10,
+-			.colorspace	= V4L2_COLORSPACE_SRGB,
++			.colorspace	= V4L2_COLORSPACE_RAW,
+ 			.field		= V4L2_FIELD_NONE,
+ 			.width		= 640,
+ 			.height		= 480
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0250-media-bcm2835-unicam-Parse-pad-numbers-correctly.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0250-media-bcm2835-unicam-Parse-pad-numbers-correctly.patch
new file mode 100644
index 00000000..40a01928
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0250-media-bcm2835-unicam-Parse-pad-numbers-correctly.patch
@@ -0,0 +1,232 @@
+From 2e2eb433802c5ab9c83357c4726f4bf86f3797e9 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 23 Sep 2020 15:16:18 +0100
+Subject: [PATCH 250/697] media/bcm2835-unicam: Parse pad numbers correctly
+
+The driver was making big assumptions about the source device
+using pad 0 and 1, which doesn't follow for more complex
+devices where Unicam's source device may be a sink device for
+something else.
+
+Read the pad numbers through media controller, and reference
+them appropriately.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../media/platform/bcm2835/bcm2835-unicam.c   | 89 ++++++++++++-------
+ 1 file changed, 58 insertions(+), 31 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -372,6 +372,8 @@ struct unicam_node {
+ 	int open;
+ 	bool streaming;
+ 	unsigned int pad_id;
++	/* Source pad id on the sensor for this node */
++	unsigned int src_pad_id;
+ 	/* Pointer pointing to current v4l2_buffer */
+ 	struct unicam_buffer *cur_frm;
+ 	/* Pointer pointing to next v4l2_buffer */
+@@ -580,7 +582,7 @@ static int __subdev_get_format(struct un
+ {
+ 	struct v4l2_subdev_format sd_fmt = {
+ 		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
+-		.pad = pad_id
++		.pad = dev->node[pad_id].src_pad_id,
+ 	};
+ 	int ret;
+ 
+@@ -602,7 +604,7 @@ static int __subdev_set_format(struct un
+ {
+ 	struct v4l2_subdev_format sd_fmt = {
+ 		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
+-		.pad = pad_id
++		.pad = dev->node[pad_id].src_pad_id,
+ 	};
+ 	int ret;
+ 
+@@ -1970,7 +1972,7 @@ static int unicam_enum_framesizes(struct
+ 
+ 	fse.which = V4L2_SUBDEV_FORMAT_ACTIVE;
+ 	fse.index = fsize->index;
+-	fse.pad = node->pad_id;
++	fse.pad = node->src_pad_id;
+ 
+ 	ret = v4l2_subdev_call(dev->sensor, pad, enum_frame_size, NULL, &fse);
+ 	if (ret)
+@@ -1995,6 +1997,7 @@ static int unicam_enum_frameintervals(st
+ 	const struct unicam_fmt *fmt;
+ 	struct v4l2_subdev_frame_interval_enum fie = {
+ 		.index = fival->index,
++		.pad = node->src_pad_id,
+ 		.width = fival->width,
+ 		.height = fival->height,
+ 		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
+@@ -2086,8 +2089,13 @@ static int unicam_enum_dv_timings(struct
+ {
+ 	struct unicam_node *node = video_drvdata(file);
+ 	struct unicam_device *dev = node->dev;
++	int ret;
++
++	timings->pad = node->src_pad_id;
++	ret = v4l2_subdev_call(dev->sensor, pad, enum_dv_timings, timings);
++	timings->pad = node->pad_id;
+ 
+-	return v4l2_subdev_call(dev->sensor, pad, enum_dv_timings, timings);
++	return ret;
+ }
+ 
+ static int unicam_dv_timings_cap(struct file *file, void *priv,
+@@ -2095,8 +2103,13 @@ static int unicam_dv_timings_cap(struct
+ {
+ 	struct unicam_node *node = video_drvdata(file);
+ 	struct unicam_device *dev = node->dev;
++	int ret;
++
++	cap->pad = node->src_pad_id;
++	ret = v4l2_subdev_call(dev->sensor, pad, dv_timings_cap, cap);
++	cap->pad = node->pad_id;
+ 
+-	return v4l2_subdev_call(dev->sensor, pad, dv_timings_cap, cap);
++	return ret;
+ }
+ 
+ static int unicam_subscribe_event(struct v4l2_fh *fh,
+@@ -2367,14 +2380,12 @@ static int register_node(struct unicam_d
+ 			 */
+ 			fmt = get_first_supported_format(unicam);
+ 
+-			if (!fmt)
+-				/* No compatible formats */
+-				return -EINVAL;
+-
+-			mbus_fmt.code = fmt->code;
+-			ret = __subdev_set_format(unicam, &mbus_fmt, pad_id);
+-			if (ret)
+-				return -EINVAL;
++			if (fmt) {
++				mbus_fmt.code = fmt->code;
++				ret = __subdev_set_format(unicam, &mbus_fmt, pad_id);
++				if (ret)
++					return -EINVAL;
++			}
+ 		}
+ 		if (mbus_fmt.field != V4L2_FIELD_NONE) {
+ 			/* Interlaced not supported - disable it now. */
+@@ -2384,7 +2395,8 @@ static int register_node(struct unicam_d
+ 				return -EINVAL;
+ 		}
+ 
+-		node->v_fmt.fmt.pix.pixelformat = fmt->fourcc ? fmt->fourcc
++		if (fmt)
++			node->v_fmt.fmt.pix.pixelformat = fmt->fourcc ? fmt->fourcc
+ 						: fmt->repacked_fourcc;
+ 	} else {
+ 		/* Fix this node format as embedded data. */
+@@ -2397,7 +2409,8 @@ static int register_node(struct unicam_d
+ 	node->fmt = fmt;
+ 
+ 	/* Read current subdev format */
+-	unicam_reset_format(node);
++	if (fmt)
++		unicam_reset_format(node);
+ 
+ 	if (v4l2_subdev_has_op(unicam->sensor, video, s_std)) {
+ 		v4l2_std_id tvnorms;
+@@ -2486,6 +2499,7 @@ static int register_node(struct unicam_d
+ 		unicam_err(unicam, "Unable to allocate dummy buffer.\n");
+ 		return -ENOMEM;
+ 	}
++
+ 	if (pad_id == METADATA_PAD ||
+ 	    !v4l2_subdev_has_op(unicam->sensor, video, s_std)) {
+ 		v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_STD);
+@@ -2544,7 +2558,8 @@ static int register_node(struct unicam_d
+ 	node->registered = true;
+ 
+ 	if (pad_id != METADATA_PAD || unicam->sensor_embedded_data) {
+-		ret = media_create_pad_link(&unicam->sensor->entity, pad_id,
++		ret = media_create_pad_link(&unicam->sensor->entity,
++					    node->src_pad_id,
+ 					    &node->video_dev.entity, 0,
+ 					    MEDIA_LNK_FL_ENABLED |
+ 					    MEDIA_LNK_FL_IMMUTABLE);
+@@ -2576,9 +2591,11 @@ static void unregister_nodes(struct unic
+ 	}
+ }
+ 
+-static int unicam_probe_complete(struct unicam_device *unicam)
++static int unicam_async_complete(struct v4l2_async_notifier *notifier)
+ {
+ 	static struct lock_class_key key;
++	struct unicam_device *unicam = to_unicam_device(notifier->v4l2_dev);
++	unsigned int i, source_pads = 0;
+ 	int ret;
+ 
+ 	unicam->v4l2_dev.notify = unicam_notify;
+@@ -2588,7 +2605,20 @@ static int unicam_probe_complete(struct
+ 	if (!unicam->sensor_state)
+ 		return -ENOMEM;
+ 
+-	unicam->sensor_embedded_data = (unicam->sensor->entity.num_pads >= 2);
++	for (i = 0; i < unicam->sensor->entity.num_pads; i++) {
++		if (unicam->sensor->entity.pads[i].flags & MEDIA_PAD_FL_SOURCE) {
++			if (source_pads < MAX_NODES) {
++				unicam->node[source_pads].src_pad_id = i;
++				unicam_err(unicam, "source pad %u is index %u\n",
++					   source_pads, i);
++			}
++			source_pads++;
++		}
++	}
++	if (!source_pads) {
++		unicam_err(unicam, "No source pads on sensor.\n");
++		goto unregister;
++	}
+ 
+ 	ret = register_node(unicam, &unicam->node[IMAGE_PAD],
+ 			    V4L2_BUF_TYPE_VIDEO_CAPTURE, IMAGE_PAD);
+@@ -2597,11 +2627,15 @@ static int unicam_probe_complete(struct
+ 		goto unregister;
+ 	}
+ 
+-	ret = register_node(unicam, &unicam->node[METADATA_PAD],
+-			    V4L2_BUF_TYPE_META_CAPTURE, METADATA_PAD);
+-	if (ret) {
+-		unicam_err(unicam, "Unable to register metadata video device.\n");
+-		goto unregister;
++	if (source_pads >= 2) {
++		unicam->sensor_embedded_data = true;
++
++		ret = register_node(unicam, &unicam->node[METADATA_PAD],
++				    V4L2_BUF_TYPE_META_CAPTURE, METADATA_PAD);
++		if (ret) {
++			unicam_err(unicam, "Unable to register metadata video device.\n");
++			goto unregister;
++		}
+ 	}
+ 
+ 	ret = v4l2_device_register_ro_subdev_nodes(&unicam->v4l2_dev);
+@@ -2624,13 +2658,6 @@ unregister:
+ 	return ret;
+ }
+ 
+-static int unicam_async_complete(struct v4l2_async_notifier *notifier)
+-{
+-	struct unicam_device *unicam = to_unicam_device(notifier->v4l2_dev);
+-
+-	return unicam_probe_complete(unicam);
+-}
+-
+ static const struct v4l2_async_notifier_operations unicam_async_ops = {
+ 	.bound = unicam_async_bound,
+ 	.complete = unicam_async_complete,
+@@ -2739,7 +2766,7 @@ static int of_unicam_connect_subdevs(str
+ 	dev->notifier.ops = &unicam_async_ops;
+ 
+ 	dev->asd.match_type = V4L2_ASYNC_MATCH_FWNODE;
+-	dev->asd.match.fwnode = of_fwnode_handle(sensor_node);
++	dev->asd.match.fwnode = fwnode_graph_get_remote_endpoint(of_fwnode_handle(ep_node));
+ 	ret = __v4l2_async_nf_add_subdev(&dev->notifier, &dev->asd);
+ 	if (ret) {
+ 		unicam_err(dev, "Error adding subdevice: %d\n", ret);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0251-media-bcm2835-unicam-Add-support-for-configuration-v.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0251-media-bcm2835-unicam-Add-support-for-configuration-v.patch
new file mode 100644
index 00000000..2acfcd3f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0251-media-bcm2835-unicam-Add-support-for-configuration-v.patch
@@ -0,0 +1,1941 @@
+From 6dbd2e0f11764dbb959e96b91624257eb94c84b8 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 15 Oct 2021 17:57:27 +0100
+Subject: [PATCH 251/697] media/bcm2835-unicam: Add support for configuration
+ via MC API
+
+Adds Media Controller API support for more complex pipelines.
+libcamera is about to switch to using this mechanism for configuring
+sensors.
+
+This can be enabled by either a module parameter, or device tree.
+
+Various functions have been moved to group video-centric and
+mc-centric functions together.
+
+Based on a similar conversion done to ti-vpe.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: bcm2835-unicam: Fixup for 5.18 and new get_mbus_config struct
+
+The number of active CSI2 data lanes has moved within the struct
+v4l2_mbus_config used by the get_mbus_config API call.
+Update the driver to match the changes in mainline.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../media/platform/bcm2835/bcm2835-unicam.c   | 2110 ++++++++++-------
+ 1 file changed, 1305 insertions(+), 805 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -83,6 +83,10 @@ static int debug;
+ module_param(debug, int, 0644);
+ MODULE_PARM_DESC(debug, "Debug level 0-3");
+ 
++static int media_controller;
++module_param(media_controller, int, 0644);
++MODULE_PARM_DESC(media_controller, "Use media controller API");
++
+ #define unicam_dbg(level, dev, fmt, arg...)	\
+ 		v4l2_dbg(level, debug, &(dev)->v4l2_dev, fmt, ##arg)
+ #define unicam_info(dev, fmt, arg...)	\
+@@ -119,7 +123,7 @@ MODULE_PARM_DESC(debug, "Debug level 0-3
+ #define MIN_WIDTH		16
+ #define MIN_HEIGHT		16
+ /* Default size of the embedded buffer */
+-#define UNICAM_EMBEDDED_SIZE	8192
++#define UNICAM_EMBEDDED_SIZE	16384
+ 
+ /*
+  * Size of the dummy buffer. Can be any size really, but the DMA
+@@ -133,6 +137,22 @@ enum pad_types {
+ 	MAX_NODES
+ };
+ 
++#define MASK_CS_DEFAULT		BIT(V4L2_COLORSPACE_DEFAULT)
++#define MASK_CS_SMPTE170M	BIT(V4L2_COLORSPACE_SMPTE170M)
++#define MASK_CS_SMPTE240M	BIT(V4L2_COLORSPACE_SMPTE240M)
++#define MASK_CS_REC709		BIT(V4L2_COLORSPACE_REC709)
++#define MASK_CS_BT878		BIT(V4L2_COLORSPACE_BT878)
++#define MASK_CS_470_M		BIT(V4L2_COLORSPACE_470_SYSTEM_M)
++#define MASK_CS_470_BG		BIT(V4L2_COLORSPACE_470_SYSTEM_BG)
++#define MASK_CS_JPEG		BIT(V4L2_COLORSPACE_JPEG)
++#define MASK_CS_SRGB		BIT(V4L2_COLORSPACE_SRGB)
++#define MASK_CS_OPRGB		BIT(V4L2_COLORSPACE_OPRGB)
++#define MASK_CS_BT2020		BIT(V4L2_COLORSPACE_BT2020)
++#define MASK_CS_RAW		BIT(V4L2_COLORSPACE_RAW)
++#define MASK_CS_DCI_P3		BIT(V4L2_COLORSPACE_DCI_P3)
++
++#define MAX_COLORSPACE		32
++
+ /*
+  * struct unicam_fmt - Unicam media bus format information
+  * @pixelformat: V4L2 pixel format FCC identifier. 0 if n/a.
+@@ -141,8 +161,14 @@ enum pad_types {
+  * @code: V4L2 media bus format code.
+  * @depth: Bits per pixel as delivered from the source.
+  * @csi_dt: CSI data type.
++ * @valid_colorspaces: Bitmask of valid colorspaces so that the Media Controller
++ *		centric try_fmt can validate the colorspace and pass
++ *		v4l2-compliance.
+  * @check_variants: Flag to denote that there are multiple mediabus formats
+  *		still in the list that could match this V4L2 format.
++ * @mc_skip: Media Controller shouldn't list this format via ENUM_FMT as it is
++ *		a duplicate of an earlier format.
++ * @metadata_fmt: This format only applies to the metadata pad.
+  */
+ struct unicam_fmt {
+ 	u32	fourcc;
+@@ -150,7 +176,10 @@ struct unicam_fmt {
+ 	u32	code;
+ 	u8	depth;
+ 	u8	csi_dt;
+-	u8	check_variants;
++	u32	valid_colorspaces;
++	u8	check_variants:1;
++	u8	mc_skip:1;
++	u8	metadata_fmt:1;
+ };
+ 
+ static const struct unicam_fmt formats[] = {
+@@ -161,169 +190,212 @@ static const struct unicam_fmt formats[]
+ 		.depth		= 16,
+ 		.csi_dt		= 0x1e,
+ 		.check_variants = 1,
++		.valid_colorspaces = MASK_CS_SMPTE170M | MASK_CS_REC709 |
++				     MASK_CS_JPEG,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_UYVY,
+ 		.code		= MEDIA_BUS_FMT_UYVY8_2X8,
+ 		.depth		= 16,
+ 		.csi_dt		= 0x1e,
+ 		.check_variants = 1,
++		.valid_colorspaces = MASK_CS_SMPTE170M | MASK_CS_REC709 |
++				     MASK_CS_JPEG,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_YVYU,
+ 		.code		= MEDIA_BUS_FMT_YVYU8_2X8,
+ 		.depth		= 16,
+ 		.csi_dt		= 0x1e,
+ 		.check_variants = 1,
++		.valid_colorspaces = MASK_CS_SMPTE170M | MASK_CS_REC709 |
++				     MASK_CS_JPEG,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_VYUY,
+ 		.code		= MEDIA_BUS_FMT_VYUY8_2X8,
+ 		.depth		= 16,
+ 		.csi_dt		= 0x1e,
+ 		.check_variants = 1,
++		.valid_colorspaces = MASK_CS_SMPTE170M | MASK_CS_REC709 |
++				     MASK_CS_JPEG,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_YUYV,
+ 		.code		= MEDIA_BUS_FMT_YUYV8_1X16,
+ 		.depth		= 16,
+ 		.csi_dt		= 0x1e,
++		.mc_skip	= 1,
++		.valid_colorspaces = MASK_CS_SMPTE170M | MASK_CS_REC709 |
++				     MASK_CS_JPEG,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_UYVY,
+ 		.code		= MEDIA_BUS_FMT_UYVY8_1X16,
+ 		.depth		= 16,
+ 		.csi_dt		= 0x1e,
++		.mc_skip	= 1,
++		.valid_colorspaces = MASK_CS_SMPTE170M | MASK_CS_REC709 |
++				     MASK_CS_JPEG,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_YVYU,
+ 		.code		= MEDIA_BUS_FMT_YVYU8_1X16,
+ 		.depth		= 16,
+ 		.csi_dt		= 0x1e,
++		.mc_skip	= 1,
++		.valid_colorspaces = MASK_CS_SMPTE170M | MASK_CS_REC709 |
++				     MASK_CS_JPEG,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_VYUY,
+ 		.code		= MEDIA_BUS_FMT_VYUY8_1X16,
+ 		.depth		= 16,
+ 		.csi_dt		= 0x1e,
++		.mc_skip	= 1,
++		.valid_colorspaces = MASK_CS_SMPTE170M | MASK_CS_REC709 |
++				     MASK_CS_JPEG,
+ 	}, {
+ 	/* RGB Formats */
+ 		.fourcc		= V4L2_PIX_FMT_RGB565, /* gggbbbbb rrrrrggg */
+ 		.code		= MEDIA_BUS_FMT_RGB565_2X8_LE,
+ 		.depth		= 16,
+ 		.csi_dt		= 0x22,
++		.valid_colorspaces = MASK_CS_SRGB,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_RGB565X, /* rrrrrggg gggbbbbb */
+ 		.code		= MEDIA_BUS_FMT_RGB565_2X8_BE,
+ 		.depth		= 16,
+-		.csi_dt		= 0x22
++		.csi_dt		= 0x22,
++		.valid_colorspaces = MASK_CS_SRGB,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_RGB555, /* gggbbbbb arrrrrgg */
+ 		.code		= MEDIA_BUS_FMT_RGB555_2X8_PADHI_LE,
+ 		.depth		= 16,
+ 		.csi_dt		= 0x21,
++		.valid_colorspaces = MASK_CS_SRGB,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_RGB555X, /* arrrrrgg gggbbbbb */
+ 		.code		= MEDIA_BUS_FMT_RGB555_2X8_PADHI_BE,
+ 		.depth		= 16,
+ 		.csi_dt		= 0x21,
++		.valid_colorspaces = MASK_CS_SRGB,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_RGB24, /* rgb */
+ 		.code		= MEDIA_BUS_FMT_RGB888_1X24,
+ 		.depth		= 24,
+ 		.csi_dt		= 0x24,
++		.valid_colorspaces = MASK_CS_SRGB,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_BGR24, /* bgr */
+ 		.code		= MEDIA_BUS_FMT_BGR888_1X24,
+ 		.depth		= 24,
+ 		.csi_dt		= 0x24,
++		.valid_colorspaces = MASK_CS_SRGB,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_RGB32, /* argb */
+ 		.code		= MEDIA_BUS_FMT_ARGB8888_1X32,
+ 		.depth		= 32,
+ 		.csi_dt		= 0x0,
++		.valid_colorspaces = MASK_CS_SRGB,
+ 	}, {
+ 	/* Bayer Formats */
+ 		.fourcc		= V4L2_PIX_FMT_SBGGR8,
+ 		.code		= MEDIA_BUS_FMT_SBGGR8_1X8,
+ 		.depth		= 8,
+ 		.csi_dt		= 0x2a,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGBRG8,
+ 		.code		= MEDIA_BUS_FMT_SGBRG8_1X8,
+ 		.depth		= 8,
+ 		.csi_dt		= 0x2a,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGRBG8,
+ 		.code		= MEDIA_BUS_FMT_SGRBG8_1X8,
+ 		.depth		= 8,
+ 		.csi_dt		= 0x2a,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SRGGB8,
+ 		.code		= MEDIA_BUS_FMT_SRGGB8_1X8,
+ 		.depth		= 8,
+ 		.csi_dt		= 0x2a,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SBGGR10P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SBGGR10,
+ 		.code		= MEDIA_BUS_FMT_SBGGR10_1X10,
+ 		.depth		= 10,
+ 		.csi_dt		= 0x2b,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGBRG10P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SGBRG10,
+ 		.code		= MEDIA_BUS_FMT_SGBRG10_1X10,
+ 		.depth		= 10,
+ 		.csi_dt		= 0x2b,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGRBG10P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SGRBG10,
+ 		.code		= MEDIA_BUS_FMT_SGRBG10_1X10,
+ 		.depth		= 10,
+ 		.csi_dt		= 0x2b,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SRGGB10P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SRGGB10,
+ 		.code		= MEDIA_BUS_FMT_SRGGB10_1X10,
+ 		.depth		= 10,
+ 		.csi_dt		= 0x2b,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SBGGR12P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SBGGR12,
+ 		.code		= MEDIA_BUS_FMT_SBGGR12_1X12,
+ 		.depth		= 12,
+ 		.csi_dt		= 0x2c,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGBRG12P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SGBRG12,
+ 		.code		= MEDIA_BUS_FMT_SGBRG12_1X12,
+ 		.depth		= 12,
+ 		.csi_dt		= 0x2c,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGRBG12P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SGRBG12,
+ 		.code		= MEDIA_BUS_FMT_SGRBG12_1X12,
+ 		.depth		= 12,
+ 		.csi_dt		= 0x2c,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SRGGB12P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SRGGB12,
+ 		.code		= MEDIA_BUS_FMT_SRGGB12_1X12,
+ 		.depth		= 12,
+ 		.csi_dt		= 0x2c,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SBGGR14P,
+ 		.code		= MEDIA_BUS_FMT_SBGGR14_1X14,
+ 		.depth		= 14,
+ 		.csi_dt		= 0x2d,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGBRG14P,
+ 		.code		= MEDIA_BUS_FMT_SGBRG14_1X14,
+ 		.depth		= 14,
+ 		.csi_dt		= 0x2d,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGRBG14P,
+ 		.code		= MEDIA_BUS_FMT_SGRBG14_1X14,
+ 		.depth		= 14,
+ 		.csi_dt		= 0x2d,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SRGGB14P,
+ 		.code		= MEDIA_BUS_FMT_SRGGB14_1X14,
+ 		.depth		= 14,
+ 		.csi_dt		= 0x2d,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 	/*
+ 	 * 16 bit Bayer formats could be supported, but there is no CSI2
+@@ -336,24 +408,28 @@ static const struct unicam_fmt formats[]
+ 		.code		= MEDIA_BUS_FMT_Y8_1X8,
+ 		.depth		= 8,
+ 		.csi_dt		= 0x2a,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_Y10P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_Y10,
+ 		.code		= MEDIA_BUS_FMT_Y10_1X10,
+ 		.depth		= 10,
+ 		.csi_dt		= 0x2b,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		/* NB There is no packed V4L2 fourcc for this format. */
+ 		.repacked_fourcc = V4L2_PIX_FMT_Y12,
+ 		.code		= MEDIA_BUS_FMT_Y12_1X12,
+ 		.depth		= 12,
+ 		.csi_dt		= 0x2c,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	},
+ 	/* Embedded data format */
+ 	{
+ 		.fourcc		= V4L2_META_FMT_SENSOR_DATA,
+ 		.code		= MEDIA_BUS_FMT_SENSOR_DATA,
+ 		.depth		= 8,
++		.metadata_fmt	= 1,
+ 	}
+ };
+ 
+@@ -398,6 +474,7 @@ struct unicam_node {
+ 	struct unicam_device *dev;
+ 	struct media_pad pad;
+ 	unsigned int embedded_lines;
++	struct media_pipeline pipe;
+ 	/*
+ 	 * Dummy buffer intended to be used by unicam
+ 	 * if we have no other queued buffers to swap to.
+@@ -449,6 +526,8 @@ struct unicam_device {
+ 
+ 	struct unicam_node node[MAX_NODES];
+ 	struct v4l2_ctrl_handler ctrl_handler;
++
++	bool mc_api;
+ };
+ 
+ static inline struct unicam_device *
+@@ -898,6 +977,7 @@ static irqreturn_t unicam_isr(int irq, v
+ 	return IRQ_HANDLED;
+ }
+ 
++/* V4L2 Common IOCTLs */
+ static int unicam_querycap(struct file *file, void *priv,
+ 			   struct v4l2_capability *cap)
+ {
+@@ -915,6 +995,38 @@ static int unicam_querycap(struct file *
+ 	return 0;
+ }
+ 
++static int unicam_log_status(struct file *file, void *fh)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	u32 reg;
++
++	/* status for sub devices */
++	v4l2_device_call_all(&dev->v4l2_dev, 0, core, log_status);
++
++	unicam_info(dev, "-----Receiver status-----\n");
++	unicam_info(dev, "V4L2 width/height:   %ux%u\n",
++		    node->v_fmt.fmt.pix.width, node->v_fmt.fmt.pix.height);
++	unicam_info(dev, "Mediabus format:     %08x\n", node->fmt->code);
++	unicam_info(dev, "V4L2 format:         %08x\n",
++		    node->v_fmt.fmt.pix.pixelformat);
++	reg = reg_read(dev, UNICAM_IPIPE);
++	unicam_info(dev, "Unpacking/packing:   %u / %u\n",
++		    get_field(reg, UNICAM_PUM_MASK),
++		    get_field(reg, UNICAM_PPM_MASK));
++	unicam_info(dev, "----Live data----\n");
++	unicam_info(dev, "Programmed stride:   %4u\n",
++		    reg_read(dev, UNICAM_IBLS));
++	unicam_info(dev, "Detected resolution: %ux%u\n",
++		    reg_read(dev, UNICAM_IHSTA),
++		    reg_read(dev, UNICAM_IVSTA));
++	unicam_info(dev, "Write pointer:       %08x\n",
++		    reg_read(dev, UNICAM_IBWP));
++
++	return 0;
++}
++
++/* V4L2 Video Centric IOCTLs */
+ static int unicam_enum_fmt_vid_cap(struct file *file, void  *priv,
+ 				   struct v4l2_fmtdesc *f)
+ {
+@@ -1259,6 +1371,727 @@ static int unicam_g_fmt_meta_cap(struct
+ 	return 0;
+ }
+ 
++static int unicam_enum_input(struct file *file, void *priv,
++			     struct v4l2_input *inp)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	int ret;
++
++	if (inp->index != 0)
++		return -EINVAL;
++
++	inp->type = V4L2_INPUT_TYPE_CAMERA;
++	if (v4l2_subdev_has_op(dev->sensor, video, s_dv_timings)) {
++		inp->capabilities = V4L2_IN_CAP_DV_TIMINGS;
++		inp->std = 0;
++	} else if (v4l2_subdev_has_op(dev->sensor, video, s_std)) {
++		inp->capabilities = V4L2_IN_CAP_STD;
++		if (v4l2_subdev_call(dev->sensor, video, g_tvnorms, &inp->std) < 0)
++			inp->std = V4L2_STD_ALL;
++	} else {
++		inp->capabilities = 0;
++		inp->std = 0;
++	}
++
++	if (v4l2_subdev_has_op(dev->sensor, video, g_input_status)) {
++		ret = v4l2_subdev_call(dev->sensor, video, g_input_status,
++				       &inp->status);
++		if (ret < 0)
++			return ret;
++	}
++
++	snprintf(inp->name, sizeof(inp->name), "Camera 0");
++	return 0;
++}
++
++static int unicam_g_input(struct file *file, void *priv, unsigned int *i)
++{
++	*i = 0;
++
++	return 0;
++}
++
++static int unicam_s_input(struct file *file, void *priv, unsigned int i)
++{
++	/*
++	 * FIXME: Ideally we would like to be able to query the source
++	 * subdevice for information over the input connectors it supports,
++	 * and map that through in to a call to video_ops->s_routing.
++	 * There is no infrastructure support for defining that within
++	 * devicetree at present. Until that is implemented we can't
++	 * map a user physical connector number to s_routing input number.
++	 */
++	if (i > 0)
++		return -EINVAL;
++
++	return 0;
++}
++
++static int unicam_querystd(struct file *file, void *priv,
++			   v4l2_std_id *std)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, video, querystd, std);
++}
++
++static int unicam_g_std(struct file *file, void *priv, v4l2_std_id *std)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, video, g_std, std);
++}
++
++static int unicam_s_std(struct file *file, void *priv, v4l2_std_id std)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	int ret;
++	v4l2_std_id current_std;
++
++	ret = v4l2_subdev_call(dev->sensor, video, g_std, &current_std);
++	if (ret)
++		return ret;
++
++	if (std == current_std)
++		return 0;
++
++	if (vb2_is_busy(&node->buffer_queue))
++		return -EBUSY;
++
++	ret = v4l2_subdev_call(dev->sensor, video, s_std, std);
++
++	/* Force recomputation of bytesperline */
++	node->v_fmt.fmt.pix.bytesperline = 0;
++
++	unicam_reset_format(node);
++
++	return ret;
++}
++
++static int unicam_s_edid(struct file *file, void *priv, struct v4l2_edid *edid)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, pad, set_edid, edid);
++}
++
++static int unicam_g_edid(struct file *file, void *priv, struct v4l2_edid *edid)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, pad, get_edid, edid);
++}
++
++static int unicam_s_selection(struct file *file, void *priv,
++			      struct v4l2_selection *sel)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	struct v4l2_subdev_selection sdsel = {
++		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
++		.target = sel->target,
++		.flags = sel->flags,
++		.r = sel->r,
++	};
++
++	if (sel->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
++		return -EINVAL;
++
++	return v4l2_subdev_call(dev->sensor, pad, set_selection, NULL, &sdsel);
++}
++
++static int unicam_g_selection(struct file *file, void *priv,
++			      struct v4l2_selection *sel)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	struct v4l2_subdev_selection sdsel = {
++		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
++		.target = sel->target,
++	};
++	int ret;
++
++	if (sel->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
++		return -EINVAL;
++
++	ret = v4l2_subdev_call(dev->sensor, pad, get_selection, NULL, &sdsel);
++	if (!ret)
++		sel->r = sdsel.r;
++
++	return ret;
++}
++
++static int unicam_enum_framesizes(struct file *file, void *priv,
++				  struct v4l2_frmsizeenum *fsize)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	const struct unicam_fmt *fmt;
++	struct v4l2_subdev_frame_size_enum fse;
++	int ret;
++
++	/* check for valid format */
++	fmt = find_format_by_pix(dev, fsize->pixel_format);
++	if (!fmt) {
++		unicam_dbg(3, dev, "Invalid pixel code: %x\n",
++			   fsize->pixel_format);
++		return -EINVAL;
++	}
++	fse.code = fmt->code;
++
++	fse.which = V4L2_SUBDEV_FORMAT_ACTIVE;
++	fse.index = fsize->index;
++	fse.pad = node->src_pad_id;
++
++	ret = v4l2_subdev_call(dev->sensor, pad, enum_frame_size, NULL, &fse);
++	if (ret)
++		return ret;
++
++	unicam_dbg(1, dev, "%s: index: %d code: %x W:[%d,%d] H:[%d,%d]\n",
++		   __func__, fse.index, fse.code, fse.min_width, fse.max_width,
++		   fse.min_height, fse.max_height);
++
++	fsize->type = V4L2_FRMSIZE_TYPE_DISCRETE;
++	fsize->discrete.width = fse.max_width;
++	fsize->discrete.height = fse.max_height;
++
++	return 0;
++}
++
++static int unicam_enum_frameintervals(struct file *file, void *priv,
++				      struct v4l2_frmivalenum *fival)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	const struct unicam_fmt *fmt;
++	struct v4l2_subdev_frame_interval_enum fie = {
++		.index = fival->index,
++		.pad = node->src_pad_id,
++		.width = fival->width,
++		.height = fival->height,
++		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
++	};
++	int ret;
++
++	fmt = find_format_by_pix(dev, fival->pixel_format);
++	if (!fmt)
++		return -EINVAL;
++
++	fie.code = fmt->code;
++	ret = v4l2_subdev_call(dev->sensor, pad, enum_frame_interval,
++			       NULL, &fie);
++	if (ret)
++		return ret;
++
++	fival->type = V4L2_FRMIVAL_TYPE_DISCRETE;
++	fival->discrete = fie.interval;
++
++	return 0;
++}
++
++static int unicam_g_parm(struct file *file, void *fh, struct v4l2_streamparm *a)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_g_parm_cap(video_devdata(file), dev->sensor, a);
++}
++
++static int unicam_s_parm(struct file *file, void *fh, struct v4l2_streamparm *a)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_s_parm_cap(video_devdata(file), dev->sensor, a);
++}
++
++static int unicam_g_dv_timings(struct file *file, void *priv,
++			       struct v4l2_dv_timings *timings)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, video, g_dv_timings, timings);
++}
++
++static int unicam_s_dv_timings(struct file *file, void *priv,
++			       struct v4l2_dv_timings *timings)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	struct v4l2_dv_timings current_timings;
++	int ret;
++
++	ret = v4l2_subdev_call(dev->sensor, video, g_dv_timings,
++			       &current_timings);
++
++	if (ret < 0)
++		return ret;
++
++	if (v4l2_match_dv_timings(timings, &current_timings, 0, false))
++		return 0;
++
++	if (vb2_is_busy(&node->buffer_queue))
++		return -EBUSY;
++
++	ret = v4l2_subdev_call(dev->sensor, video, s_dv_timings, timings);
++
++	/* Force recomputation of bytesperline */
++	node->v_fmt.fmt.pix.bytesperline = 0;
++
++	unicam_reset_format(node);
++
++	return ret;
++}
++
++static int unicam_query_dv_timings(struct file *file, void *priv,
++				   struct v4l2_dv_timings *timings)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	return v4l2_subdev_call(dev->sensor, video, query_dv_timings, timings);
++}
++
++static int unicam_enum_dv_timings(struct file *file, void *priv,
++				  struct v4l2_enum_dv_timings *timings)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	int ret;
++
++	timings->pad = node->src_pad_id;
++	ret = v4l2_subdev_call(dev->sensor, pad, enum_dv_timings, timings);
++	timings->pad = node->pad_id;
++
++	return ret;
++}
++
++static int unicam_dv_timings_cap(struct file *file, void *priv,
++				 struct v4l2_dv_timings_cap *cap)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	int ret;
++
++	cap->pad = node->src_pad_id;
++	ret = v4l2_subdev_call(dev->sensor, pad, dv_timings_cap, cap);
++	cap->pad = node->pad_id;
++
++	return ret;
++}
++
++static int unicam_subscribe_event(struct v4l2_fh *fh,
++				  const struct v4l2_event_subscription *sub)
++{
++	switch (sub->type) {
++	case V4L2_EVENT_FRAME_SYNC:
++		return v4l2_event_subscribe(fh, sub, 2, NULL);
++	case V4L2_EVENT_SOURCE_CHANGE:
++		return v4l2_event_subscribe(fh, sub, 4, NULL);
++	}
++
++	return v4l2_ctrl_subscribe_event(fh, sub);
++}
++
++static void unicam_notify(struct v4l2_subdev *sd,
++			  unsigned int notification, void *arg)
++{
++	struct unicam_device *dev = to_unicam_device(sd->v4l2_dev);
++
++	switch (notification) {
++	case V4L2_DEVICE_NOTIFY_EVENT:
++		v4l2_event_queue(&dev->node[IMAGE_PAD].video_dev, arg);
++		break;
++	default:
++		break;
++	}
++}
++
++/* unicam capture ioctl operations */
++static const struct v4l2_ioctl_ops unicam_ioctl_ops = {
++	.vidioc_querycap		= unicam_querycap,
++	.vidioc_enum_fmt_vid_cap	= unicam_enum_fmt_vid_cap,
++	.vidioc_g_fmt_vid_cap		= unicam_g_fmt_vid_cap,
++	.vidioc_s_fmt_vid_cap		= unicam_s_fmt_vid_cap,
++	.vidioc_try_fmt_vid_cap		= unicam_try_fmt_vid_cap,
++
++	.vidioc_enum_fmt_meta_cap	= unicam_enum_fmt_meta_cap,
++	.vidioc_g_fmt_meta_cap		= unicam_g_fmt_meta_cap,
++	.vidioc_s_fmt_meta_cap		= unicam_g_fmt_meta_cap,
++	.vidioc_try_fmt_meta_cap	= unicam_g_fmt_meta_cap,
++
++	.vidioc_enum_input		= unicam_enum_input,
++	.vidioc_g_input			= unicam_g_input,
++	.vidioc_s_input			= unicam_s_input,
++
++	.vidioc_querystd		= unicam_querystd,
++	.vidioc_s_std			= unicam_s_std,
++	.vidioc_g_std			= unicam_g_std,
++
++	.vidioc_g_edid			= unicam_g_edid,
++	.vidioc_s_edid			= unicam_s_edid,
++
++	.vidioc_enum_framesizes		= unicam_enum_framesizes,
++	.vidioc_enum_frameintervals	= unicam_enum_frameintervals,
++
++	.vidioc_g_selection		= unicam_g_selection,
++	.vidioc_s_selection		= unicam_s_selection,
++
++	.vidioc_g_parm			= unicam_g_parm,
++	.vidioc_s_parm			= unicam_s_parm,
++
++	.vidioc_s_dv_timings		= unicam_s_dv_timings,
++	.vidioc_g_dv_timings		= unicam_g_dv_timings,
++	.vidioc_query_dv_timings	= unicam_query_dv_timings,
++	.vidioc_enum_dv_timings		= unicam_enum_dv_timings,
++	.vidioc_dv_timings_cap		= unicam_dv_timings_cap,
++
++	.vidioc_reqbufs			= vb2_ioctl_reqbufs,
++	.vidioc_create_bufs		= vb2_ioctl_create_bufs,
++	.vidioc_prepare_buf		= vb2_ioctl_prepare_buf,
++	.vidioc_querybuf		= vb2_ioctl_querybuf,
++	.vidioc_qbuf			= vb2_ioctl_qbuf,
++	.vidioc_dqbuf			= vb2_ioctl_dqbuf,
++	.vidioc_expbuf			= vb2_ioctl_expbuf,
++	.vidioc_streamon		= vb2_ioctl_streamon,
++	.vidioc_streamoff		= vb2_ioctl_streamoff,
++
++	.vidioc_log_status		= unicam_log_status,
++	.vidioc_subscribe_event		= unicam_subscribe_event,
++	.vidioc_unsubscribe_event	= v4l2_event_unsubscribe,
++};
++
++/* V4L2 Media Controller Centric IOCTLs */
++
++static int unicam_mc_enum_fmt_vid_cap(struct file *file, void  *priv,
++				      struct v4l2_fmtdesc *f)
++{
++	int i, j;
++
++	for (i = 0, j = 0; i < ARRAY_SIZE(formats); i++) {
++		if (f->mbus_code && formats[i].code != f->mbus_code)
++			continue;
++		if (formats[i].mc_skip || formats[i].metadata_fmt)
++			continue;
++
++		if (formats[i].fourcc) {
++			if (j == f->index) {
++				f->pixelformat = formats[i].fourcc;
++				f->type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
++				return 0;
++			}
++			j++;
++		}
++		if (formats[i].repacked_fourcc) {
++			if (j == f->index) {
++				f->pixelformat = formats[i].repacked_fourcc;
++				f->type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
++				return 0;
++			}
++			j++;
++		}
++	}
++
++	return -EINVAL;
++}
++
++static int unicam_mc_g_fmt_vid_cap(struct file *file, void *priv,
++				   struct v4l2_format *f)
++{
++	struct unicam_node *node = video_drvdata(file);
++
++	if (node->pad_id != IMAGE_PAD)
++		return -EINVAL;
++
++	*f = node->v_fmt;
++
++	return 0;
++}
++
++static void unicam_mc_try_fmt(struct unicam_node *node, struct v4l2_format *f,
++			      const struct unicam_fmt **ret_fmt)
++{
++	struct v4l2_pix_format *v4l2_format = &f->fmt.pix;
++	struct unicam_device *dev = node->dev;
++	const struct unicam_fmt *fmt;
++	int is_rgb;
++
++	/*
++	 * Default to the first format if the requested pixel format code isn't
++	 * supported.
++	 */
++	fmt = find_format_by_pix(dev, v4l2_format->pixelformat);
++	if (!fmt) {
++		fmt = &formats[0];
++		v4l2_format->pixelformat = fmt->fourcc;
++	}
++
++	unicam_calc_format_size_bpl(dev, fmt, f);
++
++	if (v4l2_format->field == V4L2_FIELD_ANY)
++		v4l2_format->field = V4L2_FIELD_NONE;
++
++	if (ret_fmt)
++		*ret_fmt = fmt;
++
++	if (v4l2_format->colorspace >= MAX_COLORSPACE ||
++	    !(fmt->valid_colorspaces & (1 << v4l2_format->colorspace))) {
++		v4l2_format->colorspace = __ffs(fmt->valid_colorspaces);
++
++		v4l2_format->xfer_func =
++			V4L2_MAP_XFER_FUNC_DEFAULT(v4l2_format->colorspace);
++		v4l2_format->ycbcr_enc =
++			V4L2_MAP_YCBCR_ENC_DEFAULT(v4l2_format->colorspace);
++		is_rgb = v4l2_format->colorspace == V4L2_COLORSPACE_SRGB;
++		v4l2_format->quantization =
++			V4L2_MAP_QUANTIZATION_DEFAULT(is_rgb,
++						      v4l2_format->colorspace,
++						      v4l2_format->ycbcr_enc);
++	}
++
++	unicam_dbg(3, dev, "%s: %08x %ux%u (bytesperline %u sizeimage %u)\n",
++		   __func__, v4l2_format->pixelformat,
++		   v4l2_format->width, v4l2_format->height,
++		   v4l2_format->bytesperline, v4l2_format->sizeimage);
++}
++
++static int unicam_mc_try_fmt_vid_cap(struct file *file, void *priv,
++				     struct v4l2_format *f)
++{
++	struct unicam_node *node = video_drvdata(file);
++
++	unicam_mc_try_fmt(node, f, NULL);
++	return 0;
++}
++
++static int unicam_mc_s_fmt_vid_cap(struct file *file, void *priv,
++				   struct v4l2_format *f)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++	const struct unicam_fmt *fmt;
++
++	if (vb2_is_busy(&node->buffer_queue)) {
++		unicam_dbg(3, dev, "%s device busy\n", __func__);
++		return -EBUSY;
++	}
++
++	unicam_mc_try_fmt(node, f, &fmt);
++
++	node->v_fmt = *f;
++	node->fmt = fmt;
++
++	return 0;
++}
++
++static int unicam_mc_enum_framesizes(struct file *file, void *fh,
++				     struct v4l2_frmsizeenum *fsize)
++{
++	struct unicam_node *node = video_drvdata(file);
++	struct unicam_device *dev = node->dev;
++
++	if (fsize->index > 0)
++		return -EINVAL;
++
++	if (!find_format_by_pix(dev, fsize->pixel_format)) {
++		unicam_dbg(3, dev, "Invalid pixel format 0x%08x\n",
++			   fsize->pixel_format);
++		return -EINVAL;
++	}
++
++	fsize->type = V4L2_FRMSIZE_TYPE_STEPWISE;
++	fsize->stepwise.min_width = MIN_WIDTH;
++	fsize->stepwise.max_width = MAX_WIDTH;
++	fsize->stepwise.step_width = 1;
++	fsize->stepwise.min_height = MIN_HEIGHT;
++	fsize->stepwise.max_height = MAX_HEIGHT;
++	fsize->stepwise.step_height = 1;
++
++	return 0;
++}
++
++static int unicam_mc_enum_fmt_meta_cap(struct file *file, void  *priv,
++				       struct v4l2_fmtdesc *f)
++{
++	int i, j;
++
++	for (i = 0, j = 0; i < ARRAY_SIZE(formats); i++) {
++		if (f->mbus_code && formats[i].code != f->mbus_code)
++			continue;
++		if (!formats[i].metadata_fmt)
++			continue;
++
++		if (formats[i].fourcc) {
++			if (j == f->index) {
++				f->pixelformat = formats[i].fourcc;
++				f->type = V4L2_BUF_TYPE_META_CAPTURE;
++				return 0;
++			}
++			j++;
++		}
++	}
++
++	return -EINVAL;
++}
++
++static int unicam_mc_g_fmt_meta_cap(struct file *file, void *priv,
++				    struct v4l2_format *f)
++{
++	struct unicam_node *node = video_drvdata(file);
++
++	if (node->pad_id != METADATA_PAD)
++		return -EINVAL;
++
++	*f = node->v_fmt;
++
++	return 0;
++}
++
++static int unicam_mc_try_fmt_meta_cap(struct file *file, void *priv,
++				      struct v4l2_format *f)
++{
++	struct unicam_node *node = video_drvdata(file);
++
++	if (node->pad_id != METADATA_PAD)
++		return -EINVAL;
++
++	f->fmt.meta.dataformat = V4L2_META_FMT_SENSOR_DATA;
++
++	return 0;
++}
++
++static int unicam_mc_s_fmt_meta_cap(struct file *file, void *priv,
++				    struct v4l2_format *f)
++{
++	struct unicam_node *node = video_drvdata(file);
++
++	if (node->pad_id != METADATA_PAD)
++		return -EINVAL;
++
++	unicam_mc_try_fmt_meta_cap(file, priv, f);
++
++	node->v_fmt = *f;
++
++	return 0;
++}
++
++static const struct v4l2_ioctl_ops unicam_mc_ioctl_ops = {
++	.vidioc_querycap      = unicam_querycap,
++	.vidioc_enum_fmt_vid_cap  = unicam_mc_enum_fmt_vid_cap,
++	.vidioc_g_fmt_vid_cap     = unicam_mc_g_fmt_vid_cap,
++	.vidioc_try_fmt_vid_cap   = unicam_mc_try_fmt_vid_cap,
++	.vidioc_s_fmt_vid_cap     = unicam_mc_s_fmt_vid_cap,
++
++	.vidioc_enum_fmt_meta_cap	= unicam_mc_enum_fmt_meta_cap,
++	.vidioc_g_fmt_meta_cap		= unicam_mc_g_fmt_meta_cap,
++	.vidioc_try_fmt_meta_cap	= unicam_mc_try_fmt_meta_cap,
++	.vidioc_s_fmt_meta_cap		= unicam_mc_s_fmt_meta_cap,
++
++	.vidioc_enum_framesizes   = unicam_mc_enum_framesizes,
++	.vidioc_reqbufs       = vb2_ioctl_reqbufs,
++	.vidioc_create_bufs   = vb2_ioctl_create_bufs,
++	.vidioc_prepare_buf   = vb2_ioctl_prepare_buf,
++	.vidioc_querybuf      = vb2_ioctl_querybuf,
++	.vidioc_qbuf          = vb2_ioctl_qbuf,
++	.vidioc_dqbuf         = vb2_ioctl_dqbuf,
++	.vidioc_expbuf        = vb2_ioctl_expbuf,
++	.vidioc_streamon      = vb2_ioctl_streamon,
++	.vidioc_streamoff     = vb2_ioctl_streamoff,
++
++	.vidioc_log_status		= unicam_log_status,
++	.vidioc_subscribe_event		= unicam_subscribe_event,
++	.vidioc_unsubscribe_event	= v4l2_event_unsubscribe,
++};
++
++static int
++unicam_mc_subdev_link_validate_get_format(struct media_pad *pad,
++					  struct v4l2_subdev_format *fmt)
++{
++	if (is_media_entity_v4l2_subdev(pad->entity)) {
++		struct v4l2_subdev *sd =
++			media_entity_to_v4l2_subdev(pad->entity);
++
++		fmt->which = V4L2_SUBDEV_FORMAT_ACTIVE;
++		fmt->pad = pad->index;
++		return v4l2_subdev_call(sd, pad, get_fmt, NULL, fmt);
++	}
++
++	return -EINVAL;
++}
++
++static int unicam_mc_video_link_validate(struct media_link *link)
++{
++	struct video_device *vd = container_of(link->sink->entity,
++						struct video_device, entity);
++	struct unicam_node *node = container_of(vd, struct unicam_node,
++						video_dev);
++	struct unicam_device *unicam = node->dev;
++	struct v4l2_subdev_format source_fmt;
++	int ret;
++
++	if (!media_entity_remote_source_pad_unique(link->sink->entity)) {
++		unicam_dbg(1, unicam,
++			   "video node %s pad not connected\n", vd->name);
++		return -ENOTCONN;
++	}
++
++	ret = unicam_mc_subdev_link_validate_get_format(link->source,
++							&source_fmt);
++	if (ret < 0)
++		return 0;
++
++	if (node->pad_id == IMAGE_PAD) {
++		struct v4l2_pix_format *pix_fmt = &node->v_fmt.fmt.pix;
++		const struct unicam_fmt *fmt;
++
++		if (source_fmt.format.width != pix_fmt->width ||
++		    source_fmt.format.height != pix_fmt->height) {
++			unicam_err(unicam,
++				   "Wrong width or height %ux%u (remote pad set to %ux%u)\n",
++				   pix_fmt->width, pix_fmt->height,
++				   source_fmt.format.width,
++				   source_fmt.format.height);
++			return -EINVAL;
++		}
++
++		fmt = find_format_by_code(source_fmt.format.code);
++
++		if (!fmt || (fmt->fourcc != pix_fmt->pixelformat &&
++			     fmt->repacked_fourcc != pix_fmt->pixelformat))
++			return -EINVAL;
++	} else {
++		struct v4l2_meta_format *meta_fmt = &node->v_fmt.fmt.meta;
++
++		if (source_fmt.format.width != meta_fmt->buffersize ||
++		    source_fmt.format.height != 1 ||
++		    source_fmt.format.code != MEDIA_BUS_FMT_SENSOR_DATA) {
++			unicam_err(unicam,
++				   "Wrong metadata width/height/code %ux%u %08x (remote pad set to %ux%u %08x)\n",
++				   meta_fmt->buffersize, 1,
++				   MEDIA_BUS_FMT_SENSOR_DATA,
++				   source_fmt.format.width,
++				   source_fmt.format.height,
++				   source_fmt.format.code);
++			return -EINVAL;
++		}
++	}
++
++	return 0;
++}
++
++static const struct media_entity_operations unicam_mc_entity_ops = {
++	.link_validate = unicam_mc_video_link_validate,
++};
++
++/* videobuf2 Operations */
++
+ static int unicam_queue_setup(struct vb2_queue *vq,
+ 			      unsigned int *nbuffers,
+ 			      unsigned int *nplanes,
+@@ -1485,7 +2318,7 @@ static void unicam_start_rx(struct unica
+ 		/* CSI2 */
+ 		set_field(&val, 1, UNICAM_CLE);
+ 		set_field(&val, 1, UNICAM_CLLPE);
+-		if (dev->bus_flags & V4L2_MBUS_CSI2_CONTINUOUS_CLOCK) {
++		if (!(dev->bus_flags & V4L2_MBUS_CSI2_NONCONTINUOUS_CLOCK)) {
+ 			set_field(&val, 1, UNICAM_CLTRE);
+ 			set_field(&val, 1, UNICAM_CLHSE);
+ 		}
+@@ -1507,7 +2340,7 @@ static void unicam_start_rx(struct unica
+ 		/* CSI2 */
+ 		set_field(&val, 1, UNICAM_DLE);
+ 		set_field(&val, 1, UNICAM_DLLPE);
+-		if (dev->bus_flags & V4L2_MBUS_CSI2_CONTINUOUS_CLOCK) {
++		if (!(dev->bus_flags & V4L2_MBUS_CSI2_NONCONTINUOUS_CLOCK)) {
+ 			set_field(&val, 1, UNICAM_DLTRE);
+ 			set_field(&val, 1, UNICAM_DLHSE);
+ 		}
+@@ -1656,6 +2489,12 @@ static int unicam_start_streaming(struct
+ 		goto err_streaming;
+ 	}
+ 
++	ret = media_pipeline_start(&node->video_dev.entity, &node->pipe);
++	if (ret < 0) {
++		unicam_err(dev, "Failed to start media pipeline: %d\n", ret);
++		goto err_pm_put;
++	}
++
+ 	dev->active_data_lanes = dev->max_data_lanes;
+ 
+ 	if (dev->bus_type == V4L2_MBUS_CSI2_DPHY) {
+@@ -1665,12 +2504,10 @@ static int unicam_start_streaming(struct
+ 				       0, &mbus_config);
+ 		if (ret < 0 && ret != -ENOIOCTLCMD) {
+ 			unicam_dbg(3, dev, "g_mbus_config failed\n");
+-			goto err_pm_put;
++			goto error_pipeline;
+ 		}
+ 
+-		dev->active_data_lanes =
+-			(mbus_config.flags & V4L2_MBUS_CSI2_LANE_MASK) >>
+-					__ffs(V4L2_MBUS_CSI2_LANE_MASK);
++		dev->active_data_lanes = mbus_config.bus.mipi_csi2.num_data_lanes;
+ 		if (!dev->active_data_lanes)
+ 			dev->active_data_lanes = dev->max_data_lanes;
+ 		if (dev->active_data_lanes > dev->max_data_lanes) {
+@@ -1678,7 +2515,7 @@ static int unicam_start_streaming(struct
+ 				   dev->active_data_lanes,
+ 				   dev->max_data_lanes);
+ 			ret = -EINVAL;
+-			goto err_pm_put;
++			goto error_pipeline;
+ 		}
+ 	}
+ 
+@@ -1688,13 +2525,13 @@ static int unicam_start_streaming(struct
+ 	ret = clk_set_min_rate(dev->vpu_clock, MIN_VPU_CLOCK_RATE);
+ 	if (ret) {
+ 		unicam_err(dev, "failed to set up VPU clock\n");
+-		goto err_pm_put;
++		goto error_pipeline;
+ 	}
+ 
+ 	ret = clk_prepare_enable(dev->vpu_clock);
+ 	if (ret) {
+ 		unicam_err(dev, "Failed to enable VPU clock: %d\n", ret);
+-		goto err_pm_put;
++		goto error_pipeline;
+ 	}
+ 
+ 	ret = clk_set_rate(dev->clock, 100 * 1000 * 1000);
+@@ -1745,6 +2582,8 @@ err_vpu_clock:
+ 	if (clk_set_min_rate(dev->vpu_clock, 0))
+ 		unicam_err(dev, "failed to reset the VPU clock\n");
+ 	clk_disable_unprepare(dev->vpu_clock);
++error_pipeline:
++	media_pipeline_stop(&node->video_dev.entity);
+ err_pm_put:
+ 	unicam_runtime_put(dev);
+ err_streaming:
+@@ -1772,6 +2611,8 @@ static void unicam_stop_streaming(struct
+ 
+ 		unicam_disable(dev);
+ 
++		media_pipeline_stop(&node->video_dev.entity);
++
+ 		if (dev->clocks_enabled) {
+ 			if (clk_set_min_rate(dev->vpu_clock, 0))
+ 				unicam_err(dev, "failed to reset the min VPU clock\n");
+@@ -1796,379 +2637,6 @@ static void unicam_stop_streaming(struct
+ 	unicam_return_buffers(node, VB2_BUF_STATE_ERROR);
+ }
+ 
+-static int unicam_enum_input(struct file *file, void *priv,
+-			     struct v4l2_input *inp)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-	int ret;
+-
+-	if (inp->index != 0)
+-		return -EINVAL;
+-
+-	inp->type = V4L2_INPUT_TYPE_CAMERA;
+-	if (v4l2_subdev_has_op(dev->sensor, video, s_dv_timings)) {
+-		inp->capabilities = V4L2_IN_CAP_DV_TIMINGS;
+-		inp->std = 0;
+-	} else if (v4l2_subdev_has_op(dev->sensor, video, s_std)) {
+-		inp->capabilities = V4L2_IN_CAP_STD;
+-		if (v4l2_subdev_call(dev->sensor, video, g_tvnorms, &inp->std) < 0)
+-			inp->std = V4L2_STD_ALL;
+-	} else {
+-		inp->capabilities = 0;
+-		inp->std = 0;
+-	}
+-
+-	if (v4l2_subdev_has_op(dev->sensor, video, g_input_status)) {
+-		ret = v4l2_subdev_call(dev->sensor, video, g_input_status,
+-				       &inp->status);
+-		if (ret < 0)
+-			return ret;
+-	}
+-
+-	snprintf(inp->name, sizeof(inp->name), "Camera 0");
+-	return 0;
+-}
+-
+-static int unicam_g_input(struct file *file, void *priv, unsigned int *i)
+-{
+-	*i = 0;
+-
+-	return 0;
+-}
+-
+-static int unicam_s_input(struct file *file, void *priv, unsigned int i)
+-{
+-	/*
+-	 * FIXME: Ideally we would like to be able to query the source
+-	 * subdevice for information over the input connectors it supports,
+-	 * and map that through in to a call to video_ops->s_routing.
+-	 * There is no infrastructure support for defining that within
+-	 * devicetree at present. Until that is implemented we can't
+-	 * map a user physical connector number to s_routing input number.
+-	 */
+-	if (i > 0)
+-		return -EINVAL;
+-
+-	return 0;
+-}
+-
+-static int unicam_querystd(struct file *file, void *priv,
+-			   v4l2_std_id *std)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-
+-	return v4l2_subdev_call(dev->sensor, video, querystd, std);
+-}
+-
+-static int unicam_g_std(struct file *file, void *priv, v4l2_std_id *std)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-
+-	return v4l2_subdev_call(dev->sensor, video, g_std, std);
+-}
+-
+-static int unicam_s_std(struct file *file, void *priv, v4l2_std_id std)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-	int ret;
+-	v4l2_std_id current_std;
+-
+-	ret = v4l2_subdev_call(dev->sensor, video, g_std, &current_std);
+-	if (ret)
+-		return ret;
+-
+-	if (std == current_std)
+-		return 0;
+-
+-	if (vb2_is_busy(&node->buffer_queue))
+-		return -EBUSY;
+-
+-	ret = v4l2_subdev_call(dev->sensor, video, s_std, std);
+-
+-	/* Force recomputation of bytesperline */
+-	node->v_fmt.fmt.pix.bytesperline = 0;
+-
+-	unicam_reset_format(node);
+-
+-	return ret;
+-}
+-
+-static int unicam_s_edid(struct file *file, void *priv, struct v4l2_edid *edid)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-
+-	return v4l2_subdev_call(dev->sensor, pad, set_edid, edid);
+-}
+-
+-static int unicam_g_edid(struct file *file, void *priv, struct v4l2_edid *edid)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-
+-	return v4l2_subdev_call(dev->sensor, pad, get_edid, edid);
+-}
+-
+-static int unicam_s_selection(struct file *file, void *priv,
+-			      struct v4l2_selection *sel)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-	struct v4l2_subdev_selection sdsel = {
+-		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
+-		.target = sel->target,
+-		.flags = sel->flags,
+-		.r = sel->r,
+-	};
+-
+-	if (sel->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+-		return -EINVAL;
+-
+-	return v4l2_subdev_call(dev->sensor, pad, set_selection, NULL, &sdsel);
+-}
+-
+-static int unicam_g_selection(struct file *file, void *priv,
+-			      struct v4l2_selection *sel)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-	struct v4l2_subdev_selection sdsel = {
+-		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
+-		.target = sel->target,
+-	};
+-	int ret;
+-
+-	if (sel->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+-		return -EINVAL;
+-
+-	ret = v4l2_subdev_call(dev->sensor, pad, get_selection, NULL, &sdsel);
+-	if (!ret)
+-		sel->r = sdsel.r;
+-
+-	return ret;
+-}
+-
+-static int unicam_enum_framesizes(struct file *file, void *priv,
+-				  struct v4l2_frmsizeenum *fsize)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-	const struct unicam_fmt *fmt;
+-	struct v4l2_subdev_frame_size_enum fse;
+-	int ret;
+-
+-	/* check for valid format */
+-	fmt = find_format_by_pix(dev, fsize->pixel_format);
+-	if (!fmt) {
+-		unicam_dbg(3, dev, "Invalid pixel code: %x\n",
+-			   fsize->pixel_format);
+-		return -EINVAL;
+-	}
+-	fse.code = fmt->code;
+-
+-	fse.which = V4L2_SUBDEV_FORMAT_ACTIVE;
+-	fse.index = fsize->index;
+-	fse.pad = node->src_pad_id;
+-
+-	ret = v4l2_subdev_call(dev->sensor, pad, enum_frame_size, NULL, &fse);
+-	if (ret)
+-		return ret;
+-
+-	unicam_dbg(1, dev, "%s: index: %d code: %x W:[%d,%d] H:[%d,%d]\n",
+-		   __func__, fse.index, fse.code, fse.min_width, fse.max_width,
+-		   fse.min_height, fse.max_height);
+-
+-	fsize->type = V4L2_FRMSIZE_TYPE_DISCRETE;
+-	fsize->discrete.width = fse.max_width;
+-	fsize->discrete.height = fse.max_height;
+-
+-	return 0;
+-}
+-
+-static int unicam_enum_frameintervals(struct file *file, void *priv,
+-				      struct v4l2_frmivalenum *fival)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-	const struct unicam_fmt *fmt;
+-	struct v4l2_subdev_frame_interval_enum fie = {
+-		.index = fival->index,
+-		.pad = node->src_pad_id,
+-		.width = fival->width,
+-		.height = fival->height,
+-		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
+-	};
+-	int ret;
+-
+-	fmt = find_format_by_pix(dev, fival->pixel_format);
+-	if (!fmt)
+-		return -EINVAL;
+-
+-	fie.code = fmt->code;
+-	ret = v4l2_subdev_call(dev->sensor, pad, enum_frame_interval,
+-			       NULL, &fie);
+-	if (ret)
+-		return ret;
+-
+-	fival->type = V4L2_FRMIVAL_TYPE_DISCRETE;
+-	fival->discrete = fie.interval;
+-
+-	return 0;
+-}
+-
+-static int unicam_g_parm(struct file *file, void *fh, struct v4l2_streamparm *a)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-
+-	return v4l2_g_parm_cap(video_devdata(file), dev->sensor, a);
+-}
+-
+-static int unicam_s_parm(struct file *file, void *fh, struct v4l2_streamparm *a)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-
+-	return v4l2_s_parm_cap(video_devdata(file), dev->sensor, a);
+-}
+-
+-static int unicam_g_dv_timings(struct file *file, void *priv,
+-			       struct v4l2_dv_timings *timings)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-
+-	return v4l2_subdev_call(dev->sensor, video, g_dv_timings, timings);
+-}
+-
+-static int unicam_s_dv_timings(struct file *file, void *priv,
+-			       struct v4l2_dv_timings *timings)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-	struct v4l2_dv_timings current_timings;
+-	int ret;
+-
+-	ret = v4l2_subdev_call(dev->sensor, video, g_dv_timings,
+-			       &current_timings);
+-
+-	if (ret < 0)
+-		return ret;
+-
+-	if (v4l2_match_dv_timings(timings, &current_timings, 0, false))
+-		return 0;
+-
+-	if (vb2_is_busy(&node->buffer_queue))
+-		return -EBUSY;
+-
+-	ret = v4l2_subdev_call(dev->sensor, video, s_dv_timings, timings);
+-
+-	/* Force recomputation of bytesperline */
+-	node->v_fmt.fmt.pix.bytesperline = 0;
+-
+-	unicam_reset_format(node);
+-
+-	return ret;
+-}
+-
+-static int unicam_query_dv_timings(struct file *file, void *priv,
+-				   struct v4l2_dv_timings *timings)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-
+-	return v4l2_subdev_call(dev->sensor, video, query_dv_timings, timings);
+-}
+-
+-static int unicam_enum_dv_timings(struct file *file, void *priv,
+-				  struct v4l2_enum_dv_timings *timings)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-	int ret;
+-
+-	timings->pad = node->src_pad_id;
+-	ret = v4l2_subdev_call(dev->sensor, pad, enum_dv_timings, timings);
+-	timings->pad = node->pad_id;
+-
+-	return ret;
+-}
+-
+-static int unicam_dv_timings_cap(struct file *file, void *priv,
+-				 struct v4l2_dv_timings_cap *cap)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-	int ret;
+-
+-	cap->pad = node->src_pad_id;
+-	ret = v4l2_subdev_call(dev->sensor, pad, dv_timings_cap, cap);
+-	cap->pad = node->pad_id;
+-
+-	return ret;
+-}
+-
+-static int unicam_subscribe_event(struct v4l2_fh *fh,
+-				  const struct v4l2_event_subscription *sub)
+-{
+-	switch (sub->type) {
+-	case V4L2_EVENT_FRAME_SYNC:
+-		return v4l2_event_subscribe(fh, sub, 2, NULL);
+-	case V4L2_EVENT_SOURCE_CHANGE:
+-		return v4l2_event_subscribe(fh, sub, 4, NULL);
+-	}
+-
+-	return v4l2_ctrl_subscribe_event(fh, sub);
+-}
+-
+-static int unicam_log_status(struct file *file, void *fh)
+-{
+-	struct unicam_node *node = video_drvdata(file);
+-	struct unicam_device *dev = node->dev;
+-	u32 reg;
+-
+-	/* status for sub devices */
+-	v4l2_device_call_all(&dev->v4l2_dev, 0, core, log_status);
+-
+-	unicam_info(dev, "-----Receiver status-----\n");
+-	unicam_info(dev, "V4L2 width/height:   %ux%u\n",
+-		    node->v_fmt.fmt.pix.width, node->v_fmt.fmt.pix.height);
+-	unicam_info(dev, "Mediabus format:     %08x\n", node->fmt->code);
+-	unicam_info(dev, "V4L2 format:         %08x\n",
+-		    node->v_fmt.fmt.pix.pixelformat);
+-	reg = reg_read(dev, UNICAM_IPIPE);
+-	unicam_info(dev, "Unpacking/packing:   %u / %u\n",
+-		    get_field(reg, UNICAM_PUM_MASK),
+-		    get_field(reg, UNICAM_PPM_MASK));
+-	unicam_info(dev, "----Live data----\n");
+-	unicam_info(dev, "Programmed stride:   %4u\n",
+-		    reg_read(dev, UNICAM_IBLS));
+-	unicam_info(dev, "Detected resolution: %ux%u\n",
+-		    reg_read(dev, UNICAM_IHSTA),
+-		    reg_read(dev, UNICAM_IVSTA));
+-	unicam_info(dev, "Write pointer:       %08x\n",
+-		    reg_read(dev, UNICAM_IBWP));
+-
+-	return 0;
+-}
+-
+-static void unicam_notify(struct v4l2_subdev *sd,
+-			  unsigned int notification, void *arg)
+-{
+-	struct unicam_device *dev = to_unicam_device(sd->v4l2_dev);
+-
+-	switch (notification) {
+-	case V4L2_DEVICE_NOTIFY_EVENT:
+-		v4l2_event_queue(&dev->node[IMAGE_PAD].video_dev, arg);
+-		break;
+-	default:
+-		break;
+-	}
+-}
+ 
+ static const struct vb2_ops unicam_video_qops = {
+ 	.wait_prepare		= vb2_ops_wait_prepare,
+@@ -2251,60 +2719,6 @@ static const struct v4l2_file_operations
+ 	.mmap		= vb2_fop_mmap,
+ };
+ 
+-/* unicam capture ioctl operations */
+-static const struct v4l2_ioctl_ops unicam_ioctl_ops = {
+-	.vidioc_querycap		= unicam_querycap,
+-	.vidioc_enum_fmt_vid_cap	= unicam_enum_fmt_vid_cap,
+-	.vidioc_g_fmt_vid_cap		= unicam_g_fmt_vid_cap,
+-	.vidioc_s_fmt_vid_cap		= unicam_s_fmt_vid_cap,
+-	.vidioc_try_fmt_vid_cap		= unicam_try_fmt_vid_cap,
+-
+-	.vidioc_enum_fmt_meta_cap	= unicam_enum_fmt_meta_cap,
+-	.vidioc_g_fmt_meta_cap		= unicam_g_fmt_meta_cap,
+-	.vidioc_s_fmt_meta_cap		= unicam_g_fmt_meta_cap,
+-	.vidioc_try_fmt_meta_cap	= unicam_g_fmt_meta_cap,
+-
+-	.vidioc_enum_input		= unicam_enum_input,
+-	.vidioc_g_input			= unicam_g_input,
+-	.vidioc_s_input			= unicam_s_input,
+-
+-	.vidioc_querystd		= unicam_querystd,
+-	.vidioc_s_std			= unicam_s_std,
+-	.vidioc_g_std			= unicam_g_std,
+-
+-	.vidioc_g_edid			= unicam_g_edid,
+-	.vidioc_s_edid			= unicam_s_edid,
+-
+-	.vidioc_enum_framesizes		= unicam_enum_framesizes,
+-	.vidioc_enum_frameintervals	= unicam_enum_frameintervals,
+-
+-	.vidioc_g_selection		= unicam_g_selection,
+-	.vidioc_s_selection		= unicam_s_selection,
+-
+-	.vidioc_g_parm			= unicam_g_parm,
+-	.vidioc_s_parm			= unicam_s_parm,
+-
+-	.vidioc_s_dv_timings		= unicam_s_dv_timings,
+-	.vidioc_g_dv_timings		= unicam_g_dv_timings,
+-	.vidioc_query_dv_timings	= unicam_query_dv_timings,
+-	.vidioc_enum_dv_timings		= unicam_enum_dv_timings,
+-	.vidioc_dv_timings_cap		= unicam_dv_timings_cap,
+-
+-	.vidioc_reqbufs			= vb2_ioctl_reqbufs,
+-	.vidioc_create_bufs		= vb2_ioctl_create_bufs,
+-	.vidioc_prepare_buf		= vb2_ioctl_prepare_buf,
+-	.vidioc_querybuf		= vb2_ioctl_querybuf,
+-	.vidioc_qbuf			= vb2_ioctl_qbuf,
+-	.vidioc_dqbuf			= vb2_ioctl_dqbuf,
+-	.vidioc_expbuf			= vb2_ioctl_expbuf,
+-	.vidioc_streamon		= vb2_ioctl_streamon,
+-	.vidioc_streamoff		= vb2_ioctl_streamoff,
+-
+-	.vidioc_log_status		= unicam_log_status,
+-	.vidioc_subscribe_event		= unicam_subscribe_event,
+-	.vidioc_unsubscribe_event	= v4l2_event_unsubscribe,
+-};
+-
+ static int
+ unicam_async_bound(struct v4l2_async_notifier *notifier,
+ 		   struct v4l2_subdev *subdev,
+@@ -2355,11 +2769,11 @@ static void unicam_node_release(struct v
+ 	unicam_put(node->dev);
+ }
+ 
+-static int register_node(struct unicam_device *unicam, struct unicam_node *node,
+-			 enum v4l2_buf_type type, int pad_id)
++static int unicam_set_default_format(struct unicam_device *unicam,
++				     struct unicam_node *node,
++				     int pad_id,
++				     const struct unicam_fmt **ret_fmt)
+ {
+-	struct video_device *vdev;
+-	struct vb2_queue *q;
+ 	struct v4l2_mbus_framefmt mbus_fmt = {0};
+ 	const struct unicam_fmt *fmt;
+ 	int ret;
+@@ -2404,15 +2818,69 @@ static int register_node(struct unicam_d
+ 		node->v_fmt.fmt.meta.dataformat = fmt->fourcc;
+ 	}
+ 
++	*ret_fmt = fmt;
++
++	return 0;
++}
++
++static void unicam_mc_set_default_format(struct unicam_node *node, int pad_id)
++{
++	if (pad_id == IMAGE_PAD) {
++		struct v4l2_pix_format *pix_fmt = &node->v_fmt.fmt.pix;
++
++		pix_fmt->width = 640;
++		pix_fmt->height = 480;
++		pix_fmt->field = V4L2_FIELD_NONE;
++		pix_fmt->colorspace = V4L2_COLORSPACE_SRGB;
++		pix_fmt->ycbcr_enc = V4L2_YCBCR_ENC_601;
++		pix_fmt->quantization = V4L2_QUANTIZATION_LIM_RANGE;
++		pix_fmt->xfer_func = V4L2_XFER_FUNC_SRGB;
++		pix_fmt->pixelformat = formats[0].fourcc;
++		unicam_calc_format_size_bpl(node->dev, &formats[0],
++					    &node->v_fmt);
++		node->v_fmt.type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
++
++		node->fmt = &formats[0];
++	} else {
++		const struct unicam_fmt *fmt;
++
++		/* Fix this node format as embedded data. */
++		fmt = find_format_by_code(MEDIA_BUS_FMT_SENSOR_DATA);
++		node->v_fmt.fmt.meta.dataformat = fmt->fourcc;
++		node->fmt = fmt;
++
++		node->v_fmt.fmt.meta.buffersize = UNICAM_EMBEDDED_SIZE;
++		node->embedded_lines = 1;
++		node->v_fmt.type = V4L2_BUF_TYPE_META_CAPTURE;
++	}
++}
++
++static int register_node(struct unicam_device *unicam, struct unicam_node *node,
++			 enum v4l2_buf_type type, int pad_id)
++{
++	struct video_device *vdev;
++	struct vb2_queue *q;
++	int ret;
++
+ 	node->dev = unicam;
+ 	node->pad_id = pad_id;
+-	node->fmt = fmt;
+ 
+-	/* Read current subdev format */
+-	if (fmt)
+-		unicam_reset_format(node);
++	if (!unicam->mc_api) {
++		const struct unicam_fmt *fmt;
+ 
+-	if (v4l2_subdev_has_op(unicam->sensor, video, s_std)) {
++		ret = unicam_set_default_format(unicam, node, pad_id, &fmt);
++		if (ret)
++			return ret;
++		node->fmt = fmt;
++		/* Read current subdev format */
++		if (fmt)
++			unicam_reset_format(node);
++	} else {
++		unicam_mc_set_default_format(node, pad_id);
++	}
++
++	if (!unicam->mc_api &&
++	    v4l2_subdev_has_op(unicam->sensor, video, s_std)) {
+ 		v4l2_std_id tvnorms;
+ 
+ 		if (WARN_ON(!v4l2_subdev_has_op(unicam->sensor, video,
+@@ -2435,12 +2903,15 @@ static int register_node(struct unicam_d
+ 
+ 	vdev = &node->video_dev;
+ 	if (pad_id == IMAGE_PAD) {
+-		/* Add controls from the subdevice */
+-		ret = v4l2_ctrl_add_handler(&unicam->ctrl_handler,
+-					    unicam->sensor->ctrl_handler, NULL,
+-					    true);
+-		if (ret < 0)
+-			return ret;
++		if (!unicam->mc_api) {
++			/* Add controls from the subdevice */
++			ret = v4l2_ctrl_add_handler(&unicam->ctrl_handler,
++						    unicam->sensor->ctrl_handler,
++						    NULL,
++						    true);
++			if (ret < 0)
++				return ret;
++		}
+ 
+ 		/*
+ 		 * If the sensor subdevice has any controls, associate the node
+@@ -2472,7 +2943,8 @@ static int register_node(struct unicam_d
+ 
+ 	vdev->release = unicam_node_release;
+ 	vdev->fops = &unicam_fops;
+-	vdev->ioctl_ops = &unicam_ioctl_ops;
++	vdev->ioctl_ops = unicam->mc_api ? &unicam_mc_ioctl_ops :
++					   &unicam_ioctl_ops;
+ 	vdev->v4l2_dev = &unicam->v4l2_dev;
+ 	vdev->vfl_dir = VFL_DIR_RX;
+ 	vdev->queue = q;
+@@ -2480,6 +2952,10 @@ static int register_node(struct unicam_d
+ 	vdev->device_caps = (pad_id == IMAGE_PAD) ?
+ 				V4L2_CAP_VIDEO_CAPTURE : V4L2_CAP_META_CAPTURE;
+ 	vdev->device_caps |= V4L2_CAP_READWRITE | V4L2_CAP_STREAMING;
++	if (unicam->mc_api) {
++		vdev->device_caps |= V4L2_CAP_IO_MC;
++		vdev->entity.ops = &unicam_mc_entity_ops;
++	}
+ 
+ 	/* Define the device names */
+ 	snprintf(vdev->name, sizeof(vdev->name), "%s-%s", UNICAM_MODULE_NAME,
+@@ -2499,48 +2975,61 @@ static int register_node(struct unicam_d
+ 		unicam_err(unicam, "Unable to allocate dummy buffer.\n");
+ 		return -ENOMEM;
+ 	}
+-
+-	if (pad_id == METADATA_PAD ||
+-	    !v4l2_subdev_has_op(unicam->sensor, video, s_std)) {
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_STD);
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_STD);
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_ENUMSTD);
+-	}
+-	if (pad_id == METADATA_PAD ||
+-	    !v4l2_subdev_has_op(unicam->sensor, video, querystd))
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_QUERYSTD);
+-	if (pad_id == METADATA_PAD ||
+-	    !v4l2_subdev_has_op(unicam->sensor, video, s_dv_timings)) {
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_EDID);
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_EDID);
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_DV_TIMINGS_CAP);
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_DV_TIMINGS);
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_DV_TIMINGS);
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_ENUM_DV_TIMINGS);
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_QUERY_DV_TIMINGS);
+-	}
+-	if (pad_id == METADATA_PAD ||
+-	    !v4l2_subdev_has_op(unicam->sensor, pad, enum_frame_interval))
+-		v4l2_disable_ioctl(&node->video_dev,
+-				   VIDIOC_ENUM_FRAMEINTERVALS);
+-	if (pad_id == METADATA_PAD ||
+-	    !v4l2_subdev_has_op(unicam->sensor, video, g_frame_interval))
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_PARM);
+-	if (pad_id == METADATA_PAD ||
+-	    !v4l2_subdev_has_op(unicam->sensor, video, s_frame_interval))
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_PARM);
+-
+-	if (pad_id == METADATA_PAD ||
+-	    !v4l2_subdev_has_op(unicam->sensor, pad, enum_frame_size))
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_ENUM_FRAMESIZES);
+-
+-	if (node->pad_id == METADATA_PAD ||
+-	    !v4l2_subdev_has_op(unicam->sensor, pad, set_selection))
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_SELECTION);
+-
+-	if (node->pad_id == METADATA_PAD ||
+-	    !v4l2_subdev_has_op(unicam->sensor, pad, get_selection))
+-		v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_SELECTION);
++	if (!unicam->mc_api) {
++		if (pad_id == METADATA_PAD ||
++		    !v4l2_subdev_has_op(unicam->sensor, video, s_std)) {
++			v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_STD);
++			v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_STD);
++			v4l2_disable_ioctl(&node->video_dev, VIDIOC_ENUMSTD);
++		}
++		if (pad_id == METADATA_PAD ||
++		    !v4l2_subdev_has_op(unicam->sensor, video, querystd))
++			v4l2_disable_ioctl(&node->video_dev, VIDIOC_QUERYSTD);
++		if (pad_id == METADATA_PAD ||
++		    !v4l2_subdev_has_op(unicam->sensor, video, s_dv_timings)) {
++			v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_EDID);
++			v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_EDID);
++			v4l2_disable_ioctl(&node->video_dev,
++					   VIDIOC_DV_TIMINGS_CAP);
++			v4l2_disable_ioctl(&node->video_dev,
++					   VIDIOC_G_DV_TIMINGS);
++			v4l2_disable_ioctl(&node->video_dev,
++					   VIDIOC_S_DV_TIMINGS);
++			v4l2_disable_ioctl(&node->video_dev,
++					   VIDIOC_ENUM_DV_TIMINGS);
++			v4l2_disable_ioctl(&node->video_dev,
++					   VIDIOC_QUERY_DV_TIMINGS);
++		}
++		if (pad_id == METADATA_PAD ||
++		    !v4l2_subdev_has_op(unicam->sensor, pad,
++					enum_frame_interval))
++			v4l2_disable_ioctl(&node->video_dev,
++					   VIDIOC_ENUM_FRAMEINTERVALS);
++		if (pad_id == METADATA_PAD ||
++		    !v4l2_subdev_has_op(unicam->sensor, pad,
++					get_frame_interval))
++			v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_PARM);
++		if (pad_id == METADATA_PAD ||
++		    !v4l2_subdev_has_op(unicam->sensor, pad,
++					set_frame_interval))
++			v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_PARM);
++
++		if (pad_id == METADATA_PAD ||
++		    !v4l2_subdev_has_op(unicam->sensor, pad,
++					enum_frame_size))
++			v4l2_disable_ioctl(&node->video_dev,
++					   VIDIOC_ENUM_FRAMESIZES);
++
++		if (node->pad_id == METADATA_PAD ||
++		    !v4l2_subdev_has_op(unicam->sensor, pad, set_selection))
++			v4l2_disable_ioctl(&node->video_dev,
++					   VIDIOC_S_SELECTION);
++
++		if (node->pad_id == METADATA_PAD ||
++		    !v4l2_subdev_has_op(unicam->sensor, pad, get_selection))
++			v4l2_disable_ioctl(&node->video_dev,
++					   VIDIOC_G_SELECTION);
++	}
+ 
+ 	ret = video_register_device(vdev, VFL_TYPE_VIDEO, -1);
+ 	if (ret) {
+@@ -2609,7 +3098,7 @@ static int unicam_async_complete(struct
+ 		if (unicam->sensor->entity.pads[i].flags & MEDIA_PAD_FL_SOURCE) {
+ 			if (source_pads < MAX_NODES) {
+ 				unicam->node[source_pads].src_pad_id = i;
+-				unicam_err(unicam, "source pad %u is index %u\n",
++				unicam_dbg(3, unicam, "source pad %u is index %u\n",
+ 					   source_pads, i);
+ 			}
+ 			source_pads++;
+@@ -2638,7 +3127,10 @@ static int unicam_async_complete(struct
+ 		}
+ 	}
+ 
+-	ret = v4l2_device_register_ro_subdev_nodes(&unicam->v4l2_dev);
++	if (unicam->mc_api)
++		ret = v4l2_device_register_subdev_nodes(&unicam->v4l2_dev);
++	else
++		ret = v4l2_device_register_ro_subdev_nodes(&unicam->v4l2_dev);
+ 	if (ret) {
+ 		unicam_err(unicam, "Unable to register subdev nodes.\n");
+ 		goto unregister;
+@@ -2798,6 +3290,14 @@ static int unicam_probe(struct platform_
+ 	kref_init(&unicam->kref);
+ 	unicam->pdev = pdev;
+ 
++	/*
++	 * Adopt the current setting of the module parameter, and check if
++	 * device tree requests it.
++	 */
++	unicam->mc_api = media_controller;
++	if (of_property_read_bool(pdev->dev.of_node, "brcm,media-controller"))
++		unicam->mc_api = true;
++
+ 	unicam->base = devm_platform_ioremap_resource(pdev, 0);
+ 	if (IS_ERR(unicam->base)) {
+ 		unicam_err(unicam, "Failed to get main io block\n");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0252-staging-bcm2835-camera-Add-support-for-H264_MIN_QP-H.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0252-staging-bcm2835-camera-Add-support-for-H264_MIN_QP-H.patch
new file mode 100644
index 00000000..ef62f0f2
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0252-staging-bcm2835-camera-Add-support-for-H264_MIN_QP-H.patch
@@ -0,0 +1,54 @@
+From 523d636b7febeb59100fc802e83038936feb02d5 Mon Sep 17 00:00:00 2001
+From: soyer <soyer@irl.hu>
+Date: Sat, 23 Oct 2021 12:23:50 +0200
+Subject: [PATCH 252/697] staging/bcm2835-camera: Add support for H264_MIN_QP,
+ H264_MAX_QP
+
+Signed-off-by: Gergo Koteles <soyer@irl.hu>
+---
+ .../bcm2835-camera/bcm2835-camera.h           |  2 +-
+ .../vc04_services/bcm2835-camera/controls.c   | 22 +++++++++++++++++++
+ 2 files changed, 23 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
++++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
+@@ -13,7 +13,7 @@
+  * core driver device
+  */
+ 
+-#define V4L2_CTRL_COUNT 29 /* number of v4l controls */
++#define V4L2_CTRL_COUNT 31 /* number of v4l controls */
+ 
+ enum {
+ 	COMP_CAMERA = 0,
+--- a/drivers/staging/vc04_services/bcm2835-camera/controls.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/controls.c
+@@ -1264,6 +1264,28 @@ static const struct bcm2835_mmal_v4l2_ct
+ 		.mmal_id = MMAL_PARAMETER_INTRAPERIOD,
+ 		.setter = ctrl_set_video_encode_param_output,
+ 	},
++	{
++		.id = V4L2_CID_MPEG_VIDEO_H264_MIN_QP,
++		.type = MMAL_CONTROL_TYPE_STD,
++		.min = 0,
++		.max = 51,
++		.def = 0,
++		.step = 1,
++		.imenu = NULL,
++		.mmal_id = MMAL_PARAMETER_VIDEO_ENCODE_MIN_QUANT,
++		.setter = ctrl_set_video_encode_param_output,
++	},
++	{
++		.id = V4L2_CID_MPEG_VIDEO_H264_MAX_QP,
++		.type = MMAL_CONTROL_TYPE_STD,
++		.min = 0,
++		.max = 51,
++		.def = 0,
++		.step = 1,
++		.imenu = NULL,
++		.mmal_id = MMAL_PARAMETER_VIDEO_ENCODE_MAX_QUANT,
++		.setter = ctrl_set_video_encode_param_output,
++	},
+ };
+ 
+ int bcm2835_mmal_set_all_camera_controls(struct bcm2835_mmal_dev *dev)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0253-staging-bcm2835-camera-Add-support-for-MPEG_VIDEO_FO.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0253-staging-bcm2835-camera-Add-support-for-MPEG_VIDEO_FO.patch
new file mode 100644
index 00000000..d56a3974
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0253-staging-bcm2835-camera-Add-support-for-MPEG_VIDEO_FO.patch
@@ -0,0 +1,43 @@
+From 1d3c064c411338eb0314cecb717ccb0296a67b5c Mon Sep 17 00:00:00 2001
+From: Gergo Koteles <soyer@irl.hu>
+Date: Sun, 24 Oct 2021 23:18:09 +0200
+Subject: [PATCH 253/697] staging/bcm2835-camera: Add support for
+ MPEG_VIDEO_FORCE_KEY_FRAME
+
+Signed-off-by: Gergo Koteles <soyer@irl.hu>
+---
+ .../vc04_services/bcm2835-camera/bcm2835-camera.h     |  2 +-
+ .../staging/vc04_services/bcm2835-camera/controls.c   | 11 +++++++++++
+ 2 files changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
++++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
+@@ -13,7 +13,7 @@
+  * core driver device
+  */
+ 
+-#define V4L2_CTRL_COUNT 31 /* number of v4l controls */
++#define V4L2_CTRL_COUNT 32 /* number of v4l controls */
+ 
+ enum {
+ 	COMP_CAMERA = 0,
+--- a/drivers/staging/vc04_services/bcm2835-camera/controls.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/controls.c
+@@ -1286,6 +1286,17 @@ static const struct bcm2835_mmal_v4l2_ct
+ 		.mmal_id = MMAL_PARAMETER_VIDEO_ENCODE_MAX_QUANT,
+ 		.setter = ctrl_set_video_encode_param_output,
+ 	},
++	{
++		.id = V4L2_CID_MPEG_VIDEO_FORCE_KEY_FRAME,
++		.type = MMAL_CONTROL_TYPE_STD,
++		.min = 0,
++		.max = 0,
++		.def = 0,
++		.step = 0,
++		.imenu = NULL,
++		.mmal_id = MMAL_PARAMETER_VIDEO_REQUEST_I_FRAME,
++		.setter = ctrl_set_video_encode_param_output,
++	},
+ };
+ 
+ int bcm2835_mmal_set_all_camera_controls(struct bcm2835_mmal_dev *dev)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0254-brcmfmac-Don-t-promote-INFO-logging-to-ERR.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0254-brcmfmac-Don-t-promote-INFO-logging-to-ERR.patch
new file mode 100644
index 00000000..39eb7b06
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0254-brcmfmac-Don-t-promote-INFO-logging-to-ERR.patch
@@ -0,0 +1,32 @@
+From 66156ea1a78f6b8c59e084ebef1397474a4f7855 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 2 Nov 2021 11:13:42 +0000
+Subject: [PATCH 254/697] brcmfmac: Don't promote INFO logging to ERR
+
+An unwanted side effect of enabling the BRCMDBG config setting is
+redefining brcmf_info to be brcmf_err. This can be alarming to users
+and makes it harder to spot real errors, so don't do it.
+
+See: https://github.com/raspberrypi/linux/issues/4663
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
+@@ -67,7 +67,12 @@ void __brcmf_err(struct brcmf_bus *bus,
+ #if defined(DEBUG) || defined(CONFIG_BRCM_TRACING)
+ 
+ /* For debug/tracing purposes treat info messages as errors */
+-#define brcmf_info brcmf_err
++// #define brcmf_info brcmf_err
++
++#define brcmf_info(fmt, ...)						\
++	do {								\
++		pr_info("%s: " fmt, __func__, ##__VA_ARGS__);		\
++	} while (0)
+ 
+ __printf(3, 4)
+ void __brcmf_dbg(u32 level, const char *func, const char *fmt, ...);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0255-media-i2c-ov5647-Support-HFLIP-and-VFLIP.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0255-media-i2c-ov5647-Support-HFLIP-and-VFLIP.patch
new file mode 100644
index 00000000..01c5397d
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0255-media-i2c-ov5647-Support-HFLIP-and-VFLIP.patch
@@ -0,0 +1,189 @@
+From a505038832c44d1f14b838c65be34861d46508ea Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.com>
+Date: Mon, 22 Nov 2021 13:10:39 +0000
+Subject: [PATCH 255/697] media: i2c: ov5647: Support HFLIP and VFLIP
+
+Add these missing V4L2 controls. Tested binned and full resolution
+modes in all four orientations using Raspberry Pi running libcamera.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ drivers/media/i2c/ov5647.c | 76 +++++++++++++++++++++++++++++++++++---
+ 1 file changed, 70 insertions(+), 6 deletions(-)
+
+--- a/drivers/media/i2c/ov5647.c
++++ b/drivers/media/i2c/ov5647.c
+@@ -54,6 +54,8 @@
+ #define OV5647_REG_GAIN_LO		0x350b
+ #define OV5647_REG_VTS_HI		0x380e
+ #define OV5647_REG_VTS_LO		0x380f
++#define OV5647_REG_VFLIP		0x3820
++#define OV5647_REG_HFLIP		0x3821
+ #define OV5647_REG_FRAME_OFF_NUMBER	0x4202
+ #define OV5647_REG_MIPI_CTRL00		0x4800
+ #define OV5647_REG_MIPI_CTRL14		0x4814
+@@ -109,6 +111,8 @@ struct ov5647 {
+ 	struct v4l2_ctrl		*hblank;
+ 	struct v4l2_ctrl		*vblank;
+ 	struct v4l2_ctrl		*exposure;
++	struct v4l2_ctrl		*hflip;
++	struct v4l2_ctrl		*vflip;
+ };
+ 
+ static inline struct ov5647 *to_sensor(struct v4l2_subdev *sd)
+@@ -150,7 +154,7 @@ static struct regval_list ov5647_2592x19
+ 	{0x3036, 0x69},
+ 	{0x303c, 0x11},
+ 	{0x3106, 0xf5},
+-	{0x3821, 0x06},
++	{0x3821, 0x00},
+ 	{0x3820, 0x00},
+ 	{0x3827, 0xec},
+ 	{0x370c, 0x03},
+@@ -239,7 +243,7 @@ static struct regval_list ov5647_1080p30
+ 	{0x3036, 0x62},
+ 	{0x303c, 0x11},
+ 	{0x3106, 0xf5},
+-	{0x3821, 0x06},
++	{0x3821, 0x00},
+ 	{0x3820, 0x00},
+ 	{0x3827, 0xec},
+ 	{0x370c, 0x03},
+@@ -403,7 +407,7 @@ static struct regval_list ov5647_2x2binn
+ 	{0x4800, 0x24},
+ 	{0x3503, 0x03},
+ 	{0x3820, 0x41},
+-	{0x3821, 0x07},
++	{0x3821, 0x01},
+ 	{0x350a, 0x00},
+ 	{0x350b, 0x10},
+ 	{0x3500, 0x00},
+@@ -419,7 +423,7 @@ static struct regval_list ov5647_640x480
+ 	{0x3035, 0x11},
+ 	{0x3036, 0x46},
+ 	{0x303c, 0x11},
+-	{0x3821, 0x07},
++	{0x3821, 0x01},
+ 	{0x3820, 0x41},
+ 	{0x370c, 0x03},
+ 	{0x3612, 0x59},
+@@ -948,6 +952,25 @@ static const struct v4l2_subdev_video_op
+ 	.s_stream =		ov5647_s_stream,
+ };
+ 
++/* This function returns the mbus code for the current settings of the
++   HFLIP and VFLIP controls. */
++
++static u32 ov5647_get_mbus_code(struct v4l2_subdev *sd)
++{
++	struct ov5647 *sensor = to_sensor(sd);
++	/* The control values are only 0 or 1. */
++	int index =  sensor->hflip->val | (sensor->vflip->val << 1);
++
++	static const u32 codes[4] = {
++		MEDIA_BUS_FMT_SGBRG10_1X10,
++		MEDIA_BUS_FMT_SBGGR10_1X10,
++		MEDIA_BUS_FMT_SRGGB10_1X10,
++		MEDIA_BUS_FMT_SGRBG10_1X10
++	};
++
++	return codes[index];
++}
++
+ static int ov5647_enum_mbus_code(struct v4l2_subdev *sd,
+ 				 struct v4l2_subdev_state *sd_state,
+ 				 struct v4l2_subdev_mbus_code_enum *code)
+@@ -955,7 +978,7 @@ static int ov5647_enum_mbus_code(struct
+ 	if (code->index > 0)
+ 		return -EINVAL;
+ 
+-	code->code = MEDIA_BUS_FMT_SBGGR10_1X10;
++	code->code = ov5647_get_mbus_code(sd);
+ 
+ 	return 0;
+ }
+@@ -966,7 +989,7 @@ static int ov5647_enum_frame_size(struct
+ {
+ 	const struct v4l2_mbus_framefmt *fmt;
+ 
+-	if (fse->code != MEDIA_BUS_FMT_SBGGR10_1X10 ||
++	if (fse->code != ov5647_get_mbus_code(sd) ||
+ 	    fse->index >= ARRAY_SIZE(ov5647_modes))
+ 		return -EINVAL;
+ 
+@@ -999,6 +1022,8 @@ static int ov5647_get_pad_fmt(struct v4l
+ 	}
+ 
+ 	*fmt = *sensor_format;
++	/* The code we pass back must reflect the current h/vflips. */
++	fmt->code = ov5647_get_mbus_code(sd);
+ 	mutex_unlock(&sensor->lock);
+ 
+ 	return 0;
+@@ -1046,6 +1071,8 @@ static int ov5647_set_pad_fmt(struct v4l
+ 					 exposure_def);
+ 	}
+ 	*fmt = mode->format;
++	/* The code we pass back must reflect the current h/vflips. */
++	fmt->code = ov5647_get_mbus_code(sd);
+ 	mutex_unlock(&sensor->lock);
+ 
+ 	return 0;
+@@ -1221,6 +1248,25 @@ static int ov5647_s_exposure(struct v4l2
+ 	return ov5647_write(sd, OV5647_REG_EXP_LO, (val & 0xf) << 4);
+ }
+ 
++static int ov5647_s_flip( struct v4l2_subdev *sd, u16 reg, u32 ctrl_val)
++{
++	int ret;
++	u8 reg_val;
++
++	/* Set or clear bit 1 and leave everything else alone. */
++	ret = ov5647_read(sd, reg, &reg_val);
++	if (ret == 0) {
++		if (ctrl_val)
++			reg_val |= 2;
++		else
++			reg_val &= ~2;
++
++		ret = ov5647_write(sd, reg, reg_val);
++	}
++
++	return ret;
++}
++
+ static int ov5647_s_ctrl(struct v4l2_ctrl *ctrl)
+ {
+ 	struct ov5647 *sensor = container_of(ctrl->handler,
+@@ -1283,6 +1329,14 @@ static int ov5647_s_ctrl(struct v4l2_ctr
+ 		/* Read-only, but we adjust it based on mode. */
+ 		break;
+ 
++	case V4L2_CID_HFLIP:
++		/* There's an in-built hflip in the sensor, so account for that here. */
++		ov5647_s_flip(sd, OV5647_REG_HFLIP, !ctrl->val);
++		break;
++	case V4L2_CID_VFLIP:
++		ov5647_s_flip(sd, OV5647_REG_VFLIP, ctrl->val);
++		break;
++
+ 	default:
+ 		dev_info(&client->dev,
+ 			 "Control (id:0x%x, val:0x%x) not supported\n",
+@@ -1354,6 +1408,16 @@ static int ov5647_init_controls(struct o
+ 				     ARRAY_SIZE(ov5647_test_pattern_menu) - 1,
+ 				     0, 0, ov5647_test_pattern_menu);
+ 
++	sensor->hflip = v4l2_ctrl_new_std(&sensor->ctrls, &ov5647_ctrl_ops,
++					  V4L2_CID_HFLIP, 0, 1, 1, 0);
++	if (sensor->hflip)
++		sensor->hflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++
++	sensor->vflip = v4l2_ctrl_new_std(&sensor->ctrls, &ov5647_ctrl_ops,
++					  V4L2_CID_VFLIP, 0, 1, 1, 0);
++	if (sensor->vflip)
++		sensor->vflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++
+ 	v4l2_fwnode_device_parse(dev, &props);
+ 
+ 	v4l2_ctrl_new_fwnode_properties(&sensor->ctrls, &ov5647_ctrl_ops,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0256-spi-spidev-Restore-loading-from-Device-Tree.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0256-spi-spidev-Restore-loading-from-Device-Tree.patch
new file mode 100644
index 00000000..079ff053
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0256-spi-spidev-Restore-loading-from-Device-Tree.patch
@@ -0,0 +1,25 @@
+From 6be738112047b03fa0db4d8f788b8923a21363a9 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 29 Nov 2021 12:14:49 +0000
+Subject: [PATCH 256/697] spi: spidev: Restore loading from Device Tree
+
+As happens occasionally, an upstream change has once again prevented
+spidev from being loaded via Device Tree. We now need "spidev" to be
+included in the new spi_device_id list, otherwise although the
+spidev driver gets loaded no /dev/spidev*.* entries will appear.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/spi/spidev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -711,6 +711,7 @@ static const struct spi_device_id spidev
+ 	{ .name = "spi-authenta" },
+ 	{ .name = "em3581" },
+ 	{ .name = "si3210" },
++	{ .name = "spidev" },
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(spi, spidev_spi_ids);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0257-drivers-bcm2835_unicam-Add-logging-message-when-a-fr.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0257-drivers-bcm2835_unicam-Add-logging-message-when-a-fr.patch
new file mode 100644
index 00000000..74d3748f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0257-drivers-bcm2835_unicam-Add-logging-message-when-a-fr.patch
@@ -0,0 +1,26 @@
+From f196c58cf7ef1ec812b1bac61f67e9971f196a3c Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Tue, 30 Nov 2021 10:39:41 +0000
+Subject: [PATCH 257/697] drivers: bcm2835_unicam: Add logging message when a
+ frame is dropped.
+
+If a dummy buffer is still active on a frame start, it indicates that this frame
+will be dropped. The explicit logging helps users identify performance issues.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -940,6 +940,9 @@ static irqreturn_t unicam_isr(int irq, v
+ 			if (unicam->node[i].cur_frm)
+ 				unicam->node[i].cur_frm->vb.vb2_buf.timestamp =
+ 								ts;
++			else
++				unicam_dbg(2, unicam, "ISR: [%d] Dropping frame, buffer not available at FS\n",
++					   i);
+ 			/*
+ 			 * Set the next frame output to go to a dummy frame
+ 			 * if we have not managed to obtain another frame
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0258-regulator-rpi-panel-attiny-Don-t-read-the-LCD-power-.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0258-regulator-rpi-panel-attiny-Don-t-read-the-LCD-power-.patch
new file mode 100644
index 00000000..94218967
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0258-regulator-rpi-panel-attiny-Don-t-read-the-LCD-power-.patch
@@ -0,0 +1,158 @@
+From 2bb372505d2d398fd62ea0eb7a68a8ba67da6144 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 29 Nov 2021 18:31:37 +0000
+Subject: [PATCH 258/697] regulator/rpi-panel-attiny: Don't read the LCD power
+ status
+
+The I2C to the Atmel is very fussy, and locks up easily on
+Pi0-3 particularly on reads.
+
+The LCD power status is controlled solely by this driver, so
+rather than reading it back from the Atmel, use the cached
+status last set.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+regulator/rpi-panel: Power off display on shutdown
+
+Adds a shutdown function to turn off the backlight, bridge, and
+touch controller on shutdown.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+regulator/rpi-panel: Remove the ID read
+
+Reading from the Atmel has always been troublesome due to
+clock stretching, and the driver does nothing with it anyway.
+
+Remove the read and assume that if the overlay has been
+configured (most likely through the firmware autodetection)
+that the hardware is present.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../regulator/rpi-panel-attiny-regulator.c    | 77 +++----------------
+ 1 file changed, 10 insertions(+), 67 deletions(-)
+
+--- a/drivers/regulator/rpi-panel-attiny-regulator.c
++++ b/drivers/regulator/rpi-panel-attiny-regulator.c
+@@ -143,24 +143,8 @@ static int attiny_lcd_power_disable(stru
+ static int attiny_lcd_power_is_enabled(struct regulator_dev *rdev)
+ {
+ 	struct attiny_lcd *state = rdev_get_drvdata(rdev);
+-	unsigned int data;
+-	int ret, i;
+-
+-	mutex_lock(&state->lock);
+-
+-	for (i = 0; i < 10; i++) {
+-		ret = regmap_read(rdev->regmap, REG_PORTC, &data);
+-		if (!ret)
+-			break;
+-		usleep_range(10000, 12000);
+-	}
+ 
+-	mutex_unlock(&state->lock);
+-
+-	if (ret < 0)
+-		return ret;
+-
+-	return data & PC_RST_BRIDGE_N;
++	return state->port_states[REG_PORTC - REG_PORTA] & PC_RST_BRIDGE_N;
+ }
+ 
+ static const struct regulator_init_data attiny_regulator_default = {
+@@ -245,39 +229,6 @@ static void attiny_gpio_set(struct gpio_
+ 	mutex_unlock(&state->lock);
+ }
+ 
+-static int attiny_i2c_read(struct i2c_client *client, u8 reg, unsigned int *buf)
+-{
+-	struct i2c_msg msgs[1];
+-	u8 addr_buf[1] = { reg };
+-	u8 data_buf[1] = { 0, };
+-	int ret;
+-
+-	/* Write register address */
+-	msgs[0].addr = client->addr;
+-	msgs[0].flags = 0;
+-	msgs[0].len = ARRAY_SIZE(addr_buf);
+-	msgs[0].buf = addr_buf;
+-
+-	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
+-	if (ret != ARRAY_SIZE(msgs))
+-		return -EIO;
+-
+-	usleep_range(5000, 10000);
+-
+-	/* Read data from register */
+-	msgs[0].addr = client->addr;
+-	msgs[0].flags = I2C_M_RD;
+-	msgs[0].len = 1;
+-	msgs[0].buf = data_buf;
+-
+-	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
+-	if (ret != ARRAY_SIZE(msgs))
+-		return -EIO;
+-
+-	*buf = data_buf[0];
+-	return 0;
+-}
+-
+ /*
+  * I2C driver interface functions
+  */
+@@ -289,7 +240,6 @@ static int attiny_i2c_probe(struct i2c_c
+ 	struct regulator_dev *rdev;
+ 	struct attiny_lcd *state;
+ 	struct regmap *regmap;
+-	unsigned int data;
+ 	int ret;
+ 
+ 	state = devm_kzalloc(&i2c->dev, sizeof(*state), GFP_KERNEL);
+@@ -307,22 +257,6 @@ static int attiny_i2c_probe(struct i2c_c
+ 		goto error;
+ 	}
+ 
+-	ret = attiny_i2c_read(i2c, REG_ID, &data);
+-	if (ret < 0) {
+-		dev_err(&i2c->dev, "Failed to read REG_ID reg: %d\n", ret);
+-		goto error;
+-	}
+-
+-	switch (data) {
+-	case 0xde: /* ver 1 */
+-	case 0xc3: /* ver 2 */
+-		break;
+-	default:
+-		dev_err(&i2c->dev, "Unknown Atmel firmware revision: 0x%02x\n", data);
+-		ret = -ENODEV;
+-		goto error;
+-	}
+-
+ 	regmap_write(regmap, REG_POWERON, 0);
+ 	msleep(30);
+ 	regmap_write(regmap, REG_PWM, 0);
+@@ -386,6 +320,14 @@ static void attiny_i2c_remove(struct i2c
+ 	mutex_destroy(&state->lock);
+ }
+ 
++static void attiny_i2c_shutdown(struct i2c_client *client)
++{
++	struct attiny_lcd *state = i2c_get_clientdata(client);
++
++	regmap_write(state->regmap, REG_PWM, 0);
++	regmap_write(state->regmap, REG_POWERON, 0);
++}
++
+ static const struct of_device_id attiny_dt_ids[] = {
+ 	{ .compatible = "raspberrypi,7inch-touchscreen-panel-regulator" },
+ 	{},
+@@ -400,6 +342,7 @@ static struct i2c_driver attiny_regulato
+ 	},
+ 	.probe = attiny_i2c_probe,
+ 	.remove	= attiny_i2c_remove,
++	.shutdown = attiny_i2c_shutdown,
+ };
+ 
+ module_i2c_driver(attiny_regulator_driver);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0259-rtc-pcf8523-Fix-oscillator-stop-bit-handling.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0259-rtc-pcf8523-Fix-oscillator-stop-bit-handling.patch
new file mode 100644
index 00000000..cf9f84cd
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0259-rtc-pcf8523-Fix-oscillator-stop-bit-handling.patch
@@ -0,0 +1,56 @@
+From 91f3463411f921c5f8fb615610ea855ac92cee90 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Mon, 29 Oct 2018 14:45:45 +0000
+Subject: [PATCH 259/697] rtc: pcf8523: Fix oscillator stop bit handling
+
+See: https://github.com/raspberrypi/firmware/issues/1065
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/rtc/rtc-pcf8523.c | 28 ++++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+--- a/drivers/rtc/rtc-pcf8523.c
++++ b/drivers/rtc/rtc-pcf8523.c
+@@ -100,6 +100,7 @@ static int pcf8523_rtc_read_time(struct
+ {
+ 	struct pcf8523 *pcf8523 = dev_get_drvdata(dev);
+ 	u8 regs[10];
++	u32 value;
+ 	int err;
+ 
+ 	err = regmap_bulk_read(pcf8523->regmap, PCF8523_REG_CONTROL1, regs,
+@@ -110,6 +111,33 @@ static int pcf8523_rtc_read_time(struct
+ 	if ((regs[0] & PCF8523_CONTROL1_STOP) || (regs[3] & PCF8523_SECONDS_OS))
+ 		return -EINVAL;
+ 
++	if (regs[0] & PCF8523_SECONDS_OS) {
++		/*
++		 * If the oscillator was stopped, try to clear the flag. Upon
++		 * power-up the flag is always set, but if we cannot clear it
++		 * the oscillator isn't running properly for some reason. The
++		 * sensible thing therefore is to return an error, signalling
++		 * that the clock cannot be assumed to be correct.
++		 */
++
++		regs[0] &= ~PCF8523_SECONDS_OS;
++
++		err = regmap_write(pcf8523->regmap, PCF8523_REG_SECONDS,
++				   regs[0]);
++		if (err < 0)
++			return err;
++
++		err = regmap_read(pcf8523->regmap, PCF8523_REG_SECONDS,
++				  &value);
++		if (err < 0)
++			return err;
++
++		if (value & PCF8523_SECONDS_OS)
++			return -EAGAIN;
++
++		regs[0] = value;
++	}
++
+ 	tm->tm_sec = bcd2bin(regs[3] & 0x7f);
+ 	tm->tm_min = bcd2bin(regs[4] & 0x7f);
+ 	tm->tm_hour = bcd2bin(regs[5] & 0x3f);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0260-media-i2c-ov5647-Add-support-for-regulator-control.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0260-media-i2c-ov5647-Add-support-for-regulator-control.patch
new file mode 100644
index 00000000..220bdc08
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0260-media-i2c-ov5647-Add-support-for-regulator-control.patch
@@ -0,0 +1,111 @@
+From 99832ff2d482cb5dba93cec3547c1815db29077b Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 22 Nov 2021 12:31:35 +0000
+Subject: [PATCH 260/697] media: i2c: ov5647: Add support for regulator
+ control.
+
+The driver supported using GPIOs to control the shutdown line,
+but no regulator control.
+
+Add regulator hooks.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/ov5647.c | 37 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 37 insertions(+)
+
+--- a/drivers/media/i2c/ov5647.c
++++ b/drivers/media/i2c/ov5647.c
+@@ -20,6 +20,7 @@
+ #include <linux/module.h>
+ #include <linux/of_graph.h>
+ #include <linux/pm_runtime.h>
++#include <linux/regulator/consumer.h>
+ #include <linux/slab.h>
+ #include <linux/videodev2.h>
+ #include <media/v4l2-ctrls.h>
+@@ -83,6 +84,15 @@
+ #define OV5647_EXPOSURE_DEFAULT		1000
+ #define OV5647_EXPOSURE_MAX		65535
+ 
++/* regulator supplies */
++static const char * const ov5647_supply_names[] = {
++	"avdd",		/* Analog power */
++	"dovdd",	/* Digital I/O power */
++	"dvdd",		/* Digital core power */
++};
++
++#define OV5647_NUM_SUPPLIES ARRAY_SIZE(ov5647_supply_names)
++
+ struct regval_list {
+ 	u16 addr;
+ 	u8 data;
+@@ -104,6 +114,7 @@ struct ov5647 {
+ 	struct mutex			lock;
+ 	struct clk			*xclk;
+ 	struct gpio_desc		*pwdn;
++	struct regulator_bulk_data supplies[OV5647_NUM_SUPPLIES];
+ 	bool				clock_ncont;
+ 	struct v4l2_ctrl_handler	ctrls;
+ 	const struct ov5647_mode	*mode;
+@@ -794,6 +805,12 @@ static int ov5647_power_on(struct device
+ 
+ 	dev_dbg(dev, "OV5647 power on\n");
+ 
++	ret = regulator_bulk_enable(OV5647_NUM_SUPPLIES, sensor->supplies);
++	if (ret < 0) {
++		dev_err(dev, "Failed to enable regulators\n");
++		return ret;
++	}
++
+ 	if (sensor->pwdn) {
+ 		gpiod_set_value_cansleep(sensor->pwdn, 0);
+ 		msleep(PWDN_ACTIVE_DELAY_MS);
+@@ -825,6 +842,7 @@ error_clk_disable:
+ 	clk_disable_unprepare(sensor->xclk);
+ error_pwdn:
+ 	gpiod_set_value_cansleep(sensor->pwdn, 1);
++	regulator_bulk_disable(OV5647_NUM_SUPPLIES, sensor->supplies);
+ 
+ 	return ret;
+ }
+@@ -854,6 +872,7 @@ static int ov5647_power_off(struct devic
+ 
+ 	clk_disable_unprepare(sensor->xclk);
+ 	gpiod_set_value_cansleep(sensor->pwdn, 1);
++	regulator_bulk_disable(OV5647_NUM_SUPPLIES, sensor->supplies);
+ 
+ 	return 0;
+ }
+@@ -1353,6 +1372,18 @@ static const struct v4l2_ctrl_ops ov5647
+ 	.s_ctrl = ov5647_s_ctrl,
+ };
+ 
++static int ov5647_configure_regulators(struct device *dev,
++				       struct ov5647 *sensor)
++{
++	unsigned int i;
++
++	for (i = 0; i < OV5647_NUM_SUPPLIES; i++)
++		sensor->supplies[i].supply = ov5647_supply_names[i];
++
++	return devm_regulator_bulk_get(dev, OV5647_NUM_SUPPLIES,
++				       sensor->supplies);
++}
++
+ static int ov5647_init_controls(struct ov5647 *sensor, struct device *dev)
+ {
+ 	struct i2c_client *client = v4l2_get_subdevdata(&sensor->sd);
+@@ -1502,6 +1533,12 @@ static int ov5647_probe(struct i2c_clien
+ 		return -EINVAL;
+ 	}
+ 
++	ret = ov5647_configure_regulators(dev, sensor);
++	if (ret) {
++		dev_err(dev, "Failed to get power regulators\n");
++		return ret;
++	}
++
+ 	mutex_init(&sensor->lock);
+ 
+ 	sensor->mode = OV5647_DEFAULT_MODE;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0261-media-i2c-ov7251-Make-the-enable-GPIO-optional.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0261-media-i2c-ov7251-Make-the-enable-GPIO-optional.patch
new file mode 100644
index 00000000..822e7509
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0261-media-i2c-ov7251-Make-the-enable-GPIO-optional.patch
@@ -0,0 +1,26 @@
+From 91efea769b70a3b6e2b5eec7de94fad407527ec7 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 14 Dec 2021 17:18:49 +0000
+Subject: [PATCH 261/697] media: i2c: ov7251: Make the enable GPIO optional.
+
+Not all implementations wire up the enable GPIO and may just tie
+it to a supply rail.
+Make it optional.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/ov7251.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/ov7251.c
++++ b/drivers/media/i2c/ov7251.c
+@@ -1697,7 +1697,8 @@ static int ov7251_probe(struct i2c_clien
+ 		return PTR_ERR(ov7251->analog_regulator);
+ 	}
+ 
+-	ov7251->enable_gpio = devm_gpiod_get(dev, "enable", GPIOD_OUT_HIGH);
++	ov7251->enable_gpio = devm_gpiod_get_optional(dev, "enable",
++						      GPIOD_OUT_HIGH);
+ 	if (IS_ERR(ov7251->enable_gpio)) {
+ 		dev_err(dev, "cannot get enable gpio\n");
+ 		return PTR_ERR(ov7251->enable_gpio);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0262-uapi-v4l2-controls-Reset-V4L2_CID_USER_BCM2835_ISP_B.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0262-uapi-v4l2-controls-Reset-V4L2_CID_USER_BCM2835_ISP_B.patch
new file mode 100644
index 00000000..d79b7d6a
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0262-uapi-v4l2-controls-Reset-V4L2_CID_USER_BCM2835_ISP_B.patch
@@ -0,0 +1,33 @@
+From 108551c5f955ffaf6f9ba69ed78d006ae0a3d618 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 4 Jan 2022 13:56:42 +0000
+Subject: [PATCH 262/697] uapi/v4l2-controls: Reset
+ V4L2_CID_USER_BCM2835_ISP_BASE to same as 5.10
+
+https://github.com/raspberrypi/linux/issues/4440
+
+Upstream has added additional device specific controls, so the
+V4L2_CID_USER_BASE + 0x10e0 value that had been defined for use with
+the ISP has been taken by something else (and +0x10f0 has been used as
+well)
+
+Duplicate the use on V4L2_CID_USER_BASE + 0x10e0 so that userspace
+(libcamera) doesn't need to change. Once the driver is upstream, then
+we'll update libcamera to adopt the new value as it then won't change.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ include/uapi/linux/v4l2-controls.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/uapi/linux/v4l2-controls.h
++++ b/include/uapi/linux/v4l2-controls.h
+@@ -217,7 +217,7 @@ enum v4l2_colorfx {
+ 
+ /* The base for the bcm2835-isp driver controls.
+  * We reserve 16 controls for this driver. */
+-#define V4L2_CID_USER_BCM2835_ISP_BASE		(V4L2_CID_USER_BASE + 0x10f0)
++#define V4L2_CID_USER_BCM2835_ISP_BASE		(V4L2_CID_USER_BASE + 0x10e0)
+ 
+ /* MPEG-class control IDs */
+ /* The MPEG controls are applicable to all codec controls
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0263-mfd-simple-mfd-i2c-Add-configuration-for-RPi-POE-HAT.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0263-mfd-simple-mfd-i2c-Add-configuration-for-RPi-POE-HAT.patch
new file mode 100644
index 00000000..0599aa26
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0263-mfd-simple-mfd-i2c-Add-configuration-for-RPi-POE-HAT.patch
@@ -0,0 +1,63 @@
+From 015002e730d621dd0228ddf9b1ad66a53f2a25e8 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 19 Jan 2022 17:22:57 +0000
+Subject: [PATCH 263/697] mfd: simple-mfd-i2c: Add configuration for RPi POE
+ HAT
+
+The Raspbery Pi PoE+ HAT exposes a fan controller and power
+supply status reporting via a single I2C address.
+
+Create an MFD device that allows loading of the relevant
+sub-drivers, with a shared I2C regmap.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/mfd/Kconfig          | 10 ++++++++++
+ drivers/mfd/simple-mfd-i2c.c | 10 ++++++++++
+ 2 files changed, 20 insertions(+)
+
+--- a/drivers/mfd/Kconfig
++++ b/drivers/mfd/Kconfig
+@@ -1186,6 +1186,16 @@ config MFD_SY7636A
+ 	  To enable support for building sub-devices as modules,
+ 	  choose M here.
+ 
++config MFD_RASPBERRYPI_POE_HAT
++	tristate "Raspberry Pi PoE HAT MFD"
++	depends on I2C
++	select MFD_SIMPLE_MFD_I2C
++	help
++	  This module supports the PWM fan controller found on the Raspberry Pi
++	  POE and POE+ HAT boards, and the power supply driver on the POE+ HAT.
++	  (Functionally it relies on MFD_SIMPLE_MFD_I2C to provide the framework
++	  that loads the child drivers).
++
+ config MFD_RDC321X
+ 	tristate "RDC R-321x southbridge"
+ 	select MFD_CORE
+--- a/drivers/mfd/simple-mfd-i2c.c
++++ b/drivers/mfd/simple-mfd-i2c.c
+@@ -29,6 +29,15 @@ static const struct regmap_config regmap
+ 	.val_bits = 8,
+ };
+ 
++static const struct regmap_config regmap_config_16r_8v = {
++	.reg_bits = 16,
++	.val_bits = 8,
++};
++
++static const struct simple_mfd_data rpi_poe_core = {
++	.regmap_config = &regmap_config_16r_8v,
++};
++
+ static int simple_mfd_i2c_probe(struct i2c_client *i2c)
+ {
+ 	const struct simple_mfd_data *simple_mfd_data;
+@@ -88,6 +97,7 @@ static const struct of_device_id simple_
+ 	{ .compatible = "silergy,sy7636a", .data = &silergy_sy7636a},
+ 	{ .compatible = "maxim,max5970", .data = &maxim_max5970},
+ 	{ .compatible = "maxim,max5978", .data = &maxim_max5970},
++	{ .compatible = "raspberrypi,poe-core", &rpi_poe_core },
+ 	{ .compatible = "raspberrypi,sensehat" },
+ 	{}
+ };
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0264-pwm-raspberrypi-poe-Add-option-of-being-created-by-M.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0264-pwm-raspberrypi-poe-Add-option-of-being-created-by-M.patch
new file mode 100644
index 00000000..eace2176
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0264-pwm-raspberrypi-poe-Add-option-of-being-created-by-M.patch
@@ -0,0 +1,177 @@
+From 35667fb7f2ae094b3a9c28c3a9f147a10f822577 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 19 Jan 2022 17:26:22 +0000
+Subject: [PATCH 264/697] pwm: raspberrypi-poe: Add option of being created by
+ MFD or FW
+
+The firmware can only use I2C0 if the kernel isn't, therefore
+with libcamera and DRM using it the PoE HAT fan control needs
+to move to the kernel.
+
+Add the option for the driver to be created by the PoE HAT core
+MFD driver, and use the I2C regmap that provides to control fan
+functions.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/pwm/pwm-raspberrypi-poe.c | 88 +++++++++++++++++++------------
+ 1 file changed, 55 insertions(+), 33 deletions(-)
+
+--- a/drivers/pwm/pwm-raspberrypi-poe.c
++++ b/drivers/pwm/pwm-raspberrypi-poe.c
+@@ -16,6 +16,7 @@
+ #include <linux/of.h>
+ #include <linux/platform_device.h>
+ #include <linux/pwm.h>
++#include <linux/regmap.h>
+ 
+ #include <soc/bcm2835/raspberrypi-firmware.h>
+ #include <dt-bindings/pwm/raspberrypi,firmware-poe-pwm.h>
+@@ -27,6 +28,10 @@
+ 
+ struct raspberrypi_pwm {
+ 	struct rpi_firmware *firmware;
++
++	struct regmap *regmap;
++	u32 offset;
++
+ 	unsigned int duty_cycle;
+ };
+ 
+@@ -42,7 +47,7 @@ struct raspberrypi_pwm *raspberrypi_pwm_
+ 	return pwmchip_get_drvdata(chip);
+ }
+ 
+-static int raspberrypi_pwm_set_property(struct rpi_firmware *firmware,
++static int raspberrypi_pwm_set_property(struct raspberrypi_pwm *pwm,
+ 					u32 reg, u32 val)
+ {
+ 	struct raspberrypi_pwm_prop msg = {
+@@ -51,17 +56,19 @@ static int raspberrypi_pwm_set_property(
+ 	};
+ 	int ret;
+ 
+-	ret = rpi_firmware_property(firmware, RPI_FIRMWARE_SET_POE_HAT_VAL,
+-				    &msg, sizeof(msg));
+-	if (ret)
+-		return ret;
+-	if (msg.ret)
+-		return -EIO;
++	if (pwm->firmware) {
++		ret = rpi_firmware_property(pwm->firmware, RPI_FIRMWARE_SET_POE_HAT_VAL,
++					    &msg, sizeof(msg));
++		if (!ret && msg.ret)
++			ret = -EIO;
++	} else {
++		ret = regmap_write(pwm->regmap, pwm->offset + reg, val);
++	}
+ 
+-	return 0;
++	return ret;
+ }
+ 
+-static int raspberrypi_pwm_get_property(struct rpi_firmware *firmware,
++static int raspberrypi_pwm_get_property(struct raspberrypi_pwm *pwm,
+ 					u32 reg, u32 *val)
+ {
+ 	struct raspberrypi_pwm_prop msg = {
+@@ -69,16 +76,17 @@ static int raspberrypi_pwm_get_property(
+ 	};
+ 	int ret;
+ 
+-	ret = rpi_firmware_property(firmware, RPI_FIRMWARE_GET_POE_HAT_VAL,
+-				    &msg, sizeof(msg));
+-	if (ret)
+-		return ret;
+-	if (msg.ret)
+-		return -EIO;
+-
+-	*val = le32_to_cpu(msg.val);
++	if (pwm->firmware) {
++		ret = rpi_firmware_property(pwm->firmware, RPI_FIRMWARE_GET_POE_HAT_VAL,
++					    &msg, sizeof(msg));
++		if (!ret && msg.ret)
++			ret = -EIO;
++		*val = le32_to_cpu(msg.val);
++	} else {
++		ret = regmap_read(pwm->regmap, pwm->offset + reg, val);
++	}
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ static int raspberrypi_pwm_get_state(struct pwm_chip *chip,
+@@ -118,7 +126,7 @@ static int raspberrypi_pwm_apply(struct
+ 	if (duty_cycle == rpipwm->duty_cycle)
+ 		return 0;
+ 
+-	ret = raspberrypi_pwm_set_property(rpipwm->firmware, RPI_PWM_CUR_DUTY_REG,
++	ret = raspberrypi_pwm_set_property(rpipwm, RPI_PWM_CUR_DUTY_REG,
+ 					   duty_cycle);
+ 	if (ret) {
+ 		dev_err(pwmchip_parent(chip), "Failed to set duty cycle: %pe\n",
+@@ -145,28 +153,41 @@ static int raspberrypi_pwm_probe(struct
+ 	struct raspberrypi_pwm *rpipwm;
+ 	int ret;
+ 
+-	firmware_node = of_get_parent(dev->of_node);
+-	if (!firmware_node) {
+-		dev_err(dev, "Missing firmware node\n");
+-		return -ENOENT;
+-	}
+-
+-	firmware = devm_rpi_firmware_get(&pdev->dev, firmware_node);
+-	of_node_put(firmware_node);
+-	if (!firmware)
+-		return dev_err_probe(dev, -EPROBE_DEFER,
+-				     "Failed to get firmware handle\n");
+-
+ 	chip = devm_pwmchip_alloc(&pdev->dev, RASPBERRYPI_FIRMWARE_PWM_NUM,
+ 				  sizeof(*rpipwm));
+ 	if (IS_ERR(chip))
+ 		return PTR_ERR(chip);
+ 	rpipwm = raspberrypi_pwm_from_chip(chip);
+ 
+-	rpipwm->firmware = firmware;
++	if (!rpipwm)
++		return -ENOMEM;
++
++	if (pdev->dev.parent)
++		rpipwm->regmap = dev_get_regmap(pdev->dev.parent, NULL);
++
++	if (rpipwm->regmap) {
++		ret = device_property_read_u32(&pdev->dev, "reg", &rpipwm->offset);
++		if (ret)
++			return -EINVAL;
++	} else {
++		firmware_node = of_get_parent(dev->of_node);
++		if (!firmware_node) {
++			dev_err(dev, "Missing firmware node\n");
++			return -ENOENT;
++		}
++
++		firmware = devm_rpi_firmware_get(&pdev->dev, firmware_node);
++		of_node_put(firmware_node);
++		if (!firmware)
++			return dev_err_probe(dev, -EPROBE_DEFER,
++					     "Failed to get firmware handle\n");
++
++		rpipwm->firmware = firmware;
++	}
++
+ 	chip->ops = &raspberrypi_pwm_ops;
+ 
+-	ret = raspberrypi_pwm_get_property(rpipwm->firmware, RPI_PWM_CUR_DUTY_REG,
++	ret = raspberrypi_pwm_get_property(rpipwm, RPI_PWM_CUR_DUTY_REG,
+ 					   &rpipwm->duty_cycle);
+ 	if (ret) {
+ 		dev_err(dev, "Failed to get duty cycle: %pe\n", ERR_PTR(ret));
+@@ -178,6 +199,7 @@ static int raspberrypi_pwm_probe(struct
+ 
+ static const struct of_device_id raspberrypi_pwm_of_match[] = {
+ 	{ .compatible = "raspberrypi,firmware-poe-pwm", },
++	{ .compatible = "raspberrypi,poe-pwm", },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(of, raspberrypi_pwm_of_match);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0265-power-rpi-poe-Drop-CURRENT_AVG-as-it-is-not-hardware.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0265-power-rpi-poe-Drop-CURRENT_AVG-as-it-is-not-hardware.patch
new file mode 100644
index 00000000..2b58d435
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0265-power-rpi-poe-Drop-CURRENT_AVG-as-it-is-not-hardware.patch
@@ -0,0 +1,43 @@
+From d591ddebbd9c14ca02a811dc94a7ff8c95ed9a60 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 20 Jan 2022 15:48:03 +0000
+Subject: [PATCH 265/697] power: rpi-poe: Drop CURRENT_AVG as it is not
+ hardware averaged
+
+As documented the _AVG parameters are meant to be hardware
+averaged, but the implementation for the PoE+ HAT was done in
+software in the firmware.
+
+Drop the property.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/power/supply/rpi_poe_power.c | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+--- a/drivers/power/supply/rpi_poe_power.c
++++ b/drivers/power/supply/rpi_poe_power.c
+@@ -106,15 +106,6 @@ static int rpi_poe_power_supply_get_prop
+ 		r_val->intval = (val > 5);
+ 		return 0;
+ 
+-	case POWER_SUPPLY_PROP_CURRENT_AVG:
+-		val = 50;
+-		ret = read_reg(ctx->fw, RPI_POE_ADC_REG, &val);
+-		if (ret)
+-			return ret;
+-		val = (val * 3300)/9821;
+-		r_val->intval = val * 1000;
+-		return 0;
+-
+ 	case POWER_SUPPLY_PROP_CURRENT_NOW:
+ 		ret = read_reg(ctx->fw, RPI_POE_ADC_REG, &val);
+ 		if (ret)
+@@ -145,7 +136,6 @@ static int rpi_poe_power_supply_get_prop
+ static enum power_supply_property rpi_poe_power_supply_properties[] = {
+ 	POWER_SUPPLY_PROP_HEALTH,
+ 	POWER_SUPPLY_PROP_ONLINE,
+-	POWER_SUPPLY_PROP_CURRENT_AVG,
+ 	POWER_SUPPLY_PROP_CURRENT_NOW,
+ 	POWER_SUPPLY_PROP_CURRENT_MAX,
+ };
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0266-power-rpi-poe-Add-option-of-being-created-by-MFD-or-.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0266-power-rpi-poe-Add-option-of-being-created-by-MFD-or-.patch
new file mode 100644
index 00000000..8a1d581d
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0266-power-rpi-poe-Add-option-of-being-created-by-MFD-or-.patch
@@ -0,0 +1,234 @@
+From 511116eb8b0f66b80cc5354183c54bc858958401 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 20 Jan 2022 15:50:27 +0000
+Subject: [PATCH 266/697] power: rpi-poe: Add option of being created by MFD or
+ FW
+
+The firmware can only use I2C0 if the kernel isn't, therefore
+with libcamera and DRM using it the PoE HAT fan control needs
+to move to the kernel.
+
+Add the option for the driver to be created by the PoE HAT core
+MFD driver, and use the I2C regmap that provides to control fan
+functions.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/power/supply/rpi_poe_power.c | 124 ++++++++++++++++-----------
+ 1 file changed, 75 insertions(+), 49 deletions(-)
+
+--- a/drivers/power/supply/rpi_poe_power.c
++++ b/drivers/power/supply/rpi_poe_power.c
+@@ -12,10 +12,13 @@
+ #include <linux/of.h>
+ #include <linux/platform_device.h>
+ #include <linux/power_supply.h>
++#include <linux/regmap.h>
+ #include <soc/bcm2835/raspberrypi-firmware.h>
+ 
+-#define RPI_POE_ADC_REG			0x2
+-#define RPI_POE_FLAG_REG		0x4
++#define RPI_POE_FW_BASE_REG		0x2
++
++#define RPI_POE_ADC_REG			0x0
++#define RPI_POE_FLAG_REG		0x2
+ 
+ #define RPI_POE_FLAG_AT			BIT(0)
+ #define RPI_POE_FLAG_OC			BIT(1)
+@@ -26,8 +29,12 @@
+ #define DRVNAME "rpi-poe-power-supply"
+ 
+ struct rpi_poe_power_supply_ctx {
+-	struct power_supply *supply;
+ 	struct rpi_firmware *fw;
++
++	struct regmap *regmap;
++	u32 offset;
++
++	struct power_supply *supply;
+ };
+ 
+ struct fw_tag_data_s {
+@@ -36,40 +43,51 @@ struct fw_tag_data_s {
+ 	u32 ret;
+ };
+ 
+-static int write_reg(struct rpi_firmware *fw, u32 reg, u32 *val)
++static int write_reg(struct rpi_poe_power_supply_ctx *ctx, u32 reg, u32 *val)
+ {
+ 	struct fw_tag_data_s fw_tag_data = {
+-		.reg = reg,
++		.reg = reg + RPI_POE_FW_BASE_REG,
+ 		.val = *val
+ 	};
+ 	int ret;
+ 
+-	ret = rpi_firmware_property(fw, RPI_FIRMWARE_SET_POE_HAT_VAL,
+-				    &fw_tag_data, sizeof(fw_tag_data));
+-	if (ret)
+-		return ret;
+-	else if (fw_tag_data.ret)
+-		return -EIO;
+-	return 0;
++	if (ctx->fw) {
++		ret = rpi_firmware_property(ctx->fw, RPI_FIRMWARE_SET_POE_HAT_VAL,
++					    &fw_tag_data, sizeof(fw_tag_data));
++		if (!ret && fw_tag_data.ret)
++			ret = -EIO;
++	} else {
++		ret = regmap_write(ctx->regmap, ctx->offset + reg, *val);
++	}
++
++	return ret;
+ }
+ 
+-static int read_reg(struct rpi_firmware *fw, u32 reg, u32 *val)
++static int read_reg(struct rpi_poe_power_supply_ctx *ctx, u32 reg, u32 *val)
+ {
+ 	struct fw_tag_data_s fw_tag_data = {
+-		.reg = reg,
++		.reg = reg + RPI_POE_FW_BASE_REG,
+ 		.val = *val
+ 	};
++	u32 value;
+ 	int ret;
+ 
+-	ret = rpi_firmware_property(fw, RPI_FIRMWARE_GET_POE_HAT_VAL,
+-				    &fw_tag_data, sizeof(fw_tag_data));
+-	if (ret)
+-		return ret;
+-	else if (fw_tag_data.ret)
+-		return -EIO;
++	if (ctx->fw) {
++		ret = rpi_firmware_property(ctx->fw, RPI_FIRMWARE_GET_POE_HAT_VAL,
++					    &fw_tag_data, sizeof(fw_tag_data));
++		if (!ret && fw_tag_data.ret)
++			ret = -EIO;
++		*val = fw_tag_data.val;
++	} else {
++		ret = regmap_read(ctx->regmap, ctx->offset + reg, &value);
++		if (!ret) {
++			*val = value;
++			ret = regmap_read(ctx->regmap, ctx->offset + reg + 1, &value);
++			*val |= value << 8;
++		}
++	}
+ 
+-	*val = fw_tag_data.val;
+-	return 0;
++	return ret;
+ }
+ 
+ static int rpi_poe_power_supply_get_property(struct power_supply *psy,
+@@ -82,14 +100,14 @@ static int rpi_poe_power_supply_get_prop
+ 
+ 	switch (psp) {
+ 	case POWER_SUPPLY_PROP_HEALTH:
+-		ret = read_reg(ctx->fw, RPI_POE_FLAG_REG, &val);
++		ret = read_reg(ctx, RPI_POE_FLAG_REG, &val);
+ 		if (ret)
+ 			return ret;
+ 
+ 		if (val & RPI_POE_FLAG_OC) {
+ 			r_val->intval = POWER_SUPPLY_HEALTH_UNSPEC_FAILURE;
+ 			val = RPI_POE_FLAG_OC;
+-			ret = write_reg(ctx->fw, RPI_POE_FLAG_REG, &val);
++			ret = write_reg(ctx, RPI_POE_FLAG_REG, &val);
+ 			if (ret)
+ 				return ret;
+ 			return 0;
+@@ -99,7 +117,7 @@ static int rpi_poe_power_supply_get_prop
+ 		return 0;
+ 
+ 	case POWER_SUPPLY_PROP_ONLINE:
+-		ret = read_reg(ctx->fw, RPI_POE_ADC_REG, &val);
++		ret = read_reg(ctx, RPI_POE_ADC_REG, &val);
+ 		if (ret)
+ 			return ret;
+ 
+@@ -107,7 +125,7 @@ static int rpi_poe_power_supply_get_prop
+ 		return 0;
+ 
+ 	case POWER_SUPPLY_PROP_CURRENT_NOW:
+-		ret = read_reg(ctx->fw, RPI_POE_ADC_REG, &val);
++		ret = read_reg(ctx, RPI_POE_ADC_REG, &val);
+ 		if (ret)
+ 			return ret;
+ 		val = (val * 3300)/9821;
+@@ -115,15 +133,14 @@ static int rpi_poe_power_supply_get_prop
+ 		return 0;
+ 
+ 	case POWER_SUPPLY_PROP_CURRENT_MAX:
+-		ret = read_reg(ctx->fw, RPI_POE_FLAG_REG, &val);
++		ret = read_reg(ctx, RPI_POE_FLAG_REG, &val);
+ 		if (ret)
+ 			return ret;
+ 
+-		if (val & RPI_POE_FLAG_AT) {
++		if (val & RPI_POE_FLAG_AT)
+ 			r_val->intval = RPI_POE_CURRENT_AT_MAX;
+-			return 0;
+-		}
+-		r_val->intval = RPI_POE_CURRENT_AF_MAX;
++		else
++			r_val->intval = RPI_POE_CURRENT_AF_MAX;
+ 		return 0;
+ 
+ 	default:
+@@ -158,29 +175,38 @@ static int rpi_poe_power_supply_probe(st
+ 	if (!of_device_is_available(pdev->dev.of_node))
+ 		return -ENODEV;
+ 
+-	fw_node = of_parse_phandle(pdev->dev.of_node, "firmware", 0);
+-	if (!fw_node) {
+-		dev_err(&pdev->dev, "Missing firmware node\n");
+-		return -ENOENT;
+-	}
+-
+ 	ctx = devm_kzalloc(&pdev->dev, sizeof(*ctx), GFP_KERNEL);
+ 	if (!ctx)
+ 		return -ENOMEM;
+ 
+-	ctx->fw = rpi_firmware_get(fw_node);
+-	if (!ctx->fw)
+-		return -EPROBE_DEFER;
+-	if (rpi_firmware_property(ctx->fw,
+-			RPI_FIRMWARE_GET_FIRMWARE_REVISION,
+-			&revision, sizeof(revision))) {
+-		dev_err(&pdev->dev, "Failed to get firmware revision\n");
+-		return -ENOENT;
+-	}
+-	if (revision < 0x60af72e8) {
+-		dev_err(&pdev->dev, "Unsupported firmware\n");
+-		return -ENOENT;
++	if (pdev->dev.parent)
++		ctx->regmap = dev_get_regmap(pdev->dev.parent, NULL);
++
++	if (ctx->regmap) {
++		if (device_property_read_u32(&pdev->dev, "reg", &ctx->offset))
++			return -EINVAL;
++	} else {
++		fw_node = of_parse_phandle(pdev->dev.of_node, "firmware", 0);
++		if (!fw_node) {
++			dev_err(&pdev->dev, "Missing firmware node\n");
++			return -ENOENT;
++		}
++
++		ctx->fw = rpi_firmware_get(fw_node);
++		if (!ctx->fw)
++			return -EPROBE_DEFER;
++		if (rpi_firmware_property(ctx->fw,
++					  RPI_FIRMWARE_GET_FIRMWARE_REVISION,
++					  &revision, sizeof(revision))) {
++			dev_err(&pdev->dev, "Failed to get firmware revision\n");
++			return -ENOENT;
++		}
++		if (revision < 0x60af72e8) {
++			dev_err(&pdev->dev, "Unsupported firmware\n");
++			return -ENOENT;
++		}
+ 	}
++
+ 	platform_set_drvdata(pdev, ctx);
+ 
+ 	psy_cfg.of_node = pdev->dev.of_node;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0267-drivers-bcm2835_unicam-Disable-trigger-mode-operatio.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0267-drivers-bcm2835_unicam-Disable-trigger-mode-operatio.patch
new file mode 100644
index 00000000..02f1188a
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0267-drivers-bcm2835_unicam-Disable-trigger-mode-operatio.patch
@@ -0,0 +1,57 @@
+From 14902098e55af583a0a5e16ee9450bb99bdf7427 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Tue, 18 Jan 2022 13:13:14 +0000
+Subject: [PATCH 267/697] drivers: bcm2835_unicam: Disable trigger mode
+ operation
+
+On a Pi3 B/B+ platform the imx219 sensor frequently generates a single corrupt
+frame when the sensor first starts. This can either be a missing line, or
+invalid samples within the line. This only occurrs using the Unicam kernel
+driver.
+
+Disabling trigger mode elimiates this corruption. Since trigger mode is a
+legacy feature copied from the firmware driver and not expected to be needed,
+remove it. Tested on the Raspberry Pi cameras and shows no ill effects.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 14 +-------------
+ 1 file changed, 1 insertion(+), 13 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -972,11 +972,6 @@ static irqreturn_t unicam_isr(int irq, v
+ 		}
+ 	}
+ 
+-	if (reg_read(unicam, UNICAM_ICTL) & UNICAM_FCM) {
+-		/* Switch out of trigger mode if selected */
+-		reg_write_field(unicam, UNICAM_ICTL, 1, UNICAM_TFC);
+-		reg_write_field(unicam, UNICAM_ICTL, 0, UNICAM_FCM);
+-	}
+ 	return IRQ_HANDLED;
+ }
+ 
+@@ -2286,8 +2281,7 @@ static void unicam_start_rx(struct unica
+ 
+ 	reg_write_field(dev, UNICAM_ANA, 0, UNICAM_DDL);
+ 
+-	/* Always start in trigger frame capture mode (UNICAM_FCM set) */
+-	val = UNICAM_FSIE | UNICAM_FEIE | UNICAM_FCM | UNICAM_IBOB;
++	val = UNICAM_FSIE | UNICAM_FEIE | UNICAM_IBOB;
+ 	set_field(&val, line_int_freq, UNICAM_LCIE_MASK);
+ 	reg_write(dev, UNICAM_ICTL, val);
+ 	reg_write(dev, UNICAM_STA, UNICAM_STA_MASK_ALL);
+@@ -2400,12 +2394,6 @@ static void unicam_start_rx(struct unica
+ 	/* Load embedded data buffer pointers if needed */
+ 	if (dev->node[METADATA_PAD].streaming && dev->sensor_embedded_data)
+ 		reg_write_field(dev, UNICAM_DCS, 1, UNICAM_LDP);
+-
+-	/*
+-	 * Enable trigger only for the first frame to
+-	 * sync correctly to the FS from the source.
+-	 */
+-	reg_write_field(dev, UNICAM_ICTL, 1, UNICAM_TFC);
+ }
+ 
+ static void unicam_disable(struct unicam_device *dev)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0268-media-bcm2835-unicam-Set-ret-on-error-path-in-unicam.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0268-media-bcm2835-unicam-Set-ret-on-error-path-in-unicam.patch
new file mode 100644
index 00000000..9b022838
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0268-media-bcm2835-unicam-Set-ret-on-error-path-in-unicam.patch
@@ -0,0 +1,43 @@
+From 1de205d903dd22dcd840ed86b2c5aa29da91887d Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Mon, 31 Jan 2022 17:23:38 -0700
+Subject: [PATCH 268/697] media: bcm2835-unicam: Set ret on error path in
+ unicam_async_complete()
+
+Clang warns:
+
+  drivers/media/platform/bcm2835/bcm2835-unicam.c:3109:6: warning: variable 'ret' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
+          if (!source_pads) {
+              ^~~~~~~~~~~~
+  drivers/media/platform/bcm2835/bcm2835-unicam.c:3152:9: note: uninitialized use occurs here
+          return ret;
+                 ^~~
+  drivers/media/platform/bcm2835/bcm2835-unicam.c:3109:2: note: remove the 'if' if its condition is always false
+          if (!source_pads) {
+          ^~~~~~~~~~~~~~~~~~~
+  drivers/media/platform/bcm2835/bcm2835-unicam.c:3091:9: note: initialize the variable 'ret' to silence this warning
+          int ret;
+                 ^
+                  = 0
+  1 warning generated.
+
+When the if condition is true, ret will be used uninitialized, which
+could result in undesirable behavior. Set ret to -ENODEV on the error
+path, which is a standard error code for the ->complete() callback.
+
+Fixes: d056e86eb35f ("media/bcm2835-unicam: Parse pad numbers correctly")
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -3097,6 +3097,7 @@ static int unicam_async_complete(struct
+ 	}
+ 	if (!source_pads) {
+ 		unicam_err(unicam, "No source pads on sensor.\n");
++		ret = -ENODEV;
+ 		goto unregister;
+ 	}
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0269-i2c-bcm2835-Make-clock-stretch-timeout-configurable.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0269-i2c-bcm2835-Make-clock-stretch-timeout-configurable.patch
new file mode 100644
index 00000000..49a763cc
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0269-i2c-bcm2835-Make-clock-stretch-timeout-configurable.patch
@@ -0,0 +1,44 @@
+From 3990db6ab0d0eb262656520436bda680aba67c32 Mon Sep 17 00:00:00 2001
+From: Alex Crawford <raspberrypi/linux@code.acrawford.com>
+Date: Fri, 28 Jan 2022 13:36:51 -0800
+Subject: [PATCH 269/697] i2c: bcm2835: Make clock-stretch timeout configurable
+
+The default clock-stretch timeout is 35 mS, which works well for
+SMBus, but there are some I2C devices which can stretch the clock even
+longer. Rather than trying to prescribe a safe default for everyone,
+allow the timeout to be configured.
+
+Signed-off-by: Alex Crawford <raspberrypi/linux@code.acrawford.com>
+---
+ drivers/i2c/busses/i2c-bcm2835.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-bcm2835.c
++++ b/drivers/i2c/busses/i2c-bcm2835.c
+@@ -60,6 +60,10 @@ static unsigned int debug;
+ module_param(debug, uint, 0644);
+ MODULE_PARM_DESC(debug, "1=err, 2=isr, 3=xfer");
+ 
++static unsigned int clk_tout_ms = 35; /* SMBUs-recommended 35ms */
++module_param(clk_tout_ms, uint, 0644);
++MODULE_PARM_DESC(clk_tout_ms, "clock-stretch timeout (mS)");
++
+ #define BCM2835_DEBUG_MAX	512
+ struct bcm2835_debug {
+ 	struct i2c_msg *msg;
+@@ -219,12 +223,12 @@ static int clk_bcm2835_i2c_set_rate(stru
+ 			   (redl << BCM2835_I2C_REDL_SHIFT));
+ 
+ 	/*
+-	 * Set the clock stretch timeout to the SMBUs-recommended 35ms.
++	 * Set the clock stretch timeout.
+ 	 */
+-	if (rate > 0xffff*1000/35)
++	if (rate > 0xffff*1000/clk_tout_ms)
+ 	    clk_tout = 0xffff;
+ 	else
+-	    clk_tout = 35*rate/1000;
++	    clk_tout = clk_tout_ms*rate/1000;
+ 
+ 	bcm2835_i2c_writel(div->i2c_dev, BCM2835_I2C_CLKT, clk_tout);
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0270-bindings-Add-sck-idle-input-to-spi-gpio.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0270-bindings-Add-sck-idle-input-to-spi-gpio.patch
new file mode 100644
index 00000000..e410a1ff
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0270-bindings-Add-sck-idle-input-to-spi-gpio.patch
@@ -0,0 +1,23 @@
+From 8f7b2816a822b3f28b417c4f587eebcdca318797 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 4 Feb 2022 11:33:28 +0000
+Subject: [PATCH 270/697] bindings: Add sck-idle-input to spi-gpio
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ Documentation/devicetree/bindings/spi/spi-gpio.yaml | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/Documentation/devicetree/bindings/spi/spi-gpio.yaml
++++ b/Documentation/devicetree/bindings/spi/spi-gpio.yaml
+@@ -43,6 +43,10 @@ properties:
+       with no chip select is connected.
+     $ref: /schemas/types.yaml#/definitions/uint32
+ 
++  sck-idle-input:
++    description: Make SCK an input when inactive.
++    type: boolean
++
+   # Deprecated properties
+   gpio-sck: false
+   gpio-miso: false
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0271-spi-gpio-Add-sck-idle-input-property.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0271-spi-gpio-Add-sck-idle-input-property.patch
new file mode 100644
index 00000000..e9778116
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0271-spi-gpio-Add-sck-idle-input-property.patch
@@ -0,0 +1,57 @@
+From 4acdd2dc7d19b7ce3704be8f4819bf3a386a989b Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 12 Jan 2022 08:23:28 +0000
+Subject: [PATCH 271/697] spi: gpio: Add sck-idle-input property
+
+The sck-idle-input property indicates that the spi-gpio driver should
+return the SCK line to an input when the chip select signals are
+inactive.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/spi/spi-gpio.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/spi/spi-gpio.c
++++ b/drivers/spi/spi-gpio.c
+@@ -34,6 +34,7 @@ struct spi_gpio {
+ 	struct gpio_desc		*sck;
+ 	struct gpio_desc		*miso;
+ 	struct gpio_desc		*mosi;
++	bool				sck_idle_input;
+ 	struct gpio_desc		**cs_gpios;
+ };
+ 
+@@ -224,8 +225,12 @@ static void spi_gpio_chipselect(struct s
+ 	struct spi_gpio *spi_gpio = spi_to_spi_gpio(spi);
+ 
+ 	/* set initial clock line level */
+-	if (is_active)
+-		gpiod_set_value_cansleep(spi_gpio->sck, spi->mode & SPI_CPOL);
++	if (is_active) {
++		if (spi_gpio->sck_idle_input)
++			gpiod_direction_output(spi_gpio->sck, spi->mode & SPI_CPOL);
++		else
++			gpiod_set_value_cansleep(spi_gpio->sck, spi->mode & SPI_CPOL);
++	}
+ 
+ 	/* Drive chip select line, if we have one */
+ 	if (spi_gpio->cs_gpios) {
+@@ -234,6 +239,9 @@ static void spi_gpio_chipselect(struct s
+ 		/* SPI chip selects are normally active-low */
+ 		gpiod_set_value_cansleep(cs, (spi->mode & SPI_CS_HIGH) ? is_active : !is_active);
+ 	}
++
++	if (spi_gpio->sck_idle_input && !is_active)
++		gpiod_direction_input(spi_gpio->sck);
+ }
+ 
+ static void spi_gpio_set_mosi_idle(struct spi_device *spi)
+@@ -329,6 +337,7 @@ static int spi_gpio_request(struct devic
+ 	if (IS_ERR(spi_gpio->miso))
+ 		return PTR_ERR(spi_gpio->miso);
+ 
++	spi_gpio->sck_idle_input = device_property_read_bool(dev, "sck-idle-input");
+ 	spi_gpio->sck = devm_gpiod_get(dev, "sck", GPIOD_OUT_LOW);
+ 	return PTR_ERR_OR_ZERO(spi_gpio->sck);
+ }
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0272-media-bcm2835-unicam-Handle-a-repeated-frame-start-w.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0272-media-bcm2835-unicam-Handle-a-repeated-frame-start-w.patch
new file mode 100644
index 00000000..1813fdd0
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0272-media-bcm2835-unicam-Handle-a-repeated-frame-start-w.patch
@@ -0,0 +1,63 @@
+From cff8b22389bdf36a57273e45a0fe592118775235 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 4 Feb 2022 16:12:35 +0000
+Subject: [PATCH 272/697] media: bcm2835-unicam: Handle a repeated frame start
+ with no end
+
+In the case of 2 frame starts being received with no frame end
+between, the queued buffer held in next_frm was lost as the
+pointer was overwritten with the dummy buffer.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../media/platform/bcm2835/bcm2835-unicam.c   | 29 +++++++++++++++----
+ 1 file changed, 24 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -919,10 +919,14 @@ static irqreturn_t unicam_isr(int irq, v
+ 			 * as complete, as the HW will reuse that buffer.
+ 			 */
+ 			if (unicam->node[i].cur_frm &&
+-			    unicam->node[i].cur_frm != unicam->node[i].next_frm)
++			    unicam->node[i].cur_frm != unicam->node[i].next_frm) {
+ 				unicam_process_buffer_complete(&unicam->node[i],
+ 							       sequence);
+-			unicam->node[i].cur_frm = unicam->node[i].next_frm;
++				unicam->node[i].cur_frm = unicam->node[i].next_frm;
++				unicam->node[i].next_frm = NULL;
++			} else {
++				unicam->node[i].cur_frm = unicam->node[i].next_frm;
++			}
+ 		}
+ 		unicam->sequence++;
+ 	}
+@@ -945,10 +949,25 @@ static irqreturn_t unicam_isr(int irq, v
+ 					   i);
+ 			/*
+ 			 * Set the next frame output to go to a dummy frame
+-			 * if we have not managed to obtain another frame
+-			 * from the queue.
++			 * if no buffer currently queued.
+ 			 */
+-			unicam_schedule_dummy_buffer(&unicam->node[i]);
++			if (!unicam->node[i].next_frm ||
++			    unicam->node[i].next_frm == unicam->node[i].cur_frm) {
++				unicam_schedule_dummy_buffer(&unicam->node[i]);
++			} else if (unicam->node[i].cur_frm) {
++				/*
++				 * Repeated FS without FE. Hardware will have
++				 * swapped buffers, but the cur_frm doesn't
++				 * contain valid data. Return cur_frm to the
++				 * queue.
++				 */
++				spin_lock(&unicam->node[i].dma_queue_lock);
++				list_add_tail(&unicam->node[i].cur_frm->list,
++					      &unicam->node[i].dma_queue);
++				spin_unlock(&unicam->node[i].dma_queue_lock);
++				unicam->node[i].cur_frm = unicam->node[i].next_frm;
++				unicam->node[i].next_frm = NULL;
++			}
+ 		}
+ 
+ 		unicam_queue_event_sof(unicam);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0273-media-i2c-ov7251-Reinstate-setting-ov7251_global_ini.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0273-media-i2c-ov7251-Reinstate-setting-ov7251_global_ini.patch
new file mode 100644
index 00000000..3f0f641a
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0273-media-i2c-ov7251-Reinstate-setting-ov7251_global_ini.patch
@@ -0,0 +1,32 @@
+From ee2efcf16da250265c03ae46339356868a592a44 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 17 Feb 2022 14:48:30 +0000
+Subject: [PATCH 273/697] media: i2c: ov7251: Reinstate setting
+ ov7251_global_init_setting
+
+"media: i2c: Remove .s_power() from ov7251" removed the call that
+sent ov7251_global_init_setting to the sensor. Send it when starting
+streaming.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/ov7251.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/media/i2c/ov7251.c
++++ b/drivers/media/i2c/ov7251.c
+@@ -1346,6 +1346,14 @@ static int ov7251_s_stream(struct v4l2_s
+ 			return ret;
+ 		}
+ 
++		ret = ov7251_set_register_array(ov7251,
++					ov7251_global_init_setting,
++					ARRAY_SIZE(ov7251_global_init_setting));
++		if (ret < 0) {
++			dev_err(ov7251->dev, "could not set global_init_setting\n");
++			goto err_power_down;
++		}
++
+ 		ret = ov7251_pll_configure(ov7251);
+ 		if (ret) {
+ 			dev_err(ov7251->dev, "error configuring PLLs\n");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0274-media-i2c-Add-driver-for-Omnivision-OV2311.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0274-media-i2c-Add-driver-for-Omnivision-OV2311.patch
new file mode 100644
index 00000000..f4ac3867
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0274-media-i2c-Add-driver-for-Omnivision-OV2311.patch
@@ -0,0 +1,1236 @@
+From 596e7f63a42f4f117a0c9ce742c92ea56a6a3776 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 25 Feb 2022 18:16:13 +0000
+Subject: [PATCH 274/697] media/i2c: Add driver for Omnivision OV2311
+
+Omnivision OV2311 is a CSI2 1600x1300 global shutter image sensor.
+Add a driver for it.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: Update ov2311 Kconfig entry
+
+Bring the OV2311 Kconfig declaration in line with upstream entries.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+media: i2c: ov2311: Fix uninitialized variable usage
+
+Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
+---
+ drivers/media/i2c/Kconfig  |   10 +
+ drivers/media/i2c/Makefile |    1 +
+ drivers/media/i2c/ov2311.c | 1178 ++++++++++++++++++++++++++++++++++++
+ 3 files changed, 1189 insertions(+)
+ create mode 100644 drivers/media/i2c/ov2311.c
+
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -396,6 +396,16 @@ config VIDEO_OV13B10
+ 	  This is a Video4Linux2 sensor driver for the OmniVision
+ 	  OV13B10 camera.
+ 
++config VIDEO_OV2311
++	tristate "OmniVision OV2311 sensor support"
++	depends on I2C && VIDEO_DEV
++	help
++	  This is a Video4Linux2 sensor-level driver for the OmniVision
++	  OV2311 camera.
++
++	  To compile this driver as a module, choose M here: the
++	  module will be called ov2311.
++
+ config VIDEO_OV2640
+ 	tristate "OmniVision OV2640 sensor support"
+ 	help
+--- a/drivers/media/i2c/Makefile
++++ b/drivers/media/i2c/Makefile
+@@ -89,6 +89,7 @@ obj-$(CONFIG_VIDEO_OV08D10) += ov08d10.o
+ obj-$(CONFIG_VIDEO_OV08X40) += ov08x40.o
+ obj-$(CONFIG_VIDEO_OV13858) += ov13858.o
+ obj-$(CONFIG_VIDEO_OV13B10) += ov13b10.o
++obj-$(CONFIG_VIDEO_OV2311) += ov2311.o
+ obj-$(CONFIG_VIDEO_OV2640) += ov2640.o
+ obj-$(CONFIG_VIDEO_OV2659) += ov2659.o
+ obj-$(CONFIG_VIDEO_OV2680) += ov2680.o
+--- /dev/null
++++ b/drivers/media/i2c/ov2311.c
+@@ -0,0 +1,1178 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Omnivision OV2311 1600x1300 global shutter image sensor driver
++ * Copyright (C) 2022, Raspberry Pi (Trading) Ltd
++ *
++ * This driver is based on the OV9281 driver.
++ * Copyright (C) 2017 Fuzhou Rockchip Electronics Co., Ltd.
++ * Register configuration from
++ * https://github.com/ArduCAM/ArduCAM_USB_Camera_Shield/tree/master/Config/USB3.0_UC-425_Rev.C%2BUC-628_Rev.B/OV2311
++ * with additional exposure and gain register information from
++ * https://github.com/renesas-rcar/linux-bsp/tree/0cf6e36f5bf49e1c2aab87139ec5b588623c56f8/drivers/media/i2c/imagers
++ */
++
++#include <linux/clk.h>
++#include <linux/device.h>
++#include <linux/delay.h>
++#include <linux/gpio/consumer.h>
++#include <linux/i2c.h>
++#include <linux/module.h>
++#include <linux/pm_runtime.h>
++#include <linux/regulator/consumer.h>
++#include <media/media-entity.h>
++#include <media/v4l2-async.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-event.h>
++#include <media/v4l2-fwnode.h>
++#include <media/v4l2-subdev.h>
++
++#define OV2311_LINK_FREQ		400000000
++#define OV2311_LANES			2
++
++/* pixel rate = link frequency * 2 * lanes / BITS_PER_SAMPLE */
++#define OV2311_PIXEL_RATE_10BIT		(OV2311_LINK_FREQ * 2 * \
++					 OV2311_LANES / 10)
++#define OV2311_PIXEL_RATE_8BIT		(OV2311_LINK_FREQ * 2 * \
++					 OV2311_LANES / 8)
++#define OV2311_XVCLK_FREQ		24000000
++
++#define CHIP_ID				0x2311
++#define OV2311_REG_CHIP_ID		0x300a
++
++#define OV2311_REG_CTRL_MODE		0x0100
++#define OV2311_MODE_SW_STANDBY		0x0
++#define OV2311_MODE_STREAMING		BIT(0)
++
++#define OV2311_REG_V_FLIP		0x3820
++#define OV2311_REG_H_FLIP		0x3821
++#define OV2311_FLIP_BIT			BIT(2)
++
++#define OV2311_REG_EXPOSURE		0x3501
++#define	OV2311_EXPOSURE_MIN		4
++#define	OV2311_EXPOSURE_STEP		1
++#define OV2311_VTS_MAX			0xffff
++
++#define OV2311_REG_GAIN_H		0x3508
++#define OV2311_REG_GAIN_L		0x3509
++#define OV2311_GAIN_H_MASK		0x07
++#define OV2311_GAIN_H_SHIFT		8
++#define OV2311_GAIN_L_MASK		0xff
++#define OV2311_GAIN_MIN			0x100
++#define OV2311_GAIN_MAX			0x780
++#define OV2311_GAIN_STEP		1
++#define OV2311_GAIN_DEFAULT		OV2311_GAIN_MIN
++
++#define OV2311_REG_TEST_PATTERN		0x5e00
++#define OV2311_TEST_PATTERN_ENABLE	0x80
++#define OV2311_TEST_PATTERN_DISABLE	0x0
++
++#define OV2311_REG_VTS			0x380e
++
++/*
++ * OV2311 native and active pixel array size.
++ * Datasheet not available to confirm these values. renesas-rcar linux-bsp tree
++ * has these values.
++ */
++#define OV2311_NATIVE_WIDTH		1616U
++#define OV2311_NATIVE_HEIGHT		1316U
++#define OV2311_PIXEL_ARRAY_LEFT		8U
++#define OV2311_PIXEL_ARRAY_TOP		8U
++#define OV2311_PIXEL_ARRAY_WIDTH	1600U
++#define OV2311_PIXEL_ARRAY_HEIGHT	1300U
++
++#define REG_NULL			0xFFFF
++
++#define OV2311_REG_VALUE_08BIT		1
++#define OV2311_REG_VALUE_16BIT		2
++#define OV2311_REG_VALUE_24BIT		3
++
++#define OV2311_NAME			"ov2311"
++
++static const char * const ov2311_supply_names[] = {
++	"avdd",		/* Analog power */
++	"dovdd",	/* Digital I/O power */
++	"dvdd",		/* Digital core power */
++};
++
++#define OV2311_NUM_SUPPLIES ARRAY_SIZE(ov2311_supply_names)
++
++struct regval {
++	u16 addr;
++	u8 val;
++};
++
++struct ov2311_mode {
++	u32 width;
++	u32 height;
++	u32 hts_def;
++	u32 vts_def;
++	u32 exp_def;
++	struct v4l2_rect crop;
++	const struct regval *reg_list;
++};
++
++struct ov2311 {
++	struct i2c_client	*client;
++	struct clk		*xvclk;
++	struct gpio_desc	*reset_gpio;
++	struct gpio_desc	*pwdn_gpio;
++	struct regulator_bulk_data supplies[OV2311_NUM_SUPPLIES];
++
++	struct v4l2_subdev	subdev;
++	struct media_pad	pad;
++	struct v4l2_ctrl_handler ctrl_handler;
++	struct v4l2_ctrl	*exposure;
++	struct v4l2_ctrl	*hblank;
++	struct v4l2_ctrl	*vblank;
++	struct v4l2_ctrl	*pixel_rate;
++	/*
++	 * Mutex for serialized access:
++	 * Protect sensor module set pad format and start/stop streaming safely.
++	 */
++	struct mutex		mutex;
++
++	/* Streaming on/off */
++	bool streaming;
++
++	const struct ov2311_mode *cur_mode;
++	u32			code;
++};
++
++#define to_ov2311(sd) container_of(sd, struct ov2311, subdev)
++
++/*
++ * Xclk 24Mhz
++ * max_framerate 60fps for 10 bit, 74.6fps for 8 bit.
++ */
++static const struct regval ov2311_common_regs[] = {
++	{ 0x0103, 0x01 },
++	{ 0x0100, 0x00 },
++	{ 0x0300, 0x01 },
++	{ 0x0302, 0x32 },
++	{ 0x0303, 0x00 },
++	{ 0x0304, 0x03 },
++	{ 0x0305, 0x02 },
++	{ 0x0306, 0x01 },
++	{ 0x030e, 0x04 },
++	{ 0x3001, 0x02 },
++	{ 0x3004, 0x00 },
++	{ 0x3005, 0x00 },
++	{ 0x3006, 0x00 },
++	{ 0x3011, 0x0d },
++	{ 0x3014, 0x04 },
++	{ 0x301c, 0xf0 },
++	{ 0x3020, 0x00 },
++	{ 0x302c, 0x00 },
++	{ 0x302d, 0x12 },
++	{ 0x302e, 0x4c },
++	{ 0x302f, 0x8c },
++	{ 0x3030, 0x10 },
++	{ 0x303f, 0x03 },
++	{ 0x3103, 0x00 },
++	{ 0x3106, 0x08 },
++	{ 0x31ff, 0x01 },
++	{ 0x3501, 0x05 },
++	{ 0x3502, 0xba },
++	{ 0x3506, 0x00 },
++	{ 0x3507, 0x00 },
++	{ 0x3620, 0x67 },
++	{ 0x3633, 0x78 },
++	{ 0x3666, 0x00 },
++	{ 0x3670, 0x68 },
++	{ 0x3674, 0x10 },
++	{ 0x3675, 0x00 },
++	{ 0x3680, 0x84 },
++	{ 0x36a2, 0x04 },
++	{ 0x36a3, 0x80 },
++	{ 0x36b0, 0x00 },
++	{ 0x3700, 0x35 },
++	{ 0x3704, 0x59 },
++	{ 0x3712, 0x00 },
++	{ 0x3713, 0x02 },
++	{ 0x379b, 0x01 },
++	{ 0x379c, 0x10 },
++	{ 0x3800, 0x00 },
++	{ 0x3801, 0x00 },
++	{ 0x3804, 0x06 },
++	{ 0x3805, 0x4f },
++	{ 0x3810, 0x00 },
++	{ 0x3811, 0x08 },
++	{ 0x3812, 0x00 },
++	{ 0x3813, 0x08 },
++	{ 0x3814, 0x11 },
++	{ 0x3815, 0x11 },
++	{ 0x3816, 0x00 },
++	{ 0x3817, 0x00 },
++	{ 0x3818, 0x04 },
++	{ 0x3819, 0x00 },
++	{ 0x382b, 0x5a },
++	{ 0x382c, 0x09 },
++	{ 0x382d, 0x9a },
++	{ 0x3882, 0x02 },
++	{ 0x3883, 0x6c },
++	{ 0x3885, 0x07 },
++	{ 0x389d, 0x03 },
++	{ 0x38a6, 0x00 },
++	{ 0x38a7, 0x01 },
++	{ 0x38b3, 0x07 },
++	{ 0x38b1, 0x00 },
++	{ 0x38e5, 0x02 },
++	{ 0x38e7, 0x00 },
++	{ 0x38e8, 0x00 },
++	{ 0x3910, 0xff },
++	{ 0x3911, 0xff },
++	{ 0x3912, 0x08 },
++	{ 0x3913, 0x00 },
++	{ 0x3914, 0x00 },
++	{ 0x3915, 0x00 },
++	{ 0x391c, 0x00 },
++	{ 0x3920, 0xa5 },
++	{ 0x3921, 0x00 },
++	{ 0x3922, 0x00 },
++	{ 0x3923, 0x00 },
++	{ 0x3924, 0x05 },
++	{ 0x3925, 0x00 },
++	{ 0x3926, 0x00 },
++	{ 0x3927, 0x00 },
++	{ 0x3928, 0x1a },
++	{ 0x392d, 0x05 },
++	{ 0x392e, 0xf2 },
++	{ 0x392f, 0x40 },
++	{ 0x4001, 0x00 },
++	{ 0x4003, 0x40 },
++	{ 0x4008, 0x12 },
++	{ 0x4009, 0x1b },
++	{ 0x400c, 0x0c },
++	{ 0x400d, 0x13 },
++	{ 0x4010, 0xf0 },
++	{ 0x4011, 0x00 },
++	{ 0x4016, 0x00 },
++	{ 0x4017, 0x04 },
++	{ 0x4042, 0x11 },
++	{ 0x4043, 0x70 },
++	{ 0x4045, 0x00 },
++	{ 0x4409, 0x5f },
++	{ 0x450b, 0x00 },
++	{ 0x4600, 0x00 },
++	{ 0x4601, 0xa0 },
++	{ 0x4708, 0x09 },
++	{ 0x470c, 0x81 },
++	{ 0x4710, 0x06 },
++	{ 0x4711, 0x00 },
++	{ 0x4800, 0x00 },
++	{ 0x481f, 0x30 },
++	{ 0x4837, 0x14 },
++	{ 0x4f00, 0x00 },
++	{ 0x4f07, 0x00 },
++	{ 0x4f08, 0x03 },
++	{ 0x4f09, 0x08 },
++	{ 0x4f0c, 0x06 },
++	{ 0x4f0d, 0x02 },
++	{ 0x4f10, 0x00 },
++	{ 0x4f11, 0x00 },
++	{ 0x4f12, 0x07 },
++	{ 0x4f13, 0xe2 },
++	{ 0x5000, 0x9f },
++	{ 0x5001, 0x20 },
++	{ 0x5026, 0x00 },
++	{ 0x5c00, 0x00 },
++	{ 0x5c01, 0x2c },
++	{ 0x5c02, 0x00 },
++	{ 0x5c03, 0x7f },
++	{ 0x5e00, 0x00 },
++	{ 0x5e01, 0x41 },
++	{REG_NULL, 0x00},
++};
++
++static const struct regval ov2311_1600x1300_regs[] = {
++	{ 0x3802, 0x00 },
++	{ 0x3803, 0x00 },
++	{ 0x3806, 0x05 },
++	{ 0x3807, 0x23 },
++	{ 0x3808, 0x06 },
++	{ 0x3809, 0x40 },
++	{ 0x380a, 0x05 },
++	{ 0x380b, 0x14 },
++	{ 0x380c, 0x03 },
++	{ 0x380d, 0x88 },
++	{REG_NULL, 0x00},
++};
++
++static const struct regval ov2311_1600x1080_regs[] = {
++	{ 0x3802, 0x00 },
++	{ 0x3803, 0x6e },
++	{ 0x3806, 0x04 },
++	{ 0x3807, 0xae },
++	{ 0x3808, 0x06 },
++	{ 0x3809, 0x40 },
++	{ 0x380a, 0x04 },
++	{ 0x380b, 0x38 },
++	{ 0x380c, 0x03 },
++	{ 0x380d, 0x88 },
++
++	{ 0x5d01, 0x00 },
++	{ 0x5d02, 0x04 },
++	{ 0x5d03, 0x00 },
++	{ 0x5d04, 0x04 },
++	{ 0x5d05, 0x00 },
++	{REG_NULL, 0x00},
++};
++
++static const struct regval op_10bit[] = {
++	{ 0x030d, 0x5a },
++	{ 0x3662, 0x65 },
++	{REG_NULL, 0x00},
++};
++
++static const struct regval op_8bit[] = {
++	{ 0x030d, 0x70 },
++	{ 0x3662, 0x67 },
++	{REG_NULL, 0x00},
++};
++
++static const struct ov2311_mode supported_modes[] = {
++	{
++		.width = 1600,
++		.height = 1300,
++		.exp_def = 0x0320,
++		.hts_def = (0x0388 * 2),/* Registers 0x380c / 0x380d  * 2 */
++		.vts_def = 0x5c2,	/* Registers 0x380e / 0x380f
++					 * 60fps for 10bpp
++					 */
++		.crop = {
++			.left = OV2311_PIXEL_ARRAY_LEFT,
++			.top = OV2311_PIXEL_ARRAY_TOP,
++			.width = 1600,
++			.height = 1300
++		},
++		.reg_list = ov2311_1600x1300_regs,
++	},
++	{
++		.width = 1600,
++		.height = 1080,
++		.exp_def = 0x0320,
++		.hts_def = (0x0388 * 2),/* Registers 0x380c / 0x380d  * 2 */
++		.vts_def = 0x5c2,	/* Registers 0x380e / 0x380f
++					 * 60fps for 10bpp
++					 */
++		.crop = {
++			.left = OV2311_PIXEL_ARRAY_LEFT,
++			.top = 110 + OV2311_PIXEL_ARRAY_TOP,
++			.width = 1600,
++			.height = 1080
++		},
++		.reg_list = ov2311_1600x1080_regs,
++	},
++};
++
++static const s64 link_freq_menu_items[] = {
++	OV2311_LINK_FREQ
++};
++
++static const char * const ov2311_test_pattern_menu[] = {
++	"Disabled",
++	"Vertical Color Bar Type 1",
++	"Vertical Color Bar Type 2",
++	"Vertical Color Bar Type 3",
++	"Vertical Color Bar Type 4"
++};
++
++/* Write registers up to 4 at a time */
++static int ov2311_write_reg(struct i2c_client *client, u16 reg,
++			    u32 len, u32 val)
++{
++	u32 buf_i, val_i;
++	u8 buf[6];
++	u8 *val_p;
++	__be32 val_be;
++
++	if (len > 4)
++		return -EINVAL;
++
++	buf[0] = reg >> 8;
++	buf[1] = reg & 0xff;
++
++	val_be = cpu_to_be32(val);
++	val_p = (u8 *)&val_be;
++	buf_i = 2;
++	val_i = 4 - len;
++
++	while (val_i < 4)
++		buf[buf_i++] = val_p[val_i++];
++
++	if (i2c_master_send(client, buf, len + 2) != len + 2)
++		return -EIO;
++
++	return 0;
++}
++
++static int ov2311_write_array(struct i2c_client *client,
++			      const struct regval *regs)
++{
++	u32 i;
++	int ret = 0;
++
++	for (i = 0; ret == 0 && regs[i].addr != REG_NULL; i++)
++		ret = ov2311_write_reg(client, regs[i].addr,
++				       OV2311_REG_VALUE_08BIT, regs[i].val);
++
++	return ret;
++}
++
++/* Read registers up to 4 at a time */
++static int ov2311_read_reg(struct i2c_client *client, u16 reg, unsigned int len,
++			   u32 *val)
++{
++	struct i2c_msg msgs[2];
++	u8 *data_be_p;
++	__be32 data_be = 0;
++	__be16 reg_addr_be = cpu_to_be16(reg);
++	int ret;
++
++	if (len > 4 || !len)
++		return -EINVAL;
++
++	data_be_p = (u8 *)&data_be;
++	/* Write register address */
++	msgs[0].addr = client->addr;
++	msgs[0].flags = 0;
++	msgs[0].len = 2;
++	msgs[0].buf = (u8 *)&reg_addr_be;
++
++	/* Read data from register */
++	msgs[1].addr = client->addr;
++	msgs[1].flags = I2C_M_RD;
++	msgs[1].len = len;
++	msgs[1].buf = &data_be_p[4 - len];
++
++	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
++	if (ret != ARRAY_SIZE(msgs))
++		return -EIO;
++
++	*val = be32_to_cpu(data_be);
++
++	return 0;
++}
++
++static int ov2311_set_fmt(struct v4l2_subdev *sd,
++			  struct v4l2_subdev_state *sd_state,
++			  struct v4l2_subdev_format *fmt)
++{
++	struct ov2311 *ov2311 = to_ov2311(sd);
++	const struct ov2311_mode *mode;
++	s64 h_blank, vblank_def, pixel_rate;
++
++	mutex_lock(&ov2311->mutex);
++
++	mode = v4l2_find_nearest_size(supported_modes,
++				      ARRAY_SIZE(supported_modes),
++				      width, height,
++				      fmt->format.width,
++				      fmt->format.height);
++	if (fmt->format.code != MEDIA_BUS_FMT_Y8_1X8)
++		fmt->format.code = MEDIA_BUS_FMT_Y10_1X10;
++	fmt->format.width = mode->width;
++	fmt->format.height = mode->height;
++	fmt->format.field = V4L2_FIELD_NONE;
++	fmt->format.colorspace = V4L2_COLORSPACE_RAW;
++	fmt->format.ycbcr_enc =
++			V4L2_MAP_YCBCR_ENC_DEFAULT(fmt->format.colorspace);
++	fmt->format.quantization =
++		V4L2_MAP_QUANTIZATION_DEFAULT(true, fmt->format.colorspace,
++					      fmt->format.ycbcr_enc);
++	fmt->format.xfer_func =
++		V4L2_MAP_XFER_FUNC_DEFAULT(fmt->format.colorspace);
++
++	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++		*v4l2_subdev_state_get_format(sd_state, fmt->pad) =
++								fmt->format;
++	} else {
++		ov2311->cur_mode = mode;
++		ov2311->code = fmt->format.code;
++		h_blank = mode->hts_def - mode->width;
++		__v4l2_ctrl_modify_range(ov2311->hblank, h_blank,
++					 h_blank, 1, h_blank);
++		__v4l2_ctrl_s_ctrl(ov2311->hblank, h_blank);
++		vblank_def = mode->vts_def - mode->height;
++		__v4l2_ctrl_modify_range(ov2311->vblank, vblank_def,
++					 OV2311_VTS_MAX - mode->height,
++					 1, vblank_def);
++		__v4l2_ctrl_s_ctrl(ov2311->vblank, vblank_def);
++
++		pixel_rate = (fmt->format.code == MEDIA_BUS_FMT_Y10_1X10) ?
++			OV2311_PIXEL_RATE_10BIT : OV2311_PIXEL_RATE_8BIT;
++		__v4l2_ctrl_modify_range(ov2311->pixel_rate, pixel_rate,
++					 pixel_rate, 1, pixel_rate);
++	}
++
++	mutex_unlock(&ov2311->mutex);
++
++	return 0;
++}
++
++static int ov2311_get_fmt(struct v4l2_subdev *sd,
++			  struct v4l2_subdev_state *sd_state,
++			  struct v4l2_subdev_format *fmt)
++{
++	struct ov2311 *ov2311 = to_ov2311(sd);
++	const struct ov2311_mode *mode = ov2311->cur_mode;
++
++	mutex_lock(&ov2311->mutex);
++	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++		fmt->format = *v4l2_subdev_state_get_format(sd_state, fmt->pad);
++	} else {
++		fmt->format.width = mode->width;
++		fmt->format.height = mode->height;
++		fmt->format.code = ov2311->code;
++		fmt->format.field = V4L2_FIELD_NONE;
++		fmt->format.colorspace = V4L2_COLORSPACE_SRGB;
++		fmt->format.ycbcr_enc =
++			V4L2_MAP_YCBCR_ENC_DEFAULT(fmt->format.colorspace);
++		fmt->format.quantization =
++			V4L2_MAP_QUANTIZATION_DEFAULT(true,
++						      fmt->format.colorspace,
++						      fmt->format.ycbcr_enc);
++		fmt->format.xfer_func =
++			V4L2_MAP_XFER_FUNC_DEFAULT(fmt->format.colorspace);
++	}
++	mutex_unlock(&ov2311->mutex);
++
++	return 0;
++}
++
++static int ov2311_enum_mbus_code(struct v4l2_subdev *sd,
++				 struct v4l2_subdev_state *sd_state,
++				 struct v4l2_subdev_mbus_code_enum *code)
++{
++	switch (code->index) {
++	default:
++		return -EINVAL;
++	case 0:
++		code->code = MEDIA_BUS_FMT_Y10_1X10;
++		break;
++	case 1:
++		code->code = MEDIA_BUS_FMT_Y8_1X8;
++		break;
++	}
++
++	return 0;
++}
++
++static int ov2311_enum_frame_sizes(struct v4l2_subdev *sd,
++				   struct v4l2_subdev_state *sd_state,
++				   struct v4l2_subdev_frame_size_enum *fse)
++{
++	if (fse->index >= ARRAY_SIZE(supported_modes))
++		return -EINVAL;
++
++	if (fse->code != MEDIA_BUS_FMT_Y10_1X10 &&
++	    fse->code != MEDIA_BUS_FMT_Y8_1X8)
++		return -EINVAL;
++
++	fse->min_width  = supported_modes[fse->index].width;
++	fse->max_width  = supported_modes[fse->index].width;
++	fse->max_height = supported_modes[fse->index].height;
++	fse->min_height = supported_modes[fse->index].height;
++
++	return 0;
++}
++
++static int ov2311_enable_test_pattern(struct ov2311 *ov2311, u32 pattern)
++{
++	u32 val;
++
++	if (pattern)
++		val = (pattern - 1) | OV2311_TEST_PATTERN_ENABLE;
++	else
++		val = OV2311_TEST_PATTERN_DISABLE;
++
++	return ov2311_write_reg(ov2311->client, OV2311_REG_TEST_PATTERN,
++				OV2311_REG_VALUE_08BIT, val);
++}
++
++static const struct v4l2_rect *
++__ov2311_get_pad_crop(struct ov2311 *ov2311, struct v4l2_subdev_state *sd_state,
++		      unsigned int pad, enum v4l2_subdev_format_whence which)
++{
++	switch (which) {
++	case V4L2_SUBDEV_FORMAT_TRY:
++		return v4l2_subdev_state_get_crop(sd_state, pad);
++	case V4L2_SUBDEV_FORMAT_ACTIVE:
++		return &ov2311->cur_mode->crop;
++	}
++
++	return NULL;
++}
++
++static int ov2311_get_selection(struct v4l2_subdev *sd,
++				struct v4l2_subdev_state *sd_state,
++				struct v4l2_subdev_selection *sel)
++{
++	switch (sel->target) {
++	case V4L2_SEL_TGT_CROP: {
++		struct ov2311 *ov2311 = to_ov2311(sd);
++
++		mutex_lock(&ov2311->mutex);
++		sel->r = *__ov2311_get_pad_crop(ov2311, sd_state, sel->pad,
++						sel->which);
++		mutex_unlock(&ov2311->mutex);
++
++		return 0;
++	}
++
++	case V4L2_SEL_TGT_NATIVE_SIZE:
++		sel->r.top = 0;
++		sel->r.left = 0;
++		sel->r.width = OV2311_NATIVE_WIDTH;
++		sel->r.height = OV2311_NATIVE_HEIGHT;
++
++		return 0;
++
++	case V4L2_SEL_TGT_CROP_DEFAULT:
++	case V4L2_SEL_TGT_CROP_BOUNDS:
++		sel->r.top = OV2311_PIXEL_ARRAY_TOP;
++		sel->r.left = OV2311_PIXEL_ARRAY_LEFT;
++		sel->r.width = OV2311_PIXEL_ARRAY_WIDTH;
++		sel->r.height = OV2311_PIXEL_ARRAY_HEIGHT;
++
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++static int ov2311_start_stream(struct ov2311 *ov2311)
++{
++	int ret;
++
++	ret = ov2311_write_array(ov2311->client, ov2311_common_regs);
++	if (ret)
++		return ret;
++
++	ret = ov2311_write_array(ov2311->client, ov2311->cur_mode->reg_list);
++	if (ret)
++		return ret;
++
++	if (ov2311->code == MEDIA_BUS_FMT_Y10_1X10)
++		ret = ov2311_write_array(ov2311->client, op_10bit);
++	else
++		ret = ov2311_write_array(ov2311->client, op_8bit);
++	if (ret)
++		return ret;
++
++	/* In case these controls are set before streaming */
++	mutex_unlock(&ov2311->mutex);
++	ret = v4l2_ctrl_handler_setup(&ov2311->ctrl_handler);
++	mutex_lock(&ov2311->mutex);
++	if (ret)
++		return ret;
++
++	return ov2311_write_reg(ov2311->client, OV2311_REG_CTRL_MODE,
++				OV2311_REG_VALUE_08BIT, OV2311_MODE_STREAMING);
++}
++
++static int ov2311_stop_stream(struct ov2311 *ov2311)
++{
++	return ov2311_write_reg(ov2311->client, OV2311_REG_CTRL_MODE,
++				OV2311_REG_VALUE_08BIT, OV2311_MODE_SW_STANDBY);
++}
++
++static int ov2311_s_stream(struct v4l2_subdev *sd, int enable)
++{
++	struct ov2311 *ov2311 = to_ov2311(sd);
++	struct i2c_client *client = ov2311->client;
++	int ret = 0;
++
++	mutex_lock(&ov2311->mutex);
++	if (ov2311->streaming == enable) {
++		mutex_unlock(&ov2311->mutex);
++		return 0;
++	}
++
++	if (enable) {
++		ret = pm_runtime_resume_and_get(&client->dev);
++		if (ret < 0)
++			goto unlock_and_return;
++
++		ret = ov2311_start_stream(ov2311);
++		if (ret) {
++			v4l2_err(sd, "start stream failed while write regs\n");
++			pm_runtime_put(&client->dev);
++			goto unlock_and_return;
++		}
++	} else {
++		ov2311_stop_stream(ov2311);
++		pm_runtime_put(&client->dev);
++	}
++
++	ov2311->streaming = enable;
++
++unlock_and_return:
++	mutex_unlock(&ov2311->mutex);
++
++	return ret;
++}
++
++static int ov2311_power_on(struct device *dev)
++{
++	struct v4l2_subdev *sd = dev_get_drvdata(dev);
++	struct ov2311 *ov2311 = to_ov2311(sd);
++	int ret;
++
++	ret = clk_set_rate(ov2311->xvclk, OV2311_XVCLK_FREQ);
++	if (ret < 0)
++		dev_warn(dev, "Failed to set xvclk rate (24MHz)\n");
++	if (clk_get_rate(ov2311->xvclk) != OV2311_XVCLK_FREQ)
++		dev_warn(dev, "xvclk mismatched, modes are based on 24MHz - rate is %lu\n",
++			 clk_get_rate(ov2311->xvclk));
++
++	ret = clk_prepare_enable(ov2311->xvclk);
++	if (ret < 0) {
++		dev_err(dev, "Failed to enable xvclk\n");
++		return ret;
++	}
++
++	gpiod_set_value_cansleep(ov2311->reset_gpio, 0);
++
++	ret = regulator_bulk_enable(OV2311_NUM_SUPPLIES, ov2311->supplies);
++	if (ret < 0) {
++		dev_err(dev, "Failed to enable regulators\n");
++		goto disable_clk;
++	}
++
++	gpiod_set_value_cansleep(ov2311->reset_gpio, 1);
++
++	usleep_range(500, 1000);
++	gpiod_set_value_cansleep(ov2311->pwdn_gpio, 1);
++
++	usleep_range(1000, 2000);
++
++	return 0;
++
++disable_clk:
++	clk_disable_unprepare(ov2311->xvclk);
++
++	return ret;
++}
++
++static int ov2311_power_off(struct device *dev)
++{
++	struct v4l2_subdev *sd = dev_get_drvdata(dev);
++	struct ov2311 *ov2311 = to_ov2311(sd);
++
++	gpiod_set_value_cansleep(ov2311->pwdn_gpio, 0);
++	clk_disable_unprepare(ov2311->xvclk);
++	gpiod_set_value_cansleep(ov2311->reset_gpio, 0);
++	regulator_bulk_disable(OV2311_NUM_SUPPLIES, ov2311->supplies);
++
++	return 0;
++}
++
++static int ov2311_runtime_resume(struct device *dev)
++{
++	struct v4l2_subdev *sd = dev_get_drvdata(dev);
++	struct ov2311 *ov2311 = to_ov2311(sd);
++	int ret;
++
++	if (ov2311->streaming) {
++		ret = ov2311_start_stream(ov2311);
++		if (ret)
++			goto error;
++	}
++	return 0;
++
++error:
++	ov2311_stop_stream(ov2311);
++	ov2311->streaming = 0;
++	return ret;
++}
++
++static int ov2311_runtime_suspend(struct device *dev)
++{
++	struct v4l2_subdev *sd = dev_get_drvdata(dev);
++	struct ov2311 *ov2311 = to_ov2311(sd);
++
++	if (ov2311->streaming)
++		ov2311_stop_stream(ov2311);
++
++	return 0;
++}
++
++static int ov2311_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
++{
++	struct ov2311 *ov2311 = to_ov2311(sd);
++	struct v4l2_mbus_framefmt *try_fmt =
++				v4l2_subdev_state_get_format(fh->state, 0);
++	const struct ov2311_mode *def_mode = &supported_modes[0];
++
++	mutex_lock(&ov2311->mutex);
++	/* Initialize try_fmt */
++	try_fmt->width = def_mode->width;
++	try_fmt->height = def_mode->height;
++	try_fmt->code = MEDIA_BUS_FMT_Y10_1X10;
++	try_fmt->field = V4L2_FIELD_NONE;
++	try_fmt->colorspace = V4L2_COLORSPACE_RAW;
++	try_fmt->ycbcr_enc = V4L2_MAP_YCBCR_ENC_DEFAULT(try_fmt->colorspace);
++	try_fmt->quantization =
++		V4L2_MAP_QUANTIZATION_DEFAULT(true, try_fmt->colorspace,
++					      try_fmt->ycbcr_enc);
++	try_fmt->xfer_func = V4L2_MAP_XFER_FUNC_DEFAULT(try_fmt->colorspace);
++
++	mutex_unlock(&ov2311->mutex);
++	/* No crop or compose */
++
++	return 0;
++}
++
++static const struct dev_pm_ops ov2311_pm_ops = {
++	SET_RUNTIME_PM_OPS(ov2311_runtime_suspend, ov2311_runtime_resume, NULL)
++	SET_RUNTIME_PM_OPS(ov2311_power_off, ov2311_power_on, NULL)
++};
++
++static const struct v4l2_subdev_internal_ops ov2311_internal_ops = {
++	.open = ov2311_open,
++};
++
++static const struct v4l2_subdev_core_ops ov2311_core_ops = {
++	.subscribe_event = v4l2_ctrl_subdev_subscribe_event,
++	.unsubscribe_event = v4l2_event_subdev_unsubscribe,
++};
++
++static const struct v4l2_subdev_video_ops ov2311_video_ops = {
++	.s_stream = ov2311_s_stream,
++};
++
++static const struct v4l2_subdev_pad_ops ov2311_pad_ops = {
++	.enum_mbus_code = ov2311_enum_mbus_code,
++	.enum_frame_size = ov2311_enum_frame_sizes,
++	.get_fmt = ov2311_get_fmt,
++	.set_fmt = ov2311_set_fmt,
++	.get_selection = ov2311_get_selection,
++};
++
++static const struct v4l2_subdev_ops ov2311_subdev_ops = {
++	.core	= &ov2311_core_ops,
++	.video	= &ov2311_video_ops,
++	.pad	= &ov2311_pad_ops,
++};
++
++static int ov2311_set_ctrl(struct v4l2_ctrl *ctrl)
++{
++	struct ov2311 *ov2311 = container_of(ctrl->handler,
++					     struct ov2311, ctrl_handler);
++	struct i2c_client *client = ov2311->client;
++	s64 max;
++	int ret = 0;
++
++	/* Propagate change of current control to all related controls */
++	switch (ctrl->id) {
++	case V4L2_CID_VBLANK:
++		/* Update max exposure while meeting expected vblanking */
++		max = ov2311->cur_mode->height + ctrl->val - 4;
++		__v4l2_ctrl_modify_range(ov2311->exposure,
++					 ov2311->exposure->minimum, max,
++					 ov2311->exposure->step,
++					 ov2311->exposure->default_value);
++		break;
++	}
++
++	if (pm_runtime_get(&client->dev) <= 0)
++		return 0;
++
++	switch (ctrl->id) {
++	case V4L2_CID_EXPOSURE:
++		ret = ov2311_write_reg(ov2311->client, OV2311_REG_EXPOSURE,
++				       OV2311_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_ANALOGUE_GAIN:
++		ret = ov2311_write_reg(ov2311->client, OV2311_REG_GAIN_H,
++				       OV2311_REG_VALUE_08BIT,
++				       (ctrl->val >> OV2311_GAIN_H_SHIFT) &
++							OV2311_GAIN_H_MASK);
++		ret |= ov2311_write_reg(ov2311->client, OV2311_REG_GAIN_L,
++				       OV2311_REG_VALUE_08BIT,
++				       ctrl->val & OV2311_GAIN_L_MASK);
++		break;
++	case V4L2_CID_VBLANK:
++		ret = ov2311_write_reg(ov2311->client, OV2311_REG_VTS,
++				       OV2311_REG_VALUE_16BIT,
++				       ctrl->val + ov2311->cur_mode->height);
++		break;
++	case V4L2_CID_TEST_PATTERN:
++		ret = ov2311_enable_test_pattern(ov2311, ctrl->val);
++		break;
++	case V4L2_CID_HFLIP:
++		ret = ov2311_write_reg(ov2311->client, OV2311_REG_H_FLIP,
++				       OV2311_REG_VALUE_08BIT,
++				       ctrl->val ? OV2311_FLIP_BIT : 0);
++		break;
++	case V4L2_CID_VFLIP:
++		ret = ov2311_write_reg(ov2311->client, OV2311_REG_V_FLIP,
++				       OV2311_REG_VALUE_08BIT,
++				       ctrl->val ? OV2311_FLIP_BIT : 0);
++		break;
++	default:
++		dev_warn(&client->dev, "%s Unhandled id:0x%x, val:0x%x\n",
++			 __func__, ctrl->id, ctrl->val);
++		break;
++	}
++
++	pm_runtime_put(&client->dev);
++
++	return ret;
++}
++
++static const struct v4l2_ctrl_ops ov2311_ctrl_ops = {
++	.s_ctrl = ov2311_set_ctrl,
++};
++
++static int ov2311_initialize_controls(struct ov2311 *ov2311)
++{
++	struct v4l2_fwnode_device_properties props;
++	const struct ov2311_mode *mode;
++	struct v4l2_ctrl_handler *handler;
++	struct v4l2_ctrl *ctrl;
++	s64 exposure_max, vblank_def;
++	u32 h_blank;
++	int ret;
++
++	handler = &ov2311->ctrl_handler;
++	mode = ov2311->cur_mode;
++	ret = v4l2_ctrl_handler_init(handler, 11);
++	if (ret)
++		return ret;
++	handler->lock = &ov2311->mutex;
++
++	ctrl = v4l2_ctrl_new_int_menu(handler, NULL, V4L2_CID_LINK_FREQ,
++				      0, 0, link_freq_menu_items);
++	if (ctrl)
++		ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++
++	ov2311->pixel_rate = v4l2_ctrl_new_std(handler, NULL,
++					       V4L2_CID_PIXEL_RATE,
++					       OV2311_PIXEL_RATE_10BIT,
++					       OV2311_PIXEL_RATE_10BIT, 1,
++					       OV2311_PIXEL_RATE_10BIT);
++
++	h_blank = mode->hts_def - mode->width;
++	ov2311->hblank = v4l2_ctrl_new_std(handler, NULL, V4L2_CID_HBLANK,
++					   h_blank, h_blank, 1, h_blank);
++	if (ov2311->hblank)
++		ov2311->hblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++
++	vblank_def = mode->vts_def - mode->height;
++	ov2311->vblank = v4l2_ctrl_new_std(handler, &ov2311_ctrl_ops,
++					   V4L2_CID_VBLANK, vblank_def,
++					   OV2311_VTS_MAX - mode->height, 1,
++					   vblank_def);
++
++	exposure_max = mode->vts_def - 4;
++	ov2311->exposure = v4l2_ctrl_new_std(handler, &ov2311_ctrl_ops,
++					     V4L2_CID_EXPOSURE,
++					     OV2311_EXPOSURE_MIN, exposure_max,
++					     OV2311_EXPOSURE_STEP,
++					     mode->exp_def);
++
++	v4l2_ctrl_new_std(handler, &ov2311_ctrl_ops, V4L2_CID_ANALOGUE_GAIN,
++			  OV2311_GAIN_MIN, OV2311_GAIN_MAX, OV2311_GAIN_STEP,
++			  OV2311_GAIN_DEFAULT);
++
++	v4l2_ctrl_new_std_menu_items(handler, &ov2311_ctrl_ops,
++				     V4L2_CID_TEST_PATTERN,
++				     ARRAY_SIZE(ov2311_test_pattern_menu) - 1,
++				     0, 0, ov2311_test_pattern_menu);
++
++	v4l2_ctrl_new_std(handler, &ov2311_ctrl_ops,
++			  V4L2_CID_HFLIP, 0, 1, 1, 0);
++
++	v4l2_ctrl_new_std(handler, &ov2311_ctrl_ops,
++			  V4L2_CID_VFLIP, 0, 1, 1, 0);
++
++	ret = v4l2_fwnode_device_parse(&ov2311->client->dev, &props);
++	if (ret)
++		goto err_free_handler;
++
++	ret = v4l2_ctrl_new_fwnode_properties(handler, &ov2311_ctrl_ops,
++					      &props);
++	if (ret)
++		goto err_free_handler;
++
++	if (handler->error) {
++		ret = handler->error;
++		dev_err(&ov2311->client->dev,
++			"Failed to init controls(%d)\n", ret);
++		goto err_free_handler;
++	}
++
++	ov2311->subdev.ctrl_handler = handler;
++
++	return 0;
++
++err_free_handler:
++	v4l2_ctrl_handler_free(handler);
++
++	return ret;
++}
++
++static int ov2311_check_sensor_id(struct ov2311 *ov2311,
++				  struct i2c_client *client)
++{
++	struct device *dev = &ov2311->client->dev;
++	u32 id = 0, id_msb = 0;
++	int ret;
++
++	ret = ov2311_read_reg(client, OV2311_REG_CHIP_ID + 1,
++			      OV2311_REG_VALUE_08BIT, &id);
++	if (!ret)
++		ret = ov2311_read_reg(client, OV2311_REG_CHIP_ID,
++				      OV2311_REG_VALUE_08BIT, &id_msb);
++	id |= (id_msb << 8);
++	if (ret || id != CHIP_ID) {
++		dev_err(dev, "Unexpected sensor id(%04x), ret(%d)\n", id, ret);
++		return -ENODEV;
++	}
++
++	dev_info(dev, "Detected OV%06x sensor\n", CHIP_ID);
++
++	return 0;
++}
++
++static int ov2311_configure_regulators(struct ov2311 *ov2311)
++{
++	unsigned int i;
++
++	for (i = 0; i < OV2311_NUM_SUPPLIES; i++)
++		ov2311->supplies[i].supply = ov2311_supply_names[i];
++
++	return devm_regulator_bulk_get(&ov2311->client->dev,
++				       OV2311_NUM_SUPPLIES,
++				       ov2311->supplies);
++}
++
++static int ov2311_probe(struct i2c_client *client)
++{
++	struct device *dev = &client->dev;
++	struct ov2311 *ov2311;
++	struct v4l2_subdev *sd;
++	int ret;
++
++	ov2311 = devm_kzalloc(dev, sizeof(*ov2311), GFP_KERNEL);
++	if (!ov2311)
++		return -ENOMEM;
++
++	ov2311->client = client;
++	ov2311->cur_mode = &supported_modes[0];
++
++	ov2311->xvclk = devm_clk_get(dev, "xvclk");
++	if (IS_ERR(ov2311->xvclk)) {
++		dev_err(dev, "Failed to get xvclk\n");
++		return -EINVAL;
++	}
++
++	ov2311->reset_gpio = devm_gpiod_get_optional(dev, "reset",
++						     GPIOD_OUT_LOW);
++	if (IS_ERR(ov2311->reset_gpio))
++		dev_warn(dev, "Failed to get reset-gpios\n");
++
++	ov2311->pwdn_gpio = devm_gpiod_get_optional(dev, "pwdn", GPIOD_OUT_LOW);
++	if (IS_ERR(ov2311->pwdn_gpio))
++		dev_warn(dev, "Failed to get pwdn-gpios\n");
++
++	ret = ov2311_configure_regulators(ov2311);
++	if (ret) {
++		dev_err(dev, "Failed to get power regulators\n");
++		return ret;
++	}
++
++	mutex_init(&ov2311->mutex);
++
++	sd = &ov2311->subdev;
++	v4l2_i2c_subdev_init(sd, client, &ov2311_subdev_ops);
++	ret = ov2311_initialize_controls(ov2311);
++	if (ret)
++		goto err_destroy_mutex;
++
++	ret = ov2311_power_on(&client->dev);
++	if (ret)
++		goto err_free_handler;
++
++	ret = ov2311_check_sensor_id(ov2311, client);
++	if (ret)
++		goto err_power_off;
++
++	sd->internal_ops = &ov2311_internal_ops;
++	sd->flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
++
++	ov2311->pad.flags = MEDIA_PAD_FL_SOURCE;
++	sd->entity.function = MEDIA_ENT_F_CAM_SENSOR;
++	ret = media_entity_pads_init(&sd->entity, 1, &ov2311->pad);
++	if (ret < 0)
++		goto err_power_off;
++
++	ret = v4l2_async_register_subdev(sd);
++	if (ret) {
++		dev_err(dev, "v4l2 async register subdev failed\n");
++		goto err_clean_entity;
++	}
++
++	pm_runtime_set_active(dev);
++	pm_runtime_enable(dev);
++	pm_runtime_idle(dev);
++
++	return 0;
++
++err_clean_entity:
++	media_entity_cleanup(&sd->entity);
++err_power_off:
++	ov2311_power_off(&client->dev);
++err_free_handler:
++	v4l2_ctrl_handler_free(&ov2311->ctrl_handler);
++err_destroy_mutex:
++	mutex_destroy(&ov2311->mutex);
++
++	return ret;
++}
++
++static void ov2311_remove(struct i2c_client *client)
++{
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct ov2311 *ov2311 = to_ov2311(sd);
++
++	v4l2_async_unregister_subdev(sd);
++	media_entity_cleanup(&sd->entity);
++	v4l2_ctrl_handler_free(&ov2311->ctrl_handler);
++	mutex_destroy(&ov2311->mutex);
++
++	pm_runtime_disable(&client->dev);
++	if (!pm_runtime_status_suspended(&client->dev))
++		ov2311_power_off(&client->dev);
++	pm_runtime_set_suspended(&client->dev);
++}
++
++static const struct of_device_id ov2311_of_match[] = {
++	{ .compatible = "ovti,ov2311" },
++	{},
++};
++MODULE_DEVICE_TABLE(of, ov2311_of_match);
++
++static const struct i2c_device_id ov2311_match_id[] = {
++	{ "ovti,ov2311", 0 },
++	{ },
++};
++
++static struct i2c_driver ov2311_i2c_driver = {
++	.driver = {
++		.name = OV2311_NAME,
++		.pm = &ov2311_pm_ops,
++		.of_match_table = of_match_ptr(ov2311_of_match),
++	},
++	.probe		= &ov2311_probe,
++	.remove		= &ov2311_remove,
++	.id_table	= ov2311_match_id,
++};
++
++module_i2c_driver(ov2311_i2c_driver);
++
++MODULE_AUTHOR("Dave Stevenson <dave.stevenson@raspberrypi.com");
++MODULE_DESCRIPTION("OmniVision OV2311 sensor driver");
++MODULE_LICENSE("GPL v2");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0275-dt-bindings-media-i2c-Add-binding-for-ad5398-VCM.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0275-dt-bindings-media-i2c-Add-binding-for-ad5398-VCM.patch
new file mode 100644
index 00000000..4b3e7bbb
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0275-dt-bindings-media-i2c-Add-binding-for-ad5398-VCM.patch
@@ -0,0 +1,39 @@
+From d21ee00b14e10b155d4388f78e7cf43a8272994e Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 29 Sep 2021 12:33:35 +0100
+Subject: [PATCH 275/697] dt-bindings: media: i2c: Add binding for ad5398 VCM
+
+Add a binding for Analog Devices AD5398 10bit current
+sinking DAC when used as a lens VCM driver.
+
+FIXME: Convert to YAML
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../devicetree/bindings/media/i2c/ad5398.txt  | 20 +++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/media/i2c/ad5398.txt
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/i2c/ad5398.txt
+@@ -0,0 +1,20 @@
++* Analog Devices AD5398 autofocus coil
++
++Required Properties:
++
++  - compatible: Must contain one of:
++		- "adi,ad5398"
++
++  - reg: I2C slave address
++
++  - VANA-supply: supply of voltage for VANA pin
++
++Example:
++
++       ad5398: coil@c {
++               compatible = "adi,ad5398";
++               reg = <0x0c>;
++
++               VANA-supply = <&vaux4>;
++       };
++
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0276-media-i2c-Add-driver-for-AD5398-VCM-lens-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0276-media-i2c-Add-driver-for-AD5398-VCM-lens-driver.patch
new file mode 100644
index 00000000..ce39a5a2
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0276-media-i2c-Add-driver-for-AD5398-VCM-lens-driver.patch
@@ -0,0 +1,396 @@
+From a47d6cbfe7d355b08d0e2299074dfeb9c88fadd4 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 29 Sep 2021 14:04:28 +0100
+Subject: [PATCH 276/697] media: i2c: Add driver for AD5398 VCM lens driver
+
+Adds a driver for the Analog Devices AD5398 10 bit
+I2C DAC which is commonly used for driving VCM lens
+mechanisms.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: i2c: Rename ad5398 to ad5398_vcm
+
+There's already a regulator module called ad5398 that exposes
+this device through the regulator API. That is meaningless in
+the terms that it uses and how it maps to V4L2, so a new driver
+was added. However the module name collision wasn't noted, so
+rename it now.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/Kconfig      |   7 +
+ drivers/media/i2c/Makefile     |   1 +
+ drivers/media/i2c/ad5398_vcm.c | 340 +++++++++++++++++++++++++++++++++
+ 3 files changed, 348 insertions(+)
+ create mode 100644 drivers/media/i2c/ad5398_vcm.c
+
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -745,6 +745,13 @@ endmenu
+ menu "Lens drivers"
+ 	visible if MEDIA_CAMERA_SUPPORT
+ 
++config VIDEO_AD5398
++	tristate "AD5398 lens voice coil support"
++	depends on GPIOLIB && I2C && VIDEO_DEV
++	select MEDIA_CONTROLLER
++	help
++	  This is a driver for the AD5398 camera lens voice coil.
++
+ config VIDEO_AD5820
+ 	tristate "AD5820 lens voice coil support"
+ 	depends on GPIOLIB && I2C && VIDEO_DEV
+--- a/drivers/media/i2c/Makefile
++++ b/drivers/media/i2c/Makefile
+@@ -3,6 +3,7 @@
+ msp3400-objs	:=	msp3400-driver.o msp3400-kthreads.o
+ 
+ obj-$(CONFIG_SDR_MAX2175) += max2175.o
++obj-$(CONFIG_VIDEO_AD5398) += ad5398_vcm.o
+ obj-$(CONFIG_VIDEO_AD5820) += ad5820.o
+ obj-$(CONFIG_VIDEO_ADP1653) += adp1653.o
+ obj-$(CONFIG_VIDEO_ADV7170) += adv7170.o
+--- /dev/null
++++ b/drivers/media/i2c/ad5398_vcm.c
+@@ -0,0 +1,340 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * AD5398 DAC driver for camera voice coil focus.
++ * Copyright (C) 2021 Raspberry Pi (Trading) Ltd.
++ *
++ * Based on AD5820 DAC driver by Nokia and TI.
++ *
++ * This driver uses the regulator framework notification hooks on the
++ * assumption that the VCM and sensor share a regulator. This means the VCM
++ * position will be restored when either the sensor or VCM subdevices are opened
++ * or powered up. The client can therefore choose to ignore the VCM subdevice,
++ * and the lens position will be as previously requested. Without that, there
++ * is a hard requirement to have the VCM subdevice open in order for the VCM
++ * to be powered and at the requested position.
++ */
++
++#include <linux/errno.h>
++#include <linux/i2c.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/regulator/consumer.h>
++#include <linux/gpio/consumer.h>
++
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-subdev.h>
++
++/* Register definitions */
++#define AD5398_POWER_DOWN		BIT(15)
++#define AD5398_DAC_SHIFT		4
++
++#define to_ad5398_device(sd)	container_of(sd, struct ad5398_device, subdev)
++
++struct ad5398_device {
++	struct v4l2_subdev subdev;
++	struct ad5398_platform_data *platform_data;
++	struct regulator *vana;
++	struct notifier_block nb;
++
++	struct v4l2_ctrl_handler ctrls;
++	u32 focus_absolute;
++
++	bool standby;
++};
++
++static int ad5398_write(struct ad5398_device *coil, u16 data)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&coil->subdev);
++	struct i2c_msg msg;
++	__be16 be_data;
++	int r;
++
++	if (!client->adapter)
++		return -ENODEV;
++
++	be_data = cpu_to_be16(data);
++	msg.addr  = client->addr;
++	msg.flags = 0;
++	msg.len   = 2;
++	msg.buf   = (u8 *)&be_data;
++
++	r = i2c_transfer(client->adapter, &msg, 1);
++	if (r < 0) {
++		dev_err(&client->dev, "write failed, error %d\n", r);
++		return r;
++	}
++
++	return 0;
++}
++
++/*
++ * Calculate status word and write it to the device based on current
++ * values of V4L2 controls. It is assumed that the stored V4L2 control
++ * values are properly limited and rounded.
++ */
++static int ad5398_update_hw(struct ad5398_device *coil)
++{
++	u16 status;
++
++	status = coil->focus_absolute << AD5398_DAC_SHIFT;
++
++	if (coil->standby)
++		status |= AD5398_POWER_DOWN;
++
++	return ad5398_write(coil, status);
++}
++
++/*
++ * Power handling
++ */
++static int ad5398_power_off(struct ad5398_device *coil)
++{
++	int ret = 0;
++
++	coil->standby = true;
++	ret = ad5398_update_hw(coil);
++
++	return ret;
++}
++
++static int ad5398_power_on(struct ad5398_device *coil)
++{
++	int ret;
++
++	/* Restore the hardware settings. */
++	coil->standby = false;
++	ret = ad5398_update_hw(coil);
++	if (ret)
++		goto fail;
++
++	return 0;
++
++fail:
++	coil->standby = true;
++
++	return ret;
++}
++
++/*
++ * V4L2 controls
++ */
++static int ad5398_set_ctrl(struct v4l2_ctrl *ctrl)
++{
++	struct ad5398_device *coil =
++		container_of(ctrl->handler, struct ad5398_device, ctrls);
++
++	switch (ctrl->id) {
++	case V4L2_CID_FOCUS_ABSOLUTE:
++		coil->focus_absolute = ctrl->val;
++		return ad5398_update_hw(coil);
++	}
++
++	return 0;
++}
++
++static const struct v4l2_ctrl_ops ad5398_ctrl_ops = {
++	.s_ctrl = ad5398_set_ctrl,
++};
++
++static int ad5398_init_controls(struct ad5398_device *coil)
++{
++	v4l2_ctrl_handler_init(&coil->ctrls, 1);
++
++	/*
++	 * V4L2_CID_FOCUS_ABSOLUTE
++	 *
++	 * Minimum current is 0 mA, maximum is 120 mA. Thus, 1 code is
++	 * equivalent to 120/1023 = 0.1173 mA. Nevertheless, we do not use [mA]
++	 * for focus position, because it is meaningless for user. Meaningful
++	 * would be to use focus distance or even its inverse, but since the
++	 * driver doesn't have sufficient knowledge to do the conversion, we
++	 * will just use abstract codes here. In any case, smaller value = focus
++	 * position farther from camera. The default zero value means focus at
++	 * infinity, and also least current consumption.
++	 */
++	v4l2_ctrl_new_std(&coil->ctrls, &ad5398_ctrl_ops,
++			  V4L2_CID_FOCUS_ABSOLUTE, 0, 1023, 1, 0);
++
++	if (coil->ctrls.error)
++		return coil->ctrls.error;
++
++	coil->focus_absolute = 0;
++
++	coil->subdev.ctrl_handler = &coil->ctrls;
++
++	return 0;
++}
++
++/*
++ * V4L2 subdev operations
++ */
++static int ad5398_registered(struct v4l2_subdev *subdev)
++{
++	struct ad5398_device *coil = to_ad5398_device(subdev);
++
++	return ad5398_init_controls(coil);
++}
++
++static int
++ad5398_set_power(struct v4l2_subdev *subdev, int on)
++{
++	struct ad5398_device *coil = to_ad5398_device(subdev);
++	int ret;
++
++	if (on)
++		ret = regulator_enable(coil->vana);
++	else
++		ret = regulator_disable(coil->vana);
++
++	return ret;
++}
++
++static int ad5398_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
++{
++	struct ad5398_device *coil = to_ad5398_device(sd);
++
++	return regulator_enable(coil->vana);
++}
++
++static int ad5398_close(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
++{
++	struct ad5398_device *coil = to_ad5398_device(sd);
++
++	return regulator_disable(coil->vana);
++}
++
++static const struct v4l2_subdev_core_ops ad5398_core_ops = {
++	.s_power = ad5398_set_power,
++};
++
++static const struct v4l2_subdev_ops ad5398_ops = {
++	.core = &ad5398_core_ops,
++};
++
++static const struct v4l2_subdev_internal_ops ad5398_internal_ops = {
++	.registered = ad5398_registered,
++	.open = ad5398_open,
++	.close = ad5398_close,
++};
++
++/*
++ * I2C driver
++ */
++static int __maybe_unused ad5398_suspend(struct device *dev)
++{
++	struct i2c_client *client = container_of(dev, struct i2c_client, dev);
++	struct v4l2_subdev *subdev = i2c_get_clientdata(client);
++	struct ad5398_device *coil = to_ad5398_device(subdev);
++
++	return regulator_enable(coil->vana);
++}
++
++static int __maybe_unused ad5398_resume(struct device *dev)
++{
++	struct i2c_client *client = container_of(dev, struct i2c_client, dev);
++	struct v4l2_subdev *subdev = i2c_get_clientdata(client);
++	struct ad5398_device *coil = to_ad5398_device(subdev);
++
++	return regulator_disable(coil->vana);
++}
++
++static int ad5398_regulator_notifier(struct notifier_block *nb,
++				     unsigned long event,
++				     void *ignored)
++{
++	struct ad5398_device *coil = container_of(nb, struct ad5398_device, nb);
++
++	if (event == REGULATOR_EVENT_ENABLE)
++		ad5398_power_on(coil);
++	else if (event == REGULATOR_EVENT_PRE_DISABLE)
++		ad5398_power_off(coil);
++
++	return NOTIFY_OK;
++}
++
++static int ad5398_probe(struct i2c_client *client)
++{
++	struct ad5398_device *coil;
++	int ret;
++
++	coil = devm_kzalloc(&client->dev, sizeof(*coil), GFP_KERNEL);
++	if (!coil)
++		return -ENOMEM;
++
++	coil->vana = devm_regulator_get(&client->dev, "VANA");
++	if (IS_ERR(coil->vana)) {
++		ret = PTR_ERR(coil->vana);
++		if (ret != -EPROBE_DEFER)
++			dev_err(&client->dev, "could not get regulator for vana\n");
++		return ret;
++	}
++
++	v4l2_i2c_subdev_init(&coil->subdev, client, &ad5398_ops);
++	coil->subdev.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
++	coil->subdev.internal_ops = &ad5398_internal_ops;
++	coil->subdev.entity.function = MEDIA_ENT_F_LENS;
++	strscpy(coil->subdev.name, "ad5398 focus", sizeof(coil->subdev.name));
++
++	coil->nb.notifier_call = &ad5398_regulator_notifier;
++	ret = regulator_register_notifier(coil->vana, &coil->nb);
++	if (ret < 0)
++		return ret;
++
++	ret = media_entity_pads_init(&coil->subdev.entity, 0, NULL);
++	if (ret < 0)
++		goto cleanup2;
++
++	ret = v4l2_async_register_subdev(&coil->subdev);
++	if (ret < 0)
++		goto cleanup;
++
++	return ret;
++
++cleanup:
++	media_entity_cleanup(&coil->subdev.entity);
++cleanup2:
++	regulator_unregister_notifier(coil->vana, &coil->nb);
++	return ret;
++}
++
++static void ad5398_remove(struct i2c_client *client)
++{
++	struct v4l2_subdev *subdev = i2c_get_clientdata(client);
++	struct ad5398_device *coil = to_ad5398_device(subdev);
++
++	v4l2_async_unregister_subdev(&coil->subdev);
++	v4l2_ctrl_handler_free(&coil->ctrls);
++	media_entity_cleanup(&coil->subdev.entity);
++}
++
++static const struct i2c_device_id ad5398_id_table[] = {
++	{ "ad5398", 0 },
++	{ }
++};
++MODULE_DEVICE_TABLE(i2c, ad5398_id_table);
++
++static const struct of_device_id ad5398_of_table[] = {
++	{ .compatible = "adi,ad5398" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, ad5398_of_table);
++
++static SIMPLE_DEV_PM_OPS(ad5398_pm, ad5398_suspend, ad5398_resume);
++
++static struct i2c_driver ad5398_i2c_driver = {
++	.driver		= {
++		.name	= "ad5398",
++		.pm	= &ad5398_pm,
++		.of_match_table = ad5398_of_table,
++	},
++	.probe		= ad5398_probe,
++	.remove		= ad5398_remove,
++	.id_table	= ad5398_id_table,
++};
++
++module_i2c_driver(ad5398_i2c_driver);
++
++MODULE_AUTHOR("Dave Stevenson <dave.stevenson@raspberrypi.com>");
++MODULE_DESCRIPTION("AD5398 camera lens driver");
++MODULE_LICENSE("GPL");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0277-media-i2c-ov5647-Use-v4l2_async_register_subdev_sens.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0277-media-i2c-ov5647-Use-v4l2_async_register_subdev_sens.patch
new file mode 100644
index 00000000..cb7a9dfc
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0277-media-i2c-ov5647-Use-v4l2_async_register_subdev_sens.patch
@@ -0,0 +1,26 @@
+From efbc9681590452d200059be54d0a18c4b80682e2 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 16 Mar 2022 12:15:41 +0000
+Subject: [PATCH 277/697] media: i2c: ov5647: Use
+ v4l2_async_register_subdev_sensor for lens binding
+
+v4l2_async_register_subdev doesn't bind in lens or flash drivers,
+but v4l2_async_register_subdev_sensor does.
+Switch to using v4l2_async_register_subdev_sensor.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/ov5647.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/ov5647.c
++++ b/drivers/media/i2c/ov5647.c
+@@ -1566,7 +1566,7 @@ static int ov5647_probe(struct i2c_clien
+ 	if (ret < 0)
+ 		goto power_off;
+ 
+-	ret = v4l2_async_register_subdev(sd);
++	ret = v4l2_async_register_subdev_sensor(sd);
+ 	if (ret < 0)
+ 		goto power_off;
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0278-mm-page_alloc-cma-introduce-a-customisable-threshold.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0278-mm-page_alloc-cma-introduce-a-customisable-threshold.patch
new file mode 100644
index 00000000..97f24a94
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0278-mm-page_alloc-cma-introduce-a-customisable-threshold.patch
@@ -0,0 +1,67 @@
+From d2c8004ece45fcaa34ae36b8e2f7918e6f0c804d Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.com>
+Date: Tue, 29 Mar 2022 16:10:06 +0100
+Subject: [PATCH 278/697] mm,page_alloc,cma: introduce a customisable threshold
+ for allocating pages in cma
+
+On some platforms the cma area can be half the entire system memory,
+meaning that allocations start happening in the cma area immediately.
+This leads to fragmentation and subsequent fatal cma_alloc failures.
+
+We introduce an "alloc_in_cma_threshold" parameter which requires that
+this many sixteenths of the free pages must be in cma before it will
+try to use them. By default this is set to 12, but the previous
+behaviour can be restored by setting it to 8 on startup.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ mm/page_alloc.c | 28 +++++++++++++++++++++++++---
+ 1 file changed, 25 insertions(+), 3 deletions(-)
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -207,6 +207,27 @@ EXPORT_SYMBOL(node_states);
+ 
+ gfp_t gfp_allowed_mask __read_mostly = GFP_BOOT_MASK;
+ 
++#define ALLOC_IN_CMA_THRESHOLD_MAX 16
++#define ALLOC_IN_CMA_THRESHOLD_DEFAULT 12
++
++static unsigned long _alloc_in_cma_threshold __read_mostly
++				= ALLOC_IN_CMA_THRESHOLD_DEFAULT;
++
++static int __init alloc_in_cma_threshold_setup(char *buf)
++{
++	unsigned long res;
++
++	if (kstrtoul(buf, 10, &res) < 0 ||
++	    res > ALLOC_IN_CMA_THRESHOLD_MAX) {
++		pr_err("Bad alloc_cma_threshold value\n");
++		return 0;
++	}
++	_alloc_in_cma_threshold = res;
++	pr_info("Setting alloc_in_cma_threshold to %lu\n", res);
++	return 0;
++}
++early_param("alloc_in_cma_threshold", alloc_in_cma_threshold_setup);
++
+ #ifdef CONFIG_HUGETLB_PAGE_SIZE_VARIABLE
+ unsigned int pageblock_order __read_mostly;
+ #endif
+@@ -2268,12 +2289,13 @@ __rmqueue(struct zone *zone, unsigned in
+ 	if (IS_ENABLED(CONFIG_CMA)) {
+ 		/*
+ 		 * Balance movable allocations between regular and CMA areas by
+-		 * allocating from CMA when over half of the zone's free memory
+-		 * is in the CMA area.
++		 * allocating from CMA when over more than a given proportion of
++		 * the zone's free memory is in the CMA area.
+ 		 */
+ 		if (alloc_flags & ALLOC_CMA &&
+ 		    zone_page_state(zone, NR_FREE_CMA_PAGES) >
+-		    zone_page_state(zone, NR_FREE_PAGES) / 2) {
++		    zone_page_state(zone, NR_FREE_PAGES) / ALLOC_IN_CMA_THRESHOLD_MAX
++		    * _alloc_in_cma_threshold) {
+ 			page = __rmqueue_cma_fallback(zone, order);
+ 			if (page)
+ 				return page;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0279-tpm_tis_spi_main-Force-probe-routine-to-run-synchron.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0279-tpm_tis_spi_main-Force-probe-routine-to-run-synchron.patch
new file mode 100644
index 00000000..aeff7a6e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0279-tpm_tis_spi_main-Force-probe-routine-to-run-synchron.patch
@@ -0,0 +1,28 @@
+From 06740c2bf7827990306d2979bdaadad96c74b42c Mon Sep 17 00:00:00 2001
+From: Scovotto Davide <scovottodavide@gmail.com>
+Date: Wed, 20 Apr 2022 17:22:17 +0200
+Subject: [PATCH 279/697] tpm_tis_spi_main: Force probe routine to run
+ synchronously with driver and device registration when IMA is enabled
+
+Co-authored-by: Alberto Solavagione <albertosolavagione30@gmail.com>
+Co-developed-by: Alberto Solavagione <albertosolavagione30@gmail.com>
+Signed-off-by: Alberto Solavagione <albertosolavagione30@gmail.com>
+Signed-off-by: Davide Scovotto <scovottodavide@gmail.com>
+---
+ drivers/char/tpm/tpm_tis_spi_main.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/char/tpm/tpm_tis_spi_main.c
++++ b/drivers/char/tpm/tpm_tis_spi_main.c
+@@ -350,7 +350,11 @@ static struct spi_driver tpm_tis_spi_dri
+ 		.pm = &tpm_tis_pm,
+ 		.of_match_table = of_match_ptr(of_tis_spi_match),
+ 		.acpi_match_table = ACPI_PTR(acpi_tis_spi_match),
++#ifdef CONFIG_IMA
++		.probe_type = PROBE_FORCE_SYNCHRONOUS,
++#else
+ 		.probe_type = PROBE_PREFER_ASYNCHRONOUS,
++#endif
+ 	},
+ 	.probe = tpm_tis_spi_driver_probe,
+ 	.remove = tpm_tis_spi_remove,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0280-dt-bindings-vendor-prefixes-Add-Arducam.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0280-dt-bindings-vendor-prefixes-Add-Arducam.patch
new file mode 100644
index 00000000..73892d85
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0280-dt-bindings-vendor-prefixes-Add-Arducam.patch
@@ -0,0 +1,23 @@
+From 9c6b1a19c25a516632cb196f999564b8766db95a Mon Sep 17 00:00:00 2001
+From: Lee Jackson <info@arducam.com>
+Date: Thu, 21 Apr 2022 14:14:29 +0800
+Subject: [PATCH 280/697] dt-bindings: vendor-prefixes: Add Arducam
+
+Add vendor prefix for Arducam (https://arducam.com).
+
+Signed-off-by: Lee Jackson <info@arducam.com>
+---
+ Documentation/devicetree/bindings/vendor-prefixes.yaml | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/Documentation/devicetree/bindings/vendor-prefixes.yaml
++++ b/Documentation/devicetree/bindings/vendor-prefixes.yaml
+@@ -147,6 +147,8 @@ patternProperties:
+     description: arcx Inc. / Archronix Inc.
+   "^aries,.*":
+     description: Aries Embedded GmbH
++  "^arducam,.*":
++    description: Arducam Technology co., Ltd.
+   "^arm,.*":
+     description: ARM Ltd.
+   "^armadeus,.*":
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0281-media-dt-bindings-media-i2c-Add-Arducam-Pivariety-Se.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0281-media-dt-bindings-media-i2c-Add-Arducam-Pivariety-Se.patch
new file mode 100644
index 00000000..c360933c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0281-media-dt-bindings-media-i2c-Add-Arducam-Pivariety-Se.patch
@@ -0,0 +1,148 @@
+From d0b88bb0a92b5a0fc6f367ec13a670a96f420aed Mon Sep 17 00:00:00 2001
+From: Lee Jackson <info@arducam.com>
+Date: Thu, 21 Apr 2022 14:18:44 +0800
+Subject: [PATCH 281/697] media: dt-bindings: media: i2c: Add Arducam Pivariety
+ Series CMOS sensor binding
+
+Add YAML device tree binding for Arducam Pivariety CMOS image sensor, and
+the relevant MAINTAINERS entries.
+
+Signed-off-by: Lee Jackson <info@arducam.com>
+---
+ .../bindings/media/i2c/arducam-pivariety.yaml | 112 ++++++++++++++++++
+ MAINTAINERS                                   |   8 ++
+ 2 files changed, 120 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/media/i2c/arducam-pivariety.yaml
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/i2c/arducam-pivariety.yaml
+@@ -0,0 +1,112 @@
++# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/media/i2c/arducam-pivariety.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Arducam Pivariety Series CMOS Digital Image Sensor
++
++maintainers:
++  - Lee Jackson <info@arducam.com>
++
++description: |-
++  Arducam Pivariety series cameras make compatibility layers for various CMOS
++  sensors and provide a unified command interface. It is programmable through
++  I2C interface. The I2C address is fixed to 0x0C. Image data is sent through
++  MIPI CSI-2, which is configured as either 1, 2 or 4 data lanes.
++
++properties:
++  compatible:
++    const: arducam,arducam-pivariety
++
++  reg:
++    description: I2C device address
++    maxItems: 1
++
++  clocks:
++    maxItems: 1
++
++  VDIG-supply:
++    description:
++      Digital I/O voltage supply, 1.05 volts
++
++  VANA-supply:
++    description:
++      Analog voltage supply, 2.8 volts
++
++  VDDL-supply:
++    description:
++      Digital core voltage supply, 1.8 volts
++
++  reset-gpios:
++    description: |-
++      Reference to the GPIO connected to the xclr pin, if any.
++      Must be released (set high) after all supplies and INCK are applied.
++
++  # See ../video-interfaces.txt for more details
++  port:
++    type: object
++    properties:
++      endpoint:
++        type: object
++        properties:
++          data-lanes:
++            description: |-
++              The sensor supports either two-lane, or four-lane operation.
++              For two-lane operation the property must be set to <1 2>.
++            items:
++              - const: 1
++              - const: 2
++
++          clock-noncontinuous:
++            type: boolean
++            description: |-
++              MIPI CSI-2 clock is non-continuous if this property is present,
++              otherwise it's continuous.
++
++          link-frequencies:
++            allOf:
++              - $ref: /schemas/types.yaml#/definitions/uint64-array
++            description:
++              Allowed data bus frequencies.
++
++        required:
++          - link-frequencies
++
++required:
++  - compatible
++  - reg
++  - clocks
++  - VANA-supply
++  - VDIG-supply
++  - VDDL-supply
++  - port
++
++additionalProperties: false
++
++examples:
++  - |
++    i2c0 {
++        #address-cells = <1>;
++        #size-cells = <0>;
++
++        arducam_pivariety: sensor@0c {
++            compatible = "arducam,arducam-pivariety";
++            reg = <0x0c>;
++            clocks = <&arducam_pivariety_clk>;
++            VANA-supply = <&arducam_pivariety_vana>;   /* 2.8v */
++            VDIG-supply = <&arducam_pivariety_vdig>;   /* 1.05v */
++            VDDL-supply = <&arducam_pivariety_vddl>;   /* 1.8v */
++
++            port {
++                arducam_pivariety_0: endpoint {
++                    remote-endpoint = <&csi1_ep>;
++                    data-lanes = <1 2>;
++                    clock-noncontinuous;
++                    link-frequencies = /bits/ 64 <493500000>;
++                };
++            };
++        };
++    };
++
++...
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -1752,6 +1752,14 @@ S:	Maintained
+ F:	drivers/net/arcnet/
+ F:	include/uapi/linux/if_arcnet.h
+ 
++ARDUCAM PIVARIETY SENSOR DRIVER
++M:	Arducam Kernel Maintenance <info@arducam.com>
++L:	linux-media@vger.kernel.org
++S:	Maintained
++T:	git git://linuxtv.org/media_tree.git
++F:	Documentation/devicetree/bindings/media/i2c/arducam-pivariety.yaml
++F:	drivers/media/i2c/arducam-pivariety.c
++
+ ARM AND ARM64 SoC SUB-ARCHITECTURES (COMMON PARTS)
+ M:	Arnd Bergmann <arnd@arndb.de>
+ M:	Olof Johansson <olof@lixom.net>
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0282-media-i2c-Add-driver-of-Arducam-Pivariety-series-cam.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0282-media-i2c-Add-driver-of-Arducam-Pivariety-series-cam.patch
new file mode 100644
index 00000000..045efb20
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0282-media-i2c-Add-driver-of-Arducam-Pivariety-series-cam.patch
@@ -0,0 +1,1649 @@
+From 43892d7ec1775208cfcce55d0193156b11ec527b Mon Sep 17 00:00:00 2001
+From: Lee Jackson <info@arducam.com>
+Date: Thu, 14 Apr 2022 17:31:01 +0800
+Subject: [PATCH 282/697] media: i2c: Add driver of Arducam Pivariety series
+ camera
+
+Add a driver for the Arducam Pivariety series CSI2 camera sensor.
+
+Signed-off-by: Lee Jackson <info@arducam.com>
+
+SQUASH: Fix VIDEO_ARDUCAM_PIVARIETY Kconfig entry
+
+The cherry-pick from rpi-5.17.y put it in the wrong section, and failed
+to update it for 5.18.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+media: i2c: arducam-pivariety: Add custom controls
+
+Add support for strobe_shift, strobe_width and mode custom controls.
+
+Signed-off-by: Lee Jackson <info@arducam.com>
+---
+ drivers/media/i2c/Kconfig             |   11 +
+ drivers/media/i2c/Makefile            |    1 +
+ drivers/media/i2c/arducam-pivariety.c | 1472 +++++++++++++++++++++++++
+ drivers/media/i2c/arducam-pivariety.h |  110 ++
+ 4 files changed, 1594 insertions(+)
+ create mode 100644 drivers/media/i2c/arducam-pivariety.c
+ create mode 100644 drivers/media/i2c/arducam-pivariety.h
+
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -100,6 +100,17 @@ config VIDEO_GC2145
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called gc2145.
+ 
++config VIDEO_ARDUCAM_PIVARIETY
++	tristate "Arducam Pivariety sensor support"
++	depends on I2C && VIDEO_DEV
++	select VIDEO_V4L2_SUBDEV_API
++	help
++	  This is a Video4Linux2 sensor driver for the Arducam
++	  Pivariety camera series.
++
++	  To compile this driver as a module, choose M here: the
++	  module will be called arducam-pivariety.
++
+ config VIDEO_HI556
+ 	tristate "Hynix Hi-556 sensor support"
+ 	help
+--- a/drivers/media/i2c/Makefile
++++ b/drivers/media/i2c/Makefile
+@@ -21,6 +21,7 @@ obj-$(CONFIG_VIDEO_AK881X) += ak881x.o
+ obj-$(CONFIG_VIDEO_ALVIUM_CSI2) += alvium-csi2.o
+ obj-$(CONFIG_VIDEO_APTINA_PLL) += aptina-pll.o
+ obj-$(CONFIG_VIDEO_AR0521) += ar0521.o
++obj-$(CONFIG_VIDEO_ARDUCAM_PIVARIETY) += arducam-pivariety.o
+ obj-$(CONFIG_VIDEO_BT819) += bt819.o
+ obj-$(CONFIG_VIDEO_BT856) += bt856.o
+ obj-$(CONFIG_VIDEO_BT866) += bt866.o
+--- /dev/null
++++ b/drivers/media/i2c/arducam-pivariety.c
+@@ -0,0 +1,1472 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * A V4L2 driver for Arducam Pivariety Cameras
++ * Copyright (C) 2022 Arducam Technology co., Ltd.
++ *
++ * Based on Sony IMX219 camera driver
++ * Copyright (C) 2019, Raspberry Pi (Trading) Ltd
++ *
++ * I2C read and write method is taken from the OV9281 driver
++ * Copyright (C) 2017 Fuzhou Rockchip Electronics Co., Ltd.
++ */
++
++#include <linux/clk.h>
++#include <linux/delay.h>
++#include <linux/gpio/consumer.h>
++#include <linux/i2c.h>
++#include <linux/module.h>
++#include <linux/pm_runtime.h>
++#include <linux/regulator/consumer.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-event.h>
++#include <media/v4l2-fwnode.h>
++#include "arducam-pivariety.h"
++
++static int debug;
++module_param(debug, int, 0644);
++
++/* regulator supplies */
++static const char * const pivariety_supply_name[] = {
++	/* Supplies can be enabled in any order */
++	"VANA",  /* Analog (2.8V) supply */
++	"VDIG",  /* Digital Core (1.8V) supply */
++	"VDDL",  /* IF (1.2V) supply */
++};
++
++/* The supported raw formats. */
++static const u32 codes[] = {
++	MEDIA_BUS_FMT_SBGGR8_1X8,
++	MEDIA_BUS_FMT_SGBRG8_1X8,
++	MEDIA_BUS_FMT_SGRBG8_1X8,
++	MEDIA_BUS_FMT_SRGGB8_1X8,
++	MEDIA_BUS_FMT_Y8_1X8,
++
++	MEDIA_BUS_FMT_SBGGR10_1X10,
++	MEDIA_BUS_FMT_SGBRG10_1X10,
++	MEDIA_BUS_FMT_SGRBG10_1X10,
++	MEDIA_BUS_FMT_SRGGB10_1X10,
++	MEDIA_BUS_FMT_Y10_1X10,
++
++	MEDIA_BUS_FMT_SBGGR12_1X12,
++	MEDIA_BUS_FMT_SGBRG12_1X12,
++	MEDIA_BUS_FMT_SGRBG12_1X12,
++	MEDIA_BUS_FMT_SRGGB12_1X12,
++	MEDIA_BUS_FMT_Y12_1X12,
++};
++
++#define ARDUCAM_NUM_SUPPLIES ARRAY_SIZE(pivariety_supply_name)
++
++#define ARDUCAM_XCLR_MIN_DELAY_US	10000
++#define ARDUCAM_XCLR_DELAY_RANGE_US	1000
++
++#define MAX_CTRLS 32
++
++struct pivariety {
++	struct v4l2_subdev sd;
++	struct media_pad pad;
++
++	struct v4l2_mbus_config_mipi_csi2 bus;
++	struct clk *xclk;
++	u32 xclk_freq;
++
++	struct gpio_desc *reset_gpio;
++	struct regulator_bulk_data supplies[ARDUCAM_NUM_SUPPLIES];
++
++	struct arducam_format *supported_formats;
++	int num_supported_formats;
++	int current_format_idx;
++	int current_resolution_idx;
++	int lanes;
++	int bayer_order_volatile;
++	bool wait_until_free;
++
++	struct v4l2_ctrl_handler ctrl_handler;
++	struct v4l2_ctrl *ctrls[MAX_CTRLS];
++	/* V4L2 Controls */
++	struct v4l2_ctrl *vflip;
++	struct v4l2_ctrl *hflip;
++
++	struct v4l2_rect crop;
++	/*
++	 * Mutex for serialized access:
++	 * Protect sensor module set pad format and start/stop streaming safely.
++	 */
++	struct mutex mutex;
++
++	/* Streaming on/off */
++	bool streaming;
++};
++
++static inline struct pivariety *to_pivariety(struct v4l2_subdev *_sd)
++{
++	return container_of(_sd, struct pivariety, sd);
++}
++
++/* Write registers up to 4 at a time */
++static int pivariety_write_reg(struct i2c_client *client, u16 reg, u32 val)
++{
++	unsigned int len = sizeof(u32);
++	u32 buf_i, val_i = 0;
++	u8 buf[6];
++	u8 *val_p;
++	__be32 val_be;
++
++	buf[0] = reg >> 8;
++	buf[1] = reg & 0xff;
++
++	val_be = cpu_to_be32(val);
++	val_p = (u8 *)&val_be;
++	buf_i = 2;
++
++	while (val_i < 4)
++		buf[buf_i++] = val_p[val_i++];
++
++	if (i2c_master_send(client, buf, len + 2) != len + 2)
++		return -EIO;
++
++	return 0;
++}
++
++/* Read registers up to 4 at a time */
++static int pivariety_read_reg(struct i2c_client *client, u16 reg, u32 *val)
++{
++	struct i2c_msg msgs[2];
++	unsigned int len = sizeof(u32);
++	u8 *data_be_p;
++	__be32 data_be = 0;
++	__be16 reg_addr_be = cpu_to_be16(reg);
++	int ret;
++
++	data_be_p = (u8 *)&data_be;
++	/* Write register address */
++	msgs[0].addr = client->addr;
++	msgs[0].flags = 0;
++	msgs[0].len = 2;
++	msgs[0].buf = (u8 *)&reg_addr_be;
++
++	/* Read data from register */
++	msgs[1].addr = client->addr;
++	msgs[1].flags = I2C_M_RD;
++	msgs[1].len = len;
++	msgs[1].buf = data_be_p;
++
++	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
++	if (ret != ARRAY_SIZE(msgs))
++		return -EIO;
++
++	*val = be32_to_cpu(data_be);
++
++	return 0;
++}
++
++static int
++pivariety_read(struct pivariety *pivariety, u16 addr, u32 *value)
++{
++	struct v4l2_subdev *sd = &pivariety->sd;
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++	int ret, count = 0;
++
++	while (count++ < I2C_READ_RETRY_COUNT) {
++		ret = pivariety_read_reg(client, addr, value);
++		if (!ret) {
++			v4l2_dbg(2, debug, sd, "%s: 0x%02x 0x%04x\n",
++				 __func__, addr, *value);
++			return ret;
++		}
++	}
++
++	v4l2_err(sd, "%s: Reading register 0x%02x failed\n",
++		 __func__, addr);
++
++	return ret;
++}
++
++static int pivariety_write(struct pivariety *pivariety, u16 addr, u32 value)
++{
++	struct v4l2_subdev *sd = &pivariety->sd;
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++	int ret, count = 0;
++
++	while (count++ < I2C_WRITE_RETRY_COUNT) {
++		ret = pivariety_write_reg(client, addr, value);
++		if (!ret)
++			return ret;
++	}
++
++	v4l2_err(sd, "%s: Write 0x%04x to register 0x%02x failed\n",
++		 __func__, value, addr);
++
++	return ret;
++}
++
++static int wait_for_free(struct pivariety *pivariety, int interval)
++{
++	u32 value;
++	u32 count = 0;
++
++	while (count++ < (1000 / interval)) {
++		int ret = pivariety_read(pivariety, SYSTEM_IDLE_REG, &value);
++
++		if (!ret && !value)
++			break;
++		msleep(interval);
++	}
++
++	v4l2_dbg(2, debug, &pivariety->sd, "%s: End wait, Count: %d.\n",
++		 __func__, count);
++
++	return 0;
++}
++
++static int is_raw(int pixformat)
++{
++	return pixformat >= 0x28 && pixformat <= 0x2D;
++}
++
++static u32 bayer_to_mbus_code(int data_type, int bayer_order)
++{
++	const u32 depth8[] = {
++		MEDIA_BUS_FMT_SBGGR8_1X8,
++		MEDIA_BUS_FMT_SGBRG8_1X8,
++		MEDIA_BUS_FMT_SGRBG8_1X8,
++		MEDIA_BUS_FMT_SRGGB8_1X8,
++		MEDIA_BUS_FMT_Y8_1X8,
++	};
++
++	const u32 depth10[] = {
++		MEDIA_BUS_FMT_SBGGR10_1X10,
++		MEDIA_BUS_FMT_SGBRG10_1X10,
++		MEDIA_BUS_FMT_SGRBG10_1X10,
++		MEDIA_BUS_FMT_SRGGB10_1X10,
++		MEDIA_BUS_FMT_Y10_1X10,
++	};
++
++	const u32 depth12[] = {
++		MEDIA_BUS_FMT_SBGGR12_1X12,
++		MEDIA_BUS_FMT_SGBRG12_1X12,
++		MEDIA_BUS_FMT_SGRBG12_1X12,
++		MEDIA_BUS_FMT_SRGGB12_1X12,
++		MEDIA_BUS_FMT_Y12_1X12,
++	};
++
++	if (bayer_order < 0 || bayer_order > 4)
++		return 0;
++
++	switch (data_type) {
++	case IMAGE_DT_RAW8:
++		return depth8[bayer_order];
++	case IMAGE_DT_RAW10:
++		return depth10[bayer_order];
++	case IMAGE_DT_RAW12:
++		return depth12[bayer_order];
++	}
++
++	return 0;
++}
++
++static u32 yuv422_to_mbus_code(int data_type, int order)
++{
++	const u32 depth8[] = {
++		MEDIA_BUS_FMT_YUYV8_1X16,
++		MEDIA_BUS_FMT_YVYU8_1X16,
++		MEDIA_BUS_FMT_UYVY8_1X16,
++		MEDIA_BUS_FMT_VYUY8_1X16,
++	};
++
++	const u32 depth10[] = {
++		MEDIA_BUS_FMT_YUYV10_1X20,
++		MEDIA_BUS_FMT_YVYU10_1X20,
++		MEDIA_BUS_FMT_UYVY10_1X20,
++		MEDIA_BUS_FMT_VYUY10_1X20,
++	};
++
++	if (order < 0 || order > 3)
++		return 0;
++
++	switch (data_type) {
++	case IMAGE_DT_YUV422_8:
++		return depth8[order];
++	case IMAGE_DT_YUV422_10:
++		return depth10[order];
++	}
++
++	return 0;
++}
++
++static u32 data_type_to_mbus_code(int data_type, int bayer_order)
++{
++	if (is_raw(data_type))
++		return bayer_to_mbus_code(data_type, bayer_order);
++
++	switch (data_type) {
++	case IMAGE_DT_YUV422_8:
++	case IMAGE_DT_YUV422_10:
++		return yuv422_to_mbus_code(data_type, bayer_order);
++	case IMAGE_DT_RGB565:
++		return MEDIA_BUS_FMT_RGB565_2X8_LE;
++	case IMAGE_DT_RGB888:
++		return MEDIA_BUS_FMT_RGB888_1X24;
++	}
++
++	return 0;
++}
++
++/* Get bayer order based on flip setting. */
++static u32 pivariety_get_format_code(struct pivariety *pivariety,
++				     struct arducam_format *format)
++{
++	unsigned int order, origin_order;
++
++	lockdep_assert_held(&pivariety->mutex);
++
++	/*
++	 * Only the bayer format needs to transform the format.
++	 */
++	if (!is_raw(format->data_type) ||
++	    !pivariety->bayer_order_volatile ||
++	    format->bayer_order == BAYER_ORDER_GRAY)
++		return data_type_to_mbus_code(format->data_type,
++					      format->bayer_order);
++
++	order = format->bayer_order;
++
++	origin_order = order;
++
++	order = (pivariety->hflip && pivariety->hflip->val ? order ^ 1 : order);
++	order = (pivariety->vflip && pivariety->vflip->val ? order ^ 2 : order);
++
++	v4l2_dbg(1, debug, &pivariety->sd, "%s: before: %d, after: %d.\n",
++		 __func__, origin_order, order);
++
++	return data_type_to_mbus_code(format->data_type, order);
++}
++
++/* Power/clock management functions */
++static int pivariety_power_on(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct pivariety *pivariety = to_pivariety(sd);
++	int ret;
++
++	ret = regulator_bulk_enable(ARDUCAM_NUM_SUPPLIES,
++				    pivariety->supplies);
++	if (ret) {
++		dev_err(dev, "%s: failed to enable regulators\n",
++			__func__);
++		return ret;
++	}
++
++	ret = clk_prepare_enable(pivariety->xclk);
++	if (ret) {
++		dev_err(dev, "%s: failed to enable clock\n",
++			__func__);
++		goto reg_off;
++	}
++
++	gpiod_set_value_cansleep(pivariety->reset_gpio, 1);
++	usleep_range(ARDUCAM_XCLR_MIN_DELAY_US,
++		     ARDUCAM_XCLR_MIN_DELAY_US + ARDUCAM_XCLR_DELAY_RANGE_US);
++
++	return 0;
++
++reg_off:
++	regulator_bulk_disable(ARDUCAM_NUM_SUPPLIES, pivariety->supplies);
++
++	return ret;
++}
++
++static int pivariety_power_off(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct pivariety *pivariety = to_pivariety(sd);
++
++	gpiod_set_value_cansleep(pivariety->reset_gpio, 0);
++	regulator_bulk_disable(ARDUCAM_NUM_SUPPLIES, pivariety->supplies);
++	clk_disable_unprepare(pivariety->xclk);
++
++	return 0;
++}
++
++static int pivariety_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
++{
++	struct pivariety *pivariety = to_pivariety(sd);
++	struct v4l2_mbus_framefmt *try_fmt =
++		v4l2_subdev_state_get_format(fh->state, 0);
++	struct arducam_format *def_fmt = &pivariety->supported_formats[0];
++
++	/* Initialize try_fmt */
++	try_fmt->width = def_fmt->resolution_set->width;
++	try_fmt->height = def_fmt->resolution_set->height;
++	try_fmt->code = def_fmt->mbus_code;
++	try_fmt->field = V4L2_FIELD_NONE;
++
++	return 0;
++}
++
++static int pivariety_s_ctrl(struct v4l2_ctrl *ctrl)
++{
++	int ret, i;
++	struct pivariety *pivariety =
++		container_of(ctrl->handler, struct pivariety,
++			     ctrl_handler);
++	struct arducam_format *supported_fmts = pivariety->supported_formats;
++	int num_supported_formats = pivariety->num_supported_formats;
++
++	v4l2_dbg(3, debug, &pivariety->sd, "%s: cid = (0x%X), value = (%d).\n",
++		 __func__, ctrl->id, ctrl->val);
++
++	ret = pivariety_write(pivariety, CTRL_ID_REG, ctrl->id);
++	ret += pivariety_write(pivariety, CTRL_VALUE_REG, ctrl->val);
++	if (ret < 0)
++		return -EINVAL;
++
++	/* When flip is set, modify all bayer formats */
++	if (ctrl->id == V4L2_CID_VFLIP || ctrl->id == V4L2_CID_HFLIP) {
++		for (i = 0; i < num_supported_formats; i++) {
++			supported_fmts[i].mbus_code =
++				pivariety_get_format_code(pivariety,
++							  &supported_fmts[i]);
++		}
++	}
++
++	/*
++	 * When starting streaming, controls are set in batches,
++	 * and the short interval will cause some controls to be unsuccessfully
++	 * set.
++	 */
++	if (pivariety->wait_until_free)
++		wait_for_free(pivariety, 1);
++	else
++		usleep_range(200, 210);
++
++	return 0;
++}
++
++static const struct v4l2_ctrl_ops pivariety_ctrl_ops = {
++	.s_ctrl = pivariety_s_ctrl,
++};
++
++static int pivariety_enum_mbus_code(struct v4l2_subdev *sd,
++				    struct v4l2_subdev_state *sd_state,
++				    struct v4l2_subdev_mbus_code_enum *code)
++{
++	struct pivariety *pivariety = to_pivariety(sd);
++	struct arducam_format *supported_formats = pivariety->supported_formats;
++	int num_supported_formats = pivariety->num_supported_formats;
++
++	v4l2_dbg(1, debug, sd, "%s: index = (%d)\n", __func__, code->index);
++
++	if (code->index >= num_supported_formats)
++		return -EINVAL;
++
++	code->code = supported_formats[code->index].mbus_code;
++
++	return 0;
++}
++
++static int pivariety_enum_framesizes(struct v4l2_subdev *sd,
++				     struct v4l2_subdev_state *sd_state,
++				     struct v4l2_subdev_frame_size_enum *fse)
++{
++	int i;
++	struct pivariety *pivariety = to_pivariety(sd);
++	struct arducam_format *supported_formats = pivariety->supported_formats;
++	int num_supported_formats = pivariety->num_supported_formats;
++	struct arducam_format *format;
++	struct arducam_resolution *resolution;
++
++	v4l2_dbg(1, debug, sd, "%s: code = (0x%X), index = (%d)\n",
++		 __func__, fse->code, fse->index);
++
++	for (i = 0; i < num_supported_formats; i++) {
++		format = &supported_formats[i];
++		if (fse->code == format->mbus_code) {
++			if (fse->index >= format->num_resolution_set)
++				return -EINVAL;
++
++			resolution = &format->resolution_set[fse->index];
++			fse->min_width = resolution->width;
++			fse->max_width = resolution->width;
++			fse->min_height = resolution->height;
++			fse->max_height = resolution->height;
++
++			return 0;
++		}
++	}
++
++	return -EINVAL;
++}
++
++static int pivariety_get_fmt(struct v4l2_subdev *sd,
++			     struct v4l2_subdev_state *sd_state,
++			     struct v4l2_subdev_format *format)
++{
++	struct pivariety *pivariety = to_pivariety(sd);
++	struct arducam_format *current_format;
++	struct v4l2_mbus_framefmt *fmt = &format->format;
++	int cur_res_idx;
++
++	if (format->pad != 0)
++		return -EINVAL;
++
++	mutex_lock(&pivariety->mutex);
++
++	current_format =
++		&pivariety->supported_formats[pivariety->current_format_idx];
++	cur_res_idx = pivariety->current_resolution_idx;
++	format->format.width =
++		current_format->resolution_set[cur_res_idx].width;
++	format->format.height =
++		current_format->resolution_set[cur_res_idx].height;
++	format->format.code = current_format->mbus_code;
++	format->format.field = V4L2_FIELD_NONE;
++	fmt->colorspace = V4L2_COLORSPACE_RAW;
++	fmt->ycbcr_enc = V4L2_MAP_YCBCR_ENC_DEFAULT(fmt->colorspace);
++	fmt->quantization = V4L2_MAP_QUANTIZATION_DEFAULT(true,
++							  fmt->colorspace,
++							  fmt->ycbcr_enc);
++	fmt->xfer_func = V4L2_MAP_XFER_FUNC_DEFAULT(fmt->colorspace);
++
++	v4l2_dbg(1, debug, sd, "%s: width: (%d) height: (%d) code: (0x%X)\n",
++		 __func__, format->format.width, format->format.height,
++		 format->format.code);
++
++	mutex_unlock(&pivariety->mutex);
++	return 0;
++}
++
++static int pivariety_get_fmt_idx_by_code(struct pivariety *pivariety,
++					 u32 mbus_code)
++{
++	int i;
++	u32 data_type;
++	struct arducam_format *formats = pivariety->supported_formats;
++
++	for (i = 0; i < pivariety->num_supported_formats; i++) {
++		if (formats[i].mbus_code == mbus_code)
++			return i;
++	}
++
++	/*
++	 * If the specified format is not found in the list of supported
++	 * formats, try to find a format of the same data type.
++	 */
++	for (i = 0; i < ARRAY_SIZE(codes); i++)
++		if (codes[i] == mbus_code)
++			break;
++
++	if (i >= ARRAY_SIZE(codes))
++		return -EINVAL;
++
++	data_type = i / 5 + IMAGE_DT_RAW8;
++
++	for (i = 0; i < pivariety->num_supported_formats; i++) {
++		if (formats[i].data_type == data_type)
++			return i;
++	}
++
++	return -EINVAL;
++}
++
++static struct v4l2_ctrl *get_control(struct pivariety *pivariety,
++				     u32 id)
++{
++	int index = 0;
++
++	while (index < MAX_CTRLS && pivariety->ctrls[index]) {
++		if (pivariety->ctrls[index]->id == id)
++			return pivariety->ctrls[index];
++		index++;
++	}
++
++	return NULL;
++}
++
++static int update_control(struct pivariety *pivariety, u32 id)
++{
++	struct v4l2_subdev *sd = &pivariety->sd;
++	struct v4l2_ctrl *ctrl;
++	u32 min, max, step, def, id2;
++	int ret = 0;
++
++	pivariety_write(pivariety, CTRL_ID_REG, id);
++	pivariety_read(pivariety, CTRL_ID_REG, &id2);
++
++	v4l2_dbg(1, debug, sd, "%s: Write ID: 0x%08X Read ID: 0x%08X\n",
++		 __func__, id, id2);
++
++	pivariety_write(pivariety, CTRL_VALUE_REG, 0);
++	wait_for_free(pivariety, 1);
++
++	ret += pivariety_read(pivariety, CTRL_MAX_REG, &max);
++	ret += pivariety_read(pivariety, CTRL_MIN_REG, &min);
++	ret += pivariety_read(pivariety, CTRL_DEF_REG, &def);
++	ret += pivariety_read(pivariety, CTRL_STEP_REG, &step);
++
++	if (ret < 0)
++		goto err;
++
++	if (id == NO_DATA_AVAILABLE || max == NO_DATA_AVAILABLE ||
++	    min == NO_DATA_AVAILABLE || def == NO_DATA_AVAILABLE ||
++	    step == NO_DATA_AVAILABLE)
++		goto err;
++
++	v4l2_dbg(1, debug, sd, "%s: min: %d, max: %d, step: %d, def: %d\n",
++		 __func__, min, max, step, def);
++
++	ctrl = get_control(pivariety, id);
++	return __v4l2_ctrl_modify_range(ctrl, min, max, step, def);
++
++err:
++	return -EINVAL;
++}
++
++static int update_controls(struct pivariety *pivariety)
++{
++	int ret = 0;
++	int index = 0;
++
++	wait_for_free(pivariety, 5);
++
++	while (index < MAX_CTRLS && pivariety->ctrls[index]) {
++		ret += update_control(pivariety, pivariety->ctrls[index]->id);
++		index++;
++	}
++
++	return ret;
++}
++
++static int pivariety_set_fmt(struct v4l2_subdev *sd,
++			     struct v4l2_subdev_state *sd_state,
++			     struct v4l2_subdev_format *format)
++{
++	int i, j;
++	struct pivariety *pivariety = to_pivariety(sd);
++	struct arducam_format *supported_formats = pivariety->supported_formats;
++
++	if (format->pad != 0)
++		return -EINVAL;
++
++	mutex_lock(&pivariety->mutex);
++
++	format->format.colorspace = V4L2_COLORSPACE_RAW;
++	format->format.field = V4L2_FIELD_NONE;
++
++	v4l2_dbg(1, debug, sd, "%s: code: 0x%X, width: %d, height: %d\n",
++		 __func__, format->format.code, format->format.width,
++		 format->format.height);
++
++	i = pivariety_get_fmt_idx_by_code(pivariety, format->format.code);
++	if (i < 0)
++		i = 0;
++
++	format->format.code = supported_formats[i].mbus_code;
++
++	for (j = 0; j < supported_formats[i].num_resolution_set; j++) {
++		if (supported_formats[i].resolution_set[j].width ==
++						format->format.width &&
++			supported_formats[i].resolution_set[j].height ==
++						format->format.height) {
++			v4l2_dbg(1, debug, sd,
++				 "%s: format match.\n", __func__);
++			v4l2_dbg(1, debug, sd,
++				 "%s: set format to device: %d %d.\n",
++				 __func__, supported_formats[i].index, j);
++
++			pivariety_write(pivariety, PIXFORMAT_INDEX_REG,
++					supported_formats[i].index);
++			pivariety_write(pivariety, RESOLUTION_INDEX_REG, j);
++
++			pivariety->current_format_idx = i;
++			pivariety->current_resolution_idx = j;
++
++			update_controls(pivariety);
++
++			goto unlock;
++		}
++	}
++
++	format->format.width = supported_formats[i].resolution_set[0].width;
++	format->format.height = supported_formats[i].resolution_set[0].height;
++
++	pivariety_write(pivariety, PIXFORMAT_INDEX_REG,
++			supported_formats[i].index);
++	pivariety_write(pivariety, RESOLUTION_INDEX_REG, 0);
++
++	pivariety->current_format_idx = i;
++	pivariety->current_resolution_idx = 0;
++	update_controls(pivariety);
++
++unlock:
++
++	mutex_unlock(&pivariety->mutex);
++
++	return 0;
++}
++
++/* Start streaming */
++static int pivariety_start_streaming(struct pivariety *pivariety)
++{
++	int ret;
++
++	/* set stream on register */
++	ret = pivariety_write(pivariety, MODE_SELECT_REG,
++			      ARDUCAM_MODE_STREAMING);
++
++	if (ret)
++		return ret;
++
++	wait_for_free(pivariety, 2);
++
++	/*
++	 * When starting streaming, controls are set in batches,
++	 * and the short interval will cause some controls to be unsuccessfully
++	 * set.
++	 */
++	pivariety->wait_until_free = true;
++	/* Apply customized values from user */
++	ret =  __v4l2_ctrl_handler_setup(pivariety->sd.ctrl_handler);
++
++	pivariety->wait_until_free = false;
++	if (ret)
++		return ret;
++
++	wait_for_free(pivariety, 2);
++
++	return ret;
++}
++
++static int pivariety_read_sel(struct pivariety *pivariety,
++			      struct v4l2_rect *rect)
++{
++	int ret = 0;
++
++	ret += pivariety_read(pivariety, IPC_SEL_TOP_REG, &rect->top);
++	ret += pivariety_read(pivariety, IPC_SEL_LEFT_REG, &rect->left);
++	ret += pivariety_read(pivariety, IPC_SEL_WIDTH_REG, &rect->width);
++	ret += pivariety_read(pivariety, IPC_SEL_HEIGHT_REG, &rect->height);
++
++	if (ret || rect->top == NO_DATA_AVAILABLE ||
++	    rect->left == NO_DATA_AVAILABLE ||
++	    rect->width == NO_DATA_AVAILABLE ||
++	    rect->height == NO_DATA_AVAILABLE) {
++		v4l2_err(&pivariety->sd, "%s: Failed to read selection.\n",
++			 __func__);
++		return -EINVAL;
++		}
++
++	return 0;
++}
++
++static const struct v4l2_rect *
++__pivariety_get_pad_crop(struct pivariety *pivariety,
++			 struct v4l2_subdev_state *sd_state,
++			 unsigned int pad,
++			 enum v4l2_subdev_format_whence which)
++{
++	int ret;
++
++	switch (which) {
++	case V4L2_SUBDEV_FORMAT_TRY:
++		return v4l2_subdev_state_get_crop(sd_state, pad);
++	case V4L2_SUBDEV_FORMAT_ACTIVE:
++		ret = pivariety_read_sel(pivariety, &pivariety->crop);
++		if (ret)
++			return NULL;
++		return &pivariety->crop;
++	}
++
++	return NULL;
++}
++
++static int pivariety_get_selection(struct v4l2_subdev *sd,
++				   struct v4l2_subdev_state *sd_state,
++				   struct v4l2_subdev_selection *sel)
++{
++	int ret = 0;
++	struct v4l2_rect rect;
++	struct pivariety *pivariety = to_pivariety(sd);
++
++	ret = pivariety_write(pivariety, IPC_SEL_TARGET_REG, sel->target);
++	if (ret) {
++		v4l2_err(sd, "%s: Write register 0x%02x failed\n",
++			 __func__, IPC_SEL_TARGET_REG);
++		return -EINVAL;
++	}
++
++	wait_for_free(pivariety, 2);
++
++	switch (sel->target) {
++	case V4L2_SEL_TGT_CROP: {
++		mutex_lock(&pivariety->mutex);
++		sel->r = *__pivariety_get_pad_crop(pivariety, sd_state,
++						   sel->pad,
++						   sel->which);
++		mutex_unlock(&pivariety->mutex);
++
++		return 0;
++	}
++
++	case V4L2_SEL_TGT_NATIVE_SIZE:
++	case V4L2_SEL_TGT_CROP_DEFAULT:
++	case V4L2_SEL_TGT_CROP_BOUNDS:
++		ret = pivariety_read_sel(pivariety, &rect);
++		if (ret)
++			return -EINVAL;
++
++		sel->r = rect;
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++/* Stop streaming */
++static int pivariety_stop_streaming(struct pivariety *pivariety)
++{
++	int ret;
++
++	/* set stream off register */
++	ret = pivariety_write(pivariety, MODE_SELECT_REG, ARDUCAM_MODE_STANDBY);
++	if (ret)
++		v4l2_err(&pivariety->sd, "%s failed to set stream\n", __func__);
++
++	/*
++	 * Return success even if it was an error, as there is nothing the
++	 * caller can do about it.
++	 */
++	return 0;
++}
++
++static int pivariety_set_stream(struct v4l2_subdev *sd, int enable)
++{
++	struct pivariety *pivariety = to_pivariety(sd);
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++	int ret = 0;
++
++	mutex_lock(&pivariety->mutex);
++	if (pivariety->streaming == enable) {
++		mutex_unlock(&pivariety->mutex);
++		return 0;
++	}
++
++	if (enable) {
++		ret = pm_runtime_get_sync(&client->dev);
++		if (ret < 0) {
++			pm_runtime_put_noidle(&client->dev);
++			goto err_unlock;
++		}
++
++		/*
++		 * Apply default & customized values
++		 * and then start streaming.
++		 */
++		ret = pivariety_start_streaming(pivariety);
++		if (ret)
++			goto err_rpm_put;
++	} else {
++		pivariety_stop_streaming(pivariety);
++		pm_runtime_put(&client->dev);
++	}
++
++	pivariety->streaming = enable;
++
++	/*
++	 * vflip and hflip cannot change during streaming
++	 * Pivariety may not implement flip control.
++	 */
++	if (pivariety->vflip)
++		__v4l2_ctrl_grab(pivariety->vflip, enable);
++
++	if (pivariety->hflip)
++		__v4l2_ctrl_grab(pivariety->hflip, enable);
++
++	mutex_unlock(&pivariety->mutex);
++
++	return ret;
++
++err_rpm_put:
++	pm_runtime_put(&client->dev);
++err_unlock:
++	mutex_unlock(&pivariety->mutex);
++
++	return ret;
++}
++
++static int __maybe_unused pivariety_suspend(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct pivariety *pivariety = to_pivariety(sd);
++
++	if (pivariety->streaming)
++		pivariety_stop_streaming(pivariety);
++
++	return 0;
++}
++
++static int __maybe_unused pivariety_resume(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct pivariety *pivariety = to_pivariety(sd);
++	int ret;
++
++	if (pivariety->streaming) {
++		ret = pivariety_start_streaming(pivariety);
++		if (ret)
++			goto error;
++	}
++
++	return 0;
++
++error:
++	pivariety_stop_streaming(pivariety);
++	pivariety->streaming = 0;
++	return ret;
++}
++
++static int pivariety_get_regulators(struct pivariety *pivariety)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&pivariety->sd);
++	int i;
++
++	for (i = 0; i < ARDUCAM_NUM_SUPPLIES; i++)
++		pivariety->supplies[i].supply = pivariety_supply_name[i];
++
++	return devm_regulator_bulk_get(&client->dev,
++				       ARDUCAM_NUM_SUPPLIES,
++				       pivariety->supplies);
++}
++
++static int pivariety_get_mbus_config(struct v4l2_subdev *sd, unsigned int pad,
++				     struct v4l2_mbus_config *cfg)
++{
++	struct pivariety *pivariety = to_pivariety(sd);
++
++	if (pivariety->lanes > pivariety->bus.num_data_lanes)
++		return -EINVAL;
++
++	cfg->type = V4L2_MBUS_CSI2_DPHY;
++	cfg->bus.mipi_csi2.flags = pivariety->bus.flags;
++	cfg->bus.mipi_csi2.num_data_lanes = pivariety->lanes;
++
++	return 0;
++}
++
++static const struct v4l2_subdev_core_ops pivariety_core_ops = {
++	.subscribe_event = v4l2_ctrl_subdev_subscribe_event,
++	.unsubscribe_event = v4l2_event_subdev_unsubscribe,
++};
++
++static const struct v4l2_subdev_video_ops pivariety_video_ops = {
++	.s_stream = pivariety_set_stream,
++};
++
++static const struct v4l2_subdev_pad_ops pivariety_pad_ops = {
++	.enum_mbus_code = pivariety_enum_mbus_code,
++	.get_fmt = pivariety_get_fmt,
++	.set_fmt = pivariety_set_fmt,
++	.enum_frame_size = pivariety_enum_framesizes,
++	.get_selection = pivariety_get_selection,
++	.get_mbus_config = pivariety_get_mbus_config,
++};
++
++static const struct v4l2_subdev_ops pivariety_subdev_ops = {
++	.core = &pivariety_core_ops,
++	.video = &pivariety_video_ops,
++	.pad = &pivariety_pad_ops,
++};
++
++static const struct v4l2_subdev_internal_ops pivariety_internal_ops = {
++	.open = pivariety_open,
++};
++
++static void pivariety_free_controls(struct pivariety *pivariety)
++{
++	v4l2_ctrl_handler_free(pivariety->sd.ctrl_handler);
++	mutex_destroy(&pivariety->mutex);
++}
++
++static int pivariety_get_length_of_set(struct pivariety *pivariety,
++				       u16 idx_reg, u16 val_reg)
++{
++	int ret;
++	int index = 0;
++	u32 val;
++
++	while (1) {
++		ret = pivariety_write(pivariety, idx_reg, index);
++		ret += pivariety_read(pivariety, val_reg, &val);
++
++		if (ret < 0)
++			return -1;
++
++		if (val == NO_DATA_AVAILABLE)
++			break;
++		index++;
++	}
++	pivariety_write(pivariety, idx_reg, 0);
++	return index;
++}
++
++static int pivariety_enum_resolution(struct pivariety *pivariety,
++				     struct arducam_format *format)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&pivariety->sd);
++	int index = 0;
++	u32 width, height;
++	int num_resolution = 0;
++	int ret;
++
++	num_resolution = pivariety_get_length_of_set(pivariety,
++						     RESOLUTION_INDEX_REG,
++						     FORMAT_WIDTH_REG);
++	if (num_resolution < 0)
++		goto err;
++
++	format->resolution_set = devm_kzalloc(&client->dev,
++					      sizeof(*format->resolution_set) *
++								num_resolution,
++					      GFP_KERNEL);
++	while (1) {
++		ret = pivariety_write(pivariety, RESOLUTION_INDEX_REG, index);
++		ret += pivariety_read(pivariety, FORMAT_WIDTH_REG, &width);
++		ret += pivariety_read(pivariety, FORMAT_HEIGHT_REG, &height);
++
++		if (ret < 0)
++			goto err;
++
++		if (width == NO_DATA_AVAILABLE || height == NO_DATA_AVAILABLE)
++			break;
++
++		format->resolution_set[index].width = width;
++		format->resolution_set[index].height = height;
++
++		index++;
++	}
++
++	format->num_resolution_set = index;
++	pivariety_write(pivariety, RESOLUTION_INDEX_REG, 0);
++	return 0;
++err:
++	return -ENODEV;
++}
++
++static int pivariety_enum_pixformat(struct pivariety *pivariety)
++{
++	int ret = 0;
++	u32 mbus_code = 0;
++	int pixfmt_type;
++	int bayer_order;
++	int bayer_order_not_volatile;
++	int lanes;
++	int index = 0;
++	int num_pixformat = 0;
++	struct arducam_format *arducam_fmt;
++	struct i2c_client *client = v4l2_get_subdevdata(&pivariety->sd);
++
++	num_pixformat = pivariety_get_length_of_set(pivariety,
++						    PIXFORMAT_INDEX_REG,
++						    PIXFORMAT_TYPE_REG);
++
++	if (num_pixformat < 0)
++		goto err;
++
++	ret = pivariety_read(pivariety, FLIPS_DONT_CHANGE_ORDER_REG,
++			     &bayer_order_not_volatile);
++	if (bayer_order_not_volatile == NO_DATA_AVAILABLE)
++		pivariety->bayer_order_volatile = 1;
++	else
++		pivariety->bayer_order_volatile = !bayer_order_not_volatile;
++
++	if (ret < 0)
++		goto err;
++
++	pivariety->supported_formats =
++		devm_kzalloc(&client->dev,
++			     sizeof(*pivariety->supported_formats) *
++								num_pixformat,
++			     GFP_KERNEL);
++
++	while (1) {
++		ret = pivariety_write(pivariety, PIXFORMAT_INDEX_REG, index);
++		ret += pivariety_read(pivariety, PIXFORMAT_TYPE_REG,
++				      &pixfmt_type);
++
++		if (pixfmt_type == NO_DATA_AVAILABLE)
++			break;
++
++		ret += pivariety_read(pivariety, MIPI_LANES_REG, &lanes);
++		if (lanes == NO_DATA_AVAILABLE)
++			break;
++
++		ret += pivariety_read(pivariety, PIXFORMAT_ORDER_REG,
++				      &bayer_order);
++		if (ret < 0)
++			goto err;
++
++		mbus_code = data_type_to_mbus_code(pixfmt_type, bayer_order);
++		arducam_fmt = &pivariety->supported_formats[index];
++		arducam_fmt->index = index;
++		arducam_fmt->mbus_code = mbus_code;
++		arducam_fmt->bayer_order = bayer_order;
++		arducam_fmt->data_type = pixfmt_type;
++		if (pivariety_enum_resolution(pivariety, arducam_fmt))
++			goto err;
++
++		index++;
++	}
++
++	pivariety_write(pivariety, PIXFORMAT_INDEX_REG, 0);
++	pivariety->num_supported_formats = index;
++	pivariety->current_format_idx = 0;
++	pivariety->current_resolution_idx = 0;
++	pivariety->lanes = lanes;
++
++	return 0;
++
++err:
++	return -ENODEV;
++}
++
++static const char *pivariety_ctrl_get_name(u32 id)
++{
++	switch (id) {
++	case V4L2_CID_ARDUCAM_EXT_TRI:
++		return "trigger_mode";
++	case V4L2_CID_ARDUCAM_IRCUT:
++		return "ircut";
++	case V4L2_CID_ARDUCAM_STROBE_SHIFT:
++		return "strobe_shift";
++	case V4L2_CID_ARDUCAM_STROBE_WIDTH:
++		return "strobe_width";
++	case V4L2_CID_ARDUCAM_MODE:
++		return "mode";
++	default:
++		return NULL;
++	}
++}
++
++static enum v4l2_ctrl_type pivariety_get_v4l2_ctrl_type(u32 id)
++{
++	switch (id) {
++	case V4L2_CID_ARDUCAM_EXT_TRI:
++		return V4L2_CTRL_TYPE_BOOLEAN;
++	case V4L2_CID_ARDUCAM_IRCUT:
++		return V4L2_CTRL_TYPE_BOOLEAN;
++	default:
++		return V4L2_CTRL_TYPE_INTEGER;
++	}
++}
++
++static struct v4l2_ctrl *v4l2_ctrl_new_arducam(struct v4l2_ctrl_handler *hdl,
++					       const struct v4l2_ctrl_ops *ops,
++					       u32 id, s64 min, s64 max,
++					       u64 step, s64 def)
++{
++	struct v4l2_ctrl_config ctrl_cfg = {
++		.ops = ops,
++		.id = id,
++		.name = NULL,
++		.type = V4L2_CTRL_TYPE_INTEGER,
++		.flags = 0,
++		.min = min,
++		.max = max,
++		.def = def,
++		.step = step,
++	};
++
++	ctrl_cfg.name = pivariety_ctrl_get_name(id);
++	ctrl_cfg.type = pivariety_get_v4l2_ctrl_type(id);
++
++	return v4l2_ctrl_new_custom(hdl, &ctrl_cfg, NULL);
++}
++
++static int pivariety_enum_controls(struct pivariety *pivariety)
++{
++	struct v4l2_subdev *sd = &pivariety->sd;
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++	struct v4l2_ctrl_handler *ctrl_hdlr = &pivariety->ctrl_handler;
++	struct v4l2_fwnode_device_properties props;
++	struct v4l2_ctrl **ctrl = pivariety->ctrls;
++	int ret, index, num_ctrls;
++	u32 id, min, max, def, step;
++
++	num_ctrls = pivariety_get_length_of_set(pivariety, CTRL_INDEX_REG,
++						CTRL_ID_REG);
++	if (num_ctrls < 0)
++		goto err;
++
++	v4l2_dbg(1, debug, sd, "%s: num_ctrls = %d\n",
++		 __func__, num_ctrls);
++
++	ret = v4l2_ctrl_handler_init(ctrl_hdlr, num_ctrls);
++	if (ret)
++		return ret;
++
++	index = 0;
++	while (1) {
++		ret = pivariety_write(pivariety, CTRL_INDEX_REG, index);
++		pivariety_write(pivariety, CTRL_VALUE_REG, 0);
++		wait_for_free(pivariety, 1);
++
++		ret += pivariety_read(pivariety, CTRL_ID_REG, &id);
++		ret += pivariety_read(pivariety, CTRL_MAX_REG, &max);
++		ret += pivariety_read(pivariety, CTRL_MIN_REG, &min);
++		ret += pivariety_read(pivariety, CTRL_DEF_REG, &def);
++		ret += pivariety_read(pivariety, CTRL_STEP_REG, &step);
++		if (ret < 0)
++			goto err;
++
++		if (id == NO_DATA_AVAILABLE || max == NO_DATA_AVAILABLE ||
++		    min == NO_DATA_AVAILABLE || def == NO_DATA_AVAILABLE ||
++		    step == NO_DATA_AVAILABLE)
++			break;
++
++		v4l2_dbg(1, debug, sd,
++			 "%s: index = %d, id = 0x%x, max = %d, min = %d, def = %d, step = %d\n",
++			 __func__, index, id, max, min, def, step);
++
++		if (v4l2_ctrl_get_name(id)) {
++			*ctrl = v4l2_ctrl_new_std(ctrl_hdlr,
++						  &pivariety_ctrl_ops,
++						  id, min,
++						  max, step,
++						  def);
++			v4l2_dbg(1, debug, sd, "%s: ctrl: 0x%p\n",
++				 __func__, *ctrl);
++		} else if (pivariety_ctrl_get_name(id)) {
++			*ctrl = v4l2_ctrl_new_arducam(ctrl_hdlr,
++						      &pivariety_ctrl_ops,
++						      id, min, max, step, def);
++
++			v4l2_dbg(1, debug, sd,
++				 "%s: new custom ctrl, ctrl: 0x%p.\n",
++				 __func__, *ctrl);
++		} else {
++			index++;
++			continue;
++		}
++
++		if (!*ctrl)
++			goto err;
++
++		switch (id) {
++		case V4L2_CID_HFLIP:
++			pivariety->hflip = *ctrl;
++			if (pivariety->bayer_order_volatile)
++				pivariety->hflip->flags |=
++						V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++			break;
++
++		case V4L2_CID_VFLIP:
++			pivariety->vflip = *ctrl;
++			if (pivariety->bayer_order_volatile)
++				pivariety->vflip->flags |=
++						V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++			break;
++
++		case V4L2_CID_HBLANK:
++			(*ctrl)->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++			break;
++		}
++
++		ctrl++;
++		index++;
++	}
++
++	pivariety_write(pivariety, CTRL_INDEX_REG, 0);
++
++	ret = v4l2_fwnode_device_parse(&client->dev, &props);
++	if (ret)
++		goto err;
++
++	ret = v4l2_ctrl_new_fwnode_properties(ctrl_hdlr,
++					      &pivariety_ctrl_ops,
++					      &props);
++	if (ret)
++		goto err;
++
++	pivariety->sd.ctrl_handler = ctrl_hdlr;
++	v4l2_ctrl_handler_setup(ctrl_hdlr);
++	return 0;
++err:
++	return -ENODEV;
++}
++
++static int pivariety_parse_dt(struct pivariety *pivariety, struct device *dev)
++{
++	struct fwnode_handle *endpoint;
++	struct v4l2_fwnode_endpoint ep_cfg = {
++		.bus_type = V4L2_MBUS_CSI2_DPHY
++	};
++	int ret = -EINVAL;
++
++	/* Get CSI2 bus config */
++	endpoint = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
++	if (!endpoint) {
++		dev_err(dev, "endpoint node not found\n");
++		return -EINVAL;
++	}
++
++	if (v4l2_fwnode_endpoint_alloc_parse(endpoint, &ep_cfg)) {
++		dev_err(dev, "could not parse endpoint\n");
++		goto error_out;
++	}
++
++	pivariety->bus = ep_cfg.bus.mipi_csi2;
++
++	ret = 0;
++
++error_out:
++	v4l2_fwnode_endpoint_free(&ep_cfg);
++	fwnode_handle_put(endpoint);
++
++	return ret;
++}
++
++static int pivariety_probe(struct i2c_client *client)
++{
++	struct device *dev = &client->dev;
++	struct pivariety *pivariety;
++	u32 device_id, firmware_version;
++	int ret;
++
++	pivariety = devm_kzalloc(&client->dev, sizeof(*pivariety), GFP_KERNEL);
++	if (!pivariety)
++		return -ENOMEM;
++
++	/* Initialize subdev */
++	v4l2_i2c_subdev_init(&pivariety->sd, client,
++			     &pivariety_subdev_ops);
++
++	if (pivariety_parse_dt(pivariety, dev))
++		return -EINVAL;
++
++	/* Get system clock (xclk) */
++	pivariety->xclk = devm_clk_get(dev, "xclk");
++	if (IS_ERR(pivariety->xclk)) {
++		dev_err(dev, "failed to get xclk\n");
++		return PTR_ERR(pivariety->xclk);
++	}
++
++	pivariety->xclk_freq = clk_get_rate(pivariety->xclk);
++	if (pivariety->xclk_freq != 24000000) {
++		dev_err(dev, "xclk frequency not supported: %d Hz\n",
++			pivariety->xclk_freq);
++		return -EINVAL;
++	}
++
++	ret = pivariety_get_regulators(pivariety);
++	if (ret)
++		return ret;
++
++	/* Request optional enable pin */
++	pivariety->reset_gpio = devm_gpiod_get_optional(dev, "reset",
++							GPIOD_OUT_HIGH);
++
++	ret = pivariety_power_on(dev);
++	if (ret)
++		return ret;
++
++	ret = pivariety_read(pivariety, DEVICE_ID_REG, &device_id);
++	if (ret || device_id != DEVICE_ID) {
++		dev_err(dev, "probe failed\n");
++		ret = -ENODEV;
++		goto error_power_off;
++	}
++
++	ret = pivariety_read(pivariety, DEVICE_VERSION_REG, &firmware_version);
++	if (ret)
++		dev_err(dev, "read firmware version failed\n");
++
++	dev_info(dev, "firmware version: 0x%04X\n", firmware_version);
++
++	if (pivariety_enum_pixformat(pivariety)) {
++		dev_err(dev, "enum pixformat failed.\n");
++		ret = -ENODEV;
++		goto error_power_off;
++	}
++
++	if (pivariety_enum_controls(pivariety)) {
++		dev_err(dev, "enum controls failed.\n");
++		ret = -ENODEV;
++		goto error_power_off;
++	}
++
++	/* Initialize subdev */
++	pivariety->sd.internal_ops = &pivariety_internal_ops;
++	pivariety->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
++	pivariety->sd.entity.function = MEDIA_ENT_F_CAM_SENSOR;
++	/* Initialize source pad */
++	pivariety->pad.flags = MEDIA_PAD_FL_SOURCE;
++
++	ret = media_entity_pads_init(&pivariety->sd.entity, 1, &pivariety->pad);
++	if (ret)
++		goto error_handler_free;
++
++	ret = v4l2_async_register_subdev_sensor(&pivariety->sd);
++	if (ret < 0)
++		goto error_media_entity;
++
++	pm_runtime_set_active(dev);
++	pm_runtime_enable(dev);
++	pm_runtime_idle(dev);
++
++	return 0;
++
++error_media_entity:
++	media_entity_cleanup(&pivariety->sd.entity);
++
++error_handler_free:
++	pivariety_free_controls(pivariety);
++
++error_power_off:
++	pivariety_power_off(dev);
++
++	return ret;
++}
++
++static void pivariety_remove(struct i2c_client *client)
++{
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct pivariety *pivariety = to_pivariety(sd);
++
++	v4l2_async_unregister_subdev(sd);
++	media_entity_cleanup(&sd->entity);
++	pivariety_free_controls(pivariety);
++
++	pm_runtime_disable(&client->dev);
++	pm_runtime_set_suspended(&client->dev);
++}
++
++static const struct dev_pm_ops pivariety_pm_ops = {
++	SET_SYSTEM_SLEEP_PM_OPS(pivariety_suspend, pivariety_resume)
++	SET_RUNTIME_PM_OPS(pivariety_power_off, pivariety_power_on, NULL)
++};
++
++static const struct of_device_id arducam_pivariety_dt_ids[] = {
++	{ .compatible = "arducam,arducam-pivariety" },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, arducam_pivariety_dt_ids);
++
++static struct i2c_driver arducam_pivariety_i2c_driver = {
++	.driver = {
++		.name = "arducam-pivariety",
++		.of_match_table	= arducam_pivariety_dt_ids,
++		.pm = &pivariety_pm_ops,
++	},
++	.probe = pivariety_probe,
++	.remove = pivariety_remove,
++};
++
++module_i2c_driver(arducam_pivariety_i2c_driver);
++
++MODULE_AUTHOR("Lee Jackson <info@arducam.com>");
++MODULE_DESCRIPTION("Arducam Pivariety v4l2 driver");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/drivers/media/i2c/arducam-pivariety.h
+@@ -0,0 +1,110 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _ARDUCAM_PIVARIETY_H_
++#define _ARDUCAM_PIVARIETY_H_
++
++#define DEVICE_REG_BASE		0x0100
++#define PIXFORMAT_REG_BASE	0x0200
++#define FORMAT_REG_BASE		0x0300
++#define CTRL_REG_BASE		0x0400
++#define IPC_REG_BASE		0x0600
++
++#define ARDUCAM_MODE_STANDBY		0x00
++#define ARDUCAM_MODE_STREAMING		0x01
++
++#define MODE_SELECT_REG		(DEVICE_REG_BASE | 0x0000)
++#define DEVICE_VERSION_REG	(DEVICE_REG_BASE | 0x0001)
++#define SENSOR_ID_REG		(DEVICE_REG_BASE | 0x0002)
++#define DEVICE_ID_REG		(DEVICE_REG_BASE | 0x0003)
++#define SYSTEM_IDLE_REG		(DEVICE_REG_BASE | 0x0007)
++
++#define PIXFORMAT_INDEX_REG		(PIXFORMAT_REG_BASE | 0x0000)
++#define PIXFORMAT_TYPE_REG		(PIXFORMAT_REG_BASE | 0x0001)
++#define PIXFORMAT_ORDER_REG		(PIXFORMAT_REG_BASE | 0x0002)
++#define MIPI_LANES_REG			(PIXFORMAT_REG_BASE | 0x0003)
++#define FLIPS_DONT_CHANGE_ORDER_REG	(PIXFORMAT_REG_BASE | 0x0004)
++
++#define RESOLUTION_INDEX_REG	(FORMAT_REG_BASE | 0x0000)
++#define FORMAT_WIDTH_REG	(FORMAT_REG_BASE | 0x0001)
++#define FORMAT_HEIGHT_REG	(FORMAT_REG_BASE | 0x0002)
++
++#define CTRL_INDEX_REG	(CTRL_REG_BASE | 0x0000)
++#define CTRL_ID_REG	(CTRL_REG_BASE | 0x0001)
++#define CTRL_MIN_REG	(CTRL_REG_BASE | 0x0002)
++#define CTRL_MAX_REG	(CTRL_REG_BASE | 0x0003)
++#define CTRL_STEP_REG	(CTRL_REG_BASE | 0x0004)
++#define CTRL_DEF_REG	(CTRL_REG_BASE | 0x0005)
++#define CTRL_VALUE_REG	(CTRL_REG_BASE | 0x0006)
++
++#define IPC_SEL_TARGET_REG	(IPC_REG_BASE | 0x0000)
++#define IPC_SEL_TOP_REG		(IPC_REG_BASE | 0x0001)
++#define IPC_SEL_LEFT_REG	(IPC_REG_BASE | 0x0002)
++#define IPC_SEL_WIDTH_REG	(IPC_REG_BASE | 0x0003)
++#define IPC_SEL_HEIGHT_REG	(IPC_REG_BASE | 0x0004)
++#define IPC_DELAY_REG		(IPC_REG_BASE | 0x0005)
++
++#define NO_DATA_AVAILABLE	0xFFFFFFFE
++
++#define DEVICE_ID	0x0030
++
++#define I2C_READ_RETRY_COUNT	3
++#define I2C_WRITE_RETRY_COUNT	2
++
++#define V4L2_CID_ARDUCAM_BASE		(V4L2_CID_USER_BASE + 0x1000)
++#define V4L2_CID_ARDUCAM_EXT_TRI	(V4L2_CID_ARDUCAM_BASE + 1)
++#define V4L2_CID_ARDUCAM_IRCUT		(V4L2_CID_ARDUCAM_BASE + 8)
++#define V4L2_CID_ARDUCAM_STROBE_SHIFT	(V4L2_CID_ARDUCAM_BASE + 14)
++#define V4L2_CID_ARDUCAM_STROBE_WIDTH	(V4L2_CID_ARDUCAM_BASE + 15)
++#define V4L2_CID_ARDUCAM_MODE		(V4L2_CID_ARDUCAM_BASE + 16)
++
++enum image_dt {
++	IMAGE_DT_YUV420_8 = 0x18,
++	IMAGE_DT_YUV420_10,
++
++	IMAGE_DT_YUV420CSPS_8 = 0x1C,
++	IMAGE_DT_YUV420CSPS_10,
++	IMAGE_DT_YUV422_8,
++	IMAGE_DT_YUV422_10,
++	IMAGE_DT_RGB444,
++	IMAGE_DT_RGB555,
++	IMAGE_DT_RGB565,
++	IMAGE_DT_RGB666,
++	IMAGE_DT_RGB888,
++
++	IMAGE_DT_RAW6 = 0x28,
++	IMAGE_DT_RAW7,
++	IMAGE_DT_RAW8,
++	IMAGE_DT_RAW10,
++	IMAGE_DT_RAW12,
++	IMAGE_DT_RAW14,
++};
++
++enum bayer_order {
++	BAYER_ORDER_BGGR = 0,
++	BAYER_ORDER_GBRG = 1,
++	BAYER_ORDER_GRBG = 2,
++	BAYER_ORDER_RGGB = 3,
++	BAYER_ORDER_GRAY = 4,
++};
++
++enum yuv_order {
++	YUV_ORDER_YUYV = 0,
++	YUV_ORDER_YVYU = 1,
++	YUV_ORDER_UYVY = 2,
++	YUV_ORDER_VYUY = 3,
++};
++
++struct arducam_resolution {
++	u32 width;
++	u32 height;
++};
++
++struct arducam_format {
++	u32 index;
++	u32 mbus_code;
++	u32 bayer_order;
++	u32 data_type;
++	u32 num_resolution_set;
++	struct arducam_resolution *resolution_set;
++};
++
++#endif
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0283-thermal-broadcom-Use-dev_err_probe-to-suppress-defer.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0283-thermal-broadcom-Use-dev_err_probe-to-suppress-defer.patch
new file mode 100644
index 00000000..bd4c7169
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0283-thermal-broadcom-Use-dev_err_probe-to-suppress-defer.patch
@@ -0,0 +1,26 @@
+From c9dd21e97f2c833e90f9f3e22d3ab8a5459b6ff6 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 6 May 2022 15:34:44 +0100
+Subject: [PATCH 283/697] thermal: broadcom: Use dev_err_probe to suppress
+ defer errors
+
+It is quite common for the devm_thermal_zone_of_sensor_register
+to need to defer, so avoid spamming the log by using
+dev_err_probe instead of dev_err.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/thermal/broadcom/bcm2711_thermal.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/thermal/broadcom/bcm2711_thermal.c
++++ b/drivers/thermal/broadcom/bcm2711_thermal.c
+@@ -92,7 +92,7 @@ static int bcm2711_thermal_probe(struct
+ 						&bcm2711_thermal_of_ops);
+ 	if (IS_ERR(thermal)) {
+ 		ret = PTR_ERR(thermal);
+-		dev_err(dev, "could not register sensor: %d\n", ret);
++		dev_err_probe(dev, ret, "could not register sensor: %d\n", ret);
+ 		return ret;
+ 	}
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0284-dt-bindings-hwmon-add-microchip-emc2305.yaml-dt-bind.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0284-dt-bindings-hwmon-add-microchip-emc2305.yaml-dt-bind.patch
new file mode 100644
index 00000000..45350908
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0284-dt-bindings-hwmon-add-microchip-emc2305.yaml-dt-bind.patch
@@ -0,0 +1,81 @@
+From 85204e739affc95ba8e94d5460f79a9ab8afb30b Mon Sep 17 00:00:00 2001
+From: Michael Shych <michaelsh@nvidia.com>
+Date: Sat, 30 Apr 2022 14:49:04 +0300
+Subject: [PATCH 284/697] dt-bindings: hwmon: add microchip,emc2305.yaml dt
+ binding description.
+
+Submitted to linux-hwmon mailing list at
+https://patchwork.kernel.org/project/linux-hwmon/patch/20220430114905.53448-3-michaelsh@nvidia.com/
+
+Add basic description of emc2305 driver device tree binding.
+
+Signed-off-by: Michael Shych <michaelsh@nvidia.com>
+Reviewed-by: Vadim Pasternak <vadimp@nvidia.com>
+
+dtbindings: Fixup microchip,emc2305.yaml bindings
+
+The bindings submitted to mainline had some issues, so fix them up.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../bindings/hwmon/microchip,emc2305.yaml     | 54 +++++++++++++++++++
+ 1 file changed, 54 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/hwmon/microchip,emc2305.yaml
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/hwmon/microchip,emc2305.yaml
+@@ -0,0 +1,54 @@
++# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
++%YAML 1.2
++---
++
++$id: http://devicetree.org/schemas/hwmon/emc2305.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Microchip EMC230[1|2|3|5] RPM-based PWM Fan Speed Controller
++
++properties:
++  compatible:
++    enum:
++      - microchip,emc2305
++      - microchip,emc2301
++  emc2305,pwm-min:
++    description:
++      Min pwm of emc2305
++    maxItems: 1
++  emc2305,pwm-max:
++    description:
++      Max pwm of emc2305
++    maxItems: 1
++  emc2305,pwm-channel:
++    description:
++      Max number of pwm channels
++    maxItems: 1
++  emcs205,max-state:
++    description:
++    maxItems: 1
++  emc2305,cooling-levels:
++    description:
++      Quantity of cooling level state.
++    maxItems: 1
++
++required:
++  - compatible
++
++optional:
++  - emc2305,min-pwm
++  - emc2305,max-pwm
++  - emc2305,pwm-channels
++  - emc2305,cooling-levels
++
++additionalProperties: false
++
++examples:
++  - |
++    fan {
++        compatible = "microchip,emc2305";
++        emc2305,pwm-min = <0>;
++        emc2305,pwm-max = <255>;
++        emc2305,pwm-channel = <5>
++        emc2305,cooling-levels = <10>;
++    };
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0285-hwmon-emc2305-fixups-for-driver-submitted-to-mailing.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0285-hwmon-emc2305-fixups-for-driver-submitted-to-mailing.patch
new file mode 100644
index 00000000..a1fc20bf
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0285-hwmon-emc2305-fixups-for-driver-submitted-to-mailing.patch
@@ -0,0 +1,223 @@
+From aae8abcb3906540b26e12339e35e9497362c44bb Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 5 May 2022 15:46:07 +0100
+Subject: [PATCH 285/697] hwmon: emc2305: fixups for driver submitted to
+ mailing lists
+
+The driver had a number of issues, checkpatch warnings/errors,
+and other limitations, so fix these up to make it usable.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+hwmon: emc2305: Add calls to initialise of cooling maps
+
+Commit 46ef9d4ed26b ("hwmon: emc2305: fixups for driver submitted to
+mailing lists") missed adding the call to thermal_of_cooling_device_register
+required to configure any cooling maps for the device, hence stopping it
+from actually ever changing speed.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+hwmon: emc2305: Change OF properties pwm-min & pwm-max to u8
+
+There is no DT binding for emc2305 as mainline are still
+discussing how to do a generic fan binding.
+The 5.15 driver was reading the "emc2305," properties
+"cooling-levels", "pwm-max", "pwm-min", and "pwm-channel" as u8.
+The overlay was writing them as u16 (;) so it was working.
+
+The 6.1 driver was reading as u32, which failed as there is
+insufficient data.
+
+As this is all downstream only, revert to u8 to match 5.15.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/hwmon/emc2305.c | 95 +++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 87 insertions(+), 8 deletions(-)
+
+--- a/drivers/hwmon/emc2305.c
++++ b/drivers/hwmon/emc2305.c
+@@ -12,12 +12,13 @@
+ #include <linux/platform_data/emc2305.h>
+ #include <linux/thermal.h>
+ 
++#define EMC2305_REG_FAN_STATUS		0x24
++#define EMC2305_REG_FAN_STALL_STATUS	0x25
+ #define EMC2305_REG_DRIVE_FAIL_STATUS	0x27
+ #define EMC2305_REG_VENDOR		0xfe
+ #define EMC2305_FAN_MAX			0xff
+ #define EMC2305_FAN_MIN			0x00
+ #define EMC2305_FAN_MAX_STATE		10
+-#define EMC2305_DEVICE			0x34
+ #define EMC2305_VENDOR			0x5d
+ #define EMC2305_REG_PRODUCT_ID		0xfd
+ #define EMC2305_TACH_REGS_UNUSE_BITS	3
+@@ -36,6 +37,7 @@
+ #define EMC2305_RPM_FACTOR		3932160
+ 
+ #define EMC2305_REG_FAN_DRIVE(n)	(0x30 + 0x10 * (n))
++#define EMC2305_REG_FAN_CFG(n)		(0x32 + 0x10 * (n))
+ #define EMC2305_REG_FAN_MIN_DRIVE(n)	(0x38 + 0x10 * (n))
+ #define EMC2305_REG_FAN_TACH(n)		(0x3e + 0x10 * (n))
+ 
+@@ -55,6 +57,15 @@ static const struct i2c_device_id emc230
+ };
+ MODULE_DEVICE_TABLE(i2c, emc2305_ids);
+ 
++static const struct of_device_id emc2305_dt_ids[] = {
++	{ .compatible = "microchip,emc2305" },
++	{ .compatible = "microchip,emc2303" },
++	{ .compatible = "microchip,emc2302" },
++	{ .compatible = "microchip,emc2301" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, emc2305_dt_ids);
++
+ /**
+  * struct emc2305_cdev_data - device-specific cooling device state
+  * @cdev: cooling device
+@@ -100,6 +111,7 @@ struct emc2305_data {
+ 	u8 pwm_num;
+ 	bool pwm_separate;
+ 	u8 pwm_min[EMC2305_PWM_MAX];
++	u8 pwm_max;
+ 	struct emc2305_cdev_data cdev_data[EMC2305_PWM_MAX];
+ };
+ 
+@@ -272,7 +284,7 @@ static int emc2305_set_pwm(struct device
+ 	struct i2c_client *client = data->client;
+ 	int ret;
+ 
+-	if (val < data->pwm_min[channel] || val > EMC2305_FAN_MAX)
++	if (val < data->pwm_min[channel] || val > data->pwm_max)
+ 		return -EINVAL;
+ 
+ 	ret = i2c_smbus_write_byte_data(client, EMC2305_REG_FAN_DRIVE(channel), val);
+@@ -283,6 +295,49 @@ static int emc2305_set_pwm(struct device
+ 	return 0;
+ }
+ 
++static int emc2305_get_tz_of(struct device *dev)
++{
++	struct device_node *np = dev->of_node;
++	struct emc2305_data *data = dev_get_drvdata(dev);
++	int ret = 0;
++	u8 val;
++	int i;
++
++	/* OF parameters are optional - overwrite default setting
++	 * if some of them are provided.
++	 */
++
++	ret = of_property_read_u8(np, "emc2305,cooling-levels", &val);
++	if (!ret)
++		data->max_state = val;
++	else if (ret != -EINVAL)
++		return ret;
++
++	ret = of_property_read_u8(np, "emc2305,pwm-max", &val);
++	if (!ret)
++		data->pwm_max = val;
++	else if (ret != -EINVAL)
++		return ret;
++
++	ret = of_property_read_u8(np, "emc2305,pwm-min", &val);
++	if (!ret)
++		for (i = 0; i < EMC2305_PWM_MAX; i++)
++			data->pwm_min[i] = val;
++	else if (ret != -EINVAL)
++		return ret;
++
++	/* Not defined or 0 means one thermal zone over all cooling devices.
++	 * Otherwise - separated thermal zones for each PWM channel.
++	 */
++	ret = of_property_read_u8(np, "emc2305,pwm-channel", &val);
++	if (!ret)
++		data->pwm_separate = (val != 0);
++	else if (ret != -EINVAL)
++		return ret;
++
++	return 0;
++}
++
+ static int emc2305_set_single_tz(struct device *dev, int idx)
+ {
+ 	struct emc2305_data *data = dev_get_drvdata(dev);
+@@ -292,9 +347,17 @@ static int emc2305_set_single_tz(struct
+ 	cdev_idx = (idx) ? idx - 1 : 0;
+ 	pwm = data->pwm_min[cdev_idx];
+ 
+-	data->cdev_data[cdev_idx].cdev =
+-		thermal_cooling_device_register(emc2305_fan_name[idx], data,
+-						&emc2305_cooling_ops);
++	if (dev->of_node)
++		data->cdev_data[cdev_idx].cdev =
++			devm_thermal_of_cooling_device_register(dev, dev->of_node,
++								emc2305_fan_name[idx],
++								data,
++								&emc2305_cooling_ops);
++	else
++		data->cdev_data[cdev_idx].cdev =
++			thermal_cooling_device_register(emc2305_fan_name[idx],
++							data,
++							&emc2305_cooling_ops);
+ 
+ 	if (IS_ERR(data->cdev_data[cdev_idx].cdev)) {
+ 		dev_err(dev, "Failed to register cooling device %s\n", emc2305_fan_name[idx]);
+@@ -347,9 +410,11 @@ static void emc2305_unset_tz(struct devi
+ 	int i;
+ 
+ 	/* Unregister cooling device. */
+-	for (i = 0; i < EMC2305_PWM_MAX; i++)
+-		if (data->cdev_data[i].cdev)
+-			thermal_cooling_device_unregister(data->cdev_data[i].cdev);
++	if (!dev->of_node) {
++		for (i = 0; i < EMC2305_PWM_MAX; i++)
++			if (data->cdev_data[i].cdev)
++				thermal_cooling_device_unregister(data->cdev_data[i].cdev);
++	}
+ }
+ 
+ static umode_t
+@@ -571,11 +636,18 @@ static int emc2305_probe(struct i2c_clie
+ 		data->pwm_separate = pdata->pwm_separate;
+ 		for (i = 0; i < EMC2305_PWM_MAX; i++)
+ 			data->pwm_min[i] = pdata->pwm_min[i];
++		data->pwm_max = EMC2305_FAN_MAX;
+ 	} else {
+ 		data->max_state = EMC2305_FAN_MAX_STATE;
+ 		data->pwm_separate = false;
+ 		for (i = 0; i < EMC2305_PWM_MAX; i++)
+ 			data->pwm_min[i] = EMC2305_FAN_MIN;
++		data->pwm_max = EMC2305_FAN_MAX;
++		if (dev->of_node) {
++			ret = emc2305_get_tz_of(dev);
++			if (ret < 0)
++				return ret;
++		}
+ 	}
+ 
+ 	data->hwmon_dev = devm_hwmon_device_register_with_info(dev, "emc2305", data,
+@@ -596,6 +668,12 @@ static int emc2305_probe(struct i2c_clie
+ 			return ret;
+ 	}
+ 
++	/* Acknowledge any existing faults. Stops the device responding on the
++	 * SMBus alert address.
++	 */
++	i2c_smbus_read_byte_data(client, EMC2305_REG_FAN_STALL_STATUS);
++	i2c_smbus_read_byte_data(client, EMC2305_REG_FAN_STATUS);
++
+ 	return 0;
+ }
+ 
+@@ -610,6 +688,7 @@ static void emc2305_remove(struct i2c_cl
+ static struct i2c_driver emc2305_driver = {
+ 	.driver = {
+ 		.name = "emc2305",
++		.of_match_table = emc2305_dt_ids,
+ 	},
+ 	.probe = emc2305_probe,
+ 	.remove	  = emc2305_remove,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0286-vc04_services-vchiq-mmal-Add-defines-for-mmal_es_for.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0286-vc04_services-vchiq-mmal-Add-defines-for-mmal_es_for.patch
new file mode 100644
index 00000000..7f0239f6
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0286-vc04_services-vchiq-mmal-Add-defines-for-mmal_es_for.patch
@@ -0,0 +1,34 @@
+From 51717fbb8afb767e7765b31b7fcadcfd32b6359e Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 16 May 2022 17:33:48 +0100
+Subject: [PATCH 286/697] vc04_services: vchiq-mmal: Add defines for
+ mmal_es_format flags
+
+There is a flags field in struct mmal_es_format, but the defines
+for what the bits meant weren't included in the headers.
+For V4L2_PIX_FMT_NV12_COL128 support we need them, so add them in.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../staging/vc04_services/vchiq-mmal/mmal-msg-format.h | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-msg-format.h
++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-msg-format.h
+@@ -53,6 +53,16 @@ union mmal_es_specific_format {
+ 	struct mmal_subpicture_format subpicture;
+ };
+ 
++/* The elementary stream will already be framed */
++#define MMAL_ES_FORMAT_FLAG_FRAMED				BIT(0)
++/*
++ * For column formats we ideally want to pass in the column stride. This hasn't
++ * been the past behaviour, so require a new flag to be set should
++ * es->video.width be the column stride (in lines) instead of an ignored width
++ * value.
++ */
++#define MMAL_ES_FORMAT_FLAG_COL_FMTS_WIDTH_IS_COL_STRIDE	BIT(1)
++
+ /* Definition of an elementary stream format (MMAL_ES_FORMAT_T) */
+ struct mmal_es_format_local {
+ 	u32 type;	/* enum mmal_es_type */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0287-random-do-not-use-jump-labels-before-they-are-initia.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0287-random-do-not-use-jump-labels-before-they-are-initia.patch
new file mode 100644
index 00000000..31a4f7a2
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0287-random-do-not-use-jump-labels-before-they-are-initia.patch
@@ -0,0 +1,86 @@
+From 125ff35c88a9755d80988f7485c6b451bcf4b5fb Mon Sep 17 00:00:00 2001
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Date: Tue, 7 Jun 2022 12:02:10 +0200
+Subject: [PATCH 287/697] random: do not use jump labels before they are
+ initialized
+
+[ I would like to pursue fixing this more directly first before actually
+  merging this, but I thought I'd send this to the list now anyway as a
+  the "backup" plan. If I can't figure out how to make headway on the
+  main plan in the next few days, it'll be easy to just do this. ]
+
+Stephen reported that a static key warning splat appears during early
+boot on systems that credit randomness from device trees that contain an
+"rng-seed" property, because because setup_machine_fdt() is called
+before jump_label_init() during setup_arch():
+
+ static_key_enable_cpuslocked(): static key '0xffffffe51c6fcfc0' used before call to jump_label_init()
+ WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:166 static_key_enable_cpuslocked+0xb0/0xb8
+ Modules linked in:
+ CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0+ #224 44b43e377bfc84bc99bb5ab885ff694984ee09ff
+ pstate: 600001c9 (nZCv dAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+ pc : static_key_enable_cpuslocked+0xb0/0xb8
+ lr : static_key_enable_cpuslocked+0xb0/0xb8
+ sp : ffffffe51c393cf0
+ x29: ffffffe51c393cf0 x28: 000000008185054c x27: 00000000f1042f10
+ x26: 0000000000000000 x25: 00000000f10302b2 x24: 0000002513200000
+ x23: 0000002513200000 x22: ffffffe51c1c9000 x21: fffffffdfdc00000
+ x20: ffffffe51c2f0831 x19: ffffffe51c6fcfc0 x18: 00000000ffff1020
+ x17: 00000000e1e2ac90 x16: 00000000000000e0 x15: ffffffe51b710708
+ x14: 0000000000000066 x13: 0000000000000018 x12: 0000000000000000
+ x11: 0000000000000000 x10: 00000000ffffffff x9 : 0000000000000000
+ x8 : 0000000000000000 x7 : 61632065726f6665 x6 : 6220646573752027
+ x5 : ffffffe51c641d25 x4 : ffffffe51c13142c x3 : ffff0a00ffffff05
+ x2 : 40000000ffffe003 x1 : 00000000000001c0 x0 : 0000000000000065
+ Call trace:
+  static_key_enable_cpuslocked+0xb0/0xb8
+  static_key_enable+0x2c/0x40
+  crng_set_ready+0x24/0x30
+  execute_in_process_context+0x80/0x90
+  _credit_init_bits+0x100/0x154
+  add_bootloader_randomness+0x64/0x78
+  early_init_dt_scan_chosen+0x140/0x184
+  early_init_dt_scan_nodes+0x28/0x4c
+  early_init_dt_scan+0x40/0x44
+  setup_machine_fdt+0x7c/0x120
+  setup_arch+0x74/0x1d8
+  start_kernel+0x84/0x44c
+  __primary_switched+0xc0/0xc8
+ ---[ end trace 0000000000000000 ]---
+ random: crng init done
+ Machine model: Google Lazor (rev1 - 2) with LTE
+
+A trivial fix went in to address this on arm64, 73e2d827a501 ("arm64:
+Initialize jump labels before setup_machine_fdt()"). But it appears that
+fixing it on other platforms might not be so trivial. Instead, defer the
+setting of the static branch until later in the boot process.
+
+Fixes: f5bda35fba61 ("random: use static branch for crng_ready()")
+Reported-by: Stephen Boyd <swboyd@chromium.org>
+Cc: Ard Biesheuvel <ardb@kernel.org>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Russell King <linux@armlinux.org.uk>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Phil Elwell <phil@raspberrypi.com>
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+---
+ drivers/char/random.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -867,6 +867,14 @@ void __init random_init_early(const char
+ 	unsigned long entropy[BLAKE2S_BLOCK_SIZE / sizeof(long)];
+ 	size_t i, longs, arch_bits;
+ 
++	/*
++	 * If we were initialized by the bootloader before jump labels are
++	 * initialized, then we should enable the static branch here, where
++	 * it's guaranteed that jump labels have been initialized.
++	 */
++	if (!static_branch_likely(&crng_is_ready) && crng_init >= CRNG_READY)
++		crng_set_ready(NULL);
++
+ #if defined(LATENT_ENTROPY_PLUGIN)
+ 	static const u8 compiletime_seed[BLAKE2S_BLOCK_SIZE] __initconst __latent_entropy;
+ 	_mix_pool_bytes(compiletime_seed, sizeof(compiletime_seed));
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0288-media-dt-bindings-media-i2c-Add-Arducam-64MP-CMOS-se.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0288-media-dt-bindings-media-i2c-Add-Arducam-64MP-CMOS-se.patch
new file mode 100644
index 00000000..d81fda34
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0288-media-dt-bindings-media-i2c-Add-Arducam-64MP-CMOS-se.patch
@@ -0,0 +1,151 @@
+From 87464872347325c676549179faa970b236135567 Mon Sep 17 00:00:00 2001
+From: Lee Jackson <info@arducam.com>
+Date: Fri, 13 May 2022 17:21:42 +0800
+Subject: [PATCH 288/697] media: dt-bindings: media: i2c: Add Arducam 64MP CMOS
+ sensor binding
+
+Add YAML device tree binding for Arducam 64MP CMOS image sensor, and
+the relevant MAINTAINERS entries.
+
+Signed-off-by: Lee Jackson <info@arducam.com>
+---
+ .../bindings/media/i2c/arducam,64mp.yaml      | 115 ++++++++++++++++++
+ MAINTAINERS                                   |   8 ++
+ 2 files changed, 123 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/media/i2c/arducam,64mp.yaml
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/i2c/arducam,64mp.yaml
+@@ -0,0 +1,115 @@
++# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/media/i2c/arducam,64mp.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Arducam 1/1.7-Inch 64Mpixel CMOS Digital Image Sensor
++
++maintainers:
++  - Lee Jackson <info@arducam.com>
++
++description: |-
++  The Arducam 1/1.7-Inch 64Mpixel CMOS active pixel digital image sensor
++  with an active array size of 9248 x 6944. It is programmable through
++  I2C interface. The I2C address is fixed to 0x1A as per sensor data sheet.
++  Image data is sent through MIPI CSI-2, which can be configured for operation
++  with either 2 or 4 data lanes.
++
++properties:
++  compatible:
++    const: arducam,64mp
++
++  reg:
++    description: I2C device address
++    maxItems: 1
++
++  clocks:
++    maxItems: 1
++
++  VDIG-supply:
++    description:
++      Digital I/O voltage supply, 1.05 volts
++
++  VANA-supply:
++    description:
++      Analog voltage supply, 2.8 volts
++
++  VDDL-supply:
++    description:
++      Digital core voltage supply, 1.8 volts
++
++  reset-gpios:
++    description: |-
++      Reference to the GPIO connected to the xclr pin, if any.
++      Must be released (set high) after all supplies and INCK are applied.
++
++  # See ../video-interfaces.txt for more details
++  port:
++    type: object
++    properties:
++      endpoint:
++        type: object
++        properties:
++          data-lanes:
++            description: |-
++              The sensor supports either two-lane, or four-lane operation.
++              For two-lane operation the property must be set to <1 2>.
++            anyOf:
++              - items:
++                  - const: 1
++                  - const: 2
++              - items:
++                  - const: 1
++                  - const: 2
++                  - const: 3
++                  - const: 4
++
++          clock-noncontinuous: true
++
++          link-frequencies:
++            allOf:
++              - $ref: /schemas/types.yaml#/definitions/uint64-array
++            description:
++              Allowed data bus frequencies.
++
++        required:
++          - link-frequencies
++
++required:
++  - compatible
++  - reg
++  - clocks
++  - VANA-supply
++  - VDIG-supply
++  - VDDL-supply
++  - port
++
++additionalProperties: false
++
++examples:
++  - |
++    i2c0 {
++        #address-cells = <1>;
++        #size-cells = <0>;
++
++        arducam_64mp: sensor@1a {
++            compatible = "arducam,64mp";
++            reg = <0x1a>;
++            clocks = <&arducam_64mp_clk>;
++            VANA-supply = <&arducam_64mp_vana>;   /* 2.8v */
++            VDIG-supply = <&arducam_64mp_vdig>;   /* 1.05v */
++            VDDL-supply = <&arducam_64mp_vddl>;   /* 1.8v */
++
++            port {
++                arducam_64mp_0: endpoint {
++                    remote-endpoint = <&csi1_ep>;
++                    data-lanes = <1 2>;
++                    clock-noncontinuous;
++                    link-frequencies = /bits/ 64 <456000000>;
++                };
++            };
++        };
++    };
++
++...
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -1752,6 +1752,14 @@ S:	Maintained
+ F:	drivers/net/arcnet/
+ F:	include/uapi/linux/if_arcnet.h
+ 
++ARDUCAM 64MP SENSOR DRIVER
++M:	Arducam Kernel Maintenance <info@arducam.com>
++L:	linux-media@vger.kernel.org
++S:	Maintained
++T:	git git://linuxtv.org/media_tree.git
++F:	Documentation/devicetree/bindings/media/i2c/arducam,64mp.yaml
++F:	drivers/media/i2c/arducam_64mp.c
++
+ ARDUCAM PIVARIETY SENSOR DRIVER
+ M:	Arducam Kernel Maintenance <info@arducam.com>
+ L:	linux-media@vger.kernel.org
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0289-media-i2c-Add-driver-of-Arducam-64MP-camera.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0289-media-i2c-Add-driver-of-Arducam-64MP-camera.patch
new file mode 100644
index 00000000..8194f859
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0289-media-i2c-Add-driver-of-Arducam-64MP-camera.patch
@@ -0,0 +1,2720 @@
+From 5f7f0d43d4365655d322e55aed8902279c09335d Mon Sep 17 00:00:00 2001
+From: Lee Jackson <info@arducam.com>
+Date: Fri, 13 May 2022 17:11:35 +0800
+Subject: [PATCH 289/697] media: i2c: Add driver of Arducam 64MP camera
+
+Add a driver for the Arducam 64MP camera sensor.
+Whilst the sensor supports 2 or 4 CSI2 data lanes, this driver
+currently only supports 2 lanes.
+
+The following Bayer modes are currently available:
+
+9152x6944 10-bit @ 2.7fps
+4624x3472 10-bit (binned) @ 10fps
+3840x2160 10-bit (cropped/binned) @ 20fps
+2312x1736 10-bit (binned) @ 30fps
+1920x1080 10-bit (cropped/binned) @ 60fps
+1280x720 10-bit (cropped/binned) @ 120fps
+
+Signed-off-by: Lee Jackson <info@arducam.com>
+
+media: i2c: arducam_64mp: Advertise embedded data node on media pad 1
+
+This commit updates the arducam_64mp driver to adverise support for
+embedded data streams.
+
+The arducam_64mp sensor subdevice overloads the media pad to differentiate
+between image stream (pad 0) and embedded data stream (pad 1) when
+performing the v4l2_subdev_pad_ops functions.
+
+Signed-off-by: Lee Jackson <info@arducam.com>
+
+media: i2c: arducam_64mp: Modify the line length of 1280x720 resolution
+
+Arducam 64MP has specific requirements for the line length, and if these
+conditions are not met, the camera will not function properly. Under the
+previous configuration, once a stream off operation is performed, the
+camera will not output any data, even if a stream on operation is
+performed. This prevents us from switching from 1280x720 to another
+resolution.
+
+Signed-off-by: Lee Jackson <lee.jackson@arducam.com>
+
+media: i2c: arducam_64mp: Add 8000x6000 resolution
+
+Added 8000x6000 10-bit (cropped) @ 3fps mode for Arducam 64MP
+
+Signed-off-by: Lee Jackson <lee.jackson@arducam.com>
+
+media: i2c: arducam_64mp: Add PDAF support
+
+Enable PDAF output for all modes, and also need to modify Embedded Line
+Width to 11560 * 3 (two lines of Embedded Data + one line of PDAF).
+
+Signed-off-by: Lee Jackson <lee.jackson@arducam.com>
+
+drivers: media: arducam_64mp: Add V4L2_CID_LINK_FREQ control
+
+Add V4L2_CID_LINK_FREQ as a read-only control with a value of 456 Mhz.
+This will be used by the CFE driver to corretly setup the DPHY timing
+parameters in the CSI-2 block.
+
+Signed-off-by: Lee Jackson <lee.jackson@arducam.com>
+---
+ drivers/media/i2c/Kconfig        |   11 +
+ drivers/media/i2c/Makefile       |    1 +
+ drivers/media/i2c/arducam_64mp.c | 2618 ++++++++++++++++++++++++++++++
+ 3 files changed, 2630 insertions(+)
+ create mode 100644 drivers/media/i2c/arducam_64mp.c
+
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -100,6 +100,17 @@ config VIDEO_GC2145
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called gc2145.
+ 
++config VIDEO_ARDUCAM_64MP
++	tristate "Arducam 64MP sensor support"
++	depends on I2C && VIDEO_DEV
++	select VIDEO_V4L2_SUBDEV_API
++	help
++	  This is a Video4Linux2 sensor driver for the Arducam
++	  64MP camera.
++
++	  To compile this driver as a module, choose M here: the
++	  module will be called arducam_64mp.
++
+ config VIDEO_ARDUCAM_PIVARIETY
+ 	tristate "Arducam Pivariety sensor support"
+ 	depends on I2C && VIDEO_DEV
+--- a/drivers/media/i2c/Makefile
++++ b/drivers/media/i2c/Makefile
+@@ -21,6 +21,7 @@ obj-$(CONFIG_VIDEO_AK881X) += ak881x.o
+ obj-$(CONFIG_VIDEO_ALVIUM_CSI2) += alvium-csi2.o
+ obj-$(CONFIG_VIDEO_APTINA_PLL) += aptina-pll.o
+ obj-$(CONFIG_VIDEO_AR0521) += ar0521.o
++obj-$(CONFIG_VIDEO_ARDUCAM_64MP) += arducam_64mp.o
+ obj-$(CONFIG_VIDEO_ARDUCAM_PIVARIETY) += arducam-pivariety.o
+ obj-$(CONFIG_VIDEO_BT819) += bt819.o
+ obj-$(CONFIG_VIDEO_BT856) += bt856.o
+--- /dev/null
++++ b/drivers/media/i2c/arducam_64mp.c
+@@ -0,0 +1,2618 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * A V4L2 driver for Arducam 64MP cameras.
++ * Copyright (C) 2021 Arducam Technology co., Ltd.
++ *
++ * Based on Sony IMX477 camera driver
++ * Copyright (C) 2020 Raspberry Pi (Trading) Ltd
++ */
++#include <linux/unaligned.h>
++#include <linux/clk.h>
++#include <linux/delay.h>
++#include <linux/gpio/consumer.h>
++#include <linux/i2c.h>
++#include <linux/module.h>
++#include <linux/of_device.h>
++#include <linux/pm_runtime.h>
++#include <linux/regulator/consumer.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-event.h>
++#include <media/v4l2-fwnode.h>
++#include <media/v4l2-mediabus.h>
++
++#define ARDUCAM_64MP_REG_VALUE_08BIT	1
++#define ARDUCAM_64MP_REG_VALUE_16BIT	2
++
++/* Chip ID */
++#define ARDUCAM_64MP_REG_CHIP_ID	0x005E
++#define ARDUCAM_64MP_CHIP_ID		0x4136
++
++#define ARDUCAM_64MP_REG_MODE_SELECT	0x0100
++#define ARDUCAM_64MP_MODE_STANDBY	0x00
++#define ARDUCAM_64MP_MODE_STREAMING	0x01
++
++#define ARDUCAM_64MP_REG_ORIENTATION	0x101
++
++#define ARDUCAM_64MP_XCLK_FREQ		24000000
++
++#define ARDUCAM_64MP_DEFAULT_LINK_FREQ	456000000
++
++/* Pixel rate is fixed at 900MHz for all the modes */
++#define ARDUCAM_64MP_PIXEL_RATE		900000000
++
++/* V_TIMING internal */
++#define ARDUCAM_64MP_REG_FRAME_LENGTH	0x0340
++#define ARDUCAM_64MP_FRAME_LENGTH_MAX	0xffff
++
++/* Long exposure multiplier */
++#define ARDUCAM_64MP_LONG_EXP_SHIFT_MAX	7
++#define ARDUCAM_64MP_LONG_EXP_SHIFT_REG	0x3100
++
++/* Exposure control */
++#define ARDUCAM_64MP_REG_EXPOSURE	0x0202
++#define ARDUCAM_64MP_EXPOSURE_OFFSET	48
++#define ARDUCAM_64MP_EXPOSURE_MIN	9
++#define ARDUCAM_64MP_EXPOSURE_STEP	1
++#define ARDUCAM_64MP_EXPOSURE_DEFAULT	0x3e8
++#define ARDUCAM_64MP_EXPOSURE_MAX	(ARDUCAM_64MP_FRAME_LENGTH_MAX - \
++					 ARDUCAM_64MP_EXPOSURE_OFFSET)
++
++/* Analog gain control */
++#define ARDUCAM_64MP_REG_ANALOG_GAIN		0x0204
++#define ARDUCAM_64MP_ANA_GAIN_MIN		0
++#define ARDUCAM_64MP_ANA_GAIN_MAX		1008
++#define ARDUCAM_64MP_ANA_GAIN_STEP		1
++#define ARDUCAM_64MP_ANA_GAIN_DEFAULT		0x0
++
++/* Digital gain control */
++#define ARDUCAM_64MP_REG_DIGITAL_GAIN		0x020e
++#define ARDUCAM_64MP_DGTL_GAIN_MIN		0x0100
++#define ARDUCAM_64MP_DGTL_GAIN_MAX		0x0fff
++#define ARDUCAM_64MP_DGTL_GAIN_DEFAULT		0x0100
++#define ARDUCAM_64MP_DGTL_GAIN_STEP		1
++
++/* Test Pattern Control */
++#define ARDUCAM_64MP_REG_TEST_PATTERN		0x0600
++#define ARDUCAM_64MP_TEST_PATTERN_DISABLE	0
++#define ARDUCAM_64MP_TEST_PATTERN_SOLID_COLOR	1
++#define ARDUCAM_64MP_TEST_PATTERN_COLOR_BARS	2
++#define ARDUCAM_64MP_TEST_PATTERN_GREY_COLOR	3
++#define ARDUCAM_64MP_TEST_PATTERN_PN9		4
++
++/* Test pattern colour components */
++#define ARDUCAM_64MP_REG_TEST_PATTERN_R		0x0602
++#define ARDUCAM_64MP_REG_TEST_PATTERN_GR	0x0604
++#define ARDUCAM_64MP_REG_TEST_PATTERN_B		0x0606
++#define ARDUCAM_64MP_REG_TEST_PATTERN_GB	0x0608
++#define ARDUCAM_64MP_TEST_PATTERN_COLOUR_MIN	0
++#define ARDUCAM_64MP_TEST_PATTERN_COLOUR_MAX	0x0fff
++#define ARDUCAM_64MP_TEST_PATTERN_COLOUR_STEP	1
++#define ARDUCAM_64MP_TEST_PATTERN_R_DEFAULT	\
++	ARDUCAM_64MP_TEST_PATTERN_COLOUR_MAX
++#define ARDUCAM_64MP_TEST_PATTERN_GR_DEFAULT	0
++#define ARDUCAM_64MP_TEST_PATTERN_B_DEFAULT	0
++#define ARDUCAM_64MP_TEST_PATTERN_GB_DEFAULT	0
++
++/* Embedded metadata stream structure */
++#define ARDUCAM_64MP_EMBEDDED_LINE_WIDTH (11560 * 3)
++#define ARDUCAM_64MP_NUM_EMBEDDED_LINES 1
++
++enum pad_types {
++	IMAGE_PAD,
++	METADATA_PAD,
++	NUM_PADS
++};
++
++/* ARDUCAM_64MP native and active pixel array size. */
++#define ARDUCAM_64MP_NATIVE_WIDTH		9344U
++#define ARDUCAM_64MP_NATIVE_HEIGHT		7032U
++#define ARDUCAM_64MP_PIXEL_ARRAY_LEFT		48U
++#define ARDUCAM_64MP_PIXEL_ARRAY_TOP		40U
++#define ARDUCAM_64MP_PIXEL_ARRAY_WIDTH		9248U
++#define ARDUCAM_64MP_PIXEL_ARRAY_HEIGHT		6944U
++
++struct arducam_64mp_reg {
++	u16 address;
++	u8 val;
++};
++
++struct arducam_64mp_reg_list {
++	unsigned int num_of_regs;
++	const struct arducam_64mp_reg *regs;
++};
++
++/* Mode : resolution and related config&values */
++struct arducam_64mp_mode {
++	/* Frame width */
++	unsigned int width;
++
++	/* Frame height */
++	unsigned int height;
++
++	/* H-timing in pixels */
++	unsigned int line_length_pix;
++
++	/* Analog crop rectangle. */
++	struct v4l2_rect crop;
++
++	/* Default framerate. */
++	struct v4l2_fract timeperframe_default;
++
++	/* Default register values */
++	struct arducam_64mp_reg_list reg_list;
++};
++
++static const s64 arducam_64mp_link_freq_menu[] = {
++	ARDUCAM_64MP_DEFAULT_LINK_FREQ,
++};
++
++static const struct arducam_64mp_reg mode_common_regs[] = {
++	{0x0100, 0x00},
++	{0x0136, 0x18},
++	{0x0137, 0x00},
++	{0x33F0, 0x01},
++	{0x33F1, 0x03},
++	{0x0111, 0x02},
++	{0x3062, 0x00},
++	{0x3063, 0x30},
++	{0x3076, 0x00},
++	{0x3077, 0x30},
++	{0x1f06, 0x06},
++	{0x1f07, 0x82},
++	{0x1f04, 0x71},
++	{0x1f05, 0x01},
++	{0x1f08, 0x01},
++	{0x5bfe, 0x14},
++	{0x5c0d, 0x2d},
++	{0x5c1c, 0x30},
++	{0x5c2b, 0x32},
++	{0x5c37, 0x2e},
++	{0x5c40, 0x30},
++	{0x5c50, 0x14},
++	{0x5c5f, 0x28},
++	{0x5c6e, 0x28},
++	{0x5c7d, 0x32},
++	{0x5c89, 0x37},
++	{0x5c92, 0x56},
++	{0x5bfc, 0x12},
++	{0x5c0b, 0x2a},
++	{0x5c1a, 0x2c},
++	{0x5c29, 0x2f},
++	{0x5c36, 0x2e},
++	{0x5c3f, 0x2e},
++	{0x5c4e, 0x06},
++	{0x5c5d, 0x1e},
++	{0x5c6c, 0x20},
++	{0x5c7b, 0x1e},
++	{0x5c88, 0x32},
++	{0x5c91, 0x32},
++	{0x5c02, 0x14},
++	{0x5c11, 0x2f},
++	{0x5c20, 0x32},
++	{0x5c2f, 0x34},
++	{0x5c39, 0x31},
++	{0x5c42, 0x31},
++	{0x5c8b, 0x28},
++	{0x5c94, 0x28},
++	{0x5c00, 0x10},
++	{0x5c0f, 0x2c},
++	{0x5c1e, 0x2e},
++	{0x5c2d, 0x32},
++	{0x5c38, 0x2e},
++	{0x5c41, 0x2b},
++	{0x5c61, 0x0a},
++	{0x5c70, 0x0a},
++	{0x5c7f, 0x0a},
++	{0x5c8a, 0x1e},
++	{0x5c93, 0x2a},
++	{0x5bfa, 0x2b},
++	{0x5c09, 0x2d},
++	{0x5c18, 0x2e},
++	{0x5c27, 0x30},
++	{0x5c5b, 0x28},
++	{0x5c6a, 0x22},
++	{0x5c79, 0x42},
++	{0x5bfb, 0x2c},
++	{0x5c0a, 0x2f},
++	{0x5c19, 0x2e},
++	{0x5c28, 0x2e},
++	{0x5c4d, 0x20},
++	{0x5c5c, 0x1e},
++	{0x5c6b, 0x32},
++	{0x5c7a, 0x32},
++	{0x5bfd, 0x30},
++	{0x5c0c, 0x32},
++	{0x5c1b, 0x2e},
++	{0x5c2a, 0x30},
++	{0x5c4f, 0x28},
++	{0x5c5e, 0x32},
++	{0x5c6d, 0x37},
++	{0x5c7c, 0x56},
++	{0x5bff, 0x2e},
++	{0x5c0e, 0x32},
++	{0x5c1d, 0x2e},
++	{0x5c2c, 0x2b},
++	{0x5c51, 0x0a},
++	{0x5c60, 0x0a},
++	{0x5c6f, 0x1e},
++	{0x5c7e, 0x2a},
++	{0x5c01, 0x32},
++	{0x5c10, 0x34},
++	{0x5c1f, 0x31},
++	{0x5c2e, 0x31},
++	{0x5c71, 0x28},
++	{0x5c80, 0x28},
++	{0x5c4c, 0x2a},
++	{0x33f2, 0x01},
++	{0x1f04, 0x73},
++	{0x1f05, 0x01},
++	{0x5bfa, 0x35},
++	{0x5c09, 0x38},
++	{0x5c18, 0x3a},
++	{0x5c27, 0x38},
++	{0x5c5b, 0x25},
++	{0x5c6a, 0x24},
++	{0x5c79, 0x47},
++	{0x5bfc, 0x15},
++	{0x5c0b, 0x2e},
++	{0x5c1a, 0x36},
++	{0x5c29, 0x38},
++	{0x5c36, 0x36},
++	{0x5c3f, 0x36},
++	{0x5c4e, 0x0b},
++	{0x5c5d, 0x20},
++	{0x5c6c, 0x2a},
++	{0x5c7b, 0x25},
++	{0x5c88, 0x25},
++	{0x5c91, 0x22},
++	{0x5bfe, 0x15},
++	{0x5c0d, 0x32},
++	{0x5c1c, 0x36},
++	{0x5c2b, 0x36},
++	{0x5c37, 0x3a},
++	{0x5c40, 0x39},
++	{0x5c50, 0x06},
++	{0x5c5f, 0x22},
++	{0x5c6e, 0x23},
++	{0x5c7d, 0x2e},
++	{0x5c89, 0x44},
++	{0x5c92, 0x51},
++	{0x5d7f, 0x0a},
++	{0x5c00, 0x17},
++	{0x5c0f, 0x36},
++	{0x5c1e, 0x38},
++	{0x5c2d, 0x3c},
++	{0x5c38, 0x38},
++	{0x5c41, 0x36},
++	{0x5c52, 0x0a},
++	{0x5c61, 0x21},
++	{0x5c70, 0x23},
++	{0x5c7f, 0x1b},
++	{0x5c8a, 0x22},
++	{0x5c93, 0x20},
++	{0x5c02, 0x1a},
++	{0x5c11, 0x3e},
++	{0x5c20, 0x3f},
++	{0x5c2f, 0x3d},
++	{0x5c39, 0x3e},
++	{0x5c42, 0x3c},
++	{0x5c54, 0x02},
++	{0x5c63, 0x12},
++	{0x5c72, 0x14},
++	{0x5c81, 0x24},
++	{0x5c8b, 0x1c},
++	{0x5c94, 0x4e},
++	{0x5d8a, 0x09},
++	{0x5bfb, 0x36},
++	{0x5c0a, 0x38},
++	{0x5c19, 0x36},
++	{0x5c28, 0x36},
++	{0x5c4d, 0x2a},
++	{0x5c5c, 0x25},
++	{0x5c6b, 0x25},
++	{0x5c7a, 0x22},
++	{0x5bfd, 0x36},
++	{0x5c0c, 0x36},
++	{0x5c1b, 0x3a},
++	{0x5c2a, 0x39},
++	{0x5c4f, 0x23},
++	{0x5c5e, 0x2e},
++	{0x5c6d, 0x44},
++	{0x5c7c, 0x51},
++	{0x5d63, 0x0a},
++	{0x5bff, 0x38},
++	{0x5c0e, 0x3c},
++	{0x5c1d, 0x38},
++	{0x5c2c, 0x36},
++	{0x5c51, 0x23},
++	{0x5c60, 0x1b},
++	{0x5c6f, 0x22},
++	{0x5c7e, 0x20},
++	{0x5c01, 0x3f},
++	{0x5c10, 0x3d},
++	{0x5c1f, 0x3e},
++	{0x5c2e, 0x3c},
++	{0x5c53, 0x14},
++	{0x5c62, 0x24},
++	{0x5c71, 0x1c},
++	{0x5c80, 0x4e},
++	{0x5d76, 0x09},
++	{0x5c4c, 0x2a},
++	{0x33f2, 0x02},
++	{0x1f04, 0x78},
++	{0x1f05, 0x01},
++	{0x5bfa, 0x37},
++	{0x5c09, 0x36},
++	{0x5c18, 0x39},
++	{0x5c27, 0x38},
++	{0x5c5b, 0x27},
++	{0x5c6a, 0x2b},
++	{0x5c79, 0x48},
++	{0x5bfc, 0x16},
++	{0x5c0b, 0x32},
++	{0x5c1a, 0x33},
++	{0x5c29, 0x37},
++	{0x5c36, 0x36},
++	{0x5c3f, 0x35},
++	{0x5c4e, 0x0d},
++	{0x5c5d, 0x2d},
++	{0x5c6c, 0x23},
++	{0x5c7b, 0x25},
++	{0x5c88, 0x31},
++	{0x5c91, 0x2e},
++	{0x5bfe, 0x15},
++	{0x5c0d, 0x31},
++	{0x5c1c, 0x35},
++	{0x5c2b, 0x36},
++	{0x5c37, 0x35},
++	{0x5c40, 0x37},
++	{0x5c50, 0x0f},
++	{0x5c5f, 0x31},
++	{0x5c6e, 0x30},
++	{0x5c7d, 0x33},
++	{0x5c89, 0x36},
++	{0x5c92, 0x5b},
++	{0x5c00, 0x13},
++	{0x5c0f, 0x2f},
++	{0x5c1e, 0x2e},
++	{0x5c2d, 0x34},
++	{0x5c38, 0x33},
++	{0x5c41, 0x32},
++	{0x5c52, 0x0d},
++	{0x5c61, 0x27},
++	{0x5c70, 0x28},
++	{0x5c7f, 0x1f},
++	{0x5c8a, 0x25},
++	{0x5c93, 0x2c},
++	{0x5c02, 0x15},
++	{0x5c11, 0x36},
++	{0x5c20, 0x39},
++	{0x5c2f, 0x3a},
++	{0x5c39, 0x37},
++	{0x5c42, 0x37},
++	{0x5c54, 0x04},
++	{0x5c63, 0x1c},
++	{0x5c72, 0x1c},
++	{0x5c81, 0x1c},
++	{0x5c8b, 0x28},
++	{0x5c94, 0x24},
++	{0x5bfb, 0x33},
++	{0x5c0a, 0x37},
++	{0x5c19, 0x36},
++	{0x5c28, 0x35},
++	{0x5c4d, 0x23},
++	{0x5c5c, 0x25},
++	{0x5c6b, 0x31},
++	{0x5c7a, 0x2e},
++	{0x5bfd, 0x35},
++	{0x5c0c, 0x36},
++	{0x5c1b, 0x35},
++	{0x5c2a, 0x37},
++	{0x5c4f, 0x30},
++	{0x5c5e, 0x33},
++	{0x5c6d, 0x36},
++	{0x5c7c, 0x5b},
++	{0x5bff, 0x2e},
++	{0x5c0e, 0x34},
++	{0x5c1d, 0x33},
++	{0x5c2c, 0x32},
++	{0x5c51, 0x28},
++	{0x5c60, 0x1f},
++	{0x5c6f, 0x25},
++	{0x5c7e, 0x2c},
++	{0x5c01, 0x39},
++	{0x5c10, 0x3a},
++	{0x5c1f, 0x37},
++	{0x5c2e, 0x37},
++	{0x5c53, 0x1c},
++	{0x5c62, 0x1c},
++	{0x5c71, 0x28},
++	{0x5c80, 0x24},
++	{0x5c4c, 0x2c},
++	{0x33f2, 0x03},
++	{0x1f08, 0x00},
++	{0x32c8, 0x00},
++	{0x4017, 0x40},
++	{0x40a2, 0x01},
++	{0x40ac, 0x01},
++	{0x4328, 0x00},
++	{0x4329, 0xb3},
++	{0x4e15, 0x10},
++	{0x4e19, 0x2f},
++	{0x4e21, 0x0f},
++	{0x4e2f, 0x10},
++	{0x4e3d, 0x10},
++	{0x4e41, 0x2f},
++	{0x4e57, 0x29},
++	{0x4ffb, 0x2f},
++	{0x5011, 0x24},
++	{0x501d, 0x03},
++	{0x505f, 0x41},
++	{0x5060, 0xdf},
++	{0x5065, 0xdf},
++	{0x5066, 0x37},
++	{0x506e, 0x57},
++	{0x5070, 0xc5},
++	{0x5072, 0x57},
++	{0x5075, 0x53},
++	{0x5076, 0x55},
++	{0x5077, 0xc1},
++	{0x5078, 0xc3},
++	{0x5079, 0x53},
++	{0x507a, 0x55},
++	{0x507d, 0x57},
++	{0x507e, 0xdf},
++	{0x507f, 0xc5},
++	{0x5081, 0x57},
++	{0x53c8, 0x01},
++	{0x53c9, 0xe2},
++	{0x53ca, 0x03},
++	{0x5422, 0x7a},
++	{0x548e, 0x40},
++	{0x5497, 0x5e},
++	{0x54a1, 0x40},
++	{0x54a9, 0x40},
++	{0x54b2, 0x5e},
++	{0x54bc, 0x40},
++	{0x57c6, 0x00},
++	{0x583d, 0x0e},
++	{0x583e, 0x0e},
++	{0x583f, 0x0e},
++	{0x5840, 0x0e},
++	{0x5841, 0x0e},
++	{0x5842, 0x0e},
++	{0x5900, 0x12},
++	{0x5901, 0x12},
++	{0x5902, 0x14},
++	{0x5903, 0x12},
++	{0x5904, 0x14},
++	{0x5905, 0x12},
++	{0x5906, 0x14},
++	{0x5907, 0x12},
++	{0x590f, 0x12},
++	{0x5911, 0x12},
++	{0x5913, 0x12},
++	{0x591c, 0x12},
++	{0x591e, 0x12},
++	{0x5920, 0x12},
++	{0x5948, 0x08},
++	{0x5949, 0x08},
++	{0x594a, 0x08},
++	{0x594b, 0x08},
++	{0x594c, 0x08},
++	{0x594d, 0x08},
++	{0x594e, 0x08},
++	{0x594f, 0x08},
++	{0x595c, 0x08},
++	{0x595e, 0x08},
++	{0x5960, 0x08},
++	{0x596e, 0x08},
++	{0x5970, 0x08},
++	{0x5972, 0x08},
++	{0x597e, 0x0f},
++	{0x597f, 0x0f},
++	{0x599a, 0x0f},
++	{0x59de, 0x08},
++	{0x59df, 0x08},
++	{0x59fa, 0x08},
++	{0x5a59, 0x22},
++	{0x5a5b, 0x22},
++	{0x5a5d, 0x1a},
++	{0x5a5f, 0x22},
++	{0x5a61, 0x1a},
++	{0x5a63, 0x22},
++	{0x5a65, 0x1a},
++	{0x5a67, 0x22},
++	{0x5a77, 0x22},
++	{0x5a7b, 0x22},
++	{0x5a7f, 0x22},
++	{0x5a91, 0x22},
++	{0x5a95, 0x22},
++	{0x5a99, 0x22},
++	{0x5ae9, 0x66},
++	{0x5aeb, 0x66},
++	{0x5aed, 0x5e},
++	{0x5aef, 0x66},
++	{0x5af1, 0x5e},
++	{0x5af3, 0x66},
++	{0x5af5, 0x5e},
++	{0x5af7, 0x66},
++	{0x5b07, 0x66},
++	{0x5b0b, 0x66},
++	{0x5b0f, 0x66},
++	{0x5b21, 0x66},
++	{0x5b25, 0x66},
++	{0x5b29, 0x66},
++	{0x5b79, 0x46},
++	{0x5b7b, 0x3e},
++	{0x5b7d, 0x3e},
++	{0x5b89, 0x46},
++	{0x5b8b, 0x46},
++	{0x5b97, 0x46},
++	{0x5b99, 0x46},
++	{0x5c9e, 0x0a},
++	{0x5c9f, 0x08},
++	{0x5ca0, 0x0a},
++	{0x5ca1, 0x0a},
++	{0x5ca2, 0x0b},
++	{0x5ca3, 0x06},
++	{0x5ca4, 0x04},
++	{0x5ca5, 0x06},
++	{0x5ca6, 0x04},
++	{0x5cad, 0x0b},
++	{0x5cae, 0x0a},
++	{0x5caf, 0x0c},
++	{0x5cb0, 0x0a},
++	{0x5cb1, 0x0b},
++	{0x5cb2, 0x08},
++	{0x5cb3, 0x06},
++	{0x5cb4, 0x08},
++	{0x5cb5, 0x04},
++	{0x5cbc, 0x0b},
++	{0x5cbd, 0x09},
++	{0x5cbe, 0x08},
++	{0x5cbf, 0x09},
++	{0x5cc0, 0x0a},
++	{0x5cc1, 0x08},
++	{0x5cc2, 0x06},
++	{0x5cc3, 0x08},
++	{0x5cc4, 0x06},
++	{0x5ccb, 0x0a},
++	{0x5ccc, 0x09},
++	{0x5ccd, 0x0a},
++	{0x5cce, 0x08},
++	{0x5ccf, 0x0a},
++	{0x5cd0, 0x08},
++	{0x5cd1, 0x08},
++	{0x5cd2, 0x08},
++	{0x5cd3, 0x08},
++	{0x5cda, 0x09},
++	{0x5cdb, 0x09},
++	{0x5cdc, 0x08},
++	{0x5cdd, 0x08},
++	{0x5ce3, 0x09},
++	{0x5ce4, 0x08},
++	{0x5ce5, 0x08},
++	{0x5ce6, 0x08},
++	{0x5cf4, 0x04},
++	{0x5d04, 0x04},
++	{0x5d13, 0x06},
++	{0x5d22, 0x06},
++	{0x5d23, 0x04},
++	{0x5d2e, 0x06},
++	{0x5d37, 0x06},
++	{0x5d6f, 0x09},
++	{0x5d72, 0x0f},
++	{0x5d88, 0x0f},
++	{0x5de6, 0x01},
++	{0x5de7, 0x01},
++	{0x5de8, 0x01},
++	{0x5de9, 0x01},
++	{0x5dea, 0x01},
++	{0x5deb, 0x01},
++	{0x5dec, 0x01},
++	{0x5df2, 0x01},
++	{0x5df3, 0x01},
++	{0x5df4, 0x01},
++	{0x5df5, 0x01},
++	{0x5df6, 0x01},
++	{0x5df7, 0x01},
++	{0x5df8, 0x01},
++	{0x5dfe, 0x01},
++	{0x5dff, 0x01},
++	{0x5e00, 0x01},
++	{0x5e01, 0x01},
++	{0x5e02, 0x01},
++	{0x5e03, 0x01},
++	{0x5e04, 0x01},
++	{0x5e0a, 0x01},
++	{0x5e0b, 0x01},
++	{0x5e0c, 0x01},
++	{0x5e0d, 0x01},
++	{0x5e0e, 0x01},
++	{0x5e0f, 0x01},
++	{0x5e10, 0x01},
++	{0x5e16, 0x01},
++	{0x5e17, 0x01},
++	{0x5e18, 0x01},
++	{0x5e1e, 0x01},
++	{0x5e1f, 0x01},
++	{0x5e20, 0x01},
++	{0x5e6e, 0x5a},
++	{0x5e6f, 0x46},
++	{0x5e70, 0x46},
++	{0x5e71, 0x3c},
++	{0x5e72, 0x3c},
++	{0x5e73, 0x28},
++	{0x5e74, 0x28},
++	{0x5e75, 0x6e},
++	{0x5e76, 0x6e},
++	{0x5e81, 0x46},
++	{0x5e83, 0x3c},
++	{0x5e85, 0x28},
++	{0x5e87, 0x6e},
++	{0x5e92, 0x46},
++	{0x5e94, 0x3c},
++	{0x5e96, 0x28},
++	{0x5e98, 0x6e},
++	{0x5ecb, 0x26},
++	{0x5ecc, 0x26},
++	{0x5ecd, 0x26},
++	{0x5ece, 0x26},
++	{0x5ed2, 0x26},
++	{0x5ed3, 0x26},
++	{0x5ed4, 0x26},
++	{0x5ed5, 0x26},
++	{0x5ed9, 0x26},
++	{0x5eda, 0x26},
++	{0x5ee5, 0x08},
++	{0x5ee6, 0x08},
++	{0x5ee7, 0x08},
++	{0x6006, 0x14},
++	{0x6007, 0x14},
++	{0x6008, 0x14},
++	{0x6009, 0x14},
++	{0x600a, 0x14},
++	{0x600b, 0x14},
++	{0x600c, 0x14},
++	{0x600d, 0x22},
++	{0x600e, 0x22},
++	{0x600f, 0x14},
++	{0x601a, 0x14},
++	{0x601b, 0x14},
++	{0x601c, 0x14},
++	{0x601d, 0x14},
++	{0x601e, 0x14},
++	{0x601f, 0x14},
++	{0x6020, 0x14},
++	{0x6021, 0x22},
++	{0x6022, 0x22},
++	{0x6023, 0x14},
++	{0x602e, 0x14},
++	{0x602f, 0x14},
++	{0x6030, 0x14},
++	{0x6031, 0x22},
++	{0x6039, 0x14},
++	{0x603a, 0x14},
++	{0x603b, 0x14},
++	{0x603c, 0x22},
++	{0x6132, 0x0f},
++	{0x6133, 0x0f},
++	{0x6134, 0x0f},
++	{0x6135, 0x0f},
++	{0x6136, 0x0f},
++	{0x6137, 0x0f},
++	{0x6138, 0x0f},
++	{0x613e, 0x0f},
++	{0x613f, 0x0f},
++	{0x6140, 0x0f},
++	{0x6141, 0x0f},
++	{0x6142, 0x0f},
++	{0x6143, 0x0f},
++	{0x6144, 0x0f},
++	{0x614a, 0x0f},
++	{0x614b, 0x0f},
++	{0x614c, 0x0f},
++	{0x614d, 0x0f},
++	{0x614e, 0x0f},
++	{0x614f, 0x0f},
++	{0x6150, 0x0f},
++	{0x6156, 0x0f},
++	{0x6157, 0x0f},
++	{0x6158, 0x0f},
++	{0x6159, 0x0f},
++	{0x615a, 0x0f},
++	{0x615b, 0x0f},
++	{0x615c, 0x0f},
++	{0x6162, 0x0f},
++	{0x6163, 0x0f},
++	{0x6164, 0x0f},
++	{0x616a, 0x0f},
++	{0x616b, 0x0f},
++	{0x616c, 0x0f},
++	{0x6226, 0x00},
++	{0x84f8, 0x01},
++	{0x8501, 0x00},
++	{0x8502, 0x01},
++	{0x8505, 0x00},
++	{0x8744, 0x00},
++	{0x883c, 0x01},
++	{0x8845, 0x00},
++	{0x8846, 0x01},
++	{0x8849, 0x00},
++	{0x9004, 0x1f},
++	{0x9064, 0x4d},
++	{0x9065, 0x3d},
++	{0x922e, 0x91},
++	{0x922f, 0x2a},
++	{0x9230, 0xe2},
++	{0x9231, 0xc0},
++	{0x9232, 0xe2},
++	{0x9233, 0xc1},
++	{0x9234, 0xe2},
++	{0x9235, 0xc2},
++	{0x9236, 0xe2},
++	{0x9237, 0xc3},
++	{0x9238, 0xe2},
++	{0x9239, 0xd4},
++	{0x923a, 0xe2},
++	{0x923b, 0xd5},
++	{0x923c, 0x90},
++	{0x923d, 0x64},
++	{0xb0b9, 0x10},
++	{0xbc76, 0x00},
++	{0xbc77, 0x00},
++	{0xbc78, 0x00},
++	{0xbc79, 0x00},
++	{0xbc7b, 0x28},
++	{0xbc7c, 0x00},
++	{0xbc7d, 0x00},
++	{0xbc7f, 0xc0},
++	{0xc6b9, 0x01},
++	{0xecb5, 0x04},
++	{0xecbf, 0x04},
++	{0x0112, 0x0a},
++	{0x0113, 0x0a},
++	{0x0114, 0x01},
++	{0x0301, 0x08},
++	{0x0303, 0x02},
++	{0x0305, 0x04},
++	{0x0306, 0x01},
++	{0x0307, 0x2c},
++	{0x030b, 0x02},
++	{0x030d, 0x04},
++	{0x030e, 0x01},
++	{0x030f, 0x30},
++	{0x0310, 0x01},
++	{0x4018, 0x00},
++	{0x4019, 0x00},
++	{0x401a, 0x00},
++	{0x401b, 0x00},
++	{0x3400, 0x01},
++	{0x3092, 0x01},
++	{0x3093, 0x00},
++	{0x0350, 0x00},
++	{0x3419, 0x00},
++};
++
++/* 64 mpix 2.7fps */
++static const struct arducam_64mp_reg mode_9152x6944_regs[] = {
++	{0x0342, 0xb6},
++	{0x0343, 0xb2},
++	{0x0340, 0x1b},
++	{0x0341, 0x76},
++	{0x0344, 0x00},
++	{0x0345, 0x00},
++	{0x0346, 0x00},
++	{0x0347, 0x00},
++	{0x0348, 0x24},
++	{0x0349, 0x1f},
++	{0x034a, 0x1b},
++	{0x034b, 0x1f},
++	{0x0900, 0x00},
++	{0x0901, 0x11},
++	{0x0902, 0x0a},
++	{0x30d8, 0x00},
++	{0x3200, 0x01},
++	{0x3201, 0x01},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x23},
++	{0x040d, 0xc0},
++	{0x040e, 0x1b},
++	{0x040f, 0x20},
++	{0x034c, 0x23},
++	{0x034d, 0xc0},
++	{0x034e, 0x1b},
++	{0x034f, 0x20},
++	{0x30d9, 0x01},
++	{0x32d5, 0x01},
++	{0x32d6, 0x00},
++	{0x401e, 0x00},
++	{0x40b8, 0x04},
++	{0x40b9, 0x20},
++	{0x40bc, 0x02},
++	{0x40bd, 0x58},
++	{0x40be, 0x02},
++	{0x40bf, 0x58},
++	{0x41a4, 0x00},
++	{0x5a09, 0x01},
++	{0x5a17, 0x01},
++	{0x5a25, 0x01},
++	{0x5a33, 0x01},
++	{0x98d7, 0x14},
++	{0x98d8, 0x14},
++	{0x98d9, 0x00},
++	{0x99c4, 0x00},
++	{0x0202, 0x03},
++	{0x0203, 0xe8},
++	{0x0204, 0x00},
++	{0x0205, 0x00},
++	{0x020e, 0x01},
++	{0x020f, 0x00},
++	{0x341a, 0x00},
++	{0x341b, 0x00},
++	{0x341c, 0x00},
++	{0x341d, 0x00},
++	{0x341e, 0x02},
++	{0x341f, 0x3c},
++	{0x3420, 0x02},
++	{0x3421, 0x42},
++};
++
++/* 48 mpix 3.0fps */
++static const struct arducam_64mp_reg mode_8000x6000_regs[] = {
++	{0x0342, 0xb6},
++	{0x0343, 0xb2},
++	{0x0340, 0x19},
++	{0x0341, 0x0e},
++	{0x0344, 0x02},
++	{0x0345, 0x70},
++	{0x0346, 0x01},
++	{0x0347, 0xd8},
++	{0x0348, 0x21},
++	{0x0349, 0xaf},
++	{0x034a, 0x19},
++	{0x034b, 0x47},
++	{0x0900, 0x00},
++	{0x0901, 0x11},
++	{0x0902, 0x0a},
++	{0x30d8, 0x00},
++	{0x3200, 0x01},
++	{0x3201, 0x01},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x1f},
++	{0x040d, 0x40},
++	{0x040e, 0x17},
++	{0x040f, 0x70},
++	{0x034c, 0x1f},
++	{0x034d, 0x40},
++	{0x034e, 0x17},
++	{0x034f, 0x70},
++	{0x30d9, 0x01},
++	{0x32d5, 0x01},
++	{0x32d6, 0x00},
++	{0x401e, 0x00},
++	{0x40b8, 0x04},
++	{0x40b9, 0x20},
++	{0x40bc, 0x02},
++	{0x40bd, 0x58},
++	{0x40be, 0x02},
++	{0x40bf, 0x58},
++	{0x41a4, 0x00},
++	{0x5a09, 0x01},
++	{0x5a17, 0x01},
++	{0x5a25, 0x01},
++	{0x5a33, 0x01},
++	{0x98d7, 0x14},
++	{0x98d8, 0x14},
++	{0x98d9, 0x00},
++	{0x99c4, 0x00},
++	{0x0202, 0x03},
++	{0x0203, 0xe8},
++	{0x0204, 0x00},
++	{0x0205, 0x00},
++	{0x020e, 0x01},
++	{0x020f, 0x00},
++	{0x341a, 0x00},
++	{0x341b, 0x00},
++	{0x341c, 0x00},
++	{0x341d, 0x00},
++	{0x341e, 0x01},
++	{0x341f, 0xf4},
++	{0x3420, 0x01},
++	{0x3421, 0xf4},
++};
++
++/* 16 mpix 10fps */
++static const struct arducam_64mp_reg mode_4624x3472_regs[] = {
++	{0x0342, 0x63},
++	{0x0343, 0x97},
++	{0x0340, 0x0d},
++	{0x0341, 0xca},
++	{0x0344, 0x00},
++	{0x0345, 0x00},
++	{0x0346, 0x00},
++	{0x0347, 0x00},
++	{0x0348, 0x24},
++	{0x0349, 0x1f},
++	{0x034a, 0x1b},
++	{0x034b, 0x1f},
++	{0x0900, 0x01},
++	{0x0901, 0x22},
++	{0x0902, 0x08},
++	{0x30d8, 0x04},
++	{0x3200, 0x41},
++	{0x3201, 0x41},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x12},
++	{0x040d, 0x10},
++	{0x040e, 0x0d},
++	{0x040f, 0x90},
++	{0x034c, 0x12},
++	{0x034d, 0x10},
++	{0x034e, 0x0d},
++	{0x034f, 0x90},
++	{0x30d9, 0x00},
++	{0x32d5, 0x00},
++	{0x32d6, 0x00},
++	{0x401e, 0x00},
++	{0x40b8, 0x01},
++	{0x40b9, 0x2c},
++	{0x40bc, 0x01},
++	{0x40bd, 0x18},
++	{0x40be, 0x00},
++	{0x40bf, 0x00},
++	{0x41a4, 0x00},
++	{0x5a09, 0x01},
++	{0x5a17, 0x01},
++	{0x5a25, 0x01},
++	{0x5a33, 0x01},
++	{0x98d7, 0xb4},
++	{0x98d8, 0x8c},
++	{0x98d9, 0x0a},
++	{0x99c4, 0x16},
++	{0x341a, 0x00},
++	{0x341b, 0x00},
++	{0x341c, 0x00},
++	{0x341d, 0x00},
++	{0x341e, 0x01},
++	{0x341f, 0x21},
++	{0x3420, 0x01},
++	{0x3421, 0x21},
++};
++
++/* 4k 20fps mode */
++static const struct arducam_64mp_reg mode_3840x2160_regs[] = {
++	{0x0342, 0x4e},
++	{0x0343, 0xb7},
++	{0x0340, 0x08},
++	{0x0341, 0xb9},
++	{0x0344, 0x03},
++	{0x0345, 0x10},
++	{0x0346, 0x05},
++	{0x0347, 0x20},
++	{0x0348, 0x21},
++	{0x0349, 0x0f},
++	{0x034a, 0x15},
++	{0x034b, 0xff},
++	{0x0900, 0x01},
++	{0x0901, 0x22},
++	{0x0902, 0x08},
++	{0x30d8, 0x04},
++	{0x3200, 0x41},
++	{0x3201, 0x41},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x0f},
++	{0x040d, 0x00},
++	{0x040e, 0x08},
++	{0x040f, 0x70},
++	{0x034c, 0x0f},
++	{0x034d, 0x00},
++	{0x034e, 0x08},
++	{0x034f, 0x70},
++	{0x30d9, 0x00},
++	{0x32d5, 0x00},
++	{0x32d6, 0x00},
++	{0x401e, 0x00},
++	{0x40b8, 0x01},
++	{0x40b9, 0x2c},
++	{0x40bc, 0x01},
++	{0x40bd, 0x18},
++	{0x40be, 0x00},
++	{0x40bf, 0x00},
++	{0x41a4, 0x00},
++	{0x5a09, 0x01},
++	{0x5a17, 0x01},
++	{0x5a25, 0x01},
++	{0x5a33, 0x01},
++	{0x98d7, 0xb4},
++	{0x98d8, 0x8c},
++	{0x98d9, 0x0a},
++	{0x99c4, 0x16},
++	{0x341a, 0x00},
++	{0x341b, 0x00},
++	{0x341c, 0x00},
++	{0x341d, 0x00},
++	{0x341e, 0x00},
++	{0x341f, 0xf0},
++	{0x3420, 0x00},
++	{0x3421, 0xb4},
++};
++
++/* 4x4 binned 30fps mode */
++static const struct arducam_64mp_reg mode_2312x1736_regs[] = {
++	{0x0342, 0x33},
++	{0x0343, 0x60},
++	{0x0340, 0x08},
++	{0x0341, 0xe9},
++	{0x0344, 0x00},
++	{0x0345, 0x00},
++	{0x0346, 0x00},
++	{0x0347, 0x00},
++	{0x0348, 0x24},
++	{0x0349, 0x1f},
++	{0x034a, 0x1b},
++	{0x034b, 0x1f},
++	{0x0900, 0x01},
++	{0x0901, 0x44},
++	{0x0902, 0x08},
++	{0x30d8, 0x04},
++	{0x3200, 0x43},
++	{0x3201, 0x43},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x09},
++	{0x040d, 0x08},
++	{0x040e, 0x06},
++	{0x040f, 0xc8},
++	{0x034c, 0x09},
++	{0x034d, 0x08},
++	{0x034e, 0x06},
++	{0x034f, 0xc8},
++	{0x30d9, 0x00},
++	{0x32d5, 0x00},
++	{0x32d6, 0x00},
++	{0x401e, 0x00},
++	{0x40b8, 0x01},
++	{0x40b9, 0x2c},
++	{0x40bc, 0x01},
++	{0x40bd, 0x18},
++	{0x40be, 0x00},
++	{0x40bf, 0x00},
++	{0x41a4, 0x00},
++	{0x5a09, 0x01},
++	{0x5a17, 0x01},
++	{0x5a25, 0x01},
++	{0x5a33, 0x01},
++	{0x98d7, 0xb4},
++	{0x98d8, 0x8c},
++	{0x98d9, 0x0a},
++	{0x99c4, 0x16},
++	{0x341a, 0x00},
++	{0x341b, 0x00},
++	{0x341c, 0x00},
++	{0x341d, 0x00},
++	{0x341e, 0x00},
++	{0x341f, 0x90},
++	{0x3420, 0x00},
++	{0x3421, 0x90},
++};
++
++/* 1080p 60fps mode */
++static const struct arducam_64mp_reg mode_1920x1080_regs[] = {
++	{0x0342, 0x29},
++	{0x0343, 0xe3},
++	{0x0340, 0x05},
++	{0x0341, 0x76},
++	{0x0344, 0x03},
++	{0x0345, 0x10},
++	{0x0346, 0x05},
++	{0x0347, 0x20},
++	{0x0348, 0x21},
++	{0x0349, 0x0f},
++	{0x034a, 0x16},
++	{0x034b, 0x0f},
++	{0x0900, 0x01},
++	{0x0901, 0x44},
++	{0x0902, 0x08},
++	{0x30d8, 0x04},
++	{0x3200, 0x43},
++	{0x3201, 0x43},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x07},
++	{0x040d, 0x80},
++	{0x040e, 0x04},
++	{0x040f, 0x38},
++	{0x034c, 0x07},
++	{0x034d, 0x80},
++	{0x034e, 0x04},
++	{0x034f, 0x38},
++	{0x30d9, 0x00},
++	{0x32d5, 0x00},
++	{0x32d6, 0x00},
++	{0x401e, 0x00},
++	{0x40b8, 0x01},
++	{0x40b9, 0x2c},
++	{0x40bc, 0x01},
++	{0x40bd, 0x18},
++	{0x40be, 0x00},
++	{0x40bf, 0x00},
++	{0x41a4, 0x00},
++	{0x5a09, 0x01},
++	{0x5a17, 0x01},
++	{0x5a25, 0x01},
++	{0x5a33, 0x01},
++	{0x98d7, 0xb4},
++	{0x98d8, 0x8c},
++	{0x98d9, 0x0a},
++	{0x99c4, 0x16},
++	{0x341a, 0x00},
++	{0x341b, 0x00},
++	{0x341c, 0x00},
++	{0x341d, 0x00},
++	{0x341e, 0x00},
++	{0x341f, 0x78},
++	{0x3420, 0x00},
++	{0x3421, 0x5a},
++};
++
++/* 720p 120fps mode */
++static const struct arducam_64mp_reg mode_1280x720_regs[] = {
++	{0x0342, 0x1b},
++	{0x0343, 0x08},
++	{0x0340, 0x04},
++	{0x0341, 0x3b},
++	{0x0344, 0x08},
++	{0x0345, 0x10},
++	{0x0346, 0x07},
++	{0x0347, 0xf0},
++	{0x0348, 0x1c},
++	{0x0349, 0x0f},
++	{0x034a, 0x13},
++	{0x034b, 0x3f},
++	{0x0900, 0x01},
++	{0x0901, 0x44},
++	{0x0902, 0x08},
++	{0x30d8, 0x04},
++	{0x3200, 0x43},
++	{0x3201, 0x43},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040a, 0x00},
++	{0x040b, 0x00},
++	{0x040c, 0x05},
++	{0x040d, 0x00},
++	{0x040e, 0x02},
++	{0x040f, 0xd0},
++	{0x034c, 0x05},
++	{0x034d, 0x00},
++	{0x034e, 0x02},
++	{0x034f, 0xd0},
++	{0x30d9, 0x00},
++	{0x32d5, 0x00},
++	{0x32d6, 0x00},
++	{0x401e, 0x00},
++	{0x40b8, 0x01},
++	{0x40b9, 0x2c},
++	{0x40bc, 0x01},
++	{0x40bd, 0x18},
++	{0x40be, 0x00},
++	{0x40bf, 0x00},
++	{0x41a4, 0x00},
++	{0x5a09, 0x01},
++	{0x5a17, 0x01},
++	{0x5a25, 0x01},
++	{0x5a33, 0x01},
++	{0x98d7, 0xb4},
++	{0x98d8, 0x8c},
++	{0x98d9, 0x0a},
++	{0x99c4, 0x16},
++	{0x341a, 0x00},
++	{0x341b, 0x00},
++	{0x341c, 0x00},
++	{0x341d, 0x00},
++	{0x341e, 0x00},
++	{0x341f, 0x50},
++	{0x3420, 0x00},
++	{0x3421, 0x3c},
++};
++
++/* Mode configs */
++static const struct arducam_64mp_mode supported_modes[] = {
++	{
++		.width = 9152,
++		.height = 6944,
++		.line_length_pix = 0xb6b2,
++		.crop = {
++			.left = ARDUCAM_64MP_PIXEL_ARRAY_LEFT,
++			.top = ARDUCAM_64MP_PIXEL_ARRAY_TOP,
++			.width = 9248,
++			.height = 6944,
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 270
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_9152x6944_regs),
++			.regs = mode_9152x6944_regs,
++		}
++	}, {
++		.width = 8000,
++		.height = 6000,
++		.line_length_pix = 0xb6b2,
++		.crop = {
++			.left = ARDUCAM_64MP_PIXEL_ARRAY_LEFT + 624,
++			.top = ARDUCAM_64MP_PIXEL_ARRAY_TOP + 472,
++			.width = 9248,
++			.height = 6944,
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 300
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_8000x6000_regs),
++			.regs = mode_8000x6000_regs,
++		}
++	}, {
++		.width = 4624,
++		.height = 3472,
++		.line_length_pix = 0x6397,
++		.crop = {
++			.left = ARDUCAM_64MP_PIXEL_ARRAY_LEFT,
++			.top = ARDUCAM_64MP_PIXEL_ARRAY_TOP,
++			.width = 9248,
++			.height = 6944,
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 1000
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_4624x3472_regs),
++			.regs = mode_4624x3472_regs,
++		}
++	}, {
++		.width = 3840,
++		.height = 2160,
++		.line_length_pix = 0x4eb7,
++		.crop = {
++			.left = ARDUCAM_64MP_PIXEL_ARRAY_LEFT + 784,
++			.top = ARDUCAM_64MP_PIXEL_ARRAY_TOP + 1312,
++			.width = 7680,
++			.height = 4320,
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 2000
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_3840x2160_regs),
++			.regs = mode_3840x2160_regs,
++		}
++	}, {
++		.width = 2312,
++		.height = 1736,
++		.line_length_pix = 0x3360,
++		.crop = {
++			.left = ARDUCAM_64MP_PIXEL_ARRAY_LEFT,
++			.top = ARDUCAM_64MP_PIXEL_ARRAY_TOP,
++			.width = 9248,
++			.height = 6944,
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 3000
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_2312x1736_regs),
++			.regs = mode_2312x1736_regs,
++		}
++	}, {
++		.width = 1920,
++		.height = 1080,
++		.line_length_pix = 0x29e3,
++		.crop = {
++			.left = ARDUCAM_64MP_PIXEL_ARRAY_LEFT + 784,
++			.top = ARDUCAM_64MP_PIXEL_ARRAY_TOP + 1312,
++			.width = 7680,
++			.height = 4320,
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 6000
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_1920x1080_regs),
++			.regs = mode_1920x1080_regs,
++		}
++	}, {
++		.width = 1280,
++		.height = 720,
++		.line_length_pix = 0x1b08,
++		.crop = {
++			.left = ARDUCAM_64MP_PIXEL_ARRAY_LEFT + 2064,
++			.top = ARDUCAM_64MP_PIXEL_ARRAY_TOP + 2032,
++			.width = 5120,
++			.height = 2880,
++		},
++		.timeperframe_default = {
++			.numerator = 100,
++			.denominator = 12000
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_1280x720_regs),
++			.regs = mode_1280x720_regs,
++		}
++	},
++};
++
++/*
++ * The supported formats.
++ * This table MUST contain 4 entries per format, to cover the various flip
++ * combinations in the order
++ * - no flip
++ * - h flip
++ * - v flip
++ * - h&v flips
++ */
++static const u32 codes[] = {
++	/* 10-bit modes. */
++	MEDIA_BUS_FMT_SRGGB10_1X10,
++	MEDIA_BUS_FMT_SGRBG10_1X10,
++	MEDIA_BUS_FMT_SGBRG10_1X10,
++	MEDIA_BUS_FMT_SBGGR10_1X10,
++};
++
++static const char * const arducam_64mp_test_pattern_menu[] = {
++	"Disabled",
++	"Color Bars",
++	"Solid Color",
++	"Grey Color Bars",
++	"PN9"
++};
++
++static const int arducam_64mp_test_pattern_val[] = {
++	ARDUCAM_64MP_TEST_PATTERN_DISABLE,
++	ARDUCAM_64MP_TEST_PATTERN_COLOR_BARS,
++	ARDUCAM_64MP_TEST_PATTERN_SOLID_COLOR,
++	ARDUCAM_64MP_TEST_PATTERN_GREY_COLOR,
++	ARDUCAM_64MP_TEST_PATTERN_PN9,
++};
++
++/* regulator supplies */
++static const char * const arducam_64mp_supply_name[] = {
++	/* Supplies can be enabled in any order */
++	"VANA",  /* Analog (2.8V) supply */
++	"VDIG",  /* Digital Core (1.05V) supply */
++	"VDDL",  /* IF (1.8V) supply */
++};
++
++#define ARDUCAM_64MP_NUM_SUPPLIES ARRAY_SIZE(arducam_64mp_supply_name)
++
++/*
++ * Initialisation delay between XCLR low->high and the moment when the sensor
++ * can start capture (i.e. can leave software standby), given by T7 in the
++ * datasheet is 7.7ms.  This does include I2C setup time as well.
++ *
++ * Note, that delay between XCLR low->high and reading the CCI ID register (T6
++ * in the datasheet) is much smaller - 1ms.
++ */
++#define ARDUCAM_64MP_XCLR_MIN_DELAY_US		8000
++#define ARDUCAM_64MP_XCLR_DELAY_RANGE_US	1000
++
++struct arducam_64mp {
++	struct v4l2_subdev sd;
++	struct media_pad pad[NUM_PADS];
++
++	unsigned int fmt_code;
++
++	struct clk *xclk;
++
++	struct gpio_desc *reset_gpio;
++	struct regulator_bulk_data supplies[ARDUCAM_64MP_NUM_SUPPLIES];
++
++	struct v4l2_ctrl_handler ctrl_handler;
++	/* V4L2 Controls */
++	struct v4l2_ctrl *pixel_rate;
++	struct v4l2_ctrl *exposure;
++	struct v4l2_ctrl *vflip;
++	struct v4l2_ctrl *hflip;
++	struct v4l2_ctrl *vblank;
++	struct v4l2_ctrl *hblank;
++
++	/* Current mode */
++	const struct arducam_64mp_mode *mode;
++
++	/*
++	 * Mutex for serialized access:
++	 * Protect sensor module set pad format and start/stop streaming safely.
++	 */
++	struct mutex mutex;
++
++	/* Streaming on/off */
++	bool streaming;
++
++	/* Rewrite common registers on stream on? */
++	bool common_regs_written;
++
++	/* Current long exposure factor in use. Set through V4L2_CID_VBLANK */
++	unsigned int long_exp_shift;
++};
++
++static inline struct arducam_64mp *to_arducam_64mp(struct v4l2_subdev *_sd)
++{
++	return container_of(_sd, struct arducam_64mp, sd);
++}
++
++/* Read registers up to 2 at a time */
++static int arducam_64mp_read_reg(struct i2c_client *client,
++				 u16 reg, u32 len, u32 *val)
++{
++	struct i2c_msg msgs[2];
++	u8 addr_buf[2] = { reg >> 8, reg & 0xff };
++	u8 data_buf[4] = { 0, };
++	int ret;
++
++	if (len > 4)
++		return -EINVAL;
++
++	/* Write register address */
++	msgs[0].addr = client->addr;
++	msgs[0].flags = 0;
++	msgs[0].len = ARRAY_SIZE(addr_buf);
++	msgs[0].buf = addr_buf;
++
++	/* Read data from register */
++	msgs[1].addr = client->addr;
++	msgs[1].flags = I2C_M_RD;
++	msgs[1].len = len;
++	msgs[1].buf = &data_buf[4 - len];
++
++	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
++	if (ret != ARRAY_SIZE(msgs))
++		return -EIO;
++
++	*val = get_unaligned_be32(data_buf);
++
++	return 0;
++}
++
++/* Write registers up to 2 at a time */
++static int arducam_64mp_write_reg(struct arducam_64mp *arducam_64mp,
++				  u16 reg, u32 len, u32 val)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&arducam_64mp->sd);
++	u8 buf[6];
++
++	if (len > 4)
++		return -EINVAL;
++
++	put_unaligned_be16(reg, buf);
++	put_unaligned_be32(val << (8 * (4 - len)), buf + 2);
++	if (i2c_master_send(client, buf, len + 2) != len + 2)
++		return -EIO;
++
++	return 0;
++}
++
++/* Write a list of registers */
++static int arducam_64mp_write_regs(struct arducam_64mp *arducam_64mp,
++				   const struct arducam_64mp_reg *regs, u32 len)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&arducam_64mp->sd);
++	unsigned int i;
++	int ret;
++
++	for (i = 0; i < len; i++) {
++		ret = arducam_64mp_write_reg(arducam_64mp, regs[i].address, 1,
++					     regs[i].val);
++		if (ret) {
++			dev_err_ratelimited(&client->dev,
++					    "Failed to write reg 0x%4.4x. error = %d\n",
++					    regs[i].address, ret);
++
++			return ret;
++		}
++	}
++
++	return 0;
++}
++
++/* Get bayer order based on flip setting. */
++static u32 arducam_64mp_get_format_code(struct arducam_64mp *arducam_64mp)
++{
++	unsigned int i;
++
++	lockdep_assert_held(&arducam_64mp->mutex);
++
++	i = (arducam_64mp->vflip->val ? 2 : 0) |
++	    (arducam_64mp->hflip->val ? 1 : 0);
++
++	return codes[i];
++}
++
++static int arducam_64mp_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
++{
++	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
++	struct v4l2_mbus_framefmt *try_fmt_img =
++		v4l2_subdev_state_get_format(fh->state, IMAGE_PAD);
++	struct v4l2_mbus_framefmt *try_fmt_meta =
++		v4l2_subdev_state_get_format(fh->state, METADATA_PAD);
++	struct v4l2_rect *try_crop;
++
++	mutex_lock(&arducam_64mp->mutex);
++
++	/* Initialize try_fmt for the image pad */
++	try_fmt_img->width = supported_modes[0].width;
++	try_fmt_img->height = supported_modes[0].height;
++	try_fmt_img->code = arducam_64mp_get_format_code(arducam_64mp);
++	try_fmt_img->field = V4L2_FIELD_NONE;
++
++	/* Initialize try_fmt for the embedded metadata pad */
++	try_fmt_meta->width = ARDUCAM_64MP_EMBEDDED_LINE_WIDTH;
++	try_fmt_meta->height = ARDUCAM_64MP_NUM_EMBEDDED_LINES;
++	try_fmt_meta->code = MEDIA_BUS_FMT_SENSOR_DATA;
++	try_fmt_meta->field = V4L2_FIELD_NONE;
++
++	/* Initialize try_crop */
++	try_crop = v4l2_subdev_state_get_crop(fh->state, IMAGE_PAD);
++	try_crop->left = ARDUCAM_64MP_PIXEL_ARRAY_LEFT;
++	try_crop->top = ARDUCAM_64MP_PIXEL_ARRAY_TOP;
++	try_crop->width = ARDUCAM_64MP_PIXEL_ARRAY_WIDTH;
++	try_crop->height = ARDUCAM_64MP_PIXEL_ARRAY_HEIGHT;
++
++	mutex_unlock(&arducam_64mp->mutex);
++
++	return 0;
++}
++
++static void
++arducam_64mp_adjust_exposure_range(struct arducam_64mp *arducam_64mp)
++{
++	int exposure_max, exposure_def;
++
++	/* Honour the VBLANK limits when setting exposure. */
++	exposure_max = arducam_64mp->mode->height + arducam_64mp->vblank->val -
++		       ARDUCAM_64MP_EXPOSURE_OFFSET;
++	exposure_def = min(exposure_max, arducam_64mp->exposure->val);
++	__v4l2_ctrl_modify_range(arducam_64mp->exposure,
++				 arducam_64mp->exposure->minimum,
++				 exposure_max, arducam_64mp->exposure->step,
++				 exposure_def);
++}
++
++static int arducam_64mp_set_frame_length(struct arducam_64mp *arducam_64mp,
++					 unsigned int vblank)
++{
++	unsigned int val = vblank + arducam_64mp->mode->height;
++	int ret = 0;
++
++	arducam_64mp->long_exp_shift = 0;
++
++	while (val > ARDUCAM_64MP_FRAME_LENGTH_MAX) {
++		arducam_64mp->long_exp_shift++;
++		val >>= 1;
++	}
++
++	ret = arducam_64mp_write_reg(arducam_64mp,
++				     ARDUCAM_64MP_REG_FRAME_LENGTH,
++				     ARDUCAM_64MP_REG_VALUE_16BIT, val);
++	if (ret)
++		return ret;
++
++	return arducam_64mp_write_reg(arducam_64mp,
++				      ARDUCAM_64MP_LONG_EXP_SHIFT_REG,
++				      ARDUCAM_64MP_REG_VALUE_08BIT,
++				      arducam_64mp->long_exp_shift);
++}
++
++static int arducam_64mp_set_ctrl(struct v4l2_ctrl *ctrl)
++{
++	struct arducam_64mp *arducam_64mp =
++		container_of(ctrl->handler, struct arducam_64mp, ctrl_handler);
++	struct i2c_client *client = v4l2_get_subdevdata(&arducam_64mp->sd);
++	int ret;
++	u32 val;
++	/*
++	 * The VBLANK control may change the limits of usable exposure, so check
++	 * and adjust if necessary.
++	 */
++	if (ctrl->id == V4L2_CID_VBLANK)
++		arducam_64mp_adjust_exposure_range(arducam_64mp);
++
++	/*
++	 * Applying V4L2 control value only happens
++	 * when power is up for streaming
++	 */
++	if (pm_runtime_get_if_in_use(&client->dev) == 0)
++		return 0;
++
++	switch (ctrl->id) {
++	case V4L2_CID_ANALOGUE_GAIN:
++		ret = arducam_64mp_write_reg(arducam_64mp,
++					     ARDUCAM_64MP_REG_ANALOG_GAIN,
++					     ARDUCAM_64MP_REG_VALUE_16BIT,
++					     ctrl->val);
++		break;
++	case V4L2_CID_EXPOSURE:
++		val = ctrl->val >> arducam_64mp->long_exp_shift;
++		ret = arducam_64mp_write_reg(arducam_64mp,
++					     ARDUCAM_64MP_REG_EXPOSURE,
++					     ARDUCAM_64MP_REG_VALUE_16BIT,
++					     val);
++		break;
++	case V4L2_CID_DIGITAL_GAIN:
++		ret = arducam_64mp_write_reg(arducam_64mp,
++					     ARDUCAM_64MP_REG_DIGITAL_GAIN,
++					     ARDUCAM_64MP_REG_VALUE_16BIT,
++					     ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN:
++		val = arducam_64mp_test_pattern_val[ctrl->val];
++		ret = arducam_64mp_write_reg(arducam_64mp,
++					     ARDUCAM_64MP_REG_TEST_PATTERN,
++					     ARDUCAM_64MP_REG_VALUE_16BIT,
++					     val);
++		break;
++	case V4L2_CID_TEST_PATTERN_RED:
++		ret = arducam_64mp_write_reg(arducam_64mp,
++					     ARDUCAM_64MP_REG_TEST_PATTERN_R,
++					     ARDUCAM_64MP_REG_VALUE_16BIT,
++					     ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN_GREENR:
++		ret = arducam_64mp_write_reg(arducam_64mp,
++					     ARDUCAM_64MP_REG_TEST_PATTERN_GR,
++					     ARDUCAM_64MP_REG_VALUE_16BIT,
++					     ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN_BLUE:
++		ret = arducam_64mp_write_reg(arducam_64mp,
++					     ARDUCAM_64MP_REG_TEST_PATTERN_B,
++					     ARDUCAM_64MP_REG_VALUE_16BIT,
++					     ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN_GREENB:
++		ret = arducam_64mp_write_reg(arducam_64mp,
++					     ARDUCAM_64MP_REG_TEST_PATTERN_GB,
++					     ARDUCAM_64MP_REG_VALUE_16BIT,
++					     ctrl->val);
++		break;
++	case V4L2_CID_HFLIP:
++	case V4L2_CID_VFLIP:
++		ret = arducam_64mp_write_reg(arducam_64mp,
++					     ARDUCAM_64MP_REG_ORIENTATION, 1,
++					     arducam_64mp->hflip->val |
++						arducam_64mp->vflip->val << 1);
++		break;
++	case V4L2_CID_VBLANK:
++		ret = arducam_64mp_set_frame_length(arducam_64mp, ctrl->val);
++		break;
++	default:
++		dev_info(&client->dev,
++			 "ctrl(id:0x%x,val:0x%x) is not handled\n",
++			 ctrl->id, ctrl->val);
++		ret = -EINVAL;
++		break;
++	}
++
++	pm_runtime_put(&client->dev);
++
++	return ret;
++}
++
++static const struct v4l2_ctrl_ops arducam_64mp_ctrl_ops = {
++	.s_ctrl = arducam_64mp_set_ctrl,
++};
++
++static int arducam_64mp_enum_mbus_code(struct v4l2_subdev *sd,
++				       struct v4l2_subdev_state *sd_state,
++				       struct v4l2_subdev_mbus_code_enum *code)
++{
++	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
++
++	if (code->pad >= NUM_PADS)
++		return -EINVAL;
++
++	if (code->pad == IMAGE_PAD) {
++		if (code->index > 0)
++			return -EINVAL;
++
++		code->code = arducam_64mp_get_format_code(arducam_64mp);
++	} else {
++		if (code->index > 0)
++			return -EINVAL;
++
++		code->code = MEDIA_BUS_FMT_SENSOR_DATA;
++	}
++
++	return 0;
++}
++
++static int arducam_64mp_enum_frame_size(struct v4l2_subdev *sd,
++					struct v4l2_subdev_state *sd_state,
++					struct v4l2_subdev_frame_size_enum *fse)
++{
++	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
++
++	if (fse->pad >= NUM_PADS)
++		return -EINVAL;
++
++	if (fse->pad == IMAGE_PAD) {
++		if (fse->index >= ARRAY_SIZE(supported_modes))
++			return -EINVAL;
++
++		if (fse->code != arducam_64mp_get_format_code(arducam_64mp))
++			return -EINVAL;
++
++		fse->min_width = supported_modes[fse->index].width;
++		fse->max_width = fse->min_width;
++		fse->min_height = supported_modes[fse->index].height;
++		fse->max_height = fse->min_height;
++	} else {
++		if (fse->code != MEDIA_BUS_FMT_SENSOR_DATA || fse->index > 0)
++			return -EINVAL;
++
++		fse->min_width = ARDUCAM_64MP_EMBEDDED_LINE_WIDTH;
++		fse->max_width = fse->min_width;
++		fse->min_height = ARDUCAM_64MP_NUM_EMBEDDED_LINES;
++		fse->max_height = fse->min_height;
++	}
++
++	return 0;
++}
++
++static void arducam_64mp_reset_colorspace(struct v4l2_mbus_framefmt *fmt)
++{
++	fmt->colorspace = V4L2_COLORSPACE_RAW;
++	fmt->ycbcr_enc = V4L2_MAP_YCBCR_ENC_DEFAULT(fmt->colorspace);
++	fmt->quantization = V4L2_MAP_QUANTIZATION_DEFAULT(true,
++							  fmt->colorspace,
++							  fmt->ycbcr_enc);
++	fmt->xfer_func = V4L2_MAP_XFER_FUNC_DEFAULT(fmt->colorspace);
++}
++
++static void
++arducam_64mp_update_image_pad_format(struct arducam_64mp *arducam_64mp,
++				     const struct arducam_64mp_mode *mode,
++				     struct v4l2_subdev_format *fmt)
++{
++	fmt->format.width = mode->width;
++	fmt->format.height = mode->height;
++	fmt->format.field = V4L2_FIELD_NONE;
++	arducam_64mp_reset_colorspace(&fmt->format);
++}
++
++static void
++arducam_64mp_update_metadata_pad_format(struct v4l2_subdev_format *fmt)
++{
++	fmt->format.width = ARDUCAM_64MP_EMBEDDED_LINE_WIDTH;
++	fmt->format.height = ARDUCAM_64MP_NUM_EMBEDDED_LINES;
++	fmt->format.code = MEDIA_BUS_FMT_SENSOR_DATA;
++	fmt->format.field = V4L2_FIELD_NONE;
++}
++
++static int arducam_64mp_get_pad_format(struct v4l2_subdev *sd,
++				       struct v4l2_subdev_state *sd_state,
++				       struct v4l2_subdev_format *fmt)
++{
++	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
++
++	if (fmt->pad >= NUM_PADS)
++		return -EINVAL;
++
++	mutex_lock(&arducam_64mp->mutex);
++
++	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++		struct v4l2_mbus_framefmt *try_fmt =
++			v4l2_subdev_state_get_format(sd_state,
++						   fmt->pad);
++		/* update the code which could change due to vflip or hflip: */
++		try_fmt->code = fmt->pad == IMAGE_PAD ?
++				arducam_64mp_get_format_code(arducam_64mp) :
++				MEDIA_BUS_FMT_SENSOR_DATA;
++		fmt->format = *try_fmt;
++	} else {
++		if (fmt->pad == IMAGE_PAD) {
++			arducam_64mp_update_image_pad_format(arducam_64mp,
++							     arducam_64mp->mode,
++							     fmt);
++			fmt->format.code =
++			       arducam_64mp_get_format_code(arducam_64mp);
++		} else {
++			arducam_64mp_update_metadata_pad_format(fmt);
++		}
++	}
++
++	mutex_unlock(&arducam_64mp->mutex);
++	return 0;
++}
++
++static unsigned int
++arducam_64mp_get_frame_length(const struct arducam_64mp_mode *mode,
++			      const struct v4l2_fract *timeperframe)
++{
++	u64 frame_length;
++
++	frame_length = (u64)timeperframe->numerator * ARDUCAM_64MP_PIXEL_RATE;
++	do_div(frame_length,
++	       (u64)timeperframe->denominator * mode->line_length_pix);
++
++	if (WARN_ON(frame_length > ARDUCAM_64MP_FRAME_LENGTH_MAX))
++		frame_length = ARDUCAM_64MP_FRAME_LENGTH_MAX;
++
++	return max_t(unsigned int, frame_length, mode->height);
++}
++
++static void arducam_64mp_set_framing_limits(struct arducam_64mp *arducam_64mp)
++{
++	unsigned int frm_length_min, frm_length_default, hblank;
++	const struct arducam_64mp_mode *mode = arducam_64mp->mode;
++
++	/* The default framerate is highest possible framerate. */
++	frm_length_min =
++		arducam_64mp_get_frame_length(mode,
++					      &mode->timeperframe_default);
++	frm_length_default =
++		arducam_64mp_get_frame_length(mode,
++					      &mode->timeperframe_default);
++
++	/* Default to no long exposure multiplier. */
++	arducam_64mp->long_exp_shift = 0;
++
++	/* Update limits and set FPS to default */
++	__v4l2_ctrl_modify_range(arducam_64mp->vblank,
++				 frm_length_min - mode->height,
++				 ((1 << ARDUCAM_64MP_LONG_EXP_SHIFT_MAX) *
++				  ARDUCAM_64MP_FRAME_LENGTH_MAX) - mode->height,
++				 1, frm_length_default - mode->height);
++
++	/* Setting this will adjust the exposure limits as well. */
++	__v4l2_ctrl_s_ctrl(arducam_64mp->vblank,
++			   frm_length_default - mode->height);
++
++	/*
++	 * Currently PPL is fixed to the mode specified value, so hblank
++	 * depends on mode->width only, and is not changeable in any
++	 * way other than changing the mode.
++	 */
++	hblank = mode->line_length_pix - mode->width;
++	__v4l2_ctrl_modify_range(arducam_64mp->hblank, hblank, hblank, 1,
++				 hblank);
++}
++
++static int arducam_64mp_set_pad_format(struct v4l2_subdev *sd,
++				       struct v4l2_subdev_state *sd_state,
++				       struct v4l2_subdev_format *fmt)
++{
++	struct v4l2_mbus_framefmt *framefmt;
++	const struct arducam_64mp_mode *mode;
++	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
++
++	if (fmt->pad >= NUM_PADS)
++		return -EINVAL;
++
++	mutex_lock(&arducam_64mp->mutex);
++
++	if (fmt->pad == IMAGE_PAD) {
++		/* Bayer order varies with flips */
++		fmt->format.code = arducam_64mp_get_format_code(arducam_64mp);
++
++		mode = v4l2_find_nearest_size(supported_modes,
++					      ARRAY_SIZE(supported_modes),
++					      width, height,
++					      fmt->format.width,
++					      fmt->format.height);
++		arducam_64mp_update_image_pad_format(arducam_64mp, mode, fmt);
++		if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++			framefmt = v4l2_subdev_state_get_format(sd_state,
++							      fmt->pad);
++			*framefmt = fmt->format;
++		} else {
++			arducam_64mp->mode = mode;
++			arducam_64mp->fmt_code = fmt->format.code;
++			arducam_64mp_set_framing_limits(arducam_64mp);
++		}
++	} else {
++		if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++			framefmt = v4l2_subdev_state_get_format(sd_state,
++							      fmt->pad);
++			*framefmt = fmt->format;
++		} else {
++			/* Only one embedded data mode is supported */
++			arducam_64mp_update_metadata_pad_format(fmt);
++		}
++	}
++
++	mutex_unlock(&arducam_64mp->mutex);
++
++	return 0;
++}
++
++static const struct v4l2_rect *
++__arducam_64mp_get_pad_crop(struct arducam_64mp *arducam_64mp,
++			    struct v4l2_subdev_state *sd_state,
++			    unsigned int pad,
++			    enum v4l2_subdev_format_whence which)
++{
++	switch (which) {
++	case V4L2_SUBDEV_FORMAT_TRY:
++		return v4l2_subdev_state_get_crop(sd_state,
++						pad);
++	case V4L2_SUBDEV_FORMAT_ACTIVE:
++		return &arducam_64mp->mode->crop;
++	}
++
++	return NULL;
++}
++
++static int arducam_64mp_get_selection(struct v4l2_subdev *sd,
++				      struct v4l2_subdev_state *sd_state,
++				      struct v4l2_subdev_selection *sel)
++{
++	switch (sel->target) {
++	case V4L2_SEL_TGT_CROP: {
++		struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
++
++		mutex_lock(&arducam_64mp->mutex);
++		sel->r = *__arducam_64mp_get_pad_crop(arducam_64mp, sd_state,
++						      sel->pad, sel->which);
++		mutex_unlock(&arducam_64mp->mutex);
++
++		return 0;
++	}
++
++	case V4L2_SEL_TGT_NATIVE_SIZE:
++		sel->r.left = 0;
++		sel->r.top = 0;
++		sel->r.width = ARDUCAM_64MP_NATIVE_WIDTH;
++		sel->r.height = ARDUCAM_64MP_NATIVE_HEIGHT;
++
++		return 0;
++
++	case V4L2_SEL_TGT_CROP_DEFAULT:
++	case V4L2_SEL_TGT_CROP_BOUNDS:
++		sel->r.left = ARDUCAM_64MP_PIXEL_ARRAY_LEFT;
++		sel->r.top = ARDUCAM_64MP_PIXEL_ARRAY_TOP;
++		sel->r.width = ARDUCAM_64MP_PIXEL_ARRAY_WIDTH;
++		sel->r.height = ARDUCAM_64MP_PIXEL_ARRAY_HEIGHT;
++
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++/* Start streaming */
++static int arducam_64mp_start_streaming(struct arducam_64mp *arducam_64mp)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&arducam_64mp->sd);
++	const struct arducam_64mp_reg_list *reg_list;
++	int ret;
++
++	if (!arducam_64mp->common_regs_written) {
++		ret = arducam_64mp_write_regs(arducam_64mp, mode_common_regs,
++					      ARRAY_SIZE(mode_common_regs));
++
++		if (ret) {
++			dev_err(&client->dev, "%s failed to set common settings\n",
++				__func__);
++			return ret;
++		}
++		arducam_64mp->common_regs_written = true;
++	}
++
++	/* Apply default values of current mode */
++	reg_list = &arducam_64mp->mode->reg_list;
++	ret = arducam_64mp_write_regs(arducam_64mp, reg_list->regs,
++				      reg_list->num_of_regs);
++	if (ret) {
++		dev_err(&client->dev, "%s failed to set mode\n", __func__);
++		return ret;
++	}
++
++	/* Apply customized values from user */
++	ret =  __v4l2_ctrl_handler_setup(arducam_64mp->sd.ctrl_handler);
++	if (ret)
++		return ret;
++
++	/* set stream on register */
++	return arducam_64mp_write_reg(arducam_64mp,
++				      ARDUCAM_64MP_REG_MODE_SELECT,
++				      ARDUCAM_64MP_REG_VALUE_08BIT,
++				      ARDUCAM_64MP_MODE_STREAMING);
++}
++
++/* Stop streaming */
++static void arducam_64mp_stop_streaming(struct arducam_64mp *arducam_64mp)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&arducam_64mp->sd);
++	int ret;
++
++	/* set stream off register */
++	ret = arducam_64mp_write_reg(arducam_64mp, ARDUCAM_64MP_REG_MODE_SELECT,
++				     ARDUCAM_64MP_REG_VALUE_08BIT,
++				     ARDUCAM_64MP_MODE_STANDBY);
++	if (ret)
++		dev_err(&client->dev, "%s failed to set stream\n", __func__);
++}
++
++static int arducam_64mp_set_stream(struct v4l2_subdev *sd, int enable)
++{
++	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++	int ret = 0;
++
++	mutex_lock(&arducam_64mp->mutex);
++	if (arducam_64mp->streaming == enable) {
++		mutex_unlock(&arducam_64mp->mutex);
++		return 0;
++	}
++
++	if (enable) {
++		ret = pm_runtime_get_sync(&client->dev);
++		if (ret < 0) {
++			pm_runtime_put_noidle(&client->dev);
++			goto err_unlock;
++		}
++
++		/*
++		 * Apply default & customized values
++		 * and then start streaming.
++		 */
++		ret = arducam_64mp_start_streaming(arducam_64mp);
++		if (ret)
++			goto err_rpm_put;
++	} else {
++		arducam_64mp_stop_streaming(arducam_64mp);
++		pm_runtime_put(&client->dev);
++	}
++
++	arducam_64mp->streaming = enable;
++
++	/* vflip and hflip cannot change during streaming */
++	__v4l2_ctrl_grab(arducam_64mp->vflip, enable);
++	__v4l2_ctrl_grab(arducam_64mp->hflip, enable);
++
++	mutex_unlock(&arducam_64mp->mutex);
++
++	return ret;
++
++err_rpm_put:
++	pm_runtime_put(&client->dev);
++err_unlock:
++	mutex_unlock(&arducam_64mp->mutex);
++
++	return ret;
++}
++
++/* Power/clock management functions */
++static int arducam_64mp_power_on(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
++	int ret;
++
++	ret = regulator_bulk_enable(ARDUCAM_64MP_NUM_SUPPLIES,
++				    arducam_64mp->supplies);
++	if (ret) {
++		dev_err(&client->dev, "%s: failed to enable regulators\n",
++			__func__);
++		return ret;
++	}
++
++	ret = clk_prepare_enable(arducam_64mp->xclk);
++	if (ret) {
++		dev_err(&client->dev, "%s: failed to enable clock\n",
++			__func__);
++		goto reg_off;
++	}
++
++	gpiod_set_value_cansleep(arducam_64mp->reset_gpio, 1);
++	usleep_range(ARDUCAM_64MP_XCLR_MIN_DELAY_US,
++		     ARDUCAM_64MP_XCLR_MIN_DELAY_US +
++					ARDUCAM_64MP_XCLR_DELAY_RANGE_US);
++
++	return 0;
++
++reg_off:
++	regulator_bulk_disable(ARDUCAM_64MP_NUM_SUPPLIES,
++			       arducam_64mp->supplies);
++	return ret;
++}
++
++static int arducam_64mp_power_off(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
++
++	gpiod_set_value_cansleep(arducam_64mp->reset_gpio, 0);
++	regulator_bulk_disable(ARDUCAM_64MP_NUM_SUPPLIES,
++			       arducam_64mp->supplies);
++	clk_disable_unprepare(arducam_64mp->xclk);
++
++	/* Force reprogramming of the common registers when powered up again. */
++	arducam_64mp->common_regs_written = false;
++
++	return 0;
++}
++
++static int __maybe_unused arducam_64mp_suspend(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
++
++	if (arducam_64mp->streaming)
++		arducam_64mp_stop_streaming(arducam_64mp);
++
++	return 0;
++}
++
++static int __maybe_unused arducam_64mp_resume(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
++	int ret;
++
++	if (arducam_64mp->streaming) {
++		ret = arducam_64mp_start_streaming(arducam_64mp);
++		if (ret)
++			goto error;
++	}
++
++	return 0;
++
++error:
++	arducam_64mp_stop_streaming(arducam_64mp);
++	arducam_64mp->streaming = 0;
++	return ret;
++}
++
++static int arducam_64mp_get_regulators(struct arducam_64mp *arducam_64mp)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&arducam_64mp->sd);
++	unsigned int i;
++
++	for (i = 0; i < ARDUCAM_64MP_NUM_SUPPLIES; i++)
++		arducam_64mp->supplies[i].supply = arducam_64mp_supply_name[i];
++
++	return devm_regulator_bulk_get(&client->dev,
++				       ARDUCAM_64MP_NUM_SUPPLIES,
++				       arducam_64mp->supplies);
++}
++
++/* Verify chip ID */
++static int arducam_64mp_identify_module(struct arducam_64mp *arducam_64mp)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&arducam_64mp->sd);
++	struct i2c_client *arducam_identifier;
++	int ret;
++	u32 val;
++
++	arducam_identifier = i2c_new_dummy_device(client->adapter, 0x50);
++	if (IS_ERR(arducam_identifier)) {
++		dev_err(&client->dev, "failed to create arducam_identifier\n");
++		return PTR_ERR(arducam_identifier);
++	}
++
++	ret = arducam_64mp_read_reg(arducam_identifier,
++				    ARDUCAM_64MP_REG_CHIP_ID,
++				    ARDUCAM_64MP_REG_VALUE_16BIT, &val);
++	if (ret) {
++		dev_err(&client->dev, "failed to read chip id %x, with error %d\n",
++			ARDUCAM_64MP_CHIP_ID, ret);
++		goto error;
++	}
++
++	if (val != ARDUCAM_64MP_CHIP_ID) {
++		dev_err(&client->dev, "chip id mismatch: %x!=%x\n",
++			ARDUCAM_64MP_CHIP_ID, val);
++		ret = -EIO;
++		goto error;
++	}
++
++	dev_info(&client->dev, "Device found Arducam 64MP.\n");
++
++error:
++	i2c_unregister_device(arducam_identifier);
++
++	return ret;
++}
++
++static const struct v4l2_subdev_core_ops arducam_64mp_core_ops = {
++	.subscribe_event = v4l2_ctrl_subdev_subscribe_event,
++	.unsubscribe_event = v4l2_event_subdev_unsubscribe,
++};
++
++static const struct v4l2_subdev_video_ops arducam_64mp_video_ops = {
++	.s_stream = arducam_64mp_set_stream,
++};
++
++static const struct v4l2_subdev_pad_ops arducam_64mp_pad_ops = {
++	.enum_mbus_code = arducam_64mp_enum_mbus_code,
++	.get_fmt = arducam_64mp_get_pad_format,
++	.set_fmt = arducam_64mp_set_pad_format,
++	.get_selection = arducam_64mp_get_selection,
++	.enum_frame_size = arducam_64mp_enum_frame_size,
++};
++
++static const struct v4l2_subdev_ops arducam_64mp_subdev_ops = {
++	.core = &arducam_64mp_core_ops,
++	.video = &arducam_64mp_video_ops,
++	.pad = &arducam_64mp_pad_ops,
++};
++
++static const struct v4l2_subdev_internal_ops arducam_64mp_internal_ops = {
++	.open = arducam_64mp_open,
++};
++
++/* Initialize control handlers */
++static int arducam_64mp_init_controls(struct arducam_64mp *arducam_64mp)
++{
++	struct v4l2_ctrl_handler *ctrl_hdlr;
++	struct i2c_client *client = v4l2_get_subdevdata(&arducam_64mp->sd);
++	struct v4l2_fwnode_device_properties props;
++	struct v4l2_ctrl *link_freq;
++	unsigned int i;
++	int ret;
++	u8 test_pattern_max;
++	u8 link_freq_max;
++
++	ctrl_hdlr = &arducam_64mp->ctrl_handler;
++	ret = v4l2_ctrl_handler_init(ctrl_hdlr, 16);
++	if (ret)
++		return ret;
++
++	mutex_init(&arducam_64mp->mutex);
++	ctrl_hdlr->lock = &arducam_64mp->mutex;
++
++	/* By default, PIXEL_RATE is read only */
++	arducam_64mp->pixel_rate = v4l2_ctrl_new_std(ctrl_hdlr,
++						     &arducam_64mp_ctrl_ops,
++						     V4L2_CID_PIXEL_RATE,
++						     ARDUCAM_64MP_PIXEL_RATE,
++						     ARDUCAM_64MP_PIXEL_RATE, 1,
++						     ARDUCAM_64MP_PIXEL_RATE);
++
++	/* LINK_FREQ is also read only */
++	link_freq_max = ARRAY_SIZE(arducam_64mp_link_freq_menu) - 1;
++	link_freq =
++		v4l2_ctrl_new_int_menu(ctrl_hdlr, &arducam_64mp_ctrl_ops,
++				       V4L2_CID_LINK_FREQ,
++				       link_freq_max, 0,
++				       arducam_64mp_link_freq_menu);
++	if (link_freq)
++		link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++
++	/*
++	 * Create the controls here, but mode specific limits are setup
++	 * in the arducam_64mp_set_framing_limits() call below.
++	 */
++	arducam_64mp->vblank = v4l2_ctrl_new_std(ctrl_hdlr,
++						 &arducam_64mp_ctrl_ops,
++						 V4L2_CID_VBLANK,
++						 0, 0xffff, 1, 0);
++	arducam_64mp->hblank = v4l2_ctrl_new_std(ctrl_hdlr,
++						 &arducam_64mp_ctrl_ops,
++						 V4L2_CID_HBLANK,
++						 0, 0xffff, 1, 0);
++
++	/* HBLANK is read-only, but does change with mode. */
++	if (arducam_64mp->hblank)
++		arducam_64mp->hblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++
++	arducam_64mp->exposure =
++		v4l2_ctrl_new_std(ctrl_hdlr,
++				  &arducam_64mp_ctrl_ops,
++				  V4L2_CID_EXPOSURE,
++				  ARDUCAM_64MP_EXPOSURE_MIN,
++				  ARDUCAM_64MP_EXPOSURE_MAX,
++				  ARDUCAM_64MP_EXPOSURE_STEP,
++				  ARDUCAM_64MP_EXPOSURE_DEFAULT);
++
++	v4l2_ctrl_new_std(ctrl_hdlr, &arducam_64mp_ctrl_ops,
++			  V4L2_CID_ANALOGUE_GAIN, ARDUCAM_64MP_ANA_GAIN_MIN,
++			  ARDUCAM_64MP_ANA_GAIN_MAX, ARDUCAM_64MP_ANA_GAIN_STEP,
++			  ARDUCAM_64MP_ANA_GAIN_DEFAULT);
++
++	v4l2_ctrl_new_std(ctrl_hdlr, &arducam_64mp_ctrl_ops,
++			  V4L2_CID_DIGITAL_GAIN, ARDUCAM_64MP_DGTL_GAIN_MIN,
++			  ARDUCAM_64MP_DGTL_GAIN_MAX,
++			  ARDUCAM_64MP_DGTL_GAIN_STEP,
++			  ARDUCAM_64MP_DGTL_GAIN_DEFAULT);
++
++	arducam_64mp->hflip = v4l2_ctrl_new_std(ctrl_hdlr,
++						&arducam_64mp_ctrl_ops,
++						V4L2_CID_HFLIP, 0, 1, 1, 0);
++	if (arducam_64mp->hflip)
++		arducam_64mp->hflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++
++	arducam_64mp->vflip = v4l2_ctrl_new_std(ctrl_hdlr,
++						&arducam_64mp_ctrl_ops,
++						V4L2_CID_VFLIP, 0, 1, 1, 0);
++	if (arducam_64mp->vflip)
++		arducam_64mp->vflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++
++	test_pattern_max = ARRAY_SIZE(arducam_64mp_test_pattern_menu) - 1;
++	v4l2_ctrl_new_std_menu_items(ctrl_hdlr, &arducam_64mp_ctrl_ops,
++				     V4L2_CID_TEST_PATTERN,
++				     test_pattern_max,
++				     0, 0, arducam_64mp_test_pattern_menu);
++	for (i = 0; i < 4; i++) {
++		/*
++		 * The assumption is that
++		 * V4L2_CID_TEST_PATTERN_GREENR == V4L2_CID_TEST_PATTERN_RED + 1
++		 * V4L2_CID_TEST_PATTERN_BLUE   == V4L2_CID_TEST_PATTERN_RED + 2
++		 * V4L2_CID_TEST_PATTERN_GREENB == V4L2_CID_TEST_PATTERN_RED + 3
++		 */
++		v4l2_ctrl_new_std(ctrl_hdlr, &arducam_64mp_ctrl_ops,
++				  V4L2_CID_TEST_PATTERN_RED + i,
++				  ARDUCAM_64MP_TEST_PATTERN_COLOUR_MIN,
++				  ARDUCAM_64MP_TEST_PATTERN_COLOUR_MAX,
++				  ARDUCAM_64MP_TEST_PATTERN_COLOUR_STEP,
++				  ARDUCAM_64MP_TEST_PATTERN_COLOUR_MAX);
++		/* The "Solid color" pattern is white by default */
++	}
++
++	if (ctrl_hdlr->error) {
++		ret = ctrl_hdlr->error;
++		dev_err(&client->dev, "%s control init failed (%d)\n",
++			__func__, ret);
++		goto error;
++	}
++
++	ret = v4l2_fwnode_device_parse(&client->dev, &props);
++	if (ret)
++		goto error;
++
++	ret = v4l2_ctrl_new_fwnode_properties(ctrl_hdlr, &arducam_64mp_ctrl_ops,
++					      &props);
++	if (ret)
++		goto error;
++
++	arducam_64mp->sd.ctrl_handler = ctrl_hdlr;
++
++	/* Setup exposure and frame/line length limits. */
++	arducam_64mp_set_framing_limits(arducam_64mp);
++
++	return 0;
++
++error:
++	v4l2_ctrl_handler_free(ctrl_hdlr);
++	mutex_destroy(&arducam_64mp->mutex);
++
++	return ret;
++}
++
++static void arducam_64mp_free_controls(struct arducam_64mp *arducam_64mp)
++{
++	v4l2_ctrl_handler_free(arducam_64mp->sd.ctrl_handler);
++	mutex_destroy(&arducam_64mp->mutex);
++}
++
++static int arducam_64mp_check_hwcfg(struct device *dev)
++{
++	struct fwnode_handle *endpoint;
++	struct v4l2_fwnode_endpoint ep_cfg = {
++		.bus_type = V4L2_MBUS_CSI2_DPHY
++	};
++	int ret = -EINVAL;
++
++	endpoint = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
++	if (!endpoint) {
++		dev_err(dev, "endpoint node not found\n");
++		return -EINVAL;
++	}
++
++	if (v4l2_fwnode_endpoint_alloc_parse(endpoint, &ep_cfg)) {
++		dev_err(dev, "could not parse endpoint\n");
++		goto error_out;
++	}
++
++	/* Check the number of MIPI CSI2 data lanes */
++	if (ep_cfg.bus.mipi_csi2.num_data_lanes != 2) {
++		dev_err(dev, "only 2 data lanes are currently supported\n");
++		goto error_out;
++	}
++
++	/* Check the link frequency set in device tree */
++	if (!ep_cfg.nr_of_link_frequencies) {
++		dev_err(dev, "link-frequency property not found in DT\n");
++		goto error_out;
++	}
++
++	if (ep_cfg.nr_of_link_frequencies != 1 ||
++	    ep_cfg.link_frequencies[0] != ARDUCAM_64MP_DEFAULT_LINK_FREQ) {
++		dev_err(dev, "Link frequency not supported: %lld\n",
++			ep_cfg.link_frequencies[0]);
++		goto error_out;
++	}
++
++	ret = 0;
++
++error_out:
++	v4l2_fwnode_endpoint_free(&ep_cfg);
++	fwnode_handle_put(endpoint);
++
++	return ret;
++}
++
++static const struct of_device_id arducam_64mp_dt_ids[] = {
++	{ .compatible = "arducam,64mp"},
++	{ /* sentinel */ }
++};
++
++static int arducam_64mp_probe(struct i2c_client *client)
++{
++	struct device *dev = &client->dev;
++	struct arducam_64mp *arducam_64mp;
++	const struct of_device_id *match;
++	u32 xclk_freq;
++	int ret;
++
++	arducam_64mp = devm_kzalloc(&client->dev, sizeof(*arducam_64mp),
++				    GFP_KERNEL);
++	if (!arducam_64mp)
++		return -ENOMEM;
++
++	v4l2_i2c_subdev_init(&arducam_64mp->sd, client,
++			     &arducam_64mp_subdev_ops);
++
++	match = of_match_device(arducam_64mp_dt_ids, dev);
++	if (!match)
++		return -ENODEV;
++
++	/* Check the hardware configuration in device tree */
++	if (arducam_64mp_check_hwcfg(dev))
++		return -EINVAL;
++
++	/* Get system clock (xclk) */
++	arducam_64mp->xclk = devm_clk_get(dev, NULL);
++	if (IS_ERR(arducam_64mp->xclk)) {
++		dev_err(dev, "failed to get xclk\n");
++		return PTR_ERR(arducam_64mp->xclk);
++	}
++
++	xclk_freq = clk_get_rate(arducam_64mp->xclk);
++	if (xclk_freq != ARDUCAM_64MP_XCLK_FREQ) {
++		dev_err(dev, "xclk frequency not supported: %d Hz\n",
++			xclk_freq);
++		return -EINVAL;
++	}
++
++	ret = arducam_64mp_get_regulators(arducam_64mp);
++	if (ret) {
++		dev_err(dev, "failed to get regulators\n");
++		return ret;
++	}
++
++	/* Request optional enable pin */
++	arducam_64mp->reset_gpio = devm_gpiod_get_optional(dev, "reset",
++							   GPIOD_OUT_HIGH);
++
++	/*
++	 * The sensor must be powered for arducam_64mp_identify_module()
++	 * to be able to read the CHIP_ID from arducam_identifier.
++	 */
++	ret = arducam_64mp_power_on(dev);
++	if (ret)
++		return ret;
++
++	ret = arducam_64mp_identify_module(arducam_64mp);
++	if (ret)
++		goto error_power_off;
++
++	/* Set default mode to max resolution */
++	arducam_64mp->mode = &supported_modes[0];
++	arducam_64mp->fmt_code = MEDIA_BUS_FMT_SRGGB10_1X10;
++
++	/* Enable runtime PM and turn off the device */
++	pm_runtime_set_active(dev);
++	pm_runtime_enable(dev);
++	pm_runtime_idle(dev);
++
++	/* This needs the pm runtime to be registered. */
++	ret = arducam_64mp_init_controls(arducam_64mp);
++	if (ret)
++		goto error_power_off;
++
++	/* Initialize subdev */
++	arducam_64mp->sd.internal_ops = &arducam_64mp_internal_ops;
++	arducam_64mp->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE |
++			    V4L2_SUBDEV_FL_HAS_EVENTS;
++	arducam_64mp->sd.entity.function = MEDIA_ENT_F_CAM_SENSOR;
++
++	/* Initialize source pads */
++	arducam_64mp->pad[IMAGE_PAD].flags = MEDIA_PAD_FL_SOURCE;
++	arducam_64mp->pad[METADATA_PAD].flags = MEDIA_PAD_FL_SOURCE;
++
++	ret = media_entity_pads_init(&arducam_64mp->sd.entity, NUM_PADS,
++				     arducam_64mp->pad);
++	if (ret) {
++		dev_err(dev, "failed to init entity pads: %d\n", ret);
++		goto error_handler_free;
++	}
++
++	ret = v4l2_async_register_subdev_sensor(&arducam_64mp->sd);
++	if (ret < 0) {
++		dev_err(dev, "failed to register sensor sub-device: %d\n", ret);
++		goto error_media_entity;
++	}
++
++	return 0;
++
++error_media_entity:
++	media_entity_cleanup(&arducam_64mp->sd.entity);
++
++error_handler_free:
++	arducam_64mp_free_controls(arducam_64mp);
++
++error_power_off:
++	pm_runtime_disable(&client->dev);
++	pm_runtime_set_suspended(&client->dev);
++	arducam_64mp_power_off(&client->dev);
++
++	return ret;
++}
++
++static void arducam_64mp_remove(struct i2c_client *client)
++{
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct arducam_64mp *arducam_64mp = to_arducam_64mp(sd);
++
++	v4l2_async_unregister_subdev(sd);
++	media_entity_cleanup(&sd->entity);
++	arducam_64mp_free_controls(arducam_64mp);
++
++	pm_runtime_disable(&client->dev);
++	if (!pm_runtime_status_suspended(&client->dev))
++		arducam_64mp_power_off(&client->dev);
++	pm_runtime_set_suspended(&client->dev);
++}
++
++MODULE_DEVICE_TABLE(of, arducam_64mp_dt_ids);
++
++static const struct dev_pm_ops arducam_64mp_pm_ops = {
++	SET_SYSTEM_SLEEP_PM_OPS(arducam_64mp_suspend, arducam_64mp_resume)
++	SET_RUNTIME_PM_OPS(arducam_64mp_power_off, arducam_64mp_power_on, NULL)
++};
++
++static struct i2c_driver arducam_64mp_i2c_driver = {
++	.driver = {
++		.name = "arducam_64mp",
++		.of_match_table	= arducam_64mp_dt_ids,
++		.pm = &arducam_64mp_pm_ops,
++	},
++	.probe = arducam_64mp_probe,
++	.remove = arducam_64mp_remove,
++};
++
++module_i2c_driver(arducam_64mp_i2c_driver);
++
++MODULE_AUTHOR("Lee Jackson <info@arducam.com>");
++MODULE_DESCRIPTION("Arducam 64MP sensor driver");
++MODULE_LICENSE("GPL v2");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0290-Add-HDMI1-facility-to-the-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0290-Add-HDMI1-facility-to-the-driver.patch
new file mode 100644
index 00000000..f264b4aa
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0290-Add-HDMI1-facility-to-the-driver.patch
@@ -0,0 +1,300 @@
+From ed7528ad9d1a06e252ab24721600146d49ec66e3 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Wed, 8 Jun 2022 20:49:22 +0100
+Subject: [PATCH 290/697] Add HDMI1 facility to the driver.
+
+Also check for which HDMI devices are connected and only create
+devices for those that are present.
+
+Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+snd_bcm2835: disable HDMI audio when vc4 is used (#3640)
+
+Things don't work too well when both the vc4 driver and the firmware
+driver are trying to control the same audio output:
+
+[  763.569406] bcm2835_audio bcm2835_audio: vchi message timeout, msg=5
+
+Hence, when the vc4 HDMI driver is used, let it control audio. This is done
+by introducing a new device tree property to the audio node, and
+extending the vc4-kms-v3d overlays to set it appropriately.
+
+Signed-off-by: Hristo Venev <hristo@venev.name>
+
+staging: bcm2835-audio: Add disable-headphones flag
+
+Add a property to allow the headphone output to be disabled. Use an
+integer property rather than a boolean so that an overlay can clear it.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+staging: bcm2835-audio: Find compatible firmware node
+
+Commit "ARM: dts: Adopt the upstream snd_bcm2835 handling" removed the
+audio section from the DT and the driver can no longer access the
+referenced firmware node 'brcm,firmware'. Fix that by searching for a
+compatible firmware node instead, similar to drivers/gpu/drm/vc4.
+
+Fixes: b9e62329e096 ("ARM: dts: Adopt the upstream snd_bcm2835 handling")
+Signed-off-by: Juerg Haefliger <juergh@proton.me>
+
+staging: bcm2835-audio: Fix firmware node refcounting
+
+Decrement firmware node refcounts on all exit paths in set_hdmi_enables().
+
+Signed-off-by: Juerg Haefliger <juergh@proton.me>
+
+staging: bcm2835-audio: Log errors in case of firmware query failures
+
+The driver queries the firmware for the number of detected HDMI displays
+and their IDs. Log error messages if queries fail.
+
+Signed-off-by: Juerg Haefliger <juergh@proton.me>
+
+staging: bcm2835-audio: Fix unused enable_hdmi module parameter
+
+The commit "Add HDMI1 facility to the driver." made the enable_hdmi module
+parameter unused. Fix that by making it a global switch for all available
+HDMI audio outputs.
+
+Fixes: 755f3366084b ("Add HDMI1 facility to the driver.")
+Signed-off-by: Juerg Haefliger <juergh@proton.me>
+
+staging: bcm2835-audio: Fix unused enable_headphones module parameter
+
+Since commit "staging: bcm2835-audio: Add disable-headphones flag" the
+enabling/disabling of the headphones output is solely determined by the
+presence of the DT property 'brcm,disable-headphones' and the
+enable_headphones module parameter is unused. Fix that by making it a
+global switch.
+
+Fixes: ee90e47d8824 ("staging: bcm2835-audio: Add disable-headphones flag")
+Signed-off-by: Juerg Haefliger <juergh@proton.me>
+---
+ .../vc04_services/bcm2835-audio/bcm2835-pcm.c |   3 +-
+ .../vc04_services/bcm2835-audio/bcm2835.c     | 111 ++++++++++++++++--
+ .../vc04_services/bcm2835-audio/bcm2835.h     |   6 +-
+ 3 files changed, 106 insertions(+), 14 deletions(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
++++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+@@ -321,10 +321,11 @@ static const struct snd_pcm_ops snd_bcm2
+ 
+ /* create a pcm device */
+ int snd_bcm2835_new_pcm(struct bcm2835_chip *chip, const char *name,
+-			int idx, enum snd_bcm2835_route route,
++			enum snd_bcm2835_route route,
+ 			u32 numchannels, bool spdif)
+ {
+ 	struct snd_pcm *pcm;
++	int idx = chip->index++;
+ 	int err;
+ 
+ 	err = snd_pcm_new(chip->card, name, idx, numchannels, 0, &pcm);
+--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
++++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+@@ -5,11 +5,13 @@
+ #include <linux/init.h>
+ #include <linux/slab.h>
+ #include <linux/module.h>
++#include <linux/of.h>
+ 
+ #include "../interface/vchiq_arm/vchiq_bus.h"
+ #include "bcm2835.h"
++#include <soc/bcm2835/raspberrypi-firmware.h>
+ 
+-static bool enable_hdmi;
++static bool enable_hdmi, enable_hdmi0, enable_hdmi1;
+ static bool enable_headphones = true;
+ static int num_channels = MAX_SUBSTREAMS;
+ 
+@@ -65,14 +67,13 @@ static int bcm2835_audio_dual_newpcm(str
+ 				     u32 numchannels)
+ {
+ 	int err;
+-
+-	err = snd_bcm2835_new_pcm(chip, name, 0, route,
++	err = snd_bcm2835_new_pcm(chip, name, route,
+ 				  numchannels, false);
+ 
+ 	if (err)
+ 		return err;
+ 
+-	err = snd_bcm2835_new_pcm(chip, "IEC958", 1, route, 1, true);
++	err = snd_bcm2835_new_pcm(chip, name, route, 1, true);
+ 	if (err)
+ 		return err;
+ 
+@@ -84,20 +85,33 @@ static int bcm2835_audio_simple_newpcm(s
+ 				       enum snd_bcm2835_route route,
+ 				       u32 numchannels)
+ {
+-	return snd_bcm2835_new_pcm(chip, name, 0, route, numchannels, false);
++	return snd_bcm2835_new_pcm(chip, name, route, numchannels, false);
+ }
+ 
+-static struct bcm2835_audio_driver bcm2835_audio_hdmi = {
++static struct bcm2835_audio_driver bcm2835_audio_hdmi0 = {
++	.driver = {
++		.name = "bcm2835_hdmi",
++		.owner = THIS_MODULE,
++	},
++	.shortname = "bcm2835 HDMI 1",
++	.longname  = "bcm2835 HDMI 1",
++	.minchannels = 1,
++	.newpcm = bcm2835_audio_dual_newpcm,
++	.newctl = snd_bcm2835_new_hdmi_ctl,
++	.route = AUDIO_DEST_HDMI0
++};
++
++static struct bcm2835_audio_driver bcm2835_audio_hdmi1 = {
+ 	.driver = {
+ 		.name = "bcm2835_hdmi",
+ 		.owner = THIS_MODULE,
+ 	},
+-	.shortname = "bcm2835 HDMI",
+-	.longname  = "bcm2835 HDMI",
++	.shortname = "bcm2835 HDMI 2",
++	.longname  = "bcm2835 HDMI 2",
+ 	.minchannels = 1,
+ 	.newpcm = bcm2835_audio_dual_newpcm,
+ 	.newctl = snd_bcm2835_new_hdmi_ctl,
+-	.route = AUDIO_DEST_HDMI
++	.route = AUDIO_DEST_HDMI1
+ };
+ 
+ static struct bcm2835_audio_driver bcm2835_audio_headphones = {
+@@ -120,8 +134,12 @@ struct bcm2835_audio_drivers {
+ 
+ static struct bcm2835_audio_drivers children_devices[] = {
+ 	{
+-		.audio_driver = &bcm2835_audio_hdmi,
+-		.is_enabled = &enable_hdmi,
++		.audio_driver = &bcm2835_audio_hdmi0,
++		.is_enabled = &enable_hdmi0,
++	},
++	{
++		.audio_driver = &bcm2835_audio_hdmi1,
++		.is_enabled = &enable_hdmi1,
+ 	},
+ 	{
+ 		.audio_driver = &bcm2835_audio_headphones,
+@@ -268,10 +286,70 @@ static int snd_add_child_devices(struct
+ 	return 0;
+ }
+ 
++static void set_hdmi_enables(struct device *dev)
++{
++	struct device_node *firmware_node;
++	struct rpi_firmware *firmware = NULL;
++	u32 num_displays, i, display_id;
++	int ret;
++
++	firmware_node = of_find_compatible_node(NULL, NULL,
++					"raspberrypi,bcm2835-firmware");
++	if (firmware_node) {
++		firmware = rpi_firmware_get(firmware_node);
++		of_node_put(firmware_node);
++	}
++
++	if (!firmware) {
++		dev_err(dev, "Failed to get fw structure\n");
++		return;
++	}
++
++	ret = rpi_firmware_property(firmware,
++				    RPI_FIRMWARE_FRAMEBUFFER_GET_NUM_DISPLAYS,
++				    &num_displays, sizeof(u32));
++	if (ret) {
++		dev_err(dev, "Failed to get fw property NUM_DISPLAYS\n");
++		goto out_rpi_fw_put;
++	}
++
++	for (i = 0; i < num_displays; i++) {
++		display_id = i;
++		ret = rpi_firmware_property(firmware,
++				RPI_FIRMWARE_FRAMEBUFFER_GET_DISPLAY_ID,
++				&display_id, sizeof(display_id));
++		if (ret) {
++			dev_err(dev, "Failed to get fw property DISPLAY_ID "
++				"(i = %d)\n", i);
++		} else {
++			if (display_id == 2)
++				enable_hdmi0 = true;
++			if (display_id == 7)
++				enable_hdmi1 = true;
++		}
++	}
++
++	if (!enable_hdmi0 && enable_hdmi1) {
++		/* Swap them over and reassign route. This means
++		 * that if we only have one connected, it is always named
++		 *  HDMI1, irrespective of if its on port HDMI0 or HDMI1.
++		 *  This should match with the naming of HDMI ports in DRM
++		 */
++		enable_hdmi0 = true;
++		enable_hdmi1 = false;
++		bcm2835_audio_hdmi0.route = AUDIO_DEST_HDMI1;
++	}
++
++out_rpi_fw_put:
++	rpi_firmware_put(firmware);
++	return;
++}
++
+ static int snd_bcm2835_alsa_probe(struct vchiq_device *device)
+ {
+ 	struct device *dev = &device->dev;
+ 	int err;
++	u32 disable_headphones = 0;
+ 
+ 	err = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32));
+ 	if (err) {
+@@ -285,6 +363,17 @@ static int snd_bcm2835_alsa_probe(struct
+ 			 num_channels);
+ 	}
+ 
++	if (enable_hdmi &&
++	    !of_property_read_bool(dev->of_node, "brcm,disable-hdmi"))
++		set_hdmi_enables(dev);
++
++	if (enable_headphones) {
++		of_property_read_u32(dev->of_node,
++				     "brcm,disable-headphones",
++				     &disable_headphones);
++		enable_headphones = !disable_headphones;
++	}
++
+ 	err = bcm2835_devm_add_vchi_ctx(dev);
+ 	if (err)
+ 		return err;
+--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
++++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
+@@ -34,7 +34,8 @@ enum {
+ enum snd_bcm2835_route {
+ 	AUDIO_DEST_AUTO = 0,
+ 	AUDIO_DEST_HEADPHONES = 1,
+-	AUDIO_DEST_HDMI = 2,
++	AUDIO_DEST_HDMI0 = 2,
++	AUDIO_DEST_HDMI1 = 3,
+ 	AUDIO_DEST_MAX,
+ };
+ 
+@@ -59,6 +60,7 @@ struct bcm2835_chip {
+ 	int volume;
+ 	int dest;
+ 	int mute;
++	int index;
+ 
+ 	unsigned int opened;
+ 	unsigned int spdif_status;
+@@ -85,7 +87,7 @@ struct bcm2835_alsa_stream {
+ };
+ 
+ int snd_bcm2835_new_pcm(struct bcm2835_chip *chip, const char *name,
+-			int idx, enum snd_bcm2835_route route,
++			enum snd_bcm2835_route route,
+ 			u32 numchannels, bool spdif);
+ 
+ int snd_bcm2835_new_hdmi_ctl(struct bcm2835_chip *chip);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0291-Populate-phy-driver-block-for-BCM54213PE.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0291-Populate-phy-driver-block-for-BCM54213PE.patch
new file mode 100644
index 00000000..b42bc72d
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0291-Populate-phy-driver-block-for-BCM54213PE.patch
@@ -0,0 +1,33 @@
+From f0f712912efa0c0df110f7b77a64e136e251b688 Mon Sep 17 00:00:00 2001
+From: Jonathan Lemon <jonathan.lemon@gmail.com>
+Date: Wed, 4 May 2022 14:33:05 -0700
+Subject: [PATCH 291/697] Populate phy driver block for BCM54213PE
+
+The BCM54213PE identifier is a RPI-specific addition.
+Populate the remainder of the driver functions, including the
+required probe routine.
+
+Add a version of bcm54xx_suspend, from upstream.
+
+Signed-off-by: Jonathan Lemon <jonathan.lemon@gmail.com>
+---
+ drivers/net/phy/broadcom.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/phy/broadcom.c
++++ b/drivers/net/phy/broadcom.c
+@@ -1478,8 +1478,14 @@ static struct phy_driver broadcom_driver
+ 	.phy_id_mask	= 0xffffffff,
+ 	.name		= "Broadcom BCM54213PE",
+ 	/* PHY_GBIT_FEATURES */
++	.get_sset_count	= bcm_phy_get_sset_count,
++	.get_strings	= bcm_phy_get_strings,
++	.get_stats	= bcm54xx_get_stats,
++	.probe		= bcm54xx_phy_probe,
+ 	.config_init	= bcm54xx_config_init,
+ 	.config_intr	= bcm_phy_config_intr,
++	.suspend	= bcm54xx_suspend,
++	.resume		= bcm54xx_resume,
+ }, {
+ 	.phy_id		= PHY_ID_BCM5461,
+ 	.phy_id_mask	= 0xfffffff0,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0292-media-bcm2835-unicam-Correctly-handle-FS-FE-ISR-cond.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0292-media-bcm2835-unicam-Correctly-handle-FS-FE-ISR-cond.patch
new file mode 100644
index 00000000..2bd05a03
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0292-media-bcm2835-unicam-Correctly-handle-FS-FE-ISR-cond.patch
@@ -0,0 +1,64 @@
+From 577c32b96737568a3c40a43ec706a504a89ee3a6 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Mon, 8 Aug 2022 10:01:41 +0100
+Subject: [PATCH 292/697] media: bcm2835-unicam: Correctly handle FS + FE ISR
+ condtion
+
+If we get a simultaneous FS + FE interrupt for the same frame, it cannot be
+marked as completed and returned to userland as the framebuffer will be refilled
+by Unicam on the next sensor frame. Additionally, the timestamp will be set to 0
+as the FS interrupt handling code will not have run yet.
+
+To avoid these problems, the frame is considered dropped in the FE handler,
+and will be returned to userland on the subsequent sensor frame.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../media/platform/bcm2835/bcm2835-unicam.c   | 28 +++++++++++++------
+ 1 file changed, 20 insertions(+), 8 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -908,7 +908,9 @@ static irqreturn_t unicam_isr(int irq, v
+ 		 * to use.
+ 		 */
+ 		for (i = 0; i < ARRAY_SIZE(unicam->node); i++) {
+-			if (!unicam->node[i].streaming)
++			struct unicam_node *node = &unicam->node[i];
++
++			if (!node->streaming)
+ 				continue;
+ 
+ 			/*
+@@ -918,14 +920,24 @@ static irqreturn_t unicam_isr(int irq, v
+ 			 * + FS + LS). In this case, we cannot signal the buffer
+ 			 * as complete, as the HW will reuse that buffer.
+ 			 */
+-			if (unicam->node[i].cur_frm &&
+-			    unicam->node[i].cur_frm != unicam->node[i].next_frm) {
+-				unicam_process_buffer_complete(&unicam->node[i],
+-							       sequence);
+-				unicam->node[i].cur_frm = unicam->node[i].next_frm;
+-				unicam->node[i].next_frm = NULL;
++			if (node->cur_frm && node->cur_frm != node->next_frm) {
++				/*
++				 * This condition checks if FE + FS for the same
++				 * frame has occurred. In such cases, we cannot
++				 * return out the frame, as no buffer handling
++				 * or timestamping has yet been done as part of
++				 * the FS handler.
++				 */
++				if (!node->cur_frm->vb.vb2_buf.timestamp) {
++					unicam_dbg(2, unicam, "ISR: FE without FS, dropping frame\n");
++					continue;
++				}
++
++				unicam_process_buffer_complete(node, sequence);
++				node->cur_frm = node->next_frm;
++				node->next_frm = NULL;
+ 			} else {
+-				unicam->node[i].cur_frm = unicam->node[i].next_frm;
++				node->cur_frm = node->next_frm;
+ 			}
+ 		}
+ 		unicam->sequence++;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0293-media-video-mux-Read-CSI2-config-from-FW-and-pass-to.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0293-media-video-mux-Read-CSI2-config-from-FW-and-pass-to.patch
new file mode 100644
index 00000000..f1be0e20
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0293-media-video-mux-Read-CSI2-config-from-FW-and-pass-to.patch
@@ -0,0 +1,158 @@
+From 9ce82409f333cbca919926c9d0f1d6f5efdb30b9 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 29 Jul 2022 17:46:49 +0100
+Subject: [PATCH 293/697] media: video-mux: Read CSI2 config from FW, and pass
+ to receiver
+
+There is no obligation for all source devices on a video-mux to
+require the same bus configuration, so read the configuration
+from the sink ports, and relay via get_mbus_config on the source
+port.
+If the sources support get_mbus_config, then call that first.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/platform/video-mux.c | 73 ++++++++++++++++++++++++++++--
+ 1 file changed, 69 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/platform/video-mux.c
++++ b/drivers/media/platform/video-mux.c
+@@ -20,10 +20,27 @@
+ #include <media/v4l2-mc.h>
+ #include <media/v4l2-subdev.h>
+ 
++struct video_mux_asd {
++	struct v4l2_async_connection base;
++	unsigned int port;
++};
++
++static inline struct video_mux_asd *to_video_mux_asd(struct v4l2_async_connection *asd)
++{
++	return container_of(asd, struct video_mux_asd, base);
++}
++
++struct video_mux_pad_cfg {
++	unsigned int num_lanes;
++	bool non_continuous;
++	struct v4l2_subdev *source;
++};
++
+ struct video_mux {
+ 	struct v4l2_subdev subdev;
+ 	struct v4l2_async_notifier notifier;
+ 	struct media_pad *pads;
++	struct video_mux_pad_cfg *cfg;
+ 	struct mux_control *mux;
+ 	struct mutex lock;
+ 	int active;
+@@ -301,9 +318,33 @@ static int video_mux_init_state(struct v
+ 	return 0;
+ }
+ 
++static int video_mux_get_mbus_config(struct v4l2_subdev *sd,
++				     unsigned int pad,
++				     struct v4l2_mbus_config *cfg)
++{
++	struct video_mux *vmux = v4l2_subdev_to_video_mux(sd);
++	int ret;
++
++	ret = v4l2_subdev_call(vmux->cfg[vmux->active].source, pad, get_mbus_config,
++			       0, cfg);
++
++	if (ret != -ENOIOCTLCMD)
++		return ret;
++
++	cfg->type = V4L2_MBUS_CSI2_DPHY;
++	cfg->bus.mipi_csi2.num_data_lanes = vmux->cfg[vmux->active].num_lanes;
++
++	/* Support for non-continuous CSI-2 clock is missing in pdate mode */
++	if (vmux->cfg[vmux->active].non_continuous)
++		cfg->bus.mipi_csi2.flags |= V4L2_MBUS_CSI2_NONCONTINUOUS_CLOCK;
++
++	return 0;
++};
++
+ static const struct v4l2_subdev_pad_ops video_mux_pad_ops = {
+ 	.get_fmt = v4l2_subdev_get_fmt,
+ 	.set_fmt = video_mux_set_format,
++	.get_mbus_config = video_mux_get_mbus_config,
+ };
+ 
+ static const struct v4l2_subdev_ops video_mux_subdev_ops = {
+@@ -320,6 +361,9 @@ static int video_mux_notify_bound(struct
+ 				  struct v4l2_async_connection *asd)
+ {
+ 	struct video_mux *vmux = notifier_to_video_mux(notifier);
++	unsigned int port = to_video_mux_asd(asd)->port;
++
++	vmux->cfg[port].source = sd;
+ 
+ 	return v4l2_create_fwnode_links(sd, &vmux->subdev);
+ }
+@@ -337,7 +381,7 @@ static int video_mux_async_register(stru
+ 	v4l2_async_subdev_nf_init(&vmux->notifier, &vmux->subdev);
+ 
+ 	for (i = 0; i < num_input_pads; i++) {
+-		struct v4l2_async_connection *asd;
++		struct video_mux_asd *asd;
+ 		struct fwnode_handle *ep, *remote_ep;
+ 
+ 		ep = fwnode_graph_get_endpoint_by_id(
+@@ -355,8 +399,7 @@ static int video_mux_async_register(stru
+ 		fwnode_handle_put(remote_ep);
+ 
+ 		asd = v4l2_async_nf_add_fwnode_remote(&vmux->notifier, ep,
+-						      struct v4l2_async_connection);
+-
++						      struct video_mux_asd);
+ 		fwnode_handle_put(ep);
+ 
+ 		if (IS_ERR(asd)) {
+@@ -365,6 +408,8 @@ static int video_mux_async_register(stru
+ 			if (ret != -EEXIST)
+ 				goto err_nf_cleanup;
+ 		}
++
++		asd->port = i;
+ 	}
+ 
+ 	vmux->notifier.ops = &video_mux_notify_ops;
+@@ -390,6 +435,9 @@ static int video_mux_probe(struct platfo
+ {
+ 	struct device_node *np = pdev->dev.of_node;
+ 	struct device *dev = &pdev->dev;
++	struct v4l2_fwnode_endpoint fwnode_ep = {
++		.bus_type = V4L2_MBUS_CSI2_DPHY
++	};
+ 	struct device_node *ep;
+ 	struct video_mux *vmux;
+ 	unsigned int num_pads = 0;
+@@ -437,10 +485,27 @@ static int video_mux_probe(struct platfo
+ 	if (!vmux->pads)
+ 		return -ENOMEM;
+ 
+-	for (i = 0; i < num_pads; i++)
++	vmux->cfg = devm_kcalloc(dev, num_pads, sizeof(*vmux->cfg), GFP_KERNEL);
++	if (!vmux->cfg)
++		return -ENOMEM;
++
++	for (i = 0; i < num_pads; i++) {
+ 		vmux->pads[i].flags = (i < num_pads - 1) ? MEDIA_PAD_FL_SINK
+ 							 : MEDIA_PAD_FL_SOURCE;
+ 
++		ep = of_graph_get_endpoint_by_regs(pdev->dev.of_node, i, 0);
++		if (ep) {
++			ret = v4l2_fwnode_endpoint_parse(of_fwnode_handle(ep), &fwnode_ep);
++			if (!ret) {
++				/* Get number of data lanes */
++				vmux->cfg[i].num_lanes = fwnode_ep.bus.mipi_csi2.num_data_lanes;
++				vmux->cfg[i].non_continuous = fwnode_ep.bus.mipi_csi2.flags &
++							V4L2_MBUS_CSI2_NONCONTINUOUS_CLOCK;
++			}
++			of_node_put(ep);
++		}
++	}
++
+ 	vmux->subdev.entity.function = MEDIA_ENT_F_VID_MUX;
+ 	ret = media_entity_pads_init(&vmux->subdev.entity, num_pads,
+ 				     vmux->pads);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0294-media-bcm2835-unicam-Fix-for-possible-dummy-buffer-o.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0294-media-bcm2835-unicam-Fix-for-possible-dummy-buffer-o.patch
new file mode 100644
index 00000000..26eb698a
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0294-media-bcm2835-unicam-Fix-for-possible-dummy-buffer-o.patch
@@ -0,0 +1,56 @@
+From 13e4f1140ec9d8e11ae2237318304935035058b8 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Fri, 2 Sep 2022 08:35:35 +0100
+Subject: [PATCH 294/697] media: bcm2835-unicam: Fix for possible dummy buffer
+ overrun
+
+The Unicam hardware has been observed to cause a buffer overrun when using the
+dummy buffer as a circular buffer. The conditions that cause the overrun are not
+fully known, but it seems to occur when the memory bus is heavily loaded.
+
+To avoid the overrun, program the hardware with a buffer size of 0 when using
+the dummy buffer. This will cause overrun into the allocated dummy buffer, but
+avoid out of bounds writes.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -126,8 +126,11 @@ MODULE_PARM_DESC(media_controller, "Use
+ #define UNICAM_EMBEDDED_SIZE	16384
+ 
+ /*
+- * Size of the dummy buffer. Can be any size really, but the DMA
+- * allocation works in units of page sizes.
++ * Size of the dummy buffer allocation.
++ *
++ * Due to a HW bug causing buffer overruns in circular buffer mode under certain
++ * (not yet fully known) conditions, the dummy buffer allocation is set to a
++ * a single page size, but the hardware gets programmed with a buffer size of 0.
+  */
+ #define DUMMY_BUF_SIZE		(PAGE_SIZE)
+ 
+@@ -832,8 +835,7 @@ static void unicam_schedule_dummy_buffer
+ 	unicam_dbg(3, dev, "Scheduling dummy buffer for node %d\n",
+ 		   node->pad_id);
+ 
+-	unicam_wr_dma_addr(dev, node->dummy_buf_dma_addr, DUMMY_BUF_SIZE,
+-			   node->pad_id);
++	unicam_wr_dma_addr(dev, node->dummy_buf_dma_addr, 0, node->pad_id);
+ 	node->next_frm = NULL;
+ }
+ 
+@@ -2651,8 +2653,8 @@ static void unicam_stop_streaming(struct
+ 		 * This is only really needed if the embedded data pad is
+ 		 * disabled before the image pad.
+ 		 */
+-		unicam_wr_dma_addr(dev, node->dummy_buf_dma_addr,
+-				   DUMMY_BUF_SIZE, METADATA_PAD);
++		unicam_wr_dma_addr(dev, node->dummy_buf_dma_addr, 0,
++				   METADATA_PAD);
+ 	}
+ 
+ 	/* Clear all queued buffers for the node */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0295-media-bcm2835-unicam-Fix-up-start-stop-api-change.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0295-media-bcm2835-unicam-Fix-up-start-stop-api-change.patch
new file mode 100644
index 00000000..18418eaa
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0295-media-bcm2835-unicam-Fix-up-start-stop-api-change.patch
@@ -0,0 +1,39 @@
+From 0b977fe3b87405ef9ce0a4dee024d4deb5a69245 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Mon, 24 Oct 2022 13:57:23 +0100
+Subject: [PATCH 295/697] media: bcm2835-unicam: Fix up start/stop api change
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -2513,7 +2513,7 @@ static int unicam_start_streaming(struct
+ 		goto err_streaming;
+ 	}
+ 
+-	ret = media_pipeline_start(&node->video_dev.entity, &node->pipe);
++	ret = media_pipeline_start(node->video_dev.entity.pads, &node->pipe);
+ 	if (ret < 0) {
+ 		unicam_err(dev, "Failed to start media pipeline: %d\n", ret);
+ 		goto err_pm_put;
+@@ -2607,7 +2607,7 @@ err_vpu_clock:
+ 		unicam_err(dev, "failed to reset the VPU clock\n");
+ 	clk_disable_unprepare(dev->vpu_clock);
+ error_pipeline:
+-	media_pipeline_stop(&node->video_dev.entity);
++	media_pipeline_stop(node->video_dev.entity.pads);
+ err_pm_put:
+ 	unicam_runtime_put(dev);
+ err_streaming:
+@@ -2635,7 +2635,7 @@ static void unicam_stop_streaming(struct
+ 
+ 		unicam_disable(dev);
+ 
+-		media_pipeline_stop(&node->video_dev.entity);
++		media_pipeline_stop(node->video_dev.entity.pads);
+ 
+ 		if (dev->clocks_enabled) {
+ 			if (clk_set_min_rate(dev->vpu_clock, 0))
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0296-media-adv7180-Nasty-hack-to-allow-input-selection.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0296-media-adv7180-Nasty-hack-to-allow-input-selection.patch
new file mode 100644
index 00000000..0c862827
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0296-media-adv7180-Nasty-hack-to-allow-input-selection.patch
@@ -0,0 +1,89 @@
+From fada7d9531a40e00ae31c078ca7208c83b0361aa Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Wed, 31 Oct 2018 15:00:04 +0000
+Subject: [PATCH 296/697] media: adv7180: Nasty hack to allow input selection.
+
+Whilst the adv7180 driver support s_routing, nothing else
+does, and there is a missing lump of framework code to
+define the mapping from connectors on a board to the inputs
+they represent on the ADV7180.
+
+Add a nasty hack to take a module parameter that is passed in
+to s_routing on any call to G_STD, or S_STD (or subdev
+g_input_status call).
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ drivers/media/i2c/adv7180.c | 30 ++++++++++++++++++++++++++++--
+ 1 file changed, 28 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -189,6 +189,10 @@
+ /* Initial number of frames to skip to avoid possible garbage */
+ #define ADV7180_NUM_OF_SKIP_FRAMES       2
+ 
++static int dbg_input;
++module_param(dbg_input, int, 0644);
++MODULE_PARM_DESC(dbg_input, "Input number (0-31)");
++
+ struct adv7180_state;
+ 
+ #define ADV7180_FLAG_RESET_POWERED	BIT(0)
+@@ -407,10 +411,24 @@ out:
+ 	return ret;
+ }
+ 
++static void adv7180_check_input(struct v4l2_subdev *sd)
++{
++	struct adv7180_state *state = to_state(sd);
++
++	if (state->input != dbg_input)
++		if (adv7180_s_routing(sd, dbg_input, 0, 0))
++			/* Failed - reset dbg_input */
++			dbg_input = state->input;
++}
++
+ static int adv7180_g_input_status(struct v4l2_subdev *sd, u32 *status)
+ {
+ 	struct adv7180_state *state = to_state(sd);
+-	int ret = mutex_lock_interruptible(&state->mutex);
++	int ret;
++
++	adv7180_check_input(sd);
++
++	ret = mutex_lock_interruptible(&state->mutex);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -436,7 +454,11 @@ static int adv7180_program_std(struct ad
+ static int adv7180_s_std(struct v4l2_subdev *sd, v4l2_std_id std)
+ {
+ 	struct adv7180_state *state = to_state(sd);
+-	int ret = mutex_lock_interruptible(&state->mutex);
++	int ret;
++
++	adv7180_check_input(sd);
++
++	ret = mutex_lock_interruptible(&state->mutex);
+ 
+ 	if (ret)
+ 		return ret;
+@@ -458,6 +480,8 @@ static int adv7180_g_std(struct v4l2_sub
+ {
+ 	struct adv7180_state *state = to_state(sd);
+ 
++	adv7180_check_input(sd);
++
+ 	*norm = state->curr_norm;
+ 
+ 	return 0;
+@@ -895,6 +919,8 @@ static int adv7180_s_stream(struct v4l2_
+ 		return 0;
+ 	}
+ 
++	adv7180_check_input(sd);
++
+ 	/* Must wait until querystd released the lock */
+ 	ret = mutex_lock_interruptible(&state->mutex);
+ 	if (ret)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0297-media-i2c-ov7251-Add-module-param-to-select-ext-trig.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0297-media-i2c-ov7251-Add-module-param-to-select-ext-trig.patch
new file mode 100644
index 00000000..04c588c5
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0297-media-i2c-ov7251-Add-module-param-to-select-ext-trig.patch
@@ -0,0 +1,88 @@
+From 68e4dd5b017e9333f83a7d56a26fc07e5e9dac12 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 1 Dec 2022 13:54:49 +0000
+Subject: [PATCH 297/697] media: i2c: ov7251: Add module param to select ext
+ trig mode
+
+As there isn't currently a defined mechanism for selecting an
+external trigger mode on image sensors, copy the imx477
+approach of using a module parameter to enable ext trig.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/ov7251.c | 35 ++++++++++++++++++++++++++++++++---
+ 1 file changed, 32 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/i2c/ov7251.c
++++ b/drivers/media/i2c/ov7251.c
+@@ -23,6 +23,10 @@
+ #include <media/v4l2-fwnode.h>
+ #include <media/v4l2-subdev.h>
+ 
++static int trigger_mode;
++module_param(trigger_mode, int, 0644);
++MODULE_PARM_DESC(trigger_mode, "Set vsync trigger mode: 0=standalone, (1=source - not implemented), 2=sink");
++
+ #define OV7251_SC_MODE_SELECT		0x0100
+ #define OV7251_SC_MODE_SELECT_SW_STANDBY	0x0
+ #define OV7251_SC_MODE_SELECT_STREAMING		0x1
+@@ -525,7 +529,6 @@ static const struct reg_value ov7251_set
+ 	{ 0x3662, 0x01 },
+ 	{ 0x3663, 0x70 },
+ 	{ 0x3664, 0x50 },
+-	{ 0x3666, 0x0a },
+ 	{ 0x3669, 0x1a },
+ 	{ 0x366a, 0x00 },
+ 	{ 0x366b, 0x50 },
+@@ -592,9 +595,8 @@ static const struct reg_value ov7251_set
+ 	{ 0x3c00, 0x89 },
+ 	{ 0x3c01, 0x63 },
+ 	{ 0x3c02, 0x01 },
+-	{ 0x3c03, 0x00 },
+ 	{ 0x3c04, 0x00 },
+-	{ 0x3c05, 0x03 },
++	{ 0x3c05, 0x01 },
+ 	{ 0x3c06, 0x00 },
+ 	{ 0x3c07, 0x06 },
+ 	{ 0x3c0c, 0x01 },
+@@ -624,6 +626,16 @@ static const struct reg_value ov7251_set
+ 	{ 0x5001, 0x80 },
+ };
+ 
++static const struct reg_value ov7251_ext_trig_on[] = {
++	{ 0x3666, 0x00 },
++	{ 0x3c03, 0x17 },
++};
++
++static const struct reg_value ov7251_ext_trig_off[] = {
++	{ 0x3666, 0x0a },
++	{ 0x3c03, 0x00 },
++};
++
+ static const unsigned long supported_xclk_rates[] = {
+ 	[OV7251_19_2_MHZ] = 19200000,
+ 	[OV7251_24_MHZ] = 24000000,
+@@ -1374,6 +1386,23 @@ static int ov7251_s_stream(struct v4l2_s
+ 			dev_err(ov7251->dev, "could not sync v4l2 controls\n");
+ 			goto err_power_down;
+ 		}
++
++		/* Set vsync trigger mode */
++		switch (trigger_mode) {
++		case 2:
++			ov7251_set_register_array(ov7251,
++						  ov7251_ext_trig_on,
++						  ARRAY_SIZE(ov7251_ext_trig_on));
++			break;
++		case 0:
++		default:
++			/* case 1 for ext trig source currently not implemented */
++			ov7251_set_register_array(ov7251,
++						  ov7251_ext_trig_off,
++						  ARRAY_SIZE(ov7251_ext_trig_off));
++			break;
++		}
++
+ 		ret = ov7251_write_reg(ov7251, OV7251_SC_MODE_SELECT,
+ 				       OV7251_SC_MODE_SELECT_STREAMING);
+ 		if (ret)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0298-net-bcmgenet-Add-eee-module-parameter.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0298-net-bcmgenet-Add-eee-module-parameter.patch
new file mode 100644
index 00000000..b444773c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0298-net-bcmgenet-Add-eee-module-parameter.patch
@@ -0,0 +1,46 @@
+From d977697a78cd1c3c718cbf686321a26d3b71a7d4 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 14 Dec 2022 15:00:51 +0000
+Subject: [PATCH 298/697] net: bcmgenet: Add 'eee' module parameter
+
+On some switches, having EEE enabled causes the link to become
+unstable. With this patch, adding 'genet.eee=N' to the kernel command
+line will cause EEE to be disabled on the link.
+
+See: https://github.com/raspberrypi/linux/issues/4289
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -70,6 +70,9 @@ static void bcmgenet_set_rx_mode(struct
+ static bool skip_umac_reset = false;
+ module_param(skip_umac_reset, bool, 0444);
+ MODULE_PARM_DESC(skip_umac_reset, "Skip UMAC reset step");
++static bool eee = true;
++module_param(eee, bool, 0444);
++MODULE_PARM_DESC(eee, "Enable EEE (default Y)");
+ 
+ static inline void bcmgenet_writel(u32 value, void __iomem *offset)
+ {
+@@ -3430,6 +3433,17 @@ static int bcmgenet_open(struct net_devi
+ 
+ 	bcmgenet_phy_pause_set(dev, priv->rx_pause, priv->tx_pause);
+ 
++	if (!eee) {
++		struct ethtool_keee eee_data;
++
++		ret = bcmgenet_get_eee(dev, &eee_data);
++		if (ret == 0) {
++			eee_data.eee_enabled = 0;
++			bcmgenet_set_eee(dev, &eee_data);
++			netdev_warn(dev, "EEE disabled\n");
++		}
++	}
++
+ 	bcmgenet_netif_start(dev);
+ 
+ 	netif_tx_start_all_queues(dev);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0299-media-dt-bindings-Add-DW9817-to-DW9807-binding.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0299-media-dt-bindings-Add-DW9817-to-DW9807-binding.patch
new file mode 100644
index 00000000..7fd81e45
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0299-media-dt-bindings-Add-DW9817-to-DW9807-binding.patch
@@ -0,0 +1,46 @@
+From 05909828efd4b11540436afbb0e373d01f6360ea Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 3 Jan 2023 15:44:10 +0000
+Subject: [PATCH 299/697] media: dt-bindings: Add DW9817 to DW9807 binding
+
+The DW9817 is programmatically the same as DW9807, but
+the output drive is a bi-directional -100 to +100mA
+instead of 0-100mA.
+
+Add the appropriate compativle string.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../bindings/media/i2c/dongwoon,dw9807-vcm.yaml      | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/Documentation/devicetree/bindings/media/i2c/dongwoon,dw9807-vcm.yaml
++++ b/Documentation/devicetree/bindings/media/i2c/dongwoon,dw9807-vcm.yaml
+@@ -5,18 +5,24 @@
+ $id: http://devicetree.org/schemas/media/i2c/dongwoon,dw9807-vcm.yaml#
+ $schema: http://devicetree.org/meta-schemas/core.yaml#
+ 
+-title: Dongwoon Anatech DW9807 voice coil lens driver
++title: Dongwoon Anatech DW9807 and DW9817 voice coil lens driver
+ 
+ maintainers:
+   - Sakari Ailus <sakari.ailus@linux.intel.com>
+ 
+ description: |
+   DW9807 is a 10-bit DAC with current sink capability. It is intended for
+-  controlling voice coil lenses.
++  controlling voice coil lenses. The output drive is 0-100mA.
++  DW9817 is very similar as a 10-bit DAC with current sink capability,
++  however the output drive is a bidirection -100 to +100mA.
++
+ 
+ properties:
+   compatible:
+-    const: dongwoon,dw9807-vcm
++    items:
++      - enum:
++          - dongwoon,dw9807-vcm
++          - dongwoon,dw9817-vcm
+ 
+   reg:
+     maxItems: 1
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0300-media-dw9807-vcm-Add-support-for-DW9817-bidirectiona.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0300-media-dw9807-vcm-Add-support-for-DW9817-bidirectiona.patch
new file mode 100644
index 00000000..c88db679
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0300-media-dw9807-vcm-Add-support-for-DW9817-bidirectiona.patch
@@ -0,0 +1,223 @@
+From 47b786cf830e927502eebcf912b7ef9611d27a9b Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 3 Jan 2023 15:38:08 +0000
+Subject: [PATCH 300/697] media: dw9807-vcm: Add support for DW9817
+ bidirectional VCM driver
+
+The DW9817 is effectively the same as DW9807 from a programming
+interface, however it drives +/-100mA instead of 0-100mA. This means
+that the power on ramp needs to take the lens from the midpoint, and
+power off return it there. It also changes the default position for
+the module.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/dw9807-vcm.c | 115 +++++++++++++++++++++++++--------
+ 1 file changed, 88 insertions(+), 27 deletions(-)
+
+--- a/drivers/media/i2c/dw9807-vcm.c
++++ b/drivers/media/i2c/dw9807-vcm.c
+@@ -1,6 +1,14 @@
+ // SPDX-License-Identifier: GPL-2.0
+ // Copyright (C) 2018 Intel Corporation
+ 
++/*
++ * DW9807 is a 10-bit DAC driver, capable of sinking up to 100mA.
++ *
++ * DW9817 is a bidirectional 10-bit driver, driving up to +/- 100mA.
++ * Operationally it is identical to DW9807, except that the idle position is
++ * the mid-point, not 0.
++ */
++
+ #include <linux/acpi.h>
+ #include <linux/delay.h>
+ #include <linux/i2c.h>
+@@ -38,10 +46,16 @@
+ 
+ #define MAX_RETRY		10
+ 
++struct dw9807_cfg {
++	unsigned int idle_pos;
++	unsigned int default_pos;
++};
++
+ struct dw9807_device {
+ 	struct v4l2_ctrl_handler ctrls_vcm;
+ 	struct v4l2_subdev sd;
+ 	u16 current_val;
++	u16 idle_pos;
+ };
+ 
+ static inline struct dw9807_device *sd_to_dw9807_vcm(
+@@ -109,6 +123,40 @@ static int dw9807_set_dac(struct i2c_cli
+ 	return 0;
+ }
+ 
++/*
++ * The lens position is gradually moved in units of DW9807_CTRL_STEPS,
++ * to make the movements smoothly. In all cases, even when "start" and
++ * "end" are the same, the lens will be set to the "end" position.
++ *
++ * (We don't use hardware slew rate control, because it differs widely
++ * between otherwise-compatible ICs, and may need lens-specific tuning.)
++ */
++static int dw9807_ramp(struct i2c_client *client, int start, int end)
++{
++	int step, val, ret;
++
++	if (start < end)
++		step = DW9807_CTRL_STEPS;
++	else
++		step = -DW9807_CTRL_STEPS;
++
++	val = start;
++	while (true) {
++		val += step;
++		if (step * (val - end) >= 0)
++			val = end;
++		ret = dw9807_set_dac(client, val);
++		if (ret)
++			dev_err_ratelimited(&client->dev, "%s I2C failure: %d",
++					    __func__, ret);
++		if (val == end)
++			break;
++		usleep_range(DW9807_CTRL_DELAY_US, DW9807_CTRL_DELAY_US + 10);
++	}
++
++	return ret;
++}
++
+ static int dw9807_set_ctrl(struct v4l2_ctrl *ctrl)
+ {
+ 	struct dw9807_device *dev_vcm = container_of(ctrl->handler,
+@@ -118,7 +166,7 @@ static int dw9807_set_ctrl(struct v4l2_c
+ 		struct i2c_client *client = v4l2_get_subdevdata(&dev_vcm->sd);
+ 
+ 		dev_vcm->current_val = ctrl->val;
+-		return dw9807_set_dac(client, ctrl->val);
++		return dw9807_ramp(client, ctrl->val, ctrl->val);
+ 	}
+ 
+ 	return -EINVAL;
+@@ -163,7 +211,8 @@ static int dw9807_init_controls(struct d
+ 	v4l2_ctrl_handler_init(hdl, 1);
+ 
+ 	v4l2_ctrl_new_std(hdl, ops, V4L2_CID_FOCUS_ABSOLUTE,
+-			  0, DW9807_MAX_FOCUS_POS, DW9807_FOCUS_STEPS, 0);
++			  0, DW9807_MAX_FOCUS_POS, DW9807_FOCUS_STEPS,
++			  dev_vcm->current_val);
+ 
+ 	dev_vcm->sd.ctrl_handler = hdl;
+ 	if (hdl->error) {
+@@ -175,9 +224,32 @@ static int dw9807_init_controls(struct d
+ 	return 0;
+ }
+ 
++/* Compatible devices; in fact there are many similar chips.
++ * "data" holds the powered-off (zero current) lens position and a
++ * default/initial control value (which need not be the same as the powered-off
++ * value).
++ */
++static const struct dw9807_cfg dw9807_cfg = {
++	.idle_pos = 0,
++	.default_pos = 0
++};
++
++static const struct dw9807_cfg dw9817_cfg = {
++	.idle_pos = 512,
++	.default_pos = 480,
++};
++
++static const struct of_device_id dw9807_of_table[] = {
++	{ .compatible = "dongwoon,dw9807-vcm", .data = &dw9807_cfg },
++	{ .compatible = "dongwoon,dw9817-vcm", .data = &dw9817_cfg },
++	{ /* sentinel */ }
++};
++
+ static int dw9807_probe(struct i2c_client *client)
+ {
+ 	struct dw9807_device *dw9807_dev;
++	const struct of_device_id *match;
++	const struct dw9807_cfg *cfg;
+ 	int rval;
+ 
+ 	dw9807_dev = devm_kzalloc(&client->dev, sizeof(*dw9807_dev),
+@@ -185,6 +257,13 @@ static int dw9807_probe(struct i2c_clien
+ 	if (dw9807_dev == NULL)
+ 		return -ENOMEM;
+ 
++	match = i2c_of_match_device(dw9807_of_table, client);
++	if (match) {
++		cfg = (const struct dw9807_cfg *)match->data;
++		dw9807_dev->idle_pos = cfg->idle_pos;
++		dw9807_dev->current_val = cfg->default_pos;
++	}
++
+ 	v4l2_i2c_subdev_init(&dw9807_dev->sd, client, &dw9807_ops);
+ 	dw9807_dev->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
+ 	dw9807_dev->sd.internal_ops = &dw9807_int_ops;
+@@ -203,7 +282,8 @@ static int dw9807_probe(struct i2c_clien
+ 	if (rval < 0)
+ 		goto err_cleanup;
+ 
+-	pm_runtime_set_active(&client->dev);
++	if (!dw9807_dev->vdd)
++		pm_runtime_set_active(&client->dev);
+ 	pm_runtime_enable(&client->dev);
+ 	pm_runtime_idle(&client->dev);
+ 
+@@ -237,15 +317,10 @@ static int __maybe_unused dw9807_vcm_sus
+ 	struct v4l2_subdev *sd = i2c_get_clientdata(client);
+ 	struct dw9807_device *dw9807_dev = sd_to_dw9807_vcm(sd);
+ 	const char tx_data[2] = { DW9807_CTL_ADDR, 0x01 };
+-	int ret, val;
++	int ret;
+ 
+-	for (val = dw9807_dev->current_val & ~(DW9807_CTRL_STEPS - 1);
+-	     val >= 0; val -= DW9807_CTRL_STEPS) {
+-		ret = dw9807_set_dac(client, val);
+-		if (ret)
+-			dev_err_once(dev, "%s I2C failure: %d", __func__, ret);
+-		usleep_range(DW9807_CTRL_DELAY_US, DW9807_CTRL_DELAY_US + 10);
+-	}
++	if (abs(dw9807_dev->current_val - dw9807_dev->idle_pos) > DW9807_CTRL_STEPS)
++		dw9807_ramp(client, dw9807_dev->current_val, dw9807_dev->idle_pos);
+ 
+ 	/* Power down */
+ 	ret = i2c_master_send(client, tx_data, sizeof(tx_data));
+@@ -269,7 +344,7 @@ static int  __maybe_unused dw9807_vcm_re
+ 	struct v4l2_subdev *sd = i2c_get_clientdata(client);
+ 	struct dw9807_device *dw9807_dev = sd_to_dw9807_vcm(sd);
+ 	const char tx_data[2] = { DW9807_CTL_ADDR, 0x00 };
+-	int ret, val;
++	int ret;
+ 
+ 	/* Power on */
+ 	ret = i2c_master_send(client, tx_data, sizeof(tx_data));
+@@ -278,25 +353,11 @@ static int  __maybe_unused dw9807_vcm_re
+ 		return ret;
+ 	}
+ 
+-	for (val = dw9807_dev->current_val % DW9807_CTRL_STEPS;
+-	     val < dw9807_dev->current_val + DW9807_CTRL_STEPS - 1;
+-	     val += DW9807_CTRL_STEPS) {
+-		ret = dw9807_set_dac(client, val);
+-		if (ret)
+-			dev_err_ratelimited(dev, "%s I2C failure: %d",
+-						__func__, ret);
+-		usleep_range(DW9807_CTRL_DELAY_US, DW9807_CTRL_DELAY_US + 10);
+-	}
++	dw9807_ramp(client, dw9807_dev->idle_pos, dw9807_dev->current_val);
+ 
+ 	return 0;
+ }
+ 
+-static const struct of_device_id dw9807_of_table[] = {
+-	{ .compatible = "dongwoon,dw9807-vcm" },
+-	/* Compatibility for older firmware, NEVER USE THIS IN FIRMWARE! */
+-	{ .compatible = "dongwoon,dw9807" },
+-	{ /* sentinel */ }
+-};
+ MODULE_DEVICE_TABLE(of, dw9807_of_table);
+ 
+ static const struct dev_pm_ops dw9807_pm_ops = {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0301-media-dt-bindings-Add-regulator-to-dw9807-vcm.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0301-media-dt-bindings-Add-regulator-to-dw9807-vcm.patch
new file mode 100644
index 00000000..fd410342
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0301-media-dt-bindings-Add-regulator-to-dw9807-vcm.patch
@@ -0,0 +1,40 @@
+From 9cfc8faac7ad7c93cf19c2c102fbef055773771f Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 3 Jan 2023 16:41:08 +0000
+Subject: [PATCH 301/697] media: dt-bindings: Add regulator to dw9807-vcm
+
+The VCM driver will often be controlled via a regulator,
+therefore add in the relevant DT hooks.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../devicetree/bindings/media/i2c/dongwoon,dw9807-vcm.yaml    | 4 ++++
+ drivers/media/i2c/dw9807-vcm.c                                | 4 ++++
+ 2 files changed, 8 insertions(+)
+
+--- a/Documentation/devicetree/bindings/media/i2c/dongwoon,dw9807-vcm.yaml
++++ b/Documentation/devicetree/bindings/media/i2c/dongwoon,dw9807-vcm.yaml
+@@ -27,6 +27,10 @@ properties:
+   reg:
+     maxItems: 1
+ 
++  VDD-supply:
++    description:
++      Definition of the regulator used as VDD power supply to the driver.
++
+ required:
+   - compatible
+   - reg
+--- a/drivers/media/i2c/dw9807-vcm.c
++++ b/drivers/media/i2c/dw9807-vcm.c
+@@ -301,6 +301,10 @@ static void dw9807_remove(struct i2c_cli
+ 	struct v4l2_subdev *sd = i2c_get_clientdata(client);
+ 	struct dw9807_device *dw9807_dev = sd_to_dw9807_vcm(sd);
+ 
++	if (dw9807_dev->vdd)
++		regulator_unregister_notifier(dw9807_dev->vdd,
++					      &dw9807_dev->notifier);
++
+ 	pm_runtime_disable(&client->dev);
+ 
+ 	dw9807_subdev_cleanup(dw9807_dev);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0302-media-dw9807-vcm-Add-regulator-support-to-the-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0302-media-dw9807-vcm-Add-regulator-support-to-the-driver.patch
new file mode 100644
index 00000000..079a043c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0302-media-dw9807-vcm-Add-regulator-support-to-the-driver.patch
@@ -0,0 +1,187 @@
+From 028e4de39d604e6e35fb1636a2e74332cf93f383 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 3 Jan 2023 16:35:59 +0000
+Subject: [PATCH 302/697] media: dw9807-vcm: Add regulator support to the
+ driver
+
+Uses the regulator notifier framework so that the current
+focus position will be restored whenever any user of the
+regulator powers it up. This means that should the VCM
+and sensor share a common regulator then starting the sensor
+will automatically restore the default position. If they
+have independent regulators then it will behave be powered
+up when the VCM subdev is opened.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/dw9807-vcm.c | 113 ++++++++++++++++++++++++++-------
+ 1 file changed, 90 insertions(+), 23 deletions(-)
+
+--- a/drivers/media/i2c/dw9807-vcm.c
++++ b/drivers/media/i2c/dw9807-vcm.c
+@@ -15,6 +15,7 @@
+ #include <linux/iopoll.h>
+ #include <linux/module.h>
+ #include <linux/pm_runtime.h>
++#include <linux/regulator/consumer.h>
+ #include <media/v4l2-ctrls.h>
+ #include <media/v4l2-device.h>
+ 
+@@ -46,6 +47,9 @@
+ 
+ #define MAX_RETRY		10
+ 
++#define DW9807_PW_MIN_DELAY_US		100
++#define DW9807_PW_DELAY_RANGE_US	10
++
+ struct dw9807_cfg {
+ 	unsigned int idle_pos;
+ 	unsigned int default_pos;
+@@ -56,6 +60,8 @@ struct dw9807_device {
+ 	struct v4l2_subdev sd;
+ 	u16 current_val;
+ 	u16 idle_pos;
++	struct regulator *vdd;
++	struct notifier_block notifier;
+ };
+ 
+ static inline struct dw9807_device *sd_to_dw9807_vcm(
+@@ -157,6 +163,66 @@ static int dw9807_ramp(struct i2c_client
+ 	return ret;
+ }
+ 
++static int dw9807_active(struct dw9807_device *dw9807_dev)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&dw9807_dev->sd);
++	const char tx_data[2] = { DW9807_CTL_ADDR, 0x00 };
++	int ret;
++
++	/* Power on */
++	ret = i2c_master_send(client, tx_data, sizeof(tx_data));
++	if (ret < 0) {
++		dev_err(&client->dev, "I2C write CTL fail ret = %d\n", ret);
++		return ret;
++	}
++
++	return dw9807_ramp(client, dw9807_dev->idle_pos, dw9807_dev->current_val);
++}
++
++static int dw9807_standby(struct dw9807_device *dw9807_dev)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&dw9807_dev->sd);
++	const char tx_data[2] = { DW9807_CTL_ADDR, 0x01 };
++	int ret;
++
++	if (abs(dw9807_dev->current_val - dw9807_dev->idle_pos) > DW9807_CTRL_STEPS)
++		dw9807_ramp(client, dw9807_dev->current_val, dw9807_dev->idle_pos);
++
++	/* Power down */
++	ret = i2c_master_send(client, tx_data, sizeof(tx_data));
++	if (ret < 0) {
++		dev_err(&client->dev, "I2C write CTL fail ret = %d\n", ret);
++		return ret;
++	}
++
++	return 0;
++}
++
++static int dw9807_regulator_event(struct notifier_block *nb,
++				  unsigned long action, void *data)
++{
++	struct dw9807_device *dw9807_dev =
++		container_of(nb, struct dw9807_device, notifier);
++
++	if (action & REGULATOR_EVENT_ENABLE) {
++		/*
++		 * Initialisation delay between VDD low->high and the moment
++		 * when the i2c command is available.
++		 * From the datasheet, it should be 10ms + 2ms (max power
++		 * up sequence duration)
++		 */
++		usleep_range(DW9807_PW_MIN_DELAY_US,
++			     DW9807_PW_MIN_DELAY_US +
++			     DW9807_PW_DELAY_RANGE_US);
++
++		dw9807_active(dw9807_dev);
++	} else if (action & REGULATOR_EVENT_PRE_DISABLE) {
++		dw9807_standby(dw9807_dev);
++	}
++
++	return 0;
++}
++
+ static int dw9807_set_ctrl(struct v4l2_ctrl *ctrl)
+ {
+ 	struct dw9807_device *dev_vcm = container_of(ctrl->handler,
+@@ -257,6 +323,24 @@ static int dw9807_probe(struct i2c_clien
+ 	if (dw9807_dev == NULL)
+ 		return -ENOMEM;
+ 
++	dw9807_dev->vdd = devm_regulator_get_optional(&client->dev, "VDD");
++	if (IS_ERR(dw9807_dev->vdd)) {
++		if (PTR_ERR(dw9807_dev->vdd) != -ENODEV)
++			return PTR_ERR(dw9807_dev->vdd);
++
++		dw9807_dev->vdd = NULL;
++	} else {
++		dw9807_dev->notifier.notifier_call = dw9807_regulator_event;
++
++		rval = regulator_register_notifier(dw9807_dev->vdd,
++						   &dw9807_dev->notifier);
++		if (rval) {
++			dev_err(&client->dev,
++				"could not register regulator notifier\n");
++			return rval;
++		}
++	}
++
+ 	match = i2c_of_match_device(dw9807_of_table, client);
+ 	if (match) {
+ 		cfg = (const struct dw9807_cfg *)match->data;
+@@ -320,20 +404,11 @@ static int __maybe_unused dw9807_vcm_sus
+ 	struct i2c_client *client = to_i2c_client(dev);
+ 	struct v4l2_subdev *sd = i2c_get_clientdata(client);
+ 	struct dw9807_device *dw9807_dev = sd_to_dw9807_vcm(sd);
+-	const char tx_data[2] = { DW9807_CTL_ADDR, 0x01 };
+-	int ret;
+-
+-	if (abs(dw9807_dev->current_val - dw9807_dev->idle_pos) > DW9807_CTRL_STEPS)
+-		dw9807_ramp(client, dw9807_dev->current_val, dw9807_dev->idle_pos);
+ 
+-	/* Power down */
+-	ret = i2c_master_send(client, tx_data, sizeof(tx_data));
+-	if (ret < 0) {
+-		dev_err(&client->dev, "I2C write CTL fail ret = %d\n", ret);
+-		return ret;
+-	}
++	if (dw9807_dev->vdd)
++		return regulator_disable(dw9807_dev->vdd);
+ 
+-	return 0;
++	return dw9807_standby(dw9807_dev);
+ }
+ 
+ /*
+@@ -347,19 +422,11 @@ static int  __maybe_unused dw9807_vcm_re
+ 	struct i2c_client *client = to_i2c_client(dev);
+ 	struct v4l2_subdev *sd = i2c_get_clientdata(client);
+ 	struct dw9807_device *dw9807_dev = sd_to_dw9807_vcm(sd);
+-	const char tx_data[2] = { DW9807_CTL_ADDR, 0x00 };
+-	int ret;
+-
+-	/* Power on */
+-	ret = i2c_master_send(client, tx_data, sizeof(tx_data));
+-	if (ret < 0) {
+-		dev_err(&client->dev, "I2C write CTL fail ret = %d\n", ret);
+-		return ret;
+-	}
+ 
+-	dw9807_ramp(client, dw9807_dev->idle_pos, dw9807_dev->current_val);
++	if (dw9807_dev->vdd)
++		return regulator_enable(dw9807_dev->vdd);
+ 
+-	return 0;
++	return dw9807_active(dw9807_dev);
+ }
+ 
+ MODULE_DEVICE_TABLE(of, dw9807_of_table);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0303-media-dw9807-vcm-Smooth-the-first-user-movement-of-t.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0303-media-dw9807-vcm-Smooth-the-first-user-movement-of-t.patch
new file mode 100644
index 00000000..d207528d
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0303-media-dw9807-vcm-Smooth-the-first-user-movement-of-t.patch
@@ -0,0 +1,49 @@
+From 0e7df07fdaf0c69f5c7ab9dd47976207bfd23beb Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 3 Jan 2023 16:53:37 +0000
+Subject: [PATCH 303/697] media: dw9807-vcm: Smooth the first user movement of
+ the lens
+
+The power up/down sequence is already ramped. Extend this to
+the first user movement as well, as this will generally avoid
+the "tick" noises due to rapid movements and overshooting.
+Subsequent movements are generally smaller and so don't cause
+issues.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/dw9807-vcm.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/dw9807-vcm.c
++++ b/drivers/media/i2c/dw9807-vcm.c
+@@ -62,6 +62,7 @@ struct dw9807_device {
+ 	u16 idle_pos;
+ 	struct regulator *vdd;
+ 	struct notifier_block notifier;
++	bool first;
+ };
+ 
+ static inline struct dw9807_device *sd_to_dw9807_vcm(
+@@ -176,6 +177,8 @@ static int dw9807_active(struct dw9807_d
+ 		return ret;
+ 	}
+ 
++	dw9807_dev->first = true;
++
+ 	return dw9807_ramp(client, dw9807_dev->idle_pos, dw9807_dev->current_val);
+ }
+ 
+@@ -230,9 +233,11 @@ static int dw9807_set_ctrl(struct v4l2_c
+ 
+ 	if (ctrl->id == V4L2_CID_FOCUS_ABSOLUTE) {
+ 		struct i2c_client *client = v4l2_get_subdevdata(&dev_vcm->sd);
++		int start = (dev_vcm->first) ? dev_vcm->current_val : ctrl->val;
+ 
++		dev_vcm->first = false;
+ 		dev_vcm->current_val = ctrl->val;
+-		return dw9807_ramp(client, ctrl->val, ctrl->val);
++		return dw9807_ramp(client, start, ctrl->val);
+ 	}
+ 
+ 	return -EINVAL;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0304-dtbindings-media-i2c-Add-IMX708-CMOS-sensor-binding.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0304-dtbindings-media-i2c-Add-IMX708-CMOS-sensor-binding.patch
new file mode 100644
index 00000000..bafa5f3f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0304-dtbindings-media-i2c-Add-IMX708-CMOS-sensor-binding.patch
@@ -0,0 +1,155 @@
+From 358f675bd960b8feb692b2649380dca6e690c7d1 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 22 Dec 2022 14:08:35 +0000
+Subject: [PATCH 304/697] dtbindings: media: i2c: Add IMX708 CMOS sensor
+ binding
+
+Add YAML devicetree binding for IMX708 CMOS image sensor.
+Let's also add a MAINTAINERS entry for the binding and driver.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../devicetree/bindings/media/i2c/imx708.yaml | 119 ++++++++++++++++++
+ MAINTAINERS                                   |   8 ++
+ 2 files changed, 127 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/media/i2c/imx708.yaml
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/i2c/imx708.yaml
+@@ -0,0 +1,119 @@
++# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/media/i2c/imx708.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Sony 1/2.3-Inch 12Mpixel CMOS Digital Image Sensor
++
++maintainers:
++  - Naushir Patuck <naush@raspberypi.com>
++
++description: |-
++  The Sony IMX708 is a 1/2.3-inch CMOS active pixel digital image sensor
++  with an active array size of 4608H x 2592V. It is programmable through
++  I2C interface. The I2C address is fixed to 0x1A as per sensor data sheet.
++  Image data is sent through MIPI CSI-2, which is configured as either 2 or
++  4 data lanes.
++
++properties:
++  compatible:
++    const: sony,imx708
++
++  reg:
++    description: I2C device address
++    maxItems: 1
++
++  clocks:
++    maxItems: 1
++
++  VDIG-supply:
++    description:
++      Digital I/O voltage supply, 1.1 volts
++
++  VANA1-supply:
++    description:
++      Analog1 voltage supply, 2.8 volts
++
++  VANA2-supply:
++    description:
++      Analog2 voltage supply, 1.8 volts
++
++  VDDL-supply:
++    description:
++      Digital core voltage supply, 1.8 volts
++
++  reset-gpios:
++    description: |-
++      Reference to the GPIO connected to the xclr pin, if any.
++      Must be released (set high) after all supplies and INCK are applied.
++
++  # See ../video-interfaces.txt for more details
++  port:
++    type: object
++    properties:
++      endpoint:
++        type: object
++        properties:
++          data-lanes:
++            description: |-
++              The sensor supports either two-lane, or four-lane operation.
++              For two-lane operation the property must be set to <1 2>.
++            items:
++              - const: 1
++              - const: 2
++
++          clock-noncontinuous:
++            type: boolean
++            description: |-
++              MIPI CSI-2 clock is non-continuous if this property is present,
++              otherwise it's continuous.
++
++          link-frequencies:
++            allOf:
++              - $ref: /schemas/types.yaml#/definitions/uint64-array
++            description:
++              Allowed data bus frequencies.
++
++        required:
++          - link-frequencies
++
++required:
++  - compatible
++  - reg
++  - clocks
++  - VANA1-supply
++  - VANA2-supply
++  - VDIG-supply
++  - VDDL-supply
++  - port
++
++additionalProperties: false
++
++examples:
++  - |
++    i2c0 {
++        #address-cells = <1>;
++        #size-cells = <0>;
++
++        imx708: sensor@1a {
++            compatible = "sony,imx708";
++            reg = <0x1a>;
++            clocks = <&imx708_clk>;
++            VANA1-supply = <&imx708_vana1>; /* 1.8v */
++            VANA2-supply = <&imx708_vana2>; /* 2.8v */
++            VDIG-supply = <&imx708_vdig>;   /* 1.1v */
++            VDDL-supply = <&imx708_vddl>;   /* 1.8v */
++
++            port {
++                imx708_0: endpoint {
++                    remote-endpoint = <&csi1_ep>;
++                    data-lanes = <1 2>;
++                    clock-noncontinuous;
++                    link-frequencies = /bits/ 64 <450000000>;
++                };
++            };
++        };
++    };
++
++...
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -21589,6 +21589,14 @@ T:	git git://linuxtv.org/media_tree.git
+ F:	Documentation/devicetree/bindings/media/i2c/imx519.yaml
+ F:	drivers/media/i2c/imx519.c
+ 
++SONY IMX708 SENSOR DRIVER
++M:	Raspberry Pi Kernel Maintenance <kernel-list@raspberrypi.com>
++L:	linux-media@vger.kernel.org
++S:	Maintained
++T:	git git://linuxtv.org/media_tree.git
++F:	Documentation/devicetree/bindings/media/i2c/imx708.yaml
++F:	drivers/media/i2c/imx708.c
++
+ SONY MEMORYSTICK SUBSYSTEM
+ M:	Maxim Levitsky <maximlevitsky@gmail.com>
+ M:	Alex Dubov <oakad@yahoo.com>
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0305-media-i2c-Add-a-driver-for-the-Sony-IMX708-image-sen.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0305-media-i2c-Add-a-driver-for-the-Sony-IMX708-image-sen.patch
new file mode 100644
index 00000000..02399997
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0305-media-i2c-Add-a-driver-for-the-Sony-IMX708-image-sen.patch
@@ -0,0 +1,2256 @@
+From 9fc39c299680fbd7bfa0a899e2cfd6b949e2901f Mon Sep 17 00:00:00 2001
+From: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+Date: Thu, 22 Dec 2022 13:59:33 +0000
+Subject: [PATCH 305/697] media/i2c: Add a driver for the Sony IMX708 image
+ sensor
+
+The imx708 is a 12MP MIPI sensor with a 16:9 aspect ratio, here using
+two CSI-2 lanes. It is a "quad Bayer" sensor with all 3 modes offering
+10-bit output:
+
+12MP: 4608x2592 up to 14.35fps (full FoV)
+1080p: 2304x1296 up to 56.02fps (full FoV)
+720p: 1536x864 up to 120.12fps (cropped)
+
+This imx708 sensor driver is based heavily on the imx477 driver and
+has been tested on the Raspberry Pi platform using libcamera.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drivers: media: imx708: Enable long exposure mode
+
+Enable long exposure modes by using the long exposure shift register setting
+in the imx708 sensor.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+drivers: media: i2c: imx708: Fix crop information
+
+The 1536x864 mode contained incorrect crop information.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+drivers: media: i2c: imx708: Fix WIDE_DYNAMIC_RANGE control with long exposure
+
+Setting V4L2_CID_WIDE_DYNAMIC_RANGE was causing the long exposure
+shift count to be reset, which is incorrect if the user has already
+changed the frame length to cause it to have a non-zero value.
+
+Because it only updates control ranges and doesn't set any registers,
+the control can also be applied when the sensor is not powered on.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+drivers: media: imx708: Increase usable link frequencies
+
+Add support for three different usable link frequencies (default 450Mhz,
+447Mhz, and 453MHz) for the IMX708 camera sensor. The choice of
+frequency is handled thorugh the "link-frequency" overlay parameter.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+drivers: media: imx708: Remove unused control fields
+
+Remove unused and redundant control fields from the state structure.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+drivers: media: imx708: Tidy-ups to address upstream review comments
+
+This commit addresses vaious tidy-ups requesed for upstreaming the
+IMX708 driver. Notably:
+
+- Remove #define IMX708_NUM_SUPPLIES and use ARRAY_SIZE() directly
+- Use dev_err_probe where possible in imx708_probe()
+- Fix error handling paths in imx708_probe()
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+drivers: media: imx708: Follow the standard devicetree labels
+
+Switch the system clock name from "xclk" to "inclk".
+Use lower case lables for all regulator names.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+drives: media: imx708: Put HFLIP and VFLIP controls in a cluster
+
+Create a cluster for the HVLIP and VFLIP controls so they are treated
+as a single composite control.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+drivers: media: imx708: Adjust broken line correction parameter
+
+In full-resolution mode, the LPF_INTENSITY_EN and LPF_INTENSITY
+registers control Quad Bayer Re-mosaic broken line correction.
+Expose this as a module parameter "qbc_adjust": zero disables
+the correction and values in the range 2 to 5 set its strength.
+
+There is a trade-off between coloured and monochrome patterns.
+The previous fixed value 4 could produce ladder/spots artefacts
+in coloured textures. The new default value 2 may suit a wider
+range of scenes.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+
+media: i2c: imx708: Squash fixes
+---
+ drivers/media/i2c/Kconfig  |   13 +
+ drivers/media/i2c/Makefile |    1 +
+ drivers/media/i2c/imx708.c | 2116 ++++++++++++++++++++++++++++++++++++
+ 3 files changed, 2130 insertions(+)
+ create mode 100644 drivers/media/i2c/imx708.c
+
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -297,6 +297,19 @@ config VIDEO_IMX519
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called IMX519.
+ 
++config VIDEO_IMX708
++	tristate "Sony IMX708 sensor support"
++	depends on I2C && VIDEO_DEV
++	select MEDIA_CONTROLLER
++	select VIDEO_V4L2_SUBDEV_API
++	select V4L2_FWNODE
++	help
++	  This is a Video4Linux2 sensor driver for the Sony
++	  IMX708 camera.
++
++	  To compile this driver as a module, choose M here: the
++	  module will be called imx708.
++
+ config VIDEO_MAX9271_LIB
+ 	tristate
+ 
+--- a/drivers/media/i2c/Makefile
++++ b/drivers/media/i2c/Makefile
+@@ -64,6 +64,7 @@ obj-$(CONFIG_VIDEO_IMX412) += imx412.o
+ obj-$(CONFIG_VIDEO_IMX415) += imx415.o
+ obj-$(CONFIG_VIDEO_IMX477) += imx477.o
+ obj-$(CONFIG_VIDEO_IMX519) += imx519.o
++obj-$(CONFIG_VIDEO_IMX708) += imx708.o
+ obj-$(CONFIG_VIDEO_IR_I2C) += ir-kbd-i2c.o
+ obj-$(CONFIG_VIDEO_IRS1125) += irs1125.o
+ obj-$(CONFIG_VIDEO_ISL7998X) += isl7998x.o
+--- /dev/null
++++ b/drivers/media/i2c/imx708.c
+@@ -0,0 +1,2116 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * A V4L2 driver for Sony IMX708 cameras.
++ * Copyright (C) 2022, Raspberry Pi Ltd
++ *
++ * Based on Sony imx477 camera driver
++ * Copyright (C) 2020 Raspberry Pi Ltd
++ */
++#include <linux/unaligned.h>
++#include <linux/clk.h>
++#include <linux/delay.h>
++#include <linux/gpio/consumer.h>
++#include <linux/i2c.h>
++#include <linux/module.h>
++#include <linux/pm_runtime.h>
++#include <linux/regulator/consumer.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-event.h>
++#include <media/v4l2-fwnode.h>
++#include <media/v4l2-mediabus.h>
++
++/*
++ * Parameter to adjust Quad Bayer re-mosaic broken line correction
++ * strength, used in full-resolution mode only. Set zero to disable.
++ */
++static int qbc_adjust = 2;
++module_param(qbc_adjust, int, 0644);
++MODULE_PARM_DESC(qbc_adjust, "Quad Bayer broken line correction strength [0,2-5]");
++
++#define IMX708_REG_VALUE_08BIT		1
++#define IMX708_REG_VALUE_16BIT		2
++
++/* Chip ID */
++#define IMX708_REG_CHIP_ID		0x0016
++#define IMX708_CHIP_ID			0x0708
++
++#define IMX708_REG_MODE_SELECT		0x0100
++#define IMX708_MODE_STANDBY		0x00
++#define IMX708_MODE_STREAMING		0x01
++
++#define IMX708_REG_ORIENTATION		0x101
++
++#define IMX708_INCLK_FREQ		24000000
++
++/* Default initial pixel rate, will get updated for each mode. */
++#define IMX708_INITIAL_PIXEL_RATE	590000000
++
++/* V_TIMING internal */
++#define IMX708_REG_FRAME_LENGTH		0x0340
++#define IMX708_FRAME_LENGTH_MAX		0xffff
++
++/* Long exposure multiplier */
++#define IMX708_LONG_EXP_SHIFT_MAX	7
++#define IMX708_LONG_EXP_SHIFT_REG	0x3100
++
++/* Exposure control */
++#define IMX708_REG_EXPOSURE		0x0202
++#define IMX708_EXPOSURE_OFFSET		48
++#define IMX708_EXPOSURE_DEFAULT		0x640
++#define IMX708_EXPOSURE_STEP		1
++#define IMX708_EXPOSURE_MIN		1
++#define IMX708_EXPOSURE_MAX		(IMX708_FRAME_LENGTH_MAX - \
++					 IMX708_EXPOSURE_OFFSET)
++
++/* Analog gain control */
++#define IMX708_REG_ANALOG_GAIN		0x0204
++#define IMX708_ANA_GAIN_MIN		112
++#define IMX708_ANA_GAIN_MAX		960
++#define IMX708_ANA_GAIN_STEP		1
++#define IMX708_ANA_GAIN_DEFAULT	   IMX708_ANA_GAIN_MIN
++
++/* Digital gain control */
++#define IMX708_REG_DIGITAL_GAIN		0x020e
++#define IMX708_DGTL_GAIN_MIN		0x0100
++#define IMX708_DGTL_GAIN_MAX		0xffff
++#define IMX708_DGTL_GAIN_DEFAULT	0x0100
++#define IMX708_DGTL_GAIN_STEP		1
++
++/* Colour balance controls */
++#define IMX708_REG_COLOUR_BALANCE_RED   0x0b90
++#define IMX708_REG_COLOUR_BALANCE_BLUE	0x0b92
++#define IMX708_COLOUR_BALANCE_MIN	0x01
++#define IMX708_COLOUR_BALANCE_MAX	0xffff
++#define IMX708_COLOUR_BALANCE_STEP	0x01
++#define IMX708_COLOUR_BALANCE_DEFAULT	0x100
++
++/* Test Pattern Control */
++#define IMX708_REG_TEST_PATTERN		0x0600
++#define IMX708_TEST_PATTERN_DISABLE	0
++#define IMX708_TEST_PATTERN_SOLID_COLOR	1
++#define IMX708_TEST_PATTERN_COLOR_BARS	2
++#define IMX708_TEST_PATTERN_GREY_COLOR	3
++#define IMX708_TEST_PATTERN_PN9		4
++
++/* Test pattern colour components */
++#define IMX708_REG_TEST_PATTERN_R	0x0602
++#define IMX708_REG_TEST_PATTERN_GR	0x0604
++#define IMX708_REG_TEST_PATTERN_B	0x0606
++#define IMX708_REG_TEST_PATTERN_GB	0x0608
++#define IMX708_TEST_PATTERN_COLOUR_MIN	0
++#define IMX708_TEST_PATTERN_COLOUR_MAX	0x0fff
++#define IMX708_TEST_PATTERN_COLOUR_STEP	1
++
++#define IMX708_REG_BASE_SPC_GAINS_L	0x7b10
++#define IMX708_REG_BASE_SPC_GAINS_R	0x7c00
++
++/* HDR exposure ratio (long:med == med:short) */
++#define IMX708_HDR_EXPOSURE_RATIO       4
++#define IMX708_REG_MID_EXPOSURE		0x3116
++#define IMX708_REG_SHT_EXPOSURE		0x0224
++#define IMX708_REG_MID_ANALOG_GAIN	0x3118
++#define IMX708_REG_SHT_ANALOG_GAIN	0x0216
++
++/* QBC Re-mosaic broken line correction registers */
++#define IMX708_LPF_INTENSITY_EN		0xC428
++#define IMX708_LPF_INTENSITY_ENABLED	0x00
++#define IMX708_LPF_INTENSITY_DISABLED	0x01
++#define IMX708_LPF_INTENSITY		0xC429
++
++/*
++ * Metadata buffer holds a variety of data, all sent with the same VC/DT (0x12).
++ * It comprises two scanlines (of up to 5760 bytes each, for 4608 pixels)
++ * of embedded data, one line of PDAF data, and two lines of AE-HIST data
++ * (AE histograms are valid for HDR mode and empty in non-HDR modes).
++ */
++#define IMX708_EMBEDDED_LINE_WIDTH (5 * 5760)
++#define IMX708_NUM_EMBEDDED_LINES 1
++
++enum pad_types {
++	IMAGE_PAD,
++	METADATA_PAD,
++	NUM_PADS
++};
++
++/* IMX708 native and active pixel array size. */
++#define IMX708_NATIVE_WIDTH		4640U
++#define IMX708_NATIVE_HEIGHT		2658U
++#define IMX708_PIXEL_ARRAY_LEFT		16U
++#define IMX708_PIXEL_ARRAY_TOP		24U
++#define IMX708_PIXEL_ARRAY_WIDTH	4608U
++#define IMX708_PIXEL_ARRAY_HEIGHT	2592U
++
++struct imx708_reg {
++	u16 address;
++	u8 val;
++};
++
++struct imx708_reg_list {
++	unsigned int num_of_regs;
++	const struct imx708_reg *regs;
++};
++
++/* Mode : resolution and related config&values */
++struct imx708_mode {
++	/* Frame width */
++	unsigned int width;
++
++	/* Frame height */
++	unsigned int height;
++
++	/* H-timing in pixels */
++	unsigned int line_length_pix;
++
++	/* Analog crop rectangle. */
++	struct v4l2_rect crop;
++
++	/* Highest possible framerate. */
++	unsigned int vblank_min;
++
++	/* Default framerate. */
++	unsigned int vblank_default;
++
++	/* Default register values */
++	struct imx708_reg_list reg_list;
++
++	/* Not all modes have the same pixel rate. */
++	u64 pixel_rate;
++
++	/* Not all modes have the same minimum exposure. */
++	u32 exposure_lines_min;
++
++	/* Not all modes have the same exposure lines step. */
++	u32 exposure_lines_step;
++
++	/* HDR flag, used for checking if the current mode is HDR */
++	bool hdr;
++
++	/* Quad Bayer Re-mosaic flag */
++	bool remosaic;
++};
++
++/* Default PDAF pixel correction gains */
++static const u8 pdaf_gains[2][9] = {
++	{ 0x4c, 0x4c, 0x4c, 0x46, 0x3e, 0x38, 0x35, 0x35, 0x35 },
++	{ 0x35, 0x35, 0x35, 0x38, 0x3e, 0x46, 0x4c, 0x4c, 0x4c }
++};
++
++/* Link frequency setup */
++enum {
++	IMX708_LINK_FREQ_450MHZ,
++	IMX708_LINK_FREQ_447MHZ,
++	IMX708_LINK_FREQ_453MHZ,
++};
++
++static const s64 link_freqs[] = {
++	[IMX708_LINK_FREQ_450MHZ] = 450000000,
++	[IMX708_LINK_FREQ_447MHZ] = 447000000,
++	[IMX708_LINK_FREQ_453MHZ] = 453000000,
++};
++
++/* 450MHz is the nominal "default" link frequency */
++static const struct imx708_reg link_450Mhz_regs[] = {
++	{0x030E, 0x01},
++	{0x030F, 0x2c},
++};
++
++static const struct imx708_reg link_447Mhz_regs[] = {
++	{0x030E, 0x01},
++	{0x030F, 0x2a},
++};
++
++static const struct imx708_reg link_453Mhz_regs[] = {
++	{0x030E, 0x01},
++	{0x030F, 0x2e},
++};
++
++static const struct imx708_reg_list link_freq_regs[] = {
++	[IMX708_LINK_FREQ_450MHZ] = {
++		.regs = link_450Mhz_regs,
++		.num_of_regs = ARRAY_SIZE(link_450Mhz_regs)
++	},
++	[IMX708_LINK_FREQ_447MHZ] = {
++		.regs = link_447Mhz_regs,
++		.num_of_regs = ARRAY_SIZE(link_447Mhz_regs)
++	},
++	[IMX708_LINK_FREQ_453MHZ] = {
++		.regs = link_453Mhz_regs,
++		.num_of_regs = ARRAY_SIZE(link_453Mhz_regs)
++	},
++};
++
++static const struct imx708_reg mode_common_regs[] = {
++	{0x0100, 0x00},
++	{0x0136, 0x18},
++	{0x0137, 0x00},
++	{0x33F0, 0x02},
++	{0x33F1, 0x05},
++	{0x3062, 0x00},
++	{0x3063, 0x12},
++	{0x3068, 0x00},
++	{0x3069, 0x12},
++	{0x306A, 0x00},
++	{0x306B, 0x30},
++	{0x3076, 0x00},
++	{0x3077, 0x30},
++	{0x3078, 0x00},
++	{0x3079, 0x30},
++	{0x5E54, 0x0C},
++	{0x6E44, 0x00},
++	{0xB0B6, 0x01},
++	{0xE829, 0x00},
++	{0xF001, 0x08},
++	{0xF003, 0x08},
++	{0xF00D, 0x10},
++	{0xF00F, 0x10},
++	{0xF031, 0x08},
++	{0xF033, 0x08},
++	{0xF03D, 0x10},
++	{0xF03F, 0x10},
++	{0x0112, 0x0A},
++	{0x0113, 0x0A},
++	{0x0114, 0x01},
++	{0x0B8E, 0x01},
++	{0x0B8F, 0x00},
++	{0x0B94, 0x01},
++	{0x0B95, 0x00},
++	{0x3400, 0x01},
++	{0x3478, 0x01},
++	{0x3479, 0x1c},
++	{0x3091, 0x01},
++	{0x3092, 0x00},
++	{0x3419, 0x00},
++	{0xBCF1, 0x02},
++	{0x3094, 0x01},
++	{0x3095, 0x01},
++	{0x3362, 0x00},
++	{0x3363, 0x00},
++	{0x3364, 0x00},
++	{0x3365, 0x00},
++	{0x0138, 0x01},
++};
++
++/* 10-bit. */
++static const struct imx708_reg mode_4608x2592_regs[] = {
++	{0x0342, 0x3D},
++	{0x0343, 0x20},
++	{0x0340, 0x0A},
++	{0x0341, 0x59},
++	{0x0344, 0x00},
++	{0x0345, 0x00},
++	{0x0346, 0x00},
++	{0x0347, 0x00},
++	{0x0348, 0x11},
++	{0x0349, 0xFF},
++	{0x034A, 0X0A},
++	{0x034B, 0x1F},
++	{0x0220, 0x62},
++	{0x0222, 0x01},
++	{0x0900, 0x00},
++	{0x0901, 0x11},
++	{0x0902, 0x0A},
++	{0x3200, 0x01},
++	{0x3201, 0x01},
++	{0x32D5, 0x01},
++	{0x32D6, 0x00},
++	{0x32DB, 0x01},
++	{0x32DF, 0x00},
++	{0x350C, 0x00},
++	{0x350D, 0x00},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040A, 0x00},
++	{0x040B, 0x00},
++	{0x040C, 0x12},
++	{0x040D, 0x00},
++	{0x040E, 0x0A},
++	{0x040F, 0x20},
++	{0x034C, 0x12},
++	{0x034D, 0x00},
++	{0x034E, 0x0A},
++	{0x034F, 0x20},
++	{0x0301, 0x05},
++	{0x0303, 0x02},
++	{0x0305, 0x02},
++	{0x0306, 0x00},
++	{0x0307, 0x7C},
++	{0x030B, 0x02},
++	{0x030D, 0x04},
++	{0x0310, 0x01},
++	{0x3CA0, 0x00},
++	{0x3CA1, 0x64},
++	{0x3CA4, 0x00},
++	{0x3CA5, 0x00},
++	{0x3CA6, 0x00},
++	{0x3CA7, 0x00},
++	{0x3CAA, 0x00},
++	{0x3CAB, 0x00},
++	{0x3CB8, 0x00},
++	{0x3CB9, 0x08},
++	{0x3CBA, 0x00},
++	{0x3CBB, 0x00},
++	{0x3CBC, 0x00},
++	{0x3CBD, 0x3C},
++	{0x3CBE, 0x00},
++	{0x3CBF, 0x00},
++	{0x0202, 0x0A},
++	{0x0203, 0x29},
++	{0x0224, 0x01},
++	{0x0225, 0xF4},
++	{0x3116, 0x01},
++	{0x3117, 0xF4},
++	{0x0204, 0x00},
++	{0x0205, 0x00},
++	{0x0216, 0x00},
++	{0x0217, 0x00},
++	{0x0218, 0x01},
++	{0x0219, 0x00},
++	{0x020E, 0x01},
++	{0x020F, 0x00},
++	{0x3118, 0x00},
++	{0x3119, 0x00},
++	{0x311A, 0x01},
++	{0x311B, 0x00},
++	{0x341a, 0x00},
++	{0x341b, 0x00},
++	{0x341c, 0x00},
++	{0x341d, 0x00},
++	{0x341e, 0x01},
++	{0x341f, 0x20},
++	{0x3420, 0x00},
++	{0x3421, 0xd8},
++	{0x3366, 0x00},
++	{0x3367, 0x00},
++	{0x3368, 0x00},
++	{0x3369, 0x00},
++};
++
++static const struct imx708_reg mode_2x2binned_regs[] = {
++	{0x0342, 0x1E},
++	{0x0343, 0x90},
++	{0x0340, 0x05},
++	{0x0341, 0x38},
++	{0x0344, 0x00},
++	{0x0345, 0x00},
++	{0x0346, 0x00},
++	{0x0347, 0x00},
++	{0x0348, 0x11},
++	{0x0349, 0xFF},
++	{0x034A, 0X0A},
++	{0x034B, 0x1F},
++	{0x0220, 0x62},
++	{0x0222, 0x01},
++	{0x0900, 0x01},
++	{0x0901, 0x22},
++	{0x0902, 0x08},
++	{0x3200, 0x41},
++	{0x3201, 0x41},
++	{0x32D5, 0x00},
++	{0x32D6, 0x00},
++	{0x32DB, 0x01},
++	{0x32DF, 0x00},
++	{0x350C, 0x00},
++	{0x350D, 0x00},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040A, 0x00},
++	{0x040B, 0x00},
++	{0x040C, 0x09},
++	{0x040D, 0x00},
++	{0x040E, 0x05},
++	{0x040F, 0x10},
++	{0x034C, 0x09},
++	{0x034D, 0x00},
++	{0x034E, 0x05},
++	{0x034F, 0x10},
++	{0x0301, 0x05},
++	{0x0303, 0x02},
++	{0x0305, 0x02},
++	{0x0306, 0x00},
++	{0x0307, 0x7A},
++	{0x030B, 0x02},
++	{0x030D, 0x04},
++	{0x0310, 0x01},
++	{0x3CA0, 0x00},
++	{0x3CA1, 0x3C},
++	{0x3CA4, 0x00},
++	{0x3CA5, 0x3C},
++	{0x3CA6, 0x00},
++	{0x3CA7, 0x00},
++	{0x3CAA, 0x00},
++	{0x3CAB, 0x00},
++	{0x3CB8, 0x00},
++	{0x3CB9, 0x1C},
++	{0x3CBA, 0x00},
++	{0x3CBB, 0x08},
++	{0x3CBC, 0x00},
++	{0x3CBD, 0x1E},
++	{0x3CBE, 0x00},
++	{0x3CBF, 0x0A},
++	{0x0202, 0x05},
++	{0x0203, 0x08},
++	{0x0224, 0x01},
++	{0x0225, 0xF4},
++	{0x3116, 0x01},
++	{0x3117, 0xF4},
++	{0x0204, 0x00},
++	{0x0205, 0x70},
++	{0x0216, 0x00},
++	{0x0217, 0x70},
++	{0x0218, 0x01},
++	{0x0219, 0x00},
++	{0x020E, 0x01},
++	{0x020F, 0x00},
++	{0x3118, 0x00},
++	{0x3119, 0x70},
++	{0x311A, 0x01},
++	{0x311B, 0x00},
++	{0x341a, 0x00},
++	{0x341b, 0x00},
++	{0x341c, 0x00},
++	{0x341d, 0x00},
++	{0x341e, 0x00},
++	{0x341f, 0x90},
++	{0x3420, 0x00},
++	{0x3421, 0x6c},
++	{0x3366, 0x00},
++	{0x3367, 0x00},
++	{0x3368, 0x00},
++	{0x3369, 0x00},
++};
++
++static const struct imx708_reg mode_2x2binned_720p_regs[] = {
++	{0x0342, 0x14},
++	{0x0343, 0x60},
++	{0x0340, 0x04},
++	{0x0341, 0xB6},
++	{0x0344, 0x03},
++	{0x0345, 0x00},
++	{0x0346, 0x01},
++	{0x0347, 0xB0},
++	{0x0348, 0x0E},
++	{0x0349, 0xFF},
++	{0x034A, 0x08},
++	{0x034B, 0x6F},
++	{0x0220, 0x62},
++	{0x0222, 0x01},
++	{0x0900, 0x01},
++	{0x0901, 0x22},
++	{0x0902, 0x08},
++	{0x3200, 0x41},
++	{0x3201, 0x41},
++	{0x32D5, 0x00},
++	{0x32D6, 0x00},
++	{0x32DB, 0x01},
++	{0x32DF, 0x01},
++	{0x350C, 0x00},
++	{0x350D, 0x00},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040A, 0x00},
++	{0x040B, 0x00},
++	{0x040C, 0x06},
++	{0x040D, 0x00},
++	{0x040E, 0x03},
++	{0x040F, 0x60},
++	{0x034C, 0x06},
++	{0x034D, 0x00},
++	{0x034E, 0x03},
++	{0x034F, 0x60},
++	{0x0301, 0x05},
++	{0x0303, 0x02},
++	{0x0305, 0x02},
++	{0x0306, 0x00},
++	{0x0307, 0x76},
++	{0x030B, 0x02},
++	{0x030D, 0x04},
++	{0x0310, 0x01},
++	{0x3CA0, 0x00},
++	{0x3CA1, 0x3C},
++	{0x3CA4, 0x01},
++	{0x3CA5, 0x5E},
++	{0x3CA6, 0x00},
++	{0x3CA7, 0x00},
++	{0x3CAA, 0x00},
++	{0x3CAB, 0x00},
++	{0x3CB8, 0x00},
++	{0x3CB9, 0x0C},
++	{0x3CBA, 0x00},
++	{0x3CBB, 0x04},
++	{0x3CBC, 0x00},
++	{0x3CBD, 0x1E},
++	{0x3CBE, 0x00},
++	{0x3CBF, 0x05},
++	{0x0202, 0x04},
++	{0x0203, 0x86},
++	{0x0224, 0x01},
++	{0x0225, 0xF4},
++	{0x3116, 0x01},
++	{0x3117, 0xF4},
++	{0x0204, 0x00},
++	{0x0205, 0x70},
++	{0x0216, 0x00},
++	{0x0217, 0x70},
++	{0x0218, 0x01},
++	{0x0219, 0x00},
++	{0x020E, 0x01},
++	{0x020F, 0x00},
++	{0x3118, 0x00},
++	{0x3119, 0x70},
++	{0x311A, 0x01},
++	{0x311B, 0x00},
++	{0x341a, 0x00},
++	{0x341b, 0x00},
++	{0x341c, 0x00},
++	{0x341d, 0x00},
++	{0x341e, 0x00},
++	{0x341f, 0x60},
++	{0x3420, 0x00},
++	{0x3421, 0x48},
++	{0x3366, 0x00},
++	{0x3367, 0x00},
++	{0x3368, 0x00},
++	{0x3369, 0x00},
++};
++
++static const struct imx708_reg mode_hdr_regs[] = {
++	{0x0342, 0x14},
++	{0x0343, 0x60},
++	{0x0340, 0x0A},
++	{0x0341, 0x5B},
++	{0x0344, 0x00},
++	{0x0345, 0x00},
++	{0x0346, 0x00},
++	{0x0347, 0x00},
++	{0x0348, 0x11},
++	{0x0349, 0xFF},
++	{0x034A, 0X0A},
++	{0x034B, 0x1F},
++	{0x0220, 0x01},
++	{0x0222, IMX708_HDR_EXPOSURE_RATIO},
++	{0x0900, 0x00},
++	{0x0901, 0x11},
++	{0x0902, 0x0A},
++	{0x3200, 0x01},
++	{0x3201, 0x01},
++	{0x32D5, 0x00},
++	{0x32D6, 0x00},
++	{0x32DB, 0x01},
++	{0x32DF, 0x00},
++	{0x350C, 0x00},
++	{0x350D, 0x00},
++	{0x0408, 0x00},
++	{0x0409, 0x00},
++	{0x040A, 0x00},
++	{0x040B, 0x00},
++	{0x040C, 0x09},
++	{0x040D, 0x00},
++	{0x040E, 0x05},
++	{0x040F, 0x10},
++	{0x034C, 0x09},
++	{0x034D, 0x00},
++	{0x034E, 0x05},
++	{0x034F, 0x10},
++	{0x0301, 0x05},
++	{0x0303, 0x02},
++	{0x0305, 0x02},
++	{0x0306, 0x00},
++	{0x0307, 0xA2},
++	{0x030B, 0x02},
++	{0x030D, 0x04},
++	{0x0310, 0x01},
++	{0x3CA0, 0x00},
++	{0x3CA1, 0x00},
++	{0x3CA4, 0x00},
++	{0x3CA5, 0x00},
++	{0x3CA6, 0x00},
++	{0x3CA7, 0x28},
++	{0x3CAA, 0x00},
++	{0x3CAB, 0x00},
++	{0x3CB8, 0x00},
++	{0x3CB9, 0x30},
++	{0x3CBA, 0x00},
++	{0x3CBB, 0x00},
++	{0x3CBC, 0x00},
++	{0x3CBD, 0x32},
++	{0x3CBE, 0x00},
++	{0x3CBF, 0x00},
++	{0x0202, 0x0A},
++	{0x0203, 0x2B},
++	{0x0224, 0x0A},
++	{0x0225, 0x2B},
++	{0x3116, 0x0A},
++	{0x3117, 0x2B},
++	{0x0204, 0x00},
++	{0x0205, 0x00},
++	{0x0216, 0x00},
++	{0x0217, 0x00},
++	{0x0218, 0x01},
++	{0x0219, 0x00},
++	{0x020E, 0x01},
++	{0x020F, 0x00},
++	{0x3118, 0x00},
++	{0x3119, 0x00},
++	{0x311A, 0x01},
++	{0x311B, 0x00},
++	{0x341a, 0x00},
++	{0x341b, 0x00},
++	{0x341c, 0x00},
++	{0x341d, 0x00},
++	{0x341e, 0x00},
++	{0x341f, 0x90},
++	{0x3420, 0x00},
++	{0x3421, 0x6c},
++	{0x3360, 0x01},
++	{0x3361, 0x01},
++	{0x3366, 0x09},
++	{0x3367, 0x00},
++	{0x3368, 0x05},
++	{0x3369, 0x10},
++};
++
++/* Mode configs. Keep separate lists for when HDR is enabled or not. */
++static const struct imx708_mode supported_modes_10bit_no_hdr[] = {
++	{
++		/* Full resolution. */
++		.width = 4608,
++		.height = 2592,
++		.line_length_pix = 0x3d20,
++		.crop = {
++			.left = IMX708_PIXEL_ARRAY_LEFT,
++			.top = IMX708_PIXEL_ARRAY_TOP,
++			.width = 4608,
++			.height = 2592,
++		},
++		.vblank_min = 58,
++		.vblank_default = 58,
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_4608x2592_regs),
++			.regs = mode_4608x2592_regs,
++		},
++		.pixel_rate = 595200000,
++		.exposure_lines_min = 8,
++		.exposure_lines_step = 1,
++		.hdr = false,
++		.remosaic = true
++	},
++	{
++		/* regular 2x2 binned. */
++		.width = 2304,
++		.height = 1296,
++		.line_length_pix = 0x1e90,
++		.crop = {
++			.left = IMX708_PIXEL_ARRAY_LEFT,
++			.top = IMX708_PIXEL_ARRAY_TOP,
++			.width = 4608,
++			.height = 2592,
++		},
++		.vblank_min = 40,
++		.vblank_default = 1198,
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_2x2binned_regs),
++			.regs = mode_2x2binned_regs,
++		},
++		.pixel_rate = 585600000,
++		.exposure_lines_min = 4,
++		.exposure_lines_step = 2,
++		.hdr = false,
++		.remosaic = false
++	},
++	{
++		/* 2x2 binned and cropped for 720p. */
++		.width = 1536,
++		.height = 864,
++		.line_length_pix = 0x1460,
++		.crop = {
++			.left = IMX708_PIXEL_ARRAY_LEFT + 768,
++			.top = IMX708_PIXEL_ARRAY_TOP + 432,
++			.width = 3072,
++			.height = 1728,
++		},
++		.vblank_min = 40,
++		.vblank_default = 2755,
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_2x2binned_720p_regs),
++			.regs = mode_2x2binned_720p_regs,
++		},
++		.pixel_rate = 566400000,
++		.exposure_lines_min = 4,
++		.exposure_lines_step = 2,
++		.hdr = false,
++		.remosaic = false
++	},
++};
++
++static const struct imx708_mode supported_modes_10bit_hdr[] = {
++	{
++		/* There's only one HDR mode, which is 2x2 downscaled */
++		.width = 2304,
++		.height = 1296,
++		.line_length_pix = 0x1460,
++		.crop = {
++			.left = IMX708_PIXEL_ARRAY_LEFT,
++			.top = IMX708_PIXEL_ARRAY_TOP,
++			.width = 4608,
++			.height = 2592,
++		},
++		.vblank_min = 3673,
++		.vblank_default = 3673,
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_hdr_regs),
++			.regs = mode_hdr_regs,
++		},
++		.pixel_rate = 777600000,
++		.exposure_lines_min = 8 * IMX708_HDR_EXPOSURE_RATIO * IMX708_HDR_EXPOSURE_RATIO,
++		.exposure_lines_step = 2 * IMX708_HDR_EXPOSURE_RATIO * IMX708_HDR_EXPOSURE_RATIO,
++		.hdr = true,
++		.remosaic = false
++	}
++};
++
++/*
++ * The supported formats.
++ * This table MUST contain 4 entries per format, to cover the various flip
++ * combinations in the order
++ * - no flip
++ * - h flip
++ * - v flip
++ * - h&v flips
++ */
++static const u32 codes[] = {
++	/* 10-bit modes. */
++	MEDIA_BUS_FMT_SRGGB10_1X10,
++	MEDIA_BUS_FMT_SGRBG10_1X10,
++	MEDIA_BUS_FMT_SGBRG10_1X10,
++	MEDIA_BUS_FMT_SBGGR10_1X10,
++};
++
++static const char * const imx708_test_pattern_menu[] = {
++	"Disabled",
++	"Color Bars",
++	"Solid Color",
++	"Grey Color Bars",
++	"PN9"
++};
++
++static const int imx708_test_pattern_val[] = {
++	IMX708_TEST_PATTERN_DISABLE,
++	IMX708_TEST_PATTERN_COLOR_BARS,
++	IMX708_TEST_PATTERN_SOLID_COLOR,
++	IMX708_TEST_PATTERN_GREY_COLOR,
++	IMX708_TEST_PATTERN_PN9,
++};
++
++/* regulator supplies */
++static const char * const imx708_supply_name[] = {
++	/* Supplies can be enabled in any order */
++	"vana1",  /* Analog1 (2.8V) supply */
++	"vana2",  /* Analog2 (1.8V) supply */
++	"vdig",  /* Digital Core (1.1V) supply */
++	"vddl",  /* IF (1.8V) supply */
++};
++
++/*
++ * Initialisation delay between XCLR low->high and the moment when the sensor
++ * can start capture (i.e. can leave software standby), given by T7 in the
++ * datasheet is 8ms.  This does include I2C setup time as well.
++ *
++ * Note, that delay between XCLR low->high and reading the CCI ID register (T6
++ * in the datasheet) is much smaller - 600us.
++ */
++#define IMX708_XCLR_MIN_DELAY_US	8000
++#define IMX708_XCLR_DELAY_RANGE_US	1000
++
++struct imx708 {
++	struct v4l2_subdev sd;
++	struct media_pad pad[NUM_PADS];
++
++	struct v4l2_mbus_framefmt fmt;
++
++	struct clk *inclk;
++	u32 inclk_freq;
++
++	struct gpio_desc *reset_gpio;
++	struct regulator_bulk_data supplies[ARRAY_SIZE(imx708_supply_name)];
++
++	struct v4l2_ctrl_handler ctrl_handler;
++	/* V4L2 Controls */
++	struct v4l2_ctrl *pixel_rate;
++	struct v4l2_ctrl *exposure;
++	struct v4l2_ctrl *vblank;
++	struct v4l2_ctrl *hblank;
++	struct v4l2_ctrl *hdr_mode;
++	struct v4l2_ctrl *link_freq;
++	struct {
++		struct v4l2_ctrl *hflip;
++		struct v4l2_ctrl *vflip;
++	};
++
++	/* Current mode */
++	const struct imx708_mode *mode;
++
++	/*
++	 * Mutex for serialized access:
++	 * Protect sensor module set pad format and start/stop streaming safely.
++	 */
++	struct mutex mutex;
++
++	/* Streaming on/off */
++	bool streaming;
++
++	/* Rewrite common registers on stream on? */
++	bool common_regs_written;
++
++	/* Current long exposure factor in use. Set through V4L2_CID_VBLANK */
++	unsigned int long_exp_shift;
++
++	unsigned int link_freq_idx;
++};
++
++static inline struct imx708 *to_imx708(struct v4l2_subdev *_sd)
++{
++	return container_of(_sd, struct imx708, sd);
++}
++
++static inline void get_mode_table(unsigned int code,
++				  const struct imx708_mode **mode_list,
++				  unsigned int *num_modes,
++				  bool hdr_enable)
++{
++	switch (code) {
++	/* 10-bit */
++	case MEDIA_BUS_FMT_SRGGB10_1X10:
++	case MEDIA_BUS_FMT_SGRBG10_1X10:
++	case MEDIA_BUS_FMT_SGBRG10_1X10:
++	case MEDIA_BUS_FMT_SBGGR10_1X10:
++		if (hdr_enable) {
++			*mode_list = supported_modes_10bit_hdr;
++			*num_modes = ARRAY_SIZE(supported_modes_10bit_hdr);
++		} else {
++			*mode_list = supported_modes_10bit_no_hdr;
++			*num_modes = ARRAY_SIZE(supported_modes_10bit_no_hdr);
++		}
++		break;
++	default:
++		*mode_list = NULL;
++		*num_modes = 0;
++	}
++}
++
++/* Read registers up to 2 at a time */
++static int imx708_read_reg(struct imx708 *imx708, u16 reg, u32 len, u32 *val)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx708->sd);
++	struct i2c_msg msgs[2];
++	u8 addr_buf[2] = { reg >> 8, reg & 0xff };
++	u8 data_buf[4] = { 0, };
++	int ret;
++
++	if (len > 4)
++		return -EINVAL;
++
++	/* Write register address */
++	msgs[0].addr = client->addr;
++	msgs[0].flags = 0;
++	msgs[0].len = ARRAY_SIZE(addr_buf);
++	msgs[0].buf = addr_buf;
++
++	/* Read data from register */
++	msgs[1].addr = client->addr;
++	msgs[1].flags = I2C_M_RD;
++	msgs[1].len = len;
++	msgs[1].buf = &data_buf[4 - len];
++
++	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
++	if (ret != ARRAY_SIZE(msgs))
++		return -EIO;
++
++	*val = get_unaligned_be32(data_buf);
++
++	return 0;
++}
++
++/* Write registers up to 2 at a time */
++static int imx708_write_reg(struct imx708 *imx708, u16 reg, u32 len, u32 val)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx708->sd);
++	u8 buf[6];
++
++	if (len > 4)
++		return -EINVAL;
++
++	put_unaligned_be16(reg, buf);
++	put_unaligned_be32(val << (8 * (4 - len)), buf + 2);
++	if (i2c_master_send(client, buf, len + 2) != len + 2)
++		return -EIO;
++
++	return 0;
++}
++
++/* Write a list of registers */
++static int imx708_write_regs(struct imx708 *imx708,
++			     const struct imx708_reg *regs, u32 len)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx708->sd);
++	unsigned int i;
++
++	for (i = 0; i < len; i++) {
++		int ret;
++
++		ret = imx708_write_reg(imx708, regs[i].address, 1, regs[i].val);
++		if (ret) {
++			dev_err_ratelimited(&client->dev,
++					    "Failed to write reg 0x%4.4x. error = %d\n",
++					    regs[i].address, ret);
++
++			return ret;
++		}
++	}
++
++	return 0;
++}
++
++/* Get bayer order based on flip setting. */
++static u32 imx708_get_format_code(struct imx708 *imx708)
++{
++	unsigned int i;
++
++	lockdep_assert_held(&imx708->mutex);
++
++	i = (imx708->vflip->val ? 2 : 0) |
++	    (imx708->hflip->val ? 1 : 0);
++
++	return codes[i];
++}
++
++static void imx708_set_default_format(struct imx708 *imx708)
++{
++	struct v4l2_mbus_framefmt *fmt = &imx708->fmt;
++
++	/* Set default mode to max resolution */
++	imx708->mode = &supported_modes_10bit_no_hdr[0];
++
++	/* fmt->code not set as it will always be computed based on flips */
++	fmt->colorspace = V4L2_COLORSPACE_RAW;
++	fmt->ycbcr_enc = V4L2_MAP_YCBCR_ENC_DEFAULT(fmt->colorspace);
++	fmt->quantization = V4L2_MAP_QUANTIZATION_DEFAULT(true,
++							  fmt->colorspace,
++							  fmt->ycbcr_enc);
++	fmt->xfer_func = V4L2_MAP_XFER_FUNC_DEFAULT(fmt->colorspace);
++	fmt->width = imx708->mode->width;
++	fmt->height = imx708->mode->height;
++	fmt->field = V4L2_FIELD_NONE;
++}
++
++static int imx708_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
++{
++	struct imx708 *imx708 = to_imx708(sd);
++	struct v4l2_mbus_framefmt *try_fmt_img =
++		v4l2_subdev_state_get_format(fh->state, IMAGE_PAD);
++	struct v4l2_mbus_framefmt *try_fmt_meta =
++		v4l2_subdev_state_get_format(fh->state, METADATA_PAD);
++	struct v4l2_rect *try_crop;
++
++	mutex_lock(&imx708->mutex);
++
++	/* Initialize try_fmt for the image pad */
++	if (imx708->hdr_mode->val) {
++		try_fmt_img->width = supported_modes_10bit_hdr[0].width;
++		try_fmt_img->height = supported_modes_10bit_hdr[0].height;
++	} else {
++		try_fmt_img->width = supported_modes_10bit_no_hdr[0].width;
++		try_fmt_img->height = supported_modes_10bit_no_hdr[0].height;
++	}
++	try_fmt_img->code = imx708_get_format_code(imx708);
++	try_fmt_img->field = V4L2_FIELD_NONE;
++
++	/* Initialize try_fmt for the embedded metadata pad */
++	try_fmt_meta->width = IMX708_EMBEDDED_LINE_WIDTH;
++	try_fmt_meta->height = IMX708_NUM_EMBEDDED_LINES;
++	try_fmt_meta->code = MEDIA_BUS_FMT_SENSOR_DATA;
++	try_fmt_meta->field = V4L2_FIELD_NONE;
++
++	/* Initialize try_crop */
++	try_crop = v4l2_subdev_state_get_crop(fh->state, IMAGE_PAD);
++	try_crop->left = IMX708_PIXEL_ARRAY_LEFT;
++	try_crop->top = IMX708_PIXEL_ARRAY_TOP;
++	try_crop->width = IMX708_PIXEL_ARRAY_WIDTH;
++	try_crop->height = IMX708_PIXEL_ARRAY_HEIGHT;
++
++	mutex_unlock(&imx708->mutex);
++
++	return 0;
++}
++
++static int imx708_set_exposure(struct imx708 *imx708, unsigned int val)
++{
++	val = max(val, imx708->mode->exposure_lines_min);
++	val -= val % imx708->mode->exposure_lines_step;
++
++	/*
++	 * In HDR mode this will set the longest exposure. The sensor
++	 * will automatically divide the medium and short ones by 4,16.
++	 */
++	return imx708_write_reg(imx708, IMX708_REG_EXPOSURE,
++				IMX708_REG_VALUE_16BIT,
++				val >> imx708->long_exp_shift);
++}
++
++static void imx708_adjust_exposure_range(struct imx708 *imx708,
++					 struct v4l2_ctrl *ctrl)
++{
++	int exposure_max, exposure_def;
++
++	/* Honour the VBLANK limits when setting exposure. */
++	exposure_max = imx708->mode->height + imx708->vblank->val -
++		IMX708_EXPOSURE_OFFSET;
++	exposure_def = min(exposure_max, imx708->exposure->val);
++	__v4l2_ctrl_modify_range(imx708->exposure, imx708->exposure->minimum,
++				 exposure_max, imx708->exposure->step,
++				 exposure_def);
++}
++
++static int imx708_set_analogue_gain(struct imx708 *imx708, unsigned int val)
++{
++	int ret;
++
++	/*
++	 * In HDR mode this will set the gain for the longest exposure,
++	 * and by default the sensor uses the same gain for all of them.
++	 */
++	ret = imx708_write_reg(imx708, IMX708_REG_ANALOG_GAIN,
++			       IMX708_REG_VALUE_16BIT, val);
++
++	return ret;
++}
++
++static int imx708_set_frame_length(struct imx708 *imx708, unsigned int val)
++{
++	int ret;
++
++	imx708->long_exp_shift = 0;
++
++	while (val > IMX708_FRAME_LENGTH_MAX) {
++		imx708->long_exp_shift++;
++		val >>= 1;
++	}
++
++	ret = imx708_write_reg(imx708, IMX708_REG_FRAME_LENGTH,
++			       IMX708_REG_VALUE_16BIT, val);
++	if (ret)
++		return ret;
++
++	return imx708_write_reg(imx708, IMX708_LONG_EXP_SHIFT_REG,
++				IMX708_REG_VALUE_08BIT, imx708->long_exp_shift);
++}
++
++static void imx708_set_framing_limits(struct imx708 *imx708)
++{
++	const struct imx708_mode *mode = imx708->mode;
++	unsigned int hblank;
++
++	__v4l2_ctrl_modify_range(imx708->pixel_rate,
++				 mode->pixel_rate, mode->pixel_rate,
++				 1, mode->pixel_rate);
++
++	/* Update limits and set FPS to default */
++	__v4l2_ctrl_modify_range(imx708->vblank, mode->vblank_min,
++				 ((1 << IMX708_LONG_EXP_SHIFT_MAX) *
++					IMX708_FRAME_LENGTH_MAX) - mode->height,
++				 1, mode->vblank_default);
++
++	/*
++	 * Currently PPL is fixed to the mode specified value, so hblank
++	 * depends on mode->width only, and is not changeable in any
++	 * way other than changing the mode.
++	 */
++	hblank = mode->line_length_pix - mode->width;
++	__v4l2_ctrl_modify_range(imx708->hblank, hblank, hblank, 1, hblank);
++}
++
++static int imx708_set_ctrl(struct v4l2_ctrl *ctrl)
++{
++	struct imx708 *imx708 =
++		container_of(ctrl->handler, struct imx708, ctrl_handler);
++	struct i2c_client *client = v4l2_get_subdevdata(&imx708->sd);
++	const struct imx708_mode *mode_list;
++	unsigned int code, num_modes;
++	int ret = 0;
++
++	switch (ctrl->id) {
++	case V4L2_CID_VBLANK:
++		/*
++		 * The VBLANK control may change the limits of usable exposure,
++		 * so check and adjust if necessary.
++		 */
++		imx708_adjust_exposure_range(imx708, ctrl);
++		break;
++
++	case V4L2_CID_WIDE_DYNAMIC_RANGE:
++		/*
++		 * The WIDE_DYNAMIC_RANGE control can also be applied immediately
++		 * as it doesn't set any registers. Don't do anything if the mode
++		 * already matches.
++		 */
++		if (imx708->mode && imx708->mode->hdr != ctrl->val) {
++			code = imx708_get_format_code(imx708);
++			get_mode_table(code, &mode_list, &num_modes, ctrl->val);
++			imx708->mode = v4l2_find_nearest_size(mode_list,
++							      num_modes,
++							      width, height,
++							      imx708->mode->width,
++							      imx708->mode->height);
++			imx708_set_framing_limits(imx708);
++		}
++		break;
++	}
++
++	/*
++	 * Applying V4L2 control value only happens
++	 * when power is up for streaming
++	 */
++	if (pm_runtime_get_if_in_use(&client->dev) == 0)
++		return 0;
++
++	switch (ctrl->id) {
++	case V4L2_CID_ANALOGUE_GAIN:
++		imx708_set_analogue_gain(imx708, ctrl->val);
++		break;
++	case V4L2_CID_EXPOSURE:
++		ret = imx708_set_exposure(imx708, ctrl->val);
++		break;
++	case V4L2_CID_DIGITAL_GAIN:
++		ret = imx708_write_reg(imx708, IMX708_REG_DIGITAL_GAIN,
++				       IMX708_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN:
++		ret = imx708_write_reg(imx708, IMX708_REG_TEST_PATTERN,
++				       IMX708_REG_VALUE_16BIT,
++				       imx708_test_pattern_val[ctrl->val]);
++		break;
++	case V4L2_CID_TEST_PATTERN_RED:
++		ret = imx708_write_reg(imx708, IMX708_REG_TEST_PATTERN_R,
++				       IMX708_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN_GREENR:
++		ret = imx708_write_reg(imx708, IMX708_REG_TEST_PATTERN_GR,
++				       IMX708_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN_BLUE:
++		ret = imx708_write_reg(imx708, IMX708_REG_TEST_PATTERN_B,
++				       IMX708_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_TEST_PATTERN_GREENB:
++		ret = imx708_write_reg(imx708, IMX708_REG_TEST_PATTERN_GB,
++				       IMX708_REG_VALUE_16BIT, ctrl->val);
++		break;
++	case V4L2_CID_HFLIP:
++	case V4L2_CID_VFLIP:
++		ret = imx708_write_reg(imx708, IMX708_REG_ORIENTATION, 1,
++				       imx708->hflip->val |
++				       imx708->vflip->val << 1);
++		break;
++	case V4L2_CID_VBLANK:
++		ret = imx708_set_frame_length(imx708,
++					      imx708->mode->height + ctrl->val);
++		break;
++	case V4L2_CID_NOTIFY_GAINS:
++		ret = imx708_write_reg(imx708, IMX708_REG_COLOUR_BALANCE_BLUE,
++				       IMX708_REG_VALUE_16BIT,
++				       ctrl->p_new.p_u32[0]);
++		if (ret)
++			break;
++		ret = imx708_write_reg(imx708, IMX708_REG_COLOUR_BALANCE_RED,
++				       IMX708_REG_VALUE_16BIT,
++				       ctrl->p_new.p_u32[3]);
++		break;
++	case V4L2_CID_WIDE_DYNAMIC_RANGE:
++		/* Already handled above. */
++		break;
++	default:
++		dev_info(&client->dev,
++			 "ctrl(id:0x%x,val:0x%x) is not handled\n",
++			 ctrl->id, ctrl->val);
++		ret = -EINVAL;
++		break;
++	}
++
++	pm_runtime_put(&client->dev);
++
++	return ret;
++}
++
++static const struct v4l2_ctrl_ops imx708_ctrl_ops = {
++	.s_ctrl = imx708_set_ctrl,
++};
++
++static int imx708_enum_mbus_code(struct v4l2_subdev *sd,
++				 struct v4l2_subdev_state *sd_state,
++				 struct v4l2_subdev_mbus_code_enum *code)
++{
++	struct imx708 *imx708 = to_imx708(sd);
++
++	if (code->pad >= NUM_PADS)
++		return -EINVAL;
++
++	if (code->pad == IMAGE_PAD) {
++		if (code->index >= (ARRAY_SIZE(codes) / 4))
++			return -EINVAL;
++
++		code->code = imx708_get_format_code(imx708);
++	} else {
++		if (code->index > 0)
++			return -EINVAL;
++
++		code->code = MEDIA_BUS_FMT_SENSOR_DATA;
++	}
++
++	return 0;
++}
++
++static int imx708_enum_frame_size(struct v4l2_subdev *sd,
++				  struct v4l2_subdev_state *sd_state,
++				  struct v4l2_subdev_frame_size_enum *fse)
++{
++	struct imx708 *imx708 = to_imx708(sd);
++
++	if (fse->pad >= NUM_PADS)
++		return -EINVAL;
++
++	if (fse->pad == IMAGE_PAD) {
++		const struct imx708_mode *mode_list;
++		unsigned int num_modes;
++
++		get_mode_table(fse->code, &mode_list, &num_modes,
++			       imx708->hdr_mode->val);
++
++		if (fse->index >= num_modes)
++			return -EINVAL;
++
++		if (fse->code != imx708_get_format_code(imx708))
++			return -EINVAL;
++
++		fse->min_width = mode_list[fse->index].width;
++		fse->max_width = fse->min_width;
++		fse->min_height = mode_list[fse->index].height;
++		fse->max_height = fse->min_height;
++	} else {
++		if (fse->code != MEDIA_BUS_FMT_SENSOR_DATA || fse->index > 0)
++			return -EINVAL;
++
++		fse->min_width = IMX708_EMBEDDED_LINE_WIDTH;
++		fse->max_width = fse->min_width;
++		fse->min_height = IMX708_NUM_EMBEDDED_LINES;
++		fse->max_height = fse->min_height;
++	}
++
++	return 0;
++}
++
++static void imx708_reset_colorspace(struct v4l2_mbus_framefmt *fmt)
++{
++	fmt->colorspace = V4L2_COLORSPACE_RAW;
++	fmt->ycbcr_enc = V4L2_MAP_YCBCR_ENC_DEFAULT(fmt->colorspace);
++	fmt->quantization = V4L2_MAP_QUANTIZATION_DEFAULT(true,
++							  fmt->colorspace,
++							  fmt->ycbcr_enc);
++	fmt->xfer_func = V4L2_MAP_XFER_FUNC_DEFAULT(fmt->colorspace);
++}
++
++static void imx708_update_image_pad_format(struct imx708 *imx708,
++					   const struct imx708_mode *mode,
++					   struct v4l2_subdev_format *fmt)
++{
++	fmt->format.width = mode->width;
++	fmt->format.height = mode->height;
++	fmt->format.field = V4L2_FIELD_NONE;
++	imx708_reset_colorspace(&fmt->format);
++}
++
++static void imx708_update_metadata_pad_format(struct v4l2_subdev_format *fmt)
++{
++	fmt->format.width = IMX708_EMBEDDED_LINE_WIDTH;
++	fmt->format.height = IMX708_NUM_EMBEDDED_LINES;
++	fmt->format.code = MEDIA_BUS_FMT_SENSOR_DATA;
++	fmt->format.field = V4L2_FIELD_NONE;
++}
++
++static int imx708_get_pad_format(struct v4l2_subdev *sd,
++				 struct v4l2_subdev_state *sd_state,
++				 struct v4l2_subdev_format *fmt)
++{
++	struct imx708 *imx708 = to_imx708(sd);
++
++	if (fmt->pad >= NUM_PADS)
++		return -EINVAL;
++
++	mutex_lock(&imx708->mutex);
++
++	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++		struct v4l2_mbus_framefmt *try_fmt =
++			v4l2_subdev_state_get_format(sd_state,
++						   fmt->pad);
++		/* update the code which could change due to vflip or hflip */
++		try_fmt->code = fmt->pad == IMAGE_PAD ?
++				imx708_get_format_code(imx708) :
++				MEDIA_BUS_FMT_SENSOR_DATA;
++		fmt->format = *try_fmt;
++	} else {
++		if (fmt->pad == IMAGE_PAD) {
++			imx708_update_image_pad_format(imx708, imx708->mode,
++						       fmt);
++			fmt->format.code = imx708_get_format_code(imx708);
++		} else {
++			imx708_update_metadata_pad_format(fmt);
++		}
++	}
++
++	mutex_unlock(&imx708->mutex);
++	return 0;
++}
++
++static int imx708_set_pad_format(struct v4l2_subdev *sd,
++				 struct v4l2_subdev_state *sd_state,
++				 struct v4l2_subdev_format *fmt)
++{
++	struct v4l2_mbus_framefmt *framefmt;
++	const struct imx708_mode *mode;
++	struct imx708 *imx708 = to_imx708(sd);
++
++	if (fmt->pad >= NUM_PADS)
++		return -EINVAL;
++
++	mutex_lock(&imx708->mutex);
++
++	if (fmt->pad == IMAGE_PAD) {
++		const struct imx708_mode *mode_list;
++		unsigned int num_modes;
++
++		/* Bayer order varies with flips */
++		fmt->format.code = imx708_get_format_code(imx708);
++
++		get_mode_table(fmt->format.code, &mode_list, &num_modes,
++			       imx708->hdr_mode->val);
++
++		mode = v4l2_find_nearest_size(mode_list,
++					      num_modes,
++					      width, height,
++					      fmt->format.width,
++					      fmt->format.height);
++		imx708_update_image_pad_format(imx708, mode, fmt);
++		if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++			framefmt = v4l2_subdev_state_get_format(sd_state,
++							      fmt->pad);
++			*framefmt = fmt->format;
++		} else {
++			imx708->mode = mode;
++			imx708_set_framing_limits(imx708);
++		}
++	} else {
++		if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++			framefmt = v4l2_subdev_state_get_format(sd_state,
++							      fmt->pad);
++			*framefmt = fmt->format;
++		} else {
++			/* Only one embedded data mode is supported */
++			imx708_update_metadata_pad_format(fmt);
++		}
++	}
++
++	mutex_unlock(&imx708->mutex);
++
++	return 0;
++}
++
++static const struct v4l2_rect *
++__imx708_get_pad_crop(struct imx708 *imx708, struct v4l2_subdev_state *sd_state,
++		      unsigned int pad, enum v4l2_subdev_format_whence which)
++{
++	switch (which) {
++	case V4L2_SUBDEV_FORMAT_TRY:
++		return v4l2_subdev_state_get_crop(sd_state, pad);
++	case V4L2_SUBDEV_FORMAT_ACTIVE:
++		return &imx708->mode->crop;
++	}
++
++	return NULL;
++}
++
++static int imx708_get_selection(struct v4l2_subdev *sd,
++				struct v4l2_subdev_state *sd_state,
++				struct v4l2_subdev_selection *sel)
++{
++	switch (sel->target) {
++	case V4L2_SEL_TGT_CROP: {
++		struct imx708 *imx708 = to_imx708(sd);
++
++		mutex_lock(&imx708->mutex);
++		sel->r = *__imx708_get_pad_crop(imx708, sd_state, sel->pad,
++						sel->which);
++		mutex_unlock(&imx708->mutex);
++
++		return 0;
++	}
++
++	case V4L2_SEL_TGT_NATIVE_SIZE:
++		sel->r.left = 0;
++		sel->r.top = 0;
++		sel->r.width = IMX708_NATIVE_WIDTH;
++		sel->r.height = IMX708_NATIVE_HEIGHT;
++
++		return 0;
++
++	case V4L2_SEL_TGT_CROP_DEFAULT:
++	case V4L2_SEL_TGT_CROP_BOUNDS:
++		sel->r.left = IMX708_PIXEL_ARRAY_LEFT;
++		sel->r.top = IMX708_PIXEL_ARRAY_TOP;
++		sel->r.width = IMX708_PIXEL_ARRAY_WIDTH;
++		sel->r.height = IMX708_PIXEL_ARRAY_HEIGHT;
++
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++/* Start streaming */
++static int imx708_start_streaming(struct imx708 *imx708)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx708->sd);
++	const struct imx708_reg_list *reg_list, *freq_regs;
++	int i, ret;
++	u32 val;
++
++	if (!imx708->common_regs_written) {
++		ret = imx708_write_regs(imx708, mode_common_regs,
++					ARRAY_SIZE(mode_common_regs));
++		if (ret) {
++			dev_err(&client->dev, "%s failed to set common settings\n",
++				__func__);
++			return ret;
++		}
++
++		ret = imx708_read_reg(imx708, IMX708_REG_BASE_SPC_GAINS_L,
++				      IMX708_REG_VALUE_08BIT, &val);
++		if (ret == 0 && val == 0x40) {
++			for (i = 0; i < 54 && ret == 0; i++) {
++				ret = imx708_write_reg(imx708,
++						       IMX708_REG_BASE_SPC_GAINS_L + i,
++						       IMX708_REG_VALUE_08BIT,
++						       pdaf_gains[0][i % 9]);
++			}
++			for (i = 0; i < 54 && ret == 0; i++) {
++				ret = imx708_write_reg(imx708,
++						       IMX708_REG_BASE_SPC_GAINS_R + i,
++						       IMX708_REG_VALUE_08BIT,
++						       pdaf_gains[1][i % 9]);
++			}
++		}
++		if (ret) {
++			dev_err(&client->dev, "%s failed to set PDAF gains\n",
++				__func__);
++			return ret;
++		}
++
++		imx708->common_regs_written = true;
++	}
++
++	/* Apply default values of current mode */
++	reg_list = &imx708->mode->reg_list;
++	ret = imx708_write_regs(imx708, reg_list->regs, reg_list->num_of_regs);
++	if (ret) {
++		dev_err(&client->dev, "%s failed to set mode\n", __func__);
++		return ret;
++	}
++
++	/* Update the link frequency registers */
++	freq_regs = &link_freq_regs[imx708->link_freq_idx];
++	ret = imx708_write_regs(imx708, freq_regs->regs,
++				freq_regs->num_of_regs);
++	if (ret) {
++		dev_err(&client->dev, "%s failed to set link frequency registers\n",
++			__func__);
++		return ret;
++	}
++
++	/* Quad Bayer re-mosaic adjustments (for full-resolution mode only) */
++	if (imx708->mode->remosaic && qbc_adjust > 0) {
++		imx708_write_reg(imx708, IMX708_LPF_INTENSITY,
++				 IMX708_REG_VALUE_08BIT, qbc_adjust);
++		imx708_write_reg(imx708,
++				 IMX708_LPF_INTENSITY_EN,
++				 IMX708_REG_VALUE_08BIT,
++				 IMX708_LPF_INTENSITY_ENABLED);
++	} else {
++		imx708_write_reg(imx708,
++				 IMX708_LPF_INTENSITY_EN,
++				 IMX708_REG_VALUE_08BIT,
++				 IMX708_LPF_INTENSITY_DISABLED);
++	}
++
++	/* Apply customized values from user */
++	ret =  __v4l2_ctrl_handler_setup(imx708->sd.ctrl_handler);
++	if (ret)
++		return ret;
++
++	/* set stream on register */
++	return imx708_write_reg(imx708, IMX708_REG_MODE_SELECT,
++				IMX708_REG_VALUE_08BIT, IMX708_MODE_STREAMING);
++}
++
++/* Stop streaming */
++static void imx708_stop_streaming(struct imx708 *imx708)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx708->sd);
++	int ret;
++
++	/* set stream off register */
++	ret = imx708_write_reg(imx708, IMX708_REG_MODE_SELECT,
++			       IMX708_REG_VALUE_08BIT, IMX708_MODE_STANDBY);
++	if (ret)
++		dev_err(&client->dev, "%s failed to set stream\n", __func__);
++}
++
++static int imx708_set_stream(struct v4l2_subdev *sd, int enable)
++{
++	struct imx708 *imx708 = to_imx708(sd);
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++	int ret = 0;
++
++	mutex_lock(&imx708->mutex);
++	if (imx708->streaming == enable) {
++		mutex_unlock(&imx708->mutex);
++		return 0;
++	}
++
++	if (enable) {
++		ret = pm_runtime_get_sync(&client->dev);
++		if (ret < 0) {
++			pm_runtime_put_noidle(&client->dev);
++			goto err_unlock;
++		}
++
++		/*
++		 * Apply default & customized values
++		 * and then start streaming.
++		 */
++		ret = imx708_start_streaming(imx708);
++		if (ret)
++			goto err_rpm_put;
++	} else {
++		imx708_stop_streaming(imx708);
++		pm_runtime_put(&client->dev);
++	}
++
++	imx708->streaming = enable;
++
++	/* vflip/hflip and hdr mode cannot change during streaming */
++	__v4l2_ctrl_grab(imx708->vflip, enable);
++	__v4l2_ctrl_grab(imx708->hflip, enable);
++	__v4l2_ctrl_grab(imx708->hdr_mode, enable);
++
++	mutex_unlock(&imx708->mutex);
++
++	return ret;
++
++err_rpm_put:
++	pm_runtime_put(&client->dev);
++err_unlock:
++	mutex_unlock(&imx708->mutex);
++
++	return ret;
++}
++
++/* Power/clock management functions */
++static int imx708_power_on(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx708 *imx708 = to_imx708(sd);
++	int ret;
++
++	ret = regulator_bulk_enable(ARRAY_SIZE(imx708_supply_name),
++				    imx708->supplies);
++	if (ret) {
++		dev_err(&client->dev, "%s: failed to enable regulators\n",
++			__func__);
++		return ret;
++	}
++
++	ret = clk_prepare_enable(imx708->inclk);
++	if (ret) {
++		dev_err(&client->dev, "%s: failed to enable clock\n",
++			__func__);
++		goto reg_off;
++	}
++
++	gpiod_set_value_cansleep(imx708->reset_gpio, 1);
++	usleep_range(IMX708_XCLR_MIN_DELAY_US,
++		     IMX708_XCLR_MIN_DELAY_US + IMX708_XCLR_DELAY_RANGE_US);
++
++	return 0;
++
++reg_off:
++	regulator_bulk_disable(ARRAY_SIZE(imx708_supply_name),
++			       imx708->supplies);
++	return ret;
++}
++
++static int imx708_power_off(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx708 *imx708 = to_imx708(sd);
++
++	gpiod_set_value_cansleep(imx708->reset_gpio, 0);
++	regulator_bulk_disable(ARRAY_SIZE(imx708_supply_name),
++			       imx708->supplies);
++	clk_disable_unprepare(imx708->inclk);
++
++	/* Force reprogramming of the common registers when powered up again. */
++	imx708->common_regs_written = false;
++
++	return 0;
++}
++
++static int __maybe_unused imx708_suspend(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx708 *imx708 = to_imx708(sd);
++
++	if (imx708->streaming)
++		imx708_stop_streaming(imx708);
++
++	return 0;
++}
++
++static int __maybe_unused imx708_resume(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx708 *imx708 = to_imx708(sd);
++	int ret;
++
++	if (imx708->streaming) {
++		ret = imx708_start_streaming(imx708);
++		if (ret)
++			goto error;
++	}
++
++	return 0;
++
++error:
++	imx708_stop_streaming(imx708);
++	imx708->streaming = 0;
++	return ret;
++}
++
++static int imx708_get_regulators(struct imx708 *imx708)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx708->sd);
++	unsigned int i;
++
++	for (i = 0; i < ARRAY_SIZE(imx708_supply_name); i++)
++		imx708->supplies[i].supply = imx708_supply_name[i];
++
++	return devm_regulator_bulk_get(&client->dev,
++				       ARRAY_SIZE(imx708_supply_name),
++				       imx708->supplies);
++}
++
++/* Verify chip ID */
++static int imx708_identify_module(struct imx708 *imx708)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx708->sd);
++	int ret;
++	u32 val;
++
++	ret = imx708_read_reg(imx708, IMX708_REG_CHIP_ID,
++			      IMX708_REG_VALUE_16BIT, &val);
++	if (ret) {
++		dev_err(&client->dev, "failed to read chip id %x, with error %d\n",
++			IMX708_CHIP_ID, ret);
++		return ret;
++	}
++
++	if (val != IMX708_CHIP_ID) {
++		dev_err(&client->dev, "chip id mismatch: %x!=%x\n",
++			IMX708_CHIP_ID, val);
++		return -EIO;
++	}
++
++	ret = imx708_read_reg(imx708, 0x0000, IMX708_REG_VALUE_16BIT, &val);
++	if (!ret) {
++		dev_info(&client->dev, "camera module ID 0x%04x\n", val);
++		snprintf(imx708->sd.name, sizeof(imx708->sd.name), "imx708%s%s",
++			 val & 0x02 ? "_wide" : "",
++			 val & 0x80 ? "_noir" : "");
++	}
++
++	return 0;
++}
++
++static const struct v4l2_subdev_core_ops imx708_core_ops = {
++	.subscribe_event = v4l2_ctrl_subdev_subscribe_event,
++	.unsubscribe_event = v4l2_event_subdev_unsubscribe,
++};
++
++static const struct v4l2_subdev_video_ops imx708_video_ops = {
++	.s_stream = imx708_set_stream,
++};
++
++static const struct v4l2_subdev_pad_ops imx708_pad_ops = {
++	.enum_mbus_code = imx708_enum_mbus_code,
++	.get_fmt = imx708_get_pad_format,
++	.set_fmt = imx708_set_pad_format,
++	.get_selection = imx708_get_selection,
++	.enum_frame_size = imx708_enum_frame_size,
++};
++
++static const struct v4l2_subdev_ops imx708_subdev_ops = {
++	.core = &imx708_core_ops,
++	.video = &imx708_video_ops,
++	.pad = &imx708_pad_ops,
++};
++
++static const struct v4l2_subdev_internal_ops imx708_internal_ops = {
++	.open = imx708_open,
++};
++
++static const struct v4l2_ctrl_config imx708_notify_gains_ctrl = {
++	.ops = &imx708_ctrl_ops,
++	.id = V4L2_CID_NOTIFY_GAINS,
++	.type = V4L2_CTRL_TYPE_U32,
++	.min = IMX708_COLOUR_BALANCE_MIN,
++	.max = IMX708_COLOUR_BALANCE_MAX,
++	.step = IMX708_COLOUR_BALANCE_STEP,
++	.def = IMX708_COLOUR_BALANCE_DEFAULT,
++	.dims = { 4 },
++	.elem_size = sizeof(u32),
++};
++
++/* Initialize control handlers */
++static int imx708_init_controls(struct imx708 *imx708)
++{
++	struct v4l2_ctrl_handler *ctrl_hdlr;
++	struct i2c_client *client = v4l2_get_subdevdata(&imx708->sd);
++	struct v4l2_fwnode_device_properties props;
++	struct v4l2_ctrl *ctrl;
++	unsigned int i;
++	int ret;
++
++	ctrl_hdlr = &imx708->ctrl_handler;
++	ret = v4l2_ctrl_handler_init(ctrl_hdlr, 16);
++	if (ret)
++		return ret;
++
++	mutex_init(&imx708->mutex);
++	ctrl_hdlr->lock = &imx708->mutex;
++
++	/* By default, PIXEL_RATE is read only */
++	imx708->pixel_rate = v4l2_ctrl_new_std(ctrl_hdlr, &imx708_ctrl_ops,
++					       V4L2_CID_PIXEL_RATE,
++					       IMX708_INITIAL_PIXEL_RATE,
++					       IMX708_INITIAL_PIXEL_RATE, 1,
++					       IMX708_INITIAL_PIXEL_RATE);
++
++	ctrl = v4l2_ctrl_new_int_menu(ctrl_hdlr, &imx708_ctrl_ops,
++				      V4L2_CID_LINK_FREQ, 0, 0,
++				      &link_freqs[imx708->link_freq_idx]);
++	if (ctrl)
++		ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++
++	/*
++	 * Create the controls here, but mode specific limits are setup
++	 * in the imx708_set_framing_limits() call below.
++	 */
++	imx708->vblank = v4l2_ctrl_new_std(ctrl_hdlr, &imx708_ctrl_ops,
++					   V4L2_CID_VBLANK, 0, 0xffff, 1, 0);
++	imx708->hblank = v4l2_ctrl_new_std(ctrl_hdlr, &imx708_ctrl_ops,
++					   V4L2_CID_HBLANK, 0, 0xffff, 1, 0);
++
++	imx708->exposure = v4l2_ctrl_new_std(ctrl_hdlr, &imx708_ctrl_ops,
++					     V4L2_CID_EXPOSURE,
++					     IMX708_EXPOSURE_MIN,
++					     IMX708_EXPOSURE_MAX,
++					     IMX708_EXPOSURE_STEP,
++					     IMX708_EXPOSURE_DEFAULT);
++
++	v4l2_ctrl_new_std(ctrl_hdlr, &imx708_ctrl_ops, V4L2_CID_ANALOGUE_GAIN,
++			  IMX708_ANA_GAIN_MIN, IMX708_ANA_GAIN_MAX,
++			  IMX708_ANA_GAIN_STEP, IMX708_ANA_GAIN_DEFAULT);
++
++	v4l2_ctrl_new_std(ctrl_hdlr, &imx708_ctrl_ops, V4L2_CID_DIGITAL_GAIN,
++			  IMX708_DGTL_GAIN_MIN, IMX708_DGTL_GAIN_MAX,
++			  IMX708_DGTL_GAIN_STEP, IMX708_DGTL_GAIN_DEFAULT);
++
++	imx708->hflip = v4l2_ctrl_new_std(ctrl_hdlr, &imx708_ctrl_ops,
++					  V4L2_CID_HFLIP, 0, 1, 1, 0);
++
++	imx708->vflip = v4l2_ctrl_new_std(ctrl_hdlr, &imx708_ctrl_ops,
++					  V4L2_CID_VFLIP, 0, 1, 1, 0);
++	v4l2_ctrl_cluster(2, &imx708->hflip);
++
++	v4l2_ctrl_new_std_menu_items(ctrl_hdlr, &imx708_ctrl_ops,
++				     V4L2_CID_TEST_PATTERN,
++				     ARRAY_SIZE(imx708_test_pattern_menu) - 1,
++				     0, 0, imx708_test_pattern_menu);
++	for (i = 0; i < 4; i++) {
++		/*
++		 * The assumption is that
++		 * V4L2_CID_TEST_PATTERN_GREENR == V4L2_CID_TEST_PATTERN_RED + 1
++		 * V4L2_CID_TEST_PATTERN_BLUE   == V4L2_CID_TEST_PATTERN_RED + 2
++		 * V4L2_CID_TEST_PATTERN_GREENB == V4L2_CID_TEST_PATTERN_RED + 3
++		 */
++		v4l2_ctrl_new_std(ctrl_hdlr, &imx708_ctrl_ops,
++				  V4L2_CID_TEST_PATTERN_RED + i,
++				  IMX708_TEST_PATTERN_COLOUR_MIN,
++				  IMX708_TEST_PATTERN_COLOUR_MAX,
++				  IMX708_TEST_PATTERN_COLOUR_STEP,
++				  IMX708_TEST_PATTERN_COLOUR_MAX);
++		/* The "Solid color" pattern is white by default */
++	}
++
++	v4l2_ctrl_new_custom(ctrl_hdlr, &imx708_notify_gains_ctrl, NULL);
++
++	imx708->hdr_mode = v4l2_ctrl_new_std(ctrl_hdlr, &imx708_ctrl_ops,
++					     V4L2_CID_WIDE_DYNAMIC_RANGE,
++					     0, 1, 1, 0);
++
++	ret = v4l2_fwnode_device_parse(&client->dev, &props);
++	if (ret)
++		goto error;
++
++	v4l2_ctrl_new_fwnode_properties(ctrl_hdlr, &imx708_ctrl_ops, &props);
++
++	if (ctrl_hdlr->error) {
++		ret = ctrl_hdlr->error;
++		dev_err(&client->dev, "%s control init failed (%d)\n",
++			__func__, ret);
++		goto error;
++	}
++
++	imx708->hblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++	imx708->hflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++	imx708->vflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++	imx708->hdr_mode->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++
++	imx708->sd.ctrl_handler = ctrl_hdlr;
++
++	/* Setup exposure and frame/line length limits. */
++	imx708_set_framing_limits(imx708);
++
++	return 0;
++
++error:
++	v4l2_ctrl_handler_free(ctrl_hdlr);
++	mutex_destroy(&imx708->mutex);
++
++	return ret;
++}
++
++static void imx708_free_controls(struct imx708 *imx708)
++{
++	v4l2_ctrl_handler_free(imx708->sd.ctrl_handler);
++	mutex_destroy(&imx708->mutex);
++}
++
++static int imx708_check_hwcfg(struct device *dev, struct imx708 *imx708)
++{
++	struct fwnode_handle *endpoint;
++	struct v4l2_fwnode_endpoint ep_cfg = {
++		.bus_type = V4L2_MBUS_CSI2_DPHY
++	};
++	int ret = -EINVAL;
++	int i;
++
++	endpoint = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
++	if (!endpoint) {
++		dev_err(dev, "endpoint node not found\n");
++		return -EINVAL;
++	}
++
++	if (v4l2_fwnode_endpoint_alloc_parse(endpoint, &ep_cfg)) {
++		dev_err(dev, "could not parse endpoint\n");
++		goto error_out;
++	}
++
++	/* Check the number of MIPI CSI2 data lanes */
++	if (ep_cfg.bus.mipi_csi2.num_data_lanes != 2) {
++		dev_err(dev, "only 2 data lanes are currently supported\n");
++		goto error_out;
++	}
++
++	/* Check the link frequency set in device tree */
++	if (!ep_cfg.nr_of_link_frequencies) {
++		dev_err(dev, "link-frequency property not found in DT\n");
++		goto error_out;
++	}
++
++	for (i = 0; i < ARRAY_SIZE(link_freqs); i++) {
++		if (link_freqs[i] == ep_cfg.link_frequencies[0]) {
++			imx708->link_freq_idx = i;
++			break;
++		}
++	}
++
++	if (i == ARRAY_SIZE(link_freqs)) {
++		dev_err(dev, "Link frequency not supported: %lld\n",
++			ep_cfg.link_frequencies[0]);
++			ret = -EINVAL;
++			goto error_out;
++	}
++
++	ret = 0;
++
++error_out:
++	v4l2_fwnode_endpoint_free(&ep_cfg);
++	fwnode_handle_put(endpoint);
++
++	return ret;
++}
++
++static int imx708_probe(struct i2c_client *client)
++{
++	struct device *dev = &client->dev;
++	struct imx708 *imx708;
++	int ret;
++
++	imx708 = devm_kzalloc(&client->dev, sizeof(*imx708), GFP_KERNEL);
++	if (!imx708)
++		return -ENOMEM;
++
++	v4l2_i2c_subdev_init(&imx708->sd, client, &imx708_subdev_ops);
++
++	/* Check the hardware configuration in device tree */
++	if (imx708_check_hwcfg(dev, imx708))
++		return -EINVAL;
++
++	/* Get system clock (inclk) */
++	imx708->inclk = devm_clk_get(dev, "inclk");
++	if (IS_ERR(imx708->inclk))
++		return dev_err_probe(dev, PTR_ERR(imx708->inclk),
++				     "failed to get inclk\n");
++
++	imx708->inclk_freq = clk_get_rate(imx708->inclk);
++	if (imx708->inclk_freq != IMX708_INCLK_FREQ)
++		return dev_err_probe(dev, -EINVAL,
++				     "inclk frequency not supported: %d Hz\n",
++				     imx708->inclk_freq);
++
++	ret = imx708_get_regulators(imx708);
++	if (ret)
++		return dev_err_probe(dev, ret, "failed to get regulators\n");
++
++	/* Request optional enable pin */
++	imx708->reset_gpio = devm_gpiod_get_optional(dev, "reset",
++						     GPIOD_OUT_HIGH);
++
++	/*
++	 * The sensor must be powered for imx708_identify_module()
++	 * to be able to read the CHIP_ID register
++	 */
++	ret = imx708_power_on(dev);
++	if (ret)
++		return ret;
++
++	ret = imx708_identify_module(imx708);
++	if (ret)
++		goto error_power_off;
++
++	/* Initialize default format */
++	imx708_set_default_format(imx708);
++
++	/* Enable runtime PM and turn off the device */
++	pm_runtime_set_active(dev);
++	pm_runtime_enable(dev);
++	pm_runtime_idle(dev);
++
++	/* This needs the pm runtime to be registered. */
++	ret = imx708_init_controls(imx708);
++	if (ret)
++		goto error_pm_runtime;
++
++	/* Initialize subdev */
++	imx708->sd.internal_ops = &imx708_internal_ops;
++	imx708->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE |
++			    V4L2_SUBDEV_FL_HAS_EVENTS;
++	imx708->sd.entity.function = MEDIA_ENT_F_CAM_SENSOR;
++
++	/* Initialize source pads */
++	imx708->pad[IMAGE_PAD].flags = MEDIA_PAD_FL_SOURCE;
++	imx708->pad[METADATA_PAD].flags = MEDIA_PAD_FL_SOURCE;
++
++	ret = media_entity_pads_init(&imx708->sd.entity, NUM_PADS, imx708->pad);
++	if (ret) {
++		dev_err(dev, "failed to init entity pads: %d\n", ret);
++		goto error_handler_free;
++	}
++
++	ret = v4l2_async_register_subdev_sensor(&imx708->sd);
++	if (ret < 0) {
++		dev_err(dev, "failed to register sensor sub-device: %d\n", ret);
++		goto error_media_entity;
++	}
++
++	return 0;
++
++error_media_entity:
++	media_entity_cleanup(&imx708->sd.entity);
++
++error_handler_free:
++	imx708_free_controls(imx708);
++
++error_pm_runtime:
++	pm_runtime_disable(&client->dev);
++	pm_runtime_set_suspended(&client->dev);
++
++error_power_off:
++	imx708_power_off(&client->dev);
++
++	return ret;
++}
++
++static void imx708_remove(struct i2c_client *client)
++{
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx708 *imx708 = to_imx708(sd);
++
++	v4l2_async_unregister_subdev(sd);
++	media_entity_cleanup(&sd->entity);
++	imx708_free_controls(imx708);
++
++	pm_runtime_disable(&client->dev);
++	if (!pm_runtime_status_suspended(&client->dev))
++		imx708_power_off(&client->dev);
++	pm_runtime_set_suspended(&client->dev);
++}
++
++static const struct of_device_id imx708_dt_ids[] = {
++	{ .compatible = "sony,imx708" },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, imx708_dt_ids);
++
++static const struct dev_pm_ops imx708_pm_ops = {
++	SET_SYSTEM_SLEEP_PM_OPS(imx708_suspend, imx708_resume)
++	SET_RUNTIME_PM_OPS(imx708_power_off, imx708_power_on, NULL)
++};
++
++static struct i2c_driver imx708_i2c_driver = {
++	.driver = {
++		.name = "imx708",
++		.of_match_table	= imx708_dt_ids,
++		.pm = &imx708_pm_ops,
++	},
++	.probe = imx708_probe,
++	.remove = imx708_remove,
++};
++
++module_i2c_driver(imx708_i2c_driver);
++
++MODULE_AUTHOR("David Plowman <david.plowman@raspberrypi.com>");
++MODULE_DESCRIPTION("Sony IMX708 sensor driver");
++MODULE_LICENSE("GPL v2");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0306-media-bcm2835-unicam-Use-mipi-csi2.h-header-for-data.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0306-media-bcm2835-unicam-Use-mipi-csi2.h-header-for-data.patch
new file mode 100644
index 00000000..e08880ee
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0306-media-bcm2835-unicam-Use-mipi-csi2.h-header-for-data.patch
@@ -0,0 +1,288 @@
+From 4fffe4ac1fcad81bd7e6dc126e2d64e34791e7f0 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 20 Jan 2023 11:50:28 +0000
+Subject: [PATCH 306/697] media: bcm2835-unicam: Use mipi-csi2.h header for
+ data type values
+
+The MIPI CSI2 data type ID values are now defined in the
+mipi-csi2.h header, so use those defines instead of hard
+coding them in the driver.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../media/platform/bcm2835/bcm2835-unicam.c   | 67 ++++++++++---------
+ 1 file changed, 34 insertions(+), 33 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -62,6 +62,7 @@
+ #include <linux/uaccess.h>
+ #include <linux/videodev2.h>
+ 
++#include <media/mipi-csi2.h>
+ #include <media/v4l2-common.h>
+ #include <media/v4l2-ctrls.h>
+ #include <media/v4l2-dev.h>
+@@ -191,7 +192,7 @@ static const struct unicam_fmt formats[]
+ 		.fourcc		= V4L2_PIX_FMT_YUYV,
+ 		.code		= MEDIA_BUS_FMT_YUYV8_2X8,
+ 		.depth		= 16,
+-		.csi_dt		= 0x1e,
++		.csi_dt		= MIPI_CSI2_DT_YUV422_8B,
+ 		.check_variants = 1,
+ 		.valid_colorspaces = MASK_CS_SMPTE170M | MASK_CS_REC709 |
+ 				     MASK_CS_JPEG,
+@@ -199,7 +200,7 @@ static const struct unicam_fmt formats[]
+ 		.fourcc		= V4L2_PIX_FMT_UYVY,
+ 		.code		= MEDIA_BUS_FMT_UYVY8_2X8,
+ 		.depth		= 16,
+-		.csi_dt		= 0x1e,
++		.csi_dt		= MIPI_CSI2_DT_YUV422_8B,
+ 		.check_variants = 1,
+ 		.valid_colorspaces = MASK_CS_SMPTE170M | MASK_CS_REC709 |
+ 				     MASK_CS_JPEG,
+@@ -207,7 +208,7 @@ static const struct unicam_fmt formats[]
+ 		.fourcc		= V4L2_PIX_FMT_YVYU,
+ 		.code		= MEDIA_BUS_FMT_YVYU8_2X8,
+ 		.depth		= 16,
+-		.csi_dt		= 0x1e,
++		.csi_dt		= MIPI_CSI2_DT_YUV422_8B,
+ 		.check_variants = 1,
+ 		.valid_colorspaces = MASK_CS_SMPTE170M | MASK_CS_REC709 |
+ 				     MASK_CS_JPEG,
+@@ -215,7 +216,7 @@ static const struct unicam_fmt formats[]
+ 		.fourcc		= V4L2_PIX_FMT_VYUY,
+ 		.code		= MEDIA_BUS_FMT_VYUY8_2X8,
+ 		.depth		= 16,
+-		.csi_dt		= 0x1e,
++		.csi_dt		= MIPI_CSI2_DT_YUV422_8B,
+ 		.check_variants = 1,
+ 		.valid_colorspaces = MASK_CS_SMPTE170M | MASK_CS_REC709 |
+ 				     MASK_CS_JPEG,
+@@ -223,7 +224,7 @@ static const struct unicam_fmt formats[]
+ 		.fourcc		= V4L2_PIX_FMT_YUYV,
+ 		.code		= MEDIA_BUS_FMT_YUYV8_1X16,
+ 		.depth		= 16,
+-		.csi_dt		= 0x1e,
++		.csi_dt		= MIPI_CSI2_DT_YUV422_8B,
+ 		.mc_skip	= 1,
+ 		.valid_colorspaces = MASK_CS_SMPTE170M | MASK_CS_REC709 |
+ 				     MASK_CS_JPEG,
+@@ -231,7 +232,7 @@ static const struct unicam_fmt formats[]
+ 		.fourcc		= V4L2_PIX_FMT_UYVY,
+ 		.code		= MEDIA_BUS_FMT_UYVY8_1X16,
+ 		.depth		= 16,
+-		.csi_dt		= 0x1e,
++		.csi_dt		= MIPI_CSI2_DT_YUV422_8B,
+ 		.mc_skip	= 1,
+ 		.valid_colorspaces = MASK_CS_SMPTE170M | MASK_CS_REC709 |
+ 				     MASK_CS_JPEG,
+@@ -239,7 +240,7 @@ static const struct unicam_fmt formats[]
+ 		.fourcc		= V4L2_PIX_FMT_YVYU,
+ 		.code		= MEDIA_BUS_FMT_YVYU8_1X16,
+ 		.depth		= 16,
+-		.csi_dt		= 0x1e,
++		.csi_dt		= MIPI_CSI2_DT_YUV422_8B,
+ 		.mc_skip	= 1,
+ 		.valid_colorspaces = MASK_CS_SMPTE170M | MASK_CS_REC709 |
+ 				     MASK_CS_JPEG,
+@@ -247,7 +248,7 @@ static const struct unicam_fmt formats[]
+ 		.fourcc		= V4L2_PIX_FMT_VYUY,
+ 		.code		= MEDIA_BUS_FMT_VYUY8_1X16,
+ 		.depth		= 16,
+-		.csi_dt		= 0x1e,
++		.csi_dt		= MIPI_CSI2_DT_YUV422_8B,
+ 		.mc_skip	= 1,
+ 		.valid_colorspaces = MASK_CS_SMPTE170M | MASK_CS_REC709 |
+ 				     MASK_CS_JPEG,
+@@ -256,37 +257,37 @@ static const struct unicam_fmt formats[]
+ 		.fourcc		= V4L2_PIX_FMT_RGB565, /* gggbbbbb rrrrrggg */
+ 		.code		= MEDIA_BUS_FMT_RGB565_2X8_LE,
+ 		.depth		= 16,
+-		.csi_dt		= 0x22,
++		.csi_dt		= MIPI_CSI2_DT_RGB565,
+ 		.valid_colorspaces = MASK_CS_SRGB,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_RGB565X, /* rrrrrggg gggbbbbb */
+ 		.code		= MEDIA_BUS_FMT_RGB565_2X8_BE,
+ 		.depth		= 16,
+-		.csi_dt		= 0x22,
++		.csi_dt		= MIPI_CSI2_DT_RGB565,
+ 		.valid_colorspaces = MASK_CS_SRGB,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_RGB555, /* gggbbbbb arrrrrgg */
+ 		.code		= MEDIA_BUS_FMT_RGB555_2X8_PADHI_LE,
+ 		.depth		= 16,
+-		.csi_dt		= 0x21,
++		.csi_dt		= MIPI_CSI2_DT_RGB555,
+ 		.valid_colorspaces = MASK_CS_SRGB,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_RGB555X, /* arrrrrgg gggbbbbb */
+ 		.code		= MEDIA_BUS_FMT_RGB555_2X8_PADHI_BE,
+ 		.depth		= 16,
+-		.csi_dt		= 0x21,
++		.csi_dt		= MIPI_CSI2_DT_RGB555,
+ 		.valid_colorspaces = MASK_CS_SRGB,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_RGB24, /* rgb */
+ 		.code		= MEDIA_BUS_FMT_RGB888_1X24,
+ 		.depth		= 24,
+-		.csi_dt		= 0x24,
++		.csi_dt		= MIPI_CSI2_DT_RGB888,
+ 		.valid_colorspaces = MASK_CS_SRGB,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_BGR24, /* bgr */
+ 		.code		= MEDIA_BUS_FMT_BGR888_1X24,
+ 		.depth		= 24,
+-		.csi_dt		= 0x24,
++		.csi_dt		= MIPI_CSI2_DT_RGB888,
+ 		.valid_colorspaces = MASK_CS_SRGB,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_RGB32, /* argb */
+@@ -299,105 +300,105 @@ static const struct unicam_fmt formats[]
+ 		.fourcc		= V4L2_PIX_FMT_SBGGR8,
+ 		.code		= MEDIA_BUS_FMT_SBGGR8_1X8,
+ 		.depth		= 8,
+-		.csi_dt		= 0x2a,
++		.csi_dt		= MIPI_CSI2_DT_RAW8,
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGBRG8,
+ 		.code		= MEDIA_BUS_FMT_SGBRG8_1X8,
+ 		.depth		= 8,
+-		.csi_dt		= 0x2a,
++		.csi_dt		= MIPI_CSI2_DT_RAW8,
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGRBG8,
+ 		.code		= MEDIA_BUS_FMT_SGRBG8_1X8,
+ 		.depth		= 8,
+-		.csi_dt		= 0x2a,
++		.csi_dt		= MIPI_CSI2_DT_RAW8,
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SRGGB8,
+ 		.code		= MEDIA_BUS_FMT_SRGGB8_1X8,
+ 		.depth		= 8,
+-		.csi_dt		= 0x2a,
++		.csi_dt		= MIPI_CSI2_DT_RAW8,
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SBGGR10P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SBGGR10,
+ 		.code		= MEDIA_BUS_FMT_SBGGR10_1X10,
+ 		.depth		= 10,
+-		.csi_dt		= 0x2b,
++		.csi_dt		= MIPI_CSI2_DT_RAW10,
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGBRG10P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SGBRG10,
+ 		.code		= MEDIA_BUS_FMT_SGBRG10_1X10,
+ 		.depth		= 10,
+-		.csi_dt		= 0x2b,
++		.csi_dt		= MIPI_CSI2_DT_RAW10,
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGRBG10P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SGRBG10,
+ 		.code		= MEDIA_BUS_FMT_SGRBG10_1X10,
+ 		.depth		= 10,
+-		.csi_dt		= 0x2b,
++		.csi_dt		= MIPI_CSI2_DT_RAW10,
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SRGGB10P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SRGGB10,
+ 		.code		= MEDIA_BUS_FMT_SRGGB10_1X10,
+ 		.depth		= 10,
+-		.csi_dt		= 0x2b,
++		.csi_dt		= MIPI_CSI2_DT_RAW10,
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SBGGR12P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SBGGR12,
+ 		.code		= MEDIA_BUS_FMT_SBGGR12_1X12,
+ 		.depth		= 12,
+-		.csi_dt		= 0x2c,
++		.csi_dt		= MIPI_CSI2_DT_RAW12,
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGBRG12P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SGBRG12,
+ 		.code		= MEDIA_BUS_FMT_SGBRG12_1X12,
+ 		.depth		= 12,
+-		.csi_dt		= 0x2c,
++		.csi_dt		= MIPI_CSI2_DT_RAW12,
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGRBG12P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SGRBG12,
+ 		.code		= MEDIA_BUS_FMT_SGRBG12_1X12,
+ 		.depth		= 12,
+-		.csi_dt		= 0x2c,
++		.csi_dt		= MIPI_CSI2_DT_RAW12,
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SRGGB12P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_SRGGB12,
+ 		.code		= MEDIA_BUS_FMT_SRGGB12_1X12,
+ 		.depth		= 12,
+-		.csi_dt		= 0x2c,
++		.csi_dt		= MIPI_CSI2_DT_RAW12,
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SBGGR14P,
+ 		.code		= MEDIA_BUS_FMT_SBGGR14_1X14,
+ 		.depth		= 14,
+-		.csi_dt		= 0x2d,
++		.csi_dt		= MIPI_CSI2_DT_RAW14,
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGBRG14P,
+ 		.code		= MEDIA_BUS_FMT_SGBRG14_1X14,
+ 		.depth		= 14,
+-		.csi_dt		= 0x2d,
++		.csi_dt		= MIPI_CSI2_DT_RAW14,
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGRBG14P,
+ 		.code		= MEDIA_BUS_FMT_SGRBG14_1X14,
+ 		.depth		= 14,
+-		.csi_dt		= 0x2d,
++		.csi_dt		= MIPI_CSI2_DT_RAW14,
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SRGGB14P,
+ 		.code		= MEDIA_BUS_FMT_SRGGB14_1X14,
+ 		.depth		= 14,
+-		.csi_dt		= 0x2d,
++		.csi_dt		= MIPI_CSI2_DT_RAW14,
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 	/*
+@@ -410,21 +411,21 @@ static const struct unicam_fmt formats[]
+ 		.fourcc		= V4L2_PIX_FMT_GREY,
+ 		.code		= MEDIA_BUS_FMT_Y8_1X8,
+ 		.depth		= 8,
+-		.csi_dt		= 0x2a,
++		.csi_dt		= MIPI_CSI2_DT_RAW8,
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_Y10P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_Y10,
+ 		.code		= MEDIA_BUS_FMT_Y10_1X10,
+ 		.depth		= 10,
+-		.csi_dt		= 0x2b,
++		.csi_dt		= MIPI_CSI2_DT_RAW10,
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		/* NB There is no packed V4L2 fourcc for this format. */
+ 		.repacked_fourcc = V4L2_PIX_FMT_Y12,
+ 		.code		= MEDIA_BUS_FMT_Y12_1X12,
+ 		.depth		= 12,
+-		.csi_dt		= 0x2c,
++		.csi_dt		= MIPI_CSI2_DT_RAW12,
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	},
+ 	/* Embedded data format */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0307-media-bcm2835-unicam-Add-support-for-RAW16-formats.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0307-media-bcm2835-unicam-Add-support-for-RAW16-formats.patch
new file mode 100644
index 00000000..067a2b9f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0307-media-bcm2835-unicam-Add-support-for-RAW16-formats.patch
@@ -0,0 +1,64 @@
+From 6909a349d65624ce9b187a16b5594e567150d679 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 20 Jan 2023 11:56:54 +0000
+Subject: [PATCH 307/697] media: bcm2835-unicam: Add support for RAW16 formats
+
+With the RAW16 formats now having a defined CSI2 data type ID,
+they can be added to the driver.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../media/platform/bcm2835/bcm2835-unicam.c   | 35 ++++++++++++++++---
+ 1 file changed, 30 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -401,11 +401,30 @@ static const struct unicam_fmt formats[]
+ 		.csi_dt		= MIPI_CSI2_DT_RAW14,
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+-	/*
+-	 * 16 bit Bayer formats could be supported, but there is no CSI2
+-	 * data_type defined for raw 16, and no sensors that produce it at
+-	 * present.
+-	 */
++		.fourcc		= V4L2_PIX_FMT_SBGGR16,
++		.code		= MEDIA_BUS_FMT_SBGGR16_1X16,
++		.depth		= 16,
++		.csi_dt		= MIPI_CSI2_DT_RAW16,
++		.valid_colorspaces = MASK_CS_RAW,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SGBRG16,
++		.code		= MEDIA_BUS_FMT_SGBRG16_1X16,
++		.depth		= 16,
++		.csi_dt		= MIPI_CSI2_DT_RAW16,
++		.valid_colorspaces = MASK_CS_RAW,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SGRBG16,
++		.code		= MEDIA_BUS_FMT_SGRBG16_1X16,
++		.depth		= 16,
++		.csi_dt		= MIPI_CSI2_DT_RAW16,
++		.valid_colorspaces = MASK_CS_RAW,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_SRGGB16,
++		.code		= MEDIA_BUS_FMT_SRGGB16_1X16,
++		.depth		= 16,
++		.csi_dt		= MIPI_CSI2_DT_RAW16,
++		.valid_colorspaces = MASK_CS_RAW,
++	}, {
+ 
+ 	/* Greyscale formats */
+ 		.fourcc		= V4L2_PIX_FMT_GREY,
+@@ -427,6 +446,12 @@ static const struct unicam_fmt formats[]
+ 		.depth		= 12,
+ 		.csi_dt		= MIPI_CSI2_DT_RAW12,
+ 		.valid_colorspaces = MASK_CS_RAW,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_Y16,
++		.code		= MEDIA_BUS_FMT_Y16_1X16,
++		.depth		= 16,
++		.csi_dt		= MIPI_CSI2_DT_RAW16,
++		.valid_colorspaces = MASK_CS_RAW,
+ 	},
+ 	/* Embedded data format */
+ 	{
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0308-iio-adc-mcp3422-Add-correct-compatible-strings.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0308-iio-adc-mcp3422-Add-correct-compatible-strings.patch
new file mode 100644
index 00000000..e04eb71e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0308-iio-adc-mcp3422-Add-correct-compatible-strings.patch
@@ -0,0 +1,28 @@
+From 161876a30365e350611cf25c49718c7809644557 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 6 Mar 2023 20:04:34 +0000
+Subject: [PATCH 308/697] iio: adc: mcp3422: Add correct compatible strings
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/iio/adc/mcp3422.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/adc/mcp3422.c
++++ b/drivers/iio/adc/mcp3422.c
+@@ -407,7 +407,14 @@ static const struct i2c_device_id mcp342
+ MODULE_DEVICE_TABLE(i2c, mcp3422_id);
+ 
+ static const struct of_device_id mcp3422_of_match[] = {
+-	{ .compatible = "mcp3422" },
++	{ .compatible = "microchip,mcp3421" },
++	{ .compatible = "microchip,mcp3422" },
++	{ .compatible = "microchip,mcp3423" },
++	{ .compatible = "microchip,mcp3424" },
++	{ .compatible = "microchip,mcp3425" },
++	{ .compatible = "microchip,mcp3426" },
++	{ .compatible = "microchip,mcp3427" },
++	{ .compatible = "microchip,mcp3428" },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(of, mcp3422_of_match);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0309-gpio-pca953x-Add-ti-tca9554-compatible-string.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0309-gpio-pca953x-Add-ti-tca9554-compatible-string.patch
new file mode 100644
index 00000000..e568b41a
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0309-gpio-pca953x-Add-ti-tca9554-compatible-string.patch
@@ -0,0 +1,20 @@
+From ef4f763ed8224efcaa5a09a7b304f3ab3c1bd5cc Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 6 Mar 2023 21:04:05 +0000
+Subject: [PATCH 309/697] gpio: pca953x: Add ti,tca9554 compatible string
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/gpio/gpio-pca953x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -1318,6 +1318,7 @@ static const struct of_device_id pca953x
+ 	{ .compatible = "ti,tca9535", .data = OF_953X(16, PCA_INT), },
+ 	{ .compatible = "ti,tca9538", .data = OF_953X( 8, PCA_INT), },
+ 	{ .compatible = "ti,tca9539", .data = OF_953X(16, PCA_INT), },
++	{ .compatible = "ti,tca9554", .data = OF_953X( 8, PCA_INT), },
+ 
+ 	{ .compatible = "onnn,cat9554", .data = OF_953X( 8, PCA_INT), },
+ 	{ .compatible = "onnn,pca9654", .data = OF_953X( 8, PCA_INT), },
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0310-hwmon-aht10-Add-DT-compatible-string.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0310-hwmon-aht10-Add-DT-compatible-string.patch
new file mode 100644
index 00000000..720785d0
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0310-hwmon-aht10-Add-DT-compatible-string.patch
@@ -0,0 +1,33 @@
+From e6734918e4b4ea0a66db495ff33b35536025ac5f Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 7 Mar 2023 11:52:36 +0000
+Subject: [PATCH 310/697] hwmon: (aht10): Add DT compatible string
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/hwmon/aht10.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/hwmon/aht10.c
++++ b/drivers/hwmon/aht10.c
+@@ -57,6 +57,12 @@ static const struct i2c_device_id aht10_
+ };
+ MODULE_DEVICE_TABLE(i2c, aht10_id);
+ 
++static const struct of_device_id aht10_of_id[] = {
++	{ .compatible = "aosong,aht10", },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, aht10_of_id);
++
+ /**
+  *   struct aht10_data - All the data required to operate an AHT10/AHT20 chip
+  *   @client: the i2c client associated with the AHT10/AHT20
+@@ -380,6 +386,7 @@ static int aht10_probe(struct i2c_client
+ static struct i2c_driver aht10_driver = {
+ 	.driver = {
+ 		.name = "aht10",
++		.of_match_table = aht10_of_id,
+ 	},
+ 	.probe      = aht10_probe,
+ 	.id_table   = aht10_id,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0311-hwmon-ds1621-Add-DT-compatible-strings.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0311-hwmon-ds1621-Add-DT-compatible-strings.patch
new file mode 100644
index 00000000..882eaf02
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0311-hwmon-ds1621-Add-DT-compatible-strings.patch
@@ -0,0 +1,29 @@
+From 24e6696900f74b4de806f7f092c99e31cdf30d38 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 7 Mar 2023 12:12:36 +0000
+Subject: [PATCH 311/697] hwmon: (ds1621) Add DT compatible strings
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/hwmon/ds1621.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/hwmon/ds1621.c
++++ b/drivers/hwmon/ds1621.c
+@@ -376,6 +376,16 @@ static const struct i2c_device_id ds1621
+ };
+ MODULE_DEVICE_TABLE(i2c, ds1621_id);
+ 
++static const struct of_device_id ds1621_of_ids[] = {
++	{ .compatible = "dallas,ds1621", },
++	{ .compatible = "dallas,ds1625", },
++	{ .compatible = "dallas,ds1631", },
++	{ .compatible = "dallas,ds1721", },
++	{ .compatible = "dallas,ds1731", },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, ds1621_of_ids);
++
+ /* This is the driver that will be inserted */
+ static struct i2c_driver ds1621_driver = {
+ 	.driver = {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0312-rtc-ds3232-Add-DT-compatible-string-for-ds3234.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0312-rtc-ds3232-Add-DT-compatible-string-for-ds3234.patch
new file mode 100644
index 00000000..67c343bd
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0312-rtc-ds3232-Add-DT-compatible-string-for-ds3234.patch
@@ -0,0 +1,29 @@
+From 9d694a218f041ee887245eed41d0fb7fee43e8da Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 7 Mar 2023 20:51:53 +0000
+Subject: [PATCH 312/697] rtc: ds3232: Add DT compatible string for ds3234
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/rtc/rtc-ds3232.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/rtc/rtc-ds3232.c
++++ b/drivers/rtc/rtc-ds3232.c
+@@ -701,9 +701,16 @@ static int ds3234_probe(struct spi_devic
+ 	return ds3232_probe(&spi->dev, regmap, spi->irq, "ds3234");
+ }
+ 
++static const  __maybe_unused struct of_device_id ds3234_of_match[] = {
++	{ .compatible = "dallas,ds3234" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, ds3234_of_match);
++
+ static struct spi_driver ds3234_driver = {
+ 	.driver = {
+ 		.name	 = "ds3234",
++		.of_match_table = of_match_ptr(ds3234_of_match),
+ 	},
+ 	.probe	 = ds3234_probe,
+ };
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0313-hwmon-sht3x-Add-DT-compatible-string.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0313-hwmon-sht3x-Add-DT-compatible-string.patch
new file mode 100644
index 00000000..95a30ad4
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0313-hwmon-sht3x-Add-DT-compatible-string.patch
@@ -0,0 +1,40 @@
+From b39654d5a2f057c607da111ca3be1005de5a2c09 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 7 Mar 2023 21:47:58 +0000
+Subject: [PATCH 313/697] hwmon: (sht3x) Add DT compatible string
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/hwmon/sht3x.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/hwmon/sht3x.c
++++ b/drivers/hwmon/sht3x.c
+@@ -954,19 +954,19 @@ static int sht3x_probe(struct i2c_client
+ 	return PTR_ERR_OR_ZERO(hwmon_dev);
+ }
+ 
+-/* device ID table */
+-static const struct i2c_device_id sht3x_ids[] = {
+-	{"sht3x", sht3x},
+-	{"sts3x", sts3x},
++static const struct of_device_id sht3x_of_ids[] = {
++	{ .compatible = "sensirion,sht3x" },
++	{ .compatible = "sensirion,sts3x" },
+ 	{}
+ };
+-
+-MODULE_DEVICE_TABLE(i2c, sht3x_ids);
++MODULE_DEVICE_TABLE(of, sht3x_of_ids);
+ 
+ static struct i2c_driver sht3x_i2c_driver = {
+-	.driver.name = "sht3x",
++	.driver = {
++		.name = "sht3x",
++		.of_match_table = sht3x_of_ids,
++	},
+ 	.probe       = sht3x_probe,
+-	.id_table    = sht3x_ids,
+ };
+ 
+ static int __init sht3x_init(void)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0314-iio-light-tsl4531-Add-DT-compatible-string.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0314-iio-light-tsl4531-Add-DT-compatible-string.patch
new file mode 100644
index 00000000..659d77ed
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0314-iio-light-tsl4531-Add-DT-compatible-string.patch
@@ -0,0 +1,29 @@
+From cb52d75ba1159400c4b8a3a577a31e962cedb6ab Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 7 Mar 2023 21:48:54 +0000
+Subject: [PATCH 314/697] iio: light: tsl4531: Add DT compatible string
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/iio/light/tsl4531.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/iio/light/tsl4531.c
++++ b/drivers/iio/light/tsl4531.c
+@@ -232,9 +232,16 @@ static const struct i2c_device_id tsl453
+ };
+ MODULE_DEVICE_TABLE(i2c, tsl4531_id);
+ 
++static const struct of_device_id tsl4531_of_id[] = {
++	{ .compatible = "amstaos,tsl4531" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, tsl4531_of_id);
++
+ static struct i2c_driver tsl4531_driver = {
+ 	.driver = {
+ 		.name   = TSL4531_DRV_NAME,
++		.of_match_table = tsl4531_of_id,
+ 		.pm	= pm_sleep_ptr(&tsl4531_pm_ops),
+ 	},
+ 	.probe = tsl4531_probe,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0315-iio-light-veml6070-Add-DT-compatible-string.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0315-iio-light-veml6070-Add-DT-compatible-string.patch
new file mode 100644
index 00000000..1a637c26
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0315-iio-light-veml6070-Add-DT-compatible-string.patch
@@ -0,0 +1,29 @@
+From cf3f4310821d52f3ecc62359d9b82eaec19421f9 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 7 Mar 2023 21:49:30 +0000
+Subject: [PATCH 315/697] iio: light: veml6070: Add DT compatible string
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/iio/light/veml6070.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/iio/light/veml6070.c
++++ b/drivers/iio/light/veml6070.c
+@@ -194,9 +194,16 @@ static const struct i2c_device_id veml60
+ };
+ MODULE_DEVICE_TABLE(i2c, veml6070_id);
+ 
++static const struct of_device_id veml6070_of_id[] = {
++	{ .compatible = "vishay,veml6070" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, veml6070_of_id);
++
+ static struct i2c_driver veml6070_driver = {
+ 	.driver = {
+ 		.name   = VEML6070_DRV_NAME,
++		.of_match_table = veml6070_of_id,
+ 	},
+ 	.probe = veml6070_probe,
+ 	.remove  = veml6070_remove,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0316-media-i2c-imx219-Correct-the-minimum-vblanking-value.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0316-media-i2c-imx219-Correct-the-minimum-vblanking-value.patch
new file mode 100644
index 00000000..19d05ea5
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0316-media-i2c-imx219-Correct-the-minimum-vblanking-value.patch
@@ -0,0 +1,26 @@
+From 16d33aa52c6cac55a39989c095e4dc444967c6ed Mon Sep 17 00:00:00 2001
+From: David Plowman <david.plowman@raspberrypi.com>
+Date: Tue, 25 Jan 2022 15:48:53 +0000
+Subject: [PATCH 316/697] media: i2c: imx219: Correct the minimum vblanking
+ value
+
+The datasheet for this sensor documents the minimum vblanking as being
+32 lines. It does fix some problems with occasional black lines at the
+bottom of images (tested on Raspberry Pi).
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+---
+ drivers/media/i2c/imx219.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/imx219.c
++++ b/drivers/media/i2c/imx219.c
+@@ -74,7 +74,7 @@
+ #define IMX219_REG_VTS			CCI_REG16(0x0160)
+ #define IMX219_VTS_MAX			0xffff
+ 
+-#define IMX219_VBLANK_MIN		4
++#define IMX219_VBLANK_MIN		32
+ 
+ /* HBLANK control - read only */
+ #define IMX219_PPL_DEFAULT		3448
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0317-hwrng-bcm2835-sleep-more-intelligently.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0317-hwrng-bcm2835-sleep-more-intelligently.patch
new file mode 100644
index 00000000..0b1ced56
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0317-hwrng-bcm2835-sleep-more-intelligently.patch
@@ -0,0 +1,66 @@
+From bf5e1a5355432aad0e76225cb79ca3444f07a61d Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 22 Mar 2023 15:30:38 +0000
+Subject: [PATCH 317/697] hwrng: bcm2835 - sleep more intelligently
+
+While waiting for random data, use sleeps that are proportional
+to the amount of data expected. Prevent indefinite waits by
+giving up if nothing is received for a second.
+
+See: https://github.com/raspberrypi/linux/issues/5390
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/char/hw_random/bcm2835-rng.c | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+--- a/drivers/char/hw_random/bcm2835-rng.c
++++ b/drivers/char/hw_random/bcm2835-rng.c
+@@ -13,6 +13,7 @@
+ #include <linux/printk.h>
+ #include <linux/clk.h>
+ #include <linux/reset.h>
++#include <linux/delay.h>
+ 
+ #define RNG_CTRL	0x0
+ #define RNG_STATUS	0x4
+@@ -27,6 +28,9 @@
+ 
+ #define RNG_INT_OFF	0x1
+ 
++#define RNG_FIFO_WORDS	4
++#define RNG_US_PER_WORD	34 /* Tuned for throughput */
++
+ struct bcm2835_rng_priv {
+ 	struct hwrng rng;
+ 	void __iomem *base;
+@@ -63,19 +67,23 @@ static inline void rng_writel(struct bcm
+ static int bcm2835_rng_read(struct hwrng *rng, void *buf, size_t max,
+ 			       bool wait)
+ {
++	u32 retries = 1000000/(RNG_FIFO_WORDS * RNG_US_PER_WORD);
+ 	struct bcm2835_rng_priv *priv = to_rng_priv(rng);
+ 	u32 max_words = max / sizeof(u32);
+ 	u32 num_words, count;
+ 
+-	while ((rng_readl(priv, RNG_STATUS) >> 24) == 0) {
+-		if (!wait)
++	num_words = rng_readl(priv, RNG_STATUS) >> 24;
++
++	while (!num_words) {
++		if (!wait || !retries)
+ 			return 0;
+-		hwrng_yield(rng);
++		retries--;
++		usleep_range((u32)RNG_US_PER_WORD,
++			     (u32)RNG_US_PER_WORD * RNG_FIFO_WORDS);
++		num_words = rng_readl(priv, RNG_STATUS) >> 24;
+ 	}
+ 
+-	num_words = rng_readl(priv, RNG_STATUS) >> 24;
+-	if (num_words > max_words)
+-		num_words = max_words;
++	num_words = min(num_words, max_words);
+ 
+ 	for (count = 0; count < num_words; count++)
+ 		((u32 *)buf)[count] = rng_readl(priv, RNG_DATA);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0318-fbdev-Don-t-cancel-deferred-work-if-pagelist-empty.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0318-fbdev-Don-t-cancel-deferred-work-if-pagelist-empty.patch
new file mode 100644
index 00000000..ea101d45
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0318-fbdev-Don-t-cancel-deferred-work-if-pagelist-empty.patch
@@ -0,0 +1,36 @@
+From 17a714719c853c9d2a96fcd4bf7bfff049ec93e4 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 29 Mar 2023 09:49:36 +0100
+Subject: [PATCH 318/697] fbdev: Don't cancel deferred work if pagelist empty
+
+Since [1], the fbdev deferred IO framework is careful to cancel
+pending updates on close to prevent dirty pages being accessed after
+they may have been reused. However, this is not necessary in the case
+that the pagelist is empty, and drivers that don't make use of the
+pagelist may have wanted updates cancelled for no good reason.
+
+Avoid penalising fbdev drivers that don't make use of the pagelist by
+making the cancelling of deferred IO on close conditional on there
+being a non-empty pagelist.
+
+See: https://github.com/raspberrypi/linux/issues/5398
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+[1] 3efc61d95259 ("fbdev: Fix invalid page access after closing deferred I/O devices")
+---
+ drivers/video/fbdev/core/fb_defio.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/video/fbdev/core/fb_defio.c
++++ b/drivers/video/fbdev/core/fb_defio.c
+@@ -346,7 +346,8 @@ static void fb_deferred_io_lastclose(str
+ {
+ 	unsigned long i;
+ 
+-	flush_delayed_work(&info->deferred_work);
++	if (!list_empty(&info->fbdefio->pagereflist))
++		flush_delayed_work(&info->deferred_work);
+ 
+ 	/* clear out the mapping that we setup */
+ 	for (i = 0; i < info->npagerefs; ++i)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0319-dt-bindings-media-i2c-Replace-IMX708-sensor-binding-.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0319-dt-bindings-media-i2c-Replace-IMX708-sensor-binding-.patch
new file mode 100644
index 00000000..9605b9ea
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0319-dt-bindings-media-i2c-Replace-IMX708-sensor-binding-.patch
@@ -0,0 +1,282 @@
+From af97bf8c80d27e6801c565f335c79d1fd0f8529e Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Fri, 31 Mar 2023 11:52:25 +0100
+Subject: [PATCH 319/697] dt-bindings: media: i2c: Replace IMX708 sensor
+ binding documentation file
+
+Replace the existing imx708.yaml file with sony,imx708.yaml that follows
+the latest devicetree conventions for camera sensors.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../devicetree/bindings/media/i2c/imx708.yaml | 119 ----------------
+ .../bindings/media/i2c/sony,imx708.yaml       | 128 ++++++++++++++++++
+ MAINTAINERS                                   |   2 +-
+ 3 files changed, 129 insertions(+), 120 deletions(-)
+ delete mode 100644 Documentation/devicetree/bindings/media/i2c/imx708.yaml
+ create mode 100644 Documentation/devicetree/bindings/media/i2c/sony,imx708.yaml
+
+--- a/Documentation/devicetree/bindings/media/i2c/imx708.yaml
++++ /dev/null
+@@ -1,119 +0,0 @@
+-# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+-%YAML 1.2
+----
+-$id: http://devicetree.org/schemas/media/i2c/imx708.yaml#
+-$schema: http://devicetree.org/meta-schemas/core.yaml#
+-
+-title: Sony 1/2.3-Inch 12Mpixel CMOS Digital Image Sensor
+-
+-maintainers:
+-  - Naushir Patuck <naush@raspberypi.com>
+-
+-description: |-
+-  The Sony IMX708 is a 1/2.3-inch CMOS active pixel digital image sensor
+-  with an active array size of 4608H x 2592V. It is programmable through
+-  I2C interface. The I2C address is fixed to 0x1A as per sensor data sheet.
+-  Image data is sent through MIPI CSI-2, which is configured as either 2 or
+-  4 data lanes.
+-
+-properties:
+-  compatible:
+-    const: sony,imx708
+-
+-  reg:
+-    description: I2C device address
+-    maxItems: 1
+-
+-  clocks:
+-    maxItems: 1
+-
+-  VDIG-supply:
+-    description:
+-      Digital I/O voltage supply, 1.1 volts
+-
+-  VANA1-supply:
+-    description:
+-      Analog1 voltage supply, 2.8 volts
+-
+-  VANA2-supply:
+-    description:
+-      Analog2 voltage supply, 1.8 volts
+-
+-  VDDL-supply:
+-    description:
+-      Digital core voltage supply, 1.8 volts
+-
+-  reset-gpios:
+-    description: |-
+-      Reference to the GPIO connected to the xclr pin, if any.
+-      Must be released (set high) after all supplies and INCK are applied.
+-
+-  # See ../video-interfaces.txt for more details
+-  port:
+-    type: object
+-    properties:
+-      endpoint:
+-        type: object
+-        properties:
+-          data-lanes:
+-            description: |-
+-              The sensor supports either two-lane, or four-lane operation.
+-              For two-lane operation the property must be set to <1 2>.
+-            items:
+-              - const: 1
+-              - const: 2
+-
+-          clock-noncontinuous:
+-            type: boolean
+-            description: |-
+-              MIPI CSI-2 clock is non-continuous if this property is present,
+-              otherwise it's continuous.
+-
+-          link-frequencies:
+-            allOf:
+-              - $ref: /schemas/types.yaml#/definitions/uint64-array
+-            description:
+-              Allowed data bus frequencies.
+-
+-        required:
+-          - link-frequencies
+-
+-required:
+-  - compatible
+-  - reg
+-  - clocks
+-  - VANA1-supply
+-  - VANA2-supply
+-  - VDIG-supply
+-  - VDDL-supply
+-  - port
+-
+-additionalProperties: false
+-
+-examples:
+-  - |
+-    i2c0 {
+-        #address-cells = <1>;
+-        #size-cells = <0>;
+-
+-        imx708: sensor@1a {
+-            compatible = "sony,imx708";
+-            reg = <0x1a>;
+-            clocks = <&imx708_clk>;
+-            VANA1-supply = <&imx708_vana1>; /* 1.8v */
+-            VANA2-supply = <&imx708_vana2>; /* 2.8v */
+-            VDIG-supply = <&imx708_vdig>;   /* 1.1v */
+-            VDDL-supply = <&imx708_vddl>;   /* 1.8v */
+-
+-            port {
+-                imx708_0: endpoint {
+-                    remote-endpoint = <&csi1_ep>;
+-                    data-lanes = <1 2>;
+-                    clock-noncontinuous;
+-                    link-frequencies = /bits/ 64 <450000000>;
+-                };
+-            };
+-        };
+-    };
+-
+-...
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/i2c/sony,imx708.yaml
+@@ -0,0 +1,128 @@
++# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/media/i2c/sony,imx708.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Sony 1/2.3-Inch 12Mpixel CMOS Digital Image Sensor
++
++maintainers:
++  - Raspberry Pi Kernel Maintenance <kernel-list@raspberrypi.com>
++
++description: |-
++  The Sony IMX708 is a 1/2.3-inch CMOS active pixel digital image sensor
++  with an active array size of 4608H x 2592V. It is programmable through
++  I2C interface. The I2C address is fixed to 0x1A as per sensor data sheet.
++  Image data is sent through MIPI CSI-2, which is configured as either 2 or
++  4 data lanes.
++
++properties:
++  compatible:
++    const: sony,imx708
++
++  reg:
++    maxItems: 1
++
++  clocks:
++    maxItems: 1
++
++  clock-names:
++    description: Input clock (6 to 27 MHz)
++    items:
++      - const: inck
++
++  vdig-supply:
++    description:
++      Digital I/O voltage supply, 1.1 volts
++
++  vana1-supply:
++    description:
++      Analog1 voltage supply, 2.8 volts
++
++  vana2-supply:
++    description:
++      Analog2 voltage supply, 1.8 volts
++
++  vddl-supply:
++    description:
++      Digital core voltage supply, 1.8 volts
++
++  reset-gpios:
++    description: Sensor reset (XCLR) GPIO
++    maxItems: 1
++
++  port:
++    $ref: /schemas/graph.yaml#/$defs/port-base
++    description: |
++      Video output port
++
++    properties:
++      endpoint:
++        $ref: /schemas/media/video-interfaces.yaml#
++        unevaluatedProperties: false
++
++        properties:
++          data-lanes:
++            anyOf:
++              - items:
++                  - const: 1
++                  - const: 2
++              - items:
++                  - const: 1
++                  - const: 2
++                  - const: 3
++                  - const: 4
++
++          link-frequencies: true
++
++        required:
++          - data-lanes
++          - link-frequencies
++
++    additionalProperties: false
++
++required:
++  - compatible
++  - reg
++  - clocks
++  - clock-names
++  - vdig-supply
++  - vana1-supply
++  - vana2-supply
++  - vddl-supply
++  - port
++
++additionalProperties: false
++
++examples:
++  - |
++    #include <dt-bindings/gpio/gpio.h>
++
++    i2c {
++        #address-cells = <1>;
++        #size-cells = <0>;
++
++        imx708: camera-sensor@1a {
++            compatible = "sony,imx708";
++            reg = <0x1a>;
++
++            clocks = <&clk 90>;
++            clock-names = "inck";
++
++            vdig-supply = <&camera_vdig>;
++            vana1-supply = <&camera_vana1>;
++            vana2-supply = <&camera_vana2>;
++            vddl-supply = <&camera_vddl>;
++
++            reset-gpios = <&gpio 35 GPIO_ACTIVE_LOW>;
++
++            port {
++                imx708_ep: endpoint {
++                    data-lanes = <1 2>;
++                    link-frequencies = /bits/ 64 <450000000>;
++                    remote-endpoint = <&csi_ep>;
++                };
++            };
++        };
++    };
++...
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -21594,7 +21594,7 @@ M:	Raspberry Pi Kernel Maintenance <kern
+ L:	linux-media@vger.kernel.org
+ S:	Maintained
+ T:	git git://linuxtv.org/media_tree.git
+-F:	Documentation/devicetree/bindings/media/i2c/imx708.yaml
++F:	Documentation/devicetree/bindings/media/i2c/sony,imx708.yaml
+ F:	drivers/media/i2c/imx708.c
+ 
+ SONY MEMORYSTICK SUBSYSTEM
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0320-media-bcm2835-unicam-Start-and-stop-media_pipeline-w.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0320-media-bcm2835-unicam-Start-and-stop-media_pipeline-w.patch
new file mode 100644
index 00000000..eef8bff3
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0320-media-bcm2835-unicam-Start-and-stop-media_pipeline-w.patch
@@ -0,0 +1,43 @@
+From 849b36b3a3d292d3279c9a8c3e4c88ba8eb27ce3 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 28 Mar 2023 13:43:43 +0100
+Subject: [PATCH 320/697] media: bcm2835-unicam: Start and stop media_pipeline
+ with same node
+
+media_pipeline_start and media_pipeline_stop now validate that
+the pipeline is being started and stopped with the same pipe
+and pad handles.
+When running with embedded metadata (eg imx477 and imx708), the
+start typically happens from the metadata pad, whilst stop is
+always from the image pad.
+
+Always pass the image pad to media_pipeline_start to ensure
+that the calls are balanced.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -2539,7 +2539,8 @@ static int unicam_start_streaming(struct
+ 		goto err_streaming;
+ 	}
+ 
+-	ret = media_pipeline_start(node->video_dev.entity.pads, &node->pipe);
++	ret = media_pipeline_start(dev->node[IMAGE_PAD].video_dev.entity.pads,
++				   &dev->node[IMAGE_PAD].pipe);
+ 	if (ret < 0) {
+ 		unicam_err(dev, "Failed to start media pipeline: %d\n", ret);
+ 		goto err_pm_put;
+@@ -2633,7 +2634,8 @@ err_vpu_clock:
+ 		unicam_err(dev, "failed to reset the VPU clock\n");
+ 	clk_disable_unprepare(dev->vpu_clock);
+ error_pipeline:
+-	media_pipeline_stop(node->video_dev.entity.pads);
++	if (node->pad_id == IMAGE_PAD)
++		media_pipeline_stop(dev->node[IMAGE_PAD].video_dev.entity.pads);
+ err_pm_put:
+ 	unicam_runtime_put(dev);
+ err_streaming:
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0321-input-goodix-Add-option-to-poll-instead-of-relying-o.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0321-input-goodix-Add-option-to-poll-instead-of-relying-o.patch
new file mode 100644
index 00000000..6827899e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0321-input-goodix-Add-option-to-poll-instead-of-relying-o.patch
@@ -0,0 +1,180 @@
+From f15346d0f92c0d16f4e6f51f852c94bde42c6d1a Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 30 Jan 2023 14:46:16 +0000
+Subject: [PATCH 321/697] input: goodix: Add option to poll instead of relying
+ on IRQ line
+
+The interrupt line from the touch controller is not necessarily
+connected to the SoC, so add the option to poll for touch info.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+input: goodix: Include I2C details in names for the devices
+
+libinput uses the input device name alone. If you have two
+identical input devices, then there is no way to differentiate
+between them, and in the case of touchscreens that means no
+way to associate them with the appropriate display device.
+
+Add the I2C bus and address to the start of the input device
+name so that the name is always unique within the system.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/input/touchscreen/goodix.c | 75 +++++++++++++++++++++++++++---
+ drivers/input/touchscreen/goodix.h |  5 ++
+ 2 files changed, 73 insertions(+), 7 deletions(-)
+
+--- a/drivers/input/touchscreen/goodix.c
++++ b/drivers/input/touchscreen/goodix.c
+@@ -48,6 +48,8 @@
+ #define MAX_CONTACTS_LOC	5
+ #define TRIGGER_LOC		6
+ 
++#define POLL_INTERVAL_MS		17	/* 17ms = 60fps */
++
+ /* Our special handling for GPIO accesses through ACPI is x86 specific */
+ #if defined CONFIG_X86 && defined CONFIG_ACPI
+ #define ACPI_GPIO_SUPPORT
+@@ -513,16 +515,67 @@ static irqreturn_t goodix_ts_irq_handler
+ 	return IRQ_HANDLED;
+ }
+ 
++static void goodix_ts_irq_poll_timer(struct timer_list *t)
++{
++	struct goodix_ts_data *ts = from_timer(ts, t, timer);
++
++	schedule_work(&ts->work_i2c_poll);
++	mod_timer(&ts->timer, jiffies + msecs_to_jiffies(POLL_INTERVAL_MS));
++}
++
++static void goodix_ts_work_i2c_poll(struct work_struct *work)
++{
++	struct goodix_ts_data *ts = container_of(work,
++			struct goodix_ts_data, work_i2c_poll);
++
++	goodix_process_events(ts);
++	goodix_i2c_write_u8(ts->client, GOODIX_READ_COOR_ADDR, 0);
++}
++
++static void goodix_enable_irq(struct goodix_ts_data *ts)
++{
++	if (ts->client->irq) {
++		enable_irq(ts->client->irq);
++	} else {
++		ts->timer.expires = jiffies + msecs_to_jiffies(POLL_INTERVAL_MS);
++		add_timer(&ts->timer);
++	}
++}
++
++static void goodix_disable_irq(struct goodix_ts_data *ts)
++{
++	if (ts->client->irq) {
++		disable_irq(ts->client->irq);
++	} else {
++		del_timer(&ts->timer);
++		cancel_work_sync(&ts->work_i2c_poll);
++	}
++}
++
+ static void goodix_free_irq(struct goodix_ts_data *ts)
+ {
+-	devm_free_irq(&ts->client->dev, ts->client->irq, ts);
++	if (ts->client->irq) {
++		devm_free_irq(&ts->client->dev, ts->client->irq, ts);
++	} else {
++		del_timer(&ts->timer);
++		cancel_work_sync(&ts->work_i2c_poll);
++	}
+ }
+ 
+ static int goodix_request_irq(struct goodix_ts_data *ts)
+ {
+-	return devm_request_threaded_irq(&ts->client->dev, ts->client->irq,
+-					 NULL, goodix_ts_irq_handler,
+-					 ts->irq_flags, ts->client->name, ts);
++	if (ts->client->irq) {
++		return devm_request_threaded_irq(&ts->client->dev, ts->client->irq,
++						 NULL, goodix_ts_irq_handler,
++						 ts->irq_flags, ts->client->name, ts);
++	} else {
++		INIT_WORK(&ts->work_i2c_poll,
++			  goodix_ts_work_i2c_poll);
++		timer_setup(&ts->timer, goodix_ts_irq_poll_timer, 0);
++		if (ts->irq_pin_access_method == IRQ_PIN_ACCESS_NONE)
++			goodix_enable_irq(ts);
++		return 0;
++	}
+ }
+ 
+ static int goodix_check_cfg_8(struct goodix_ts_data *ts, const u8 *cfg, int len)
+@@ -1141,7 +1194,10 @@ static int goodix_configure_dev(struct g
+ 		return -ENOMEM;
+ 	}
+ 
+-	ts->input_dev->name = "Goodix Capacitive TouchScreen";
++	snprintf(ts->name, GOODIX_NAME_MAX_LEN, "%s Goodix Capacitive TouchScreen",
++		 dev_name(&ts->client->dev));
++
++	ts->input_dev->name = ts->name;
+ 	ts->input_dev->phys = "input/ts";
+ 	ts->input_dev->id.bustype = BUS_I2C;
+ 	ts->input_dev->id.vendor = 0x0416;
+@@ -1407,6 +1463,11 @@ static void goodix_ts_remove(struct i2c_
+ {
+ 	struct goodix_ts_data *ts = i2c_get_clientdata(client);
+ 
++	if (!client->irq) {
++		del_timer(&ts->timer);
++		cancel_work_sync(&ts->work_i2c_poll);
++	}
++
+ 	if (ts->load_cfg_from_disk)
+ 		wait_for_completion(&ts->firmware_loading_complete);
+ }
+@@ -1422,7 +1483,7 @@ static int goodix_suspend(struct device
+ 
+ 	/* We need gpio pins to suspend/resume */
+ 	if (ts->irq_pin_access_method == IRQ_PIN_ACCESS_NONE) {
+-		disable_irq(client->irq);
++		goodix_disable_irq(ts);
+ 		return 0;
+ 	}
+ 
+@@ -1466,7 +1527,7 @@ static int goodix_resume(struct device *
+ 	int error;
+ 
+ 	if (ts->irq_pin_access_method == IRQ_PIN_ACCESS_NONE) {
+-		enable_irq(client->irq);
++		goodix_enable_irq(ts);
+ 		return 0;
+ 	}
+ 
+--- a/drivers/input/touchscreen/goodix.h
++++ b/drivers/input/touchscreen/goodix.h
+@@ -57,6 +57,8 @@
+ #define GOODIX_CONFIG_MAX_LENGTH		240
+ #define GOODIX_MAX_KEYS				7
+ 
++#define GOODIX_NAME_MAX_LEN			38
++
+ enum goodix_irq_pin_access_method {
+ 	IRQ_PIN_ACCESS_NONE,
+ 	IRQ_PIN_ACCESS_GPIO,
+@@ -91,6 +93,7 @@ struct goodix_ts_data {
+ 	enum gpiod_flags gpiod_rst_flags;
+ 	char id[GOODIX_ID_MAX_LEN + 1];
+ 	char cfg_name[64];
++	char name[GOODIX_NAME_MAX_LEN];
+ 	u16 version;
+ 	bool reset_controller_at_probe;
+ 	bool load_cfg_from_disk;
+@@ -104,6 +107,8 @@ struct goodix_ts_data {
+ 	u8 main_clk[GOODIX_MAIN_CLK_LEN];
+ 	int bak_ref_len;
+ 	u8 *bak_ref;
++	struct timer_list timer;
++	struct work_struct work_i2c_poll;
+ };
+ 
+ int goodix_i2c_read(struct i2c_client *client, u16 reg, u8 *buf, int len);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0322-serial-8250-Add-NOMSI-bug-for-bcm2835aux.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0322-serial-8250-Add-NOMSI-bug-for-bcm2835aux.patch
new file mode 100644
index 00000000..20ea6966
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0322-serial-8250-Add-NOMSI-bug-for-bcm2835aux.patch
@@ -0,0 +1,103 @@
+From 428474df32a4afb7a3dafeae80fcfeb011f3c134 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 24 Apr 2023 11:48:31 +0100
+Subject: [PATCH 322/697] serial: 8250: Add NOMSI bug for bcm2835aux
+
+The BCM2835 mini-UART has no modem status interrupt, causing all
+transmission to stop, never to use, if a speed change ever happens
+while the CTS signal is high.
+
+Add a simple polling mechanism in order to allow recovery in that
+situation.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/tty/serial/8250/8250.h            |  1 +
+ drivers/tty/serial/8250/8250_bcm2835aux.c |  1 +
+ drivers/tty/serial/8250/8250_core.c       | 15 +++++++++++++++
+ drivers/tty/serial/8250/8250_port.c       |  9 +++++++++
+ 4 files changed, 26 insertions(+)
+
+--- a/drivers/tty/serial/8250/8250.h
++++ b/drivers/tty/serial/8250/8250.h
+@@ -92,6 +92,7 @@ struct serial8250_config {
+ #define UART_BUG_NOMSR	BIT(2)	/* UART has buggy MSR status bits (Au1x00) */
+ #define UART_BUG_THRE	BIT(3)	/* UART has buggy THRE reassertion */
+ #define UART_BUG_TXRACE	BIT(5)	/* UART Tx fails to set remote DR */
++#define UART_BUG_NOMSI	BIT(6)	/* UART has no modem status interrupt */
+ 
+ /* Module parameters */
+ #define UART_NR	CONFIG_SERIAL_8250_NR_UARTS
+--- a/drivers/tty/serial/8250/8250_bcm2835aux.c
++++ b/drivers/tty/serial/8250/8250_bcm2835aux.c
+@@ -101,6 +101,7 @@ static int bcm2835aux_serial_probe(struc
+ 	up.port.flags = UPF_FIXED_PORT | UPF_FIXED_TYPE | UPF_SKIP_TEST | UPF_IOREMAP;
+ 	up.port.rs485_config = serial8250_em485_config;
+ 	up.port.rs485_supported = serial8250_em485_supported;
++	up.bugs |= UART_BUG_NOMSI;
+ 	up.rs485_start_tx = bcm2835aux_rs485_start_tx;
+ 	up.rs485_stop_tx = bcm2835aux_rs485_stop_tx;
+ 
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -212,6 +212,18 @@ static void serial8250_timeout(struct ti
+ 	mod_timer(&up->timer, jiffies + uart_poll_timeout(&up->port));
+ }
+ 
++static void serial8250_cts_poll_timeout(struct timer_list *t)
++{
++	struct uart_8250_port *up = from_timer(up, t, timer);
++	unsigned long flags;
++
++	spin_lock_irqsave(&up->port.lock, flags);
++	serial8250_modem_status(up);
++	spin_unlock_irqrestore(&up->port.lock, flags);
++	if (up->port.hw_stopped)
++		mod_timer(&up->timer, jiffies + 1);
++}
++
+ static void serial8250_backup_timeout(struct timer_list *t)
+ {
+ 	struct uart_8250_port *up = from_timer(up, t, timer);
+@@ -275,6 +287,9 @@ static void univ8250_setup_timer(struct
+ 			  uart_poll_timeout(port) + HZ / 5);
+ 	}
+ 
++	if (up->bugs & UART_BUG_NOMSI)
++		up->timer.function = serial8250_cts_poll_timeout;
++
+ 	/*
+ 	 * If the "interrupt" for this port doesn't correspond with any
+ 	 * hardware interrupt, we use a timer-based system.  The original
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -1510,6 +1510,9 @@ static void serial8250_stop_tx(struct ua
+ 		serial_icr_write(up, UART_ACR, up->acr);
+ 	}
+ 	serial8250_rpm_put(up);
++
++	if (port->hw_stopped && (up->bugs & UART_BUG_NOMSI))
++		mod_timer(&up->timer, jiffies + 1);
+ }
+ 
+ static inline void __start_tx(struct uart_port *port)
+@@ -1623,6 +1626,9 @@ static void serial8250_start_tx(struct u
+ 	/* Port locked to synchronize UART_IER access against the console. */
+ 	lockdep_assert_held_once(&port->lock);
+ 
++	if (up->bugs & UART_BUG_NOMSI)
++		del_timer(&up->timer);
++
+ 	if (!port->x_char && kfifo_is_empty(&port->state->port.xmit_fifo))
+ 		return;
+ 
+@@ -1851,6 +1857,9 @@ unsigned int serial8250_modem_status(str
+ 			uart_handle_cts_change(port, status & UART_MSR_CTS);
+ 
+ 		wake_up_interruptible(&port->state->port.delta_msr_wait);
++	} else if (up->bugs & UART_BUG_NOMSI &&	port->hw_stopped &&
++		   status & UART_MSR_CTS) {
++		uart_handle_cts_change(port, status & UART_MSR_CTS);
+ 	}
+ 
+ 	return status;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0323-Bluetooth-hci_sync-Add-fallback-bd-address-prop.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0323-Bluetooth-hci_sync-Add-fallback-bd-address-prop.patch
new file mode 100644
index 00000000..075c37fa
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0323-Bluetooth-hci_sync-Add-fallback-bd-address-prop.patch
@@ -0,0 +1,40 @@
+From 2e81dce58bb7151806bde4f9cabffbd45aa340f8 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 25 Apr 2023 11:49:41 +0100
+Subject: [PATCH 323/697] Bluetooth: hci_sync: Add fallback-bd-address prop
+
+The kernel Bluetooth framework understands that devices may not
+be programmed with valid Bluetooth addresses. It also has the ability
+to override a Bluetooth address with the value of the local-bd-address
+DT property, but it ignores the validity of the existing address when
+doing so.
+
+Add a new boolean property, fallback-bd-address, which indicates that
+the given local-bd-address property should only be used if the device
+does not already have a valid BDADDR.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ net/bluetooth/hci_sync.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -4861,6 +4861,7 @@ static const struct {
+  */
+ static int hci_dev_setup_sync(struct hci_dev *hdev)
+ {
++	struct fwnode_handle *fwnode = dev_fwnode(hdev->dev.parent);
+ 	int ret = 0;
+ 	bool invalid_bdaddr;
+ 	size_t i;
+@@ -4889,7 +4890,8 @@ static int hci_dev_setup_sync(struct hci
+ 			 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks);
+ 	if (!ret) {
+ 		if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks) &&
+-		    !bacmp(&hdev->public_addr, BDADDR_ANY))
++		    !bacmp(&hdev->public_addr, BDADDR_ANY) &&
++		    (invalid_bdaddr || !fwnode_property_present(fwnode, "fallback-bd-address")))
+ 			hci_dev_get_bd_addr_from_property(hdev);
+ 
+ 		if (invalid_bdaddr && bacmp(&hdev->public_addr, BDADDR_ANY) &&
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0324-Bluetooth-hci_bcm-Add-more-invalid-BDADDRs.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0324-Bluetooth-hci_bcm-Add-more-invalid-BDADDRs.patch
new file mode 100644
index 00000000..299cd469
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0324-Bluetooth-hci_bcm-Add-more-invalid-BDADDRs.patch
@@ -0,0 +1,45 @@
+From fe814ac888bd87fe45be02e227d7feb0b2b3c784 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 6 Apr 2023 10:38:40 +0100
+Subject: [PATCH 324/697] Bluetooth: hci_bcm: Add more invalid BDADDRs
+
+The kernel needs to recognise the default BDADDRs used by the Bluetooth
+modems, so add a few more that we care about.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/bluetooth/btbcm.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/bluetooth/btbcm.c
++++ b/drivers/bluetooth/btbcm.c
+@@ -25,12 +25,15 @@
+ #define BDADDR_BCM20702A1 (&(bdaddr_t) {{0x00, 0x00, 0xa0, 0x02, 0x70, 0x20}})
+ #define BDADDR_BCM2076B1 (&(bdaddr_t) {{0x79, 0x56, 0x00, 0xa0, 0x76, 0x20}})
+ #define BDADDR_BCM43430A0 (&(bdaddr_t) {{0xac, 0x1f, 0x12, 0xa0, 0x43, 0x43}})
+-#define BDADDR_BCM43430A1 (&(bdaddr_t) {{0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa}})
++#define BDADDR_BCM43430A1 (&(bdaddr_t) {{0xac, 0x1f, 0x12, 0xa1, 0x43, 0x43}})
++#define BDADDR_BCM43430B0 (&(bdaddr_t) {{0xac, 0x1f, 0x37, 0xb0, 0x43, 0x43}})
+ #define BDADDR_BCM4324B3 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb3, 0x24, 0x43}})
+ #define BDADDR_BCM4330B1 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb1, 0x30, 0x43}})
+ #define BDADDR_BCM4334B0 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb0, 0x34, 0x43}})
++#define BDADDR_BCM4345C0 (&(bdaddr_t) {{0xac, 0x1f, 0x00, 0xc0, 0x45, 0x43}})
+ #define BDADDR_BCM4345C5 (&(bdaddr_t) {{0xac, 0x1f, 0x00, 0xc5, 0x45, 0x43}})
+ #define BDADDR_BCM43341B (&(bdaddr_t) {{0xac, 0x1f, 0x00, 0x1b, 0x34, 0x43}})
++#define BDADDR_BCM43438 (&(bdaddr_t) {{0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa}})
+ 
+ #define BCM_FW_NAME_LEN			64
+ #define BCM_FW_NAME_COUNT_MAX		4
+@@ -127,9 +130,12 @@ int btbcm_check_bdaddr(struct hci_dev *h
+ 	    !bacmp(&bda->bdaddr, BDADDR_BCM4324B3) ||
+ 	    !bacmp(&bda->bdaddr, BDADDR_BCM4330B1) ||
+ 	    !bacmp(&bda->bdaddr, BDADDR_BCM4334B0) ||
++	    !bacmp(&bda->bdaddr, BDADDR_BCM4345C0) ||
+ 	    !bacmp(&bda->bdaddr, BDADDR_BCM4345C5) ||
+ 	    !bacmp(&bda->bdaddr, BDADDR_BCM43430A0) ||
+ 	    !bacmp(&bda->bdaddr, BDADDR_BCM43430A1) ||
++	    !bacmp(&bda->bdaddr, BDADDR_BCM43430B0) ||
++	    !bacmp(&bda->bdaddr, BDADDR_BCM43438) ||
+ 	    !bacmp(&bda->bdaddr, BDADDR_BCM43341B)) {
+ 		/* Try falling back to BDADDR EFI variable */
+ 		if (btbcm_set_bdaddr_from_efi(hdev) != 0) {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0325-pinctrl-bcm2835-Workaround-for-edge-IRQ-loss.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0325-pinctrl-bcm2835-Workaround-for-edge-IRQ-loss.patch
new file mode 100644
index 00000000..d6182da5
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0325-pinctrl-bcm2835-Workaround-for-edge-IRQ-loss.patch
@@ -0,0 +1,67 @@
+From 5e0c014e13b902cdef27f92ee753119f76361955 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 5 May 2023 11:25:48 +0100
+Subject: [PATCH 325/697] pinctrl: bcm2835: Workaround for edge IRQ loss
+
+It has been observed that edge events can be lost when GPIO edges occur
+close to each other. Investigation suggests this is due to a hardware
+bug, although no mechanism has been identified.
+
+Work around the event loss by moving the IRQ acknowledgement into the
+main ISR, adding missing events by explicit level-change detection.
+
+See: https://forums.raspberrypi.com/viewtopic.php?t=350295
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/pinctrl/bcm/pinctrl-bcm2835.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
++++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+@@ -425,15 +425,32 @@ static void bcm2835_gpio_irq_handle_bank
+ 	unsigned long events;
+ 	unsigned offset;
+ 	unsigned gpio;
++	u32 levs, levs2;
+ 
+ 	events = bcm2835_gpio_rd(pc, GPEDS0 + bank * 4);
++	levs = bcm2835_gpio_rd(pc, GPLEV0 + bank * 4);
+ 	events &= mask;
+ 	events &= pc->enabled_irq_map[bank];
++	bcm2835_gpio_wr(pc, GPEDS0 + bank * 4, events);
++
++retry:
+ 	for_each_set_bit(offset, &events, 32) {
+ 		gpio = (32 * bank) + offset;
+ 		generic_handle_domain_irq(pc->gpio_chip.irq.domain,
+ 					  gpio);
+ 	}
++	events = bcm2835_gpio_rd(pc, GPEDS0 + bank * 4);
++	levs2 = bcm2835_gpio_rd(pc, GPLEV0 + bank * 4);
++
++	events |= levs2 & ~levs & bcm2835_gpio_rd(pc, GPREN0 + bank * 4);
++	events |= ~levs2 & levs & bcm2835_gpio_rd(pc, GPFEN0 + bank * 4);
++	events &= mask;
++	events &= pc->enabled_irq_map[bank];
++	if (events) {
++		bcm2835_gpio_wr(pc, GPEDS0 + bank * 4, events);
++		levs = levs2;
++		goto retry;
++	}
+ }
+ 
+ static void bcm2835_gpio_irq_handler(struct irq_desc *desc)
+@@ -673,11 +690,7 @@ static int bcm2835_gpio_irq_set_type(str
+ 
+ static void bcm2835_gpio_irq_ack(struct irq_data *data)
+ {
+-	struct gpio_chip *chip = irq_data_get_irq_chip_data(data);
+-	struct bcm2835_pinctrl *pc = gpiochip_get_data(chip);
+-	unsigned gpio = irqd_to_hwirq(data);
+-
+-	bcm2835_gpio_set_bit(pc, GPEDS0, gpio);
++	/* Nothing to do - the main interrupt handler includes the ACK */
+ }
+ 
+ static int bcm2835_gpio_irq_set_wake(struct irq_data *data, unsigned int on)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0326-mmc-bcm2835-Use-phys-addresses-for-slave-DMA-config.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0326-mmc-bcm2835-Use-phys-addresses-for-slave-DMA-config.patch
new file mode 100644
index 00000000..ba3f215b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0326-mmc-bcm2835-Use-phys-addresses-for-slave-DMA-config.patch
@@ -0,0 +1,60 @@
+From 617fe1d87962364433f5a5c4e479202fdcd00077 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 11 May 2023 16:25:46 +0100
+Subject: [PATCH 326/697] mmc: bcm2835: Use phys addresses for slave DMA config
+
+Contrary to what struct snd_dmaengine_dai_dma_data suggests, the
+configuration of addresses of DMA slave interfaces should be done in
+CPU physical addresses.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/mmc/host/bcm2835.c | 17 +++--------------
+ 1 file changed, 3 insertions(+), 14 deletions(-)
+
+--- a/drivers/mmc/host/bcm2835.c
++++ b/drivers/mmc/host/bcm2835.c
+@@ -38,7 +38,6 @@
+ #include <linux/io.h>
+ #include <linux/iopoll.h>
+ #include <linux/module.h>
+-#include <linux/of_address.h>
+ #include <linux/of_irq.h>
+ #include <linux/platform_device.h>
+ #include <linux/scatterlist.h>
+@@ -1347,8 +1346,8 @@ static int bcm2835_probe(struct platform
+ 	struct device *dev = &pdev->dev;
+ 	struct clk *clk;
+ 	struct bcm2835_host *host;
++	struct resource *iomem;
+ 	struct mmc_host *mmc;
+-	const __be32 *regaddr_p;
+ 	int ret;
+ 
+ 	dev_dbg(dev, "%s\n", __func__);
+@@ -1361,23 +1360,13 @@ static int bcm2835_probe(struct platform
+ 	host->pdev = pdev;
+ 	spin_lock_init(&host->lock);
+ 
+-	host->ioaddr = devm_platform_ioremap_resource(pdev, 0);
++	host->ioaddr = devm_platform_get_and_ioremap_resource(pdev, 0, &iomem);
+ 	if (IS_ERR(host->ioaddr)) {
+ 		ret = PTR_ERR(host->ioaddr);
+ 		goto err;
+ 	}
+ 
+-	/* Parse OF address directly to get the physical address for
+-	 * DMA to our registers.
+-	 */
+-	regaddr_p = of_get_address(pdev->dev.of_node, 0, NULL, NULL);
+-	if (!regaddr_p) {
+-		dev_err(dev, "Can't get phys address\n");
+-		ret = -EINVAL;
+-		goto err;
+-	}
+-
+-	host->phys_addr = be32_to_cpup(regaddr_p);
++	host->phys_addr = iomem->start;
+ 
+ 	host->dma_chan = NULL;
+ 	host->dma_desc = NULL;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0327-spi-bcm2835-Use-phys-addresses-for-slave-DMA-config.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0327-spi-bcm2835-Use-phys-addresses-for-slave-DMA-config.patch
new file mode 100644
index 00000000..be4ee3b6
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0327-spi-bcm2835-Use-phys-addresses-for-slave-DMA-config.patch
@@ -0,0 +1,86 @@
+From 3234bd4189b44c1a325b70f7fafa2b3be10f492c Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 11 May 2023 16:27:06 +0100
+Subject: [PATCH 327/697] spi: bcm2835: Use phys addresses for slave DMA config
+
+Contrary to what struct snd_dmaengine_dai_dma_data suggests, the
+configuration of addresses of DMA slave interfaces should be done in
+CPU physical addresses.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/spi/spi-bcm2835.c | 22 +++++++---------------
+ 1 file changed, 7 insertions(+), 15 deletions(-)
+
+--- a/drivers/spi/spi-bcm2835.c
++++ b/drivers/spi/spi-bcm2835.c
+@@ -119,6 +119,7 @@ MODULE_PARM_DESC(polling_limit_us,
+  */
+ struct bcm2835_spi {
+ 	void __iomem *regs;
++	phys_addr_t phys_addr;
+ 	struct clk *clk;
+ 	struct gpio_desc *cs_gpio;
+ 	unsigned long clk_hz;
+@@ -891,19 +892,8 @@ static int bcm2835_dma_init(struct spi_c
+ 			    struct bcm2835_spi *bs)
+ {
+ 	struct dma_slave_config slave_config;
+-	const __be32 *addr;
+-	dma_addr_t dma_reg_base;
+ 	int ret;
+ 
+-	/* base address in dma-space */
+-	addr = of_get_address(ctlr->dev.of_node, 0, NULL, NULL);
+-	if (!addr) {
+-		dev_err(dev, "could not get DMA-register address - not using dma mode\n");
+-		/* Fall back to interrupt mode */
+-		return 0;
+-	}
+-	dma_reg_base = be32_to_cpup(addr);
+-
+ 	/* get tx/rx dma */
+ 	ctlr->dma_tx = dma_request_chan(dev, "tx");
+ 	if (IS_ERR(ctlr->dma_tx)) {
+@@ -925,7 +915,7 @@ static int bcm2835_dma_init(struct spi_c
+ 	 * or, in case of an RX-only transfer, cyclically copies from the zero
+ 	 * page to the FIFO using a preallocated, reusable descriptor.
+ 	 */
+-	slave_config.dst_addr = (u32)(dma_reg_base + BCM2835_SPI_FIFO);
++	slave_config.dst_addr = bs->phys_addr + BCM2835_SPI_FIFO;
+ 	slave_config.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+ 
+ 	ret = dmaengine_slave_config(ctlr->dma_tx, &slave_config);
+@@ -964,9 +954,9 @@ static int bcm2835_dma_init(struct spi_c
+ 	 * RX FIFO or, in case of a TX-only transfer, cyclically writes a
+ 	 * precalculated value to the CS register to clear the RX FIFO.
+ 	 */
+-	slave_config.src_addr = (u32)(dma_reg_base + BCM2835_SPI_FIFO);
++	slave_config.src_addr = bs->phys_addr + BCM2835_SPI_FIFO;
+ 	slave_config.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+-	slave_config.dst_addr = (u32)(dma_reg_base + BCM2835_SPI_CS);
++	slave_config.dst_addr = bs->phys_addr + BCM2835_SPI_CS;
+ 	slave_config.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+ 
+ 	ret = dmaengine_slave_config(ctlr->dma_rx, &slave_config);
+@@ -1346,6 +1336,7 @@ static int bcm2835_spi_probe(struct plat
+ {
+ 	struct spi_controller *ctlr;
+ 	struct bcm2835_spi *bs;
++	struct resource *iomem;
+ 	int err;
+ 
+ 	ctlr = devm_spi_alloc_host(&pdev->dev, sizeof(*bs));
+@@ -1369,10 +1360,11 @@ static int bcm2835_spi_probe(struct plat
+ 	bs = spi_controller_get_devdata(ctlr);
+ 	bs->ctlr = ctlr;
+ 
+-	bs->regs = devm_platform_ioremap_resource(pdev, 0);
++	bs->regs = devm_platform_get_and_ioremap_resource(pdev, 0, &iomem);
+ 	if (IS_ERR(bs->regs))
+ 		return PTR_ERR(bs->regs);
+ 
++	bs->phys_addr = iomem->start;
+ 	bs->clk = devm_clk_get_enabled(&pdev->dev, NULL);
+ 	if (IS_ERR(bs->clk))
+ 		return dev_err_probe(&pdev->dev, PTR_ERR(bs->clk),
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0328-i2c-bcm2835-Flush-FIFOs-cleanly-on-error.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0328-i2c-bcm2835-Flush-FIFOs-cleanly-on-error.patch
new file mode 100644
index 00000000..e0d1b38e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0328-i2c-bcm2835-Flush-FIFOs-cleanly-on-error.patch
@@ -0,0 +1,45 @@
+From c5b49edc4be7c76db60fe6d5e602526d0458670e Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 23 May 2023 14:11:52 +0100
+Subject: [PATCH 328/697] i2c-bcm2835: Flush FIFOs cleanly on error
+
+On error condition, note the error return code, but still
+handle the FIFOs in the normal way rather than relying on
+C_CLEAR flushing everything cleanly.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/i2c/busses/i2c-bcm2835.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-bcm2835.c
++++ b/drivers/i2c/busses/i2c-bcm2835.c
+@@ -385,10 +385,8 @@ static irqreturn_t bcm2835_i2c_isr(int t
+ 	bcm2835_debug_add(i2c_dev, val);
+ 
+ 	err = val & (BCM2835_I2C_S_CLKT | BCM2835_I2C_S_ERR);
+-	if (err) {
++	if (err)
+ 		i2c_dev->msg_err = err;
+-		goto complete;
+-	}
+ 
+ 	if (val & BCM2835_I2C_S_DONE) {
+ 		if (!i2c_dev->curr_msg) {
+@@ -400,8 +398,6 @@ static irqreturn_t bcm2835_i2c_isr(int t
+ 
+ 		if ((val & BCM2835_I2C_S_RXD) || i2c_dev->msg_buf_remaining)
+ 			i2c_dev->msg_err = BCM2835_I2C_S_LEN;
+-		else
+-			i2c_dev->msg_err = 0;
+ 		goto complete;
+ 	}
+ 
+@@ -465,6 +461,7 @@ static int bcm2835_i2c_xfer(struct i2c_a
+ 
+ 	i2c_dev->curr_msg = msgs;
+ 	i2c_dev->num_msgs = num;
++	i2c_dev->msg_err = 0;
+ 	reinit_completion(&i2c_dev->completion);
+ 
+ 	bcm2835_i2c_start_transfer(i2c_dev);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0329-i2c-bcm2835-Do-not-abort-transfers-on-ERR-if-still-a.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0329-i2c-bcm2835-Do-not-abort-transfers-on-ERR-if-still-a.patch
new file mode 100644
index 00000000..0421e5fa
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0329-i2c-bcm2835-Do-not-abort-transfers-on-ERR-if-still-a.patch
@@ -0,0 +1,28 @@
+From 41571ae67f0fe5251e85e60ba71c811163130264 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 23 May 2023 14:14:05 +0100
+Subject: [PATCH 329/697] i2c-bcm2835: Do not abort transfers on ERR if still
+ active
+
+If a transaction is aborted immediately on ERR being reported,
+then the bus is not returned to the STOP condition, and devices
+generally get very upset.
+
+Handle the ERR and CLKT conditions only when TA is not set.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/i2c/busses/i2c-bcm2835.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-bcm2835.c
++++ b/drivers/i2c/busses/i2c-bcm2835.c
+@@ -385,7 +385,7 @@ static irqreturn_t bcm2835_i2c_isr(int t
+ 	bcm2835_debug_add(i2c_dev, val);
+ 
+ 	err = val & (BCM2835_I2C_S_CLKT | BCM2835_I2C_S_ERR);
+-	if (err)
++	if (err && !(val & BCM2835_I2C_S_TA))
+ 		i2c_dev->msg_err = err;
+ 
+ 	if (val & BCM2835_I2C_S_DONE) {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0330-i2c-bcm2835-Implement-I2C_M_IGNORE_NAK.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0330-i2c-bcm2835-Implement-I2C_M_IGNORE_NAK.patch
new file mode 100644
index 00000000..a54d77f9
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0330-i2c-bcm2835-Implement-I2C_M_IGNORE_NAK.patch
@@ -0,0 +1,61 @@
+From 94f949c3de106e47be45f997f8c953bef8b1702c Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 23 May 2023 14:31:03 +0100
+Subject: [PATCH 330/697] i2c-bcm2835: Implement I2C_M_IGNORE_NAK
+
+Now that transfers aren't aborted immediately (and uncleanly) on
+errors, and the FIFOs are always drained after all transfers, we
+can implement I2C_M_IGNORE_NAK by ignoring the returned error
+value.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/i2c/busses/i2c-bcm2835.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-bcm2835.c
++++ b/drivers/i2c/busses/i2c-bcm2835.c
+@@ -443,6 +443,7 @@ static int bcm2835_i2c_xfer(struct i2c_a
+ {
+ 	struct bcm2835_i2c_dev *i2c_dev = i2c_get_adapdata(adap);
+ 	unsigned long time_left;
++	bool ignore_nak = false;
+ 	int i;
+ 
+ 	if (debug)
+@@ -452,12 +453,15 @@ static int bcm2835_i2c_xfer(struct i2c_a
+ 		for (i = 0; i < num; i++)
+ 			bcm2835_debug_print_msg(i2c_dev, &msgs[i], i + 1, num, __func__);
+ 
+-	for (i = 0; i < (num - 1); i++)
++	for (i = 0; i < (num - 1); i++) {
+ 		if (msgs[i].flags & I2C_M_RD) {
+ 			dev_warn_once(i2c_dev->dev,
+ 				      "only one read message supported, has to be last\n");
+ 			return -EOPNOTSUPP;
+ 		}
++		if (msgs[i].flags & I2C_M_IGNORE_NAK)
++			ignore_nak = true;
++	}
+ 
+ 	i2c_dev->curr_msg = msgs;
+ 	i2c_dev->num_msgs = num;
+@@ -471,6 +475,9 @@ static int bcm2835_i2c_xfer(struct i2c_a
+ 
+ 	bcm2835_i2c_finish_transfer(i2c_dev);
+ 
++	if (ignore_nak)
++		i2c_dev->msg_err &= ~BCM2835_I2C_S_ERR;
++
+ 	if (debug > 1 || (debug && (!time_left || i2c_dev->msg_err)))
+ 		bcm2835_debug_print(i2c_dev);
+ 	i2c_dev->debug_num_msgs = 0;
+@@ -496,7 +503,7 @@ static int bcm2835_i2c_xfer(struct i2c_a
+ 
+ static u32 bcm2835_i2c_func(struct i2c_adapter *adap)
+ {
+-	return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
++	return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL | I2C_FUNC_PROTOCOL_MANGLING;
+ }
+ 
+ static const struct i2c_algorithm bcm2835_i2c_algo = {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0331-pps-Compatibility-hack-should-be-X86-specific.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0331-pps-Compatibility-hack-should-be-X86-specific.patch
new file mode 100644
index 00000000..98bb8083
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0331-pps-Compatibility-hack-should-be-X86-specific.patch
@@ -0,0 +1,48 @@
+From 7dc4907c9ef0431c3f3e71d9e18a4228bb59fafd Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 22 May 2023 14:22:55 +0100
+Subject: [PATCH 331/697] pps: Compatibility hack should be X86-specific
+
+As of [1], using PPS_FETCH on a 64-bit ARM kernel with a 32-bit userland
+is broken, returning a timeout. This is because the requested 4-byte
+alignment for struct pps_ktime_compat (illegal on arm64) results in the
+timeout flags field being uninitialised.
+
+Make the hack specific to X86_64 builds with CONFIG_COMPAT defined.
+
+[1] commit c2a49fe8eeef ("pps: fix padding issue with PPS_FETCH for
+    ioctl_compat")
+
+See: https://github.com/raspberrypi/linux/issues/5430
+Fixes: c2a49fe8eeef ("pps: fix padding issue with PPS_FETCH for ioctl_compat")
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/pps/pps.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/pps/pps.c
++++ b/drivers/pps/pps.c
+@@ -249,12 +249,13 @@ static long pps_cdev_ioctl(struct file *
+ static long pps_cdev_compat_ioctl(struct file *file,
+ 		unsigned int cmd, unsigned long arg)
+ {
+-	struct pps_device *pps = file->private_data;
+-	void __user *uarg = (void __user *) arg;
+ 
+ 	cmd = _IOC(_IOC_DIR(cmd), _IOC_TYPE(cmd), _IOC_NR(cmd), sizeof(void *));
+ 
++#ifdef CONFIG_X86_64
+ 	if (cmd == PPS_FETCH) {
++		struct pps_device *pps = file->private_data;
++		void __user *uarg = (void __user *) arg;
+ 		struct pps_fdata_compat compat;
+ 		struct pps_fdata fdata;
+ 		int err;
+@@ -289,6 +290,7 @@ static long pps_cdev_compat_ioctl(struct
+ 		return copy_to_user(uarg, &compat,
+ 				sizeof(struct pps_fdata_compat)) ? -EFAULT : 0;
+ 	}
++#endif
+ 
+ 	return pps_cdev_ioctl(file, cmd, arg);
+ }
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0332-serial-sc16is7xx-Read-modem-line-state-at-startup.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0332-serial-sc16is7xx-Read-modem-line-state-at-startup.patch
new file mode 100644
index 00000000..e227136c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0332-serial-sc16is7xx-Read-modem-line-state-at-startup.patch
@@ -0,0 +1,28 @@
+From bff553406ec725908cb6b855fce9771f964fbb57 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 13 Jun 2023 16:12:54 +0100
+Subject: [PATCH 332/697] serial: sc16is7xx: Read modem line state at startup
+
+This patch sets the driver modem line state to the actual line state
+at driver startup.
+
+See: https://github.com/raspberrypi/linux/issues/5501
+
+Signed-off-by: Earl Schmidt <schmidt.earl.f@gmail.com>
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/tty/serial/sc16is7xx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/tty/serial/sc16is7xx.c
++++ b/drivers/tty/serial/sc16is7xx.c
+@@ -1206,6 +1206,9 @@ static int sc16is7xx_startup(struct uart
+ 	      SC16IS7XX_IER_MSI_BIT;
+ 	sc16is7xx_port_write(port, SC16IS7XX_IER_REG, val);
+ 
++	/* Initialize the Modem Control signals to current status */
++	one->old_mctrl = sc16is7xx_get_hwmctrl(port);
++
+ 	/* Enable modem status polling */
+ 	uart_port_lock_irqsave(port, &flags);
+ 	sc16is7xx_enable_ms(port);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0333-drivers-media-bcm2835_unicam-Improve-frame-sequence-.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0333-drivers-media-bcm2835_unicam-Improve-frame-sequence-.patch
new file mode 100644
index 00000000..9cb8a49b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0333-drivers-media-bcm2835_unicam-Improve-frame-sequence-.patch
@@ -0,0 +1,79 @@
+From 5a293e3bdb6a5f3dcbcd8ffd84e8f9c3a8171906 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Fri, 16 Jun 2023 16:24:19 +0100
+Subject: [PATCH 333/697] drivers: media: bcm2835_unicam: Improve frame
+ sequence count handling
+
+Ensure that the frame sequence counter is incremented only if a previous
+frame start interrupt has occurred, or a frame start + frame end has
+occurred simultaneously.
+
+This corresponds the sequence number with the actual number of frames
+produced by the sensor, not the number of frame buffers dequeued back
+to userland.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../media/platform/bcm2835/bcm2835-unicam.c   | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -537,6 +537,7 @@ struct unicam_device {
+ 	/* subdevice async Notifier */
+ 	struct v4l2_async_notifier notifier;
+ 	unsigned int sequence;
++	bool frame_started;
+ 
+ 	/* ptr to  sub device */
+ 	struct v4l2_subdev *sensor;
+@@ -929,6 +930,8 @@ static irqreturn_t unicam_isr(int irq, v
+ 	 * buffer forever.
+ 	 */
+ 	if (fe) {
++		bool inc_seq = unicam->frame_started;
++
+ 		/*
+ 		 * Ensure we have swapped buffers already as we can't
+ 		 * stop the peripheral. If no buffer is available, use a
+@@ -964,11 +967,23 @@ static irqreturn_t unicam_isr(int irq, v
+ 				unicam_process_buffer_complete(node, sequence);
+ 				node->cur_frm = node->next_frm;
+ 				node->next_frm = NULL;
++				inc_seq = true;
+ 			} else {
+ 				node->cur_frm = node->next_frm;
+ 			}
+ 		}
+-		unicam->sequence++;
++
++		/*
++		 * Increment the sequence number conditionally on either a FS
++		 * having already occurred, or in the FE + FS condition as
++		 * caught in the FE handler above. This ensures the sequence
++		 * number corresponds to the frames generated by the sensor, not
++		 * the frames dequeued to userland.
++		 */
++		if (inc_seq) {
++			unicam->sequence++;
++			unicam->frame_started = false;
++		}
+ 	}
+ 
+ 	if (ista & UNICAM_FSI) {
+@@ -1011,6 +1026,7 @@ static irqreturn_t unicam_isr(int irq, v
+ 		}
+ 
+ 		unicam_queue_event_sof(unicam);
++		unicam->frame_started = true;
+ 	}
+ 
+ 	/*
+@@ -2615,6 +2631,7 @@ static int unicam_start_streaming(struct
+ 			vb2_dma_contig_plane_dma_addr(&buf->vb.vb2_buf, 0);
+ 	}
+ 
++	dev->frame_started = false;
+ 	unicam_start_rx(dev, buffer_addr);
+ 
+ 	ret = v4l2_subdev_call(dev->sensor, video, s_stream, 1);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0334-xhci-quirks-add-link-TRB-quirk-for-VL805.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0334-xhci-quirks-add-link-TRB-quirk-for-VL805.patch
new file mode 100644
index 00000000..062e24fa
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0334-xhci-quirks-add-link-TRB-quirk-for-VL805.patch
@@ -0,0 +1,65 @@
+From 80ee0c536cdc4af70d72872b32308a0aac588acd Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Mon, 26 Oct 2020 14:03:35 +0000
+Subject: [PATCH 334/697] xhci: quirks: add link TRB quirk for VL805
+
+The VL805 controller can't cope with the TR Dequeue Pointer for an endpoint
+being set to a Link TRB. The hardware-maintained endpoint context ends up
+stuck at the address of the Link TRB, leading to erroneous ring expansion
+events whenever the enqueue pointer wraps to the dequeue position.
+
+If the search for the end of the current TD and ring cycle state lands on
+a Link TRB, move to the next segment.
+
+Link: https://github.com/raspberrypi/linux/issues/3919
+
+[6.5.y Fixup - move downstream quirk bits further along]
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/host/xhci-pci.c  |  1 +
+ drivers/usb/host/xhci-ring.c | 10 ++++++++++
+ drivers/usb/host/xhci.h      |  3 +++
+ 3 files changed, 14 insertions(+)
+
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -427,6 +427,7 @@ static void xhci_pci_quirks(struct devic
+ 	if (pdev->vendor == PCI_VENDOR_ID_VIA && pdev->device == 0x3483) {
+ 		xhci->quirks |= XHCI_LPM_SUPPORT;
+ 		xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
++		xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
+ 	}
+ 
+ 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -710,6 +710,16 @@ static int xhci_move_dequeue_past_td(str
+ 
+ 	} while (!cycle_found || !td_last_trb_found);
+ 
++	/*
++	 * Quirk: the xHC does not correctly parse link TRBs if the HW Dequeue
++	 * pointer is set to one. Advance to the next TRB (and next segment).
++	 */
++	if (xhci->quirks & XHCI_AVOID_DQ_ON_LINK && trb_is_link(new_deq)) {
++		if (link_trb_toggles_cycle(new_deq))
++			new_cycle ^= 0x1;
++		next_trb(xhci, ep_ring, &new_seg, &new_deq);
++	}
++
+ 	/* Don't update the ring cycle state for the producer (us). */
+ 	addr = xhci_trb_virt_to_dma(new_seg, new_deq);
+ 	if (addr == 0) {
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1627,6 +1627,9 @@ struct xhci_hcd {
+ #define XHCI_CDNS_SCTX_QUIRK	BIT_ULL(48)
+ #define XHCI_ETRON_HOST	BIT_ULL(49)
+ 
++/* Downstream VLI fixes */
++#define XHCI_AVOID_DQ_ON_LINK	BIT_ULL(56)
++
+ 	unsigned int		num_active_eps;
+ 	unsigned int		limit_active_eps;
+ 	struct xhci_port	*hw_ports;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0335-usb-xhci-borrow-upstream-TRB_FETCH-quirk-on-VL805-ho.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0335-usb-xhci-borrow-upstream-TRB_FETCH-quirk-on-VL805-ho.patch
new file mode 100644
index 00000000..f2eb7e47
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0335-usb-xhci-borrow-upstream-TRB_FETCH-quirk-on-VL805-ho.patch
@@ -0,0 +1,32 @@
+From fa3e443aac1ca923b1be4e426e2b5b527f1375a0 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Thu, 13 Jul 2023 15:06:54 +0100
+Subject: [PATCH 335/697] usb: xhci: borrow upstream TRB_FETCH quirk on VL805
+ hosts
+
+This reimplements 5a57342 usb: xhci: add VLI_TRB_CACHE_BUG quirk
+
+The downstream implementation required a fair bit of driver surgery to
+allow for truncated ring segments, which needed to shrink by a small
+amount to avoid the cache prefetcher from reading off the end of one
+segment and into another.
+
+An upstream implementation for a similar bug on a different controller
+just doubles the size of the memory allocated for ring segments, which
+is a bit more wasteful (+4K per allocation) but means less code churn.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/host/xhci-pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -428,6 +428,7 @@ static void xhci_pci_quirks(struct devic
+ 		xhci->quirks |= XHCI_LPM_SUPPORT;
+ 		xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
+ 		xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
++		xhci->quirks |= XHCI_ZHAOXIN_TRB_FETCH;
+ 	}
+ 
+ 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0336-usb-xhci-add-VLI_SS_BULK_OUT_BUG-quirk.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0336-usb-xhci-add-VLI_SS_BULK_OUT_BUG-quirk.patch
new file mode 100644
index 00000000..88874697
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0336-usb-xhci-add-VLI_SS_BULK_OUT_BUG-quirk.patch
@@ -0,0 +1,110 @@
+From 54e6f0f82b8ee925e57c39c90a338bfb45a6c79a Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Thu, 8 Sep 2022 15:50:15 +0100
+Subject: [PATCH 336/697] usb: xhci: add VLI_SS_BULK_OUT_BUG quirk
+
+The VL805 can cause data corruption if a SS Bulk OUT endpoint enters a
+flow-control condition and there are TRBs in the transfer ring that are
+not an integral size of wMaxPacket and the endpoint is behind one or more
+hubs.
+
+This is frequently the case encountered when FAT32 filesystems are
+present on mass-storage devices with cluster sizes of 1 sector, and the
+filesystem is being written to with an aggregate of small files.
+
+The initial implementation of this quirk separated TRBs that didn't
+adhere to this limitation into two - the first a multiple of wMaxPacket
+and the second the 512-byte remainder - in an attempt to force TD
+fragments to align with packet boundaries. This reduced the incidence
+rate of data corruption but did not resolve it.
+
+The fix as recommended by VIA is to disable bursts if this sequence of
+TRBs can occur.
+
+Limit turning off bursts to just USB mass-storage devices by searching
+the device's configuration for an interface with a class type of
+USB_CLASS_MASS_STORAGE.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/host/xhci-mem.c | 31 ++++++++++++++++++++++++++++++-
+ drivers/usb/host/xhci-pci.c |  1 +
+ drivers/usb/host/xhci.h     |  1 +
+ 3 files changed, 32 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1395,6 +1395,7 @@ int xhci_endpoint_init(struct xhci_hcd *
+ 	unsigned int ep_index;
+ 	struct xhci_ep_ctx *ep_ctx;
+ 	struct xhci_ring *ep_ring;
++	struct usb_interface_cache *intfc;
+ 	unsigned int max_packet;
+ 	enum xhci_ring_type ring_type;
+ 	u32 max_esit_payload;
+@@ -1404,6 +1405,8 @@ int xhci_endpoint_init(struct xhci_hcd *
+ 	unsigned int mult;
+ 	unsigned int avg_trb_len;
+ 	unsigned int err_count = 0;
++	unsigned int is_ums_dev = 0;
++	unsigned int i;
+ 
+ 	ep_index = xhci_get_endpoint_index(&ep->desc);
+ 	ep_ctx = xhci_get_ep_ctx(xhci, virt_dev->in_ctx, ep_index);
+@@ -1435,9 +1438,35 @@ int xhci_endpoint_init(struct xhci_hcd *
+ 
+ 	mult = xhci_get_endpoint_mult(udev, ep);
+ 	max_packet = usb_endpoint_maxp(&ep->desc);
+-	max_burst = xhci_get_endpoint_max_burst(udev, ep);
+ 	avg_trb_len = max_esit_payload;
+ 
++	/*
++	 * VL805 errata - Bulk OUT bursts to superspeed mass-storage
++	 * devices behind hub ports can cause data corruption with
++	 * non-wMaxPacket-multiple transfers.
++	 */
++	for (i = 0; i < udev->config->desc.bNumInterfaces; i++) {
++		intfc = udev->config->intf_cache[i];
++		/*
++		 * Slight hack - look at interface altsetting 0, which
++		 * should be the UMS bulk-only interface. If the class
++		 * matches, then we disable out bursts for all OUT
++		 * endpoints because endpoint assignments may change
++		 * between alternate settings.
++		 */
++		if (intfc->altsetting[0].desc.bInterfaceClass ==
++		    USB_CLASS_MASS_STORAGE) {
++			is_ums_dev = 1;
++			break;
++		}
++	}
++	if (xhci->quirks & XHCI_VLI_SS_BULK_OUT_BUG &&
++	    usb_endpoint_is_bulk_out(&ep->desc) && is_ums_dev &&
++	    udev->route)
++		max_burst = 0;
++	else
++		max_burst = xhci_get_endpoint_max_burst(udev, ep);
++
+ 	/* FIXME dig Mult and streams info out of ep companion desc */
+ 
+ 	/* Allow 3 retries for everything but isoc, set CErr = 3 */
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -429,6 +429,7 @@ static void xhci_pci_quirks(struct devic
+ 		xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
+ 		xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
+ 		xhci->quirks |= XHCI_ZHAOXIN_TRB_FETCH;
++		xhci->quirks |= XHCI_VLI_SS_BULK_OUT_BUG;
+ 	}
+ 
+ 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1629,6 +1629,7 @@ struct xhci_hcd {
+ 
+ /* Downstream VLI fixes */
+ #define XHCI_AVOID_DQ_ON_LINK	BIT_ULL(56)
++#define XHCI_VLI_SS_BULK_OUT_BUG	BIT_ULL(57)
+ 
+ 	unsigned int		num_active_eps;
+ 	unsigned int		limit_active_eps;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0337-usb-xhci-add-XHCI_VLI_HUB_TT_QUIRK.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0337-usb-xhci-add-XHCI_VLI_HUB_TT_QUIRK.patch
new file mode 100644
index 00000000..896dffef
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0337-usb-xhci-add-XHCI_VLI_HUB_TT_QUIRK.patch
@@ -0,0 +1,154 @@
+From a1ad48450f85705abf8177751653e85602e3097e Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Thu, 1 Dec 2022 16:59:44 +0000
+Subject: [PATCH 337/697] usb: xhci: add XHCI_VLI_HUB_TT_QUIRK
+
+The integrated USB2.0 hub in the VL805 chipset has a bug where it
+incorrectly determines the remaining available frame time before the
+host next sends a SOF packet with an incremented frame_number.
+
+See the USB2.0 specification sections 11.3 and 11.14.2.3.
+
+The hub's non-periodic TT handler can transmit the IN/OUT handshake
+token too late, so a following 64-byte DATA0/1 packet causes the ACK
+handshake to collide with the propagated SOF. This causes port babble.
+
+Avoid ringing doorbells for vulnerable endpoints during uFrame 7 if the
+TR is Idle to stop one source of babble. An IN transfer for a Running TR
+may happen at any time, so there's not much we can do about that.
+
+Ideally a hub firmware update to properly implement frame timeouts is
+needed, and to avoid spinning for up to 125us when submitting TDs to
+Idle rings.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+xhci: constrain XHCI_VLI_HUB_TT_QUIRK to old firmware versions
+
+VLI have a firmware update for the VL805 which resolves the incorrect
+frame time calculation in the hub's TT. Limit applying the quirk to
+known-bad firmwares.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/host/xhci-pci.c  | 14 +++++++++++
+ drivers/usb/host/xhci-ring.c | 46 ++++++++++++++++++++++++++++++++++++
+ drivers/usb/host/xhci.h      |  1 +
+ 3 files changed, 61 insertions(+)
+
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -27,6 +27,8 @@
+ #define SPARSE_DISABLE_BIT	17
+ #define SPARSE_CNTL_ENABLE	0xC12C
+ 
++#define VL805_FW_VER_0138C0	0x0138C0
++
+ /* Device for a quirk */
+ #define PCI_VENDOR_ID_FRESCO_LOGIC	0x1b73
+ #define PCI_DEVICE_ID_FRESCO_LOGIC_PDK	0x1000
+@@ -242,6 +244,16 @@ static int xhci_pci_reinit(struct xhci_h
+ 	return 0;
+ }
+ 
++static u32 xhci_vl805_get_fw_version(struct pci_dev *dev)
++{
++	int ret;
++	u32 ver;
++
++	ret = pci_read_config_dword(dev, 0x50, &ver);
++	/* Default to a fw version of 0 instead of ~0 */
++	return ret ? 0 : ver;
++}
++
+ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ {
+ 	struct pci_dev                  *pdev = to_pci_dev(dev);
+@@ -430,6 +442,8 @@ static void xhci_pci_quirks(struct devic
+ 		xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
+ 		xhci->quirks |= XHCI_ZHAOXIN_TRB_FETCH;
+ 		xhci->quirks |= XHCI_VLI_SS_BULK_OUT_BUG;
++		if (xhci_vl805_get_fw_version(pdev) < VL805_FW_VER_0138C0)
++			xhci->quirks |= XHCI_VLI_HUB_TT_QUIRK;
+ 	}
+ 
+ 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -3615,6 +3615,48 @@ static int xhci_align_td(struct xhci_hcd
+ 	return 1;
+ }
+ 
++static void xhci_vl805_hub_tt_quirk(struct xhci_hcd *xhci, struct urb *urb,
++				    struct xhci_ring *ring)
++{
++	struct list_head *tmp;
++	struct usb_device *udev = urb->dev;
++	unsigned int timeout = 0;
++	unsigned int single_td = 0;
++
++	/*
++	 * Adding a TD to an Idle ring for a FS nonperiodic endpoint
++	 * that is behind the internal hub's TT will run the risk of causing a
++	 * downstream port babble if submitted late in uFrame 7.
++	 * Wait until we've moved on into at least uFrame 0
++	 * (MFINDEX references the next SOF to be transmitted).
++	 *
++	 * Rings for IN endpoints in the Running state also risk causing
++	 * babble if the returned data is large, but there's not much we can do
++	 * about it here.
++	 */
++	if (udev->route & 0xffff0 || udev->speed != USB_SPEED_FULL)
++		return;
++
++	list_for_each(tmp, &ring->td_list) {
++		single_td++;
++		if (single_td == 2) {
++			single_td = 0;
++			break;
++		}
++	}
++	if (single_td) {
++		while (timeout < 20 &&
++		       (readl(&xhci->run_regs->microframe_index) & 0x7) == 0) {
++			udelay(10);
++			timeout++;
++		}
++		if (timeout >= 20)
++			xhci_warn(xhci, "MFINDEX didn't advance - %u.%u dodged\n",
++				  readl(&xhci->run_regs->microframe_index) >> 3,
++				  readl(&xhci->run_regs->microframe_index) & 7);
++	}
++}
++
+ /* This is very similar to what ehci-q.c qtd_fill() does */
+ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ 		struct urb *urb, int slot_id, unsigned int ep_index)
+@@ -3769,6 +3811,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
+ 	}
+ 
+ 	check_trb_math(urb, enqd_len);
++	if (xhci->quirks & XHCI_VLI_HUB_TT_QUIRK)
++		xhci_vl805_hub_tt_quirk(xhci, urb, ring);
+ 	giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id,
+ 			start_cycle, start_trb);
+ 	return 0;
+@@ -3917,6 +3961,8 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *
+ 			/* Event on completion */
+ 			field | TRB_IOC | TRB_TYPE(TRB_STATUS) | ep_ring->cycle_state);
+ 
++	if (xhci->quirks & XHCI_VLI_HUB_TT_QUIRK)
++		xhci_vl805_hub_tt_quirk(xhci, urb, ep_ring);
+ 	giveback_first_trb(xhci, slot_id, ep_index, 0,
+ 			start_cycle, start_trb);
+ 	return 0;
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1630,6 +1630,7 @@ struct xhci_hcd {
+ /* Downstream VLI fixes */
+ #define XHCI_AVOID_DQ_ON_LINK	BIT_ULL(56)
+ #define XHCI_VLI_SS_BULK_OUT_BUG	BIT_ULL(57)
++#define XHCI_VLI_HUB_TT_QUIRK	BIT_ULL(58)
+ 
+ 	unsigned int		num_active_eps;
+ 	unsigned int		limit_active_eps;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0338-cfg80211-ship-debian-certificates-as-hex-files.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0338-cfg80211-ship-debian-certificates-as-hex-files.patch
new file mode 100644
index 00000000..223ab99c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0338-cfg80211-ship-debian-certificates-as-hex-files.patch
@@ -0,0 +1,1455 @@
+From 7f42ee849684983c9395fb06139c6e35816efd8e Mon Sep 17 00:00:00 2001
+From: Nicolai Buchwitz <n.buchwitz@kunbus.com>
+Date: Wed, 12 Jul 2023 11:30:42 +0200
+Subject: [PATCH 338/697] cfg80211: ship debian certificates as hex files
+
+Loading the regulatory database from the debian files fails with
+
+"loaded regulatory.db is malformed or signature is missing/invalid"
+
+due to missing certificates.  Add these debian-specific certificates
+from upstream to fix this error. See #5536 for details.
+
+The certificates have been imported as following:
+
+patch -p1 <<<$(
+curl https://salsa.debian.org/kernel-team/linux/-/raw/\
+master/debian/patches/debian/\
+wireless-add-debian-wireless-regdb-certificates.patch
+)
+
+Signed-off-by: Nicolai Buchwitz <n.buchwitz@kunbus.com>
+---
+ net/wireless/certs/debian.hex | 1426 +++++++++++++++++++++++++++++++++
+ 1 file changed, 1426 insertions(+)
+ create mode 100644 net/wireless/certs/debian.hex
+
+--- /dev/null
++++ b/net/wireless/certs/debian.hex
+@@ -0,0 +1,1426 @@
++0x30,
++0x82,
++0x02,
++0xbd,
++0x30,
++0x82,
++0x01,
++0xa5,
++0x02,
++0x14,
++0x57,
++0x7e,
++0x02,
++0x1c,
++0xb9,
++0x80,
++0xe0,
++0xe8,
++0x20,
++0x82,
++0x1b,
++0xa7,
++0xb5,
++0x4b,
++0x49,
++0x61,
++0xb8,
++0xb4,
++0xfa,
++0xdf,
++0x30,
++0x0d,
++0x06,
++0x09,
++0x2a,
++0x86,
++0x48,
++0x86,
++0xf7,
++0x0d,
++0x01,
++0x01,
++0x0b,
++0x05,
++0x00,
++0x30,
++0x1a,
++0x31,
++0x18,
++0x30,
++0x16,
++0x06,
++0x03,
++0x55,
++0x04,
++0x03,
++0x0c,
++0x0f,
++0x62,
++0x65,
++0x6e,
++0x68,
++0x40,
++0x64,
++0x65,
++0x62,
++0x69,
++0x61,
++0x6e,
++0x2e,
++0x6f,
++0x72,
++0x67,
++0x30,
++0x20,
++0x17,
++0x0d,
++0x32,
++0x30,
++0x30,
++0x31,
++0x33,
++0x30,
++0x31,
++0x33,
++0x32,
++0x36,
++0x31,
++0x33,
++0x5a,
++0x18,
++0x0f,
++0x32,
++0x31,
++0x32,
++0x30,
++0x30,
++0x31,
++0x30,
++0x36,
++0x31,
++0x33,
++0x32,
++0x36,
++0x31,
++0x33,
++0x5a,
++0x30,
++0x1a,
++0x31,
++0x18,
++0x30,
++0x16,
++0x06,
++0x03,
++0x55,
++0x04,
++0x03,
++0x0c,
++0x0f,
++0x62,
++0x65,
++0x6e,
++0x68,
++0x40,
++0x64,
++0x65,
++0x62,
++0x69,
++0x61,
++0x6e,
++0x2e,
++0x6f,
++0x72,
++0x67,
++0x30,
++0x82,
++0x01,
++0x22,
++0x30,
++0x0d,
++0x06,
++0x09,
++0x2a,
++0x86,
++0x48,
++0x86,
++0xf7,
++0x0d,
++0x01,
++0x01,
++0x01,
++0x05,
++0x00,
++0x03,
++0x82,
++0x01,
++0x0f,
++0x00,
++0x30,
++0x82,
++0x01,
++0x0a,
++0x02,
++0x82,
++0x01,
++0x01,
++0x00,
++0x9d,
++0xe1,
++0x77,
++0xa0,
++0x24,
++0xa0,
++0xd5,
++0x79,
++0x65,
++0x3a,
++0x07,
++0x90,
++0xc9,
++0xf6,
++0xa5,
++0xa6,
++0x1f,
++0x84,
++0x1c,
++0x23,
++0x07,
++0x4b,
++0x4f,
++0xa5,
++0x03,
++0xc6,
++0x0f,
++0xf7,
++0x54,
++0xd5,
++0x8b,
++0x7e,
++0x79,
++0x81,
++0x00,
++0xd2,
++0xe9,
++0x3d,
++0xf4,
++0x97,
++0xfe,
++0x84,
++0xcd,
++0x55,
++0xbd,
++0xc9,
++0x8f,
++0x21,
++0x57,
++0x88,
++0x06,
++0x39,
++0x90,
++0x66,
++0x41,
++0x26,
++0x79,
++0x2c,
++0xca,
++0x3f,
++0x95,
++0x87,
++0x01,
++0x11,
++0x2f,
++0x2f,
++0xb0,
++0xe1,
++0x0b,
++0x43,
++0xfc,
++0x5f,
++0x2f,
++0x4f,
++0x67,
++0x04,
++0xdb,
++0x4d,
++0xb7,
++0x72,
++0x4d,
++0xd1,
++0xc5,
++0x76,
++0x73,
++0x4d,
++0x91,
++0x69,
++0xb0,
++0x71,
++0x17,
++0x36,
++0xea,
++0xab,
++0x0a,
++0x3a,
++0xcd,
++0x95,
++0x9b,
++0x76,
++0x1b,
++0x8e,
++0x21,
++0x17,
++0x8f,
++0xc5,
++0x02,
++0xbf,
++0x24,
++0xc7,
++0xc0,
++0x40,
++0xb1,
++0x3b,
++0xc4,
++0x80,
++0x7c,
++0x71,
++0xa5,
++0x51,
++0xdc,
++0xf7,
++0x3a,
++0x58,
++0x7f,
++0xb1,
++0x07,
++0x81,
++0x8a,
++0x10,
++0xd1,
++0xf6,
++0x93,
++0x17,
++0x71,
++0xe0,
++0xfa,
++0x51,
++0x79,
++0x15,
++0xd4,
++0xd7,
++0x8f,
++0xad,
++0xbd,
++0x6f,
++0x38,
++0xe1,
++0x26,
++0x7d,
++0xbc,
++0xf0,
++0x3e,
++0x80,
++0x89,
++0xb4,
++0xec,
++0x8e,
++0x69,
++0x90,
++0xdb,
++0x97,
++0x8a,
++0xf0,
++0x23,
++0x23,
++0x83,
++0x82,
++0x3b,
++0x6a,
++0xb1,
++0xac,
++0xeb,
++0xe7,
++0x99,
++0x74,
++0x2a,
++0x35,
++0x8e,
++0xa9,
++0x64,
++0xfd,
++0x46,
++0x9e,
++0xe8,
++0xe5,
++0x48,
++0x61,
++0x31,
++0x6e,
++0xe6,
++0xfc,
++0x19,
++0x18,
++0x54,
++0xc3,
++0x1b,
++0x4f,
++0xd6,
++0x00,
++0x44,
++0x87,
++0x1c,
++0x37,
++0x45,
++0xea,
++0xf5,
++0xc9,
++0xcb,
++0x0f,
++0x0c,
++0x55,
++0xec,
++0xcf,
++0x6a,
++0xc2,
++0x45,
++0x26,
++0x23,
++0xa2,
++0x31,
++0x52,
++0x4d,
++0xee,
++0x21,
++0x7d,
++0xfd,
++0x58,
++0x72,
++0xc2,
++0x28,
++0xc5,
++0x8e,
++0xa9,
++0xd0,
++0xee,
++0x01,
++0x77,
++0x08,
++0xa5,
++0xf0,
++0x22,
++0x2b,
++0x47,
++0x79,
++0x2b,
++0xcf,
++0x9a,
++0x46,
++0xb5,
++0x8f,
++0xfd,
++0x64,
++0xa2,
++0xb5,
++0xed,
++0x02,
++0x03,
++0x01,
++0x00,
++0x01,
++0x30,
++0x0d,
++0x06,
++0x09,
++0x2a,
++0x86,
++0x48,
++0x86,
++0xf7,
++0x0d,
++0x01,
++0x01,
++0x0b,
++0x05,
++0x00,
++0x03,
++0x82,
++0x01,
++0x01,
++0x00,
++0x20,
++0x44,
++0xfe,
++0xa9,
++0x9e,
++0xdd,
++0x9b,
++0xea,
++0xce,
++0x25,
++0x75,
++0x08,
++0xf0,
++0x2b,
++0x53,
++0xf7,
++0x5a,
++0x36,
++0x1c,
++0x4a,
++0x23,
++0x7f,
++0xd0,
++0x41,
++0x3c,
++0x12,
++0x2b,
++0xb9,
++0x80,
++0x4e,
++0x8a,
++0x15,
++0x5d,
++0x1f,
++0x40,
++0xa7,
++0x26,
++0x28,
++0x32,
++0xc3,
++0x5b,
++0x06,
++0x28,
++0x2d,
++0x3d,
++0x08,
++0x09,
++0x1e,
++0x01,
++0xe9,
++0x67,
++0xe3,
++0x33,
++0xe6,
++0x15,
++0x45,
++0x39,
++0xee,
++0x17,
++0x83,
++0xdb,
++0x42,
++0xff,
++0x7f,
++0x35,
++0xf4,
++0xac,
++0x16,
++0xdb,
++0xba,
++0xb8,
++0x1a,
++0x20,
++0x21,
++0x41,
++0xff,
++0xf3,
++0x92,
++0xff,
++0x65,
++0x6e,
++0x29,
++0x16,
++0xd0,
++0xbf,
++0x8d,
++0xdf,
++0x48,
++0x2c,
++0x73,
++0x36,
++0x7f,
++0x22,
++0xe6,
++0xee,
++0x78,
++0xb4,
++0x63,
++0x83,
++0x0e,
++0x39,
++0xeb,
++0xaf,
++0x10,
++0x2a,
++0x90,
++0xd3,
++0xfc,
++0xe6,
++0xc3,
++0x8f,
++0x97,
++0x5b,
++0x76,
++0xbf,
++0x9b,
++0xf5,
++0x98,
++0xd2,
++0x53,
++0x06,
++0x8b,
++0xf8,
++0xa4,
++0x04,
++0x9b,
++0x1b,
++0x62,
++0x6a,
++0x9d,
++0xac,
++0xe6,
++0x4b,
++0x0d,
++0xc9,
++0xd7,
++0x56,
++0x63,
++0x15,
++0x01,
++0x38,
++0x8c,
++0xbe,
++0xf1,
++0x44,
++0xc4,
++0x38,
++0x27,
++0xe0,
++0xcf,
++0x72,
++0xd6,
++0x3d,
++0xe4,
++0xf7,
++0x4b,
++0x3b,
++0xd2,
++0xb1,
++0x0c,
++0xd5,
++0x83,
++0x6d,
++0x1e,
++0x10,
++0x04,
++0x69,
++0x29,
++0x88,
++0x69,
++0xe0,
++0x7d,
++0xd7,
++0xdb,
++0xb4,
++0x59,
++0x72,
++0x8d,
++0x9d,
++0x3c,
++0x43,
++0xaf,
++0xc6,
++0x7d,
++0xb7,
++0x21,
++0x15,
++0x52,
++0x8a,
++0xe9,
++0x9b,
++0x6b,
++0x2e,
++0xe8,
++0x27,
++0x3c,
++0x3f,
++0x2d,
++0x84,
++0xfb,
++0x9a,
++0x22,
++0x0a,
++0x9f,
++0x6a,
++0x25,
++0xe6,
++0x39,
++0xe4,
++0x74,
++0x73,
++0xb6,
++0x2a,
++0x70,
++0xaa,
++0x1d,
++0xcb,
++0xcc,
++0xd4,
++0xa0,
++0x1b,
++0x26,
++0x71,
++0x63,
++0x04,
++0xc5,
++0x12,
++0x21,
++0x48,
++0xba,
++0x92,
++0x27,
++0x06,
++0xa8,
++0x3e,
++0x6d,
++0xa1,
++0x43,
++0xa5,
++0xd2,
++0x2a,
++0xf7,
++0xca,
++0xc4,
++0x26,
++0xe8,
++0x5b,
++0x1f,
++0xe4,
++0xdc,
++0x89,
++0xdc,
++0x1f,
++0x04,
++0x79,
++0x3f,
++0x30,
++0x82,
++0x02,
++0xcd,
++0x30,
++0x82,
++0x01,
++0xb5,
++0x02,
++0x14,
++0x3a,
++0xbb,
++0xc6,
++0xec,
++0x14,
++0x6e,
++0x09,
++0xd1,
++0xb6,
++0x01,
++0x6a,
++0xb9,
++0xd6,
++0xcf,
++0x71,
++0xdd,
++0x23,
++0x3f,
++0x03,
++0x28,
++0x30,
++0x0d,
++0x06,
++0x09,
++0x2a,
++0x86,
++0x48,
++0x86,
++0xf7,
++0x0d,
++0x01,
++0x01,
++0x0b,
++0x05,
++0x00,
++0x30,
++0x22,
++0x31,
++0x20,
++0x30,
++0x1e,
++0x06,
++0x03,
++0x55,
++0x04,
++0x03,
++0x0c,
++0x17,
++0x72,
++0x6f,
++0x6d,
++0x61,
++0x69,
++0x6e,
++0x2e,
++0x70,
++0x65,
++0x72,
++0x69,
++0x65,
++0x72,
++0x40,
++0x67,
++0x6d,
++0x61,
++0x69,
++0x6c,
++0x2e,
++0x63,
++0x6f,
++0x6d,
++0x30,
++0x20,
++0x17,
++0x0d,
++0x32,
++0x30,
++0x30,
++0x32,
++0x32,
++0x34,
++0x31,
++0x39,
++0x30,
++0x31,
++0x34,
++0x34,
++0x5a,
++0x18,
++0x0f,
++0x32,
++0x31,
++0x32,
++0x30,
++0x30,
++0x31,
++0x33,
++0x31,
++0x31,
++0x39,
++0x30,
++0x31,
++0x34,
++0x34,
++0x5a,
++0x30,
++0x22,
++0x31,
++0x20,
++0x30,
++0x1e,
++0x06,
++0x03,
++0x55,
++0x04,
++0x03,
++0x0c,
++0x17,
++0x72,
++0x6f,
++0x6d,
++0x61,
++0x69,
++0x6e,
++0x2e,
++0x70,
++0x65,
++0x72,
++0x69,
++0x65,
++0x72,
++0x40,
++0x67,
++0x6d,
++0x61,
++0x69,
++0x6c,
++0x2e,
++0x63,
++0x6f,
++0x6d,
++0x30,
++0x82,
++0x01,
++0x22,
++0x30,
++0x0d,
++0x06,
++0x09,
++0x2a,
++0x86,
++0x48,
++0x86,
++0xf7,
++0x0d,
++0x01,
++0x01,
++0x01,
++0x05,
++0x00,
++0x03,
++0x82,
++0x01,
++0x0f,
++0x00,
++0x30,
++0x82,
++0x01,
++0x0a,
++0x02,
++0x82,
++0x01,
++0x01,
++0x00,
++0xf0,
++0xb8,
++0x4f,
++0x3f,
++0x70,
++0x78,
++0xf8,
++0x74,
++0x45,
++0xa2,
++0x28,
++0xaf,
++0x04,
++0x75,
++0x04,
++0xa3,
++0xf3,
++0xa7,
++0xc7,
++0x04,
++0xac,
++0xb6,
++0xe1,
++0xfc,
++0xe1,
++0xc0,
++0x3d,
++0xe0,
++0x26,
++0x90,
++0x8a,
++0x45,
++0x60,
++0xc4,
++0x75,
++0xf3,
++0x1a,
++0x33,
++0x37,
++0x56,
++0x7d,
++0x30,
++0x07,
++0x75,
++0x0e,
++0xa6,
++0x79,
++0x06,
++0x95,
++0x9d,
++0x17,
++0x3c,
++0x09,
++0xa9,
++0x7f,
++0xab,
++0x95,
++0x5d,
++0xed,
++0xe0,
++0x75,
++0x26,
++0x2f,
++0x65,
++0x65,
++0xcd,
++0x61,
++0xb1,
++0x33,
++0x27,
++0x67,
++0x41,
++0xa1,
++0x01,
++0x13,
++0xe9,
++0x13,
++0x6a,
++0x6d,
++0x4e,
++0x98,
++0xe1,
++0x9e,
++0x7b,
++0x0b,
++0x5b,
++0x44,
++0xef,
++0x68,
++0x5a,
++0x6f,
++0x7d,
++0x97,
++0xa1,
++0x33,
++0x22,
++0x97,
++0x12,
++0x21,
++0x09,
++0x8f,
++0x90,
++0xe0,
++0x25,
++0x94,
++0xdd,
++0x8a,
++0x3a,
++0xf7,
++0x4a,
++0x60,
++0x04,
++0x26,
++0x6d,
++0x00,
++0x82,
++0xe4,
++0xcf,
++0x64,
++0x1c,
++0x79,
++0x15,
++0x24,
++0xf2,
++0x42,
++0x86,
++0xf5,
++0x10,
++0x86,
++0xac,
++0x20,
++0x88,
++0x90,
++0x87,
++0xdf,
++0x8c,
++0x37,
++0x7c,
++0xbf,
++0x35,
++0xd5,
++0x6f,
++0x9f,
++0x77,
++0xc3,
++0xcd,
++0x69,
++0x25,
++0x06,
++0xc2,
++0x65,
++0x51,
++0x71,
++0x89,
++0x7f,
++0x6e,
++0x4d,
++0xe5,
++0xd5,
++0x8a,
++0x36,
++0x1a,
++0xad,
++0xc1,
++0x18,
++0xd6,
++0x14,
++0x42,
++0x87,
++0xf0,
++0x93,
++0x83,
++0xf1,
++0x99,
++0x74,
++0xc4,
++0x13,
++0xaa,
++0x3b,
++0x66,
++0x85,
++0x6f,
++0xe0,
++0xbc,
++0x5f,
++0xb6,
++0x40,
++0xa6,
++0x41,
++0x06,
++0x0a,
++0xba,
++0x0e,
++0xe9,
++0x32,
++0x44,
++0x10,
++0x39,
++0x53,
++0xcd,
++0xbf,
++0xf3,
++0xd3,
++0x26,
++0xf6,
++0xb6,
++0x2b,
++0x40,
++0x2e,
++0xb9,
++0x88,
++0xc1,
++0xf4,
++0xe3,
++0xa0,
++0x28,
++0x77,
++0x4f,
++0xba,
++0xa8,
++0xca,
++0x9c,
++0x05,
++0xba,
++0x88,
++0x96,
++0x99,
++0x54,
++0x89,
++0xa2,
++0x8d,
++0xf3,
++0x73,
++0xa1,
++0x8c,
++0x4a,
++0xa8,
++0x71,
++0xee,
++0x2e,
++0xd2,
++0x83,
++0x14,
++0x48,
++0xbd,
++0x98,
++0xc6,
++0xce,
++0xdc,
++0xa8,
++0xa3,
++0x97,
++0x2e,
++0x40,
++0x16,
++0x2f,
++0x02,
++0x03,
++0x01,
++0x00,
++0x01,
++0x30,
++0x0d,
++0x06,
++0x09,
++0x2a,
++0x86,
++0x48,
++0x86,
++0xf7,
++0x0d,
++0x01,
++0x01,
++0x0b,
++0x05,
++0x00,
++0x03,
++0x82,
++0x01,
++0x01,
++0x00,
++0x76,
++0x5d,
++0x03,
++0x3d,
++0xb6,
++0x96,
++0x00,
++0x1b,
++0x6e,
++0x0c,
++0xdd,
++0xbb,
++0xc8,
++0xdf,
++0xbc,
++0xeb,
++0x6c,
++0x01,
++0x40,
++0x1a,
++0x2b,
++0x07,
++0x60,
++0xa1,
++0x1a,
++0xe1,
++0x43,
++0x57,
++0xfa,
++0xbe,
++0xde,
++0xbb,
++0x8f,
++0x73,
++0xf3,
++0x92,
++0xa2,
++0xaa,
++0x83,
++0x01,
++0xc1,
++0x17,
++0xe4,
++0x9d,
++0x09,
++0x41,
++0xe0,
++0x32,
++0x33,
++0x97,
++0x4b,
++0xf2,
++0xdc,
++0x0f,
++0x8b,
++0xa8,
++0xb8,
++0x5a,
++0x04,
++0x86,
++0xf6,
++0x71,
++0xa1,
++0x97,
++0xd0,
++0x54,
++0x56,
++0x10,
++0x8e,
++0x54,
++0x99,
++0x0d,
++0x2a,
++0xa9,
++0xaf,
++0x1b,
++0x55,
++0x59,
++0x06,
++0x2b,
++0xa4,
++0x5f,
++0xb1,
++0x54,
++0xa6,
++0xec,
++0xc7,
++0xd6,
++0x43,
++0xee,
++0x86,
++0x2c,
++0x9b,
++0x18,
++0x9d,
++0x8f,
++0x00,
++0x82,
++0xc1,
++0x88,
++0x61,
++0x16,
++0x85,
++0x3c,
++0x17,
++0x56,
++0xfe,
++0x6a,
++0xa0,
++0x7a,
++0x68,
++0xc5,
++0x7b,
++0x3d,
++0x3c,
++0xb6,
++0x13,
++0x18,
++0x99,
++0x6d,
++0x74,
++0x65,
++0x13,
++0x67,
++0xb7,
++0xfc,
++0x5a,
++0x44,
++0x48,
++0x72,
++0xa0,
++0x73,
++0xb8,
++0xff,
++0x02,
++0x9d,
++0x7c,
++0x5b,
++0xf9,
++0x7c,
++0x75,
++0x0a,
++0x3c,
++0x81,
++0x80,
++0x3c,
++0x41,
++0xf2,
++0xd5,
++0xfa,
++0x3d,
++0x1f,
++0xe3,
++0xda,
++0x8c,
++0xa5,
++0x17,
++0x1f,
++0x53,
++0x1a,
++0x75,
++0xad,
++0x4e,
++0x11,
++0x1c,
++0x07,
++0xec,
++0x0a,
++0x69,
++0xfd,
++0x33,
++0xfa,
++0x32,
++0x7e,
++0x66,
++0xf5,
++0x29,
++0xe8,
++0x4d,
++0x8a,
++0xfa,
++0x0d,
++0x4b,
++0x68,
++0xc3,
++0x95,
++0x11,
++0xba,
++0x6f,
++0x1e,
++0x07,
++0x8c,
++0x85,
++0xc7,
++0xc7,
++0xc9,
++0xc1,
++0x30,
++0xa3,
++0x70,
++0xb0,
++0xa1,
++0xe0,
++0xd5,
++0x85,
++0x15,
++0x94,
++0x77,
++0xc1,
++0x1c,
++0x91,
++0xf1,
++0x5f,
++0x50,
++0xcd,
++0x2c,
++0x57,
++0x4b,
++0x22,
++0x4f,
++0xee,
++0x95,
++0xd7,
++0xa7,
++0xa4,
++0x59,
++0x62,
++0xae,
++0xb9,
++0xbf,
++0xd7,
++0x63,
++0x5a,
++0x04,
++0xfc,
++0x24,
++0x11,
++0xae,
++0x34,
++0x4b,
++0xf4,
++0x0c,
++0x9f,
++0x0b,
++0x59,
++0x7d,
++0x27,
++0x39,
++0x54,
++0x69,
++0x4f,
++0xfd,
++0x6e,
++0x44,
++0x9f,
++0x21,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0339-drm-ili9486-Resolve-clash-in-spi_device_id-names.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0339-drm-ili9486-Resolve-clash-in-spi_device_id-names.patch
new file mode 100644
index 00000000..f8ef791a
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0339-drm-ili9486-Resolve-clash-in-spi_device_id-names.patch
@@ -0,0 +1,34 @@
+From b32eba2e27bf27c187737f867cda19b8c37e63f2 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 1 Sep 2023 12:17:38 +0100
+Subject: [PATCH 339/697] drm/ili9486: Resolve clash in spi_device_id names
+
+For "Really Good Reasons" [1] the SPI core requires a match
+between compatible device strings and the name in spi_device_id.
+
+The ili9486 driver uses compatible strings "waveshare,rpi-lcd-35"
+and "ozzmaker,piscreen", but "rpi-lcd-35" and "piscreen" are missing,
+so add them.
+
+Compatible string "ilitek,ili9486" is already used by
+staging/fbtft/fb_ili9486, therefore leaving it present in ili9486 as an
+spi_device_id causes the incorrect module to be loaded, therefore remove
+this id.
+
+[1] https://elixir.bootlin.com/linux/latest/source/drivers/spi/spi.c#L487
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/tiny/ili9486.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/gpu/drm/tiny/ili9486.c
++++ b/drivers/gpu/drm/tiny/ili9486.c
+@@ -188,7 +188,6 @@ static const struct of_device_id ili9486
+ MODULE_DEVICE_TABLE(of, ili9486_of_match);
+ 
+ static const struct spi_device_id ili9486_id[] = {
+-	{ "ili9486", 0 },
+ 	{ "rpi-lcd-35", 0 },
+ 	{ "piscreen", 0 },
+ 	{ }
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0340-bcm2835-unicam-hacks-to-allow-it-to-build.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0340-bcm2835-unicam-hacks-to-allow-it-to-build.patch
new file mode 100644
index 00000000..c97525ca
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0340-bcm2835-unicam-hacks-to-allow-it-to-build.patch
@@ -0,0 +1,57 @@
+From 0b4b7dcfffe8ee356d1211adc3ddc514f2156a99 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Wed, 13 Sep 2023 18:53:21 +0100
+Subject: [PATCH 340/697] bcm2835-unicam: hacks to allow it to build
+
+media: bcm2835-unicam: Fix up async notifier usage
+
+Fixes "8a090fc3e549 bcm2835-unicam: hacks to allow it to build"
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -516,7 +516,7 @@ struct unicam_device {
+ 	struct kref kref;
+ 
+ 	/* V4l2 specific parameters */
+-	struct v4l2_async_subdev asd;
++	struct v4l2_async_connection *asd;
+ 
+ 	/* peripheral base address */
+ 	void __iomem *base;
+@@ -2791,7 +2791,7 @@ static const struct v4l2_file_operations
+ static int
+ unicam_async_bound(struct v4l2_async_notifier *notifier,
+ 		   struct v4l2_subdev *subdev,
+-		   struct v4l2_async_subdev *asd)
++		   struct v4l2_async_connection *asd)
+ {
+ 	struct unicam_device *unicam = to_unicam_device(notifier->v4l2_dev);
+ 
+@@ -3324,18 +3324,18 @@ static int of_unicam_connect_subdevs(str
+ 		   dev->max_data_lanes, dev->bus_flags);
+ 
+ 	/* Initialize and register the async notifier. */
+-	v4l2_async_nf_init(&dev->notifier);
++	v4l2_async_nf_init(&dev->notifier, &dev->v4l2_dev);
+ 	dev->notifier.ops = &unicam_async_ops;
+ 
+-	dev->asd.match_type = V4L2_ASYNC_MATCH_FWNODE;
+-	dev->asd.match.fwnode = fwnode_graph_get_remote_endpoint(of_fwnode_handle(ep_node));
+-	ret = __v4l2_async_nf_add_subdev(&dev->notifier, &dev->asd);
+-	if (ret) {
++	dev->asd = v4l2_async_nf_add_fwnode(&dev->notifier,
++					    of_fwnode_handle(sensor_node),
++					    struct v4l2_async_connection);
++	if (IS_ERR(dev->asd)) {
+ 		unicam_err(dev, "Error adding subdevice: %d\n", ret);
+ 		goto cleanup_exit;
+ 	}
+ 
+-	ret = v4l2_async_nf_register(&dev->v4l2_dev, &dev->notifier);
++	ret = v4l2_async_nf_register(&dev->notifier);
+ 	if (ret) {
+ 		unicam_err(dev, "Error registering async notifier: %d\n", ret);
+ 		ret = -EINVAL;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0341-rtc-rv3028-Add-backup-switchover-mode-support.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0341-rtc-rv3028-Add-backup-switchover-mode-support.patch
new file mode 100644
index 00000000..f67ff73e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0341-rtc-rv3028-Add-backup-switchover-mode-support.patch
@@ -0,0 +1,58 @@
+From 51cf413b28a5f2b625bf5e5d14f752c5161ef75a Mon Sep 17 00:00:00 2001
+From: Phil Howard <phil@gadgetoid.com>
+Date: Fri, 29 Mar 2019 10:53:14 +0000
+Subject: [PATCH 341/697] rtc: rv3028: Add backup switchover mode support
+
+Signed-off-by: Phil Howard <phil@pimoroni.com>
+---
+ drivers/rtc/rtc-rv3028.c | 24 ++++++++++++++++++------
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+--- a/drivers/rtc/rtc-rv3028.c
++++ b/drivers/rtc/rtc-rv3028.c
+@@ -858,16 +858,17 @@ static const struct regmap_config regmap
+ static u8 rv3028_set_trickle_charger(struct rv3028_data *rv3028,
+ 				     struct i2c_client *client)
+ {
+-	int ret, val_old, val;
++	int ret, val_old, val, val_mask;
+ 	u32 ohms, chargeable;
++	u32 bsm;
+ 
+ 	ret = regmap_read(rv3028->regmap, RV3028_BACKUP, &val_old);
+ 	if (ret < 0)
+ 		return ret;
+ 
+ 	/* mask out only trickle charger bits */
+-	val_old = val_old & (RV3028_BACKUP_TCE | RV3028_BACKUP_TCR_MASK);
+-	val = val_old;
++	val_mask = RV3028_BACKUP_TCE | RV3028_BACKUP_TCR_MASK;
++	val = val_old & val_mask;
+ 
+ 	/* setup trickle charger */
+ 	if (!device_property_read_u32(&client->dev, "trickle-resistor-ohms",
+@@ -902,10 +903,21 @@ static u8 rv3028_set_trickle_charger(str
+ 		}
+ 	}
+ 
++	/* setup backup switchover mode */
++	if (!device_property_read_u32(&client->dev,
++				      "backup-switchover-mode",
++				      &bsm)) {
++		if (bsm <= 3) {
++			val_mask |= RV3028_BACKUP_BSM;
++			val |= (u8)(bsm << 2);
++		} else {
++			dev_warn(&client->dev, "invalid backup switchover mode value\n");
++		}
++	}
++
+ 	/* only update EEPROM if changes are necessary */
+-	if (val_old != val) {
+-		ret = rv3028_update_cfg(rv3028, RV3028_BACKUP, RV3028_BACKUP_TCE |
+-						RV3028_BACKUP_TCR_MASK, val);
++	if ((val_old & val_mask) != val) {
++		ret = rv3028_update_cfg(rv3028, RV3028_BACKUP, val_mask, val);
+ 		if (ret)
+ 			return ret;
+ 	}
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0342-gpio_brcmstb-Allow-to-build-for-ARCH_BCM2835.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0342-gpio_brcmstb-Allow-to-build-for-ARCH_BCM2835.patch
new file mode 100644
index 00000000..e7c91cd6
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0342-gpio_brcmstb-Allow-to-build-for-ARCH_BCM2835.patch
@@ -0,0 +1,279 @@
+From c305e93b69d0c737fdc4126b0e30c3d5fae17caf Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Fri, 21 May 2021 12:33:38 +0100
+Subject: [PATCH 342/697] gpio_brcmstb: Allow to build for ARCH_BCM2835
+
+gpio-brcmstb: Report the correct bank width
+
+gpio: brcmstb: Use bank address as gpiochip label
+
+If the path to the device node is used as gpiochip label then
+gpio-brcmstb instances with multiple banks end up with duplicated
+names. Instead, use a combination of the driver name with the physical
+address of the bank, which is both unique and helpful for devmem
+debugging.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+gpio: mmio: Add DIRECT mode for shared access
+
+The generic MMIO GPIO library uses shadow registers for efficiency,
+but this breaks attempts by raspi-gpio to change other GPIOs in the
+same bank. Add a DIRECT mode that makes fewer assumptions about the
+existing register contents, but note that genuinely simultaneous
+accesses are likely to lose updates.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+gpio: brcmstb: Don't always clear interrupt mask
+
+If the GPIO controller is not being used as an interrupt source
+leave the interrupt mask register alone. On BCM2712 it might be used
+to generate interrupts to the VPU firmware, and on other devices it
+doesn't matter since no interrupts will be generated.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+gpio: brcmstb: Use dynamic GPIO base numbers
+
+Forcing a gpiochip to have a fixed base number now leads to a warning
+message. Remove the need to do so by calculating hwirq numbers based
+on bank numbers.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+Fixes: 3b0213d56eb7 ("gpio: Add GPIO support for Broadcom STB SoCs")
+---
+ drivers/gpio/gpio-brcmstb.c |  14 ++--
+ drivers/gpio/gpio-mmio.c    | 124 ++++++++++++++++++++++++++++++++++--
+ include/linux/gpio/driver.h |   1 +
+ 3 files changed, 130 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpio/gpio-brcmstb.c
++++ b/drivers/gpio/gpio-brcmstb.c
+@@ -633,6 +633,8 @@ static int brcmstb_gpio_probe(struct pla
+ #if defined(CONFIG_MIPS) && defined(__BIG_ENDIAN)
+ 	flags = BGPIOF_BIG_ENDIAN_BYTE_ORDER;
+ #endif
++	if (of_property_read_bool(np, "brcm,gpio-direct"))
++	    flags |= BGPIOF_REG_DIRECT;
+ 
+ 	of_property_for_each_u32(np, "brcm,gpio-bank-widths", bank_width) {
+ 		struct brcmstb_gpio_bank *bank;
+@@ -681,7 +683,9 @@ static int brcmstb_gpio_probe(struct pla
+ 		}
+ 
+ 		gc->owner = THIS_MODULE;
+-		gc->label = devm_kasprintf(dev, GFP_KERNEL, "%pOF", np);
++		gc->label = devm_kasprintf(dev, GFP_KERNEL, "gpio-brcmstb@%zx",
++					   (size_t)res->start +
++					   GIO_BANK_OFF(bank->id, 0));
+ 		if (!gc->label) {
+ 			err = -ENOMEM;
+ 			goto fail;
+@@ -689,7 +693,7 @@ static int brcmstb_gpio_probe(struct pla
+ 		gc->of_gpio_n_cells = 2;
+ 		gc->of_xlate = brcmstb_gpio_of_xlate;
+ 		/* not all ngpio lines are valid, will use bank width later */
+-		gc->ngpio = MAX_GPIO_PER_BANK;
++		gc->ngpio = bank_width;
+ 		gc->offset = bank->id * MAX_GPIO_PER_BANK;
+ 		gc->request = gpiochip_generic_request;
+ 		gc->free = gpiochip_generic_free;
+@@ -700,8 +704,10 @@ static int brcmstb_gpio_probe(struct pla
+ 		 * Mask all interrupts by default, since wakeup interrupts may
+ 		 * be retained from S5 cold boot
+ 		 */
+-		need_wakeup_event |= !!__brcmstb_gpio_get_active_irqs(bank);
+-		gc->write_reg(reg_base + GIO_MASK(bank->id), 0);
++		if (priv->parent_irq > 0) {
++			need_wakeup_event |= !!__brcmstb_gpio_get_active_irqs(bank);
++			gc->write_reg(reg_base + GIO_MASK(bank->id), 0);
++		}
+ 
+ 		err = gpiochip_add_data(gc, bank);
+ 		if (err) {
+--- a/drivers/gpio/gpio-mmio.c
++++ b/drivers/gpio/gpio-mmio.c
+@@ -231,6 +231,25 @@ static void bgpio_set(struct gpio_chip *
+ 	raw_spin_unlock_irqrestore(&gc->bgpio_lock, flags);
+ }
+ 
++static void bgpio_set_direct(struct gpio_chip *gc, unsigned int gpio, int val)
++{
++	unsigned long mask = bgpio_line2mask(gc, gpio);
++	unsigned long flags;
++
++	raw_spin_lock_irqsave(&gc->bgpio_lock, flags);
++
++	gc->bgpio_data = gc->read_reg(gc->reg_dat);
++
++	if (val)
++		gc->bgpio_data |= mask;
++	else
++		gc->bgpio_data &= ~mask;
++
++	gc->write_reg(gc->reg_dat, gc->bgpio_data);
++
++	raw_spin_unlock_irqrestore(&gc->bgpio_lock, flags);
++}
++
+ static void bgpio_set_with_clear(struct gpio_chip *gc, unsigned int gpio,
+ 				 int val)
+ {
+@@ -323,6 +342,27 @@ static void bgpio_set_multiple_with_clea
+ 		gc->write_reg(gc->reg_clr, clear_mask);
+ }
+ 
++static void bgpio_set_multiple_direct(struct gpio_chip *gc,
++				      unsigned long *mask,
++				      unsigned long *bits)
++{
++	unsigned long flags;
++	unsigned long set_mask, clear_mask;
++
++	raw_spin_lock_irqsave(&gc->bgpio_lock, flags);
++
++	bgpio_multiple_get_masks(gc, mask, bits, &set_mask, &clear_mask);
++
++	gc->bgpio_data = gc->read_reg(gc->reg_dat);
++
++	gc->bgpio_data |= set_mask;
++	gc->bgpio_data &= ~clear_mask;
++
++	gc->write_reg(gc->reg_dat, gc->bgpio_data);
++
++	raw_spin_unlock_irqrestore(&gc->bgpio_lock, flags);
++}
++
+ static int bgpio_simple_dir_in(struct gpio_chip *gc, unsigned int gpio)
+ {
+ 	return 0;
+@@ -360,6 +400,29 @@ static int bgpio_dir_in(struct gpio_chip
+ 	return 0;
+ }
+ 
++static int bgpio_dir_in_direct(struct gpio_chip *gc, unsigned int gpio)
++{
++	unsigned long flags;
++
++	raw_spin_lock_irqsave(&gc->bgpio_lock, flags);
++
++	if (gc->reg_dir_in)
++		gc->bgpio_dir = ~gc->read_reg(gc->reg_dir_in);
++	if (gc->reg_dir_out)
++		gc->bgpio_dir = gc->read_reg(gc->reg_dir_out);
++
++	gc->bgpio_dir &= ~bgpio_line2mask(gc, gpio);
++
++	if (gc->reg_dir_in)
++		gc->write_reg(gc->reg_dir_in, ~gc->bgpio_dir);
++	if (gc->reg_dir_out)
++		gc->write_reg(gc->reg_dir_out, gc->bgpio_dir);
++
++	raw_spin_unlock_irqrestore(&gc->bgpio_lock, flags);
++
++	return 0;
++}
++
+ static int bgpio_get_dir(struct gpio_chip *gc, unsigned int gpio)
+ {
+ 	/* Return 0 if output, 1 if input */
+@@ -398,6 +461,28 @@ static void bgpio_dir_out(struct gpio_ch
+ 	raw_spin_unlock_irqrestore(&gc->bgpio_lock, flags);
+ }
+ 
++static void bgpio_dir_out_direct(struct gpio_chip *gc, unsigned int gpio,
++				 int val)
++{
++	unsigned long flags;
++
++	raw_spin_lock_irqsave(&gc->bgpio_lock, flags);
++
++	if (gc->reg_dir_in)
++		gc->bgpio_dir = ~gc->read_reg(gc->reg_dir_in);
++	if (gc->reg_dir_out)
++		gc->bgpio_dir = gc->read_reg(gc->reg_dir_out);
++
++	gc->bgpio_dir |= bgpio_line2mask(gc, gpio);
++
++	if (gc->reg_dir_in)
++		gc->write_reg(gc->reg_dir_in, ~gc->bgpio_dir);
++	if (gc->reg_dir_out)
++		gc->write_reg(gc->reg_dir_out, gc->bgpio_dir);
++
++	raw_spin_unlock_irqrestore(&gc->bgpio_lock, flags);
++}
++
+ static int bgpio_dir_out_dir_first(struct gpio_chip *gc, unsigned int gpio,
+ 				   int val)
+ {
+@@ -414,6 +499,22 @@ static int bgpio_dir_out_val_first(struc
+ 	return 0;
+ }
+ 
++static int bgpio_dir_out_dir_first_direct(struct gpio_chip *gc,
++					  unsigned int gpio, int val)
++{
++	bgpio_dir_out_direct(gc, gpio, val);
++	gc->set(gc, gpio, val);
++	return 0;
++}
++
++static int bgpio_dir_out_val_first_direct(struct gpio_chip *gc,
++					  unsigned int gpio, int val)
++{
++	gc->set(gc, gpio, val);
++	bgpio_dir_out_direct(gc, gpio, val);
++	return 0;
++}
++
+ static int bgpio_setup_accessors(struct device *dev,
+ 				 struct gpio_chip *gc,
+ 				 bool byte_be)
+@@ -507,6 +608,9 @@ static int bgpio_setup_io(struct gpio_ch
+ 	} else if (flags & BGPIOF_NO_OUTPUT) {
+ 		gc->set = bgpio_set_none;
+ 		gc->set_multiple = NULL;
++	} else if (flags & BGPIOF_REG_DIRECT) {
++		gc->set = bgpio_set_direct;
++		gc->set_multiple = bgpio_set_multiple_direct;
+ 	} else {
+ 		gc->set = bgpio_set;
+ 		gc->set_multiple = bgpio_set_multiple;
+@@ -543,11 +647,21 @@ static int bgpio_setup_direction(struct
+ 	if (dirout || dirin) {
+ 		gc->reg_dir_out = dirout;
+ 		gc->reg_dir_in = dirin;
+-		if (flags & BGPIOF_NO_SET_ON_INPUT)
+-			gc->direction_output = bgpio_dir_out_dir_first;
+-		else
+-			gc->direction_output = bgpio_dir_out_val_first;
+-		gc->direction_input = bgpio_dir_in;
++		if (flags & BGPIOF_REG_DIRECT) {
++			if (flags & BGPIOF_NO_SET_ON_INPUT)
++				gc->direction_output =
++					bgpio_dir_out_dir_first_direct;
++			else
++				gc->direction_output =
++					bgpio_dir_out_val_first_direct;
++			gc->direction_input = bgpio_dir_in_direct;
++		} else {
++			if (flags & BGPIOF_NO_SET_ON_INPUT)
++				gc->direction_output = bgpio_dir_out_dir_first;
++			else
++				gc->direction_output = bgpio_dir_out_val_first;
++			gc->direction_input = bgpio_dir_in;
++		}
+ 		gc->get_direction = bgpio_get_dir;
+ 	} else {
+ 		if (flags & BGPIOF_NO_OUTPUT)
+--- a/include/linux/gpio/driver.h
++++ b/include/linux/gpio/driver.h
+@@ -713,6 +713,7 @@ int bgpio_init(struct gpio_chip *gc, str
+ #define BGPIOF_READ_OUTPUT_REG_SET	BIT(4) /* reg_set stores output value */
+ #define BGPIOF_NO_OUTPUT		BIT(5) /* only input */
+ #define BGPIOF_NO_SET_ON_INPUT		BIT(6)
++#define BGPIOF_REG_DIRECT		BIT(7) /* ignore shadow registers */
+ 
+ #ifdef CONFIG_GPIOLIB_IRQCHIP
+ int gpiochip_irqchip_add_domain(struct gpio_chip *gc,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0343-Allow-RESET_BRCMSTB-on-ARCH_BCM2835.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0343-Allow-RESET_BRCMSTB-on-ARCH_BCM2835.patch
new file mode 100644
index 00000000..9bea3df4
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0343-Allow-RESET_BRCMSTB-on-ARCH_BCM2835.patch
@@ -0,0 +1,20 @@
+From 518372fabc46138a9b20e19a65e39356ac641963 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 27 May 2021 11:46:30 +0100
+Subject: [PATCH 343/697] Allow RESET_BRCMSTB on ARCH_BCM2835
+
+---
+ drivers/reset/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/reset/Kconfig
++++ b/drivers/reset/Kconfig
+@@ -51,7 +51,7 @@ config RESET_BERLIN
+ 
+ config RESET_BRCMSTB
+ 	tristate "Broadcom STB reset controller"
+-	depends on ARCH_BRCMSTB || COMPILE_TEST
++	depends on ARCH_BRCMSTB || ARCH_BCM2835 || COMPILE_TEST
+ 	default ARCH_BRCMSTB
+ 	help
+ 	  This enables the reset controller driver for Broadcom STB SoCs using
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0344-pinctrl-bcm2712-pinctrl-pinconf-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0344-pinctrl-bcm2712-pinctrl-pinconf-driver.patch
new file mode 100644
index 00000000..91a6d0c8
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0344-pinctrl-bcm2712-pinctrl-pinconf-driver.patch
@@ -0,0 +1,1379 @@
+From 7db65d8e88d8a608b8a974d1c6f97a2b2b569852 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 9 Jun 2021 15:48:28 +0100
+Subject: [PATCH 344/697] pinctrl: bcm2712 pinctrl/pinconf driver
+
+pinctrl: bcm2712: Reject invalid pulls
+
+Reject attempts to set pulls on aon-sgpios, and fix pull shift
+values.
+
+pinctrl: bcm2712: Add 7712 support, fix 2712 count
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+pinctrl-bcm2712: add EMMC pins so pulls can be set
+
+These pins have pad controls but not mux controls. They look enough like
+GPIOs to squeeze in at the end of the list though.
+
+pinctrl: bcm2712: correct BCM2712C0 AON_GPIO pad pull control offset
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+pinctrl: bcm2712: on C0 the regular GPIO pad control register moves too
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+pinctrl: bcm2712: Implement (partially) pinconf_get
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+pinctrl: bcm2712: Convert to generic pinconf
+
+Remove the legacy brcm,* pin configuration support and replace it with
+a proper generic pinconf interface, using named functions instead of
+alt function numbers. This is nicer for users, less error-prone, and
+immune to some of the C0->D0 changes.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+pinctrl: bcm2712: Remove vestigial pull parameter
+
+Now the legacy brcm, pinconf parameters are no longer supported, this
+custom pin config parameter is not needed.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+pinctrl: bcm2712: Guard against bad func numbers
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+pinctrl: bcm2712: A better attempt at D0 support
+
+The BCM2712D0 sparse pinctrl maps play havoc with the old GPIO_REGS
+macro, so make the bit positions explicit. And delete the unwanted
+GPIO and pinmux declarations on D0.
+
+Note that a Pi 5 with D0 requires a separate DTS file with "bcm2712d0"
+compatible strings.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+pinctrl: bcm2712: Delete base register constants
+
+BCM2712D0 deletes many GPIOs and their associated mux and pad bits,
+so much so that the offsets to the start of the pad control registers
+changes. Remove the constant offsets from the *GPIO_REGS macros,
+compensating by adjusting the per-GPIO values.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+pinctrl: bcm2712: Fix for sparse GPIOs
+
+BCM2712D0's sparse GPIO map revealed that it is not safe to treat
+group_selector as the GPIO number - it is an index into the array of
+pinctrl_pin_descs, and the "number" member says which GPIO it refers to.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+pinctrl: bcm2712: Fix for the first valid GPIO
+
+A non-zero mux bit number is used to detect a valid entry in the
+pin_regs tables, but GPIO 0 (GPIO 1 on D0) is a valid GPIO with a mux
+bit number of zero, so add a high-bit on all valid entries to
+distinguish this from an uninitialised row in the table.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+drivers: pinctrl: add BCM2712D0 EMMC pins
+
+The pad control registers are concatenated onto the GPIO pad control
+registers, as with previous steppings.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/pinctrl/bcm/Kconfig           |    9 +
+ drivers/pinctrl/bcm/Makefile          |    1 +
+ drivers/pinctrl/bcm/pinctrl-bcm2712.c | 1247 +++++++++++++++++++++++++
+ 3 files changed, 1257 insertions(+)
+ create mode 100644 drivers/pinctrl/bcm/pinctrl-bcm2712.c
+
+--- a/drivers/pinctrl/bcm/Kconfig
++++ b/drivers/pinctrl/bcm/Kconfig
+@@ -3,6 +3,15 @@
+ # Broadcom pinctrl drivers
+ #
+ 
++config PINCTRL_BCM2712
++	bool "Broadcom BCM2712 PINCONF driver"
++	depends on OF && (ARCH_BCM2835 || ARCH_BRCMSTB || COMPILE_TEST)
++	select PINMUX
++	select PINCONF
++	select GENERIC_PINCONF
++	help
++	   Say Y here to enable the Broadcom BCM2712 PINCONF driver.
++
+ config PINCTRL_BCM281XX
+ 	bool "Broadcom BCM281xx pinctrl driver"
+ 	depends on OF && (ARCH_BCM_MOBILE || COMPILE_TEST)
+--- a/drivers/pinctrl/bcm/Makefile
++++ b/drivers/pinctrl/bcm/Makefile
+@@ -1,6 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ # Broadcom pinctrl support
+ 
++obj-$(CONFIG_PINCTRL_BCM2712)		+= pinctrl-bcm2712.o
+ obj-$(CONFIG_PINCTRL_BCM281XX)		+= pinctrl-bcm281xx.o
+ obj-$(CONFIG_PINCTRL_BCM2835)		+= pinctrl-bcm2835.o
+ obj-$(CONFIG_PINCTRL_BCM4908)		+= pinctrl-bcm4908.o
+--- /dev/null
++++ b/drivers/pinctrl/bcm/pinctrl-bcm2712.c
+@@ -0,0 +1,1247 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Driver for Broadcom BCM2712 GPIO units (pinctrl only)
++ *
++ * Copyright (C) 2021-3 Raspberry Pi Ltd.
++ * Copyright (C) 2012 Chris Boot, Simon Arlott, Stephen Warren
++ *
++ * Based heavily on the BCM2835 GPIO & pinctrl driver, which was inspired by:
++ * pinctrl-nomadik.c, please see original file for copyright information
++ * pinctrl-tegra.c, please see original file for copyright information
++ */
++
++#include <linux/bitmap.h>
++#include <linux/bug.h>
++#include <linux/delay.h>
++#include <linux/device.h>
++#include <linux/err.h>
++#include <linux/io.h>
++#include <linux/init.h>
++#include <linux/interrupt.h>
++#include <linux/of_address.h>
++#include <linux/of.h>
++#include <linux/pinctrl/consumer.h>
++#include <linux/pinctrl/machine.h>
++#include <linux/pinctrl/pinconf.h>
++#include <linux/pinctrl/pinctrl.h>
++#include <linux/pinctrl/pinmux.h>
++#include <linux/pinctrl/pinconf-generic.h>
++#include <linux/platform_device.h>
++#include <linux/seq_file.h>
++#include <linux/slab.h>
++#include <linux/spinlock.h>
++#include <linux/types.h>
++
++#define MODULE_NAME "pinctrl-bcm2712"
++
++/* Register offsets */
++
++#define BCM2712_PULL_NONE	0
++#define BCM2712_PULL_DOWN	1
++#define BCM2712_PULL_UP		2
++#define BCM2712_PULL_MASK	0x3
++
++#define BCM2712_FSEL_COUNT 9
++#define BCM2712_FSEL_MASK  0xf
++
++#define FUNC(f) \
++	[func_##f] = #f
++#define PIN(i, f1, f2, f3, f4, f5, f6, f7, f8) \
++	[i] = { \
++		.funcs = { \
++			func_##f1, \
++			func_##f2, \
++			func_##f3, \
++			func_##f4, \
++			func_##f5, \
++			func_##f6, \
++			func_##f7, \
++			func_##f8, \
++		}, \
++	}
++
++#define MUX_BIT_VALID	0x8000
++#define REG_BIT_INVALID	0xffff
++
++#define BIT_TO_REG(b) (((b) >> 5) << 2)
++#define BIT_TO_SHIFT(b) ((b) & 0x1f)
++
++#define MUX_BIT(mr, mb) (MUX_BIT_VALID + ((mr)*4)*8 + (mb)*4)
++#define GPIO_REGS(n, mr, mb, pr, pb) \
++	[n] = { MUX_BIT(mr, mb), ((pr)*4)*8 + (pb)*2 }
++
++#define EMMC_REGS(n, pr, pb) \
++	[n] = { 0, ((pr)*4)*8 + (pb)*2 }
++
++#define AGPIO_REGS(n, mr, mb, pr, pb) \
++	[n] = { MUX_BIT(mr, mb), ((pr)*4)*8 + (pb)*2 }
++
++#define SGPIO_REGS(n, mr, mb) \
++	[n+32] = { MUX_BIT(mr, mb), REG_BIT_INVALID }
++
++#define GPIO_PIN(a) PINCTRL_PIN(a, "gpio" #a)
++#define AGPIO_PIN(a) PINCTRL_PIN(a, "aon_gpio" #a)
++#define SGPIO_PIN(a) PINCTRL_PIN(a+32, "aon_sgpio" #a)
++
++struct pin_regs {
++	u16 mux_bit;
++	u16 pad_bit;
++};
++
++struct bcm2712_pinctrl {
++	struct device *dev;
++	void __iomem *base;
++	struct pinctrl_dev *pctl_dev;
++	struct pinctrl_desc pctl_desc;
++	const struct pin_regs *pin_regs;
++	const struct bcm2712_pin_funcs *pin_funcs;
++	const char *const *gpio_groups;
++	struct pinctrl_gpio_range gpio_range;
++	spinlock_t lock;
++};
++
++struct bcm_plat_data {
++	const struct pinctrl_desc *pctl_desc;
++	const struct pinctrl_gpio_range *gpio_range;
++	const struct pin_regs *pin_regs;
++	const struct bcm2712_pin_funcs *pin_funcs;
++};
++
++struct bcm2712_pin_funcs {
++	u8 funcs[BCM2712_FSEL_COUNT - 1];
++};
++
++enum bcm2712_funcs {
++	func_gpio,
++	func_alt1,
++	func_alt2,
++	func_alt3,
++	func_alt4,
++	func_alt5,
++	func_alt6,
++	func_alt7,
++	func_alt8,
++	func_aon_cpu_standbyb,
++	func_aon_fp_4sec_resetb,
++	func_aon_gpclk,
++	func_aon_pwm,
++	func_arm_jtag,
++	func_aud_fs_clk0,
++	func_avs_pmu_bsc,
++	func_bsc_m0,
++	func_bsc_m1,
++	func_bsc_m2,
++	func_bsc_m3,
++	func_clk_observe,
++	func_ctl_hdmi_5v,
++	func_enet0,
++	func_enet0_mii,
++	func_enet0_rgmii,
++	func_ext_sc_clk,
++	func_fl0,
++	func_fl1,
++	func_gpclk0,
++	func_gpclk1,
++	func_gpclk2,
++	func_hdmi_tx0_auto_i2c,
++	func_hdmi_tx0_bsc,
++	func_hdmi_tx1_auto_i2c,
++	func_hdmi_tx1_bsc,
++	func_i2s_in,
++	func_i2s_out,
++	func_ir_in,
++	func_mtsif,
++	func_mtsif_alt,
++	func_mtsif_alt1,
++	func_pdm,
++	func_pkt,
++	func_pm_led_out,
++	func_sc0,
++	func_sd0,
++	func_sd2,
++	func_sd_card_a,
++	func_sd_card_b,
++	func_sd_card_c,
++	func_sd_card_d,
++	func_sd_card_e,
++	func_sd_card_f,
++	func_sd_card_g,
++	func_spdif_out,
++	func_spi_m,
++	func_spi_s,
++	func_sr_edm_sense,
++	func_te0,
++	func_te1,
++	func_tsio,
++	func_uart0,
++	func_uart1,
++	func_uart2,
++	func_usb_pwr,
++	func_usb_vbus,
++	func_uui,
++	func_vc_i2c0,
++	func_vc_i2c3,
++	func_vc_i2c4,
++	func_vc_i2c5,
++	func_vc_i2csl,
++	func_vc_pcm,
++	func_vc_pwm0,
++	func_vc_pwm1,
++	func_vc_spi0,
++	func_vc_spi3,
++	func_vc_spi4,
++	func_vc_spi5,
++	func_vc_uart0,
++	func_vc_uart2,
++	func_vc_uart3,
++	func_vc_uart4,
++	func__,
++	func_count = func__
++};
++
++static const struct pin_regs bcm2712_c0_gpio_pin_regs[] = {
++	GPIO_REGS(0, 0, 0, 7, 7),
++	GPIO_REGS(1, 0, 1, 7, 8),
++	GPIO_REGS(2, 0, 2, 7, 9),
++	GPIO_REGS(3, 0, 3, 7, 10),
++	GPIO_REGS(4, 0, 4, 7, 11),
++	GPIO_REGS(5, 0, 5, 7, 12),
++	GPIO_REGS(6, 0, 6, 7, 13),
++	GPIO_REGS(7, 0, 7, 7, 14),
++	GPIO_REGS(8, 1, 0, 8, 0),
++	GPIO_REGS(9, 1, 1, 8, 1),
++	GPIO_REGS(10, 1, 2, 8, 2),
++	GPIO_REGS(11, 1, 3, 8, 3),
++	GPIO_REGS(12, 1, 4, 8, 4),
++	GPIO_REGS(13, 1, 5, 8, 5),
++	GPIO_REGS(14, 1, 6, 8, 6),
++	GPIO_REGS(15, 1, 7, 8, 7),
++	GPIO_REGS(16, 2, 0, 8, 8),
++	GPIO_REGS(17, 2, 1, 8, 9),
++	GPIO_REGS(18, 2, 2, 8, 10),
++	GPIO_REGS(19, 2, 3, 8, 11),
++	GPIO_REGS(20, 2, 4, 8, 12),
++	GPIO_REGS(21, 2, 5, 8, 13),
++	GPIO_REGS(22, 2, 6, 8, 14),
++	GPIO_REGS(23, 2, 7, 9, 0),
++	GPIO_REGS(24, 3, 0, 9, 1),
++	GPIO_REGS(25, 3, 1, 9, 2),
++	GPIO_REGS(26, 3, 2, 9, 3),
++	GPIO_REGS(27, 3, 3, 9, 4),
++	GPIO_REGS(28, 3, 4, 9, 5),
++	GPIO_REGS(29, 3, 5, 9, 6),
++	GPIO_REGS(30, 3, 6, 9, 7),
++	GPIO_REGS(31, 3, 7, 9, 8),
++	GPIO_REGS(32, 4, 0, 9, 9),
++	GPIO_REGS(33, 4, 1, 9, 10),
++	GPIO_REGS(34, 4, 2, 9, 11),
++	GPIO_REGS(35, 4, 3, 9, 12),
++	GPIO_REGS(36, 4, 4, 9, 13),
++	GPIO_REGS(37, 4, 5, 9, 14),
++	GPIO_REGS(38, 4, 6, 10, 0),
++	GPIO_REGS(39, 4, 7, 10, 1),
++	GPIO_REGS(40, 5, 0, 10, 2),
++	GPIO_REGS(41, 5, 1, 10, 3),
++	GPIO_REGS(42, 5, 2, 10, 4),
++	GPIO_REGS(43, 5, 3, 10, 5),
++	GPIO_REGS(44, 5, 4, 10, 6),
++	GPIO_REGS(45, 5, 5, 10, 7),
++	GPIO_REGS(46, 5, 6, 10, 8),
++	GPIO_REGS(47, 5, 7, 10, 9),
++	GPIO_REGS(48, 6, 0, 10, 10),
++	GPIO_REGS(49, 6, 1, 10, 11),
++	GPIO_REGS(50, 6, 2, 10, 12),
++	GPIO_REGS(51, 6, 3, 10, 13),
++	GPIO_REGS(52, 6, 4, 10, 14),
++	GPIO_REGS(53, 6, 5, 11, 0),
++	EMMC_REGS(54, 11, 1), /* EMMC_CMD */
++	EMMC_REGS(55, 11, 2), /* EMMC_DS */
++	EMMC_REGS(56, 11, 3), /* EMMC_CLK */
++	EMMC_REGS(57, 11, 4), /* EMMC_DAT0 */
++	EMMC_REGS(58, 11, 5), /* EMMC_DAT1 */
++	EMMC_REGS(59, 11, 6), /* EMMC_DAT2 */
++	EMMC_REGS(60, 11, 7), /* EMMC_DAT3 */
++	EMMC_REGS(61, 11, 8), /* EMMC_DAT4 */
++	EMMC_REGS(62, 11, 9), /* EMMC_DAT5 */
++	EMMC_REGS(63, 11, 10), /* EMMC_DAT6 */
++	EMMC_REGS(64, 11, 11), /* EMMC_DAT7 */
++};
++
++static struct pin_regs bcm2712_c0_aon_gpio_pin_regs[] = {
++	AGPIO_REGS(0, 3, 0, 6, 10),
++	AGPIO_REGS(1, 3, 1, 6, 11),
++	AGPIO_REGS(2, 3, 2, 6, 12),
++	AGPIO_REGS(3, 3, 3, 6, 13),
++	AGPIO_REGS(4, 3, 4, 6, 14),
++	AGPIO_REGS(5, 3, 5, 7, 0),
++	AGPIO_REGS(6, 3, 6, 7, 1),
++	AGPIO_REGS(7, 3, 7, 7, 2),
++	AGPIO_REGS(8, 4, 0, 7, 3),
++	AGPIO_REGS(9, 4, 1, 7, 4),
++	AGPIO_REGS(10, 4, 2, 7, 5),
++	AGPIO_REGS(11, 4, 3, 7, 6),
++	AGPIO_REGS(12, 4, 4, 7, 7),
++	AGPIO_REGS(13, 4, 5, 7, 8),
++	AGPIO_REGS(14, 4, 6, 7, 9),
++	AGPIO_REGS(15, 4, 7, 7, 10),
++	AGPIO_REGS(16, 5, 0, 7, 11),
++	SGPIO_REGS(0, 0, 0),
++	SGPIO_REGS(1, 0, 1),
++	SGPIO_REGS(2, 0, 2),
++	SGPIO_REGS(3, 0, 3),
++	SGPIO_REGS(4, 1, 0),
++	SGPIO_REGS(5, 2, 0),
++};
++
++static const struct pinctrl_pin_desc bcm2712_c0_gpio_pins[] = {
++	GPIO_PIN(0),
++	GPIO_PIN(1),
++	GPIO_PIN(2),
++	GPIO_PIN(3),
++	GPIO_PIN(4),
++	GPIO_PIN(5),
++	GPIO_PIN(6),
++	GPIO_PIN(7),
++	GPIO_PIN(8),
++	GPIO_PIN(9),
++	GPIO_PIN(10),
++	GPIO_PIN(11),
++	GPIO_PIN(12),
++	GPIO_PIN(13),
++	GPIO_PIN(14),
++	GPIO_PIN(15),
++	GPIO_PIN(16),
++	GPIO_PIN(17),
++	GPIO_PIN(18),
++	GPIO_PIN(19),
++	GPIO_PIN(20),
++	GPIO_PIN(21),
++	GPIO_PIN(22),
++	GPIO_PIN(23),
++	GPIO_PIN(24),
++	GPIO_PIN(25),
++	GPIO_PIN(26),
++	GPIO_PIN(27),
++	GPIO_PIN(28),
++	GPIO_PIN(29),
++	GPIO_PIN(30),
++	GPIO_PIN(31),
++	GPIO_PIN(32),
++	GPIO_PIN(33),
++	GPIO_PIN(34),
++	GPIO_PIN(35),
++	GPIO_PIN(36),
++	GPIO_PIN(37),
++	GPIO_PIN(38),
++	GPIO_PIN(39),
++	GPIO_PIN(40),
++	GPIO_PIN(41),
++	GPIO_PIN(42),
++	GPIO_PIN(43),
++	GPIO_PIN(44),
++	GPIO_PIN(45),
++	GPIO_PIN(46),
++	GPIO_PIN(47),
++	GPIO_PIN(48),
++	GPIO_PIN(49),
++	GPIO_PIN(50),
++	GPIO_PIN(51),
++	GPIO_PIN(52),
++	GPIO_PIN(53),
++	PINCTRL_PIN(54, "emmc_cmd"),
++	PINCTRL_PIN(55, "emmc_ds"),
++	PINCTRL_PIN(56, "emmc_clk"),
++	PINCTRL_PIN(57, "emmc_dat0"),
++	PINCTRL_PIN(58, "emmc_dat1"),
++	PINCTRL_PIN(59, "emmc_dat2"),
++	PINCTRL_PIN(60, "emmc_dat3"),
++	PINCTRL_PIN(61, "emmc_dat4"),
++	PINCTRL_PIN(62, "emmc_dat5"),
++	PINCTRL_PIN(63, "emmc_dat6"),
++	PINCTRL_PIN(64, "emmc_dat7"),
++};
++
++static struct pinctrl_pin_desc bcm2712_c0_aon_gpio_pins[] = {
++	AGPIO_PIN(0),
++	AGPIO_PIN(1),
++	AGPIO_PIN(2),
++	AGPIO_PIN(3),
++	AGPIO_PIN(4),
++	AGPIO_PIN(5),
++	AGPIO_PIN(6),
++	AGPIO_PIN(7),
++	AGPIO_PIN(8),
++	AGPIO_PIN(9),
++	AGPIO_PIN(10),
++	AGPIO_PIN(11),
++	AGPIO_PIN(12),
++	AGPIO_PIN(13),
++	AGPIO_PIN(14),
++	AGPIO_PIN(15),
++	AGPIO_PIN(16),
++	SGPIO_PIN(0),
++	SGPIO_PIN(1),
++	SGPIO_PIN(2),
++	SGPIO_PIN(3),
++	SGPIO_PIN(4),
++	SGPIO_PIN(5),
++};
++
++static const struct pin_regs bcm2712_d0_gpio_pin_regs[] = {
++	GPIO_REGS(1, 0, 0, 4, 5),
++	GPIO_REGS(2, 0, 1, 4, 6),
++	GPIO_REGS(3, 0, 2, 4, 7),
++	GPIO_REGS(4, 0, 3, 4, 8),
++	GPIO_REGS(10, 0, 4, 4, 9),
++	GPIO_REGS(11, 0, 5, 4, 10),
++	GPIO_REGS(12, 0, 6, 4, 11),
++	GPIO_REGS(13, 0, 7, 4, 12),
++	GPIO_REGS(14, 1, 0, 4, 13),
++	GPIO_REGS(15, 1, 1, 4, 14),
++	GPIO_REGS(18, 1, 2, 5, 0),
++	GPIO_REGS(19, 1, 3, 5, 1),
++	GPIO_REGS(20, 1, 4, 5, 2),
++	GPIO_REGS(21, 1, 5, 5, 3),
++	GPIO_REGS(22, 1, 6, 5, 4),
++	GPIO_REGS(23, 1, 7, 5, 5),
++	GPIO_REGS(24, 2, 0, 5, 6),
++	GPIO_REGS(25, 2, 1, 5, 7),
++	GPIO_REGS(26, 2, 2, 5, 8),
++	GPIO_REGS(27, 2, 3, 5, 9),
++	GPIO_REGS(28, 2, 4, 5, 10),
++	GPIO_REGS(29, 2, 5, 5, 11),
++	GPIO_REGS(30, 2, 6, 5, 12),
++	GPIO_REGS(31, 2, 7, 5, 13),
++	GPIO_REGS(32, 3, 0, 5, 14),
++	GPIO_REGS(33, 3, 1, 6, 0),
++	GPIO_REGS(34, 3, 2, 6, 1),
++	GPIO_REGS(35, 3, 3, 6, 2),
++	EMMC_REGS(36, 6, 3), /* EMMC_CMD */
++	EMMC_REGS(37, 6, 4), /* EMMC_DS */
++	EMMC_REGS(38, 6, 5), /* EMMC_CLK */
++	EMMC_REGS(39, 6, 6), /* EMMC_DAT0 */
++	EMMC_REGS(40, 6, 7), /* EMMC_DAT1 */
++	EMMC_REGS(41, 6, 8), /* EMMC_DAT2 */
++	EMMC_REGS(42, 6, 9), /* EMMC_DAT3 */
++	EMMC_REGS(43, 6, 10), /* EMMC_DAT4 */
++	EMMC_REGS(44, 6, 11), /* EMMC_DAT5 */
++	EMMC_REGS(45, 6, 12), /* EMMC_DAT6 */
++	EMMC_REGS(46, 6, 13), /* EMMC_DAT7 */
++};
++
++static struct pin_regs bcm2712_d0_aon_gpio_pin_regs[] = {
++	AGPIO_REGS(0, 3, 0, 5, 9),
++	AGPIO_REGS(1, 3, 1, 5, 10),
++	AGPIO_REGS(2, 3, 2, 5, 11),
++	AGPIO_REGS(3, 3, 3, 5, 12),
++	AGPIO_REGS(4, 3, 4, 5, 13),
++	AGPIO_REGS(5, 3, 5, 5, 14),
++	AGPIO_REGS(6, 3, 6, 6, 0),
++	AGPIO_REGS(8, 3, 7, 6, 1),
++	AGPIO_REGS(9, 4, 0, 6, 2),
++	AGPIO_REGS(12, 4, 1, 6, 3),
++	AGPIO_REGS(13, 4, 2, 6, 4),
++	AGPIO_REGS(14, 4, 3, 6, 5),
++	SGPIO_REGS(0, 0, 0),
++	SGPIO_REGS(1, 0, 1),
++	SGPIO_REGS(2, 0, 2),
++	SGPIO_REGS(3, 0, 3),
++	SGPIO_REGS(4, 1, 0),
++	SGPIO_REGS(5, 2, 0),
++};
++
++static const struct pinctrl_pin_desc bcm2712_d0_gpio_pins[] = {
++	GPIO_PIN(1),
++	GPIO_PIN(2),
++	GPIO_PIN(3),
++	GPIO_PIN(4),
++	GPIO_PIN(10),
++	GPIO_PIN(11),
++	GPIO_PIN(12),
++	GPIO_PIN(13),
++	GPIO_PIN(14),
++	GPIO_PIN(15),
++	GPIO_PIN(18),
++	GPIO_PIN(19),
++	GPIO_PIN(20),
++	GPIO_PIN(21),
++	GPIO_PIN(22),
++	GPIO_PIN(23),
++	GPIO_PIN(24),
++	GPIO_PIN(25),
++	GPIO_PIN(26),
++	GPIO_PIN(27),
++	GPIO_PIN(28),
++	GPIO_PIN(29),
++	GPIO_PIN(30),
++	GPIO_PIN(31),
++	GPIO_PIN(32),
++	GPIO_PIN(33),
++	GPIO_PIN(34),
++	GPIO_PIN(35),
++	PINCTRL_PIN(36, "emmc_cmd"),
++	PINCTRL_PIN(37, "emmc_ds"),
++	PINCTRL_PIN(38, "emmc_clk"),
++	PINCTRL_PIN(39, "emmc_dat0"),
++	PINCTRL_PIN(40, "emmc_dat1"),
++	PINCTRL_PIN(41, "emmc_dat2"),
++	PINCTRL_PIN(42, "emmc_dat3"),
++	PINCTRL_PIN(43, "emmc_dat4"),
++	PINCTRL_PIN(44, "emmc_dat5"),
++	PINCTRL_PIN(45, "emmc_dat6"),
++	PINCTRL_PIN(46, "emmc_dat7"),
++};
++
++static struct pinctrl_pin_desc bcm2712_d0_aon_gpio_pins[] = {
++	AGPIO_PIN(0),
++	AGPIO_PIN(1),
++	AGPIO_PIN(2),
++	AGPIO_PIN(3),
++	AGPIO_PIN(4),
++	AGPIO_PIN(5),
++	AGPIO_PIN(6),
++	AGPIO_PIN(8),
++	AGPIO_PIN(9),
++	AGPIO_PIN(12),
++	AGPIO_PIN(13),
++	AGPIO_PIN(14),
++	SGPIO_PIN(0),
++	SGPIO_PIN(1),
++	SGPIO_PIN(2),
++	SGPIO_PIN(3),
++	SGPIO_PIN(4),
++	SGPIO_PIN(5),
++};
++
++static const char * const bcm2712_func_names[] = {
++	FUNC(gpio),
++	FUNC(alt1),
++	FUNC(alt2),
++	FUNC(alt3),
++	FUNC(alt4),
++	FUNC(alt5),
++	FUNC(alt6),
++	FUNC(alt7),
++	FUNC(alt8),
++	FUNC(aon_cpu_standbyb),
++	FUNC(aon_fp_4sec_resetb),
++	FUNC(aon_gpclk),
++	FUNC(aon_pwm),
++	FUNC(arm_jtag),
++	FUNC(aud_fs_clk0),
++	FUNC(avs_pmu_bsc),
++	FUNC(bsc_m0),
++	FUNC(bsc_m1),
++	FUNC(bsc_m2),
++	FUNC(bsc_m3),
++	FUNC(clk_observe),
++	FUNC(ctl_hdmi_5v),
++	FUNC(enet0),
++	FUNC(enet0_mii),
++	FUNC(enet0_rgmii),
++	FUNC(ext_sc_clk),
++	FUNC(fl0),
++	FUNC(fl1),
++	FUNC(gpclk0),
++	FUNC(gpclk1),
++	FUNC(gpclk2),
++	FUNC(hdmi_tx0_auto_i2c),
++	FUNC(hdmi_tx0_bsc),
++	FUNC(hdmi_tx1_auto_i2c),
++	FUNC(hdmi_tx1_bsc),
++	FUNC(i2s_in),
++	FUNC(i2s_out),
++	FUNC(ir_in),
++	FUNC(mtsif),
++	FUNC(mtsif_alt),
++	FUNC(mtsif_alt1),
++	FUNC(pdm),
++	FUNC(pkt),
++	FUNC(pm_led_out),
++	FUNC(sc0),
++	FUNC(sd0),
++	FUNC(sd2),
++	FUNC(sd_card_a),
++	FUNC(sd_card_b),
++	FUNC(sd_card_c),
++	FUNC(sd_card_d),
++	FUNC(sd_card_e),
++	FUNC(sd_card_f),
++	FUNC(sd_card_g),
++	FUNC(spdif_out),
++	FUNC(spi_m),
++	FUNC(spi_s),
++	FUNC(sr_edm_sense),
++	FUNC(te0),
++	FUNC(te1),
++	FUNC(tsio),
++	FUNC(uart0),
++	FUNC(uart1),
++	FUNC(uart2),
++	FUNC(usb_pwr),
++	FUNC(usb_vbus),
++	FUNC(uui),
++	FUNC(vc_i2c0),
++	FUNC(vc_i2c3),
++	FUNC(vc_i2c4),
++	FUNC(vc_i2c5),
++	FUNC(vc_i2csl),
++	FUNC(vc_pcm),
++	FUNC(vc_pwm0),
++	FUNC(vc_pwm1),
++	FUNC(vc_spi0),
++	FUNC(vc_spi3),
++	FUNC(vc_spi4),
++	FUNC(vc_spi5),
++	FUNC(vc_uart0),
++	FUNC(vc_uart2),
++	FUNC(vc_uart3),
++	FUNC(vc_uart4),
++};
++
++static const struct bcm2712_pin_funcs bcm2712_c0_aon_gpio_pin_funcs[] = {
++	PIN(0, ir_in, vc_spi0, vc_uart3, vc_i2c3, te0, vc_i2c0, _, _),
++	PIN(1, vc_pwm0, vc_spi0, vc_uart3, vc_i2c3, te1, aon_pwm, vc_i2c0, vc_pwm1),
++	PIN(2, vc_pwm0, vc_spi0, vc_uart3, ctl_hdmi_5v, fl0, aon_pwm, ir_in, vc_pwm1),
++	PIN(3, ir_in, vc_spi0, vc_uart3, aon_fp_4sec_resetb, fl1, sd_card_g, aon_gpclk, _),
++	PIN(4, gpclk0, vc_spi0, vc_i2csl, aon_gpclk, pm_led_out, aon_pwm, sd_card_g, vc_pwm0),
++	PIN(5, gpclk1, ir_in, vc_i2csl, clk_observe, aon_pwm, sd_card_g, vc_pwm0, _),
++	PIN(6, uart1, vc_uart4, gpclk2, ctl_hdmi_5v, vc_uart0, vc_spi3, _, _),
++	PIN(7, uart1, vc_uart4, gpclk0, aon_pwm, vc_uart0, vc_spi3, _, _),
++	PIN(8, uart1, vc_uart4, vc_i2csl, ctl_hdmi_5v, vc_uart0, vc_spi3, _, _),
++	PIN(9, uart1, vc_uart4, vc_i2csl, aon_pwm, vc_uart0, vc_spi3, _, _),
++	PIN(10, tsio, ctl_hdmi_5v, sc0, spdif_out, vc_spi5, usb_pwr, aon_gpclk, sd_card_f),
++	PIN(11, tsio, uart0, sc0, aud_fs_clk0, vc_spi5, usb_vbus, vc_uart2, sd_card_f),
++	PIN(12, tsio, uart0, vc_uart0, tsio, vc_spi5, usb_pwr, vc_uart2, sd_card_f),
++	PIN(13, bsc_m1, uart0, vc_uart0, uui, vc_spi5, arm_jtag, vc_uart2, vc_i2c3),
++	PIN(14, bsc_m1, uart0, vc_uart0, uui, vc_spi5, arm_jtag, vc_uart2, vc_i2c3),
++	PIN(15, ir_in, aon_fp_4sec_resetb, vc_uart0, pm_led_out, ctl_hdmi_5v, aon_pwm, aon_gpclk, _),
++	PIN(16, aon_cpu_standbyb, gpclk0, pm_led_out, ctl_hdmi_5v, vc_pwm0, usb_pwr, aud_fs_clk0, _),
++};
++
++static const struct bcm2712_pin_funcs bcm2712_c0_aon_sgpio_pin_funcs[] = {
++	PIN(0, hdmi_tx0_bsc, hdmi_tx0_auto_i2c, bsc_m0, vc_i2c0, _, _, _, _),
++	PIN(1, hdmi_tx0_bsc, hdmi_tx0_auto_i2c, bsc_m0, vc_i2c0, _, _, _, _),
++	PIN(2, hdmi_tx1_bsc, hdmi_tx1_auto_i2c, bsc_m1, vc_i2c4, ctl_hdmi_5v, _, _, _),
++	PIN(3, hdmi_tx1_bsc, hdmi_tx1_auto_i2c, bsc_m1, vc_i2c4, _, _, _, _),
++	PIN(4, avs_pmu_bsc, bsc_m2, vc_i2c5, ctl_hdmi_5v, _, _, _, _),
++	PIN(5, avs_pmu_bsc, bsc_m2, vc_i2c5, _, _, _, _, _),
++};
++
++static const struct bcm2712_pin_funcs bcm2712_c0_gpio_pin_funcs[] = {
++	PIN(0, bsc_m3, vc_i2c0, gpclk0, enet0, vc_pwm1, vc_spi0, ir_in, _),
++	PIN(1, bsc_m3, vc_i2c0, gpclk1, enet0, vc_pwm1, sr_edm_sense, vc_spi0, vc_uart3),
++	PIN(2, pdm, i2s_in, gpclk2, vc_spi4, pkt, vc_spi0, vc_uart3, _),
++	PIN(3, pdm, i2s_in, vc_spi4, pkt, vc_spi0, vc_uart3, _, _),
++	PIN(4, pdm, i2s_in, arm_jtag, vc_spi4, pkt, vc_spi0, vc_uart3, _),
++	PIN(5, pdm, vc_i2c3, arm_jtag, sd_card_e, vc_spi4, pkt, vc_pcm, vc_i2c5),
++	PIN(6, pdm, vc_i2c3, arm_jtag, sd_card_e, vc_spi4, pkt, vc_pcm, vc_i2c5),
++	PIN(7, i2s_out, spdif_out, arm_jtag, sd_card_e, vc_i2c3, enet0_rgmii, vc_pcm, vc_spi4),
++	PIN(8, i2s_out, aud_fs_clk0, arm_jtag, sd_card_e, vc_i2c3, enet0_mii, vc_pcm, vc_spi4),
++	PIN(9, i2s_out, aud_fs_clk0, arm_jtag, sd_card_e, enet0_mii, sd_card_c, vc_spi4, _),
++	PIN(10, bsc_m3, mtsif_alt1, i2s_in, i2s_out, vc_spi5, enet0_mii, sd_card_c, vc_spi4),
++	PIN(11, bsc_m3, mtsif_alt1, i2s_in, i2s_out, vc_spi5, enet0_mii, sd_card_c, vc_spi4),
++	PIN(12, spi_s, mtsif_alt1, i2s_in, i2s_out, vc_spi5, vc_i2csl, sd0, sd_card_d),
++	PIN(13, spi_s, mtsif_alt1, i2s_out, usb_vbus, vc_spi5, vc_i2csl, sd0, sd_card_d),
++	PIN(14, spi_s, vc_i2csl, enet0_rgmii, arm_jtag, vc_spi5, vc_pwm0, vc_i2c4, sd_card_d),
++	PIN(15, spi_s, vc_i2csl, vc_spi3, arm_jtag, vc_pwm0, vc_i2c4, gpclk0, _),
++	PIN(16, sd_card_b, i2s_out, vc_spi3, i2s_in, sd0, enet0_rgmii, gpclk1, _),
++	PIN(17, sd_card_b, i2s_out, vc_spi3, i2s_in, ext_sc_clk, sd0, enet0_rgmii, gpclk2),
++	PIN(18, sd_card_b, i2s_out, vc_spi3, i2s_in, sd0, enet0_rgmii, vc_pwm1, _),
++	PIN(19, sd_card_b, usb_pwr, vc_spi3, pkt, spdif_out, sd0, ir_in, vc_pwm1),
++	PIN(20, sd_card_b, uui, vc_uart0, arm_jtag, uart2, usb_pwr, vc_pcm, vc_uart4),
++	PIN(21, usb_pwr, uui, vc_uart0, arm_jtag, uart2, sd_card_b, vc_pcm, vc_uart4),
++	PIN(22, usb_pwr, enet0, vc_uart0, mtsif, uart2, usb_vbus, vc_pcm, vc_i2c5),
++	PIN(23, usb_vbus, enet0, vc_uart0, mtsif, uart2, i2s_out, vc_pcm, vc_i2c5),
++	PIN(24, mtsif, pkt, uart0, enet0_rgmii, enet0_rgmii, vc_i2c4, vc_uart3, _),
++	PIN(25, mtsif, pkt, sc0, uart0, enet0_rgmii, enet0_rgmii, vc_i2c4, vc_uart3),
++	PIN(26, mtsif, pkt, sc0, uart0, enet0_rgmii, vc_uart4, vc_spi5, _),
++	PIN(27, mtsif, pkt, sc0, uart0, enet0_rgmii, vc_uart4, vc_spi5, _),
++	PIN(28, mtsif, pkt, sc0, enet0_rgmii, vc_uart4, vc_spi5, _, _),
++	PIN(29, mtsif, pkt, sc0, enet0_rgmii, vc_uart4, vc_spi5, _, _),
++	PIN(30, mtsif, pkt, sc0, sd2, enet0_rgmii, gpclk0, vc_pwm0, _),
++	PIN(31, mtsif, pkt, sc0, sd2, enet0_rgmii, vc_spi3, vc_pwm0, _),
++	PIN(32, mtsif, pkt, sc0, sd2, enet0_rgmii, vc_spi3, vc_uart3, _),
++	PIN(33, mtsif, pkt, sd2, enet0_rgmii, vc_spi3, vc_uart3, _, _),
++	PIN(34, mtsif, pkt, ext_sc_clk, sd2, enet0_rgmii, vc_spi3, vc_i2c5, _),
++	PIN(35, mtsif, pkt, sd2, enet0_rgmii, vc_spi3, vc_i2c5, _, _),
++	PIN(36, sd0, mtsif, sc0, i2s_in, vc_uart3, vc_uart2, _, _),
++	PIN(37, sd0, mtsif, sc0, vc_spi0, i2s_in, vc_uart3, vc_uart2, _),
++	PIN(38, sd0, mtsif_alt, sc0, vc_spi0, i2s_in, vc_uart3, vc_uart2, _),
++	PIN(39, sd0, mtsif_alt, sc0, vc_spi0, vc_uart3, vc_uart2, _, _),
++	PIN(40, sd0, mtsif_alt, sc0, vc_spi0, bsc_m3, _, _, _),
++	PIN(41, sd0, mtsif_alt, sc0, vc_spi0, bsc_m3, _, _, _),
++	PIN(42, vc_spi0, mtsif_alt, vc_i2c0, sd_card_a, mtsif_alt1, arm_jtag, pdm, spi_m),
++	PIN(43, vc_spi0, mtsif_alt, vc_i2c0, sd_card_a, mtsif_alt1, arm_jtag, pdm, spi_m),
++	PIN(44, vc_spi0, mtsif_alt, enet0, sd_card_a, mtsif_alt1, arm_jtag, pdm, spi_m),
++	PIN(45, vc_spi0, mtsif_alt, enet0, sd_card_a, mtsif_alt1, arm_jtag, pdm, spi_m),
++	PIN(46, vc_spi0, mtsif_alt, sd_card_a, mtsif_alt1, arm_jtag, pdm, spi_m, _),
++	PIN(47, enet0, mtsif_alt, i2s_out, mtsif_alt1, arm_jtag, _, _, _),
++	PIN(48, sc0, usb_pwr, spdif_out, mtsif, _, _, _, _),
++	PIN(49, sc0, usb_pwr, aud_fs_clk0, mtsif, _, _, _, _),
++	PIN(50, sc0, usb_vbus, sc0, _, _, _, _, _),
++	PIN(51, sc0, enet0, sc0, sr_edm_sense, _, _, _, _),
++	PIN(52, sc0, enet0, vc_pwm1, _, _, _, _, _),
++	PIN(53, sc0, enet0_rgmii, ext_sc_clk, _, _, _, _, _),
++};
++
++static const struct bcm2712_pin_funcs bcm2712_d0_aon_gpio_pin_funcs[] = {
++	PIN(0, ir_in, vc_spi0, vc_uart0, vc_i2c3, uart0, vc_i2c0, _, _),
++	PIN(1, vc_pwm0, vc_spi0, vc_uart0, vc_i2c3, uart0, aon_pwm, vc_i2c0, vc_pwm1),
++	PIN(2, vc_pwm0, vc_spi0, vc_uart0, ctl_hdmi_5v, uart0, aon_pwm, ir_in, vc_pwm1),
++	PIN(3, ir_in, vc_spi0, vc_uart0, uart0, sd_card_g, aon_gpclk, _, _),
++	PIN(4, gpclk0, vc_spi0, pm_led_out, aon_pwm, sd_card_g, vc_pwm0, _, _),
++	PIN(5, gpclk1, ir_in, aon_pwm, sd_card_g, vc_pwm0, _, _, _),
++	PIN(6, uart1, vc_uart2, ctl_hdmi_5v, gpclk2, vc_spi3, _, _, _),
++	PIN(7, _, _, _, _, _, _, _, _),
++	PIN(8, uart1, vc_uart2, ctl_hdmi_5v, vc_spi0, vc_spi3, _, _, _),
++	PIN(9, uart1, vc_uart2, vc_uart0, aon_pwm, vc_spi0, vc_uart2, vc_spi3, _),
++	PIN(10, _, _, _, _, _, _, _, _),
++	PIN(11, _, _, _, _, _, _, _, _),
++	PIN(12, uart1, vc_uart2, vc_uart0, vc_spi0, usb_pwr, vc_uart2, vc_spi3, _),
++	PIN(13, bsc_m1, vc_uart0, uui, vc_spi0, arm_jtag, vc_uart2, vc_i2c3, _),
++	PIN(14, bsc_m1, aon_gpclk, vc_uart0, uui, vc_spi0, arm_jtag, vc_uart2, vc_i2c3),
++};
++
++static const struct bcm2712_pin_funcs bcm2712_d0_aon_sgpio_pin_funcs[] = {
++	PIN(0, hdmi_tx0_bsc, hdmi_tx0_auto_i2c, bsc_m0, vc_i2c0, _, _, _, _),
++	PIN(1, hdmi_tx0_bsc, hdmi_tx0_auto_i2c, bsc_m0, vc_i2c0, _, _, _, _),
++	PIN(2, hdmi_tx1_bsc, hdmi_tx1_auto_i2c, bsc_m1, vc_i2c0, ctl_hdmi_5v, _, _, _),
++	PIN(3, hdmi_tx1_bsc, hdmi_tx1_auto_i2c, bsc_m1, vc_i2c0, _, _, _, _),
++	PIN(4, avs_pmu_bsc, bsc_m2, vc_i2c3, ctl_hdmi_5v, _, _, _, _),
++	PIN(5, avs_pmu_bsc, bsc_m2, vc_i2c3, _, _, _, _, _),
++};
++
++static const struct bcm2712_pin_funcs bcm2712_d0_gpio_pin_funcs[] = {
++	PIN(1, vc_i2c0, usb_pwr, gpclk0, sd_card_e, vc_spi3, sr_edm_sense, vc_spi0, vc_uart0),
++	PIN(2, vc_i2c0, usb_pwr, gpclk1, sd_card_e, vc_spi3, clk_observe, vc_spi0, vc_uart0),
++	PIN(3, vc_i2c3, usb_vbus, gpclk2, sd_card_e, vc_spi3, vc_spi0, vc_uart0, _),
++	PIN(4, vc_i2c3, vc_pwm1, vc_spi3, sd_card_e, vc_spi3, vc_spi0, vc_uart0, _),
++	PIN(10, bsc_m3, vc_pwm1, vc_spi3, sd_card_e, vc_spi3, gpclk0, _, _),
++	PIN(11, bsc_m3, vc_spi3, clk_observe, sd_card_c, gpclk1, _, _, _),
++	PIN(12, spi_s, vc_spi3, sd_card_c, sd_card_d, _, _, _, _),
++	PIN(13, spi_s, vc_spi3, sd_card_c, sd_card_d, _, _, _, _),
++	PIN(14, spi_s, uui, arm_jtag, vc_pwm0, vc_i2c0, sd_card_d, _, _),
++	PIN(15, spi_s, uui, arm_jtag, vc_pwm0, vc_i2c0, gpclk0, _, _),
++	PIN(18, sd_card_f, vc_pwm1, _, _, _, _, _, _),
++	PIN(19, sd_card_f, usb_pwr, vc_pwm1, _, _, _, _, _),
++	PIN(20, vc_i2c3, uui, vc_uart0, arm_jtag, vc_uart2, _, _, _),
++	PIN(21, vc_i2c3, uui, vc_uart0, arm_jtag, vc_uart2, _, _, _),
++	PIN(22, sd_card_f, vc_uart0, vc_i2c3, _, _, _, _, _),
++	PIN(23, vc_uart0, vc_i2c3, _, _, _, _, _, _),
++	PIN(24, sd_card_b, vc_spi0, arm_jtag, uart0, usb_pwr, vc_uart2, vc_uart0, _),
++	PIN(25, sd_card_b, vc_spi0, arm_jtag, uart0, usb_pwr, vc_uart2, vc_uart0, _),
++	PIN(26, sd_card_b, vc_spi0, arm_jtag, uart0, usb_vbus, vc_uart2, vc_spi0, _),
++	PIN(27, sd_card_b, vc_spi0, arm_jtag, uart0, vc_uart2, vc_spi0, _, _),
++	PIN(28, sd_card_b, vc_spi0, arm_jtag, vc_i2c0, vc_spi0, _, _, _),
++	PIN(29, arm_jtag, vc_i2c0, vc_spi0, _, _, _, _, _),
++	PIN(30, sd2, gpclk0, vc_pwm0, _, _, _, _, _),
++	PIN(31, sd2, vc_spi3, vc_pwm0, _, _, _, _, _),
++	PIN(32, sd2, vc_spi3, vc_uart3, _, _, _, _, _),
++	PIN(33, sd2, vc_spi3, vc_uart3, _, _, _, _, _),
++	PIN(34, sd2, vc_spi3, vc_i2c5, _, _, _, _, _),
++	PIN(35, sd2, vc_spi3, vc_i2c5, _, _, _, _, _),
++};
++
++static inline u32 bcm2712_reg_rd(struct bcm2712_pinctrl *pc, unsigned reg)
++{
++	return readl(pc->base + reg);
++}
++
++static inline void bcm2712_reg_wr(struct bcm2712_pinctrl *pc, unsigned reg,
++		u32 val)
++{
++	writel(val, pc->base + reg);
++}
++
++static enum bcm2712_funcs bcm2712_pinctrl_fsel_get(
++	struct bcm2712_pinctrl *pc, unsigned pin)
++{
++	u32 bit = pc->pin_regs[pin].mux_bit;
++	enum bcm2712_funcs func;
++	int fsel;
++	u32 val;
++
++	if (!bit)
++		return func_gpio;
++	bit &= ~MUX_BIT_VALID;
++
++	val = bcm2712_reg_rd(pc, BIT_TO_REG(bit));
++	fsel = (val >> BIT_TO_SHIFT(bit)) & BCM2712_FSEL_MASK;
++	func = pc->pin_funcs[pin].funcs[fsel];
++	if (func >= func_count)
++		func = (enum bcm2712_funcs)fsel;
++
++	dev_dbg(pc->dev, "get %04x: %08x (%u => %s)\n",
++		BIT_TO_REG(bit), val, pin,
++		bcm2712_func_names[func]);
++
++	return func;
++}
++
++static void bcm2712_pinctrl_fsel_set(
++	struct bcm2712_pinctrl *pc, unsigned pin,
++	enum bcm2712_funcs func)
++{
++	u32 bit = pc->pin_regs[pin].mux_bit, val;
++	const u8 *pin_funcs;
++	unsigned long flags;
++	int fsel;
++	int cur;
++	int i;
++
++	if (!bit || func >= func_count)
++		return;
++	bit &= ~MUX_BIT_VALID;
++
++	fsel = BCM2712_FSEL_COUNT;
++
++	if (func >= BCM2712_FSEL_COUNT) {
++		/* Convert to an fsel number */
++		pin_funcs = pc->pin_funcs[pin].funcs;
++		for (i = 1; i < BCM2712_FSEL_COUNT; i++) {
++			if (pin_funcs[i - 1] == func) {
++				fsel = i;
++				break;
++			}
++		}
++	} else {
++		fsel = (enum bcm2712_funcs)func;
++	}
++	if (fsel >= BCM2712_FSEL_COUNT)
++		return;
++
++	spin_lock_irqsave(&pc->lock, flags);
++
++	val = bcm2712_reg_rd(pc, BIT_TO_REG(bit));
++	cur = (val >> BIT_TO_SHIFT(bit)) & BCM2712_FSEL_MASK;
++
++	dev_dbg(pc->dev, "read %04x: %08x (%u => %s)\n",
++		BIT_TO_REG(bit), val, pin,
++		bcm2712_func_names[cur]);
++
++	if (cur != fsel) {
++		val &= ~(BCM2712_FSEL_MASK << BIT_TO_SHIFT(bit));
++		val |= fsel << BIT_TO_SHIFT(bit);
++
++		dev_dbg(pc->dev, "write %04x: %08x (%u <= %s)\n",
++			BIT_TO_REG(bit), val, pin,
++			bcm2712_func_names[fsel]);
++		bcm2712_reg_wr(pc, BIT_TO_REG(bit), val);
++	}
++
++	spin_unlock_irqrestore(&pc->lock, flags);
++}
++
++static int bcm2712_pctl_get_groups_count(struct pinctrl_dev *pctldev)
++{
++	struct bcm2712_pinctrl *pc = pinctrl_dev_get_drvdata(pctldev);
++
++	return pc->pctl_desc.npins;
++}
++
++static const char *bcm2712_pctl_get_group_name(struct pinctrl_dev *pctldev,
++		unsigned selector)
++{
++	struct bcm2712_pinctrl *pc = pinctrl_dev_get_drvdata(pctldev);
++
++	return pc->gpio_groups[selector];
++}
++
++static int bcm2712_pctl_get_group_pins(struct pinctrl_dev *pctldev,
++		unsigned selector,
++		const unsigned **pins,
++		unsigned *num_pins)
++{
++	struct bcm2712_pinctrl *pc = pinctrl_dev_get_drvdata(pctldev);
++
++	*pins = &pc->pctl_desc.pins[selector].number;
++	*num_pins = 1;
++
++	return 0;
++}
++
++static void bcm2712_pctl_pin_dbg_show(struct pinctrl_dev *pctldev,
++		struct seq_file *s,
++		unsigned offset)
++{
++	struct bcm2712_pinctrl *pc = pinctrl_dev_get_drvdata(pctldev);
++	enum bcm2712_funcs fsel = bcm2712_pinctrl_fsel_get(pc, offset);
++	const char *fname = bcm2712_func_names[fsel];
++
++	seq_printf(s, "function %s", fname);
++}
++
++static void bcm2712_pctl_dt_free_map(struct pinctrl_dev *pctldev,
++		struct pinctrl_map *maps, unsigned num_maps)
++{
++	int i;
++
++	for (i = 0; i < num_maps; i++)
++		if (maps[i].type == PIN_MAP_TYPE_CONFIGS_PIN)
++			kfree(maps[i].data.configs.configs);
++
++	kfree(maps);
++}
++
++static const struct pinctrl_ops bcm2712_pctl_ops = {
++	.get_groups_count = bcm2712_pctl_get_groups_count,
++	.get_group_name = bcm2712_pctl_get_group_name,
++	.get_group_pins = bcm2712_pctl_get_group_pins,
++	.pin_dbg_show = bcm2712_pctl_pin_dbg_show,
++	.dt_node_to_map = pinconf_generic_dt_node_to_map_all,
++	.dt_free_map = bcm2712_pctl_dt_free_map,
++};
++
++static int bcm2712_pmx_free(struct pinctrl_dev *pctldev,
++		unsigned offset)
++{
++	struct bcm2712_pinctrl *pc = pinctrl_dev_get_drvdata(pctldev);
++
++	/* disable by setting to GPIO */
++	bcm2712_pinctrl_fsel_set(pc, offset, func_gpio);
++	return 0;
++}
++
++static int bcm2712_pmx_get_functions_count(struct pinctrl_dev *pctldev)
++{
++	return func_count;
++}
++
++static const char *bcm2712_pmx_get_function_name(struct pinctrl_dev *pctldev,
++		unsigned selector)
++{
++	return (selector < func_count) ? bcm2712_func_names[selector] : NULL;
++}
++
++static int bcm2712_pmx_get_function_groups(struct pinctrl_dev *pctldev,
++		unsigned selector,
++		const char * const **groups,
++		unsigned * const num_groups)
++{
++	struct bcm2712_pinctrl *pc = pinctrl_dev_get_drvdata(pctldev);
++	/* every pin can do every function */
++	*groups = pc->gpio_groups;
++	*num_groups = pc->pctl_desc.npins;
++
++	return 0;
++}
++
++static int bcm2712_pmx_set(struct pinctrl_dev *pctldev,
++		unsigned func_selector,
++		unsigned group_selector)
++{
++	struct bcm2712_pinctrl *pc = pinctrl_dev_get_drvdata(pctldev);
++	const struct pinctrl_desc *pctldesc = &pc->pctl_desc;
++	const struct pinctrl_pin_desc *pindesc;
++
++	if (group_selector >= pctldesc->npins)
++		return -EINVAL;
++	pindesc = &pctldesc->pins[group_selector];
++	bcm2712_pinctrl_fsel_set(pc, pindesc->number, func_selector);
++
++	return 0;
++}
++static int bcm2712_pmx_gpio_request_enable(struct pinctrl_dev *pctldev,
++					   struct pinctrl_gpio_range *range,
++					   unsigned pin)
++{
++	struct bcm2712_pinctrl *pc = pinctrl_dev_get_drvdata(pctldev);
++
++	bcm2712_pinctrl_fsel_set(pc, pin, func_gpio);
++
++	return 0;
++}
++
++static void bcm2712_pmx_gpio_disable_free(struct pinctrl_dev *pctldev,
++		struct pinctrl_gpio_range *range,
++		unsigned offset)
++{
++	struct bcm2712_pinctrl *pc = pinctrl_dev_get_drvdata(pctldev);
++
++	/* disable by setting to GPIO */
++	bcm2712_pinctrl_fsel_set(pc, offset, func_gpio);
++}
++
++static const struct pinmux_ops bcm2712_pmx_ops = {
++	.free = bcm2712_pmx_free,
++	.get_functions_count = bcm2712_pmx_get_functions_count,
++	.get_function_name = bcm2712_pmx_get_function_name,
++	.get_function_groups = bcm2712_pmx_get_function_groups,
++	.set_mux = bcm2712_pmx_set,
++	.gpio_request_enable = bcm2712_pmx_gpio_request_enable,
++	.gpio_disable_free = bcm2712_pmx_gpio_disable_free,
++};
++
++static unsigned int bcm2712_pull_config_get(struct bcm2712_pinctrl *pc,
++					    unsigned int pin)
++{
++	u32 bit = pc->pin_regs[pin].pad_bit, val;
++
++	if (unlikely(bit == REG_BIT_INVALID))
++	    return BCM2712_PULL_NONE;
++
++	val = bcm2712_reg_rd(pc, BIT_TO_REG(bit));
++	return (val >> BIT_TO_SHIFT(bit)) & BCM2712_PULL_MASK;
++}
++
++static void bcm2712_pull_config_set(struct bcm2712_pinctrl *pc,
++				    unsigned int pin, unsigned int arg)
++{
++	u32 bit = pc->pin_regs[pin].pad_bit, val;
++	unsigned long flags;
++
++	if (unlikely(bit == REG_BIT_INVALID)) {
++	    dev_warn(pc->dev, "can't set pulls for %s\n", pc->gpio_groups[pin]);
++	    return;
++	}
++
++	spin_lock_irqsave(&pc->lock, flags);
++
++	val = bcm2712_reg_rd(pc, BIT_TO_REG(bit));
++	val &= ~(BCM2712_PULL_MASK << BIT_TO_SHIFT(bit));
++	val |= (arg << BIT_TO_SHIFT(bit));
++	bcm2712_reg_wr(pc, BIT_TO_REG(bit), val);
++
++	spin_unlock_irqrestore(&pc->lock, flags);
++}
++
++static int bcm2712_pinconf_get(struct pinctrl_dev *pctldev,
++			unsigned pin, unsigned long *config)
++{
++	struct bcm2712_pinctrl *pc = pinctrl_dev_get_drvdata(pctldev);
++	enum pin_config_param param = pinconf_to_config_param(*config);
++	u32 arg;
++
++	switch (param) {
++	case PIN_CONFIG_BIAS_DISABLE:
++		arg = (bcm2712_pull_config_get(pc, pin) == BCM2712_PULL_NONE);
++		break;
++	case PIN_CONFIG_BIAS_PULL_DOWN:
++		arg = (bcm2712_pull_config_get(pc, pin) == BCM2712_PULL_DOWN);
++		break;
++	case PIN_CONFIG_BIAS_PULL_UP:
++		arg = (bcm2712_pull_config_get(pc, pin) == BCM2712_PULL_UP);
++		break;
++	default:
++		return -ENOTSUPP;
++	}
++
++	*config = pinconf_to_config_packed(param, arg);
++
++	return 0;
++}
++
++static int bcm2712_pinconf_set(struct pinctrl_dev *pctldev,
++			       unsigned int pin, unsigned long *configs,
++			       unsigned int num_configs)
++{
++	struct bcm2712_pinctrl *pc = pinctrl_dev_get_drvdata(pctldev);
++	u32 param, arg;
++	int i;
++
++	for (i = 0; i < num_configs; i++) {
++		param = pinconf_to_config_param(configs[i]);
++		arg = pinconf_to_config_argument(configs[i]);
++
++		switch (param) {
++		case PIN_CONFIG_BIAS_DISABLE:
++			bcm2712_pull_config_set(pc, pin, BCM2712_PULL_NONE);
++			break;
++		case PIN_CONFIG_BIAS_PULL_DOWN:
++			bcm2712_pull_config_set(pc, pin, BCM2712_PULL_DOWN);
++			break;
++		case PIN_CONFIG_BIAS_PULL_UP:
++			bcm2712_pull_config_set(pc, pin, BCM2712_PULL_UP);
++			break;
++		default:
++			return -ENOTSUPP;
++		}
++	} /* for each config */
++
++	return 0;
++}
++
++static const struct pinconf_ops bcm2712_pinconf_ops = {
++	.is_generic = true,
++	.pin_config_get = bcm2712_pinconf_get,
++	.pin_config_set = bcm2712_pinconf_set,
++};
++
++static const struct pinctrl_desc bcm2712_c0_pinctrl_desc = {
++	.name = "pinctrl-bcm2712",
++	.pins = bcm2712_c0_gpio_pins,
++	.npins = ARRAY_SIZE(bcm2712_c0_gpio_pins),
++	.pctlops = &bcm2712_pctl_ops,
++	.pmxops = &bcm2712_pmx_ops,
++	.confops = &bcm2712_pinconf_ops,
++	.owner = THIS_MODULE,
++};
++
++static const struct pinctrl_desc bcm2712_c0_aon_pinctrl_desc = {
++	.name = "aon-pinctrl-bcm2712",
++	.pins = bcm2712_c0_aon_gpio_pins,
++	.npins = ARRAY_SIZE(bcm2712_c0_aon_gpio_pins),
++	.pctlops = &bcm2712_pctl_ops,
++	.pmxops = &bcm2712_pmx_ops,
++	.confops = &bcm2712_pinconf_ops,
++	.owner = THIS_MODULE,
++};
++
++static const struct pinctrl_desc bcm2712_d0_pinctrl_desc = {
++	.name = "pinctrl-bcm2712",
++	.pins = bcm2712_d0_gpio_pins,
++	.npins = ARRAY_SIZE(bcm2712_d0_gpio_pins),
++	.pctlops = &bcm2712_pctl_ops,
++	.pmxops = &bcm2712_pmx_ops,
++	.confops = &bcm2712_pinconf_ops,
++	.owner = THIS_MODULE,
++};
++
++static const struct pinctrl_desc bcm2712_d0_aon_pinctrl_desc = {
++	.name = "aon-pinctrl-bcm2712",
++	.pins = bcm2712_d0_aon_gpio_pins,
++	.npins = ARRAY_SIZE(bcm2712_d0_aon_gpio_pins),
++	.pctlops = &bcm2712_pctl_ops,
++	.pmxops = &bcm2712_pmx_ops,
++	.confops = &bcm2712_pinconf_ops,
++	.owner = THIS_MODULE,
++};
++
++static const struct pinctrl_gpio_range bcm2712_c0_pinctrl_gpio_range = {
++	.name = "pinctrl-bcm2712",
++	.npins = ARRAY_SIZE(bcm2712_c0_gpio_pins),
++};
++
++static const struct pinctrl_gpio_range bcm2712_c0_aon_pinctrl_gpio_range = {
++	.name = "aon-pinctrl-bcm2712",
++	.npins = ARRAY_SIZE(bcm2712_c0_aon_gpio_pins),
++};
++
++static const struct pinctrl_gpio_range bcm2712_d0_pinctrl_gpio_range = {
++	.name = "pinctrl-bcm2712",
++	.npins = ARRAY_SIZE(bcm2712_d0_gpio_pins),
++};
++
++static const struct pinctrl_gpio_range bcm2712_d0_aon_pinctrl_gpio_range = {
++	.name = "aon-pinctrl-bcm2712",
++	.npins = ARRAY_SIZE(bcm2712_d0_aon_gpio_pins),
++};
++
++static const struct bcm_plat_data bcm2712_c0_plat_data = {
++	.pctl_desc = &bcm2712_c0_pinctrl_desc,
++	.gpio_range = &bcm2712_c0_pinctrl_gpio_range,
++	.pin_regs = bcm2712_c0_gpio_pin_regs,
++	.pin_funcs = bcm2712_c0_gpio_pin_funcs,
++};
++
++static const struct bcm_plat_data bcm2712_c0_aon_plat_data = {
++	.pctl_desc = &bcm2712_c0_aon_pinctrl_desc,
++	.gpio_range = &bcm2712_c0_aon_pinctrl_gpio_range,
++	.pin_regs = bcm2712_c0_aon_gpio_pin_regs,
++	.pin_funcs = bcm2712_c0_aon_gpio_pin_funcs,
++};
++
++static const struct bcm_plat_data bcm2712_d0_plat_data = {
++	.pctl_desc = &bcm2712_d0_pinctrl_desc,
++	.gpio_range = &bcm2712_d0_pinctrl_gpio_range,
++	.pin_regs = bcm2712_d0_gpio_pin_regs,
++	.pin_funcs = bcm2712_d0_gpio_pin_funcs,
++};
++
++static const struct bcm_plat_data bcm2712_d0_aon_plat_data = {
++	.pctl_desc = &bcm2712_d0_aon_pinctrl_desc,
++	.gpio_range = &bcm2712_d0_aon_pinctrl_gpio_range,
++	.pin_regs = bcm2712_d0_aon_gpio_pin_regs,
++	.pin_funcs = bcm2712_d0_aon_gpio_pin_funcs,
++};
++
++static const struct of_device_id bcm2712_pinctrl_match[] = {
++	{
++		.compatible = "brcm,bcm2712-pinctrl",
++		.data = &bcm2712_c0_plat_data,
++	},
++	{
++		.compatible = "brcm,bcm2712-aon-pinctrl",
++		.data = &bcm2712_c0_aon_plat_data,
++	},
++
++	{
++		.compatible = "brcm,bcm2712c0-pinctrl",
++		.data = &bcm2712_c0_plat_data,
++	},
++	{
++		.compatible = "brcm,bcm2712c0-aon-pinctrl",
++		.data = &bcm2712_c0_aon_plat_data,
++	},
++
++	{
++		.compatible = "brcm,bcm2712d0-pinctrl",
++		.data = &bcm2712_d0_plat_data,
++	},
++	{
++		.compatible = "brcm,bcm2712d0-aon-pinctrl",
++		.data = &bcm2712_d0_aon_plat_data,
++	},
++	{}
++};
++
++static int bcm2712_pinctrl_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct device_node *np = dev->of_node;
++	const struct bcm_plat_data *pdata;
++	const struct of_device_id *match;
++	struct bcm2712_pinctrl *pc;
++	const char **names;
++	int num_pins, i;
++
++	match = of_match_node(bcm2712_pinctrl_match, np);
++	if (!match)
++		return -EINVAL;
++	pdata = match->data;
++
++	pc = devm_kzalloc(dev, sizeof(*pc), GFP_KERNEL);
++	if (!pc)
++		return -ENOMEM;
++
++	platform_set_drvdata(pdev, pc);
++	pc->dev = dev;
++	spin_lock_init(&pc->lock);
++
++	pc->base = devm_of_iomap(dev, np, 0, NULL);
++	if (IS_ERR(pc->base)) {
++		dev_err(dev, "could not get IO memory\n");
++		return PTR_ERR(pc->base);
++	}
++
++	pc->pctl_desc = *pdata->pctl_desc;
++	num_pins = pc->pctl_desc.npins;
++	names = devm_kmalloc_array(dev, num_pins, sizeof(const char *),
++				   GFP_KERNEL);
++	if (!names)
++		return -ENOMEM;
++	for (i = 0; i < num_pins; i++)
++		names[i] = pc->pctl_desc.pins[i].name;
++	pc->gpio_groups = names;
++	pc->pin_regs = pdata->pin_regs;
++	pc->pin_funcs = pdata->pin_funcs;
++	pc->pctl_dev = devm_pinctrl_register(dev, &pc->pctl_desc, pc);
++	if (IS_ERR(pc->pctl_dev))
++		return PTR_ERR(pc->pctl_dev);
++
++	pc->gpio_range = *pdata->gpio_range;
++	pinctrl_add_gpio_range(pc->pctl_dev, &pc->gpio_range);
++
++	return 0;
++}
++
++static struct platform_driver bcm2712_pinctrl_driver = {
++	.probe = bcm2712_pinctrl_probe,
++	.driver = {
++		.name = MODULE_NAME,
++		.of_match_table = bcm2712_pinctrl_match,
++		.suppress_bind_attrs = true,
++	},
++};
++builtin_platform_driver(bcm2712_pinctrl_driver);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0345-mmc-brcmstb-add-support-for-BCM2712.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0345-mmc-brcmstb-add-support-for-BCM2712.patch
new file mode 100644
index 00000000..e3cd1c70
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0345-mmc-brcmstb-add-support-for-BCM2712.patch
@@ -0,0 +1,445 @@
+From 10d9fcf2545d9acef2281a215e7e92d6c7e88f85 Mon Sep 17 00:00:00 2001
+From: Ulf Hansson <ulf.hansson@linaro.org>
+Date: Thu, 29 Oct 2020 09:57:16 +0800
+Subject: [PATCH 345/697] mmc: brcmstb: add support for BCM2712
+
+BCM2712 has an SD Express capable SDHCI implementation and uses
+the SDIO CFG register block present on other STB chips.
+
+Add plumbing for SD Express handover and BCM2712-specific functions.
+
+Due to the common bus infrastructure between BCM2711 and BCM2712,
+the driver also needs to implement 32-bit IO accessors.
+
+mmc: brcmstb: override card presence if broken-cd is set
+
+Not just if the card is declared as nonremovable.
+
+sdhci: brcmstb: align SD express switchover with SD spec v8.00
+
+Part 1 of the Physical specification, figure 3-24, details the switch
+sequence for cards initially probed as SD. Add a missing check for DAT2
+level after switching VDD2 on.
+
+sdhci: brcmstb: clean up SD Express probe and error handling
+
+Refactor to avoid spurious error messages in dmesg if the requisite SD
+Express DT nodes aren't present.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+mmc: sdhci-brcmstb: only use the delay line PHY for tuneable speeds
+
+The MMC core has a 200MHz core clock which allows the use of DDR50 and
+below without incremental phase tuning. SDR50/SDR104 and the EMMC HS200
+speeds require tuning.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+mmc: sdhci-brcmstb: remove 32-bit accessors for BCM2712
+
+The reason for adding these are lost to the mists of time (and for a
+previous chip revision). Removing these accessors appears to have no ill
+effect on production chips, so get rid of the unnecessary RMW cycles.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+drivers: mmc: sdhci-brcmstb: fix usage of SD_PIN_SEL on BCM2712
+
+The SDIO_CFG register SD_PIN_SEL conflates two settings - whether eMMC
+HS or SD UHS timings are applied to the interface, and whether or not
+the card-detect line is functional. SD_PIN_SEL can only be changed when
+the SD clock isn't running, so add a bcm2712-specific clock setup.
+
+Toggling SD_PIN_SEL at runtime means the integrated card-detect feature
+can't be used, so this controller needs a cd-gpios property.
+
+Also fix conditionals for usage of the delay-line PHY - no-1-8-v will
+imply no bits set in hsemmc_mask or uhs_mask, so remove it.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+drivers: sdhci-brcmstb: set CQE timer clock frequency
+
+CQHCI keeps track of tags in flight with internal timers, so the clock
+frequency driving the timer needs to be specified. The config registers
+default to 0 (100kHz) which means timeouts will be significantly shorter
+than they should be. Assume the timer clock comes from the controller
+base clock.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/host/Kconfig         |   1 +
+ drivers/mmc/host/sdhci-brcmstb.c | 235 +++++++++++++++++++++++++++++--
+ 2 files changed, 227 insertions(+), 9 deletions(-)
+
+--- a/drivers/mmc/host/Kconfig
++++ b/drivers/mmc/host/Kconfig
+@@ -1070,6 +1070,7 @@ config MMC_SDHCI_BRCMSTB
+ 	depends on ARCH_BRCMSTB || ARCH_BCM2835 || BMIPS_GENERIC || COMPILE_TEST
+ 	depends on MMC_SDHCI_PLTFM
+ 	select MMC_CQHCI
++	select OF_DYNAMIC
+ 	default ARCH_BRCMSTB || BMIPS_GENERIC
+ 	help
+ 	  This selects support for the SDIO/SD/MMC Host Controller on
+--- a/drivers/mmc/host/sdhci-brcmstb.c
++++ b/drivers/mmc/host/sdhci-brcmstb.c
+@@ -12,6 +12,8 @@
+ #include <linux/of.h>
+ #include <linux/bitops.h>
+ #include <linux/delay.h>
++#include <linux/pinctrl/consumer.h>
++#include <linux/regulator/consumer.h>
+ 
+ #include "sdhci-cqhci.h"
+ #include "sdhci-pltfm.h"
+@@ -28,29 +30,38 @@
+ 
+ #define BRCMSTB_PRIV_FLAGS_HAS_CQE		BIT(0)
+ #define BRCMSTB_PRIV_FLAGS_GATE_CLOCK		BIT(1)
++#define BRCMSTB_PRIV_FLAGS_HAS_SD_EXPRESS	BIT(2)
+ 
+ #define SDHCI_ARASAN_CQE_BASE_ADDR		0x200
+ 
+ #define SDIO_CFG_CQ_CAPABILITY			0x4c
+-#define SDIO_CFG_CQ_CAPABILITY_FMUL		GENMASK(13, 12)
++#define  SDIO_CFG_CQ_CAPABILITY_FMUL_SHIFT	12
+ 
+ #define SDIO_CFG_CTRL				0x0
+ #define SDIO_CFG_CTRL_SDCD_N_TEST_EN		BIT(31)
+ #define SDIO_CFG_CTRL_SDCD_N_TEST_LEV		BIT(30)
+ 
++#define SDIO_CFG_SD_PIN_SEL			0x44
++#define  SDIO_CFG_SD_PIN_SEL_MASK		0x3
++#define  SDIO_CFG_SD_PIN_SEL_SD			BIT(1)
++#define  SDIO_CFG_SD_PIN_SEL_MMC		BIT(0)
++
+ #define SDIO_CFG_MAX_50MHZ_MODE			0x1ac
+ #define SDIO_CFG_MAX_50MHZ_MODE_STRAP_OVERRIDE	BIT(31)
+ #define SDIO_CFG_MAX_50MHZ_MODE_ENABLE		BIT(0)
+ 
+-#define MMC_CAP_HSE_MASK	(MMC_CAP2_HSX00_1_2V | MMC_CAP2_HSX00_1_8V)
+-/* Select all SD UHS type I SDR speed above 50MB/s */
+-#define MMC_CAP_UHS_I_SDR_MASK	(MMC_CAP_UHS_SDR50 | MMC_CAP_UHS_SDR104)
+-
+ struct sdhci_brcmstb_priv {
+ 	void __iomem *cfg_regs;
+ 	unsigned int flags;
+ 	struct clk *base_clk;
+ 	u32 base_freq_hz;
++	struct regulator *sde_1v8;
++	struct device_node *sde_pcie;
++	void *__iomem sde_ioaddr;
++	void *__iomem sde_ioaddr2;
++	struct pinctrl *pinctrl;
++	struct pinctrl_state *pins_default;
++	struct pinctrl_state *pins_sdex;
+ };
+ 
+ struct brcmstb_match_priv {
+@@ -141,6 +152,42 @@ static void sdhci_brcmstb_hs400es(struct
+ 	writel(reg, host->ioaddr + SDHCI_VENDOR);
+ }
+ 
++static void sdhci_bcm2712_set_clock(struct sdhci_host *host, unsigned int clock)
++{
++	u16 clk;
++	u32 reg;
++	bool is_emmc_rate = false;
++	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
++	struct sdhci_brcmstb_priv *brcmstb_priv = sdhci_pltfm_priv(pltfm_host);
++
++	host->mmc->actual_clock = 0;
++
++	sdhci_writew(host, 0, SDHCI_CLOCK_CONTROL);
++
++	switch (host->mmc->ios.timing) {
++	case MMC_TIMING_MMC_HS400:
++	case MMC_TIMING_MMC_HS200:
++	case MMC_TIMING_MMC_DDR52:
++	case MMC_TIMING_MMC_HS:
++	is_emmc_rate = true;
++	break;
++	}
++
++	reg = readl(brcmstb_priv->cfg_regs + SDIO_CFG_SD_PIN_SEL);
++	reg &= ~SDIO_CFG_SD_PIN_SEL_MASK;
++	if (is_emmc_rate)
++		reg |= SDIO_CFG_SD_PIN_SEL_MMC;
++	else
++		reg |= SDIO_CFG_SD_PIN_SEL_SD;
++	writel(reg, brcmstb_priv->cfg_regs + SDIO_CFG_SD_PIN_SEL);
++
++	if (clock == 0)
++		return;
++
++	clk = sdhci_calc_clk(host, clock, &host->mmc->actual_clock);
++	sdhci_enable_clk(host, clk);
++}
++
+ static void sdhci_brcmstb_set_clock(struct sdhci_host *host, unsigned int clock)
+ {
+ 	u16 clk;
+@@ -156,6 +203,17 @@ static void sdhci_brcmstb_set_clock(stru
+ 	sdhci_enable_clk(host, clk);
+ }
+ 
++static void sdhci_brcmstb_set_power(struct sdhci_host *host, unsigned char mode,
++				  unsigned short vdd)
++{
++	if (!IS_ERR(host->mmc->supply.vmmc)) {
++		struct mmc_host *mmc = host->mmc;
++
++		mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
++	}
++	sdhci_set_power_noreg(host, mode, vdd);
++}
++
+ static void sdhci_brcmstb_set_uhs_signaling(struct sdhci_host *host,
+ 					    unsigned int timing)
+ {
+@@ -190,12 +248,16 @@ static void sdhci_brcmstb_cfginit_2712(s
+ 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ 	struct sdhci_brcmstb_priv *brcmstb_priv = sdhci_pltfm_priv(pltfm_host);
+ 	u32 reg;
++	u32 uhs_mask = (MMC_CAP_UHS_SDR50 | MMC_CAP_UHS_SDR104);
++	u32 hsemmc_mask = (MMC_CAP2_HS200_1_8V_SDR | MMC_CAP2_HS200_1_2V_SDR |
++			   MMC_CAP2_HS400_1_8V | MMC_CAP2_HS400_1_2V);
++	u32 base_clk_mhz;
+ 
+ 	/*
+ 	 * If we support a speed that requires tuning,
+ 	 * then select the delay line PHY as the clock source.
+ 	 */
+-	if ((host->mmc->caps & MMC_CAP_UHS_I_SDR_MASK) || (host->mmc->caps2 & MMC_CAP_HSE_MASK)) {
++	if ((host->mmc->caps & uhs_mask) || (host->mmc->caps2 & hsemmc_mask)) {
+ 		reg = readl(brcmstb_priv->cfg_regs + SDIO_CFG_MAX_50MHZ_MODE);
+ 		reg &= ~SDIO_CFG_MAX_50MHZ_MODE_ENABLE;
+ 		reg |= SDIO_CFG_MAX_50MHZ_MODE_STRAP_OVERRIDE;
+@@ -210,6 +272,109 @@ static void sdhci_brcmstb_cfginit_2712(s
+ 		reg |= SDIO_CFG_CTRL_SDCD_N_TEST_EN;
+ 		writel(reg, brcmstb_priv->cfg_regs + SDIO_CFG_CTRL);
+ 	}
++
++	/* Guesstimate the timer frequency (controller base clock) */
++	base_clk_mhz = max_t(u32, clk_get_rate(pltfm_host->clk) / (1000 * 1000), 1);
++	reg = (3 << SDIO_CFG_CQ_CAPABILITY_FMUL_SHIFT) | base_clk_mhz;
++	writel(reg, brcmstb_priv->cfg_regs + SDIO_CFG_CQ_CAPABILITY);
++}
++
++static int bcm2712_init_sd_express(struct sdhci_host *host, struct mmc_ios *ios)
++{
++	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
++	struct sdhci_brcmstb_priv *brcmstb_priv = sdhci_pltfm_priv(pltfm_host);
++	struct device *dev = host->mmc->parent;
++	u32 ctrl_val;
++	u32 present_state;
++	int ret;
++
++	if (!brcmstb_priv->sde_ioaddr || !brcmstb_priv->sde_ioaddr2)
++		return -EINVAL;
++
++	if (!brcmstb_priv->pinctrl)
++		return -EINVAL;
++
++	/* Turn off the SD clock first */
++	sdhci_set_clock(host, 0);
++
++	/* Disable SD DAT0-3 pulls */
++	pinctrl_select_state(brcmstb_priv->pinctrl, brcmstb_priv->pins_sdex);
++
++	ctrl_val = readl(brcmstb_priv->sde_ioaddr);
++	dev_dbg(dev, "ctrl_val 1 %08x\n", ctrl_val);
++
++	/* Tri-state the SD pins */
++	ctrl_val |= 0x1ff8;
++	writel(ctrl_val, brcmstb_priv->sde_ioaddr);
++	dev_dbg(dev, "ctrl_val 1->%08x (%08x)\n", ctrl_val, readl(brcmstb_priv->sde_ioaddr));
++	/* Let voltages settle */
++	udelay(100);
++
++	/* Enable the PCIe sideband pins */
++	ctrl_val &= ~0x6000;
++	writel(ctrl_val, brcmstb_priv->sde_ioaddr);
++	dev_dbg(dev, "ctrl_val 1->%08x (%08x)\n", ctrl_val, readl(brcmstb_priv->sde_ioaddr));
++	/* Let voltages settle */
++	udelay(100);
++
++	/* Turn on the 1v8 VDD2 regulator */
++	ret = regulator_enable(brcmstb_priv->sde_1v8);
++	if (ret)
++		return ret;
++
++	/* Wait for Tpvcrl */
++	msleep(1);
++
++	/* Sample DAT2 (CLKREQ#) - if low, card is in PCIe mode */
++	present_state = sdhci_readl(host, SDHCI_PRESENT_STATE);
++	present_state = (present_state & SDHCI_DATA_LVL_MASK) >> SDHCI_DATA_LVL_SHIFT;
++	dev_dbg(dev, "state = 0x%08x\n", present_state);
++
++	if (present_state & BIT(2)) {
++		dev_err(dev, "DAT2 still high, abandoning SDex switch\n");
++		return -ENODEV;
++	}
++
++	/* Turn on the LCPLL PTEST mux */
++	ctrl_val = readl(brcmstb_priv->sde_ioaddr2 + 20); // misc5
++	ctrl_val &= ~(0x7 << 7);
++	ctrl_val |= 3 << 7;
++	writel(ctrl_val, brcmstb_priv->sde_ioaddr2 + 20);
++	dev_dbg(dev, "misc 5->%08x (%08x)\n", ctrl_val, readl(brcmstb_priv->sde_ioaddr2 + 20));
++
++	/* PTEST diff driver enable */
++	ctrl_val = readl(brcmstb_priv->sde_ioaddr2);
++	ctrl_val |= BIT(21);
++	writel(ctrl_val, brcmstb_priv->sde_ioaddr2);
++
++	dev_dbg(dev, "misc 0->%08x (%08x)\n", ctrl_val, readl(brcmstb_priv->sde_ioaddr2));
++
++	/* Wait for more than the minimum Tpvpgl time */
++	msleep(100);
++
++	if (brcmstb_priv->sde_pcie) {
++		struct of_changeset changeset;
++		static struct property okay_property = {
++			.name = "status",
++			.value = "okay",
++			.length = 5,
++		};
++
++		/* Enable the pcie controller */
++		of_changeset_init(&changeset);
++		ret = of_changeset_update_property(&changeset,
++						   brcmstb_priv->sde_pcie,
++						   &okay_property);
++		if (ret) {
++			dev_err(dev, "%s: failed to update property - %d\n", __func__,
++			       ret);
++			return -ENODEV;
++		}
++		ret = of_changeset_apply(&changeset);
++	}
++
++	dev_dbg(dev, "%s -> %d\n", __func__, ret);
++	return ret;
+ }
+ 
+ static void sdhci_brcmstb_dumpregs(struct mmc_host *mmc)
+@@ -245,11 +410,12 @@ static struct sdhci_ops sdhci_brcmstb_op
+ };
+ 
+ static struct sdhci_ops sdhci_brcmstb_ops_2712 = {
+-	.set_clock = sdhci_set_clock,
+-	.set_power = sdhci_set_power_and_bus_voltage,
++	.set_clock = sdhci_bcm2712_set_clock,
++	.set_power = sdhci_brcmstb_set_power,
+ 	.set_bus_width = sdhci_set_bus_width,
+ 	.reset = sdhci_reset,
+ 	.set_uhs_signaling = sdhci_set_uhs_signaling,
++	.init_sd_express = bcm2712_init_sd_express,
+ };
+ 
+ static struct sdhci_ops sdhci_brcmstb_ops_7216 = {
+@@ -267,6 +433,8 @@ static struct sdhci_ops sdhci_brcmstb_op
+ };
+ 
+ static const struct brcmstb_match_priv match_priv_2712 = {
++	.flags = BRCMSTB_MATCH_FLAGS_USE_CARD_BUSY,
++	.hs400es = sdhci_brcmstb_hs400es,
+ 	.cfginit = sdhci_brcmstb_cfginit_2712,
+ 	.ops = &sdhci_brcmstb_ops_2712,
+ };
+@@ -372,6 +540,8 @@ static int sdhci_brcmstb_probe(struct pl
+ 	struct sdhci_brcmstb_priv *priv;
+ 	u32 actual_clock_mhz;
+ 	struct sdhci_host *host;
++	struct resource *iomem;
++	bool no_pinctrl = false;
+ 	struct clk *clk;
+ 	struct clk *base_clk = NULL;
+ 	int res;
+@@ -394,12 +564,19 @@ static int sdhci_brcmstb_probe(struct pl
+ 		return PTR_ERR(host);
+ 
+ 	pltfm_host = sdhci_priv(host);
++	pltfm_host->clk = clk;
++
+ 	priv = sdhci_pltfm_priv(pltfm_host);
+ 	if (device_property_read_bool(&pdev->dev, "supports-cqe")) {
+ 		priv->flags |= BRCMSTB_PRIV_FLAGS_HAS_CQE;
+ 		match_priv->ops->irq = sdhci_brcmstb_cqhci_irq;
+ 	}
+ 
++	priv->sde_pcie = of_parse_phandle(pdev->dev.of_node,
++					  "sde-pcie", 0);
++	if (priv->sde_pcie)
++		priv->flags |= BRCMSTB_PRIV_FLAGS_HAS_SD_EXPRESS;
++
+ 	/* Map in the non-standard CFG registers */
+ 	priv->cfg_regs = devm_platform_get_and_ioremap_resource(pdev, 1, NULL);
+ 	if (IS_ERR(priv->cfg_regs)) {
+@@ -412,6 +589,43 @@ static int sdhci_brcmstb_probe(struct pl
+ 	if (res)
+ 		goto err;
+ 
++	priv->sde_1v8 = devm_regulator_get_optional(&pdev->dev, "sde-1v8");
++	if (IS_ERR(priv->sde_1v8))
++		priv->flags &= ~BRCMSTB_PRIV_FLAGS_HAS_SD_EXPRESS;
++
++	iomem = platform_get_resource(pdev, IORESOURCE_MEM, 2);
++	if (iomem) {
++		priv->sde_ioaddr = devm_ioremap_resource(&pdev->dev, iomem);
++		if (IS_ERR(priv->sde_ioaddr))
++			priv->sde_ioaddr = NULL;
++	}
++
++	iomem = platform_get_resource(pdev, IORESOURCE_MEM, 3);
++	if (iomem) {
++		priv->sde_ioaddr2 = devm_ioremap_resource(&pdev->dev, iomem);
++		if (IS_ERR(priv->sde_ioaddr2))
++			priv->sde_ioaddr = NULL;
++	}
++
++	priv->pinctrl = devm_pinctrl_get(&pdev->dev);
++	if (IS_ERR(priv->pinctrl)) {
++			no_pinctrl = true;
++	}
++	priv->pins_default = pinctrl_lookup_state(priv->pinctrl, "default");
++	if (IS_ERR(priv->pins_default)) {
++			dev_dbg(&pdev->dev, "No pinctrl default state\n");
++			no_pinctrl = true;
++	}
++	priv->pins_sdex = pinctrl_lookup_state(priv->pinctrl, "sd-express");
++	if (IS_ERR(priv->pins_sdex)) {
++			dev_dbg(&pdev->dev, "No pinctrl sd-express state\n");
++			no_pinctrl = true;
++	}
++	if (no_pinctrl || !priv->sde_ioaddr || !priv->sde_ioaddr2) {
++		priv->pinctrl = NULL;
++		priv->flags &= ~BRCMSTB_PRIV_FLAGS_HAS_SD_EXPRESS;
++	}
++
+ 	/*
+ 	 * Automatic clock gating does not work for SD cards that may
+ 	 * voltage switch so only enable it for non-removable devices.
+@@ -428,6 +642,10 @@ static int sdhci_brcmstb_probe(struct pl
+ 	    (host->mmc->caps2 & MMC_CAP2_HS400_ES))
+ 		host->mmc_host_ops.hs400_enhanced_strobe = match_priv->hs400es;
+ 
++	if (host->ops->init_sd_express &&
++	    (priv->flags & BRCMSTB_PRIV_FLAGS_HAS_SD_EXPRESS))
++		host->mmc->caps2 |= MMC_CAP2_SD_EXP;
++
+ 	if (match_priv->cfginit)
+ 		match_priv->cfginit(host);
+ 
+@@ -481,7 +699,6 @@ add_host:
+ 	if (res)
+ 		goto err;
+ 
+-	pltfm_host->clk = clk;
+ 	return res;
+ 
+ err:
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0346-sdhci-Add-SD-Express-hook.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0346-sdhci-Add-SD-Express-hook.patch
new file mode 100644
index 00000000..94d1ec3b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0346-sdhci-Add-SD-Express-hook.patch
@@ -0,0 +1,91 @@
+From 36e8354b254c2ac78653d263859c51068996a1f0 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 6 Jul 2021 09:45:36 +0100
+Subject: [PATCH 346/697] sdhci: Add SD Express hook
+
+sdhci: remove PYA0_INTR_BUG quirk. Add quirks to disable some of the higher SDR speeds at 1.8v.
+---
+ drivers/mmc/host/sdhci-of-dwcmshc.c |  6 +++++-
+ drivers/mmc/host/sdhci.c            | 19 +++++++++++++++++++
+ drivers/mmc/host/sdhci.h            |  6 ++++++
+ 3 files changed, 30 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/sdhci-of-dwcmshc.c
++++ b/drivers/mmc/host/sdhci-of-dwcmshc.c
+@@ -1212,7 +1212,11 @@ static const struct dwcmshc_pltfm_data s
+ 		.quirks = SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN |
+ 			  SDHCI_QUIRK_BROKEN_TIMEOUT_VAL,
+ 		.quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN |
+-			   SDHCI_QUIRK2_CLOCK_DIV_ZERO_BROKEN,
++			   SDHCI_QUIRK2_CLOCK_DIV_ZERO_BROKEN |
++			   SDHCI_QUIRK2_NO_SDR50 |
++			   SDHCI_QUIRK2_NO_SDR104 |
++			   SDHCI_QUIRK2_NO_SDR25,
++
+ 	},
+ 	.init = dwcmshc_rk35xx_init,
+ 	.postinit = dwcmshc_rk35xx_postinit,
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -3032,6 +3032,15 @@ static void sdhci_card_event(struct mmc_
+ 	spin_unlock_irqrestore(&host->lock, flags);
+ }
+ 
++static int sdhci_init_sd_express(struct mmc_host *mmc, struct mmc_ios *ios)
++{
++	struct sdhci_host *host = mmc_priv(mmc);
++
++	if (!host->ops->init_sd_express)
++		return -EOPNOTSUPP;
++	return host->ops->init_sd_express(host, ios);
++}
++
+ static const struct mmc_host_ops sdhci_ops = {
+ 	.request	= sdhci_request,
+ 	.post_req	= sdhci_post_req,
+@@ -3047,6 +3056,7 @@ static const struct mmc_host_ops sdhci_o
+ 	.execute_tuning			= sdhci_execute_tuning,
+ 	.card_event			= sdhci_card_event,
+ 	.card_busy	= sdhci_card_busy,
++	.init_sd_express = sdhci_init_sd_express,
+ };
+ 
+ /*****************************************************************************\
+@@ -4565,6 +4575,15 @@ int sdhci_setup_host(struct sdhci_host *
+ 	    !(host->quirks2 & SDHCI_QUIRK2_BROKEN_DDR50))
+ 		mmc->caps |= MMC_CAP_UHS_DDR50;
+ 
++	if (host->quirks2 & SDHCI_QUIRK2_NO_SDR25)
++		mmc->caps &= ~MMC_CAP_UHS_SDR25;
++
++	if (host->quirks2 & SDHCI_QUIRK2_NO_SDR50)
++		mmc->caps &= ~MMC_CAP_UHS_SDR50;
++
++	if (host->quirks2 & SDHCI_QUIRK2_NO_SDR104)
++		mmc->caps &= ~MMC_CAP_UHS_SDR104;
++
+ 	/* Does the host need tuning for SDR50? */
+ 	if (host->caps1 & SDHCI_USE_SDR50_TUNING)
+ 		host->flags |= SDHCI_SDR50_NEEDS_TUNING;
+--- a/drivers/mmc/host/sdhci.h
++++ b/drivers/mmc/host/sdhci.h
+@@ -485,6 +485,11 @@ struct sdhci_host {
+ /* Issue CMD and DATA reset together */
+ #define SDHCI_QUIRK2_ISSUE_CMD_DAT_RESET_TOGETHER	(1<<19)
+ 
++/* Quirks to ignore a speed if a that speed is unreliable */
++#define SDHCI_QUIRK2_NO_SDR25	(1<<19)
++#define SDHCI_QUIRK2_NO_SDR50  (1<<20)
++#define SDHCI_QUIRK2_NO_SDR104	(1<<21)
++
+ 	int irq;		/* Device IRQ */
+ 	void __iomem *ioaddr;	/* Mapped address */
+ 	phys_addr_t mapbase;	/* physical address base */
+@@ -667,6 +672,7 @@ struct sdhci_ops {
+ 	void	(*request_done)(struct sdhci_host *host,
+ 				struct mmc_request *mrq);
+ 	void    (*dump_vendor_regs)(struct sdhci_host *host);
++	int	(*init_sd_express)(struct sdhci_host *host, struct mmc_ios *ios);
+ };
+ 
+ #ifdef CONFIG_MMC_SDHCI_IO_ACCESSORS
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0347-irqchip-irq-bcm2712-mip-Support-for-2712-s-MIP.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0347-irqchip-irq-bcm2712-mip-Support-for-2712-s-MIP.patch
new file mode 100644
index 00000000..6c14f57a
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0347-irqchip-irq-bcm2712-mip-Support-for-2712-s-MIP.patch
@@ -0,0 +1,384 @@
+From 347c75312abe74c177a20383a0e2a893cd9b8083 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 28 Jul 2021 11:13:39 +0100
+Subject: [PATCH 347/697] irqchip: irq-bcm2712-mip: Support for 2712's MIP
+
+irqchip: irq-bcm2712-mip: specify bitmap search size as ilog2(N) not N
+
+Freeing also has the same interface.
+
+irqchip: irq-bcm2712-mip: Fix build warnings
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+irqchip: bcm2712-mip: add a quick hack to optionally shift MSI vectors
+
+There are two MIP peripherals in bcm2712, the first gets a first-class
+treatment where 64 consecutive GIC SPIs are assigned to all 64 output
+vectors. The second gets an agglomeration of 17 GIC SPIs, but only 8 of
+these are consecutive starting at the 8th output vector.
+
+For now, allow the use of this smaller contiguous range within a larger
+whole.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/irqchip/Kconfig           |   8 +
+ drivers/irqchip/Makefile          |   1 +
+ drivers/irqchip/irq-bcm2712-mip.c | 323 ++++++++++++++++++++++++++++++
+ 3 files changed, 332 insertions(+)
+ create mode 100644 drivers/irqchip/irq-bcm2712-mip.c
+
+--- a/drivers/irqchip/Kconfig
++++ b/drivers/irqchip/Kconfig
+@@ -109,6 +109,14 @@ config I8259
+ 	bool
+ 	select IRQ_DOMAIN
+ 
++config BCM2712_MIP
++	bool "Broadcom 2712 MSI-X Interrupt Peripheral support"
++	depends on ARM_GIC
++	select GENERIC_IRQ_CHIP
++	select IRQ_DOMAIN
++	help
++	  Enable support for the Broadcom BCM2712 MSI-X target peripheral.
++
+ config BCM6345_L1_IRQ
+ 	bool
+ 	select GENERIC_IRQ_CHIP
+--- a/drivers/irqchip/Makefile
++++ b/drivers/irqchip/Makefile
+@@ -62,6 +62,7 @@ obj-$(CONFIG_XTENSA_MX)			+= irq-xtensa-
+ obj-$(CONFIG_XILINX_INTC)		+= irq-xilinx-intc.o
+ obj-$(CONFIG_IRQ_CROSSBAR)		+= irq-crossbar.o
+ obj-$(CONFIG_SOC_VF610)			+= irq-vf610-mscm-ir.o
++obj-$(CONFIG_BCM2712_MIP)		+= irq-bcm2712-mip.o
+ obj-$(CONFIG_BCM6345_L1_IRQ)		+= irq-bcm6345-l1.o
+ obj-$(CONFIG_BCM7038_L1_IRQ)		+= irq-bcm7038-l1.o
+ obj-$(CONFIG_BCM7120_L2_IRQ)		+= irq-bcm7120-l2.o
+--- /dev/null
++++ b/drivers/irqchip/irq-bcm2712-mip.c
+@@ -0,0 +1,323 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * Copyright (C) 2021 Raspberry Pi Ltd., All Rights Reserved.
++ */
++
++#include <linux/pci.h>
++#include <linux/msi.h>
++#include <linux/of.h>
++#include <linux/of_address.h>
++#include <linux/of_irq.h>
++#include <linux/of_pci.h>
++
++#include <linux/irqchip.h>
++
++#define MIP_INT_RAISED		0x00
++#define MIP_INT_CLEARED		0x10
++#define MIP_INT_CFGL_HOST	0x20
++#define MIP_INT_CFGH_HOST	0x30
++#define MIP_INT_MASKL_HOST	0x40
++#define MIP_INT_MASKH_HOST	0x50
++#define MIP_INT_MASKL_VPU	0x60
++#define MIP_INT_MASKH_VPU	0x70
++#define MIP_INT_STATUSL_HOST	0x80
++#define MIP_INT_STATUSH_HOST	0x90
++#define MIP_INT_STATUSL_VPU	0xa0
++#define MIP_INT_STATUSH_VPU	0xb0
++
++struct mip_priv {
++	spinlock_t msi_map_lock;
++	spinlock_t hw_lock;
++	void * __iomem base;
++	phys_addr_t msg_addr;
++	u32 msi_base;		/* The SGI number that MSIs start */
++	u32 num_msis;		/* The number of SGIs for MSIs */
++	u32 msi_offset;		/* Shift the allocated msi up by N */
++	unsigned long *msi_map;
++};
++
++static void mip_mask_msi_irq(struct irq_data *d)
++{
++	pci_msi_mask_irq(d);
++	irq_chip_mask_parent(d);
++}
++
++static void mip_unmask_msi_irq(struct irq_data *d)
++{
++	pci_msi_unmask_irq(d);
++	irq_chip_unmask_parent(d);
++}
++
++static void mip_compose_msi_msg(struct irq_data *d, struct msi_msg *msg)
++{
++	struct mip_priv *priv = irq_data_get_irq_chip_data(d);
++
++	msg->address_hi = upper_32_bits(priv->msg_addr);
++	msg->address_lo = lower_32_bits(priv->msg_addr);
++	msg->data = d->hwirq;
++}
++
++// The "bus-specific" irq_chip (the MIP doesn't _have_ to be used with PCIe)
++
++static struct irq_chip mip_msi_irq_chip = {
++	.name			= "MIP-MSI",
++	.irq_unmask		= mip_unmask_msi_irq,
++	.irq_mask		= mip_mask_msi_irq,
++	.irq_eoi		= irq_chip_eoi_parent,
++	.irq_set_affinity	= irq_chip_set_affinity_parent,
++};
++
++static struct msi_domain_info mip_msi_domain_info = {
++	.flags	= (MSI_FLAG_USE_DEF_DOM_OPS | MSI_FLAG_USE_DEF_CHIP_OPS |
++		   MSI_FLAG_PCI_MSIX),
++	.chip	= &mip_msi_irq_chip,
++};
++
++// The "middle" irq_chip (the hardware control part)
++
++static struct irq_chip mip_irq_chip = {
++	.name			= "MIP",
++	.irq_mask		= irq_chip_mask_parent,
++	.irq_unmask		= irq_chip_unmask_parent,
++	.irq_eoi		= irq_chip_eoi_parent,
++	.irq_set_affinity	= irq_chip_set_affinity_parent,
++	.irq_set_type		= irq_chip_set_type_parent,
++	.irq_compose_msi_msg	= mip_compose_msi_msg,
++};
++
++
++// And a domain to connect it to its parent (the GIC)
++
++static int mip_irq_domain_alloc(struct irq_domain *domain,
++				unsigned int virq, unsigned int nr_irqs,
++				void *args)
++{
++	struct mip_priv *priv = domain->host_data;
++	struct irq_fwspec fwspec;
++	struct irq_data *irqd;
++	int hwirq, ret, i;
++
++	spin_lock(&priv->msi_map_lock);
++
++	hwirq = bitmap_find_free_region(priv->msi_map, priv->num_msis, ilog2(nr_irqs));
++
++	spin_unlock(&priv->msi_map_lock);
++
++	if (hwirq < 0)
++		return -ENOSPC;
++
++	hwirq += priv->msi_offset;
++	fwspec.fwnode = domain->parent->fwnode;
++	fwspec.param_count = 3;
++	fwspec.param[0] = 0;
++	fwspec.param[1] = hwirq + priv->msi_base;
++	fwspec.param[2] = IRQ_TYPE_EDGE_RISING;
++
++	ret = irq_domain_alloc_irqs_parent(domain, virq, nr_irqs, &fwspec);
++	if (ret)
++	    return ret;
++
++	for (i = 0; i < nr_irqs; i++) {
++		irqd = irq_domain_get_irq_data(domain->parent, virq + i);
++		irqd->chip->irq_set_type(irqd, IRQ_TYPE_EDGE_RISING);
++
++		irq_domain_set_hwirq_and_chip(domain, virq + i, hwirq + i,
++					      &mip_irq_chip, priv);
++		irqd = irq_get_irq_data(virq + i);
++		irqd_set_single_target(irqd);
++		irqd_set_affinity_on_activate(irqd);
++	}
++
++	return 0;
++}
++
++static void mip_irq_domain_free(struct irq_domain *domain,
++				unsigned int virq, unsigned int nr_irqs)
++{
++	struct irq_data *d = irq_domain_get_irq_data(domain, virq);
++	struct mip_priv *priv = irq_data_get_irq_chip_data(d);
++
++	irq_domain_free_irqs_parent(domain, virq, nr_irqs);
++	d->hwirq -= priv->msi_offset;
++
++	spin_lock(&priv->msi_map_lock);
++
++	bitmap_release_region(priv->msi_map, d->hwirq, ilog2(nr_irqs));
++
++	spin_unlock(&priv->msi_map_lock);
++}
++
++#if 0
++static int mip_irq_domain_activate(struct irq_domain *domain,
++				   struct irq_data *d, bool reserve)
++{
++	struct mip_priv *priv = irq_data_get_irq_chip_data(d);
++	unsigned long flags;
++	unsigned int irq = d->hwirq;
++	void *__iomem reg = priv->base +
++		((irq < 32) ? MIP_INT_MASKL_HOST : MIP_INT_MASKH_HOST);
++	u32 val;
++
++	spin_lock_irqsave(&priv->hw_lock, flags);
++	val = readl(reg);
++	val &= ~(1 << (irq % 32)); // Clear the mask
++	writel(val, reg);
++	spin_unlock_irqrestore(&priv->hw_lock, flags);
++	return 0;
++}
++
++static void mip_irq_domain_deactivate(struct irq_domain *domain,
++				      struct irq_data *d)
++{
++	struct mip_priv *priv = irq_data_get_irq_chip_data(d);
++	unsigned long flags;
++	unsigned int irq = d->hwirq - priv->msi_base;
++	void *__iomem reg = priv->base +
++		((irq < 32) ? MIP_INT_MASKL_HOST : MIP_INT_MASKH_HOST);
++	u32 val;
++
++	spin_lock_irqsave(&priv->hw_lock, flags);
++	val = readl(reg);
++	val |= (1 << (irq % 32)); // Mask it out
++	writel(val, reg);
++	spin_unlock_irqrestore(&priv->hw_lock, flags);
++}
++#endif
++
++static const struct irq_domain_ops mip_irq_domain_ops = {
++	.alloc		= mip_irq_domain_alloc,
++	.free		= mip_irq_domain_free,
++	//.activate	= mip_irq_domain_activate,
++	//.deactivate	= mip_irq_domain_deactivate,
++};
++
++static int mip_init_domains(struct mip_priv *priv,
++			    struct device_node *node)
++{
++	struct irq_domain *middle_domain, *msi_domain, *gic_domain;
++	struct device_node *gic_node;
++
++	gic_node = of_irq_find_parent(node);
++	if (!gic_node) {
++		pr_err("Failed to find the GIC node\n");
++		return -ENODEV;
++	}
++
++	gic_domain = irq_find_host(gic_node);
++	if (!gic_domain) {
++		pr_err("Failed to find the GIC domain\n");
++		return -ENXIO;
++	}
++
++	middle_domain = irq_domain_add_hierarchy(gic_domain, 0, 0, NULL,
++						 &mip_irq_domain_ops,
++						 priv);
++	if (!middle_domain) {
++		pr_err("Failed to create the MIP middle domain\n");
++		return -ENOMEM;
++	}
++
++	msi_domain = pci_msi_create_irq_domain(of_node_to_fwnode(node),
++					       &mip_msi_domain_info,
++					       middle_domain);
++	if (!msi_domain) {
++		pr_err("Failed to create MSI domain\n");
++		irq_domain_remove(middle_domain);
++		return -ENOMEM;
++	}
++
++	return 0;
++}
++
++static int __init mip_of_msi_init(struct device_node *node,
++				  struct device_node *parent)
++{
++	struct mip_priv *priv;
++	struct resource res;
++	int ret;
++
++	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	spin_lock_init(&priv->msi_map_lock);
++	spin_lock_init(&priv->hw_lock);
++
++	ret = of_address_to_resource(node, 0, &res);
++	if (ret) {
++		pr_err("Failed to allocate resource\n");
++		goto err_priv;
++	}
++
++	if (of_property_read_u32(node, "brcm,msi-base-spi", &priv->msi_base)) {
++		pr_err("Unable to parse MSI base\n");
++		ret = -EINVAL;
++		goto err_priv;
++	}
++
++	if (of_property_read_u32(node, "brcm,msi-num-spis", &priv->num_msis)) {
++		pr_err("Unable to parse MSI numbers\n");
++		ret = -EINVAL;
++		goto err_priv;
++	}
++
++	if (of_property_read_u32(node, "brcm,msi-offset", &priv->msi_offset))
++		priv->msi_offset = 0;
++
++	if (of_property_read_u64(node, "brcm,msi-pci-addr", &priv->msg_addr)) {
++		pr_err("Unable to parse MSI address\n");
++		ret = -EINVAL;
++		goto err_priv;
++	}
++
++	priv->base = ioremap(res.start, resource_size(&res));
++	if (!priv->base) {
++		pr_err("Failed to ioremap regs\n");
++		ret = -ENOMEM;
++		goto err_priv;
++	}
++
++	priv->msi_map = kcalloc(BITS_TO_LONGS(priv->num_msis),
++				sizeof(*priv->msi_map),
++				GFP_KERNEL);
++	if (!priv->msi_map) {
++		ret = -ENOMEM;
++		goto err_base;
++	}
++
++	pr_debug("Registering %d msixs, starting at %d\n",
++		 priv->num_msis, priv->msi_base);
++
++	/*
++	 * Begin with all MSI-Xs masked in for the host, masked out for the
++	 * VPU, and edge-triggered.
++	 */
++	writel(0, priv->base + MIP_INT_MASKL_HOST);
++	writel(0, priv->base + MIP_INT_MASKH_HOST);
++	writel(~0, priv->base + MIP_INT_MASKL_VPU);
++	writel(~0, priv->base + MIP_INT_MASKH_VPU);
++	writel(~0, priv->base + MIP_INT_CFGL_HOST);
++	writel(~0, priv->base + MIP_INT_CFGH_HOST);
++
++	ret = mip_init_domains(priv, node);
++	if (ret) {
++		pr_err("Failed to allocate msi_map\n");
++		goto err_map;
++	}
++
++	return 0;
++
++err_map:
++	kfree(priv->msi_map);
++
++err_base:
++	iounmap(priv->base);
++
++err_priv:
++	kfree(priv);
++
++	pr_err("%s: failed - err %d\n", __func__, ret);
++
++	return ret;
++}
++IRQCHIP_DECLARE(bcm_mip, "brcm,bcm2712-mip-intc", mip_of_msi_init);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0348-reset-reset-brcmstb-rescal-Support-shared-use.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0348-reset-reset-brcmstb-rescal-Support-shared-use.patch
new file mode 100644
index 00000000..1941dfa7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0348-reset-reset-brcmstb-rescal-Support-shared-use.patch
@@ -0,0 +1,47 @@
+From 0acd87ba1731d307461a8cbdf877e8317b730f97 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 7 Sep 2021 14:49:00 +0100
+Subject: [PATCH 348/697] reset: reset-brcmstb-rescal: Support shared use
+
+reset_control_reset should not be used with shared reset controllers.
+Add support for reset_control_assert and _deassert to get the desired
+behaviour and avoid ugly warnings in the kernel log.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/reset/reset-brcmstb-rescal.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/reset/reset-brcmstb-rescal.c
++++ b/drivers/reset/reset-brcmstb-rescal.c
+@@ -20,6 +20,7 @@ struct brcm_rescal_reset {
+ 	struct reset_controller_dev rcdev;
+ };
+ 
++/* Also doubles a deassert */
+ static int brcm_rescal_reset_set(struct reset_controller_dev *rcdev,
+ 				 unsigned long id)
+ {
+@@ -52,6 +53,13 @@ static int brcm_rescal_reset_set(struct
+ 	return 0;
+ }
+ 
++/* A dummy function - deassert/reset does all the work */
++static int brcm_rescal_reset_assert(struct reset_controller_dev *rcdev,
++				    unsigned long id)
++{
++	return 0;
++}
++
+ static int brcm_rescal_reset_xlate(struct reset_controller_dev *rcdev,
+ 				   const struct of_phandle_args *reset_spec)
+ {
+@@ -61,6 +69,8 @@ static int brcm_rescal_reset_xlate(struc
+ 
+ static const struct reset_control_ops brcm_rescal_reset_ops = {
+ 	.reset = brcm_rescal_reset_set,
++	.deassert = brcm_rescal_reset_set,
++	.assert = brcm_rescal_reset_assert,
+ };
+ 
+ static int brcm_rescal_reset_probe(struct platform_device *pdev)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0349-net-macb-Also-set-DMA-coherent-mask.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0349-net-macb-Also-set-DMA-coherent-mask.patch
new file mode 100644
index 00000000..2100a134
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0349-net-macb-Also-set-DMA-coherent-mask.patch
@@ -0,0 +1,419 @@
+From a7d42f9b71e51c2a69fa5a876c0b0e98b4189215 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 10 Sep 2021 17:20:45 +0100
+Subject: [PATCH 349/697] net: macb: Also set DMA coherent mask
+
+macb: Add device tree properties that allow configuration of the AXI max pipeline register
+
+net: macb: add support for ethtool interrupt moderation configuration
+
+Only global throttling of rx or tx by time quanta is supported.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+macb: add platform device shutdown function. Prevents AXI master over PCIE from hanging when the host is rebooted.
+
+net: macb: increase polling interval for MDIO completion
+
+MDIO is a slow bus (single-digit MHz). Polling at 1us intervals
+is a bit aggressive, so increase to 100us as the transaction
+usually takes 100-200us to complete.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+net: macb: Several patches for RP1
+
+64-bit RX fix
+
+Also set DMA coherent mask
+
+Add device tree properties that allow configuration of the AXI max
+pipeline register
+
+Add support for ethtool interrupt moderation configuration
+
+Only global throttling of rx or tx by time quanta is supported.
+
+Add platform device shutdown function. Prevents AXI master over PCIE
+from hanging when the host is rebooted.
+
+Increase polling interval for MDIO completion
+
+MDIO is a slow bus (single-digit MHz). Polling at 1us intervals
+is a bit aggressive, so increase to 100us as the transaction
+usually takes 100-200us to complete.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+net: macb: Support the phy-reset-gpios property
+
+Allow a PHY to be reset with an optional GPIO. The reset duration can
+be specified in milliseconds - the default is 10ms.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+drivers: net: macb: close device on driver shutdown
+
+Fix some suspicious locking and instead call into macb_close, which
+deregisters and frees all resources the corresponding macb_open
+claimed.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+net: macb: add hack to prevent TX stalls in a quiet system
+
+See https://github.com/raspberrypi/linux-2712/issues/89
+
+There is some critical window during TX where a further write to the
+TSTART bit while TX is active does not cause newly queued TX descriptors
+to be consumed.
+
+For now "wait a bit, then try anyway" seems to work.
+
+Requires further investigation, but this unsticks NFS reliably.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+net: macb: set default interrupt moderation for GEM hardware
+
+Defaulting to intmod = 0 is antisocial, as the MAC can generate over
+130,000 interrupts per second. 50us is a sensible default.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/net/ethernet/cadence/macb.h      |  25 ++++
+ drivers/net/ethernet/cadence/macb_main.c | 152 ++++++++++++++++++++++-
+ 2 files changed, 175 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/cadence/macb.h
++++ b/drivers/net/ethernet/cadence/macb.h
+@@ -86,6 +86,8 @@
+ #define GEM_PBUFRXCUT		0x0044 /* RX Partial Store and Forward */
+ #define GEM_JML			0x0048 /* Jumbo Max Length */
+ #define GEM_HS_MAC_CONFIG	0x0050 /* GEM high speed config */
++#define GEM_AMP			0x0054 /* AXI Max Pipeline */
++#define GEM_INTMOD		0x005c /* Interrupt moderation */
+ #define GEM_HRB			0x0080 /* Hash Bottom */
+ #define GEM_HRT			0x0084 /* Hash Top */
+ #define GEM_SA1B		0x0088 /* Specific1 Bottom */
+@@ -348,6 +350,21 @@
+ #define GEM_ADDR64_OFFSET	30 /* Address bus width - 64b or 32b */
+ #define GEM_ADDR64_SIZE		1
+ 
++/* Bitfields in AMP */
++#define GEM_AR2R_MAX_PIPE_OFFSET	0  /* Maximum number of outstanding AXI read requests */
++#define GEM_AR2R_MAX_PIPE_SIZE		8
++#define GEM_AW2W_MAX_PIPE_OFFSET	8  /* Maximum number of outstanding AXI write requests */
++#define GEM_AW2W_MAX_PIPE_SIZE		8
++#define GEM_AW2B_FILL_OFFSET		16 /* Select wether the max AW2W transactions operates between: */
++#define GEM_AW2B_FILL_AW2W		0  /*   0: the AW to W AXI channel */
++#define GEM_AW2B_FILL_AW2B		1  /*   1: AW to B channel */
++#define GEM_AW2B_FILL_SIZE              1
++
++/* Bitfields in INTMOD */
++#define GEM_RX_MODERATION_OFFSET	0  /* RX interrupt moderation */
++#define GEM_RX_MODERATION_SIZE		8
++#define GEM_TX_MODERATION_OFFSET	16 /* TX interrupt moderation */
++#define GEM_TX_MODERATION_SIZE		8
+ 
+ /* Bitfields in PBUFRXCUT */
+ #define GEM_ENCUTTHRU_OFFSET	31 /* Enable RX partial store and forward */
+@@ -813,6 +830,7 @@
+ 	})
+ 
+ #define MACB_READ_NSR(bp)	macb_readl(bp, NSR)
++#define MACB_READ_TSR(bp)	macb_readl(bp, TSR)
+ 
+ /* struct macb_dma_desc - Hardware DMA descriptor
+  * @addr: DMA address of data buffer
+@@ -1229,6 +1247,7 @@ struct macb_queue {
+ 	dma_addr_t		tx_ring_dma;
+ 	struct work_struct	tx_error_task;
+ 	bool			txubr_pending;
++	bool			tx_pending;
+ 	struct napi_struct	napi_tx;
+ 
+ 	dma_addr_t		rx_ring_dma;
+@@ -1294,9 +1313,15 @@ struct macb {
+ 
+ 	u32			caps;
+ 	unsigned int		dma_burst_length;
++	u8			aw2w_max_pipe;
++	u8			ar2r_max_pipe;
++	bool			use_aw2b_fill;
+ 
+ 	phy_interface_t		phy_interface;
+ 
++	struct gpio_desc	*phy_reset_gpio;
++	int			phy_reset_ms;
++
+ 	/* AT91RM9200 transmit queue (1 on wire + 1 queued) */
+ 	struct macb_tx_skb	rm9200_txq[2];
+ 	unsigned int		max_tx_length;
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -41,6 +41,9 @@
+ #include <linux/inetdevice.h>
+ #include "macb.h"
+ 
++static unsigned int txdelay = 35;
++module_param(txdelay, uint, 0644);
++
+ /* This structure is only used for MACB on SiFive FU540 devices */
+ struct sifive_fu540_macb_mgmt {
+ 	void __iomem *reg;
+@@ -334,7 +337,7 @@ static int macb_mdio_wait_for_idle(struc
+ 	u32 val;
+ 
+ 	return readx_poll_timeout(MACB_READ_NSR, bp, val, val & MACB_BIT(IDLE),
+-				  1, MACB_MDIO_TIMEOUT);
++				  100, MACB_MDIO_TIMEOUT);
+ }
+ 
+ static int macb_mdio_read_c22(struct mii_bus *bus, int mii_id, int regnum)
+@@ -493,6 +496,19 @@ mdio_pm_exit:
+ 	return status;
+ }
+ 
++static int macb_mdio_reset(struct mii_bus *bus)
++{
++	struct macb *bp = bus->priv;
++
++	if (bp->phy_reset_gpio) {
++		gpiod_set_value_cansleep(bp->phy_reset_gpio, 1);
++		msleep(bp->phy_reset_ms);
++		gpiod_set_value_cansleep(bp->phy_reset_gpio, 0);
++	}
++
++	return 0;
++}
++
+ static void macb_init_buffers(struct macb *bp)
+ {
+ 	struct macb_queue *queue;
+@@ -977,6 +993,7 @@ static int macb_mii_init(struct macb *bp
+ 	bp->mii_bus->write = &macb_mdio_write_c22;
+ 	bp->mii_bus->read_c45 = &macb_mdio_read_c45;
+ 	bp->mii_bus->write_c45 = &macb_mdio_write_c45;
++	bp->mii_bus->reset = &macb_mdio_reset;
+ 	snprintf(bp->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
+ 		 bp->pdev->name, bp->pdev->id);
+ 	bp->mii_bus->priv = bp;
+@@ -1648,6 +1665,11 @@ static int macb_rx(struct macb_queue *qu
+ 
+ 		macb_init_rx_ring(queue);
+ 		queue_writel(queue, RBQP, queue->rx_ring_dma);
++#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
++		if (bp->hw_dma_cap & HW_DMA_CAP_64B)
++			macb_writel(bp, RBQPH,
++				    upper_32_bits(queue->rx_ring_dma));
++#endif
+ 
+ 		macb_writel(bp, NCR, ctrl | MACB_BIT(RE));
+ 
+@@ -1948,8 +1970,9 @@ static irqreturn_t macb_interrupt(int ir
+ 				queue_writel(queue, ISR, MACB_BIT(TCOMP) |
+ 							 MACB_BIT(TXUBR));
+ 
+-			if (status & MACB_BIT(TXUBR)) {
++			if (status & MACB_BIT(TXUBR) || queue->tx_pending) {
+ 				queue->txubr_pending = true;
++				queue->tx_pending = 0;
+ 				wmb(); // ensure softirq can see update
+ 			}
+ 
+@@ -2402,6 +2425,11 @@ static netdev_tx_t macb_start_xmit(struc
+ 	skb_tx_timestamp(skb);
+ 
+ 	spin_lock_irq(&bp->lock);
++
++	/* TSTART write might get dropped, so make the IRQ retrigger a buffer read */
++	if (macb_readl(bp, TSR) & MACB_BIT(TGO))
++		queue->tx_pending = 1;
++
+ 	macb_writel(bp, NCR, macb_readl(bp, NCR) | MACB_BIT(TSTART));
+ 	spin_unlock_irq(&bp->lock);
+ 
+@@ -2808,6 +2836,37 @@ static void macb_configure_dma(struct ma
+ 	}
+ }
+ 
++static void gem_init_axi(struct macb *bp)
++{
++	u32 amp;
++
++	/* AXI pipeline setup - don't touch values unless specified in device
++	 * tree. Some hardware could have reset values > 1.
++	 */
++	amp = gem_readl(bp, AMP);
++
++	if (bp->use_aw2b_fill)
++		amp = GEM_BFINS(AW2B_FILL, bp->use_aw2b_fill, amp);
++	if (bp->aw2w_max_pipe)
++		amp = GEM_BFINS(AW2W_MAX_PIPE, bp->aw2w_max_pipe, amp);
++	if (bp->ar2r_max_pipe)
++		amp = GEM_BFINS(AR2R_MAX_PIPE, bp->ar2r_max_pipe, amp);
++
++	gem_writel(bp, AMP, amp);
++}
++
++static void gem_init_intmod(struct macb *bp)
++{
++	unsigned int throttle;
++	u32 intmod = 0;
++
++	/* Use sensible interrupt moderation thresholds (50us rx and tx) */
++	throttle = (1000 * 50) / 800;
++	intmod = GEM_BFINS(TX_MODERATION, throttle, intmod);
++	intmod = GEM_BFINS(RX_MODERATION, throttle, intmod);
++	gem_writel(bp, INTMOD, intmod);
++}
++
+ static void macb_init_hw(struct macb *bp)
+ {
+ 	u32 config;
+@@ -2836,6 +2895,11 @@ static void macb_init_hw(struct macb *bp
+ 	if (bp->caps & MACB_CAPS_JUMBO)
+ 		bp->rx_frm_len_mask = MACB_RX_JFRMLEN_MASK;
+ 
++	if (macb_is_gem(bp)) {
++		gem_init_axi(bp);
++		gem_init_intmod(bp);
++	}
++
+ 	macb_configure_dma(bp);
+ 
+ 	/* Enable RX partial store and forward and set watermark */
+@@ -3197,6 +3261,52 @@ static void gem_get_ethtool_strings(stru
+ 	}
+ }
+ 
++static int gem_set_coalesce(struct net_device *dev,
++			    struct ethtool_coalesce *ec,
++			    struct kernel_ethtool_coalesce *kernel_coal,
++			    struct netlink_ext_ack *extack)
++{
++	struct macb *bp = netdev_priv(dev);
++	unsigned int tx_throttle;
++	unsigned int rx_throttle;
++	u32 intmod = 0;
++
++	/* GEM has simple IRQ throttling support. RX and TX interrupts
++	 * are separately moderated on 800ns quantums, with no support
++	 * for frame coalescing.
++	 */
++
++	/* Max is 255 * 0.8us = 204us. Zero implies no moderation. */
++	if (ec->rx_coalesce_usecs > 204 || ec->tx_coalesce_usecs > 204)
++		return -EINVAL;
++
++	tx_throttle = (1000 * ec->tx_coalesce_usecs) / 800;
++	rx_throttle = (1000 * ec->rx_coalesce_usecs) / 800;
++
++	intmod = GEM_BFINS(TX_MODERATION, tx_throttle, intmod);
++	intmod = GEM_BFINS(RX_MODERATION, rx_throttle, intmod);
++
++	gem_writel(bp, INTMOD, intmod);
++
++	return 0;
++}
++
++static int gem_get_coalesce(struct net_device *dev,
++			    struct ethtool_coalesce *ec,
++			    struct kernel_ethtool_coalesce *kernel_coal,
++			    struct netlink_ext_ack *extack)
++{
++	struct macb *bp = netdev_priv(dev);
++	u32 intmod;
++
++	intmod = gem_readl(bp, INTMOD);
++
++	ec->tx_coalesce_usecs = (GEM_BFEXT(TX_MODERATION, intmod) * 800) / 1000;
++	ec->rx_coalesce_usecs = (GEM_BFEXT(RX_MODERATION, intmod) * 800) / 1000;
++
++	return 0;
++}
++
+ static struct net_device_stats *macb_get_stats(struct net_device *dev)
+ {
+ 	struct macb *bp = netdev_priv(dev);
+@@ -3779,6 +3889,8 @@ static const struct ethtool_ops macb_eth
+ };
+ 
+ static const struct ethtool_ops gem_ethtool_ops = {
++	.supported_coalesce_params = ETHTOOL_COALESCE_RX_USECS |
++				     ETHTOOL_COALESCE_TX_USECS,
+ 	.get_regs_len		= macb_get_regs_len,
+ 	.get_regs		= macb_get_regs,
+ 	.get_wol		= macb_get_wol,
+@@ -3788,6 +3900,8 @@ static const struct ethtool_ops gem_etht
+ 	.get_ethtool_stats	= gem_get_ethtool_stats,
+ 	.get_strings		= gem_get_ethtool_strings,
+ 	.get_sset_count		= gem_get_sset_count,
++	.get_coalesce		= gem_get_coalesce,
++	.set_coalesce		= gem_set_coalesce,
+ 	.get_link_ksettings     = macb_get_link_ksettings,
+ 	.set_link_ksettings     = macb_set_link_ksettings,
+ 	.get_ringparam		= macb_get_ringparam,
+@@ -5109,6 +5223,11 @@ static int macb_probe(struct platform_de
+ 			}
+ 		}
+ 	}
++
++	device_property_read_u8(&pdev->dev, "cdns,aw2w-max-pipe", &bp->aw2w_max_pipe);
++	device_property_read_u8(&pdev->dev, "cdns,ar2r-max-pipe", &bp->ar2r_max_pipe);
++	bp->use_aw2b_fill = device_property_read_bool(&pdev->dev, "cdns,use-aw2b-fill");
++
+ 	spin_lock_init(&bp->lock);
+ 
+ 	/* setup capabilities */
+@@ -5164,6 +5283,21 @@ static int macb_probe(struct platform_de
+ 	else
+ 		bp->phy_interface = interface;
+ 
++	/* optional PHY reset-related properties */
++	bp->phy_reset_gpio = devm_gpiod_get_optional(&pdev->dev, "phy-reset",
++						     GPIOD_OUT_LOW);
++	if (IS_ERR(bp->phy_reset_gpio)) {
++		dev_err(&pdev->dev, "Failed to obtain phy-reset gpio\n");
++		err = PTR_ERR(bp->phy_reset_gpio);
++		goto err_out_free_netdev;
++	}
++
++	bp->phy_reset_ms = 10;
++	of_property_read_u32(np, "phy-reset-duration", &bp->phy_reset_ms);
++	/* A sane reset duration should not be longer than 1s */
++	if (bp->phy_reset_ms > 1000)
++		bp->phy_reset_ms = 1000;
++
+ 	/* IP specific init */
+ 	err = init(pdev);
+ 	if (err)
+@@ -5238,6 +5372,19 @@ static void macb_remove(struct platform_
+ 	}
+ }
+ 
++static void macb_shutdown(struct platform_device *pdev)
++{
++	struct net_device *dev;
++
++	dev = platform_get_drvdata(pdev);
++
++	rtnl_lock();
++	netif_device_detach(dev);
++	if (netif_running(dev))
++		dev_close(dev);
++	rtnl_unlock();
++}
++
+ static int __maybe_unused macb_suspend(struct device *dev)
+ {
+ 	struct net_device *netdev = dev_get_drvdata(dev);
+@@ -5491,6 +5638,7 @@ static const struct dev_pm_ops macb_pm_o
+ static struct platform_driver macb_driver = {
+ 	.probe		= macb_probe,
+ 	.remove_new	= macb_remove,
++	.shutdown	= macb_shutdown,
+ 	.driver		= {
+ 		.name		= "macb",
+ 		.of_match_table	= of_match_ptr(macb_dt_ids),
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0351-V4L2-Add-PiSP-opaque-formats-to-V4L2.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0351-V4L2-Add-PiSP-opaque-formats-to-V4L2.patch
new file mode 100644
index 00000000..5209403d
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0351-V4L2-Add-PiSP-opaque-formats-to-V4L2.patch
@@ -0,0 +1,34 @@
+From 024504fc45187debd29d5d0e0e68a4dddc7e0647 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Mon, 7 Feb 2022 09:20:49 +0000
+Subject: [PATCH 351/697] V4L2: Add PiSP opaque formats to V4L2
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/v4l2-core/v4l2-ioctl.c | 2 ++
+ include/uapi/linux/videodev2.h       | 3 +++
+ 2 files changed, 5 insertions(+)
+
+--- a/drivers/media/v4l2-core/v4l2-ioctl.c
++++ b/drivers/media/v4l2-core/v4l2-ioctl.c
+@@ -1478,6 +1478,8 @@ static void v4l_fill_fmtdesc(struct v4l2
+ 	case V4L2_META_FMT_GENERIC_CSI2_24:	descr = "8-bit Generic Meta, 24b CSI-2"; break;
+ 	case V4L2_META_FMT_SENSOR_DATA:	descr = "Sensor Ancillary Metadata"; break;
+ 	case V4L2_META_FMT_BCM2835_ISP_STATS: descr = "BCM2835 ISP Image Statistics"; break;
++	case V4L2_META_FMT_RPI_FE_CFG: descr = "PiSP FE Config format"; break;
++	case V4L2_META_FMT_RPI_FE_STATS: descr = "PiSP FE Statistics format"; break;
+ 
+ 	default:
+ 		/* Compressed formats */
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -871,6 +871,9 @@ struct v4l2_pix_format {
+ /* Vendor specific - used for RaspberryPi PiSP */
+ #define V4L2_META_FMT_RPI_BE_CFG	v4l2_fourcc('R', 'P', 'B', 'C') /* PiSP BE configuration */
+ 
++/* The metadata format identifier for FE configuration buffers. */
++#define V4L2_META_FMT_RPI_FE_STATS v4l2_fourcc('R', 'P', 'F', 'S')
++
+ #ifdef __KERNEL__
+ /*
+  * Line-based metadata formats. Remember to update v4l_fill_fmtdesc() when
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0352-V4L2-Add-PiSP-compressed-formats-to-V4L2.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0352-V4L2-Add-PiSP-compressed-formats-to-V4L2.patch
new file mode 100644
index 00000000..bde52d64
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0352-V4L2-Add-PiSP-compressed-formats-to-V4L2.patch
@@ -0,0 +1,26 @@
+From b4967a675e4b3ffb79e1d97ac2513cfb8b895be6 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Wed, 2 Mar 2022 16:10:50 +0000
+Subject: [PATCH 352/697] V4L2: Add PiSP compressed formats to V4L2
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ include/uapi/linux/videodev2.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -838,6 +838,13 @@ struct v4l2_pix_format {
+ #define V4L2_PIX_FMT_PISP_COMP2_BGGR	v4l2_fourcc('P', 'C', '2', 'B') /* PiSP 8-bit mode 2 compressed BGGR bayer */
+ #define V4L2_PIX_FMT_PISP_COMP2_MONO	v4l2_fourcc('P', 'C', '2', 'M') /* PiSP 8-bit mode 2 compressed monochrome */
+ 
++/* The pixel format for all our buffers (the precise format is found in the config buffer). */
++#define V4L2_PIX_FMT_RPI_BE		v4l2_fourcc('R', 'P', 'B', 'P')
++#define V4L2_PIX_FMT_PISP_COMP_RGGB	v4l2_fourcc('P', 'C', 'R', 'G')
++#define V4L2_PIX_FMT_PISP_COMP_GRBG	v4l2_fourcc('P', 'C', 'G', 'R')
++#define V4L2_PIX_FMT_PISP_COMP_GBRG	v4l2_fourcc('P', 'C', 'G', 'B')
++#define V4L2_PIX_FMT_PISP_COMP_BGGR	v4l2_fourcc('P', 'C', 'B', 'G')
++
+ /* SDR formats - used only for Software Defined Radio devices */
+ #define V4L2_SDR_FMT_CU8          v4l2_fourcc('C', 'U', '0', '8') /* IQ u8 */
+ #define V4L2_SDR_FMT_CU16LE       v4l2_fourcc('C', 'U', '1', '6') /* IQ u16le */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0353-dt-binding-mfd-Add-binding-for-Raspberry-Pi-RP1.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0353-dt-binding-mfd-Add-binding-for-Raspberry-Pi-RP1.patch
new file mode 100644
index 00000000..fa9ae604
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0353-dt-binding-mfd-Add-binding-for-Raspberry-Pi-RP1.patch
@@ -0,0 +1,249 @@
+From ffcff4e8140a3f5178c761a89323332585919486 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 28 Oct 2022 14:10:34 +0100
+Subject: [PATCH 353/697] dt-binding: mfd: Add binding for Raspberry Pi RP1
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ include/dt-bindings/mfd/rp1.h | 235 ++++++++++++++++++++++++++++++++++
+ 1 file changed, 235 insertions(+)
+ create mode 100644 include/dt-bindings/mfd/rp1.h
+
+--- /dev/null
++++ b/include/dt-bindings/mfd/rp1.h
+@@ -0,0 +1,235 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * This header provides constants for the PY MFD.
++ */
++
++#ifndef _RP1_H
++#define _RP1_H
++
++/* Address map */
++#define RP1_SYSINFO_BASE 0x000000
++#define RP1_TBMAN_BASE 0x004000
++#define RP1_SYSCFG_BASE 0x008000
++#define RP1_OTP_BASE 0x00c000
++#define RP1_POWER_BASE 0x010000
++#define RP1_RESETS_BASE 0x014000
++#define RP1_CLOCKS_BANK_DEFAULT_BASE 0x018000
++#define RP1_CLOCKS_BANK_VIDEO_BASE 0x01c000
++#define RP1_PLL_SYS_BASE 0x020000
++#define RP1_PLL_AUDIO_BASE 0x024000
++#define RP1_PLL_VIDEO_BASE 0x028000
++#define RP1_UART0_BASE 0x030000
++#define RP1_UART1_BASE 0x034000
++#define RP1_UART2_BASE 0x038000
++#define RP1_UART3_BASE 0x03c000
++#define RP1_UART4_BASE 0x040000
++#define RP1_UART5_BASE 0x044000
++#define RP1_SPI8_BASE 0x04c000
++#define RP1_SPI0_BASE 0x050000
++#define RP1_SPI1_BASE 0x054000
++#define RP1_SPI2_BASE 0x058000
++#define RP1_SPI3_BASE 0x05c000
++#define RP1_SPI4_BASE 0x060000
++#define RP1_SPI5_BASE 0x064000
++#define RP1_SPI6_BASE 0x068000
++#define RP1_SPI7_BASE 0x06c000
++#define RP1_I2C0_BASE 0x070000
++#define RP1_I2C1_BASE 0x074000
++#define RP1_I2C2_BASE 0x078000
++#define RP1_I2C3_BASE 0x07c000
++#define RP1_I2C4_BASE 0x080000
++#define RP1_I2C5_BASE 0x084000
++#define RP1_I2C6_BASE 0x088000
++#define RP1_AUDIO_IN_BASE 0x090000
++#define RP1_AUDIO_OUT_BASE 0x094000
++#define RP1_PWM0_BASE 0x098000
++#define RP1_PWM1_BASE 0x09c000
++#define RP1_I2S0_BASE 0x0a0000
++#define RP1_I2S1_BASE 0x0a4000
++#define RP1_I2S2_BASE 0x0a8000
++#define RP1_TIMER_BASE 0x0ac000
++#define RP1_SDIO0_APBS_BASE 0x0b0000
++#define RP1_SDIO1_APBS_BASE 0x0b4000
++#define RP1_BUSFABRIC_MONITOR_BASE 0x0c0000
++#define RP1_BUSFABRIC_AXISHIM_BASE 0x0c4000
++#define RP1_ADC_BASE 0x0c8000
++#define RP1_IO_BANK0_BASE 0x0d0000
++#define RP1_IO_BANK1_BASE 0x0d4000
++#define RP1_IO_BANK2_BASE 0x0d8000
++#define RP1_SYS_RIO0_BASE 0x0e0000
++#define RP1_SYS_RIO1_BASE 0x0e4000
++#define RP1_SYS_RIO2_BASE 0x0e8000
++#define RP1_PADS_BANK0_BASE 0x0f0000
++#define RP1_PADS_BANK1_BASE 0x0f4000
++#define RP1_PADS_BANK2_BASE 0x0f8000
++#define RP1_PADS_ETH_BASE 0x0fc000
++#define RP1_ETH_IP_BASE 0x100000
++#define RP1_ETH_CFG_BASE 0x104000
++#define RP1_PCIE_APBS_BASE 0x108000
++#define RP1_MIPI0_CSIDMA_BASE 0x110000
++#define RP1_MIPI0_CSIHOST_BASE 0x114000
++#define RP1_MIPI0_DSIDMA_BASE 0x118000
++#define RP1_MIPI0_DSIHOST_BASE 0x11c000
++#define RP1_MIPI0_MIPICFG_BASE 0x120000
++#define RP1_MIPI0_ISP_BASE 0x124000
++#define RP1_MIPI1_CSIDMA_BASE 0x128000
++#define RP1_MIPI1_CSIHOST_BASE 0x12c000
++#define RP1_MIPI1_DSIDMA_BASE 0x130000
++#define RP1_MIPI1_DSIHOST_BASE 0x134000
++#define RP1_MIPI1_MIPICFG_BASE 0x138000
++#define RP1_MIPI1_ISP_BASE 0x13c000
++#define RP1_VIDEO_OUT_CFG_BASE 0x140000
++#define RP1_VIDEO_OUT_VEC_BASE 0x144000
++#define RP1_VIDEO_OUT_DPI_BASE 0x148000
++#define RP1_XOSC_BASE 0x150000
++#define RP1_WATCHDOG_BASE 0x154000
++#define RP1_DMA_TICK_BASE 0x158000
++#define RP1_SDIO_CLOCKS_BASE 0x15c000
++#define RP1_USBHOST0_APBS_BASE 0x160000
++#define RP1_USBHOST1_APBS_BASE 0x164000
++#define RP1_ROSC0_BASE 0x168000
++#define RP1_ROSC1_BASE 0x16c000
++#define RP1_VBUSCTRL_BASE 0x170000
++#define RP1_TICKS_BASE 0x174000
++#define RP1_PIO_APBS_BASE 0x178000
++#define RP1_SDIO0_AHBLS_BASE 0x180000
++#define RP1_SDIO1_AHBLS_BASE 0x184000
++#define RP1_DMA_BASE 0x188000
++#define RP1_RAM_BASE 0x1c0000
++#define RP1_RAM_SIZE 0x020000
++#define RP1_USBHOST0_AXIS_BASE 0x200000
++#define RP1_USBHOST1_AXIS_BASE 0x300000
++#define RP1_EXAC_BASE 0x400000
++
++/* Interrupts */
++
++#define RP1_INT_IO_BANK0 0
++#define RP1_INT_IO_BANK1 1
++#define RP1_INT_IO_BANK2 2
++#define RP1_INT_AUDIO_IN 3
++#define RP1_INT_AUDIO_OUT 4
++#define RP1_INT_PWM0 5
++#define RP1_INT_ETH 6
++#define RP1_INT_I2C0 7
++#define RP1_INT_I2C1 8
++#define RP1_INT_I2C2 9
++#define RP1_INT_I2C3 10
++#define RP1_INT_I2C4 11
++#define RP1_INT_I2C5 12
++#define RP1_INT_I2C6 13
++#define RP1_INT_I2S0 14
++#define RP1_INT_I2S1 15
++#define RP1_INT_I2S2 16
++#define RP1_INT_SDIO0 17
++#define RP1_INT_SDIO1 18
++#define RP1_INT_SPI0 19
++#define RP1_INT_SPI1 20
++#define RP1_INT_SPI2 21
++#define RP1_INT_SPI3 22
++#define RP1_INT_SPI4 23
++#define RP1_INT_SPI5 24
++#define RP1_INT_UART0 25
++#define RP1_INT_TIMER_0 26
++#define RP1_INT_TIMER_1 27
++#define RP1_INT_TIMER_2 28
++#define RP1_INT_TIMER_3 29
++#define RP1_INT_USBHOST0 30
++#define RP1_INT_USBHOST0_0 31
++#define RP1_INT_USBHOST0_1 32
++#define RP1_INT_USBHOST0_2 33
++#define RP1_INT_USBHOST0_3 34
++#define RP1_INT_USBHOST1 35
++#define RP1_INT_USBHOST1_0 36
++#define RP1_INT_USBHOST1_1 37
++#define RP1_INT_USBHOST1_2 38
++#define RP1_INT_USBHOST1_3 39
++#define RP1_INT_DMA 40
++#define RP1_INT_PWM1 41
++#define RP1_INT_UART1 42
++#define RP1_INT_UART2 43
++#define RP1_INT_UART3 44
++#define RP1_INT_UART4 45
++#define RP1_INT_UART5 46
++#define RP1_INT_MIPI0 47
++#define RP1_INT_MIPI1 48
++#define RP1_INT_VIDEO_OUT 49
++#define RP1_INT_PIO_0 50
++#define RP1_INT_PIO_1 51
++#define RP1_INT_ADC_FIFO 52
++#define RP1_INT_PCIE_OUT 53
++#define RP1_INT_SPI6 54
++#define RP1_INT_SPI7 55
++#define RP1_INT_SPI8 56
++#define RP1_INT_SYSCFG 58
++#define RP1_INT_CLOCKS_DEFAULT 59
++#define RP1_INT_VBUSCTRL 60
++#define RP1_INT_PROC_MISC 57
++#define RP1_INT_END 61
++
++/* DMA peripherals (for pacing) */
++#define RP1_DMA_I2C0_RX 0x0
++#define RP1_DMA_I2C0_TX 0x1
++#define RP1_DMA_I2C1_RX 0x2
++#define RP1_DMA_I2C1_TX 0x3
++#define RP1_DMA_I2C2_RX 0x4
++#define RP1_DMA_I2C2_TX 0x5
++#define RP1_DMA_I2C3_RX 0x6
++#define RP1_DMA_I2C3_TX 0x7
++#define RP1_DMA_I2C4_RX 0x8
++#define RP1_DMA_I2C4_TX 0x9
++#define RP1_DMA_I2C5_RX 0xa
++#define RP1_DMA_I2C5_TX 0xb
++#define RP1_DMA_SPI0_RX 0xc
++#define RP1_DMA_SPI0_TX 0xd
++#define RP1_DMA_SPI1_RX 0xe
++#define RP1_DMA_SPI1_TX 0xf
++#define RP1_DMA_SPI2_RX 0x10
++#define RP1_DMA_SPI2_TX 0x11
++#define RP1_DMA_SPI3_RX 0x12
++#define RP1_DMA_SPI3_TX 0x13
++#define RP1_DMA_SPI4_RX 0x14
++#define RP1_DMA_SPI4_TX 0x15
++#define RP1_DMA_SPI5_RX 0x16
++#define RP1_DMA_SPI5_TX 0x17
++#define RP1_DMA_PWM0 0x18
++#define RP1_DMA_UART0_RX 0x19
++#define RP1_DMA_UART0_TX 0x1a
++#define RP1_DMA_AUDIO_IN_CH0 0x1b
++#define RP1_DMA_AUDIO_IN_CH1 0x1c
++#define RP1_DMA_AUDIO_OUT 0x1d
++#define RP1_DMA_PWM1 0x1e
++#define RP1_DMA_I2S0_RX 0x1f
++#define RP1_DMA_I2S0_TX 0x20
++#define RP1_DMA_I2S1_RX 0x21
++#define RP1_DMA_I2S1_TX 0x22
++#define RP1_DMA_I2S2_RX 0x23
++#define RP1_DMA_I2S2_TX 0x24
++#define RP1_DMA_UART1_RX 0x25
++#define RP1_DMA_UART1_TX 0x26
++#define RP1_DMA_UART2_RX 0x27
++#define RP1_DMA_UART2_TX 0x28
++#define RP1_DMA_UART3_RX 0x29
++#define RP1_DMA_UART3_TX 0x2a
++#define RP1_DMA_UART4_RX 0x2b
++#define RP1_DMA_UART4_TX 0x2c
++#define RP1_DMA_UART5_RX 0x2d
++#define RP1_DMA_UART5_TX 0x2e
++#define RP1_DMA_ADC 0x2f
++#define RP1_DMA_DMA_TICK_TICK0 0x30
++#define RP1_DMA_DMA_TICK_TICK1 0x31
++#define RP1_DMA_SPI6_RX 0x32
++#define RP1_DMA_SPI6_TX 0x33
++#define RP1_DMA_SPI7_RX 0x34
++#define RP1_DMA_SPI7_TX 0x35
++#define RP1_DMA_SPI8_RX 0x36
++#define RP1_DMA_SPI8_TX 0x37
++#define RP1_DMA_PIO_CH0_TX 0x38
++#define RP1_DMA_PIO_CH0_RX 0x39
++#define RP1_DMA_PIO_CH1_TX 0x3a
++#define RP1_DMA_PIO_CH1_RX 0x3b
++#define RP1_DMA_PIO_CH2_TX 0x3c
++#define RP1_DMA_PIO_CH2_RX 0x3d
++#define RP1_DMA_PIO_CH3_TX 0x3e
++#define RP1_DMA_PIO_CH3_RX 0x3f
++
++#endif
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0354-mfd-Add-rp1-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0354-mfd-Add-rp1-driver.patch
new file mode 100644
index 00000000..e83aada2
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0354-mfd-Add-rp1-driver.patch
@@ -0,0 +1,455 @@
+From f35f06f28ae0d2e4c2e38a068af286f43e91a28e Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 10 Oct 2022 14:21:50 +0100
+Subject: [PATCH 354/697] mfd: Add rp1 driver
+
+RP1 is a multifunction PCIe device that exposes a range of
+peripherals.
+Add the parent driver to manage these.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+mfd: rp1: Support interrupt CPU affinity
+
+See: https://github.com/raspberrypi/linux/issues/6077
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/mfd/Kconfig          |  11 +
+ drivers/mfd/Makefile         |   2 +
+ drivers/mfd/rp1.c            | 376 +++++++++++++++++++++++++++++++++++
+ include/linux/rp1_platform.h |  20 ++
+ 4 files changed, 409 insertions(+)
+ create mode 100644 drivers/mfd/rp1.c
+ create mode 100644 include/linux/rp1_platform.h
+
+--- a/drivers/mfd/Kconfig
++++ b/drivers/mfd/Kconfig
+@@ -2384,6 +2384,17 @@ config MFD_INTEL_M10_BMC_PMCI
+ 	  additional drivers must be enabled in order to use the functionality
+ 	  of the device.
+ 
++config MFD_RP1
++	tristate "RP1 MFD driver"
++	depends on PCI
++	select MFD_CORE
++	help
++	  Support for the RP1 peripheral chip.
++
++	  This driver provides support for the Raspberry Pi RP1 peripheral chip.
++	  It is responsible for enabling the Device Tree node once the PCIe endpoint
++	  has been configured, and handling interrupts.
++
+ config MFD_RSMU_I2C
+ 	tristate "Renesas Synchronization Management Unit with I2C"
+ 	depends on I2C && OF
+--- a/drivers/mfd/Makefile
++++ b/drivers/mfd/Makefile
+@@ -289,3 +289,5 @@ obj-$(CONFIG_MFD_ATC260X_I2C)	+= atc260x
+ 
+ obj-$(CONFIG_MFD_RSMU_I2C)	+= rsmu_i2c.o rsmu_core.o
+ obj-$(CONFIG_MFD_RSMU_SPI)	+= rsmu_spi.o rsmu_core.o
++
++obj-$(CONFIG_MFD_RP1)		+= rp1.o
+--- /dev/null
++++ b/drivers/mfd/rp1.c
+@@ -0,0 +1,376 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (c) 2018-22 Raspberry Pi Ltd.
++ * All rights reserved.
++ */
++
++#include <linux/clk.h>
++#include <linux/clkdev.h>
++#include <linux/clk-provider.h>
++#include <linux/completion.h>
++#include <linux/etherdevice.h>
++#include <linux/err.h>
++#include <linux/interrupt.h>
++#include <linux/io.h>
++#include <linux/irq.h>
++#include <linux/irqchip/chained_irq.h>
++#include <linux/irqdomain.h>
++#include <linux/mfd/core.h>
++#include <linux/mmc/host.h>
++#include <linux/module.h>
++#include <linux/msi.h>
++#include <linux/of_platform.h>
++#include <linux/pci.h>
++#include <linux/platform_device.h>
++#include <linux/rp1_platform.h>
++#include <linux/reset.h>
++#include <linux/slab.h>
++
++#include <dt-bindings/mfd/rp1.h>
++
++/* TO DO:
++ * 1. Occasional shutdown crash - RP1 being closed before its children?
++ * 2. DT mode interrupt handling.
++ */
++
++#define RP1_DRIVER_NAME "rp1"
++
++#define PCI_VENDOR_ID_RPI 0x1de4
++#define PCI_DEVICE_ID_RP1_C0 0x0001
++#define PCI_DEVICE_REV_RP1_C0 2
++
++#define RP1_ACTUAL_IRQS		RP1_INT_END
++#define RP1_IRQS		RP1_ACTUAL_IRQS
++
++#define RP1_SYSCLK_RATE		200000000
++#define RP1_SYSCLK_FPGA_RATE	60000000
++
++// Don't want to include the whole sysinfo reg header
++#define SYSINFO_CHIP_ID_OFFSET	0x00000000
++#define SYSINFO_PLATFORM_OFFSET	0x00000004
++
++#define REG_RW          0x000
++#define REG_SET         0x800
++#define REG_CLR         0xc00
++
++// MSIX CFG registers start at 0x8
++#define MSIX_CFG(x) (0x8 + (4 * (x)))
++
++#define MSIX_CFG_IACK_EN        BIT(3)
++#define MSIX_CFG_IACK           BIT(2)
++#define MSIX_CFG_TEST           BIT(1)
++#define MSIX_CFG_ENABLE         BIT(0)
++
++#define INTSTATL		0x108
++#define INTSTATH		0x10c
++
++struct rp1_dev {
++	struct pci_dev *pdev;
++	struct device *dev;
++	resource_size_t bar_start;
++	resource_size_t bar_end;
++	struct clk *sys_clk;
++	struct irq_domain *domain;
++	struct irq_data *pcie_irqds[64];
++	void __iomem *msix_cfg_regs;
++};
++
++static bool rp1_level_triggered_irq[RP1_ACTUAL_IRQS] = { 0 };
++
++static struct rp1_dev *g_rp1;
++static u32 g_chip_id, g_platform;
++
++static void dump_bar(struct pci_dev *pdev, unsigned int bar)
++{
++	dev_info(&pdev->dev,
++		 "bar%d len 0x%llx, start 0x%llx, end 0x%llx, flags, 0x%lx\n",
++		 bar,
++		 pci_resource_len(pdev, bar),
++		 pci_resource_start(pdev, bar),
++		 pci_resource_end(pdev, bar),
++		 pci_resource_flags(pdev, bar));
++}
++
++static void msix_cfg_set(struct rp1_dev *rp1, unsigned int hwirq, u32 value)
++{
++	writel(value, rp1->msix_cfg_regs + REG_SET + MSIX_CFG(hwirq));
++}
++
++static void msix_cfg_clr(struct rp1_dev *rp1, unsigned int hwirq, u32 value)
++{
++	writel(value, rp1->msix_cfg_regs + REG_CLR + MSIX_CFG(hwirq));
++}
++
++static void rp1_mask_irq(struct irq_data *irqd)
++{
++	struct rp1_dev *rp1 = irqd->domain->host_data;
++	struct irq_data *pcie_irqd = rp1->pcie_irqds[irqd->hwirq];
++
++	pci_msi_mask_irq(pcie_irqd);
++}
++
++static void rp1_unmask_irq(struct irq_data *irqd)
++{
++	struct rp1_dev *rp1 = irqd->domain->host_data;
++	struct irq_data *pcie_irqd = rp1->pcie_irqds[irqd->hwirq];
++
++	pci_msi_unmask_irq(pcie_irqd);
++}
++
++static int rp1_irq_set_type(struct irq_data *irqd, unsigned int type)
++{
++	struct rp1_dev *rp1 = irqd->domain->host_data;
++	unsigned int hwirq = (unsigned int)irqd->hwirq;
++	int ret = 0;
++
++	switch (type) {
++	case IRQ_TYPE_LEVEL_HIGH:
++		dev_dbg(rp1->dev, "MSIX IACK EN for irq %d\n", hwirq);
++		msix_cfg_set(rp1, hwirq, MSIX_CFG_IACK_EN);
++		rp1_level_triggered_irq[hwirq] = true;
++	break;
++	case IRQ_TYPE_EDGE_RISING:
++		msix_cfg_clr(rp1, hwirq, MSIX_CFG_IACK_EN);
++		rp1_level_triggered_irq[hwirq] = false;
++		break;
++	default:
++		ret = -EINVAL;
++		break;
++	}
++
++	return ret;
++}
++
++static int rp1_irq_set_affinity(struct irq_data *irqd, const struct cpumask *dest, bool force)
++{
++	struct rp1_dev *rp1 = irqd->domain->host_data;
++	struct irq_data *pcie_irqd = rp1->pcie_irqds[irqd->hwirq];
++
++	return msi_domain_set_affinity(pcie_irqd, dest, force);
++}
++
++static struct irq_chip rp1_irq_chip = {
++	.name            = "rp1_irq_chip",
++	.irq_mask        = rp1_mask_irq,
++	.irq_unmask      = rp1_unmask_irq,
++	.irq_set_type    = rp1_irq_set_type,
++	.irq_set_affinity = rp1_irq_set_affinity,
++};
++
++static void rp1_chained_handle_irq(struct irq_desc *desc)
++{
++	struct irq_chip *chip = irq_desc_get_chip(desc);
++	struct rp1_dev *rp1 = desc->irq_data.chip_data;
++	unsigned int hwirq = desc->irq_data.hwirq & 0x3f;
++	int new_irq;
++
++	rp1 = g_rp1;
++
++	chained_irq_enter(chip, desc);
++
++	new_irq = irq_linear_revmap(rp1->domain, hwirq);
++	generic_handle_irq(new_irq);
++	if (rp1_level_triggered_irq[hwirq])
++		msix_cfg_set(rp1, hwirq, MSIX_CFG_IACK);
++
++	chained_irq_exit(chip, desc);
++}
++
++static int rp1_irq_xlate(struct irq_domain *d, struct device_node *node,
++			 const u32 *intspec, unsigned int intsize,
++			 unsigned long *out_hwirq, unsigned int *out_type)
++{
++	struct rp1_dev *rp1 = d->host_data;
++	struct irq_data *pcie_irqd;
++	unsigned long hwirq;
++	int pcie_irq;
++	int ret;
++
++	ret = irq_domain_xlate_twocell(d, node, intspec, intsize,
++				       &hwirq, out_type);
++	if (!ret) {
++		pcie_irq = pci_irq_vector(rp1->pdev, hwirq);
++		pcie_irqd = irq_get_irq_data(pcie_irq);
++		rp1->pcie_irqds[hwirq] = pcie_irqd;
++		*out_hwirq = hwirq;
++	}
++	return ret;
++}
++
++static int rp1_irq_activate(struct irq_domain *d, struct irq_data *irqd,
++			    bool reserve)
++{
++	struct rp1_dev *rp1 = d->host_data;
++	struct irq_data *pcie_irqd;
++
++	pcie_irqd = rp1->pcie_irqds[irqd->hwirq];
++	msix_cfg_set(rp1, (unsigned int)irqd->hwirq, MSIX_CFG_ENABLE);
++	return irq_domain_activate_irq(pcie_irqd, reserve);
++}
++
++static void rp1_irq_deactivate(struct irq_domain *d, struct irq_data *irqd)
++{
++	struct rp1_dev *rp1 = d->host_data;
++	struct irq_data *pcie_irqd;
++
++	pcie_irqd = rp1->pcie_irqds[irqd->hwirq];
++	msix_cfg_clr(rp1, (unsigned int)irqd->hwirq, MSIX_CFG_ENABLE);
++	return irq_domain_deactivate_irq(pcie_irqd);
++}
++
++static const struct irq_domain_ops rp1_domain_ops = {
++	.xlate      = rp1_irq_xlate,
++	.activate   = rp1_irq_activate,
++	.deactivate = rp1_irq_deactivate,
++};
++
++static inline dma_addr_t rp1_io_to_phys(struct rp1_dev *rp1, unsigned int offset)
++{
++	return rp1->bar_start + offset;
++}
++
++static u32 rp1_reg_read(struct rp1_dev *rp1, unsigned int base_addr, u32 offset)
++{
++	dma_addr_t phys = rp1_io_to_phys(rp1, base_addr);
++	void __iomem *regblock = ioremap(phys, 0x1000);
++	u32 value = readl(regblock + offset);
++
++	iounmap(regblock);
++	return value;
++}
++
++void rp1_get_platform(u32 *chip_id, u32 *platform)
++{
++	if (chip_id)
++		*chip_id = g_chip_id;
++	if (platform)
++		*platform = g_platform;
++}
++EXPORT_SYMBOL_GPL(rp1_get_platform);
++
++static int rp1_probe(struct pci_dev *pdev, const struct pci_device_id *id)
++{
++	struct reset_control *reset;
++	struct platform_device *pcie_pdev;
++	struct device_node *rp1_node;
++	struct rp1_dev *rp1;
++	int err  = 0;
++	int i;
++
++	reset = devm_reset_control_get_optional_exclusive(&pdev->dev, NULL);
++	if (IS_ERR(reset))
++		return PTR_ERR(reset);
++	reset_control_reset(reset);
++
++	dump_bar(pdev, 0);
++	dump_bar(pdev, 1);
++
++	if (pci_resource_len(pdev, 1) <= 0x10000) {
++		dev_err(&pdev->dev,
++			"Not initialised - is the firmware running?\n");
++		return -EINVAL;
++	}
++
++	/* enable pci device */
++	err = pcim_enable_device(pdev);
++	if (err < 0) {
++		dev_err(&pdev->dev, "Enabling PCI device has failed: %d",
++			err);
++		return err;
++	}
++
++	pci_set_master(pdev);
++
++	err = pci_alloc_irq_vectors(pdev, RP1_IRQS, RP1_IRQS,
++				    PCI_IRQ_MSIX);
++	if (err != RP1_IRQS) {
++		dev_err(&pdev->dev, "pci_alloc_irq_vectors failed - %d\n", err);
++		return err;
++	}
++
++	rp1 = devm_kzalloc(&pdev->dev, sizeof(*rp1), GFP_KERNEL);
++	if (!rp1)
++		return -ENOMEM;
++
++	rp1->pdev = pdev;
++	rp1->dev = &pdev->dev;
++
++	pci_set_drvdata(pdev, rp1);
++
++	rp1->bar_start = pci_resource_start(pdev, 1);
++	rp1->bar_end = pci_resource_end(pdev, 1);
++
++	// Get chip id
++	g_chip_id = rp1_reg_read(rp1, RP1_SYSINFO_BASE, SYSINFO_CHIP_ID_OFFSET);
++	g_platform = rp1_reg_read(rp1, RP1_SYSINFO_BASE, SYSINFO_PLATFORM_OFFSET);
++	dev_info(&pdev->dev, "chip_id 0x%x%s\n", g_chip_id,
++		 (g_platform & RP1_PLATFORM_FPGA) ? " FPGA" : "");
++	if (g_chip_id != RP1_C0_CHIP_ID) {
++		dev_err(&pdev->dev, "wrong chip id (%x)\n", g_chip_id);
++		return -EINVAL;
++	}
++
++	rp1_node = of_find_node_by_name(NULL, "rp1");
++	if (!rp1_node) {
++		dev_err(&pdev->dev, "failed to find RP1 DT node\n");
++		return -EINVAL;
++	}
++
++	pcie_pdev = of_find_device_by_node(rp1_node->parent);
++	rp1->domain = irq_domain_add_linear(rp1_node, RP1_IRQS,
++					    &rp1_domain_ops, rp1);
++
++	g_rp1 = rp1;
++
++	/* TODO can this go in the rp1 device tree entry? */
++	rp1->msix_cfg_regs = ioremap(rp1_io_to_phys(rp1, RP1_PCIE_APBS_BASE), 0x1000);
++
++	for (i = 0; i < RP1_IRQS; i++) {
++		int irq = irq_create_mapping(rp1->domain, i);
++
++		if (irq < 0) {
++			dev_err(&pdev->dev, "failed to create irq mapping\n");
++			return irq;
++		}
++
++		irq_set_chip_data(irq, rp1);
++		irq_set_chip_and_handler(irq, &rp1_irq_chip, handle_level_irq);
++		irq_set_probe(irq);
++		irq_set_chained_handler(pci_irq_vector(pdev, i),
++					rp1_chained_handle_irq);
++	}
++
++	if (rp1_node)
++		of_platform_populate(rp1_node, NULL, NULL, &pcie_pdev->dev);
++
++	of_node_put(rp1_node);
++
++	return 0;
++}
++
++static void rp1_remove(struct pci_dev *pdev)
++{
++	struct rp1_dev *rp1 = pci_get_drvdata(pdev);
++
++	mfd_remove_devices(&pdev->dev);
++
++	clk_unregister(rp1->sys_clk);
++}
++
++static const struct pci_device_id dev_id_table[] = {
++	{ PCI_DEVICE(PCI_VENDOR_ID_RPI, PCI_DEVICE_ID_RP1_C0), },
++	{ 0, }
++};
++
++static struct pci_driver rp1_driver = {
++	.name		= RP1_DRIVER_NAME,
++	.id_table	= dev_id_table,
++	.probe		= rp1_probe,
++	.remove		= rp1_remove,
++};
++
++module_pci_driver(rp1_driver);
++
++MODULE_AUTHOR("Phil Elwell <phil@raspberrypi.com>");
++MODULE_DESCRIPTION("RP1 wrapper");
++MODULE_LICENSE("GPL");
+--- /dev/null
++++ b/include/linux/rp1_platform.h
+@@ -0,0 +1,20 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * Copyright (c) 2021-2022 Raspberry Pi Ltd.
++ * All rights reserved.
++ */
++
++#ifndef _RP1_PLATFORM_H
++#define _RP1_PLATFORM_H
++
++#include <vdso/bits.h>
++
++#define RP1_B0_CHIP_ID 0x10001927
++#define RP1_C0_CHIP_ID 0x20001927
++
++#define RP1_PLATFORM_ASIC BIT(1)
++#define RP1_PLATFORM_FPGA BIT(0)
++
++void rp1_get_platform(u32 *chip_id, u32 *platform);
++
++#endif
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0355-dt-bindings-clock-Add-bindings-for-Raspberry-Pi-RP1.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0355-dt-bindings-clock-Add-bindings-for-Raspberry-Pi-RP1.patch
new file mode 100644
index 00000000..8770d5b2
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0355-dt-bindings-clock-Add-bindings-for-Raspberry-Pi-RP1.patch
@@ -0,0 +1,65 @@
+From c152122f3532fb95abc15fc128af5cddd70faf75 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 28 Oct 2022 14:12:18 +0100
+Subject: [PATCH 355/697] dt-bindings: clock: Add bindings for Raspberry Pi RP1
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ include/dt-bindings/clock/rp1.h | 51 +++++++++++++++++++++++++++++++++
+ 1 file changed, 51 insertions(+)
+ create mode 100644 include/dt-bindings/clock/rp1.h
+
+--- /dev/null
++++ b/include/dt-bindings/clock/rp1.h
+@@ -0,0 +1,51 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * Copyright (C) 2021 Raspberry Pi Ltd.
++ */
++
++#define RP1_PLL_SYS_CORE		0
++#define RP1_PLL_AUDIO_CORE		1
++#define RP1_PLL_VIDEO_CORE		2
++
++#define RP1_PLL_SYS			3
++#define RP1_PLL_AUDIO			4
++#define RP1_PLL_VIDEO			5
++
++#define RP1_PLL_SYS_PRI_PH		6
++#define RP1_PLL_SYS_SEC_PH		7
++
++#define RP1_PLL_SYS_SEC			8
++#define RP1_PLL_AUDIO_SEC		9
++#define RP1_PLL_VIDEO_SEC		10
++
++#define RP1_CLK_SYS			11
++#define RP1_CLK_SLOW_SYS		12
++#define RP1_CLK_DMA			13
++#define RP1_CLK_UART			14
++#define RP1_CLK_ETH			15
++#define RP1_CLK_PWM0			16
++#define RP1_CLK_PWM1			17
++#define RP1_CLK_AUDIO_IN		18
++#define RP1_CLK_AUDIO_OUT		19
++#define RP1_CLK_I2S			20
++#define RP1_CLK_MIPI0_CFG		21
++#define RP1_CLK_MIPI1_CFG		22
++#define RP1_CLK_PCIE_AUX		23
++#define RP1_CLK_USBH0_MICROFRAME	24
++#define RP1_CLK_USBH1_MICROFRAME	25
++#define RP1_CLK_USBH0_SUSPEND		26
++#define RP1_CLK_USBH1_SUSPEND		27
++#define RP1_CLK_ETH_TSU			28
++#define RP1_CLK_ADC			29
++#define RP1_CLK_SDIO_TIMER		30
++#define RP1_CLK_SDIO_ALT_SRC		31
++#define RP1_CLK_GP0			32
++#define RP1_CLK_GP1			33
++#define RP1_CLK_GP2			34
++#define RP1_CLK_GP3			35
++#define RP1_CLK_GP4			36
++#define RP1_CLK_GP5			37
++#define RP1_CLK_VEC			38
++#define RP1_CLK_DPI			39
++#define RP1_CLK_MIPI0_DPI		40
++#define RP1_CLK_MIPI1_DPI		41
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0356-clk-Add-rp1-clock-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0356-clk-Add-rp1-clock-driver.patch
new file mode 100644
index 00000000..e3b4d08c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0356-clk-Add-rp1-clock-driver.patch
@@ -0,0 +1,2678 @@
+From c3bed3cb4109ec1b75f908bd561d228abb525672 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 10 Oct 2022 14:25:38 +0100
+Subject: [PATCH 356/697] clk: Add rp1 clock driver
+
+RP1 contains various PLLs and clocks for driving the hardware
+blocks, so add a driver to configure these.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+drivers: clk: rp1: add GPCLK source muxes and additional PLL dividers
+
+General-purpose clocks are routed (via a pad) to a large variety of
+peripheral aux muxes, and themselves gather a large variety of source
+clocks. Entries without a corresponding name string should not be
+selected - they bring out internal test/debug clocks which may be
+intermittent or very high frequency.
+
+As the GPCLK inputs to peripheral muxes come from a pad, differentiate
+the source name from the divider output name. This allows the
+possibility of specifying an off-chip clock source to drive the internal
+peripheral clock.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+drivers: clk: rp1: constrain clock divider outputs to design maximums
+
+Overclocking peripherals is generally a bad thing to do - so reject any
+attempt to set a clock output higher than it should be.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+clk: rp1: Reserve pll_audio* for clk_i2s
+
+Prevent all clocks except clk_i2s from using the audio PLLs as sources,
+so that clk_i2s may be allowed to change them as needed.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+clk: rp1: Allow clk_i2s to change the audio PLLs
+
+Add dedicated code allowing the audio PLLs to be changed, enabling
+perfect I2S clock generation. The slowest legal pll_audio_core and
+pll_audio will be selected that leads to the required clk_i2s rate.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+clk: clk-rp1: Add "varsrc" clocks to represent MIPI byte clocks
+
+Add a new class of clocks to RP1 to represent clock sources whose
+frequency changes at run-time as a side-effect of some other driver.
+Specifically this is for the two MIPI DSI byte-clock sources.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+
+clk: clk-rp1: Don't crash on duplicate clocks
+
+When using DTBs that don't match the kernel version, it's possible for
+clock registration to fail. Handle that failure, in the hope that the
+system can continue to boot, with a suitable error message.
+
+Link: https://github.com/raspberrypi/linux/issues/6321
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/clk/Kconfig             |    7 +
+ drivers/clk/Makefile            |    1 +
+ drivers/clk/clk-rp1.c           | 2500 +++++++++++++++++++++++++++++++
+ include/dt-bindings/clock/rp1.h |   69 +-
+ 4 files changed, 2543 insertions(+), 34 deletions(-)
+ create mode 100644 drivers/clk/clk-rp1.c
+
+--- a/drivers/clk/Kconfig
++++ b/drivers/clk/Kconfig
+@@ -88,6 +88,13 @@ config COMMON_CLK_RK808
+ 	  These multi-function devices have two fixed-rate oscillators, clocked at 32KHz each.
+ 	  Clkout1 is always on, Clkout2 can off by control register.
+ 
++config COMMON_CLK_RP1
++	tristate "Raspberry Pi RP1-based clock support"
++	depends on PCI || COMPILE_TEST
++	depends on COMMON_CLK
++	help
++	  Enable common clock framework support for Raspberry Pi RP1
++
+ config COMMON_CLK_HI655X
+ 	tristate "Clock driver for Hi655x" if EXPERT
+ 	depends on (MFD_HI655X_PMIC || COMPILE_TEST)
+--- a/drivers/clk/Makefile
++++ b/drivers/clk/Makefile
+@@ -70,6 +70,7 @@ obj-$(CONFIG_CLK_LS1028A_PLLDIG)	+= clk-
+ obj-$(CONFIG_COMMON_CLK_PWM)		+= clk-pwm.o
+ obj-$(CONFIG_CLK_QORIQ)			+= clk-qoriq.o
+ obj-$(CONFIG_COMMON_CLK_RK808)		+= clk-rk808.o
++obj-$(CONFIG_COMMON_CLK_RP1)		+= clk-rp1.o
+ obj-$(CONFIG_COMMON_CLK_HI655X)		+= clk-hi655x.o
+ obj-$(CONFIG_COMMON_CLK_S2MPS11)	+= clk-s2mps11.o
+ obj-$(CONFIG_COMMON_CLK_SCMI)           += clk-scmi.o
+--- /dev/null
++++ b/drivers/clk/clk-rp1.c
+@@ -0,0 +1,2500 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Copyright (C) 2023 Raspberry Pi Ltd.
++ *
++ * Clock driver for RP1 PCIe multifunction chip.
++ */
++
++#include <linux/clk-provider.h>
++#include <linux/clkdev.h>
++#include <linux/clk.h>
++#include <linux/debugfs.h>
++#include <linux/delay.h>
++#include <linux/io.h>
++#include <linux/math64.h>
++#include <linux/module.h>
++#include <linux/of_device.h>
++#include <linux/platform_device.h>
++#include <linux/rp1_platform.h>
++#include <linux/slab.h>
++
++#include <asm/div64.h>
++
++#include <dt-bindings/clock/rp1.h>
++
++#define PLL_SYS_CS			0x08000
++#define PLL_SYS_PWR			0x08004
++#define PLL_SYS_FBDIV_INT		0x08008
++#define PLL_SYS_FBDIV_FRAC		0x0800c
++#define PLL_SYS_PRIM			0x08010
++#define PLL_SYS_SEC			0x08014
++
++#define PLL_AUDIO_CS			0x0c000
++#define PLL_AUDIO_PWR			0x0c004
++#define PLL_AUDIO_FBDIV_INT		0x0c008
++#define PLL_AUDIO_FBDIV_FRAC		0x0c00c
++#define PLL_AUDIO_PRIM			0x0c010
++#define PLL_AUDIO_SEC			0x0c014
++#define PLL_AUDIO_TERN			0x0c018
++
++#define PLL_VIDEO_CS			0x10000
++#define PLL_VIDEO_PWR			0x10004
++#define PLL_VIDEO_FBDIV_INT		0x10008
++#define PLL_VIDEO_FBDIV_FRAC		0x1000c
++#define PLL_VIDEO_PRIM			0x10010
++#define PLL_VIDEO_SEC			0x10014
++
++#define GPCLK_OE_CTRL			0x00000
++
++#define CLK_SYS_CTRL			0x00014
++#define CLK_SYS_DIV_INT			0x00018
++#define CLK_SYS_SEL			0x00020
++
++#define CLK_SLOW_SYS_CTRL		0x00024
++#define CLK_SLOW_SYS_DIV_INT		0x00028
++#define CLK_SLOW_SYS_SEL		0x00030
++
++#define CLK_DMA_CTRL			0x00044
++#define CLK_DMA_DIV_INT			0x00048
++#define CLK_DMA_SEL			0x00050
++
++#define CLK_UART_CTRL			0x00054
++#define CLK_UART_DIV_INT		0x00058
++#define CLK_UART_SEL			0x00060
++
++#define CLK_ETH_CTRL			0x00064
++#define CLK_ETH_DIV_INT			0x00068
++#define CLK_ETH_SEL			0x00070
++
++#define CLK_PWM0_CTRL			0x00074
++#define CLK_PWM0_DIV_INT		0x00078
++#define CLK_PWM0_DIV_FRAC		0x0007c
++#define CLK_PWM0_SEL			0x00080
++
++#define CLK_PWM1_CTRL			0x00084
++#define CLK_PWM1_DIV_INT		0x00088
++#define CLK_PWM1_DIV_FRAC		0x0008c
++#define CLK_PWM1_SEL			0x00090
++
++#define CLK_AUDIO_IN_CTRL		0x00094
++#define CLK_AUDIO_IN_DIV_INT		0x00098
++#define CLK_AUDIO_IN_SEL		0x000a0
++
++#define CLK_AUDIO_OUT_CTRL		0x000a4
++#define CLK_AUDIO_OUT_DIV_INT		0x000a8
++#define CLK_AUDIO_OUT_SEL		0x000b0
++
++#define CLK_I2S_CTRL			0x000b4
++#define CLK_I2S_DIV_INT			0x000b8
++#define CLK_I2S_SEL			0x000c0
++
++#define CLK_MIPI0_CFG_CTRL		0x000c4
++#define CLK_MIPI0_CFG_DIV_INT		0x000c8
++#define CLK_MIPI0_CFG_SEL		0x000d0
++
++#define CLK_MIPI1_CFG_CTRL		0x000d4
++#define CLK_MIPI1_CFG_DIV_INT		0x000d8
++#define CLK_MIPI1_CFG_SEL		0x000e0
++
++#define CLK_PCIE_AUX_CTRL		0x000e4
++#define CLK_PCIE_AUX_DIV_INT		0x000e8
++#define CLK_PCIE_AUX_SEL		0x000f0
++
++#define CLK_USBH0_MICROFRAME_CTRL	0x000f4
++#define CLK_USBH0_MICROFRAME_DIV_INT	0x000f8
++#define CLK_USBH0_MICROFRAME_SEL	0x00100
++
++#define CLK_USBH1_MICROFRAME_CTRL	0x00104
++#define CLK_USBH1_MICROFRAME_DIV_INT	0x00108
++#define CLK_USBH1_MICROFRAME_SEL	0x00110
++
++#define CLK_USBH0_SUSPEND_CTRL		0x00114
++#define CLK_USBH0_SUSPEND_DIV_INT	0x00118
++#define CLK_USBH0_SUSPEND_SEL		0x00120
++
++#define CLK_USBH1_SUSPEND_CTRL		0x00124
++#define CLK_USBH1_SUSPEND_DIV_INT	0x00128
++#define CLK_USBH1_SUSPEND_SEL		0x00130
++
++#define CLK_ETH_TSU_CTRL		0x00134
++#define CLK_ETH_TSU_DIV_INT		0x00138
++#define CLK_ETH_TSU_SEL			0x00140
++
++#define CLK_ADC_CTRL			0x00144
++#define CLK_ADC_DIV_INT			0x00148
++#define CLK_ADC_SEL			0x00150
++
++#define CLK_SDIO_TIMER_CTRL		0x00154
++#define CLK_SDIO_TIMER_DIV_INT		0x00158
++#define CLK_SDIO_TIMER_SEL		0x00160
++
++#define CLK_SDIO_ALT_SRC_CTRL		0x00164
++#define CLK_SDIO_ALT_SRC_DIV_INT	0x00168
++#define CLK_SDIO_ALT_SRC_SEL		0x00170
++
++#define CLK_GP0_CTRL			0x00174
++#define CLK_GP0_DIV_INT			0x00178
++#define CLK_GP0_DIV_FRAC		0x0017c
++#define CLK_GP0_SEL			0x00180
++
++#define CLK_GP1_CTRL			0x00184
++#define CLK_GP1_DIV_INT			0x00188
++#define CLK_GP1_DIV_FRAC		0x0018c
++#define CLK_GP1_SEL			0x00190
++
++#define CLK_GP2_CTRL			0x00194
++#define CLK_GP2_DIV_INT			0x00198
++#define CLK_GP2_DIV_FRAC		0x0019c
++#define CLK_GP2_SEL			0x001a0
++
++#define CLK_GP3_CTRL			0x001a4
++#define CLK_GP3_DIV_INT			0x001a8
++#define CLK_GP3_DIV_FRAC		0x001ac
++#define CLK_GP3_SEL			0x001b0
++
++#define CLK_GP4_CTRL			0x001b4
++#define CLK_GP4_DIV_INT			0x001b8
++#define CLK_GP4_DIV_FRAC		0x001bc
++#define CLK_GP4_SEL			0x001c0
++
++#define CLK_GP5_CTRL			0x001c4
++#define CLK_GP5_DIV_INT			0x001c8
++#define CLK_GP5_DIV_FRAC		0x001cc
++#define CLK_GP5_SEL			0x001d0
++
++#define CLK_SYS_RESUS_CTRL		0x0020c
++
++#define CLK_SLOW_SYS_RESUS_CTRL		0x00214
++
++#define FC0_REF_KHZ			0x0021c
++#define FC0_MIN_KHZ			0x00220
++#define FC0_MAX_KHZ			0x00224
++#define FC0_DELAY			0x00228
++#define FC0_INTERVAL			0x0022c
++#define FC0_SRC				0x00230
++#define FC0_STATUS			0x00234
++#define FC0_RESULT			0x00238
++#define FC_SIZE				0x20
++#define FC_COUNT			8
++#define FC_NUM(idx, off)		((idx) * 32 + (off))
++
++#define AUX_SEL				1
++
++#define VIDEO_CLOCKS_OFFSET		0x4000
++#define VIDEO_CLK_VEC_CTRL		(VIDEO_CLOCKS_OFFSET + 0x0000)
++#define VIDEO_CLK_VEC_DIV_INT		(VIDEO_CLOCKS_OFFSET + 0x0004)
++#define VIDEO_CLK_VEC_SEL		(VIDEO_CLOCKS_OFFSET + 0x000c)
++#define VIDEO_CLK_DPI_CTRL		(VIDEO_CLOCKS_OFFSET + 0x0010)
++#define VIDEO_CLK_DPI_DIV_INT		(VIDEO_CLOCKS_OFFSET + 0x0014)
++#define VIDEO_CLK_DPI_SEL		(VIDEO_CLOCKS_OFFSET + 0x001c)
++#define VIDEO_CLK_MIPI0_DPI_CTRL	(VIDEO_CLOCKS_OFFSET + 0x0020)
++#define VIDEO_CLK_MIPI0_DPI_DIV_INT	(VIDEO_CLOCKS_OFFSET + 0x0024)
++#define VIDEO_CLK_MIPI0_DPI_DIV_FRAC	(VIDEO_CLOCKS_OFFSET + 0x0028)
++#define VIDEO_CLK_MIPI0_DPI_SEL		(VIDEO_CLOCKS_OFFSET + 0x002c)
++#define VIDEO_CLK_MIPI1_DPI_CTRL	(VIDEO_CLOCKS_OFFSET + 0x0030)
++#define VIDEO_CLK_MIPI1_DPI_DIV_INT	(VIDEO_CLOCKS_OFFSET + 0x0034)
++#define VIDEO_CLK_MIPI1_DPI_DIV_FRAC	(VIDEO_CLOCKS_OFFSET + 0x0038)
++#define VIDEO_CLK_MIPI1_DPI_SEL		(VIDEO_CLOCKS_OFFSET + 0x003c)
++
++#define DIV_INT_8BIT_MAX		0x000000ffu /* max divide for most clocks */
++#define DIV_INT_16BIT_MAX		0x0000ffffu /* max divide for GPx, PWM */
++#define DIV_INT_24BIT_MAX               0x00ffffffu /* max divide for CLK_SYS */
++
++#define FC0_STATUS_DONE			BIT(4)
++#define FC0_STATUS_RUNNING		BIT(8)
++#define FC0_RESULT_FRAC_SHIFT		5
++
++#define PLL_PRIM_DIV1_SHIFT		16
++#define PLL_PRIM_DIV1_MASK		0x00070000
++#define PLL_PRIM_DIV2_SHIFT		12
++#define PLL_PRIM_DIV2_MASK		0x00007000
++
++#define PLL_SEC_DIV_SHIFT		8
++#define PLL_SEC_DIV_WIDTH		5
++#define PLL_SEC_DIV_MASK		0x00001f00
++
++#define PLL_CS_LOCK			BIT(31)
++#define PLL_CS_REFDIV_SHIFT		0
++
++#define PLL_PWR_PD			BIT(0)
++#define PLL_PWR_DACPD			BIT(1)
++#define PLL_PWR_DSMPD			BIT(2)
++#define PLL_PWR_POSTDIVPD		BIT(3)
++#define PLL_PWR_4PHASEPD		BIT(4)
++#define PLL_PWR_VCOPD			BIT(5)
++#define PLL_PWR_MASK			0x0000003f
++
++#define PLL_SEC_RST			BIT(16)
++#define PLL_SEC_IMPL			BIT(31)
++
++/* PLL phase output for both PRI and SEC */
++#define PLL_PH_EN			BIT(4)
++#define PLL_PH_PHASE_SHIFT		0
++
++#define RP1_PLL_PHASE_0			0
++#define RP1_PLL_PHASE_90		1
++#define RP1_PLL_PHASE_180		2
++#define RP1_PLL_PHASE_270		3
++
++/* Clock fields for all clocks */
++#define CLK_CTRL_ENABLE			BIT(11)
++#define CLK_CTRL_AUXSRC_MASK		0x000003e0
++#define CLK_CTRL_AUXSRC_SHIFT		5
++#define CLK_CTRL_SRC_SHIFT		0
++#define CLK_DIV_FRAC_BITS		16
++
++#define KHz				1000
++#define MHz				(KHz * KHz)
++#define LOCK_TIMEOUT_NS			100000000
++#define FC_TIMEOUT_NS			100000000
++
++#define MAX_CLK_PARENTS	16
++
++#define MEASURE_CLOCK_RATE
++const char * const fc0_ref_clk_name = "clk_slow_sys";
++
++#define ABS_DIFF(a, b) ((a) > (b) ? (a) - (b) : (b) - (a))
++#define DIV_NEAREST(a, b) (((a) + ((b) >> 1)) / (b))
++#define DIV_U64_NEAREST(a, b) div_u64(((a) + ((b) >> 1)), (b))
++
++/*
++ * Names of the reference clock for the pll cores.  This name must match
++ * the DT reference clock-output-name.
++ */
++static const char *const ref_clock = "xosc";
++
++/*
++ * Secondary PLL channel output divider table.
++ * Divider values range from 8 to 19.
++ * Invalid values default to 19
++ */
++static const struct clk_div_table pll_sec_div_table[] = {
++	{ 0x00, 19 },
++	{ 0x01, 19 },
++	{ 0x02, 19 },
++	{ 0x03, 19 },
++	{ 0x04, 19 },
++	{ 0x05, 19 },
++	{ 0x06, 19 },
++	{ 0x07, 19 },
++	{ 0x08,  8 },
++	{ 0x09,  9 },
++	{ 0x0a, 10 },
++	{ 0x0b, 11 },
++	{ 0x0c, 12 },
++	{ 0x0d, 13 },
++	{ 0x0e, 14 },
++	{ 0x0f, 15 },
++	{ 0x10, 16 },
++	{ 0x11, 17 },
++	{ 0x12, 18 },
++	{ 0x13, 19 },
++	{ 0x14, 19 },
++	{ 0x15, 19 },
++	{ 0x16, 19 },
++	{ 0x17, 19 },
++	{ 0x18, 19 },
++	{ 0x19, 19 },
++	{ 0x1a, 19 },
++	{ 0x1b, 19 },
++	{ 0x1c, 19 },
++	{ 0x1d, 19 },
++	{ 0x1e, 19 },
++	{ 0x1f, 19 },
++	{ 0 }
++};
++
++struct rp1_clockman {
++	struct device *dev;
++	void __iomem *regs;
++	spinlock_t regs_lock; /* spinlock for all clocks */
++
++	/* Must be last */
++	struct clk_hw_onecell_data onecell;
++};
++
++struct rp1_pll_core_data {
++	const char *name;
++	u32 cs_reg;
++	u32 pwr_reg;
++	u32 fbdiv_int_reg;
++	u32 fbdiv_frac_reg;
++	unsigned long flags;
++	u32 fc0_src;
++};
++
++struct rp1_pll_data {
++	const char *name;
++	const char *source_pll;
++	u32 ctrl_reg;
++	unsigned long flags;
++	u32 fc0_src;
++};
++
++struct rp1_pll_ph_data {
++	const char *name;
++	const char *source_pll;
++	unsigned int phase;
++	unsigned int fixed_divider;
++	u32 ph_reg;
++	unsigned long flags;
++	u32 fc0_src;
++};
++
++struct rp1_pll_divider_data {
++	const char *name;
++	const char *source_pll;
++	u32 sec_reg;
++	unsigned long flags;
++	u32 fc0_src;
++};
++
++struct rp1_clock_data {
++	const char *name;
++	const char *const parents[MAX_CLK_PARENTS];
++	int num_std_parents;
++	int num_aux_parents;
++	unsigned long flags;
++	u32 oe_mask;
++	u32 clk_src_mask;
++	u32 ctrl_reg;
++	u32 div_int_reg;
++	u32 div_frac_reg;
++	u32 sel_reg;
++	u32 div_int_max;
++	unsigned long max_freq;
++	u32 fc0_src;
++};
++
++struct rp1_pll_core {
++	struct clk_hw hw;
++	struct rp1_clockman *clockman;
++	const struct rp1_pll_core_data *data;
++	unsigned long cached_rate;
++};
++
++struct rp1_pll {
++	struct clk_hw hw;
++	struct clk_divider div;
++	struct rp1_clockman *clockman;
++	const struct rp1_pll_data *data;
++	unsigned long cached_rate;
++};
++
++struct rp1_pll_ph {
++	struct clk_hw hw;
++	struct rp1_clockman *clockman;
++	const struct rp1_pll_ph_data *data;
++};
++
++struct rp1_clock {
++	struct clk_hw hw;
++	struct rp1_clockman *clockman;
++	const struct rp1_clock_data *data;
++	unsigned long cached_rate;
++};
++
++struct rp1_varsrc {
++	struct clk_hw hw;
++	struct rp1_clockman *clockman;
++	unsigned long rate;
++};
++
++struct rp1_clk_change {
++	struct clk_hw *hw;
++	unsigned long new_rate;
++};
++
++struct rp1_clk_change rp1_clk_chg_tree[3];
++
++static struct clk_hw *clk_xosc;
++static struct clk_hw *clk_audio;
++static struct clk_hw *clk_i2s;
++
++static void rp1_debugfs_regset(struct rp1_clockman *clockman, u32 base,
++			       const struct debugfs_reg32 *regs,
++			       size_t nregs, struct dentry *dentry)
++{
++	struct debugfs_regset32 *regset;
++
++	regset = devm_kzalloc(clockman->dev, sizeof(*regset), GFP_KERNEL);
++	if (!regset)
++		return;
++
++	regset->regs = regs;
++	regset->nregs = nregs;
++	regset->base = clockman->regs + base;
++
++	debugfs_create_regset32("regdump", 0444, dentry, regset);
++}
++
++static inline u32 set_register_field(u32 reg, u32 val, u32 mask, u32 shift)
++{
++	reg &= ~mask;
++	reg |= (val << shift) & mask;
++	return reg;
++}
++
++static inline
++void clockman_write(struct rp1_clockman *clockman, u32 reg, u32 val)
++{
++	writel(val, clockman->regs + reg);
++}
++
++static inline u32 clockman_read(struct rp1_clockman *clockman, u32 reg)
++{
++	return readl(clockman->regs + reg);
++}
++
++#ifdef MEASURE_CLOCK_RATE
++static unsigned long clockman_measure_clock(struct rp1_clockman *clockman,
++					    const char *clk_name,
++					    unsigned int fc0_src)
++{
++	struct clk *ref_clk = __clk_lookup(fc0_ref_clk_name);
++	unsigned long result;
++	ktime_t timeout;
++	unsigned int fc_idx, fc_offset, fc_src;
++
++	fc_idx = fc0_src / 32;
++	fc_src = fc0_src % 32;
++
++	/* fc_src == 0 is invalid. */
++	if (!fc_src || fc_idx >= FC_COUNT)
++		return 0;
++
++	fc_offset = fc_idx * FC_SIZE;
++
++	/* Ensure the frequency counter is idle. */
++	timeout = ktime_add_ns(ktime_get(), FC_TIMEOUT_NS);
++	while (clockman_read(clockman, fc_offset + FC0_STATUS) & FC0_STATUS_RUNNING) {
++		if (ktime_after(ktime_get(), timeout)) {
++			dev_err(clockman->dev, "%s: FC0 busy timeout\n",
++				clk_name);
++			return 0;
++		}
++		cpu_relax();
++	}
++
++	spin_lock(&clockman->regs_lock);
++	clockman_write(clockman, fc_offset + FC0_REF_KHZ,
++		       clk_get_rate(ref_clk) / KHz);
++	clockman_write(clockman, fc_offset + FC0_MIN_KHZ, 0);
++	clockman_write(clockman, fc_offset + FC0_MAX_KHZ, 0x1ffffff);
++	clockman_write(clockman, fc_offset + FC0_INTERVAL, 8);
++	clockman_write(clockman, fc_offset + FC0_DELAY, 7);
++	clockman_write(clockman, fc_offset + FC0_SRC, fc_src);
++	spin_unlock(&clockman->regs_lock);
++
++	/* Ensure the frequency counter is idle. */
++	timeout = ktime_add_ns(ktime_get(), FC_TIMEOUT_NS);
++	while (!(clockman_read(clockman, fc_offset + FC0_STATUS) & FC0_STATUS_DONE)) {
++		if (ktime_after(ktime_get(), timeout)) {
++			dev_err(clockman->dev, "%s: FC0 wait timeout\n",
++				clk_name);
++			return 0;
++		}
++		cpu_relax();
++	}
++
++	result = clockman_read(clockman, fc_offset + FC0_RESULT);
++
++	/* Disable FC0 */
++	spin_lock(&clockman->regs_lock);
++	clockman_write(clockman, fc_offset + FC0_SRC, 0);
++	spin_unlock(&clockman->regs_lock);
++
++	return result;
++}
++#endif
++
++static int rp1_pll_core_is_on(struct clk_hw *hw)
++{
++	struct rp1_pll_core *pll_core = container_of(hw, struct rp1_pll_core, hw);
++	struct rp1_clockman *clockman = pll_core->clockman;
++	const struct rp1_pll_core_data *data = pll_core->data;
++	u32 pwr = clockman_read(clockman, data->pwr_reg);
++
++	return (pwr & PLL_PWR_PD) || (pwr & PLL_PWR_POSTDIVPD);
++}
++
++static int rp1_pll_core_on(struct clk_hw *hw)
++{
++	struct rp1_pll_core *pll_core = container_of(hw, struct rp1_pll_core, hw);
++	struct rp1_clockman *clockman = pll_core->clockman;
++	const struct rp1_pll_core_data *data = pll_core->data;
++	u32 fbdiv_frac;
++	ktime_t timeout;
++
++	spin_lock(&clockman->regs_lock);
++
++	if (!(clockman_read(clockman, data->cs_reg) & PLL_CS_LOCK)) {
++		/* Reset to a known state. */
++		clockman_write(clockman, data->pwr_reg, PLL_PWR_MASK);
++		clockman_write(clockman, data->fbdiv_int_reg, 20);
++		clockman_write(clockman, data->fbdiv_frac_reg, 0);
++		clockman_write(clockman, data->cs_reg, 1 << PLL_CS_REFDIV_SHIFT);
++	}
++
++	/* Come out of reset. */
++	fbdiv_frac = clockman_read(clockman, data->fbdiv_frac_reg);
++	clockman_write(clockman, data->pwr_reg, fbdiv_frac ? 0 : PLL_PWR_DSMPD);
++	spin_unlock(&clockman->regs_lock);
++
++	/* Wait for the PLL to lock. */
++	timeout = ktime_add_ns(ktime_get(), LOCK_TIMEOUT_NS);
++	while (!(clockman_read(clockman, data->cs_reg) & PLL_CS_LOCK)) {
++		if (ktime_after(ktime_get(), timeout)) {
++			dev_err(clockman->dev, "%s: can't lock PLL\n",
++				clk_hw_get_name(hw));
++			return -ETIMEDOUT;
++		}
++		cpu_relax();
++	}
++
++	return 0;
++}
++
++static void rp1_pll_core_off(struct clk_hw *hw)
++{
++	struct rp1_pll_core *pll_core = container_of(hw, struct rp1_pll_core, hw);
++	struct rp1_clockman *clockman = pll_core->clockman;
++	const struct rp1_pll_core_data *data = pll_core->data;
++
++	spin_lock(&clockman->regs_lock);
++	clockman_write(clockman, data->pwr_reg, 0);
++	spin_unlock(&clockman->regs_lock);
++}
++
++static inline unsigned long get_pll_core_divider(struct clk_hw *hw,
++						 unsigned long rate,
++						 unsigned long parent_rate,
++						 u32 *div_int, u32 *div_frac)
++{
++	unsigned long calc_rate;
++	u32 fbdiv_int, fbdiv_frac;
++	u64 div_fp64; /* 32.32 fixed point fraction. */
++
++	/* Factor of reference clock to VCO frequency. */
++	div_fp64 = (u64)(rate) << 32;
++	div_fp64 = DIV_U64_NEAREST(div_fp64, parent_rate);
++
++	/* Round the fractional component at 24 bits. */
++	div_fp64 += 1 << (32 - 24 - 1);
++
++	fbdiv_int = div_fp64 >> 32;
++	fbdiv_frac = (div_fp64 >> (32 - 24)) & 0xffffff;
++
++	calc_rate =
++		((u64)parent_rate * (((u64)fbdiv_int << 24) + fbdiv_frac) + (1 << 23)) >> 24;
++
++	*div_int = fbdiv_int;
++	*div_frac = fbdiv_frac;
++
++	return calc_rate;
++}
++
++static int rp1_pll_core_set_rate(struct clk_hw *hw,
++				 unsigned long rate, unsigned long parent_rate)
++{
++	struct rp1_pll_core *pll_core = container_of(hw, struct rp1_pll_core, hw);
++	struct rp1_clockman *clockman = pll_core->clockman;
++	const struct rp1_pll_core_data *data = pll_core->data;
++	unsigned long calc_rate;
++	u32 fbdiv_int, fbdiv_frac;
++
++	// todo: is this needed??
++	//rp1_pll_off(hw);
++
++	/* Disable dividers to start with. */
++	spin_lock(&clockman->regs_lock);
++	clockman_write(clockman, data->fbdiv_int_reg, 0);
++	clockman_write(clockman, data->fbdiv_frac_reg, 0);
++	spin_unlock(&clockman->regs_lock);
++
++	calc_rate = get_pll_core_divider(hw, rate, parent_rate,
++					 &fbdiv_int, &fbdiv_frac);
++
++	spin_lock(&clockman->regs_lock);
++	clockman_write(clockman, data->pwr_reg, fbdiv_frac ? 0 : PLL_PWR_DSMPD);
++	clockman_write(clockman, data->fbdiv_int_reg, fbdiv_int);
++	clockman_write(clockman, data->fbdiv_frac_reg, fbdiv_frac);
++	spin_unlock(&clockman->regs_lock);
++
++	/* Check that reference frequency is no greater than VCO / 16. */
++	BUG_ON(parent_rate > (rate / 16));
++
++	pll_core->cached_rate = calc_rate;
++
++	spin_lock(&clockman->regs_lock);
++	/* Don't need to divide ref unless parent_rate > (output freq / 16) */
++	clockman_write(clockman, data->cs_reg,
++		       clockman_read(clockman, data->cs_reg) |
++				     (1 << PLL_CS_REFDIV_SHIFT));
++	spin_unlock(&clockman->regs_lock);
++
++	return 0;
++}
++
++static unsigned long rp1_pll_core_recalc_rate(struct clk_hw *hw,
++					      unsigned long parent_rate)
++{
++	struct rp1_pll_core *pll_core = container_of(hw, struct rp1_pll_core, hw);
++	struct rp1_clockman *clockman = pll_core->clockman;
++	const struct rp1_pll_core_data *data = pll_core->data;
++	u32 fbdiv_int, fbdiv_frac;
++	unsigned long calc_rate;
++
++	fbdiv_int = clockman_read(clockman, data->fbdiv_int_reg);
++	fbdiv_frac = clockman_read(clockman, data->fbdiv_frac_reg);
++	calc_rate =
++		((u64)parent_rate * (((u64)fbdiv_int << 24) + fbdiv_frac) + (1 << 23)) >> 24;
++
++	return calc_rate;
++}
++
++static long rp1_pll_core_round_rate(struct clk_hw *hw, unsigned long rate,
++				    unsigned long *parent_rate)
++{
++	u32 fbdiv_int, fbdiv_frac;
++	long calc_rate;
++
++	calc_rate = get_pll_core_divider(hw, rate, *parent_rate,
++					 &fbdiv_int, &fbdiv_frac);
++	return calc_rate;
++}
++
++static void rp1_pll_core_debug_init(struct clk_hw *hw, struct dentry *dentry)
++{
++	struct rp1_pll_core *pll_core = container_of(hw, struct rp1_pll_core, hw);
++	struct rp1_clockman *clockman = pll_core->clockman;
++	const struct rp1_pll_core_data *data = pll_core->data;
++	struct debugfs_reg32 *regs;
++
++	regs = devm_kcalloc(clockman->dev, 4, sizeof(*regs), GFP_KERNEL);
++	if (!regs)
++		return;
++
++	regs[0].name = "cs";
++	regs[0].offset = data->cs_reg;
++	regs[1].name = "pwr";
++	regs[1].offset = data->pwr_reg;
++	regs[2].name = "fbdiv_int";
++	regs[2].offset = data->fbdiv_int_reg;
++	regs[3].name = "fbdiv_frac";
++	regs[3].offset = data->fbdiv_frac_reg;
++
++	rp1_debugfs_regset(clockman, 0, regs, 4, dentry);
++}
++
++static void get_pll_prim_dividers(unsigned long rate, unsigned long parent_rate,
++				  u32 *divider1, u32 *divider2)
++{
++	unsigned int div1, div2;
++	unsigned int best_div1 = 7, best_div2 = 7;
++	unsigned long best_rate_diff =
++		ABS_DIFF(DIV_ROUND_CLOSEST(parent_rate, best_div1 * best_div2), rate);
++	long rate_diff, calc_rate;
++
++	for (div1 = 1; div1 <= 7; div1++) {
++		for (div2 = 1; div2 <= div1; div2++) {
++			calc_rate = DIV_ROUND_CLOSEST(parent_rate, div1 * div2);
++			rate_diff = ABS_DIFF(calc_rate, rate);
++
++			if (calc_rate == rate) {
++				best_div1 = div1;
++				best_div2 = div2;
++				goto done;
++			} else if (rate_diff < best_rate_diff) {
++				best_div1 = div1;
++				best_div2 = div2;
++				best_rate_diff = rate_diff;
++			}
++		}
++	}
++
++done:
++	*divider1 = best_div1;
++	*divider2 = best_div2;
++}
++
++static int rp1_pll_set_rate(struct clk_hw *hw,
++			    unsigned long rate, unsigned long parent_rate)
++{
++	struct rp1_pll *pll = container_of(hw, struct rp1_pll, hw);
++	struct rp1_clockman *clockman = pll->clockman;
++	const struct rp1_pll_data *data = pll->data;
++	u32 prim, prim_div1, prim_div2;
++
++	get_pll_prim_dividers(rate, parent_rate, &prim_div1, &prim_div2);
++
++	spin_lock(&clockman->regs_lock);
++	prim = clockman_read(clockman, data->ctrl_reg);
++	prim = set_register_field(prim, prim_div1, PLL_PRIM_DIV1_MASK,
++				  PLL_PRIM_DIV1_SHIFT);
++	prim = set_register_field(prim, prim_div2, PLL_PRIM_DIV2_MASK,
++				  PLL_PRIM_DIV2_SHIFT);
++	clockman_write(clockman, data->ctrl_reg, prim);
++	spin_unlock(&clockman->regs_lock);
++
++#ifdef MEASURE_CLOCK_RATE
++	clockman_measure_clock(clockman, data->name, data->fc0_src);
++#endif
++	return 0;
++}
++
++static unsigned long rp1_pll_recalc_rate(struct clk_hw *hw,
++					 unsigned long parent_rate)
++{
++	struct rp1_pll *pll = container_of(hw, struct rp1_pll, hw);
++	struct rp1_clockman *clockman = pll->clockman;
++	const struct rp1_pll_data *data = pll->data;
++	u32 prim, prim_div1, prim_div2;
++
++	prim = clockman_read(clockman, data->ctrl_reg);
++	prim_div1 = (prim & PLL_PRIM_DIV1_MASK) >> PLL_PRIM_DIV1_SHIFT;
++	prim_div2 = (prim & PLL_PRIM_DIV2_MASK) >> PLL_PRIM_DIV2_SHIFT;
++
++	if (!prim_div1 || !prim_div2) {
++		dev_err(clockman->dev, "%s: (%s) zero divider value\n",
++			__func__, data->name);
++		return 0;
++	}
++
++	return DIV_ROUND_CLOSEST(parent_rate, prim_div1 * prim_div2);
++}
++
++static long rp1_pll_round_rate(struct clk_hw *hw, unsigned long rate,
++			       unsigned long *parent_rate)
++{
++	const struct rp1_clk_change *chg = &rp1_clk_chg_tree[1];
++	u32 div1, div2;
++
++	if (chg->hw == hw && chg->new_rate == rate)
++		*parent_rate = chg[1].new_rate;
++
++	get_pll_prim_dividers(rate, *parent_rate, &div1, &div2);
++
++	return DIV_ROUND_CLOSEST(*parent_rate, div1 * div2);
++}
++
++static void rp1_pll_debug_init(struct clk_hw *hw,
++			       struct dentry *dentry)
++{
++	struct rp1_pll *pll = container_of(hw, struct rp1_pll, hw);
++	struct rp1_clockman *clockman = pll->clockman;
++	const struct rp1_pll_data *data = pll->data;
++	struct debugfs_reg32 *regs;
++
++	regs = devm_kcalloc(clockman->dev, 1, sizeof(*regs), GFP_KERNEL);
++	if (!regs)
++		return;
++
++	regs[0].name = "prim";
++	regs[0].offset = data->ctrl_reg;
++
++	rp1_debugfs_regset(clockman, 0, regs, 1, dentry);
++}
++
++static int rp1_pll_ph_is_on(struct clk_hw *hw)
++{
++	struct rp1_pll_ph *pll = container_of(hw, struct rp1_pll_ph, hw);
++	struct rp1_clockman *clockman = pll->clockman;
++	const struct rp1_pll_ph_data *data = pll->data;
++
++	return !!(clockman_read(clockman, data->ph_reg) & PLL_PH_EN);
++}
++
++static int rp1_pll_ph_on(struct clk_hw *hw)
++{
++	struct rp1_pll_ph *pll_ph = container_of(hw, struct rp1_pll_ph, hw);
++	struct rp1_clockman *clockman = pll_ph->clockman;
++	const struct rp1_pll_ph_data *data = pll_ph->data;
++	u32 ph_reg;
++
++	/* todo: ensure pri/sec is enabled! */
++	spin_lock(&clockman->regs_lock);
++	ph_reg = clockman_read(clockman, data->ph_reg);
++	ph_reg |= data->phase << PLL_PH_PHASE_SHIFT;
++	ph_reg |= PLL_PH_EN;
++	clockman_write(clockman, data->ph_reg, ph_reg);
++	spin_unlock(&clockman->regs_lock);
++
++#ifdef MEASURE_CLOCK_RATE
++	clockman_measure_clock(clockman, data->name, data->fc0_src);
++#endif
++	return 0;
++}
++
++static void rp1_pll_ph_off(struct clk_hw *hw)
++{
++	struct rp1_pll_ph *pll_ph = container_of(hw, struct rp1_pll_ph, hw);
++	struct rp1_clockman *clockman = pll_ph->clockman;
++	const struct rp1_pll_ph_data *data = pll_ph->data;
++
++	spin_lock(&clockman->regs_lock);
++	clockman_write(clockman, data->ph_reg,
++		       clockman_read(clockman, data->ph_reg) & ~PLL_PH_EN);
++	spin_unlock(&clockman->regs_lock);
++}
++
++static int rp1_pll_ph_set_rate(struct clk_hw *hw,
++			       unsigned long rate, unsigned long parent_rate)
++{
++	struct rp1_pll_ph *pll_ph = container_of(hw, struct rp1_pll_ph, hw);
++	const struct rp1_pll_ph_data *data = pll_ph->data;
++	struct rp1_clockman *clockman = pll_ph->clockman;
++
++	/* Nothing really to do here! */
++	WARN_ON(data->fixed_divider != 1 && data->fixed_divider != 2);
++	WARN_ON(rate != parent_rate / data->fixed_divider);
++
++#ifdef MEASURE_CLOCK_RATE
++	if (rp1_pll_ph_is_on(hw))
++		clockman_measure_clock(clockman, data->name, data->fc0_src);
++#endif
++	return 0;
++}
++
++static unsigned long rp1_pll_ph_recalc_rate(struct clk_hw *hw,
++					    unsigned long parent_rate)
++{
++	struct rp1_pll_ph *pll_ph = container_of(hw, struct rp1_pll_ph, hw);
++	const struct rp1_pll_ph_data *data = pll_ph->data;
++
++	return parent_rate / data->fixed_divider;
++}
++
++static long rp1_pll_ph_round_rate(struct clk_hw *hw, unsigned long rate,
++				  unsigned long *parent_rate)
++{
++	struct rp1_pll_ph *pll_ph = container_of(hw, struct rp1_pll_ph, hw);
++	const struct rp1_pll_ph_data *data = pll_ph->data;
++
++	return *parent_rate / data->fixed_divider;
++}
++
++static void rp1_pll_ph_debug_init(struct clk_hw *hw,
++				  struct dentry *dentry)
++{
++	struct rp1_pll_ph *pll_ph = container_of(hw, struct rp1_pll_ph, hw);
++	const struct rp1_pll_ph_data *data = pll_ph->data;
++	struct rp1_clockman *clockman = pll_ph->clockman;
++	struct debugfs_reg32 *regs;
++
++	regs = devm_kcalloc(clockman->dev, 1, sizeof(*regs), GFP_KERNEL);
++	if (!regs)
++		return;
++
++	regs[0].name = "ph_reg";
++	regs[0].offset = data->ph_reg;
++
++	rp1_debugfs_regset(clockman, 0, regs, 1, dentry);
++}
++
++static int rp1_pll_divider_is_on(struct clk_hw *hw)
++{
++	struct rp1_pll *divider = container_of(hw, struct rp1_pll, div.hw);
++	struct rp1_clockman *clockman = divider->clockman;
++	const struct rp1_pll_data *data = divider->data;
++
++	return !(clockman_read(clockman, data->ctrl_reg) & PLL_SEC_RST);
++}
++
++static int rp1_pll_divider_on(struct clk_hw *hw)
++{
++	struct rp1_pll *divider = container_of(hw, struct rp1_pll, div.hw);
++	struct rp1_clockman *clockman = divider->clockman;
++	const struct rp1_pll_data *data = divider->data;
++
++	spin_lock(&clockman->regs_lock);
++	/* Check the implementation bit is set! */
++	WARN_ON(!(clockman_read(clockman, data->ctrl_reg) & PLL_SEC_IMPL));
++	clockman_write(clockman, data->ctrl_reg,
++		       clockman_read(clockman, data->ctrl_reg) & ~PLL_SEC_RST);
++	spin_unlock(&clockman->regs_lock);
++
++#ifdef MEASURE_CLOCK_RATE
++	clockman_measure_clock(clockman, data->name, data->fc0_src);
++#endif
++	return 0;
++}
++
++static void rp1_pll_divider_off(struct clk_hw *hw)
++{
++	struct rp1_pll *divider = container_of(hw, struct rp1_pll, div.hw);
++	struct rp1_clockman *clockman = divider->clockman;
++	const struct rp1_pll_data *data = divider->data;
++
++	spin_lock(&clockman->regs_lock);
++	clockman_write(clockman, data->ctrl_reg, PLL_SEC_RST);
++	spin_unlock(&clockman->regs_lock);
++}
++
++static int rp1_pll_divider_set_rate(struct clk_hw *hw,
++				    unsigned long rate,
++				    unsigned long parent_rate)
++{
++	struct rp1_pll *divider = container_of(hw, struct rp1_pll, div.hw);
++	struct rp1_clockman *clockman = divider->clockman;
++	const struct rp1_pll_data *data = divider->data;
++	u32 div, sec;
++
++	div = DIV_ROUND_UP_ULL(parent_rate, rate);
++	div = clamp(div, 8u, 19u);
++
++	spin_lock(&clockman->regs_lock);
++	sec = clockman_read(clockman, data->ctrl_reg);
++	sec = set_register_field(sec, div, PLL_SEC_DIV_MASK, PLL_SEC_DIV_SHIFT);
++
++	/* Must keep the divider in reset to change the value. */
++	sec |= PLL_SEC_RST;
++	clockman_write(clockman, data->ctrl_reg, sec);
++
++	// todo: must sleep 10 pll vco cycles
++	sec &= ~PLL_SEC_RST;
++	clockman_write(clockman, data->ctrl_reg, sec);
++	spin_unlock(&clockman->regs_lock);
++
++#ifdef MEASURE_CLOCK_RATE
++	if (rp1_pll_divider_is_on(hw))
++		clockman_measure_clock(clockman, data->name, data->fc0_src);
++#endif
++	return 0;
++}
++
++static unsigned long rp1_pll_divider_recalc_rate(struct clk_hw *hw,
++						 unsigned long parent_rate)
++{
++	return clk_divider_ops.recalc_rate(hw, parent_rate);
++}
++
++static long rp1_pll_divider_round_rate(struct clk_hw *hw,
++				       unsigned long rate,
++				       unsigned long *parent_rate)
++{
++	return clk_divider_ops.round_rate(hw, rate, parent_rate);
++}
++
++static void rp1_pll_divider_debug_init(struct clk_hw *hw, struct dentry *dentry)
++{
++	struct rp1_pll *divider = container_of(hw, struct rp1_pll, div.hw);
++	struct rp1_clockman *clockman = divider->clockman;
++	const struct rp1_pll_data *data = divider->data;
++	struct debugfs_reg32 *regs;
++
++	regs = devm_kcalloc(clockman->dev, 1, sizeof(*regs), GFP_KERNEL);
++	if (!regs)
++		return;
++
++	regs[0].name = "sec";
++	regs[0].offset = data->ctrl_reg;
++
++	rp1_debugfs_regset(clockman, 0, regs, 1, dentry);
++}
++
++static int rp1_clock_is_on(struct clk_hw *hw)
++{
++	struct rp1_clock *clock = container_of(hw, struct rp1_clock, hw);
++	struct rp1_clockman *clockman = clock->clockman;
++	const struct rp1_clock_data *data = clock->data;
++
++	return !!(clockman_read(clockman, data->ctrl_reg) & CLK_CTRL_ENABLE);
++}
++
++static unsigned long rp1_clock_recalc_rate(struct clk_hw *hw,
++					   unsigned long parent_rate)
++{
++	struct rp1_clock *clock = container_of(hw, struct rp1_clock, hw);
++	struct rp1_clockman *clockman = clock->clockman;
++	const struct rp1_clock_data *data = clock->data;
++	u64 calc_rate;
++	u64 div;
++
++	u32 frac;
++
++	div = clockman_read(clockman, data->div_int_reg);
++	frac = (data->div_frac_reg != 0) ?
++		clockman_read(clockman, data->div_frac_reg) : 0;
++
++	/* If the integer portion of the divider is 0, treat it as 2^16 */
++	if (!div)
++		div = 1 << 16;
++
++	div = (div << CLK_DIV_FRAC_BITS) | (frac >> (32 - CLK_DIV_FRAC_BITS));
++
++	calc_rate = (u64)parent_rate << CLK_DIV_FRAC_BITS;
++	calc_rate = div64_u64(calc_rate, div);
++
++	return calc_rate;
++}
++
++static int rp1_clock_on(struct clk_hw *hw)
++{
++	struct rp1_clock *clock = container_of(hw, struct rp1_clock, hw);
++	struct rp1_clockman *clockman = clock->clockman;
++	const struct rp1_clock_data *data = clock->data;
++
++	spin_lock(&clockman->regs_lock);
++	clockman_write(clockman, data->ctrl_reg,
++		       clockman_read(clockman, data->ctrl_reg) | CLK_CTRL_ENABLE);
++	/* If this is a GPCLK, turn on the output-enable */
++	if (data->oe_mask)
++		clockman_write(clockman, GPCLK_OE_CTRL,
++			       clockman_read(clockman, GPCLK_OE_CTRL) | data->oe_mask);
++	spin_unlock(&clockman->regs_lock);
++
++#ifdef MEASURE_CLOCK_RATE
++	clockman_measure_clock(clockman, data->name, data->fc0_src);
++#endif
++	return 0;
++}
++
++static void rp1_clock_off(struct clk_hw *hw)
++{
++	struct rp1_clock *clock = container_of(hw, struct rp1_clock, hw);
++	struct rp1_clockman *clockman = clock->clockman;
++	const struct rp1_clock_data *data = clock->data;
++
++	spin_lock(&clockman->regs_lock);
++	clockman_write(clockman, data->ctrl_reg,
++		       clockman_read(clockman, data->ctrl_reg) & ~CLK_CTRL_ENABLE);
++	/* If this is a GPCLK, turn off the output-enable */
++	if (data->oe_mask)
++		clockman_write(clockman, GPCLK_OE_CTRL,
++			       clockman_read(clockman, GPCLK_OE_CTRL) & ~data->oe_mask);
++	spin_unlock(&clockman->regs_lock);
++}
++
++static u32 rp1_clock_choose_div(unsigned long rate, unsigned long parent_rate,
++				const struct rp1_clock_data *data)
++{
++	u64 div;
++
++	/*
++	 * Due to earlier rounding, calculated parent_rate may differ from
++	 * expected value. Don't fail on a small discrepancy near unity divide.
++	 */
++	if (!rate || rate > parent_rate + (parent_rate >> CLK_DIV_FRAC_BITS))
++		return 0;
++
++	/*
++	 * Always express div in fixed-point format for fractional division;
++	 * If no fractional divider is present, the fraction part will be zero.
++	 */
++	if (data->div_frac_reg) {
++		div = (u64)parent_rate << CLK_DIV_FRAC_BITS;
++		div = DIV_U64_NEAREST(div, rate);
++	} else {
++		div = DIV_U64_NEAREST(parent_rate, rate);
++		div <<= CLK_DIV_FRAC_BITS;
++	}
++
++	div = clamp(div,
++		    1ull << CLK_DIV_FRAC_BITS,
++		    (u64)data->div_int_max << CLK_DIV_FRAC_BITS);
++
++	return div;
++}
++
++static u8 rp1_clock_get_parent(struct clk_hw *hw)
++{
++	struct rp1_clock *clock = container_of(hw, struct rp1_clock, hw);
++	struct rp1_clockman *clockman = clock->clockman;
++	const struct rp1_clock_data *data = clock->data;
++	u32 sel, ctrl;
++	u8 parent;
++
++	/* Sel is one-hot, so find the first bit set */
++	sel = clockman_read(clockman, data->sel_reg);
++	parent = ffs(sel) - 1;
++
++	/* sel == 0 implies the parent clock is not enabled yet. */
++	if (!sel) {
++		/* Read the clock src from the CTRL register instead */
++		ctrl = clockman_read(clockman, data->ctrl_reg);
++		parent = (ctrl & data->clk_src_mask) >> CLK_CTRL_SRC_SHIFT;
++	}
++
++	if (parent >= data->num_std_parents)
++		parent = AUX_SEL;
++
++	if (parent == AUX_SEL) {
++		/*
++		 * Clock parent is an auxiliary source, so get the parent from
++		 * the AUXSRC register field.
++		 */
++		ctrl = clockman_read(clockman, data->ctrl_reg);
++		parent = (ctrl & CLK_CTRL_AUXSRC_MASK) >> CLK_CTRL_AUXSRC_SHIFT;
++		parent += data->num_std_parents;
++	}
++
++	return parent;
++}
++
++static int rp1_clock_set_parent(struct clk_hw *hw, u8 index)
++{
++	struct rp1_clock *clock = container_of(hw, struct rp1_clock, hw);
++	struct rp1_clockman *clockman = clock->clockman;
++	const struct rp1_clock_data *data = clock->data;
++	u32 ctrl, sel;
++
++	spin_lock(&clockman->regs_lock);
++	ctrl = clockman_read(clockman, data->ctrl_reg);
++
++	if (index >= data->num_std_parents) {
++		/* This is an aux source request */
++		if (index >= data->num_std_parents + data->num_aux_parents)
++			return -EINVAL;
++
++		/* Select parent from aux list */
++		ctrl = set_register_field(ctrl, index - data->num_std_parents,
++					  CLK_CTRL_AUXSRC_MASK,
++					  CLK_CTRL_AUXSRC_SHIFT);
++		/* Set src to aux list */
++		ctrl = set_register_field(ctrl, AUX_SEL, data->clk_src_mask,
++					  CLK_CTRL_SRC_SHIFT);
++	} else {
++		ctrl = set_register_field(ctrl, index, data->clk_src_mask,
++					  CLK_CTRL_SRC_SHIFT);
++	}
++
++	clockman_write(clockman, data->ctrl_reg, ctrl);
++	spin_unlock(&clockman->regs_lock);
++
++	sel = rp1_clock_get_parent(hw);
++	WARN(sel != index, "(%s): Parent index req %u returned back %u\n",
++	     data->name, index, sel);
++
++	return 0;
++}
++
++static int rp1_clock_set_rate_and_parent(struct clk_hw *hw,
++					 unsigned long rate,
++					 unsigned long parent_rate,
++					 u8 parent)
++{
++	struct rp1_clock *clock = container_of(hw, struct rp1_clock, hw);
++	struct rp1_clockman *clockman = clock->clockman;
++	const struct rp1_clock_data *data = clock->data;
++	u32 div = rp1_clock_choose_div(rate, parent_rate, data);
++
++	WARN(rate > 4000000000ll, "rate is -ve (%d)\n", (int)rate);
++
++	if (WARN(!div,
++		 "clk divider calculated as 0! (%s, rate %ld, parent rate %ld)\n",
++		 data->name, rate, parent_rate))
++		div = 1 << CLK_DIV_FRAC_BITS;
++
++	spin_lock(&clockman->regs_lock);
++
++	clockman_write(clockman, data->div_int_reg, div >> CLK_DIV_FRAC_BITS);
++	if (data->div_frac_reg)
++		clockman_write(clockman, data->div_frac_reg, div << (32 - CLK_DIV_FRAC_BITS));
++
++	spin_unlock(&clockman->regs_lock);
++
++	if (parent != 0xff)
++		rp1_clock_set_parent(hw, parent);
++
++#ifdef MEASURE_CLOCK_RATE
++	if (rp1_clock_is_on(hw))
++		clockman_measure_clock(clockman, data->name, data->fc0_src);
++#endif
++	return 0;
++}
++
++static int rp1_clock_set_rate(struct clk_hw *hw, unsigned long rate,
++			      unsigned long parent_rate)
++{
++	return rp1_clock_set_rate_and_parent(hw, rate, parent_rate, 0xff);
++}
++
++static unsigned long calc_core_pll_rate(struct clk_hw *pll_hw,
++					unsigned long target_rate,
++					int *pdiv_prim, int *pdiv_clk)
++{
++	static const int prim_divs[] = {
++		2, 3, 4, 5, 6, 7, 8, 9, 10, 12, 14, 15, 16,
++		18, 20, 21, 24, 25, 28, 30, 35, 36, 42, 49,
++	};
++	const unsigned long xosc_rate = clk_hw_get_rate(clk_xosc);
++	const unsigned long core_max = 2400000000;
++	const unsigned long core_min = xosc_rate * 16;
++	unsigned long best_rate = core_max + 1;
++	int best_div_prim = 1, best_div_clk = 1;
++	unsigned long core_rate = 0;
++	int div_int, div_frac;
++	u64 div;
++	int i;
++
++	/* Given the target rate, choose a set of divisors/multipliers */
++	for (i = 0; i < ARRAY_SIZE(prim_divs); i++) {
++		int div_prim = prim_divs[i];
++		int div_clk;
++
++		for (div_clk = 1; div_clk <= 256; div_clk++) {
++			core_rate = target_rate * div_clk * div_prim;
++			if (core_rate >= core_min) {
++				if (core_rate < best_rate) {
++					best_rate = core_rate;
++					best_div_prim = div_prim;
++					best_div_clk = div_clk;
++				}
++				break;
++			}
++		}
++	}
++
++	if (best_rate < core_max) {
++		div = ((best_rate << 24) + xosc_rate / 2) / xosc_rate;
++		div_int = div >> 24;
++		div_frac = div % (1 << 24);
++		core_rate = (xosc_rate * ((div_int << 24) + div_frac) + (1 << 23)) >> 24;
++	} else {
++		core_rate = 0;
++	}
++
++	if (pdiv_prim)
++		*pdiv_prim = best_div_prim;
++	if (pdiv_clk)
++		*pdiv_clk = best_div_clk;
++
++	return core_rate;
++}
++
++static void rp1_clock_choose_div_and_prate(struct clk_hw *hw,
++					   int parent_idx,
++					   unsigned long rate,
++					   unsigned long *prate,
++					   unsigned long *calc_rate)
++{
++	struct rp1_clock *clock = container_of(hw, struct rp1_clock, hw);
++	const struct rp1_clock_data *data = clock->data;
++	struct clk_hw *parent;
++	u32 div;
++	u64 tmp;
++	int i;
++
++	parent = clk_hw_get_parent_by_index(hw, parent_idx);
++
++	for (i = 0; i < ARRAY_SIZE(rp1_clk_chg_tree); i++) {
++		const struct rp1_clk_change *chg = &rp1_clk_chg_tree[i];
++
++		if (chg->hw == hw && chg->new_rate == rate) {
++			if (i == 2)
++				*prate = clk_hw_get_rate(clk_xosc);
++			else if (parent == rp1_clk_chg_tree[i + 1].hw)
++				*prate = rp1_clk_chg_tree[i + 1].new_rate;
++			else
++				continue;
++			*calc_rate = chg->new_rate;
++			return;
++		}
++	}
++
++	if (hw == clk_i2s && parent == clk_audio) {
++		unsigned long core_rate, audio_rate, i2s_rate;
++		int div_prim, div_clk;
++
++		core_rate = calc_core_pll_rate(parent, rate, &div_prim, &div_clk);
++		audio_rate = DIV_NEAREST(core_rate, div_prim);
++		i2s_rate = DIV_NEAREST(audio_rate, div_clk);
++		rp1_clk_chg_tree[2].hw = clk_hw_get_parent(parent);
++		rp1_clk_chg_tree[2].new_rate = core_rate;
++		rp1_clk_chg_tree[1].hw = clk_audio;
++		rp1_clk_chg_tree[1].new_rate = audio_rate;
++		rp1_clk_chg_tree[0].hw = clk_i2s;
++		rp1_clk_chg_tree[0].new_rate = i2s_rate;
++		*prate = audio_rate;
++		*calc_rate = i2s_rate;
++		return;
++	}
++
++	*prate = clk_hw_get_rate(parent);
++	div = rp1_clock_choose_div(rate, *prate, data);
++
++	if (!div) {
++		*calc_rate = 0;
++		return;
++	}
++
++	/* Recalculate to account for rounding errors */
++	tmp = (u64)*prate << CLK_DIV_FRAC_BITS;
++	tmp = div_u64(tmp, div);
++	/*
++	 * Prevent overclocks - if all parent choices result in
++	 * a downstream clock in excess of the maximum, then the
++	 * call to set the clock will fail.
++	 */
++	if (tmp > clock->data->max_freq)
++		*calc_rate = 0;
++	else
++		*calc_rate = tmp;
++}
++
++static int rp1_clock_determine_rate(struct clk_hw *hw,
++				    struct clk_rate_request *req)
++{
++	struct clk_hw *parent, *best_parent = NULL;
++	unsigned long best_rate = 0;
++	unsigned long best_prate = 0;
++	unsigned long best_rate_diff = ULONG_MAX;
++	unsigned long prate, calc_rate;
++	size_t i;
++
++	/*
++	 * If the NO_REPARENT flag is set, try to use existing parent.
++	 */
++	if ((clk_hw_get_flags(hw) & CLK_SET_RATE_NO_REPARENT)) {
++		i = rp1_clock_get_parent(hw);
++		parent = clk_hw_get_parent_by_index(hw, i);
++		if (parent) {
++			rp1_clock_choose_div_and_prate(hw, i, req->rate, &prate,
++						       &calc_rate);
++			if (calc_rate > 0) {
++				req->best_parent_hw = parent;
++				req->best_parent_rate = prate;
++				req->rate = calc_rate;
++				return 0;
++			}
++		}
++	}
++
++	/*
++	 * Select parent clock that results in the closest rate (lower or
++	 * higher)
++	 */
++	for (i = 0; i < clk_hw_get_num_parents(hw); i++) {
++		parent = clk_hw_get_parent_by_index(hw, i);
++		if (!parent)
++			continue;
++
++		rp1_clock_choose_div_and_prate(hw, i, req->rate, &prate,
++					       &calc_rate);
++
++		if (ABS_DIFF(calc_rate, req->rate) < best_rate_diff) {
++			best_parent = parent;
++			best_prate = prate;
++			best_rate = calc_rate;
++			best_rate_diff = ABS_DIFF(calc_rate, req->rate);
++
++			if (best_rate_diff == 0)
++				break;
++		}
++	}
++
++	if (best_rate == 0)
++		return -EINVAL;
++
++	req->best_parent_hw = best_parent;
++	req->best_parent_rate = best_prate;
++	req->rate = best_rate;
++
++	return 0;
++}
++
++static void rp1_clk_debug_init(struct clk_hw *hw, struct dentry *dentry)
++{
++	struct rp1_clock *clock = container_of(hw, struct rp1_clock, hw);
++	struct rp1_clockman *clockman = clock->clockman;
++	const struct rp1_clock_data *data = clock->data;
++	struct debugfs_reg32 *regs;
++	int i;
++
++	regs = devm_kcalloc(clockman->dev, 4, sizeof(*regs), GFP_KERNEL);
++	if (!regs)
++		return;
++
++	i = 0;
++	regs[i].name = "ctrl";
++	regs[i++].offset = data->ctrl_reg;
++	regs[i].name = "div_int";
++	regs[i++].offset = data->div_int_reg;
++	regs[i].name = "div_frac";
++	regs[i++].offset = data->div_frac_reg;
++	regs[i].name = "sel";
++	regs[i++].offset = data->sel_reg;
++
++	rp1_debugfs_regset(clockman, 0, regs, i, dentry);
++}
++
++static int rp1_varsrc_set_rate(struct clk_hw *hw,
++			       unsigned long rate, unsigned long parent_rate)
++{
++	struct rp1_varsrc *varsrc = container_of(hw, struct rp1_varsrc, hw);
++
++	/*
++	 * "varsrc" exists purely to let clock dividers know the frequency
++	 * of an externally-managed clock source (such as MIPI DSI byte-clock)
++	 * which may change at run-time as a side-effect of some other driver.
++	 */
++	varsrc->rate = rate;
++	return 0;
++}
++
++static unsigned long rp1_varsrc_recalc_rate(struct clk_hw *hw,
++					    unsigned long parent_rate)
++{
++	struct rp1_varsrc *varsrc = container_of(hw, struct rp1_varsrc, hw);
++
++	return varsrc->rate;
++}
++
++static long rp1_varsrc_round_rate(struct clk_hw *hw, unsigned long rate,
++				  unsigned long *parent_rate)
++{
++	return rate;
++}
++
++static const struct clk_ops rp1_pll_core_ops = {
++	.is_prepared = rp1_pll_core_is_on,
++	.prepare = rp1_pll_core_on,
++	.unprepare = rp1_pll_core_off,
++	.set_rate = rp1_pll_core_set_rate,
++	.recalc_rate = rp1_pll_core_recalc_rate,
++	.round_rate = rp1_pll_core_round_rate,
++	.debug_init = rp1_pll_core_debug_init,
++};
++
++static const struct clk_ops rp1_pll_ops = {
++	.set_rate = rp1_pll_set_rate,
++	.recalc_rate = rp1_pll_recalc_rate,
++	.round_rate = rp1_pll_round_rate,
++	.debug_init = rp1_pll_debug_init,
++};
++
++static const struct clk_ops rp1_pll_ph_ops = {
++	.is_prepared = rp1_pll_ph_is_on,
++	.prepare = rp1_pll_ph_on,
++	.unprepare = rp1_pll_ph_off,
++	.set_rate = rp1_pll_ph_set_rate,
++	.recalc_rate = rp1_pll_ph_recalc_rate,
++	.round_rate = rp1_pll_ph_round_rate,
++	.debug_init = rp1_pll_ph_debug_init,
++};
++
++static const struct clk_ops rp1_pll_divider_ops = {
++	.is_prepared = rp1_pll_divider_is_on,
++	.prepare = rp1_pll_divider_on,
++	.unprepare = rp1_pll_divider_off,
++	.set_rate = rp1_pll_divider_set_rate,
++	.recalc_rate = rp1_pll_divider_recalc_rate,
++	.round_rate = rp1_pll_divider_round_rate,
++	.debug_init = rp1_pll_divider_debug_init,
++};
++
++static const struct clk_ops rp1_clk_ops = {
++	.is_prepared = rp1_clock_is_on,
++	.prepare = rp1_clock_on,
++	.unprepare = rp1_clock_off,
++	.recalc_rate = rp1_clock_recalc_rate,
++	.get_parent = rp1_clock_get_parent,
++	.set_parent = rp1_clock_set_parent,
++	.set_rate_and_parent = rp1_clock_set_rate_and_parent,
++	.set_rate = rp1_clock_set_rate,
++	.determine_rate = rp1_clock_determine_rate,
++	.debug_init = rp1_clk_debug_init,
++};
++
++static const struct clk_ops rp1_varsrc_ops = {
++	.set_rate = rp1_varsrc_set_rate,
++	.recalc_rate = rp1_varsrc_recalc_rate,
++	.round_rate = rp1_varsrc_round_rate,
++};
++
++static bool rp1_clk_is_claimed(const char *name);
++
++static struct clk_hw *rp1_register_pll_core(struct rp1_clockman *clockman,
++					    const void *data)
++{
++	const struct rp1_pll_core_data *pll_core_data = data;
++	struct rp1_pll_core *pll_core;
++	struct clk_init_data init;
++	int ret;
++
++	memset(&init, 0, sizeof(init));
++
++	/* All of the PLL cores derive from the external oscillator. */
++	init.parent_names = &ref_clock;
++	init.num_parents = 1;
++	init.name = pll_core_data->name;
++	init.ops = &rp1_pll_core_ops;
++	init.flags = pll_core_data->flags | CLK_IGNORE_UNUSED | CLK_IS_CRITICAL;
++
++	pll_core = kzalloc(sizeof(*pll_core), GFP_KERNEL);
++	if (!pll_core)
++		return NULL;
++
++	pll_core->clockman = clockman;
++	pll_core->data = pll_core_data;
++	pll_core->hw.init = &init;
++
++	ret = devm_clk_hw_register(clockman->dev, &pll_core->hw);
++	if (ret) {
++		kfree(pll_core);
++		return NULL;
++	}
++
++	return &pll_core->hw;
++}
++
++static struct clk_hw *rp1_register_pll(struct rp1_clockman *clockman,
++				       const void *data)
++{
++	const struct rp1_pll_data *pll_data = data;
++	struct rp1_pll *pll;
++	struct clk_init_data init;
++	int ret;
++
++	memset(&init, 0, sizeof(init));
++
++	init.parent_names = &pll_data->source_pll;
++	init.num_parents = 1;
++	init.name = pll_data->name;
++	init.ops = &rp1_pll_ops;
++	init.flags = pll_data->flags | CLK_IGNORE_UNUSED | CLK_IS_CRITICAL;
++
++	pll = kzalloc(sizeof(*pll), GFP_KERNEL);
++	if (!pll)
++		return NULL;
++
++	pll->clockman = clockman;
++	pll->data = pll_data;
++	pll->hw.init = &init;
++
++	ret = devm_clk_hw_register(clockman->dev, &pll->hw);
++	if (ret) {
++		kfree(pll);
++		return NULL;
++	}
++
++	return &pll->hw;
++}
++
++static struct clk_hw *rp1_register_pll_ph(struct rp1_clockman *clockman,
++					  const void *data)
++{
++	const struct rp1_pll_ph_data *ph_data = data;
++	struct rp1_pll_ph *ph;
++	struct clk_init_data init;
++	int ret;
++
++	memset(&init, 0, sizeof(init));
++
++	/* All of the PLLs derive from the external oscillator. */
++	init.parent_names = &ph_data->source_pll;
++	init.num_parents = 1;
++	init.name = ph_data->name;
++	init.ops = &rp1_pll_ph_ops;
++	init.flags = ph_data->flags | CLK_IGNORE_UNUSED;
++
++	ph = kzalloc(sizeof(*ph), GFP_KERNEL);
++	if (!ph)
++		return NULL;
++
++	ph->clockman = clockman;
++	ph->data = ph_data;
++	ph->hw.init = &init;
++
++	ret = devm_clk_hw_register(clockman->dev, &ph->hw);
++	if (ret) {
++		kfree(ph);
++		return NULL;
++	}
++
++	return &ph->hw;
++}
++
++static struct clk_hw *rp1_register_pll_divider(struct rp1_clockman *clockman,
++					       const void *data)
++{
++	const struct rp1_pll_data *divider_data = data;
++	struct rp1_pll *divider;
++	struct clk_init_data init;
++	int ret;
++
++	memset(&init, 0, sizeof(init));
++
++	init.parent_names = &divider_data->source_pll;
++	init.num_parents = 1;
++	init.name = divider_data->name;
++	init.ops = &rp1_pll_divider_ops;
++	init.flags = divider_data->flags | CLK_IGNORE_UNUSED;
++
++	divider = devm_kzalloc(clockman->dev, sizeof(*divider), GFP_KERNEL);
++	if (!divider)
++		return NULL;
++
++	divider->div.reg = clockman->regs + divider_data->ctrl_reg;
++	divider->div.shift = PLL_SEC_DIV_SHIFT;
++	divider->div.width = PLL_SEC_DIV_WIDTH;
++	divider->div.flags = CLK_DIVIDER_ROUND_CLOSEST;
++	divider->div.lock = &clockman->regs_lock;
++	divider->div.hw.init = &init;
++	divider->div.table = pll_sec_div_table;
++
++	if (!rp1_clk_is_claimed(divider_data->source_pll))
++		init.flags |= CLK_IS_CRITICAL;
++	if (!rp1_clk_is_claimed(divider_data->name))
++		divider->div.flags |= CLK_IS_CRITICAL;
++
++	divider->clockman = clockman;
++	divider->data = divider_data;
++
++	ret = devm_clk_hw_register(clockman->dev, &divider->div.hw);
++	if (ret)
++		return ERR_PTR(ret);
++
++	return &divider->div.hw;
++}
++
++static struct clk_hw *rp1_register_clock(struct rp1_clockman *clockman,
++					 const void *data)
++{
++	const struct rp1_clock_data *clock_data = data;
++	struct rp1_clock *clock;
++	struct clk_init_data init;
++	int ret;
++
++	BUG_ON(MAX_CLK_PARENTS <
++	       clock_data->num_std_parents + clock_data->num_aux_parents);
++	/* There must be a gap for the AUX selector */
++	BUG_ON((clock_data->num_std_parents > AUX_SEL) &&
++	       strcmp("-", clock_data->parents[AUX_SEL]));
++
++	memset(&init, 0, sizeof(init));
++	init.parent_names = clock_data->parents;
++	init.num_parents =
++		clock_data->num_std_parents + clock_data->num_aux_parents;
++	init.name = clock_data->name;
++	init.flags = clock_data->flags | CLK_IGNORE_UNUSED;
++	init.ops = &rp1_clk_ops;
++
++	clock = devm_kzalloc(clockman->dev, sizeof(*clock), GFP_KERNEL);
++	if (!clock)
++		return NULL;
++
++	clock->clockman = clockman;
++	clock->data = clock_data;
++	clock->hw.init = &init;
++
++	ret = devm_clk_hw_register(clockman->dev, &clock->hw);
++	if (ret)
++		return ERR_PTR(ret);
++
++	return &clock->hw;
++}
++
++static struct clk_hw *rp1_register_varsrc(struct rp1_clockman *clockman,
++					  const void *data)
++{
++	const char *name = *(char const * const *)data;
++	struct rp1_varsrc *clock;
++	struct clk_init_data init;
++	int ret;
++
++	memset(&init, 0, sizeof(init));
++	init.parent_names = &ref_clock;
++	init.num_parents = 1;
++	init.name = name;
++	init.flags = CLK_IGNORE_UNUSED;
++	init.ops = &rp1_varsrc_ops;
++
++	clock = devm_kzalloc(clockman->dev, sizeof(*clock), GFP_KERNEL);
++	if (!clock)
++		return NULL;
++
++	clock->clockman = clockman;
++	clock->hw.init = &init;
++
++	ret = devm_clk_hw_register(clockman->dev, &clock->hw);
++	if (ret)
++		return ERR_PTR(ret);
++
++	return &clock->hw;
++}
++
++struct rp1_clk_desc {
++	struct clk_hw *(*clk_register)(struct rp1_clockman *clockman,
++				       const void *data);
++	const void *data;
++};
++
++/* Assignment helper macros for different clock types. */
++#define _REGISTER(f, ...) { .clk_register = f, .data = __VA_ARGS__ }
++
++#define REGISTER_PLL_CORE(...)	_REGISTER(&rp1_register_pll_core,	\
++					  &(struct rp1_pll_core_data)	\
++					  {__VA_ARGS__})
++
++#define REGISTER_PLL(...)	_REGISTER(&rp1_register_pll,		\
++					  &(struct rp1_pll_data)		\
++					  {__VA_ARGS__})
++
++#define REGISTER_PLL_PH(...)	_REGISTER(&rp1_register_pll_ph,		\
++					  &(struct rp1_pll_ph_data)	\
++					  {__VA_ARGS__})
++
++#define REGISTER_PLL_DIV(...)	_REGISTER(&rp1_register_pll_divider,	\
++					  &(struct rp1_pll_data)	\
++					  {__VA_ARGS__})
++
++#define REGISTER_CLK(...)	_REGISTER(&rp1_register_clock,		\
++					  &(struct rp1_clock_data)	\
++					  {__VA_ARGS__})
++
++#define REGISTER_VARSRC(n)	_REGISTER(&rp1_register_varsrc,	&(const char *){n})
++
++static const struct rp1_clk_desc clk_desc_array[] = {
++	[RP1_PLL_SYS_CORE] = REGISTER_PLL_CORE(
++				.name = "pll_sys_core",
++				.cs_reg = PLL_SYS_CS,
++				.pwr_reg = PLL_SYS_PWR,
++				.fbdiv_int_reg = PLL_SYS_FBDIV_INT,
++				.fbdiv_frac_reg = PLL_SYS_FBDIV_FRAC,
++				),
++
++	[RP1_PLL_AUDIO_CORE] = REGISTER_PLL_CORE(
++				.name = "pll_audio_core",
++				.cs_reg = PLL_AUDIO_CS,
++				.pwr_reg = PLL_AUDIO_PWR,
++				.fbdiv_int_reg = PLL_AUDIO_FBDIV_INT,
++				.fbdiv_frac_reg = PLL_AUDIO_FBDIV_FRAC,
++				),
++
++	[RP1_PLL_VIDEO_CORE] = REGISTER_PLL_CORE(
++				.name = "pll_video_core",
++				.cs_reg = PLL_VIDEO_CS,
++				.pwr_reg = PLL_VIDEO_PWR,
++				.fbdiv_int_reg = PLL_VIDEO_FBDIV_INT,
++				.fbdiv_frac_reg = PLL_VIDEO_FBDIV_FRAC,
++				),
++
++	[RP1_PLL_SYS] = REGISTER_PLL(
++				.name = "pll_sys",
++				.source_pll = "pll_sys_core",
++				.ctrl_reg = PLL_SYS_PRIM,
++				.fc0_src = FC_NUM(0, 2),
++				),
++
++	[RP1_PLL_AUDIO] = REGISTER_PLL(
++				.name = "pll_audio",
++				.source_pll = "pll_audio_core",
++				.ctrl_reg = PLL_AUDIO_PRIM,
++				.fc0_src = FC_NUM(4, 2),
++				.flags = CLK_SET_RATE_PARENT,
++				),
++
++	[RP1_PLL_VIDEO] = REGISTER_PLL(
++				.name = "pll_video",
++				.source_pll = "pll_video_core",
++				.ctrl_reg = PLL_VIDEO_PRIM,
++				.fc0_src = FC_NUM(3, 2),
++				),
++
++	[RP1_PLL_SYS_PRI_PH] = REGISTER_PLL_PH(
++				.name = "pll_sys_pri_ph",
++				.source_pll = "pll_sys",
++				.ph_reg = PLL_SYS_PRIM,
++				.fixed_divider = 2,
++				.phase = RP1_PLL_PHASE_0,
++				.fc0_src = FC_NUM(1, 2),
++				),
++
++	[RP1_PLL_AUDIO_PRI_PH] = REGISTER_PLL_PH(
++				.name = "pll_audio_pri_ph",
++				.source_pll = "pll_audio",
++				.ph_reg = PLL_AUDIO_PRIM,
++				.fixed_divider = 2,
++				.phase = RP1_PLL_PHASE_0,
++				.fc0_src = FC_NUM(5, 1),
++				),
++
++	[RP1_PLL_VIDEO_PRI_PH] = REGISTER_PLL_PH(
++				.name = "pll_video_pri_ph",
++				.source_pll = "pll_video",
++				.ph_reg = PLL_VIDEO_PRIM,
++				.fixed_divider = 2,
++				.phase = RP1_PLL_PHASE_0,
++				.fc0_src = FC_NUM(4, 3),
++				),
++
++	[RP1_PLL_SYS_SEC] = REGISTER_PLL_DIV(
++				.name = "pll_sys_sec",
++				.source_pll = "pll_sys_core",
++				.ctrl_reg = PLL_SYS_SEC,
++				.fc0_src = FC_NUM(2, 2),
++				),
++
++	[RP1_PLL_AUDIO_SEC] = REGISTER_PLL_DIV(
++				.name = "pll_audio_sec",
++				.source_pll = "pll_audio_core",
++				.ctrl_reg = PLL_AUDIO_SEC,
++				.fc0_src = FC_NUM(6, 2),
++				),
++
++	[RP1_PLL_VIDEO_SEC] = REGISTER_PLL_DIV(
++				.name = "pll_video_sec",
++				.source_pll = "pll_video_core",
++				.ctrl_reg = PLL_VIDEO_SEC,
++				.fc0_src = FC_NUM(5, 3),
++				),
++
++	[RP1_PLL_AUDIO_TERN] = REGISTER_PLL_DIV(
++				.name = "pll_audio_tern",
++				.source_pll = "pll_audio_core",
++				.ctrl_reg = PLL_AUDIO_TERN,
++				.fc0_src = FC_NUM(6, 2),
++				),
++
++	[RP1_CLK_SYS] = REGISTER_CLK(
++				.name = "clk_sys",
++				.parents = {"xosc", "-", "pll_sys"},
++				.num_std_parents = 3,
++				.num_aux_parents = 0,
++				.ctrl_reg = CLK_SYS_CTRL,
++				.div_int_reg = CLK_SYS_DIV_INT,
++				.sel_reg = CLK_SYS_SEL,
++				.div_int_max = DIV_INT_24BIT_MAX,
++				.max_freq = 200 * MHz,
++				.fc0_src = FC_NUM(0, 4),
++				.clk_src_mask = 0x3,
++				),
++
++	[RP1_CLK_SLOW_SYS] = REGISTER_CLK(
++				.name = "clk_slow_sys",
++				.parents = {"xosc"},
++				.num_std_parents = 1,
++				.num_aux_parents = 0,
++				.ctrl_reg = CLK_SLOW_SYS_CTRL,
++				.div_int_reg = CLK_SLOW_SYS_DIV_INT,
++				.sel_reg = CLK_SLOW_SYS_SEL,
++				.div_int_max = DIV_INT_8BIT_MAX,
++				.max_freq = 50 * MHz,
++				.fc0_src = FC_NUM(1, 4),
++				.clk_src_mask = 0x1,
++				),
++
++	[RP1_CLK_UART] = REGISTER_CLK(
++				.name = "clk_uart",
++				.parents = {"pll_sys_pri_ph",
++					    "pll_video",
++					    "xosc",
++					    "clksrc_gp0",
++					    "clksrc_gp1",
++					    "clksrc_gp2",
++					    "clksrc_gp3",
++					    "clksrc_gp4",
++					    "clksrc_gp5"},
++				.num_std_parents = 0,
++				.num_aux_parents = 9,
++				.ctrl_reg = CLK_UART_CTRL,
++				.div_int_reg = CLK_UART_DIV_INT,
++				.sel_reg = CLK_UART_SEL,
++				.div_int_max = DIV_INT_8BIT_MAX,
++				.max_freq = 100 * MHz,
++				.fc0_src = FC_NUM(6, 7),
++				),
++
++	[RP1_CLK_ETH] = REGISTER_CLK(
++				.name = "clk_eth",
++				.parents = {"pll_sys_sec",
++					    "pll_sys",
++					    "pll_video_sec",
++					    "clksrc_gp0",
++					    "clksrc_gp1",
++					    "clksrc_gp2",
++					    "clksrc_gp3",
++					    "clksrc_gp4",
++					    "clksrc_gp5"},
++				.num_std_parents = 0,
++				.num_aux_parents = 9,
++				.ctrl_reg = CLK_ETH_CTRL,
++				.div_int_reg = CLK_ETH_DIV_INT,
++				.sel_reg = CLK_ETH_SEL,
++				.div_int_max = DIV_INT_8BIT_MAX,
++				.max_freq = 125 * MHz,
++				.fc0_src = FC_NUM(4, 6),
++				),
++
++	[RP1_CLK_PWM0] = REGISTER_CLK(
++				.name = "clk_pwm0",
++				.parents = {"", // "pll_audio_pri_ph",
++					    "pll_video_sec",
++					    "xosc",
++					    "clksrc_gp0",
++					    "clksrc_gp1",
++					    "clksrc_gp2",
++					    "clksrc_gp3",
++					    "clksrc_gp4",
++					    "clksrc_gp5"},
++				.num_std_parents = 0,
++				.num_aux_parents = 9,
++				.ctrl_reg = CLK_PWM0_CTRL,
++				.div_int_reg = CLK_PWM0_DIV_INT,
++				.div_frac_reg = CLK_PWM0_DIV_FRAC,
++				.sel_reg = CLK_PWM0_SEL,
++				.div_int_max = DIV_INT_16BIT_MAX,
++				.max_freq = 76800 * KHz,
++				.fc0_src = FC_NUM(0, 5),
++				),
++
++	[RP1_CLK_PWM1] = REGISTER_CLK(
++				.name = "clk_pwm1",
++				.parents = {"", // "pll_audio_pri_ph",
++					    "pll_video_sec",
++					    "xosc",
++					    "clksrc_gp0",
++					    "clksrc_gp1",
++					    "clksrc_gp2",
++					    "clksrc_gp3",
++					    "clksrc_gp4",
++					    "clksrc_gp5"},
++				.num_std_parents = 0,
++				.num_aux_parents = 9,
++				.ctrl_reg = CLK_PWM1_CTRL,
++				.div_int_reg = CLK_PWM1_DIV_INT,
++				.div_frac_reg = CLK_PWM1_DIV_FRAC,
++				.sel_reg = CLK_PWM1_SEL,
++				.div_int_max = DIV_INT_16BIT_MAX,
++				.max_freq = 76800 * KHz,
++				.fc0_src = FC_NUM(1, 5),
++				),
++
++	[RP1_CLK_AUDIO_IN] = REGISTER_CLK(
++				.name = "clk_audio_in",
++				.parents = {"", //"pll_audio",
++					    "", //"pll_audio_pri_ph",
++					    "", //"pll_audio_sec",
++					    "pll_video_sec",
++					    "xosc",
++					    "clksrc_gp0",
++					    "clksrc_gp1",
++					    "clksrc_gp2",
++					    "clksrc_gp3",
++					    "clksrc_gp4",
++					    "clksrc_gp5"},
++				.num_std_parents = 0,
++				.num_aux_parents = 11,
++				.ctrl_reg = CLK_AUDIO_IN_CTRL,
++				.div_int_reg = CLK_AUDIO_IN_DIV_INT,
++				.sel_reg = CLK_AUDIO_IN_SEL,
++				.div_int_max = DIV_INT_8BIT_MAX,
++				.max_freq = 76800 * KHz,
++				.fc0_src = FC_NUM(2, 5),
++				),
++
++	[RP1_CLK_AUDIO_OUT] = REGISTER_CLK(
++				.name = "clk_audio_out",
++				.parents = {"", //"pll_audio",
++					    "", //"pll_audio_sec",
++					    "pll_video_sec",
++					    "xosc",
++					    "clksrc_gp0",
++					    "clksrc_gp1",
++					    "clksrc_gp2",
++					    "clksrc_gp3",
++					    "clksrc_gp4",
++					    "clksrc_gp5"},
++				.num_std_parents = 0,
++				.num_aux_parents = 10,
++				.ctrl_reg = CLK_AUDIO_OUT_CTRL,
++				.div_int_reg = CLK_AUDIO_OUT_DIV_INT,
++				.sel_reg = CLK_AUDIO_OUT_SEL,
++				.div_int_max = DIV_INT_8BIT_MAX,
++				.max_freq = 153600 * KHz,
++				.fc0_src = FC_NUM(3, 5),
++				),
++
++	[RP1_CLK_I2S] = REGISTER_CLK(
++				.name = "clk_i2s",
++				.parents = {"xosc",
++					    "pll_audio",
++					    "pll_audio_sec",
++					    "clksrc_gp0",
++					    "clksrc_gp1",
++					    "clksrc_gp2",
++					    "clksrc_gp3",
++					    "clksrc_gp4",
++					    "clksrc_gp5"},
++				.num_std_parents = 0,
++				.num_aux_parents = 9,
++				.ctrl_reg = CLK_I2S_CTRL,
++				.div_int_reg = CLK_I2S_DIV_INT,
++				.sel_reg = CLK_I2S_SEL,
++				.div_int_max = DIV_INT_8BIT_MAX,
++				.max_freq = 50 * MHz,
++				.fc0_src = FC_NUM(4, 4),
++				.flags = CLK_SET_RATE_PARENT,
++				),
++
++	[RP1_CLK_MIPI0_CFG] = REGISTER_CLK(
++				.name = "clk_mipi0_cfg",
++				.parents = {"xosc"},
++				.num_std_parents = 0,
++				.num_aux_parents = 1,
++				.ctrl_reg = CLK_MIPI0_CFG_CTRL,
++				.div_int_reg = CLK_MIPI0_CFG_DIV_INT,
++				.sel_reg = CLK_MIPI0_CFG_SEL,
++				.div_int_max = DIV_INT_8BIT_MAX,
++				.max_freq = 50 * MHz,
++				.fc0_src = FC_NUM(4, 5),
++				),
++
++	[RP1_CLK_MIPI1_CFG] = REGISTER_CLK(
++				.name = "clk_mipi1_cfg",
++				.parents = {"xosc"},
++				.num_std_parents = 0,
++				.num_aux_parents = 1,
++				.ctrl_reg = CLK_MIPI1_CFG_CTRL,
++				.div_int_reg = CLK_MIPI1_CFG_DIV_INT,
++				.sel_reg = CLK_MIPI1_CFG_SEL,
++				.clk_src_mask = 1,
++				.div_int_max = DIV_INT_8BIT_MAX,
++				.max_freq = 50 * MHz,
++				.fc0_src = FC_NUM(5, 6),
++				),
++
++	[RP1_CLK_ETH_TSU] = REGISTER_CLK(
++				.name = "clk_eth_tsu",
++				.parents = {"xosc",
++					    "pll_video_sec",
++					    "clksrc_gp0",
++					    "clksrc_gp1",
++					    "clksrc_gp2",
++					    "clksrc_gp3",
++					    "clksrc_gp4",
++					    "clksrc_gp5"},
++				.num_std_parents = 0,
++				.num_aux_parents = 8,
++				.ctrl_reg = CLK_ETH_TSU_CTRL,
++				.div_int_reg = CLK_ETH_TSU_DIV_INT,
++				.sel_reg = CLK_ETH_TSU_SEL,
++				.div_int_max = DIV_INT_8BIT_MAX,
++				.max_freq = 50 * MHz,
++				.fc0_src = FC_NUM(5, 7),
++				),
++
++	[RP1_CLK_ADC] = REGISTER_CLK(
++				.name = "clk_adc",
++				.parents = {"xosc",
++					    "", //"pll_audio_tern",
++					    "clksrc_gp0",
++					    "clksrc_gp1",
++					    "clksrc_gp2",
++					    "clksrc_gp3",
++					    "clksrc_gp4",
++					    "clksrc_gp5"},
++				.num_std_parents = 0,
++				.num_aux_parents = 8,
++				.ctrl_reg = CLK_ADC_CTRL,
++				.div_int_reg = CLK_ADC_DIV_INT,
++				.sel_reg = CLK_ADC_SEL,
++				.div_int_max = DIV_INT_8BIT_MAX,
++				.max_freq = 50 * MHz,
++				.fc0_src = FC_NUM(5, 5),
++				),
++
++	[RP1_CLK_SDIO_TIMER] = REGISTER_CLK(
++				.name = "clk_sdio_timer",
++				.parents = {"xosc"},
++				.num_std_parents = 0,
++				.num_aux_parents = 1,
++				.ctrl_reg = CLK_SDIO_TIMER_CTRL,
++				.div_int_reg = CLK_SDIO_TIMER_DIV_INT,
++				.sel_reg = CLK_SDIO_TIMER_SEL,
++				.div_int_max = DIV_INT_8BIT_MAX,
++				.max_freq = 50 * MHz,
++				.fc0_src = FC_NUM(3, 4),
++				),
++
++	[RP1_CLK_SDIO_ALT_SRC] = REGISTER_CLK(
++				.name = "clk_sdio_alt_src",
++				.parents = {"pll_sys"},
++				.num_std_parents = 0,
++				.num_aux_parents = 1,
++				.ctrl_reg = CLK_SDIO_ALT_SRC_CTRL,
++				.div_int_reg = CLK_SDIO_ALT_SRC_DIV_INT,
++				.sel_reg = CLK_SDIO_ALT_SRC_SEL,
++				.div_int_max = DIV_INT_8BIT_MAX,
++				.max_freq = 200 * MHz,
++				.fc0_src = FC_NUM(5, 4),
++				),
++
++	[RP1_CLK_GP0] = REGISTER_CLK(
++				.name = "clk_gp0",
++				.parents = {"xosc",
++					    "clksrc_gp1",
++					    "clksrc_gp2",
++					    "clksrc_gp3",
++					    "clksrc_gp4",
++					    "clksrc_gp5",
++					    "pll_sys",
++					    "", //"pll_audio",
++					    "",
++					    "",
++					    "clk_i2s",
++					    "clk_adc",
++					    "",
++					    "",
++					    "",
++					    "clk_sys"},
++				.num_std_parents = 0,
++				.num_aux_parents = 16,
++				.oe_mask = BIT(0),
++				.ctrl_reg = CLK_GP0_CTRL,
++				.div_int_reg = CLK_GP0_DIV_INT,
++				.div_frac_reg = CLK_GP0_DIV_FRAC,
++				.sel_reg = CLK_GP0_SEL,
++				.div_int_max = DIV_INT_16BIT_MAX,
++				.max_freq = 100 * MHz,
++				.fc0_src = FC_NUM(0, 1),
++				),
++
++	[RP1_CLK_GP1] = REGISTER_CLK(
++				.name = "clk_gp1",
++				.parents = {"clk_sdio_timer",
++					    "clksrc_gp0",
++					    "clksrc_gp2",
++					    "clksrc_gp3",
++					    "clksrc_gp4",
++					    "clksrc_gp5",
++					    "pll_sys_pri_ph",
++					    "", //"pll_audio_pri_ph",
++					    "",
++					    "",
++					    "clk_adc",
++					    "clk_dpi",
++					    "clk_pwm0",
++					    "",
++					    "",
++					    ""},
++				.num_std_parents = 0,
++				.num_aux_parents = 16,
++				.oe_mask = BIT(1),
++				.ctrl_reg = CLK_GP1_CTRL,
++				.div_int_reg = CLK_GP1_DIV_INT,
++				.div_frac_reg = CLK_GP1_DIV_FRAC,
++				.sel_reg = CLK_GP1_SEL,
++				.div_int_max = DIV_INT_16BIT_MAX,
++				.max_freq = 100 * MHz,
++				.fc0_src = FC_NUM(1, 1),
++				),
++
++	[RP1_CLK_GP2] = REGISTER_CLK(
++				.name = "clk_gp2",
++				.parents = {"clk_sdio_alt_src",
++					    "clksrc_gp0",
++					    "clksrc_gp1",
++					    "clksrc_gp3",
++					    "clksrc_gp4",
++					    "clksrc_gp5",
++					    "pll_sys_sec",
++					    "", //"pll_audio_sec",
++					    "pll_video",
++					    "clk_audio_in",
++					    "clk_dpi",
++					    "clk_pwm0",
++					    "clk_pwm1",
++					    "clk_mipi0_dpi",
++					    "clk_mipi1_cfg",
++					    "clk_sys"},
++				.num_std_parents = 0,
++				.num_aux_parents = 16,
++				.oe_mask = BIT(2),
++				.ctrl_reg = CLK_GP2_CTRL,
++				.div_int_reg = CLK_GP2_DIV_INT,
++				.div_frac_reg = CLK_GP2_DIV_FRAC,
++				.sel_reg = CLK_GP2_SEL,
++				.div_int_max = DIV_INT_16BIT_MAX,
++				.max_freq = 100 * MHz,
++				.fc0_src = FC_NUM(2, 1),
++				),
++
++	[RP1_CLK_GP3] = REGISTER_CLK(
++				.name = "clk_gp3",
++				.parents = {"xosc",
++					    "clksrc_gp0",
++					    "clksrc_gp1",
++					    "clksrc_gp2",
++					    "clksrc_gp4",
++					    "clksrc_gp5",
++					    "",
++					    "",
++					    "pll_video_pri_ph",
++					    "clk_audio_out",
++					    "",
++					    "",
++					    "clk_mipi1_dpi",
++					    "",
++					    "",
++					    ""},
++				.num_std_parents = 0,
++				.num_aux_parents = 16,
++				.oe_mask = BIT(3),
++				.ctrl_reg = CLK_GP3_CTRL,
++				.div_int_reg = CLK_GP3_DIV_INT,
++				.div_frac_reg = CLK_GP3_DIV_FRAC,
++				.sel_reg = CLK_GP3_SEL,
++				.div_int_max = DIV_INT_16BIT_MAX,
++				.max_freq = 100 * MHz,
++				.fc0_src = FC_NUM(3, 1),
++				),
++
++	[RP1_CLK_GP4] = REGISTER_CLK(
++				.name = "clk_gp4",
++				.parents = {"xosc",
++					    "clksrc_gp0",
++					    "clksrc_gp1",
++					    "clksrc_gp2",
++					    "clksrc_gp3",
++					    "clksrc_gp5",
++					    "", //"pll_audio_tern",
++					    "pll_video_sec",
++					    "",
++					    "",
++					    "",
++					    "clk_mipi0_cfg",
++					    "clk_uart",
++					    "",
++					    "",
++					    "clk_sys",
++					    },
++				.num_std_parents = 0,
++				.num_aux_parents = 16,
++				.oe_mask = BIT(4),
++				.ctrl_reg = CLK_GP4_CTRL,
++				.div_int_reg = CLK_GP4_DIV_INT,
++				.div_frac_reg = CLK_GP4_DIV_FRAC,
++				.sel_reg = CLK_GP4_SEL,
++				.div_int_max = DIV_INT_16BIT_MAX,
++				.max_freq = 100 * MHz,
++				.fc0_src = FC_NUM(4, 1),
++				),
++
++	[RP1_CLK_GP5] = REGISTER_CLK(
++				.name = "clk_gp5",
++				.parents = {"xosc",
++					    "clksrc_gp0",
++					    "clksrc_gp1",
++					    "clksrc_gp2",
++					    "clksrc_gp3",
++					    "clksrc_gp4",
++					    "", //"pll_audio_tern",
++					    "pll_video_sec",
++					    "clk_eth_tsu",
++					    "",
++					    "clk_vec",
++					    "",
++					    "",
++					    "",
++					    "",
++					    ""},
++				.num_std_parents = 0,
++				.num_aux_parents = 16,
++				.oe_mask = BIT(5),
++				.ctrl_reg = CLK_GP5_CTRL,
++				.div_int_reg = CLK_GP5_DIV_INT,
++				.div_frac_reg = CLK_GP5_DIV_FRAC,
++				.sel_reg = CLK_GP5_SEL,
++				.div_int_max = DIV_INT_16BIT_MAX,
++				.max_freq = 100 * MHz,
++				.fc0_src = FC_NUM(5, 1),
++				),
++
++	[RP1_CLK_VEC] = REGISTER_CLK(
++				.name = "clk_vec",
++				.parents = {"pll_sys_pri_ph",
++					    "pll_video_sec",
++					    "pll_video",
++					    "clksrc_gp0",
++					    "clksrc_gp1",
++					    "clksrc_gp2",
++					    "clksrc_gp3",
++					    "clksrc_gp4"},
++				.num_std_parents = 0,
++				.num_aux_parents = 8, /* XXX in fact there are more than 8 */
++				.ctrl_reg = VIDEO_CLK_VEC_CTRL,
++				.div_int_reg = VIDEO_CLK_VEC_DIV_INT,
++				.sel_reg = VIDEO_CLK_VEC_SEL,
++				.flags = CLK_SET_RATE_NO_REPARENT, /* Let VEC driver set parent */
++				.div_int_max = DIV_INT_8BIT_MAX,
++				.max_freq = 108 * MHz,
++				.fc0_src = FC_NUM(0, 6),
++				),
++
++	[RP1_CLK_DPI] = REGISTER_CLK(
++				.name = "clk_dpi",
++				.parents = {"pll_sys",
++					    "pll_video_sec",
++					    "pll_video",
++					    "clksrc_gp0",
++					    "clksrc_gp1",
++					    "clksrc_gp2",
++					    "clksrc_gp3",
++					    "clksrc_gp4"},
++				.num_std_parents = 0,
++				.num_aux_parents = 8, /* XXX in fact there are more than 8 */
++				.ctrl_reg = VIDEO_CLK_DPI_CTRL,
++				.div_int_reg = VIDEO_CLK_DPI_DIV_INT,
++				.sel_reg = VIDEO_CLK_DPI_SEL,
++				.flags = CLK_SET_RATE_NO_REPARENT, /* Let DPI driver set parent */
++				.div_int_max = DIV_INT_8BIT_MAX,
++				.max_freq = 200 * MHz,
++				.fc0_src = FC_NUM(1, 6),
++				),
++
++	[RP1_CLK_MIPI0_DPI] = REGISTER_CLK(
++				.name = "clk_mipi0_dpi",
++				.parents = {"pll_sys",
++					    "pll_video_sec",
++					    "pll_video",
++					    "clksrc_mipi0_dsi_byteclk",
++					    "clksrc_gp0",
++					    "clksrc_gp1",
++					    "clksrc_gp2",
++					    "clksrc_gp3"},
++				.num_std_parents = 0,
++				.num_aux_parents = 8, /* XXX in fact there are more than 8 */
++				.ctrl_reg = VIDEO_CLK_MIPI0_DPI_CTRL,
++				.div_int_reg = VIDEO_CLK_MIPI0_DPI_DIV_INT,
++				.div_frac_reg = VIDEO_CLK_MIPI0_DPI_DIV_FRAC,
++				.sel_reg = VIDEO_CLK_MIPI0_DPI_SEL,
++				.flags = CLK_SET_RATE_NO_REPARENT, /* Let DSI driver set parent */
++				.div_int_max = DIV_INT_8BIT_MAX,
++				.max_freq = 200 * MHz,
++				.fc0_src = FC_NUM(2, 6),
++				),
++
++	[RP1_CLK_MIPI1_DPI] = REGISTER_CLK(
++				.name = "clk_mipi1_dpi",
++				.parents = {"pll_sys",
++					    "pll_video_sec",
++					    "pll_video",
++					    "clksrc_mipi1_dsi_byteclk",
++					    "clksrc_gp0",
++					    "clksrc_gp1",
++					    "clksrc_gp2",
++					    "clksrc_gp3"},
++				.num_std_parents = 0,
++				.num_aux_parents = 8, /* XXX in fact there are more than 8 */
++				.ctrl_reg = VIDEO_CLK_MIPI1_DPI_CTRL,
++				.div_int_reg = VIDEO_CLK_MIPI1_DPI_DIV_INT,
++				.div_frac_reg = VIDEO_CLK_MIPI1_DPI_DIV_FRAC,
++				.sel_reg = VIDEO_CLK_MIPI1_DPI_SEL,
++				.flags = CLK_SET_RATE_NO_REPARENT, /* Let DSI driver set parent */
++				.div_int_max = DIV_INT_8BIT_MAX,
++				.max_freq = 200 * MHz,
++				.fc0_src = FC_NUM(3, 6),
++				),
++
++	[RP1_CLK_MIPI0_DSI_BYTECLOCK] = REGISTER_VARSRC("clksrc_mipi0_dsi_byteclk"),
++	[RP1_CLK_MIPI1_DSI_BYTECLOCK] = REGISTER_VARSRC("clksrc_mipi1_dsi_byteclk"),
++};
++
++static bool rp1_clk_claimed[ARRAY_SIZE(clk_desc_array)];
++
++static bool rp1_clk_is_claimed(const char *name)
++{
++	unsigned int i;
++
++	for (i = 0; i < ARRAY_SIZE(clk_desc_array); i++) {
++		if (clk_desc_array[i].data) {
++			const char *clk_name = *(const char **)(clk_desc_array[i].data);
++
++			if (!strcmp(name, clk_name))
++				return rp1_clk_claimed[i];
++		}
++	}
++
++	return false;
++}
++
++static int rp1_clk_probe(struct platform_device *pdev)
++{
++	const struct rp1_clk_desc *desc;
++	struct device *dev = &pdev->dev;
++	struct rp1_clockman *clockman;
++	struct resource *res;
++	struct clk_hw **hws;
++	const size_t asize = ARRAY_SIZE(clk_desc_array);
++	u32 chip_id, platform;
++	unsigned int i;
++	u32 clk_id;
++	int ret;
++
++	clockman = devm_kzalloc(dev, struct_size(clockman, onecell.hws, asize),
++				GFP_KERNEL);
++	if (!clockman)
++		return -ENOMEM;
++
++	rp1_get_platform(&chip_id, &platform);
++
++	spin_lock_init(&clockman->regs_lock);
++	clockman->dev = dev;
++	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	clockman->regs = devm_ioremap_resource(&pdev->dev, res);
++	if (IS_ERR(clockman->regs))
++		return PTR_ERR(clockman->regs);
++
++	memset(rp1_clk_claimed, 0, sizeof(rp1_clk_claimed));
++	for (i = 0;
++	     !of_property_read_u32_index(pdev->dev.of_node, "claim-clocks",
++					 i, &clk_id);
++	     i++)
++		rp1_clk_claimed[clk_id] = true;
++
++	platform_set_drvdata(pdev, clockman);
++
++	clockman->onecell.num = asize;
++	hws = clockman->onecell.hws;
++
++	for (i = 0; i < asize; i++) {
++		desc = &clk_desc_array[i];
++		if (desc->clk_register && desc->data) {
++			hws[i] = desc->clk_register(clockman, desc->data);
++			if (IS_ERR_OR_NULL(hws[i])) {
++				pr_err("Failed to register RP1 clock '%s' (%ld) - wrong dtbs?\n", *(char **)desc->data, PTR_ERR(hws[i]));
++				hws[i] = NULL;
++				continue;
++			}
++			if (!strcmp(clk_hw_get_name(hws[i]), "clk_i2s")) {
++				clk_i2s = hws[i];
++				clk_xosc = clk_hw_get_parent_by_index(clk_i2s, 0);
++				clk_audio = clk_hw_get_parent_by_index(clk_i2s, 1);
++			}
++		}
++	}
++
++	ret = of_clk_add_hw_provider(dev->of_node, of_clk_hw_onecell_get,
++				     &clockman->onecell);
++	if (ret)
++		return ret;
++
++	return 0;
++}
++
++static const struct of_device_id rp1_clk_of_match[] = {
++	{ .compatible = "raspberrypi,rp1-clocks" },
++	{}
++};
++MODULE_DEVICE_TABLE(of, rp1_clk_of_match);
++
++static struct platform_driver rp1_clk_driver = {
++	.driver = {
++		.name = "rp1-clk",
++		.of_match_table = rp1_clk_of_match,
++	},
++	.probe = rp1_clk_probe,
++};
++
++static int __init __rp1_clk_driver_init(void)
++{
++	return platform_driver_register(&rp1_clk_driver);
++}
++postcore_initcall(__rp1_clk_driver_init);
++
++MODULE_AUTHOR("Naushir Patuck <naush@raspberrypi.com>");
++MODULE_DESCRIPTION("RP1 clock driver");
++MODULE_LICENSE("GPL");
+--- a/include/dt-bindings/clock/rp1.h
++++ b/include/dt-bindings/clock/rp1.h
+@@ -13,39 +13,40 @@
+ 
+ #define RP1_PLL_SYS_PRI_PH		6
+ #define RP1_PLL_SYS_SEC_PH		7
++#define RP1_PLL_AUDIO_PRI_PH		8
+ 
+-#define RP1_PLL_SYS_SEC			8
+-#define RP1_PLL_AUDIO_SEC		9
+-#define RP1_PLL_VIDEO_SEC		10
++#define RP1_PLL_SYS_SEC			9
++#define RP1_PLL_AUDIO_SEC		10
++#define RP1_PLL_VIDEO_SEC		11
+ 
+-#define RP1_CLK_SYS			11
+-#define RP1_CLK_SLOW_SYS		12
+-#define RP1_CLK_DMA			13
+-#define RP1_CLK_UART			14
+-#define RP1_CLK_ETH			15
+-#define RP1_CLK_PWM0			16
+-#define RP1_CLK_PWM1			17
+-#define RP1_CLK_AUDIO_IN		18
+-#define RP1_CLK_AUDIO_OUT		19
+-#define RP1_CLK_I2S			20
+-#define RP1_CLK_MIPI0_CFG		21
+-#define RP1_CLK_MIPI1_CFG		22
+-#define RP1_CLK_PCIE_AUX		23
+-#define RP1_CLK_USBH0_MICROFRAME	24
+-#define RP1_CLK_USBH1_MICROFRAME	25
+-#define RP1_CLK_USBH0_SUSPEND		26
+-#define RP1_CLK_USBH1_SUSPEND		27
+-#define RP1_CLK_ETH_TSU			28
+-#define RP1_CLK_ADC			29
+-#define RP1_CLK_SDIO_TIMER		30
+-#define RP1_CLK_SDIO_ALT_SRC		31
+-#define RP1_CLK_GP0			32
+-#define RP1_CLK_GP1			33
+-#define RP1_CLK_GP2			34
+-#define RP1_CLK_GP3			35
+-#define RP1_CLK_GP4			36
+-#define RP1_CLK_GP5			37
+-#define RP1_CLK_VEC			38
+-#define RP1_CLK_DPI			39
+-#define RP1_CLK_MIPI0_DPI		40
+-#define RP1_CLK_MIPI1_DPI		41
++#define RP1_CLK_SYS			12
++#define RP1_CLK_SLOW_SYS		13
++#define RP1_CLK_DMA			14
++#define RP1_CLK_UART			15
++#define RP1_CLK_ETH			16
++#define RP1_CLK_PWM0			17
++#define RP1_CLK_PWM1			18
++#define RP1_CLK_AUDIO_IN		19
++#define RP1_CLK_AUDIO_OUT		20
++#define RP1_CLK_I2S			21
++#define RP1_CLK_MIPI0_CFG		22
++#define RP1_CLK_MIPI1_CFG		23
++#define RP1_CLK_PCIE_AUX		24
++#define RP1_CLK_USBH0_MICROFRAME	25
++#define RP1_CLK_USBH1_MICROFRAME	26
++#define RP1_CLK_USBH0_SUSPEND		27
++#define RP1_CLK_USBH1_SUSPEND		28
++#define RP1_CLK_ETH_TSU			29
++#define RP1_CLK_ADC			30
++#define RP1_CLK_SDIO_TIMER		31
++#define RP1_CLK_SDIO_ALT_SRC		32
++#define RP1_CLK_GP0			33
++#define RP1_CLK_GP1			34
++#define RP1_CLK_GP2			35
++#define RP1_CLK_GP3			36
++#define RP1_CLK_GP4			37
++#define RP1_CLK_GP5			38
++#define RP1_CLK_VEC			39
++#define RP1_CLK_DPI			40
++#define RP1_CLK_MIPI0_DPI		41
++#define RP1_CLK_MIPI1_DPI		42
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0357-dt-bindings-pinctrl-Add-bindings-for-Raspberry-Pi-RP.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0357-dt-bindings-pinctrl-Add-bindings-for-Raspberry-Pi-RP.patch
new file mode 100644
index 00000000..6903e7f4
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0357-dt-bindings-pinctrl-Add-bindings-for-Raspberry-Pi-RP.patch
@@ -0,0 +1,61 @@
+From 6e2725fd216e43c3d23ef90c70afd40fed991d0e Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 28 Oct 2022 14:13:30 +0100
+Subject: [PATCH 357/697] dt-bindings: pinctrl: Add bindings for Raspberry Pi
+ RP1
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ include/dt-bindings/pinctrl/rp1.h | 46 +++++++++++++++++++++++++++++++
+ 1 file changed, 46 insertions(+)
+ create mode 100644 include/dt-bindings/pinctrl/rp1.h
+
+--- /dev/null
++++ b/include/dt-bindings/pinctrl/rp1.h
+@@ -0,0 +1,46 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * Header providing constants for RP1 pinctrl bindings.
++ *
++ * Copyright (C) 2019-2022 Raspberry Pi Ltd.
++ */
++
++#ifndef __DT_BINDINGS_PINCTRL_RP1_H__
++#define __DT_BINDINGS_PINCTRL_RP1_H__
++
++/* brcm,function property */
++#define RP1_FSEL_GPIO_IN	0
++#define RP1_FSEL_GPIO_OUT	1
++#define RP1_FSEL_ALT0_LEGACY	4
++#define RP1_FSEL_ALT1_LEGACY	5
++#define RP1_FSEL_ALT2_LEGACY	6
++#define RP1_FSEL_ALT3_LEGACY	7
++#define RP1_FSEL_ALT4_LEGACY	3
++#define RP1_FSEL_ALT5_LEGACY	2
++#define RP1_FSEL_ALT0		0x08
++#define RP1_FSEL_ALT0INV	0x09
++#define RP1_FSEL_ALT1		0x0a
++#define RP1_FSEL_ALT1INV	0x0b
++#define RP1_FSEL_ALT2		0x0c
++#define RP1_FSEL_ALT2INV	0x0d
++#define RP1_FSEL_ALT3		0x0e
++#define RP1_FSEL_ALT3INV	0x0f
++#define RP1_FSEL_ALT4		0x10
++#define RP1_FSEL_ALT4INV	0x11
++#define RP1_FSEL_ALT5		0x12
++#define RP1_FSEL_ALT5INV	0x13
++#define RP1_FSEL_ALT6		0x14
++#define RP1_FSEL_ALT6INV	0x15
++#define RP1_FSEL_ALT7		0x16
++#define RP1_FSEL_ALT7INV	0x17
++#define RP1_FSEL_ALT8		0x18
++#define RP1_FSEL_ALT8INV	0x19
++#define RP1_FSEL_NONE		0x1a
++
++/* brcm,pull property */
++#define RP1_PUD_OFF		0
++#define RP1_PUD_DOWN		1
++#define RP1_PUD_UP		2
++#define RP1_PUD_KEEP		3
++
++#endif /* __DT_BINDINGS_PINCTRL_RP1_H__ */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0358-pinctrl-Add-rp1-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0358-pinctrl-Add-rp1-driver.patch
new file mode 100644
index 00000000..fbe74ec2
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0358-pinctrl-Add-rp1-driver.patch
@@ -0,0 +1,1742 @@
+From 2653a5d76e238f73299885ebfa05258692614579 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 10 Oct 2022 14:21:11 +0100
+Subject: [PATCH 358/697] pinctrl: Add rp1 driver
+
+RP1 exposes GPIOs. Add a pinctrl driver to allow control of those.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+pinctrl: rp1: Use the correct per-bank GPIO base
+
+The GPIO start for each bank - min_gpio - must be used in the IRQ
+handler.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+pinctrl: rp1: Allow legacy brcm,pins on all banks
+
+Support the use of the brcm,pins property for GPIOs in banks 1 and 2,
+but only for inputs and outputs - no other legacy mapping.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+pinctrl: rp1: Support interrupt CPU affinity
+
+See: https://github.com/raspberrypi/linux/issues/6077
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+pinctrl: rp1: Clear events when setting IRQ type
+
+When setting the interrupt type, it is unlikely that any latched events
+are of interest, so clear them.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+pinctrl: rp1: Add strict_gpiod module parameter
+
+Setting strict_gpiod to Y makes libgpiod and the gpiod utilities behave
+as documented, i.e. pins are returned to being GPIO inputs when they are
+released.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+pinctrl: rp1: Use persist_gpio_outputs
+
+Following 8ff05989b44e1a8f7d2bbe67320990ebc2fbb5e5, adopt the same
+parameter name but with the opposite default.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/pinctrl/Kconfig           |    7 +
+ drivers/pinctrl/Makefile          |    1 +
+ drivers/pinctrl/pinctrl-rp1.c     | 1605 +++++++++++++++++++++++++++++
+ include/dt-bindings/pinctrl/rp1.h |   46 -
+ 4 files changed, 1613 insertions(+), 46 deletions(-)
+ create mode 100644 drivers/pinctrl/pinctrl-rp1.c
+ delete mode 100644 include/dt-bindings/pinctrl/rp1.h
+
+--- a/drivers/pinctrl/Kconfig
++++ b/drivers/pinctrl/Kconfig
+@@ -587,6 +587,13 @@ config PINCTRL_MLXBF3
+ 	  each pin. This driver can also be built as a module called
+ 	  pinctrl-mlxbf3.
+ 
++config PINCTRL_RP1
++	bool "Pinctrl driver for RP1"
++	select PINMUX
++	select PINCONF
++	select GENERIC_PINCONF
++	select GPIOLIB_IRQCHIP
++
+ source "drivers/pinctrl/actions/Kconfig"
+ source "drivers/pinctrl/aspeed/Kconfig"
+ source "drivers/pinctrl/bcm/Kconfig"
+--- a/drivers/pinctrl/Makefile
++++ b/drivers/pinctrl/Makefile
+@@ -47,6 +47,7 @@ obj-$(CONFIG_PINCTRL_PIC32)	+= pinctrl-p
+ obj-$(CONFIG_PINCTRL_PISTACHIO)	+= pinctrl-pistachio.o
+ obj-$(CONFIG_PINCTRL_RK805)	+= pinctrl-rk805.o
+ obj-$(CONFIG_PINCTRL_ROCKCHIP)	+= pinctrl-rockchip.o
++obj-$(CONFIG_PINCTRL_RP1)	+= pinctrl-rp1.o
+ obj-$(CONFIG_PINCTRL_SCMI)	+= pinctrl-scmi.o
+ obj-$(CONFIG_PINCTRL_SINGLE)	+= pinctrl-single.o
+ obj-$(CONFIG_PINCTRL_ST) 	+= pinctrl-st.o
+--- /dev/null
++++ b/drivers/pinctrl/pinctrl-rp1.c
+@@ -0,0 +1,1605 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Driver for Raspberry Pi RP1 GPIO unit (pinctrl + GPIO)
++ *
++ * Copyright (C) 2023 Raspberry Pi Ltd.
++ *
++ * This driver is inspired by:
++ * pinctrl-bcm2835.c, please see original file for copyright information
++ */
++
++#include <linux/bitmap.h>
++#include <linux/bitops.h>
++#include <linux/bug.h>
++#include <linux/delay.h>
++#include <linux/device.h>
++#include <linux/err.h>
++#include <linux/gpio/driver.h>
++#include <linux/io.h>
++#include <linux/irq.h>
++#include <linux/irqdesc.h>
++#include <linux/init.h>
++#include <linux/of_address.h>
++#include <linux/of.h>
++#include <linux/of_irq.h>
++#include <linux/pinctrl/consumer.h>
++#include <linux/pinctrl/machine.h>
++#include <linux/pinctrl/pinconf.h>
++#include <linux/pinctrl/pinctrl.h>
++#include <linux/pinctrl/pinmux.h>
++#include <linux/pinctrl/pinconf-generic.h>
++#include <linux/platform_device.h>
++#include <linux/seq_file.h>
++#include <linux/spinlock.h>
++#include <linux/types.h>
++#include "core.h"
++#include "pinconf.h"
++#include "pinctrl-utils.h"
++
++#define MODULE_NAME "pinctrl-rp1"
++#define RP1_NUM_GPIOS	54
++#define RP1_NUM_BANKS	3
++
++#define RP1_RW_OFFSET			0x0000
++#define RP1_XOR_OFFSET			0x1000
++#define RP1_SET_OFFSET			0x2000
++#define RP1_CLR_OFFSET			0x3000
++
++#define RP1_GPIO_STATUS			0x0000
++#define RP1_GPIO_CTRL			0x0004
++
++#define RP1_GPIO_PCIE_INTE		0x011c
++#define RP1_GPIO_PCIE_INTS		0x0124
++
++#define RP1_GPIO_EVENTS_SHIFT_RAW	20
++#define RP1_GPIO_STATUS_FALLING		BIT(20)
++#define RP1_GPIO_STATUS_RISING		BIT(21)
++#define RP1_GPIO_STATUS_LOW		BIT(22)
++#define RP1_GPIO_STATUS_HIGH		BIT(23)
++
++#define RP1_GPIO_EVENTS_SHIFT_FILTERED	24
++#define RP1_GPIO_STATUS_F_FALLING	BIT(24)
++#define RP1_GPIO_STATUS_F_RISING	BIT(25)
++#define RP1_GPIO_STATUS_F_LOW		BIT(26)
++#define RP1_GPIO_STATUS_F_HIGH		BIT(27)
++
++#define RP1_GPIO_CTRL_FUNCSEL_LSB	0
++#define RP1_GPIO_CTRL_FUNCSEL_MASK	0x0000001f
++#define RP1_GPIO_CTRL_OUTOVER_LSB	12
++#define RP1_GPIO_CTRL_OUTOVER_MASK	0x00003000
++#define RP1_GPIO_CTRL_OEOVER_LSB	14
++#define RP1_GPIO_CTRL_OEOVER_MASK	0x0000c000
++#define RP1_GPIO_CTRL_INOVER_LSB	16
++#define RP1_GPIO_CTRL_INOVER_MASK	0x00030000
++#define RP1_GPIO_CTRL_IRQEN_FALLING	BIT(20)
++#define RP1_GPIO_CTRL_IRQEN_RISING	BIT(21)
++#define RP1_GPIO_CTRL_IRQEN_LOW		BIT(22)
++#define RP1_GPIO_CTRL_IRQEN_HIGH	BIT(23)
++#define RP1_GPIO_CTRL_IRQEN_F_FALLING	BIT(24)
++#define RP1_GPIO_CTRL_IRQEN_F_RISING	BIT(25)
++#define RP1_GPIO_CTRL_IRQEN_F_LOW	BIT(26)
++#define RP1_GPIO_CTRL_IRQEN_F_HIGH	BIT(27)
++#define RP1_GPIO_CTRL_IRQRESET		BIT(28)
++#define RP1_GPIO_CTRL_IRQOVER_LSB	30
++#define RP1_GPIO_CTRL_IRQOVER_MASK	0xc0000000
++
++#define RP1_INT_EDGE_FALLING		BIT(0)
++#define RP1_INT_EDGE_RISING		BIT(1)
++#define RP1_INT_LEVEL_LOW		BIT(2)
++#define RP1_INT_LEVEL_HIGH		BIT(3)
++#define RP1_INT_MASK			0xf
++
++#define RP1_INT_EDGE_BOTH		(RP1_INT_EDGE_FALLING |	\
++					 RP1_INT_EDGE_RISING)
++#define RP1_PUD_OFF			0
++#define RP1_PUD_DOWN			1
++#define RP1_PUD_UP			2
++
++#define RP1_FSEL_COUNT			9
++
++#define RP1_FSEL_ALT0			0x00
++#define RP1_FSEL_GPIO			0x05
++#define RP1_FSEL_NONE			0x09
++#define RP1_FSEL_NONE_HW		0x1f
++
++#define RP1_DIR_OUTPUT			0
++#define RP1_DIR_INPUT			1
++
++#define RP1_OUTOVER_PERI		0
++#define RP1_OUTOVER_INVPERI		1
++#define RP1_OUTOVER_LOW			2
++#define RP1_OUTOVER_HIGH		3
++
++#define RP1_OEOVER_PERI			0
++#define RP1_OEOVER_INVPERI		1
++#define RP1_OEOVER_DISABLE		2
++#define RP1_OEOVER_ENABLE		3
++
++#define RP1_INOVER_PERI			0
++#define RP1_INOVER_INVPERI		1
++#define RP1_INOVER_LOW			2
++#define RP1_INOVER_HIGH			3
++
++#define RP1_RIO_OUT			0x00
++#define RP1_RIO_OE			0x04
++#define RP1_RIO_IN			0x08
++
++#define RP1_PAD_SLEWFAST_MASK		0x00000001
++#define RP1_PAD_SLEWFAST_LSB		0
++#define RP1_PAD_SCHMITT_MASK		0x00000002
++#define RP1_PAD_SCHMITT_LSB		1
++#define RP1_PAD_PULL_MASK		0x0000000c
++#define RP1_PAD_PULL_LSB		2
++#define RP1_PAD_DRIVE_MASK		0x00000030
++#define RP1_PAD_DRIVE_LSB		4
++#define RP1_PAD_IN_ENABLE_MASK		0x00000040
++#define RP1_PAD_IN_ENABLE_LSB		6
++#define RP1_PAD_OUT_DISABLE_MASK	0x00000080
++#define RP1_PAD_OUT_DISABLE_LSB		7
++
++#define RP1_PAD_DRIVE_2MA		0x00000000
++#define RP1_PAD_DRIVE_4MA		0x00000010
++#define RP1_PAD_DRIVE_8MA		0x00000020
++#define RP1_PAD_DRIVE_12MA		0x00000030
++
++#define FLD_GET(r, f) (((r) & (f ## _MASK)) >> (f ## _LSB))
++#define FLD_SET(r, f, v) r = (((r) & ~(f ## _MASK)) | ((v) << (f ## _LSB)))
++
++#define FUNC(f) \
++	[func_##f] = #f
++#define RP1_MAX_FSEL 8
++#define PIN(i, f0, f1, f2, f3, f4, f5, f6, f7, f8) \
++	[i] = { \
++		.funcs = { \
++			func_##f0, \
++			func_##f1, \
++			func_##f2, \
++			func_##f3, \
++			func_##f4, \
++			func_##f5, \
++			func_##f6, \
++			func_##f7, \
++			func_##f8, \
++		}, \
++	}
++
++#define LEGACY_MAP(n, f0, f1, f2, f3, f4, f5) \
++	[n] = { \
++		func_gpio, \
++		func_gpio, \
++		func_##f5, \
++		func_##f4, \
++		func_##f0, \
++		func_##f1, \
++		func_##f2, \
++		func_##f3, \
++	}
++
++struct rp1_iobank_desc {
++	int min_gpio;
++	int num_gpios;
++	int gpio_offset;
++	int inte_offset;
++	int ints_offset;
++	int rio_offset;
++	int pads_offset;
++};
++
++struct rp1_pin_info {
++	u8 num;
++	u8 bank;
++	u8 offset;
++	u8 fsel;
++	u8 irq_type;
++
++	void __iomem *gpio;
++	void __iomem *rio;
++	void __iomem *inte;
++	void __iomem *ints;
++	void __iomem *pad;
++};
++
++enum funcs {
++	func_alt0,
++	func_alt1,
++	func_alt2,
++	func_alt3,
++	func_alt4,
++	func_gpio,
++	func_alt6,
++	func_alt7,
++	func_alt8,
++	func_none,
++	func_aaud,
++	func_dcd0,
++	func_dpi,
++	func_dsi0_te_ext,
++	func_dsi1_te_ext,
++	func_dsr0,
++	func_dtr0,
++	func_gpclk0,
++	func_gpclk1,
++	func_gpclk2,
++	func_gpclk3,
++	func_gpclk4,
++	func_gpclk5,
++	func_i2c0,
++	func_i2c1,
++	func_i2c2,
++	func_i2c3,
++	func_i2c4,
++	func_i2c5,
++	func_i2c6,
++	func_i2s0,
++	func_i2s1,
++	func_i2s2,
++	func_ir,
++	func_mic,
++	func_pcie_clkreq_n,
++	func_pio,
++	func_proc_rio,
++	func_pwm0,
++	func_pwm1,
++	func_ri0,
++	func_sd0,
++	func_sd1,
++	func_spi0,
++	func_spi1,
++	func_spi2,
++	func_spi3,
++	func_spi4,
++	func_spi5,
++	func_spi6,
++	func_spi7,
++	func_spi8,
++	func_uart0,
++	func_uart1,
++	func_uart2,
++	func_uart3,
++	func_uart4,
++	func_uart5,
++	func_vbus0,
++	func_vbus1,
++	func_vbus2,
++	func_vbus3,
++	func__,
++	func_count = func__,
++	func_invalid = func__,
++};
++
++struct rp1_pin_funcs {
++	u8 funcs[RP1_FSEL_COUNT];
++};
++
++struct rp1_pinctrl {
++	struct device *dev;
++	void __iomem *gpio_base;
++	void __iomem *rio_base;
++	void __iomem *pads_base;
++	int irq[RP1_NUM_BANKS];
++	struct rp1_pin_info pins[RP1_NUM_GPIOS];
++
++	struct pinctrl_dev *pctl_dev;
++	struct gpio_chip gpio_chip;
++	struct pinctrl_gpio_range gpio_range;
++
++	raw_spinlock_t irq_lock[RP1_NUM_BANKS];
++};
++
++const struct rp1_iobank_desc rp1_iobanks[RP1_NUM_BANKS] = {
++	/*         gpio   inte    ints     rio    pads */
++	{  0, 28, 0x0000, 0x011c, 0x0124, 0x0000, 0x0004 },
++	{ 28,  6, 0x4000, 0x411c, 0x4124, 0x4000, 0x4004 },
++	{ 34, 20, 0x8000, 0x811c, 0x8124, 0x8000, 0x8004 },
++};
++
++/* pins are just named GPIO0..GPIO53 */
++#define RP1_GPIO_PIN(a) PINCTRL_PIN(a, "gpio" #a)
++static struct pinctrl_pin_desc rp1_gpio_pins[] = {
++	RP1_GPIO_PIN(0),
++	RP1_GPIO_PIN(1),
++	RP1_GPIO_PIN(2),
++	RP1_GPIO_PIN(3),
++	RP1_GPIO_PIN(4),
++	RP1_GPIO_PIN(5),
++	RP1_GPIO_PIN(6),
++	RP1_GPIO_PIN(7),
++	RP1_GPIO_PIN(8),
++	RP1_GPIO_PIN(9),
++	RP1_GPIO_PIN(10),
++	RP1_GPIO_PIN(11),
++	RP1_GPIO_PIN(12),
++	RP1_GPIO_PIN(13),
++	RP1_GPIO_PIN(14),
++	RP1_GPIO_PIN(15),
++	RP1_GPIO_PIN(16),
++	RP1_GPIO_PIN(17),
++	RP1_GPIO_PIN(18),
++	RP1_GPIO_PIN(19),
++	RP1_GPIO_PIN(20),
++	RP1_GPIO_PIN(21),
++	RP1_GPIO_PIN(22),
++	RP1_GPIO_PIN(23),
++	RP1_GPIO_PIN(24),
++	RP1_GPIO_PIN(25),
++	RP1_GPIO_PIN(26),
++	RP1_GPIO_PIN(27),
++	RP1_GPIO_PIN(28),
++	RP1_GPIO_PIN(29),
++	RP1_GPIO_PIN(30),
++	RP1_GPIO_PIN(31),
++	RP1_GPIO_PIN(32),
++	RP1_GPIO_PIN(33),
++	RP1_GPIO_PIN(34),
++	RP1_GPIO_PIN(35),
++	RP1_GPIO_PIN(36),
++	RP1_GPIO_PIN(37),
++	RP1_GPIO_PIN(38),
++	RP1_GPIO_PIN(39),
++	RP1_GPIO_PIN(40),
++	RP1_GPIO_PIN(41),
++	RP1_GPIO_PIN(42),
++	RP1_GPIO_PIN(43),
++	RP1_GPIO_PIN(44),
++	RP1_GPIO_PIN(45),
++	RP1_GPIO_PIN(46),
++	RP1_GPIO_PIN(47),
++	RP1_GPIO_PIN(48),
++	RP1_GPIO_PIN(49),
++	RP1_GPIO_PIN(50),
++	RP1_GPIO_PIN(51),
++	RP1_GPIO_PIN(52),
++	RP1_GPIO_PIN(53),
++};
++
++/* one pin per group */
++static const char * const rp1_gpio_groups[] = {
++	"gpio0",
++	"gpio1",
++	"gpio2",
++	"gpio3",
++	"gpio4",
++	"gpio5",
++	"gpio6",
++	"gpio7",
++	"gpio8",
++	"gpio9",
++	"gpio10",
++	"gpio11",
++	"gpio12",
++	"gpio13",
++	"gpio14",
++	"gpio15",
++	"gpio16",
++	"gpio17",
++	"gpio18",
++	"gpio19",
++	"gpio20",
++	"gpio21",
++	"gpio22",
++	"gpio23",
++	"gpio24",
++	"gpio25",
++	"gpio26",
++	"gpio27",
++	"gpio28",
++	"gpio29",
++	"gpio30",
++	"gpio31",
++	"gpio32",
++	"gpio33",
++	"gpio34",
++	"gpio35",
++	"gpio36",
++	"gpio37",
++	"gpio38",
++	"gpio39",
++	"gpio40",
++	"gpio41",
++	"gpio42",
++	"gpio43",
++	"gpio44",
++	"gpio45",
++	"gpio46",
++	"gpio47",
++	"gpio48",
++	"gpio49",
++	"gpio50",
++	"gpio51",
++	"gpio52",
++	"gpio53",
++};
++
++static const char * const rp1_func_names[] = {
++	FUNC(alt0),
++	FUNC(alt1),
++	FUNC(alt2),
++	FUNC(alt3),
++	FUNC(alt4),
++	FUNC(gpio),
++	FUNC(alt6),
++	FUNC(alt7),
++	FUNC(alt8),
++	FUNC(none),
++	FUNC(aaud),
++	FUNC(dcd0),
++	FUNC(dpi),
++	FUNC(dsi0_te_ext),
++	FUNC(dsi1_te_ext),
++	FUNC(dsr0),
++	FUNC(dtr0),
++	FUNC(gpclk0),
++	FUNC(gpclk1),
++	FUNC(gpclk2),
++	FUNC(gpclk3),
++	FUNC(gpclk4),
++	FUNC(gpclk5),
++	FUNC(i2c0),
++	FUNC(i2c1),
++	FUNC(i2c2),
++	FUNC(i2c3),
++	FUNC(i2c4),
++	FUNC(i2c5),
++	FUNC(i2c6),
++	FUNC(i2s0),
++	FUNC(i2s1),
++	FUNC(i2s2),
++	FUNC(ir),
++	FUNC(mic),
++	FUNC(pcie_clkreq_n),
++	FUNC(pio),
++	FUNC(proc_rio),
++	FUNC(pwm0),
++	FUNC(pwm1),
++	FUNC(ri0),
++	FUNC(sd0),
++	FUNC(sd1),
++	FUNC(spi0),
++	FUNC(spi1),
++	FUNC(spi2),
++	FUNC(spi3),
++	FUNC(spi4),
++	FUNC(spi5),
++	FUNC(spi6),
++	FUNC(spi7),
++	FUNC(spi8),
++	FUNC(uart0),
++	FUNC(uart1),
++	FUNC(uart2),
++	FUNC(uart3),
++	FUNC(uart4),
++	FUNC(uart5),
++	FUNC(vbus0),
++	FUNC(vbus1),
++	FUNC(vbus2),
++	FUNC(vbus3),
++	[func_invalid] = "?"
++};
++
++static const struct rp1_pin_funcs rp1_gpio_pin_funcs[] = {
++	PIN(0, spi0, dpi, uart1, i2c0, _, gpio, proc_rio, pio, spi2),
++	PIN(1, spi0, dpi, uart1, i2c0, _, gpio, proc_rio, pio, spi2),
++	PIN(2, spi0, dpi, uart1, i2c1, ir, gpio, proc_rio, pio, spi2),
++	PIN(3, spi0, dpi, uart1, i2c1, ir, gpio, proc_rio, pio, spi2),
++	PIN(4, gpclk0, dpi, uart2, i2c2, ri0, gpio, proc_rio, pio, spi3),
++	PIN(5, gpclk1, dpi, uart2, i2c2, dtr0, gpio, proc_rio, pio, spi3),
++	PIN(6, gpclk2, dpi, uart2, i2c3, dcd0, gpio, proc_rio, pio, spi3),
++	PIN(7, spi0, dpi, uart2, i2c3, dsr0, gpio, proc_rio, pio, spi3),
++	PIN(8, spi0, dpi, uart3, i2c0, _, gpio, proc_rio, pio, spi4),
++	PIN(9, spi0, dpi, uart3, i2c0, _, gpio, proc_rio, pio, spi4),
++	PIN(10, spi0, dpi, uart3, i2c1, _, gpio, proc_rio, pio, spi4),
++	PIN(11, spi0, dpi, uart3, i2c1, _, gpio, proc_rio, pio, spi4),
++	PIN(12, pwm0, dpi, uart4, i2c2, aaud, gpio, proc_rio, pio, spi5),
++	PIN(13, pwm0, dpi, uart4, i2c2, aaud, gpio, proc_rio, pio, spi5),
++	PIN(14, pwm0, dpi, uart4, i2c3, uart0, gpio, proc_rio, pio, spi5),
++	PIN(15, pwm0, dpi, uart4, i2c3, uart0, gpio, proc_rio, pio, spi5),
++	PIN(16, spi1, dpi, dsi0_te_ext, _, uart0, gpio, proc_rio, pio, _),
++	PIN(17, spi1, dpi, dsi1_te_ext, _, uart0, gpio, proc_rio, pio, _),
++	PIN(18, spi1, dpi, i2s0, pwm0, i2s1, gpio, proc_rio, pio, gpclk1),
++	PIN(19, spi1, dpi, i2s0, pwm0, i2s1, gpio, proc_rio, pio, _),
++	PIN(20, spi1, dpi, i2s0, gpclk0, i2s1, gpio, proc_rio, pio, _),
++	PIN(21, spi1, dpi, i2s0, gpclk1, i2s1, gpio, proc_rio, pio, _),
++	PIN(22, sd0, dpi, i2s0, i2c3, i2s1, gpio, proc_rio, pio, _),
++	PIN(23, sd0, dpi, i2s0, i2c3, i2s1, gpio, proc_rio, pio, _),
++	PIN(24, sd0, dpi, i2s0, _, i2s1, gpio, proc_rio, pio, spi2),
++	PIN(25, sd0, dpi, i2s0, mic, i2s1, gpio, proc_rio, pio, spi3),
++	PIN(26, sd0, dpi, i2s0, mic, i2s1, gpio, proc_rio, pio, spi5),
++	PIN(27, sd0, dpi, i2s0, mic, i2s1, gpio, proc_rio, pio, spi1),
++	PIN(28, sd1, i2c4, i2s2, spi6, vbus0, gpio, proc_rio, _, _),
++	PIN(29, sd1, i2c4, i2s2, spi6, vbus0, gpio, proc_rio, _, _),
++	PIN(30, sd1, i2c5, i2s2, spi6, uart5, gpio, proc_rio, _, _),
++	PIN(31, sd1, i2c5, i2s2, spi6, uart5, gpio, proc_rio, _, _),
++	PIN(32, sd1, gpclk3, i2s2, spi6, uart5, gpio, proc_rio, _, _),
++	PIN(33, sd1, gpclk4, i2s2, spi6, uart5, gpio, proc_rio, _, _),
++	PIN(34, pwm1, gpclk3, vbus0, i2c4, mic, gpio, proc_rio, _, _),
++	PIN(35, spi8, pwm1, vbus0, i2c4, mic, gpio, proc_rio, _, _),
++	PIN(36, spi8, uart5, pcie_clkreq_n, i2c5, mic, gpio, proc_rio, _, _),
++	PIN(37, spi8, uart5, mic, i2c5, pcie_clkreq_n, gpio, proc_rio, _, _),
++	PIN(38, spi8, uart5, mic, i2c6, aaud, gpio, proc_rio, dsi0_te_ext, _),
++	PIN(39, spi8, uart5, mic, i2c6, aaud, gpio, proc_rio, dsi1_te_ext, _),
++	PIN(40, pwm1, uart5, i2c4, spi6, aaud, gpio, proc_rio, _, _),
++	PIN(41, pwm1, uart5, i2c4, spi6, aaud, gpio, proc_rio, _, _),
++	PIN(42, gpclk5, uart5, vbus1, spi6, i2s2, gpio, proc_rio, _, _),
++	PIN(43, gpclk4, uart5, vbus1, spi6, i2s2, gpio, proc_rio, _, _),
++	PIN(44, gpclk5, i2c5, pwm1, spi6, i2s2, gpio, proc_rio, _, _),
++	PIN(45, pwm1, i2c5, spi7, spi6, i2s2, gpio, proc_rio, _, _),
++	PIN(46, gpclk3, i2c4, spi7, mic, i2s2, gpio, proc_rio, dsi0_te_ext, _),
++	PIN(47, gpclk5, i2c4, spi7, mic, i2s2, gpio, proc_rio, dsi1_te_ext, _),
++	PIN(48, pwm1, pcie_clkreq_n, spi7, mic, uart5, gpio, proc_rio, _, _),
++	PIN(49, spi8, spi7, i2c5, aaud, uart5, gpio, proc_rio, _, _),
++	PIN(50, spi8, spi7, i2c5, aaud, vbus2, gpio, proc_rio, _, _),
++	PIN(51, spi8, spi7, i2c6, aaud, vbus2, gpio, proc_rio, _, _),
++	PIN(52, spi8, _, i2c6, aaud, vbus3, gpio, proc_rio, _, _),
++	PIN(53, spi8, spi7, _, pcie_clkreq_n, vbus3, gpio, proc_rio, _, _),
++};
++
++static const u8 legacy_fsel_map[][8] = {
++	LEGACY_MAP(0, i2c0, _, dpi, spi2, uart1, _),
++	LEGACY_MAP(1, i2c0, _, dpi, spi2, uart1, _),
++	LEGACY_MAP(2, i2c1, _, dpi, spi2, uart1, _),
++	LEGACY_MAP(3, i2c1, _, dpi, spi2, uart1, _),
++	LEGACY_MAP(4, gpclk0, _, dpi, spi3, uart2, i2c2),
++	LEGACY_MAP(5, gpclk1, _, dpi, spi3, uart2, i2c2),
++	LEGACY_MAP(6, gpclk2, _, dpi, spi3, uart2, i2c3),
++	LEGACY_MAP(7, spi0, _, dpi, spi3, uart2, i2c3),
++	LEGACY_MAP(8, spi0, _, dpi, _, uart3, i2c0),
++	LEGACY_MAP(9, spi0, _, dpi, _, uart3, i2c0),
++	LEGACY_MAP(10, spi0, _, dpi, _, uart3, i2c1),
++	LEGACY_MAP(11, spi0, _, dpi, _, uart3, i2c1),
++	LEGACY_MAP(12, pwm0, _, dpi, spi5, uart4, i2c2),
++	LEGACY_MAP(13, pwm0, _, dpi, spi5, uart4, i2c2),
++	LEGACY_MAP(14, uart0, _, dpi, spi5, uart4, _),
++	LEGACY_MAP(15, uart0, _, dpi, spi5, uart4, _),
++	LEGACY_MAP(16, _, _, dpi, uart0, spi1, _),
++	LEGACY_MAP(17, _, _, dpi, uart0, spi1, _),
++	LEGACY_MAP(18, i2s0, _, dpi, _, spi1, pwm0),
++	LEGACY_MAP(19, i2s0, _, dpi, _, spi1, pwm0),
++	LEGACY_MAP(20, i2s0, _, dpi, _, spi1, gpclk0),
++	LEGACY_MAP(21, i2s0, _, dpi, _, spi1, gpclk1),
++	LEGACY_MAP(22, sd0, _, dpi, _, _, i2c3),
++	LEGACY_MAP(23, sd0, _, dpi, _, _, i2c3),
++	LEGACY_MAP(24, sd0, _, dpi, _, _, spi2),
++	LEGACY_MAP(25, sd0, _, dpi, _, _, spi3),
++	LEGACY_MAP(26, sd0, _, dpi, _, _, spi5),
++	LEGACY_MAP(27, sd0, _, dpi, _, _, _),
++};
++
++static const char * const irq_type_names[] = {
++	[IRQ_TYPE_NONE] = "none",
++	[IRQ_TYPE_EDGE_RISING] = "edge-rising",
++	[IRQ_TYPE_EDGE_FALLING] = "edge-falling",
++	[IRQ_TYPE_EDGE_BOTH] = "edge-both",
++	[IRQ_TYPE_LEVEL_HIGH] = "level-high",
++	[IRQ_TYPE_LEVEL_LOW] = "level-low",
++};
++
++static bool persist_gpio_outputs = true;
++module_param(persist_gpio_outputs, bool, 0644);
++MODULE_PARM_DESC(persist_gpio_outputs, "Enable GPIO_OUT persistence when pin is freed");
++
++static int rp1_pinconf_set(struct pinctrl_dev *pctldev,
++			   unsigned int offset, unsigned long *configs,
++			   unsigned int num_configs);
++
++static struct rp1_pin_info *rp1_get_pin(struct gpio_chip *chip,
++					unsigned int offset)
++{
++	struct rp1_pinctrl *pc = gpiochip_get_data(chip);
++
++	if (pc && offset < RP1_NUM_GPIOS)
++		return &pc->pins[offset];
++	return NULL;
++}
++
++static struct rp1_pin_info *rp1_get_pin_pctl(struct pinctrl_dev *pctldev,
++					     unsigned int offset)
++{
++	struct rp1_pinctrl *pc = pinctrl_dev_get_drvdata(pctldev);
++
++	if (pc && offset < RP1_NUM_GPIOS)
++		return &pc->pins[offset];
++	return NULL;
++}
++
++static void rp1_pad_update(struct rp1_pin_info *pin, u32 clr, u32 set)
++{
++	u32 padctrl = readl(pin->pad);
++
++	padctrl &= ~clr;
++	padctrl |= set;
++
++	writel(padctrl, pin->pad);
++}
++
++static void rp1_input_enable(struct rp1_pin_info *pin, int value)
++{
++	rp1_pad_update(pin, RP1_PAD_IN_ENABLE_MASK,
++		       value ? RP1_PAD_IN_ENABLE_MASK : 0);
++}
++
++static void rp1_output_enable(struct rp1_pin_info *pin, int value)
++{
++	rp1_pad_update(pin, RP1_PAD_OUT_DISABLE_MASK,
++		       value ? 0 : RP1_PAD_OUT_DISABLE_MASK);
++}
++
++static u32 rp1_get_fsel(struct rp1_pin_info *pin)
++{
++	u32 ctrl = readl(pin->gpio + RP1_GPIO_CTRL);
++	u32 oeover = FLD_GET(ctrl, RP1_GPIO_CTRL_OEOVER);
++	u32 fsel = FLD_GET(ctrl, RP1_GPIO_CTRL_FUNCSEL);
++
++	if (oeover != RP1_OEOVER_PERI || fsel >= RP1_FSEL_COUNT)
++		fsel = RP1_FSEL_NONE;
++
++	return fsel;
++}
++
++static void rp1_set_fsel(struct rp1_pin_info *pin, u32 fsel)
++{
++	u32 ctrl = readl(pin->gpio + RP1_GPIO_CTRL);
++
++	if (fsel >= RP1_FSEL_COUNT)
++		fsel = RP1_FSEL_NONE_HW;
++
++	rp1_input_enable(pin, 1);
++	rp1_output_enable(pin, 1);
++
++	if (fsel == RP1_FSEL_NONE) {
++		FLD_SET(ctrl, RP1_GPIO_CTRL_OEOVER, RP1_OEOVER_DISABLE);
++	} else {
++		FLD_SET(ctrl, RP1_GPIO_CTRL_OUTOVER, RP1_OUTOVER_PERI);
++		FLD_SET(ctrl, RP1_GPIO_CTRL_OEOVER, RP1_OEOVER_PERI);
++	}
++	FLD_SET(ctrl, RP1_GPIO_CTRL_FUNCSEL, fsel);
++	writel(ctrl, pin->gpio + RP1_GPIO_CTRL);
++}
++
++static int rp1_get_dir(struct rp1_pin_info *pin)
++{
++	return !(readl(pin->rio + RP1_RIO_OE) & (1 << pin->offset)) ?
++		RP1_DIR_INPUT : RP1_DIR_OUTPUT;
++}
++
++static void rp1_set_dir(struct rp1_pin_info *pin, bool is_input)
++{
++	int offset = is_input ? RP1_CLR_OFFSET : RP1_SET_OFFSET;
++
++	writel(1 << pin->offset, pin->rio + RP1_RIO_OE + offset);
++}
++
++static int rp1_get_value(struct rp1_pin_info *pin)
++{
++	return !!(readl(pin->rio + RP1_RIO_IN) & (1 << pin->offset));
++}
++
++static void rp1_set_value(struct rp1_pin_info *pin, int value)
++{
++	/* Assume the pin is already an output */
++	writel(1 << pin->offset,
++	       pin->rio + RP1_RIO_OUT + (value ? RP1_SET_OFFSET : RP1_CLR_OFFSET));
++}
++
++static int rp1_gpio_get(struct gpio_chip *chip, unsigned offset)
++{
++	struct rp1_pin_info *pin = rp1_get_pin(chip, offset);
++	int ret;
++
++	if (!pin)
++		return -EINVAL;
++	ret = rp1_get_value(pin);
++	return ret;
++}
++
++static void rp1_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
++{
++	struct rp1_pin_info *pin = rp1_get_pin(chip, offset);
++
++	if (pin)
++		rp1_set_value(pin, value);
++}
++
++static int rp1_gpio_get_direction(struct gpio_chip *chip, unsigned int offset)
++{
++	struct rp1_pin_info *pin = rp1_get_pin(chip, offset);
++	u32 fsel;
++
++	if (!pin)
++		return -EINVAL;
++	fsel = rp1_get_fsel(pin);
++	if (fsel != RP1_FSEL_GPIO)
++		return -EINVAL;
++	return (rp1_get_dir(pin) == RP1_DIR_OUTPUT) ?
++		GPIO_LINE_DIRECTION_OUT :
++		GPIO_LINE_DIRECTION_IN;
++}
++
++static int rp1_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
++{
++	struct rp1_pin_info *pin = rp1_get_pin(chip, offset);
++
++	if (!pin)
++		return -EINVAL;
++	rp1_set_dir(pin, RP1_DIR_INPUT);
++	rp1_set_fsel(pin, RP1_FSEL_GPIO);
++	return 0;
++}
++
++static int rp1_gpio_direction_output(struct gpio_chip *chip, unsigned offset,
++				     int value)
++{
++	struct rp1_pin_info *pin = rp1_get_pin(chip, offset);
++
++	if (!pin)
++		return -EINVAL;
++	rp1_set_value(pin, value);
++	rp1_set_dir(pin, RP1_DIR_OUTPUT);
++	rp1_set_fsel(pin, RP1_FSEL_GPIO);
++	return 0;
++}
++
++static int rp1_gpio_set_config(struct gpio_chip *gc, unsigned offset,
++			       unsigned long config)
++{
++	struct rp1_pinctrl *pc = gpiochip_get_data(gc);
++	unsigned long configs[] = { config };
++
++	return rp1_pinconf_set(pc->pctl_dev, offset, configs,
++			      ARRAY_SIZE(configs));
++}
++
++static const struct gpio_chip rp1_gpio_chip = {
++	.label = MODULE_NAME,
++	.owner = THIS_MODULE,
++	.request = gpiochip_generic_request,
++	.free = gpiochip_generic_free,
++	.direction_input = rp1_gpio_direction_input,
++	.direction_output = rp1_gpio_direction_output,
++	.get_direction = rp1_gpio_get_direction,
++	.get = rp1_gpio_get,
++	.set = rp1_gpio_set,
++	.base = -1,
++	.set_config = rp1_gpio_set_config,
++	.ngpio = RP1_NUM_GPIOS,
++	.can_sleep = false,
++};
++
++static void rp1_gpio_irq_handler(struct irq_desc *desc)
++{
++	struct gpio_chip *chip = irq_desc_get_handler_data(desc);
++	struct rp1_pinctrl *pc = gpiochip_get_data(chip);
++	struct irq_chip *host_chip = irq_desc_get_chip(desc);
++	const struct rp1_iobank_desc *bank;
++	int irq = irq_desc_get_irq(desc);
++	unsigned long ints;
++	int b;
++
++	if (pc->irq[0] == irq)
++		bank = &rp1_iobanks[0];
++	else if (pc->irq[1] == irq)
++		bank = &rp1_iobanks[1];
++	else
++		bank = &rp1_iobanks[2];
++
++	chained_irq_enter(host_chip, desc);
++
++	ints = readl(pc->gpio_base + bank->ints_offset);
++	for_each_set_bit(b, &ints, 32) {
++		struct rp1_pin_info *pin = rp1_get_pin(chip, bank->min_gpio + b);
++
++		writel(RP1_GPIO_CTRL_IRQRESET,
++		       pin->gpio + RP1_SET_OFFSET + RP1_GPIO_CTRL);
++		generic_handle_irq(irq_linear_revmap(pc->gpio_chip.irq.domain,
++						     bank->min_gpio + b));
++	}
++
++	chained_irq_exit(host_chip, desc);
++}
++
++static void rp1_gpio_irq_config(struct rp1_pin_info *pin, bool enable)
++{
++	writel(1 << pin->offset,
++	       pin->inte + (enable ? RP1_SET_OFFSET : RP1_CLR_OFFSET));
++	if (!enable)
++		/* Clear any latched events */
++		writel(RP1_GPIO_CTRL_IRQRESET,
++		       pin->gpio + RP1_SET_OFFSET + RP1_GPIO_CTRL);
++}
++
++static void rp1_gpio_irq_enable(struct irq_data *data)
++{
++	struct gpio_chip *chip = irq_data_get_irq_chip_data(data);
++	unsigned gpio = irqd_to_hwirq(data);
++	struct rp1_pin_info *pin = rp1_get_pin(chip, gpio);
++
++	rp1_gpio_irq_config(pin, true);
++}
++
++static void rp1_gpio_irq_disable(struct irq_data *data)
++{
++	struct gpio_chip *chip = irq_data_get_irq_chip_data(data);
++	unsigned gpio = irqd_to_hwirq(data);
++	struct rp1_pin_info *pin = rp1_get_pin(chip, gpio);
++
++	rp1_gpio_irq_config(pin, false);
++}
++
++static int rp1_irq_set_type(struct rp1_pin_info *pin, unsigned int type)
++{
++	u32 irq_flags;
++
++	switch (type) {
++	case IRQ_TYPE_NONE:
++		irq_flags = 0;
++		break;
++	case IRQ_TYPE_EDGE_RISING:
++		irq_flags = RP1_INT_EDGE_RISING;
++		break;
++	case IRQ_TYPE_EDGE_FALLING:
++		irq_flags = RP1_INT_EDGE_FALLING;
++		break;
++	case IRQ_TYPE_EDGE_BOTH:
++		irq_flags = RP1_INT_EDGE_RISING | RP1_INT_EDGE_FALLING;
++		break;
++	case IRQ_TYPE_LEVEL_HIGH:
++		irq_flags = RP1_INT_LEVEL_HIGH;
++		break;
++	case IRQ_TYPE_LEVEL_LOW:
++		irq_flags = RP1_INT_LEVEL_LOW;
++		break;
++
++	default:
++		return -EINVAL;
++	}
++
++	/* Clear the event enables */
++	writel(RP1_INT_MASK << RP1_GPIO_EVENTS_SHIFT_RAW,
++	       pin->gpio + RP1_CLR_OFFSET + RP1_GPIO_CTRL);
++	/* Clear any latched events */
++	writel(RP1_GPIO_CTRL_IRQRESET,
++		pin->gpio + RP1_SET_OFFSET + RP1_GPIO_CTRL);
++	/* Enable the events that are needed */
++	writel(irq_flags << RP1_GPIO_EVENTS_SHIFT_RAW,
++	       pin->gpio + RP1_SET_OFFSET + RP1_GPIO_CTRL);
++	pin->irq_type = type;
++
++	return 0;
++}
++
++static int rp1_gpio_irq_set_type(struct irq_data *data, unsigned int type)
++{
++	struct gpio_chip *chip = irq_data_get_irq_chip_data(data);
++	struct rp1_pinctrl *pc = gpiochip_get_data(chip);
++	unsigned gpio = irqd_to_hwirq(data);
++	struct rp1_pin_info *pin = rp1_get_pin(chip, gpio);
++	int bank = pin->bank;
++	unsigned long flags;
++	int ret;
++
++	raw_spin_lock_irqsave(&pc->irq_lock[bank], flags);
++
++	ret = rp1_irq_set_type(pin, type);
++	if (!ret) {
++		if (type & IRQ_TYPE_EDGE_BOTH)
++			irq_set_handler_locked(data, handle_edge_irq);
++		else
++			irq_set_handler_locked(data, handle_level_irq);
++	}
++
++	raw_spin_unlock_irqrestore(&pc->irq_lock[bank], flags);
++
++	return ret;
++}
++
++static void rp1_gpio_irq_ack(struct irq_data *data)
++{
++	struct gpio_chip *chip = irq_data_get_irq_chip_data(data);
++	unsigned gpio = irqd_to_hwirq(data);
++	struct rp1_pin_info *pin = rp1_get_pin(chip, gpio);
++
++	/* Clear any latched events */
++	writel(RP1_GPIO_CTRL_IRQRESET, pin->gpio + RP1_SET_OFFSET + RP1_GPIO_CTRL);
++}
++
++static int rp1_gpio_irq_set_affinity(struct irq_data *data, const struct cpumask *dest, bool force)
++{
++	struct gpio_chip *chip = irq_data_get_irq_chip_data(data);
++	struct rp1_pinctrl *pc = gpiochip_get_data(chip);
++	const struct rp1_iobank_desc *bank;
++	struct irq_data *parent_data = NULL;
++	int i;
++
++	for (i = 0; i < 3; i++) {
++		bank = &rp1_iobanks[i];
++		if (data->hwirq >= bank->min_gpio &&
++		    data->hwirq < bank->min_gpio + bank->num_gpios) {
++			parent_data = irq_get_irq_data(pc->irq[i]);
++			break;
++		}
++	}
++
++	if (parent_data && parent_data->chip->irq_set_affinity)
++		return parent_data->chip->irq_set_affinity(parent_data, dest, force);
++
++	return -EINVAL;
++}
++
++static struct irq_chip rp1_gpio_irq_chip = {
++	.name = MODULE_NAME,
++	.irq_enable = rp1_gpio_irq_enable,
++	.irq_disable = rp1_gpio_irq_disable,
++	.irq_set_type = rp1_gpio_irq_set_type,
++	.irq_ack = rp1_gpio_irq_ack,
++	.irq_mask = rp1_gpio_irq_disable,
++	.irq_unmask = rp1_gpio_irq_enable,
++	.irq_set_affinity = rp1_gpio_irq_set_affinity,
++	.flags = IRQCHIP_IMMUTABLE,
++};
++
++static int rp1_pctl_get_groups_count(struct pinctrl_dev *pctldev)
++{
++	return ARRAY_SIZE(rp1_gpio_groups);
++}
++
++static const char *rp1_pctl_get_group_name(struct pinctrl_dev *pctldev,
++					   unsigned selector)
++{
++	return rp1_gpio_groups[selector];
++}
++
++static enum funcs rp1_get_fsel_func(unsigned pin, unsigned fsel)
++{
++	if (pin < RP1_NUM_GPIOS) {
++		if (fsel < RP1_FSEL_COUNT)
++			return rp1_gpio_pin_funcs[pin].funcs[fsel];
++		else if (fsel == RP1_FSEL_NONE)
++			return func_none;
++	}
++	return func_invalid;
++}
++
++static int rp1_pctl_get_group_pins(struct pinctrl_dev *pctldev,
++				   unsigned selector,
++				   const unsigned **pins,
++				   unsigned *num_pins)
++{
++	*pins = &rp1_gpio_pins[selector].number;
++	*num_pins = 1;
++
++	return 0;
++}
++
++static void rp1_pctl_pin_dbg_show(struct pinctrl_dev *pctldev,
++				  struct seq_file *s,
++				  unsigned offset)
++{
++	struct rp1_pinctrl *pc = pinctrl_dev_get_drvdata(pctldev);
++	struct gpio_chip *chip = &pc->gpio_chip;
++	struct rp1_pin_info *pin = rp1_get_pin_pctl(pctldev, offset);
++	u32 fsel = rp1_get_fsel(pin);
++	enum funcs func = rp1_get_fsel_func(offset, fsel);
++	int value = rp1_get_value(pin);
++	int irq = irq_find_mapping(chip->irq.domain, offset);
++
++	seq_printf(s, "function %s (%s) in %s; irq %d (%s)",
++		   rp1_func_names[fsel], rp1_func_names[func],
++		   value ? "hi" : "lo",
++		   irq, irq_type_names[pin->irq_type]);
++}
++
++static void rp1_pctl_dt_free_map(struct pinctrl_dev *pctldev,
++				 struct pinctrl_map *maps, unsigned num_maps)
++{
++	int i;
++
++	for (i = 0; i < num_maps; i++)
++		if (maps[i].type == PIN_MAP_TYPE_CONFIGS_PIN)
++			kfree(maps[i].data.configs.configs);
++
++	kfree(maps);
++}
++
++static int rp1_pctl_legacy_map_func(struct rp1_pinctrl *pc,
++				    struct device_node *np, u32 pin, u32 fnum,
++				    struct pinctrl_map *maps,
++				    unsigned int *num_maps)
++{
++	struct pinctrl_map *map = &maps[*num_maps];
++	enum funcs func;
++
++	if (fnum >= ARRAY_SIZE(legacy_fsel_map[0])) {
++		dev_err(pc->dev, "%pOF: invalid brcm,function %d\n", np, fnum);
++		return -EINVAL;
++	}
++
++	if (pin < ARRAY_SIZE(legacy_fsel_map)) {
++		func = legacy_fsel_map[pin][fnum];
++	} else if (fnum < 2) {
++		func = func_gpio;
++	} else {
++		dev_err(pc->dev, "%pOF: invalid brcm,pins value %d\n",
++			np, pin);
++		return -EINVAL;
++	}
++
++	if (func == func_invalid) {
++		dev_err(pc->dev, "%pOF: brcm,function %d not supported on pin %d\n",
++			np, fnum, pin);
++	}
++
++	map->type = PIN_MAP_TYPE_MUX_GROUP;
++	map->data.mux.group = rp1_gpio_groups[pin];
++	map->data.mux.function = rp1_func_names[func];
++	(*num_maps)++;
++
++	return 0;
++}
++
++static int rp1_pctl_legacy_map_pull(struct rp1_pinctrl *pc,
++				    struct device_node *np, u32 pin, u32 pull,
++				    struct pinctrl_map *maps,
++				    unsigned int *num_maps)
++{
++	struct pinctrl_map *map = &maps[*num_maps];
++	enum pin_config_param param;
++	unsigned long *configs;
++
++	switch (pull) {
++	case RP1_PUD_OFF:
++		param = PIN_CONFIG_BIAS_DISABLE;
++		break;
++	case RP1_PUD_DOWN:
++		param = PIN_CONFIG_BIAS_PULL_DOWN;
++		break;
++	case RP1_PUD_UP:
++		param = PIN_CONFIG_BIAS_PULL_UP;
++		break;
++	default:
++		dev_err(pc->dev, "%pOF: invalid brcm,pull %d\n", np, pull);
++		return -EINVAL;
++	}
++
++	configs = kzalloc(sizeof(*configs), GFP_KERNEL);
++	if (!configs)
++		return -ENOMEM;
++
++	configs[0] = pinconf_to_config_packed(param, 0);
++	map->type = PIN_MAP_TYPE_CONFIGS_PIN;
++	map->data.configs.group_or_pin = rp1_gpio_pins[pin].name;
++	map->data.configs.configs = configs;
++	map->data.configs.num_configs = 1;
++	(*num_maps)++;
++
++	return 0;
++}
++
++static int rp1_pctl_dt_node_to_map(struct pinctrl_dev *pctldev,
++				   struct device_node *np,
++				   struct pinctrl_map **map,
++				   unsigned int *num_maps)
++{
++	struct rp1_pinctrl *pc = pinctrl_dev_get_drvdata(pctldev);
++	struct property *pins, *funcs, *pulls;
++	int num_pins, num_funcs, num_pulls, maps_per_pin;
++	struct pinctrl_map *maps;
++	unsigned long *configs = NULL;
++	const char *function = NULL;
++	unsigned int reserved_maps;
++	int num_configs = 0;
++	int i, err;
++	u32 pin, func, pull;
++
++	/* Check for legacy pin declaration */
++	pins = of_find_property(np, "brcm,pins", NULL);
++
++	if (!pins) /* Assume generic bindings in this node */
++		return pinconf_generic_dt_node_to_map_all(pctldev, np, map, num_maps);
++
++	funcs = of_find_property(np, "brcm,function", NULL);
++	if (!funcs)
++		of_property_read_string(np, "function", &function);
++
++	pulls = of_find_property(np, "brcm,pull", NULL);
++	if (!pulls)
++		pinconf_generic_parse_dt_config(np, pctldev, &configs, &num_configs);
++
++	if (!function && !funcs && !num_configs && !pulls) {
++		dev_err(pc->dev,
++			"%pOF: no function, brcm,function, brcm,pull, etc.\n",
++			np);
++		return -EINVAL;
++	}
++
++	num_pins = pins->length / 4;
++	num_funcs = funcs ? (funcs->length / 4) : 0;
++	num_pulls = pulls ? (pulls->length / 4) : 0;
++
++	if (num_funcs > 1 && num_funcs != num_pins) {
++		dev_err(pc->dev,
++			"%pOF: brcm,function must have 1 or %d entries\n",
++			np, num_pins);
++		return -EINVAL;
++	}
++
++	if (num_pulls > 1 && num_pulls != num_pins) {
++		dev_err(pc->dev,
++			"%pOF: brcm,pull must have 1 or %d entries\n",
++			np, num_pins);
++		return -EINVAL;
++	}
++
++	maps_per_pin = 0;
++	if (function || num_funcs)
++		maps_per_pin++;
++	if (num_configs || num_pulls)
++		maps_per_pin++;
++	reserved_maps = num_pins * maps_per_pin;
++	maps = kcalloc(reserved_maps, sizeof(*maps), GFP_KERNEL);
++	if (!maps)
++		return -ENOMEM;
++
++	*num_maps = 0;
++
++	for (i = 0; i < num_pins; i++) {
++		err = of_property_read_u32_index(np, "brcm,pins", i, &pin);
++		if (err)
++			goto out;
++		if (num_funcs) {
++			err = of_property_read_u32_index(np, "brcm,function",
++							 (num_funcs > 1) ? i : 0,
++							 &func);
++			if (err)
++				goto out;
++			err = rp1_pctl_legacy_map_func(pc, np, pin, func,
++						       maps, num_maps);
++		} else if (function) {
++			err = pinctrl_utils_add_map_mux(pctldev, &maps,
++							&reserved_maps, num_maps,
++							rp1_gpio_groups[pin],
++							function);
++		}
++
++		if (err)
++			goto out;
++
++		if (num_pulls) {
++			err = of_property_read_u32_index(np, "brcm,pull",
++							 (num_pulls > 1) ? i : 0,
++							 &pull);
++			if (err)
++				goto out;
++			err = rp1_pctl_legacy_map_pull(pc, np, pin, pull,
++						       maps, num_maps);
++		} else if (num_configs) {
++			err = pinctrl_utils_add_map_configs(pctldev, &maps,
++							    &reserved_maps, num_maps,
++							    rp1_gpio_groups[pin],
++							    configs, num_configs,
++							    PIN_MAP_TYPE_CONFIGS_PIN);
++		}
++
++		if (err)
++			goto out;
++	}
++
++	*map = maps;
++
++	return 0;
++
++out:
++	rp1_pctl_dt_free_map(pctldev, maps, reserved_maps);
++	return err;
++}
++
++static const struct pinctrl_ops rp1_pctl_ops = {
++	.get_groups_count = rp1_pctl_get_groups_count,
++	.get_group_name = rp1_pctl_get_group_name,
++	.get_group_pins = rp1_pctl_get_group_pins,
++	.pin_dbg_show = rp1_pctl_pin_dbg_show,
++	.dt_node_to_map = rp1_pctl_dt_node_to_map,
++	.dt_free_map = rp1_pctl_dt_free_map,
++};
++
++static int rp1_pmx_free(struct pinctrl_dev *pctldev, unsigned offset)
++{
++	struct rp1_pin_info *pin = rp1_get_pin_pctl(pctldev, offset);
++	u32 fsel = rp1_get_fsel(pin);
++
++	/* Return all pins to GPIO_IN, unless persist_gpio_outputs is set */
++	if (persist_gpio_outputs && fsel == RP1_FSEL_GPIO)
++		return 0;
++
++	rp1_set_dir(pin, RP1_DIR_INPUT);
++	rp1_set_fsel(pin, RP1_FSEL_GPIO);
++
++	return 0;
++}
++
++static int rp1_pmx_get_functions_count(struct pinctrl_dev *pctldev)
++{
++	return func_count;
++}
++
++static const char *rp1_pmx_get_function_name(struct pinctrl_dev *pctldev,
++					     unsigned selector)
++{
++	return (selector < func_count) ? rp1_func_names[selector] : NULL;
++}
++
++static int rp1_pmx_get_function_groups(struct pinctrl_dev *pctldev,
++				       unsigned selector,
++				       const char * const **groups,
++				       unsigned * const num_groups)
++{
++	/* every pin can do every function */
++	*groups = rp1_gpio_groups;
++	*num_groups = ARRAY_SIZE(rp1_gpio_groups);
++
++	return 0;
++}
++
++static int rp1_pmx_set(struct pinctrl_dev *pctldev, unsigned func_selector,
++		       unsigned group_selector)
++{
++	struct rp1_pin_info *pin = rp1_get_pin_pctl(pctldev, group_selector);
++	const u8 *pin_funcs;
++	int fsel;
++
++	/* func_selector is an enum funcs, so needs translation */
++
++	if (func_selector >= RP1_FSEL_COUNT) {
++		/* Convert to an fsel number */
++		pin_funcs = rp1_gpio_pin_funcs[pin->num].funcs;
++		for (fsel = 0; fsel < RP1_FSEL_COUNT; fsel++) {
++			if (pin_funcs[fsel] == func_selector)
++				break;
++		}
++	} else {
++		fsel = (int)func_selector;
++	}
++
++	if (fsel >= RP1_FSEL_COUNT && fsel != RP1_FSEL_NONE)
++		return -EINVAL;
++
++	rp1_set_fsel(pin, fsel);
++
++	return 0;
++}
++
++static void rp1_pmx_gpio_disable_free(struct pinctrl_dev *pctldev,
++				      struct pinctrl_gpio_range *range,
++				      unsigned offset)
++{
++	(void)rp1_pmx_free(pctldev, offset);
++}
++
++static int rp1_pmx_gpio_set_direction(struct pinctrl_dev *pctldev,
++				      struct pinctrl_gpio_range *range,
++				      unsigned offset,
++				      bool input)
++{
++	struct rp1_pin_info *pin = rp1_get_pin_pctl(pctldev, offset);
++
++	rp1_set_dir(pin, input);
++	rp1_set_fsel(pin, RP1_FSEL_GPIO);
++
++	return 0;
++}
++
++static const struct pinmux_ops rp1_pmx_ops = {
++	.free = rp1_pmx_free,
++	.get_functions_count = rp1_pmx_get_functions_count,
++	.get_function_name = rp1_pmx_get_function_name,
++	.get_function_groups = rp1_pmx_get_function_groups,
++	.set_mux = rp1_pmx_set,
++	.gpio_disable_free = rp1_pmx_gpio_disable_free,
++	.gpio_set_direction = rp1_pmx_gpio_set_direction,
++};
++
++static void rp1_pull_config_set(struct rp1_pin_info *pin, unsigned int arg)
++{
++	u32 padctrl = readl(pin->pad);
++
++	FLD_SET(padctrl, RP1_PAD_PULL, arg & 0x3);
++
++	writel(padctrl, pin->pad);
++}
++
++/* Generic pinconf methods */
++
++static int rp1_pinconf_set(struct pinctrl_dev *pctldev, unsigned int offset,
++			   unsigned long *configs, unsigned int num_configs)
++{
++	struct rp1_pin_info *pin = rp1_get_pin_pctl(pctldev, offset);
++	u32 param, arg;
++	int i;
++
++	if (!pin)
++		return -EINVAL;
++
++	for (i = 0; i < num_configs; i++) {
++		param = pinconf_to_config_param(configs[i]);
++		arg = pinconf_to_config_argument(configs[i]);
++
++		switch (param) {
++		case PIN_CONFIG_BIAS_DISABLE:
++			rp1_pull_config_set(pin, RP1_PUD_OFF);
++			break;
++
++		case PIN_CONFIG_BIAS_PULL_DOWN:
++			rp1_pull_config_set(pin, RP1_PUD_DOWN);
++			break;
++
++		case PIN_CONFIG_BIAS_PULL_UP:
++			rp1_pull_config_set(pin, RP1_PUD_UP);
++			break;
++
++		case PIN_CONFIG_INPUT_ENABLE:
++			rp1_input_enable(pin, arg);
++			break;
++
++		case PIN_CONFIG_OUTPUT_ENABLE:
++			rp1_output_enable(pin, arg);
++			break;
++
++		case PIN_CONFIG_OUTPUT:
++			rp1_set_value(pin, arg);
++			rp1_set_dir(pin, RP1_DIR_OUTPUT);
++			rp1_set_fsel(pin, RP1_FSEL_GPIO);
++			break;
++
++		case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
++			rp1_pad_update(pin, RP1_PAD_SCHMITT_MASK,
++				       arg ? RP1_PAD_SCHMITT_MASK : 0);
++			break;
++
++		case PIN_CONFIG_SLEW_RATE:
++			rp1_pad_update(pin, RP1_PAD_SLEWFAST_MASK,
++				       arg ? RP1_PAD_SLEWFAST_MASK : 0);
++			break;
++
++		case PIN_CONFIG_DRIVE_STRENGTH:
++			switch (arg) {
++			case 2:
++				arg = RP1_PAD_DRIVE_2MA;
++				break;
++			case 4:
++				arg = RP1_PAD_DRIVE_4MA;
++				break;
++			case 8:
++				arg = RP1_PAD_DRIVE_8MA;
++				break;
++			case 12:
++				arg = RP1_PAD_DRIVE_12MA;
++				break;
++			default:
++				return -ENOTSUPP;
++			}
++			rp1_pad_update(pin, RP1_PAD_DRIVE_MASK, arg);
++			break;
++
++		default:
++			return -ENOTSUPP;
++
++		} /* switch param type */
++	} /* for each config */
++
++	return 0;
++}
++
++static int rp1_pinconf_get(struct pinctrl_dev *pctldev, unsigned offset,
++			   unsigned long *config)
++{
++	struct rp1_pin_info *pin = rp1_get_pin_pctl(pctldev, offset);
++	enum pin_config_param param = pinconf_to_config_param(*config);
++	u32 padctrl;
++	u32 arg;
++
++	if (!pin)
++		return -EINVAL;
++
++	padctrl = readl(pin->pad);
++
++	switch (param) {
++	case PIN_CONFIG_INPUT_ENABLE:
++		arg = !!(padctrl & RP1_PAD_IN_ENABLE_MASK);
++		break;
++	case PIN_CONFIG_OUTPUT_ENABLE:
++		arg = !(padctrl & RP1_PAD_OUT_DISABLE_MASK);
++		break;
++	case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
++		arg = !!(padctrl & RP1_PAD_SCHMITT_MASK);
++		break;
++	case PIN_CONFIG_SLEW_RATE:
++		arg = !!(padctrl & RP1_PAD_SLEWFAST_MASK);
++		break;
++	case PIN_CONFIG_DRIVE_STRENGTH:
++		switch (padctrl & RP1_PAD_DRIVE_MASK) {
++		case RP1_PAD_DRIVE_2MA:
++			arg = 2;
++			break;
++		case RP1_PAD_DRIVE_4MA:
++			arg = 4;
++			break;
++		case RP1_PAD_DRIVE_8MA:
++			arg = 8;
++			break;
++		case RP1_PAD_DRIVE_12MA:
++			arg = 12;
++			break;
++		}
++		break;
++	case PIN_CONFIG_BIAS_DISABLE:
++		arg = ((padctrl & RP1_PAD_PULL_MASK) == (RP1_PUD_OFF << RP1_PAD_PULL_LSB));
++		break;
++	case PIN_CONFIG_BIAS_PULL_DOWN:
++		arg = ((padctrl & RP1_PAD_PULL_MASK) == (RP1_PUD_DOWN << RP1_PAD_PULL_LSB));
++		break;
++
++	case PIN_CONFIG_BIAS_PULL_UP:
++		arg = ((padctrl & RP1_PAD_PULL_MASK) == (RP1_PUD_UP << RP1_PAD_PULL_LSB));
++		break;
++	default:
++		return -ENOTSUPP;
++	}
++
++	*config = pinconf_to_config_packed(param, arg);
++
++	return 0;
++}
++
++static const struct pinconf_ops rp1_pinconf_ops = {
++	.is_generic = true,
++	.pin_config_get = rp1_pinconf_get,
++	.pin_config_set = rp1_pinconf_set,
++};
++
++static struct pinctrl_desc rp1_pinctrl_desc = {
++	.name = MODULE_NAME,
++	.pins = rp1_gpio_pins,
++	.npins = ARRAY_SIZE(rp1_gpio_pins),
++	.pctlops = &rp1_pctl_ops,
++	.pmxops = &rp1_pmx_ops,
++	.confops = &rp1_pinconf_ops,
++	.owner = THIS_MODULE,
++};
++
++static struct pinctrl_gpio_range rp1_pinctrl_gpio_range = {
++	.name = MODULE_NAME,
++	.npins = RP1_NUM_GPIOS,
++};
++
++static const struct of_device_id rp1_pinctrl_match[] = {
++	{
++		.compatible = "raspberrypi,rp1-gpio",
++		.data = &rp1_pinconf_ops,
++	},
++	{}
++};
++
++static inline void __iomem *devm_auto_iomap(struct platform_device *pdev,
++					    unsigned int index)
++{
++	struct device *dev = &pdev->dev;
++	struct device_node *np = dev->of_node;
++
++	if (np)
++		return devm_of_iomap(dev, np, (int)index, NULL);
++	else
++		return devm_platform_ioremap_resource(pdev, index);
++}
++
++static int rp1_pinctrl_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct device_node *np = dev->of_node;
++	struct rp1_pinctrl *pc;
++	struct gpio_irq_chip *girq;
++	int err, i;
++
++	BUILD_BUG_ON(ARRAY_SIZE(rp1_gpio_pins) != RP1_NUM_GPIOS);
++	BUILD_BUG_ON(ARRAY_SIZE(rp1_gpio_groups) != RP1_NUM_GPIOS);
++
++	pc = devm_kzalloc(dev, sizeof(*pc), GFP_KERNEL);
++	if (!pc)
++		return -ENOMEM;
++
++	platform_set_drvdata(pdev, pc);
++	pc->dev = dev;
++
++	pc->gpio_base = devm_auto_iomap(pdev, 0);
++	if (IS_ERR(pc->gpio_base)) {
++		dev_err(dev, "could not get GPIO IO memory\n");
++		return PTR_ERR(pc->gpio_base);
++	}
++
++	pc->rio_base = devm_auto_iomap(pdev, 1);
++	if (IS_ERR(pc->rio_base)) {
++		dev_err(dev, "could not get RIO IO memory\n");
++		return PTR_ERR(pc->rio_base);
++	}
++
++	pc->pads_base = devm_auto_iomap(pdev, 2);
++	if (IS_ERR(pc->pads_base)) {
++		dev_err(dev, "could not get PADS IO memory\n");
++		return PTR_ERR(pc->pads_base);
++	}
++
++	pc->gpio_chip = rp1_gpio_chip;
++	pc->gpio_chip.parent = dev;
++
++	for (i = 0; i < RP1_NUM_BANKS; i++) {
++		const struct rp1_iobank_desc *bank = &rp1_iobanks[i];
++		int j;
++
++		for (j = 0; j < bank->num_gpios; j++) {
++			struct rp1_pin_info *pin =
++				&pc->pins[bank->min_gpio + j];
++
++			pin->num = bank->min_gpio + j;
++			pin->bank = i;
++			pin->offset = j;
++
++			pin->gpio = pc->gpio_base + bank->gpio_offset +
++				    j * sizeof(u32) * 2;
++			pin->inte = pc->gpio_base + bank->inte_offset;
++			pin->ints = pc->gpio_base + bank->ints_offset;
++			pin->rio  = pc->rio_base + bank->rio_offset;
++			pin->pad  = pc->pads_base + bank->pads_offset +
++				    j * sizeof(u32);
++		}
++
++		raw_spin_lock_init(&pc->irq_lock[i]);
++	}
++
++	pc->pctl_dev = devm_pinctrl_register(dev, &rp1_pinctrl_desc, pc);
++	if (IS_ERR(pc->pctl_dev))
++		return PTR_ERR(pc->pctl_dev);
++
++	girq = &pc->gpio_chip.irq;
++	girq->chip = &rp1_gpio_irq_chip;
++	girq->parent_handler = rp1_gpio_irq_handler;
++	girq->num_parents = RP1_NUM_BANKS;
++	girq->parents = pc->irq;
++
++	/*
++	 * Use the same handler for all groups: this is necessary
++	 * since we use one gpiochip to cover all lines - the
++	 * irq handler then needs to figure out which group and
++	 * bank that was firing the IRQ and look up the per-group
++	 * and bank data.
++	 */
++	for (i = 0; i < RP1_NUM_BANKS; i++) {
++		pc->irq[i] = irq_of_parse_and_map(np, i);
++		if (!pc->irq[i]) {
++			girq->num_parents = i;
++			break;
++		}
++	}
++
++	girq->default_type = IRQ_TYPE_NONE;
++	girq->handler = handle_level_irq;
++
++	err = devm_gpiochip_add_data(dev, &pc->gpio_chip, pc);
++	if (err) {
++		dev_err(dev, "could not add GPIO chip\n");
++		return err;
++	}
++
++	pc->gpio_range = rp1_pinctrl_gpio_range;
++	pc->gpio_range.base = pc->gpio_chip.base;
++	pc->gpio_range.gc = &pc->gpio_chip;
++	pinctrl_add_gpio_range(pc->pctl_dev, &pc->gpio_range);
++
++	return 0;
++}
++
++static struct platform_driver rp1_pinctrl_driver = {
++	.probe = rp1_pinctrl_probe,
++	.driver = {
++		.name = MODULE_NAME,
++		.of_match_table = rp1_pinctrl_match,
++		.suppress_bind_attrs = true,
++	},
++};
++builtin_platform_driver(rp1_pinctrl_driver);
+--- a/include/dt-bindings/pinctrl/rp1.h
++++ /dev/null
+@@ -1,46 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-/*
+- * Header providing constants for RP1 pinctrl bindings.
+- *
+- * Copyright (C) 2019-2022 Raspberry Pi Ltd.
+- */
+-
+-#ifndef __DT_BINDINGS_PINCTRL_RP1_H__
+-#define __DT_BINDINGS_PINCTRL_RP1_H__
+-
+-/* brcm,function property */
+-#define RP1_FSEL_GPIO_IN	0
+-#define RP1_FSEL_GPIO_OUT	1
+-#define RP1_FSEL_ALT0_LEGACY	4
+-#define RP1_FSEL_ALT1_LEGACY	5
+-#define RP1_FSEL_ALT2_LEGACY	6
+-#define RP1_FSEL_ALT3_LEGACY	7
+-#define RP1_FSEL_ALT4_LEGACY	3
+-#define RP1_FSEL_ALT5_LEGACY	2
+-#define RP1_FSEL_ALT0		0x08
+-#define RP1_FSEL_ALT0INV	0x09
+-#define RP1_FSEL_ALT1		0x0a
+-#define RP1_FSEL_ALT1INV	0x0b
+-#define RP1_FSEL_ALT2		0x0c
+-#define RP1_FSEL_ALT2INV	0x0d
+-#define RP1_FSEL_ALT3		0x0e
+-#define RP1_FSEL_ALT3INV	0x0f
+-#define RP1_FSEL_ALT4		0x10
+-#define RP1_FSEL_ALT4INV	0x11
+-#define RP1_FSEL_ALT5		0x12
+-#define RP1_FSEL_ALT5INV	0x13
+-#define RP1_FSEL_ALT6		0x14
+-#define RP1_FSEL_ALT6INV	0x15
+-#define RP1_FSEL_ALT7		0x16
+-#define RP1_FSEL_ALT7INV	0x17
+-#define RP1_FSEL_ALT8		0x18
+-#define RP1_FSEL_ALT8INV	0x19
+-#define RP1_FSEL_NONE		0x1a
+-
+-/* brcm,pull property */
+-#define RP1_PUD_OFF		0
+-#define RP1_PUD_DOWN		1
+-#define RP1_PUD_UP		2
+-#define RP1_PUD_KEEP		3
+-
+-#endif /* __DT_BINDINGS_PINCTRL_RP1_H__ */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0359-serial-pl011-rp1-uart-support.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0359-serial-pl011-rp1-uart-support.patch
new file mode 100644
index 00000000..275a1919
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0359-serial-pl011-rp1-uart-support.patch
@@ -0,0 +1,171 @@
+From b0e9124fb0d8d0fc99595f981a03949055029bb1 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 12 Oct 2022 13:24:51 +0100
+Subject: [PATCH 359/697] serial: pl011: rp1 uart support
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+ARM: pl011: Add rs485 to the RP1 support
+
+pl011_axi_probe, added for RP1 support, lacks the rs485 additions that
+appeared during its development.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+tty/serial: pl011: restrict RX burst FIFO threshold
+
+If the associated DMA controller has lower burst length support than the
+level the FIFO is set to, then bytes will be left in the RX FIFO at the
+end of a DMA block - requiring a round-trip through the timeout interrupt
+handler rather than an end-of-block DMA interrupt.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+tty/serial: pl011: Also unregister pl011_axi_platform_driver
+
+See: https://github.com/raspberrypi/linux/issues/6379
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/tty/serial/amba-pl011.c | 104 ++++++++++++++++++++++++++++++++
+ 1 file changed, 104 insertions(+)
+
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -152,6 +152,20 @@ static const struct vendor_data vendor_s
+ 	.fixed_options		= true,
+ };
+ 
++static struct vendor_data vendor_arm_axi = {
++	.reg_offset		= pl011_std_offsets,
++	.ifls			= UART011_IFLS_RX4_8 | UART011_IFLS_TX4_8,
++	.fr_busy		= UART01x_FR_BUSY,
++	.fr_dsr			= UART01x_FR_DSR,
++	.fr_cts			= UART01x_FR_CTS,
++	.fr_ri			= UART011_FR_RI,
++	.oversampling		= false,
++	.dma_threshold		= false,
++	.cts_event_workaround	= false,
++	.always_enabled		= false,
++	.fixed_options		= false,
++};
++
+ #ifdef CONFIG_ACPI_SPCR_TABLE
+ static const struct vendor_data vendor_qdt_qdf2400_e44 = {
+ 	.reg_offset		= pl011_std_offsets,
+@@ -470,6 +484,12 @@ static void pl011_dma_probe(struct uart_
+ 					 "RX DMA disabled - no residue processing\n");
+ 				return;
+ 			}
++			/*
++			 * DMA controllers with smaller burst capabilities than 1/4
++			 * the FIFO depth will leave more bytes than expected in the
++			 * RX FIFO if mismatched.
++			 */
++			rx_conf.src_maxburst = min(caps.max_burst, rx_conf.src_maxburst);
+ 		}
+ 		dmaengine_slave_config(chan, &rx_conf);
+ 		uap->dmarx.chan = chan;
+@@ -2964,6 +2984,87 @@ static struct platform_driver arm_sbsa_u
+ 	},
+ };
+ 
++static int pl011_axi_probe(struct platform_device *pdev)
++{
++	struct uart_amba_port *uap;
++	struct vendor_data *vendor =  &vendor_arm_axi;
++	struct resource *r;
++	unsigned int periphid;
++	int portnr, ret, irq;
++
++	portnr = pl011_find_free_port();
++	if (portnr < 0)
++		return portnr;
++
++	uap = devm_kzalloc(&pdev->dev, sizeof(struct uart_amba_port),
++			   GFP_KERNEL);
++	if (!uap)
++		return -ENOMEM;
++
++	uap->clk = devm_clk_get(&pdev->dev, NULL);
++	if (IS_ERR(uap->clk))
++		return PTR_ERR(uap->clk);
++
++	if (of_property_read_bool(pdev->dev.of_node, "cts-event-workaround")) {
++		vendor->cts_event_workaround = true;
++		dev_info(&pdev->dev, "cts_event_workaround enabled\n");
++	}
++
++	irq = platform_get_irq(pdev, 0);
++	if (irq < 0)
++		return irq;
++
++	periphid = 0x00241011; /* A safe default */
++	of_property_read_u32(pdev->dev.of_node, "arm,primecell-periphid",
++			     &periphid);
++
++	uap->reg_offset = vendor->reg_offset;
++	uap->vendor = vendor;
++	uap->fifosize = (AMBA_REV_BITS(periphid) < 3) ? 16 : 32;
++	uap->port.iotype = vendor->access_32b ? UPIO_MEM32 : UPIO_MEM;
++	uap->port.irq = irq;
++	uap->port.ops = &amba_pl011_pops;
++	uap->port.rs485_config = pl011_rs485_config;
++	uap->port.rs485_supported = pl011_rs485_supported;
++
++	snprintf(uap->type, sizeof(uap->type), "PL011 AXI");
++
++	r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++
++	ret = pl011_setup_port(&pdev->dev, uap, r, portnr);
++	if (ret)
++		return ret;
++
++	platform_set_drvdata(pdev, uap);
++
++	return pl011_register_port(uap);
++}
++
++static void pl011_axi_remove(struct platform_device *pdev)
++{
++	struct uart_amba_port *uap = platform_get_drvdata(pdev);
++
++	uart_remove_one_port(&amba_reg, &uap->port);
++	pl011_unregister_port(uap);
++}
++
++static const struct of_device_id pl011_axi_of_match[] = {
++	{ .compatible = "arm,pl011-axi" },
++	{},
++};
++MODULE_DEVICE_TABLE(of, pl011_axi_of_match);
++
++static struct platform_driver pl011_axi_platform_driver = {
++	.probe		= pl011_axi_probe,
++	.remove		= pl011_axi_remove,
++	.driver	= {
++		.name	= "pl011-axi",
++		.pm	= &pl011_dev_pm_ops,
++		.of_match_table = of_match_ptr(pl011_axi_of_match),
++		.suppress_bind_attrs = IS_BUILTIN(CONFIG_SERIAL_AMBA_PL011),
++	},
++};
++
+ static const struct amba_id pl011_ids[] = {
+ 	{
+ 		.id	= 0x00041011,
+@@ -2997,12 +3098,15 @@ static int __init pl011_init(void)
+ 
+ 	if (platform_driver_register(&arm_sbsa_uart_platform_driver))
+ 		pr_warn("could not register SBSA UART platform driver\n");
++	if (platform_driver_register(&pl011_axi_platform_driver))
++		pr_warn("could not register PL011 AXI platform driver\n");
+ 	return amba_driver_register(&pl011_driver);
+ }
+ 
+ static void __exit pl011_exit(void)
+ {
+ 	platform_driver_unregister(&arm_sbsa_uart_platform_driver);
++	platform_driver_unregister(&pl011_axi_platform_driver);
+ 	amba_driver_unregister(&pl011_driver);
+ }
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0360-mmc-sdhci-of-dwcmshc-define-sdio-timeout-clocks.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0360-mmc-sdhci-of-dwcmshc-define-sdio-timeout-clocks.patch
new file mode 100644
index 00000000..c279d740
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0360-mmc-sdhci-of-dwcmshc-define-sdio-timeout-clocks.patch
@@ -0,0 +1,180 @@
+From ff8d92194cf41686f917673ce72ee855994fc84f Mon Sep 17 00:00:00 2001
+From: Liam Fraser <liam@raspberrypi.com>
+Date: Thu, 14 Mar 2019 16:01:26 +0000
+Subject: [PATCH 360/697] mmc: sdhci-of-dwcmshc: define sdio timeout clocks
+
+Signed-off-by: Liam Fraser <liam@raspberrypi.com>
+
+mmc: sdhci-of-dwcmshc: rp1 sdio changes
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+drivers: mmc: sdhci-of-dwcmshc: add RP1 dt ID and quirks
+
+Differentiate the RP1 variant of the Designware MSHC controller(s).
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/host/sdhci-of-dwcmshc.c | 54 +++++++++++++++++++++++++++--
+ drivers/mmc/host/sdhci-pltfm.c      |  8 +++++
+ drivers/mmc/host/sdhci-pltfm.h      |  3 ++
+ 3 files changed, 62 insertions(+), 3 deletions(-)
+
+--- a/drivers/mmc/host/sdhci-of-dwcmshc.c
++++ b/drivers/mmc/host/sdhci-of-dwcmshc.c
+@@ -220,6 +220,7 @@ struct rk35xx_priv {
+ 
+ struct dwcmshc_priv {
+ 	struct clk	*bus_clk;
++	struct clk	*sdio_clk;
+ 	int vendor_specific_area1; /* P_VENDOR_SPECIFIC_AREA1 reg */
+ 	int vendor_specific_area2; /* P_VENDOR_SPECIFIC_AREA2 reg */
+ 
+@@ -288,6 +289,17 @@ static void dwcmshc_adma_write_desc(stru
+ 	sdhci_adma_write_desc(host, desc, addr, len, cmd);
+ }
+ 
++static void dwcmshc_set_clock(struct sdhci_host *host, unsigned int clock)
++{
++	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
++	struct dwcmshc_priv *priv = sdhci_pltfm_priv(pltfm_host);
++
++	if (priv->sdio_clk)
++		clk_set_rate(priv->sdio_clk, clock);
++
++	sdhci_set_clock(host, clock);
++}
++
+ static unsigned int dwcmshc_get_max_clock(struct sdhci_host *host)
+ {
+ 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+@@ -1114,10 +1126,11 @@ static int sg2042_init(struct device *de
+ }
+ 
+ static const struct sdhci_ops sdhci_dwcmshc_ops = {
+-	.set_clock		= sdhci_set_clock,
++	.set_clock		= dwcmshc_set_clock,
+ 	.set_bus_width		= sdhci_set_bus_width,
+ 	.set_uhs_signaling	= dwcmshc_set_uhs_signaling,
+ 	.get_max_clock		= dwcmshc_get_max_clock,
++	.get_timeout_clock	= sdhci_pltfm_clk_get_timeout_clock,
+ 	.reset			= sdhci_reset,
+ 	.adma_write_desc	= dwcmshc_adma_write_desc,
+ 	.irq			= dwcmshc_cqe_irq_handler,
+@@ -1190,8 +1203,10 @@ static const struct sdhci_ops sdhci_dwcm
+ static const struct dwcmshc_pltfm_data sdhci_dwcmshc_pdata = {
+ 	.pdata = {
+ 		.ops = &sdhci_dwcmshc_ops,
+-		.quirks = SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN,
+-		.quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
++		.quirks = SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN |
++			SDHCI_QUIRK_BROKEN_CARD_DETECTION,
++		.quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN |
++			SDHCI_QUIRK2_BROKEN_HS200,
+ 	},
+ };
+ 
+@@ -1206,6 +1221,15 @@ static const struct dwcmshc_pltfm_data s
+ };
+ #endif
+ 
++static const struct sdhci_pltfm_data sdhci_dwcmshc_rp1_pdata = {
++	.ops = &sdhci_dwcmshc_ops,
++	.quirks = SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN |
++		  SDHCI_QUIRK_BROKEN_CARD_DETECTION,
++	.quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN |
++		   SDHCI_QUIRK2_BROKEN_HS200 |
++		   SDHCI_QUIRK2_SPURIOUS_INT_RESP,
++};
++
+ static const struct dwcmshc_pltfm_data sdhci_dwcmshc_rk35xx_pdata = {
+ 	.pdata = {
+ 		.ops = &sdhci_dwcmshc_rk35xx_ops,
+@@ -1317,6 +1341,10 @@ dsbl_cqe_caps:
+ 
+ static const struct of_device_id sdhci_dwcmshc_dt_ids[] = {
+ 	{
++		.compatible = "raspberrypi,rp1-dwcmshc",
++		.data = &sdhci_dwcmshc_rp1_pdata,
++	},
++	{
+ 		.compatible = "rockchip,rk3588-dwcmshc",
+ 		.data = &sdhci_dwcmshc_rk35xx_pdata,
+ 	},
+@@ -1405,13 +1433,32 @@ static int dwcmshc_probe(struct platform
+ 		priv->bus_clk = devm_clk_get(dev, "bus");
+ 		if (!IS_ERR(priv->bus_clk))
+ 			clk_prepare_enable(priv->bus_clk);
++
++		pltfm_host->timeout_clk = devm_clk_get(dev, "timeout");
++		if (!IS_ERR(pltfm_host->timeout_clk))
++			err = clk_prepare_enable(pltfm_host->timeout_clk);
++		if (err)
++			goto free_pltfm;
++
++		priv->sdio_clk = devm_clk_get_optional(&pdev->dev, "sdio");
++	}
++
++	pltfm_host->timeout_clk = devm_clk_get(&pdev->dev, "timeout");
++	if (IS_ERR(pltfm_host->timeout_clk)) {
++		err = PTR_ERR(pltfm_host->timeout_clk);
++		dev_err(&pdev->dev, "failed to get timeout clk: %d\n", err);
++		goto free_pltfm;
+ 	}
++	err = clk_prepare_enable(pltfm_host->timeout_clk);
++	if (err)
++		goto free_pltfm;
+ 
+ 	err = mmc_of_parse(host->mmc);
+ 	if (err)
+ 		goto err_clk;
+ 
+ 	sdhci_get_of_property(pdev);
++	sdhci_enable_v4_mode(host);
+ 
+ 	priv->vendor_specific_area1 =
+ 		sdhci_readl(host, DWCMSHC_P_VENDOR_AREA1) & DWCMSHC_AREA1_MASK;
+@@ -1471,6 +1518,7 @@ err_rpm:
+ 	pm_runtime_put_noidle(dev);
+ err_clk:
+ 	clk_disable_unprepare(pltfm_host->clk);
++	clk_disable_unprepare(pltfm_host->timeout_clk);
+ 	clk_disable_unprepare(priv->bus_clk);
+ 	clk_bulk_disable_unprepare(priv->num_other_clks, priv->other_clks);
+ free_pltfm:
+--- a/drivers/mmc/host/sdhci-pltfm.c
++++ b/drivers/mmc/host/sdhci-pltfm.c
+@@ -32,6 +32,14 @@ unsigned int sdhci_pltfm_clk_get_max_clo
+ }
+ EXPORT_SYMBOL_GPL(sdhci_pltfm_clk_get_max_clock);
+ 
++unsigned int sdhci_pltfm_clk_get_timeout_clock(struct sdhci_host *host)
++{
++	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
++
++	return clk_get_rate(pltfm_host->timeout_clk);
++}
++EXPORT_SYMBOL_GPL(sdhci_pltfm_clk_get_timeout_clock);
++
+ static const struct sdhci_ops sdhci_pltfm_ops = {
+ 	.set_clock = sdhci_set_clock,
+ 	.set_bus_width = sdhci_set_bus_width,
+--- a/drivers/mmc/host/sdhci-pltfm.h
++++ b/drivers/mmc/host/sdhci-pltfm.h
+@@ -20,6 +20,7 @@ struct sdhci_pltfm_data {
+ 
+ struct sdhci_pltfm_host {
+ 	struct clk *clk;
++	struct clk *timeout_clk;
+ 
+ 	/* migrate from sdhci_of_host */
+ 	unsigned int clock;
+@@ -106,6 +107,8 @@ extern void sdhci_pltfm_remove(struct pl
+ 
+ extern unsigned int sdhci_pltfm_clk_get_max_clock(struct sdhci_host *host);
+ 
++extern unsigned int sdhci_pltfm_clk_get_timeout_clock(struct sdhci_host *host);
++
+ static inline void *sdhci_pltfm_priv(struct sdhci_pltfm_host *host)
+ {
+ 	return host->private;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0361-clk-rp1-Add-sdio-clk-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0361-clk-rp1-Add-sdio-clk-driver.patch
new file mode 100644
index 00000000..f68bb565
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0361-clk-rp1-Add-sdio-clk-driver.patch
@@ -0,0 +1,640 @@
+From 6814139662884aaf588f586a2e3786522cbb35be Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 12 Oct 2022 14:20:07 +0100
+Subject: [PATCH 361/697] clk: rp1: Add sdio-clk driver
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/clk/Kconfig        |   6 +
+ drivers/clk/Makefile       |   1 +
+ drivers/clk/clk-rp1-sdio.c | 599 +++++++++++++++++++++++++++++++++++++
+ 3 files changed, 606 insertions(+)
+ create mode 100644 drivers/clk/clk-rp1-sdio.c
+
+--- a/drivers/clk/Kconfig
++++ b/drivers/clk/Kconfig
+@@ -95,6 +95,12 @@ config COMMON_CLK_RP1
+ 	help
+ 	  Enable common clock framework support for Raspberry Pi RP1
+ 
++config COMMON_CLK_RP1_SDIO
++	tristate "Clock driver for the RP1 SDIO interfaces"
++	depends on MFD_RP1
++	help
++	  SDIO clock driver for the RP1 support chip
++
+ config COMMON_CLK_HI655X
+ 	tristate "Clock driver for Hi655x" if EXPERT
+ 	depends on (MFD_HI655X_PMIC || COMPILE_TEST)
+--- a/drivers/clk/Makefile
++++ b/drivers/clk/Makefile
+@@ -71,6 +71,7 @@ obj-$(CONFIG_COMMON_CLK_PWM)		+= clk-pwm
+ obj-$(CONFIG_CLK_QORIQ)			+= clk-qoriq.o
+ obj-$(CONFIG_COMMON_CLK_RK808)		+= clk-rk808.o
+ obj-$(CONFIG_COMMON_CLK_RP1)		+= clk-rp1.o
++obj-$(CONFIG_COMMON_CLK_RP1_SDIO)	+= clk-rp1-sdio.o
+ obj-$(CONFIG_COMMON_CLK_HI655X)		+= clk-hi655x.o
+ obj-$(CONFIG_COMMON_CLK_S2MPS11)	+= clk-s2mps11.o
+ obj-$(CONFIG_COMMON_CLK_SCMI)           += clk-scmi.o
+--- /dev/null
++++ b/drivers/clk/clk-rp1-sdio.c
+@@ -0,0 +1,599 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * SDIO clock driver for RP1
++ *
++ * Copyright (C) 2023 Raspberry Pi Ltd.
++ */
++
++#include <linux/io.h>
++#include <linux/clk.h>
++#include <linux/clk-provider.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++
++// Register    : MODE
++#define MODE        0x00000000
++#define MODE_BITS   0x70030000
++#define MODE_RESET  0x00000000
++// Field       : MODE_STEPS_PER_CYCLE
++#define MODE_STEPS_PER_CYCLE_RESET          0x0
++#define MODE_STEPS_PER_CYCLE_BITS           0x70000000
++#define MODE_STEPS_PER_CYCLE_MSB            30
++#define MODE_STEPS_PER_CYCLE_LSB            28
++#define MODE_STEPS_PER_CYCLE_VALUE_STEPS_20 0x0
++#define MODE_STEPS_PER_CYCLE_VALUE_STEPS_10 0x1
++#define MODE_STEPS_PER_CYCLE_VALUE_STEPS_16 0x2
++#define MODE_STEPS_PER_CYCLE_VALUE_STEPS_8  0x3
++#define MODE_STEPS_PER_CYCLE_VALUE_STEPS_12 0x4
++#define MODE_STEPS_PER_CYCLE_VALUE_STEPS_6  0x5
++#define MODE_STEPS_PER_CYCLE_VALUE_STEPS_5  0x6
++#define MODE_STEPS_PER_CYCLE_VALUE_STEPS_4  0x7
++// Field       : MODE_SRC_SEL
++#define MODE_SRC_SEL_RESET                   0x0
++#define MODE_SRC_SEL_BITS                    0x00030000
++#define MODE_SRC_SEL_MSB                     17
++#define MODE_SRC_SEL_LSB                     16
++#define MODE_SRC_SEL_VALUE_STOP              0x0
++#define MODE_SRC_SEL_VALUE_CLK_ALT_SRC       0x1
++#define MODE_SRC_SEL_VALUE_PLL_SYS_VCO       0x2
++#define MODE_SRC_SEL_VALUE_PLL_SYS_VCO_AGAIN 0x3
++// Register    : FROMIP
++#define FROMIP        0x00000004
++#define FROMIP_BITS   0x0f9713ff
++#define FROMIP_RESET  0x00000000
++// Field       : FROMIP_TUNING_CCLK_SEL
++#define FROMIP_TUNING_CCLK_SEL_RESET  0x0
++#define FROMIP_TUNING_CCLK_SEL_BITS   0x0f000000
++#define FROMIP_TUNING_CCLK_SEL_MSB    27
++#define FROMIP_TUNING_CCLK_SEL_LSB    24
++// Field       : FROMIP_TUNING_CCLK_UPDATE
++#define FROMIP_TUNING_CCLK_UPDATE_RESET  0x0
++#define FROMIP_TUNING_CCLK_UPDATE_BITS   0x00800000
++#define FROMIP_TUNING_CCLK_UPDATE_MSB    23
++#define FROMIP_TUNING_CCLK_UPDATE_LSB    23
++// Field       : FROMIP_SAMPLE_CCLK_SEL
++#define FROMIP_SAMPLE_CCLK_SEL_RESET  0x0
++#define FROMIP_SAMPLE_CCLK_SEL_BITS   0x00100000
++#define FROMIP_SAMPLE_CCLK_SEL_MSB    20
++#define FROMIP_SAMPLE_CCLK_SEL_LSB    20
++// Field       : FROMIP_CLK2CARD_ON
++#define FROMIP_CLK2CARD_ON_RESET  0x0
++#define FROMIP_CLK2CARD_ON_BITS   0x00040000
++#define FROMIP_CLK2CARD_ON_MSB    18
++#define FROMIP_CLK2CARD_ON_LSB    18
++// Field       : FROMIP_CARD_CLK_STABLE
++#define FROMIP_CARD_CLK_STABLE_RESET  0x0
++#define FROMIP_CARD_CLK_STABLE_BITS   0x00020000
++#define FROMIP_CARD_CLK_STABLE_MSB    17
++#define FROMIP_CARD_CLK_STABLE_LSB    17
++// Field       : FROMIP_CARD_CLK_EN
++#define FROMIP_CARD_CLK_EN_RESET  0x0
++#define FROMIP_CARD_CLK_EN_BITS   0x00010000
++#define FROMIP_CARD_CLK_EN_MSB    16
++#define FROMIP_CARD_CLK_EN_LSB    16
++// Field       : FROMIP_CLK_GEN_SEL
++#define FROMIP_CLK_GEN_SEL_RESET  0x0
++#define FROMIP_CLK_GEN_SEL_BITS   0x00001000
++#define FROMIP_CLK_GEN_SEL_MSB    12
++#define FROMIP_CLK_GEN_SEL_LSB    12
++// Field       : FROMIP_FREQ_SEL
++#define FROMIP_FREQ_SEL_RESET  0x000
++#define FROMIP_FREQ_SEL_BITS   0x000003ff
++#define FROMIP_FREQ_SEL_MSB    9
++#define FROMIP_FREQ_SEL_LSB    0
++// Register    : LOCAL
++#define LOCAL        0x00000008
++#define LOCAL_BITS   0x1f9713ff
++#define LOCAL_RESET  0x00000000
++// Field       : LOCAL_TUNING_CCLK_SEL
++#define LOCAL_TUNING_CCLK_SEL_RESET  0x00
++#define LOCAL_TUNING_CCLK_SEL_BITS   0x1f000000
++#define LOCAL_TUNING_CCLK_SEL_MSB    28
++#define LOCAL_TUNING_CCLK_SEL_LSB    24
++// Field       : LOCAL_TUNING_CCLK_UPDATE
++#define LOCAL_TUNING_CCLK_UPDATE_RESET  0x0
++#define LOCAL_TUNING_CCLK_UPDATE_BITS   0x00800000
++#define LOCAL_TUNING_CCLK_UPDATE_MSB    23
++#define LOCAL_TUNING_CCLK_UPDATE_LSB    23
++// Field       : LOCAL_SAMPLE_CCLK_SEL
++#define LOCAL_SAMPLE_CCLK_SEL_RESET  0x0
++#define LOCAL_SAMPLE_CCLK_SEL_BITS   0x00100000
++#define LOCAL_SAMPLE_CCLK_SEL_MSB    20
++#define LOCAL_SAMPLE_CCLK_SEL_LSB    20
++// Field       : LOCAL_CLK2CARD_ON
++#define LOCAL_CLK2CARD_ON_RESET  0x0
++#define LOCAL_CLK2CARD_ON_BITS   0x00040000
++#define LOCAL_CLK2CARD_ON_MSB    18
++#define LOCAL_CLK2CARD_ON_LSB    18
++// Field       : LOCAL_CARD_CLK_STABLE
++#define LOCAL_CARD_CLK_STABLE_RESET  0x0
++#define LOCAL_CARD_CLK_STABLE_BITS   0x00020000
++#define LOCAL_CARD_CLK_STABLE_MSB    17
++#define LOCAL_CARD_CLK_STABLE_LSB    17
++// Field       : LOCAL_CARD_CLK_EN
++#define LOCAL_CARD_CLK_EN_RESET  0x0
++#define LOCAL_CARD_CLK_EN_BITS   0x00010000
++#define LOCAL_CARD_CLK_EN_MSB    16
++#define LOCAL_CARD_CLK_EN_LSB    16
++// Field       : LOCAL_CLK_GEN_SEL
++#define LOCAL_CLK_GEN_SEL_RESET               0x0
++#define LOCAL_CLK_GEN_SEL_BITS                0x00001000
++#define LOCAL_CLK_GEN_SEL_MSB                 12
++#define LOCAL_CLK_GEN_SEL_LSB                 12
++#define LOCAL_CLK_GEN_SEL_VALUE_PROGCLOCKMODE 0x0
++#define LOCAL_CLK_GEN_SEL_VALUE_DIVCLOCKMODE  0x1
++// Field       : LOCAL_FREQ_SEL
++#define LOCAL_FREQ_SEL_RESET  0x000
++#define LOCAL_FREQ_SEL_BITS   0x000003ff
++#define LOCAL_FREQ_SEL_MSB    9
++#define LOCAL_FREQ_SEL_LSB    0
++// Register    : USE_LOCAL
++#define USE_LOCAL        0x0000000c
++#define USE_LOCAL_BITS   0x01951001
++#define USE_LOCAL_RESET  0x00000000
++// Field       : USE_LOCAL_TUNING_CCLK_SEL
++#define USE_LOCAL_TUNING_CCLK_SEL_RESET  0x0
++#define USE_LOCAL_TUNING_CCLK_SEL_BITS   0x01000000
++#define USE_LOCAL_TUNING_CCLK_SEL_MSB    24
++#define USE_LOCAL_TUNING_CCLK_SEL_LSB    24
++// Field       : USE_LOCAL_TUNING_CCLK_UPDATE
++#define USE_LOCAL_TUNING_CCLK_UPDATE_RESET  0x0
++#define USE_LOCAL_TUNING_CCLK_UPDATE_BITS   0x00800000
++#define USE_LOCAL_TUNING_CCLK_UPDATE_MSB    23
++#define USE_LOCAL_TUNING_CCLK_UPDATE_LSB    23
++// Field       : USE_LOCAL_SAMPLE_CCLK_SEL
++#define USE_LOCAL_SAMPLE_CCLK_SEL_RESET  0x0
++#define USE_LOCAL_SAMPLE_CCLK_SEL_BITS   0x00100000
++#define USE_LOCAL_SAMPLE_CCLK_SEL_MSB    20
++#define USE_LOCAL_SAMPLE_CCLK_SEL_LSB    20
++// Field       : USE_LOCAL_CLK2CARD_ON
++#define USE_LOCAL_CLK2CARD_ON_RESET  0x0
++#define USE_LOCAL_CLK2CARD_ON_BITS   0x00040000
++#define USE_LOCAL_CLK2CARD_ON_MSB    18
++#define USE_LOCAL_CLK2CARD_ON_LSB    18
++// Field       : USE_LOCAL_CARD_CLK_EN
++#define USE_LOCAL_CARD_CLK_EN_RESET  0x0
++#define USE_LOCAL_CARD_CLK_EN_BITS   0x00010000
++#define USE_LOCAL_CARD_CLK_EN_MSB    16
++#define USE_LOCAL_CARD_CLK_EN_LSB    16
++// Field       : USE_LOCAL_CLK_GEN_SEL
++#define USE_LOCAL_CLK_GEN_SEL_RESET  0x0
++#define USE_LOCAL_CLK_GEN_SEL_BITS   0x00001000
++#define USE_LOCAL_CLK_GEN_SEL_MSB    12
++#define USE_LOCAL_CLK_GEN_SEL_LSB    12
++// Field       : USE_LOCAL_FREQ_SEL
++#define USE_LOCAL_FREQ_SEL_RESET  0x0
++#define USE_LOCAL_FREQ_SEL_BITS   0x00000001
++#define USE_LOCAL_FREQ_SEL_MSB    0
++#define USE_LOCAL_FREQ_SEL_LSB    0
++// Register    : SD_DELAY
++#define SD_DELAY        0x00000010
++#define SD_DELAY_BITS   0x0000001f
++#define SD_DELAY_RESET  0x00000000
++// Field       : SD_DELAY_STEPS
++#define SD_DELAY_STEPS_RESET  0x00
++#define SD_DELAY_STEPS_BITS   0x0000001f
++#define SD_DELAY_STEPS_MSB    4
++#define SD_DELAY_STEPS_LSB    0
++// Register    : RX_DELAY
++#define RX_DELAY        0x00000014
++#define RX_DELAY_BITS   0x19f3331f
++#define RX_DELAY_RESET  0x00000000
++// Field       : RX_DELAY_BYPASS
++#define RX_DELAY_BYPASS_RESET  0x0
++#define RX_DELAY_BYPASS_BITS   0x10000000
++#define RX_DELAY_BYPASS_MSB    28
++#define RX_DELAY_BYPASS_LSB    28
++// Field       : RX_DELAY_FAIL_ACTUAL
++#define RX_DELAY_FAIL_ACTUAL_RESET  0x0
++#define RX_DELAY_FAIL_ACTUAL_BITS   0x08000000
++#define RX_DELAY_FAIL_ACTUAL_MSB    27
++#define RX_DELAY_FAIL_ACTUAL_LSB    27
++// Field       : RX_DELAY_ACTUAL
++#define RX_DELAY_ACTUAL_RESET  0x00
++#define RX_DELAY_ACTUAL_BITS   0x01f00000
++#define RX_DELAY_ACTUAL_MSB    24
++#define RX_DELAY_ACTUAL_LSB    20
++// Field       : RX_DELAY_OFFSET
++#define RX_DELAY_OFFSET_RESET  0x0
++#define RX_DELAY_OFFSET_BITS   0x00030000
++#define RX_DELAY_OFFSET_MSB    17
++#define RX_DELAY_OFFSET_LSB    16
++// Field       : RX_DELAY_OVERFLOW
++#define RX_DELAY_OVERFLOW_RESET       0x0
++#define RX_DELAY_OVERFLOW_BITS        0x00003000
++#define RX_DELAY_OVERFLOW_MSB         13
++#define RX_DELAY_OVERFLOW_LSB         12
++#define RX_DELAY_OVERFLOW_VALUE_ALLOW 0x0
++#define RX_DELAY_OVERFLOW_VALUE_CLAMP 0x1
++#define RX_DELAY_OVERFLOW_VALUE_FAIL  0x2
++// Field       : RX_DELAY_MAP
++#define RX_DELAY_MAP_RESET         0x0
++#define RX_DELAY_MAP_BITS          0x00000300
++#define RX_DELAY_MAP_MSB           9
++#define RX_DELAY_MAP_LSB           8
++#define RX_DELAY_MAP_VALUE_DIRECT  0x0
++#define RX_DELAY_MAP_VALUE         0x1
++#define RX_DELAY_MAP_VALUE_STRETCH 0x2
++// Field       : RX_DELAY_FIXED
++#define RX_DELAY_FIXED_RESET  0x00
++#define RX_DELAY_FIXED_BITS   0x0000001f
++#define RX_DELAY_FIXED_MSB    4
++#define RX_DELAY_FIXED_LSB    0
++// Register    : NDIV
++#define NDIV        0x00000018
++#define NDIV_BITS   0x1fff0000
++#define NDIV_RESET  0x00110000
++// Field       : NDIV_DIVB
++#define NDIV_DIVB_RESET  0x001
++#define NDIV_DIVB_BITS   0x1ff00000
++#define NDIV_DIVB_MSB    28
++#define NDIV_DIVB_LSB    20
++// Field       : NDIV_DIVA
++#define NDIV_DIVA_RESET  0x1
++#define NDIV_DIVA_BITS   0x000f0000
++#define NDIV_DIVA_MSB    19
++#define NDIV_DIVA_LSB    16
++// Register    : CS
++#define CS        0x0000001c
++#define CS_BITS   0x00111101
++#define CS_RESET  0x00000001
++// Field       : CS_RX_DEL_UPDATED
++#define CS_RX_DEL_UPDATED_RESET  0x0
++#define CS_RX_DEL_UPDATED_BITS   0x00100000
++#define CS_RX_DEL_UPDATED_MSB    20
++#define CS_RX_DEL_UPDATED_LSB    20
++// Field       : CS_RX_CLK_RUNNING
++#define CS_RX_CLK_RUNNING_RESET  0x0
++#define CS_RX_CLK_RUNNING_BITS   0x00010000
++#define CS_RX_CLK_RUNNING_MSB    16
++#define CS_RX_CLK_RUNNING_LSB    16
++// Field       : CS_SD_CLK_RUNNING
++#define CS_SD_CLK_RUNNING_RESET  0x0
++#define CS_SD_CLK_RUNNING_BITS   0x00001000
++#define CS_SD_CLK_RUNNING_MSB    12
++#define CS_SD_CLK_RUNNING_LSB    12
++// Field       : CS_TX_CLK_RUNNING
++#define CS_TX_CLK_RUNNING_RESET  0x0
++#define CS_TX_CLK_RUNNING_BITS   0x00000100
++#define CS_TX_CLK_RUNNING_MSB    8
++#define CS_TX_CLK_RUNNING_LSB    8
++// Field       : CS_RESET
++#define CS_RESET_RESET  0x1
++#define CS_RESET_BITS   0x00000001
++#define CS_RESET_MSB    0
++#define CS_RESET_LSB    0
++
++#define FPGA_SRC_RATE 400000000
++
++/* Base number of steps to delay in relation to tx clk.
++ * The relationship of the 3 clocks are as follows:
++ * tx_clk: This clock is provided to the controller. Data is sent out
++ * to the pads using this clock.
++ * sd_clk: This clock is sent out to the card.
++ * rx_clk: This clock is used to sample the data coming back from the card.
++ * This may need to be several steps ahead of the tx_clk. The default rx delay
++ * is used as a base delay, and can be further adjusted by the sd host
++ * controller during the tuning process if using a DDR50 or faster SD card
++ */
++/*
++ * PRJY-1813 - the default SD clock delay needs to be set to ~60% of the total
++ * number of steps to meet tISU (>6ns) and tIH (>2ns) in high-speed mode.
++ * On FPGA this means delay SDCLK by 5, and sample RX with a delay of 6.
++ */
++#define DEFAULT_RX_DELAY 6
++#define DEFAULT_SD_DELAY 5
++
++struct rp1_sdio_clkgen {
++	struct device *dev;
++
++	/* Source clock. Either PLL VCO or fixed freq on FPGA */
++	struct clk *src_clk;
++	/* Desired base frequency. Max freq card can go */
++	struct clk *base_clk;
++
++	struct clk_hw hw;
++	void __iomem *regs;
++
++	/* Starting value of local register before changing freq */
++	u32 local_base;
++};
++
++static inline void clkgen_write(struct rp1_sdio_clkgen *clkgen, u32 reg, u32 val)
++{
++	dev_dbg(clkgen->dev, "%s: write reg 0x%x: 0x%x\n", __func__, reg, val);
++	writel(val, clkgen->regs + reg);
++}
++
++static inline u32 clkgen_read(struct rp1_sdio_clkgen *clkgen, u32 reg)
++{
++	u32 val = readl(clkgen->regs + reg);
++
++	dev_dbg(clkgen->dev, "%s: read reg 0x%x: 0x%x\n", __func__, reg, val);
++	return val;
++}
++
++static int get_steps(unsigned int steps)
++{
++	int ret = -1;
++
++	if (steps == 4)
++		ret = MODE_STEPS_PER_CYCLE_VALUE_STEPS_4;
++	else if (steps == 5)
++		ret = MODE_STEPS_PER_CYCLE_VALUE_STEPS_5;
++	else if (steps == 6)
++		ret = MODE_STEPS_PER_CYCLE_VALUE_STEPS_6;
++	else if (steps == 8)
++		ret = MODE_STEPS_PER_CYCLE_VALUE_STEPS_8;
++	else if (steps == 10)
++		ret = MODE_STEPS_PER_CYCLE_VALUE_STEPS_10;
++	else if (steps == 12)
++		ret = MODE_STEPS_PER_CYCLE_VALUE_STEPS_12;
++	else if (steps == 16)
++		ret = MODE_STEPS_PER_CYCLE_VALUE_STEPS_16;
++	else if (steps == 20)
++		ret = MODE_STEPS_PER_CYCLE_VALUE_STEPS_20;
++	return ret;
++}
++
++static int rp1_sdio_clk_init(struct rp1_sdio_clkgen *clkgen)
++{
++	unsigned long src_rate = clk_get_rate(clkgen->src_clk);
++	unsigned long base_rate = clk_get_rate(clkgen->base_clk);
++	unsigned int steps = src_rate / base_rate;
++	u32 reg = 0;
++	int steps_value = 0;
++
++	dev_dbg(clkgen->dev, "init: src_rate %lu, base_rate %lu, steps %d\n",
++		src_rate, base_rate, steps);
++
++	/* Assert reset while we set up clkgen */
++	clkgen_write(clkgen, CS, CS_RESET_BITS);
++
++	/* Pick clock source */
++	if (src_rate == FPGA_SRC_RATE) {
++		/* Using ALT SRC */
++		reg |= MODE_SRC_SEL_VALUE_CLK_ALT_SRC << MODE_SRC_SEL_LSB;
++	} else {
++		/* Assume we are using PLL SYS VCO */
++		reg |= MODE_SRC_SEL_VALUE_PLL_SYS_VCO << MODE_SRC_SEL_LSB;
++	}
++
++	/* How many delay steps are available in one cycle for this source */
++	steps_value = get_steps(steps);
++	if (steps_value < 0) {
++		dev_err(clkgen->dev, "Invalid step value: %d\n", steps);
++		return -EINVAL;
++	}
++	reg |= steps_value << MODE_STEPS_PER_CYCLE_LSB;
++
++	/* Mode register is done now*/
++	clkgen_write(clkgen, MODE, reg);
++
++	/* Now set delay mode */
++	/* Clamp value if out of range rx delay is used */
++	reg = RX_DELAY_OVERFLOW_VALUE_CLAMP << RX_DELAY_OVERFLOW_LSB;
++	/* SD tuning bus goes from 0x0 to 0xf but we don't necessarily have that
++	 * many steps available depending on the source so map 0x0 -> 0xf to one
++	 * cycle of rx delay
++	 */
++	reg |= RX_DELAY_MAP_VALUE_STRETCH << RX_DELAY_MAP_LSB;
++
++	/* Default RX delay */
++	dev_dbg(clkgen->dev, "default rx delay %d\n", DEFAULT_RX_DELAY);
++	reg |= (DEFAULT_RX_DELAY & RX_DELAY_FIXED_BITS) << RX_DELAY_FIXED_LSB;
++	clkgen_write(clkgen, RX_DELAY, reg);
++
++	/* Default SD delay */
++	dev_dbg(clkgen->dev, "default sd delay %d\n", DEFAULT_SD_DELAY);
++	reg = (DEFAULT_SD_DELAY & SD_DELAY_STEPS_BITS) << SD_DELAY_STEPS_LSB;
++	clkgen_write(clkgen, SD_DELAY, reg);
++
++	/* We select freq, we turn on tx clock, we turn on sd clk,
++	 * we pick clock generator mode
++	 */
++	reg = USE_LOCAL_FREQ_SEL_BITS | USE_LOCAL_CARD_CLK_EN_BITS |
++	      USE_LOCAL_CLK2CARD_ON_BITS | USE_LOCAL_CLK_GEN_SEL_BITS;
++	clkgen_write(clkgen, USE_LOCAL, reg);
++
++	/* Deassert reset. Reset bit is only writable bit of CS
++	 * reg so fine to write a 0.
++	 */
++	clkgen_write(clkgen, CS, 0);
++
++	return 0;
++}
++
++#define RUNNING	\
++	(CS_TX_CLK_RUNNING_BITS | CS_RX_CLK_RUNNING_BITS | \
++	 CS_SD_CLK_RUNNING_BITS)
++static int rp1_sdio_clk_is_prepared(struct clk_hw *hw)
++{
++	struct rp1_sdio_clkgen *clkgen =
++		container_of(hw, struct rp1_sdio_clkgen, hw);
++	u32 status;
++
++	dev_dbg(clkgen->dev, "is_prepared\n");
++	status = clkgen_read(clkgen, CS);
++	return ((status & RUNNING) == RUNNING);
++}
++
++/* Can define an additional divider if an sd card isn't working at full speed */
++/* #define SLOWDOWN 3 */
++
++static unsigned long rp1_sdio_clk_get_rate(struct clk_hw *hw,
++					   unsigned long parent_rate)
++{
++	/* Get the current rate */
++	struct rp1_sdio_clkgen *clkgen =
++		container_of(hw, struct rp1_sdio_clkgen, hw);
++	unsigned long actual_rate = 0;
++	u32 ndiv_diva;
++	u32 ndiv_divb;
++	u32 tmp;
++	u32 div;
++
++	tmp = clkgen_read(clkgen, LOCAL);
++	if ((tmp & LOCAL_CLK2CARD_ON_BITS) == 0) {
++		dev_dbg(clkgen->dev, "get_rate 0\n");
++		return 0;
++	}
++
++	tmp = clkgen_read(clkgen, NDIV);
++	ndiv_diva = (tmp & NDIV_DIVA_BITS) >> NDIV_DIVA_LSB;
++	ndiv_divb = (tmp & NDIV_DIVB_BITS) >> NDIV_DIVB_LSB;
++	div = ndiv_diva * ndiv_divb;
++	actual_rate = (clk_get_rate(clkgen->base_clk) / div);
++
++#ifdef SLOWDOWN
++	actual_rate *= SLOWDOWN;
++#endif
++
++	dev_dbg(clkgen->dev, "get_rate. ndiv_diva %d, ndiv_divb %d = %lu\n",
++		ndiv_diva, ndiv_divb, actual_rate);
++
++	return actual_rate;
++}
++
++static int rp1_sdio_clk_set_rate(struct clk_hw *hw, unsigned long rate,
++				 unsigned long parent_rate)
++{
++	struct rp1_sdio_clkgen *clkgen =
++		container_of(hw, struct rp1_sdio_clkgen, hw);
++	u32 div;
++	u32 reg;
++
++	dev_dbg(clkgen->dev, "set_rate %lu\n", rate);
++
++	if (rate == 0) {
++		/* Keep tx clock running */
++		clkgen_write(clkgen, LOCAL, LOCAL_CARD_CLK_EN_BITS);
++		return 0;
++	}
++
++#ifdef SLOWDOWN
++	rate /= SLOWDOWN;
++#endif
++
++	div = (clk_get_rate(clkgen->base_clk) / rate) - 1;
++	reg = LOCAL_CLK_GEN_SEL_BITS | LOCAL_CARD_CLK_EN_BITS |
++	      LOCAL_CLK2CARD_ON_BITS | (div << LOCAL_FREQ_SEL_LSB);
++	clkgen_write(clkgen, LOCAL, reg);
++
++	return 0;
++}
++
++#define MAX_NDIV (256 * 8)
++static int rp1_sdio_clk_determine_rate(struct clk_hw *hw,
++				       struct clk_rate_request *req)
++{
++	unsigned long rate;
++	struct rp1_sdio_clkgen *clkgen =
++		container_of(hw, struct rp1_sdio_clkgen, hw);
++	unsigned long base_rate = clk_get_rate(clkgen->base_clk);
++	u32 div;
++
++	/* What is the actual rate I can get if I request xyz */
++	if (req->rate) {
++		div = min((u32)(base_rate / req->rate), (u32)MAX_NDIV);
++		rate = base_rate / div;
++		req->rate = rate;
++		dev_dbg(clkgen->dev, "determine_rate %lu: %lu / %d = %lu\n",
++			req->rate, base_rate, div, rate);
++	} else {
++		rate = 0;
++		dev_dbg(clkgen->dev, "determine_rate %lu: %lu\n", req->rate,
++			rate);
++	}
++
++	return 0;
++}
++
++static const struct clk_ops rp1_sdio_clk_ops = {
++	.is_prepared    = rp1_sdio_clk_is_prepared,
++	.recalc_rate    = rp1_sdio_clk_get_rate,
++	.set_rate       = rp1_sdio_clk_set_rate,
++	.determine_rate = rp1_sdio_clk_determine_rate,
++};
++
++static int rp1_sdio_clk_probe(struct platform_device *pdev)
++{
++	struct device_node *node = pdev->dev.of_node;
++	struct rp1_sdio_clkgen *clkgen;
++	void __iomem *regs;
++	struct clk_init_data init = {};
++	int ret;
++
++	clkgen = devm_kzalloc(&pdev->dev, sizeof(*clkgen), GFP_KERNEL);
++	if (!clkgen)
++		return -ENOMEM;
++	platform_set_drvdata(pdev, clkgen);
++
++	clkgen->dev = &pdev->dev;
++
++	/* Source freq */
++	clkgen->src_clk = devm_clk_get(&pdev->dev, "src");
++	if (IS_ERR(clkgen->src_clk)) {
++		int err = PTR_ERR(clkgen->src_clk);
++
++		dev_err(&pdev->dev, "failed to get src clk: %d\n", err);
++		return err;
++	}
++
++	/* Desired maximum output freq (i.e. base freq) */
++	clkgen->base_clk = devm_clk_get(&pdev->dev, "base");
++	if (IS_ERR(clkgen->base_clk)) {
++		int err = PTR_ERR(clkgen->base_clk);
++
++		dev_err(&pdev->dev, "failed to get base clk: %d\n", err);
++		return err;
++	}
++
++	regs = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(regs))
++		return PTR_ERR(regs);
++
++	init.name = node->name;
++	init.ops = &rp1_sdio_clk_ops;
++	init.flags = CLK_GET_RATE_NOCACHE;
++
++	clkgen->hw.init = &init;
++	clkgen->regs = regs;
++
++	dev_info(&pdev->dev, "loaded %s\n", init.name);
++
++	ret = devm_clk_hw_register(&pdev->dev, &clkgen->hw);
++	if (ret)
++		return ret;
++
++	ret = of_clk_add_hw_provider(node, of_clk_hw_simple_get, &clkgen->hw);
++	if (ret)
++		return ret;
++
++	ret = rp1_sdio_clk_init(clkgen);
++	return ret;
++}
++
++static void rp1_sdio_clk_remove(struct platform_device *pdev)
++{
++}
++
++static const struct of_device_id rp1_sdio_clk_dt_ids[] = {
++	{ .compatible = "raspberrypi,rp1-sdio-clk", },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, rp1_sdio_clk_dt_ids);
++
++static struct platform_driver rp1_sdio_clk_driver = {
++	.probe	= rp1_sdio_clk_probe,
++	.remove	= rp1_sdio_clk_remove,
++	.driver	= {
++		.name		= "rp1-sdio-clk",
++		.of_match_table	= rp1_sdio_clk_dt_ids,
++	},
++};
++module_platform_driver(rp1_sdio_clk_driver);
++
++MODULE_AUTHOR("Liam Fraser <liam@raspberrypi.com>");
++MODULE_DESCRIPTION("RP1 SDIO clock driver");
++MODULE_LICENSE("GPL");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0362-i2c-designware-Add-SMBUS-quick-command-support.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0362-i2c-designware-Add-SMBUS-quick-command-support.patch
new file mode 100644
index 00000000..7c78cd12
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0362-i2c-designware-Add-SMBUS-quick-command-support.patch
@@ -0,0 +1,75 @@
+From 8fe88419936121f1c34358e34849ae7e4c6ea0cc Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 4 Dec 2020 15:20:36 +0000
+Subject: [PATCH 362/697] i2c: designware: Add SMBUS quick command support
+
+The SMBUS emulation code turns an SMBUS quick command into a zero-
+length read. This controller can't do zero length accesses, but it
+can do quick commands, so reverse the emulation. The alternative
+would be to properly implement the SMBUS support but that is a lot
+more work, and unnecessary just to get i2cdetect working.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/i2c/busses/i2c-designware-core.h   |  2 ++
+ drivers/i2c/busses/i2c-designware-master.c | 17 +++++++++++++++--
+ 2 files changed, 17 insertions(+), 2 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-designware-core.h
++++ b/drivers/i2c/busses/i2c-designware-core.h
+@@ -123,7 +123,9 @@
+ 
+ #define DW_IC_ERR_TX_ABRT			0x1
+ 
++#define DW_IC_TAR_SPECIAL			BIT(11)
+ #define DW_IC_TAR_10BITADDR_MASTER		BIT(12)
++#define DW_IC_TAR_SMBUS_QUICK_CMD		BIT(16)
+ 
+ #define DW_IC_COMP_PARAM_1_SPEED_MODE_HIGH	(BIT(2) | BIT(3))
+ #define DW_IC_COMP_PARAM_1_SPEED_MODE_MASK	GENMASK(3, 2)
+--- a/drivers/i2c/busses/i2c-designware-master.c
++++ b/drivers/i2c/busses/i2c-designware-master.c
+@@ -247,6 +247,10 @@ static void i2c_dw_xfer_init(struct dw_i
+ 		ic_tar = DW_IC_TAR_10BITADDR_MASTER;
+ 	}
+ 
++	/* Convert a zero-length read into an SMBUS quick command */
++	if (!msgs[dev->msg_write_idx].len)
++		ic_tar = DW_IC_TAR_SPECIAL | DW_IC_TAR_SMBUS_QUICK_CMD;
++
+ 	regmap_update_bits(dev->map, DW_IC_CON, DW_IC_CON_10BITADDR_MASTER,
+ 			   ic_con);
+ 
+@@ -455,6 +459,14 @@ i2c_dw_xfer_msg(struct dw_i2c_dev *dev)
+ 		regmap_read(dev->map, DW_IC_RXFLR, &flr);
+ 		rx_limit = dev->rx_fifo_depth - flr;
+ 
++		/* Handle SMBUS quick commands */
++		if (!buf_len) {
++			if (msgs[dev->msg_write_idx].flags & I2C_M_RD)
++				regmap_write(dev->map, DW_IC_DATA_CMD, 0x300);
++			else
++				regmap_write(dev->map, DW_IC_DATA_CMD, 0x200);
++		}
++
+ 		while (buf_len > 0 && tx_limit > 0 && rx_limit > 0) {
+ 			u32 cmd = 0;
+ 
+@@ -893,14 +905,15 @@ static const struct i2c_algorithm i2c_dw
+ };
+ 
+ static const struct i2c_adapter_quirks i2c_dw_quirks = {
+-	.flags = I2C_AQ_NO_ZERO_LEN,
++	.flags = 0,
+ };
+ 
+ void i2c_dw_configure_master(struct dw_i2c_dev *dev)
+ {
+ 	struct i2c_timings *t = &dev->timings;
+ 
+-	dev->functionality = I2C_FUNC_10BIT_ADDR | DW_IC_DEFAULT_FUNCTIONALITY;
++	dev->functionality = I2C_FUNC_10BIT_ADDR | I2C_FUNC_SMBUS_QUICK |
++			     DW_IC_DEFAULT_FUNCTIONALITY;
+ 
+ 	dev->master_cfg = DW_IC_CON_MASTER | DW_IC_CON_SLAVE_DISABLE |
+ 			  DW_IC_CON_RESTART_EN;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0363-dmaengine-dw-axi-dmac-Fixes-for-RP1.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0363-dmaengine-dw-axi-dmac-Fixes-for-RP1.patch
new file mode 100644
index 00000000..7ca0c4ab
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0363-dmaengine-dw-axi-dmac-Fixes-for-RP1.patch
@@ -0,0 +1,341 @@
+From 612942d207f957dacffc4bd36dc47b7ad9dfefb0 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 28 Apr 2021 17:46:01 +0100
+Subject: [PATCH 363/697] dmaengine: dw-axi-dmac: Fixes for RP1
+
+Don't assume that DMA addresses of devices are the same as their
+physical addresses - convert correctly.
+
+The CFG2 register layout is used when there are more than 8 channels,
+but also when configured for more than 16 target peripheral devices
+because the index of the handshake signal has to be made wider.
+
+Reset the DMAC on probe
+
+The driver goes to the trouble of tracking when transfers have been
+paused, but then doesn't report that state when queried.
+
+Not having APB registers is not an error - for most use cases it's
+not even of interest, it's expected. Demote the message to debug level,
+which is disabled by default.
+
+Each channel has a descriptor pool, which is shared between transfers.
+It is unsafe to treat the total number of descriptors allocated from a
+pool as the number allocated to a specific transfer; doing so leads
+to releasing buffers that shouldn't be released and walking off the
+ends of descriptor lists. Instead, give each transfer descriptor its
+own count.
+
+Support partial transfers:
+Some use cases involve streaming from a device where the transfer only
+proceeds when the device's FIFO occupancy exceeds a certain threshold.
+In such cases (e.g. when pulling data from a UART) it is important to
+know how much data has been transferred so far, in order that remaining
+bytes can be read from the FIFO directly by software.
+
+Add the necessary code to provide this "residue" value with a finer,
+sub-transfer granularity.
+
+In order to prevent the occasional byte getting stuck in the DMA
+controller's internal buffers, restrict the destination memory width
+to the source register width.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+dmaengine: dw-axi-dmac: Fix a non-atomic update
+
+dw_axi_dma_interrupt disables interrupts for the duration of the channel
+handling. It does so by clearing a bit in the DMA_CFG register - an
+action that involves a read-modify-write. That in itself would be safe
+because there will be no further interrupts, hence no reentrancy, were
+it the only bit of code accessing that register.
+
+The only neighbour of INT_EN is DMAC_EN - the main enable for the block.
+That's not the sort of thing you would expect to be modified during the
+normal course of operation, but bizarrely it is set at the start of the
+transfer of every block, in axi_chan_block_xfer_star, by a call to
+axi_dma_enable. This can lead to INT_EN being accidentally cleared,
+which causes all DMA transfers to time out.
+
+One might think that the enabling was being delayed until the first
+transfer, but the probe function calls axi_dma_resume which in turn
+calls axi_dma_enable, so that isn't the case.
+
+Fix the atomicity problem by removing the spurious call to
+axi_dma_enable.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ .../dma/dw-axi-dmac/dw-axi-dmac-platform.c    | 132 +++++++++++++++---
+ 1 file changed, 111 insertions(+), 21 deletions(-)
+
+--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
++++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+@@ -12,6 +12,7 @@
+ #include <linux/device.h>
+ #include <linux/dmaengine.h>
+ #include <linux/dmapool.h>
++#include <linux/dma-direct.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/err.h>
+ #include <linux/interrupt.h>
+@@ -95,6 +96,17 @@ axi_chan_iowrite64(struct axi_dma_chan *
+ 	iowrite32(upper_32_bits(val), chan->chan_regs + reg + 4);
+ }
+ 
++static inline u64
++axi_chan_ioread64(struct axi_dma_chan *chan, u32 reg)
++{
++	/*
++	 * We split one 64 bit read into two 32 bit reads as some HW doesn't
++	 * support 64 bit access.
++	 */
++	return ((u64)ioread32(chan->chan_regs + reg + 4) << 32) +
++		ioread32(chan->chan_regs + reg);
++}
++
+ static inline void axi_chan_config_write(struct axi_dma_chan *chan,
+ 					 struct axi_dma_chan_config *config)
+ {
+@@ -266,7 +278,18 @@ static void axi_dma_hw_init(struct axi_d
+ {
+ 	int ret;
+ 	u32 i;
++	int retries = 1000;
+ 
++	axi_dma_iowrite32(chip, DMAC_RESET, 1);
++	while (axi_dma_ioread32(chip, DMAC_RESET)) {
++		retries--;
++		if (!retries) {
++			dev_err(chip->dev, "%s: DMAC failed to reset\n",
++				__func__);
++			return;
++		}
++		cpu_relax();
++	}
+ 	for (i = 0; i < chip->dw->hdata->nr_channels; i++) {
+ 		axi_chan_irq_disable(&chip->dw->chan[i], DWAXIDMAC_IRQ_ALL);
+ 		axi_chan_disable(&chip->dw->chan[i]);
+@@ -351,6 +374,48 @@ static void vchan_desc_put(struct virt_d
+ 	axi_desc_put(vd_to_axi_desc(vdesc));
+ }
+ 
++static u32 axi_dma_desc_src_pos(struct axi_dma_desc *desc, dma_addr_t addr)
++{
++	unsigned int idx = 0;
++	u32 pos = 0;
++
++	while (pos < desc->length) {
++		struct axi_dma_hw_desc *hw_desc = &desc->hw_desc[idx++];
++		u32 len = hw_desc->len;
++		dma_addr_t start = le64_to_cpu(hw_desc->lli->sar);
++
++		if (addr >= start && addr <= (start + len)) {
++			pos += addr - start;
++			break;
++		}
++
++		pos += len;
++	}
++
++	return pos;
++}
++
++static u32 axi_dma_desc_dst_pos(struct axi_dma_desc *desc, dma_addr_t addr)
++{
++	unsigned int idx = 0;
++	u32 pos = 0;
++
++	while (pos < desc->length) {
++		struct axi_dma_hw_desc *hw_desc = &desc->hw_desc[idx++];
++		u32 len = hw_desc->len;
++		dma_addr_t start = le64_to_cpu(hw_desc->lli->dar);
++
++		if (addr >= start && addr <= (start + len)) {
++			pos += addr - start;
++			break;
++		}
++
++		pos += len;
++	}
++
++	return pos;
++}
++
+ static enum dma_status
+ dma_chan_tx_status(struct dma_chan *dchan, dma_cookie_t cookie,
+ 		  struct dma_tx_state *txstate)
+@@ -360,10 +425,7 @@ dma_chan_tx_status(struct dma_chan *dcha
+ 	enum dma_status status;
+ 	u32 completed_length;
+ 	unsigned long flags;
+-	u32 completed_blocks;
+ 	size_t bytes = 0;
+-	u32 length;
+-	u32 len;
+ 
+ 	status = dma_cookie_status(dchan, cookie, txstate);
+ 	if (status == DMA_COMPLETE || !txstate)
+@@ -372,16 +434,31 @@ dma_chan_tx_status(struct dma_chan *dcha
+ 	spin_lock_irqsave(&chan->vc.lock, flags);
+ 
+ 	vdesc = vchan_find_desc(&chan->vc, cookie);
+-	if (vdesc) {
+-		length = vd_to_axi_desc(vdesc)->length;
+-		completed_blocks = vd_to_axi_desc(vdesc)->completed_blocks;
+-		len = vd_to_axi_desc(vdesc)->hw_desc[0].len;
+-		completed_length = completed_blocks * len;
+-		bytes = length - completed_length;
++	if (vdesc && vdesc == vchan_next_desc(&chan->vc)) {
++		/* This descriptor is in-progress */
++		struct axi_dma_desc *desc = vd_to_axi_desc(vdesc);
++		dma_addr_t addr;
++
++		if (chan->direction == DMA_MEM_TO_DEV) {
++			addr = axi_chan_ioread64(chan, CH_SAR);
++			completed_length = axi_dma_desc_src_pos(desc, addr);
++		} else if (chan->direction == DMA_DEV_TO_MEM) {
++			addr = axi_chan_ioread64(chan, CH_DAR);
++			completed_length = axi_dma_desc_dst_pos(desc, addr);
++		} else {
++			completed_length = 0;
++		}
++		bytes = desc->length - completed_length;
++	} else if (vdesc) {
++		/* Still in the queue so not started */
++		bytes = vd_to_axi_desc(vdesc)->length;
+ 	}
+ 
+-	spin_unlock_irqrestore(&chan->vc.lock, flags);
++	if (chan->is_paused && status == DMA_IN_PROGRESS)
++		status = DMA_PAUSED;
++
+ 	dma_set_residue(txstate, bytes);
++	spin_unlock_irqrestore(&chan->vc.lock, flags);
+ 
+ 	return status;
+ }
+@@ -435,8 +512,6 @@ static void axi_chan_block_xfer_start(st
+ 		return;
+ 	}
+ 
+-	axi_dma_enable(chan->chip);
+-
+ 	config.dst_multblk_type = DWAXIDMAC_MBLK_TYPE_LL;
+ 	config.src_multblk_type = DWAXIDMAC_MBLK_TYPE_LL;
+ 	config.tt_fc = DWAXIDMAC_TT_FC_MEM_TO_MEM_DMAC;
+@@ -569,7 +644,7 @@ static void dw_axi_dma_set_hw_channel(st
+ 	unsigned long reg_value, val;
+ 
+ 	if (!chip->apb_regs) {
+-		dev_err(chip->dev, "apb_regs not initialized\n");
++		dev_dbg(chip->dev, "apb_regs not initialized\n");
+ 		return;
+ 	}
+ 
+@@ -673,18 +748,25 @@ static int dw_axi_dma_set_hw_desc(struct
+ 	switch (chan->direction) {
+ 	case DMA_MEM_TO_DEV:
+ 		reg_width = __ffs(chan->config.dst_addr_width);
+-		device_addr = chan->config.dst_addr;
++		device_addr = phys_to_dma(chan->chip->dev, chan->config.dst_addr);
+ 		ctllo = reg_width << CH_CTL_L_DST_WIDTH_POS |
+ 			mem_width << CH_CTL_L_SRC_WIDTH_POS |
++			DWAXIDMAC_BURST_TRANS_LEN_1 << CH_CTL_L_DST_MSIZE_POS |
++			DWAXIDMAC_BURST_TRANS_LEN_4 << CH_CTL_L_SRC_MSIZE_POS |
+ 			DWAXIDMAC_CH_CTL_L_NOINC << CH_CTL_L_DST_INC_POS |
+ 			DWAXIDMAC_CH_CTL_L_INC << CH_CTL_L_SRC_INC_POS;
+ 		block_ts = len >> mem_width;
+ 		break;
+ 	case DMA_DEV_TO_MEM:
+ 		reg_width = __ffs(chan->config.src_addr_width);
+-		device_addr = chan->config.src_addr;
++		/* Prevent partial access units getting lost */
++		if (mem_width > reg_width)
++			mem_width = reg_width;
++		device_addr = phys_to_dma(chan->chip->dev, chan->config.src_addr);
+ 		ctllo = reg_width << CH_CTL_L_SRC_WIDTH_POS |
+ 			mem_width << CH_CTL_L_DST_WIDTH_POS |
++			DWAXIDMAC_BURST_TRANS_LEN_4 << CH_CTL_L_DST_MSIZE_POS |
++			DWAXIDMAC_BURST_TRANS_LEN_1 << CH_CTL_L_SRC_MSIZE_POS |
+ 			DWAXIDMAC_CH_CTL_L_INC << CH_CTL_L_DST_INC_POS |
+ 			DWAXIDMAC_CH_CTL_L_NOINC << CH_CTL_L_SRC_INC_POS;
+ 		block_ts = len >> reg_width;
+@@ -720,9 +802,6 @@ static int dw_axi_dma_set_hw_desc(struct
+ 	}
+ 
+ 	hw_desc->lli->block_ts_lo = cpu_to_le32(block_ts - 1);
+-
+-	ctllo |= DWAXIDMAC_BURST_TRANS_LEN_4 << CH_CTL_L_DST_MSIZE_POS |
+-		 DWAXIDMAC_BURST_TRANS_LEN_4 << CH_CTL_L_SRC_MSIZE_POS;
+ 	hw_desc->lli->ctl_lo = cpu_to_le32(ctllo);
+ 
+ 	set_desc_src_master(hw_desc);
+@@ -817,6 +896,8 @@ dw_axi_dma_chan_prep_cyclic(struct dma_c
+ 		src_addr += segment_len;
+ 	}
+ 
++	desc->nr_hw_descs = total_segments;
++
+ 	llp = desc->hw_desc[0].llp;
+ 
+ 	/* Managed transfer list */
+@@ -896,6 +977,8 @@ dw_axi_dma_chan_prep_slave_sg(struct dma
+ 		} while (len >= segment_len);
+ 	}
+ 
++	desc->nr_hw_descs = loop;
++
+ 	/* Set end-of-link to the last link descriptor of list */
+ 	set_desc_last(&desc->hw_desc[num_sgs - 1]);
+ 
+@@ -1003,6 +1086,8 @@ dma_chan_prep_dma_memcpy(struct dma_chan
+ 		num++;
+ 	}
+ 
++	desc->nr_hw_descs = num;
++
+ 	/* Set end-of-link to the last link descriptor of list */
+ 	set_desc_last(&desc->hw_desc[num - 1]);
+ 	/* Managed transfer list */
+@@ -1051,7 +1136,7 @@ static void axi_chan_dump_lli(struct axi
+ static void axi_chan_list_dump_lli(struct axi_dma_chan *chan,
+ 				   struct axi_dma_desc *desc_head)
+ {
+-	int count = atomic_read(&chan->descs_allocated);
++	int count = desc_head->nr_hw_descs;
+ 	int i;
+ 
+ 	for (i = 0; i < count; i++)
+@@ -1094,11 +1179,11 @@ out:
+ 
+ static void axi_chan_block_xfer_complete(struct axi_dma_chan *chan)
+ {
+-	int count = atomic_read(&chan->descs_allocated);
+ 	struct axi_dma_hw_desc *hw_desc;
+ 	struct axi_dma_desc *desc;
+ 	struct virt_dma_desc *vd;
+ 	unsigned long flags;
++	int count;
+ 	u64 llp;
+ 	int i;
+ 
+@@ -1120,6 +1205,7 @@ static void axi_chan_block_xfer_complete
+ 	if (chan->cyclic) {
+ 		desc = vd_to_axi_desc(vd);
+ 		if (desc) {
++			count = desc->nr_hw_descs;
+ 			llp = lo_hi_readq(chan->chan_regs + CH_LLP);
+ 			for (i = 0; i < count; i++) {
+ 				hw_desc = &desc->hw_desc[i];
+@@ -1397,6 +1483,10 @@ static int parse_device_properties(struc
+ 
+ 	chip->dw->hdata->nr_masters = tmp;
+ 
++	ret = device_property_read_u32(dev, "snps,dma-targets", &tmp);
++	if (!ret && tmp > 16)
++		chip->dw->hdata->use_cfg2 = true;
++
+ 	ret = device_property_read_u32(dev, "snps,data-width", &tmp);
+ 	if (ret)
+ 		return ret;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0364-spi-dw-Handle-combined-tx-and-rx-messages.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0364-spi-dw-Handle-combined-tx-and-rx-messages.patch
new file mode 100644
index 00000000..fe0925c3
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0364-spi-dw-Handle-combined-tx-and-rx-messages.patch
@@ -0,0 +1,64 @@
+From 2d7cd8e834e753c86b5a06f31a77beb72f797402 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 29 Nov 2022 10:09:54 +0000
+Subject: [PATCH 364/697] spi: dw: Handle combined tx and rx messages
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/spi/spi-dw-core.c | 12 +++++++++---
+ drivers/spi/spi-dw-mmio.c |  8 ++++++--
+ 2 files changed, 15 insertions(+), 5 deletions(-)
+
+--- a/drivers/spi/spi-dw-core.c
++++ b/drivers/spi/spi-dw-core.c
+@@ -241,8 +241,11 @@ static irqreturn_t dw_spi_transfer_handl
+ 	 */
+ 	if (irq_status & DW_SPI_INT_TXEI) {
+ 		dw_writer(dws);
+-		if (!dws->tx_len)
++		if (!dws->tx_len) {
+ 			dw_spi_mask_intr(dws, DW_SPI_INT_TXEI);
++			if (!dws->rx_len)
++				spi_finalize_current_transfer(dws->host);
++		}
+ 	}
+ 
+ 	return IRQ_HANDLED;
+@@ -369,8 +372,11 @@ static void dw_spi_irq_setup(struct dw_s
+ 
+ 	dws->transfer_handler = dw_spi_transfer_handler;
+ 
+-	imask = DW_SPI_INT_TXEI | DW_SPI_INT_TXOI |
+-		DW_SPI_INT_RXUI | DW_SPI_INT_RXOI | DW_SPI_INT_RXFI;
++	imask = 0;
++	if (dws->tx_len)
++		imask |= DW_SPI_INT_TXEI | DW_SPI_INT_TXOI;
++	if (dws->rx_len)
++		imask |= DW_SPI_INT_RXUI | DW_SPI_INT_RXOI | DW_SPI_INT_RXFI;
+ 	dw_spi_umask_intr(dws, imask);
+ }
+ 
+--- a/drivers/spi/spi-dw-mmio.c
++++ b/drivers/spi/spi-dw-mmio.c
+@@ -20,6 +20,7 @@
+ #include <linux/property.h>
+ #include <linux/regmap.h>
+ #include <linux/reset.h>
++#include <linux/interrupt.h>
+ 
+ #include "spi-dw.h"
+ 
+@@ -341,8 +342,11 @@ static int dw_spi_mmio_probe(struct plat
+ 	dws->paddr = mem->start;
+ 
+ 	dws->irq = platform_get_irq(pdev, 0);
+-	if (dws->irq < 0)
+-		return dws->irq; /* -ENXIO */
++	if (dws->irq < 0) {
++		if (dws->irq != -ENXIO)
++			return dws->irq; /* -ENXIO */
++		dws->irq = IRQ_NOTCONNECTED;
++	}
+ 
+ 	dwsmmio->clk = devm_clk_get_enabled(&pdev->dev, NULL);
+ 	if (IS_ERR(dwsmmio->clk))
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0365-pwm-Add-support-for-RP1-PWM.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0365-pwm-Add-support-for-RP1-PWM.patch
new file mode 100644
index 00000000..1828ca58
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0365-pwm-Add-support-for-RP1-PWM.patch
@@ -0,0 +1,275 @@
+From 6c99a4b55b504bdcc6767de9190da643b548ae58 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 14 Feb 2023 14:03:54 +0000
+Subject: [PATCH 365/697] pwm: Add support for RP1 PWM
+
+Add a driver for the RP1 PWM block.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ .../devicetree/bindings/pwm/pwm-rp1.yaml      |  38 ++++
+ drivers/pwm/Kconfig                           |   9 +
+ drivers/pwm/Makefile                          |   1 +
+ drivers/pwm/pwm-rp1.c                         | 186 ++++++++++++++++++
+ 4 files changed, 234 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/pwm/pwm-rp1.yaml
+ create mode 100644 drivers/pwm/pwm-rp1.c
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/pwm/pwm-rp1.yaml
+@@ -0,0 +1,38 @@
++# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/pwm/pwm-rp1.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Raspberry Pi RP1 PWM controller
++
++maintainers:
++  - Naushir Patuck <naush@raspberrypi.com>
++
++properties:
++  compatible:
++    enum:
++      - raspberrypi,rp1-pwm
++
++  reg:
++    maxItems: 1
++
++  "#pwm-cells":
++    const: 3
++
++required:
++  - compatible
++  - reg
++  - clocks
++  - "#pwm-cells"
++
++additionalProperties: false
++
++examples:
++  - |
++    pwm0: pwm@98000 {
++      compatible = "raspberrypi,rp1-pwm";
++      reg = <0x0 0x98000  0x0 0x100>;
++      clocks = <&rp1_sys>;
++      #pwm-cells = <3>;
++    };
+--- a/drivers/pwm/Kconfig
++++ b/drivers/pwm/Kconfig
+@@ -510,6 +510,15 @@ config PWM_RASPBERRYPI_POE
+ 	  Enable Raspberry Pi firmware controller PWM bus used to control the
+ 	  official RPI PoE hat
+ 
++config PWM_RP1
++	tristate "RP1 PWM support"
++	depends on ARCH_BCM2835 || COMPILE_TEST
++	help
++	  PWM framework driver for Raspberry Pi RP1 controller
++
++	  To compile this driver as a module, choose M here: the module
++	  will be called pwm-rp1.
++
+ config PWM_RCAR
+ 	tristate "Renesas R-Car PWM support"
+ 	depends on ARCH_RENESAS || COMPILE_TEST
+--- a/drivers/pwm/Makefile
++++ b/drivers/pwm/Makefile
+@@ -46,6 +46,7 @@ obj-$(CONFIG_PWM_OMAP_DMTIMER)	+= pwm-om
+ obj-$(CONFIG_PWM_PCA9685)	+= pwm-pca9685.o
+ obj-$(CONFIG_PWM_PXA)		+= pwm-pxa.o
+ obj-$(CONFIG_PWM_RASPBERRYPI_POE)	+= pwm-raspberrypi-poe.o
++obj-$(CONFIG_PWM_RP1)		+= pwm-rp1.o
+ obj-$(CONFIG_PWM_RCAR)		+= pwm-rcar.o
+ obj-$(CONFIG_PWM_RENESAS_TPU)	+= pwm-renesas-tpu.o
+ obj-$(CONFIG_PWM_ROCKCHIP)	+= pwm-rockchip.o
+--- /dev/null
++++ b/drivers/pwm/pwm-rp1.c
+@@ -0,0 +1,186 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * pwm-rp1.c
++ *
++ * Raspberry Pi RP1 PWM.
++ *
++ * Copyright © 2023 Raspberry Pi Ltd.
++ *
++ * Author: Naushir Patuck (naush@raspberrypi.com)
++ *
++ * Based on the pwm-bcm2835 driver by:
++ * Bart Tanghe <bart.tanghe@thomasmore.be>
++ */
++
++#include <linux/bitops.h>
++#include <linux/clk.h>
++#include <linux/err.h>
++#include <linux/io.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/pwm.h>
++
++#define PWM_GLOBAL_CTRL		0x000
++#define PWM_CHANNEL_CTRL(x)	(0x014 + ((x) * 16))
++#define PWM_RANGE(x)		(0x018 + ((x) * 16))
++#define PWM_DUTY(x)		(0x020 + ((x) * 16))
++
++/* 8:FIFO_POP_MASK + 0:Trailing edge M/S modulation */
++#define PWM_CHANNEL_DEFAULT	(BIT(8) + BIT(0))
++#define PWM_CHANNEL_ENABLE(x)	BIT(x)
++#define PWM_POLARITY		BIT(3)
++#define SET_UPDATE		BIT(31)
++#define PWM_MODE_MASK		GENMASK(1, 0)
++
++struct rp1_pwm {
++	void __iomem *base;
++	struct clk *clk;
++};
++
++static inline struct rp1_pwm *to_rp1_pwm(struct pwm_chip *chip)
++{
++	return pwmchip_get_drvdata(chip);
++}
++
++static void rp1_pwm_apply_config(struct pwm_chip *chip, struct pwm_device *pwm)
++{
++	struct rp1_pwm *pc = to_rp1_pwm(chip);
++	u32 value;
++
++	value = readl(pc->base + PWM_GLOBAL_CTRL);
++	value |= SET_UPDATE;
++	writel(value, pc->base + PWM_GLOBAL_CTRL);
++}
++
++static int rp1_pwm_request(struct pwm_chip *chip, struct pwm_device *pwm)
++{
++	struct rp1_pwm *pc = to_rp1_pwm(chip);
++
++	writel(PWM_CHANNEL_DEFAULT, pc->base + PWM_CHANNEL_CTRL(pwm->hwpwm));
++	return 0;
++}
++
++static void rp1_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm)
++{
++	struct rp1_pwm *pc = to_rp1_pwm(chip);
++	u32 value;
++
++	value = readl(pc->base + PWM_CHANNEL_CTRL(pwm->hwpwm));
++	value &= ~PWM_MODE_MASK;
++	writel(value, pc->base + PWM_CHANNEL_CTRL(pwm->hwpwm));
++	rp1_pwm_apply_config(chip, pwm);
++}
++
++static int rp1_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
++			 const struct pwm_state *state)
++{
++	struct rp1_pwm *pc = to_rp1_pwm(chip);
++	unsigned long clk_rate = clk_get_rate(pc->clk);
++	unsigned long clk_period;
++	u32 value;
++
++	if (!clk_rate) {
++		dev_err(&chip->dev, "failed to get clock rate\n");
++		return -EINVAL;
++	}
++
++	/* set period */
++	clk_period = DIV_ROUND_CLOSEST(NSEC_PER_SEC, clk_rate);
++
++	writel(DIV_ROUND_CLOSEST(state->duty_cycle, clk_period),
++	       pc->base + PWM_DUTY(pwm->hwpwm));
++
++	/* set duty cycle */
++	writel(DIV_ROUND_CLOSEST(state->period, clk_period),
++	       pc->base + PWM_RANGE(pwm->hwpwm));
++
++	/* set polarity */
++	value = readl(pc->base + PWM_CHANNEL_CTRL(pwm->hwpwm));
++	if (state->polarity == PWM_POLARITY_NORMAL)
++		value &= ~PWM_POLARITY;
++	else
++		value |= PWM_POLARITY;
++	writel(value, pc->base + PWM_CHANNEL_CTRL(pwm->hwpwm));
++
++	/* enable/disable */
++	value = readl(pc->base + PWM_GLOBAL_CTRL);
++	if (state->enabled)
++		value |= PWM_CHANNEL_ENABLE(pwm->hwpwm);
++	else
++		value &= ~PWM_CHANNEL_ENABLE(pwm->hwpwm);
++	writel(value, pc->base + PWM_GLOBAL_CTRL);
++
++	rp1_pwm_apply_config(chip, pwm);
++
++	return 0;
++}
++
++static const struct pwm_ops rp1_pwm_ops = {
++	.request = rp1_pwm_request,
++	.free = rp1_pwm_free,
++	.apply = rp1_pwm_apply,
++};
++
++static int rp1_pwm_probe(struct platform_device *pdev)
++{
++	struct pwm_chip *chip;
++	struct rp1_pwm *pc;
++	int ret;
++
++	chip = devm_pwmchip_alloc(&pdev->dev, 4, sizeof(*pc));
++
++	if (IS_ERR(chip))
++		return PTR_ERR(chip);
++
++	pc = to_rp1_pwm(chip);
++
++	pc->base = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(pc->base))
++		return PTR_ERR(pc->base);
++
++	pc->clk = devm_clk_get_enabled(&pdev->dev, NULL);
++	if (IS_ERR(pc->clk))
++		return dev_err_probe(&pdev->dev, PTR_ERR(pc->clk),
++				     "clock not found\n");
++
++	chip->ops = &rp1_pwm_ops;
++	chip->of_xlate = of_pwm_xlate_with_flags;
++
++	ret = devm_pwmchip_add(&pdev->dev, chip);
++	if (ret < 0)
++		goto add_fail;
++
++	return 0;
++
++add_fail:
++	clk_disable_unprepare(pc->clk);
++	return ret;
++}
++
++static void rp1_pwm_remove(struct platform_device *pdev)
++{
++	struct rp1_pwm *pc = platform_get_drvdata(pdev);
++
++	clk_disable_unprepare(pc->clk);
++}
++
++static const struct of_device_id rp1_pwm_of_match[] = {
++	{ .compatible = "raspberrypi,rp1-pwm" },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, rp1_pwm_of_match);
++
++static struct platform_driver rp1_pwm_driver = {
++	.driver = {
++		.name = "rpi-pwm",
++		.of_match_table = rp1_pwm_of_match,
++	},
++	.probe = rp1_pwm_probe,
++	.remove = rp1_pwm_remove,
++};
++module_platform_driver(rp1_pwm_driver);
++
++MODULE_AUTHOR("Naushir Patuck <naush@raspberrypi.com");
++MODULE_DESCRIPTION("RP1 PWM driver");
++MODULE_LICENSE("GPL");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0366-drm-Add-RP1-DSI-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0366-drm-Add-RP1-DSI-driver.patch
new file mode 100644
index 00000000..8ca2a892
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0366-drm-Add-RP1-DSI-driver.patch
@@ -0,0 +1,2861 @@
+From e7b7c00003e510fd760febbdd4a2c1992164c9be Mon Sep 17 00:00:00 2001
+From: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+Date: Tue, 14 Feb 2023 14:58:33 +0000
+Subject: [PATCH 366/697] drm: Add RP1 DSI driver
+
+Add support for the RP1 DSI hardware.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+
+drm/rp1: depends on, instead of select, MFD_RP1
+
+According to kconfig-language.txt [1], select should be used only for
+"non-visible symbols ... and for symbols with no dependencies". Since
+MFD_RP1 both is visible and has a dependency, "select" should not be
+used and "depends on" should be used instead.
+
+In particular, this fixes the build of this kernel tree on NixOS, where
+its kernel config system will try to answer 'M' to as many config as
+possible.
+
+[1] https://www.kernel.org/doc/html/latest/kbuild/kconfig-language.html
+
+Signed-off-by: Ratchanan Srirattanamet <peathot@hotmail.com>
+
+DRM: rp1: rp1-dsi: Fix escape clock divider and timeouts.
+
+Escape clock divider was fixed at 5, which is correct at 800Mbps/lane
+but increasingly out of spec for higher rates. Compute it correctly.
+
+High speed timeout was fixed at 5*512 == 2560 byte-clocks per lane.
+Compute it conservatively to be 8/7 times the line period (assuming
+there will be a transition to LP some time during each scanline?)
+keeping the old value as a lower bound. Increase LPRX TO to 1024,
+and BTA TO to 0xb00 (same value as in bridge/synopsys/dw-mipi-dsi).
+
+(No change to LP_CMD_TIM. To do: compute this correctly.)
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+
+drm: rp1: rp1-dsi: Switch to PLL_SYS source for DPI when 8 * lanes > bpp
+
+To support 4 lanes, re-parent DPI clock source between DSI byteclock
+(using the new "variable sources" defined in clk-rp1) and PLL_SYS.
+This is to cover cases in which byteclock < pixclock <= 200MHz.
+
+Tidying: All frequencies now in Hz (not kHz), where DSI speed is now
+represented by byteclock to simplify arithmetic. Clamp DPI and byte
+clocks to their legal ranges; fix up HSTX timeout to avoid an unsafe
+assumption that it would return to LP state for every scanline.
+
+Because of RP1's clock topology, the ratio between DSI and DPI clocks
+may not be exact with 3 or 4 lanes, leading to slightly irregular
+timings each time DSI switches between HS and LP states. Tweak to
+inhibit LP during Horizontal BP when sync pulses were requested.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+
+drm: rp1: rp1-dsi: Add DRM_FORMAT_ARGB8888 and DRM_FORMAT_ABGR8888
+
+Android requires this.
+As the underlying hardware doesn't support alpha blending,
+we ignore the alpha value.
+
+Signed-off-by: Jan Kehren <jan.kehren@emteria.com>
+
+drivers: drm: rp1-dsi: Implement more DSI options and flags
+
+Now implementing:
+- Per-command selection of LP or HS for commands (previously LP)
+- EoTp transmission option (previously EoTp was always disabled)
+- Non-continuous clock option (previously always continuous)
+- Per-command enabling of ACK request (in command mode only)
+
+Make a plausible (and possibly correct) attempt to measure the
+longest LP command that will fit into vertical blanking lines.
+
+DON'T set both "Burst Mode" and "Sync Events" flags together.
+This is redundant in the standard IP; in this RP1 variant it
+would enable Sync Pulses but may break with some video timings.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+---
+ drivers/gpu/drm/Kconfig                   |    2 +
+ drivers/gpu/drm/Makefile                  |    1 +
+ drivers/gpu/drm/rp1/Kconfig               |    5 +
+ drivers/gpu/drm/rp1/Makefile              |    4 +
+ drivers/gpu/drm/rp1/rp1-dsi/Kconfig       |   14 +
+ drivers/gpu/drm/rp1/rp1-dsi/Makefile      |    5 +
+ drivers/gpu/drm/rp1/rp1-dsi/rp1_dsi.c     |  540 +++++++
+ drivers/gpu/drm/rp1/rp1-dsi/rp1_dsi.h     |   96 ++
+ drivers/gpu/drm/rp1/rp1-dsi/rp1_dsi_dma.c |  455 ++++++
+ drivers/gpu/drm/rp1/rp1-dsi/rp1_dsi_dsi.c | 1598 +++++++++++++++++++++
+ 10 files changed, 2720 insertions(+)
+ create mode 100644 drivers/gpu/drm/rp1/Kconfig
+ create mode 100644 drivers/gpu/drm/rp1/Makefile
+ create mode 100644 drivers/gpu/drm/rp1/rp1-dsi/Kconfig
+ create mode 100644 drivers/gpu/drm/rp1/rp1-dsi/Makefile
+ create mode 100644 drivers/gpu/drm/rp1/rp1-dsi/rp1_dsi.c
+ create mode 100644 drivers/gpu/drm/rp1/rp1-dsi/rp1_dsi.h
+ create mode 100644 drivers/gpu/drm/rp1/rp1-dsi/rp1_dsi_dma.c
+ create mode 100644 drivers/gpu/drm/rp1/rp1-dsi/rp1_dsi_dsi.c
+
+--- a/drivers/gpu/drm/Kconfig
++++ b/drivers/gpu/drm/Kconfig
+@@ -424,6 +424,8 @@ source "drivers/gpu/drm/v3d/Kconfig"
+ 
+ source "drivers/gpu/drm/vc4/Kconfig"
+ 
++source "drivers/gpu/drm/rp1/Kconfig"
++
+ source "drivers/gpu/drm/loongson/Kconfig"
+ 
+ source "drivers/gpu/drm/etnaviv/Kconfig"
+--- a/drivers/gpu/drm/Makefile
++++ b/drivers/gpu/drm/Makefile
+@@ -219,3 +219,4 @@ obj-y			+= solomon/
+ obj-$(CONFIG_DRM_SPRD) += sprd/
+ obj-$(CONFIG_DRM_LOONGSON) += loongson/
+ obj-$(CONFIG_DRM_POWERVR) += imagination/
++obj-y			+= rp1/
+--- /dev/null
++++ b/drivers/gpu/drm/rp1/Kconfig
+@@ -0,0 +1,5 @@
++source "drivers/gpu/drm/rp1/rp1-dsi/Kconfig"
++
++source "drivers/gpu/drm/rp1/rp1-dpi/Kconfig"
++
++source "drivers/gpu/drm/rp1/rp1-vec/Kconfig"
+--- /dev/null
++++ b/drivers/gpu/drm/rp1/Makefile
+@@ -0,0 +1,4 @@
++obj-$(CONFIG_DRM_RP1_DSI) += rp1-dsi/
++obj-$(CONFIG_DRM_RP1_DPI) += rp1-dpi/
++obj-$(CONFIG_DRM_RP1_VEC) += rp1-vec/
++
+--- /dev/null
++++ b/drivers/gpu/drm/rp1/rp1-dsi/Kconfig
+@@ -0,0 +1,14 @@
++# SPDX-License-Identifier: GPL-2.0-only
++config DRM_RP1_DSI
++	tristate "DRM Support for RP1 DSI"
++	depends on DRM && MFD_RP1
++	select DRM_GEM_DMA_HELPER
++	select DRM_KMS_HELPER
++	select DRM_MIPI_DSI
++	select DRM_VRAM_HELPER
++	select DRM_TTM
++	select DRM_TTM_HELPER
++	select GENERIC_PHY
++	select GENERIC_PHY_MIPI_DPHY
++	help
++	  Choose this option to enable DSI display on RP1
+--- /dev/null
++++ b/drivers/gpu/drm/rp1/rp1-dsi/Makefile
+@@ -0,0 +1,5 @@
++# SPDX-License-Identifier: GPL-2.0-only
++
++drm-rp1-dsi-y := rp1_dsi.o rp1_dsi_dma.o rp1_dsi_dsi.o
++
++obj-$(CONFIG_DRM_RP1_DSI) += drm-rp1-dsi.o
+--- /dev/null
++++ b/drivers/gpu/drm/rp1/rp1-dsi/rp1_dsi.c
+@@ -0,0 +1,540 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * DRM Driver for DSI output on Raspberry Pi RP1
++ *
++ * Copyright (c) 2023 Raspberry Pi Limited.
++ */
++
++#include <linux/clk.h>
++#include <linux/component.h>
++#include <linux/delay.h>
++#include <linux/dma-mapping.h>
++#include <linux/errno.h>
++#include <linux/init.h>
++#include <linux/interrupt.h>
++#include <linux/io.h>
++#include <linux/list.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/phy/phy-mipi-dphy.h>
++#include <linux/string.h>
++
++#include <drm/drm_atomic_helper.h>
++#include <drm/drm_crtc.h>
++#include <drm/drm_crtc_helper.h>
++#include <drm/drm_drv.h>
++#include <drm/drm_encoder.h>
++#include <drm/drm_fourcc.h>
++#include <drm/drm_fb_helper.h>
++#include <drm/drm_fbdev_ttm.h>
++#include <drm/drm_framebuffer.h>
++#include <drm/drm_gem.h>
++#include <drm/drm_gem_atomic_helper.h>
++#include <drm/drm_gem_dma_helper.h>
++#include <drm/drm_gem_framebuffer_helper.h>
++#include <drm/drm_managed.h>
++#include <drm/drm_modeset_helper_vtables.h>
++#include <drm/drm_of.h>
++#include <drm/drm_print.h>
++#include <drm/drm_probe_helper.h>
++#include <drm/drm_simple_kms_helper.h>
++#include <drm/drm_vblank.h>
++
++#include "rp1_dsi.h"
++
++static inline struct rp1_dsi *
++bridge_to_rp1_dsi(struct drm_bridge *bridge)
++{
++	return container_of(bridge, struct rp1_dsi, bridge);
++}
++
++static void rp1_dsi_bridge_pre_enable(struct drm_bridge *bridge,
++				      struct drm_bridge_state *old_state)
++{
++	struct rp1_dsi *dsi = bridge_to_rp1_dsi(bridge);
++
++	rp1dsi_dsi_setup(dsi, &dsi->pipe.crtc.state->adjusted_mode);
++	dsi->dsi_running = true;
++}
++
++static void rp1_dsi_bridge_enable(struct drm_bridge *bridge,
++				  struct drm_bridge_state *old_state)
++{
++}
++
++static void rp1_dsi_bridge_disable(struct drm_bridge *bridge,
++				   struct drm_bridge_state *state)
++{
++}
++
++static void rp1_dsi_bridge_post_disable(struct drm_bridge *bridge,
++					struct drm_bridge_state *state)
++{
++	struct rp1_dsi *dsi = bridge_to_rp1_dsi(bridge);
++
++	if (dsi->dsi_running) {
++		rp1dsi_dsi_stop(dsi);
++		dsi->dsi_running = false;
++	}
++}
++
++static int rp1_dsi_bridge_attach(struct drm_bridge *bridge,
++				 enum drm_bridge_attach_flags flags)
++{
++	struct rp1_dsi *dsi = bridge_to_rp1_dsi(bridge);
++
++	/* Attach the panel or bridge to the dsi bridge */
++	return drm_bridge_attach(bridge->encoder, dsi->out_bridge,
++				 &dsi->bridge, flags);
++	return 0;
++}
++
++static const struct drm_bridge_funcs rp1_dsi_bridge_funcs = {
++	.atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state,
++	.atomic_destroy_state = drm_atomic_helper_bridge_destroy_state,
++	.atomic_reset = drm_atomic_helper_bridge_reset,
++	.atomic_pre_enable = rp1_dsi_bridge_pre_enable,
++	.atomic_enable = rp1_dsi_bridge_enable,
++	.atomic_disable = rp1_dsi_bridge_disable,
++	.atomic_post_disable = rp1_dsi_bridge_post_disable,
++	.attach = rp1_dsi_bridge_attach,
++};
++
++static void rp1dsi_pipe_update(struct drm_simple_display_pipe *pipe,
++			       struct drm_plane_state *old_state)
++{
++	struct drm_pending_vblank_event *event;
++	unsigned long flags;
++	struct drm_framebuffer *fb = pipe->plane.state->fb;
++	struct rp1_dsi *dsi = pipe->crtc.dev->dev_private;
++	struct drm_gem_object *gem = fb ? drm_gem_fb_get_obj(fb, 0) : NULL;
++	struct drm_gem_dma_object *dma_obj = gem ? to_drm_gem_dma_obj(gem) : NULL;
++	bool can_update = fb && dma_obj && dsi && dsi->pipe_enabled;
++
++	/* (Re-)start DSI,DMA where required; and update FB address */
++	if (can_update) {
++		if (!dsi->dma_running || fb->format->format != dsi->cur_fmt) {
++			if (dsi->dma_running && fb->format->format != dsi->cur_fmt) {
++				rp1dsi_dma_stop(dsi);
++				dsi->dma_running = false;
++			}
++			if (!dsi->dma_running) {
++				rp1dsi_dma_setup(dsi,
++						 fb->format->format, dsi->display_format,
++						&pipe->crtc.state->adjusted_mode);
++				dsi->dma_running = true;
++			}
++			dsi->cur_fmt  = fb->format->format;
++			drm_crtc_vblank_on(&pipe->crtc);
++		}
++		rp1dsi_dma_update(dsi, dma_obj->dma_addr, fb->offsets[0], fb->pitches[0]);
++	}
++
++	/* Arm VBLANK event (or call it immediately in some error cases) */
++	spin_lock_irqsave(&pipe->crtc.dev->event_lock, flags);
++	event = pipe->crtc.state->event;
++	if (event) {
++		pipe->crtc.state->event = NULL;
++		if (can_update && drm_crtc_vblank_get(&pipe->crtc) == 0)
++			drm_crtc_arm_vblank_event(&pipe->crtc, event);
++		else
++			drm_crtc_send_vblank_event(&pipe->crtc, event);
++	}
++	spin_unlock_irqrestore(&pipe->crtc.dev->event_lock, flags);
++}
++
++static inline struct rp1_dsi *
++encoder_to_rp1_dsi(struct drm_encoder *encoder)
++{
++	struct drm_simple_display_pipe *pipe =
++		container_of(encoder, struct drm_simple_display_pipe, encoder);
++	return container_of(pipe, struct rp1_dsi, pipe);
++}
++
++static void rp1dsi_encoder_enable(struct drm_encoder *encoder)
++{
++	struct rp1_dsi *dsi = encoder_to_rp1_dsi(encoder);
++
++	/* Put DSI into video mode before starting video */
++	rp1dsi_dsi_set_cmdmode(dsi, 0);
++
++	/* Start DMA -> DPI */
++	dsi->pipe_enabled = true;
++	dsi->cur_fmt = 0xdeadbeef;
++	rp1dsi_pipe_update(&dsi->pipe, 0);
++}
++
++static void rp1dsi_encoder_disable(struct drm_encoder *encoder)
++{
++	struct rp1_dsi *dsi = encoder_to_rp1_dsi(encoder);
++
++	drm_crtc_vblank_off(&dsi->pipe.crtc);
++	if (dsi->dma_running) {
++		rp1dsi_dma_stop(dsi);
++		dsi->dma_running = false;
++	}
++	dsi->pipe_enabled = false;
++
++	/* Return to command mode after stopping video */
++	rp1dsi_dsi_set_cmdmode(dsi, 1);
++}
++
++static const struct drm_encoder_helper_funcs rp1_dsi_encoder_funcs = {
++	.enable = rp1dsi_encoder_enable,
++	.disable = rp1dsi_encoder_disable,
++};
++
++static void rp1dsi_pipe_enable(struct drm_simple_display_pipe *pipe,
++			       struct drm_crtc_state *crtc_state,
++			       struct drm_plane_state *plane_state)
++{
++}
++
++static void rp1dsi_pipe_disable(struct drm_simple_display_pipe *pipe)
++{
++}
++
++static int rp1dsi_pipe_enable_vblank(struct drm_simple_display_pipe *pipe)
++{
++	struct rp1_dsi *dsi = pipe->crtc.dev->dev_private;
++
++	if (dsi)
++		rp1dsi_dma_vblank_ctrl(dsi, 1);
++
++	return 0;
++}
++
++static void rp1dsi_pipe_disable_vblank(struct drm_simple_display_pipe *pipe)
++{
++	struct rp1_dsi *dsi = pipe->crtc.dev->dev_private;
++
++	if (dsi)
++		rp1dsi_dma_vblank_ctrl(dsi, 0);
++}
++
++static const struct drm_simple_display_pipe_funcs rp1dsi_pipe_funcs = {
++	.enable	    = rp1dsi_pipe_enable,
++	.update	    = rp1dsi_pipe_update,
++	.disable    = rp1dsi_pipe_disable,
++	.enable_vblank  = rp1dsi_pipe_enable_vblank,
++	.disable_vblank = rp1dsi_pipe_disable_vblank,
++};
++
++static const struct drm_mode_config_funcs rp1dsi_mode_funcs = {
++	.fb_create = drm_gem_fb_create,
++	.atomic_check = drm_atomic_helper_check,
++	.atomic_commit = drm_atomic_helper_commit,
++};
++
++static const u32 rp1dsi_formats[] = {
++	DRM_FORMAT_XRGB8888,
++	DRM_FORMAT_XBGR8888,
++	DRM_FORMAT_ARGB8888,
++	DRM_FORMAT_ABGR8888,
++	DRM_FORMAT_RGB888,
++	DRM_FORMAT_BGR888,
++	DRM_FORMAT_RGB565
++};
++
++static void rp1dsi_stopall(struct drm_device *drm)
++{
++	if (drm->dev_private) {
++		struct rp1_dsi *dsi = drm->dev_private;
++
++		if (dsi->dma_running || rp1dsi_dma_busy(dsi)) {
++			rp1dsi_dma_stop(dsi);
++			dsi->dma_running = false;
++		}
++		if (dsi->dsi_running) {
++			rp1dsi_dsi_stop(dsi);
++			dsi->dsi_running = false;
++		}
++		if (dsi->clocks[RP1DSI_CLOCK_CFG])
++			clk_disable_unprepare(dsi->clocks[RP1DSI_CLOCK_CFG]);
++	}
++}
++
++DEFINE_DRM_GEM_DMA_FOPS(rp1dsi_fops);
++
++static struct drm_driver rp1dsi_driver = {
++	.driver_features	= DRIVER_GEM | DRIVER_MODESET | DRIVER_ATOMIC,
++	.fops			= &rp1dsi_fops,
++	.name			= "drm-rp1-dsi",
++	.desc			= "drm-rp1-dsi",
++	.date			= "0",
++	.major			= 1,
++	.minor			= 0,
++	DRM_GEM_DMA_DRIVER_OPS,
++	.release		= rp1dsi_stopall,
++};
++
++static int rp1dsi_bind(struct rp1_dsi *dsi)
++{
++	struct platform_device *pdev = dsi->pdev;
++	struct drm_device *drm = dsi->drm;
++	int ret;
++
++	dsi->out_bridge = drmm_of_get_bridge(drm, pdev->dev.of_node, 0, 0);
++	if (IS_ERR(dsi->out_bridge))
++		return PTR_ERR(dsi->out_bridge);
++
++	ret = drmm_mode_config_init(drm);
++	if (ret)
++		goto rtn;
++
++	drm->mode_config.max_width  = 4096;
++	drm->mode_config.max_height = 4096;
++	drm->mode_config.preferred_depth = 32;
++	drm->mode_config.prefer_shadow	 = 0;
++	drm->mode_config.quirk_addfb_prefer_host_byte_order = true;
++	drm->mode_config.funcs = &rp1dsi_mode_funcs;
++	drm_vblank_init(drm, 1);
++
++	ret = drm_simple_display_pipe_init(drm,
++					   &dsi->pipe,
++					   &rp1dsi_pipe_funcs,
++					   rp1dsi_formats,
++					   ARRAY_SIZE(rp1dsi_formats),
++					   NULL, NULL);
++	if (ret)
++		goto rtn;
++
++	/* We need slightly more complex encoder handling (enabling/disabling
++	 * video mode), so add encoder helper functions.
++	 */
++	drm_encoder_helper_add(&dsi->pipe.encoder, &rp1_dsi_encoder_funcs);
++
++	ret = drm_simple_display_pipe_attach_bridge(&dsi->pipe, &dsi->bridge);
++	if (ret)
++		goto rtn;
++
++	drm_bridge_add(&dsi->bridge);
++
++	drm_mode_config_reset(drm);
++
++	if (dsi->clocks[RP1DSI_CLOCK_CFG])
++		clk_prepare_enable(dsi->clocks[RP1DSI_CLOCK_CFG]);
++
++	ret = drm_dev_register(drm, 0);
++
++	if (ret == 0)
++		drm_fbdev_ttm_setup(drm, 32);
++
++rtn:
++	if (ret)
++		dev_err(&pdev->dev, "%s returned %d\n", __func__, ret);
++	else
++		dev_info(&pdev->dev, "%s succeeded", __func__);
++
++	return ret;
++}
++
++static void rp1dsi_unbind(struct rp1_dsi *dsi)
++{
++	struct drm_device *drm = dsi->drm;
++
++	rp1dsi_stopall(drm);
++	drm_dev_unregister(drm);
++	drm_atomic_helper_shutdown(drm);
++}
++
++static int rp1dsi_host_attach(struct mipi_dsi_host *host, struct mipi_dsi_device *dsi_dev)
++{
++	struct rp1_dsi *dsi = container_of(host, struct rp1_dsi, dsi_host);
++
++	dev_info(&dsi->pdev->dev, "%s: Attach DSI device name=%s channel=%d lanes=%d format=%d flags=0x%lx hs_rate=%lu lp_rate=%lu",
++		 __func__, dsi_dev->name, dsi_dev->channel, dsi_dev->lanes,
++		 dsi_dev->format, dsi_dev->mode_flags, dsi_dev->hs_rate,
++		 dsi_dev->lp_rate);
++	dsi->vc              = dsi_dev->channel & 3;
++	dsi->lanes           = dsi_dev->lanes;
++
++	switch (dsi_dev->format) {
++	case MIPI_DSI_FMT_RGB666:
++	case MIPI_DSI_FMT_RGB666_PACKED:
++	case MIPI_DSI_FMT_RGB565:
++	case MIPI_DSI_FMT_RGB888:
++		break;
++	default:
++		return -EINVAL;
++	}
++	dsi->display_format  = dsi_dev->format;
++	dsi->display_flags   = dsi_dev->mode_flags;
++	dsi->display_hs_rate = dsi_dev->hs_rate;
++	dsi->display_lp_rate = dsi_dev->lp_rate;
++
++	/*
++	 * Previously, we added a separate component to handle panel/bridge
++	 * discovery and DRM registration, but now it's just a function call.
++	 * The downstream/attaching device should deal with -EPROBE_DEFER
++	 */
++	return rp1dsi_bind(dsi);
++}
++
++static int rp1dsi_host_detach(struct mipi_dsi_host *host, struct mipi_dsi_device *dsi_dev)
++{
++	struct rp1_dsi *dsi = container_of(host, struct rp1_dsi, dsi_host);
++
++	/*
++	 * Unregister the DRM driver.
++	 * TODO: Check we are cleaning up correctly and not doing things multiple times!
++	 */
++	rp1dsi_unbind(dsi);
++	return 0;
++}
++
++static ssize_t rp1dsi_host_transfer(struct mipi_dsi_host *host, const struct mipi_dsi_msg *msg)
++{
++	struct rp1_dsi *dsi = container_of(host, struct rp1_dsi, dsi_host);
++	struct mipi_dsi_packet packet;
++	int ret = 0;
++
++	/* Write */
++	ret = mipi_dsi_create_packet(&packet, msg);
++	if (ret) {
++		dev_err(dsi->drm->dev, "RP1DSI: failed to create packet: %d\n", ret);
++		return ret;
++	}
++
++	rp1dsi_dsi_send(dsi, *(u32 *)(&packet.header),
++			packet.payload_length, packet.payload,
++			!!(msg->flags & MIPI_DSI_MSG_USE_LPM),
++			!!(msg->flags & MIPI_DSI_MSG_REQ_ACK));
++
++	/* Optional read back */
++	if (msg->rx_len && msg->rx_buf)
++		ret = rp1dsi_dsi_recv(dsi, msg->rx_len, msg->rx_buf);
++
++	return (ssize_t)ret;
++}
++
++static const struct mipi_dsi_host_ops rp1dsi_mipi_dsi_host_ops = {
++	.attach = rp1dsi_host_attach,
++	.detach = rp1dsi_host_detach,
++	.transfer = rp1dsi_host_transfer
++};
++
++static int rp1dsi_platform_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct drm_device *drm;
++	struct rp1_dsi *dsi;
++	int i, ret;
++
++	drm = drm_dev_alloc(&rp1dsi_driver, dev);
++	if (IS_ERR(drm)) {
++		ret = PTR_ERR(drm);
++		return ret;
++	}
++	dsi = drmm_kzalloc(drm, sizeof(*dsi), GFP_KERNEL);
++	if (!dsi) {
++		ret = -ENOMEM;
++		goto err_free_drm;
++	}
++	init_completion(&dsi->finished);
++	dsi->drm = drm;
++	dsi->pdev = pdev;
++	drm->dev_private = dsi;
++	platform_set_drvdata(pdev, drm);
++
++	dsi->bridge.funcs = &rp1_dsi_bridge_funcs;
++	dsi->bridge.of_node = dev->of_node;
++	dsi->bridge.type = DRM_MODE_CONNECTOR_DSI;
++
++	/* Safe default values for DSI mode */
++	dsi->lanes = 1;
++	dsi->display_format = MIPI_DSI_FMT_RGB888;
++	dsi->display_flags  = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_LPM;
++
++	/* Hardware resources */
++	for (i = 0; i < RP1DSI_NUM_CLOCKS; i++) {
++		static const char * const myclocknames[RP1DSI_NUM_CLOCKS] = {
++			"cfgclk", "dpiclk", "byteclk", "refclk", "pllsys"
++		};
++		dsi->clocks[i] = devm_clk_get(dev, myclocknames[i]);
++		if (IS_ERR(dsi->clocks[i])) {
++			ret = PTR_ERR(dsi->clocks[i]);
++			dev_err(dev, "Error getting clocks[%d]\n", i);
++			goto err_free_drm;
++		}
++	}
++
++	for (i = 0; i < RP1DSI_NUM_HW_BLOCKS; i++) {
++		dsi->hw_base[i] =
++			devm_ioremap_resource(dev,
++					      platform_get_resource(dsi->pdev,
++								    IORESOURCE_MEM,
++								    i));
++		if (IS_ERR(dsi->hw_base[i])) {
++			ret = PTR_ERR(dsi->hw_base[i]);
++			dev_err(dev, "Error memory mapping regs[%d]\n", i);
++			goto err_free_drm;
++		}
++	}
++	ret = platform_get_irq(dsi->pdev, 0);
++	if (ret > 0)
++		ret = devm_request_irq(dev, ret, rp1dsi_dma_isr,
++				       IRQF_SHARED, "rp1-dsi", dsi);
++	if (ret) {
++		dev_err(dev, "Unable to request interrupt\n");
++		ret = -EINVAL;
++		goto err_free_drm;
++	}
++	rp1dsi_mipicfg_setup(dsi);
++	dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64));
++
++	/* Create the MIPI DSI Host and wait for the panel/bridge to attach to it */
++	dsi->dsi_host.ops = &rp1dsi_mipi_dsi_host_ops;
++	dsi->dsi_host.dev = dev;
++	ret = mipi_dsi_host_register(&dsi->dsi_host);
++	if (ret)
++		goto err_free_drm;
++
++	return ret;
++
++err_free_drm:
++	dev_err(dev, "%s fail %d\n", __func__, ret);
++	drm_dev_put(drm);
++	return ret;
++}
++
++static void rp1dsi_platform_remove(struct platform_device *pdev)
++{
++	struct drm_device *drm = platform_get_drvdata(pdev);
++	struct rp1_dsi *dsi = drm->dev_private;
++
++	mipi_dsi_host_unregister(&dsi->dsi_host);
++}
++
++static void rp1dsi_platform_shutdown(struct platform_device *pdev)
++{
++	struct drm_device *drm = platform_get_drvdata(pdev);
++
++	rp1dsi_stopall(drm);
++}
++
++static const struct of_device_id rp1dsi_of_match[] = {
++	{
++		.compatible = "raspberrypi,rp1dsi",
++	},
++	{ /* sentinel */ },
++};
++
++MODULE_DEVICE_TABLE(of, rp1dsi_of_match);
++
++static struct platform_driver rp1dsi_platform_driver = {
++	.probe		= rp1dsi_platform_probe,
++	.remove		= rp1dsi_platform_remove,
++	.shutdown       = rp1dsi_platform_shutdown,
++	.driver		= {
++		.name	= DRIVER_NAME,
++		.owner  = THIS_MODULE,
++		.of_match_table = rp1dsi_of_match,
++	},
++};
++
++module_platform_driver(rp1dsi_platform_driver);
++
++MODULE_LICENSE("GPL");
++MODULE_DESCRIPTION("MIPI DSI driver for Raspberry Pi RP1");
++MODULE_AUTHOR("Nick Hollinghurst");
+--- /dev/null
++++ b/drivers/gpu/drm/rp1/rp1-dsi/rp1_dsi.h
+@@ -0,0 +1,96 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * DRM Driver for DSI output on Raspberry Pi RP1
++ *
++ * Copyright (c) 2023 Raspberry Pi Limited.
++ */
++#ifndef _RP1_DSI_H_
++#define _RP1_DSI_H_
++
++#include <linux/clk.h>
++#include <linux/io.h>
++#include <linux/types.h>
++
++#include <drm/drm_bridge.h>
++#include <drm/drm_device.h>
++#include <drm/drm_mipi_dsi.h>
++#include <drm/drm_simple_kms_helper.h>
++
++#define MODULE_NAME "drm-rp1-dsi"
++#define DRIVER_NAME "drm-rp1-dsi"
++
++/* ---------------------------------------------------------------------- */
++
++#define RP1DSI_HW_BLOCK_DMA   0
++#define RP1DSI_HW_BLOCK_DSI   1
++#define RP1DSI_HW_BLOCK_CFG   2
++#define RP1DSI_NUM_HW_BLOCKS  3
++
++#define RP1DSI_CLOCK_CFG     0
++#define RP1DSI_CLOCK_DPI     1
++#define RP1DSI_CLOCK_BYTE    2
++#define RP1DSI_CLOCK_REF     3
++#define RP1DSI_CLOCK_PLLSYS  4
++#define RP1DSI_NUM_CLOCKS    5
++
++/* ---------------------------------------------------------------------- */
++
++struct rp1_dsi {
++	/* DRM and platform device pointers */
++	struct drm_device *drm;
++	struct platform_device *pdev;
++
++	/* Framework and helper objects */
++	struct drm_simple_display_pipe pipe;
++	struct drm_bridge bridge;
++	struct drm_bridge *out_bridge;
++	struct mipi_dsi_host dsi_host;
++
++	/* Clocks. We need DPI clock; the others are frequency references */
++	struct clk *clocks[RP1DSI_NUM_CLOCKS];
++
++	/* Block (DSI DMA, DSI Host) base addresses, and current state */
++	void __iomem *hw_base[RP1DSI_NUM_HW_BLOCKS];
++	u32 cur_fmt;
++	bool dsi_running, dma_running, pipe_enabled;
++	struct completion finished;
++
++	/* Attached display parameters (from mipi_dsi_device) */
++	unsigned long display_flags, display_hs_rate, display_lp_rate;
++	enum mipi_dsi_pixel_format display_format;
++	u8 vc;
++	u8 lanes;
++
++	/* DPHY */
++	u8 hsfreq_index;
++};
++
++/* ---------------------------------------------------------------------- */
++/* Functions to control the DSI/DPI/DMA block				  */
++
++void rp1dsi_dma_setup(struct rp1_dsi *dsi,
++		      u32 in_format, enum mipi_dsi_pixel_format out_format,
++		      struct drm_display_mode const *mode);
++void rp1dsi_dma_update(struct rp1_dsi *dsi, dma_addr_t addr, u32 offset, u32 stride);
++void rp1dsi_dma_stop(struct rp1_dsi *dsi);
++int rp1dsi_dma_busy(struct rp1_dsi *dsi);
++irqreturn_t rp1dsi_dma_isr(int irq, void *dev);
++void rp1dsi_dma_vblank_ctrl(struct rp1_dsi *dsi, int enable);
++
++/* ---------------------------------------------------------------------- */
++/* Functions to control the MIPICFG block and check RP1 platform		  */
++
++void rp1dsi_mipicfg_setup(struct rp1_dsi *dsi);
++
++/* ---------------------------------------------------------------------- */
++/* Functions to control the SNPS D-PHY and DSI block setup		  */
++
++void rp1dsi_dsi_setup(struct rp1_dsi *dsi, struct drm_display_mode const *mode);
++void rp1dsi_dsi_send(struct rp1_dsi *dsi, u32 header, int len, const u8 *buf,
++		bool use_lpm, bool req_ack);
++int  rp1dsi_dsi_recv(struct rp1_dsi *dsi, int len, u8 *buf);
++void rp1dsi_dsi_set_cmdmode(struct rp1_dsi *dsi, int cmd_mode);
++void rp1dsi_dsi_stop(struct rp1_dsi *dsi);
++
++#endif
++
+--- /dev/null
++++ b/drivers/gpu/drm/rp1/rp1-dsi/rp1_dsi_dma.c
+@@ -0,0 +1,455 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * DRM Driver for DSI output on Raspberry Pi RP1
++ *
++ * Copyright (c) 2023 Raspberry Pi Limited.
++ */
++
++#include <linux/interrupt.h>
++#include <linux/platform_device.h>
++
++#include <drm/drm_fourcc.h>
++#include <drm/drm_print.h>
++#include <drm/drm_vblank.h>
++
++#include "rp1_dsi.h"
++
++// --- DPI DMA REGISTERS (derived from Argon firmware, via RP1 drivers/mipi, with corrections) ---
++
++// Control
++#define DPI_DMA_CONTROL				      0x0
++#define DPI_DMA_CONTROL_ARM_SHIFT		      0
++#define DPI_DMA_CONTROL_ARM_MASK		      BIT(DPI_DMA_CONTROL_ARM_SHIFT)
++#define DPI_DMA_CONTROL_ALIGN16_SHIFT		      2
++#define DPI_DMA_CONTROL_ALIGN16_MASK		      BIT(DPI_DMA_CONTROL_ALIGN16_SHIFT)
++#define DPI_DMA_CONTROL_AUTO_REPEAT_SHIFT	      1
++#define DPI_DMA_CONTROL_AUTO_REPEAT_MASK	      BIT(DPI_DMA_CONTROL_AUTO_REPEAT_SHIFT)
++#define DPI_DMA_CONTROL_HIGH_WATER_SHIFT	      3
++#define DPI_DMA_CONTROL_HIGH_WATER_MASK		      (0x1FF << DPI_DMA_CONTROL_HIGH_WATER_SHIFT)
++#define DPI_DMA_CONTROL_DEN_POL_SHIFT		      12
++#define DPI_DMA_CONTROL_DEN_POL_MASK		      BIT(DPI_DMA_CONTROL_DEN_POL_SHIFT)
++#define DPI_DMA_CONTROL_HSYNC_POL_SHIFT		      13
++#define DPI_DMA_CONTROL_HSYNC_POL_MASK		      BIT(DPI_DMA_CONTROL_HSYNC_POL_SHIFT)
++#define DPI_DMA_CONTROL_VSYNC_POL_SHIFT		      14
++#define DPI_DMA_CONTROL_VSYNC_POL_MASK		      BIT(DPI_DMA_CONTROL_VSYNC_POL_SHIFT)
++#define DPI_DMA_CONTROL_COLORM_SHIFT		      15
++#define DPI_DMA_CONTROL_COLORM_MASK		      BIT(DPI_DMA_CONTROL_COLORM_SHIFT)
++#define DPI_DMA_CONTROL_SHUTDN_SHIFT		      16
++#define DPI_DMA_CONTROL_SHUTDN_MASK		      BIT(DPI_DMA_CONTROL_SHUTDN_SHIFT)
++#define DPI_DMA_CONTROL_HBP_EN_SHIFT		      17
++#define DPI_DMA_CONTROL_HBP_EN_MASK		      BIT(DPI_DMA_CONTROL_HBP_EN_SHIFT)
++#define DPI_DMA_CONTROL_HFP_EN_SHIFT		      18
++#define DPI_DMA_CONTROL_HFP_EN_MASK		      BIT(DPI_DMA_CONTROL_HFP_EN_SHIFT)
++#define DPI_DMA_CONTROL_VBP_EN_SHIFT		      19
++#define DPI_DMA_CONTROL_VBP_EN_MASK		      BIT(DPI_DMA_CONTROL_VBP_EN_SHIFT)
++#define DPI_DMA_CONTROL_VFP_EN_SHIFT		      20
++#define DPI_DMA_CONTROL_VFP_EN_MASK		      BIT(DPI_DMA_CONTROL_VFP_EN_SHIFT)
++#define DPI_DMA_CONTROL_HSYNC_EN_SHIFT		      21
++#define DPI_DMA_CONTROL_HSYNC_EN_MASK		      BIT(DPI_DMA_CONTROL_HSYNC_EN_SHIFT)
++#define DPI_DMA_CONTROL_VSYNC_EN_SHIFT		      22
++#define DPI_DMA_CONTROL_VSYNC_EN_MASK		      BIT(DPI_DMA_CONTROL_VSYNC_EN_SHIFT)
++#define DPI_DMA_CONTROL_FORCE_IMMED_SHIFT	      23
++#define DPI_DMA_CONTROL_FORCE_IMMED_MASK	      BIT(DPI_DMA_CONTROL_FORCE_IMMED_SHIFT)
++#define DPI_DMA_CONTROL_FORCE_DRAIN_SHIFT	      24
++#define DPI_DMA_CONTROL_FORCE_DRAIN_MASK	      BIT(DPI_DMA_CONTROL_FORCE_DRAIN_SHIFT)
++#define DPI_DMA_CONTROL_FORCE_EMPTY_SHIFT	      25
++#define DPI_DMA_CONTROL_FORCE_EMPTY_MASK	      BIT(DPI_DMA_CONTROL_FORCE_EMPTY_SHIFT)
++
++// IRQ_ENABLES
++#define DPI_DMA_IRQ_EN				      0x04
++#define DPI_DMA_IRQ_EN_DMA_READY_SHIFT		      0
++#define DPI_DMA_IRQ_EN_DMA_READY_MASK		      BIT(DPI_DMA_IRQ_EN_DMA_READY_SHIFT)
++#define DPI_DMA_IRQ_EN_UNDERFLOW_SHIFT		      1
++#define DPI_DMA_IRQ_EN_UNDERFLOW_MASK		      BIT(DPI_DMA_IRQ_EN_UNDERFLOW_SHIFT)
++#define DPI_DMA_IRQ_EN_FRAME_START_SHIFT	      2
++#define DPI_DMA_IRQ_EN_FRAME_START_MASK		      BIT(DPI_DMA_IRQ_EN_FRAME_START_SHIFT)
++#define DPI_DMA_IRQ_EN_AFIFO_EMPTY_SHIFT	      3
++#define DPI_DMA_IRQ_EN_AFIFO_EMPTY_MASK		      BIT(DPI_DMA_IRQ_EN_AFIFO_EMPTY_SHIFT)
++#define DPI_DMA_IRQ_EN_TE_SHIFT			      4
++#define DPI_DMA_IRQ_EN_TE_MASK			      BIT(DPI_DMA_IRQ_EN_TE_SHIFT)
++#define DPI_DMA_IRQ_EN_ERROR_SHIFT		      5
++#define DPI_DMA_IRQ_EN_ERROR_MASK		      BIT(DPI_DMA_IRQ_EN_ERROR_SHIFT)
++#define DPI_DMA_IRQ_EN_MATCH_SHIFT		      6
++#define DPI_DMA_IRQ_EN_MATCH_MASK		      BIT(DPI_DMA_IRQ_EN_MATCH_SHIFT)
++#define DPI_DMA_IRQ_EN_MATCH_LINE_SHIFT		      16
++#define DPI_DMA_IRQ_EN_MATCH_LINE_MASK		      (0xFFF << DPI_DMA_IRQ_EN_MATCH_LINE_SHIFT)
++
++// IRQ_FLAGS
++#define DPI_DMA_IRQ_FLAGS			      0x08
++#define DPI_DMA_IRQ_FLAGS_DMA_READY_SHIFT	      0
++#define DPI_DMA_IRQ_FLAGS_DMA_READY_MASK	      BIT(DPI_DMA_IRQ_FLAGS_DMA_READY_SHIFT)
++#define DPI_DMA_IRQ_FLAGS_UNDERFLOW_SHIFT	      1
++#define DPI_DMA_IRQ_FLAGS_UNDERFLOW_MASK	      BIT(DPI_DMA_IRQ_FLAGS_UNDERFLOW_SHIFT)
++#define DPI_DMA_IRQ_FLAGS_FRAME_START_SHIFT	      2
++#define DPI_DMA_IRQ_FLAGS_FRAME_START_MASK	      BIT(DPI_DMA_IRQ_FLAGS_FRAME_START_SHIFT)
++#define DPI_DMA_IRQ_FLAGS_AFIFO_EMPTY_SHIFT	      3
++#define DPI_DMA_IRQ_FLAGS_AFIFO_EMPTY_MASK	      BIT(DPI_DMA_IRQ_FLAGS_AFIFO_EMPTY_SHIFT)
++#define DPI_DMA_IRQ_FLAGS_TE_SHIFT		      4
++#define DPI_DMA_IRQ_FLAGS_TE_MASK		      BIT(DPI_DMA_IRQ_FLAGS_TE_SHIFT)
++#define DPI_DMA_IRQ_FLAGS_ERROR_SHIFT		      5
++#define DPI_DMA_IRQ_FLAGS_ERROR_MASK		      BIT(DPI_DMA_IRQ_FLAGS_ERROR_SHIFT)
++#define DPI_DMA_IRQ_FLAGS_MATCH_SHIFT		      6
++#define DPI_DMA_IRQ_FLAGS_MATCH_MASK		      BIT(DPI_DMA_IRQ_FLAGS_MATCH_SHIFT)
++
++// QOS
++#define DPI_DMA_QOS				      0xC
++#define DPI_DMA_QOS_DQOS_SHIFT			      0
++#define DPI_DMA_QOS_DQOS_MASK			      (0xF << DPI_DMA_QOS_DQOS_SHIFT)
++#define DPI_DMA_QOS_ULEV_SHIFT			      4
++#define DPI_DMA_QOS_ULEV_MASK			      (0xF << DPI_DMA_QOS_ULEV_SHIFT)
++#define DPI_DMA_QOS_UQOS_SHIFT			      8
++#define DPI_DMA_QOS_UQOS_MASK			      (0xF << DPI_DMA_QOS_UQOS_SHIFT)
++#define DPI_DMA_QOS_LLEV_SHIFT			      12
++#define DPI_DMA_QOS_LLEV_MASK			      (0xF << DPI_DMA_QOS_LLEV_SHIFT)
++#define DPI_DMA_QOS_LQOS_SHIFT			      16
++#define DPI_DMA_QOS_LQOS_MASK			      (0xF << DPI_DMA_QOS_LQOS_SHIFT)
++
++// Panics
++#define DPI_DMA_PANICS				     0x38
++#define DPI_DMA_PANICS_UPPER_COUNT_SHIFT	     0
++#define DPI_DMA_PANICS_UPPER_COUNT_MASK		     \
++				(0x0000FFFF << DPI_DMA_PANICS_UPPER_COUNT_SHIFT)
++#define DPI_DMA_PANICS_LOWER_COUNT_SHIFT	     16
++#define DPI_DMA_PANICS_LOWER_COUNT_MASK		     \
++				(0x0000FFFF << DPI_DMA_PANICS_LOWER_COUNT_SHIFT)
++
++// DMA Address Lower:
++#define DPI_DMA_DMA_ADDR_L			     0x10
++
++// DMA Address Upper:
++#define DPI_DMA_DMA_ADDR_H			     0x40
++
++// DMA stride
++#define DPI_DMA_DMA_STRIDE			     0x14
++
++// Visible Area
++#define DPI_DMA_VISIBLE_AREA			     0x18
++#define DPI_DMA_VISIBLE_AREA_ROWSM1_SHIFT     0
++#define DPI_DMA_VISIBLE_AREA_ROWSM1_MASK     (0x0FFF << DPI_DMA_VISIBLE_AREA_ROWSM1_SHIFT)
++#define DPI_DMA_VISIBLE_AREA_COLSM1_SHIFT    16
++#define DPI_DMA_VISIBLE_AREA_COLSM1_MASK     (0x0FFF << DPI_DMA_VISIBLE_AREA_COLSM1_SHIFT)
++
++// Sync width
++#define DPI_DMA_SYNC_WIDTH   0x1C
++#define DPI_DMA_SYNC_WIDTH_ROWSM1_SHIFT	 0
++#define DPI_DMA_SYNC_WIDTH_ROWSM1_MASK	 (0x0FFF << DPI_DMA_SYNC_WIDTH_ROWSM1_SHIFT)
++#define DPI_DMA_SYNC_WIDTH_COLSM1_SHIFT	 16
++#define DPI_DMA_SYNC_WIDTH_COLSM1_MASK	 (0x0FFF << DPI_DMA_SYNC_WIDTH_COLSM1_SHIFT)
++
++// Back porch
++#define DPI_DMA_BACK_PORCH   0x20
++#define DPI_DMA_BACK_PORCH_ROWSM1_SHIFT	 0
++#define DPI_DMA_BACK_PORCH_ROWSM1_MASK	 (0x0FFF << DPI_DMA_BACK_PORCH_ROWSM1_SHIFT)
++#define DPI_DMA_BACK_PORCH_COLSM1_SHIFT	 16
++#define DPI_DMA_BACK_PORCH_COLSM1_MASK	 (0x0FFF << DPI_DMA_BACK_PORCH_COLSM1_SHIFT)
++
++// Front porch
++#define DPI_DMA_FRONT_PORCH  0x24
++#define DPI_DMA_FRONT_PORCH_ROWSM1_SHIFT     0
++#define DPI_DMA_FRONT_PORCH_ROWSM1_MASK	 (0x0FFF << DPI_DMA_FRONT_PORCH_ROWSM1_SHIFT)
++#define DPI_DMA_FRONT_PORCH_COLSM1_SHIFT     16
++#define DPI_DMA_FRONT_PORCH_COLSM1_MASK	 (0x0FFF << DPI_DMA_FRONT_PORCH_COLSM1_SHIFT)
++
++// Input masks
++#define DPI_DMA_IMASK	 0x2C
++#define DPI_DMA_IMASK_R_SHIFT	 0
++#define DPI_DMA_IMASK_R_MASK	 (0x3FF << DPI_DMA_IMASK_R_SHIFT)
++#define DPI_DMA_IMASK_G_SHIFT	 10
++#define DPI_DMA_IMASK_G_MASK	 (0x3FF << DPI_DMA_IMASK_G_SHIFT)
++#define DPI_DMA_IMASK_B_SHIFT	 20
++#define DPI_DMA_IMASK_B_MASK	 (0x3FF << DPI_DMA_IMASK_B_SHIFT)
++
++// Output Masks
++#define DPI_DMA_OMASK	 0x30
++#define DPI_DMA_OMASK_R_SHIFT	 0
++#define DPI_DMA_OMASK_R_MASK	 (0x3FF << DPI_DMA_OMASK_R_SHIFT)
++#define DPI_DMA_OMASK_G_SHIFT	 10
++#define DPI_DMA_OMASK_G_MASK	 (0x3FF << DPI_DMA_OMASK_G_SHIFT)
++#define DPI_DMA_OMASK_B_SHIFT	 20
++#define DPI_DMA_OMASK_B_MASK	 (0x3FF << DPI_DMA_OMASK_B_SHIFT)
++
++// Shifts
++#define DPI_DMA_SHIFT	 0x28
++#define DPI_DMA_SHIFT_IR_SHIFT	 0
++#define DPI_DMA_SHIFT_IR_MASK	 (0x1F << DPI_DMA_SHIFT_IR_SHIFT)
++#define DPI_DMA_SHIFT_IG_SHIFT	 5
++#define DPI_DMA_SHIFT_IG_MASK	 (0x1F << DPI_DMA_SHIFT_IG_SHIFT)
++#define DPI_DMA_SHIFT_IB_SHIFT	 10
++#define DPI_DMA_SHIFT_IB_MASK	 (0x1F << DPI_DMA_SHIFT_IB_SHIFT)
++#define DPI_DMA_SHIFT_OR_SHIFT	 15
++#define DPI_DMA_SHIFT_OR_MASK	 (0x1F << DPI_DMA_SHIFT_OR_SHIFT)
++#define DPI_DMA_SHIFT_OG_SHIFT	 20
++#define DPI_DMA_SHIFT_OG_MASK	 (0x1F << DPI_DMA_SHIFT_OG_SHIFT)
++#define DPI_DMA_SHIFT_OB_SHIFT	 25
++#define DPI_DMA_SHIFT_OB_MASK	 (0x1F << DPI_DMA_SHIFT_OB_SHIFT)
++
++// Scaling
++#define DPI_DMA_RGBSZ	 0x34
++#define DPI_DMA_RGBSZ_BPP_SHIFT	 16
++#define DPI_DMA_RGBSZ_BPP_MASK	 (0x3 << DPI_DMA_RGBSZ_BPP_SHIFT)
++#define DPI_DMA_RGBSZ_R_SHIFT	 0
++#define DPI_DMA_RGBSZ_R_MASK	 (0xF << DPI_DMA_RGBSZ_R_SHIFT)
++#define DPI_DMA_RGBSZ_G_SHIFT	 4
++#define DPI_DMA_RGBSZ_G_MASK	 (0xF << DPI_DMA_RGBSZ_G_SHIFT)
++#define DPI_DMA_RGBSZ_B_SHIFT	 8
++#define DPI_DMA_RGBSZ_B_MASK	 (0xF << DPI_DMA_RGBSZ_B_SHIFT)
++
++// Status
++#define DPI_DMA_STATUS  0x3c
++
++#define BITS(field, val) (((val) << (field ## _SHIFT)) & (field ## _MASK))
++
++static unsigned int rp1dsi_dma_read(struct rp1_dsi *dsi, unsigned int reg)
++{
++	void __iomem *addr = dsi->hw_base[RP1DSI_HW_BLOCK_DMA] + reg;
++
++	return readl(addr);
++}
++
++static void rp1dsi_dma_write(struct rp1_dsi *dsi, unsigned int reg, unsigned int val)
++{
++	void __iomem *addr = dsi->hw_base[RP1DSI_HW_BLOCK_DMA] + reg;
++
++	writel(val, addr);
++}
++
++int rp1dsi_dma_busy(struct rp1_dsi *dsi)
++{
++	return (rp1dsi_dma_read(dsi, DPI_DMA_STATUS) & 0xF8F) ? 1 : 0;
++}
++
++/* Table of supported input (in-memory/DMA) pixel formats. */
++struct rp1dsi_ipixfmt {
++	u32 format; /* DRM format code                           */
++	u32 mask;   /* RGB masks (10 bits each, left justified)  */
++	u32 shift;  /* RGB MSB positions in the memory word      */
++	u32 rgbsz;  /* Shifts used for scaling; also (BPP/8-1)   */
++};
++
++#define IMASK_RGB(r, g, b)	(BITS(DPI_DMA_IMASK_R, r) | \
++				 BITS(DPI_DMA_IMASK_G, g) |  \
++				 BITS(DPI_DMA_IMASK_B, b))
++#define ISHIFT_RGB(r, g, b)	(BITS(DPI_DMA_SHIFT_IR, r) | \
++				 BITS(DPI_DMA_SHIFT_IG, g) | \
++				 BITS(DPI_DMA_SHIFT_IB, b))
++
++static const struct rp1dsi_ipixfmt my_formats[] = {
++	{
++		.format = DRM_FORMAT_XRGB8888,
++		.mask   = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
++		.shift  = ISHIFT_RGB(23, 15, 7),
++		.rgbsz  = BITS(DPI_DMA_RGBSZ_BPP, 3),
++	},
++	{
++		.format = DRM_FORMAT_XBGR8888,
++		.mask   = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
++		.shift  = ISHIFT_RGB(7, 15, 23),
++		.rgbsz  = BITS(DPI_DMA_RGBSZ_BPP, 3),
++	},
++	{
++		.format = DRM_FORMAT_ARGB8888,
++		.mask   = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
++		.shift  = ISHIFT_RGB(23, 15, 7),
++		.rgbsz  = BITS(DPI_DMA_RGBSZ_BPP, 3),
++	},
++	{
++		.format = DRM_FORMAT_ABGR8888,
++		.mask   = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
++		.shift  = ISHIFT_RGB(7, 15, 23),
++		.rgbsz  = BITS(DPI_DMA_RGBSZ_BPP, 3),
++	},
++	{
++		.format = DRM_FORMAT_RGB888,
++		.mask   = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
++		.shift  = ISHIFT_RGB(23, 15, 7),
++		.rgbsz  = BITS(DPI_DMA_RGBSZ_BPP, 2),
++	},
++	{
++		.format = DRM_FORMAT_BGR888,
++		.mask   = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
++		.shift  = ISHIFT_RGB(7, 15, 23),
++		.rgbsz  = BITS(DPI_DMA_RGBSZ_BPP, 2),
++	},
++	{
++		.format = DRM_FORMAT_RGB565,
++		.mask   = IMASK_RGB(0x3e0, 0x3f0, 0x3e0),
++		.shift  = ISHIFT_RGB(15, 10, 4),
++		.rgbsz  = BITS(DPI_DMA_RGBSZ_R, 5) | BITS(DPI_DMA_RGBSZ_G, 6) |
++			  BITS(DPI_DMA_RGBSZ_B, 5) | BITS(DPI_DMA_RGBSZ_BPP, 1),
++	}
++};
++
++/* Choose the internal on-the-bus DPI format as expected by DSI Host. */
++static u32 get_omask_oshift(enum mipi_dsi_pixel_format fmt, u32 *oshift)
++{
++	switch (fmt) {
++	case MIPI_DSI_FMT_RGB565:
++		*oshift = BITS(DPI_DMA_SHIFT_OR, 15) |
++			  BITS(DPI_DMA_SHIFT_OG, 10) |
++			  BITS(DPI_DMA_SHIFT_OB, 4);
++		return BITS(DPI_DMA_OMASK_R, 0x3e0) |
++		       BITS(DPI_DMA_OMASK_G, 0x3f0) |
++		       BITS(DPI_DMA_OMASK_B, 0x3e0);
++	case MIPI_DSI_FMT_RGB666_PACKED:
++		*oshift = BITS(DPI_DMA_SHIFT_OR, 17) |
++			  BITS(DPI_DMA_SHIFT_OG, 11) |
++			  BITS(DPI_DMA_SHIFT_OB, 5);
++		return BITS(DPI_DMA_OMASK_R, 0x3f0) |
++		       BITS(DPI_DMA_OMASK_G, 0x3f0) |
++		       BITS(DPI_DMA_OMASK_B, 0x3f0);
++	case MIPI_DSI_FMT_RGB666:
++		*oshift = BITS(DPI_DMA_SHIFT_OR, 21) |
++			  BITS(DPI_DMA_SHIFT_OG, 13) |
++			  BITS(DPI_DMA_SHIFT_OB, 5);
++		return BITS(DPI_DMA_OMASK_R, 0x3f0) |
++		       BITS(DPI_DMA_OMASK_G, 0x3f0) |
++		       BITS(DPI_DMA_OMASK_B, 0x3f0);
++	default:
++		*oshift = BITS(DPI_DMA_SHIFT_OR, 23) |
++			  BITS(DPI_DMA_SHIFT_OG, 15) |
++			  BITS(DPI_DMA_SHIFT_OB, 7);
++		return BITS(DPI_DMA_OMASK_R, 0x3fc) |
++		       BITS(DPI_DMA_OMASK_G, 0x3fc) |
++		       BITS(DPI_DMA_OMASK_B, 0x3fc);
++	}
++}
++
++void rp1dsi_dma_setup(struct rp1_dsi *dsi,
++		      u32 in_format, enum mipi_dsi_pixel_format out_format,
++		     struct drm_display_mode const *mode)
++{
++	u32 oshift;
++	int i;
++
++	/*
++	 * Configure all DSI/DPI/DMA block registers, except base address.
++	 * DMA will not actually start until a FB base address is specified
++	 * using rp1dsi_dma_update().
++	 */
++
++	rp1dsi_dma_write(dsi, DPI_DMA_VISIBLE_AREA,
++			 BITS(DPI_DMA_VISIBLE_AREA_ROWSM1, mode->vdisplay - 1) |
++			 BITS(DPI_DMA_VISIBLE_AREA_COLSM1, mode->hdisplay - 1));
++
++	rp1dsi_dma_write(dsi, DPI_DMA_SYNC_WIDTH,
++			 BITS(DPI_DMA_SYNC_WIDTH_ROWSM1, mode->vsync_end - mode->vsync_start - 1) |
++			 BITS(DPI_DMA_SYNC_WIDTH_COLSM1, mode->hsync_end - mode->hsync_start - 1));
++
++	/* In the DPIDMA registers, "back porch" time includes sync width */
++	rp1dsi_dma_write(dsi, DPI_DMA_BACK_PORCH,
++			 BITS(DPI_DMA_BACK_PORCH_ROWSM1, mode->vtotal - mode->vsync_start - 1) |
++			 BITS(DPI_DMA_BACK_PORCH_COLSM1, mode->htotal - mode->hsync_start - 1));
++
++	rp1dsi_dma_write(dsi, DPI_DMA_FRONT_PORCH,
++			 BITS(DPI_DMA_FRONT_PORCH_ROWSM1, mode->vsync_start - mode->vdisplay - 1) |
++			 BITS(DPI_DMA_FRONT_PORCH_COLSM1, mode->hsync_start - mode->hdisplay - 1));
++
++	/* Input to output pixel format conversion */
++	for (i = 0; i < ARRAY_SIZE(my_formats); ++i) {
++		if (my_formats[i].format == in_format)
++			break;
++	}
++	if (i >= ARRAY_SIZE(my_formats)) {
++		drm_err(dsi->drm, "%s: bad input format\n", __func__);
++		i = 0;
++	}
++	rp1dsi_dma_write(dsi, DPI_DMA_IMASK, my_formats[i].mask);
++	rp1dsi_dma_write(dsi, DPI_DMA_OMASK, get_omask_oshift(out_format, &oshift));
++	rp1dsi_dma_write(dsi, DPI_DMA_SHIFT, my_formats[i].shift | oshift);
++	if (out_format == MIPI_DSI_FMT_RGB888)
++		rp1dsi_dma_write(dsi, DPI_DMA_RGBSZ, my_formats[i].rgbsz);
++	else
++		rp1dsi_dma_write(dsi, DPI_DMA_RGBSZ, my_formats[i].rgbsz & DPI_DMA_RGBSZ_BPP_MASK);
++
++	rp1dsi_dma_write(dsi, DPI_DMA_QOS,
++			 BITS(DPI_DMA_QOS_DQOS, 0x0) |
++			 BITS(DPI_DMA_QOS_ULEV, 0xb) |
++			 BITS(DPI_DMA_QOS_UQOS, 0x2) |
++			 BITS(DPI_DMA_QOS_LLEV, 0x8) |
++			 BITS(DPI_DMA_QOS_LQOS, 0x7));
++
++	rp1dsi_dma_write(dsi, DPI_DMA_IRQ_FLAGS, -1);
++	rp1dsi_dma_vblank_ctrl(dsi, 1);
++
++	i = rp1dsi_dma_busy(dsi);
++	if (i)
++		drm_err(dsi->drm, "RP1DSI: Unexpectedly busy at start!");
++
++	rp1dsi_dma_write(dsi, DPI_DMA_CONTROL,
++			 BITS(DPI_DMA_CONTROL_ARM, (i == 0)) |
++			 BITS(DPI_DMA_CONTROL_AUTO_REPEAT, 1) |
++			 BITS(DPI_DMA_CONTROL_HIGH_WATER, 448) |
++			 BITS(DPI_DMA_CONTROL_DEN_POL, 0) |
++			 BITS(DPI_DMA_CONTROL_HSYNC_POL, 0) |
++			 BITS(DPI_DMA_CONTROL_VSYNC_POL, 0) |
++			 BITS(DPI_DMA_CONTROL_COLORM, 0) |
++			 BITS(DPI_DMA_CONTROL_SHUTDN, 0) |
++			 BITS(DPI_DMA_CONTROL_HBP_EN, 1) |
++			 BITS(DPI_DMA_CONTROL_HFP_EN, 1) |
++			 BITS(DPI_DMA_CONTROL_VBP_EN, 1) |
++			 BITS(DPI_DMA_CONTROL_VFP_EN, 1) |
++			 BITS(DPI_DMA_CONTROL_HSYNC_EN, 1) |
++			 BITS(DPI_DMA_CONTROL_VSYNC_EN, 1));
++}
++
++void rp1dsi_dma_update(struct rp1_dsi *dsi, dma_addr_t addr, u32 offset, u32 stride)
++{
++	/*
++	 * Update STRIDE, DMAH and DMAL only. When called after rp1dsi_dma_setup(),
++	 * DMA starts immediately; if already running, the buffer will flip at
++	 * the next vertical sync event.
++	 */
++	u64 a = addr + offset;
++
++	rp1dsi_dma_write(dsi, DPI_DMA_DMA_STRIDE, stride);
++	rp1dsi_dma_write(dsi, DPI_DMA_DMA_ADDR_H, a >> 32);
++	rp1dsi_dma_write(dsi, DPI_DMA_DMA_ADDR_L, a & 0xFFFFFFFFu);
++}
++
++void rp1dsi_dma_stop(struct rp1_dsi *dsi)
++{
++	/*
++	 * Stop DMA by turning off the Auto-Repeat flag, and wait up to 100ms for
++	 * the current and any queued frame to end. "Force drain" flags are not used,
++	 * as they seem to prevent DMA from re-starting properly; it's safer to wait.
++	 */
++	u32 ctrl;
++
++	reinit_completion(&dsi->finished);
++	ctrl = rp1dsi_dma_read(dsi, DPI_DMA_CONTROL);
++	ctrl &= ~(DPI_DMA_CONTROL_ARM_MASK | DPI_DMA_CONTROL_AUTO_REPEAT_MASK);
++	rp1dsi_dma_write(dsi, DPI_DMA_CONTROL, ctrl);
++	if (!wait_for_completion_timeout(&dsi->finished, HZ / 10))
++		drm_err(dsi->drm, "%s: timed out waiting for idle\n", __func__);
++	rp1dsi_dma_write(dsi, DPI_DMA_IRQ_EN, 0);
++}
++
++void rp1dsi_dma_vblank_ctrl(struct rp1_dsi *dsi, int enable)
++{
++	rp1dsi_dma_write(dsi, DPI_DMA_IRQ_EN,
++			 BITS(DPI_DMA_IRQ_EN_AFIFO_EMPTY, 1)      |
++			 BITS(DPI_DMA_IRQ_EN_UNDERFLOW, 1)        |
++			 BITS(DPI_DMA_IRQ_EN_DMA_READY, !!enable) |
++			 BITS(DPI_DMA_IRQ_EN_MATCH_LINE, 4095));
++}
++
++irqreturn_t rp1dsi_dma_isr(int irq, void *dev)
++{
++	struct rp1_dsi *dsi = dev;
++	u32 u = rp1dsi_dma_read(dsi, DPI_DMA_IRQ_FLAGS);
++
++	if (u) {
++		rp1dsi_dma_write(dsi, DPI_DMA_IRQ_FLAGS, u);
++		if (dsi) {
++			if (u & DPI_DMA_IRQ_FLAGS_UNDERFLOW_MASK)
++				drm_err_ratelimited(dsi->drm,
++						    "Underflow! (panics=0x%08x)\n",
++						    rp1dsi_dma_read(dsi, DPI_DMA_PANICS));
++			if (u & DPI_DMA_IRQ_FLAGS_DMA_READY_MASK)
++				drm_crtc_handle_vblank(&dsi->pipe.crtc);
++			if (u & DPI_DMA_IRQ_FLAGS_AFIFO_EMPTY_MASK)
++				complete(&dsi->finished);
++		}
++	}
++	return u ? IRQ_HANDLED : IRQ_NONE;
++}
+--- /dev/null
++++ b/drivers/gpu/drm/rp1/rp1-dsi/rp1_dsi_dsi.c
+@@ -0,0 +1,1598 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * DRM Driver for DSI output on Raspberry Pi RP1
++ *
++ * Copyright (c) 2023 Raspberry Pi Limited.
++ */
++
++#include <linux/delay.h>
++#include <linux/errno.h>
++#include <linux/math64.h>
++#include <linux/platform_device.h>
++#include <linux/rp1_platform.h>
++#include "drm/drm_print.h"
++
++#include "rp1_dsi.h"
++
++/* ------------------------------- Synopsis DSI ------------------------ */
++#define     DSI_VERSION_CFG                       0x000
++#define     DSI_PWR_UP                            0x004
++#define     DSI_CLKMGR_CFG                        0x008
++#define     DSI_DPI_VCID                          0x00C
++#define     DSI_DPI_COLOR_CODING                  0x010
++#define     DSI_DPI_CFG_POL                       0x014
++#define     DSI_DPI_LP_CMD_TIM                    0x018
++#define     DSI_DBI_VCID                          0x01C
++#define     DSI_DBI_CFG                           0x020
++#define     DSI_DBI_PARTITIONING_EN               0x024
++#define     DSI_DBI_CMDSIZE                       0x028
++#define     DSI_PCKHDL_CFG                        0x02C
++#define     DSI_GEN_VCID                          0x030
++#define     DSI_MODE_CFG                          0x034
++#define     DSI_VID_MODE_CFG                      0x038
++#define     DSI_VID_PKT_SIZE                      0x03C
++#define     DSI_VID_NUM_CHUNKS                    0x040
++#define     DSI_VID_NULL_SIZE                     0x044
++#define     DSI_VID_HSA_TIME                      0x048
++#define     DSI_VID_HBP_TIME                      0x04C
++#define     DSI_VID_HLINE_TIME                    0x050
++#define     DSI_VID_VSA_LINES                     0x054
++#define     DSI_VID_VBP_LINES                     0x058
++#define     DSI_VID_VFP_LINES                     0x05C
++#define     DSI_VID_VACTIVE_LINES                 0x060
++#define     DSI_EDPI_CMD_SIZE                     0x064
++#define     DSI_CMD_MODE_CFG                      0x068
++#define     DSI_GEN_HDR                           0x06C
++#define     DSI_GEN_PLD_DATA                      0x070
++#define     DSI_CMD_PKT_STATUS                    0x074
++#define     DSI_TO_CNT_CFG                        0x078
++#define     DSI_HS_RD_TO_CNT                      0x07C
++#define     DSI_LP_RD_TO_CNT                      0x080
++#define     DSI_HS_WR_TO_CNT                      0x084
++#define     DSI_LP_WR_TO_CNT                      0x088
++#define     DSI_BTA_TO_CNT                        0x08C
++#define     DSI_SDF_3D                            0x090
++#define     DSI_LPCLK_CTRL                        0x094
++#define     DSI_PHY_TMR_LPCLK_CFG                 0x098
++#define     DSI_PHY_TMR_HS2LP_LSB       16
++#define     DSI_PHY_TMR_LP2HS_LSB       0
++#define     DSI_PHY_TMR_CFG                       0x09C
++#define     DSI_PHY_TMR_RD_CFG                    0x0F4
++#define     DSI_PHYRSTZ                           0x0A0
++#define     DSI_PHY_IF_CFG                        0x0A4
++#define     DSI_PHY_ULPS_CTRL                     0x0A8
++#define     DSI_PHY_TX_TRIGGERS                   0x0AC
++#define     DSI_PHY_STATUS                        0x0B0
++
++#define     DSI_PHY_TST_CTRL0                     0x0B4
++#define     DSI_PHY_TST_CTRL1                     0x0B8
++#define     DSI_INT_ST0                           0x0BC
++#define     DSI_INT_ST1                           0x0C0
++#define     DSI_INT_MASK0_CFG                     0x0C4
++#define     DSI_INT_MASK1_CFG                     0x0C8
++#define     DSI_PHY_CAL                           0x0CC
++#define     DSI_HEXP_NPKT_CLR                     0x104
++#define     DSI_HEXP_NPKT_SIZE                    0x108
++#define     DSI_VID_SHADOW_CTRL                   0x100
++
++#define     DSI_DPI_VCID_ACT                      0x10C
++#define     DSI_DPI_COLOR_CODING_ACT              0x110
++#define     DSI_DPI_LP_CMD_TIM_ACT                0x118
++#define     DSI_VID_MODE_CFG_ACT                  0x138
++#define     DSI_VID_PKT_SIZE_ACT                  0x13C
++#define     DSI_VID_NUM_CHUNKS_ACT                0x140
++#define     DSI_VID_NULL_SIZE_ACT                 0x144
++#define     DSI_VID_HSA_TIME_ACT                  0x148
++#define     DSI_VID_HBP_TIME_ACT                  0x14C
++#define     DSI_VID_HLINE_TIME_ACT                0x150
++#define     DSI_VID_VSA_LINES_ACT                 0x154
++#define     DSI_VID_VBP_LINES_ACT                 0x158
++#define     DSI_VID_VFP_LINES_ACT                 0x15C
++#define     DSI_VID_VACTIVE_LINES_ACT             0x160
++#define     DSI_SDF_3D_CFG_ACT                    0x190
++
++#define     DSI_INT_FORCE0                        0x0D8
++#define     DSI_INT_FORCE1                        0x0DC
++
++#define     DSI_AUTO_ULPS_MODE                    0x0E0
++#define     DSI_AUTO_ULPS_ENTRY_DELAY             0x0E4
++#define     DSI_AUTO_ULPS_WAKEUP_TIME             0x0E8
++#define     DSI_EDPI_ADV_FEATURES                 0x0EC
++
++#define     DSI_DSC_PARAMETER                     0x0F0
++
++/* And some bitfield definitions */
++
++#define DSI_PCKHDL_EOTP_TX_EN  BIT(0)
++#define DSI_PCKHDL_BTA_EN      BIT(2)
++
++#define DSI_VID_MODE_LP_CMD_EN        BIT(15)
++#define DSI_VID_MODE_FRAME_BTA_ACK_EN BIT(14)
++#define DSI_VID_MODE_LP_HFP_EN        BIT(13)
++#define DSI_VID_MODE_LP_HBP_EN        BIT(12)
++#define DSI_VID_MODE_LP_VACT_EN       BIT(11)
++#define DSI_VID_MODE_LP_VFP_EN        BIT(10)
++#define DSI_VID_MODE_LP_VBP_EN        BIT(9)
++#define DSI_VID_MODE_LP_VSA_EN        BIT(8)
++#define DSI_VID_MODE_SYNC_PULSES      0
++#define DSI_VID_MODE_SYNC_EVENTS      1
++#define DSI_VID_MODE_BURST            2
++
++#define DSI_CMD_MODE_ALL_LP           0x10f7f00
++#define DSI_CMD_MODE_ACK_RQST_EN      BIT(1)
++
++#define DPHY_PWR_UP_SHUTDOWNZ_LSB 0
++#define DPHY_PWR_UP_SHUTDOWNZ_BITS BIT(DPHY_PWR_UP_SHUTDOWNZ_LSB)
++
++#define DPHY_CTRL0_PHY_TESTCLK_LSB 1
++#define DPHY_CTRL0_PHY_TESTCLK_BITS BIT(DPHY_CTRL0_PHY_TESTCLK_LSB)
++#define DPHY_CTRL0_PHY_TESTCLR_LSB 0
++#define DPHY_CTRL0_PHY_TESTCLR_BITS BIT(DPHY_CTRL0_PHY_TESTCLR_LSB)
++
++#define DPHY_CTRL1_PHY_TESTDIN_LSB  0
++#define DPHY_CTRL1_PHY_TESTDIN_BITS  (0xff << DPHY_CTRL1_PHY_TESTDIN_LSB)
++#define DPHY_CTRL1_PHY_TESTDOUT_LSB 8
++#define DPHY_CTRL1_PHY_TESTDOUT_BITS (0xff << DPHY_CTRL1_PHY_TESTDOUT_LSB)
++#define DPHY_CTRL1_PHY_TESTEN_LSB 16
++#define DPHY_CTRL1_PHY_TESTEN_BITS BIT(DPHY_CTRL1_PHY_TESTEN_LSB)
++
++#define DSI_PHYRSTZ_SHUTDOWNZ_LSB  0
++#define DSI_PHYRSTZ_SHUTDOWNZ_BITS BIT(DSI_PHYRSTZ_SHUTDOWNZ_LSB)
++#define DSI_PHYRSTZ_RSTZ_LSB  1
++#define DSI_PHYRSTZ_RSTZ_BITS BIT(DSI_PHYRSTZ_RSTZ_LSB)
++#define DSI_PHYRSTZ_ENABLECLK_LSB 2
++#define DSI_PHYRSTZ_ENABLECLK_BITS BIT(DSI_PHYRSTZ_ENABLECLK_LSB)
++#define DSI_PHYRSTZ_FORCEPLL_LSB 3
++#define DSI_PHYRSTZ_FORCEPLL_BITS  BIT(DSI_PHYRSTZ_FORCEPLL_LSB)
++
++#define DPHY_HS_RX_CTRL_LANE0_OFFSET  0x44
++#define DPHY_PLL_INPUT_DIV_OFFSET 0x17
++#define DPHY_PLL_LOOP_DIV_OFFSET 0x18
++#define DPHY_PLL_DIV_CTRL_OFFSET 0x19
++
++#define DPHY_PLL_BIAS_OFFSET 0x10
++#define DPHY_PLL_BIAS_VCO_RANGE_LSB 3
++#define DPHY_PLL_BIAS_USE_PROGRAMMED_VCO_RANGE BIT(7)
++
++#define DPHY_PLL_CHARGE_PUMP_OFFSET 0x11
++#define DPHY_PLL_LPF_OFFSET 0x12
++
++#define DSI_WRITE(reg, val)  writel((val),  dsi->hw_base[RP1DSI_HW_BLOCK_DSI] + (reg))
++#define DSI_READ(reg)        readl(dsi->hw_base[RP1DSI_HW_BLOCK_DSI] + (reg))
++
++// ================================================================================
++// Register block : RPI_MIPICFG
++// Version        : 1
++// Bus type       : apb
++// Description    : Register block to control mipi DPHY
++// ================================================================================
++#define RPI_MIPICFG_REGS_RWTYPE_MSB 13
++#define RPI_MIPICFG_REGS_RWTYPE_LSB 12
++// ================================================================================
++// Register    : RPI_MIPICFG_CLK2FC
++// JTAG access : synchronous
++// Description : None
++#define RPI_MIPICFG_CLK2FC_OFFSET 0x00000000
++#define RPI_MIPICFG_CLK2FC_BITS   0x00000007
++#define RPI_MIPICFG_CLK2FC_RESET  0x00000000
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_CLK2FC_SEL
++// Description : select a clock to be sent to the frequency counter
++//               7 = none
++//               6 = none
++//               5 = none
++//               4 = rxbyteclkhs (187.5MHz)
++//               3 = rxclkesc0 (20MHz)
++//               2 = txbyteclkhs (187.5MHz)
++//               1 = txclkesc (125MHz)
++//               0 = none
++#define RPI_MIPICFG_CLK2FC_SEL_RESET  0x0
++#define RPI_MIPICFG_CLK2FC_SEL_BITS   0x00000007
++#define RPI_MIPICFG_CLK2FC_SEL_MSB    2
++#define RPI_MIPICFG_CLK2FC_SEL_LSB    0
++#define RPI_MIPICFG_CLK2FC_SEL_ACCESS "RW"
++// ================================================================================
++// Register    : RPI_MIPICFG_CFG
++// JTAG access : asynchronous
++// Description : Top level configuration
++#define RPI_MIPICFG_CFG_OFFSET 0x00000004
++#define RPI_MIPICFG_CFG_BITS   0x00000111
++#define RPI_MIPICFG_CFG_RESET  0x00000001
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_CFG_DPIUPDATE
++// Description : Indicate the DSI block that the next frame will have a new video configuration
++#define RPI_MIPICFG_CFG_DPIUPDATE_RESET  0x0
++#define RPI_MIPICFG_CFG_DPIUPDATE_BITS   0x00000100
++#define RPI_MIPICFG_CFG_DPIUPDATE_MSB    8
++#define RPI_MIPICFG_CFG_DPIUPDATE_LSB    8
++#define RPI_MIPICFG_CFG_DPIUPDATE_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_CFG_SEL_TE_EXT
++// Description : Select the TE source: 1 - ext, 0 - int
++#define RPI_MIPICFG_CFG_SEL_TE_EXT_RESET  0x0
++#define RPI_MIPICFG_CFG_SEL_TE_EXT_BITS   0x00000010
++#define RPI_MIPICFG_CFG_SEL_TE_EXT_MSB    4
++#define RPI_MIPICFG_CFG_SEL_TE_EXT_LSB    4
++#define RPI_MIPICFG_CFG_SEL_TE_EXT_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_CFG_SEL_CSI_DSI_N
++// Description : Select PHY direction: input to CSI, output from DSI. CSI 1 DSI 0
++#define RPI_MIPICFG_CFG_SEL_CSI_DSI_N_RESET  0x1
++#define RPI_MIPICFG_CFG_SEL_CSI_DSI_N_BITS   0x00000001
++#define RPI_MIPICFG_CFG_SEL_CSI_DSI_N_MSB    0
++#define RPI_MIPICFG_CFG_SEL_CSI_DSI_N_LSB    0
++#define RPI_MIPICFG_CFG_SEL_CSI_DSI_N_ACCESS "RW"
++// ================================================================================
++// Register    : RPI_MIPICFG_TE
++// JTAG access : synchronous
++// Description : Tearing effect processing
++#define RPI_MIPICFG_TE_OFFSET 0x00000008
++#define RPI_MIPICFG_TE_BITS   0x10ffffff
++#define RPI_MIPICFG_TE_RESET  0x00000000
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_TE_ARM
++// Description : Tearing effect arm
++#define RPI_MIPICFG_TE_ARM_RESET  0x0
++#define RPI_MIPICFG_TE_ARM_BITS   0x10000000
++#define RPI_MIPICFG_TE_ARM_MSB    28
++#define RPI_MIPICFG_TE_ARM_LSB    28
++#define RPI_MIPICFG_TE_ARM_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_TE_HALT_CYC
++// Description : When arm pulse has been seen, wait for te; then halt the dpi block
++//		 for this many clk_dpi cycles
++#define RPI_MIPICFG_TE_HALT_CYC_RESET  0x000000
++#define RPI_MIPICFG_TE_HALT_CYC_BITS   0x00ffffff
++#define RPI_MIPICFG_TE_HALT_CYC_MSB    23
++#define RPI_MIPICFG_TE_HALT_CYC_LSB    0
++#define RPI_MIPICFG_TE_HALT_CYC_ACCESS "RW"
++// ================================================================================
++// Register    : RPI_MIPICFG_DPHY_MONITOR
++// JTAG access : asynchronous
++// Description : DPHY status monitors for analog DFT
++#define RPI_MIPICFG_DPHY_MONITOR_OFFSET 0x00000010
++#define RPI_MIPICFG_DPHY_MONITOR_BITS   0x00111fff
++#define RPI_MIPICFG_DPHY_MONITOR_RESET  0x00000000
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_MONITOR_LOCK
++// Description : None
++#define RPI_MIPICFG_DPHY_MONITOR_LOCK_RESET  0x0
++#define RPI_MIPICFG_DPHY_MONITOR_LOCK_BITS   0x00100000
++#define RPI_MIPICFG_DPHY_MONITOR_LOCK_MSB    20
++#define RPI_MIPICFG_DPHY_MONITOR_LOCK_LSB    20
++#define RPI_MIPICFG_DPHY_MONITOR_LOCK_ACCESS "RO"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_MONITOR_BISTOK
++// Description : None
++#define RPI_MIPICFG_DPHY_MONITOR_BISTOK_RESET  0x0
++#define RPI_MIPICFG_DPHY_MONITOR_BISTOK_BITS   0x00010000
++#define RPI_MIPICFG_DPHY_MONITOR_BISTOK_MSB    16
++#define RPI_MIPICFG_DPHY_MONITOR_BISTOK_LSB    16
++#define RPI_MIPICFG_DPHY_MONITOR_BISTOK_ACCESS "RO"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_MONITOR_STOPSTATECLK
++// Description : None
++#define RPI_MIPICFG_DPHY_MONITOR_STOPSTATECLK_RESET  0x0
++#define RPI_MIPICFG_DPHY_MONITOR_STOPSTATECLK_BITS   0x00001000
++#define RPI_MIPICFG_DPHY_MONITOR_STOPSTATECLK_MSB    12
++#define RPI_MIPICFG_DPHY_MONITOR_STOPSTATECLK_LSB    12
++#define RPI_MIPICFG_DPHY_MONITOR_STOPSTATECLK_ACCESS "RO"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_MONITOR_STOPSTATEDATA
++// Description : None
++#define RPI_MIPICFG_DPHY_MONITOR_STOPSTATEDATA_RESET  0x0
++#define RPI_MIPICFG_DPHY_MONITOR_STOPSTATEDATA_BITS   0x00000f00
++#define RPI_MIPICFG_DPHY_MONITOR_STOPSTATEDATA_MSB    11
++#define RPI_MIPICFG_DPHY_MONITOR_STOPSTATEDATA_LSB    8
++#define RPI_MIPICFG_DPHY_MONITOR_STOPSTATEDATA_ACCESS "RO"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_MONITOR_TESTDOUT
++// Description : None
++#define RPI_MIPICFG_DPHY_MONITOR_TESTDOUT_RESET  0x00
++#define RPI_MIPICFG_DPHY_MONITOR_TESTDOUT_BITS   0x000000ff
++#define RPI_MIPICFG_DPHY_MONITOR_TESTDOUT_MSB    7
++#define RPI_MIPICFG_DPHY_MONITOR_TESTDOUT_LSB    0
++#define RPI_MIPICFG_DPHY_MONITOR_TESTDOUT_ACCESS "RO"
++// ================================================================================
++// Register    : RPI_MIPICFG_DPHY_CTRL_0
++// JTAG access : asynchronous
++// Description : DPHY control for analog DFT
++#define RPI_MIPICFG_DPHY_CTRL_0_OFFSET 0x00000014
++#define RPI_MIPICFG_DPHY_CTRL_0_BITS   0x0000003f
++#define RPI_MIPICFG_DPHY_CTRL_0_RESET  0x00000000
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_0_TEST_LPMODE
++// Description : When set in lpmode, TXCLKESC is driven from clk_vec(driven from clocks block)
++#define RPI_MIPICFG_DPHY_CTRL_0_TEST_LPMODE_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_0_TEST_LPMODE_BITS   0x00000020
++#define RPI_MIPICFG_DPHY_CTRL_0_TEST_LPMODE_MSB    5
++#define RPI_MIPICFG_DPHY_CTRL_0_TEST_LPMODE_LSB    5
++#define RPI_MIPICFG_DPHY_CTRL_0_TEST_LPMODE_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_0_TEST_ENA
++// Description : When set, drive the DPHY from the test registers
++#define RPI_MIPICFG_DPHY_CTRL_0_TEST_ENA_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_0_TEST_ENA_BITS   0x00000010
++#define RPI_MIPICFG_DPHY_CTRL_0_TEST_ENA_MSB    4
++#define RPI_MIPICFG_DPHY_CTRL_0_TEST_ENA_LSB    4
++#define RPI_MIPICFG_DPHY_CTRL_0_TEST_ENA_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_0_CFG_CLK_DIS
++// Description : When test_ena is set, disable cfg_clk
++#define RPI_MIPICFG_DPHY_CTRL_0_CFG_CLK_DIS_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_0_CFG_CLK_DIS_BITS   0x00000008
++#define RPI_MIPICFG_DPHY_CTRL_0_CFG_CLK_DIS_MSB    3
++#define RPI_MIPICFG_DPHY_CTRL_0_CFG_CLK_DIS_LSB    3
++#define RPI_MIPICFG_DPHY_CTRL_0_CFG_CLK_DIS_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_0_REFCLK_DIS
++// Description : When test_ena is set, disable refclk
++#define RPI_MIPICFG_DPHY_CTRL_0_REFCLK_DIS_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_0_REFCLK_DIS_BITS   0x00000004
++#define RPI_MIPICFG_DPHY_CTRL_0_REFCLK_DIS_MSB    2
++#define RPI_MIPICFG_DPHY_CTRL_0_REFCLK_DIS_LSB    2
++#define RPI_MIPICFG_DPHY_CTRL_0_REFCLK_DIS_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_0_TXCLKESC_DIS
++// Description : When test_ena is set, disable txclkesc
++#define RPI_MIPICFG_DPHY_CTRL_0_TXCLKESC_DIS_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_0_TXCLKESC_DIS_BITS   0x00000002
++#define RPI_MIPICFG_DPHY_CTRL_0_TXCLKESC_DIS_MSB    1
++#define RPI_MIPICFG_DPHY_CTRL_0_TXCLKESC_DIS_LSB    1
++#define RPI_MIPICFG_DPHY_CTRL_0_TXCLKESC_DIS_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_0_TXBYTECLKHS_DIS
++// Description : When test_ena is set, disable txbyteclkhs
++#define RPI_MIPICFG_DPHY_CTRL_0_TXBYTECLKHS_DIS_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_0_TXBYTECLKHS_DIS_BITS   0x00000001
++#define RPI_MIPICFG_DPHY_CTRL_0_TXBYTECLKHS_DIS_MSB    0
++#define RPI_MIPICFG_DPHY_CTRL_0_TXBYTECLKHS_DIS_LSB    0
++#define RPI_MIPICFG_DPHY_CTRL_0_TXBYTECLKHS_DIS_ACCESS "RW"
++// ================================================================================
++// Register    : RPI_MIPICFG_DPHY_CTRL_1
++// JTAG access : asynchronous
++// Description : DPHY control for analog DFT
++#define RPI_MIPICFG_DPHY_CTRL_1_OFFSET 0x00000018
++#define RPI_MIPICFG_DPHY_CTRL_1_BITS   0x7fffffff
++#define RPI_MIPICFG_DPHY_CTRL_1_RESET  0x00000000
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_FORCEPLL
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_FORCEPLL_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_FORCEPLL_BITS   0x40000000
++#define RPI_MIPICFG_DPHY_CTRL_1_FORCEPLL_MSB    30
++#define RPI_MIPICFG_DPHY_CTRL_1_FORCEPLL_LSB    30
++#define RPI_MIPICFG_DPHY_CTRL_1_FORCEPLL_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_SHUTDOWNZ
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_SHUTDOWNZ_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_SHUTDOWNZ_BITS   0x20000000
++#define RPI_MIPICFG_DPHY_CTRL_1_SHUTDOWNZ_MSB    29
++#define RPI_MIPICFG_DPHY_CTRL_1_SHUTDOWNZ_LSB    29
++#define RPI_MIPICFG_DPHY_CTRL_1_SHUTDOWNZ_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_RSTZ
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_RSTZ_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_RSTZ_BITS   0x10000000
++#define RPI_MIPICFG_DPHY_CTRL_1_RSTZ_MSB    28
++#define RPI_MIPICFG_DPHY_CTRL_1_RSTZ_LSB    28
++#define RPI_MIPICFG_DPHY_CTRL_1_RSTZ_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_MASTERSLAVEZ
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_MASTERSLAVEZ_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_MASTERSLAVEZ_BITS   0x08000000
++#define RPI_MIPICFG_DPHY_CTRL_1_MASTERSLAVEZ_MSB    27
++#define RPI_MIPICFG_DPHY_CTRL_1_MASTERSLAVEZ_LSB    27
++#define RPI_MIPICFG_DPHY_CTRL_1_MASTERSLAVEZ_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_BISTON
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_BISTON_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_BISTON_BITS   0x04000000
++#define RPI_MIPICFG_DPHY_CTRL_1_BISTON_MSB    26
++#define RPI_MIPICFG_DPHY_CTRL_1_BISTON_LSB    26
++#define RPI_MIPICFG_DPHY_CTRL_1_BISTON_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTHSCLK
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTHSCLK_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTHSCLK_BITS   0x02000000
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTHSCLK_MSB    25
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTHSCLK_LSB    25
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTHSCLK_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_ENABLECLK
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_ENABLECLK_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_ENABLECLK_BITS   0x01000000
++#define RPI_MIPICFG_DPHY_CTRL_1_ENABLECLK_MSB    24
++#define RPI_MIPICFG_DPHY_CTRL_1_ENABLECLK_LSB    24
++#define RPI_MIPICFG_DPHY_CTRL_1_ENABLECLK_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_ENABLE_3
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_ENABLE_3_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_ENABLE_3_BITS   0x00800000
++#define RPI_MIPICFG_DPHY_CTRL_1_ENABLE_3_MSB    23
++#define RPI_MIPICFG_DPHY_CTRL_1_ENABLE_3_LSB    23
++#define RPI_MIPICFG_DPHY_CTRL_1_ENABLE_3_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_ENABLE_2
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_ENABLE_2_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_ENABLE_2_BITS   0x00400000
++#define RPI_MIPICFG_DPHY_CTRL_1_ENABLE_2_MSB    22
++#define RPI_MIPICFG_DPHY_CTRL_1_ENABLE_2_LSB    22
++#define RPI_MIPICFG_DPHY_CTRL_1_ENABLE_2_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_ENABLE_1
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_ENABLE_1_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_ENABLE_1_BITS   0x00200000
++#define RPI_MIPICFG_DPHY_CTRL_1_ENABLE_1_MSB    21
++#define RPI_MIPICFG_DPHY_CTRL_1_ENABLE_1_LSB    21
++#define RPI_MIPICFG_DPHY_CTRL_1_ENABLE_1_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_ENABLE_0
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_ENABLE_0_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_ENABLE_0_BITS   0x00100000
++#define RPI_MIPICFG_DPHY_CTRL_1_ENABLE_0_MSB    20
++#define RPI_MIPICFG_DPHY_CTRL_1_ENABLE_0_LSB    20
++#define RPI_MIPICFG_DPHY_CTRL_1_ENABLE_0_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_BASEDIR_3
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_BASEDIR_3_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_BASEDIR_3_BITS   0x00080000
++#define RPI_MIPICFG_DPHY_CTRL_1_BASEDIR_3_MSB    19
++#define RPI_MIPICFG_DPHY_CTRL_1_BASEDIR_3_LSB    19
++#define RPI_MIPICFG_DPHY_CTRL_1_BASEDIR_3_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_BASEDIR_2
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_BASEDIR_2_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_BASEDIR_2_BITS   0x00040000
++#define RPI_MIPICFG_DPHY_CTRL_1_BASEDIR_2_MSB    18
++#define RPI_MIPICFG_DPHY_CTRL_1_BASEDIR_2_LSB    18
++#define RPI_MIPICFG_DPHY_CTRL_1_BASEDIR_2_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_BASEDIR_1
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_BASEDIR_1_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_BASEDIR_1_BITS   0x00020000
++#define RPI_MIPICFG_DPHY_CTRL_1_BASEDIR_1_MSB    17
++#define RPI_MIPICFG_DPHY_CTRL_1_BASEDIR_1_LSB    17
++#define RPI_MIPICFG_DPHY_CTRL_1_BASEDIR_1_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_BASEDIR_0
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_BASEDIR_0_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_BASEDIR_0_BITS   0x00010000
++#define RPI_MIPICFG_DPHY_CTRL_1_BASEDIR_0_MSB    16
++#define RPI_MIPICFG_DPHY_CTRL_1_BASEDIR_0_LSB    16
++#define RPI_MIPICFG_DPHY_CTRL_1_BASEDIR_0_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_TXLPDTESC_3
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_TXLPDTESC_3_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_TXLPDTESC_3_BITS   0x00008000
++#define RPI_MIPICFG_DPHY_CTRL_1_TXLPDTESC_3_MSB    15
++#define RPI_MIPICFG_DPHY_CTRL_1_TXLPDTESC_3_LSB    15
++#define RPI_MIPICFG_DPHY_CTRL_1_TXLPDTESC_3_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_TXLPDTESC_2
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_TXLPDTESC_2_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_TXLPDTESC_2_BITS   0x00004000
++#define RPI_MIPICFG_DPHY_CTRL_1_TXLPDTESC_2_MSB    14
++#define RPI_MIPICFG_DPHY_CTRL_1_TXLPDTESC_2_LSB    14
++#define RPI_MIPICFG_DPHY_CTRL_1_TXLPDTESC_2_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_TXLPDTESC_1
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_TXLPDTESC_1_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_TXLPDTESC_1_BITS   0x00002000
++#define RPI_MIPICFG_DPHY_CTRL_1_TXLPDTESC_1_MSB    13
++#define RPI_MIPICFG_DPHY_CTRL_1_TXLPDTESC_1_LSB    13
++#define RPI_MIPICFG_DPHY_CTRL_1_TXLPDTESC_1_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_TXLPDTESC_0
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_TXLPDTESC_0_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_TXLPDTESC_0_BITS   0x00001000
++#define RPI_MIPICFG_DPHY_CTRL_1_TXLPDTESC_0_MSB    12
++#define RPI_MIPICFG_DPHY_CTRL_1_TXLPDTESC_0_LSB    12
++#define RPI_MIPICFG_DPHY_CTRL_1_TXLPDTESC_0_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_TXVALIDESC_3
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_TXVALIDESC_3_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_TXVALIDESC_3_BITS   0x00000800
++#define RPI_MIPICFG_DPHY_CTRL_1_TXVALIDESC_3_MSB    11
++#define RPI_MIPICFG_DPHY_CTRL_1_TXVALIDESC_3_LSB    11
++#define RPI_MIPICFG_DPHY_CTRL_1_TXVALIDESC_3_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_TXVALIDESC_2
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_TXVALIDESC_2_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_TXVALIDESC_2_BITS   0x00000400
++#define RPI_MIPICFG_DPHY_CTRL_1_TXVALIDESC_2_MSB    10
++#define RPI_MIPICFG_DPHY_CTRL_1_TXVALIDESC_2_LSB    10
++#define RPI_MIPICFG_DPHY_CTRL_1_TXVALIDESC_2_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_TXVALIDESC_1
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_TXVALIDESC_1_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_TXVALIDESC_1_BITS   0x00000200
++#define RPI_MIPICFG_DPHY_CTRL_1_TXVALIDESC_1_MSB    9
++#define RPI_MIPICFG_DPHY_CTRL_1_TXVALIDESC_1_LSB    9
++#define RPI_MIPICFG_DPHY_CTRL_1_TXVALIDESC_1_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_TXVALIDESC_0
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_TXVALIDESC_0_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_TXVALIDESC_0_BITS   0x00000100
++#define RPI_MIPICFG_DPHY_CTRL_1_TXVALIDESC_0_MSB    8
++#define RPI_MIPICFG_DPHY_CTRL_1_TXVALIDESC_0_LSB    8
++#define RPI_MIPICFG_DPHY_CTRL_1_TXVALIDESC_0_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTESC_3
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTESC_3_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTESC_3_BITS   0x00000080
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTESC_3_MSB    7
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTESC_3_LSB    7
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTESC_3_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTESC_2
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTESC_2_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTESC_2_BITS   0x00000040
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTESC_2_MSB    6
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTESC_2_LSB    6
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTESC_2_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTESC_1
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTESC_1_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTESC_1_BITS   0x00000020
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTESC_1_MSB    5
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTESC_1_LSB    5
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTESC_1_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTESC_0
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTESC_0_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTESC_0_BITS   0x00000010
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTESC_0_MSB    4
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTESC_0_LSB    4
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTESC_0_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTDATAHS_3
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTDATAHS_3_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTDATAHS_3_BITS   0x00000008
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTDATAHS_3_MSB    3
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTDATAHS_3_LSB    3
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTDATAHS_3_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTDATAHS_2
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTDATAHS_2_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTDATAHS_2_BITS   0x00000004
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTDATAHS_2_MSB    2
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTDATAHS_2_LSB    2
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTDATAHS_2_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTDATAHS_1
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTDATAHS_1_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTDATAHS_1_BITS   0x00000002
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTDATAHS_1_MSB    1
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTDATAHS_1_LSB    1
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTDATAHS_1_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTDATAHS_0
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTDATAHS_0_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTDATAHS_0_BITS   0x00000001
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTDATAHS_0_MSB    0
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTDATAHS_0_LSB    0
++#define RPI_MIPICFG_DPHY_CTRL_1_TXREQUESTDATAHS_0_ACCESS "RW"
++// ================================================================================
++// Register    : RPI_MIPICFG_DPHY_CTRL_2
++// JTAG access : asynchronous
++// Description : DPHY control for analog DFT
++#define RPI_MIPICFG_DPHY_CTRL_2_OFFSET 0x0000001c
++#define RPI_MIPICFG_DPHY_CTRL_2_BITS   0x000007ff
++#define RPI_MIPICFG_DPHY_CTRL_2_RESET  0x00000000
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_2_TESTCLK
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_2_TESTCLK_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_2_TESTCLK_BITS   0x00000400
++#define RPI_MIPICFG_DPHY_CTRL_2_TESTCLK_MSB    10
++#define RPI_MIPICFG_DPHY_CTRL_2_TESTCLK_LSB    10
++#define RPI_MIPICFG_DPHY_CTRL_2_TESTCLK_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_2_TESTEN
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_2_TESTEN_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_2_TESTEN_BITS   0x00000200
++#define RPI_MIPICFG_DPHY_CTRL_2_TESTEN_MSB    9
++#define RPI_MIPICFG_DPHY_CTRL_2_TESTEN_LSB    9
++#define RPI_MIPICFG_DPHY_CTRL_2_TESTEN_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_2_TESTCLR
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_2_TESTCLR_RESET  0x0
++#define RPI_MIPICFG_DPHY_CTRL_2_TESTCLR_BITS   0x00000100
++#define RPI_MIPICFG_DPHY_CTRL_2_TESTCLR_MSB    8
++#define RPI_MIPICFG_DPHY_CTRL_2_TESTCLR_LSB    8
++#define RPI_MIPICFG_DPHY_CTRL_2_TESTCLR_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_2_TESTDIN
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_2_TESTDIN_RESET  0x00
++#define RPI_MIPICFG_DPHY_CTRL_2_TESTDIN_BITS   0x000000ff
++#define RPI_MIPICFG_DPHY_CTRL_2_TESTDIN_MSB    7
++#define RPI_MIPICFG_DPHY_CTRL_2_TESTDIN_LSB    0
++#define RPI_MIPICFG_DPHY_CTRL_2_TESTDIN_ACCESS "RW"
++// ================================================================================
++// Register    : RPI_MIPICFG_DPHY_CTRL_3
++// JTAG access : asynchronous
++// Description : DPHY control for analog DFT
++#define RPI_MIPICFG_DPHY_CTRL_3_OFFSET 0x00000020
++#define RPI_MIPICFG_DPHY_CTRL_3_BITS   0xffffffff
++#define RPI_MIPICFG_DPHY_CTRL_3_RESET  0x00000000
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_3_TXDATAESC_3
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_3_TXDATAESC_3_RESET  0x00
++#define RPI_MIPICFG_DPHY_CTRL_3_TXDATAESC_3_BITS   0xff000000
++#define RPI_MIPICFG_DPHY_CTRL_3_TXDATAESC_3_MSB    31
++#define RPI_MIPICFG_DPHY_CTRL_3_TXDATAESC_3_LSB    24
++#define RPI_MIPICFG_DPHY_CTRL_3_TXDATAESC_3_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_3_TXDATAESC_2
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_3_TXDATAESC_2_RESET  0x00
++#define RPI_MIPICFG_DPHY_CTRL_3_TXDATAESC_2_BITS   0x00ff0000
++#define RPI_MIPICFG_DPHY_CTRL_3_TXDATAESC_2_MSB    23
++#define RPI_MIPICFG_DPHY_CTRL_3_TXDATAESC_2_LSB    16
++#define RPI_MIPICFG_DPHY_CTRL_3_TXDATAESC_2_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_3_TXDATAESC_1
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_3_TXDATAESC_1_RESET  0x00
++#define RPI_MIPICFG_DPHY_CTRL_3_TXDATAESC_1_BITS   0x0000ff00
++#define RPI_MIPICFG_DPHY_CTRL_3_TXDATAESC_1_MSB    15
++#define RPI_MIPICFG_DPHY_CTRL_3_TXDATAESC_1_LSB    8
++#define RPI_MIPICFG_DPHY_CTRL_3_TXDATAESC_1_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_3_TXDATAESC_0
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_3_TXDATAESC_0_RESET  0x00
++#define RPI_MIPICFG_DPHY_CTRL_3_TXDATAESC_0_BITS   0x000000ff
++#define RPI_MIPICFG_DPHY_CTRL_3_TXDATAESC_0_MSB    7
++#define RPI_MIPICFG_DPHY_CTRL_3_TXDATAESC_0_LSB    0
++#define RPI_MIPICFG_DPHY_CTRL_3_TXDATAESC_0_ACCESS "RW"
++// ================================================================================
++// Register    : RPI_MIPICFG_DPHY_CTRL_4
++// JTAG access : asynchronous
++// Description : DPHY control for analog DFT
++#define RPI_MIPICFG_DPHY_CTRL_4_OFFSET 0x00000024
++#define RPI_MIPICFG_DPHY_CTRL_4_BITS   0xffffffff
++#define RPI_MIPICFG_DPHY_CTRL_4_RESET  0x00000000
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_4_TXDATAHS_3
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_4_TXDATAHS_3_RESET  0x00
++#define RPI_MIPICFG_DPHY_CTRL_4_TXDATAHS_3_BITS   0xff000000
++#define RPI_MIPICFG_DPHY_CTRL_4_TXDATAHS_3_MSB    31
++#define RPI_MIPICFG_DPHY_CTRL_4_TXDATAHS_3_LSB    24
++#define RPI_MIPICFG_DPHY_CTRL_4_TXDATAHS_3_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_4_TXDATAHS_2
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_4_TXDATAHS_2_RESET  0x00
++#define RPI_MIPICFG_DPHY_CTRL_4_TXDATAHS_2_BITS   0x00ff0000
++#define RPI_MIPICFG_DPHY_CTRL_4_TXDATAHS_2_MSB    23
++#define RPI_MIPICFG_DPHY_CTRL_4_TXDATAHS_2_LSB    16
++#define RPI_MIPICFG_DPHY_CTRL_4_TXDATAHS_2_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_4_TXDATAHS_1
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_4_TXDATAHS_1_RESET  0x00
++#define RPI_MIPICFG_DPHY_CTRL_4_TXDATAHS_1_BITS   0x0000ff00
++#define RPI_MIPICFG_DPHY_CTRL_4_TXDATAHS_1_MSB    15
++#define RPI_MIPICFG_DPHY_CTRL_4_TXDATAHS_1_LSB    8
++#define RPI_MIPICFG_DPHY_CTRL_4_TXDATAHS_1_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DPHY_CTRL_4_TXDATAHS_0
++// Description : None
++#define RPI_MIPICFG_DPHY_CTRL_4_TXDATAHS_0_RESET  0x00
++#define RPI_MIPICFG_DPHY_CTRL_4_TXDATAHS_0_BITS   0x000000ff
++#define RPI_MIPICFG_DPHY_CTRL_4_TXDATAHS_0_MSB    7
++#define RPI_MIPICFG_DPHY_CTRL_4_TXDATAHS_0_LSB    0
++#define RPI_MIPICFG_DPHY_CTRL_4_TXDATAHS_0_ACCESS "RW"
++// ================================================================================
++// Register    : RPI_MIPICFG_INTR
++// JTAG access : synchronous
++// Description : Raw Interrupts
++#define RPI_MIPICFG_INTR_OFFSET 0x00000028
++#define RPI_MIPICFG_INTR_BITS   0x0000000f
++#define RPI_MIPICFG_INTR_RESET  0x00000000
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_INTR_DSI_HOST
++// Description : None
++#define RPI_MIPICFG_INTR_DSI_HOST_RESET  0x0
++#define RPI_MIPICFG_INTR_DSI_HOST_BITS   0x00000008
++#define RPI_MIPICFG_INTR_DSI_HOST_MSB    3
++#define RPI_MIPICFG_INTR_DSI_HOST_LSB    3
++#define RPI_MIPICFG_INTR_DSI_HOST_ACCESS "RO"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_INTR_CSI_HOST
++// Description : None
++#define RPI_MIPICFG_INTR_CSI_HOST_RESET  0x0
++#define RPI_MIPICFG_INTR_CSI_HOST_BITS   0x00000004
++#define RPI_MIPICFG_INTR_CSI_HOST_MSB    2
++#define RPI_MIPICFG_INTR_CSI_HOST_LSB    2
++#define RPI_MIPICFG_INTR_CSI_HOST_ACCESS "RO"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_INTR_DSI_DMA
++// Description : None
++#define RPI_MIPICFG_INTR_DSI_DMA_RESET  0x0
++#define RPI_MIPICFG_INTR_DSI_DMA_BITS   0x00000002
++#define RPI_MIPICFG_INTR_DSI_DMA_MSB    1
++#define RPI_MIPICFG_INTR_DSI_DMA_LSB    1
++#define RPI_MIPICFG_INTR_DSI_DMA_ACCESS "RO"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_INTR_CSI_DMA
++// Description : None
++#define RPI_MIPICFG_INTR_CSI_DMA_RESET  0x0
++#define RPI_MIPICFG_INTR_CSI_DMA_BITS   0x00000001
++#define RPI_MIPICFG_INTR_CSI_DMA_MSB    0
++#define RPI_MIPICFG_INTR_CSI_DMA_LSB    0
++#define RPI_MIPICFG_INTR_CSI_DMA_ACCESS "RO"
++// ================================================================================
++// Register    : RPI_MIPICFG_INTE
++// JTAG access : synchronous
++// Description : Interrupt Enable
++#define RPI_MIPICFG_INTE_OFFSET 0x0000002c
++#define RPI_MIPICFG_INTE_BITS   0x0000000f
++#define RPI_MIPICFG_INTE_RESET  0x00000000
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_INTE_DSI_HOST
++// Description : None
++#define RPI_MIPICFG_INTE_DSI_HOST_RESET  0x0
++#define RPI_MIPICFG_INTE_DSI_HOST_BITS   0x00000008
++#define RPI_MIPICFG_INTE_DSI_HOST_MSB    3
++#define RPI_MIPICFG_INTE_DSI_HOST_LSB    3
++#define RPI_MIPICFG_INTE_DSI_HOST_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_INTE_CSI_HOST
++// Description : None
++#define RPI_MIPICFG_INTE_CSI_HOST_RESET  0x0
++#define RPI_MIPICFG_INTE_CSI_HOST_BITS   0x00000004
++#define RPI_MIPICFG_INTE_CSI_HOST_MSB    2
++#define RPI_MIPICFG_INTE_CSI_HOST_LSB    2
++#define RPI_MIPICFG_INTE_CSI_HOST_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_INTE_DSI_DMA
++// Description : None
++#define RPI_MIPICFG_INTE_DSI_DMA_RESET  0x0
++#define RPI_MIPICFG_INTE_DSI_DMA_BITS   0x00000002
++#define RPI_MIPICFG_INTE_DSI_DMA_MSB    1
++#define RPI_MIPICFG_INTE_DSI_DMA_LSB    1
++#define RPI_MIPICFG_INTE_DSI_DMA_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_INTE_CSI_DMA
++// Description : None
++#define RPI_MIPICFG_INTE_CSI_DMA_RESET  0x0
++#define RPI_MIPICFG_INTE_CSI_DMA_BITS   0x00000001
++#define RPI_MIPICFG_INTE_CSI_DMA_MSB    0
++#define RPI_MIPICFG_INTE_CSI_DMA_LSB    0
++#define RPI_MIPICFG_INTE_CSI_DMA_ACCESS "RW"
++// ================================================================================
++// Register    : RPI_MIPICFG_INTF
++// JTAG access : synchronous
++// Description : Interrupt Force
++#define RPI_MIPICFG_INTF_OFFSET 0x00000030
++#define RPI_MIPICFG_INTF_BITS   0x0000000f
++#define RPI_MIPICFG_INTF_RESET  0x00000000
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_INTF_DSI_HOST
++// Description : None
++#define RPI_MIPICFG_INTF_DSI_HOST_RESET  0x0
++#define RPI_MIPICFG_INTF_DSI_HOST_BITS   0x00000008
++#define RPI_MIPICFG_INTF_DSI_HOST_MSB    3
++#define RPI_MIPICFG_INTF_DSI_HOST_LSB    3
++#define RPI_MIPICFG_INTF_DSI_HOST_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_INTF_CSI_HOST
++// Description : None
++#define RPI_MIPICFG_INTF_CSI_HOST_RESET  0x0
++#define RPI_MIPICFG_INTF_CSI_HOST_BITS   0x00000004
++#define RPI_MIPICFG_INTF_CSI_HOST_MSB    2
++#define RPI_MIPICFG_INTF_CSI_HOST_LSB    2
++#define RPI_MIPICFG_INTF_CSI_HOST_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_INTF_DSI_DMA
++// Description : None
++#define RPI_MIPICFG_INTF_DSI_DMA_RESET  0x0
++#define RPI_MIPICFG_INTF_DSI_DMA_BITS   0x00000002
++#define RPI_MIPICFG_INTF_DSI_DMA_MSB    1
++#define RPI_MIPICFG_INTF_DSI_DMA_LSB    1
++#define RPI_MIPICFG_INTF_DSI_DMA_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_INTF_CSI_DMA
++// Description : None
++#define RPI_MIPICFG_INTF_CSI_DMA_RESET  0x0
++#define RPI_MIPICFG_INTF_CSI_DMA_BITS   0x00000001
++#define RPI_MIPICFG_INTF_CSI_DMA_MSB    0
++#define RPI_MIPICFG_INTF_CSI_DMA_LSB    0
++#define RPI_MIPICFG_INTF_CSI_DMA_ACCESS "RW"
++// ================================================================================
++// Register    : RPI_MIPICFG_INTS
++// JTAG access : synchronous
++// Description : Interrupt status after masking & forcing
++#define RPI_MIPICFG_INTS_OFFSET 0x00000034
++#define RPI_MIPICFG_INTS_BITS   0x0000000f
++#define RPI_MIPICFG_INTS_RESET  0x00000000
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_INTS_DSI_HOST
++// Description : None
++#define RPI_MIPICFG_INTS_DSI_HOST_RESET  0x0
++#define RPI_MIPICFG_INTS_DSI_HOST_BITS   0x00000008
++#define RPI_MIPICFG_INTS_DSI_HOST_MSB    3
++#define RPI_MIPICFG_INTS_DSI_HOST_LSB    3
++#define RPI_MIPICFG_INTS_DSI_HOST_ACCESS "RO"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_INTS_CSI_HOST
++// Description : None
++#define RPI_MIPICFG_INTS_CSI_HOST_RESET  0x0
++#define RPI_MIPICFG_INTS_CSI_HOST_BITS   0x00000004
++#define RPI_MIPICFG_INTS_CSI_HOST_MSB    2
++#define RPI_MIPICFG_INTS_CSI_HOST_LSB    2
++#define RPI_MIPICFG_INTS_CSI_HOST_ACCESS "RO"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_INTS_DSI_DMA
++// Description : None
++#define RPI_MIPICFG_INTS_DSI_DMA_RESET  0x0
++#define RPI_MIPICFG_INTS_DSI_DMA_BITS   0x00000002
++#define RPI_MIPICFG_INTS_DSI_DMA_MSB    1
++#define RPI_MIPICFG_INTS_DSI_DMA_LSB    1
++#define RPI_MIPICFG_INTS_DSI_DMA_ACCESS "RO"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_INTS_CSI_DMA
++// Description : None
++#define RPI_MIPICFG_INTS_CSI_DMA_RESET  0x0
++#define RPI_MIPICFG_INTS_CSI_DMA_BITS   0x00000001
++#define RPI_MIPICFG_INTS_CSI_DMA_MSB    0
++#define RPI_MIPICFG_INTS_CSI_DMA_LSB    0
++#define RPI_MIPICFG_INTS_CSI_DMA_ACCESS "RO"
++// ================================================================================
++// Register    : RPI_MIPICFG_BLOCK_ID
++// JTAG access : asynchronous
++// Description : Block Identifier
++#define RPI_MIPICFG_BLOCK_ID_OFFSET 0x00000038
++#define RPI_MIPICFG_BLOCK_ID_BITS   0xffffffff
++#define RPI_MIPICFG_BLOCK_ID_RESET  0x4d495049
++#define RPI_MIPICFG_BLOCK_ID_MSB    31
++#define RPI_MIPICFG_BLOCK_ID_LSB    0
++#define RPI_MIPICFG_BLOCK_ID_ACCESS "RO"
++// ================================================================================
++// Register    : RPI_MIPICFG_INSTANCE_ID
++// JTAG access : asynchronous
++// Description : Block Instance Identifier
++#define RPI_MIPICFG_INSTANCE_ID_OFFSET 0x0000003c
++#define RPI_MIPICFG_INSTANCE_ID_BITS   0x0000000f
++#define RPI_MIPICFG_INSTANCE_ID_RESET  0x00000000
++#define RPI_MIPICFG_INSTANCE_ID_MSB    3
++#define RPI_MIPICFG_INSTANCE_ID_LSB    0
++#define RPI_MIPICFG_INSTANCE_ID_ACCESS "RO"
++// ================================================================================
++// Register    : RPI_MIPICFG_RSTSEQ_AUTO
++// JTAG access : synchronous
++// Description : None
++#define RPI_MIPICFG_RSTSEQ_AUTO_OFFSET 0x00000040
++#define RPI_MIPICFG_RSTSEQ_AUTO_BITS   0x00000007
++#define RPI_MIPICFG_RSTSEQ_AUTO_RESET  0x00000007
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_RSTSEQ_AUTO_CSI
++// Description : 1 = reset is controlled by the sequencer
++//               0 = reset is controlled by rstseq_ctrl
++#define RPI_MIPICFG_RSTSEQ_AUTO_CSI_RESET  0x1
++#define RPI_MIPICFG_RSTSEQ_AUTO_CSI_BITS   0x00000004
++#define RPI_MIPICFG_RSTSEQ_AUTO_CSI_MSB    2
++#define RPI_MIPICFG_RSTSEQ_AUTO_CSI_LSB    2
++#define RPI_MIPICFG_RSTSEQ_AUTO_CSI_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_RSTSEQ_AUTO_DPI
++// Description : 1 = reset is controlled by the sequencer
++//               0 = reset is controlled by rstseq_ctrl
++#define RPI_MIPICFG_RSTSEQ_AUTO_DPI_RESET  0x1
++#define RPI_MIPICFG_RSTSEQ_AUTO_DPI_BITS   0x00000002
++#define RPI_MIPICFG_RSTSEQ_AUTO_DPI_MSB    1
++#define RPI_MIPICFG_RSTSEQ_AUTO_DPI_LSB    1
++#define RPI_MIPICFG_RSTSEQ_AUTO_DPI_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_RSTSEQ_AUTO_BUSADAPTER
++// Description : 1 = reset is controlled by the sequencer
++//               0 = reset is controlled by rstseq_ctrl
++#define RPI_MIPICFG_RSTSEQ_AUTO_BUSADAPTER_RESET  0x1
++#define RPI_MIPICFG_RSTSEQ_AUTO_BUSADAPTER_BITS   0x00000001
++#define RPI_MIPICFG_RSTSEQ_AUTO_BUSADAPTER_MSB    0
++#define RPI_MIPICFG_RSTSEQ_AUTO_BUSADAPTER_LSB    0
++#define RPI_MIPICFG_RSTSEQ_AUTO_BUSADAPTER_ACCESS "RW"
++// ================================================================================
++// Register    : RPI_MIPICFG_RSTSEQ_PARALLEL
++// JTAG access : synchronous
++// Description : None
++#define RPI_MIPICFG_RSTSEQ_PARALLEL_OFFSET 0x00000044
++#define RPI_MIPICFG_RSTSEQ_PARALLEL_BITS   0x00000007
++#define RPI_MIPICFG_RSTSEQ_PARALLEL_RESET  0x00000006
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_RSTSEQ_PARALLEL_CSI
++// Description : Is this reset parallel (i.e. not part of the sequence)
++#define RPI_MIPICFG_RSTSEQ_PARALLEL_CSI_RESET  0x1
++#define RPI_MIPICFG_RSTSEQ_PARALLEL_CSI_BITS   0x00000004
++#define RPI_MIPICFG_RSTSEQ_PARALLEL_CSI_MSB    2
++#define RPI_MIPICFG_RSTSEQ_PARALLEL_CSI_LSB    2
++#define RPI_MIPICFG_RSTSEQ_PARALLEL_CSI_ACCESS "RO"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_RSTSEQ_PARALLEL_DPI
++// Description : Is this reset parallel (i.e. not part of the sequence)
++#define RPI_MIPICFG_RSTSEQ_PARALLEL_DPI_RESET  0x1
++#define RPI_MIPICFG_RSTSEQ_PARALLEL_DPI_BITS   0x00000002
++#define RPI_MIPICFG_RSTSEQ_PARALLEL_DPI_MSB    1
++#define RPI_MIPICFG_RSTSEQ_PARALLEL_DPI_LSB    1
++#define RPI_MIPICFG_RSTSEQ_PARALLEL_DPI_ACCESS "RO"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_RSTSEQ_PARALLEL_BUSADAPTER
++// Description : Is this reset parallel (i.e. not part of the sequence)
++#define RPI_MIPICFG_RSTSEQ_PARALLEL_BUSADAPTER_RESET  0x0
++#define RPI_MIPICFG_RSTSEQ_PARALLEL_BUSADAPTER_BITS   0x00000001
++#define RPI_MIPICFG_RSTSEQ_PARALLEL_BUSADAPTER_MSB    0
++#define RPI_MIPICFG_RSTSEQ_PARALLEL_BUSADAPTER_LSB    0
++#define RPI_MIPICFG_RSTSEQ_PARALLEL_BUSADAPTER_ACCESS "RO"
++// ================================================================================
++// Register    : RPI_MIPICFG_RSTSEQ_CTRL
++// JTAG access : synchronous
++// Description : None
++#define RPI_MIPICFG_RSTSEQ_CTRL_OFFSET 0x00000048
++#define RPI_MIPICFG_RSTSEQ_CTRL_BITS   0x00000007
++#define RPI_MIPICFG_RSTSEQ_CTRL_RESET  0x00000000
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_RSTSEQ_CTRL_CSI
++// Description : 1 = keep the reset asserted
++//               0 = keep the reset deasserted
++//               This is ignored if rstseq_auto=1
++#define RPI_MIPICFG_RSTSEQ_CTRL_CSI_RESET  0x0
++#define RPI_MIPICFG_RSTSEQ_CTRL_CSI_BITS   0x00000004
++#define RPI_MIPICFG_RSTSEQ_CTRL_CSI_MSB    2
++#define RPI_MIPICFG_RSTSEQ_CTRL_CSI_LSB    2
++#define RPI_MIPICFG_RSTSEQ_CTRL_CSI_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_RSTSEQ_CTRL_DPI
++// Description : 1 = keep the reset asserted
++//               0 = keep the reset deasserted
++//               This is ignored if rstseq_auto=1
++#define RPI_MIPICFG_RSTSEQ_CTRL_DPI_RESET  0x0
++#define RPI_MIPICFG_RSTSEQ_CTRL_DPI_BITS   0x00000002
++#define RPI_MIPICFG_RSTSEQ_CTRL_DPI_MSB    1
++#define RPI_MIPICFG_RSTSEQ_CTRL_DPI_LSB    1
++#define RPI_MIPICFG_RSTSEQ_CTRL_DPI_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_RSTSEQ_CTRL_BUSADAPTER
++// Description : 1 = keep the reset asserted
++//               0 = keep the reset deasserted
++//               This is ignored if rstseq_auto=1
++#define RPI_MIPICFG_RSTSEQ_CTRL_BUSADAPTER_RESET  0x0
++#define RPI_MIPICFG_RSTSEQ_CTRL_BUSADAPTER_BITS   0x00000001
++#define RPI_MIPICFG_RSTSEQ_CTRL_BUSADAPTER_MSB    0
++#define RPI_MIPICFG_RSTSEQ_CTRL_BUSADAPTER_LSB    0
++#define RPI_MIPICFG_RSTSEQ_CTRL_BUSADAPTER_ACCESS "RW"
++// ================================================================================
++// Register    : RPI_MIPICFG_RSTSEQ_TRIG
++// JTAG access : synchronous
++// Description : None
++#define RPI_MIPICFG_RSTSEQ_TRIG_OFFSET 0x0000004c
++#define RPI_MIPICFG_RSTSEQ_TRIG_BITS   0x00000007
++#define RPI_MIPICFG_RSTSEQ_TRIG_RESET  0x00000000
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_RSTSEQ_TRIG_CSI
++// Description : Pulses the reset output
++#define RPI_MIPICFG_RSTSEQ_TRIG_CSI_RESET  0x0
++#define RPI_MIPICFG_RSTSEQ_TRIG_CSI_BITS   0x00000004
++#define RPI_MIPICFG_RSTSEQ_TRIG_CSI_MSB    2
++#define RPI_MIPICFG_RSTSEQ_TRIG_CSI_LSB    2
++#define RPI_MIPICFG_RSTSEQ_TRIG_CSI_ACCESS "SC"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_RSTSEQ_TRIG_DPI
++// Description : Pulses the reset output
++#define RPI_MIPICFG_RSTSEQ_TRIG_DPI_RESET  0x0
++#define RPI_MIPICFG_RSTSEQ_TRIG_DPI_BITS   0x00000002
++#define RPI_MIPICFG_RSTSEQ_TRIG_DPI_MSB    1
++#define RPI_MIPICFG_RSTSEQ_TRIG_DPI_LSB    1
++#define RPI_MIPICFG_RSTSEQ_TRIG_DPI_ACCESS "SC"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_RSTSEQ_TRIG_BUSADAPTER
++// Description : Pulses the reset output
++#define RPI_MIPICFG_RSTSEQ_TRIG_BUSADAPTER_RESET  0x0
++#define RPI_MIPICFG_RSTSEQ_TRIG_BUSADAPTER_BITS   0x00000001
++#define RPI_MIPICFG_RSTSEQ_TRIG_BUSADAPTER_MSB    0
++#define RPI_MIPICFG_RSTSEQ_TRIG_BUSADAPTER_LSB    0
++#define RPI_MIPICFG_RSTSEQ_TRIG_BUSADAPTER_ACCESS "SC"
++// ================================================================================
++// Register    : RPI_MIPICFG_RSTSEQ_DONE
++// JTAG access : synchronous
++// Description : None
++#define RPI_MIPICFG_RSTSEQ_DONE_OFFSET 0x00000050
++#define RPI_MIPICFG_RSTSEQ_DONE_BITS   0x00000007
++#define RPI_MIPICFG_RSTSEQ_DONE_RESET  0x00000000
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_RSTSEQ_DONE_CSI
++// Description : Indicates the current state of the reset
++#define RPI_MIPICFG_RSTSEQ_DONE_CSI_RESET  0x0
++#define RPI_MIPICFG_RSTSEQ_DONE_CSI_BITS   0x00000004
++#define RPI_MIPICFG_RSTSEQ_DONE_CSI_MSB    2
++#define RPI_MIPICFG_RSTSEQ_DONE_CSI_LSB    2
++#define RPI_MIPICFG_RSTSEQ_DONE_CSI_ACCESS "RO"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_RSTSEQ_DONE_DPI
++// Description : Indicates the current state of the reset
++#define RPI_MIPICFG_RSTSEQ_DONE_DPI_RESET  0x0
++#define RPI_MIPICFG_RSTSEQ_DONE_DPI_BITS   0x00000002
++#define RPI_MIPICFG_RSTSEQ_DONE_DPI_MSB    1
++#define RPI_MIPICFG_RSTSEQ_DONE_DPI_LSB    1
++#define RPI_MIPICFG_RSTSEQ_DONE_DPI_ACCESS "RO"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_RSTSEQ_DONE_BUSADAPTER
++// Description : Indicates the current state of the reset
++#define RPI_MIPICFG_RSTSEQ_DONE_BUSADAPTER_RESET  0x0
++#define RPI_MIPICFG_RSTSEQ_DONE_BUSADAPTER_BITS   0x00000001
++#define RPI_MIPICFG_RSTSEQ_DONE_BUSADAPTER_MSB    0
++#define RPI_MIPICFG_RSTSEQ_DONE_BUSADAPTER_LSB    0
++#define RPI_MIPICFG_RSTSEQ_DONE_BUSADAPTER_ACCESS "RO"
++// ================================================================================
++// Register    : RPI_MIPICFG_DFTSS
++// JTAG access : asynchronous
++// Description : None
++#define RPI_MIPICFG_DFTSS_OFFSET 0x00000054
++#define RPI_MIPICFG_DFTSS_BITS   0x0000001f
++#define RPI_MIPICFG_DFTSS_RESET  0x00000000
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DFTSS_JTAG_COPY
++// Description : None
++#define RPI_MIPICFG_DFTSS_JTAG_COPY_RESET  0x0
++#define RPI_MIPICFG_DFTSS_JTAG_COPY_BITS   0x00000010
++#define RPI_MIPICFG_DFTSS_JTAG_COPY_MSB    4
++#define RPI_MIPICFG_DFTSS_JTAG_COPY_LSB    4
++#define RPI_MIPICFG_DFTSS_JTAG_COPY_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DFTSS_JTAG_ACCESS_ONLY
++// Description : None
++#define RPI_MIPICFG_DFTSS_JTAG_ACCESS_ONLY_RESET  0x0
++#define RPI_MIPICFG_DFTSS_JTAG_ACCESS_ONLY_BITS   0x00000008
++#define RPI_MIPICFG_DFTSS_JTAG_ACCESS_ONLY_MSB    3
++#define RPI_MIPICFG_DFTSS_JTAG_ACCESS_ONLY_LSB    3
++#define RPI_MIPICFG_DFTSS_JTAG_ACCESS_ONLY_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DFTSS_BYPASS_OUTSYNCS
++// Description : None
++#define RPI_MIPICFG_DFTSS_BYPASS_OUTSYNCS_RESET  0x0
++#define RPI_MIPICFG_DFTSS_BYPASS_OUTSYNCS_BITS   0x00000004
++#define RPI_MIPICFG_DFTSS_BYPASS_OUTSYNCS_MSB    2
++#define RPI_MIPICFG_DFTSS_BYPASS_OUTSYNCS_LSB    2
++#define RPI_MIPICFG_DFTSS_BYPASS_OUTSYNCS_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DFTSS_BYPASS_INSYNCS
++// Description : None
++#define RPI_MIPICFG_DFTSS_BYPASS_INSYNCS_RESET  0x0
++#define RPI_MIPICFG_DFTSS_BYPASS_INSYNCS_BITS   0x00000002
++#define RPI_MIPICFG_DFTSS_BYPASS_INSYNCS_MSB    1
++#define RPI_MIPICFG_DFTSS_BYPASS_INSYNCS_LSB    1
++#define RPI_MIPICFG_DFTSS_BYPASS_INSYNCS_ACCESS "RW"
++// --------------------------------------------------------------------------------
++// Field       : RPI_MIPICFG_DFTSS_BYPASS_RESETSYNCS
++// Description : None
++#define RPI_MIPICFG_DFTSS_BYPASS_RESETSYNCS_RESET  0x0
++#define RPI_MIPICFG_DFTSS_BYPASS_RESETSYNCS_BITS   0x00000001
++#define RPI_MIPICFG_DFTSS_BYPASS_RESETSYNCS_MSB    0
++#define RPI_MIPICFG_DFTSS_BYPASS_RESETSYNCS_LSB    0
++#define RPI_MIPICFG_DFTSS_BYPASS_RESETSYNCS_ACCESS "RW"
++
++#define CFG_WRITE(reg, val)  writel((val),  dsi->hw_base[RP1DSI_HW_BLOCK_CFG] + (reg ## _OFFSET))
++#define CFG_READ(reg)        readl(dsi->hw_base[RP1DSI_HW_BLOCK_CFG] + (reg ## _OFFSET))
++
++/* ------------------------------- DPHY setup stuff ------------------------ */
++
++static void dphy_transaction(struct rp1_dsi *dsi, uint8_t test_code, uint8_t test_data)
++{
++	/*
++	 * See pg 101 of mipi dphy bidir databook
++	 * Assume we start with testclk high.
++	 * Each APB write takes at least 10ns and we ignore TESTDOUT
++	 * so there is no need for extra delays between the transitions.
++	 */
++
++	DSI_WRITE(DSI_PHY_TST_CTRL1, test_code | DPHY_CTRL1_PHY_TESTEN_BITS);
++	DSI_WRITE(DSI_PHY_TST_CTRL0, 0);
++	DSI_READ(DSI_PHY_TST_CTRL1); /* XXX possibly not needed */
++	DSI_WRITE(DSI_PHY_TST_CTRL1, test_data);
++	DSI_WRITE(DSI_PHY_TST_CTRL0, DPHY_CTRL0_PHY_TESTCLK_BITS);
++}
++
++static u64 dphy_get_div(u32 refclk, u64 vco_freq, u32 *ptr_m, u32 *ptr_n)
++{
++	/*
++	 * See pg 77-78 of dphy databook
++	 * fvco = m/n * refclk
++	 * with the limit
++	 * 40MHz >= fREFCLK / N >= 5MHz
++	 * M (multiplier) must be an even number between 2 and 300
++	 * N (input divider) must be an integer between 1 and 100
++	 *
++	 * In practice, given a 50MHz reference clock, it can produce any
++	 * multiple of 10MHz, 11.1111MHz, 12.5MHz, 14.286MHz or 16.667MHz
++	 * with < 1% error for all frequencies above 495MHz.
++	 *
++	 * vco_freq should be set to the lane bit rate (not the MIPI clock
++	 * which is half of this). These frequencies are now measured in Hz.
++	 * They should fit within u32, but u64 is needed for calculations.
++	 */
++
++	static const u32 REF_DIVN_MAX = 40000000;
++	static const u32 REF_DIVN_MIN =  5000000;
++	u32 n, best_n, best_m;
++	u64 best_err = vco_freq;
++
++	for (n = 1 + refclk / REF_DIVN_MAX; n * REF_DIVN_MIN <= refclk && n < 100; ++n) {
++		u32 half_m = DIV_U64_ROUND_CLOSEST(n * vco_freq, 2 * refclk);
++
++		if (half_m < 150) {
++			u64 f = div_u64(mul_u32_u32(2 * half_m, refclk), n);
++			u64 err = (f > vco_freq) ? f - vco_freq : vco_freq - f;
++
++			if (err < best_err) {
++				best_n = n;
++				best_m = 2 * half_m;
++				best_err = err;
++				if (err == 0)
++					break;
++			}
++		}
++	}
++
++	if (64 * best_err >= vco_freq)
++		return 0;
++
++	*ptr_n = best_n;
++	*ptr_m = best_m;
++	return div_u64(mul_u32_u32(best_m, refclk), best_n);
++}
++
++struct hsfreq_range {
++	u16 mhz_max;
++	u8  hsfreqrange;
++	u8  clk_lp2hs;
++	u8  clk_hs2lp;
++	u8  data_lp2hs; /* excluding clk lane entry */
++	u8  data_hs2lp;
++};
++
++/* See Table A-3 on page 258 of dphy databook */
++static const struct hsfreq_range hsfreq_table[] = {
++	{   89, 0b000000, 32, 20, 26, 13 },
++	{   99, 0b010000, 35, 23, 28, 14 },
++	{  109, 0b100000, 32, 22, 26, 13 },
++	{  129, 0b000001, 31, 20, 27, 13 },
++	{  139, 0b010001, 33, 22, 26, 14 },
++	{  149, 0b100001, 33, 21, 26, 14 },
++	{  169, 0b000010, 32, 20, 27, 13 },
++	{  179, 0b010010, 36, 23, 30, 15 },
++	{  199, 0b100010, 40, 22, 33, 15 },
++	{  219, 0b000011, 40, 22, 33, 15 },
++	{  239, 0b010011, 44, 24, 36, 16 },
++	{  249, 0b100011, 48, 24, 38, 17 },
++	{  269, 0b000100, 48, 24, 38, 17 },
++	{  299, 0b010100, 50, 27, 41, 18 },
++	{  329, 0b000101, 56, 28, 45, 18 },
++	{  359, 0b010101, 59, 28, 48, 19 },
++	{  399, 0b100101, 61, 30, 50, 20 },
++	{  449, 0b000110, 67, 31, 55, 21 },
++	{  499, 0b010110, 73, 31, 59, 22 },
++	{  549, 0b000111, 79, 36, 63, 24 },
++	{  599, 0b010111, 83, 37, 68, 25 },
++	{  649, 0b001000, 90, 38, 73, 27 },
++	{  699, 0b011000, 95, 40, 77, 28 },
++	{  749, 0b001001, 102, 40, 84, 28 },
++	{  799, 0b011001, 106, 42, 87, 30 },
++	{  849, 0b101001, 113, 44, 93, 31 },
++	{  899, 0b111001, 118, 47, 98, 32 },
++	{  949, 0b001010, 124, 47, 102, 34 },
++	{  999, 0b011010, 130, 49, 107, 35 },
++	{ 1049, 0b101010, 135, 51, 111, 37 },
++	{ 1099, 0b111010, 139, 51, 114, 38 },
++	{ 1149, 0b001011, 146, 54, 120, 40 },
++	{ 1199, 0b011011, 153, 57, 125, 41 },
++	{ 1249, 0b101011, 158, 58, 130, 42 },
++	{ 1299, 0b111011, 163, 58, 135, 44 },
++	{ 1349, 0b001100, 168, 60, 140, 45 },
++	{ 1399, 0b011100, 172, 64, 144, 47 },
++	{ 1449, 0b101100, 176, 65, 148, 48 },
++	{ 1500, 0b111100, 181, 66, 153, 50 },
++};
++
++static void dphy_set_hsfreqrange(struct rp1_dsi *dsi, u32 freq_mhz)
++{
++	unsigned int i;
++
++	if (freq_mhz < 80 || freq_mhz > 1500)
++		drm_err(dsi->drm, "DPHY: Frequency %u MHz out of range\n",
++			freq_mhz);
++
++	for (i = 0; i < ARRAY_SIZE(hsfreq_table) - 1; i++) {
++		if (freq_mhz <= hsfreq_table[i].mhz_max)
++			break;
++	}
++
++	dsi->hsfreq_index = i;
++	dphy_transaction(dsi, DPHY_HS_RX_CTRL_LANE0_OFFSET,
++			 hsfreq_table[i].hsfreqrange << 1);
++}
++
++static u32 dphy_configure_pll(struct rp1_dsi *dsi, u32 refclk, u32 vco_freq)
++{
++	u32 m = 0;
++	u32 n = 0;
++	u32 actual_vco_freq = dphy_get_div(refclk, vco_freq, &m, &n);
++
++	if (actual_vco_freq) {
++		dphy_set_hsfreqrange(dsi, actual_vco_freq / 1000000);
++		/* Program m,n from registers */
++		dphy_transaction(dsi, DPHY_PLL_DIV_CTRL_OFFSET, 0x30);
++		/* N (program N-1) */
++		dphy_transaction(dsi, DPHY_PLL_INPUT_DIV_OFFSET, n - 1);
++		/* M[8:5] ?? */
++		dphy_transaction(dsi, DPHY_PLL_LOOP_DIV_OFFSET, 0x80 | ((m - 1) >> 5));
++		/* M[4:0] (program M-1) */
++		dphy_transaction(dsi, DPHY_PLL_LOOP_DIV_OFFSET, ((m - 1) & 0x1F));
++		drm_dbg_driver(dsi->drm,
++			       "DPHY: vco freq want %uHz got %uHz = %d * (%uHz / %d), hsfreqrange = 0x%02x\n",
++			       vco_freq, actual_vco_freq, m, refclk, n,
++			       hsfreq_table[dsi->hsfreq_index].hsfreqrange);
++	} else {
++		drm_err(dsi->drm,
++			"rp1dsi: Error configuring DPHY PLL %uHz\n", vco_freq);
++	}
++
++	return actual_vco_freq;
++}
++
++static u32 dphy_init(struct rp1_dsi *dsi, u32 ref_freq, u32 vco_freq)
++{
++	u32 actual_vco_freq;
++
++	/* Reset the PHY */
++	DSI_WRITE(DSI_PHYRSTZ, 0);
++	DSI_WRITE(DSI_PHY_TST_CTRL0, DPHY_CTRL0_PHY_TESTCLK_BITS);
++	DSI_WRITE(DSI_PHY_TST_CTRL1, 0);
++	DSI_WRITE(DSI_PHY_TST_CTRL0, (DPHY_CTRL0_PHY_TESTCLK_BITS | DPHY_CTRL0_PHY_TESTCLR_BITS));
++	udelay(1);
++	DSI_WRITE(DSI_PHY_TST_CTRL0, DPHY_CTRL0_PHY_TESTCLK_BITS);
++	udelay(1);
++	/* Since we are in DSI (not CSI2) mode here, start the PLL */
++	actual_vco_freq = dphy_configure_pll(dsi, ref_freq, vco_freq);
++	udelay(1);
++	/* Unreset */
++	DSI_WRITE(DSI_PHYRSTZ, DSI_PHYRSTZ_SHUTDOWNZ_BITS);
++	udelay(1);
++	DSI_WRITE(DSI_PHYRSTZ, (DSI_PHYRSTZ_SHUTDOWNZ_BITS | DSI_PHYRSTZ_RSTZ_BITS));
++	udelay(1); /* so we can see PLL coming up? */
++
++	return actual_vco_freq;
++}
++
++void rp1dsi_mipicfg_setup(struct rp1_dsi *dsi)
++{
++	/* Select DSI rather than CSI-2 */
++	CFG_WRITE(RPI_MIPICFG_CFG, 0);
++	/* Enable DSIDMA interrupt only */
++	CFG_WRITE(RPI_MIPICFG_INTE, RPI_MIPICFG_INTE_DSI_DMA_BITS);
++}
++
++static unsigned long rp1dsi_refclk_freq(struct rp1_dsi *dsi)
++{
++	unsigned long u;
++
++	u = (dsi->clocks[RP1DSI_CLOCK_REF]) ? clk_get_rate(dsi->clocks[RP1DSI_CLOCK_REF]) : 0;
++	if (u < 1 || u >= (1ul << 30))
++		u = 50000000ul; /* default XOSC frequency */
++	return u;
++}
++
++static void rp1dsi_dpiclk_start(struct rp1_dsi *dsi, u32 byte_clock,
++				unsigned int bpp, unsigned int lanes)
++{
++	/* Dummy clk_set_rate() to declare the actual DSI byte-clock rate */
++	clk_set_rate(dsi->clocks[RP1DSI_CLOCK_BYTE], byte_clock);
++
++	/*
++	 * Prefer the DSI byte-clock source where possible, so that DSI and DPI
++	 * clocks will be in an exact ratio and downstream devices can recover
++	 * perfect timings. But when DPI clock is faster, fall back on PLL_SYS.
++	 * To defeat rounding errors, specify explicitly which source to use.
++	 */
++	if (bpp >= 8 * lanes)
++		clk_set_parent(dsi->clocks[RP1DSI_CLOCK_DPI], dsi->clocks[RP1DSI_CLOCK_BYTE]);
++	else if (dsi->clocks[RP1DSI_CLOCK_PLLSYS])
++		clk_set_parent(dsi->clocks[RP1DSI_CLOCK_DPI], dsi->clocks[RP1DSI_CLOCK_PLLSYS]);
++
++	clk_set_rate(dsi->clocks[RP1DSI_CLOCK_DPI], (4 * lanes * byte_clock) / (bpp >> 1));
++	clk_prepare_enable(dsi->clocks[RP1DSI_CLOCK_DPI]);
++	drm_info(dsi->drm,
++		 "rp1dsi: Nominal Byte clock %u DPI clock %lu (parent rate %lu)\n",
++		 byte_clock,
++		 clk_get_rate(dsi->clocks[RP1DSI_CLOCK_DPI]),
++		 clk_get_rate(clk_get_parent(dsi->clocks[RP1DSI_CLOCK_DPI])));
++}
++
++static void rp1dsi_dpiclk_stop(struct rp1_dsi *dsi)
++{
++	if (dsi->clocks[RP1DSI_CLOCK_DPI])
++		clk_disable_unprepare(dsi->clocks[RP1DSI_CLOCK_DPI]);
++}
++
++/* Choose the internal on-the-bus DPI format, and DSI packing flag. */
++static u32 get_colorcode(enum mipi_dsi_pixel_format fmt)
++{
++	switch (fmt) {
++	case MIPI_DSI_FMT_RGB666:
++		return 0x104;
++	case MIPI_DSI_FMT_RGB666_PACKED:
++		return 0x003;
++	case MIPI_DSI_FMT_RGB565:
++		return 0x000;
++	case MIPI_DSI_FMT_RGB888:
++		return 0x005;
++	}
++
++	/* This should be impossible as the format is validated in
++	 * rp1dsi_host_attach
++	 */
++	WARN_ONCE(1, "Invalid colour format configured for DSI");
++	return 0x005;
++}
++
++/* Frequency limits for DPI, HS and LP clocks, and some magic numbers */
++#define RP1DSI_DPI_MAX_KHZ     200000
++#define RP1DSI_BYTE_CLK_MIN  10000000
++#define RP1DSI_BYTE_CLK_MAX 187500000
++#define RP1DSI_ESC_CLK_MAX   20000000
++#define RP1DSI_TO_CLK_DIV        0x50
++#define RP1DSI_LPRX_TO_VAL       0x40
++#define RP1DSI_BTA_TO_VAL       0xd00
++
++void rp1dsi_dsi_setup(struct rp1_dsi *dsi, struct drm_display_mode const *mode)
++{
++	int cmdtim;
++	u32 timeout, mask, clkdiv;
++	unsigned int bpp = mipi_dsi_pixel_format_to_bpp(dsi->display_format);
++	u32 byte_clock = clamp((bpp * 125 * min(mode->clock, RP1DSI_DPI_MAX_KHZ)) / dsi->lanes,
++			       RP1DSI_BYTE_CLK_MIN, RP1DSI_BYTE_CLK_MAX);
++
++	DSI_WRITE(DSI_PHY_IF_CFG, dsi->lanes - 1);
++	DSI_WRITE(DSI_DPI_CFG_POL, 0);
++	DSI_WRITE(DSI_GEN_VCID, dsi->vc);
++	DSI_WRITE(DSI_DPI_COLOR_CODING, get_colorcode(dsi->display_format));
++
++	/*
++	 * Flags to configure use of LP, EoTp, Burst Mode, Sync Events/Pulses.
++	 * Note that Burst Mode implies Sync Events; the two flags need not be
++	 * set concurrently, and in this RP1 variant *should not* both be set:
++	 * doing so would (counter-intuitively) enable Sync Pulses and may fail
++	 * if there is not sufficient time to return to LP11 state during HBP.
++	 */
++	mask =  DSI_VID_MODE_LP_HFP_EN  | DSI_VID_MODE_LP_HBP_EN |
++		DSI_VID_MODE_LP_VACT_EN | DSI_VID_MODE_LP_VFP_EN |
++		DSI_VID_MODE_LP_VBP_EN  | DSI_VID_MODE_LP_VSA_EN;
++	if (dsi->display_flags & MIPI_DSI_MODE_LPM)
++		mask |= DSI_VID_MODE_LP_CMD_EN;
++	if (dsi->display_flags & MIPI_DSI_MODE_VIDEO_BURST)
++		mask |= DSI_VID_MODE_BURST;
++	else if (!(dsi->display_flags & MIPI_DSI_MODE_VIDEO_SYNC_PULSE))
++		mask |= DSI_VID_MODE_SYNC_EVENTS;
++	else if (8 * dsi->lanes > bpp)
++		mask &= ~DSI_VID_MODE_LP_HBP_EN; /* PULSE && inexact DPICLK => fix HBP time */
++	DSI_WRITE(DSI_VID_MODE_CFG, mask);
++	DSI_WRITE(DSI_CMD_MODE_CFG,
++		  (dsi->display_flags & MIPI_DSI_MODE_LPM) ? DSI_CMD_MODE_ALL_LP : 0);
++	DSI_WRITE(DSI_PCKHDL_CFG,
++		  DSI_PCKHDL_BTA_EN |
++		  ((dsi->display_flags & MIPI_DSI_MODE_NO_EOT_PACKET) ? 0 : DSI_PCKHDL_EOTP_TX_EN));
++
++	/* Select Command Mode */
++	DSI_WRITE(DSI_MODE_CFG, 1);
++
++	/* Set timeouts and clock dividers */
++	timeout = (bpp * mode->htotal * mode->vdisplay) / (7 * RP1DSI_TO_CLK_DIV * dsi->lanes);
++	if (timeout > 0xFFFFu)
++		timeout = 0;
++	DSI_WRITE(DSI_TO_CNT_CFG, (timeout << 16) | RP1DSI_LPRX_TO_VAL);
++	DSI_WRITE(DSI_BTA_TO_CNT, RP1DSI_BTA_TO_VAL);
++	clkdiv = max(2u, 1u + byte_clock / RP1DSI_ESC_CLK_MAX); /* byte clocks per escape clock */
++	DSI_WRITE(DSI_CLKMGR_CFG,
++		  (RP1DSI_TO_CLK_DIV << 8) | clkdiv);
++
++	/* Configure video timings */
++	DSI_WRITE(DSI_VID_PKT_SIZE, mode->hdisplay);
++	DSI_WRITE(DSI_VID_NUM_CHUNKS, 0);
++	DSI_WRITE(DSI_VID_NULL_SIZE, 0);
++	DSI_WRITE(DSI_VID_HSA_TIME,
++		  (bpp * (mode->hsync_end - mode->hsync_start)) / (8 * dsi->lanes));
++	DSI_WRITE(DSI_VID_HBP_TIME,
++		  (bpp * (mode->htotal - mode->hsync_end)) / (8 * dsi->lanes));
++	DSI_WRITE(DSI_VID_HLINE_TIME, (bpp * mode->htotal) / (8 * dsi->lanes));
++	DSI_WRITE(DSI_VID_VSA_LINES, (mode->vsync_end - mode->vsync_start));
++	DSI_WRITE(DSI_VID_VBP_LINES, (mode->vtotal - mode->vsync_end));
++	DSI_WRITE(DSI_VID_VFP_LINES, (mode->vsync_start - mode->vdisplay));
++	DSI_WRITE(DSI_VID_VACTIVE_LINES, mode->vdisplay);
++
++	/* Init PHY */
++	byte_clock = dphy_init(dsi, rp1dsi_refclk_freq(dsi), 8 * byte_clock) >> 3;
++
++	DSI_WRITE(DSI_PHY_TMR_LPCLK_CFG,
++		  (hsfreq_table[dsi->hsfreq_index].clk_lp2hs << DSI_PHY_TMR_LP2HS_LSB) |
++		  (hsfreq_table[dsi->hsfreq_index].clk_hs2lp << DSI_PHY_TMR_HS2LP_LSB));
++	DSI_WRITE(DSI_PHY_TMR_CFG,
++		  (hsfreq_table[dsi->hsfreq_index].data_lp2hs << DSI_PHY_TMR_LP2HS_LSB) |
++		  (hsfreq_table[dsi->hsfreq_index].data_hs2lp << DSI_PHY_TMR_HS2LP_LSB));
++
++	/* Estimate how many LP bytes can be sent during vertical blanking (Databook 3.6.2.1) */
++	cmdtim = mode->htotal;
++	if (dsi->display_flags & MIPI_DSI_MODE_VIDEO_SYNC_PULSE)
++		cmdtim -= mode->hsync_end - mode->hsync_start;
++	cmdtim = (bpp * cmdtim - 64) / (8 * dsi->lanes);      /* byte clocks after HSS and EoTp */
++	cmdtim -= hsfreq_table[dsi->hsfreq_index].data_hs2lp;
++	cmdtim -= hsfreq_table[dsi->hsfreq_index].data_lp2hs;
++	cmdtim = (cmdtim / clkdiv) - 24;                      /* escape clocks for commands */
++	cmdtim = max(0, cmdtim >> 4);                         /* bytes (at 2 clocks per bit) */
++	drm_info(dsi->drm, "rp1dsi: Command time (outvact): %d\n", cmdtim);
++	DSI_WRITE(DSI_DPI_LP_CMD_TIM, cmdtim << 16);
++
++	/* Wait for PLL lock */
++	for (timeout = (1 << 14); timeout != 0; --timeout) {
++		usleep_range(10, 50);
++		if (DSI_READ(DSI_PHY_STATUS) & (1 << 0))
++			break;
++	}
++	if (timeout == 0)
++		drm_err(dsi->drm, "RP1DSI: Time out waiting for PLL\n");
++
++	DSI_WRITE(DSI_LPCLK_CTRL,
++		  (dsi->display_flags & MIPI_DSI_CLOCK_NON_CONTINUOUS) ? 0x3 : 0x1);
++	DSI_WRITE(DSI_PHY_TST_CTRL0, 0x2);
++	DSI_WRITE(DSI_PWR_UP, 0x1);		/* power up */
++
++	/* Now it should be safe to start the external DPI clock divider */
++	rp1dsi_dpiclk_start(dsi, byte_clock, bpp, dsi->lanes);
++
++	/* Wait for all lane(s) to be in Stopstate */
++	mask = (1 << 4);
++	if (dsi->lanes >= 2)
++		mask |= (1 << 7);
++	if (dsi->lanes >= 3)
++		mask |= (1 << 9);
++	if (dsi->lanes >= 4)
++		mask |= (1 << 11);
++	for (timeout = (1 << 10); timeout != 0; --timeout) {
++		usleep_range(10, 50);
++		if ((DSI_READ(DSI_PHY_STATUS) & mask) == mask)
++			break;
++	}
++	if (timeout == 0)
++		drm_err(dsi->drm, "RP1DSI: Time out waiting for lanes (%x %x)\n",
++			mask, DSI_READ(DSI_PHY_STATUS));
++}
++
++void rp1dsi_dsi_send(struct rp1_dsi *dsi, u32 hdr, int len, const u8 *buf,
++		     bool use_lpm, bool req_ack)
++{
++	u32 val;
++
++	/* Wait for both FIFOs empty */
++	for (val = 256; val > 0; --val) {
++		if ((DSI_READ(DSI_CMD_PKT_STATUS) & 0xF) == 0x5)
++			break;
++		usleep_range(100, 150);
++	}
++
++	/*
++	 * Update global configuration flags for LP/HS and ACK options.
++	 * XXX It's not clear if having empty FIFOs (checked above and below) guarantees that
++	 * the last command has completed and been ACKed, or how closely these control registers
++	 * align with command/payload FIFO writes (as each is an independent clock-crossing)?
++	 */
++	val = DSI_READ(DSI_VID_MODE_CFG);
++	if (use_lpm)
++		val |= DSI_VID_MODE_LP_CMD_EN;
++	else
++		val &= ~DSI_VID_MODE_LP_CMD_EN;
++	DSI_WRITE(DSI_VID_MODE_CFG, val);
++	val = (use_lpm) ? DSI_CMD_MODE_ALL_LP : 0;
++	if (req_ack)
++		val |= DSI_CMD_MODE_ACK_RQST_EN;
++	DSI_WRITE(DSI_CMD_MODE_CFG, val);
++	(void)DSI_READ(DSI_CMD_MODE_CFG);
++
++	/* Write payload (in 32-bit words) and header */
++	for (; len > 0; len -= 4) {
++		val = *buf++;
++		if (len > 1)
++			val |= (*buf++) << 8;
++		if (len > 2)
++			val |= (*buf++) << 16;
++		if (len > 3)
++			val |= (*buf++) << 24;
++		DSI_WRITE(DSI_GEN_PLD_DATA, val);
++	}
++	DSI_WRITE(DSI_GEN_HDR, hdr);
++
++	/* Wait for both FIFOs empty */
++	for (val = 256; val > 0; --val) {
++		if ((DSI_READ(DSI_CMD_PKT_STATUS) & 0xF) == 0x5)
++			break;
++		usleep_range(100, 150);
++	}
++}
++
++int rp1dsi_dsi_recv(struct rp1_dsi *dsi, int len, u8 *buf)
++{
++	int i, j;
++	u32 val;
++
++	/* Wait until not busy and FIFO not empty */
++	for (i = 1024; i > 0; --i) {
++		val = DSI_READ(DSI_CMD_PKT_STATUS);
++		if ((val & ((1 << 6) | (1 << 4))) == 0)
++			break;
++		usleep_range(100, 150);
++	}
++	if (!i) {
++		drm_warn(dsi->drm, "Receive failed\n");
++		return -EIO;
++	}
++
++	for (i = 0; i < len; i += 4) {
++		/* Read fifo must not be empty before all bytes are read */
++		if (DSI_READ(DSI_CMD_PKT_STATUS) & (1 << 4))
++			break;
++
++		val = DSI_READ(DSI_GEN_PLD_DATA);
++		for (j = 0; j < 4 && j + i < len; j++)
++			*buf++ = val >> (8 * j);
++	}
++
++	return (i >= len) ? len : (i > 0) ? i : -EIO;
++}
++
++void rp1dsi_dsi_stop(struct rp1_dsi *dsi)
++{
++	DSI_WRITE(DSI_MODE_CFG, 1);	/* Return to Command Mode */
++	DSI_WRITE(DSI_LPCLK_CTRL, 2);	/* Stop the HS clock */
++	DSI_WRITE(DSI_PWR_UP, 0x0);     /* Power down host controller */
++	DSI_WRITE(DSI_PHYRSTZ, 0);      /* PHY into reset. */
++	rp1dsi_dpiclk_stop(dsi);
++}
++
++void rp1dsi_dsi_set_cmdmode(struct rp1_dsi *dsi, int mode)
++{
++	DSI_WRITE(DSI_MODE_CFG, mode);
++}
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0367-drm-Add-RP1-DPI-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0367-drm-Add-RP1-DPI-driver.patch
new file mode 100644
index 00000000..57d69176
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0367-drm-Add-RP1-DPI-driver.patch
@@ -0,0 +1,1595 @@
+From a01ae3437e5dd10e82112976f3ae78284a1013a0 Mon Sep 17 00:00:00 2001
+From: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+Date: Tue, 19 Sep 2023 17:51:49 +0100
+Subject: [PATCH 367/697] drm: Add RP1 DPI driver
+
+Add support for the RP1 DPI hardware.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+
+drm/rp1: depends on, instead of select, MFD_RP1
+
+According to kconfig-language.txt [1], select should be used only for
+"non-visible symbols ... and for symbols with no dependencies". Since
+MFD_RP1 both is visible and has a dependency, "select" should not be
+used and "depends on" should be used instead.
+
+In particular, this fixes the build of this kernel tree on NixOS, where
+its kernel config system will try to answer 'M' to as many config as
+possible.
+
+[1] https://www.kernel.org/doc/html/latest/kbuild/kconfig-language.html
+
+Signed-off-by: Ratchanan Srirattanamet <peathot@hotmail.com>
+
+drm: rp1: VEC and DPI drivers: Fix bug #5901
+
+Rework probe() to use devm_drm_dev_alloc(), embedding the DRM
+device in the DPI or VEC device as now seems to be recommended.
+
+Change order of resource allocation and driver initialization.
+This prevents it trying to write to an unmapped register during
+clean-up, which previously could crash.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+
+drm: rp1: dpi: Add support for MEDIA_BUS_FMT_RGB565_1X24_CPADHI
+
+This new format corresponds to the Raspberry Pi legacy DPI mode 3.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+
+drm: rp1: rp1-dpi: Add DRM_FORMAT_ARGB8888 and DRM_FORMAT_ABGR8888
+
+Android requires this.
+As the underlying hardware doesn't support alpha blending,
+we ignore the alpha value.
+
+Signed-off-by: Jan Kehren <jan.kehren@emteria.com>
+---
+ drivers/gpu/drm/rp1/rp1-dpi/Kconfig       |  11 +
+ drivers/gpu/drm/rp1/rp1-dpi/Makefile      |   5 +
+ drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.c     | 415 ++++++++++++++++++
+ drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.h     |  69 +++
+ drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi_cfg.c | 510 ++++++++++++++++++++++
+ drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi_hw.c  | 504 +++++++++++++++++++++
+ 6 files changed, 1514 insertions(+)
+ create mode 100644 drivers/gpu/drm/rp1/rp1-dpi/Kconfig
+ create mode 100644 drivers/gpu/drm/rp1/rp1-dpi/Makefile
+ create mode 100644 drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.c
+ create mode 100644 drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.h
+ create mode 100644 drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi_cfg.c
+ create mode 100644 drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi_hw.c
+
+--- /dev/null
++++ b/drivers/gpu/drm/rp1/rp1-dpi/Kconfig
+@@ -0,0 +1,11 @@
++# SPDX-License-Identifier: GPL-2.0-only
++config DRM_RP1_DPI
++	tristate "DRM Support for RP1 DPI"
++	depends on DRM && MFD_RP1
++	select DRM_GEM_DMA_HELPER
++	select DRM_KMS_HELPER
++	select DRM_VRAM_HELPER
++	select DRM_TTM
++	select DRM_TTM_HELPER
++	help
++	  Choose this option to enable Video Out on RP1
+--- /dev/null
++++ b/drivers/gpu/drm/rp1/rp1-dpi/Makefile
+@@ -0,0 +1,5 @@
++# SPDX-License-Identifier: GPL-2.0-only
++
++drm-rp1-dpi-y := rp1_dpi.o rp1_dpi_hw.o rp1_dpi_cfg.o
++
++obj-$(CONFIG_DRM_RP1_DPI) += drm-rp1-dpi.o
+--- /dev/null
++++ b/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.c
+@@ -0,0 +1,415 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * DRM Driver for DPI output on Raspberry Pi RP1
++ *
++ * Copyright (c) 2023 Raspberry Pi Limited.
++ */
++
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/errno.h>
++#include <linux/string.h>
++#include <linux/slab.h>
++#include <linux/mm.h>
++#include <linux/fb.h>
++#include <linux/init.h>
++#include <linux/delay.h>
++#include <linux/interrupt.h>
++#include <linux/ioport.h>
++#include <linux/list.h>
++#include <linux/platform_device.h>
++#include <linux/clk.h>
++#include <linux/printk.h>
++#include <linux/console.h>
++#include <linux/debugfs.h>
++#include <linux/uaccess.h>
++#include <linux/io.h>
++#include <linux/dma-mapping.h>
++#include <linux/cred.h>
++#include <linux/media-bus-format.h>
++#include <linux/pinctrl/consumer.h>
++#include <drm/drm_drv.h>
++#include <drm/drm_mm.h>
++#include <drm/drm_fourcc.h>
++#include <drm/drm_gem_atomic_helper.h>
++#include <drm/drm_gem_dma_helper.h>
++#include <drm/drm_atomic_helper.h>
++#include <drm/drm_managed.h>
++#include <drm/drm_crtc.h>
++#include <drm/drm_crtc_helper.h>
++#include <drm/drm_encoder.h>
++#include <drm/drm_fb_helper.h>
++#include <drm/drm_fbdev_ttm.h>
++#include <drm/drm_framebuffer.h>
++#include <drm/drm_gem.h>
++#include <drm/drm_gem_framebuffer_helper.h>
++#include <drm/drm_simple_kms_helper.h>
++#include <drm/drm_probe_helper.h>
++#include <drm/drm_modeset_helper_vtables.h>
++#include <drm/drm_vblank.h>
++#include <drm/drm_of.h>
++
++#include "rp1_dpi.h"
++
++/*
++ * Default bus format, where not specified by a connector/bridge
++ * and not overridden by the OF property "default_bus_fmt".
++ * This value is for compatibility with vc4 and VGA666-style boards,
++ * even though RP1 hardware cannot achieve the full 18-bit depth
++ * with that pinout (MEDIA_BUS_FMT_RGB666_1X24_CPADHI is preferred).
++ */
++static unsigned int default_bus_fmt = MEDIA_BUS_FMT_RGB666_1X18;
++module_param(default_bus_fmt, uint, 0644);
++
++/* -------------------------------------------------------------- */
++
++static void rp1dpi_pipe_update(struct drm_simple_display_pipe *pipe,
++			       struct drm_plane_state *old_state)
++{
++	struct drm_pending_vblank_event *event;
++	unsigned long flags;
++	struct drm_framebuffer *fb = pipe->plane.state->fb;
++	struct rp1_dpi *dpi = pipe->crtc.dev->dev_private;
++	struct drm_gem_object *gem = fb ? drm_gem_fb_get_obj(fb, 0) : NULL;
++	struct drm_gem_dma_object *dma_obj = gem ? to_drm_gem_dma_obj(gem) : NULL;
++	bool can_update = fb && dma_obj && dpi && dpi->pipe_enabled;
++
++	/* (Re-)start DPI-DMA where required; and update FB address */
++	if (can_update) {
++		if (!dpi->dpi_running || fb->format->format != dpi->cur_fmt) {
++			if (dpi->dpi_running &&
++			    fb->format->format != dpi->cur_fmt) {
++				rp1dpi_hw_stop(dpi);
++				dpi->dpi_running = false;
++			}
++			if (!dpi->dpi_running) {
++				rp1dpi_hw_setup(dpi,
++						fb->format->format,
++						dpi->bus_fmt,
++						dpi->de_inv,
++						&pipe->crtc.state->mode);
++				dpi->dpi_running = true;
++			}
++			dpi->cur_fmt = fb->format->format;
++			drm_crtc_vblank_on(&pipe->crtc);
++		}
++		rp1dpi_hw_update(dpi, dma_obj->dma_addr, fb->offsets[0], fb->pitches[0]);
++	}
++
++	/* Arm VBLANK event (or call it immediately in some error cases) */
++	spin_lock_irqsave(&pipe->crtc.dev->event_lock, flags);
++	event = pipe->crtc.state->event;
++	if (event) {
++		pipe->crtc.state->event = NULL;
++		if (can_update && drm_crtc_vblank_get(&pipe->crtc) == 0)
++			drm_crtc_arm_vblank_event(&pipe->crtc, event);
++		else
++			drm_crtc_send_vblank_event(&pipe->crtc, event);
++	}
++	spin_unlock_irqrestore(&pipe->crtc.dev->event_lock, flags);
++}
++
++static void rp1dpi_pipe_enable(struct drm_simple_display_pipe *pipe,
++			       struct drm_crtc_state *crtc_state,
++			      struct drm_plane_state *plane_state)
++{
++	static const unsigned int M = 1000000;
++	struct rp1_dpi *dpi = pipe->crtc.dev->dev_private;
++	struct drm_connector *conn;
++	struct drm_connector_list_iter conn_iter;
++	unsigned int fpix, fdiv, fvco;
++	int ret;
++
++	/* Look up the connector attached to DPI so we can get the
++	 * bus_format.  Ideally the bridge would tell us the
++	 * bus_format we want, but it doesn't yet, so assume that it's
++	 * uniform throughout the bridge chain.
++	 */
++	dev_info(&dpi->pdev->dev, __func__);
++	drm_connector_list_iter_begin(pipe->encoder.dev, &conn_iter);
++	drm_for_each_connector_iter(conn, &conn_iter) {
++		if (conn->encoder == &pipe->encoder) {
++			dpi->de_inv = !!(conn->display_info.bus_flags &
++							DRM_BUS_FLAG_DE_LOW);
++			dpi->clk_inv = !!(conn->display_info.bus_flags &
++						DRM_BUS_FLAG_PIXDATA_DRIVE_NEGEDGE);
++			if (conn->display_info.num_bus_formats)
++				dpi->bus_fmt = conn->display_info.bus_formats[0];
++			break;
++		}
++	}
++	drm_connector_list_iter_end(&conn_iter);
++
++	/* Set DPI clock to desired frequency. Currently (experimentally)
++	 * we take control of the VideoPLL, to ensure we can generate it
++	 * accurately. NB: this prevents concurrent use of DPI and VEC!
++	 * Magic numbers ensure the parent clock is within [100MHz, 200MHz]
++	 * with VCO in [1GHz, 1.33GHz]. The initial divide is by 6, 8 or 10.
++	 */
++	fpix = 1000 * pipe->crtc.state->mode.clock;
++	fpix = clamp(fpix, 1 * M, 200 * M);
++	fdiv = fpix;
++	while (fdiv < 100 * M)
++		fdiv *= 2;
++	fvco = fdiv * 2 * DIV_ROUND_UP(500 * M, fdiv);
++	ret = clk_set_rate(dpi->clocks[RP1DPI_CLK_PLLCORE], fvco);
++	if (ret)
++		dev_err(&dpi->pdev->dev, "Failed to set PLL VCO to %u (%d)", fvco, ret);
++	ret = clk_set_rate(dpi->clocks[RP1DPI_CLK_PLLDIV], fdiv);
++	if (ret)
++		dev_err(&dpi->pdev->dev, "Failed to set PLL output to %u (%d)", fdiv, ret);
++	ret = clk_set_rate(dpi->clocks[RP1DPI_CLK_DPI], fpix);
++	if (ret)
++		dev_err(&dpi->pdev->dev, "Failed to set DPI clock to %u (%d)", fpix, ret);
++
++	rp1dpi_vidout_setup(dpi, dpi->clk_inv);
++	clk_prepare_enable(dpi->clocks[RP1DPI_CLK_PLLCORE]);
++	clk_prepare_enable(dpi->clocks[RP1DPI_CLK_PLLDIV]);
++	pinctrl_pm_select_default_state(&dpi->pdev->dev);
++	clk_prepare_enable(dpi->clocks[RP1DPI_CLK_DPI]);
++	dev_info(&dpi->pdev->dev, "Want %u /%u %u /%u %u; got VCO=%lu DIV=%lu DPI=%lu",
++		 fvco, fvco / fdiv, fdiv, fdiv / fpix, fpix,
++		 clk_get_rate(dpi->clocks[RP1DPI_CLK_PLLCORE]),
++		 clk_get_rate(dpi->clocks[RP1DPI_CLK_PLLDIV]),
++		 clk_get_rate(dpi->clocks[RP1DPI_CLK_DPI]));
++
++	/* Start DPI-DMA. pipe already has the new crtc and plane state. */
++	dpi->pipe_enabled = true;
++	dpi->cur_fmt = 0xdeadbeef;
++	rp1dpi_pipe_update(pipe, 0);
++}
++
++static void rp1dpi_pipe_disable(struct drm_simple_display_pipe *pipe)
++{
++	struct rp1_dpi *dpi = pipe->crtc.dev->dev_private;
++
++	dev_info(&dpi->pdev->dev, __func__);
++	drm_crtc_vblank_off(&pipe->crtc);
++	if (dpi->dpi_running) {
++		rp1dpi_hw_stop(dpi);
++		dpi->dpi_running = false;
++	}
++	clk_disable_unprepare(dpi->clocks[RP1DPI_CLK_DPI]);
++	pinctrl_pm_select_sleep_state(&dpi->pdev->dev);
++	clk_disable_unprepare(dpi->clocks[RP1DPI_CLK_PLLDIV]);
++	clk_disable_unprepare(dpi->clocks[RP1DPI_CLK_PLLCORE]);
++	dpi->pipe_enabled = false;
++}
++
++static int rp1dpi_pipe_enable_vblank(struct drm_simple_display_pipe *pipe)
++{
++	struct rp1_dpi *dpi = pipe->crtc.dev->dev_private;
++
++	if (dpi)
++		rp1dpi_hw_vblank_ctrl(dpi, 1);
++
++	return 0;
++}
++
++static void rp1dpi_pipe_disable_vblank(struct drm_simple_display_pipe *pipe)
++{
++	struct rp1_dpi *dpi = pipe->crtc.dev->dev_private;
++
++	if (dpi)
++		rp1dpi_hw_vblank_ctrl(dpi, 0);
++}
++
++static const struct drm_simple_display_pipe_funcs rp1dpi_pipe_funcs = {
++	.enable	    = rp1dpi_pipe_enable,
++	.update	    = rp1dpi_pipe_update,
++	.disable    = rp1dpi_pipe_disable,
++	.enable_vblank	= rp1dpi_pipe_enable_vblank,
++	.disable_vblank = rp1dpi_pipe_disable_vblank,
++};
++
++static const struct drm_mode_config_funcs rp1dpi_mode_funcs = {
++	.fb_create = drm_gem_fb_create,
++	.atomic_check = drm_atomic_helper_check,
++	.atomic_commit = drm_atomic_helper_commit,
++};
++
++static void rp1dpi_stopall(struct drm_device *drm)
++{
++	if (drm->dev_private) {
++		struct rp1_dpi *dpi = drm->dev_private;
++
++		if (dpi->dpi_running || rp1dpi_hw_busy(dpi)) {
++			rp1dpi_hw_stop(dpi);
++			clk_disable_unprepare(dpi->clocks[RP1DPI_CLK_DPI]);
++			dpi->dpi_running = false;
++		}
++		rp1dpi_vidout_poweroff(dpi);
++		pinctrl_pm_select_sleep_state(&dpi->pdev->dev);
++	}
++}
++
++DEFINE_DRM_GEM_DMA_FOPS(rp1dpi_fops);
++
++static struct drm_driver rp1dpi_driver = {
++	.driver_features	= DRIVER_GEM | DRIVER_MODESET | DRIVER_ATOMIC,
++	.fops			= &rp1dpi_fops,
++	.name			= "drm-rp1-dpi",
++	.desc			= "drm-rp1-dpi",
++	.date			= "0",
++	.major			= 1,
++	.minor			= 0,
++	DRM_GEM_DMA_DRIVER_OPS,
++	.release		= rp1dpi_stopall,
++};
++
++static const u32 rp1dpi_formats[] = {
++	DRM_FORMAT_XRGB8888,
++	DRM_FORMAT_XBGR8888,
++	DRM_FORMAT_ARGB8888,
++	DRM_FORMAT_ABGR8888,
++	DRM_FORMAT_RGB888,
++	DRM_FORMAT_BGR888,
++	DRM_FORMAT_RGB565
++};
++
++static int rp1dpi_platform_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct rp1_dpi *dpi;
++	struct drm_bridge *bridge = NULL;
++	struct drm_panel *panel;
++	int i, ret;
++
++	dev_info(dev, __func__);
++	ret = drm_of_find_panel_or_bridge(pdev->dev.of_node, 0, 0,
++					  &panel, &bridge);
++	if (ret) {
++		dev_info(dev, "%s: bridge not found\n", __func__);
++		return -EPROBE_DEFER;
++	}
++	if (panel) {
++		bridge = devm_drm_panel_bridge_add(dev, panel);
++		if (IS_ERR(bridge))
++			return PTR_ERR(bridge);
++	}
++
++	dpi = devm_drm_dev_alloc(dev, &rp1dpi_driver, struct rp1_dpi, drm);
++	if (IS_ERR(dpi)) {
++		ret = PTR_ERR(dpi);
++		dev_err(dev, "%s devm_drm_dev_alloc %d", __func__, ret);
++		return ret;
++	}
++	dpi->pdev = pdev;
++
++	dpi->bus_fmt = default_bus_fmt;
++	ret = of_property_read_u32(dev->of_node, "default_bus_fmt", &dpi->bus_fmt);
++
++	for (i = 0; i < RP1DPI_NUM_HW_BLOCKS; i++) {
++		dpi->hw_base[i] =
++			devm_ioremap_resource(dev,
++					      platform_get_resource(dpi->pdev, IORESOURCE_MEM, i));
++		if (IS_ERR(dpi->hw_base[i])) {
++			dev_err(dev, "Error memory mapping regs[%d]\n", i);
++			return PTR_ERR(dpi->hw_base[i]);
++		}
++	}
++	ret = platform_get_irq(dpi->pdev, 0);
++	if (ret > 0)
++		ret = devm_request_irq(dev, ret, rp1dpi_hw_isr,
++				       IRQF_SHARED, "rp1-dpi", dpi);
++	if (ret) {
++		dev_err(dev, "Unable to request interrupt\n");
++		return -EINVAL;
++	}
++
++	for (i = 0; i < RP1DPI_NUM_CLOCKS; i++) {
++		static const char * const myclocknames[RP1DPI_NUM_CLOCKS] = {
++			"dpiclk", "plldiv", "pllcore"
++		};
++		dpi->clocks[i] = devm_clk_get(dev, myclocknames[i]);
++		if (IS_ERR(dpi->clocks[i])) {
++			dev_err(dev, "Unable to request clock %s\n", myclocknames[i]);
++			return PTR_ERR(dpi->clocks[i]);
++		}
++	}
++
++	ret = drmm_mode_config_init(&dpi->drm);
++	if (ret)
++		goto done_err;
++
++	/* Now we have all our resources, finish driver initialization */
++	dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64));
++	init_completion(&dpi->finished);
++	dpi->drm.dev_private = dpi;
++	platform_set_drvdata(pdev, &dpi->drm);
++
++	dpi->drm.mode_config.max_width  = 4096;
++	dpi->drm.mode_config.max_height = 4096;
++	dpi->drm.mode_config.preferred_depth = 32;
++	dpi->drm.mode_config.prefer_shadow   = 0;
++	dpi->drm.mode_config.quirk_addfb_prefer_host_byte_order = true;
++	dpi->drm.mode_config.funcs = &rp1dpi_mode_funcs;
++	drm_vblank_init(&dpi->drm, 1);
++
++	ret = drm_simple_display_pipe_init(&dpi->drm,
++					   &dpi->pipe,
++					   &rp1dpi_pipe_funcs,
++					   rp1dpi_formats,
++					   ARRAY_SIZE(rp1dpi_formats),
++					   NULL, NULL);
++	if (!ret)
++		ret = drm_simple_display_pipe_attach_bridge(&dpi->pipe, bridge);
++	if (ret)
++		goto done_err;
++
++	drm_mode_config_reset(&dpi->drm);
++
++	ret = drm_dev_register(&dpi->drm, 0);
++	if (ret)
++		return ret;
++
++	drm_fbdev_ttm_setup(&dpi->drm, 32);
++	return ret;
++
++done_err:
++	dev_err(dev, "%s fail %d\n", __func__, ret);
++	return ret;
++}
++
++static void rp1dpi_platform_remove(struct platform_device *pdev)
++{
++	struct drm_device *drm = platform_get_drvdata(pdev);
++
++	rp1dpi_stopall(drm);
++	drm_dev_unregister(drm);
++	drm_atomic_helper_shutdown(drm);
++	drm_dev_put(drm);
++}
++
++static void rp1dpi_platform_shutdown(struct platform_device *pdev)
++{
++	struct drm_device *drm = platform_get_drvdata(pdev);
++
++	rp1dpi_stopall(drm);
++}
++
++static const struct of_device_id rp1dpi_of_match[] = {
++	{
++		.compatible = "raspberrypi,rp1dpi",
++	},
++	{ /* sentinel */ },
++};
++
++MODULE_DEVICE_TABLE(of, rp1dpi_of_match);
++
++static struct platform_driver rp1dpi_platform_driver = {
++	.probe		= rp1dpi_platform_probe,
++	.remove		= rp1dpi_platform_remove,
++	.shutdown	= rp1dpi_platform_shutdown,
++	.driver		= {
++		.name	= DRIVER_NAME,
++		.owner	= THIS_MODULE,
++		.of_match_table = rp1dpi_of_match,
++	},
++};
++
++module_platform_driver(rp1dpi_platform_driver);
++
++MODULE_AUTHOR("Nick Hollinghurst");
++MODULE_DESCRIPTION("DRM driver for DPI output on Raspberry Pi RP1");
++MODULE_LICENSE("GPL");
+--- /dev/null
++++ b/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.h
+@@ -0,0 +1,69 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * DRM Driver for DSI output on Raspberry Pi RP1
++ *
++ * Copyright (c) 2023 Raspberry Pi Limited.
++ */
++
++#include <linux/types.h>
++#include <linux/io.h>
++#include <linux/clk.h>
++#include <drm/drm_device.h>
++#include <drm/drm_simple_kms_helper.h>
++
++#define MODULE_NAME "drm-rp1-dpi"
++#define DRIVER_NAME "drm-rp1-dpi"
++
++/* ---------------------------------------------------------------------- */
++
++#define RP1DPI_HW_BLOCK_DPI   0
++#define RP1DPI_HW_BLOCK_CFG   1
++#define RP1DPI_NUM_HW_BLOCKS  2
++
++#define RP1DPI_CLK_DPI      0
++#define RP1DPI_CLK_PLLDIV   1
++#define RP1DPI_CLK_PLLCORE  2
++#define RP1DPI_NUM_CLOCKS   3
++
++/* ---------------------------------------------------------------------- */
++
++struct rp1_dpi {
++	/* DRM base and platform device pointer */
++	struct drm_device drm;
++	struct platform_device *pdev;
++
++	/* Framework and helper objects */
++	struct drm_simple_display_pipe pipe;
++	struct drm_connector connector;
++
++	/* Clocks: Video PLL, its primary divider, and DPI clock. */
++	struct clk *clocks[RP1DPI_NUM_CLOCKS];
++
++	/* Block (DPI, VOCFG) base addresses, and current state */
++	void __iomem *hw_base[RP1DPI_NUM_HW_BLOCKS];
++	u32 cur_fmt;
++	u32 bus_fmt;
++	bool de_inv, clk_inv;
++	bool dpi_running, pipe_enabled;
++	struct completion finished;
++};
++
++/* ---------------------------------------------------------------------- */
++/* Functions to control the DPI/DMA block				  */
++
++void rp1dpi_hw_setup(struct rp1_dpi *dpi,
++		     u32 in_format,
++		     u32 bus_format,
++		     bool de_inv,
++		     struct drm_display_mode const *mode);
++void rp1dpi_hw_update(struct rp1_dpi *dpi, dma_addr_t addr, u32 offset, u32 stride);
++void rp1dpi_hw_stop(struct rp1_dpi *dpi);
++int rp1dpi_hw_busy(struct rp1_dpi *dpi);
++irqreturn_t rp1dpi_hw_isr(int irq, void *dev);
++void rp1dpi_hw_vblank_ctrl(struct rp1_dpi *dpi, int enable);
++
++/* ---------------------------------------------------------------------- */
++/* Functions to control the VIDEO OUT CFG block and check RP1 platform	  */
++
++void rp1dpi_vidout_setup(struct rp1_dpi *dpi, bool drive_negedge);
++void rp1dpi_vidout_poweroff(struct rp1_dpi *dpi);
+--- /dev/null
++++ b/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi_cfg.c
+@@ -0,0 +1,510 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * DRM Driver for DPI output on Raspberry Pi RP1
++ *
++ * Copyright (c) 2023 Raspberry Pi Limited.
++ */
++
++#include <linux/kernel.h>
++#include <linux/errno.h>
++#include <linux/mm.h>
++#include <linux/delay.h>
++#include <linux/interrupt.h>
++#include <linux/platform_device.h>
++#include <linux/printk.h>
++#include <linux/rp1_platform.h>
++
++#include "rp1_dpi.h"
++
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_SEL
++// JTAG access : synchronous
++// Description : Selects source: VEC or DPI
++#define VIDEO_OUT_CFG_SEL_OFFSET 0x00000000
++#define VIDEO_OUT_CFG_SEL_BITS	 0x00000013
++#define VIDEO_OUT_CFG_SEL_RESET	 0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_SEL_PCLK_INV
++// Description : Select dpi_pclk output port polarity inversion.
++#define VIDEO_OUT_CFG_SEL_PCLK_INV_RESET  0x0
++#define VIDEO_OUT_CFG_SEL_PCLK_INV_BITS	  0x00000010
++#define VIDEO_OUT_CFG_SEL_PCLK_INV_MSB	  4
++#define VIDEO_OUT_CFG_SEL_PCLK_INV_LSB	  4
++#define VIDEO_OUT_CFG_SEL_PCLK_INV_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_SEL_PAD_MUX
++// Description : VEC 1 DPI 0
++#define VIDEO_OUT_CFG_SEL_PAD_MUX_RESET	 0x0
++#define VIDEO_OUT_CFG_SEL_PAD_MUX_BITS	 0x00000002
++#define VIDEO_OUT_CFG_SEL_PAD_MUX_MSB	 1
++#define VIDEO_OUT_CFG_SEL_PAD_MUX_LSB	 1
++#define VIDEO_OUT_CFG_SEL_PAD_MUX_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_SEL_VDAC_MUX
++// Description : VEC 1 DPI 0
++#define VIDEO_OUT_CFG_SEL_VDAC_MUX_RESET  0x0
++#define VIDEO_OUT_CFG_SEL_VDAC_MUX_BITS	  0x00000001
++#define VIDEO_OUT_CFG_SEL_VDAC_MUX_MSB	  0
++#define VIDEO_OUT_CFG_SEL_VDAC_MUX_LSB	  0
++#define VIDEO_OUT_CFG_SEL_VDAC_MUX_ACCESS "RW"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_VDAC_CFG
++// JTAG access : synchronous
++// Description : Configure SNPS VDAC
++#define VIDEO_OUT_CFG_VDAC_CFG_OFFSET 0x00000004
++#define VIDEO_OUT_CFG_VDAC_CFG_BITS   0x1fffffff
++#define VIDEO_OUT_CFG_VDAC_CFG_RESET  0x0003ffff
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_VDAC_CFG_ENCTR
++// Description : None
++#define VIDEO_OUT_CFG_VDAC_CFG_ENCTR_RESET  0x0
++#define VIDEO_OUT_CFG_VDAC_CFG_ENCTR_BITS   0x1c000000
++#define VIDEO_OUT_CFG_VDAC_CFG_ENCTR_MSB    28
++#define VIDEO_OUT_CFG_VDAC_CFG_ENCTR_LSB    26
++#define VIDEO_OUT_CFG_VDAC_CFG_ENCTR_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_VDAC_CFG_ENSC
++// Description : None
++#define VIDEO_OUT_CFG_VDAC_CFG_ENSC_RESET  0x0
++#define VIDEO_OUT_CFG_VDAC_CFG_ENSC_BITS   0x03800000
++#define VIDEO_OUT_CFG_VDAC_CFG_ENSC_MSB	   25
++#define VIDEO_OUT_CFG_VDAC_CFG_ENSC_LSB	   23
++#define VIDEO_OUT_CFG_VDAC_CFG_ENSC_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_VDAC_CFG_ENDAC
++// Description : None
++#define VIDEO_OUT_CFG_VDAC_CFG_ENDAC_RESET  0x0
++#define VIDEO_OUT_CFG_VDAC_CFG_ENDAC_BITS   0x00700000
++#define VIDEO_OUT_CFG_VDAC_CFG_ENDAC_MSB    22
++#define VIDEO_OUT_CFG_VDAC_CFG_ENDAC_LSB    20
++#define VIDEO_OUT_CFG_VDAC_CFG_ENDAC_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_VDAC_CFG_ENVBG
++// Description : None
++#define VIDEO_OUT_CFG_VDAC_CFG_ENVBG_RESET  0x0
++#define VIDEO_OUT_CFG_VDAC_CFG_ENVBG_BITS   0x00080000
++#define VIDEO_OUT_CFG_VDAC_CFG_ENVBG_MSB    19
++#define VIDEO_OUT_CFG_VDAC_CFG_ENVBG_LSB    19
++#define VIDEO_OUT_CFG_VDAC_CFG_ENVBG_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_VDAC_CFG_ENEXTREF
++// Description : None
++#define VIDEO_OUT_CFG_VDAC_CFG_ENEXTREF_RESET  0x0
++#define VIDEO_OUT_CFG_VDAC_CFG_ENEXTREF_BITS   0x00040000
++#define VIDEO_OUT_CFG_VDAC_CFG_ENEXTREF_MSB    18
++#define VIDEO_OUT_CFG_VDAC_CFG_ENEXTREF_LSB    18
++#define VIDEO_OUT_CFG_VDAC_CFG_ENEXTREF_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_VDAC_CFG_DAC2GC
++// Description : dac2 gain control
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC2GC_RESET  0x3f
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC2GC_BITS   0x0003f000
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC2GC_MSB    17
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC2GC_LSB    12
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC2GC_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_VDAC_CFG_DAC1GC
++// Description : dac1 gain control
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC1GC_RESET  0x3f
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC1GC_BITS   0x00000fc0
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC1GC_MSB    11
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC1GC_LSB    6
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC1GC_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_VDAC_CFG_DAC0GC
++// Description : dac0 gain control
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC0GC_RESET  0x3f
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC0GC_BITS   0x0000003f
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC0GC_MSB    5
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC0GC_LSB    0
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC0GC_ACCESS "RW"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_VDAC_STATUS
++// JTAG access : synchronous
++// Description : Read VDAC status
++#define VIDEO_OUT_CFG_VDAC_STATUS_OFFSET 0x00000008
++#define VIDEO_OUT_CFG_VDAC_STATUS_BITS	 0x00000017
++#define VIDEO_OUT_CFG_VDAC_STATUS_RESET	 0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_VDAC_STATUS_ENCTR3
++// Description : None
++#define VIDEO_OUT_CFG_VDAC_STATUS_ENCTR3_RESET	0x0
++#define VIDEO_OUT_CFG_VDAC_STATUS_ENCTR3_BITS	0x00000010
++#define VIDEO_OUT_CFG_VDAC_STATUS_ENCTR3_MSB	4
++#define VIDEO_OUT_CFG_VDAC_STATUS_ENCTR3_LSB	4
++#define VIDEO_OUT_CFG_VDAC_STATUS_ENCTR3_ACCESS "RO"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_VDAC_STATUS_CABLEOUT
++// Description : None
++#define VIDEO_OUT_CFG_VDAC_STATUS_CABLEOUT_RESET  "-"
++#define VIDEO_OUT_CFG_VDAC_STATUS_CABLEOUT_BITS	  0x00000007
++#define VIDEO_OUT_CFG_VDAC_STATUS_CABLEOUT_MSB	  2
++#define VIDEO_OUT_CFG_VDAC_STATUS_CABLEOUT_LSB	  0
++#define VIDEO_OUT_CFG_VDAC_STATUS_CABLEOUT_ACCESS "RO"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_MEM_PD
++// JTAG access : synchronous
++// Description : Control memory power down
++#define VIDEO_OUT_CFG_MEM_PD_OFFSET 0x0000000c
++#define VIDEO_OUT_CFG_MEM_PD_BITS   0x00000003
++#define VIDEO_OUT_CFG_MEM_PD_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_MEM_PD_VEC
++// Description : None
++#define VIDEO_OUT_CFG_MEM_PD_VEC_RESET	0x0
++#define VIDEO_OUT_CFG_MEM_PD_VEC_BITS	0x00000002
++#define VIDEO_OUT_CFG_MEM_PD_VEC_MSB	1
++#define VIDEO_OUT_CFG_MEM_PD_VEC_LSB	1
++#define VIDEO_OUT_CFG_MEM_PD_VEC_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_MEM_PD_DPI
++// Description : None
++#define VIDEO_OUT_CFG_MEM_PD_DPI_RESET	0x0
++#define VIDEO_OUT_CFG_MEM_PD_DPI_BITS	0x00000001
++#define VIDEO_OUT_CFG_MEM_PD_DPI_MSB	0
++#define VIDEO_OUT_CFG_MEM_PD_DPI_LSB	0
++#define VIDEO_OUT_CFG_MEM_PD_DPI_ACCESS "RW"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_TEST_OVERRIDE
++// JTAG access : synchronous
++// Description : None
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_OFFSET 0x00000010
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_BITS   0xffffffff
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_TEST_OVERRIDE_PAD
++// Description : None
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_PAD_RESET  0x0
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_PAD_BITS   0x80000000
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_PAD_MSB    31
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_PAD_LSB    31
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_PAD_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_TEST_OVERRIDE_VDAC
++// Description : None
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_VDAC_RESET	0x0
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_VDAC_BITS	0x40000000
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_VDAC_MSB	30
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_VDAC_LSB	30
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_VDAC_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_TEST_OVERRIDE_RGBVAL
++// Description : None
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_RGBVAL_RESET  0x00000000
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_RGBVAL_BITS	  0x3fffffff
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_RGBVAL_MSB	  29
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_RGBVAL_LSB	  0
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_RGBVAL_ACCESS "RW"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_INTR
++// JTAG access : synchronous
++// Description : Raw Interrupts
++#define VIDEO_OUT_CFG_INTR_OFFSET 0x00000014
++#define VIDEO_OUT_CFG_INTR_BITS	  0x00000003
++#define VIDEO_OUT_CFG_INTR_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_INTR_DPI
++// Description : None
++#define VIDEO_OUT_CFG_INTR_DPI_RESET  0x0
++#define VIDEO_OUT_CFG_INTR_DPI_BITS   0x00000002
++#define VIDEO_OUT_CFG_INTR_DPI_MSB    1
++#define VIDEO_OUT_CFG_INTR_DPI_LSB    1
++#define VIDEO_OUT_CFG_INTR_DPI_ACCESS "RO"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_INTR_VEC
++// Description : None
++#define VIDEO_OUT_CFG_INTR_VEC_RESET  0x0
++#define VIDEO_OUT_CFG_INTR_VEC_BITS   0x00000001
++#define VIDEO_OUT_CFG_INTR_VEC_MSB    0
++#define VIDEO_OUT_CFG_INTR_VEC_LSB    0
++#define VIDEO_OUT_CFG_INTR_VEC_ACCESS "RO"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_INTE
++// JTAG access : synchronous
++// Description : Interrupt Enable
++#define VIDEO_OUT_CFG_INTE_OFFSET 0x00000018
++#define VIDEO_OUT_CFG_INTE_BITS	  0x00000003
++#define VIDEO_OUT_CFG_INTE_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_INTE_DPI
++// Description : None
++#define VIDEO_OUT_CFG_INTE_DPI_RESET  0x0
++#define VIDEO_OUT_CFG_INTE_DPI_BITS   0x00000002
++#define VIDEO_OUT_CFG_INTE_DPI_MSB    1
++#define VIDEO_OUT_CFG_INTE_DPI_LSB    1
++#define VIDEO_OUT_CFG_INTE_DPI_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_INTE_VEC
++// Description : None
++#define VIDEO_OUT_CFG_INTE_VEC_RESET  0x0
++#define VIDEO_OUT_CFG_INTE_VEC_BITS   0x00000001
++#define VIDEO_OUT_CFG_INTE_VEC_MSB    0
++#define VIDEO_OUT_CFG_INTE_VEC_LSB    0
++#define VIDEO_OUT_CFG_INTE_VEC_ACCESS "RW"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_INTF
++// JTAG access : synchronous
++// Description : Interrupt Force
++#define VIDEO_OUT_CFG_INTF_OFFSET 0x0000001c
++#define VIDEO_OUT_CFG_INTF_BITS	  0x00000003
++#define VIDEO_OUT_CFG_INTF_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_INTF_DPI
++// Description : None
++#define VIDEO_OUT_CFG_INTF_DPI_RESET  0x0
++#define VIDEO_OUT_CFG_INTF_DPI_BITS   0x00000002
++#define VIDEO_OUT_CFG_INTF_DPI_MSB    1
++#define VIDEO_OUT_CFG_INTF_DPI_LSB    1
++#define VIDEO_OUT_CFG_INTF_DPI_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_INTF_VEC
++// Description : None
++#define VIDEO_OUT_CFG_INTF_VEC_RESET  0x0
++#define VIDEO_OUT_CFG_INTF_VEC_BITS   0x00000001
++#define VIDEO_OUT_CFG_INTF_VEC_MSB    0
++#define VIDEO_OUT_CFG_INTF_VEC_LSB    0
++#define VIDEO_OUT_CFG_INTF_VEC_ACCESS "RW"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_INTS
++// JTAG access : synchronous
++// Description : Interrupt status after masking & forcing
++#define VIDEO_OUT_CFG_INTS_OFFSET 0x00000020
++#define VIDEO_OUT_CFG_INTS_BITS	  0x00000003
++#define VIDEO_OUT_CFG_INTS_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_INTS_DPI
++// Description : None
++#define VIDEO_OUT_CFG_INTS_DPI_RESET  0x0
++#define VIDEO_OUT_CFG_INTS_DPI_BITS   0x00000002
++#define VIDEO_OUT_CFG_INTS_DPI_MSB    1
++#define VIDEO_OUT_CFG_INTS_DPI_LSB    1
++#define VIDEO_OUT_CFG_INTS_DPI_ACCESS "RO"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_INTS_VEC
++// Description : None
++#define VIDEO_OUT_CFG_INTS_VEC_RESET  0x0
++#define VIDEO_OUT_CFG_INTS_VEC_BITS   0x00000001
++#define VIDEO_OUT_CFG_INTS_VEC_MSB    0
++#define VIDEO_OUT_CFG_INTS_VEC_LSB    0
++#define VIDEO_OUT_CFG_INTS_VEC_ACCESS "RO"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_BLOCK_ID
++// JTAG access : synchronous
++// Description : Block Identifier
++//		 Hexadecimal representation of "VOCF"
++#define VIDEO_OUT_CFG_BLOCK_ID_OFFSET 0x00000024
++#define VIDEO_OUT_CFG_BLOCK_ID_BITS   0xffffffff
++#define VIDEO_OUT_CFG_BLOCK_ID_RESET  0x564f4346
++#define VIDEO_OUT_CFG_BLOCK_ID_MSB    31
++#define VIDEO_OUT_CFG_BLOCK_ID_LSB    0
++#define VIDEO_OUT_CFG_BLOCK_ID_ACCESS "RO"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_INSTANCE_ID
++// JTAG access : synchronous
++// Description : Block Instance Identifier
++#define VIDEO_OUT_CFG_INSTANCE_ID_OFFSET 0x00000028
++#define VIDEO_OUT_CFG_INSTANCE_ID_BITS	 0x0000000f
++#define VIDEO_OUT_CFG_INSTANCE_ID_RESET	 0x00000000
++#define VIDEO_OUT_CFG_INSTANCE_ID_MSB	 3
++#define VIDEO_OUT_CFG_INSTANCE_ID_LSB	 0
++#define VIDEO_OUT_CFG_INSTANCE_ID_ACCESS "RO"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_RSTSEQ_AUTO
++// JTAG access : synchronous
++// Description : None
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_OFFSET 0x0000002c
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_BITS	 0x00000007
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_RESET	 0x00000007
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_AUTO_VEC
++// Description : 1 = reset is controlled by the sequencer
++//		 0 = reset is controlled by rstseq_ctrl
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_VEC_RESET  0x1
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_VEC_BITS   0x00000004
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_VEC_MSB    2
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_VEC_LSB    2
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_VEC_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_AUTO_DPI
++// Description : 1 = reset is controlled by the sequencer
++//		 0 = reset is controlled by rstseq_ctrl
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_DPI_RESET  0x1
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_DPI_BITS   0x00000002
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_DPI_MSB    1
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_DPI_LSB    1
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_DPI_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_AUTO_BUSADAPTER
++// Description : 1 = reset is controlled by the sequencer
++//		 0 = reset is controlled by rstseq_ctrl
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_BUSADAPTER_RESET  0x1
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_BUSADAPTER_BITS   0x00000001
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_BUSADAPTER_MSB    0
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_BUSADAPTER_LSB    0
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_BUSADAPTER_ACCESS "RW"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_RSTSEQ_PARALLEL
++// JTAG access : synchronous
++// Description : None
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_OFFSET 0x00000030
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_BITS   0x00000007
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_RESET  0x00000006
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_PARALLEL_VEC
++// Description : Is this reset parallel (i.e. not part of the sequence)
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_VEC_RESET	 0x1
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_VEC_BITS	 0x00000004
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_VEC_MSB	 2
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_VEC_LSB	 2
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_VEC_ACCESS "RO"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_PARALLEL_DPI
++// Description : Is this reset parallel (i.e. not part of the sequence)
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_DPI_RESET	 0x1
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_DPI_BITS	 0x00000002
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_DPI_MSB	 1
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_DPI_LSB	 1
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_DPI_ACCESS "RO"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_PARALLEL_BUSADAPTER
++// Description : Is this reset parallel (i.e. not part of the sequence)
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_BUSADAPTER_RESET	0x0
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_BUSADAPTER_BITS	0x00000001
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_BUSADAPTER_MSB	0
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_BUSADAPTER_LSB	0
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_BUSADAPTER_ACCESS "RO"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_RSTSEQ_CTRL
++// JTAG access : synchronous
++// Description : None
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_OFFSET 0x00000034
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_BITS	 0x00000007
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_RESET	 0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_CTRL_VEC
++// Description : 1 = keep the reset asserted
++//		 0 = keep the reset deasserted
++//		 This is ignored if rstseq_auto=1
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_VEC_RESET  0x0
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_VEC_BITS   0x00000004
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_VEC_MSB    2
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_VEC_LSB    2
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_VEC_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_CTRL_DPI
++// Description : 1 = keep the reset asserted
++//		 0 = keep the reset deasserted
++//		 This is ignored if rstseq_auto=1
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_DPI_RESET  0x0
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_DPI_BITS   0x00000002
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_DPI_MSB    1
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_DPI_LSB    1
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_DPI_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_CTRL_BUSADAPTER
++// Description : 1 = keep the reset asserted
++//		 0 = keep the reset deasserted
++//		 This is ignored if rstseq_auto=1
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_BUSADAPTER_RESET  0x0
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_BUSADAPTER_BITS   0x00000001
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_BUSADAPTER_MSB    0
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_BUSADAPTER_LSB    0
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_BUSADAPTER_ACCESS "RW"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_RSTSEQ_TRIG
++// JTAG access : synchronous
++// Description : None
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_OFFSET 0x00000038
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_BITS	 0x00000007
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_RESET	 0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_TRIG_VEC
++// Description : Pulses the reset output
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_VEC_RESET  0x0
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_VEC_BITS   0x00000004
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_VEC_MSB    2
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_VEC_LSB    2
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_VEC_ACCESS "SC"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_TRIG_DPI
++// Description : Pulses the reset output
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_DPI_RESET  0x0
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_DPI_BITS   0x00000002
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_DPI_MSB    1
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_DPI_LSB    1
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_DPI_ACCESS "SC"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_TRIG_BUSADAPTER
++// Description : Pulses the reset output
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_BUSADAPTER_RESET  0x0
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_BUSADAPTER_BITS   0x00000001
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_BUSADAPTER_MSB    0
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_BUSADAPTER_LSB    0
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_BUSADAPTER_ACCESS "SC"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_RSTSEQ_DONE
++// JTAG access : synchronous
++// Description : None
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_OFFSET 0x0000003c
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_BITS	 0x00000007
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_RESET	 0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_DONE_VEC
++// Description : Indicates the current state of the reset
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_VEC_RESET  0x0
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_VEC_BITS   0x00000004
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_VEC_MSB    2
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_VEC_LSB    2
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_VEC_ACCESS "RO"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_DONE_DPI
++// Description : Indicates the current state of the reset
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_DPI_RESET  0x0
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_DPI_BITS   0x00000002
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_DPI_MSB    1
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_DPI_LSB    1
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_DPI_ACCESS "RO"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_DONE_BUSADAPTER
++// Description : Indicates the current state of the reset
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_BUSADAPTER_RESET  0x0
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_BUSADAPTER_BITS   0x00000001
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_BUSADAPTER_MSB    0
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_BUSADAPTER_LSB    0
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_BUSADAPTER_ACCESS "RO"
++// =============================================================================
++
++#define CFG_WRITE(reg, val)  writel((val),  dpi->hw_base[RP1DPI_HW_BLOCK_CFG] + (reg ## _OFFSET))
++#define CFG_READ(reg)	     readl(dpi->hw_base[RP1DPI_HW_BLOCK_CFG] + (reg ## _OFFSET))
++
++void rp1dpi_vidout_setup(struct rp1_dpi *dpi, bool drive_negedge)
++{
++	/*
++	 * We assume DPI and VEC can't be used at the same time (due to
++	 * clashing requirements for PLL_VIDEO, and potentially for VDAC).
++	 * We therefore leave VEC memories powered down.
++	 */
++	CFG_WRITE(VIDEO_OUT_CFG_MEM_PD, VIDEO_OUT_CFG_MEM_PD_VEC_BITS);
++	CFG_WRITE(VIDEO_OUT_CFG_TEST_OVERRIDE,
++		  VIDEO_OUT_CFG_TEST_OVERRIDE_VDAC_BITS);
++
++	/* DPI->Pads; DPI->VDAC; optionally flip PCLK polarity */
++	CFG_WRITE(VIDEO_OUT_CFG_SEL,
++		  drive_negedge ? VIDEO_OUT_CFG_SEL_PCLK_INV_BITS : 0);
++
++	/* configure VDAC for 3 channels, bandgap on, 710mV swing */
++	CFG_WRITE(VIDEO_OUT_CFG_VDAC_CFG, 0);
++
++	/* enable DPI interrupt */
++	CFG_WRITE(VIDEO_OUT_CFG_INTE, VIDEO_OUT_CFG_INTE_DPI_BITS);
++}
++
++void rp1dpi_vidout_poweroff(struct rp1_dpi *dpi)
++{
++	/* disable DPI interrupt */
++	CFG_WRITE(VIDEO_OUT_CFG_INTE, 0);
++
++	/* Ensure VDAC is turned off; power down DPI,VEC memories */
++	CFG_WRITE(VIDEO_OUT_CFG_VDAC_CFG, 0);
++	CFG_WRITE(VIDEO_OUT_CFG_MEM_PD, VIDEO_OUT_CFG_MEM_PD_BITS);
++}
+--- /dev/null
++++ b/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi_hw.c
+@@ -0,0 +1,504 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * DRM Driver for DPI output on Raspberry Pi RP1
++ *
++ * Copyright (c) 2023 Raspberry Pi Limited.
++ */
++
++#include <linux/kernel.h>
++#include <linux/errno.h>
++#include <linux/mm.h>
++#include <linux/delay.h>
++#include <linux/interrupt.h>
++#include <linux/media-bus-format.h>
++#include <linux/platform_device.h>
++#include <linux/printk.h>
++#include <drm/drm_fourcc.h>
++#include <drm/drm_print.h>
++#include <drm/drm_vblank.h>
++
++#include "rp1_dpi.h"
++
++// --- DPI DMA REGISTERS ---
++
++// Control
++#define DPI_DMA_CONTROL				      0x0
++#define DPI_DMA_CONTROL_ARM_SHIFT		      0
++#define DPI_DMA_CONTROL_ARM_MASK		      BIT(DPI_DMA_CONTROL_ARM_SHIFT)
++#define DPI_DMA_CONTROL_ALIGN16_SHIFT		      2
++#define DPI_DMA_CONTROL_ALIGN16_MASK		      BIT(DPI_DMA_CONTROL_ALIGN16_SHIFT)
++#define DPI_DMA_CONTROL_AUTO_REPEAT_SHIFT	      1
++#define DPI_DMA_CONTROL_AUTO_REPEAT_MASK	      BIT(DPI_DMA_CONTROL_AUTO_REPEAT_SHIFT)
++#define DPI_DMA_CONTROL_HIGH_WATER_SHIFT	      3
++#define DPI_DMA_CONTROL_HIGH_WATER_MASK		      (0x1FF << DPI_DMA_CONTROL_HIGH_WATER_SHIFT)
++#define DPI_DMA_CONTROL_DEN_POL_SHIFT		      12
++#define DPI_DMA_CONTROL_DEN_POL_MASK		      BIT(DPI_DMA_CONTROL_DEN_POL_SHIFT)
++#define DPI_DMA_CONTROL_HSYNC_POL_SHIFT		      13
++#define DPI_DMA_CONTROL_HSYNC_POL_MASK		      BIT(DPI_DMA_CONTROL_HSYNC_POL_SHIFT)
++#define DPI_DMA_CONTROL_VSYNC_POL_SHIFT		      14
++#define DPI_DMA_CONTROL_VSYNC_POL_MASK		      BIT(DPI_DMA_CONTROL_VSYNC_POL_SHIFT)
++#define DPI_DMA_CONTROL_COLORM_SHIFT		      15
++#define DPI_DMA_CONTROL_COLORM_MASK		      BIT(DPI_DMA_CONTROL_COLORM_SHIFT)
++#define DPI_DMA_CONTROL_SHUTDN_SHIFT		      16
++#define DPI_DMA_CONTROL_SHUTDN_MASK		      BIT(DPI_DMA_CONTROL_SHUTDN_SHIFT)
++#define DPI_DMA_CONTROL_HBP_EN_SHIFT		      17
++#define DPI_DMA_CONTROL_HBP_EN_MASK		      BIT(DPI_DMA_CONTROL_HBP_EN_SHIFT)
++#define DPI_DMA_CONTROL_HFP_EN_SHIFT		      18
++#define DPI_DMA_CONTROL_HFP_EN_MASK		      BIT(DPI_DMA_CONTROL_HFP_EN_SHIFT)
++#define DPI_DMA_CONTROL_VBP_EN_SHIFT		      19
++#define DPI_DMA_CONTROL_VBP_EN_MASK		      BIT(DPI_DMA_CONTROL_VBP_EN_SHIFT)
++#define DPI_DMA_CONTROL_VFP_EN_SHIFT		      20
++#define DPI_DMA_CONTROL_VFP_EN_MASK		      BIT(DPI_DMA_CONTROL_VFP_EN_SHIFT)
++#define DPI_DMA_CONTROL_HSYNC_EN_SHIFT		      21
++#define DPI_DMA_CONTROL_HSYNC_EN_MASK		      BIT(DPI_DMA_CONTROL_HSYNC_EN_SHIFT)
++#define DPI_DMA_CONTROL_VSYNC_EN_SHIFT		      22
++#define DPI_DMA_CONTROL_VSYNC_EN_MASK		      BIT(DPI_DMA_CONTROL_VSYNC_EN_SHIFT)
++#define DPI_DMA_CONTROL_FORCE_IMMED_SHIFT	      23
++#define DPI_DMA_CONTROL_FORCE_IMMED_MASK	      BIT(DPI_DMA_CONTROL_FORCE_IMMED_SHIFT)
++#define DPI_DMA_CONTROL_FORCE_DRAIN_SHIFT	      24
++#define DPI_DMA_CONTROL_FORCE_DRAIN_MASK	      BIT(DPI_DMA_CONTROL_FORCE_DRAIN_SHIFT)
++#define DPI_DMA_CONTROL_FORCE_EMPTY_SHIFT	      25
++#define DPI_DMA_CONTROL_FORCE_EMPTY_MASK	      BIT(DPI_DMA_CONTROL_FORCE_EMPTY_SHIFT)
++
++// IRQ_ENABLES
++#define DPI_DMA_IRQ_EN				      0x04
++#define DPI_DMA_IRQ_EN_DMA_READY_SHIFT		      0
++#define DPI_DMA_IRQ_EN_DMA_READY_MASK		      BIT(DPI_DMA_IRQ_EN_DMA_READY_SHIFT)
++#define DPI_DMA_IRQ_EN_UNDERFLOW_SHIFT		      1
++#define DPI_DMA_IRQ_EN_UNDERFLOW_MASK		      BIT(DPI_DMA_IRQ_EN_UNDERFLOW_SHIFT)
++#define DPI_DMA_IRQ_EN_FRAME_START_SHIFT	      2
++#define DPI_DMA_IRQ_EN_FRAME_START_MASK		      BIT(DPI_DMA_IRQ_EN_FRAME_START_SHIFT)
++#define DPI_DMA_IRQ_EN_AFIFO_EMPTY_SHIFT	      3
++#define DPI_DMA_IRQ_EN_AFIFO_EMPTY_MASK		      BIT(DPI_DMA_IRQ_EN_AFIFO_EMPTY_SHIFT)
++#define DPI_DMA_IRQ_EN_TE_SHIFT			      4
++#define DPI_DMA_IRQ_EN_TE_MASK			      BIT(DPI_DMA_IRQ_EN_TE_SHIFT)
++#define DPI_DMA_IRQ_EN_ERROR_SHIFT		      5
++#define DPI_DMA_IRQ_EN_ERROR_MASK		      BIT(DPI_DMA_IRQ_EN_ERROR_SHIFT)
++#define DPI_DMA_IRQ_EN_MATCH_SHIFT		      6
++#define DPI_DMA_IRQ_EN_MATCH_MASK		      BIT(DPI_DMA_IRQ_EN_MATCH_SHIFT)
++#define DPI_DMA_IRQ_EN_MATCH_LINE_SHIFT		      16
++#define DPI_DMA_IRQ_EN_MATCH_LINE_MASK		      (0xFFF << DPI_DMA_IRQ_EN_MATCH_LINE_SHIFT)
++
++// IRQ_FLAGS
++#define DPI_DMA_IRQ_FLAGS			      0x08
++#define DPI_DMA_IRQ_FLAGS_DMA_READY_SHIFT	      0
++#define DPI_DMA_IRQ_FLAGS_DMA_READY_MASK	      BIT(DPI_DMA_IRQ_FLAGS_DMA_READY_SHIFT)
++#define DPI_DMA_IRQ_FLAGS_UNDERFLOW_SHIFT	      1
++#define DPI_DMA_IRQ_FLAGS_UNDERFLOW_MASK	      BIT(DPI_DMA_IRQ_FLAGS_UNDERFLOW_SHIFT)
++#define DPI_DMA_IRQ_FLAGS_FRAME_START_SHIFT	      2
++#define DPI_DMA_IRQ_FLAGS_FRAME_START_MASK	      BIT(DPI_DMA_IRQ_FLAGS_FRAME_START_SHIFT)
++#define DPI_DMA_IRQ_FLAGS_AFIFO_EMPTY_SHIFT	      3
++#define DPI_DMA_IRQ_FLAGS_AFIFO_EMPTY_MASK	      BIT(DPI_DMA_IRQ_FLAGS_AFIFO_EMPTY_SHIFT)
++#define DPI_DMA_IRQ_FLAGS_TE_SHIFT		      4
++#define DPI_DMA_IRQ_FLAGS_TE_MASK		      BIT(DPI_DMA_IRQ_FLAGS_TE_SHIFT)
++#define DPI_DMA_IRQ_FLAGS_ERROR_SHIFT		      5
++#define DPI_DMA_IRQ_FLAGS_ERROR_MASK		      BIT(DPI_DMA_IRQ_FLAGS_ERROR_SHIFT)
++#define DPI_DMA_IRQ_FLAGS_MATCH_SHIFT		      6
++#define DPI_DMA_IRQ_FLAGS_MATCH_MASK		      BIT(DPI_DMA_IRQ_FLAGS_MATCH_SHIFT)
++
++// QOS
++#define DPI_DMA_QOS				      0xC
++#define DPI_DMA_QOS_DQOS_SHIFT			      0
++#define DPI_DMA_QOS_DQOS_MASK			      (0xF << DPI_DMA_QOS_DQOS_SHIFT)
++#define DPI_DMA_QOS_ULEV_SHIFT			      4
++#define DPI_DMA_QOS_ULEV_MASK			      (0xF << DPI_DMA_QOS_ULEV_SHIFT)
++#define DPI_DMA_QOS_UQOS_SHIFT			      8
++#define DPI_DMA_QOS_UQOS_MASK			      (0xF << DPI_DMA_QOS_UQOS_SHIFT)
++#define DPI_DMA_QOS_LLEV_SHIFT			      12
++#define DPI_DMA_QOS_LLEV_MASK			      (0xF << DPI_DMA_QOS_LLEV_SHIFT)
++#define DPI_DMA_QOS_LQOS_SHIFT			      16
++#define DPI_DMA_QOS_LQOS_MASK			      (0xF << DPI_DMA_QOS_LQOS_SHIFT)
++
++// Panics
++#define DPI_DMA_PANICS				     0x38
++#define DPI_DMA_PANICS_UPPER_COUNT_SHIFT	     0
++#define DPI_DMA_PANICS_UPPER_COUNT_MASK		     \
++				(0x0000FFFF << DPI_DMA_PANICS_UPPER_COUNT_SHIFT)
++#define DPI_DMA_PANICS_LOWER_COUNT_SHIFT	     16
++#define DPI_DMA_PANICS_LOWER_COUNT_MASK		     \
++				(0x0000FFFF << DPI_DMA_PANICS_LOWER_COUNT_SHIFT)
++
++// DMA Address Lower:
++#define DPI_DMA_DMA_ADDR_L			     0x10
++
++// DMA Address Upper:
++#define DPI_DMA_DMA_ADDR_H			     0x40
++
++// DMA stride
++#define DPI_DMA_DMA_STRIDE			     0x14
++
++// Visible Area
++#define DPI_DMA_VISIBLE_AREA			     0x18
++#define DPI_DMA_VISIBLE_AREA_ROWSM1_SHIFT     0
++#define DPI_DMA_VISIBLE_AREA_ROWSM1_MASK     (0x0FFF << DPI_DMA_VISIBLE_AREA_ROWSM1_SHIFT)
++#define DPI_DMA_VISIBLE_AREA_COLSM1_SHIFT    16
++#define DPI_DMA_VISIBLE_AREA_COLSM1_MASK     (0x0FFF << DPI_DMA_VISIBLE_AREA_COLSM1_SHIFT)
++
++// Sync width
++#define DPI_DMA_SYNC_WIDTH   0x1C
++#define DPI_DMA_SYNC_WIDTH_ROWSM1_SHIFT	 0
++#define DPI_DMA_SYNC_WIDTH_ROWSM1_MASK	 (0x0FFF << DPI_DMA_SYNC_WIDTH_ROWSM1_SHIFT)
++#define DPI_DMA_SYNC_WIDTH_COLSM1_SHIFT	 16
++#define DPI_DMA_SYNC_WIDTH_COLSM1_MASK	 (0x0FFF << DPI_DMA_SYNC_WIDTH_COLSM1_SHIFT)
++
++// Back porch
++#define DPI_DMA_BACK_PORCH   0x20
++#define DPI_DMA_BACK_PORCH_ROWSM1_SHIFT	 0
++#define DPI_DMA_BACK_PORCH_ROWSM1_MASK	 (0x0FFF << DPI_DMA_BACK_PORCH_ROWSM1_SHIFT)
++#define DPI_DMA_BACK_PORCH_COLSM1_SHIFT	 16
++#define DPI_DMA_BACK_PORCH_COLSM1_MASK	 (0x0FFF << DPI_DMA_BACK_PORCH_COLSM1_SHIFT)
++
++// Front porch
++#define DPI_DMA_FRONT_PORCH  0x24
++#define DPI_DMA_FRONT_PORCH_ROWSM1_SHIFT     0
++#define DPI_DMA_FRONT_PORCH_ROWSM1_MASK	 (0x0FFF << DPI_DMA_FRONT_PORCH_ROWSM1_SHIFT)
++#define DPI_DMA_FRONT_PORCH_COLSM1_SHIFT     16
++#define DPI_DMA_FRONT_PORCH_COLSM1_MASK	 (0x0FFF << DPI_DMA_FRONT_PORCH_COLSM1_SHIFT)
++
++// Input masks
++#define DPI_DMA_IMASK	 0x2C
++#define DPI_DMA_IMASK_R_SHIFT	 0
++#define DPI_DMA_IMASK_R_MASK	 (0x3FF << DPI_DMA_IMASK_R_SHIFT)
++#define DPI_DMA_IMASK_G_SHIFT	 10
++#define DPI_DMA_IMASK_G_MASK	 (0x3FF << DPI_DMA_IMASK_G_SHIFT)
++#define DPI_DMA_IMASK_B_SHIFT	 20
++#define DPI_DMA_IMASK_B_MASK	 (0x3FF << DPI_DMA_IMASK_B_SHIFT)
++
++// Output Masks
++#define DPI_DMA_OMASK	 0x30
++#define DPI_DMA_OMASK_R_SHIFT	 0
++#define DPI_DMA_OMASK_R_MASK	 (0x3FF << DPI_DMA_OMASK_R_SHIFT)
++#define DPI_DMA_OMASK_G_SHIFT	 10
++#define DPI_DMA_OMASK_G_MASK	 (0x3FF << DPI_DMA_OMASK_G_SHIFT)
++#define DPI_DMA_OMASK_B_SHIFT	 20
++#define DPI_DMA_OMASK_B_MASK	 (0x3FF << DPI_DMA_OMASK_B_SHIFT)
++
++// Shifts
++#define DPI_DMA_SHIFT	 0x28
++#define DPI_DMA_SHIFT_IR_SHIFT	 0
++#define DPI_DMA_SHIFT_IR_MASK	 (0x1F << DPI_DMA_SHIFT_IR_SHIFT)
++#define DPI_DMA_SHIFT_IG_SHIFT	 5
++#define DPI_DMA_SHIFT_IG_MASK	 (0x1F << DPI_DMA_SHIFT_IG_SHIFT)
++#define DPI_DMA_SHIFT_IB_SHIFT	 10
++#define DPI_DMA_SHIFT_IB_MASK	 (0x1F << DPI_DMA_SHIFT_IB_SHIFT)
++#define DPI_DMA_SHIFT_OR_SHIFT	 15
++#define DPI_DMA_SHIFT_OR_MASK	 (0x1F << DPI_DMA_SHIFT_OR_SHIFT)
++#define DPI_DMA_SHIFT_OG_SHIFT	 20
++#define DPI_DMA_SHIFT_OG_MASK	 (0x1F << DPI_DMA_SHIFT_OG_SHIFT)
++#define DPI_DMA_SHIFT_OB_SHIFT	 25
++#define DPI_DMA_SHIFT_OB_MASK	 (0x1F << DPI_DMA_SHIFT_OB_SHIFT)
++
++// Scaling
++#define DPI_DMA_RGBSZ	 0x34
++#define DPI_DMA_RGBSZ_BPP_SHIFT	 16
++#define DPI_DMA_RGBSZ_BPP_MASK	 (0x3 << DPI_DMA_RGBSZ_BPP_SHIFT)
++#define DPI_DMA_RGBSZ_R_SHIFT	 0
++#define DPI_DMA_RGBSZ_R_MASK	 (0xF << DPI_DMA_RGBSZ_R_SHIFT)
++#define DPI_DMA_RGBSZ_G_SHIFT	 4
++#define DPI_DMA_RGBSZ_G_MASK	 (0xF << DPI_DMA_RGBSZ_G_SHIFT)
++#define DPI_DMA_RGBSZ_B_SHIFT	 8
++#define DPI_DMA_RGBSZ_B_MASK	 (0xF << DPI_DMA_RGBSZ_B_SHIFT)
++
++// Status
++#define DPI_DMA_STATUS  0x3c
++
++#define BITS(field, val) (((val) << (field ## _SHIFT)) & (field ## _MASK))
++
++static unsigned int rp1dpi_hw_read(struct rp1_dpi *dpi, unsigned int reg)
++{
++	void __iomem *addr = dpi->hw_base[RP1DPI_HW_BLOCK_DPI] + reg;
++
++	return readl(addr);
++}
++
++static void rp1dpi_hw_write(struct rp1_dpi *dpi, unsigned int reg, unsigned int val)
++{
++	void __iomem *addr = dpi->hw_base[RP1DPI_HW_BLOCK_DPI] + reg;
++
++	writel(val, addr);
++}
++
++int rp1dpi_hw_busy(struct rp1_dpi *dpi)
++{
++	return (rp1dpi_hw_read(dpi, DPI_DMA_STATUS) & 0xF8F) ? 1 : 0;
++}
++
++/* Table of supported input (in-memory/DMA) pixel formats. */
++struct rp1dpi_ipixfmt {
++	u32 format; /* DRM format code                           */
++	u32 mask;   /* RGB masks (10 bits each, left justified)  */
++	u32 shift;  /* RGB MSB positions in the memory word      */
++	u32 rgbsz;  /* Shifts used for scaling; also (BPP/8-1)   */
++};
++
++#define IMASK_RGB(r, g, b)	(BITS(DPI_DMA_IMASK_R, r)  | \
++				 BITS(DPI_DMA_IMASK_G, g)  | \
++				 BITS(DPI_DMA_IMASK_B, b))
++#define OMASK_RGB(r, g, b)	(BITS(DPI_DMA_OMASK_R, r)  | \
++				 BITS(DPI_DMA_OMASK_G, g)  | \
++				 BITS(DPI_DMA_OMASK_B, b))
++#define ISHIFT_RGB(r, g, b)	(BITS(DPI_DMA_SHIFT_IR, r) | \
++				 BITS(DPI_DMA_SHIFT_IG, g) | \
++				 BITS(DPI_DMA_SHIFT_IB, b))
++#define OSHIFT_RGB(r, g, b)	(BITS(DPI_DMA_SHIFT_OR, r) | \
++				 BITS(DPI_DMA_SHIFT_OG, g) | \
++				 BITS(DPI_DMA_SHIFT_OB, b))
++
++static const struct rp1dpi_ipixfmt my_formats[] = {
++	{
++	  .format = DRM_FORMAT_XRGB8888,
++	  .mask	  = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
++	  .shift  = ISHIFT_RGB(23, 15, 7),
++	  .rgbsz  = BITS(DPI_DMA_RGBSZ_BPP, 3),
++	},
++	{
++	  .format = DRM_FORMAT_XBGR8888,
++	  .mask	  = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
++	  .shift  = ISHIFT_RGB(7, 15, 23),
++	  .rgbsz  = BITS(DPI_DMA_RGBSZ_BPP, 3),
++	},
++	{
++	  .format = DRM_FORMAT_ARGB8888,
++	  .mask	  = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
++	  .shift  = ISHIFT_RGB(23, 15, 7),
++	  .rgbsz  = BITS(DPI_DMA_RGBSZ_BPP, 3),
++	},
++	{
++	  .format = DRM_FORMAT_ABGR8888,
++	  .mask	  = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
++	  .shift  = ISHIFT_RGB(7, 15, 23),
++	  .rgbsz  = BITS(DPI_DMA_RGBSZ_BPP, 3),
++	},
++	{
++	  .format = DRM_FORMAT_RGB888,
++	  .mask	  = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
++	  .shift  = ISHIFT_RGB(23, 15, 7),
++	  .rgbsz  = BITS(DPI_DMA_RGBSZ_BPP, 2),
++	},
++	{
++	  .format = DRM_FORMAT_BGR888,
++	  .mask	  = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
++	  .shift  = ISHIFT_RGB(7, 15, 23),
++	  .rgbsz  = BITS(DPI_DMA_RGBSZ_BPP, 2),
++	},
++	{
++	  .format = DRM_FORMAT_RGB565,
++	  .mask	  = IMASK_RGB(0x3e0, 0x3f0, 0x3e0),
++	  .shift  = ISHIFT_RGB(15, 10, 4),
++	  .rgbsz  = BITS(DPI_DMA_RGBSZ_R, 5) | BITS(DPI_DMA_RGBSZ_G, 6) |
++		    BITS(DPI_DMA_RGBSZ_B, 5) | BITS(DPI_DMA_RGBSZ_BPP, 1),
++	},
++	{
++	  .format = DRM_FORMAT_BGR565,
++	  .mask	  = IMASK_RGB(0x3e0, 0x3f0, 0x3e0),
++	  .shift  = ISHIFT_RGB(4, 10, 15),
++	  .rgbsz  = BITS(DPI_DMA_RGBSZ_R, 5) | BITS(DPI_DMA_RGBSZ_G, 6) |
++		    BITS(DPI_DMA_RGBSZ_B, 5) | BITS(DPI_DMA_RGBSZ_BPP, 1),
++	}
++};
++
++static u32 set_output_format(u32 bus_format, u32 *shift, u32 *imask, u32 *rgbsz)
++{
++	switch (bus_format) {
++	case MEDIA_BUS_FMT_RGB565_1X16:
++		if (*shift == ISHIFT_RGB(15, 10, 4)) {
++			/* When framebuffer is RGB565, we can output RGB565 */
++			*shift = ISHIFT_RGB(15, 7, 0) | OSHIFT_RGB(19, 9, 0);
++			*rgbsz &= DPI_DMA_RGBSZ_BPP_MASK;
++			return OMASK_RGB(0x3fc, 0x3fc, 0);
++		}
++
++		/* due to a HW limitation, bit-depth is effectively RGB535 */
++		*shift |= OSHIFT_RGB(19, 14, 6);
++		*imask &= IMASK_RGB(0x3e0, 0x380, 0x3e0);
++		*rgbsz = BITS(DPI_DMA_RGBSZ_G, 5) | (*rgbsz & DPI_DMA_RGBSZ_BPP_MASK);
++		return OMASK_RGB(0x3e0, 0x39c, 0x3e0);
++
++	case MEDIA_BUS_FMT_RGB666_1X18:
++	case MEDIA_BUS_FMT_BGR666_1X18:
++		/* due to a HW limitation, bit-depth is effectively RGB444 */
++		*shift |= OSHIFT_RGB(23, 15, 7);
++		*imask &= IMASK_RGB(0x3c0, 0x3c0, 0x3c0);
++		*rgbsz = BITS(DPI_DMA_RGBSZ_R, 2) | (*rgbsz & DPI_DMA_RGBSZ_BPP_MASK);
++		return OMASK_RGB(0x330, 0x3c0, 0x3c0);
++
++	case MEDIA_BUS_FMT_RGB888_1X24:
++	case MEDIA_BUS_FMT_BGR888_1X24:
++	case MEDIA_BUS_FMT_RGB101010_1X30:
++		/* The full 24 bits can be output. Note that RP1's internal wiring means
++		 * that 8.8.8 to GPIO pads can share with 10.10.10 to the onboard VDAC.
++		 */
++		*shift |= OSHIFT_RGB(29, 19, 9);
++		return OMASK_RGB(0x3fc, 0x3fc, 0x3fc);
++
++	case MEDIA_BUS_FMT_RGB565_1X24_CPADHI:
++		/* This should match Raspberry Pi legacy "mode 3" */
++		*shift |= OSHIFT_RGB(26, 17, 6);
++		*rgbsz &= DPI_DMA_RGBSZ_BPP_MASK;
++		return OMASK_RGB(0x3e0, 0x3f0, 0x3e0);
++
++	default:
++		/* RGB666_1x24_CPADHI, BGR666_1X24_CPADHI and "mode 4" formats */
++		*shift |= OSHIFT_RGB(27, 17, 7);
++		*rgbsz &= DPI_DMA_RGBSZ_BPP_MASK;
++		return OMASK_RGB(0x3f0, 0x3f0, 0x3f0);
++	}
++}
++
++#define BUS_FMT_IS_BGR(fmt) (				       \
++		((fmt) == MEDIA_BUS_FMT_BGR666_1X18)        || \
++		((fmt) == MEDIA_BUS_FMT_BGR666_1X24_CPADHI) || \
++		((fmt) == MEDIA_BUS_FMT_BGR888_1X24))
++
++void rp1dpi_hw_setup(struct rp1_dpi *dpi,
++		     u32 in_format, u32 bus_format, bool de_inv,
++		    struct drm_display_mode const *mode)
++{
++	u32 shift, imask, omask, rgbsz;
++	int i;
++
++	pr_info("%s: in_fmt=\'%c%c%c%c\' bus_fmt=0x%x mode=%dx%d total=%dx%d %dkHz %cH%cV%cD%cC",
++		__func__, in_format, in_format >> 8, in_format >> 16, in_format >> 24, bus_format,
++		mode->hdisplay, mode->vdisplay,
++		mode->htotal, mode->vtotal,
++		mode->clock,
++		(mode->flags & DRM_MODE_FLAG_NHSYNC) ? '-' : '+',
++		(mode->flags & DRM_MODE_FLAG_NVSYNC) ? '-' : '+',
++		de_inv ? '-' : '+',
++		dpi->clk_inv ? '-' : '+');
++
++	/*
++	 * Configure all DPI/DMA block registers, except base address.
++	 * DMA will not actually start until a FB base address is specified
++	 * using rp1dpi_hw_update().
++	 */
++	rp1dpi_hw_write(dpi, DPI_DMA_VISIBLE_AREA,
++			BITS(DPI_DMA_VISIBLE_AREA_ROWSM1, mode->vdisplay - 1) |
++			BITS(DPI_DMA_VISIBLE_AREA_COLSM1, mode->hdisplay - 1));
++
++	rp1dpi_hw_write(dpi, DPI_DMA_SYNC_WIDTH,
++			BITS(DPI_DMA_SYNC_WIDTH_ROWSM1, mode->vsync_end - mode->vsync_start - 1) |
++			BITS(DPI_DMA_SYNC_WIDTH_COLSM1, mode->hsync_end - mode->hsync_start - 1));
++
++	/* In these registers, "back porch" time includes sync width */
++	rp1dpi_hw_write(dpi, DPI_DMA_BACK_PORCH,
++			BITS(DPI_DMA_BACK_PORCH_ROWSM1, mode->vtotal - mode->vsync_start - 1) |
++			BITS(DPI_DMA_BACK_PORCH_COLSM1, mode->htotal - mode->hsync_start - 1));
++
++	rp1dpi_hw_write(dpi, DPI_DMA_FRONT_PORCH,
++			BITS(DPI_DMA_FRONT_PORCH_ROWSM1, mode->vsync_start - mode->vdisplay - 1) |
++			BITS(DPI_DMA_FRONT_PORCH_COLSM1, mode->hsync_start - mode->hdisplay - 1));
++
++	/* Input to output pixel format conversion */
++	for (i = 0; i < ARRAY_SIZE(my_formats); ++i) {
++		if (my_formats[i].format == in_format)
++			break;
++	}
++	if (i >= ARRAY_SIZE(my_formats)) {
++		pr_err("%s: bad input format\n", __func__);
++		i = 4;
++	}
++	if (BUS_FMT_IS_BGR(bus_format))
++		i ^= 1;
++	shift = my_formats[i].shift;
++	imask = my_formats[i].mask;
++	rgbsz = my_formats[i].rgbsz;
++	omask = set_output_format(bus_format, &shift, &imask, &rgbsz);
++
++	rp1dpi_hw_write(dpi, DPI_DMA_IMASK, imask);
++	rp1dpi_hw_write(dpi, DPI_DMA_OMASK, omask);
++	rp1dpi_hw_write(dpi, DPI_DMA_SHIFT, shift);
++	rp1dpi_hw_write(dpi, DPI_DMA_RGBSZ, rgbsz);
++
++	rp1dpi_hw_write(dpi, DPI_DMA_QOS,
++			BITS(DPI_DMA_QOS_DQOS, 0x0) |
++			BITS(DPI_DMA_QOS_ULEV, 0xb) |
++			BITS(DPI_DMA_QOS_UQOS, 0x2) |
++			BITS(DPI_DMA_QOS_LLEV, 0x8) |
++			BITS(DPI_DMA_QOS_LQOS, 0x7));
++
++	rp1dpi_hw_write(dpi, DPI_DMA_IRQ_FLAGS, -1);
++	rp1dpi_hw_vblank_ctrl(dpi, 1);
++
++	i = rp1dpi_hw_busy(dpi);
++	if (i)
++		pr_warn("%s: Unexpectedly busy at start!", __func__);
++
++	rp1dpi_hw_write(dpi, DPI_DMA_CONTROL,
++			BITS(DPI_DMA_CONTROL_ARM,          !i) |
++			BITS(DPI_DMA_CONTROL_AUTO_REPEAT,   1) |
++			BITS(DPI_DMA_CONTROL_HIGH_WATER,  448) |
++			BITS(DPI_DMA_CONTROL_DEN_POL,  de_inv) |
++			BITS(DPI_DMA_CONTROL_HSYNC_POL, !!(mode->flags & DRM_MODE_FLAG_NHSYNC)) |
++			BITS(DPI_DMA_CONTROL_VSYNC_POL, !!(mode->flags & DRM_MODE_FLAG_NVSYNC)) |
++			BITS(DPI_DMA_CONTROL_COLORM,	   0) |
++			BITS(DPI_DMA_CONTROL_SHUTDN,	   0) |
++			BITS(DPI_DMA_CONTROL_HBP_EN,    (mode->htotal != mode->hsync_end))      |
++			BITS(DPI_DMA_CONTROL_HFP_EN,    (mode->hsync_start != mode->hdisplay))  |
++			BITS(DPI_DMA_CONTROL_VBP_EN,    (mode->vtotal != mode->vsync_end))      |
++			BITS(DPI_DMA_CONTROL_VFP_EN,    (mode->vsync_start != mode->vdisplay))  |
++			BITS(DPI_DMA_CONTROL_HSYNC_EN,  (mode->hsync_end != mode->hsync_start)) |
++			BITS(DPI_DMA_CONTROL_VSYNC_EN,  (mode->vsync_end != mode->vsync_start)));
++}
++
++void rp1dpi_hw_update(struct rp1_dpi *dpi, dma_addr_t addr, u32 offset, u32 stride)
++{
++	u64 a = addr + offset;
++
++	/*
++	 * Update STRIDE, DMAH and DMAL only. When called after rp1dpi_hw_setup(),
++	 * DMA starts immediately; if already running, the buffer will flip at
++	 * the next vertical sync event.
++	 */
++	rp1dpi_hw_write(dpi, DPI_DMA_DMA_STRIDE, stride);
++	rp1dpi_hw_write(dpi, DPI_DMA_DMA_ADDR_H, a >> 32);
++	rp1dpi_hw_write(dpi, DPI_DMA_DMA_ADDR_L, a & 0xFFFFFFFFu);
++}
++
++void rp1dpi_hw_stop(struct rp1_dpi *dpi)
++{
++	u32 ctrl;
++
++	/*
++	 * Stop DMA by turning off the Auto-Repeat flag, and wait up to 100ms for
++	 * the current and any queued frame to end. "Force drain" flags are not used,
++	 * as they seem to prevent DMA from re-starting properly; it's safer to wait.
++	 */
++	reinit_completion(&dpi->finished);
++	ctrl = rp1dpi_hw_read(dpi, DPI_DMA_CONTROL);
++	ctrl &= ~(DPI_DMA_CONTROL_ARM_MASK | DPI_DMA_CONTROL_AUTO_REPEAT_MASK);
++	rp1dpi_hw_write(dpi, DPI_DMA_CONTROL, ctrl);
++	if (!wait_for_completion_timeout(&dpi->finished, HZ / 10))
++		drm_err(&dpi->drm, "%s: timed out waiting for idle\n", __func__);
++	rp1dpi_hw_write(dpi, DPI_DMA_IRQ_EN, 0);
++}
++
++void rp1dpi_hw_vblank_ctrl(struct rp1_dpi *dpi, int enable)
++{
++	rp1dpi_hw_write(dpi, DPI_DMA_IRQ_EN,
++			BITS(DPI_DMA_IRQ_EN_AFIFO_EMPTY, 1)      |
++			BITS(DPI_DMA_IRQ_EN_UNDERFLOW, 1)        |
++			BITS(DPI_DMA_IRQ_EN_DMA_READY, !!enable) |
++			BITS(DPI_DMA_IRQ_EN_MATCH_LINE, 4095));
++}
++
++irqreturn_t rp1dpi_hw_isr(int irq, void *dev)
++{
++	struct rp1_dpi *dpi = dev;
++	u32 u = rp1dpi_hw_read(dpi, DPI_DMA_IRQ_FLAGS);
++
++	if (u) {
++		rp1dpi_hw_write(dpi, DPI_DMA_IRQ_FLAGS, u);
++		if (dpi) {
++			if (u & DPI_DMA_IRQ_FLAGS_UNDERFLOW_MASK)
++				drm_err_ratelimited(&dpi->drm,
++						    "Underflow! (panics=0x%08x)\n",
++						    rp1dpi_hw_read(dpi, DPI_DMA_PANICS));
++			if (u & DPI_DMA_IRQ_FLAGS_DMA_READY_MASK)
++				drm_crtc_handle_vblank(&dpi->pipe.crtc);
++			if (u & DPI_DMA_IRQ_FLAGS_AFIFO_EMPTY_MASK)
++				complete(&dpi->finished);
++		}
++	}
++	return u ? IRQ_HANDLED : IRQ_NONE;
++}
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0368-drm-Add-RP1-VEC-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0368-drm-Add-RP1-VEC-driver.patch
new file mode 100644
index 00000000..e5d99503
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0368-drm-Add-RP1-VEC-driver.patch
@@ -0,0 +1,3334 @@
+From 85edbc5dc2579c4358e234fe7fe83789d89c03c5 Mon Sep 17 00:00:00 2001
+From: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+Date: Tue, 19 Sep 2023 17:54:41 +0100
+Subject: [PATCH 368/697] drm: Add RP1 VEC driver
+
+Add support for the RP1 VEC hardware.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+
+drm: rp1: rp1-vec: Allow non-standard modes with various crops
+
+Tweak sync timings in the advertised modelines.
+
+Accept other, custom modes, provided they fit within the active
+area of one of the existing hardware-supported TV modes.
+
+Instead of always padding symmetrically, try to respect the user's
+[hv]sync_start values, allowing the image to be shifted around
+the screen (to fine-tune overscan correction).
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+
+drm/rp1: depends on, instead of select, MFD_RP1
+
+According to kconfig-language.txt [1], select should be used only for
+"non-visible symbols ... and for symbols with no dependencies". Since
+MFD_RP1 both is visible and has a dependency, "select" should not be
+used and "depends on" should be used instead.
+
+In particular, this fixes the build of this kernel tree on NixOS, where
+its kernel config system will try to answer 'M' to as many config as
+possible.
+
+[1] https://www.kernel.org/doc/html/latest/kbuild/kconfig-language.html
+
+Signed-off-by: Ratchanan Srirattanamet <peathot@hotmail.com>
+
+drm: rp1: Use tv_mode from the command line and fix for Linux 6.6
+
+Use the standard enum drm_connector_tv_mode instead of a private
+enum and switch from the legacy to the standard tv_mode property.
+
+Remove the module parameter "tv_norm". Instead, get tv_mode from
+the command line and make this the connector's default TV mode.
+
+Don't restrict the choice of modes based on tv_mode, but interpret
+nonstandard combinations as NTSC or PAL, depending on resolution.
+Thus the default tv_mode=NTSC effectively means "Auto".
+
+Tweak the advertised horizontal timings for 625/50 to match Rec.601
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+
+drm: rp1: VEC and DPI drivers: Fix bug #5901
+
+Rework probe() to use devm_drm_dev_alloc(), embedding the DRM
+device in the DPI or VEC device as now seems to be recommended.
+
+Change order of resource allocation and driver initialization.
+This prevents it trying to write to an unmapped register during
+clean-up, which previously could crash.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+
+drm: rp1: vec: Support more video modes in the RP1 VEC driver
+
+Support a wider range of pixel clock rates. The driver will round
+pixclock up to 108MHz/n but tries to honour the desired image width
+and position (of the centre of the display relative to HSYNC_STARTs).
+This adds complexity but removes the need for separate 13.5MHz and
+15.428MHz modes.
+
+Support "fake" double-rate progressive modes (in which only every
+2nd scanline is displayed). To work around aspect ratio issues.
+
+Add Monochrome TV mode support. Add "vintage" modes (544x380i for
+System A; 848x738i for System E) when configured for Monochrome.
+
+Add a way to create a "custom" display mode from a module parameter.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+
+drm: rp1: rp1-vec: Add DRM_FORMAT_ARGB8888 and DRM_FORMAT_ABGR8888
+
+Android requires this.
+As the underlying hardware doesn't support alpha blending,
+we ignore the alpha value.
+
+Signed-off-by: Jan Kehren <jan.kehren@emteria.com>
+
+drivers: drm: rp1-vec: Increase width limit, for PAL 16:9 @ 18MHz
+
+There was no technical reason for the DRM mode's width limit of 848;
+increase it to 960 (720*18MHz/13.5MHz) to support ~square pixels on
+16:9 screens. Tweak the PAL active window to start slightly earlier.
+(The maximum number of visible columns at 18MHz is about 942.)
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+---
+ drivers/gpu/drm/rp1/rp1-vec/Kconfig       |   11 +
+ drivers/gpu/drm/rp1/rp1-vec/Makefile      |    5 +
+ drivers/gpu/drm/rp1/rp1-vec/rp1_vec.c     |  602 +++++++++
+ drivers/gpu/drm/rp1/rp1-vec/rp1_vec.h     |   72 ++
+ drivers/gpu/drm/rp1/rp1-vec/rp1_vec_cfg.c |  508 ++++++++
+ drivers/gpu/drm/rp1/rp1-vec/rp1_vec_hw.c  |  580 +++++++++
+ drivers/gpu/drm/rp1/rp1-vec/vec_regs.h    | 1420 +++++++++++++++++++++
+ 7 files changed, 3198 insertions(+)
+ create mode 100644 drivers/gpu/drm/rp1/rp1-vec/Kconfig
+ create mode 100644 drivers/gpu/drm/rp1/rp1-vec/Makefile
+ create mode 100644 drivers/gpu/drm/rp1/rp1-vec/rp1_vec.c
+ create mode 100644 drivers/gpu/drm/rp1/rp1-vec/rp1_vec.h
+ create mode 100644 drivers/gpu/drm/rp1/rp1-vec/rp1_vec_cfg.c
+ create mode 100644 drivers/gpu/drm/rp1/rp1-vec/rp1_vec_hw.c
+ create mode 100644 drivers/gpu/drm/rp1/rp1-vec/vec_regs.h
+
+--- /dev/null
++++ b/drivers/gpu/drm/rp1/rp1-vec/Kconfig
+@@ -0,0 +1,11 @@
++# SPDX-License-Identifier: GPL-2.0-only
++config DRM_RP1_VEC
++	tristate "DRM Support for RP1 VEC"
++	depends on DRM && MFD_RP1
++	select DRM_GEM_DMA_HELPER
++	select DRM_KMS_HELPER
++	select DRM_VRAM_HELPER
++	select DRM_TTM
++	select DRM_TTM_HELPER
++	help
++	  Choose this option to enable Video Out on RP1
+--- /dev/null
++++ b/drivers/gpu/drm/rp1/rp1-vec/Makefile
+@@ -0,0 +1,5 @@
++# SPDX-License-Identifier: GPL-2.0-only
++
++drm-rp1-vec-y := rp1_vec.o rp1_vec_hw.o rp1_vec_cfg.o
++
++obj-$(CONFIG_DRM_RP1_VEC) += drm-rp1-vec.o
+--- /dev/null
++++ b/drivers/gpu/drm/rp1/rp1-vec/rp1_vec.c
+@@ -0,0 +1,602 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * DRM Driver for VEC output on Raspberry Pi RP1
++ *
++ * Copyright (c) 2023 Raspberry Pi Limited.
++ */
++
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/errno.h>
++#include <linux/string.h>
++#include <linux/slab.h>
++#include <linux/mm.h>
++#include <linux/fb.h>
++#include <linux/init.h>
++#include <linux/delay.h>
++#include <linux/interrupt.h>
++#include <linux/ioport.h>
++#include <linux/list.h>
++#include <linux/platform_device.h>
++#include <linux/clk.h>
++#include <linux/console.h>
++#include <linux/debugfs.h>
++#include <linux/uaccess.h>
++#include <linux/io.h>
++#include <linux/dma-mapping.h>
++#include <linux/cred.h>
++#include <drm/drm_drv.h>
++#include <drm/drm_mm.h>
++#include <drm/drm_fourcc.h>
++#include <drm/drm_atomic_helper.h>
++#include <drm/drm_managed.h>
++#include <drm/drm_crtc.h>
++#include <drm/drm_crtc_helper.h>
++#include <drm/drm_encoder.h>
++#include <drm/drm_fb_helper.h>
++#include <drm/drm_fbdev_ttm.h>
++#include <drm/drm_framebuffer.h>
++#include <drm/drm_gem.h>
++#include <drm/drm_gem_atomic_helper.h>
++#include <drm/drm_gem_dma_helper.h>
++#include <drm/drm_gem_framebuffer_helper.h>
++#include <drm/drm_simple_kms_helper.h>
++#include <drm/drm_probe_helper.h>
++#include <drm/drm_modeset_helper_vtables.h>
++#include <drm/drm_vblank.h>
++#include <drm/drm_of.h>
++
++#include "rp1_vec.h"
++
++/*
++ * Linux doesn't make it easy to create custom video modes for the console
++ * with non-CVT timings; so add a module parameter for it. The format is:
++ * "<pclk>,<hact>,<hfp>,<hsync>,<hbp>,<vact>,<vfp>,<vsync>,<vbp>[,i]"
++ * (where each comma may be replaced by any sequence of punctuation).
++ * pclk should be 108000/n for 5 <= n <= 16 (twice this for "fake" modes).
++ */
++
++static char *rp1vec_cmode_str;
++module_param_named(cmode, rp1vec_cmode_str, charp, 0600);
++MODULE_PARM_DESC(cmode, "Custom video mode:\n"
++		 "\t\t<pclk>,<hact>,<hfp>,<hsync>,<hbp>,<vact>,<vfp>,<vsync>,<vbp>[,i]\n");
++
++static struct drm_display_mode *rp1vec_parse_custom_mode(struct drm_device *dev)
++{
++	char const *p = rp1vec_cmode_str;
++	struct drm_display_mode *mode;
++	unsigned int n, vals[9];
++
++	if (!p)
++		return NULL;
++
++	for (n = 0; n < 9; n++) {
++		unsigned int v = 0;
++
++		if (!isdigit(*p))
++			return NULL;
++		do {
++			v = 10u * v + (*p - '0');
++		} while (isdigit(*++p));
++
++		vals[n] = v;
++		while (ispunct(*p))
++			p++;
++	}
++
++	mode = drm_mode_create(dev);
++	if (!mode)
++		return NULL;
++
++	mode->clock	  = vals[0];
++	mode->hdisplay	  = vals[1];
++	mode->hsync_start = mode->hdisplay + vals[2];
++	mode->hsync_end	  = mode->hsync_start + vals[3];
++	mode->htotal	  = mode->hsync_end + vals[4];
++	mode->vdisplay	  = vals[5];
++	mode->vsync_start = mode->vdisplay + vals[6];
++	mode->vsync_end	  = mode->vsync_start + vals[7];
++	mode->vtotal	  = mode->vsync_end + vals[8];
++	mode->type  = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
++	mode->flags = DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC;
++	if (strchr(p, 'i'))
++		mode->flags |= DRM_MODE_FLAG_INTERLACE;
++
++	return mode;
++}
++
++static void rp1vec_pipe_update(struct drm_simple_display_pipe *pipe,
++			       struct drm_plane_state *old_state)
++{
++	struct drm_pending_vblank_event *event;
++	unsigned long flags;
++	struct drm_framebuffer *fb = pipe->plane.state->fb;
++	struct rp1_vec *vec = pipe->crtc.dev->dev_private;
++	struct drm_gem_object *gem = fb ? drm_gem_fb_get_obj(fb, 0) : NULL;
++	struct drm_gem_dma_object *dma_obj = gem ? to_drm_gem_dma_obj(gem) : NULL;
++	bool can_update = fb && dma_obj && vec && vec->pipe_enabled;
++
++	/* (Re-)start VEC where required; and update FB address */
++	if (can_update) {
++		if (!vec->vec_running || fb->format->format != vec->cur_fmt) {
++			if (vec->vec_running && fb->format->format != vec->cur_fmt) {
++				rp1vec_hw_stop(vec);
++				vec->vec_running = false;
++			}
++			if (!vec->vec_running) {
++				rp1vec_hw_setup(vec,
++						fb->format->format,
++						&pipe->crtc.state->mode,
++						vec->connector.state->tv.mode);
++				vec->vec_running = true;
++			}
++			vec->cur_fmt  = fb->format->format;
++			drm_crtc_vblank_on(&pipe->crtc);
++		}
++		rp1vec_hw_update(vec, dma_obj->dma_addr, fb->offsets[0], fb->pitches[0]);
++	}
++
++	/* Check if VBLANK callback needs to be armed (or sent immediately in some error cases).
++	 * Note there is a tiny probability of a race between rp1vec_dma_update() and IRQ;
++	 * ordering it this way around is safe, but theoretically might delay an extra frame.
++	 */
++	spin_lock_irqsave(&pipe->crtc.dev->event_lock, flags);
++	event = pipe->crtc.state->event;
++	if (event) {
++		pipe->crtc.state->event = NULL;
++		if (can_update && drm_crtc_vblank_get(&pipe->crtc) == 0)
++			drm_crtc_arm_vblank_event(&pipe->crtc, event);
++		else
++			drm_crtc_send_vblank_event(&pipe->crtc, event);
++	}
++	spin_unlock_irqrestore(&pipe->crtc.dev->event_lock, flags);
++}
++
++static void rp1vec_pipe_enable(struct drm_simple_display_pipe *pipe,
++			       struct drm_crtc_state *crtc_state,
++			       struct drm_plane_state *plane_state)
++{
++	struct rp1_vec *vec = pipe->crtc.dev->dev_private;
++
++	dev_info(&vec->pdev->dev, __func__);
++	vec->pipe_enabled = true;
++	vec->cur_fmt = 0xdeadbeef;
++	rp1vec_vidout_setup(vec);
++	rp1vec_pipe_update(pipe, 0);
++}
++
++static void rp1vec_pipe_disable(struct drm_simple_display_pipe *pipe)
++{
++	struct rp1_vec *vec = pipe->crtc.dev->dev_private;
++
++	dev_info(&vec->pdev->dev, __func__);
++	drm_crtc_vblank_off(&pipe->crtc);
++	if (vec) {
++		if (vec->vec_running) {
++			rp1vec_hw_stop(vec);
++			vec->vec_running = false;
++		}
++		vec->pipe_enabled = false;
++	}
++}
++
++static int rp1vec_pipe_enable_vblank(struct drm_simple_display_pipe *pipe)
++{
++	if (pipe && pipe->crtc.dev) {
++		struct rp1_vec *vec = pipe->crtc.dev->dev_private;
++
++		if (vec)
++			rp1vec_hw_vblank_ctrl(vec, 1);
++	}
++	return 0;
++}
++
++static void rp1vec_pipe_disable_vblank(struct drm_simple_display_pipe *pipe)
++{
++	if (pipe && pipe->crtc.dev) {
++		struct rp1_vec *vec = pipe->crtc.dev->dev_private;
++
++		if (vec)
++			rp1vec_hw_vblank_ctrl(vec, 0);
++	}
++}
++
++static const struct drm_simple_display_pipe_funcs rp1vec_pipe_funcs = {
++	.enable	    = rp1vec_pipe_enable,
++	.update	    = rp1vec_pipe_update,
++	.disable    = rp1vec_pipe_disable,
++	.enable_vblank	= rp1vec_pipe_enable_vblank,
++	.disable_vblank = rp1vec_pipe_disable_vblank,
++};
++
++static void rp1vec_connector_destroy(struct drm_connector *connector)
++{
++	drm_connector_unregister(connector);
++	drm_connector_cleanup(connector);
++}
++
++/*
++ * Check the mode roughly matches something we can generate.
++ * The choice of hardware TV mode depends on total lines and frame rate.
++ * Within each hardware mode, allow pixel clock, image size and offsets
++ * to vary, up to a maximum horizontal active period and line count.
++ * Don't check sync timings here: the HW driver will sanitize them.
++ */
++
++static enum drm_mode_status rp1vec_mode_valid(struct drm_device *dev,
++					      const struct drm_display_mode *mode)
++{
++	int prog	  = !(mode->flags & DRM_MODE_FLAG_INTERLACE);
++	int fake_31khz	  = prog && mode->vtotal >= 500;
++	int vtotal_2fld	  = mode->vtotal << (prog && !fake_31khz);
++	int vdisplay_2fld = mode->vdisplay << (prog && !fake_31khz);
++	int real_clock	  = mode->clock >> fake_31khz;
++
++	/* Check pixel clock is in the permitted range */
++	if (real_clock < 6750)
++		return MODE_CLOCK_LOW;
++	else if (real_clock > 21600)
++		return MODE_CLOCK_HIGH;
++
++	/* Try to match against the 525-line 60Hz mode (System M) */
++	if (vtotal_2fld >= 524 && vtotal_2fld <= 526 && vdisplay_2fld <= 486 &&
++	    mode->htotal * vtotal_2fld > 32 * real_clock &&
++	    mode->htotal * vtotal_2fld < 34 * real_clock &&
++	    37 * mode->hdisplay <= 2 * real_clock) /* 54us */
++		return MODE_OK;
++
++	/* All other supported TV Systems (625-, 405-, 819-line) are 50Hz */
++	if (mode->htotal * vtotal_2fld > 39 * real_clock &&
++	    mode->htotal * vtotal_2fld < 41 * real_clock) {
++		if (vtotal_2fld >= 624 && vtotal_2fld <= 626 && vdisplay_2fld <= 576 &&
++		    37 * mode->hdisplay <= 2 * real_clock) /* 54us */
++			return MODE_OK;
++
++		if (vtotal_2fld == 405 && vdisplay_2fld <= 380 &&
++		    49 * mode->hdisplay <= 4 * real_clock) /* 81.6us */
++			return MODE_OK;
++
++		if (vtotal_2fld == 819 && vdisplay_2fld <= 738 &&
++		    25 * mode->hdisplay <= real_clock) /* 40us */
++			return MODE_OK;
++	}
++
++	return MODE_BAD;
++}
++
++static const struct drm_display_mode rp1vec_modes[6] = {
++	{ /* Full size 525/60i with Rec.601 pixel rate */
++		DRM_MODE("720x480i", DRM_MODE_TYPE_DRIVER, 13500,
++			 720, 720 + 16, 720 + 16 + 64, 858, 0,
++			 480, 480 + 6, 480 + 6 + 6, 525, 0,
++			 DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC |
++			 DRM_MODE_FLAG_INTERLACE)
++	},
++	{ /* Cropped and horizontally squashed to be TV-safe */
++		DRM_MODE("704x432i", DRM_MODE_TYPE_DRIVER, 15429,
++			 704, 704 + 76, 704 + 76 + 72, 980, 0,
++			 432, 432 + 30, 432 + 30 + 6, 525, 0,
++			 DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC |
++			 DRM_MODE_FLAG_INTERLACE)
++	},
++	{ /* Full size 625/50i with Rec.601 pixel rate */
++		DRM_MODE("720x576i", DRM_MODE_TYPE_DRIVER, 13500,
++			 720, 720 + 12, 720 + 12 + 64, 864, 0,
++			 576, 576 + 5, 576 + 5 + 5, 625, 0,
++			 DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC |
++			 DRM_MODE_FLAG_INTERLACE)
++	},
++	{ /* Cropped and squashed, for square(ish) pixels */
++		DRM_MODE("704x512i", DRM_MODE_TYPE_DRIVER, 15429,
++			 704, 704 + 72, 704 + 72 + 72, 987, 0,
++			 512, 512 + 37, 512 + 37 + 5, 625, 0,
++			 DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC |
++			 DRM_MODE_FLAG_INTERLACE)
++	},
++	{ /* System A (405 lines) */
++		DRM_MODE("544x380i", DRM_MODE_TYPE_DRIVER, 6750,
++			 544, 544 + 12, 544 + 12 + 60, 667, 0,
++			 380, 380 + 0,	380 + 0 + 8, 405, 0,
++			 DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC |
++			 DRM_MODE_FLAG_INTERLACE)
++	},
++	{ /* System E (819 lines) */
++		DRM_MODE("848x738i", DRM_MODE_TYPE_DRIVER, 21600,
++			 848, 848 + 12, 848 + 12 + 54, 1055, 0,
++			 738, 738 + 6, 738 + 6 + 1, 819, 0,
++			 DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC |
++			 DRM_MODE_FLAG_INTERLACE)
++	}
++};
++
++/*
++ * Advertise a custom mode, if specified; then those from the table above.
++ * From each interlaced mode above, derive a half-height progressive one.
++ *
++ * This driver always supports all 525-line and 625-line standard modes
++ * regardless of connector's tv_mode; non-standard combinations generally
++ * default to PAL[-BDGHIK] or NTSC[-M] (with a special case for "PAL60").
++ *
++ * The "vintage" standards (System A, System E) are advertised only when
++ * the default tv_mode was DRM_MODE_TV_MODE_MONOCHROME, and only interlaced.
++ */
++
++static int rp1vec_connector_get_modes(struct drm_connector *connector)
++{
++	u64 tvstd;
++	int i, prog, limit, n = 0, preferred_lines = 525;
++	struct drm_display_mode *mode;
++
++	if (!drm_object_property_get_default_value(&connector->base,
++						   connector->dev->mode_config.tv_mode_property,
++						   &tvstd))
++		preferred_lines = (tvstd == DRM_MODE_TV_MODE_PAL   ||
++				   tvstd == DRM_MODE_TV_MODE_PAL_N ||
++				   tvstd >= DRM_MODE_TV_MODE_SECAM) ? 625 : 525;
++
++	mode = rp1vec_parse_custom_mode(connector->dev);
++	if (mode) {
++		if (rp1vec_mode_valid(connector->dev, mode) == 0) {
++			drm_mode_set_name(mode);
++			drm_mode_probed_add(connector, mode);
++			n++;
++			preferred_lines = 0;
++		} else {
++			drm_mode_destroy(connector->dev, mode);
++		}
++	}
++
++	limit = (tvstd < DRM_MODE_TV_MODE_MONOCHROME) ? 4 : ARRAY_SIZE(rp1vec_modes);
++	for (i = 0; i < limit; i++) {
++		for (prog = 0; prog < 2; prog++) {
++			mode = drm_mode_duplicate(connector->dev, &rp1vec_modes[i]);
++			if (!mode)
++				return n;
++
++			if (prog) {
++				mode->flags &= ~DRM_MODE_FLAG_INTERLACE;
++				mode->vdisplay	  >>= 1;
++				mode->vsync_start >>= 1;
++				mode->vsync_end	  >>= 1;
++				mode->vtotal	  >>= 1;
++			} else if (mode->hdisplay == 704 && mode->vtotal == preferred_lines) {
++				mode->type |= DRM_MODE_TYPE_PREFERRED;
++			}
++			drm_mode_set_name(mode);
++			drm_mode_probed_add(connector, mode);
++			n++;
++
++			if (mode->vtotal == 405 || mode->vtotal == 819)
++				break; /* Don't offer progressive for Systems A, E */
++		}
++	}
++
++	return n;
++}
++
++static void rp1vec_connector_reset(struct drm_connector *connector)
++{
++	drm_atomic_helper_connector_reset(connector);
++	drm_atomic_helper_connector_tv_reset(connector);
++}
++
++static int rp1vec_connector_atomic_check(struct drm_connector *conn,
++					 struct drm_atomic_state *state)
++{	struct drm_connector_state *old_state =
++		drm_atomic_get_old_connector_state(state, conn);
++	struct drm_connector_state *new_state =
++		drm_atomic_get_new_connector_state(state, conn);
++
++	if (new_state->crtc && old_state->tv.mode != new_state->tv.mode) {
++		struct drm_crtc_state *crtc_state =
++			drm_atomic_get_new_crtc_state(state, new_state->crtc);
++
++		crtc_state->mode_changed = true;
++	}
++
++	return 0;
++}
++
++static const struct drm_connector_helper_funcs rp1vec_connector_helper_funcs = {
++	.get_modes = rp1vec_connector_get_modes,
++	.atomic_check = rp1vec_connector_atomic_check,
++};
++
++static const struct drm_connector_funcs rp1vec_connector_funcs = {
++	.fill_modes = drm_helper_probe_single_connector_modes,
++	.destroy = rp1vec_connector_destroy,
++	.reset = rp1vec_connector_reset,
++	.atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
++	.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
++};
++
++static const struct drm_mode_config_funcs rp1vec_mode_funcs = {
++	.fb_create = drm_gem_fb_create,
++	.atomic_check = drm_atomic_helper_check,
++	.atomic_commit = drm_atomic_helper_commit,
++	.mode_valid = rp1vec_mode_valid,
++};
++
++static const u32 rp1vec_formats[] = {
++	DRM_FORMAT_XRGB8888,
++	DRM_FORMAT_XBGR8888,
++	DRM_FORMAT_ARGB8888,
++	DRM_FORMAT_ABGR8888,
++	DRM_FORMAT_RGB888,
++	DRM_FORMAT_BGR888,
++	DRM_FORMAT_RGB565
++};
++
++static void rp1vec_stopall(struct drm_device *drm)
++{
++	if (drm->dev_private) {
++		struct rp1_vec *vec = drm->dev_private;
++
++		if (vec->vec_running || rp1vec_hw_busy(vec)) {
++			rp1vec_hw_stop(vec);
++			vec->vec_running = false;
++		}
++		rp1vec_vidout_poweroff(vec);
++	}
++}
++
++DEFINE_DRM_GEM_DMA_FOPS(rp1vec_fops);
++
++static struct drm_driver rp1vec_driver = {
++	.driver_features	= DRIVER_GEM | DRIVER_MODESET | DRIVER_ATOMIC,
++	.fops			= &rp1vec_fops,
++	.name			= "drm-rp1-vec",
++	.desc			= "drm-rp1-vec",
++	.date			= "0",
++	.major			= 1,
++	.minor			= 0,
++	DRM_GEM_DMA_DRIVER_OPS,
++	.release		= rp1vec_stopall,
++};
++
++static int rp1vec_platform_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct rp1_vec *vec;
++	int i, ret;
++
++	dev_info(dev, __func__);
++	vec = devm_drm_dev_alloc(dev, &rp1vec_driver, struct rp1_vec, drm);
++	if (IS_ERR(vec)) {
++		ret = PTR_ERR(vec);
++		dev_err(dev, "%s devm_drm_dev_alloc %d", __func__, ret);
++		return ret;
++	}
++	vec->pdev = pdev;
++
++	for (i = 0; i < RP1VEC_NUM_HW_BLOCKS; i++) {
++		vec->hw_base[i] =
++			devm_ioremap_resource(dev,
++					      platform_get_resource(vec->pdev, IORESOURCE_MEM, i));
++		if (IS_ERR(vec->hw_base[i])) {
++			ret = PTR_ERR(vec->hw_base[i]);
++			dev_err(dev, "Error memory mapping regs[%d]\n", i);
++			goto done_err;
++		}
++	}
++	ret = platform_get_irq(vec->pdev, 0);
++	if (ret > 0)
++		ret = devm_request_irq(dev, ret, rp1vec_hw_isr,
++				       IRQF_SHARED, "rp1-vec", vec);
++	if (ret) {
++		dev_err(dev, "Unable to request interrupt\n");
++		ret = -EINVAL;
++		goto done_err;
++	}
++
++	vec->vec_clock = devm_clk_get(dev, NULL);
++	if (IS_ERR(vec->vec_clock)) {
++		ret = PTR_ERR(vec->vec_clock);
++		goto done_err;
++	}
++	ret = clk_prepare_enable(vec->vec_clock);
++
++	ret = drmm_mode_config_init(&vec->drm);
++	if (ret)
++		goto done_err;
++
++	/* Now we have all our resources, finish driver initialization */
++	dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64));
++	init_completion(&vec->finished);
++	vec->drm.dev_private = vec;
++	platform_set_drvdata(pdev, &vec->drm);
++
++	vec->drm.mode_config.min_width	= 256;
++	vec->drm.mode_config.min_height = 128;
++	vec->drm.mode_config.max_width	= 960; /* for "widescreen" @ 18MHz */
++	vec->drm.mode_config.max_height = 738; /* for System E only */
++	vec->drm.mode_config.preferred_depth = 32;
++	vec->drm.mode_config.prefer_shadow = 0;
++	vec->drm.mode_config.quirk_addfb_prefer_host_byte_order = true;
++	vec->drm.mode_config.funcs = &rp1vec_mode_funcs;
++	drm_vblank_init(&vec->drm, 1);
++
++	ret = drm_mode_create_tv_properties(&vec->drm, RP1VEC_SUPPORTED_TV_MODES);
++	if (ret)
++		goto done_err;
++
++	drm_connector_init(&vec->drm, &vec->connector, &rp1vec_connector_funcs,
++			   DRM_MODE_CONNECTOR_Composite);
++	if (ret)
++		goto done_err;
++
++	vec->connector.interlace_allowed = true;
++	drm_connector_helper_add(&vec->connector, &rp1vec_connector_helper_funcs);
++
++	drm_object_attach_property(&vec->connector.base,
++				   vec->drm.mode_config.tv_mode_property,
++				   (vec->connector.cmdline_mode.tv_mode_specified) ?
++					   vec->connector.cmdline_mode.tv_mode :
++					   DRM_MODE_TV_MODE_NTSC);
++
++	ret = drm_simple_display_pipe_init(&vec->drm,
++					   &vec->pipe,
++					   &rp1vec_pipe_funcs,
++					   rp1vec_formats,
++					   ARRAY_SIZE(rp1vec_formats),
++					   NULL,
++					   &vec->connector);
++	if (ret)
++		goto done_err;
++
++	drm_mode_config_reset(&vec->drm);
++
++	ret = drm_dev_register(&vec->drm, 0);
++	if (ret)
++		goto done_err;
++
++	drm_fbdev_ttm_setup(&vec->drm, 32);
++	return ret;
++
++done_err:
++	dev_err(dev, "%s fail %d", __func__, ret);
++	return ret;
++}
++
++static void rp1vec_platform_remove(struct platform_device *pdev)
++{
++	struct drm_device *drm = platform_get_drvdata(pdev);
++
++	rp1vec_stopall(drm);
++	drm_dev_unregister(drm);
++	drm_atomic_helper_shutdown(drm);
++	drm_dev_put(drm);
++}
++
++static void rp1vec_platform_shutdown(struct platform_device *pdev)
++{
++	struct drm_device *drm = platform_get_drvdata(pdev);
++
++	rp1vec_stopall(drm);
++}
++
++static const struct of_device_id rp1vec_of_match[] = {
++	{
++		.compatible = "raspberrypi,rp1vec",
++	},
++	{ /* sentinel */ },
++};
++
++MODULE_DEVICE_TABLE(of, rp1vec_of_match);
++
++static struct platform_driver rp1vec_platform_driver = {
++	.probe		= rp1vec_platform_probe,
++	.remove		= rp1vec_platform_remove,
++	.shutdown	= rp1vec_platform_shutdown,
++	.driver		= {
++		.name	= DRIVER_NAME,
++		.owner	= THIS_MODULE,
++		.of_match_table = rp1vec_of_match,
++	},
++};
++
++module_platform_driver(rp1vec_platform_driver);
++
++MODULE_LICENSE("GPL");
++MODULE_DESCRIPTION("DRM driver for Composite Video on Raspberry Pi RP1");
++MODULE_AUTHOR("Nick Hollinghurst");
+--- /dev/null
++++ b/drivers/gpu/drm/rp1/rp1-vec/rp1_vec.h
+@@ -0,0 +1,72 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * DRM Driver for DSI output on Raspberry Pi RP1
++ *
++ * Copyright (c) 2023 Raspberry Pi Limited.
++ */
++
++#include <linux/types.h>
++#include <linux/io.h>
++#include <linux/clk.h>
++#include <drm/drm_device.h>
++#include <drm/drm_simple_kms_helper.h>
++
++#define MODULE_NAME "drm-rp1-vec"
++#define DRIVER_NAME "drm-rp1-vec"
++
++/* ---------------------------------------------------------------------- */
++
++#define RP1VEC_HW_BLOCK_VEC   0
++#define RP1VEC_HW_BLOCK_CFG   1
++#define RP1VEC_NUM_HW_BLOCKS  2
++
++#define RP1VEC_SUPPORTED_TV_MODES	  \
++	(BIT(DRM_MODE_TV_MODE_NTSC)	| \
++	 BIT(DRM_MODE_TV_MODE_NTSC_443) | \
++	 BIT(DRM_MODE_TV_MODE_NTSC_J)	| \
++	 BIT(DRM_MODE_TV_MODE_PAL)	| \
++	 BIT(DRM_MODE_TV_MODE_PAL_M)	| \
++	 BIT(DRM_MODE_TV_MODE_PAL_N)	| \
++	 BIT(DRM_MODE_TV_MODE_MONOCHROME))
++
++#define RP1VEC_VDAC_KHZ 108000
++
++/* ---------------------------------------------------------------------- */
++
++struct rp1_vec {
++	/* DRM base and platform device pointer */
++	struct drm_device drm;
++	struct platform_device *pdev;
++
++	/* Framework and helper objects */
++	struct drm_simple_display_pipe pipe;
++	struct drm_connector connector;
++
++	/* Clock. We assume this is always at 108 MHz. */
++	struct clk *vec_clock;
++
++	/* Block (VCC, CFG) base addresses, and current state */
++	void __iomem *hw_base[RP1VEC_NUM_HW_BLOCKS];
++	u32 cur_fmt;
++	bool fake_31khz, vec_running, pipe_enabled;
++	struct completion finished;
++};
++
++/* ---------------------------------------------------------------------- */
++/* Functions to control the VEC/DMA block				  */
++
++void rp1vec_hw_setup(struct rp1_vec *vec,
++		     u32 in_format,
++		     struct drm_display_mode const *mode,
++		     int tvstd);
++void rp1vec_hw_update(struct rp1_vec *vec, dma_addr_t addr, u32 offset, u32 stride);
++void rp1vec_hw_stop(struct rp1_vec *vec);
++int rp1vec_hw_busy(struct rp1_vec *vec);
++irqreturn_t rp1vec_hw_isr(int irq, void *dev);
++void rp1vec_hw_vblank_ctrl(struct rp1_vec *vec, int enable);
++
++/* ---------------------------------------------------------------------- */
++/* Functions to control the VIDEO OUT CFG block and check RP1 platform	  */
++
++void rp1vec_vidout_setup(struct rp1_vec *vec);
++void rp1vec_vidout_poweroff(struct rp1_vec *vec);
+--- /dev/null
++++ b/drivers/gpu/drm/rp1/rp1-vec/rp1_vec_cfg.c
+@@ -0,0 +1,508 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * DRM Driver for DSI output on Raspberry Pi RP1
++ *
++ * Copyright (c) 2023 Raspberry Pi Limited.
++ */
++
++#include <linux/kernel.h>
++#include <linux/errno.h>
++#include <linux/mm.h>
++#include <linux/delay.h>
++#include <linux/interrupt.h>
++#include <linux/platform_device.h>
++#include <linux/printk.h>
++#include <linux/rp1_platform.h>
++
++#include "rp1_vec.h"
++
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_SEL
++// JTAG access : synchronous
++// Description : Selects source: VEC or DPI
++#define VIDEO_OUT_CFG_SEL_OFFSET 0x00000000
++#define VIDEO_OUT_CFG_SEL_BITS	 0x00000013
++#define VIDEO_OUT_CFG_SEL_RESET	 0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_SEL_PCLK_INV
++// Description : Select dpi_pclk output port polarity inversion.
++#define VIDEO_OUT_CFG_SEL_PCLK_INV_RESET  0x0
++#define VIDEO_OUT_CFG_SEL_PCLK_INV_BITS	  0x00000010
++#define VIDEO_OUT_CFG_SEL_PCLK_INV_MSB	  4
++#define VIDEO_OUT_CFG_SEL_PCLK_INV_LSB	  4
++#define VIDEO_OUT_CFG_SEL_PCLK_INV_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_SEL_PAD_MUX
++// Description : VEC 1 DPI 0
++#define VIDEO_OUT_CFG_SEL_PAD_MUX_RESET	 0x0
++#define VIDEO_OUT_CFG_SEL_PAD_MUX_BITS	 0x00000002
++#define VIDEO_OUT_CFG_SEL_PAD_MUX_MSB	 1
++#define VIDEO_OUT_CFG_SEL_PAD_MUX_LSB	 1
++#define VIDEO_OUT_CFG_SEL_PAD_MUX_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_SEL_VDAC_MUX
++// Description : VEC 1 DPI 0
++#define VIDEO_OUT_CFG_SEL_VDAC_MUX_RESET  0x0
++#define VIDEO_OUT_CFG_SEL_VDAC_MUX_BITS	  0x00000001
++#define VIDEO_OUT_CFG_SEL_VDAC_MUX_MSB	  0
++#define VIDEO_OUT_CFG_SEL_VDAC_MUX_LSB	  0
++#define VIDEO_OUT_CFG_SEL_VDAC_MUX_ACCESS "RW"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_VDAC_CFG
++// JTAG access : synchronous
++// Description : Configure SNPS VDAC
++#define VIDEO_OUT_CFG_VDAC_CFG_OFFSET 0x00000004
++#define VIDEO_OUT_CFG_VDAC_CFG_BITS   0x1fffffff
++#define VIDEO_OUT_CFG_VDAC_CFG_RESET  0x0003ffff
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_VDAC_CFG_ENCTR
++// Description : None
++#define VIDEO_OUT_CFG_VDAC_CFG_ENCTR_RESET  0x0
++#define VIDEO_OUT_CFG_VDAC_CFG_ENCTR_BITS   0x1c000000
++#define VIDEO_OUT_CFG_VDAC_CFG_ENCTR_MSB    28
++#define VIDEO_OUT_CFG_VDAC_CFG_ENCTR_LSB    26
++#define VIDEO_OUT_CFG_VDAC_CFG_ENCTR_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_VDAC_CFG_ENSC
++// Description : None
++#define VIDEO_OUT_CFG_VDAC_CFG_ENSC_RESET  0x0
++#define VIDEO_OUT_CFG_VDAC_CFG_ENSC_BITS   0x03800000
++#define VIDEO_OUT_CFG_VDAC_CFG_ENSC_MSB	   25
++#define VIDEO_OUT_CFG_VDAC_CFG_ENSC_LSB	   23
++#define VIDEO_OUT_CFG_VDAC_CFG_ENSC_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_VDAC_CFG_ENDAC
++// Description : None
++#define VIDEO_OUT_CFG_VDAC_CFG_ENDAC_RESET  0x0
++#define VIDEO_OUT_CFG_VDAC_CFG_ENDAC_BITS   0x00700000
++#define VIDEO_OUT_CFG_VDAC_CFG_ENDAC_MSB    22
++#define VIDEO_OUT_CFG_VDAC_CFG_ENDAC_LSB    20
++#define VIDEO_OUT_CFG_VDAC_CFG_ENDAC_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_VDAC_CFG_ENVBG
++// Description : None
++#define VIDEO_OUT_CFG_VDAC_CFG_ENVBG_RESET  0x0
++#define VIDEO_OUT_CFG_VDAC_CFG_ENVBG_BITS   0x00080000
++#define VIDEO_OUT_CFG_VDAC_CFG_ENVBG_MSB    19
++#define VIDEO_OUT_CFG_VDAC_CFG_ENVBG_LSB    19
++#define VIDEO_OUT_CFG_VDAC_CFG_ENVBG_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_VDAC_CFG_ENEXTREF
++// Description : None
++#define VIDEO_OUT_CFG_VDAC_CFG_ENEXTREF_RESET  0x0
++#define VIDEO_OUT_CFG_VDAC_CFG_ENEXTREF_BITS   0x00040000
++#define VIDEO_OUT_CFG_VDAC_CFG_ENEXTREF_MSB    18
++#define VIDEO_OUT_CFG_VDAC_CFG_ENEXTREF_LSB    18
++#define VIDEO_OUT_CFG_VDAC_CFG_ENEXTREF_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_VDAC_CFG_DAC2GC
++// Description : dac2 gain control
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC2GC_RESET  0x3f
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC2GC_BITS   0x0003f000
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC2GC_MSB    17
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC2GC_LSB    12
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC2GC_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_VDAC_CFG_DAC1GC
++// Description : dac1 gain control
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC1GC_RESET  0x3f
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC1GC_BITS   0x00000fc0
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC1GC_MSB    11
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC1GC_LSB    6
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC1GC_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_VDAC_CFG_DAC0GC
++// Description : dac0 gain control
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC0GC_RESET  0x3f
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC0GC_BITS   0x0000003f
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC0GC_MSB    5
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC0GC_LSB    0
++#define VIDEO_OUT_CFG_VDAC_CFG_DAC0GC_ACCESS "RW"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_VDAC_STATUS
++// JTAG access : synchronous
++// Description : Read VDAC status
++#define VIDEO_OUT_CFG_VDAC_STATUS_OFFSET 0x00000008
++#define VIDEO_OUT_CFG_VDAC_STATUS_BITS	 0x00000017
++#define VIDEO_OUT_CFG_VDAC_STATUS_RESET	 0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_VDAC_STATUS_ENCTR3
++// Description : None
++#define VIDEO_OUT_CFG_VDAC_STATUS_ENCTR3_RESET	0x0
++#define VIDEO_OUT_CFG_VDAC_STATUS_ENCTR3_BITS	0x00000010
++#define VIDEO_OUT_CFG_VDAC_STATUS_ENCTR3_MSB	4
++#define VIDEO_OUT_CFG_VDAC_STATUS_ENCTR3_LSB	4
++#define VIDEO_OUT_CFG_VDAC_STATUS_ENCTR3_ACCESS "RO"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_VDAC_STATUS_CABLEOUT
++// Description : None
++#define VIDEO_OUT_CFG_VDAC_STATUS_CABLEOUT_RESET  "-"
++#define VIDEO_OUT_CFG_VDAC_STATUS_CABLEOUT_BITS	  0x00000007
++#define VIDEO_OUT_CFG_VDAC_STATUS_CABLEOUT_MSB	  2
++#define VIDEO_OUT_CFG_VDAC_STATUS_CABLEOUT_LSB	  0
++#define VIDEO_OUT_CFG_VDAC_STATUS_CABLEOUT_ACCESS "RO"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_MEM_PD
++// JTAG access : synchronous
++// Description : Control memory power down
++#define VIDEO_OUT_CFG_MEM_PD_OFFSET 0x0000000c
++#define VIDEO_OUT_CFG_MEM_PD_BITS   0x00000003
++#define VIDEO_OUT_CFG_MEM_PD_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_MEM_PD_VEC
++// Description : None
++#define VIDEO_OUT_CFG_MEM_PD_VEC_RESET	0x0
++#define VIDEO_OUT_CFG_MEM_PD_VEC_BITS	0x00000002
++#define VIDEO_OUT_CFG_MEM_PD_VEC_MSB	1
++#define VIDEO_OUT_CFG_MEM_PD_VEC_LSB	1
++#define VIDEO_OUT_CFG_MEM_PD_VEC_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_MEM_PD_DPI
++// Description : None
++#define VIDEO_OUT_CFG_MEM_PD_DPI_RESET	0x0
++#define VIDEO_OUT_CFG_MEM_PD_DPI_BITS	0x00000001
++#define VIDEO_OUT_CFG_MEM_PD_DPI_MSB	0
++#define VIDEO_OUT_CFG_MEM_PD_DPI_LSB	0
++#define VIDEO_OUT_CFG_MEM_PD_DPI_ACCESS "RW"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_TEST_OVERRIDE
++// JTAG access : synchronous
++// Description : None
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_OFFSET 0x00000010
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_BITS   0xffffffff
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_TEST_OVERRIDE_PAD
++// Description : None
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_PAD_RESET  0x0
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_PAD_BITS   0x80000000
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_PAD_MSB    31
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_PAD_LSB    31
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_PAD_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_TEST_OVERRIDE_VDAC
++// Description : None
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_VDAC_RESET	0x0
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_VDAC_BITS	0x40000000
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_VDAC_MSB	30
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_VDAC_LSB	30
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_VDAC_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_TEST_OVERRIDE_RGBVAL
++// Description : None
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_RGBVAL_RESET  0x00000000
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_RGBVAL_BITS	  0x3fffffff
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_RGBVAL_MSB	  29
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_RGBVAL_LSB	  0
++#define VIDEO_OUT_CFG_TEST_OVERRIDE_RGBVAL_ACCESS "RW"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_INTR
++// JTAG access : synchronous
++// Description : Raw Interrupts
++#define VIDEO_OUT_CFG_INTR_OFFSET 0x00000014
++#define VIDEO_OUT_CFG_INTR_BITS	  0x00000003
++#define VIDEO_OUT_CFG_INTR_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_INTR_DPI
++// Description : None
++#define VIDEO_OUT_CFG_INTR_DPI_RESET  0x0
++#define VIDEO_OUT_CFG_INTR_DPI_BITS   0x00000002
++#define VIDEO_OUT_CFG_INTR_DPI_MSB    1
++#define VIDEO_OUT_CFG_INTR_DPI_LSB    1
++#define VIDEO_OUT_CFG_INTR_DPI_ACCESS "RO"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_INTR_VEC
++// Description : None
++#define VIDEO_OUT_CFG_INTR_VEC_RESET  0x0
++#define VIDEO_OUT_CFG_INTR_VEC_BITS   0x00000001
++#define VIDEO_OUT_CFG_INTR_VEC_MSB    0
++#define VIDEO_OUT_CFG_INTR_VEC_LSB    0
++#define VIDEO_OUT_CFG_INTR_VEC_ACCESS "RO"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_INTE
++// JTAG access : synchronous
++// Description : Interrupt Enable
++#define VIDEO_OUT_CFG_INTE_OFFSET 0x00000018
++#define VIDEO_OUT_CFG_INTE_BITS	  0x00000003
++#define VIDEO_OUT_CFG_INTE_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_INTE_DPI
++// Description : None
++#define VIDEO_OUT_CFG_INTE_DPI_RESET  0x0
++#define VIDEO_OUT_CFG_INTE_DPI_BITS   0x00000002
++#define VIDEO_OUT_CFG_INTE_DPI_MSB    1
++#define VIDEO_OUT_CFG_INTE_DPI_LSB    1
++#define VIDEO_OUT_CFG_INTE_DPI_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_INTE_VEC
++// Description : None
++#define VIDEO_OUT_CFG_INTE_VEC_RESET  0x0
++#define VIDEO_OUT_CFG_INTE_VEC_BITS   0x00000001
++#define VIDEO_OUT_CFG_INTE_VEC_MSB    0
++#define VIDEO_OUT_CFG_INTE_VEC_LSB    0
++#define VIDEO_OUT_CFG_INTE_VEC_ACCESS "RW"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_INTF
++// JTAG access : synchronous
++// Description : Interrupt Force
++#define VIDEO_OUT_CFG_INTF_OFFSET 0x0000001c
++#define VIDEO_OUT_CFG_INTF_BITS	  0x00000003
++#define VIDEO_OUT_CFG_INTF_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_INTF_DPI
++// Description : None
++#define VIDEO_OUT_CFG_INTF_DPI_RESET  0x0
++#define VIDEO_OUT_CFG_INTF_DPI_BITS   0x00000002
++#define VIDEO_OUT_CFG_INTF_DPI_MSB    1
++#define VIDEO_OUT_CFG_INTF_DPI_LSB    1
++#define VIDEO_OUT_CFG_INTF_DPI_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_INTF_VEC
++// Description : None
++#define VIDEO_OUT_CFG_INTF_VEC_RESET  0x0
++#define VIDEO_OUT_CFG_INTF_VEC_BITS   0x00000001
++#define VIDEO_OUT_CFG_INTF_VEC_MSB    0
++#define VIDEO_OUT_CFG_INTF_VEC_LSB    0
++#define VIDEO_OUT_CFG_INTF_VEC_ACCESS "RW"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_INTS
++// JTAG access : synchronous
++// Description : Interrupt status after masking & forcing
++#define VIDEO_OUT_CFG_INTS_OFFSET 0x00000020
++#define VIDEO_OUT_CFG_INTS_BITS	  0x00000003
++#define VIDEO_OUT_CFG_INTS_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_INTS_DPI
++// Description : None
++#define VIDEO_OUT_CFG_INTS_DPI_RESET  0x0
++#define VIDEO_OUT_CFG_INTS_DPI_BITS   0x00000002
++#define VIDEO_OUT_CFG_INTS_DPI_MSB    1
++#define VIDEO_OUT_CFG_INTS_DPI_LSB    1
++#define VIDEO_OUT_CFG_INTS_DPI_ACCESS "RO"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_INTS_VEC
++// Description : None
++#define VIDEO_OUT_CFG_INTS_VEC_RESET  0x0
++#define VIDEO_OUT_CFG_INTS_VEC_BITS   0x00000001
++#define VIDEO_OUT_CFG_INTS_VEC_MSB    0
++#define VIDEO_OUT_CFG_INTS_VEC_LSB    0
++#define VIDEO_OUT_CFG_INTS_VEC_ACCESS "RO"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_BLOCK_ID
++// JTAG access : synchronous
++// Description : Block Identifier
++//		 Hexadecimal representation of "VOCF"
++#define VIDEO_OUT_CFG_BLOCK_ID_OFFSET 0x00000024
++#define VIDEO_OUT_CFG_BLOCK_ID_BITS   0xffffffff
++#define VIDEO_OUT_CFG_BLOCK_ID_RESET  0x564f4346
++#define VIDEO_OUT_CFG_BLOCK_ID_MSB    31
++#define VIDEO_OUT_CFG_BLOCK_ID_LSB    0
++#define VIDEO_OUT_CFG_BLOCK_ID_ACCESS "RO"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_INSTANCE_ID
++// JTAG access : synchronous
++// Description : Block Instance Identifier
++#define VIDEO_OUT_CFG_INSTANCE_ID_OFFSET 0x00000028
++#define VIDEO_OUT_CFG_INSTANCE_ID_BITS	 0x0000000f
++#define VIDEO_OUT_CFG_INSTANCE_ID_RESET	 0x00000000
++#define VIDEO_OUT_CFG_INSTANCE_ID_MSB	 3
++#define VIDEO_OUT_CFG_INSTANCE_ID_LSB	 0
++#define VIDEO_OUT_CFG_INSTANCE_ID_ACCESS "RO"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_RSTSEQ_AUTO
++// JTAG access : synchronous
++// Description : None
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_OFFSET 0x0000002c
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_BITS	 0x00000007
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_RESET	 0x00000007
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_AUTO_VEC
++// Description : 1 = reset is controlled by the sequencer
++//		 0 = reset is controlled by rstseq_ctrl
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_VEC_RESET  0x1
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_VEC_BITS   0x00000004
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_VEC_MSB    2
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_VEC_LSB    2
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_VEC_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_AUTO_DPI
++// Description : 1 = reset is controlled by the sequencer
++//		 0 = reset is controlled by rstseq_ctrl
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_DPI_RESET  0x1
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_DPI_BITS   0x00000002
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_DPI_MSB    1
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_DPI_LSB    1
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_DPI_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_AUTO_BUSADAPTER
++// Description : 1 = reset is controlled by the sequencer
++//		 0 = reset is controlled by rstseq_ctrl
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_BUSADAPTER_RESET  0x1
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_BUSADAPTER_BITS   0x00000001
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_BUSADAPTER_MSB    0
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_BUSADAPTER_LSB    0
++#define VIDEO_OUT_CFG_RSTSEQ_AUTO_BUSADAPTER_ACCESS "RW"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_RSTSEQ_PARALLEL
++// JTAG access : synchronous
++// Description : None
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_OFFSET 0x00000030
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_BITS   0x00000007
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_RESET  0x00000006
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_PARALLEL_VEC
++// Description : Is this reset parallel (i.e. not part of the sequence)
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_VEC_RESET	 0x1
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_VEC_BITS	 0x00000004
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_VEC_MSB	 2
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_VEC_LSB	 2
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_VEC_ACCESS "RO"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_PARALLEL_DPI
++// Description : Is this reset parallel (i.e. not part of the sequence)
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_DPI_RESET	 0x1
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_DPI_BITS	 0x00000002
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_DPI_MSB	 1
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_DPI_LSB	 1
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_DPI_ACCESS "RO"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_PARALLEL_BUSADAPTER
++// Description : Is this reset parallel (i.e. not part of the sequence)
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_BUSADAPTER_RESET	0x0
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_BUSADAPTER_BITS	0x00000001
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_BUSADAPTER_MSB	0
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_BUSADAPTER_LSB	0
++#define VIDEO_OUT_CFG_RSTSEQ_PARALLEL_BUSADAPTER_ACCESS "RO"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_RSTSEQ_CTRL
++// JTAG access : synchronous
++// Description : None
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_OFFSET 0x00000034
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_BITS	 0x00000007
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_RESET	 0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_CTRL_VEC
++// Description : 1 = keep the reset asserted
++//		 0 = keep the reset deasserted
++//		 This is ignored if rstseq_auto=1
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_VEC_RESET  0x0
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_VEC_BITS   0x00000004
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_VEC_MSB    2
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_VEC_LSB    2
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_VEC_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_CTRL_DPI
++// Description : 1 = keep the reset asserted
++//		 0 = keep the reset deasserted
++//		 This is ignored if rstseq_auto=1
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_DPI_RESET  0x0
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_DPI_BITS   0x00000002
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_DPI_MSB    1
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_DPI_LSB    1
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_DPI_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_CTRL_BUSADAPTER
++// Description : 1 = keep the reset asserted
++//		 0 = keep the reset deasserted
++//		 This is ignored if rstseq_auto=1
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_BUSADAPTER_RESET  0x0
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_BUSADAPTER_BITS   0x00000001
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_BUSADAPTER_MSB    0
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_BUSADAPTER_LSB    0
++#define VIDEO_OUT_CFG_RSTSEQ_CTRL_BUSADAPTER_ACCESS "RW"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_RSTSEQ_TRIG
++// JTAG access : synchronous
++// Description : None
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_OFFSET 0x00000038
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_BITS	 0x00000007
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_RESET	 0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_TRIG_VEC
++// Description : Pulses the reset output
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_VEC_RESET  0x0
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_VEC_BITS   0x00000004
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_VEC_MSB    2
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_VEC_LSB    2
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_VEC_ACCESS "SC"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_TRIG_DPI
++// Description : Pulses the reset output
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_DPI_RESET  0x0
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_DPI_BITS   0x00000002
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_DPI_MSB    1
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_DPI_LSB    1
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_DPI_ACCESS "SC"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_TRIG_BUSADAPTER
++// Description : Pulses the reset output
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_BUSADAPTER_RESET  0x0
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_BUSADAPTER_BITS   0x00000001
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_BUSADAPTER_MSB    0
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_BUSADAPTER_LSB    0
++#define VIDEO_OUT_CFG_RSTSEQ_TRIG_BUSADAPTER_ACCESS "SC"
++// =============================================================================
++// Register    : VIDEO_OUT_CFG_RSTSEQ_DONE
++// JTAG access : synchronous
++// Description : None
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_OFFSET 0x0000003c
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_BITS	 0x00000007
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_RESET	 0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_DONE_VEC
++// Description : Indicates the current state of the reset
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_VEC_RESET  0x0
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_VEC_BITS   0x00000004
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_VEC_MSB    2
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_VEC_LSB    2
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_VEC_ACCESS "RO"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_DONE_DPI
++// Description : Indicates the current state of the reset
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_DPI_RESET  0x0
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_DPI_BITS   0x00000002
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_DPI_MSB    1
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_DPI_LSB    1
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_DPI_ACCESS "RO"
++// -----------------------------------------------------------------------------
++// Field       : VIDEO_OUT_CFG_RSTSEQ_DONE_BUSADAPTER
++// Description : Indicates the current state of the reset
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_BUSADAPTER_RESET  0x0
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_BUSADAPTER_BITS   0x00000001
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_BUSADAPTER_MSB    0
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_BUSADAPTER_LSB    0
++#define VIDEO_OUT_CFG_RSTSEQ_DONE_BUSADAPTER_ACCESS "RO"
++// =============================================================================
++
++#define CFG_WRITE(reg, val)  writel((val),  vec->hw_base[RP1VEC_HW_BLOCK_CFG] + (reg ## _OFFSET))
++#define CFG_READ(reg)	     readl(vec->hw_base[RP1VEC_HW_BLOCK_CFG] + (reg ## _OFFSET))
++
++void rp1vec_vidout_setup(struct rp1_vec *vec)
++{
++	/*
++	 * We assume DPI and VEC can't be used at the same time (due to
++	 * clashing requirements for PLL_VIDEO, and potentially for VDAC).
++	 * We therefore leave DPI memories powered down.
++	 */
++	CFG_WRITE(VIDEO_OUT_CFG_MEM_PD, VIDEO_OUT_CFG_MEM_PD_DPI_BITS);
++	CFG_WRITE(VIDEO_OUT_CFG_TEST_OVERRIDE, 0x00000000);
++
++	/* DPI->Pads; VEC->VDAC */
++	CFG_WRITE(VIDEO_OUT_CFG_SEL, VIDEO_OUT_CFG_SEL_VDAC_MUX_BITS);
++
++	/* configure VDAC for 1 channel, bandgap on, 1.28V swing */
++	CFG_WRITE(VIDEO_OUT_CFG_VDAC_CFG, 0x0019ffff);
++
++	/* enable VEC interrupt */
++	CFG_WRITE(VIDEO_OUT_CFG_INTE, VIDEO_OUT_CFG_INTE_VEC_BITS);
++}
++
++void rp1vec_vidout_poweroff(struct rp1_vec *vec)
++{
++	/* disable VEC interrupt */
++	CFG_WRITE(VIDEO_OUT_CFG_INTE, 0);
++
++	/* Ensure VDAC is turned off; power down DPI,VEC memories */
++	CFG_WRITE(VIDEO_OUT_CFG_VDAC_CFG, 0);
++	CFG_WRITE(VIDEO_OUT_CFG_MEM_PD, VIDEO_OUT_CFG_MEM_PD_BITS);
++}
+--- /dev/null
++++ b/drivers/gpu/drm/rp1/rp1-vec/rp1_vec_hw.c
+@@ -0,0 +1,580 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * DRM Driver for VEC output on Raspberry Pi RP1
++ *
++ * Copyright (c) 2023 Raspberry Pi Limited.
++ */
++
++#include <linux/kernel.h>
++#include <linux/errno.h>
++#include <linux/mm.h>
++#include <linux/delay.h>
++#include <linux/interrupt.h>
++#include <linux/platform_device.h>
++#include <drm/drm_fourcc.h>
++#include <drm/drm_print.h>
++#include <drm/drm_vblank.h>
++
++#include "rp1_vec.h"
++#include "vec_regs.h"
++
++#define BITS(field, val)    (((val) << (field ## _LSB)) & (field ## _BITS))
++#define VEC_WRITE(reg, val) writel((val), vec->hw_base[RP1VEC_HW_BLOCK_VEC] + (reg ## _OFFSET))
++#define VEC_READ(reg)	    readl(vec->hw_base[RP1VEC_HW_BLOCK_VEC] + (reg ## _OFFSET))
++
++static void rp1vec_write_regs(struct rp1_vec *vec, u32 offset, u32 const *vals, u32 num)
++{
++	while (num--) {
++		writel(*vals++, vec->hw_base[RP1VEC_HW_BLOCK_VEC] + offset);
++		offset += 4;
++	}
++}
++
++int rp1vec_hw_busy(struct rp1_vec *vec)
++{
++	/* Read the undocumented "pline_busy" flag */
++	return VEC_READ(VEC_STATUS) & 1;
++}
++
++/* Table of supported input (in-memory/DMA) pixel formats. */
++struct rp1vec_ipixfmt {
++	u32 format; /* DRM format code				 */
++	u32 mask;   /* RGB masks (10 bits each, left justified)	 */
++	u32 shift;  /* RGB MSB positions in the memory word	 */
++	u32 rgbsz;  /* Shifts used for scaling; also (BPP/8-1)	 */
++};
++
++#define MASK_RGB(r, g, b) \
++	(BITS(VEC_IMASK_MASK_R, r) | BITS(VEC_IMASK_MASK_G, g) | BITS(VEC_IMASK_MASK_B, b))
++#define SHIFT_RGB(r, g, b) \
++	(BITS(VEC_SHIFT_SHIFT_R, r) | BITS(VEC_SHIFT_SHIFT_G, g) | BITS(VEC_SHIFT_SHIFT_B, b))
++
++static const struct rp1vec_ipixfmt my_formats[] = {
++	{
++		.format = DRM_FORMAT_XRGB8888,
++		.mask	= MASK_RGB(0x3fc, 0x3fc, 0x3fc),
++		.shift	= SHIFT_RGB(23, 15, 7),
++		.rgbsz	= BITS(VEC_RGBSZ_BYTES_PER_PIXEL_MINUS1, 3),
++	},
++	{
++		.format = DRM_FORMAT_XBGR8888,
++		.mask	= MASK_RGB(0x3fc, 0x3fc, 0x3fc),
++		.shift	= SHIFT_RGB(7, 15, 23),
++		.rgbsz	= BITS(VEC_RGBSZ_BYTES_PER_PIXEL_MINUS1, 3),
++	},
++	{
++		.format = DRM_FORMAT_ARGB8888,
++		.mask	= MASK_RGB(0x3fc, 0x3fc, 0x3fc),
++		.shift	= SHIFT_RGB(23, 15, 7),
++		.rgbsz	= BITS(VEC_RGBSZ_BYTES_PER_PIXEL_MINUS1, 3),
++	},
++	{
++		.format = DRM_FORMAT_ABGR8888,
++		.mask	= MASK_RGB(0x3fc, 0x3fc, 0x3fc),
++		.shift	= SHIFT_RGB(7, 15, 23),
++		.rgbsz	= BITS(VEC_RGBSZ_BYTES_PER_PIXEL_MINUS1, 3),
++	},
++	{
++		.format = DRM_FORMAT_RGB888,
++		.mask	= MASK_RGB(0x3fc, 0x3fc, 0x3fc),
++		.shift	= SHIFT_RGB(23, 15, 7),
++		.rgbsz	= BITS(VEC_RGBSZ_BYTES_PER_PIXEL_MINUS1, 2),
++	},
++	{
++		.format = DRM_FORMAT_BGR888,
++		.mask	= MASK_RGB(0x3fc, 0x3fc, 0x3fc),
++		.shift	= SHIFT_RGB(7, 15, 23),
++		.rgbsz	= BITS(VEC_RGBSZ_BYTES_PER_PIXEL_MINUS1, 2),
++	},
++	{
++		.format = DRM_FORMAT_RGB565,
++		.mask	= MASK_RGB(0x3e0, 0x3f0, 0x3e0),
++		.shift	= SHIFT_RGB(15, 10, 4),
++		.rgbsz	= BITS(VEC_RGBSZ_SCALE_R, 5) |
++			  BITS(VEC_RGBSZ_SCALE_G, 6) |
++			  BITS(VEC_RGBSZ_SCALE_B, 5) |
++			  BITS(VEC_RGBSZ_BYTES_PER_PIXEL_MINUS1, 1),
++	}
++};
++
++/*
++ * Hardware mode descriptions (@ 108 MHz VDAC clock)
++ * See "vec_regs.h" for further descriptions of these registers and fields.
++ * Driver should adjust some values for other TV standards and for pixel rate,
++ * and must ensure that ((de_end - de_bgn) % rate) == 0.
++ */
++
++struct rp1vec_hwmode {
++	u16  max_rows_per_field;   /* active lines per field (including partial ones)  */
++	u16  ref_vfp;		   /* nominal (vsync_start - vdisplay) when max height */
++	bool interlaced;	   /* set for interlaced			       */
++	bool first_field_odd;	   /* depends confusingly on line numbering convention */
++	s16  scale_v;		   /* V scale in 2.8 format (for power-of-2 CIC rates) */
++	s16  scale_u;		   /* U scale in 2.8 format (for power-of-2 CIC rates) */
++	u16  scale_y;		   /* Y scale in 2.8 format (for power-of-2 CIC rates) */
++	u16  de_end;		   /* end of horizontal Data Active period at 108MHz   */
++	u16  de_bgn;		   /* start of horizontal Data Active period	       */
++	u16  half_lines_per_field; /* number of half lines per field		       */
++	s16  pedestal;		   /* pedestal (1024 = 100IRE) including FIR overshoot */
++	u16  scale_luma;	   /* back end luma scaling in 1.15 format wrt DAC FSD */
++	u16  scale_sync;	   /* back end sync scaling / blanking level as above  */
++	u32  scale_burst_chroma;   /* back end { burst, chroma } scaling	       */
++	u32  misc;		   /* Contents of the "EC" register except rate,shift  */
++	u64  nco_freq;		   /* colour carrier frequency * (2**64) / 108MHz      */
++	u32  timing_regs[14];	   /* other back end registers 0x84 .. 0xB8	       */
++};
++
++/* { NTSC, PAL, PAL-M } x { progressive, interlaced } */
++static const struct rp1vec_hwmode rp1vec_hwmodes[3][2] = {
++	{
++		/* NTSC */
++		{
++			.max_rows_per_field = 240,
++			.ref_vfp = 2,
++			.interlaced = false,
++			.first_field_odd = false,
++			.scale_v = 0x0cf,
++			.scale_u = 0x074,
++			.scale_y = 0x107,
++			.de_end	 = 0x1a4f,
++			.de_bgn	 = 0x038f,
++			.half_lines_per_field = 524, /* also works with 526/2 lines */
++			.pedestal = 0x04c,
++			.scale_luma = 0x8c9a,
++			.scale_sync = 0x3851,
++			.scale_burst_chroma = 0x11195561,
++			.misc = 0x00090c00, /* 5-tap FIR, SEQ_EN, 4 fld sync */
++			.nco_freq = 0x087c1f07c1f07c1f,
++			.timing_regs = {
++				0x03e10cc6, 0x0d6801fb, 0x023d034c, 0x00f80b6d,
++				0x00000005, 0x0006000b, 0x000c0011, 0x000a0106,
++				0x00000000, 0x00000000, 0x00000000, 0x00000000,
++				0x00170106, 0x00000000
++			},
++		}, {
++			.max_rows_per_field = 243,
++			.ref_vfp = 3,
++			.interlaced = true,
++			.first_field_odd = true,
++			.scale_v = 0x0cf,
++			.scale_u = 0x074,
++			.scale_y = 0x107,
++			.de_end = 0x1a4f,
++			.de_bgn = 0x038f,
++			.half_lines_per_field = 525,
++			.pedestal = 0x04c,
++			.scale_luma = 0x8c9a,
++			.scale_sync = 0x3851,
++			.scale_burst_chroma = 0x11195561,
++			.misc = 0x00094c02, /* 5-tap FIR, SEQ_EN, 2 flds, 4 fld sync, ilace */
++			.nco_freq = 0x087c1f07c1f07c1f,
++			.timing_regs = {
++				0x03e10cc6, 0x0d6801fb, 0x023d034c, 0x00f80b6d,
++				0x00000005, 0x0006000b, 0x000c0011, 0x000a0107,
++				0x0111020d, 0x00000000, 0x00000000, 0x011c020d,
++				0x00150106, 0x0107011b,
++			},
++		},
++	}, {
++		/* PAL */
++		{
++			.max_rows_per_field = 288,
++			.ref_vfp = 2,
++			.interlaced = false,
++			.first_field_odd = false,
++			.scale_v = 0x0e0,
++			.scale_u = 0x07e,
++			.scale_y = 0x11c,
++			.de_end = 0x1ab6,
++			.de_bgn = 0x03f6,
++			.half_lines_per_field = 624,
++			.pedestal = 0x00a, /* nonzero for max FIR overshoot after CIC */
++			.scale_luma = 0x89d8,
++			.scale_sync = 0x3c00,
++			.scale_burst_chroma = 0x0caf53b5,
++			.misc = 0x00091c01, /* 5-tap FIR, SEQ_EN, 8 fld sync, PAL */
++			.nco_freq = 0x0a8262b2cc48c1d1,
++			.timing_regs = {
++				0x04660cee, 0x0d8001fb, 0x025c034f, 0x00fd0b84,
++				0x026c0270, 0x00000004, 0x00050009, 0x00070135,
++				0x00000000, 0x00000000, 0x00000000, 0x00000000,
++				0x00170136, 0x00000000,
++			},
++		}, {
++			.max_rows_per_field = 288,
++			.ref_vfp = 5,
++			.interlaced = true,
++			.first_field_odd = false,
++			.scale_v = 0x0e0,
++			.scale_u = 0x07e,
++			.scale_y = 0x11c,
++			.de_end = 0x1ab6,
++			.de_bgn = 0x03f6,
++			.half_lines_per_field = 625,
++			.pedestal = 0x00a,
++			.scale_luma = 0x89d8,
++			.scale_sync = 0x3c00,
++			.scale_burst_chroma = 0x0caf53b5,
++			.misc = 0x0009dc03, /* 5-tap FIR, SEQ_EN, 4 flds, 8 fld sync, ilace, PAL */
++			.nco_freq = 0x0a8262b2cc48c1d1,
++			.timing_regs = {
++				0x04660cee, 0x0d8001fb, 0x025c034f, 0x00fd0b84,
++				0x026c0270, 0x00000004, 0x00050009, 0x00070135,
++				0x013f026d, 0x00060136, 0x0140026e, 0x0150026e,
++				0x00180136, 0x026f0017,
++			},
++		},
++	}, {
++		/* PAL-M */
++		{
++			.max_rows_per_field = 240,
++			.ref_vfp = 2,
++			.interlaced = false,
++			.first_field_odd = false,
++			.scale_v = 0x0e0,
++			.scale_u = 0x07e,
++			.scale_y = 0x11c,
++			.de_end = 0x1a4f,
++			.de_bgn = 0x038f,
++			.half_lines_per_field = 524,
++			.pedestal = 0x00a,
++			.scale_luma = 0x89d8,
++			.scale_sync = 0x3851,
++			.scale_burst_chroma = 0x0d5c53b5,
++			.misc = 0x00091c01, /* 5-tap FIR, SEQ_EN, 8 fld sync PAL */
++			.nco_freq = 0x0879bbf8d6d33ea8,
++			.timing_regs = {
++				0x03e10cc6, 0x0d6801fb, 0x023c034c, 0x00f80b6e,
++				0x00000005, 0x0006000b, 0x000c0011, 0x000a0106,
++				0x00000000, 0x00000000, 0x00000000, 0x00000000,
++				0x00170106, 0x00000000,
++			},
++		}, {
++			.max_rows_per_field = 243,
++			.ref_vfp = 3,
++			.interlaced = true,
++			.first_field_odd = true,
++			.scale_v = 0x0e0,
++			.scale_u = 0x07e,
++			.scale_y = 0x11c,
++			.de_end = 0x1a4f,
++			.de_bgn = 0x038f,
++			.half_lines_per_field = 525,
++			.pedestal = 0x00a,
++			.scale_luma = 0x89d8,
++			.scale_sync = 0x3851,
++			.scale_burst_chroma = 0x0d5c53b5,
++			.misc = 0x0009dc03, /* 5-tap FIR, SEQ_EN, 4 flds, 8 fld sync, ilace, PAL */
++			.nco_freq = 0x0879bbf8d6d33ea8,
++			.timing_regs = {
++				0x03e10cc6, 0x0d6801fb, 0x023c034c, 0x00f80b6e,
++				0x00140019, 0x00000005, 0x0006000b, 0x00090103,
++				0x010f0209, 0x00080102, 0x010e020a, 0x0119020a,
++				0x00120103, 0x01040118,
++			},
++		},
++	},
++};
++
++/* System A, System E */
++static const struct rp1vec_hwmode rp1vec_vintage_modes[2] = {
++	{
++		.max_rows_per_field = 190,
++		.ref_vfp = 0,
++		.interlaced = true,
++		.first_field_odd = true,
++		.scale_v = 0,
++		.scale_u = 0,
++		.scale_y = 0x11c,
++		.de_end = 0x2920,
++		.de_bgn = 0x06a0,
++		.half_lines_per_field = 405,
++		.pedestal = 0x00a,
++		.scale_luma = 0x89d8,
++		.scale_sync = 0x3c00,
++		.scale_burst_chroma = 0,
++		.misc = 0x00084002, /* 5-tap FIR, 2 fields, interlace */
++		.nco_freq = 0,
++		.timing_regs = {
++			0x06f01430, 0x14d503cc, 0x00000000, 0x000010de,
++			0x00000000, 0x00000007, 0x00000000, 0x00000000,
++			0x00000000, 0x00000000, 0x00000000, 0x00d90195,
++			0x000e00ca, 0x00cb00d8,
++		},
++	}, {
++		.max_rows_per_field = 369,
++		.ref_vfp = 6,
++		.interlaced = true,
++		.first_field_odd = true,
++		.scale_v = 0,
++		.scale_u = 0,
++		.scale_y = 0x11c,
++		.de_end = 0x145f,
++		.de_bgn = 0x03a7,
++		.half_lines_per_field = 819,
++		.pedestal = 0x0010,
++		.scale_luma = 0x89d8,
++		.scale_sync = 0x3b13,
++		.scale_burst_chroma = 0,
++		.misc = 0x00084002, /* 5-tap FIR, 2 fields, interlace */
++		.nco_freq = 0,
++		.timing_regs = {
++			0x03c10a08, 0x0a4d0114, 0x00000000, 0x000008a6,
++			0x00000000, 0x00000000, 0x00000000, 0x00000000,
++			0x00000000, 0x00000000, 0x00000000, 0x01c10330,
++			0x00270196, 0x019701c0,
++		},
++	},
++};
++
++static const u32 rp1vec_fir_regs[4] = {
++	0x00000000, 0x0be20200, 0x20f0f800, 0x265c7f00,
++};
++
++/*
++ * Correction for the 4th order CIC filter's gain of (rate ** 4)
++ * expressed as a right-shift and a reciprocal scale factor (Q12).
++ * These arrays are indexed by [rate - 4] where 4 <= rate <= 16.
++ */
++
++static const int rp1vec_scale_table[13] = {
++	4096, 6711, 6473, 6988,
++	4096, 5114, 6711, 4584,
++	6473, 4699, 6988, 5302,
++	4096
++};
++
++static const u32 rp1vec_rate_shift_table[13] = {
++	BITS(VEC_DAC_EC_INTERP_RATE_MINUS1,  3) | BITS(VEC_DAC_EC_INTERP_SHIFT_MINUS1,	7),
++	BITS(VEC_DAC_EC_INTERP_RATE_MINUS1,  4) | BITS(VEC_DAC_EC_INTERP_SHIFT_MINUS1,	9),
++	BITS(VEC_DAC_EC_INTERP_RATE_MINUS1,  5) | BITS(VEC_DAC_EC_INTERP_SHIFT_MINUS1, 10),
++	BITS(VEC_DAC_EC_INTERP_RATE_MINUS1,  6) | BITS(VEC_DAC_EC_INTERP_SHIFT_MINUS1, 11),
++	BITS(VEC_DAC_EC_INTERP_RATE_MINUS1,  7) | BITS(VEC_DAC_EC_INTERP_SHIFT_MINUS1, 11),
++	BITS(VEC_DAC_EC_INTERP_RATE_MINUS1,  8) | BITS(VEC_DAC_EC_INTERP_SHIFT_MINUS1, 12),
++	BITS(VEC_DAC_EC_INTERP_RATE_MINUS1,  9) | BITS(VEC_DAC_EC_INTERP_SHIFT_MINUS1, 13),
++	BITS(VEC_DAC_EC_INTERP_RATE_MINUS1, 10) | BITS(VEC_DAC_EC_INTERP_SHIFT_MINUS1, 13),
++	BITS(VEC_DAC_EC_INTERP_RATE_MINUS1, 11) | BITS(VEC_DAC_EC_INTERP_SHIFT_MINUS1, 14),
++	BITS(VEC_DAC_EC_INTERP_RATE_MINUS1, 12) | BITS(VEC_DAC_EC_INTERP_SHIFT_MINUS1, 14),
++	BITS(VEC_DAC_EC_INTERP_RATE_MINUS1, 13) | BITS(VEC_DAC_EC_INTERP_SHIFT_MINUS1, 15),
++	BITS(VEC_DAC_EC_INTERP_RATE_MINUS1, 14) | BITS(VEC_DAC_EC_INTERP_SHIFT_MINUS1, 15),
++	BITS(VEC_DAC_EC_INTERP_RATE_MINUS1, 15) | BITS(VEC_DAC_EC_INTERP_SHIFT_MINUS1, 15),
++};
++
++void rp1vec_hw_setup(struct rp1_vec *vec,
++		     u32 in_format,
++		     struct drm_display_mode const *mode,
++		     int tvstd)
++{
++	int i, mode_family, w, h;
++	const struct rp1vec_hwmode *hwm;
++	int wmax, hpad_r, vpad_b, rate, ref_2mid, usr_2mid;
++	u32 misc;
++
++	/* Input pixel format conversion */
++	for (i = 0; i < ARRAY_SIZE(my_formats); ++i) {
++		if (my_formats[i].format == in_format)
++			break;
++	}
++	if (i >= ARRAY_SIZE(my_formats)) {
++		dev_err(&vec->pdev->dev, "%s: bad input format\n", __func__);
++		i = 0;
++	}
++	VEC_WRITE(VEC_IMASK, my_formats[i].mask);
++	VEC_WRITE(VEC_SHIFT, my_formats[i].shift);
++	VEC_WRITE(VEC_RGBSZ, my_formats[i].rgbsz);
++
++	/* Pick an appropriate "base" mode, which we may modify.
++	 * Note that this driver supports a limited selection of video modes.
++	 * (A complete TV mode cannot be directly inferred from a DRM display mode:
++	 * features such as chroma burst sequence, half-lines and equalizing pulses
++	 * would be under-specified, and timings prone to rounding errors.)
++	 */
++	if (mode->vtotal == 405 || mode->vtotal == 819) {
++		/* Systems A and E (interlaced only) */
++		vec->fake_31khz = false;
++		mode_family = 1;
++		hwm = &rp1vec_vintage_modes[(mode->vtotal == 819) ? 1 : 0];
++	} else {
++		/* 525- and 625-line modes, with half-height and "fake" progressive variants */
++		vec->fake_31khz = mode->vtotal >= 500 && !(mode->flags & DRM_MODE_FLAG_INTERLACE);
++		h = (mode->vtotal >= 500) ? (mode->vtotal >> 1) : mode->vtotal;
++		if (h >= 272)
++			mode_family = 1; /* PAL-625 */
++		else if (tvstd == DRM_MODE_TV_MODE_PAL_M || tvstd == DRM_MODE_TV_MODE_PAL)
++			mode_family = 2; /* PAL-525 */
++		else
++			mode_family = 0; /* NTSC-525 */
++		hwm = &rp1vec_hwmodes[mode_family][(mode->flags & DRM_MODE_FLAG_INTERLACE) ? 1 : 0];
++	}
++
++	/*
++	 * Choose the upsampling rate (to 108MHz) in the range 4..16.
++	 * Clip dimensions to the limits of the chosen hardware mode, then add
++	 * padding as required, making some attempt to respect the DRM mode's
++	 * display position (relative to H and V sync start). Note that "wmax"
++	 * should be wider than the horizontal active region, to avoid boundary
++	 * artifacts (e.g. wmax = 728, w = 720, active ~= 704 in Rec.601 modes).
++	 */
++	i = (vec->fake_31khz) ? (mode->clock >> 1) : mode->clock;
++	rate = (i < (RP1VEC_VDAC_KHZ / 16)) ? 16 : max(4, (RP1VEC_VDAC_KHZ + 256) / i);
++	wmax = min((hwm->de_end - hwm->de_bgn) / rate, 1020);
++	w = min(mode->hdisplay, wmax);
++	ref_2mid = (hwm->de_bgn + hwm->de_end) / rate + 4; /* + 4 for FIR delay */
++	usr_2mid = (2 * (mode->htotal - mode->hsync_start) + w) * 2 * (hwm->timing_regs[1] >> 16) /
++		(rate * mode->htotal);
++	hpad_r = (wmax - w + ref_2mid - usr_2mid) >> 1;
++	hpad_r = min(max(0, hpad_r), wmax - w);
++	h = mode->vdisplay >> (hwm->interlaced || vec->fake_31khz);
++	h = min(h, 0 + hwm->max_rows_per_field);
++	vpad_b = ((mode->vsync_start - hwm->ref_vfp) >> (hwm->interlaced || vec->fake_31khz)) - h;
++	vpad_b = min(max(0, vpad_b), hwm->max_rows_per_field - h);
++
++	/* Configure the hardware "front end" (in the sysclock domain) */
++	VEC_WRITE(VEC_APB_TIMEOUT, 0x38);
++	VEC_WRITE(VEC_QOS,
++		  BITS(VEC_QOS_DQOS, 0x0) |
++		  BITS(VEC_QOS_ULEV, 0x8) |
++		  BITS(VEC_QOS_UQOS, 0x2) |
++		  BITS(VEC_QOS_LLEV, 0x4) |
++		  BITS(VEC_QOS_LQOS, 0x7));
++	VEC_WRITE(VEC_DMA_AREA,
++		  BITS(VEC_DMA_AREA_COLS_MINUS1, w - 1) |
++		  BITS(VEC_DMA_AREA_ROWS_PER_FIELD_MINUS1, h - 1));
++	VEC_WRITE(VEC_YUV_SCALING,
++		  BITS(VEC_YUV_SCALING_U10_SCALE_Y,
++		       (hwm->scale_y * rp1vec_scale_table[rate - 4] + 2048) >> 12) |
++		  BITS(VEC_YUV_SCALING_S10_SCALE_U,
++		       (hwm->scale_u * rp1vec_scale_table[rate - 4] + 2048) >> 12) |
++		  BITS(VEC_YUV_SCALING_S10_SCALE_V,
++		       (hwm->scale_v * rp1vec_scale_table[rate - 4] + 2048) >> 12));
++	VEC_WRITE(VEC_BACK_PORCH,
++		  BITS(VEC_BACK_PORCH_HBP_MINUS1, wmax - w - hpad_r - 1) |
++		  BITS(VEC_BACK_PORCH_VBP_MINUS1, hwm->max_rows_per_field - h - vpad_b - 1));
++	VEC_WRITE(VEC_FRONT_PORCH,
++		  BITS(VEC_FRONT_PORCH_HFP_MINUS1, hpad_r - 1) |
++		  BITS(VEC_FRONT_PORCH_VFP_MINUS1, vpad_b - 1));
++	VEC_WRITE(VEC_MODE,
++		  BITS(VEC_MODE_HIGH_WATER, 0xE0)				|
++		  BITS(VEC_MODE_ALIGN16, !((w | mode->hdisplay) & 15))		|
++		  BITS(VEC_MODE_VFP_EN, (vpad_b > 0))				|
++		  BITS(VEC_MODE_VBP_EN, (hwm->max_rows_per_field > h + vpad_b)) |
++		  BITS(VEC_MODE_HFP_EN, (hpad_r > 0))				|
++		  BITS(VEC_MODE_HBP_EN, (wmax > w + hpad_r))			|
++		  BITS(VEC_MODE_FIELDS_PER_FRAME_MINUS1, hwm->interlaced)	|
++		  BITS(VEC_MODE_FIRST_FIELD_ODD, hwm->first_field_odd));
++
++	/* Configure the hardware "back end" (in the VDAC clock domain) */
++	VEC_WRITE(VEC_DAC_80,
++		  BITS(VEC_DAC_80_U14_DE_BGN, hwm->de_bgn) |
++		  BITS(VEC_DAC_80_U14_DE_END, hwm->de_bgn + wmax * rate));
++	rp1vec_write_regs(vec, 0x84, hwm->timing_regs, ARRAY_SIZE(hwm->timing_regs));
++	VEC_WRITE(VEC_DAC_C0, 0x0); /* DAC control/status -- not wired up in RP1 */
++	VEC_WRITE(VEC_DAC_C4, 0x007bffff); /* DAC control -- not wired up in RP1 */
++	misc = hwm->half_lines_per_field;
++	if (misc == 524 && (mode->vtotal >> vec->fake_31khz) == 263)
++		misc += 2;
++	if (tvstd == DRM_MODE_TV_MODE_NTSC_J && mode_family == 0) {
++		/* NTSC-J modification: reduce pedestal and increase gain */
++		VEC_WRITE(VEC_DAC_BC,
++			  BITS(VEC_DAC_BC_U11_HALF_LINES_PER_FIELD, misc) |
++			  BITS(VEC_DAC_BC_S11_PEDESTAL, 0x00a));
++		VEC_WRITE(VEC_DAC_C8,
++			  BITS(VEC_DAC_C8_U16_SCALE_LUMA, 0x9400) |
++			  BITS(VEC_DAC_C8_U16_SCALE_SYNC, hwm->scale_sync));
++	} else {
++		VEC_WRITE(VEC_DAC_BC,
++			  BITS(VEC_DAC_BC_U11_HALF_LINES_PER_FIELD, misc) |
++			  BITS(VEC_DAC_BC_S11_PEDESTAL, hwm->pedestal));
++		VEC_WRITE(VEC_DAC_C8,
++			  BITS(VEC_DAC_C8_U16_SCALE_LUMA, hwm->scale_luma) |
++			  BITS(VEC_DAC_C8_U16_SCALE_SYNC, hwm->scale_sync));
++	}
++	VEC_WRITE(VEC_DAC_CC, (tvstd >= DRM_MODE_TV_MODE_SECAM) ? 0 : hwm->scale_burst_chroma);
++	VEC_WRITE(VEC_DAC_D0, 0x02000000); /* ADC offsets -- not needed in RP1? */
++	misc = hwm->misc;
++	if ((tvstd == DRM_MODE_TV_MODE_NTSC_443 || tvstd == DRM_MODE_TV_MODE_PAL) &&
++	    mode_family != 1) {
++		/* Change colour carrier frequency to 4433618.75 Hz; disable hard sync */
++		VEC_WRITE(VEC_DAC_D4, 0xcc48c1d1);
++		VEC_WRITE(VEC_DAC_D8, 0x0a8262b2);
++		misc &= ~VEC_DAC_EC_SEQ_EN_BITS;
++	} else if (tvstd == DRM_MODE_TV_MODE_PAL_N && mode_family == 1) {
++		/* Change colour carrier frequency to 3582056.25 Hz */
++		VEC_WRITE(VEC_DAC_D4, 0x9ce075f7);
++		VEC_WRITE(VEC_DAC_D8, 0x087da511);
++	} else {
++		VEC_WRITE(VEC_DAC_D4, (u32)(hwm->nco_freq));
++		VEC_WRITE(VEC_DAC_D8, (u32)(hwm->nco_freq >> 32));
++	}
++	VEC_WRITE(VEC_DAC_EC, misc | rp1vec_rate_shift_table[rate - 4]);
++	rp1vec_write_regs(vec, 0xDC, rp1vec_fir_regs, ARRAY_SIZE(rp1vec_fir_regs));
++
++	/* Set up interrupts and initialise VEC. It will start on the next rp1vec_hw_update() */
++	VEC_WRITE(VEC_IRQ_FLAGS, 0xFFFFFFFFu);
++	rp1vec_hw_vblank_ctrl(vec, 1);
++	i = rp1vec_hw_busy(vec);
++	if (i)
++		dev_warn(&vec->pdev->dev,
++			 "%s: VEC unexpectedly busy at start (0x%08x)",
++			__func__, VEC_READ(VEC_STATUS));
++
++	VEC_WRITE(VEC_CONTROL,
++		  BITS(VEC_CONTROL_START_ARM, (!i)) |
++		  BITS(VEC_CONTROL_AUTO_REPEAT, 1));
++}
++
++void rp1vec_hw_update(struct rp1_vec *vec, dma_addr_t addr, u32 offset, u32 stride)
++{
++	/*
++	 * Update STRIDE, DMAH and DMAL only. When called after rp1vec_hw_setup(),
++	 * DMA starts immediately; if already running, the buffer will flip at
++	 * the next vertical sync event.
++	 */
++	u64 a = addr + offset;
++
++	if (vec->fake_31khz) {
++		a += stride;
++		stride *= 2;
++	}
++	VEC_WRITE(VEC_DMA_STRIDE, stride);
++	VEC_WRITE(VEC_DMA_ADDR_H, a >> 32);
++	VEC_WRITE(VEC_DMA_ADDR_L, a & 0xFFFFFFFFu);
++}
++
++void rp1vec_hw_stop(struct rp1_vec *vec)
++{
++	/*
++	 * Stop DMA by turning off the Auto-Repeat flag, and wait up to 100ms for
++	 * the current and any queued frame to end. "Force drain" flags are not used,
++	 * as they seem to prevent DMA from re-starting properly; it's safer to wait.
++	 */
++
++	reinit_completion(&vec->finished);
++	VEC_WRITE(VEC_CONTROL, 0);
++	if (!wait_for_completion_timeout(&vec->finished, HZ / 10))
++		drm_err(&vec->drm, "%s: timed out waiting for idle\n", __func__);
++	VEC_WRITE(VEC_IRQ_ENABLES, 0);
++}
++
++void rp1vec_hw_vblank_ctrl(struct rp1_vec *vec, int enable)
++{
++	VEC_WRITE(VEC_IRQ_ENABLES,
++		  BITS(VEC_IRQ_ENABLES_DONE, 1) |
++		  BITS(VEC_IRQ_ENABLES_DMA, (enable ? 1 : 0)) |
++		  BITS(VEC_IRQ_ENABLES_MATCH_ROW, 1023));
++}
++
++irqreturn_t rp1vec_hw_isr(int irq, void *dev)
++{
++	struct rp1_vec *vec = dev;
++	u32 u = VEC_READ(VEC_IRQ_FLAGS);
++
++	if (u) {
++		VEC_WRITE(VEC_IRQ_FLAGS, u);
++		if (u & VEC_IRQ_FLAGS_DMA_BITS)
++			drm_crtc_handle_vblank(&vec->pipe.crtc);
++		if (u & VEC_IRQ_FLAGS_DONE_BITS)
++			complete(&vec->finished);
++	}
++	return u ? IRQ_HANDLED : IRQ_NONE;
++}
+--- /dev/null
++++ b/drivers/gpu/drm/rp1/rp1-vec/vec_regs.h
+@@ -0,0 +1,1420 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
++// =============================================================================
++// Copyright Raspberry Pi Ltd. 2023
++// vrbuild version: 56aac1a23c016cbbd229108f3b6efc1343842156-clean
++// THIS FILE IS GENERATED BY VRBUILD - DO NOT EDIT
++// =============================================================================
++// Register block : VEC
++// Version        : 1
++// Bus type       : apb
++// Description    : None
++// =============================================================================
++#ifndef VEC_REGS_DEFINED
++#define VEC_REGS_DEFINED
++#define VEC_REGS_RWTYPE_MSB 13
++#define VEC_REGS_RWTYPE_LSB 12
++// =============================================================================
++// Register    : VEC_CONTROL
++// JTAG access : synchronous
++// Description : None
++#define VEC_CONTROL_OFFSET 0x00000000
++#define VEC_CONTROL_BITS   0x00000007
++#define VEC_CONTROL_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_CONTROL_BARS
++// Description : Write '1' to display colour bar test pattern
++#define VEC_CONTROL_BARS_RESET  0x0
++#define VEC_CONTROL_BARS_BITS   0x00000004
++#define VEC_CONTROL_BARS_MSB    2
++#define VEC_CONTROL_BARS_LSB    2
++#define VEC_CONTROL_BARS_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_CONTROL_AUTO_REPEAT
++// Description : Write '1' to re-display same frame continuously
++#define VEC_CONTROL_AUTO_REPEAT_RESET  0x0
++#define VEC_CONTROL_AUTO_REPEAT_BITS   0x00000002
++#define VEC_CONTROL_AUTO_REPEAT_MSB    1
++#define VEC_CONTROL_AUTO_REPEAT_LSB    1
++#define VEC_CONTROL_AUTO_REPEAT_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_CONTROL_START_ARM
++// Description : Write '1' before first DMA address is written This bit always
++//               reads back as '0'
++#define VEC_CONTROL_START_ARM_RESET  0x0
++#define VEC_CONTROL_START_ARM_BITS   0x00000001
++#define VEC_CONTROL_START_ARM_MSB    0
++#define VEC_CONTROL_START_ARM_LSB    0
++#define VEC_CONTROL_START_ARM_ACCESS "SC"
++// =============================================================================
++// Register    : VEC_IRQ_ENABLES
++// JTAG access : synchronous
++// Description : None
++#define VEC_IRQ_ENABLES_OFFSET 0x00000004
++#define VEC_IRQ_ENABLES_BITS   0x03ff003f
++#define VEC_IRQ_ENABLES_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_IRQ_ENABLES_MATCH_ROW
++// Description : Raster line at which MATCH interrupt is signalled
++#define VEC_IRQ_ENABLES_MATCH_ROW_RESET  0x000
++#define VEC_IRQ_ENABLES_MATCH_ROW_BITS   0x03ff0000
++#define VEC_IRQ_ENABLES_MATCH_ROW_MSB    25
++#define VEC_IRQ_ENABLES_MATCH_ROW_LSB    16
++#define VEC_IRQ_ENABLES_MATCH_ROW_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_IRQ_ENABLES_MATCH
++// Description : Output raster == match_row reached
++#define VEC_IRQ_ENABLES_MATCH_RESET  0x0
++#define VEC_IRQ_ENABLES_MATCH_BITS   0x00000020
++#define VEC_IRQ_ENABLES_MATCH_MSB    5
++#define VEC_IRQ_ENABLES_MATCH_LSB    5
++#define VEC_IRQ_ENABLES_MATCH_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_IRQ_ENABLES_ERROR
++// Description : DMA address overwritten before it was taken
++#define VEC_IRQ_ENABLES_ERROR_RESET  0x0
++#define VEC_IRQ_ENABLES_ERROR_BITS   0x00000010
++#define VEC_IRQ_ENABLES_ERROR_MSB    4
++#define VEC_IRQ_ENABLES_ERROR_LSB    4
++#define VEC_IRQ_ENABLES_ERROR_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_IRQ_ENABLES_DONE
++// Description : Last word sent to DAC after end of video (= all clear)
++#define VEC_IRQ_ENABLES_DONE_RESET  0x0
++#define VEC_IRQ_ENABLES_DONE_BITS   0x00000008
++#define VEC_IRQ_ENABLES_DONE_MSB    3
++#define VEC_IRQ_ENABLES_DONE_LSB    3
++#define VEC_IRQ_ENABLES_DONE_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_IRQ_ENABLES_FRAME
++// Description : Start of frame
++#define VEC_IRQ_ENABLES_FRAME_RESET  0x0
++#define VEC_IRQ_ENABLES_FRAME_BITS   0x00000004
++#define VEC_IRQ_ENABLES_FRAME_MSB    2
++#define VEC_IRQ_ENABLES_FRAME_LSB    2
++#define VEC_IRQ_ENABLES_FRAME_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_IRQ_ENABLES_UNDERFLOW
++// Description : Underflow has occurred
++#define VEC_IRQ_ENABLES_UNDERFLOW_RESET  0x0
++#define VEC_IRQ_ENABLES_UNDERFLOW_BITS   0x00000002
++#define VEC_IRQ_ENABLES_UNDERFLOW_MSB    1
++#define VEC_IRQ_ENABLES_UNDERFLOW_LSB    1
++#define VEC_IRQ_ENABLES_UNDERFLOW_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_IRQ_ENABLES_DMA
++// Description : DMA ready to accept next frame start address
++#define VEC_IRQ_ENABLES_DMA_RESET  0x0
++#define VEC_IRQ_ENABLES_DMA_BITS   0x00000001
++#define VEC_IRQ_ENABLES_DMA_MSB    0
++#define VEC_IRQ_ENABLES_DMA_LSB    0
++#define VEC_IRQ_ENABLES_DMA_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_IRQ_FLAGS
++// JTAG access : synchronous
++// Description : None
++#define VEC_IRQ_FLAGS_OFFSET 0x00000008
++#define VEC_IRQ_FLAGS_BITS   0x0000003f
++#define VEC_IRQ_FLAGS_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_IRQ_FLAGS_MATCH
++// Description : Output raster == match_row reached
++#define VEC_IRQ_FLAGS_MATCH_RESET  0x0
++#define VEC_IRQ_FLAGS_MATCH_BITS   0x00000020
++#define VEC_IRQ_FLAGS_MATCH_MSB    5
++#define VEC_IRQ_FLAGS_MATCH_LSB    5
++#define VEC_IRQ_FLAGS_MATCH_ACCESS "WC"
++// -----------------------------------------------------------------------------
++// Field       : VEC_IRQ_FLAGS_ERROR
++// Description : DMA address overwritten before it was taken
++#define VEC_IRQ_FLAGS_ERROR_RESET  0x0
++#define VEC_IRQ_FLAGS_ERROR_BITS   0x00000010
++#define VEC_IRQ_FLAGS_ERROR_MSB    4
++#define VEC_IRQ_FLAGS_ERROR_LSB    4
++#define VEC_IRQ_FLAGS_ERROR_ACCESS "WC"
++// -----------------------------------------------------------------------------
++// Field       : VEC_IRQ_FLAGS_DONE
++// Description : Last word sent to DAC after end of video (= all clear)
++#define VEC_IRQ_FLAGS_DONE_RESET  0x0
++#define VEC_IRQ_FLAGS_DONE_BITS   0x00000008
++#define VEC_IRQ_FLAGS_DONE_MSB    3
++#define VEC_IRQ_FLAGS_DONE_LSB    3
++#define VEC_IRQ_FLAGS_DONE_ACCESS "WC"
++// -----------------------------------------------------------------------------
++// Field       : VEC_IRQ_FLAGS_FRAME
++// Description : Start of frame
++#define VEC_IRQ_FLAGS_FRAME_RESET  0x0
++#define VEC_IRQ_FLAGS_FRAME_BITS   0x00000004
++#define VEC_IRQ_FLAGS_FRAME_MSB    2
++#define VEC_IRQ_FLAGS_FRAME_LSB    2
++#define VEC_IRQ_FLAGS_FRAME_ACCESS "WC"
++// -----------------------------------------------------------------------------
++// Field       : VEC_IRQ_FLAGS_UNDERFLOW
++// Description : Underflow has occurred
++#define VEC_IRQ_FLAGS_UNDERFLOW_RESET  0x0
++#define VEC_IRQ_FLAGS_UNDERFLOW_BITS   0x00000002
++#define VEC_IRQ_FLAGS_UNDERFLOW_MSB    1
++#define VEC_IRQ_FLAGS_UNDERFLOW_LSB    1
++#define VEC_IRQ_FLAGS_UNDERFLOW_ACCESS "WC"
++// -----------------------------------------------------------------------------
++// Field       : VEC_IRQ_FLAGS_DMA
++// Description : DMA ready to accept next frame start address
++#define VEC_IRQ_FLAGS_DMA_RESET  0x0
++#define VEC_IRQ_FLAGS_DMA_BITS   0x00000001
++#define VEC_IRQ_FLAGS_DMA_MSB    0
++#define VEC_IRQ_FLAGS_DMA_LSB    0
++#define VEC_IRQ_FLAGS_DMA_ACCESS "WC"
++// =============================================================================
++// Register    : VEC_QOS
++// JTAG access : synchronous
++// Description : This register configures panic levels for the AXI ar_qos
++//               quality of service field. Panic status is driven by the number
++//               of rows held in the SRAM cache:
++#define VEC_QOS_OFFSET 0x0000000c
++#define VEC_QOS_BITS   0x000fffff
++#define VEC_QOS_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_QOS_UQOS
++// Description : Upper AXI QOS
++#define VEC_QOS_UQOS_RESET  0x0
++#define VEC_QOS_UQOS_BITS   0x000f0000
++#define VEC_QOS_UQOS_MSB    19
++#define VEC_QOS_UQOS_LSB    16
++#define VEC_QOS_UQOS_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_QOS_ULEV
++// Description : Upper trip level (resolution = 1 / 16 of cache size)
++#define VEC_QOS_ULEV_RESET  0x0
++#define VEC_QOS_ULEV_BITS   0x0000f000
++#define VEC_QOS_ULEV_MSB    15
++#define VEC_QOS_ULEV_LSB    12
++#define VEC_QOS_ULEV_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_QOS_LQOS
++// Description : Lower AXI QOS
++#define VEC_QOS_LQOS_RESET  0x0
++#define VEC_QOS_LQOS_BITS   0x00000f00
++#define VEC_QOS_LQOS_MSB    11
++#define VEC_QOS_LQOS_LSB    8
++#define VEC_QOS_LQOS_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_QOS_LLEV
++// Description : Lower trip level (resolution = 1 / 16 of cache size)
++#define VEC_QOS_LLEV_RESET  0x0
++#define VEC_QOS_LLEV_BITS   0x000000f0
++#define VEC_QOS_LLEV_MSB    7
++#define VEC_QOS_LLEV_LSB    4
++#define VEC_QOS_LLEV_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_QOS_DQOS
++// Description : Default QOS
++#define VEC_QOS_DQOS_RESET  0x0
++#define VEC_QOS_DQOS_BITS   0x0000000f
++#define VEC_QOS_DQOS_MSB    3
++#define VEC_QOS_DQOS_LSB    0
++#define VEC_QOS_DQOS_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DMA_ADDR_L
++// JTAG access : synchronous
++// Description : Lower 32-bits
++#define VEC_DMA_ADDR_L_OFFSET 0x00000010
++#define VEC_DMA_ADDR_L_BITS   0xffffffff
++#define VEC_DMA_ADDR_L_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DMA_ADDR_L_AXI_ADDR
++// Description : Byte address of DMA transfer frame buffer.
++#define VEC_DMA_ADDR_L_AXI_ADDR_RESET  0x00000000
++#define VEC_DMA_ADDR_L_AXI_ADDR_BITS   0xffffffff
++#define VEC_DMA_ADDR_L_AXI_ADDR_MSB    31
++#define VEC_DMA_ADDR_L_AXI_ADDR_LSB    0
++#define VEC_DMA_ADDR_L_AXI_ADDR_ACCESS "RWF"
++// =============================================================================
++// Register    : VEC_DMA_STRIDE
++// JTAG access : synchronous
++// Description : This register sets the line byte stride.
++#define VEC_DMA_STRIDE_OFFSET 0x00000014
++#define VEC_DMA_STRIDE_BITS   0xffffffff
++#define VEC_DMA_STRIDE_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DMA_STRIDE_STRIDE
++// Description : Byte stride
++#define VEC_DMA_STRIDE_STRIDE_RESET  0x00000000
++#define VEC_DMA_STRIDE_STRIDE_BITS   0xffffffff
++#define VEC_DMA_STRIDE_STRIDE_MSB    31
++#define VEC_DMA_STRIDE_STRIDE_LSB    0
++#define VEC_DMA_STRIDE_STRIDE_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DMA_AREA
++// JTAG access : synchronous
++// Description : Interlaced pixel area. See example driver code.
++#define VEC_DMA_AREA_OFFSET 0x00000018
++#define VEC_DMA_AREA_BITS   0x03ff03ff
++#define VEC_DMA_AREA_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DMA_AREA_COLS_MINUS1
++// Description : Width
++#define VEC_DMA_AREA_COLS_MINUS1_RESET  0x000
++#define VEC_DMA_AREA_COLS_MINUS1_BITS   0x03ff0000
++#define VEC_DMA_AREA_COLS_MINUS1_MSB    25
++#define VEC_DMA_AREA_COLS_MINUS1_LSB    16
++#define VEC_DMA_AREA_COLS_MINUS1_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DMA_AREA_ROWS_PER_FIELD_MINUS1
++// Description : Lines per field = half of lines per interlaced frame
++#define VEC_DMA_AREA_ROWS_PER_FIELD_MINUS1_RESET  0x000
++#define VEC_DMA_AREA_ROWS_PER_FIELD_MINUS1_BITS   0x000003ff
++#define VEC_DMA_AREA_ROWS_PER_FIELD_MINUS1_MSB    9
++#define VEC_DMA_AREA_ROWS_PER_FIELD_MINUS1_LSB    0
++#define VEC_DMA_AREA_ROWS_PER_FIELD_MINUS1_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_YUV_SCALING
++// JTAG access : synchronous
++// Description : None
++#define VEC_YUV_SCALING_OFFSET 0x0000001c
++#define VEC_YUV_SCALING_BITS   0x3fffffff
++#define VEC_YUV_SCALING_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_YUV_SCALING_U10_SCALE_Y
++// Description : Y unsigned scaling factor - 8 binary places
++#define VEC_YUV_SCALING_U10_SCALE_Y_RESET  0x000
++#define VEC_YUV_SCALING_U10_SCALE_Y_BITS   0x3ff00000
++#define VEC_YUV_SCALING_U10_SCALE_Y_MSB    29
++#define VEC_YUV_SCALING_U10_SCALE_Y_LSB    20
++#define VEC_YUV_SCALING_U10_SCALE_Y_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_YUV_SCALING_S10_SCALE_U
++// Description : U signed scaling factor - 8 binary places
++#define VEC_YUV_SCALING_S10_SCALE_U_RESET  0x000
++#define VEC_YUV_SCALING_S10_SCALE_U_BITS   0x000ffc00
++#define VEC_YUV_SCALING_S10_SCALE_U_MSB    19
++#define VEC_YUV_SCALING_S10_SCALE_U_LSB    10
++#define VEC_YUV_SCALING_S10_SCALE_U_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_YUV_SCALING_S10_SCALE_V
++// Description : V signed scaling factor - 8 binary please
++#define VEC_YUV_SCALING_S10_SCALE_V_RESET  0x000
++#define VEC_YUV_SCALING_S10_SCALE_V_BITS   0x000003ff
++#define VEC_YUV_SCALING_S10_SCALE_V_MSB    9
++#define VEC_YUV_SCALING_S10_SCALE_V_LSB    0
++#define VEC_YUV_SCALING_S10_SCALE_V_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_BACK_PORCH
++// JTAG access : synchronous
++// Description : None
++#define VEC_BACK_PORCH_OFFSET 0x00000020
++#define VEC_BACK_PORCH_BITS   0x03ff03ff
++#define VEC_BACK_PORCH_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_BACK_PORCH_HBP_MINUS1
++// Description : Horizontal back porch
++#define VEC_BACK_PORCH_HBP_MINUS1_RESET  0x000
++#define VEC_BACK_PORCH_HBP_MINUS1_BITS   0x03ff0000
++#define VEC_BACK_PORCH_HBP_MINUS1_MSB    25
++#define VEC_BACK_PORCH_HBP_MINUS1_LSB    16
++#define VEC_BACK_PORCH_HBP_MINUS1_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_BACK_PORCH_VBP_MINUS1
++// Description : Vertical back porch
++#define VEC_BACK_PORCH_VBP_MINUS1_RESET  0x000
++#define VEC_BACK_PORCH_VBP_MINUS1_BITS   0x000003ff
++#define VEC_BACK_PORCH_VBP_MINUS1_MSB    9
++#define VEC_BACK_PORCH_VBP_MINUS1_LSB    0
++#define VEC_BACK_PORCH_VBP_MINUS1_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_FRONT_PORCH
++// JTAG access : synchronous
++// Description : None
++#define VEC_FRONT_PORCH_OFFSET 0x00000024
++#define VEC_FRONT_PORCH_BITS   0x03ff03ff
++#define VEC_FRONT_PORCH_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_FRONT_PORCH_HFP_MINUS1
++// Description : Horizontal front porch
++#define VEC_FRONT_PORCH_HFP_MINUS1_RESET  0x000
++#define VEC_FRONT_PORCH_HFP_MINUS1_BITS   0x03ff0000
++#define VEC_FRONT_PORCH_HFP_MINUS1_MSB    25
++#define VEC_FRONT_PORCH_HFP_MINUS1_LSB    16
++#define VEC_FRONT_PORCH_HFP_MINUS1_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_FRONT_PORCH_VFP_MINUS1
++// Description : Vertical front porch
++#define VEC_FRONT_PORCH_VFP_MINUS1_RESET  0x000
++#define VEC_FRONT_PORCH_VFP_MINUS1_BITS   0x000003ff
++#define VEC_FRONT_PORCH_VFP_MINUS1_MSB    9
++#define VEC_FRONT_PORCH_VFP_MINUS1_LSB    0
++#define VEC_FRONT_PORCH_VFP_MINUS1_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_SHIFT
++// JTAG access : synchronous
++// Description : Positions of R,G,B MS bits in the memory word. Note: due to an
++//               unintended red/blue swap, these fields have been renamed since
++//               a previous version. There is no functional change.
++#define VEC_SHIFT_OFFSET 0x00000028
++#define VEC_SHIFT_BITS   0x00007fff
++#define VEC_SHIFT_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_SHIFT_SHIFT_R
++// Description : Red MSB
++#define VEC_SHIFT_SHIFT_R_RESET  0x00
++#define VEC_SHIFT_SHIFT_R_BITS   0x00007c00
++#define VEC_SHIFT_SHIFT_R_MSB    14
++#define VEC_SHIFT_SHIFT_R_LSB    10
++#define VEC_SHIFT_SHIFT_R_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_SHIFT_SHIFT_G
++// Description : Green MSB
++#define VEC_SHIFT_SHIFT_G_RESET  0x00
++#define VEC_SHIFT_SHIFT_G_BITS   0x000003e0
++#define VEC_SHIFT_SHIFT_G_MSB    9
++#define VEC_SHIFT_SHIFT_G_LSB    5
++#define VEC_SHIFT_SHIFT_G_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_SHIFT_SHIFT_B
++// Description : Blue MSB
++#define VEC_SHIFT_SHIFT_B_RESET  0x00
++#define VEC_SHIFT_SHIFT_B_BITS   0x0000001f
++#define VEC_SHIFT_SHIFT_B_MSB    4
++#define VEC_SHIFT_SHIFT_B_LSB    0
++#define VEC_SHIFT_SHIFT_B_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_IMASK
++// JTAG access : synchronous
++// Description : Masks for R,G,B significant bits, left-justified within 10-bit
++//               fields.
++#define VEC_IMASK_OFFSET 0x0000002c
++#define VEC_IMASK_BITS   0x3fffffff
++#define VEC_IMASK_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_IMASK_MASK_R
++// Description : Red mask
++#define VEC_IMASK_MASK_R_RESET  0x000
++#define VEC_IMASK_MASK_R_BITS   0x3ff00000
++#define VEC_IMASK_MASK_R_MSB    29
++#define VEC_IMASK_MASK_R_LSB    20
++#define VEC_IMASK_MASK_R_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_IMASK_MASK_G
++// Description : Green mask
++#define VEC_IMASK_MASK_G_RESET  0x000
++#define VEC_IMASK_MASK_G_BITS   0x000ffc00
++#define VEC_IMASK_MASK_G_MSB    19
++#define VEC_IMASK_MASK_G_LSB    10
++#define VEC_IMASK_MASK_G_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_IMASK_MASK_B
++// Description : Blue mask
++#define VEC_IMASK_MASK_B_RESET  0x000
++#define VEC_IMASK_MASK_B_BITS   0x000003ff
++#define VEC_IMASK_MASK_B_MSB    9
++#define VEC_IMASK_MASK_B_LSB    0
++#define VEC_IMASK_MASK_B_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_MODE
++// JTAG access : synchronous
++// Description : None
++#define VEC_MODE_OFFSET 0x00000030
++#define VEC_MODE_BITS   0x01ff003f
++#define VEC_MODE_RESET  0x01c00000
++// -----------------------------------------------------------------------------
++// Field       : VEC_MODE_HIGH_WATER
++// Description : ALWAYS WRITE 8'hE0
++#define VEC_MODE_HIGH_WATER_RESET  0xe0
++#define VEC_MODE_HIGH_WATER_BITS   0x01fe0000
++#define VEC_MODE_HIGH_WATER_MSB    24
++#define VEC_MODE_HIGH_WATER_LSB    17
++#define VEC_MODE_HIGH_WATER_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_MODE_ALIGN16
++// Description : Data: 0=BYTE aligned; 1=BEAT aligned
++#define VEC_MODE_ALIGN16_RESET  0x0
++#define VEC_MODE_ALIGN16_BITS   0x00010000
++#define VEC_MODE_ALIGN16_MSB    16
++#define VEC_MODE_ALIGN16_LSB    16
++#define VEC_MODE_ALIGN16_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_MODE_VFP_EN
++// Description : Enable vertical front porch
++#define VEC_MODE_VFP_EN_RESET  0x0
++#define VEC_MODE_VFP_EN_BITS   0x00000020
++#define VEC_MODE_VFP_EN_MSB    5
++#define VEC_MODE_VFP_EN_LSB    5
++#define VEC_MODE_VFP_EN_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_MODE_VBP_EN
++// Description : Enable vertical back porch
++#define VEC_MODE_VBP_EN_RESET  0x0
++#define VEC_MODE_VBP_EN_BITS   0x00000010
++#define VEC_MODE_VBP_EN_MSB    4
++#define VEC_MODE_VBP_EN_LSB    4
++#define VEC_MODE_VBP_EN_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_MODE_HFP_EN
++// Description : Enable horizontal front porch
++#define VEC_MODE_HFP_EN_RESET  0x0
++#define VEC_MODE_HFP_EN_BITS   0x00000008
++#define VEC_MODE_HFP_EN_MSB    3
++#define VEC_MODE_HFP_EN_LSB    3
++#define VEC_MODE_HFP_EN_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_MODE_HBP_EN
++// Description : Enable horizontal back porch
++#define VEC_MODE_HBP_EN_RESET  0x0
++#define VEC_MODE_HBP_EN_BITS   0x00000004
++#define VEC_MODE_HBP_EN_MSB    2
++#define VEC_MODE_HBP_EN_LSB    2
++#define VEC_MODE_HBP_EN_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_MODE_FIELDS_PER_FRAME_MINUS1
++// Description : Interlaced / progressive
++#define VEC_MODE_FIELDS_PER_FRAME_MINUS1_RESET  0x0
++#define VEC_MODE_FIELDS_PER_FRAME_MINUS1_BITS   0x00000002
++#define VEC_MODE_FIELDS_PER_FRAME_MINUS1_MSB    1
++#define VEC_MODE_FIELDS_PER_FRAME_MINUS1_LSB    1
++#define VEC_MODE_FIELDS_PER_FRAME_MINUS1_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_MODE_FIRST_FIELD_ODD
++// Description : Interlacing order: odd/even or even/odd
++#define VEC_MODE_FIRST_FIELD_ODD_RESET  0x0
++#define VEC_MODE_FIRST_FIELD_ODD_BITS   0x00000001
++#define VEC_MODE_FIRST_FIELD_ODD_MSB    0
++#define VEC_MODE_FIRST_FIELD_ODD_LSB    0
++#define VEC_MODE_FIRST_FIELD_ODD_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_RGBSZ
++// JTAG access : synchronous
++// Description : None
++#define VEC_RGBSZ_OFFSET 0x00000034
++#define VEC_RGBSZ_BITS   0x00030fff
++#define VEC_RGBSZ_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_RGBSZ_BYTES_PER_PIXEL_MINUS1
++// Description : Pixel stride
++#define VEC_RGBSZ_BYTES_PER_PIXEL_MINUS1_RESET  0x0
++#define VEC_RGBSZ_BYTES_PER_PIXEL_MINUS1_BITS   0x00030000
++#define VEC_RGBSZ_BYTES_PER_PIXEL_MINUS1_MSB    17
++#define VEC_RGBSZ_BYTES_PER_PIXEL_MINUS1_LSB    16
++#define VEC_RGBSZ_BYTES_PER_PIXEL_MINUS1_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_RGBSZ_SCALE_R
++// Description : Red number of bits for shift-and-OR scaling
++#define VEC_RGBSZ_SCALE_R_RESET  0x0
++#define VEC_RGBSZ_SCALE_R_BITS   0x00000f00
++#define VEC_RGBSZ_SCALE_R_MSB    11
++#define VEC_RGBSZ_SCALE_R_LSB    8
++#define VEC_RGBSZ_SCALE_R_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_RGBSZ_SCALE_G
++// Description : Green number of bits for shift-and-OR scaling
++#define VEC_RGBSZ_SCALE_G_RESET  0x0
++#define VEC_RGBSZ_SCALE_G_BITS   0x000000f0
++#define VEC_RGBSZ_SCALE_G_MSB    7
++#define VEC_RGBSZ_SCALE_G_LSB    4
++#define VEC_RGBSZ_SCALE_G_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_RGBSZ_SCALE_B
++// Description : Blue number of bits for shift-and-OR scaling
++#define VEC_RGBSZ_SCALE_B_RESET  0x0
++#define VEC_RGBSZ_SCALE_B_BITS   0x0000000f
++#define VEC_RGBSZ_SCALE_B_MSB    3
++#define VEC_RGBSZ_SCALE_B_LSB    0
++#define VEC_RGBSZ_SCALE_B_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_PANICS
++// JTAG access : synchronous
++// Description : None
++#define VEC_PANICS_OFFSET 0x00000038
++#define VEC_PANICS_BITS   0xffffffff
++#define VEC_PANICS_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_PANICS_UCOUNT
++// Description : Upper panic count
++#define VEC_PANICS_UCOUNT_RESET  0x0000
++#define VEC_PANICS_UCOUNT_BITS   0xffff0000
++#define VEC_PANICS_UCOUNT_MSB    31
++#define VEC_PANICS_UCOUNT_LSB    16
++#define VEC_PANICS_UCOUNT_ACCESS "WC"
++// -----------------------------------------------------------------------------
++// Field       : VEC_PANICS_LCOUNT
++// Description : Lower panic count
++#define VEC_PANICS_LCOUNT_RESET  0x0000
++#define VEC_PANICS_LCOUNT_BITS   0x0000ffff
++#define VEC_PANICS_LCOUNT_MSB    15
++#define VEC_PANICS_LCOUNT_LSB    0
++#define VEC_PANICS_LCOUNT_ACCESS "WC"
++// =============================================================================
++// Register    : VEC_STATUS
++// JTAG access : synchronous
++// Description : None
++#define VEC_STATUS_OFFSET 0x0000003c
++#define VEC_STATUS_BITS   0xff000000
++#define VEC_STATUS_RESET  0x0d000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_STATUS_VERSION
++// Description : VEC module version code
++#define VEC_STATUS_VERSION_RESET  0x0d
++#define VEC_STATUS_VERSION_BITS   0xff000000
++#define VEC_STATUS_VERSION_MSB    31
++#define VEC_STATUS_VERSION_LSB    24
++#define VEC_STATUS_VERSION_ACCESS "RO"
++// =============================================================================
++// Register    : VEC_DMA_ADDR_H
++// JTAG access : synchronous
++// Description : Upper 32-bits
++#define VEC_DMA_ADDR_H_OFFSET 0x00000040
++#define VEC_DMA_ADDR_H_BITS   0xffffffff
++#define VEC_DMA_ADDR_H_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DMA_ADDR_H_AXI_ADDR
++// Description : Byte address of DMA transfer frame buffer.
++#define VEC_DMA_ADDR_H_AXI_ADDR_RESET  0x00000000
++#define VEC_DMA_ADDR_H_AXI_ADDR_BITS   0xffffffff
++#define VEC_DMA_ADDR_H_AXI_ADDR_MSB    31
++#define VEC_DMA_ADDR_H_AXI_ADDR_LSB    0
++#define VEC_DMA_ADDR_H_AXI_ADDR_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_BURST_ADDR_L
++// JTAG access : synchronous
++// Description : None
++#define VEC_BURST_ADDR_L_OFFSET 0x00000044
++#define VEC_BURST_ADDR_L_BITS   0xffffffff
++#define VEC_BURST_ADDR_L_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_BURST_ADDR_L_BURST_ADDR
++// Description : the lower 32-bits of the most recent read request sent to AXI
++//               memory.
++#define VEC_BURST_ADDR_L_BURST_ADDR_RESET  0x00000000
++#define VEC_BURST_ADDR_L_BURST_ADDR_BITS   0xffffffff
++#define VEC_BURST_ADDR_L_BURST_ADDR_MSB    31
++#define VEC_BURST_ADDR_L_BURST_ADDR_LSB    0
++#define VEC_BURST_ADDR_L_BURST_ADDR_ACCESS "RO"
++// =============================================================================
++// Register    : VEC_APB_TIMEOUT
++// JTAG access : synchronous
++// Description : None
++#define VEC_APB_TIMEOUT_OFFSET 0x00000048
++#define VEC_APB_TIMEOUT_BITS   0x000103ff
++#define VEC_APB_TIMEOUT_RESET  0x00000014
++// -----------------------------------------------------------------------------
++// Field       : VEC_APB_TIMEOUT_SLVERR_EN
++// Description : 1 = Assert PREADY and PSLVERR on timeout 0 = Assert PREADY only
++#define VEC_APB_TIMEOUT_SLVERR_EN_RESET  0x0
++#define VEC_APB_TIMEOUT_SLVERR_EN_BITS   0x00010000
++#define VEC_APB_TIMEOUT_SLVERR_EN_MSB    16
++#define VEC_APB_TIMEOUT_SLVERR_EN_LSB    16
++#define VEC_APB_TIMEOUT_SLVERR_EN_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_APB_TIMEOUT_TIMEOUT
++// Description : Maximum AXI clock cycles to wait for responses from DAC clock
++//               domain APB block
++#define VEC_APB_TIMEOUT_TIMEOUT_RESET  0x014
++#define VEC_APB_TIMEOUT_TIMEOUT_BITS   0x000003ff
++#define VEC_APB_TIMEOUT_TIMEOUT_MSB    9
++#define VEC_APB_TIMEOUT_TIMEOUT_LSB    0
++#define VEC_APB_TIMEOUT_TIMEOUT_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_80
++// JTAG access : synchronous
++// Description : None
++#define VEC_DAC_80_OFFSET 0x00000080
++#define VEC_DAC_80_BITS   0x3fff3fff
++#define VEC_DAC_80_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_80_U14_DE_BGN
++// Description : Beginning of active data enable within each visible line
++#define VEC_DAC_80_U14_DE_BGN_RESET  0x0000
++#define VEC_DAC_80_U14_DE_BGN_BITS   0x3fff0000
++#define VEC_DAC_80_U14_DE_BGN_MSB    29
++#define VEC_DAC_80_U14_DE_BGN_LSB    16
++#define VEC_DAC_80_U14_DE_BGN_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_80_U14_DE_END
++// Description : End of active data enable within each visible line
++#define VEC_DAC_80_U14_DE_END_RESET  0x0000
++#define VEC_DAC_80_U14_DE_END_BITS   0x00003fff
++#define VEC_DAC_80_U14_DE_END_MSB    13
++#define VEC_DAC_80_U14_DE_END_LSB    0
++#define VEC_DAC_80_U14_DE_END_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_84
++// JTAG access : synchronous
++// Description : None
++#define VEC_DAC_84_OFFSET 0x00000084
++#define VEC_DAC_84_BITS   0x1fff1fff
++#define VEC_DAC_84_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_84_U13_ACTIVE_RISE
++// Description : Horizontal blanking interval
++#define VEC_DAC_84_U13_ACTIVE_RISE_RESET  0x0000
++#define VEC_DAC_84_U13_ACTIVE_RISE_BITS   0x1fff0000
++#define VEC_DAC_84_U13_ACTIVE_RISE_MSB    28
++#define VEC_DAC_84_U13_ACTIVE_RISE_LSB    16
++#define VEC_DAC_84_U13_ACTIVE_RISE_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_84_U13_ACTIVE_FALL
++// Description : Horizontal blanking interval
++#define VEC_DAC_84_U13_ACTIVE_FALL_RESET  0x0000
++#define VEC_DAC_84_U13_ACTIVE_FALL_BITS   0x00001fff
++#define VEC_DAC_84_U13_ACTIVE_FALL_MSB    12
++#define VEC_DAC_84_U13_ACTIVE_FALL_LSB    0
++#define VEC_DAC_84_U13_ACTIVE_FALL_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_88
++// JTAG access : synchronous
++// Description : None
++#define VEC_DAC_88_OFFSET 0x00000088
++#define VEC_DAC_88_BITS   0x1fff1fff
++#define VEC_DAC_88_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_88_U13_HALF_LINE_PERIOD
++// Description : Ratio of DAC clock to horizontal line rate, halved
++#define VEC_DAC_88_U13_HALF_LINE_PERIOD_RESET  0x0000
++#define VEC_DAC_88_U13_HALF_LINE_PERIOD_BITS   0x1fff0000
++#define VEC_DAC_88_U13_HALF_LINE_PERIOD_MSB    28
++#define VEC_DAC_88_U13_HALF_LINE_PERIOD_LSB    16
++#define VEC_DAC_88_U13_HALF_LINE_PERIOD_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_88_U13_HORZ_SYNC
++// Description : Width of horizontal sync pulses
++#define VEC_DAC_88_U13_HORZ_SYNC_RESET  0x0000
++#define VEC_DAC_88_U13_HORZ_SYNC_BITS   0x00001fff
++#define VEC_DAC_88_U13_HORZ_SYNC_MSB    12
++#define VEC_DAC_88_U13_HORZ_SYNC_LSB    0
++#define VEC_DAC_88_U13_HORZ_SYNC_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_8C
++// JTAG access : synchronous
++// Description : None
++#define VEC_DAC_8C_OFFSET 0x0000008c
++#define VEC_DAC_8C_BITS   0x1fff1fff
++#define VEC_DAC_8C_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_8C_U13_BURST_RISE
++// Description : Start of raised-cosine colour burst envelope
++#define VEC_DAC_8C_U13_BURST_RISE_RESET  0x0000
++#define VEC_DAC_8C_U13_BURST_RISE_BITS   0x1fff0000
++#define VEC_DAC_8C_U13_BURST_RISE_MSB    28
++#define VEC_DAC_8C_U13_BURST_RISE_LSB    16
++#define VEC_DAC_8C_U13_BURST_RISE_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_8C_U13_BURST_FALL
++// Description : End of raised-cosine colour burst envelope
++#define VEC_DAC_8C_U13_BURST_FALL_RESET  0x0000
++#define VEC_DAC_8C_U13_BURST_FALL_BITS   0x00001fff
++#define VEC_DAC_8C_U13_BURST_FALL_MSB    12
++#define VEC_DAC_8C_U13_BURST_FALL_LSB    0
++#define VEC_DAC_8C_U13_BURST_FALL_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_90
++// JTAG access : synchronous
++// Description : None
++#define VEC_DAC_90_OFFSET 0x00000090
++#define VEC_DAC_90_BITS   0x1fff3fff
++#define VEC_DAC_90_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_90_U13_VERT_EQ
++// Description : Width of vertical equalisation pulses (= half line minus
++//               serration)
++#define VEC_DAC_90_U13_VERT_EQ_RESET  0x0000
++#define VEC_DAC_90_U13_VERT_EQ_BITS   0x1fff0000
++#define VEC_DAC_90_U13_VERT_EQ_MSB    28
++#define VEC_DAC_90_U13_VERT_EQ_LSB    16
++#define VEC_DAC_90_U13_VERT_EQ_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_90_U14_VERT_SYNC
++// Description : Width of vertical sync pulses
++#define VEC_DAC_90_U14_VERT_SYNC_RESET  0x0000
++#define VEC_DAC_90_U14_VERT_SYNC_BITS   0x00003fff
++#define VEC_DAC_90_U14_VERT_SYNC_MSB    13
++#define VEC_DAC_90_U14_VERT_SYNC_LSB    0
++#define VEC_DAC_90_U14_VERT_SYNC_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_94
++// JTAG access : synchronous
++// Description : None
++#define VEC_DAC_94_OFFSET 0x00000094
++#define VEC_DAC_94_BITS   0x03ff03ff
++#define VEC_DAC_94_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_94_U10_PRE_EQ_BGN
++// Description : Half-lines, inclusive, relative to field datum, where vertical
++//               pre-equalisation pulses start
++#define VEC_DAC_94_U10_PRE_EQ_BGN_RESET  0x000
++#define VEC_DAC_94_U10_PRE_EQ_BGN_BITS   0x03ff0000
++#define VEC_DAC_94_U10_PRE_EQ_BGN_MSB    25
++#define VEC_DAC_94_U10_PRE_EQ_BGN_LSB    16
++#define VEC_DAC_94_U10_PRE_EQ_BGN_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_94_U10_PRE_EQ_END
++// Description : Half-lines, inclusive, relative to field datum, where vertical
++//               pre-equalisation pulses end
++#define VEC_DAC_94_U10_PRE_EQ_END_RESET  0x000
++#define VEC_DAC_94_U10_PRE_EQ_END_BITS   0x000003ff
++#define VEC_DAC_94_U10_PRE_EQ_END_MSB    9
++#define VEC_DAC_94_U10_PRE_EQ_END_LSB    0
++#define VEC_DAC_94_U10_PRE_EQ_END_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_98
++// JTAG access : synchronous
++// Description : None
++#define VEC_DAC_98_OFFSET 0x00000098
++#define VEC_DAC_98_BITS   0x03ff03ff
++#define VEC_DAC_98_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_98_U10_FIELD_SYNC_BGN
++// Description : Half-lines containing vertical sync pulses (inclusive)
++#define VEC_DAC_98_U10_FIELD_SYNC_BGN_RESET  0x000
++#define VEC_DAC_98_U10_FIELD_SYNC_BGN_BITS   0x03ff0000
++#define VEC_DAC_98_U10_FIELD_SYNC_BGN_MSB    25
++#define VEC_DAC_98_U10_FIELD_SYNC_BGN_LSB    16
++#define VEC_DAC_98_U10_FIELD_SYNC_BGN_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_98_U10_FIELD_SYNC_END
++// Description : Half-lines containing vertical sync pulses (inclusive)
++#define VEC_DAC_98_U10_FIELD_SYNC_END_RESET  0x000
++#define VEC_DAC_98_U10_FIELD_SYNC_END_BITS   0x000003ff
++#define VEC_DAC_98_U10_FIELD_SYNC_END_MSB    9
++#define VEC_DAC_98_U10_FIELD_SYNC_END_LSB    0
++#define VEC_DAC_98_U10_FIELD_SYNC_END_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_9C
++// JTAG access : synchronous
++// Description : None
++#define VEC_DAC_9C_OFFSET 0x0000009c
++#define VEC_DAC_9C_BITS   0x03ff03ff
++#define VEC_DAC_9C_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_9C_U10_POST_EQ_BGN
++// Description : Half-lines containing vertical post-equalisation pulses
++#define VEC_DAC_9C_U10_POST_EQ_BGN_RESET  0x000
++#define VEC_DAC_9C_U10_POST_EQ_BGN_BITS   0x03ff0000
++#define VEC_DAC_9C_U10_POST_EQ_BGN_MSB    25
++#define VEC_DAC_9C_U10_POST_EQ_BGN_LSB    16
++#define VEC_DAC_9C_U10_POST_EQ_BGN_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_9C_U10_POST_EQ_END
++// Description : Half-lines containing vertical post-equalisation pulses
++#define VEC_DAC_9C_U10_POST_EQ_END_RESET  0x000
++#define VEC_DAC_9C_U10_POST_EQ_END_BITS   0x000003ff
++#define VEC_DAC_9C_U10_POST_EQ_END_MSB    9
++#define VEC_DAC_9C_U10_POST_EQ_END_LSB    0
++#define VEC_DAC_9C_U10_POST_EQ_END_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_A0
++// JTAG access : synchronous
++// Description : None
++#define VEC_DAC_A0_OFFSET 0x000000a0
++#define VEC_DAC_A0_BITS   0x03ff03ff
++#define VEC_DAC_A0_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_A0_U10_FLD1_BURST_BGN
++// Description : First and last full frame lines (1-based numbering) within the
++//               PAL/NTSC four field sequence which require a colour burst
++#define VEC_DAC_A0_U10_FLD1_BURST_BGN_RESET  0x000
++#define VEC_DAC_A0_U10_FLD1_BURST_BGN_BITS   0x03ff0000
++#define VEC_DAC_A0_U10_FLD1_BURST_BGN_MSB    25
++#define VEC_DAC_A0_U10_FLD1_BURST_BGN_LSB    16
++#define VEC_DAC_A0_U10_FLD1_BURST_BGN_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_A0_U10_FLD1_BURST_END
++// Description : First and last full frame lines (1-based numbering) within the
++//               PAL/NTSC four field sequence which require a colour burst
++#define VEC_DAC_A0_U10_FLD1_BURST_END_RESET  0x000
++#define VEC_DAC_A0_U10_FLD1_BURST_END_BITS   0x000003ff
++#define VEC_DAC_A0_U10_FLD1_BURST_END_MSB    9
++#define VEC_DAC_A0_U10_FLD1_BURST_END_LSB    0
++#define VEC_DAC_A0_U10_FLD1_BURST_END_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_A4
++// JTAG access : synchronous
++// Description : None
++#define VEC_DAC_A4_OFFSET 0x000000a4
++#define VEC_DAC_A4_BITS   0x03ff03ff
++#define VEC_DAC_A4_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_A4_U10_FLD2_BURST_BGN
++// Description : First and last full frame lines (1-based numbering) within the
++//               PAL/NTSC four field sequence which require a colour burst
++#define VEC_DAC_A4_U10_FLD2_BURST_BGN_RESET  0x000
++#define VEC_DAC_A4_U10_FLD2_BURST_BGN_BITS   0x03ff0000
++#define VEC_DAC_A4_U10_FLD2_BURST_BGN_MSB    25
++#define VEC_DAC_A4_U10_FLD2_BURST_BGN_LSB    16
++#define VEC_DAC_A4_U10_FLD2_BURST_BGN_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_A4_U10_FLD2_BURST_END
++// Description : First and last full frame lines (1-based numbering) within the
++//               PAL/NTSC four field sequence which require a colour burst
++#define VEC_DAC_A4_U10_FLD2_BURST_END_RESET  0x000
++#define VEC_DAC_A4_U10_FLD2_BURST_END_BITS   0x000003ff
++#define VEC_DAC_A4_U10_FLD2_BURST_END_MSB    9
++#define VEC_DAC_A4_U10_FLD2_BURST_END_LSB    0
++#define VEC_DAC_A4_U10_FLD2_BURST_END_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_A8
++// JTAG access : synchronous
++// Description : None
++#define VEC_DAC_A8_OFFSET 0x000000a8
++#define VEC_DAC_A8_BITS   0x03ff03ff
++#define VEC_DAC_A8_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_A8_U10_FLD3_BURST_BGN
++// Description : First and last full frame lines (1-based numbering) within the
++//               PAL/NTSC four field sequence which require a colour burst
++#define VEC_DAC_A8_U10_FLD3_BURST_BGN_RESET  0x000
++#define VEC_DAC_A8_U10_FLD3_BURST_BGN_BITS   0x03ff0000
++#define VEC_DAC_A8_U10_FLD3_BURST_BGN_MSB    25
++#define VEC_DAC_A8_U10_FLD3_BURST_BGN_LSB    16
++#define VEC_DAC_A8_U10_FLD3_BURST_BGN_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_A8_U10_FLD3_BURST_END
++// Description : First and last full frame lines (1-based numbering) within the
++//               PAL/NTSC four field sequence which require a colour burst
++#define VEC_DAC_A8_U10_FLD3_BURST_END_RESET  0x000
++#define VEC_DAC_A8_U10_FLD3_BURST_END_BITS   0x000003ff
++#define VEC_DAC_A8_U10_FLD3_BURST_END_MSB    9
++#define VEC_DAC_A8_U10_FLD3_BURST_END_LSB    0
++#define VEC_DAC_A8_U10_FLD3_BURST_END_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_AC
++// JTAG access : synchronous
++// Description : None
++#define VEC_DAC_AC_OFFSET 0x000000ac
++#define VEC_DAC_AC_BITS   0x03ff03ff
++#define VEC_DAC_AC_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_AC_U10_FLD4_BURST_BGN
++// Description : First and last full frame lines (1-based numbering) within the
++//               PAL/NTSC four field sequence which require a colour burst
++#define VEC_DAC_AC_U10_FLD4_BURST_BGN_RESET  0x000
++#define VEC_DAC_AC_U10_FLD4_BURST_BGN_BITS   0x03ff0000
++#define VEC_DAC_AC_U10_FLD4_BURST_BGN_MSB    25
++#define VEC_DAC_AC_U10_FLD4_BURST_BGN_LSB    16
++#define VEC_DAC_AC_U10_FLD4_BURST_BGN_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_AC_U10_FLD4_BURST_END
++// Description : First and last full frame lines (1-based numbering) within the
++//               PAL/NTSC four field sequence which require a colour burst
++#define VEC_DAC_AC_U10_FLD4_BURST_END_RESET  0x000
++#define VEC_DAC_AC_U10_FLD4_BURST_END_BITS   0x000003ff
++#define VEC_DAC_AC_U10_FLD4_BURST_END_MSB    9
++#define VEC_DAC_AC_U10_FLD4_BURST_END_LSB    0
++#define VEC_DAC_AC_U10_FLD4_BURST_END_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_B0
++// JTAG access : synchronous
++// Description : None
++#define VEC_DAC_B0_OFFSET 0x000000b0
++#define VEC_DAC_B0_BITS   0x03ff03ff
++#define VEC_DAC_B0_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_B0_U10_FLD24_FULL_LINE_BGN
++// Description : First and last full visible lines (1-based numbering) in the
++//               PAL/NTSC four field sequence
++#define VEC_DAC_B0_U10_FLD24_FULL_LINE_BGN_RESET  0x000
++#define VEC_DAC_B0_U10_FLD24_FULL_LINE_BGN_BITS   0x03ff0000
++#define VEC_DAC_B0_U10_FLD24_FULL_LINE_BGN_MSB    25
++#define VEC_DAC_B0_U10_FLD24_FULL_LINE_BGN_LSB    16
++#define VEC_DAC_B0_U10_FLD24_FULL_LINE_BGN_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_B0_U10_FLD24_FULL_LINE_END
++// Description : First and last full visible lines (1-based numbering) in the
++//               PAL/NTSC four field sequence
++#define VEC_DAC_B0_U10_FLD24_FULL_LINE_END_RESET  0x000
++#define VEC_DAC_B0_U10_FLD24_FULL_LINE_END_BITS   0x000003ff
++#define VEC_DAC_B0_U10_FLD24_FULL_LINE_END_MSB    9
++#define VEC_DAC_B0_U10_FLD24_FULL_LINE_END_LSB    0
++#define VEC_DAC_B0_U10_FLD24_FULL_LINE_END_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_B4
++// JTAG access : synchronous
++// Description : None
++#define VEC_DAC_B4_OFFSET 0x000000b4
++#define VEC_DAC_B4_BITS   0x03ff03ff
++#define VEC_DAC_B4_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_B4_U10_FLD13_FULL_LINE_BGN
++// Description : First and last full visible lines (1-based numbering) in the
++//               PAL/NTSC four field sequence
++#define VEC_DAC_B4_U10_FLD13_FULL_LINE_BGN_RESET  0x000
++#define VEC_DAC_B4_U10_FLD13_FULL_LINE_BGN_BITS   0x03ff0000
++#define VEC_DAC_B4_U10_FLD13_FULL_LINE_BGN_MSB    25
++#define VEC_DAC_B4_U10_FLD13_FULL_LINE_BGN_LSB    16
++#define VEC_DAC_B4_U10_FLD13_FULL_LINE_BGN_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_B4_U10_FLD13_FULL_LINE_END
++// Description : First and last full visible lines (1-based numbering) in the
++//               PAL/NTSC four field sequence
++#define VEC_DAC_B4_U10_FLD13_FULL_LINE_END_RESET  0x000
++#define VEC_DAC_B4_U10_FLD13_FULL_LINE_END_BITS   0x000003ff
++#define VEC_DAC_B4_U10_FLD13_FULL_LINE_END_MSB    9
++#define VEC_DAC_B4_U10_FLD13_FULL_LINE_END_LSB    0
++#define VEC_DAC_B4_U10_FLD13_FULL_LINE_END_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_B8
++// JTAG access : synchronous
++// Description : None
++#define VEC_DAC_B8_OFFSET 0x000000b8
++#define VEC_DAC_B8_BITS   0x03ff03ff
++#define VEC_DAC_B8_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_B8_U10_BOT_HALF_LINE
++// Description : Top and bottom visible half-lines in 1-based standard full
++//               frame numbering, for interlaced modes. Set to zero to disable.
++#define VEC_DAC_B8_U10_BOT_HALF_LINE_RESET  0x000
++#define VEC_DAC_B8_U10_BOT_HALF_LINE_BITS   0x03ff0000
++#define VEC_DAC_B8_U10_BOT_HALF_LINE_MSB    25
++#define VEC_DAC_B8_U10_BOT_HALF_LINE_LSB    16
++#define VEC_DAC_B8_U10_BOT_HALF_LINE_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_B8_U10_TOP_HALF_LINE
++// Description : Top and bottom visible half-lines in 1-based standard full
++//               frame numbering, for interlaced modes. Set to zero to disable.
++#define VEC_DAC_B8_U10_TOP_HALF_LINE_RESET  0x000
++#define VEC_DAC_B8_U10_TOP_HALF_LINE_BITS   0x000003ff
++#define VEC_DAC_B8_U10_TOP_HALF_LINE_MSB    9
++#define VEC_DAC_B8_U10_TOP_HALF_LINE_LSB    0
++#define VEC_DAC_B8_U10_TOP_HALF_LINE_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_BC
++// JTAG access : synchronous
++// Description : None
++#define VEC_DAC_BC_OFFSET 0x000000bc
++#define VEC_DAC_BC_BITS   0x07ff07ff
++#define VEC_DAC_BC_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_BC_S11_PEDESTAL
++// Description : NTSC pedestal. For 7.5 IRE, this field is 1024 * 7.5/100. For
++//               PAL, or Japanese NTSC, this field should be zero.
++#define VEC_DAC_BC_S11_PEDESTAL_RESET  0x000
++#define VEC_DAC_BC_S11_PEDESTAL_BITS   0x07ff0000
++#define VEC_DAC_BC_S11_PEDESTAL_MSB    26
++#define VEC_DAC_BC_S11_PEDESTAL_LSB    16
++#define VEC_DAC_BC_S11_PEDESTAL_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_BC_U11_HALF_LINES_PER_FIELD
++// Description : Mode = 625 PAL, Lines per field = 312.5,
++//               u11_half_lines_per_field = 1+2*312 Mode = 525 NTSC, Lines per
++//               field = 262.5, u11_half_lines_per_field = 1+2*262
++#define VEC_DAC_BC_U11_HALF_LINES_PER_FIELD_RESET  0x000
++#define VEC_DAC_BC_U11_HALF_LINES_PER_FIELD_BITS   0x000007ff
++#define VEC_DAC_BC_U11_HALF_LINES_PER_FIELD_MSB    10
++#define VEC_DAC_BC_U11_HALF_LINES_PER_FIELD_LSB    0
++#define VEC_DAC_BC_U11_HALF_LINES_PER_FIELD_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_C0
++// JTAG access : synchronous
++// Description : Synopsis DesignWare control
++#define VEC_DAC_C0_OFFSET 0x000000c0
++#define VEC_DAC_C0_BITS   0x000fffff
++#define VEC_DAC_C0_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_C0_DWC_CABLE_ENCTR3
++// Description : Synopsis test input
++#define VEC_DAC_C0_DWC_CABLE_ENCTR3_RESET  0x0
++#define VEC_DAC_C0_DWC_CABLE_ENCTR3_BITS   0x00080000
++#define VEC_DAC_C0_DWC_CABLE_ENCTR3_MSB    19
++#define VEC_DAC_C0_DWC_CABLE_ENCTR3_LSB    19
++#define VEC_DAC_C0_DWC_CABLE_ENCTR3_ACCESS "RO"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_C0_DWC_CABLE_CABLEOUT
++// Description : cable detect state
++#define VEC_DAC_C0_DWC_CABLE_CABLEOUT_RESET  0x0
++#define VEC_DAC_C0_DWC_CABLE_CABLEOUT_BITS   0x00070000
++#define VEC_DAC_C0_DWC_CABLE_CABLEOUT_MSB    18
++#define VEC_DAC_C0_DWC_CABLE_CABLEOUT_LSB    16
++#define VEC_DAC_C0_DWC_CABLE_CABLEOUT_ACCESS "RO"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_C0_DWC_MUX_2
++// Description : Select DAC channel 2 output
++#define VEC_DAC_C0_DWC_MUX_2_RESET  0x0
++#define VEC_DAC_C0_DWC_MUX_2_BITS   0x0000c000
++#define VEC_DAC_C0_DWC_MUX_2_MSB    15
++#define VEC_DAC_C0_DWC_MUX_2_LSB    14
++#define VEC_DAC_C0_DWC_MUX_2_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_C0_DWC_MUX_1
++// Description : Select DAC channel 1 output
++#define VEC_DAC_C0_DWC_MUX_1_RESET  0x0
++#define VEC_DAC_C0_DWC_MUX_1_BITS   0x00003000
++#define VEC_DAC_C0_DWC_MUX_1_MSB    13
++#define VEC_DAC_C0_DWC_MUX_1_LSB    12
++#define VEC_DAC_C0_DWC_MUX_1_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_C0_DWC_MUX_0
++// Description : Select DAC channel 0 output
++#define VEC_DAC_C0_DWC_MUX_0_RESET  0x0
++#define VEC_DAC_C0_DWC_MUX_0_BITS   0x00000c00
++#define VEC_DAC_C0_DWC_MUX_0_MSB    11
++#define VEC_DAC_C0_DWC_MUX_0_LSB    10
++#define VEC_DAC_C0_DWC_MUX_0_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_C0_DWC_TEST
++// Description : Fixed DAC command word
++#define VEC_DAC_C0_DWC_TEST_RESET  0x000
++#define VEC_DAC_C0_DWC_TEST_BITS   0x000003ff
++#define VEC_DAC_C0_DWC_TEST_MSB    9
++#define VEC_DAC_C0_DWC_TEST_LSB    0
++#define VEC_DAC_C0_DWC_TEST_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_C4
++// JTAG access : synchronous
++// Description : Synopsis DAC control
++#define VEC_DAC_C4_OFFSET 0x000000c4
++#define VEC_DAC_C4_BITS   0x1fffffff
++#define VEC_DAC_C4_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_C4_ENCTR
++// Description : Always write3'b000
++#define VEC_DAC_C4_ENCTR_RESET  0x0
++#define VEC_DAC_C4_ENCTR_BITS   0x1c000000
++#define VEC_DAC_C4_ENCTR_MSB    28
++#define VEC_DAC_C4_ENCTR_LSB    26
++#define VEC_DAC_C4_ENCTR_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_C4_ENSC
++// Description : Enable cable detect - write 3'b000
++#define VEC_DAC_C4_ENSC_RESET  0x0
++#define VEC_DAC_C4_ENSC_BITS   0x03800000
++#define VEC_DAC_C4_ENSC_MSB    25
++#define VEC_DAC_C4_ENSC_LSB    23
++#define VEC_DAC_C4_ENSC_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_C4_ENDAC
++// Description : Enable DAC channel
++#define VEC_DAC_C4_ENDAC_RESET  0x0
++#define VEC_DAC_C4_ENDAC_BITS   0x00700000
++#define VEC_DAC_C4_ENDAC_MSB    22
++#define VEC_DAC_C4_ENDAC_LSB    20
++#define VEC_DAC_C4_ENDAC_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_C4_ENVBG
++// Description : Enable internal bandgap reference - write '1'
++#define VEC_DAC_C4_ENVBG_RESET  0x0
++#define VEC_DAC_C4_ENVBG_BITS   0x00080000
++#define VEC_DAC_C4_ENVBG_MSB    19
++#define VEC_DAC_C4_ENVBG_LSB    19
++#define VEC_DAC_C4_ENVBG_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_C4_ENEXTREF
++// Description : Enable external reference - write '0'
++#define VEC_DAC_C4_ENEXTREF_RESET  0x0
++#define VEC_DAC_C4_ENEXTREF_BITS   0x00040000
++#define VEC_DAC_C4_ENEXTREF_MSB    18
++#define VEC_DAC_C4_ENEXTREF_LSB    18
++#define VEC_DAC_C4_ENEXTREF_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_C4_DAC2GC
++// Description : DAC channel 2 gain control - write 6'd63
++#define VEC_DAC_C4_DAC2GC_RESET  0x00
++#define VEC_DAC_C4_DAC2GC_BITS   0x0003f000
++#define VEC_DAC_C4_DAC2GC_MSB    17
++#define VEC_DAC_C4_DAC2GC_LSB    12
++#define VEC_DAC_C4_DAC2GC_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_C4_DAC1GC
++// Description : DAC channel 1 gain control - write 6'd63
++#define VEC_DAC_C4_DAC1GC_RESET  0x00
++#define VEC_DAC_C4_DAC1GC_BITS   0x00000fc0
++#define VEC_DAC_C4_DAC1GC_MSB    11
++#define VEC_DAC_C4_DAC1GC_LSB    6
++#define VEC_DAC_C4_DAC1GC_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_C4_DAC0GC
++// Description : DAC channel 0 gain control - write 6'd63
++#define VEC_DAC_C4_DAC0GC_RESET  0x00
++#define VEC_DAC_C4_DAC0GC_BITS   0x0000003f
++#define VEC_DAC_C4_DAC0GC_MSB    5
++#define VEC_DAC_C4_DAC0GC_LSB    0
++#define VEC_DAC_C4_DAC0GC_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_C8
++// JTAG access : synchronous
++// Description : None
++#define VEC_DAC_C8_OFFSET 0x000000c8
++#define VEC_DAC_C8_BITS   0xffffffff
++#define VEC_DAC_C8_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_C8_U16_SCALE_SYNC
++// Description : Scaling applied prior to final summation to form the DAC
++//               command word(s)
++#define VEC_DAC_C8_U16_SCALE_SYNC_RESET  0x0000
++#define VEC_DAC_C8_U16_SCALE_SYNC_BITS   0xffff0000
++#define VEC_DAC_C8_U16_SCALE_SYNC_MSB    31
++#define VEC_DAC_C8_U16_SCALE_SYNC_LSB    16
++#define VEC_DAC_C8_U16_SCALE_SYNC_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_C8_U16_SCALE_LUMA
++// Description : Scaling applied prior to final summation to form the DAC
++//               command word(s)
++#define VEC_DAC_C8_U16_SCALE_LUMA_RESET  0x0000
++#define VEC_DAC_C8_U16_SCALE_LUMA_BITS   0x0000ffff
++#define VEC_DAC_C8_U16_SCALE_LUMA_MSB    15
++#define VEC_DAC_C8_U16_SCALE_LUMA_LSB    0
++#define VEC_DAC_C8_U16_SCALE_LUMA_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_CC
++// JTAG access : synchronous
++// Description : None
++#define VEC_DAC_CC_OFFSET 0x000000cc
++#define VEC_DAC_CC_BITS   0xffffffff
++#define VEC_DAC_CC_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_CC_S16_SCALE_BURST
++// Description : Scaling applied prior to final summation to form the DAC
++//               command word(s)
++#define VEC_DAC_CC_S16_SCALE_BURST_RESET  0x0000
++#define VEC_DAC_CC_S16_SCALE_BURST_BITS   0xffff0000
++#define VEC_DAC_CC_S16_SCALE_BURST_MSB    31
++#define VEC_DAC_CC_S16_SCALE_BURST_LSB    16
++#define VEC_DAC_CC_S16_SCALE_BURST_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_CC_S16_SCALE_CHROMA
++// Description : Scaling applied prior to final summation to form the DAC
++//               command word(s)
++#define VEC_DAC_CC_S16_SCALE_CHROMA_RESET  0x0000
++#define VEC_DAC_CC_S16_SCALE_CHROMA_BITS   0x0000ffff
++#define VEC_DAC_CC_S16_SCALE_CHROMA_MSB    15
++#define VEC_DAC_CC_S16_SCALE_CHROMA_LSB    0
++#define VEC_DAC_CC_S16_SCALE_CHROMA_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_D0
++// JTAG access : synchronous
++// Description : None
++#define VEC_DAC_D0_OFFSET 0x000000d0
++#define VEC_DAC_D0_BITS   0xffffffff
++#define VEC_DAC_D0_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_D0_S16_OFFSET_LUMA
++// Description : These offsets are applied to the chroma and luma channels
++//               before the final MUX
++#define VEC_DAC_D0_S16_OFFSET_LUMA_RESET  0x0000
++#define VEC_DAC_D0_S16_OFFSET_LUMA_BITS   0xffff0000
++#define VEC_DAC_D0_S16_OFFSET_LUMA_MSB    31
++#define VEC_DAC_D0_S16_OFFSET_LUMA_LSB    16
++#define VEC_DAC_D0_S16_OFFSET_LUMA_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_D0_S16_OFFSET_CHRO
++// Description : These offsets are applied to the chroma and luma channels
++//               before the final MUX
++#define VEC_DAC_D0_S16_OFFSET_CHRO_RESET  0x0000
++#define VEC_DAC_D0_S16_OFFSET_CHRO_BITS   0x0000ffff
++#define VEC_DAC_D0_S16_OFFSET_CHRO_MSB    15
++#define VEC_DAC_D0_S16_OFFSET_CHRO_LSB    0
++#define VEC_DAC_D0_S16_OFFSET_CHRO_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_D4
++// JTAG access : synchronous
++// Description : None
++#define VEC_DAC_D4_OFFSET 0x000000d4
++#define VEC_DAC_D4_BITS   0xffffffff
++#define VEC_DAC_D4_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_D4_NCO_FREQ
++// Description : This 64-bit frequency command is applied to the phase
++//               accumulator of the NCO (numerically controlled oscillator)
++//               which generates the colour sub-carrier. This value is computed
++//               as ratio of sub-carrier frequency to DAC clock multiplied by
++//               2^64.
++#define VEC_DAC_D4_NCO_FREQ_RESET  0x00000000
++#define VEC_DAC_D4_NCO_FREQ_BITS   0xffffffff
++#define VEC_DAC_D4_NCO_FREQ_MSB    31
++#define VEC_DAC_D4_NCO_FREQ_LSB    0
++#define VEC_DAC_D4_NCO_FREQ_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_D8
++// JTAG access : synchronous
++// Description : None
++#define VEC_DAC_D8_OFFSET 0x000000d8
++#define VEC_DAC_D8_BITS   0xffffffff
++#define VEC_DAC_D8_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_D8_NCO_FREQ
++// Description : This 64-bit frequency command is applied to the phase
++//               accumulator of the NCO (numerically controlled oscillator)
++//               which generates the colour sub-carrier. This value is computed
++//               as ratio of sub-carrier frequency to DAC clock multiplied by
++//               2^64.
++#define VEC_DAC_D8_NCO_FREQ_RESET  0x00000000
++#define VEC_DAC_D8_NCO_FREQ_BITS   0xffffffff
++#define VEC_DAC_D8_NCO_FREQ_MSB    31
++#define VEC_DAC_D8_NCO_FREQ_LSB    0
++#define VEC_DAC_D8_NCO_FREQ_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_DC
++// JTAG access : synchronous
++// Description : None
++#define VEC_DAC_DC_OFFSET 0x000000dc
++#define VEC_DAC_DC_BITS   0xffffffff
++#define VEC_DAC_DC_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_DC_FIR_COEFF_CHROMA_0_6
++// Description : FIR filter coefficients
++#define VEC_DAC_DC_FIR_COEFF_CHROMA_0_6_RESET  0x0000
++#define VEC_DAC_DC_FIR_COEFF_CHROMA_0_6_BITS   0xffff0000
++#define VEC_DAC_DC_FIR_COEFF_CHROMA_0_6_MSB    31
++#define VEC_DAC_DC_FIR_COEFF_CHROMA_0_6_LSB    16
++#define VEC_DAC_DC_FIR_COEFF_CHROMA_0_6_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_DC_FIR_COEFF_LUMA_0_6
++// Description : FIR filter coefficients
++#define VEC_DAC_DC_FIR_COEFF_LUMA_0_6_RESET  0x0000
++#define VEC_DAC_DC_FIR_COEFF_LUMA_0_6_BITS   0x0000ffff
++#define VEC_DAC_DC_FIR_COEFF_LUMA_0_6_MSB    15
++#define VEC_DAC_DC_FIR_COEFF_LUMA_0_6_LSB    0
++#define VEC_DAC_DC_FIR_COEFF_LUMA_0_6_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_E0
++// JTAG access : synchronous
++// Description : None
++#define VEC_DAC_E0_OFFSET 0x000000e0
++#define VEC_DAC_E0_BITS   0xffffffff
++#define VEC_DAC_E0_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_E0_FIR_COEFF_CHROMA_1_5
++// Description : FIR filter coefficients
++#define VEC_DAC_E0_FIR_COEFF_CHROMA_1_5_RESET  0x0000
++#define VEC_DAC_E0_FIR_COEFF_CHROMA_1_5_BITS   0xffff0000
++#define VEC_DAC_E0_FIR_COEFF_CHROMA_1_5_MSB    31
++#define VEC_DAC_E0_FIR_COEFF_CHROMA_1_5_LSB    16
++#define VEC_DAC_E0_FIR_COEFF_CHROMA_1_5_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_E0_FIR_COEFF_LUMA_1_5
++// Description : FIR filter coefficients
++#define VEC_DAC_E0_FIR_COEFF_LUMA_1_5_RESET  0x0000
++#define VEC_DAC_E0_FIR_COEFF_LUMA_1_5_BITS   0x0000ffff
++#define VEC_DAC_E0_FIR_COEFF_LUMA_1_5_MSB    15
++#define VEC_DAC_E0_FIR_COEFF_LUMA_1_5_LSB    0
++#define VEC_DAC_E0_FIR_COEFF_LUMA_1_5_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_E4
++// JTAG access : synchronous
++// Description : None
++#define VEC_DAC_E4_OFFSET 0x000000e4
++#define VEC_DAC_E4_BITS   0xffffffff
++#define VEC_DAC_E4_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_E4_FIR_COEFF_CHROMA_2_4
++// Description : FIR filter coefficients
++#define VEC_DAC_E4_FIR_COEFF_CHROMA_2_4_RESET  0x0000
++#define VEC_DAC_E4_FIR_COEFF_CHROMA_2_4_BITS   0xffff0000
++#define VEC_DAC_E4_FIR_COEFF_CHROMA_2_4_MSB    31
++#define VEC_DAC_E4_FIR_COEFF_CHROMA_2_4_LSB    16
++#define VEC_DAC_E4_FIR_COEFF_CHROMA_2_4_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_E4_FIR_COEFF_LUMA_2_4
++// Description : FIR filter coefficients
++#define VEC_DAC_E4_FIR_COEFF_LUMA_2_4_RESET  0x0000
++#define VEC_DAC_E4_FIR_COEFF_LUMA_2_4_BITS   0x0000ffff
++#define VEC_DAC_E4_FIR_COEFF_LUMA_2_4_MSB    15
++#define VEC_DAC_E4_FIR_COEFF_LUMA_2_4_LSB    0
++#define VEC_DAC_E4_FIR_COEFF_LUMA_2_4_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_E8
++// JTAG access : synchronous
++// Description : None
++#define VEC_DAC_E8_OFFSET 0x000000e8
++#define VEC_DAC_E8_BITS   0xffffffff
++#define VEC_DAC_E8_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_E8_FIR_COEFF_CHROMA_3
++// Description : FIR filter coefficients
++#define VEC_DAC_E8_FIR_COEFF_CHROMA_3_RESET  0x0000
++#define VEC_DAC_E8_FIR_COEFF_CHROMA_3_BITS   0xffff0000
++#define VEC_DAC_E8_FIR_COEFF_CHROMA_3_MSB    31
++#define VEC_DAC_E8_FIR_COEFF_CHROMA_3_LSB    16
++#define VEC_DAC_E8_FIR_COEFF_CHROMA_3_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_E8_FIR_COEFF_LUMA_3
++// Description : FIR filter coefficients
++#define VEC_DAC_E8_FIR_COEFF_LUMA_3_RESET  0x0000
++#define VEC_DAC_E8_FIR_COEFF_LUMA_3_BITS   0x0000ffff
++#define VEC_DAC_E8_FIR_COEFF_LUMA_3_MSB    15
++#define VEC_DAC_E8_FIR_COEFF_LUMA_3_LSB    0
++#define VEC_DAC_E8_FIR_COEFF_LUMA_3_ACCESS "RW"
++// =============================================================================
++// Register    : VEC_DAC_EC
++// JTAG access : synchronous
++// Description : Misc. control
++#define VEC_DAC_EC_OFFSET 0x000000ec
++#define VEC_DAC_EC_BITS   0x001fffff
++#define VEC_DAC_EC_RESET  0x00000000
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_EC_SLOW_CLOCK
++// Description : Doubles the raised-cosine rate
++#define VEC_DAC_EC_SLOW_CLOCK_RESET  0x0
++#define VEC_DAC_EC_SLOW_CLOCK_BITS   0x00100000
++#define VEC_DAC_EC_SLOW_CLOCK_MSB    20
++#define VEC_DAC_EC_SLOW_CLOCK_LSB    20
++#define VEC_DAC_EC_SLOW_CLOCK_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_EC_FIR_RMINUS1
++// Description : Select 1, 3, 5 or 7 FIR taps
++#define VEC_DAC_EC_FIR_RMINUS1_RESET  0x0
++#define VEC_DAC_EC_FIR_RMINUS1_BITS   0x000c0000
++#define VEC_DAC_EC_FIR_RMINUS1_MSB    19
++#define VEC_DAC_EC_FIR_RMINUS1_LSB    18
++#define VEC_DAC_EC_FIR_RMINUS1_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_EC_VERT_FULL_NOT_HALF
++// Description : Disable half-line pulses during VBI
++#define VEC_DAC_EC_VERT_FULL_NOT_HALF_RESET  0x0
++#define VEC_DAC_EC_VERT_FULL_NOT_HALF_BITS   0x00020000
++#define VEC_DAC_EC_VERT_FULL_NOT_HALF_MSB    17
++#define VEC_DAC_EC_VERT_FULL_NOT_HALF_LSB    17
++#define VEC_DAC_EC_VERT_FULL_NOT_HALF_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_EC_SEQ_EN
++// Description : Enable NCO reset
++#define VEC_DAC_EC_SEQ_EN_RESET  0x0
++#define VEC_DAC_EC_SEQ_EN_BITS   0x00010000
++#define VEC_DAC_EC_SEQ_EN_MSB    16
++#define VEC_DAC_EC_SEQ_EN_LSB    16
++#define VEC_DAC_EC_SEQ_EN_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_EC_U2_FLD_MASK
++// Description : Field sequence
++#define VEC_DAC_EC_U2_FLD_MASK_RESET  0x0
++#define VEC_DAC_EC_U2_FLD_MASK_BITS   0x0000c000
++#define VEC_DAC_EC_U2_FLD_MASK_MSB    15
++#define VEC_DAC_EC_U2_FLD_MASK_LSB    14
++#define VEC_DAC_EC_U2_FLD_MASK_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_EC_U4_SEQ_MASK
++// Description : NCO reset sequence
++#define VEC_DAC_EC_U4_SEQ_MASK_RESET  0x0
++#define VEC_DAC_EC_U4_SEQ_MASK_BITS   0x00003c00
++#define VEC_DAC_EC_U4_SEQ_MASK_MSB    13
++#define VEC_DAC_EC_U4_SEQ_MASK_LSB    10
++#define VEC_DAC_EC_U4_SEQ_MASK_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_EC_INTERP_RATE_MINUS1
++// Description : Interpolation rate 2<=R<=16
++#define VEC_DAC_EC_INTERP_RATE_MINUS1_RESET  0x0
++#define VEC_DAC_EC_INTERP_RATE_MINUS1_BITS   0x000003c0
++#define VEC_DAC_EC_INTERP_RATE_MINUS1_MSB    9
++#define VEC_DAC_EC_INTERP_RATE_MINUS1_LSB    6
++#define VEC_DAC_EC_INTERP_RATE_MINUS1_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_EC_INTERP_SHIFT_MINUS1
++// Description : Power-of-2 scaling after interpolation
++#define VEC_DAC_EC_INTERP_SHIFT_MINUS1_RESET  0x0
++#define VEC_DAC_EC_INTERP_SHIFT_MINUS1_BITS   0x0000003c
++#define VEC_DAC_EC_INTERP_SHIFT_MINUS1_MSB    5
++#define VEC_DAC_EC_INTERP_SHIFT_MINUS1_LSB    2
++#define VEC_DAC_EC_INTERP_SHIFT_MINUS1_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_EC_FIELDS_PER_FRAME_MINUS1
++// Description : Interlaced / progressive
++#define VEC_DAC_EC_FIELDS_PER_FRAME_MINUS1_RESET  0x0
++#define VEC_DAC_EC_FIELDS_PER_FRAME_MINUS1_BITS   0x00000002
++#define VEC_DAC_EC_FIELDS_PER_FRAME_MINUS1_MSB    1
++#define VEC_DAC_EC_FIELDS_PER_FRAME_MINUS1_LSB    1
++#define VEC_DAC_EC_FIELDS_PER_FRAME_MINUS1_ACCESS "RW"
++// -----------------------------------------------------------------------------
++// Field       : VEC_DAC_EC_PAL_EN
++// Description : Enable phase alternate line (PAL) mode
++#define VEC_DAC_EC_PAL_EN_RESET  0x0
++#define VEC_DAC_EC_PAL_EN_BITS   0x00000001
++#define VEC_DAC_EC_PAL_EN_MSB    0
++#define VEC_DAC_EC_PAL_EN_LSB    0
++#define VEC_DAC_EC_PAL_EN_ACCESS "RW"
++// =============================================================================
++#endif // VEC_REGS_DEFINED
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0369-media-rp1-Add-CFE-Camera-Front-End-support.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0369-media-rp1-Add-CFE-Camera-Front-End-support.patch
new file mode 100644
index 00000000..1ff5fc45
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0369-media-rp1-Add-CFE-Camera-Front-End-support.patch
@@ -0,0 +1,6000 @@
+From 147a066b06ce2f8b26e7fe3bbc8d295c59390155 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Tue, 14 Feb 2023 20:58:59 +0000
+Subject: [PATCH 369/697] media: rp1: Add CFE (Camera Front End) support
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+v4l2: Add pisp compression format support to v4l2
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: rp1: cfe: Fix use of freed memory on errors
+
+cfe_probe_complete() calls cfe_put() on both success and fail code paths.
+This works for the success path, but causes the cfe_device struct to be
+freed, even if it will be used later in the teardown code.
+
+Fix this by making the ref handling a bit saner: Let the video nodes
+have the refs as they do now, but also keep a ref in the "main" driver,
+released only at cfe_remove() time. This way the driver does not depend
+on the video nodes keeping the refs.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+media: rp1: cfe: Fix width & height in cfe_start_channel()
+
+The logic for handling width & height in cfe_start_channel() is somewhat
+odd and, afaics, broken. The code reads:
+
+bool start_fe = is_fe_enabled(cfe) &&
+                test_all_nodes(cfe, NODE_ENABLED, NODE_STREAMING);
+
+if (start_fe || is_image_output_node(node)) {
+        width = node->fmt.fmt.pix.width;
+        height = node->fmt.fmt.pix.height;
+}
+
+cfe_start_channel() is called for all video nodes that will be used. So
+this means that if, say, fe_stats is enabled as the last node, start_fe
+will be true, and width and height will be taken from fe_stats' node.
+The width and height will thus contain garbage, which then gets
+programmed to the csi2 registers.
+
+It seems that this often still works fine, though, probably if the width
+& height are large enough.
+
+Drop the above code, and instead get the width & height from the csi2
+subdev's sink pad for the csi2 channel that is used. For metadata the
+width & height will be 0 as before.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+media: rp1: cfe: Fix verbose debug print
+
+The debug print in cfe_schedule_next_csi2_job() is printed every frame,
+and should thus use cfe_dbg_irq() to avoid spamming, rather than cfe_dbg().
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+media: rp1: cfe: Rename xxx_dbg_irq() to xxx_dbg_verbose()
+
+Rename the xxx_dbg_irq() macros to xxx_dbg_verbose(), as they can be
+used to verbose debugs outside irq context too.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+media: rp1: cfe: Add verbose debug module parameter
+
+Expose the verbose debug flag as a module parameter.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+media: rp1: cfe: Drop unused field
+
+Drop 'sensor_embedded_data' field, as it is unused.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+media: rp1: cfe: Fix default meta format's field
+
+Set default meta format's field to V4L2_FIELD_NONE, instead of zeroing
+it which indicates V4L2_FIELD_ANY. Metadata doesn't have fields, so NONE
+makes sense, and furthermore the default v4l2 link validation will check
+for matching fields, or that the sink field is NONE.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+media: rp1: cfe: Fail streaming if FE_CONFIG node is not enabled
+
+When the FE is enabled, ensure that the FE_CONFIG node is enabled.
+Otherwise fail cfe_start_streaming() entirely.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+drivers: media: rp1_cfe: Remove PISP specific MBUS formats
+
+Remove the MEDIA_BUS_FMT_PISP* format codcs entirely. For the image
+pad formats, use the 16-bit Bayer format mbus codes instead. For the
+config and stats pad formats, use MEDIA_BUS_FMT_FIXED.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+drivers: media: rp1_cfe: Fix link validate test for pixel format
+
+Now that we have removed unique PISP media bus codes, the cfe format
+table has multiple entries with the same media bus code for 16-bit
+formats. The test in cfe_video_link_validate() did not account for this.
+Fix it by testing the media bus code and the V4L2 pixelformat 4cc
+together.
+
+As a drive-by, ensure we have a valid CSI2 datatype id when programming
+the hardware block.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+drivers: media: cfe: Set the CSI-2 link frequency correctly
+
+Use the sensor provided link frequency to set the DPHY timing parameters
+on stream_on. This replaces the hard-coded 999 MHz value currently being
+used. As a fallback, revert to the original 999 Mhz link frequency.
+
+As a drive-by, fix a 80-character line formatting error.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+drivers: media: cfe: Don't confuse MHz and Mbps
+
+The driver was interchaning these units when talking about link rate.
+Fix this to avoid confusion. Apart from the logging message change,
+there is no function change in this commit.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: rp1: csi2: Fix missing reg writes
+
+The driver has two places where it writes a register based on a
+condition, and when that condition is false, the driver presumes that
+the register has the reset value. This is not a good idea, so fix those
+places to always write the register.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+media: rp1: fe: Use ~0, not -1, when working with unsigned values
+
+Use ~0, not -1, when working with unsigned values (-1 is not unsigned).
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+media: rp1: Add back reg write debug prints
+
+Add back debug prints in csi2 and pisp_fe reg_write() functions, but use
+the 'irq' variants to avoid spamming in normal situation.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+media: rp1: csi2: Track CSI-2 errors
+
+Track the errors from the CSI-2 receiver: overflows and discards. These
+are recorded in a table which can be read by the userspace via debugfs.
+
+As tracking the errors may cause much more interrupt load, the tracking
+needs to be enabled with a module parameter.
+
+Note that the recording is not perfect: we only record the last
+discarded DT for each discard type, instead of recording all of them.
+This means that e.g. if the device is discarding two unmatched DTs, the
+debugfs file only shows the last one recorded. Recording all of them
+would need a more sophisticated recording system to avoid the need of a
+very large table, or dynamic allocation.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+media: rp1: csi2: Set values for enum csi2_mode
+
+Set hardcoded values for enum csi2_mode, as the values will be
+programmed to HW registers.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+media: rp1: fe: Fix default mbus code
+
+When pisp_fe_pad_set_fmt() is given an mbus code that CFE does not
+support, it currently defaults to MEDIA_BUS_FMT_SBGGR10_1X10. This is
+not correct, as FE does not support SBGGR10.
+
+Set the default to MEDIA_BUS_FMT_SRGGB16_1X16 instead.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+drivers: media: cfe: Find the source pads on the sensor entity
+
+The driver was assuming that pad 0 on the sensor entity was the
+appropriate source pad, but this isn't necessarily the case.
+With video-mux, it has the sink pads first, and then the source
+pad as the last one.
+
+Iterate through the sensor pads to find the relevant source pads.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: rp1: cfe: Expose find_format_by_pix()
+
+Make find_format_by_pix() accessible to other files in the driver.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+media: rp1: cfe: Add cfe_find_16bit_code() and cfe_find_compressed_code()
+
+Add helper functions which, given an mbus code, return the 16-bit
+remapped mbus code or the compressed mbus code.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+media: rp1: csi2: Use get_frame_desc to get CSI-2 VC and DT
+
+Use get_frame_desc pad op for asking the CSI-2 VC and DT from the source
+device driver, instead of hardcoding to VC 0, and getting the DT from a
+formats table. To keep backward compatibility with sources that do not
+implement get_frame_desc, implement a fallback mechanism that always
+uses VC 0, and gets the DT from the formats table, based on the CSI2's
+sink pad's format.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+media: rp1: cfe: Add is_image_node()
+
+The hardware supports streaming from memory (in addition to streaming
+from the CSI-2 RX), but the driver does not support this at the moment.
+
+There are multiple places in the driver which uses
+is_image_output_node(), even if the "output" part is not relevant. Thus,
+in a minor preparation for the possible support for streaming from
+memory, and to make it more obvious that the pieces of code are not
+about the "output", add is_image_node() which will return true for both
+input and output video nodes.
+
+While at it, reformat also the metadata related macros to fit inside 80
+columns.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+media: rp1: cfe: Dual purpose video nodes
+
+The RP1 CSI-2 DMA can capture both video and metadata just fine, but at
+the moment the video nodes are only set to support either video or
+metadata.
+
+Make the changes to support both video and metadata. This mostly means
+tracking both video format and metadata format separately for each video
+node, and using vb2_queue_change_type() to change the vb2 queue type
+when needed.
+
+Briefly, this means that the user can get/set both video and meta
+formats to a single video node. The vb2 queue buffer type will be
+changed when the user calls REQBUFS or CREATE_BUFS ioctls. This buffer
+type will be then used as the "mode" for the video node when the user
+starts the streaming, and based on that either the video or the meta
+format will be used.
+
+A bunch of macros are added (node_supports_xxx()), which tell if a node
+can support a particular mode, whereas the existing macros
+(is_xxx_node()) will tell if the node is currently in a particular mode.
+Note that the latter will only work correctly between the start of the
+streaming and the end of the streaming, and thus should be only used in
+those code paths.
+
+However, as the userspace (libcamera) does not support dual purpose
+video nodes, for the time being let's keep the second video node as
+V4L2_CAP_META_CAPTURE only to keep the userspace working.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+media: rp1: Drop LE handling
+
+The driver registers for line-end interrupts, but never uses them. This
+just causes extra interrupt load, with more complexity in the driver.
+
+Drop the LE handling. It can easily be added back if later needed.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+media: rp1: cfe: Improve link validation for metadata
+
+Improve the link validation for metadata by:
+- Allowing capture buffers that are larger than the incoming frame
+  (instead of requiring exact match).
+
+- Instead of assuming that a metadata unit ("pixel") is 8 bits, use
+  find_format_by_code() to get the format and use the bit depth from
+  there. E.g. bit depth for RAW10 metadata will be 10 bits, when we
+  move to the upstream metadata formats.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+drivers: media: cfe: Add more robust ISR handlers
+
+Update the ISR logic to be more robust to sensors in problematic states
+where interrupts may start arriving overlapped and/or missing.
+
+1) Test for cur_frame in the FE handler, and if present, dequeue it in
+an error state so that it does not get orphaned.
+
+2) Move the sequence counter and timestamp variables to the node
+structures.  This allows the ISR to track channels running ahead when
+interrupts arrive unordered.
+
+3) Add a test to ensure we don't have a spurios (but harmlesS) call to
+the FE handler in some circumstances.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: rp1: cfe: Fix error paths in cfe_start_streaming
+
+Noted that if we get "node link is not enabled", then we also
+get the videobuf2 splat for the driver not cleaning up correctly
+on a failed start_streaming, and indeed we weren't returning the
+buffers.
+
+Checking the other error paths, noted that the "FE enabled, but
+FE_CONFIG node is not" path was not calling pm_runtime_put.
+
+Fix both paths.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drivers: media: cfe: Increase default size of embedded buffer
+
+Increase the size of the default embedded buffer to 16k. This is done to
+match what is advertised by the IMX219 driver and workaround a problem
+where the embedded stream is not actually used. Without full streams API
+support, the media pipeline validation will fail in these circumstances.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: rp1: cfe: Actually use the number of lanes configured
+
+The driver was calling get_mbus_config to ask the sensor subdev
+how many CSI2 data lanes it wished to use and with what other
+properties, but then failed to pass that to the DPHY configuration.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: rp1: csi2: Fix csi2_pad_set_fmt()
+
+The CSI-2 subdev's set_fmt currently allows setting the source and sink
+pad formats quite freely. This is not right, as the CSI-2 block can only
+do one of the following when processing the stream: 1) pass through as
+is, 2) expand to 16-bits, 3) compress.
+
+The csi2_pad_set_fmt() should take this into account, and only allow
+changing the source side mbus code, compared to the sink side format.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+media: rp1: csi2: Use standard link_validate
+
+The current csi2_link_validate() skips some important checks. Let's
+rather use the standard v4l2_subdev_link_validate_default() as the
+link_validate hook.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+media: rp1: csi2: Squash fixes
+
+media: rp1: fe: Fix pisp_fe_pad_set_fmt()
+
+pisp_fe_pad_set_fmt() allows setting the pad formats quite freely. This
+is not correct, and the function should only allow formats as supported
+by the hardware. Fix this by:
+
+Allow no format changes for FE_CONFIG_PAD and FE_STATS_PAD. They should
+always be the hardcoded initial ones.
+
+Allow setting FE_STREAM_PAD freely (but the mbus code must be
+supported), and propagate the format to the FE_OUTPUT0_PAD and
+FE_OUTPUT1_PAD pads.
+
+Allow changing the mbus code for FE_OUTPUT0_PAD and FE_OUTPUT1_PAD pads
+only if the mbus code is the compressed version of the sink side code.
+
+TODO: FE supports scaling and cropping. This should be represented here
+too?
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+media: rp1: fe: Use standard link_validate
+
+The current pisp_fe_link_validate() skips some important checks. Let's
+rather use the standard v4l2_subdev_link_validate_default() as the
+link_validate hook.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+drivers: media: cfe: Add 16-bit and compressed mono format support
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: rp1: cfe: Add missing remaps
+
+8-bit bayer formats are missing remap definitions. Add them.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+media: rp1: cfe: Add missing compressed remaps
+
+16-bit bayer formats are missing compressed remap definitions. Add them.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+drivers: media: pisp_be: pisp_fe: Update UAPI header licenses
+
+Update the license tags on the pisp UAPI header files with the
+"Linux-syscall-note" clause.  Also replace the "GPL-2.0" tag with the
+preferred "GPL-2.0-only" tag.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+media: rp1: cfe: Use the MIPI_CSI2_DT_xxx defines for csi_dt
+
+Seeing as we now have the CSI2 data types defined, make use of
+them instead of hardcoding the values.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+media: rp1: cfe: Add a csi_dt value for 16bit formats
+
+Raw 16bit formats didn't have a csi_dt value defined, which
+presumably would trip the WARN_ON(!fmt->csi_dt); in
+cfe_start_channel.
+
+The value is defined in CSI2 v2.0 as 0x2e, so set it accordingly.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drivers: media: pisp_be: Add mono and 48-bit RGB pixel format support
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+drivers: media: pisp_be: Update seqeuence numbers of the buffers
+
+Add a framebuffer sequence counter and increment on every completed job.
+This counter is then used to update the VB2 buffer sequence count before
+calling vb2_buffer_done().
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/platform/raspberrypi/Kconfig    |    1 +
+ drivers/media/platform/raspberrypi/Makefile   |    1 +
+ .../raspberrypi/pisp_be/pisp_be_config.h      |  533 ++++
+ .../platform/raspberrypi/rp1_cfe/Kconfig      |   14 +
+ .../platform/raspberrypi/rp1_cfe/Makefile     |    6 +
+ .../media/platform/raspberrypi/rp1_cfe/cfe.c  | 2421 +++++++++++++++++
+ .../media/platform/raspberrypi/rp1_cfe/cfe.h  |   43 +
+ .../platform/raspberrypi/rp1_cfe/cfe_fmts.h   |  316 +++
+ .../media/platform/raspberrypi/rp1_cfe/csi2.c |  628 +++++
+ .../media/platform/raspberrypi/rp1_cfe/csi2.h |   90 +
+ .../media/platform/raspberrypi/rp1_cfe/dphy.c |  177 ++
+ .../media/platform/raspberrypi/rp1_cfe/dphy.h |   27 +
+ .../raspberrypi/rp1_cfe/pisp_common.h         |   69 +
+ .../platform/raspberrypi/rp1_cfe/pisp_fe.c    |  569 ++++
+ .../platform/raspberrypi/rp1_cfe/pisp_fe.h    |   53 +
+ .../raspberrypi/rp1_cfe/pisp_fe_config.h      |  272 ++
+ .../raspberrypi/rp1_cfe/pisp_statistics.h     |   62 +
+ .../platform/raspberrypi/rp1_cfe/pisp_types.h |  144 +
+ include/uapi/linux/videodev2.h                |   15 +-
+ 19 files changed, 5437 insertions(+), 4 deletions(-)
+ create mode 100644 drivers/media/platform/raspberrypi/pisp_be/pisp_be_config.h
+ create mode 100644 drivers/media/platform/raspberrypi/rp1_cfe/Kconfig
+ create mode 100644 drivers/media/platform/raspberrypi/rp1_cfe/Makefile
+ create mode 100644 drivers/media/platform/raspberrypi/rp1_cfe/cfe.c
+ create mode 100644 drivers/media/platform/raspberrypi/rp1_cfe/cfe.h
+ create mode 100644 drivers/media/platform/raspberrypi/rp1_cfe/cfe_fmts.h
+ create mode 100644 drivers/media/platform/raspberrypi/rp1_cfe/csi2.c
+ create mode 100644 drivers/media/platform/raspberrypi/rp1_cfe/csi2.h
+ create mode 100644 drivers/media/platform/raspberrypi/rp1_cfe/dphy.c
+ create mode 100644 drivers/media/platform/raspberrypi/rp1_cfe/dphy.h
+ create mode 100644 drivers/media/platform/raspberrypi/rp1_cfe/pisp_common.h
+ create mode 100644 drivers/media/platform/raspberrypi/rp1_cfe/pisp_fe.c
+ create mode 100644 drivers/media/platform/raspberrypi/rp1_cfe/pisp_fe.h
+ create mode 100644 drivers/media/platform/raspberrypi/rp1_cfe/pisp_fe_config.h
+ create mode 100644 drivers/media/platform/raspberrypi/rp1_cfe/pisp_statistics.h
+ create mode 100644 drivers/media/platform/raspberrypi/rp1_cfe/pisp_types.h
+
+--- a/drivers/media/platform/raspberrypi/Kconfig
++++ b/drivers/media/platform/raspberrypi/Kconfig
+@@ -3,3 +3,4 @@
+ comment "Raspberry Pi media platform drivers"
+ 
+ source "drivers/media/platform/raspberrypi/pisp_be/Kconfig"
++source "drivers/media/platform/raspberrypi/rp1_cfe/Kconfig"
+--- a/drivers/media/platform/raspberrypi/Makefile
++++ b/drivers/media/platform/raspberrypi/Makefile
+@@ -1,3 +1,4 @@
+ # SPDX-License-Identifier: GPL-2.0
+ 
+ obj-y += pisp_be/
++obj-y += rp1_cfe/
+--- /dev/null
++++ b/drivers/media/platform/raspberrypi/pisp_be/pisp_be_config.h
+@@ -0,0 +1,533 @@
++/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
++/*
++ * PiSP Back End configuration definitions.
++ *
++ * Copyright (C) 2021 - Raspberry Pi Ltd
++ *
++ */
++#ifndef _PISP_BE_CONFIG_H_
++#define _PISP_BE_CONFIG_H_
++
++#include <linux/types.h>
++
++#include <media/raspberrypi/pisp_common.h>
++
++/* byte alignment for inputs */
++#define PISP_BACK_END_INPUT_ALIGN 4u
++/* alignment for compressed inputs */
++#define PISP_BACK_END_COMPRESSED_ALIGN 8u
++/* minimum required byte alignment for outputs */
++#define PISP_BACK_END_OUTPUT_MIN_ALIGN 16u
++/* preferred byte alignment for outputs */
++#define PISP_BACK_END_OUTPUT_MAX_ALIGN 64u
++
++/* minimum allowed tile width anywhere in the pipeline */
++#define PISP_BACK_END_MIN_TILE_WIDTH 16u
++/* minimum allowed tile width anywhere in the pipeline */
++#define PISP_BACK_END_MIN_TILE_HEIGHT 16u
++
++#define PISP_BACK_END_NUM_OUTPUTS 2
++#define PISP_BACK_END_HOG_OUTPUT 1
++
++#define PISP_BACK_END_NUM_TILES 64
++
++enum pisp_be_bayer_enable {
++	PISP_BE_BAYER_ENABLE_INPUT = 0x000001,
++	PISP_BE_BAYER_ENABLE_DECOMPRESS = 0x000002,
++	PISP_BE_BAYER_ENABLE_DPC = 0x000004,
++	PISP_BE_BAYER_ENABLE_GEQ = 0x000008,
++	PISP_BE_BAYER_ENABLE_TDN_INPUT = 0x000010,
++	PISP_BE_BAYER_ENABLE_TDN_DECOMPRESS = 0x000020,
++	PISP_BE_BAYER_ENABLE_TDN = 0x000040,
++	PISP_BE_BAYER_ENABLE_TDN_COMPRESS = 0x000080,
++	PISP_BE_BAYER_ENABLE_TDN_OUTPUT = 0x000100,
++	PISP_BE_BAYER_ENABLE_SDN = 0x000200,
++	PISP_BE_BAYER_ENABLE_BLC = 0x000400,
++	PISP_BE_BAYER_ENABLE_STITCH_INPUT = 0x000800,
++	PISP_BE_BAYER_ENABLE_STITCH_DECOMPRESS = 0x001000,
++	PISP_BE_BAYER_ENABLE_STITCH = 0x002000,
++	PISP_BE_BAYER_ENABLE_STITCH_COMPRESS = 0x004000,
++	PISP_BE_BAYER_ENABLE_STITCH_OUTPUT = 0x008000,
++	PISP_BE_BAYER_ENABLE_WBG = 0x010000,
++	PISP_BE_BAYER_ENABLE_CDN = 0x020000,
++	PISP_BE_BAYER_ENABLE_LSC = 0x040000,
++	PISP_BE_BAYER_ENABLE_TONEMAP = 0x080000,
++	PISP_BE_BAYER_ENABLE_CAC = 0x100000,
++	PISP_BE_BAYER_ENABLE_DEBIN = 0x200000,
++	PISP_BE_BAYER_ENABLE_DEMOSAIC = 0x400000,
++};
++
++enum pisp_be_rgb_enable {
++	PISP_BE_RGB_ENABLE_INPUT = 0x000001,
++	PISP_BE_RGB_ENABLE_CCM = 0x000002,
++	PISP_BE_RGB_ENABLE_SAT_CONTROL = 0x000004,
++	PISP_BE_RGB_ENABLE_YCBCR = 0x000008,
++	PISP_BE_RGB_ENABLE_FALSE_COLOUR = 0x000010,
++	PISP_BE_RGB_ENABLE_SHARPEN = 0x000020,
++	/* Preferred colours would occupy 0x000040 */
++	PISP_BE_RGB_ENABLE_YCBCR_INVERSE = 0x000080,
++	PISP_BE_RGB_ENABLE_GAMMA = 0x000100,
++	PISP_BE_RGB_ENABLE_CSC0 = 0x000200,
++	PISP_BE_RGB_ENABLE_CSC1 = 0x000400,
++	PISP_BE_RGB_ENABLE_DOWNSCALE0 = 0x001000,
++	PISP_BE_RGB_ENABLE_DOWNSCALE1 = 0x002000,
++	PISP_BE_RGB_ENABLE_RESAMPLE0 = 0x008000,
++	PISP_BE_RGB_ENABLE_RESAMPLE1 = 0x010000,
++	PISP_BE_RGB_ENABLE_OUTPUT0 = 0x040000,
++	PISP_BE_RGB_ENABLE_OUTPUT1 = 0x080000,
++	PISP_BE_RGB_ENABLE_HOG = 0x200000
++};
++
++#define PISP_BE_RGB_ENABLE_CSC(i) (PISP_BE_RGB_ENABLE_CSC0 << (i))
++#define PISP_BE_RGB_ENABLE_DOWNSCALE(i) (PISP_BE_RGB_ENABLE_DOWNSCALE0 << (i))
++#define PISP_BE_RGB_ENABLE_RESAMPLE(i) (PISP_BE_RGB_ENABLE_RESAMPLE0 << (i))
++#define PISP_BE_RGB_ENABLE_OUTPUT(i) (PISP_BE_RGB_ENABLE_OUTPUT0 << (i))
++
++/*
++ * We use the enable flags to show when blocks are "dirty", but we need some
++ * extra ones too.
++ */
++enum pisp_be_dirty {
++	PISP_BE_DIRTY_GLOBAL = 0x0001,
++	PISP_BE_DIRTY_SH_FC_COMBINE = 0x0002,
++	PISP_BE_DIRTY_CROP = 0x0004
++};
++
++struct pisp_be_global_config {
++	u32 bayer_enables;
++	u32 rgb_enables;
++	u8 bayer_order;
++	u8 pad[3];
++};
++
++struct pisp_be_input_buffer_config {
++	/* low 32 bits followed by high 32 bits (for each of up to 3 planes) */
++	u32 addr[3][2];
++};
++
++struct pisp_be_dpc_config {
++	u8 coeff_level;
++	u8 coeff_range;
++	u8 pad;
++#define PISP_BE_DPC_FLAG_FOLDBACK 1
++	u8 flags;
++};
++
++struct pisp_be_geq_config {
++	u16 offset;
++#define PISP_BE_GEQ_SHARPER BIT(15)
++#define PISP_BE_GEQ_SLOPE ((1 << 10) - 1)
++	/* top bit is the "sharper" flag, slope value is bottom 10 bits */
++	u16 slope_sharper;
++	u16 min;
++	u16 max;
++};
++
++struct pisp_be_tdn_input_buffer_config {
++	/* low 32 bits followed by high 32 bits */
++	u32 addr[2];
++};
++
++struct pisp_be_tdn_config {
++	u16 black_level;
++	u16 ratio;
++	u16 noise_constant;
++	u16 noise_slope;
++	u16 threshold;
++	u8 reset;
++	u8 pad;
++};
++
++struct pisp_be_tdn_output_buffer_config {
++	/* low 32 bits followed by high 32 bits */
++	u32 addr[2];
++};
++
++struct pisp_be_sdn_config {
++	u16 black_level;
++	u8 leakage;
++	u8 pad;
++	u16 noise_constant;
++	u16 noise_slope;
++	u16 noise_constant2;
++	u16 noise_slope2;
++};
++
++struct pisp_be_stitch_input_buffer_config {
++	/* low 32 bits followed by high 32 bits */
++	u32 addr[2];
++};
++
++#define PISP_BE_STITCH_STREAMING_LONG 0x8000
++#define PISP_BE_STITCH_EXPOSURE_RATIO_MASK 0x7fff
++
++struct pisp_be_stitch_config {
++	u16 threshold_lo;
++	u8 threshold_diff_power;
++	u8 pad;
++
++	/* top bit indicates whether streaming input is the long exposure */
++	u16 exposure_ratio;
++
++	u8 motion_threshold_256;
++	u8 motion_threshold_recip;
++};
++
++struct pisp_be_stitch_output_buffer_config {
++	/* low 32 bits followed by high 32 bits */
++	u32 addr[2];
++};
++
++struct pisp_be_cdn_config {
++	u16 thresh;
++	u8 iir_strength;
++	u8 g_adjust;
++};
++
++#define PISP_BE_LSC_LOG_GRID_SIZE 5
++#define PISP_BE_LSC_GRID_SIZE (1 << PISP_BE_LSC_LOG_GRID_SIZE)
++#define PISP_BE_LSC_STEP_PRECISION 18
++
++struct pisp_be_lsc_config {
++	/* (1<<18) / grid_cell_width */
++	u16 grid_step_x;
++	/* (1<<18) / grid_cell_height */
++	u16 grid_step_y;
++	/* RGB gains jointly encoded in 32 bits */
++	u32 lut_packed[PISP_BE_LSC_GRID_SIZE + 1]
++			   [PISP_BE_LSC_GRID_SIZE + 1];
++};
++
++struct pisp_be_lsc_extra {
++	u16 offset_x;
++	u16 offset_y;
++};
++
++#define PISP_BE_CAC_LOG_GRID_SIZE 3
++#define PISP_BE_CAC_GRID_SIZE (1 << PISP_BE_CAC_LOG_GRID_SIZE)
++#define PISP_BE_CAC_STEP_PRECISION 20
++
++struct pisp_be_cac_config {
++	/* (1<<20) / grid_cell_width */
++	u16 grid_step_x;
++	/* (1<<20) / grid_cell_height */
++	u16 grid_step_y;
++	/* [gridy][gridx][rb][xy] */
++	s8 lut[PISP_BE_CAC_GRID_SIZE + 1][PISP_BE_CAC_GRID_SIZE + 1][2][2];
++};
++
++struct pisp_be_cac_extra {
++	u16 offset_x;
++	u16 offset_y;
++};
++
++#define PISP_BE_DEBIN_NUM_COEFFS 4
++
++struct pisp_be_debin_config {
++	s8 coeffs[PISP_BE_DEBIN_NUM_COEFFS];
++	s8 h_enable;
++	s8 v_enable;
++	s8 pad[2];
++};
++
++#define PISP_BE_TONEMAP_LUT_SIZE 64
++
++struct pisp_be_tonemap_config {
++	u16 detail_constant;
++	u16 detail_slope;
++	u16 iir_strength;
++	u16 strength;
++	u32 lut[PISP_BE_TONEMAP_LUT_SIZE];
++};
++
++struct pisp_be_demosaic_config {
++	u8 sharper;
++	u8 fc_mode;
++	u8 pad[2];
++};
++
++struct pisp_be_ccm_config {
++	s16 coeffs[9];
++	u8 pad[2];
++	s32 offsets[3];
++};
++
++struct pisp_be_sat_control_config {
++	u8 shift_r;
++	u8 shift_g;
++	u8 shift_b;
++	u8 pad;
++};
++
++struct pisp_be_false_colour_config {
++	u8 distance;
++	u8 pad[3];
++};
++
++#define PISP_BE_SHARPEN_SIZE 5
++#define PISP_BE_SHARPEN_FUNC_NUM_POINTS 9
++
++struct pisp_be_sharpen_config {
++	s8 kernel0[PISP_BE_SHARPEN_SIZE * PISP_BE_SHARPEN_SIZE];
++	s8 pad0[3];
++	s8 kernel1[PISP_BE_SHARPEN_SIZE * PISP_BE_SHARPEN_SIZE];
++	s8 pad1[3];
++	s8 kernel2[PISP_BE_SHARPEN_SIZE * PISP_BE_SHARPEN_SIZE];
++	s8 pad2[3];
++	s8 kernel3[PISP_BE_SHARPEN_SIZE * PISP_BE_SHARPEN_SIZE];
++	s8 pad3[3];
++	s8 kernel4[PISP_BE_SHARPEN_SIZE * PISP_BE_SHARPEN_SIZE];
++	s8 pad4[3];
++	u16 threshold_offset0;
++	u16 threshold_slope0;
++	u16 scale0;
++	u16 pad5;
++	u16 threshold_offset1;
++	u16 threshold_slope1;
++	u16 scale1;
++	u16 pad6;
++	u16 threshold_offset2;
++	u16 threshold_slope2;
++	u16 scale2;
++	u16 pad7;
++	u16 threshold_offset3;
++	u16 threshold_slope3;
++	u16 scale3;
++	u16 pad8;
++	u16 threshold_offset4;
++	u16 threshold_slope4;
++	u16 scale4;
++	u16 pad9;
++	u16 positive_strength;
++	u16 positive_pre_limit;
++	u16 positive_func[PISP_BE_SHARPEN_FUNC_NUM_POINTS];
++	u16 positive_limit;
++	u16 negative_strength;
++	u16 negative_pre_limit;
++	u16 negative_func[PISP_BE_SHARPEN_FUNC_NUM_POINTS];
++	u16 negative_limit;
++	u8 enables;
++	u8 white;
++	u8 black;
++	u8 grey;
++};
++
++struct pisp_be_sh_fc_combine_config {
++	u8 y_factor;
++	u8 c1_factor;
++	u8 c2_factor;
++	u8 pad;
++};
++
++#define PISP_BE_GAMMA_LUT_SIZE 64
++
++struct pisp_be_gamma_config {
++	u32 lut[PISP_BE_GAMMA_LUT_SIZE];
++};
++
++struct pisp_be_crop_config {
++	u16 offset_x, offset_y;
++	u16 width, height;
++};
++
++#define PISP_BE_RESAMPLE_FILTER_SIZE 96
++
++struct pisp_be_resample_config {
++	u16 scale_factor_h, scale_factor_v;
++	s16 coef[PISP_BE_RESAMPLE_FILTER_SIZE];
++};
++
++struct pisp_be_resample_extra {
++	u16 scaled_width;
++	u16 scaled_height;
++	s16 initial_phase_h[3];
++	s16 initial_phase_v[3];
++};
++
++struct pisp_be_downscale_config {
++	u16 scale_factor_h;
++	u16 scale_factor_v;
++	u16 scale_recip_h;
++	u16 scale_recip_v;
++};
++
++struct pisp_be_downscale_extra {
++	u16 scaled_width;
++	u16 scaled_height;
++};
++
++struct pisp_be_hog_config {
++	u8 compute_signed;
++	u8 channel_mix[3];
++	u32 stride;
++};
++
++struct pisp_be_axi_config {
++	u8 r_qos; /* Read QoS */
++	u8 r_cache_prot; /* Read { prot[2:0], cache[3:0] } */
++	u8 w_qos; /* Write QoS */
++	u8 w_cache_prot; /* Write { prot[2:0], cache[3:0] } */
++};
++
++enum pisp_be_transform {
++	PISP_BE_TRANSFORM_NONE = 0x0,
++	PISP_BE_TRANSFORM_HFLIP = 0x1,
++	PISP_BE_TRANSFORM_VFLIP = 0x2,
++	PISP_BE_TRANSFORM_ROT180 =
++		(PISP_BE_TRANSFORM_HFLIP | PISP_BE_TRANSFORM_VFLIP)
++};
++
++struct pisp_be_output_format_config {
++	struct pisp_image_format_config image;
++	u8 transform;
++	u8 pad[3];
++	u16 lo;
++	u16 hi;
++	u16 lo2;
++	u16 hi2;
++};
++
++struct pisp_be_output_buffer_config {
++	/* low 32 bits followed by high 32 bits (for each of 3 planes) */
++	u32 addr[3][2];
++};
++
++struct pisp_be_hog_buffer_config {
++	/* low 32 bits followed by high 32 bits */
++	u32 addr[2];
++};
++
++struct pisp_be_config {
++	/* I/O configuration: */
++	struct pisp_be_input_buffer_config input_buffer;
++	struct pisp_be_tdn_input_buffer_config tdn_input_buffer;
++	struct pisp_be_stitch_input_buffer_config stitch_input_buffer;
++	struct pisp_be_tdn_output_buffer_config tdn_output_buffer;
++	struct pisp_be_stitch_output_buffer_config stitch_output_buffer;
++	struct pisp_be_output_buffer_config
++				output_buffer[PISP_BACK_END_NUM_OUTPUTS];
++	struct pisp_be_hog_buffer_config hog_buffer;
++	/* Processing configuration: */
++	struct pisp_be_global_config global;
++	struct pisp_image_format_config input_format;
++	struct pisp_decompress_config decompress;
++	struct pisp_be_dpc_config dpc;
++	struct pisp_be_geq_config geq;
++	struct pisp_image_format_config tdn_input_format;
++	struct pisp_decompress_config tdn_decompress;
++	struct pisp_be_tdn_config tdn;
++	struct pisp_compress_config tdn_compress;
++	struct pisp_image_format_config tdn_output_format;
++	struct pisp_be_sdn_config sdn;
++	struct pisp_bla_config blc;
++	struct pisp_compress_config stitch_compress;
++	struct pisp_image_format_config stitch_output_format;
++	struct pisp_image_format_config stitch_input_format;
++	struct pisp_decompress_config stitch_decompress;
++	struct pisp_be_stitch_config stitch;
++	struct pisp_be_lsc_config lsc;
++	struct pisp_wbg_config wbg;
++	struct pisp_be_cdn_config cdn;
++	struct pisp_be_cac_config cac;
++	struct pisp_be_debin_config debin;
++	struct pisp_be_tonemap_config tonemap;
++	struct pisp_be_demosaic_config demosaic;
++	struct pisp_be_ccm_config ccm;
++	struct pisp_be_sat_control_config sat_control;
++	struct pisp_be_ccm_config ycbcr;
++	struct pisp_be_sharpen_config sharpen;
++	struct pisp_be_false_colour_config false_colour;
++	struct pisp_be_sh_fc_combine_config sh_fc_combine;
++	struct pisp_be_ccm_config ycbcr_inverse;
++	struct pisp_be_gamma_config gamma;
++	struct pisp_be_ccm_config csc[PISP_BACK_END_NUM_OUTPUTS];
++	struct pisp_be_downscale_config downscale[PISP_BACK_END_NUM_OUTPUTS];
++	struct pisp_be_resample_config resample[PISP_BACK_END_NUM_OUTPUTS];
++	struct pisp_be_output_format_config
++				output_format[PISP_BACK_END_NUM_OUTPUTS];
++	struct pisp_be_hog_config hog;
++	struct pisp_be_axi_config axi;
++	/* Non-register fields: */
++	struct pisp_be_lsc_extra lsc_extra;
++	struct pisp_be_cac_extra cac_extra;
++	struct pisp_be_downscale_extra
++				downscale_extra[PISP_BACK_END_NUM_OUTPUTS];
++	struct pisp_be_resample_extra resample_extra[PISP_BACK_END_NUM_OUTPUTS];
++	struct pisp_be_crop_config crop;
++	struct pisp_image_format_config hog_format;
++	u32 dirty_flags_bayer; /* these use pisp_be_bayer_enable */
++	u32 dirty_flags_rgb; /* use pisp_be_rgb_enable */
++	u32 dirty_flags_extra; /* these use pisp_be_dirty_t */
++};
++
++/*
++ * We also need a tile structure to describe the size of the tiles going
++ * through the pipeline.
++ */
++
++enum pisp_tile_edge {
++	PISP_LEFT_EDGE = (1 << 0),
++	PISP_RIGHT_EDGE = (1 << 1),
++	PISP_TOP_EDGE = (1 << 2),
++	PISP_BOTTOM_EDGE = (1 << 3)
++};
++
++struct pisp_tile {
++	u8 edge; // enum pisp_tile_edge
++	u8 pad0[3];
++	// 4 bytes
++	u32 input_addr_offset;
++	u32 input_addr_offset2;
++	u16 input_offset_x;
++	u16 input_offset_y;
++	u16 input_width;
++	u16 input_height;
++	// 20 bytes
++	u32 tdn_input_addr_offset;
++	u32 tdn_output_addr_offset;
++	u32 stitch_input_addr_offset;
++	u32 stitch_output_addr_offset;
++	// 36 bytes
++	u32 lsc_grid_offset_x;
++	u32 lsc_grid_offset_y;
++	// 44 bytes
++	u32 cac_grid_offset_x;
++	u32 cac_grid_offset_y;
++	// 52 bytes
++	u16 crop_x_start[PISP_BACK_END_NUM_OUTPUTS];
++	u16 crop_x_end[PISP_BACK_END_NUM_OUTPUTS];
++	u16 crop_y_start[PISP_BACK_END_NUM_OUTPUTS];
++	u16 crop_y_end[PISP_BACK_END_NUM_OUTPUTS];
++	// 68 bytes
++	/* Ordering is planes then branches */
++	u16 downscale_phase_x[3 * PISP_BACK_END_NUM_OUTPUTS];
++	u16 downscale_phase_y[3 * PISP_BACK_END_NUM_OUTPUTS];
++	// 92 bytes
++	u16 resample_in_width[PISP_BACK_END_NUM_OUTPUTS];
++	u16 resample_in_height[PISP_BACK_END_NUM_OUTPUTS];
++	// 100 bytes
++	/* Ordering is planes then branches */
++	u16 resample_phase_x[3 * PISP_BACK_END_NUM_OUTPUTS];
++	u16 resample_phase_y[3 * PISP_BACK_END_NUM_OUTPUTS];
++	// 124 bytes
++	u16 output_offset_x[PISP_BACK_END_NUM_OUTPUTS];
++	u16 output_offset_y[PISP_BACK_END_NUM_OUTPUTS];
++	u16 output_width[PISP_BACK_END_NUM_OUTPUTS];
++	u16 output_height[PISP_BACK_END_NUM_OUTPUTS];
++	// 140 bytes
++	u32 output_addr_offset[PISP_BACK_END_NUM_OUTPUTS];
++	u32 output_addr_offset2[PISP_BACK_END_NUM_OUTPUTS];
++	// 156 bytes
++	u32 output_hog_addr_offset;
++	// 160 bytes
++};
++
++static_assert(sizeof(struct pisp_tile) == 160);
++
++struct pisp_be_tiles_config {
++	struct pisp_be_config config;
++	struct pisp_tile tiles[PISP_BACK_END_NUM_TILES];
++	int num_tiles;
++};
++
++#endif /* _PISP_BE_CONFIG_H_ */
+--- /dev/null
++++ b/drivers/media/platform/raspberrypi/rp1_cfe/Kconfig
+@@ -0,0 +1,14 @@
++# RP1 V4L2 camera support
++
++config VIDEO_RP1_CFE
++	tristate "RP1 Camera Frond End (CFE) video capture driver"
++	depends on VIDEO_DEV
++	select VIDEO_V4L2_SUBDEV_API
++	select MEDIA_CONTROLLER
++	select VIDEOBUF2_DMA_CONTIG
++	select V4L2_FWNODE
++	help
++	  Say Y here to enable support for the RP1 Camera Front End.
++
++	  To compile this driver as a module, choose M here. The module will be
++	  called rp1-cfe.
+--- /dev/null
++++ b/drivers/media/platform/raspberrypi/rp1_cfe/Makefile
+@@ -0,0 +1,6 @@
++# SPDX-License-Identifier: GPL-2.0
++#
++# Makefile for RP1 Camera Front End driver
++#
++rp1-cfe-objs := cfe.o csi2.o pisp_fe.o dphy.o
++obj-$(CONFIG_VIDEO_RP1_CFE) += rp1-cfe.o
+--- /dev/null
++++ b/drivers/media/platform/raspberrypi/rp1_cfe/cfe.c
+@@ -0,0 +1,2421 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * RP1 Camera Front End Driver
++ *
++ * Copyright (C) 2021-2022 - Raspberry Pi Ltd.
++ *
++ */
++
++#include <linux/atomic.h>
++#include <linux/clk.h>
++#include <linux/debugfs.h>
++#include <linux/delay.h>
++#include <linux/device.h>
++#include <linux/dma-mapping.h>
++#include <linux/err.h>
++#include <linux/init.h>
++#include <linux/interrupt.h>
++#include <linux/io.h>
++#include <linux/module.h>
++#include <linux/of_device.h>
++#include <linux/of_graph.h>
++#include <linux/phy/phy.h>
++#include <linux/pinctrl/consumer.h>
++#include <linux/platform_device.h>
++#include <linux/pm_runtime.h>
++#include <linux/seq_file.h>
++#include <linux/slab.h>
++#include <linux/uaccess.h>
++#include <linux/videodev2.h>
++
++#include <media/v4l2-async.h>
++#include <media/v4l2-common.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-dev.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-dv-timings.h>
++#include <media/v4l2-event.h>
++#include <media/v4l2-fwnode.h>
++#include <media/v4l2-ioctl.h>
++#include <media/videobuf2-dma-contig.h>
++
++#include "cfe.h"
++#include "cfe_fmts.h"
++#include "csi2.h"
++#include "pisp_fe.h"
++#include "pisp_fe_config.h"
++#include "pisp_statistics.h"
++
++#define CFE_MODULE_NAME	"rp1-cfe"
++#define CFE_VERSION	"1.0"
++
++bool cfe_debug_verbose;
++module_param_named(verbose_debug, cfe_debug_verbose, bool, 0644);
++MODULE_PARM_DESC(verbose_debug, "verbose debugging messages");
++
++#define cfe_dbg_verbose(fmt, arg...)                          \
++	do {                                                  \
++		if (cfe_debug_verbose)                        \
++			dev_dbg(&cfe->pdev->dev, fmt, ##arg); \
++	} while (0)
++#define cfe_dbg(fmt, arg...) dev_dbg(&cfe->pdev->dev, fmt, ##arg)
++#define cfe_info(fmt, arg...) dev_info(&cfe->pdev->dev, fmt, ##arg)
++#define cfe_err(fmt, arg...) dev_err(&cfe->pdev->dev, fmt, ##arg)
++
++/* MIPICFG registers */
++#define MIPICFG_CFG		0x004
++#define MIPICFG_INTR		0x028
++#define MIPICFG_INTE		0x02c
++#define MIPICFG_INTF		0x030
++#define MIPICFG_INTS		0x034
++
++#define MIPICFG_CFG_SEL_CSI	BIT(0)
++
++#define MIPICFG_INT_CSI_DMA	BIT(0)
++#define MIPICFG_INT_CSI_HOST	BIT(2)
++#define MIPICFG_INT_PISP_FE	BIT(4)
++
++#define BPL_ALIGNMENT 16
++#define MAX_BYTESPERLINE 0xffffff00
++#define MAX_BUFFER_SIZE  0xffffff00
++/*
++ * Max width is therefore determined by the max stride divided by the number of
++ * bits per pixel.
++ *
++ * However, to avoid overflow issues let's use a 16k maximum. This lets us
++ * calculate 16k * 16k * 4 with 32bits. If we need higher maximums, a careful
++ * review and adjustment of the code is needed so that it will deal with
++ * overflows correctly.
++ */
++#define MAX_WIDTH 16384
++#define MAX_HEIGHT MAX_WIDTH
++/* Define a nominal minimum image size */
++#define MIN_WIDTH 16
++#define MIN_HEIGHT 16
++/* Default size of the embedded buffer */
++#define DEFAULT_EMBEDDED_SIZE 16384
++
++const struct v4l2_mbus_framefmt cfe_default_format = {
++	.width = 640,
++	.height = 480,
++	.code = MEDIA_BUS_FMT_SRGGB10_1X10,
++	.field = V4L2_FIELD_NONE,
++	.colorspace = V4L2_COLORSPACE_RAW,
++	.ycbcr_enc = V4L2_YCBCR_ENC_601,
++	.quantization = V4L2_QUANTIZATION_FULL_RANGE,
++	.xfer_func = V4L2_XFER_FUNC_NONE,
++};
++
++const struct v4l2_mbus_framefmt cfe_default_meta_format = {
++	.width = DEFAULT_EMBEDDED_SIZE,
++	.height = 1,
++	.code = MEDIA_BUS_FMT_SENSOR_DATA,
++	.field = V4L2_FIELD_NONE,
++};
++
++enum node_ids {
++	/* CSI2 HW output nodes first. */
++	CSI2_CH0,
++	CSI2_CH1,
++	CSI2_CH2,
++	CSI2_CH3,
++	/* FE only nodes from here on. */
++	FE_OUT0,
++	FE_OUT1,
++	FE_STATS,
++	FE_CONFIG,
++	NUM_NODES
++};
++
++struct node_description {
++	unsigned int id;
++	const char *name;
++	unsigned int caps;
++	unsigned int pad_flags;
++	unsigned int link_pad;
++};
++
++/* Must match the ordering of enum ids */
++static const struct node_description node_desc[NUM_NODES] = {
++	[CSI2_CH0] = {
++		.name = "csi2_ch0",
++		.caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_META_CAPTURE,
++		.pad_flags = MEDIA_PAD_FL_SINK | MEDIA_PAD_FL_MUST_CONNECT,
++		.link_pad = CSI2_NUM_CHANNELS + 0
++	},
++	/*
++	 * TODO: This node should be named "csi2_ch1" and the caps should be set
++	 * to both video and meta capture. However, to keep compatibility with
++	 * the current libcamera, keep the name as "embedded" and support
++	 * only meta capture.
++	 */
++	[CSI2_CH1] = {
++		.name = "embedded",
++		.caps = V4L2_CAP_META_CAPTURE,
++		.pad_flags = MEDIA_PAD_FL_SINK | MEDIA_PAD_FL_MUST_CONNECT,
++		.link_pad = CSI2_NUM_CHANNELS + 1
++	},
++	[CSI2_CH2] = {
++		.name = "csi2_ch2",
++		.caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_META_CAPTURE,
++		.pad_flags = MEDIA_PAD_FL_SINK | MEDIA_PAD_FL_MUST_CONNECT,
++		.link_pad = CSI2_NUM_CHANNELS + 2
++	},
++	[CSI2_CH3] = {
++		.name = "csi2_ch3",
++		.caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_META_CAPTURE,
++		.pad_flags = MEDIA_PAD_FL_SINK | MEDIA_PAD_FL_MUST_CONNECT,
++		.link_pad = CSI2_NUM_CHANNELS + 3
++	},
++	[FE_OUT0] = {
++		.name = "fe_image0",
++		.caps = V4L2_CAP_VIDEO_CAPTURE,
++		.pad_flags = MEDIA_PAD_FL_SINK | MEDIA_PAD_FL_MUST_CONNECT,
++		.link_pad = FE_OUTPUT0_PAD
++	},
++	[FE_OUT1] = {
++		.name = "fe_image1",
++		.caps = V4L2_CAP_VIDEO_CAPTURE,
++		.pad_flags = MEDIA_PAD_FL_SINK | MEDIA_PAD_FL_MUST_CONNECT,
++		.link_pad = FE_OUTPUT1_PAD
++	},
++	[FE_STATS] = {
++		.name = "fe_stats",
++		.caps = V4L2_CAP_META_CAPTURE,
++		.pad_flags = MEDIA_PAD_FL_SINK | MEDIA_PAD_FL_MUST_CONNECT,
++		.link_pad = FE_STATS_PAD
++	},
++	[FE_CONFIG] = {
++		.name = "fe_config",
++		.caps = V4L2_CAP_META_OUTPUT,
++		.pad_flags = MEDIA_PAD_FL_SOURCE | MEDIA_PAD_FL_MUST_CONNECT,
++		.link_pad = FE_CONFIG_PAD
++	},
++};
++
++#define is_fe_node(node) (((node)->id) >= FE_OUT0)
++#define is_csi2_node(node) (!is_fe_node(node))
++
++#define node_supports_image_output(node) \
++	(!!(node_desc[(node)->id].caps & V4L2_CAP_VIDEO_CAPTURE))
++#define node_supports_meta_output(node) \
++	(!!(node_desc[(node)->id].caps & V4L2_CAP_META_CAPTURE))
++#define node_supports_image_input(node) \
++	(!!(node_desc[(node)->id].caps & V4L2_CAP_VIDEO_OUTPUT))
++#define node_supports_meta_input(node) \
++	(!!(node_desc[(node)->id].caps & V4L2_CAP_META_OUTPUT))
++#define node_supports_image(node) \
++	(node_supports_image_output(node) || node_supports_image_input(node))
++#define node_supports_meta(node) \
++	(node_supports_meta_output(node) || node_supports_meta_input(node))
++
++#define is_image_output_node(node) \
++	((node)->buffer_queue.type == V4L2_BUF_TYPE_VIDEO_CAPTURE)
++#define is_image_input_node(node) \
++	((node)->buffer_queue.type == V4L2_BUF_TYPE_VIDEO_OUTPUT)
++#define is_image_node(node) \
++	(is_image_output_node(node) || is_image_input_node(node))
++#define is_meta_output_node(node) \
++	((node)->buffer_queue.type == V4L2_BUF_TYPE_META_CAPTURE)
++#define is_meta_input_node(node) \
++	((node)->buffer_queue.type == V4L2_BUF_TYPE_META_OUTPUT)
++#define is_meta_node(node) \
++	(is_meta_output_node(node) || is_meta_input_node(node))
++
++/* To track state across all nodes. */
++#define NUM_STATES		5
++#define NODE_REGISTERED		BIT(0)
++#define NODE_ENABLED		BIT(1)
++#define NODE_STREAMING		BIT(2)
++#define FS_INT			BIT(3)
++#define FE_INT			BIT(4)
++
++struct cfe_buffer {
++	struct vb2_v4l2_buffer vb;
++	struct list_head list;
++};
++
++struct cfe_config_buffer {
++	struct cfe_buffer buf;
++	struct pisp_fe_config config;
++};
++
++static inline struct cfe_buffer *to_cfe_buffer(struct vb2_buffer *vb)
++{
++	return container_of(vb, struct cfe_buffer, vb.vb2_buf);
++}
++
++static inline
++struct cfe_config_buffer *to_cfe_config_buffer(struct cfe_buffer *buf)
++{
++	return container_of(buf, struct cfe_config_buffer, buf);
++}
++
++struct cfe_node {
++	unsigned int id;
++	/* Pointer pointing to current v4l2_buffer */
++	struct cfe_buffer *cur_frm;
++	/* Pointer pointing to next v4l2_buffer */
++	struct cfe_buffer *next_frm;
++	/* Used to store current pixel format */
++	struct v4l2_format vid_fmt;
++	/* Used to store current meta format */
++	struct v4l2_format meta_fmt;
++	/* Buffer queue used in video-buf */
++	struct vb2_queue buffer_queue;
++	/* Queue of filled frames */
++	struct list_head dma_queue;
++	/* lock used to access this structure */
++	struct mutex lock;
++	/* Identifies video device for this channel */
++	struct video_device video_dev;
++	/* Pointer to the parent handle */
++	struct cfe_device *cfe;
++	struct media_pad pad;
++	unsigned int fs_count;
++	u64 ts;
++};
++
++struct cfe_device {
++	struct dentry *debugfs;
++	struct kref kref;
++
++	/* V4l2 specific parameters */
++	struct v4l2_async_connection *asd;
++
++	/* peripheral base address */
++	void __iomem *mipi_cfg_base;
++
++	struct clk *clk;
++
++	/* V4l2 device */
++	struct v4l2_device v4l2_dev;
++	struct media_device mdev;
++	struct media_pipeline pipe;
++
++	/* IRQ lock for node state and DMA queues */
++	spinlock_t state_lock;
++	bool job_ready;
++	bool job_queued;
++
++	/* parent device */
++	struct platform_device *pdev;
++	/* subdevice async Notifier */
++	struct v4l2_async_notifier notifier;
++
++	/* ptr to sub device */
++	struct v4l2_subdev *sensor;
++
++	struct cfe_node node[NUM_NODES];
++	DECLARE_BITMAP(node_flags, NUM_STATES * NUM_NODES);
++
++	struct csi2_device csi2;
++	struct pisp_fe_device fe;
++
++	int fe_csi2_channel;
++};
++
++static inline bool is_fe_enabled(struct cfe_device *cfe)
++{
++	return cfe->fe_csi2_channel != -1;
++}
++
++static inline struct cfe_device *to_cfe_device(struct v4l2_device *v4l2_dev)
++{
++	return container_of(v4l2_dev, struct cfe_device, v4l2_dev);
++}
++
++static inline u32 cfg_reg_read(struct cfe_device *cfe, u32 offset)
++{
++	return readl(cfe->mipi_cfg_base + offset);
++}
++
++static inline void cfg_reg_write(struct cfe_device *cfe, u32 offset, u32 val)
++{
++	writel(val, cfe->mipi_cfg_base + offset);
++}
++
++static bool check_state(struct cfe_device *cfe, unsigned long state,
++			unsigned int node_id)
++{
++	unsigned long bit;
++
++	for_each_set_bit(bit, &state, sizeof(state)) {
++		if (!test_bit(bit + (node_id * NUM_STATES), cfe->node_flags))
++			return false;
++	}
++	return true;
++}
++
++static void set_state(struct cfe_device *cfe, unsigned long state,
++		      unsigned int node_id)
++{
++	unsigned long bit;
++
++	for_each_set_bit(bit, &state, sizeof(state))
++		set_bit(bit + (node_id * NUM_STATES), cfe->node_flags);
++}
++
++static void clear_state(struct cfe_device *cfe, unsigned long state,
++			unsigned int node_id)
++{
++	unsigned long bit;
++
++	for_each_set_bit(bit, &state, sizeof(state))
++		clear_bit(bit + (node_id * NUM_STATES), cfe->node_flags);
++}
++
++static bool test_any_node(struct cfe_device *cfe, unsigned long cond)
++{
++	unsigned int i;
++
++	for (i = 0; i < NUM_NODES; i++) {
++		if (check_state(cfe, cond, i))
++			return true;
++	}
++
++	return false;
++}
++
++static bool test_all_nodes(struct cfe_device *cfe, unsigned long precond,
++			   unsigned long cond)
++{
++	unsigned int i;
++
++	for (i = 0; i < NUM_NODES; i++) {
++		if (check_state(cfe, precond, i)) {
++			if (!check_state(cfe, cond, i))
++				return false;
++		}
++	}
++
++	return true;
++}
++
++static int mipi_cfg_regs_show(struct seq_file *s, void *data)
++{
++	struct cfe_device *cfe = s->private;
++	int ret;
++
++	ret = pm_runtime_resume_and_get(&cfe->pdev->dev);
++	if (ret)
++		return ret;
++
++#define DUMP(reg) seq_printf(s, #reg " \t0x%08x\n", cfg_reg_read(cfe, reg))
++	DUMP(MIPICFG_CFG);
++	DUMP(MIPICFG_INTR);
++	DUMP(MIPICFG_INTE);
++	DUMP(MIPICFG_INTF);
++	DUMP(MIPICFG_INTS);
++#undef DUMP
++
++	pm_runtime_put(&cfe->pdev->dev);
++
++	return 0;
++}
++
++static int format_show(struct seq_file *s, void *data)
++{
++	struct cfe_device *cfe = s->private;
++	unsigned int i;
++
++	for (i = 0; i < NUM_NODES; i++) {
++		struct cfe_node *node = &cfe->node[i];
++		unsigned long sb, state = 0;
++
++		for (sb = 0; sb < NUM_STATES; sb++) {
++			if (check_state(cfe, BIT(sb), i))
++				state |= BIT(sb);
++		}
++
++		seq_printf(s, "\nNode %u (%s) state: 0x%lx\n", i,
++			   node_desc[i].name, state);
++
++		if (node_supports_image(node))
++			seq_printf(s, "format: " V4L2_FOURCC_CONV " 0x%x\n"
++				      "resolution: %ux%u\nbpl: %u\nsize: %u\n",
++				   V4L2_FOURCC_CONV_ARGS(node->vid_fmt.fmt.pix.pixelformat),
++				   node->vid_fmt.fmt.pix.pixelformat,
++				   node->vid_fmt.fmt.pix.width,
++				   node->vid_fmt.fmt.pix.height,
++				   node->vid_fmt.fmt.pix.bytesperline,
++				   node->vid_fmt.fmt.pix.sizeimage);
++
++		if (node_supports_meta(node))
++			seq_printf(s, "format: " V4L2_FOURCC_CONV " 0x%x\nsize: %u\n",
++				   V4L2_FOURCC_CONV_ARGS(node->meta_fmt.fmt.meta.dataformat),
++				   node->meta_fmt.fmt.meta.dataformat,
++				   node->meta_fmt.fmt.meta.buffersize);
++	}
++
++	return 0;
++}
++
++DEFINE_SHOW_ATTRIBUTE(mipi_cfg_regs);
++DEFINE_SHOW_ATTRIBUTE(format);
++
++/* Format setup functions */
++const struct cfe_fmt *find_format_by_code(u32 code)
++{
++	unsigned int i;
++
++	for (i = 0; i < ARRAY_SIZE(formats); i++) {
++		if (formats[i].code == code)
++			return &formats[i];
++	}
++
++	return NULL;
++}
++
++const struct cfe_fmt *find_format_by_pix(u32 pixelformat)
++{
++	unsigned int i;
++
++	for (i = 0; i < ARRAY_SIZE(formats); i++) {
++		if (formats[i].fourcc == pixelformat)
++			return &formats[i];
++	}
++
++	return NULL;
++}
++
++/*
++ * Given the mbus code, find the 16 bit remapped code. Returns 0 if no remap
++ * possible.
++ */
++u32 cfe_find_16bit_code(u32 code)
++{
++	const struct cfe_fmt *cfe_fmt;
++
++	cfe_fmt = find_format_by_code(code);
++
++	if (!cfe_fmt || !cfe_fmt->remap[CFE_REMAP_16BIT])
++		return 0;
++
++	cfe_fmt = find_format_by_pix(cfe_fmt->remap[CFE_REMAP_16BIT]);
++	if (!cfe_fmt)
++		return 0;
++
++	return cfe_fmt->code;
++}
++
++/*
++ * Given the mbus code, find the 8 bit compressed code. Returns 0 if no remap
++ * possible.
++ */
++u32 cfe_find_compressed_code(u32 code)
++{
++	const struct cfe_fmt *cfe_fmt;
++
++	cfe_fmt = find_format_by_code(code);
++
++	if (!cfe_fmt || !cfe_fmt->remap[CFE_REMAP_COMPRESSED])
++		return 0;
++
++	cfe_fmt = find_format_by_pix(cfe_fmt->remap[CFE_REMAP_COMPRESSED]);
++	if (!cfe_fmt)
++		return 0;
++
++	return cfe_fmt->code;
++}
++
++static int cfe_calc_format_size_bpl(struct cfe_device *cfe,
++				    const struct cfe_fmt *fmt,
++				    struct v4l2_format *f)
++{
++	unsigned int min_bytesperline;
++
++	v4l_bound_align_image(&f->fmt.pix.width, MIN_WIDTH, MAX_WIDTH, 2,
++			      &f->fmt.pix.height, MIN_HEIGHT, MAX_HEIGHT, 0, 0);
++
++	min_bytesperline =
++		ALIGN((f->fmt.pix.width * fmt->depth) >> 3, BPL_ALIGNMENT);
++
++	if (f->fmt.pix.bytesperline > min_bytesperline &&
++	    f->fmt.pix.bytesperline <= MAX_BYTESPERLINE)
++		f->fmt.pix.bytesperline =
++			ALIGN(f->fmt.pix.bytesperline, BPL_ALIGNMENT);
++	else
++		f->fmt.pix.bytesperline = min_bytesperline;
++
++	f->fmt.pix.sizeimage = f->fmt.pix.height * f->fmt.pix.bytesperline;
++
++	cfe_dbg("%s: " V4L2_FOURCC_CONV " size: %ux%u bpl:%u img_size:%u\n",
++		__func__, V4L2_FOURCC_CONV_ARGS(f->fmt.pix.pixelformat),
++		f->fmt.pix.width, f->fmt.pix.height,
++		f->fmt.pix.bytesperline, f->fmt.pix.sizeimage);
++
++	return 0;
++}
++
++static void cfe_schedule_next_csi2_job(struct cfe_device *cfe)
++{
++	struct cfe_buffer *buf;
++	unsigned int i;
++	dma_addr_t addr;
++
++	for (i = 0; i < CSI2_NUM_CHANNELS; i++) {
++		struct cfe_node *node = &cfe->node[i];
++		unsigned int stride, size;
++
++		if (!check_state(cfe, NODE_STREAMING, i))
++			continue;
++
++		buf = list_first_entry(&node->dma_queue, struct cfe_buffer,
++				       list);
++		node->next_frm = buf;
++		list_del(&buf->list);
++
++		cfe_dbg_verbose("%s: [%s] buffer:%p\n", __func__,
++				node_desc[node->id].name, &buf->vb.vb2_buf);
++
++		if (is_meta_node(node)) {
++			size = node->meta_fmt.fmt.meta.buffersize;
++			stride = 0;
++		} else {
++			size = node->vid_fmt.fmt.pix.sizeimage;
++			stride = node->vid_fmt.fmt.pix.bytesperline;
++		}
++
++		addr = vb2_dma_contig_plane_dma_addr(&buf->vb.vb2_buf, 0);
++		csi2_set_buffer(&cfe->csi2, node->id, addr, stride, size);
++	}
++}
++
++static void cfe_schedule_next_pisp_job(struct cfe_device *cfe)
++{
++	struct vb2_buffer *vb2_bufs[FE_NUM_PADS] = { 0 };
++	struct cfe_config_buffer *config_buf;
++	struct cfe_buffer *buf;
++	unsigned int i;
++
++	for (i = CSI2_NUM_CHANNELS; i < NUM_NODES; i++) {
++		struct cfe_node *node = &cfe->node[i];
++
++		if (!check_state(cfe, NODE_STREAMING, i))
++			continue;
++
++		buf = list_first_entry(&node->dma_queue, struct cfe_buffer,
++				       list);
++
++		cfe_dbg_verbose("%s: [%s] buffer:%p\n", __func__,
++				node_desc[node->id].name, &buf->vb.vb2_buf);
++
++		node->next_frm = buf;
++		vb2_bufs[node_desc[i].link_pad] = &buf->vb.vb2_buf;
++		list_del(&buf->list);
++	}
++
++	config_buf = to_cfe_config_buffer(cfe->node[FE_CONFIG].next_frm);
++	pisp_fe_submit_job(&cfe->fe, vb2_bufs, &config_buf->config);
++}
++
++static bool cfe_check_job_ready(struct cfe_device *cfe)
++{
++	unsigned int i;
++
++	for (i = 0; i < NUM_NODES; i++) {
++		struct cfe_node *node = &cfe->node[i];
++
++		if (!check_state(cfe, NODE_ENABLED, i))
++			continue;
++
++		if (list_empty(&node->dma_queue)) {
++			cfe_dbg_verbose("%s: [%s] has no buffer, unable to schedule job\n",
++				__func__, node_desc[i].name);
++			return false;
++		}
++	}
++
++	return true;
++}
++
++static void cfe_prepare_next_job(struct cfe_device *cfe)
++{
++	cfe->job_queued = true;
++	cfe_schedule_next_csi2_job(cfe);
++	if (is_fe_enabled(cfe))
++		cfe_schedule_next_pisp_job(cfe);
++
++	/* Flag if another job is ready after this. */
++	cfe->job_ready = cfe_check_job_ready(cfe);
++
++	cfe_dbg_verbose("%s: end with scheduled job\n", __func__);
++}
++
++static void cfe_process_buffer_complete(struct cfe_node *node,
++					enum vb2_buffer_state state)
++{
++	struct cfe_device *cfe = node->cfe;
++
++	cfe_dbg_verbose("%s: [%s] buffer:%p\n", __func__,
++			node_desc[node->id].name, &node->cur_frm->vb.vb2_buf);
++
++	node->cur_frm->vb.sequence = node->fs_count - 1;
++	vb2_buffer_done(&node->cur_frm->vb.vb2_buf, state);
++}
++
++static void cfe_queue_event_sof(struct cfe_node *node)
++{
++	struct v4l2_event event = {
++		.type = V4L2_EVENT_FRAME_SYNC,
++		.u.frame_sync.frame_sequence = node->fs_count - 1,
++	};
++
++	v4l2_event_queue(&node->video_dev, &event);
++}
++
++static void cfe_sof_isr_handler(struct cfe_node *node)
++{
++	struct cfe_device *cfe = node->cfe;
++	bool matching_fs = true;
++	unsigned int i;
++
++	cfe_dbg_verbose("%s: [%s] seq %u\n", __func__, node_desc[node->id].name,
++			node->fs_count);
++
++	/*
++	 * If the sensor is producing unexpected frame event ordering over a
++	 * sustained period of time, guard against the possibility of coming
++	 * here and orphaning the cur_frm if it's not been dequeued already.
++	 * Unfortunately, there is not enough hardware state to tell if this
++	 * may have occurred.
++	 */
++	if (WARN(node->cur_frm, "%s: [%s] Orphanded frame at seq %u\n",
++		 __func__, node_desc[node->id].name, node->fs_count))
++		cfe_process_buffer_complete(node, VB2_BUF_STATE_ERROR);
++
++	node->cur_frm = node->next_frm;
++	node->next_frm = NULL;
++	node->fs_count++;
++
++	node->ts = ktime_get_ns();
++	for (i = 0; i < NUM_NODES; i++) {
++		if (!check_state(cfe, NODE_STREAMING, i) || i == node->id)
++			continue;
++		/*
++		 * This checks if any other node has seen a FS. If yes, use the
++		 * same timestamp, eventually across all node buffers.
++		 */
++		if (cfe->node[i].fs_count >= node->fs_count)
++			node->ts = cfe->node[i].ts;
++		/*
++		 * This checks if all other node have seen a matching FS. If
++		 * yes, we can flag another job to be queued.
++		 */
++		if (matching_fs && cfe->node[i].fs_count != node->fs_count)
++			matching_fs = false;
++	}
++
++	if (matching_fs)
++		cfe->job_queued = false;
++
++	if (node->cur_frm)
++		node->cur_frm->vb.vb2_buf.timestamp = node->ts;
++
++	set_state(cfe, FS_INT, node->id);
++	clear_state(cfe, FE_INT, node->id);
++
++	if (is_image_output_node(node))
++		cfe_queue_event_sof(node);
++}
++
++static void cfe_eof_isr_handler(struct cfe_node *node)
++{
++	struct cfe_device *cfe = node->cfe;
++
++	cfe_dbg_verbose("%s: [%s] seq %u\n", __func__, node_desc[node->id].name,
++			node->fs_count - 1);
++
++	if (node->cur_frm)
++		cfe_process_buffer_complete(node, VB2_BUF_STATE_DONE);
++
++	node->cur_frm = NULL;
++	set_state(cfe, FE_INT, node->id);
++	clear_state(cfe, FS_INT, node->id);
++}
++
++static irqreturn_t cfe_isr(int irq, void *dev)
++{
++	struct cfe_device *cfe = dev;
++	unsigned int i;
++	bool sof[NUM_NODES] = {0}, eof[NUM_NODES] = {0};
++	u32 sts;
++
++	sts = cfg_reg_read(cfe, MIPICFG_INTS);
++
++	if (sts & MIPICFG_INT_CSI_DMA)
++		csi2_isr(&cfe->csi2, sof, eof);
++
++	if (sts & MIPICFG_INT_PISP_FE)
++		pisp_fe_isr(&cfe->fe, sof + CSI2_NUM_CHANNELS,
++			    eof + CSI2_NUM_CHANNELS);
++
++	spin_lock(&cfe->state_lock);
++
++	for (i = 0; i < NUM_NODES; i++) {
++		struct cfe_node *node = &cfe->node[i];
++
++		/*
++		 * The check_state(NODE_STREAMING) is to ensure we do not loop
++		 * over the CSI2_CHx nodes when the FE is active since they
++		 * generate interrupts even though the node is not streaming.
++		 */
++		if (!check_state(cfe, NODE_STREAMING, i) ||
++		    !(sof[i] || eof[i]))
++			continue;
++
++		/*
++		 * There are 3 cases where we could get FS + FE_ACK at
++		 * the same time:
++		 * 1) FE of the current frame, and FS of the next frame.
++		 * 2) FS + FE of the same frame.
++		 * 3) FE of the current frame, and FS + FE of the next
++		 *    frame. To handle this, see the sof handler below.
++		 *
++		 * (1) is handled implicitly by the ordering of the FE and FS
++		 * handlers below.
++		 */
++		if (eof[i]) {
++			/*
++			 * The condition below tests for (2). Run the FS handler
++			 * first before the FE handler, both for the current
++			 * frame.
++			 */
++			if (sof[i] && !check_state(cfe, FS_INT, i)) {
++				cfe_sof_isr_handler(node);
++				sof[i] = false;
++			}
++
++			cfe_eof_isr_handler(node);
++		}
++
++		if (sof[i]) {
++			/*
++			 * The condition below tests for (3). In such cases, we
++			 * come in here with FS flag set in the node state from
++			 * the previous frame since it only gets cleared in
++			 * eof_isr_handler(). Handle the FE for the previous
++			 * frame first before the FS handler for the current
++			 * frame.
++			 */
++			if (check_state(cfe, FS_INT, node->id) &&
++			    !check_state(cfe, FE_INT, node->id)) {
++				cfe_dbg("%s: [%s] Handling missing previous FE interrupt\n",
++					__func__, node_desc[node->id].name);
++				cfe_eof_isr_handler(node);
++			}
++
++			cfe_sof_isr_handler(node);
++		}
++
++		if (!cfe->job_queued && cfe->job_ready)
++			cfe_prepare_next_job(cfe);
++	}
++
++	spin_unlock(&cfe->state_lock);
++
++	return IRQ_HANDLED;
++}
++
++/*
++ * Stream helpers
++ */
++
++static void cfe_start_channel(struct cfe_node *node)
++{
++	struct cfe_device *cfe = node->cfe;
++	struct v4l2_subdev_state *state;
++	struct v4l2_mbus_framefmt *source_fmt;
++	const struct cfe_fmt *fmt;
++	unsigned long flags;
++	bool start_fe = is_fe_enabled(cfe) &&
++			test_all_nodes(cfe, NODE_ENABLED, NODE_STREAMING);
++
++	cfe_dbg("%s: [%s]\n", __func__, node_desc[node->id].name);
++
++	state = v4l2_subdev_lock_and_get_active_state(&cfe->csi2.sd);
++
++	if (start_fe) {
++		unsigned int width, height;
++
++		WARN_ON(!is_fe_enabled(cfe));
++		cfe_dbg("%s: %s using csi2 channel %d\n",
++			__func__, node_desc[FE_OUT0].name,
++			cfe->fe_csi2_channel);
++
++		source_fmt = v4l2_subdev_state_get_format(state,
++							cfe->fe_csi2_channel);
++		fmt = find_format_by_code(source_fmt->code);
++
++		width = source_fmt->width;
++		height = source_fmt->height;
++
++		/* Must have a valid CSI2 datatype. */
++		WARN_ON(!fmt->csi_dt);
++
++		/*
++		 * Start the associated CSI2 Channel as well.
++		 *
++		 * Must write to the ADDR register to latch the ctrl values
++		 * even if we are connected to the front end. Once running,
++		 * this is handled by the CSI2 AUTO_ARM mode.
++		 */
++		csi2_start_channel(&cfe->csi2, cfe->fe_csi2_channel,
++				   CSI2_MODE_FE_STREAMING,
++				   true, false, width, height);
++		csi2_set_buffer(&cfe->csi2, cfe->fe_csi2_channel, 0, 0, -1);
++		pisp_fe_start(&cfe->fe);
++	}
++
++	if (is_csi2_node(node)) {
++		unsigned int width = 0, height = 0;
++
++		u32 mode = CSI2_MODE_NORMAL;
++
++		source_fmt = v4l2_subdev_state_get_format(state,
++			node_desc[node->id].link_pad - CSI2_NUM_CHANNELS);
++		fmt = find_format_by_code(source_fmt->code);
++
++		/* Must have a valid CSI2 datatype. */
++		WARN_ON(!fmt->csi_dt);
++
++		if (is_image_output_node(node)) {
++			width = source_fmt->width;
++			height = source_fmt->height;
++
++			if (node->vid_fmt.fmt.pix.pixelformat ==
++					fmt->remap[CFE_REMAP_16BIT])
++				mode = CSI2_MODE_REMAP;
++			else if (node->vid_fmt.fmt.pix.pixelformat ==
++					fmt->remap[CFE_REMAP_COMPRESSED]) {
++				mode = CSI2_MODE_COMPRESSED;
++				csi2_set_compression(&cfe->csi2, node->id,
++						     CSI2_COMPRESSION_DELTA, 0,
++						     0);
++			}
++		}
++		/* Unconditionally start this CSI2 channel. */
++		csi2_start_channel(&cfe->csi2, node->id,
++				   mode,
++				   /* Auto arm */
++				   false,
++				   /* Pack bytes */
++				   is_meta_node(node) ? true : false,
++				   width, height);
++	}
++
++	v4l2_subdev_unlock_state(state);
++
++	spin_lock_irqsave(&cfe->state_lock, flags);
++	if (cfe->job_ready && test_all_nodes(cfe, NODE_ENABLED, NODE_STREAMING))
++		cfe_prepare_next_job(cfe);
++	spin_unlock_irqrestore(&cfe->state_lock, flags);
++}
++
++static void cfe_stop_channel(struct cfe_node *node, bool fe_stop)
++{
++	struct cfe_device *cfe = node->cfe;
++
++	cfe_dbg("%s: [%s] fe_stop %u\n", __func__,
++		node_desc[node->id].name, fe_stop);
++
++	if (fe_stop) {
++		csi2_stop_channel(&cfe->csi2, cfe->fe_csi2_channel);
++		pisp_fe_stop(&cfe->fe);
++	}
++
++	if (is_csi2_node(node))
++		csi2_stop_channel(&cfe->csi2, node->id);
++}
++
++static void cfe_return_buffers(struct cfe_node *node,
++			       enum vb2_buffer_state state)
++{
++	struct cfe_device *cfe = node->cfe;
++	struct cfe_buffer *buf, *tmp;
++	unsigned long flags;
++
++	cfe_dbg("%s: [%s]\n", __func__, node_desc[node->id].name);
++
++	spin_lock_irqsave(&cfe->state_lock, flags);
++	list_for_each_entry_safe(buf, tmp, &node->dma_queue, list) {
++		list_del(&buf->list);
++		vb2_buffer_done(&buf->vb.vb2_buf, state);
++	}
++
++	if (node->cur_frm)
++		vb2_buffer_done(&node->cur_frm->vb.vb2_buf, state);
++	if (node->next_frm && node->cur_frm != node->next_frm)
++		vb2_buffer_done(&node->next_frm->vb.vb2_buf, state);
++
++	node->cur_frm = NULL;
++	node->next_frm = NULL;
++	spin_unlock_irqrestore(&cfe->state_lock, flags);
++}
++
++/*
++ * vb2 ops
++ */
++
++static int cfe_queue_setup(struct vb2_queue *vq, unsigned int *nbuffers,
++			   unsigned int *nplanes, unsigned int sizes[],
++			   struct device *alloc_devs[])
++{
++	struct cfe_node *node = vb2_get_drv_priv(vq);
++	struct cfe_device *cfe = node->cfe;
++	unsigned int size = is_image_node(node) ? node->vid_fmt.fmt.pix.sizeimage :
++						  node->meta_fmt.fmt.meta.buffersize;
++
++	cfe_dbg("%s: [%s] type:%u\n", __func__, node_desc[node->id].name,
++		node->buffer_queue.type);
++
++	if (vb2_get_num_buffers(vq) + *nbuffers < 3)
++		*nbuffers = 3 - vb2_get_num_buffers(vq);
++
++	if (*nplanes) {
++		if (sizes[0] < size) {
++			cfe_err("sizes[0] %i < size %u\n", sizes[0], size);
++			return -EINVAL;
++		}
++		size = sizes[0];
++	}
++
++	*nplanes = 1;
++	sizes[0] = size;
++
++	return 0;
++}
++
++static int cfe_buffer_prepare(struct vb2_buffer *vb)
++{
++	struct cfe_node *node = vb2_get_drv_priv(vb->vb2_queue);
++	struct cfe_device *cfe = node->cfe;
++	struct cfe_buffer *buf = to_cfe_buffer(vb);
++	unsigned long size;
++
++	cfe_dbg_verbose("%s: [%s] buffer:%p\n", __func__,
++			node_desc[node->id].name, vb);
++
++	size = is_image_node(node) ? node->vid_fmt.fmt.pix.sizeimage :
++				     node->meta_fmt.fmt.meta.buffersize;
++	if (vb2_plane_size(vb, 0) < size) {
++		cfe_err("data will not fit into plane (%lu < %lu)\n",
++			vb2_plane_size(vb, 0), size);
++		return -EINVAL;
++	}
++
++	vb2_set_plane_payload(&buf->vb.vb2_buf, 0, size);
++
++	if (node->id == FE_CONFIG) {
++		struct cfe_config_buffer *b = to_cfe_config_buffer(buf);
++		void *addr = vb2_plane_vaddr(vb, 0);
++
++		memcpy(&b->config, addr, sizeof(struct pisp_fe_config));
++		return pisp_fe_validate_config(&cfe->fe, &b->config,
++					       &cfe->node[FE_OUT0].vid_fmt,
++					       &cfe->node[FE_OUT1].vid_fmt);
++	}
++
++	return 0;
++}
++
++static void cfe_buffer_queue(struct vb2_buffer *vb)
++{
++	struct cfe_node *node = vb2_get_drv_priv(vb->vb2_queue);
++	struct cfe_device *cfe = node->cfe;
++	struct cfe_buffer *buf = to_cfe_buffer(vb);
++	unsigned long flags;
++
++	cfe_dbg_verbose("%s: [%s] buffer:%p\n", __func__,
++			node_desc[node->id].name, vb);
++
++	spin_lock_irqsave(&cfe->state_lock, flags);
++
++	list_add_tail(&buf->list, &node->dma_queue);
++
++	if (!cfe->job_ready)
++		cfe->job_ready = cfe_check_job_ready(cfe);
++
++	if (!cfe->job_queued && cfe->job_ready &&
++	    test_all_nodes(cfe, NODE_ENABLED, NODE_STREAMING)) {
++		cfe_dbg("Preparing job immediately for channel %u\n",
++			node->id);
++		cfe_prepare_next_job(cfe);
++	}
++
++	spin_unlock_irqrestore(&cfe->state_lock, flags);
++}
++
++static u64 sensor_link_rate(struct cfe_device *cfe)
++{
++	struct v4l2_mbus_framefmt *source_fmt;
++	struct v4l2_subdev_state *state;
++	struct media_entity *entity;
++	struct v4l2_subdev *subdev;
++	const struct cfe_fmt *fmt;
++	struct media_pad *pad;
++	s64 link_freq;
++
++	state = v4l2_subdev_lock_and_get_active_state(&cfe->csi2.sd);
++	source_fmt = v4l2_subdev_state_get_format(state, 0);
++	fmt = find_format_by_code(source_fmt->code);
++	v4l2_subdev_unlock_state(state);
++
++	/*
++	 * Walk up the media graph to find either the sensor entity, or another
++	 * entity that advertises the V4L2_CID_LINK_FREQ or V4L2_CID_PIXEL_RATE
++	 * control through the subdev.
++	 */
++	entity = &cfe->csi2.sd.entity;
++	while (1) {
++		pad = &entity->pads[0];
++		if (!(pad->flags & MEDIA_PAD_FL_SINK))
++			goto err;
++
++		pad = media_pad_remote_pad_first(pad);
++		if (!pad || !is_media_entity_v4l2_subdev(pad->entity))
++			goto err;
++
++		entity = pad->entity;
++		subdev = media_entity_to_v4l2_subdev(entity);
++		if (entity->function == MEDIA_ENT_F_CAM_SENSOR ||
++		    v4l2_ctrl_find(subdev->ctrl_handler, V4L2_CID_LINK_FREQ) ||
++		    v4l2_ctrl_find(subdev->ctrl_handler, V4L2_CID_PIXEL_RATE))
++			break;
++	}
++
++	link_freq = v4l2_get_link_freq(subdev->ctrl_handler, fmt->depth,
++				       cfe->csi2.dphy.active_lanes * 2);
++	if (link_freq < 0)
++		goto err;
++
++	/* x2 for DDR. */
++	link_freq *= 2;
++	cfe_info("Using a link rate of %lld Mbps\n", link_freq / (1000 * 1000));
++	return link_freq;
++
++err:
++	cfe_err("Unable to determine sensor link rate, using 999 Mbps\n");
++	return 999 * 1000000UL;
++}
++
++static int cfe_start_streaming(struct vb2_queue *vq, unsigned int count)
++{
++	struct v4l2_mbus_config mbus_config = { 0 };
++	struct cfe_node *node = vb2_get_drv_priv(vq);
++	struct cfe_device *cfe = node->cfe;
++	int ret;
++
++	cfe_dbg("%s: [%s] begin.\n", __func__, node_desc[node->id].name);
++
++	if (!check_state(cfe, NODE_ENABLED, node->id)) {
++		cfe_err("%s node link is not enabled.\n",
++			node_desc[node->id].name);
++		ret = -EINVAL;
++		goto err_streaming;
++	}
++
++	ret = pm_runtime_resume_and_get(&cfe->pdev->dev);
++	if (ret < 0) {
++		cfe_err("pm_runtime_resume_and_get failed\n");
++		goto err_streaming;
++	}
++
++	/* When using the Frontend, we must enable the FE_CONFIG node. */
++	if (is_fe_enabled(cfe) &&
++	    !check_state(cfe, NODE_ENABLED, cfe->node[FE_CONFIG].id)) {
++		cfe_err("FE enabled, but FE_CONFIG node is not\n");
++		ret = -EINVAL;
++		goto err_pm_put;
++	}
++
++	ret = media_pipeline_start(&node->pad, &cfe->pipe);
++	if (ret < 0) {
++		cfe_err("Failed to start media pipeline: %d\n", ret);
++		goto err_pm_put;
++	}
++
++	clear_state(cfe, FS_INT | FE_INT, node->id);
++	set_state(cfe, NODE_STREAMING, node->id);
++	node->fs_count = 0;
++	cfe_start_channel(node);
++
++	if (!test_all_nodes(cfe, NODE_ENABLED, NODE_STREAMING)) {
++		cfe_dbg("Not all nodes are set to streaming yet!\n");
++		return 0;
++	}
++
++	cfg_reg_write(cfe, MIPICFG_CFG, MIPICFG_CFG_SEL_CSI);
++	cfg_reg_write(cfe, MIPICFG_INTE, MIPICFG_INT_CSI_DMA | MIPICFG_INT_PISP_FE);
++
++	ret = v4l2_subdev_call(cfe->sensor, pad, get_mbus_config, 0,
++			       &mbus_config);
++	if (ret < 0 && ret != -ENOIOCTLCMD) {
++		cfe_err("g_mbus_config failed\n");
++		goto err_pm_put;
++	}
++
++	cfe->csi2.dphy.active_lanes = mbus_config.bus.mipi_csi2.num_data_lanes;
++	if (!cfe->csi2.dphy.active_lanes)
++		cfe->csi2.dphy.active_lanes = cfe->csi2.dphy.max_lanes;
++	if (cfe->csi2.dphy.active_lanes > cfe->csi2.dphy.max_lanes) {
++		cfe_err("Device has requested %u data lanes, which is >%u configured in DT\n",
++			cfe->csi2.dphy.active_lanes, cfe->csi2.dphy.max_lanes);
++		ret = -EINVAL;
++		goto err_disable_cfe;
++	}
++
++	cfe_dbg("Configuring CSI-2 block - %u data lanes\n", cfe->csi2.dphy.active_lanes);
++	cfe->csi2.dphy.dphy_rate = sensor_link_rate(cfe) / 1000000UL;
++	csi2_open_rx(&cfe->csi2);
++
++	cfe_dbg("Starting sensor streaming\n");
++	ret = v4l2_subdev_call(cfe->sensor, video, s_stream, 1);
++	if (ret < 0) {
++		cfe_err("stream on failed in subdev\n");
++		goto err_disable_cfe;
++	}
++
++	cfe_dbg("%s: [%s] end.\n", __func__, node_desc[node->id].name);
++
++	return 0;
++
++err_disable_cfe:
++	csi2_close_rx(&cfe->csi2);
++	cfe_stop_channel(node, true);
++	media_pipeline_stop(&node->pad);
++err_pm_put:
++	pm_runtime_put(&cfe->pdev->dev);
++err_streaming:
++	cfe_return_buffers(node, VB2_BUF_STATE_QUEUED);
++	clear_state(cfe, NODE_STREAMING, node->id);
++
++	return ret;
++}
++
++static void cfe_stop_streaming(struct vb2_queue *vq)
++{
++	struct cfe_node *node = vb2_get_drv_priv(vq);
++	struct cfe_device *cfe = node->cfe;
++	unsigned long flags;
++	bool fe_stop;
++
++	cfe_dbg("%s: [%s] begin.\n", __func__, node_desc[node->id].name);
++
++	spin_lock_irqsave(&cfe->state_lock, flags);
++	fe_stop = is_fe_enabled(cfe) &&
++		  test_all_nodes(cfe, NODE_ENABLED, NODE_STREAMING);
++
++	cfe->job_ready = false;
++	clear_state(cfe, NODE_STREAMING, node->id);
++	spin_unlock_irqrestore(&cfe->state_lock, flags);
++
++	cfe_stop_channel(node, fe_stop);
++
++	if (!test_any_node(cfe, NODE_STREAMING)) {
++		/* Stop streaming the sensor and disable the peripheral. */
++		if (v4l2_subdev_call(cfe->sensor, video, s_stream, 0) < 0)
++			cfe_err("stream off failed in subdev\n");
++
++		csi2_close_rx(&cfe->csi2);
++
++		cfg_reg_write(cfe, MIPICFG_INTE, 0);
++	}
++
++	media_pipeline_stop(&node->pad);
++
++	/* Clear all queued buffers for the node */
++	cfe_return_buffers(node, VB2_BUF_STATE_ERROR);
++
++	pm_runtime_put(&cfe->pdev->dev);
++
++	cfe_dbg("%s: [%s] end.\n", __func__, node_desc[node->id].name);
++}
++
++static const struct vb2_ops cfe_video_qops = {
++	.wait_prepare = vb2_ops_wait_prepare,
++	.wait_finish = vb2_ops_wait_finish,
++	.queue_setup = cfe_queue_setup,
++	.buf_prepare = cfe_buffer_prepare,
++	.buf_queue = cfe_buffer_queue,
++	.start_streaming = cfe_start_streaming,
++	.stop_streaming = cfe_stop_streaming,
++};
++
++/*
++ * v4l2 ioctl ops
++ */
++
++static int cfe_querycap(struct file *file, void *priv,
++			struct v4l2_capability *cap)
++{
++	struct cfe_node *node = video_drvdata(file);
++	struct cfe_device *cfe = node->cfe;
++
++	strscpy(cap->driver, CFE_MODULE_NAME, sizeof(cap->driver));
++	strscpy(cap->card, CFE_MODULE_NAME, sizeof(cap->card));
++
++	snprintf(cap->bus_info, sizeof(cap->bus_info), "platform:%s",
++		 dev_name(&cfe->pdev->dev));
++
++	cap->capabilities |= V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_META_CAPTURE |
++			     V4L2_CAP_META_OUTPUT;
++
++	return 0;
++}
++
++static int cfe_enum_fmt_vid_cap(struct file *file, void *priv,
++				struct v4l2_fmtdesc *f)
++{
++	struct cfe_node *node = video_drvdata(file);
++	struct cfe_device *cfe = node->cfe;
++	unsigned int i, j;
++
++	if (!node_supports_image_output(node))
++		return -EINVAL;
++
++	cfe_dbg("%s: [%s]\n", __func__, node_desc[node->id].name);
++
++	for (i = 0, j = 0; i < ARRAY_SIZE(formats); i++) {
++		if (f->mbus_code && formats[i].code != f->mbus_code)
++			continue;
++
++		if (formats[i].flags & CFE_FORMAT_FLAG_META_OUT ||
++		    formats[i].flags & CFE_FORMAT_FLAG_META_CAP)
++			continue;
++
++		if (is_fe_node(node) &&
++		    !(formats[i].flags & CFE_FORMAT_FLAG_FE_OUT))
++			continue;
++
++		if (j == f->index) {
++			f->pixelformat = formats[i].fourcc;
++			f->type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
++			return 0;
++		}
++		j++;
++	}
++
++	return -EINVAL;
++}
++
++static int cfe_g_fmt(struct file *file, void *priv,
++		     struct v4l2_format *f)
++{
++	struct cfe_node *node = video_drvdata(file);
++	struct cfe_device *cfe = node->cfe;
++
++	cfe_dbg("%s: [%s]\n", __func__, node_desc[node->id].name);
++
++	if (!node_supports_image(node))
++		return -EINVAL;
++
++	*f = node->vid_fmt;
++
++	return 0;
++}
++
++static int try_fmt_vid_cap(struct cfe_node *node, struct v4l2_format *f)
++{
++	struct cfe_device *cfe = node->cfe;
++	const struct cfe_fmt *fmt;
++
++	cfe_dbg("%s: [%s] %ux%u, V4L2 pix " V4L2_FOURCC_CONV "\n",
++		__func__, node_desc[node->id].name,
++		f->fmt.pix.width, f->fmt.pix.height,
++		V4L2_FOURCC_CONV_ARGS(f->fmt.pix.pixelformat));
++
++	if (!node_supports_image_output(node))
++		return -EINVAL;
++
++	/*
++	 * Default to a format that works for both CSI2 and FE.
++	 */
++	fmt = find_format_by_pix(f->fmt.pix.pixelformat);
++	if (!fmt)
++		fmt = find_format_by_code(MEDIA_BUS_FMT_SBGGR10_1X10);
++
++	f->fmt.pix.pixelformat = fmt->fourcc;
++
++	if (is_fe_node(node) && fmt->remap[CFE_REMAP_16BIT]) {
++		f->fmt.pix.pixelformat = fmt->remap[CFE_REMAP_16BIT];
++		fmt = find_format_by_pix(f->fmt.pix.pixelformat);
++	}
++
++	f->fmt.pix.field = V4L2_FIELD_NONE;
++
++	cfe_calc_format_size_bpl(cfe, fmt, f);
++
++	return 0;
++}
++
++static int cfe_s_fmt_vid_cap(struct file *file, void *priv,
++			     struct v4l2_format *f)
++{
++	struct cfe_node *node = video_drvdata(file);
++	struct cfe_device *cfe = node->cfe;
++	struct vb2_queue *q = &node->buffer_queue;
++	int ret;
++
++	cfe_dbg("%s: [%s]\n", __func__, node_desc[node->id].name);
++
++	if (vb2_is_busy(q))
++		return -EBUSY;
++
++	ret = try_fmt_vid_cap(node, f);
++	if (ret)
++		return ret;
++
++	node->vid_fmt = *f;
++
++	cfe_dbg("%s: Set %ux%u, V4L2 pix " V4L2_FOURCC_CONV "\n", __func__,
++		node->vid_fmt.fmt.pix.width, node->vid_fmt.fmt.pix.height,
++		V4L2_FOURCC_CONV_ARGS(node->vid_fmt.fmt.pix.pixelformat));
++
++	return 0;
++}
++
++static int cfe_try_fmt_vid_cap(struct file *file, void *priv,
++			       struct v4l2_format *f)
++{
++	struct cfe_node *node = video_drvdata(file);
++	struct cfe_device *cfe = node->cfe;
++
++	cfe_dbg("%s: [%s]\n", __func__, node_desc[node->id].name);
++
++	return try_fmt_vid_cap(node, f);
++}
++
++static int cfe_enum_fmt_meta(struct file *file, void *priv,
++			     struct v4l2_fmtdesc *f)
++{
++	struct cfe_node *node = video_drvdata(file);
++	struct cfe_device *cfe = node->cfe;
++
++	cfe_dbg("%s: [%s]\n", __func__, node_desc[node->id].name);
++
++	if (!node_supports_meta(node) || f->index != 0)
++		return -EINVAL;
++
++	switch (node->id) {
++	case CSI2_CH0...CSI2_CH3:
++		f->pixelformat = V4L2_META_FMT_SENSOR_DATA;
++		return 0;
++	case FE_STATS:
++		f->pixelformat = V4L2_META_FMT_RPI_FE_STATS;
++		return 0;
++	case FE_CONFIG:
++		f->pixelformat = V4L2_META_FMT_RPI_FE_CFG;
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++static int try_fmt_meta(struct cfe_node *node, struct v4l2_format *f)
++{
++	if (!node_supports_meta(node))
++		return -EINVAL;
++
++	switch (node->id) {
++	case CSI2_CH0...CSI2_CH3:
++		f->fmt.meta.dataformat = V4L2_META_FMT_SENSOR_DATA;
++		if (!f->fmt.meta.buffersize)
++			f->fmt.meta.buffersize = DEFAULT_EMBEDDED_SIZE;
++		f->fmt.meta.buffersize =
++			min_t(u32, f->fmt.meta.buffersize, MAX_BUFFER_SIZE);
++		f->fmt.meta.buffersize =
++			ALIGN(f->fmt.meta.buffersize, BPL_ALIGNMENT);
++		return 0;
++	case FE_STATS:
++		f->fmt.meta.dataformat = V4L2_META_FMT_RPI_FE_STATS;
++		f->fmt.meta.buffersize = sizeof(struct pisp_statistics);
++		return 0;
++	case FE_CONFIG:
++		f->fmt.meta.dataformat = V4L2_META_FMT_RPI_FE_CFG;
++		f->fmt.meta.buffersize = sizeof(struct pisp_fe_config);
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++static int cfe_g_fmt_meta(struct file *file, void *priv, struct v4l2_format *f)
++{
++	struct cfe_node *node = video_drvdata(file);
++	struct cfe_device *cfe = node->cfe;
++
++	cfe_dbg("%s: [%s]\n", __func__, node_desc[node->id].name);
++
++	if (!node_supports_meta(node))
++		return -EINVAL;
++
++	*f = node->meta_fmt;
++
++	return 0;
++}
++
++static int cfe_s_fmt_meta(struct file *file, void *priv, struct v4l2_format *f)
++{
++	struct cfe_node *node = video_drvdata(file);
++	struct cfe_device *cfe = node->cfe;
++	struct vb2_queue *q = &node->buffer_queue;
++	int ret;
++
++	cfe_dbg("%s: [%s]\n", __func__, node_desc[node->id].name);
++
++	if (vb2_is_busy(q))
++		return -EBUSY;
++
++	if (!node_supports_meta(node))
++		return -EINVAL;
++
++	ret = try_fmt_meta(node, f);
++	if (ret)
++		return ret;
++
++	node->meta_fmt = *f;
++
++	cfe_dbg("%s: Set " V4L2_FOURCC_CONV "\n", __func__,
++		V4L2_FOURCC_CONV_ARGS(node->meta_fmt.fmt.meta.dataformat));
++
++	return 0;
++}
++
++static int cfe_try_fmt_meta(struct file *file, void *priv,
++			    struct v4l2_format *f)
++{
++	struct cfe_node *node = video_drvdata(file);
++	struct cfe_device *cfe = node->cfe;
++
++	cfe_dbg("%s: [%s]\n", __func__, node_desc[node->id].name);
++	return try_fmt_meta(node, f);
++}
++
++static int cfe_enum_framesizes(struct file *file, void *priv,
++			       struct v4l2_frmsizeenum *fsize)
++{
++	struct cfe_node *node = video_drvdata(file);
++	struct cfe_device *cfe = node->cfe;
++	const struct cfe_fmt *fmt;
++
++	cfe_dbg("%s [%s]\n", __func__, node_desc[node->id].name);
++
++	if (fsize->index > 0)
++		return -EINVAL;
++
++	/* check for valid format */
++	fmt = find_format_by_pix(fsize->pixel_format);
++	if (!fmt) {
++		cfe_dbg("Invalid pixel code: %x\n", fsize->pixel_format);
++		return -EINVAL;
++	}
++
++	/* TODO: Do we have limits on the step_width? */
++
++	fsize->type = V4L2_FRMSIZE_TYPE_STEPWISE;
++	fsize->stepwise.min_width = MIN_WIDTH;
++	fsize->stepwise.max_width = MAX_WIDTH;
++	fsize->stepwise.step_width = 2;
++	fsize->stepwise.min_height = MIN_HEIGHT;
++	fsize->stepwise.max_height = MAX_HEIGHT;
++	fsize->stepwise.step_height = 1;
++
++	return 0;
++}
++
++static int cfe_vb2_ioctl_reqbufs(struct file *file, void *priv,
++				 struct v4l2_requestbuffers *p)
++{
++	struct video_device *vdev = video_devdata(file);
++	struct cfe_node *node = video_get_drvdata(vdev);
++	struct cfe_device *cfe = node->cfe;
++	int ret;
++
++	cfe_dbg("%s: [%s] type:%u\n", __func__, node_desc[node->id].name,
++		p->type);
++
++	if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE &&
++	    p->type != V4L2_BUF_TYPE_META_CAPTURE &&
++	    p->type != V4L2_BUF_TYPE_META_OUTPUT)
++		return -EINVAL;
++
++	ret = vb2_queue_change_type(vdev->queue, p->type);
++	if (ret)
++		return ret;
++
++	return vb2_ioctl_reqbufs(file, priv, p);
++}
++
++static int cfe_vb2_ioctl_create_bufs(struct file *file, void *priv,
++				     struct v4l2_create_buffers *p)
++{
++	struct video_device *vdev = video_devdata(file);
++	struct cfe_node *node = video_get_drvdata(vdev);
++	struct cfe_device *cfe = node->cfe;
++	int ret;
++
++	cfe_dbg("%s: [%s] type:%u\n", __func__, node_desc[node->id].name,
++		p->format.type);
++
++	if (p->format.type != V4L2_BUF_TYPE_VIDEO_CAPTURE &&
++	    p->format.type != V4L2_BUF_TYPE_META_CAPTURE &&
++	    p->format.type != V4L2_BUF_TYPE_META_OUTPUT)
++		return -EINVAL;
++
++	ret = vb2_queue_change_type(vdev->queue, p->format.type);
++	if (ret)
++		return ret;
++
++	return vb2_ioctl_create_bufs(file, priv, p);
++}
++
++static int cfe_subscribe_event(struct v4l2_fh *fh,
++			       const struct v4l2_event_subscription *sub)
++{
++	struct cfe_node *node = video_get_drvdata(fh->vdev);
++
++	switch (sub->type) {
++	case V4L2_EVENT_FRAME_SYNC:
++		if (!node_supports_image_output(node))
++			break;
++
++		return v4l2_event_subscribe(fh, sub, 2, NULL);
++	case V4L2_EVENT_SOURCE_CHANGE:
++		if (!node_supports_image_output(node) &&
++		    !node_supports_meta_output(node))
++			break;
++
++		return v4l2_event_subscribe(fh, sub, 4, NULL);
++	}
++
++	return v4l2_ctrl_subscribe_event(fh, sub);
++}
++
++static const struct v4l2_ioctl_ops cfe_ioctl_ops = {
++	.vidioc_querycap = cfe_querycap,
++	.vidioc_enum_fmt_vid_cap = cfe_enum_fmt_vid_cap,
++	.vidioc_g_fmt_vid_cap = cfe_g_fmt,
++	.vidioc_s_fmt_vid_cap = cfe_s_fmt_vid_cap,
++	.vidioc_try_fmt_vid_cap = cfe_try_fmt_vid_cap,
++
++	.vidioc_enum_fmt_meta_cap = cfe_enum_fmt_meta,
++	.vidioc_g_fmt_meta_cap = cfe_g_fmt_meta,
++	.vidioc_s_fmt_meta_cap = cfe_s_fmt_meta,
++	.vidioc_try_fmt_meta_cap = cfe_try_fmt_meta,
++
++	.vidioc_enum_fmt_meta_out = cfe_enum_fmt_meta,
++	.vidioc_g_fmt_meta_out = cfe_g_fmt_meta,
++	.vidioc_s_fmt_meta_out = cfe_s_fmt_meta,
++	.vidioc_try_fmt_meta_out = cfe_try_fmt_meta,
++
++	.vidioc_enum_framesizes = cfe_enum_framesizes,
++
++	.vidioc_reqbufs = cfe_vb2_ioctl_reqbufs,
++	.vidioc_create_bufs = cfe_vb2_ioctl_create_bufs,
++	.vidioc_prepare_buf = vb2_ioctl_prepare_buf,
++	.vidioc_querybuf = vb2_ioctl_querybuf,
++	.vidioc_qbuf = vb2_ioctl_qbuf,
++	.vidioc_dqbuf = vb2_ioctl_dqbuf,
++	.vidioc_expbuf = vb2_ioctl_expbuf,
++	.vidioc_streamon = vb2_ioctl_streamon,
++	.vidioc_streamoff = vb2_ioctl_streamoff,
++
++	.vidioc_subscribe_event = cfe_subscribe_event,
++	.vidioc_unsubscribe_event = v4l2_event_unsubscribe,
++};
++
++static void cfe_notify(struct v4l2_subdev *sd, unsigned int notification,
++		       void *arg)
++{
++	struct cfe_device *cfe = to_cfe_device(sd->v4l2_dev);
++	unsigned int i;
++
++	switch (notification) {
++	case V4L2_DEVICE_NOTIFY_EVENT:
++		for (i = 0; i < NUM_NODES; i++) {
++			struct cfe_node *node = &cfe->node[i];
++
++			if (check_state(cfe, NODE_REGISTERED, i))
++				continue;
++
++			v4l2_event_queue(&node->video_dev, arg);
++		}
++		break;
++	default:
++		break;
++	}
++}
++
++/* cfe capture driver file operations */
++static const struct v4l2_file_operations cfe_fops = {
++	.owner = THIS_MODULE,
++	.open = v4l2_fh_open,
++	.release = vb2_fop_release,
++	.poll = vb2_fop_poll,
++	.unlocked_ioctl = video_ioctl2,
++	.mmap = vb2_fop_mmap,
++};
++
++static int cfe_video_link_validate(struct media_link *link)
++{
++	struct video_device *vd = container_of(link->sink->entity,
++					       struct video_device, entity);
++	struct cfe_node *node = container_of(vd, struct cfe_node, video_dev);
++	struct cfe_device *cfe = node->cfe;
++	struct v4l2_mbus_framefmt *source_fmt;
++	struct v4l2_subdev_state *state;
++	struct v4l2_subdev *source_sd;
++	int ret = 0;
++
++	cfe_dbg("%s: [%s] link \"%s\":%u -> \"%s\":%u\n", __func__,
++		node_desc[node->id].name,
++		link->source->entity->name, link->source->index,
++		link->sink->entity->name, link->sink->index);
++
++	if (!media_entity_remote_source_pad_unique(link->sink->entity)) {
++		cfe_err("video node %s pad not connected\n", vd->name);
++		return -ENOTCONN;
++	}
++
++	source_sd = media_entity_to_v4l2_subdev(link->source->entity);
++
++	state = v4l2_subdev_lock_and_get_active_state(source_sd);
++
++	source_fmt = v4l2_subdev_state_get_format(state,
++						link->source->index);
++	if (!source_fmt) {
++		ret = -EINVAL;
++		goto out;
++	}
++
++	if (is_image_output_node(node)) {
++		struct v4l2_pix_format *pix_fmt = &node->vid_fmt.fmt.pix;
++		const struct cfe_fmt *fmt = NULL;
++		unsigned int i;
++
++		if (source_fmt->width != pix_fmt->width ||
++		    source_fmt->height != pix_fmt->height) {
++			cfe_err("Wrong width or height %ux%u (remote pad set to %ux%u)\n",
++				pix_fmt->width, pix_fmt->height,
++				source_fmt->width,
++				source_fmt->height);
++			ret = -EINVAL;
++			goto out;
++		}
++
++		for (i = 0; i < ARRAY_SIZE(formats); i++) {
++			if (formats[i].code == source_fmt->code &&
++			    formats[i].fourcc == pix_fmt->pixelformat) {
++				fmt = &formats[i];
++				break;
++			}
++		}
++		if (!fmt) {
++			cfe_err("Format mismatch!\n");
++			ret = -EINVAL;
++			goto out;
++		}
++	} else if (is_csi2_node(node) && is_meta_output_node(node)) {
++		struct v4l2_meta_format *meta_fmt = &node->meta_fmt.fmt.meta;
++		const struct cfe_fmt *fmt;
++		u32 source_size;
++
++		fmt = find_format_by_code(source_fmt->code);
++		if (!fmt || fmt->fourcc != meta_fmt->dataformat) {
++			cfe_err("Metadata format mismatch!\n");
++			ret = -EINVAL;
++			goto out;
++		}
++
++		source_size = DIV_ROUND_UP(source_fmt->width * source_fmt->height * fmt->depth, 8);
++
++		if (source_fmt->code != MEDIA_BUS_FMT_SENSOR_DATA) {
++			cfe_err("Bad metadata mbus format\n");
++			ret = -EINVAL;
++			goto out;
++		}
++
++		if (source_size > meta_fmt->buffersize) {
++			cfe_err("Metadata buffer too small: %u < %u\n",
++				meta_fmt->buffersize, source_size);
++			ret = -EINVAL;
++			goto out;
++		}
++	}
++
++out:
++	v4l2_subdev_unlock_state(state);
++
++	return ret;
++}
++
++static const struct media_entity_operations cfe_media_entity_ops = {
++	.link_validate = cfe_video_link_validate,
++};
++
++static int cfe_video_link_notify(struct media_link *link, u32 flags,
++				 unsigned int notification)
++{
++	struct media_device *mdev = link->graph_obj.mdev;
++	struct cfe_device *cfe = container_of(mdev, struct cfe_device, mdev);
++	struct media_entity *fe = &cfe->fe.sd.entity;
++	struct media_entity *csi2 = &cfe->csi2.sd.entity;
++	unsigned long lock_flags;
++	unsigned int i;
++
++	if (notification != MEDIA_DEV_NOTIFY_POST_LINK_CH)
++		return 0;
++
++	cfe_dbg("%s: %s[%u] -> %s[%u] 0x%x", __func__,
++		link->source->entity->name, link->source->index,
++		link->sink->entity->name, link->sink->index, flags);
++
++	spin_lock_irqsave(&cfe->state_lock, lock_flags);
++
++	for (i = 0; i < NUM_NODES; i++) {
++		if (link->sink->entity != &cfe->node[i].video_dev.entity &&
++		    link->source->entity != &cfe->node[i].video_dev.entity)
++			continue;
++
++		if (link->flags & MEDIA_LNK_FL_ENABLED)
++			set_state(cfe, NODE_ENABLED, i);
++		else
++			clear_state(cfe, NODE_ENABLED, i);
++
++		break;
++	}
++
++	spin_unlock_irqrestore(&cfe->state_lock, lock_flags);
++
++	if (link->source->entity != csi2)
++		return 0;
++	if (link->sink->entity != fe)
++		return 0;
++	if (link->sink->index != 0)
++		return 0;
++
++	cfe->fe_csi2_channel = -1;
++	if (link->flags & MEDIA_LNK_FL_ENABLED) {
++		if (link->source->index == node_desc[CSI2_CH0].link_pad)
++			cfe->fe_csi2_channel = CSI2_CH0;
++		else if (link->source->index == node_desc[CSI2_CH1].link_pad)
++			cfe->fe_csi2_channel = CSI2_CH1;
++		else if (link->source->index == node_desc[CSI2_CH2].link_pad)
++			cfe->fe_csi2_channel = CSI2_CH2;
++		else if (link->source->index == node_desc[CSI2_CH3].link_pad)
++			cfe->fe_csi2_channel = CSI2_CH3;
++	}
++
++	if (is_fe_enabled(cfe))
++		cfe_dbg("%s: Found CSI2:%d -> FE:0 link\n", __func__,
++			cfe->fe_csi2_channel);
++	else
++		cfe_dbg("%s: Unable to find CSI2:x -> FE:0 link\n", __func__);
++
++	return 0;
++}
++
++static const struct media_device_ops cfe_media_device_ops = {
++	.link_notify = cfe_video_link_notify,
++};
++
++static void cfe_release(struct kref *kref)
++{
++	struct cfe_device *cfe = container_of(kref, struct cfe_device, kref);
++
++	media_device_cleanup(&cfe->mdev);
++
++	kfree(cfe);
++}
++
++static void cfe_put(struct cfe_device *cfe)
++{
++	kref_put(&cfe->kref, cfe_release);
++}
++
++static void cfe_get(struct cfe_device *cfe)
++{
++	kref_get(&cfe->kref);
++}
++
++static void cfe_node_release(struct video_device *vdev)
++{
++	struct cfe_node *node = video_get_drvdata(vdev);
++
++	cfe_put(node->cfe);
++}
++
++static int cfe_register_node(struct cfe_device *cfe, int id)
++{
++	struct video_device *vdev;
++	const struct cfe_fmt *fmt;
++	struct vb2_queue *q;
++	struct cfe_node *node = &cfe->node[id];
++	int ret;
++
++	node->cfe = cfe;
++	node->id = id;
++
++	if (node_supports_image(node)) {
++		if (node_supports_image_output(node))
++			node->vid_fmt.type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
++		else
++			node->vid_fmt.type = V4L2_BUF_TYPE_VIDEO_OUTPUT;
++
++		fmt = find_format_by_code(cfe_default_format.code);
++		if (!fmt) {
++			cfe_err("Failed to find format code\n");
++			return -EINVAL;
++		}
++
++		node->vid_fmt.fmt.pix.pixelformat = fmt->fourcc;
++		v4l2_fill_pix_format(&node->vid_fmt.fmt.pix, &cfe_default_format);
++
++		ret = try_fmt_vid_cap(node, &node->vid_fmt);
++		if (ret)
++			return ret;
++	}
++
++	if (node_supports_meta(node)) {
++		if (node_supports_meta_output(node))
++			node->meta_fmt.type = V4L2_BUF_TYPE_META_CAPTURE;
++		else
++			node->meta_fmt.type = V4L2_BUF_TYPE_META_OUTPUT;
++
++		ret = try_fmt_meta(node, &node->meta_fmt);
++		if (ret)
++			return ret;
++	}
++
++	mutex_init(&node->lock);
++
++	q = &node->buffer_queue;
++	q->type = node_supports_image(node) ? node->vid_fmt.type :
++					      node->meta_fmt.type;
++	q->io_modes = VB2_MMAP | VB2_DMABUF;
++	q->drv_priv = node;
++	q->ops = &cfe_video_qops;
++	q->mem_ops = &vb2_dma_contig_memops;
++	q->buf_struct_size = id == FE_CONFIG ? sizeof(struct cfe_config_buffer)
++					     : sizeof(struct cfe_buffer);
++	q->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
++	q->lock = &node->lock;
++	q->min_queued_buffers = 1;
++	q->dev = &cfe->pdev->dev;
++
++	ret = vb2_queue_init(q);
++	if (ret) {
++		cfe_err("vb2_queue_init() failed\n");
++		return ret;
++	}
++
++	INIT_LIST_HEAD(&node->dma_queue);
++
++	vdev = &node->video_dev;
++	vdev->release = cfe_node_release;
++	vdev->fops = &cfe_fops;
++	vdev->ioctl_ops = &cfe_ioctl_ops;
++	vdev->entity.ops = &cfe_media_entity_ops;
++	vdev->v4l2_dev = &cfe->v4l2_dev;
++	vdev->vfl_dir = (node_supports_image_output(node) ||
++			 node_supports_meta_output(node)) ?
++				VFL_DIR_RX :
++				VFL_DIR_TX;
++	vdev->queue = q;
++	vdev->lock = &node->lock;
++	vdev->device_caps = node_desc[id].caps;
++	vdev->device_caps |= V4L2_CAP_STREAMING | V4L2_CAP_IO_MC;
++
++	/* Define the device names */
++	snprintf(vdev->name, sizeof(vdev->name), "%s-%s", CFE_MODULE_NAME,
++		 node_desc[id].name);
++
++	video_set_drvdata(vdev, node);
++	if (node->id == FE_OUT0)
++		vdev->entity.flags |= MEDIA_ENT_FL_DEFAULT;
++	node->pad.flags = node_desc[id].pad_flags;
++	media_entity_pads_init(&vdev->entity, 1, &node->pad);
++
++	if (!node_supports_image(node)) {
++		v4l2_disable_ioctl(&node->video_dev,
++				   VIDIOC_ENUM_FRAMEINTERVALS);
++		v4l2_disable_ioctl(&node->video_dev,
++				   VIDIOC_ENUM_FRAMESIZES);
++	}
++
++	ret = video_register_device(vdev, VFL_TYPE_VIDEO, -1);
++	if (ret) {
++		cfe_err("Unable to register video device %s\n", vdev->name);
++		return ret;
++	}
++
++	cfe_info("Registered [%s] node id %d successfully as /dev/video%u\n",
++		 vdev->name, id, vdev->num);
++
++	/*
++	 * Acquire a reference to cfe, which will be released when the video
++	 * device will be unregistered and userspace will have closed all open
++	 * file handles.
++	 */
++	cfe_get(cfe);
++	set_state(cfe, NODE_REGISTERED, id);
++
++	return 0;
++}
++
++static void cfe_unregister_nodes(struct cfe_device *cfe)
++{
++	unsigned int i;
++
++	for (i = 0; i < NUM_NODES; i++) {
++		struct cfe_node *node = &cfe->node[i];
++
++		if (check_state(cfe, NODE_REGISTERED, i)) {
++			clear_state(cfe, NODE_REGISTERED, i);
++			video_unregister_device(&node->video_dev);
++		}
++	}
++}
++
++static int cfe_link_node_pads(struct cfe_device *cfe)
++{
++	unsigned int i, source_pad = 0;
++	int ret;
++
++	for (i = 0; i < CSI2_NUM_CHANNELS; i++) {
++		struct cfe_node *node = &cfe->node[i];
++
++		if (!check_state(cfe, NODE_REGISTERED, i))
++			continue;
++
++		/* Find next source pad */
++		while (source_pad < cfe->sensor->entity.num_pads &&
++		       !(cfe->sensor->entity.pads[source_pad].flags &
++							MEDIA_PAD_FL_SOURCE))
++			source_pad++;
++
++		if (source_pad < cfe->sensor->entity.num_pads) {
++			/* Sensor -> CSI2 */
++			ret = media_create_pad_link(&cfe->sensor->entity, source_pad,
++						    &cfe->csi2.sd.entity, i,
++						    MEDIA_LNK_FL_IMMUTABLE |
++						    MEDIA_LNK_FL_ENABLED);
++			if (ret)
++				return ret;
++
++			/* Dealt with that source_pad, look at the next one next time */
++			source_pad++;
++		}
++
++		/* CSI2 channel # -> /dev/video# */
++		ret = media_create_pad_link(&cfe->csi2.sd.entity,
++					    node_desc[i].link_pad,
++					    &node->video_dev.entity, 0, 0);
++		if (ret)
++			return ret;
++
++		if (node_supports_image(node)) {
++			/* CSI2 channel # -> FE Input */
++			ret = media_create_pad_link(&cfe->csi2.sd.entity,
++						    node_desc[i].link_pad,
++						    &cfe->fe.sd.entity,
++						    FE_STREAM_PAD, 0);
++			if (ret)
++				return ret;
++		}
++	}
++
++	for (; i < NUM_NODES; i++) {
++		struct cfe_node *node = &cfe->node[i];
++		struct media_entity *src, *dst;
++		unsigned int src_pad, dst_pad;
++
++		if (node_desc[i].pad_flags & MEDIA_PAD_FL_SINK) {
++			/* FE -> /dev/video# */
++			src = &cfe->fe.sd.entity;
++			src_pad = node_desc[i].link_pad;
++			dst = &node->video_dev.entity;
++			dst_pad = 0;
++		} else {
++			/* /dev/video# -> FE */
++			dst = &cfe->fe.sd.entity;
++			dst_pad = node_desc[i].link_pad;
++			src = &node->video_dev.entity;
++			src_pad = 0;
++		}
++
++		ret = media_create_pad_link(src, src_pad, dst, dst_pad, 0);
++		if (ret)
++			return ret;
++	}
++
++	return 0;
++}
++
++static int cfe_probe_complete(struct cfe_device *cfe)
++{
++	unsigned int i;
++	int ret;
++
++	cfe->v4l2_dev.notify = cfe_notify;
++
++	for (i = 0; i < NUM_NODES; i++) {
++		ret = cfe_register_node(cfe, i);
++		if (ret) {
++			cfe_err("Unable to register video node %u.\n", i);
++			goto unregister;
++		}
++	}
++
++	ret = cfe_link_node_pads(cfe);
++	if (ret) {
++		cfe_err("Unable to link node pads.\n");
++		goto unregister;
++	}
++
++	ret = v4l2_device_register_subdev_nodes(&cfe->v4l2_dev);
++	if (ret) {
++		cfe_err("Unable to register subdev nodes.\n");
++		goto unregister;
++	}
++
++	return 0;
++
++unregister:
++	cfe_unregister_nodes(cfe);
++	return ret;
++}
++
++static int cfe_async_bound(struct v4l2_async_notifier *notifier,
++			   struct v4l2_subdev *subdev,
++			   struct v4l2_async_connection *asd)
++{
++	struct cfe_device *cfe = to_cfe_device(notifier->v4l2_dev);
++
++	if (cfe->sensor) {
++		cfe_info("Rejecting subdev %s (Already set!!)", subdev->name);
++		return 0;
++	}
++
++	cfe->sensor = subdev;
++	cfe_info("Using sensor %s for capture\n", subdev->name);
++
++	return 0;
++}
++
++static int cfe_async_complete(struct v4l2_async_notifier *notifier)
++{
++	struct cfe_device *cfe = to_cfe_device(notifier->v4l2_dev);
++
++	return cfe_probe_complete(cfe);
++}
++
++static const struct v4l2_async_notifier_operations cfe_async_ops = {
++	.bound = cfe_async_bound,
++	.complete = cfe_async_complete,
++};
++
++static int of_cfe_connect_subdevs(struct cfe_device *cfe)
++{
++	struct platform_device *pdev = cfe->pdev;
++	struct v4l2_fwnode_endpoint ep = { .bus_type = V4L2_MBUS_CSI2_DPHY };
++	struct device_node *node = pdev->dev.of_node;
++	struct device_node *ep_node;
++	struct device_node *sensor_node;
++	unsigned int lane;
++	int ret = -EINVAL;
++
++	/* Get the local endpoint and remote device. */
++	ep_node = of_graph_get_next_endpoint(node, NULL);
++	if (!ep_node) {
++		cfe_err("can't get next endpoint\n");
++		return -EINVAL;
++	}
++
++	cfe_dbg("ep_node is %pOF\n", ep_node);
++
++	sensor_node = of_graph_get_remote_port_parent(ep_node);
++	if (!sensor_node) {
++		cfe_err("can't get remote parent\n");
++		goto cleanup_exit;
++	}
++
++	cfe_info("found subdevice %pOF\n", sensor_node);
++
++	/* Parse the local endpoint and validate its configuration. */
++	v4l2_fwnode_endpoint_parse(of_fwnode_handle(ep_node), &ep);
++
++	cfe->csi2.multipacket_line =
++		fwnode_property_present(of_fwnode_handle(ep_node),
++					"multipacket-line");
++
++	if (ep.bus_type != V4L2_MBUS_CSI2_DPHY) {
++		cfe_err("endpoint node type != CSI2\n");
++		return -EINVAL;
++	}
++
++	for (lane = 0; lane < ep.bus.mipi_csi2.num_data_lanes; lane++) {
++		if (ep.bus.mipi_csi2.data_lanes[lane] != lane + 1) {
++			cfe_err("subdevice %pOF: data lanes reordering not supported\n",
++				sensor_node);
++			goto cleanup_exit;
++		}
++	}
++
++	cfe->csi2.dphy.max_lanes = ep.bus.mipi_csi2.num_data_lanes;
++	cfe->csi2.bus_flags = ep.bus.mipi_csi2.flags;
++
++	cfe_dbg("subdevice %pOF: %u data lanes, flags=0x%08x, multipacket_line=%u\n",
++		sensor_node, cfe->csi2.dphy.max_lanes, cfe->csi2.bus_flags,
++		cfe->csi2.multipacket_line);
++
++	/* Initialize and register the async notifier. */
++	v4l2_async_nf_init(&cfe->notifier, &cfe->v4l2_dev);
++	cfe->notifier.ops = &cfe_async_ops;
++
++	cfe->asd = v4l2_async_nf_add_fwnode(&cfe->notifier,
++					    of_fwnode_handle(sensor_node),
++					    struct v4l2_async_connection);
++	if (IS_ERR(cfe->asd)) {
++		cfe_err("Error adding subdevice: %d\n", ret);
++		goto cleanup_exit;
++	}
++
++	ret = v4l2_async_nf_register(&cfe->notifier);
++	if (ret) {
++		cfe_err("Error registering async notifier: %d\n", ret);
++		ret = -EINVAL;
++	}
++
++cleanup_exit:
++	of_node_put(sensor_node);
++	of_node_put(ep_node);
++
++	return ret;
++}
++
++static int cfe_probe(struct platform_device *pdev)
++{
++	struct cfe_device *cfe;
++	char debugfs_name[32];
++	int ret;
++
++	cfe = kzalloc(sizeof(*cfe), GFP_KERNEL);
++	if (!cfe)
++		return -ENOMEM;
++
++	platform_set_drvdata(pdev, cfe);
++
++	kref_init(&cfe->kref);
++	cfe->pdev = pdev;
++	cfe->fe_csi2_channel = -1;
++	spin_lock_init(&cfe->state_lock);
++
++	cfe->csi2.base = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(cfe->csi2.base)) {
++		dev_err(&pdev->dev, "Failed to get dma io block\n");
++		ret = PTR_ERR(cfe->csi2.base);
++		goto err_cfe_put;
++	}
++
++	cfe->csi2.dphy.base = devm_platform_ioremap_resource(pdev, 1);
++	if (IS_ERR(cfe->csi2.dphy.base)) {
++		dev_err(&pdev->dev, "Failed to get host io block\n");
++		ret = PTR_ERR(cfe->csi2.dphy.base);
++		goto err_cfe_put;
++	}
++
++	cfe->mipi_cfg_base = devm_platform_ioremap_resource(pdev, 2);
++	if (IS_ERR(cfe->mipi_cfg_base)) {
++		dev_err(&pdev->dev, "Failed to get mipi cfg io block\n");
++		ret = PTR_ERR(cfe->mipi_cfg_base);
++		goto err_cfe_put;
++	}
++
++	cfe->fe.base = devm_platform_ioremap_resource(pdev, 3);
++	if (IS_ERR(cfe->fe.base)) {
++		dev_err(&pdev->dev, "Failed to get pisp fe io block\n");
++		ret = PTR_ERR(cfe->fe.base);
++		goto err_cfe_put;
++	}
++
++	ret = platform_get_irq(pdev, 0);
++	if (ret <= 0) {
++		dev_err(&pdev->dev, "No IRQ resource\n");
++		ret = -EINVAL;
++		goto err_cfe_put;
++	}
++
++	ret = devm_request_irq(&pdev->dev, ret, cfe_isr, 0, "rp1-cfe", cfe);
++	if (ret) {
++		dev_err(&pdev->dev, "Unable to request interrupt\n");
++		ret = -EINVAL;
++		goto err_cfe_put;
++	}
++
++	ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
++	if (ret) {
++		dev_err(&pdev->dev, "DMA enable failed\n");
++		goto err_cfe_put;
++	}
++
++	/* TODO: Enable clock only when running. */
++	cfe->clk = devm_clk_get(&pdev->dev, NULL);
++	if (IS_ERR(cfe->clk))
++		return dev_err_probe(&pdev->dev, PTR_ERR(cfe->clk),
++				     "clock not found\n");
++
++	cfe->mdev.dev = &pdev->dev;
++	cfe->mdev.ops = &cfe_media_device_ops;
++	strscpy(cfe->mdev.model, CFE_MODULE_NAME, sizeof(cfe->mdev.model));
++	strscpy(cfe->mdev.serial, "", sizeof(cfe->mdev.serial));
++	snprintf(cfe->mdev.bus_info, sizeof(cfe->mdev.bus_info), "platform:%s",
++		 dev_name(&pdev->dev));
++
++	media_device_init(&cfe->mdev);
++
++	cfe->v4l2_dev.mdev = &cfe->mdev;
++
++	ret = v4l2_device_register(&pdev->dev, &cfe->v4l2_dev);
++	if (ret) {
++		cfe_err("Unable to register v4l2 device.\n");
++		goto err_cfe_put;
++	}
++
++	snprintf(debugfs_name, sizeof(debugfs_name), "rp1-cfe:%s",
++		 dev_name(&pdev->dev));
++	cfe->debugfs = debugfs_create_dir(debugfs_name, NULL);
++	debugfs_create_file("format", 0444, cfe->debugfs, cfe, &format_fops);
++	debugfs_create_file("regs", 0444, cfe->debugfs, cfe,
++			    &mipi_cfg_regs_fops);
++
++	/* Enable the block power domain */
++	pm_runtime_enable(&pdev->dev);
++
++	ret = pm_runtime_resume_and_get(&cfe->pdev->dev);
++	if (ret)
++		goto err_runtime_disable;
++
++	cfe->csi2.v4l2_dev = &cfe->v4l2_dev;
++	ret = csi2_init(&cfe->csi2, cfe->debugfs);
++	if (ret) {
++		cfe_err("Failed to init csi2 (%d)\n", ret);
++		goto err_runtime_put;
++	}
++
++	cfe->fe.v4l2_dev = &cfe->v4l2_dev;
++	ret = pisp_fe_init(&cfe->fe, cfe->debugfs);
++	if (ret) {
++		cfe_err("Failed to init pisp fe (%d)\n", ret);
++		goto err_csi2_uninit;
++	}
++
++	cfe->mdev.hw_revision = cfe->fe.hw_revision;
++	ret = media_device_register(&cfe->mdev);
++	if (ret < 0) {
++		cfe_err("Unable to register media-controller device.\n");
++		goto err_pisp_fe_uninit;
++	}
++
++	ret = of_cfe_connect_subdevs(cfe);
++	if (ret) {
++		cfe_err("Failed to connect subdevs\n");
++		goto err_media_unregister;
++	}
++
++	pm_runtime_put(&cfe->pdev->dev);
++
++	return 0;
++
++err_media_unregister:
++	media_device_unregister(&cfe->mdev);
++err_pisp_fe_uninit:
++	pisp_fe_uninit(&cfe->fe);
++err_csi2_uninit:
++	csi2_uninit(&cfe->csi2);
++err_runtime_put:
++	pm_runtime_put(&cfe->pdev->dev);
++err_runtime_disable:
++	pm_runtime_disable(&pdev->dev);
++	debugfs_remove(cfe->debugfs);
++	v4l2_device_unregister(&cfe->v4l2_dev);
++err_cfe_put:
++	cfe_put(cfe);
++
++	return ret;
++}
++
++static void cfe_remove(struct platform_device *pdev)
++{
++	struct cfe_device *cfe = platform_get_drvdata(pdev);
++
++	debugfs_remove(cfe->debugfs);
++
++	v4l2_async_nf_unregister(&cfe->notifier);
++	media_device_unregister(&cfe->mdev);
++	cfe_unregister_nodes(cfe);
++
++	pisp_fe_uninit(&cfe->fe);
++	csi2_uninit(&cfe->csi2);
++
++	pm_runtime_disable(&pdev->dev);
++
++	v4l2_device_unregister(&cfe->v4l2_dev);
++
++	cfe_put(cfe);
++}
++
++static int cfe_runtime_suspend(struct device *dev)
++{
++	struct platform_device *pdev = to_platform_device(dev);
++	struct cfe_device *cfe = platform_get_drvdata(pdev);
++
++	clk_disable_unprepare(cfe->clk);
++
++	return 0;
++}
++
++static int cfe_runtime_resume(struct device *dev)
++{
++	struct platform_device *pdev = to_platform_device(dev);
++	struct cfe_device *cfe = platform_get_drvdata(pdev);
++	int ret;
++
++	ret = clk_prepare_enable(cfe->clk);
++	if (ret) {
++		dev_err(dev, "Unable to enable clock\n");
++		return ret;
++	}
++
++	return 0;
++}
++
++static const struct dev_pm_ops cfe_pm_ops = {
++	SET_RUNTIME_PM_OPS(cfe_runtime_suspend, cfe_runtime_resume, NULL)
++	SET_LATE_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, pm_runtime_force_resume)
++};
++
++static const struct of_device_id cfe_of_match[] = {
++	{ .compatible = "raspberrypi,rp1-cfe" },
++	{ /* sentinel */ },
++};
++MODULE_DEVICE_TABLE(of, cfe_of_match);
++
++static struct platform_driver cfe_driver = {
++	.probe		= cfe_probe,
++	.remove		= cfe_remove,
++	.driver = {
++		.name	= CFE_MODULE_NAME,
++		.of_match_table = cfe_of_match,
++		.pm = &cfe_pm_ops,
++	},
++};
++
++module_platform_driver(cfe_driver);
++
++MODULE_AUTHOR("Naushir Patuck <naush@raspberrypi.com>");
++MODULE_DESCRIPTION("RP1 Camera Front End driver");
++MODULE_LICENSE("GPL");
++MODULE_VERSION(CFE_VERSION);
+--- /dev/null
++++ b/drivers/media/platform/raspberrypi/rp1_cfe/cfe.h
+@@ -0,0 +1,43 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * RP1 CFE driver.
++ * Copyright (c) 2021 Raspberry Pi Ltd.
++ *
++ */
++#ifndef _RP1_CFE_
++#define _RP1_CFE_
++
++#include <linux/types.h>
++#include <linux/media-bus-format.h>
++#include <linux/videodev2.h>
++
++extern bool cfe_debug_verbose;
++
++enum cfe_remap_types {
++	CFE_REMAP_16BIT,
++	CFE_REMAP_COMPRESSED,
++	CFE_NUM_REMAP,
++};
++
++#define CFE_FORMAT_FLAG_META_OUT	BIT(0)
++#define CFE_FORMAT_FLAG_META_CAP	BIT(1)
++#define CFE_FORMAT_FLAG_FE_OUT		BIT(2)
++
++struct cfe_fmt {
++	u32 fourcc;
++	u32 code;
++	u8 depth;
++	u8 csi_dt;
++	u32 remap[CFE_NUM_REMAP];
++	u32 flags;
++};
++
++extern const struct v4l2_mbus_framefmt cfe_default_format;
++extern const struct v4l2_mbus_framefmt cfe_default_meta_format;
++
++const struct cfe_fmt *find_format_by_code(u32 code);
++const struct cfe_fmt *find_format_by_pix(u32 pixelformat);
++u32 cfe_find_16bit_code(u32 code);
++u32 cfe_find_compressed_code(u32 code);
++
++#endif
+--- /dev/null
++++ b/drivers/media/platform/raspberrypi/rp1_cfe/cfe_fmts.h
+@@ -0,0 +1,316 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * RP1 Camera Front End formats definition
++ *
++ * Copyright (C) 2021 - Raspberry Pi Ltd.
++ *
++ */
++#ifndef _CFE_FMTS_H_
++#define _CFE_FMTS_H_
++
++#include "cfe.h"
++#include <media/mipi-csi2.h>
++
++static const struct cfe_fmt formats[] = {
++	/* YUV Formats */
++	{
++		.fourcc = V4L2_PIX_FMT_YUYV,
++		.code = MEDIA_BUS_FMT_YUYV8_1X16,
++		.depth = 16,
++		.csi_dt = MIPI_CSI2_DT_YUV422_8B,
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_UYVY,
++		.code = MEDIA_BUS_FMT_UYVY8_1X16,
++		.depth = 16,
++		.csi_dt = MIPI_CSI2_DT_YUV422_8B,
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_YVYU,
++		.code = MEDIA_BUS_FMT_YVYU8_1X16,
++		.depth = 16,
++		.csi_dt = MIPI_CSI2_DT_YUV422_8B,
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_VYUY,
++		.code = MEDIA_BUS_FMT_VYUY8_1X16,
++		.depth = 16,
++		.csi_dt = MIPI_CSI2_DT_YUV422_8B,
++	},
++	{
++		/* RGB Formats */
++		.fourcc = V4L2_PIX_FMT_RGB565, /* gggbbbbb rrrrrggg */
++		.code = MEDIA_BUS_FMT_RGB565_2X8_LE,
++		.depth = 16,
++		.csi_dt = MIPI_CSI2_DT_RGB565,
++	},
++	{	.fourcc = V4L2_PIX_FMT_RGB565X, /* rrrrrggg gggbbbbb */
++		.code = MEDIA_BUS_FMT_RGB565_2X8_BE,
++		.depth = 16,
++		.csi_dt = MIPI_CSI2_DT_RGB565,
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_RGB555, /* gggbbbbb arrrrrgg */
++		.code = MEDIA_BUS_FMT_RGB555_2X8_PADHI_LE,
++		.depth = 16,
++		.csi_dt = MIPI_CSI2_DT_RGB555,
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_RGB555X, /* arrrrrgg gggbbbbb */
++		.code = MEDIA_BUS_FMT_RGB555_2X8_PADHI_BE,
++		.depth = 16,
++		.csi_dt = MIPI_CSI2_DT_RGB555,
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_RGB24, /* rgb */
++		.code = MEDIA_BUS_FMT_RGB888_1X24,
++		.depth = 24,
++		.csi_dt = MIPI_CSI2_DT_RGB888,
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_BGR24, /* bgr */
++		.code = MEDIA_BUS_FMT_BGR888_1X24,
++		.depth = 24,
++		.csi_dt = MIPI_CSI2_DT_RGB888,
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_RGB32, /* argb */
++		.code = MEDIA_BUS_FMT_ARGB8888_1X32,
++		.depth = 32,
++		.csi_dt = 0x0,
++	},
++
++	/* Bayer Formats */
++	{
++		.fourcc = V4L2_PIX_FMT_SBGGR8,
++		.code = MEDIA_BUS_FMT_SBGGR8_1X8,
++		.depth = 8,
++		.csi_dt = MIPI_CSI2_DT_RAW8,
++		.remap = { V4L2_PIX_FMT_SBGGR16, V4L2_PIX_FMT_PISP_COMP1_BGGR },
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_SGBRG8,
++		.code = MEDIA_BUS_FMT_SGBRG8_1X8,
++		.depth = 8,
++		.csi_dt = MIPI_CSI2_DT_RAW8,
++		.remap = { V4L2_PIX_FMT_SGBRG16, V4L2_PIX_FMT_PISP_COMP1_GBRG },
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_SGRBG8,
++		.code = MEDIA_BUS_FMT_SGRBG8_1X8,
++		.depth = 8,
++		.csi_dt = MIPI_CSI2_DT_RAW8,
++		.remap = { V4L2_PIX_FMT_SGRBG16, V4L2_PIX_FMT_PISP_COMP1_GRBG },
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_SRGGB8,
++		.code = MEDIA_BUS_FMT_SRGGB8_1X8,
++		.depth = 8,
++		.csi_dt = MIPI_CSI2_DT_RAW8,
++		.remap = { V4L2_PIX_FMT_SRGGB16, V4L2_PIX_FMT_PISP_COMP1_RGGB },
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_SBGGR10P,
++		.code = MEDIA_BUS_FMT_SBGGR10_1X10,
++		.depth = 10,
++		.csi_dt = MIPI_CSI2_DT_RAW10,
++		.remap = { V4L2_PIX_FMT_SBGGR16, V4L2_PIX_FMT_PISP_COMP1_BGGR },
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_SGBRG10P,
++		.code = MEDIA_BUS_FMT_SGBRG10_1X10,
++		.depth = 10,
++		.csi_dt = MIPI_CSI2_DT_RAW10,
++		.remap = { V4L2_PIX_FMT_SGBRG16, V4L2_PIX_FMT_PISP_COMP1_GBRG },
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_SGRBG10P,
++		.code = MEDIA_BUS_FMT_SGRBG10_1X10,
++		.depth = 10,
++		.csi_dt = MIPI_CSI2_DT_RAW10,
++		.remap = { V4L2_PIX_FMT_SGRBG16, V4L2_PIX_FMT_PISP_COMP1_GRBG },
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_SRGGB10P,
++		.code = MEDIA_BUS_FMT_SRGGB10_1X10,
++		.depth = 10,
++		.csi_dt = MIPI_CSI2_DT_RAW10,
++		.remap = { V4L2_PIX_FMT_SRGGB16, V4L2_PIX_FMT_PISP_COMP1_RGGB },
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_SBGGR12P,
++		.code = MEDIA_BUS_FMT_SBGGR12_1X12,
++		.depth = 12,
++		.csi_dt = MIPI_CSI2_DT_RAW12,
++		.remap = { V4L2_PIX_FMT_SBGGR16, V4L2_PIX_FMT_PISP_COMP1_BGGR },
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_SGBRG12P,
++		.code = MEDIA_BUS_FMT_SGBRG12_1X12,
++		.depth = 12,
++		.csi_dt = MIPI_CSI2_DT_RAW12,
++		.remap = { V4L2_PIX_FMT_SGBRG16, V4L2_PIX_FMT_PISP_COMP1_GBRG },
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_SGRBG12P,
++		.code = MEDIA_BUS_FMT_SGRBG12_1X12,
++		.depth = 12,
++		.csi_dt = MIPI_CSI2_DT_RAW12,
++		.remap = { V4L2_PIX_FMT_SGRBG16, V4L2_PIX_FMT_PISP_COMP1_GRBG },
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_SRGGB12P,
++		.code = MEDIA_BUS_FMT_SRGGB12_1X12,
++		.depth = 12,
++		.csi_dt = MIPI_CSI2_DT_RAW12,
++		.remap = { V4L2_PIX_FMT_SRGGB16, V4L2_PIX_FMT_PISP_COMP1_RGGB },
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_SBGGR14P,
++		.code = MEDIA_BUS_FMT_SBGGR14_1X14,
++		.depth = 14,
++		.csi_dt = MIPI_CSI2_DT_RAW14,
++		.remap = { V4L2_PIX_FMT_SBGGR16, V4L2_PIX_FMT_PISP_COMP1_BGGR },
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_SGBRG14P,
++		.code = MEDIA_BUS_FMT_SGBRG14_1X14,
++		.depth = 14,
++		.csi_dt = MIPI_CSI2_DT_RAW14,
++		.remap = { V4L2_PIX_FMT_SGBRG16, V4L2_PIX_FMT_PISP_COMP1_GBRG },
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_SGRBG14P,
++		.code = MEDIA_BUS_FMT_SGRBG14_1X14,
++		.depth = 14,
++		.csi_dt = MIPI_CSI2_DT_RAW14,
++		.remap = { V4L2_PIX_FMT_SGRBG16, V4L2_PIX_FMT_PISP_COMP1_GRBG },
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_SRGGB14P,
++		.code = MEDIA_BUS_FMT_SRGGB14_1X14,
++		.depth = 14,
++		.csi_dt = MIPI_CSI2_DT_RAW14,
++		.remap = { V4L2_PIX_FMT_SRGGB16, V4L2_PIX_FMT_PISP_COMP1_RGGB },
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_SBGGR16,
++		.code = MEDIA_BUS_FMT_SBGGR16_1X16,
++		.depth = 16,
++		.csi_dt = MIPI_CSI2_DT_RAW16,
++		.flags = CFE_FORMAT_FLAG_FE_OUT,
++		.remap = { V4L2_PIX_FMT_SBGGR16, V4L2_PIX_FMT_PISP_COMP1_BGGR },
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_SGBRG16,
++		.code = MEDIA_BUS_FMT_SGBRG16_1X16,
++		.depth = 16,
++		.csi_dt = MIPI_CSI2_DT_RAW16,
++		.flags = CFE_FORMAT_FLAG_FE_OUT,
++		.remap = { V4L2_PIX_FMT_SGBRG16, V4L2_PIX_FMT_PISP_COMP1_GBRG },
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_SGRBG16,
++		.code = MEDIA_BUS_FMT_SGRBG16_1X16,
++		.depth = 16,
++		.csi_dt = MIPI_CSI2_DT_RAW16,
++		.flags = CFE_FORMAT_FLAG_FE_OUT,
++		.remap = { V4L2_PIX_FMT_SGRBG16, V4L2_PIX_FMT_PISP_COMP1_GRBG },
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_SRGGB16,
++		.code = MEDIA_BUS_FMT_SRGGB16_1X16,
++		.depth = 16,
++		.csi_dt = MIPI_CSI2_DT_RAW16,
++		.flags = CFE_FORMAT_FLAG_FE_OUT,
++		.remap = { V4L2_PIX_FMT_SRGGB16, V4L2_PIX_FMT_PISP_COMP1_RGGB },
++	},
++	/* PiSP Compressed Mode 1 */
++	{
++		.fourcc = V4L2_PIX_FMT_PISP_COMP1_RGGB,
++		.code = MEDIA_BUS_FMT_SRGGB16_1X16,
++		.depth = 8,
++		.flags = CFE_FORMAT_FLAG_FE_OUT,
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_PISP_COMP1_BGGR,
++		.code = MEDIA_BUS_FMT_SBGGR16_1X16,
++		.depth = 8,
++		.flags = CFE_FORMAT_FLAG_FE_OUT,
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_PISP_COMP1_GBRG,
++		.code = MEDIA_BUS_FMT_SGBRG16_1X16,
++		.depth = 8,
++		.flags = CFE_FORMAT_FLAG_FE_OUT,
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_PISP_COMP1_GRBG,
++		.code = MEDIA_BUS_FMT_SGRBG16_1X16,
++		.depth = 8,
++		.flags = CFE_FORMAT_FLAG_FE_OUT,
++	},
++	/* Greyscale format */
++	{
++		.fourcc = V4L2_PIX_FMT_GREY,
++		.code = MEDIA_BUS_FMT_Y8_1X8,
++		.depth = 8,
++		.csi_dt = MIPI_CSI2_DT_RAW8,
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_Y10P,
++		.code = MEDIA_BUS_FMT_Y10_1X10,
++		.depth = 10,
++		.csi_dt = MIPI_CSI2_DT_RAW10,
++		.remap = { V4L2_PIX_FMT_Y16, V4L2_PIX_FMT_PISP_COMP1_MONO },
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_Y12P,
++		.code = MEDIA_BUS_FMT_Y12_1X12,
++		.depth = 12,
++		.csi_dt = MIPI_CSI2_DT_RAW12,
++		.remap = { V4L2_PIX_FMT_Y16, V4L2_PIX_FMT_PISP_COMP1_MONO },
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_Y14P,
++		.code = MEDIA_BUS_FMT_Y14_1X14,
++		.depth = 14,
++		.csi_dt = MIPI_CSI2_DT_RAW14,
++		.remap = { V4L2_PIX_FMT_Y16, V4L2_PIX_FMT_PISP_COMP1_MONO },
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_Y16,
++		.code = MEDIA_BUS_FMT_Y16_1X16,
++		.depth = 16,
++		.csi_dt = MIPI_CSI2_DT_RAW16,
++		.flags = CFE_FORMAT_FLAG_FE_OUT,
++	},
++	{
++		.fourcc = V4L2_PIX_FMT_PISP_COMP1_MONO,
++		.code = MEDIA_BUS_FMT_Y16_1X16,
++		.depth = 8,
++		.flags = CFE_FORMAT_FLAG_FE_OUT,
++	},
++	/* Embedded data format */
++	{
++		.fourcc = V4L2_META_FMT_SENSOR_DATA,
++		.code = MEDIA_BUS_FMT_SENSOR_DATA,
++		.depth = 8,
++		.csi_dt = MIPI_CSI2_DT_EMBEDDED_8B,
++		.flags = CFE_FORMAT_FLAG_META_CAP,
++	},
++
++	/* Frontend formats */
++	{
++		.fourcc = V4L2_META_FMT_RPI_FE_CFG,
++		.code = MEDIA_BUS_FMT_FIXED,
++		.flags = CFE_FORMAT_FLAG_META_OUT,
++	},
++	{
++		.fourcc = V4L2_META_FMT_RPI_FE_STATS,
++		.code = MEDIA_BUS_FMT_FIXED,
++		.flags = CFE_FORMAT_FLAG_META_CAP,
++	},
++};
++
++#endif /* _CFE_FMTS_H_ */
+--- /dev/null
++++ b/drivers/media/platform/raspberrypi/rp1_cfe/csi2.c
+@@ -0,0 +1,628 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * RP1 CSI-2 Driver
++ *
++ * Copyright (C) 2021 - Raspberry Pi Ltd.
++ *
++ */
++
++#include <linux/delay.h>
++#include <linux/moduleparam.h>
++#include <linux/pm_runtime.h>
++#include <linux/seq_file.h>
++
++#include <media/videobuf2-dma-contig.h>
++
++#include "csi2.h"
++#include "cfe.h"
++
++static bool csi2_track_errors;
++module_param_named(track_csi2_errors, csi2_track_errors, bool, 0);
++MODULE_PARM_DESC(track_csi2_errors, "track csi-2 errors");
++
++#define csi2_dbg_verbose(fmt, arg...)                             \
++	do {                                                      \
++		if (cfe_debug_verbose)                            \
++			dev_dbg(csi2->v4l2_dev->dev, fmt, ##arg); \
++	} while (0)
++#define csi2_dbg(fmt, arg...) dev_dbg(csi2->v4l2_dev->dev, fmt, ##arg)
++#define csi2_info(fmt, arg...) dev_info(csi2->v4l2_dev->dev, fmt, ##arg)
++#define csi2_err(fmt, arg...) dev_err(csi2->v4l2_dev->dev, fmt, ##arg)
++
++/* CSI2-DMA registers */
++#define CSI2_STATUS		0x000
++#define CSI2_QOS		0x004
++#define CSI2_DISCARDS_OVERFLOW	0x008
++#define CSI2_DISCARDS_INACTIVE	0x00c
++#define CSI2_DISCARDS_UNMATCHED	0x010
++#define CSI2_DISCARDS_LEN_LIMIT	0x014
++
++#define CSI2_DISCARDS_AMOUNT_SHIFT	0
++#define CSI2_DISCARDS_AMOUNT_MASK	GENMASK(23, 0)
++#define CSI2_DISCARDS_DT_SHIFT		24
++#define CSI2_DISCARDS_DT_MASK		GENMASK(29, 24)
++#define CSI2_DISCARDS_VC_SHIFT		30
++#define CSI2_DISCARDS_VC_MASK		GENMASK(31, 30)
++
++#define CSI2_LLEV_PANICS	0x018
++#define CSI2_ULEV_PANICS	0x01c
++#define CSI2_IRQ_MASK		0x020
++#define CSI2_IRQ_MASK_IRQ_OVERFLOW		BIT(0)
++#define CSI2_IRQ_MASK_IRQ_DISCARD_OVERFLOW	BIT(1)
++#define CSI2_IRQ_MASK_IRQ_DISCARD_LENGTH_LIMIT	BIT(2)
++#define CSI2_IRQ_MASK_IRQ_DISCARD_UNMATCHED	BIT(3)
++#define CSI2_IRQ_MASK_IRQ_DISCARD_INACTIVE	BIT(4)
++#define CSI2_IRQ_MASK_IRQ_ALL                                              \
++	(CSI2_IRQ_MASK_IRQ_OVERFLOW | CSI2_IRQ_MASK_IRQ_DISCARD_OVERFLOW | \
++	 CSI2_IRQ_MASK_IRQ_DISCARD_LENGTH_LIMIT |                          \
++	 CSI2_IRQ_MASK_IRQ_DISCARD_UNMATCHED |                             \
++	 CSI2_IRQ_MASK_IRQ_DISCARD_INACTIVE)
++
++#define CSI2_CTRL		0x024
++#define CSI2_CH_CTRL(x)		((x) * 0x40 + 0x28)
++#define CSI2_CH_ADDR0(x)	((x) * 0x40 + 0x2c)
++#define CSI2_CH_ADDR1(x)	((x) * 0x40 + 0x3c)
++#define CSI2_CH_STRIDE(x)	((x) * 0x40 + 0x30)
++#define CSI2_CH_LENGTH(x)	((x) * 0x40 + 0x34)
++#define CSI2_CH_DEBUG(x)	((x) * 0x40 + 0x38)
++#define CSI2_CH_FRAME_SIZE(x)	((x) * 0x40 + 0x40)
++#define CSI2_CH_COMP_CTRL(x)	((x) * 0x40 + 0x44)
++#define CSI2_CH_FE_FRAME_ID(x)	((x) * 0x40 + 0x48)
++
++/* CSI2_STATUS */
++#define IRQ_FS(x)		(BIT(0) << (x))
++#define IRQ_FE(x)		(BIT(4) << (x))
++#define IRQ_FE_ACK(x)		(BIT(8) << (x))
++#define IRQ_LE(x)		(BIT(12) << (x))
++#define IRQ_LE_ACK(x)		(BIT(16) << (x))
++#define IRQ_CH_MASK(x)		(IRQ_FS(x) | IRQ_FE(x) | IRQ_FE_ACK(x) | IRQ_LE(x) | IRQ_LE_ACK(x))
++#define IRQ_OVERFLOW		BIT(20)
++#define IRQ_DISCARD_OVERFLOW	BIT(21)
++#define IRQ_DISCARD_LEN_LIMIT	BIT(22)
++#define IRQ_DISCARD_UNMATCHED	BIT(23)
++#define IRQ_DISCARD_INACTIVE	BIT(24)
++
++/* CSI2_CTRL */
++#define EOP_IS_EOL		BIT(0)
++
++/* CSI2_CH_CTRL */
++#define DMA_EN			BIT(0)
++#define FORCE			BIT(3)
++#define AUTO_ARM		BIT(4)
++#define IRQ_EN_FS		BIT(13)
++#define IRQ_EN_FE		BIT(14)
++#define IRQ_EN_FE_ACK		BIT(15)
++#define IRQ_EN_LE		BIT(16)
++#define IRQ_EN_LE_ACK		BIT(17)
++#define FLUSH_FE		BIT(28)
++#define PACK_LINE		BIT(29)
++#define PACK_BYTES		BIT(30)
++#define CH_MODE_MASK		GENMASK(2, 1)
++#define VC_MASK			GENMASK(6, 5)
++#define DT_MASK			GENMASK(12, 7)
++#define LC_MASK			GENMASK(27, 18)
++
++/* CHx_COMPRESSION_CONTROL */
++#define COMP_OFFSET_MASK	GENMASK(15, 0)
++#define COMP_SHIFT_MASK		GENMASK(19, 16)
++#define COMP_MODE_MASK		GENMASK(25, 24)
++
++static inline u32 csi2_reg_read(struct csi2_device *csi2, u32 offset)
++{
++	return readl(csi2->base + offset);
++}
++
++static inline void csi2_reg_write(struct csi2_device *csi2, u32 offset, u32 val)
++{
++	writel(val, csi2->base + offset);
++	csi2_dbg_verbose("csi2: write 0x%04x -> 0x%03x\n", val, offset);
++}
++
++static inline void set_field(u32 *valp, u32 field, u32 mask)
++{
++	u32 val = *valp;
++
++	val &= ~mask;
++	val |= (field << __ffs(mask)) & mask;
++	*valp = val;
++}
++
++static int csi2_regs_show(struct seq_file *s, void *data)
++{
++	struct csi2_device *csi2 = s->private;
++	unsigned int i;
++	int ret;
++
++	ret = pm_runtime_resume_and_get(csi2->v4l2_dev->dev);
++	if (ret)
++		return ret;
++
++#define DUMP(reg) seq_printf(s, #reg " \t0x%08x\n", csi2_reg_read(csi2, reg))
++#define DUMP_CH(idx, reg) seq_printf(s, #reg "(%u) \t0x%08x\n", idx, csi2_reg_read(csi2, reg(idx)))
++
++	DUMP(CSI2_STATUS);
++	DUMP(CSI2_DISCARDS_OVERFLOW);
++	DUMP(CSI2_DISCARDS_INACTIVE);
++	DUMP(CSI2_DISCARDS_UNMATCHED);
++	DUMP(CSI2_DISCARDS_LEN_LIMIT);
++	DUMP(CSI2_LLEV_PANICS);
++	DUMP(CSI2_ULEV_PANICS);
++	DUMP(CSI2_IRQ_MASK);
++	DUMP(CSI2_CTRL);
++
++	for (i = 0; i < CSI2_NUM_CHANNELS; ++i) {
++		DUMP_CH(i, CSI2_CH_CTRL);
++		DUMP_CH(i, CSI2_CH_ADDR0);
++		DUMP_CH(i, CSI2_CH_ADDR1);
++		DUMP_CH(i, CSI2_CH_STRIDE);
++		DUMP_CH(i, CSI2_CH_LENGTH);
++		DUMP_CH(i, CSI2_CH_DEBUG);
++		DUMP_CH(i, CSI2_CH_FRAME_SIZE);
++		DUMP_CH(i, CSI2_CH_COMP_CTRL);
++		DUMP_CH(i, CSI2_CH_FE_FRAME_ID);
++	}
++
++#undef DUMP
++#undef DUMP_CH
++
++	pm_runtime_put(csi2->v4l2_dev->dev);
++
++	return 0;
++}
++
++DEFINE_SHOW_ATTRIBUTE(csi2_regs);
++
++static int csi2_errors_show(struct seq_file *s, void *data)
++{
++	struct csi2_device *csi2 = s->private;
++	unsigned long flags;
++	u32 discards_table[DISCARDS_TABLE_NUM_VCS][DISCARDS_TABLE_NUM_ENTRIES];
++	u32 discards_dt_table[DISCARDS_TABLE_NUM_ENTRIES];
++	u32 overflows;
++
++	spin_lock_irqsave(&csi2->errors_lock, flags);
++
++	memcpy(discards_table, csi2->discards_table, sizeof(discards_table));
++	memcpy(discards_dt_table, csi2->discards_dt_table,
++	       sizeof(discards_dt_table));
++	overflows = csi2->overflows;
++
++	csi2->overflows = 0;
++	memset(csi2->discards_table, 0, sizeof(discards_table));
++	memset(csi2->discards_dt_table, 0, sizeof(discards_dt_table));
++
++	spin_unlock_irqrestore(&csi2->errors_lock, flags);
++
++	seq_printf(s, "Overflows %u\n", overflows);
++	seq_puts(s, "Discards:\n");
++	seq_puts(s, "VC            OVLF        LEN  UNMATCHED   INACTIVE\n");
++
++	for (unsigned int vc = 0; vc < DISCARDS_TABLE_NUM_VCS; ++vc) {
++		seq_printf(s, "%u       %10u %10u %10u %10u\n", vc,
++			   discards_table[vc][DISCARDS_TABLE_OVERFLOW],
++			   discards_table[vc][DISCARDS_TABLE_LENGTH_LIMIT],
++			   discards_table[vc][DISCARDS_TABLE_UNMATCHED],
++			   discards_table[vc][DISCARDS_TABLE_INACTIVE]);
++	}
++
++	seq_printf(s, "Last DT %10u %10u %10u %10u\n",
++		   discards_dt_table[DISCARDS_TABLE_OVERFLOW],
++		   discards_dt_table[DISCARDS_TABLE_LENGTH_LIMIT],
++		   discards_dt_table[DISCARDS_TABLE_UNMATCHED],
++		   discards_dt_table[DISCARDS_TABLE_INACTIVE]);
++
++	return 0;
++}
++
++DEFINE_SHOW_ATTRIBUTE(csi2_errors);
++
++static void csi2_isr_handle_errors(struct csi2_device *csi2, u32 status)
++{
++	spin_lock(&csi2->errors_lock);
++
++	if (status & IRQ_OVERFLOW)
++		csi2->overflows++;
++
++	for (unsigned int i = 0; i < DISCARDS_TABLE_NUM_ENTRIES; ++i) {
++		static const u32 discard_bits[] = {
++			IRQ_DISCARD_OVERFLOW,
++			IRQ_DISCARD_LEN_LIMIT,
++			IRQ_DISCARD_UNMATCHED,
++			IRQ_DISCARD_INACTIVE,
++		};
++		static const u8 discard_regs[] = {
++			CSI2_DISCARDS_OVERFLOW,
++			CSI2_DISCARDS_LEN_LIMIT,
++			CSI2_DISCARDS_UNMATCHED,
++			CSI2_DISCARDS_INACTIVE,
++		};
++		u32 amount;
++		u8 dt, vc;
++		u32 v;
++
++		if (!(status & discard_bits[i]))
++			continue;
++
++		v = csi2_reg_read(csi2, discard_regs[i]);
++		csi2_reg_write(csi2, discard_regs[i], 0);
++
++		amount = (v & CSI2_DISCARDS_AMOUNT_MASK) >>
++			 CSI2_DISCARDS_AMOUNT_SHIFT;
++		dt = (v & CSI2_DISCARDS_DT_MASK) >> CSI2_DISCARDS_DT_SHIFT;
++		vc = (v & CSI2_DISCARDS_VC_MASK) >> CSI2_DISCARDS_VC_SHIFT;
++
++		csi2->discards_table[vc][i] += amount;
++		csi2->discards_dt_table[i] = dt;
++	}
++
++	spin_unlock(&csi2->errors_lock);
++}
++
++void csi2_isr(struct csi2_device *csi2, bool *sof, bool *eof)
++{
++	unsigned int i;
++	u32 status;
++
++	status = csi2_reg_read(csi2, CSI2_STATUS);
++	csi2_dbg_verbose("ISR: STA: 0x%x\n", status);
++
++	/* Write value back to clear the interrupts */
++	csi2_reg_write(csi2, CSI2_STATUS, status);
++
++	for (i = 0; i < CSI2_NUM_CHANNELS; i++) {
++		u32 dbg;
++
++		if ((status & IRQ_CH_MASK(i)) == 0)
++			continue;
++
++		dbg = csi2_reg_read(csi2, CSI2_CH_DEBUG(i));
++
++		csi2_dbg_verbose("ISR: [%u], %s%s%s%s%s frame: %u line: %u\n",
++				 i, (status & IRQ_FS(i)) ? "FS " : "",
++				 (status & IRQ_FE(i)) ? "FE " : "",
++				 (status & IRQ_FE_ACK(i)) ? "FE_ACK " : "",
++				 (status & IRQ_LE(i)) ? "LE " : "",
++				 (status & IRQ_LE_ACK(i)) ? "LE_ACK " : "",
++				 dbg >> 16,
++				 csi2->num_lines[i] ?
++					 ((dbg & 0xffff) % csi2->num_lines[i]) :
++					 0);
++
++		sof[i] = !!(status & IRQ_FS(i));
++		eof[i] = !!(status & IRQ_FE_ACK(i));
++	}
++
++	if (csi2_track_errors)
++		csi2_isr_handle_errors(csi2, status);
++}
++
++void csi2_set_buffer(struct csi2_device *csi2, unsigned int channel,
++		     dma_addr_t dmaaddr, unsigned int stride, unsigned int size)
++{
++	u64 addr = dmaaddr;
++	/*
++	 * ADDRESS0 must be written last as it triggers the double buffering
++	 * mechanism for all buffer registers within the hardware.
++	 */
++	addr >>= 4;
++	csi2_reg_write(csi2, CSI2_CH_LENGTH(channel), size >> 4);
++	csi2_reg_write(csi2, CSI2_CH_STRIDE(channel), stride >> 4);
++	csi2_reg_write(csi2, CSI2_CH_ADDR1(channel), addr >> 32);
++	csi2_reg_write(csi2, CSI2_CH_ADDR0(channel), addr & 0xffffffff);
++}
++
++void csi2_set_compression(struct csi2_device *csi2, unsigned int channel,
++			  enum csi2_compression_mode mode, unsigned int shift,
++			  unsigned int offset)
++{
++	u32 compression = 0;
++
++	set_field(&compression, COMP_OFFSET_MASK, offset);
++	set_field(&compression, COMP_SHIFT_MASK, shift);
++	set_field(&compression, COMP_MODE_MASK, mode);
++	csi2_reg_write(csi2, CSI2_CH_COMP_CTRL(channel), compression);
++}
++
++static int csi2_get_vc_dt_fallback(struct csi2_device *csi2,
++				   unsigned int channel, u8 *vc, u8 *dt)
++{
++	struct v4l2_subdev *sd = &csi2->sd;
++	struct v4l2_subdev_state *state;
++	struct v4l2_mbus_framefmt *fmt;
++	const struct cfe_fmt *cfe_fmt;
++
++	state = v4l2_subdev_get_locked_active_state(sd);
++
++	/* Without Streams API, the channel number matches the sink pad */
++	fmt = v4l2_subdev_state_get_format(state, channel);
++	if (!fmt)
++		return -EINVAL;
++
++	cfe_fmt = find_format_by_code(fmt->code);
++	if (!cfe_fmt)
++		return -EINVAL;
++
++	*vc = 0;
++	*dt = cfe_fmt->csi_dt;
++
++	return 0;
++}
++
++static int csi2_get_vc_dt(struct csi2_device *csi2, unsigned int channel,
++			  u8 *vc, u8 *dt)
++{
++	struct v4l2_mbus_frame_desc remote_desc;
++	const struct media_pad *remote_pad;
++	struct v4l2_subdev *source_sd;
++	int ret;
++
++	/* Without Streams API, the channel number matches the sink pad */
++	remote_pad = media_pad_remote_pad_first(&csi2->pad[channel]);
++	if (!remote_pad)
++		return -EPIPE;
++
++	source_sd = media_entity_to_v4l2_subdev(remote_pad->entity);
++
++	ret = v4l2_subdev_call(source_sd, pad, get_frame_desc,
++			       remote_pad->index, &remote_desc);
++	if (ret == -ENOIOCTLCMD) {
++		csi2_dbg("source does not support get_frame_desc, use fallback\n");
++		return csi2_get_vc_dt_fallback(csi2, channel, vc, dt);
++	} else if (ret) {
++		csi2_err("Failed to get frame descriptor\n");
++		return ret;
++	}
++
++	if (remote_desc.type != V4L2_MBUS_FRAME_DESC_TYPE_CSI2) {
++		csi2_err("Frame descriptor does not describe CSI-2 link");
++		return -EINVAL;
++	}
++
++	if (remote_desc.num_entries != 1) {
++		csi2_err("Frame descriptor does not have a single entry");
++		return -EINVAL;
++	}
++
++	*vc = remote_desc.entry[0].bus.csi2.vc;
++	*dt = remote_desc.entry[0].bus.csi2.dt;
++
++	return 0;
++}
++
++void csi2_start_channel(struct csi2_device *csi2, unsigned int channel,
++			enum csi2_mode mode, bool auto_arm,
++			bool pack_bytes, unsigned int width,
++			unsigned int height)
++{
++	u32 ctrl;
++	int ret;
++	u8 vc, dt;
++
++	ret = csi2_get_vc_dt(csi2, channel, &vc, &dt);
++	if (ret)
++		return;
++
++	csi2_dbg("%s [%u]\n", __func__, channel);
++
++	csi2_reg_write(csi2, CSI2_CH_CTRL(channel), 0);
++	csi2_reg_write(csi2, CSI2_CH_DEBUG(channel), 0);
++	csi2_reg_write(csi2, CSI2_STATUS, IRQ_CH_MASK(channel));
++
++	/* Enable channel and FS/FE interrupts. */
++	ctrl = DMA_EN | IRQ_EN_FS | IRQ_EN_FE_ACK | PACK_LINE;
++	/* PACK_BYTES ensures no striding for embedded data. */
++	if (pack_bytes)
++		ctrl |= PACK_BYTES;
++
++	if (auto_arm)
++		ctrl |= AUTO_ARM;
++
++	if (width && height) {
++		set_field(&ctrl, mode, CH_MODE_MASK);
++		csi2_reg_write(csi2, CSI2_CH_FRAME_SIZE(channel),
++			       (height << 16) | width);
++	} else {
++		set_field(&ctrl, 0x0, CH_MODE_MASK);
++		csi2_reg_write(csi2, CSI2_CH_FRAME_SIZE(channel), 0);
++	}
++
++	set_field(&ctrl, vc, VC_MASK);
++	set_field(&ctrl, dt, DT_MASK);
++	csi2_reg_write(csi2, CSI2_CH_CTRL(channel), ctrl);
++	csi2->num_lines[channel] = height;
++}
++
++void csi2_stop_channel(struct csi2_device *csi2, unsigned int channel)
++{
++	csi2_dbg("%s [%u]\n", __func__, channel);
++
++	/* Channel disable.  Use FORCE to allow stopping mid-frame. */
++	csi2_reg_write(csi2, CSI2_CH_CTRL(channel), FORCE);
++	/* Latch the above change by writing to the ADDR0 register. */
++	csi2_reg_write(csi2, CSI2_CH_ADDR0(channel), 0);
++	/* Write this again, the HW needs it! */
++	csi2_reg_write(csi2, CSI2_CH_ADDR0(channel), 0);
++}
++
++void csi2_open_rx(struct csi2_device *csi2)
++{
++	csi2_reg_write(csi2, CSI2_IRQ_MASK,
++		       csi2_track_errors ? CSI2_IRQ_MASK_IRQ_ALL : 0);
++
++	dphy_start(&csi2->dphy);
++
++	csi2_reg_write(csi2, CSI2_CTRL,
++		       csi2->multipacket_line ? 0 : EOP_IS_EOL);
++}
++
++void csi2_close_rx(struct csi2_device *csi2)
++{
++	dphy_stop(&csi2->dphy);
++
++	csi2_reg_write(csi2, CSI2_IRQ_MASK, 0);
++}
++
++static int csi2_init_cfg(struct v4l2_subdev *sd,
++			 struct v4l2_subdev_state *state)
++{
++	struct v4l2_mbus_framefmt *fmt;
++
++	for (unsigned int i = 0; i < CSI2_NUM_CHANNELS; ++i) {
++		const struct v4l2_mbus_framefmt *def_fmt;
++
++		/* CSI2_CH1_EMBEDDED */
++		if (i == 1)
++			def_fmt = &cfe_default_meta_format;
++		else
++			def_fmt = &cfe_default_format;
++
++		fmt = v4l2_subdev_state_get_format(state, i);
++		*fmt = *def_fmt;
++
++		fmt = v4l2_subdev_state_get_format(state, i + CSI2_NUM_CHANNELS);
++		*fmt = *def_fmt;
++	}
++
++	return 0;
++}
++
++static int csi2_pad_set_fmt(struct v4l2_subdev *sd,
++			    struct v4l2_subdev_state *state,
++			    struct v4l2_subdev_format *format)
++{
++	if (format->pad < CSI2_NUM_CHANNELS) {
++		/*
++		 * Store the sink pad format and propagate it to the source pad.
++		 */
++
++		struct v4l2_mbus_framefmt *fmt;
++
++		fmt = v4l2_subdev_state_get_format(state, format->pad);
++		if (!fmt)
++			return -EINVAL;
++
++		*fmt = format->format;
++
++		fmt = v4l2_subdev_state_get_format(state,
++			format->pad + CSI2_NUM_CHANNELS);
++		if (!fmt)
++			return -EINVAL;
++
++		format->format.field = V4L2_FIELD_NONE;
++
++		*fmt = format->format;
++	} else {
++		/*
++		 * Only allow changing the source pad mbus code.
++		 */
++
++		struct v4l2_mbus_framefmt *sink_fmt, *source_fmt;
++		u32 sink_code;
++		u32 code;
++
++		sink_fmt = v4l2_subdev_state_get_format(state,
++			format->pad - CSI2_NUM_CHANNELS);
++		if (!sink_fmt)
++			return -EINVAL;
++
++		source_fmt = v4l2_subdev_state_get_format(state, format->pad);
++		if (!source_fmt)
++			return -EINVAL;
++
++		sink_code = sink_fmt->code;
++		code = format->format.code;
++
++		/*
++		 * If the source code from the user does not match the code in
++		 * the sink pad, check that the source code matches either the
++		 * 16-bit version or the compressed version of the sink code.
++		 */
++
++		if (code != sink_code &&
++		    (code == cfe_find_16bit_code(sink_code) ||
++		     code == cfe_find_compressed_code(sink_code)))
++			source_fmt->code = code;
++
++		format->format.code = source_fmt->code;
++	}
++
++	return 0;
++}
++
++static const struct v4l2_subdev_internal_ops csi2_internal_ops = {
++	.init_state = csi2_init_cfg,
++};
++
++static const struct v4l2_subdev_pad_ops csi2_subdev_pad_ops = {
++	.get_fmt = v4l2_subdev_get_fmt,
++	.set_fmt = csi2_pad_set_fmt,
++	.link_validate = v4l2_subdev_link_validate_default,
++};
++
++static const struct media_entity_operations csi2_entity_ops = {
++	.link_validate = v4l2_subdev_link_validate,
++};
++
++static const struct v4l2_subdev_ops csi2_subdev_ops = {
++	.pad = &csi2_subdev_pad_ops,
++};
++
++int csi2_init(struct csi2_device *csi2, struct dentry *debugfs)
++{
++	unsigned int i, ret;
++
++	spin_lock_init(&csi2->errors_lock);
++
++	csi2->dphy.dev = csi2->v4l2_dev->dev;
++	dphy_probe(&csi2->dphy);
++
++	debugfs_create_file("csi2_regs", 0444, debugfs, csi2, &csi2_regs_fops);
++
++	if (csi2_track_errors)
++		debugfs_create_file("csi2_errors", 0444, debugfs, csi2,
++				    &csi2_errors_fops);
++
++	for (i = 0; i < CSI2_NUM_CHANNELS * 2; i++)
++		csi2->pad[i].flags = i < CSI2_NUM_CHANNELS ?
++				     MEDIA_PAD_FL_SINK : MEDIA_PAD_FL_SOURCE;
++
++	ret = media_entity_pads_init(&csi2->sd.entity, ARRAY_SIZE(csi2->pad),
++				     csi2->pad);
++	if (ret)
++		return ret;
++
++	/* Initialize subdev */
++	v4l2_subdev_init(&csi2->sd, &csi2_subdev_ops);
++	csi2->sd.internal_ops = &csi2_internal_ops;
++	csi2->sd.entity.function = MEDIA_ENT_F_VID_IF_BRIDGE;
++	csi2->sd.entity.ops = &csi2_entity_ops;
++	csi2->sd.flags = V4L2_SUBDEV_FL_HAS_DEVNODE;
++	csi2->sd.owner = THIS_MODULE;
++	snprintf(csi2->sd.name, sizeof(csi2->sd.name), "csi2");
++
++	ret = v4l2_subdev_init_finalize(&csi2->sd);
++	if (ret)
++		goto err_entity_cleanup;
++
++	ret = v4l2_device_register_subdev(csi2->v4l2_dev, &csi2->sd);
++	if (ret) {
++		csi2_err("Failed register csi2 subdev (%d)\n", ret);
++		goto err_subdev_cleanup;
++	}
++
++	return 0;
++
++err_subdev_cleanup:
++	v4l2_subdev_cleanup(&csi2->sd);
++err_entity_cleanup:
++	media_entity_cleanup(&csi2->sd.entity);
++
++	return ret;
++}
++
++void csi2_uninit(struct csi2_device *csi2)
++{
++	v4l2_device_unregister_subdev(&csi2->sd);
++	v4l2_subdev_cleanup(&csi2->sd);
++	media_entity_cleanup(&csi2->sd.entity);
++}
+--- /dev/null
++++ b/drivers/media/platform/raspberrypi/rp1_cfe/csi2.h
+@@ -0,0 +1,90 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * RP1 CSI-2 driver.
++ * Copyright (c) 2021 Raspberry Pi Ltd.
++ *
++ */
++#ifndef _RP1_CSI2_
++#define _RP1_CSI2_
++
++#include <linux/debugfs.h>
++#include <linux/io.h>
++#include <linux/types.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-subdev.h>
++
++#include "dphy.h"
++
++#define CSI2_NUM_CHANNELS 4
++
++#define DISCARDS_TABLE_NUM_VCS 4
++
++enum csi2_mode {
++	CSI2_MODE_NORMAL = 0,
++	CSI2_MODE_REMAP = 1,
++	CSI2_MODE_COMPRESSED = 2,
++	CSI2_MODE_FE_STREAMING = 3,
++};
++
++enum csi2_compression_mode {
++	CSI2_COMPRESSION_DELTA = 1,
++	CSI2_COMPRESSION_SIMPLE = 2,
++	CSI2_COMPRESSION_COMBINED = 3,
++};
++
++struct csi2_cfg {
++	u16 width;
++	u16 height;
++	u32 stride;
++	u32 buffer_size;
++};
++
++enum discards_table_index {
++	DISCARDS_TABLE_OVERFLOW = 0,
++	DISCARDS_TABLE_LENGTH_LIMIT,
++	DISCARDS_TABLE_UNMATCHED,
++	DISCARDS_TABLE_INACTIVE,
++	DISCARDS_TABLE_NUM_ENTRIES,
++};
++
++struct csi2_device {
++	/* Parent V4l2 device */
++	struct v4l2_device *v4l2_dev;
++
++	void __iomem *base;
++
++	struct dphy_data dphy;
++
++	enum v4l2_mbus_type bus_type;
++	unsigned int bus_flags;
++	bool multipacket_line;
++	unsigned int num_lines[CSI2_NUM_CHANNELS];
++
++	struct media_pad pad[CSI2_NUM_CHANNELS * 2];
++	struct v4l2_subdev sd;
++
++	/* lock for csi2 errors counters */
++	spinlock_t errors_lock;
++	u32 overflows;
++	u32 discards_table[DISCARDS_TABLE_NUM_VCS][DISCARDS_TABLE_NUM_ENTRIES];
++	u32 discards_dt_table[DISCARDS_TABLE_NUM_ENTRIES];
++};
++
++void csi2_isr(struct csi2_device *csi2, bool *sof, bool *eof);
++void csi2_set_buffer(struct csi2_device *csi2, unsigned int channel,
++		     dma_addr_t dmaaddr, unsigned int stride,
++		     unsigned int size);
++void csi2_set_compression(struct csi2_device *csi2, unsigned int channel,
++			  enum csi2_compression_mode mode, unsigned int shift,
++			  unsigned int offset);
++void csi2_start_channel(struct csi2_device *csi2, unsigned int channel,
++			enum csi2_mode mode, bool auto_arm,
++			bool pack_bytes, unsigned int width,
++			unsigned int height);
++void csi2_stop_channel(struct csi2_device *csi2, unsigned int channel);
++void csi2_open_rx(struct csi2_device *csi2);
++void csi2_close_rx(struct csi2_device *csi2);
++int csi2_init(struct csi2_device *csi2, struct dentry *debugfs);
++void csi2_uninit(struct csi2_device *csi2);
++
++#endif
+--- /dev/null
++++ b/drivers/media/platform/raspberrypi/rp1_cfe/dphy.c
+@@ -0,0 +1,177 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * RP1 CSI-2 Driver
++ *
++ * Copyright (C) 2021 - Raspberry Pi Ltd.
++ *
++ */
++
++#include <linux/delay.h>
++#include <linux/dev_printk.h>
++#include <linux/pm_runtime.h>
++
++#include "dphy.h"
++
++#define dphy_dbg(fmt, arg...) dev_dbg(dphy->dev, fmt, ##arg)
++#define dphy_info(fmt, arg...) dev_info(dphy->dev, fmt, ##arg)
++#define dphy_err(fmt, arg...) dev_err(dphy->dev, fmt, ##arg)
++
++/* DW dphy Host registers */
++#define VERSION		0x000
++#define N_LANES		0x004
++#define RESETN		0x008
++#define PHY_SHUTDOWNZ	0x040
++#define PHY_RSTZ	0x044
++#define PHY_RX		0x048
++#define	PHY_STOPSTATE	0x04c
++#define PHY_TST_CTRL0	0x050
++#define PHY_TST_CTRL1	0x054
++#define PHY2_TST_CTRL0	0x058
++#define PHY2_TST_CTRL1	0x05c
++
++/* DW dphy Host Transactions */
++#define DPHY_HS_RX_CTRL_LANE0_OFFSET	0x44
++#define DPHY_PLL_INPUT_DIV_OFFSET	0x17
++#define DPHY_PLL_LOOP_DIV_OFFSET	0x18
++#define DPHY_PLL_DIV_CTRL_OFFSET	0x19
++
++static u32 dw_csi2_host_read(struct dphy_data *dphy, u32 offset)
++{
++	return readl(dphy->base + offset);
++}
++
++static void dw_csi2_host_write(struct dphy_data *dphy, u32 offset, u32 data)
++{
++	writel(data, dphy->base + offset);
++}
++
++static void set_tstclr(struct dphy_data *dphy, u32 val)
++{
++	u32 ctrl0 = dw_csi2_host_read(dphy, PHY_TST_CTRL0);
++
++	dw_csi2_host_write(dphy, PHY_TST_CTRL0, (ctrl0 & ~1) | val);
++}
++
++static void set_tstclk(struct dphy_data *dphy, u32 val)
++{
++	u32 ctrl0 = dw_csi2_host_read(dphy, PHY_TST_CTRL0);
++
++	dw_csi2_host_write(dphy, PHY_TST_CTRL0, (ctrl0 & ~2) | (val << 1));
++}
++
++static uint8_t get_tstdout(struct dphy_data *dphy)
++{
++	u32 ctrl1 = dw_csi2_host_read(dphy, PHY_TST_CTRL1);
++
++	return ((ctrl1 >> 8) & 0xff);
++}
++
++static void set_testen(struct dphy_data *dphy, u32 val)
++{
++	u32 ctrl1 = dw_csi2_host_read(dphy, PHY_TST_CTRL1);
++
++	dw_csi2_host_write(dphy, PHY_TST_CTRL1,
++			   (ctrl1 & ~(1 << 16)) | (val << 16));
++}
++
++static void set_testdin(struct dphy_data *dphy, u32 val)
++{
++	u32 ctrl1 = dw_csi2_host_read(dphy, PHY_TST_CTRL1);
++
++	dw_csi2_host_write(dphy, PHY_TST_CTRL1, (ctrl1 & ~0xff) | val);
++}
++
++static uint8_t dphy_transaction(struct dphy_data *dphy, u8 test_code,
++				uint8_t test_data)
++{
++	/* See page 101 of the MIPI DPHY databook. */
++	set_tstclk(dphy, 1);
++	set_testen(dphy, 0);
++	set_testdin(dphy, test_code);
++	set_testen(dphy, 1);
++	set_tstclk(dphy, 0);
++	set_testen(dphy, 0);
++	set_testdin(dphy, test_data);
++	set_tstclk(dphy, 1);
++	return get_tstdout(dphy);
++}
++
++static void dphy_set_hsfreqrange(struct dphy_data *dphy, uint32_t mbps)
++{
++	/* See Table 5-1 on page 65 of dphy databook */
++	static const u16 hsfreqrange_table[][2] = {
++		{ 89, 0b000000 },   { 99, 0b010000 },	{ 109, 0b100000 },
++		{ 129, 0b000001 },  { 139, 0b010001 },	{ 149, 0b100001 },
++		{ 169, 0b000010 },  { 179, 0b010010 },	{ 199, 0b100010 },
++		{ 219, 0b000011 },  { 239, 0b010011 },	{ 249, 0b100011 },
++		{ 269, 0b000100 },  { 299, 0b010100 },	{ 329, 0b000101 },
++		{ 359, 0b010101 },  { 399, 0b100101 },	{ 449, 0b000110 },
++		{ 499, 0b010110 },  { 549, 0b000111 },	{ 599, 0b010111 },
++		{ 649, 0b001000 },  { 699, 0b011000 },	{ 749, 0b001001 },
++		{ 799, 0b011001 },  { 849, 0b101001 },	{ 899, 0b111001 },
++		{ 949, 0b001010 },  { 999, 0b011010 },	{ 1049, 0b101010 },
++		{ 1099, 0b111010 }, { 1149, 0b001011 }, { 1199, 0b011011 },
++		{ 1249, 0b101011 }, { 1299, 0b111011 }, { 1349, 0b001100 },
++		{ 1399, 0b011100 }, { 1449, 0b101100 }, { 1500, 0b111100 },
++	};
++	unsigned int i;
++
++	if (mbps < 80 || mbps > 1500)
++		dphy_err("DPHY: Datarate %u Mbps out of range\n", mbps);
++
++	for (i = 0; i < ARRAY_SIZE(hsfreqrange_table) - 1; i++) {
++		if (mbps <= hsfreqrange_table[i][0])
++			break;
++	}
++
++	dphy_transaction(dphy, DPHY_HS_RX_CTRL_LANE0_OFFSET,
++			 hsfreqrange_table[i][1] << 1);
++}
++
++static void dphy_init(struct dphy_data *dphy)
++{
++	dw_csi2_host_write(dphy, PHY_RSTZ, 0);
++	dw_csi2_host_write(dphy, PHY_SHUTDOWNZ, 0);
++	set_tstclk(dphy, 1);
++	set_testen(dphy, 0);
++	set_tstclr(dphy, 1);
++	usleep_range(15, 20);
++	set_tstclr(dphy, 0);
++	usleep_range(15, 20);
++
++	dphy_set_hsfreqrange(dphy, dphy->dphy_rate);
++
++	usleep_range(5, 10);
++	dw_csi2_host_write(dphy, PHY_SHUTDOWNZ, 1);
++	usleep_range(5, 10);
++	dw_csi2_host_write(dphy, PHY_RSTZ, 1);
++}
++
++void dphy_start(struct dphy_data *dphy)
++{
++	dw_csi2_host_write(dphy, N_LANES, (dphy->active_lanes - 1));
++	dphy_init(dphy);
++	dw_csi2_host_write(dphy, RESETN, 0xffffffff);
++	usleep_range(10, 50);
++}
++
++void dphy_stop(struct dphy_data *dphy)
++{
++	/* Set only one lane (lane 0) as active (ON) */
++	dw_csi2_host_write(dphy, N_LANES, 0);
++	dw_csi2_host_write(dphy, RESETN, 0);
++}
++
++void dphy_probe(struct dphy_data *dphy)
++{
++	u32 host_ver;
++	u8 host_ver_major, host_ver_minor;
++
++	host_ver = dw_csi2_host_read(dphy, VERSION);
++	host_ver_major = (u8)((host_ver >> 24) - '0');
++	host_ver_minor = (u8)((host_ver >> 16) - '0');
++	host_ver_minor = host_ver_minor * 10;
++	host_ver_minor += (u8)((host_ver >> 8) - '0');
++
++	dphy_info("DW dphy Host HW v%u.%u\n", host_ver_major, host_ver_minor);
++}
+--- /dev/null
++++ b/drivers/media/platform/raspberrypi/rp1_cfe/dphy.h
+@@ -0,0 +1,27 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * Copyright (c) 2021 Raspberry Pi Ltd.
++ *
++ */
++
++#ifndef _RP1_DPHY_
++#define _RP1_DPHY_
++
++#include <linux/io.h>
++#include <linux/types.h>
++
++struct dphy_data {
++	struct device *dev;
++
++	void __iomem *base;
++
++	u32 dphy_rate;
++	u32 max_lanes;
++	u32 active_lanes;
++};
++
++void dphy_probe(struct dphy_data *dphy);
++void dphy_start(struct dphy_data *dphy);
++void dphy_stop(struct dphy_data *dphy);
++
++#endif
+--- /dev/null
++++ b/drivers/media/platform/raspberrypi/rp1_cfe/pisp_common.h
+@@ -0,0 +1,69 @@
++/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
++/*
++ * RP1 PiSP common definitions.
++ *
++ * Copyright (C) 2021 - Raspberry Pi Ltd.
++ *
++ */
++#ifndef _PISP_COMMON_H_
++#define _PISP_COMMON_H_
++
++#include "pisp_types.h"
++
++struct pisp_bla_config {
++	u16 black_level_r;
++	u16 black_level_gr;
++	u16 black_level_gb;
++	u16 black_level_b;
++	u16 output_black_level;
++	u8 pad[2];
++};
++
++struct pisp_wbg_config {
++	u16 gain_r;
++	u16 gain_g;
++	u16 gain_b;
++	u8 pad[2];
++};
++
++struct pisp_compress_config {
++	/* value subtracted from incoming data */
++	u16 offset;
++	u8 pad;
++	/* 1 => Companding; 2 => Delta (recommended); 3 => Combined (for HDR) */
++	u8 mode;
++};
++
++struct pisp_decompress_config {
++	/* value added to reconstructed data */
++	u16 offset;
++	u8 pad;
++	/* 1 => Companding; 2 => Delta (recommended); 3 => Combined (for HDR) */
++	u8 mode;
++};
++
++enum pisp_axi_flags {
++	/*
++	 * round down bursts to end at a 32-byte boundary, to align following
++	 * bursts
++	 */
++	PISP_AXI_FLAG_ALIGN = 128,
++	/* for FE writer: force WSTRB high, to pad output to 16-byte boundary */
++	PISP_AXI_FLAG_PAD = 64,
++	/* for FE writer: Use Output FIFO level to trigger "panic" */
++	PISP_AXI_FLAG_PANIC = 32,
++};
++
++struct pisp_axi_config {
++	/*
++	 * burst length minus one, which must be in the range 0:15; OR'd with
++	 * flags
++	 */
++	u8 maxlen_flags;
++	/* { prot[2:0], cache[3:0] } fields, echoed on AXI bus */
++	u8 cache_prot;
++	/* QoS field(s) (4x4 bits for FE writer; 4 bits for other masters) */
++	u16 qos;
++};
++
++#endif /* _PISP_COMMON_H_ */
+--- /dev/null
++++ b/drivers/media/platform/raspberrypi/rp1_cfe/pisp_fe.c
+@@ -0,0 +1,569 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * PiSP Front End driver.
++ * Copyright (c) 2021 Raspberry Pi Ltd.
++ *
++ */
++
++#include <linux/bitops.h>
++#include <linux/delay.h>
++#include <linux/moduleparam.h>
++#include <linux/pm_runtime.h>
++#include <linux/seq_file.h>
++
++#include <media/videobuf2-dma-contig.h>
++
++#include "pisp_fe.h"
++#include "cfe.h"
++
++#define FE_VERSION		0x000
++#define FE_CONTROL		0x004
++#define FE_STATUS		0x008
++#define FE_FRAME_STATUS		0x00c
++#define FE_ERROR_STATUS		0x010
++#define FE_OUTPUT_STATUS	0x014
++#define FE_INT_EN		0x018
++#define FE_INT_STATUS		0x01c
++
++/* CONTROL */
++#define FE_CONTROL_QUEUE	BIT(0)
++#define FE_CONTROL_ABORT	BIT(1)
++#define FE_CONTROL_RESET	BIT(2)
++#define FE_CONTROL_LATCH_REGS	BIT(3)
++
++/* INT_EN / INT_STATUS */
++#define FE_INT_EOF		BIT(0)
++#define FE_INT_SOF		BIT(1)
++#define FE_INT_LINES0		BIT(8)
++#define FE_INT_LINES1		BIT(9)
++#define FE_INT_STATS		BIT(16)
++#define FE_INT_QREADY		BIT(24)
++
++/* STATUS */
++#define FE_STATUS_QUEUED	BIT(0)
++#define FE_STATUS_WAITING	BIT(1)
++#define FE_STATUS_ACTIVE	BIT(2)
++
++#define PISP_FE_CONFIG_BASE_OFFSET	0x0040
++
++#define PISP_FE_ENABLE_STATS_CLUSTER \
++	(PISP_FE_ENABLE_STATS_CROP | PISP_FE_ENABLE_DECIMATE    | \
++	 PISP_FE_ENABLE_BLC        | PISP_FE_ENABLE_CDAF_STATS  | \
++	 PISP_FE_ENABLE_AWB_STATS  | PISP_FE_ENABLE_RGBY        | \
++	 PISP_FE_ENABLE_LSC        | PISP_FE_ENABLE_AGC_STATS)
++
++#define PISP_FE_ENABLE_OUTPUT_CLUSTER(i)				\
++	((PISP_FE_ENABLE_CROP0     | PISP_FE_ENABLE_DOWNSCALE0 |	\
++	  PISP_FE_ENABLE_COMPRESS0 | PISP_FE_ENABLE_OUTPUT0) << (4 * (i)))
++
++struct pisp_fe_config_param {
++	u32 dirty_flags;
++	u32 dirty_flags_extra;
++	size_t offset;
++	size_t size;
++};
++
++static const struct pisp_fe_config_param pisp_fe_config_map[] = {
++	/* *_dirty_flag_extra types */
++	{ 0, PISP_FE_DIRTY_GLOBAL,     offsetof(struct pisp_fe_config, global),
++					sizeof(struct pisp_fe_global_config)         },
++	{ 0, PISP_FE_DIRTY_FLOATING,   offsetof(struct pisp_fe_config, floating_stats),
++					sizeof(struct pisp_fe_floating_stats_config) },
++	{ 0, PISP_FE_DIRTY_OUTPUT_AXI, offsetof(struct pisp_fe_config, output_axi),
++					sizeof(struct pisp_fe_output_axi_config)     },
++	/* *_dirty_flag types */
++	{ PISP_FE_ENABLE_INPUT,      0, offsetof(struct pisp_fe_config, input),
++					sizeof(struct pisp_fe_input_config)          },
++	{ PISP_FE_ENABLE_DECOMPRESS, 0, offsetof(struct pisp_fe_config, decompress),
++					sizeof(struct pisp_decompress_config)        },
++	{ PISP_FE_ENABLE_DECOMPAND,  0, offsetof(struct pisp_fe_config, decompand),
++					sizeof(struct pisp_fe_decompand_config)      },
++	{ PISP_FE_ENABLE_BLA,        0, offsetof(struct pisp_fe_config, bla),
++					sizeof(struct pisp_bla_config)               },
++	{ PISP_FE_ENABLE_DPC,        0, offsetof(struct pisp_fe_config, dpc),
++					sizeof(struct pisp_fe_dpc_config)            },
++	{ PISP_FE_ENABLE_STATS_CROP, 0, offsetof(struct pisp_fe_config, stats_crop),
++					sizeof(struct pisp_fe_crop_config)           },
++	{ PISP_FE_ENABLE_BLC,	     0, offsetof(struct pisp_fe_config, blc),
++					sizeof(struct pisp_bla_config)               },
++	{ PISP_FE_ENABLE_CDAF_STATS, 0, offsetof(struct pisp_fe_config, cdaf_stats),
++					sizeof(struct pisp_fe_cdaf_stats_config)     },
++	{ PISP_FE_ENABLE_AWB_STATS,  0, offsetof(struct pisp_fe_config, awb_stats),
++					sizeof(struct pisp_fe_awb_stats_config)      },
++	{ PISP_FE_ENABLE_RGBY,       0, offsetof(struct pisp_fe_config, rgby),
++					sizeof(struct pisp_fe_rgby_config)           },
++	{ PISP_FE_ENABLE_LSC,        0, offsetof(struct pisp_fe_config, lsc),
++					sizeof(struct pisp_fe_lsc_config)            },
++	{ PISP_FE_ENABLE_AGC_STATS,  0, offsetof(struct pisp_fe_config, agc_stats),
++					sizeof(struct pisp_agc_statistics)           },
++	{ PISP_FE_ENABLE_CROP0,      0, offsetof(struct pisp_fe_config, ch[0].crop),
++					sizeof(struct pisp_fe_crop_config)           },
++	{ PISP_FE_ENABLE_DOWNSCALE0, 0, offsetof(struct pisp_fe_config, ch[0].downscale),
++					sizeof(struct pisp_fe_downscale_config)      },
++	{ PISP_FE_ENABLE_COMPRESS0,  0, offsetof(struct pisp_fe_config, ch[0].compress),
++					sizeof(struct pisp_compress_config)          },
++	{ PISP_FE_ENABLE_OUTPUT0,    0, offsetof(struct pisp_fe_config, ch[0].output),
++					sizeof(struct pisp_fe_output_config)         },
++	{ PISP_FE_ENABLE_CROP1,      0, offsetof(struct pisp_fe_config, ch[1].crop),
++					sizeof(struct pisp_fe_crop_config)           },
++	{ PISP_FE_ENABLE_DOWNSCALE1, 0, offsetof(struct pisp_fe_config, ch[1].downscale),
++					sizeof(struct pisp_fe_downscale_config)      },
++	{ PISP_FE_ENABLE_COMPRESS1,  0, offsetof(struct pisp_fe_config, ch[1].compress),
++					sizeof(struct pisp_compress_config)          },
++	{ PISP_FE_ENABLE_OUTPUT1,    0, offsetof(struct pisp_fe_config, ch[1].output),
++					sizeof(struct pisp_fe_output_config)         },
++};
++
++#define pisp_fe_dbg_verbose(fmt, arg...)                        \
++	do {                                                    \
++		if (cfe_debug_verbose)                          \
++			dev_dbg(fe->v4l2_dev->dev, fmt, ##arg); \
++	} while (0)
++#define pisp_fe_dbg(fmt, arg...) dev_dbg(fe->v4l2_dev->dev, fmt, ##arg)
++#define pisp_fe_info(fmt, arg...) dev_info(fe->v4l2_dev->dev, fmt, ##arg)
++#define pisp_fe_err(fmt, arg...) dev_err(fe->v4l2_dev->dev, fmt, ##arg)
++
++static inline u32 pisp_fe_reg_read(struct pisp_fe_device *fe, u32 offset)
++{
++	return readl(fe->base + offset);
++}
++
++static inline void pisp_fe_reg_write(struct pisp_fe_device *fe, u32 offset,
++				     u32 val)
++{
++	writel(val, fe->base + offset);
++	pisp_fe_dbg_verbose("fe: write 0x%04x -> 0x%03x\n", val, offset);
++}
++
++static inline void pisp_fe_reg_write_relaxed(struct pisp_fe_device *fe, u32 offset,
++					     u32 val)
++{
++	writel_relaxed(val, fe->base + offset);
++	pisp_fe_dbg_verbose("fe: write 0x%04x -> 0x%03x\n", val, offset);
++}
++
++static int pisp_regs_show(struct seq_file *s, void *data)
++{
++	struct pisp_fe_device *fe = s->private;
++	int ret;
++
++	ret = pm_runtime_resume_and_get(fe->v4l2_dev->dev);
++	if (ret)
++		return ret;
++
++	pisp_fe_reg_write(fe, FE_CONTROL, FE_CONTROL_LATCH_REGS);
++
++#define DUMP(reg) seq_printf(s, #reg " \t0x%08x\n", pisp_fe_reg_read(fe, reg))
++	DUMP(FE_VERSION);
++	DUMP(FE_CONTROL);
++	DUMP(FE_STATUS);
++	DUMP(FE_FRAME_STATUS);
++	DUMP(FE_ERROR_STATUS);
++	DUMP(FE_OUTPUT_STATUS);
++	DUMP(FE_INT_EN);
++	DUMP(FE_INT_STATUS);
++#undef DUMP
++
++	pm_runtime_put(fe->v4l2_dev->dev);
++
++	return 0;
++}
++
++DEFINE_SHOW_ATTRIBUTE(pisp_regs);
++
++static void pisp_config_write(struct pisp_fe_device *fe,
++			      struct pisp_fe_config *config,
++			      unsigned int start_offset,
++			      unsigned int size)
++{
++	const unsigned int max_offset =
++		offsetof(struct pisp_fe_config, ch[PISP_FE_NUM_OUTPUTS]);
++	unsigned int i, end_offset;
++	u32 *cfg = (u32 *)config;
++
++	start_offset = min(start_offset, max_offset);
++	end_offset = min(start_offset + size, max_offset);
++
++	cfg += start_offset >> 2;
++	for (i = start_offset; i < end_offset; i += 4, cfg++)
++		pisp_fe_reg_write_relaxed(fe, PISP_FE_CONFIG_BASE_OFFSET + i,
++					  *cfg);
++}
++
++void pisp_fe_isr(struct pisp_fe_device *fe, bool *sof, bool *eof)
++{
++	u32 status, int_status, out_status, frame_status, error_status;
++	unsigned int i;
++
++	pisp_fe_reg_write(fe, FE_CONTROL, FE_CONTROL_LATCH_REGS);
++	status = pisp_fe_reg_read(fe, FE_STATUS);
++	out_status = pisp_fe_reg_read(fe, FE_OUTPUT_STATUS);
++	frame_status = pisp_fe_reg_read(fe, FE_FRAME_STATUS);
++	error_status = pisp_fe_reg_read(fe, FE_ERROR_STATUS);
++
++	int_status = pisp_fe_reg_read(fe, FE_INT_STATUS);
++	pisp_fe_reg_write(fe, FE_INT_STATUS, int_status);
++
++	pisp_fe_dbg_verbose("%s: status 0x%x out 0x%x frame 0x%x error 0x%x int 0x%x\n",
++		__func__, status, out_status, frame_status, error_status,
++		int_status);
++
++	/* We do not report interrupts for the input/stream pad. */
++	for (i = 0; i < FE_NUM_PADS - 1; i++) {
++		sof[i] = !!(int_status & FE_INT_SOF);
++		eof[i] = !!(int_status & FE_INT_EOF);
++	}
++}
++
++static bool pisp_fe_validate_output(struct pisp_fe_config const *cfg,
++				    unsigned int c, struct v4l2_format const *f)
++{
++	unsigned int wbytes;
++
++	wbytes = cfg->ch[c].output.format.width;
++	if (cfg->ch[c].output.format.format & PISP_IMAGE_FORMAT_BPS_MASK)
++		wbytes *= 2;
++
++	/* Check output image dimensions are nonzero and not too big */
++	if (cfg->ch[c].output.format.width < 2 ||
++	    cfg->ch[c].output.format.height < 2 ||
++	    cfg->ch[c].output.format.height > f->fmt.pix.height ||
++	    cfg->ch[c].output.format.stride > f->fmt.pix.bytesperline ||
++	    wbytes > f->fmt.pix.bytesperline)
++		return false;
++
++	/* Check for zero-sized crops, which could cause lockup */
++	if ((cfg->global.enables & PISP_FE_ENABLE_CROP(c)) &&
++	    ((cfg->ch[c].crop.offset_x >= (cfg->input.format.width & ~1) ||
++	      cfg->ch[c].crop.offset_y >= cfg->input.format.height ||
++	      cfg->ch[c].crop.width < 2 ||
++	      cfg->ch[c].crop.height < 2)))
++		return false;
++
++	if ((cfg->global.enables & PISP_FE_ENABLE_DOWNSCALE(c)) &&
++	    (cfg->ch[c].downscale.output_width < 2 ||
++	     cfg->ch[c].downscale.output_height < 2))
++		return false;
++
++	return true;
++}
++
++static bool pisp_fe_validate_stats(struct pisp_fe_config const *cfg)
++{
++	/* Check for zero-sized crop, which could cause lockup */
++	return (!(cfg->global.enables & PISP_FE_ENABLE_STATS_CROP) ||
++		(cfg->stats_crop.offset_x < (cfg->input.format.width & ~1) &&
++		 cfg->stats_crop.offset_y < cfg->input.format.height &&
++		 cfg->stats_crop.width >= 2 &&
++		 cfg->stats_crop.height >= 2));
++}
++
++int pisp_fe_validate_config(struct pisp_fe_device *fe,
++			    struct pisp_fe_config *cfg,
++			    struct v4l2_format const *f0,
++			    struct v4l2_format const *f1)
++{
++	unsigned int i;
++
++	/*
++	 * Check the input is enabled, streaming and has nonzero size;
++	 * to avoid cases where the hardware might lock up or try to
++	 * read inputs from memory (which this driver doesn't support).
++	 */
++	if (!(cfg->global.enables & PISP_FE_ENABLE_INPUT) ||
++	    cfg->input.streaming != 1 || cfg->input.format.width < 2 ||
++	    cfg->input.format.height < 2) {
++		pisp_fe_err("%s: Input config not valid", __func__);
++		return -EINVAL;
++	}
++
++	for (i = 0; i < PISP_FE_NUM_OUTPUTS; i++) {
++		if (!(cfg->global.enables & PISP_FE_ENABLE_OUTPUT(i))) {
++			if (cfg->global.enables &
++					PISP_FE_ENABLE_OUTPUT_CLUSTER(i)) {
++				pisp_fe_err("%s: Output %u not valid",
++					    __func__, i);
++				return -EINVAL;
++			}
++			continue;
++		}
++
++		if (!pisp_fe_validate_output(cfg, i, i ? f1 : f0))
++			return -EINVAL;
++	}
++
++	if ((cfg->global.enables & PISP_FE_ENABLE_STATS_CLUSTER) &&
++	    !pisp_fe_validate_stats(cfg)) {
++		pisp_fe_err("%s: Stats config not valid", __func__);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++void pisp_fe_submit_job(struct pisp_fe_device *fe, struct vb2_buffer **vb2_bufs,
++			struct pisp_fe_config *cfg)
++{
++	unsigned int i;
++	u64 addr;
++	u32 status;
++
++	/*
++	 * Check output buffers exist and outputs are correctly configured.
++	 * If valid, set the buffer's DMA address; otherwise disable.
++	 */
++	for (i = 0; i < PISP_FE_NUM_OUTPUTS; i++) {
++		struct vb2_buffer *buf = vb2_bufs[FE_OUTPUT0_PAD + i];
++
++		if (!(cfg->global.enables & PISP_FE_ENABLE_OUTPUT(i)))
++			continue;
++
++		addr = vb2_dma_contig_plane_dma_addr(buf, 0);
++		cfg->output_buffer[i].addr_lo = addr & 0xffffffff;
++		cfg->output_buffer[i].addr_hi = addr >> 32;
++	}
++
++	if (vb2_bufs[FE_STATS_PAD]) {
++		addr = vb2_dma_contig_plane_dma_addr(vb2_bufs[FE_STATS_PAD], 0);
++		cfg->stats_buffer.addr_lo = addr & 0xffffffff;
++		cfg->stats_buffer.addr_hi = addr >> 32;
++	}
++
++	/* Set up ILINES interrupts 3/4 of the way down each output */
++	cfg->ch[0].output.ilines =
++		max(0x80u, (3u * cfg->ch[0].output.format.height) >> 2);
++	cfg->ch[1].output.ilines =
++		max(0x80u, (3u * cfg->ch[1].output.format.height) >> 2);
++
++	/*
++	 * The hardware must have consumed the previous config by now.
++	 * This read of status also serves as a memory barrier before the
++	 * sequence of relaxed writes which follow.
++	 */
++	status = pisp_fe_reg_read(fe, FE_STATUS);
++	pisp_fe_dbg_verbose("%s: status = 0x%x\n", __func__, status);
++	if (WARN_ON(status & FE_STATUS_QUEUED))
++		return;
++
++	/*
++	 * Unconditionally write buffers, global and input parameters.
++	 * Write cropping and output parameters whenever they are enabled.
++	 * Selectively write other parameters that have been marked as
++	 * changed through the dirty flags.
++	 */
++	pisp_config_write(fe, cfg, 0,
++			  offsetof(struct pisp_fe_config, decompress));
++	cfg->dirty_flags_extra &= ~PISP_FE_DIRTY_GLOBAL;
++	cfg->dirty_flags &= ~PISP_FE_ENABLE_INPUT;
++	cfg->dirty_flags |= (cfg->global.enables &
++			     (PISP_FE_ENABLE_STATS_CROP        |
++			      PISP_FE_ENABLE_OUTPUT_CLUSTER(0) |
++			      PISP_FE_ENABLE_OUTPUT_CLUSTER(1)));
++	for (i = 0; i < ARRAY_SIZE(pisp_fe_config_map); i++) {
++		const struct pisp_fe_config_param *p = &pisp_fe_config_map[i];
++
++		if (cfg->dirty_flags & p->dirty_flags ||
++		    cfg->dirty_flags_extra & p->dirty_flags_extra)
++			pisp_config_write(fe, cfg, p->offset, p->size);
++	}
++
++	/* This final non-relaxed write serves as a memory barrier */
++	pisp_fe_reg_write(fe, FE_CONTROL, FE_CONTROL_QUEUE);
++}
++
++void pisp_fe_start(struct pisp_fe_device *fe)
++{
++	pisp_fe_reg_write(fe, FE_CONTROL, FE_CONTROL_RESET);
++	pisp_fe_reg_write(fe, FE_INT_STATUS, ~0);
++	pisp_fe_reg_write(fe, FE_INT_EN, FE_INT_EOF | FE_INT_SOF | FE_INT_LINES0 | FE_INT_LINES1);
++	fe->inframe_count = 0;
++}
++
++void pisp_fe_stop(struct pisp_fe_device *fe)
++{
++	pisp_fe_reg_write(fe, FE_INT_EN, 0);
++	pisp_fe_reg_write(fe, FE_CONTROL, FE_CONTROL_ABORT);
++	usleep_range(1000, 2000);
++	WARN_ON(pisp_fe_reg_read(fe, FE_STATUS));
++	pisp_fe_reg_write(fe, FE_INT_STATUS, ~0);
++}
++
++static int pisp_fe_init_cfg(struct v4l2_subdev *sd,
++			    struct v4l2_subdev_state *state)
++{
++	struct v4l2_mbus_framefmt *fmt;
++
++	fmt = v4l2_subdev_state_get_format(state, FE_STREAM_PAD);
++	*fmt = cfe_default_format;
++	fmt->code = MEDIA_BUS_FMT_SRGGB16_1X16;
++
++	fmt = v4l2_subdev_state_get_format(state, FE_CONFIG_PAD);
++	*fmt = cfe_default_meta_format;
++	fmt->code = MEDIA_BUS_FMT_FIXED;
++
++	fmt = v4l2_subdev_state_get_format(state, FE_OUTPUT0_PAD);
++	*fmt = cfe_default_format;
++	fmt->code = MEDIA_BUS_FMT_SRGGB16_1X16;
++
++	fmt = v4l2_subdev_state_get_format(state, FE_OUTPUT1_PAD);
++	*fmt = cfe_default_format;
++	fmt->code = MEDIA_BUS_FMT_SRGGB16_1X16;
++
++	fmt = v4l2_subdev_state_get_format(state, FE_STATS_PAD);
++	*fmt = cfe_default_meta_format;
++	fmt->code = MEDIA_BUS_FMT_FIXED;
++
++	return 0;
++}
++
++static int pisp_fe_pad_set_fmt(struct v4l2_subdev *sd,
++			       struct v4l2_subdev_state *state,
++			       struct v4l2_subdev_format *format)
++{
++	struct v4l2_mbus_framefmt *fmt;
++	const struct cfe_fmt *cfe_fmt;
++
++	/* TODO: format propagation to source pads */
++	/* TODO: format validation */
++
++	switch (format->pad) {
++	case FE_STREAM_PAD:
++		cfe_fmt = find_format_by_code(format->format.code);
++		if (!cfe_fmt || !(cfe_fmt->flags & CFE_FORMAT_FLAG_FE_OUT))
++			cfe_fmt = find_format_by_code(MEDIA_BUS_FMT_SRGGB16_1X16);
++
++		format->format.code = cfe_fmt->code;
++		format->format.field = V4L2_FIELD_NONE;
++
++		fmt = v4l2_subdev_state_get_format(state, FE_STREAM_PAD);
++		*fmt = format->format;
++
++		fmt = v4l2_subdev_state_get_format(state, FE_OUTPUT0_PAD);
++		*fmt = format->format;
++
++		fmt = v4l2_subdev_state_get_format(state, FE_OUTPUT1_PAD);
++		*fmt = format->format;
++
++		return 0;
++
++	case FE_OUTPUT0_PAD:
++	case FE_OUTPUT1_PAD: {
++		/*
++		 * TODO: we should allow scaling and cropping by allowing the
++		 * user to set the size here.
++		 */
++		struct v4l2_mbus_framefmt *sink_fmt, *source_fmt;
++		u32 sink_code;
++		u32 code;
++
++		sink_fmt = v4l2_subdev_state_get_format(state, FE_STREAM_PAD);
++		if (!sink_fmt)
++			return -EINVAL;
++
++		source_fmt = v4l2_subdev_state_get_format(state, format->pad);
++		if (!source_fmt)
++			return -EINVAL;
++
++		sink_code = sink_fmt->code;
++		code = format->format.code;
++
++		/*
++		 * If the source code from the user does not match the code in
++		 * the sink pad, check that the source code matches the
++		 * compressed version of the sink code.
++		 */
++
++		if (code != sink_code &&
++		    code == cfe_find_compressed_code(sink_code))
++			source_fmt->code = code;
++
++		return 0;
++	}
++
++	case FE_CONFIG_PAD:
++	case FE_STATS_PAD:
++	default:
++		return v4l2_subdev_get_fmt(sd, state, format);
++	}
++}
++
++static const struct v4l2_subdev_internal_ops pisp_fe_internal_ops = {
++	.init_state = pisp_fe_init_cfg,
++};
++
++static const struct v4l2_subdev_pad_ops pisp_fe_subdev_pad_ops = {
++	.get_fmt = v4l2_subdev_get_fmt,
++	.set_fmt = pisp_fe_pad_set_fmt,
++	.link_validate = v4l2_subdev_link_validate_default,
++};
++
++static const struct media_entity_operations pisp_fe_entity_ops = {
++	.link_validate = v4l2_subdev_link_validate,
++};
++
++static const struct v4l2_subdev_ops pisp_fe_subdev_ops = {
++	.pad = &pisp_fe_subdev_pad_ops,
++};
++
++int pisp_fe_init(struct pisp_fe_device *fe, struct dentry *debugfs)
++{
++	int ret;
++
++	debugfs_create_file("pisp_regs", 0444, debugfs, fe, &pisp_regs_fops);
++
++	fe->hw_revision = pisp_fe_reg_read(fe, FE_VERSION);
++	pisp_fe_info("PiSP FE HW v%u.%u\n",
++		     (fe->hw_revision >> 24) & 0xff,
++		     (fe->hw_revision >> 20) & 0x0f);
++
++	fe->pad[FE_STREAM_PAD].flags =
++		MEDIA_PAD_FL_SINK | MEDIA_PAD_FL_MUST_CONNECT;
++	fe->pad[FE_CONFIG_PAD].flags = MEDIA_PAD_FL_SINK;
++	fe->pad[FE_OUTPUT0_PAD].flags = MEDIA_PAD_FL_SOURCE;
++	fe->pad[FE_OUTPUT1_PAD].flags = MEDIA_PAD_FL_SOURCE;
++	fe->pad[FE_STATS_PAD].flags = MEDIA_PAD_FL_SOURCE;
++
++	ret = media_entity_pads_init(&fe->sd.entity, ARRAY_SIZE(fe->pad),
++				     fe->pad);
++	if (ret)
++		return ret;
++
++	/* Initialize subdev */
++	v4l2_subdev_init(&fe->sd, &pisp_fe_subdev_ops);
++	fe->sd.internal_ops = &pisp_fe_internal_ops;
++	fe->sd.entity.function = MEDIA_ENT_F_PROC_VIDEO_SCALER;
++	fe->sd.entity.ops = &pisp_fe_entity_ops;
++	fe->sd.entity.name = "pisp-fe";
++	fe->sd.flags = V4L2_SUBDEV_FL_HAS_DEVNODE;
++	fe->sd.owner = THIS_MODULE;
++	snprintf(fe->sd.name, sizeof(fe->sd.name), "pisp-fe");
++
++	ret = v4l2_subdev_init_finalize(&fe->sd);
++	if (ret)
++		goto err_entity_cleanup;
++
++	ret = v4l2_device_register_subdev(fe->v4l2_dev, &fe->sd);
++	if (ret) {
++		pisp_fe_err("Failed register pisp fe subdev (%d)\n", ret);
++		goto err_subdev_cleanup;
++	}
++
++	/* Must be in IDLE state (STATUS == 0) here. */
++	WARN_ON(pisp_fe_reg_read(fe, FE_STATUS));
++
++	return 0;
++
++err_subdev_cleanup:
++	v4l2_subdev_cleanup(&fe->sd);
++err_entity_cleanup:
++	media_entity_cleanup(&fe->sd.entity);
++
++	return ret;
++}
++
++void pisp_fe_uninit(struct pisp_fe_device *fe)
++{
++	v4l2_device_unregister_subdev(&fe->sd);
++	v4l2_subdev_cleanup(&fe->sd);
++	media_entity_cleanup(&fe->sd.entity);
++}
+--- /dev/null
++++ b/drivers/media/platform/raspberrypi/rp1_cfe/pisp_fe.h
+@@ -0,0 +1,53 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * PiSP Front End driver.
++ * Copyright (c) 2021 Raspberry Pi Ltd.
++ *
++ */
++#ifndef _PISP_FE_H_
++#define _PISP_FE_H_
++
++#include <linux/debugfs.h>
++#include <linux/io.h>
++#include <linux/types.h>
++#include <linux/videodev2.h>
++
++#include <media/media-device.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-subdev.h>
++
++#include "pisp_fe_config.h"
++
++enum pisp_fe_pads {
++	FE_STREAM_PAD,
++	FE_CONFIG_PAD,
++	FE_OUTPUT0_PAD,
++	FE_OUTPUT1_PAD,
++	FE_STATS_PAD,
++	FE_NUM_PADS
++};
++
++struct pisp_fe_device {
++	/* Parent V4l2 device */
++	struct v4l2_device *v4l2_dev;
++	void __iomem *base;
++	u32 hw_revision;
++
++	u16 inframe_count;
++	struct media_pad pad[FE_NUM_PADS];
++	struct v4l2_subdev sd;
++};
++
++void pisp_fe_isr(struct pisp_fe_device *fe, bool *sof, bool *eof);
++int pisp_fe_validate_config(struct pisp_fe_device *fe,
++			    struct pisp_fe_config *cfg,
++			    struct v4l2_format const *f0,
++			    struct v4l2_format const *f1);
++void pisp_fe_submit_job(struct pisp_fe_device *fe, struct vb2_buffer **vb2_bufs,
++			struct pisp_fe_config *cfg);
++void pisp_fe_start(struct pisp_fe_device *fe);
++void pisp_fe_stop(struct pisp_fe_device *fe);
++int pisp_fe_init(struct pisp_fe_device *fe, struct dentry *debugfs);
++void pisp_fe_uninit(struct pisp_fe_device *fe);
++
++#endif
+--- /dev/null
++++ b/drivers/media/platform/raspberrypi/rp1_cfe/pisp_fe_config.h
+@@ -0,0 +1,272 @@
++/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
++/*
++ * RP1 PiSP Front End Driver Configuration structures
++ *
++ * Copyright (C) 2021 - Raspberry Pi Ltd.
++ *
++ */
++#ifndef _PISP_FE_CONFIG_
++#define _PISP_FE_CONFIG_
++
++#include "pisp_common.h"
++
++#include "pisp_statistics.h"
++
++#define PISP_FE_NUM_OUTPUTS 2
++
++enum pisp_fe_enable {
++	PISP_FE_ENABLE_INPUT = 0x000001,
++	PISP_FE_ENABLE_DECOMPRESS = 0x000002,
++	PISP_FE_ENABLE_DECOMPAND = 0x000004,
++	PISP_FE_ENABLE_BLA = 0x000008,
++	PISP_FE_ENABLE_DPC = 0x000010,
++	PISP_FE_ENABLE_STATS_CROP = 0x000020,
++	PISP_FE_ENABLE_DECIMATE = 0x000040,
++	PISP_FE_ENABLE_BLC = 0x000080,
++	PISP_FE_ENABLE_CDAF_STATS = 0x000100,
++	PISP_FE_ENABLE_AWB_STATS = 0x000200,
++	PISP_FE_ENABLE_RGBY = 0x000400,
++	PISP_FE_ENABLE_LSC = 0x000800,
++	PISP_FE_ENABLE_AGC_STATS = 0x001000,
++	PISP_FE_ENABLE_CROP0 = 0x010000,
++	PISP_FE_ENABLE_DOWNSCALE0 = 0x020000,
++	PISP_FE_ENABLE_COMPRESS0 = 0x040000,
++	PISP_FE_ENABLE_OUTPUT0 = 0x080000,
++	PISP_FE_ENABLE_CROP1 = 0x100000,
++	PISP_FE_ENABLE_DOWNSCALE1 = 0x200000,
++	PISP_FE_ENABLE_COMPRESS1 = 0x400000,
++	PISP_FE_ENABLE_OUTPUT1 = 0x800000
++};
++
++#define PISP_FE_ENABLE_CROP(i) (PISP_FE_ENABLE_CROP0 << (4 * (i)))
++#define PISP_FE_ENABLE_DOWNSCALE(i) (PISP_FE_ENABLE_DOWNSCALE0 << (4 * (i)))
++#define PISP_FE_ENABLE_COMPRESS(i) (PISP_FE_ENABLE_COMPRESS0 << (4 * (i)))
++#define PISP_FE_ENABLE_OUTPUT(i) (PISP_FE_ENABLE_OUTPUT0 << (4 * (i)))
++
++/*
++ * We use the enable flags to show when blocks are "dirty", but we need some
++ * extra ones too.
++ */
++enum pisp_fe_dirty {
++	PISP_FE_DIRTY_GLOBAL = 0x0001,
++	PISP_FE_DIRTY_FLOATING = 0x0002,
++	PISP_FE_DIRTY_OUTPUT_AXI = 0x0004
++};
++
++struct pisp_fe_global_config {
++	u32 enables;
++	u8 bayer_order;
++	u8 pad[3];
++};
++
++struct pisp_fe_input_axi_config {
++	/* burst length minus one, in the range 0..15; OR'd with flags */
++	u8 maxlen_flags;
++	/* { prot[2:0], cache[3:0] } fields */
++	u8 cache_prot;
++	/* QoS (only 4 LS bits are used) */
++	u16 qos;
++};
++
++struct pisp_fe_output_axi_config {
++	/* burst length minus one, in the range 0..15; OR'd with flags */
++	u8 maxlen_flags;
++	/* { prot[2:0], cache[3:0] } fields */
++	u8 cache_prot;
++	/* QoS (4 bitfields of 4 bits each for different panic levels) */
++	u16 qos;
++	/*  For Panic mode: Output FIFO panic threshold */
++	u16 thresh;
++	/*  For Panic mode: Output FIFO statistics throttle threshold */
++	u16 throttle;
++};
++
++struct pisp_fe_input_config {
++	u8 streaming;
++	u8 pad[3];
++	struct pisp_image_format_config format;
++	struct pisp_fe_input_axi_config axi;
++	/* Extra cycles delay before issuing each burst request */
++	u8 holdoff;
++	u8 pad2[3];
++};
++
++struct pisp_fe_output_config {
++	struct pisp_image_format_config format;
++	u16 ilines;
++	u8 pad[2];
++};
++
++struct pisp_fe_input_buffer_config {
++	u32 addr_lo;
++	u32 addr_hi;
++	u16 frame_id;
++	u16 pad;
++};
++
++#define PISP_FE_DECOMPAND_LUT_SIZE 65
++
++struct pisp_fe_decompand_config {
++	u16 lut[PISP_FE_DECOMPAND_LUT_SIZE];
++	u16 pad;
++};
++
++struct pisp_fe_dpc_config {
++	u8 coeff_level;
++	u8 coeff_range;
++	u8 coeff_range2;
++#define PISP_FE_DPC_FLAG_FOLDBACK 1
++#define PISP_FE_DPC_FLAG_VFLAG 2
++	u8 flags;
++};
++
++#define PISP_FE_LSC_LUT_SIZE 16
++
++struct pisp_fe_lsc_config {
++	u8 shift;
++	u8 pad0;
++	u16 scale;
++	u16 centre_x;
++	u16 centre_y;
++	u16 lut[PISP_FE_LSC_LUT_SIZE];
++};
++
++struct pisp_fe_rgby_config {
++	u16 gain_r;
++	u16 gain_g;
++	u16 gain_b;
++	u8 maxflag;
++	u8 pad;
++};
++
++struct pisp_fe_agc_stats_config {
++	u16 offset_x;
++	u16 offset_y;
++	u16 size_x;
++	u16 size_y;
++	/* each weight only 4 bits */
++	u8 weights[PISP_AGC_STATS_NUM_ZONES / 2];
++	u16 row_offset_x;
++	u16 row_offset_y;
++	u16 row_size_x;
++	u16 row_size_y;
++	u8 row_shift;
++	u8 float_shift;
++	u8 pad1[2];
++};
++
++struct pisp_fe_awb_stats_config {
++	u16 offset_x;
++	u16 offset_y;
++	u16 size_x;
++	u16 size_y;
++	u8 shift;
++	u8 pad[3];
++	u16 r_lo;
++	u16 r_hi;
++	u16 g_lo;
++	u16 g_hi;
++	u16 b_lo;
++	u16 b_hi;
++};
++
++struct pisp_fe_floating_stats_region {
++	u16 offset_x;
++	u16 offset_y;
++	u16 size_x;
++	u16 size_y;
++};
++
++struct pisp_fe_floating_stats_config {
++	struct pisp_fe_floating_stats_region
++					regions[PISP_FLOATING_STATS_NUM_ZONES];
++};
++
++#define PISP_FE_CDAF_NUM_WEIGHTS 8
++
++struct pisp_fe_cdaf_stats_config {
++	u16 noise_constant;
++	u16 noise_slope;
++	u16 offset_x;
++	u16 offset_y;
++	u16 size_x;
++	u16 size_y;
++	u16 skip_x;
++	u16 skip_y;
++	u32 mode;
++};
++
++struct pisp_fe_stats_buffer_config {
++	u32 addr_lo;
++	u32 addr_hi;
++};
++
++struct pisp_fe_crop_config {
++	u16 offset_x;
++	u16 offset_y;
++	u16 width;
++	u16 height;
++};
++
++enum pisp_fe_downscale_flags {
++	DOWNSCALE_BAYER =
++		1, /* downscale the four Bayer components independently... */
++	DOWNSCALE_BIN =
++		2 /* ...without trying to preserve their spatial relationship */
++};
++
++struct pisp_fe_downscale_config {
++	u8 xin;
++	u8 xout;
++	u8 yin;
++	u8 yout;
++	u8 flags; /* enum pisp_fe_downscale_flags */
++	u8 pad[3];
++	u16 output_width;
++	u16 output_height;
++};
++
++struct pisp_fe_output_buffer_config {
++	u32 addr_lo;
++	u32 addr_hi;
++};
++
++/* Each of the two output channels/branches: */
++struct pisp_fe_output_branch_config {
++	struct pisp_fe_crop_config crop;
++	struct pisp_fe_downscale_config downscale;
++	struct pisp_compress_config compress;
++	struct pisp_fe_output_config output;
++	u32 pad;
++};
++
++/* And finally one to rule them all: */
++struct pisp_fe_config {
++	/* I/O configuration: */
++	struct pisp_fe_stats_buffer_config stats_buffer;
++	struct pisp_fe_output_buffer_config output_buffer[PISP_FE_NUM_OUTPUTS];
++	struct pisp_fe_input_buffer_config input_buffer;
++	/* processing configuration: */
++	struct pisp_fe_global_config global;
++	struct pisp_fe_input_config input;
++	struct pisp_decompress_config decompress;
++	struct pisp_fe_decompand_config decompand;
++	struct pisp_bla_config bla;
++	struct pisp_fe_dpc_config dpc;
++	struct pisp_fe_crop_config stats_crop;
++	u32 spare1; /* placeholder for future decimate configuration */
++	struct pisp_bla_config blc;
++	struct pisp_fe_rgby_config rgby;
++	struct pisp_fe_lsc_config lsc;
++	struct pisp_fe_agc_stats_config agc_stats;
++	struct pisp_fe_awb_stats_config awb_stats;
++	struct pisp_fe_cdaf_stats_config cdaf_stats;
++	struct pisp_fe_floating_stats_config floating_stats;
++	struct pisp_fe_output_axi_config output_axi;
++	struct pisp_fe_output_branch_config ch[PISP_FE_NUM_OUTPUTS];
++	/* non-register fields: */
++	u32 dirty_flags; /* these use pisp_fe_enable */
++	u32 dirty_flags_extra; /* these use pisp_fe_dirty */
++};
++
++#endif /* _PISP_FE_CONFIG_ */
+--- /dev/null
++++ b/drivers/media/platform/raspberrypi/rp1_cfe/pisp_statistics.h
+@@ -0,0 +1,62 @@
++/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
++/*
++ * RP1 PiSP Front End statistics definitions
++ *
++ * Copyright (C) 2021 - Raspberry Pi Ltd.
++ *
++ */
++#ifndef _PISP_FE_STATISTICS_H_
++#define _PISP_FE_STATISTICS_H_
++
++#define PISP_FLOATING_STATS_NUM_ZONES 4
++#define PISP_AGC_STATS_NUM_BINS 1024
++#define PISP_AGC_STATS_SIZE 16
++#define PISP_AGC_STATS_NUM_ZONES (PISP_AGC_STATS_SIZE * PISP_AGC_STATS_SIZE)
++#define PISP_AGC_STATS_NUM_ROW_SUMS 512
++
++struct pisp_agc_statistics_zone {
++	u64 Y_sum;
++	u32 counted;
++	u32 pad;
++};
++
++struct pisp_agc_statistics {
++	u32 row_sums[PISP_AGC_STATS_NUM_ROW_SUMS];
++	/*
++	 * 32-bits per bin means an image (just less than) 16384x16384 pixels
++	 * in size can weight every pixel from 0 to 15.
++	 */
++	u32 histogram[PISP_AGC_STATS_NUM_BINS];
++	struct pisp_agc_statistics_zone floating[PISP_FLOATING_STATS_NUM_ZONES];
++};
++
++#define PISP_AWB_STATS_SIZE 32
++#define PISP_AWB_STATS_NUM_ZONES (PISP_AWB_STATS_SIZE * PISP_AWB_STATS_SIZE)
++
++struct pisp_awb_statistics_zone {
++	u32 R_sum;
++	u32 G_sum;
++	u32 B_sum;
++	u32 counted;
++};
++
++struct pisp_awb_statistics {
++	struct pisp_awb_statistics_zone zones[PISP_AWB_STATS_NUM_ZONES];
++	struct pisp_awb_statistics_zone floating[PISP_FLOATING_STATS_NUM_ZONES];
++};
++
++#define PISP_CDAF_STATS_SIZE 8
++#define PISP_CDAF_STATS_NUM_FOMS (PISP_CDAF_STATS_SIZE * PISP_CDAF_STATS_SIZE)
++
++struct pisp_cdaf_statistics {
++	u64 foms[PISP_CDAF_STATS_NUM_FOMS];
++	u64 floating[PISP_FLOATING_STATS_NUM_ZONES];
++};
++
++struct pisp_statistics {
++	struct pisp_awb_statistics awb;
++	struct pisp_agc_statistics agc;
++	struct pisp_cdaf_statistics cdaf;
++};
++
++#endif /* _PISP_FE_STATISTICS_H_ */
+--- /dev/null
++++ b/drivers/media/platform/raspberrypi/rp1_cfe/pisp_types.h
+@@ -0,0 +1,144 @@
++/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
++/*
++ * RP1 PiSP Front End image definitions.
++ *
++ * Copyright (C) 2021 - Raspberry Pi Ltd.
++ *
++ */
++#ifndef _PISP_FE_TYPES_H_
++#define _PISP_FE_TYPES_H_
++
++/* This definition must match the format description in the hardware exactly! */
++struct pisp_image_format_config {
++	/* size in pixels */
++	u16 width, height;
++	/* must match struct pisp_image_format below */
++	u32 format;
++	s32 stride;
++	/* some planar image formats will need a second stride */
++	s32 stride2;
++};
++
++static_assert(sizeof(struct pisp_image_format_config) == 16);
++
++enum pisp_bayer_order {
++	/*
++	 * Note how bayer_order&1 tells you if G is on the even pixels of the
++	 * checkerboard or not, and bayer_order&2 tells you if R is on the even
++	 * rows or is swapped with B. Note that if the top (of the 8) bits is
++	 * set, this denotes a monochrome or greyscale image, and the lower bits
++	 * should all be ignored.
++	 */
++	PISP_BAYER_ORDER_RGGB = 0,
++	PISP_BAYER_ORDER_GBRG = 1,
++	PISP_BAYER_ORDER_BGGR = 2,
++	PISP_BAYER_ORDER_GRBG = 3,
++	PISP_BAYER_ORDER_GREYSCALE = 128
++};
++
++enum pisp_image_format {
++	/*
++	 * Precise values are mostly tbd. Generally these will be portmanteau
++	 * values comprising bit fields and flags. This format must be shared
++	 * throughout the PiSP.
++	 */
++	PISP_IMAGE_FORMAT_BPS_8 = 0x00000000,
++	PISP_IMAGE_FORMAT_BPS_10 = 0x00000001,
++	PISP_IMAGE_FORMAT_BPS_12 = 0x00000002,
++	PISP_IMAGE_FORMAT_BPS_16 = 0x00000003,
++	PISP_IMAGE_FORMAT_BPS_MASK = 0x00000003,
++
++	PISP_IMAGE_FORMAT_PLANARITY_INTERLEAVED = 0x00000000,
++	PISP_IMAGE_FORMAT_PLANARITY_SEMI_PLANAR = 0x00000010,
++	PISP_IMAGE_FORMAT_PLANARITY_PLANAR = 0x00000020,
++	PISP_IMAGE_FORMAT_PLANARITY_MASK = 0x00000030,
++
++	PISP_IMAGE_FORMAT_SAMPLING_444 = 0x00000000,
++	PISP_IMAGE_FORMAT_SAMPLING_422 = 0x00000100,
++	PISP_IMAGE_FORMAT_SAMPLING_420 = 0x00000200,
++	PISP_IMAGE_FORMAT_SAMPLING_MASK = 0x00000300,
++
++	PISP_IMAGE_FORMAT_ORDER_NORMAL = 0x00000000,
++	PISP_IMAGE_FORMAT_ORDER_SWAPPED = 0x00001000,
++
++	PISP_IMAGE_FORMAT_SHIFT_0 = 0x00000000,
++	PISP_IMAGE_FORMAT_SHIFT_1 = 0x00010000,
++	PISP_IMAGE_FORMAT_SHIFT_2 = 0x00020000,
++	PISP_IMAGE_FORMAT_SHIFT_3 = 0x00030000,
++	PISP_IMAGE_FORMAT_SHIFT_4 = 0x00040000,
++	PISP_IMAGE_FORMAT_SHIFT_5 = 0x00050000,
++	PISP_IMAGE_FORMAT_SHIFT_6 = 0x00060000,
++	PISP_IMAGE_FORMAT_SHIFT_7 = 0x00070000,
++	PISP_IMAGE_FORMAT_SHIFT_8 = 0x00080000,
++	PISP_IMAGE_FORMAT_SHIFT_MASK = 0x000f0000,
++
++	PISP_IMAGE_FORMAT_UNCOMPRESSED = 0x00000000,
++	PISP_IMAGE_FORMAT_COMPRESSION_MODE_1 = 0x01000000,
++	PISP_IMAGE_FORMAT_COMPRESSION_MODE_2 = 0x02000000,
++	PISP_IMAGE_FORMAT_COMPRESSION_MODE_3 = 0x03000000,
++	PISP_IMAGE_FORMAT_COMPRESSION_MASK = 0x03000000,
++
++	PISP_IMAGE_FORMAT_HOG_SIGNED = 0x04000000,
++	PISP_IMAGE_FORMAT_HOG_UNSIGNED = 0x08000000,
++	PISP_IMAGE_FORMAT_INTEGRAL_IMAGE = 0x10000000,
++	PISP_IMAGE_FORMAT_WALLPAPER_ROLL = 0x20000000,
++	PISP_IMAGE_FORMAT_THREE_CHANNEL = 0x40000000,
++
++	/* Lastly a few specific instantiations of the above. */
++	PISP_IMAGE_FORMAT_SINGLE_16 = PISP_IMAGE_FORMAT_BPS_16,
++	PISP_IMAGE_FORMAT_THREE_16 =
++		PISP_IMAGE_FORMAT_BPS_16 | PISP_IMAGE_FORMAT_THREE_CHANNEL
++};
++
++#define PISP_IMAGE_FORMAT_bps_8(fmt)                                           \
++	(((fmt) & PISP_IMAGE_FORMAT_BPS_MASK) == PISP_IMAGE_FORMAT_BPS_8)
++#define PISP_IMAGE_FORMAT_bps_10(fmt)                                          \
++	(((fmt) & PISP_IMAGE_FORMAT_BPS_MASK) == PISP_IMAGE_FORMAT_BPS_10)
++#define PISP_IMAGE_FORMAT_bps_12(fmt)                                          \
++	(((fmt) & PISP_IMAGE_FORMAT_BPS_MASK) == PISP_IMAGE_FORMAT_BPS_12)
++#define PISP_IMAGE_FORMAT_bps_16(fmt)                                          \
++	(((fmt) & PISP_IMAGE_FORMAT_BPS_MASK) == PISP_IMAGE_FORMAT_BPS_16)
++#define PISP_IMAGE_FORMAT_bps(fmt)                                             \
++	(((fmt) & PISP_IMAGE_FORMAT_BPS_MASK) ?                                \
++		       8 + (2 << (((fmt) & PISP_IMAGE_FORMAT_BPS_MASK) - 1)) : \
++		       8)
++#define PISP_IMAGE_FORMAT_shift(fmt)                                           \
++	(((fmt) & PISP_IMAGE_FORMAT_SHIFT_MASK) / PISP_IMAGE_FORMAT_SHIFT_1)
++#define PISP_IMAGE_FORMAT_three_channel(fmt)                                   \
++	((fmt) & PISP_IMAGE_FORMAT_THREE_CHANNEL)
++#define PISP_IMAGE_FORMAT_single_channel(fmt)                                  \
++	(!((fmt) & PISP_IMAGE_FORMAT_THREE_CHANNEL))
++#define PISP_IMAGE_FORMAT_compressed(fmt)                                      \
++	(((fmt) & PISP_IMAGE_FORMAT_COMPRESSION_MASK) !=                       \
++	 PISP_IMAGE_FORMAT_UNCOMPRESSED)
++#define PISP_IMAGE_FORMAT_sampling_444(fmt)                                    \
++	(((fmt) & PISP_IMAGE_FORMAT_SAMPLING_MASK) ==                          \
++	 PISP_IMAGE_FORMAT_SAMPLING_444)
++#define PISP_IMAGE_FORMAT_sampling_422(fmt)                                    \
++	(((fmt) & PISP_IMAGE_FORMAT_SAMPLING_MASK) ==                          \
++	 PISP_IMAGE_FORMAT_SAMPLING_422)
++#define PISP_IMAGE_FORMAT_sampling_420(fmt)                                    \
++	(((fmt) & PISP_IMAGE_FORMAT_SAMPLING_MASK) ==                          \
++	 PISP_IMAGE_FORMAT_SAMPLING_420)
++#define PISP_IMAGE_FORMAT_order_normal(fmt)                                    \
++	(!((fmt) & PISP_IMAGE_FORMAT_ORDER_SWAPPED))
++#define PISP_IMAGE_FORMAT_order_swapped(fmt)                                   \
++	((fmt) & PISP_IMAGE_FORMAT_ORDER_SWAPPED)
++#define PISP_IMAGE_FORMAT_interleaved(fmt)                                     \
++	(((fmt) & PISP_IMAGE_FORMAT_PLANARITY_MASK) ==                         \
++	 PISP_IMAGE_FORMAT_PLANARITY_INTERLEAVED)
++#define PISP_IMAGE_FORMAT_semiplanar(fmt)                                      \
++	(((fmt) & PISP_IMAGE_FORMAT_PLANARITY_MASK) ==                         \
++	 PISP_IMAGE_FORMAT_PLANARITY_SEMI_PLANAR)
++#define PISP_IMAGE_FORMAT_planar(fmt)                                          \
++	(((fmt) & PISP_IMAGE_FORMAT_PLANARITY_MASK) ==                         \
++	 PISP_IMAGE_FORMAT_PLANARITY_PLANAR)
++#define PISP_IMAGE_FORMAT_wallpaper(fmt)                                       \
++	((fmt) & PISP_IMAGE_FORMAT_WALLPAPER_ROLL)
++#define PISP_IMAGE_FORMAT_HOG(fmt)                                             \
++	((fmt) &                                                               \
++	 (PISP_IMAGE_FORMAT_HOG_SIGNED | PISP_IMAGE_FORMAT_HOG_UNSIGNED))
++
++#define PISP_WALLPAPER_WIDTH 128 // in bytes
++
++#endif /* _PISP_FE_TYPES_H_ */
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -840,10 +840,14 @@ struct v4l2_pix_format {
+ 
+ /* The pixel format for all our buffers (the precise format is found in the config buffer). */
+ #define V4L2_PIX_FMT_RPI_BE		v4l2_fourcc('R', 'P', 'B', 'P')
+-#define V4L2_PIX_FMT_PISP_COMP_RGGB	v4l2_fourcc('P', 'C', 'R', 'G')
+-#define V4L2_PIX_FMT_PISP_COMP_GRBG	v4l2_fourcc('P', 'C', 'G', 'R')
+-#define V4L2_PIX_FMT_PISP_COMP_GBRG	v4l2_fourcc('P', 'C', 'G', 'B')
+-#define V4L2_PIX_FMT_PISP_COMP_BGGR	v4l2_fourcc('P', 'C', 'B', 'G')
++#define V4L2_PIX_FMT_PISP_COMP1_RGGB	v4l2_fourcc('P', 'C', '1', 'R')
++#define V4L2_PIX_FMT_PISP_COMP1_GRBG	v4l2_fourcc('P', 'C', '1', 'G')
++#define V4L2_PIX_FMT_PISP_COMP1_GBRG	v4l2_fourcc('P', 'C', '1', 'g')
++#define V4L2_PIX_FMT_PISP_COMP1_BGGR	v4l2_fourcc('P', 'C', '1', 'B')
++#define V4L2_PIX_FMT_PISP_COMP2_RGGB	v4l2_fourcc('P', 'C', '2', 'R')
++#define V4L2_PIX_FMT_PISP_COMP2_GRBG	v4l2_fourcc('P', 'C', '2', 'G')
++#define V4L2_PIX_FMT_PISP_COMP2_GBRG	v4l2_fourcc('P', 'C', '2', 'g')
++#define V4L2_PIX_FMT_PISP_COMP2_BGGR	v4l2_fourcc('P', 'C', '2', 'B')
+ 
+ /* SDR formats - used only for Software Defined Radio devices */
+ #define V4L2_SDR_FMT_CU8          v4l2_fourcc('C', 'U', '0', '8') /* IQ u8 */
+@@ -879,6 +883,9 @@ struct v4l2_pix_format {
+ #define V4L2_META_FMT_RPI_BE_CFG	v4l2_fourcc('R', 'P', 'B', 'C') /* PiSP BE configuration */
+ 
+ /* The metadata format identifier for FE configuration buffers. */
++#define V4L2_META_FMT_RPI_FE_CFG v4l2_fourcc('R', 'P', 'F', 'C')
++
++/* The metadata format identifier for FE configuration buffers. */
+ #define V4L2_META_FMT_RPI_FE_STATS v4l2_fourcc('R', 'P', 'F', 'S')
+ 
+ #ifdef __KERNEL__
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0370-dt-bindings-net-cdns-macb-AXI-tuning-properties.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0370-dt-bindings-net-cdns-macb-AXI-tuning-properties.patch
new file mode 100644
index 00000000..7e342ce2
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0370-dt-bindings-net-cdns-macb-AXI-tuning-properties.patch
@@ -0,0 +1,38 @@
+From d801d51deaf8be6eadebc4d74096fc2214c3512f Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 15 Feb 2023 09:46:35 +0000
+Subject: [PATCH 370/697] dt-bindings: net: cdns,macb: AXI tuning properties
+
+Add optional properties to tune the AXI interface -
+cdns,aw2w-max-pipe, cdns,ar2r-max-pipe and cdns,use-aw2b-fill.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ .../devicetree/bindings/net/cdns,macb.yaml       | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/Documentation/devicetree/bindings/net/cdns,macb.yaml
++++ b/Documentation/devicetree/bindings/net/cdns,macb.yaml
+@@ -136,6 +136,22 @@ properties:
+       Node containing PHY children. If this node is not present, then PHYs will
+       be direct children.
+ 
++  cdns,aw2w-max-pipe:
++    $ref: /schemas/types.yaml#/definitions/uint32
++    description:
++      Maximum number of outstanding AXI write requests
++
++  cdns,ar2r-max-pipe:
++    $ref: /schemas/types.yaml#/definitions/uint32
++    description:
++      Maximum number of outstanding AXI read requests
++
++  cdns,use-aw2b-fill:
++    type: boolean
++    description:
++      If set, the maximum number of outstanding write transactions operates
++      between the AW to B AXI channel, instead of the AW to W AXI channel.
++
+ patternProperties:
+   "^ethernet-phy@[0-9a-f]$":
+     type: object
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0371-hwmon-Add-RP1-ADC-and-temperature-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0371-hwmon-Add-RP1-ADC-and-temperature-driver.patch
new file mode 100644
index 00000000..56a9f440
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0371-hwmon-Add-RP1-ADC-and-temperature-driver.patch
@@ -0,0 +1,355 @@
+From cae7b6ca2e37814e84be96a57c7f01aba23ce359 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 2 Mar 2023 18:04:42 +0000
+Subject: [PATCH 371/697] hwmon: Add RP1 ADC and temperature driver
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+drivers: hwmon: rp1-adc: check conversion validity before supplying value
+
+The SAR ADC architecture may complete a conversion but instability in the
+comparator can corrupt the result. Such corruption is signalled in the CS
+ERR bit, asserted alongside each conversion result.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/hwmon/Kconfig   |   7 +
+ drivers/hwmon/Makefile  |   1 +
+ drivers/hwmon/rp1-adc.c | 305 ++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 313 insertions(+)
+ create mode 100644 drivers/hwmon/rp1-adc.c
+
+--- a/drivers/hwmon/Kconfig
++++ b/drivers/hwmon/Kconfig
+@@ -2551,6 +2551,13 @@ config SENSORS_INTEL_M10_BMC_HWMON
+ 	  sensors monitor various telemetry data of different components on the
+ 	  card, e.g. board temperature, FPGA core temperature/voltage/current.
+ 
++config SENSORS_RP1_ADC
++	tristate "RP1 ADC and temperature sensor driver"
++	depends on MFD_RP1
++	help
++	  Say yes here to enable support for the voltage and temperature
++	  sensors of the Raspberry Pi RP1 peripheral chip.
++
+ if ACPI
+ 
+ comment "ACPI drivers"
+--- a/drivers/hwmon/Makefile
++++ b/drivers/hwmon/Makefile
+@@ -188,6 +188,7 @@ obj-$(CONFIG_SENSORS_POWR1220)  += powr1
+ obj-$(CONFIG_SENSORS_PT5161L)	+= pt5161l.o
+ obj-$(CONFIG_SENSORS_PWM_FAN)	+= pwm-fan.o
+ obj-$(CONFIG_SENSORS_RASPBERRYPI_HWMON)	+= raspberrypi-hwmon.o
++obj-$(CONFIG_SENSORS_RP1_ADC)	+= rp1-adc.o
+ obj-$(CONFIG_SENSORS_SBTSI)	+= sbtsi_temp.o
+ obj-$(CONFIG_SENSORS_SBRMI)	+= sbrmi.o
+ obj-$(CONFIG_SENSORS_SCH56XX_COMMON)+= sch56xx-common.o
+--- /dev/null
++++ b/drivers/hwmon/rp1-adc.c
+@@ -0,0 +1,305 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Driver for the RP1 ADC and temperature sensor
++ * Copyright (C) 2023 Raspberry Pi Ltd.
++ */
++
++#include <linux/clk.h>
++#include <linux/err.h>
++#include <linux/hwmon.h>
++#include <linux/hwmon-sysfs.h>
++#include <linux/io.h>
++#include <linux/module.h>
++#include <linux/mod_devicetable.h>
++#include <linux/platform_device.h>
++#include <linux/regulator/consumer.h>
++
++#define MODULE_NAME	"rp1-adc"
++
++#define RP1_ADC_CS		0x00
++#define RP1_ADC_RESULT		0x04
++#define RP1_ADC_FCS		0x08
++#define RP1_ADC_FIFO		0x0c
++#define RP1_ADC_DIV		0x10
++
++#define RP1_ADC_INTR		0x14
++#define RP1_ADC_INTE		0x18
++#define RP1_ADC_INTF		0x1c
++#define RP1_ADC_INTS		0x20
++
++#define RP1_ADC_RWTYPE_SET	0x2000
++#define RP1_ADC_RWTYPE_CLR	0x3000
++
++#define RP1_ADC_CS_RROBIN_MASK	0x1f
++#define RP1_ADC_CS_RROBIN_SHIFT	16
++#define RP1_ADC_CS_AINSEL_MASK	0x7
++#define RP1_ADC_CS_AINSEL_SHIFT	12
++#define RP1_ADC_CS_ERR_STICKY	0x400
++#define RP1_ADC_CS_ERR		0x200
++#define RP1_ADC_CS_READY	0x100
++#define RP1_ADC_CS_START_MANY	0x8
++#define RP1_ADC_CS_START_ONCE	0x4
++#define RP1_ADC_CS_TS_EN	0x2
++#define RP1_ADC_CS_EN		0x1
++
++#define RP1_ADC_FCS_THRESH_MASK	0xf
++#define RP1_ADC_FCS_THRESH_SHIFT	24
++#define RP1_ADC_FCS_LEVEL_MASK	0xf
++#define RP1_ADC_FCS_LEVEL_SHIFT	16
++#define RP1_ADC_FCS_OVER	0x800
++#define RP1_ADC_FCS_UNDER	0x400
++#define RP1_ADC_FCS_FULL	0x200
++#define RP1_ADC_FCS_EMPTY	0x100
++#define RP1_ADC_FCS_DREQ_EN	0x8
++#define RP1_ADC_FCS_ERR		0x4
++#define RP1_ADC_FCS_SHIFR	0x2
++#define RP1_ADC_FCS_EN		0x1
++
++#define RP1_ADC_FIFO_ERR	0x8000
++#define RP1_ADC_FIFO_VAL_MASK	0xfff
++
++#define RP1_ADC_DIV_INT_MASK	0xffff
++#define RP1_ADC_DIV_INT_SHIFT	8
++#define RP1_ADC_DIV_FRAC_MASK	0xff
++#define RP1_ADC_DIV_FRAC_SHIFT	0
++
++struct rp1_adc_data {
++	void __iomem *base;
++	spinlock_t lock;
++	struct device *hwmon_dev;
++	int vref_mv;
++};
++
++static int rp1_adc_ready_wait(struct rp1_adc_data *data)
++{
++	int retries = 10;
++
++	while (retries && !(readl(data->base + RP1_ADC_CS) & RP1_ADC_CS_READY))
++		retries--;
++
++	return retries ? 0 : -EIO;
++}
++
++static int rp1_adc_read(struct rp1_adc_data *data,
++			struct device_attribute *devattr, unsigned int *val)
++{
++	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
++	int channel = attr->index;
++	int ret;
++
++	spin_lock(&data->lock);
++
++	writel(RP1_ADC_CS_AINSEL_MASK << RP1_ADC_CS_AINSEL_SHIFT,
++	       data->base + RP1_ADC_RWTYPE_CLR + RP1_ADC_CS);
++	writel(channel << RP1_ADC_CS_AINSEL_SHIFT,
++	       data->base + RP1_ADC_RWTYPE_SET + RP1_ADC_CS);
++	writel(RP1_ADC_CS_START_ONCE,
++	       data->base + RP1_ADC_RWTYPE_SET + RP1_ADC_CS);
++
++	ret = rp1_adc_ready_wait(data);
++	if (ret)
++		return ret;
++
++	/* Asserted if the completed conversion had a convergence error */
++	if (readl(data->base + RP1_ADC_CS) & RP1_ADC_CS_ERR)
++		return -EIO;
++
++	*val = readl(data->base + RP1_ADC_RESULT);
++
++	spin_unlock(&data->lock);
++
++	return ret;
++}
++
++static int rp1_adc_to_mv(struct rp1_adc_data *data, unsigned int val)
++{
++	return ((u64)data->vref_mv * val) / 0xfff;
++}
++
++static ssize_t rp1_adc_show(struct device *dev,
++			    struct device_attribute *devattr,
++			    char *buf)
++{
++	struct rp1_adc_data *data = dev_get_drvdata(dev);
++	unsigned int val;
++	int ret;
++
++	ret = rp1_adc_read(data, devattr, &val);
++	if (ret)
++		return ret;
++
++	return sprintf(buf, "%d\n", rp1_adc_to_mv(data, val));
++}
++
++static ssize_t rp1_adc_temp_show(struct device *dev,
++				 struct device_attribute *devattr,
++				 char *buf)
++{
++	struct rp1_adc_data *data = dev_get_drvdata(dev);
++	unsigned int val;
++	int ret, mv, mc;
++
++	writel(RP1_ADC_CS_TS_EN,
++	       data->base + RP1_ADC_RWTYPE_SET + RP1_ADC_CS);
++	ret = rp1_adc_read(data, devattr, &val);
++	if (ret)
++		return ret;
++
++	mv = rp1_adc_to_mv(data, val);
++
++	/* T = 27 - (ADC_voltage - 0.706)/0.001721 */
++
++	mc = 27000 - DIV_ROUND_CLOSEST((mv - 706) * (s64)1000000, 1721);
++
++	return sprintf(buf, "%d\n", mc);
++}
++
++static ssize_t rp1_adc_raw_show(struct device *dev,
++				struct device_attribute *devattr,
++				char *buf)
++{
++	struct rp1_adc_data *data = dev_get_drvdata(dev);
++	unsigned int val;
++	int ret = rp1_adc_read(data, devattr, &val);
++
++	if (ret)
++		return ret;
++
++	return sprintf(buf, "%u\n", val);
++}
++
++static ssize_t rp1_adc_temp_raw_show(struct device *dev,
++				     struct device_attribute *devattr,
++				     char *buf)
++{
++	struct rp1_adc_data *data = dev_get_drvdata(dev);
++	unsigned int val;
++	int ret = rp1_adc_read(data, devattr, &val);
++
++	if (ret)
++		return ret;
++
++	return sprintf(buf, "%u\n", val);
++}
++
++static SENSOR_DEVICE_ATTR_RO(in1_input, rp1_adc, 0);
++static SENSOR_DEVICE_ATTR_RO(in2_input, rp1_adc, 1);
++static SENSOR_DEVICE_ATTR_RO(in3_input, rp1_adc, 2);
++static SENSOR_DEVICE_ATTR_RO(in4_input, rp1_adc, 3);
++static SENSOR_DEVICE_ATTR_RO(temp1_input, rp1_adc_temp, 4);
++static SENSOR_DEVICE_ATTR_RO(in1_raw, rp1_adc_raw, 0);
++static SENSOR_DEVICE_ATTR_RO(in2_raw, rp1_adc_raw, 1);
++static SENSOR_DEVICE_ATTR_RO(in3_raw, rp1_adc_raw, 2);
++static SENSOR_DEVICE_ATTR_RO(in4_raw, rp1_adc_raw, 3);
++static SENSOR_DEVICE_ATTR_RO(temp1_raw, rp1_adc_temp_raw, 4);
++
++static struct attribute *rp1_adc_attrs[] = {
++	&sensor_dev_attr_in1_input.dev_attr.attr,
++	&sensor_dev_attr_in2_input.dev_attr.attr,
++	&sensor_dev_attr_in3_input.dev_attr.attr,
++	&sensor_dev_attr_in4_input.dev_attr.attr,
++	&sensor_dev_attr_temp1_input.dev_attr.attr,
++	&sensor_dev_attr_in1_raw.dev_attr.attr,
++	&sensor_dev_attr_in2_raw.dev_attr.attr,
++	&sensor_dev_attr_in3_raw.dev_attr.attr,
++	&sensor_dev_attr_in4_raw.dev_attr.attr,
++	&sensor_dev_attr_temp1_raw.dev_attr.attr,
++	NULL
++};
++
++static umode_t rp1_adc_is_visible(struct kobject *kobj,
++				  struct attribute *attr, int index)
++{
++	return 0444;
++}
++
++static const struct attribute_group rp1_adc_group = {
++	.attrs = rp1_adc_attrs,
++	.is_visible = rp1_adc_is_visible,
++};
++__ATTRIBUTE_GROUPS(rp1_adc);
++
++static int __init rp1_adc_probe(struct platform_device *pdev)
++{
++	struct rp1_adc_data *data;
++	struct regulator *reg;
++	struct clk *clk;
++	int vref_uv, ret;
++
++	data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
++	if (!data)
++		return -ENOMEM;
++
++	spin_lock_init(&data->lock);
++
++	data->base = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(data->base))
++		return PTR_ERR(data->base);
++
++	platform_set_drvdata(pdev, data);
++
++	clk = devm_clk_get(&pdev->dev, NULL);
++	if (IS_ERR(clk))
++		return -ENODEV;
++
++	clk_set_rate(clk, 50000000);
++	clk_prepare_enable(clk);
++
++	reg = devm_regulator_get(&pdev->dev, "vref");
++	if (IS_ERR(reg))
++		return PTR_ERR(reg);
++
++	vref_uv = regulator_get_voltage(reg);
++	data->vref_mv = DIV_ROUND_CLOSEST(vref_uv, 1000);
++
++	data->hwmon_dev =
++	    devm_hwmon_device_register_with_groups(&pdev->dev,
++						   "rp1_adc",
++						   data,
++						   rp1_adc_groups);
++	if (IS_ERR(data->hwmon_dev)) {
++		ret = PTR_ERR(data->hwmon_dev);
++		dev_err(&pdev->dev, "hwmon_device_register failed with %d.\n", ret);
++		goto err_register;
++	}
++
++	/* Disable interrupts */
++	writel(0, data->base + RP1_ADC_INTE);
++
++	/* Enable the block, clearing any sticky error */
++	writel(RP1_ADC_CS_EN | RP1_ADC_CS_ERR_STICKY, data->base + RP1_ADC_CS);
++
++	return 0;
++
++err_register:
++	sysfs_remove_group(&pdev->dev.kobj, &rp1_adc_group);
++
++	return ret;
++}
++
++static void rp1_adc_remove(struct platform_device *pdev)
++{
++	struct rp1_adc_data *data = platform_get_drvdata(pdev);
++
++	hwmon_device_unregister(data->hwmon_dev);
++}
++
++static const struct of_device_id rp1_adc_dt_ids[] = {
++	{ .compatible = "raspberrypi,rp1-adc", },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, rp1_adc_dt_ids);
++
++static struct platform_driver rp1_adc_driver = {
++	.remove		= rp1_adc_remove,
++	.driver		= {
++		.name	= MODULE_NAME,
++		.of_match_table = rp1_adc_dt_ids,
++	},
++};
++
++module_platform_driver_probe(rp1_adc_driver, rp1_adc_probe);
++
++MODULE_DESCRIPTION("RP1 ADC driver");
++MODULE_AUTHOR("Phil Elwell <phil@raspberrypi.com>");
++MODULE_LICENSE("GPL");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0372-mfd-bcm2835-pm-Add-support-for-BCM2712.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0372-mfd-bcm2835-pm-Add-support-for-BCM2712.patch
new file mode 100644
index 00000000..93eda94f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0372-mfd-bcm2835-pm-Add-support-for-BCM2712.patch
@@ -0,0 +1,69 @@
+From 0e083912cbe7b59bbfe6e27eaf8dda9340e09943 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 8 Mar 2023 14:27:58 +0000
+Subject: [PATCH 372/697] mfd: bcm2835-pm: Add support for BCM2712
+
+BCM2712 lacks the "asb" and "rpivid_asb" register ranges, but still
+requires the use of the bcm2835-power driver to reset the V3D block.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/mfd/bcm2835-pm.c | 28 +++++++++++++++++++---------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+--- a/drivers/mfd/bcm2835-pm.c
++++ b/drivers/mfd/bcm2835-pm.c
+@@ -69,12 +69,30 @@ static int bcm2835_pm_get_pdata(struct p
+ 	return 0;
+ }
+ 
++static const struct of_device_id bcm2835_pm_of_match[] = {
++	{ .compatible = "brcm,bcm2835-pm-wdt", },
++	{ .compatible = "brcm,bcm2835-pm", },
++	{ .compatible = "brcm,bcm2711-pm", },
++	{ .compatible = "brcm,bcm2712-pm", .data = (const void *)1},
++	{},
++};
++MODULE_DEVICE_TABLE(of, bcm2835_pm_of_match);
++
+ static int bcm2835_pm_probe(struct platform_device *pdev)
+ {
++	const struct of_device_id *of_id;
+ 	struct device *dev = &pdev->dev;
+ 	struct bcm2835_pm *pm;
++	bool is_2712;
+ 	int ret;
+ 
++	of_id = of_match_node(bcm2835_pm_of_match, pdev->dev.of_node);
++	if (!of_id) {
++		dev_err(&pdev->dev, "Failed to match compatible string\n");
++		return -EINVAL;
++	}
++	is_2712 = !!of_id->data;
++
+ 	pm = devm_kzalloc(dev, sizeof(*pm), GFP_KERNEL);
+ 	if (!pm)
+ 		return -ENOMEM;
+@@ -97,21 +115,13 @@ static int bcm2835_pm_probe(struct platf
+ 	 * bcm2835-pm binding as the key for whether we can reference
+ 	 * the full PM register range and support power domains.
+ 	 */
+-	if (pm->asb)
++	if (pm->asb || is_2712)
+ 		return devm_mfd_add_devices(dev, -1, bcm2835_power_devs,
+ 					    ARRAY_SIZE(bcm2835_power_devs),
+ 					    NULL, 0, NULL);
+ 	return 0;
+ }
+ 
+-static const struct of_device_id bcm2835_pm_of_match[] = {
+-	{ .compatible = "brcm,bcm2835-pm-wdt", },
+-	{ .compatible = "brcm,bcm2835-pm", },
+-	{ .compatible = "brcm,bcm2711-pm", },
+-	{},
+-};
+-MODULE_DEVICE_TABLE(of, bcm2835_pm_of_match);
+-
+ static struct platform_driver bcm2835_pm_driver = {
+ 	.probe		= bcm2835_pm_probe,
+ 	.driver = {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0373-soc-bcm-bcm2835-power-Add-support-for-BCM2712.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0373-soc-bcm-bcm2835-power-Add-support-for-BCM2712.patch
new file mode 100644
index 00000000..36e8ac45
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0373-soc-bcm-bcm2835-power-Add-support-for-BCM2712.patch
@@ -0,0 +1,76 @@
+From 566dacda8c2bec9753a586ce1f967aac8675bc75 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 8 Mar 2023 14:42:48 +0000
+Subject: [PATCH 373/697] soc: bcm: bcm2835-power: Add support for BCM2712
+
+BCM2712 has a PM block but neither ASB nor RPIVID_ASB. Use the absence
+of the "asb" register range to indicate BCM2712 and its different PM
+register range.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/pmdomain/bcm/bcm2835-power.c | 29 ++++++++++++++++++----------
+ 1 file changed, 19 insertions(+), 10 deletions(-)
+
+--- a/drivers/pmdomain/bcm/bcm2835-power.c
++++ b/drivers/pmdomain/bcm/bcm2835-power.c
+@@ -79,6 +79,7 @@
+ #define PM_IMAGE			0x108
+ #define PM_GRAFX			0x10c
+ #define PM_PROC				0x110
++#define PM_GRAFX_2712			0x304
+ #define PM_ENAB				BIT(12)
+ #define PM_ISPRSTN			BIT(8)
+ #define PM_H264RSTN			BIT(7)
+@@ -381,6 +382,9 @@ static int bcm2835_power_pd_power_on(str
+ 		return bcm2835_power_power_on(pd, PM_GRAFX);
+ 
+ 	case BCM2835_POWER_DOMAIN_GRAFX_V3D:
++		if (!power->asb)
++			return bcm2835_asb_power_on(pd, PM_GRAFX_2712,
++						    0, 0, PM_V3DRSTN);
+ 		return bcm2835_asb_power_on(pd, PM_GRAFX,
+ 					    ASB_V3D_M_CTRL, ASB_V3D_S_CTRL,
+ 					    PM_V3DRSTN);
+@@ -447,6 +451,9 @@ static int bcm2835_power_pd_power_off(st
+ 		return bcm2835_power_power_off(pd, PM_GRAFX);
+ 
+ 	case BCM2835_POWER_DOMAIN_GRAFX_V3D:
++		if (!power->asb)
++			return bcm2835_asb_power_off(pd, PM_GRAFX_2712,
++						    0, 0, PM_V3DRSTN);
+ 		return bcm2835_asb_power_off(pd, PM_GRAFX,
+ 					     ASB_V3D_M_CTRL, ASB_V3D_S_CTRL,
+ 					     PM_V3DRSTN);
+@@ -642,19 +649,21 @@ static int bcm2835_power_probe(struct pl
+ 	power->asb = pm->asb;
+ 	power->rpivid_asb = pm->rpivid_asb;
+ 
+-	id = readl(power->asb + ASB_AXI_BRDG_ID);
+-	if (id != BCM2835_BRDG_ID /* "BRDG" */) {
+-		dev_err(dev, "ASB register ID returned 0x%08x\n", id);
+-		return -ENODEV;
+-	}
+-
+-	if (power->rpivid_asb) {
+-		id = readl(power->rpivid_asb + ASB_AXI_BRDG_ID);
++	if (power->asb) {
++		id = readl(power->asb + ASB_AXI_BRDG_ID);
+ 		if (id != BCM2835_BRDG_ID /* "BRDG" */) {
+-			dev_err(dev, "RPiVid ASB register ID returned 0x%08x\n",
+-				     id);
++			dev_err(dev, "ASB register ID returned 0x%08x\n", id);
+ 			return -ENODEV;
+ 		}
++
++		if (power->rpivid_asb) {
++			id = readl(power->rpivid_asb + ASB_AXI_BRDG_ID);
++			if (id != BCM2835_BRDG_ID /* "BRDG" */) {
++				dev_err(dev, "RPiVid ASB register ID returned 0x%08x\n",
++					id);
++				return -ENODEV;
++			}
++		}
+ 	}
+ 
+ 	power->pd_xlate.domains = devm_kcalloc(dev,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0374-spi-gpio-Fix-spi-gpio-to-correctly-implement-sck-idl.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0374-spi-gpio-Fix-spi-gpio-to-correctly-implement-sck-idl.patch
new file mode 100644
index 00000000..426a7837
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0374-spi-gpio-Fix-spi-gpio-to-correctly-implement-sck-idl.patch
@@ -0,0 +1,135 @@
+From 2ba894cc02170c8e98aebe3235f05d26f7046ad3 Mon Sep 17 00:00:00 2001
+From: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+Date: Wed, 1 Mar 2023 17:57:11 +0000
+Subject: [PATCH 374/697] spi: gpio: Fix spi-gpio to correctly implement
+ sck-idle-input
+
+Formerly, if configured using DT, CS GPIOs were driven from spi.c
+and it was possible for CS to be asserted (low) *before* starting
+to drive SCK. CS GPIOs have been brought under control of this
+driver in both ACPI and DT cases, with a fixup for GPIO polarity.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+---
+ drivers/spi/spi-gpio.c | 69 +++++++++++++++++++++++++++++-------------
+ 1 file changed, 48 insertions(+), 21 deletions(-)
+
+--- a/drivers/spi/spi-gpio.c
++++ b/drivers/spi/spi-gpio.c
+@@ -34,8 +34,9 @@ struct spi_gpio {
+ 	struct gpio_desc		*sck;
+ 	struct gpio_desc		*miso;
+ 	struct gpio_desc		*mosi;
+-	bool				sck_idle_input;
+ 	struct gpio_desc		**cs_gpios;
++	bool				sck_idle_input;
++	bool                            cs_dont_invert;
+ };
+ 
+ /*----------------------------------------------------------------------*/
+@@ -232,12 +233,18 @@ static void spi_gpio_chipselect(struct s
+ 			gpiod_set_value_cansleep(spi_gpio->sck, spi->mode & SPI_CPOL);
+ 	}
+ 
+-	/* Drive chip select line, if we have one */
++	/*
++	 * Drive chip select line, if we have one.
++	 * SPI chip selects are normally active-low, but when
++	 * cs_dont_invert is set, we assume their polarity is
++	 * controlled by the GPIO, and write '1' to assert.
++	 */
+ 	if (spi_gpio->cs_gpios) {
+ 		struct gpio_desc *cs = spi_gpio->cs_gpios[spi_get_chipselect(spi, 0)];
++		int val = ((spi->mode & SPI_CS_HIGH) || spi_gpio->cs_dont_invert) ?
++			is_active : !is_active;
+ 
+-		/* SPI chip selects are normally active-low */
+-		gpiod_set_value_cansleep(cs, (spi->mode & SPI_CS_HIGH) ? is_active : !is_active);
++		gpiod_set_value_cansleep(cs, val);
+ 	}
+ 
+ 	if (spi_gpio->sck_idle_input && !is_active)
+@@ -261,11 +268,14 @@ static int spi_gpio_setup(struct spi_dev
+ 	/*
+ 	 * The CS GPIOs have already been
+ 	 * initialized from the descriptor lookup.
++	 * Here we set them to the non-asserted state.
+ 	 */
+ 	if (spi_gpio->cs_gpios) {
+ 		cs = spi_gpio->cs_gpios[spi_get_chipselect(spi, 0)];
+ 		if (!spi->controller_state && cs) {
+-			ret = gpiod_direction_output(cs, !(spi->mode & SPI_CS_HIGH));
++			ret = gpiod_direction_output(cs,
++							!((spi->mode & SPI_CS_HIGH) ||
++							   spi_gpio->cs_dont_invert));
+ 			if (ret)
+ 				return ret;
+ 		}
+@@ -342,13 +352,43 @@ static int spi_gpio_request(struct devic
+ 	return PTR_ERR_OR_ZERO(spi_gpio->sck);
+ }
+ 
++/*
++ * In order to implement "sck-idle-input" (which requires SCK
++ * direction and CS level to be switched in a particular order),
++ * we need to control GPIO chip selects from within this driver.
++ */
++
++static int spi_gpio_probe_get_cs_gpios(struct device *dev,
++				       struct spi_controller *master,
++				       bool gpio_defines_polarity)
++{
++	int i;
++	struct spi_gpio *spi_gpio = spi_controller_get_devdata(master);
++
++	spi_gpio->cs_dont_invert = gpio_defines_polarity;
++	spi_gpio->cs_gpios = devm_kcalloc(dev, master->num_chipselect,
++					  sizeof(*spi_gpio->cs_gpios),
++					  GFP_KERNEL);
++	if (!spi_gpio->cs_gpios)
++		return -ENOMEM;
++
++	for (i = 0; i < master->num_chipselect; i++) {
++		spi_gpio->cs_gpios[i] =
++			devm_gpiod_get_index(dev, "cs", i,
++					     gpio_defines_polarity ?
++						GPIOD_OUT_LOW : GPIOD_OUT_HIGH);
++		if (IS_ERR(spi_gpio->cs_gpios[i]))
++			return PTR_ERR(spi_gpio->cs_gpios[i]);
++	}
++
++	return 0;
++}
++
+ static int spi_gpio_probe_pdata(struct platform_device *pdev,
+ 				struct spi_controller *host)
+ {
+ 	struct device *dev = &pdev->dev;
+ 	struct spi_gpio_platform_data *pdata = dev_get_platdata(dev);
+-	struct spi_gpio *spi_gpio = spi_controller_get_devdata(host);
+-	int i;
+ 
+ #ifdef GENERIC_BITBANG
+ 	if (!pdata || !pdata->num_chipselect)
+@@ -360,20 +400,7 @@ static int spi_gpio_probe_pdata(struct p
+ 	 */
+ 	host->num_chipselect = pdata->num_chipselect ?: 1;
+ 
+-	spi_gpio->cs_gpios = devm_kcalloc(dev, host->num_chipselect,
+-					  sizeof(*spi_gpio->cs_gpios),
+-					  GFP_KERNEL);
+-	if (!spi_gpio->cs_gpios)
+-		return -ENOMEM;
+-
+-	for (i = 0; i < host->num_chipselect; i++) {
+-		spi_gpio->cs_gpios[i] = devm_gpiod_get_index(dev, "cs", i,
+-							     GPIOD_OUT_HIGH);
+-		if (IS_ERR(spi_gpio->cs_gpios[i]))
+-			return PTR_ERR(spi_gpio->cs_gpios[i]);
+-	}
+-
+-	return 0;
++	return spi_gpio_probe_get_cs_gpios(dev, host, false);
+ }
+ 
+ static int spi_gpio_probe(struct platform_device *pdev)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0375-spi-spi-gpio-Implement-spidelay-when-requested-bit-r.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0375-spi-spi-gpio-Implement-spidelay-when-requested-bit-r.patch
new file mode 100644
index 00000000..23e8b5b8
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0375-spi-spi-gpio-Implement-spidelay-when-requested-bit-r.patch
@@ -0,0 +1,49 @@
+From ac9d08de269bb1f83ed04a3c0a8243071ebcb823 Mon Sep 17 00:00:00 2001
+From: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+Date: Mon, 4 Sep 2023 10:57:47 +0100
+Subject: [PATCH 375/697] spi: spi-gpio: Implement spidelay when requested bit
+ rate <= 1 Mbps
+
+Formerly the delay was omitted as bit-banged SPI seldom achieved
+even one Mbit/s; but some modern platforms can run faster, and
+some SPI devices may need to be clocked slower.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+---
+ drivers/spi/spi-gpio.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/drivers/spi/spi-gpio.c
++++ b/drivers/spi/spi-gpio.c
+@@ -11,6 +11,7 @@
+ #include <linux/module.h>
+ #include <linux/platform_device.h>
+ #include <linux/property.h>
++#include <linux/delay.h>
+ 
+ #include <linux/spi/spi.h>
+ #include <linux/spi/spi_bitbang.h>
+@@ -110,12 +111,18 @@ static inline int getmiso(const struct s
+ }
+ 
+ /*
+- * NOTE:  this clocks "as fast as we can".  It "should" be a function of the
+- * requested device clock.  Software overhead means we usually have trouble
+- * reaching even one Mbit/sec (except when we can inline bitops), so for now
+- * we'll just assume we never need additional per-bit slowdowns.
++ * Generic bit-banged GPIO SPI might free-run at something in the range
++ * 1Mbps ~ 10Mbps (depending on the platform), and some SPI devices may
++ * need to be clocked at a lower rate. ndelay() is often implemented by
++ * udelay() with rounding up, so do the delay only for nsecs >= 500
++ * (<= 1Mbps). The conditional test adds a small overhead.
+  */
+-#define spidelay(nsecs)	do {} while (0)
++
++static inline void spidelay(unsigned long nsecs)
++{
++	if (nsecs >= 500)
++		ndelay(nsecs);
++}
+ 
+ #include "spi-bitbang-txrx.h"
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0376-drm-v3d-add-brcm-2712-v3d-as-a-compatible-V3D-device.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0376-drm-v3d-add-brcm-2712-v3d-as-a-compatible-V3D-device.patch
new file mode 100644
index 00000000..fc900f43
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0376-drm-v3d-add-brcm-2712-v3d-as-a-compatible-V3D-device.patch
@@ -0,0 +1,19 @@
+From 5f36a4643009d4327265cd76c67e1d59e1209865 Mon Sep 17 00:00:00 2001
+From: Iago Toral Quiroga <itoral@igalia.com>
+Date: Thu, 2 Mar 2023 11:54:45 +0100
+Subject: [PATCH 376/697] drm/v3d: add brcm,2712-v3d as a compatible V3D device
+
+---
+ drivers/gpu/drm/v3d/v3d_drv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/v3d/v3d_drv.c
++++ b/drivers/gpu/drm/v3d/v3d_drv.c
+@@ -249,6 +249,7 @@ static const struct drm_driver v3d_drm_d
+ };
+ 
+ static const struct of_device_id v3d_of_match[] = {
++	{ .compatible = "brcm,2712-v3d" },
+ 	{ .compatible = "brcm,2711-v3d" },
+ 	{ .compatible = "brcm,2712-v3d" },
+ 	{ .compatible = "brcm,7268-v3d" },
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0377-dt-bindings-gpu-v3d-Add-BCM2712-to-compatibility-lis.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0377-dt-bindings-gpu-v3d-Add-BCM2712-to-compatibility-lis.patch
new file mode 100644
index 00000000..29ca06a4
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0377-dt-bindings-gpu-v3d-Add-BCM2712-to-compatibility-lis.patch
@@ -0,0 +1,20 @@
+From 9b2aed3f8ed7e7db2a0bf731a09fa8298040d26f Mon Sep 17 00:00:00 2001
+From: Iago Toral Quiroga <itoral@igalia.com>
+Date: Thu, 2 Mar 2023 11:56:52 +0100
+Subject: [PATCH 377/697] dt-bindings: gpu: v3d: Add BCM2712 to compatibility
+ list
+
+---
+ Documentation/devicetree/bindings/gpu/brcm,bcm-v3d.yaml | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/Documentation/devicetree/bindings/gpu/brcm,bcm-v3d.yaml
++++ b/Documentation/devicetree/bindings/gpu/brcm,bcm-v3d.yaml
+@@ -16,6 +16,7 @@ properties:
+ 
+   compatible:
+     enum:
++      - brcm,2712-v3d
+       - brcm,2711-v3d
+       - brcm,2712-v3d
+       - brcm,7268-v3d
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0378-dmaengine-bcm2835-Add-BCM2712-support.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0378-dmaengine-bcm2835-Add-BCM2712-support.patch
new file mode 100644
index 00000000..04d7397b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0378-dmaengine-bcm2835-Add-BCM2712-support.patch
@@ -0,0 +1,36 @@
+From 9a47325c8376ba07ee6a38c0ecf239756aca7af9 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 8 Mar 2023 16:53:38 +0000
+Subject: [PATCH 378/697] dmaengine: bcm2835: Add BCM2712 support
+
+BCM2712 has 6 40-bit channels - DMA6 to DMA11. Add a new compatible
+string to indicate that the current platform is BCM2712.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/dma/bcm2835-dma.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -331,6 +331,12 @@ static const struct bcm2835_dma_cfg_data
+ 	.dma_mask = DMA_BIT_MASK(36),
+ };
+ 
++static const struct bcm2835_dma_cfg_data bcm2712_dma_cfg = {
++	.chan_40bit_mask = BIT(6) | BIT(7) | BIT(8) | BIT(9) |
++				 BIT(10) | BIT(11),
++	.dma_mask = DMA_BIT_MASK(40),
++};
++
+ static inline size_t bcm2835_dma_max_frame_length(struct bcm2835_chan *c)
+ {
+ 	/* lite and normal channels have different max frame length */
+@@ -1211,6 +1217,7 @@ static void bcm2835_dma_free(struct bcm2
+ static const struct of_device_id bcm2835_dma_of_match[] = {
+ 	{ .compatible = "brcm,bcm2835-dma", .data = &bcm2835_dma_cfg },
+ 	{ .compatible = "brcm,bcm2711-dma", .data = &bcm2711_dma_cfg },
++	{ .compatible = "brcm,bcm2712-dma", .data = &bcm2712_dma_cfg },
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(of, bcm2835_dma_of_match);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0379-dmaengine-bcm2835-HACK-Support-DMA-Lite-channels.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0379-dmaengine-bcm2835-HACK-Support-DMA-Lite-channels.patch
new file mode 100644
index 00000000..45522cd2
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0379-dmaengine-bcm2835-HACK-Support-DMA-Lite-channels.patch
@@ -0,0 +1,90 @@
+From df02b475178d3d9ab2eaa41dd8868f16606f7f69 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Thu, 13 Apr 2023 16:52:19 +0200
+Subject: [PATCH 379/697] dmaengine: bcm2835: HACK: Support DMA-Lite channels
+
+The BCM2712 has a DMA-Lite controller that is basically a BCM2835-style
+DMA controller that supports 40 bits DMA addresses.
+
+We need it for HDMI audio to work, but this breaks BCM2835-38 so we
+should rework this later.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+
+dmaengine: bcm2835: Fix dma driver for BCM2835-38
+
+The previous commit broke support on older devices.
+Make the breaking parts of patch conditional on
+the device being used.
+
+Fixes: 6e1856ac7c39 ("dmaengine: bcm2835: HACK: Support DMA-Lite channels")
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/dma/bcm2835-dma.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -102,6 +102,7 @@ struct bcm2835_chan {
+ 
+ 	bool is_lite_channel;
+ 	bool is_40bit_channel;
++	bool is_2712;
+ };
+ 
+ struct bcm2835_desc {
+@@ -550,7 +551,11 @@ static struct bcm2835_desc *bcm2835_dma_
+ 			control_block->info = info;
+ 			control_block->src = src;
+ 			control_block->dst = dst;
+-			control_block->stride = 0;
++			if (c->is_2712)
++				control_block->stride = (upper_32_bits(dst) << 8) |
++							upper_32_bits(src);
++			else
++				control_block->stride = 0;
+ 			control_block->next = 0;
+ 		}
+ 
+@@ -575,7 +580,8 @@ static struct bcm2835_desc *bcm2835_dma_
+ 			 d->cb_list[frame - 1].cb)->next_cb =
+ 				to_bcm2711_cbaddr(cb_entry->paddr);
+ 		if (frame && !c->is_40bit_channel)
+-			d->cb_list[frame - 1].cb->next = cb_entry->paddr;
++			d->cb_list[frame - 1].cb->next = c->is_2712 ?
++			to_bcm2711_cbaddr(cb_entry->paddr) : cb_entry->paddr;
+ 
+ 		/* update src and dst and length */
+ 		if (src && (info & BCM2835_DMA_S_INC)) {
+@@ -760,7 +766,10 @@ static void bcm2835_dma_start_desc(struc
+ 		writel(BCM2711_DMA40_ACTIVE | BCM2711_DMA40_PROT | BCM2711_DMA40_CS_FLAGS(c->dreq),
+ 		       c->chan_base + BCM2711_DMA40_CS);
+ 	} else {
+-		writel(d->cb_list[0].paddr, c->chan_base + BCM2835_DMA_ADDR);
++		writel(BIT(31), c->chan_base + BCM2835_DMA_CS);
++
++		writel(c->is_2712 ? to_bcm2711_cbaddr(d->cb_list[0].paddr) : d->cb_list[0].paddr,
++		       c->chan_base + BCM2835_DMA_ADDR);
+ 		writel(BCM2835_DMA_ACTIVE | BCM2835_DMA_CS_FLAGS(c->dreq),
+ 		       c->chan_base + BCM2835_DMA_CS);
+ 	}
+@@ -1129,7 +1138,8 @@ static struct dma_async_tx_descriptor *b
+ 		 d->cb_list[frames - 1].cb)->next_cb =
+ 			to_bcm2711_cbaddr(d->cb_list[0].paddr);
+ 	else
+-		d->cb_list[d->frames - 1].cb->next = d->cb_list[0].paddr;
++		d->cb_list[d->frames - 1].cb->next = c->is_2712 ?
++		to_bcm2711_cbaddr(d->cb_list[0].paddr) : d->cb_list[0].paddr;
+ 
+ 	return vchan_tx_prep(&c->vc, &d->vd, flags);
+ }
+@@ -1196,6 +1206,8 @@ static int bcm2835_dma_chan_init(struct
+ 	else if (readl(c->chan_base + BCM2835_DMA_DEBUG) &
+ 		 BCM2835_DMA_DEBUG_LITE)
+ 		c->is_lite_channel = true;
++	if (d->cfg_data->dma_mask == DMA_BIT_MASK(40))
++		c->is_2712 = true;
+ 
+ 	return 0;
+ }
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0380-dmaengine-bcm2835-Rename-to_bcm2711_cbaddr-to-to_40b.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0380-dmaengine-bcm2835-Rename-to_bcm2711_cbaddr-to-to_40b.patch
new file mode 100644
index 00000000..f09704cc
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0380-dmaengine-bcm2835-Rename-to_bcm2711_cbaddr-to-to_40b.patch
@@ -0,0 +1,68 @@
+From 6dfb8956f57e51b1727551bb69b6a03207129a1a Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Thu, 25 May 2023 14:48:28 +0100
+Subject: [PATCH 380/697] dmaengine: bcm2835: Rename to_bcm2711_cbaddr to
+ to_40bit_cbaddr
+
+As the shifted address also applies to bcm2712,
+give the function a more specific name.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/dma/bcm2835-dma.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -391,7 +391,7 @@ static inline uint32_t to_bcm2711_dsti(u
+ 	       BCM2711_DMA40_BURST_LEN(BCM2835_DMA_GET_BURST_LENGTH(info));
+ }
+ 
+-static inline uint32_t to_bcm2711_cbaddr(dma_addr_t addr)
++static inline uint32_t to_40bit_cbaddr(dma_addr_t addr)
+ {
+ 	BUG_ON(addr & 0x1f);
+ 	return (addr >> 5);
+@@ -578,10 +578,10 @@ static struct bcm2835_desc *bcm2835_dma_
+ 		if (frame && c->is_40bit_channel)
+ 			((struct bcm2711_dma40_scb *)
+ 			 d->cb_list[frame - 1].cb)->next_cb =
+-				to_bcm2711_cbaddr(cb_entry->paddr);
++				to_40bit_cbaddr(cb_entry->paddr);
+ 		if (frame && !c->is_40bit_channel)
+ 			d->cb_list[frame - 1].cb->next = c->is_2712 ?
+-			to_bcm2711_cbaddr(cb_entry->paddr) : cb_entry->paddr;
++			to_40bit_cbaddr(cb_entry->paddr) : cb_entry->paddr;
+ 
+ 		/* update src and dst and length */
+ 		if (src && (info & BCM2835_DMA_S_INC)) {
+@@ -761,14 +761,14 @@ static void bcm2835_dma_start_desc(struc
+ 	c->desc = d = to_bcm2835_dma_desc(&vd->tx);
+ 
+ 	if (c->is_40bit_channel) {
+-		writel(to_bcm2711_cbaddr(d->cb_list[0].paddr),
++		writel(to_40bit_cbaddr(d->cb_list[0].paddr),
+ 		       c->chan_base + BCM2711_DMA40_CB);
+ 		writel(BCM2711_DMA40_ACTIVE | BCM2711_DMA40_PROT | BCM2711_DMA40_CS_FLAGS(c->dreq),
+ 		       c->chan_base + BCM2711_DMA40_CS);
+ 	} else {
+ 		writel(BIT(31), c->chan_base + BCM2835_DMA_CS);
+ 
+-		writel(c->is_2712 ? to_bcm2711_cbaddr(d->cb_list[0].paddr) : d->cb_list[0].paddr,
++		writel(c->is_2712 ? to_40bit_cbaddr(d->cb_list[0].paddr) : d->cb_list[0].paddr,
+ 		       c->chan_base + BCM2835_DMA_ADDR);
+ 		writel(BCM2835_DMA_ACTIVE | BCM2835_DMA_CS_FLAGS(c->dreq),
+ 		       c->chan_base + BCM2835_DMA_CS);
+@@ -1136,10 +1136,10 @@ static struct dma_async_tx_descriptor *b
+ 	if (c->is_40bit_channel)
+ 		((struct bcm2711_dma40_scb *)
+ 		 d->cb_list[frames - 1].cb)->next_cb =
+-			to_bcm2711_cbaddr(d->cb_list[0].paddr);
++			to_40bit_cbaddr(d->cb_list[0].paddr);
+ 	else
+ 		d->cb_list[d->frames - 1].cb->next = c->is_2712 ?
+-		to_bcm2711_cbaddr(d->cb_list[0].paddr) : d->cb_list[0].paddr;
++		to_40bit_cbaddr(d->cb_list[0].paddr) : d->cb_list[0].paddr;
+ 
+ 	return vchan_tx_prep(&c->vc, &d->vd, flags);
+ }
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0381-drivers-iommu-Add-BCM2712-IOMMU.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0381-drivers-iommu-Add-BCM2712-IOMMU.patch
new file mode 100644
index 00000000..095d5ad8
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0381-drivers-iommu-Add-BCM2712-IOMMU.patch
@@ -0,0 +1,884 @@
+From 32c1cb540dfb316b93e79d9bbafa3f8cc478c875 Mon Sep 17 00:00:00 2001
+From: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+Date: Thu, 11 May 2023 16:37:34 +0100
+Subject: [PATCH 381/697] drivers: iommu: Add BCM2712 IOMMU
+
+Add a driver for BCM2712 IOMMUs.
+There is a small driver for the Shared IOMMU TLB Cache.
+Each IOMMU instance is a separate device.
+
+IOMMUs are set up with a "pass-through" range covering
+the lowest 40BGytes (which should cover all of SDRAM)
+for the benefit of non-IOMMU-aware devices that share
+a physical IOMMU; and translation for addresses in the
+range 40GB to 42GB.
+
+An optional parameter adds a DMA offset (which otherwise
+would be lost?) to virtual addresses for DMA masters on a
+bus such as PCIe.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+
+iommu: bcm2712-iommu: Map and unmap multiple pages in a single call
+
+For efficiency, the map_pages() and unmap_pages() calls now pay
+attention to their "count" argument.
+
+Remove a special case for a "pass-through" address range, which
+the DMA/IOMMU subsystem isn't told exists and should never use.
+
+Fix a bug where we omitted to set *mapped to 0 in error cases.
+Minor style fixes and tidying.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+
+iommu/bcm2712: don't allow building as module
+
+Since bcm2712-iommu{,-cache}.c doesn't have usual module descriptors
+such as `MODULE_LICENSE`, configuring this as 'M' fails the build with
+`ERROR: modpost: missing MODULE_LICENSE() in <...>/bcm2712-iommu.o`.
+Since it seems like the code is not intended to be built as a module
+anyway (it registers the driver with `builtin_platform_driver()`), don't
+allow building this code as a module.
+
+Signed-off-by: Ratchanan Srirattanamet <peathot@hotmail.com>
+---
+ drivers/iommu/Kconfig               |   7 +
+ drivers/iommu/Makefile              |   1 +
+ drivers/iommu/bcm2712-iommu-cache.c |  77 ++++
+ drivers/iommu/bcm2712-iommu.c       | 677 ++++++++++++++++++++++++++++
+ drivers/iommu/bcm2712-iommu.h       |  45 ++
+ 5 files changed, 807 insertions(+)
+ create mode 100644 drivers/iommu/bcm2712-iommu-cache.c
+ create mode 100644 drivers/iommu/bcm2712-iommu.c
+ create mode 100644 drivers/iommu/bcm2712-iommu.h
+
+--- a/drivers/iommu/Kconfig
++++ b/drivers/iommu/Kconfig
+@@ -519,4 +519,11 @@ config SPRD_IOMMU
+ 
+ 	  Say Y here if you want to use the multimedia devices listed above.
+ 
++config BCM2712_IOMMU
++       bool "BCM2712 IOMMU driver"
++       depends on ARM64 && ARCH_BCM
++       select IOMMU_API
++       help
++	 IOMMU driver for BCM2712
++
+ endif # IOMMU_SUPPORT
+--- a/drivers/iommu/Makefile
++++ b/drivers/iommu/Makefile
+@@ -30,3 +30,4 @@ obj-$(CONFIG_IOMMU_SVA) += iommu-sva.o
+ obj-$(CONFIG_IOMMU_IOPF) += io-pgfault.o
+ obj-$(CONFIG_SPRD_IOMMU) += sprd-iommu.o
+ obj-$(CONFIG_APPLE_DART) += apple-dart.o
++obj-$(CONFIG_BCM2712_IOMMU) += bcm2712-iommu.o bcm2712-iommu-cache.o
+--- /dev/null
++++ b/drivers/iommu/bcm2712-iommu-cache.c
+@@ -0,0 +1,77 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * IOMMU driver for BCM2712
++ *
++ * Copyright (c) 2023 Raspberry Pi Ltd.
++ */
++
++#include "bcm2712-iommu.h"
++
++#include <linux/err.h>
++#include <linux/of_platform.h>
++#include <linux/platform_device.h>
++#include <linux/spinlock.h>
++
++#define MMUC_CONTROL_ENABLE   1
++#define MMUC_CONTROL_FLUSH    2
++#define MMUC_CONTROL_FLUSHING 4
++
++void bcm2712_iommu_cache_flush(struct bcm2712_iommu_cache *cache)
++{
++	unsigned long flags;
++	int i;
++
++	spin_lock_irqsave(&cache->hw_lock, flags);
++	if (cache->reg_base) {
++		/* Enable and flush the TLB cache */
++		writel(MMUC_CONTROL_ENABLE | MMUC_CONTROL_FLUSH,
++		       cache->reg_base);
++
++		/* Wait for flush to complete: it should be very quick */
++		for (i = 0; i < 1024; i++) {
++			if (!(MMUC_CONTROL_FLUSHING & readl(cache->reg_base)))
++				break;
++			cpu_relax();
++		}
++	}
++	spin_unlock_irqrestore(&cache->hw_lock, flags);
++}
++
++static int bcm2712_iommu_cache_probe(struct platform_device *pdev)
++{
++	struct bcm2712_iommu_cache *cache;
++
++	dev_info(&pdev->dev, __func__);
++	cache = devm_kzalloc(&pdev->dev, sizeof(*cache), GFP_KERNEL);
++	if (!cache)
++		return -ENOMEM;
++
++	cache->dev = &pdev->dev;
++	platform_set_drvdata(pdev, cache);
++	spin_lock_init(&cache->hw_lock);
++
++	/* Get IOMMUC registers; we only use the first register (IOMMUC_CTRL) */
++	cache->reg_base = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(cache->reg_base)) {
++		dev_err(&pdev->dev, "Failed to get IOMMU Cache registers address\n");
++		cache->reg_base = NULL;
++	}
++	return 0;
++}
++
++static const struct of_device_id bcm2712_iommu_cache_of_match[] = {
++	{
++		. compatible = "brcm,bcm2712-iommuc"
++	},
++	{ /* sentinel */ },
++};
++
++static struct platform_driver bcm2712_iommu_cache_driver = {
++	.probe = bcm2712_iommu_cache_probe,
++	.driver = {
++		.name = "bcm2712-iommu-cache",
++		.of_match_table = bcm2712_iommu_cache_of_match
++	},
++};
++
++builtin_platform_driver(bcm2712_iommu_cache_driver);
+--- /dev/null
++++ b/drivers/iommu/bcm2712-iommu.c
+@@ -0,0 +1,677 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * IOMMU driver for BCM2712
++ *
++ * Copyright (c) 2023 Raspberry Pi Ltd.
++ */
++
++#include "bcm2712-iommu.h"
++
++#include <linux/dma-mapping.h>
++#include <linux/err.h>
++#include <linux/iommu.h>
++#include <linux/of_platform.h>
++#include <linux/platform_device.h>
++#include <linux/spinlock.h>
++
++#define MMU_WR(off, val)   writel(val, mmu->reg_base + (off))
++#define MMU_RD(off)        readl(mmu->reg_base + (off))
++
++#define domain_to_mmu(d) (container_of(d, struct bcm2712_iommu_domain, base)->mmu)
++
++#define MMMU_CTRL_OFFSET                       0x00
++#define MMMU_CTRL_CAP_EXCEEDED                 BIT(27)
++#define MMMU_CTRL_CAP_EXCEEDED_ABORT_EN        BIT(26)
++#define MMMU_CTRL_CAP_EXCEEDED_INT_EN          BIT(25)
++#define MMMU_CTRL_CAP_EXCEEDED_EXCEPTION_EN    BIT(24)
++#define MMMU_CTRL_PT_INVALID                   BIT(20)
++#define MMMU_CTRL_PT_INVALID_ABORT_EN          BIT(19)
++#define MMMU_CTRL_PT_INVALID_EXCEPTION_EN      BIT(18)
++#define MMMU_CTRL_PT_INVALID_EN                BIT(17)
++#define MMMU_CTRL_WRITE_VIOLATION              BIT(12)
++#define MMMU_CTRL_WRITE_VIOLATION_ABORT_EN     BIT(11)
++#define MMMU_CTRL_WRITE_VIOLATION_INT_EN       BIT(10)
++#define MMMU_CTRL_WRITE_VIOLATION_EXCEPTION_EN BIT(9)
++#define MMMU_CTRL_BYPASS                       BIT(8)
++#define MMMU_CTRL_TLB_CLEARING                 BIT(7)
++#define MMMU_CTRL_STATS_CLEAR                  BIT(3)
++#define MMMU_CTRL_TLB_CLEAR                    BIT(2)
++#define MMMU_CTRL_STATS_ENABLE                 BIT(1)
++#define MMMU_CTRL_ENABLE                       BIT(0)
++
++#define MMMU_PT_PA_BASE_OFFSET                 0x04
++
++#define MMMU_HIT_OFFSET                        0x08
++#define MMMU_MISS_OFFSET                       0x0C
++#define MMMU_STALL_OFFSET                      0x10
++
++#define MMMU_ADDR_CAP_OFFSET                   0x14
++#define MMMU_ADDR_CAP_ENABLE                   BIT(31)
++#define ADDR_CAP_SHIFT 28 /* ADDR_CAP is defined to be in 256 MByte units */
++
++#define MMMU_SHOOT_DOWN_OFFSET                 0x18
++#define MMMU_SHOOT_DOWN_SHOOTING               BIT(31)
++#define MMMU_SHOOT_DOWN_SHOOT                  BIT(30)
++
++#define MMMU_BYPASS_START_OFFSET               0x1C
++#define MMMU_BYPASS_START_ENABLE               BIT(31)
++#define MMMU_BYPASS_START_INVERT               BIT(30)
++
++#define MMMU_BYPASS_END_OFFSET                 0x20
++#define MMMU_BYPASS_END_ENABLE                 BIT(31)
++
++#define MMMU_MISC_OFFSET                       0x24
++#define MMMU_MISC_SINGLE_TABLE                 BIT(31)
++
++#define MMMU_ILLEGAL_ADR_OFFSET                0x30
++#define MMMU_ILLEGAL_ADR_ENABLE                BIT(31)
++
++#define MMMU_DEBUG_INFO_OFFSET                 0x38
++#define MMMU_DEBUG_INFO_VERSION_MASK           0x0000000Fu
++#define MMMU_DEBUG_INFO_VA_WIDTH_MASK          0x000000F0u
++#define MMMU_DEBUG_INFO_PA_WIDTH_MASK          0x00000F00u
++#define MMMU_DEBUG_INFO_BIGPAGE_WIDTH_MASK     0x000FF000u
++#define MMMU_DEBUG_INFO_SUPERPAGE_WIDTH_MASK   0x0FF00000u
++#define MMMU_DEBUG_INFO_BYPASS_4M              BIT(28)
++#define MMMU_DEBUG_INFO_BYPASS                 BIT(29)
++
++#define MMMU_PTE_PAGESIZE_MASK                 0xC0000000u
++#define MMMU_PTE_WRITEABLE                     BIT(29)
++#define MMMU_PTE_VALID                         BIT(28)
++
++/*
++ * BCM2712 IOMMU is organized around 4Kbyte pages (MMU_PAGE_SIZE).
++ * Linux PAGE_SIZE must not be smaller but may be larger (e.g. 4K, 16K).
++ *
++ * Unlike many larger MMUs, this one uses a 4-byte word size, allowing
++ * 1024 entries within each 4K table page, and two-level translation.
++ *
++ * Let's allocate enough table space for 2GB of translated memory (IOVA).
++ * This requires 512 4K pages (2MB) of level-2 tables, one page of
++ * top-level table (only half-filled in this particular configuration),
++ * plus one "default" page to catch illegal requests.
++ *
++ * The translated virtual address region is between 40GB and 42GB;
++ * addresses below this range pass straight through to the SDRAM.
++ *
++ * Currently we assume a 1:1:1 correspondence of IOMMU, group and domain.
++ */
++
++#define MMU_PAGE_SHIFT    12
++#define MMU_PAGE_SIZE     BIT(MMU_PAGE_SHIFT)
++
++#define PAGEWORDS_SHIFT   (MMU_PAGE_SHIFT - 2)
++#define HUGEPAGE_SHIFT    (MMU_PAGE_SHIFT + PAGEWORDS_SHIFT)
++#define L1_CHUNK_SHIFT    (MMU_PAGE_SHIFT + 2 * PAGEWORDS_SHIFT)
++
++#define APERTURE_BASE     (40ul << 30)
++#define APERTURE_SIZE     (2ul << 30)
++#define APERTURE_TOP      (APERTURE_BASE + APERTURE_SIZE)
++#define TRANSLATED_PAGES  (APERTURE_SIZE >> MMU_PAGE_SHIFT)
++#define L2_PAGES          (TRANSLATED_PAGES >> PAGEWORDS_SHIFT)
++#define TABLES_ALLOC_SIZE (L2_PAGES * MMU_PAGE_SIZE + 2 * PAGE_SIZE)
++
++static void bcm2712_iommu_init(struct bcm2712_iommu *mmu)
++{
++	unsigned int i, bypass_shift;
++	struct sg_dma_page_iter it;
++	u32 u = MMU_RD(MMMU_DEBUG_INFO_OFFSET);
++
++	/*
++	 * Check IOMMU version and hardware configuration.
++	 * This driver is for VC IOMMU version >= 4 (with 2-level tables)
++	 * and assumes at least 36 bits of virtual and physical address space.
++	 * Bigpage and superpage sizes are typically 64K and 1M, but may vary
++	 * (hugepage size is fixed at 4M, the range covered by an L2 page).
++	 */
++	dev_info(mmu->dev, "%s: DEBUG_INFO = 0x%08x\n", __func__, u);
++	WARN_ON(FIELD_GET(MMMU_DEBUG_INFO_VERSION_MASK, u) < 4 ||
++		FIELD_GET(MMMU_DEBUG_INFO_VA_WIDTH_MASK, u) < 6 ||
++		FIELD_GET(MMMU_DEBUG_INFO_PA_WIDTH_MASK, u) < 6 ||
++		!(u & MMMU_DEBUG_INFO_BYPASS));
++
++	mmu->bigpage_mask =
++		((1u << FIELD_GET(MMMU_DEBUG_INFO_BIGPAGE_WIDTH_MASK, u)) - 1u) << MMU_PAGE_SHIFT;
++	mmu->superpage_mask =
++		((1u << FIELD_GET(MMMU_DEBUG_INFO_SUPERPAGE_WIDTH_MASK, u)) - 1u) << MMU_PAGE_SHIFT;
++	bypass_shift = (u & MMMU_DEBUG_INFO_BYPASS_4M) ?
++		HUGEPAGE_SHIFT : ADDR_CAP_SHIFT;
++
++	/* Disable MMU and clear sticky flags; meanwhile flush the TLB */
++	MMU_WR(MMMU_CTRL_OFFSET,
++	       MMMU_CTRL_CAP_EXCEEDED    |
++	       MMMU_CTRL_PT_INVALID      |
++	       MMMU_CTRL_WRITE_VIOLATION |
++	       MMMU_CTRL_STATS_CLEAR     |
++	       MMMU_CTRL_TLB_CLEAR);
++
++	/*
++	 * Put MMU into 2-level mode; set address cap and "bypass" range
++	 * (note that some of these registers have unintuitive off-by-ones).
++	 * Addresses below APERTURE_BASE are passed unchanged: this is
++	 * useful for blocks which share an IOMMU with other blocks
++	 * whose drivers are not IOMMU-aware.
++	 */
++	MMU_WR(MMMU_MISC_OFFSET,
++	       MMU_RD(MMMU_MISC_OFFSET) & ~MMMU_MISC_SINGLE_TABLE);
++	MMU_WR(MMMU_ADDR_CAP_OFFSET,
++	       MMMU_ADDR_CAP_ENABLE +
++	       (APERTURE_TOP >> ADDR_CAP_SHIFT) - 1);
++	if (APERTURE_BASE > 0) {
++		MMU_WR(MMMU_BYPASS_START_OFFSET,
++		       MMMU_BYPASS_START_ENABLE + MMMU_BYPASS_START_INVERT +
++		       (APERTURE_BASE >> bypass_shift) - 1);
++		MMU_WR(MMMU_BYPASS_END_OFFSET,
++		       MMMU_BYPASS_END_ENABLE +
++		       (APERTURE_TOP >> bypass_shift));
++	} else {
++		MMU_WR(MMMU_BYPASS_START_OFFSET, 0);
++		MMU_WR(MMMU_BYPASS_END_OFFSET, 0);
++	}
++
++	/* Ensure tables are zeroed (which marks all pages as invalid) */
++	dma_sync_sgtable_for_cpu(mmu->dev, mmu->sgt, DMA_TO_DEVICE);
++	memset(mmu->tables, 0, TABLES_ALLOC_SIZE);
++	mmu->nmapped_pages = 0;
++
++	/* Initialize the high-level table to point to the low-level pages */
++	__sg_page_iter_start(&it.base, mmu->sgt->sgl, mmu->sgt->nents, 0);
++	for (i = 0; i < L2_PAGES; i++) {
++		if (!(i % (PAGE_SIZE / MMU_PAGE_SIZE))) {
++			__sg_page_iter_dma_next(&it);
++			u = (sg_page_iter_dma_address(&it) >> MMU_PAGE_SHIFT);
++		} else {
++			u++;
++		}
++		mmu->tables[TRANSLATED_PAGES + i] = MMMU_PTE_VALID + u;
++	}
++
++	/*
++	 * Configure the addresses of the top-level table (offset because
++	 * the aperture does not start from zero), and of the default page.
++	 * For simplicity, both these regions are whole Linux pages.
++	 */
++	__sg_page_iter_dma_next(&it);
++	u = (sg_page_iter_dma_address(&it) >> MMU_PAGE_SHIFT);
++	MMU_WR(MMMU_PT_PA_BASE_OFFSET, u - (APERTURE_BASE >> L1_CHUNK_SHIFT));
++	__sg_page_iter_dma_next(&it);
++	u = (sg_page_iter_dma_address(&it) >> MMU_PAGE_SHIFT);
++	MMU_WR(MMMU_ILLEGAL_ADR_OFFSET, MMMU_ILLEGAL_ADR_ENABLE + u);
++	dma_sync_sgtable_for_device(mmu->dev, mmu->sgt, DMA_TO_DEVICE);
++	mmu->dirty = false;
++
++	/* Flush (and enable) the shared TLB cache; enable this MMU. */
++	if (mmu->cache)
++		bcm2712_iommu_cache_flush(mmu->cache);
++	MMU_WR(MMMU_CTRL_OFFSET,
++	       MMMU_CTRL_CAP_EXCEEDED_ABORT_EN    |
++	       MMMU_CTRL_PT_INVALID_ABORT_EN      |
++	       MMMU_CTRL_WRITE_VIOLATION_ABORT_EN |
++	       MMMU_CTRL_STATS_ENABLE             |
++	       MMMU_CTRL_ENABLE);
++}
++
++static int bcm2712_iommu_attach_dev(struct iommu_domain *domain, struct device *dev)
++{
++	struct bcm2712_iommu *mmu = dev ? dev_iommu_priv_get(dev) : 0;
++	struct bcm2712_iommu_domain *mydomain =
++		container_of(domain, struct bcm2712_iommu_domain, base);
++
++	dev_info(dev, "%s: MMU %s\n",
++		 __func__, mmu ? dev_name(mmu->dev) : "");
++
++	if (mmu) {
++		mydomain->mmu = mmu;
++		mmu->domain = mydomain;
++
++		if (mmu->dma_iova_offset) {
++			domain->geometry.aperture_start =
++				mmu->dma_iova_offset + APERTURE_BASE;
++			domain->geometry.aperture_end =
++				mmu->dma_iova_offset + APERTURE_TOP - 1ul;
++		}
++
++		return 0;
++	}
++	return -EINVAL;
++}
++
++static int bcm2712_iommu_map(struct iommu_domain *domain, unsigned long iova,
++			     phys_addr_t pa, size_t bytes, size_t count,
++			     int prot, gfp_t gfp, size_t *mapped)
++{
++	struct bcm2712_iommu *mmu = domain_to_mmu(domain);
++	u32 entry = MMMU_PTE_VALID | (pa >> MMU_PAGE_SHIFT);
++	u32 align = (u32)(iova | pa | bytes);
++	unsigned int p;
++
++	/* Reject if at least the first page is not within our aperture */
++	if (iova < mmu->dma_iova_offset + APERTURE_BASE ||
++	    iova + bytes > mmu->dma_iova_offset + APERTURE_TOP) {
++		dev_warn(mmu->dev, "%s: iova=0x%lx pa=0x%llx bytes=0x%lx OUT OF RANGE\n",
++			 __func__, iova,
++			 (unsigned long long)pa, (unsigned long)bytes);
++		*mapped = 0;
++
++		return -EINVAL;
++	}
++
++	/* large page and write enable flags */
++	if (!(align & ((1 << HUGEPAGE_SHIFT) - 1)))
++		entry |= FIELD_PREP(MMMU_PTE_PAGESIZE_MASK, 3);
++	else if (!(align & mmu->superpage_mask) && mmu->superpage_mask)
++		entry |= FIELD_PREP(MMMU_PTE_PAGESIZE_MASK, 2);
++	else if (!(align &  mmu->bigpage_mask) && mmu->bigpage_mask)
++		entry |= FIELD_PREP(MMMU_PTE_PAGESIZE_MASK, 1);
++	if (prot & IOMMU_WRITE)
++		entry |= MMMU_PTE_WRITEABLE;
++
++	/* Ensure tables are cache-coherent with CPU */
++	if (!mmu->dirty) {
++		dma_sync_sgtable_for_cpu(mmu->dev, mmu->sgt, DMA_TO_DEVICE);
++		mmu->dirty = true;
++	}
++
++	/* Make iova relative to table base; amalgamate count pages */
++	iova -= (mmu->dma_iova_offset + APERTURE_BASE);
++	bytes = min(APERTURE_SIZE - iova, count * bytes);
++
++	/* Iterate over table by smallest native IOMMU page size */
++	for (p = iova >> MMU_PAGE_SHIFT;
++	     p < (iova + bytes) >> MMU_PAGE_SHIFT; p++) {
++		mmu->nmapped_pages += !(mmu->tables[p]);
++		mmu->tables[p] = entry++;
++	}
++
++	*mapped = bytes;
++
++	return 0;
++}
++
++static size_t bcm2712_iommu_unmap(struct iommu_domain *domain, unsigned long iova,
++				  size_t bytes, size_t count,
++				  struct iommu_iotlb_gather *gather)
++{
++	struct bcm2712_iommu *mmu = domain_to_mmu(domain);
++	unsigned int p;
++
++	if (iova < mmu->dma_iova_offset + APERTURE_BASE ||
++	    iova + bytes > mmu->dma_iova_offset + APERTURE_TOP)
++		return 0;
++
++	/* Record just the lower and upper bounds in "gather" */
++	if (gather) {
++		bool empty = (gather->end <= gather->start);
++
++		if (empty || gather->start < iova)
++			gather->start = iova;
++		if (empty || gather->end < iova + bytes)
++			gather->end = iova + bytes;
++	}
++
++	/* Ensure tables are cache-coherent with CPU */
++	if (!mmu->dirty) {
++		dma_sync_sgtable_for_cpu(mmu->dev, mmu->sgt, DMA_TO_DEVICE);
++		mmu->dirty = true;
++	}
++
++	/* Make iova relative to table base; amalgamate count pages */
++	iova -= (mmu->dma_iova_offset + APERTURE_BASE);
++	bytes = min(APERTURE_SIZE - iova, count * bytes);
++
++	/* Clear table entries, this marks the addresses as illegal */
++	for (p = iova >> MMU_PAGE_SHIFT;
++	     p < (iova + bytes) >> MMU_PAGE_SHIFT;
++	     p++) {
++		mmu->nmapped_pages -= !!(mmu->tables[p]);
++		mmu->tables[p] = 0;
++	}
++
++	return bytes;
++}
++
++static int bcm2712_iommu_sync_range(struct iommu_domain *domain,
++				    unsigned long iova, size_t size)
++{
++	struct bcm2712_iommu *mmu = domain_to_mmu(domain);
++	unsigned long iova_end;
++	unsigned int i, p4;
++
++	if (!mmu || !mmu->dirty)
++		return 0;
++
++	/* Ensure tables are cleaned from CPU cache or write-buffer */
++	dma_sync_sgtable_for_device(mmu->dev, mmu->sgt, DMA_TO_DEVICE);
++	mmu->dirty = false;
++
++	/* Flush the shared TLB cache */
++	if (mmu->cache)
++		bcm2712_iommu_cache_flush(mmu->cache);
++
++	/*
++	 * When flushing a large range or when nothing needs to be kept,
++	 * it's quicker to use the"TLB_CLEAR" flag. Otherwise, invalidate
++	 * TLB entries in lines of 4 words each. Each flush/clear operation
++	 * should complete almost instantaneously.
++	 */
++	iova -= mmu->dma_iova_offset;
++	iova_end = min(APERTURE_TOP, iova + size);
++	iova = max(APERTURE_BASE, iova);
++	if (mmu->nmapped_pages == 0 || iova_end - iova >= APERTURE_SIZE / 8) {
++		MMU_WR(MMMU_CTRL_OFFSET,
++		       MMMU_CTRL_CAP_EXCEEDED_ABORT_EN    |
++		       MMMU_CTRL_PT_INVALID_ABORT_EN      |
++		       MMMU_CTRL_WRITE_VIOLATION_ABORT_EN |
++		       MMMU_CTRL_TLB_CLEAR                |
++		       MMMU_CTRL_STATS_ENABLE             |
++		       MMMU_CTRL_ENABLE);
++		for (i = 0; i < 1024; i++) {
++			if (!(MMMU_CTRL_TLB_CLEARING & MMU_RD(MMMU_CTRL_OFFSET)))
++				break;
++			cpu_relax();
++		}
++	} else {
++		for (p4 = iova >> (MMU_PAGE_SHIFT + 2);
++		     p4 < (iova_end + 3 * MMU_PAGE_SIZE) >> (MMU_PAGE_SHIFT + 2);
++		     p4++) {
++			MMU_WR(MMMU_SHOOT_DOWN_OFFSET,
++			       MMMU_SHOOT_DOWN_SHOOT + (p4 << 2));
++			for (i = 0; i < 1024; i++) {
++				if (!(MMMU_SHOOT_DOWN_SHOOTING & MMU_RD(MMMU_SHOOT_DOWN_OFFSET)))
++					break;
++				cpu_relax();
++			}
++		}
++	}
++
++	return 0;
++}
++
++static void bcm2712_iommu_sync(struct iommu_domain *domain,
++			       struct iommu_iotlb_gather *gather)
++{
++	bcm2712_iommu_sync_range(domain, gather->start,
++				 gather->end - gather->start);
++}
++
++static void bcm2712_iommu_sync_all(struct iommu_domain *domain)
++{
++	bcm2712_iommu_sync_range(domain, APERTURE_BASE, APERTURE_SIZE);
++}
++
++static phys_addr_t bcm2712_iommu_iova_to_phys(struct iommu_domain *domain, dma_addr_t iova)
++{
++	struct bcm2712_iommu *mmu = domain_to_mmu(domain);
++	u32 p;
++
++	iova -= mmu->dma_iova_offset;
++	if (iova  >= APERTURE_BASE && iova < APERTURE_TOP) {
++		p = (iova - APERTURE_BASE) >> MMU_PAGE_SHIFT;
++		p = mmu->tables[p] & 0x0FFFFFFFu;
++		return (((phys_addr_t)p) << MMU_PAGE_SHIFT) + (iova & (MMU_PAGE_SIZE - 1u));
++	} else if (iova < APERTURE_BASE) {
++		return (phys_addr_t)iova;
++	} else {
++		return (phys_addr_t)-EINVAL;
++	}
++}
++
++static void bcm2712_iommu_domain_free(struct iommu_domain *domain)
++{
++	struct bcm2712_iommu_domain *mydomain =
++		container_of(domain, struct bcm2712_iommu_domain, base);
++
++	kfree(mydomain);
++}
++
++static const struct iommu_domain_ops bcm2712_iommu_domain_ops = {
++	.attach_dev	 = bcm2712_iommu_attach_dev,
++	.map_pages	 = bcm2712_iommu_map,
++	.unmap_pages	 = bcm2712_iommu_unmap,
++	.iotlb_sync      = bcm2712_iommu_sync,
++	.iotlb_sync_map  = bcm2712_iommu_sync_range,
++	.flush_iotlb_all = bcm2712_iommu_sync_all,
++	.iova_to_phys	 = bcm2712_iommu_iova_to_phys,
++	.free		 = bcm2712_iommu_domain_free,
++};
++
++static struct iommu_domain *bcm2712_iommu_domain_alloc(unsigned int type)
++{
++	struct bcm2712_iommu_domain *domain;
++
++	if (type != IOMMU_DOMAIN_UNMANAGED && type != IOMMU_DOMAIN_DMA)
++		return NULL;
++
++	domain = kzalloc(sizeof(*domain), GFP_KERNEL);
++	if (!domain)
++		return NULL;
++
++	domain->base.type = type;
++	domain->base.ops  = &bcm2712_iommu_domain_ops;
++	domain->base.geometry.aperture_start = APERTURE_BASE;
++	domain->base.geometry.aperture_end   = APERTURE_TOP - 1ul;
++	domain->base.geometry.force_aperture = true;
++	return &domain->base;
++}
++
++static struct iommu_device *bcm2712_iommu_probe_device(struct device *dev)
++{
++	struct bcm2712_iommu *mmu;
++
++	/*
++	 * For reasons I don't fully understand, we need to try both
++	 * cases (dev_iommu_priv_get() and platform_get_drvdata())
++	 * in order to get both GPU and ISP-BE to probe successfully.
++	 */
++	mmu = dev_iommu_priv_get(dev);
++	if (!mmu) {
++		struct device_node *np;
++		struct platform_device *pdev;
++
++		/* Ignore devices that don't have an "iommus" property with exactly one phandle */
++		if (!dev->of_node ||
++		    of_property_count_elems_of_size(dev->of_node, "iommus", sizeof(phandle)) != 1)
++			return ERR_PTR(-ENODEV);
++
++		np = of_parse_phandle(dev->of_node, "iommus", 0);
++		if (!np)
++			return ERR_PTR(-EINVAL);
++
++		pdev = of_find_device_by_node(np);
++		of_node_put(np);
++		if (pdev)
++			mmu = platform_get_drvdata(pdev);
++
++		if (!mmu)
++			return ERR_PTR(-ENODEV);
++	}
++
++	dev_info(dev, "%s: MMU %s\n", __func__, dev_name(mmu->dev));
++	dev_iommu_priv_set(dev, mmu);
++	return &mmu->iommu;
++}
++
++static void bcm2712_iommu_release_device(struct device *dev)
++{
++	dev_iommu_priv_set(dev, NULL);
++}
++
++static struct iommu_group *bcm2712_iommu_device_group(struct device *dev)
++{
++	struct bcm2712_iommu *mmu = dev_iommu_priv_get(dev);
++
++	if (!mmu || !mmu->group)
++		return ERR_PTR(-EINVAL);
++
++	dev_info(dev, "%s: MMU %s\n", __func__, dev_name(mmu->dev));
++	return iommu_group_ref_get(mmu->group);
++}
++
++static int bcm2712_iommu_of_xlate(struct device *dev,
++				  const struct of_phandle_args *args)
++{
++	struct platform_device *iommu_dev;
++	struct bcm2712_iommu *mmu;
++
++	iommu_dev = of_find_device_by_node(args->np);
++	mmu = platform_get_drvdata(iommu_dev);
++	dev_iommu_priv_set(dev, mmu);
++	dev_info(dev, "%s: MMU %s\n", __func__, dev_name(mmu->dev));
++
++	return 0;
++}
++
++static bool bcm2712_iommu_capable(struct device *dev, enum iommu_cap cap)
++{
++	return false;
++}
++
++static const struct iommu_ops bcm2712_iommu_ops = {
++	.capable        = bcm2712_iommu_capable,
++	.domain_alloc	= bcm2712_iommu_domain_alloc,
++	.probe_device	= bcm2712_iommu_probe_device,
++	.release_device	= bcm2712_iommu_release_device,
++	.device_group	= bcm2712_iommu_device_group,
++	/* Advertise native page sizes as well as 2M, 16K which Linux may prefer */
++	.pgsize_bitmap	= (SZ_4M | SZ_2M | SZ_1M | SZ_64K | SZ_16K | SZ_4K),
++	.default_domain_ops = &bcm2712_iommu_domain_ops,
++	.of_xlate = bcm2712_iommu_of_xlate,
++};
++
++static int bcm2712_iommu_probe(struct platform_device *pdev)
++{
++	struct bcm2712_iommu *mmu;
++	struct bcm2712_iommu_cache *cache = NULL;
++	int ret;
++
++	/* First of all, check for an IOMMU shared cache */
++	if (pdev->dev.of_node) {
++		struct device_node *cache_np;
++		struct platform_device *cache_pdev;
++
++		cache_np = of_parse_phandle(pdev->dev.of_node, "cache", 0);
++		if (cache_np) {
++			cache_pdev = of_find_device_by_node(cache_np);
++			of_node_put(cache_np);
++			if (cache_pdev && !IS_ERR(cache_pdev))
++				cache = platform_get_drvdata(cache_pdev);
++			if (!cache)
++				return -EPROBE_DEFER;
++		}
++	}
++
++	/* Allocate private data */
++	mmu = devm_kzalloc(&pdev->dev, sizeof(*mmu), GFP_KERNEL);
++	if (!mmu)
++		return -ENOMEM;
++
++	mmu->name = dev_name(&pdev->dev);
++	mmu->dev = &pdev->dev;
++	mmu->cache = cache;
++	platform_set_drvdata(pdev, mmu);
++	spin_lock_init(&mmu->hw_lock);
++
++	/*
++	 * XXX When an IOMMU is downstream of a PCIe RC or some other chip/bus
++	 * and serves some of the masters thereon (others using pass-through),
++	 * we seem to fumble and lose the "dma-ranges" address offset for
++	 * masters using IOMMU. This property restores it, where needed.
++	 */
++	if (!pdev->dev.of_node ||
++	    of_property_read_u64(pdev->dev.of_node, "dma-iova-offset",
++				 &mmu->dma_iova_offset))
++		mmu->dma_iova_offset = 0;
++
++	/*
++	 * The IOMMU is itself a device that allocates DMA-able memory
++	 * to hold its translation tables. Provided the IOVA aperture
++	 * is no larger than 4 GBytes (so that the L1 table fits within
++	 * a single 4K page), we don't need the tables to be contiguous.
++	 * Assume we can address at least 36 bits (64 GB).
++	 */
++	ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(36));
++	WARN_ON(ret);
++	mmu->sgt = dma_alloc_noncontiguous(&pdev->dev, TABLES_ALLOC_SIZE,
++					   DMA_TO_DEVICE, GFP_KERNEL,
++					   DMA_ATTR_ALLOC_SINGLE_PAGES);
++	if (!mmu->sgt) {
++		ret = -ENOMEM;
++		goto done_err;
++	}
++	mmu->tables = dma_vmap_noncontiguous(&pdev->dev, TABLES_ALLOC_SIZE,
++					     mmu->sgt);
++	if (!mmu->tables) {
++		ret = -ENOMEM;
++		goto done_err;
++	}
++
++	/* Get IOMMU registers */
++	mmu->reg_base = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(mmu->reg_base)) {
++		dev_err(&pdev->dev, "Failed to get IOMMU registers address\n");
++		ret = PTR_ERR(mmu->reg_base);
++		goto done_err;
++	}
++
++	/* Stuff */
++	mmu->group = iommu_group_alloc();
++	if (IS_ERR(mmu->group)) {
++		ret = PTR_ERR(mmu->group);
++		mmu->group = NULL;
++		goto done_err;
++	}
++	ret = iommu_device_sysfs_add(&mmu->iommu, mmu->dev, NULL, mmu->name);
++	if (ret)
++		goto done_err;
++
++	/* Initialize table and hardware */
++	bcm2712_iommu_init(mmu);
++	ret = iommu_device_register(&mmu->iommu, &bcm2712_iommu_ops, &pdev->dev);
++
++	dev_info(&pdev->dev, "%s: Success\n", __func__);
++	return 0;
++
++done_err:
++	dev_info(&pdev->dev, "%s: Failure %d\n", __func__, ret);
++	if (mmu->group)
++		iommu_group_put(mmu->group);
++	if (mmu->tables)
++		dma_vunmap_noncontiguous(&pdev->dev,
++					 (void *)(mmu->tables));
++	mmu->tables = NULL;
++	if (mmu->sgt)
++		dma_free_noncontiguous(&pdev->dev, TABLES_ALLOC_SIZE,
++				       mmu->sgt, DMA_TO_DEVICE);
++	mmu->sgt = NULL;
++	kfree(mmu);
++	return ret;
++}
++
++static void bcm2712_iommu_remove(struct platform_device *pdev)
++{
++	struct bcm2712_iommu *mmu = platform_get_drvdata(pdev);
++
++	if (mmu->reg_base)
++		MMU_WR(MMMU_CTRL_OFFSET, 0); /* disable the MMU */
++	if (mmu->sgt)
++		dma_free_noncontiguous(&pdev->dev, TABLES_ALLOC_SIZE,
++				       mmu->sgt, DMA_TO_DEVICE);
++}
++
++static const struct of_device_id bcm2712_iommu_of_match[] = {
++	{
++		. compatible = "brcm,bcm2712-iommu"
++	},
++	{ /* sentinel */ },
++};
++
++static struct platform_driver bcm2712_iommu_driver = {
++	.probe = bcm2712_iommu_probe,
++	.remove = bcm2712_iommu_remove,
++	.driver = {
++		.name = "bcm2712-iommu",
++		.of_match_table = bcm2712_iommu_of_match
++	},
++};
++
++builtin_platform_driver(bcm2712_iommu_driver);
+--- /dev/null
++++ b/drivers/iommu/bcm2712-iommu.h
+@@ -0,0 +1,45 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++/*
++ * IOMMU driver for BCM2712
++ *
++ * Copyright (c) 2023 Raspberry Pi Ltd.
++ */
++
++#ifndef _BCM2712_IOMMU_H
++#define _BCM2712_IOMMU_H
++
++#include <linux/iommu.h>
++#include <linux/scatterlist.h>
++
++struct bcm2712_iommu_cache {
++	struct device *dev;
++	spinlock_t hw_lock; /* to protect HW registers */
++	void __iomem *reg_base;
++};
++
++void bcm2712_iommu_cache_flush(struct bcm2712_iommu_cache *cache);
++
++struct bcm2712_iommu {
++	struct device *dev;
++	struct iommu_device iommu;
++	struct iommu_group *group;
++	struct bcm2712_iommu_domain *domain;
++	char const *name;
++	struct sg_table *sgt; /* allocated memory for page tables */
++	u32 *tables;          /* kernel mapping for page tables */
++	struct bcm2712_iommu_cache *cache;
++	spinlock_t hw_lock;   /* to protect HW registers */
++	void __iomem *reg_base;
++	u64 dma_iova_offset; /* Hack for IOMMU attached to PCIe RC */
++	u32 bigpage_mask;
++	u32 superpage_mask;
++	unsigned int nmapped_pages;
++	bool dirty; /* true when tables are oriented towards CPU */
++};
++
++struct bcm2712_iommu_domain {
++	struct iommu_domain base;
++	struct bcm2712_iommu *mmu;
++};
++
++#endif
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0382-irqchip-irq-brcmstb-l2-Add-config-for-2711-controlle.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0382-irqchip-irq-brcmstb-l2-Add-config-for-2711-controlle.patch
new file mode 100644
index 00000000..7c94e19d
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0382-irqchip-irq-brcmstb-l2-Add-config-for-2711-controlle.patch
@@ -0,0 +1,74 @@
+From b9b75b370b3854c1db6a29311f09458e9a34c541 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Wed, 28 Jun 2023 16:24:29 +0100
+Subject: [PATCH 382/697] irqchip/irq-brcmstb-l2: Add config for 2711
+ controller
+
+We currently see these regularly:
+[   25.157560] irq 31, desc: 00000000c15e6d2c, depth: 0, count: 0, unhandled: 0
+[   25.164658] ->handle_irq():  00000000b1775675, brcmstb_l2_intc_irq_handle+0x0/0x1a8
+[   25.172352] ->irq_data.chip(): 00000000fea59f1c, gic_chip_mode1+0x0/0x108
+[   25.179166] ->action(): 000000003eda6d6f
+[   25.183096] ->action->handler(): 000000002c09e646, bad_chained_irq+0x0/0x58
+[   25.190084]      IRQ_LEVEL set
+[   25.193142]    IRQ_NOPROBE set
+[   25.196198]  IRQ_NOREQUEST set
+[   25.199255]   IRQ_NOTHREAD set
+
+with:
+$ cat /proc/interrupts  | grep 31:
+ 31:          1          0          0          0     GICv2 129 Level     (null)
+
+The interrupt is described in DT with IRQ_TYPE_LEVEL_HIGH
+
+But the current compatible string uses the controller in edge triggered mode
+(as that config matches our register layout).
+
+Add a new compatible structure for level driven interrupt with our register layout.
+
+We had already been using this compatible string in device tree, so no change needed
+there.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/irqchip/irq-brcmstb-l2.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+--- a/drivers/irqchip/irq-brcmstb-l2.c
++++ b/drivers/irqchip/irq-brcmstb-l2.c
+@@ -51,6 +51,16 @@ static const struct brcmstb_intc_init_pa
+ 	.cpu_mask_clear		= 0x0C
+ };
+ 
++/* Register offsets in the 2711 L2 level interrupt controller */
++static const struct brcmstb_intc_init_params l2_2711_lvl_intc_init = {
++	.handler		= handle_level_irq,
++	.cpu_status		= 0x00,
++	.cpu_clear		= 0x08,
++	.cpu_mask_status	= 0x0c,
++	.cpu_mask_set		= 0x10,
++	.cpu_mask_clear		= 0x14
++};
++
+ /* L2 intc private data structure */
+ struct brcmstb_l2_intc_data {
+ 	struct irq_domain *domain;
+@@ -299,11 +309,18 @@ static int __init brcmstb_l2_lvl_intc_of
+ 	return brcmstb_l2_intc_of_init(np, parent, &l2_lvl_intc_init);
+ }
+ 
++static int __init brcmstb_l2_2711_lvl_intc_of_init(struct device_node *np,
++	struct device_node *parent)
++{
++	return brcmstb_l2_intc_of_init(np, parent, &l2_2711_lvl_intc_init);
++}
++
+ IRQCHIP_PLATFORM_DRIVER_BEGIN(brcmstb_l2)
+ IRQCHIP_MATCH("brcm,l2-intc", brcmstb_l2_edge_intc_of_init)
+ IRQCHIP_MATCH("brcm,hif-spi-l2-intc", brcmstb_l2_edge_intc_of_init)
+ IRQCHIP_MATCH("brcm,upg-aux-aon-l2-intc", brcmstb_l2_edge_intc_of_init)
+ IRQCHIP_MATCH("brcm,bcm7271-l2-intc", brcmstb_l2_lvl_intc_of_init)
++IRQCHIP_MATCH("brcm,bcm2711-l2-intc", brcmstb_l2_2711_lvl_intc_of_init)
+ IRQCHIP_PLATFORM_DRIVER_END(brcmstb_l2)
+ MODULE_DESCRIPTION("Broadcom STB generic L2 interrupt controller");
+ MODULE_LICENSE("GPL v2");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0383-rtc-rtc-rpi-Add-simple-RTC-driver-for-Raspberry-Pi.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0383-rtc-rtc-rpi-Add-simple-RTC-driver-for-Raspberry-Pi.patch
new file mode 100644
index 00000000..62be442f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0383-rtc-rtc-rpi-Add-simple-RTC-driver-for-Raspberry-Pi.patch
@@ -0,0 +1,348 @@
+From 3ea70bc24807265abe59eaef3d5d10020b638c61 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Fri, 7 Jul 2023 20:00:45 +0100
+Subject: [PATCH 383/697] rtc: rtc-rpi: Add simple RTC driver for Raspberry Pi
+
+This supports setting and reading the real time clock
+and supports wakeup alarms.
+
+To support wake up alarms you want this bootloader config:
+ POWER_OFF_ON_HALT=1
+ WAKE_ON_GPIO=0
+
+You can test with:
+  echo +600 | sudo tee /sys/class/rtc/rtc0/wakealarm
+  sudo halt
+
+That will halt (in an almost no power state),
+then wake and restart after 10 minutes.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+drivers: rtc-rpi: add battery charge circuit control and readback
+
+Parse devicetree for a charger voltage and apply it. If nonzero and a
+valid voltage, the firmware will enable charging, otherwise the charger
+circuit is disabled.
+
+Add sysfs attributes to read back the supported charge voltage range,
+the measured battery voltage, and the charger setpoint.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/rtc/Kconfig   |  11 ++
+ drivers/rtc/Makefile  |   1 +
+ drivers/rtc/rtc-rpi.c | 277 ++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 289 insertions(+)
+ create mode 100644 drivers/rtc/rtc-rpi.c
+
+--- a/drivers/rtc/Kconfig
++++ b/drivers/rtc/Kconfig
+@@ -223,6 +223,17 @@ config RTC_DRV_AC100
+ 	  This driver can also be built as a module. If so, the module
+ 	  will be called rtc-ac100.
+ 
++config RTC_DRV_RPI
++	tristate "Raspberry Pi RTC"
++	depends on ARCH_BRCMSTB || COMPILE_TEST
++	default ARCH_BRCMSTB
++	help
++	  If you say yes here you get support for the RTC found on
++	  Raspberry Pi devices.
++
++	  This driver can also be built as a module. If so, the module
++	  will be called rtc-rpi.
++
+ config RTC_DRV_BRCMSTB
+ 	tristate "Broadcom STB wake-timer"
+ 	depends on ARCH_BRCMSTB || BMIPS_GENERIC || COMPILE_TEST
+--- a/drivers/rtc/Makefile
++++ b/drivers/rtc/Makefile
+@@ -143,6 +143,7 @@ obj-$(CONFIG_RTC_DRV_RC5T583)	+= rtc-rc5
+ obj-$(CONFIG_RTC_DRV_RC5T619)	+= rtc-rc5t619.o
+ obj-$(CONFIG_RTC_DRV_RK808)	+= rtc-rk808.o
+ obj-$(CONFIG_RTC_DRV_RP5C01)	+= rtc-rp5c01.o
++obj-$(CONFIG_RTC_DRV_RPI)	+= rtc-rpi.o
+ obj-$(CONFIG_RTC_DRV_RS5C313)	+= rtc-rs5c313.o
+ obj-$(CONFIG_RTC_DRV_RS5C348)	+= rtc-rs5c348.o
+ obj-$(CONFIG_RTC_DRV_RS5C372)	+= rtc-rs5c372.o
+--- /dev/null
++++ b/drivers/rtc/rtc-rpi.c
+@@ -0,0 +1,277 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
++/**
++ * rtc-rpi.c
++ *
++ * RTC driver using firmware mailbox
++ * Supports battery backed RTC and wake alarms
++ *
++ * Based on rtc-meson-vrtc by Neil Armstrong
++ *
++ * Copyright (c) 2023, Raspberry Pi Ltd.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/rtc.h>
++#include <linux/of.h>
++#include <soc/bcm2835/raspberrypi-firmware.h>
++
++struct rpi_rtc_data {
++	struct rtc_device *rtc;
++	struct rpi_firmware *fw;
++	u32 bbat_vchg_microvolts;
++};
++
++#define RPI_FIRMWARE_GET_RTC_REG 0x00030087
++#define RPI_FIRMWARE_SET_RTC_REG 0x00038087
++
++enum {
++	RTC_TIME,
++	RTC_ALARM,
++	RTC_ALARM_PENDING,
++	RTC_ALARM_ENABLE,
++	RTC_BBAT_CHG_VOLTS,
++	RTC_BBAT_CHG_VOLTS_MIN,
++	RTC_BBAT_CHG_VOLTS_MAX,
++	RTC_BBAT_VOLTS
++};
++
++static int rpi_rtc_read_time(struct device *dev, struct rtc_time *tm)
++{
++	struct rpi_rtc_data *vrtc = dev_get_drvdata(dev);
++	u32 data[2] = {RTC_TIME};
++	int err;
++
++	err = rpi_firmware_property(vrtc->fw, RPI_FIRMWARE_GET_RTC_REG,
++				    &data, sizeof(data));
++	rtc_time64_to_tm(data[1], tm);
++	return err;
++}
++
++static int rpi_rtc_set_time(struct device *dev, struct rtc_time *tm)
++{
++	struct rpi_rtc_data *vrtc = dev_get_drvdata(dev);
++	u32 data[2] = {RTC_TIME, rtc_tm_to_time64(tm)};
++
++	return rpi_firmware_property(vrtc->fw, RPI_FIRMWARE_SET_RTC_REG,
++				     &data, sizeof(data));
++}
++
++static int rpi_rtc_alarm_irq_is_enabled(struct device *dev, unsigned char *enabled)
++{
++	struct rpi_rtc_data *vrtc = dev_get_drvdata(dev);
++	u32 data[2] = {RTC_ALARM_ENABLE};
++	s32 err = 0;
++
++	err = rpi_firmware_property(vrtc->fw, RPI_FIRMWARE_GET_RTC_REG,
++				    &data, sizeof(data));
++	*enabled = data[1] & 0x1;
++	return err;
++}
++
++static int rpi_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
++{
++	struct rpi_rtc_data *vrtc = dev_get_drvdata(dev);
++	u32 data[2] = {RTC_ALARM_ENABLE, enabled};
++
++	return rpi_firmware_property(vrtc->fw, RPI_FIRMWARE_SET_RTC_REG,
++				     &data, sizeof(data));
++}
++
++static int rpi_rtc_alarm_clear_pending(struct device *dev)
++{
++	struct rpi_rtc_data *vrtc = dev_get_drvdata(dev);
++	u32 data[2] = {RTC_ALARM_PENDING, 1};
++
++	return rpi_firmware_property(vrtc->fw, RPI_FIRMWARE_SET_RTC_REG,
++				     &data, sizeof(data));
++}
++
++static int rpi_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alarm)
++{
++	struct rpi_rtc_data *vrtc = dev_get_drvdata(dev);
++	u32 data[2] = {RTC_ALARM};
++	s32 err = 0;
++
++	err = rpi_rtc_alarm_irq_is_enabled(dev, &alarm->enabled);
++	if (!err)
++		err = rpi_firmware_property(vrtc->fw, RPI_FIRMWARE_GET_RTC_REG,
++					    &data, sizeof(data));
++	rtc_time64_to_tm(data[1], &alarm->time);
++
++	return err;
++}
++
++static int rpi_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alarm)
++{
++	struct rpi_rtc_data *vrtc = dev_get_drvdata(dev);
++	u32 data[2] = {RTC_ALARM, rtc_tm_to_time64(&alarm->time)};
++	int err;
++
++	err = rpi_firmware_property(vrtc->fw, RPI_FIRMWARE_SET_RTC_REG,
++				    &data, sizeof(data));
++
++	if (err == 0)
++		err = rpi_rtc_alarm_irq_enable(dev, alarm->enabled);
++
++	return err;
++}
++
++static const struct rtc_class_ops rpi_rtc_ops = {
++	.read_time = rpi_rtc_read_time,
++	.set_time = rpi_rtc_set_time,
++	.read_alarm = rpi_rtc_read_alarm,
++	.set_alarm = rpi_rtc_set_alarm,
++	.alarm_irq_enable = rpi_rtc_alarm_irq_enable,
++};
++
++static int rpi_rtc_set_charge_voltage(struct device *dev)
++{
++	struct rpi_rtc_data *vrtc = dev_get_drvdata(dev);
++	u32 data[2] = {RTC_BBAT_CHG_VOLTS, vrtc->bbat_vchg_microvolts};
++	int err;
++
++	err = rpi_firmware_property(vrtc->fw, RPI_FIRMWARE_SET_RTC_REG,
++				    &data, sizeof(data));
++
++	if (err)
++		dev_err(dev, "failed to set trickle charge voltage to %uuV: %d\n",
++			vrtc->bbat_vchg_microvolts, err);
++	else if (vrtc->bbat_vchg_microvolts)
++		dev_info(dev, "trickle charging enabled at %uuV\n",
++			 vrtc->bbat_vchg_microvolts);
++
++	return err;
++}
++
++static ssize_t rpi_rtc_print_uint_reg(struct device *dev, char *buf, u32 reg)
++{
++	struct rpi_rtc_data *vrtc = dev_get_drvdata(dev->parent);
++	u32 data[2] = {reg, 0};
++	int ret = 0;
++
++	ret = rpi_firmware_property(vrtc->fw, RPI_FIRMWARE_GET_RTC_REG,
++				    &data, sizeof(data));
++	if (ret < 0)
++		return ret;
++
++	return sprintf(buf, "%u\n", data[1]);
++}
++
++static ssize_t charging_voltage_show(struct device *dev,
++				     struct device_attribute *attr,
++				     char *buf)
++{
++	return rpi_rtc_print_uint_reg(dev, buf, RTC_BBAT_CHG_VOLTS);
++}
++static DEVICE_ATTR_RO(charging_voltage);
++
++static ssize_t charging_voltage_min_show(struct device *dev,
++					 struct device_attribute *attr,
++					 char *buf)
++{
++	return rpi_rtc_print_uint_reg(dev, buf, RTC_BBAT_CHG_VOLTS_MIN);
++}
++static DEVICE_ATTR_RO(charging_voltage_min);
++
++static ssize_t charging_voltage_max_show(struct device *dev,
++					 struct device_attribute *attr,
++					 char *buf)
++{
++	return rpi_rtc_print_uint_reg(dev, buf, RTC_BBAT_CHG_VOLTS_MAX);
++}
++static DEVICE_ATTR_RO(charging_voltage_max);
++
++static ssize_t battery_voltage_show(struct device *dev,
++				    struct device_attribute *attr,
++				    char *buf)
++{
++	return rpi_rtc_print_uint_reg(dev, buf, RTC_BBAT_VOLTS);
++}
++static DEVICE_ATTR_RO(battery_voltage);
++
++static struct attribute *rpi_rtc_attrs[] = {
++	&dev_attr_charging_voltage.attr,
++	&dev_attr_charging_voltage_min.attr,
++	&dev_attr_charging_voltage_max.attr,
++	&dev_attr_battery_voltage.attr,
++	NULL
++};
++
++static const struct attribute_group rpi_rtc_sysfs_files = {
++	.attrs = rpi_rtc_attrs,
++};
++
++static int rpi_rtc_probe(struct platform_device *pdev)
++{
++	struct rpi_rtc_data *vrtc;
++	struct device *dev = &pdev->dev;
++	struct device_node *np = dev->of_node;
++	struct device_node *fw_node;
++	struct rpi_firmware *fw;
++	int ret;
++
++	fw_node = of_parse_phandle(np, "firmware", 0);
++	if (!fw_node) {
++		dev_err(dev, "Missing firmware node\n");
++		return -ENOENT;
++	}
++
++	fw = rpi_firmware_get(fw_node);
++	if (!fw)
++		return -EPROBE_DEFER;
++
++	vrtc = devm_kzalloc(&pdev->dev, sizeof(*vrtc), GFP_KERNEL);
++	if (!vrtc)
++		return -ENOMEM;
++
++	vrtc->fw = fw;
++
++	device_init_wakeup(&pdev->dev, 1);
++
++	platform_set_drvdata(pdev, vrtc);
++
++	vrtc->rtc = devm_rtc_allocate_device(&pdev->dev);
++	if (IS_ERR(vrtc->rtc))
++		return PTR_ERR(vrtc->rtc);
++
++	set_bit(RTC_FEATURE_ALARM_WAKEUP_ONLY, vrtc->rtc->features);
++	clear_bit(RTC_FEATURE_UPDATE_INTERRUPT, vrtc->rtc->features);
++
++	vrtc->rtc->ops = &rpi_rtc_ops;
++	ret = rtc_add_group(vrtc->rtc, &rpi_rtc_sysfs_files);
++	if (ret)
++		return ret;
++
++	rpi_rtc_alarm_clear_pending(dev);
++
++	/*
++	 * Optionally enable trickle charging - if the property isn't
++	 * present (or set to zero), trickle charging is disabled.
++	 */
++	of_property_read_u32(np, "trickle-charge-microvolt",
++			     &vrtc->bbat_vchg_microvolts);
++
++	rpi_rtc_set_charge_voltage(dev);
++
++	return devm_rtc_register_device(vrtc->rtc);
++}
++
++static const struct of_device_id rpi_rtc_dt_match[] = {
++	{ .compatible = "raspberrypi,rpi-rtc"},
++	{},
++};
++MODULE_DEVICE_TABLE(of, rpi_rtc_dt_match);
++
++static struct platform_driver rpi_rtc_driver = {
++	.probe = rpi_rtc_probe,
++	.driver = {
++		.name = "rpi-rtc",
++		.of_match_table = rpi_rtc_dt_match,
++	},
++};
++
++module_platform_driver(rpi_rtc_driver);
++
++MODULE_DESCRIPTION("Raspberry Pi RTC driver");
++MODULE_LICENSE("GPL");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0384-dt-bindings-rtc-new-binding-for-Raspberry-Pi-RTC-dri.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0384-dt-bindings-rtc-new-binding-for-Raspberry-Pi-RTC-dri.patch
new file mode 100644
index 00000000..4696f93b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0384-dt-bindings-rtc-new-binding-for-Raspberry-Pi-RTC-dri.patch
@@ -0,0 +1,47 @@
+From 4d732f37c30c02d6110622c2a29c4168d840e2f3 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Fri, 7 Jul 2023 20:16:06 +0100
+Subject: [PATCH 384/697] dt-bindings: rtc: new binding for Raspberry Pi RTC
+ driver
+
+Add binding for the new RTC driver for Raspberry Pi.
+This platform has an RTC managed by firmware, and this RTC
+driver provides the simple mailbox interface to access it.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+dt: bindings: update rpi-rtc binding
+
+Add property for bcm2712 firmware RTC driver charger control
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ .../devicetree/bindings/rtc/rtc-rpi.txt       | 22 +++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/rtc/rtc-rpi.txt
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/rtc/rtc-rpi.txt
+@@ -0,0 +1,22 @@
++* Raspberry Pi RTC
++
++This is a Linux interface to an RTC managed by firmware, hence it's
++virtual from a Linux perspective.
++
++The interface uses the firmware mailbox api to access the RTC registers.
++
++Required properties:
++compatible: should be "raspberrypi,rpi-rtc"
++firmware:   Reference to the RPi firmware device node.
++
++Optional property:
++trickle-charge-microvolt: specify a trickle charge voltage for the backup
++                          battery in microvolts.
++
++Example:
++
++	rpi_rtc: rpi_rtc {
++		compatible = "raspberrypi,rpi-rtc";
++		firmware = <&firmware>;
++		trickle-charge-microvolt = <3000000>;
++	};
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0385-dt-bindings-display-Add-BCM2712-HDMI-bindings.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0385-dt-bindings-display-Add-BCM2712-HDMI-bindings.patch
new file mode 100644
index 00000000..3da36a3c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0385-dt-bindings-display-Add-BCM2712-HDMI-bindings.patch
@@ -0,0 +1,26 @@
+From fc0fd7cb6be4a64f7fbcac6c93cc89a4ee93bd87 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Fri, 17 Feb 2023 13:36:02 +0100
+Subject: [PATCH 385/697] dt-bindings: display: Add BCM2712 HDMI bindings
+
+The BCM2712 HDMI controller uses a slightly different HDMI controller
+than the BCM2711, and a completely different PHY.
+
+Let's introduce a new compatible for it.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ .../devicetree/bindings/display/brcm,bcm2711-hdmi.yaml          | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/Documentation/devicetree/bindings/display/brcm,bcm2711-hdmi.yaml
++++ b/Documentation/devicetree/bindings/display/brcm,bcm2711-hdmi.yaml
+@@ -14,6 +14,8 @@ properties:
+     enum:
+       - brcm,bcm2711-hdmi0
+       - brcm,bcm2711-hdmi1
++      - brcm,bcm2712-hdmi0
++      - brcm,bcm2712-hdmi1
+ 
+   reg:
+     items:
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0386-dt-bindings-display-Add-BCM2712-HVS-bindings.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0386-dt-bindings-display-Add-BCM2712-HVS-bindings.patch
new file mode 100644
index 00000000..97d4c262
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0386-dt-bindings-display-Add-BCM2712-HVS-bindings.patch
@@ -0,0 +1,34 @@
+From 35d2a64d363f91703ef1e037899cbf0332d3780e Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Fri, 17 Feb 2023 13:36:14 +0100
+Subject: [PATCH 386/697] dt-bindings: display: Add BCM2712 HVS bindings
+
+The BCM2712 has a completely different HVS than the previous
+generations, so let's add a new compatible for it.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ .../devicetree/bindings/display/brcm,bcm2835-hvs.yaml        | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/display/brcm,bcm2835-hvs.yaml
++++ b/Documentation/devicetree/bindings/display/brcm,bcm2835-hvs.yaml
+@@ -13,6 +13,7 @@ properties:
+   compatible:
+     enum:
+       - brcm,bcm2711-hvs
++      - brcm,bcm2712-hvs
+       - brcm,bcm2835-hvs
+ 
+   reg:
+@@ -36,7 +37,9 @@ if:
+   properties:
+     compatible:
+       contains:
+-        const: brcm,bcm2711-hvs
++        enum:
++          - brcm,bcm2711-hvs
++          - brcm,bcm2712-hvs
+ 
+ then:
+   required:
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0387-dt-bindings-display-Add-BCM2712-PixelValve-bindings.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0387-dt-bindings-display-Add-BCM2712-PixelValve-bindings.patch
new file mode 100644
index 00000000..8c3612ca
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0387-dt-bindings-display-Add-BCM2712-PixelValve-bindings.patch
@@ -0,0 +1,28 @@
+From 9352d0f882c291fef4de0c7ddd059d97408a6e07 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Fri, 17 Feb 2023 13:36:27 +0100
+Subject: [PATCH 387/697] dt-bindings: display: Add BCM2712 PixelValve bindings
+
+The BCM2712 has 3 different pixelvalves that are similar to the ones
+found in the previous generations but with slightly different
+capabilities.
+
+Express that using a new set of compatibles.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ .../devicetree/bindings/display/brcm,bcm2835-pixelvalve0.yaml  | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/Documentation/devicetree/bindings/display/brcm,bcm2835-pixelvalve0.yaml
++++ b/Documentation/devicetree/bindings/display/brcm,bcm2835-pixelvalve0.yaml
+@@ -20,6 +20,9 @@ properties:
+       - brcm,bcm2711-pixelvalve2
+       - brcm,bcm2711-pixelvalve3
+       - brcm,bcm2711-pixelvalve4
++      - brcm,bcm2712-pixelvalve0
++      - brcm,bcm2712-pixelvalve1
++      - brcm,bcm2712-pixelvalve2
+ 
+   reg:
+     maxItems: 1
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0388-dt-bindings-display-Add-BCM2712-MOP-bindings.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0388-dt-bindings-display-Add-BCM2712-MOP-bindings.patch
new file mode 100644
index 00000000..17be8c8f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0388-dt-bindings-display-Add-BCM2712-MOP-bindings.patch
@@ -0,0 +1,28 @@
+From 1faa92d5c42a0decc084659fbe9c2751f1222b5a Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Fri, 17 Feb 2023 13:36:36 +0100
+Subject: [PATCH 388/697] dt-bindings: display: Add BCM2712 MOP bindings
+
+The BCM2712 has a MOP controller which is basically a new revision of
+the TXP.
+
+Express that by adding a new compatible for it.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ .../devicetree/bindings/display/brcm,bcm2835-txp.yaml         | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/display/brcm,bcm2835-txp.yaml
++++ b/Documentation/devicetree/bindings/display/brcm,bcm2835-txp.yaml
+@@ -11,7 +11,9 @@ maintainers:
+ 
+ properties:
+   compatible:
+-    const: brcm,bcm2835-txp
++    enum:
++      - brcm,bcm2712-mop
++      - brcm,bcm2835-txp
+ 
+   reg:
+     maxItems: 1
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0389-dt-bindings-display-Add-BCM2712-MOPLET-bindings.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0389-dt-bindings-display-Add-BCM2712-MOPLET-bindings.patch
new file mode 100644
index 00000000..7e79302e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0389-dt-bindings-display-Add-BCM2712-MOPLET-bindings.patch
@@ -0,0 +1,25 @@
+From 660a7817c26c96818fdda04e147254c2999bea1f Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Fri, 17 Feb 2023 13:36:36 +0100
+Subject: [PATCH 389/697] dt-bindings: display: Add BCM2712 MOPLET bindings
+
+The BCM2712 has a MOPLET controller which is basically a TXP without the
+transpose feature.
+
+Express that by adding a new compatible for it.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ Documentation/devicetree/bindings/display/brcm,bcm2835-txp.yaml | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/Documentation/devicetree/bindings/display/brcm,bcm2835-txp.yaml
++++ b/Documentation/devicetree/bindings/display/brcm,bcm2835-txp.yaml
+@@ -13,6 +13,7 @@ properties:
+   compatible:
+     enum:
+       - brcm,bcm2712-mop
++      - brcm,bcm2712-moplet
+       - brcm,bcm2835-txp
+ 
+   reg:
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0390-dt-bindings-display-Add-BCM2712-KMS-driver-bindings.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0390-dt-bindings-display-Add-BCM2712-KMS-driver-bindings.patch
new file mode 100644
index 00000000..e9477d76
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0390-dt-bindings-display-Add-BCM2712-KMS-driver-bindings.patch
@@ -0,0 +1,23 @@
+From a5281ba8f5c00628078094ab4811653739011c1f Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Fri, 17 Feb 2023 13:36:51 +0100
+Subject: [PATCH 390/697] dt-bindings: display: Add BCM2712 KMS driver bindings
+
+The BCM2712 SoC comes with a new variation of the videocore display
+pipeline. Let's create a new compatible for it.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ Documentation/devicetree/bindings/display/brcm,bcm2835-vc4.yaml | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/Documentation/devicetree/bindings/display/brcm,bcm2835-vc4.yaml
++++ b/Documentation/devicetree/bindings/display/brcm,bcm2835-vc4.yaml
+@@ -18,6 +18,7 @@ properties:
+   compatible:
+     enum:
+       - brcm,bcm2711-vc5
++      - brcm,bcm2712-vc6
+       - brcm,bcm2835-vc4
+       - brcm,cygnus-vc4
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0391-media-i2c-Move-Kconfig-entry-for-IMX477-to-the-camer.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0391-media-i2c-Move-Kconfig-entry-for-IMX477-to-the-camer.patch
new file mode 100644
index 00000000..43130eae
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0391-media-i2c-Move-Kconfig-entry-for-IMX477-to-the-camer.patch
@@ -0,0 +1,53 @@
+From df7c556baf809ac8ec3888c32563bb44185a79c7 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Wed, 4 Oct 2023 11:09:10 +0100
+Subject: [PATCH 391/697] media: i2c: Move Kconfig entry for IMX477 to the
+ camera sensor section
+
+It was accidentally placed in the audio decoder section.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/i2c/Kconfig | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -286,6 +286,19 @@ config VIDEO_IMX415
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called imx415.
+ 
++config VIDEO_IMX477
++	tristate "Sony IMX477 sensor support"
++	depends on I2C && VIDEO_DEV
++	select VIDEO_V4L2_SUBDEV_API
++	select MEDIA_CONTROLLER
++	select V4L2_FWNODE
++	help
++	  This is a Video4Linux2 sensor driver for the Sony
++	  IMX477 camera. Also supports the Sony IMX378.
++
++	  To compile this driver as a module, choose M here: the
++	  module will be called imx477.
++
+ config VIDEO_IMX519
+ 	tristate "Arducam IMX519 sensor support"
+ 	depends on I2C && VIDEO_DEV
+@@ -1034,17 +1047,6 @@ config VIDEO_UDA1342
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called uda1342.
+ 
+-config VIDEO_IMX477
+-	tristate "Sony IMX477 sensor support"
+-	depends on I2C && VIDEO_DEV
+-	select VIDEO_V4L2_SUBDEV_API
+-	help
+-	  This is a Video4Linux2 sensor driver for the Sony
+-	  IMX477 camera. Also supports the Sony IMX378.
+-
+-	  To compile this driver as a module, choose M here: the
+-	  module will be called imx477.
+-
+ config VIDEO_VP27SMPX
+ 	tristate "Panasonic VP27's internal MPX"
+ 	depends on VIDEO_DEV && I2C
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0392-drm-Look-for-an-alias-for-the-displays-to-use-as-the.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0392-drm-Look-for-an-alias-for-the-displays-to-use-as-the.patch
new file mode 100644
index 00000000..b7455b34
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0392-drm-Look-for-an-alias-for-the-displays-to-use-as-the.patch
@@ -0,0 +1,117 @@
+From 94824bcfb83bdc91006c3ad5378e0e586fafbaa4 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 28 Sep 2023 18:27:09 +0100
+Subject: [PATCH 392/697] drm: Look for an alias for the displays to use as the
+ DRM device name
+
+Allow DT aliases of eg DSI2 to force make DRM allocate the
+display with the requested name.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/drm_connector.c | 61 ++++++++++++++++++++++++++++++---
+ 1 file changed, 57 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/drm_connector.c
++++ b/drivers/gpu/drm/drm_connector.c
+@@ -33,6 +33,7 @@
+ #include <drm/drm_sysfs.h>
+ #include <drm/drm_utils.h>
+ 
++#include <linux/of.h>
+ #include <linux/property.h>
+ #include <linux/uaccess.h>
+ 
+@@ -83,6 +84,7 @@ struct drm_conn_prop_enum_list {
+ 	int type;
+ 	const char *name;
+ 	struct ida ida;
++	int first_dyn_num;
+ };
+ 
+ /*
+@@ -112,12 +114,41 @@ static struct drm_conn_prop_enum_list dr
+ 	{ DRM_MODE_CONNECTOR_USB, "USB" },
+ };
+ 
++#define MAX_DT_NODE_NAME_LEN	20
++#define DT_DRM_NODE_PREFIX	"drm_"
++
++static void drm_connector_get_of_name(int type, char *node_name, int length)
++{
++	int i = 0;
++
++	strcpy(node_name, DT_DRM_NODE_PREFIX);
++
++	do {
++		node_name[i + strlen(DT_DRM_NODE_PREFIX)] =
++				tolower(drm_connector_enum_list[type].name[i]);
++
++	} while (drm_connector_enum_list[type].name[i++] &&
++		 i < length);
++
++	node_name[length - 1] = '\0';
++}
++
+ void drm_connector_ida_init(void)
+ {
+-	int i;
++	int i, id;
++	char node_name[MAX_DT_NODE_NAME_LEN];
+ 
+-	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++)
++	for (i = 0; i < ARRAY_SIZE(drm_connector_enum_list); i++) {
+ 		ida_init(&drm_connector_enum_list[i].ida);
++
++		drm_connector_get_of_name(i, node_name, MAX_DT_NODE_NAME_LEN);
++
++		id = of_alias_get_highest_id(node_name);
++		if (id > 0)
++			drm_connector_enum_list[i].first_dyn_num = id + 1;
++		else
++			drm_connector_enum_list[i].first_dyn_num = 1;
++	}
+ }
+ 
+ void drm_connector_ida_destroy(void)
+@@ -225,7 +256,9 @@ static int __drm_connector_init(struct d
+ 				struct i2c_adapter *ddc)
+ {
+ 	struct drm_mode_config *config = &dev->mode_config;
++	char node_name[MAX_DT_NODE_NAME_LEN];
+ 	int ret;
++	int id;
+ 	struct ida *connector_ida =
+ 		&drm_connector_enum_list[connector_type].ida;
+ 
+@@ -255,8 +288,28 @@ static int __drm_connector_init(struct d
+ 	ret = 0;
+ 
+ 	connector->connector_type = connector_type;
+-	connector->connector_type_id =
+-		ida_alloc_min(connector_ida, 1, GFP_KERNEL);
++	connector->connector_type_id = 0;
++
++	drm_connector_get_of_name(connector_type, node_name, MAX_DT_NODE_NAME_LEN);
++	id = of_alias_get_id(dev->dev->of_node, node_name);
++	if (id > 0) {
++		/* Try and allocate the requested ID
++		 * Valid range is 1 to 31, hence ignoring 0 as an error
++		 */
++		int type_id = ida_alloc_range(connector_ida, id, id, GFP_KERNEL);
++
++		if (type_id > 0)
++			connector->connector_type_id = type_id;
++		else
++			drm_err(dev, "Failed to acquire type ID %d for interface type %s, ret %d\n",
++				id, drm_connector_enum_list[connector_type].name,
++				type_id);
++	}
++	if (!connector->connector_type_id)
++		connector->connector_type_id =
++				ida_alloc_min(connector_ida,
++					      drm_connector_enum_list[connector_type].first_dyn_num,
++					      GFP_KERNEL);
+ 	if (connector->connector_type_id < 0) {
+ 		ret = connector->connector_type_id;
+ 		goto out_put_id;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0393-media-i2c-ov9282-Read-chip-ID-via-2-reads.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0393-media-i2c-ov9282-Read-chip-ID-via-2-reads.patch
new file mode 100644
index 00000000..7520ed31
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0393-media-i2c-ov9282-Read-chip-ID-via-2-reads.patch
@@ -0,0 +1,38 @@
+From 16c81bc3a9530d557f17c022cde7bee85ca17853 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 11 Oct 2023 11:12:41 +0100
+Subject: [PATCH 393/697] media: i2c: ov9282: Read chip ID via 2 reads
+
+Vision Components have made an OV9281 module which blocks reading
+back the majority of registers to comply with NDAs, and in doing
+so doesn't allow auto-increment register reading as used when
+reading the chip ID.
+
+Use two reads and manually combine the results.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/ov9282.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/ov9282.c
++++ b/drivers/media/i2c/ov9282.c
+@@ -1069,12 +1069,16 @@ error_unlock:
+ static int ov9282_detect(struct ov9282 *ov9282)
+ {
+ 	int ret;
+-	u32 val;
++	u32 val, msb;
+ 
+-	ret = ov9282_read_reg(ov9282, OV9282_REG_ID, 2, &val);
++	ret = ov9282_read_reg(ov9282, OV9282_REG_ID + 1, 1, &val);
++	if (ret)
++		return ret;
++	ret = ov9282_read_reg(ov9282, OV9282_REG_ID, 1, &msb);
+ 	if (ret)
+ 		return ret;
+ 
++	val |= (msb << 8);
+ 	if (val != OV9282_ID) {
+ 		dev_err(ov9282->dev, "chip id mismatch: %x!=%x",
+ 			OV9282_ID, val);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0394-fbdev-Allow-client-to-request-a-particular-dev-fbN-n.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0394-fbdev-Allow-client-to-request-a-particular-dev-fbN-n.patch
new file mode 100644
index 00000000..a99fd8e4
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0394-fbdev-Allow-client-to-request-a-particular-dev-fbN-n.patch
@@ -0,0 +1,82 @@
+From 940f48d8897c4ca63cb9f0dfd5545d4fc3e60aea Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 9 Oct 2023 16:32:45 +0100
+Subject: [PATCH 394/697] fbdev: Allow client to request a particular /dev/fbN
+ node
+
+Add a flag custom_fb_num to denote that the client has
+requested a specific fbdev node number via node.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/video/fbdev/core/fbmem.c | 19 ++++++++++++++-----
+ include/linux/fb.h               |  2 ++
+ 2 files changed, 16 insertions(+), 5 deletions(-)
+
+--- a/drivers/video/fbdev/core/fbmem.c
++++ b/drivers/video/fbdev/core/fbmem.c
+@@ -31,6 +31,7 @@ struct class *fb_class;
+ DEFINE_MUTEX(registration_lock);
+ struct fb_info *registered_fb[FB_MAX] __read_mostly;
+ int num_registered_fb __read_mostly;
++int min_dynamic_fb __read_mostly;
+ #define for_each_registered_fb(i)		\
+ 	for (i = 0; i < FB_MAX; i++)		\
+ 		if (!registered_fb[i]) {} else
+@@ -398,10 +399,12 @@ static int do_register_framebuffer(struc
+ 		return -ENXIO;
+ 
+ 	num_registered_fb++;
+-	for (i = 0 ; i < FB_MAX; i++)
+-		if (!registered_fb[i])
+-			break;
+-	fb_info->node = i;
++	if (!fb_info->custom_fb_num || fb_info->node >= FB_MAX || registered_fb[fb_info->node]) {
++		for (i = min_dynamic_fb ; i < FB_MAX; i++)
++			if (!registered_fb[i])
++				break;
++		fb_info->node = i;
++	}
+ 	refcount_set(&fb_info->count, 1);
+ 	mutex_init(&fb_info->lock);
+ 	mutex_init(&fb_info->mm_lock);
+@@ -436,7 +439,7 @@ static int do_register_framebuffer(struc
+ 
+ 	fb_var_to_videomode(&mode, &fb_info->var);
+ 	fb_add_videomode(&mode, &fb_info->modelist);
+-	registered_fb[i] = fb_info;
++	registered_fb[fb_info->node] = fb_info;
+ 
+ #ifdef CONFIG_GUMSTIX_AM200EPD
+ 	{
+@@ -497,6 +500,12 @@ static void do_unregister_framebuffer(st
+ 	put_fb_info(fb_info);
+ }
+ 
++void fb_set_lowest_dynamic_fb(int min_fb_dev)
++{
++	min_dynamic_fb = min_fb_dev;
++}
++EXPORT_SYMBOL(fb_set_lowest_dynamic_fb);
++
+ /**
+  *	register_framebuffer - registers a frame buffer device
+  *	@fb_info: frame buffer info structure
+--- a/include/linux/fb.h
++++ b/include/linux/fb.h
+@@ -511,6 +511,7 @@ struct fb_info {
+ 
+ 	bool skip_vt_switch; /* no VT switch on suspend/resume required */
+ 	bool skip_panic; /* Do not write to the fb after a panic */
++	bool custom_fb_num; /* Use value in node as the preferred node number */
+ };
+ 
+ /* This will go away
+@@ -600,6 +601,7 @@ extern ssize_t fb_sys_write(struct fb_in
+ 	.fb_imageblit	= sys_imageblit
+ 
+ /* fbmem.c */
++extern void fb_set_lowest_dynamic_fb(int min_fb_dev);
+ extern int register_framebuffer(struct fb_info *fb_info);
+ extern void unregister_framebuffer(struct fb_info *fb_info);
+ extern int devm_register_framebuffer(struct device *dev, struct fb_info *fb_info);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0395-drm-fb-helper-Look-up-preferred-fbdev-node-number-fr.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0395-drm-fb-helper-Look-up-preferred-fbdev-node-number-fr.patch
new file mode 100644
index 00000000..b89f5ce1
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0395-drm-fb-helper-Look-up-preferred-fbdev-node-number-fr.patch
@@ -0,0 +1,47 @@
+From 62ebda30d43d1f19f3f4a8bb4835df445e022920 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 9 Oct 2023 16:34:36 +0100
+Subject: [PATCH 395/697] drm/fb-helper: Look up preferred fbdev node number
+ from DT
+
+For situations where there are multiple DRM cards in a system,
+add a query of DT for "drm_fb" designations for cards to set
+their preferred /dev/fbN designation.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/fb_helper: Change query for FB designation from drm_fb to drm-fb
+
+Fixes: 1216ea56c2e3 ("drm/fb-helper: Look up preferred fbdev node number from DT")
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/drm_fb_helper.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -1838,7 +1838,7 @@ __drm_fb_helper_initial_config_and_unloc
+ 	struct drm_device *dev = fb_helper->dev;
+ 	struct fb_info *info;
+ 	unsigned int width, height;
+-	int ret;
++	int ret, id;
+ 
+ 	width = dev->mode_config.max_width;
+ 	height = dev->mode_config.max_height;
+@@ -1866,6 +1866,15 @@ __drm_fb_helper_initial_config_and_unloc
+ 	 * register the fbdev emulation instance in kernel_fb_helper_list. */
+ 	mutex_unlock(&fb_helper->lock);
+ 
++	id = of_alias_get_highest_id("drm-fb");
++	if (id >= 0)
++		fb_set_lowest_dynamic_fb(id + 1);
++
++	id = of_alias_get_id(dev->dev->of_node, "drm-fb");
++	if (id >= 0) {
++		info->node = id;
++		info->custom_fb_num = true;
++	}
+ 	ret = register_framebuffer(info);
+ 	if (ret < 0)
+ 		return ret;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0396-drm-connector-Change-DRM-card-alias-from-underscore-.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0396-drm-connector-Change-DRM-card-alias-from-underscore-.patch
new file mode 100644
index 00000000..2aa2e7e6
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0396-drm-connector-Change-DRM-card-alias-from-underscore-.patch
@@ -0,0 +1,26 @@
+From b15ff2d9fa7660cd3e728dbf7c45d294cc6be037 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 19 Oct 2023 10:34:58 +0100
+Subject: [PATCH 396/697] drm/connector: Change DRM card alias from underscore
+ to hyphen
+
+Apparently aliases are only allowed lower case and hyphens,
+so swap the use of underscore to hyphen.
+
+Fixes: 3aa1f2477545 ("drm: Look for an alias for the displays to use as the DRM device name")
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/drm_connector.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_connector.c
++++ b/drivers/gpu/drm/drm_connector.c
+@@ -115,7 +115,7 @@ static struct drm_conn_prop_enum_list dr
+ };
+ 
+ #define MAX_DT_NODE_NAME_LEN	20
+-#define DT_DRM_NODE_PREFIX	"drm_"
++#define DT_DRM_NODE_PREFIX	"drm-"
+ 
+ static void drm_connector_get_of_name(int type, char *node_name, int length)
+ {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0397-dt-bindings-PCI-brcmstb-add-optional-property-brcm-t.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0397-dt-bindings-PCI-brcmstb-add-optional-property-brcm-t.patch
new file mode 100644
index 00000000..f4e949c9
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0397-dt-bindings-PCI-brcmstb-add-optional-property-brcm-t.patch
@@ -0,0 +1,32 @@
+From 9f56967b61115af87f258a5aa1a8a9dfbc579065 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 20 Sep 2023 10:04:15 +0100
+Subject: [PATCH 397/697] dt-bindings: PCI: brcmstb: add optional property -
+ "brcm,tperst-clk-ms"
+
+This property can be used to delay deassertion of external fundamental
+reset, which may be useful for endpoints that require an extended time for
+internal setup to complete.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ Documentation/devicetree/bindings/pci/brcm,stb-pcie.yaml | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/Documentation/devicetree/bindings/pci/brcm,stb-pcie.yaml
++++ b/Documentation/devicetree/bindings/pci/brcm,stb-pcie.yaml
+@@ -104,6 +104,14 @@ properties:
+     minItems: 1
+     maxItems: 3
+ 
++  brcm,tperst-clk-ms:
++    category: optional
++    type: int
++    description: u32 giving the number of milliseconds to extend
++      the time between internal release of fundamental reset and
++      the deassertion of the external PERST# pin. This has the
++      effect of increasing the Tperst_clk phase of link init.
++
+ required:
+   - compatible
+   - reg
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0398-drivers-mmc-sdhci-add-SPURIOUS_INT_RESP-quirk.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0398-drivers-mmc-sdhci-add-SPURIOUS_INT_RESP-quirk.patch
new file mode 100644
index 00000000..aca85523
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0398-drivers-mmc-sdhci-add-SPURIOUS_INT_RESP-quirk.patch
@@ -0,0 +1,62 @@
+From 7854c35df6a691b9a6c0212fbfe08252b3019fc1 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 8 Nov 2023 11:52:16 +0000
+Subject: [PATCH 398/697] drivers: mmc: sdhci: add SPURIOUS_INT_RESP quirk
+
+Certain controllers (dwc-mshc) generate timeout conditions separately to
+command-completion conditions, where the end result is interrupts are
+separated in time depending on the current SDCLK frequency.
+
+This causes spurious interrupts if SDCLK is slow compared to the CPU's
+ability to process and return from interrupt. This occurs during card
+probe with an empty slot where all commands that would generate a
+response time out.
+
+Add a quirk to squelch command response interrupts when a command
+timeout interrupt is received.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/host/sdhci.c | 11 +++++++++++
+ drivers/mmc/host/sdhci.h |  3 +++
+ 2 files changed, 14 insertions(+)
+
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -1713,6 +1713,12 @@ static bool sdhci_send_command(struct sd
+ 	if (host->use_external_dma)
+ 		sdhci_external_dma_pre_transfer(host, cmd);
+ 
++	if (host->quirks2 & SDHCI_QUIRK2_SPURIOUS_INT_RESP) {
++		host->ier |= SDHCI_INT_RESPONSE;
++		sdhci_writel(host, host->ier, SDHCI_INT_ENABLE);
++		sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE);
++	}
++
+ 	sdhci_writew(host, SDHCI_MAKE_CMD(cmd->opcode, flags), SDHCI_COMMAND);
+ 
+ 	return true;
+@@ -3291,6 +3297,11 @@ static void sdhci_cmd_irq(struct sdhci_h
+ 		if (intmask & SDHCI_INT_TIMEOUT) {
+ 			host->cmd->error = -ETIMEDOUT;
+ 			sdhci_err_stats_inc(host, CMD_TIMEOUT);
++			if (host->quirks2 & SDHCI_QUIRK2_SPURIOUS_INT_RESP) {
++				host->ier &= ~SDHCI_INT_RESPONSE;
++				sdhci_writel(host, host->ier, SDHCI_INT_ENABLE);
++				sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE);
++			}
+ 		} else {
+ 			host->cmd->error = -EILSEQ;
+ 			if (!mmc_op_tuning(host->cmd->opcode))
+--- a/drivers/mmc/host/sdhci.h
++++ b/drivers/mmc/host/sdhci.h
+@@ -490,6 +490,9 @@ struct sdhci_host {
+ #define SDHCI_QUIRK2_NO_SDR50  (1<<20)
+ #define SDHCI_QUIRK2_NO_SDR104	(1<<21)
+ 
++/* Command timeouts may generate a trailing INT_RESPONSE later */
++#define SDHCI_QUIRK2_SPURIOUS_INT_RESP			(1<<31)
++
+ 	int irq;		/* Device IRQ */
+ 	void __iomem *ioaddr;	/* Mapped address */
+ 	phys_addr_t mapbase;	/* physical address base */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0399-dt-bindings-mmc-sdhci-of-dwcmhsc-Add-Raspberry-Pi-RP.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0399-dt-bindings-mmc-sdhci-of-dwcmhsc-Add-Raspberry-Pi-RP.patch
new file mode 100644
index 00000000..4c7715f0
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0399-dt-bindings-mmc-sdhci-of-dwcmhsc-Add-Raspberry-Pi-RP.patch
@@ -0,0 +1,42 @@
+From 065cf8419cdf23b24ef85f5a936f6962f4403d3a Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 8 Nov 2023 16:10:13 +0000
+Subject: [PATCH 399/697] dt-bindings: mmc: sdhci-of-dwcmhsc: Add Raspberry Pi
+ RP1 support
+
+The DWC MSHC controller on RP1 needs differentiating from the generic
+version.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ .../devicetree/bindings/mmc/snps,dwcmshc-sdhci.yaml          | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/Documentation/devicetree/bindings/mmc/snps,dwcmshc-sdhci.yaml
++++ b/Documentation/devicetree/bindings/mmc/snps,dwcmshc-sdhci.yaml
+@@ -17,6 +17,7 @@ properties:
+           - const: rockchip,rk3576-dwcmshc
+           - const: rockchip,rk3588-dwcmshc
+       - enum:
++          - raspberrypi,rp1-dwcmshc
+           - rockchip,rk3568-dwcmshc
+           - rockchip,rk3588-dwcmshc
+           - snps,dwcmshc-sdhci
+@@ -95,6 +96,8 @@ allOf:
+             - description: axi clock for rockchip specified
+             - description: block clock for rockchip specified
+             - description: timer clock for rockchip specified
++            - description: timeout clock for rp1 specified
++            - description: sdio clock generator for rp1 specified
+         clock-names:
+           minItems: 1
+           items:
+@@ -103,6 +106,8 @@ allOf:
+             - const: axi
+             - const: block
+             - const: timer
++            - const: timeout
++            - const: sdio
+ 
+   - if:
+       properties:
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0400-Add-ability-to-export-gpio-used-by-gpio-poweroff.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0400-Add-ability-to-export-gpio-used-by-gpio-poweroff.patch
new file mode 100644
index 00000000..4b99193f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0400-Add-ability-to-export-gpio-used-by-gpio-poweroff.patch
@@ -0,0 +1,58 @@
+From 975cebf662b2a9b6103f2c8dc9e710ac914ad7d9 Mon Sep 17 00:00:00 2001
+From: Nick Bulleid <nedbulleid@fastmail.com>
+Date: Thu, 10 May 2018 21:57:02 +0100
+Subject: [PATCH 400/697] Add ability to export gpio used by gpio-poweroff
+
+Signed-off-by: Nick Bulleid <nedbulleid@fastmail.com>
+
+Added export feature to gpio-poweroff documentation
+
+Signed-off-by: Nick Bulleid <nedbulleid@fastmail.com>
+---
+ .../bindings/power/reset/gpio-poweroff.yaml           |  4 ++++
+ drivers/power/reset/gpio-poweroff.c                   | 11 ++++++++++-
+ 2 files changed, 14 insertions(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/power/reset/gpio-poweroff.yaml
++++ b/Documentation/devicetree/bindings/power/reset/gpio-poweroff.yaml
+@@ -50,6 +50,10 @@ properties:
+     default: 3000
+     description: Time to wait before assuming the power off sequence failed.
+ 
++  export:
++    type: boolean
++    description: Export the GPIO line to the sysfs system
++
+ required:
+   - compatible
+   - gpios
+--- a/drivers/power/reset/gpio-poweroff.c
++++ b/drivers/power/reset/gpio-poweroff.c
+@@ -55,6 +55,7 @@ static int gpio_poweroff_probe(struct pl
+ 	bool input = false;
+ 	enum gpiod_flags flags;
+ 	int priority = SYS_OFF_PRIO_DEFAULT;
++	bool export = false;
+ 	int ret;
+ 
+ 	gpio_poweroff = devm_kzalloc(&pdev->dev, sizeof(*gpio_poweroff), GFP_KERNEL);
+@@ -86,10 +87,18 @@ static int gpio_poweroff_probe(struct pl
+ 	if (IS_ERR(gpio_poweroff->reset_gpio))
+ 		return PTR_ERR(gpio_poweroff->reset_gpio);
+ 
++	export = device_property_read_bool(&pdev->dev, "export");
++	if (export) {
++		gpiod_export(gpio_poweroff->reset_gpio, true);
++		gpiod_export_link(&pdev->dev, "poweroff-gpio", gpio_poweroff->reset_gpio);
++	}
++
+ 	ret = devm_register_sys_off_handler(&pdev->dev, SYS_OFF_MODE_POWER_OFF,
+ 					    priority, gpio_poweroff_do_poweroff, gpio_poweroff);
+-	if (ret)
++	if (ret) {
++		gpiod_unexport(gpio_poweroff->reset_gpio);
+ 		return dev_err_probe(&pdev->dev, ret, "Cannot register poweroff handler\n");
++	}
+ 
+ 	return 0;
+ }
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0401-gpio-poweroff-Disable-the-WARN.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0401-gpio-poweroff-Disable-the-WARN.patch
new file mode 100644
index 00000000..6b8aeaf8
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0401-gpio-poweroff-Disable-the-WARN.patch
@@ -0,0 +1,25 @@
+From bcf74f4775f82ffc907ed6360d3a7bf5fb688fb1 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 22 Nov 2023 13:05:00 +0000
+Subject: [PATCH 401/697] gpio-poweroff: Disable the WARN
+
+With the new support for a chain of sys_off handlers, gpio-poweroff
+does not disable a normal shutdown (though it does delay it). There
+is therefore no need for the noisy WARN from the kernel.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/power/reset/gpio-poweroff.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/power/reset/gpio-poweroff.c
++++ b/drivers/power/reset/gpio-poweroff.c
+@@ -44,7 +44,7 @@ static int gpio_poweroff_do_poweroff(str
+ 	/* give it some time */
+ 	mdelay(gpio_poweroff->timeout_ms);
+ 
+-	WARN_ON(1);
++	//WARN_ON(1);
+ 
+ 	return NOTIFY_DONE;
+ }
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0402-w1-Disable-kernel-log-spam.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0402-w1-Disable-kernel-log-spam.patch
new file mode 100644
index 00000000..73a394ce
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0402-w1-Disable-kernel-log-spam.patch
@@ -0,0 +1,25 @@
+From 6b94344a2d0aee86a30cd9b44b977d295b6d439b Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 20 Nov 2023 14:46:14 +0000
+Subject: [PATCH 402/697] w1: Disable kernel log spam
+
+See: https://forums.raspberrypi.com/viewtopic.php?p=2159344
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/w1/w1.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/w1/w1.c
++++ b/drivers/w1/w1.c
+@@ -733,8 +733,10 @@ int w1_attach_slave_device(struct w1_mas
+ 	atomic_set(&sl->refcnt, 1);
+ 	atomic_inc(&sl->master->refcnt);
+ 	dev->slave_count++;
++#if 0
+ 	dev_info(&dev->dev, "Attaching one wire slave %02x.%012llx crc %02x\n",
+ 		  rn->family, (unsigned long long)rn->id, rn->crc);
++#endif
+ 
+ 	/* slave modules need to be loaded in a context with unlocked mutex */
+ 	mutex_unlock(&dev->mutex);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0403-xhci-Use-more-event-ring-segment-table-entries.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0403-xhci-Use-more-event-ring-segment-table-entries.patch
new file mode 100644
index 00000000..edba0a09
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0403-xhci-Use-more-event-ring-segment-table-entries.patch
@@ -0,0 +1,32 @@
+From 41ba0febc5d69b5867ce1ad0b0852a0f59e16d16 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Thu, 19 Oct 2023 13:29:10 +0300
+Subject: [PATCH 403/697] xhci: Use more event ring segment table entries
+
+Users have reported log spam created by "Event Ring Full" xHC event
+TRBs. These are caused by interrupt latency in conjunction with a very
+busy set of devices on the bus. The errors are benign, but throughput
+will suffer as the xHC will pause processing of transfers until the
+event ring is drained by the kernel. Expand the number of event TRB slots
+available by increasing the number of event ring segments in the ERST.
+
+Controllers have a hardware-defined limit as to the number of ERST
+entries they can process, so make the actual number in use
+min(ERST_MAX_SEGS, hw_max).
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/host/xhci.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1392,7 +1392,7 @@ struct urb_priv {
+ };
+ 
+ /* Number of Event Ring segments to allocate, when amount is not specified. (spec allows 32k) */
+-#define	ERST_DEFAULT_SEGS	2
++#define	ERST_DEFAULT_SEGS	8
+ /* Poll every 60 seconds */
+ #define	POLL_TIMEOUT	60
+ /* Stop endpoint command timeout (secs) for URB cancellation watchdog timer */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0404-drivers-thermal-step_wise-add-support-for-hysteresis.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0404-drivers-thermal-step_wise-add-support-for-hysteresis.patch
new file mode 100644
index 00000000..83434dc6
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0404-drivers-thermal-step_wise-add-support-for-hysteresis.patch
@@ -0,0 +1,93 @@
+From 09aa8fd7a3cf83c83d96d62df9ece4b8521d062f Mon Sep 17 00:00:00 2001
+From: Ram Chandrasekar <rkumbako@codeaurora.org>
+Date: Mon, 7 May 2018 11:54:08 -0600
+Subject: [PATCH 404/697] drivers: thermal: step_wise: add support for
+ hysteresis
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Step wise governor increases the mitigation level when the temperature
+goes above a threshold and will decrease the mitigation when the
+temperature falls below the threshold. If it were a case, where the
+temperature hovers around a threshold, the mitigation will be applied
+and removed at every iteration. This reaction to the temperature is
+inefficient for performance.
+
+The use of hysteresis temperature could avoid this ping-pong of
+mitigation by relaxing the mitigation to happen only when the
+temperature goes below this lower hysteresis value.
+
+Signed-off-by: Ram Chandrasekar <rkumbako@codeaurora.org>
+Signed-off-by: Lina Iyer <ilina@codeaurora.org>
+
+drivers: thermal: step_wise: avoid throttling at hysteresis temperature after dropping below it
+
+Signed-off-by: Serge Schneider <serge@raspberrypi.org>
+
+Fix hysteresis support in gov_step_wise.c
+
+Directly get hyst value instead of going through an
+optional and, now, unimplemented function.
+
+Signed-off-by: Jürgen Kreileder <jk@blackdown.de>
+---
+ drivers/thermal/gov_step_wise.c | 24 ++++++++++++++++++++----
+ 1 file changed, 20 insertions(+), 4 deletions(-)
+
+--- a/drivers/thermal/gov_step_wise.c
++++ b/drivers/thermal/gov_step_wise.c
+@@ -17,11 +17,11 @@
+ #include "thermal_core.h"
+ 
+ /*
+- * If the temperature is higher than a trip point,
++ * If the temperature is higher than a hysteresis temperature,
+  *    a. if the trend is THERMAL_TREND_RAISING, use higher cooling
+  *       state for this trip point
+  *    b. if the trend is THERMAL_TREND_DROPPING, do nothing
+- * If the temperature is lower than a trip point,
++ * If the temperature is lower than a hysteresis temperature,
+  *    a. if the trend is THERMAL_TREND_RAISING, do nothing
+  *    b. if the trend is THERMAL_TREND_DROPPING, use lower cooling
+  *       state for this trip point, if the cooling state already
+@@ -73,14 +73,18 @@ static void thermal_zone_trip_update(str
+ 	int trip_id = thermal_zone_trip_id(tz, trip);
+ 	struct thermal_instance *instance;
+ 	bool throttle = false;
++	int hyst_temp;
+ 
+ 	if (tz->temperature >= trip_threshold) {
+ 		throttle = true;
+ 		trace_thermal_zone_trip(tz, trip_id, trip->type);
+ 	}
+ 
+-	dev_dbg(&tz->device, "Trip%d[type=%d,temp=%d]:trend=%d,throttle=%d\n",
+-		trip_id, trip->type, trip_threshold, trend, throttle);
++	hyst_temp = trip->temperature - trip->hysteresis;
++
++	dev_dbg(&tz->device,
++		"Trip%d[type=%d,temp=%d,hyst=%d]:trend=%d,throttle=%d\n",
++		trip_id, trip->type, trip->temperature, hyst_temp, trend, throttle);
+ 
+ 	list_for_each_entry(instance, &tz->thermal_instances, tz_node) {
+ 		int old_target;
+@@ -89,6 +93,18 @@ static void thermal_zone_trip_update(str
+ 			continue;
+ 
+ 		old_target = instance->target;
++		throttle = false;
++		/*
++		 * Lower the mitigation only if the temperature
++		 * goes below the hysteresis temperature.
++		 */
++		if (tz->temperature >= trip->temperature ||
++		   (tz->temperature >= hyst_temp &&
++		   old_target == instance->upper)) {
++			throttle = true;
++			trace_thermal_zone_trip(tz, trip_id, trip->type);
++		}
++
+ 		instance->target = get_target_state(instance, trend, throttle);
+ 
+ 		dev_dbg(&instance->cdev->device, "old_target=%d, target=%ld\n",
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0405-media-i2c-ov7251-Switch-from-V4L2_CID_GAIN-to-V4L2_C.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0405-media-i2c-ov7251-Switch-from-V4L2_CID_GAIN-to-V4L2_C.patch
new file mode 100644
index 00000000..e493d707
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0405-media-i2c-ov7251-Switch-from-V4L2_CID_GAIN-to-V4L2_C.patch
@@ -0,0 +1,38 @@
+From 2e6a487946196338935b9938404dbf1c3ced0860 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 14 Nov 2023 18:36:19 +0000
+Subject: [PATCH 405/697] media/i2c: ov7251: Switch from V4L2_CID_GAIN to
+ V4L2_CID_ANALOGUE_GAIN
+
+The mainline driver has implemented analogue gain using the control
+V4L2_CID_GAIN instead of V4L2_CID_ANALOGUE_GAIN.
+
+libcamera requires V4L2_CID_ANALOGUE_GAIN, and therefore fails.
+
+Update the driver to use V4L2_CID_ANALOGUE_GAIN.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/ov7251.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/ov7251.c
++++ b/drivers/media/i2c/ov7251.c
+@@ -1063,7 +1063,7 @@ static int ov7251_s_ctrl(struct v4l2_ctr
+ 	case V4L2_CID_EXPOSURE:
+ 		ret = ov7251_set_exposure(ov7251, ctrl->val);
+ 		break;
+-	case V4L2_CID_GAIN:
++	case V4L2_CID_ANALOGUE_GAIN:
+ 		ret = ov7251_set_gain(ov7251, ctrl->val);
+ 		break;
+ 	case V4L2_CID_TEST_PATTERN:
+@@ -1609,7 +1609,7 @@ static int ov7251_init_ctrls(struct ov72
+ 	ov7251->exposure = v4l2_ctrl_new_std(&ov7251->ctrls, &ov7251_ctrl_ops,
+ 					     V4L2_CID_EXPOSURE, 1, 32, 1, 32);
+ 	ov7251->gain = v4l2_ctrl_new_std(&ov7251->ctrls, &ov7251_ctrl_ops,
+-					 V4L2_CID_GAIN, 16, 1023, 1, 16);
++					 V4L2_CID_ANALOGUE_GAIN, 16, 1023, 1, 16);
+ 	v4l2_ctrl_new_std_menu_items(&ov7251->ctrls, &ov7251_ctrl_ops,
+ 				     V4L2_CID_TEST_PATTERN,
+ 				     ARRAY_SIZE(ov7251_test_pattern_menu) - 1,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0406-drm-bridge-display-connector-Select-DRM_KMS_HELPER.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0406-drm-bridge-display-connector-Select-DRM_KMS_HELPER.patch
new file mode 100644
index 00000000..20454218
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0406-drm-bridge-display-connector-Select-DRM_KMS_HELPER.patch
@@ -0,0 +1,29 @@
+From dfb7a0897acbc3b12eb681c208e574251ad7175f Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 17 Nov 2023 14:50:11 +0000
+Subject: [PATCH 406/697] drm/bridge: display-connector: Select DRM_KMS_HELPER
+
+Commit 7cd70656d128 ("drm/bridge: display-connector: implement
+bus fmts callbacks") added use of drm_atomic_helper_bridge_*
+functions, but didn't select the dependency of DRM_KMS_HELPER.
+If nothing else selected that dependency it resulted in a
+build failure.
+
+Select the missing dependency.
+
+Fixes: 7cd70656d128 ("drm/bridge: display-connector: implement bus fmts callbacks")
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/bridge/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/bridge/Kconfig
++++ b/drivers/gpu/drm/bridge/Kconfig
+@@ -73,6 +73,7 @@ config DRM_CROS_EC_ANX7688
+ config DRM_DISPLAY_CONNECTOR
+ 	tristate "Display connector support"
+ 	depends on OF
++	select DRM_KMS_HELPER
+ 	help
+ 	  Driver for display connectors with support for DDC and hot-plug
+ 	  detection. Most display controllers handle display connectors
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0407-dtc-update.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0407-dtc-update.patch
new file mode 100644
index 00000000..dc1f8849
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0407-dtc-update.patch
@@ -0,0 +1,20 @@
+From c4cdbf358d82cf2cb1603c5669f3c3d88ec1d1b1 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 1 Dec 2023 15:59:45 +0000
+Subject: [PATCH 407/697] dtc update
+
+---
+ scripts/dtc/checks.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/scripts/dtc/checks.c
++++ b/scripts/dtc/checks.c
+@@ -724,7 +724,7 @@ static void check_alias_paths(struct che
+ 			continue;
+ 		}
+ 		if (strspn(prop->name, LOWERCASE DIGITS "-") != strlen(prop->name))
+-			FAIL(c, dti, node, "aliases property name must include only lowercase and '-'");
++		    FAIL(c, dti, node, "aliases property name (%s) must include only lowercase and '-'", prop->name);
+ 	}
+ }
+ WARNING(alias_paths, check_alias_paths, NULL);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0408-media-dt-bindings-i2c-Add-Rohm-BU64754-bindings.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0408-media-dt-bindings-i2c-Add-Rohm-BU64754-bindings.patch
new file mode 100644
index 00000000..5be1523e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0408-media-dt-bindings-i2c-Add-Rohm-BU64754-bindings.patch
@@ -0,0 +1,83 @@
+From dd2ea175a3b3778131faad04fadaa9f52764740f Mon Sep 17 00:00:00 2001
+From: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Date: Thu, 14 Sep 2023 17:03:24 +0100
+Subject: [PATCH 408/697] media: dt-bindings: i2c: Add Rohm BU64754 bindings
+
+Add YAML device tree bindings for the ROHM BU64754 VCM Motor Driver for
+Camera Autofocus.
+
+Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+---
+ .../bindings/media/i2c/rohm,bu64754.yaml      | 48 +++++++++++++++++++
+ MAINTAINERS                                   |  7 +++
+ 2 files changed, 55 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/media/i2c/rohm,bu64754.yaml
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/i2c/rohm,bu64754.yaml
+@@ -0,0 +1,48 @@
++# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++# Copyright (C) 2023 Ideas on Board Oy.
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/media/i2c/rohm,bu64754.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: ROHM BU64754 Actuator Driver for Camera Autofocus
++
++maintainers:
++  - Kieran Bingham <kieran.bingham@ideasonboard.com>
++
++description: |
++  The BU64754GWZ is an actuator driver IC which can control the actuator
++  position precisely using an internal Hall Sensor.
++
++properties:
++  compatible:
++    items:
++      - enum:
++          - rohm,bu64754
++
++  reg:
++    maxItems: 1
++
++  vdd-supply:
++    description:
++      Definition of the regulator used as VDD power supply to the driver.
++
++required:
++  - compatible
++  - reg
++
++additionalProperties: false
++
++examples:
++  - |
++    i2c {
++        #address-cells = <1>;
++        #size-cells = <0>;
++
++        lens@76 {
++            compatible = "rohm,bu64754";
++            reg = <0x76>;
++            vdd-supply = <&cam1_reg>;
++        };
++    };
++...
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -20060,6 +20060,13 @@ S:	Supported
+ F:	drivers/iio/light/rohm-bu27008.c
+ F:	drivers/iio/light/rohm-bu27034.c
+ 
++ROHM BU64754 MOTOR DRIVER FOR CAMERA AUTOFOCUS
++M:	Kieran Bingham <kieran.bingham@ideasonboard.com>
++L:	linux-media@vger.kernel.org
++S:	Maintained
++T:	git git://linuxtv.org/media_tree.git
++F:	Documentation/devicetree/bindings/media/i2c/rohm,bu64754.yaml
++
+ ROHM MULTIFUNCTION BD9571MWV-M PMIC DEVICE DRIVERS
+ M:	Marek Vasut <marek.vasut+renesas@gmail.com>
+ L:	linux-kernel@vger.kernel.org
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0409-media-i2c-Add-ROHM-BU64754-Camera-Autofocus-Actuator.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0409-media-i2c-Add-ROHM-BU64754-Camera-Autofocus-Actuator.patch
new file mode 100644
index 00000000..1b09fe37
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0409-media-i2c-Add-ROHM-BU64754-Camera-Autofocus-Actuator.patch
@@ -0,0 +1,369 @@
+From 7b6dbf8ddbae740688bd718c528e5cf5b5e96884 Mon Sep 17 00:00:00 2001
+From: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Date: Wed, 13 Sep 2023 17:53:54 +0100
+Subject: [PATCH 409/697] media: i2c: Add ROHM BU64754 Camera Autofocus
+ Actuator
+
+Add support for the ROHM BU64754 Motor Driver for Camera Autofocus. A
+V4L2 Subdevice is registered and provides a single
+V4L2_CID_FOCUS_ABSOLUTE control.
+
+Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+---
+ drivers/media/i2c/Kconfig   |  13 ++
+ drivers/media/i2c/Makefile  |   1 +
+ drivers/media/i2c/bu64754.c | 315 ++++++++++++++++++++++++++++++++++++
+ 3 files changed, 329 insertions(+)
+ create mode 100644 drivers/media/i2c/bu64754.c
+
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -821,6 +821,19 @@ config VIDEO_AK7375
+ 	  capability. This is designed for linear control of
+ 	  voice coil motors, controlled via I2C serial interface.
+ 
++config VIDEO_BU64754
++	tristate "BU64754 Motor Driver for Camera Autofocus"
++	depends on I2C && VIDEO_DEV
++	select MEDIA_CONTROLLER
++	select VIDEO_V4L2_SUBDEV_API
++	select V4L2_ASYNC
++	select V4L2_CCI_I2C
++	help
++	  This is a driver for the BU64754 Motor Driver for Camera
++	  Autofocus. The BU64754GWZ is an actuator driver IC which
++	  can be controlled the actuator position precisely using
++	  with internal Hall Sensor.
++
+ config VIDEO_DW9714
+ 	tristate "DW9714 lens voice coil support"
+ 	depends on I2C && VIDEO_DEV
+--- a/drivers/media/i2c/Makefile
++++ b/drivers/media/i2c/Makefile
+@@ -26,6 +26,7 @@ obj-$(CONFIG_VIDEO_ARDUCAM_PIVARIETY) +=
+ obj-$(CONFIG_VIDEO_BT819) += bt819.o
+ obj-$(CONFIG_VIDEO_BT856) += bt856.o
+ obj-$(CONFIG_VIDEO_BT866) += bt866.o
++obj-$(CONFIG_VIDEO_BU64754) += bu64754.o
+ obj-$(CONFIG_VIDEO_CCS) += ccs/
+ obj-$(CONFIG_VIDEO_CCS_PLL) += ccs-pll.o
+ obj-$(CONFIG_VIDEO_CS3308) += cs3308.o
+--- /dev/null
++++ b/drivers/media/i2c/bu64754.c
+@@ -0,0 +1,315 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * The BU64754GWZ is an actuator driver IC which can control the
++ * actuator position precisely using an internal Hall Sensor.
++ */
++
++#include <linux/delay.h>
++#include <linux/i2c.h>
++#include <linux/module.h>
++#include <linux/pm_runtime.h>
++#include <linux/regulator/consumer.h>
++
++#include <media/v4l2-cci.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-device.h>
++
++#define BU64754_REG_ACTIVE	CCI_REG16(0x07)
++#define BU64754_ACTIVE_MODE	0x8080
++
++#define BU64754_REG_SERVE	CCI_REG16(0xd9)
++#define BU64754_SERVE_ON	0x0404
++
++#define BU64754_REG_POSITION	CCI_REG16(0x45)
++#define BU64753_POSITION_MAX	1023 /* 0x3ff */
++#define BU64753_POSITION_STEPS	1
++
++#define BU64754_POWER_ON_DELAY	800 /* uS : t1, t3 */
++
++struct bu64754 {
++	struct device *dev;
++
++	struct v4l2_ctrl_handler ctrls_vcm;
++	struct v4l2_subdev sd;
++	struct regmap *cci;
++
++	u16 current_val;
++	struct regulator *vdd;
++	struct notifier_block notifier;
++};
++
++static inline struct bu64754 *sd_to_bu64754(struct v4l2_subdev *subdev)
++{
++	return container_of(subdev, struct bu64754, sd);
++}
++
++static int bu64754_set(struct bu64754 *bu64754, u16 position)
++{
++	int ret;
++
++	position &= 0x3ff; /* BU64753_POSITION_MAX */
++	ret = cci_write(bu64754->cci, BU64754_REG_POSITION, position, NULL);
++	if (ret) {
++		dev_err(bu64754->dev, "Set position failed ret=%d\n", ret);
++		return ret;
++	}
++
++	return 0;
++}
++
++static int bu64754_active(struct bu64754 *bu64754)
++{
++	int ret;
++
++	/* Power on */
++	ret = cci_write(bu64754->cci, BU64754_REG_ACTIVE, BU64754_ACTIVE_MODE, NULL);
++	if (ret < 0) {
++		dev_err(bu64754->dev, "Failed to set active mode ret = %d\n",
++			ret);
++		return ret;
++	}
++
++	/* Serve on */
++	ret = cci_write(bu64754->cci, BU64754_REG_SERVE, BU64754_SERVE_ON, NULL);
++	if (ret < 0) {
++		dev_err(bu64754->dev, "Failed to enable serve ret = %d\n",
++			ret);
++		return ret;
++	}
++
++	return bu64754_set(bu64754, bu64754->current_val);
++}
++
++static int bu64754_standby(struct bu64754 *bu64754)
++{
++	int ret;
++
++	ret = cci_write(bu64754->cci, BU64754_REG_ACTIVE, 0, NULL);
++	if (ret < 0)
++		dev_err(bu64754->dev, "Failed to enter standby mode ret = %d\n",
++			ret);
++
++	return ret;
++}
++
++static int bu64754_regulator_event(struct notifier_block *nb,
++				   unsigned long action, void *data)
++{
++	struct bu64754 *bu64754 = container_of(nb, struct bu64754, notifier);
++
++	if (action & REGULATOR_EVENT_ENABLE) {
++		/*
++		 * Initialisation delay between VDD low->high and availability
++		 * i2c operation.
++		 */
++		usleep_range(BU64754_POWER_ON_DELAY,
++			     BU64754_POWER_ON_DELAY + 100);
++
++		bu64754_active(bu64754);
++	} else if (action & REGULATOR_EVENT_PRE_DISABLE) {
++		bu64754_standby(bu64754);
++	}
++
++	return 0;
++}
++
++static int bu64754_set_ctrl(struct v4l2_ctrl *ctrl)
++{
++	struct bu64754 *bu64754 = container_of(ctrl->handler,
++		struct bu64754, ctrls_vcm);
++
++	if (ctrl->id == V4L2_CID_FOCUS_ABSOLUTE) {
++		bu64754->current_val = ctrl->val;
++		return bu64754_set(bu64754, ctrl->val);
++	}
++
++	return -EINVAL;
++}
++
++static const struct v4l2_ctrl_ops bu64754_vcm_ctrl_ops = {
++	.s_ctrl = bu64754_set_ctrl,
++};
++
++static int bu64754_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
++{
++	return pm_runtime_resume_and_get(sd->dev);
++}
++
++static int bu64754_close(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
++{
++	pm_runtime_put(sd->dev);
++	return 0;
++}
++
++static const struct v4l2_subdev_internal_ops bu64754_int_ops = {
++	.open = bu64754_open,
++	.close = bu64754_close,
++};
++
++static const struct v4l2_subdev_ops bu64754_ops = { };
++
++static void bu64754_subdev_cleanup(struct bu64754 *bu64754)
++{
++	v4l2_async_unregister_subdev(&bu64754->sd);
++	v4l2_ctrl_handler_free(&bu64754->ctrls_vcm);
++	media_entity_cleanup(&bu64754->sd.entity);
++}
++
++static int bu64754_init_controls(struct bu64754 *bu64754)
++{
++	struct v4l2_ctrl_handler *hdl = &bu64754->ctrls_vcm;
++	const struct v4l2_ctrl_ops *ops = &bu64754_vcm_ctrl_ops;
++
++	v4l2_ctrl_handler_init(hdl, 1);
++
++	v4l2_ctrl_new_std(hdl, ops, V4L2_CID_FOCUS_ABSOLUTE,
++			  0, BU64753_POSITION_MAX, BU64753_POSITION_STEPS,
++			  0);
++
++	bu64754->current_val = 0;
++
++	bu64754->sd.ctrl_handler = hdl;
++	if (hdl->error) {
++		dev_err(bu64754->dev, "%s fail error: 0x%x\n",
++			__func__, hdl->error);
++		return hdl->error;
++	}
++
++	return 0;
++}
++
++static int bu64754_probe(struct i2c_client *client)
++{
++	struct bu64754 *bu64754;
++	int ret;
++
++	bu64754 = devm_kzalloc(&client->dev, sizeof(*bu64754), GFP_KERNEL);
++	if (!bu64754)
++		return -ENOMEM;
++
++	bu64754->dev = &client->dev;
++
++	bu64754->cci = devm_cci_regmap_init_i2c(client, 8);
++	if (IS_ERR(bu64754->cci)) {
++		dev_err(bu64754->dev, "Failed to initialize CCI\n");
++		return PTR_ERR(bu64754->cci);
++	}
++
++	bu64754->vdd = devm_regulator_get_optional(&client->dev, "vdd");
++	if (IS_ERR(bu64754->vdd)) {
++		if (PTR_ERR(bu64754->vdd) != -ENODEV)
++			return PTR_ERR(bu64754->vdd);
++
++		bu64754->vdd = NULL;
++	} else {
++		bu64754->notifier.notifier_call = bu64754_regulator_event;
++
++		ret = regulator_register_notifier(bu64754->vdd,
++						  &bu64754->notifier);
++		if (ret) {
++			dev_err(bu64754->dev,
++				"could not register regulator notifier\n");
++			return ret;
++		}
++	}
++
++	v4l2_i2c_subdev_init(&bu64754->sd, client, &bu64754_ops);
++	bu64754->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
++	bu64754->sd.internal_ops = &bu64754_int_ops;
++	bu64754->sd.entity.function = MEDIA_ENT_F_LENS;
++
++	ret = bu64754_init_controls(bu64754);
++	if (ret)
++		goto err_cleanup;
++
++	ret = media_entity_pads_init(&bu64754->sd.entity, 0, NULL);
++	if (ret < 0)
++		goto err_cleanup;
++
++	bu64754->sd.entity.function = MEDIA_ENT_F_LENS;
++
++	ret = v4l2_async_register_subdev(&bu64754->sd);
++	if (ret < 0)
++		goto err_cleanup;
++
++	if (!bu64754->vdd)
++		pm_runtime_set_active(&client->dev);
++
++	pm_runtime_enable(&client->dev);
++	pm_runtime_idle(&client->dev);
++
++	return 0;
++
++err_cleanup:
++	v4l2_ctrl_handler_free(&bu64754->ctrls_vcm);
++	media_entity_cleanup(&bu64754->sd.entity);
++
++	return ret;
++}
++
++static void bu64754_remove(struct i2c_client *client)
++{
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct bu64754 *bu64754 = sd_to_bu64754(sd);
++
++	if (bu64754->vdd)
++		regulator_unregister_notifier(bu64754->vdd,
++					      &bu64754->notifier);
++
++	pm_runtime_disable(&client->dev);
++
++	bu64754_subdev_cleanup(bu64754);
++}
++
++static int __maybe_unused bu64754_vcm_suspend(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct bu64754 *bu64754 = sd_to_bu64754(sd);
++
++	if (bu64754->vdd)
++		return regulator_disable(bu64754->vdd);
++
++	return bu64754_standby(bu64754);
++}
++
++static int  __maybe_unused bu64754_vcm_resume(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct bu64754 *bu64754 = sd_to_bu64754(sd);
++
++	if (bu64754->vdd)
++		return regulator_enable(bu64754->vdd);
++
++	return bu64754_active(bu64754);
++}
++
++static const struct of_device_id bu64754_of_table[] = {
++	{ .compatible = "rohm,bu64754", },
++	{ /* sentinel */ }
++};
++
++MODULE_DEVICE_TABLE(of, bu64754_of_table);
++
++static const struct dev_pm_ops bu64754_pm_ops = {
++	SET_SYSTEM_SLEEP_PM_OPS(bu64754_vcm_suspend, bu64754_vcm_resume)
++	SET_RUNTIME_PM_OPS(bu64754_vcm_suspend, bu64754_vcm_resume, NULL)
++};
++
++static struct i2c_driver bu64754_i2c_driver = {
++	.driver = {
++		.name = "bu64754",
++		.pm = &bu64754_pm_ops,
++		.of_match_table = bu64754_of_table,
++	},
++	.probe = bu64754_probe,
++	.remove = bu64754_remove,
++};
++
++module_i2c_driver(bu64754_i2c_driver);
++
++MODULE_AUTHOR("Kieran Bingham");
++MODULE_DESCRIPTION("BU64754 VCM driver");
++MODULE_LICENSE("GPL");
++
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0410-firmware-psci-Pass-given-partition-number-through.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0410-firmware-psci-Pass-given-partition-number-through.patch
new file mode 100644
index 00000000..5896a644
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0410-firmware-psci-Pass-given-partition-number-through.patch
@@ -0,0 +1,33 @@
+From 65b3cdbfdc3084d31da8a2ef62d3022434387948 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 11 Dec 2023 16:58:07 +0000
+Subject: [PATCH 410/697] firmware/psci: Pass given partition number through
+
+Pi 5 uses BL31 as its armstub file, so the reset goes via PSCI. Parse
+any "reboot" parameter as a partition number to reboot into.
+N.B. This code path is only used if reboot mode has been set to warm
+or soft.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/firmware/psci/psci.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/firmware/psci/psci.c
++++ b/drivers/firmware/psci/psci.c
+@@ -315,7 +315,14 @@ static int psci_sys_reset(struct notifie
+ 		 * reset_type[30:0] = 0 (SYSTEM_WARM_RESET)
+ 		 * cookie = 0 (ignored by the implementation)
+ 		 */
+-		invoke_psci_fn(PSCI_FN_NATIVE(1_1, SYSTEM_RESET2), 0, 0, 0);
++		// Allow extra arguments separated by spaces after
++		// the partition number.
++		unsigned long val;
++		u8 partition = 0;
++
++		if (data && sscanf(data, "%lu", &val) == 1 && val < 63)
++			partition = val;
++		invoke_psci_fn(PSCI_FN_NATIVE(1_1, SYSTEM_RESET2), 0, partition, 0);
+ 	} else {
+ 		invoke_psci_fn(PSCI_0_2_FN_SYSTEM_RESET, 0, 0, 0);
+ 	}
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0411-media-i2c-adv7180-Use-MEDIA_BUS_FMT_UYVY8_1X16-for-C.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0411-media-i2c-adv7180-Use-MEDIA_BUS_FMT_UYVY8_1X16-for-C.patch
new file mode 100644
index 00000000..c978d95e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0411-media-i2c-adv7180-Use-MEDIA_BUS_FMT_UYVY8_1X16-for-C.patch
@@ -0,0 +1,48 @@
+From e14afbbe1448b1ee0ca961e5b137cb6bbc7855e1 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 21 Dec 2023 18:01:59 +0000
+Subject: [PATCH 411/697] media: i2c: adv7180: Use MEDIA_BUS_FMT_UYVY8_1X16 for
+ CSI2 output
+
+CSI2 devices are meant to use the 1Xnn formats rather than 2Xnn
+such as MEDIA_BUS_FMT_UYVY8_2X8.
+
+For devices with ADV7180_FLAG_MIPI_CSI2 set, use
+MEDIA_BUS_FMT_UYVY8_1X16.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/adv7180.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -732,10 +732,15 @@ static int adv7180_enum_mbus_code(struct
+ 				  struct v4l2_subdev_state *sd_state,
+ 				  struct v4l2_subdev_mbus_code_enum *code)
+ {
++	struct adv7180_state *state = to_state(sd);
++
+ 	if (code->index != 0)
+ 		return -EINVAL;
+ 
+-	code->code = MEDIA_BUS_FMT_UYVY8_2X8;
++	if (state->chip_info->flags & ADV7180_FLAG_MIPI_CSI2)
++		code->code = MEDIA_BUS_FMT_UYVY8_1X16;
++	else
++		code->code = MEDIA_BUS_FMT_UYVY8_2X8;
+ 
+ 	return 0;
+ }
+@@ -745,7 +750,10 @@ static int adv7180_mbus_fmt(struct v4l2_
+ {
+ 	struct adv7180_state *state = to_state(sd);
+ 
+-	fmt->code = MEDIA_BUS_FMT_UYVY8_2X8;
++	if (state->chip_info->flags & ADV7180_FLAG_MIPI_CSI2)
++		fmt->code = MEDIA_BUS_FMT_UYVY8_1X16;
++	else
++		fmt->code = MEDIA_BUS_FMT_UYVY8_2X8;
+ 	fmt->colorspace = V4L2_COLORSPACE_SMPTE170M;
+ 	fmt->width = 720;
+ 	fmt->height = state->curr_norm & V4L2_STD_525_60 ? 480 : 576;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0412-media-i2c-adv7180-Add-support-for-V4L2_CID_LINK_FREQ.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0412-media-i2c-adv7180-Add-support-for-V4L2_CID_LINK_FREQ.patch
new file mode 100644
index 00000000..a5ead8cc
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0412-media-i2c-adv7180-Add-support-for-V4L2_CID_LINK_FREQ.patch
@@ -0,0 +1,99 @@
+From 59225a4f0fc8b4433f1654b9cfa4bb13fcbf76f5 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 21 Dec 2023 18:03:34 +0000
+Subject: [PATCH 412/697] media: i2c: adv7180: Add support for
+ V4L2_CID_LINK_FREQ
+
+For CSI2 receivers that need to know the link frequency,
+add it as a control to the driver.
+Interlaced modes are 216Mbp/s or 108MHz, whilst going through
+the I2P to deinterlace gives 432Mb/s or 216MHz.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/adv7180.c | 32 +++++++++++++++++++++++++++++++-
+ 1 file changed, 31 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -189,6 +189,16 @@
+ /* Initial number of frames to skip to avoid possible garbage */
+ #define ADV7180_NUM_OF_SKIP_FRAMES       2
+ 
++enum adv7180_link_freq_idx {
++	INTERLACED_IDX,
++	I2P_IDX,
++};
++
++static const s64 adv7180_link_freqs[] = {
++	[INTERLACED_IDX] = 108000000,
++	[I2P_IDX] = 216000000,
++};
++
+ static int dbg_input;
+ module_param(dbg_input, int, 0644);
+ MODULE_PARM_DESC(dbg_input, "Input number (0-31)");
+@@ -228,6 +238,7 @@ struct adv7180_state {
+ 	const struct adv7180_chip_info *chip_info;
+ 	enum v4l2_field		field;
+ 	bool			force_bt656_4;
++	struct v4l2_ctrl	*link_freq;
+ };
+ #define to_adv7180_sd(_ctrl) (&container_of(_ctrl->handler,		\
+ 					    struct adv7180_state,	\
+@@ -629,6 +640,9 @@ static int adv7180_s_ctrl(struct v4l2_ct
+ 
+ 	if (ret)
+ 		return ret;
++	if (ctrl->flags & V4L2_CTRL_FLAG_READ_ONLY)
++		goto unlock;
++
+ 	val = ctrl->val;
+ 	switch (ctrl->id) {
+ 	case V4L2_CID_BRIGHTNESS:
+@@ -670,6 +684,7 @@ static int adv7180_s_ctrl(struct v4l2_ct
+ 		ret = -EINVAL;
+ 	}
+ 
++unlock:
+ 	mutex_unlock(&state->mutex);
+ 	return ret;
+ }
+@@ -690,7 +705,7 @@ static const struct v4l2_ctrl_config adv
+ 
+ static int adv7180_init_controls(struct adv7180_state *state)
+ {
+-	v4l2_ctrl_handler_init(&state->ctrl_hdl, 4);
++	v4l2_ctrl_handler_init(&state->ctrl_hdl, 5);
+ 
+ 	v4l2_ctrl_new_std(&state->ctrl_hdl, &adv7180_ctrl_ops,
+ 			  V4L2_CID_BRIGHTNESS, ADV7180_BRI_MIN,
+@@ -712,6 +727,17 @@ static int adv7180_init_controls(struct
+ 				      0, ARRAY_SIZE(test_pattern_menu) - 1,
+ 				      test_pattern_menu);
+ 
++	if (state->chip_info->flags & ADV7180_FLAG_MIPI_CSI2) {
++		state->link_freq =
++			v4l2_ctrl_new_int_menu(&state->ctrl_hdl,
++					       &adv7180_ctrl_ops,
++					       V4L2_CID_LINK_FREQ,
++					       ARRAY_SIZE(adv7180_link_freqs) - 1,
++					       0, adv7180_link_freqs);
++		if (state->link_freq)
++			state->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++	}
++
+ 	state->sd.ctrl_handler = &state->ctrl_hdl;
+ 	if (state->ctrl_hdl.error) {
+ 		int err = state->ctrl_hdl.error;
+@@ -844,6 +870,10 @@ static int adv7180_set_pad_format(struct
+ 			adv7180_set_power(state, false);
+ 			adv7180_set_field_mode(state);
+ 			adv7180_set_power(state, true);
++			if (state->chip_info->flags & ADV7180_FLAG_MIPI_CSI2)
++				__v4l2_ctrl_s_ctrl(state->link_freq,
++						   (state->field == V4L2_FIELD_NONE) ?
++						   I2P_IDX : INTERLACED_IDX);
+ 		}
+ 	} else {
+ 		framefmt = v4l2_subdev_state_get_format(sd_state, 0);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0413-spi-bcm2835-Support-spi0-0cs-and-SPI_NO_CS-mode.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0413-spi-bcm2835-Support-spi0-0cs-and-SPI_NO_CS-mode.patch
new file mode 100644
index 00000000..a55d6a76
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0413-spi-bcm2835-Support-spi0-0cs-and-SPI_NO_CS-mode.patch
@@ -0,0 +1,42 @@
+From 69e6058ae026e6d73796b698e5a95e32d9b5a742 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 8 Jan 2024 11:42:57 +0000
+Subject: [PATCH 413/697] spi: bcm2835: Support spi0-0cs and SPI_NO_CS mode
+
+The forced conversion of native CS lines into software CS lines is done
+whether or not the controller has been given any CS lines to use. This
+breaks the use of the spi0-0cs overlay to prevent SPI from claiming any
+CS lines, particularly with spidev which doesn't pass in the SPI_NO_CS
+flag at creation.
+
+Use the presence of an empty cs-gpios property as an indication that no
+CS lines should be used, bypassing the native CS conversion code.
+
+See: https://github.com/raspberrypi/linux/issues/5835
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/spi/spi-bcm2835.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/spi/spi-bcm2835.c
++++ b/drivers/spi/spi-bcm2835.c
+@@ -1225,6 +1225,7 @@ static int bcm2835_spi_setup(struct spi_
+ 	struct bcm2835_spi *bs = spi_controller_get_devdata(ctlr);
+ 	struct bcm2835_spidev *target = spi_get_ctldata(spi);
+ 	struct gpiod_lookup_table *lookup __free(kfree) = NULL;
++	int len;
+ 	int ret;
+ 	u32 cs;
+ 
+@@ -1290,6 +1291,10 @@ static int bcm2835_spi_setup(struct spi_
+ 		goto err_cleanup;
+ 	}
+ 
++	/* Skip forced CS conversion if controller has an empty cs-gpios property */
++	if (of_find_property(ctlr->dev.of_node, "cs-gpios", &len) && len == 0)
++		return 0;
++
+ 	/*
+ 	 * TODO: The code below is a slightly better alternative to the utter
+ 	 * abuse of the GPIO API that I found here before. It creates a
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0414-dt-bindings-usb-update-dwc3-bindings-for-parkmode-di.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0414-dt-bindings-usb-update-dwc3-bindings-for-parkmode-di.patch
new file mode 100644
index 00000000..3e0c5902
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0414-dt-bindings-usb-update-dwc3-bindings-for-parkmode-di.patch
@@ -0,0 +1,37 @@
+From 9248ef85a72e5267991c00fa825dc986fd333011 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 24 Jan 2024 16:26:37 +0000
+Subject: [PATCH 414/697] dt-bindings: usb: update dwc3 bindings for
+ parkmode-disable quirks
+
+There are three disable bits, one for each bus-instance type. Add a
+quirk to cover the FS/LS type, and update the slightly mangled quirk
+descriptions in the process.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ Documentation/devicetree/bindings/usb/snps,dwc3.yaml | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/Documentation/devicetree/bindings/usb/snps,dwc3.yaml
++++ b/Documentation/devicetree/bindings/usb/snps,dwc3.yaml
+@@ -234,12 +234,17 @@ properties:
+ 
+   snps,parkmode-disable-ss-quirk:
+     description:
+-      When set, all SuperSpeed bus instances in park mode are disabled.
++      When set, disable park mode for all Superspeed bus instances.
+     type: boolean
+ 
+   snps,parkmode-disable-hs-quirk:
+     description:
+-      When set, all HighSpeed bus instances in park mode are disabled.
++      When set, disable park mode for all Highspeed bus instances.
++    type: boolean
++
++  snps,parkmode-disable-fsls-quirk:
++    description:
++      When set, disable park mode for all Full/Lowspeed bus instances.
+     type: boolean
+ 
+   snps,dis_metastability_quirk:
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0415-drivers-usb-dwc3-add-FS-LS-bus-instance-parkmode-dis.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0415-drivers-usb-dwc3-add-FS-LS-bus-instance-parkmode-dis.patch
new file mode 100644
index 00000000..c6feb1b7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0415-drivers-usb-dwc3-add-FS-LS-bus-instance-parkmode-dis.patch
@@ -0,0 +1,72 @@
+From 7e4a08a2a58838305d6acdfa2b26738668fc4bd1 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 24 Jan 2024 16:28:19 +0000
+Subject: [PATCH 415/697] drivers: usb: dwc3: add FS/LS bus instance parkmode
+ disable bit
+
+There are three parkmode disable bits, one for each bus instance type.
+Add FS/LS and parse the quirk out of DT. Also update the slightly
+mangled quirk descriptions.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/dwc3/core.c |  5 +++++
+ drivers/usb/dwc3/core.h | 12 ++++++++----
+ 2 files changed, 13 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1470,6 +1470,9 @@ static int dwc3_core_init(struct dwc3 *d
+ 		if (dwc->parkmode_disable_hs_quirk)
+ 			reg |= DWC3_GUCTL1_PARKMODE_DISABLE_HS;
+ 
++		if (dwc->parkmode_disable_fsls_quirk)
++			reg |= DWC3_GUCTL1_PARKMODE_DISABLE_FSLS;
++
+ 		if (DWC3_VER_IS_WITHIN(DWC3, 290A, ANY)) {
+ 			if (dwc->maximum_speed == USB_SPEED_FULL ||
+ 			    dwc->maximum_speed == USB_SPEED_HIGH)
+@@ -1825,6 +1828,8 @@ static void dwc3_get_properties(struct d
+ 				"snps,parkmode-disable-ss-quirk");
+ 	dwc->parkmode_disable_hs_quirk = device_property_read_bool(dev,
+ 				"snps,parkmode-disable-hs-quirk");
++	dwc->parkmode_disable_fsls_quirk = device_property_read_bool(dev,
++				"snps,parkmode-disable-fsls-quirk");
+ 	dwc->gfladj_refclk_lpm_sel = device_property_read_bool(dev,
+ 				"snps,gfladj-refclk-lpm-sel-quirk");
+ 
+--- a/drivers/usb/dwc3/core.h
++++ b/drivers/usb/dwc3/core.h
+@@ -284,6 +284,7 @@
+ #define DWC3_GUCTL1_DEV_L1_EXIT_BY_HW		BIT(24)
+ #define DWC3_GUCTL1_PARKMODE_DISABLE_SS		BIT(17)
+ #define DWC3_GUCTL1_PARKMODE_DISABLE_HS		BIT(16)
++#define DWC3_GUCTL1_PARKMODE_DISABLE_FSLS	BIT(15)
+ #define DWC3_GUCTL1_RESUME_OPMODE_HS_HOST	BIT(10)
+ 
+ /* Global Status Register */
+@@ -1141,10 +1142,12 @@ struct dwc3_scratchpad_array {
+  *			generation after resume from suspend.
+  * @ulpi_ext_vbus_drv: Set to confiure the upli chip to drives CPEN pin
+  *			VBUS with an external supply.
+- * @parkmode_disable_ss_quirk: set if we need to disable all SuperSpeed
+- *			instances in park mode.
+- * @parkmode_disable_hs_quirk: set if we need to disable all HishSpeed
+- *			instances in park mode.
++ * @parkmode_disable_ss_quirk: If set, disable park mode feature for all
++ *			Superspeed instances.
++ * @parkmode_disable_hs_quirk: If set, disable park mode feature for all
++ *			Highspeed instances.
++ * @parkmode_disable_fsls_quirk: If set, disable park mode feature for all
++ *			Full/Lowspeed instances.
+  * @gfladj_refclk_lpm_sel: set if we need to enable SOF/ITP counter
+  *                          running based on ref_clk
+  * @tx_de_emphasis_quirk: set if we enable Tx de-emphasis quirk
+@@ -1381,6 +1384,7 @@ struct dwc3 {
+ 	unsigned		ulpi_ext_vbus_drv:1;
+ 	unsigned		parkmode_disable_ss_quirk:1;
+ 	unsigned		parkmode_disable_hs_quirk:1;
++	unsigned		parkmode_disable_fsls_quirk:1;
+ 	unsigned		gfladj_refclk_lpm_sel:1;
+ 
+ 	unsigned		tx_de_emphasis_quirk:1;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0416-i2c-designware-Use-SCL-rise-and-fall-times-in-DT.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0416-i2c-designware-Use-SCL-rise-and-fall-times-in-DT.patch
new file mode 100644
index 00000000..bbbc70d7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0416-i2c-designware-Use-SCL-rise-and-fall-times-in-DT.patch
@@ -0,0 +1,83 @@
+From 0d18e1249c2dacf0bb001d967900e3b5e825275a Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 16 Jan 2024 15:54:22 +0000
+Subject: [PATCH 416/697] i2c: designware: Use SCL rise and fall times in DT
+
+Calculate the HCNT and LCNT values for all modes using the rise and
+fall times of SCL, the aim being a 50/50 mark/space ratio.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/i2c/busses/i2c-designware-master.c | 26 ++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-designware-master.c
++++ b/drivers/i2c/busses/i2c-designware-master.c
+@@ -40,6 +40,22 @@ static void i2c_dw_configure_fifo_master
+ 	regmap_write(dev->map, DW_IC_CON, dev->master_cfg);
+ }
+ 
++static u16 clock_calc(struct dw_i2c_dev *dev, bool want_high)
++{
++	struct i2c_timings *t = &dev->timings;
++	u32 wanted_speed = t->bus_freq_hz;
++	u32 clk_khz = i2c_dw_clk_rate(dev);
++	u32 extra_ns = want_high ? t->scl_fall_ns : t->scl_rise_ns;
++	u32 extra_cycles = (u32)((u64)clk_khz * extra_ns / 1000000);
++	u32 period = ((u64)clk_khz * 1000 + wanted_speed - 1) / wanted_speed;
++	u32 cycles = (period + want_high)/2 - extra_cycles;
++
++	if (cycles > 0xffff)
++		cycles = 0xffff;
++
++	return (u16)cycles;
++}
++
+ static int i2c_dw_set_timings_master(struct dw_i2c_dev *dev)
+ {
+ 	unsigned int comp_param1;
+@@ -47,6 +63,7 @@ static int i2c_dw_set_timings_master(str
+ 	struct i2c_timings *t = &dev->timings;
+ 	const char *fp_str = "";
+ 	u32 ic_clk;
++	u32 hcnt, lcnt;
+ 	int ret;
+ 
+ 	ret = i2c_dw_acquire_lock(dev);
+@@ -62,6 +79,9 @@ static int i2c_dw_set_timings_master(str
+ 	sda_falling_time = t->sda_fall_ns ?: 300; /* ns */
+ 	scl_falling_time = t->scl_fall_ns ?: 300; /* ns */
+ 
++	hcnt = clock_calc(dev, true);
++	lcnt = clock_calc(dev, false);
++
+ 	/* Calculate SCL timing parameters for standard mode if not set */
+ 	if (!dev->ss_hcnt || !dev->ss_lcnt) {
+ 		ic_clk = i2c_dw_clk_rate(dev);
+@@ -81,6 +101,8 @@ static int i2c_dw_set_timings_master(str
+ 					scl_falling_time,
+ 					0);	/* No offset */
+ 	}
++	dev->ss_hcnt = hcnt;
++	dev->ss_lcnt = lcnt;
+ 	dev_dbg(dev->dev, "Standard Mode HCNT:LCNT = %d:%d\n",
+ 		dev->ss_hcnt, dev->ss_lcnt);
+ 
+@@ -139,6 +161,8 @@ static int i2c_dw_set_timings_master(str
+ 					scl_falling_time,
+ 					0);	/* No offset */
+ 	}
++	dev->fs_hcnt = hcnt;
++	dev->fs_lcnt = lcnt;
+ 	dev_dbg(dev->dev, "Fast Mode%s HCNT:LCNT = %d:%d\n",
+ 		fp_str, dev->fs_hcnt, dev->fs_lcnt);
+ 
+@@ -171,6 +195,8 @@ static int i2c_dw_set_timings_master(str
+ 						scl_falling_time,
+ 						0);	/* No offset */
+ 		}
++		dev->hs_hcnt = hcnt;
++		dev->hs_lcnt = lcnt;
+ 		dev_dbg(dev->dev, "High Speed Mode HCNT:LCNT = %d:%d\n",
+ 			dev->hs_hcnt, dev->hs_lcnt);
+ 	}
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0417-i2c-designware-Support-non-standard-bus-speeds.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0417-i2c-designware-Support-non-standard-bus-speeds.patch
new file mode 100644
index 00000000..f3797224
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0417-i2c-designware-Support-non-standard-bus-speeds.patch
@@ -0,0 +1,124 @@
+From 23087d3f29adf1bd2b53111b9e61f8935fdbcf47 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 16 Jan 2024 16:03:14 +0000
+Subject: [PATCH 417/697] i2c: designware: Support non-standard bus speeds
+
+Add support for non-standard bus speeds by treating them as detuned
+versions of the slowest standard speed not less than the requested
+speed.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/i2c/busses/i2c-designware-common.c | 27 ++++++++++++++++
+ drivers/i2c/busses/i2c-designware-core.h   |  1 +
+ drivers/i2c/busses/i2c-designware-master.c | 37 ++++++++++++++--------
+ 3 files changed, 52 insertions(+), 13 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-designware-common.c
++++ b/drivers/i2c/busses/i2c-designware-common.c
+@@ -359,6 +359,9 @@ static void i2c_dw_adjust_bus_speed(stru
+ {
+ 	u32 acpi_speed = i2c_dw_acpi_round_bus_speed(dev->dev);
+ 	struct i2c_timings *t = &dev->timings;
++	u32 wanted_speed;
++	u32 legal_speed = 0;
++	int i;
+ 
+ 	/*
+ 	 * Find bus speed from the "clock-frequency" device property, ACPI
+@@ -370,6 +373,30 @@ static void i2c_dw_adjust_bus_speed(stru
+ 		t->bus_freq_hz = max(t->bus_freq_hz, acpi_speed);
+ 	else
+ 		t->bus_freq_hz = I2C_MAX_FAST_MODE_FREQ;
++
++	wanted_speed = t->bus_freq_hz;
++
++	/* For unsupported speeds, scale down the lowest speed which is faster. */
++	for (i = 0; i < ARRAY_SIZE(supported_speeds); i++) {
++		/* supported speeds is in decreasing order */
++		if (wanted_speed == supported_speeds[i]) {
++			legal_speed = 0;
++			break;
++		}
++		if (wanted_speed > supported_speeds[i])
++			break;
++
++		legal_speed = supported_speeds[i];
++	}
++
++	if (legal_speed) {
++		/*
++		 * Pretend this was the requested speed, but preserve the preferred
++		 * speed so the clock counts can be scaled.
++		 */
++		t->bus_freq_hz = legal_speed;
++		dev->wanted_bus_speed = wanted_speed;
++	}
+ }
+ 
+ int i2c_dw_fw_parse_and_configure(struct dw_i2c_dev *dev)
+--- a/drivers/i2c/busses/i2c-designware-core.h
++++ b/drivers/i2c/busses/i2c-designware-core.h
+@@ -293,6 +293,7 @@ struct dw_i2c_dev {
+ 	u16			fp_lcnt;
+ 	u16			hs_hcnt;
+ 	u16			hs_lcnt;
++	u32			wanted_bus_speed;
+ 	int			(*acquire_lock)(void);
+ 	void			(*release_lock)(void);
+ 	int			semaphore_idx;
+--- a/drivers/i2c/busses/i2c-designware-master.c
++++ b/drivers/i2c/busses/i2c-designware-master.c
+@@ -40,20 +40,32 @@ static void i2c_dw_configure_fifo_master
+ 	regmap_write(dev->map, DW_IC_CON, dev->master_cfg);
+ }
+ 
+-static u16 clock_calc(struct dw_i2c_dev *dev, bool want_high)
++static u32 linear_interpolate(u32 x, u32 x1, u32 x2, u32 y1, u32 y2)
++{
++	return ((x - x1) * y2 + (x2 - x) * y1) / (x2 - x1);
++}
++
++static u16 u16_clamp(u32 v)
++{
++	return (u16)min(v, 0xffff);
++}
++
++static void clock_calc(struct dw_i2c_dev *dev, u32 *hcnt, u32 *lcnt)
+ {
+ 	struct i2c_timings *t = &dev->timings;
+-	u32 wanted_speed = t->bus_freq_hz;
++	u32 wanted_khz = (dev->wanted_bus_speed ?: t->bus_freq_hz)/1000;
+ 	u32 clk_khz = i2c_dw_clk_rate(dev);
+-	u32 extra_ns = want_high ? t->scl_fall_ns : t->scl_rise_ns;
+-	u32 extra_cycles = (u32)((u64)clk_khz * extra_ns / 1000000);
+-	u32 period = ((u64)clk_khz * 1000 + wanted_speed - 1) / wanted_speed;
+-	u32 cycles = (period + want_high)/2 - extra_cycles;
+-
+-	if (cycles > 0xffff)
+-		cycles = 0xffff;
++	u32 min_high_ns = (wanted_khz <= 100) ? 4000 :
++			  (wanted_khz <= 400) ?
++				linear_interpolate(wanted_khz, 100, 400, 4000, 600) :
++				linear_interpolate(wanted_khz, 400, 1000, 600, 260);
++	u32 high_cycles = (u32)(((u64)clk_khz * min_high_ns + 999999) / 1000000) + 1;
++	u32 extra_high_cycles = (u32)((u64)clk_khz * t->scl_fall_ns / 1000000);
++	u32 extra_low_cycles = (u32)((u64)clk_khz * t->scl_rise_ns / 1000000);
++	u32 period = ((u64)clk_khz + wanted_khz - 1) / wanted_khz;
+ 
+-	return (u16)cycles;
++	*hcnt = u16_clamp(high_cycles - extra_high_cycles);
++	*lcnt = u16_clamp(period - high_cycles - extra_low_cycles);
+ }
+ 
+ static int i2c_dw_set_timings_master(struct dw_i2c_dev *dev)
+@@ -79,8 +91,7 @@ static int i2c_dw_set_timings_master(str
+ 	sda_falling_time = t->sda_fall_ns ?: 300; /* ns */
+ 	scl_falling_time = t->scl_fall_ns ?: 300; /* ns */
+ 
+-	hcnt = clock_calc(dev, true);
+-	lcnt = clock_calc(dev, false);
++	clock_calc(dev, &hcnt, &lcnt);
+ 
+ 	/* Calculate SCL timing parameters for standard mode if not set */
+ 	if (!dev->ss_hcnt || !dev->ss_lcnt) {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0418-serial-sc16is7xx-Don-t-spin-if-no-data-received.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0418-serial-sc16is7xx-Don-t-spin-if-no-data-received.patch
new file mode 100644
index 00000000..c31383c2
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0418-serial-sc16is7xx-Don-t-spin-if-no-data-received.patch
@@ -0,0 +1,26 @@
+From 6adfb0fd31d93051f49fa915de71518b35974c52 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 2 Feb 2024 15:41:29 +0000
+Subject: [PATCH 418/697] serial: sc16is7xx: Don't spin if no data received
+
+There are multiple causes of interrupts, errors being one, and only the
+receipt of data warrants continued polling.
+
+See: https://github.com/raspberrypi/linux/issues/2676
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/tty/serial/sc16is7xx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/tty/serial/sc16is7xx.c
++++ b/drivers/tty/serial/sc16is7xx.c
+@@ -821,6 +821,8 @@ static bool sc16is7xx_port_irq(struct sc
+ 
+ 		if (rxlen)
+ 			sc16is7xx_handle_rx(port, rxlen, iir);
++		else
++			rc = false;
+ 		break;
+ 		/* CTSRTS interrupt comes only when CTS goes inactive */
+ 	case SC16IS7XX_IIR_CTSRTS_SRC:
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0419-arm64-Kconfig-Don-t-set-DMA_BOUNCE_UNALIGNED_KMALLOC.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0419-arm64-Kconfig-Don-t-set-DMA_BOUNCE_UNALIGNED_KMALLOC.patch
new file mode 100644
index 00000000..84a29f7e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0419-arm64-Kconfig-Don-t-set-DMA_BOUNCE_UNALIGNED_KMALLOC.patch
@@ -0,0 +1,29 @@
+From 0ac4d5d1e10d61849aa856e6de3a0e48f534adcf Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 21 Feb 2024 14:16:21 +0000
+Subject: [PATCH 419/697] arm64/Kconfig: Don't set DMA_BOUNCE_UNALIGNED_KMALLOC
+
+If enabled, DMA_BOUNCE_UNALIGNED_KMALLOC causes the swiotlb buffers
+(64MB, by default) to be allocated, even on systems where the DMA
+controller can reach all of RAM. This is a huge amount of RAM to
+waste on a device with only 512MB to start with, such as the Zero 2 W.
+
+See: https://github.com/raspberrypi/linux/issues/5975
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm64/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -130,7 +130,8 @@ config ARM64
+ 	select CRC32
+ 	select DCACHE_WORD_ACCESS
+ 	select DYNAMIC_FTRACE if FUNCTION_TRACER
+-	select DMA_BOUNCE_UNALIGNED_KMALLOC
++	# Disable this to save 64MB when DMA controllers can reach all of RAM
++	# select DMA_BOUNCE_UNALIGNED_KMALLOC
+ 	select DMA_DIRECT_REMAP
+ 	select EDAC_SUPPORT
+ 	select FRAME_POINTER
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0420-Bluetooth-btbcm-Add-entry-for-BCM43439-UART-BT.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0420-Bluetooth-btbcm-Add-entry-for-BCM43439-UART-BT.patch
new file mode 100644
index 00000000..077558b0
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0420-Bluetooth-btbcm-Add-entry-for-BCM43439-UART-BT.patch
@@ -0,0 +1,24 @@
+From 4d688961aba2e64ccd17d763ba21a094aee2f299 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 20 Feb 2024 10:17:12 +0000
+Subject: [PATCH 420/697] Bluetooth: btbcm: Add entry for BCM43439 UART BT
+
+This patch adds the device ID for the BCM4343A2 module, found e.g. in
+the Infineon (Cypress) CYW43439 chip. The required firmware file is
+named 'BCM4343A2.hcd'.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/bluetooth/btbcm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/bluetooth/btbcm.c
++++ b/drivers/bluetooth/btbcm.c
+@@ -521,6 +521,7 @@ static const struct bcm_subver_table bcm
+ 	{ 0x4106, "BCM4335A0"	},	/* 002.001.006 */
+ 	{ 0x410c, "BCM43430B0"	},	/* 002.001.012 */
+ 	{ 0x2119, "BCM4373A0"	},	/* 001.001.025 */
++	{ 0x2310, "BCM4343A2"	},	/* 001.003.016 */
+ 	{ }
+ };
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0421-dt-bindings-add-additional-RP1-PLL-output-channels.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0421-dt-bindings-add-additional-RP1-PLL-output-channels.patch
new file mode 100644
index 00000000..62778274
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0421-dt-bindings-add-additional-RP1-PLL-output-channels.patch
@@ -0,0 +1,23 @@
+From dbb9f53907abd8e88b62e23aaa4605e1a15fc0d8 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Tue, 5 Mar 2024 10:05:16 +0000
+Subject: [PATCH 421/697] dt-bindings: add additional RP1 PLL output channels
+
+PLL_AUDIO has a ternary divider (a copy of the secondary divider) and
+PLL_VIDEO has a primary phased output.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ include/dt-bindings/clock/rp1.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/include/dt-bindings/clock/rp1.h
++++ b/include/dt-bindings/clock/rp1.h
+@@ -50,3 +50,7 @@
+ #define RP1_CLK_DPI			40
+ #define RP1_CLK_MIPI0_DPI		41
+ #define RP1_CLK_MIPI1_DPI		42
++
++/* Extra PLL output channels - RP1B0 only */
++#define RP1_PLL_VIDEO_PRI_PH		43
++#define RP1_PLL_AUDIO_TERN		44
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0422-regulator-Add-a-regulator-for-the-new-LCD-panels.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0422-regulator-Add-a-regulator-for-the-new-LCD-panels.patch
new file mode 100644
index 00000000..5bb2e62c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0422-regulator-Add-a-regulator-for-the-new-LCD-panels.patch
@@ -0,0 +1,238 @@
+From 7859dcd00b84470b74becdf27c26bb1e8f854736 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 30 Nov 2020 16:45:23 +0000
+Subject: [PATCH 422/697] regulator: Add a regulator for the new LCD panels
+
+The newer Raspberry Pi 5" and 7" panels have a slightly different
+register map to the original one.
+Add a new driver for this regulator.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/regulator/Kconfig                  |  10 ++
+ drivers/regulator/Makefile                 |   1 +
+ drivers/regulator/rpi-panel-v2-regulator.c | 189 +++++++++++++++++++++
+ 3 files changed, 200 insertions(+)
+ create mode 100644 drivers/regulator/rpi-panel-v2-regulator.c
+
+--- a/drivers/regulator/Kconfig
++++ b/drivers/regulator/Kconfig
+@@ -1142,6 +1142,16 @@ config REGULATOR_RASPBERRYPI_TOUCHSCREEN
+ 	  touchscreen unit. The regulator is used to enable power to the
+ 	  TC358762, display and to control backlight.
+ 
++config REGULATOR_RASPBERRYPI_TOUCHSCREEN_V2
++	tristate "Raspberry Pi 7-inch touchscreen panel V2 regulator"
++	depends on BACKLIGHT_CLASS_DEVICE
++	depends on I2C
++	select REGMAP_I2C
++	help
++	  This driver supports regulator on the V2 Raspberry Pi
++	  touchscreen unit. The regulator is used to enable power to the
++	  display and to control backlight.
++
+ config REGULATOR_RC5T583
+ 	tristate "RICOH RC5T583 Power regulators"
+ 	depends on MFD_RC5T583
+--- a/drivers/regulator/Makefile
++++ b/drivers/regulator/Makefile
+@@ -135,6 +135,7 @@ obj-$(CONFIG_REGULATOR_PCAP) += pcap-reg
+ obj-$(CONFIG_REGULATOR_PCF50633) += pcf50633-regulator.o
+ obj-$(CONFIG_REGULATOR_RAA215300) += raa215300.o
+ obj-$(CONFIG_REGULATOR_RASPBERRYPI_TOUCHSCREEN_ATTINY)  += rpi-panel-attiny-regulator.o
++obj-$(CONFIG_REGULATOR_RASPBERRYPI_TOUCHSCREEN_V2)  += rpi-panel-v2-regulator.o
+ obj-$(CONFIG_REGULATOR_RC5T583)  += rc5t583-regulator.o
+ obj-$(CONFIG_REGULATOR_RK808)   += rk808-regulator.o
+ obj-$(CONFIG_REGULATOR_RN5T618) += rn5t618-regulator.o
+--- /dev/null
++++ b/drivers/regulator/rpi-panel-v2-regulator.c
+@@ -0,0 +1,189 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (C) 2022 Raspberry Pi Ltd.
++ *
++ * Based on rpi-panel-attiny-regulator.c by Marek Vasut <marex@denx.de>
++ */
++
++#include <linux/backlight.h>
++#include <linux/err.h>
++#include <linux/gpio.h>
++#include <linux/gpio/driver.h>
++#include <linux/module.h>
++#include <linux/regmap.h>
++#include <linux/regulator/driver.h>
++
++/* I2C registers of the microcontroller. */
++#define REG_ID		0x01
++#define REG_POWERON	0x02
++#define REG_PWM		0x03
++
++// bits for poweron register
++#define LCD_RESET_BIT	BIT(0)
++#define CTP_RESET_BIT	BIT(1)
++
++//bits for the PWM register
++#define PWM_BL_ENABLE	BIT(7)
++#define PWM_VALUE	GENMASK(4, 0)
++
++#define NUM_GPIO	2	/* Treat LCD_RESET and CTP_RESET as GPIOs */
++
++struct rpi_panel_v2_lcd {
++	/* lock to serialise overall accesses to the Atmel */
++	struct mutex	lock;
++	struct regmap	*regmap;
++	u8 poweron_state;
++
++	struct gpio_chip gc;
++};
++
++static const struct regmap_config rpi_panel_regmap_config = {
++	.reg_bits = 8,
++	.val_bits = 8,
++	.max_register = REG_PWM,
++};
++
++static int rpi_panel_v2_gpio_get_direction(struct gpio_chip *gc, unsigned int off)
++{
++	return GPIO_LINE_DIRECTION_OUT;
++}
++
++static void rpi_panel_v2_gpio_set(struct gpio_chip *gc, unsigned int off, int val)
++{
++	struct rpi_panel_v2_lcd *state = gpiochip_get_data(gc);
++	u8 last_val;
++
++	if (off >= NUM_GPIO)
++		return;
++
++	mutex_lock(&state->lock);
++
++	last_val = state->poweron_state;
++	if (val)
++		last_val |= (1 << off);
++	else
++		last_val &= ~(1 << off);
++
++	state->poweron_state = last_val;
++
++	regmap_write(state->regmap, REG_POWERON, last_val);
++
++	mutex_unlock(&state->lock);
++}
++
++static int rpi_panel_v2_update_status(struct backlight_device *bl)
++{
++	struct regmap *regmap = bl_get_data(bl);
++	int brightness = bl->props.brightness;
++
++	if (bl->props.power != FB_BLANK_UNBLANK ||
++	    bl->props.fb_blank != FB_BLANK_UNBLANK)
++		brightness = 0;
++
++	return regmap_write(regmap, REG_PWM, brightness | PWM_BL_ENABLE);
++}
++
++static const struct backlight_ops rpi_panel_v2_bl = {
++	.update_status	= rpi_panel_v2_update_status,
++};
++
++/*
++ * I2C driver interface functions
++ */
++static int rpi_panel_v2_i2c_probe(struct i2c_client *i2c)
++{
++	struct backlight_properties props = { };
++	struct backlight_device *bl;
++	struct rpi_panel_v2_lcd *state;
++	struct regmap *regmap;
++	unsigned int data;
++	int ret;
++
++	state = devm_kzalloc(&i2c->dev, sizeof(*state), GFP_KERNEL);
++	if (!state)
++		return -ENOMEM;
++
++	mutex_init(&state->lock);
++
++	regmap = devm_regmap_init_i2c(i2c, &rpi_panel_regmap_config);
++	if (IS_ERR(regmap)) {
++		ret = PTR_ERR(regmap);
++		dev_err(&i2c->dev, "Failed to allocate register map: %d\n",
++			ret);
++		goto error;
++	}
++
++	ret = regmap_read(regmap, REG_ID, &data);
++	if (ret < 0) {
++		dev_err(&i2c->dev, "Failed to read REG_ID reg: %d\n", ret);
++		goto error;
++	}
++
++	switch (data & 0x0f) {
++	case 0x01: /* 7 inch */
++	case 0x04: /* 7 inch - old */
++	case 0x08: /* 5 inch - old */
++	case 0x09: /* 5 inch */
++		break;
++	default:
++		dev_err(&i2c->dev, "Unknown revision: 0x%02x\n",
++			data & 0x0f);
++		ret = -ENODEV;
++		goto error;
++	}
++
++	regmap_write(regmap, REG_POWERON, 0);
++
++	state->regmap = regmap;
++	state->gc.parent = &i2c->dev;
++	state->gc.label = i2c->name;
++	state->gc.owner = THIS_MODULE;
++	state->gc.base = -1;
++	state->gc.ngpio = NUM_GPIO;
++
++	state->gc.set = rpi_panel_v2_gpio_set;
++	state->gc.get_direction = rpi_panel_v2_gpio_get_direction;
++	state->gc.can_sleep = true;
++
++	ret = devm_gpiochip_add_data(&i2c->dev, &state->gc, state);
++	if (ret) {
++		dev_err(&i2c->dev, "Failed to create gpiochip: %d\n", ret);
++		goto error;
++	}
++
++	props.type = BACKLIGHT_RAW;
++	props.max_brightness = PWM_VALUE;
++	bl = devm_backlight_device_register(&i2c->dev, dev_name(&i2c->dev),
++					    &i2c->dev, regmap, &rpi_panel_v2_bl,
++					    &props);
++	if (IS_ERR(bl))
++		return PTR_ERR(bl);
++
++	bl->props.brightness = PWM_VALUE;
++
++	return 0;
++
++error:
++	mutex_destroy(&state->lock);
++	return ret;
++}
++
++static const struct of_device_id rpi_panel_v2_dt_ids[] = {
++	{ .compatible = "raspberrypi,v2-touchscreen-panel-regulator" },
++	{},
++};
++MODULE_DEVICE_TABLE(of, rpi_panel_v2_dt_ids);
++
++static struct i2c_driver rpi_panel_v2_regulator_driver = {
++	.driver = {
++		.name = "rpi_touchscreen_v2",
++		.of_match_table = of_match_ptr(rpi_panel_v2_dt_ids),
++	},
++	.probe = rpi_panel_v2_i2c_probe,
++};
++
++module_i2c_driver(rpi_panel_v2_regulator_driver);
++
++MODULE_AUTHOR("Dave Stevenson <dave.stevenson@raspberrypi.com>");
++MODULE_DESCRIPTION("Regulator device driver for Raspberry Pi 7-inch V2 touchscreen");
++MODULE_LICENSE("GPL");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0423-i2c-mux-Add-support-for-generic-base-nr-property.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0423-i2c-mux-Add-support-for-generic-base-nr-property.patch
new file mode 100644
index 00000000..d2118e41
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0423-i2c-mux-Add-support-for-generic-base-nr-property.patch
@@ -0,0 +1,35 @@
+From 586f779c8bfebc528c882ec7f16dbe4e5d33e676 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 14 Mar 2024 09:55:31 +0000
+Subject: [PATCH 423/697] i2c: mux: Add support for generic base-nr property
+
+i2c_mux_add_adapter takes a force_nr parameter that allows an explicit
+bus number to be associated with a channel. However, only i2c-mux-reg
+and i2c-mux-gpio make use of it.
+
+To help with situations where it is desirable to have a fixed, known
+base address for the channels of a mux, create a "base-nr" property.
+When force_nr is 0 and base-nr is set and non-zero, form a force_nr
+value from the sum of base-nr and the channel ID.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/i2c/i2c-mux.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/i2c/i2c-mux.c
++++ b/drivers/i2c/i2c-mux.c
+@@ -333,8 +333,13 @@ int i2c_mux_add_adapter(struct i2c_mux_c
+ 	if (muxc->dev->of_node) {
+ 		struct device_node *dev_node = muxc->dev->of_node;
+ 		struct device_node *mux_node, *child = NULL;
++		u32 base_nr = 0;
+ 		u32 reg;
+ 
++		of_property_read_u32(dev_node, "base-nr", &base_nr);
++		if (!force_nr && base_nr)
++			force_nr = base_nr + chan_id;
++
+ 		if (muxc->arbitrator)
+ 			mux_node = of_get_child_by_name(dev_node, "i2c-arb");
+ 		else if (muxc->gate)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0424-non-upstream-support-DS1-exit-firmware-re-download.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0424-non-upstream-support-DS1-exit-firmware-re-download.patch
new file mode 100644
index 00000000..43a3dfcd
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0424-non-upstream-support-DS1-exit-firmware-re-download.patch
@@ -0,0 +1,721 @@
+From cd7ab08b664f24768c3530f6f32927251d97cfb9 Mon Sep 17 00:00:00 2001
+From: Praveen Babu C <pucn@cypress.com>
+Date: Tue, 9 Jan 2018 11:33:10 +0530
+Subject: [PATCH 424/697] non-upstream: support DS1 exit firmware re-download
+
+In deep sleep mode (DS1) ARM is off and once exit trigger comes than
+mailbox Interrupt comes to host and whole reinitiation should be done
+in the ARM to start TX/RX.
+
+Also fix below issus for DS1 exit:
+1. Sent Tx Control frame only after firmware redownload complete (check
+F2 Ready before sending Tx Control frame to Firmware)
+2. intermittent High DS1 TX Exit latency time (almost 3sec) ==> This is
+fixed by skipping host Mailbox interrupt Multiple times (ulp state
+mechanism)
+3. RX GlOM save/restore in Firmware
+4. Add ULP event enable & event_msgs_ext iovar configuration in FMAC
+5. Add ULP_EVENT_RECV state machine for sbwad support
+6. Support 2 Byte Shared memory read for DS1 Exit HUDI implementation
+
+Signed-off-by: Praveen Babu C <pucn@cypress.com>
+Signed-off-by: Naveen Gupta <nagu@cypress.com>
+[Merge from 4.14.77 to 5.4.18; set BRCMF_SDIO_MAX_ACCESS_ERRORS to 20]
+Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
+JIRA: SWWLAN-135583
+JIRA: SWWLAN-136577
+---
+ .../broadcom/brcm80211/brcmfmac/bus.h         |   2 +-
+ .../broadcom/brcm80211/brcmfmac/common.c      |  39 +++
+ .../broadcom/brcm80211/brcmfmac/core.c        |  13 +-
+ .../broadcom/brcm80211/brcmfmac/debug.h       |   1 +
+ .../broadcom/brcm80211/brcmfmac/fweh.h        |  31 ++-
+ .../broadcom/brcm80211/brcmfmac/pcie.c        |   2 +-
+ .../broadcom/brcm80211/brcmfmac/sdio.c        | 260 +++++++++++++++++-
+ .../broadcom/brcm80211/brcmfmac/sdio.h        | 110 ++++++++
+ .../broadcom/brcm80211/brcmfmac/usb.c         |   4 +-
+ .../broadcom/brcm80211/include/chipcommon.h   |   2 +
+ 10 files changed, 448 insertions(+), 16 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+@@ -298,7 +298,7 @@ void brcmf_rx_event(struct device *dev,
+ 
+ int brcmf_alloc(struct device *dev, struct brcmf_mp_device *settings);
+ /* Indication from bus module regarding presence/insertion of dongle. */
+-int brcmf_attach(struct device *dev);
++int brcmf_attach(struct device *dev, bool start_bus);
+ /* Indication from bus module regarding removal/absence of dongle */
+ void brcmf_detach(struct device *dev);
+ void brcmf_free(struct device *dev);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -20,6 +20,8 @@
+ #include "of.h"
+ #include "firmware.h"
+ #include "chip.h"
++#include "fweh.h"
++#include <brcm_hw_ids.h>
+ 
+ MODULE_AUTHOR("Broadcom Corporation");
+ MODULE_DESCRIPTION("Broadcom 802.11 wireless LAN fullmac driver.");
+@@ -274,6 +276,8 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 	char *clmver;
+ 	char *ptr;
+ 	s32 err;
++	struct eventmsgs_ext *eventmask_msg = NULL;
++	u8 msglen;
+ 
+ 	if (is_valid_ether_addr(ifp->mac_addr)) {
+ 		/* set mac address */
+@@ -433,6 +437,41 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 		goto done;
+ 	}
+ 
++	/* Enable event_msg_ext specific to 43012 chip */
++	if (bus->chip == CY_CC_43012_CHIP_ID) {
++		/* Program event_msg_ext to support event larger than 128 */
++		msglen = (roundup(BRCMF_E_LAST, NBBY) / NBBY) +
++				  EVENTMSGS_EXT_STRUCT_SIZE;
++		/* Allocate buffer for eventmask_msg */
++		eventmask_msg = kzalloc(msglen, GFP_KERNEL);
++		if (!eventmask_msg) {
++			err = -ENOMEM;
++			goto done;
++		}
++
++		/* Read the current programmed event_msgs_ext */
++		eventmask_msg->ver = EVENTMSGS_VER;
++		eventmask_msg->len = roundup(BRCMF_E_LAST, NBBY) / NBBY;
++		err = brcmf_fil_iovar_data_get(ifp, "event_msgs_ext",
++					       eventmask_msg,
++					       msglen);
++
++		/* Enable ULP event */
++		brcmf_dbg(EVENT, "enable event ULP\n");
++		setbit(eventmask_msg->mask, BRCMF_E_ULP);
++
++		/* Write updated Event mask */
++		eventmask_msg->ver = EVENTMSGS_VER;
++		eventmask_msg->command = EVENTMSGS_SET_MASK;
++		eventmask_msg->len = (roundup(BRCMF_E_LAST, NBBY) / NBBY);
++
++		err = brcmf_fil_iovar_data_set(ifp, "event_msgs_ext",
++					       eventmask_msg, msglen);
++		if (err) {
++			brcmf_err("Set event_msgs_ext error (%d)\n", err);
++			goto done;
++		}
++	}
+ 	/* Setup default scan channel time */
+ 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
+ 				    BRCMF_DEFAULT_SCAN_CHANNEL_TIME);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1317,7 +1317,7 @@ int brcmf_alloc(struct device *dev, stru
+ 	return 0;
+ }
+ 
+-int brcmf_attach(struct device *dev)
++int brcmf_attach(struct device *dev, bool start_bus)
+ {
+ 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+ 	struct brcmf_pub *drvr = bus_if->drvr;
+@@ -1358,10 +1358,13 @@ int brcmf_attach(struct device *dev)
+ 	brcmf_fweh_register(drvr, BRCMF_E_PSM_WATCHDOG,
+ 			    brcmf_psm_watchdog_notify);
+ 
+-	ret = brcmf_bus_started(drvr, drvr->ops);
+-	if (ret != 0) {
+-		bphy_err(drvr, "dongle is not responding: err=%d\n", ret);
+-		goto fail;
++	if (start_bus) {
++		ret = brcmf_bus_started(drvr, drvr->ops);
++		if (ret != 0) {
++			bphy_err(drvr, "dongle is not responding: err=%d\n",
++				 ret);
++			goto fail;
++		}
+ 	}
+ 
+ 	return 0;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
+@@ -29,6 +29,7 @@
+ #define BRCMF_MSGBUF_VAL	0x00040000
+ #define BRCMF_PCIE_VAL		0x00080000
+ #define BRCMF_FWCON_VAL		0x00100000
++#define BRCMF_ULP_VAL		0x00200000
+ 
+ /* set default print format */
+ #undef pr_fmt
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h
+@@ -94,7 +94,8 @@ struct brcmf_cfg80211_info;
+ 	BRCMF_ENUM_DEF(FIFO_CREDIT_MAP, 74) \
+ 	BRCMF_ENUM_DEF(ACTION_FRAME_RX, 75) \
+ 	BRCMF_ENUM_DEF(TDLS_PEER_EVENT, 92) \
+-	BRCMF_ENUM_DEF(BCMC_CREDIT_SUPPORT, 127)
++	BRCMF_ENUM_DEF(BCMC_CREDIT_SUPPORT, 127) \
++	BRCMF_ENUM_DEF(ULP, 146)
+ 
+ #define BRCMF_ENUM_DEF(id, val) \
+ 	BRCMF_E_##id = (val),
+@@ -102,6 +103,12 @@ struct brcmf_cfg80211_info;
+ /* firmware event codes sent by the dongle */
+ enum brcmf_fweh_event_code {
+ 	BRCMF_FWEH_EVENT_ENUM_DEFLIST
++
++	/* this determines event mask length which must match
++	 * minimum length check in device firmware so it is
++	 * hard-coded here.
++	 */
++	BRCMF_E_LAST
+ };
+ #undef BRCMF_ENUM_DEF
+ 
+@@ -280,6 +287,28 @@ struct brcmf_if_event {
+ 	u8 role;
+ };
+ 
++enum event_msgs_ext_command {
++	EVENTMSGS_NONE		=	0,
++	EVENTMSGS_SET_BIT	=	1,
++	EVENTMSGS_RESET_BIT	=	2,
++	EVENTMSGS_SET_MASK	=	3
++};
++
++#define EVENTMSGS_VER 1
++#define EVENTMSGS_EXT_STRUCT_SIZE	offsetof(struct eventmsgs_ext, mask[0])
++
++/* len-	for SET it would be mask size from the application to the firmware */
++/*		for GET it would be actual firmware mask size */
++/* maxgetsize -	is only used for GET. indicate max mask size that the */
++/*				application can read from the firmware */
++struct eventmsgs_ext {
++	u8	ver;
++	u8	command;
++	u8	len;
++	u8	maxgetsize;
++	u8	mask[1];
++};
++
+ typedef int (*brcmf_fweh_handler_t)(struct brcmf_if *ifp,
+ 				    const struct brcmf_event_msg *evtmsg,
+ 				    void *data);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -2207,7 +2207,7 @@ static void brcmf_pcie_setup(struct devi
+ 
+ 	init_waitqueue_head(&devinfo->mbdata_resp_wait);
+ 
+-	ret = brcmf_attach(&devinfo->pdev->dev);
++	ret = brcmf_attach(&devinfo->pdev->dev, true);
+ 	if (ret)
+ 		goto fail;
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -35,9 +35,12 @@
+ #include "core.h"
+ #include "common.h"
+ #include "bcdc.h"
++#include "debug.h"
++#include "fwil.h"
+ 
+ #define DCMD_RESP_TIMEOUT	msecs_to_jiffies(2500)
+ #define CTL_DONE_TIMEOUT	msecs_to_jiffies(2500)
++#define ULP_HUDI_PROC_DONE_TIME	msecs_to_jiffies(2500)
+ 
+ /* watermark expressed in number of words */
+ #define DEFAULT_F2_WATERMARK    0x8
+@@ -325,7 +328,16 @@ struct rte_console {
+ 
+ #define KSO_WAIT_US 50
+ #define MAX_KSO_ATTEMPTS (PMU_MAX_TRANSITION_DLY/KSO_WAIT_US)
+-#define BRCMF_SDIO_MAX_ACCESS_ERRORS	5
++#define BRCMF_SDIO_MAX_ACCESS_ERRORS	20
++
++static void brcmf_sdio_firmware_callback(struct device *dev, int err,
++					 struct brcmf_fw_request *fwreq);
++static struct brcmf_fw_request *
++	brcmf_sdio_prepare_fw_request(struct brcmf_sdio *bus);
++static int brcmf_sdio_f2_ready(struct brcmf_sdio *bus);
++static int brcmf_ulp_event_notify(struct brcmf_if *ifp,
++				  const struct brcmf_event_msg *evtmsg,
++				  void *data);
+ 
+ #ifdef DEBUG
+ /* Device console log buffer state */
+@@ -1105,7 +1117,7 @@ static void brcmf_sdio_get_console_addr(
+ }
+ #endif /* DEBUG */
+ 
+-static u32 brcmf_sdio_hostmail(struct brcmf_sdio *bus)
++static u32 brcmf_sdio_hostmail(struct brcmf_sdio *bus, u32 *hmbd)
+ {
+ 	struct brcmf_sdio_dev *sdiod = bus->sdiodev;
+ 	struct brcmf_core *core = bus->sdio_core;
+@@ -1194,6 +1206,9 @@ static u32 brcmf_sdio_hostmail(struct br
+ 			 HMB_DATA_FCDATA_MASK | HMB_DATA_VERSION_MASK))
+ 		brcmf_err("Unknown mailbox data content: 0x%02x\n",
+ 			  hmb_data);
++	/* Populate hmb_data if argument is passed for DS1 check later */
++	if (hmbd)
++		*hmbd = hmb_data;
+ 
+ 	return intstatus;
+ }
+@@ -2580,6 +2595,182 @@ static int brcmf_sdio_intr_rstatus(struc
+ 	return ret;
+ }
+ 
++/* This Function is used to retrieve important
++ * details from dongle related to ULP mode Mostly
++ * values/SHM details that will be vary depending
++ * on the firmware branches
++ */
++static void
++brcmf_sdio_ulp_preinit(struct device *dev)
++{
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
++	struct brcmf_if *ifp = bus_if->drvr->iflist[0];
++
++	brcmf_dbg(ULP, "Enter\n");
++
++	/* Query ulp_sdioctrl iovar to get the ULP related SHM offsets */
++	brcmf_fil_iovar_data_get(ifp, "ulp_sdioctrl",
++				 &sdiodev->fmac_ulp.ulp_shm_offset,
++				 sizeof(sdiodev->fmac_ulp.ulp_shm_offset));
++
++	sdiodev->ulp = false;
++
++	brcmf_dbg(ULP, "m_ulp_ctrl_sdio[%x] m_ulp_wakeevt_ind [%x]\n",
++		  M_DS1_CTRL_SDIO(sdiodev->fmac_ulp),
++		  M_WAKEEVENT_IND(sdiodev->fmac_ulp));
++	brcmf_dbg(ULP, "m_ulp_wakeind [%x]\n",
++		  M_ULP_WAKE_IND(sdiodev->fmac_ulp));
++}
++
++/* Reinitialize ARM because In DS1 mode ARM got off */
++static int
++brcmf_sdio_ulp_reinit_fw(struct brcmf_sdio *bus)
++{
++	struct brcmf_sdio_dev *sdiodev = bus->sdiodev;
++	struct brcmf_fw_request *fwreq;
++	int err = 0;
++
++	/* After firmware redownload tx/rx seq are reset accordingly
++	 * these values are reset on FMAC side tx_max is initially set to 4,
++	 * which later is updated by FW.
++	 */
++	bus->tx_seq = 0;
++	bus->rx_seq = 0;
++	bus->tx_max = 4;
++
++	fwreq = brcmf_sdio_prepare_fw_request(bus);
++	if (!fwreq)
++		return -ENOMEM;
++
++	err = brcmf_fw_get_firmwares(sdiodev->dev, fwreq,
++				     brcmf_sdio_firmware_callback);
++	if (err != 0) {
++		brcmf_err("async firmware request failed: %d\n", err);
++		kfree(fwreq);
++	}
++
++	return err;
++}
++
++/* Check if device is in DS1 mode and handshake with ULP UCODE */
++static bool
++brcmf_sdio_ulp_pre_redownload_check(struct brcmf_sdio *bus, u32 hmb_data)
++{
++	struct brcmf_sdio_dev *sdiod = bus->sdiodev;
++	int err = 0;
++	u32 value = 0;
++	u32 val32, ulp_wake_ind, wowl_wake_ind;
++	int reg_addr;
++	unsigned long timeout;
++	struct brcmf_ulp *fmac_ulp = &bus->sdiodev->fmac_ulp;
++	int i = 0;
++
++	/* If any host mail box data is present, ignore DS1 exit sequence */
++	if (hmb_data)
++		return false;
++	/* Skip if DS1 Exit is already in progress
++	 * This can happen if firmware download is taking more time
++	 */
++	if (fmac_ulp->ulp_state == FMAC_ULP_TRIGGERED)
++		return false;
++
++	value = brcmf_sdiod_func0_rb(sdiod, SDIO_CCCR_IOEx, &err);
++
++	if (value == SDIO_FUNC_ENABLE_1) {
++		brcmf_dbg(ULP, "GOT THE INTERRUPT FROM UCODE\n");
++		sdiod->ulp = true;
++		fmac_ulp->ulp_state = FMAC_ULP_TRIGGERED;
++		ulp_wake_ind = D11SHM_RDW(sdiod,
++					  M_ULP_WAKE_IND(sdiod->fmac_ulp),
++					  &err);
++		wowl_wake_ind = D11SHM_RDW(sdiod,
++					   M_WAKEEVENT_IND(sdiod->fmac_ulp),
++					   &err);
++
++		brcmf_dbg(ULP, "wowl_wake_ind: 0x%08x, ulp_wake_ind: 0x%08x state %s\n",
++			  wowl_wake_ind, ulp_wake_ind, (fmac_ulp->ulp_state) ?
++			  "DS1 Exit Triggered" : "IDLE State");
++
++		if (wowl_wake_ind || ulp_wake_ind) {
++			/* RX wake Don't do anything.
++			 * Just bail out and re-download firmware.
++			 */
++			 /* Print out PHY TX error block when bit 9 set */
++			if ((ulp_wake_ind & C_DS1_PHY_TXERR) &&
++			    M_DS1_PHYTX_ERR_BLK(sdiod->fmac_ulp)) {
++				brcmf_err("Dump PHY TX Error SHM Locations\n");
++				for (i = 0; i < PHYTX_ERR_BLK_SIZE; i++) {
++					pr_err("0x%x",
++					       D11SHM_RDW(sdiod,
++					       (M_DS1_PHYTX_ERR_BLK(sdiod->fmac_ulp) +
++						(i * 2)), &err));
++				}
++				brcmf_err("\n");
++			}
++		} else {
++			/* TX wake negotiate with MAC */
++			brcmf_dbg(ULP, "M_DS1_CTRL_SDIO: 0x%08x\n",
++				  (u32)D11SHM_RDW(sdiod,
++				  M_DS1_CTRL_SDIO(sdiod->fmac_ulp),
++				  &err));
++			val32 = D11SHM_RD(sdiod,
++					  M_DS1_CTRL_SDIO(sdiod->fmac_ulp),
++					  &err);
++			D11SHM_WR(sdiod, M_DS1_CTRL_SDIO(sdiod->fmac_ulp),
++				  val32, (C_DS1_CTRL_SDIO_DS1_EXIT |
++				  C_DS1_CTRL_REQ_VALID), &err);
++			val32 = D11REG_RD(sdiod, D11_MACCONTROL_REG, &err);
++			val32 = val32 | D11_MACCONTROL_REG_WAKE;
++			D11REG_WR(sdiod, D11_MACCONTROL_REG, val32, &err);
++
++			/* Poll for PROC_DONE to be set by ucode */
++			value = D11SHM_RDW(sdiod,
++					   M_DS1_CTRL_SDIO(sdiod->fmac_ulp),
++					   &err);
++			/* Wait here (polling) for C_DS1_CTRL_PROC_DONE */
++			timeout = jiffies + ULP_HUDI_PROC_DONE_TIME;
++			while (!(value & C_DS1_CTRL_PROC_DONE)) {
++				value = D11SHM_RDW(sdiod,
++						   M_DS1_CTRL_SDIO(sdiod->fmac_ulp),
++						   &err);
++				if (time_after(jiffies, timeout))
++					break;
++				usleep_range(1000, 2000);
++			}
++			brcmf_dbg(ULP, "M_DS1_CTRL_SDIO: 0x%08x\n",
++				  (u32)D11SHM_RDW(sdiod,
++				  M_DS1_CTRL_SDIO(sdiod->fmac_ulp), &err));
++			value = D11SHM_RDW(sdiod,
++					   M_DS1_CTRL_SDIO(sdiod->fmac_ulp),
++					   &err);
++			if (!(value & C_DS1_CTRL_PROC_DONE)) {
++				brcmf_err("Timeout Failed to enter DS1 Exit state!\n");
++				return false;
++			}
++		}
++
++		ulp_wake_ind = D11SHM_RDW(sdiod,
++					  M_ULP_WAKE_IND(sdiod->fmac_ulp),
++					  &err);
++		wowl_wake_ind = D11SHM_RDW(sdiod,
++					   M_WAKEEVENT_IND(sdiod->fmac_ulp),
++					   &err);
++		brcmf_dbg(ULP, "wowl_wake_ind: 0x%08x, ulp_wake_ind: 0x%08x\n",
++			  wowl_wake_ind, ulp_wake_ind);
++		reg_addr = CORE_CC_REG(
++			  brcmf_chip_get_pmu(bus->ci)->base, min_res_mask);
++		brcmf_sdiod_writel(sdiod, reg_addr,
++				   DEFAULT_43012_MIN_RES_MASK, &err);
++		if (err)
++			brcmf_err("min_res_mask failed\n");
++
++		return true;
++	}
++
++	return false;
++}
++
+ static void brcmf_sdio_dpc(struct brcmf_sdio *bus)
+ {
+ 	struct brcmf_sdio_dev *sdiod = bus->sdiodev;
+@@ -2651,8 +2842,11 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 
+ 	/* Handle host mailbox indication */
+ 	if (intstatus & I_HMB_HOST_INT) {
++		u32 hmb_data = 0;
+ 		intstatus &= ~I_HMB_HOST_INT;
+-		intstatus |= brcmf_sdio_hostmail(bus);
++		intstatus |= brcmf_sdio_hostmail(bus, &hmb_data);
++		if (brcmf_sdio_ulp_pre_redownload_check(bus, hmb_data))
++			brcmf_sdio_ulp_reinit_fw(bus);
+ 	}
+ 
+ 	sdio_release_host(bus->sdiodev->func1);
+@@ -2697,7 +2891,7 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 	brcmf_sdio_clrintr(bus);
+ 
+ 	if (bus->ctrl_frame_stat && (bus->clkstate == CLK_AVAIL) &&
+-	    txctl_ok(bus)) {
++	    txctl_ok(bus) && brcmf_sdio_f2_ready(bus)) {
+ 		sdio_claim_host(bus->sdiodev->func1);
+ 		if (bus->ctrl_frame_stat) {
+ 			err = brcmf_sdio_tx_ctrlframe(bus,  bus->ctrl_frame_buf,
+@@ -3567,6 +3761,10 @@ static int brcmf_sdio_bus_preinit(struct
+ 	if (err < 0)
+ 		goto done;
+ 
++	/* initialize SHM address from firmware for DS1 */
++	if (!bus->sdiodev->ulp)
++		brcmf_sdio_ulp_preinit(dev);
++
+ 	bus->tx_hdrlen = SDPCM_HWHDR_LEN + SDPCM_SWHDR_LEN;
+ 	if (sdiodev->sg_support) {
+ 		bus->txglom = false;
+@@ -4215,7 +4413,7 @@ static void brcmf_sdio_firmware_callback
+ 	u8 saveclk, bpreq;
+ 	u8 devctl;
+ 
+-	brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
++	brcmf_dbg(ULP, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
+ 
+ 	if (err)
+ 		goto fail;
+@@ -4392,12 +4590,25 @@ static void brcmf_sdio_firmware_callback
+ 	}
+ 
+ 	/* Attach to the common layer, reserve hdr space */
+-	err = brcmf_attach(sdiod->dev);
++	err = brcmf_attach(sdiod->dev, !bus->sdiodev->ulp);
+ 	if (err != 0) {
+ 		brcmf_err("brcmf_attach failed\n");
+ 		goto free;
+ 	}
+ 
++	/* Register for ULP events */
++	if (sdiod->func1->device == SDIO_DEVICE_ID_BROADCOM_CYPRESS_43012)
++		brcmf_fweh_register(bus_if->drvr, BRCMF_E_ULP,
++				    brcmf_ulp_event_notify);
++
++	if (bus->sdiodev->ulp) {
++		/* For ULP, after firmware redownload complete
++		 * set ULP state to IDLE
++		 */
++		if (bus->sdiodev->fmac_ulp.ulp_state == FMAC_ULP_TRIGGERED)
++			bus->sdiodev->fmac_ulp.ulp_state = FMAC_ULP_IDLE;
++	}
++
+ 	/* ready */
+ 	return;
+ 
+@@ -4640,3 +4851,40 @@ int brcmf_sdio_sleep(struct brcmf_sdio *
+ 
+ 	return ret;
+ }
++
++/* Check F2 Ready bit before sending data to Firmware */
++static int
++brcmf_sdio_f2_ready(struct brcmf_sdio *bus)
++{
++	int ret = -1;
++	int iordy_status = 0;
++
++	sdio_claim_host(bus->sdiodev->func1);
++	/* Read the status of IOR2 */
++	iordy_status = brcmf_sdiod_func0_rb(bus->sdiodev, SDIO_CCCR_IORx, NULL);
++
++	sdio_release_host(bus->sdiodev->func1);
++	ret = iordy_status & SDIO_FUNC_ENABLE_2;
++	return ret;
++}
++
++static int brcmf_ulp_event_notify(struct brcmf_if *ifp,
++				  const struct brcmf_event_msg *evtmsg,
++				  void *data)
++{
++	int err = 0;
++	struct brcmf_bus *bus_if = ifp->drvr->bus_if;
++	struct brcmf_sdio_dev *sdiodev;
++	struct brcmf_sdio *bus;
++	struct brcmf_ulp_event *ulp_event = (struct brcmf_ulp_event *)data;
++
++	sdiodev = bus_if->bus_priv.sdio;
++	bus = sdiodev->bus;
++
++	brcmf_dbg(ULP, "Chip went to DS1 state : action %d\n",
++		  ulp_event->ulp_dongle_action);
++	if (ulp_event->ulp_dongle_action == FMAC_ULP_ENTRY)
++		bus->sdiodev->fmac_ulp.ulp_state = FMAC_ULP_ENTRY_RECV;
++
++	return err;
++}
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -165,6 +165,35 @@ struct brcmf_sdreg {
+ struct brcmf_sdio;
+ struct brcmf_sdiod_freezer;
+ 
++/* ULP SHM Offsets info */
++struct ulp_shm_info {
++	u32 m_ulp_ctrl_sdio;
++	u32 m_ulp_wakeevt_ind;
++	u32 m_ulp_wakeind;
++	u32 m_ulp_phytxblk;
++};
++
++/* FMAC ULP state machine */
++#define FMAC_ULP_IDLE		(0)
++#define FMAC_ULP_ENTRY_RECV		(1)
++#define FMAC_ULP_TRIGGERED		(2)
++
++/* BRCMF_E_ULP event data */
++#define FMAC_ULP_EVENT_VERSION		1
++#define FMAC_ULP_DISABLE_CONSOLE		1 /* Disable console */
++#define FMAC_ULP_UCODE_DOWNLOAD		2 /* Download ULP ucode file */
++#define FMAC_ULP_ENTRY		3 /* Inform ulp entry to Host */
++
++struct brcmf_ulp {
++	uint ulp_state;
++	struct ulp_shm_info ulp_shm_offset;
++};
++
++struct brcmf_ulp_event {
++	u16 version;
++	u16 ulp_dongle_action;
++};
++
+ struct brcmf_sdio_dev {
+ 	struct sdio_func *func1;
+ 	struct sdio_func *func2;
+@@ -193,6 +222,8 @@ struct brcmf_sdio_dev {
+ 	enum brcmf_sdiod_state state;
+ 	struct brcmf_sdiod_freezer *freezer;
+ 	const struct firmware *clm_fw;
++	struct brcmf_ulp fmac_ulp;
++	bool ulp;
+ };
+ 
+ /* sdio core registers */
+@@ -367,4 +398,83 @@ void brcmf_sdio_wowl_config(struct devic
+ int brcmf_sdio_sleep(struct brcmf_sdio *bus, bool sleep);
+ void brcmf_sdio_trigger_dpc(struct brcmf_sdio *bus);
+ 
++/* SHM offsets */
++#define M_DS1_CTRL_SDIO(ptr)	((ptr).ulp_shm_offset.m_ulp_ctrl_sdio)
++#define M_WAKEEVENT_IND(ptr)	((ptr).ulp_shm_offset.m_ulp_wakeevt_ind)
++#define M_ULP_WAKE_IND(ptr)		((ptr).ulp_shm_offset.m_ulp_wakeind)
++#define M_DS1_PHYTX_ERR_BLK(ptr)	((ptr).ulp_shm_offset.m_ulp_phytxblk)
++
++#define D11_BASE_ADDR			0x18001000
++#define D11_AXI_BASE_ADDR		0xE8000000
++#define D11_SHM_BASE_ADDR		(D11_AXI_BASE_ADDR + 0x4000)
++
++#define D11REG_ADDR(offset)	(D11_BASE_ADDR + (offset))
++#define D11IHR_ADDR(offset)	(D11_AXI_BASE_ADDR + 0x400 + (2 * (offset)))
++#define D11SHM_ADDR(offset)	(D11_SHM_BASE_ADDR + (offset))
++
++/* MacControl register */
++#define D11_MACCONTROL_REG			D11REG_ADDR(0x120)
++#define D11_MACCONTROL_REG_WAKE		0x4000000
++
++/* HUDI Sequence SHM bits */
++#define	C_DS1_CTRL_SDIO_DS1_SLEEP		0x1
++#define	C_DS1_CTRL_SDIO_MAC_ON			0x2
++#define	C_DS1_CTRL_SDIO_RADIO_PHY_ON	0x4
++#define	C_DS1_CTRL_SDIO_DS1_EXIT		0x8
++#define	C_DS1_CTRL_PROC_DONE			0x100
++#define	C_DS1_CTRL_REQ_VALID			0x200
++
++/* M_ULP_WAKEIND bits */
++#define	C_WATCHDOG_EXPIRY	BIT(0)
++#define	C_FCBS_ERROR		BIT(1)
++#define	C_RETX_FAILURE		BIT(2)
++#define	C_HOST_WAKEUP		BIT(3)
++#define	C_INVALID_FCBS_BLOCK	BIT(4)
++#define	C_HUDI_DS1_EXIT		BIT(5)
++#define	C_LOB_SLEEP		BIT(6)
++#define	C_DS1_PHY_TXERR		BIT(9)
++#define	C_DS1_WAKE_TIMER	BIT(10)
++
++#define PHYTX_ERR_BLK_SIZE		18
++#define D11SHM_FIRST2BYTE_MASK		0xFFFF0000
++#define D11SHM_SECOND2BYTE_MASK		0x0000FFFF
++#define D11SHM_2BYTE_SHIFT		16
++
++#define D11SHM_RD(sdh, offset, ret) \
++	brcmf_sdiod_readl(sdh, D11SHM_ADDR(offset), ret)
++
++/* SHM Read is motified based on SHM 4 byte alignment as SHM size is 2 bytes and
++ * 2 byte is currently not working on FMAC
++ * If SHM address is not 4 byte aligned, then right shift by 16
++ * otherwise, mask the first two MSB bytes
++ * Suppose data in address 7260 is 0x440002 and it is 4 byte aligned
++ * Correct SHM value is 0x2 for this SHM offset and next SHM value is 0x44
++ */
++#define D11SHM_RDW(sdh, offset, ret) \
++	((offset % 4) ? \
++		(brcmf_sdiod_readl(sdh, D11SHM_ADDR(offset), ret) \
++		>> D11SHM_2BYTE_SHIFT) : \
++		(brcmf_sdiod_readl(sdh, D11SHM_ADDR(offset), ret) \
++		& D11SHM_SECOND2BYTE_MASK))
++
++/* SHM is of size 2 bytes, 4 bytes write will overwrite other SHM's
++ * First read 4 bytes and then clear the required two bytes based on
++ * 4 byte alignment, then update the required value and write the
++ * 4 byte value now
++ */
++#define D11SHM_WR(sdh, offset, val, mask, ret) \
++	do { \
++		if ((offset) % 4) \
++			val = (val & D11SHM_SECOND2BYTE_MASK) | \
++				((mask) << D11SHM_2BYTE_SHIFT); \
++		else \
++			val = (mask) | (val & D11SHM_FIRST2BYTE_MASK); \
++		brcmf_sdiod_writel(sdh, D11SHM_ADDR(offset), val, ret); \
++	} while (0)
++#define D11REG_WR(sdh, addr, val, ret) \
++	brcmf_sdiod_writel(sdh, addr, val, ret)
++
++#define D11REG_RD(sdh, addr, ret) \
++	brcmf_sdiod_readl(sdh, addr, ret)
++
+ #endif /* BRCMFMAC_SDIO_H */
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -1200,7 +1200,7 @@ static void brcmf_usb_probe_phase2(struc
+ 		goto error;
+ 
+ 	/* Attach to the common driver interface */
+-	ret = brcmf_attach(devinfo->dev);
++	ret = brcmf_attach(devinfo->dev, true);
+ 	if (ret)
+ 		goto error;
+ 
+@@ -1277,7 +1277,7 @@ static int brcmf_usb_probe_cb(struct brc
+ 		ret = brcmf_alloc(devinfo->dev, devinfo->settings);
+ 		if (ret)
+ 			goto fail;
+-		ret = brcmf_attach(devinfo->dev);
++		ret = brcmf_attach(devinfo->dev, true);
+ 		if (ret)
+ 			goto fail;
+ 		/* we are done */
+--- a/drivers/net/wireless/broadcom/brcm80211/include/chipcommon.h
++++ b/drivers/net/wireless/broadcom/brcm80211/include/chipcommon.h
+@@ -308,4 +308,6 @@ struct chipcregs {
+ */
+ #define PMU_MAX_TRANSITION_DLY	15000
+ 
++#define DEFAULT_43012_MIN_RES_MASK 0x0f8bfe77
++
+ #endif				/* _SBCHIPC_H */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0425-brcmfmac-Fix-interoperating-DPP-and-other-encryption.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0425-brcmfmac-Fix-interoperating-DPP-and-other-encryption.patch
new file mode 100644
index 00000000..151882e3
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0425-brcmfmac-Fix-interoperating-DPP-and-other-encryption.patch
@@ -0,0 +1,129 @@
+From 593fd227e20b5b223fdf968a16122602bf2b8cdf Mon Sep 17 00:00:00 2001
+From: Kurt Lee <kurt.lee@cypress.com>
+Date: Thu, 20 Aug 2020 03:07:02 -0500
+Subject: [PATCH 425/697] brcmfmac: Fix interoperating DPP and other encryption
+ network access
+
+1. If firmware supports 4-way handshake offload but not supports DPP
+4-way offload, when user first connects encryption network, driver will
+set "sup_wpa 1" to firmware, but it will further result in DPP
+connection failure since firmware won't send EAPOL frame to host.
+
+2. Fix DPP AP mode handling action frames.
+
+3. For some firmware without fwsup support, the join procedure will be
+skipped due to "sup_wpa" iovar returning not-support. Check the fwsup
+feature before do such iovar.
+
+Signed-off-by: Kurt Lee <kurt.lee@cypress.com>
+Signed-off-by: Double Lo <double.lo@cypress.com>
+Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
+---
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c    | 67 ++++++++++---------
+ .../broadcom/brcm80211/brcmfmac/p2p.c         |  5 ++
+ 2 files changed, 42 insertions(+), 30 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -2463,43 +2463,50 @@ brcmf_cfg80211_connect(struct wiphy *wip
+ 		goto done;
+ 	}
+ 
+-	if (sme->crypto.psk &&
+-	    profile->use_fwsup != BRCMF_PROFILE_FWSUP_SAE) {
+-		if (WARN_ON(profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE)) {
+-			err = -EINVAL;
+-			goto done;
++	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWSUP)) {
++		if (sme->crypto.psk) {
++			if (profile->use_fwsup != BRCMF_PROFILE_FWSUP_SAE) {
++				if (WARN_ON(profile->use_fwsup !=
++					BRCMF_PROFILE_FWSUP_NONE)) {
++					err = -EINVAL;
++					goto done;
++				}
++				brcmf_dbg(INFO, "using PSK offload\n");
++				profile->use_fwsup = BRCMF_PROFILE_FWSUP_PSK;
++			}
++		} else {
++			profile->use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
+ 		}
+-		brcmf_dbg(INFO, "using PSK offload\n");
+-		profile->use_fwsup = BRCMF_PROFILE_FWSUP_PSK;
+-	}
+ 
+-	if (profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
+-		/* enable firmware supplicant for this interface */
+-		err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 1);
+-		if (err < 0) {
+-			bphy_err(drvr, "failed to enable fw supplicant\n");
+-			goto done;
++		if (profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
++			/* enable firmware supplicant for this interface */
++			err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 1);
++			if (err < 0) {
++				bphy_err(drvr, "failed to enable fw supplicant\n");
++				goto done;
++			}
++		} else {
++			err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 0);
+ 		}
+-	}
+ 
+-	if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_PSK)
+-		err = brcmf_set_pmk(ifp, sme->crypto.psk,
+-				    BRCMF_WSEC_MAX_PSK_LEN);
+-	else if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_SAE) {
+-		/* clean up user-space RSNE */
+-		err = brcmf_fil_iovar_data_set(ifp, "wpaie", NULL, 0);
+-		if (err) {
+-			bphy_err(drvr, "failed to clean up user-space RSNE\n");
+-			goto done;
+-		}
+-		err = brcmf_fwvid_set_sae_password(ifp, &sme->crypto);
+-		if (!err && sme->crypto.psk)
++		if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_PSK) {
+ 			err = brcmf_set_pmk(ifp, sme->crypto.psk,
+ 					    BRCMF_WSEC_MAX_PSK_LEN);
++		} else if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_SAE) {
++			/* clean up user-space RSNE */
++			err = brcmf_fil_iovar_data_set(ifp, "wpaie", NULL, 0);
++			if (err) {
++				bphy_err(drvr, "failed to clean up user-space RSNE\n");
++				goto done;
++			}
++			err = brcmf_fwvid_set_sae_password(ifp, &sme->crypto);
++			if (!err && sme->crypto.psk)
++				err = brcmf_set_pmk(ifp, sme->crypto.psk,
++						    BRCMF_WSEC_MAX_PSK_LEN);
++		}
++		if (err)
++			goto done;
+ 	}
+-	if (err)
+-		goto done;
+-
+ 	/* Join with specific BSSID and cached SSID
+ 	 * If SSID is zero join based on BSSID only
+ 	 */
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+@@ -1281,6 +1281,10 @@ static s32 brcmf_p2p_abort_action_frame(
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+ 	vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
++
++	if (!vif)
++		vif = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
++
+ 	err = brcmf_fil_bsscfg_data_set(vif->ifp, "actframe_abort", &int_val,
+ 					sizeof(s32));
+ 	if (err)
+@@ -1826,6 +1830,7 @@ bool brcmf_p2p_send_action_frame(struct
+ 	/* validate channel and p2p ies */
+ 	if (config_af_params.search_channel &&
+ 	    IS_P2P_SOCIAL_CHANNEL(le32_to_cpu(af_params->channel)) &&
++	    p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif &&
+ 	    p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif->saved_ie.probe_req_ie_len) {
+ 		afx_hdl = &p2p->afx_hdl;
+ 		afx_hdl->peer_listen_chan = le32_to_cpu(af_params->channel);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0426-brcmfmac-support-external-SAE-authentication-in-stat.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0426-brcmfmac-support-external-SAE-authentication-in-stat.patch
new file mode 100644
index 00000000..2965f182
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0426-brcmfmac-support-external-SAE-authentication-in-stat.patch
@@ -0,0 +1,593 @@
+From 22c96e5777bfb350c25f6a98b1b8fdca91e1fb86 Mon Sep 17 00:00:00 2001
+From: Chung-Hsien Hsu <stanley.hsu@cypress.com>
+Date: Fri, 9 Apr 2021 02:48:51 -0500
+Subject: [PATCH 426/697] brcmfmac: support external SAE authentication in
+ station mode
+
+Firmware has SME functionality but would like the userspace to handle
+SAE authentication. This patch adds support for such an external SAE
+authentication mechanism in station mode.
+
+Signed-off-by: Chung-Hsien Hsu <chung-hsien.hsu@infineon.com>
+Signed-off-by: Chi-hsien Lin <chi-hsien.lin@infineon.com>
+---
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c    | 255 +++++++++++++++++-
+ .../broadcom/brcm80211/brcmfmac/cfg80211.h    |  18 ++
+ .../broadcom/brcm80211/brcmfmac/common.c      |   6 +-
+ .../broadcom/brcm80211/brcmfmac/feature.c     |   1 +
+ .../broadcom/brcm80211/brcmfmac/feature.h     |   2 +
+ .../broadcom/brcm80211/brcmfmac/fweh.c        |  19 ++
+ .../broadcom/brcm80211/brcmfmac/fweh.h        |  12 +-
+ .../broadcom/brcm80211/brcmfmac/fwil_types.h  |  45 ++++
+ 8 files changed, 340 insertions(+), 18 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -90,6 +90,9 @@
+ 
+ #define BRCMF_PS_MAX_TIMEOUT_MS		2000
+ 
++#define MGMT_AUTH_FRAME_DWELL_TIME	4000
++#define MGMT_AUTH_FRAME_WAIT_TIME	(MGMT_AUTH_FRAME_DWELL_TIME + 100)
++
+ /* Dump obss definitions */
+ #define ACS_MSRMNT_DELAY		80
+ #define CHAN_NOISE_DUMMY		(-80)
+@@ -1945,14 +1948,18 @@ static s32 brcmf_set_wpa_version(struct
+ 	s32 val = 0;
+ 	s32 err = 0;
+ 
+-	if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1)
++	if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1) {
+ 		val = WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED;
+-	else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)
+-		val = WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED;
+-	else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_3)
++	} else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2) {
++		if (sme->crypto.akm_suites[0] == WLAN_AKM_SUITE_SAE)
++			val = WPA3_AUTH_SAE_PSK;
++		else
++			val = WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED;
++	} else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_3) {
+ 		val = WPA3_AUTH_SAE_PSK;
+-	else
++	} else {
+ 		val = WPA_AUTH_DISABLED;
++	}
+ 	brcmf_dbg(CONN, "setting wpa_auth to 0x%0x\n", val);
+ 	err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", val);
+ 	if (err) {
+@@ -2218,7 +2225,7 @@ brcmf_set_key_mgmt(struct net_device *nd
+ 	brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "mfp", mfp);
+ 
+ skip_mfp_config:
+-	brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
++	brcmf_dbg(CONN, "setting wpa_auth to 0x%0x\n", val);
+ 	err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
+ 	if (err) {
+ 		bphy_err(drvr, "could not set wpa_auth (%d)\n", err);
+@@ -5526,9 +5533,12 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wip
+ 	s32 ie_len;
+ 	struct brcmf_fil_action_frame_le *action_frame;
+ 	struct brcmf_fil_af_params_le *af_params;
+-	bool ack;
++	bool ack = false;
+ 	s32 chan_nr;
+ 	u32 freq;
++	struct brcmf_mf_params_le *mf_params;
++	u32 mf_params_len;
++	s32 timeout;
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+@@ -5609,6 +5619,71 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wip
+ 		cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
+ 					GFP_KERNEL);
+ 		kfree(af_params);
++	} else if (ieee80211_is_auth(mgmt->frame_control)) {
++		reinit_completion(&vif->mgmt_tx);
++		clear_bit(BRCMF_MGMT_TX_ACK, &vif->mgmt_tx_status);
++		clear_bit(BRCMF_MGMT_TX_NOACK, &vif->mgmt_tx_status);
++		clear_bit(BRCMF_MGMT_TX_OFF_CHAN_COMPLETED,
++			  &vif->mgmt_tx_status);
++
++		mf_params_len = offsetof(struct brcmf_mf_params_le, data) +
++				(len - DOT11_MGMT_HDR_LEN);
++		mf_params = kzalloc(mf_params_len, GFP_KERNEL);
++		if (!mf_params) {
++			err = -ENOMEM;
++			goto exit;
++		}
++
++		mf_params->dwell_time = cpu_to_le32(MGMT_AUTH_FRAME_DWELL_TIME);
++		mf_params->len = cpu_to_le16(len - DOT11_MGMT_HDR_LEN);
++		mf_params->frame_control = mgmt->frame_control;
++
++		if (chan)
++			freq = chan->center_freq;
++		else
++			brcmf_fil_cmd_int_get(vif->ifp, BRCMF_C_GET_CHANNEL,
++					      &freq);
++		chan_nr = ieee80211_frequency_to_channel(freq);
++		mf_params->channel = cpu_to_le32(chan_nr);
++		memcpy(&mf_params->da[0], &mgmt->da[0], ETH_ALEN);
++		memcpy(&mf_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
++		mf_params->packet_id = cpu_to_le32(*cookie);
++		memcpy(mf_params->data, &buf[DOT11_MGMT_HDR_LEN],
++		       le16_to_cpu(mf_params->len));
++
++		brcmf_dbg(TRACE, "Auth frame, cookie=%d, fc=%04x, len=%d, channel=%d\n",
++			  le32_to_cpu(mf_params->packet_id),
++			  le16_to_cpu(mf_params->frame_control),
++			  le16_to_cpu(mf_params->len),
++			  le32_to_cpu(mf_params->channel));
++
++		vif->mgmt_tx_id = le32_to_cpu(mf_params->packet_id);
++		set_bit(BRCMF_MGMT_TX_SEND_FRAME, &vif->mgmt_tx_status);
++
++		err = brcmf_fil_bsscfg_data_set(vif->ifp, "mgmt_frame",
++						mf_params, mf_params_len);
++		if (err) {
++			bphy_err(drvr, "Failed to send Auth frame: err=%d\n",
++				 err);
++			goto tx_status;
++		}
++
++		timeout =
++			wait_for_completion_timeout(&vif->mgmt_tx,
++						    MGMT_AUTH_FRAME_WAIT_TIME);
++		if (test_bit(BRCMF_MGMT_TX_ACK, &vif->mgmt_tx_status)) {
++			brcmf_dbg(TRACE, "TX Auth frame operation is success\n");
++			ack = true;
++		} else {
++			bphy_err(drvr, "TX Auth frame operation is failed: status=%ld)\n",
++				 vif->mgmt_tx_status);
++		}
++
++tx_status:
++		cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
++					GFP_KERNEL);
++		kfree(mf_params);
++
+ 	} else {
+ 		brcmf_dbg(TRACE, "Unhandled, fc=%04x!!\n", mgmt->frame_control);
+ 		brcmf_dbg_hex_dump(true, buf, len, "payload, len=%zu\n", len);
+@@ -5932,6 +6007,40 @@ static int brcmf_cfg80211_del_pmk(struct
+ 	return brcmf_set_pmk(ifp, NULL, 0);
+ }
+ 
++static int
++brcmf_cfg80211_external_auth(struct wiphy *wiphy, struct net_device *dev,
++			     struct cfg80211_external_auth_params *params)
++{
++	struct brcmf_if *ifp;
++	struct brcmf_pub *drvr;
++	struct brcmf_auth_req_status_le auth_status;
++	int ret = 0;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	ifp = netdev_priv(dev);
++	drvr = ifp->drvr;
++	if (params->status == WLAN_STATUS_SUCCESS) {
++		auth_status.flags = cpu_to_le16(BRCMF_EXTAUTH_SUCCESS);
++	} else {
++		bphy_err(drvr, "External authentication failed: status=%d\n",
++			 params->status);
++		auth_status.flags = cpu_to_le16(BRCMF_EXTAUTH_FAIL);
++	}
++
++	memcpy(auth_status.peer_mac, params->bssid, ETH_ALEN);
++	auth_status.ssid_len = cpu_to_le32(min_t(u8, params->ssid.ssid_len,
++						 IEEE80211_MAX_SSID_LEN));
++	memcpy(auth_status.ssid, params->ssid.ssid, auth_status.ssid_len);
++
++	ret = brcmf_fil_iovar_data_set(ifp, "auth_status", &auth_status,
++				       sizeof(auth_status));
++	if (ret < 0)
++		bphy_err(drvr, "auth_status iovar failed: ret=%d\n", ret);
++
++	return ret;
++}
++
+ static struct cfg80211_ops brcmf_cfg80211_ops = {
+ 	.add_virtual_intf = brcmf_cfg80211_add_iface,
+ 	.del_virtual_intf = brcmf_cfg80211_del_iface,
+@@ -5979,6 +6088,7 @@ static struct cfg80211_ops brcmf_cfg8021
+ 	.update_connect_params = brcmf_cfg80211_update_conn_params,
+ 	.set_pmk = brcmf_cfg80211_set_pmk,
+ 	.del_pmk = brcmf_cfg80211_del_pmk,
++	.external_auth = brcmf_cfg80211_external_auth,
+ };
+ 
+ struct cfg80211_ops *brcmf_cfg80211_get_ops(struct brcmf_mp_device *settings)
+@@ -6025,6 +6135,7 @@ struct brcmf_cfg80211_vif *brcmf_alloc_v
+ 		vif->mbss = mbss;
+ 	}
+ 
++	init_completion(&vif->mgmt_tx);
+ 	list_add_tail(&vif->list, &cfg->vif_list);
+ 	return vif;
+ }
+@@ -6716,6 +6827,122 @@ static s32 brcmf_notify_vif_event(struct
+ 	return -EINVAL;
+ }
+ 
++static s32
++brcmf_notify_ext_auth_request(struct brcmf_if *ifp,
++			      const struct brcmf_event_msg *e, void *data)
++{
++	struct brcmf_pub *drvr = ifp->drvr;
++	struct cfg80211_external_auth_params params;
++	struct brcmf_auth_req_status_le *auth_req =
++		(struct brcmf_auth_req_status_le *)data;
++	s32 err = 0;
++
++	brcmf_dbg(INFO, "Enter: event %s (%d) received\n",
++		  brcmf_fweh_event_name(e->event_code), e->event_code);
++
++	if (e->datalen < sizeof(*auth_req)) {
++		bphy_err(drvr, "Event %s (%d) data too small. Ignore\n",
++			 brcmf_fweh_event_name(e->event_code), e->event_code);
++		return -EINVAL;
++	}
++
++	memset(&params, 0, sizeof(params));
++	params.action = NL80211_EXTERNAL_AUTH_START;
++	params.key_mgmt_suite = ntohl(WLAN_AKM_SUITE_SAE);
++	params.status = WLAN_STATUS_SUCCESS;
++	params.ssid.ssid_len = min_t(u32, 32, le32_to_cpu(auth_req->ssid_len));
++	memcpy(params.ssid.ssid, auth_req->ssid, params.ssid.ssid_len);
++	memcpy(params.bssid, auth_req->peer_mac, ETH_ALEN);
++
++	err = cfg80211_external_auth_request(ifp->ndev, &params, GFP_ATOMIC);
++	if (err)
++		bphy_err(drvr, "Ext Auth request to supplicant failed (%d)\n",
++			 err);
++
++	return err;
++}
++
++static s32
++brcmf_notify_auth_frame_rx(struct brcmf_if *ifp,
++			   const struct brcmf_event_msg *e, void *data)
++{
++	struct brcmf_pub *drvr = ifp->drvr;
++	struct brcmf_cfg80211_info *cfg = drvr->config;
++	struct wireless_dev *wdev;
++	u32 mgmt_frame_len = e->datalen - sizeof(struct brcmf_rx_mgmt_data);
++	struct brcmf_rx_mgmt_data *rxframe = (struct brcmf_rx_mgmt_data *)data;
++	u8 *frame = (u8 *)(rxframe + 1);
++	struct brcmu_chan ch;
++	struct ieee80211_mgmt *mgmt_frame;
++	s32 freq;
++
++	brcmf_dbg(INFO, "Enter: event %s (%d) received\n",
++		  brcmf_fweh_event_name(e->event_code), e->event_code);
++
++	if (e->datalen < sizeof(*rxframe)) {
++		bphy_err(drvr, "Event %s (%d) data too small. Ignore\n",
++			 brcmf_fweh_event_name(e->event_code), e->event_code);
++		return -EINVAL;
++	}
++
++	wdev = &ifp->vif->wdev;
++	WARN_ON(!wdev);
++
++	ch.chspec = be16_to_cpu(rxframe->chanspec);
++	cfg->d11inf.decchspec(&ch);
++
++	mgmt_frame = kzalloc(mgmt_frame_len, GFP_KERNEL);
++	if (!mgmt_frame)
++		return -ENOMEM;
++
++	mgmt_frame->frame_control = cpu_to_le16(IEEE80211_STYPE_AUTH);
++	memcpy(mgmt_frame->da, ifp->mac_addr, ETH_ALEN);
++	memcpy(mgmt_frame->sa, e->addr, ETH_ALEN);
++	brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSSID, mgmt_frame->bssid,
++			       ETH_ALEN);
++	frame += offsetof(struct ieee80211_mgmt, u);
++	memcpy(&mgmt_frame->u, frame,
++	       mgmt_frame_len - offsetof(struct ieee80211_mgmt, u));
++
++	freq = ieee80211_channel_to_frequency(ch.control_ch_num,
++					      ch.band == BRCMU_CHAN_BAND_2G ?
++					      NL80211_BAND_2GHZ :
++					      NL80211_BAND_5GHZ);
++
++	cfg80211_rx_mgmt(wdev, freq, 0, (u8 *)mgmt_frame, mgmt_frame_len,
++			 NL80211_RXMGMT_FLAG_EXTERNAL_AUTH);
++	kfree(mgmt_frame);
++	return 0;
++}
++
++static s32
++brcmf_notify_mgmt_tx_status(struct brcmf_if *ifp,
++			    const struct brcmf_event_msg *e, void *data)
++{
++	struct brcmf_cfg80211_vif *vif = ifp->vif;
++	u32 *packet_id = (u32 *)data;
++
++	brcmf_dbg(INFO, "Enter: event %s (%d), status=%d\n",
++		  brcmf_fweh_event_name(e->event_code), e->event_code,
++		  e->status);
++
++	if (!test_bit(BRCMF_MGMT_TX_SEND_FRAME, &vif->mgmt_tx_status) ||
++	    (*packet_id != vif->mgmt_tx_id))
++		return 0;
++
++	if (e->event_code == BRCMF_E_MGMT_FRAME_TXSTATUS) {
++		if (e->status == BRCMF_E_STATUS_SUCCESS)
++			set_bit(BRCMF_MGMT_TX_ACK, &vif->mgmt_tx_status);
++		else
++			set_bit(BRCMF_MGMT_TX_NOACK, &vif->mgmt_tx_status);
++	} else {
++		set_bit(BRCMF_MGMT_TX_OFF_CHAN_COMPLETED, &vif->mgmt_tx_status);
++	}
++
++	complete(&vif->mgmt_tx);
++	return 0;
++}
++
+ static void brcmf_init_conf(struct brcmf_cfg80211_conf *conf)
+ {
+ 	conf->frag_threshold = (u32)-1;
+@@ -6760,7 +6987,16 @@ static void brcmf_register_event_handler
+ 			    brcmf_p2p_notify_action_tx_complete);
+ 	brcmf_fweh_register(cfg->pub, BRCMF_E_PSK_SUP,
+ 			    brcmf_notify_connect_status);
+-	brcmf_fweh_register(cfg->pub, BRCMF_E_RSSI, brcmf_notify_rssi);
++	brcmf_fweh_register(cfg->pub, BRCMF_E_RSSI,
++				brcmf_notify_rssi);
++	brcmf_fweh_register(cfg->pub, BRCMF_E_EXT_AUTH_REQ,
++			    brcmf_notify_ext_auth_request);
++	brcmf_fweh_register(cfg->pub, BRCMF_E_EXT_AUTH_FRAME_RX,
++			    brcmf_notify_auth_frame_rx);
++	brcmf_fweh_register(cfg->pub, BRCMF_E_MGMT_FRAME_TXSTATUS,
++			    brcmf_notify_mgmt_tx_status);
++	brcmf_fweh_register(cfg->pub, BRCMF_E_MGMT_FRAME_OFF_CHAN_COMPLETE,
++			    brcmf_notify_mgmt_tx_status);
+ }
+ 
+ static void brcmf_deinit_priv_mem(struct brcmf_cfg80211_info *cfg)
+@@ -7347,6 +7583,7 @@ brcmf_txrx_stypes[NUM_NL80211_IFTYPES] =
+ 	[NL80211_IFTYPE_STATION] = {
+ 		.tx = 0xffff,
+ 		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
++		      BIT(IEEE80211_STYPE_AUTH >> 4) |
+ 		      BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+ 	},
+ 	[NL80211_IFTYPE_P2P_CLIENT] = {
+@@ -7652,6 +7889,8 @@ static int brcmf_setup_wiphy(struct wiph
+ 			wiphy_ext_feature_set(wiphy,
+ 					      NL80211_EXT_FEATURE_SAE_OFFLOAD_AP);
+ 	}
++	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SAE_EXT))
++		wiphy->features |= NL80211_FEATURE_SAE;
+ 	wiphy->mgmt_stypes = brcmf_txrx_stypes;
+ 	wiphy->max_remain_on_channel_duration = 5000;
+ 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
+@@ -179,6 +179,21 @@ enum brcmf_vif_status {
+ };
+ 
+ /**
++ * enum brcmf_mgmt_tx_status - mgmt frame tx status
++ *
++ * @BRCMF_MGMT_TX_ACK: mgmt frame acked
++ * @BRCMF_MGMT_TX_NOACK: mgmt frame not acked
++ * @BRCMF_MGMT_TX_OFF_CHAN_COMPLETED: off-channel complete
++ * @BRCMF_MGMT_TX_SEND_FRAME: mgmt frame tx is in progres
++ */
++enum brcmf_mgmt_tx_status {
++	BRCMF_MGMT_TX_ACK,
++	BRCMF_MGMT_TX_NOACK,
++	BRCMF_MGMT_TX_OFF_CHAN_COMPLETED,
++	BRCMF_MGMT_TX_SEND_FRAME
++};
++
++/**
+  * struct vif_saved_ie - holds saved IEs for a virtual interface.
+  *
+  * @probe_req_ie: IE info for probe request.
+@@ -224,6 +239,9 @@ struct brcmf_cfg80211_vif {
+ 	unsigned long sme_state;
+ 	struct vif_saved_ie saved_ie;
+ 	struct list_head list;
++	struct completion mgmt_tx;
++	unsigned long mgmt_tx_status;
++	u32 mgmt_tx_id;
+ 	u16 mgmt_rx_reg;
+ 	bool mbss;
+ 	int is_11d;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -440,7 +440,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 	/* Enable event_msg_ext specific to 43012 chip */
+ 	if (bus->chip == CY_CC_43012_CHIP_ID) {
+ 		/* Program event_msg_ext to support event larger than 128 */
+-		msglen = (roundup(BRCMF_E_LAST, NBBY) / NBBY) +
++		msglen = (roundup(fweh->num_event_codes, NBBY) / NBBY) +
+ 				  EVENTMSGS_EXT_STRUCT_SIZE;
+ 		/* Allocate buffer for eventmask_msg */
+ 		eventmask_msg = kzalloc(msglen, GFP_KERNEL);
+@@ -451,7 +451,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 
+ 		/* Read the current programmed event_msgs_ext */
+ 		eventmask_msg->ver = EVENTMSGS_VER;
+-		eventmask_msg->len = roundup(BRCMF_E_LAST, NBBY) / NBBY;
++		eventmask_msg->len = roundup(fweh->num_event_codes, NBBY) / NBBY;
+ 		err = brcmf_fil_iovar_data_get(ifp, "event_msgs_ext",
+ 					       eventmask_msg,
+ 					       msglen);
+@@ -463,7 +463,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 		/* Write updated Event mask */
+ 		eventmask_msg->ver = EVENTMSGS_VER;
+ 		eventmask_msg->command = EVENTMSGS_SET_MASK;
+-		eventmask_msg->len = (roundup(BRCMF_E_LAST, NBBY) / NBBY);
++		eventmask_msg->len = (roundup(fweh->num_event_codes, NBBY) / NBBY);
+ 
+ 		err = brcmf_fil_iovar_data_set(ifp, "event_msgs_ext",
+ 					       eventmask_msg, msglen);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+@@ -44,6 +44,7 @@ static const struct brcmf_feat_fwcap brc
+ 	{ BRCMF_FEAT_DOT11H, "802.11h" },
+ 	{ BRCMF_FEAT_SAE, "sae" },
+ 	{ BRCMF_FEAT_FWAUTH, "idauth" },
++	{ BRCMF_FEAT_SAE_EXT, "sae_ext " },
+ };
+ 
+ #ifdef DEBUG
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
+@@ -30,6 +30,7 @@
+  * SAE: simultaneous authentication of equals
+  * FWAUTH: Firmware authenticator
+  * DUMP_OBSS: Firmware has capable to dump obss info to support ACS
++ * SAE_EXT: SAE be handled by userspace supplicant
+  * SCAN_V2: Version 2 scan params
+  */
+ #define BRCMF_FEAT_LIST \
+@@ -55,6 +56,7 @@
+ 	BRCMF_FEAT_DEF(SAE) \
+ 	BRCMF_FEAT_DEF(FWAUTH) \
+ 	BRCMF_FEAT_DEF(DUMP_OBSS) \
++	BRCMF_FEAT_DEF(SAE_EXT) \
+ 	BRCMF_FEAT_DEF(SCAN_V2) \
+ 	BRCMF_FEAT_DEF(PMKID_V2) \
+ 	BRCMF_FEAT_DEF(PMKID_V3)
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
+@@ -432,6 +432,8 @@ int brcmf_fweh_activate_events(struct br
+ {
+ 	struct brcmf_fweh_info *fweh = ifp->drvr->fweh;
+ 	enum brcmf_fweh_event_code code;
++	struct eventmsgs_ext *eventmask_msg;
++	u32 msglen;
+ 	int i, err;
+ 
+ 	memset(fweh->event_mask, 0, fweh->event_mask_len);
+@@ -444,15 +446,32 @@ int brcmf_fweh_activate_events(struct br
+ 		}
+ 	}
+ 
++	msglen = EVENTMSGS_EXT_STRUCT_SIZE + fweh->event_mask_len;
++	eventmask_msg = kzalloc(msglen, GFP_KERNEL);
++	if (!eventmask_msg)
++		return -ENOMEM;
++
+ 	/* want to handle IF event as well */
+ 	brcmf_dbg(EVENT, "enable event IF\n");
+ 	setbit(fweh->event_mask, BRCMF_E_IF);
+ 
++	eventmask_msg->ver = EVENTMSGS_VER;
++	eventmask_msg->command = EVENTMSGS_SET_MASK;
++	eventmask_msg->len = fweh->event_mask_len;
++	memcpy(eventmask_msg->mask, fweh->event_mask, fweh->event_mask_len);
++
++	err = brcmf_fil_iovar_data_set(ifp, "event_msgs_ext", eventmask_msg,
++				       msglen);
++	if (!err)
++		goto end;
++
+ 	err = brcmf_fil_iovar_data_set(ifp, "event_msgs", fweh->event_mask,
+ 				       fweh->event_mask_len);
+ 	if (err)
+ 		bphy_err(fweh->drvr, "Set event_msgs error (%d)\n", err);
+ 
++end:
++	kfree(eventmask_msg);
+ 	return err;
+ }
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h
+@@ -95,7 +95,11 @@ struct brcmf_cfg80211_info;
+ 	BRCMF_ENUM_DEF(ACTION_FRAME_RX, 75) \
+ 	BRCMF_ENUM_DEF(TDLS_PEER_EVENT, 92) \
+ 	BRCMF_ENUM_DEF(BCMC_CREDIT_SUPPORT, 127) \
+-	BRCMF_ENUM_DEF(ULP, 146)
++	BRCMF_ENUM_DEF(ULP, 146) \
++	BRCMF_ENUM_DEF(EXT_AUTH_REQ, 187) \
++	BRCMF_ENUM_DEF(EXT_AUTH_FRAME_RX, 188) \
++	BRCMF_ENUM_DEF(MGMT_FRAME_TXSTATUS, 189) \
++	BRCMF_ENUM_DEF(MGMT_FRAME_OFF_CHAN_COMPLETE, 190)
+ 
+ #define BRCMF_ENUM_DEF(id, val) \
+ 	BRCMF_E_##id = (val),
+@@ -103,12 +107,6 @@ struct brcmf_cfg80211_info;
+ /* firmware event codes sent by the dongle */
+ enum brcmf_fweh_event_code {
+ 	BRCMF_FWEH_EVENT_ENUM_DEFLIST
+-
+-	/* this determines event mask length which must match
+-	 * minimum length check in device firmware so it is
+-	 * hard-coded here.
+-	 */
+-	BRCMF_E_LAST
+ };
+ #undef BRCMF_ENUM_DEF
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+@@ -178,6 +178,11 @@
+ #define BRCMF_PMKSA_VER_3		3
+ #define BRCMF_PMKSA_NO_EXPIRY		0xffffffff
+ 
++#define BRCMF_EXTAUTH_START	1
++#define BRCMF_EXTAUTH_ABORT	2
++#define BRCMF_EXTAUTH_FAIL	3
++#define BRCMF_EXTAUTH_SUCCESS	4
++
+ /* MAX_CHUNK_LEN is the maximum length for data passing to firmware in each
+  * ioctl. It is relatively small because firmware has small maximum size input
+  * playload restriction for ioctls.
+@@ -598,6 +603,46 @@ struct brcmf_wsec_sae_pwd_le {
+ 	u8 key[BRCMF_WSEC_MAX_SAE_PASSWORD_LEN];
+ };
+ 
++/**
++ * struct brcmf_auth_req_status_le - external auth request and status update
++ *
++ * @flags: flags for external auth status
++ * @peer_mac: peer MAC address
++ * @ssid_len: length of ssid
++ * @ssid: ssid characters
++ */
++struct brcmf_auth_req_status_le {
++	__le16 flags;
++	u8 peer_mac[ETH_ALEN];
++	__le32 ssid_len;
++	u8 ssid[IEEE80211_MAX_SSID_LEN];
++};
++
++/**
++ * struct brcmf_mf_params_le - management frame parameters for mgmt_frame iovar
++ *
++ * @version: version of the iovar
++ * @dwell_time: dwell duration in ms
++ * @len: length of frame data
++ * @frame_control: frame control
++ * @channel: channel
++ * @da: peer MAC address
++ * @bssid: BSS network identifier
++ * @packet_id: packet identifier
++ * @data: frame data
++ */
++struct brcmf_mf_params_le {
++	__le32 version;
++	__le32 dwell_time;
++	__le16 len;
++	__le16 frame_control;
++	__le16 channel;
++	u8 da[ETH_ALEN];
++	u8 bssid[ETH_ALEN];
++	__le32 packet_id;
++	u8 data[1];
++};
++
+ /* Used to get specific STA parameters */
+ struct brcmf_scb_val_le {
+ 	__le32 val;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0427-brcmfmac-Fix-802.1x.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0427-brcmfmac-Fix-802.1x.patch
new file mode 100644
index 00000000..c3584d27
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0427-brcmfmac-Fix-802.1x.patch
@@ -0,0 +1,29 @@
+From 532dfd066d49f9c5ab083076e48272a38b36d053 Mon Sep 17 00:00:00 2001
+From: Mike Cui <cuicui@gmail.com>
+Date: Mon, 19 Feb 2024 17:11:49 -0800
+Subject: [PATCH 427/697] brcmfmac: Fix 802.1x
+
+Commit 7d239fbf9d4 broke 802.1X authentication by setting
+profile->use_fwsup = NONE whenever PSK is not used. However
+802.1X does not use PSK and requires profile->use_fwsup set
+to 1X, or brcmf_cfg80211_set_pmk() fails. Fix this by checking
+that profile->use_fwsup is not already set to 1X and avoid
+setting it to NONE in that case.
+
+Fixes: 7d239fbf9d4 (brcmfmac: Fix interoperating DPP and other encryption network access)
+Fixes: https://github.com/raspberrypi/linux/issues/5964
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -2481,7 +2481,7 @@ brcmf_cfg80211_connect(struct wiphy *wip
+ 				brcmf_dbg(INFO, "using PSK offload\n");
+ 				profile->use_fwsup = BRCMF_PROFILE_FWSUP_PSK;
+ 			}
+-		} else {
++		} else if (profile->use_fwsup != BRCMF_PROFILE_FWSUP_1X) {
+ 			profile->use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
+ 		}
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0428-mmc-bcm2835-sdhost-use-Host-Software-Queueing-mechan.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0428-mmc-bcm2835-sdhost-use-Host-Software-Queueing-mechan.patch
new file mode 100644
index 00000000..29a6c91a
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0428-mmc-bcm2835-sdhost-use-Host-Software-Queueing-mechan.patch
@@ -0,0 +1,111 @@
+From 3935406c13910930a8dca4e4126f62565fe043e3 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Thu, 18 Jan 2024 14:32:16 +0000
+Subject: [PATCH 428/697] mmc: bcm2835-sdhost: use Host Software Queueing
+ mechanism
+
+See commit 511ce378e16f ("mmc: Add MMC host software queue support")
+
+Introduced in 5.8, this feature lets the block layer issue up to 2
+pending requests to the MMC layer which in certain cases can improve
+throughput, but in the case of this driver can significantly reduce
+context switching when performing random reads.
+
+On bcm2837 with a performant class A1 card, context switches under FIO
+random 4k reads go from ~8800 per second to ~5800, with a reduction in
+hardIRQs per second from ~5800 to ~4000. There is no appreciable
+difference in throughput.
+
+For bcm2835, and for workloads other than random read, HSQ is a wash in
+terms of throughput and CPU load.
+
+So, use it by default.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/host/Kconfig          |  1 +
+ drivers/mmc/host/bcm2835-sdhost.c | 27 ++++++++++++++++++++++-----
+ 2 files changed, 23 insertions(+), 5 deletions(-)
+
+--- a/drivers/mmc/host/Kconfig
++++ b/drivers/mmc/host/Kconfig
+@@ -37,6 +37,7 @@ config MMC_BCM2835_PIO_DMA_BARRIER
+ config MMC_BCM2835_SDHOST
+ 	tristate "Support for the SDHost controller on BCM2708/9"
+ 	depends on ARCH_BCM2835
++	select MMC_HSQ
+ 	help
+ 	  This selects the SDHost controller on BCM2835/6.
+ 
+--- a/drivers/mmc/host/bcm2835-sdhost.c
++++ b/drivers/mmc/host/bcm2835-sdhost.c
+@@ -57,6 +57,7 @@
+ 
+ /* For mmc_card_blockaddr */
+ #include "../core/card.h"
++#include "mmc_hsq.h"
+ 
+ #define DRIVER_NAME "sdhost-bcm2835"
+ 
+@@ -1891,13 +1892,16 @@ static void bcm2835_sdhost_tasklet_finis
+ 				mmc_hostname(host->mmc));
+ 	}
+ 
+-	mmc_request_done(host->mmc, mrq);
++	if (!mmc_hsq_finalize_request(host->mmc, mrq))
++		mmc_request_done(host->mmc, mrq);
+ 	log_event("TSK>", mrq, 0);
+ }
+ 
+-int bcm2835_sdhost_add_host(struct bcm2835_host *host)
++static int bcm2835_sdhost_add_host(struct platform_device *pdev)
+ {
++	struct bcm2835_host *host = platform_get_drvdata(pdev);
+ 	struct mmc_host *mmc;
++	struct mmc_hsq *hsq;
+ 	struct dma_slave_config cfg;
+ 	char pio_limit_string[20];
+ 	int ret;
+@@ -1992,6 +1996,16 @@ int bcm2835_sdhost_add_host(struct bcm28
+ 		goto untasklet;
+ 	}
+ 
++	hsq = devm_kzalloc(&pdev->dev, sizeof(*hsq), GFP_KERNEL);
++	if (!hsq) {
++		ret = -ENOMEM;
++		goto free_irq;
++	}
++
++	ret = mmc_hsq_init(hsq, host->mmc);
++	if (ret)
++		goto free_irq;
++
+ 	mmc_add_host(mmc);
+ 
+ 	pio_limit_string[0] = '\0';
+@@ -2004,6 +2018,9 @@ int bcm2835_sdhost_add_host(struct bcm28
+ 
+ 	return 0;
+ 
++free_irq:
++	free_irq(host->irq, host);
++
+ untasklet:
+ 	tasklet_kill(&host->finish_tasklet);
+ 
+@@ -2134,12 +2151,12 @@ static int bcm2835_sdhost_probe(struct p
+ 
+ 	host->firmware_sets_cdiv = (msg[1] != ~0);
+ 
+-	ret = bcm2835_sdhost_add_host(host);
++	platform_set_drvdata(pdev, host);
++
++	ret = bcm2835_sdhost_add_host(pdev);
+ 	if (ret)
+ 		goto err;
+ 
+-	platform_set_drvdata(pdev, host);
+-
+ 	pr_debug("bcm2835_sdhost_probe -> OK\n");
+ 
+ 	return 0;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0429-drivers-mmc-add-SD-support-for-Command-Queueing.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0429-drivers-mmc-add-SD-support-for-Command-Queueing.patch
new file mode 100644
index 00000000..c89c33be
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0429-drivers-mmc-add-SD-support-for-Command-Queueing.patch
@@ -0,0 +1,247 @@
+From a464795ba56c099286af522845412436a89200fc Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Fri, 15 Mar 2024 13:06:13 +0000
+Subject: [PATCH 429/697] drivers: mmc: add SD support for Command Queueing
+
+Application class A2 cards require CQ to be enabled to realise their
+stated performance figures. Add support to enable/disable card CQ via
+the Performance Enhancement extension register, and cater for the slight
+differences in command set versus eMMC.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/core/block.c  | 26 +++++++++++++++++-----
+ drivers/mmc/core/core.c   |  6 ++++-
+ drivers/mmc/core/sd.c     | 46 ++++++++++++++++++++++++++++++++++-----
+ drivers/mmc/core/sd_ops.c | 37 +++++++++++++++++++++++++++++++
+ drivers/mmc/core/sd_ops.h |  2 ++
+ include/linux/mmc/sd.h    | 12 ++++++++++
+ 6 files changed, 116 insertions(+), 13 deletions(-)
+
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -934,7 +934,10 @@ static int mmc_blk_part_switch_pre(struc
+ 
+ 	if ((part_type & mask) == rpmb) {
+ 		if (card->ext_csd.cmdq_en) {
+-			ret = mmc_cmdq_disable(card);
++			if (mmc_card_sd(card))
++				ret = mmc_sd_cmdq_disable(card);
++			else
++				ret = mmc_cmdq_disable(card);
+ 			if (ret)
+ 				return ret;
+ 		}
+@@ -953,8 +956,12 @@ static int mmc_blk_part_switch_post(stru
+ 
+ 	if ((part_type & mask) == rpmb) {
+ 		mmc_retune_unpause(card->host);
+-		if (card->reenable_cmdq && !card->ext_csd.cmdq_en)
+-			ret = mmc_cmdq_enable(card);
++		if (card->reenable_cmdq && !card->ext_csd.cmdq_en) {
++			if (mmc_card_sd(card))
++				ret = mmc_sd_cmdq_enable(card);
++			else
++				ret = mmc_cmdq_enable(card);
++		}
+ 	}
+ 
+ 	return ret;
+@@ -1165,7 +1172,10 @@ static void mmc_blk_issue_drv_op(struct
+ 	switch (mq_rq->drv_op) {
+ 	case MMC_DRV_OP_IOCTL:
+ 		if (card->ext_csd.cmdq_en) {
+-			ret = mmc_cmdq_disable(card);
++			if (mmc_card_sd(card))
++				ret = mmc_sd_cmdq_disable(card);
++			else
++				ret = mmc_cmdq_disable(card);
+ 			if (ret)
+ 				break;
+ 		}
+@@ -1183,8 +1193,12 @@ static void mmc_blk_issue_drv_op(struct
+ 		/* Always switch back to main area after RPMB access */
+ 		if (rpmb_ioctl)
+ 			mmc_blk_part_switch(card, 0);
+-		else if (card->reenable_cmdq && !card->ext_csd.cmdq_en)
+-			mmc_cmdq_enable(card);
++		else if (card->reenable_cmdq && !card->ext_csd.cmdq_en) {
++			if (mmc_card_sd(card))
++				mmc_sd_cmdq_enable(card);
++			else
++				mmc_cmdq_enable(card);
++		}
+ 		break;
+ 	case MMC_DRV_OP_BOOT_WP:
+ 		ret = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL, EXT_CSD_BOOT_WP,
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -556,7 +556,11 @@ int mmc_cqe_recovery(struct mmc_host *ho
+ 	mmc_poll_for_busy(host->card, MMC_CQE_RECOVERY_TIMEOUT, true, MMC_BUSY_IO);
+ 
+ 	memset(&cmd, 0, sizeof(cmd));
+-	cmd.opcode       = MMC_CMDQ_TASK_MGMT;
++	if (mmc_card_sd(host->card))
++		cmd.opcode = SD_CMDQ_TASK_MGMT;
++	else
++		cmd.opcode = MMC_CMDQ_TASK_MGMT;
++
+ 	cmd.arg          = 1; /* Discard entire queue */
+ 	cmd.flags        = MMC_RSP_R1B | MMC_CMD_AC;
+ 	cmd.flags       &= ~MMC_RSP_CRC; /* Ignore CRC */
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -1011,8 +1011,8 @@ static bool mmc_sd_card_using_v18(struct
+ 	       (SD_MODE_UHS_SDR50 | SD_MODE_UHS_SDR104 | SD_MODE_UHS_DDR50);
+ }
+ 
+-static int sd_write_ext_reg(struct mmc_card *card, u8 fno, u8 page, u16 offset,
+-			    u8 reg_data)
++int sd_write_ext_reg(struct mmc_card *card, u8 fno, u8 page, u16 offset,
++		     u8 reg_data)
+ {
+ 	struct mmc_host *host = card->host;
+ 	struct mmc_request mrq = {};
+@@ -1170,8 +1170,14 @@ static int sd_parse_ext_reg_perf(struct
+ 		card->ext_perf.feature_support |= SD_EXT_PERF_CACHE;
+ 
+ 	/* Command queue support indicated via queue depth bits (0 to 4). */
+-	if (reg_buf[6] & 0x1f)
++	if (reg_buf[6] & 0x1f) {
+ 		card->ext_perf.feature_support |= SD_EXT_PERF_CMD_QUEUE;
++		card->ext_csd.cmdq_depth = reg_buf[6] & 0x1f;
++		card->ext_csd.cmdq_support = true;
++		pr_debug("%s: Command Queue supported depth %u\n",
++			 mmc_hostname(card->host),
++			 card->ext_csd.cmdq_depth);
++	}
+ 
+ 	card->ext_perf.fno = fno;
+ 	card->ext_perf.page = page;
+@@ -1558,13 +1564,41 @@ cont:
+ 			goto free_card;
+ 	}
+ 
++	/* Enable command queueing if supported */
++	if (card->ext_csd.cmdq_support && host->caps2 & MMC_CAP2_CQE) {
++		/*
++		 * Right now the MMC block layer uses DCMDs to issue
++		 * cache-flush commands specific to eMMC devices.
++		 * Turning off DCMD support avoids generating Illegal Command
++		 * errors on SD, and flushing is instead done synchronously
++		 * by mmc_blk_issue_flush().
++		 */
++		host->caps2 &= ~MMC_CAP2_CQE_DCMD;
++		err = mmc_sd_cmdq_enable(card);
++		if (err && err != -EBADMSG)
++			goto free_card;
++		if (err) {
++			pr_warn("%s: Enabling CMDQ failed\n",
++				mmc_hostname(card->host));
++			card->ext_csd.cmdq_support = false;
++			card->ext_csd.cmdq_depth = 0;
++		}
++	}
++	card->reenable_cmdq = card->ext_csd.cmdq_en;
++
+ 	if (host->cqe_ops && !host->cqe_enabled) {
+ 		err = host->cqe_ops->cqe_enable(host, card);
+ 		if (!err) {
+ 			host->cqe_enabled = true;
+-			host->hsq_enabled = true;
+-			pr_info("%s: Host Software Queue enabled\n",
+-				mmc_hostname(host));
++
++			if (card->ext_csd.cmdq_en) {
++				pr_info("%s: Command Queue Engine enabled\n",
++					mmc_hostname(host));
++			} else {
++				host->hsq_enabled = true;
++				pr_info("%s: Host Software Queue enabled\n",
++					mmc_hostname(host));
++			}
+ 		}
+ 	}
+ 
+--- a/drivers/mmc/core/sd_ops.c
++++ b/drivers/mmc/core/sd_ops.c
+@@ -393,3 +393,40 @@ int mmc_app_sd_status(struct mmc_card *c
+ 
+ 	return 0;
+ }
++
++int sd_write_ext_reg(struct mmc_card *card, u8 fno, u8 page, u16 offset,
++		     u8 reg_data);
++
++static int mmc_sd_cmdq_switch(struct mmc_card *card, bool enable)
++{
++	int err;
++	u8 reg = 0;
++	/*
++	 * SD offers two command queueing modes - sequential (in-order) and
++	 * voluntary (out-of-order). Apps Class A2 performance is only
++	 * guaranteed for voluntary CQ (bit 1 = 0), so use that in preference
++	 * to sequential.
++	 */
++	if (enable)
++		reg = BIT(0);
++
++	/* Performance enhancement register byte 262 controls command queueing */
++	err = sd_write_ext_reg(card, card->ext_perf.fno, card->ext_perf.page,
++			       card->ext_perf.offset + 262, reg);
++	if (!err)
++		card->ext_csd.cmdq_en = enable;
++
++	return err;
++}
++
++int mmc_sd_cmdq_enable(struct mmc_card *card)
++{
++	return mmc_sd_cmdq_switch(card, true);
++}
++EXPORT_SYMBOL_GPL(mmc_sd_cmdq_enable);
++
++int mmc_sd_cmdq_disable(struct mmc_card *card)
++{
++	return mmc_sd_cmdq_switch(card, false);
++}
++EXPORT_SYMBOL_GPL(mmc_sd_cmdq_disable);
+--- a/drivers/mmc/core/sd_ops.h
++++ b/drivers/mmc/core/sd_ops.h
+@@ -21,6 +21,8 @@ int mmc_send_relative_addr(struct mmc_ho
+ int mmc_app_send_scr(struct mmc_card *card);
+ int mmc_app_sd_status(struct mmc_card *card, void *ssr);
+ int mmc_app_cmd(struct mmc_host *host, struct mmc_card *card);
++int mmc_sd_cmdq_enable(struct mmc_card *card);
++int mmc_sd_cmdq_disable(struct mmc_card *card);
+ 
+ #endif
+ 
+--- a/include/linux/mmc/sd.h
++++ b/include/linux/mmc/sd.h
+@@ -29,6 +29,9 @@
+ #define SD_APP_OP_COND           41   /* bcr  [31:0] OCR         R3  */
+ #define SD_APP_SEND_SCR          51   /* adtc                    R1  */
+ 
++  /* class 1 */
++#define SD_CMDQ_TASK_MGMT        43   /* ac   See below          R1b */
++
+   /* class 11 */
+ #define SD_READ_EXTR_SINGLE      48   /* adtc [31:0]             R1  */
+ #define SD_WRITE_EXTR_SINGLE     49   /* adtc [31:0]             R1  */
+@@ -62,6 +65,15 @@
+  */
+ 
+ /*
++ * SD_CMDQ_TASK_MGMT argument format:
++ *
++ * [31:21] Reserved (0)
++ * [20:16] Task ID
++ * [15:4] Reserved (0)
++ * [3:0] Operation - 0x1 = abort all tasks, 0x2 = abort Task ID
++ */
++
++/*
+  * SCR field definitions
+  */
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0430-drivers-mmc-preallocate-a-block-for-SD-extension-reg.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0430-drivers-mmc-preallocate-a-block-for-SD-extension-reg.patch
new file mode 100644
index 00000000..f70ec971
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0430-drivers-mmc-preallocate-a-block-for-SD-extension-reg.patch
@@ -0,0 +1,155 @@
+From d55b12e1526623aecfcc77759a9e70e32045f1b2 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 20 Mar 2024 13:00:30 +0000
+Subject: [PATCH 430/697] drivers: mmc: preallocate a block for SD extension
+ register accesses
+
+The Performance Extension register is regularly accessed in a hot path
+to do write cache flushes. Don't invoke kmalloc/kfree for every access,
+preallocate a 512B buffer for this purpose.
+
+Also remove an unused alloc in sd_enable_cache().
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/core/bus.c   |  2 ++
+ drivers/mmc/core/sd.c    | 34 +++++++++++-----------------------
+ include/linux/mmc/card.h |  1 +
+ 3 files changed, 14 insertions(+), 23 deletions(-)
+
+--- a/drivers/mmc/core/bus.c
++++ b/drivers/mmc/core/bus.c
+@@ -266,6 +266,8 @@ static void mmc_release_card(struct devi
+ 
+ 	sdio_free_common_cis(card);
+ 
++	kfree(card->ext_reg_buf);
++
+ 	kfree(card->info);
+ 
+ 	kfree(card);
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -1021,9 +1021,8 @@ int sd_write_ext_reg(struct mmc_card *ca
+ 	struct scatterlist sg;
+ 	u8 *reg_buf;
+ 
+-	reg_buf = kzalloc(512, GFP_KERNEL);
+-	if (!reg_buf)
+-		return -ENOMEM;
++	reg_buf = card->ext_reg_buf;
++	memset(reg_buf, 0, 512);
+ 
+ 	mrq.cmd = &cmd;
+ 	mrq.data = &data;
+@@ -1055,8 +1054,6 @@ int sd_write_ext_reg(struct mmc_card *ca
+ 	mmc_set_data_timeout(&data, card);
+ 	mmc_wait_for_req(host, &mrq);
+ 
+-	kfree(reg_buf);
+-
+ 	/*
+ 	 * Note that, the SD card is allowed to signal busy on DAT0 up to 1s
+ 	 * after the CMD49. Although, let's leave this to be managed by the
+@@ -1097,9 +1094,7 @@ static int sd_parse_ext_reg_power(struct
+ 	int err;
+ 	u8 *reg_buf;
+ 
+-	reg_buf = kzalloc(512, GFP_KERNEL);
+-	if (!reg_buf)
+-		return -ENOMEM;
++	reg_buf = card->ext_reg_buf;
+ 
+ 	/* Read the extension register for power management function. */
+ 	err = sd_read_ext_reg(card, fno, page, offset, 512, reg_buf);
+@@ -1129,7 +1124,6 @@ static int sd_parse_ext_reg_power(struct
+ 	card->ext_power.offset = offset;
+ 
+ out:
+-	kfree(reg_buf);
+ 	return err;
+ }
+ 
+@@ -1139,9 +1133,7 @@ static int sd_parse_ext_reg_perf(struct
+ 	int err;
+ 	u8 *reg_buf;
+ 
+-	reg_buf = kzalloc(512, GFP_KERNEL);
+-	if (!reg_buf)
+-		return -ENOMEM;
++	reg_buf = card->ext_reg_buf;
+ 
+ 	err = sd_read_ext_reg(card, fno, page, offset, 512, reg_buf);
+ 	if (err) {
+@@ -1184,7 +1176,6 @@ static int sd_parse_ext_reg_perf(struct
+ 	card->ext_perf.offset = offset;
+ 
+ out:
+-	kfree(reg_buf);
+ 	return err;
+ }
+ 
+@@ -1255,6 +1246,12 @@ static int sd_read_ext_regs(struct mmc_c
+ 	if (!gen_info_buf)
+ 		return -ENOMEM;
+ 
++	card->ext_reg_buf = kzalloc(512, GFP_KERNEL);
++	if (!card->ext_reg_buf) {
++		err = -ENOMEM;
++		goto out;
++	}
++
+ 	/*
+ 	 * Read 512 bytes of general info, which is found at function number 0,
+ 	 * at page 0 and with no offset.
+@@ -1321,9 +1318,7 @@ static int sd_flush_cache(struct mmc_hos
+ 	if (!sd_cache_enabled(host))
+ 		return 0;
+ 
+-	reg_buf = kzalloc(512, GFP_KERNEL);
+-	if (!reg_buf)
+-		return -ENOMEM;
++	reg_buf = card->ext_reg_buf;
+ 
+ 	/*
+ 	 * Set Flush Cache at bit 0 in the performance enhancement register at
+@@ -1359,21 +1354,15 @@ static int sd_flush_cache(struct mmc_hos
+ 	if (reg_buf[0] & BIT(0))
+ 		err = -ETIMEDOUT;
+ out:
+-	kfree(reg_buf);
+ 	return err;
+ }
+ 
+ static int sd_enable_cache(struct mmc_card *card)
+ {
+-	u8 *reg_buf;
+ 	int err;
+ 
+ 	card->ext_perf.feature_enabled &= ~SD_EXT_PERF_CACHE;
+ 
+-	reg_buf = kzalloc(512, GFP_KERNEL);
+-	if (!reg_buf)
+-		return -ENOMEM;
+-
+ 	/*
+ 	 * Set Cache Enable at bit 0 in the performance enhancement register at
+ 	 * 260 bytes offset.
+@@ -1392,7 +1381,6 @@ static int sd_enable_cache(struct mmc_ca
+ 		card->ext_perf.feature_enabled |= SD_EXT_PERF_CACHE;
+ 
+ out:
+-	kfree(reg_buf);
+ 	return err;
+ }
+ 
+--- a/include/linux/mmc/card.h
++++ b/include/linux/mmc/card.h
+@@ -320,6 +320,7 @@ struct mmc_card {
+ 	struct sd_switch_caps	sw_caps;	/* switch (CMD6) caps */
+ 	struct sd_ext_reg	ext_power;	/* SD extension reg for PM */
+ 	struct sd_ext_reg	ext_perf;	/* SD extension reg for PERF */
++	u8			*ext_reg_buf;	/* 512 byte block for extension register R/W */
+ 
+ 	unsigned int		sdio_funcs;	/* number of SDIO functions */
+ 	atomic_t		sdio_funcs_probed; /* number of probed SDIO funcs */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0431-drivers-mmc-trigger-activity-LED-when-CQE-is-active.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0431-drivers-mmc-trigger-activity-LED-when-CQE-is-active.patch
new file mode 100644
index 00000000..29962780
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0431-drivers-mmc-trigger-activity-LED-when-CQE-is-active.patch
@@ -0,0 +1,23 @@
+From c055d89dbce7325b468812469932a0925baa95e6 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 20 Mar 2024 14:18:30 +0000
+Subject: [PATCH 431/697] drivers: mmc: trigger activity LED when CQE is active
+
+Add a LED_FULL trigger equivalent to mmc_start_request() in
+mmc_cqe_start_req(), otherwise it stays off forever.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/core/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -455,6 +455,7 @@ int mmc_cqe_start_req(struct mmc_host *h
+ 		goto out_err;
+ 
+ 	trace_mmc_request_start(host, mrq);
++	led_trigger_event(host->led, LED_FULL);
+ 
+ 	return 0;
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0432-drivers-sdhci-brcmstb-work-around-mystery-CQE-CMD_ID.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0432-drivers-sdhci-brcmstb-work-around-mystery-CQE-CMD_ID.patch
new file mode 100644
index 00000000..71be7a25
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0432-drivers-sdhci-brcmstb-work-around-mystery-CQE-CMD_ID.patch
@@ -0,0 +1,37 @@
+From e9265d895176735e8ca0eb9848705601b23b4307 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Fri, 22 Mar 2024 14:22:55 +0000
+Subject: [PATCH 432/697] drivers: sdhci-brcmstb: work around mystery CQE
+ CMD_IDLE_TIMER trampling
+
+For unknown reasons the controller seems to reset the idle polling timer
+interval on CQE enable/disable to 8 clocks which is extremely short.
+
+Just use the reset value in the eMMC spec (4096 clock periods which at
+200MHz is ~20uS).
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/host/sdhci-brcmstb.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/mmc/host/sdhci-brcmstb.c
++++ b/drivers/mmc/host/sdhci-brcmstb.c
+@@ -385,6 +385,7 @@ static void sdhci_brcmstb_dumpregs(struc
+ static void sdhci_brcmstb_cqe_enable(struct mmc_host *mmc)
+ {
+ 	struct sdhci_host *host = mmc_priv(mmc);
++	struct cqhci_host *cq_host = mmc->cqe_private;
+ 	u32 reg;
+ 
+ 	reg = sdhci_readl(host, SDHCI_PRESENT_STATE);
+@@ -394,6 +395,9 @@ static void sdhci_brcmstb_cqe_enable(str
+ 	}
+ 
+ 	sdhci_cqe_enable(mmc);
++
++	/* Reset CMD13 polling timer back to eMMC specification default */
++	cqhci_writel(cq_host, 0x00011000, CQHCI_SSC1);
+ }
+ 
+ static const struct cqhci_host_ops sdhci_brcmstb_cqhci_ops = {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0433-drivers-mmc-cqhci-clear-CQHCI_CTL-if-halt-fails.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0433-drivers-mmc-cqhci-clear-CQHCI_CTL-if-halt-fails.patch
new file mode 100644
index 00000000..fe30156a
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0433-drivers-mmc-cqhci-clear-CQHCI_CTL-if-halt-fails.patch
@@ -0,0 +1,46 @@
+From bdbdf4ba929e6767f2cc251dcac4284fd55f31df Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Tue, 26 Mar 2024 13:17:10 +0000
+Subject: [PATCH 433/697] drivers: mmc: cqhci: clear CQHCI_CTL if halt fails
+
+The eMMC spec says that in certain circumstances the controller can't
+respond to a halt request - in practice, this occurs if a CMD
+timeout happens (card went away/crashed).
+
+Clear the halt request by writing 0 to CQHCI_CTL. Also fix a logic error
+testing for halt in cqhci_request.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/host/cqhci-core.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/mmc/host/cqhci-core.c
++++ b/drivers/mmc/host/cqhci-core.c
+@@ -388,9 +388,11 @@ static void cqhci_off(struct mmc_host *m
+ 
+ 	err = readx_poll_timeout(cqhci_read_ctl, cq_host, reg,
+ 				 reg & CQHCI_HALT, 0, CQHCI_OFF_TIMEOUT);
+-	if (err < 0)
++	if (err < 0) {
+ 		pr_err("%s: cqhci: CQE stuck on\n", mmc_hostname(mmc));
+-	else
++		/* eMMC v5.1 B.2.8 recommends writing 0 to CQHCI_CTL if stuck */
++		cqhci_writel(cq_host, 0, CQHCI_CTL);
++	} else
+ 		pr_debug("%s: cqhci: CQE off\n", mmc_hostname(mmc));
+ 
+ 	if (cq_host->ops->post_disable)
+@@ -980,8 +982,11 @@ static bool cqhci_halt(struct mmc_host *
+ 
+ 	ret = cqhci_halted(cq_host);
+ 
+-	if (!ret)
++	if (!ret) {
+ 		pr_warn("%s: cqhci: Failed to halt\n", mmc_hostname(mmc));
++		/* eMMC v5.1 B.2.8 recommends writing 0 to CQHCI_CTL if stuck */
++		cqhci_writel(cq_host, 0, CQHCI_CTL);
++	}
+ 
+ 	return ret;
+ }
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0434-drivers-mmc-export-SD-extension-register-read-write-.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0434-drivers-mmc-export-SD-extension-register-read-write-.patch
new file mode 100644
index 00000000..6d2dea3f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0434-drivers-mmc-export-SD-extension-register-read-write-.patch
@@ -0,0 +1,304 @@
+From 6f3469680356b0871075cf70aab00119fd367303 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Tue, 26 Mar 2024 13:25:01 +0000
+Subject: [PATCH 434/697] drivers: mmc: export SD extension register read/write
+ functions
+
+Certain status bits in these registers may need polling outside of
+SD-specific code. Export in sd_ops.h
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/core/sd.c     | 97 ++++-----------------------------------
+ drivers/mmc/core/sd_ops.c | 83 +++++++++++++++++++++++++++++++--
+ drivers/mmc/core/sd_ops.h |  4 ++
+ 3 files changed, 93 insertions(+), 91 deletions(-)
+
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -1011,83 +1011,6 @@ static bool mmc_sd_card_using_v18(struct
+ 	       (SD_MODE_UHS_SDR50 | SD_MODE_UHS_SDR104 | SD_MODE_UHS_DDR50);
+ }
+ 
+-int sd_write_ext_reg(struct mmc_card *card, u8 fno, u8 page, u16 offset,
+-		     u8 reg_data)
+-{
+-	struct mmc_host *host = card->host;
+-	struct mmc_request mrq = {};
+-	struct mmc_command cmd = {};
+-	struct mmc_data data = {};
+-	struct scatterlist sg;
+-	u8 *reg_buf;
+-
+-	reg_buf = card->ext_reg_buf;
+-	memset(reg_buf, 0, 512);
+-
+-	mrq.cmd = &cmd;
+-	mrq.data = &data;
+-
+-	/*
+-	 * Arguments of CMD49:
+-	 * [31:31] MIO (0 = memory).
+-	 * [30:27] FNO (function number).
+-	 * [26:26] MW - mask write mode (0 = disable).
+-	 * [25:18] page number.
+-	 * [17:9] offset address.
+-	 * [8:0] length (0 = 1 byte).
+-	 */
+-	cmd.arg = fno << 27 | page << 18 | offset << 9;
+-
+-	/* The first byte in the buffer is the data to be written. */
+-	reg_buf[0] = reg_data;
+-
+-	data.flags = MMC_DATA_WRITE;
+-	data.blksz = 512;
+-	data.blocks = 1;
+-	data.sg = &sg;
+-	data.sg_len = 1;
+-	sg_init_one(&sg, reg_buf, 512);
+-
+-	cmd.opcode = SD_WRITE_EXTR_SINGLE;
+-	cmd.flags = MMC_RSP_R1 | MMC_CMD_ADTC;
+-
+-	mmc_set_data_timeout(&data, card);
+-	mmc_wait_for_req(host, &mrq);
+-
+-	/*
+-	 * Note that, the SD card is allowed to signal busy on DAT0 up to 1s
+-	 * after the CMD49. Although, let's leave this to be managed by the
+-	 * caller.
+-	 */
+-
+-	if (cmd.error)
+-		return cmd.error;
+-	if (data.error)
+-		return data.error;
+-
+-	return 0;
+-}
+-
+-static int sd_read_ext_reg(struct mmc_card *card, u8 fno, u8 page,
+-			   u16 offset, u16 len, u8 *reg_buf)
+-{
+-	u32 cmd_args;
+-
+-	/*
+-	 * Command arguments of CMD48:
+-	 * [31:31] MIO (0 = memory).
+-	 * [30:27] FNO (function number).
+-	 * [26:26] reserved (0).
+-	 * [25:18] page number.
+-	 * [17:9] offset address.
+-	 * [8:0] length (0 = 1 byte, 1ff = 512 bytes).
+-	 */
+-	cmd_args = fno << 27 | page << 18 | offset << 9 | (len -1);
+-
+-	return mmc_send_adtc_data(card, card->host, SD_READ_EXTR_SINGLE,
+-				  cmd_args, reg_buf, 512);
+-}
+-
+ static int sd_parse_ext_reg_power(struct mmc_card *card, u8 fno, u8 page,
+ 				  u16 offset)
+ {
+@@ -1097,7 +1020,7 @@ static int sd_parse_ext_reg_power(struct
+ 	reg_buf = card->ext_reg_buf;
+ 
+ 	/* Read the extension register for power management function. */
+-	err = sd_read_ext_reg(card, fno, page, offset, 512, reg_buf);
++	err = mmc_sd_read_ext_reg(card, fno, page, offset, 512, reg_buf);
+ 	if (err) {
+ 		pr_warn("%s: error %d reading PM func of ext reg\n",
+ 			mmc_hostname(card->host), err);
+@@ -1135,7 +1058,7 @@ static int sd_parse_ext_reg_perf(struct
+ 
+ 	reg_buf = card->ext_reg_buf;
+ 
+-	err = sd_read_ext_reg(card, fno, page, offset, 512, reg_buf);
++	err = mmc_sd_read_ext_reg(card, fno, page, offset, 512, reg_buf);
+ 	if (err) {
+ 		pr_warn("%s: error %d reading PERF func of ext reg\n",
+ 			mmc_hostname(card->host), err);
+@@ -1230,7 +1153,7 @@ static int sd_parse_ext_reg(struct mmc_c
+ 	return 0;
+ }
+ 
+-static int sd_read_ext_regs(struct mmc_card *card)
++static int mmc_sd_read_ext_regs(struct mmc_card *card)
+ {
+ 	int err, i;
+ 	u8 num_ext, *gen_info_buf;
+@@ -1256,7 +1179,7 @@ static int sd_read_ext_regs(struct mmc_c
+ 	 * Read 512 bytes of general info, which is found at function number 0,
+ 	 * at page 0 and with no offset.
+ 	 */
+-	err = sd_read_ext_reg(card, 0, 0, 0, 512, gen_info_buf);
++	err = mmc_sd_read_ext_reg(card, 0, 0, 0, 512, gen_info_buf);
+ 	if (err) {
+ 		pr_err("%s: error %d reading general info of SD ext reg\n",
+ 			mmc_hostname(card->host), err);
+@@ -1328,7 +1251,7 @@ static int sd_flush_cache(struct mmc_hos
+ 	page = card->ext_perf.page;
+ 	offset = card->ext_perf.offset + 261;
+ 
+-	err = sd_write_ext_reg(card, fno, page, offset, BIT(0));
++	err = mmc_sd_write_ext_reg(card, fno, page, offset, BIT(0));
+ 	if (err) {
+ 		pr_warn("%s: error %d writing Cache Flush bit\n",
+ 			mmc_hostname(host), err);
+@@ -1344,7 +1267,7 @@ static int sd_flush_cache(struct mmc_hos
+ 	 * Read the Flush Cache bit. The card shall reset it, to confirm that
+ 	 * it's has completed the flushing of the cache.
+ 	 */
+-	err = sd_read_ext_reg(card, fno, page, offset, 1, reg_buf);
++	err = mmc_sd_read_ext_reg(card, fno, page, offset, 1, reg_buf);
+ 	if (err) {
+ 		pr_warn("%s: error %d reading Cache Flush bit\n",
+ 			mmc_hostname(host), err);
+@@ -1367,7 +1290,7 @@ static int sd_enable_cache(struct mmc_ca
+ 	 * Set Cache Enable at bit 0 in the performance enhancement register at
+ 	 * 260 bytes offset.
+ 	 */
+-	err = sd_write_ext_reg(card, card->ext_perf.fno, card->ext_perf.page,
++	err = mmc_sd_write_ext_reg(card, card->ext_perf.fno, card->ext_perf.page,
+ 			       card->ext_perf.offset + 260, BIT(0));
+ 	if (err) {
+ 		pr_warn("%s: error %d writing Cache Enable bit\n",
+@@ -1540,7 +1463,7 @@ retry:
+ cont:
+ 	if (!oldcard) {
+ 		/* Read/parse the extension registers. */
+-		err = sd_read_ext_regs(card);
++		err = mmc_sd_read_ext_regs(card);
+ 		if (err)
+ 			goto free_card;
+ 	}
+@@ -1667,7 +1590,7 @@ static int sd_busy_poweroff_notify_cb(vo
+ 	 * one byte offset and is one byte long. The Power Off Notification
+ 	 * Ready is bit 0.
+ 	 */
+-	err = sd_read_ext_reg(card, card->ext_power.fno, card->ext_power.page,
++	err = mmc_sd_read_ext_reg(card, card->ext_power.fno, card->ext_power.page,
+ 			      card->ext_power.offset + 1, 1, data->reg_buf);
+ 	if (err) {
+ 		pr_warn("%s: error %d reading status reg of PM func\n",
+@@ -1693,7 +1616,7 @@ static int sd_poweroff_notify(struct mmc
+ 	 * Set the Power Off Notification bit in the power management settings
+ 	 * register at 2 bytes offset.
+ 	 */
+-	err = sd_write_ext_reg(card, card->ext_power.fno, card->ext_power.page,
++	err = mmc_sd_write_ext_reg(card, card->ext_power.fno, card->ext_power.page,
+ 			       card->ext_power.offset + 2, BIT(0));
+ 	if (err) {
+ 		pr_warn("%s: error %d writing Power Off Notify bit\n",
+--- a/drivers/mmc/core/sd_ops.c
++++ b/drivers/mmc/core/sd_ops.c
+@@ -394,8 +394,83 @@ int mmc_app_sd_status(struct mmc_card *c
+ 	return 0;
+ }
+ 
+-int sd_write_ext_reg(struct mmc_card *card, u8 fno, u8 page, u16 offset,
+-		     u8 reg_data);
++
++int mmc_sd_write_ext_reg(struct mmc_card *card, u8 fno, u8 page, u16 offset,
++		     u8 reg_data)
++{
++	struct mmc_host *host = card->host;
++	struct mmc_request mrq = {};
++	struct mmc_command cmd = {};
++	struct mmc_data data = {};
++	struct scatterlist sg;
++	u8 *reg_buf;
++
++	reg_buf = card->ext_reg_buf;
++	memset(reg_buf, 0, 512);
++
++	mrq.cmd = &cmd;
++	mrq.data = &data;
++
++	/*
++	 * Arguments of CMD49:
++	 * [31:31] MIO (0 = memory).
++	 * [30:27] FNO (function number).
++	 * [26:26] MW - mask write mode (0 = disable).
++	 * [25:18] page number.
++	 * [17:9] offset address.
++	 * [8:0] length (0 = 1 byte).
++	 */
++	cmd.arg = fno << 27 | page << 18 | offset << 9;
++
++	/* The first byte in the buffer is the data to be written. */
++	reg_buf[0] = reg_data;
++
++	data.flags = MMC_DATA_WRITE;
++	data.blksz = 512;
++	data.blocks = 1;
++	data.sg = &sg;
++	data.sg_len = 1;
++	sg_init_one(&sg, reg_buf, 512);
++
++	cmd.opcode = SD_WRITE_EXTR_SINGLE;
++	cmd.flags = MMC_RSP_R1 | MMC_CMD_ADTC;
++
++	mmc_set_data_timeout(&data, card);
++	mmc_wait_for_req(host, &mrq);
++
++	/*
++	 * Note that, the SD card is allowed to signal busy on DAT0 up to 1s
++	 * after the CMD49. Although, let's leave this to be managed by the
++	 * caller.
++	 */
++
++	if (cmd.error)
++		return cmd.error;
++	if (data.error)
++		return data.error;
++
++	return 0;
++}
++
++int mmc_sd_read_ext_reg(struct mmc_card *card, u8 fno, u8 page,
++			u16 offset, u16 len, u8 *reg_buf)
++{
++	u32 cmd_args;
++
++	/*
++	 * Command arguments of CMD48:
++	 * [31:31] MIO (0 = memory).
++	 * [30:27] FNO (function number).
++	 * [26:26] reserved (0).
++	 * [25:18] page number.
++	 * [17:9] offset address.
++	 * [8:0] length (0 = 1 byte, 1ff = 512 bytes).
++	 */
++	cmd_args = fno << 27 | page << 18 | offset << 9 | (len - 1);
++
++	return mmc_send_adtc_data(card, card->host, SD_READ_EXTR_SINGLE,
++				  cmd_args, reg_buf, 512);
++}
+ 
+ static int mmc_sd_cmdq_switch(struct mmc_card *card, bool enable)
+ {
+@@ -411,8 +486,8 @@ static int mmc_sd_cmdq_switch(struct mmc
+ 		reg = BIT(0);
+ 
+ 	/* Performance enhancement register byte 262 controls command queueing */
+-	err = sd_write_ext_reg(card, card->ext_perf.fno, card->ext_perf.page,
+-			       card->ext_perf.offset + 262, reg);
++	err = mmc_sd_write_ext_reg(card, card->ext_perf.fno, card->ext_perf.page,
++				   card->ext_perf.offset + 262, reg);
+ 	if (!err)
+ 		card->ext_csd.cmdq_en = enable;
+ 
+--- a/drivers/mmc/core/sd_ops.h
++++ b/drivers/mmc/core/sd_ops.h
+@@ -23,6 +23,10 @@ int mmc_app_sd_status(struct mmc_card *c
+ int mmc_app_cmd(struct mmc_host *host, struct mmc_card *card);
+ int mmc_sd_cmdq_enable(struct mmc_card *card);
+ int mmc_sd_cmdq_disable(struct mmc_card *card);
++int mmc_sd_write_ext_reg(struct mmc_card *card, u8 fno, u8 page, u16 offset,
++			 u8 reg_data);
++int mmc_sd_read_ext_reg(struct mmc_card *card, u8 fno, u8 page,
++			u16 offset, u16 len, u8 *reg_buf);
+ 
+ #endif
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0435-drivers-mmc-be-more-cautious-when-manipulating-Comma.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0435-drivers-mmc-be-more-cautious-when-manipulating-Comma.patch
new file mode 100644
index 00000000..aa7ba86a
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0435-drivers-mmc-be-more-cautious-when-manipulating-Comma.patch
@@ -0,0 +1,79 @@
+From 8853434c9cf7f746a23d5669f67769a58e86955a Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Tue, 26 Mar 2024 13:36:23 +0000
+Subject: [PATCH 435/697] drivers: mmc: be more cautious when manipulating
+ Command Queue enable
+
+Don't attempt to turn on CQ if the other mandatory features are not
+indicated as supported by the card. Also make sure that the register write
+actually stuck, as some cards claim support but never report back that
+the queue engine is enabled.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/core/sd.c     |  8 ++++++--
+ drivers/mmc/core/sd_ops.c | 22 ++++++++++++++++++++++
+ 2 files changed, 28 insertions(+), 2 deletions(-)
+
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -1084,8 +1084,12 @@ static int sd_parse_ext_reg_perf(struct
+ 	if ((reg_buf[4] & BIT(0)) && !mmc_card_broken_sd_cache(card))
+ 		card->ext_perf.feature_support |= SD_EXT_PERF_CACHE;
+ 
+-	/* Command queue support indicated via queue depth bits (0 to 4). */
+-	if (reg_buf[6] & 0x1f) {
++	/*
++	 * Command queue support indicated via queue depth bits (0 to 4).
++	 * Qualify this with the other mandatory required features.
++	 */
++	if (reg_buf[6] & 0x1f && card->ext_power.feature_support & SD_EXT_POWER_OFF_NOTIFY &&
++	    card->ext_perf.feature_support & SD_EXT_PERF_CACHE) {
+ 		card->ext_perf.feature_support |= SD_EXT_PERF_CMD_QUEUE;
+ 		card->ext_csd.cmdq_depth = reg_buf[6] & 0x1f;
+ 		card->ext_csd.cmdq_support = true;
+--- a/drivers/mmc/core/sd_ops.c
++++ b/drivers/mmc/core/sd_ops.c
+@@ -8,6 +8,7 @@
+ #include <linux/slab.h>
+ #include <linux/types.h>
+ #include <linux/export.h>
++#include <linux/ktime.h>
+ #include <linux/scatterlist.h>
+ 
+ #include <linux/mmc/host.h>
+@@ -476,6 +477,8 @@ static int mmc_sd_cmdq_switch(struct mmc
+ {
+ 	int err;
+ 	u8 reg = 0;
++	u8 *reg_buf = card->ext_reg_buf;
++	ktime_t timeout;
+ 	/*
+ 	 * SD offers two command queueing modes - sequential (in-order) and
+ 	 * voluntary (out-of-order). Apps Class A2 performance is only
+@@ -488,6 +491,25 @@ static int mmc_sd_cmdq_switch(struct mmc
+ 	/* Performance enhancement register byte 262 controls command queueing */
+ 	err = mmc_sd_write_ext_reg(card, card->ext_perf.fno, card->ext_perf.page,
+ 				   card->ext_perf.offset + 262, reg);
++	if (err)
++		goto out;
++
++	/* Poll the register - cards may have a lazy init/deinit sequence. */
++	timeout = ktime_add_ms(ktime_get(), 10);
++	while (1) {
++		err = mmc_sd_read_ext_reg(card, card->ext_perf.fno, card->ext_perf.page,
++					  card->ext_perf.offset + 262, 1, reg_buf);
++		if (err)
++			break;
++		if ((reg_buf[0] & BIT(0)) == reg)
++			break;
++		if (ktime_after(ktime_get(), timeout)) {
++			err = -EBADMSG;
++			break;
++		}
++		usleep_range(100, 200);
++	}
++out:
+ 	if (!err)
+ 		card->ext_csd.cmdq_en = enable;
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0436-drivers-mmc-add-debugfs-entries-for-SD-extension-reg.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0436-drivers-mmc-add-debugfs-entries-for-SD-extension-reg.patch
new file mode 100644
index 00000000..bdca457d
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0436-drivers-mmc-add-debugfs-entries-for-SD-extension-reg.patch
@@ -0,0 +1,59 @@
+From 4683c4f300038315db1523772fa82c02236ad5c2 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Tue, 26 Mar 2024 13:39:47 +0000
+Subject: [PATCH 436/697] drivers: mmc: add debugfs entries for SD extension
+ registers
+
+Also report the card's supported queue depth in the message log.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/core/mmc.c | 4 ++--
+ drivers/mmc/core/sd.c  | 9 ++++++---
+ 2 files changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -1915,8 +1915,8 @@ static int mmc_init_card(struct mmc_host
+ 			host->cqe_enabled = true;
+ 
+ 			if (card->ext_csd.cmdq_en) {
+-				pr_info("%s: Command Queue Engine enabled\n",
+-					mmc_hostname(host));
++				pr_info("%s: Command Queue Engine enabled, %u tags\n",
++					mmc_hostname(host), card->ext_csd.cmdq_depth);
+ 			} else {
+ 				host->hsq_enabled = true;
+ 				pr_info("%s: Host Software Queue enabled\n",
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -710,7 +710,8 @@ MMC_DEV_ATTR(oemid, "0x%04x\n", card->ci
+ MMC_DEV_ATTR(serial, "0x%08x\n", card->cid.serial);
+ MMC_DEV_ATTR(ocr, "0x%08x\n", card->ocr);
+ MMC_DEV_ATTR(rca, "0x%04x\n", card->rca);
+-
++MMC_DEV_ATTR(ext_perf, "%02x\n", card->ext_perf.feature_support);
++MMC_DEV_ATTR(ext_power, "%02x\n", card->ext_power.feature_support);
+ 
+ static ssize_t mmc_dsr_show(struct device *dev, struct device_attribute *attr,
+ 			    char *buf)
+@@ -772,6 +773,8 @@ static struct attribute *sd_std_attrs[]
+ 	&dev_attr_ocr.attr,
+ 	&dev_attr_rca.attr,
+ 	&dev_attr_dsr.attr,
++	&dev_attr_ext_perf.attr,
++	&dev_attr_ext_power.attr,
+ 	NULL,
+ };
+ 
+@@ -1507,8 +1510,8 @@ cont:
+ 			host->cqe_enabled = true;
+ 
+ 			if (card->ext_csd.cmdq_en) {
+-				pr_info("%s: Command Queue Engine enabled\n",
+-					mmc_hostname(host));
++				pr_info("%s: Command Queue Engine enabled, %u tags\n",
++					mmc_hostname(host), card->ext_csd.cmdq_depth);
+ 			} else {
+ 				host->hsq_enabled = true;
+ 				pr_info("%s: Host Software Queue enabled\n",
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0437-drivers-mmc-handle-1024-byte-SD-General-Info-lengths.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0437-drivers-mmc-handle-1024-byte-SD-General-Info-lengths.patch
new file mode 100644
index 00000000..e1a67c2f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0437-drivers-mmc-handle-1024-byte-SD-General-Info-lengths.patch
@@ -0,0 +1,53 @@
+From a376fc5b08c8aa3028159a3637498ce96e2393ee Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Tue, 26 Mar 2024 14:58:58 +0000
+Subject: [PATCH 437/697] drivers: mmc: handle 1024-byte SD General Info
+ lengths
+
+The spec allows for up to two 512-byte pages to be allocated for the
+Extension Register General Info block, so allocate accordingly.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/core/sd.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -1172,7 +1172,7 @@ static int mmc_sd_read_ext_regs(struct m
+ 	if (!(card->scr.cmds & SD_SCR_CMD48_SUPPORT))
+ 		return 0;
+ 
+-	gen_info_buf = kzalloc(512, GFP_KERNEL);
++	gen_info_buf = kzalloc(1024, GFP_KERNEL);
+ 	if (!gen_info_buf)
+ 		return -ENOMEM;
+ 
+@@ -1203,14 +1203,23 @@ static int mmc_sd_read_ext_regs(struct m
+ 	num_ext = gen_info_buf[4];
+ 
+ 	/*
+-	 * We only support revision 0 and limit it to 512 bytes for simplicity.
++	 * We only support revision 0 and up to the spec-defined maximum of 1K.
+ 	 * No matter what, let's return zero to allow us to continue using the
+ 	 * card, even if we can't support the features from the SD function
+ 	 * extensions registers.
+ 	 */
+-	if (rev != 0 || len > 512) {
+-		pr_warn("%s: non-supported SD ext reg layout\n",
+-			mmc_hostname(card->host));
++	if (rev != 0 || len > 1024) {
++		pr_warn("%s: non-supported SD ext reg layout rev %u length %u\n",
++			mmc_hostname(card->host), rev, len);
++		goto out;
++	}
++
++	/* If the General Information block spills into the next page, read the rest */
++	if (len > 512)
++		err = mmc_sd_read_ext_reg(card, 0, 1, 0, 512, &gen_info_buf[512]);
++	if (err) {
++		pr_err("%s: error %d reading page 1 of general info of SD ext reg\n",
++			mmc_hostname(card->host), err);
+ 		goto out;
+ 	}
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0438-mmc-sdhci-brcmstb-add-hs400_downgrade-callback-for-b.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0438-mmc-sdhci-brcmstb-add-hs400_downgrade-callback-for-b.patch
new file mode 100644
index 00000000..3c64eb11
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0438-mmc-sdhci-brcmstb-add-hs400_downgrade-callback-for-b.patch
@@ -0,0 +1,49 @@
+From ea064c6c82052fb3aa563b79880501eab08a095c Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Tue, 4 Jun 2024 09:51:17 +0100
+Subject: [PATCH 438/697] mmc: sdhci-brcmstb: add hs400_downgrade callback for
+ bcm2712
+
+The attached PHY performs parameter validation, so the switch from HS200
+to HS (before selecting HS400/HS400es) with a 200MHz clock fails to
+update pad timings and results in CRC errors from the card.
+
+Underclocking the interface is safe, so do that in the downgrade callback.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/host/sdhci-brcmstb.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/drivers/mmc/host/sdhci-brcmstb.c
++++ b/drivers/mmc/host/sdhci-brcmstb.c
+@@ -243,6 +243,20 @@ static void sdhci_brcmstb_set_uhs_signal
+ 	sdhci_writew(host, ctrl_2, SDHCI_HOST_CONTROL2);
+ }
+ 
++static void sdhci_bcm2712_hs400_downgrade(struct mmc_host *mmc)
++{
++	struct sdhci_host *host = mmc_priv(mmc);
++	/*
++	 * The eMMC PHY and its internal controller parses and validates
++	 * the uhs_mode, divisor, pin_sel, and sampling clock select
++	 * output from the SD controller. It will refuse to update its
++	 * config if HS timings are selected while the clock is >52MHz.
++	 * so bump the clock down now before card/controller setup is
++	 * performed.
++	 */
++	sdhci_bcm2712_set_clock(host, 52000000);
++}
++
+ static void sdhci_brcmstb_cfginit_2712(struct sdhci_host *host)
+ {
+ 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+@@ -262,6 +276,8 @@ static void sdhci_brcmstb_cfginit_2712(s
+ 		reg &= ~SDIO_CFG_MAX_50MHZ_MODE_ENABLE;
+ 		reg |= SDIO_CFG_MAX_50MHZ_MODE_STRAP_OVERRIDE;
+ 		writel(reg, brcmstb_priv->cfg_regs + SDIO_CFG_MAX_50MHZ_MODE);
++
++		host->mmc_host_ops.hs400_downgrade = sdhci_bcm2712_hs400_downgrade;
+ 	}
+ 
+ 	if ((host->mmc->caps & MMC_CAP_NONREMOVABLE) ||
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0439-mmc-sdhci-extend-maximum-ADMA-transfer-length-to-4Mi.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0439-mmc-sdhci-extend-maximum-ADMA-transfer-length-to-4Mi.patch
new file mode 100644
index 00000000..21759d3d
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0439-mmc-sdhci-extend-maximum-ADMA-transfer-length-to-4Mi.patch
@@ -0,0 +1,47 @@
+From 57159b8fb492764217e57390b6c37aa6af15e75a Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Tue, 4 Jun 2024 13:45:37 +0100
+Subject: [PATCH 439/697] mmc: sdhci: extend maximum ADMA transfer length to
+ 4MiB
+
+This gains about 8-12% sequential write speed with the fastest SD/eMMC
+cards, and Class A1/A2 card sequential performance is only assured with
+a 4MiB write length.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/host/sdhci.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -1081,7 +1081,7 @@ static void sdhci_initialize_data(struct
+ 	WARN_ON(host->data);
+ 
+ 	/* Sanity checks */
+-	BUG_ON(data->blksz * data->blocks > 524288);
++	BUG_ON(data->blksz * data->blocks > host->mmc->max_req_size);
+ 	BUG_ON(data->blksz > host->mmc->max_blk_size);
+ 	BUG_ON(data->blocks > 65535);
+ 
+@@ -4709,11 +4709,16 @@ int sdhci_setup_host(struct sdhci_host *
+ 	spin_lock_init(&host->lock);
+ 
+ 	/*
+-	 * Maximum number of sectors in one transfer. Limited by SDMA boundary
+-	 * size (512KiB). Note some tuning modes impose a 4MiB limit, but this
+-	 * is less anyway.
++	 * Maximum number of sectors in one transfer.
++	 * 4MiB is preferred for multi-descriptor DMA as a) card sequential
++	 * write speeds are only guaranteed with a 4MiB write length and
++	 * b) most tuning modes require a 4MiB limit.
++	 * SDMA has a 512KiB boundary size.
+ 	 */
+-	mmc->max_req_size = 524288;
++	if (host->flags & SDHCI_USE_ADMA)
++		mmc->max_req_size = SZ_4M;
++	else
++		mmc->max_req_size = SZ_512K;
+ 
+ 	/*
+ 	 * Maximum number of segments. Depends on if the hardware
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0440-drivers-mmc-sdhci-brcmstb-improve-bcm2712-card-remov.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0440-drivers-mmc-sdhci-brcmstb-improve-bcm2712-card-remov.patch
new file mode 100644
index 00000000..4c4e9f8c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0440-drivers-mmc-sdhci-brcmstb-improve-bcm2712-card-remov.patch
@@ -0,0 +1,52 @@
+From c07fb6b4fa158ba5f6b4b95265877d9af5dcca59 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Thu, 13 Jun 2024 15:01:02 +0100
+Subject: [PATCH 440/697] drivers: mmc: sdhci-brcmstb: improve bcm2712 card
+ removal handling
+
+If the controller is being reset, then the CQE needs to be reset as well.
+
+For removable cards, CQHCI_SSC1 must specify a polling mode (CBC=0)
+otherwise it's possible that the controller stops emitting periodic
+CMD13s on card removal, without raising an error status interrupt.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/host/sdhci-brcmstb.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+--- a/drivers/mmc/host/sdhci-brcmstb.c
++++ b/drivers/mmc/host/sdhci-brcmstb.c
+@@ -412,8 +412,21 @@ static void sdhci_brcmstb_cqe_enable(str
+ 
+ 	sdhci_cqe_enable(mmc);
+ 
+-	/* Reset CMD13 polling timer back to eMMC specification default */
+-	cqhci_writel(cq_host, 0x00011000, CQHCI_SSC1);
++	/*
++	 * The controller resets this register to a very short default interval
++	 * whenever CQHCI is disabled.
++	 *
++	 * For removable cards CBC needs to be clear or card removal can hang
++	 * the CQE. In polling mode, a CIT of 0x4000 "cycles" seems to produce the best
++	 * throughput.
++	 *
++	 * For nonremovable cards, the specification default of CBC=1 CIT=0x1000
++	 * suffices.
++	 */
++	if (mmc->caps & MMC_CAP_NONREMOVABLE)
++		cqhci_writel(cq_host, 0x00011000, CQHCI_SSC1);
++	else
++		cqhci_writel(cq_host, 0x00004000, CQHCI_SSC1);
+ }
+ 
+ static const struct cqhci_host_ops sdhci_brcmstb_cqhci_ops = {
+@@ -433,7 +446,7 @@ static struct sdhci_ops sdhci_brcmstb_op
+ 	.set_clock = sdhci_bcm2712_set_clock,
+ 	.set_power = sdhci_brcmstb_set_power,
+ 	.set_bus_width = sdhci_set_bus_width,
+-	.reset = sdhci_reset,
++	.reset = brcmstb_reset,
+ 	.set_uhs_signaling = sdhci_set_uhs_signaling,
+ 	.init_sd_express = bcm2712_init_sd_express,
+ };
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0441-drivers-mmc-core-handle-card-removal-when-running-CQ.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0441-drivers-mmc-core-handle-card-removal-when-running-CQ.patch
new file mode 100644
index 00000000..5b77fb0c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0441-drivers-mmc-core-handle-card-removal-when-running-CQ.patch
@@ -0,0 +1,43 @@
+From db0e26071c3121b66e4d11fc9d06297b525a170e Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Thu, 13 Jun 2024 15:05:40 +0100
+Subject: [PATCH 441/697] drivers: mmc: core: handle card-removal when running
+ CQE recovery
+
+Recovery claims the MMC card so the card-detect work gets significantly
+delayed - leading to lots of error recovery loops that can never do
+anything but fail.
+
+Explicitly detect the card after CQE has halted and bail if it's not
+there.
+
+Also ratelimit a not-very-descriptive warning - one occurrence in dmesg
+is enough to signal that something is amiss.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/core/core.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -543,10 +543,18 @@ int mmc_cqe_recovery(struct mmc_host *ho
+ 	 * Recovery is expected seldom, if at all, but it reduces performance,
+ 	 * so make sure it is not completely silent.
+ 	 */
+-	pr_warn("%s: running CQE recovery\n", mmc_hostname(host));
++	pr_warn_ratelimited("%s: running CQE recovery\n", mmc_hostname(host));
+ 
+ 	host->cqe_ops->cqe_recovery_start(host);
+ 
++	err = mmc_detect_card_removed(host);
++	if (err) {
++		host->cqe_ops->cqe_recovery_finish(host);
++		host->cqe_ops->cqe_off(host);
++		mmc_retune_release(host);
++		return err;
++	}
++
+ 	memset(&cmd, 0, sizeof(cmd));
+ 	cmd.opcode       = MMC_STOP_TRANSMISSION;
+ 	cmd.flags        = MMC_RSP_R1B | MMC_CMD_AC;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0442-mmc-restrict-posted-write-counts-for-SD-cards-in-CQ-.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0442-mmc-restrict-posted-write-counts-for-SD-cards-in-CQ-.patch
new file mode 100644
index 00000000..34b92c4b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0442-mmc-restrict-posted-write-counts-for-SD-cards-in-CQ-.patch
@@ -0,0 +1,183 @@
+From 32301f94625742211b8f4408229e3447ca2ee534 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Thu, 20 Jun 2024 14:31:20 +0100
+Subject: [PATCH 442/697] mmc: restrict posted write counts for SD cards in CQ
+ mode
+
+Command Queueing requires Write Cache and Power off Notification support
+from the card - but using the write cache forms a contract with the host
+whereby the card expects to be told about impending power-down.
+
+The implication is that (for performance) the card can do unsafe things
+with pending write data - including reordering what gets committed to
+nonvolatile storage at what time.
+
+Exposed SD slots and platforms powered by hotpluggable means (i.e.
+Raspberry Pis) can't guarantee that surprise removal won't happen.
+
+To limit the scope for cards to invent new ways to trash filesystems,
+limit pending writes to 1 (equivalent to the non-CQ behaviour).
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+
+fixup: mmc: restrict posted write counts for SD cards in CQ mode
+
+Leaving card->max_posted_writes unintialised was a bad thing to do.
+
+Also, cqe_enable is 1 if hsq is enabled as hsq substitutes the cqhci
+implementation with its own.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/core/block.c | 11 +++++++++--
+ drivers/mmc/core/mmc.c   |  2 ++
+ drivers/mmc/core/queue.c |  9 +++++++++
+ drivers/mmc/core/queue.h |  1 +
+ drivers/mmc/core/sd.c    | 10 ++++++++++
+ include/linux/mmc/card.h |  2 ++
+ 6 files changed, 33 insertions(+), 2 deletions(-)
+
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -1617,6 +1617,8 @@ static void mmc_blk_cqe_complete_rq(stru
+ 
+ 	spin_lock_irqsave(&mq->lock, flags);
+ 
++	if (req_op(req) == REQ_OP_WRITE)
++		mq->pending_writes--;
+ 	mq->in_flight[issue_type] -= 1;
+ 
+ 	put_card = (mmc_tot_in_flight(mq) == 0);
+@@ -2133,6 +2135,8 @@ static void mmc_blk_mq_complete_rq(struc
+ 	struct mmc_queue_req *mqrq = req_to_mmc_queue_req(req);
+ 	unsigned int nr_bytes = mqrq->brq.data.bytes_xfered;
+ 
++	if (req_op(req) == REQ_OP_WRITE)
++		mq->pending_writes--;
+ 	if (nr_bytes) {
+ 		if (blk_update_request(req, BLK_STS_OK, nr_bytes))
+ 			blk_mq_requeue_request(req, true);
+@@ -2227,13 +2231,16 @@ static void mmc_blk_mq_poll_completion(s
+ 	mmc_blk_urgent_bkops(mq, mqrq);
+ }
+ 
+-static void mmc_blk_mq_dec_in_flight(struct mmc_queue *mq, enum mmc_issue_type issue_type)
++static void mmc_blk_mq_dec_in_flight(struct mmc_queue *mq, enum mmc_issue_type issue_type,
++				     struct request *req)
+ {
+ 	unsigned long flags;
+ 	bool put_card;
+ 
+ 	spin_lock_irqsave(&mq->lock, flags);
+ 
++	if (req_op(req) == REQ_OP_WRITE)
++		mq->pending_writes--;
+ 	mq->in_flight[issue_type] -= 1;
+ 
+ 	put_card = (mmc_tot_in_flight(mq) == 0);
+@@ -2267,7 +2274,7 @@ static void mmc_blk_mq_post_req(struct m
+ 			blk_mq_complete_request(req);
+ 	}
+ 
+-	mmc_blk_mq_dec_in_flight(mq, issue_type);
++	mmc_blk_mq_dec_in_flight(mq, issue_type, req);
+ }
+ 
+ void mmc_blk_mq_recovery(struct mmc_queue *mq)
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -1657,6 +1657,7 @@ static int mmc_init_card(struct mmc_host
+ 		card->ocr = ocr;
+ 		card->type = MMC_TYPE_MMC;
+ 		card->rca = 1;
++		card->max_posted_writes = 1;
+ 		memcpy(card->raw_cid, cid, sizeof(card->raw_cid));
+ 	}
+ 
+@@ -1922,6 +1923,7 @@ static int mmc_init_card(struct mmc_host
+ 				pr_info("%s: Host Software Queue enabled\n",
+ 					mmc_hostname(host));
+ 			}
++			card->max_posted_writes = card->ext_csd.cmdq_depth;
+ 		}
+ 	}
+ 
+--- a/drivers/mmc/core/queue.c
++++ b/drivers/mmc/core/queue.c
+@@ -266,6 +266,11 @@ static blk_status_t mmc_mq_queue_rq(stru
+ 			spin_unlock_irq(&mq->lock);
+ 			return BLK_STS_RESOURCE;
+ 		}
++		if (!host->hsq_enabled && host->cqe_enabled && req_op(req) == REQ_OP_WRITE &&
++		    mq->pending_writes >= card->max_posted_writes) {
++			spin_unlock_irq(&mq->lock);
++			return BLK_STS_RESOURCE;
++		}
+ 		break;
+ 	default:
+ 		/*
+@@ -282,6 +287,8 @@ static blk_status_t mmc_mq_queue_rq(stru
+ 	/* Parallel dispatch of requests is not supported at the moment */
+ 	mq->busy = true;
+ 
++	if (req_op(req) == REQ_OP_WRITE)
++		mq->pending_writes++;
+ 	mq->in_flight[issue_type] += 1;
+ 	get_card = (mmc_tot_in_flight(mq) == 1);
+ 	cqe_retune_ok = (mmc_cqe_qcnt(mq) == 1);
+@@ -321,6 +328,8 @@ static blk_status_t mmc_mq_queue_rq(stru
+ 		bool put_card = false;
+ 
+ 		spin_lock_irq(&mq->lock);
++		if (req_op(req) == REQ_OP_WRITE)
++			mq->pending_writes--;
+ 		mq->in_flight[issue_type] -= 1;
+ 		if (mmc_tot_in_flight(mq) == 0)
+ 			put_card = true;
+--- a/drivers/mmc/core/queue.h
++++ b/drivers/mmc/core/queue.h
+@@ -79,6 +79,7 @@ struct mmc_queue {
+ 	struct request_queue	*queue;
+ 	spinlock_t		lock;
+ 	int			in_flight[MMC_ISSUE_MAX];
++	int			pending_writes;
+ 	unsigned int		cqe_busy;
+ #define MMC_CQE_DCMD_BUSY	BIT(0)
+ 	bool			busy;
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -1099,6 +1099,15 @@ static int sd_parse_ext_reg_perf(struct
+ 		pr_debug("%s: Command Queue supported depth %u\n",
+ 			 mmc_hostname(card->host),
+ 			 card->ext_csd.cmdq_depth);
++		/*
++		 * If CQ is enabled, there is a contract between host and card such that
++		 * VDD will be maintained and removed only if a power off notification
++		 * is provided. An SD card in an accessible slot means surprise removal
++		 * is a possibility. As a middle ground, keep the default maximum of 1
++		 * posted write unless the card is "hardwired".
++		 */
++		if (!mmc_card_is_removable(card->host))
++			card->max_posted_writes = card->ext_csd.cmdq_depth;
+ 	}
+ 
+ 	card->ext_perf.fno = fno;
+@@ -1362,6 +1371,7 @@ retry:
+ 
+ 		card->ocr = ocr;
+ 		card->type = MMC_TYPE_SD;
++		card->max_posted_writes = 1;
+ 		memcpy(card->raw_cid, cid, sizeof(card->raw_cid));
+ 	}
+ 
+--- a/include/linux/mmc/card.h
++++ b/include/linux/mmc/card.h
+@@ -343,6 +343,8 @@ struct mmc_card {
+ 	unsigned int    nr_parts;
+ 
+ 	struct workqueue_struct *complete_wq;	/* Private workqueue */
++
++	unsigned int		max_posted_writes; /* command queue posted write limit */
+ };
+ 
+ static inline bool mmc_large_sector(struct mmc_card *card)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0443-mmc-don-t-reference-requests-after-finishing-them.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0443-mmc-don-t-reference-requests-after-finishing-them.patch
new file mode 100644
index 00000000..9305cd25
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0443-mmc-don-t-reference-requests-after-finishing-them.patch
@@ -0,0 +1,71 @@
+From fdc7536cf03103a01cb67cb91e051fdb7ef29631 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Tue, 15 Oct 2024 11:22:53 +0100
+Subject: [PATCH 443/697] mmc: don't reference requests after finishing them
+
+Posted write tracking introduced in the commit below raced with re-use
+of the requests between completion and submission, potentially causing
+underflow of the pending write count.
+
+Fixes: e6c1e862b2b8 ("mmc: restrict posted write counts for SD cards in CQ mode")
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/core/block.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -1586,6 +1586,7 @@ static void mmc_blk_cqe_complete_rq(stru
+ 	struct request_queue *q = req->q;
+ 	struct mmc_host *host = mq->card->host;
+ 	enum mmc_issue_type issue_type = mmc_issue_type(mq, req);
++	bool write = req_op(req) == REQ_OP_WRITE;
+ 	unsigned long flags;
+ 	bool put_card;
+ 	int err;
+@@ -1617,7 +1618,7 @@ static void mmc_blk_cqe_complete_rq(stru
+ 
+ 	spin_lock_irqsave(&mq->lock, flags);
+ 
+-	if (req_op(req) == REQ_OP_WRITE)
++	if (write)
+ 		mq->pending_writes--;
+ 	mq->in_flight[issue_type] -= 1;
+ 
+@@ -2232,15 +2233,16 @@ static void mmc_blk_mq_poll_completion(s
+ }
+ 
+ static void mmc_blk_mq_dec_in_flight(struct mmc_queue *mq, enum mmc_issue_type issue_type,
+-				     struct request *req)
++				     bool write)
+ {
+ 	unsigned long flags;
+ 	bool put_card;
+ 
+ 	spin_lock_irqsave(&mq->lock, flags);
+ 
+-	if (req_op(req) == REQ_OP_WRITE)
++	if (write)
+ 		mq->pending_writes--;
++
+ 	mq->in_flight[issue_type] -= 1;
+ 
+ 	put_card = (mmc_tot_in_flight(mq) == 0);
+@@ -2255,6 +2257,7 @@ static void mmc_blk_mq_post_req(struct m
+ 				bool can_sleep)
+ {
+ 	enum mmc_issue_type issue_type = mmc_issue_type(mq, req);
++	bool write = req_op(req) == REQ_OP_WRITE;
+ 	struct mmc_queue_req *mqrq = req_to_mmc_queue_req(req);
+ 	struct mmc_request *mrq = &mqrq->brq.mrq;
+ 	struct mmc_host *host = mq->card->host;
+@@ -2274,7 +2277,7 @@ static void mmc_blk_mq_post_req(struct m
+ 			blk_mq_complete_request(req);
+ 	}
+ 
+-	mmc_blk_mq_dec_in_flight(mq, issue_type, req);
++	mmc_blk_mq_dec_in_flight(mq, issue_type, write);
+ }
+ 
+ void mmc_blk_mq_recovery(struct mmc_queue *mq)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0444-drivers-mmc-disable-write-caching-on-Samsung-2023-mo.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0444-drivers-mmc-disable-write-caching-on-Samsung-2023-mo.patch
new file mode 100644
index 00000000..72527d5c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0444-drivers-mmc-disable-write-caching-on-Samsung-2023-mo.patch
@@ -0,0 +1,47 @@
+From 63e6aa0795706ad65c05bcb4762460e3ea911a9d Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Mon, 8 Apr 2024 16:09:52 +0100
+Subject: [PATCH 444/697] drivers: mmc: disable write-caching on Samsung 2023
+ model year SD cards
+
+Samsung EVO Plus, Pro Plus and Evo Ultimate cards of this era appear to
+have a broken cache-flush implementation when operating in CQ mode.
+
+Unfortunately the cards seem to use a separate CID name string for every
+variant and capacity, so nobble the cache feature for this MANFID, OEMID
+and year. Turning this off seems to have negligible impact on
+random-write throughput in non-CQ mode.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/core/card.h   | 1 +
+ drivers/mmc/core/quirks.h | 8 ++++++++
+ 2 files changed, 9 insertions(+)
+
+--- a/drivers/mmc/core/card.h
++++ b/drivers/mmc/core/card.h
+@@ -88,6 +88,7 @@ struct mmc_fixup {
+ #define CID_MANFID_GIGASTONE    0x12
+ #define CID_MANFID_MICRON       0x13
+ #define CID_MANFID_SAMSUNG      0x15
++#define CID_MANFID_SAMSUNG_SD	0x1b
+ #define CID_MANFID_APACER       0x27
+ #define CID_MANFID_KINGSTON     0x70
+ #define CID_MANFID_HYNIX	0x90
+--- a/drivers/mmc/core/quirks.h
++++ b/drivers/mmc/core/quirks.h
+@@ -34,6 +34,14 @@ static const struct mmc_fixup __maybe_un
+ 		   MMC_QUIRK_BROKEN_SD_CACHE | MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY,
+ 		   EXT_CSD_REV_ANY),
+ 
++	/*
++	 * Samsung Pro Plus/EVO Plus/Pro Ultimate SD cards (2023) claim to cache
++	 * flush OK, but become unresponsive afterwards.
++	 */
++	_FIXUP_EXT(CID_NAME_ANY, CID_MANFID_SAMSUNG_SD, 0x534d, 2023, CID_MONTH_ANY,
++		   0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
++		   MMC_QUIRK_BROKEN_SD_CACHE, EXT_CSD_REV_ANY),
++
+ 	END_FIXUP
+ };
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0445-mmc-quirks-disable-cache-on-more-known-bad-Sandisk-c.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0445-mmc-quirks-disable-cache-on-more-known-bad-Sandisk-c.patch
new file mode 100644
index 00000000..a71bbef2
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0445-mmc-quirks-disable-cache-on-more-known-bad-Sandisk-c.patch
@@ -0,0 +1,35 @@
+From b017fe984df5c2b92761e934d8d283db09e9006b Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Tue, 15 Oct 2024 14:35:42 +0100
+Subject: [PATCH 445/697] mmc: quirks: disable cache on more known-bad Sandisk
+ card date ranges
+
+Cards with manufacture dates in 2019 and 2020 have been seen in the wild
+that hang indefinitely if issued a cache flush command in CQ mode.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/core/quirks.h | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/mmc/core/quirks.h
++++ b/drivers/mmc/core/quirks.h
+@@ -42,6 +42,18 @@ static const struct mmc_fixup __maybe_un
+ 		   0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
+ 		   MMC_QUIRK_BROKEN_SD_CACHE, EXT_CSD_REV_ANY),
+ 
++	/*
++	 * Early Sandisk Extreme and Extreme Pro A2 cards never finish SD cache
++	 * flush in CQ mode. Latest card date this was seen on is 10/2020.
++	 */
++	_FIXUP_EXT(CID_NAME_ANY, CID_MANFID_SANDISK_SD, 0x5344, 2019, CID_MONTH_ANY,
++		   0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
++		   MMC_QUIRK_BROKEN_SD_CACHE, EXT_CSD_REV_ANY),
++
++	_FIXUP_EXT(CID_NAME_ANY, CID_MANFID_SANDISK_SD, 0x5344, 2020, CID_MONTH_ANY,
++		   0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
++		   MMC_QUIRK_BROKEN_SD_CACHE, EXT_CSD_REV_ANY),
++
+ 	END_FIXUP
+ };
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0446-mmc-block-disable-CQ-on-SD-cards-when-doing-non-Disc.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0446-mmc-block-disable-CQ-on-SD-cards-when-doing-non-Disc.patch
new file mode 100644
index 00000000..567c21de
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0446-mmc-block-disable-CQ-on-SD-cards-when-doing-non-Disc.patch
@@ -0,0 +1,55 @@
+From a9fe88271eb7576b1c176e1f1086d80413c88af5 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Fri, 18 Oct 2024 13:11:11 +0100
+Subject: [PATCH 446/697] mmc: block: disable CQ on SD cards when doing
+ non-Discard erase
+
+Only CMD38 with Arg=0x1 (Discard) is supported when in CQ mode, so
+turn it off before issuing a non-discard erase op.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/core/block.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -1239,12 +1239,26 @@ static void mmc_blk_issue_erase_rq(struc
+ 	unsigned int from, nr;
+ 	int err = 0;
+ 	blk_status_t status = BLK_STS_OK;
++	bool restart_cmdq = false;
+ 
+ 	if (!mmc_can_erase(card)) {
+ 		status = BLK_STS_NOTSUPP;
+ 		goto fail;
+ 	}
+ 
++	/*
++	 * Only Discard ops are supported with SD cards in CQ mode
++	 * (SD Physical Spec v9.00 4.19.2)
++	 */
++	if (mmc_card_sd(card) && card->ext_csd.cmdq_en && erase_arg != SD_DISCARD_ARG) {
++		restart_cmdq = true;
++		err = mmc_sd_cmdq_disable(card);
++		if (err) {
++			status = BLK_STS_IOERR;
++			goto fail;
++		}
++	}
++
+ 	from = blk_rq_pos(req);
+ 	nr = blk_rq_sectors(req);
+ 
+@@ -1265,6 +1279,11 @@ static void mmc_blk_issue_erase_rq(struc
+ 		status = BLK_STS_IOERR;
+ 	else
+ 		mmc_blk_reset_success(md, type);
++
++	if (restart_cmdq)
++		err = mmc_sd_cmdq_enable(card);
++	if (err)
++		status = BLK_STS_IOERR;
+ fail:
+ 	blk_mq_end_request(req, status);
+ }
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0447-mmc-quirks-add-MMC_QUIRK_BROKEN_ERASE-for-Phison-Int.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0447-mmc-quirks-add-MMC_QUIRK_BROKEN_ERASE-for-Phison-Int.patch
new file mode 100644
index 00000000..bfd3ea34
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0447-mmc-quirks-add-MMC_QUIRK_BROKEN_ERASE-for-Phison-Int.patch
@@ -0,0 +1,33 @@
+From fce383af88e15b0178ae559af807bfd6fe2a9eec Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Fri, 18 Oct 2024 16:01:28 +0100
+Subject: [PATCH 447/697] mmc: quirks: add MMC_QUIRK_BROKEN_ERASE for
+ Phison/Integral cards
+
+Recent Integral cards end up with corrupt sectors after a flash erase.
+This covers sizes for the A2 range, which can't be differentiated from
+the A1 range which might not have the same issue.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/core/quirks.h | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/mmc/core/quirks.h
++++ b/drivers/mmc/core/quirks.h
+@@ -171,6 +171,15 @@ static const struct mmc_fixup __maybe_un
+ 	MMC_FIXUP("SD32G", 0x41, 0x3432, add_quirk, MMC_QUIRK_ERASE_BROKEN),
+ 	MMC_FIXUP("SD64G", 0x41, 0x3432, add_quirk, MMC_QUIRK_ERASE_BROKEN),
+ 
++	/*
++	 * Larger Integral SD cards using rebranded Phison controllers trash
++	 * nearby flash blocks after erases.
++	 */
++	MMC_FIXUP("SD64G", 0x27, 0x5048, add_quirk, MMC_QUIRK_ERASE_BROKEN),
++	MMC_FIXUP("SD128", 0x27, 0x5048, add_quirk, MMC_QUIRK_ERASE_BROKEN),
++	MMC_FIXUP("SD256", 0x27, 0x5048, add_quirk, MMC_QUIRK_ERASE_BROKEN),
++	MMC_FIXUP("SD512", 0x27, 0x5048, add_quirk, MMC_QUIRK_ERASE_BROKEN),
++
+ 	END_FIXUP
+ };
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0448-i2c-designware-Add-support-for-bus-clear-feature.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0448-i2c-designware-Add-support-for-bus-clear-feature.patch
new file mode 100644
index 00000000..b16d010c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0448-i2c-designware-Add-support-for-bus-clear-feature.patch
@@ -0,0 +1,157 @@
+From c16275f3435315d4ad779ccd9d519f5525678ed1 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 26 Mar 2024 15:57:46 +0000
+Subject: [PATCH 448/697] i2c: designware: Add support for bus clear feature
+
+Newer versions of the DesignWare I2C block support the detection of
+stuck signals, and a mechanism to recover from them. Add the required
+software support to the driver.
+
+This change was prompted by the observation that reading a single byte
+from register 0 of a VEML7700 seems to cause it to issue an ACK too
+early, and the controller to complain about losing arbitration. There
+is a suspicion that this may be a more widespread problem, but at least
+this patch prevents the bus from locking up.
+
+See: https://github.com/raspberrypi/linux/issues/6057
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/i2c/busses/i2c-designware-common.c | 12 ++++++++++++
+ drivers/i2c/busses/i2c-designware-core.h   |  7 +++++++
+ drivers/i2c/busses/i2c-designware-master.c | 19 ++++++++++++++++++-
+ 3 files changed, 37 insertions(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-designware-common.c
++++ b/drivers/i2c/busses/i2c-designware-common.c
+@@ -62,6 +62,8 @@ static char *abort_sources[] = {
+ 		"slave lost the bus while transmitting data to a remote master",
+ 	[ABRT_SLAVE_RD_INTX] =
+ 		"incorrect slave-transmitter mode configuration",
++	[ABRT_SLAVE_SDA_STUCK_AT_LOW] =
++		"SDA stuck at low",
+ };
+ 
+ static int dw_reg_read(void *context, unsigned int reg, unsigned int *val)
+@@ -691,8 +693,16 @@ int i2c_dw_wait_bus_not_busy(struct dw_i
+ int i2c_dw_handle_tx_abort(struct dw_i2c_dev *dev)
+ {
+ 	unsigned long abort_source = dev->abort_source;
++	unsigned int reg;
+ 	int i;
+ 
++	if (abort_source & DW_IC_TX_ABRT_SLAVE_SDA_STUCK_AT_LOW) {
++		regmap_write(dev->map, DW_IC_ENABLE,
++			     DW_IC_ENABLE_ENABLE | DW_IC_ENABLE_BUS_RECOVERY);
++		regmap_read_poll_timeout(dev->map, DW_IC_ENABLE, reg,
++					 !(reg & DW_IC_ENABLE_BUS_RECOVERY),
++					 1100, 200000);
++	}
+ 	if (abort_source & DW_IC_TX_ABRT_NOACK) {
+ 		for_each_set_bit(i, &abort_source, ARRAY_SIZE(abort_sources))
+ 			dev_dbg(dev->dev,
+@@ -707,6 +717,8 @@ int i2c_dw_handle_tx_abort(struct dw_i2c
+ 		return -EAGAIN;
+ 	else if (abort_source & DW_IC_TX_ABRT_GCALL_READ)
+ 		return -EINVAL; /* wrong msgs[] data */
++	else if (abort_source & DW_IC_TX_ABRT_SLAVE_SDA_STUCK_AT_LOW)
++		return -EREMOTEIO;
+ 	else
+ 		return -EIO;
+ }
+--- a/drivers/i2c/busses/i2c-designware-core.h
++++ b/drivers/i2c/busses/i2c-designware-core.h
+@@ -78,9 +78,12 @@
+ #define DW_IC_TX_ABRT_SOURCE			0x80
+ #define DW_IC_ENABLE_STATUS			0x9c
+ #define DW_IC_CLR_RESTART_DET			0xa8
++#define DW_IC_SCL_STUCK_AT_LOW_TIMEOUT		0xac
++#define DW_IC_SDA_STUCK_AT_LOW_TIMEOUT		0xb0
+ #define DW_IC_COMP_PARAM_1			0xf4
+ #define DW_IC_COMP_VERSION			0xf8
+ #define DW_IC_SDA_HOLD_MIN_VERS			0x3131312A /* "111*" == v1.11* */
++#define DW_IC_BUS_CLEAR_MIN_VERS		0x3230302A /* "200*" == v2.00* */
+ #define DW_IC_COMP_TYPE				0xfc
+ #define DW_IC_COMP_TYPE_VALUE			0x44570140 /* "DW" + 0x0140 */
+ 
+@@ -110,6 +113,7 @@
+ 
+ #define DW_IC_ENABLE_ENABLE			BIT(0)
+ #define DW_IC_ENABLE_ABORT			BIT(1)
++#define DW_IC_ENABLE_BUS_RECOVERY		BIT(3)
+ 
+ #define DW_IC_STATUS_ACTIVITY			BIT(0)
+ #define DW_IC_STATUS_TFE			BIT(2)
+@@ -117,6 +121,7 @@
+ #define DW_IC_STATUS_MASTER_ACTIVITY		BIT(5)
+ #define DW_IC_STATUS_SLAVE_ACTIVITY		BIT(6)
+ #define DW_IC_STATUS_MASTER_HOLD_TX_FIFO_EMPTY	BIT(7)
++#define DW_IC_STATUS_SDA_STUCK_NOT_RECOVERED	BIT(11)
+ 
+ #define DW_IC_SDA_HOLD_RX_SHIFT			16
+ #define DW_IC_SDA_HOLD_RX_MASK			GENMASK(23, 16)
+@@ -164,6 +169,7 @@
+ #define ABRT_SLAVE_FLUSH_TXFIFO			13
+ #define ABRT_SLAVE_ARBLOST			14
+ #define ABRT_SLAVE_RD_INTX			15
++#define ABRT_SLAVE_SDA_STUCK_AT_LOW		17
+ 
+ #define DW_IC_TX_ABRT_7B_ADDR_NOACK		BIT(ABRT_7B_ADDR_NOACK)
+ #define DW_IC_TX_ABRT_10ADDR1_NOACK		BIT(ABRT_10ADDR1_NOACK)
+@@ -179,6 +185,7 @@
+ #define DW_IC_RX_ABRT_SLAVE_RD_INTX		BIT(ABRT_SLAVE_RD_INTX)
+ #define DW_IC_RX_ABRT_SLAVE_ARBLOST		BIT(ABRT_SLAVE_ARBLOST)
+ #define DW_IC_RX_ABRT_SLAVE_FLUSH_TXFIFO	BIT(ABRT_SLAVE_FLUSH_TXFIFO)
++#define DW_IC_TX_ABRT_SLAVE_SDA_STUCK_AT_LOW	BIT(ABRT_SLAVE_SDA_STUCK_AT_LOW)
+ 
+ #define DW_IC_TX_ABRT_NOACK			(DW_IC_TX_ABRT_7B_ADDR_NOACK | \
+ 						 DW_IC_TX_ABRT_10ADDR1_NOACK | \
+--- a/drivers/i2c/busses/i2c-designware-master.c
++++ b/drivers/i2c/busses/i2c-designware-master.c
+@@ -230,6 +230,7 @@ static int i2c_dw_set_timings_master(str
+  */
+ static int i2c_dw_init_master(struct dw_i2c_dev *dev)
+ {
++	unsigned int timeout = 0;
+ 	int ret;
+ 
+ 	ret = i2c_dw_acquire_lock(dev);
+@@ -253,6 +254,17 @@ static int i2c_dw_init_master(struct dw_
+ 		regmap_write(dev->map, DW_IC_HS_SCL_LCNT, dev->hs_lcnt);
+ 	}
+ 
++	if (dev->master_cfg & DW_IC_CON_BUS_CLEAR_CTRL) {
++		/* Set a sensible timeout if not already configured */
++		regmap_read(dev->map, DW_IC_SDA_STUCK_AT_LOW_TIMEOUT, &timeout);
++		if (timeout == ~0) {
++			/* Use 10ms as a timeout, which is 1000 cycles at 100kHz */
++			timeout = i2c_dw_clk_rate(dev) * 10; /* clock rate is in kHz */
++			regmap_write(dev->map, DW_IC_SDA_STUCK_AT_LOW_TIMEOUT, timeout);
++			regmap_write(dev->map, DW_IC_SCL_STUCK_AT_LOW_TIMEOUT, timeout);
++		}
++	}
++
+ 	/* Write SDA hold time if supported */
+ 	if (dev->sda_hold_time)
+ 		regmap_write(dev->map, DW_IC_SDA_HOLD, dev->sda_hold_time);
+@@ -1032,6 +1044,7 @@ int i2c_dw_probe_master(struct dw_i2c_de
+ 	struct i2c_adapter *adap = &dev->adapter;
+ 	unsigned long irq_flags;
+ 	unsigned int ic_con;
++	unsigned int id_ver;
+ 	int ret;
+ 
+ 	init_completion(&dev->cmd_complete);
+@@ -1066,7 +1079,11 @@ int i2c_dw_probe_master(struct dw_i2c_de
+ 	if (ret)
+ 		return ret;
+ 
+-	if (ic_con & DW_IC_CON_BUS_CLEAR_CTRL)
++	ret = regmap_read(dev->map, DW_IC_COMP_VERSION, &id_ver);
++	if (ret)
++		return ret;
++
++	if (ic_con & DW_IC_CON_BUS_CLEAR_CTRL || id_ver >= DW_IC_BUS_CLEAR_MIN_VERS)
+ 		dev->master_cfg |= DW_IC_CON_BUS_CLEAR_CTRL;
+ 
+ 	ret = dev->init(dev);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0449-i2c-designware-Make-the-SDA-hold-time-half-LCNT.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0449-i2c-designware-Make-the-SDA-hold-time-half-LCNT.patch
new file mode 100644
index 00000000..86914ef0
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0449-i2c-designware-Make-the-SDA-hold-time-half-LCNT.patch
@@ -0,0 +1,25 @@
+From 1f00a0bff5d574c2863ca7f59f94aac1f6ec4ead Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 4 Apr 2024 17:03:33 +0100
+Subject: [PATCH 449/697] i2c: designware: Make the SDA hold time half LCNT
+
+In the absence of a value in Device Tree, set the SDA hold time to half
+the SCL low time.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/i2c/busses/i2c-designware-master.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-designware-master.c
++++ b/drivers/i2c/busses/i2c-designware-master.c
+@@ -212,6 +212,9 @@ static int i2c_dw_set_timings_master(str
+ 			dev->hs_hcnt, dev->hs_lcnt);
+ 	}
+ 
++	if (!dev->sda_hold_time)
++		dev->sda_hold_time = lcnt / 2;
++
+ 	ret = i2c_dw_set_sda_hold(dev);
+ 	if (ret)
+ 		return ret;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0450-nvmem-raspberrypi-Add-nvmem-driver-for-accessing-OTP.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0450-nvmem-raspberrypi-Add-nvmem-driver-for-accessing-OTP.patch
new file mode 100644
index 00000000..f5d9df80
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0450-nvmem-raspberrypi-Add-nvmem-driver-for-accessing-OTP.patch
@@ -0,0 +1,189 @@
+From 4d37a4bdd835e431b069b215d464aa1817effa99 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Fri, 23 Feb 2024 19:25:55 +0000
+Subject: [PATCH 450/697] nvmem: raspberrypi: Add nvmem driver for accessing
+ OTP data
+
+This supports reading and writing OTP using the firmware
+mailbox interface.
+
+It needs supporting firmware to run.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/nvmem/Kconfig           |  12 +++
+ drivers/nvmem/Makefile          |   2 +
+ drivers/nvmem/raspberrypi-otp.c | 135 ++++++++++++++++++++++++++++++++
+ 3 files changed, 149 insertions(+)
+ create mode 100644 drivers/nvmem/raspberrypi-otp.c
+
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -52,6 +52,18 @@ config NVMEM_BLOCK
+ 	  typically used with eMMC to store MAC addresses or Wi-Fi
+ 	  calibration data on embedded devices.
+ 
++config NVMEM_RASPBERRYPI_OTP
++	tristate "Raspberry Pi OTP support"
++	depends on (ARCH_BCM && RASPBERRYPI_FIRMWARE) || COMPILE_TEST
++	default ARCH_BCM && RASPBERRYPI_FIRMWARE
++	help
++	  Say y here to enable support for accessing OTP on Raspberry Pi boards.
++	  These are used to store non-volatile information such as serial number,
++	  board revision and customer stored data.
++
++	  This driver can also be built as a module. If so, the module will
++	  be called nvmem-raspberrypi-otp.
++
+ config NVMEM_BCM_OCOTP
+ 	tristate "Broadcom On-Chip OTP Controller support"
+ 	depends on ARCH_BCM_IPROC || COMPILE_TEST
+--- a/drivers/nvmem/Makefile
++++ b/drivers/nvmem/Makefile
+@@ -12,6 +12,8 @@ obj-y				+= layouts/
+ # Devices
+ obj-$(CONFIG_NVMEM_APPLE_EFUSES)	+= nvmem-apple-efuses.o
+ nvmem-apple-efuses-y 			:= apple-efuses.o
++obj-$(CONFIG_NVMEM_RASPBERRYPI_OTP)	+= nvmem-raspberrypi-otp.o
++nvmem-raspberrypi-otp-y			:= raspberrypi-otp.o
+ obj-$(CONFIG_NVMEM_BCM_OCOTP)		+= nvmem-bcm-ocotp.o
+ nvmem-bcm-ocotp-y			:= bcm-ocotp.o
+ obj-$(CONFIG_NVMEM_BLOCK)		+= nvmem-block.o
+--- /dev/null
++++ b/drivers/nvmem/raspberrypi-otp.c
+@@ -0,0 +1,135 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
++/**
++ * raspberrypi-otp.c
++ *
++ * nvmem driver using firmware mailbox to access otp
++ *
++ * Copyright (c) 2024, Raspberry Pi Ltd.
++ */
++
++#include <linux/nvmem-provider.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <soc/bcm2835/raspberrypi-firmware.h>
++
++struct rpi_otp_priv {
++	struct rpi_firmware *fw;
++	u32 block;
++};
++
++#define MAX_ROWS 192
++
++#define RPI_FIRMWARE_GET_USER_OTP 0x00030024
++#define RPI_FIRMWARE_SET_USER_OTP 0x00038024
++
++static int rpi_otp_read(void *context, unsigned int offset, void *val,
++			     size_t bytes)
++{
++	struct rpi_otp_priv *priv = context;
++	int words = bytes / sizeof(u32);
++	int index = offset / sizeof(u32);
++	u32 data[3 + MAX_ROWS] = {priv->block, index, words};
++	int err = 0;
++
++	if (words > MAX_ROWS)
++		return -EINVAL;
++
++	err = rpi_firmware_property(priv->fw, RPI_FIRMWARE_GET_USER_OTP,
++				    &data, sizeof(data));
++	if (err == 0)
++		memcpy(val, data + 3, bytes);
++	else
++		memset(val, 0xee, bytes);
++	return err;
++}
++
++static int rpi_otp_write(void *context, unsigned int offset, void *val,
++			     size_t bytes)
++{
++	struct rpi_otp_priv *priv = context;
++	int words = bytes / sizeof(u32);
++	int index = offset / sizeof(u32);
++	u32 data[3 + MAX_ROWS] = {priv->block, index, words};
++
++	if (bytes > MAX_ROWS * sizeof(u32))
++		return -EINVAL;
++
++	memcpy(data + 3, val, bytes);
++	return rpi_firmware_property(priv->fw, RPI_FIRMWARE_SET_USER_OTP,
++				    &data, sizeof(data));
++}
++
++static int rpi_otp_probe(struct platform_device *pdev)
++{
++	struct rpi_otp_priv *priv;
++	struct nvmem_config config = {
++		.dev = &pdev->dev,
++		.reg_read = rpi_otp_read,
++		.reg_write = rpi_otp_write,
++		.stride = sizeof(u32),
++		.word_size = sizeof(u32),
++		.type = NVMEM_TYPE_OTP,
++		.root_only = true,
++	};
++	struct device *dev = &pdev->dev;
++	struct device_node *np = dev->of_node;
++	struct device_node *fw_node;
++	struct rpi_firmware *fw;
++	u32 reg[2];
++	const char *pname;
++
++	if (of_property_read_u32_array(np, "reg", reg, ARRAY_SIZE(reg))) {
++		dev_err(dev, "Failed to parse \"reg\" property\n");
++		return -EINVAL;
++	}
++
++	pname = of_get_property(np, "name", NULL);
++	if (!pname) {
++		dev_err(dev, "Failed to parse \"name\" property\n");
++		return -ENOENT;
++	}
++
++	config.name = pname;
++	config.size = reg[1] * sizeof(u32);
++	config.read_only = !of_property_read_bool(np, "rw");
++
++	fw_node = of_parse_phandle(np, "firmware", 0);
++	if (!fw_node) {
++		dev_err(dev, "Missing firmware node\n");
++		return -ENOENT;
++	}
++
++	fw = rpi_firmware_get(fw_node);
++	if (!fw)
++		return -EPROBE_DEFER;
++
++	priv = devm_kzalloc(config.dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	priv->fw = fw;
++	priv->block = reg[0];
++	config.priv = priv;
++
++	return PTR_ERR_OR_ZERO(devm_nvmem_register(config.dev, &config));
++}
++
++static const struct of_device_id rpi_otp_of_match[] = {
++	{ .compatible = "raspberrypi,rpi-otp", },
++	{}
++};
++
++MODULE_DEVICE_TABLE(of, rpi_otp_of_match);
++
++static struct platform_driver rpi_otp_driver = {
++	.driver = {
++		.name = "rpi_otp",
++		.of_match_table = rpi_otp_of_match,
++	},
++	.probe = rpi_otp_probe,
++};
++
++module_platform_driver(rpi_otp_driver);
++
++MODULE_AUTHOR("Dom Cobley <popcornmix@gmail.com>");
++MODULE_LICENSE("GPL");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0451-module-Avoid-ABI-changes-when-debug-info-is-disabled.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0451-module-Avoid-ABI-changes-when-debug-info-is-disabled.patch
new file mode 100644
index 00000000..1dff8983
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0451-module-Avoid-ABI-changes-when-debug-info-is-disabled.patch
@@ -0,0 +1,25 @@
+From a957f636f2d435752dfae9c093acc33fbd8dbd83 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <benh@debian.org>
+Date: Fri, 13 May 2022 21:08:08 +0200
+Subject: [PATCH 451/697] module: Avoid ABI changes when debug info is disabled
+
+CI builds are done with debug info disabled, but this removes some
+members from struct module.  This causes builds to fail if there is an
+ABI reference for the current ABI.
+
+Define these members unconditionally, so that there is no ABI change.
+---
+ include/linux/module.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/module.h
++++ b/include/linux/module.h
+@@ -516,7 +516,7 @@ struct module {
+ 	unsigned int num_bpf_raw_events;
+ 	struct bpf_raw_event_map *bpf_raw_events;
+ #endif
+-#ifdef CONFIG_DEBUG_INFO_BTF_MODULES
++#if 1
+ 	unsigned int btf_data_size;
+ 	unsigned int btf_base_data_size;
+ 	void *btf_data;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0452-media-bcm2835-unicam-Add-option-for-a-GPIO-to-reflec.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0452-media-bcm2835-unicam-Add-option-for-a-GPIO-to-reflec.patch
new file mode 100644
index 00000000..363151a9
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0452-media-bcm2835-unicam-Add-option-for-a-GPIO-to-reflec.patch
@@ -0,0 +1,66 @@
+From be17c7218cdeca01ef54715fbffc7695c6d75ef0 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 3 Apr 2024 16:06:08 +0100
+Subject: [PATCH 452/697] media: bcm2835-unicam: Add option for a GPIO to
+ reflect FS/FE timing
+
+The legacy stack had an option to have a GPIO track frame start and
+end events to give basic synchronisation to the incoming image stream.
+https://forums.raspberrypi.com/viewtopic.php?t=190314
+
+Replicate this in the kernel Unicam driver.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -49,6 +49,7 @@
+ #include <linux/device.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/err.h>
++#include <linux/gpio/consumer.h>
+ #include <linux/init.h>
+ #include <linux/interrupt.h>
+ #include <linux/io.h>
+@@ -532,6 +533,8 @@ struct unicam_device {
+ 	struct v4l2_device v4l2_dev;
+ 	struct media_device mdev;
+ 
++	struct gpio_desc *sync_gpio;
++
+ 	/* parent device */
+ 	struct platform_device *pdev;
+ 	/* subdevice async Notifier */
+@@ -932,6 +935,8 @@ static irqreturn_t unicam_isr(int irq, v
+ 	if (fe) {
+ 		bool inc_seq = unicam->frame_started;
+ 
++		if (unicam->sync_gpio)
++			gpiod_set_value(unicam->sync_gpio, 0);
+ 		/*
+ 		 * Ensure we have swapped buffers already as we can't
+ 		 * stop the peripheral. If no buffer is available, use a
+@@ -992,6 +997,10 @@ static irqreturn_t unicam_isr(int irq, v
+ 		 * aka frame start.
+ 		 */
+ 		ts = ktime_get_ns();
++
++		if (unicam->sync_gpio)
++			gpiod_set_value(unicam->sync_gpio, 1);
++
+ 		for (i = 0; i < ARRAY_SIZE(unicam->node); i++) {
+ 			if (!unicam->node[i].streaming)
+ 				continue;
+@@ -3396,6 +3405,9 @@ static int unicam_probe(struct platform_
+ 		goto err_unicam_put;
+ 	}
+ 
++	unicam->sync_gpio = devm_gpiod_get_optional(&pdev->dev, "sync",
++						    GPIOD_OUT_LOW);
++
+ 	ret = platform_get_irq(pdev, 0);
+ 	if (ret <= 0) {
+ 		dev_err(&pdev->dev, "No IRQ resource\n");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0453-dw-axi-dmac-platform-Avoid-trampling-with-zero-lengt.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0453-dw-axi-dmac-platform-Avoid-trampling-with-zero-lengt.patch
new file mode 100644
index 00000000..1679944b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0453-dw-axi-dmac-platform-Avoid-trampling-with-zero-lengt.patch
@@ -0,0 +1,34 @@
+From 931ff378b3166f29210ee33160616e697bfc142a Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Tue, 23 Apr 2024 09:51:36 +0100
+Subject: [PATCH 453/697] dw-axi-dmac-platform: Avoid trampling with zero
+ length buffer
+
+This code:
+for_each_sg(sgl, sg, sg_len, i)
+  num_sgs += DIV_ROUND_UP(sg_dma_len(sg), axi_block_len);
+
+determines how many hw_desc are allocated.
+If sg_dma_len(sg)=0 we don't allocate for this sgl.
+
+However in the next loop, we will increment loop
+for this case, and loop gets higher than num_sgs
+and we trample memory.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
++++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+@@ -963,6 +963,9 @@ dw_axi_dma_chan_prep_slave_sg(struct dma
+ 		mem = sg_dma_address(sg);
+ 		len = sg_dma_len(sg);
+ 		num_segments = DIV_ROUND_UP(sg_dma_len(sg), axi_block_len);
++		if (!num_segments)
++			continue;
++
+ 		segment_len = DIV_ROUND_UP(sg_dma_len(sg), num_segments);
+ 
+ 		do {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0454-drivers-media-cfe-Add-remap-entries-for-mono-formats.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0454-drivers-media-cfe-Add-remap-entries-for-mono-formats.patch
new file mode 100644
index 00000000..fe91f88b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0454-drivers-media-cfe-Add-remap-entries-for-mono-formats.patch
@@ -0,0 +1,32 @@
+From 351ba4cdeec9b2953b0a18fade1bbf6716b52524 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Tue, 23 Apr 2024 12:50:23 +0100
+Subject: [PATCH 454/697] drivers: media: cfe: Add remap entries for mono
+ formats
+
+The 8-bit and 16-bit mono formats were missing the appropriate remap
+entries in the format table.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/platform/raspberrypi/rp1_cfe/cfe_fmts.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/media/platform/raspberrypi/rp1_cfe/cfe_fmts.h
++++ b/drivers/media/platform/raspberrypi/rp1_cfe/cfe_fmts.h
+@@ -256,6 +256,7 @@ static const struct cfe_fmt formats[] =
+ 		.code = MEDIA_BUS_FMT_Y8_1X8,
+ 		.depth = 8,
+ 		.csi_dt = MIPI_CSI2_DT_RAW8,
++		.remap = { V4L2_PIX_FMT_Y16, V4L2_PIX_FMT_PISP_COMP1_MONO },
+ 	},
+ 	{
+ 		.fourcc = V4L2_PIX_FMT_Y10P,
+@@ -284,6 +285,7 @@ static const struct cfe_fmt formats[] =
+ 		.depth = 16,
+ 		.csi_dt = MIPI_CSI2_DT_RAW16,
+ 		.flags = CFE_FORMAT_FLAG_FE_OUT,
++		.remap = { V4L2_PIX_FMT_Y16, V4L2_PIX_FMT_PISP_COMP1_MONO },
+ 	},
+ 	{
+ 		.fourcc = V4L2_PIX_FMT_PISP_COMP1_MONO,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0455-drm-panel-Add-and-initialise-an-orientation-field-to.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0455-drm-panel-Add-and-initialise-an-orientation-field-to.patch
new file mode 100644
index 00000000..fbd9edde
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0455-drm-panel-Add-and-initialise-an-orientation-field-to.patch
@@ -0,0 +1,42 @@
+From 252198fb0b2c3023667fc502b3e4a98721cf4ad3 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 1 Feb 2022 12:20:20 +0000
+Subject: [PATCH 455/697] drm/panel: Add and initialise an orientation field to
+ drm_panel from OF
+
+"rotation" is listed as a standard property of panels in panel-common.yaml,
+therefore it would be logical to process that from within the core
+code should a panel driver not implement the get_orientation hook.
+
+Call of_drm_get_panel_orientation from
+drm_connector_set_orientation_from_panel to get that information.
+
+This removes the need for any boiler-plate in panel drivers for calling
+drm_connector_set_orientation_from_panel or
+drm_connector_set_panel_orientation.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/drm_connector.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/drm_connector.c
++++ b/drivers/gpu/drm/drm_connector.c
+@@ -2957,10 +2957,15 @@ int drm_connector_set_orientation_from_p
+ {
+ 	enum drm_panel_orientation orientation;
+ 
+-	if (panel && panel->funcs && panel->funcs->get_orientation)
++	if (panel && panel->funcs && panel->funcs->get_orientation) {
+ 		orientation = panel->funcs->get_orientation(panel);
+-	else
++	} else {
+ 		orientation = DRM_MODE_PANEL_ORIENTATION_UNKNOWN;
++		if (panel) {
++			of_drm_get_panel_orientation(panel->dev->of_node,
++						     &orientation);
++		}
++	}
+ 
+ 	return drm_connector_set_panel_orientation(connector, orientation);
+ }
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0456-drm-bridge-tc358762-Program-the-DPI-mode-into-the-ch.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0456-drm-bridge-tc358762-Program-the-DPI-mode-into-the-ch.patch
new file mode 100644
index 00000000..9fae7bcc
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0456-drm-bridge-tc358762-Program-the-DPI-mode-into-the-ch.patch
@@ -0,0 +1,48 @@
+From 9082ae0d3ed3e6350d081d6297d5e73b8fdb9dec Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 9 Jan 2024 17:37:00 +0000
+Subject: [PATCH 456/697] drm/bridge: tc358762: Program the DPI mode into the
+ chip
+
+The autodetection of resolution/timing by the TC358762 can lead
+to the display being shifted by a pixel or two.
+
+Program the TC358762 with the requested mode timing so that
+it can reproduce it accurately.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/bridge/tc358762.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+--- a/drivers/gpu/drm/bridge/tc358762.c
++++ b/drivers/gpu/drm/bridge/tc358762.c
+@@ -53,6 +53,12 @@
+ #define LCDCTRL_VSPOL		BIT(19) /* Polarity of VSYNC signal */
+ #define LCDCTRL_VSDELAY(v)	(((v) & 0xfff) << 20) /* VSYNC delay */
+ 
++/* First parameter is in the 16bits, second is in the top 16bits */
++#define LCD_HS_HBP		0x0424
++#define LCD_HDISP_HFP		0x0428
++#define LCD_VS_VBP		0x042c
++#define LCD_VDISP_VFP		0x0430
++
+ /* SPI Master Registers */
+ #define SPICMR			0x0450
+ #define SPITCR			0x0454
+@@ -139,6 +145,15 @@ static int tc358762_init(struct tc358762
+ 	tc358762_write(ctx, LCDCTRL, lcdctrl);
+ 
+ 	tc358762_write(ctx, SYSCTRL, 0x040f);
++
++	tc358762_write(ctx, LCD_HS_HBP, (ctx->mode.hsync_end - ctx->mode.hsync_start) |
++		       ((ctx->mode.htotal - ctx->mode.hsync_end) << 16));
++	tc358762_write(ctx, LCD_HDISP_HFP, ctx->mode.hdisplay |
++		       ((ctx->mode.hsync_start - ctx->mode.hdisplay) << 16));
++	tc358762_write(ctx, LCD_VS_VBP, (ctx->mode.vsync_end - ctx->mode.vsync_start) |
++		       ((ctx->mode.vtotal - ctx->mode.vsync_end) << 16));
++	tc358762_write(ctx, LCD_VDISP_VFP, ctx->mode.vdisplay |
++		       ((ctx->mode.vsync_start - ctx->mode.vdisplay) << 16));
+ 	msleep(100);
+ 
+ 	tc358762_write(ctx, PPI_STARTPPI, PPI_START_FUNCTION);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0457-drm-bridge-tc358762-revert-move-ops-to-enable.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0457-drm-bridge-tc358762-revert-move-ops-to-enable.patch
new file mode 100644
index 00000000..7d70b455
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0457-drm-bridge-tc358762-revert-move-ops-to-enable.patch
@@ -0,0 +1,38 @@
+From 288337ed1b3dfc3e313a8d442a57f649d899f202 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 9 Jan 2024 18:44:49 +0000
+Subject: [PATCH 457/697] drm/bridge: tc358762: revert move ops to enable
+
+Reverts 8a4b2fc9c91a ("drm/bridge: tc358762: Split register programming from pre-enable to enable")
+as we want the config commands sent before video starts.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/bridge/tc358762.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+--- a/drivers/gpu/drm/bridge/tc358762.c
++++ b/drivers/gpu/drm/bridge/tc358762.c
+@@ -200,14 +200,6 @@ static void tc358762_pre_enable(struct d
+ 		usleep_range(5000, 10000);
+ 	}
+ 
+-	ctx->pre_enabled = true;
+-}
+-
+-static void tc358762_enable(struct drm_bridge *bridge, struct drm_bridge_state *state)
+-{
+-	struct tc358762 *ctx = bridge_to_tc358762(bridge);
+-	int ret;
+-
+ 	ret = tc358762_init(ctx);
+ 	if (ret < 0)
+ 		dev_err(ctx->dev, "error initializing bridge (%d)\n", ret);
+@@ -234,7 +226,6 @@ static void tc358762_bridge_mode_set(str
+ static const struct drm_bridge_funcs tc358762_bridge_funcs = {
+ 	.atomic_post_disable = tc358762_post_disable,
+ 	.atomic_pre_enable = tc358762_pre_enable,
+-	.atomic_enable = tc358762_enable,
+ 	.atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state,
+ 	.atomic_destroy_state = drm_atomic_helper_bridge_destroy_state,
+ 	.atomic_reset = drm_atomic_helper_bridge_reset,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0458-pinctrl-bcm2835-Persist-outputs-by-default.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0458-pinctrl-bcm2835-Persist-outputs-by-default.patch
new file mode 100644
index 00000000..d293031b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0458-pinctrl-bcm2835-Persist-outputs-by-default.patch
@@ -0,0 +1,26 @@
+From 3ed57d1e6dee918fab666c0be8d446129abcdf98 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 7 May 2024 12:14:12 +0100
+Subject: [PATCH 458/697] pinctrl: bcm2835: Persist outputs by default
+
+Having accepted the upstream change to add the persist_gpio_outputs
+parameter, make it true by default.
+
+See: https://github.com/raspberrypi/linux/pull/6117
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/pinctrl/bcm/pinctrl-bcm2835.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
++++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+@@ -245,7 +245,7 @@ static const char * const irq_type_names
+ 	[IRQ_TYPE_LEVEL_LOW] = "level-low",
+ };
+ 
+-static bool persist_gpio_outputs;
++static bool persist_gpio_outputs = true;
+ module_param(persist_gpio_outputs, bool, 0444);
+ MODULE_PARM_DESC(persist_gpio_outputs, "Enable GPIO_OUT persistence when pin is freed");
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0459-spi-dw-Handle-any-number-of-gpiod-CS-lines.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0459-spi-dw-Handle-any-number-of-gpiod-CS-lines.patch
new file mode 100644
index 00000000..7bbe3a78
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0459-spi-dw-Handle-any-number-of-gpiod-CS-lines.patch
@@ -0,0 +1,28 @@
+From 09dcde48a89835bbe5649d7663d80ab005eb0fed Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 13 May 2024 15:40:02 +0100
+Subject: [PATCH 459/697] spi: dw: Handle any number of gpiod CS lines
+
+Even when configured to use only gpiod CS lines, the DW SPI controller
+still expects a bit to be set in the SER register, otherwise transfers
+stall. For the csgpiod case, nominate bit 0 for the job.
+
+See: https://github.com/raspberrypi/linux/issues/6159
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/spi/spi-dw-core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-dw-core.c
++++ b/drivers/spi/spi-dw-core.c
+@@ -100,7 +100,8 @@ void dw_spi_set_cs(struct spi_device *sp
+ 	 * support active-high or active-low CS level.
+ 	 */
+ 	if (cs_high == enable)
+-		dw_writel(dws, DW_SPI_SER, BIT(spi_get_chipselect(spi, 0)));
++		dw_writel(dws, DW_SPI_SER,
++			BIT(spi_get_csgpiod(spi, 0) ? 0 : spi_get_chipselect(spi, 0)));
+ 	else
+ 		dw_writel(dws, DW_SPI_SER, 0);
+ }
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0460-regulator-rpi_panel_v2-Add-remove-and-shutdown-hooks.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0460-regulator-rpi_panel_v2-Add-remove-and-shutdown-hooks.patch
new file mode 100644
index 00000000..fb4eb241
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0460-regulator-rpi_panel_v2-Add-remove-and-shutdown-hooks.patch
@@ -0,0 +1,55 @@
+From 11f123e33f5fbcb63abf18732efcd35dc8d345f6 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 16 May 2024 18:26:36 +0100
+Subject: [PATCH 460/697] regulator: rpi_panel_v2: Add remove and shutdown
+ hooks
+
+Add shutdown and remove hooks so that the panel gets powered
+off with the system.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/regulator/rpi-panel-v2-regulator.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/drivers/regulator/rpi-panel-v2-regulator.c
++++ b/drivers/regulator/rpi-panel-v2-regulator.c
+@@ -104,6 +104,7 @@ static int rpi_panel_v2_i2c_probe(struct
+ 		return -ENOMEM;
+ 
+ 	mutex_init(&state->lock);
++	i2c_set_clientdata(i2c, state);
+ 
+ 	regmap = devm_regmap_init_i2c(i2c, &rpi_panel_regmap_config);
+ 	if (IS_ERR(regmap)) {
+@@ -168,6 +169,21 @@ error:
+ 	return ret;
+ }
+ 
++static void rpi_panel_v2_i2c_remove(struct i2c_client *client)
++{
++	struct rpi_panel_v2_lcd *state = i2c_get_clientdata(client);
++
++	mutex_destroy(&state->lock);
++}
++
++static void rpi_panel_v2_i2c_shutdown(struct i2c_client *client)
++{
++	struct rpi_panel_v2_lcd *state = i2c_get_clientdata(client);
++
++	regmap_write(state->regmap, REG_PWM, 0);
++	regmap_write(state->regmap, REG_POWERON, 0);
++}
++
+ static const struct of_device_id rpi_panel_v2_dt_ids[] = {
+ 	{ .compatible = "raspberrypi,v2-touchscreen-panel-regulator" },
+ 	{},
+@@ -180,6 +196,8 @@ static struct i2c_driver rpi_panel_v2_re
+ 		.of_match_table = of_match_ptr(rpi_panel_v2_dt_ids),
+ 	},
+ 	.probe = rpi_panel_v2_i2c_probe,
++	.remove	= rpi_panel_v2_i2c_remove,
++	.shutdown = rpi_panel_v2_i2c_shutdown,
+ };
+ 
+ module_i2c_driver(rpi_panel_v2_regulator_driver);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0461-regulator-rpi_panel_v2-Add-delay-on-I2C-reads.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0461-regulator-rpi_panel_v2-Add-delay-on-I2C-reads.patch
new file mode 100644
index 00000000..af6239b0
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0461-regulator-rpi_panel_v2-Add-delay-on-I2C-reads.patch
@@ -0,0 +1,70 @@
+From 71827e08a72dfcd67b4cbf1f5e92ed3ccf927671 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 17 May 2024 14:27:59 +0100
+Subject: [PATCH 461/697] regulator: rpi_panel_v2: Add delay on I2C reads
+
+As with many microcontrollers, the panel wants to use clock
+stretching during a read so that the appropriate return value
+can be generated and programmed into the hardware.
+With Pi0-3 really not supporting clock stretching, this resulted
+in the panel firmware dying.
+
+Insert a delay between the write and the read to give the firmware
+a chance to generate the relevant return value.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/regulator/rpi-panel-v2-regulator.c | 35 +++++++++++++++++++++-
+ 1 file changed, 34 insertions(+), 1 deletion(-)
+
+--- a/drivers/regulator/rpi-panel-v2-regulator.c
++++ b/drivers/regulator/rpi-panel-v2-regulator.c
+@@ -87,6 +87,39 @@ static const struct backlight_ops rpi_pa
+ 	.update_status	= rpi_panel_v2_update_status,
+ };
+ 
++static int rpi_panel_v2_i2c_read(struct i2c_client *client, u8 reg, unsigned int *buf)
++{
++	struct i2c_msg msgs[1];
++	u8 addr_buf[1] = { reg };
++	u8 data_buf[1] = { 0, };
++	int ret;
++
++	/* Write register address */
++	msgs[0].addr = client->addr;
++	msgs[0].flags = 0;
++	msgs[0].len = ARRAY_SIZE(addr_buf);
++	msgs[0].buf = addr_buf;
++
++	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
++	if (ret != ARRAY_SIZE(msgs))
++		return -EIO;
++
++	usleep_range(5000, 10000);
++
++	/* Read data from register */
++	msgs[0].addr = client->addr;
++	msgs[0].flags = I2C_M_RD;
++	msgs[0].len = 1;
++	msgs[0].buf = data_buf;
++
++	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
++	if (ret != ARRAY_SIZE(msgs))
++		return -EIO;
++
++	*buf = data_buf[0];
++	return 0;
++}
++
+ /*
+  * I2C driver interface functions
+  */
+@@ -114,7 +147,7 @@ static int rpi_panel_v2_i2c_probe(struct
+ 		goto error;
+ 	}
+ 
+-	ret = regmap_read(regmap, REG_ID, &data);
++	ret = rpi_panel_v2_i2c_read(i2c, REG_ID, &data);
+ 	if (ret < 0) {
+ 		dev_err(&i2c->dev, "Failed to read REG_ID reg: %d\n", ret);
+ 		goto error;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0462-backlight-Add-a-display-name-to-the-core-and-a-funct.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0462-backlight-Add-a-display-name-to-the-core-and-a-funct.patch
new file mode 100644
index 00000000..dcf12f9b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0462-backlight-Add-a-display-name-to-the-core-and-a-funct.patch
@@ -0,0 +1,100 @@
+From d5d0fc3ac907fadc5c1135c40648bf7eb0f1d897 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 17 May 2024 17:35:25 +0100
+Subject: [PATCH 462/697] backlight: Add a display name to the core, and a
+ function to set it
+
+The naming of backlight devices is not terribly useful for
+associating a backlight controller with a display (assuming
+it is attached to one).
+
+Add a sysfs node that will return a display name that can be set
+by other subsystems.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/video/backlight/backlight.c | 21 +++++++++++++++++++++
+ include/linux/backlight.h           | 15 +++++++++++++++
+ 2 files changed, 36 insertions(+)
+
+--- a/drivers/video/backlight/backlight.c
++++ b/drivers/video/backlight/backlight.c
+@@ -287,6 +287,15 @@ static ssize_t max_brightness_show(struc
+ }
+ static DEVICE_ATTR_RO(max_brightness);
+ 
++static ssize_t display_name_show(struct device *dev,
++				 struct device_attribute *attr, char *buf)
++{
++	struct backlight_device *bd = to_backlight_device(dev);
++
++	return sprintf(buf, "%s\n", bd->props.display_name);
++}
++static DEVICE_ATTR_RO(display_name);
++
+ static ssize_t actual_brightness_show(struct device *dev,
+ 		struct device_attribute *attr, char *buf)
+ {
+@@ -365,6 +374,7 @@ static struct attribute *bl_device_attrs
+ 	&dev_attr_max_brightness.attr,
+ 	&dev_attr_scale.attr,
+ 	&dev_attr_type.attr,
++	&dev_attr_display_name.attr,
+ 	NULL,
+ };
+ ATTRIBUTE_GROUPS(bl_device);
+@@ -668,6 +678,17 @@ static int of_parent_match(struct device
+ 	return dev->parent && dev->parent->of_node == data;
+ }
+ 
++int backlight_set_display_name(struct backlight_device *bd, const char *name)
++{
++	if (!bd)
++		return -EINVAL;
++
++	strscpy_pad(bd->props.display_name, name, sizeof(bd->props.display_name));
++
++	return 0;
++}
++EXPORT_SYMBOL(backlight_set_display_name);
++
+ /**
+  * of_find_backlight_by_node() - find backlight device by device-tree node
+  * @node: device-tree node of the backlight device
+--- a/include/linux/backlight.h
++++ b/include/linux/backlight.h
+@@ -255,6 +255,13 @@ struct backlight_properties {
+ 	 * @scale: The type of the brightness scale.
+ 	 */
+ 	enum backlight_scale scale;
++
++#define BL_DISPLAY_NAME_LEN 32
++	/**
++	 * @display_name: Optional name that can be registered to associate a
++	 * backlight device with a display device.
++	 */
++	char display_name[BL_DISPLAY_NAME_LEN];
+ };
+ 
+ /**
+@@ -459,12 +466,20 @@ of_find_backlight_by_node(struct device_
+ 
+ #if IS_ENABLED(CONFIG_BACKLIGHT_CLASS_DEVICE)
+ struct backlight_device *devm_of_find_backlight(struct device *dev);
++int backlight_set_display_name(struct backlight_device *bd, const char *name);
+ #else
+ static inline struct backlight_device *
+ devm_of_find_backlight(struct device *dev)
+ {
+ 	return NULL;
+ }
++
++static inline int backlight_set_display_name(struct backlight_device *bd,
++					     const char *name)
++{
++	return 0;
++}
++
+ #endif
+ 
+ #endif
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0463-drm-bridge-panel-Name-an-associated-backlight-device.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0463-drm-bridge-panel-Name-an-associated-backlight-device.patch
new file mode 100644
index 00000000..1c2f1ae7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0463-drm-bridge-panel-Name-an-associated-backlight-device.patch
@@ -0,0 +1,49 @@
+From ad8cb7e8bfe4900ed8da548e57a1b7b4e8a469a2 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 17 May 2024 17:37:33 +0100
+Subject: [PATCH 463/697] drm/bridge: panel: Name an associated backlight
+ device
+
+Pass the DRM connector name to any configured backlight
+device so that userspace can associate the two items.
+
+Ideally this should be in drm_panel, but it is bridge/panel
+that creates the drm_connector and therefore knows the name.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/bridge: panel: Ensure backlight is reachable
+
+Ensure that the various options of modules vs builtin results
+in being able to call into the backlight code.
+
+https://github.com/raspberrypi/linux/issues/6198
+
+Fixes: 573f8fd0abf1 ("drm/bridge: panel: Name an associated backlight device")
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/bridge/panel.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/bridge/panel.c
++++ b/drivers/gpu/drm/bridge/panel.c
+@@ -16,6 +16,7 @@
+ #include <drm/drm_panel.h>
+ #include <drm/drm_print.h>
+ #include <drm/drm_probe_helper.h>
++#include <linux/backlight.h>
+ 
+ struct panel_bridge {
+ 	struct drm_bridge bridge;
+@@ -83,6 +84,11 @@ static int panel_bridge_attach(struct dr
+ 	drm_connector_attach_encoder(&panel_bridge->connector,
+ 					  bridge->encoder);
+ 
++#if IS_REACHABLE(CONFIG_BACKLIGHT_CLASS_DEVICE)
++	backlight_set_display_name(panel_bridge->panel->backlight,
++				   panel_bridge->connector.name);
++#endif
++
+ 	if (bridge->dev->registered) {
+ 		if (connector->funcs->reset)
+ 			connector->funcs->reset(connector);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0464-drivers-media-pci-Add-Hailo-accelerator-device-drive.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0464-drivers-media-pci-Add-Hailo-accelerator-device-drive.patch
new file mode 100644
index 00000000..c95c482c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0464-drivers-media-pci-Add-Hailo-accelerator-device-drive.patch
@@ -0,0 +1,7062 @@
+From 9e6a5e2c58b4ee8ac104e82334c324c44d71bb3a Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Tue, 21 May 2024 12:56:17 +0100
+Subject: [PATCH 464/697] drivers: media: pci: Add Hailo accelerator device
+ drivers
+
+Add version 4.17.1 of the Hailo PCIe device drivers.
+Sourced from https://github.com/hailo-ai/hailort-drivers/
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/pci/Kconfig                     |    1 +
+ drivers/media/pci/Makefile                    |    3 +-
+ drivers/media/pci/hailo/Kconfig               |    6 +
+ drivers/media/pci/hailo/Makefile              |   32 +
+ drivers/media/pci/hailo/common/fw_operation.c |  103 ++
+ drivers/media/pci/hailo/common/fw_operation.h |   25 +
+ .../media/pci/hailo/common/fw_validation.c    |  112 ++
+ .../media/pci/hailo/common/fw_validation.h    |   66 ++
+ .../pci/hailo/common/hailo_ioctl_common.h     |  575 ++++++++++
+ .../pci/hailo/common/hailo_pcie_version.h     |   13 +
+ .../media/pci/hailo/common/hailo_resource.c   |  128 +++
+ .../media/pci/hailo/common/hailo_resource.h   |   39 +
+ drivers/media/pci/hailo/common/pcie_common.c  |  641 +++++++++++
+ drivers/media/pci/hailo/common/pcie_common.h  |  128 +++
+ drivers/media/pci/hailo/common/utils.h        |   39 +
+ drivers/media/pci/hailo/common/vdma_common.c  |  684 +++++++++++
+ drivers/media/pci/hailo/common/vdma_common.h  |  243 ++++
+ .../pci/hailo/include/hailo_pcie_version.h    |   14 +
+ drivers/media/pci/hailo/src/fops.c            |  736 ++++++++++++
+ drivers/media/pci/hailo/src/fops.h            |   21 +
+ drivers/media/pci/hailo/src/pcie.c            | 1012 +++++++++++++++++
+ drivers/media/pci/hailo/src/pcie.h            |   82 ++
+ drivers/media/pci/hailo/src/sysfs.c           |   36 +
+ drivers/media/pci/hailo/src/sysfs.h           |   13 +
+ drivers/media/pci/hailo/src/utils.c           |   27 +
+ drivers/media/pci/hailo/src/utils.h           |   21 +
+ drivers/media/pci/hailo/utils/compact.h       |  153 +++
+ drivers/media/pci/hailo/utils/fw_common.h     |   19 +
+ drivers/media/pci/hailo/utils/logs.c          |    8 +
+ drivers/media/pci/hailo/utils/logs.h          |   45 +
+ drivers/media/pci/hailo/vdma/ioctl.c          |  698 ++++++++++++
+ drivers/media/pci/hailo/vdma/ioctl.h          |   37 +
+ drivers/media/pci/hailo/vdma/memory.c         |  551 +++++++++
+ drivers/media/pci/hailo/vdma/memory.h         |   54 +
+ drivers/media/pci/hailo/vdma/vdma.c           |  336 ++++++
+ drivers/media/pci/hailo/vdma/vdma.h           |  143 +++
+ 36 files changed, 6843 insertions(+), 1 deletion(-)
+ create mode 100644 drivers/media/pci/hailo/Kconfig
+ create mode 100644 drivers/media/pci/hailo/Makefile
+ create mode 100644 drivers/media/pci/hailo/common/fw_operation.c
+ create mode 100644 drivers/media/pci/hailo/common/fw_operation.h
+ create mode 100644 drivers/media/pci/hailo/common/fw_validation.c
+ create mode 100644 drivers/media/pci/hailo/common/fw_validation.h
+ create mode 100644 drivers/media/pci/hailo/common/hailo_ioctl_common.h
+ create mode 100644 drivers/media/pci/hailo/common/hailo_pcie_version.h
+ create mode 100644 drivers/media/pci/hailo/common/hailo_resource.c
+ create mode 100644 drivers/media/pci/hailo/common/hailo_resource.h
+ create mode 100644 drivers/media/pci/hailo/common/pcie_common.c
+ create mode 100644 drivers/media/pci/hailo/common/pcie_common.h
+ create mode 100644 drivers/media/pci/hailo/common/utils.h
+ create mode 100644 drivers/media/pci/hailo/common/vdma_common.c
+ create mode 100644 drivers/media/pci/hailo/common/vdma_common.h
+ create mode 100755 drivers/media/pci/hailo/include/hailo_pcie_version.h
+ create mode 100644 drivers/media/pci/hailo/src/fops.c
+ create mode 100644 drivers/media/pci/hailo/src/fops.h
+ create mode 100644 drivers/media/pci/hailo/src/pcie.c
+ create mode 100644 drivers/media/pci/hailo/src/pcie.h
+ create mode 100644 drivers/media/pci/hailo/src/sysfs.c
+ create mode 100644 drivers/media/pci/hailo/src/sysfs.h
+ create mode 100644 drivers/media/pci/hailo/src/utils.c
+ create mode 100644 drivers/media/pci/hailo/src/utils.h
+ create mode 100644 drivers/media/pci/hailo/utils/compact.h
+ create mode 100644 drivers/media/pci/hailo/utils/fw_common.h
+ create mode 100644 drivers/media/pci/hailo/utils/logs.c
+ create mode 100644 drivers/media/pci/hailo/utils/logs.h
+ create mode 100644 drivers/media/pci/hailo/vdma/ioctl.c
+ create mode 100644 drivers/media/pci/hailo/vdma/ioctl.h
+ create mode 100644 drivers/media/pci/hailo/vdma/memory.c
+ create mode 100644 drivers/media/pci/hailo/vdma/memory.h
+ create mode 100644 drivers/media/pci/hailo/vdma/vdma.c
+ create mode 100644 drivers/media/pci/hailo/vdma/vdma.h
+
+--- a/drivers/media/pci/Kconfig
++++ b/drivers/media/pci/Kconfig
+@@ -75,6 +75,7 @@ config VIDEO_PCI_SKELETON
+ 	  when developing new drivers.
+ 
+ source "drivers/media/pci/intel/Kconfig"
++source "drivers/media/pci/hailo/Kconfig"
+ 
+ endif #MEDIA_PCI_SUPPORT
+ endif #PCI
+--- a/drivers/media/pci/Makefile
++++ b/drivers/media/pci/Makefile
+@@ -17,7 +17,8 @@ obj-y        +=	ttpci/		\
+ 		saa7146/	\
+ 		smipcie/	\
+ 		netup_unidvb/	\
+-		intel/
++		intel/		\
++		hailo/
+ 
+ # Please keep it alphabetically sorted by Kconfig name
+ # (e. g. LC_ALL=C sort Makefile)
+--- /dev/null
++++ b/drivers/media/pci/hailo/Kconfig
+@@ -0,0 +1,6 @@
++
++config MEDIA_PCI_HAILO
++	tristate "Hailo AI accelerator PCIe driver"
++	depends on PCI
++	help
++	  Enable build of Hailo AI accelerator PCIe driver.
+--- /dev/null
++++ b/drivers/media/pci/hailo/Makefile
+@@ -0,0 +1,32 @@
++# SPDX-License-Identifier: GPL-2.0
++
++COMMON_SRC_DIRECTORY=common
++VDMA_SRC_DIRECTORY=vdma
++UTILS_SRC_DIRECTORY=utils
++
++obj-$(CONFIG_MEDIA_PCI_HAILO) := hailo_pci.o
++
++hailo_pci-objs += src/pcie.o
++hailo_pci-objs += src/fops.o
++hailo_pci-objs += src/utils.o
++hailo_pci-objs += src/sysfs.o
++
++hailo_pci-objs += $(COMMON_SRC_DIRECTORY)/fw_validation.o
++hailo_pci-objs += $(COMMON_SRC_DIRECTORY)/fw_operation.o
++hailo_pci-objs += $(COMMON_SRC_DIRECTORY)/pcie_common.o
++hailo_pci-objs += $(COMMON_SRC_DIRECTORY)/vdma_common.o
++hailo_pci-objs += $(COMMON_SRC_DIRECTORY)/hailo_resource.o
++
++hailo_pci-objs += $(UTILS_SRC_DIRECTORY)/logs.o
++
++hailo_pci-objs += $(VDMA_SRC_DIRECTORY)/vdma.o
++hailo_pci-objs += $(VDMA_SRC_DIRECTORY)/memory.o
++hailo_pci-objs += $(VDMA_SRC_DIRECTORY)/ioctl.o
++
++ccflags-y      += -Werror
++ccflags-y      += -DHAILO_RASBERRY_PIE
++ccflags-y      += -I$(srctree)/$(src)
++ccflags-y      += -I$(srctree)/$(src)/include
++ccflags-y      += -I$(srctree)/$(src)/common
++
++clean-files := $(hailo_pci-objs)
+--- /dev/null
++++ b/drivers/media/pci/hailo/common/fw_operation.c
+@@ -0,0 +1,103 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2022 Hailo Technologies Ltd. All rights reserved.
++**/
++
++#include "fw_operation.h"
++
++#include <linux/errno.h>
++#include <linux/types.h>
++#include <linux/kernel.h>
++#include <linux/bug.h>
++
++typedef struct {
++    u32 host_offset;
++    u32 chip_offset;
++} FW_DEBUG_BUFFER_HEADER_t;
++
++#define DEBUG_BUFFER_DATA_SIZE (DEBUG_BUFFER_TOTAL_SIZE - sizeof(FW_DEBUG_BUFFER_HEADER_t))
++
++int hailo_read_firmware_notification(struct hailo_resource *resource, struct hailo_d2h_notification *notification)
++{
++    hailo_d2h_buffer_details_t d2h_buffer_details = {0, 0};
++    hailo_resource_read_buffer(resource, 0, sizeof(d2h_buffer_details),
++        &d2h_buffer_details);
++
++    if ((sizeof(notification->buffer) < d2h_buffer_details.buffer_len) || (0 == d2h_buffer_details.is_buffer_in_use)) {
++        return -EINVAL;
++    }
++
++    notification->buffer_len = d2h_buffer_details.buffer_len;
++    hailo_resource_read_buffer(resource, sizeof(d2h_buffer_details), notification->buffer_len, notification->buffer);
++
++    // Write is_buffer_in_use = false
++    hailo_resource_write16(resource, 0, 0);
++    return 0;
++}
++
++static inline size_t calculate_log_ready_to_read(FW_DEBUG_BUFFER_HEADER_t *header)
++{
++    size_t ready_to_read = 0;
++    size_t host_offset = header->host_offset;
++    size_t chip_offset = header->chip_offset;
++
++    if (chip_offset >= host_offset) {
++        ready_to_read = chip_offset - host_offset;
++    } else {
++        ready_to_read = DEBUG_BUFFER_DATA_SIZE - (host_offset - chip_offset);
++    }
++
++    return ready_to_read;
++}
++
++long hailo_read_firmware_log(struct hailo_resource *fw_logger_resource, struct hailo_read_log_params *params)
++{
++    FW_DEBUG_BUFFER_HEADER_t debug_buffer_header = {0};
++    size_t read_offset = 0;
++    size_t ready_to_read = 0;
++    size_t size_to_read = 0;
++    uintptr_t user_buffer = (uintptr_t)params->buffer;
++
++    if (params->buffer_size > ARRAY_SIZE(params->buffer)) {
++        return -EINVAL;
++    }
++
++    hailo_resource_read_buffer(fw_logger_resource, 0, sizeof(debug_buffer_header),
++        &debug_buffer_header);
++
++    /* Point to the start of the data buffer. */
++    ready_to_read = calculate_log_ready_to_read(&debug_buffer_header);
++    if (0 == ready_to_read) {
++        params->read_bytes = 0;
++        return 0;
++    }
++    /* If ready to read is bigger than the buffer size, read only buffer size bytes. */
++    ready_to_read = min(ready_to_read, params->buffer_size);
++    
++    /* Point to the data that is read to be read by the host. */
++    read_offset = sizeof(debug_buffer_header) + debug_buffer_header.host_offset;
++    /* Check if the offset should cycle back to beginning. */
++    if (DEBUG_BUFFER_DATA_SIZE <= debug_buffer_header.host_offset + ready_to_read) {
++        size_to_read = DEBUG_BUFFER_DATA_SIZE - debug_buffer_header.host_offset;
++        hailo_resource_read_buffer(fw_logger_resource, read_offset, size_to_read, (void*)user_buffer);
++
++        user_buffer += size_to_read;
++        size_to_read = ready_to_read - size_to_read;
++        /* Point back to the beginning of the data buffer. */
++        read_offset -= debug_buffer_header.host_offset;
++    }
++    else {
++        size_to_read = ready_to_read;
++    }
++
++    /* size_to_read may become 0 if the read reached DEBUG_BUFFER_DATA_SIZE exactly */
++    hailo_resource_read_buffer(fw_logger_resource, read_offset, size_to_read, (void*)user_buffer);
++
++    /* Change current_offset to represent the new host offset. */
++    read_offset += size_to_read;
++    hailo_resource_write32(fw_logger_resource, offsetof(FW_DEBUG_BUFFER_HEADER_t, host_offset),
++        (u32)(read_offset - sizeof(debug_buffer_header)));
++    
++    params->read_bytes = ready_to_read;
++    return 0;
++}
+\ No newline at end of file
+--- /dev/null
++++ b/drivers/media/pci/hailo/common/fw_operation.h
+@@ -0,0 +1,25 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2022 Hailo Technologies Ltd. All rights reserved.
++**/
++
++#ifndef _HAILO_COMMON_FIRMWARE_OPERATION_H_
++#define _HAILO_COMMON_FIRMWARE_OPERATION_H_
++
++#include "hailo_resource.h"
++
++#define DEBUG_BUFFER_TOTAL_SIZE (4*1024)
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++int hailo_read_firmware_notification(struct hailo_resource *resource, struct hailo_d2h_notification *notification);
++
++long hailo_read_firmware_log(struct hailo_resource *fw_logger_resource, struct hailo_read_log_params *params);
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* _HAILO_COMMON_FIRMWARE_OPERATION_H_ */
+--- /dev/null
++++ b/drivers/media/pci/hailo/common/fw_validation.c
+@@ -0,0 +1,112 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#include "fw_validation.h"
++#include <linux/errno.h>
++#include <linux/types.h>
++
++
++
++/* when reading the firmware we don't want to read past the firmware_size,
++   so we have a consumed_firmware_offset that is updated _before_ accessing data at that offset
++   of firmware_base_address */
++#define CONSUME_FIRMWARE(__size, __err) do {                                                    \
++        consumed_firmware_offset += (u32) (__size);                                        \
++        if ((firmware_size < (__size)) || (firmware_size < consumed_firmware_offset)) {         \
++            err = __err;                                                                        \
++            goto exit;                                                                          \
++        }                                                                                       \
++    } while(0)
++
++int FW_VALIDATION__validate_fw_header(uintptr_t firmware_base_address,
++    size_t firmware_size, u32 max_code_size, u32 *outer_consumed_firmware_offset,
++    firmware_header_t **out_firmware_header, enum hailo_board_type board_type)
++{
++    int err = -EINVAL;
++    firmware_header_t *firmware_header = NULL;
++    u32 consumed_firmware_offset = *outer_consumed_firmware_offset;
++    u32 expected_firmware_magic = 0;
++ 
++    firmware_header = (firmware_header_t *) (firmware_base_address + consumed_firmware_offset);
++    CONSUME_FIRMWARE(sizeof(firmware_header_t), -EINVAL);
++
++    switch (board_type) {
++    case HAILO_BOARD_TYPE_HAILO8:
++        expected_firmware_magic = FIRMWARE_HEADER_MAGIC_HAILO8; 
++        break;
++    case HAILO_BOARD_TYPE_HAILO15:
++        expected_firmware_magic = FIRMWARE_HEADER_MAGIC_HAILO15; 
++        break;
++    case HAILO_BOARD_TYPE_PLUTO:
++        expected_firmware_magic = FIRMWARE_HEADER_MAGIC_PLUTO;
++        break;
++    default:
++        err = -EINVAL;
++        goto exit;
++    }
++
++    if (expected_firmware_magic != firmware_header->magic) {
++        err = -EINVAL;
++        goto exit;
++    }
++
++    /* Validate that the firmware header version is supported */
++    switch(firmware_header->header_version) {
++        case FIRMWARE_HEADER_VERSION_INITIAL:
++            break;
++        default:
++            err = -EINVAL;
++            goto exit;
++            break;
++    }
++
++    if (MINIMUM_FIRMWARE_CODE_SIZE > firmware_header->code_size) {
++        err = -EINVAL;
++        goto exit;
++    }
++
++    if (max_code_size < firmware_header->code_size) {
++        err = -EINVAL;
++        goto exit;
++    }
++
++    CONSUME_FIRMWARE(firmware_header->code_size, -EINVAL);
++
++    *outer_consumed_firmware_offset = consumed_firmware_offset;
++    *out_firmware_header = firmware_header;
++    err = 0;
++
++exit:
++    return err;
++}
++
++int FW_VALIDATION__validate_cert_header(uintptr_t firmware_base_address,
++    size_t firmware_size, u32 *outer_consumed_firmware_offset, secure_boot_certificate_t **out_firmware_cert)
++{
++
++    secure_boot_certificate_t *firmware_cert = NULL;
++    int err = -EINVAL;
++    u32 consumed_firmware_offset = *outer_consumed_firmware_offset;
++
++    firmware_cert = (secure_boot_certificate_t *) (firmware_base_address + consumed_firmware_offset);
++    CONSUME_FIRMWARE(sizeof(secure_boot_certificate_t), -EINVAL);
++
++    if ((MAXIMUM_FIRMWARE_CERT_KEY_SIZE < firmware_cert->key_size) ||
++        (MAXIMUM_FIRMWARE_CERT_CONTENT_SIZE < firmware_cert->content_size)) {
++        err = -EINVAL;
++        goto exit;
++    }
++
++    CONSUME_FIRMWARE(firmware_cert->key_size, -EINVAL);
++    CONSUME_FIRMWARE(firmware_cert->content_size, -EINVAL);
++
++    *outer_consumed_firmware_offset = consumed_firmware_offset;
++    *out_firmware_cert = firmware_cert;
++    err = 0;
++
++exit:
++    return err;
++}
++
+--- /dev/null
++++ b/drivers/media/pci/hailo/common/fw_validation.h
+@@ -0,0 +1,66 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#ifndef PCIE_COMMON_FIRMWARE_HEADER_UTILS_H_
++#define PCIE_COMMON_FIRMWARE_HEADER_UTILS_H_
++
++#include "hailo_ioctl_common.h"
++#include <linux/types.h>
++
++#define FIRMWARE_HEADER_MAGIC_HAILO8 (0x1DD89DE0)
++#define FIRMWARE_HEADER_MAGIC_HAILO15 (0xE905DAAB)
++// TODO - HRT-11344 : change fw magic to pluto specific
++#define FIRMWARE_HEADER_MAGIC_PLUTO (0xE905DAAB)
++
++#ifndef HAILO_EMULATOR
++#define FIRMWARE_WAIT_TIMEOUT_MS (5000)
++#else /* ifndef HAILO_EMULATOR */
++#define FIRMWARE_WAIT_TIMEOUT_MS (500000)
++#endif /* ifndef HAILO_EMULATOR */
++
++typedef enum {
++    FIRMWARE_HEADER_VERSION_INITIAL = 0,
++
++    /* MUST BE LAST */
++    FIRMWARE_HEADER_VERSION_COUNT
++} firmware_header_version_t;
++
++typedef struct {
++    u32 magic;
++    u32 header_version;
++    u32 firmware_major;
++    u32 firmware_minor;
++    u32 firmware_revision;
++    u32 code_size;
++} firmware_header_t;
++
++
++#ifdef _MSC_VER
++#pragma warning(push)
++#pragma warning(disable:4200)
++#endif /* _MSC_VER */
++
++typedef struct {
++    u32 key_size;
++    u32 content_size;
++    u8 certificates_data[0];
++} secure_boot_certificate_t;
++
++#ifdef _MSC_VER
++#pragma warning(pop)
++#endif /* _MSC_VER */
++
++#define MINIMUM_FIRMWARE_CODE_SIZE (20*4)
++#define MAXIMUM_FIRMWARE_CERT_KEY_SIZE (0x1000)
++#define MAXIMUM_FIRMWARE_CERT_CONTENT_SIZE (0x1000)
++
++int FW_VALIDATION__validate_fw_header(uintptr_t firmware_base_address,
++    size_t firmware_size, u32 max_code_size, u32 *outer_consumed_firmware_offset,
++    firmware_header_t **out_firmware_header, enum hailo_board_type board_type);
++
++int FW_VALIDATION__validate_cert_header(uintptr_t firmware_base_address,
++    size_t firmware_size, u32 *outer_consumed_firmware_offset, secure_boot_certificate_t **out_firmware_cert);
++
++#endif
+\ No newline at end of file
+--- /dev/null
++++ b/drivers/media/pci/hailo/common/hailo_ioctl_common.h
+@@ -0,0 +1,575 @@
++// SPDX-License-Identifier: (GPL-2.0 WITH Linux-syscall-note) AND MIT
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#ifndef _HAILO_IOCTL_COMMON_H_
++#define _HAILO_IOCTL_COMMON_H_
++
++
++// This value is not easily changeable.
++// For example: the channel interrupts ioctls assume we have up to 32 channels
++#define MAX_VDMA_CHANNELS_PER_ENGINE    (32)
++#define MAX_VDMA_ENGINES                (3)
++#define SIZE_OF_VDMA_DESCRIPTOR         (16)
++#define VDMA_DEST_CHANNELS_START        (16)
++
++#define HAILO_VDMA_MAX_ONGOING_TRANSFERS (128)
++#define HAILO_VDMA_MAX_ONGOING_TRANSFERS_MASK (HAILO_VDMA_MAX_ONGOING_TRANSFERS - 1)
++
++#define CHANNEL_IRQ_TIMESTAMPS_SIZE (HAILO_VDMA_MAX_ONGOING_TRANSFERS * 2)
++#define CHANNEL_IRQ_TIMESTAMPS_SIZE_MASK (CHANNEL_IRQ_TIMESTAMPS_SIZE - 1)
++
++#define INVALID_DRIVER_HANDLE_VALUE     ((uintptr_t)-1)
++
++// Used by windows and unix driver to raise the right CPU control handle to the FW. The same as in pcie_service FW
++#define FW_ACCESS_CORE_CPU_CONTROL_SHIFT (1)
++#define FW_ACCESS_CORE_CPU_CONTROL_MASK  (1 << FW_ACCESS_CORE_CPU_CONTROL_SHIFT)
++#define FW_ACCESS_CONTROL_INTERRUPT_SHIFT (0)
++#define FW_ACCESS_APP_CPU_CONTROL_MASK (1 << FW_ACCESS_CONTROL_INTERRUPT_SHIFT)
++#define FW_ACCESS_DRIVER_SHUTDOWN_SHIFT (2)
++#define FW_ACCESS_DRIVER_SHUTDOWN_MASK (1 << FW_ACCESS_DRIVER_SHUTDOWN_SHIFT)
++
++#define INVALID_VDMA_CHANNEL (0xff)
++
++#if !defined(__cplusplus) && defined(NTDDI_VERSION)
++#include <wdm.h>
++typedef ULONG uint32_t;
++typedef UCHAR uint8_t;
++typedef USHORT uint16_t;
++typedef ULONGLONG uint64_t;
++#endif /*  !defined(__cplusplus) && defined(NTDDI_VERSION) */
++
++
++#ifdef _MSC_VER
++
++#include <initguid.h>
++
++#if !defined(bool) && !defined(__cplusplus)
++typedef uint8_t bool;
++#endif // !defined(bool) && !defined(__cplusplus)
++
++#if !defined(INT_MAX)
++#define INT_MAX 0x7FFFFFFF
++#endif // !defined(INT_MAX)
++
++
++// {d88d31f1-fede-4e71-ac2a-6ce0018c1501}
++DEFINE_GUID (GUID_DEVINTERFACE_HailoKM,
++    0xd88d31f1,0xfede,0x4e71,0xac,0x2a,0x6c,0xe0,0x01,0x8c,0x15,0x01);
++
++#define HAILO_GENERAL_IOCTL_MAGIC 0
++#define HAILO_VDMA_IOCTL_MAGIC    1
++#define HAILO_NON_LINUX_IOCTL_MAGIC 2
++
++#define HAILO_IOCTL_COMPATIBLE                  CTL_CODE(FILE_DEVICE_UNKNOWN, 0x802, METHOD_BUFFERED, FILE_ANY_ACCESS)
++
++
++typedef struct tCompatibleHailoIoctlParam
++{
++    union {
++        struct {
++            ULONG Size : 16;
++            ULONG Code : 8;
++            ULONG Type : 6;
++            ULONG Read : 1;
++            ULONG Write : 1;
++        } bits;
++        ULONG value;
++    } u;
++} tCompatibleHailoIoctlParam;
++
++static ULONG FORCEINLINE _IOC_(ULONG nr, ULONG type, ULONG size, bool read, bool write)
++{
++    struct tCompatibleHailoIoctlParam param;
++    param.u.bits.Code = nr;
++    param.u.bits.Size = size;
++    param.u.bits.Type = type;
++    param.u.bits.Read = read ? 1 : 0;
++    param.u.bits.Write = write ? 1 : 0;
++    return param.u.value;
++}
++
++#define _IOW_(type,nr,size) _IOC_(nr, type, sizeof(size), true, false)
++#define _IOR_(type,nr,size) _IOC_(nr, type, sizeof(size), false, true)
++#define _IOWR_(type,nr,size) _IOC_(nr, type, sizeof(size), true, true)
++#define _IO_(type,nr) _IOC_(nr, type, 0, false, false)
++
++#elif defined(__linux__) // #ifdef _MSC_VER
++#ifndef __KERNEL__
++// include the userspace headers only if this file is included by user space program
++// It is discourged to include them when compiling the driver (https://lwn.net/Articles/113349/)
++#include <stdint.h>
++#include <sys/types.h>
++#else
++#include <linux/types.h>
++#include <linux/limits.h>
++#include <linux/kernel.h>
++#endif // ifndef __KERNEL__
++
++#include <linux/ioctl.h>
++
++#define _IOW_       _IOW
++#define _IOR_       _IOR
++#define _IOWR_      _IOWR
++#define _IO_        _IO
++
++#define HAILO_GENERAL_IOCTL_MAGIC 'g'
++#define HAILO_VDMA_IOCTL_MAGIC 'v'
++#define HAILO_NON_LINUX_IOCTL_MAGIC 'w'
++
++#elif defined(__QNX__) // #ifdef _MSC_VER
++#include <devctl.h>
++#include <stdint.h>
++#include <sys/types.h>
++#include <sys/mman.h>
++#include <stdbool.h>
++
++// defines for devctl
++#define _IOW_   __DIOF
++#define _IOR_   __DIOT
++#define _IOWR_  __DIOTF
++#define _IO_    __DION
++#define HAILO_GENERAL_IOCTL_MAGIC   _DCMD_ALL
++#define HAILO_VDMA_IOCTL_MAGIC      _DCMD_MISC
++#define HAILO_NON_LINUX_IOCTL_MAGIC _DCMD_PROC
++
++#else // #ifdef _MSC_VER
++#error "unsupported platform!"
++#endif
++
++#pragma pack(push, 1)
++
++struct hailo_channel_interrupt_timestamp {
++    uint64_t timestamp_ns;
++    uint16_t desc_num_processed;
++};
++
++typedef struct {
++    uint16_t is_buffer_in_use;
++    uint16_t buffer_len;
++} hailo_d2h_buffer_details_t;
++
++// This struct is the same as `enum dma_data_direction` (defined in linux/dma-direction)
++enum hailo_dma_data_direction {
++    HAILO_DMA_BIDIRECTIONAL = 0,
++    HAILO_DMA_TO_DEVICE = 1,
++    HAILO_DMA_FROM_DEVICE = 2,
++    HAILO_DMA_NONE = 3,
++
++    /** Max enum value to maintain ABI Integrity */
++    HAILO_DMA_MAX_ENUM = INT_MAX,
++};
++
++// Enum that determines if buffer should be allocated from user space or from driver
++enum hailo_allocation_mode {
++    HAILO_ALLOCATION_MODE_USERSPACE = 0,
++    HAILO_ALLOCATION_MODE_DRIVER    = 1,
++
++    /** Max enum value to maintain ABI Integrity */
++    HAILO_ALLOCATION_MODE_MAX_ENUM = INT_MAX,
++};
++
++/* structure used in ioctl HAILO_VDMA_BUFFER_MAP */
++struct hailo_vdma_buffer_map_params {
++#if defined(__linux__) || defined(_MSC_VER)
++    void* user_address;                             // in
++#elif defined(__QNX__)
++    shm_handle_t shared_memory_handle;              // in
++#else
++#error "unsupported platform!"
++#endif // __linux__
++    size_t size;                                    // in
++    enum hailo_dma_data_direction data_direction;   // in
++    uintptr_t allocated_buffer_handle;              // in
++    size_t mapped_handle;                           // out
++};
++
++/* structure used in ioctl HAILO_VDMA_BUFFER_UNMAP */
++struct hailo_vdma_buffer_unmap_params {
++    size_t mapped_handle;
++};
++
++/* structure used in ioctl HAILO_DESC_LIST_CREATE */
++struct hailo_desc_list_create_params {
++    size_t desc_count;          // in
++    uint16_t desc_page_size;    // in
++    bool is_circular;           // in
++    uintptr_t desc_handle;      // out
++    uint64_t dma_address;       // out
++};
++
++/* structure used in ioctl HAILO_DESC_LIST_RELEASE */
++struct hailo_desc_list_release_params {
++    uintptr_t desc_handle;      // in
++};
++
++/* structure used in ioctl HAILO_NON_LINUX_DESC_LIST_MMAP */
++struct hailo_non_linux_desc_list_mmap_params {
++    uintptr_t desc_handle;  // in
++    size_t size;            // in
++    void* user_address;     // out
++};
++
++/* structure used in ioctl HAILO_DESC_LIST_BIND_VDMA_BUFFER */
++struct hailo_desc_list_bind_vdma_buffer_params {
++    size_t buffer_handle;       // in
++    size_t buffer_size;         // in
++    size_t buffer_offset;       // in
++    uintptr_t desc_handle;      // in
++    uint8_t channel_index;      // in
++    uint32_t starting_desc;     // in
++};
++
++/* structure used in ioctl HAILO_VDMA_INTERRUPTS_ENABLE */
++struct hailo_vdma_interrupts_enable_params {
++    uint32_t channels_bitmap_per_engine[MAX_VDMA_ENGINES];  // in
++    bool enable_timestamps_measure;                         // in
++};
++
++/* structure used in ioctl HAILO_VDMA_INTERRUPTS_DISABLE */
++struct hailo_vdma_interrupts_disable_params {
++    uint32_t channels_bitmap_per_engine[MAX_VDMA_ENGINES];  // in
++};
++
++/* structure used in ioctl HAILO_VDMA_INTERRUPTS_WAIT */
++struct hailo_vdma_interrupts_channel_data {
++    uint8_t engine_index;
++    uint8_t channel_index;
++    bool is_active;                 // If not activate, num_processed is ignored.
++    uint16_t host_num_processed;
++    uint8_t host_error;             // Channel errors bits on source side
++    uint8_t device_error;           // Channel errors bits on dest side
++    bool validation_success;        // If the validation of the channel was successful
++};
++
++struct hailo_vdma_interrupts_wait_params {
++    uint32_t channels_bitmap_per_engine[MAX_VDMA_ENGINES];          // in
++    uint8_t channels_count;                                         // out
++    struct hailo_vdma_interrupts_channel_data
++        irq_data[MAX_VDMA_CHANNELS_PER_ENGINE * MAX_VDMA_ENGINES];  // out
++};
++
++/* structure used in ioctl HAILO_VDMA_INTERRUPTS_READ_TIMESTAMPS */
++struct hailo_vdma_interrupts_read_timestamp_params {
++    uint8_t engine_index;                                                               // in
++    uint8_t channel_index;                                                              // in
++    uint32_t timestamps_count;                                                          // out
++    struct hailo_channel_interrupt_timestamp timestamps[CHANNEL_IRQ_TIMESTAMPS_SIZE];   // out
++};
++
++/* structure used in ioctl HAILO_FW_CONTROL */
++#define MAX_CONTROL_LENGTH  (1500)
++#define PCIE_EXPECTED_MD5_LENGTH (16)
++
++
++/* structure used in ioctl	HAILO_FW_CONTROL and HAILO_READ_LOG */
++enum hailo_cpu_id {
++    HAILO_CPU_ID_CPU0 = 0,
++    HAILO_CPU_ID_CPU1,
++    HAILO_CPU_ID_NONE,
++
++    /** Max enum value to maintain ABI Integrity */
++    HAILO_CPU_MAX_ENUM = INT_MAX,
++};
++
++struct hailo_fw_control {
++    // expected_md5+buffer_len+buffer must be in this order at the start of the struct
++    uint8_t   expected_md5[PCIE_EXPECTED_MD5_LENGTH];
++    uint32_t  buffer_len;
++    uint8_t   buffer[MAX_CONTROL_LENGTH];
++    uint32_t timeout_ms;
++    enum hailo_cpu_id cpu_id;
++};
++
++/* structure used in ioctl HAILO_MEMORY_TRANSFER */
++// Max bar transfer size gotten from ATR0_TABLE_SIZE
++#define MAX_MEMORY_TRANSFER_LENGTH  (4096)
++
++enum hailo_transfer_direction {
++    TRANSFER_READ = 0,
++    TRANSFER_WRITE,
++
++    /** Max enum value to maintain ABI Integrity */
++    TRANSFER_MAX_ENUM = INT_MAX,
++};
++
++enum hailo_transfer_memory_type {
++    HAILO_TRANSFER_DEVICE_DIRECT_MEMORY,
++
++    // vDMA memories
++    HAILO_TRANSFER_MEMORY_VDMA0 = 0x100,
++    HAILO_TRANSFER_MEMORY_VDMA1,
++    HAILO_TRANSFER_MEMORY_VDMA2,
++
++    // PCIe driver memories
++    HAILO_TRANSFER_MEMORY_PCIE_BAR0 = 0x200,
++    HAILO_TRANSFER_MEMORY_PCIE_BAR2 = 0x202,
++    HAILO_TRANSFER_MEMORY_PCIE_BAR4 = 0x204,
++
++    // DRAM DMA driver memories
++    HAILO_TRANSFER_MEMORY_DMA_ENGINE0 = 0x300,
++    HAILO_TRANSFER_MEMORY_DMA_ENGINE1,
++    HAILO_TRANSFER_MEMORY_DMA_ENGINE2,
++
++    /** Max enum value to maintain ABI Integrity */
++    HAILO_TRANSFER_MEMORY_MAX_ENUM = INT_MAX,
++};
++
++struct hailo_memory_transfer_params {
++    enum hailo_transfer_direction transfer_direction;   // in
++    enum hailo_transfer_memory_type memory_type;        // in
++    uint64_t address;                                   // in
++    size_t count;                                       // in
++    uint8_t buffer[MAX_MEMORY_TRANSFER_LENGTH];         // in/out
++};
++
++/* structure used in ioctl HAILO_VDMA_BUFFER_SYNC */
++enum hailo_vdma_buffer_sync_type {
++    HAILO_SYNC_FOR_CPU,
++    HAILO_SYNC_FOR_DEVICE,
++
++    /** Max enum value to maintain ABI Integrity */
++    HAILO_SYNC_MAX_ENUM = INT_MAX,
++};
++
++struct hailo_vdma_buffer_sync_params {
++    size_t handle;                              // in
++    enum hailo_vdma_buffer_sync_type sync_type; // in
++    size_t offset;                              // in
++    size_t count;                               // in
++};
++
++/* structure used in ioctl HAILO_READ_NOTIFICATION */
++#define MAX_NOTIFICATION_LENGTH  (1500)
++
++struct hailo_d2h_notification {
++    size_t buffer_len;                  // out
++    uint8_t buffer[MAX_NOTIFICATION_LENGTH]; // out
++};
++
++enum hailo_board_type {
++    HAILO_BOARD_TYPE_HAILO8 = 0,
++    HAILO_BOARD_TYPE_HAILO15,
++    HAILO_BOARD_TYPE_PLUTO,
++    HAILO_BOARD_TYPE_COUNT,
++
++    /** Max enum value to maintain ABI Integrity */
++    HAILO_BOARD_TYPE_MAX_ENUM = INT_MAX
++};
++
++enum hailo_dma_type {
++    HAILO_DMA_TYPE_PCIE,
++    HAILO_DMA_TYPE_DRAM,
++
++    /** Max enum value to maintain ABI Integrity */
++    HAILO_DMA_TYPE_MAX_ENUM = INT_MAX,
++};
++
++struct hailo_device_properties {
++    uint16_t                     desc_max_page_size;
++    enum hailo_board_type        board_type;
++    enum hailo_allocation_mode   allocation_mode;
++    enum hailo_dma_type          dma_type;
++    size_t                       dma_engines_count;
++    bool                         is_fw_loaded;
++#ifdef __QNX__
++    pid_t                        resource_manager_pid;
++#endif // __QNX__
++};
++
++struct hailo_driver_info {
++    uint32_t major_version;
++    uint32_t minor_version;
++    uint32_t revision_version;
++};
++
++/* structure used in ioctl HAILO_READ_LOG */
++#define MAX_FW_LOG_BUFFER_LENGTH  (512)
++
++struct hailo_read_log_params {
++    enum hailo_cpu_id cpu_id;                   // in
++    uint8_t buffer[MAX_FW_LOG_BUFFER_LENGTH];   // out
++    size_t buffer_size;                         // in
++    size_t read_bytes;                          // out
++};
++
++/* structure used in ioctl HAILO_VDMA_LOW_MEMORY_BUFFER_ALLOC */
++struct hailo_allocate_low_memory_buffer_params {
++    size_t      buffer_size;    // in
++    uintptr_t   buffer_handle;  // out
++};
++
++/* structure used in ioctl HAILO_VDMA_LOW_MEMORY_BUFFER_FREE */
++struct hailo_free_low_memory_buffer_params {
++    uintptr_t  buffer_handle;  // in
++};
++
++struct hailo_mark_as_in_use_params {
++    bool in_use;           // out
++};
++
++/* structure used in ioctl HAILO_VDMA_CONTINUOUS_BUFFER_ALLOC */
++struct hailo_allocate_continuous_buffer_params {
++    size_t buffer_size;         // in
++    uintptr_t buffer_handle;    // out
++    uint64_t dma_address;       // out
++};
++
++/* structure used in ioctl HAILO_VDMA_CONTINUOUS_BUFFER_FREE */
++struct hailo_free_continuous_buffer_params {
++    uintptr_t buffer_handle;    // in
++};
++
++/* structures used in ioctl HAILO_VDMA_LAUNCH_TRANSFER */
++struct hailo_vdma_transfer_buffer {
++    size_t mapped_buffer_handle;       // in
++    uint32_t offset;                   // in
++    uint32_t size;                     // in
++};
++
++enum hailo_vdma_interrupts_domain {
++    HAILO_VDMA_INTERRUPTS_DOMAIN_NONE   = 0,
++    HAILO_VDMA_INTERRUPTS_DOMAIN_DEVICE = (1 << 0),
++    HAILO_VDMA_INTERRUPTS_DOMAIN_HOST   = (1 << 1),
++
++    /** Max enum value to maintain ABI Integrity */
++    HAILO_VDMA_INTERRUPTS_DOMAIN_MAX_ENUM = INT_MAX,
++};
++
++// We allow maximum 2 buffers per transfer since we may have an extra buffer 
++// to make sure each buffer is aligned to page size.
++#define HAILO_MAX_BUFFERS_PER_SINGLE_TRANSFER (2)
++
++struct hailo_vdma_launch_transfer_params {
++    uint8_t engine_index;                                               // in
++    uint8_t channel_index;                                              // in
++
++    uintptr_t desc_handle;                                              // in
++    uint32_t starting_desc;                                             // in
++
++    bool should_bind;                                                   // in, if false, assumes buffer already bound.
++    uint8_t buffers_count;                                              // in
++    struct hailo_vdma_transfer_buffer
++        buffers[HAILO_MAX_BUFFERS_PER_SINGLE_TRANSFER];                 // in
++
++    enum hailo_vdma_interrupts_domain first_interrupts_domain;          // in
++    enum hailo_vdma_interrupts_domain last_interrupts_domain;           // in
++
++    bool is_debug;                                                      // in, if set program hw to send
++                                                                        // more info (e.g desc complete status)
++
++    uint32_t descs_programed;                                           // out, amount of descriptors programed.
++};
++
++#ifdef _MSC_VER
++struct tCompatibleHailoIoctlData
++{
++    tCompatibleHailoIoctlParam Parameters;
++    ULONG_PTR Value;
++    union {
++        struct hailo_memory_transfer_params MemoryTransfer;
++        struct hailo_vdma_interrupts_enable_params VdmaInterruptsEnable;
++        struct hailo_vdma_interrupts_disable_params VdmaInterruptsDisable;
++        struct hailo_vdma_interrupts_read_timestamp_params VdmaInterruptsReadTimestamps;
++        struct hailo_vdma_interrupts_wait_params VdmaInterruptsWait;
++        struct hailo_vdma_buffer_sync_params VdmaBufferSync;
++        struct hailo_fw_control FirmwareControl;
++        struct hailo_vdma_buffer_map_params VdmaBufferMap;
++        struct hailo_vdma_buffer_unmap_params VdmaBufferUnmap;
++        struct hailo_desc_list_create_params DescListCreate;
++        struct hailo_desc_list_release_params DescListReleaseParam;
++        struct hailo_desc_list_bind_vdma_buffer_params DescListBind;
++        struct hailo_d2h_notification D2HNotification;
++        struct hailo_device_properties DeviceProperties;
++        struct hailo_driver_info DriverInfo;
++        struct hailo_non_linux_desc_list_mmap_params DescListMmap;
++        struct hailo_read_log_params ReadLog;
++        struct hailo_mark_as_in_use_params MarkAsInUse;
++        struct hailo_vdma_launch_transfer_params LaunchTransfer;
++    } Buffer;
++};
++#endif // _MSC_VER
++
++#pragma pack(pop)
++
++enum hailo_general_ioctl_code {
++    HAILO_MEMORY_TRANSFER_CODE,
++    HAILO_FW_CONTROL_CODE,
++    HAILO_READ_NOTIFICATION_CODE,
++    HAILO_DISABLE_NOTIFICATION_CODE,
++    HAILO_QUERY_DEVICE_PROPERTIES_CODE,
++    HAILO_QUERY_DRIVER_INFO_CODE,
++    HAILO_READ_LOG_CODE,
++    HAILO_RESET_NN_CORE_CODE,
++
++    // Must be last
++    HAILO_GENERAL_IOCTL_MAX_NR,
++};
++
++#define HAILO_MEMORY_TRANSFER           _IOWR_(HAILO_GENERAL_IOCTL_MAGIC,  HAILO_MEMORY_TRANSFER_CODE,            struct hailo_memory_transfer_params)
++#define HAILO_FW_CONTROL                _IOWR_(HAILO_GENERAL_IOCTL_MAGIC,  HAILO_FW_CONTROL_CODE,                 struct hailo_fw_control)
++#define HAILO_READ_NOTIFICATION         _IOW_(HAILO_GENERAL_IOCTL_MAGIC,   HAILO_READ_NOTIFICATION_CODE,          struct hailo_d2h_notification)
++#define HAILO_DISABLE_NOTIFICATION      _IO_(HAILO_GENERAL_IOCTL_MAGIC,    HAILO_DISABLE_NOTIFICATION_CODE)
++#define HAILO_QUERY_DEVICE_PROPERTIES   _IOW_(HAILO_GENERAL_IOCTL_MAGIC,   HAILO_QUERY_DEVICE_PROPERTIES_CODE,    struct hailo_device_properties)
++#define HAILO_QUERY_DRIVER_INFO         _IOW_(HAILO_GENERAL_IOCTL_MAGIC,   HAILO_QUERY_DRIVER_INFO_CODE,          struct hailo_driver_info)
++#define HAILO_READ_LOG                  _IOWR_(HAILO_GENERAL_IOCTL_MAGIC,  HAILO_READ_LOG_CODE,                   struct hailo_read_log_params)
++#define HAILO_RESET_NN_CORE             _IO_(HAILO_GENERAL_IOCTL_MAGIC,    HAILO_RESET_NN_CORE_CODE)
++
++enum hailo_vdma_ioctl_code {
++    HAILO_VDMA_INTERRUPTS_ENABLE_CODE,
++    HAILO_VDMA_INTERRUPTS_DISABLE_CODE,
++    HAILO_VDMA_INTERRUPTS_WAIT_CODE,
++    HAILO_VDMA_INTERRUPTS_READ_TIMESTAMPS_CODE,
++    HAILO_VDMA_BUFFER_MAP_CODE,
++    HAILO_VDMA_BUFFER_UNMAP_CODE,
++    HAILO_VDMA_BUFFER_SYNC_CODE,
++    HAILO_DESC_LIST_CREATE_CODE,
++    HAILO_DESC_LIST_RELEASE_CODE,
++    HAILO_DESC_LIST_BIND_VDMA_BUFFER_CODE,
++    HAILO_VDMA_LOW_MEMORY_BUFFER_ALLOC_CODE,
++    HAILO_VDMA_LOW_MEMORY_BUFFER_FREE_CODE,
++    HAILO_MARK_AS_IN_USE_CODE,
++    HAILO_VDMA_CONTINUOUS_BUFFER_ALLOC_CODE,
++    HAILO_VDMA_CONTINUOUS_BUFFER_FREE_CODE,
++    HAILO_VDMA_LAUNCH_TRANSFER_CODE,
++
++    // Must be last
++    HAILO_VDMA_IOCTL_MAX_NR,
++};
++
++#define HAILO_VDMA_INTERRUPTS_ENABLE          _IOR_(HAILO_VDMA_IOCTL_MAGIC,  HAILO_VDMA_INTERRUPTS_ENABLE_CODE,            struct hailo_vdma_interrupts_enable_params)
++#define HAILO_VDMA_INTERRUPTS_DISABLE         _IOR_(HAILO_VDMA_IOCTL_MAGIC,  HAILO_VDMA_INTERRUPTS_DISABLE_CODE,           struct hailo_vdma_interrupts_disable_params)
++#define HAILO_VDMA_INTERRUPTS_WAIT            _IOWR_(HAILO_VDMA_IOCTL_MAGIC, HAILO_VDMA_INTERRUPTS_WAIT_CODE,              struct hailo_vdma_interrupts_wait_params)
++#define HAILO_VDMA_INTERRUPTS_READ_TIMESTAMPS _IOWR_(HAILO_VDMA_IOCTL_MAGIC, HAILO_VDMA_INTERRUPTS_READ_TIMESTAMPS_CODE,   struct hailo_vdma_interrupts_read_timestamp_params)
++
++#define HAILO_VDMA_BUFFER_MAP                 _IOWR_(HAILO_VDMA_IOCTL_MAGIC, HAILO_VDMA_BUFFER_MAP_CODE,                    struct hailo_vdma_buffer_map_params)
++#define HAILO_VDMA_BUFFER_UNMAP               _IOR_(HAILO_VDMA_IOCTL_MAGIC,  HAILO_VDMA_BUFFER_UNMAP_CODE,                  struct hailo_vdma_buffer_unmap_params)
++#define HAILO_VDMA_BUFFER_SYNC                _IOR_(HAILO_VDMA_IOCTL_MAGIC,  HAILO_VDMA_BUFFER_SYNC_CODE,                   struct hailo_vdma_buffer_sync_params)
++
++#define HAILO_DESC_LIST_CREATE                _IOWR_(HAILO_VDMA_IOCTL_MAGIC, HAILO_DESC_LIST_CREATE_CODE,                   struct hailo_desc_list_create_params)
++#define HAILO_DESC_LIST_RELEASE               _IOR_(HAILO_VDMA_IOCTL_MAGIC,  HAILO_DESC_LIST_RELEASE_CODE,                  struct hailo_desc_list_release_params)
++#define HAILO_DESC_LIST_BIND_VDMA_BUFFER      _IOR_(HAILO_VDMA_IOCTL_MAGIC,  HAILO_DESC_LIST_BIND_VDMA_BUFFER_CODE,         struct hailo_desc_list_bind_vdma_buffer_params)
++
++#define HAILO_VDMA_LOW_MEMORY_BUFFER_ALLOC    _IOWR_(HAILO_VDMA_IOCTL_MAGIC, HAILO_VDMA_LOW_MEMORY_BUFFER_ALLOC_CODE,       struct hailo_allocate_low_memory_buffer_params)
++#define HAILO_VDMA_LOW_MEMORY_BUFFER_FREE     _IOR_(HAILO_VDMA_IOCTL_MAGIC,   HAILO_VDMA_LOW_MEMORY_BUFFER_FREE_CODE,       struct hailo_free_low_memory_buffer_params)
++
++#define HAILO_MARK_AS_IN_USE                  _IOW_(HAILO_VDMA_IOCTL_MAGIC,  HAILO_MARK_AS_IN_USE_CODE,                     struct hailo_mark_as_in_use_params)
++
++#define HAILO_VDMA_CONTINUOUS_BUFFER_ALLOC    _IOWR_(HAILO_VDMA_IOCTL_MAGIC, HAILO_VDMA_CONTINUOUS_BUFFER_ALLOC_CODE,       struct hailo_allocate_continuous_buffer_params)
++#define HAILO_VDMA_CONTINUOUS_BUFFER_FREE     _IOR_(HAILO_VDMA_IOCTL_MAGIC,   HAILO_VDMA_CONTINUOUS_BUFFER_FREE_CODE,       struct hailo_free_continuous_buffer_params)
++
++#define HAILO_VDMA_LAUNCH_TRANSFER           _IOWR_(HAILO_VDMA_IOCTL_MAGIC, HAILO_VDMA_LAUNCH_TRANSFER_CODE,                struct hailo_vdma_launch_transfer_params)
++
++
++enum hailo_non_linux_ioctl_code {
++    HAILO_NON_LINUX_DESC_LIST_MMAP_CODE,
++
++    // Must be last
++    HAILO_NON_LINUX_IOCTL_MAX_NR,
++};
++
++#define HAILO_NON_LINUX_DESC_LIST_MMAP _IOWR_(HAILO_NON_LINUX_IOCTL_MAGIC, HAILO_NON_LINUX_DESC_LIST_MMAP_CODE, struct hailo_non_linux_desc_list_mmap_params)
++
++
++#endif /* _HAILO_IOCTL_COMMON_H_ */
+--- /dev/null
++++ b/drivers/media/pci/hailo/common/hailo_pcie_version.h
+@@ -0,0 +1,13 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#ifndef _HAILO_COMMON_PCIE_VERSION_H_
++#define _HAILO_COMMON_PCIE_VERSION_H_
++
++#define HAILO_DRV_VER_MAJOR 4
++#define HAILO_DRV_VER_MINOR 17
++#define HAILO_DRV_VER_REVISION 0
++
++#endif /* _HAILO_COMMON_PCIE_VERSION_H_ */
+\ No newline at end of file
+--- /dev/null
++++ b/drivers/media/pci/hailo/common/hailo_resource.c
+@@ -0,0 +1,128 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#include "hailo_resource.h"
++
++#include <linux/io.h>
++#include <linux/errno.h>
++#include <linux/types.h>
++#include <linux/kernel.h>
++
++
++u8 hailo_resource_read8(struct hailo_resource *resource, size_t offset)
++{
++    return ioread8((u8*)resource->address + offset);
++}
++
++u16 hailo_resource_read16(struct hailo_resource *resource, size_t offset)
++{
++    return ioread16((u8*)resource->address + offset);
++}
++
++u32 hailo_resource_read32(struct hailo_resource *resource, size_t offset)
++{
++    return ioread32((u8*)resource->address + offset);
++}
++
++void hailo_resource_write8(struct hailo_resource *resource, size_t offset, u8 value)
++{
++    iowrite8(value, (u8*)resource->address + offset);
++}
++
++void hailo_resource_write16(struct hailo_resource *resource, size_t offset, u16 value)
++{
++    iowrite16(value, (u8*)resource->address + offset);
++}
++
++void hailo_resource_write32(struct hailo_resource *resource, size_t offset, u32 value)
++{
++    iowrite32(value, (u8*)resource->address + offset);
++}
++
++void hailo_resource_read_buffer(struct hailo_resource *resource, size_t offset, size_t count, void *to)
++{
++    // Copied and modified from linux aarch64 (using ioread32 instead of readq that does not work all the time)
++    uintptr_t to_ptr = (uintptr_t)to;
++    while ((count > 0) && (!IS_ALIGNED(to_ptr, 4) || !IS_ALIGNED((uintptr_t)resource->address + offset, 4))) {
++        *(u8*)to_ptr = hailo_resource_read8(resource, offset);
++        to_ptr++;
++        offset++;
++        count--;
++    }
++
++    while (count >= 4) {
++        *(u32*)to_ptr = hailo_resource_read32(resource, offset);
++        to_ptr += 4;
++        offset += 4;
++        count -= 4;
++    }
++
++    while (count > 0) {
++        *(u8*)to_ptr = hailo_resource_read8(resource, offset);
++        to_ptr++;
++        offset++;
++        count--;
++    }
++}
++
++int hailo_resource_write_buffer(struct hailo_resource *resource, size_t offset, size_t count, const void *from)
++{
++    // read the bytes after writing them for flushing the data. This function also checks if the pcie link
++    // is broken.
++    uintptr_t from_ptr = (uintptr_t)from;
++    while (count && (!IS_ALIGNED(resource->address + offset, 4) || !IS_ALIGNED(from_ptr, 4))) {
++        hailo_resource_write8(resource, offset, *(u8*)from_ptr);
++        if (hailo_resource_read8(resource, offset) != *(u8*)from_ptr) {
++            return -EIO;
++        }
++        from_ptr++;
++        offset++;
++        count--;
++    }
++
++    while (count >= 4) {
++        hailo_resource_write32(resource, offset, *(u32*)from_ptr);
++        if (hailo_resource_read32(resource, offset) != *(u32*)from_ptr) {
++            return -EIO;
++        }
++        from_ptr += 4;
++        offset += 4;
++        count -= 4;
++    }
++
++    while (count) {
++        hailo_resource_write8(resource, offset, *(u8*)from_ptr);
++         if (hailo_resource_read8(resource, offset) != *(u8*)from_ptr) {
++            return -EIO;
++        }
++        from_ptr++;
++        offset++;
++        count--;
++    }
++
++    return 0;
++}
++
++int hailo_resource_transfer(struct hailo_resource *resource, struct hailo_memory_transfer_params *transfer)
++{
++    // Check for transfer size (address is in resources address-space)
++    if ((transfer->address + transfer->count) > (u64)resource->size) {
++        return -EINVAL;
++    }
++
++    if (transfer->count > ARRAY_SIZE(transfer->buffer)) {
++        return -EINVAL;
++    }
++
++    switch (transfer->transfer_direction) {
++    case TRANSFER_READ:
++        hailo_resource_read_buffer(resource, (u32)transfer->address, transfer->count, transfer->buffer);
++        return 0;
++    case TRANSFER_WRITE:
++        return hailo_resource_write_buffer(resource, (u32)transfer->address, transfer->count, transfer->buffer);
++    default:
++        return -EINVAL;
++    }
++}
+--- /dev/null
++++ b/drivers/media/pci/hailo/common/hailo_resource.h
+@@ -0,0 +1,39 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#ifndef _HAILO_COMMON_HAILO_RESOURCE_H_
++#define _HAILO_COMMON_HAILO_RESOURCE_H_
++
++#include "hailo_ioctl_common.h"
++#include <linux/types.h>
++
++struct hailo_resource {
++    uintptr_t   address;
++    size_t      size;
++};
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++// Implemented by the specific platform
++u32 hailo_resource_read32(struct hailo_resource *resource, size_t offset);
++u16 hailo_resource_read16(struct hailo_resource *resource, size_t offset);
++u8 hailo_resource_read8(struct hailo_resource *resource, size_t offset);
++void hailo_resource_write32(struct hailo_resource *resource, size_t offset, u32 value);
++void hailo_resource_write16(struct hailo_resource *resource, size_t offset, u16 value);
++void hailo_resource_write8(struct hailo_resource *resource, size_t offset, u8 value);
++
++void hailo_resource_read_buffer(struct hailo_resource *resource, size_t offset, size_t count, void *to);
++int hailo_resource_write_buffer(struct hailo_resource *resource, size_t offset, size_t count, const void *from);
++
++// Transfer (read/write) the given resource into/from transfer params.
++int hailo_resource_transfer(struct hailo_resource *resource, struct hailo_memory_transfer_params *transfer);
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* _HAILO_COMMON_HAILO_RESOURCE_H_ */
+\ No newline at end of file
+--- /dev/null
++++ b/drivers/media/pci/hailo/common/pcie_common.c
+@@ -0,0 +1,641 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#include "pcie_common.h"
++#include "fw_operation.h"
++
++#include <linux/errno.h>
++#include <linux/bug.h>
++#include <linux/delay.h>
++#include <linux/kernel.h>
++
++
++#define BSC_IMASK_HOST (0x0188)
++#define BCS_ISTATUS_HOST (0x018C)
++#define BCS_SOURCE_INTERRUPT_PER_CHANNEL (0x400)
++#define BCS_DESTINATION_INTERRUPT_PER_CHANNEL (0x500)
++
++#define PO2_ROUND_UP(size, alignment) ((size + alignment-1) & ~(alignment-1))
++
++#define ATR0_PARAM (0x17)
++#define ATR0_SRC_ADDR (0x0)
++#define ATR0_TRSL_ADDR2 (0x0)
++#define ATR0_TRSL_PARAM (6)
++
++#define ATR0_PCIE_BRIDGE_OFFSET (0x700)
++#define ATR0_TABLE_SIZE (0x1000u)
++#define ATR0_TABLE_SIZE_MASK (0x1000u - 1)
++
++#define MAXIMUM_APP_FIRMWARE_CODE_SIZE (0x40000)
++#define MAXIMUM_CORE_FIRMWARE_CODE_SIZE (0x20000)
++
++#define FIRMWARE_LOAD_WAIT_MAX_RETRIES (100)
++#define FIRMWARE_LOAD_SLEEP_MS         (50)
++
++#define PCIE_APP_CPU_DEBUG_OFFSET (8*1024)
++#define PCIE_CORE_CPU_DEBUG_OFFSET (PCIE_APP_CPU_DEBUG_OFFSET + DEBUG_BUFFER_TOTAL_SIZE)
++
++#define PCIE_D2H_NOTIFICATION_SRAM_OFFSET (0x640 + 0x640)
++#define PCIE_REQUEST_SIZE_OFFSET (0x640)
++
++#define PCIE_CONFIG_VENDOR_OFFSET (0x0098)
++
++#define HAILO_PCIE_HOST_DMA_DATA_ID (0)
++#define HAILO_PCIE_DMA_DEVICE_INTERRUPTS_BITMASK    (1 << 4)
++#define HAILO_PCIE_DMA_HOST_INTERRUPTS_BITMASK      (1 << 5)
++
++typedef u32 hailo_ptr_t;
++
++struct hailo_fw_addresses {
++    u32 boot_fw_header;
++    u32 app_fw_code_ram_base;
++    u32 boot_key_cert;
++    u32 boot_cont_cert;
++    u32 boot_fw_trigger;
++    u32 core_code_ram_base;
++    u32 core_fw_header;
++    u32 atr0_trsl_addr1;
++    u32 raise_ready_offset;
++};
++
++struct hailo_atr_config {
++    u32 atr_param;
++    u32 atr_src;
++    u32 atr_trsl_addr_1;
++    u32 atr_trsl_addr_2;
++    u32 atr_trsl_param;
++};
++
++struct hailo_board_compatibility {
++    struct hailo_fw_addresses fw_addresses;
++    const char *fw_filename;
++    const struct hailo_config_constants board_cfg;
++    const struct hailo_config_constants fw_cfg;
++};
++
++static const struct hailo_board_compatibility compat[HAILO_BOARD_TYPE_COUNT] = {
++    [HAILO_BOARD_TYPE_HAILO8] = {
++        .fw_addresses = {
++            .boot_fw_header = 0xE0030,
++            .boot_fw_trigger = 0xE0980,
++            .boot_key_cert = 0xE0048,
++            .boot_cont_cert = 0xE0390,
++            .app_fw_code_ram_base = 0x60000,
++            .core_code_ram_base = 0xC0000,
++            .core_fw_header = 0xA0000,
++            .atr0_trsl_addr1 = 0x60000000,
++            .raise_ready_offset = 0x1684,
++        },
++        .fw_filename = "hailo/hailo8_fw.bin",
++        .board_cfg = {
++            .filename = "hailo/hailo8_board_cfg.bin",
++            .address = 0x60001000,
++            .max_size = PCIE_HAILO8_BOARD_CFG_MAX_SIZE,
++        },
++        .fw_cfg = {
++            .filename = "hailo/hailo8_fw_cfg.bin",
++            .address = 0x60001500,
++            .max_size = PCIE_HAILO8_FW_CFG_MAX_SIZE,
++        },
++    },
++    [HAILO_BOARD_TYPE_HAILO15] = {
++        .fw_addresses = {
++            .boot_fw_header = 0x88000,
++            .boot_fw_trigger = 0x88c98,
++            .boot_key_cert = 0x88018,
++            .boot_cont_cert = 0x886a8,
++            .app_fw_code_ram_base = 0x20000,
++            .core_code_ram_base = 0x60000,
++            .core_fw_header = 0xC0000,
++            .atr0_trsl_addr1 = 0x000BE000,
++            .raise_ready_offset = 0x1754,
++        },
++        .fw_filename = "hailo/hailo15_fw.bin",
++        .board_cfg = {
++            .filename = NULL,
++            .address = 0,
++            .max_size = 0,
++        },
++        .fw_cfg = {
++            .filename = NULL,
++            .address = 0,
++            .max_size = 0,
++        },
++    },
++    // HRT-11344 : none of these matter except raise_ready_offset seeing as we load fw seperately - not through driver
++    // After implementing bootloader put correct values here
++    [HAILO_BOARD_TYPE_PLUTO] = {
++        .fw_addresses = {
++            .boot_fw_header = 0x88000,
++            .boot_fw_trigger = 0x88c98,
++            .boot_key_cert = 0x88018,
++            .boot_cont_cert = 0x886a8,
++            .app_fw_code_ram_base = 0x20000,
++            .core_code_ram_base = 0x60000,
++            .core_fw_header = 0xC0000,
++            .atr0_trsl_addr1 = 0x000BE000,
++            // NOTE: After they update hw consts - check register fw_access_interrupt_w1s of pcie_config
++            .raise_ready_offset = 0x174c,
++        },
++        .fw_filename = "hailo/pluto_fw.bin",
++        .board_cfg = {
++            .filename = NULL,
++            .address = 0,
++            .max_size = 0,
++        },
++        .fw_cfg = {
++            .filename = NULL,
++            .address = 0,
++            .max_size = 0,
++        },
++    }
++};
++
++
++bool hailo_pcie_read_interrupt(struct hailo_pcie_resources *resources, struct hailo_pcie_interrupt_source *source)
++{
++    u32 channel_data_source = 0;
++    u32 channel_data_dest = 0;
++    memset(source, 0, sizeof(*source));
++
++    source->interrupt_bitmask = hailo_resource_read32(&resources->config, BCS_ISTATUS_HOST);
++    if (0 == source->interrupt_bitmask) {
++        return false;
++    }
++
++    // clear signal
++    hailo_resource_write32(&resources->config, BCS_ISTATUS_HOST, source->interrupt_bitmask);
++
++    if (source->interrupt_bitmask & BCS_ISTATUS_HOST_VDMA_SRC_IRQ_MASK) {
++        channel_data_source = hailo_resource_read32(&resources->config, BCS_SOURCE_INTERRUPT_PER_CHANNEL);
++        hailo_resource_write32(&resources->config, BCS_SOURCE_INTERRUPT_PER_CHANNEL, channel_data_source);
++    }
++    if (source->interrupt_bitmask & BCS_ISTATUS_HOST_VDMA_DEST_IRQ_MASK) {
++        channel_data_dest = hailo_resource_read32(&resources->config, BCS_DESTINATION_INTERRUPT_PER_CHANNEL);
++        hailo_resource_write32(&resources->config, BCS_DESTINATION_INTERRUPT_PER_CHANNEL, channel_data_dest);
++    }
++    source->vdma_channels_bitmap = channel_data_source | channel_data_dest;
++
++    return true;
++}
++
++int hailo_pcie_write_firmware_control(struct hailo_pcie_resources *resources, const struct hailo_fw_control *command)
++{
++    int err = 0;
++    u32 request_size = 0;
++    u8 fw_access_value = FW_ACCESS_APP_CPU_CONTROL_MASK;
++    const struct hailo_fw_addresses *fw_addresses = &(compat[resources->board_type].fw_addresses);
++
++    if (!hailo_pcie_is_firmware_loaded(resources)) {
++        return -ENODEV;
++    }
++
++    // Copy md5 + buffer_len + buffer
++    request_size = sizeof(command->expected_md5) + sizeof(command->buffer_len) + command->buffer_len;
++    err = hailo_resource_write_buffer(&resources->fw_access, 0, PO2_ROUND_UP(request_size, FW_CODE_SECTION_ALIGNMENT),
++        command);
++    if (err < 0) {
++        return err;
++    }
++
++    // Raise the bit for the CPU that will handle the control
++    fw_access_value = (command->cpu_id == HAILO_CPU_ID_CPU1) ? FW_ACCESS_CORE_CPU_CONTROL_MASK :
++        FW_ACCESS_APP_CPU_CONTROL_MASK;
++    
++    // Raise ready flag to FW
++    hailo_resource_write32(&resources->fw_access, fw_addresses->raise_ready_offset, (u32)fw_access_value);
++    return 0;
++}
++
++int hailo_pcie_read_firmware_control(struct hailo_pcie_resources *resources, struct hailo_fw_control *command)
++{
++    u32 response_header_size = 0;
++
++    // Copy response md5 + buffer_len
++    response_header_size = sizeof(command->expected_md5) + sizeof(command->buffer_len);
++
++    hailo_resource_read_buffer(&resources->fw_access, PCIE_REQUEST_SIZE_OFFSET, response_header_size, command);
++
++    if (sizeof(command->buffer) < command->buffer_len) {
++        return -EINVAL;
++    }
++
++    // Copy response buffer
++    hailo_resource_read_buffer(&resources->fw_access, PCIE_REQUEST_SIZE_OFFSET + (size_t)response_header_size,
++        command->buffer_len, &command->buffer);
++    
++    return 0;
++}
++
++void hailo_pcie_write_firmware_driver_shutdown(struct hailo_pcie_resources *resources)
++{
++    const struct hailo_fw_addresses *fw_addresses = &(compat[resources->board_type].fw_addresses);
++    const u32 fw_access_value = FW_ACCESS_DRIVER_SHUTDOWN_MASK;
++
++    // Write shutdown flag to FW
++    hailo_resource_write32(&resources->fw_access, fw_addresses->raise_ready_offset, fw_access_value);
++}
++
++int hailo_pcie_read_firmware_notification(struct hailo_pcie_resources *resources,
++    struct hailo_d2h_notification *notification)
++{
++    struct hailo_resource notification_resource;
++
++    if (PCIE_D2H_NOTIFICATION_SRAM_OFFSET > resources->fw_access.size) {
++        return -EINVAL;
++    }
++
++    notification_resource.address = resources->fw_access.address + PCIE_D2H_NOTIFICATION_SRAM_OFFSET,
++    notification_resource.size = sizeof(struct hailo_d2h_notification);
++
++    return hailo_read_firmware_notification(&notification_resource, notification);
++}
++
++static void write_atr_table(struct hailo_pcie_resources *resources,
++    struct hailo_atr_config *atr)
++{
++    hailo_resource_write_buffer(&resources->config, ATR0_PCIE_BRIDGE_OFFSET,
++        sizeof(*atr), (void*)atr);
++}
++
++static void read_atr_table(struct hailo_pcie_resources *resources,
++    struct hailo_atr_config *atr)
++{
++    hailo_resource_read_buffer(&resources->config, ATR0_PCIE_BRIDGE_OFFSET,
++        sizeof(*atr), (void*)atr);
++}
++
++static void configure_atr_table(struct hailo_pcie_resources *resources,
++    hailo_ptr_t base_address)
++{
++    struct hailo_atr_config atr = {
++        .atr_param = ATR0_PARAM,
++        .atr_src = ATR0_SRC_ADDR,
++        .atr_trsl_addr_1 = (u32)base_address,
++        .atr_trsl_addr_2 = ATR0_TRSL_ADDR2,
++        .atr_trsl_param = ATR0_TRSL_PARAM
++    };
++    write_atr_table(resources, &atr);
++}
++
++static void write_memory_chunk(struct hailo_pcie_resources *resources,
++    hailo_ptr_t dest, u32 dest_offset, const void *src, u32 len)
++{
++    BUG_ON(dest_offset + len > (u32)resources->fw_access.size);
++
++    configure_atr_table(resources, dest);
++    (void)hailo_resource_write_buffer(&resources->fw_access, dest_offset, len, src);
++}
++
++static void read_memory_chunk(
++    struct hailo_pcie_resources *resources, hailo_ptr_t src, u32 src_offset, void *dest, u32 len)
++{
++    BUG_ON(src_offset + len > (u32)resources->fw_access.size);
++
++    configure_atr_table(resources, src);
++    (void)hailo_resource_read_buffer(&resources->fw_access, src_offset, len, dest);
++}
++
++// Note: this function modify the device ATR table (that is also used by the firmware for control and vdma).
++// Use with caution, and restore the original atr if needed.
++static void write_memory(struct hailo_pcie_resources *resources, hailo_ptr_t dest, const void *src, u32 len)
++{
++    hailo_ptr_t base_address = dest & ~ATR0_TABLE_SIZE_MASK;
++    u32 chunk_len = 0;
++    u32 offset = 0;
++
++    if (base_address != dest) {
++        // Data is not aligned, write the first chunk
++        chunk_len = min(base_address + ATR0_TABLE_SIZE - dest, len);
++        write_memory_chunk(resources, base_address, dest - base_address, src, chunk_len);
++        offset += chunk_len;
++    }
++
++    while (offset < len) {
++        chunk_len = min(len - offset, ATR0_TABLE_SIZE);
++        write_memory_chunk(resources, dest + offset, 0, (const u8*)src + offset, chunk_len);
++        offset += chunk_len;
++    }
++}
++
++// Note: this function modify the device ATR table (that is also used by the firmware for control and vdma).
++// Use with caution, and restore the original atr if needed.
++static void read_memory(struct hailo_pcie_resources *resources, hailo_ptr_t src, void *dest, u32 len)
++{
++    hailo_ptr_t base_address = src & ~ATR0_TABLE_SIZE_MASK;
++    u32 chunk_len = 0;
++    u32 offset = 0;
++
++    if (base_address != src) {
++        // Data is not aligned, write the first chunk
++        chunk_len = min(base_address + ATR0_TABLE_SIZE - src, len);
++        read_memory_chunk(resources, base_address, src - base_address, dest, chunk_len);
++        offset += chunk_len;
++    }
++
++    while (offset < len) {
++        chunk_len = min(len - offset, ATR0_TABLE_SIZE);
++        read_memory_chunk(resources, src + offset, 0, (u8*)dest + offset, chunk_len);
++        offset += chunk_len;
++    }
++}
++
++static void hailo_write_app_firmware(struct hailo_pcie_resources *resources, firmware_header_t *fw_header,
++    secure_boot_certificate_t *fw_cert)
++{
++    const struct hailo_fw_addresses *fw_addresses = &(compat[resources->board_type].fw_addresses);
++    void *fw_code = (void*)((u8*)fw_header + sizeof(firmware_header_t));
++    void *key_data = &fw_cert->certificates_data[0];
++    void *content_data = &fw_cert->certificates_data[fw_cert->key_size];
++
++    write_memory(resources, fw_addresses->boot_fw_header, fw_header, sizeof(firmware_header_t));
++
++    write_memory(resources, fw_addresses->app_fw_code_ram_base, fw_code, fw_header->code_size);
++
++    write_memory(resources, fw_addresses->boot_key_cert, key_data, fw_cert->key_size);
++    write_memory(resources, fw_addresses->boot_cont_cert, content_data, fw_cert->content_size);
++}
++
++static void hailo_write_core_firmware(struct hailo_pcie_resources *resources, firmware_header_t *fw_header)
++{
++    const struct hailo_fw_addresses *fw_addresses = &(compat[resources->board_type].fw_addresses);
++    void *fw_code = (void*)((u8*)fw_header + sizeof(firmware_header_t));
++
++    write_memory(resources, fw_addresses->core_code_ram_base, fw_code, fw_header->code_size);
++    write_memory(resources, fw_addresses->core_fw_header, fw_header, sizeof(firmware_header_t));
++}
++
++static void hailo_trigger_firmware_boot(struct hailo_pcie_resources *resources)
++{
++    const struct hailo_fw_addresses *fw_addresses = &(compat[resources->board_type].fw_addresses);
++    u32 pcie_finished = 1;
++
++    write_memory(resources, fw_addresses->boot_fw_trigger,
++        (void*)&pcie_finished, sizeof(pcie_finished));
++}
++
++/**
++* Validates the FW headers.
++* @param[in] address                    Address of the firmware.
++* @param[in] firmware_size              Size of the firmware.
++* @param[out] out_app_firmware_header   (optional) App firmware header
++* @param[out] out_core_firmware_header  (optional) Core firmware header
++* @param[out] out_firmware_cert         (optional) Firmware certificate header
++*/
++static int FW_VALIDATION__validate_fw_headers(uintptr_t firmware_base_address, size_t firmware_size,
++    firmware_header_t **out_app_firmware_header, firmware_header_t **out_core_firmware_header,
++    secure_boot_certificate_t **out_firmware_cert, enum hailo_board_type board_type)
++{
++    firmware_header_t *app_firmware_header = NULL;
++    firmware_header_t *core_firmware_header = NULL;
++    secure_boot_certificate_t *firmware_cert = NULL;
++    int err = -EINVAL;
++    u32 consumed_firmware_offset = 0;
++
++    err = FW_VALIDATION__validate_fw_header(firmware_base_address, firmware_size, MAXIMUM_APP_FIRMWARE_CODE_SIZE,
++        &consumed_firmware_offset, &app_firmware_header, board_type);
++    if (0 != err) {
++        err = -EINVAL;
++        goto exit;
++    }
++
++    err = FW_VALIDATION__validate_cert_header(firmware_base_address, firmware_size,
++        &consumed_firmware_offset, &firmware_cert);
++    if (0 != err) {
++        err = -EINVAL;
++        goto exit;
++    }
++
++    err = FW_VALIDATION__validate_fw_header(firmware_base_address, firmware_size, MAXIMUM_CORE_FIRMWARE_CODE_SIZE,
++        &consumed_firmware_offset, &core_firmware_header, board_type);
++    if (0 != err) {
++        err = -EINVAL;
++        goto exit;
++    }
++
++    if (consumed_firmware_offset != firmware_size) {
++        /* it is an error if there is leftover data after the last firmware header */
++        err = -EINVAL;
++        goto exit;
++    }
++
++    /* the out params are all optional */
++    if (NULL != out_app_firmware_header) {
++        *out_app_firmware_header = app_firmware_header;
++    }
++    if (NULL != out_firmware_cert) {
++        *out_firmware_cert = firmware_cert;
++    }
++    if (NULL != out_core_firmware_header) {
++        *out_core_firmware_header = core_firmware_header;
++    }
++    err = 0;
++
++exit:
++    return err;
++}
++
++int hailo_pcie_write_firmware(struct hailo_pcie_resources *resources, const void *fw_data, size_t fw_size)
++{
++    firmware_header_t *app_firmware_header = NULL;
++    secure_boot_certificate_t *firmware_cert = NULL;
++    firmware_header_t *core_firmware_header = NULL;
++
++    int err = FW_VALIDATION__validate_fw_headers((uintptr_t)fw_data, fw_size,
++        &app_firmware_header, &core_firmware_header, &firmware_cert, resources->board_type);
++    if (err < 0) {
++        return err;
++    }
++
++    hailo_write_app_firmware(resources, app_firmware_header, firmware_cert);
++    hailo_write_core_firmware(resources, core_firmware_header);
++
++    hailo_trigger_firmware_boot(resources);
++
++    return 0;
++}
++
++bool hailo_pcie_is_firmware_loaded(struct hailo_pcie_resources *resources)
++{
++    u32 offset = ATR0_PCIE_BRIDGE_OFFSET + offsetof(struct hailo_atr_config, atr_trsl_addr_1);
++    u32 atr_value = hailo_resource_read32(&resources->config, offset);
++    return atr_value == compat[resources->board_type].fw_addresses.atr0_trsl_addr1;
++}
++
++bool hailo_pcie_wait_for_firmware(struct hailo_pcie_resources *resources)
++{
++    size_t retries;
++    for (retries = 0; retries < FIRMWARE_LOAD_WAIT_MAX_RETRIES; retries++) {
++        if (hailo_pcie_is_firmware_loaded(resources)) {
++            return true;
++        }
++
++        msleep(FIRMWARE_LOAD_SLEEP_MS);
++    }
++
++    return false;
++}
++
++int hailo_pcie_write_config_common(struct hailo_pcie_resources *resources, const void* config_data,
++    const size_t config_size, const struct hailo_config_constants *config_consts)
++{
++    if (config_size > config_consts->max_size) {
++        return -EINVAL;
++    }
++
++    write_memory(resources, config_consts->address, config_data, (u32)config_size);
++    return 0;
++}
++
++const struct hailo_config_constants* hailo_pcie_get_board_config_constants(const enum hailo_board_type board_type) {
++    BUG_ON(board_type >= HAILO_BOARD_TYPE_COUNT || board_type < 0);
++    return &compat[board_type].board_cfg;
++}
++
++const struct hailo_config_constants* hailo_pcie_get_user_config_constants(const enum hailo_board_type board_type) {
++    BUG_ON(board_type >= HAILO_BOARD_TYPE_COUNT || board_type < 0);
++    return &compat[board_type].fw_cfg;
++}
++
++const char* hailo_pcie_get_fw_filename(const enum hailo_board_type board_type) {
++    BUG_ON(board_type >= HAILO_BOARD_TYPE_COUNT || board_type < 0);
++    return compat[board_type].fw_filename;
++}
++
++void hailo_pcie_update_channel_interrupts_mask(struct hailo_pcie_resources* resources, u32 channels_bitmap)
++{
++    size_t i = 0;
++    u32 mask = hailo_resource_read32(&resources->config, BSC_IMASK_HOST);
++
++    // Clear old channel interrupts
++    mask &= ~BCS_ISTATUS_HOST_VDMA_SRC_IRQ_MASK;
++    mask &= ~BCS_ISTATUS_HOST_VDMA_DEST_IRQ_MASK;
++    // Set interrupt by the bitmap
++    for (i = 0; i < MAX_VDMA_CHANNELS_PER_ENGINE; ++i) {
++        if (hailo_test_bit(i, &channels_bitmap)) {
++            // based on 18.5.2 "vDMA Interrupt Registers" in PLDA documentation
++            u32 offset = (i < VDMA_DEST_CHANNELS_START) ? 0 : 8;
++            hailo_set_bit((((int)i*8) / MAX_VDMA_CHANNELS_PER_ENGINE) + offset, &mask);
++        }
++    }
++    hailo_resource_write32(&resources->config, BSC_IMASK_HOST, mask);
++}
++
++void hailo_pcie_enable_interrupts(struct hailo_pcie_resources *resources)
++{
++    u32 mask = hailo_resource_read32(&resources->config, BSC_IMASK_HOST);
++
++    hailo_resource_write32(&resources->config, BCS_ISTATUS_HOST, 0xFFFFFFFF);
++    hailo_resource_write32(&resources->config, BCS_DESTINATION_INTERRUPT_PER_CHANNEL, 0xFFFFFFFF);
++    hailo_resource_write32(&resources->config, BCS_SOURCE_INTERRUPT_PER_CHANNEL, 0xFFFFFFFF);
++
++    mask |= BCS_ISTATUS_HOST_FW_IRQ_CONTROL_MASK | BCS_ISTATUS_HOST_FW_IRQ_NOTIFICATION | BCS_ISTATUS_HOST_DRIVER_DOWN;
++    hailo_resource_write32(&resources->config, BSC_IMASK_HOST, mask);
++}
++
++void hailo_pcie_disable_interrupts(struct hailo_pcie_resources* resources)
++{
++    hailo_resource_write32(&resources->config, BSC_IMASK_HOST, 0);
++}
++
++long hailo_pcie_read_firmware_log(struct hailo_pcie_resources *resources, struct hailo_read_log_params *params)
++{
++    long err = 0;
++    struct hailo_resource log_resource = {resources->fw_access.address, DEBUG_BUFFER_TOTAL_SIZE};
++
++    if (HAILO_CPU_ID_CPU0 == params->cpu_id) {
++        log_resource.address += PCIE_APP_CPU_DEBUG_OFFSET;
++    } else if (HAILO_CPU_ID_CPU1 == params->cpu_id) {
++        log_resource.address += PCIE_CORE_CPU_DEBUG_OFFSET;
++    } else {
++        return -EINVAL;
++    }
++
++    if (0 == params->buffer_size) {
++        params->read_bytes = 0;
++        return 0;
++    }
++
++    err = hailo_read_firmware_log(&log_resource, params);
++    if (0 != err) {
++        return err;
++    }
++
++    return 0;
++}
++
++static int direct_memory_transfer(struct hailo_pcie_resources *resources,
++    struct hailo_memory_transfer_params *params)
++{
++    int err = -EINVAL;
++    struct hailo_atr_config previous_atr = {0};
++
++    if (params->address > U32_MAX) {
++        return -EFAULT;
++    }
++
++    // Store previous ATR (Read/write modify the ATR).
++    read_atr_table(resources, &previous_atr);
++
++    switch (params->transfer_direction) {
++    case TRANSFER_READ:
++        read_memory(resources, (u32)params->address, params->buffer, (u32)params->count);
++        break;
++    case TRANSFER_WRITE:
++        write_memory(resources, (u32)params->address, params->buffer, (u32)params->count);
++        break;
++    default:
++        err = -EINVAL;
++        goto restore_atr;
++    }
++
++    err = 0;
++restore_atr:
++    write_atr_table(resources, &previous_atr);
++    return err;
++}
++
++int hailo_pcie_memory_transfer(struct hailo_pcie_resources *resources, struct hailo_memory_transfer_params *params)
++{
++    if (params->count > ARRAY_SIZE(params->buffer)) {
++        return -EINVAL;
++    }
++
++    switch (params->memory_type) {
++    case HAILO_TRANSFER_DEVICE_DIRECT_MEMORY:
++        return direct_memory_transfer(resources, params);
++    case HAILO_TRANSFER_MEMORY_PCIE_BAR0:
++        return hailo_resource_transfer(&resources->config, params);
++    case HAILO_TRANSFER_MEMORY_PCIE_BAR2:
++    case HAILO_TRANSFER_MEMORY_VDMA0:
++        return hailo_resource_transfer(&resources->vdma_registers, params);
++    case HAILO_TRANSFER_MEMORY_PCIE_BAR4:
++        return hailo_resource_transfer(&resources->fw_access, params);
++    default:
++        return -EINVAL;
++    }
++}
++
++bool hailo_pcie_is_device_connected(struct hailo_pcie_resources *resources)
++{
++    return PCI_VENDOR_ID_HAILO == hailo_resource_read16(&resources->config, PCIE_CONFIG_VENDOR_OFFSET);
++}
++
++// On PCIe, just return the address
++static u64 encode_dma_address(dma_addr_t dma_address, u8 channel_id)
++{
++    (void)channel_id;
++    return (u64)dma_address;
++}
++
++struct hailo_vdma_hw hailo_pcie_vdma_hw = {
++    .hw_ops = {
++        .encode_desc_dma_address = encode_dma_address
++    },
++    .ddr_data_id = HAILO_PCIE_HOST_DMA_DATA_ID,
++    .device_interrupts_bitmask = HAILO_PCIE_DMA_DEVICE_INTERRUPTS_BITMASK,
++    .host_interrupts_bitmask = HAILO_PCIE_DMA_HOST_INTERRUPTS_BITMASK,
++
++};
+\ No newline at end of file
+--- /dev/null
++++ b/drivers/media/pci/hailo/common/pcie_common.h
+@@ -0,0 +1,128 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#ifndef _HAILO_COMMON_PCIE_COMMON_H_
++#define _HAILO_COMMON_PCIE_COMMON_H_
++
++#include "hailo_resource.h"
++#include "hailo_ioctl_common.h"
++#include "fw_validation.h"
++#include "fw_operation.h"
++#include "utils.h"
++#include "vdma_common.h"
++
++#include <linux/types.h>
++
++
++#define BCS_ISTATUS_HOST_FW_IRQ_CONTROL_MASK (0x04000000)
++#define BCS_ISTATUS_HOST_FW_IRQ_NOTIFICATION (0x02000000)
++#define BCS_ISTATUS_HOST_DRIVER_DOWN         (0x08000000)
++#define BCS_ISTATUS_HOST_VDMA_SRC_IRQ_MASK   (0x000000FF)
++#define BCS_ISTATUS_HOST_VDMA_DEST_IRQ_MASK  (0x0000FF00)
++
++#define PCIE_HAILO8_BOARD_CFG_MAX_SIZE          (0x500)
++#define PCIE_HAILO8_FW_CFG_MAX_SIZE             (0x500)
++
++#define FW_CODE_SECTION_ALIGNMENT (4)
++
++#define HAILO_PCIE_CONFIG_BAR       (0)
++#define HAILO_PCIE_VDMA_REGS_BAR    (2)
++#define HAILO_PCIE_FW_ACCESS_BAR    (4)
++
++#define HAILO_PCIE_DMA_ENGINES_COUNT (1)
++
++#define DRIVER_NAME		"hailo"
++
++#define PCI_VENDOR_ID_HAILO           0x1e60
++#define PCI_DEVICE_ID_HAILO_HAILO8    0x2864
++#define PCI_DEVICE_ID_HAILO_HAILO15   0x45C4
++#define PCI_DEVICE_ID_HAILO_PLUTO     0x43a2
++
++struct hailo_pcie_resources {
++    struct hailo_resource config;               // BAR0
++    struct hailo_resource vdma_registers;       // BAR2
++    struct hailo_resource fw_access;            // BAR4
++    enum hailo_board_type board_type;
++};
++
++enum hailo_pcie_interrupt_masks {
++    FW_CONTROL = BCS_ISTATUS_HOST_FW_IRQ_CONTROL_MASK,
++    FW_NOTIFICATION = BCS_ISTATUS_HOST_FW_IRQ_NOTIFICATION,
++    DRIVER_DOWN = BCS_ISTATUS_HOST_DRIVER_DOWN,
++    VDMA_SRC_IRQ_MASK = BCS_ISTATUS_HOST_VDMA_SRC_IRQ_MASK,
++    VDMA_DEST_IRQ_MASK = BCS_ISTATUS_HOST_VDMA_DEST_IRQ_MASK
++};
++
++struct hailo_pcie_interrupt_source {
++    u32 interrupt_bitmask;
++    u32 vdma_channels_bitmap;
++};
++
++struct hailo_config_constants {
++    const char *filename;
++    u32 address;
++    size_t max_size;
++};
++
++// TODO: HRT-6144 - Align Windows/Linux to QNX
++#ifdef __QNX__
++enum hailo_bar_index {
++    BAR0 = 0,
++    BAR2,
++    BAR4,
++    MAX_BAR
++};
++#else
++enum hailo_bar_index {
++    BAR0 = 0,
++    BAR1,
++    BAR2,
++    BAR3,
++    BAR4,
++    BAR5,
++    MAX_BAR
++};
++#endif // ifdef (__QNX__)
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++extern struct hailo_vdma_hw hailo_pcie_vdma_hw;
++
++// Reads the interrupt source from BARs, return false if there is no interrupt.
++// note - this function clears the interrupt signals.
++bool hailo_pcie_read_interrupt(struct hailo_pcie_resources *resources, struct hailo_pcie_interrupt_source *source);
++void hailo_pcie_update_channel_interrupts_mask(struct hailo_pcie_resources *resources, u32 channels_bitmap);
++void hailo_pcie_enable_interrupts(struct hailo_pcie_resources *resources);
++void hailo_pcie_disable_interrupts(struct hailo_pcie_resources *resources);
++
++int hailo_pcie_write_firmware_control(struct hailo_pcie_resources *resources, const struct hailo_fw_control *command);
++int hailo_pcie_read_firmware_control(struct hailo_pcie_resources *resources, struct hailo_fw_control *command);
++
++int hailo_pcie_write_firmware(struct hailo_pcie_resources *resources, const void *fw_data, size_t fw_size);
++bool hailo_pcie_is_firmware_loaded(struct hailo_pcie_resources *resources);
++bool hailo_pcie_wait_for_firmware(struct hailo_pcie_resources *resources);
++
++int hailo_pcie_read_firmware_notification(struct hailo_pcie_resources *resources,
++    struct hailo_d2h_notification *notification);
++
++int hailo_pcie_write_config_common(struct hailo_pcie_resources *resources, const void* config_data,
++    const size_t config_size, const struct hailo_config_constants *config_consts);
++const struct hailo_config_constants* hailo_pcie_get_board_config_constants(const enum hailo_board_type board_type);
++const struct hailo_config_constants* hailo_pcie_get_user_config_constants(const enum hailo_board_type board_type);
++const char* hailo_pcie_get_fw_filename(const enum hailo_board_type board_type);
++
++long hailo_pcie_read_firmware_log(struct hailo_pcie_resources *resources, struct hailo_read_log_params *params);
++int hailo_pcie_memory_transfer(struct hailo_pcie_resources *resources, struct hailo_memory_transfer_params *params);
++
++bool hailo_pcie_is_device_connected(struct hailo_pcie_resources *resources);
++void hailo_pcie_write_firmware_driver_shutdown(struct hailo_pcie_resources *resources);
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* _HAILO_COMMON_PCIE_COMMON_H_ */
+\ No newline at end of file
+--- /dev/null
++++ b/drivers/media/pci/hailo/common/utils.h
+@@ -0,0 +1,39 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#ifndef _HAILO_DRIVER_UTILS_H_
++#define _HAILO_DRIVER_UTILS_H_
++
++#include <linux/bitops.h>
++
++#define hailo_clear_bit(bit, pval)  { *(pval) &= ~(1 << bit); }
++#define hailo_test_bit(pos,var_addr)  ((*var_addr) & (1<<(pos)))
++
++#ifdef __cplusplus
++extern "C"
++{
++#endif
++
++static inline bool is_powerof2(size_t v) {
++    // bit trick
++    return (v & (v - 1)) == 0;
++}
++
++static inline void hailo_set_bit(int nr, u32* addr) {
++	u32 mask = BIT_MASK(nr);
++	u32 *p = addr + BIT_WORD(nr);
++
++	*p  |= mask;
++}
++
++#ifndef DIV_ROUND_UP
++#define DIV_ROUND_UP(n,d) (((n) + (d) - 1) / (d))
++#endif
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif // _HAILO_DRIVER_UTILS_H_
+\ No newline at end of file
+--- /dev/null
++++ b/drivers/media/pci/hailo/common/vdma_common.c
+@@ -0,0 +1,684 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#include "vdma_common.h"
++
++#include <linux/types.h>
++#include <linux/errno.h>
++#include <linux/bug.h>
++#include <linux/circ_buf.h>
++#include <linux/ktime.h>
++#include <linux/timekeeping.h>
++#include <linux/kernel.h>
++#include <linux/kconfig.h>
++#include <linux/printk.h>
++
++
++#define CHANNEL_BASE_OFFSET(channel_index) ((channel_index) << 5)
++#define CHANNEL_HOST_OFFSET(channel_index) CHANNEL_BASE_OFFSET(channel_index) + \
++    (channel_index < VDMA_DEST_CHANNELS_START ? 0 : 0x10)
++#define CHANNEL_DEVICE_OFFSET(channel_index) CHANNEL_BASE_OFFSET(channel_index) + \
++    (channel_index < VDMA_DEST_CHANNELS_START ? 0x10 : 0)
++
++#define CHANNEL_CONTROL_OFFSET      (0x0)
++#define CHANNEL_NUM_AVAIL_OFFSET    (0x2)
++#define CHANNEL_NUM_PROC_OFFSET     (0x4)
++#define CHANNEL_ERROR_OFFSET        (0x8)
++
++#define VDMA_CHANNEL_CONTROL_START (0x1)
++#define VDMA_CHANNEL_CONTROL_ABORT (0b00)
++#define VDMA_CHANNEL_CONTROL_ABORT_PAUSE (0b10)
++#define VDMA_CHANNEL_CONTROL_START_ABORT_PAUSE_RESUME_BITMASK (0x3)
++#define VDMA_CHANNEL_CONTROL_START_ABORT_BITMASK (0x1)
++
++#define DESCRIPTOR_PAGE_SIZE_SHIFT (8)
++#define DESCRIPTOR_DESC_CONTROL (0x2)
++#define DESCRIPTOR_ADDR_L_MASK (0xFFFFFFC0)
++
++#define DESCRIPTOR_DESC_STATUS_DONE_BIT  (0x0)
++#define DESCRIPTOR_DESC_STATUS_ERROR_BIT (0x1)
++#define DESCRIPTOR_DESC_STATUS_MASK (0xFF)
++
++#define DESC_STATUS_REQ                       (1 << 0)
++#define DESC_STATUS_REQ_ERR                   (1 << 1)
++#define DESC_REQUEST_IRQ_PROCESSED            (1 << 2)
++#define DESC_REQUEST_IRQ_ERR                  (1 << 3)
++
++
++#define DWORD_SIZE                  (4)
++#define WORD_SIZE                   (2)
++#define BYTE_SIZE                   (1)
++
++#define TIMESTAMPS_CIRC_SPACE(timestamp_list) \
++    CIRC_SPACE((timestamp_list).head, (timestamp_list).tail, CHANNEL_IRQ_TIMESTAMPS_SIZE)
++#define TIMESTAMPS_CIRC_CNT(timestamp_list) \
++    CIRC_CNT((timestamp_list).head, (timestamp_list).tail, CHANNEL_IRQ_TIMESTAMPS_SIZE)
++
++#define ONGOING_TRANSFERS_CIRC_SPACE(transfers_list) \
++    CIRC_SPACE((transfers_list).head, (transfers_list).tail, HAILO_VDMA_MAX_ONGOING_TRANSFERS)
++#define ONGOING_TRANSFERS_CIRC_CNT(transfers_list) \
++    CIRC_CNT((transfers_list).head, (transfers_list).tail, HAILO_VDMA_MAX_ONGOING_TRANSFERS)
++
++#ifndef for_each_sgtable_dma_sg
++#define for_each_sgtable_dma_sg(sgt, sg, i)	\
++    for_each_sg((sgt)->sgl, sg, (sgt)->nents, i)
++#endif /* for_each_sgtable_dma_sg */
++
++
++static int ongoing_transfer_push(struct hailo_vdma_channel *channel,
++    struct hailo_ongoing_transfer *ongoing_transfer)
++{
++    struct hailo_ongoing_transfers_list *transfers = &channel->ongoing_transfers;
++    if (!ONGOING_TRANSFERS_CIRC_SPACE(*transfers)) {
++        return -EFAULT;
++    }
++
++    if (ongoing_transfer->dirty_descs_count > ARRAY_SIZE(ongoing_transfer->dirty_descs)) {
++        return -EFAULT;
++    }
++
++    transfers->transfers[transfers->head] = *ongoing_transfer;
++    transfers->head = (transfers->head + 1) & HAILO_VDMA_MAX_ONGOING_TRANSFERS_MASK;
++    return 0;
++}
++
++static int ongoing_transfer_pop(struct hailo_vdma_channel *channel,
++    struct hailo_ongoing_transfer *ongoing_transfer)
++{
++    struct hailo_ongoing_transfers_list *transfers = &channel->ongoing_transfers;
++    if (!ONGOING_TRANSFERS_CIRC_CNT(*transfers)) {
++        return -EFAULT;
++    }
++
++    if (ongoing_transfer) {
++        *ongoing_transfer = transfers->transfers[transfers->tail];
++    }
++    transfers->tail = (transfers->tail + 1) & HAILO_VDMA_MAX_ONGOING_TRANSFERS_MASK;
++    return 0;
++}
++
++static void clear_dirty_desc(struct hailo_vdma_descriptors_list *desc_list, u16 desc)
++{
++    desc_list->desc_list[desc].PageSize_DescControl =
++        (u32)((desc_list->desc_page_size << DESCRIPTOR_PAGE_SIZE_SHIFT) + DESCRIPTOR_DESC_CONTROL);
++}
++
++static void clear_dirty_descs(struct hailo_vdma_channel *channel,
++    struct hailo_ongoing_transfer *ongoing_transfer)
++{
++    u8 i = 0;
++    struct hailo_vdma_descriptors_list *desc_list = channel->last_desc_list;
++    BUG_ON(ongoing_transfer->dirty_descs_count > ARRAY_SIZE(ongoing_transfer->dirty_descs));
++    for (i = 0; i < ongoing_transfer->dirty_descs_count; i++) {
++        clear_dirty_desc(desc_list, ongoing_transfer->dirty_descs[i]);
++    }
++}
++
++static bool validate_last_desc_status(struct hailo_vdma_channel *channel,
++    struct hailo_ongoing_transfer *ongoing_transfer)
++{
++    u16 last_desc = ongoing_transfer->last_desc;
++    u32 last_desc_control = channel->last_desc_list->desc_list[last_desc].RemainingPageSize_Status &
++        DESCRIPTOR_DESC_STATUS_MASK;
++    if (!hailo_test_bit(DESCRIPTOR_DESC_STATUS_DONE_BIT, &last_desc_control)) {
++        pr_err("Expecting desc %d to be done\n", last_desc);
++        return false;
++    }
++    if (hailo_test_bit(DESCRIPTOR_DESC_STATUS_ERROR_BIT, &last_desc_control)) {
++        pr_err("Got unexpected error on desc %d\n", last_desc);
++        return false;
++    }
++
++    return true;
++}
++
++void hailo_vdma_program_descriptor(struct hailo_vdma_descriptor *descriptor, u64 dma_address, size_t page_size,
++    u8 data_id)
++{
++    descriptor->PageSize_DescControl = (u32)((page_size << DESCRIPTOR_PAGE_SIZE_SHIFT) +
++        DESCRIPTOR_DESC_CONTROL);
++    descriptor->AddrL_rsvd_DataID = (u32)(((dma_address & DESCRIPTOR_ADDR_L_MASK)) | data_id);
++    descriptor->AddrH = (u32)(dma_address >> 32);
++    descriptor->RemainingPageSize_Status = 0 ;
++}
++
++static u8 get_channel_id(u8 channel_index)
++{
++    if (channel_index < VDMA_DEST_CHANNELS_START) {
++        // H2D channel
++        return channel_index;
++    }
++    else if ((channel_index >= VDMA_DEST_CHANNELS_START) &&
++             (channel_index < MAX_VDMA_CHANNELS_PER_ENGINE)) {
++        // D2H channel
++        return channel_index - VDMA_DEST_CHANNELS_START;
++    }
++    else {
++        return INVALID_VDMA_CHANNEL;
++    }
++}
++
++static int program_descriptors_in_chunk(
++    struct hailo_vdma_hw *vdma_hw,
++    dma_addr_t chunk_addr,
++    unsigned int chunk_size,
++    struct hailo_vdma_descriptors_list *desc_list,
++    u32 desc_index,
++    u32 max_desc_index,
++    u8 channel_id)
++{
++    const u32 desc_per_chunk = DIV_ROUND_UP(chunk_size, desc_list->desc_page_size);
++    struct hailo_vdma_descriptor *dma_desc = NULL;
++    u16 size_to_program = 0;
++    u32 index = 0;
++    u64 encoded_addr = 0;
++
++    for (index = 0; index < desc_per_chunk; index++) {
++        if (desc_index > max_desc_index) {
++            return -ERANGE;
++        }
++
++        encoded_addr = vdma_hw->hw_ops.encode_desc_dma_address(chunk_addr, channel_id);
++        if (INVALID_VDMA_ADDRESS == encoded_addr) {
++            return -EFAULT;
++        }
++
++        dma_desc = &desc_list->desc_list[desc_index % desc_list->desc_count];
++        size_to_program = chunk_size > desc_list->desc_page_size ?
++            desc_list->desc_page_size : (u16)chunk_size;
++        hailo_vdma_program_descriptor(dma_desc, encoded_addr, size_to_program, vdma_hw->ddr_data_id);
++
++        chunk_addr += size_to_program;
++        chunk_size -= size_to_program;
++        desc_index++;
++    }
++
++    return (int)desc_per_chunk;
++}
++
++int hailo_vdma_program_descriptors_list(
++    struct hailo_vdma_hw *vdma_hw,
++    struct hailo_vdma_descriptors_list *desc_list,
++    u32 starting_desc,
++    struct hailo_vdma_mapped_transfer_buffer *buffer,
++    u8 channel_index)
++{
++    const u8 channel_id = get_channel_id(channel_index);
++    int desc_programmed = 0;
++    u32 max_desc_index = 0;
++    u32 chunk_size = 0;
++    struct scatterlist *sg_entry = NULL;
++    unsigned int i = 0;
++    int ret = 0;
++    size_t buffer_current_offset = 0;
++    dma_addr_t chunk_start_addr = 0;
++    u32 program_size = buffer->size;
++
++    if (starting_desc >= desc_list->desc_count) {
++        return -EFAULT;
++    }
++
++    if (buffer->offset % desc_list->desc_page_size != 0) {
++        return -EFAULT;
++    }
++
++    // On circular buffer, allow programming  desc_count descriptors (starting
++    // from starting_desc). On non circular, don't allow is to pass desc_count
++    max_desc_index = desc_list->is_circular ?
++        starting_desc + desc_list->desc_count - 1 :
++        desc_list->desc_count - 1;
++    for_each_sgtable_dma_sg(buffer->sg_table, sg_entry, i) {
++        // Skip sg entries until we reach the right buffer offset. offset can be in the middle of an sg entry.
++        if (buffer_current_offset + sg_dma_len(sg_entry) < buffer->offset) {
++            buffer_current_offset += sg_dma_len(sg_entry);
++            continue;
++        }
++        chunk_start_addr = (buffer_current_offset < buffer->offset) ?
++            sg_dma_address(sg_entry) + (buffer->offset - buffer_current_offset) :
++            sg_dma_address(sg_entry);
++        chunk_size = (buffer_current_offset < buffer->offset) ?
++            (u32)(sg_dma_len(sg_entry) - (buffer->offset - buffer_current_offset)) :
++            (u32)(sg_dma_len(sg_entry));
++        chunk_size = min((u32)program_size, chunk_size);
++
++        ret = program_descriptors_in_chunk(vdma_hw, chunk_start_addr, chunk_size, desc_list,
++            starting_desc, max_desc_index, channel_id);
++        if (ret < 0) {
++            return ret;
++        }
++
++        desc_programmed += ret;
++        starting_desc = starting_desc + ret;
++        program_size -= chunk_size;
++        buffer_current_offset += sg_dma_len(sg_entry);
++    }
++
++    if (program_size != 0) {
++        // We didn't program all the buffer.
++        return -EFAULT;
++    }
++
++    return desc_programmed;
++}
++
++static bool channel_control_reg_is_active(u8 control)
++{
++    return (control & VDMA_CHANNEL_CONTROL_START_ABORT_BITMASK) == VDMA_CHANNEL_CONTROL_START;
++}
++
++static int validate_channel_state(struct hailo_vdma_channel *channel)
++{
++    const u8 control = ioread8(channel->host_regs + CHANNEL_CONTROL_OFFSET);
++    const u16 hw_num_avail = ioread16(channel->host_regs + CHANNEL_NUM_AVAIL_OFFSET);
++
++    if (!channel_control_reg_is_active(control)) {
++        pr_err("Channel %d is not active\n", channel->index);
++        return -EBUSY;
++    }
++
++    if (hw_num_avail != channel->state.num_avail) {
++        pr_err("Channel %d hw state out of sync. num available is %d, expected %d\n",
++            channel->index, hw_num_avail, channel->state.num_avail);
++        return -EFAULT;
++    }
++
++    return 0;
++}
++
++static unsigned long get_interrupts_bitmask(struct hailo_vdma_hw *vdma_hw,
++    enum hailo_vdma_interrupts_domain interrupts_domain, bool is_debug)
++{
++    unsigned long bitmask = 0;
++
++    if (0 != (HAILO_VDMA_INTERRUPTS_DOMAIN_DEVICE & interrupts_domain)) {
++        bitmask |= vdma_hw->device_interrupts_bitmask;
++    }
++    if (0 != (HAILO_VDMA_INTERRUPTS_DOMAIN_HOST & interrupts_domain)) {
++        bitmask |= vdma_hw->host_interrupts_bitmask;
++    }
++
++    if (bitmask != 0) {
++        bitmask |= DESC_REQUEST_IRQ_PROCESSED | DESC_REQUEST_IRQ_ERR;
++        if (is_debug) {
++            bitmask |= DESC_STATUS_REQ | DESC_STATUS_REQ_ERR;
++        }
++    }
++
++    return bitmask;
++}
++
++static void set_num_avail(u8 __iomem *host_regs, u16 num_avail)
++{
++    iowrite16(num_avail, host_regs + CHANNEL_NUM_AVAIL_OFFSET);
++}
++
++static u16 get_num_proc(u8 __iomem *host_regs)
++{
++    return ioread16(host_regs + CHANNEL_NUM_PROC_OFFSET);
++}
++
++static int program_last_desc(
++    struct hailo_vdma_descriptors_list *desc_list,
++    u32 starting_desc,
++    struct hailo_vdma_mapped_transfer_buffer *transfer_buffer)
++{
++    u32 total_descs = DIV_ROUND_UP(transfer_buffer->size, desc_list->desc_page_size);
++    u32 last_desc = (starting_desc + total_descs - 1) % desc_list->desc_count;
++    u32 last_desc_size = transfer_buffer->size - (total_descs - 1) * desc_list->desc_page_size;
++
++    // Configure only last descriptor with residue size
++    desc_list->desc_list[last_desc].PageSize_DescControl = (u32)
++        ((last_desc_size << DESCRIPTOR_PAGE_SIZE_SHIFT) + DESCRIPTOR_DESC_CONTROL);
++    return (int)total_descs;
++}
++
++int hailo_vdma_launch_transfer(
++    struct hailo_vdma_hw *vdma_hw,
++    struct hailo_vdma_channel *channel,
++    struct hailo_vdma_descriptors_list *desc_list,
++    u32 starting_desc,
++    u8 buffers_count,
++    struct hailo_vdma_mapped_transfer_buffer *buffers,
++    bool should_bind,
++    enum hailo_vdma_interrupts_domain first_interrupts_domain,
++    enum hailo_vdma_interrupts_domain last_desc_interrupts,
++    bool is_debug)
++{
++    int ret = -EFAULT;
++    u32 total_descs = 0;
++    u32 first_desc = starting_desc;
++    u32 last_desc = U32_MAX;
++    u16 new_num_avail = 0;
++    struct hailo_ongoing_transfer ongoing_transfer = {0};
++    u8 i = 0;
++
++    channel->state.desc_count_mask = (desc_list->desc_count - 1);
++
++    if (NULL == channel->last_desc_list) {
++        // First transfer on this active channel, store desc list.
++        channel->last_desc_list = desc_list;
++    } else if (desc_list != channel->last_desc_list) {
++        // Shouldn't happen, desc list may change only after channel deactivation.
++        pr_err("Inconsistent desc list given to channel %d\n", channel->index);
++        return -EINVAL;
++    }
++
++    if (channel->state.num_avail != (u16)starting_desc) {
++        pr_err("Channel %d state out of sync. num available is %d, expected %d\n",
++            channel->index, channel->state.num_avail, (u16)starting_desc);
++        return -EFAULT;
++    }
++
++    if (buffers_count > HAILO_MAX_BUFFERS_PER_SINGLE_TRANSFER) {
++        pr_err("Too many buffers %u for single transfer\n", buffers_count);
++        return -EINVAL;
++    }
++
++    if (is_debug) {
++        ret = validate_channel_state(channel);
++        if (ret < 0) {
++            return ret;
++        }
++    }
++
++    BUILD_BUG_ON_MSG((HAILO_MAX_BUFFERS_PER_SINGLE_TRANSFER + 1) != ARRAY_SIZE(ongoing_transfer.dirty_descs),
++        "Unexpected amount of dirty descriptors");
++    ongoing_transfer.dirty_descs_count = buffers_count + 1;
++    ongoing_transfer.dirty_descs[0] = (u16)starting_desc;
++
++    for (i = 0; i < buffers_count; i++) {
++        ret = should_bind ?
++            hailo_vdma_program_descriptors_list(vdma_hw, desc_list, starting_desc, &buffers[i], channel->index) :
++            program_last_desc(desc_list, starting_desc, &buffers[i]);
++        if (ret < 0) {
++            return ret;
++        }
++        total_descs += ret;
++        last_desc = (starting_desc + ret - 1) % desc_list->desc_count;
++        starting_desc = (starting_desc + ret) % desc_list->desc_count;
++
++        ongoing_transfer.dirty_descs[i+1] = (u16)last_desc;
++        ongoing_transfer.buffers[i] = buffers[i];
++    }
++    ongoing_transfer.buffers_count = buffers_count;
++
++    desc_list->desc_list[first_desc].PageSize_DescControl |=
++        get_interrupts_bitmask(vdma_hw, first_interrupts_domain, is_debug);
++    desc_list->desc_list[last_desc].PageSize_DescControl |=
++        get_interrupts_bitmask(vdma_hw, last_desc_interrupts, is_debug);
++
++    ongoing_transfer.last_desc = (u16)last_desc;
++    ongoing_transfer.is_debug = is_debug;
++    ret = ongoing_transfer_push(channel, &ongoing_transfer);
++    if (ret < 0) {
++        pr_err("Failed push ongoing transfer to channel %d\n", channel->index);
++        return ret;
++    }
++
++    new_num_avail = (u16)((last_desc + 1) % desc_list->desc_count);
++    channel->state.num_avail = new_num_avail;
++    set_num_avail(channel->host_regs, new_num_avail);
++
++    return (int)total_descs;
++}
++
++static void hailo_vdma_push_timestamp(struct hailo_vdma_channel *channel)
++{
++    struct hailo_channel_interrupt_timestamp_list *timestamp_list = &channel->timestamp_list;
++    const u16 num_proc = get_num_proc(channel->host_regs);
++    if (TIMESTAMPS_CIRC_SPACE(*timestamp_list) != 0) {
++        timestamp_list->timestamps[timestamp_list->head].timestamp_ns = ktime_get_ns();
++        timestamp_list->timestamps[timestamp_list->head].desc_num_processed = num_proc;
++        timestamp_list->head = (timestamp_list->head + 1) & CHANNEL_IRQ_TIMESTAMPS_SIZE_MASK;
++    }
++}
++
++// Returns false if there are no items
++static bool hailo_vdma_pop_timestamp(struct hailo_channel_interrupt_timestamp_list *timestamp_list,
++    struct hailo_channel_interrupt_timestamp *out_timestamp)
++{
++    if (0 == TIMESTAMPS_CIRC_CNT(*timestamp_list)) {
++        return false;
++    }
++
++    *out_timestamp = timestamp_list->timestamps[timestamp_list->tail];
++    timestamp_list->tail = (timestamp_list->tail+1) & CHANNEL_IRQ_TIMESTAMPS_SIZE_MASK;
++    return true;
++}
++
++static void hailo_vdma_pop_timestamps_to_response(struct hailo_vdma_channel *channel,
++    struct hailo_vdma_interrupts_read_timestamp_params *result)
++{
++    const u32 max_timestamps = ARRAY_SIZE(result->timestamps);
++    u32 i = 0;
++
++    while (hailo_vdma_pop_timestamp(&channel->timestamp_list, &result->timestamps[i]) &&
++        (i < max_timestamps)) {
++        // Although the hw_num_processed should be a number between 0 and
++        // desc_count-1, if desc_count < 0x10000 (the maximum desc size),
++        // the actual hw_num_processed is a number between 1 and desc_count.
++        // Therefore the value can be desc_count, in this case we change it to
++        // zero.
++        result->timestamps[i].desc_num_processed = result->timestamps[i].desc_num_processed &
++            channel->state.desc_count_mask;
++        i++;
++    }
++
++    result->timestamps_count = i;
++}
++
++static void channel_state_init(struct hailo_vdma_channel_state *state)
++{
++    state->num_avail = state->num_proc = 0;
++
++    // Special value used when the channel is not activate.
++    state->desc_count_mask = U32_MAX;
++}
++
++void hailo_vdma_engine_init(struct hailo_vdma_engine *engine, u8 engine_index,
++    const struct hailo_resource *channel_registers)
++{
++    u8 channel_index = 0;
++    struct hailo_vdma_channel *channel;
++
++    engine->index = engine_index;
++    engine->enabled_channels = 0x0;
++    engine->interrupted_channels = 0x0;
++
++    for_each_vdma_channel(engine, channel, channel_index) {
++        u8 __iomem *regs_base = (u8 __iomem *)channel_registers->address;
++        channel->host_regs = regs_base + CHANNEL_HOST_OFFSET(channel_index);
++        channel->device_regs = regs_base + CHANNEL_DEVICE_OFFSET(channel_index);
++        channel->index = channel_index;
++        channel->timestamp_measure_enabled = false;
++
++        channel_state_init(&channel->state);
++        channel->last_desc_list = NULL;
++
++        channel->ongoing_transfers.head = 0;
++        channel->ongoing_transfers.tail = 0;
++    }
++}
++
++void hailo_vdma_engine_enable_channel_interrupts(struct hailo_vdma_engine *engine, u32 bitmap,
++    bool measure_timestamp)
++{
++    struct hailo_vdma_channel *channel = NULL;
++    u8 channel_index = 0;
++
++    for_each_vdma_channel(engine, channel, channel_index) {
++        if (hailo_test_bit(channel_index, &bitmap)) {
++            channel->timestamp_measure_enabled = measure_timestamp;
++            channel->timestamp_list.head = channel->timestamp_list.tail = 0;
++        }
++    }
++
++    engine->enabled_channels |= bitmap;
++}
++
++void hailo_vdma_engine_disable_channel_interrupts(struct hailo_vdma_engine *engine, u32 bitmap)
++{
++    struct hailo_vdma_channel *channel = NULL;
++    u8 channel_index = 0;
++
++    engine->enabled_channels &= ~bitmap;
++
++    for_each_vdma_channel(engine, channel, channel_index) {
++        channel_state_init(&channel->state);
++
++        while (ONGOING_TRANSFERS_CIRC_CNT(channel->ongoing_transfers) > 0) {
++            struct hailo_ongoing_transfer transfer;
++            ongoing_transfer_pop(channel, &transfer);
++
++            if (channel->last_desc_list == NULL) {
++                pr_err("Channel %d has ongoing transfers but no desc list\n", channel->index);
++                continue;
++            }
++
++            clear_dirty_descs(channel, &transfer);
++        }
++
++        channel->last_desc_list = NULL;
++    }
++}
++
++void hailo_vdma_engine_push_timestamps(struct hailo_vdma_engine *engine, u32 bitmap)
++{
++    struct hailo_vdma_channel *channel = NULL;
++    u8 channel_index = 0;
++
++    for_each_vdma_channel(engine, channel, channel_index) {
++        if (unlikely(hailo_test_bit(channel_index, &bitmap) &&
++                channel->timestamp_measure_enabled)) {
++            hailo_vdma_push_timestamp(channel);
++        }
++    }
++}
++
++int hailo_vdma_engine_read_timestamps(struct hailo_vdma_engine *engine,
++    struct hailo_vdma_interrupts_read_timestamp_params *params)
++{
++    struct hailo_vdma_channel *channel = NULL;
++
++    if (params->channel_index >= MAX_VDMA_CHANNELS_PER_ENGINE) {
++        return -EINVAL;
++    }
++
++    channel = &engine->channels[params->channel_index];
++    hailo_vdma_pop_timestamps_to_response(channel, params);
++    return 0;
++}
++
++void hailo_vdma_engine_clear_channel_interrupts(struct hailo_vdma_engine *engine, u32 bitmap)
++{
++    engine->interrupted_channels &= ~bitmap;
++}
++
++void hailo_vdma_engine_set_channel_interrupts(struct hailo_vdma_engine *engine, u32 bitmap)
++{
++    engine->interrupted_channels |= bitmap;
++}
++
++static void fill_channel_irq_data(struct hailo_vdma_interrupts_channel_data *irq_data,
++    struct hailo_vdma_engine *engine, struct hailo_vdma_channel *channel, u16 num_proc,
++    bool validation_success)
++{
++    u8 host_control = ioread8(channel->host_regs + CHANNEL_CONTROL_OFFSET);
++    u8 device_control = ioread8(channel->device_regs + CHANNEL_CONTROL_OFFSET);
++
++    irq_data->engine_index = engine->index;
++    irq_data->channel_index = channel->index;
++
++    irq_data->is_active = channel_control_reg_is_active(host_control) &&
++        channel_control_reg_is_active(device_control);
++
++    irq_data->host_num_processed = num_proc;
++    irq_data->host_error = ioread8(channel->host_regs + CHANNEL_ERROR_OFFSET);
++    irq_data->device_error = ioread8(channel->device_regs + CHANNEL_ERROR_OFFSET);
++    irq_data->validation_success = validation_success;
++}
++
++static bool is_desc_between(u16 begin, u16 end, u16 desc)
++{
++    if (begin == end) {
++        // There is nothing between
++        return false;
++    }
++    if (begin < end) {
++        // desc needs to be in [begin, end)
++        return (begin <= desc) && (desc < end);
++    }
++    else {
++        // desc needs to be in [0, end) or [begin, m_descs.size()-1]
++        return (desc < end) || (begin <= desc);
++    }
++}
++
++static bool is_transfer_complete(struct hailo_vdma_channel *channel,
++    struct hailo_ongoing_transfer *transfer, u16 hw_num_proc)
++{
++    if (channel->state.num_avail == hw_num_proc) {
++        return true;
++    }
++
++    return is_desc_between(channel->state.num_proc, hw_num_proc, transfer->last_desc);
++}
++
++int hailo_vdma_engine_fill_irq_data(struct hailo_vdma_interrupts_wait_params *irq_data,
++    struct hailo_vdma_engine *engine, u32 irq_channels_bitmap,
++    transfer_done_cb_t transfer_done, void *transfer_done_opaque)
++{
++    struct hailo_vdma_channel *channel = NULL;
++    u8 channel_index = 0;
++    bool validation_success = true;
++
++    for_each_vdma_channel(engine, channel, channel_index) {
++        u16 hw_num_proc = U16_MAX;
++        if (!hailo_test_bit(channel->index, &irq_channels_bitmap)) {
++            continue;
++        }
++
++        if (channel->last_desc_list == NULL) {
++            // Channel not active or no transfer, skipping.
++            continue;
++        }
++
++        if (irq_data->channels_count >= ARRAY_SIZE(irq_data->irq_data)) {
++            return -EINVAL;
++        }
++
++        // Although the hw_num_processed should be a number between 0 and
++        // desc_count-1, if desc_count < 0x10000 (the maximum desc size),
++        // the actual hw_num_processed is a number between 1 and desc_count.
++        // Therefore the value can be desc_count, in this case we change it to
++        // zero.
++        hw_num_proc = get_num_proc(channel->host_regs) & channel->state.desc_count_mask;
++
++        while (ONGOING_TRANSFERS_CIRC_CNT(channel->ongoing_transfers) > 0) {
++            struct hailo_ongoing_transfer *cur_transfer =
++                &channel->ongoing_transfers.transfers[channel->ongoing_transfers.tail];
++            if (!is_transfer_complete(channel, cur_transfer, hw_num_proc)) {
++                break;
++            }
++
++            if (cur_transfer->is_debug &&
++                !validate_last_desc_status(channel, cur_transfer)) {
++                validation_success = false;
++            }
++
++            clear_dirty_descs(channel, cur_transfer);
++            transfer_done(cur_transfer, transfer_done_opaque);
++            channel->state.num_proc = (u16)((cur_transfer->last_desc + 1) & channel->state.desc_count_mask);
++
++            ongoing_transfer_pop(channel, NULL);
++        }
++
++        fill_channel_irq_data(&irq_data->irq_data[irq_data->channels_count],
++            engine, channel, hw_num_proc, validation_success);
++        irq_data->channels_count++;
++    }
++
++    return 0;
++}
+\ No newline at end of file
+--- /dev/null
++++ b/drivers/media/pci/hailo/common/vdma_common.h
+@@ -0,0 +1,243 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#ifndef _HAILO_COMMON_VDMA_COMMON_H_
++#define _HAILO_COMMON_VDMA_COMMON_H_
++
++#include "hailo_resource.h"
++#include "utils.h"
++
++#include <linux/types.h>
++#include <linux/scatterlist.h>
++#include <linux/io.h>
++
++#define VDMA_DESCRIPTOR_LIST_ALIGN  (1 << 16)
++#define INVALID_VDMA_ADDRESS        (0)
++
++#ifdef __cplusplus
++extern "C"
++{
++#endif
++
++struct hailo_vdma_descriptor {
++    u32    PageSize_DescControl;
++    u32    AddrL_rsvd_DataID;
++    u32    AddrH;
++    u32    RemainingPageSize_Status;
++};
++
++struct hailo_vdma_descriptors_list {
++    struct hailo_vdma_descriptor *desc_list;
++    u32                      desc_count;  // Must be power of 2 if is_circular is set.
++    u16                      desc_page_size;
++    bool                          is_circular;
++};
++
++struct hailo_channel_interrupt_timestamp_list {
++    int head;
++    int tail;
++    struct hailo_channel_interrupt_timestamp timestamps[CHANNEL_IRQ_TIMESTAMPS_SIZE];
++};
++
++
++// For each buffers in transfer, the last descriptor will be programmed with
++// the residue size. In addition, if configured, the first descriptor (in
++// all transfer) may be programmed with interrupts.
++#define MAX_DIRTY_DESCRIPTORS_PER_TRANSFER      \
++    (HAILO_MAX_BUFFERS_PER_SINGLE_TRANSFER + 1)
++
++struct hailo_vdma_mapped_transfer_buffer {
++    struct sg_table *sg_table;
++    u32 size;
++    u32 offset;
++    void *opaque; // Drivers can set any opaque data here.
++};
++
++struct hailo_ongoing_transfer {
++    uint16_t last_desc;
++
++    u8 buffers_count;
++    struct hailo_vdma_mapped_transfer_buffer buffers[HAILO_MAX_BUFFERS_PER_SINGLE_TRANSFER];
++
++    // Contains all descriptors that were programmed with non-default values
++    // for the transfer (by non-default we mean - different size or different
++    // interrupts domain).
++    uint8_t dirty_descs_count;
++    uint16_t dirty_descs[MAX_DIRTY_DESCRIPTORS_PER_TRANSFER];
++
++    // If set, validate descriptors status on transfer completion.
++    bool is_debug;
++};
++
++struct hailo_ongoing_transfers_list {
++    unsigned long head;
++    unsigned long tail;
++    struct hailo_ongoing_transfer transfers[HAILO_VDMA_MAX_ONGOING_TRANSFERS];
++};
++
++struct hailo_vdma_channel_state {
++    // vdma channel counters. num_avail should be synchronized with the hw
++    // num_avail value. num_proc is the last num proc updated when the user
++    // reads interrupts.
++    u16 num_avail;
++    u16 num_proc;
++
++    // Mask of the num-avail/num-proc counters.
++    u32 desc_count_mask;
++};
++
++struct hailo_vdma_channel {
++    u8 index;
++
++    u8 __iomem *host_regs;
++    u8 __iomem *device_regs;
++
++    // Last descriptors list attached to the channel. When it changes,
++    // assumes that the channel got reset.
++    struct hailo_vdma_descriptors_list *last_desc_list;
++
++    struct hailo_vdma_channel_state state;
++    struct hailo_ongoing_transfers_list ongoing_transfers;
++
++    bool timestamp_measure_enabled;
++    struct hailo_channel_interrupt_timestamp_list timestamp_list;
++};
++
++struct hailo_vdma_engine {
++    u8 index;
++    u32 enabled_channels;
++    u32 interrupted_channels;
++    struct hailo_vdma_channel channels[MAX_VDMA_CHANNELS_PER_ENGINE];
++};
++
++struct hailo_vdma_hw_ops {
++    // Accepts some dma_addr_t mapped to the device and encodes it using
++    // hw specific encode. returns INVALID_VDMA_ADDRESS on failure.
++    u64 (*encode_desc_dma_address)(dma_addr_t dma_address, u8 channel_id);
++};
++
++struct hailo_vdma_hw {
++    struct hailo_vdma_hw_ops hw_ops;
++
++    // The data_id code of ddr addresses.
++    u8 ddr_data_id;
++
++    // Bitmask needed to set on each descriptor to enable interrupts (either host/device).
++    unsigned long host_interrupts_bitmask;
++    unsigned long device_interrupts_bitmask;
++};
++
++#define _for_each_element_array(array, size, element, index) \
++    for (index = 0, element = &array[index]; index < size; index++, element = &array[index])
++
++#define for_each_vdma_channel(engine, channel, channel_index) \
++    _for_each_element_array(engine->channels, MAX_VDMA_CHANNELS_PER_ENGINE,   \
++        channel, channel_index)
++
++void hailo_vdma_program_descriptor(struct hailo_vdma_descriptor *descriptor, u64 dma_address, size_t page_size,
++    u8 data_id);
++
++/**
++ * Program the given descriptors list to map the given buffer.
++ *
++ * @param vdma_hw vdma hw object
++ * @param desc_list descriptors list object to program
++ * @param starting_desc index of the first descriptor to program. If the list
++ *                      is circular, this function may wrap around the list.
++ * @param buffer buffer to program to the descriptors list.
++ * @param channel_index channel index of the channel attached.
++ *
++ * @return On success - the amount of descriptors programmed, negative value on error.
++ */
++int hailo_vdma_program_descriptors_list(
++    struct hailo_vdma_hw *vdma_hw,
++    struct hailo_vdma_descriptors_list *desc_list,
++    u32 starting_desc,
++    struct hailo_vdma_mapped_transfer_buffer *buffer,
++    u8 channel_index);
++
++/**
++ * Launch a transfer on some vdma channel. Includes:
++ *      1. Binding the transfer buffers to the descriptors list.
++ *      2. Program the descriptors list.
++ *      3. Increase num available
++ *
++ * @param vdma_hw vdma hw object
++ * @param channel vdma channel object.
++ * @param desc_list descriptors list object to program.
++ * @param starting_desc index of the first descriptor to program.
++ * @param buffers_count amount of transfer mapped buffers to program.
++ * @param buffers array of buffers to program to the descriptors list.
++ * @param should_bind whether to bind the buffer to the descriptors list.
++ * @param first_interrupts_domain - interrupts settings on first descriptor.
++ * @param last_desc_interrupts - interrupts settings on last descriptor.
++ * @param is_debug program descriptors for debug run, adds some overhead (for
++ *                 example, hw will write desc complete status).
++ *
++ * @return On success - the amount of descriptors programmed, negative value on error.
++ */
++int hailo_vdma_launch_transfer(
++    struct hailo_vdma_hw *vdma_hw,
++    struct hailo_vdma_channel *channel,
++    struct hailo_vdma_descriptors_list *desc_list,
++    u32 starting_desc,
++    u8 buffers_count,
++    struct hailo_vdma_mapped_transfer_buffer *buffers,
++    bool should_bind,
++    enum hailo_vdma_interrupts_domain first_interrupts_domain,
++    enum hailo_vdma_interrupts_domain last_desc_interrupts,
++    bool is_debug);
++
++void hailo_vdma_engine_init(struct hailo_vdma_engine *engine, u8 engine_index,
++    const struct hailo_resource *channel_registers);
++
++// enable/disable channels interrupt (does not update interrupts mask because the
++// implementation is different between PCIe and DRAM DMA. To support it we
++// can add some ops struct to the engine).
++void hailo_vdma_engine_enable_channel_interrupts(struct hailo_vdma_engine *engine, u32 bitmap,
++    bool measure_timestamp);
++void hailo_vdma_engine_disable_channel_interrupts(struct hailo_vdma_engine *engine, u32 bitmap);
++
++void hailo_vdma_engine_push_timestamps(struct hailo_vdma_engine *engine, u32 bitmap);
++int hailo_vdma_engine_read_timestamps(struct hailo_vdma_engine *engine,
++    struct hailo_vdma_interrupts_read_timestamp_params *params);
++
++static inline bool hailo_vdma_engine_got_interrupt(struct hailo_vdma_engine *engine,
++    u32 channels_bitmap)
++{
++    // Reading interrupts without lock is ok (needed only for writes)
++    const bool any_interrupt = (0 != (channels_bitmap & engine->interrupted_channels));
++    const bool any_disabled = (channels_bitmap != (channels_bitmap & engine->enabled_channels));
++    return (any_disabled || any_interrupt);
++}
++
++// Set/Clear/Read channels interrupts, must called under some lock (driver specific)
++void hailo_vdma_engine_clear_channel_interrupts(struct hailo_vdma_engine *engine, u32 bitmap);
++void hailo_vdma_engine_set_channel_interrupts(struct hailo_vdma_engine *engine, u32 bitmap);
++
++static inline u32 hailo_vdma_engine_read_interrupts(struct hailo_vdma_engine *engine,
++    u32 requested_bitmap)
++{
++    // Interrupts only for channels that are requested and enabled.
++    u32 irq_channels_bitmap = requested_bitmap &
++                          engine->enabled_channels &
++                          engine->interrupted_channels;
++    engine->interrupted_channels &= ~irq_channels_bitmap;
++
++    return irq_channels_bitmap;
++}
++
++typedef void(*transfer_done_cb_t)(struct hailo_ongoing_transfer *transfer, void *opaque);
++
++// Assuming irq_data->channels_count contains the amount of channels already
++// written (used for multiple engines).
++int hailo_vdma_engine_fill_irq_data(struct hailo_vdma_interrupts_wait_params *irq_data,
++    struct hailo_vdma_engine *engine, u32 irq_channels_bitmap,
++    transfer_done_cb_t transfer_done, void *transfer_done_opaque);
++
++#ifdef __cplusplus
++}
++#endif
++#endif /* _HAILO_COMMON_VDMA_COMMON_H_ */
+--- /dev/null
++++ b/drivers/media/pci/hailo/include/hailo_pcie_version.h
+@@ -0,0 +1,14 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#ifndef _HAILO_PCIE_VERSION_H_
++#define _HAILO_PCIE_VERSION_H_
++
++#include <linux/stringify.h>
++#include "../common/hailo_pcie_version.h"
++
++#define HAILO_DRV_VER __stringify(HAILO_DRV_VER_MAJOR) "." __stringify(HAILO_DRV_VER_MINOR) "."  __stringify(HAILO_DRV_VER_REVISION)
++
++#endif /* _HAILO_PCIE_VERSION_H_ */
+--- /dev/null
++++ b/drivers/media/pci/hailo/src/fops.c
+@@ -0,0 +1,736 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#include <linux/version.h>
++#include <linux/pci.h>
++#include <linux/interrupt.h>
++#include <linux/sched.h>
++#include <linux/pagemap.h>
++#include <linux/uaccess.h>
++#include <linux/scatterlist.h>
++#include <linux/slab.h>
++#include <linux/delay.h>
++
++#include <asm/thread_info.h>
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0)
++#include <linux/sched/signal.h>
++#endif
++
++#include "hailo_pcie_version.h"
++#include "utils.h"
++#include "fops.h"
++#include "vdma_common.h"
++#include "utils/logs.h"
++#include "vdma/memory.h"
++#include "vdma/ioctl.h"
++#include "utils/compact.h"
++
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION( 4, 13, 0 )
++#define wait_queue_t wait_queue_entry_t
++#endif
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION( 4, 15, 0 )
++#define ACCESS_ONCE READ_ONCE
++#endif
++
++#ifndef VM_RESERVED
++    #define VMEM_FLAGS (VM_IO | VM_DONTEXPAND | VM_DONTDUMP)
++#else
++    #define VMEM_FLAGS (VM_IO | VM_RESERVED)
++#endif
++
++#define IS_PO2_ALIGNED(size, alignment) (!(size & (alignment-1)))
++
++// On pcie driver there is only one dma engine
++#define DEFAULT_VDMA_ENGINE_INDEX       (0)
++
++#if !defined(HAILO_EMULATOR)
++#define DEFAULT_SHUTDOWN_TIMEOUT_MS (5)
++#else /* !defined(HAILO_EMULATOR) */
++#define DEFAULT_SHUTDOWN_TIMEOUT_MS (1000)
++#endif /* !defined(HAILO_EMULATOR) */
++
++static long hailo_add_notification_wait(struct hailo_pcie_board *board, struct file *filp);
++
++static struct hailo_file_context *create_file_context(struct hailo_pcie_board *board, struct file *filp)
++{
++    struct hailo_file_context *context = kzalloc(sizeof(*context), GFP_KERNEL);
++    if (!context) {
++        hailo_err(board, "Failed to alloc file context (required size %zu)\n", sizeof(*context));
++        return ERR_PTR(-ENOMEM);
++    }
++
++    context->filp = filp;
++    hailo_vdma_file_context_init(&context->vdma_context);
++    list_add(&context->open_files_list, &board->open_files_list);
++    context->is_valid = true;
++    return context;
++}
++
++static void release_file_context(struct hailo_file_context *context)
++{
++    context->is_valid = false;
++    list_del(&context->open_files_list);
++    kfree(context);
++}
++
++static struct hailo_file_context *find_file_context(struct hailo_pcie_board *board, struct file *filp)
++{
++    struct hailo_file_context *cur = NULL;
++    list_for_each_entry(cur, &board->open_files_list, open_files_list) {
++        if (cur->filp == filp) {
++            return cur;
++        }
++    }
++    return NULL;
++}
++
++int hailo_pcie_fops_open(struct inode *inode, struct file *filp)
++{
++    u32 major = MAJOR(inode->i_rdev);
++    u32 minor = MINOR(inode->i_rdev);
++    struct hailo_pcie_board *pBoard;
++    int err = 0;
++    pci_power_t previous_power_state = PCI_UNKNOWN;
++    bool interrupts_enabled_by_filp = false;
++    struct hailo_file_context *context = NULL;
++
++    pr_debug(DRIVER_NAME ": (%d: %d-%d): fops_open\n", current->tgid, major, minor);
++
++    // allow multiple processes to open a device, count references in hailo_pcie_get_board_index.
++    if (!(pBoard = hailo_pcie_get_board_index(minor))) {
++        pr_err(DRIVER_NAME ": fops_open: PCIe board not found for /dev/hailo%d node.\n", minor);
++        err = -ENODEV;
++        goto l_exit;
++    }
++
++    filp->private_data = pBoard;
++
++    if (down_interruptible(&pBoard->mutex)) {
++        hailo_err(pBoard, "fops_open down_interruptible fail tgid:%d\n", current->tgid);
++        err = -ERESTARTSYS;
++        goto l_decrease_ref_count;
++    }
++
++    context = create_file_context(pBoard, filp);
++    if (IS_ERR(context)) {
++        err = PTR_ERR(context);
++        goto l_release_mutex;
++    }
++
++    previous_power_state = pBoard->pDev->current_state;
++    if (PCI_D0 != previous_power_state) {
++        hailo_info(pBoard, "Waking up board");
++        err = pci_set_power_state(pBoard->pDev, PCI_D0);
++        if (err < 0) {
++            hailo_err(pBoard, "Failed waking up board %d", err);
++            goto l_free_context;
++        }
++    }
++
++    if (!hailo_pcie_is_device_connected(&pBoard->pcie_resources)) {
++        hailo_err(pBoard, "Device disconnected while opening device\n");
++        err = -ENXIO;
++        goto l_revert_power_state;
++    }
++
++    // enable interrupts
++    if (!pBoard->interrupts_enabled) {
++        err = hailo_enable_interrupts(pBoard);
++        if (err < 0) {
++            hailo_err(pBoard, "Failed Enabling interrupts %d\n", err);
++            goto l_revert_power_state;
++        }
++        interrupts_enabled_by_filp = true;
++    }
++
++    err = hailo_add_notification_wait(pBoard, filp);
++    if (err < 0) {
++        goto l_release_irq;
++    }
++
++    hailo_dbg(pBoard, "(%d: %d-%d): fops_open: SUCCESS on /dev/hailo%d\n", current->tgid,
++        major, minor, minor);
++
++    up(&pBoard->mutex);
++    return 0;
++
++l_release_irq:
++    if (interrupts_enabled_by_filp) {
++        hailo_disable_interrupts(pBoard);
++    }
++
++l_revert_power_state:
++    if (pBoard->pDev->current_state != previous_power_state) {
++        if (pci_set_power_state(pBoard->pDev, previous_power_state) < 0) {
++            hailo_err(pBoard, "Failed setting power state back to %d\n", (int)previous_power_state);
++        }
++    }
++l_free_context:
++    release_file_context(context);
++l_release_mutex:
++    up(&pBoard->mutex);
++l_decrease_ref_count:
++    atomic_dec(&pBoard->ref_count);
++l_exit:
++    return err;
++}
++
++int hailo_pcie_driver_down(struct hailo_pcie_board *board)
++{
++    long completion_result = 0;
++    int err = 0;
++
++    reinit_completion(&board->driver_down.reset_completed);
++
++    hailo_pcie_write_firmware_driver_shutdown(&board->pcie_resources);
++
++    // Wait for response
++    completion_result =
++        wait_for_completion_timeout(&board->driver_down.reset_completed, msecs_to_jiffies(DEFAULT_SHUTDOWN_TIMEOUT_MS));
++    if (completion_result <= 0) {
++        if (0 == completion_result) {
++            hailo_err(board, "hailo_pcie_driver_down, timeout waiting for shutdown response (timeout_ms=%d)\n", DEFAULT_SHUTDOWN_TIMEOUT_MS);
++            err = -ETIMEDOUT;
++        } else {
++            hailo_info(board, "hailo_pcie_driver_down, wait for completion failed with err=%ld (process was interrupted or killed)\n",
++                completion_result);
++            err = completion_result;
++        }
++        goto l_exit;
++    }
++
++l_exit:
++    return err;
++}
++
++int hailo_pcie_fops_release(struct inode *inode, struct file *filp)
++{
++    struct hailo_pcie_board *pBoard = (struct hailo_pcie_board *)filp->private_data;
++    struct hailo_file_context *context = NULL;
++
++    u32 major = MAJOR(inode->i_rdev);
++    u32 minor = MINOR(inode->i_rdev);
++
++    if (pBoard) {
++        hailo_info(pBoard, "(%d: %d-%d): fops_release\n", current->tgid, major, minor);
++
++        if (down_interruptible(&pBoard->mutex)) {
++            hailo_err(pBoard, "fops_release down_interruptible failed");
++            return -ERESTARTSYS;
++        }
++
++        context = find_file_context(pBoard, filp);
++        if (NULL == context) {
++            hailo_err(pBoard, "Invalid driver state, file context does not exist\n");
++            up(&pBoard->mutex);
++            return -EINVAL;
++        }
++
++        if (false == context->is_valid) {
++            // File context is invalid, but open. It's OK to continue finalize and release it.
++            hailo_err(pBoard, "Invalid file context\n");
++        }
++
++        hailo_pcie_clear_notification_wait_list(pBoard, filp);
++
++        if (filp == pBoard->vdma.used_by_filp) {
++            if (hailo_pcie_driver_down(pBoard)) {
++                hailo_err(pBoard, "Failed sending FW shutdown event");
++            }
++        }
++
++        hailo_vdma_file_context_finalize(&context->vdma_context, &pBoard->vdma, filp);
++        release_file_context(context);
++
++        if (atomic_dec_and_test(&pBoard->ref_count)) {
++            // Disable interrupts
++            hailo_disable_interrupts(pBoard);
++
++            if (power_mode_enabled()) {
++                if (pBoard->pDev && pci_set_power_state(pBoard->pDev, PCI_D3hot) < 0) {
++                    hailo_err(pBoard, "Failed setting power state to D3hot");
++                }
++            }
++
++            // deallocate board if already removed
++            if (!pBoard->pDev) {
++                hailo_dbg(pBoard, "fops_close, freed board\n");
++                up(&pBoard->mutex);
++                kfree(pBoard);
++                pBoard = NULL;
++            } else {
++
++                hailo_dbg(pBoard, "fops_close, released resources for board\n");
++                up(&pBoard->mutex);
++            }
++        } else {
++            up(&pBoard->mutex);
++        }
++
++        hailo_dbg(pBoard, "(%d: %d-%d): fops_close: SUCCESS on /dev/hailo%d\n", current->tgid,
++            major, minor, minor);
++    }
++
++    return 0;
++}
++
++static long hailo_memory_transfer_ioctl(struct hailo_pcie_board *board, unsigned long arg)
++{
++    long err = 0;
++    struct hailo_memory_transfer_params* transfer = &board->memory_transfer_params;
++
++    hailo_dbg(board, "Start memory transfer ioctl\n");
++
++    if (copy_from_user(transfer, (void __user*)arg, sizeof(*transfer))) {
++        hailo_err(board, "copy_from_user fail\n");
++        return -ENOMEM;
++    }
++
++    err = hailo_pcie_memory_transfer(&board->pcie_resources, transfer);
++    if (err < 0) {
++        hailo_err(board, "memory transfer failed %ld", err);
++    }
++
++    if (copy_to_user((void __user*)arg, transfer, sizeof(*transfer))) {
++        hailo_err(board, "copy_to_user fail\n");
++        return -ENOMEM;
++    }
++
++    return err;
++}
++
++static long hailo_read_log_ioctl(struct hailo_pcie_board *pBoard, unsigned long arg)
++{
++    long err = 0;
++    struct hailo_read_log_params params;
++
++    if (copy_from_user(&params, (void __user*)arg, sizeof(params))) {
++        hailo_err(pBoard, "HAILO_READ_LOG, copy_from_user fail\n");
++        return -ENOMEM;
++    }
++
++    if (0 > (err = hailo_pcie_read_firmware_log(&pBoard->pcie_resources, &params))) {
++        hailo_err(pBoard, "HAILO_READ_LOG, reading from log failed with error: %ld \n", err);
++        return err;
++    }
++
++    if (copy_to_user((void*)arg, &params, sizeof(params))) {
++        return -ENOMEM;
++    }
++
++    return 0;
++}
++
++static void firmware_notification_irq_handler(struct hailo_pcie_board *board)
++{
++    struct hailo_notification_wait *notif_wait_cursor = NULL;
++    int err = 0;
++    unsigned long irq_saved_flags = 0;
++
++    spin_lock_irqsave(&board->notification_read_spinlock, irq_saved_flags);
++    err = hailo_pcie_read_firmware_notification(&board->pcie_resources, &board->notification_cache);
++    spin_unlock_irqrestore(&board->notification_read_spinlock, irq_saved_flags);
++
++    if (err < 0) {
++        hailo_err(board, "Failed reading firmware notification");
++    }
++    else {
++        rcu_read_lock();
++        list_for_each_entry_rcu(notif_wait_cursor, &board->notification_wait_list, notification_wait_list)
++        {
++            complete(&notif_wait_cursor->notification_completion);
++        }
++        rcu_read_unlock();
++    }
++}
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,22)
++irqreturn_t hailo_irqhandler(int irq, void *dev_id, struct pt_regs *regs)
++#else
++irqreturn_t hailo_irqhandler(int irq, void *dev_id)
++#endif
++{
++    irqreturn_t return_value = IRQ_NONE;
++    struct hailo_pcie_board *board = (struct hailo_pcie_board *)dev_id;
++    bool got_interrupt = false;
++    struct hailo_pcie_interrupt_source irq_source = {0};
++
++    hailo_dbg(board, "hailo_irqhandler\n");
++
++    while (true) {
++        if (!hailo_pcie_is_device_connected(&board->pcie_resources)) {
++            hailo_err(board, "Device disconnected while handling irq\n");
++            break;
++        }
++
++        got_interrupt = hailo_pcie_read_interrupt(&board->pcie_resources, &irq_source);
++        if (!got_interrupt) {
++            break;
++        }
++
++        return_value = IRQ_HANDLED;
++
++        // wake fw_control if needed
++        if (irq_source.interrupt_bitmask & FW_CONTROL) {
++            complete(&board->fw_control.completion);
++        }
++
++        // wake driver_down if needed
++        if (irq_source.interrupt_bitmask & DRIVER_DOWN) {
++            complete(&board->driver_down.reset_completed);
++        }
++
++        if (irq_source.interrupt_bitmask & FW_NOTIFICATION) {
++            if (!completion_done(&board->fw_loaded_completion)) {
++                // Complete firmware loaded completion
++                complete_all(&board->fw_loaded_completion);
++            } else {
++                firmware_notification_irq_handler(board);
++            }
++        }
++
++        if (0 != irq_source.vdma_channels_bitmap) {
++            hailo_vdma_irq_handler(&board->vdma, DEFAULT_VDMA_ENGINE_INDEX,
++                irq_source.vdma_channels_bitmap);
++        }
++    }
++
++    return return_value;
++}
++
++static long hailo_get_notification_wait_thread(struct hailo_pcie_board *pBoard, struct file *filp,
++    struct hailo_notification_wait **current_waiting_thread)
++{
++    struct hailo_notification_wait *cursor = NULL;
++    // note: safe to access without rcu because the notification_wait_list is closed only on file release
++    list_for_each_entry(cursor, &pBoard->notification_wait_list, notification_wait_list)
++    {
++        if ((current->tgid == cursor->tgid) && (filp == cursor->filp)) {
++            *current_waiting_thread = cursor;
++            return 0;
++        }
++    }
++
++    return -EFAULT;
++}
++
++static long hailo_add_notification_wait(struct hailo_pcie_board *board, struct file *filp)
++{
++    struct hailo_notification_wait *new_notification_wait = NULL;
++    if (!(new_notification_wait = kmalloc(sizeof(*new_notification_wait), GFP_KERNEL))) {
++        hailo_err(board, "Failed to allocate notification wait structure.\n");
++        return -ENOMEM;
++    }
++    new_notification_wait->tgid = current->tgid;
++    new_notification_wait->filp = filp;
++    new_notification_wait->is_disabled = false;
++    init_completion(&new_notification_wait->notification_completion);
++    list_add_rcu(&new_notification_wait->notification_wait_list, &board->notification_wait_list);
++    return 0;
++}
++
++static long hailo_read_notification_ioctl(struct hailo_pcie_board *pBoard, unsigned long arg, struct file *filp,
++    bool* should_up_board_mutex)
++{
++    long err = 0;
++    struct hailo_notification_wait *current_waiting_thread = NULL;
++    struct hailo_d2h_notification *notification = &pBoard->notification_to_user;
++    unsigned long irq_saved_flags;
++
++    err = hailo_get_notification_wait_thread(pBoard, filp, &current_waiting_thread);
++    if (0 != err) {
++        goto l_exit;
++    }
++    up(&pBoard->mutex);
++
++    if (0 > (err = wait_for_completion_interruptible(&current_waiting_thread->notification_completion))) {
++        hailo_info(pBoard,
++            "HAILO_READ_NOTIFICATION - wait_for_completion_interruptible error. err=%ld. tgid=%d (process was interrupted or killed)\n",
++            err, current_waiting_thread->tgid);
++        *should_up_board_mutex = false;
++        goto l_exit;
++    }
++
++    if (down_interruptible(&pBoard->mutex)) {
++        hailo_info(pBoard, "HAILO_READ_NOTIFICATION - down_interruptible error (process was interrupted or killed)\n");
++        *should_up_board_mutex = false;
++        err = -ERESTARTSYS;
++        goto l_exit;
++    }
++
++    // Check if was disabled
++    if (current_waiting_thread->is_disabled) {
++        hailo_info(pBoard, "HAILO_READ_NOTIFICATION, can't find notification wait for tgid=%d\n", current->tgid);
++        err = -EINVAL;
++        goto l_exit;
++    }
++
++    reinit_completion(&current_waiting_thread->notification_completion);
++    
++    spin_lock_irqsave(&pBoard->notification_read_spinlock, irq_saved_flags);
++    notification->buffer_len = pBoard->notification_cache.buffer_len;
++    memcpy(notification->buffer, pBoard->notification_cache.buffer, notification->buffer_len);
++    spin_unlock_irqrestore(&pBoard->notification_read_spinlock, irq_saved_flags);
++
++    if (copy_to_user((void __user*)arg, notification, sizeof(*notification))) {
++        hailo_err(pBoard, "HAILO_READ_NOTIFICATION copy_to_user fail\n");
++        err = -ENOMEM;
++        goto l_exit;
++    }
++
++l_exit:
++    return err;
++}
++
++static long hailo_disable_notification(struct hailo_pcie_board *pBoard, struct file *filp)
++{
++    struct hailo_notification_wait *cursor = NULL;
++
++    hailo_info(pBoard, "HAILO_DISABLE_NOTIFICATION: disable notification");
++    rcu_read_lock();
++    list_for_each_entry_rcu(cursor, &pBoard->notification_wait_list, notification_wait_list) {
++        if ((current->tgid == cursor->tgid) && (filp == cursor->filp)) {
++            cursor->is_disabled = true;
++            complete(&cursor->notification_completion);
++            break;
++        }
++    }
++    rcu_read_unlock();
++
++    return 0;
++}
++
++static int hailo_fw_control(struct hailo_pcie_board *pBoard, unsigned long arg, bool* should_up_board_mutex)
++{
++    struct hailo_fw_control *command = &pBoard->fw_control.command;
++    long completion_result = 0;
++    int err = 0;
++
++    up(&pBoard->mutex);
++    *should_up_board_mutex = false;
++
++    if (down_interruptible(&pBoard->fw_control.mutex)) {
++        hailo_info(pBoard, "hailo_fw_control down_interruptible fail tgid:%d (process was interrupted or killed)\n", current->tgid);
++        return -ERESTARTSYS;
++    }
++
++    if (copy_from_user(command, (void __user*)arg, sizeof(*command))) {
++        hailo_err(pBoard, "hailo_fw_control, copy_from_user fail\n");
++        err = -ENOMEM;
++        goto l_exit;
++    }
++
++    reinit_completion(&pBoard->fw_control.completion);
++
++    err = hailo_pcie_write_firmware_control(&pBoard->pcie_resources, command);
++    if (err < 0) {
++        hailo_err(pBoard, "Failed writing fw control to pcie\n");
++        goto l_exit;
++    }
++
++    // Wait for response
++    completion_result = wait_for_completion_interruptible_timeout(&pBoard->fw_control.completion, msecs_to_jiffies(command->timeout_ms));
++    if (completion_result <= 0) {
++        if (0 == completion_result) {
++            hailo_err(pBoard, "hailo_fw_control, timeout waiting for control (timeout_ms=%d)\n", command->timeout_ms);
++            err = -ETIMEDOUT;
++        } else {
++            hailo_info(pBoard, "hailo_fw_control, wait for completion failed with err=%ld (process was interrupted or killed)\n", completion_result);
++            err = -EINTR;
++        }
++        goto l_exit;
++    }
++
++    err = hailo_pcie_read_firmware_control(&pBoard->pcie_resources, command);
++    if (err < 0) {
++        hailo_err(pBoard, "Failed reading fw control from pcie\n");
++        goto l_exit;
++    }
++
++    if (copy_to_user((void __user*)arg, command, sizeof(*command))) {
++        hailo_err(pBoard, "hailo_fw_control, copy_to_user fail\n");
++        err = -ENOMEM;
++        goto l_exit;
++    }
++
++l_exit:
++    up(&pBoard->fw_control.mutex);
++    return err;
++}
++
++static long hailo_query_device_properties(struct hailo_pcie_board *board, unsigned long arg)
++{
++    struct hailo_device_properties props = {
++        .desc_max_page_size = board->desc_max_page_size,
++        .allocation_mode = board->allocation_mode,
++        .dma_type = HAILO_DMA_TYPE_PCIE,
++        .dma_engines_count = board->vdma.vdma_engines_count,
++        .is_fw_loaded = hailo_pcie_is_firmware_loaded(&board->pcie_resources),
++    };
++
++    hailo_info(board, "HAILO_QUERY_DEVICE_PROPERTIES: desc_max_page_size=%u\n", props.desc_max_page_size);
++
++    if (copy_to_user((void __user*)arg, &props, sizeof(props))) {
++        hailo_err(board, "HAILO_QUERY_DEVICE_PROPERTIES, copy_to_user failed\n");
++        return -ENOMEM;
++    }
++
++    return 0;
++}
++
++static long hailo_query_driver_info(struct hailo_pcie_board *board, unsigned long arg)
++{
++    struct hailo_driver_info info = {
++        .major_version = HAILO_DRV_VER_MAJOR,
++        .minor_version = HAILO_DRV_VER_MINOR,
++        .revision_version = HAILO_DRV_VER_REVISION
++    };
++
++    hailo_info(board, "HAILO_QUERY_DRIVER_INFO: major=%u, minor=%u, revision=%u\n",
++        info.major_version, info.minor_version, info.revision_version);
++
++    if (copy_to_user((void __user*)arg, &info, sizeof(info))) {
++        hailo_err(board, "HAILO_QUERY_DRIVER_INFO, copy_to_user failed\n");
++        return -ENOMEM;
++    }
++
++    return 0;
++}
++
++static long hailo_general_ioctl(struct hailo_file_context *context, struct hailo_pcie_board *board,
++    unsigned int cmd, unsigned long arg, struct file *filp, bool *should_up_board_mutex)
++{
++    switch (cmd) {
++    case HAILO_MEMORY_TRANSFER:
++        return hailo_memory_transfer_ioctl(board, arg);
++    case HAILO_FW_CONTROL:
++        return hailo_fw_control(board, arg, should_up_board_mutex);
++    case HAILO_READ_NOTIFICATION:
++        return hailo_read_notification_ioctl(board, arg, filp, should_up_board_mutex);
++    case HAILO_DISABLE_NOTIFICATION:
++        return hailo_disable_notification(board, filp);
++    case HAILO_QUERY_DEVICE_PROPERTIES:
++        return hailo_query_device_properties(board, arg);
++    case HAILO_QUERY_DRIVER_INFO:
++        return hailo_query_driver_info(board, arg);
++    case HAILO_READ_LOG:
++        return hailo_read_log_ioctl(board, arg);
++    default:
++        hailo_err(board, "Invalid general ioctl code 0x%x (nr: %d)\n", cmd, _IOC_NR(cmd));
++        return -ENOTTY;
++    }
++}
++
++long hailo_pcie_fops_unlockedioctl(struct file* filp, unsigned int cmd, unsigned long arg)
++{
++    long err = 0;
++    struct hailo_pcie_board* board = (struct hailo_pcie_board*) filp->private_data;
++    struct hailo_file_context *context = NULL;
++    bool should_up_board_mutex = true;
++
++
++    if (!board || !board->pDev) return -ENODEV;
++
++    hailo_dbg(board, "(%d): fops_unlockedioctl. cmd:%d\n", current->tgid, _IOC_NR(cmd));
++
++    if (_IOC_DIR(cmd) & _IOC_READ)
++    {
++        err = !compatible_access_ok(VERIFY_WRITE, (void __user *)arg, _IOC_SIZE(cmd));
++    }
++    else if (_IOC_DIR(cmd) & _IOC_WRITE)
++    {
++        err =  !compatible_access_ok(VERIFY_READ, (void __user *)arg, _IOC_SIZE(cmd));
++    }
++
++    if (err) {
++        hailo_err(board, "Invalid ioctl parameter access 0x%x", cmd);
++        return -EFAULT;
++    }
++
++    if (down_interruptible(&board->mutex)) {
++        hailo_err(board, "unlockedioctl down_interruptible failed");
++        return -ERESTARTSYS;
++    }
++    BUG_ON(board->mutex.count != 0);
++
++    context = find_file_context(board, filp);
++    if (NULL == context) {
++        hailo_err(board, "Invalid driver state, file context does not exist\n");
++        up(&board->mutex);
++        return -EINVAL;
++    }
++
++    if (false == context->is_valid) {
++        hailo_err(board, "Invalid file context\n");
++        up(&board->mutex);
++        return -EINVAL;
++    }
++
++    switch (_IOC_TYPE(cmd)) {
++    case HAILO_GENERAL_IOCTL_MAGIC:
++        err = hailo_general_ioctl(context, board, cmd, arg, filp, &should_up_board_mutex);
++        break;
++    case HAILO_VDMA_IOCTL_MAGIC:
++        err = hailo_vdma_ioctl(&context->vdma_context, &board->vdma, cmd, arg, filp, &board->mutex,
++            &should_up_board_mutex);
++        break;
++    default:
++        hailo_err(board, "Invalid ioctl type %d\n", _IOC_TYPE(cmd));
++        err = -ENOTTY;
++    }
++
++    if (should_up_board_mutex) {
++        up(&board->mutex);
++    }
++
++    hailo_dbg(board, "(%d): fops_unlockedioct: SUCCESS\n", current->tgid);
++    return err;
++
++}
++
++int hailo_pcie_fops_mmap(struct file* filp, struct vm_area_struct *vma)
++{
++    int err = 0;
++
++    uintptr_t vdma_handle   = vma->vm_pgoff << PAGE_SHIFT;
++
++    struct hailo_pcie_board* board = (struct hailo_pcie_board*)filp->private_data;
++    struct hailo_file_context *context = NULL;
++
++    BUILD_BUG_ON_MSG(sizeof(vma->vm_pgoff) < sizeof(vdma_handle),
++        "If this expression fails to compile it means the target HW is not compatible with our approach to use "
++         "the page offset paramter of 'mmap' to pass the driver the 'handle' of the desired descriptor");
++
++    vma->vm_pgoff = 0; // vm_pgoff contains vdma_handle page offset, the actual offset from the phys addr is 0
++
++    hailo_info(board, "%d fops_mmap\n", current->tgid);
++
++    if (!board || !board->pDev) return -ENODEV;
++
++    if (down_interruptible(&board->mutex)) {
++        hailo_err(board, "hailo_pcie_fops_mmap down_interruptible fail tgid:%d\n", current->tgid);
++        return -ERESTARTSYS;
++    }
++
++    context = find_file_context(board, filp);
++    if (NULL == context) {
++        up(&board->mutex);
++        hailo_err(board, "Invalid driver state, file context does not exist\n");
++        return -EINVAL;
++    }
++
++    if (false == context->is_valid) {
++        up(&board->mutex);
++        hailo_err(board, "Invalid file context\n");
++        return -EINVAL;
++    }
++
++    err = hailo_vdma_mmap(&context->vdma_context, &board->vdma, vma, vdma_handle);
++    up(&board->mutex);
++    return err;
++}
+--- /dev/null
++++ b/drivers/media/pci/hailo/src/fops.h
+@@ -0,0 +1,21 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#ifndef _HAILO_PCI_FOPS_H_
++#define _HAILO_PCI_FOPS_H_
++
++int hailo_pcie_fops_open(struct inode* inode, struct file* filp);
++int hailo_pcie_fops_release(struct inode* inode, struct file* filp);
++long hailo_pcie_fops_unlockedioctl(struct file* filp, unsigned int cmd, unsigned long arg);
++int hailo_pcie_fops_mmap(struct file* filp, struct vm_area_struct *vma);
++int hailo_pcie_driver_down(struct hailo_pcie_board *board);
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,22)
++irqreturn_t hailo_irqhandler(int irq, void* dev_id, struct pt_regs *regs);
++#else
++irqreturn_t hailo_irqhandler(int irq, void* dev_id);
++#endif
++
++#endif /* _HAILO_PCI_FOPS_H_ */
+--- /dev/null
++++ b/drivers/media/pci/hailo/src/pcie.c
+@@ -0,0 +1,1012 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#include <linux/version.h>
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/pci.h>
++#include <linux/pci_regs.h>
++#include <linux/interrupt.h>
++#include <linux/sched.h>
++#include <linux/pagemap.h>
++#include <linux/firmware.h>
++#include <linux/kthread.h>
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 16, 0)
++#include <linux/dma-direct.h>
++#endif
++
++#define KERNEL_CODE	1
++
++#include "hailo_pcie_version.h"
++#include "hailo_ioctl_common.h"
++#include "pcie.h"
++#include "fops.h"
++#include "sysfs.h"
++#include "utils/logs.h"
++#include "utils/compact.h"
++#include "vdma/vdma.h"
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION( 5, 4, 0 )
++#include <linux/pci-aspm.h>
++#endif
++
++// enum that represents values for the driver parameter to either force buffer from driver , userspace or not force
++// and let driver decide
++enum hailo_allocate_driver_buffer_driver_param {
++    HAILO_NO_FORCE_BUFFER = 0,
++    HAILO_FORCE_BUFFER_FROM_USERSPACE = 1,
++    HAILO_FORCE_BUFFER_FROM_DRIVER = 2,
++};
++
++//Debug flag
++static int force_desc_page_size = 0;
++static bool g_is_power_mode_enabled = true;
++static int force_allocation_from_driver = HAILO_NO_FORCE_BUFFER;
++
++#define DEVICE_NODE_NAME "hailo"
++static int char_major = 0;
++static struct class *chardev_class;
++
++static LIST_HEAD(g_hailo_board_list);
++static struct semaphore g_hailo_add_board_mutex = __SEMAPHORE_INITIALIZER(g_hailo_add_board_mutex, 1);
++
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 22))
++#define HAILO_IRQ_FLAGS (SA_SHIRQ | SA_INTERRUPT)
++#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 22) && LINUX_VERSION_CODE < KERNEL_VERSION(4, 1, 0))
++#define HAILO_IRQ_FLAGS (IRQF_SHARED | IRQF_DISABLED)
++#else
++#define HAILO_IRQ_FLAGS (IRQF_SHARED)
++#endif
++
++ /* ****************************
++  ******************************* */
++bool power_mode_enabled(void)
++{
++#if !defined(HAILO_EMULATOR)
++    return g_is_power_mode_enabled;
++#else /* !defined(HAILO_EMULATOR) */
++    return false;
++#endif /* !defined(HAILO_EMULATOR) */
++}
++
++
++/**
++ * Due to an HW bug, on system with low MaxReadReq ( < 512) we need to use different descriptors size.
++ * Returns the max descriptor size or 0 on failure.
++ */
++static int hailo_get_desc_page_size(struct pci_dev *pdev, u32 *out_page_size)
++{
++    u16 pcie_device_control = 0;
++    int err = 0;
++    // The default page size must be smaller/equal to 32K (due to PLDA registers limit).
++    const u32 max_page_size = 32u * 1024u;
++    const u32 defualt_page_size = min((u32)PAGE_SIZE, max_page_size);
++
++    if (force_desc_page_size != 0) {
++        // The user given desc_page_size as a module parameter
++        if ((force_desc_page_size & (force_desc_page_size - 1)) != 0) {
++            pci_err(pdev, "force_desc_page_size must be a power of 2\n");
++            return -EINVAL;
++        }
++
++        if (force_desc_page_size > max_page_size) {
++            pci_err(pdev, "force_desc_page_size %d mustn't be larger than %u", force_desc_page_size, max_page_size);
++            return -EINVAL;
++        }
++
++        pci_notice(pdev, "Probing: Force setting max_desc_page_size to %d (recommended value is %lu)\n",
++            force_desc_page_size, PAGE_SIZE);
++        *out_page_size = force_desc_page_size;
++        return 0;
++    }
++
++    err = pcie_capability_read_word(pdev, PCI_EXP_DEVCTL, &pcie_device_control);
++    if (err < 0) {
++        pci_err(pdev, "Couldn't read DEVCTL capability\n");
++        return err;
++    }
++
++    switch (pcie_device_control & PCI_EXP_DEVCTL_READRQ) {
++    case PCI_EXP_DEVCTL_READRQ_128B:
++        pci_notice(pdev, "Probing: Setting max_desc_page_size to 128 (recommended value is %u)\n", defualt_page_size);
++        *out_page_size = 128;
++        return 0;
++    case PCI_EXP_DEVCTL_READRQ_256B:
++        pci_notice(pdev, "Probing: Setting max_desc_page_size to 256 (recommended value is %u)\n", defualt_page_size);
++        *out_page_size = 256;
++        return 0;
++    default:
++        pci_notice(pdev, "Probing: Setting max_desc_page_size to %u, (page_size=%lu)\n", defualt_page_size, PAGE_SIZE);
++        *out_page_size = defualt_page_size;
++        return 0;
++    };
++}
++
++// should be called only from fops_open (once)
++struct hailo_pcie_board* hailo_pcie_get_board_index(u32 index)
++{
++    struct hailo_pcie_board *pBoard, *pRet = NULL;
++
++    down(&g_hailo_add_board_mutex);
++    list_for_each_entry(pBoard, &g_hailo_board_list, board_list)
++    {
++        if ( index == pBoard->board_index )
++        {
++            atomic_inc(&pBoard->ref_count);
++            pRet = pBoard;
++            break;
++        }
++    }
++    up(&g_hailo_add_board_mutex);
++
++    return pRet;
++}
++
++/**
++ * hailo_pcie_disable_aspm - Disable ASPM states
++ * @board: pointer to PCI board struct
++ * @state: bit-mask of ASPM states to disable
++ * @locked: indication if this context holds pci_bus_sem locked.
++ *
++ * Some devices *must* have certain ASPM states disabled per hardware errata.
++ **/
++static int hailo_pcie_disable_aspm(struct hailo_pcie_board *board, u16 state, bool locked)
++{
++    struct pci_dev *pdev = board->pDev;
++    struct pci_dev *parent = pdev->bus->self;
++    u16 aspm_dis_mask = 0;
++    u16 pdev_aspmc = 0;
++    u16 parent_aspmc = 0;
++    int err = 0;
++
++    switch (state) {
++    case PCIE_LINK_STATE_L0S:
++        aspm_dis_mask |= PCI_EXP_LNKCTL_ASPM_L0S;
++        break;
++    case PCIE_LINK_STATE_L1:
++        aspm_dis_mask |= PCI_EXP_LNKCTL_ASPM_L1;
++        break;
++    default:
++        break;
++    }
++
++    err = pcie_capability_read_word(pdev, PCI_EXP_LNKCTL, &pdev_aspmc);
++    if (err < 0) {
++        hailo_err(board, "Couldn't read LNKCTL capability\n");
++        return err;
++    }
++
++    pdev_aspmc &= PCI_EXP_LNKCTL_ASPMC;
++
++    if (parent) {
++        err = pcie_capability_read_word(parent, PCI_EXP_LNKCTL, &parent_aspmc);
++        if (err < 0) {
++            hailo_err(board, "Couldn't read slot LNKCTL capability\n");
++            return err;
++        }
++        parent_aspmc &= PCI_EXP_LNKCTL_ASPMC;
++    }
++
++    hailo_notice(board, "Disabling ASPM %s %s\n",
++        (aspm_dis_mask & PCI_EXP_LNKCTL_ASPM_L0S) ? "L0s" : "",
++        (aspm_dis_mask & PCI_EXP_LNKCTL_ASPM_L1) ? "L1" : "");
++
++    // Disable L0s even if it is currently disabled as ASPM states can be enabled by the kernel when changing power modes
++#ifdef CONFIG_PCIEASPM
++    if (locked) {
++        // Older kernel versions (<5.2.21) don't return value for this functions, so we try manual disabling anyway
++        (void)pci_disable_link_state_locked(pdev, state);
++    } else {
++        (void)pci_disable_link_state(pdev, state);
++    }
++
++    /* Double-check ASPM control.  If not disabled by the above, the
++     * BIOS is preventing that from happening (or CONFIG_PCIEASPM is
++     * not enabled); override by writing PCI config space directly.
++     */                       
++    err = pcie_capability_read_word(pdev, PCI_EXP_LNKCTL, &pdev_aspmc);
++    if (err < 0) {
++        hailo_err(board, "Couldn't read LNKCTL capability\n");
++        return err;
++    }
++    pdev_aspmc &= PCI_EXP_LNKCTL_ASPMC;
++
++    if (!(aspm_dis_mask & pdev_aspmc)) {
++        hailo_notice(board, "Successfully disabled ASPM %s %s\n",
++            (aspm_dis_mask & PCI_EXP_LNKCTL_ASPM_L0S) ? "L0s" : "",
++            (aspm_dis_mask & PCI_EXP_LNKCTL_ASPM_L1) ? "L1" : "");
++        return 0;
++    }
++#endif
++
++    /* Both device and parent should have the same ASPM setting.
++     * Disable ASPM in downstream component first and then upstream.
++     */
++    err = pcie_capability_clear_word(pdev, PCI_EXP_LNKCTL, aspm_dis_mask);
++    if (err < 0) {
++        hailo_err(board, "Couldn't read LNKCTL capability\n");
++        return err;
++    }
++    if (parent) {
++        err = pcie_capability_clear_word(parent, PCI_EXP_LNKCTL, aspm_dis_mask);
++        if (err < 0) {
++            hailo_err(board, "Couldn't read slot LNKCTL capability\n");
++            return err;
++        }
++    }
++    hailo_notice(board, "Manually disabled ASPM %s %s\n",
++        (aspm_dis_mask & PCI_EXP_LNKCTL_ASPM_L0S) ? "L0s" : "",
++        (aspm_dis_mask & PCI_EXP_LNKCTL_ASPM_L1) ? "L1" : "");
++
++    return 0;
++}
++
++static void hailo_pcie_insert_board(struct hailo_pcie_board* pBoard)
++{
++    u32 index = 0;
++    struct hailo_pcie_board *pCurrent, *pNext;
++
++
++    down(&g_hailo_add_board_mutex);
++    if ( list_empty(&g_hailo_board_list)  ||
++            list_first_entry(&g_hailo_board_list, struct hailo_pcie_board, board_list)->board_index > 0)
++    {
++        pBoard->board_index = 0;
++        list_add(&pBoard->board_list, &g_hailo_board_list);
++
++        up(&g_hailo_add_board_mutex);
++        return;
++    }
++
++    list_for_each_entry_safe(pCurrent, pNext, &g_hailo_board_list, board_list)
++    {
++        index = pCurrent->board_index+1;
++        if( list_is_last(&pCurrent->board_list, &g_hailo_board_list) || (index != pNext->board_index))
++        {
++            break;
++        }
++    }
++
++    pBoard->board_index = index;
++    list_add(&pBoard->board_list, &pCurrent->board_list);
++
++    up(&g_hailo_add_board_mutex);
++
++    return;
++}
++
++static void hailo_pcie_remove_board(struct hailo_pcie_board* pBoard)
++{
++    down(&g_hailo_add_board_mutex);
++    if (pBoard)
++    {
++        list_del(&pBoard->board_list);
++    }
++    up(&g_hailo_add_board_mutex);
++}
++
++static int hailo_write_config(struct hailo_pcie_resources *resources, struct device *dev,
++    const struct hailo_config_constants *config_consts)
++{
++    const struct firmware *config = NULL;
++    int err = 0;
++
++    if (NULL == config_consts->filename) {
++        // Config not supported for platform
++        return 0;
++    }
++
++    err = request_firmware_direct(&config, config_consts->filename, dev);
++    if (err < 0) {
++        hailo_dev_info(dev, "Config %s not found\n", config_consts->filename);
++        return 0;
++    }
++
++    hailo_dev_notice(dev, "Writing config %s\n", config_consts->filename);
++
++    err = hailo_pcie_write_config_common(resources, config->data, config->size, config_consts);
++    if (err < 0) {
++        if (-EINVAL == err) {
++            hailo_dev_warn(dev, "Config size %zu is bigger than max %zu\n", config->size, config_consts->max_size);
++        }
++        release_firmware(config);
++        return err;
++    }
++
++    release_firmware(config);
++    return 0;
++}
++
++static bool wait_for_firmware_completion(struct completion *fw_load_completion)
++{
++    return (0 != wait_for_completion_timeout(fw_load_completion, FIRMWARE_WAIT_TIMEOUT_MS));
++}
++
++static int hailo_load_firmware(struct hailo_pcie_resources *resources,
++    struct device *dev, struct completion *fw_load_completion)
++{
++    const struct firmware *firmware = NULL;
++    int err = 0;
++
++    if (hailo_pcie_is_firmware_loaded(resources)) {
++        hailo_dev_warn(dev, "Firmware was already loaded\n");
++        return 0;
++    }
++
++    reinit_completion(fw_load_completion);
++
++    err = hailo_write_config(resources, dev, hailo_pcie_get_board_config_constants(resources->board_type));
++    if (err < 0) {
++        hailo_dev_err(dev, "Failed writing board config");
++        return err;
++    }
++
++    err = hailo_write_config(resources, dev, hailo_pcie_get_user_config_constants(resources->board_type));
++    if (err < 0) {
++        hailo_dev_err(dev, "Failed writing fw config");
++        return err;
++    }
++
++    // read firmware file
++    err = request_firmware_direct(&firmware, hailo_pcie_get_fw_filename(resources->board_type), dev);
++    if (err < 0) {
++        hailo_dev_warn(dev, "Firmware file not found (/lib/firmware/%s), please upload the firmware manually \n",
++            hailo_pcie_get_fw_filename(resources->board_type));
++        return 0;
++    }
++
++    err = hailo_pcie_write_firmware(resources, firmware->data, firmware->size);
++    if (err < 0) {
++        hailo_dev_err(dev, "Failed writing firmware. err %d\n", err);
++        release_firmware(firmware);
++        return err;
++    }
++
++    release_firmware(firmware);
++
++    if (!wait_for_firmware_completion(fw_load_completion)) {
++        hailo_dev_err(dev, "Timeout waiting for firmware..\n");
++        return -ETIMEDOUT;
++    }
++
++    hailo_dev_notice(dev, "Firmware was loaded successfully\n");
++    return 0;
++}
++
++static int hailo_activate_board(struct hailo_pcie_board *board)
++{
++    int err = 0;
++
++    (void)hailo_pcie_disable_aspm(board, PCIE_LINK_STATE_L0S, false);
++
++    err = hailo_enable_interrupts(board);
++    if (err < 0) {
++        hailo_err(board, "Failed Enabling interrupts %d\n", err);
++        return err;
++    }
++
++    err = hailo_load_firmware(&board->pcie_resources, &board->pDev->dev,
++        &board->fw_loaded_completion);
++    if (err < 0) {
++        hailo_err(board, "Firmware load failed\n");
++        hailo_disable_interrupts(board);
++        return err;
++    }
++
++    hailo_disable_interrupts(board);
++
++    if (power_mode_enabled()) {
++        // Setting the device to low power state, until the user opens the device
++        err = pci_set_power_state(board->pDev, PCI_D3hot);
++        if (err < 0) {
++            hailo_err(board, "Set power state failed %d\n", err);
++            return err;
++        }
++    }
++
++    return 0;
++}
++
++int hailo_enable_interrupts(struct hailo_pcie_board *board)
++{
++    int err = 0;
++
++    if (board->interrupts_enabled) {
++        hailo_crit(board, "Failed enabling interrupts (already enabled)\n");
++        return -EINVAL;
++    }
++
++    // TODO HRT-2253: use new api for enabling msi: (pci_alloc_irq_vectors)
++    if ((err = pci_enable_msi(board->pDev))) {
++        hailo_err(board, "Failed to enable MSI %d\n", err);
++        return err;
++    }
++    hailo_info(board, "Enabled MSI interrupt\n");
++
++    err = request_irq(board->pDev->irq, hailo_irqhandler, HAILO_IRQ_FLAGS, DRIVER_NAME, board);
++    if (err) {
++        hailo_err(board, "request_irq failed %d\n", err);
++        pci_disable_msi(board->pDev);
++        return err;
++    }
++    hailo_info(board, "irq enabled %u\n", board->pDev->irq);
++
++    hailo_pcie_enable_interrupts(&board->pcie_resources);
++
++    board->interrupts_enabled = true;
++    return 0;
++}
++
++void hailo_disable_interrupts(struct hailo_pcie_board *board)
++{
++    // Sanity Check
++    if ((NULL == board) || (NULL == board->pDev)) {
++        pr_err("Failed to access board or device\n");
++        return;
++    }
++
++    if (!board->interrupts_enabled) {
++        return;
++    }
++
++    board->interrupts_enabled = false;
++    hailo_pcie_disable_interrupts(&board->pcie_resources);
++    free_irq(board->pDev->irq, board);
++    pci_disable_msi(board->pDev);
++}
++
++static int hailo_bar_iomap(struct pci_dev *pdev, int bar, struct hailo_resource *resource)
++{
++    resource->size = pci_resource_len(pdev, bar);
++    resource->address = (uintptr_t)(pci_iomap(pdev, bar, resource->size));
++
++    if (!resource->size || !resource->address) {
++        pci_err(pdev, "Probing: Invalid PCIe BAR %d", bar);
++        return -EINVAL;
++    }
++
++    pci_notice(pdev, "Probing: mapped bar %d - %p %zu\n", bar,
++        (void*)resource->address, resource->size);
++    return 0;
++}
++
++static void hailo_bar_iounmap(struct pci_dev *pdev, struct hailo_resource *resource)
++{
++    if (resource->address) {
++        pci_iounmap(pdev, (void*)resource->address);
++        resource->address = 0;
++        resource->size = 0;
++    }
++}
++
++static int pcie_resources_init(struct pci_dev *pdev, struct hailo_pcie_resources *resources,
++    enum hailo_board_type board_type)
++{
++    int err = -EINVAL;
++    if (board_type >= HAILO_BOARD_TYPE_COUNT) {
++        pci_err(pdev, "Probing: Invalid board type %d\n", (int)board_type);
++        err = -EINVAL;
++        goto failure_exit;
++    }
++
++    err = pci_request_regions(pdev, DRIVER_NAME);
++    if (err < 0) {
++        pci_err(pdev, "Probing: Error allocating bars %d\n", err);
++        goto failure_exit;
++    }
++
++    err = hailo_bar_iomap(pdev, HAILO_PCIE_CONFIG_BAR, &resources->config);
++    if (err < 0) {
++        goto failure_release_regions;
++    }
++
++    err = hailo_bar_iomap(pdev, HAILO_PCIE_VDMA_REGS_BAR, &resources->vdma_registers);
++    if (err < 0) {
++        goto failure_release_config;
++    }
++
++    err = hailo_bar_iomap(pdev, HAILO_PCIE_FW_ACCESS_BAR, &resources->fw_access);
++    if (err < 0) {
++        goto failure_release_vdma_regs;
++    }
++
++    resources->board_type = board_type;
++
++    if (!hailo_pcie_is_device_connected(resources)) {
++        pci_err(pdev, "Probing: Failed reading device BARs, device may be disconnected\n");
++        err = -ENODEV;
++        goto failure_release_fw_access;
++    }
++
++    return 0;
++
++failure_release_fw_access:
++    hailo_bar_iounmap(pdev, &resources->fw_access);
++failure_release_vdma_regs:
++    hailo_bar_iounmap(pdev, &resources->vdma_registers);
++failure_release_config:
++    hailo_bar_iounmap(pdev, &resources->config);
++failure_release_regions:
++    pci_release_regions(pdev);
++failure_exit:
++    return err;
++}
++
++static void pcie_resources_release(struct pci_dev *pdev, struct hailo_pcie_resources *resources)
++{
++    hailo_bar_iounmap(pdev, &resources->config);
++    hailo_bar_iounmap(pdev, &resources->vdma_registers);
++    hailo_bar_iounmap(pdev, &resources->fw_access);
++    pci_release_regions(pdev);
++}
++
++static void update_channel_interrupts(struct hailo_vdma_controller *controller,
++    size_t engine_index, u32 channels_bitmap)
++{
++    struct hailo_pcie_board *board = (struct hailo_pcie_board*) dev_get_drvdata(controller->dev);
++    if (engine_index >= board->vdma.vdma_engines_count) {
++        hailo_err(board, "Invalid engine index %zu", engine_index);
++        return;
++    }
++
++    hailo_pcie_update_channel_interrupts_mask(&board->pcie_resources, channels_bitmap);
++}
++
++static struct hailo_vdma_controller_ops pcie_vdma_controller_ops = {
++    .update_channel_interrupts = update_channel_interrupts,
++};
++
++
++static int hailo_pcie_vdma_controller_init(struct hailo_vdma_controller *controller,
++    struct device *dev, struct hailo_resource *vdma_registers)
++{
++    const size_t engines_count = 1;
++    return hailo_vdma_controller_init(controller, dev, &hailo_pcie_vdma_hw,
++        &pcie_vdma_controller_ops, vdma_registers, engines_count);
++}
++
++// Tries to check if address allocated with kmalloc is dma capable.
++// If kmalloc address is not dma capable we assume other addresses
++// won't be dma capable as well.
++static bool is_kmalloc_dma_capable(struct device *dev)
++{
++    void *check_addr = NULL;
++    dma_addr_t dma_addr = 0;
++    phys_addr_t phys_addr = 0;
++    bool capable = false;
++
++    if (!dev->dma_mask) {
++        return false;
++    }
++
++    check_addr = kmalloc(PAGE_SIZE, GFP_KERNEL);
++    if (NULL == check_addr) {
++        dev_err(dev, "failed allocating page!\n");
++        return false;
++    }
++
++    phys_addr = virt_to_phys(check_addr);
++    dma_addr = phys_to_dma(dev, phys_addr);
++
++    capable = is_dma_capable(dev, dma_addr, PAGE_SIZE);
++    kfree(check_addr);
++    return capable;
++}
++
++static int hailo_get_allocation_mode(struct pci_dev *pdev, enum hailo_allocation_mode *allocation_mode)
++{
++    // Check if module paramater was given to override driver choice
++    if (HAILO_NO_FORCE_BUFFER != force_allocation_from_driver) {
++        if (HAILO_FORCE_BUFFER_FROM_USERSPACE == force_allocation_from_driver) {
++            *allocation_mode = HAILO_ALLOCATION_MODE_USERSPACE;
++            pci_notice(pdev, "Probing: Using userspace allocated vdma buffers\n");
++        }
++        else if (HAILO_FORCE_BUFFER_FROM_DRIVER == force_allocation_from_driver) {
++            *allocation_mode = HAILO_ALLOCATION_MODE_DRIVER;
++            pci_notice(pdev, "Probing: Using driver allocated vdma buffers\n");
++        }
++        else {
++            pci_err(pdev, "Invalid value for force allocation driver paramater - value given: %d!\n",
++                force_allocation_from_driver);
++            return -EINVAL;
++        }
++
++        return 0;
++    }
++
++    if (is_kmalloc_dma_capable(&pdev->dev)) {
++        *allocation_mode = HAILO_ALLOCATION_MODE_USERSPACE;
++        pci_notice(pdev, "Probing: Using userspace allocated vdma buffers\n");
++    } else {
++        *allocation_mode = HAILO_ALLOCATION_MODE_DRIVER;
++        pci_notice(pdev, "Probing: Using driver allocated vdma buffers\n");
++    }
++
++    return 0;
++}
++
++static int hailo_pcie_probe(struct pci_dev* pDev, const struct pci_device_id* id)
++{
++    struct hailo_pcie_board * pBoard;
++    struct device *char_device = NULL;
++    int err = -EINVAL;
++
++    pci_notice(pDev, "Probing on: %04x:%04x...\n", pDev->vendor, pDev->device);
++#ifdef HAILO_EMULATOR
++    pci_notice(pDev, "PCIe driver was compiled in emulator mode\n");
++#endif /* HAILO_EMULATOR */
++    if (!g_is_power_mode_enabled) {
++        pci_notice(pDev, "PCIe driver was compiled with power modes disabled\n");
++    }
++
++    /* Initialize device extension for the board*/
++    pci_notice(pDev, "Probing: Allocate memory for device extension, %zu\n", sizeof(struct hailo_pcie_board));
++    pBoard = (struct hailo_pcie_board*) kzalloc( sizeof(struct hailo_pcie_board), GFP_KERNEL);
++    if (pBoard == NULL)
++    {
++        pci_err(pDev, "Probing: Failed to allocate memory for device extension structure\n");
++        err = -ENOMEM;
++        goto probe_exit;
++    }
++
++    pBoard->pDev = pDev;
++
++    if ( (err = pci_enable_device(pDev)) )
++    {
++        pci_err(pDev, "Probing: Failed calling pci_enable_device %d\n", err);
++        goto probe_free_board;
++    }
++    pci_notice(pDev, "Probing: Device enabled\n");
++
++    pci_set_master(pDev);
++
++    err = pcie_resources_init(pDev, &pBoard->pcie_resources, id->driver_data);
++    if (err < 0) {
++        pci_err(pDev, "Probing: Failed init pcie resources");
++        goto probe_disable_device;
++    }
++
++    err = hailo_get_desc_page_size(pDev, &pBoard->desc_max_page_size);
++    if (err < 0) {
++        goto probe_release_pcie_resources;
++    }
++
++    pBoard->interrupts_enabled = false;
++    init_completion(&pBoard->fw_loaded_completion);
++
++    sema_init(&pBoard->mutex, 1);
++    atomic_set(&pBoard->ref_count, 0);
++    INIT_LIST_HEAD(&pBoard->open_files_list);
++
++    sema_init(&pBoard->fw_control.mutex, 1);
++    spin_lock_init(&pBoard->notification_read_spinlock);
++    init_completion(&pBoard->fw_control.completion);
++
++    init_completion(&pBoard->driver_down.reset_completed);
++
++    INIT_LIST_HEAD(&pBoard->notification_wait_list);
++
++    memset(&pBoard->notification_cache, 0, sizeof(pBoard->notification_cache));
++    memset(&pBoard->memory_transfer_params, 0, sizeof(pBoard->memory_transfer_params));
++
++    err = hailo_pcie_vdma_controller_init(&pBoard->vdma, &pBoard->pDev->dev,
++        &pBoard->pcie_resources.vdma_registers);
++    if (err < 0) {
++        hailo_err(pBoard, "Failed init vdma controller %d\n", err);
++        goto probe_release_pcie_resources;
++    }
++
++    // Checks the dma mask => it must be called after the device's dma_mask is set by hailo_pcie_vdma_controller_init
++    err = hailo_get_allocation_mode(pDev, &pBoard->allocation_mode);
++    if (err < 0) {
++        pci_err(pDev, "Failed determining allocation of buffers from driver. error type: %d\n", err);
++        goto probe_release_pcie_resources;
++    }
++
++    err = hailo_activate_board(pBoard);
++    if (err < 0) {
++        hailo_err(pBoard, "Failed activating board %d\n", err);
++        goto probe_release_pcie_resources;
++    }
++
++    /* Keep track on the device, in order, to be able to remove it later */
++    pci_set_drvdata(pDev, pBoard);
++    hailo_pcie_insert_board(pBoard);
++
++    /* Create dynamically the device node*/
++    char_device = device_create_with_groups(chardev_class, NULL,
++                                            MKDEV(char_major, pBoard->board_index),
++                                            pBoard,
++                                            g_hailo_dev_groups,
++                                            DEVICE_NODE_NAME"%d", pBoard->board_index);
++    if (IS_ERR(char_device)) {
++        hailo_err(pBoard, "Failed creating dynamic device %d\n", pBoard->board_index);
++        err = PTR_ERR(char_device);
++        goto probe_remove_board;
++    }
++
++    hailo_notice(pBoard, "Probing: Added board %0x-%0x, /dev/hailo%d\n", pDev->vendor, pDev->device, pBoard->board_index);
++
++    return 0;
++
++probe_remove_board:
++    hailo_pcie_remove_board(pBoard);
++
++probe_release_pcie_resources:
++    pcie_resources_release(pBoard->pDev, &pBoard->pcie_resources);
++
++probe_disable_device:
++    pci_disable_device(pDev);
++
++probe_free_board:
++    kfree(pBoard);
++
++probe_exit:
++
++    return err;
++}
++
++static void hailo_pcie_remove(struct pci_dev* pDev)
++{
++    struct hailo_pcie_board* pBoard = (struct hailo_pcie_board*) pci_get_drvdata(pDev);
++    struct hailo_notification_wait *cursor = NULL;
++
++    pci_notice(pDev, "Remove: Releasing board\n");
++
++    if (pBoard)
++    {
++
++        // lock board to wait for any pending operations and for synchronization with open
++        down(&pBoard->mutex);
++
++
++        // remove board from active boards list
++        hailo_pcie_remove_board(pBoard);
++
++
++        /* Delete the device node */
++        device_destroy(chardev_class, MKDEV(char_major, pBoard->board_index));
++
++        // disable interrupts - will only disable if they have not been disabled in release already
++        hailo_disable_interrupts(pBoard);
++
++        pcie_resources_release(pBoard->pDev, &pBoard->pcie_resources);
++
++        // deassociate device from board to be picked up by char device
++        pBoard->pDev = NULL;
++
++        pBoard->vdma.dev = NULL;
++
++        pci_disable_device(pDev);
++
++        pci_set_drvdata(pDev, NULL);
++
++        // Lock rcu_read_lock and send notification_completion to wake anyone waiting on the notification_wait_list when removed
++        rcu_read_lock();
++        list_for_each_entry_rcu(cursor, &pBoard->notification_wait_list, notification_wait_list) {
++            cursor->is_disabled = true;
++            complete(&cursor->notification_completion);
++        }
++        rcu_read_unlock();
++
++        up(&pBoard->mutex);
++
++        if ( 0 == atomic_read(&pBoard->ref_count) )
++        {
++            // nobody has the board open - free
++            pci_notice(pDev, "Remove: Freed board, /dev/hailo%d\n", pBoard->board_index);
++            kfree(pBoard);
++        }
++        else
++        {
++            // board resources are freed on last close
++            pci_notice(pDev, "Remove: Scheduled for board removal, /dev/hailo%d\n", pBoard->board_index);
++        }
++    }
++
++}
++
++#ifdef CONFIG_PM_SLEEP
++static int hailo_pcie_suspend(struct device *dev)
++{
++    struct hailo_pcie_board *board = (struct hailo_pcie_board*) dev_get_drvdata(dev);
++    struct hailo_file_context *cur = NULL;
++    int err = 0;
++
++    // lock board to wait for any pending operations
++    down(&board->mutex);
++
++    // Disable all interrupts. All interrupts from Hailo chip would be masked.
++    hailo_disable_interrupts(board);
++
++    // Close all vDMA channels
++    if (board->vdma.used_by_filp != NULL) {
++        err = hailo_pcie_driver_down(board);
++        if (err < 0) {
++            dev_notice(dev, "Error while trying to call FW to close vdma channels\n");
++        }
++    }
++
++    // Un validate all activae file contexts so every new action would return error to the user.
++    list_for_each_entry(cur, &board->open_files_list, open_files_list) {
++        cur->is_valid = false;
++    }
++
++    // Release board
++    up(&board->mutex);
++
++    dev_notice(dev, "PM's suspend\n");
++    // Continue system suspend
++    return err;
++}
++
++static int hailo_pcie_resume(struct device *dev)
++{
++    struct hailo_pcie_board *board = (struct hailo_pcie_board*) dev_get_drvdata(dev);
++    int err = 0;
++
++    if ((err = hailo_activate_board(board)) < 0) {
++        dev_err(dev, "Failed activating board %d\n", err);
++        return err;
++    }
++
++    dev_notice(dev, "PM's resume\n");
++    return 0;
++}
++#endif /* CONFIG_PM_SLEEP */
++
++static SIMPLE_DEV_PM_OPS(hailo_pcie_pm_ops, hailo_pcie_suspend, hailo_pcie_resume);
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION( 3, 16, 0 )
++static void hailo_pci_reset_prepare(struct pci_dev *pdev)
++{
++    struct hailo_pcie_board* board = (struct hailo_pcie_board*) pci_get_drvdata(pdev);
++    int err = 0;
++    /* Reset preparation logic goes here */
++    pci_err(pdev, "Reset preparation for PCI device \n");
++
++    if (board)
++    {
++        // lock board to wait for any pending operations and for synchronization with open
++        down(&board->mutex);
++        if (board->vdma.used_by_filp != NULL) {
++            // Try to close all vDMA channels before reset
++            err = hailo_pcie_driver_down(board);
++            if (err < 0) {
++                pci_err(pdev, "Error while trying to call FW to close vdma channels (errno %d)\n", err);
++            }
++        }
++        up(&board->mutex);
++    }
++}
++#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION( 3, 16, 0 ) */
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION( 4, 13, 0 ) && LINUX_VERSION_CODE >= KERNEL_VERSION( 3, 16, 0 )
++static void hailo_pci_reset_notify(struct pci_dev *pdev, bool prepare)
++{
++    if (prepare) {
++        hailo_pci_reset_prepare(pdev);
++    }
++}
++#endif
++
++static const struct pci_error_handlers hailo_pcie_err_handlers = {
++#if LINUX_VERSION_CODE < KERNEL_VERSION( 3, 16, 0 )
++/* No FLR callback */
++#elif LINUX_VERSION_CODE < KERNEL_VERSION( 4, 13, 0 )
++/* FLR Callback is reset_notify */
++	.reset_notify	= hailo_pci_reset_notify,
++#else
++/* FLR Callback is reset_prepare */
++	.reset_prepare	= hailo_pci_reset_prepare,
++#endif
++};
++
++static struct pci_device_id hailo_pcie_id_table[] =
++{
++    {PCI_DEVICE_DATA(HAILO, HAILO8, HAILO_BOARD_TYPE_HAILO8)},
++    {PCI_DEVICE_DATA(HAILO, HAILO15, HAILO_BOARD_TYPE_HAILO15)},
++    {PCI_DEVICE_DATA(HAILO, PLUTO, HAILO_BOARD_TYPE_PLUTO)},
++    {0,0,0,0,0,0,0 },
++};
++
++static struct file_operations hailo_pcie_fops =
++{
++    owner:              THIS_MODULE,
++    unlocked_ioctl:     hailo_pcie_fops_unlockedioctl,
++    mmap:               hailo_pcie_fops_mmap,
++    open:               hailo_pcie_fops_open,
++    release:            hailo_pcie_fops_release
++};
++
++
++static struct pci_driver hailo_pci_driver =
++{
++    name:		 DRIVER_NAME,
++    id_table:    hailo_pcie_id_table,
++    probe:		 hailo_pcie_probe,
++    remove:		 hailo_pcie_remove,
++    driver: {
++        pm: &hailo_pcie_pm_ops,
++    },
++    err_handler: &hailo_pcie_err_handlers,
++};
++
++MODULE_DEVICE_TABLE (pci, hailo_pcie_id_table);
++
++static int hailo_pcie_register_chrdev(unsigned int major, const char *name)
++{
++    int char_major;
++
++    char_major = register_chrdev(major, name, &hailo_pcie_fops);
++
++    chardev_class = class_create_compat("hailo_chardev");
++
++    return char_major;
++}
++
++static void hailo_pcie_unregister_chrdev(unsigned int major, const char *name)
++{
++    class_destroy(chardev_class);
++    unregister_chrdev(major, name);
++}
++
++static int __init hailo_pcie_module_init(void)
++{
++    int err;
++
++    pr_notice(DRIVER_NAME ": Init module. driver version %s\n", HAILO_DRV_VER);
++
++    if ( 0 > (char_major = hailo_pcie_register_chrdev(0, DRIVER_NAME)) )
++    {
++        pr_err(DRIVER_NAME ": Init Error, failed to call register_chrdev.\n");
++
++        return char_major;
++    }
++
++    if ( 0 != (err = pci_register_driver(&hailo_pci_driver)))
++    {
++        pr_err(DRIVER_NAME ": Init Error, failed to call pci_register_driver.\n");
++        class_destroy(chardev_class);
++        hailo_pcie_unregister_chrdev(char_major, DRIVER_NAME);
++        return err;
++    }
++
++    return 0;
++}
++
++static void __exit hailo_pcie_module_exit(void)
++{
++
++    pr_notice(DRIVER_NAME ": Exit module.\n");
++
++    // Unregister the driver from pci bus
++    pci_unregister_driver(&hailo_pci_driver);
++    hailo_pcie_unregister_chrdev(char_major, DRIVER_NAME);
++
++    pr_notice(DRIVER_NAME ": Hailo PCIe driver unloaded.\n");
++}
++
++
++module_init(hailo_pcie_module_init);
++module_exit(hailo_pcie_module_exit);
++
++module_param(o_dbg, int, S_IRUGO | S_IWUSR);
++
++module_param_named(no_power_mode, g_is_power_mode_enabled, invbool, S_IRUGO);
++MODULE_PARM_DESC(no_power_mode, "Disables automatic D0->D3 PCIe transactions");
++
++module_param(force_allocation_from_driver, int, S_IRUGO);
++MODULE_PARM_DESC(force_allocation_from_driver, "Determines whether to force buffer allocation from driver or userspace");
++
++module_param(force_desc_page_size, int, S_IRUGO);
++MODULE_PARM_DESC(force_desc_page_size, "Determines the maximum DMA descriptor page size (must be a power of 2)");
++
++MODULE_AUTHOR("Hailo Technologies Ltd.");
++MODULE_DESCRIPTION("Hailo PCIe driver");
++MODULE_LICENSE("GPL v2");
++MODULE_VERSION(HAILO_DRV_VER);
++
+--- /dev/null
++++ b/drivers/media/pci/hailo/src/pcie.h
+@@ -0,0 +1,82 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#ifndef _HAILO_PCI_PCIE_H_
++#define _HAILO_PCI_PCIE_H_
++
++#include "vdma/vdma.h"
++#include "hailo_ioctl_common.h"
++#include "pcie_common.h"
++#include "utils/fw_common.h"
++
++#include <linux/pci.h>
++#include <linux/fs.h>
++#include <linux/interrupt.h>
++#include <linux/circ_buf.h>
++#include <linux/device.h>
++
++#include <linux/ioctl.h>
++
++struct hailo_fw_control_info {
++    // protects that only one fw control will be send at a time
++    struct semaphore    mutex;
++    // called from the interrupt handler to notify that a response is ready
++    struct completion   completion;
++    // the command we are currently handling
++    struct hailo_fw_control command;
++};
++
++struct hailo_pcie_driver_down_info {
++    // called from the interrupt handler to notify that FW completed reset
++    struct completion   reset_completed;
++};
++
++struct hailo_fw_boot {
++    // the filp that enabled interrupts for fw boot. the interrupt is enabled if this is not null
++    struct file *filp;
++    // called from the interrupt handler to notify that an interrupt was raised
++    struct completion completion;
++};
++
++
++// Context for each open file handle
++// TODO: store board and use as actual context
++struct hailo_file_context {
++    struct list_head open_files_list;
++    struct file *filp;
++    struct hailo_vdma_file_context vdma_context;
++    bool is_valid;
++};
++
++struct hailo_pcie_board {
++    struct list_head board_list;
++    struct pci_dev *pDev;
++    u32 board_index;
++    atomic_t ref_count;
++    struct list_head open_files_list;
++    struct hailo_pcie_resources pcie_resources;
++    struct hailo_fw_control_info fw_control;
++    struct hailo_pcie_driver_down_info driver_down;
++    struct semaphore mutex;
++    struct hailo_vdma_controller vdma;
++    spinlock_t notification_read_spinlock;
++    struct list_head notification_wait_list;
++    struct hailo_d2h_notification notification_cache;
++    struct hailo_d2h_notification notification_to_user;
++    struct hailo_memory_transfer_params memory_transfer_params;
++    u32 desc_max_page_size;
++    enum hailo_allocation_mode allocation_mode;
++    struct completion fw_loaded_completion;
++    bool interrupts_enabled;
++};
++
++bool power_mode_enabled(void);
++
++struct hailo_pcie_board* hailo_pcie_get_board_index(u32 index);
++void hailo_disable_interrupts(struct hailo_pcie_board *board);
++int hailo_enable_interrupts(struct hailo_pcie_board *board);
++
++#endif /* _HAILO_PCI_PCIE_H_ */
++
+--- /dev/null
++++ b/drivers/media/pci/hailo/src/sysfs.c
+@@ -0,0 +1,36 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#include "sysfs.h"
++#include "pcie.h"
++
++#include <linux/device.h>
++#include <linux/sysfs.h>
++
++static ssize_t board_location_show(struct device *dev, struct device_attribute *_attr,
++    char *buf)
++{
++    struct hailo_pcie_board *board = (struct hailo_pcie_board *)dev_get_drvdata(dev);
++    const char *dev_info = pci_name(board->pDev);
++    return sprintf(buf, "%s", dev_info);
++}
++static DEVICE_ATTR_RO(board_location);
++
++static ssize_t device_id_show(struct device *dev, struct device_attribute *_attr,
++    char *buf)
++{
++    struct hailo_pcie_board *board = (struct hailo_pcie_board *)dev_get_drvdata(dev);
++    return sprintf(buf, "%x:%x", board->pDev->vendor, board->pDev->device);
++}
++static DEVICE_ATTR_RO(device_id);
++
++static struct attribute *hailo_dev_attrs[] = {
++    &dev_attr_board_location.attr,
++    &dev_attr_device_id.attr,
++    NULL
++};
++
++ATTRIBUTE_GROUPS(hailo_dev);
++const struct attribute_group **g_hailo_dev_groups = hailo_dev_groups;
+--- /dev/null
++++ b/drivers/media/pci/hailo/src/sysfs.h
+@@ -0,0 +1,13 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#ifndef _HAILO_PCI_SYSFS_H_
++#define _HAILO_PCI_SYSFS_H_
++
++#include <linux/sysfs.h>
++
++extern const struct attribute_group **g_hailo_dev_groups;
++
++#endif /* _HAILO_PCI_SYSFS_H_ */
+--- /dev/null
++++ b/drivers/media/pci/hailo/src/utils.c
+@@ -0,0 +1,27 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#include <linux/version.h>
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/pci.h>
++
++#include "hailo_pcie_version.h"
++#include "pcie.h"
++#include "utils.h"
++#include "utils/logs.h"
++
++
++void hailo_pcie_clear_notification_wait_list(struct hailo_pcie_board *pBoard, struct file *filp)
++{
++    struct hailo_notification_wait *cur = NULL, *next = NULL;
++    list_for_each_entry_safe(cur, next, &pBoard->notification_wait_list, notification_wait_list) {
++        if (cur->filp == filp) {
++            list_del_rcu(&cur->notification_wait_list);
++            synchronize_rcu();
++            kfree(cur);
++        }
++    }
++}
+--- /dev/null
++++ b/drivers/media/pci/hailo/src/utils.h
+@@ -0,0 +1,21 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#ifndef _HAILO_PCI_UTILS_H_
++#define _HAILO_PCI_UTILS_H_
++
++#include <linux/version.h>
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/pci.h>
++#include <linux/interrupt.h>
++#include <linux/sched.h>
++#include <linux/pagemap.h>
++
++#include "pcie.h"
++
++void hailo_pcie_clear_notification_wait_list(struct hailo_pcie_board *pBoard, struct file *filp);
++
++#endif /* _HAILO_PCI_UTILS_H_ */
+--- /dev/null
++++ b/drivers/media/pci/hailo/utils/compact.h
+@@ -0,0 +1,153 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#ifndef _HAILO_PCI_COMPACT_H_
++#define _HAILO_PCI_COMPACT_H_
++
++#include <linux/version.h>
++#include <linux/scatterlist.h>
++#include <linux/vmalloc.h>
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 4, 0)
++#define class_create_compat class_create
++#else
++#define class_create_compat(name) class_create(THIS_MODULE, name)
++#endif
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 16, 0)
++#define pci_printk(level, pdev, fmt, arg...) \
++	dev_printk(level, &(pdev)->dev, fmt, ##arg)
++#define pci_emerg(pdev, fmt, arg...)	dev_emerg(&(pdev)->dev, fmt, ##arg)
++#define pci_alert(pdev, fmt, arg...)	dev_alert(&(pdev)->dev, fmt, ##arg)
++#define pci_crit(pdev, fmt, arg...)	dev_crit(&(pdev)->dev, fmt, ##arg)
++#define pci_err(pdev, fmt, arg...)	dev_err(&(pdev)->dev, fmt, ##arg)
++#define pci_warn(pdev, fmt, arg...)	dev_warn(&(pdev)->dev, fmt, ##arg)
++#define pci_notice(pdev, fmt, arg...)	dev_notice(&(pdev)->dev, fmt, ##arg)
++#define pci_info(pdev, fmt, arg...)	dev_info(&(pdev)->dev, fmt, ##arg)
++#define pci_dbg(pdev, fmt, arg...)	dev_dbg(&(pdev)->dev, fmt, ##arg)
++#endif
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 5, 0)
++#define get_user_pages_compact get_user_pages
++#elif LINUX_VERSION_CODE >= KERNEL_VERSION(4, 9, 0)
++#define get_user_pages_compact(start, nr_pages, gup_flags, pages) \
++    get_user_pages(start, nr_pages, gup_flags, pages, NULL)
++#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 4, 168)) && (LINUX_VERSION_CODE < KERNEL_VERSION(4, 5, 0))
++#define get_user_pages_compact(start, nr_pages, gup_flags, pages) \
++    get_user_pages(current, current->mm, start, nr_pages, gup_flags, pages, NULL)
++#else
++static inline long get_user_pages_compact(unsigned long start, unsigned long nr_pages,
++    unsigned int gup_flags, struct page **pages)
++{
++    int write = !!((gup_flags & FOLL_WRITE) == FOLL_WRITE);
++    int force = !!((gup_flags & FOLL_FORCE) == FOLL_FORCE);
++    return get_user_pages(current, current->mm, start, nr_pages, write, force,
++        pages, NULL);
++}
++#endif
++
++#ifndef _LINUX_MMAP_LOCK_H
++static inline void mmap_read_lock(struct mm_struct *mm)
++{
++    down_read(&mm->mmap_sem);
++}
++
++static inline void mmap_read_unlock(struct mm_struct *mm)
++{
++    up_read(&mm->mmap_sem);
++}
++#endif /* _LINUX_MMAP_LOCK_H */
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 0) && LINUX_VERSION_CODE < KERNEL_VERSION(5, 15, 0)
++#define sg_alloc_table_from_pages_segment_compat __sg_alloc_table_from_pages
++#else
++static inline struct scatterlist *sg_alloc_table_from_pages_segment_compat(struct sg_table *sgt,
++    struct page **pages, unsigned int n_pages, unsigned int offset,
++    unsigned long size, unsigned int max_segment,
++    struct scatterlist *prv, unsigned int left_pages,
++    gfp_t gfp_mask)
++{
++    int res = 0;
++
++    if (NULL != prv) {
++        // prv not suported
++        return ERR_PTR(-EINVAL);
++    }
++
++    if (0 != left_pages) {
++        // Left pages not supported
++        return ERR_PTR(-EINVAL);
++    }
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 15, 0)
++    res = sg_alloc_table_from_pages_segment(sgt, pages, n_pages, offset, size, max_segment, gfp_mask);
++#elif LINUX_VERSION_CODE >= KERNEL_VERSION(4, 15, 0)
++    res = __sg_alloc_table_from_pages(sgt, pages, n_pages, offset, size, max_segment, gfp_mask);
++#else
++    res = sg_alloc_table_from_pages(sgt, pages, n_pages, offset, size, gfp_mask);
++#endif
++    if (res < 0) {
++        return ERR_PTR(res);
++    }
++
++    return sgt->sgl;
++}
++#endif
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION( 5, 0, 0 )
++#define compatible_access_ok(a,b,c) access_ok(b, c)
++#else
++#define compatible_access_ok(a,b,c) access_ok(a, b, c)
++#endif
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 19, 0)
++#define PCI_DEVICE_DATA(vend, dev, data) \
++	.vendor = PCI_VENDOR_ID_##vend, .device = PCI_DEVICE_ID_##vend##_##dev, \
++	.subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID, 0, 0, \
++	.driver_data = (kernel_ulong_t)(data)
++#endif
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 12, 0)
++// On kernels < 4.1.12,  kvmalloc, kvfree is not implemented. For simplicity, instead of implement our own
++// kvmalloc/kvfree, just using vmalloc and vfree (It may reduce allocate/access performance, but it worth it).
++static inline void *kvmalloc_array(size_t n, size_t size, gfp_t flags)
++{
++    (void)flags; //ignore
++    return vmalloc(n * size);
++}
++
++#define kvfree vfree
++#endif
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 19, 0)
++static inline bool is_dma_capable(struct device *dev, dma_addr_t dma_addr, size_t size)
++{
++// Case for Rasberry Pie kernel versions 5.4.83 <=> 5.5.0 - already changed bus_dma_mask -> bus_dma_limit
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 5, 0)) || (defined(HAILO_RASBERRY_PIE) && LINUX_VERSION_CODE >= KERNEL_VERSION(5, 4, 83))
++    const u64 bus_dma_limit = dev->bus_dma_limit;
++#else
++    const u64 bus_dma_limit = dev->bus_dma_mask;
++#endif
++
++    return (dma_addr <= min_not_zero(*dev->dma_mask, bus_dma_limit));
++}
++#else
++static inline bool is_dma_capable(struct device *dev, dma_addr_t dma_addr, size_t size)
++{
++    // Implementation of dma_capable from linux kernel
++    const u64 bus_dma_limit = (*dev->dma_mask + 1) & ~(*dev->dma_mask);
++	if (bus_dma_limit && size > bus_dma_limit) {
++        return false;
++    }
++
++	if ((dma_addr | (dma_addr + size - 1)) & ~(*dev->dma_mask)) {
++        return false;
++    }
++
++    return true;
++}
++#endif // LINUX_VERSION_CODE >= KERNEL_VERSION(4, 19, 0)
++
++#endif /* _HAILO_PCI_COMPACT_H_ */
+\ No newline at end of file
+--- /dev/null
++++ b/drivers/media/pci/hailo/utils/fw_common.h
+@@ -0,0 +1,19 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#ifndef _HAILO_LINUX_COMMON_H_
++#define _HAILO_LINUX_COMMON_H_
++
++#include "hailo_ioctl_common.h"
++
++struct hailo_notification_wait {
++    struct list_head    notification_wait_list;
++    int                 tgid;
++    struct file*        filp;
++    struct completion 	notification_completion;
++    bool                is_disabled;
++};
++
++#endif /* _HAILO_LINUX_COMMON_H_ */
+\ No newline at end of file
+--- /dev/null
++++ b/drivers/media/pci/hailo/utils/logs.c
+@@ -0,0 +1,8 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#include "logs.h"
++
++int o_dbg = LOGLEVEL_NOTICE;
+--- /dev/null
++++ b/drivers/media/pci/hailo/utils/logs.h
+@@ -0,0 +1,45 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#ifndef _COMMON_LOGS_H_
++#define _COMMON_LOGS_H_
++
++#include <linux/kern_levels.h>
++
++// Should be used only by "module_param".
++// Specify the current debug level for the logs
++extern int o_dbg;
++
++
++// Logging, same interface as dev_*, uses o_dbg to filter
++// log messages
++#define hailo_printk(level, dev, fmt, ...)              \
++    do {                                                \
++        int __level = (level[1] - '0');                 \
++        if (__level <= o_dbg) {    \
++            dev_printk((level), dev, fmt, ##__VA_ARGS__); \
++        }                                               \
++    } while (0)
++
++#define hailo_emerg(board, fmt, ...) hailo_printk(KERN_EMERG, &(board)->pDev->dev, fmt, ##__VA_ARGS__)
++#define hailo_alert(board, fmt, ...) hailo_printk(KERN_ALERT, &(board)->pDev->dev, fmt, ##__VA_ARGS__)
++#define hailo_crit(board, fmt, ...)  hailo_printk(KERN_CRIT, &(board)->pDev->dev, fmt, ##__VA_ARGS__)
++#define hailo_err(board, fmt, ...) hailo_printk(KERN_ERR, &(board)->pDev->dev, fmt, ##__VA_ARGS__)
++#define hailo_warn(board, fmt, ...) hailo_printk(KERN_WARNING, &(board)->pDev->dev, fmt, ##__VA_ARGS__)
++#define hailo_notice(board, fmt, ...) hailo_printk(KERN_NOTICE, &(board)->pDev->dev, fmt, ##__VA_ARGS__)
++#define hailo_info(board, fmt, ...) hailo_printk(KERN_INFO, &(board)->pDev->dev, fmt, ##__VA_ARGS__)
++#define hailo_dbg(board, fmt, ...) hailo_printk(KERN_DEBUG, &(board)->pDev->dev, fmt, ##__VA_ARGS__)
++
++#define hailo_dev_emerg(dev, fmt, ...) hailo_printk(KERN_EMERG, dev, fmt, ##__VA_ARGS__)
++#define hailo_dev_alert(dev, fmt, ...) hailo_printk(KERN_ALERT, dev, fmt, ##__VA_ARGS__)
++#define hailo_dev_crit(dev, fmt, ...)  hailo_printk(KERN_CRIT, dev, fmt, ##__VA_ARGS__)
++#define hailo_dev_err(dev, fmt, ...) hailo_printk(KERN_ERR, dev, fmt, ##__VA_ARGS__)
++#define hailo_dev_warn(dev, fmt, ...) hailo_printk(KERN_WARNING, dev, fmt, ##__VA_ARGS__)
++#define hailo_dev_notice(dev, fmt, ...) hailo_printk(KERN_NOTICE, dev, fmt, ##__VA_ARGS__)
++#define hailo_dev_info(dev, fmt, ...) hailo_printk(KERN_INFO, dev, fmt, ##__VA_ARGS__)
++#define hailo_dev_dbg(dev, fmt, ...) hailo_printk(KERN_DEBUG, dev, fmt, ##__VA_ARGS__)
++
++
++#endif //_COMMON_LOGS_H_
+\ No newline at end of file
+--- /dev/null
++++ b/drivers/media/pci/hailo/vdma/ioctl.c
+@@ -0,0 +1,698 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#include "ioctl.h"
++#include "memory.h"
++#include "utils/logs.h"
++#include "utils.h"
++
++#include <linux/slab.h>
++#include <linux/uaccess.h>
++
++
++long hailo_vdma_interrupts_enable_ioctl(struct hailo_vdma_controller *controller, unsigned long arg)
++{
++    struct hailo_vdma_interrupts_enable_params input;
++    struct hailo_vdma_engine *engine = NULL;
++    u8 engine_index = 0;
++    u32 channels_bitmap = 0;
++
++    if (copy_from_user(&input, (void *)arg, sizeof(input))) {
++        hailo_dev_err(controller->dev, "copy_from_user fail\n");
++        return -ENOMEM;
++    }
++
++    // Validate params (ignoring engine_index >= controller->vdma_engines_count).
++    for_each_vdma_engine(controller, engine, engine_index) {
++        channels_bitmap = input.channels_bitmap_per_engine[engine_index];
++        if (0 != (channels_bitmap & engine->enabled_channels)) {
++            hailo_dev_err(controller->dev, "Trying to enable channels that are already enabled\n");
++            return -EINVAL;
++        }
++    }
++
++    for_each_vdma_engine(controller, engine, engine_index) {
++        channels_bitmap = input.channels_bitmap_per_engine[engine_index];
++        hailo_vdma_engine_enable_channel_interrupts(engine, channels_bitmap,
++            input.enable_timestamps_measure);
++        hailo_vdma_update_interrupts_mask(controller, engine_index);
++        hailo_dev_info(controller->dev, "Enabled interrupts for engine %u, channels bitmap 0x%x\n",
++            engine_index, channels_bitmap);
++    }
++
++    return 0;
++}
++
++long hailo_vdma_interrupts_disable_ioctl(struct hailo_vdma_controller *controller, unsigned long arg)
++{
++    struct hailo_vdma_interrupts_disable_params input;
++    struct hailo_vdma_engine *engine = NULL;
++    u8 engine_index = 0;
++    u32 channels_bitmap = 0;
++
++    if (copy_from_user(&input, (void*)arg, sizeof(input))) {
++        hailo_dev_err(controller->dev, "copy_from_user fail\n");
++        return -ENOMEM;
++    }
++
++    // Validate params (ignoring engine_index >= controller->vdma_engines_count).
++    for_each_vdma_engine(controller, engine, engine_index) {
++        channels_bitmap = input.channels_bitmap_per_engine[engine_index];
++        if (channels_bitmap != (channels_bitmap & engine->enabled_channels)) {
++            hailo_dev_err(controller->dev, "Trying to disable channels that were not enabled\n");
++            return -EINVAL;
++        }
++    }
++
++    for_each_vdma_engine(controller, engine, engine_index) {
++        channels_bitmap = input.channels_bitmap_per_engine[engine_index];
++        hailo_vdma_engine_interrupts_disable(controller, engine, engine_index,
++            channels_bitmap);
++    }
++
++    // Wake up threads waiting
++    wake_up_interruptible_all(&controller->interrupts_wq);
++
++    return 0;
++}
++
++static bool got_interrupt(struct hailo_vdma_controller *controller,
++    u32 channels_bitmap_per_engine[MAX_VDMA_ENGINES])
++{
++    struct hailo_vdma_engine *engine = NULL;
++    u8 engine_index = 0;
++    for_each_vdma_engine(controller, engine, engine_index) {
++        if (hailo_vdma_engine_got_interrupt(engine,
++                channels_bitmap_per_engine[engine_index])) {
++            return true;
++        }
++    }
++    return false;
++}
++
++static void transfer_done(struct hailo_ongoing_transfer *transfer, void *opaque)
++{
++    u8 i = 0;
++    struct hailo_vdma_controller *controller = (struct hailo_vdma_controller *)opaque;
++    for (i = 0; i < transfer->buffers_count; i++) {
++        struct hailo_vdma_buffer *mapped_buffer = (struct hailo_vdma_buffer *)transfer->buffers[i].opaque;
++        hailo_vdma_buffer_sync_cyclic(controller, mapped_buffer, HAILO_SYNC_FOR_CPU,
++            transfer->buffers[i].offset, transfer->buffers[i].size);
++    }
++}
++
++long hailo_vdma_interrupts_wait_ioctl(struct hailo_vdma_controller *controller, unsigned long arg,
++    struct semaphore *mutex, bool *should_up_board_mutex)
++{
++    long err = 0;
++    struct hailo_vdma_interrupts_wait_params params = {0};
++    struct hailo_vdma_engine *engine = NULL;
++    bool bitmap_not_empty = false;
++    u8 engine_index = 0;
++    u32 irq_bitmap = 0;
++    unsigned long irq_saved_flags = 0;
++
++    if (copy_from_user(&params, (void*)arg, sizeof(params))) {
++        hailo_dev_err(controller->dev, "HAILO_VDMA_INTERRUPTS_WAIT, copy_from_user fail\n");
++        return -ENOMEM;
++    }
++
++    // We don't need to validate that channels_bitmap_per_engine are enabled -
++    // If the channel is not enabled we just return an empty interrupts list.
++
++    // Validate params (ignoring engine_index >= controller->vdma_engines_count).
++    // It us ok to wait on a disabled channel - the wait will just exit.
++    for_each_vdma_engine(controller, engine, engine_index) {
++        if (0 != params.channels_bitmap_per_engine[engine_index]) {
++            bitmap_not_empty = true;
++        }
++    }
++    if (!bitmap_not_empty) {
++        hailo_dev_err(controller->dev, "Got an empty bitmap for wait interrupts\n");
++        return -EINVAL;
++    }
++
++    up(mutex);
++    err = wait_event_interruptible(controller->interrupts_wq,
++        got_interrupt(controller, params.channels_bitmap_per_engine));
++    if (err < 0) {
++        hailo_dev_info(controller->dev,
++            "wait channel interrupts failed with err=%ld (process was interrupted or killed)\n", err);
++        *should_up_board_mutex = false;
++        return err;
++    }
++
++    if (down_interruptible(mutex)) {
++        hailo_dev_info(controller->dev, "down_interruptible error (process was interrupted or killed)\n");
++        *should_up_board_mutex = false;
++        return -ERESTARTSYS;
++    }
++
++    params.channels_count = 0;
++    for_each_vdma_engine(controller, engine, engine_index) {
++
++        spin_lock_irqsave(&controller->interrupts_lock, irq_saved_flags);
++        irq_bitmap = hailo_vdma_engine_read_interrupts(engine,
++            params.channels_bitmap_per_engine[engine->index]);
++        spin_unlock_irqrestore(&controller->interrupts_lock, irq_saved_flags);
++
++        err = hailo_vdma_engine_fill_irq_data(&params, engine, irq_bitmap,
++            transfer_done, controller);
++        if (err < 0) {
++            hailo_dev_err(controller->dev, "Failed fill irq data %ld", err);
++            return err;
++        }
++    }
++
++    if (copy_to_user((void __user*)arg, &params, sizeof(params))) {
++        hailo_dev_err(controller->dev, "copy_to_user fail\n");
++        return -ENOMEM;
++    }
++
++    return 0;
++}
++
++static uintptr_t hailo_get_next_vdma_handle(struct hailo_vdma_file_context *context)
++{
++    // Note: The kernel code left-shifts the 'offset' param from the user-space call to mmap by PAGE_SHIFT bits and
++    // stores the result in 'vm_area_struct.vm_pgoff'. We pass the desc_handle to mmap in the offset param. To
++    // counter this, we right-shift the desc_handle. See also 'mmap function'.
++    uintptr_t next_handle = 0;
++    next_handle = atomic_inc_return(&context->last_vdma_handle);
++    return (next_handle << PAGE_SHIFT);
++}
++
++long hailo_vdma_buffer_map_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller,
++    unsigned long arg)
++{
++    struct hailo_vdma_buffer_map_params buf_info;
++    struct hailo_vdma_buffer *mapped_buffer = NULL;
++    enum dma_data_direction direction = DMA_NONE;
++    struct hailo_vdma_low_memory_buffer *low_memory_buffer = NULL;
++
++    if (copy_from_user(&buf_info, (void __user*)arg, sizeof(buf_info))) {
++        hailo_dev_err(controller->dev, "copy from user fail\n");
++        return -EFAULT;
++    }
++
++    hailo_dev_info(controller->dev, "address %px tgid %d size: %zu\n",
++        buf_info.user_address, current->tgid, buf_info.size);
++
++    direction = get_dma_direction(buf_info.data_direction);
++    if (DMA_NONE == direction) {
++        hailo_dev_err(controller->dev, "invalid data direction %d\n", buf_info.data_direction);
++        return -EINVAL;
++    }
++
++    low_memory_buffer = hailo_vdma_find_low_memory_buffer(context, buf_info.allocated_buffer_handle);
++
++    mapped_buffer = hailo_vdma_buffer_map(controller->dev,
++        buf_info.user_address, buf_info.size, direction, low_memory_buffer);
++    if (IS_ERR(mapped_buffer)) {
++        hailo_dev_err(controller->dev, "failed map buffer %px\n",
++            buf_info.user_address);
++        return PTR_ERR(mapped_buffer);
++    }
++
++    mapped_buffer->handle = atomic_inc_return(&context->last_vdma_user_buffer_handle);
++    buf_info.mapped_handle = mapped_buffer->handle;
++    if (copy_to_user((void __user*)arg, &buf_info, sizeof(buf_info))) {
++        hailo_dev_err(controller->dev, "copy_to_user fail\n");
++        hailo_vdma_buffer_put(mapped_buffer);
++        return -EFAULT;
++    }
++
++    list_add(&mapped_buffer->mapped_user_buffer_list, &context->mapped_user_buffer_list);
++    hailo_dev_info(controller->dev, "buffer %px (handle %zu) is mapped\n",
++        buf_info.user_address, buf_info.mapped_handle);
++    return 0;
++}
++
++long hailo_vdma_buffer_unmap_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller,
++    unsigned long arg)
++{
++    struct hailo_vdma_buffer *mapped_buffer = NULL;
++    struct hailo_vdma_buffer_unmap_params buffer_unmap_params;
++
++    if (copy_from_user(&buffer_unmap_params, (void __user*)arg, sizeof(buffer_unmap_params))) {
++        hailo_dev_err(controller->dev, "copy from user fail\n");
++        return -EFAULT;
++    }
++
++    hailo_dev_info(controller->dev, "unmap user buffer handle %zu\n", buffer_unmap_params.mapped_handle);
++
++    mapped_buffer = hailo_vdma_find_mapped_user_buffer(context, buffer_unmap_params.mapped_handle);
++    if (mapped_buffer == NULL) {
++        hailo_dev_warn(controller->dev, "buffer handle %zu not found\n", buffer_unmap_params.mapped_handle);
++        return -EINVAL;
++    }
++
++    list_del(&mapped_buffer->mapped_user_buffer_list);
++    hailo_vdma_buffer_put(mapped_buffer);
++    return 0;
++}
++
++long hailo_vdma_buffer_sync_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller, unsigned long arg)
++{
++    struct hailo_vdma_buffer_sync_params sync_info = {};
++    struct hailo_vdma_buffer *mapped_buffer = NULL;
++
++    if (copy_from_user(&sync_info, (void __user*)arg, sizeof(sync_info))) {
++        hailo_dev_err(controller->dev, "copy_from_user fail\n");
++        return -EFAULT;
++    }
++
++    if (!(mapped_buffer = hailo_vdma_find_mapped_user_buffer(context, sync_info.handle))) {
++        hailo_dev_err(controller->dev, "buffer handle %zu doesn't exist\n", sync_info.handle);
++        return -EINVAL;
++    }
++
++    if ((sync_info.sync_type != HAILO_SYNC_FOR_CPU) && (sync_info.sync_type != HAILO_SYNC_FOR_DEVICE)) {
++        hailo_dev_err(controller->dev, "Invalid sync_type given for vdma buffer sync.\n");
++        return -EINVAL;
++    }
++
++    if (sync_info.offset + sync_info.count > mapped_buffer->size) {
++        hailo_dev_err(controller->dev, "Invalid offset/count given for vdma buffer sync. offset %zu count %zu buffer size %u\n",
++            sync_info.offset, sync_info.count, mapped_buffer->size);
++        return -EINVAL;
++    }
++
++    hailo_vdma_buffer_sync(controller, mapped_buffer, sync_info.sync_type,
++        sync_info.offset, sync_info.count);
++    return 0;
++}
++
++long hailo_desc_list_create_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller,
++    unsigned long arg)
++{
++    struct hailo_desc_list_create_params params;
++    struct hailo_descriptors_list_buffer *descriptors_buffer = NULL;
++    uintptr_t next_handle = 0;
++    long err = -EINVAL;
++
++    if (copy_from_user(&params, (void __user*)arg, sizeof(params))) {
++        hailo_dev_err(controller->dev, "copy_from_user fail\n");
++        return -EFAULT;
++    }
++
++    if (params.is_circular && !is_powerof2(params.desc_count)) {
++        hailo_dev_err(controller->dev, "Invalid desc count given : %zu , circular descriptors count must be power of 2\n",
++            params.desc_count);
++        return -EINVAL;
++    }
++
++    if (!is_powerof2(params.desc_page_size)) {
++        hailo_dev_err(controller->dev, "Invalid desc page size given : %u\n",
++            params.desc_page_size);
++        return -EINVAL;
++    }
++
++    hailo_dev_info(controller->dev,
++        "Create desc list desc_count: %zu desc_page_size: %u\n",
++        params.desc_count, params.desc_page_size);
++
++    descriptors_buffer = kzalloc(sizeof(*descriptors_buffer), GFP_KERNEL);
++    if (NULL == descriptors_buffer) {
++        hailo_dev_err(controller->dev, "Failed to allocate buffer for descriptors list struct\n");
++        return -ENOMEM;
++    }
++
++    next_handle = hailo_get_next_vdma_handle(context);
++
++    err = hailo_desc_list_create(controller->dev, params.desc_count,
++        params.desc_page_size, next_handle, params.is_circular,
++        descriptors_buffer);
++    if (err < 0) {
++        hailo_dev_err(controller->dev, "failed to allocate descriptors buffer\n");
++        kfree(descriptors_buffer);
++        return err;
++    }
++
++    list_add(&descriptors_buffer->descriptors_buffer_list, &context->descriptors_buffer_list);
++
++    // Note: The physical address is required for CONTEXT_SWITCH firmware controls
++    BUILD_BUG_ON(sizeof(params.dma_address) < sizeof(descriptors_buffer->dma_address));
++    params.dma_address = descriptors_buffer->dma_address;
++    params.desc_handle = descriptors_buffer->handle;
++
++    if(copy_to_user((void __user*)arg, &params, sizeof(params))){
++        hailo_dev_err(controller->dev, "copy_to_user fail\n");
++        list_del(&descriptors_buffer->descriptors_buffer_list);
++        hailo_desc_list_release(controller->dev, descriptors_buffer);
++        kfree(descriptors_buffer);
++        return -EFAULT;
++    }
++
++    hailo_dev_info(controller->dev, "Created desc list, handle 0x%llu\n",
++        (u64)params.desc_handle);
++    return 0;
++}
++
++long hailo_desc_list_release_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller,
++    unsigned long arg)
++{
++    struct hailo_desc_list_release_params params;
++    struct hailo_descriptors_list_buffer *descriptors_buffer = NULL;
++
++    if (copy_from_user(&params, (void __user*)arg, sizeof(params))) {
++        hailo_dev_err(controller->dev, "copy_from_user fail\n");
++        return -EFAULT;
++    }
++
++    descriptors_buffer = hailo_vdma_find_descriptors_buffer(context, params.desc_handle);
++    if (descriptors_buffer == NULL) {
++        hailo_dev_warn(controller->dev, "not found desc handle %llu\n", (unsigned long long)params.desc_handle);
++        return -EINVAL;
++    }
++
++    list_del(&descriptors_buffer->descriptors_buffer_list);
++    hailo_desc_list_release(controller->dev, descriptors_buffer);
++    kfree(descriptors_buffer);
++    return 0;
++}
++
++long hailo_desc_list_bind_vdma_buffer(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller,
++    unsigned long arg)
++{
++    struct hailo_desc_list_bind_vdma_buffer_params configure_info;
++    struct hailo_vdma_buffer *mapped_buffer = NULL;
++    struct hailo_descriptors_list_buffer *descriptors_buffer = NULL;
++    struct hailo_vdma_mapped_transfer_buffer transfer_buffer = {0};
++
++    if (copy_from_user(&configure_info, (void __user*)arg, sizeof(configure_info))) {
++        hailo_dev_err(controller->dev, "copy from user fail\n");
++        return -EFAULT;
++    }
++    hailo_dev_info(controller->dev, "config buffer_handle=%zu desc_handle=%llu starting_desc=%u\n",
++        configure_info.buffer_handle, (u64)configure_info.desc_handle, configure_info.starting_desc);
++
++    mapped_buffer = hailo_vdma_find_mapped_user_buffer(context, configure_info.buffer_handle);
++    descriptors_buffer = hailo_vdma_find_descriptors_buffer(context, configure_info.desc_handle);
++    if (mapped_buffer == NULL || descriptors_buffer == NULL) {
++        hailo_dev_err(controller->dev, "invalid user/descriptors buffer\n");
++        return -EFAULT;
++    }
++
++    if (configure_info.buffer_size > mapped_buffer->size) {
++        hailo_dev_err(controller->dev, "invalid buffer size. \n");
++        return -EFAULT;
++    }
++
++    transfer_buffer.sg_table = &mapped_buffer->sg_table;
++    transfer_buffer.size = configure_info.buffer_size;
++    transfer_buffer.offset = configure_info.buffer_offset;
++
++    return hailo_vdma_program_descriptors_list(
++        controller->hw,
++        &descriptors_buffer->desc_list,
++        configure_info.starting_desc,
++        &transfer_buffer,
++        configure_info.channel_index
++    );
++}
++
++long hailo_vdma_low_memory_buffer_alloc_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller,
++    unsigned long arg)
++{
++    struct hailo_allocate_low_memory_buffer_params buf_info = {0};
++    struct hailo_vdma_low_memory_buffer *low_memory_buffer = NULL;
++    long err = -EINVAL;
++
++    if (copy_from_user(&buf_info, (void __user*)arg, sizeof(buf_info))) {
++        hailo_dev_err(controller->dev, "copy from user fail\n");
++        return -EFAULT;
++    }
++
++    low_memory_buffer = kzalloc(sizeof(*low_memory_buffer), GFP_KERNEL);
++    if (NULL == low_memory_buffer) {
++        hailo_dev_err(controller->dev, "memory alloc failed\n");
++        return -ENOMEM;
++    }
++
++    err = hailo_vdma_low_memory_buffer_alloc(buf_info.buffer_size, low_memory_buffer);
++    if (err < 0) {
++        kfree(low_memory_buffer);
++        hailo_dev_err(controller->dev, "failed allocating buffer from driver\n");
++        return err;
++    }
++
++    // Get handle for allocated buffer
++    low_memory_buffer->handle = hailo_get_next_vdma_handle(context);
++
++    list_add(&low_memory_buffer->vdma_low_memory_buffer_list, &context->vdma_low_memory_buffer_list);
++
++    buf_info.buffer_handle = low_memory_buffer->handle;
++    if (copy_to_user((void __user*)arg, &buf_info, sizeof(buf_info))) {
++        hailo_dev_err(controller->dev, "copy_to_user fail\n");
++        list_del(&low_memory_buffer->vdma_low_memory_buffer_list);
++        hailo_vdma_low_memory_buffer_free(low_memory_buffer);
++        kfree(low_memory_buffer);
++        return -EFAULT;
++    }
++
++    return 0;
++}
++
++long hailo_vdma_low_memory_buffer_free_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller,
++    unsigned long arg)
++{
++    struct hailo_vdma_low_memory_buffer *low_memory_buffer = NULL;
++    struct hailo_free_low_memory_buffer_params params = {0};
++
++    if (copy_from_user(&params, (void __user*)arg, sizeof(params))) {
++        hailo_dev_err(controller->dev, "copy from user fail\n");
++        return -EFAULT;
++    }
++
++    low_memory_buffer = hailo_vdma_find_low_memory_buffer(context, params.buffer_handle);
++    if (NULL == low_memory_buffer) {
++        hailo_dev_warn(controller->dev, "vdma buffer handle %lx not found\n", params.buffer_handle);
++        return -EINVAL;
++    }
++
++    list_del(&low_memory_buffer->vdma_low_memory_buffer_list);
++    hailo_vdma_low_memory_buffer_free(low_memory_buffer);
++    kfree(low_memory_buffer);
++    return 0;
++}
++
++long hailo_mark_as_in_use(struct hailo_vdma_controller *controller, unsigned long arg, struct file *filp)
++{
++    struct hailo_mark_as_in_use_params params = {0};
++
++    // If device is used by this FD, return false to indicate its free for usage
++    if (filp == controller->used_by_filp) {
++        params.in_use = false;
++    } else if (NULL != controller->used_by_filp) {
++        params.in_use = true;
++    } else {
++        controller->used_by_filp = filp;
++        params.in_use = false;
++    }
++
++    if (copy_to_user((void __user*)arg, &params, sizeof(params))) {
++        hailo_dev_err(controller->dev, "copy_to_user fail\n");
++        return -EFAULT;
++    }
++
++    return 0;
++}
++
++long hailo_vdma_continuous_buffer_alloc_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller, unsigned long arg)
++{
++    struct hailo_allocate_continuous_buffer_params buf_info = {0};
++    struct hailo_vdma_continuous_buffer *continuous_buffer = NULL;
++    long err = -EINVAL;
++    size_t aligned_buffer_size = 0;
++
++    if (copy_from_user(&buf_info, (void __user*)arg, sizeof(buf_info))) {
++        hailo_dev_err(controller->dev, "copy from user fail\n");
++        return -EFAULT;
++    }
++
++    continuous_buffer = kzalloc(sizeof(*continuous_buffer), GFP_KERNEL);
++    if (NULL == continuous_buffer) {
++        hailo_dev_err(controller->dev, "memory alloc failed\n");
++        return -ENOMEM;
++    }
++
++    // We use PAGE_ALIGN to support mmap
++    aligned_buffer_size = PAGE_ALIGN(buf_info.buffer_size);
++    err = hailo_vdma_continuous_buffer_alloc(controller->dev, aligned_buffer_size, continuous_buffer);
++    if (err < 0) {
++        kfree(continuous_buffer);
++        return err;
++    }
++
++    continuous_buffer->handle = hailo_get_next_vdma_handle(context);
++    list_add(&continuous_buffer->continuous_buffer_list, &context->continuous_buffer_list);
++
++    buf_info.buffer_handle = continuous_buffer->handle;
++    buf_info.dma_address = continuous_buffer->dma_address;
++    if (copy_to_user((void __user*)arg, &buf_info, sizeof(buf_info))) {
++        hailo_dev_err(controller->dev, "copy_to_user fail\n");
++        list_del(&continuous_buffer->continuous_buffer_list);
++        hailo_vdma_continuous_buffer_free(controller->dev, continuous_buffer);
++        kfree(continuous_buffer);
++        return -EFAULT;
++    }
++
++    return 0;
++}
++
++long hailo_vdma_continuous_buffer_free_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller, unsigned long arg)
++{
++    struct hailo_free_continuous_buffer_params params;
++    struct hailo_vdma_continuous_buffer *continuous_buffer = NULL;
++
++    if (copy_from_user(&params, (void __user*)arg, sizeof(params))) {
++        hailo_dev_err(controller->dev, "copy from user fail\n");
++        return -EFAULT;
++    }
++
++    continuous_buffer = hailo_vdma_find_continuous_buffer(context, params.buffer_handle);
++    if (NULL == continuous_buffer) {
++        hailo_dev_warn(controller->dev, "vdma buffer handle %lx not found\n", params.buffer_handle);
++        return -EINVAL;
++    }
++
++    list_del(&continuous_buffer->continuous_buffer_list);
++    hailo_vdma_continuous_buffer_free(controller->dev, continuous_buffer);
++    kfree(continuous_buffer);
++    return 0;
++}
++
++long hailo_vdma_interrupts_read_timestamps_ioctl(struct hailo_vdma_controller *controller, unsigned long arg)
++{
++    struct hailo_vdma_interrupts_read_timestamp_params *params = &controller->read_interrupt_timestamps_params;
++    struct hailo_vdma_engine *engine = NULL;
++    int err = -EINVAL;
++
++    hailo_dev_dbg(controller->dev, "Start read interrupt timestamps ioctl\n");
++
++    if (copy_from_user(params, (void __user*)arg, sizeof(*params))) {
++        hailo_dev_err(controller->dev, "copy_from_user fail\n");
++        return -ENOMEM;
++    }
++
++    if (params->engine_index >= controller->vdma_engines_count) {
++        hailo_dev_err(controller->dev, "Invalid engine %u", params->engine_index);
++        return -EINVAL;
++    }
++    engine = &controller->vdma_engines[params->engine_index];
++
++    err = hailo_vdma_engine_read_timestamps(engine, params);
++    if (err < 0) {
++        hailo_dev_err(controller->dev, "Failed read engine interrupts for %u:%u",
++            params->engine_index, params->channel_index);
++        return err;
++    }
++
++    if (copy_to_user((void __user*)arg, params, sizeof(*params))) {
++        hailo_dev_err(controller->dev, "copy_to_user fail\n");
++        return -ENOMEM;
++    }
++
++    return 0;
++}
++
++long hailo_vdma_launch_transfer_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller,
++    unsigned long arg)
++{
++    struct hailo_vdma_launch_transfer_params params;
++    struct hailo_vdma_engine *engine = NULL;
++    struct hailo_vdma_channel *channel = NULL;
++    struct hailo_descriptors_list_buffer *descriptors_buffer = NULL;
++    struct hailo_vdma_mapped_transfer_buffer mapped_transfer_buffers[ARRAY_SIZE(params.buffers)] = {0};
++    int ret = -EINVAL;
++    u8 i = 0;
++
++    if (copy_from_user(&params, (void __user*)arg, sizeof(params))) {
++        hailo_dev_err(controller->dev, "copy from user fail\n");
++        return -EFAULT;
++    }
++
++    if (params.engine_index >= controller->vdma_engines_count) {
++        hailo_dev_err(controller->dev, "Invalid engine %u", params.engine_index);
++        return -EINVAL;
++    }
++    engine = &controller->vdma_engines[params.engine_index];
++
++    if (params.channel_index >= ARRAY_SIZE(engine->channels)) {
++        hailo_dev_err(controller->dev, "Invalid channel %u", params.channel_index);
++        return -EINVAL;
++    }
++    channel = &engine->channels[params.channel_index];
++
++    if (params.buffers_count > ARRAY_SIZE(params.buffers)) {
++        hailo_dev_err(controller->dev, "too many buffers %u\n", params.buffers_count);
++        return -EINVAL;
++    }
++
++    descriptors_buffer = hailo_vdma_find_descriptors_buffer(context, params.desc_handle);
++    if (descriptors_buffer == NULL) {
++        hailo_dev_err(controller->dev, "invalid descriptors list handle\n");
++        return -EFAULT;
++    }
++
++    for (i = 0; i < params.buffers_count; i++) {
++        struct hailo_vdma_buffer *mapped_buffer =
++            hailo_vdma_find_mapped_user_buffer(context, params.buffers[i].mapped_buffer_handle);
++        if (mapped_buffer == NULL) {
++            hailo_dev_err(controller->dev, "invalid user buffer\n");
++            return -EFAULT;
++        }
++
++        if (params.buffers[i].size > mapped_buffer->size) {
++            hailo_dev_err(controller->dev, "Syncing size %u while buffer size is %u\n",
++                params.buffers[i].size, mapped_buffer->size);
++            return -EINVAL;
++        }
++
++        if (params.buffers[i].offset > mapped_buffer->size) {
++            hailo_dev_err(controller->dev, "Syncing offset %u while buffer size is %u\n",
++                params.buffers[i].offset, mapped_buffer->size);
++            return -EINVAL;
++        }
++
++        // Syncing the buffer to device change its ownership from host to the device.
++        // We sync on D2H as well if the user owns the buffer since the buffer might have been changed by
++        // the host between the time it was mapped and the current async transfer.
++        hailo_vdma_buffer_sync_cyclic(controller, mapped_buffer, HAILO_SYNC_FOR_DEVICE,
++            params.buffers[i].offset, params.buffers[i].size);
++
++        mapped_transfer_buffers[i].sg_table = &mapped_buffer->sg_table;
++        mapped_transfer_buffers[i].size = params.buffers[i].size;
++        mapped_transfer_buffers[i].offset = params.buffers[i].offset;
++        mapped_transfer_buffers[i].opaque = mapped_buffer;
++    }
++
++    ret = hailo_vdma_launch_transfer(
++        controller->hw,
++        channel,
++        &descriptors_buffer->desc_list,
++        params.starting_desc,
++        params.buffers_count,
++        mapped_transfer_buffers,
++        params.should_bind,
++        params.first_interrupts_domain,
++        params.last_interrupts_domain,
++        params.is_debug
++    );
++    if (ret < 0) {
++        hailo_dev_err(controller->dev, "Failed launch transfer %d\n", ret);
++        return ret;
++    }
++
++    params.descs_programed = ret;
++
++    if (copy_to_user((void __user*)arg, &params, sizeof(params))) {
++        hailo_dev_err(controller->dev, "copy_to_user fail\n");
++        return -EFAULT;
++    }
++
++    return 0;
++}
+\ No newline at end of file
+--- /dev/null
++++ b/drivers/media/pci/hailo/vdma/ioctl.h
+@@ -0,0 +1,37 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#ifndef _HAILO_VDMA_IOCTL_H_
++#define _HAILO_VDMA_IOCTL_H_
++
++#include "vdma/vdma.h"
++
++long hailo_vdma_interrupts_enable_ioctl(struct hailo_vdma_controller *controller, unsigned long arg);
++long hailo_vdma_interrupts_disable_ioctl(struct hailo_vdma_controller *controller, unsigned long arg);
++long hailo_vdma_interrupts_wait_ioctl(struct hailo_vdma_controller *controller, unsigned long arg,
++    struct semaphore *mutex, bool *should_up_board_mutex);
++
++long hailo_vdma_buffer_map_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller, unsigned long arg);
++long hailo_vdma_buffer_unmap_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller, unsigned long handle);
++long hailo_vdma_buffer_sync_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller, unsigned long arg);
++
++long hailo_desc_list_create_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller, unsigned long arg);
++long hailo_desc_list_release_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller, unsigned long arg);
++long hailo_desc_list_bind_vdma_buffer(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller, unsigned long arg);
++
++long hailo_vdma_low_memory_buffer_alloc_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller, unsigned long arg);
++long hailo_vdma_low_memory_buffer_free_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller, unsigned long arg);
++
++long hailo_mark_as_in_use(struct hailo_vdma_controller *controller, unsigned long arg, struct file *filp);
++
++long hailo_vdma_continuous_buffer_alloc_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller, unsigned long arg);
++long hailo_vdma_continuous_buffer_free_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller, unsigned long arg);
++
++long hailo_vdma_interrupts_read_timestamps_ioctl(struct hailo_vdma_controller *controller, unsigned long arg);
++
++long hailo_vdma_launch_transfer_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller,
++    unsigned long arg);
++
++#endif /* _HAILO_VDMA_IOCTL_H_ */
+\ No newline at end of file
+--- /dev/null
++++ b/drivers/media/pci/hailo/vdma/memory.c
+@@ -0,0 +1,551 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#define pr_fmt(fmt) "hailo: " fmt
++
++#include "memory.h"
++#include "utils/compact.h"
++
++#include <linux/slab.h>
++#include <linux/scatterlist.h>
++#include <linux/sched.h>
++
++
++#define SGL_MAX_SEGMENT_SIZE 	(0x10000)
++// See linux/mm.h
++#define MMIO_AND_NO_PAGES_VMA_MASK (VM_IO | VM_PFNMAP)
++
++static int map_mmio_address(void __user* user_address, u32 size, struct vm_area_struct *vma,
++    struct sg_table *sgt);
++static int prepare_sg_table(struct sg_table *sg_table, void __user* user_address, u32 size,
++    struct hailo_vdma_low_memory_buffer *low_mem_driver_allocated_buffer);
++static void clear_sg_table(struct sg_table *sgt);
++
++struct hailo_vdma_buffer *hailo_vdma_buffer_map(struct device *dev,
++    void __user *user_address, size_t size, enum dma_data_direction direction,
++    struct hailo_vdma_low_memory_buffer *low_mem_driver_allocated_buffer)
++{
++    int ret = -EINVAL;
++    struct hailo_vdma_buffer *mapped_buffer = NULL;
++    struct sg_table sgt = {0};
++    struct vm_area_struct *vma = NULL;
++    bool is_mmio = false;
++
++    mapped_buffer = kzalloc(sizeof(*mapped_buffer), GFP_KERNEL);
++    if (NULL == mapped_buffer) {
++        dev_err(dev, "memory alloc failed\n");
++        ret = -ENOMEM;
++        goto cleanup;
++    }
++
++    if (IS_ENABLED(HAILO_SUPPORT_MMIO_DMA_MAPPING)) {
++        vma = find_vma(current->mm, (uintptr_t)user_address);
++        if (NULL == vma) {
++            dev_err(dev, "no vma for virt_addr/size = 0x%08lx/0x%08zx\n", (uintptr_t)user_address, size);
++            ret = -EFAULT;
++            goto cleanup;
++        }
++    }
++
++    if (IS_ENABLED(HAILO_SUPPORT_MMIO_DMA_MAPPING) &&
++            (MMIO_AND_NO_PAGES_VMA_MASK == (vma->vm_flags & MMIO_AND_NO_PAGES_VMA_MASK))) {
++        // user_address represents memory mapped I/O and isn't backed by 'struct page' (only by pure pfn)
++        if (NULL != low_mem_driver_allocated_buffer) {
++            // low_mem_driver_allocated_buffer are backed by regular 'struct page' addresses, just in low memory
++            dev_err(dev, "low_mem_driver_allocated_buffer shouldn't be provided with an mmio address\n");
++            ret = -EINVAL;
++            goto free_buffer_struct;
++        }
++
++        ret = map_mmio_address(user_address, size, vma, &sgt);
++        if (ret < 0) {
++            dev_err(dev, "failed to map mmio address %d\n", ret);
++            goto free_buffer_struct;
++        }
++
++        is_mmio = true;
++    } else {
++        // user_address is a standard 'struct page' backed memory address
++        ret = prepare_sg_table(&sgt, user_address, size, low_mem_driver_allocated_buffer);
++        if (ret < 0) {
++            dev_err(dev, "failed to set sg list for user buffer %d\n", ret);
++            goto free_buffer_struct;
++        }
++        sgt.nents = dma_map_sg(dev, sgt.sgl, sgt.orig_nents, direction);
++        if (0 == sgt.nents) {
++            dev_err(dev, "failed to map sg list for user buffer\n");
++            ret = -ENXIO;
++            goto clear_sg_table;
++        }
++    }
++
++    kref_init(&mapped_buffer->kref);
++    mapped_buffer->device = dev;
++    mapped_buffer->user_address = user_address;
++    mapped_buffer->size = size;
++    mapped_buffer->data_direction = direction;
++    mapped_buffer->sg_table = sgt;
++    mapped_buffer->is_mmio = is_mmio;
++
++    return mapped_buffer;
++
++clear_sg_table:
++    clear_sg_table(&sgt);
++free_buffer_struct:
++    kfree(mapped_buffer);
++cleanup:
++    return ERR_PTR(ret);
++}
++
++static void unmap_buffer(struct kref *kref)
++{
++    struct hailo_vdma_buffer *buf = container_of(kref, struct hailo_vdma_buffer, kref);
++
++    if (!buf->is_mmio) {
++        dma_unmap_sg(buf->device, buf->sg_table.sgl, buf->sg_table.orig_nents, buf->data_direction);
++    }
++
++    clear_sg_table(&buf->sg_table);
++    kfree(buf);
++}
++
++void hailo_vdma_buffer_get(struct hailo_vdma_buffer *buf)
++{
++    kref_get(&buf->kref);
++}
++
++void hailo_vdma_buffer_put(struct hailo_vdma_buffer *buf)
++{
++    kref_put(&buf->kref, unmap_buffer);
++}
++
++static void vdma_sync_entire_buffer(struct hailo_vdma_controller *controller,
++    struct hailo_vdma_buffer *mapped_buffer, enum hailo_vdma_buffer_sync_type sync_type)
++{
++    if (sync_type == HAILO_SYNC_FOR_CPU) {
++        dma_sync_sg_for_cpu(controller->dev, mapped_buffer->sg_table.sgl, mapped_buffer->sg_table.nents,
++            mapped_buffer->data_direction);
++    } else {
++        dma_sync_sg_for_device(controller->dev, mapped_buffer->sg_table.sgl, mapped_buffer->sg_table.nents,
++            mapped_buffer->data_direction);
++    }
++}
++
++typedef void (*dma_sync_single_callback)(struct device *, dma_addr_t, size_t, enum dma_data_direction);
++// Map sync_info->count bytes starting at sync_info->offset
++static void vdma_sync_buffer_interval(struct hailo_vdma_controller *controller,
++    struct hailo_vdma_buffer *mapped_buffer,
++    size_t offset, size_t size, enum hailo_vdma_buffer_sync_type sync_type)
++{
++    size_t sync_start_offset = offset;
++    size_t sync_end_offset = offset + size;
++    dma_sync_single_callback dma_sync_single = (sync_type == HAILO_SYNC_FOR_CPU) ?
++        dma_sync_single_for_cpu :
++        dma_sync_single_for_device;
++    struct scatterlist* sg_entry = NULL;
++    size_t current_iter_offset = 0;
++    int i = 0;
++
++    for_each_sg(mapped_buffer->sg_table.sgl, sg_entry, mapped_buffer->sg_table.nents, i) {
++        // Check if the intervals: [current_iter_offset, sg_dma_len(sg_entry)] and [sync_start_offset, sync_end_offset]
++        // have any intersection. If offset isn't at the start of a sg_entry, we still want to sync it.
++        if (max(sync_start_offset, current_iter_offset) <= min(sync_end_offset, current_iter_offset + sg_dma_len(sg_entry))) {
++            dma_sync_single(controller->dev, sg_dma_address(sg_entry), sg_dma_len(sg_entry),
++                mapped_buffer->data_direction);
++        }
++
++        current_iter_offset += sg_dma_len(sg_entry);
++    }
++}
++
++void hailo_vdma_buffer_sync(struct hailo_vdma_controller *controller,
++    struct hailo_vdma_buffer *mapped_buffer, enum hailo_vdma_buffer_sync_type sync_type,
++    size_t offset, size_t size)
++{
++    if (IS_ENABLED(HAILO_SUPPORT_MMIO_DMA_MAPPING) && mapped_buffer->is_mmio) {
++        // MMIO buffers don't need to be sync'd
++        return;
++    }
++
++    if ((offset == 0) && (size == mapped_buffer->size)) {
++        vdma_sync_entire_buffer(controller, mapped_buffer, sync_type);
++    } else {
++        vdma_sync_buffer_interval(controller, mapped_buffer, offset, size, sync_type);
++    }
++}
++
++// Similar to vdma_buffer_sync, allow circular sync of the buffer.
++void hailo_vdma_buffer_sync_cyclic(struct hailo_vdma_controller *controller,
++    struct hailo_vdma_buffer *mapped_buffer, enum hailo_vdma_buffer_sync_type sync_type,
++    size_t offset, size_t size)
++{
++    size_t size_to_end = min(size, mapped_buffer->size - offset);
++
++    hailo_vdma_buffer_sync(controller, mapped_buffer, sync_type, offset, size_to_end);
++
++    if (size_to_end < size) {
++        hailo_vdma_buffer_sync(controller, mapped_buffer, sync_type, 0, size - size_to_end);
++    }
++}
++
++struct hailo_vdma_buffer* hailo_vdma_find_mapped_user_buffer(struct hailo_vdma_file_context *context,
++    size_t buffer_handle)
++{
++    struct hailo_vdma_buffer *cur = NULL;
++    list_for_each_entry(cur, &context->mapped_user_buffer_list, mapped_user_buffer_list) {
++        if (cur->handle == buffer_handle) {
++            return cur;
++        }
++    }
++    return NULL;
++}
++
++void hailo_vdma_clear_mapped_user_buffer_list(struct hailo_vdma_file_context *context,
++    struct hailo_vdma_controller *controller)
++{
++    struct hailo_vdma_buffer *cur = NULL, *next = NULL;
++    list_for_each_entry_safe(cur, next, &context->mapped_user_buffer_list, mapped_user_buffer_list) {
++        list_del(&cur->mapped_user_buffer_list);
++        hailo_vdma_buffer_put(cur);
++    }
++}
++
++
++int hailo_desc_list_create(struct device *dev, u32 descriptors_count, u16 desc_page_size,
++    uintptr_t desc_handle, bool is_circular, struct hailo_descriptors_list_buffer *descriptors)
++{
++    size_t buffer_size = 0;
++    const u64 align = VDMA_DESCRIPTOR_LIST_ALIGN; //First addr must be aligned on 64 KB  (from the VDMA registers documentation)
++
++    buffer_size = descriptors_count * sizeof(struct hailo_vdma_descriptor);
++    buffer_size = ALIGN(buffer_size, align);
++
++    descriptors->kernel_address = dma_alloc_coherent(dev, buffer_size,
++        &descriptors->dma_address, GFP_KERNEL | __GFP_ZERO);
++    if (descriptors->kernel_address == NULL) {
++        dev_err(dev, "Failed to allocate descriptors list, desc_count 0x%x, buffer_size 0x%zx, This failure means there is not a sufficient amount of CMA memory "
++            "(contiguous physical memory), This usually is caused by lack of general system memory. Please check you have sufficent memory.\n",
++            descriptors_count, buffer_size);
++        return -ENOMEM;
++    }
++
++    descriptors->buffer_size = buffer_size;
++    descriptors->handle = desc_handle;
++
++    descriptors->desc_list.desc_list = descriptors->kernel_address;
++    descriptors->desc_list.desc_count = descriptors_count;
++    descriptors->desc_list.desc_page_size = desc_page_size;
++    descriptors->desc_list.is_circular = is_circular;
++
++    return 0;
++}
++
++void hailo_desc_list_release(struct device *dev, struct hailo_descriptors_list_buffer *descriptors)
++{
++    dma_free_coherent(dev, descriptors->buffer_size, descriptors->kernel_address, descriptors->dma_address);
++}
++
++struct hailo_descriptors_list_buffer* hailo_vdma_find_descriptors_buffer(struct hailo_vdma_file_context *context,
++    uintptr_t desc_handle)
++{
++    struct hailo_descriptors_list_buffer *cur = NULL;
++    list_for_each_entry(cur, &context->descriptors_buffer_list, descriptors_buffer_list) {
++        if (cur->handle == desc_handle) {
++            return cur;
++        }
++    }
++    return NULL;
++}
++
++void hailo_vdma_clear_descriptors_buffer_list(struct hailo_vdma_file_context *context,
++    struct hailo_vdma_controller *controller)
++{
++    struct hailo_descriptors_list_buffer *cur = NULL, *next = NULL;
++    list_for_each_entry_safe(cur, next, &context->descriptors_buffer_list, descriptors_buffer_list) {
++        list_del(&cur->descriptors_buffer_list);
++        hailo_desc_list_release(controller->dev, cur);
++        kfree(cur);
++    }
++}
++
++int hailo_vdma_low_memory_buffer_alloc(size_t size, struct hailo_vdma_low_memory_buffer *low_memory_buffer)
++{
++    int ret = -EINVAL;
++    void *kernel_address = NULL;
++    size_t pages_count = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
++    size_t num_allocated = 0, i = 0;
++    void **pages = NULL;
++
++    pages = kcalloc(pages_count, sizeof(*pages), GFP_KERNEL);
++    if (NULL == pages) {
++        pr_err("Failed to allocate pages for buffer (size %zu)\n", size);
++        ret = -ENOMEM;
++        goto cleanup;
++    }
++
++    for (num_allocated = 0; num_allocated < pages_count; num_allocated++) {
++        // __GFP_DMA32 flag is used to limit system memory allocations to the lowest 4 GB of physical memory in order to guarantee DMA 
++        // Operations will not have to use bounce buffers on certain architectures (e.g 32-bit DMA enabled architectures)
++        kernel_address = (void*)__get_free_page(__GFP_DMA32);
++        if (NULL == kernel_address) {
++            pr_err("Failed to allocate %zu coherent bytes\n", (size_t)PAGE_SIZE);
++            ret = -ENOMEM;
++            goto cleanup;
++        }
++
++        pages[num_allocated] = kernel_address;
++    }
++
++    low_memory_buffer->pages_count = pages_count;
++    low_memory_buffer->pages_address = pages;
++
++    return 0;
++
++cleanup:
++    if (NULL != pages) {
++        for (i = 0; i < num_allocated; i++) {
++            free_page((long unsigned)pages[i]);
++        }
++
++        kfree(pages);
++    }
++
++    return ret;
++}
++
++void hailo_vdma_low_memory_buffer_free(struct hailo_vdma_low_memory_buffer *low_memory_buffer)
++{
++    size_t i = 0;
++    if (NULL == low_memory_buffer) {
++        return;
++    }
++
++    for (i = 0; i < low_memory_buffer->pages_count; i++) {
++        free_page((long unsigned)low_memory_buffer->pages_address[i]);
++    }
++
++    kfree(low_memory_buffer->pages_address);
++}
++
++struct hailo_vdma_low_memory_buffer* hailo_vdma_find_low_memory_buffer(struct hailo_vdma_file_context *context,
++    uintptr_t buf_handle)
++{
++    struct hailo_vdma_low_memory_buffer *cur = NULL;
++    list_for_each_entry(cur, &context->vdma_low_memory_buffer_list, vdma_low_memory_buffer_list) {
++        if (cur->handle == buf_handle) {
++            return cur;
++        }
++    }
++
++    return NULL;
++}
++
++void hailo_vdma_clear_low_memory_buffer_list(struct hailo_vdma_file_context *context)
++{
++    struct hailo_vdma_low_memory_buffer *cur = NULL, *next = NULL;
++    list_for_each_entry_safe(cur, next, &context->vdma_low_memory_buffer_list, vdma_low_memory_buffer_list) {
++        list_del(&cur->vdma_low_memory_buffer_list);
++        hailo_vdma_low_memory_buffer_free(cur);
++        kfree(cur);
++    }
++}
++
++int hailo_vdma_continuous_buffer_alloc(struct device *dev, size_t size,
++    struct hailo_vdma_continuous_buffer *continuous_buffer)
++{
++    dma_addr_t dma_address = 0;
++    void *kernel_address = NULL;
++
++    kernel_address = dma_alloc_coherent(dev, size, &dma_address, GFP_KERNEL);
++    if (NULL == kernel_address) {
++        dev_warn(dev, "Failed to allocate continuous buffer, size 0x%zx. This failure means there is not a sufficient amount of CMA memory "
++            "(contiguous physical memory), This usually is caused by lack of general system memory. Please check you have sufficent memory.\n", size);
++        return -ENOMEM;
++    }
++
++    continuous_buffer->kernel_address = kernel_address;
++    continuous_buffer->dma_address = dma_address;
++    continuous_buffer->size = size;
++    return 0;
++}
++
++void hailo_vdma_continuous_buffer_free(struct device *dev,
++    struct hailo_vdma_continuous_buffer *continuous_buffer)
++{
++    dma_free_coherent(dev, continuous_buffer->size, continuous_buffer->kernel_address,
++        continuous_buffer->dma_address);
++}
++
++struct hailo_vdma_continuous_buffer* hailo_vdma_find_continuous_buffer(struct hailo_vdma_file_context *context,
++    uintptr_t buf_handle)
++{
++    struct hailo_vdma_continuous_buffer *cur = NULL;
++    list_for_each_entry(cur, &context->continuous_buffer_list, continuous_buffer_list) {
++        if (cur->handle == buf_handle) {
++            return cur;
++        }
++    }
++
++    return NULL;
++}
++
++void hailo_vdma_clear_continuous_buffer_list(struct hailo_vdma_file_context *context,
++    struct hailo_vdma_controller *controller)
++{
++    struct hailo_vdma_continuous_buffer *cur = NULL, *next = NULL;
++    list_for_each_entry_safe(cur, next, &context->continuous_buffer_list, continuous_buffer_list) {
++        list_del(&cur->continuous_buffer_list);
++        hailo_vdma_continuous_buffer_free(controller->dev, cur);
++        kfree(cur);
++    }
++}
++
++// Assumes the provided user_address belongs to the vma and that MMIO_AND_NO_PAGES_VMA_MASK bits are set under
++// vma->vm_flags. This is validated in hailo_vdma_buffer_map, and won't be checked here
++static int map_mmio_address(void __user* user_address, u32 size, struct vm_area_struct *vma,
++    struct sg_table *sgt)
++{
++    int ret = -EINVAL;
++    unsigned long i = 0;
++    unsigned long pfn = 0;
++    unsigned long next_pfn = 0;
++    phys_addr_t phys_addr = 0;
++    dma_addr_t mmio_dma_address = 0;
++    const uintptr_t virt_addr = (uintptr_t)user_address;
++    const u32 vma_size = vma->vm_end - vma->vm_start + 1;
++    const uintptr_t num_pages = PFN_UP(virt_addr + size) - PFN_DOWN(virt_addr);
++
++    // Check that the vma that was marked as MMIO_AND_NO_PAGES_VMA_MASK is big enough
++    if (vma_size < size) {
++        pr_err("vma (%u bytes) smaller than provided buffer (%u bytes)\n", vma_size, size);
++        return -EINVAL;
++    }
++
++    // Get the physical address of user_address
++    ret = follow_pfn(vma, virt_addr, &pfn);
++    if (ret) {
++        pr_err("follow_pfn failed with %d\n", ret);
++        return ret;
++    }
++    phys_addr = __pfn_to_phys(pfn) + offset_in_page(virt_addr);
++
++    // Make sure the physical memory is contiguous
++    for (i = 1; i < num_pages; ++i) {
++        ret = follow_pfn(vma, virt_addr + (i << PAGE_SHIFT), &next_pfn);
++        if (ret < 0) {
++            pr_err("follow_pfn failed with %d\n", ret);
++            return ret;
++        }
++        if (next_pfn != pfn + 1) {
++            pr_err("non-contiguous physical memory\n");
++            return -EFAULT;
++        }
++        pfn = next_pfn;
++    }
++
++    // phys_addr to dma
++    // TODO: need dma_map_resource here? doesn't work currently (we get dma_mapping_error on the returned dma addr)
++    //       (HRT-12521)
++    mmio_dma_address = (dma_addr_t)phys_addr;
++
++    // Create a page-less scatterlist.
++    ret = sg_alloc_table(sgt, 1, GFP_KERNEL);
++    if (ret < 0) {
++        return ret;
++    }
++
++    sg_assign_page(sgt->sgl, NULL);
++    sg_dma_address(sgt->sgl) = mmio_dma_address;
++    sg_dma_len(sgt->sgl) = size;
++
++    return 0;
++}
++
++static int prepare_sg_table(struct sg_table *sg_table, void __user *user_address, u32 size,
++    struct hailo_vdma_low_memory_buffer *low_mem_driver_allocated_buffer)
++{
++    int ret = -EINVAL;
++    int pinned_pages = 0;
++    size_t npages = 0;
++    struct page **pages = NULL;
++    int i = 0;
++    struct scatterlist *sg_alloc_res = NULL;
++
++    npages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
++    pages = kvmalloc_array(npages, sizeof(*pages), GFP_KERNEL);
++    if (!pages) {
++        return -ENOMEM;
++    }
++
++    // Check whether mapping user allocated buffer or driver allocated low memory buffer
++    if (NULL == low_mem_driver_allocated_buffer) {
++        mmap_read_lock(current->mm);
++        pinned_pages = get_user_pages_compact((unsigned long)user_address,
++            npages, FOLL_WRITE | FOLL_FORCE, pages);
++        mmap_read_unlock(current->mm);
++
++        if (pinned_pages < 0) {
++            pr_err("get_user_pages failed with %d\n", pinned_pages);
++            ret = pinned_pages;
++            goto exit;
++        } else if (pinned_pages != npages) {
++            pr_err("Pinned %d out of %zu\n", pinned_pages, npages);
++            ret = -EINVAL;
++            goto release_pages;
++        }
++    } else {
++        // Check to make sure in case user provides wrong buffer
++        if (npages != low_mem_driver_allocated_buffer->pages_count) {
++            pr_err("Received wrong amount of pages %zu to map expected %zu\n",
++                npages, low_mem_driver_allocated_buffer->pages_count);
++            ret = -EINVAL;
++            goto exit;
++        }
++
++        for (i = 0; i < npages; i++) {
++            pages[i] = virt_to_page(low_mem_driver_allocated_buffer->pages_address[i]);
++            get_page(pages[i]);
++        }
++    }
++
++    sg_alloc_res = sg_alloc_table_from_pages_segment_compat(sg_table, pages, npages,
++        0, size, SGL_MAX_SEGMENT_SIZE, NULL, 0, GFP_KERNEL);
++    if (IS_ERR(sg_alloc_res)) {
++        ret = PTR_ERR(sg_alloc_res);
++        pr_err("sg table alloc failed (err %d)..\n", ret);
++        goto release_pages;
++    }
++
++    ret = 0;
++    goto exit;
++release_pages:
++    for (i = 0; i < pinned_pages; i++) {
++        if (!PageReserved(pages[i])) {
++            SetPageDirty(pages[i]);
++        }
++        put_page(pages[i]);
++    }
++exit:
++    kvfree(pages);
++    return ret;
++}
++
++static void clear_sg_table(struct sg_table *sgt)
++{
++    struct sg_page_iter iter;
++    struct page *page = NULL;
++
++    for_each_sg_page(sgt->sgl, &iter, sgt->orig_nents, 0) {
++        page = sg_page_iter_page(&iter);
++        if (page) {
++            if (!PageReserved(page)) {
++                SetPageDirty(page);
++            }
++            put_page(page);
++        }
++    }
++
++    sg_free_table(sgt);
++}
+--- /dev/null
++++ b/drivers/media/pci/hailo/vdma/memory.h
+@@ -0,0 +1,54 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++/**
++ * vDMA memory utility (including allocation and mappings)
++ */
++
++#ifndef _HAILO_VDMA_MEMORY_H_
++#define _HAILO_VDMA_MEMORY_H_
++
++#include "vdma/vdma.h"
++
++struct hailo_vdma_buffer *hailo_vdma_buffer_map(struct device *dev,
++    void __user *user_address, size_t size, enum dma_data_direction direction,
++    struct hailo_vdma_low_memory_buffer *low_mem_driver_allocated_buffer);
++void hailo_vdma_buffer_get(struct hailo_vdma_buffer *buf);
++void hailo_vdma_buffer_put(struct hailo_vdma_buffer *buf);
++
++void hailo_vdma_buffer_sync(struct hailo_vdma_controller *controller,
++    struct hailo_vdma_buffer *mapped_buffer, enum hailo_vdma_buffer_sync_type sync_type,
++    size_t offset, size_t size);
++void hailo_vdma_buffer_sync_cyclic(struct hailo_vdma_controller *controller,
++    struct hailo_vdma_buffer *mapped_buffer, enum hailo_vdma_buffer_sync_type sync_type,
++    size_t offset, size_t size);
++
++struct hailo_vdma_buffer* hailo_vdma_find_mapped_user_buffer(struct hailo_vdma_file_context *context,
++    size_t buffer_handle);
++void hailo_vdma_clear_mapped_user_buffer_list(struct hailo_vdma_file_context *context,
++    struct hailo_vdma_controller *controller);
++
++int hailo_desc_list_create(struct device *dev, u32 descriptors_count, u16 desc_page_size,
++    uintptr_t desc_handle, bool is_circular, struct hailo_descriptors_list_buffer *descriptors);
++void hailo_desc_list_release(struct device *dev, struct hailo_descriptors_list_buffer *descriptors);
++struct hailo_descriptors_list_buffer* hailo_vdma_find_descriptors_buffer(struct hailo_vdma_file_context *context,
++    uintptr_t desc_handle);
++void hailo_vdma_clear_descriptors_buffer_list(struct hailo_vdma_file_context *context,
++    struct hailo_vdma_controller *controller);
++
++int hailo_vdma_low_memory_buffer_alloc(size_t size, struct hailo_vdma_low_memory_buffer *low_memory_buffer);
++void hailo_vdma_low_memory_buffer_free(struct hailo_vdma_low_memory_buffer *low_memory_buffer);
++struct hailo_vdma_low_memory_buffer* hailo_vdma_find_low_memory_buffer(struct hailo_vdma_file_context *context,
++    uintptr_t buf_handle);
++void hailo_vdma_clear_low_memory_buffer_list(struct hailo_vdma_file_context *context);
++
++int hailo_vdma_continuous_buffer_alloc(struct device *dev, size_t size,
++    struct hailo_vdma_continuous_buffer *continuous_buffer);
++void hailo_vdma_continuous_buffer_free(struct device *dev,
++    struct hailo_vdma_continuous_buffer *continuous_buffer);
++struct hailo_vdma_continuous_buffer* hailo_vdma_find_continuous_buffer(struct hailo_vdma_file_context *context,
++    uintptr_t buf_handle);
++void hailo_vdma_clear_continuous_buffer_list(struct hailo_vdma_file_context *context,
++    struct hailo_vdma_controller *controller);
++#endif /* _HAILO_VDMA_MEMORY_H_ */
+\ No newline at end of file
+--- /dev/null
++++ b/drivers/media/pci/hailo/vdma/vdma.c
+@@ -0,0 +1,336 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#define pr_fmt(fmt) "hailo: " fmt
++
++#include "vdma.h"
++#include "memory.h"
++#include "ioctl.h"
++#include "utils/logs.h"
++
++#include <linux/sched.h>
++#include <linux/version.h>
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 0)
++#include <linux/dma-map-ops.h>
++#else
++#include <linux/dma-mapping.h>
++#endif
++
++
++static struct hailo_vdma_engine* init_vdma_engines(struct device *dev,
++    struct hailo_resource *channel_registers_per_engine, size_t engines_count)
++{
++    struct hailo_vdma_engine *engines = NULL;
++    u8 i = 0;
++
++    engines = devm_kmalloc_array(dev, engines_count, sizeof(*engines), GFP_KERNEL);
++    if (NULL == engines) {
++        dev_err(dev, "Failed allocating vdma engines\n");
++        return ERR_PTR(-ENOMEM);
++    }
++
++    for (i = 0; i < engines_count; i++) {
++        hailo_vdma_engine_init(&engines[i], i, &channel_registers_per_engine[i]);
++    }
++
++    return engines;
++}
++
++static int hailo_set_dma_mask(struct device *dev)
++{
++    int err = -EINVAL;
++    /* Check and configure DMA length */
++    if (!(err = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64)))) {
++        dev_notice(dev, "Probing: Enabled 64 bit dma\n");
++    } else if (!(err = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(48)))) {
++        dev_notice(dev, "Probing: Enabled 48 bit dma\n");
++    } else if (!(err = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(40)))) {
++        dev_notice(dev, "Probing: Enabled 40 bit dma\n");
++    } else if (!(err = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(36)))) {
++        dev_notice(dev, "Probing: Enabled 36 bit dma\n");
++    } else if (!(err = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32)))) {
++        dev_notice(dev, "Probing: Enabled 32 bit dma\n");
++    } else {
++        dev_err(dev, "Probing: Error enabling dma %d\n", err);
++        return err;
++    }
++
++    return 0;
++}
++
++int hailo_vdma_controller_init(struct hailo_vdma_controller *controller,
++    struct device *dev, struct hailo_vdma_hw *vdma_hw,
++    struct hailo_vdma_controller_ops *ops,
++    struct hailo_resource *channel_registers_per_engine, size_t engines_count)
++{
++    int err = 0;
++    controller->hw = vdma_hw;
++    controller->ops = ops;
++    controller->dev = dev;
++
++    controller->vdma_engines_count = engines_count;
++    controller->vdma_engines = init_vdma_engines(dev, channel_registers_per_engine, engines_count);
++    if (IS_ERR(controller->vdma_engines)) {
++        dev_err(dev, "Failed initialized vdma engines\n");
++        return PTR_ERR(controller->vdma_engines);
++    }
++
++    controller->used_by_filp = NULL;
++    spin_lock_init(&controller->interrupts_lock);
++    init_waitqueue_head(&controller->interrupts_wq);
++
++    /* Check and configure DMA length */
++    err = hailo_set_dma_mask(dev);
++    if (0 > err) {
++        return err;
++    }
++
++    if (get_dma_ops(controller->dev)) {
++        hailo_dev_notice(controller->dev, "Probing: Using specialized dma_ops=%ps", get_dma_ops(controller->dev));
++    }
++
++    return 0;
++}
++
++void hailo_vdma_file_context_init(struct hailo_vdma_file_context *context)
++{
++    atomic_set(&context->last_vdma_user_buffer_handle, 0);
++    INIT_LIST_HEAD(&context->mapped_user_buffer_list);
++
++    atomic_set(&context->last_vdma_handle, 0);
++    INIT_LIST_HEAD(&context->descriptors_buffer_list);
++    INIT_LIST_HEAD(&context->vdma_low_memory_buffer_list);
++    INIT_LIST_HEAD(&context->continuous_buffer_list);
++}
++
++void hailo_vdma_update_interrupts_mask(struct hailo_vdma_controller *controller,
++    size_t engine_index)
++{
++    struct hailo_vdma_engine *engine = &controller->vdma_engines[engine_index];
++    controller->ops->update_channel_interrupts(controller, engine_index, engine->enabled_channels);
++}
++
++void hailo_vdma_engine_interrupts_disable(struct hailo_vdma_controller *controller,
++    struct hailo_vdma_engine *engine, u8 engine_index, u32 channels_bitmap)
++{
++    unsigned long irq_saved_flags = 0;
++    // In case of FLR, the vdma registers will be NULL
++    const bool is_device_up = (NULL != controller->dev);
++
++    hailo_vdma_engine_disable_channel_interrupts(engine, channels_bitmap);
++    if (is_device_up) {
++        hailo_vdma_update_interrupts_mask(controller, engine_index);
++    }
++
++    spin_lock_irqsave(&controller->interrupts_lock, irq_saved_flags);
++    hailo_vdma_engine_clear_channel_interrupts(engine, channels_bitmap);
++    spin_unlock_irqrestore(&controller->interrupts_lock, irq_saved_flags);
++
++    hailo_dev_info(controller->dev, "Disabled interrupts for engine %u, channels bitmap 0x%x\n",
++        engine_index, channels_bitmap);
++}
++
++void hailo_vdma_file_context_finalize(struct hailo_vdma_file_context *context,
++    struct hailo_vdma_controller *controller, struct file *filp)
++{
++    size_t engine_index = 0;
++    struct hailo_vdma_engine *engine = NULL;
++    const u32 channels_bitmap = 0xFFFFFFFF; // disable all channel interrupts
++
++    if (filp == controller->used_by_filp) {
++        for_each_vdma_engine(controller, engine, engine_index) {
++            hailo_vdma_engine_interrupts_disable(controller, engine, engine_index, channels_bitmap);
++        }
++    }
++
++    hailo_vdma_clear_mapped_user_buffer_list(context, controller);
++    hailo_vdma_clear_descriptors_buffer_list(context, controller);
++    hailo_vdma_clear_low_memory_buffer_list(context);
++    hailo_vdma_clear_continuous_buffer_list(context, controller);
++
++    if (filp == controller->used_by_filp) {
++        controller->used_by_filp = NULL;
++    }
++}
++
++void hailo_vdma_irq_handler(struct hailo_vdma_controller *controller,
++    size_t engine_index, u32 channels_bitmap)
++{
++    unsigned long irq_saved_flags = 0;
++    struct hailo_vdma_engine *engine = NULL;
++
++    BUG_ON(engine_index >= controller->vdma_engines_count);
++    engine = &controller->vdma_engines[engine_index];
++
++    hailo_vdma_engine_push_timestamps(engine, channels_bitmap);
++
++    spin_lock_irqsave(&controller->interrupts_lock, irq_saved_flags);
++    hailo_vdma_engine_set_channel_interrupts(engine, channels_bitmap);
++    spin_unlock_irqrestore(&controller->interrupts_lock, irq_saved_flags);
++
++    wake_up_interruptible_all(&controller->interrupts_wq);
++}
++
++long hailo_vdma_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller,
++    unsigned int cmd, unsigned long arg, struct file *filp, struct semaphore *mutex, bool *should_up_board_mutex)
++{
++    switch (cmd) {
++    case HAILO_VDMA_INTERRUPTS_ENABLE:
++        return hailo_vdma_interrupts_enable_ioctl(controller, arg);
++    case HAILO_VDMA_INTERRUPTS_DISABLE:
++        return hailo_vdma_interrupts_disable_ioctl(controller, arg);
++    case HAILO_VDMA_INTERRUPTS_WAIT:
++        return hailo_vdma_interrupts_wait_ioctl(controller, arg, mutex, should_up_board_mutex);
++    case HAILO_VDMA_INTERRUPTS_READ_TIMESTAMPS:
++        return hailo_vdma_interrupts_read_timestamps_ioctl(controller, arg);
++    case HAILO_VDMA_BUFFER_MAP:
++        return hailo_vdma_buffer_map_ioctl(context, controller, arg);
++    case HAILO_VDMA_BUFFER_UNMAP:
++        return hailo_vdma_buffer_unmap_ioctl(context, controller, arg);
++    case HAILO_VDMA_BUFFER_SYNC:
++        return hailo_vdma_buffer_sync_ioctl(context, controller, arg);
++    case HAILO_DESC_LIST_CREATE:
++        return hailo_desc_list_create_ioctl(context, controller, arg);
++    case HAILO_DESC_LIST_RELEASE:
++        return hailo_desc_list_release_ioctl(context, controller, arg);
++    case HAILO_DESC_LIST_BIND_VDMA_BUFFER:
++        return hailo_desc_list_bind_vdma_buffer(context, controller, arg);
++    case HAILO_VDMA_LOW_MEMORY_BUFFER_ALLOC:
++        return hailo_vdma_low_memory_buffer_alloc_ioctl(context, controller, arg);
++    case HAILO_VDMA_LOW_MEMORY_BUFFER_FREE:
++        return hailo_vdma_low_memory_buffer_free_ioctl(context, controller, arg);
++    case HAILO_MARK_AS_IN_USE:
++        return hailo_mark_as_in_use(controller, arg, filp);
++    case HAILO_VDMA_CONTINUOUS_BUFFER_ALLOC:
++        return hailo_vdma_continuous_buffer_alloc_ioctl(context, controller, arg);
++    case HAILO_VDMA_CONTINUOUS_BUFFER_FREE:
++        return hailo_vdma_continuous_buffer_free_ioctl(context, controller, arg);
++    case HAILO_VDMA_LAUNCH_TRANSFER:
++        return hailo_vdma_launch_transfer_ioctl(context, controller, arg);
++    default:
++        hailo_dev_err(controller->dev, "Invalid vDMA ioctl code 0x%x (nr: %d)\n", cmd, _IOC_NR(cmd));
++        return -ENOTTY;
++    }
++}
++
++static int desc_list_mmap(struct hailo_vdma_controller *controller,
++    struct hailo_descriptors_list_buffer *vdma_descriptors_buffer, struct vm_area_struct *vma)
++{
++    int err = 0;
++    unsigned long vsize = vma->vm_end - vma->vm_start;
++
++    if (vsize > vdma_descriptors_buffer->buffer_size) {
++        hailo_dev_err(controller->dev, "Requested size to map (%lx) is larger than the descriptor list size(%x)\n",
++            vsize, vdma_descriptors_buffer->buffer_size);
++        return -EINVAL;
++    }
++
++    err = dma_mmap_coherent(controller->dev, vma, vdma_descriptors_buffer->kernel_address,
++        vdma_descriptors_buffer->dma_address, vsize);
++    if (err != 0) {
++        hailo_dev_err(controller->dev, " Failed mmap descriptors %d\n", err);
++        return err;
++    }
++
++    return 0;
++}
++
++static int low_memory_buffer_mmap(struct hailo_vdma_controller *controller,
++    struct hailo_vdma_low_memory_buffer *vdma_buffer, struct vm_area_struct *vma)
++{
++    int err     = 0;
++    size_t i    = 0;
++    unsigned long vsize         = vma->vm_end - vma->vm_start;
++    unsigned long orig_vm_start = vma->vm_start;
++    unsigned long orig_vm_end   = vma->vm_end;
++    unsigned long page_fn       = 0;
++
++    if (vsize != vdma_buffer->pages_count * PAGE_SIZE) {
++        hailo_dev_err(controller->dev, "mmap size should be %lu (given %lu)\n",
++            vdma_buffer->pages_count * PAGE_SIZE, vsize);
++        return -EINVAL;
++    }
++
++    for (i = 0 ; i < vdma_buffer->pages_count ; i++) {
++        if (i > 0) {
++            vma->vm_start = vma->vm_end;
++        }
++        vma->vm_end = vma->vm_start + PAGE_SIZE;
++
++        page_fn = virt_to_phys(vdma_buffer->pages_address[i]) >> PAGE_SHIFT ;
++        err = remap_pfn_range(vma, vma->vm_start, page_fn, PAGE_SIZE, vma->vm_page_prot);
++
++        if (err != 0) {
++            hailo_dev_err(controller->dev, " fops_mmap failed mapping kernel page %d\n", err);
++            return err;
++        }
++    }
++
++    vma->vm_start = orig_vm_start;
++    vma->vm_end = orig_vm_end;
++
++    return 0;
++}
++
++static int continuous_buffer_mmap(struct hailo_vdma_controller *controller,
++    struct hailo_vdma_continuous_buffer *buffer, struct vm_area_struct *vma)
++{
++    int err = 0;
++    const unsigned long vsize = vma->vm_end - vma->vm_start;
++
++    if (vsize > buffer->size) {
++        hailo_dev_err(controller->dev, "mmap size should be less than %zu (given %lu)\n",
++            buffer->size, vsize);
++        return -EINVAL;
++    }
++
++    err = dma_mmap_coherent(controller->dev, vma, buffer->kernel_address,
++        buffer->dma_address, vsize);
++    if (err < 0) {
++        hailo_dev_err(controller->dev, " vdma_mmap failed dma_mmap_coherent %d\n", err);
++        return err;
++    }
++
++    return 0;
++}
++
++int hailo_vdma_mmap(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller,
++    struct vm_area_struct *vma, uintptr_t vdma_handle)
++{
++    struct hailo_descriptors_list_buffer *vdma_descriptors_buffer = NULL;
++    struct hailo_vdma_low_memory_buffer *low_memory_buffer = NULL;
++    struct hailo_vdma_continuous_buffer *continuous_buffer = NULL;
++
++    hailo_dev_info(controller->dev, "Map vdma_handle %llu\n", (u64)vdma_handle);
++    if (NULL != (vdma_descriptors_buffer = hailo_vdma_find_descriptors_buffer(context, vdma_handle))) {
++        return desc_list_mmap(controller, vdma_descriptors_buffer, vma);
++    }
++    else if (NULL != (low_memory_buffer = hailo_vdma_find_low_memory_buffer(context, vdma_handle))) {
++        return low_memory_buffer_mmap(controller, low_memory_buffer, vma);
++    }
++    else if (NULL != (continuous_buffer = hailo_vdma_find_continuous_buffer(context, vdma_handle))) {
++        return continuous_buffer_mmap(controller, continuous_buffer, vma);
++    }
++    else {
++        hailo_dev_err(controller->dev, "Can't mmap vdma handle: %llu (not existing)\n", (u64)vdma_handle);
++        return -EINVAL;
++    }
++}
++
++enum dma_data_direction get_dma_direction(enum hailo_dma_data_direction hailo_direction)
++{
++    switch (hailo_direction) {
++    case HAILO_DMA_BIDIRECTIONAL:
++        return DMA_BIDIRECTIONAL;
++    case HAILO_DMA_TO_DEVICE:
++        return DMA_TO_DEVICE;
++    case HAILO_DMA_FROM_DEVICE:
++        return DMA_FROM_DEVICE;
++    default:
++        pr_err("Invalid hailo direction %d\n", hailo_direction);
++        return DMA_NONE;
++    }
++}
+--- /dev/null
++++ b/drivers/media/pci/hailo/vdma/vdma.h
+@@ -0,0 +1,143 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++/**
++ * Hailo vdma engine definitions
++ */
++
++#ifndef _HAILO_VDMA_VDMA_H_
++#define _HAILO_VDMA_VDMA_H_
++
++#include "hailo_ioctl_common.h"
++#include "hailo_resource.h"
++#include "vdma_common.h"
++
++#include <linux/dma-mapping.h>
++#include <linux/types.h>
++#include <linux/semaphore.h>
++
++#define VDMA_CHANNEL_CONTROL_REG_OFFSET(channel_index, direction) (((direction) == DMA_TO_DEVICE) ? \
++            (((channel_index) << 5) + 0x0) : (((channel_index) << 5) + 0x10))
++#define VDMA_CHANNEL_CONTROL_REG_ADDRESS(vdma_registers, channel_index, direction) \
++    ((u8*)((vdma_registers)->address) + VDMA_CHANNEL_CONTROL_REG_OFFSET(channel_index, direction))
++
++#define VDMA_CHANNEL_NUM_PROC_OFFSET(channel_index, direction) (((direction) == DMA_TO_DEVICE) ? \
++            (((channel_index) << 5) + 0x4) : (((channel_index) << 5) + 0x14))
++#define VDMA_CHANNEL_NUM_PROC_ADDRESS(vdma_registers, channel_index, direction) \
++    ((u8*)((vdma_registers)->address) + VDMA_CHANNEL_NUM_PROC_OFFSET(channel_index, direction))
++
++
++struct hailo_vdma_buffer {
++    struct list_head            mapped_user_buffer_list;
++    size_t                      handle;
++
++    struct kref                 kref;
++    struct device               *device;
++
++    void __user                 *user_address;
++    u32                         size;
++    enum dma_data_direction     data_direction;
++    struct sg_table             sg_table;
++
++    // If this flag is set, the buffer pointed by sg_table is not backed by
++    // 'struct page' (only by pure pfn). On this case, accessing to the page,
++    // or calling APIs that access the page (e.g. dma_sync_sg_for_cpu) is not
++    // allowed.
++    bool                       is_mmio;
++};
++
++// Continuous buffer that holds a descriptor list.
++struct hailo_descriptors_list_buffer {
++    struct list_head                   descriptors_buffer_list;
++    uintptr_t                          handle;
++    void                               *kernel_address;
++    dma_addr_t                         dma_address;
++    u32                           buffer_size;
++    struct hailo_vdma_descriptors_list desc_list;
++};
++
++struct hailo_vdma_low_memory_buffer {
++    struct list_head                    vdma_low_memory_buffer_list;
++    uintptr_t                           handle;
++    size_t                              pages_count;
++    void                                **pages_address;
++};
++
++struct hailo_vdma_continuous_buffer {
++    struct list_head    continuous_buffer_list;
++    uintptr_t           handle;
++    void                *kernel_address;
++    dma_addr_t          dma_address;
++    size_t              size;
++};
++
++struct hailo_vdma_controller;
++struct hailo_vdma_controller_ops {
++    void (*update_channel_interrupts)(struct hailo_vdma_controller *controller, size_t engine_index,
++        u32 channels_bitmap);
++};
++
++struct hailo_vdma_controller {
++    struct hailo_vdma_hw *hw;
++    struct hailo_vdma_controller_ops *ops;
++    struct device *dev;
++
++    size_t vdma_engines_count;
++    struct hailo_vdma_engine *vdma_engines;
++
++    spinlock_t interrupts_lock;
++    wait_queue_head_t interrupts_wq;
++
++    struct file *used_by_filp;
++
++    // Putting big IOCTL structures here to avoid stack allocation.
++    struct hailo_vdma_interrupts_read_timestamp_params read_interrupt_timestamps_params;
++};
++
++#define for_each_vdma_engine(controller, engine, engine_index)                          \
++    _for_each_element_array(controller->vdma_engines, controller->vdma_engines_count,   \
++        engine, engine_index)
++
++struct hailo_vdma_file_context {
++    atomic_t last_vdma_user_buffer_handle;
++    struct list_head mapped_user_buffer_list;
++
++    // Last_vdma_handle works as a handle for vdma decriptor list and for the vdma buffer -
++    // there will be no collisions between the two
++    atomic_t last_vdma_handle;
++    struct list_head descriptors_buffer_list;
++    struct list_head vdma_low_memory_buffer_list;
++    struct list_head continuous_buffer_list;
++};
++
++
++int hailo_vdma_controller_init(struct hailo_vdma_controller *controller,
++    struct device *dev, struct hailo_vdma_hw *vdma_hw,
++    struct hailo_vdma_controller_ops *ops,
++    struct hailo_resource *channel_registers_per_engine, size_t engines_count);
++
++void hailo_vdma_update_interrupts_mask(struct hailo_vdma_controller *controller,
++    size_t engine_index);
++
++void hailo_vdma_engine_interrupts_disable(struct hailo_vdma_controller *controller,
++    struct hailo_vdma_engine *engine, u8 engine_index, u32 channels_bitmap);
++
++void hailo_vdma_file_context_init(struct hailo_vdma_file_context *context);
++void hailo_vdma_file_context_finalize(struct hailo_vdma_file_context *context,
++    struct hailo_vdma_controller *controller, struct file *filp);
++
++void hailo_vdma_irq_handler(struct hailo_vdma_controller *controller, size_t engine_index,
++    u32 channels_bitmap);
++
++// TODO: reduce params count
++long hailo_vdma_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller,
++    unsigned int cmd, unsigned long arg, struct file *filp, struct semaphore *mutex, bool *should_up_board_mutex);
++
++int hailo_vdma_mmap(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller,
++    struct vm_area_struct *vma, uintptr_t vdma_handle);
++
++enum dma_data_direction get_dma_direction(enum hailo_dma_data_direction hailo_direction);
++void hailo_vdma_disable_vdma_channels(struct hailo_vdma_controller *controller, const bool should_close_channels);
++
++#endif /* _HAILO_VDMA_VDMA_H_ */
+\ No newline at end of file
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0465-drivers-media-pcie-hailo-Fix-include-paths.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0465-drivers-media-pcie-hailo-Fix-include-paths.patch
new file mode 100644
index 00000000..96f1a8d7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0465-drivers-media-pcie-hailo-Fix-include-paths.patch
@@ -0,0 +1,27 @@
+From 0d6f57fa567193eba861f410ca22c474f72f1f06 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 10 Jun 2024 17:41:14 +0100
+Subject: [PATCH 465/697] drivers: media: pcie: hailo: Fix include paths
+
+An attempt to fix the include paths - they look reasonable, but the
+GitHub auto-builds fail.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/media/pci/hailo/Makefile | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/pci/hailo/Makefile
++++ b/drivers/media/pci/hailo/Makefile
+@@ -25,8 +25,8 @@ hailo_pci-objs += $(VDMA_SRC_DIRECTORY)/
+ 
+ ccflags-y      += -Werror
+ ccflags-y      += -DHAILO_RASBERRY_PIE
+-ccflags-y      += -I$(srctree)/$(src)
+-ccflags-y      += -I$(srctree)/$(src)/include
+-ccflags-y      += -I$(srctree)/$(src)/common
++ccflags-y      += -I $(src)
++ccflags-y      += -I $(src)/include
++ccflags-y      += -I $(src)/common
+ 
+ clean-files := $(hailo_pci-objs)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0466-drivers-media-pci-Update-Hailo-accelerator-device-dr.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0466-drivers-media-pci-Update-Hailo-accelerator-device-dr.patch
new file mode 100644
index 00000000..26c1df3b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0466-drivers-media-pci-Update-Hailo-accelerator-device-dr.patch
@@ -0,0 +1,3352 @@
+From 0114bed53bade59b08462d66f493412689c4a89f Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Fri, 2 Aug 2024 11:01:24 +0100
+Subject: [PATCH 466/697] drivers: media: pci: Update Hailo accelerator device
+ driver to v4.18.0
+
+Sourced from https://github.com/hailo-ai/hailort-drivers/
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/pci/hailo/Makefile              |   2 +
+ drivers/media/pci/hailo/common/fw_operation.c |   2 +-
+ drivers/media/pci/hailo/common/fw_operation.h |   2 +-
+ .../media/pci/hailo/common/fw_validation.c    |  10 +-
+ .../media/pci/hailo/common/fw_validation.h    |   5 +-
+ .../pci/hailo/common/hailo_ioctl_common.h     | 240 +++++++----
+ .../media/pci/hailo/common/hailo_resource.c   |   2 +-
+ .../media/pci/hailo/common/hailo_resource.h   |   2 +-
+ drivers/media/pci/hailo/common/pcie_common.c  | 367 +++++++++++++----
+ drivers/media/pci/hailo/common/pcie_common.h  |  42 +-
+ drivers/media/pci/hailo/common/utils.h        |  24 +-
+ drivers/media/pci/hailo/common/vdma_common.c  | 371 +++++++++++++-----
+ drivers/media/pci/hailo/common/vdma_common.h  |  34 +-
+ drivers/media/pci/hailo/src/fops.c            | 104 +++--
+ drivers/media/pci/hailo/src/fops.h            |   1 +
+ drivers/media/pci/hailo/src/pci_soc_ioctl.c   | 155 ++++++++
+ drivers/media/pci/hailo/src/pci_soc_ioctl.h   |  19 +
+ drivers/media/pci/hailo/src/pcie.c            |  93 ++++-
+ drivers/media/pci/hailo/src/pcie.h            |   2 +
+ drivers/media/pci/hailo/src/sysfs.c           |   9 +
+ drivers/media/pci/hailo/src/utils.c           |   1 -
+ .../pci/hailo/utils/integrated_nnc_utils.c    | 101 +++++
+ .../pci/hailo/utils/integrated_nnc_utils.h    |  30 ++
+ drivers/media/pci/hailo/vdma/ioctl.c          |  53 ++-
+ drivers/media/pci/hailo/vdma/ioctl.h          |   6 +-
+ drivers/media/pci/hailo/vdma/memory.c         | 148 ++++++-
+ drivers/media/pci/hailo/vdma/memory.h         |   4 +-
+ drivers/media/pci/hailo/vdma/vdma.c           |  80 ++--
+ drivers/media/pci/hailo/vdma/vdma.h           |  30 +-
+ 29 files changed, 1536 insertions(+), 403 deletions(-)
+ create mode 100755 drivers/media/pci/hailo/src/pci_soc_ioctl.c
+ create mode 100755 drivers/media/pci/hailo/src/pci_soc_ioctl.h
+ create mode 100755 drivers/media/pci/hailo/utils/integrated_nnc_utils.c
+ create mode 100755 drivers/media/pci/hailo/utils/integrated_nnc_utils.h
+
+--- a/drivers/media/pci/hailo/Makefile
++++ b/drivers/media/pci/hailo/Makefile
+@@ -10,6 +10,7 @@ hailo_pci-objs += src/pcie.o
+ hailo_pci-objs += src/fops.o
+ hailo_pci-objs += src/utils.o
+ hailo_pci-objs += src/sysfs.o
++hailo_pci-objs += src/pci_soc_ioctl.o
+ 
+ hailo_pci-objs += $(COMMON_SRC_DIRECTORY)/fw_validation.o
+ hailo_pci-objs += $(COMMON_SRC_DIRECTORY)/fw_operation.o
+@@ -18,6 +19,7 @@ hailo_pci-objs += $(COMMON_SRC_DIRECTORY
+ hailo_pci-objs += $(COMMON_SRC_DIRECTORY)/hailo_resource.o
+ 
+ hailo_pci-objs += $(UTILS_SRC_DIRECTORY)/logs.o
++hailo_pci-objs += $(UTILS_SRC_DIRECTORY)/integrated_nnc_utils.o
+ 
+ hailo_pci-objs += $(VDMA_SRC_DIRECTORY)/vdma.o
+ hailo_pci-objs += $(VDMA_SRC_DIRECTORY)/memory.o
+--- a/drivers/media/pci/hailo/common/fw_operation.c
++++ b/drivers/media/pci/hailo/common/fw_operation.c
+@@ -1,4 +1,4 @@
+-// SPDX-License-Identifier: GPL-2.0
++// SPDX-License-Identifier: MIT
+ /**
+  * Copyright (c) 2022 Hailo Technologies Ltd. All rights reserved.
+ **/
+--- a/drivers/media/pci/hailo/common/fw_operation.h
++++ b/drivers/media/pci/hailo/common/fw_operation.h
+@@ -1,4 +1,4 @@
+-// SPDX-License-Identifier: GPL-2.0
++// SPDX-License-Identifier: MIT
+ /**
+  * Copyright (c) 2022 Hailo Technologies Ltd. All rights reserved.
+ **/
+--- a/drivers/media/pci/hailo/common/fw_validation.c
++++ b/drivers/media/pci/hailo/common/fw_validation.c
+@@ -1,4 +1,4 @@
+-// SPDX-License-Identifier: GPL-2.0
++// SPDX-License-Identifier: MIT
+ /**
+  * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
+  **/
+@@ -28,16 +28,18 @@ int FW_VALIDATION__validate_fw_header(ui
+     firmware_header_t *firmware_header = NULL;
+     u32 consumed_firmware_offset = *outer_consumed_firmware_offset;
+     u32 expected_firmware_magic = 0;
+- 
++
+     firmware_header = (firmware_header_t *) (firmware_base_address + consumed_firmware_offset);
+     CONSUME_FIRMWARE(sizeof(firmware_header_t), -EINVAL);
+ 
+     switch (board_type) {
+     case HAILO_BOARD_TYPE_HAILO8:
+-        expected_firmware_magic = FIRMWARE_HEADER_MAGIC_HAILO8; 
++        expected_firmware_magic = FIRMWARE_HEADER_MAGIC_HAILO8;
+         break;
++    case HAILO_BOARD_TYPE_HAILO10H_LEGACY:
+     case HAILO_BOARD_TYPE_HAILO15:
+-        expected_firmware_magic = FIRMWARE_HEADER_MAGIC_HAILO15; 
++    case HAILO_BOARD_TYPE_HAILO10H:
++        expected_firmware_magic = FIRMWARE_HEADER_MAGIC_HAILO15;
+         break;
+     case HAILO_BOARD_TYPE_PLUTO:
+         expected_firmware_magic = FIRMWARE_HEADER_MAGIC_PLUTO;
+--- a/drivers/media/pci/hailo/common/fw_validation.h
++++ b/drivers/media/pci/hailo/common/fw_validation.h
+@@ -1,4 +1,4 @@
+-// SPDX-License-Identifier: GPL-2.0
++// SPDX-License-Identifier: MIT
+ /**
+  * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
+  **/
+@@ -11,8 +11,7 @@
+ 
+ #define FIRMWARE_HEADER_MAGIC_HAILO8 (0x1DD89DE0)
+ #define FIRMWARE_HEADER_MAGIC_HAILO15 (0xE905DAAB)
+-// TODO - HRT-11344 : change fw magic to pluto specific
+-#define FIRMWARE_HEADER_MAGIC_PLUTO (0xE905DAAB)
++#define FIRMWARE_HEADER_MAGIC_PLUTO (0xF94739AB)
+ 
+ #ifndef HAILO_EMULATOR
+ #define FIRMWARE_WAIT_TIMEOUT_MS (5000)
+--- a/drivers/media/pci/hailo/common/hailo_ioctl_common.h
++++ b/drivers/media/pci/hailo/common/hailo_ioctl_common.h
+@@ -6,6 +6,14 @@
+ #ifndef _HAILO_IOCTL_COMMON_H_
+ #define _HAILO_IOCTL_COMMON_H_
+ 
++#define HAILO_DRV_VER_MAJOR 4
++#define HAILO_DRV_VER_MINOR 18
++#define HAILO_DRV_VER_REVISION 0
++
++#define _STRINGIFY_EXPANDED( x ) #x
++#define _STRINGIFY_NUMBER( x ) _STRINGIFY_EXPANDED(x)
++#define HAILO_DRV_VER _STRINGIFY_NUMBER(HAILO_DRV_VER_MAJOR) "." _STRINGIFY_NUMBER(HAILO_DRV_VER_MINOR) "."  _STRINGIFY_NUMBER(HAILO_DRV_VER_REVISION)
++
+ 
+ // This value is not easily changeable.
+ // For example: the channel interrupts ioctls assume we have up to 32 channels
+@@ -23,14 +31,17 @@
+ #define INVALID_DRIVER_HANDLE_VALUE     ((uintptr_t)-1)
+ 
+ // Used by windows and unix driver to raise the right CPU control handle to the FW. The same as in pcie_service FW
+-#define FW_ACCESS_CORE_CPU_CONTROL_SHIFT (1)
+-#define FW_ACCESS_CORE_CPU_CONTROL_MASK  (1 << FW_ACCESS_CORE_CPU_CONTROL_SHIFT)
+-#define FW_ACCESS_CONTROL_INTERRUPT_SHIFT (0)
+-#define FW_ACCESS_APP_CPU_CONTROL_MASK (1 << FW_ACCESS_CONTROL_INTERRUPT_SHIFT)
+-#define FW_ACCESS_DRIVER_SHUTDOWN_SHIFT (2)
+-#define FW_ACCESS_DRIVER_SHUTDOWN_MASK (1 << FW_ACCESS_DRIVER_SHUTDOWN_SHIFT)
++#define FW_ACCESS_CORE_CPU_CONTROL_SHIFT    (1)
++#define FW_ACCESS_CORE_CPU_CONTROL_MASK     (1 << FW_ACCESS_CORE_CPU_CONTROL_SHIFT)
++#define FW_ACCESS_CONTROL_INTERRUPT_SHIFT   (0)
++#define FW_ACCESS_APP_CPU_CONTROL_MASK      (1 << FW_ACCESS_CONTROL_INTERRUPT_SHIFT)
++#define FW_ACCESS_DRIVER_SHUTDOWN_SHIFT     (2)
++#define FW_ACCESS_DRIVER_SHUTDOWN_MASK      (1 << FW_ACCESS_DRIVER_SHUTDOWN_SHIFT)
++#define FW_ACCESS_SOC_CONNECT_SHIFT         (3)
++#define FW_ACCESS_SOC_CONNECT_MASK          (1 << FW_ACCESS_SOC_CONNECT_SHIFT)
++
++#define INVALID_VDMA_CHANNEL                (0xff)
+ 
+-#define INVALID_VDMA_CHANNEL (0xff)
+ 
+ #if !defined(__cplusplus) && defined(NTDDI_VERSION)
+ #include <wdm.h>
+@@ -53,14 +64,23 @@ typedef uint8_t bool;
+ #define INT_MAX 0x7FFFFFFF
+ #endif // !defined(INT_MAX)
+ 
++#if !defined(ECONNRESET)
++#define	ECONNRESET	104	/* Connection reset by peer */
++#endif // !defined(ECONNRESET)
+ 
+ // {d88d31f1-fede-4e71-ac2a-6ce0018c1501}
+-DEFINE_GUID (GUID_DEVINTERFACE_HailoKM,
++DEFINE_GUID (GUID_DEVINTERFACE_HailoKM_NNC,
+     0xd88d31f1,0xfede,0x4e71,0xac,0x2a,0x6c,0xe0,0x01,0x8c,0x15,0x01);
+ 
+-#define HAILO_GENERAL_IOCTL_MAGIC 0
+-#define HAILO_VDMA_IOCTL_MAGIC    1
+-#define HAILO_NON_LINUX_IOCTL_MAGIC 2
++// {7f16047d-64b8-207a-0092-e970893970a2}
++DEFINE_GUID (GUID_DEVINTERFACE_HailoKM_SOC,
++    0x7f16047d,0x64b8,0x207a,0x00,0x92,0xe9,0x70,0x89,0x39,0x70,0xa2);
++
++#define HAILO_GENERAL_IOCTL_MAGIC   0
++#define HAILO_VDMA_IOCTL_MAGIC      1
++#define HAILO_SOC_IOCTL_MAGIC       2
++#define HAILO_PCI_EP_IOCTL_MAGIC    3
++#define HAILO_NNC_IOCTL_MAGIC       4
+ 
+ #define HAILO_IOCTL_COMPATIBLE                  CTL_CODE(FILE_DEVICE_UNKNOWN, 0x802, METHOD_BUFFERED, FILE_ANY_ACCESS)
+ 
+@@ -114,9 +134,11 @@ static ULONG FORCEINLINE _IOC_(ULONG nr,
+ #define _IOWR_      _IOWR
+ #define _IO_        _IO
+ 
+-#define HAILO_GENERAL_IOCTL_MAGIC 'g'
+-#define HAILO_VDMA_IOCTL_MAGIC 'v'
+-#define HAILO_NON_LINUX_IOCTL_MAGIC 'w'
++#define HAILO_GENERAL_IOCTL_MAGIC   'g'
++#define HAILO_VDMA_IOCTL_MAGIC      'v'
++#define HAILO_SOC_IOCTL_MAGIC       's'
++#define HAILO_NNC_IOCTL_MAGIC       'n'
++#define HAILO_PCI_EP_IOCTL_MAGIC    'p'
+ 
+ #elif defined(__QNX__) // #ifdef _MSC_VER
+ #include <devctl.h>
+@@ -132,7 +154,6 @@ static ULONG FORCEINLINE _IOC_(ULONG nr,
+ #define _IO_    __DION
+ #define HAILO_GENERAL_IOCTL_MAGIC   _DCMD_ALL
+ #define HAILO_VDMA_IOCTL_MAGIC      _DCMD_MISC
+-#define HAILO_NON_LINUX_IOCTL_MAGIC _DCMD_PROC
+ 
+ #else // #ifdef _MSC_VER
+ #error "unsupported platform!"
+@@ -161,6 +182,16 @@ enum hailo_dma_data_direction {
+     HAILO_DMA_MAX_ENUM = INT_MAX,
+ };
+ 
++// Enum that states what type of buffer we are working with in the driver
++// TODO: HRT-13580 - Add specific type for user allocated and for driver allocated
++enum hailo_dma_buffer_type {
++    HAILO_DMA_USER_PTR_BUFFER = 0,
++    HAILO_DMA_DMABUF_BUFFER = 1,
++
++    /** Max enum value to maintain ABI Integrity */
++    HAILO_DMA_BUFFER_MAX_ENUM = INT_MAX,
++};
++
+ // Enum that determines if buffer should be allocated from user space or from driver
+ enum hailo_allocation_mode {
+     HAILO_ALLOCATION_MODE_USERSPACE = 0,
+@@ -170,10 +201,19 @@ enum hailo_allocation_mode {
+     HAILO_ALLOCATION_MODE_MAX_ENUM = INT_MAX,
+ };
+ 
++enum hailo_vdma_interrupts_domain {
++    HAILO_VDMA_INTERRUPTS_DOMAIN_NONE   = 0,
++    HAILO_VDMA_INTERRUPTS_DOMAIN_DEVICE = (1 << 0),
++    HAILO_VDMA_INTERRUPTS_DOMAIN_HOST   = (1 << 1),
++
++    /** Max enum value to maintain ABI Integrity */
++    HAILO_VDMA_INTERRUPTS_DOMAIN_MAX_ENUM = INT_MAX,
++};
++
+ /* structure used in ioctl HAILO_VDMA_BUFFER_MAP */
+ struct hailo_vdma_buffer_map_params {
+ #if defined(__linux__) || defined(_MSC_VER)
+-    void* user_address;                             // in
++    uintptr_t user_address;                         // in
+ #elif defined(__QNX__)
+     shm_handle_t shared_memory_handle;              // in
+ #else
+@@ -181,6 +221,7 @@ struct hailo_vdma_buffer_map_params {
+ #endif // __linux__
+     size_t size;                                    // in
+     enum hailo_dma_data_direction data_direction;   // in
++    enum hailo_dma_buffer_type buffer_type;         // in
+     uintptr_t allocated_buffer_handle;              // in
+     size_t mapped_handle;                           // out
+ };
+@@ -204,31 +245,27 @@ struct hailo_desc_list_release_params {
+     uintptr_t desc_handle;      // in
+ };
+ 
+-/* structure used in ioctl HAILO_NON_LINUX_DESC_LIST_MMAP */
+-struct hailo_non_linux_desc_list_mmap_params {
+-    uintptr_t desc_handle;  // in
+-    size_t size;            // in
+-    void* user_address;     // out
+-};
+-
+ /* structure used in ioctl HAILO_DESC_LIST_BIND_VDMA_BUFFER */
+-struct hailo_desc_list_bind_vdma_buffer_params {
++struct hailo_desc_list_program_params {
+     size_t buffer_handle;       // in
+     size_t buffer_size;         // in
+     size_t buffer_offset;       // in
+     uintptr_t desc_handle;      // in
+     uint8_t channel_index;      // in
+     uint32_t starting_desc;     // in
++    bool should_bind;           // in
++    enum hailo_vdma_interrupts_domain last_interrupts_domain;  // in
++    bool is_debug;              // in
+ };
+ 
+-/* structure used in ioctl HAILO_VDMA_INTERRUPTS_ENABLE */
+-struct hailo_vdma_interrupts_enable_params {
++/* structure used in ioctl HAILO_VDMA_ENABLE_CHANNELS */
++struct hailo_vdma_enable_channels_params {
+     uint32_t channels_bitmap_per_engine[MAX_VDMA_ENGINES];  // in
+     bool enable_timestamps_measure;                         // in
+ };
+ 
+-/* structure used in ioctl HAILO_VDMA_INTERRUPTS_DISABLE */
+-struct hailo_vdma_interrupts_disable_params {
++/* structure used in ioctl HAILO_VDMA_DISABLE_CHANNELS */
++struct hailo_vdma_disable_channels_params {
+     uint32_t channels_bitmap_per_engine[MAX_VDMA_ENGINES];  // in
+ };
+ 
+@@ -237,7 +274,7 @@ struct hailo_vdma_interrupts_channel_dat
+     uint8_t engine_index;
+     uint8_t channel_index;
+     bool is_active;                 // If not activate, num_processed is ignored.
+-    uint16_t host_num_processed;
++    uint8_t transfers_completed;    // Number of transfers completed.
+     uint8_t host_error;             // Channel errors bits on source side
+     uint8_t device_error;           // Channel errors bits on dest side
+     bool validation_success;        // If the validation of the channel was successful
+@@ -312,6 +349,10 @@ enum hailo_transfer_memory_type {
+     HAILO_TRANSFER_MEMORY_DMA_ENGINE1,
+     HAILO_TRANSFER_MEMORY_DMA_ENGINE2,
+ 
++    // PCIe EP driver memories
++    HAILO_TRANSFER_MEMORY_PCIE_EP_CONFIG = 0x400,
++    HAILO_TRANSFER_MEMORY_PCIE_EP_BRIDGE,
++
+     /** Max enum value to maintain ABI Integrity */
+     HAILO_TRANSFER_MEMORY_MAX_ENUM = INT_MAX,
+ };
+@@ -352,15 +393,26 @@ enum hailo_board_type {
+     HAILO_BOARD_TYPE_HAILO8 = 0,
+     HAILO_BOARD_TYPE_HAILO15,
+     HAILO_BOARD_TYPE_PLUTO,
++    HAILO_BOARD_TYPE_HAILO10H,
++    HAILO_BOARD_TYPE_HAILO10H_LEGACY,
+     HAILO_BOARD_TYPE_COUNT,
+ 
+     /** Max enum value to maintain ABI Integrity */
+     HAILO_BOARD_TYPE_MAX_ENUM = INT_MAX
+ };
+ 
++enum hailo_accelerator_type {
++    HAILO_ACCELERATOR_TYPE_NNC,
++    HAILO_ACCELERATOR_TYPE_SOC,
++
++    /** Max enum value to maintain ABI Integrity */
++    HAILO_ACCELERATOR_TYPE_MAX_ENUM = INT_MAX
++};
++
+ enum hailo_dma_type {
+     HAILO_DMA_TYPE_PCIE,
+     HAILO_DMA_TYPE_DRAM,
++    HAILO_DMA_TYPE_PCI_EP,
+ 
+     /** Max enum value to maintain ABI Integrity */
+     HAILO_DMA_TYPE_MAX_ENUM = INT_MAX,
+@@ -428,15 +480,6 @@ struct hailo_vdma_transfer_buffer {
+     uint32_t size;                     // in
+ };
+ 
+-enum hailo_vdma_interrupts_domain {
+-    HAILO_VDMA_INTERRUPTS_DOMAIN_NONE   = 0,
+-    HAILO_VDMA_INTERRUPTS_DOMAIN_DEVICE = (1 << 0),
+-    HAILO_VDMA_INTERRUPTS_DOMAIN_HOST   = (1 << 1),
+-
+-    /** Max enum value to maintain ABI Integrity */
+-    HAILO_VDMA_INTERRUPTS_DOMAIN_MAX_ENUM = INT_MAX,
+-};
+-
+ // We allow maximum 2 buffers per transfer since we may have an extra buffer 
+ // to make sure each buffer is aligned to page size.
+ #define HAILO_MAX_BUFFERS_PER_SINGLE_TRANSFER (2)
+@@ -460,6 +503,35 @@ struct hailo_vdma_launch_transfer_params
+                                                                         // more info (e.g desc complete status)
+ 
+     uint32_t descs_programed;                                           // out, amount of descriptors programed.
++    int launch_transfer_status;                                         // out, status of the launch transfer call. (only used in case of error)
++};
++
++/* structure used in ioctl HAILO_SOC_CONNECT */
++struct hailo_soc_connect_params {
++    uint8_t input_channel_index;    // out
++    uint8_t output_channel_index;   // out
++    uintptr_t input_desc_handle;    // in
++    uintptr_t output_desc_handle;   // in
++};
++
++/* structure used in ioctl HAILO_SOC_CLOSE */
++struct hailo_soc_close_params {
++    uint8_t input_channel_index;    // in
++    uint8_t output_channel_index;   // in
++};
++
++/* structure used in ioctl HAILO_PCI_EP_ACCEPT */
++struct hailo_pci_ep_accept_params {
++    uint8_t input_channel_index;    // out
++    uint8_t output_channel_index;   // out
++    uintptr_t input_desc_handle;    // in
++    uintptr_t output_desc_handle;   // in
++};
++
++/* structure used in ioctl HAILO_PCI_EP_CLOSE */
++struct hailo_pci_ep_close_params {
++    uint8_t input_channel_index;    // in
++    uint8_t output_channel_index;   // in
+ };
+ 
+ #ifdef _MSC_VER
+@@ -469,8 +541,8 @@ struct tCompatibleHailoIoctlData
+     ULONG_PTR Value;
+     union {
+         struct hailo_memory_transfer_params MemoryTransfer;
+-        struct hailo_vdma_interrupts_enable_params VdmaInterruptsEnable;
+-        struct hailo_vdma_interrupts_disable_params VdmaInterruptsDisable;
++        struct hailo_vdma_enable_channels_params VdmaEnableChannels;
++        struct hailo_vdma_disable_channels_params VdmaDisableChannels;
+         struct hailo_vdma_interrupts_read_timestamp_params VdmaInterruptsReadTimestamps;
+         struct hailo_vdma_interrupts_wait_params VdmaInterruptsWait;
+         struct hailo_vdma_buffer_sync_params VdmaBufferSync;
+@@ -479,14 +551,17 @@ struct tCompatibleHailoIoctlData
+         struct hailo_vdma_buffer_unmap_params VdmaBufferUnmap;
+         struct hailo_desc_list_create_params DescListCreate;
+         struct hailo_desc_list_release_params DescListReleaseParam;
+-        struct hailo_desc_list_bind_vdma_buffer_params DescListBind;
++        struct hailo_desc_list_program_params DescListProgram;
+         struct hailo_d2h_notification D2HNotification;
+         struct hailo_device_properties DeviceProperties;
+         struct hailo_driver_info DriverInfo;
+-        struct hailo_non_linux_desc_list_mmap_params DescListMmap;
+         struct hailo_read_log_params ReadLog;
+         struct hailo_mark_as_in_use_params MarkAsInUse;
+         struct hailo_vdma_launch_transfer_params LaunchTransfer;
++        struct hailo_soc_connect_params ConnectParams;
++        struct hailo_soc_close_params SocCloseParams;
++        struct hailo_pci_ep_accept_params AcceptParams;
++        struct hailo_pci_ep_close_params PciEpCloseParams;
+     } Buffer;
+ };
+ #endif // _MSC_VER
+@@ -495,30 +570,20 @@ struct tCompatibleHailoIoctlData
+ 
+ enum hailo_general_ioctl_code {
+     HAILO_MEMORY_TRANSFER_CODE,
+-    HAILO_FW_CONTROL_CODE,
+-    HAILO_READ_NOTIFICATION_CODE,
+-    HAILO_DISABLE_NOTIFICATION_CODE,
+     HAILO_QUERY_DEVICE_PROPERTIES_CODE,
+     HAILO_QUERY_DRIVER_INFO_CODE,
+-    HAILO_READ_LOG_CODE,
+-    HAILO_RESET_NN_CORE_CODE,
+ 
+     // Must be last
+     HAILO_GENERAL_IOCTL_MAX_NR,
+ };
+ 
+ #define HAILO_MEMORY_TRANSFER           _IOWR_(HAILO_GENERAL_IOCTL_MAGIC,  HAILO_MEMORY_TRANSFER_CODE,            struct hailo_memory_transfer_params)
+-#define HAILO_FW_CONTROL                _IOWR_(HAILO_GENERAL_IOCTL_MAGIC,  HAILO_FW_CONTROL_CODE,                 struct hailo_fw_control)
+-#define HAILO_READ_NOTIFICATION         _IOW_(HAILO_GENERAL_IOCTL_MAGIC,   HAILO_READ_NOTIFICATION_CODE,          struct hailo_d2h_notification)
+-#define HAILO_DISABLE_NOTIFICATION      _IO_(HAILO_GENERAL_IOCTL_MAGIC,    HAILO_DISABLE_NOTIFICATION_CODE)
+ #define HAILO_QUERY_DEVICE_PROPERTIES   _IOW_(HAILO_GENERAL_IOCTL_MAGIC,   HAILO_QUERY_DEVICE_PROPERTIES_CODE,    struct hailo_device_properties)
+ #define HAILO_QUERY_DRIVER_INFO         _IOW_(HAILO_GENERAL_IOCTL_MAGIC,   HAILO_QUERY_DRIVER_INFO_CODE,          struct hailo_driver_info)
+-#define HAILO_READ_LOG                  _IOWR_(HAILO_GENERAL_IOCTL_MAGIC,  HAILO_READ_LOG_CODE,                   struct hailo_read_log_params)
+-#define HAILO_RESET_NN_CORE             _IO_(HAILO_GENERAL_IOCTL_MAGIC,    HAILO_RESET_NN_CORE_CODE)
+ 
+ enum hailo_vdma_ioctl_code {
+-    HAILO_VDMA_INTERRUPTS_ENABLE_CODE,
+-    HAILO_VDMA_INTERRUPTS_DISABLE_CODE,
++    HAILO_VDMA_ENABLE_CHANNELS_CODE,
++    HAILO_VDMA_DISABLE_CHANNELS_CODE,
+     HAILO_VDMA_INTERRUPTS_WAIT_CODE,
+     HAILO_VDMA_INTERRUPTS_READ_TIMESTAMPS_CODE,
+     HAILO_VDMA_BUFFER_MAP_CODE,
+@@ -526,7 +591,7 @@ enum hailo_vdma_ioctl_code {
+     HAILO_VDMA_BUFFER_SYNC_CODE,
+     HAILO_DESC_LIST_CREATE_CODE,
+     HAILO_DESC_LIST_RELEASE_CODE,
+-    HAILO_DESC_LIST_BIND_VDMA_BUFFER_CODE,
++    HAILO_DESC_LIST_PROGRAM_CODE,
+     HAILO_VDMA_LOW_MEMORY_BUFFER_ALLOC_CODE,
+     HAILO_VDMA_LOW_MEMORY_BUFFER_FREE_CODE,
+     HAILO_MARK_AS_IN_USE_CODE,
+@@ -538,38 +603,67 @@ enum hailo_vdma_ioctl_code {
+     HAILO_VDMA_IOCTL_MAX_NR,
+ };
+ 
+-#define HAILO_VDMA_INTERRUPTS_ENABLE          _IOR_(HAILO_VDMA_IOCTL_MAGIC,  HAILO_VDMA_INTERRUPTS_ENABLE_CODE,            struct hailo_vdma_interrupts_enable_params)
+-#define HAILO_VDMA_INTERRUPTS_DISABLE         _IOR_(HAILO_VDMA_IOCTL_MAGIC,  HAILO_VDMA_INTERRUPTS_DISABLE_CODE,           struct hailo_vdma_interrupts_disable_params)
++#define HAILO_VDMA_ENABLE_CHANNELS            _IOR_(HAILO_VDMA_IOCTL_MAGIC,  HAILO_VDMA_ENABLE_CHANNELS_CODE,              struct hailo_vdma_enable_channels_params)
++#define HAILO_VDMA_DISABLE_CHANNELS           _IOR_(HAILO_VDMA_IOCTL_MAGIC,  HAILO_VDMA_DISABLE_CHANNELS_CODE,             struct hailo_vdma_disable_channels_params)
+ #define HAILO_VDMA_INTERRUPTS_WAIT            _IOWR_(HAILO_VDMA_IOCTL_MAGIC, HAILO_VDMA_INTERRUPTS_WAIT_CODE,              struct hailo_vdma_interrupts_wait_params)
+ #define HAILO_VDMA_INTERRUPTS_READ_TIMESTAMPS _IOWR_(HAILO_VDMA_IOCTL_MAGIC, HAILO_VDMA_INTERRUPTS_READ_TIMESTAMPS_CODE,   struct hailo_vdma_interrupts_read_timestamp_params)
+ 
+-#define HAILO_VDMA_BUFFER_MAP                 _IOWR_(HAILO_VDMA_IOCTL_MAGIC, HAILO_VDMA_BUFFER_MAP_CODE,                    struct hailo_vdma_buffer_map_params)
+-#define HAILO_VDMA_BUFFER_UNMAP               _IOR_(HAILO_VDMA_IOCTL_MAGIC,  HAILO_VDMA_BUFFER_UNMAP_CODE,                  struct hailo_vdma_buffer_unmap_params)
+-#define HAILO_VDMA_BUFFER_SYNC                _IOR_(HAILO_VDMA_IOCTL_MAGIC,  HAILO_VDMA_BUFFER_SYNC_CODE,                   struct hailo_vdma_buffer_sync_params)
++#define HAILO_VDMA_BUFFER_MAP                 _IOWR_(HAILO_VDMA_IOCTL_MAGIC, HAILO_VDMA_BUFFER_MAP_CODE,                   struct hailo_vdma_buffer_map_params)
++#define HAILO_VDMA_BUFFER_UNMAP               _IOR_(HAILO_VDMA_IOCTL_MAGIC,  HAILO_VDMA_BUFFER_UNMAP_CODE,                 struct hailo_vdma_buffer_unmap_params)
++#define HAILO_VDMA_BUFFER_SYNC                _IOR_(HAILO_VDMA_IOCTL_MAGIC,  HAILO_VDMA_BUFFER_SYNC_CODE,                  struct hailo_vdma_buffer_sync_params)
++
++#define HAILO_DESC_LIST_CREATE                _IOWR_(HAILO_VDMA_IOCTL_MAGIC, HAILO_DESC_LIST_CREATE_CODE,                  struct hailo_desc_list_create_params)
++#define HAILO_DESC_LIST_RELEASE               _IOR_(HAILO_VDMA_IOCTL_MAGIC,  HAILO_DESC_LIST_RELEASE_CODE,                 struct hailo_desc_list_release_params)
++#define HAILO_DESC_LIST_PROGRAM               _IOR_(HAILO_VDMA_IOCTL_MAGIC,  HAILO_DESC_LIST_PROGRAM_CODE,                 struct hailo_desc_list_program_params)
+ 
+-#define HAILO_DESC_LIST_CREATE                _IOWR_(HAILO_VDMA_IOCTL_MAGIC, HAILO_DESC_LIST_CREATE_CODE,                   struct hailo_desc_list_create_params)
+-#define HAILO_DESC_LIST_RELEASE               _IOR_(HAILO_VDMA_IOCTL_MAGIC,  HAILO_DESC_LIST_RELEASE_CODE,                  struct hailo_desc_list_release_params)
+-#define HAILO_DESC_LIST_BIND_VDMA_BUFFER      _IOR_(HAILO_VDMA_IOCTL_MAGIC,  HAILO_DESC_LIST_BIND_VDMA_BUFFER_CODE,         struct hailo_desc_list_bind_vdma_buffer_params)
++#define HAILO_VDMA_LOW_MEMORY_BUFFER_ALLOC    _IOWR_(HAILO_VDMA_IOCTL_MAGIC, HAILO_VDMA_LOW_MEMORY_BUFFER_ALLOC_CODE,      struct hailo_allocate_low_memory_buffer_params)
++#define HAILO_VDMA_LOW_MEMORY_BUFFER_FREE     _IOR_(HAILO_VDMA_IOCTL_MAGIC,  HAILO_VDMA_LOW_MEMORY_BUFFER_FREE_CODE,       struct hailo_free_low_memory_buffer_params)
+ 
+-#define HAILO_VDMA_LOW_MEMORY_BUFFER_ALLOC    _IOWR_(HAILO_VDMA_IOCTL_MAGIC, HAILO_VDMA_LOW_MEMORY_BUFFER_ALLOC_CODE,       struct hailo_allocate_low_memory_buffer_params)
+-#define HAILO_VDMA_LOW_MEMORY_BUFFER_FREE     _IOR_(HAILO_VDMA_IOCTL_MAGIC,   HAILO_VDMA_LOW_MEMORY_BUFFER_FREE_CODE,       struct hailo_free_low_memory_buffer_params)
++#define HAILO_MARK_AS_IN_USE                  _IOW_(HAILO_VDMA_IOCTL_MAGIC,  HAILO_MARK_AS_IN_USE_CODE,                    struct hailo_mark_as_in_use_params)
+ 
+-#define HAILO_MARK_AS_IN_USE                  _IOW_(HAILO_VDMA_IOCTL_MAGIC,  HAILO_MARK_AS_IN_USE_CODE,                     struct hailo_mark_as_in_use_params)
++#define HAILO_VDMA_CONTINUOUS_BUFFER_ALLOC    _IOWR_(HAILO_VDMA_IOCTL_MAGIC, HAILO_VDMA_CONTINUOUS_BUFFER_ALLOC_CODE,      struct hailo_allocate_continuous_buffer_params)
++#define HAILO_VDMA_CONTINUOUS_BUFFER_FREE     _IOR_(HAILO_VDMA_IOCTL_MAGIC,  HAILO_VDMA_CONTINUOUS_BUFFER_FREE_CODE,       struct hailo_free_continuous_buffer_params)
+ 
+-#define HAILO_VDMA_CONTINUOUS_BUFFER_ALLOC    _IOWR_(HAILO_VDMA_IOCTL_MAGIC, HAILO_VDMA_CONTINUOUS_BUFFER_ALLOC_CODE,       struct hailo_allocate_continuous_buffer_params)
+-#define HAILO_VDMA_CONTINUOUS_BUFFER_FREE     _IOR_(HAILO_VDMA_IOCTL_MAGIC,   HAILO_VDMA_CONTINUOUS_BUFFER_FREE_CODE,       struct hailo_free_continuous_buffer_params)
++#define HAILO_VDMA_LAUNCH_TRANSFER           _IOWR_(HAILO_VDMA_IOCTL_MAGIC,  HAILO_VDMA_LAUNCH_TRANSFER_CODE,              struct hailo_vdma_launch_transfer_params)
+ 
+-#define HAILO_VDMA_LAUNCH_TRANSFER           _IOWR_(HAILO_VDMA_IOCTL_MAGIC, HAILO_VDMA_LAUNCH_TRANSFER_CODE,                struct hailo_vdma_launch_transfer_params)
++enum hailo_nnc_ioctl_code {
++    HAILO_FW_CONTROL_CODE,
++    HAILO_READ_NOTIFICATION_CODE,
++    HAILO_DISABLE_NOTIFICATION_CODE,
++    HAILO_READ_LOG_CODE,
++    HAILO_RESET_NN_CORE_CODE,
+ 
++    // Must be last
++    HAILO_NNC_IOCTL_MAX_NR
++};
+ 
+-enum hailo_non_linux_ioctl_code {
+-    HAILO_NON_LINUX_DESC_LIST_MMAP_CODE,
++#define HAILO_FW_CONTROL                _IOWR_(HAILO_NNC_IOCTL_MAGIC,  HAILO_FW_CONTROL_CODE,                 struct hailo_fw_control)
++#define HAILO_READ_NOTIFICATION         _IOW_(HAILO_NNC_IOCTL_MAGIC,   HAILO_READ_NOTIFICATION_CODE,          struct hailo_d2h_notification)
++#define HAILO_DISABLE_NOTIFICATION      _IO_(HAILO_NNC_IOCTL_MAGIC,    HAILO_DISABLE_NOTIFICATION_CODE)
++#define HAILO_READ_LOG                  _IOWR_(HAILO_NNC_IOCTL_MAGIC,  HAILO_READ_LOG_CODE,                   struct hailo_read_log_params)
++#define HAILO_RESET_NN_CORE             _IO_(HAILO_NNC_IOCTL_MAGIC,    HAILO_RESET_NN_CORE_CODE)
++
++enum hailo_soc_ioctl_code {
++    HAILO_SOC_IOCTL_CONNECT_CODE,
++    HAILO_SOC_IOCTL_CLOSE_CODE,
+ 
+     // Must be last
+-    HAILO_NON_LINUX_IOCTL_MAX_NR,
++    HAILO_SOC_IOCTL_MAX_NR,
+ };
+ 
+-#define HAILO_NON_LINUX_DESC_LIST_MMAP _IOWR_(HAILO_NON_LINUX_IOCTL_MAGIC, HAILO_NON_LINUX_DESC_LIST_MMAP_CODE, struct hailo_non_linux_desc_list_mmap_params)
++#define HAILO_SOC_CONNECT       _IOWR_(HAILO_SOC_IOCTL_MAGIC, HAILO_SOC_IOCTL_CONNECT_CODE, struct hailo_soc_connect_params)
++#define HAILO_SOC_CLOSE         _IOR_(HAILO_SOC_IOCTL_MAGIC,  HAILO_SOC_IOCTL_CLOSE_CODE,   struct hailo_soc_close_params)
++
++
++enum hailo_pci_ep_ioctl_code {
++    HAILO_PCI_EP_ACCEPT_CODE,
++    HAILO_PCI_EP_CLOSE_CODE,
++
++    // Must be last
++    HAILO_PCI_EP_IOCTL_MAX_NR,
++};
+ 
++#define HAILO_PCI_EP_ACCEPT         _IOWR_(HAILO_PCI_EP_IOCTL_MAGIC,  HAILO_PCI_EP_ACCEPT_CODE,  struct hailo_pci_ep_accept_params)
++#define HAILO_PCI_EP_CLOSE          _IOR_(HAILO_PCI_EP_IOCTL_MAGIC,   HAILO_PCI_EP_CLOSE_CODE,   struct hailo_pci_ep_close_params)
+ 
+ #endif /* _HAILO_IOCTL_COMMON_H_ */
+--- a/drivers/media/pci/hailo/common/hailo_resource.c
++++ b/drivers/media/pci/hailo/common/hailo_resource.c
+@@ -1,4 +1,4 @@
+-// SPDX-License-Identifier: GPL-2.0
++// SPDX-License-Identifier: MIT
+ /**
+  * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
+  **/
+--- a/drivers/media/pci/hailo/common/hailo_resource.h
++++ b/drivers/media/pci/hailo/common/hailo_resource.h
+@@ -1,4 +1,4 @@
+-// SPDX-License-Identifier: GPL-2.0
++// SPDX-License-Identifier: MIT
+ /**
+  * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
+  **/
+--- a/drivers/media/pci/hailo/common/pcie_common.c
++++ b/drivers/media/pci/hailo/common/pcie_common.c
+@@ -1,4 +1,4 @@
+-// SPDX-License-Identifier: GPL-2.0
++// SPDX-License-Identifier: MIT
+ /**
+  * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
+  **/
+@@ -10,6 +10,8 @@
+ #include <linux/bug.h>
+ #include <linux/delay.h>
+ #include <linux/kernel.h>
++#include <linux/printk.h>
++#include <linux/device.h>
+ 
+ 
+ #define BSC_IMASK_HOST (0x0188)
+@@ -19,14 +21,13 @@
+ 
+ #define PO2_ROUND_UP(size, alignment) ((size + alignment-1) & ~(alignment-1))
+ 
+-#define ATR0_PARAM (0x17)
+-#define ATR0_SRC_ADDR (0x0)
+-#define ATR0_TRSL_ADDR2 (0x0)
+-#define ATR0_TRSL_PARAM (6)
++#define ATR_PARAM               (0x17)
++#define ATR_SRC_ADDR            (0x0)
++#define ATR_TRSL_PARAM          (6)
++#define ATR_TABLE_SIZE          (0x1000u)
++#define ATR_TABLE_SIZE_MASK     (0x1000u - 1)
+ 
+ #define ATR0_PCIE_BRIDGE_OFFSET (0x700)
+-#define ATR0_TABLE_SIZE (0x1000u)
+-#define ATR0_TABLE_SIZE_MASK (0x1000u - 1)
+ 
+ #define MAXIMUM_APP_FIRMWARE_CODE_SIZE (0x40000)
+ #define MAXIMUM_CORE_FIRMWARE_CODE_SIZE (0x20000)
+@@ -45,8 +46,13 @@
+ #define HAILO_PCIE_HOST_DMA_DATA_ID (0)
+ #define HAILO_PCIE_DMA_DEVICE_INTERRUPTS_BITMASK    (1 << 4)
+ #define HAILO_PCIE_DMA_HOST_INTERRUPTS_BITMASK      (1 << 5)
++#define HAILO_PCIE_DMA_SRC_CHANNELS_BITMASK         (0x0000FFFF)
+ 
+-typedef u32 hailo_ptr_t;
++#define HAILO_PCIE_MAX_ATR_TABLE_INDEX (3)
++
++#define MAX_FILES_PER_STAGE (4)
++
++#define BOOT_STATUS_UNINITIALIZED (0x1)
+ 
+ struct hailo_fw_addresses {
+     u32 boot_fw_header;
+@@ -58,14 +64,11 @@ struct hailo_fw_addresses {
+     u32 core_fw_header;
+     u32 atr0_trsl_addr1;
+     u32 raise_ready_offset;
++    u32 boot_status;
+ };
+ 
+-struct hailo_atr_config {
+-    u32 atr_param;
+-    u32 atr_src;
+-    u32 atr_trsl_addr_1;
+-    u32 atr_trsl_addr_2;
+-    u32 atr_trsl_param;
++struct loading_stage {
++    const struct hailo_file_batch *batch;
+ };
+ 
+ struct hailo_board_compatibility {
+@@ -73,6 +76,69 @@ struct hailo_board_compatibility {
+     const char *fw_filename;
+     const struct hailo_config_constants board_cfg;
+     const struct hailo_config_constants fw_cfg;
++    const struct loading_stage stages[MAX_LOADING_STAGES];
++};
++
++static const struct hailo_file_batch hailo10h_files_stg1[] = {
++    {
++        .filename = "hailo/hailo10h/customer_certificate.bin",
++        .address = 0xA0000,
++        .max_size = 0x8004,
++        .is_mandatory = true,
++        .has_header = false
++    },
++    {
++        .filename = "hailo/hailo10h/u-boot.dtb.signed",
++        .address = 0xA8004,
++        .max_size = 0x20000,
++        .is_mandatory = true,
++        .has_header = false
++    },
++    {
++        .filename = "hailo/hailo10h/scu_fw.bin",
++        .address = 0x20000,
++        .max_size = 0x40000,
++        .is_mandatory = true,
++        .has_header = true
++    },
++    {
++        .filename = NULL,
++        .address = 0x00,
++        .max_size = 0x00,
++        .is_mandatory = false,
++        .has_header = false
++    }
++};
++
++static const struct hailo_file_batch hailo10h_files_stg2[] = {
++    {
++        .filename = "hailo/hailo10h/u-boot-spl.bin",
++        .address = 0x85000000,
++        .max_size = 0x1000000,
++        .is_mandatory = true,
++        .has_header = false
++    },
++    {
++        .filename = "hailo/hailo10h/u-boot-tfa.itb",
++        .address = 0x86000000,
++        .max_size = 0x1000000,
++        .is_mandatory = true,
++        .has_header = false
++    },
++    {
++        .filename = "hailo/hailo10h/fitImage",
++        .address = 0x87000000,
++        .max_size = 0x1000000,
++        .is_mandatory = true,
++        .has_header = false
++    },
++    {
++        .filename = "hailo/hailo10h/core-image-minimal-hailo10-m2.ext4.gz",
++        .address = 0x88000000,
++        .max_size = 0x20000000, // Max size 512MB
++        .is_mandatory = true,
++        .has_header = false
++    },
+ };
+ 
+ static const struct hailo_board_compatibility compat[HAILO_BOARD_TYPE_COUNT] = {
+@@ -87,6 +153,7 @@ static const struct hailo_board_compatib
+             .core_fw_header = 0xA0000,
+             .atr0_trsl_addr1 = 0x60000000,
+             .raise_ready_offset = 0x1684,
++            .boot_status = 0xe0000,
+         },
+         .fw_filename = "hailo/hailo8_fw.bin",
+         .board_cfg = {
+@@ -100,7 +167,7 @@ static const struct hailo_board_compatib
+             .max_size = PCIE_HAILO8_FW_CFG_MAX_SIZE,
+         },
+     },
+-    [HAILO_BOARD_TYPE_HAILO15] = {
++    [HAILO_BOARD_TYPE_HAILO10H_LEGACY] = {
+         .fw_addresses = {
+             .boot_fw_header = 0x88000,
+             .boot_fw_trigger = 0x88c98,
+@@ -111,6 +178,7 @@ static const struct hailo_board_compatib
+             .core_fw_header = 0xC0000,
+             .atr0_trsl_addr1 = 0x000BE000,
+             .raise_ready_offset = 0x1754,
++            .boot_status = 0x80000,
+         },
+         .fw_filename = "hailo/hailo15_fw.bin",
+         .board_cfg = {
+@@ -124,6 +192,39 @@ static const struct hailo_board_compatib
+             .max_size = 0,
+         },
+     },
++    [HAILO_BOARD_TYPE_HAILO10H] = {
++        .fw_addresses = {
++            .boot_fw_header = 0x88000,
++            .boot_fw_trigger = 0x88c98,
++            .boot_key_cert = 0x88018,
++            .boot_cont_cert = 0x886a8,
++            .app_fw_code_ram_base = 0x20000,
++            .core_code_ram_base = 0,
++            .core_fw_header = 0,
++            .atr0_trsl_addr1 = 0x000BE000,
++            .raise_ready_offset = 0x1754,
++            .boot_status = 0x80000,
++        },
++        .fw_filename = NULL,
++        .board_cfg = {
++            .filename = NULL,
++            .address = 0,
++            .max_size = 0,
++        },
++        .fw_cfg = {
++            .filename = NULL,
++            .address = 0,
++            .max_size = 0,
++        },
++        .stages = {
++            {
++                .batch = hailo10h_files_stg1,
++            },
++            {
++                .batch = hailo10h_files_stg2,
++            },
++        },
++    },
+     // HRT-11344 : none of these matter except raise_ready_offset seeing as we load fw seperately - not through driver
+     // After implementing bootloader put correct values here
+     [HAILO_BOARD_TYPE_PLUTO] = {
+@@ -138,6 +239,7 @@ static const struct hailo_board_compatib
+             .atr0_trsl_addr1 = 0x000BE000,
+             // NOTE: After they update hw consts - check register fw_access_interrupt_w1s of pcie_config
+             .raise_ready_offset = 0x174c,
++            .boot_status = 0x80000,
+         },
+         .fw_filename = "hailo/pluto_fw.bin",
+         .board_cfg = {
+@@ -225,7 +327,7 @@ int hailo_pcie_read_firmware_control(str
+     // Copy response buffer
+     hailo_resource_read_buffer(&resources->fw_access, PCIE_REQUEST_SIZE_OFFSET + (size_t)response_header_size,
+         command->buffer_len, &command->buffer);
+-    
++
+     return 0;
+ }
+ 
+@@ -253,93 +355,111 @@ int hailo_pcie_read_firmware_notificatio
+     return hailo_read_firmware_notification(&notification_resource, notification);
+ }
+ 
+-static void write_atr_table(struct hailo_pcie_resources *resources,
+-    struct hailo_atr_config *atr)
++int hailo_pcie_configure_atr_table(struct hailo_resource *bridge_config, u64 trsl_addr, u32 atr_index)
+ {
+-    hailo_resource_write_buffer(&resources->config, ATR0_PCIE_BRIDGE_OFFSET,
+-        sizeof(*atr), (void*)atr);
+-}
++    size_t offset = 0;
++    struct hailo_atr_config atr = {
++        .atr_param = (ATR_PARAM | (atr_index << 12)),
++        .atr_src = ATR_SRC_ADDR,
++        .atr_trsl_addr_1 = (u32)(trsl_addr & 0xFFFFFFFF),
++        .atr_trsl_addr_2 = (u32)(trsl_addr >> 32),
++        .atr_trsl_param = ATR_TRSL_PARAM
++    };
+ 
+-static void read_atr_table(struct hailo_pcie_resources *resources,
+-    struct hailo_atr_config *atr)
+-{
+-    hailo_resource_read_buffer(&resources->config, ATR0_PCIE_BRIDGE_OFFSET,
+-        sizeof(*atr), (void*)atr);
++    BUG_ON(HAILO_PCIE_MAX_ATR_TABLE_INDEX < atr_index);
++    offset = ATR0_PCIE_BRIDGE_OFFSET + (atr_index * 0x20);
++
++    return hailo_resource_write_buffer(bridge_config, offset, sizeof(atr), (void*)&atr);
+ }
+ 
+-static void configure_atr_table(struct hailo_pcie_resources *resources,
+-    hailo_ptr_t base_address)
++void hailo_pcie_read_atr_table(struct hailo_resource *bridge_config, struct hailo_atr_config *atr, u32 atr_index)
+ {
+-    struct hailo_atr_config atr = {
+-        .atr_param = ATR0_PARAM,
+-        .atr_src = ATR0_SRC_ADDR,
+-        .atr_trsl_addr_1 = (u32)base_address,
+-        .atr_trsl_addr_2 = ATR0_TRSL_ADDR2,
+-        .atr_trsl_param = ATR0_TRSL_PARAM
+-    };
+-    write_atr_table(resources, &atr);
++    size_t offset = 0;
++
++    BUG_ON(HAILO_PCIE_MAX_ATR_TABLE_INDEX < atr_index);
++    offset = ATR0_PCIE_BRIDGE_OFFSET + (atr_index * 0x20);
++    
++    hailo_resource_read_buffer(bridge_config, offset, sizeof(*atr), (void*)atr);
+ }
+ 
+ static void write_memory_chunk(struct hailo_pcie_resources *resources,
+     hailo_ptr_t dest, u32 dest_offset, const void *src, u32 len)
+ {
++    u32 ATR_INDEX = 0;
+     BUG_ON(dest_offset + len > (u32)resources->fw_access.size);
+ 
+-    configure_atr_table(resources, dest);
++    (void)hailo_pcie_configure_atr_table(&resources->config, (u64)dest, ATR_INDEX);
+     (void)hailo_resource_write_buffer(&resources->fw_access, dest_offset, len, src);
+ }
+ 
+ static void read_memory_chunk(
+     struct hailo_pcie_resources *resources, hailo_ptr_t src, u32 src_offset, void *dest, u32 len)
+ {
++    u32 ATR_INDEX = 0;
+     BUG_ON(src_offset + len > (u32)resources->fw_access.size);
+ 
+-    configure_atr_table(resources, src);
++    (void)hailo_pcie_configure_atr_table(&resources->config, (u64)src, ATR_INDEX);
+     (void)hailo_resource_read_buffer(&resources->fw_access, src_offset, len, dest);
+ }
+ 
+ // Note: this function modify the device ATR table (that is also used by the firmware for control and vdma).
+ // Use with caution, and restore the original atr if needed.
+-static void write_memory(struct hailo_pcie_resources *resources, hailo_ptr_t dest, const void *src, u32 len)
++void write_memory(struct hailo_pcie_resources *resources, hailo_ptr_t dest, const void *src, u32 len)
+ {
+-    hailo_ptr_t base_address = dest & ~ATR0_TABLE_SIZE_MASK;
++    struct hailo_atr_config previous_atr = {0};
++    hailo_ptr_t base_address = (dest & ~ATR_TABLE_SIZE_MASK);
+     u32 chunk_len = 0;
+     u32 offset = 0;
++    u32 ATR_INDEX = 0;
++
++    // Store previous ATR (Read/write modify the ATR).
++    hailo_pcie_read_atr_table(&resources->config, &previous_atr, ATR_INDEX);
+ 
+     if (base_address != dest) {
+         // Data is not aligned, write the first chunk
+-        chunk_len = min(base_address + ATR0_TABLE_SIZE - dest, len);
++        chunk_len = min(base_address + ATR_TABLE_SIZE - dest, len);
+         write_memory_chunk(resources, base_address, dest - base_address, src, chunk_len);
+         offset += chunk_len;
+     }
+ 
+     while (offset < len) {
+-        chunk_len = min(len - offset, ATR0_TABLE_SIZE);
++        chunk_len = min(len - offset, ATR_TABLE_SIZE);
+         write_memory_chunk(resources, dest + offset, 0, (const u8*)src + offset, chunk_len);
+         offset += chunk_len;
+     }
++
++    (void)hailo_pcie_configure_atr_table(&resources->config,
++        (((u64)(previous_atr.atr_trsl_addr_2) << 32) | previous_atr.atr_trsl_addr_1), ATR_INDEX);
+ }
+ 
+ // Note: this function modify the device ATR table (that is also used by the firmware for control and vdma).
+ // Use with caution, and restore the original atr if needed.
+ static void read_memory(struct hailo_pcie_resources *resources, hailo_ptr_t src, void *dest, u32 len)
+ {
+-    hailo_ptr_t base_address = src & ~ATR0_TABLE_SIZE_MASK;
++    struct hailo_atr_config previous_atr = {0};
++    hailo_ptr_t base_address = (src & ~ATR_TABLE_SIZE_MASK);
+     u32 chunk_len = 0;
+     u32 offset = 0;
++    u32 ATR_INDEX = 0;
++
++    // Store previous ATR (Read/write modify the ATR).
++    hailo_pcie_read_atr_table(&resources->config, &previous_atr, ATR_INDEX);
+ 
+     if (base_address != src) {
+         // Data is not aligned, write the first chunk
+-        chunk_len = min(base_address + ATR0_TABLE_SIZE - src, len);
++        chunk_len = min(base_address + ATR_TABLE_SIZE - src, len);
+         read_memory_chunk(resources, base_address, src - base_address, dest, chunk_len);
+         offset += chunk_len;
+     }
+ 
+     while (offset < len) {
+-        chunk_len = min(len - offset, ATR0_TABLE_SIZE);
++        chunk_len = min(len - offset, ATR_TABLE_SIZE);
+         read_memory_chunk(resources, src + offset, 0, (u8*)dest + offset, chunk_len);
+         offset += chunk_len;
+     }
++
++    (void)hailo_pcie_configure_atr_table(&resources->config,
++        (((u64)(previous_atr.atr_trsl_addr_2) << 32) | previous_atr.atr_trsl_addr_1), ATR_INDEX);
+ }
+ 
+ static void hailo_write_app_firmware(struct hailo_pcie_resources *resources, firmware_header_t *fw_header,
+@@ -367,7 +487,7 @@ static void hailo_write_core_firmware(st
+     write_memory(resources, fw_addresses->core_fw_header, fw_header, sizeof(firmware_header_t));
+ }
+ 
+-static void hailo_trigger_firmware_boot(struct hailo_pcie_resources *resources)
++void hailo_trigger_firmware_boot(struct hailo_pcie_resources *resources)
+ {
+     const struct hailo_fw_addresses *fw_addresses = &(compat[resources->board_type].fw_addresses);
+     u32 pcie_finished = 1;
+@@ -376,6 +496,17 @@ static void hailo_trigger_firmware_boot(
+         (void*)&pcie_finished, sizeof(pcie_finished));
+ }
+ 
++u32 hailo_get_boot_status(struct hailo_pcie_resources *resources)
++{
++    u32 boot_status = 0;
++    const struct hailo_fw_addresses *fw_addresses = &(compat[resources->board_type].fw_addresses);
++
++    read_memory(resources, fw_addresses->boot_status,
++        &boot_status, sizeof(boot_status));
++
++    return boot_status;
++}
++
+ /**
+ * Validates the FW headers.
+ * @param[in] address                    Address of the firmware.
+@@ -408,11 +539,14 @@ static int FW_VALIDATION__validate_fw_he
+         goto exit;
+     }
+ 
+-    err = FW_VALIDATION__validate_fw_header(firmware_base_address, firmware_size, MAXIMUM_CORE_FIRMWARE_CODE_SIZE,
+-        &consumed_firmware_offset, &core_firmware_header, board_type);
+-    if (0 != err) {
+-        err = -EINVAL;
+-        goto exit;
++    // Not validating with HAILO10H since core firmware doesn't loaded over pcie
++    if (HAILO_BOARD_TYPE_HAILO10H != board_type) {
++        err = FW_VALIDATION__validate_fw_header(firmware_base_address, firmware_size, MAXIMUM_CORE_FIRMWARE_CODE_SIZE,
++            &consumed_firmware_offset, &core_firmware_header, board_type);
++        if (0 != err) {
++            err = -EINVAL;
++            goto exit;
++        }
+     }
+ 
+     if (consumed_firmware_offset != firmware_size) {
+@@ -437,6 +571,70 @@ exit:
+     return err;
+ }
+ 
++static int write_single_file(struct hailo_pcie_resources *resources, const struct hailo_file_batch *files_batch, struct device *dev)
++{
++    const struct firmware *firmware = NULL;
++    firmware_header_t *app_firmware_header = NULL;
++    secure_boot_certificate_t *firmware_cert = NULL;
++    firmware_header_t *core_firmware_header = NULL;
++    int err = 0;
++
++    err = request_firmware_direct(&firmware, files_batch->filename, dev);
++    if (err < 0) {
++        return err;
++    }
++
++    if (firmware->size > files_batch->max_size) {
++        release_firmware(firmware);
++        return -EFBIG;
++    }
++
++    if (files_batch->has_header) {
++        err = FW_VALIDATION__validate_fw_headers((uintptr_t)firmware->data, firmware->size,
++            &app_firmware_header, &core_firmware_header, &firmware_cert, resources->board_type);
++        if (err < 0) {
++            release_firmware(firmware);
++            return err;
++        }
++
++        hailo_write_app_firmware(resources, app_firmware_header, firmware_cert);
++    } else {
++        write_memory(resources, files_batch->address, (void*)firmware->data, firmware->size);
++    }
++
++    release_firmware(firmware);
++
++    return 0;
++}
++
++int hailo_pcie_write_firmware_batch(struct device *dev, struct hailo_pcie_resources *resources, u32 stage)
++{
++    const struct hailo_file_batch *files_batch = compat[resources->board_type].stages[stage].batch;
++    int file_index = 0;
++    int err = 0;
++
++    for (file_index = 0; file_index < MAX_FILES_PER_STAGE; file_index++)
++    {
++        if (NULL == files_batch[file_index].filename) {
++            break;
++        }
++
++        dev_notice(dev, "Writing file %s\n", files_batch[file_index].filename);
++
++        err = write_single_file(resources, &files_batch[file_index], dev);
++        if (err < 0) {
++            pr_warn("Failed to write file %s\n", files_batch[file_index].filename);
++            if (files_batch[file_index].is_mandatory) {
++                return err;
++            }
++        }
++
++        dev_notice(dev, "File %s written successfully\n", files_batch[file_index].filename);
++    }
++
++    return 0;
++}
++
+ int hailo_pcie_write_firmware(struct hailo_pcie_resources *resources, const void *fw_data, size_t fw_size)
+ {
+     firmware_header_t *app_firmware_header = NULL;
+@@ -457,10 +655,25 @@ int hailo_pcie_write_firmware(struct hai
+     return 0;
+ }
+ 
++// TODO: HRT-14147 - remove this function
++bool hailo_pcie_is_device_ready_for_boot(struct hailo_pcie_resources *resources)
++{
++    return hailo_get_boot_status(resources) == BOOT_STATUS_UNINITIALIZED;
++}
++
+ bool hailo_pcie_is_firmware_loaded(struct hailo_pcie_resources *resources)
+ {
+-    u32 offset = ATR0_PCIE_BRIDGE_OFFSET + offsetof(struct hailo_atr_config, atr_trsl_addr_1);
+-    u32 atr_value = hailo_resource_read32(&resources->config, offset);
++    u32 offset;
++    u32 atr_value;
++
++    // TODO: HRT-14147
++    if (HAILO_BOARD_TYPE_HAILO10H == resources->board_type) {
++        return !hailo_pcie_is_device_ready_for_boot(resources);
++    }
++
++    offset = ATR0_PCIE_BRIDGE_OFFSET + offsetof(struct hailo_atr_config, atr_trsl_addr_1);
++    atr_value = hailo_resource_read32(&resources->config, offset);
++
+     return atr_value == compat[resources->board_type].fw_addresses.atr0_trsl_addr1;
+ }
+ 
+@@ -516,7 +729,7 @@ void hailo_pcie_update_channel_interrupt
+     for (i = 0; i < MAX_VDMA_CHANNELS_PER_ENGINE; ++i) {
+         if (hailo_test_bit(i, &channels_bitmap)) {
+             // based on 18.5.2 "vDMA Interrupt Registers" in PLDA documentation
+-            u32 offset = (i < VDMA_DEST_CHANNELS_START) ? 0 : 8;
++            u32 offset = (i & 16) ? 8 : 0;
+             hailo_set_bit((((int)i*8) / MAX_VDMA_CHANNELS_PER_ENGINE) + offset, &mask);
+         }
+     }
+@@ -531,7 +744,8 @@ void hailo_pcie_enable_interrupts(struct
+     hailo_resource_write32(&resources->config, BCS_DESTINATION_INTERRUPT_PER_CHANNEL, 0xFFFFFFFF);
+     hailo_resource_write32(&resources->config, BCS_SOURCE_INTERRUPT_PER_CHANNEL, 0xFFFFFFFF);
+ 
+-    mask |= BCS_ISTATUS_HOST_FW_IRQ_CONTROL_MASK | BCS_ISTATUS_HOST_FW_IRQ_NOTIFICATION | BCS_ISTATUS_HOST_DRIVER_DOWN;
++    mask |= (BCS_ISTATUS_HOST_FW_IRQ_CONTROL_MASK | BCS_ISTATUS_HOST_FW_IRQ_NOTIFICATION |
++        BCS_ISTATUS_HOST_DRIVER_DOWN | BCS_ISTATUS_SOC_CONNECT_ACCEPTED);
+     hailo_resource_write32(&resources->config, BSC_IMASK_HOST, mask);
+ }
+ 
+@@ -569,16 +783,10 @@ long hailo_pcie_read_firmware_log(struct
+ static int direct_memory_transfer(struct hailo_pcie_resources *resources,
+     struct hailo_memory_transfer_params *params)
+ {
+-    int err = -EINVAL;
+-    struct hailo_atr_config previous_atr = {0};
+-
+     if (params->address > U32_MAX) {
+         return -EFAULT;
+     }
+ 
+-    // Store previous ATR (Read/write modify the ATR).
+-    read_atr_table(resources, &previous_atr);
+-
+     switch (params->transfer_direction) {
+     case TRANSFER_READ:
+         read_memory(resources, (u32)params->address, params->buffer, (u32)params->count);
+@@ -587,14 +795,10 @@ static int direct_memory_transfer(struct
+         write_memory(resources, (u32)params->address, params->buffer, (u32)params->count);
+         break;
+     default:
+-        err = -EINVAL;
+-        goto restore_atr;
++        return -EINVAL;
+     }
+ 
+-    err = 0;
+-restore_atr:
+-    write_atr_table(resources, &previous_atr);
+-    return err;
++    return 0;
+ }
+ 
+ int hailo_pcie_memory_transfer(struct hailo_pcie_resources *resources, struct hailo_memory_transfer_params *params)
+@@ -623,6 +827,24 @@ bool hailo_pcie_is_device_connected(stru
+     return PCI_VENDOR_ID_HAILO == hailo_resource_read16(&resources->config, PCIE_CONFIG_VENDOR_OFFSET);
+ }
+ 
++int hailo_set_device_type(struct hailo_pcie_resources *resources)
++{
++    switch(resources->board_type) {
++    case HAILO_BOARD_TYPE_HAILO8:
++    case HAILO_BOARD_TYPE_HAILO10H_LEGACY:
++    case HAILO_BOARD_TYPE_PLUTO:
++        resources->accelerator_type = HAILO_ACCELERATOR_TYPE_NNC;
++        break;
++    case HAILO_BOARD_TYPE_HAILO10H:
++        resources->accelerator_type = HAILO_ACCELERATOR_TYPE_SOC;
++        break;
++    default:
++        return -EINVAL;
++    }
++
++    return 0;
++}
++
+ // On PCIe, just return the address
+ static u64 encode_dma_address(dma_addr_t dma_address, u8 channel_id)
+ {
+@@ -637,5 +859,14 @@ struct hailo_vdma_hw hailo_pcie_vdma_hw
+     .ddr_data_id = HAILO_PCIE_HOST_DMA_DATA_ID,
+     .device_interrupts_bitmask = HAILO_PCIE_DMA_DEVICE_INTERRUPTS_BITMASK,
+     .host_interrupts_bitmask = HAILO_PCIE_DMA_HOST_INTERRUPTS_BITMASK,
++    .src_channels_bitmask = HAILO_PCIE_DMA_SRC_CHANNELS_BITMASK,
++};
+ 
+-};
+\ No newline at end of file
++void hailo_soc_write_soc_connect(struct hailo_pcie_resources *resources)
++{
++    const struct hailo_fw_addresses *fw_addresses = &(compat[resources->board_type].fw_addresses);
++    const u32 soc_connect_value = FW_ACCESS_SOC_CONNECT_MASK;
++
++    // Write shutdown flag to FW
++    hailo_resource_write32(&resources->fw_access, fw_addresses->raise_ready_offset, soc_connect_value);
++}
+\ No newline at end of file
+--- a/drivers/media/pci/hailo/common/pcie_common.h
++++ b/drivers/media/pci/hailo/common/pcie_common.h
+@@ -1,4 +1,4 @@
+-// SPDX-License-Identifier: GPL-2.0
++// SPDX-License-Identifier: MIT
+ /**
+  * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
+  **/
+@@ -14,11 +14,13 @@
+ #include "vdma_common.h"
+ 
+ #include <linux/types.h>
++#include <linux/firmware.h>
+ 
+ 
+ #define BCS_ISTATUS_HOST_FW_IRQ_CONTROL_MASK (0x04000000)
+ #define BCS_ISTATUS_HOST_FW_IRQ_NOTIFICATION (0x02000000)
+ #define BCS_ISTATUS_HOST_DRIVER_DOWN         (0x08000000)
++#define BCS_ISTATUS_SOC_CONNECT_ACCEPTED     (0x10000000)
+ #define BCS_ISTATUS_HOST_VDMA_SRC_IRQ_MASK   (0x000000FF)
+ #define BCS_ISTATUS_HOST_VDMA_DEST_IRQ_MASK  (0x0000FF00)
+ 
+@@ -40,17 +42,35 @@
+ #define PCI_DEVICE_ID_HAILO_HAILO15   0x45C4
+ #define PCI_DEVICE_ID_HAILO_PLUTO     0x43a2
+ 
++typedef u32 hailo_ptr_t;
++
+ struct hailo_pcie_resources {
+     struct hailo_resource config;               // BAR0
+     struct hailo_resource vdma_registers;       // BAR2
+     struct hailo_resource fw_access;            // BAR4
+     enum hailo_board_type board_type;
++    enum hailo_accelerator_type accelerator_type;
++};
++
++struct hailo_atr_config {
++    u32 atr_param;
++    u32 atr_src;
++    u32 atr_trsl_addr_1;
++    u32 atr_trsl_addr_2;
++    u32 atr_trsl_param;
++};
++
++enum loading_stages {
++    FIRST_STAGE = 0,
++    SECOND_STAGE = 1,
++    MAX_LOADING_STAGES = 2
+ };
+ 
+ enum hailo_pcie_interrupt_masks {
+     FW_CONTROL = BCS_ISTATUS_HOST_FW_IRQ_CONTROL_MASK,
+     FW_NOTIFICATION = BCS_ISTATUS_HOST_FW_IRQ_NOTIFICATION,
+     DRIVER_DOWN = BCS_ISTATUS_HOST_DRIVER_DOWN,
++    SOC_CONNECT_ACCEPTED = BCS_ISTATUS_SOC_CONNECT_ACCEPTED,
+     VDMA_SRC_IRQ_MASK = BCS_ISTATUS_HOST_VDMA_SRC_IRQ_MASK,
+     VDMA_DEST_IRQ_MASK = BCS_ISTATUS_HOST_VDMA_DEST_IRQ_MASK
+ };
+@@ -66,6 +86,14 @@ struct hailo_config_constants {
+     size_t max_size;
+ };
+ 
++struct hailo_file_batch {
++    const char *filename;
++    u32 address;
++    size_t max_size;
++    bool is_mandatory;
++    bool has_header;
++};
++
+ // TODO: HRT-6144 - Align Windows/Linux to QNX
+ #ifdef __QNX__
+ enum hailo_bar_index {
+@@ -103,6 +131,7 @@ int hailo_pcie_write_firmware_control(st
+ int hailo_pcie_read_firmware_control(struct hailo_pcie_resources *resources, struct hailo_fw_control *command);
+ 
+ int hailo_pcie_write_firmware(struct hailo_pcie_resources *resources, const void *fw_data, size_t fw_size);
++int hailo_pcie_write_firmware_batch(struct device *dev, struct hailo_pcie_resources *resources, u32 stage);
+ bool hailo_pcie_is_firmware_loaded(struct hailo_pcie_resources *resources);
+ bool hailo_pcie_wait_for_firmware(struct hailo_pcie_resources *resources);
+ 
+@@ -120,6 +149,17 @@ int hailo_pcie_memory_transfer(struct ha
+ 
+ bool hailo_pcie_is_device_connected(struct hailo_pcie_resources *resources);
+ void hailo_pcie_write_firmware_driver_shutdown(struct hailo_pcie_resources *resources);
++void write_memory(struct hailo_pcie_resources *resources, hailo_ptr_t dest, const void *src, u32 len);
++void hailo_trigger_firmware_boot(struct hailo_pcie_resources *resources);
++
++int hailo_set_device_type(struct hailo_pcie_resources *resources);
++
++u32 hailo_get_boot_status(struct hailo_pcie_resources *resources);
++
++int hailo_pcie_configure_atr_table(struct hailo_resource *bridge_config, u64 trsl_addr, u32 atr_index);
++void hailo_pcie_read_atr_table(struct hailo_resource *bridge_config, struct hailo_atr_config *atr, u32 atr_index);
++
++void hailo_soc_write_soc_connect(struct hailo_pcie_resources *resources);
+ 
+ #ifdef __cplusplus
+ }
+--- a/drivers/media/pci/hailo/common/utils.h
++++ b/drivers/media/pci/hailo/common/utils.h
+@@ -1,4 +1,4 @@
+-// SPDX-License-Identifier: GPL-2.0
++// SPDX-License-Identifier: MIT
+ /**
+  * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
+  **/
+@@ -11,6 +11,12 @@
+ #define hailo_clear_bit(bit, pval)  { *(pval) &= ~(1 << bit); }
+ #define hailo_test_bit(pos,var_addr)  ((*var_addr) & (1<<(pos)))
+ 
++#define READ_BITS_AT_OFFSET(amount_bits, offset, initial_value) \
++    (((initial_value) >> (offset)) & ((1 << (amount_bits)) - 1))
++#define WRITE_BITS_AT_OFFSET(amount_bits, offset, initial_value, value) \
++    (((initial_value) & ~(((1 << (amount_bits)) - 1) << (offset))) | \
++    (((value) & ((1 << (amount_bits)) - 1)) << (offset)))
++
+ #ifdef __cplusplus
+ extern "C"
+ {
+@@ -28,6 +34,22 @@ static inline void hailo_set_bit(int nr,
+ 	*p  |= mask;
+ }
+ 
++static inline uint8_t ceil_log2(uint32_t n)
++{
++    uint8_t result = 0;
++
++    if (n <= 1) {
++        return 0;
++    }
++
++    while (n > 1) {
++        result++;
++        n = (n + 1) >> 1;
++    }
++
++    return result;
++}
++
+ #ifndef DIV_ROUND_UP
+ #define DIV_ROUND_UP(n,d) (((n) + (d) - 1) / (d))
+ #endif
+--- a/drivers/media/pci/hailo/common/vdma_common.c
++++ b/drivers/media/pci/hailo/common/vdma_common.c
+@@ -1,4 +1,4 @@
+-// SPDX-License-Identifier: GPL-2.0
++// SPDX-License-Identifier: MIT
+ /**
+  * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
+  **/
+@@ -17,25 +17,37 @@
+ 
+ 
+ #define CHANNEL_BASE_OFFSET(channel_index) ((channel_index) << 5)
+-#define CHANNEL_HOST_OFFSET(channel_index) CHANNEL_BASE_OFFSET(channel_index) + \
+-    (channel_index < VDMA_DEST_CHANNELS_START ? 0 : 0x10)
+-#define CHANNEL_DEVICE_OFFSET(channel_index) CHANNEL_BASE_OFFSET(channel_index) + \
+-    (channel_index < VDMA_DEST_CHANNELS_START ? 0x10 : 0)
+ 
+ #define CHANNEL_CONTROL_OFFSET      (0x0)
++#define CHANNEL_DEPTH_ID_OFFSET     (0x1)
+ #define CHANNEL_NUM_AVAIL_OFFSET    (0x2)
+ #define CHANNEL_NUM_PROC_OFFSET     (0x4)
+ #define CHANNEL_ERROR_OFFSET        (0x8)
++#define CHANNEL_DEST_REGS_OFFSET    (0x10)
+ 
+ #define VDMA_CHANNEL_CONTROL_START (0x1)
+ #define VDMA_CHANNEL_CONTROL_ABORT (0b00)
+ #define VDMA_CHANNEL_CONTROL_ABORT_PAUSE (0b10)
+ #define VDMA_CHANNEL_CONTROL_START_ABORT_PAUSE_RESUME_BITMASK (0x3)
+ #define VDMA_CHANNEL_CONTROL_START_ABORT_BITMASK (0x1)
++#define VDMA_CHANNEL_CONTROL_MASK (0xFC)
++#define VDMA_CHANNEL_CONTROL_START_RESUME (0b01)
++#define VDMA_CHANNEL_CONTROL_START_PAUSE (0b11)
++#define VDMA_CHANNEL_CONTROL_ABORT (0b00)
++#define VDMA_CHANNEL_CONTROL_ABORT_PAUSE (0b10)
++#define VDMA_CHANNEL_CONTROL_START_ABORT_PAUSE_RESUME_BITMASK (0x3)
++#define VDMA_CHANNEL_DESC_DEPTH_WIDTH (4)
++#define VDMA_CHANNEL_DESC_DEPTH_SHIFT (11)
++#define VDMA_CHANNEL_DATA_ID_SHIFT (8)
++#define VDMA_CHANNEL__MAX_CHECKS_CHANNEL_IS_IDLE (10000)
++#define VDMA_CHANNEL__ADDRESS_L_OFFSET          (0x0A)
++#define VDMA_CHANNEL__ALIGNED_ADDRESS_L_OFFSET  (0x8)
++#define VDMA_CHANNEL__ADDRESS_H_OFFSET          (0x0C)
+ 
+ #define DESCRIPTOR_PAGE_SIZE_SHIFT (8)
+ #define DESCRIPTOR_DESC_CONTROL (0x2)
+ #define DESCRIPTOR_ADDR_L_MASK (0xFFFFFFC0)
++#define DESCRIPTOR_LIST_MAX_DEPTH (16)
+ 
+ #define DESCRIPTOR_DESC_STATUS_DONE_BIT  (0x0)
+ #define DESCRIPTOR_DESC_STATUS_ERROR_BIT (0x1)
+@@ -46,10 +58,14 @@
+ #define DESC_REQUEST_IRQ_PROCESSED            (1 << 2)
+ #define DESC_REQUEST_IRQ_ERR                  (1 << 3)
+ 
++#define VDMA_CHANNEL_NUM_PROCESSED_WIDTH (16)
++#define VDMA_CHANNEL_NUM_PROCESSED_MASK ((1 << VDMA_CHANNEL_NUM_PROCESSED_WIDTH) - 1)
++#define VDMA_CHANNEL_NUM_ONGOING_MASK VDMA_CHANNEL_NUM_PROCESSED_MASK
+ 
+ #define DWORD_SIZE                  (4)
+ #define WORD_SIZE                   (2)
+ #define BYTE_SIZE                   (1)
++#define BITS_IN_BYTE                (8)
+ 
+ #define TIMESTAMPS_CIRC_SPACE(timestamp_list) \
+     CIRC_SPACE((timestamp_list).head, (timestamp_list).tail, CHANNEL_IRQ_TIMESTAMPS_SIZE)
+@@ -146,18 +162,7 @@ void hailo_vdma_program_descriptor(struc
+ 
+ static u8 get_channel_id(u8 channel_index)
+ {
+-    if (channel_index < VDMA_DEST_CHANNELS_START) {
+-        // H2D channel
+-        return channel_index;
+-    }
+-    else if ((channel_index >= VDMA_DEST_CHANNELS_START) &&
+-             (channel_index < MAX_VDMA_CHANNELS_PER_ENGINE)) {
+-        // D2H channel
+-        return channel_index - VDMA_DEST_CHANNELS_START;
+-    }
+-    else {
+-        return INVALID_VDMA_CHANNEL;
+-    }
++    return (channel_index < MAX_VDMA_CHANNELS_PER_ENGINE) ? (channel_index & 0xF) : INVALID_VDMA_CHANNEL;
+ }
+ 
+ static int program_descriptors_in_chunk(
+@@ -198,12 +203,36 @@ static int program_descriptors_in_chunk(
+     return (int)desc_per_chunk;
+ }
+ 
+-int hailo_vdma_program_descriptors_list(
++static unsigned long get_interrupts_bitmask(struct hailo_vdma_hw *vdma_hw,
++    enum hailo_vdma_interrupts_domain interrupts_domain, bool is_debug)
++{
++    unsigned long bitmask = 0;
++
++    if (0 != (HAILO_VDMA_INTERRUPTS_DOMAIN_DEVICE & interrupts_domain)) {
++        bitmask |= vdma_hw->device_interrupts_bitmask;
++    }
++    if (0 != (HAILO_VDMA_INTERRUPTS_DOMAIN_HOST & interrupts_domain)) {
++        bitmask |= vdma_hw->host_interrupts_bitmask;
++    }
++
++    if (bitmask != 0) {
++        bitmask |= DESC_REQUEST_IRQ_PROCESSED | DESC_REQUEST_IRQ_ERR;
++        if (is_debug) {
++            bitmask |= DESC_STATUS_REQ | DESC_STATUS_REQ_ERR;
++        }
++    }
++
++    return bitmask;
++}
++
++static int bind_and_program_descriptors_list(
+     struct hailo_vdma_hw *vdma_hw,
+     struct hailo_vdma_descriptors_list *desc_list,
+     u32 starting_desc,
+     struct hailo_vdma_mapped_transfer_buffer *buffer,
+-    u8 channel_index)
++    u8 channel_index,
++    enum hailo_vdma_interrupts_domain last_desc_interrupts,
++    bool is_debug)
+ {
+     const u8 channel_id = get_channel_id(channel_index);
+     int desc_programmed = 0;
+@@ -260,9 +289,49 @@ int hailo_vdma_program_descriptors_list(
+         return -EFAULT;
+     }
+ 
++    desc_list->desc_list[(starting_desc - 1) % desc_list->desc_count].PageSize_DescControl |=
++        get_interrupts_bitmask(vdma_hw, last_desc_interrupts, is_debug);
++
+     return desc_programmed;
+ }
+ 
++static int program_last_desc(
++    struct hailo_vdma_hw *vdma_hw,
++    struct hailo_vdma_descriptors_list *desc_list,
++    u32 starting_desc,
++    struct hailo_vdma_mapped_transfer_buffer *transfer_buffer,
++    enum hailo_vdma_interrupts_domain last_desc_interrupts,
++    bool is_debug)
++{
++    u8 control = (u8)(DESCRIPTOR_DESC_CONTROL | get_interrupts_bitmask(vdma_hw, last_desc_interrupts, is_debug));
++    u32 total_descs = DIV_ROUND_UP(transfer_buffer->size, desc_list->desc_page_size);
++    u32 last_desc = (starting_desc + total_descs - 1) % desc_list->desc_count;
++    u32 last_desc_size = transfer_buffer->size - (total_descs - 1) * desc_list->desc_page_size;
++
++    // Configure only last descriptor with residue size
++    desc_list->desc_list[last_desc].PageSize_DescControl = (u32)
++        ((last_desc_size << DESCRIPTOR_PAGE_SIZE_SHIFT) + control);
++    return (int)total_descs;
++}
++
++int hailo_vdma_program_descriptors_list(
++    struct hailo_vdma_hw *vdma_hw,
++    struct hailo_vdma_descriptors_list *desc_list,
++    u32 starting_desc,
++    struct hailo_vdma_mapped_transfer_buffer *buffer,
++    bool should_bind,
++    u8 channel_index,
++    enum hailo_vdma_interrupts_domain last_desc_interrupts,
++    bool is_debug)
++{
++    return should_bind ?
++        bind_and_program_descriptors_list(vdma_hw, desc_list, starting_desc,
++            buffer, channel_index, last_desc_interrupts, is_debug) :
++        program_last_desc(vdma_hw, desc_list, starting_desc, buffer,
++            last_desc_interrupts, is_debug);
++}
++
++
+ static bool channel_control_reg_is_active(u8 control)
+ {
+     return (control & VDMA_CHANNEL_CONTROL_START_ABORT_BITMASK) == VDMA_CHANNEL_CONTROL_START;
+@@ -270,12 +339,12 @@ static bool channel_control_reg_is_activ
+ 
+ static int validate_channel_state(struct hailo_vdma_channel *channel)
+ {
+-    const u8 control = ioread8(channel->host_regs + CHANNEL_CONTROL_OFFSET);
+-    const u16 hw_num_avail = ioread16(channel->host_regs + CHANNEL_NUM_AVAIL_OFFSET);
++    u32 host_regs_value = ioread32(channel->host_regs);
++    const u8 control = READ_BITS_AT_OFFSET(BYTE_SIZE * BITS_IN_BYTE, CHANNEL_CONTROL_OFFSET * BITS_IN_BYTE, host_regs_value);
++    const u16 hw_num_avail = READ_BITS_AT_OFFSET(WORD_SIZE * BITS_IN_BYTE, CHANNEL_NUM_AVAIL_OFFSET * BITS_IN_BYTE, host_regs_value);
+ 
+     if (!channel_control_reg_is_active(control)) {
+-        pr_err("Channel %d is not active\n", channel->index);
+-        return -EBUSY;
++        return -ECONNRESET;
+     }
+ 
+     if (hw_num_avail != channel->state.num_avail) {
+@@ -287,51 +356,16 @@ static int validate_channel_state(struct
+     return 0;
+ }
+ 
+-static unsigned long get_interrupts_bitmask(struct hailo_vdma_hw *vdma_hw,
+-    enum hailo_vdma_interrupts_domain interrupts_domain, bool is_debug)
+-{
+-    unsigned long bitmask = 0;
+-
+-    if (0 != (HAILO_VDMA_INTERRUPTS_DOMAIN_DEVICE & interrupts_domain)) {
+-        bitmask |= vdma_hw->device_interrupts_bitmask;
+-    }
+-    if (0 != (HAILO_VDMA_INTERRUPTS_DOMAIN_HOST & interrupts_domain)) {
+-        bitmask |= vdma_hw->host_interrupts_bitmask;
+-    }
+-
+-    if (bitmask != 0) {
+-        bitmask |= DESC_REQUEST_IRQ_PROCESSED | DESC_REQUEST_IRQ_ERR;
+-        if (is_debug) {
+-            bitmask |= DESC_STATUS_REQ | DESC_STATUS_REQ_ERR;
+-        }
+-    }
+-
+-    return bitmask;
+-}
+-
+ static void set_num_avail(u8 __iomem *host_regs, u16 num_avail)
+ {
+-    iowrite16(num_avail, host_regs + CHANNEL_NUM_AVAIL_OFFSET);
++    u32 host_regs_val = ioread32(host_regs);
++    iowrite32(WRITE_BITS_AT_OFFSET(WORD_SIZE * BITS_IN_BYTE, CHANNEL_NUM_AVAIL_OFFSET * BITS_IN_BYTE, host_regs_val, num_avail),
++        host_regs);
+ }
+ 
+ static u16 get_num_proc(u8 __iomem *host_regs)
+ {
+-    return ioread16(host_regs + CHANNEL_NUM_PROC_OFFSET);
+-}
+-
+-static int program_last_desc(
+-    struct hailo_vdma_descriptors_list *desc_list,
+-    u32 starting_desc,
+-    struct hailo_vdma_mapped_transfer_buffer *transfer_buffer)
+-{
+-    u32 total_descs = DIV_ROUND_UP(transfer_buffer->size, desc_list->desc_page_size);
+-    u32 last_desc = (starting_desc + total_descs - 1) % desc_list->desc_count;
+-    u32 last_desc_size = transfer_buffer->size - (total_descs - 1) * desc_list->desc_page_size;
+-
+-    // Configure only last descriptor with residue size
+-    desc_list->desc_list[last_desc].PageSize_DescControl = (u32)
+-        ((last_desc_size << DESCRIPTOR_PAGE_SIZE_SHIFT) + DESCRIPTOR_DESC_CONTROL);
+-    return (int)total_descs;
++    return READ_BITS_AT_OFFSET(WORD_SIZE * BITS_IN_BYTE, 0, ioread32(host_regs + CHANNEL_NUM_PROC_OFFSET));
+ }
+ 
+ int hailo_vdma_launch_transfer(
+@@ -365,6 +399,11 @@ int hailo_vdma_launch_transfer(
+         return -EINVAL;
+     }
+ 
++    ret = validate_channel_state(channel);
++    if (ret < 0) {
++        return ret;
++    }
++
+     if (channel->state.num_avail != (u16)starting_desc) {
+         pr_err("Channel %d state out of sync. num available is %d, expected %d\n",
+             channel->index, channel->state.num_avail, (u16)starting_desc);
+@@ -376,25 +415,17 @@ int hailo_vdma_launch_transfer(
+         return -EINVAL;
+     }
+ 
+-    if (is_debug) {
+-        ret = validate_channel_state(channel);
+-        if (ret < 0) {
+-            return ret;
+-        }
+-    }
+-
+     BUILD_BUG_ON_MSG((HAILO_MAX_BUFFERS_PER_SINGLE_TRANSFER + 1) != ARRAY_SIZE(ongoing_transfer.dirty_descs),
+         "Unexpected amount of dirty descriptors");
+     ongoing_transfer.dirty_descs_count = buffers_count + 1;
+     ongoing_transfer.dirty_descs[0] = (u16)starting_desc;
+ 
+     for (i = 0; i < buffers_count; i++) {
+-        ret = should_bind ?
+-            hailo_vdma_program_descriptors_list(vdma_hw, desc_list, starting_desc, &buffers[i], channel->index) :
+-            program_last_desc(desc_list, starting_desc, &buffers[i]);
+-        if (ret < 0) {
+-            return ret;
+-        }
++        ret = hailo_vdma_program_descriptors_list(vdma_hw, desc_list,
++            starting_desc, &buffers[i], should_bind, channel->index,
++            (i == (buffers_count - 1) ? last_desc_interrupts : HAILO_VDMA_INTERRUPTS_DOMAIN_NONE),
++            is_debug);
++
+         total_descs += ret;
+         last_desc = (starting_desc + ret - 1) % desc_list->desc_count;
+         starting_desc = (starting_desc + ret) % desc_list->desc_count;
+@@ -406,8 +437,6 @@ int hailo_vdma_launch_transfer(
+ 
+     desc_list->desc_list[first_desc].PageSize_DescControl |=
+         get_interrupts_bitmask(vdma_hw, first_interrupts_domain, is_debug);
+-    desc_list->desc_list[last_desc].PageSize_DescControl |=
+-        get_interrupts_bitmask(vdma_hw, last_desc_interrupts, is_debug);
+ 
+     ongoing_transfer.last_desc = (u16)last_desc;
+     ongoing_transfer.is_debug = is_debug;
+@@ -477,8 +506,21 @@ static void channel_state_init(struct ha
+     state->desc_count_mask = U32_MAX;
+ }
+ 
++static u8 __iomem *get_channel_regs(u8 __iomem *regs_base, u8 channel_index, bool is_host_side, u32 src_channels_bitmask)
++{
++    // Check if getting host side regs or device side
++    u8 __iomem *channel_regs_base = regs_base + CHANNEL_BASE_OFFSET(channel_index);
++    if (is_host_side) {
++        return hailo_test_bit(channel_index, &src_channels_bitmask) ? channel_regs_base :
++            (channel_regs_base + CHANNEL_DEST_REGS_OFFSET);
++    } else {
++        return hailo_test_bit(channel_index, &src_channels_bitmask) ? (channel_regs_base + CHANNEL_DEST_REGS_OFFSET) :
++            channel_regs_base;
++    }
++}
++
+ void hailo_vdma_engine_init(struct hailo_vdma_engine *engine, u8 engine_index,
+-    const struct hailo_resource *channel_registers)
++    const struct hailo_resource *channel_registers, u32 src_channels_bitmask)
+ {
+     u8 channel_index = 0;
+     struct hailo_vdma_channel *channel;
+@@ -489,8 +531,8 @@ void hailo_vdma_engine_init(struct hailo
+ 
+     for_each_vdma_channel(engine, channel, channel_index) {
+         u8 __iomem *regs_base = (u8 __iomem *)channel_registers->address;
+-        channel->host_regs = regs_base + CHANNEL_HOST_OFFSET(channel_index);
+-        channel->device_regs = regs_base + CHANNEL_DEVICE_OFFSET(channel_index);
++        channel->host_regs = get_channel_regs(regs_base, channel_index, true, src_channels_bitmask);
++        channel->device_regs = get_channel_regs(regs_base, channel_index, false, src_channels_bitmask);
+         channel->index = channel_index;
+         channel->timestamp_measure_enabled = false;
+ 
+@@ -502,7 +544,15 @@ void hailo_vdma_engine_init(struct hailo
+     }
+ }
+ 
+-void hailo_vdma_engine_enable_channel_interrupts(struct hailo_vdma_engine *engine, u32 bitmap,
++/**
++ * Enables the given channels bitmap in the given engine. Allows launching transfer
++ * and reading interrupts from the channels.
++ *
++ * @param engine - dma engine.
++ * @param bitmap - channels bitmap to enable.
++ * @param measure_timestamp - if set, allow interrupts timestamp measure.
++ */
++void hailo_vdma_engine_enable_channels(struct hailo_vdma_engine *engine, u32 bitmap,
+     bool measure_timestamp)
+ {
+     struct hailo_vdma_channel *channel = NULL;
+@@ -518,7 +568,14 @@ void hailo_vdma_engine_enable_channel_in
+     engine->enabled_channels |= bitmap;
+ }
+ 
+-void hailo_vdma_engine_disable_channel_interrupts(struct hailo_vdma_engine *engine, u32 bitmap)
++/**
++ * Disables the given channels bitmap in the given engine.
++ *
++ * @param engine - dma engine.
++ * @param bitmap - channels bitmap to enable.
++ * @param measure_timestamp - if set, allow interrupts timestamp measure.
++ */
++void hailo_vdma_engine_disable_channels(struct hailo_vdma_engine *engine, u32 bitmap)
+ {
+     struct hailo_vdma_channel *channel = NULL;
+     u8 channel_index = 0;
+@@ -582,11 +639,11 @@ void hailo_vdma_engine_set_channel_inter
+ }
+ 
+ static void fill_channel_irq_data(struct hailo_vdma_interrupts_channel_data *irq_data,
+-    struct hailo_vdma_engine *engine, struct hailo_vdma_channel *channel, u16 num_proc,
++    struct hailo_vdma_engine *engine, struct hailo_vdma_channel *channel, u8 transfers_completed,
+     bool validation_success)
+ {
+-    u8 host_control = ioread8(channel->host_regs + CHANNEL_CONTROL_OFFSET);
+-    u8 device_control = ioread8(channel->device_regs + CHANNEL_CONTROL_OFFSET);
++    u8 host_control = READ_BITS_AT_OFFSET(BYTE_SIZE * BITS_IN_BYTE, CHANNEL_CONTROL_OFFSET * BITS_IN_BYTE, ioread32(channel->host_regs));
++    u8 device_control = READ_BITS_AT_OFFSET(BYTE_SIZE * BITS_IN_BYTE, CHANNEL_CONTROL_OFFSET * BITS_IN_BYTE, ioread32(channel->device_regs));
+ 
+     irq_data->engine_index = engine->index;
+     irq_data->channel_index = channel->index;
+@@ -594,9 +651,9 @@ static void fill_channel_irq_data(struct
+     irq_data->is_active = channel_control_reg_is_active(host_control) &&
+         channel_control_reg_is_active(device_control);
+ 
+-    irq_data->host_num_processed = num_proc;
+-    irq_data->host_error = ioread8(channel->host_regs + CHANNEL_ERROR_OFFSET);
+-    irq_data->device_error = ioread8(channel->device_regs + CHANNEL_ERROR_OFFSET);
++    irq_data->transfers_completed = transfers_completed;
++    irq_data->host_error = READ_BITS_AT_OFFSET(BYTE_SIZE * BITS_IN_BYTE, 0, ioread32(channel->host_regs + CHANNEL_ERROR_OFFSET));
++    irq_data->device_error = READ_BITS_AT_OFFSET(BYTE_SIZE * BITS_IN_BYTE, 0, ioread32(channel->device_regs + CHANNEL_ERROR_OFFSET));
+     irq_data->validation_success = validation_success;
+ }
+ 
+@@ -635,7 +692,12 @@ int hailo_vdma_engine_fill_irq_data(stru
+     bool validation_success = true;
+ 
+     for_each_vdma_channel(engine, channel, channel_index) {
++        u8 transfers_completed = 0;
+         u16 hw_num_proc = U16_MAX;
++
++        BUILD_BUG_ON_MSG(HAILO_VDMA_MAX_ONGOING_TRANSFERS >= U8_MAX,
++            "HAILO_VDMA_MAX_ONGOING_TRANSFERS must be less than U8_MAX to use transfers_completed as u8");
++
+         if (!hailo_test_bit(channel->index, &irq_channels_bitmap)) {
+             continue;
+         }
+@@ -673,12 +735,143 @@ int hailo_vdma_engine_fill_irq_data(stru
+             channel->state.num_proc = (u16)((cur_transfer->last_desc + 1) & channel->state.desc_count_mask);
+ 
+             ongoing_transfer_pop(channel, NULL);
++            transfers_completed++;
+         }
+ 
+         fill_channel_irq_data(&irq_data->irq_data[irq_data->channels_count],
+-            engine, channel, hw_num_proc, validation_success);
++            engine, channel, transfers_completed, validation_success);
+         irq_data->channels_count++;
+     }
+ 
+     return 0;
++}
++
++// For all these functions - best way to optimize might be to not call the function when need to pause and then abort,
++// Rather read value once and maybe save 
++// This function reads and writes the register - should try to make more optimized in future
++static void start_vdma_control_register(u8 __iomem *host_regs)
++{
++    u32 host_regs_value = ioread32(host_regs);
++    iowrite32(WRITE_BITS_AT_OFFSET(BYTE_SIZE * BITS_IN_BYTE, CHANNEL_CONTROL_OFFSET * BITS_IN_BYTE, host_regs_value,
++        VDMA_CHANNEL_CONTROL_START_RESUME), host_regs);
++}
++
++static void hailo_vdma_channel_pause(u8 __iomem *host_regs)
++{
++    u32 host_regs_value = ioread32(host_regs);
++    iowrite32(WRITE_BITS_AT_OFFSET(BYTE_SIZE * BITS_IN_BYTE, CHANNEL_CONTROL_OFFSET * BITS_IN_BYTE, host_regs_value,
++        VDMA_CHANNEL_CONTROL_START_PAUSE), host_regs);
++}
++
++// This function reads and writes the register - should try to make more optimized in future
++static void hailo_vdma_channel_abort(u8 __iomem *host_regs)
++{
++    u32 host_regs_value = ioread32(host_regs);
++    iowrite32(WRITE_BITS_AT_OFFSET(BYTE_SIZE * BITS_IN_BYTE, CHANNEL_CONTROL_OFFSET * BITS_IN_BYTE, host_regs_value,
++        VDMA_CHANNEL_CONTROL_ABORT), host_regs);
++}
++
++int hailo_vdma_start_channel(u8 __iomem *host_regs, uint64_t desc_dma_address, uint8_t desc_depth,
++    uint8_t data_id)
++{
++    u16 dma_address_l = 0;
++    u32 dma_address_h = 0;
++    u32 desc_depth_data_id = 0;
++
++    if (((desc_dma_address & 0xFFFF) != 0) || 
++         (desc_depth > DESCRIPTOR_LIST_MAX_DEPTH)) {
++        return -EINVAL;
++    }
++
++    // According to spec, depth 16 is equivalent to depth 0.
++    if (DESCRIPTOR_LIST_MAX_DEPTH == desc_depth) {
++        desc_depth = 0;
++    }
++
++    // Stop old channel state
++    hailo_vdma_stop_channel(host_regs);
++
++    // Configure address, depth and id
++    dma_address_l = (uint16_t)((desc_dma_address >> 16) & 0xFFFF);
++    iowrite32(WRITE_BITS_AT_OFFSET(WORD_SIZE * BITS_IN_BYTE, (VDMA_CHANNEL__ADDRESS_L_OFFSET -
++        VDMA_CHANNEL__ALIGNED_ADDRESS_L_OFFSET) * BITS_IN_BYTE, ioread32(host_regs +
++        VDMA_CHANNEL__ALIGNED_ADDRESS_L_OFFSET), dma_address_l), host_regs + VDMA_CHANNEL__ALIGNED_ADDRESS_L_OFFSET);
++
++    dma_address_h = (uint32_t)(desc_dma_address >> 32);
++    iowrite32(dma_address_h, host_regs + VDMA_CHANNEL__ADDRESS_H_OFFSET);
++
++    desc_depth_data_id = (uint32_t)(desc_depth << VDMA_CHANNEL_DESC_DEPTH_SHIFT) | 
++        (data_id << VDMA_CHANNEL_DATA_ID_SHIFT);
++    iowrite32(desc_depth_data_id, host_regs);
++
++    start_vdma_control_register(host_regs);
++
++    return 0;
++}
++
++static bool hailo_vdma_channel_is_idle(u8 __iomem *host_regs, size_t host_side_max_desc_count)
++{
++    // Num processed and ongoing are next to each other in the memory. 
++    // Reading them both in order to save BAR reads.
++    u32 host_side_num_processed_ongoing = ioread32(host_regs + CHANNEL_NUM_PROC_OFFSET);
++    u16 host_side_num_processed = (host_side_num_processed_ongoing & VDMA_CHANNEL_NUM_PROCESSED_MASK);
++    u16 host_side_num_ongoing = (host_side_num_processed_ongoing >> VDMA_CHANNEL_NUM_PROCESSED_WIDTH) &
++        VDMA_CHANNEL_NUM_ONGOING_MASK;
++
++    if ((host_side_num_processed % host_side_max_desc_count) == (host_side_num_ongoing % host_side_max_desc_count)) {
++        return true;
++    }
++
++    return false;
++}
++
++static int hailo_vdma_wait_until_channel_idle(u8 __iomem *host_regs)
++{
++    bool is_idle = false;
++    uint32_t check_counter = 0;
++
++    u8 depth = (uint8_t)(READ_BITS_AT_OFFSET(VDMA_CHANNEL_DESC_DEPTH_WIDTH, VDMA_CHANNEL_DESC_DEPTH_SHIFT,
++        ioread32(host_regs)));
++    size_t host_side_max_desc_count = (size_t)(1 << depth);
++
++    for (check_counter = 0; check_counter < VDMA_CHANNEL__MAX_CHECKS_CHANNEL_IS_IDLE; check_counter++) {
++        is_idle = hailo_vdma_channel_is_idle(host_regs, host_side_max_desc_count);
++        if (is_idle) {
++            return 0;
++        }
++    }
++
++    return -ETIMEDOUT;
++}
++
++void hailo_vdma_stop_channel(u8 __iomem *host_regs)
++{
++    int err = 0;
++    u8 host_side_channel_regs = READ_BITS_AT_OFFSET(BYTE_SIZE * BITS_IN_BYTE, CHANNEL_CONTROL_OFFSET * BITS_IN_BYTE, ioread32(host_regs));
++
++    if ((host_side_channel_regs & VDMA_CHANNEL_CONTROL_START_ABORT_PAUSE_RESUME_BITMASK) == VDMA_CHANNEL_CONTROL_ABORT_PAUSE) {
++        // The channel is aborted (we set the channel to VDMA_CHANNEL_CONTROL_ABORT_PAUSE at the end of this function)
++        return;
++    }
++
++    // Pause the channel
++    // The channel is paused to allow for "all transfers from fetched descriptors..." to be "...completed"
++    // (from PLDA PCIe refernce manual, "9.2.5 Starting a Channel and Transferring Data")
++    hailo_vdma_channel_pause(host_regs);
++
++    // Even if channel is stuck and not idle, force abort and return error in the end
++    err = hailo_vdma_wait_until_channel_idle(host_regs);
++    // Success oriented - if error occured print error but still abort channel
++    if (err < 0) {
++        pr_err("Timeout occured while waiting for channel to become idle\n");
++    }
++
++    // Abort the channel (even of hailo_vdma_wait_until_channel_idle function fails)
++    hailo_vdma_channel_abort(host_regs);
++}
++
++bool hailo_check_channel_index(u8 channel_index, u32 src_channels_bitmask, bool is_input_channel)
++{
++    return is_input_channel ? hailo_test_bit(channel_index, &src_channels_bitmask) :
++        (!hailo_test_bit(channel_index, &src_channels_bitmask));
+ }
+\ No newline at end of file
+--- a/drivers/media/pci/hailo/common/vdma_common.h
++++ b/drivers/media/pci/hailo/common/vdma_common.h
+@@ -1,4 +1,4 @@
+-// SPDX-License-Identifier: GPL-2.0
++// SPDX-License-Identifier: MIT
+ /**
+  * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
+  **/
+@@ -30,8 +30,8 @@ struct hailo_vdma_descriptor {
+ 
+ struct hailo_vdma_descriptors_list {
+     struct hailo_vdma_descriptor *desc_list;
+-    u32                      desc_count;  // Must be power of 2 if is_circular is set.
+-    u16                      desc_page_size;
++    u32                           desc_count;  // Must be power of 2 if is_circular is set.
++    u16                           desc_page_size;
+     bool                          is_circular;
+ };
+ 
+@@ -127,6 +127,9 @@ struct hailo_vdma_hw {
+     // Bitmask needed to set on each descriptor to enable interrupts (either host/device).
+     unsigned long host_interrupts_bitmask;
+     unsigned long device_interrupts_bitmask;
++
++    // Bitmask for each vdma hw, which channels are src side by index (on pcie/dram - 0x0000FFFF, pci ep - 0xFFFF0000)
++    u32 src_channels_bitmask;
+ };
+ 
+ #define _for_each_element_array(array, size, element, index) \
+@@ -147,7 +150,11 @@ void hailo_vdma_program_descriptor(struc
+  * @param starting_desc index of the first descriptor to program. If the list
+  *                      is circular, this function may wrap around the list.
+  * @param buffer buffer to program to the descriptors list.
++ * @param should_bind If false, assumes the buffer was already bound to the
++ *                    desc list. Used for optimization.
+  * @param channel_index channel index of the channel attached.
++ * @param last_desc_interrupts - interrupts settings on last descriptor.
++ * @param is_debug program descriptors for debug run.
+  *
+  * @return On success - the amount of descriptors programmed, negative value on error.
+  */
+@@ -156,7 +163,10 @@ int hailo_vdma_program_descriptors_list(
+     struct hailo_vdma_descriptors_list *desc_list,
+     u32 starting_desc,
+     struct hailo_vdma_mapped_transfer_buffer *buffer,
+-    u8 channel_index);
++    bool should_bind,
++    u8 channel_index,
++    enum hailo_vdma_interrupts_domain last_desc_interrupts,
++    bool is_debug);
+ 
+ /**
+  * Launch a transfer on some vdma channel. Includes:
+@@ -191,14 +201,12 @@ int hailo_vdma_launch_transfer(
+     bool is_debug);
+ 
+ void hailo_vdma_engine_init(struct hailo_vdma_engine *engine, u8 engine_index,
+-    const struct hailo_resource *channel_registers);
++    const struct hailo_resource *channel_registers, u32 src_channels_bitmask);
+ 
+-// enable/disable channels interrupt (does not update interrupts mask because the
+-// implementation is different between PCIe and DRAM DMA. To support it we
+-// can add some ops struct to the engine).
+-void hailo_vdma_engine_enable_channel_interrupts(struct hailo_vdma_engine *engine, u32 bitmap,
++void hailo_vdma_engine_enable_channels(struct hailo_vdma_engine *engine, u32 bitmap,
+     bool measure_timestamp);
+-void hailo_vdma_engine_disable_channel_interrupts(struct hailo_vdma_engine *engine, u32 bitmap);
++
++void hailo_vdma_engine_disable_channels(struct hailo_vdma_engine *engine, u32 bitmap);
+ 
+ void hailo_vdma_engine_push_timestamps(struct hailo_vdma_engine *engine, u32 bitmap);
+ int hailo_vdma_engine_read_timestamps(struct hailo_vdma_engine *engine,
+@@ -237,6 +245,12 @@ int hailo_vdma_engine_fill_irq_data(stru
+     struct hailo_vdma_engine *engine, u32 irq_channels_bitmap,
+     transfer_done_cb_t transfer_done, void *transfer_done_opaque);
+ 
++int hailo_vdma_start_channel(u8 __iomem *host_regs, uint64_t desc_dma_address, uint8_t desc_depth, uint8_t data_id);
++
++void hailo_vdma_stop_channel(u8 __iomem *host_regs);
++
++bool hailo_check_channel_index(u8 channel_index, u32 src_channels_bitmask, bool is_input_channel);
++
+ #ifdef __cplusplus
+ }
+ #endif
+--- a/drivers/media/pci/hailo/src/fops.c
++++ b/drivers/media/pci/hailo/src/fops.c
+@@ -19,7 +19,6 @@
+ #include <linux/sched/signal.h>
+ #endif
+ 
+-#include "hailo_pcie_version.h"
+ #include "utils.h"
+ #include "fops.h"
+ #include "vdma_common.h"
+@@ -27,6 +26,7 @@
+ #include "vdma/memory.h"
+ #include "vdma/ioctl.h"
+ #include "utils/compact.h"
++#include "pci_soc_ioctl.h"
+ 
+ 
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION( 4, 13, 0 )
+@@ -210,69 +210,66 @@ l_exit:
+ 
+ int hailo_pcie_fops_release(struct inode *inode, struct file *filp)
+ {
+-    struct hailo_pcie_board *pBoard = (struct hailo_pcie_board *)filp->private_data;
++    struct hailo_pcie_board *board = (struct hailo_pcie_board *)filp->private_data;
+     struct hailo_file_context *context = NULL;
+ 
+     u32 major = MAJOR(inode->i_rdev);
+     u32 minor = MINOR(inode->i_rdev);
+ 
+-    if (pBoard) {
+-        hailo_info(pBoard, "(%d: %d-%d): fops_release\n", current->tgid, major, minor);
++    if (board) {
++        hailo_info(board, "(%d: %d-%d): fops_release\n", current->tgid, major, minor);
+ 
+-        if (down_interruptible(&pBoard->mutex)) {
+-            hailo_err(pBoard, "fops_release down_interruptible failed");
+-            return -ERESTARTSYS;
+-        }
+ 
+-        context = find_file_context(pBoard, filp);
++        down(&board->mutex);
++
++        context = find_file_context(board, filp);
+         if (NULL == context) {
+-            hailo_err(pBoard, "Invalid driver state, file context does not exist\n");
+-            up(&pBoard->mutex);
++            hailo_err(board, "Invalid driver state, file context does not exist\n");
++            up(&board->mutex);
+             return -EINVAL;
+         }
+ 
+         if (false == context->is_valid) {
+             // File context is invalid, but open. It's OK to continue finalize and release it.
+-            hailo_err(pBoard, "Invalid file context\n");
++            hailo_err(board, "Invalid file context\n");
+         }
+ 
+-        hailo_pcie_clear_notification_wait_list(pBoard, filp);
++        hailo_pcie_clear_notification_wait_list(board, filp);
+ 
+-        if (filp == pBoard->vdma.used_by_filp) {
+-            if (hailo_pcie_driver_down(pBoard)) {
+-                hailo_err(pBoard, "Failed sending FW shutdown event");
++        if (filp == board->vdma.used_by_filp) {
++            if (hailo_pcie_driver_down(board)) {
++                hailo_err(board, "Failed sending FW shutdown event");
+             }
+         }
+ 
+-        hailo_vdma_file_context_finalize(&context->vdma_context, &pBoard->vdma, filp);
++        hailo_vdma_file_context_finalize(&context->vdma_context, &board->vdma, filp);
+         release_file_context(context);
+ 
+-        if (atomic_dec_and_test(&pBoard->ref_count)) {
++        if (atomic_dec_and_test(&board->ref_count)) {
+             // Disable interrupts
+-            hailo_disable_interrupts(pBoard);
++            hailo_disable_interrupts(board);
+ 
+             if (power_mode_enabled()) {
+-                if (pBoard->pDev && pci_set_power_state(pBoard->pDev, PCI_D3hot) < 0) {
+-                    hailo_err(pBoard, "Failed setting power state to D3hot");
++                if (board->pDev && pci_set_power_state(board->pDev, PCI_D3hot) < 0) {
++                    hailo_err(board, "Failed setting power state to D3hot");
+                 }
+             }
+ 
+             // deallocate board if already removed
+-            if (!pBoard->pDev) {
+-                hailo_dbg(pBoard, "fops_close, freed board\n");
+-                up(&pBoard->mutex);
+-                kfree(pBoard);
+-                pBoard = NULL;
++            if (!board->pDev) {
++                hailo_dbg(board, "fops_release, freed board\n");
++                up(&board->mutex);
++                kfree(board);
++                board = NULL;
+             } else {
+-
+-                hailo_dbg(pBoard, "fops_close, released resources for board\n");
+-                up(&pBoard->mutex);
++                hailo_dbg(board, "fops_release, released resources for board\n");
++                up(&board->mutex);
+             }
+         } else {
+-            up(&pBoard->mutex);
++            up(&board->mutex);
+         }
+ 
+-        hailo_dbg(pBoard, "(%d: %d-%d): fops_close: SUCCESS on /dev/hailo%d\n", current->tgid,
++        hailo_dbg(board, "(%d: %d-%d): fops_release: SUCCESS on /dev/hailo%d\n", current->tgid,
+             major, minor, minor);
+     }
+ 
+@@ -394,6 +391,10 @@ irqreturn_t hailo_irqhandler(int irq, vo
+             }
+         }
+ 
++        if (irq_source.interrupt_bitmask & SOC_CONNECT_ACCEPTED) {
++            complete_all(&board->soc_connect_accepted);
++        }
++
+         if (0 != irq_source.vdma_channels_bitmap) {
+             hailo_vdma_irq_handler(&board->vdma, DEFAULT_VDMA_ENGINE_INDEX,
+                 irq_source.vdma_channels_bitmap);
+@@ -602,26 +603,35 @@ static long hailo_query_driver_info(stru
+     return 0;
+ }
+ 
+-static long hailo_general_ioctl(struct hailo_file_context *context, struct hailo_pcie_board *board,
+-    unsigned int cmd, unsigned long arg, struct file *filp, bool *should_up_board_mutex)
++static long hailo_general_ioctl(struct hailo_pcie_board *board, unsigned int cmd, unsigned long arg)
+ {
+     switch (cmd) {
+     case HAILO_MEMORY_TRANSFER:
+         return hailo_memory_transfer_ioctl(board, arg);
++    case HAILO_QUERY_DEVICE_PROPERTIES:
++        return hailo_query_device_properties(board, arg);
++    case HAILO_QUERY_DRIVER_INFO:
++        return hailo_query_driver_info(board, arg);
++    default:
++        hailo_err(board, "Invalid general ioctl code 0x%x (nr: %d)\n", cmd, _IOC_NR(cmd));
++        return -ENOTTY;
++    }
++}
++
++static long hailo_nnc_ioctl(struct hailo_pcie_board *board, unsigned int cmd, unsigned long arg,
++    struct file *filp, bool *should_up_board_mutex)
++{
++    switch (cmd) {
+     case HAILO_FW_CONTROL:
+         return hailo_fw_control(board, arg, should_up_board_mutex);
+     case HAILO_READ_NOTIFICATION:
+         return hailo_read_notification_ioctl(board, arg, filp, should_up_board_mutex);
+     case HAILO_DISABLE_NOTIFICATION:
+         return hailo_disable_notification(board, filp);
+-    case HAILO_QUERY_DEVICE_PROPERTIES:
+-        return hailo_query_device_properties(board, arg);
+-    case HAILO_QUERY_DRIVER_INFO:
+-        return hailo_query_driver_info(board, arg);
+     case HAILO_READ_LOG:
+         return hailo_read_log_ioctl(board, arg);
+     default:
+-        hailo_err(board, "Invalid general ioctl code 0x%x (nr: %d)\n", cmd, _IOC_NR(cmd));
++        hailo_err(board, "Invalid nnc ioctl code 0x%x (nr: %d)\n", cmd, _IOC_NR(cmd));
+         return -ENOTTY;
+     }
+ }
+@@ -673,12 +683,28 @@ long hailo_pcie_fops_unlockedioctl(struc
+ 
+     switch (_IOC_TYPE(cmd)) {
+     case HAILO_GENERAL_IOCTL_MAGIC:
+-        err = hailo_general_ioctl(context, board, cmd, arg, filp, &should_up_board_mutex);
++        err = hailo_general_ioctl(board, cmd, arg);
+         break;
+     case HAILO_VDMA_IOCTL_MAGIC:
+         err = hailo_vdma_ioctl(&context->vdma_context, &board->vdma, cmd, arg, filp, &board->mutex,
+             &should_up_board_mutex);
+         break;
++    case HAILO_SOC_IOCTL_MAGIC:
++        if (HAILO_ACCELERATOR_TYPE_SOC != board->pcie_resources.accelerator_type) {
++            hailo_err(board, "Ioctl %d is not supported on this accelerator type\n", _IOC_TYPE(cmd));
++            err = -EINVAL;
++        } else {
++            err = hailo_soc_ioctl(board, &context->vdma_context, &board->vdma, cmd, arg);
++        }
++        break;
++    case HAILO_NNC_IOCTL_MAGIC:
++        if (HAILO_ACCELERATOR_TYPE_NNC != board->pcie_resources.accelerator_type) {
++            hailo_err(board, "Ioctl %d is not supported on this accelerator type\n", _IOC_TYPE(cmd));
++            err = -EINVAL;
++        } else {
++            err = hailo_nnc_ioctl(board, cmd, arg, filp, &should_up_board_mutex);
++        }
++        break;
+     default:
+         hailo_err(board, "Invalid ioctl type %d\n", _IOC_TYPE(cmd));
+         err = -ENOTTY;
+--- a/drivers/media/pci/hailo/src/fops.h
++++ b/drivers/media/pci/hailo/src/fops.h
+@@ -11,6 +11,7 @@ int hailo_pcie_fops_release(struct inode
+ long hailo_pcie_fops_unlockedioctl(struct file* filp, unsigned int cmd, unsigned long arg);
+ int hailo_pcie_fops_mmap(struct file* filp, struct vm_area_struct *vma);
+ int hailo_pcie_driver_down(struct hailo_pcie_board *board);
++void hailo_pcie_ep_init(struct hailo_pcie_board *board);
+ 
+ #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,22)
+ irqreturn_t hailo_irqhandler(int irq, void* dev_id, struct pt_regs *regs);
+--- /dev/null
++++ b/drivers/media/pci/hailo/src/pci_soc_ioctl.c
+@@ -0,0 +1,155 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
++ **/
++#include "pci_soc_ioctl.h"
++
++#include "utils.h"
++#include "vdma_common.h"
++#include "utils/logs.h"
++#include "vdma/memory.h"
++
++#define PCI_SOC_VDMA_ENGINE_INDEX           (0)
++#define PCI_SOC_WAIT_FOR_CONNECT_TIMEOUT_MS (10000)
++
++long hailo_soc_ioctl(struct hailo_pcie_board *board, struct hailo_vdma_file_context *context,
++    struct hailo_vdma_controller *controller, unsigned int cmd, unsigned long arg)
++{
++    switch (cmd) {
++    case HAILO_SOC_CONNECT:
++        return hailo_soc_connect_ioctl(board, context, controller, arg);
++    case HAILO_SOC_CLOSE:
++        return hailo_soc_close_ioctl(board, controller, arg);
++    default:
++        hailo_err(board, "Invalid pcie EP ioctl code 0x%x (nr: %d)\n", cmd, _IOC_NR(cmd));
++        return -ENOTTY;
++    }
++}
++
++long hailo_soc_connect_ioctl(struct hailo_pcie_board *board, struct hailo_vdma_file_context *context,
++    struct hailo_vdma_controller *controller, unsigned long arg)
++{
++    struct hailo_soc_connect_params params;
++    struct hailo_vdma_channel *input_channel = NULL;
++    struct hailo_vdma_channel *output_channel = NULL;
++    struct hailo_vdma_engine *vdma_engine = NULL;
++    struct hailo_descriptors_list_buffer *input_descriptors_buffer = NULL;
++    struct hailo_descriptors_list_buffer *output_descriptors_buffer = NULL;
++    uint8_t depth = 0;
++    int err = 0;
++    long completion_result = 0;
++
++    if (copy_from_user(&params, (void *)arg, sizeof(params))) {
++        hailo_err(board, "copy_from_user fail\n");
++        return -ENOMEM;
++    }
++
++    // TODO: have pci_ep choose the channel indexes the soc will use - for now use 0 and 16
++    params.input_channel_index = 0;
++    params.output_channel_index = 16;
++
++    reinit_completion(&board->soc_connect_accepted);
++    hailo_soc_write_soc_connect(&board->pcie_resources);
++
++    // Wait for completion
++    completion_result = wait_for_completion_interruptible_timeout(&board->soc_connect_accepted,
++        msecs_to_jiffies(PCI_SOC_WAIT_FOR_CONNECT_TIMEOUT_MS));
++    if (0 > completion_result) {
++        if (0 == completion_result) {
++            hailo_err(board, "Timeout waiting for connect to be accepted (timeout_ms=%d)\n", PCI_SOC_WAIT_FOR_CONNECT_TIMEOUT_MS);
++            return -ETIMEDOUT;
++        } else {
++            hailo_info(board, "soc connect failed with err=%ld (process was interrupted or killed)\n",
++                completion_result);
++            return -EINTR;
++        }
++    }
++
++    vdma_engine = &controller->vdma_engines[PCI_SOC_VDMA_ENGINE_INDEX];
++    input_channel = &vdma_engine->channels[params.input_channel_index];
++    output_channel = &vdma_engine->channels[params.output_channel_index];
++
++    input_descriptors_buffer = hailo_vdma_find_descriptors_buffer(context, params.input_desc_handle);
++    output_descriptors_buffer = hailo_vdma_find_descriptors_buffer(context, params.output_desc_handle);
++    if (NULL == input_descriptors_buffer || NULL == output_descriptors_buffer) {
++        hailo_dev_err(&board->pDev->dev, "input / output descriptors buffer not found \n");
++        return -EINVAL;
++    }
++
++    // Make sure channels that we are accepting are not already enabled
++    if (0 != (vdma_engine->enabled_channels & params.input_channel_index) ||
++        0 != (vdma_engine->enabled_channels & params.output_channel_index)) {
++        hailo_dev_err(&board->pDev->dev, "Trying to accept already enabled channels\n");
++        return -EINVAL;
++    }
++
++    if (!is_powerof2((size_t)input_descriptors_buffer->desc_list.desc_count) ||
++        !is_powerof2((size_t)output_descriptors_buffer->desc_list.desc_count)) {
++        hailo_dev_err(&board->pDev->dev, "Invalid desc list size\n");
++        return -EINVAL;
++    }
++
++    // configure and start input channel
++    depth = ceil_log2(input_descriptors_buffer->desc_list.desc_count);
++    // DMA Direction is only to get channel index - so 
++    err = hailo_vdma_start_channel(input_channel->host_regs, input_descriptors_buffer->dma_address, depth,
++        board->vdma.hw->ddr_data_id);
++    if (err < 0) {
++        hailo_dev_err(&board->pDev->dev, "Error starting vdma input channel index %u\n", params.input_channel_index);
++        return -EINVAL;
++    }
++    
++    // configure and start output channel
++    depth = ceil_log2(output_descriptors_buffer->desc_list.desc_count);
++    // DMA Direction is only to get channel index - so 
++    err = hailo_vdma_start_channel(output_channel->host_regs, output_descriptors_buffer->dma_address, depth,
++        board->vdma.hw->ddr_data_id);
++    if (err < 0) {
++        hailo_dev_err(&board->pDev->dev, "Error starting vdma output channel index %u\n", params.output_channel_index);
++        // Close input channel
++        hailo_vdma_stop_channel(input_channel->host_regs);
++        return -EINVAL;
++    }
++
++    if (copy_to_user((void *)arg, &params, sizeof(params))) {
++        hailo_dev_err(&board->pDev->dev, "copy_to_user fail\n");
++        return -ENOMEM;
++    }
++
++    return 0;
++}
++
++long hailo_soc_close_ioctl(struct hailo_pcie_board *board, struct hailo_vdma_controller *controller, unsigned long arg)
++{
++    struct hailo_soc_close_params params;
++    struct hailo_vdma_channel *input_channel = NULL;
++    struct hailo_vdma_channel *output_channel = NULL;
++    struct hailo_vdma_engine *vdma_engine = NULL;
++
++    if (copy_from_user(&params, (void *)arg, sizeof(params))) {
++        hailo_dev_err(&board->pDev->dev, "copy_from_user fail\n");
++        return -ENOMEM;
++    }
++
++    vdma_engine = &controller->vdma_engines[PCI_SOC_VDMA_ENGINE_INDEX];
++
++    if (!hailo_check_channel_index(params.input_channel_index, controller->hw->src_channels_bitmask, true)) {
++        hailo_dev_err(&board->pDev->dev, "Invalid input channel index %u\n", params.input_channel_index);
++        return -EINVAL;
++    }
++
++    if (!hailo_check_channel_index(params.output_channel_index, controller->hw->src_channels_bitmask, false)) {
++        hailo_dev_err(&board->pDev->dev, "Invalid output channel index %u\n", params.output_channel_index);
++        return -EINVAL;
++    }
++
++    input_channel = &vdma_engine->channels[params.input_channel_index];
++    output_channel = &vdma_engine->channels[params.output_channel_index];
++
++    // Close channels
++    hailo_vdma_stop_channel(input_channel->host_regs);
++    hailo_vdma_stop_channel(output_channel->host_regs);
++
++    hailo_pcie_write_firmware_driver_shutdown(&board->pcie_resources);
++    return 0;
++}
+\ No newline at end of file
+--- /dev/null
++++ b/drivers/media/pci/hailo/src/pci_soc_ioctl.h
+@@ -0,0 +1,19 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#ifndef _HAILO_PCI_SOC_IOCTL_H_
++#define _HAILO_PCI_SOC_IOCTL_H_
++
++#include "vdma/ioctl.h"
++#include "pcie.h"
++
++
++long hailo_soc_ioctl(struct hailo_pcie_board *board, struct hailo_vdma_file_context *context,
++    struct hailo_vdma_controller *controller, unsigned int cmd, unsigned long arg);
++long hailo_soc_connect_ioctl(struct hailo_pcie_board *board, struct hailo_vdma_file_context *context,
++    struct hailo_vdma_controller *controller, unsigned long arg);
++long hailo_soc_close_ioctl(struct hailo_pcie_board *board, struct hailo_vdma_controller *controller, unsigned long arg);
++
++#endif // _HAILO_PCI_SOC_IOCTL_H_
+\ No newline at end of file
+--- a/drivers/media/pci/hailo/src/pcie.c
++++ b/drivers/media/pci/hailo/src/pcie.c
+@@ -20,7 +20,6 @@
+ 
+ #define KERNEL_CODE	1
+ 
+-#include "hailo_pcie_version.h"
+ #include "hailo_ioctl_common.h"
+ #include "pcie.h"
+ #include "fops.h"
+@@ -45,6 +44,7 @@ enum hailo_allocate_driver_buffer_driver
+ static int force_desc_page_size = 0;
+ static bool g_is_power_mode_enabled = true;
+ static int force_allocation_from_driver = HAILO_NO_FORCE_BUFFER;
++static bool force_hailo15_legacy_mode = false;
+ 
+ #define DEVICE_NODE_NAME "hailo"
+ static int char_major = 0;
+@@ -322,7 +322,7 @@ static int hailo_write_config(struct hai
+ 
+ static bool wait_for_firmware_completion(struct completion *fw_load_completion)
+ {
+-    return (0 != wait_for_completion_timeout(fw_load_completion, FIRMWARE_WAIT_TIMEOUT_MS));
++    return (0 != wait_for_completion_timeout(fw_load_completion, msecs_to_jiffies(FIRMWARE_WAIT_TIMEOUT_MS)));
+ }
+ 
+ static int hailo_load_firmware(struct hailo_pcie_resources *resources,
+@@ -330,6 +330,7 @@ static int hailo_load_firmware(struct ha
+ {
+     const struct firmware *firmware = NULL;
+     int err = 0;
++    u32 boot_status = 0;
+ 
+     if (hailo_pcie_is_firmware_loaded(resources)) {
+         hailo_dev_warn(dev, "Firmware was already loaded\n");
+@@ -368,7 +369,8 @@ static int hailo_load_firmware(struct ha
+     release_firmware(firmware);
+ 
+     if (!wait_for_firmware_completion(fw_load_completion)) {
+-        hailo_dev_err(dev, "Timeout waiting for firmware..\n");
++        boot_status = hailo_get_boot_status(resources);
++        hailo_dev_err(dev, "Timeout waiting for firmware file, boot status %u\n", boot_status);
+         return -ETIMEDOUT;
+     }
+ 
+@@ -376,6 +378,55 @@ static int hailo_load_firmware(struct ha
+     return 0;
+ }
+ 
++static int hailo_load_firmware_batch(struct hailo_pcie_resources *resources,
++    struct device *dev, struct completion *fw_load_completion)
++{
++    u32 boot_status = 0;
++    u32 pcie_finished = 1;
++    int err = 0;
++
++    if (hailo_pcie_is_firmware_loaded(resources)) {
++        hailo_dev_warn(dev, "Firmware batch was already loaded\n");
++        return 0;
++    }
++
++    init_completion(fw_load_completion);
++
++    err = hailo_pcie_write_firmware_batch(dev, resources, FIRST_STAGE);
++    if (err < 0) {
++        hailo_dev_err(dev, "Failed writing firmware files. err %d\n", err);
++        return err;
++    }
++
++    hailo_trigger_firmware_boot(resources);
++
++    if (!wait_for_firmware_completion(fw_load_completion)) {
++        boot_status = hailo_get_boot_status(resources);
++        hailo_dev_err(dev, "Timeout waiting for firmware file, boot status %u\n", boot_status);
++        return -ETIMEDOUT;
++    }
++    reinit_completion(fw_load_completion);
++
++    err = hailo_pcie_write_firmware_batch(dev, resources, SECOND_STAGE);
++    if (err < 0) {
++        hailo_dev_err(dev, "Failed writing firmware files. err %d\n", err);
++        return err;
++    }
++
++    // TODO: HRT-13838 - Remove, move address to compat, make write_memory static
++    write_memory(resources, 0x84000000, (void*)&pcie_finished, sizeof(pcie_finished));
++
++    if (!wait_for_firmware_completion(fw_load_completion)) {
++        boot_status = hailo_get_boot_status(resources);
++        hailo_dev_err(dev, "Timeout waiting for firmware file, boot status %u\n", boot_status);
++        return -ETIMEDOUT;
++    }
++
++    hailo_dev_notice(dev, "Firmware Batch loaded successfully\n");
++
++    return 0;
++}
++
+ static int hailo_activate_board(struct hailo_pcie_board *board)
+ {
+     int err = 0;
+@@ -388,8 +439,21 @@ static int hailo_activate_board(struct h
+         return err;
+     }
+ 
+-    err = hailo_load_firmware(&board->pcie_resources, &board->pDev->dev,
+-        &board->fw_loaded_completion);
++    switch (board->pcie_resources.board_type) {
++    case HAILO_BOARD_TYPE_HAILO10H:
++        err = hailo_load_firmware_batch(&board->pcie_resources, &board->pDev->dev,
++            &board->fw_loaded_completion);
++        break;
++    case HAILO_BOARD_TYPE_HAILO10H_LEGACY:
++    case HAILO_BOARD_TYPE_PLUTO:
++    case HAILO_BOARD_TYPE_HAILO8:
++        err = hailo_load_firmware(&board->pcie_resources, &board->pDev->dev,
++            &board->fw_loaded_completion);
++        break;
++    default:
++        hailo_err(board, "Invalid board type");
++        err = -EINVAL;
++    }
+     if (err < 0) {
+         hailo_err(board, "Firmware load failed\n");
+         hailo_disable_interrupts(board);
+@@ -513,8 +577,23 @@ static int pcie_resources_init(struct pc
+         goto failure_release_vdma_regs;
+     }
+ 
++
++    // There is no HAILO15 as mercury through pcie unless it's legacy mode (H15 as accelerator) or HAILO-10H
++    if (HAILO_BOARD_TYPE_HAILO15 == board_type){
++        if (true == force_hailo15_legacy_mode) {
++            board_type = HAILO_BOARD_TYPE_HAILO10H_LEGACY;
++        } else {
++            board_type = HAILO_BOARD_TYPE_HAILO10H;
++        }
++    }
++
+     resources->board_type = board_type;
+ 
++    err = hailo_set_device_type(resources);
++    if (err < 0) {
++        goto failure_release_fw_access;
++    }
++
+     if (!hailo_pcie_is_device_connected(resources)) {
+         pci_err(pdev, "Probing: Failed reading device BARs, device may be disconnected\n");
+         err = -ENODEV;
+@@ -676,6 +755,7 @@ static int hailo_pcie_probe(struct pci_d
+ 
+     pBoard->interrupts_enabled = false;
+     init_completion(&pBoard->fw_loaded_completion);
++    init_completion(&pBoard->soc_connect_accepted);
+ 
+     sema_init(&pBoard->mutex, 1);
+     atomic_set(&pBoard->ref_count, 0);
+@@ -1005,6 +1085,9 @@ MODULE_PARM_DESC(force_allocation_from_d
+ module_param(force_desc_page_size, int, S_IRUGO);
+ MODULE_PARM_DESC(force_desc_page_size, "Determines the maximum DMA descriptor page size (must be a power of 2)");
+ 
++module_param(force_hailo15_legacy_mode, bool, S_IRUGO);
++MODULE_PARM_DESC(force_hailo15_legacy_mode, "Forces work with Hailo15 in legacy mode(relevant for emulators)");
++
+ MODULE_AUTHOR("Hailo Technologies Ltd.");
+ MODULE_DESCRIPTION("Hailo PCIe driver");
+ MODULE_LICENSE("GPL v2");
+--- a/drivers/media/pci/hailo/src/pcie.h
++++ b/drivers/media/pci/hailo/src/pcie.h
+@@ -70,6 +70,8 @@ struct hailo_pcie_board {
+     enum hailo_allocation_mode allocation_mode;
+     struct completion fw_loaded_completion;
+     bool interrupts_enabled;
++    // Only needed in accelerator type soc
++    struct completion soc_connect_accepted;
+ };
+ 
+ bool power_mode_enabled(void);
+--- a/drivers/media/pci/hailo/src/sysfs.c
++++ b/drivers/media/pci/hailo/src/sysfs.c
+@@ -26,9 +26,18 @@ static ssize_t device_id_show(struct dev
+ }
+ static DEVICE_ATTR_RO(device_id);
+ 
++static ssize_t accelerator_type_show(struct device *dev, struct device_attribute *_attr,
++    char *buf)
++{
++    struct hailo_pcie_board *board = (struct hailo_pcie_board *)dev_get_drvdata(dev);
++    return sprintf(buf, "%d", board->pcie_resources.accelerator_type);
++}
++static DEVICE_ATTR_RO(accelerator_type);
++
+ static struct attribute *hailo_dev_attrs[] = {
+     &dev_attr_board_location.attr,
+     &dev_attr_device_id.attr,
++    &dev_attr_accelerator_type.attr,
+     NULL
+ };
+ 
+--- a/drivers/media/pci/hailo/src/utils.c
++++ b/drivers/media/pci/hailo/src/utils.c
+@@ -8,7 +8,6 @@
+ #include <linux/module.h>
+ #include <linux/pci.h>
+ 
+-#include "hailo_pcie_version.h"
+ #include "pcie.h"
+ #include "utils.h"
+ #include "utils/logs.h"
+--- /dev/null
++++ b/drivers/media/pci/hailo/utils/integrated_nnc_utils.c
+@@ -0,0 +1,101 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#include "integrated_nnc_utils.h"
++#include "utils/logs.h"
++
++#include <linux/uaccess.h>
++#include <asm/io.h>
++#include <linux/of_address.h>
++#include <linux/cdev.h>
++
++int hailo_ioremap_resource(struct platform_device *pdev, struct hailo_resource *resource,
++    const char *name)
++{
++    void __iomem *address;
++    struct resource *platform_resource = platform_get_resource_byname(pdev, IORESOURCE_MEM, name);
++    if (NULL == platform_resource) {
++        return -ENOENT;
++    }
++
++    address = devm_ioremap_resource(&pdev->dev, platform_resource);
++    if (IS_ERR(address)) {
++        return PTR_ERR(address);
++    }
++
++    resource->address = (uintptr_t)address;
++    resource->size = resource_size(platform_resource);
++
++    hailo_dev_dbg(&pdev->dev, "resource[%s]: remap %pr of %zx bytes to virtual start address %lx\n",
++        platform_resource->name, platform_resource, resource->size, (uintptr_t)address);
++
++    return 0;
++}
++
++// TODO: HRT-8475 - change to name instead of index
++int hailo_ioremap_shmem(struct platform_device *pdev, int index, struct hailo_resource *resource)
++{
++    int ret;
++    struct resource res;
++    struct device_node *shmem;
++    void __iomem * remap_ptr;
++
++    shmem = of_parse_phandle(pdev->dev.of_node, "shmem", index);
++    ret = of_address_to_resource(shmem, 0, &res);
++    if (ret) {
++        hailo_dev_err(&pdev->dev, "hailo_ioremap_shmem, failed to get memory (index: %d)\n", index);
++        return ret;
++    }
++    of_node_put(shmem);
++
++    remap_ptr = devm_ioremap(&pdev->dev, res.start, resource_size(&res));
++    if (!remap_ptr) {
++        hailo_dev_err(&pdev->dev, "hailo_ioremap_shmem, failed to ioremap shmem (index: %d)\n", index);
++        return -EADDRNOTAVAIL;
++    }
++
++    resource->address = (uintptr_t)remap_ptr;
++    resource->size = resource_size(&res);
++
++    return 0;
++}
++
++int direct_memory_transfer(struct platform_device *pdev, struct hailo_memory_transfer_params *params)
++{
++    int err = -EINVAL;
++    void __iomem *mem = ioremap(params->address, params->count);
++    if (NULL == mem) {
++        hailo_dev_err(&pdev->dev, "Failed ioremap %llu %zu\n", params->address, params->count);
++        return -ENOMEM;
++    }
++
++    switch (params->transfer_direction) {
++    case TRANSFER_READ:
++        memcpy_fromio(params->buffer, mem, params->count);
++        err = 0;
++        break;
++    case TRANSFER_WRITE:
++        memcpy_toio(mem, params->buffer, params->count);
++        err = 0;
++        break;
++    default:
++        hailo_dev_err(&pdev->dev, "Invalid transfer direction %d\n", (int)params->transfer_direction);
++        err = -EINVAL;
++    }
++
++    iounmap(mem);
++    return err;
++}
++
++int hailo_get_resource_physical_addr(struct platform_device *pdev, const char *name, u64 *address)
++{
++    struct resource *platform_resource = platform_get_resource_byname(pdev, IORESOURCE_MEM, name);
++    if (NULL == platform_resource) {
++        return -ENOENT;
++    }
++
++    *address = (u64)(platform_resource->start);
++    return 0;
++}
+\ No newline at end of file
+--- /dev/null
++++ b/drivers/media/pci/hailo/utils/integrated_nnc_utils.h
+@@ -0,0 +1,30 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#ifndef _INTEGRATED_NNC_UTILS_H_
++#define _INTEGRATED_NNC_UTILS_H_
++
++#include <linux/platform_device.h>
++#include "hailo_resource.h"
++
++#define HAILO15_CORE_CONTROL_MAILBOX_INDEX (0)
++#define HAILO15_CORE_NOTIFICATION_MAILBOX_INDEX (1)
++#define HAILO15_CORE_DRIVER_DOWN_MAILBOX_INDEX (2)
++
++#define HAILO15_CORE_CONTROL_MAILBOX_TX_SHMEM_INDEX (0)
++#define HAILO15_CORE_CONTROL_MAILBOX_RX_SHMEM_INDEX (1)
++#define HAILO15_CORE_NOTIFICATION_MAILBOX_RX_SHMEM_INDEX (2)
++
++int hailo_ioremap_resource(struct platform_device *pdev, struct hailo_resource *resource,
++    const char *name);
++
++// TODO: HRT-8475 - change to name instead of index
++int hailo_ioremap_shmem(struct platform_device *pdev, int index, struct hailo_resource *resource);
++
++int direct_memory_transfer(struct platform_device *pDev, struct hailo_memory_transfer_params *params);
++
++int hailo_get_resource_physical_addr(struct platform_device *pdev, const char *name, u64 *address);
++
++#endif /* _INTEGRATED_NNC_UTILS_H_ */
+--- a/drivers/media/pci/hailo/vdma/ioctl.c
++++ b/drivers/media/pci/hailo/vdma/ioctl.c
+@@ -12,9 +12,9 @@
+ #include <linux/uaccess.h>
+ 
+ 
+-long hailo_vdma_interrupts_enable_ioctl(struct hailo_vdma_controller *controller, unsigned long arg)
++long hailo_vdma_enable_channels_ioctl(struct hailo_vdma_controller *controller, unsigned long arg)
+ {
+-    struct hailo_vdma_interrupts_enable_params input;
++    struct hailo_vdma_enable_channels_params input;
+     struct hailo_vdma_engine *engine = NULL;
+     u8 engine_index = 0;
+     u32 channels_bitmap = 0;
+@@ -35,7 +35,7 @@ long hailo_vdma_interrupts_enable_ioctl(
+ 
+     for_each_vdma_engine(controller, engine, engine_index) {
+         channels_bitmap = input.channels_bitmap_per_engine[engine_index];
+-        hailo_vdma_engine_enable_channel_interrupts(engine, channels_bitmap,
++        hailo_vdma_engine_enable_channels(engine, channels_bitmap,
+             input.enable_timestamps_measure);
+         hailo_vdma_update_interrupts_mask(controller, engine_index);
+         hailo_dev_info(controller->dev, "Enabled interrupts for engine %u, channels bitmap 0x%x\n",
+@@ -45,12 +45,13 @@ long hailo_vdma_interrupts_enable_ioctl(
+     return 0;
+ }
+ 
+-long hailo_vdma_interrupts_disable_ioctl(struct hailo_vdma_controller *controller, unsigned long arg)
++long hailo_vdma_disable_channels_ioctl(struct hailo_vdma_controller *controller, unsigned long arg)
+ {
+-    struct hailo_vdma_interrupts_disable_params input;
++    struct hailo_vdma_disable_channels_params input;
+     struct hailo_vdma_engine *engine = NULL;
+     u8 engine_index = 0;
+     u32 channels_bitmap = 0;
++    unsigned long irq_saved_flags = 0;
+ 
+     if (copy_from_user(&input, (void*)arg, sizeof(input))) {
+         hailo_dev_err(controller->dev, "copy_from_user fail\n");
+@@ -61,15 +62,21 @@ long hailo_vdma_interrupts_disable_ioctl
+     for_each_vdma_engine(controller, engine, engine_index) {
+         channels_bitmap = input.channels_bitmap_per_engine[engine_index];
+         if (channels_bitmap != (channels_bitmap & engine->enabled_channels)) {
+-            hailo_dev_err(controller->dev, "Trying to disable channels that were not enabled\n");
+-            return -EINVAL;
++            hailo_dev_warn(controller->dev, "Trying to disable channels that were not enabled\n");
+         }
+     }
+ 
+     for_each_vdma_engine(controller, engine, engine_index) {
+         channels_bitmap = input.channels_bitmap_per_engine[engine_index];
+-        hailo_vdma_engine_interrupts_disable(controller, engine, engine_index,
+-            channels_bitmap);
++        hailo_vdma_engine_disable_channels(engine, channels_bitmap);
++        hailo_vdma_update_interrupts_mask(controller, engine_index);
++
++        spin_lock_irqsave(&controller->interrupts_lock, irq_saved_flags);
++        hailo_vdma_engine_clear_channel_interrupts(engine, channels_bitmap);
++        spin_unlock_irqrestore(&controller->interrupts_lock, irq_saved_flags);
++
++        hailo_dev_info(controller->dev, "Disabled channels for engine %u, bitmap 0x%x\n",
++            engine_index, channels_bitmap);
+     }
+ 
+     // Wake up threads waiting
+@@ -197,7 +204,7 @@ long hailo_vdma_buffer_map_ioctl(struct
+         return -EFAULT;
+     }
+ 
+-    hailo_dev_info(controller->dev, "address %px tgid %d size: %zu\n",
++    hailo_dev_info(controller->dev, "address %lx tgid %d size: %zu\n",
+         buf_info.user_address, current->tgid, buf_info.size);
+ 
+     direction = get_dma_direction(buf_info.data_direction);
+@@ -209,10 +216,9 @@ long hailo_vdma_buffer_map_ioctl(struct
+     low_memory_buffer = hailo_vdma_find_low_memory_buffer(context, buf_info.allocated_buffer_handle);
+ 
+     mapped_buffer = hailo_vdma_buffer_map(controller->dev,
+-        buf_info.user_address, buf_info.size, direction, low_memory_buffer);
++        buf_info.user_address, buf_info.size, direction, buf_info.buffer_type, low_memory_buffer);
+     if (IS_ERR(mapped_buffer)) {
+-        hailo_dev_err(controller->dev, "failed map buffer %px\n",
+-            buf_info.user_address);
++        hailo_dev_err(controller->dev, "failed map buffer %lx\n", buf_info.user_address);
+         return PTR_ERR(mapped_buffer);
+     }
+ 
+@@ -225,7 +231,7 @@ long hailo_vdma_buffer_map_ioctl(struct
+     }
+ 
+     list_add(&mapped_buffer->mapped_user_buffer_list, &context->mapped_user_buffer_list);
+-    hailo_dev_info(controller->dev, "buffer %px (handle %zu) is mapped\n",
++    hailo_dev_info(controller->dev, "buffer %lx (handle %zu) is mapped\n",
+         buf_info.user_address, buf_info.mapped_handle);
+     return 0;
+ }
+@@ -374,10 +380,10 @@ long hailo_desc_list_release_ioctl(struc
+     return 0;
+ }
+ 
+-long hailo_desc_list_bind_vdma_buffer(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller,
++long hailo_desc_list_program_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller,
+     unsigned long arg)
+ {
+-    struct hailo_desc_list_bind_vdma_buffer_params configure_info;
++    struct hailo_desc_list_program_params configure_info;
+     struct hailo_vdma_buffer *mapped_buffer = NULL;
+     struct hailo_descriptors_list_buffer *descriptors_buffer = NULL;
+     struct hailo_vdma_mapped_transfer_buffer transfer_buffer = {0};
+@@ -410,7 +416,10 @@ long hailo_desc_list_bind_vdma_buffer(st
+         &descriptors_buffer->desc_list,
+         configure_info.starting_desc,
+         &transfer_buffer,
+-        configure_info.channel_index
++        configure_info.should_bind,
++        configure_info.channel_index,
++        configure_info.last_interrupts_domain,
++        configure_info.is_debug
+     );
+ }
+ 
+@@ -683,11 +692,19 @@ long hailo_vdma_launch_transfer_ioctl(st
+         params.is_debug
+     );
+     if (ret < 0) {
+-        hailo_dev_err(controller->dev, "Failed launch transfer %d\n", ret);
++        params.launch_transfer_status = ret;
++        if (-ECONNRESET != ret) {
++            hailo_dev_err(controller->dev, "Failed launch transfer %d\n", ret);
++        }
++        // Still need to copy fail status back to userspace - success oriented
++        if (copy_to_user((void __user*)arg, &params, sizeof(params))) {
++            hailo_dev_err(controller->dev, "copy_to_user fail\n");
++        }
+         return ret;
+     }
+ 
+     params.descs_programed = ret;
++    params.launch_transfer_status = 0;
+ 
+     if (copy_to_user((void __user*)arg, &params, sizeof(params))) {
+         hailo_dev_err(controller->dev, "copy_to_user fail\n");
+--- a/drivers/media/pci/hailo/vdma/ioctl.h
++++ b/drivers/media/pci/hailo/vdma/ioctl.h
+@@ -8,8 +8,8 @@
+ 
+ #include "vdma/vdma.h"
+ 
+-long hailo_vdma_interrupts_enable_ioctl(struct hailo_vdma_controller *controller, unsigned long arg);
+-long hailo_vdma_interrupts_disable_ioctl(struct hailo_vdma_controller *controller, unsigned long arg);
++long hailo_vdma_enable_channels_ioctl(struct hailo_vdma_controller *controller, unsigned long arg);
++long hailo_vdma_disable_channels_ioctl(struct hailo_vdma_controller *controller, unsigned long arg);
+ long hailo_vdma_interrupts_wait_ioctl(struct hailo_vdma_controller *controller, unsigned long arg,
+     struct semaphore *mutex, bool *should_up_board_mutex);
+ 
+@@ -19,7 +19,7 @@ long hailo_vdma_buffer_sync_ioctl(struct
+ 
+ long hailo_desc_list_create_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller, unsigned long arg);
+ long hailo_desc_list_release_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller, unsigned long arg);
+-long hailo_desc_list_bind_vdma_buffer(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller, unsigned long arg);
++long hailo_desc_list_program_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller, unsigned long arg);
+ 
+ long hailo_vdma_low_memory_buffer_alloc_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller, unsigned long arg);
+ long hailo_vdma_low_memory_buffer_free_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller, unsigned long arg);
+--- a/drivers/media/pci/hailo/vdma/memory.c
++++ b/drivers/media/pci/hailo/vdma/memory.c
+@@ -11,27 +11,107 @@
+ #include <linux/slab.h>
+ #include <linux/scatterlist.h>
+ #include <linux/sched.h>
++#include <linux/module.h>
+ 
+ 
+ #define SGL_MAX_SEGMENT_SIZE 	(0x10000)
+ // See linux/mm.h
+ #define MMIO_AND_NO_PAGES_VMA_MASK (VM_IO | VM_PFNMAP)
+ 
+-static int map_mmio_address(void __user* user_address, u32 size, struct vm_area_struct *vma,
++static int map_mmio_address(uintptr_t user_address, u32 size, struct vm_area_struct *vma,
+     struct sg_table *sgt);
+-static int prepare_sg_table(struct sg_table *sg_table, void __user* user_address, u32 size,
++static int prepare_sg_table(struct sg_table *sg_table, uintptr_t user_address, u32 size,
+     struct hailo_vdma_low_memory_buffer *low_mem_driver_allocated_buffer);
+ static void clear_sg_table(struct sg_table *sgt);
+ 
++#if LINUX_VERSION_CODE >= KERNEL_VERSION( 3, 3, 0 )
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 16, 0)
++// Import DMA_BUF namespace for needed kernels
++MODULE_IMPORT_NS(DMA_BUF);
++#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(5, 16, 0) */
++
++static int hailo_map_dmabuf(struct device *dev, int dmabuf_fd, enum dma_data_direction direction, struct sg_table *sgt,
++    struct hailo_dmabuf_info *dmabuf_info)
++{
++    int ret = -EINVAL;
++    struct dma_buf *dmabuf = NULL;
++    struct dma_buf_attachment *dmabuf_attachment = NULL;
++    struct sg_table *res_sgt = NULL;
++
++    dmabuf = dma_buf_get(dmabuf_fd);
++    if (IS_ERR(dmabuf)) {
++        dev_err(dev, "dma_buf_get failed, err=%ld\n", PTR_ERR(dmabuf));
++        ret = -EINVAL;
++        goto cleanup;
++    }
++
++    dmabuf_attachment = dma_buf_attach(dmabuf, dev);
++    if (IS_ERR(dmabuf_attachment)) {
++        dev_err(dev, "dma_buf_attach failed, err=%ld\n", PTR_ERR(dmabuf_attachment));
++        ret = -EINVAL;
++        goto l_buf_get;
++    }
++
++    res_sgt = dma_buf_map_attachment(dmabuf_attachment, direction);
++    if (IS_ERR(res_sgt)) {
++        dev_err(dev, "dma_buf_map_attachment failed, err=%ld\n", PTR_ERR(res_sgt));
++        goto l_buf_attach;
++    }
++
++    *sgt = *res_sgt;
++
++    dmabuf_info->dmabuf = dmabuf;
++    dmabuf_info->dmabuf_attachment = dmabuf_attachment;
++    dmabuf_info->dmabuf_sg_table = res_sgt;
++    return 0;
++
++l_buf_attach:
++    dma_buf_detach(dmabuf, dmabuf_attachment);
++l_buf_get:
++    dma_buf_put(dmabuf);
++cleanup:
++    return ret;
++}
++
++static void hailo_unmap_dmabuf(struct hailo_vdma_buffer *vdma_buffer)
++{
++    dma_buf_unmap_attachment(vdma_buffer->dmabuf_info.dmabuf_attachment, vdma_buffer->dmabuf_info.dmabuf_sg_table, vdma_buffer->data_direction);
++    dma_buf_detach(vdma_buffer->dmabuf_info.dmabuf, vdma_buffer->dmabuf_info.dmabuf_attachment);
++    dma_buf_put(vdma_buffer->dmabuf_info.dmabuf);
++}
++
++#else /* LINUX_VERSION_CODE >= KERNEL_VERSION( 3, 3, 0 ) */
++
++static int hailo_map_dmabuf(struct device *dev, int dmabuf_fd, enum dma_data_direction direction, struct sg_table *sgt,
++    struct hailo_dmabuf_info *dmabuf_info)
++{
++    (void) dmabuf_fd;
++    (void) direction;
++    (void) sgt;
++    (void) mapped_buffer;
++    dev_err(dev, "dmabuf not supported in kernel versions lower than 3.3.0\n");
++    return -EINVAL;
++}
++
++static void hailo_unmap_dmabuf(struct hailo_vdma_buffer *vdma_buffer)
++{
++    dev_err(vdma_buffer->device, "dmabuf not supported in kernel versions lower than 3.3.0\n");
++    return -EINVAL;
++}
++
++#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION( 3, 3, 0 ) */
++
+ struct hailo_vdma_buffer *hailo_vdma_buffer_map(struct device *dev,
+-    void __user *user_address, size_t size, enum dma_data_direction direction,
+-    struct hailo_vdma_low_memory_buffer *low_mem_driver_allocated_buffer)
++    uintptr_t user_address, size_t size, enum dma_data_direction direction,
++    enum hailo_dma_buffer_type buffer_type, struct hailo_vdma_low_memory_buffer *low_mem_driver_allocated_buffer)
+ {
+     int ret = -EINVAL;
+     struct hailo_vdma_buffer *mapped_buffer = NULL;
+     struct sg_table sgt = {0};
+     struct vm_area_struct *vma = NULL;
+     bool is_mmio = false;
++    struct hailo_dmabuf_info dmabuf_info = {0}; 
+ 
+     mapped_buffer = kzalloc(sizeof(*mapped_buffer), GFP_KERNEL);
+     if (NULL == mapped_buffer) {
+@@ -40,17 +120,19 @@ struct hailo_vdma_buffer *hailo_vdma_buf
+         goto cleanup;
+     }
+ 
+-    if (IS_ENABLED(HAILO_SUPPORT_MMIO_DMA_MAPPING)) {
+-        vma = find_vma(current->mm, (uintptr_t)user_address);
++    if (IS_ENABLED(HAILO_SUPPORT_MMIO_DMA_MAPPING) && (HAILO_DMA_DMABUF_BUFFER != buffer_type)) {
++        vma = find_vma(current->mm, user_address);
+         if (NULL == vma) {
+-            dev_err(dev, "no vma for virt_addr/size = 0x%08lx/0x%08zx\n", (uintptr_t)user_address, size);
++            dev_err(dev, "no vma for virt_addr/size = 0x%08lx/0x%08zx\n", user_address, size);
+             ret = -EFAULT;
+             goto cleanup;
+         }
+     }
+ 
++    // TODO: is MMIO DMA MAPPINGS STILL needed after dmabuf
+     if (IS_ENABLED(HAILO_SUPPORT_MMIO_DMA_MAPPING) &&
+-            (MMIO_AND_NO_PAGES_VMA_MASK == (vma->vm_flags & MMIO_AND_NO_PAGES_VMA_MASK))) {
++            (MMIO_AND_NO_PAGES_VMA_MASK == (vma->vm_flags & MMIO_AND_NO_PAGES_VMA_MASK)) && 
++            (HAILO_DMA_DMABUF_BUFFER != buffer_type)) {
+         // user_address represents memory mapped I/O and isn't backed by 'struct page' (only by pure pfn)
+         if (NULL != low_mem_driver_allocated_buffer) {
+             // low_mem_driver_allocated_buffer are backed by regular 'struct page' addresses, just in low memory
+@@ -66,6 +148,14 @@ struct hailo_vdma_buffer *hailo_vdma_buf
+         }
+ 
+         is_mmio = true;
++
++    } else if (HAILO_DMA_DMABUF_BUFFER == buffer_type) {
++        // Content user_address in case of dmabuf is fd - for now
++        ret = hailo_map_dmabuf(dev, user_address, direction, &sgt, &dmabuf_info);
++        if (ret < 0) {
++            dev_err(dev, "Failed mapping dmabuf\n");
++            goto cleanup;
++        }
+     } else {
+         // user_address is a standard 'struct page' backed memory address
+         ret = prepare_sg_table(&sgt, user_address, size, low_mem_driver_allocated_buffer);
+@@ -88,6 +178,7 @@ struct hailo_vdma_buffer *hailo_vdma_buf
+     mapped_buffer->data_direction = direction;
+     mapped_buffer->sg_table = sgt;
+     mapped_buffer->is_mmio = is_mmio;
++    mapped_buffer->dmabuf_info = dmabuf_info;
+ 
+     return mapped_buffer;
+ 
+@@ -103,11 +194,16 @@ static void unmap_buffer(struct kref *kr
+ {
+     struct hailo_vdma_buffer *buf = container_of(kref, struct hailo_vdma_buffer, kref);
+ 
+-    if (!buf->is_mmio) {
+-        dma_unmap_sg(buf->device, buf->sg_table.sgl, buf->sg_table.orig_nents, buf->data_direction);
+-    }
++    // If dmabuf - unmap and detatch dmabuf
++    if (NULL != buf->dmabuf_info.dmabuf) {
++        hailo_unmap_dmabuf(buf);
++    } else {
++        if (!buf->is_mmio) {
++            dma_unmap_sg(buf->device, buf->sg_table.sgl, buf->sg_table.orig_nents, buf->data_direction);
++        }
+ 
+-    clear_sg_table(&buf->sg_table);
++        clear_sg_table(&buf->sg_table);
++    }
+     kfree(buf);
+ }
+ 
+@@ -164,8 +260,9 @@ void hailo_vdma_buffer_sync(struct hailo
+     struct hailo_vdma_buffer *mapped_buffer, enum hailo_vdma_buffer_sync_type sync_type,
+     size_t offset, size_t size)
+ {
+-    if (IS_ENABLED(HAILO_SUPPORT_MMIO_DMA_MAPPING) && mapped_buffer->is_mmio) {
+-        // MMIO buffers don't need to be sync'd
++    if ((IS_ENABLED(HAILO_SUPPORT_MMIO_DMA_MAPPING) && mapped_buffer->is_mmio) || 
++        (NULL != mapped_buffer->dmabuf_info.dmabuf)) {
++        // MMIO buffers and dmabufs don't need to be sync'd
+         return;
+     }
+ 
+@@ -404,7 +501,8 @@ void hailo_vdma_clear_continuous_buffer_
+ 
+ // Assumes the provided user_address belongs to the vma and that MMIO_AND_NO_PAGES_VMA_MASK bits are set under
+ // vma->vm_flags. This is validated in hailo_vdma_buffer_map, and won't be checked here
+-static int map_mmio_address(void __user* user_address, u32 size, struct vm_area_struct *vma,
++#if defined(HAILO_SUPPORT_MMIO_DMA_MAPPING)
++static int map_mmio_address(uintptr_t user_address, u32 size, struct vm_area_struct *vma,
+     struct sg_table *sgt)
+ {
+     int ret = -EINVAL;
+@@ -413,7 +511,7 @@ static int map_mmio_address(void __user*
+     unsigned long next_pfn = 0;
+     phys_addr_t phys_addr = 0;
+     dma_addr_t mmio_dma_address = 0;
+-    const uintptr_t virt_addr = (uintptr_t)user_address;
++    const uintptr_t virt_addr = user_address;
+     const u32 vma_size = vma->vm_end - vma->vm_start + 1;
+     const uintptr_t num_pages = PFN_UP(virt_addr + size) - PFN_DOWN(virt_addr);
+ 
+@@ -462,8 +560,21 @@ static int map_mmio_address(void __user*
+ 
+     return 0;
+ }
++#else /* defined(HAILO_SUPPORT_MMIO_DMA_MAPPING) */
++static int map_mmio_address(uintptr_t user_address, u32 size, struct vm_area_struct *vma,
++    struct sg_table *sgt)
++{
++    (void) user_address;
++    (void) size;
++    (void) vma;
++    (void) sgt;
++    pr_err("MMIO DMA MAPPINGS are not supported in this kernel version\n");
++    return -EINVAL;
++}
++#endif /* defined(HAILO_SUPPORT_MMIO_DMA_MAPPING) */
++
+ 
+-static int prepare_sg_table(struct sg_table *sg_table, void __user *user_address, u32 size,
++static int prepare_sg_table(struct sg_table *sg_table, uintptr_t user_address, u32 size,
+     struct hailo_vdma_low_memory_buffer *low_mem_driver_allocated_buffer)
+ {
+     int ret = -EINVAL;
+@@ -482,8 +593,7 @@ static int prepare_sg_table(struct sg_ta
+     // Check whether mapping user allocated buffer or driver allocated low memory buffer
+     if (NULL == low_mem_driver_allocated_buffer) {
+         mmap_read_lock(current->mm);
+-        pinned_pages = get_user_pages_compact((unsigned long)user_address,
+-            npages, FOLL_WRITE | FOLL_FORCE, pages);
++        pinned_pages = get_user_pages_compact(user_address, npages, FOLL_WRITE | FOLL_FORCE, pages);
+         mmap_read_unlock(current->mm);
+ 
+         if (pinned_pages < 0) {
+--- a/drivers/media/pci/hailo/vdma/memory.h
++++ b/drivers/media/pci/hailo/vdma/memory.h
+@@ -11,8 +11,8 @@
+ 
+ #include "vdma/vdma.h"
+ 
+-struct hailo_vdma_buffer *hailo_vdma_buffer_map(struct device *dev,
+-    void __user *user_address, size_t size, enum dma_data_direction direction,
++struct hailo_vdma_buffer *hailo_vdma_buffer_map(struct device *dev, uintptr_t user_address, size_t size,
++    enum dma_data_direction direction, enum hailo_dma_buffer_type buffer_type,
+     struct hailo_vdma_low_memory_buffer *low_mem_driver_allocated_buffer);
+ void hailo_vdma_buffer_get(struct hailo_vdma_buffer *buf);
+ void hailo_vdma_buffer_put(struct hailo_vdma_buffer *buf);
+--- a/drivers/media/pci/hailo/vdma/vdma.c
++++ b/drivers/media/pci/hailo/vdma/vdma.c
+@@ -21,7 +21,7 @@
+ 
+ 
+ static struct hailo_vdma_engine* init_vdma_engines(struct device *dev,
+-    struct hailo_resource *channel_registers_per_engine, size_t engines_count)
++    struct hailo_resource *channel_registers_per_engine, size_t engines_count, u32 src_channels_bitmask)
+ {
+     struct hailo_vdma_engine *engines = NULL;
+     u8 i = 0;
+@@ -33,7 +33,7 @@ static struct hailo_vdma_engine* init_vd
+     }
+ 
+     for (i = 0; i < engines_count; i++) {
+-        hailo_vdma_engine_init(&engines[i], i, &channel_registers_per_engine[i]);
++        hailo_vdma_engine_init(&engines[i], i, &channel_registers_per_engine[i], src_channels_bitmask);
+     }
+ 
+     return engines;
+@@ -72,7 +72,8 @@ int hailo_vdma_controller_init(struct ha
+     controller->dev = dev;
+ 
+     controller->vdma_engines_count = engines_count;
+-    controller->vdma_engines = init_vdma_engines(dev, channel_registers_per_engine, engines_count);
++    controller->vdma_engines = init_vdma_engines(dev, channel_registers_per_engine, engines_count,
++        vdma_hw->src_channels_bitmask);
+     if (IS_ERR(controller->vdma_engines)) {
+         dev_err(dev, "Failed initialized vdma engines\n");
+         return PTR_ERR(controller->vdma_engines);
+@@ -113,36 +114,27 @@ void hailo_vdma_update_interrupts_mask(s
+     controller->ops->update_channel_interrupts(controller, engine_index, engine->enabled_channels);
+ }
+ 
+-void hailo_vdma_engine_interrupts_disable(struct hailo_vdma_controller *controller,
+-    struct hailo_vdma_engine *engine, u8 engine_index, u32 channels_bitmap)
+-{
+-    unsigned long irq_saved_flags = 0;
+-    // In case of FLR, the vdma registers will be NULL
+-    const bool is_device_up = (NULL != controller->dev);
+-
+-    hailo_vdma_engine_disable_channel_interrupts(engine, channels_bitmap);
+-    if (is_device_up) {
+-        hailo_vdma_update_interrupts_mask(controller, engine_index);
+-    }
+-
+-    spin_lock_irqsave(&controller->interrupts_lock, irq_saved_flags);
+-    hailo_vdma_engine_clear_channel_interrupts(engine, channels_bitmap);
+-    spin_unlock_irqrestore(&controller->interrupts_lock, irq_saved_flags);
+-
+-    hailo_dev_info(controller->dev, "Disabled interrupts for engine %u, channels bitmap 0x%x\n",
+-        engine_index, channels_bitmap);
+-}
+-
+ void hailo_vdma_file_context_finalize(struct hailo_vdma_file_context *context,
+     struct hailo_vdma_controller *controller, struct file *filp)
+ {
+     size_t engine_index = 0;
+     struct hailo_vdma_engine *engine = NULL;
+     const u32 channels_bitmap = 0xFFFFFFFF; // disable all channel interrupts
++    unsigned long irq_saved_flags = 0;
++    // In case of FLR, the vdma registers will be NULL
++    const bool is_device_up = (NULL != controller->dev);
+ 
+     if (filp == controller->used_by_filp) {
+         for_each_vdma_engine(controller, engine, engine_index) {
+-            hailo_vdma_engine_interrupts_disable(controller, engine, engine_index, channels_bitmap);
++            hailo_vdma_engine_disable_channels(engine, channels_bitmap);
++
++            if (is_device_up) {
++                hailo_vdma_update_interrupts_mask(controller, engine_index);
++            }
++
++            spin_lock_irqsave(&controller->interrupts_lock, irq_saved_flags);
++            hailo_vdma_engine_clear_channel_interrupts(engine, channels_bitmap);
++            spin_unlock_irqrestore(&controller->interrupts_lock, irq_saved_flags);
+         }
+     }
+ 
+@@ -178,10 +170,10 @@ long hailo_vdma_ioctl(struct hailo_vdma_
+     unsigned int cmd, unsigned long arg, struct file *filp, struct semaphore *mutex, bool *should_up_board_mutex)
+ {
+     switch (cmd) {
+-    case HAILO_VDMA_INTERRUPTS_ENABLE:
+-        return hailo_vdma_interrupts_enable_ioctl(controller, arg);
+-    case HAILO_VDMA_INTERRUPTS_DISABLE:
+-        return hailo_vdma_interrupts_disable_ioctl(controller, arg);
++    case HAILO_VDMA_ENABLE_CHANNELS:
++        return hailo_vdma_enable_channels_ioctl(controller, arg);
++    case HAILO_VDMA_DISABLE_CHANNELS:
++        return hailo_vdma_disable_channels_ioctl(controller, arg);
+     case HAILO_VDMA_INTERRUPTS_WAIT:
+         return hailo_vdma_interrupts_wait_ioctl(controller, arg, mutex, should_up_board_mutex);
+     case HAILO_VDMA_INTERRUPTS_READ_TIMESTAMPS:
+@@ -196,8 +188,8 @@ long hailo_vdma_ioctl(struct hailo_vdma_
+         return hailo_desc_list_create_ioctl(context, controller, arg);
+     case HAILO_DESC_LIST_RELEASE:
+         return hailo_desc_list_release_ioctl(context, controller, arg);
+-    case HAILO_DESC_LIST_BIND_VDMA_BUFFER:
+-        return hailo_desc_list_bind_vdma_buffer(context, controller, arg);
++    case HAILO_DESC_LIST_PROGRAM:
++        return hailo_desc_list_program_ioctl(context, controller, arg);
+     case HAILO_VDMA_LOW_MEMORY_BUFFER_ALLOC:
+         return hailo_vdma_low_memory_buffer_alloc_ioctl(context, controller, arg);
+     case HAILO_VDMA_LOW_MEMORY_BUFFER_FREE:
+@@ -216,28 +208,6 @@ long hailo_vdma_ioctl(struct hailo_vdma_
+     }
+ }
+ 
+-static int desc_list_mmap(struct hailo_vdma_controller *controller,
+-    struct hailo_descriptors_list_buffer *vdma_descriptors_buffer, struct vm_area_struct *vma)
+-{
+-    int err = 0;
+-    unsigned long vsize = vma->vm_end - vma->vm_start;
+-
+-    if (vsize > vdma_descriptors_buffer->buffer_size) {
+-        hailo_dev_err(controller->dev, "Requested size to map (%lx) is larger than the descriptor list size(%x)\n",
+-            vsize, vdma_descriptors_buffer->buffer_size);
+-        return -EINVAL;
+-    }
+-
+-    err = dma_mmap_coherent(controller->dev, vma, vdma_descriptors_buffer->kernel_address,
+-        vdma_descriptors_buffer->dma_address, vsize);
+-    if (err != 0) {
+-        hailo_dev_err(controller->dev, " Failed mmap descriptors %d\n", err);
+-        return err;
+-    }
+-
+-    return 0;
+-}
+-
+ static int low_memory_buffer_mmap(struct hailo_vdma_controller *controller,
+     struct hailo_vdma_low_memory_buffer *vdma_buffer, struct vm_area_struct *vma)
+ {
+@@ -300,15 +270,11 @@ static int continuous_buffer_mmap(struct
+ int hailo_vdma_mmap(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller,
+     struct vm_area_struct *vma, uintptr_t vdma_handle)
+ {
+-    struct hailo_descriptors_list_buffer *vdma_descriptors_buffer = NULL;
+     struct hailo_vdma_low_memory_buffer *low_memory_buffer = NULL;
+     struct hailo_vdma_continuous_buffer *continuous_buffer = NULL;
+ 
+     hailo_dev_info(controller->dev, "Map vdma_handle %llu\n", (u64)vdma_handle);
+-    if (NULL != (vdma_descriptors_buffer = hailo_vdma_find_descriptors_buffer(context, vdma_handle))) {
+-        return desc_list_mmap(controller, vdma_descriptors_buffer, vma);
+-    }
+-    else if (NULL != (low_memory_buffer = hailo_vdma_find_low_memory_buffer(context, vdma_handle))) {
++    if (NULL != (low_memory_buffer = hailo_vdma_find_low_memory_buffer(context, vdma_handle))) {
+         return low_memory_buffer_mmap(controller, low_memory_buffer, vma);
+     }
+     else if (NULL != (continuous_buffer = hailo_vdma_find_continuous_buffer(context, vdma_handle))) {
+--- a/drivers/media/pci/hailo/vdma/vdma.h
++++ b/drivers/media/pci/hailo/vdma/vdma.h
+@@ -16,6 +16,8 @@
+ #include <linux/dma-mapping.h>
+ #include <linux/types.h>
+ #include <linux/semaphore.h>
++#include <linux/dma-buf.h>
++#include <linux/version.h>
+ 
+ #define VDMA_CHANNEL_CONTROL_REG_OFFSET(channel_index, direction) (((direction) == DMA_TO_DEVICE) ? \
+             (((channel_index) << 5) + 0x0) : (((channel_index) << 5) + 0x10))
+@@ -28,6 +30,22 @@
+     ((u8*)((vdma_registers)->address) + VDMA_CHANNEL_NUM_PROC_OFFSET(channel_index, direction))
+ 
+ 
++// dmabuf is supported from linux kernel version 3.3
++#if LINUX_VERSION_CODE < KERNEL_VERSION( 3, 3, 0 )
++// Make dummy struct with one byte (C standards does not allow empty struct) - in order to not have to ifdef everywhere
++struct hailo_dmabuf_info {
++    uint8_t dummy;
++};
++#else
++// dmabuf_sg_table is needed because in dma_buf_unmap_attachment() the sg_table's address has to match the
++// The one returned from dma_buf_map_attachment() - otherwise we would need to malloc each time
++struct hailo_dmabuf_info {
++    struct dma_buf *dmabuf;
++    struct dma_buf_attachment *dmabuf_attachment;
++    struct sg_table *dmabuf_sg_table;
++};
++#endif // LINUX_VERSION_CODE < KERNEL_VERSION( 3, 3, 0 )
++
+ struct hailo_vdma_buffer {
+     struct list_head            mapped_user_buffer_list;
+     size_t                      handle;
+@@ -35,7 +53,7 @@ struct hailo_vdma_buffer {
+     struct kref                 kref;
+     struct device               *device;
+ 
+-    void __user                 *user_address;
++    uintptr_t                   user_address;
+     u32                         size;
+     enum dma_data_direction     data_direction;
+     struct sg_table             sg_table;
+@@ -44,7 +62,10 @@ struct hailo_vdma_buffer {
+     // 'struct page' (only by pure pfn). On this case, accessing to the page,
+     // or calling APIs that access the page (e.g. dma_sync_sg_for_cpu) is not
+     // allowed.
+-    bool                       is_mmio;
++    bool                        is_mmio;
++
++    // Relevant paramaters that need to be saved in case of dmabuf - otherwise struct pointers will be NULL
++    struct hailo_dmabuf_info  dmabuf_info;
+ };
+ 
+ // Continuous buffer that holds a descriptor list.
+@@ -53,7 +74,7 @@ struct hailo_descriptors_list_buffer {
+     uintptr_t                          handle;
+     void                               *kernel_address;
+     dma_addr_t                         dma_address;
+-    u32                           buffer_size;
++    u32                                buffer_size;
+     struct hailo_vdma_descriptors_list desc_list;
+ };
+ 
+@@ -120,9 +141,6 @@ int hailo_vdma_controller_init(struct ha
+ void hailo_vdma_update_interrupts_mask(struct hailo_vdma_controller *controller,
+     size_t engine_index);
+ 
+-void hailo_vdma_engine_interrupts_disable(struct hailo_vdma_controller *controller,
+-    struct hailo_vdma_engine *engine, u8 engine_index, u32 channels_bitmap);
+-
+ void hailo_vdma_file_context_init(struct hailo_vdma_file_context *context);
+ void hailo_vdma_file_context_finalize(struct hailo_vdma_file_context *context,
+     struct hailo_vdma_controller *controller, struct file *filp);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0467-drivers-media-pci-Add-wrapper-after-removal-of-follo.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0467-drivers-media-pci-Add-wrapper-after-removal-of-follo.patch
new file mode 100644
index 00000000..13c7faff
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0467-drivers-media-pci-Add-wrapper-after-removal-of-follo.patch
@@ -0,0 +1,77 @@
+From 6e94b8635e28c8372797ba34d5c30a57f0addf45 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Fri, 31 May 2024 15:15:07 +0100
+Subject: [PATCH 467/697] drivers: media: pci: Add wrapper after removal of
+ follow_pfn
+
+---
+ drivers/media/pci/hailo/vdma/memory.c      | 34 +++++++++++++++++++++-
+ drivers/regulator/rpi-panel-v2-regulator.c |  2 +-
+ 2 files changed, 34 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/pci/hailo/vdma/memory.c
++++ b/drivers/media/pci/hailo/vdma/memory.c
+@@ -8,12 +8,12 @@
+ #include "memory.h"
+ #include "utils/compact.h"
+ 
++#include <linux/highmem-internal.h>
+ #include <linux/slab.h>
+ #include <linux/scatterlist.h>
+ #include <linux/sched.h>
+ #include <linux/module.h>
+ 
+-
+ #define SGL_MAX_SEGMENT_SIZE 	(0x10000)
+ // See linux/mm.h
+ #define MMIO_AND_NO_PAGES_VMA_MASK (VM_IO | VM_PFNMAP)
+@@ -499,6 +499,38 @@ void hailo_vdma_clear_continuous_buffer_
+     }
+ }
+ 
++/**
++ * follow_pfn - look up PFN at a user virtual address
++ * @vma: memory mapping
++ * @address: user virtual address
++ * @pfn: location to store found PFN
++ *
++ * Only IO mappings and raw PFN mappings are allowed.
++ *
++ * This function does not allow the caller to read the permissions
++ * of the PTE.  Do not use it.
++ *
++ * Return: zero and the pfn at @pfn on success, -ve otherwise.
++ */
++static int follow_pfn(struct vm_area_struct *vma, unsigned long address,
++       unsigned long *pfn)
++{
++       int ret = -EINVAL;
++       spinlock_t *ptl;
++       pte_t *ptep;
++
++       if (!(vma->vm_flags & (VM_IO | VM_PFNMAP)))
++               return ret;
++
++       ret = follow_pte(vma, address, &ptep, &ptl);
++       if (ret)
++               return ret;
++       *pfn = pte_pfn(ptep_get(ptep));
++       pte_unmap_unlock(ptep, ptl);
++       return 0;
++}
++
++
+ // Assumes the provided user_address belongs to the vma and that MMIO_AND_NO_PAGES_VMA_MASK bits are set under
+ // vma->vm_flags. This is validated in hailo_vdma_buffer_map, and won't be checked here
+ #if defined(HAILO_SUPPORT_MMIO_DMA_MAPPING)
+--- a/drivers/regulator/rpi-panel-v2-regulator.c
++++ b/drivers/regulator/rpi-panel-v2-regulator.c
+@@ -77,7 +77,7 @@ static int rpi_panel_v2_update_status(st
+ 	int brightness = bl->props.brightness;
+ 
+ 	if (bl->props.power != FB_BLANK_UNBLANK ||
+-	    bl->props.fb_blank != FB_BLANK_UNBLANK)
++	    bl->props.state & (BL_CORE_SUSPENDED | BL_CORE_FBBLANK))
+ 		brightness = 0;
+ 
+ 	return regmap_write(regmap, REG_PWM, brightness | PWM_BL_ENABLE);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0468-drivers-media-pci-Fix-Hailo-compile-warnings.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0468-drivers-media-pci-Fix-Hailo-compile-warnings.patch
new file mode 100644
index 00000000..67af91e1
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0468-drivers-media-pci-Fix-Hailo-compile-warnings.patch
@@ -0,0 +1,41 @@
+From e81532d08c3029362817cd407747f44a15075c4d Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 2 Sep 2024 09:01:45 +0100
+Subject: [PATCH 468/697] drivers: media: pci: Fix Hailo compile warnings
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/media/pci/hailo/common/pcie_common.c | 2 +-
+ drivers/media/pci/hailo/vdma/memory.c        | 3 ++-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/pci/hailo/common/pcie_common.c
++++ b/drivers/media/pci/hailo/common/pcie_common.c
+@@ -656,7 +656,7 @@ int hailo_pcie_write_firmware(struct hai
+ }
+ 
+ // TODO: HRT-14147 - remove this function
+-bool hailo_pcie_is_device_ready_for_boot(struct hailo_pcie_resources *resources)
++static bool hailo_pcie_is_device_ready_for_boot(struct hailo_pcie_resources *resources)
+ {
+     return hailo_get_boot_status(resources) == BOOT_STATUS_UNINITIALIZED;
+ }
+--- a/drivers/media/pci/hailo/vdma/memory.c
++++ b/drivers/media/pci/hailo/vdma/memory.c
+@@ -512,6 +512,7 @@ void hailo_vdma_clear_continuous_buffer_
+  *
+  * Return: zero and the pfn at @pfn on success, -ve otherwise.
+  */
++#if defined(HAILO_SUPPORT_MMIO_DMA_MAPPING)
+ static int follow_pfn(struct vm_area_struct *vma, unsigned long address,
+        unsigned long *pfn)
+ {
+@@ -529,7 +530,7 @@ static int follow_pfn(struct vm_area_str
+        pte_unmap_unlock(ptep, ptl);
+        return 0;
+ }
+-
++#endif
+ 
+ // Assumes the provided user_address belongs to the vma and that MMIO_AND_NO_PAGES_VMA_MASK bits are set under
+ // vma->vm_flags. This is validated in hailo_vdma_buffer_map, and won't be checked here
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0469-staging-vc04_services-Add-helpers-for-vchiq-driver-d.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0469-staging-vc04_services-Add-helpers-for-vchiq-driver-d.patch
new file mode 100644
index 00000000..1b5982b2
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0469-staging-vc04_services-Add-helpers-for-vchiq-driver-d.patch
@@ -0,0 +1,35 @@
+From c93aacbaa8f0018f5f701810ed4ea8c197e13b57 Mon Sep 17 00:00:00 2001
+From: Umang Jain <umang.jain@ideasonboard.com>
+Date: Thu, 9 Nov 2023 16:03:01 -0500
+Subject: [PATCH 469/697] staging: vc04_services: Add helpers for vchiq driver
+ data
+
+Add helpers to set and get vchiq driver data. vchiq_set_drvdata() and
+vchiq_get_drvdata() wraps dev_set_drvdata() and dev_get_drvdata()
+respectively.
+
+Signed-off-by: Umang Jain <umang.jain@ideasonboard.com>
+Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+---
+ .../vc04_services/interface/vchiq_arm/vchiq_bus.h      | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_bus.h
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_bus.h
+@@ -37,6 +37,16 @@ static inline struct vchiq_driver *to_vc
+ 	return container_of(d, struct vchiq_driver, driver);
+ }
+ 
++static inline void *vchiq_get_drvdata(const struct vchiq_device *device)
++{
++	return dev_get_drvdata(&device->dev);
++}
++
++static inline void vchiq_set_drvdata(struct vchiq_device *device, void *data)
++{
++	dev_set_drvdata(&device->dev, data);
++}
++
+ extern const struct bus_type vchiq_bus_type;
+ 
+ struct vchiq_device *
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0470-staging-vc04_services-vc-sm-cma-Remove-deprecated-he.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0470-staging-vc04_services-vc-sm-cma-Remove-deprecated-he.patch
new file mode 100644
index 00000000..d6fd8a12
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0470-staging-vc04_services-vc-sm-cma-Remove-deprecated-he.patch
@@ -0,0 +1,30 @@
+From f810d05623d1b1ba81d12794c232b954210bebff Mon Sep 17 00:00:00 2001
+From: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Date: Mon, 3 Jun 2024 16:01:35 +0100
+Subject: [PATCH 470/697] staging: vc04_services: vc-sm-cma: Remove deprecated
+ header
+
+The vchiq_connected.h header was removed in f875976ecf45 ("staging:
+vc04_services: Drop vchiq_connected.[ch] files") to simplify the
+implementation.
+
+Update the vc_sm driver accordingly which can still use the same
+functions through the vchiq_arm.h header declarations.
+
+Fixes: b1ab7a05eb6c ("staging: vc04_services: Add new vc-sm-cma driver")
+Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+---
+ drivers/staging/vc04_services/vc-sm-cma/vc_sm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
++++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+@@ -48,7 +48,7 @@
+ #include <linux/types.h>
+ #include <asm/cacheflush.h>
+ 
+-#include "vchiq_connected.h"
++#include "../interface/vchiq_arm/vchiq_arm.h"
+ #include "vc_sm_cma_vchi.h"
+ 
+ #include "vc_sm.h"
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0471-staging-vc04_services-vc-sm-cma-Drop-include-Makefil.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0471-staging-vc04_services-vc-sm-cma-Drop-include-Makefil.patch
new file mode 100644
index 00000000..2c7d6f29
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0471-staging-vc04_services-vc-sm-cma-Drop-include-Makefil.patch
@@ -0,0 +1,58 @@
+From 87874a984b5e29a0d5d6a418c58098fa7bb8772f Mon Sep 17 00:00:00 2001
+From: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Date: Mon, 3 Jun 2024 17:01:50 +0100
+Subject: [PATCH 471/697] staging: vc04_services: vc-sm-cma: Drop include
+ Makefile directive
+
+Drop the include directive. They can break the build, when one only
+wants to build a subdirectory. Replace with "../" for the includes in
+the vc_sm files instead.
+
+The fix is equivalent to the four patches between 29d49a76c5b2
+("staging: vc04_services: bcm2835-audio: Drop include Makefile
+directive")...2529ca211402 ("staging: vc04_services: interface: Drop
+include Makefile directive")
+
+Fixes: b1ab7a05eb6c ("staging: vc04_services: Add new vc-sm-cma driver")
+Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+---
+ drivers/staging/vc04_services/vc-sm-cma/Makefile         | 5 -----
+ drivers/staging/vc04_services/vc-sm-cma/vc_sm.c          | 2 +-
+ drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.h | 2 +-
+ 3 files changed, 2 insertions(+), 7 deletions(-)
+
+--- a/drivers/staging/vc04_services/vc-sm-cma/Makefile
++++ b/drivers/staging/vc04_services/vc-sm-cma/Makefile
+@@ -1,9 +1,4 @@
+ ccflags-y += \
+-	-I$(srctree)/$(src)/../ \
+-	-I$(srctree)/$(src)/../interface/vchiq_arm\
+-	-I$(srctree)/$(src)/../include
+-
+-ccflags-y += \
+ 	-D__VCCOREVER__=0
+ 
+ vc-sm-cma-$(CONFIG_BCM_VC_SM_CMA) := \
+--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
++++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+@@ -53,7 +53,7 @@
+ 
+ #include "vc_sm.h"
+ #include "vc_sm_knl.h"
+-#include <linux/broadcom/vc_sm_cma_ioctl.h>
++#include "../include/linux/broadcom/vc_sm_cma_ioctl.h"
+ 
+ MODULE_IMPORT_NS(DMA_BUF);
+ 
+--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.h
++++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.h
+@@ -13,7 +13,7 @@
+ #ifndef __VC_SM_CMA_VCHI_H__INCLUDED__
+ #define __VC_SM_CMA_VCHI_H__INCLUDED__
+ 
+-#include <linux/raspberrypi/vchiq.h>
++#include "../include/linux/raspberrypi/vchiq.h"
+ 
+ #include "vc_sm_defs.h"
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0472-staging-vc04_services-vc-sm-cma-Register-with-vchiq_.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0472-staging-vc04_services-vc-sm-cma-Register-with-vchiq_.patch
new file mode 100644
index 00000000..88280995
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0472-staging-vc04_services-vc-sm-cma-Register-with-vchiq_.patch
@@ -0,0 +1,206 @@
+From 7a5cc238e7cc5457ffd0d3366c5a4f36fa696764 Mon Sep 17 00:00:00 2001
+From: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Date: Mon, 3 Jun 2024 17:34:03 +0100
+Subject: [PATCH 472/697] staging: vc04_services: vc-sm-cma: Register with
+ vchiq_bus_type
+
+Register the vcsm rive with the vchiq_bus_type instead of useing the
+platform driver/device.
+
+Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+---
+ .../staging/vc04_services/vc-sm-cma/vc_sm.c   | 55 +++++++++++--------
+ 1 file changed, 31 insertions(+), 24 deletions(-)
+
+--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
++++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+@@ -40,7 +40,6 @@
+ #include <linux/module.h>
+ #include <linux/mm.h>
+ #include <linux/of_device.h>
+-#include <linux/platform_device.h>
+ #include <linux/proc_fs.h>
+ #include <linux/slab.h>
+ #include <linux/seq_file.h>
+@@ -49,6 +48,7 @@
+ #include <asm/cacheflush.h>
+ 
+ #include "../interface/vchiq_arm/vchiq_arm.h"
++#include "../interface/vchiq_arm/vchiq_bus.h"
+ #include "vc_sm_cma_vchi.h"
+ 
+ #include "vc_sm.h"
+@@ -85,7 +85,7 @@ struct sm_pde_t {
+ 
+ /* Global state information. */
+ struct sm_state_t {
+-	struct platform_device *pdev;
++	struct vchiq_device *device;
+ 
+ 	struct miscdevice misc_dev;
+ 
+@@ -323,7 +323,7 @@ static void vc_sm_release_resource(struc
+ 			       __func__, buffer);
+ 		buffer->import.dma_buf = NULL;
+ 	} else {
+-		dma_free_coherent(&sm_state->pdev->dev, buffer->size,
++		dma_free_coherent(&sm_state->device->dev, buffer->size,
+ 				  buffer->cookie, buffer->dma_addr);
+ 	}
+ 
+@@ -494,7 +494,7 @@ static int vc_sm_dmabuf_mmap(struct dma_
+ 	/* now map it to userspace */
+ 	vma->vm_pgoff = 0;
+ 
+-	ret = dma_mmap_coherent(&sm_state->pdev->dev, vma, buf->cookie,
++	ret = dma_mmap_coherent(&sm_state->device->dev, vma, buf->cookie,
+ 				buf->dma_addr, buf->size);
+ 
+ 	if (ret) {
+@@ -729,7 +729,7 @@ vc_sm_cma_import_dmabuf_internal(struct
+ 	if (!dma_buf)
+ 		return -EINVAL;
+ 
+-	attach = dma_buf_attach(dma_buf, &sm_state->pdev->dev);
++	attach = dma_buf_attach(dma_buf, &sm_state->device->dev);
+ 	if (IS_ERR(attach)) {
+ 		ret = PTR_ERR(attach);
+ 		goto error;
+@@ -880,7 +880,7 @@ static int vc_sm_cma_vpu_alloc(u32 size,
+ 	 */
+ 	mutex_lock(&buffer->lock);
+ 
+-	buffer->cookie = dma_alloc_coherent(&sm_state->pdev->dev,
++	buffer->cookie = dma_alloc_coherent(&sm_state->device->dev,
+ 					    aligned_size, &buffer->dma_addr,
+ 					    GFP_KERNEL);
+ 	if (!buffer->cookie) {
+@@ -899,7 +899,7 @@ static int vc_sm_cma_vpu_alloc(u32 size,
+ 		goto error;
+ 	}
+ 
+-	ret = dma_get_sgtable(&sm_state->pdev->dev, sgt, buffer->cookie,
++	ret = dma_get_sgtable(&sm_state->device->dev, sgt, buffer->cookie,
+ 			      buffer->dma_addr, buffer->size);
+ 	if (ret < 0) {
+ 		pr_err("failed to get scatterlist from DMA API\n");
+@@ -1116,7 +1116,7 @@ static int vc_sm_cma_ioctl_alloc(struct
+ 		goto error;
+ 	}
+ 
+-	buffer->cookie = dma_alloc_coherent(&sm_state->pdev->dev,
++	buffer->cookie = dma_alloc_coherent(&sm_state->device->dev,
+ 					    aligned_size,
+ 					    &buffer->dma_addr,
+ 					    GFP_KERNEL);
+@@ -1187,7 +1187,7 @@ static int vc_sm_cma_ioctl_alloc(struct
+ 		goto error;
+ 	}
+ 
+-	ret = dma_get_sgtable(&sm_state->pdev->dev, sgt, buffer->cookie,
++	ret = dma_get_sgtable(&sm_state->device->dev, sgt, buffer->cookie,
+ 			      buffer->dma_addr, buffer->size);
+ 	if (ret < 0) {
+ 		/* FIXME: error handling */
+@@ -1224,7 +1224,7 @@ error:
+ 	} else {
+ 		/* No dmabuf, therefore just free the buffer here */
+ 		if (buffer->cookie)
+-			dma_free_coherent(&sm_state->pdev->dev, buffer->size,
++			dma_free_coherent(&sm_state->device->dev, buffer->size,
+ 					  buffer->cookie, buffer->dma_addr);
+ 		kfree(buffer);
+ 	}
+@@ -1382,13 +1382,21 @@ static void vc_sm_connected_init(void)
+ 	struct vc_sm_version version;
+ 	struct vc_sm_result_t version_result;
+ 
++	/*
++	 * Digging the vchiq_drv_mgmt, so low here and through a global seems
++	 * suspicious.
++	 *
++	 * The callbacks should be able to pass a parameter or context.
++	 */
++	struct vchiq_drv_mgmt *mgmt = dev_get_drvdata(sm_state->device->dev.parent);
++
+ 	pr_info("[%s]: start\n", __func__);
+ 
+ 	/*
+ 	 * Initialize and create a VCHI connection for the shared memory service
+ 	 * running on videocore.
+ 	 */
+-	ret = vchiq_initialise(&sm_state->vchiq_instance);
++	ret = vchiq_initialise(&mgmt->state, &sm_state->vchiq_instance);
+ 	if (ret) {
+ 		pr_err("[%s]: failed to initialise VCHI instance (ret=%d)\n",
+ 		       __func__, ret);
+@@ -1467,31 +1475,31 @@ err_remove_debugfs:
+ }
+ 
+ /* Driver loading. */
+-static int bcm2835_vc_sm_cma_probe(struct platform_device *pdev)
++static int bcm2835_vc_sm_cma_probe(struct vchiq_device *device)
+ {
+ 	pr_info("%s: Videocore shared memory driver\n", __func__);
+ 
+-	sm_state = devm_kzalloc(&pdev->dev, sizeof(*sm_state), GFP_KERNEL);
++	sm_state = devm_kzalloc(&device->dev, sizeof(*sm_state), GFP_KERNEL);
+ 	if (!sm_state)
+ 		return -ENOMEM;
+-	sm_state->pdev = pdev;
++	sm_state->device = device;
+ 	mutex_init(&sm_state->map_lock);
+ 
+ 	spin_lock_init(&sm_state->kernelid_map_lock);
+ 	idr_init_base(&sm_state->kernelid_map, 1);
+ 
+-	pdev->dev.dma_parms = devm_kzalloc(&pdev->dev,
+-					   sizeof(*pdev->dev.dma_parms),
+-					   GFP_KERNEL);
++	device->dev.dma_parms = devm_kzalloc(&device->dev,
++					     sizeof(*device->dev.dma_parms),
++					     GFP_KERNEL);
+ 	/* dma_set_max_seg_size checks if dma_parms is NULL. */
+-	dma_set_max_seg_size(&pdev->dev, 0x3FFFFFFF);
++	dma_set_max_seg_size(&device->dev, 0x3FFFFFFF);
+ 
+-	vchiq_add_connected_callback(vc_sm_connected_init);
++	vchiq_add_connected_callback(device, vc_sm_connected_init);
+ 	return 0;
+ }
+ 
+ /* Driver unloading. */
+-static int bcm2835_vc_sm_cma_remove(struct platform_device *pdev)
++static void bcm2835_vc_sm_cma_remove(struct vchiq_device *device)
+ {
+ 	pr_debug("[%s]: start\n", __func__);
+ 	if (sm_inited) {
+@@ -1512,7 +1520,6 @@ static int bcm2835_vc_sm_cma_remove(stru
+ 	}
+ 
+ 	pr_debug("[%s]: end\n", __func__);
+-	return 0;
+ }
+ 
+ /* Kernel API calls */
+@@ -1586,7 +1593,7 @@ int vc_sm_cma_import_dmabuf(struct dma_b
+ }
+ EXPORT_SYMBOL_GPL(vc_sm_cma_import_dmabuf);
+ 
+-static struct platform_driver bcm2835_vcsm_cma_driver = {
++static struct vchiq_driver bcm2835_vcsm_cma_driver = {
+ 	.probe = bcm2835_vc_sm_cma_probe,
+ 	.remove = bcm2835_vc_sm_cma_remove,
+ 	.driver = {
+@@ -1595,9 +1602,9 @@ static struct platform_driver bcm2835_vc
+ 		   },
+ };
+ 
+-module_platform_driver(bcm2835_vcsm_cma_driver);
++module_vchiq_driver(bcm2835_vcsm_cma_driver);
+ 
+ MODULE_AUTHOR("Dave Stevenson");
+ MODULE_DESCRIPTION("VideoCore CMA Shared Memory Driver");
+ MODULE_LICENSE("GPL v2");
+-MODULE_ALIAS("platform:vcsm-cma");
++MODULE_ALIAS("vcsm-cma");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0473-arm-bcm2835-Add-bcm2838-compatible-string.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0473-arm-bcm2835-Add-bcm2838-compatible-string.patch
new file mode 100644
index 00000000..37069358
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0473-arm-bcm2835-Add-bcm2838-compatible-string.patch
@@ -0,0 +1,20 @@
+From c193561326e3d66e551a69cecd146791fd088f24 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Tue, 11 Jun 2019 17:38:28 +0100
+Subject: [PATCH 473/697] arm: bcm2835: Add bcm2838 compatible string.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ arch/arm/mach-bcm/board_bcm2835.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/mach-bcm/board_bcm2835.c
++++ b/arch/arm/mach-bcm/board_bcm2835.c
+@@ -109,6 +109,7 @@ static const char * const bcm2835_compat
+ #ifdef CONFIG_ARCH_MULTI_V7
+ 	"brcm,bcm2836",
+ 	"brcm,bcm2837",
++	"brcm,bcm2838",
+ #endif
+ 	NULL
+ };
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0474-ARM-bcm-Switch-board-clk-and-pinctrl-to-bcm2711-comp.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0474-ARM-bcm-Switch-board-clk-and-pinctrl-to-bcm2711-comp.patch
new file mode 100644
index 00000000..94d1ad34
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0474-ARM-bcm-Switch-board-clk-and-pinctrl-to-bcm2711-comp.patch
@@ -0,0 +1,26 @@
+From 03f817757de297f44b89e61f857df8b615bf0c78 Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <wahrenst@gmx.net>
+Date: Thu, 19 Sep 2019 20:45:30 +0200
+Subject: [PATCH 474/697] ARM: bcm: Switch board, clk and pinctrl to bcm2711
+ compatible
+
+After the decision to use bcm2711 compatible for upstream, we should
+switch all accepted compatibles to bcm2711. So we can boot with
+one DTB the down- and the upstream kernel.
+
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+---
+ arch/arm/mach-bcm/board_bcm2835.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/mach-bcm/board_bcm2835.c
++++ b/arch/arm/mach-bcm/board_bcm2835.c
+@@ -109,7 +109,7 @@ static const char * const bcm2835_compat
+ #ifdef CONFIG_ARCH_MULTI_V7
+ 	"brcm,bcm2836",
+ 	"brcm,bcm2837",
+-	"brcm,bcm2838",
++	"brcm,bcm2711",
+ #endif
+ 	NULL
+ };
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0475-media-bcm2835-unicam-Add-support-for-12bit-mono-pack.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0475-media-bcm2835-unicam-Add-support-for-12bit-mono-pack.patch
new file mode 100644
index 00000000..12dba52b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0475-media-bcm2835-unicam-Add-support-for-12bit-mono-pack.patch
@@ -0,0 +1,25 @@
+From 49b9dbb4256da154a220fdca0f8e458321287d2c Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 25 Jun 2020 17:53:32 +0100
+Subject: [PATCH 475/697] media: bcm2835-unicam: Add support for 12bit mono
+ packed format
+
+Now that V4L2_PIX_FMT_Y12P is defined, allow passing raw 12bit
+mono packed data through the peripheral.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -441,7 +441,7 @@ static const struct unicam_fmt formats[]
+ 		.csi_dt		= MIPI_CSI2_DT_RAW10,
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+-		/* NB There is no packed V4L2 fourcc for this format. */
++		.fourcc		= V4L2_PIX_FMT_Y12P,
+ 		.repacked_fourcc = V4L2_PIX_FMT_Y12,
+ 		.code		= MEDIA_BUS_FMT_Y12_1X12,
+ 		.depth		= 12,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0476-media-bcm2835-unicam-Add-support-for-14bit-mono-sour.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0476-media-bcm2835-unicam-Add-support-for-14bit-mono-sour.patch
new file mode 100644
index 00000000..34e61e2d
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0476-media-bcm2835-unicam-Add-support-for-14bit-mono-sour.patch
@@ -0,0 +1,29 @@
+From eae72561c3578b7f3c29df7740c066cb7d0c23b6 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 25 Jun 2020 18:03:47 +0100
+Subject: [PATCH 476/697] media: bcm2835-unicam: Add support for 14bit mono
+ sources
+
+Now that V4L2_PIX_FMT_Y14 and V4L2_PIX_FMT_Y14P are defined,
+allow passing 14bit mono data through the peripheral.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -446,6 +446,12 @@ static const struct unicam_fmt formats[]
+ 		.code		= MEDIA_BUS_FMT_Y12_1X12,
+ 		.depth		= 12,
+ 		.csi_dt		= MIPI_CSI2_DT_RAW12,
++	}, {
++		.fourcc		= V4L2_PIX_FMT_Y14P,
++		.repacked_fourcc = V4L2_PIX_FMT_Y14,
++		.code		= MEDIA_BUS_FMT_Y14_1X14,
++		.depth		= 14,
++		.csi_dt		= MIPI_CSI2_DT_RAW14,
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_Y16,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0477-media-bcm2835-unicam-Add-support-for-unpacked-14bit-.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0477-media-bcm2835-unicam-Add-support-for-unpacked-14bit-.patch
new file mode 100644
index 00000000..75cc0626
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0477-media-bcm2835-unicam-Add-support-for-unpacked-14bit-.patch
@@ -0,0 +1,45 @@
+From 0f7236c2f61de2c532350f2e69a6a5290e49330d Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 1 Jul 2020 10:57:57 +0100
+Subject: [PATCH 477/697] media: bcm2835-unicam: Add support for unpacked 14bit
+ Bayer formats
+
+Now that the 14bit non-packed Bayer formats are defined, add them
+into the supported formats lookup table.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -379,24 +379,28 @@ static const struct unicam_fmt formats[]
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SBGGR14P,
++		.repacked_fourcc = V4L2_PIX_FMT_SBGGR14,
+ 		.code		= MEDIA_BUS_FMT_SBGGR14_1X14,
+ 		.depth		= 14,
+ 		.csi_dt		= MIPI_CSI2_DT_RAW14,
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGBRG14P,
++		.repacked_fourcc = V4L2_PIX_FMT_SGBRG14,
+ 		.code		= MEDIA_BUS_FMT_SGBRG14_1X14,
+ 		.depth		= 14,
+ 		.csi_dt		= MIPI_CSI2_DT_RAW14,
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SGRBG14P,
++		.repacked_fourcc = V4L2_PIX_FMT_SGRBG14,
+ 		.code		= MEDIA_BUS_FMT_SGRBG14_1X14,
+ 		.depth		= 14,
+ 		.csi_dt		= MIPI_CSI2_DT_RAW14,
+ 		.valid_colorspaces = MASK_CS_RAW,
+ 	}, {
+ 		.fourcc		= V4L2_PIX_FMT_SRGGB14P,
++		.repacked_fourcc = V4L2_PIX_FMT_SRGGB14,
+ 		.code		= MEDIA_BUS_FMT_SRGGB14_1X14,
+ 		.depth		= 14,
+ 		.csi_dt		= MIPI_CSI2_DT_RAW14,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0478-lan78xx-Read-initial-EEE-status-from-DT.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0478-lan78xx-Read-initial-EEE-status-from-DT.patch
new file mode 100644
index 00000000..945b94cd
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0478-lan78xx-Read-initial-EEE-status-from-DT.patch
@@ -0,0 +1,45 @@
+From 1ddf09acee075f2c805e57e925d5df17fa82ece7 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 11 Jun 2024 16:44:07 +0100
+Subject: [PATCH 478/697] lan78xx: Read initial EEE status from DT
+
+Add two new DT properties:
+* microchip,eee-enabled  - a boolean to enable EEE
+* microchip,tx-lpi-timer - time in microseconds to wait before entering
+                           low power state
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/net/usb/lan78xx.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -2422,7 +2422,26 @@ static int lan78xx_phy_init(struct lan78
+ 	mii_adv_to_linkmode_adv_t(fc, mii_adv);
+ 	linkmode_or(phydev->advertising, fc, phydev->advertising);
+ 
+-	phy_support_eee(phydev);
++	if (of_property_read_bool(phydev->mdio.dev.of_node,
++				  "microchip,eee-enabled")) {
++		struct ethtool_keee edata;
++		memset(&edata, 0, sizeof(edata));
++
++		linkmode_set_bit(ETHTOOL_LINK_MODE_1000baseT_Full_BIT,
++			edata.advertised);
++		linkmode_set_bit(ETHTOOL_LINK_MODE_100baseT_Full_BIT,
++			edata.advertised);
++
++		edata.eee_enabled = true;
++		edata.tx_lpi_enabled = true;
++		if (of_property_read_u32(phydev->mdio.dev.of_node,
++					 "microchip,tx-lpi-timer",
++					 &edata.tx_lpi_timer))
++			edata.tx_lpi_timer = 600; /* non-aggressive */
++		(void)lan78xx_set_eee(dev->net, &edata);
++
++		phy_support_eee(phydev);
++	}
+ 
+ 	if (phydev->mdio.dev.of_node) {
+ 		u32 reg;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0479-lan78xx-Return-tx_lpi_timer-even-if-disabled.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0479-lan78xx-Return-tx_lpi_timer-even-if-disabled.patch
new file mode 100644
index 00000000..d163415d
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0479-lan78xx-Return-tx_lpi_timer-even-if-disabled.patch
@@ -0,0 +1,33 @@
+From 98d7c377d4993d191c027039cc6bce395851c311 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 12 Jun 2024 16:11:19 +0100
+Subject: [PATCH 479/697] lan78xx: Return tx_lpi_timer even if disabled
+
+Disabling tx_lpi or eee should not cause the value of tx_lpi_timer to
+be lost, even though it is not useful until they are re-enabled.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/net/usb/lan78xx.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -1702,14 +1702,11 @@ static int lan78xx_get_eee(struct net_de
+ 	if (ret < 0)
+ 		goto exit;
+ 
+-	ret = lan78xx_read_reg(dev, MAC_CR, &buf);
+-	if (buf & MAC_CR_EEE_EN_) {
+-		/* EEE_TX_LPI_REQ_DLY & tx_lpi_timer are same uSec unit */
+-		ret = lan78xx_read_reg(dev, EEE_TX_LPI_REQ_DLY, &buf);
++	ret = lan78xx_read_reg(dev, EEE_TX_LPI_REQ_DLY, &buf);
++	if (ret >= 0)
+ 		edata->tx_lpi_timer = buf;
+-	} else {
++	else
+ 		edata->tx_lpi_timer = 0;
+-	}
+ 
+ 	ret = 0;
+ exit:
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0480-staging-vc04_services-vc-sm-cma-Explicitly-set-DMA-m.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0480-staging-vc04_services-vc-sm-cma-Explicitly-set-DMA-m.patch
new file mode 100644
index 00000000..f6719c0f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0480-staging-vc04_services-vc-sm-cma-Explicitly-set-DMA-m.patch
@@ -0,0 +1,34 @@
+From 33085be58a205549c561ef5b23242ed05f253bb0 Mon Sep 17 00:00:00 2001
+From: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Date: Thu, 6 Jun 2024 16:38:02 +0100
+Subject: [PATCH 480/697] staging: vc04_services: vc-sm-cma: Explicitly set DMA
+ mask
+
+The platform model originally handled the DMA mask. Now that
+we are on the vchiq_bus we need to explicitly set this.
+
+Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+---
+ drivers/staging/vc04_services/vc-sm-cma/vc_sm.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
++++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+@@ -1477,8 +1477,17 @@ err_remove_debugfs:
+ /* Driver loading. */
+ static int bcm2835_vc_sm_cma_probe(struct vchiq_device *device)
+ {
++	int err;
++
+ 	pr_info("%s: Videocore shared memory driver\n", __func__);
+ 
++	err = dma_set_mask_and_coherent(&device->dev, DMA_BIT_MASK(32));
++	if (err) {
++		dev_err(&device->dev, "dma_set_mask_and_coherent failed: %d\n",
++			err);
++		return err;
++	}
++
+ 	sm_state = devm_kzalloc(&device->dev, sizeof(*sm_state), GFP_KERNEL);
+ 	if (!sm_state)
+ 		return -ENOMEM;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0481-media-pisp-be-Backport-the-mainline-PiSP-BE-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0481-media-pisp-be-Backport-the-mainline-PiSP-BE-driver.patch
new file mode 100644
index 00000000..50ee7b94
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0481-media-pisp-be-Backport-the-mainline-PiSP-BE-driver.patch
@@ -0,0 +1,553 @@
+From 7789bb1a9a9c9b8860f776a092b40a81cf0ba316 Mon Sep 17 00:00:00 2001
+From: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Date: Thu, 27 Jun 2024 11:41:22 +0200
+Subject: [PATCH 481/697] media: pisp-be: Backport the mainline PiSP BE driver
+
+Backport to rpi-6.6.y the mainline version of the PiSP BE driver.
+
+The backported version of the driver corresponds to the one available
+at:
+https://lore.kernel.org/all/20240626181440.195137-1-jacopo.mondi@ideasonboard.com/
+
+Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+---
+ .../raspberrypi/pisp_be/pisp_be_config.h      | 533 ------------------
+ 1 file changed, 533 deletions(-)
+ delete mode 100644 drivers/media/platform/raspberrypi/pisp_be/pisp_be_config.h
+
+--- a/drivers/media/platform/raspberrypi/pisp_be/pisp_be_config.h
++++ /dev/null
+@@ -1,533 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+-/*
+- * PiSP Back End configuration definitions.
+- *
+- * Copyright (C) 2021 - Raspberry Pi Ltd
+- *
+- */
+-#ifndef _PISP_BE_CONFIG_H_
+-#define _PISP_BE_CONFIG_H_
+-
+-#include <linux/types.h>
+-
+-#include <media/raspberrypi/pisp_common.h>
+-
+-/* byte alignment for inputs */
+-#define PISP_BACK_END_INPUT_ALIGN 4u
+-/* alignment for compressed inputs */
+-#define PISP_BACK_END_COMPRESSED_ALIGN 8u
+-/* minimum required byte alignment for outputs */
+-#define PISP_BACK_END_OUTPUT_MIN_ALIGN 16u
+-/* preferred byte alignment for outputs */
+-#define PISP_BACK_END_OUTPUT_MAX_ALIGN 64u
+-
+-/* minimum allowed tile width anywhere in the pipeline */
+-#define PISP_BACK_END_MIN_TILE_WIDTH 16u
+-/* minimum allowed tile width anywhere in the pipeline */
+-#define PISP_BACK_END_MIN_TILE_HEIGHT 16u
+-
+-#define PISP_BACK_END_NUM_OUTPUTS 2
+-#define PISP_BACK_END_HOG_OUTPUT 1
+-
+-#define PISP_BACK_END_NUM_TILES 64
+-
+-enum pisp_be_bayer_enable {
+-	PISP_BE_BAYER_ENABLE_INPUT = 0x000001,
+-	PISP_BE_BAYER_ENABLE_DECOMPRESS = 0x000002,
+-	PISP_BE_BAYER_ENABLE_DPC = 0x000004,
+-	PISP_BE_BAYER_ENABLE_GEQ = 0x000008,
+-	PISP_BE_BAYER_ENABLE_TDN_INPUT = 0x000010,
+-	PISP_BE_BAYER_ENABLE_TDN_DECOMPRESS = 0x000020,
+-	PISP_BE_BAYER_ENABLE_TDN = 0x000040,
+-	PISP_BE_BAYER_ENABLE_TDN_COMPRESS = 0x000080,
+-	PISP_BE_BAYER_ENABLE_TDN_OUTPUT = 0x000100,
+-	PISP_BE_BAYER_ENABLE_SDN = 0x000200,
+-	PISP_BE_BAYER_ENABLE_BLC = 0x000400,
+-	PISP_BE_BAYER_ENABLE_STITCH_INPUT = 0x000800,
+-	PISP_BE_BAYER_ENABLE_STITCH_DECOMPRESS = 0x001000,
+-	PISP_BE_BAYER_ENABLE_STITCH = 0x002000,
+-	PISP_BE_BAYER_ENABLE_STITCH_COMPRESS = 0x004000,
+-	PISP_BE_BAYER_ENABLE_STITCH_OUTPUT = 0x008000,
+-	PISP_BE_BAYER_ENABLE_WBG = 0x010000,
+-	PISP_BE_BAYER_ENABLE_CDN = 0x020000,
+-	PISP_BE_BAYER_ENABLE_LSC = 0x040000,
+-	PISP_BE_BAYER_ENABLE_TONEMAP = 0x080000,
+-	PISP_BE_BAYER_ENABLE_CAC = 0x100000,
+-	PISP_BE_BAYER_ENABLE_DEBIN = 0x200000,
+-	PISP_BE_BAYER_ENABLE_DEMOSAIC = 0x400000,
+-};
+-
+-enum pisp_be_rgb_enable {
+-	PISP_BE_RGB_ENABLE_INPUT = 0x000001,
+-	PISP_BE_RGB_ENABLE_CCM = 0x000002,
+-	PISP_BE_RGB_ENABLE_SAT_CONTROL = 0x000004,
+-	PISP_BE_RGB_ENABLE_YCBCR = 0x000008,
+-	PISP_BE_RGB_ENABLE_FALSE_COLOUR = 0x000010,
+-	PISP_BE_RGB_ENABLE_SHARPEN = 0x000020,
+-	/* Preferred colours would occupy 0x000040 */
+-	PISP_BE_RGB_ENABLE_YCBCR_INVERSE = 0x000080,
+-	PISP_BE_RGB_ENABLE_GAMMA = 0x000100,
+-	PISP_BE_RGB_ENABLE_CSC0 = 0x000200,
+-	PISP_BE_RGB_ENABLE_CSC1 = 0x000400,
+-	PISP_BE_RGB_ENABLE_DOWNSCALE0 = 0x001000,
+-	PISP_BE_RGB_ENABLE_DOWNSCALE1 = 0x002000,
+-	PISP_BE_RGB_ENABLE_RESAMPLE0 = 0x008000,
+-	PISP_BE_RGB_ENABLE_RESAMPLE1 = 0x010000,
+-	PISP_BE_RGB_ENABLE_OUTPUT0 = 0x040000,
+-	PISP_BE_RGB_ENABLE_OUTPUT1 = 0x080000,
+-	PISP_BE_RGB_ENABLE_HOG = 0x200000
+-};
+-
+-#define PISP_BE_RGB_ENABLE_CSC(i) (PISP_BE_RGB_ENABLE_CSC0 << (i))
+-#define PISP_BE_RGB_ENABLE_DOWNSCALE(i) (PISP_BE_RGB_ENABLE_DOWNSCALE0 << (i))
+-#define PISP_BE_RGB_ENABLE_RESAMPLE(i) (PISP_BE_RGB_ENABLE_RESAMPLE0 << (i))
+-#define PISP_BE_RGB_ENABLE_OUTPUT(i) (PISP_BE_RGB_ENABLE_OUTPUT0 << (i))
+-
+-/*
+- * We use the enable flags to show when blocks are "dirty", but we need some
+- * extra ones too.
+- */
+-enum pisp_be_dirty {
+-	PISP_BE_DIRTY_GLOBAL = 0x0001,
+-	PISP_BE_DIRTY_SH_FC_COMBINE = 0x0002,
+-	PISP_BE_DIRTY_CROP = 0x0004
+-};
+-
+-struct pisp_be_global_config {
+-	u32 bayer_enables;
+-	u32 rgb_enables;
+-	u8 bayer_order;
+-	u8 pad[3];
+-};
+-
+-struct pisp_be_input_buffer_config {
+-	/* low 32 bits followed by high 32 bits (for each of up to 3 planes) */
+-	u32 addr[3][2];
+-};
+-
+-struct pisp_be_dpc_config {
+-	u8 coeff_level;
+-	u8 coeff_range;
+-	u8 pad;
+-#define PISP_BE_DPC_FLAG_FOLDBACK 1
+-	u8 flags;
+-};
+-
+-struct pisp_be_geq_config {
+-	u16 offset;
+-#define PISP_BE_GEQ_SHARPER BIT(15)
+-#define PISP_BE_GEQ_SLOPE ((1 << 10) - 1)
+-	/* top bit is the "sharper" flag, slope value is bottom 10 bits */
+-	u16 slope_sharper;
+-	u16 min;
+-	u16 max;
+-};
+-
+-struct pisp_be_tdn_input_buffer_config {
+-	/* low 32 bits followed by high 32 bits */
+-	u32 addr[2];
+-};
+-
+-struct pisp_be_tdn_config {
+-	u16 black_level;
+-	u16 ratio;
+-	u16 noise_constant;
+-	u16 noise_slope;
+-	u16 threshold;
+-	u8 reset;
+-	u8 pad;
+-};
+-
+-struct pisp_be_tdn_output_buffer_config {
+-	/* low 32 bits followed by high 32 bits */
+-	u32 addr[2];
+-};
+-
+-struct pisp_be_sdn_config {
+-	u16 black_level;
+-	u8 leakage;
+-	u8 pad;
+-	u16 noise_constant;
+-	u16 noise_slope;
+-	u16 noise_constant2;
+-	u16 noise_slope2;
+-};
+-
+-struct pisp_be_stitch_input_buffer_config {
+-	/* low 32 bits followed by high 32 bits */
+-	u32 addr[2];
+-};
+-
+-#define PISP_BE_STITCH_STREAMING_LONG 0x8000
+-#define PISP_BE_STITCH_EXPOSURE_RATIO_MASK 0x7fff
+-
+-struct pisp_be_stitch_config {
+-	u16 threshold_lo;
+-	u8 threshold_diff_power;
+-	u8 pad;
+-
+-	/* top bit indicates whether streaming input is the long exposure */
+-	u16 exposure_ratio;
+-
+-	u8 motion_threshold_256;
+-	u8 motion_threshold_recip;
+-};
+-
+-struct pisp_be_stitch_output_buffer_config {
+-	/* low 32 bits followed by high 32 bits */
+-	u32 addr[2];
+-};
+-
+-struct pisp_be_cdn_config {
+-	u16 thresh;
+-	u8 iir_strength;
+-	u8 g_adjust;
+-};
+-
+-#define PISP_BE_LSC_LOG_GRID_SIZE 5
+-#define PISP_BE_LSC_GRID_SIZE (1 << PISP_BE_LSC_LOG_GRID_SIZE)
+-#define PISP_BE_LSC_STEP_PRECISION 18
+-
+-struct pisp_be_lsc_config {
+-	/* (1<<18) / grid_cell_width */
+-	u16 grid_step_x;
+-	/* (1<<18) / grid_cell_height */
+-	u16 grid_step_y;
+-	/* RGB gains jointly encoded in 32 bits */
+-	u32 lut_packed[PISP_BE_LSC_GRID_SIZE + 1]
+-			   [PISP_BE_LSC_GRID_SIZE + 1];
+-};
+-
+-struct pisp_be_lsc_extra {
+-	u16 offset_x;
+-	u16 offset_y;
+-};
+-
+-#define PISP_BE_CAC_LOG_GRID_SIZE 3
+-#define PISP_BE_CAC_GRID_SIZE (1 << PISP_BE_CAC_LOG_GRID_SIZE)
+-#define PISP_BE_CAC_STEP_PRECISION 20
+-
+-struct pisp_be_cac_config {
+-	/* (1<<20) / grid_cell_width */
+-	u16 grid_step_x;
+-	/* (1<<20) / grid_cell_height */
+-	u16 grid_step_y;
+-	/* [gridy][gridx][rb][xy] */
+-	s8 lut[PISP_BE_CAC_GRID_SIZE + 1][PISP_BE_CAC_GRID_SIZE + 1][2][2];
+-};
+-
+-struct pisp_be_cac_extra {
+-	u16 offset_x;
+-	u16 offset_y;
+-};
+-
+-#define PISP_BE_DEBIN_NUM_COEFFS 4
+-
+-struct pisp_be_debin_config {
+-	s8 coeffs[PISP_BE_DEBIN_NUM_COEFFS];
+-	s8 h_enable;
+-	s8 v_enable;
+-	s8 pad[2];
+-};
+-
+-#define PISP_BE_TONEMAP_LUT_SIZE 64
+-
+-struct pisp_be_tonemap_config {
+-	u16 detail_constant;
+-	u16 detail_slope;
+-	u16 iir_strength;
+-	u16 strength;
+-	u32 lut[PISP_BE_TONEMAP_LUT_SIZE];
+-};
+-
+-struct pisp_be_demosaic_config {
+-	u8 sharper;
+-	u8 fc_mode;
+-	u8 pad[2];
+-};
+-
+-struct pisp_be_ccm_config {
+-	s16 coeffs[9];
+-	u8 pad[2];
+-	s32 offsets[3];
+-};
+-
+-struct pisp_be_sat_control_config {
+-	u8 shift_r;
+-	u8 shift_g;
+-	u8 shift_b;
+-	u8 pad;
+-};
+-
+-struct pisp_be_false_colour_config {
+-	u8 distance;
+-	u8 pad[3];
+-};
+-
+-#define PISP_BE_SHARPEN_SIZE 5
+-#define PISP_BE_SHARPEN_FUNC_NUM_POINTS 9
+-
+-struct pisp_be_sharpen_config {
+-	s8 kernel0[PISP_BE_SHARPEN_SIZE * PISP_BE_SHARPEN_SIZE];
+-	s8 pad0[3];
+-	s8 kernel1[PISP_BE_SHARPEN_SIZE * PISP_BE_SHARPEN_SIZE];
+-	s8 pad1[3];
+-	s8 kernel2[PISP_BE_SHARPEN_SIZE * PISP_BE_SHARPEN_SIZE];
+-	s8 pad2[3];
+-	s8 kernel3[PISP_BE_SHARPEN_SIZE * PISP_BE_SHARPEN_SIZE];
+-	s8 pad3[3];
+-	s8 kernel4[PISP_BE_SHARPEN_SIZE * PISP_BE_SHARPEN_SIZE];
+-	s8 pad4[3];
+-	u16 threshold_offset0;
+-	u16 threshold_slope0;
+-	u16 scale0;
+-	u16 pad5;
+-	u16 threshold_offset1;
+-	u16 threshold_slope1;
+-	u16 scale1;
+-	u16 pad6;
+-	u16 threshold_offset2;
+-	u16 threshold_slope2;
+-	u16 scale2;
+-	u16 pad7;
+-	u16 threshold_offset3;
+-	u16 threshold_slope3;
+-	u16 scale3;
+-	u16 pad8;
+-	u16 threshold_offset4;
+-	u16 threshold_slope4;
+-	u16 scale4;
+-	u16 pad9;
+-	u16 positive_strength;
+-	u16 positive_pre_limit;
+-	u16 positive_func[PISP_BE_SHARPEN_FUNC_NUM_POINTS];
+-	u16 positive_limit;
+-	u16 negative_strength;
+-	u16 negative_pre_limit;
+-	u16 negative_func[PISP_BE_SHARPEN_FUNC_NUM_POINTS];
+-	u16 negative_limit;
+-	u8 enables;
+-	u8 white;
+-	u8 black;
+-	u8 grey;
+-};
+-
+-struct pisp_be_sh_fc_combine_config {
+-	u8 y_factor;
+-	u8 c1_factor;
+-	u8 c2_factor;
+-	u8 pad;
+-};
+-
+-#define PISP_BE_GAMMA_LUT_SIZE 64
+-
+-struct pisp_be_gamma_config {
+-	u32 lut[PISP_BE_GAMMA_LUT_SIZE];
+-};
+-
+-struct pisp_be_crop_config {
+-	u16 offset_x, offset_y;
+-	u16 width, height;
+-};
+-
+-#define PISP_BE_RESAMPLE_FILTER_SIZE 96
+-
+-struct pisp_be_resample_config {
+-	u16 scale_factor_h, scale_factor_v;
+-	s16 coef[PISP_BE_RESAMPLE_FILTER_SIZE];
+-};
+-
+-struct pisp_be_resample_extra {
+-	u16 scaled_width;
+-	u16 scaled_height;
+-	s16 initial_phase_h[3];
+-	s16 initial_phase_v[3];
+-};
+-
+-struct pisp_be_downscale_config {
+-	u16 scale_factor_h;
+-	u16 scale_factor_v;
+-	u16 scale_recip_h;
+-	u16 scale_recip_v;
+-};
+-
+-struct pisp_be_downscale_extra {
+-	u16 scaled_width;
+-	u16 scaled_height;
+-};
+-
+-struct pisp_be_hog_config {
+-	u8 compute_signed;
+-	u8 channel_mix[3];
+-	u32 stride;
+-};
+-
+-struct pisp_be_axi_config {
+-	u8 r_qos; /* Read QoS */
+-	u8 r_cache_prot; /* Read { prot[2:0], cache[3:0] } */
+-	u8 w_qos; /* Write QoS */
+-	u8 w_cache_prot; /* Write { prot[2:0], cache[3:0] } */
+-};
+-
+-enum pisp_be_transform {
+-	PISP_BE_TRANSFORM_NONE = 0x0,
+-	PISP_BE_TRANSFORM_HFLIP = 0x1,
+-	PISP_BE_TRANSFORM_VFLIP = 0x2,
+-	PISP_BE_TRANSFORM_ROT180 =
+-		(PISP_BE_TRANSFORM_HFLIP | PISP_BE_TRANSFORM_VFLIP)
+-};
+-
+-struct pisp_be_output_format_config {
+-	struct pisp_image_format_config image;
+-	u8 transform;
+-	u8 pad[3];
+-	u16 lo;
+-	u16 hi;
+-	u16 lo2;
+-	u16 hi2;
+-};
+-
+-struct pisp_be_output_buffer_config {
+-	/* low 32 bits followed by high 32 bits (for each of 3 planes) */
+-	u32 addr[3][2];
+-};
+-
+-struct pisp_be_hog_buffer_config {
+-	/* low 32 bits followed by high 32 bits */
+-	u32 addr[2];
+-};
+-
+-struct pisp_be_config {
+-	/* I/O configuration: */
+-	struct pisp_be_input_buffer_config input_buffer;
+-	struct pisp_be_tdn_input_buffer_config tdn_input_buffer;
+-	struct pisp_be_stitch_input_buffer_config stitch_input_buffer;
+-	struct pisp_be_tdn_output_buffer_config tdn_output_buffer;
+-	struct pisp_be_stitch_output_buffer_config stitch_output_buffer;
+-	struct pisp_be_output_buffer_config
+-				output_buffer[PISP_BACK_END_NUM_OUTPUTS];
+-	struct pisp_be_hog_buffer_config hog_buffer;
+-	/* Processing configuration: */
+-	struct pisp_be_global_config global;
+-	struct pisp_image_format_config input_format;
+-	struct pisp_decompress_config decompress;
+-	struct pisp_be_dpc_config dpc;
+-	struct pisp_be_geq_config geq;
+-	struct pisp_image_format_config tdn_input_format;
+-	struct pisp_decompress_config tdn_decompress;
+-	struct pisp_be_tdn_config tdn;
+-	struct pisp_compress_config tdn_compress;
+-	struct pisp_image_format_config tdn_output_format;
+-	struct pisp_be_sdn_config sdn;
+-	struct pisp_bla_config blc;
+-	struct pisp_compress_config stitch_compress;
+-	struct pisp_image_format_config stitch_output_format;
+-	struct pisp_image_format_config stitch_input_format;
+-	struct pisp_decompress_config stitch_decompress;
+-	struct pisp_be_stitch_config stitch;
+-	struct pisp_be_lsc_config lsc;
+-	struct pisp_wbg_config wbg;
+-	struct pisp_be_cdn_config cdn;
+-	struct pisp_be_cac_config cac;
+-	struct pisp_be_debin_config debin;
+-	struct pisp_be_tonemap_config tonemap;
+-	struct pisp_be_demosaic_config demosaic;
+-	struct pisp_be_ccm_config ccm;
+-	struct pisp_be_sat_control_config sat_control;
+-	struct pisp_be_ccm_config ycbcr;
+-	struct pisp_be_sharpen_config sharpen;
+-	struct pisp_be_false_colour_config false_colour;
+-	struct pisp_be_sh_fc_combine_config sh_fc_combine;
+-	struct pisp_be_ccm_config ycbcr_inverse;
+-	struct pisp_be_gamma_config gamma;
+-	struct pisp_be_ccm_config csc[PISP_BACK_END_NUM_OUTPUTS];
+-	struct pisp_be_downscale_config downscale[PISP_BACK_END_NUM_OUTPUTS];
+-	struct pisp_be_resample_config resample[PISP_BACK_END_NUM_OUTPUTS];
+-	struct pisp_be_output_format_config
+-				output_format[PISP_BACK_END_NUM_OUTPUTS];
+-	struct pisp_be_hog_config hog;
+-	struct pisp_be_axi_config axi;
+-	/* Non-register fields: */
+-	struct pisp_be_lsc_extra lsc_extra;
+-	struct pisp_be_cac_extra cac_extra;
+-	struct pisp_be_downscale_extra
+-				downscale_extra[PISP_BACK_END_NUM_OUTPUTS];
+-	struct pisp_be_resample_extra resample_extra[PISP_BACK_END_NUM_OUTPUTS];
+-	struct pisp_be_crop_config crop;
+-	struct pisp_image_format_config hog_format;
+-	u32 dirty_flags_bayer; /* these use pisp_be_bayer_enable */
+-	u32 dirty_flags_rgb; /* use pisp_be_rgb_enable */
+-	u32 dirty_flags_extra; /* these use pisp_be_dirty_t */
+-};
+-
+-/*
+- * We also need a tile structure to describe the size of the tiles going
+- * through the pipeline.
+- */
+-
+-enum pisp_tile_edge {
+-	PISP_LEFT_EDGE = (1 << 0),
+-	PISP_RIGHT_EDGE = (1 << 1),
+-	PISP_TOP_EDGE = (1 << 2),
+-	PISP_BOTTOM_EDGE = (1 << 3)
+-};
+-
+-struct pisp_tile {
+-	u8 edge; // enum pisp_tile_edge
+-	u8 pad0[3];
+-	// 4 bytes
+-	u32 input_addr_offset;
+-	u32 input_addr_offset2;
+-	u16 input_offset_x;
+-	u16 input_offset_y;
+-	u16 input_width;
+-	u16 input_height;
+-	// 20 bytes
+-	u32 tdn_input_addr_offset;
+-	u32 tdn_output_addr_offset;
+-	u32 stitch_input_addr_offset;
+-	u32 stitch_output_addr_offset;
+-	// 36 bytes
+-	u32 lsc_grid_offset_x;
+-	u32 lsc_grid_offset_y;
+-	// 44 bytes
+-	u32 cac_grid_offset_x;
+-	u32 cac_grid_offset_y;
+-	// 52 bytes
+-	u16 crop_x_start[PISP_BACK_END_NUM_OUTPUTS];
+-	u16 crop_x_end[PISP_BACK_END_NUM_OUTPUTS];
+-	u16 crop_y_start[PISP_BACK_END_NUM_OUTPUTS];
+-	u16 crop_y_end[PISP_BACK_END_NUM_OUTPUTS];
+-	// 68 bytes
+-	/* Ordering is planes then branches */
+-	u16 downscale_phase_x[3 * PISP_BACK_END_NUM_OUTPUTS];
+-	u16 downscale_phase_y[3 * PISP_BACK_END_NUM_OUTPUTS];
+-	// 92 bytes
+-	u16 resample_in_width[PISP_BACK_END_NUM_OUTPUTS];
+-	u16 resample_in_height[PISP_BACK_END_NUM_OUTPUTS];
+-	// 100 bytes
+-	/* Ordering is planes then branches */
+-	u16 resample_phase_x[3 * PISP_BACK_END_NUM_OUTPUTS];
+-	u16 resample_phase_y[3 * PISP_BACK_END_NUM_OUTPUTS];
+-	// 124 bytes
+-	u16 output_offset_x[PISP_BACK_END_NUM_OUTPUTS];
+-	u16 output_offset_y[PISP_BACK_END_NUM_OUTPUTS];
+-	u16 output_width[PISP_BACK_END_NUM_OUTPUTS];
+-	u16 output_height[PISP_BACK_END_NUM_OUTPUTS];
+-	// 140 bytes
+-	u32 output_addr_offset[PISP_BACK_END_NUM_OUTPUTS];
+-	u32 output_addr_offset2[PISP_BACK_END_NUM_OUTPUTS];
+-	// 156 bytes
+-	u32 output_hog_addr_offset;
+-	// 160 bytes
+-};
+-
+-static_assert(sizeof(struct pisp_tile) == 160);
+-
+-struct pisp_be_tiles_config {
+-	struct pisp_be_config config;
+-	struct pisp_tile tiles[PISP_BACK_END_NUM_TILES];
+-	int num_tiles;
+-};
+-
+-#endif /* _PISP_BE_CONFIG_H_ */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0482-media-pisp_be-Re-introduce-multi-context-support.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0482-media-pisp_be-Re-introduce-multi-context-support.patch
new file mode 100644
index 00000000..f292d904
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0482-media-pisp_be-Re-introduce-multi-context-support.patch
@@ -0,0 +1,886 @@
+From 98c290b837440c50a6da1eb55a17f5e9da2d2d5d Mon Sep 17 00:00:00 2001
+From: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Date: Fri, 28 Jun 2024 17:26:26 +0200
+Subject: [PATCH 482/697] media: pisp_be: Re-introduce multi-context support
+
+Re-introduce multi-context support that was dropped from the
+mainline driver version.
+
+Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+---
+ .../platform/raspberrypi/pisp_be/pisp_be.c    | 355 ++++++++++--------
+ 1 file changed, 208 insertions(+), 147 deletions(-)
+
+--- a/drivers/media/platform/raspberrypi/pisp_be/pisp_be.c
++++ b/drivers/media/platform/raspberrypi/pisp_be/pisp_be.c
+@@ -24,6 +24,14 @@
+ /* Maximum number of config buffers possible */
+ #define PISP_BE_NUM_CONFIG_BUFFERS VB2_MAX_FRAME
+ 
++/*
++ * We want to support 2 independent instances allowing 2 simultaneous users
++ * of the ISP-BE (of course they share hardware, platform resources and mutex).
++ * Each such instance comprises a group of device nodes representing input
++ * and output queues, and a media controller device node to describe them.
++ */
++#define PISPBE_NUM_NODE_GROUPS 2
++
+ #define PISPBE_NAME "pispbe"
+ 
+ /* Some ISP-BE registers */
+@@ -156,7 +164,7 @@ struct pispbe_node {
+ 	struct media_pad pad;
+ 	struct media_intf_devnode *intf_devnode;
+ 	struct media_link *intf_link;
+-	struct pispbe_dev *pispbe;
++	struct pispbe_node_group *node_group;
+ 	/* Video device lock */
+ 	struct mutex node_lock;
+ 	/* vb2_queue lock */
+@@ -173,9 +181,27 @@ struct pispbe_node {
+ #define NODE_NAME(node) \
+ 		(node_desc[(node)->id].ent_name + sizeof(PISPBE_NAME))
+ 
++/*
++ * Node group structure, which comprises all the input and output nodes that a
++ * single PiSP client will need, along with its own v4l2 and media devices.
++ */
++struct pispbe_node_group {
++	unsigned int id;
++	struct v4l2_device v4l2_dev;
++	struct v4l2_subdev sd;
++	struct pispbe_dev *pispbe;
++	struct media_device mdev;
++	struct pispbe_node node[PISPBE_NUM_NODES];
++	u32 streaming_map; /* bitmap of which nodes are streaming */
++	struct media_pad pad[PISPBE_NUM_NODES]; /* output pads first */
++	struct pisp_be_tiles_config *config;
++	dma_addr_t config_dma_addr;
++	unsigned int sequence;
++};
++
+ /* Records details of the jobs currently running or queued on the h/w. */
+ struct pispbe_job {
+-	bool valid;
++	struct pispbe_node_group *node_group;
+ 	/*
+ 	 * An array of buffer pointers - remember it's source buffers first,
+ 	 * then captures, then metadata last.
+@@ -198,22 +224,13 @@ struct pispbe_job_descriptor {
+ 
+ /*
+  * Structure representing the entire PiSP Back End device, comprising several
+- * nodes which share platform resources and a mutex for the actual HW.
++ * nodes groups which share platform resources and a mutex for the actual HW.
+  */
+ struct pispbe_dev {
+ 	struct device *dev;
+-	struct pispbe_dev *pispbe;
+-	struct pisp_be_tiles_config *config;
+ 	void __iomem *be_reg_base;
+ 	struct clk *clk;
+-	struct v4l2_device v4l2_dev;
+-	struct v4l2_subdev sd;
+-	struct media_device mdev;
+-	struct media_pad pad[PISPBE_NUM_NODES]; /* output pads first */
+-	struct pispbe_node node[PISPBE_NUM_NODES];
+-	dma_addr_t config_dma_addr;
+-	unsigned int sequence;
+-	u32 streaming_map;
++	struct pispbe_node_group node_group[PISPBE_NUM_NODE_GROUPS];
+ 	struct pispbe_job queued_job, running_job;
+ 	spinlock_t hw_lock; /* protects "hw_busy" flag and streaming_map */
+ 	bool hw_busy; /* non-zero if a job is queued or is being started */
+@@ -348,9 +365,9 @@ static dma_addr_t pispbe_get_addr(struct
+ 	return 0;
+ }
+ 
+-static void pispbe_xlate_addrs(struct pispbe_dev *pispbe,
+-			       struct pispbe_job_descriptor *job,
+-			       struct pispbe_buffer *buf[PISPBE_NUM_NODES])
++static void pispbe_xlate_addrs(struct pispbe_job_descriptor *job,
++			       struct pispbe_buffer *buf[PISPBE_NUM_NODES],
++			       struct pispbe_node_group *node_group)
+ {
+ 	struct pispbe_hw_enables *hw_en = &job->hw_enables;
+ 	struct pisp_be_tiles_config *config = job->config;
+@@ -366,13 +383,13 @@ static void pispbe_xlate_addrs(struct pi
+ 	 * to 3 planes.
+ 	 */
+ 	ret = pispbe_get_planes_addr(addrs, buf[MAIN_INPUT_NODE],
+-				     &pispbe->node[MAIN_INPUT_NODE]);
++				     &node_group->node[MAIN_INPUT_NODE]);
+ 	if (ret <= 0) {
+ 		/*
+ 		 * This shouldn't happen; pispbe_schedule_internal should insist
+ 		 * on an input.
+ 		 */
+-		dev_warn(pispbe->dev, "ISP-BE missing input\n");
++		dev_warn(node_group->pispbe->dev, "ISP-BE missing input\n");
+ 		hw_en->bayer_enables = 0;
+ 		hw_en->rgb_enables = 0;
+ 		return;
+@@ -427,7 +444,7 @@ static void pispbe_xlate_addrs(struct pi
+ 	for (unsigned int i = 0; i < PISP_BACK_END_NUM_OUTPUTS; i++) {
+ 		ret = pispbe_get_planes_addr(addrs + 7 + 3 * i,
+ 					     buf[OUTPUT0_NODE + i],
+-					     &pispbe->node[OUTPUT0_NODE + i]);
++					     &node_group->node[OUTPUT0_NODE + i]);
+ 		if (ret <= 0)
+ 			hw_en->rgb_enables &= ~(PISP_BE_RGB_ENABLE_OUTPUT0 << i);
+ 	}
+@@ -447,10 +464,11 @@ static void pispbe_xlate_addrs(struct pi
+  *
+  * Returns 0 if a job has been successfully prepared, < 0 otherwise.
+  */
+-static int pispbe_prepare_job(struct pispbe_dev *pispbe,
++static int pispbe_prepare_job(struct pispbe_node_group *node_group,
+ 			      struct pispbe_job_descriptor *job)
+ {
+ 	struct pispbe_buffer *buf[PISPBE_NUM_NODES] = {};
++	struct pispbe_dev *pispbe = node_group->pispbe;
+ 	unsigned int config_index;
+ 	struct pispbe_node *node;
+ 	unsigned long flags;
+@@ -460,11 +478,11 @@ static int pispbe_prepare_job(struct pis
+ 	memset(job, 0, sizeof(struct pispbe_job_descriptor));
+ 
+ 	if (((BIT(CONFIG_NODE) | BIT(MAIN_INPUT_NODE)) &
+-		pispbe->streaming_map) !=
++		node_group->streaming_map) !=
+ 			(BIT(CONFIG_NODE) | BIT(MAIN_INPUT_NODE)))
+ 		return -ENODEV;
+ 
+-	node = &pispbe->node[CONFIG_NODE];
++	node = &node_group->node[CONFIG_NODE];
+ 	spin_lock_irqsave(&node->ready_lock, flags);
+ 	buf[CONFIG_NODE] = list_first_entry_or_null(&node->ready_queue,
+ 						    struct pispbe_buffer,
+@@ -480,8 +498,8 @@ static int pispbe_prepare_job(struct pis
+ 		return -ENODEV;
+ 
+ 	config_index = buf[CONFIG_NODE]->vb.vb2_buf.index;
+-	job->config = &pispbe->config[config_index];
+-	job->tiles = pispbe->config_dma_addr +
++	job->config = &node_group->config[config_index];
++	job->tiles = node_group->config_dma_addr +
+ 		     config_index * sizeof(struct pisp_be_tiles_config) +
+ 		     offsetof(struct pisp_be_tiles_config, tiles);
+ 
+@@ -498,7 +516,7 @@ static int pispbe_prepare_job(struct pis
+ 			continue;
+ 
+ 		buf[i] = NULL;
+-		if (!(pispbe->streaming_map & BIT(i)))
++		if (!(node_group->streaming_map & BIT(i)))
+ 			continue;
+ 
+ 		if ((!(rgb_en & PISP_BE_RGB_ENABLE_OUTPUT0) &&
+@@ -522,7 +540,7 @@ static int pispbe_prepare_job(struct pis
+ 			ignore_buffers = true;
+ 		}
+ 
+-		node = &pispbe->node[i];
++		node = &node_group->node[i];
+ 
+ 		/* Pull a buffer from each V4L2 queue to form the queued job */
+ 		spin_lock_irqsave(&node->ready_lock, flags);
+@@ -539,16 +557,16 @@ static int pispbe_prepare_job(struct pis
+ 			goto err_return_buffers;
+ 	}
+ 
+-	pispbe->queued_job.valid = true;
++	pispbe->queued_job.node_group = node_group;
+ 
+ 	/* Convert buffers to DMA addresses for the hardware */
+-	pispbe_xlate_addrs(pispbe, job, buf);
++	pispbe_xlate_addrs(job, buf, node_group);
+ 
+ 	return 0;
+ 
+ err_return_buffers:
+ 	for (unsigned int i = 0; i < PISPBE_NUM_NODES; i++) {
+-		struct pispbe_node *n =  &pispbe->node[i];
++		struct pispbe_node *n =  &node_group->node[i];
+ 
+ 		if (!buf[i])
+ 			continue;
+@@ -564,11 +582,12 @@ err_return_buffers:
+ 	return -ENODEV;
+ }
+ 
+-static void pispbe_schedule(struct pispbe_dev *pispbe, bool clear_hw_busy)
++static void pispbe_schedule(struct pispbe_dev *pispbe,
++			    struct pispbe_node_group *node_group,
++			    bool clear_hw_busy)
+ {
+ 	struct pispbe_job_descriptor job;
+ 	unsigned long flags;
+-	int ret;
+ 
+ 	spin_lock_irqsave(&pispbe->hw_lock, flags);
+ 
+@@ -578,40 +597,53 @@ static void pispbe_schedule(struct pispb
+ 	if (pispbe->hw_busy)
+ 		goto unlock_and_return;
+ 
+-	ret = pispbe_prepare_job(pispbe, &job);
+-	if (ret)
+-		goto unlock_and_return;
++	for (unsigned int i = 0; i < PISPBE_NUM_NODE_GROUPS; i++) {
++		int ret;
+ 
+-	/*
+-	 * We can kick the job off without the hw_lock, as this can
+-	 * never run again until hw_busy is cleared, which will happen
+-	 * only when the following job has been queued and an interrupt
+-	 * is rised.
+-	 */
+-	pispbe->hw_busy = true;
+-	spin_unlock_irqrestore(&pispbe->hw_lock, flags);
++		/* Schedule jobs only for a specific group. */
++		if (node_group && &pispbe->node_group[i] != node_group)
++			continue;
+ 
+-	if (job.config->num_tiles <= 0 ||
+-	    job.config->num_tiles > PISP_BACK_END_NUM_TILES ||
+-	    !((job.hw_enables.bayer_enables | job.hw_enables.rgb_enables) &
+-	      PISP_BE_BAYER_ENABLE_INPUT)) {
+ 		/*
+-		 * Bad job. We can't let it proceed as it could lock up
+-		 * the hardware, or worse!
+-		 *
+-		 * For now, just force num_tiles to 0, which causes the
+-		 * H/W to do something bizarre but survivable. It
+-		 * increments (started,done) counters by more than 1,
+-		 * but we seem to survive...
++		 * Prepare a job for this group, if the group is not ready
++		 * continue and try with the next one.
+ 		 */
+-		dev_dbg(pispbe->dev, "Bad job: invalid number of tiles: %u\n",
+-			job.config->num_tiles);
+-		job.config->num_tiles = 0;
+-	}
++		ret = pispbe_prepare_job(&pispbe->node_group[i], &job);
++		if (ret)
++			continue;
++
++		/*
++		 * We can kick the job off without the hw_lock, as this can
++		 * never run again until hw_busy is cleared, which will happen
++		 * only when the following job has been queued and an interrupt
++		 * is rised.
++		 */
++		pispbe->hw_busy = true;
++		spin_unlock_irqrestore(&pispbe->hw_lock, flags);
++
++		if (job.config->num_tiles <= 0 ||
++		    job.config->num_tiles > PISP_BACK_END_NUM_TILES ||
++		    !((job.hw_enables.bayer_enables |
++		       job.hw_enables.rgb_enables) &
++		      PISP_BE_BAYER_ENABLE_INPUT)) {
++			/*
++			 * Bad job. We can't let it proceed as it could lock up
++			 * the hardware, or worse!
++			 *
++			 * For now, just force num_tiles to 0, which causes the
++			 * H/W to do something bizarre but survivable. It
++			 * increments (started,done) counters by more than 1,
++			 * but we seem to survive...
++			 */
++			dev_dbg(pispbe->dev, "Bad job: invalid number of tiles: %u\n",
++				job.config->num_tiles);
++			job.config->num_tiles = 0;
++		}
+ 
+-	pispbe_queue_job(pispbe, &job);
++		pispbe_queue_job(pispbe, &job);
+ 
+-	return;
++		return;
++	}
+ 
+ unlock_and_return:
+ 	/* No job has been queued, just release the lock and return. */
+@@ -627,13 +659,13 @@ static void pispbe_isr_jobdone(struct pi
+ 	for (unsigned int i = 0; i < PISPBE_NUM_NODES; i++) {
+ 		if (buf[i]) {
+ 			buf[i]->vb.vb2_buf.timestamp = ts;
+-			buf[i]->vb.sequence = pispbe->sequence;
++			buf[i]->vb.sequence = job->node_group->sequence;
+ 			vb2_buffer_done(&buf[i]->vb.vb2_buf,
+ 					VB2_BUF_STATE_DONE);
+ 		}
+ 	}
+ 
+-	pispbe->sequence++;
++	job->node_group->sequence++;
+ }
+ 
+ static irqreturn_t pispbe_isr(int irq, void *dev)
+@@ -657,7 +689,7 @@ static irqreturn_t pispbe_isr(int irq, v
+ 	 * we previously saw "start" now finishes, and we then queued a new job
+ 	 * which we see both start and finish "simultaneously".
+ 	 */
+-	if (pispbe->running_job.valid && pispbe->done != done) {
++	if (pispbe->running_job.node_group && pispbe->done != done) {
+ 		pispbe_isr_jobdone(pispbe, &pispbe->running_job);
+ 		memset(&pispbe->running_job, 0, sizeof(pispbe->running_job));
+ 		pispbe->done++;
+@@ -667,7 +699,7 @@ static irqreturn_t pispbe_isr(int irq, v
+ 		pispbe->started++;
+ 		can_queue_another = 1;
+ 
+-		if (pispbe->done != done && pispbe->queued_job.valid) {
++		if (pispbe->done != done && pispbe->queued_job.node_group) {
+ 			pispbe_isr_jobdone(pispbe, &pispbe->queued_job);
+ 			pispbe->done++;
+ 		} else {
+@@ -686,17 +718,17 @@ static irqreturn_t pispbe_isr(int irq, v
+ 	}
+ 
+ 	/* check if there's more to do before going to sleep */
+-	pispbe_schedule(pispbe, can_queue_another);
++	pispbe_schedule(pispbe, NULL, can_queue_another);
+ 
+ 	return IRQ_HANDLED;
+ }
+ 
+-static int pisp_be_validate_config(struct pispbe_dev *pispbe,
++static int pisp_be_validate_config(struct pispbe_node_group *node_group,
+ 				   struct pisp_be_tiles_config *config)
+ {
+ 	u32 bayer_enables = config->config.global.bayer_enables;
+ 	u32 rgb_enables = config->config.global.rgb_enables;
+-	struct device *dev = pispbe->dev;
++	struct device *dev = node_group->pispbe->dev;
+ 	struct v4l2_format *fmt;
+ 	unsigned int bpl, size;
+ 
+@@ -707,7 +739,7 @@ static int pisp_be_validate_config(struc
+ 	}
+ 
+ 	/* Ensure output config strides and buffer sizes match the V4L2 formats. */
+-	fmt = &pispbe->node[TDN_OUTPUT_NODE].format;
++	fmt = &node_group->node[TDN_OUTPUT_NODE].format;
+ 	if (bayer_enables & PISP_BE_BAYER_ENABLE_TDN_OUTPUT) {
+ 		bpl = config->config.tdn_output_format.stride;
+ 		size = bpl * config->config.tdn_output_format.height;
+@@ -725,7 +757,7 @@ static int pisp_be_validate_config(struc
+ 		}
+ 	}
+ 
+-	fmt = &pispbe->node[STITCH_OUTPUT_NODE].format;
++	fmt = &node_group->node[STITCH_OUTPUT_NODE].format;
+ 	if (bayer_enables & PISP_BE_BAYER_ENABLE_STITCH_OUTPUT) {
+ 		bpl = config->config.stitch_output_format.stride;
+ 		size = bpl * config->config.stitch_output_format.height;
+@@ -751,7 +783,7 @@ static int pisp_be_validate_config(struc
+ 		    PISP_IMAGE_FORMAT_WALLPAPER_ROLL)
+ 			continue; /* TODO: Size checks for wallpaper formats */
+ 
+-		fmt = &pispbe->node[OUTPUT0_NODE + j].format;
++		fmt = &node_group->node[OUTPUT0_NODE + j].format;
+ 		for (unsigned int i = 0; i < fmt->fmt.pix_mp.num_planes; i++) {
+ 			bpl = !i ? config->config.output_format[j].image.stride
+ 			    : config->config.output_format[j].image.stride2;
+@@ -783,7 +815,7 @@ static int pispbe_node_queue_setup(struc
+ 				   struct device *alloc_devs[])
+ {
+ 	struct pispbe_node *node = vb2_get_drv_priv(q);
+-	struct pispbe_dev *pispbe = node->pispbe;
++	struct pispbe_dev *pispbe = node->node_group->pispbe;
+ 	unsigned int num_planes = NODE_IS_MPLANE(node) ?
+ 				  node->format.fmt.pix_mp.num_planes : 1;
+ 
+@@ -821,7 +853,7 @@ static int pispbe_node_queue_setup(struc
+ static int pispbe_node_buffer_prepare(struct vb2_buffer *vb)
+ {
+ 	struct pispbe_node *node = vb2_get_drv_priv(vb->vb2_queue);
+-	struct pispbe_dev *pispbe = node->pispbe;
++	struct pispbe_dev *pispbe = node->node_group->pispbe;
+ 	unsigned int num_planes = NODE_IS_MPLANE(node) ?
+ 				  node->format.fmt.pix_mp.num_planes : 1;
+ 
+@@ -841,12 +873,12 @@ static int pispbe_node_buffer_prepare(st
+ 	}
+ 
+ 	if (node->id == CONFIG_NODE) {
+-		void *dst = &node->pispbe->config[vb->index];
++		void *dst = &node->node_group->config[vb->index];
+ 		void *src = vb2_plane_vaddr(vb, 0);
+ 
+ 		memcpy(dst, src, sizeof(struct pisp_be_tiles_config));
+ 
+-		return pisp_be_validate_config(pispbe, dst);
++		return pisp_be_validate_config(node->node_group, dst);
+ 	}
+ 
+ 	return 0;
+@@ -859,7 +891,8 @@ static void pispbe_node_buffer_queue(str
+ 	struct pispbe_buffer *buffer =
+ 		container_of(vbuf, struct pispbe_buffer, vb);
+ 	struct pispbe_node *node = vb2_get_drv_priv(buf->vb2_queue);
+-	struct pispbe_dev *pispbe = node->pispbe;
++	struct pispbe_node_group *node_group = node->node_group;
++	struct pispbe_dev *pispbe = node->node_group->pispbe;
+ 	unsigned long flags;
+ 
+ 	dev_dbg(pispbe->dev, "%s: for node %s\n", __func__, NODE_NAME(node));
+@@ -869,15 +902,16 @@ static void pispbe_node_buffer_queue(str
+ 
+ 	/*
+ 	 * Every time we add a buffer, check if there's now some work for the hw
+-	 * to do.
++	 * to do, but only for this client.
+ 	 */
+-	pispbe_schedule(pispbe, false);
++	pispbe_schedule(node_group->pispbe, node_group, false);
+ }
+ 
+ static int pispbe_node_start_streaming(struct vb2_queue *q, unsigned int count)
+ {
+ 	struct pispbe_node *node = vb2_get_drv_priv(q);
+-	struct pispbe_dev *pispbe = node->pispbe;
++	struct pispbe_node_group *node_group = node->node_group;
++	struct pispbe_dev *pispbe = node_group->pispbe;
+ 	struct pispbe_buffer *buf, *tmp;
+ 	unsigned long flags;
+ 	int ret;
+@@ -887,17 +921,17 @@ static int pispbe_node_start_streaming(s
+ 		goto err_return_buffers;
+ 
+ 	spin_lock_irqsave(&pispbe->hw_lock, flags);
+-	node->pispbe->streaming_map |=  BIT(node->id);
+-	node->pispbe->sequence = 0;
++	node->node_group->streaming_map |=  BIT(node->id);
++	node->node_group->sequence = 0;
+ 	spin_unlock_irqrestore(&pispbe->hw_lock, flags);
+ 
+ 	dev_dbg(pispbe->dev, "%s: for node %s (count %u)\n",
+ 		__func__, NODE_NAME(node), count);
+-	dev_dbg(pispbe->dev, "Nodes streaming now 0x%x\n",
+-		node->pispbe->streaming_map);
++	dev_dbg(pispbe->dev, "Nodes streaming for this group now 0x%x\n",
++		node->node_group->streaming_map);
+ 
+ 	/* Maybe we're ready to run. */
+-	pispbe_schedule(pispbe, false);
++	pispbe_schedule(node_group->pispbe, node_group, false);
+ 
+ 	return 0;
+ 
+@@ -915,7 +949,8 @@ err_return_buffers:
+ static void pispbe_node_stop_streaming(struct vb2_queue *q)
+ {
+ 	struct pispbe_node *node = vb2_get_drv_priv(q);
+-	struct pispbe_dev *pispbe = node->pispbe;
++	struct pispbe_node_group *node_group = node->node_group;
++	struct pispbe_dev *pispbe = node_group->pispbe;
+ 	struct pispbe_buffer *buf;
+ 	unsigned long flags;
+ 
+@@ -948,14 +983,14 @@ static void pispbe_node_stop_streaming(s
+ 	vb2_wait_for_all_buffers(&node->queue);
+ 
+ 	spin_lock_irqsave(&pispbe->hw_lock, flags);
+-	pispbe->streaming_map &= ~BIT(node->id);
++	node_group->streaming_map &= ~BIT(node->id);
+ 	spin_unlock_irqrestore(&pispbe->hw_lock, flags);
+ 
+ 	pm_runtime_mark_last_busy(pispbe->dev);
+ 	pm_runtime_put_autosuspend(pispbe->dev);
+ 
+-	dev_dbg(pispbe->dev, "Nodes streaming now 0x%x\n",
+-		pispbe->streaming_map);
++	dev_dbg(pispbe->dev, "Nodes streaming for this group now 0x%x\n",
++		node_group->streaming_map);
+ }
+ 
+ static const struct vb2_ops pispbe_node_queue_ops = {
+@@ -979,7 +1014,7 @@ static int pispbe_node_querycap(struct f
+ 				struct v4l2_capability *cap)
+ {
+ 	struct pispbe_node *node = video_drvdata(file);
+-	struct pispbe_dev *pispbe = node->pispbe;
++	struct pispbe_dev *pispbe = node->node_group->pispbe;
+ 
+ 	strscpy(cap->driver, PISPBE_NAME, sizeof(cap->driver));
+ 	strscpy(cap->card, PISPBE_NAME, sizeof(cap->card));
+@@ -995,7 +1030,7 @@ static int pispbe_node_g_fmt_vid_cap(str
+ 				     struct v4l2_format *f)
+ {
+ 	struct pispbe_node *node = video_drvdata(file);
+-	struct pispbe_dev *pispbe = node->pispbe;
++	struct pispbe_dev *pispbe = node->node_group->pispbe;
+ 
+ 	if (!NODE_IS_CAPTURE(node) || NODE_IS_META(node)) {
+ 		dev_dbg(pispbe->dev,
+@@ -1015,7 +1050,7 @@ static int pispbe_node_g_fmt_vid_out(str
+ 				     struct v4l2_format *f)
+ {
+ 	struct pispbe_node *node = video_drvdata(file);
+-	struct pispbe_dev *pispbe = node->pispbe;
++	struct pispbe_dev *pispbe = node->node_group->pispbe;
+ 
+ 	if (NODE_IS_CAPTURE(node) || NODE_IS_META(node)) {
+ 		dev_dbg(pispbe->dev,
+@@ -1035,7 +1070,7 @@ static int pispbe_node_g_fmt_meta_out(st
+ 				      struct v4l2_format *f)
+ {
+ 	struct pispbe_node *node = video_drvdata(file);
+-	struct pispbe_dev *pispbe = node->pispbe;
++	struct pispbe_dev *pispbe = node->node_group->pispbe;
+ 
+ 	if (!NODE_IS_META(node) || NODE_IS_CAPTURE(node)) {
+ 		dev_dbg(pispbe->dev,
+@@ -1092,7 +1127,7 @@ static void pispbe_set_plane_params(stru
+ 
+ static void pispbe_try_format(struct v4l2_format *f, struct pispbe_node *node)
+ {
+-	struct pispbe_dev *pispbe = node->pispbe;
++	struct pispbe_dev *pispbe = node->node_group->pispbe;
+ 	u32 pixfmt = f->fmt.pix_mp.pixelformat;
+ 	const struct pisp_be_format *fmt;
+ 	bool is_rgb;
+@@ -1156,7 +1191,7 @@ static int pispbe_node_try_fmt_vid_cap(s
+ 				       struct v4l2_format *f)
+ {
+ 	struct pispbe_node *node = video_drvdata(file);
+-	struct pispbe_dev *pispbe = node->pispbe;
++	struct pispbe_dev *pispbe = node->node_group->pispbe;
+ 
+ 	if (!NODE_IS_CAPTURE(node) || NODE_IS_META(node)) {
+ 		dev_dbg(pispbe->dev,
+@@ -1174,7 +1209,7 @@ static int pispbe_node_try_fmt_vid_out(s
+ 				       struct v4l2_format *f)
+ {
+ 	struct pispbe_node *node = video_drvdata(file);
+-	struct pispbe_dev *pispbe = node->pispbe;
++	struct pispbe_dev *pispbe = node->node_group->pispbe;
+ 
+ 	if (!NODE_IS_OUTPUT(node) || NODE_IS_META(node)) {
+ 		dev_dbg(pispbe->dev,
+@@ -1192,7 +1227,7 @@ static int pispbe_node_try_fmt_meta_out(
+ 					struct v4l2_format *f)
+ {
+ 	struct pispbe_node *node = video_drvdata(file);
+-	struct pispbe_dev *pispbe = node->pispbe;
++	struct pispbe_dev *pispbe = node->node_group->pispbe;
+ 
+ 	if (!NODE_IS_META(node) || NODE_IS_CAPTURE(node)) {
+ 		dev_dbg(pispbe->dev,
+@@ -1211,7 +1246,7 @@ static int pispbe_node_s_fmt_vid_cap(str
+ 				     struct v4l2_format *f)
+ {
+ 	struct pispbe_node *node = video_drvdata(file);
+-	struct pispbe_dev *pispbe = node->pispbe;
++	struct pispbe_dev *pispbe = node->node_group->pispbe;
+ 	int ret;
+ 
+ 	ret = pispbe_node_try_fmt_vid_cap(file, priv, f);
+@@ -1234,7 +1269,7 @@ static int pispbe_node_s_fmt_vid_out(str
+ 				     struct v4l2_format *f)
+ {
+ 	struct pispbe_node *node = video_drvdata(file);
+-	struct pispbe_dev *pispbe = node->pispbe;
++	struct pispbe_dev *pispbe = node->node_group->pispbe;
+ 	int ret;
+ 
+ 	ret = pispbe_node_try_fmt_vid_out(file, priv, f);
+@@ -1257,7 +1292,7 @@ static int pispbe_node_s_fmt_meta_out(st
+ 				      struct v4l2_format *f)
+ {
+ 	struct pispbe_node *node = video_drvdata(file);
+-	struct pispbe_dev *pispbe = node->pispbe;
++	struct pispbe_dev *pispbe = node->node_group->pispbe;
+ 	int ret;
+ 
+ 	ret = pispbe_node_try_fmt_meta_out(file, priv, f);
+@@ -1306,7 +1341,7 @@ static int pispbe_enum_framesizes(struct
+ 				  struct v4l2_frmsizeenum *fsize)
+ {
+ 	struct pispbe_node *node = video_drvdata(file);
+-	struct pispbe_dev *pispbe = node->pispbe;
++	struct pispbe_dev *pispbe = node->node_group->pispbe;
+ 
+ 	if (NODE_IS_META(node) || fsize->index)
+ 		return -EINVAL;
+@@ -1391,17 +1426,19 @@ static void pispbe_node_def_fmt(struct p
+  * Initialise a struct pispbe_node and register it as /dev/video<N>
+  * to represent one of the PiSP Back End's input or output streams.
+  */
+-static int pispbe_init_node(struct pispbe_dev *pispbe, unsigned int id)
++static int pispbe_init_node(struct pispbe_node_group *node_group,
++			    unsigned int id)
+ {
+ 	bool output = NODE_DESC_IS_OUTPUT(&node_desc[id]);
+-	struct pispbe_node *node = &pispbe->node[id];
++	struct pispbe_node *node = &node_group->node[id];
+ 	struct media_entity *entity = &node->vfd.entity;
++	struct pispbe_dev *pispbe = node_group->pispbe;
+ 	struct video_device *vdev = &node->vfd;
+ 	struct vb2_queue *q = &node->queue;
+ 	int ret;
+ 
+ 	node->id = id;
+-	node->pispbe = pispbe;
++	node->node_group = node_group;
+ 	node->buf_type = node_desc[id].buf_type;
+ 
+ 	mutex_init(&node->node_lock);
+@@ -1419,7 +1456,7 @@ static int pispbe_init_node(struct pispb
+ 	q->ops = &pispbe_node_queue_ops;
+ 	q->buf_struct_size = sizeof(struct pispbe_buffer);
+ 	q->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
+-	q->dev = pispbe->dev;
++	q->dev = node->node_group->pispbe->dev;
+ 	/* get V4L2 to handle node->queue locking */
+ 	q->lock = &node->queue_lock;
+ 
+@@ -1431,7 +1468,7 @@ static int pispbe_init_node(struct pispb
+ 
+ 	*vdev = pispbe_videodev; /* default initialization */
+ 	strscpy(vdev->name, node_desc[id].ent_name, sizeof(vdev->name));
+-	vdev->v4l2_dev = &pispbe->v4l2_dev;
++	vdev->v4l2_dev = &node_group->v4l2_dev;
+ 	vdev->vfl_dir = output ? VFL_DIR_TX : VFL_DIR_RX;
+ 	/* get V4L2 to serialise our ioctls */
+ 	vdev->lock = &node->node_lock;
+@@ -1457,11 +1494,11 @@ static int pispbe_init_node(struct pispb
+ 	video_set_drvdata(vdev, node);
+ 
+ 	if (output)
+-		ret = media_create_pad_link(entity, 0, &pispbe->sd.entity,
++		ret = media_create_pad_link(entity, 0, &node_group->sd.entity,
+ 					    id, MEDIA_LNK_FL_IMMUTABLE |
+ 					    MEDIA_LNK_FL_ENABLED);
+ 	else
+-		ret = media_create_pad_link(&pispbe->sd.entity, id, entity,
++		ret = media_create_pad_link(&node_group->sd.entity, id, entity,
+ 					    0, MEDIA_LNK_FL_IMMUTABLE |
+ 					    MEDIA_LNK_FL_ENABLED);
+ 	if (ret)
+@@ -1490,9 +1527,10 @@ static const struct v4l2_subdev_ops pisp
+ 	.pad = &pispbe_pad_ops,
+ };
+ 
+-static int pispbe_init_subdev(struct pispbe_dev *pispbe)
++static int pispbe_init_subdev(struct pispbe_node_group *node_group)
+ {
+-	struct v4l2_subdev *sd = &pispbe->sd;
++	struct pispbe_dev *pispbe = node_group->pispbe;
++	struct v4l2_subdev *sd = &node_group->sd;
+ 	int ret;
+ 
+ 	v4l2_subdev_init(sd, &pispbe_sd_ops);
+@@ -1502,16 +1540,16 @@ static int pispbe_init_subdev(struct pis
+ 	strscpy(sd->name, PISPBE_NAME, sizeof(sd->name));
+ 
+ 	for (unsigned int i = 0; i < PISPBE_NUM_NODES; i++)
+-		pispbe->pad[i].flags =
++		node_group->pad[i].flags =
+ 			NODE_DESC_IS_OUTPUT(&node_desc[i]) ?
+ 			MEDIA_PAD_FL_SINK : MEDIA_PAD_FL_SOURCE;
+ 
+ 	ret = media_entity_pads_init(&sd->entity, PISPBE_NUM_NODES,
+-				     pispbe->pad);
++				     node_group->pad);
+ 	if (ret)
+ 		goto error;
+ 
+-	ret = v4l2_device_register_subdev(&pispbe->v4l2_dev, sd);
++	ret = v4l2_device_register_subdev(&node_group->v4l2_dev, sd);
+ 	if (ret)
+ 		goto error;
+ 
+@@ -1522,36 +1560,43 @@ error:
+ 	return ret;
+ }
+ 
+-static int pispbe_init_devices(struct pispbe_dev *pispbe)
++static int pispbe_init_group(struct pispbe_dev *pispbe, unsigned int id)
+ {
++	struct pispbe_node_group *node_group = &pispbe->node_group[id];
+ 	struct v4l2_device *v4l2_dev;
+ 	struct media_device *mdev;
+ 	unsigned int num_regist;
+ 	int ret;
+ 
++	node_group->id = id;
++	node_group->pispbe = pispbe;
++	node_group->streaming_map = 0;
++
++	dev_dbg(pispbe->dev, "Register nodes for group %u\n", id);
++
+ 	/* Register v4l2_device and media_device */
+-	mdev = &pispbe->mdev;
+-	mdev->hw_revision = pispbe->hw_version;
+-	mdev->dev = pispbe->dev;
++	mdev = &node_group->mdev;
++	mdev->hw_revision = node_group->pispbe->hw_version;
++	mdev->dev = node_group->pispbe->dev;
+ 	strscpy(mdev->model, PISPBE_NAME, sizeof(mdev->model));
+ 	media_device_init(mdev);
+ 
+-	v4l2_dev = &pispbe->v4l2_dev;
+-	v4l2_dev->mdev = &pispbe->mdev;
++	v4l2_dev = &node_group->v4l2_dev;
++	v4l2_dev->mdev = &node_group->mdev;
+ 	strscpy(v4l2_dev->name, PISPBE_NAME, sizeof(v4l2_dev->name));
+ 
+-	ret = v4l2_device_register(pispbe->dev, v4l2_dev);
++	ret = v4l2_device_register(pispbe->dev, &node_group->v4l2_dev);
+ 	if (ret)
+ 		goto err_media_dev_cleanup;
+ 
+ 	/* Register the PISPBE subdevice. */
+-	ret = pispbe_init_subdev(pispbe);
++	ret = pispbe_init_subdev(node_group);
+ 	if (ret)
+ 		goto err_unregister_v4l2;
+ 
+ 	/* Create device video nodes */
+ 	for (num_regist = 0; num_regist < PISPBE_NUM_NODES; num_regist++) {
+-		ret = pispbe_init_node(pispbe, num_regist);
++		ret = pispbe_init_node(node_group, num_regist);
+ 		if (ret)
+ 			goto err_unregister_nodes;
+ 	}
+@@ -1560,12 +1605,12 @@ static int pispbe_init_devices(struct pi
+ 	if (ret)
+ 		goto err_unregister_nodes;
+ 
+-	pispbe->config =
++	node_group->config =
+ 		dma_alloc_coherent(pispbe->dev,
+ 				   sizeof(struct pisp_be_tiles_config) *
+ 					PISP_BE_NUM_CONFIG_BUFFERS,
+-				   &pispbe->config_dma_addr, GFP_KERNEL);
+-	if (!pispbe->config) {
++				   &node_group->config_dma_addr, GFP_KERNEL);
++	if (!node_group->config) {
+ 		dev_err(pispbe->dev, "Unable to allocate cached config buffers.\n");
+ 		ret = -ENOMEM;
+ 		goto err_unregister_mdev;
+@@ -1577,11 +1622,11 @@ err_unregister_mdev:
+ 	media_device_unregister(mdev);
+ err_unregister_nodes:
+ 	while (num_regist-- > 0) {
+-		video_unregister_device(&pispbe->node[num_regist].vfd);
+-		vb2_queue_release(&pispbe->node[num_regist].queue);
++		video_unregister_device(&node_group->node[num_regist].vfd);
++		vb2_queue_release(&node_group->node[num_regist].queue);
+ 	}
+-	v4l2_device_unregister_subdev(&pispbe->sd);
+-	media_entity_cleanup(&pispbe->sd.entity);
++	v4l2_device_unregister_subdev(&node_group->sd);
++	media_entity_cleanup(&node_group->sd.entity);
+ err_unregister_v4l2:
+ 	v4l2_device_unregister(v4l2_dev);
+ err_media_dev_cleanup:
+@@ -1589,31 +1634,33 @@ err_media_dev_cleanup:
+ 	return ret;
+ }
+ 
+-static void pispbe_destroy_devices(struct pispbe_dev *pispbe)
++static void pispbe_destroy_node_group(struct pispbe_node_group *node_group)
+ {
+-	if (pispbe->config) {
+-		dma_free_coherent(pispbe->dev,
++	struct pispbe_dev *pispbe = node_group->pispbe;
++
++	if (node_group->config) {
++		dma_free_coherent(node_group->pispbe->dev,
+ 				  sizeof(struct pisp_be_tiles_config) *
+ 					PISP_BE_NUM_CONFIG_BUFFERS,
+-				  pispbe->config,
+-				  pispbe->config_dma_addr);
++				  node_group->config,
++				  node_group->config_dma_addr);
+ 	}
+ 
+ 	dev_dbg(pispbe->dev, "Unregister from media controller\n");
+ 
+-	v4l2_device_unregister_subdev(&pispbe->sd);
+-	media_entity_cleanup(&pispbe->sd.entity);
+-	media_device_unregister(&pispbe->mdev);
++	v4l2_device_unregister_subdev(&node_group->sd);
++	media_entity_cleanup(&node_group->sd.entity);
++	media_device_unregister(&node_group->mdev);
+ 
+ 	for (int i = PISPBE_NUM_NODES - 1; i >= 0; i--) {
+-		video_unregister_device(&pispbe->node[i].vfd);
+-		vb2_queue_release(&pispbe->node[i].queue);
+-		mutex_destroy(&pispbe->node[i].node_lock);
+-		mutex_destroy(&pispbe->node[i].queue_lock);
++		video_unregister_device(&node_group->node[i].vfd);
++		vb2_queue_release(&node_group->node[i].queue);
++		mutex_destroy(&node_group->node[i].node_lock);
++		mutex_destroy(&node_group->node[i].queue_lock);
+ 	}
+ 
+-	media_device_cleanup(&pispbe->mdev);
+-	v4l2_device_unregister(&pispbe->v4l2_dev);
++	media_device_cleanup(&node_group->mdev);
++	v4l2_device_unregister(&node_group->v4l2_dev);
+ }
+ 
+ static int pispbe_runtime_suspend(struct device *dev)
+@@ -1681,9 +1728,13 @@ static int pispbe_hw_init(struct pispbe_
+ 	return 0;
+ }
+ 
+-/* Probe the ISP-BE hardware block, as a single platform device. */
++/*
++ * Probe the ISP-BE hardware block, as a single platform device.
++ * This will instantiate multiple "node groups" each with many device nodes.
++ */
+ static int pispbe_probe(struct platform_device *pdev)
+ {
++	unsigned int num_groups = 0;
+ 	struct pispbe_dev *pispbe;
+ 	int ret;
+ 
+@@ -1736,17 +1787,26 @@ static int pispbe_probe(struct platform_
+ 	if (ret)
+ 		goto pm_runtime_suspend_err;
+ 
+-	ret = pispbe_init_devices(pispbe);
+-	if (ret)
+-		goto disable_devs_err;
++	/*
++	 * Initialise and register devices for each node_group, including media
++	 * device
++	 */
++	for (num_groups = 0;
++	     num_groups < PISPBE_NUM_NODE_GROUPS;
++	     num_groups++) {
++		ret = pispbe_init_group(pispbe, num_groups);
++		if (ret)
++			goto disable_nodes_err;
++	}
+ 
+ 	pm_runtime_mark_last_busy(pispbe->dev);
+ 	pm_runtime_put_autosuspend(pispbe->dev);
+ 
+ 	return 0;
+ 
+-disable_devs_err:
+-	pispbe_destroy_devices(pispbe);
++disable_nodes_err:
++	while (num_groups-- > 0)
++		pispbe_destroy_node_group(&pispbe->node_group[num_groups]);
+ pm_runtime_suspend_err:
+ 	pispbe_runtime_suspend(pispbe->dev);
+ pm_runtime_disable_err:
+@@ -1760,7 +1820,8 @@ static void pispbe_remove(struct platfor
+ {
+ 	struct pispbe_dev *pispbe = platform_get_drvdata(pdev);
+ 
+-	pispbe_destroy_devices(pispbe);
++	for (int i = PISPBE_NUM_NODE_GROUPS - 1; i >= 0; i--)
++		pispbe_destroy_node_group(&pispbe->node_group[i]);
+ 
+ 	pispbe_runtime_suspend(pispbe->dev);
+ 	pm_runtime_dont_use_autosuspend(pispbe->dev);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0483-media-pisp_be-Re-introduce-video-node-offset.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0483-media-pisp_be-Re-introduce-video-node-offset.patch
new file mode 100644
index 00000000..e2171755
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0483-media-pisp_be-Re-introduce-video-node-offset.patch
@@ -0,0 +1,36 @@
+From cde9114c4ea8d38f2beb990379b9e5b06397650e Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Mon, 8 Jul 2024 11:47:49 +0100
+Subject: [PATCH 483/697] media: pisp_be: Re-introduce video node offset
+
+Offset the backend dev-nodes starting at /dev/video20
+onwards to maintain backward compatibility with the
+pre-upstreamed kernel driver.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/platform/raspberrypi/pisp_be/pisp_be.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/platform/raspberrypi/pisp_be/pisp_be.c
++++ b/drivers/media/platform/raspberrypi/pisp_be/pisp_be.c
+@@ -21,6 +21,9 @@
+ 
+ #include "pisp_be_formats.h"
+ 
++/* Offset to use when registering the /dev/videoX node */
++#define PISPBE_VIDEO_NODE_OFFSET 20
++
+ /* Maximum number of config buffers possible */
+ #define PISP_BE_NUM_CONFIG_BUFFERS VB2_MAX_FRAME
+ 
+@@ -1484,7 +1487,8 @@ static int pispbe_init_node(struct pispb
+ 		goto err_unregister_queue;
+ 	}
+ 
+-	ret = video_register_device(vdev, VFL_TYPE_VIDEO, -1);
++	ret = video_register_device(vdev, VFL_TYPE_VIDEO,
++				    PISPBE_VIDEO_NODE_OFFSET);
+ 	if (ret) {
+ 		dev_err(pispbe->dev,
+ 			"Failed to register video %s device node\n",
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0484-spi-dt-bindings-Add-RPI-RP2040-GPIO-Bridge.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0484-spi-dt-bindings-Add-RPI-RP2040-GPIO-Bridge.patch
new file mode 100644
index 00000000..ac52094c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0484-spi-dt-bindings-Add-RPI-RP2040-GPIO-Bridge.patch
@@ -0,0 +1,108 @@
+From c8e4062ca143c2bed09344bc23d3c4c9c9040577 Mon Sep 17 00:00:00 2001
+From: Richard Oliver <richard.oliver@raspberrypi.com>
+Date: Fri, 24 May 2024 10:34:45 +0100
+Subject: [PATCH 484/697] spi: dt-bindings: Add RPI RP2040 GPIO Bridge
+
+Add YAML device tree bindings for the Raspberry Pi RP2040 GPIO Bridge.
+
+Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
+---
+ .../spi/raspberrypi,rp2040-gpio-bridge.yaml   | 77 +++++++++++++++++++
+ MAINTAINERS                                   |  5 ++
+ 2 files changed, 82 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/spi/raspberrypi,rp2040-gpio-bridge.yaml
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/spi/raspberrypi,rp2040-gpio-bridge.yaml
+@@ -0,0 +1,77 @@
++# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/spi/raspberrypi,rp2040-gpio-bridge.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Raspberry Pi RP2040 GPIO Bridge
++
++maintainers:
++  - Raspberry Pi <kernel-list@raspberrypi.com>
++
++description: |-
++  The Raspberry Pi PR2040 GPIO bridge can be used as a GPIO expander and
++  Tx-only SPI master.
++
++properties:
++  reg:
++    description: I2C slave address
++    const: 0x40
++
++  compatible:
++    const: raspberrypi,rp2040-gpio-bridge
++
++  power-supply:
++    description: Phandle to the regulator that powers the RP2040.
++
++  '#address-cells':
++    const: 1
++
++  '#size-cells':
++    const: 0
++
++  '#gpio-cells':
++    const: 2
++
++  gpio-controller: true
++
++  fast_xfer_requires_i2c_lock:
++    description: Set if I2C bus should be locked during fast transfer.
++
++  fast_xfer_recv_gpio_base:
++    description: RP2040 GPIO base for fast transfer pair.
++
++  fast_xfer-gpios:
++    description: RP1 GPIOs to use for fast transfer clock and data.
++
++required:
++  - reg
++  - compatible
++  - power-supply
++  - '#gpio-cells'
++  - gpio-controller
++
++additionalProperties: false
++
++examples:
++  - |
++    i2c {
++      #address-cells = <1>;
++      #size-cells = <0>;
++
++      spi@40 {
++        reg = <0x40>;
++        compatible = "raspberrypi,rp2040-gpio-bridge";
++        status = "disabled";
++        #address-cells = <1>;
++        #size-cells = <0>;
++
++        power-supply = <&cam_dummy_reg>;
++
++        #gpio-cells = <2>;
++        gpio-controller;
++      };
++    };
++
++...
++
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -19353,6 +19353,11 @@ L:	linux-edac@vger.kernel.org
+ S:	Maintained
+ F:	drivers/ras/amd/fmpm.c
+ 
++RASPBERRY PI RP2040 GPIO BRIDGE DRIVER
++M:	Raspberry Pi Kernel Maintenance <kernel-list@raspberrypi.com>
++S:	Maintained
++F:	Documentation/devicetree/bindings/spi/raspberrypi,rp2040-gpio-bridge.yaml
++
+ RASPBERRY PI PISP BACK END
+ M:	Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+ L:	Raspberry Pi Kernel Maintenance <kernel-list@raspberrypi.com>
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0485-spi-Add-a-driver-for-the-RPI-RP2040-GPIO-bridge.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0485-spi-Add-a-driver-for-the-RPI-RP2040-GPIO-bridge.patch
new file mode 100644
index 00000000..53b25cd4
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0485-spi-Add-a-driver-for-the-RPI-RP2040-GPIO-bridge.patch
@@ -0,0 +1,1330 @@
+From 212b51f2fb51311c61779c47513cf1e8e134dc42 Mon Sep 17 00:00:00 2001
+From: Richard Oliver <richard.oliver@raspberrypi.com>
+Date: Tue, 21 May 2024 13:47:23 +0100
+Subject: [PATCH 485/697] spi: Add a driver for the RPI RP2040 GPIO bridge
+
+The Raspberry Pi RP2040 GPIO bridge is an I2C-attached device exposing
+both a Tx-only SPI controller, and a GPIO controller.
+
+Due to the relative difference in transfer rates between standard-mode
+I2C and SPI, the GPIO bridge makes use of 12 MiB of non-volatile storage
+to cache repeated transfers. This cache is arranged in ~8 KiB blocks and
+is addressed by the MD5 digest of the data contained therein.
+
+Optionally, this driver is able to take advantage of Raspberry Pi RP1
+GPIOs to achieve faster than I2C data transfer rates.
+
+Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
+
+spi: rp2040-gpio-bridge: Add debugfs progress indicator
+
+Useful for tracking upload progress via userspace.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+spi: rp2040-gpio-bridge: add missing MD5 dependency
+
+rp2040-gpio-bridge relies on the md5 crypto driver. This dependency
+cannot be determined automatically as rp2040-gpio-bridge does not
+use any of md5's symbols directly.
+
+Declare a soft 'pre' dependency on md5 to ensure that it is included and
+loaded before rp2040-gpio-bridge.
+
+Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
+---
+ MAINTAINERS                          |    1 +
+ drivers/spi/Kconfig                  |   12 +
+ drivers/spi/Makefile                 |    1 +
+ drivers/spi/spi-rp2040-gpio-bridge.c | 1244 ++++++++++++++++++++++++++
+ 4 files changed, 1258 insertions(+)
+ create mode 100644 drivers/spi/spi-rp2040-gpio-bridge.c
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -19357,6 +19357,7 @@ RASPBERRY PI RP2040 GPIO BRIDGE DRIVER
+ M:	Raspberry Pi Kernel Maintenance <kernel-list@raspberrypi.com>
+ S:	Maintained
+ F:	Documentation/devicetree/bindings/spi/raspberrypi,rp2040-gpio-bridge.yaml
++F:	drivers/spi/spi-rp2040-gpio-bridge.c
+ 
+ RASPBERRY PI PISP BACK END
+ M:	Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+--- a/drivers/spi/Kconfig
++++ b/drivers/spi/Kconfig
+@@ -873,6 +873,18 @@ config SPI_RB4XX
+ 	help
+ 	  SPI controller driver for the Mikrotik RB4xx series boards.
+ 
++config SPI_RP2040_GPIO_BRIDGE
++	tristate "Raspberry Pi RP2040 GPIO Bridge"
++	depends on I2C && SPI && GPIOLIB
++	help
++	  Support for the Raspberry Pi RP2040 GPIO bridge.
++
++	  This driver provides support for the Raspberry Pi PR2040 GPIO bridge.
++	  It can be used as a GPIO expander and a Tx-only SPI master.
++
++	  Optionally, this driver is able to take advantage of Raspberry Pi RP1
++	  GPIOs to achieve faster than I2C data transfer rates.
++
+ config SPI_RPCIF
+ 	tristate "Renesas RPC-IF SPI driver"
+ 	depends on RENESAS_RPCIF
+--- a/drivers/spi/Makefile
++++ b/drivers/spi/Makefile
+@@ -119,6 +119,7 @@ obj-$(CONFIG_SPI_ROCKCHIP)		+= spi-rockc
+ obj-$(CONFIG_SPI_ROCKCHIP_SFC)		+= spi-rockchip-sfc.o
+ obj-$(CONFIG_SPI_RB4XX)			+= spi-rb4xx.o
+ obj-$(CONFIG_MACH_REALTEK_RTL)		+= spi-realtek-rtl.o
++obj-$(CONFIG_SPI_RP2040_GPIO_BRIDGE)	+= spi-rp2040-gpio-bridge.o
+ obj-$(CONFIG_SPI_RPCIF)			+= spi-rpc-if.o
+ obj-$(CONFIG_SPI_RSPI)			+= spi-rspi.o
+ obj-$(CONFIG_SPI_RZV2M_CSI)		+= spi-rzv2m-csi.o
+--- /dev/null
++++ b/drivers/spi/spi-rp2040-gpio-bridge.c
+@@ -0,0 +1,1244 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * RP2040 GPIO Bridge
++ *
++ * Copyright (C) 2023, 2024, Raspberry Pi Ltd
++ */
++
++#include <crypto/hash.h>
++#include <linux/debugfs.h>
++#include <linux/crypto.h>
++#include <linux/delay.h>
++#include <linux/firmware.h>
++#include <linux/gpio/driver.h>
++#include <linux/i2c.h>
++#include <linux/kernel.h>
++#include <linux/minmax.h>
++#include <linux/of_address.h>
++#include <linux/pm_runtime.h>
++#include <linux/spi/spi.h>
++#include <linux/stddef.h>
++#include <linux/types.h>
++
++#define MODULE_NAME "rp2040-gpio-bridge"
++
++#define I2C_RETRIES 4U
++
++#define ONE_KIB 1024U
++#define MD5_SUFFIX_SIZE 9U
++
++#define RP2040_GBDG_FLASH_BLOCK_SIZE (8U * ONE_KIB)
++#define RP2040_GBDG_BLOCK_SIZE (RP2040_GBDG_FLASH_BLOCK_SIZE - MD5_SUFFIX_SIZE)
++
++/*
++ * 1MiB transfer size is an arbitrary limit
++ * Max value is 4173330 (using a single manifest)
++ */
++#define MAX_TRANSFER_SIZE (1024U * ONE_KIB)
++
++#define HALF_BUFFER (4U * ONE_KIB)
++
++#define STATUS_SIZE 4
++#define MD5_DIGEST_SIZE 16
++#define VERSION_SIZE 4
++#define ID_SIZE 8
++#define TOTAL_RD_HDR_SIZE \
++	(STATUS_SIZE + MD5_DIGEST_SIZE + VERSION_SIZE + ID_SIZE)
++
++struct rp2040_gbdg_device_info {
++	u8 md5[MD5_DIGEST_SIZE];
++	u64 id;
++	u32 version;
++	u32 status;
++};
++
++static_assert(sizeof(struct rp2040_gbdg_device_info) == TOTAL_RD_HDR_SIZE);
++
++#define MANIFEST_UNIT_SIZE 16
++static_assert(MD5_DIGEST_SIZE == MANIFEST_UNIT_SIZE);
++#define MANIFEST_HEADER_UNITS 1
++#define MANIFEST_DATA_UNITS \
++	DIV_ROUND_UP(MAX_TRANSFER_SIZE, RP2040_GBDG_BLOCK_SIZE)
++
++#define STATUS_BUSY 0x01
++
++#define DIRECT_PREFIX 0x00
++#define DIRECT_CMD_CS 0x07
++#define DIRECT_CMD_EMIT 0x08
++
++#define WRITE_DATA_PREFIX 0x80
++#define WRITE_DATA_PREFIX_SIZE 1
++
++#define FIXED_SIZE_CMD_PREFIX 0x81
++
++#define WRITE_DATA_UPPER_PREFIX 0x82
++#define WRITE_DATA_UPPER_PREFIX_SIZE 1
++
++#define NUM_GPIO 24
++
++enum rp2040_gbdg_fixed_size_commands {
++	/* 10-byte commands */
++	CMD_SAVE_CACHE = 0x07,
++	CMD_SEND_RB = 0x08,
++	CMD_GPIO_ST_CL = 0x0b,
++	CMD_GPIO_OE = 0x0c,
++	CMD_DAT_RECV = 0x0d,
++	CMD_DAT_EMIT = 0x0e,
++	/* 18-byte commands */
++	CMD_READ_CSUM = 0x11,
++	CMD_SEND_MANI = 0x13,
++};
++
++struct rp2040_gbdg {
++	struct spi_controller *controller;
++
++	struct dentry *debugfs;
++	size_t transfer_progress;
++
++	struct i2c_client *client;
++	struct crypto_shash *shash;
++	struct shash_desc *shash_desc;
++
++	struct regulator *regulator;
++
++	struct gpio_chip gc;
++	u32 gpio_requested;
++	u32 gpio_direction;
++
++	bool fast_xfer_requires_i2c_lock;
++	struct gpio_descs *fast_xfer_gpios;
++	u32 fast_xfer_recv_gpio_base;
++	u8 fast_xfer_data_index;
++	u8 fast_xfer_clock_index;
++	void __iomem *gpio_base;
++	void __iomem *rio_base;
++
++	bool bypass_cache;
++
++	u8 buffer[2 + HALF_BUFFER];
++	u8 manifest_prep[(MANIFEST_HEADER_UNITS + MANIFEST_DATA_UNITS) *
++			 MANIFEST_UNIT_SIZE];
++};
++
++static int rp2040_gbdg_gpio_dir_in(struct gpio_chip *gc, unsigned int offset);
++static void rp2040_gbdg_gpio_set(struct gpio_chip *gc, unsigned int offset,
++				 int value);
++static int rp2040_gbdg_fast_xfer(struct rp2040_gbdg *priv_data, const u8 *data,
++				 size_t len);
++
++static int rp2040_gbdg_rp1_calc_offsets(u8 gpio, size_t *bank_offset,
++					u8 *shift_offset)
++{
++	if (!bank_offset || !shift_offset || gpio >= 54)
++		return -EINVAL;
++	if (gpio < 28) {
++		*bank_offset = 0x0000;
++		*shift_offset = gpio;
++	} else if (gpio < 34) {
++		*bank_offset = 0x4000;
++		*shift_offset = gpio - 28;
++	} else {
++		*bank_offset = 0x8000;
++		*shift_offset = gpio - 34;
++	}
++
++	return 0;
++}
++
++static int rp2040_gbdg_calc_mux_offset(u8 gpio, size_t *offset)
++{
++	size_t bank_offset;
++	u8 shift_offset;
++	int ret;
++
++	ret = rp2040_gbdg_rp1_calc_offsets(gpio, &bank_offset, &shift_offset);
++	if (ret)
++		return ret;
++	*offset = bank_offset + shift_offset * 8 + 0x4;
++
++	return 0;
++}
++
++static int rp2040_gbdg_rp1_read_mux(struct rp2040_gbdg *priv_data, u8 gpio,
++				    u32 *data)
++{
++	size_t offset;
++	int ret;
++
++	ret = rp2040_gbdg_calc_mux_offset(gpio, &offset);
++	if (ret)
++		return ret;
++
++	*data = readl(priv_data->gpio_base + offset);
++
++	return 0;
++}
++
++static int rp2040_gbdg_rp1_write_mux(struct rp2040_gbdg *priv_data, u8 gpio,
++				     u32 val)
++{
++	size_t offset;
++	int ret;
++
++	ret = rp2040_gbdg_calc_mux_offset(gpio, &offset);
++	if (ret)
++		return ret;
++
++	writel(val, priv_data->gpio_base + offset);
++
++	return 0;
++}
++
++static size_t rp2040_gbdg_max_transfer_size(struct spi_device *spi)
++{
++	return MAX_TRANSFER_SIZE;
++}
++
++static int rp2040_gbdg_get_device_info(struct i2c_client *client,
++				       struct rp2040_gbdg_device_info *info)
++{
++	u8 buf[TOTAL_RD_HDR_SIZE];
++	u8 retries = I2C_RETRIES;
++	u8 *read_pos = buf;
++	size_t field_size;
++	int ret;
++
++	do {
++		ret = i2c_master_recv(client, buf, sizeof(buf));
++		if (!retries--)
++			break;
++	} while (ret == -ETIMEDOUT);
++
++	if (ret != sizeof(buf))
++		return ret < 0 ? ret : -EIO;
++
++	field_size = sizeof_field(struct rp2040_gbdg_device_info, status);
++	memcpy(&info->status, read_pos, field_size);
++	read_pos += field_size;
++
++	field_size = sizeof_field(struct rp2040_gbdg_device_info, md5);
++	memcpy(&info->md5, read_pos, field_size);
++	read_pos += field_size;
++
++	field_size = sizeof_field(struct rp2040_gbdg_device_info, version);
++	memcpy(&info->version, read_pos, field_size);
++	read_pos += field_size;
++
++	field_size = sizeof_field(struct rp2040_gbdg_device_info, id);
++	memcpy(&info->id, read_pos, field_size);
++
++	return 0;
++}
++
++static int rp2040_gbdg_poll_device_info(struct i2c_client *client,
++					struct rp2040_gbdg_device_info *info)
++{
++	struct rp2040_gbdg_device_info itnl;
++	int ret;
++
++	itnl.status = STATUS_BUSY;
++
++	while (itnl.status & STATUS_BUSY) {
++		ret = rp2040_gbdg_get_device_info(client, &itnl);
++		if (ret)
++			return ret;
++	}
++	memcpy(info, &itnl, sizeof(itnl));
++
++	return 0;
++}
++
++static int rp2040_gbdg_get_buffer_hash(struct i2c_client *client, u8 *md5)
++{
++	struct rp2040_gbdg_device_info info;
++	int ret;
++
++	ret = rp2040_gbdg_poll_device_info(client, &info);
++	if (ret)
++		return ret;
++
++	memcpy(md5, info.md5, MD5_DIGEST_SIZE);
++
++	return 0;
++}
++
++static int rp2040_gbdg_wait_until_free(struct i2c_client *client, u8 *status)
++{
++	struct rp2040_gbdg_device_info info;
++	int ret;
++
++	ret = rp2040_gbdg_poll_device_info(client, &info);
++	if (ret)
++		return ret;
++
++	if (status)
++		*status = info.status;
++
++	return 0;
++}
++
++static int rp2040_gbdg_i2c_send(struct i2c_client *client, const u8 *buf,
++				size_t len)
++{
++	u8 retries = I2C_RETRIES;
++	int ret;
++
++	ret = rp2040_gbdg_wait_until_free(client, NULL);
++	if (ret) {
++		dev_err(&client->dev,
++			"%s() rp2040_gbdg_wait_until_free failed\n", __func__);
++		return ret;
++	}
++
++	do {
++		ret = i2c_master_send(client, buf, len);
++		if (!retries--)
++			break;
++	} while (ret == -ETIMEDOUT);
++
++	if (ret != len) {
++		dev_err(&client->dev, "%s() i2c_master_send returned %d\n",
++			__func__, ret);
++		return ret < 0 ? ret : -EIO;
++	}
++
++	return 0;
++}
++
++static int rp2040_gbdg_10byte_cmd(struct i2c_client *client, u8 cmd, u32 addr,
++				  u32 len)
++{
++	u8 buffer[10];
++
++	buffer[0] = FIXED_SIZE_CMD_PREFIX;
++	buffer[1] = cmd;
++	memcpy(&buffer[2], &addr, sizeof(addr));
++	memcpy(&buffer[6], &len, sizeof(len));
++
++	return rp2040_gbdg_i2c_send(client, buffer, sizeof(buffer));
++}
++
++static int rp2040_gbdg_18byte_cmd(struct i2c_client *client, u8 cmd,
++				  const u8 *digest)
++{
++	u8 buffer[18];
++
++	buffer[0] = FIXED_SIZE_CMD_PREFIX;
++	buffer[1] = cmd;
++	memcpy(&buffer[2], digest, MD5_DIGEST_SIZE);
++
++	return rp2040_gbdg_i2c_send(client, buffer, sizeof(buffer));
++}
++
++static int rp2040_gbdg_block_hash(struct rp2040_gbdg *priv_data, const u8 *data,
++				  size_t len, u8 *out)
++{
++	size_t remaining = RP2040_GBDG_BLOCK_SIZE;
++	size_t pad;
++	int ret;
++
++	static const u8 padding[64] = {
++		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++		0xFF, 0xFF, 0xFF, 0xFF,
++	};
++
++	if (len > RP2040_GBDG_BLOCK_SIZE) {
++		return -EMSGSIZE;
++	} else if (len == RP2040_GBDG_BLOCK_SIZE) {
++		return crypto_shash_digest(priv_data->shash_desc, data, len,
++					   out);
++	} else {
++		ret = crypto_shash_init(priv_data->shash_desc);
++		if (ret)
++			return ret;
++
++		ret = crypto_shash_update(priv_data->shash_desc, data, len);
++		if (ret)
++			return ret;
++		remaining -= len;
++
++		/* Pad up-to a 64-byte boundary, unless that takes us over. */
++		pad = round_up(len, 64);
++		if (pad != len && pad < RP2040_GBDG_BLOCK_SIZE) {
++			ret = crypto_shash_update(priv_data->shash_desc,
++						  padding, pad - len);
++			if (ret)
++				return ret;
++			remaining -= (pad - len);
++		}
++
++		/* Pad up-to RP2040_GBDG_BLOCK_SIZE in, preferably, 64-byte chunks */
++		while (remaining) {
++			pad = min_t(size_t, remaining, (size_t)64U);
++			ret = crypto_shash_update(priv_data->shash_desc,
++						  padding, pad);
++			if (ret)
++				return ret;
++			remaining -= pad;
++		}
++		return crypto_shash_final(priv_data->shash_desc, out);
++	}
++}
++
++static int rp2040_gbdg_set_remote_buffer_fast(struct rp2040_gbdg *priv_data,
++					      const u8 *data, unsigned int len)
++{
++	struct i2c_client *client = priv_data->client;
++	int ret;
++
++	if (len > RP2040_GBDG_BLOCK_SIZE)
++		return -EMSGSIZE;
++	if (!priv_data->fast_xfer_gpios)
++		return -EIO;
++
++	ret = rp2040_gbdg_10byte_cmd(client, CMD_DAT_RECV,
++				     priv_data->fast_xfer_recv_gpio_base, len);
++	if (ret) {
++		dev_err(&client->dev, "%s() failed to enter fast data mode\n",
++			__func__);
++		return ret;
++	}
++
++	return rp2040_gbdg_fast_xfer(priv_data, data, len);
++}
++
++static int rp2040_gbdg_set_remote_buffer_i2c(struct rp2040_gbdg *priv_data,
++					     const u8 *data, unsigned int len)
++{
++	struct i2c_client *client = priv_data->client;
++	unsigned int write_len;
++	int ret;
++
++	if (len > RP2040_GBDG_BLOCK_SIZE)
++		return -EMSGSIZE;
++
++	priv_data->buffer[0] = WRITE_DATA_PREFIX;
++	write_len = min(len, HALF_BUFFER);
++	memcpy(&priv_data->buffer[1], data, write_len);
++
++	ret = rp2040_gbdg_i2c_send(client, priv_data->buffer, write_len + 1);
++	if (ret)
++		return ret;
++
++	len -= write_len;
++	data += write_len;
++
++	if (!len)
++		return 0;
++
++	priv_data->buffer[0] = WRITE_DATA_UPPER_PREFIX;
++	memcpy(&priv_data->buffer[1], data, len);
++	ret = rp2040_gbdg_i2c_send(client, priv_data->buffer, len + 1);
++
++	return ret;
++}
++
++static int rp2040_gbdg_set_remote_buffer(struct rp2040_gbdg *priv_data,
++					 const u8 *data, unsigned int len)
++{
++	if (priv_data->fast_xfer_gpios)
++		return rp2040_gbdg_set_remote_buffer_fast(priv_data, data, len);
++	else
++		return rp2040_gbdg_set_remote_buffer_i2c(priv_data, data, len);
++}
++
++/* Loads data by checksum if available or resorts to sending byte-by-byte */
++static int rp2040_gbdg_load_block_remote(struct rp2040_gbdg *priv_data,
++					 const void *data, unsigned int len,
++					 u8 *digest, bool persist)
++{
++	u8 ascii_digest[MD5_DIGEST_SIZE * 2 + 1] = { 0 };
++	struct i2c_client *client = priv_data->client;
++	u8 remote_digest[MD5_DIGEST_SIZE];
++	u8 local_digest[MD5_DIGEST_SIZE];
++	int ret;
++
++	if (len > RP2040_GBDG_BLOCK_SIZE)
++		return -EMSGSIZE;
++
++	ret = rp2040_gbdg_block_hash(priv_data, data, len, local_digest);
++	if (ret)
++		return ret;
++
++	if (digest)
++		memcpy(digest, local_digest, MD5_DIGEST_SIZE);
++
++	/* Check if the RP2040 has the data already */
++	ret = rp2040_gbdg_18byte_cmd(client, CMD_READ_CSUM, local_digest);
++	if (ret)
++		return ret;
++
++	ret = rp2040_gbdg_get_buffer_hash(client, remote_digest);
++	if (ret)
++		return ret;
++
++	if (memcmp(local_digest, remote_digest, MD5_DIGEST_SIZE)) {
++		bin2hex(ascii_digest, local_digest, MD5_DIGEST_SIZE);
++		dev_info(&client->dev, "%s() device missing data: %s\n",
++			 __func__, ascii_digest);
++		/*
++		 * N.B. We're fine to send (the potentially shorter) transfer->len
++		 * number of bytes here as the RP2040 will pad with 0xFF up to buffer
++		 * size once we stop sending.
++		 */
++		ret = rp2040_gbdg_set_remote_buffer(priv_data, data, len);
++		if (ret)
++			return ret;
++
++		/* Make sure the data actually arrived. */
++		ret = rp2040_gbdg_get_buffer_hash(client, remote_digest);
++		if (memcmp(local_digest, remote_digest, MD5_DIGEST_SIZE)) {
++			dev_err(&priv_data->client->dev,
++				"%s() unable to send data to device\n",
++				__func__);
++			return -EREMOTEIO;
++		}
++
++		if (persist) {
++			dev_info(&client->dev,
++				 "%s() sent missing data to device, saving\n",
++				 __func__);
++			ret = rp2040_gbdg_10byte_cmd(client, CMD_SAVE_CACHE, 0,
++						     0);
++			if (ret)
++				return ret;
++		}
++	}
++
++	return 0;
++}
++
++static int rp2040_gbdg_transfer_block(struct rp2040_gbdg *priv_data,
++				      const void *data, unsigned int len)
++{
++	struct i2c_client *client = priv_data->client;
++	int ret;
++
++	if (len > RP2040_GBDG_BLOCK_SIZE)
++		return -EMSGSIZE;
++
++	ret = rp2040_gbdg_load_block_remote(priv_data, data, len, NULL, true);
++	if (ret)
++		return ret;
++
++	/* Remote rambuffer now has correct contents, send it */
++	ret = rp2040_gbdg_10byte_cmd(client, CMD_SEND_RB, 0, len);
++	if (ret)
++		return ret;
++
++	/*
++	 * Wait for data to have actually completed sending as we may be de-asserting CS too quickly
++	 * otherwise.
++	 */
++	ret = rp2040_gbdg_wait_until_free(client, NULL);
++	if (ret)
++		return ret;
++
++	return 0;
++}
++
++static int rp2040_gbdg_transfer_manifest(struct rp2040_gbdg *priv_data,
++					 const u8 *data, unsigned int len)
++{
++	struct i2c_client *client = priv_data->client;
++	static const char magic[] = "DATA_MANFST";
++	unsigned int remaining = len;
++	const u32 data_length = len;
++	u8 digest[MD5_DIGEST_SIZE];
++	u8 *digest_write_pos;
++	u8 status;
++	int ret;
++
++	memcpy(priv_data->manifest_prep, magic, sizeof(magic));
++	memcpy(priv_data->manifest_prep + sizeof(magic), &data_length,
++	       sizeof(data_length));
++	digest_write_pos =
++		priv_data->manifest_prep + sizeof(magic) + sizeof(data_length);
++
++	while (remaining) {
++		unsigned int size = min(remaining, RP2040_GBDG_BLOCK_SIZE);
++
++		ret = rp2040_gbdg_block_hash(priv_data, data, size,
++					     digest_write_pos);
++		if (ret)
++			return ret;
++
++		remaining -= size;
++		data += size;
++		digest_write_pos += MD5_DIGEST_SIZE;
++	}
++
++	ret = rp2040_gbdg_load_block_remote(
++		priv_data, priv_data->manifest_prep,
++		digest_write_pos - priv_data->manifest_prep, digest, true);
++	if (ret)
++		return ret;
++
++	dev_info(&client->dev, "%s() issue CMD_SEND_MANI\n", __func__);
++	ret = rp2040_gbdg_18byte_cmd(client, CMD_SEND_MANI, digest);
++	if (ret)
++		return ret;
++
++	ret = rp2040_gbdg_wait_until_free(client, &status);
++	if (ret)
++		return ret;
++
++	dev_info(&client->dev, "%s() SEND_MANI response: %02x\n", __func__,
++		 status);
++
++	return status;
++}
++
++/* Precondition: correctly initialised fast_xfer_*, gpio_base, rio_base */
++static int rp2040_gbdg_fast_xfer(struct rp2040_gbdg *priv_data, const u8 *data,
++				 size_t len)
++{
++	struct i2c_client *client = priv_data->client;
++	void __iomem *clock_toggle;
++	void __iomem *data_set;
++	size_t clock_bank;
++	size_t data_bank;
++	u8 clock_offset;
++	u8 data_offset;
++	u32 clock_mux;
++	u32 data_mux;
++
++	if (priv_data->fast_xfer_requires_i2c_lock)
++		i2c_lock_bus(client->adapter, I2C_LOCK_ROOT_ADAPTER);
++
++	rp2040_gbdg_rp1_read_mux(priv_data, priv_data->fast_xfer_data_index,
++				 &data_mux);
++	rp2040_gbdg_rp1_read_mux(priv_data, priv_data->fast_xfer_clock_index,
++				 &clock_mux);
++
++	gpiod_direction_output(priv_data->fast_xfer_gpios->desc[0], 1);
++	gpiod_direction_output(priv_data->fast_xfer_gpios->desc[1], 0);
++
++	rp2040_gbdg_rp1_calc_offsets(priv_data->fast_xfer_data_index,
++				     &data_bank, &data_offset);
++	rp2040_gbdg_rp1_calc_offsets(priv_data->fast_xfer_clock_index,
++				     &clock_bank, &clock_offset);
++
++	data_set = priv_data->rio_base + data_bank + 0x2000; /* SET offset */
++	clock_toggle =
++		priv_data->rio_base + clock_bank + 0x1000; /* XOR offset */
++
++	while (len--) {
++		/* MSB first ordering */
++		u32 d = ~(*data++) << 4U;
++		/*
++		 * Clock out each bit of data, LSB first
++		 * (DDR, achieves approx 5 Mbps)
++		 */
++		for (size_t i = 0; i < 8; i++) {
++			/* Branchless set/clr data */
++			writel(1 << data_offset,
++			       data_set + ((d <<= 1) & 0x1000) /* CLR offset */
++			);
++
++			/* Toggle the clock */
++			writel(1 << clock_offset, clock_toggle);
++		}
++	}
++
++	rp2040_gbdg_rp1_write_mux(priv_data, priv_data->fast_xfer_data_index,
++				  data_mux);
++	rp2040_gbdg_rp1_write_mux(priv_data, priv_data->fast_xfer_clock_index,
++				  clock_mux);
++
++	if (priv_data->fast_xfer_requires_i2c_lock)
++		i2c_unlock_bus(client->adapter, I2C_LOCK_ROOT_ADAPTER);
++
++	return 0;
++}
++
++static int rp2040_gbdg_transfer_bypass(struct rp2040_gbdg *priv_data,
++				       const u8 *data, unsigned int length)
++{
++	int ret;
++	u8 *buf;
++
++	if (priv_data->fast_xfer_gpios) {
++		ret = rp2040_gbdg_10byte_cmd(
++			priv_data->client, CMD_DAT_EMIT,
++			priv_data->fast_xfer_recv_gpio_base, length);
++		return ret ? ret :
++			     rp2040_gbdg_fast_xfer(priv_data, data, length);
++	}
++
++	buf = priv_data->buffer;
++
++	while (length) {
++		unsigned int xfer = min(length, HALF_BUFFER);
++
++		buf[0] = DIRECT_PREFIX;
++		buf[1] = DIRECT_CMD_EMIT;
++		memcpy(&buf[2], data, xfer);
++		ret = rp2040_gbdg_i2c_send(priv_data->client, buf, xfer + 2);
++		if (ret)
++			return ret;
++		length -= xfer;
++		data += xfer;
++	}
++
++	return 0;
++}
++
++static int rp2040_gbdg_transfer_cached(struct rp2040_gbdg *priv_data,
++				       const u8 *data, unsigned int length)
++{
++	int ret;
++
++	/*
++	 * Caching mechanism divides data into '8KiB - 9' (8183 byte)
++	 * 'RP2040_GBDG_BLOCK_SIZE' blocks.
++	 *
++	 * If there's a large amount of data to send, instead, attempt to make use
++	 * of a manifest.
++	 */
++	if (length > (2 * RP2040_GBDG_BLOCK_SIZE)) {
++		if (!rp2040_gbdg_transfer_manifest(priv_data, data, length))
++			return 0;
++	}
++
++	priv_data->transfer_progress = 0;
++	while (length) {
++		unsigned int xfer = min(length, RP2040_GBDG_BLOCK_SIZE);
++
++		ret = rp2040_gbdg_transfer_block(priv_data, data, xfer);
++		if (ret)
++			return ret;
++		length -= xfer;
++		data += xfer;
++		priv_data->transfer_progress += xfer;
++	}
++	priv_data->transfer_progress = 0;
++
++	return 0;
++}
++
++static int rp2040_gbdg_transfer_one(struct spi_controller *ctlr,
++				    struct spi_device *spi,
++				    struct spi_transfer *transfer)
++{
++	/* All transfers are performed in a synchronous manner. As such, return '0'
++	 * on success or -ve on failure. (Returning +ve indicates async xfer)
++	 */
++
++	struct rp2040_gbdg *priv_data = spi_controller_get_devdata(ctlr);
++
++	if (priv_data->bypass_cache) {
++		return rp2040_gbdg_transfer_bypass(priv_data, transfer->tx_buf,
++						   transfer->len);
++	} else {
++		return rp2040_gbdg_transfer_cached(priv_data, transfer->tx_buf,
++						   transfer->len);
++	}
++}
++
++static void rp2040_gbdg_set_cs(struct spi_device *spi, bool enable)
++{
++	static const char disable_cs[] = { DIRECT_PREFIX, DIRECT_CMD_CS, 0x00 };
++	static const char enable_cs[] = { DIRECT_PREFIX, DIRECT_CMD_CS, 0x10 };
++	struct rp2040_gbdg *p_data;
++
++	p_data = spi_controller_get_devdata(spi->controller);
++
++	/*
++	 * 'enable' is inverted and instead describes the logic level of an
++	 * active-low CS.
++	 */
++	rp2040_gbdg_i2c_send(p_data->client, enable ? disable_cs : enable_cs,
++			     3);
++}
++
++static int rp2040_gbdg_gpio_request(struct gpio_chip *gc, unsigned int offset)
++{
++	struct rp2040_gbdg *priv_data = gpiochip_get_data(gc);
++	u32 pattern;
++	int ret;
++
++	if (offset >= NUM_GPIO)
++		return -EINVAL;
++
++	pattern = (1 << (offset + 8));
++	if (pattern & priv_data->gpio_requested)
++		return -EBUSY;
++
++	/* Resume if previously no gpio requested */
++	if (!priv_data->gpio_requested) {
++		ret = pm_runtime_resume_and_get(&priv_data->client->dev);
++		if (ret) {
++			dev_err(&priv_data->client->dev,
++				"%s(%u) unable to resume\n", __func__, offset);
++			return ret;
++		}
++	}
++
++	priv_data->gpio_requested |= pattern;
++
++	return 0;
++}
++
++static void rp2040_gbdg_gpio_free(struct gpio_chip *gc, unsigned int offset)
++{
++	struct rp2040_gbdg *priv_data = gpiochip_get_data(gc);
++	u32 pattern;
++	int ret;
++
++	if (offset >= NUM_GPIO || !priv_data->gpio_requested)
++		return;
++
++	pattern = (1 << (offset + 8));
++
++	priv_data->gpio_requested &= ~pattern;
++	rp2040_gbdg_gpio_dir_in(gc, offset);
++	rp2040_gbdg_gpio_set(gc, offset, 0);
++
++	if (!priv_data->gpio_requested) {
++		ret = pm_runtime_put_autosuspend(&priv_data->client->dev);
++		if (ret) {
++			dev_err(&priv_data->client->dev,
++				"%s(%u) unable to put_autosuspend\n", __func__,
++				offset);
++		}
++	}
++}
++
++static int rp2040_gbdg_gpio_get_direction(struct gpio_chip *gc,
++					  unsigned int offset)
++{
++	struct rp2040_gbdg *priv_data = gpiochip_get_data(gc);
++
++	if (offset >= NUM_GPIO)
++		return -EINVAL;
++
++	return (priv_data->gpio_direction & (1 << (offset + 8))) ?
++		       GPIO_LINE_DIRECTION_IN :
++		       GPIO_LINE_DIRECTION_OUT;
++}
++
++static int rp2040_gbdg_gpio_dir_in(struct gpio_chip *gc, unsigned int offset)
++{
++	struct rp2040_gbdg *priv_data = gpiochip_get_data(gc);
++	struct i2c_client *client = priv_data->client;
++
++	if (offset >= NUM_GPIO)
++		return -EINVAL;
++
++	priv_data->gpio_direction |= (1 << (offset + 8));
++
++	return rp2040_gbdg_10byte_cmd(client, CMD_GPIO_OE,
++				      ~priv_data->gpio_direction,
++				      priv_data->gpio_direction);
++}
++
++static int rp2040_gbdg_gpio_dir_out(struct gpio_chip *gc, unsigned int offset,
++				    int value)
++{
++	struct rp2040_gbdg *priv_data = gpiochip_get_data(gc);
++	struct i2c_client *client = priv_data->client;
++	u32 pattern;
++	int ret;
++
++	if (offset >= NUM_GPIO)
++		return -EINVAL;
++
++	pattern = (1 << (offset + 8));
++
++	ret = rp2040_gbdg_10byte_cmd(client, CMD_GPIO_ST_CL,
++				     value ? pattern : 0, !value ? pattern : 0);
++	if (ret) {
++		dev_err(&client->dev, "%s(%u, %d) could not ST_CL\n", __func__,
++			offset, value);
++		return ret;
++	}
++
++	priv_data->gpio_direction &= ~pattern;
++	ret = rp2040_gbdg_10byte_cmd(client, CMD_GPIO_OE,
++				     ~priv_data->gpio_direction,
++				     priv_data->gpio_direction);
++
++	return ret;
++}
++
++static int rp2040_gbdg_gpio_get(struct gpio_chip *gc, unsigned int offset)
++{
++	struct rp2040_gbdg *priv_data = gpiochip_get_data(gc);
++	struct i2c_client *client = priv_data->client;
++	struct rp2040_gbdg_device_info info;
++	int ret;
++
++	if (offset >= NUM_GPIO)
++		return -EINVAL;
++
++	ret = rp2040_gbdg_get_device_info(client, &info);
++	if (ret)
++		return ret;
++
++	return info.status & (1 << (offset + 8)) ? 1 : 0;
++}
++
++static void rp2040_gbdg_gpio_set(struct gpio_chip *gc, unsigned int offset,
++				 int value)
++{
++	struct rp2040_gbdg *priv_data = gpiochip_get_data(gc);
++	struct i2c_client *client = priv_data->client;
++	u32 pattern;
++
++	if (offset >= NUM_GPIO)
++		return;
++
++	pattern = (1 << (offset + 8));
++	rp2040_gbdg_10byte_cmd(client, CMD_GPIO_ST_CL, value ? pattern : 0,
++			       !value ? pattern : 0);
++}
++
++static int rp2040_gbdg_get_regulator(struct device *dev,
++				     struct rp2040_gbdg *rp2040_gbdg)
++{
++	struct regulator *reg = devm_regulator_get(dev, "power");
++
++	if (IS_ERR(reg))
++		return PTR_ERR(reg);
++
++	rp2040_gbdg->regulator = reg;
++
++	return 0;
++}
++
++static void rp2040_gbdg_parse_dt(struct rp2040_gbdg *rp2040_gbdg)
++{
++	struct i2c_client *client = rp2040_gbdg->client;
++	struct of_phandle_args of_args[2] = { 0 };
++	struct device *dev = &client->dev;
++	struct device_node *dn;
++
++	rp2040_gbdg->bypass_cache =
++		of_property_read_bool(client->dev.of_node, "bypass-cache");
++
++	/* Optionally configure fast_xfer if RP1 is being used */
++	if (of_parse_phandle_with_args(client->dev.of_node, "fast_xfer-gpios",
++				       "#gpio-cells", 0, &of_args[0]) ||
++	    of_parse_phandle_with_args(client->dev.of_node, "fast_xfer-gpios",
++				       "#gpio-cells", 1, &of_args[1])) {
++		dev_info(dev, "Could not parse fast_xfer-gpios phandles\n");
++		goto node_put;
++	}
++
++	if (of_args[0].np != of_args[1].np) {
++		dev_info(
++			dev,
++			"fast_xfer-gpios are not provided by the same controller\n");
++		goto node_put;
++	}
++	dn = of_args[0].np;
++	if (!of_device_is_compatible(dn, "raspberrypi,rp1-gpio")) {
++		dev_info(dev, "fast_xfer-gpios controller is not an rp1\n");
++		goto node_put;
++	}
++	if (of_args[0].args_count != 2 || of_args[1].args_count != 2) {
++		dev_info(dev, "of_args count is %d\n", of_args[0].args_count);
++		goto node_put;
++	}
++
++	if (of_property_read_u32_index(
++		    client->dev.of_node, "fast_xfer_recv_gpio_base", 0,
++		    &rp2040_gbdg->fast_xfer_recv_gpio_base)) {
++		dev_info(dev, "Could not read fast_xfer_recv_gpio_base\n");
++		goto node_put;
++	}
++
++	rp2040_gbdg->fast_xfer_gpios =
++		devm_gpiod_get_array_optional(dev, "fast_xfer", GPIOD_ASIS);
++	if (!rp2040_gbdg->fast_xfer_gpios) {
++		dev_info(dev, "Could not acquire fast_xfer-gpios\n");
++		goto node_put;
++	}
++
++	rp2040_gbdg->fast_xfer_data_index = of_args[0].args[0];
++	rp2040_gbdg->fast_xfer_clock_index = of_args[1].args[0];
++	rp2040_gbdg->fast_xfer_requires_i2c_lock = of_property_read_bool(
++		client->dev.of_node, "fast_xfer_requires_i2c_lock");
++
++	rp2040_gbdg->gpio_base = of_iomap(dn, 0);
++	if (IS_ERR_OR_NULL(rp2040_gbdg->gpio_base)) {
++		dev_info(&client->dev, "%s() unable to map gpio_base\n",
++			 __func__);
++		rp2040_gbdg->gpio_base = NULL;
++		devm_gpiod_put_array(dev, rp2040_gbdg->fast_xfer_gpios);
++		rp2040_gbdg->fast_xfer_gpios = NULL;
++		goto node_put;
++	}
++
++	rp2040_gbdg->rio_base = of_iomap(dn, 1);
++	if (IS_ERR_OR_NULL(rp2040_gbdg->rio_base)) {
++		dev_info(&client->dev, "%s() unable to map rio_base\n",
++			 __func__);
++		rp2040_gbdg->rio_base = NULL;
++		iounmap(rp2040_gbdg->gpio_base);
++		rp2040_gbdg->gpio_base = NULL;
++		devm_gpiod_put_array(dev, rp2040_gbdg->fast_xfer_gpios);
++		rp2040_gbdg->fast_xfer_gpios = NULL;
++		goto node_put;
++	}
++
++node_put:
++	if (of_args[0].np)
++		of_node_put(of_args[0].np);
++	if (of_args[1].np)
++		of_node_put(of_args[1].np);
++}
++
++static int rp2040_gbdg_power_off(struct rp2040_gbdg *rp2040_gbdg)
++{
++	struct device *dev = &rp2040_gbdg->client->dev;
++	int ret;
++
++	ret = regulator_disable(rp2040_gbdg->regulator);
++	if (ret) {
++		dev_err(dev, "%s: Could not disable regulator\n", __func__);
++		return ret;
++	}
++
++	return 0;
++}
++
++static int rp2040_gbdg_power_on(struct rp2040_gbdg *rp2040_gbdg)
++{
++	struct device *dev = &rp2040_gbdg->client->dev;
++	int ret;
++
++	ret = regulator_enable(rp2040_gbdg->regulator);
++	if (ret) {
++		dev_err(dev, "%s: Could not enable regulator\n", __func__);
++		return ret;
++	}
++
++	return 0;
++}
++
++static int transfer_progress_show(struct seq_file *s, void *data)
++{
++	struct rp2040_gbdg *rp2040_gbdg = s->private;
++
++	seq_printf(s, "%zu\n", rp2040_gbdg->transfer_progress);
++	return 0;
++}
++
++DEFINE_SHOW_ATTRIBUTE(transfer_progress);
++
++static int rp2040_gbdg_probe(struct i2c_client *client)
++{
++	struct rp2040_gbdg_device_info info;
++	struct spi_controller *controller;
++	struct device *dev = &client->dev;
++	struct rp2040_gbdg *rp2040_gbdg;
++	struct device_node *np;
++	char debugfs_name[128];
++	int ret;
++
++	np = dev->of_node;
++
++	controller = devm_spi_alloc_master(dev, sizeof(struct rp2040_gbdg));
++	if (!controller)
++		return dev_err_probe(dev, ENOMEM,
++				     "could not alloc spi controller\n");
++
++	rp2040_gbdg = spi_controller_get_devdata(controller);
++	i2c_set_clientdata(client, rp2040_gbdg);
++	rp2040_gbdg->controller = controller;
++	rp2040_gbdg->client = client;
++
++	ret = rp2040_gbdg_get_regulator(dev, rp2040_gbdg);
++	if (ret < 0)
++		return dev_err_probe(dev, ret, "Cannot get regulator\n");
++
++	ret = rp2040_gbdg_power_on(rp2040_gbdg);
++	if (ret)
++		return dev_err_probe(dev, ret, "Could not power on device\n");
++
++	pm_runtime_set_active(dev);
++	pm_runtime_get_noresume(dev);
++	pm_runtime_enable(dev);
++	pm_runtime_set_autosuspend_delay(dev, 1000);
++	pm_runtime_use_autosuspend(dev);
++
++	ret = rp2040_gbdg_get_device_info(client, &info);
++	if (ret) {
++		dev_err(dev, "Could not get device info\n");
++		goto err_pm;
++	}
++
++	dev_info(dev, "%s() found dev ID: %llx, fw ver. %u\n", __func__,
++		 info.id, info.version);
++
++	rp2040_gbdg->shash = crypto_alloc_shash("md5", 0, 0);
++	if (IS_ERR(rp2040_gbdg->shash)) {
++		ret = PTR_ERR(rp2040_gbdg->shash);
++		dev_err(dev, "Could not allocate shash\n");
++		goto err_pm;
++	}
++
++	if (crypto_shash_digestsize(rp2040_gbdg->shash) != MD5_DIGEST_SIZE) {
++		ret = -EINVAL;
++		dev_err(dev, "error: Unexpected hash digest size\n");
++		goto err_shash;
++	}
++
++	rp2040_gbdg->shash_desc =
++		devm_kmalloc(dev,
++			     sizeof(struct shash_desc) +
++				     crypto_shash_descsize(rp2040_gbdg->shash),
++			     0);
++
++	if (!rp2040_gbdg->shash_desc) {
++		ret = -ENOMEM;
++		dev_err(dev,
++			"error: Could not allocate memory for shash_desc\n");
++		goto err_shash;
++	}
++	rp2040_gbdg->shash_desc->tfm = rp2040_gbdg->shash;
++
++	controller->bus_num = -1;
++	controller->num_chipselect = 1;
++	controller->mode_bits = SPI_CPOL | SPI_CPHA;
++	controller->bits_per_word_mask = SPI_BPW_MASK(8);
++	controller->min_speed_hz = 35000000;
++	controller->max_speed_hz = 35000000;
++	controller->max_transfer_size = rp2040_gbdg_max_transfer_size;
++	controller->max_message_size = rp2040_gbdg_max_transfer_size;
++	controller->transfer_one = rp2040_gbdg_transfer_one;
++	controller->set_cs = rp2040_gbdg_set_cs;
++
++	controller->dev.of_node = np;
++	controller->auto_runtime_pm = true;
++
++	ret = devm_spi_register_controller(dev, controller);
++	if (ret) {
++		dev_err(dev, "error: Could not register SPI controller\n");
++		goto err_shash;
++	}
++
++	memset(&rp2040_gbdg->gc, 0, sizeof(struct gpio_chip));
++	rp2040_gbdg->gc.parent = dev;
++	rp2040_gbdg->gc.label = MODULE_NAME;
++	rp2040_gbdg->gc.owner = THIS_MODULE;
++	rp2040_gbdg->gc.base = -1;
++	rp2040_gbdg->gc.ngpio = NUM_GPIO;
++
++	rp2040_gbdg->gc.request = rp2040_gbdg_gpio_request;
++	rp2040_gbdg->gc.free = rp2040_gbdg_gpio_free;
++	rp2040_gbdg->gc.get_direction = rp2040_gbdg_gpio_get_direction;
++	rp2040_gbdg->gc.direction_input = rp2040_gbdg_gpio_dir_in;
++	rp2040_gbdg->gc.direction_output = rp2040_gbdg_gpio_dir_out;
++	rp2040_gbdg->gc.get = rp2040_gbdg_gpio_get;
++	rp2040_gbdg->gc.set = rp2040_gbdg_gpio_set;
++	rp2040_gbdg->gc.can_sleep = true;
++
++	rp2040_gbdg->gpio_requested = 0;
++
++	/* Coming out of reset, all GPIOs are inputs */
++	rp2040_gbdg->gpio_direction = ~0;
++
++	ret = devm_gpiochip_add_data(dev, &rp2040_gbdg->gc, rp2040_gbdg);
++	if (ret) {
++		dev_err(dev, "error: Could not add data to gpiochip\n");
++		goto err_shash;
++	}
++
++	rp2040_gbdg_parse_dt(rp2040_gbdg);
++
++	snprintf(debugfs_name, sizeof(debugfs_name), "rp2040-spi:%s",
++		 dev_name(dev));
++	rp2040_gbdg->debugfs = debugfs_create_dir(debugfs_name, NULL);
++	debugfs_create_file("transfer_progress", 0444, rp2040_gbdg->debugfs,
++			    rp2040_gbdg, &transfer_progress_fops);
++
++	pm_runtime_mark_last_busy(dev);
++	pm_runtime_put_autosuspend(dev);
++
++	return 0;
++
++err_shash:
++	crypto_free_shash(rp2040_gbdg->shash);
++err_pm:
++	pm_runtime_disable(dev);
++	pm_runtime_put_noidle(dev);
++	rp2040_gbdg_power_off(rp2040_gbdg);
++
++	return ret;
++}
++
++static void rp2040_gbdg_remove(struct i2c_client *client)
++{
++	struct rp2040_gbdg *priv_data = i2c_get_clientdata(client);
++
++	crypto_free_shash(priv_data->shash);
++
++	if (priv_data->gpio_base) {
++		iounmap(priv_data->gpio_base);
++		priv_data->gpio_base = NULL;
++	}
++	if (priv_data->rio_base) {
++		iounmap(priv_data->rio_base);
++		priv_data->rio_base = NULL;
++	}
++
++	pm_runtime_disable(&client->dev);
++	if (!pm_runtime_status_suspended(&client->dev))
++		rp2040_gbdg_power_off(priv_data);
++	pm_runtime_set_suspended(&client->dev);
++}
++
++static const struct i2c_device_id rp2040_gbdg_id[] = {
++	{ "rp2040-gpio-bridge", 0 },
++	{},
++};
++MODULE_DEVICE_TABLE(i2c, rp2040_gbdg_id);
++
++static const struct of_device_id rp2040_gbdg_of_match[] = {
++	{ .compatible = "raspberrypi,rp2040-gpio-bridge" },
++	{},
++};
++MODULE_DEVICE_TABLE(of, rp2040_gbdg_of_match);
++
++static int rp2040_gbdg_runtime_suspend(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++
++	return rp2040_gbdg_power_off(i2c_get_clientdata(client));
++}
++
++static int rp2040_gbdg_runtime_resume(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++
++	return rp2040_gbdg_power_on(i2c_get_clientdata(client));
++}
++
++static const struct dev_pm_ops rp2040_gbdg_pm_ops = { SET_RUNTIME_PM_OPS(
++	rp2040_gbdg_runtime_suspend, rp2040_gbdg_runtime_resume, NULL) };
++
++static struct i2c_driver rp2040_gbdg_driver = {
++	.driver = {
++		.name = MODULE_NAME,
++		.of_match_table = of_match_ptr(rp2040_gbdg_of_match),
++		.pm = &rp2040_gbdg_pm_ops,
++	},
++	.probe = rp2040_gbdg_probe,
++	.remove = rp2040_gbdg_remove,
++	.id_table = rp2040_gbdg_id,
++};
++
++module_i2c_driver(rp2040_gbdg_driver);
++
++MODULE_AUTHOR("Richard Oliver <richard.oliver@raspberrypi.com>");
++MODULE_DESCRIPTION("Raspberry Pi RP2040 GPIO Bridge");
++MODULE_LICENSE("GPL");
++MODULE_SOFTDEP("pre: md5");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0486-dmaengine-dw-axi-dmac-Honour-snps-block-size.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0486-dmaengine-dw-axi-dmac-Honour-snps-block-size.patch
new file mode 100644
index 00000000..417f8c3f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0486-dmaengine-dw-axi-dmac-Honour-snps-block-size.patch
@@ -0,0 +1,52 @@
+From 840c5d327a27df01e0e6a606ac1da4b3be3db28d Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 10 Jul 2024 14:47:17 +0100
+Subject: [PATCH 486/697] dmaengine: dw-axi-dmac: Honour snps,block-size
+
+The snps,block-size DT property declares the maximum block size for each
+channel of the dw-axi-dmac. However, the driver ignores these when
+setting max_seg_size and uses MAX_BLOCK_SIZE (4096) instead.
+
+To take advantage of the efficiencies of larger blocks, calculate the
+minimum block size across all channels and use that instead.
+
+See: https://github.com/raspberrypi/linux/issues/6256
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
++++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+@@ -1560,6 +1560,7 @@ static int dw_probe(struct platform_devi
+ 	struct dw_axi_dma *dw;
+ 	struct dw_axi_dma_hcfg *hdata;
+ 	struct reset_control *resets;
++	unsigned int max_seg_size;
+ 	unsigned int flags;
+ 	u32 i;
+ 	int ret;
+@@ -1670,9 +1671,21 @@ static int dw_probe(struct platform_devi
+ 	 * Synopsis DesignWare AxiDMA datasheet mentioned Maximum
+ 	 * supported blocks is 1024. Device register width is 4 bytes.
+ 	 * Therefore, set constraint to 1024 * 4.
++	 * However, if all channels specify a greater value, use that instead.
+ 	 */
++
+ 	dw->dma.dev->dma_parms = &dw->dma_parms;
+-	dma_set_max_seg_size(&pdev->dev, MAX_BLOCK_SIZE);
++	max_seg_size = UINT_MAX;
++	for (i = 0; i < dw->hdata->nr_channels; i++) {
++		unsigned int block_size = chip->dw->hdata->block_size[i];
++
++		if (!block_size)
++			block_size = MAX_BLOCK_SIZE;
++		max_seg_size = min(block_size, max_seg_size);
++	}
++
++	dma_set_max_seg_size(&pdev->dev, max_seg_size);
++
+ 	platform_set_drvdata(pdev, chip);
+ 
+ 	pm_runtime_enable(chip->dev);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0487-brcmfmac-Only-match-complete-feature-names.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0487-brcmfmac-Only-match-complete-feature-names.patch
new file mode 100644
index 00000000..9aeb6dbf
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0487-brcmfmac-Only-match-complete-feature-names.patch
@@ -0,0 +1,40 @@
+From 82ad4f0383417fcd1a1d4d55b512662533c26234 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 5 Feb 2024 15:25:30 +0000
+Subject: [PATCH 487/697] brcmfmac: Only match complete feature names
+
+The firmware advertises its features as a string of words separated by
+spaces. Ensure that feature names are only matched in their entirety.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/feature.c    | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+@@ -44,7 +44,7 @@ static const struct brcmf_feat_fwcap brc
+ 	{ BRCMF_FEAT_DOT11H, "802.11h" },
+ 	{ BRCMF_FEAT_SAE, "sae" },
+ 	{ BRCMF_FEAT_FWAUTH, "idauth" },
+-	{ BRCMF_FEAT_SAE_EXT, "sae_ext " },
++	{ BRCMF_FEAT_SAE_EXT, "sae_ext" },
+ };
+ 
+ #ifdef DEBUG
+@@ -241,7 +241,14 @@ static void brcmf_feat_firmware_capabili
+ 	brcmf_dbg(INFO, "[ %s]\n", caps);
+ 
+ 	for (i = 0; i < ARRAY_SIZE(brcmf_fwcap_map); i++) {
+-		if (strnstr(caps, brcmf_fwcap_map[i].fwcap_id, sizeof(caps))) {
++		const char *match = strnstr(caps, brcmf_fwcap_map[i].fwcap_id, sizeof(caps));
++		if (match) {
++			char endc;
++			if (match != caps && match[-1] != ' ')
++				continue;
++			endc = match[strlen(brcmf_fwcap_map[i].fwcap_id)];
++			if (endc != '\0' && endc != ' ')
++				continue;
+ 			id = brcmf_fwcap_map[i].feature;
+ 			brcmf_dbg(INFO, "enabling feature: %s\n",
+ 				  brcmf_feat_names[id]);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0488-brcmfmac-Add-extsae-as-an-alias-for-sae_ext.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0488-brcmfmac-Add-extsae-as-an-alias-for-sae_ext.patch
new file mode 100644
index 00000000..edcfd9e9
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0488-brcmfmac-Add-extsae-as-an-alias-for-sae_ext.patch
@@ -0,0 +1,23 @@
+From 01ff9fa2141dfe84ccc1988ca02a86e3f7914701 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 1 Feb 2024 16:33:42 +0000
+Subject: [PATCH 488/697] brcmfmac: Add "extsae" as an alias for "sae_ext"
+
+The Cypress firmwares use "extsae" to indicate wpa_supplicant-hosted
+SAE/WPA3.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+@@ -45,6 +45,7 @@ static const struct brcmf_feat_fwcap brc
+ 	{ BRCMF_FEAT_SAE, "sae" },
+ 	{ BRCMF_FEAT_FWAUTH, "idauth" },
+ 	{ BRCMF_FEAT_SAE_EXT, "sae_ext" },
++	{ BRCMF_FEAT_SAE_EXT, "extsae" },
+ };
+ 
+ #ifdef DEBUG
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0489-brcmfmac-support-extsae-with-psk-1x-offloading.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0489-brcmfmac-support-extsae-with-psk-1x-offloading.patch
new file mode 100644
index 00000000..c78c459b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0489-brcmfmac-support-extsae-with-psk-1x-offloading.patch
@@ -0,0 +1,47 @@
+From bdbdf50cd22f767f296fe78080945e6d7a728d72 Mon Sep 17 00:00:00 2001
+From: Chien-Chia Chen <carella.chen@infineon.com>
+Date: Thu, 18 Nov 2021 03:22:26 -0600
+Subject: [PATCH 489/697] brcmfmac: support extsae with psk / 1x offloading
+
+support sae executed in wpa_supplicant and offload 4-way handshake offload.
+
+Signed-off-by: Chien-Chia Chen <carella.chen@infineon.com>
+
+JIRA: SWWLAN-142424
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c    | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -2170,6 +2170,10 @@ brcmf_set_key_mgmt(struct net_device *nd
+ 			if (sme->crypto.sae_pwd) {
+ 				brcmf_dbg(INFO, "using SAE offload\n");
+ 				profile->use_fwsup = BRCMF_PROFILE_FWSUP_SAE;
++			} else if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWSUP) &&
++				brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SAE_EXT)) {
++				brcmf_dbg(INFO, "using EXTSAE with PSK offload\n");
++				profile->use_fwsup = BRCMF_PROFILE_FWSUP_PSK;
+ 			}
+ 			break;
+ 		case WLAN_AKM_SUITE_FT_OVER_SAE:
+@@ -2472,7 +2476,8 @@ brcmf_cfg80211_connect(struct wiphy *wip
+ 
+ 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWSUP)) {
+ 		if (sme->crypto.psk) {
+-			if (profile->use_fwsup != BRCMF_PROFILE_FWSUP_SAE) {
++			if ((profile->use_fwsup != BRCMF_PROFILE_FWSUP_SAE) &&
++				(profile->use_fwsup != BRCMF_PROFILE_FWSUP_PSK)) {
+ 				if (WARN_ON(profile->use_fwsup !=
+ 					BRCMF_PROFILE_FWSUP_NONE)) {
+ 					err = -EINVAL;
+@@ -2496,7 +2501,8 @@ brcmf_cfg80211_connect(struct wiphy *wip
+ 			err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 0);
+ 		}
+ 
+-		if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_PSK) {
++		if ((profile->use_fwsup == BRCMF_PROFILE_FWSUP_PSK) &&
++			sme->crypto.psk) {
+ 			err = brcmf_set_pmk(ifp, sme->crypto.psk,
+ 					    BRCMF_WSEC_MAX_PSK_LEN);
+ 		} else if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_SAE) {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0490-dt-bindings-clk-rp1-Add-clocks-representing-MIPI-DSI.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0490-dt-bindings-clk-rp1-Add-clocks-representing-MIPI-DSI.patch
new file mode 100644
index 00000000..e2612465
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0490-dt-bindings-clk-rp1-Add-clocks-representing-MIPI-DSI.patch
@@ -0,0 +1,25 @@
+From 4129650c1fc888b310077fccbddbf2985ff834a0 Mon Sep 17 00:00:00 2001
+From: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+Date: Fri, 10 May 2024 15:18:44 +0100
+Subject: [PATCH 490/697] dt-bindings: clk: rp1: Add clocks representing MIPI
+ DSI byteclock
+
+Define two new RP1 clocks, representing the MIPI DSI byteclock
+sources for the dividers used to generate MIPI[01] DPI pixel clocks.
+(Previously they were represented by "fake" fixed clocks sources).
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+---
+ include/dt-bindings/clock/rp1.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/include/dt-bindings/clock/rp1.h
++++ b/include/dt-bindings/clock/rp1.h
+@@ -54,3 +54,7 @@
+ /* Extra PLL output channels - RP1B0 only */
+ #define RP1_PLL_VIDEO_PRI_PH		43
+ #define RP1_PLL_AUDIO_TERN		44
++
++/* MIPI clocks managed by the DSI driver */
++#define RP1_CLK_MIPI0_DSI_BYTECLOCK	45
++#define RP1_CLK_MIPI1_DSI_BYTECLOCK	46
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0491-media-bcm2835-unicam-Reinstate-old-downstream-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0491-media-bcm2835-unicam-Reinstate-old-downstream-driver.patch
new file mode 100644
index 00000000..d515e713
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0491-media-bcm2835-unicam-Reinstate-old-downstream-driver.patch
@@ -0,0 +1,150 @@
+From 7648041fa09644ec9cb8c600d81392b65ee37087 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 15 Jul 2024 15:27:12 +0100
+Subject: [PATCH 491/697] media: bcm2835-unicam: Reinstate old downstream
+ driver as legacy
+
+Whilst the Unicam driver has now been upstreamed it only supports
+configuration via Media Controller (not driven from the /dev/videoN
+node), which makes life significantly harder for simple devices such
+as mono sensors, and HDMI or analogue video to CSI2 bridge chips
+(eg TC358743 and ADV7282M).
+
+Fix up the downstream driver so that it builds, reinstate the links
+from Kconfig and Makefile to it, and give it a new Kconfig name
+(VIDEO_BCM2835_UNICAM_LEGACY).
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/platform/Kconfig                  |  1 +
+ drivers/media/platform/Makefile                 |  1 +
+ drivers/media/platform/bcm2835/Kconfig          |  7 +++++--
+ drivers/media/platform/bcm2835/Makefile         |  3 ++-
+ drivers/media/platform/bcm2835/bcm2835-unicam.c | 17 +++++++----------
+ 5 files changed, 16 insertions(+), 13 deletions(-)
+
+--- a/drivers/media/platform/Kconfig
++++ b/drivers/media/platform/Kconfig
+@@ -67,6 +67,7 @@ source "drivers/media/platform/amlogic/K
+ source "drivers/media/platform/amphion/Kconfig"
+ source "drivers/media/platform/aspeed/Kconfig"
+ source "drivers/media/platform/atmel/Kconfig"
++source "drivers/media/platform/bcm2835/Kconfig"
+ source "drivers/media/platform/broadcom/Kconfig"
+ source "drivers/media/platform/cadence/Kconfig"
+ source "drivers/media/platform/chips-media/Kconfig"
+--- a/drivers/media/platform/Makefile
++++ b/drivers/media/platform/Makefile
+@@ -10,6 +10,7 @@ obj-y += amlogic/
+ obj-y += amphion/
+ obj-y += aspeed/
+ obj-y += atmel/
++obj-y += bcm2835/
+ obj-y += broadcom/
+ obj-y += cadence/
+ obj-y += chips-media/
+--- a/drivers/media/platform/bcm2835/Kconfig
++++ b/drivers/media/platform/bcm2835/Kconfig
+@@ -1,7 +1,7 @@
+ # Broadcom VideoCore4 V4L2 camera support
+ 
+-config VIDEO_BCM2835_UNICAM
+-	tristate "Broadcom BCM283x/BCM271x Unicam video capture driver"
++config VIDEO_BCM2835_UNICAM_LEGACY
++	tristate "Broadcom BCM283x/BCM271x Unicam video capture driver - no MC"
+ 	depends on VIDEO_DEV
+ 	depends on ARCH_BCM2835 || COMPILE_TEST
+ 	select VIDEO_V4L2_SUBDEV_API
+@@ -12,6 +12,9 @@ config VIDEO_BCM2835_UNICAM
+ 	  Say Y here to enable support for the BCM283x/BCM271x CSI-2 receiver.
+ 	  This is a V4L2 driver that controls the CSI-2 receiver directly,
+ 	  independently from the VC4 firmware.
++	  This is the downstream version of this driver that still supports
++	  being driven from the video node for simple devices. The mainline
++	  driver only supports using Media Controller.
+ 	  This driver is mutually exclusive with the use of bcm2835-camera. The
+ 	  firmware will disable all access to the peripheral from within the
+ 	  firmware if it finds a DT node using it, and bcm2835-camera will
+--- a/drivers/media/platform/bcm2835/Makefile
++++ b/drivers/media/platform/bcm2835/Makefile
+@@ -1,3 +1,4 @@
+ # Makefile for BCM2835 Unicam driver
+ 
+-obj-$(CONFIG_VIDEO_BCM2835_UNICAM) += bcm2835-unicam.o
++bcm2835-unicam-legacy-y := bcm2835-unicam.o
++obj-$(CONFIG_VIDEO_BCM2835_UNICAM_LEGACY) += bcm2835-unicam-legacy.o
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -1474,7 +1474,7 @@ static int unicam_enum_input(struct file
+ 		return -EINVAL;
+ 
+ 	inp->type = V4L2_INPUT_TYPE_CAMERA;
+-	if (v4l2_subdev_has_op(dev->sensor, video, s_dv_timings)) {
++	if (v4l2_subdev_has_op(dev->sensor, pad, s_dv_timings)) {
+ 		inp->capabilities = V4L2_IN_CAP_DV_TIMINGS;
+ 		inp->std = 0;
+ 	} else if (v4l2_subdev_has_op(dev->sensor, video, s_std)) {
+@@ -1709,7 +1709,7 @@ static int unicam_g_dv_timings(struct fi
+ 	struct unicam_node *node = video_drvdata(file);
+ 	struct unicam_device *dev = node->dev;
+ 
+-	return v4l2_subdev_call(dev->sensor, video, g_dv_timings, timings);
++	return v4l2_subdev_call(dev->sensor, pad, g_dv_timings, 0, timings);
+ }
+ 
+ static int unicam_s_dv_timings(struct file *file, void *priv,
+@@ -1720,7 +1720,7 @@ static int unicam_s_dv_timings(struct fi
+ 	struct v4l2_dv_timings current_timings;
+ 	int ret;
+ 
+-	ret = v4l2_subdev_call(dev->sensor, video, g_dv_timings,
++	ret = v4l2_subdev_call(dev->sensor, pad, g_dv_timings, 0,
+ 			       &current_timings);
+ 
+ 	if (ret < 0)
+@@ -1732,7 +1732,7 @@ static int unicam_s_dv_timings(struct fi
+ 	if (vb2_is_busy(&node->buffer_queue))
+ 		return -EBUSY;
+ 
+-	ret = v4l2_subdev_call(dev->sensor, video, s_dv_timings, timings);
++	ret = v4l2_subdev_call(dev->sensor, pad, s_dv_timings, 0, timings);
+ 
+ 	/* Force recomputation of bytesperline */
+ 	node->v_fmt.fmt.pix.bytesperline = 0;
+@@ -1748,7 +1748,7 @@ static int unicam_query_dv_timings(struc
+ 	struct unicam_node *node = video_drvdata(file);
+ 	struct unicam_device *dev = node->dev;
+ 
+-	return v4l2_subdev_call(dev->sensor, video, query_dv_timings, timings);
++	return v4l2_subdev_call(dev->sensor, pad, query_dv_timings, 0, timings);
+ }
+ 
+ static int unicam_enum_dv_timings(struct file *file, void *priv,
+@@ -2196,9 +2196,6 @@ static int unicam_queue_setup(struct vb2
+ 				    node->v_fmt.fmt.pix.sizeimage :
+ 				    node->v_fmt.fmt.meta.buffersize;
+ 
+-	if (vq->num_buffers + *nbuffers < 3)
+-		*nbuffers = 3 - vq->num_buffers;
+-
+ 	if (*nplanes) {
+ 		if (sizes[0] < size) {
+ 			unicam_err(dev, "sizes[0] %i < size %u\n", sizes[0],
+@@ -3074,7 +3071,7 @@ static int register_node(struct unicam_d
+ 		    !v4l2_subdev_has_op(unicam->sensor, video, querystd))
+ 			v4l2_disable_ioctl(&node->video_dev, VIDIOC_QUERYSTD);
+ 		if (pad_id == METADATA_PAD ||
+-		    !v4l2_subdev_has_op(unicam->sensor, video, s_dv_timings)) {
++		    !v4l2_subdev_has_op(unicam->sensor, pad, s_dv_timings)) {
+ 			v4l2_disable_ioctl(&node->video_dev, VIDIOC_S_EDID);
+ 			v4l2_disable_ioctl(&node->video_dev, VIDIOC_G_EDID);
+ 			v4l2_disable_ioctl(&node->video_dev,
+@@ -3503,7 +3500,7 @@ static void unicam_remove(struct platfor
+ }
+ 
+ static const struct of_device_id unicam_of_match[] = {
+-	{ .compatible = "brcm,bcm2835-unicam", },
++	{ .compatible = "brcm,bcm2835-unicam-legacy", },
+ 	{ /* sentinel */ },
+ };
+ MODULE_DEVICE_TABLE(of, unicam_of_match);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0492-media-platform-Move-bcm2835-unicam-compatible-to-dow.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0492-media-platform-Move-bcm2835-unicam-compatible-to-dow.patch
new file mode 100644
index 00000000..7ebdf5db
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0492-media-platform-Move-bcm2835-unicam-compatible-to-dow.patch
@@ -0,0 +1,59 @@
+From eafa44f41018f0b6f3af8be0a4ecf9790ac82a5d Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 23 Jul 2024 11:27:16 +0100
+Subject: [PATCH 492/697] media: platform: Move bcm2835-unicam compatible to
+ downstream driver
+
+The upstream Unicam driver needs a set of userland changes to get
+libcamera to run, and those aren't written or merged yet.
+
+Move the "brcm,bcm2835-unicam" compatible from the upstream driver
+to the old downstream version so that users can run libcamera
+against 6.10.
+Once the libcamera changes have been merged this can be reverted
+to use the upstream driver.
+
+If using the non-legacy compatible then assume we want to use
+media-controller API for configuration.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/platform/bcm2835/bcm2835-unicam.c  | 8 +++++++-
+ drivers/media/platform/broadcom/bcm2835-unicam.c | 2 +-
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
++++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
+@@ -3381,6 +3381,11 @@ static int unicam_probe(struct platform_
+ 	 * device tree requests it.
+ 	 */
+ 	unicam->mc_api = media_controller;
++
++	/* Compatible is for the non-legacy version of the driver - use compatible */
++	if (of_device_get_match_data(&unicam->pdev->dev))
++		unicam->mc_api = true;
++
+ 	if (of_property_read_bool(pdev->dev.of_node, "brcm,media-controller"))
+ 		unicam->mc_api = true;
+ 
+@@ -3500,7 +3505,8 @@ static void unicam_remove(struct platfor
+ }
+ 
+ static const struct of_device_id unicam_of_match[] = {
+-	{ .compatible = "brcm,bcm2835-unicam-legacy", },
++	{ .compatible = "brcm,bcm2835-unicam", .data = (void *)1 },
++	{ .compatible = "brcm,bcm2835-unicam-legacy", .data = 0 },
+ 	{ /* sentinel */ },
+ };
+ MODULE_DEVICE_TABLE(of, unicam_of_match);
+--- a/drivers/media/platform/broadcom/bcm2835-unicam.c
++++ b/drivers/media/platform/broadcom/bcm2835-unicam.c
+@@ -2717,7 +2717,7 @@ static void unicam_remove(struct platfor
+ }
+ 
+ static const struct of_device_id unicam_of_match[] = {
+-	{ .compatible = "brcm,bcm2835-unicam", },
++	{ .compatible = "brcm,bcm2835-unicam-upstream", },
+ 	{ /* sentinel */ },
+ };
+ MODULE_DEVICE_TABLE(of, unicam_of_match);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0493-pinctrl-rp1-jump-through-hoops-to-avoid-PCIe-latency.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0493-pinctrl-rp1-jump-through-hoops-to-avoid-PCIe-latency.patch
new file mode 100644
index 00000000..02546199
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0493-pinctrl-rp1-jump-through-hoops-to-avoid-PCIe-latency.patch
@@ -0,0 +1,288 @@
+From 27da8c704fe8fdb6004fea7c75743447b63fac2d Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Tue, 16 Jul 2024 16:47:08 +0100
+Subject: [PATCH 493/697] pinctrl: rp1: jump through hoops to avoid PCIe
+ latency issues
+
+Automatic link power saving plus the ability of a root complex to buffer
+pending posted write transfers (and consider them complete before being
+transmitted on the wire) causes compression of updates to GPIO state.
+
+The large bandwidth of a Gen 2 x4 link means the writes toggle state
+inside RP1 as fast as it can go (~20MHz), which is bad for applications
+wanting bitbash with at least a few microseconds of delay between
+updates.
+
+By tailoring IO access patterns to a special Root Complex register,
+writes to GPIOs can be stalled until the link wakes - meaning all writes
+end up with a reasonably consistent minimum pacing (~200ns).
+
+Additionally, write barriers have no effect other than to arbitrarily
+delay some writes by a small, variable amount - so remove the vast
+majority of these in areas that could be hot-paths.
+
+Although the IO memory is mapped with Device strongly-ordered semantics,
+this doesn't prevent the splitter inside BCM2712 from letting an MMIO
+read request to a GPIO register get ahead of the pacing writes to the
+Root Complex register. So each pin state read must flush writes out to
+the Outer-Shareable domain.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/pinctrl/pinctrl-rp1.c | 120 +++++++++++++++++++++++++++++-----
+ 1 file changed, 105 insertions(+), 15 deletions(-)
+
+--- a/drivers/pinctrl/pinctrl-rp1.c
++++ b/drivers/pinctrl/pinctrl-rp1.c
+@@ -197,6 +197,7 @@ struct rp1_pin_info {
+ 	void __iomem *inte;
+ 	void __iomem *ints;
+ 	void __iomem *pad;
++	void __iomem *dummy;
+ };
+ 
+ enum funcs {
+@@ -276,6 +277,7 @@ struct rp1_pinctrl {
+ 	void __iomem *gpio_base;
+ 	void __iomem *rio_base;
+ 	void __iomem *pads_base;
++	void __iomem *dummy_base;
+ 	int irq[RP1_NUM_BANKS];
+ 	struct rp1_pin_info pins[RP1_NUM_GPIOS];
+ 
+@@ -577,6 +579,42 @@ static bool persist_gpio_outputs = true;
+ module_param(persist_gpio_outputs, bool, 0644);
+ MODULE_PARM_DESC(persist_gpio_outputs, "Enable GPIO_OUT persistence when pin is freed");
+ 
++static bool pace_pin_updates = true;
++module_param(pace_pin_updates, bool, 0644);
++MODULE_PARM_DESC(pace_pin_updates, "Update pin states with guaranteed monotonicity if PCIe ASPM is enabled");
++
++static inline void rp1_pin_writel(u32 val, void __iomem *dummy, void __iomem *reg)
++{
++	unsigned long flags;
++
++	local_irq_save(flags);
++	/*
++	 * Issuing 6 pipelined writes to the RC's Slot Control register will stall the
++	 * peripheral bus inside 2712 if the link is in L1. This acts as a lightweight
++	 * "fence" operation preventing back-to-back writes arriving at RP1 on a wake.
++	 */
++	if (dummy) {
++		writel_relaxed(0, dummy);
++		writel_relaxed(0, dummy);
++		writel_relaxed(0, dummy);
++		writel_relaxed(0, dummy);
++		writel_relaxed(0, dummy);
++		writel_relaxed(0, dummy);
++	}
++	writel_relaxed(val, reg);
++	local_irq_restore(flags);
++}
++
++static inline u32 rp1_pin_readl(const void __iomem *ioaddr)
++{
++	/*
++	 * Prior posted writes may not yet have been emitted by the CPU - do a store-flush
++	 * before reading GPIO state, as this will serialise writes versus the next issued read.
++	 */
++	__dma_wmb();
++	return readl(ioaddr);
++}
++
+ static int rp1_pinconf_set(struct pinctrl_dev *pctldev,
+ 			   unsigned int offset, unsigned long *configs,
+ 			   unsigned int num_configs);
+@@ -603,12 +641,12 @@ static struct rp1_pin_info *rp1_get_pin_
+ 
+ static void rp1_pad_update(struct rp1_pin_info *pin, u32 clr, u32 set)
+ {
+-	u32 padctrl = readl(pin->pad);
++	u32 padctrl = rp1_pin_readl(pin->pad);
+ 
+ 	padctrl &= ~clr;
+ 	padctrl |= set;
+ 
+-	writel(padctrl, pin->pad);
++	rp1_pin_writel(padctrl, pin->dummy, pin->pad);
+ }
+ 
+ static void rp1_input_enable(struct rp1_pin_info *pin, int value)
+@@ -625,7 +663,7 @@ static void rp1_output_enable(struct rp1
+ 
+ static u32 rp1_get_fsel(struct rp1_pin_info *pin)
+ {
+-	u32 ctrl = readl(pin->gpio + RP1_GPIO_CTRL);
++	u32 ctrl = rp1_pin_readl(pin->gpio + RP1_GPIO_CTRL);
+ 	u32 oeover = FLD_GET(ctrl, RP1_GPIO_CTRL_OEOVER);
+ 	u32 fsel = FLD_GET(ctrl, RP1_GPIO_CTRL_FUNCSEL);
+ 
+@@ -637,7 +675,7 @@ static u32 rp1_get_fsel(struct rp1_pin_i
+ 
+ static void rp1_set_fsel(struct rp1_pin_info *pin, u32 fsel)
+ {
+-	u32 ctrl = readl(pin->gpio + RP1_GPIO_CTRL);
++	u32 ctrl = rp1_pin_readl(pin->gpio + RP1_GPIO_CTRL);
+ 
+ 	if (fsel >= RP1_FSEL_COUNT)
+ 		fsel = RP1_FSEL_NONE_HW;
+@@ -652,12 +690,12 @@ static void rp1_set_fsel(struct rp1_pin_
+ 		FLD_SET(ctrl, RP1_GPIO_CTRL_OEOVER, RP1_OEOVER_PERI);
+ 	}
+ 	FLD_SET(ctrl, RP1_GPIO_CTRL_FUNCSEL, fsel);
+-	writel(ctrl, pin->gpio + RP1_GPIO_CTRL);
++	rp1_pin_writel(ctrl, pin->dummy, pin->gpio + RP1_GPIO_CTRL);
+ }
+ 
+ static int rp1_get_dir(struct rp1_pin_info *pin)
+ {
+-	return !(readl(pin->rio + RP1_RIO_OE) & (1 << pin->offset)) ?
++	return !(rp1_pin_readl(pin->rio + RP1_RIO_OE) & (1 << pin->offset)) ?
+ 		RP1_DIR_INPUT : RP1_DIR_OUTPUT;
+ }
+ 
+@@ -665,19 +703,19 @@ static void rp1_set_dir(struct rp1_pin_i
+ {
+ 	int offset = is_input ? RP1_CLR_OFFSET : RP1_SET_OFFSET;
+ 
+-	writel(1 << pin->offset, pin->rio + RP1_RIO_OE + offset);
++	rp1_pin_writel(1 << pin->offset, pin->dummy, pin->rio + RP1_RIO_OE + offset);
+ }
+ 
+ static int rp1_get_value(struct rp1_pin_info *pin)
+ {
+-	return !!(readl(pin->rio + RP1_RIO_IN) & (1 << pin->offset));
++	return !!(rp1_pin_readl(pin->rio + RP1_RIO_IN) & (1 << pin->offset));
+ }
+ 
+ static void rp1_set_value(struct rp1_pin_info *pin, int value)
+ {
+ 	/* Assume the pin is already an output */
+-	writel(1 << pin->offset,
+-	       pin->rio + RP1_RIO_OUT + (value ? RP1_SET_OFFSET : RP1_CLR_OFFSET));
++	rp1_pin_writel(1 << pin->offset, pin->dummy,
++		       pin->rio + RP1_RIO_OUT + (value ? RP1_SET_OFFSET : RP1_CLR_OFFSET));
+ }
+ 
+ static int rp1_gpio_get(struct gpio_chip *chip, unsigned offset)
+@@ -1298,7 +1336,7 @@ static const struct pinmux_ops rp1_pmx_o
+ 
+ static void rp1_pull_config_set(struct rp1_pin_info *pin, unsigned int arg)
+ {
+-	u32 padctrl = readl(pin->pad);
++	u32 padctrl = rp1_pin_readl(pin->pad);
+ 
+ 	FLD_SET(padctrl, RP1_PAD_PULL, arg & 0x3);
+ 
+@@ -1398,7 +1436,7 @@ static int rp1_pinconf_get(struct pinctr
+ 	if (!pin)
+ 		return -EINVAL;
+ 
+-	padctrl = readl(pin->pad);
++	padctrl = rp1_pin_readl(pin->pad);
+ 
+ 	switch (param) {
+ 	case PIN_CONFIG_INPUT_ENABLE:
+@@ -1493,6 +1531,7 @@ static int rp1_pinctrl_probe(struct plat
+ {
+ 	struct device *dev = &pdev->dev;
+ 	struct device_node *np = dev->of_node;
++	struct device_node *rp1_node = NULL;
+ 	struct rp1_pinctrl *pc;
+ 	struct gpio_irq_chip *girq;
+ 	int err, i;
+@@ -1528,6 +1567,40 @@ static int rp1_pinctrl_probe(struct plat
+ 	pc->gpio_chip = rp1_gpio_chip;
+ 	pc->gpio_chip.parent = dev;
+ 
++	/*
++	 * Workaround for the vagaries of PCIe on BCM2712
++	 *
++	 * If the link to RP1 is in L1, then the BRCMSTB RC will buffer many
++	 * outbound writes - and generate write responses for them, despite the
++	 * fact that the link is not yet active. This has the effect of compressing
++	 * multiple writes to GPIOs together, destroying any pacing that an application
++	 * may require in the 1-10us range.
++	 *
++	 * The RC Slot Control configuration register is special. It emits a
++	 * MsgD for every write to it, will stall further writes until the message
++	 * goes out on the wire. This can be (ab)used to force CPU stalls when the
++	 * link is inactive, at the cost of a small amount of downstream bandwidth
++	 * and some 200ns of added latency for each write.
++	 *
++	 * Several back-to-back configuration writes are necessary to "fill the pipe",
++	 * otherwise the outbound MAC can consume a pending MMIO write and reorder
++	 * it with respect to the config writes - undoing the intent.
++	 *
++	 * of_iomap() is used directly here as the address overlaps with the RC driver's
++	 * usage.
++	 */
++	rp1_node = of_find_node_by_name(NULL, "rp1");
++	if (!rp1_node)
++		dev_err(&pdev->dev, "failed to find RP1 DT node\n");
++	else if (pace_pin_updates &&
++		 of_device_is_compatible(rp1_node->parent, "brcm,bcm2712-pcie")) {
++		pc->dummy_base = of_iomap(rp1_node->parent, 0);
++		if (IS_ERR(pc->dummy_base)) {
++			dev_warn(&pdev->dev, "could not map bcm2712 root complex registers\n");
++			pc->dummy_base = NULL;
++		}
++	}
++
+ 	for (i = 0; i < RP1_NUM_BANKS; i++) {
+ 		const struct rp1_iobank_desc *bank = &rp1_iobanks[i];
+ 		int j;
+@@ -1547,14 +1620,17 @@ static int rp1_pinctrl_probe(struct plat
+ 			pin->rio  = pc->rio_base + bank->rio_offset;
+ 			pin->pad  = pc->pads_base + bank->pads_offset +
+ 				    j * sizeof(u32);
++			pin->dummy = pc->dummy_base ? pc->dummy_base + 0xc0 : NULL;
+ 		}
+ 
+ 		raw_spin_lock_init(&pc->irq_lock[i]);
+ 	}
+ 
+ 	pc->pctl_dev = devm_pinctrl_register(dev, &rp1_pinctrl_desc, pc);
+-	if (IS_ERR(pc->pctl_dev))
+-		return PTR_ERR(pc->pctl_dev);
++	if (IS_ERR(pc->pctl_dev)) {
++		err = PTR_ERR(pc->pctl_dev);
++		goto out_iounmap;
++	}
+ 
+ 	girq = &pc->gpio_chip.irq;
+ 	girq->chip = &rp1_gpio_irq_chip;
+@@ -1583,7 +1659,7 @@ static int rp1_pinctrl_probe(struct plat
+ 	err = devm_gpiochip_add_data(dev, &pc->gpio_chip, pc);
+ 	if (err) {
+ 		dev_err(dev, "could not add GPIO chip\n");
+-		return err;
++		goto out_iounmap;
+ 	}
+ 
+ 	pc->gpio_range = rp1_pinctrl_gpio_range;
+@@ -1592,10 +1668,24 @@ static int rp1_pinctrl_probe(struct plat
+ 	pinctrl_add_gpio_range(pc->pctl_dev, &pc->gpio_range);
+ 
+ 	return 0;
++
++out_iounmap:
++	if (pc->dummy_base)
++		iounmap(pc->dummy_base);
++	return err;
++}
++
++static void rp1_pinctrl_remove(struct platform_device *pdev)
++{
++	struct rp1_pinctrl *pc = platform_get_drvdata(pdev);
++
++	if (pc->dummy_base)
++		iounmap(pc->dummy_base);
+ }
+ 
+ static struct platform_driver rp1_pinctrl_driver = {
+ 	.probe = rp1_pinctrl_probe,
++	.remove_new = rp1_pinctrl_remove,
+ 	.driver = {
+ 		.name = MODULE_NAME,
+ 		.of_match_table = rp1_pinctrl_match,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0494-spi-dw-Save-bandwidth-with-the-TMOD_TO-feature.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0494-spi-dw-Save-bandwidth-with-the-TMOD_TO-feature.patch
new file mode 100644
index 00000000..9a66cee7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0494-spi-dw-Save-bandwidth-with-the-TMOD_TO-feature.patch
@@ -0,0 +1,66 @@
+From 52b6d4c87bc1afc2ef70595532b55788a0309843 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 1 Jul 2024 15:49:14 +0100
+Subject: [PATCH 494/697] spi: dw: Save bandwidth with the TMOD_TO feature
+
+TMOD_TO is the transmit-only mode that doesn't put data into the receive
+FIFO. Using TMOD_TO when the user doesn't want the received data saves
+CPU time and memory bandwidth.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/spi/spi-dw-core.c | 27 +++++++++++++++++----------
+ 1 file changed, 17 insertions(+), 10 deletions(-)
+
+--- a/drivers/spi/spi-dw-core.c
++++ b/drivers/spi/spi-dw-core.c
+@@ -227,12 +227,17 @@ static irqreturn_t dw_spi_transfer_handl
+ 	 * final stage of the transfer. By doing so we'll get the next IRQ
+ 	 * right when the leftover incoming data is received.
+ 	 */
+-	dw_reader(dws);
+-	if (!dws->rx_len) {
+-		dw_spi_mask_intr(dws, 0xff);
++	if (dws->rx_len) {
++		dw_reader(dws);
++		if (!dws->rx_len) {
++			dw_spi_mask_intr(dws, 0xff);
++			spi_finalize_current_transfer(dws->host);
++		} else if (dws->rx_len <= dw_readl(dws, DW_SPI_RXFTLR)) {
++			dw_writel(dws, DW_SPI_RXFTLR, dws->rx_len - 1);
++		}
++	} else if (!dws->tx_len) {
++		dw_spi_mask_intr(dws, DW_SPI_INT_TXEI);
+ 		spi_finalize_current_transfer(dws->host);
+-	} else if (dws->rx_len <= dw_readl(dws, DW_SPI_RXFTLR)) {
+-		dw_writel(dws, DW_SPI_RXFTLR, dws->rx_len - 1);
+ 	}
+ 
+ 	/*
+@@ -241,12 +246,9 @@ static irqreturn_t dw_spi_transfer_handl
+ 	 * have the TXE IRQ flood at the final stage of the transfer.
+ 	 */
+ 	if (irq_status & DW_SPI_INT_TXEI) {
+-		dw_writer(dws);
+-		if (!dws->tx_len) {
++		if (!dws->tx_len)
+ 			dw_spi_mask_intr(dws, DW_SPI_INT_TXEI);
+-			if (!dws->rx_len)
+-				spi_finalize_current_transfer(dws->host);
+-		}
++		dw_writer(dws);
+ 	}
+ 
+ 	return IRQ_HANDLED;
+@@ -436,6 +438,11 @@ static int dw_spi_transfer_one(struct sp
+ 	dws->rx = transfer->rx_buf;
+ 	dws->rx_len = dws->tx_len;
+ 
++	if (!dws->rx) {
++		dws->rx_len = 0;
++		cfg.tmode = DW_SPI_CTRLR0_TMOD_TO;
++	}
++
+ 	/* Ensure the data above is visible for all CPUs */
+ 	smp_mb();
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0495-spi-dw-Save-bandwidth-with-the-TMOD_RO-feature.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0495-spi-dw-Save-bandwidth-with-the-TMOD_RO-feature.patch
new file mode 100644
index 00000000..9d7aa3fd
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0495-spi-dw-Save-bandwidth-with-the-TMOD_RO-feature.patch
@@ -0,0 +1,186 @@
+From 68c6f84a4f870132f344bf0c7d9fe2765f5ce825 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 1 Jul 2024 16:41:04 +0100
+Subject: [PATCH 495/697] spi: dw: Save bandwidth with the TMOD_RO feature
+
+TMOD_RO is the receive-only mode that doesn't require data in the
+transmit FIFO in order to generate clock cycles. Using TMOD_RO when the
+device doesn't care about the data sent to it saves CPU time and memory
+bandwidth.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/spi/spi-dw-core.c | 31 +++++++++++++++++++++-------
+ drivers/spi/spi-dw-dma.c  | 43 +++++++++++++++++++++++++--------------
+ 2 files changed, 52 insertions(+), 22 deletions(-)
+
+--- a/drivers/spi/spi-dw-core.c
++++ b/drivers/spi/spi-dw-core.c
+@@ -369,18 +369,18 @@ static void dw_spi_irq_setup(struct dw_s
+ 	 * will be adjusted at the final stage of the IRQ-based SPI transfer
+ 	 * execution so not to lose the leftover of the incoming data.
+ 	 */
+-	level = min_t(unsigned int, dws->fifo_len / 2, dws->tx_len);
++	level = min_t(unsigned int, dws->fifo_len / 2, dws->tx_len ? dws->tx_len : dws->rx_len);
+ 	dw_writel(dws, DW_SPI_TXFTLR, level);
+ 	dw_writel(dws, DW_SPI_RXFTLR, level - 1);
+ 
+ 	dws->transfer_handler = dw_spi_transfer_handler;
+ 
+-	imask = 0;
+-	if (dws->tx_len)
+-		imask |= DW_SPI_INT_TXEI | DW_SPI_INT_TXOI;
++	imask = DW_SPI_INT_TXEI | DW_SPI_INT_TXOI;
+ 	if (dws->rx_len)
+ 		imask |= DW_SPI_INT_RXUI | DW_SPI_INT_RXOI | DW_SPI_INT_RXFI;
+ 	dw_spi_umask_intr(dws, imask);
++	if (!dws->tx_len)
++		dw_writel(dws, DW_SPI_DR, 0);
+ }
+ 
+ /*
+@@ -403,13 +403,18 @@ static int dw_spi_poll_transfer(struct d
+ 	delay.unit = SPI_DELAY_UNIT_SCK;
+ 	nbits = dws->n_bytes * BITS_PER_BYTE;
+ 
++	if (!dws->tx_len)
++		dw_writel(dws, DW_SPI_DR, 0);
++
+ 	do {
+-		dw_writer(dws);
++		if (dws->tx_len)
++			dw_writer(dws);
+ 
+ 		delay.value = nbits * (dws->rx_len - dws->tx_len);
+ 		spi_delay_exec(&delay, transfer);
+ 
+-		dw_reader(dws);
++		if (dws->rx_len)
++			dw_reader(dws);
+ 
+ 		ret = dw_spi_check_status(dws, true);
+ 		if (ret)
+@@ -429,6 +434,7 @@ static int dw_spi_transfer_one(struct sp
+ 		.dfs = transfer->bits_per_word,
+ 		.freq = transfer->speed_hz,
+ 	};
++	int buswidth;
+ 	int ret;
+ 
+ 	dws->dma_mapped = 0;
+@@ -443,6 +449,18 @@ static int dw_spi_transfer_one(struct sp
+ 		cfg.tmode = DW_SPI_CTRLR0_TMOD_TO;
+ 	}
+ 
++	if (!dws->rx) {
++		dws->rx_len = 0;
++		cfg.tmode = DW_SPI_CTRLR0_TMOD_TO;
++	}
++	if (!dws->tx) {
++		dws->tx_len = 0;
++		cfg.tmode = DW_SPI_CTRLR0_TMOD_RO;
++		cfg.ndf = dws->rx_len;
++	}
++	buswidth = transfer->rx_buf ? transfer->rx_nbits :
++		  (transfer->tx_buf ? transfer->tx_nbits : 1);
++
+ 	/* Ensure the data above is visible for all CPUs */
+ 	smp_mb();
+ 
+@@ -973,7 +991,6 @@ int dw_spi_add_host(struct device *dev,
+ 			dev_warn(dev, "DMA init failed\n");
+ 		} else {
+ 			host->can_dma = dws->dma_ops->can_dma;
+-			host->flags |= SPI_CONTROLLER_MUST_TX;
+ 		}
+ 	}
+ 
+--- a/drivers/spi/spi-dw-dma.c
++++ b/drivers/spi/spi-dw-dma.c
+@@ -6,6 +6,7 @@
+  */
+ 
+ #include <linux/completion.h>
++#include <linux/delay.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/dmaengine.h>
+ #include <linux/irqreturn.h>
+@@ -470,13 +471,12 @@ static int dw_spi_dma_setup(struct dw_sp
+ 	u16 imr, dma_ctrl;
+ 	int ret;
+ 
+-	if (!xfer->tx_buf)
+-		return -EINVAL;
+-
+ 	/* Setup DMA channels */
+-	ret = dw_spi_dma_config_tx(dws);
+-	if (ret)
+-		return ret;
++	if (xfer->tx_buf) {
++		ret = dw_spi_dma_config_tx(dws);
++		if (ret)
++			return ret;
++	}
+ 
+ 	if (xfer->rx_buf) {
+ 		ret = dw_spi_dma_config_rx(dws);
+@@ -485,13 +485,17 @@ static int dw_spi_dma_setup(struct dw_sp
+ 	}
+ 
+ 	/* Set the DMA handshaking interface */
+-	dma_ctrl = DW_SPI_DMACR_TDMAE;
++	dma_ctrl = 0;
++	if (xfer->tx_buf)
++		dma_ctrl |= DW_SPI_DMACR_TDMAE;
+ 	if (xfer->rx_buf)
+ 		dma_ctrl |= DW_SPI_DMACR_RDMAE;
+ 	dw_writel(dws, DW_SPI_DMACR, dma_ctrl);
+ 
+ 	/* Set the interrupt mask */
+-	imr = DW_SPI_INT_TXOI;
++	imr = 0;
++	if (xfer->tx_buf)
++		imr |= DW_SPI_INT_TXOI;
+ 	if (xfer->rx_buf)
+ 		imr |= DW_SPI_INT_RXUI | DW_SPI_INT_RXOI;
+ 	dw_spi_umask_intr(dws, imr);
+@@ -508,15 +512,16 @@ static int dw_spi_dma_transfer_all(struc
+ {
+ 	int ret;
+ 
+-	/* Submit the DMA Tx transfer */
+-	ret = dw_spi_dma_submit_tx(dws, xfer->tx_sg.sgl, xfer->tx_sg.nents);
+-	if (ret)
+-		goto err_clear_dmac;
++	/* Submit the DMA Tx transfer if required */
++	if (xfer->tx_buf) {
++		ret = dw_spi_dma_submit_tx(dws, xfer->tx_sg.sgl, xfer->tx_sg.nents);
++		if (ret)
++			goto err_clear_dmac;
++	}
+ 
+ 	/* Submit the DMA Rx transfer if required */
+ 	if (xfer->rx_buf) {
+-		ret = dw_spi_dma_submit_rx(dws, xfer->rx_sg.sgl,
+-					   xfer->rx_sg.nents);
++		ret = dw_spi_dma_submit_rx(dws, xfer->rx_sg.sgl, xfer->rx_sg.nents);
+ 		if (ret)
+ 			goto err_clear_dmac;
+ 
+@@ -524,7 +529,15 @@ static int dw_spi_dma_transfer_all(struc
+ 		dma_async_issue_pending(dws->rxchan);
+ 	}
+ 
+-	dma_async_issue_pending(dws->txchan);
++	if (xfer->tx_buf) {
++		dma_async_issue_pending(dws->txchan);
++	} else {
++		/* Pause to allow DMA channel to fetch RX descriptor */
++		usleep_range(5, 10);
++
++		/* Write something to the TX FIFO to start the transfer */
++		dw_writel(dws, DW_SPI_DR, 0);
++	}
+ 
+ 	ret = dw_spi_dma_wait(dws, xfer->len, xfer->effective_speed_hz);
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0496-spi-dw-don-t-immediately-kill-DMA-transfers-if-an-er.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0496-spi-dw-don-t-immediately-kill-DMA-transfers-if-an-er.patch
new file mode 100644
index 00000000..b509b757
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0496-spi-dw-don-t-immediately-kill-DMA-transfers-if-an-er.patch
@@ -0,0 +1,41 @@
+From b3824e841051ece2613742ed44d9813233930e64 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Mon, 22 Jul 2024 15:27:51 +0100
+Subject: [PATCH 496/697] spi: dw: don't immediately kill DMA transfers if an
+ error occurs
+
+Disabling the peripheral resets controller state which has a dangerous
+side-effect of disabling the DMA handshake interface while it is active.
+This can cause DMA channels to hang.
+
+The error recovery pathway will wait for DMA to stop and reset the chip
+anyway, so mask further FIFO interrupts and let the transfer finish
+gracefully.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/spi/spi-dw-core.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-dw-core.c
++++ b/drivers/spi/spi-dw-core.c
+@@ -202,7 +202,18 @@ int dw_spi_check_status(struct dw_spi *d
+ 
+ 	/* Generically handle the erroneous situation */
+ 	if (ret) {
+-		dw_spi_reset_chip(dws);
++		/*
++		 * Forcibly halting the controller can cause DMA to hang.
++		 * Defer to dw_spi_handle_err outside of interrupt context
++		 * and mask further interrupts for the current transfer.
++		 */
++		if (dws->dma_mapped) {
++			dw_spi_mask_intr(dws, 0xff);
++			dw_readl(dws, DW_SPI_ICR);
++		} else {
++			dw_spi_reset_chip(dws);
++		}
++
+ 		if (dws->host->cur_msg)
+ 			dws->host->cur_msg->status = ret;
+ 	}
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0497-drivers-dw-axi-dmac-make-more-sensible-choices-about.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0497-drivers-dw-axi-dmac-make-more-sensible-choices-about.patch
new file mode 100644
index 00000000..72d594e8
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0497-drivers-dw-axi-dmac-make-more-sensible-choices-about.patch
@@ -0,0 +1,124 @@
+From a65500a2c7d9b75b4053c7c7340119f7fd0fbc1e Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Fri, 19 Jul 2024 15:55:56 +0100
+Subject: [PATCH 497/697] drivers: dw-axi-dmac: make more sensible choices
+ about memory accesses
+
+There's no real need to constrain MEM access widths to 32-bit (or
+narrower), as the DMAC is intelligent enough to size memory accesses
+appropriately. Wider accesses are more efficient.
+
+Similarly, MEM burst lengths don't need to be a function of DEV burst
+lengths - the DMAC packs/unpacks data into/from its internal channel
+FIFOs appropriately. Longer accesses are more efficient.
+
+However, the DMAC doesn't have complete support for unaligned accesses,
+and blocks are always defined in integer multiples of SRC_WIDTH, so odd
+source lengths or buffer alignments will prevent wide accesses being
+used, as before.
+
+There is an implicit requirement to limit requested DEV read burst
+lengths to less than the hardware's maximum configured MSIZE - otherwise
+RX data will be left over at the end of a block. There is no config
+register that reports this value, so the AXI burst length parameter is
+used to produce a facsimile of it. Warn if such a request arrives that
+doesn't respect this.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ .../dma/dw-axi-dmac/dw-axi-dmac-platform.c    | 38 ++++++++++++-------
+ 1 file changed, 25 insertions(+), 13 deletions(-)
+
+--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
++++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+@@ -307,6 +307,15 @@ static u32 axi_chan_get_xfer_width(struc
+ 	return __ffs(src | dst | len | BIT(max_width));
+ }
+ 
++static u32 axi_dma_encode_msize(u32 max_burst)
++{
++	if (max_burst <= 1)
++		return DWAXIDMAC_BURST_TRANS_LEN_1;
++	if (max_burst > 1024)
++		return DWAXIDMAC_BURST_TRANS_LEN_1024;
++	return fls(max_burst) - 2;
++}
++
+ static inline const char *axi_chan_name(struct axi_dma_chan *chan)
+ {
+ 	return dma_chan_name(&chan->vc.chan);
+@@ -732,41 +741,41 @@ static int dw_axi_dma_set_hw_desc(struct
+ 	size_t axi_block_ts;
+ 	size_t block_ts;
+ 	u32 ctllo, ctlhi;
+-	u32 burst_len;
++	u32 burst_len = 0, mem_burst_msize, reg_burst_msize;
+ 
+ 	axi_block_ts = chan->chip->dw->hdata->block_size[chan->id];
+ 
+ 	mem_width = __ffs(data_width | mem_addr | len);
+-	if (mem_width > DWAXIDMAC_TRANS_WIDTH_32)
+-		mem_width = DWAXIDMAC_TRANS_WIDTH_32;
+ 
+ 	if (!IS_ALIGNED(mem_addr, 4)) {
+ 		dev_err(chan->chip->dev, "invalid buffer alignment\n");
+ 		return -EINVAL;
+ 	}
+ 
++	/* Use a reasonable upper limit otherwise residue reporting granularity grows large */
++	mem_burst_msize = axi_dma_encode_msize(16);
++
+ 	switch (chan->direction) {
+ 	case DMA_MEM_TO_DEV:
++		reg_burst_msize = axi_dma_encode_msize(chan->config.dst_maxburst);
+ 		reg_width = __ffs(chan->config.dst_addr_width);
+ 		device_addr = phys_to_dma(chan->chip->dev, chan->config.dst_addr);
+ 		ctllo = reg_width << CH_CTL_L_DST_WIDTH_POS |
+ 			mem_width << CH_CTL_L_SRC_WIDTH_POS |
+-			DWAXIDMAC_BURST_TRANS_LEN_1 << CH_CTL_L_DST_MSIZE_POS |
+-			DWAXIDMAC_BURST_TRANS_LEN_4 << CH_CTL_L_SRC_MSIZE_POS |
++			reg_burst_msize << CH_CTL_L_DST_MSIZE_POS |
++			mem_burst_msize << CH_CTL_L_SRC_MSIZE_POS |
+ 			DWAXIDMAC_CH_CTL_L_NOINC << CH_CTL_L_DST_INC_POS |
+ 			DWAXIDMAC_CH_CTL_L_INC << CH_CTL_L_SRC_INC_POS;
+ 		block_ts = len >> mem_width;
+ 		break;
+ 	case DMA_DEV_TO_MEM:
++		reg_burst_msize = axi_dma_encode_msize(chan->config.src_maxburst);
+ 		reg_width = __ffs(chan->config.src_addr_width);
+-		/* Prevent partial access units getting lost */
+-		if (mem_width > reg_width)
+-			mem_width = reg_width;
+ 		device_addr = phys_to_dma(chan->chip->dev, chan->config.src_addr);
+ 		ctllo = reg_width << CH_CTL_L_SRC_WIDTH_POS |
+ 			mem_width << CH_CTL_L_DST_WIDTH_POS |
+-			DWAXIDMAC_BURST_TRANS_LEN_4 << CH_CTL_L_DST_MSIZE_POS |
+-			DWAXIDMAC_BURST_TRANS_LEN_1 << CH_CTL_L_SRC_MSIZE_POS |
++			mem_burst_msize << CH_CTL_L_DST_MSIZE_POS |
++			reg_burst_msize << CH_CTL_L_SRC_MSIZE_POS |
+ 			DWAXIDMAC_CH_CTL_L_INC << CH_CTL_L_DST_INC_POS |
+ 			DWAXIDMAC_CH_CTL_L_NOINC << CH_CTL_L_SRC_INC_POS;
+ 		block_ts = len >> reg_width;
+@@ -807,6 +816,12 @@ static int dw_axi_dma_set_hw_desc(struct
+ 	set_desc_src_master(hw_desc);
+ 
+ 	hw_desc->len = len;
++
++	if (burst_len && (chan->config.src_maxburst > burst_len))
++		dev_warn_ratelimited(chan2dev(chan),
++				     "%s: requested source burst length %u exceeds supported burst length %u - data may be lost\n",
++				     axi_chan_name(chan), chan->config.src_maxburst, burst_len);
++
+ 	return 0;
+ }
+ 
+@@ -823,9 +838,6 @@ static size_t calculate_block_len(struct
+ 	case DMA_MEM_TO_DEV:
+ 		data_width = BIT(chan->chip->dw->hdata->m_data_width);
+ 		mem_width = __ffs(data_width | dma_addr | buf_len);
+-		if (mem_width > DWAXIDMAC_TRANS_WIDTH_32)
+-			mem_width = DWAXIDMAC_TRANS_WIDTH_32;
+-
+ 		block_len = axi_block_ts << mem_width;
+ 		break;
+ 	case DMA_DEV_TO_MEM:
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0498-DT-bindings-add-a-dma-maxburst-property-to-snps-desi.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0498-DT-bindings-add-a-dma-maxburst-property-to-snps-desi.patch
new file mode 100644
index 00000000..16acfaf0
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0498-DT-bindings-add-a-dma-maxburst-property-to-snps-desi.patch
@@ -0,0 +1,27 @@
+From 1896c111cf2856f5c8d511ca8ba52f5e98d8a6f4 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Mon, 22 Jul 2024 14:32:32 +0100
+Subject: [PATCH 498/697] DT: bindings: add a dma-maxburst property to
+ snps,designware-i2s
+
+Do an end-run around ASoC in lieu of not being able to easily find the
+associated DMA controller capabilities.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ .../devicetree/bindings/sound/snps,designware-i2s.yaml        | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/Documentation/devicetree/bindings/sound/snps,designware-i2s.yaml
++++ b/Documentation/devicetree/bindings/sound/snps,designware-i2s.yaml
+@@ -69,6 +69,10 @@ properties:
+       - description: RX DMA Channel
+     minItems: 1
+ 
++  dma-maxburst:
++    description: FIFO DMA burst threshold limit
++    maxItems: 1
++
+   dma-names:
+     items:
+       - const: tx
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0499-sound-soc-dwc-i2s-choose-FIFO-thresholds-based-on-DM.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0499-sound-soc-dwc-i2s-choose-FIFO-thresholds-based-on-DM.patch
new file mode 100644
index 00000000..7362d8b7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0499-sound-soc-dwc-i2s-choose-FIFO-thresholds-based-on-DM.patch
@@ -0,0 +1,99 @@
+From dc53cbf8e97fdeac945e6f8c9e644883253274e1 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Thu, 18 Jul 2024 09:40:03 +0100
+Subject: [PATCH 499/697] sound/soc: dwc-i2s: choose FIFO thresholds based on
+ DMA burst constraints
+
+Valid ranges for the I2S peripheral's FIFO configuration include a depth
+of 16 - unconditionally setting the burst length to 16 with a fifo
+threshold of size/2 will cause under/overflows.
+
+For DMA engines with restricted capabilities the requested burst length
+and FIFO thresholds need to be adjusted downward accordingly.
+
+Both the RX and TX FIFOs operate on "less-than" thresholds. Setting the
+TX threshold to fifo_size minus burst means the FIFO is kept nearly-full.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ sound/soc/dwc/dwc-i2s.c | 21 ++++++++++++++++-----
+ sound/soc/dwc/local.h   |  1 +
+ 2 files changed, 17 insertions(+), 5 deletions(-)
+
+--- a/sound/soc/dwc/dwc-i2s.c
++++ b/sound/soc/dwc/dwc-i2s.c
+@@ -303,6 +303,8 @@ static void dw_i2s_config(struct dw_i2s_
+ 	u32 ch_reg;
+ 	struct i2s_clk_config_data *config = &dev->config;
+ 	u32 dmacr;
++	u32 comp1 = i2s_read_reg(dev->i2s_base, dev->i2s_reg_comp1);
++	u32 fifo_depth = 1 << (1 + COMP1_FIFO_DEPTH_GLOBAL(comp1));
+ 
+ 	i2s_disable_channels(dev, stream);
+ 
+@@ -318,7 +320,7 @@ static void dw_i2s_config(struct dw_i2s_
+ 			i2s_write_reg(dev->i2s_base, TCR(ch_reg),
+ 				      dev->xfer_resolution);
+ 			i2s_write_reg(dev->i2s_base, TFCR(ch_reg),
+-				      dev->fifo_th - 1);
++				      fifo_depth - dev->fifo_th - 1);
+ 			i2s_write_reg(dev->i2s_base, TER(ch_reg), TER_TXCHEN |
+ 				      dev->tdm_mask << TER_TXSLOT_SHIFT);
+ 			dmacr |= (DMACR_DMAEN_TXCH0 << ch_reg);
+@@ -791,8 +793,8 @@ static int dw_configure_dai_by_pd(struct
+ 		dev->capture_dma_data.pd.data = pdata->capture_dma_data;
+ 		dev->play_dma_data.pd.addr = res->start + I2S_TXDMA;
+ 		dev->capture_dma_data.pd.addr = res->start + I2S_RXDMA;
+-		dev->play_dma_data.pd.max_burst = 16;
+-		dev->capture_dma_data.pd.max_burst = 16;
++		dev->play_dma_data.pd.max_burst = dev->fifo_th;
++		dev->capture_dma_data.pd.max_burst = dev->fifo_th;
+ 		dev->play_dma_data.pd.addr_width = bus_widths[idx];
+ 		dev->capture_dma_data.pd.addr_width = bus_widths[idx];
+ 		dev->play_dma_data.pd.filter = pdata->filter;
+@@ -823,7 +825,10 @@ static int dw_configure_dai_by_dt(struct
+ 		dev->play_dma_data.dt.addr = res->start + I2S_TXDMA;
+ 		dev->play_dma_data.dt.fifo_size = fifo_depth *
+ 			(fifo_width[idx2]) >> 8;
+-		dev->play_dma_data.dt.maxburst = 16;
++		if (dev->max_dma_burst)
++			dev->play_dma_data.dt.maxburst = dev->max_dma_burst;
++		else
++			dev->play_dma_data.dt.maxburst = fifo_depth / 2;
+ 	}
+ 	if (COMP1_RX_ENABLED(comp1)) {
+ 		idx2 = COMP2_RX_WORDSIZE_0(comp2);
+@@ -832,9 +837,14 @@ static int dw_configure_dai_by_dt(struct
+ 		dev->capture_dma_data.dt.addr = res->start + I2S_RXDMA;
+ 		dev->capture_dma_data.dt.fifo_size = fifo_depth *
+ 			(fifo_width[idx2] >> 8);
+-		dev->capture_dma_data.dt.maxburst = 16;
++		if (dev->max_dma_burst)
++			dev->capture_dma_data.dt.maxburst = dev->max_dma_burst;
++		else
++			dev->capture_dma_data.dt.maxburst = fifo_depth / 2;
+ 	}
+ 
++	if (dev->max_dma_burst)
++		dev->fifo_th = min(dev->max_dma_burst, dev->fifo_th);
+ 	return 0;
+ 
+ }
+@@ -1078,6 +1088,7 @@ static int dw_i2s_probe(struct platform_
+ 		}
+ 	}
+ 
++	of_property_read_u32(pdev->dev.of_node, "dma-maxburst", &dev->max_dma_burst);
+ 	dev->bclk_ratio = 0;
+ 	dev->i2s_reg_comp1 = I2S_COMP_PARAM_1;
+ 	dev->i2s_reg_comp2 = I2S_COMP_PARAM_2;
+--- a/sound/soc/dwc/local.h
++++ b/sound/soc/dwc/local.h
+@@ -133,6 +133,7 @@ struct dw_i2s_dev {
+ 	u32 ccr;
+ 	u32 xfer_resolution;
+ 	u32 fifo_th;
++	u32 max_dma_burst;
+ 	u32 l_reg;
+ 	u32 r_reg;
+ 	bool is_jh7110; /* Flag for StarFive JH7110 SoC */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0500-spi-dw-Fix-non-DMA-transmit-only-transfers.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0500-spi-dw-Fix-non-DMA-transmit-only-transfers.patch
new file mode 100644
index 00000000..2339b21c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0500-spi-dw-Fix-non-DMA-transmit-only-transfers.patch
@@ -0,0 +1,143 @@
+From 8a2df425381f6d9aed47a26602fc93612ba9864f Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 29 Jul 2024 11:12:38 +0100
+Subject: [PATCH 500/697] spi: dw: Fix non-DMA transmit-only transfers
+
+Ensure the transmit FIFO has emptied before ending the transfer by
+dropping the TX threshold to 0 when the last byte has been pushed into
+the FIFO. Include a similar fix for the non-IRQ paths.
+
+See: https://github.com/raspberrypi/linux/issues/6285
+Fixes: 6014649de765 ("spi: dw: Save bandwidth with the TMOD_TO feature")
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/spi/spi-dw-core.c | 62 +++++++++++++++++++++++++++++++++------
+ drivers/spi/spi-dw.h      |  3 ++
+ 2 files changed, 56 insertions(+), 9 deletions(-)
+
+--- a/drivers/spi/spi-dw-core.c
++++ b/drivers/spi/spi-dw-core.c
+@@ -222,6 +222,32 @@ int dw_spi_check_status(struct dw_spi *d
+ }
+ EXPORT_SYMBOL_NS_GPL(dw_spi_check_status, SPI_DW_CORE);
+ 
++static inline bool dw_spi_ctlr_busy(struct dw_spi *dws)
++{
++	return dw_readl(dws, DW_SPI_SR) & DW_SPI_SR_BUSY;
++}
++
++static enum hrtimer_restart dw_spi_hrtimer_handler(struct hrtimer *hr)
++{
++	struct dw_spi *dws = container_of(hr, struct dw_spi, hrtimer);
++
++	if (!dw_spi_ctlr_busy(dws)) {
++		spi_finalize_current_transfer(dws->host);
++		return HRTIMER_NORESTART;
++	}
++
++	if (!dws->idle_wait_retries) {
++		dev_err(&dws->host->dev, "controller stuck at busy\n");
++		spi_finalize_current_transfer(dws->host);
++		return HRTIMER_NORESTART;
++	}
++
++	dws->idle_wait_retries--;
++	hrtimer_forward_now(hr, dws->idle_wait_interval);
++
++	return HRTIMER_RESTART;
++}
++
+ static irqreturn_t dw_spi_transfer_handler(struct dw_spi *dws)
+ {
+ 	u16 irq_status = dw_readl(dws, DW_SPI_ISR);
+@@ -248,7 +274,22 @@ static irqreturn_t dw_spi_transfer_handl
+ 		}
+ 	} else if (!dws->tx_len) {
+ 		dw_spi_mask_intr(dws, DW_SPI_INT_TXEI);
+-		spi_finalize_current_transfer(dws->host);
++		if (dw_spi_ctlr_busy(dws)) {
++			ktime_t period = ns_to_ktime(DIV_ROUND_UP(NSEC_PER_SEC, dws->current_freq));
++
++			/*
++			 * Make the initial wait an underestimate of how long the transfer
++			 * should take, then poll rapidly to reduce the delay
++			 */
++			hrtimer_start(&dws->hrtimer,
++				      period * (8 * dws->n_bytes - 1),
++				      HRTIMER_MODE_REL);
++			dws->idle_wait_retries = 10;
++			dws->idle_wait_interval = period;
++		} else {
++			spi_finalize_current_transfer(dws->host);
++		}
++		return IRQ_HANDLED;
+ 	}
+ 
+ 	/*
+@@ -257,9 +298,13 @@ static irqreturn_t dw_spi_transfer_handl
+ 	 * have the TXE IRQ flood at the final stage of the transfer.
+ 	 */
+ 	if (irq_status & DW_SPI_INT_TXEI) {
+-		if (!dws->tx_len)
+-			dw_spi_mask_intr(dws, DW_SPI_INT_TXEI);
+ 		dw_writer(dws);
++		if (!dws->tx_len) {
++			if (dws->rx_len)
++				dw_spi_mask_intr(dws, DW_SPI_INT_TXEI);
++			else
++				dw_writel(dws, DW_SPI_TXFTLR, 0);
++		}
+ 	}
+ 
+ 	return IRQ_HANDLED;
+@@ -430,7 +475,7 @@ static int dw_spi_poll_transfer(struct d
+ 		ret = dw_spi_check_status(dws, true);
+ 		if (ret)
+ 			return ret;
+-	} while (dws->rx_len);
++	} while (dws->rx_len || dws->tx_len || dw_spi_ctlr_busy(dws));
+ 
+ 	return 0;
+ }
+@@ -650,11 +695,6 @@ static int dw_spi_write_then_read(struct
+ 	return 0;
+ }
+ 
+-static inline bool dw_spi_ctlr_busy(struct dw_spi *dws)
+-{
+-	return dw_readl(dws, DW_SPI_SR) & DW_SPI_SR_BUSY;
+-}
+-
+ static int dw_spi_wait_mem_op_done(struct dw_spi *dws)
+ {
+ 	int retry = DW_SPI_WAIT_RETRIES;
+@@ -1005,6 +1045,9 @@ int dw_spi_add_host(struct device *dev,
+ 		}
+ 	}
+ 
++	hrtimer_init(&dws->hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
++	dws->hrtimer.function = dw_spi_hrtimer_handler;
++
+ 	ret = spi_register_controller(host);
+ 	if (ret) {
+ 		dev_err_probe(dev, ret, "problem registering spi host\n");
+@@ -1030,6 +1073,7 @@ void dw_spi_remove_host(struct dw_spi *d
+ {
+ 	dw_spi_debugfs_remove(dws);
+ 
++	hrtimer_cancel(&dws->hrtimer);
+ 	spi_unregister_controller(dws->host);
+ 
+ 	if (dws->dma_ops && dws->dma_ops->dma_exit)
+--- a/drivers/spi/spi-dw.h
++++ b/drivers/spi/spi-dw.h
+@@ -180,6 +180,9 @@ struct dw_spi {
+ 	u32			current_freq;	/* frequency in hz */
+ 	u32			cur_rx_sample_dly;
+ 	u32			def_rx_sample_dly_ns;
++	struct hrtimer		hrtimer;
++	ktime_t			idle_wait_interval;
++	int			idle_wait_retries;
+ 
+ 	/* Custom memory operations */
+ 	struct spi_controller_mem_ops mem_ops;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0501-spi-dw-Clamp-the-minimum-clock-speed.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0501-spi-dw-Clamp-the-minimum-clock-speed.patch
new file mode 100644
index 00000000..740a2d3f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0501-spi-dw-Clamp-the-minimum-clock-speed.patch
@@ -0,0 +1,26 @@
+From 442d4c5a1042ee1cd74f46877607e5ab22a3a562 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 31 Jul 2024 10:55:19 +0100
+Subject: [PATCH 501/697] spi: dw: Clamp the minimum clock speed
+
+The DW SPI interface has a 16-bit clock divider, where the bottom bit
+of the divisor must be 0. Limit how low the clock speed can go to
+prevent the clock divider from being truncated, as that could lead to
+a much higher clock rate than requested.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/spi/spi-dw-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-dw-core.c
++++ b/drivers/spi/spi-dw-core.c
+@@ -399,7 +399,7 @@ void dw_spi_update_config(struct dw_spi
+ 		dw_writel(dws, DW_SPI_CTRLR1, cfg->ndf ? cfg->ndf - 1 : 0);
+ 
+ 	/* Note DW APB SSI clock divider doesn't support odd numbers */
+-	clk_div = (DIV_ROUND_UP(dws->max_freq, cfg->freq) + 1) & 0xfffe;
++	clk_div = min(DIV_ROUND_UP(dws->max_freq, cfg->freq) + 1, 0xfffe) & 0xfffe;
+ 	speed_hz = dws->max_freq / clk_div;
+ 
+ 	if (dws->current_freq != speed_hz) {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0502-hwmon-adt7410-Add-DT-compatible-strings.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0502-hwmon-adt7410-Add-DT-compatible-strings.patch
new file mode 100644
index 00000000..94c053d1
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0502-hwmon-adt7410-Add-DT-compatible-strings.patch
@@ -0,0 +1,30 @@
+From 3322e058aeabf9d1dcd6a767b3f4ff4496fb368c Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 31 Jul 2024 15:02:47 +0100
+Subject: [PATCH 502/697] hwmon: (adt7410) Add DT compatible strings
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/hwmon/adt7410.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/hwmon/adt7410.c
++++ b/drivers/hwmon/adt7410.c
+@@ -94,9 +94,17 @@ static const struct i2c_device_id adt741
+ };
+ MODULE_DEVICE_TABLE(i2c, adt7410_ids);
+ 
++static const struct of_device_id adt7410_of_ids[] = {
++	{ .compatible = "adi,adt7410" },
++	{ .compatible = "adi,adt7420" },
++	{}
++};
++MODULE_DEVICE_TABLE(of, adt7410_of_ids);
++
+ static struct i2c_driver adt7410_driver = {
+ 	.driver = {
+ 		.name	= "adt7410",
++		.of_match_table = adt7410_of_ids,
+ 		.pm	= pm_sleep_ptr(&adt7x10_dev_pm_ops),
+ 	},
+ 	.probe		= adt7410_i2c_probe,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0503-gpiolib-Override-gpiochip-numbers-with-DT-aliases.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0503-gpiolib-Override-gpiochip-numbers-with-DT-aliases.patch
new file mode 100644
index 00000000..75a9f4cd
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0503-gpiolib-Override-gpiochip-numbers-with-DT-aliases.patch
@@ -0,0 +1,50 @@
+From cea5967df419b561bf815a0deb97996373b0cfe1 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 2 May 2024 16:17:02 +0100
+Subject: [PATCH 503/697] gpiolib: Override gpiochip numbers with DT aliases
+
+In the same way that other subsystems support the setting of device
+id numbers from Device Tree aliases, allow gpiochip numbers to be
+derived from "gpiochip<n>" aliases.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/gpio/gpiolib.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -105,6 +105,7 @@ static int gpiochip_irqchip_init_valid_m
+ static void gpiochip_irqchip_free_valid_mask(struct gpio_chip *gc);
+ 
+ static bool gpiolib_initialized;
++static int first_dynamic_gpiochip_num = -1;
+ 
+ const char *gpiod_get_label(struct gpio_desc *desc)
+ {
+@@ -927,6 +928,7 @@ int gpiochip_add_data_with_key(struct gp
+ 	unsigned int desc_index;
+ 	int base = 0;
+ 	int ret = 0;
++	int id;
+ 
+ 	/*
+ 	 * First: allocate and populate the internal stat container, and
+@@ -953,7 +955,16 @@ int gpiochip_add_data_with_key(struct gp
+ 	else if (gc->parent)
+ 		device_set_node(&gdev->dev, dev_fwnode(gc->parent));
+ 
+-	gdev->id = ida_alloc(&gpio_ida, GFP_KERNEL);
++	if (first_dynamic_gpiochip_num < 0) {
++		id = of_alias_get_highest_id("gpiochip");
++		first_dynamic_gpiochip_num = (id >= 0) ? (id + 1) : 0;
++	}
++
++	id = of_alias_get_id(gdev->dev.of_node, "gpiochip");
++	if (id < 0)
++		id = first_dynamic_gpiochip_num;
++
++	gdev->id = ida_alloc_range(&gpio_ida, id, ~0, GFP_KERNEL);
+ 	if (gdev->id < 0) {
+ 		ret = gdev->id;
+ 		goto err_free_gdev;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0504-Bluetooth-hci_sync-Fix-crash-on-NULL-parent.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0504-Bluetooth-hci_sync-Fix-crash-on-NULL-parent.patch
new file mode 100644
index 00000000..c2f26093
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0504-Bluetooth-hci_sync-Fix-crash-on-NULL-parent.patch
@@ -0,0 +1,27 @@
+From 7268de0027e749ddb10946869a5e152f84f1560d Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 7 Aug 2024 17:41:31 +0100
+Subject: [PATCH 504/697] Bluetooth: hci_sync: Fix crash on NULL parent
+
+Although later functions can handle a NULL fwnode, fwnode can't handle
+being passed a NULL pointer.
+
+See: https://github.com/raspberrypi/linux/issues/6305
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ net/bluetooth/hci_sync.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -4861,7 +4861,8 @@ static const struct {
+  */
+ static int hci_dev_setup_sync(struct hci_dev *hdev)
+ {
+-	struct fwnode_handle *fwnode = dev_fwnode(hdev->dev.parent);
++	struct fwnode_handle *fwnode =
++		hdev->dev.parent ? dev_fwnode(hdev->dev.parent) : NULL;
+ 	int ret = 0;
+ 	bool invalid_bdaddr;
+ 	size_t i;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0505-rtc-pcf8523-Fix-oscillator-stop-bit-handling-reading.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0505-rtc-pcf8523-Fix-oscillator-stop-bit-handling-reading.patch
new file mode 100644
index 00000000..06226cd1
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0505-rtc-pcf8523-Fix-oscillator-stop-bit-handling-reading.patch
@@ -0,0 +1,53 @@
+From c5405840ec8d99c2b4f61236cb7b9392b764c3d5 Mon Sep 17 00:00:00 2001
+From: Axel <48924884+Paladinking@users.noreply.github.com>
+Date: Wed, 28 Aug 2024 09:46:13 +0200
+Subject: [PATCH 505/697] rtc: pcf8523: Fix oscillator stop bit handling
+ reading from Control_1
+
+The check if the oscillator stop bit is set was reading from Control_1
+register instead of the Seconds register.
+This caused the Seconds register to be incorrectly changed if bit 7 of
+Control_1 happens to be set.
+
+Signed-off-by: Axel Hammarberg <axel.hammarberg@gmail.com>
+---
+ drivers/rtc/rtc-pcf8523.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/rtc/rtc-pcf8523.c
++++ b/drivers/rtc/rtc-pcf8523.c
+@@ -108,10 +108,10 @@ static int pcf8523_rtc_read_time(struct
+ 	if (err < 0)
+ 		return err;
+ 
+-	if ((regs[0] & PCF8523_CONTROL1_STOP) || (regs[3] & PCF8523_SECONDS_OS))
++	if (regs[PCF8523_REG_CONTROL1] & PCF8523_CONTROL1_STOP)
+ 		return -EINVAL;
+ 
+-	if (regs[0] & PCF8523_SECONDS_OS) {
++	if (regs[PCF8523_REG_SECONDS] & PCF8523_SECONDS_OS) {
+ 		/*
+ 		 * If the oscillator was stopped, try to clear the flag. Upon
+ 		 * power-up the flag is always set, but if we cannot clear it
+@@ -120,10 +120,10 @@ static int pcf8523_rtc_read_time(struct
+ 		 * that the clock cannot be assumed to be correct.
+ 		 */
+ 
+-		regs[0] &= ~PCF8523_SECONDS_OS;
++		regs[PCF8523_REG_SECONDS] &= ~PCF8523_SECONDS_OS;
+ 
+ 		err = regmap_write(pcf8523->regmap, PCF8523_REG_SECONDS,
+-				   regs[0]);
++				   regs[PCF8523_REG_SECONDS]);
+ 		if (err < 0)
+ 			return err;
+ 
+@@ -135,7 +135,7 @@ static int pcf8523_rtc_read_time(struct
+ 		if (value & PCF8523_SECONDS_OS)
+ 			return -EAGAIN;
+ 
+-		regs[0] = value;
++		regs[PCF8523_REG_SECONDS] = value;
+ 	}
+ 
+ 	tm->tm_sec = bcd2bin(regs[3] & 0x7f);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0506-media-dt-bindings-i2c-Add-Sony-IMX500.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0506-media-dt-bindings-i2c-Add-Sony-IMX500.patch
new file mode 100644
index 00000000..dab89014
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0506-media-dt-bindings-i2c-Add-Sony-IMX500.patch
@@ -0,0 +1,166 @@
+From 29a9af008afa5102fb60851061bd2c3a1df42561 Mon Sep 17 00:00:00 2001
+From: Richard Oliver <richard.oliver@raspberrypi.com>
+Date: Fri, 24 May 2024 11:43:07 +0100
+Subject: [PATCH 506/697] media: dt-bindings: i2c: Add Sony IMX500
+
+Add YAML device tree binding for the Sony IMX500 CMOS image sensor /
+CNN inference engine.  Also, add a MAINTAINERS entry.
+
+Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
+---
+ .../bindings/media/i2c/sony,imx500.yaml       | 132 ++++++++++++++++++
+ MAINTAINERS                                   |   7 +
+ 2 files changed, 139 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/media/i2c/sony,imx500.yaml
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/media/i2c/sony,imx500.yaml
+@@ -0,0 +1,132 @@
++# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/media/i2c/sony,imx500.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Sony CMOS Digital Image Sensor and CNN
++
++maintainers:
++  - Raspberry Pi <kernel-list@raspberrypi.com>
++
++description: |-
++  The Sony IMX500 is a stacked 1/2.3-inch CMOS digital image sensor and inbuilt
++  AI processor with an active array CNN (Convolutional Neural Network) inference
++  engine.  The native sensor size is 4056H x 3040V, and the module also contains
++  an in-built ISP for the CNN. The module is programmable through an I2C
++  interface with firmware and neural network uploads being made over SPI. The
++  default I2C address is 0x1A, with an address of 0x10 being selectable via
++  SLASEL. The module also has a second I2C interface available with a fixed
++  address of 0x36.  Image data is sent through MIPI CSI-2, which is configured
++  as either 2 or 4 data lanes.
++
++properties:
++  compatible:
++    const: sony,imx500
++
++  reg:
++    description: I2C device address
++    maxItems: 1
++
++  clocks:
++    maxItems: 1
++
++  clock-names:
++    description: |-
++      Input clock (12 to 27 MHz)
++    items:
++      - const: inck
++
++  interrupts:
++    maxItems: 1
++
++  vana-supply:
++    description: Supply voltage (analog) - 2.7 V
++
++  vdig-supply:
++    description: Supply voltage (digital) - 0.84 V
++
++  vif-supply:
++    description: Supply voltage (interface) - 1.8 V
++
++  reset-gpios:
++    description: |-
++      Sensor reset (XCLR) GPIO
++
++      Chip clear in lieu of built-in power on reset. To be set 'High' after
++      power supplies are brought up and INCK supplied.
++
++  port:
++    $ref: /schemas/graph.yaml#/$defs/port-base
++    additionalProperties: false
++    description: |
++      Video output port
++
++    properties:
++      endpoint:
++        $ref: /schemas/media/video-interfaces.yaml#
++        type: object
++        unevaluatedProperties: false
++        properties:
++          data-lanes:
++            items:
++              - const: 2
++              - const: 4
++          clock-noncontinuous: true
++          link-frequencies: true
++        required:
++          - link-frequencies
++          - data-lanes
++
++  spi:
++    $ref: /schemas/types.yaml#/definitions/phandle
++    description: |-
++      SPI peripheral
++
++      Optional SPI peripheral for uploading firmware and network weights to AI
++      processor.
++
++required:
++  - compatible
++  - reg
++  - clocks
++  - clock-names
++  - vana-supply
++  - vdig-supply
++  - vif-supply
++  - port
++
++examples:
++  - |
++    #include <dt-bindings/gpio/gpio.h>
++
++    i2c {
++      #address-cells = <1>;
++      #size-cells = <0>;
++
++      imx500: sensor@1a {
++        compatible = "sony,imx500";
++        reg = <0x1a>;
++
++        clocks = <&imx500_clk>;
++        clock-names = "inck";
++
++        vana-supply = <&imx500_vana>; /* 2.7  +/- 0.1  V */
++        vdig-supply = <&imx500_vdig>; /* 0.84 +/- 0.04 V */
++        vif-supply  = <&imx500_vif>;  /* 1.8  +/- 0.1  V */
++
++        reset-gpios = <&gpio_sensor 0 GPIO_ACTIVE_LOW>;
++
++        port {
++          imx500_0: endpoint {
++            remote-endpoint = <&csi1_ep>;
++            data-lanes = <1 2>;
++            clock-noncontinuous;
++            link-frequencies = /bits/ 64 <499500000>;
++          };
++        };
++      };
++    };
++
++...
++
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -21594,6 +21594,13 @@ F:	Documentation/devicetree/bindings/med
+ F:	Documentation/devicetree/bindings/media/i2c/imx477.yaml
+ F:	drivers/media/i2c/imx477.c
+ 
++SONY IMX500 SENSOR DRIVER
++M:	Raspberry Pi Kernel Maintenance <kernel-list@raspberrypi.com>
++L:	linux-media@vger.kernel.org
++S:	Maintained
++T:	git git://linuxtv.org/media_tree.git
++F:	Documentation/devicetree/bindings/media/i2c/sony,imx500.yaml
++
+ SONY IMX519 SENSOR DRIVER
+ M:	Arducam Kernel Maintenance <info@arducam.com>
+ L:	linux-media@vger.kernel.org
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0507-media-i2c-Add-driver-for-Sony-IMX500-sensor.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0507-media-i2c-Add-driver-for-Sony-IMX500-sensor.patch
new file mode 100644
index 00000000..a32ef9a9
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0507-media-i2c-Add-driver-for-Sony-IMX500-sensor.patch
@@ -0,0 +1,2956 @@
+From 8960a9e02d4d495e35ac4f184e91683593614c53 Mon Sep 17 00:00:00 2001
+From: Richard Oliver <richard.oliver@raspberrypi.com>
+Date: Thu, 27 Jun 2024 10:11:44 +0100
+Subject: [PATCH 507/697] media: i2c: Add driver for Sony IMX500 sensor
+
+The Sony IMX500 is a stacked 1/2.3-inch CMOS digital image sensor and
+inbuilt AI processor with an active array CNN (Convolutional Neural
+Network) inference engine.  The native sensor size is 4056H x 3040V, and
+the module also contains an in-built ISP for the CNN. The module is
+programmable through an I2C interface with firmware and neural network
+uploads being made over SPI. This driver supports imaging only.
+
+Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
+
+media: i2c: imx500: Inbuilt AI processor support
+
+Add support for the IMX500's inbuilt AI processor. The IMX500 program
+loader, AI processor firmware, DNN weights are accessed via the kernel's
+firmware interface on 'open' and are transferred to the IMX500 over SPI.
+
+Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
+
+media: i2c: imx500: Enable LED during SPI transfers
+
+The Raspberry Pi 'AI Camera' is equipped with an LED. Enable this LED
+during SPI transfers to indicate to the end-user that progress is being
+made during large tramsfers.
+
+Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
+
+drivers: media: imx500: Fixes for vblank control
+
+Reduce the default/max framerate of the 2x2 binned mode to 30fps.
+The current limit of 50fps can cause the sensor to produce corrupt
+frames and cause missing framing events.
+
+Also fixup the vblank control min/max/default/step paramters when
+setting up.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+
+drivers: media: imx500: Simplify the vblank control init
+
+Set the VBLANK control minimum and default values to IMX500_VBLANK_MIN
+unconditionally everywhere.
+
+Remove the mode specific framerate_default parameter, it is now unused.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ MAINTAINERS                        |    1 +
+ drivers/media/i2c/Kconfig          |   12 +
+ drivers/media/i2c/Makefile         |    1 +
+ drivers/media/i2c/imx500.c         | 2839 ++++++++++++++++++++++++++++
+ include/uapi/linux/v4l2-controls.h |    6 +
+ 5 files changed, 2859 insertions(+)
+ create mode 100644 drivers/media/i2c/imx500.c
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -21600,6 +21600,7 @@ L:	linux-media@vger.kernel.org
+ S:	Maintained
+ T:	git git://linuxtv.org/media_tree.git
+ F:	Documentation/devicetree/bindings/media/i2c/sony,imx500.yaml
++F:	drivers/media/i2c/imx500.c
+ 
+ SONY IMX519 SENSOR DRIVER
+ M:	Arducam Kernel Maintenance <info@arducam.com>
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -299,6 +299,18 @@ config VIDEO_IMX477
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called imx477.
+ 
++config VIDEO_IMX500
++	tristate "Sony IMX500 sensor support"
++	depends on I2C && VIDEO_DEV
++	select VIDEO_V4L2_SUBDEV_API
++	select V4L2_CCI_I2C
++	help
++	  This is a Video4Linux2 sensor driver for the Sony
++	  IMX500 camera.
++
++	  To compile this driver as a module, choose M here: the
++	  module will be called IMX500.
++
+ config VIDEO_IMX519
+ 	tristate "Arducam IMX519 sensor support"
+ 	depends on I2C && VIDEO_DEV
+--- a/drivers/media/i2c/Makefile
++++ b/drivers/media/i2c/Makefile
+@@ -64,6 +64,7 @@ obj-$(CONFIG_VIDEO_IMX355) += imx355.o
+ obj-$(CONFIG_VIDEO_IMX412) += imx412.o
+ obj-$(CONFIG_VIDEO_IMX415) += imx415.o
+ obj-$(CONFIG_VIDEO_IMX477) += imx477.o
++obj-$(CONFIG_VIDEO_IMX500) += imx500.o
+ obj-$(CONFIG_VIDEO_IMX519) += imx519.o
+ obj-$(CONFIG_VIDEO_IMX708) += imx708.o
+ obj-$(CONFIG_VIDEO_IR_I2C) += ir-kbd-i2c.o
+--- /dev/null
++++ b/drivers/media/i2c/imx500.c
+@@ -0,0 +1,2839 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * A V4L2 driver for Sony IMX500 cameras.
++ * Copyright (C) 2024, Raspberry Pi Ltd
++ */
++#include <linux/unaligned.h>
++#include <linux/clk.h>
++#include <linux/debugfs.h>
++#include <linux/delay.h>
++#include <linux/earlycpio.h>
++#include <linux/firmware.h>
++#include <linux/gpio/consumer.h>
++#include <linux/i2c.h>
++#include <linux/kernel_read_file.h>
++#include <linux/limits.h>
++#include <linux/module.h>
++#include <linux/of_device.h>
++#include <linux/pm_runtime.h>
++#include <linux/regulator/consumer.h>
++#include <linux/vmalloc.h>
++#include <media/v4l2-cci.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-event.h>
++#include <media/v4l2-fwnode.h>
++#include <media/v4l2-mediabus.h>
++
++/* Chip ID */
++#define IMX500_REG_CHIP_ID CCI_REG16(0x0016)
++#define IMX500_CHIP_ID 0x0500
++
++#define IMX500_REG_MODE_SELECT CCI_REG8(0x0100)
++#define IMX500_MODE_STANDBY 0x00
++#define IMX500_MODE_STREAMING 0x01
++
++#define IMX500_REG_IMAGE_ONLY_MODE CCI_REG8(0xa700)
++#define IMX500_IMAGE_ONLY_FALSE 0x00
++#define IMX500_IMAGE_ONLY_TRUE 0x01
++
++#define IMX500_REG_ORIENTATION CCI_REG8(0x101)
++
++#define IMX500_XCLK_FREQ 24000000
++
++#define IMX500_DEFAULT_LINK_FREQ 444000000
++
++#define IMX500_PIXEL_RATE 744000000
++
++/* V_TIMING internal */
++#define IMX500_REG_FRAME_LENGTH CCI_REG16(0x0340)
++#define IMX500_FRAME_LENGTH_MAX 0xffdc
++#define IMX500_VBLANK_MIN 1117
++
++/* H_TIMING internal */
++#define IMX500_REG_LINE_LENGTH CCI_REG16(0x0342)
++#define IMX500_LINE_LENGTH_MAX 0xfff0
++
++/* Long exposure multiplier */
++#define IMX500_LONG_EXP_SHIFT_MAX 7
++#define IMX500_LONG_EXP_SHIFT_REG CCI_REG8(0x3210)
++
++/* Exposure control */
++#define IMX500_REG_EXPOSURE CCI_REG16(0x0202)
++#define IMX500_EXPOSURE_OFFSET 22
++#define IMX500_EXPOSURE_MIN 8
++#define IMX500_EXPOSURE_STEP 1
++#define IMX500_EXPOSURE_DEFAULT 0x640
++#define IMX500_EXPOSURE_MAX (IMX500_FRAME_LENGTH_MAX - IMX500_EXPOSURE_OFFSET)
++
++/* Analog gain control */
++#define IMX500_REG_ANALOG_GAIN CCI_REG16(0x0204)
++#define IMX500_ANA_GAIN_MIN 0
++#define IMX500_ANA_GAIN_MAX 978
++#define IMX500_ANA_GAIN_STEP 1
++#define IMX500_ANA_GAIN_DEFAULT 0x0
++
++/* Inference windows */
++#define IMX500_REG_DWP_AP_VC_VOFF CCI_REG16(0xD500)
++#define IMX500_REG_DWP_AP_VC_HOFF CCI_REG16(0xD502)
++#define IMX500_REG_DWP_AP_VC_VSIZE CCI_REG16(0xD504)
++#define IMX500_REG_DWP_AP_VC_HSIZE CCI_REG16(0xD506)
++
++#define IMX500_REG_DD_CH06_X_OUT_SIZE \
++	CCI_REG16(0x3054) /* Output pixel count for KPI */
++#define IMX500_REG_DD_CH07_X_OUT_SIZE \
++	CCI_REG16(0x3056) /* Output pixel count for Input Tensor */
++#define IMX500_REG_DD_CH08_X_OUT_SIZE \
++	CCI_REG16(0x3058) /* Output pixel count for Output Tensor */
++#define IMX500_REG_DD_CH09_X_OUT_SIZE \
++	CCI_REG16(0x305A) /* Output pixel count for PQ Settings */
++
++#define IMX500_REG_DD_CH06_Y_OUT_SIZE \
++	CCI_REG16(0x305C) /* Output line count for KPI */
++#define IMX500_REG_DD_CH07_Y_OUT_SIZE \
++	CCI_REG16(0x305E) /* Output line count for Input Tensor */
++#define IMX500_REG_DD_CH08_Y_OUT_SIZE \
++	CCI_REG16(0x3060) /* Output line count for Output Tensor */
++#define IMX500_REG_DD_CH09_Y_OUT_SIZE \
++	CCI_REG16(0x3062) /* Output line count for PQ Settings */
++
++#define IMX500_REG_DD_CH06_VCID \
++	CCI_REG8(0x3064) /* Virtual channel ID for KPI */
++#define IMX500_REG_DD_CH07_VCID \
++	CCI_REG8(0x3065) /* Virtual channel ID for Input Tensor */
++#define IMX500_REG_DD_CH08_VCID \
++	CCI_REG8(0x3066) /* Virtual channel ID for Output Tensor */
++#define IMX500_REG_DD_CH09_VCID \
++	CCI_REG8(0x3067) /* Virtual channel ID for PQ Settings */
++
++#define IMX500_REG_DD_CH06_DT CCI_REG8(0x3068) /* Data Type for KPI */
++#define IMX500_REG_DD_CH07_DT CCI_REG8(0x3069) /* Data Type for Input Tensor */
++#define IMX500_REG_DD_CH08_DT CCI_REG8(0x306A) /* Data Type for Output Tensor */
++#define IMX500_REG_DD_CH09_DT CCI_REG8(0x306B) /* Data Type for PQ Settings */
++
++#define IMX500_REG_DD_CH06_PACKING \
++	CCI_REG8(0x306C) /* Pixel/byte packing for KPI */
++#define IMX500_REG_DD_CH07_PACKING \
++	CCI_REG8(0x306D) /* Pixel/byte packing for Input Tensor */
++#define IMX500_REG_DD_CH08_PACKING \
++	CCI_REG8(0x306E) /* Pixel/byte packing for Output Tensor */
++#define IMX500_REG_DD_CH09_PACKING \
++	CCI_REG8(0x306F) /* Pixel/byte packing for PQ Settings */
++#define IMX500_DD_PACKING_8BPP 2 /* 8 bits/pixel */
++#define IMX500_DD_PACKING_10BPP 3 /* 10 bits/pixel */
++
++/* Interrupt command (start processing command inside IMX500 CPU) */
++#define IMX500_REG_DD_CMD_INT CCI_REG8(0x3080)
++#define IMX500_DD_CMD_INT_ST_TRANS 0
++#define IMX500_DD_CMD_INT_UPDATE 1
++#define IMX500_DD_CMD_INT_FLASH_ERASE 2
++
++/* State transition command type */
++#define IMX500_REG_DD_ST_TRANS_CMD CCI_REG8(0xD000)
++#define IMX500_DD_ST_TRANS_CMD_LOADER_FW 0
++#define IMX500_DD_ST_TRANS_CMD_MAIN_FW 1
++#define IMX500_DD_ST_TRANS_CMD_NW_WEIGHTS 2
++#define IMX500_DD_ST_TRANS_CMD_CLEAR_WEIGHTS 3
++
++/* Network weights update command */
++#define IMX500_REG_DD_UPDATE_CMD CCI_REG8(0xD001)
++#define IMX500_DD_UPDATE_CMD_SRAM 0
++#define IMX500_DD_UPDATE_CMD_FLASH 1
++
++/* Transfer source when loading into RAM */
++#define IMX500_REG_DD_LOAD_MODE CCI_REG8(0xD002)
++#define IMX500_DD_LOAD_MODE_AP 0
++#define IMX500_DD_LOAD_MODE_FLASH 1
++
++/* Image type to transfer */
++#define IMX500_REG_DD_IMAGE_TYPE CCI_REG8(0xD003)
++#define IMX500_DD_IMAGE_TYPE_LOADER_FW 0
++#define IMX500_DD_IMAGE_TYPE_MAIN_FW 1
++#define IMX500_DD_IMAGE_TYPE_NETWORK_WEIGHTS 2
++
++/* Number of divisions of download image file */
++#define IMX500_REG_DD_DOWNLOAD_DIV_NUM CCI_REG8(0xD004)
++
++#define IMX500_REG_DD_FLASH_TYPE CCI_REG8(0xD005)
++
++/* total size of download file (4-byte) */
++#define IMX500_REG_DD_DOWNLOAD_FILE_SIZE CCI_REG32(0xD008)
++
++/* Status notification (4-byte) */
++#define IMX500_REG_DD_REF_STS CCI_REG32(0xD010)
++#define IMX500_DD_REF_STS_FATAL 0xFF
++#define IMX500_DD_REF_STS_DETECT_CNT 0xFF00
++#define IMX500_DD_REF_STS_ERR_CNT 0xFF0000
++#define IMX500_DD_REF_CMD_REPLY_CNT 0xFF000000
++
++/* Command reply status */
++#define IMX500_REG_DD_CMD_REPLY_STS CCI_REG8(0xD014)
++#define IMX500_DD_CMD_REPLY_STS_TRANS_READY 0x00
++#define IMX500_DD_CMD_REPLY_STS_TRANS_DONE 0x01
++#define IMX500_DD_CMD_REPLY_STS_UPDATE_READY 0x10
++#define IMX500_DD_CMD_REPLY_STS_UPDATE_DONE 0x11
++#define IMX500_DD_CMD_REPLY_STS_UPDATE_CANCEL_DONE 0x12
++#define IMX500_DD_CMD_REPLY_STS_STATUS_ERROR 0xFF
++#define IMX500_DD_CMD_REPLY_STS_MAC_AUTH_ERROR 0xFE
++#define IMX500_DD_CMD_REPLY_STS_TIMEOUT_ERROR 0xFD
++#define IMX500_DD_CMD_REPLY_STS_PARAMETER_ERROR 0xFC
++#define IMX500_DD_CMD_REPLY_STS_INTERNAL_ERROR 0xFB
++#define IMX500_DD_CMD_REPLY_STS_PACKET_FMT_ERROR 0xFA
++
++/* Download status */
++#define IMX500_REG_DD_DOWNLOAD_STS CCI_REG8(0xD015)
++#define IMX500_DD_DOWNLOAD_STS_READY 0
++#define IMX500_DD_DOWNLOAD_STS_DOWNLOADING 1
++
++/* Update cancel */
++#define IMX500_REG_DD_UPDATE_CANCEL CCI_REG8(0xD016)
++#define IMX500_DD_UPDATE_CANCEL_NOT_CANCEL 0
++#define IMX500_DD_UPDATE_CANCEL_DO_CANCEL 1
++
++/* Notify error status */
++#define IMX500_REG_DD_ERR_STS CCI_REG8(0xD020)
++#define IMX500_DD_ERR_STS_STATUS_ERROR_BIT 0x1
++#define IMX500_DD_ERR_STS_INTERNAL_ERROR_BIT 0x2
++#define IMX500_DD_ERR_STS_PARAMETER_ERROR_BIT 0x4
++
++/* System state */
++#define IMX500_REG_DD_SYS_STATE CCI_REG8(0xD02A)
++#define IMX500_DD_SYS_STATE_STANDBY_NO_NETWORK 0
++#define IMX500_DD_SYS_STATE_STEAMING_NO_NETWORK 1
++#define IMX500_DD_SYS_STATE_STANDBY_WITH_NETWORK 2
++#define IMX500_DD_SYS_STATE_STREAMING_WITH_NETWORK 3
++
++#define IMX500_REG_MAIN_FW_VERSION CCI_REG32(0xD07C)
++
++/* Colour balance controls */
++#define IMX500_REG_COLOUR_BALANCE_R CCI_REG16(0xd804)
++#define IMX500_REG_COLOUR_BALANCE_GR CCI_REG16(0xd806)
++#define IMX500_REG_COLOUR_BALANCE_GB CCI_REG16(0xd808)
++#define IMX500_REG_COLOUR_BALANCE_B CCI_REG16(0xd80a)
++#define IMX500_COLOUR_BALANCE_MIN 0x0001
++#define IMX500_COLOUR_BALANCE_MAX 0x0fff
++#define IMX500_COLOUR_BALANCE_STEP 0x0001
++#define IMX500_COLOUR_BALANCE_DEFAULT 0x0100
++
++/* Embedded sizes */
++#define IMX500_MAX_EMBEDDED_SIZE \
++	(2 * ((((IMX500_PIXEL_ARRAY_WIDTH * 10) >> 3) + 15) & ~15))
++
++/* Inference sizes */
++#define IMX500_INFERENCE_LINE_WIDTH 2560
++#define IMX500_NUM_KPI_LINES 1
++#define IMX500_NUM_PQ_LINES 1
++
++/* IMX500 native and active pixel array size. */
++#define IMX500_NATIVE_WIDTH 4072U
++#define IMX500_NATIVE_HEIGHT 3176U
++#define IMX500_PIXEL_ARRAY_LEFT 8U
++#define IMX500_PIXEL_ARRAY_TOP 16U
++#define IMX500_PIXEL_ARRAY_WIDTH 4056U
++#define IMX500_PIXEL_ARRAY_HEIGHT 3040U
++
++enum pad_types { IMAGE_PAD, METADATA_PAD, NUM_PADS };
++
++#define V4L2_CID_USER_IMX500_INFERENCE_WINDOW (V4L2_CID_USER_IMX500_BASE + 0)
++#define V4L2_CID_USER_IMX500_NETWORK_FW_FD (V4L2_CID_USER_IMX500_BASE + 1)
++
++#define ONE_MIB (1024 * 1024)
++
++/* regulator supplies */
++static const char *const imx500_supply_name[] = {
++	/* Supplies can be enabled in any order */
++	"vana", /* Analog (2.7V) supply */
++	"vdig", /* Digital Core (0.84V) supply */
++	"vif", /* Interface (1.8V) supply */
++};
++
++#define IMX500_NUM_SUPPLIES ARRAY_SIZE(imx500_supply_name)
++
++enum imx500_image_type {
++	TYPE_LOADER = 0,
++	TYPE_MAIN = 1,
++	TYPE_NW_WEIGHTS = 2,
++	TYPE_MAX
++};
++
++struct imx500_reg_list {
++	unsigned int num_of_regs;
++	const struct cci_reg_sequence *regs;
++};
++
++/* Mode : resolution and related config&values */
++struct imx500_mode {
++	/* Frame width */
++	unsigned int width;
++
++	/* Frame height */
++	unsigned int height;
++
++	/* H-timing in pixels */
++	unsigned int line_length_pix;
++
++	/* Analog crop rectangle. */
++	struct v4l2_rect crop;
++
++	/* Default register values */
++	struct imx500_reg_list reg_list;
++};
++
++static const struct cci_reg_sequence mode_common_regs[] = {
++	{ CCI_REG8(0x0305), 0x02 },
++	{ CCI_REG8(0x0306), 0x00 },
++	{ CCI_REG8(0x030d), 0x02 },
++	{ CCI_REG8(0x030e), 0x00 },
++	{ CCI_REG8(0x0106), 0x01 }, /* FAST_STANDBY_CTL */
++	{ CCI_REG8(0x0136), 0x1b }, /* EXCLK_FREQ */
++	{ CCI_REG8(0x0137), 0x00 },
++	{ CCI_REG8(0x0112), 0x0a },
++	{ CCI_REG8(0x0113), 0x0a },
++	{ CCI_REG8(0x0114), 0x01 }, /* CSI_LANE_MODE */
++	{ CCI_REG16(0x3054), IMX500_INFERENCE_LINE_WIDTH },
++	{ CCI_REG16(0x3056), IMX500_INFERENCE_LINE_WIDTH },
++	{ CCI_REG16(0x3058), IMX500_INFERENCE_LINE_WIDTH },
++	{ CCI_REG16(0x305A), IMX500_INFERENCE_LINE_WIDTH }, /* X_OUT */
++	{ CCI_REG16(0x305C), IMX500_NUM_KPI_LINES }, /* KPI Y_OUT */
++	{ CCI_REG16(0x3062), IMX500_NUM_PQ_LINES }, /* PQ Y_OUT */
++	{ CCI_REG8(0x3068), 0x30 },
++	{ CCI_REG8(0x3069), 0x31 },
++	{ CCI_REG8(0x306A), 0x32 },
++	{ CCI_REG8(0x306B), 0x33 }, /* Data Types */
++};
++
++/* 12 mpix 15fps */
++static const struct cci_reg_sequence mode_4056x3040_regs[] = {
++	{ CCI_REG8(0x0340), 0x12 },
++	{ CCI_REG8(0x0341), 0x42 },
++	{ CCI_REG8(0x0342), 0x45 },
++	{ CCI_REG8(0x0343), 0xec },
++	{ CCI_REG8(0x3210), 0x00 },
++	{ CCI_REG8(0x0344), 0x00 },
++	{ CCI_REG8(0x0345), 0x00 },
++	{ CCI_REG8(0x0346), 0x00 },
++	{ CCI_REG8(0x0347), 0x00 },
++	{ CCI_REG8(0x0348), 0x0f },
++	{ CCI_REG8(0x0349), 0xd7 },
++	{ CCI_REG8(0x0350), 0x00 },
++	{ CCI_REG8(0x034a), 0x0b },
++	{ CCI_REG8(0x034b), 0xdf },
++	{ CCI_REG8(0x3f58), 0x01 },
++	{ CCI_REG8(0x0381), 0x01 },
++	{ CCI_REG8(0x0383), 0x01 },
++	{ CCI_REG8(0x0385), 0x01 },
++	{ CCI_REG8(0x0387), 0x01 },
++	{ CCI_REG8(0x0900), 0x00 },
++	{ CCI_REG8(0x0901), 0x11 },
++	{ CCI_REG8(0x0902), 0x00 },
++	{ CCI_REG8(0x3241), 0x11 },
++	{ CCI_REG8(0x3242), 0x01 },
++	{ CCI_REG8(0x3250), 0x00 },
++	{ CCI_REG8(0x3f0f), 0x00 },
++	{ CCI_REG8(0x3f40), 0x00 },
++	{ CCI_REG8(0x3f41), 0x00 },
++	{ CCI_REG8(0x3f42), 0x00 },
++	{ CCI_REG8(0x3f43), 0x00 },
++	{ CCI_REG8(0xb34e), 0x00 },
++	{ CCI_REG8(0xb351), 0x20 },
++	{ CCI_REG8(0xb35c), 0x00 },
++	{ CCI_REG8(0xb35e), 0x08 },
++	{ CCI_REG8(0x0401), 0x00 },
++	{ CCI_REG8(0x0404), 0x00 },
++	{ CCI_REG8(0x0405), 0x10 },
++	{ CCI_REG8(0x0408), 0x00 },
++	{ CCI_REG8(0x0409), 0x00 },
++	{ CCI_REG8(0x040a), 0x00 },
++	{ CCI_REG8(0x040b), 0x00 },
++	{ CCI_REG8(0x040c), 0x0f },
++	{ CCI_REG8(0x040d), 0xd8 },
++	{ CCI_REG8(0x040e), 0x0b },
++	{ CCI_REG8(0x040f), 0xe0 },
++	{ CCI_REG8(0x034c), 0x0f },
++	{ CCI_REG8(0x034d), 0xd8 },
++	{ CCI_REG8(0x034e), 0x0b },
++	{ CCI_REG8(0x034f), 0xe0 },
++	{ CCI_REG8(0x0301), 0x05 },
++	{ CCI_REG8(0x0303), 0x02 },
++	{ CCI_REG8(0x0307), 0x9b },
++	{ CCI_REG8(0x0309), 0x0a },
++	{ CCI_REG8(0x030b), 0x01 },
++	{ CCI_REG8(0x030f), 0x4a },
++	{ CCI_REG8(0x0310), 0x01 },
++	{ CCI_REG8(0x0820), 0x07 },
++	{ CCI_REG8(0x0821), 0xce },
++	{ CCI_REG8(0x0822), 0x00 },
++	{ CCI_REG8(0x0823), 0x00 },
++	{ CCI_REG8(0x3e20), 0x01 },
++	{ CCI_REG8(0x3e35), 0x01 },
++	{ CCI_REG8(0x3e36), 0x01 },
++	{ CCI_REG8(0x3e37), 0x00 },
++	{ CCI_REG8(0x3e3a), 0x01 },
++	{ CCI_REG8(0x3e3b), 0x00 },
++	{ CCI_REG8(0x00e3), 0x00 },
++	{ CCI_REG8(0x00e4), 0x00 },
++	{ CCI_REG8(0x00e6), 0x00 },
++	{ CCI_REG8(0x00e7), 0x00 },
++	{ CCI_REG8(0x00e8), 0x00 },
++	{ CCI_REG8(0x00e9), 0x00 },
++	{ CCI_REG8(0x3f50), 0x00 },
++	{ CCI_REG8(0x3f56), 0x02 },
++	{ CCI_REG8(0x3f57), 0x42 },
++	{ CCI_REG8(0x3606), 0x01 },
++	{ CCI_REG8(0x3607), 0x01 },
++	{ CCI_REG8(0x3f26), 0x00 },
++	{ CCI_REG8(0x3f4a), 0x00 },
++	{ CCI_REG8(0x3f4b), 0x00 },
++	{ CCI_REG8(0x4bc0), 0x16 },
++	{ CCI_REG8(0x7ba8), 0x00 },
++	{ CCI_REG8(0x7ba9), 0x00 },
++	{ CCI_REG8(0x886b), 0x00 },
++	{ CCI_REG8(0x579a), 0x00 },
++	{ CCI_REG8(0x579b), 0x0a },
++	{ CCI_REG8(0x579c), 0x01 },
++	{ CCI_REG8(0x579d), 0x2a },
++	{ CCI_REG8(0x57ac), 0x00 },
++	{ CCI_REG8(0x57ad), 0x00 },
++	{ CCI_REG8(0x57ae), 0x00 },
++	{ CCI_REG8(0x57af), 0x81 },
++	{ CCI_REG8(0x57be), 0x00 },
++	{ CCI_REG8(0x57bf), 0x00 },
++	{ CCI_REG8(0x57c0), 0x00 },
++	{ CCI_REG8(0x57c1), 0x81 },
++	{ CCI_REG8(0x57d0), 0x00 },
++	{ CCI_REG8(0x57d1), 0x00 },
++	{ CCI_REG8(0x57d2), 0x00 },
++	{ CCI_REG8(0x57d3), 0x81 },
++	{ CCI_REG8(0x5324), 0x00 },
++	{ CCI_REG8(0x5325), 0x26 },
++	{ CCI_REG8(0x5326), 0x00 },
++	{ CCI_REG8(0x5327), 0x6b },
++	{ CCI_REG8(0xbca7), 0x00 },
++	{ CCI_REG8(0x5fcc), 0x28 },
++	{ CCI_REG8(0x5fd7), 0x2d },
++	{ CCI_REG8(0x5fe2), 0x2d },
++	{ CCI_REG8(0x5fed), 0x2d },
++	{ CCI_REG8(0x5ff8), 0x2d },
++	{ CCI_REG8(0x6003), 0x2d },
++	{ CCI_REG8(0x5d0b), 0x01 },
++	{ CCI_REG8(0x6f6d), 0x00 },
++	{ CCI_REG8(0x61c9), 0x00 },
++	{ CCI_REG8(0x5352), 0x00 },
++	{ CCI_REG8(0x5353), 0x49 },
++	{ CCI_REG8(0x5356), 0x00 },
++	{ CCI_REG8(0x5357), 0x30 },
++	{ CCI_REG8(0x5358), 0x00 },
++	{ CCI_REG8(0x5359), 0x3b },
++	{ CCI_REG8(0x535c), 0x00 },
++	{ CCI_REG8(0x535d), 0xb0 },
++	{ CCI_REG8(0x6187), 0x18 },
++	{ CCI_REG8(0x6189), 0x18 },
++	{ CCI_REG8(0x618b), 0x18 },
++	{ CCI_REG8(0x618d), 0x1d },
++	{ CCI_REG8(0x618f), 0x1d },
++	{ CCI_REG8(0x5414), 0x01 },
++	{ CCI_REG8(0x5415), 0x0c },
++	{ CCI_REG8(0xbca8), 0x0a },
++	{ CCI_REG8(0x5fcf), 0x1e },
++	{ CCI_REG8(0x5fda), 0x1e },
++	{ CCI_REG8(0x5fe5), 0x1e },
++	{ CCI_REG8(0x5ff0), 0x1e },
++	{ CCI_REG8(0x5ffb), 0x1e },
++	{ CCI_REG8(0x6006), 0x1e },
++	{ CCI_REG8(0x616e), 0x04 },
++	{ CCI_REG8(0x616f), 0x04 },
++	{ CCI_REG8(0x6170), 0x04 },
++	{ CCI_REG8(0x6171), 0x06 },
++	{ CCI_REG8(0x6172), 0x06 },
++	{ CCI_REG8(0x6173), 0x0c },
++	{ CCI_REG8(0x6174), 0x0c },
++	{ CCI_REG8(0x6175), 0x0c },
++	{ CCI_REG8(0x6176), 0x00 },
++	{ CCI_REG8(0x6177), 0x10 },
++	{ CCI_REG8(0x6178), 0x00 },
++	{ CCI_REG8(0x6179), 0x1a },
++	{ CCI_REG8(0x617a), 0x00 },
++	{ CCI_REG8(0x617b), 0x1a },
++	{ CCI_REG8(0x617c), 0x00 },
++	{ CCI_REG8(0x617d), 0x27 },
++	{ CCI_REG8(0x617e), 0x00 },
++	{ CCI_REG8(0x617f), 0x27 },
++	{ CCI_REG8(0x6180), 0x00 },
++	{ CCI_REG8(0x6181), 0x44 },
++	{ CCI_REG8(0x6182), 0x00 },
++	{ CCI_REG8(0x6183), 0x44 },
++	{ CCI_REG8(0x6184), 0x00 },
++	{ CCI_REG8(0x6185), 0x44 },
++	{ CCI_REG8(0x5dfc), 0x0a },
++	{ CCI_REG8(0x5e00), 0x0a },
++	{ CCI_REG8(0x5e04), 0x0a },
++	{ CCI_REG8(0x5e08), 0x0a },
++	{ CCI_REG8(0x5dfd), 0x0a },
++	{ CCI_REG8(0x5e01), 0x0a },
++	{ CCI_REG8(0x5e05), 0x0a },
++	{ CCI_REG8(0x5e09), 0x0a },
++	{ CCI_REG8(0x5dfe), 0x0a },
++	{ CCI_REG8(0x5e02), 0x0a },
++	{ CCI_REG8(0x5e06), 0x0a },
++	{ CCI_REG8(0x5e0a), 0x0a },
++	{ CCI_REG8(0x5dff), 0x0a },
++	{ CCI_REG8(0x5e03), 0x0a },
++	{ CCI_REG8(0x5e07), 0x0a },
++	{ CCI_REG8(0x5e0b), 0x0a },
++	{ CCI_REG8(0x5dec), 0x12 },
++	{ CCI_REG8(0x5df0), 0x12 },
++	{ CCI_REG8(0x5df4), 0x21 },
++	{ CCI_REG8(0x5df8), 0x31 },
++	{ CCI_REG8(0x5ded), 0x12 },
++	{ CCI_REG8(0x5df1), 0x12 },
++	{ CCI_REG8(0x5df5), 0x21 },
++	{ CCI_REG8(0x5df9), 0x31 },
++	{ CCI_REG8(0x5dee), 0x12 },
++	{ CCI_REG8(0x5df2), 0x12 },
++	{ CCI_REG8(0x5df6), 0x21 },
++	{ CCI_REG8(0x5dfa), 0x31 },
++	{ CCI_REG8(0x5def), 0x12 },
++	{ CCI_REG8(0x5df3), 0x12 },
++	{ CCI_REG8(0x5df7), 0x21 },
++	{ CCI_REG8(0x5dfb), 0x31 },
++	{ CCI_REG8(0x5ddc), 0x0d },
++	{ CCI_REG8(0x5de0), 0x0d },
++	{ CCI_REG8(0x5de4), 0x0d },
++	{ CCI_REG8(0x5de8), 0x0d },
++	{ CCI_REG8(0x5ddd), 0x0d },
++	{ CCI_REG8(0x5de1), 0x0d },
++	{ CCI_REG8(0x5de5), 0x0d },
++	{ CCI_REG8(0x5de9), 0x0d },
++	{ CCI_REG8(0x5dde), 0x0d },
++	{ CCI_REG8(0x5de2), 0x0d },
++	{ CCI_REG8(0x5de6), 0x0d },
++	{ CCI_REG8(0x5dea), 0x0d },
++	{ CCI_REG8(0x5ddf), 0x0d },
++	{ CCI_REG8(0x5de3), 0x0d },
++	{ CCI_REG8(0x5de7), 0x0d },
++	{ CCI_REG8(0x5deb), 0x0d },
++	{ CCI_REG8(0x5dcc), 0x55 },
++	{ CCI_REG8(0x5dd0), 0x50 },
++	{ CCI_REG8(0x5dd4), 0x4b },
++	{ CCI_REG8(0x5dd8), 0x4b },
++	{ CCI_REG8(0x5dcd), 0x55 },
++	{ CCI_REG8(0x5dd1), 0x50 },
++	{ CCI_REG8(0x5dd5), 0x4b },
++	{ CCI_REG8(0x5dd9), 0x4b },
++	{ CCI_REG8(0x5dce), 0x55 },
++	{ CCI_REG8(0x5dd2), 0x50 },
++	{ CCI_REG8(0x5dd6), 0x4b },
++	{ CCI_REG8(0x5dda), 0x4b },
++	{ CCI_REG8(0x5dcf), 0x55 },
++	{ CCI_REG8(0x5dd3), 0x50 },
++	{ CCI_REG8(0x5dd7), 0x4b },
++	{ CCI_REG8(0x5ddb), 0x4b },
++	{ CCI_REG8(0x0202), 0x12 },
++	{ CCI_REG8(0x0203), 0x2c },
++	{ CCI_REG8(0x0204), 0x00 },
++	{ CCI_REG8(0x0205), 0x00 },
++	{ CCI_REG8(0x020e), 0x01 },
++	{ CCI_REG8(0x020f), 0x00 },
++	{ CCI_REG8(0x0210), 0x01 },
++	{ CCI_REG8(0x0211), 0x00 },
++	{ CCI_REG8(0x0212), 0x01 },
++	{ CCI_REG8(0x0213), 0x00 },
++	{ CCI_REG8(0x0214), 0x01 },
++	{ CCI_REG8(0x0215), 0x00 },
++};
++
++/* 2x2 binned. 56fps */
++static const struct cci_reg_sequence mode_2028x1520_regs[] = {
++	{ CCI_REG8(0x0112), 0x0a },
++	{ CCI_REG8(0x0113), 0x0a },
++	{ CCI_REG8(0x0114), 0x01 },
++	{ CCI_REG8(0x0342), 0x24 },
++	{ CCI_REG8(0x0343), 0xb6 },
++	{ CCI_REG8(0x0340), 0x0b },
++	{ CCI_REG8(0x0341), 0x9c },
++	{ CCI_REG8(0x3210), 0x00 },
++	{ CCI_REG8(0x0344), 0x00 },
++	{ CCI_REG8(0x0345), 0x00 },
++	{ CCI_REG8(0x0346), 0x00 },
++	{ CCI_REG8(0x0347), 0x00 },
++	{ CCI_REG8(0x0348), 0x0f },
++	{ CCI_REG8(0x0349), 0xd7 },
++	{ CCI_REG8(0x0350), 0x00 },
++	{ CCI_REG8(0x034a), 0x0b },
++	{ CCI_REG8(0x034b), 0xdf },
++	{ CCI_REG8(0x3f58), 0x01 },
++	{ CCI_REG8(0x0381), 0x01 },
++	{ CCI_REG8(0x0383), 0x01 },
++	{ CCI_REG8(0x0385), 0x01 },
++	{ CCI_REG8(0x0387), 0x01 },
++	{ CCI_REG8(0x0900), 0x01 },
++	{ CCI_REG8(0x0901), 0x22 },
++	{ CCI_REG8(0x0902), 0x02 },
++	{ CCI_REG8(0x3241), 0x11 },
++	{ CCI_REG8(0x3242), 0x01 },
++	{ CCI_REG8(0x3250), 0x03 },
++	{ CCI_REG8(0x3f0f), 0x00 },
++	{ CCI_REG8(0x3f40), 0x00 },
++	{ CCI_REG8(0x3f41), 0x00 },
++	{ CCI_REG8(0x3f42), 0x00 },
++	{ CCI_REG8(0x3f43), 0x00 },
++	{ CCI_REG8(0xb34e), 0x00 },
++	{ CCI_REG8(0xb351), 0x20 },
++	{ CCI_REG8(0xb35c), 0x00 },
++	{ CCI_REG8(0xb35e), 0x08 },
++	{ CCI_REG8(0x0401), 0x00 },
++	{ CCI_REG8(0x0404), 0x00 },
++	{ CCI_REG8(0x0405), 0x10 },
++	{ CCI_REG8(0x0408), 0x00 },
++	{ CCI_REG8(0x0409), 0x00 },
++	{ CCI_REG8(0x040a), 0x00 },
++	{ CCI_REG8(0x040b), 0x00 },
++	{ CCI_REG8(0x040c), 0x07 },
++	{ CCI_REG8(0x040d), 0xec },
++	{ CCI_REG8(0x040e), 0x05 },
++	{ CCI_REG8(0x040f), 0xf0 },
++	{ CCI_REG8(0x034c), 0x07 },
++	{ CCI_REG8(0x034d), 0xec },
++	{ CCI_REG8(0x034e), 0x05 },
++	{ CCI_REG8(0x034f), 0xf0 },
++	{ CCI_REG8(0x0301), 0x05 },
++	{ CCI_REG8(0x0303), 0x02 },
++	{ CCI_REG8(0x0307), 0x9b },
++	{ CCI_REG8(0x0309), 0x0a },
++	{ CCI_REG8(0x030b), 0x01 },
++	{ CCI_REG8(0x030f), 0x4a },
++	{ CCI_REG8(0x0310), 0x01 },
++	{ CCI_REG8(0x0820), 0x07 },
++	{ CCI_REG8(0x0821), 0xce },
++	{ CCI_REG8(0x0822), 0x00 },
++	{ CCI_REG8(0x0823), 0x00 },
++	{ CCI_REG8(0x3e20), 0x01 },
++	{ CCI_REG8(0x3e35), 0x01 },
++	{ CCI_REG8(0x3e36), 0x01 },
++	{ CCI_REG8(0x3e37), 0x00 },
++	{ CCI_REG8(0x3e3a), 0x01 },
++	{ CCI_REG8(0x3e3b), 0x00 },
++	{ CCI_REG8(0x00e3), 0x00 },
++	{ CCI_REG8(0x00e4), 0x00 },
++	{ CCI_REG8(0x00e6), 0x00 },
++	{ CCI_REG8(0x00e7), 0x00 },
++	{ CCI_REG8(0x00e8), 0x00 },
++	{ CCI_REG8(0x00e9), 0x00 },
++	{ CCI_REG8(0x3f50), 0x00 },
++	{ CCI_REG8(0x3f56), 0x01 },
++	{ CCI_REG8(0x3f57), 0x30 },
++	{ CCI_REG8(0x3606), 0x01 },
++	{ CCI_REG8(0x3607), 0x01 },
++	{ CCI_REG8(0x3f26), 0x00 },
++	{ CCI_REG8(0x3f4a), 0x00 },
++	{ CCI_REG8(0x3f4b), 0x00 },
++	{ CCI_REG8(0x4bc0), 0x16 },
++	{ CCI_REG8(0x7ba8), 0x00 },
++	{ CCI_REG8(0x7ba9), 0x00 },
++	{ CCI_REG8(0x886b), 0x00 },
++	{ CCI_REG8(0x579a), 0x00 },
++	{ CCI_REG8(0x579b), 0x0a },
++	{ CCI_REG8(0x579c), 0x01 },
++	{ CCI_REG8(0x579d), 0x2a },
++	{ CCI_REG8(0x57ac), 0x00 },
++	{ CCI_REG8(0x57ad), 0x00 },
++	{ CCI_REG8(0x57ae), 0x00 },
++	{ CCI_REG8(0x57af), 0x81 },
++	{ CCI_REG8(0x57be), 0x00 },
++	{ CCI_REG8(0x57bf), 0x00 },
++	{ CCI_REG8(0x57c0), 0x00 },
++	{ CCI_REG8(0x57c1), 0x81 },
++	{ CCI_REG8(0x57d0), 0x00 },
++	{ CCI_REG8(0x57d1), 0x00 },
++	{ CCI_REG8(0x57d2), 0x00 },
++	{ CCI_REG8(0x57d3), 0x81 },
++	{ CCI_REG8(0x5324), 0x00 },
++	{ CCI_REG8(0x5325), 0x31 },
++	{ CCI_REG8(0x5326), 0x00 },
++	{ CCI_REG8(0x5327), 0x60 },
++	{ CCI_REG8(0xbca7), 0x08 },
++	{ CCI_REG8(0x5fcc), 0x1e },
++	{ CCI_REG8(0x5fd7), 0x1e },
++	{ CCI_REG8(0x5fe2), 0x1e },
++	{ CCI_REG8(0x5fed), 0x1e },
++	{ CCI_REG8(0x5ff8), 0x1e },
++	{ CCI_REG8(0x6003), 0x1e },
++	{ CCI_REG8(0x5d0b), 0x02 },
++	{ CCI_REG8(0x6f6d), 0x01 },
++	{ CCI_REG8(0x61c9), 0x68 },
++	{ CCI_REG8(0x5352), 0x00 },
++	{ CCI_REG8(0x5353), 0x3f },
++	{ CCI_REG8(0x5356), 0x00 },
++	{ CCI_REG8(0x5357), 0x1c },
++	{ CCI_REG8(0x5358), 0x00 },
++	{ CCI_REG8(0x5359), 0x3d },
++	{ CCI_REG8(0x535c), 0x00 },
++	{ CCI_REG8(0x535d), 0xa6 },
++	{ CCI_REG8(0x6187), 0x1d },
++	{ CCI_REG8(0x6189), 0x1d },
++	{ CCI_REG8(0x618b), 0x1d },
++	{ CCI_REG8(0x618d), 0x23 },
++	{ CCI_REG8(0x618f), 0x23 },
++	{ CCI_REG8(0x5414), 0x01 },
++	{ CCI_REG8(0x5415), 0x12 },
++	{ CCI_REG8(0xbca8), 0x00 },
++	{ CCI_REG8(0x5fcf), 0x28 },
++	{ CCI_REG8(0x5fda), 0x2d },
++	{ CCI_REG8(0x5fe5), 0x2d },
++	{ CCI_REG8(0x5ff0), 0x2d },
++	{ CCI_REG8(0x5ffb), 0x2d },
++	{ CCI_REG8(0x6006), 0x2d },
++	{ CCI_REG8(0x616e), 0x04 },
++	{ CCI_REG8(0x616f), 0x04 },
++	{ CCI_REG8(0x6170), 0x04 },
++	{ CCI_REG8(0x6171), 0x06 },
++	{ CCI_REG8(0x6172), 0x06 },
++	{ CCI_REG8(0x6173), 0x0c },
++	{ CCI_REG8(0x6174), 0x0c },
++	{ CCI_REG8(0x6175), 0x0c },
++	{ CCI_REG8(0x6176), 0x00 },
++	{ CCI_REG8(0x6177), 0x10 },
++	{ CCI_REG8(0x6178), 0x00 },
++	{ CCI_REG8(0x6179), 0x1a },
++	{ CCI_REG8(0x617a), 0x00 },
++	{ CCI_REG8(0x617b), 0x1a },
++	{ CCI_REG8(0x617c), 0x00 },
++	{ CCI_REG8(0x617d), 0x27 },
++	{ CCI_REG8(0x617e), 0x00 },
++	{ CCI_REG8(0x617f), 0x27 },
++	{ CCI_REG8(0x6180), 0x00 },
++	{ CCI_REG8(0x6181), 0x44 },
++	{ CCI_REG8(0x6182), 0x00 },
++	{ CCI_REG8(0x6183), 0x44 },
++	{ CCI_REG8(0x6184), 0x00 },
++	{ CCI_REG8(0x6185), 0x44 },
++	{ CCI_REG8(0x5dfc), 0x0a },
++	{ CCI_REG8(0x5e00), 0x0a },
++	{ CCI_REG8(0x5e04), 0x0a },
++	{ CCI_REG8(0x5e08), 0x0a },
++	{ CCI_REG8(0x5dfd), 0x0a },
++	{ CCI_REG8(0x5e01), 0x0a },
++	{ CCI_REG8(0x5e05), 0x0a },
++	{ CCI_REG8(0x5e09), 0x0a },
++	{ CCI_REG8(0x5dfe), 0x0a },
++	{ CCI_REG8(0x5e02), 0x0a },
++	{ CCI_REG8(0x5e06), 0x0a },
++	{ CCI_REG8(0x5e0a), 0x0a },
++	{ CCI_REG8(0x5dff), 0x0a },
++	{ CCI_REG8(0x5e03), 0x0a },
++	{ CCI_REG8(0x5e07), 0x0a },
++	{ CCI_REG8(0x5e0b), 0x0a },
++	{ CCI_REG8(0x5dec), 0x12 },
++	{ CCI_REG8(0x5df0), 0x12 },
++	{ CCI_REG8(0x5df4), 0x21 },
++	{ CCI_REG8(0x5df8), 0x31 },
++	{ CCI_REG8(0x5ded), 0x12 },
++	{ CCI_REG8(0x5df1), 0x12 },
++	{ CCI_REG8(0x5df5), 0x21 },
++	{ CCI_REG8(0x5df9), 0x31 },
++	{ CCI_REG8(0x5dee), 0x12 },
++	{ CCI_REG8(0x5df2), 0x12 },
++	{ CCI_REG8(0x5df6), 0x21 },
++	{ CCI_REG8(0x5dfa), 0x31 },
++	{ CCI_REG8(0x5def), 0x12 },
++	{ CCI_REG8(0x5df3), 0x12 },
++	{ CCI_REG8(0x5df7), 0x21 },
++	{ CCI_REG8(0x5dfb), 0x31 },
++	{ CCI_REG8(0x5ddc), 0x0d },
++	{ CCI_REG8(0x5de0), 0x0d },
++	{ CCI_REG8(0x5de4), 0x0d },
++	{ CCI_REG8(0x5de8), 0x0d },
++	{ CCI_REG8(0x5ddd), 0x0d },
++	{ CCI_REG8(0x5de1), 0x0d },
++	{ CCI_REG8(0x5de5), 0x0d },
++	{ CCI_REG8(0x5de9), 0x0d },
++	{ CCI_REG8(0x5dde), 0x0d },
++	{ CCI_REG8(0x5de2), 0x0d },
++	{ CCI_REG8(0x5de6), 0x0d },
++	{ CCI_REG8(0x5dea), 0x0d },
++	{ CCI_REG8(0x5ddf), 0x0d },
++	{ CCI_REG8(0x5de3), 0x0d },
++	{ CCI_REG8(0x5de7), 0x0d },
++	{ CCI_REG8(0x5deb), 0x0d },
++	{ CCI_REG8(0x5dcc), 0x55 },
++	{ CCI_REG8(0x5dd0), 0x50 },
++	{ CCI_REG8(0x5dd4), 0x4b },
++	{ CCI_REG8(0x5dd8), 0x4b },
++	{ CCI_REG8(0x5dcd), 0x55 },
++	{ CCI_REG8(0x5dd1), 0x50 },
++	{ CCI_REG8(0x5dd5), 0x4b },
++	{ CCI_REG8(0x5dd9), 0x4b },
++	{ CCI_REG8(0x5dce), 0x55 },
++	{ CCI_REG8(0x5dd2), 0x50 },
++	{ CCI_REG8(0x5dd6), 0x4b },
++	{ CCI_REG8(0x5dda), 0x4b },
++	{ CCI_REG8(0x5dcf), 0x55 },
++	{ CCI_REG8(0x5dd3), 0x50 },
++	{ CCI_REG8(0x5dd7), 0x4b },
++	{ CCI_REG8(0x5ddb), 0x4b },
++	{ CCI_REG8(0x0202), 0x0b },
++	{ CCI_REG8(0x0203), 0x86 },
++	{ CCI_REG8(0x0204), 0x00 },
++	{ CCI_REG8(0x0205), 0x00 },
++	{ CCI_REG8(0x020e), 0x01 },
++	{ CCI_REG8(0x020f), 0x00 },
++	{ CCI_REG8(0x0210), 0x01 },
++	{ CCI_REG8(0x0211), 0x00 },
++	{ CCI_REG8(0x0212), 0x01 },
++	{ CCI_REG8(0x0213), 0x00 },
++	{ CCI_REG8(0x0214), 0x01 },
++	{ CCI_REG8(0x0215), 0x00 },
++};
++
++static const struct cci_reg_sequence metadata_output[] = {
++	{ CCI_REG8(0x3050), 1 }, /* MIPI Output enabled */
++	{ CCI_REG8(0x3051), 1 }, /* MIPI output frame includes pixels data */
++	{ CCI_REG8(0x3052), 1 }, /* MIPI output frame includes meta data */
++	{ IMX500_REG_DD_CH06_VCID, 0 },
++	{ IMX500_REG_DD_CH07_VCID, 0 },
++	{ IMX500_REG_DD_CH08_VCID, 0 },
++	{ IMX500_REG_DD_CH09_VCID, 0 },
++	{ IMX500_REG_DD_CH06_DT,
++	  0x12 }, /* KPI - User Defined 8-bit Data Type 1 */
++	{ IMX500_REG_DD_CH07_DT, 0x12 }, /* Input Tensor - U.D. 8-bit type 2 */
++	{ IMX500_REG_DD_CH08_DT, 0x12 }, /* Output Tensor - U.D. 8-bit type 3 */
++	{ IMX500_REG_DD_CH09_DT, 0x12 }, /* PQ - U.D. 8-bit type 4 */
++	{ IMX500_REG_DD_CH06_PACKING, IMX500_DD_PACKING_8BPP },
++	{ IMX500_REG_DD_CH07_PACKING, IMX500_DD_PACKING_8BPP },
++	{ IMX500_REG_DD_CH08_PACKING, IMX500_DD_PACKING_8BPP },
++	{ IMX500_REG_DD_CH09_PACKING, IMX500_DD_PACKING_8BPP },
++};
++
++static const struct cci_reg_sequence dnn_regs[] = {
++	{ CCI_REG8(0xd960), 0x52 },
++	{ CCI_REG8(0xd961), 0x52 },
++	{ CCI_REG8(0xd962), 0x52 },
++	{ CCI_REG8(0xd963), 0x52 },
++	{ CCI_REG8(0xd96c), 0x44 },
++	{ CCI_REG8(0xd96d), 0x44 },
++	{ CCI_REG8(0xd96e), 0x44 },
++	{ CCI_REG8(0xd96f), 0x44 },
++	{ CCI_REG8(0xd600), 0x20 },
++	/* Black level */
++	{ CCI_REG16(0xd80c), 0x100 },
++	{ CCI_REG16(0xd80e), 0x100 },
++	{ CCI_REG16(0xd810), 0x100 },
++	{ CCI_REG16(0xd812), 0x100 },
++	/* Gamma */
++	{ CCI_REG8(0xd814), 1 },
++	{ CCI_REG32(0xd850), 0x10000 },
++	{ CCI_REG32(0xd854), 0x40002 },
++	{ CCI_REG32(0xd858), 0x60005 },
++	{ CCI_REG32(0xd85c), 0x90008 },
++	{ CCI_REG32(0xd860), 0xc000a },
++	{ CCI_REG32(0xd864), 0x12000f },
++	{ CCI_REG32(0xd868), 0x1c0014 },
++	{ CCI_REG32(0xd86c), 0x2a0024 },
++	{ CCI_REG32(0xd870), 0x360030 },
++	{ CCI_REG32(0xd874), 0x46003c },
++	{ CCI_REG32(0xd878), 0x5a0051 },
++	{ CCI_REG32(0xd87c), 0x750064 },
++	{ CCI_REG32(0xd880), 0x920084 },
++	{ CCI_REG32(0xd884), 0xa9009e },
++	{ CCI_REG32(0xd888), 0xba00b2 },
++	{ CCI_REG32(0xd88c), 0xc700c1 },
++	{ CCI_REG32(0xd890), 0xd100cd },
++	{ CCI_REG32(0xd894), 0xde00d6 },
++	{ CCI_REG32(0xd898), 0xe900e4 },
++	{ CCI_REG32(0xd89c), 0xf300ee },
++	{ CCI_REG32(0xd8a0), 0xfb00f7 },
++	{ CCI_REG16(0xd8a4), 0xff },
++	{ CCI_REG32(0xd8a8), 0x10000 },
++	{ CCI_REG32(0xd8ac), 0x40002 },
++	{ CCI_REG32(0xd8b0), 0x60005 },
++	{ CCI_REG32(0xd8b4), 0x90008 },
++	{ CCI_REG32(0xd8b8), 0xc000a },
++	{ CCI_REG32(0xd8bc), 0x12000f },
++	{ CCI_REG32(0xd8c0), 0x1c0014 },
++	{ CCI_REG32(0xd8c4), 0x2a0024 },
++	{ CCI_REG32(0xd8c8), 0x360030 },
++	{ CCI_REG32(0xd8cc), 0x46003c },
++	{ CCI_REG32(0xd8d0), 0x5a0051 },
++	{ CCI_REG32(0xd8d4), 0x750064 },
++	{ CCI_REG32(0xd8d8), 0x920084 },
++	{ CCI_REG32(0xd8dc), 0xa9009e },
++	{ CCI_REG32(0xd8e0), 0xba00b2 },
++	{ CCI_REG32(0xd8e4), 0xc700c1 },
++	{ CCI_REG32(0xd8e8), 0xd100cd },
++	{ CCI_REG32(0xd8ec), 0xde00d6 },
++	{ CCI_REG32(0xd8f0), 0xe900e4 },
++	{ CCI_REG32(0xd8f4), 0xf300ee },
++	{ CCI_REG32(0xd8f8), 0xfb00f7 },
++	{ CCI_REG16(0xd8fc), 0xff },
++	{ CCI_REG32(0xd900), 0x10000 },
++	{ CCI_REG32(0xd904), 0x40002 },
++	{ CCI_REG32(0xd908), 0x60005 },
++	{ CCI_REG32(0xd90c), 0x90008 },
++	{ CCI_REG32(0xd910), 0xc000a },
++	{ CCI_REG32(0xd914), 0x12000f },
++	{ CCI_REG32(0xd918), 0x1c0014 },
++	{ CCI_REG32(0xd91c), 0x2a0024 },
++	{ CCI_REG32(0xd920), 0x360030 },
++	{ CCI_REG32(0xd924), 0x46003c },
++	{ CCI_REG32(0xd928), 0x5a0051 },
++	{ CCI_REG32(0xd92c), 0x750064 },
++	{ CCI_REG32(0xd930), 0x920084 },
++	{ CCI_REG32(0xd934), 0xa9009e },
++	{ CCI_REG32(0xd938), 0xba00b2 },
++	{ CCI_REG32(0xd93c), 0xc700c1 },
++	{ CCI_REG32(0xd940), 0xd100cd },
++	{ CCI_REG32(0xd944), 0xde00d6 },
++	{ CCI_REG32(0xd948), 0xe900e4 },
++	{ CCI_REG32(0xd94c), 0xf300ee },
++	{ CCI_REG32(0xd950), 0xfb00f7 },
++	{ CCI_REG16(0xd954), 0xff },
++	{ CCI_REG8(0xd826), 1 },
++};
++
++/* Mode configs */
++static const struct imx500_mode imx500_supported_modes[] = {
++	{
++		/* 12MPix 10fps mode */
++		.width = 4056,
++		.height = 3040,
++		.line_length_pix = 17900,
++		.crop = {
++			.left = IMX500_PIXEL_ARRAY_LEFT,
++			.top = IMX500_PIXEL_ARRAY_TOP,
++			.width = 4056,
++			.height = 3040,
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_4056x3040_regs),
++			.regs = mode_4056x3040_regs,
++		},
++	},
++	{
++		/* 2x2 binned 40fps mode */
++		.width = 2028,
++		.height = 1520,
++		.line_length_pix = 9398,
++		.crop = {
++			.left = IMX500_PIXEL_ARRAY_LEFT,
++			.top = IMX500_PIXEL_ARRAY_TOP,
++			.width = 4056,
++			.height = 3040,
++		},
++		.reg_list = {
++			.num_of_regs = ARRAY_SIZE(mode_2028x1520_regs),
++			.regs = mode_2028x1520_regs,
++		},
++	},
++};
++
++/*
++ * The supported formats.
++ * This table MUST contain 4 entries per format, to cover the various flip
++ * combinations in the order
++ * - no flip
++ * - h flip
++ * - v flip
++ * - h&v flips
++ */
++static const u32 codes[] = {
++	/* 10-bit modes. */
++	MEDIA_BUS_FMT_SRGGB10_1X10,
++	MEDIA_BUS_FMT_SGRBG10_1X10,
++	MEDIA_BUS_FMT_SGBRG10_1X10,
++	MEDIA_BUS_FMT_SBGGR10_1X10,
++};
++
++enum imx500_state {
++	IMX500_STATE_RESET = 0,
++	IMX500_STATE_PROGRAM_EMPTY,
++	IMX500_STATE_WITHOUT_NETWORK,
++	IMX500_STATE_WITH_NETWORK,
++};
++
++struct imx500 {
++	struct dentry *debugfs;
++	struct v4l2_subdev sd;
++	struct media_pad pad[NUM_PADS];
++	struct regmap *regmap;
++
++	unsigned int fmt_code;
++
++	struct clk *xclk;
++	u32 xclk_freq;
++
++	struct gpio_desc *led_gpio;
++	struct gpio_desc *reset_gpio;
++	struct regulator_bulk_data supplies[IMX500_NUM_SUPPLIES];
++
++	struct v4l2_ctrl_handler ctrl_handler;
++	/* V4L2 Controls */
++	struct v4l2_ctrl *pixel_rate;
++	struct v4l2_ctrl *link_freq;
++	struct v4l2_ctrl *exposure;
++	struct v4l2_ctrl *vflip;
++	struct v4l2_ctrl *hflip;
++	struct v4l2_ctrl *vblank;
++	struct v4l2_ctrl *hblank;
++	struct v4l2_ctrl *network_fw_ctrl;
++
++	struct v4l2_rect inference_window;
++
++	/* Current mode */
++	const struct imx500_mode *mode;
++
++	/*
++	 * Mutex for serialized access:
++	 * Protect sensor module set pad format and start/stop streaming safely.
++	 */
++	struct mutex mutex;
++
++	/* Streaming on/off */
++	bool streaming;
++
++	/* Rewrite common registers on stream on? */
++	bool common_regs_written;
++
++	bool loader_and_main_written;
++	bool network_written;
++
++	/* Current long exposure factor in use. Set through V4L2_CID_VBLANK */
++	unsigned int long_exp_shift;
++
++	struct spi_device *spi_device;
++
++	const struct firmware *fw_loader;
++	const struct firmware *fw_main;
++	const u8 *fw_network;
++	size_t fw_network_size;
++	size_t fw_progress;
++	unsigned int fw_stage;
++
++	enum imx500_state fsm_state;
++
++	u32 num_inference_lines;
++};
++
++static inline struct imx500 *to_imx500(struct v4l2_subdev *_sd)
++{
++	return container_of(_sd, struct imx500, sd);
++}
++
++static bool validate_normalization_yuv(u16 reg, uint8_t size,
++				       uint32_t value)
++{
++	/* Some regs are 9-bit, some 8-bit, some 1-bit */
++	switch (reg) {
++	case 0xD62A:
++	case 0xD632:
++	case 0xD63A:
++	case 0xD644:
++	case 0xD648:
++	case 0xD64C:
++	case 0xD650:
++	case 0xD654:
++	case 0xD658:
++		return size == 2 && !(value & ~0x1FF);
++	case 0xD600:
++	case 0xD601:
++	case 0xD602:
++		return size == 1 && !(value & ~0xFF);
++	case 0xD629:
++	case 0xD630:
++	case 0xD638:
++	case 0xD643:
++	case 0xD647:
++	case 0xD64B:
++	case 0xD64F:
++	case 0xD653:
++	case 0xD657:
++		return size == 1 && !(value & ~0x01);
++	default:
++		return false;
++	}
++}
++
++/* Common function as bayer rgb + normalization use the same repeating register
++ * layout
++ */
++static bool validate_bit_pattern(u8 offset, uint8_t size, uint32_t value)
++{
++	/* There are no odd register addresses */
++	if (offset & 1)
++		return false;
++
++	/* Valid register sizes/patterns repeat every 4 */
++	offset = (offset >> 1) & 3;
++
++	if (offset == 1)
++		return size == 1 && !(value & ~1);
++	else
++		return size == 2 && !(value & ~0x1FF);
++}
++
++static bool validate_bayer_rgb_normalization(u16 reg, uint8_t size,
++					     uint32_t value)
++{
++	if (reg < 0xD684 || reg >= 0xD6E4)
++		return false;
++	return validate_bit_pattern(reg - 0xD684, size, value);
++}
++
++static bool validate_normalization_registers(u16 reg, uint8_t size,
++					     uint32_t value)
++{
++	if (reg < 0xD708 || reg >= 0xD750)
++		return false;
++	return validate_bit_pattern(reg - 0xD708, size, value);
++}
++
++static bool validate_image_format_selection(u16 reg, uint8_t size,
++					    uint32_t value)
++{
++	if (size != 1 || value > 5)
++		return false;
++	if (reg < 0xD750 || reg > 0xd752)
++		return false;
++	return true;
++}
++
++static bool validate_yc_conversion_factor(u16 reg, uint8_t size,
++					  uint32_t value)
++{
++	static const u32 allowed[9] = {
++		0x0FFF0FFF, 0x0FFF1FFF, 0x0FFF0FFF, 0x0FFF1FFF, 0x0FFF0FFF,
++		0x0FFF1FFF, 0x01FF01FF, 0x01FF01FF, 0x01FF01FF,
++	};
++
++	if (size > 4 || size & 1 || reg & 1 || reg < 0x76C || reg > 0xD7FA)
++		return false;
++
++	if (size == 2) {
++		if (reg & 2)
++			reg -= 2;
++		else
++			value <<= 16;
++	}
++
++	/* High registers (clip values) are all 2x 9-bit */
++	if (reg >= 0xD7D8)
++		return !(value & ~0x01FF01FF);
++
++	/* Early registers follow a repeating pattern */
++	reg -= 0xD76C;
++	reg >>= 2;
++	return !(value & ~allowed[reg % sizeof(allowed)]);
++}
++
++static bool validate_dnn_output_setting(u16 reg, uint8_t size,
++					uint32_t value)
++{
++	/* Only Y_OUT_SIZE for Input Tensor / Output Tensor is configurable from
++	 * userspace
++	 */
++	return (size == 2) && (value < 2046) &&
++	       ((reg == CCI_REG_ADDR(IMX500_REG_DD_CH07_Y_OUT_SIZE)) ||
++		(reg == CCI_REG_ADDR(IMX500_REG_DD_CH08_Y_OUT_SIZE)));
++}
++
++static bool __must_check
++imx500_validate_inference_register(const struct cci_reg_sequence *reg)
++{
++	unsigned int i;
++
++	static bool (*const checks[])(uint16_t, uint8_t, uint32_t) = {
++		validate_normalization_yuv,
++		validate_bayer_rgb_normalization,
++		validate_normalization_registers,
++		validate_image_format_selection,
++		validate_yc_conversion_factor,
++		validate_dnn_output_setting,
++	};
++
++	if (!reg)
++		return false;
++
++	for (i = 0; i < ARRAY_SIZE(checks); i++) {
++		if (checks[i](CCI_REG_ADDR(reg->reg),
++			      CCI_REG_WIDTH_BYTES(reg->reg), reg->val))
++			return true;
++	}
++
++	return false;
++}
++
++static int imx500_set_inference_window(struct imx500 *imx500)
++{
++	u16 left, top, width, height;
++
++	if (!imx500->inference_window.width ||
++	    !imx500->inference_window.height) {
++		width = 4056;
++		height = 3040;
++		left = 0;
++		top = 0;
++	} else {
++		width = min_t(u16, imx500->inference_window.width, 4056);
++		height = min_t(u16, imx500->inference_window.height, 3040);
++		left = min_t(u16, imx500->inference_window.left, 4056);
++		top = min_t(u16, imx500->inference_window.top, 3040);
++	}
++
++	const struct cci_reg_sequence window_regs[] = {
++		{ IMX500_REG_DWP_AP_VC_HOFF, left },
++		{ IMX500_REG_DWP_AP_VC_VOFF, top },
++		{ IMX500_REG_DWP_AP_VC_HSIZE, width },
++		{ IMX500_REG_DWP_AP_VC_VSIZE, height },
++	};
++
++	return cci_multi_reg_write(imx500->regmap, window_regs,
++				   ARRAY_SIZE(window_regs), NULL);
++}
++
++static int imx500_reg_val_write_cbk(void *arg,
++				    const struct cci_reg_sequence *reg)
++{
++	struct imx500 *imx500 = arg;
++
++	if (!imx500_validate_inference_register(reg))
++		return -EINVAL;
++
++	return cci_write(imx500->regmap, reg->reg, reg->val, NULL);
++}
++
++/* Get bayer order based on flip setting. */
++static u32 imx500_get_format_code(struct imx500 *imx500)
++{
++	unsigned int i;
++
++	lockdep_assert_held(&imx500->mutex);
++
++	i = (imx500->vflip->val ? 2 : 0) | (imx500->hflip->val ? 1 : 0);
++
++	return codes[i];
++}
++
++static void imx500_set_default_format(struct imx500 *imx500)
++{
++	/* Set default mode to max resolution */
++	imx500->mode = &imx500_supported_modes[0];
++	imx500->fmt_code = MEDIA_BUS_FMT_SRGGB10_1X10;
++}
++
++/* -1 on fail, block size on success */
++static int imx500_validate_fw_block(const char *data, size_t maxlen)
++{
++	const size_t header_size = 32;
++	static const char header_id[] = { '9', '4', '6', '4' };
++
++	const size_t footer_size = 64;
++	static const char footer_id[] = { '3', '6', '9', '5' };
++
++	u32 data_size;
++
++	const char *end = data + maxlen;
++
++	if (!data)
++		return -1;
++
++	if (maxlen < header_size)
++		return -1;
++
++	if (memcmp(data, &header_id, sizeof(header_id)))
++		return -1;
++
++	/* data_size is size of header + body */
++	memcpy(&data_size, data + sizeof(header_id), sizeof(data_size));
++	data_size = ___constant_swab32(data_size);
++
++	if (end - data_size - footer_size < data)
++		return -1;
++	if (memcmp(data + data_size + footer_size - sizeof(footer_id),
++		   &footer_id, sizeof(footer_id)))
++		return -1;
++
++	return data_size + footer_size;
++}
++
++/* Parse fw block by block, returning total valid fw size */
++static size_t imx500_valid_fw_bytes(const u8 *fw,
++				    const size_t fw_size)
++{
++	int i;
++	size_t bytes = 0;
++
++	const u8 *data = fw;
++	size_t size = fw_size;
++
++	while ((i = imx500_validate_fw_block(data, size)) > 0) {
++		bytes += i;
++		data += i;
++		size -= i;
++	}
++
++	return bytes;
++}
++
++static int imx500_iterate_nw_regs(
++	const u8 *fw, size_t fw_size, void *arg,
++	int (*cbk)(void *arg, const struct cci_reg_sequence *reg))
++{
++	struct cpio_data cd = { NULL, 0, "" };
++	const u8 *read_pos;
++	size_t entries;
++	size_t size;
++
++	if (!fw || !cbk)
++		return -EINVAL;
++
++	size = imx500_valid_fw_bytes(fw, fw_size);
++	cd = find_cpio_data("imx500_regs", (void *)(fw + size),
++			    fw_size - size, NULL);
++	if (!cd.data || cd.size % 7)
++		return -EINVAL;
++
++	read_pos = cd.data;
++	entries = cd.size / 7;
++
++	while (entries--) {
++		struct cci_reg_sequence reg = { 0, 0 };
++		u16 addr;
++		u8 len;
++		u32 val;
++		int ret;
++
++		memcpy(&addr, read_pos, sizeof(addr));
++		read_pos += sizeof(addr);
++		memcpy(&len, read_pos, sizeof(len));
++		read_pos += sizeof(len);
++		memcpy(&val, read_pos, sizeof(val));
++		read_pos += sizeof(val);
++
++		reg.reg = ((len << CCI_REG_WIDTH_SHIFT) | addr);
++		reg.val = val;
++
++		ret = cbk(arg, &reg);
++		if (ret)
++			return ret;
++	}
++	return 0;
++}
++
++static int imx500_reg_tensor_lines_cbk(void *arg,
++				       const struct cci_reg_sequence *reg)
++{
++	u16 *tensor_lines = arg;
++
++	if (reg->val < 2046) {
++		switch (reg->reg) {
++		case IMX500_REG_DD_CH07_Y_OUT_SIZE:
++			tensor_lines[0] = reg->val;
++			break;
++		case IMX500_REG_DD_CH08_Y_OUT_SIZE:
++			tensor_lines[1] = reg->val;
++			break;
++		}
++	}
++
++	return 0;
++}
++
++static void imx500_calc_inference_lines(struct imx500 *imx500)
++{
++	u16 tensor_lines[2] = { 0, 0 };
++
++	if (!imx500->fw_network) {
++		imx500->num_inference_lines = 0;
++		return;
++	}
++
++	imx500_iterate_nw_regs(imx500->fw_network, imx500->fw_network_size,
++			       tensor_lines, imx500_reg_tensor_lines_cbk);
++
++	/* Full-res mode, embedded lines are actually slightly shorter than inference
++	 * lines 2544 vs 2560 (over-allocate with inf. width)
++	 */
++	imx500->num_inference_lines = IMX500_NUM_KPI_LINES +
++				      IMX500_NUM_PQ_LINES + tensor_lines[0] +
++				      tensor_lines[1];
++}
++
++static void imx500_adjust_exposure_range(struct imx500 *imx500)
++{
++	int exposure_max, exposure_def;
++
++	/* Honour the VBLANK limits when setting exposure. */
++	exposure_max = imx500->mode->height + imx500->vblank->val -
++		       IMX500_EXPOSURE_OFFSET;
++	exposure_def = min(exposure_max, imx500->exposure->val);
++	__v4l2_ctrl_modify_range(imx500->exposure, imx500->exposure->minimum,
++				 exposure_max, imx500->exposure->step,
++				 exposure_def);
++}
++
++static int imx500_set_frame_length(struct imx500 *imx500, unsigned int val)
++{
++	int ret = 0;
++
++	imx500->long_exp_shift = 0;
++
++	while (val > IMX500_FRAME_LENGTH_MAX) {
++		imx500->long_exp_shift++;
++		val >>= 1;
++	}
++
++	ret = cci_write(imx500->regmap, IMX500_REG_FRAME_LENGTH, val, NULL);
++	if (ret)
++		return ret;
++
++	return cci_write(imx500->regmap, IMX500_LONG_EXP_SHIFT_REG,
++			 imx500->long_exp_shift, NULL);
++}
++
++/* reg is both input and output:
++ * reg->val is the value we're polling until we're NEQ to
++ * It is then populated with the updated value.
++ */
++static int __must_check imx500_poll_status_reg(struct imx500 *state,
++					       struct cci_reg_sequence *reg,
++					       u8 timeout)
++{
++	u64 read_value;
++	int ret;
++
++	while (timeout) {
++		ret = cci_read(state->regmap, reg->reg, &read_value, NULL);
++		if (ret)
++			return ret;
++
++		if (read_value != reg->val) {
++			reg->val = read_value;
++			return 0;
++		}
++
++		timeout--;
++		mdelay(50);
++	}
++	return -EAGAIN;
++}
++
++static int imx500_prepare_poll_cmd_reply_sts(struct imx500 *imx500,
++					     struct cci_reg_sequence *cmd_reply)
++{
++	/* Perform single-byte read of 4-byte IMX500_REG_DD_REF_STS register to
++	 * target CMD_REPLY_STS_CNT sub-register
++	 */
++	cmd_reply->reg = CCI_REG8(CCI_REG_ADDR(IMX500_REG_DD_REF_STS));
++
++	return cci_read(imx500->regmap, cmd_reply->reg, &cmd_reply->val, NULL);
++}
++
++static int imx500_clear_weights(struct imx500 *imx500)
++{
++	struct cci_reg_sequence cmd_reply_sts_cnt_reg;
++	u64 imx500_fsm_state;
++	u64 cmd_reply;
++	int ret;
++
++	static const struct cci_reg_sequence request_clear[] = {
++		{ IMX500_REG_DD_ST_TRANS_CMD,
++		  IMX500_DD_ST_TRANS_CMD_CLEAR_WEIGHTS },
++		{ IMX500_REG_DD_CMD_INT, IMX500_DD_CMD_INT_ST_TRANS },
++	};
++
++	if (imx500->fsm_state != IMX500_STATE_WITH_NETWORK)
++		return -EINVAL;
++
++	ret = cci_read(imx500->regmap, IMX500_REG_DD_SYS_STATE,
++		       &imx500_fsm_state, NULL);
++	if (ret || imx500_fsm_state != IMX500_DD_SYS_STATE_STANDBY_WITH_NETWORK)
++		return ret ? ret : -EREMOTEIO;
++
++	ret = imx500_prepare_poll_cmd_reply_sts(imx500, &cmd_reply_sts_cnt_reg);
++	if (ret)
++		return ret;
++
++	ret = cci_multi_reg_write(imx500->regmap, request_clear,
++				  ARRAY_SIZE(request_clear), NULL);
++	if (ret)
++		return ret;
++
++	ret = imx500_poll_status_reg(imx500, &cmd_reply_sts_cnt_reg, 5);
++	if (ret)
++		return ret;
++
++	ret = cci_read(imx500->regmap, IMX500_REG_DD_CMD_REPLY_STS, &cmd_reply,
++		       NULL);
++	if (ret || cmd_reply != IMX500_DD_CMD_REPLY_STS_TRANS_DONE)
++		return ret ? ret : -EREMOTEIO;
++
++	imx500->fsm_state = IMX500_STATE_WITHOUT_NETWORK;
++	imx500->network_written = false;
++	return 0;
++}
++
++static void imx500_clear_fw_network(struct imx500 *imx500)
++{
++	/* Remove any previous firmware blob. */
++	if (imx500->fw_network)
++		vfree(imx500->fw_network);
++
++	imx500->fw_network = NULL;
++	imx500->network_written = false;
++	imx500->fw_progress = 0;
++}
++
++static int imx500_set_ctrl(struct v4l2_ctrl *ctrl)
++{
++	struct imx500 *imx500 =
++		container_of(ctrl->handler, struct imx500, ctrl_handler);
++	struct i2c_client *client = v4l2_get_subdevdata(&imx500->sd);
++	int ret = 0;
++
++	if (ctrl->id == V4L2_CID_USER_IMX500_NETWORK_FW_FD) {
++		/* Reset state of the control. */
++		if (ctrl->val < 0) {
++			return 0;
++		} else if (ctrl->val == S32_MAX) {
++			ctrl->val = -1;
++			if (pm_runtime_get_if_in_use(&client->dev) == 0)
++				return 0;
++
++			if (imx500->network_written)
++				ret = imx500_clear_weights(imx500);
++			imx500_clear_fw_network(imx500);
++
++			pm_runtime_mark_last_busy(&client->dev);
++			pm_runtime_put_autosuspend(&client->dev);
++
++			return ret;
++		}
++
++		imx500_clear_fw_network(imx500);
++		ret = kernel_read_file_from_fd(ctrl->val, 0,
++					       (void **)&imx500->fw_network, INT_MAX,
++					       &imx500->fw_network_size,
++					       1);
++		/*
++		 * Back to reset state, the FD cannot be considered valid after
++		 * this IOCTL completes.
++		 */
++		ctrl->val = -1;
++
++		if (ret < 0) {
++			dev_err(&client->dev, "%s failed to read fw image: %d\n",
++				__func__, ret);
++			imx500_clear_fw_network(imx500);
++			return ret;
++		}
++		if (ret != imx500->fw_network_size) {
++			dev_err(&client->dev, "%s read fw image size mismatich: got %u, expected %zu\n",
++				__func__, ret, imx500->fw_network_size);
++			imx500_clear_fw_network(imx500);
++			return -EIO;
++		}
++
++		imx500_calc_inference_lines(imx500);
++		return 0;
++	}
++
++	/*
++	 * The VBLANK control may change the limits of usable exposure, so check
++	 * and adjust if necessary.
++	 */
++	if (ctrl->id == V4L2_CID_VBLANK)
++		imx500_adjust_exposure_range(imx500);
++
++	/*
++	 * Applying V4L2 control value only happens
++	 * when power is up for streaming
++	 */
++	if (pm_runtime_get_if_in_use(&client->dev) == 0)
++		return 0;
++
++	switch (ctrl->id) {
++	case V4L2_CID_ANALOGUE_GAIN:
++		ret = cci_write(imx500->regmap, IMX500_REG_ANALOG_GAIN,
++				ctrl->val, NULL);
++		break;
++	case V4L2_CID_EXPOSURE:
++		ret = cci_write(imx500->regmap, IMX500_REG_EXPOSURE,
++				ctrl->val >> imx500->long_exp_shift, NULL);
++		break;
++	case V4L2_CID_HFLIP:
++	case V4L2_CID_VFLIP:
++		ret = cci_write(imx500->regmap, IMX500_REG_ORIENTATION,
++				imx500->hflip->val | imx500->vflip->val << 1,
++				NULL);
++		break;
++	case V4L2_CID_VBLANK:
++		ret = imx500_set_frame_length(imx500,
++					      imx500->mode->height + ctrl->val);
++		break;
++	case V4L2_CID_HBLANK:
++		ret = cci_write(imx500->regmap, IMX500_REG_LINE_LENGTH,
++				imx500->mode->width + ctrl->val, NULL);
++		break;
++	case V4L2_CID_NOTIFY_GAINS:
++		ret = cci_write(imx500->regmap, IMX500_REG_COLOUR_BALANCE_B,
++				ctrl->p_new.p_u32[0], NULL);
++		cci_write(imx500->regmap, IMX500_REG_COLOUR_BALANCE_GB,
++			  ctrl->p_new.p_u32[1], &ret);
++		cci_write(imx500->regmap, IMX500_REG_COLOUR_BALANCE_GR,
++			  ctrl->p_new.p_u32[2], &ret);
++		cci_write(imx500->regmap, IMX500_REG_COLOUR_BALANCE_R,
++			  ctrl->p_new.p_u32[3], &ret);
++		break;
++	case V4L2_CID_USER_IMX500_INFERENCE_WINDOW:
++		memcpy(&imx500->inference_window, ctrl->p_new.p_u32,
++		       sizeof(struct v4l2_rect));
++		ret = imx500_set_inference_window(imx500);
++		break;
++	default:
++		dev_info(&client->dev,
++			 "ctrl(id:0x%x,val:0x%x) is not handled\n", ctrl->id,
++			 ctrl->val);
++		ret = -EINVAL;
++		break;
++	}
++
++	pm_runtime_mark_last_busy(&client->dev);
++	pm_runtime_put_autosuspend(&client->dev);
++
++	return ret;
++}
++
++static const struct v4l2_ctrl_ops imx500_ctrl_ops = {
++	.s_ctrl = imx500_set_ctrl,
++};
++
++static const struct v4l2_ctrl_config imx500_notify_gains_ctrl = {
++	.ops = &imx500_ctrl_ops,
++	.id = V4L2_CID_NOTIFY_GAINS,
++	.type = V4L2_CTRL_TYPE_U32,
++	.min = IMX500_COLOUR_BALANCE_MIN,
++	.max = IMX500_COLOUR_BALANCE_MAX,
++	.step = IMX500_COLOUR_BALANCE_STEP,
++	.def = IMX500_COLOUR_BALANCE_DEFAULT,
++	.dims = { 4 },
++	.elem_size = sizeof(u32),
++};
++
++static int imx500_enum_mbus_code(struct v4l2_subdev *sd,
++				 struct v4l2_subdev_state *sd_state,
++				 struct v4l2_subdev_mbus_code_enum *code)
++{
++	struct imx500 *imx500 = to_imx500(sd);
++
++	if (code->pad >= NUM_PADS)
++		return -EINVAL;
++
++	if (code->pad == IMAGE_PAD) {
++		if (code->index != 0)
++			return -EINVAL;
++
++		code->code = imx500_get_format_code(imx500);
++	} else {
++		if (code->index > 0)
++			return -EINVAL;
++
++		code->code = MEDIA_BUS_FMT_SENSOR_DATA;
++	}
++
++	return 0;
++}
++
++static int imx500_enum_frame_size(struct v4l2_subdev *sd,
++				  struct v4l2_subdev_state *sd_state,
++				  struct v4l2_subdev_frame_size_enum *fse)
++{
++	struct imx500 *imx500 = to_imx500(sd);
++
++	if (fse->pad >= NUM_PADS)
++		return -EINVAL;
++
++	if (fse->pad == IMAGE_PAD) {
++		const struct imx500_mode *mode_list = imx500_supported_modes;
++		unsigned int num_modes = ARRAY_SIZE(imx500_supported_modes);
++
++		if (fse->index >= num_modes)
++			return -EINVAL;
++
++		if (fse->code != imx500_get_format_code(imx500))
++			return -EINVAL;
++
++		fse->min_width = mode_list[fse->index].width;
++		fse->max_width = fse->min_width;
++		fse->min_height = mode_list[fse->index].height;
++		fse->max_height = fse->min_height;
++	} else {
++		if (fse->code != MEDIA_BUS_FMT_SENSOR_DATA || fse->index > 0)
++			return -EINVAL;
++
++		fse->min_width = IMX500_MAX_EMBEDDED_SIZE +
++				 imx500->num_inference_lines *
++					 IMX500_INFERENCE_LINE_WIDTH;
++		fse->max_width = fse->min_width;
++		fse->min_height = 1;
++		fse->max_height = fse->min_height;
++	}
++
++	return 0;
++}
++
++static void imx500_update_image_pad_format(struct imx500 *imx500,
++					   const struct imx500_mode *mode,
++					   struct v4l2_subdev_format *fmt)
++{
++	fmt->format.width = mode->width;
++	fmt->format.height = mode->height;
++	fmt->format.field = V4L2_FIELD_NONE;
++	fmt->format.colorspace = V4L2_COLORSPACE_RAW;
++	fmt->format.ycbcr_enc =
++		V4L2_MAP_YCBCR_ENC_DEFAULT(fmt->format.colorspace);
++	fmt->format.quantization = V4L2_MAP_QUANTIZATION_DEFAULT(
++		true, fmt->format.colorspace, fmt->format.ycbcr_enc);
++	fmt->format.xfer_func =
++		V4L2_MAP_XFER_FUNC_DEFAULT(fmt->format.colorspace);
++}
++
++static void imx500_update_metadata_pad_format(const struct imx500 *imx500,
++					      struct v4l2_subdev_format *fmt)
++{
++	fmt->format.width =
++		IMX500_MAX_EMBEDDED_SIZE +
++		imx500->num_inference_lines * IMX500_INFERENCE_LINE_WIDTH;
++	fmt->format.height = 1;
++	fmt->format.code = MEDIA_BUS_FMT_SENSOR_DATA;
++	fmt->format.field = V4L2_FIELD_NONE;
++}
++
++static int imx500_get_pad_format(struct v4l2_subdev *sd,
++				 struct v4l2_subdev_state *sd_state,
++				 struct v4l2_subdev_format *fmt)
++{
++	struct imx500 *imx500 = to_imx500(sd);
++
++	if (fmt->pad >= NUM_PADS)
++		return -EINVAL;
++
++	mutex_lock(&imx500->mutex);
++
++	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++		struct v4l2_mbus_framefmt *try_fmt = v4l2_subdev_state_get_format(
++			sd_state, fmt->pad);
++		/* update the code which could change due to vflip or hflip */
++		try_fmt->code = fmt->pad == IMAGE_PAD ?
++					imx500_get_format_code(imx500) :
++					MEDIA_BUS_FMT_SENSOR_DATA;
++		fmt->format = *try_fmt;
++	} else {
++		if (fmt->pad == IMAGE_PAD) {
++			imx500_update_image_pad_format(imx500, imx500->mode,
++						       fmt);
++			fmt->format.code = imx500_get_format_code(imx500);
++		} else {
++			imx500_update_metadata_pad_format(imx500, fmt);
++		}
++	}
++
++	mutex_unlock(&imx500->mutex);
++	return 0;
++}
++
++static void imx500_set_framing_limits(struct imx500 *imx500)
++{
++	unsigned int hblank_min;
++	const struct imx500_mode *mode = imx500->mode;
++
++	/* Default to no long exposure multiplier. */
++	imx500->long_exp_shift = 0;
++
++	/* Update limits and set FPS to default */
++	__v4l2_ctrl_modify_range(
++		imx500->vblank, IMX500_VBLANK_MIN,
++		((1 << IMX500_LONG_EXP_SHIFT_MAX) * IMX500_FRAME_LENGTH_MAX) -
++			mode->height, 1, IMX500_VBLANK_MIN);
++
++	/* Setting this will adjust the exposure limits as well. */
++	__v4l2_ctrl_s_ctrl(imx500->vblank, IMX500_VBLANK_MIN);
++
++	hblank_min = mode->line_length_pix - mode->width;
++	__v4l2_ctrl_modify_range(imx500->hblank, hblank_min, hblank_min, 1,
++				 hblank_min);
++	__v4l2_ctrl_s_ctrl(imx500->hblank, hblank_min);
++}
++
++static int imx500_set_pad_format(struct v4l2_subdev *sd,
++				 struct v4l2_subdev_state *sd_state,
++				 struct v4l2_subdev_format *fmt)
++{
++	struct v4l2_mbus_framefmt *framefmt;
++	const struct imx500_mode *mode;
++	struct imx500 *imx500 = to_imx500(sd);
++
++	if (fmt->pad >= NUM_PADS)
++		return -EINVAL;
++
++	mutex_lock(&imx500->mutex);
++
++	if (fmt->pad == IMAGE_PAD) {
++		const struct imx500_mode *mode_list = imx500_supported_modes;
++		unsigned int num_modes = ARRAY_SIZE(imx500_supported_modes);
++
++		/* Bayer order varies with flips */
++		fmt->format.code = imx500_get_format_code(imx500);
++
++		mode = v4l2_find_nearest_size(mode_list, num_modes, width,
++					      height, fmt->format.width,
++					      fmt->format.height);
++		imx500_update_image_pad_format(imx500, mode, fmt);
++		if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++			framefmt = v4l2_subdev_state_get_format(sd_state, fmt->pad);
++			*framefmt = fmt->format;
++		} else if (imx500->mode != mode) {
++			imx500->mode = mode;
++			imx500->fmt_code = fmt->format.code;
++			imx500_set_framing_limits(imx500);
++		}
++	} else {
++		if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
++			framefmt = v4l2_subdev_state_get_format(sd_state, fmt->pad);
++			*framefmt = fmt->format;
++		} else {
++			/* Only one embedded data mode is supported */
++			imx500_update_metadata_pad_format(imx500, fmt);
++		}
++	}
++
++	mutex_unlock(&imx500->mutex);
++
++	return 0;
++}
++
++static const struct v4l2_rect *
++__imx500_get_pad_crop(struct imx500 *imx500, struct v4l2_subdev_state *sd_state,
++		      unsigned int pad, enum v4l2_subdev_format_whence which)
++{
++	switch (which) {
++	case V4L2_SUBDEV_FORMAT_TRY:
++		return v4l2_subdev_state_get_crop(sd_state, pad);
++	case V4L2_SUBDEV_FORMAT_ACTIVE:
++		return &imx500->mode->crop;
++	}
++
++	return NULL;
++}
++
++static int imx500_get_selection(struct v4l2_subdev *sd,
++				struct v4l2_subdev_state *sd_state,
++				struct v4l2_subdev_selection *sel)
++{
++	switch (sel->target) {
++	case V4L2_SEL_TGT_CROP: {
++		struct imx500 *imx500 = to_imx500(sd);
++
++		mutex_lock(&imx500->mutex);
++		sel->r = *__imx500_get_pad_crop(imx500, sd_state, sel->pad,
++						sel->which);
++		mutex_unlock(&imx500->mutex);
++
++		return 0;
++	}
++
++	case V4L2_SEL_TGT_NATIVE_SIZE:
++		sel->r.left = 0;
++		sel->r.top = 0;
++		sel->r.width = IMX500_NATIVE_WIDTH;
++		sel->r.height = IMX500_NATIVE_HEIGHT;
++
++		return 0;
++
++	case V4L2_SEL_TGT_CROP_DEFAULT:
++	case V4L2_SEL_TGT_CROP_BOUNDS:
++		sel->r.left = IMX500_PIXEL_ARRAY_LEFT;
++		sel->r.top = IMX500_PIXEL_ARRAY_TOP;
++		sel->r.width = IMX500_PIXEL_ARRAY_WIDTH;
++		sel->r.height = IMX500_PIXEL_ARRAY_HEIGHT;
++
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++static int __must_check imx500_spi_write(struct imx500 *state, const u8 *data,
++					 size_t size)
++{
++	if (size % 4 || size > ONE_MIB)
++		return -EINVAL;
++
++	if (!state->spi_device)
++		return -ENODEV;
++
++	return spi_write(state->spi_device, data, size);
++}
++
++/* Moves the IMX500 internal state machine between states or updates.
++ *
++ * Prerequisites: Sensor is powered on and not currently streaming
++ */
++static int imx500_state_transition(struct imx500 *imx500, const u8 *fw,
++				   size_t fw_size, enum imx500_image_type type,
++				   bool update)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx500->sd);
++	struct cci_reg_sequence cmd_reply_sts_cnt_reg;
++	size_t valid_size;
++	int ret;
++	u64 tmp;
++
++	if (!imx500 || !fw || type >= TYPE_MAX)
++		return -EINVAL;
++
++	if (!update && (int)type != (int)imx500->fsm_state)
++		return -EINVAL;
++
++	/* Validate firmware */
++	valid_size = imx500_valid_fw_bytes(fw, fw_size);
++	if (!valid_size)
++		return -EINVAL;
++
++	ret = imx500_prepare_poll_cmd_reply_sts(imx500, &cmd_reply_sts_cnt_reg);
++	if (ret)
++		return ret;
++
++	struct cci_reg_sequence common_regs[] = {
++		{ IMX500_REG_DD_FLASH_TYPE, 0x02 },
++		{ IMX500_REG_DD_LOAD_MODE, IMX500_DD_LOAD_MODE_AP },
++		{ IMX500_REG_DD_IMAGE_TYPE, type },
++		{ IMX500_REG_DD_DOWNLOAD_DIV_NUM, (valid_size - 1) / ONE_MIB },
++		{ IMX500_REG_DD_DOWNLOAD_FILE_SIZE, valid_size },
++	};
++
++	struct cci_reg_sequence state_transition_regs[] = {
++		{ IMX500_REG_DD_ST_TRANS_CMD, type },
++		{ IMX500_REG_DD_CMD_INT, IMX500_DD_CMD_INT_ST_TRANS },
++	};
++
++	struct cci_reg_sequence update_regs[] = {
++		{ IMX500_REG_DD_UPDATE_CMD, IMX500_DD_UPDATE_CMD_SRAM },
++		{ IMX500_REG_DD_CMD_INT, IMX500_DD_CMD_INT_UPDATE },
++	};
++
++	ret = cci_multi_reg_write(imx500->regmap, common_regs,
++				  ARRAY_SIZE(common_regs), NULL);
++
++	cci_multi_reg_write(imx500->regmap,
++			    update ? update_regs : state_transition_regs, 2,
++			    &ret);
++	if (ret)
++		return ret;
++
++	/* Poll CMD_REPLY_STS_CNT until a response is available */
++	ret = imx500_poll_status_reg(imx500, &cmd_reply_sts_cnt_reg, 5);
++	if (ret) {
++		dev_err(&client->dev, "DD_REF_STS register did not update\n");
++		return ret;
++	}
++
++	/* Read response to state transition / update request */
++	ret = cci_read(imx500->regmap, IMX500_REG_DD_CMD_REPLY_STS, &tmp, NULL);
++	if (ret || tmp != (update ? IMX500_DD_CMD_REPLY_STS_UPDATE_READY :
++				    IMX500_DD_CMD_REPLY_STS_TRANS_READY))
++		return ret ? ret : -EBUSY;
++
++	imx500->fw_stage = type;
++	imx500->fw_progress = 0;
++
++	for (size_t i = 0; i <= valid_size / ONE_MIB; i++) {
++		const u8 *data = fw + (i * ONE_MIB);
++		size_t size = valid_size - (i * ONE_MIB);
++		struct cci_reg_sequence download_sts_reg = {
++			IMX500_REG_DD_DOWNLOAD_STS,
++			IMX500_DD_DOWNLOAD_STS_DOWNLOADING,
++		};
++
++		/* Calculate SPI xfer size avoiding 0-sized TXNs */
++		size = min_t(size_t, size, ONE_MIB);
++		if (!size)
++			break;
++
++		/* Poll until device is ready for download */
++		ret = imx500_poll_status_reg(imx500, &download_sts_reg, 100);
++		if (ret) {
++			dev_err(&client->dev,
++				"DD_DOWNLOAD_STS was never ready\n");
++			return ret;
++		}
++
++		/* Do SPI transfer */
++		gpiod_set_value_cansleep(imx500->led_gpio, 1);
++		ret = imx500_spi_write(imx500, data, size);
++		gpiod_set_value_cansleep(imx500->led_gpio, 0);
++
++		imx500->fw_progress += size;
++
++		if (ret < 0)
++			return ret;
++	}
++
++	/* Poll until another response is available */
++	ret = imx500_poll_status_reg(imx500, &cmd_reply_sts_cnt_reg, 5);
++	if (ret) {
++		dev_err(&client->dev,
++			"DD_REF_STS register did not update after SPI write(s)\n");
++		return ret;
++	}
++
++	/* Verify that state transition / update completed successfully */
++	ret = cci_read(imx500->regmap, IMX500_REG_DD_CMD_REPLY_STS, &tmp, NULL);
++	if (ret || tmp != (update ? IMX500_DD_CMD_REPLY_STS_UPDATE_DONE :
++				    IMX500_DD_CMD_REPLY_STS_TRANS_DONE))
++		return ret ? ret : -EREMOTEIO;
++
++	if (!update && imx500->fsm_state < IMX500_STATE_WITH_NETWORK)
++		imx500->fsm_state++;
++
++	imx500->fw_progress = fw_size;
++
++	return 0;
++}
++
++static int imx500_transition_to_standby_wo_network(struct imx500 *imx500)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx500->sd);
++	const struct firmware *firmware;
++	u64 fw_ver;
++	int ret;
++
++	firmware = imx500->fw_loader;
++	ret = imx500_state_transition(imx500, firmware->data, firmware->size,
++				      TYPE_LOADER, false);
++	if (ret) {
++		dev_err(&client->dev, "%s: failed to load loader firmware\n",
++			__func__);
++		return ret;
++	}
++
++	firmware = imx500->fw_main;
++	ret = imx500_state_transition(imx500, firmware->data, firmware->size,
++				      TYPE_MAIN, false);
++	if (ret) {
++		dev_err(&client->dev, "%s: failed to load main firmware\n",
++			__func__);
++		return ret;
++	}
++
++	ret = cci_read(imx500->regmap, IMX500_REG_MAIN_FW_VERSION, &fw_ver,
++		       NULL);
++	if (ret) {
++		dev_err(&client->dev,
++			"%s: could not read main firmware version\n", __func__);
++		return ret;
++	}
++
++	dev_info(&client->dev,
++		 "main firmware version: %llu%llu.%llu%llu.%llu%llu\n",
++		 (fw_ver >> 20) & 0xF, (fw_ver >> 16) & 0xF,
++		 (fw_ver >> 12) & 0xF, (fw_ver >> 8) & 0xF, (fw_ver >> 4) & 0xF,
++		 fw_ver & 0xF);
++
++	ret = cci_multi_reg_write(imx500->regmap, metadata_output,
++				  ARRAY_SIZE(metadata_output), NULL);
++	if (ret) {
++		dev_err(&client->dev,
++			"%s: failed to configure MIPI output for DNN\n",
++			__func__);
++		return ret;
++	}
++
++	ret = cci_multi_reg_write(imx500->regmap, dnn_regs,
++				  ARRAY_SIZE(dnn_regs), NULL);
++	if (ret) {
++		dev_err(&client->dev, "%s: unable to write DNN regs\n",
++			__func__);
++		return ret;
++	}
++
++	return 0;
++}
++
++static int imx500_transition_to_network(struct imx500 *imx500)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx500->sd);
++	u64 imx500_fsm_state;
++	int ret;
++
++	ret = imx500_iterate_nw_regs(imx500->fw_network,
++				     imx500->fw_network_size, imx500,
++				     imx500_reg_val_write_cbk);
++	if (ret) {
++		dev_err(&client->dev,
++			"%s: unable to apply register writes from firmware\n",
++			__func__);
++		return ret;
++	}
++
++	/* Read IMX500 state to determine whether transition or update is required */
++	ret = cci_read(imx500->regmap, IMX500_REG_DD_SYS_STATE,
++		       &imx500_fsm_state, NULL);
++	if (ret || imx500_fsm_state & 1)
++		return ret ? ret : -EREMOTEIO;
++
++	ret = imx500_state_transition(
++		imx500, imx500->fw_network, imx500->fw_network_size,
++		TYPE_NW_WEIGHTS,
++		imx500_fsm_state == IMX500_DD_SYS_STATE_STANDBY_WITH_NETWORK);
++	if (ret) {
++		dev_err(&client->dev, "%s: failed to load network weights\n",
++			__func__);
++		return ret;
++	}
++
++	/* Select network 0 */
++	ret = cci_write(imx500->regmap, CCI_REG8(0xD701), 0, NULL);
++	if (ret) {
++		dev_err(&client->dev, "%s: failed to select network 0\n",
++			__func__);
++		return ret;
++	}
++
++	return ret;
++}
++
++/* Start streaming */
++static int imx500_start_streaming(struct imx500 *imx500)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx500->sd);
++	const struct imx500_reg_list *reg_list;
++	int ret;
++
++	ret = pm_runtime_resume_and_get(&client->dev);
++	if (ret < 0)
++		return ret;
++
++	ret = cci_write(imx500->regmap, IMX500_REG_IMAGE_ONLY_MODE,
++			imx500->fw_network ? IMX500_IMAGE_ONLY_FALSE :
++					     IMX500_IMAGE_ONLY_TRUE,
++			NULL);
++	if (ret) {
++		dev_err(&client->dev, "%s failed to set image mode\n",
++			__func__);
++		return ret;
++	}
++
++	/* Acquire loader and main firmware if needed */
++	if (imx500->fw_network) {
++		if (!imx500->fw_loader) {
++			ret = request_firmware(&imx500->fw_loader,
++					       "imx500_loader.fpk",
++					       &client->dev);
++			if (ret) {
++				dev_err(&client->dev,
++					"Unable to acquire firmware loader\n");
++				return ret;
++			}
++		}
++		if (!imx500->fw_main) {
++			ret = request_firmware(&imx500->fw_main,
++					       "imx500_firmware.fpk",
++					       &client->dev);
++			if (ret) {
++				dev_err(&client->dev,
++					"Unable to acquire main firmware\n");
++				return ret;
++			}
++		}
++	}
++
++	if (!imx500->common_regs_written) {
++		ret = cci_multi_reg_write(imx500->regmap, mode_common_regs,
++					  ARRAY_SIZE(mode_common_regs), NULL);
++
++		if (ret) {
++			dev_err(&client->dev,
++				"%s failed to set common settings\n", __func__);
++			return ret;
++		}
++
++		imx500->common_regs_written = true;
++	}
++
++	if (imx500->fw_network && !imx500->loader_and_main_written) {
++		ret = imx500_transition_to_standby_wo_network(imx500);
++		if (ret) {
++			dev_err(&client->dev,
++				"%s failed to transition from program empty state\n",
++				__func__);
++			return ret;
++		}
++		imx500->loader_and_main_written = true;
++	}
++
++	if (imx500->fw_network && !imx500->network_written) {
++		ret = imx500_transition_to_network(imx500);
++		if (ret) {
++			dev_err(&client->dev,
++				"%s failed to transition to network loaded\n",
++				__func__);
++			return ret;
++		}
++		imx500->network_written = true;
++	}
++
++	/* Enable DNN */
++	if (imx500->fw_network) {
++		ret = cci_write(imx500->regmap, CCI_REG8(0xD100), 4, NULL);
++		if (ret) {
++			dev_err(&client->dev, "%s failed to enable DNN\n",
++				__func__);
++			return ret;
++		}
++	}
++
++	/* Apply default values of current mode */
++	reg_list = &imx500->mode->reg_list;
++	ret = cci_multi_reg_write(imx500->regmap, reg_list->regs,
++				  reg_list->num_of_regs, NULL);
++	if (ret) {
++		dev_err(&client->dev, "%s failed to set mode\n", __func__);
++		return ret;
++	}
++
++	/* Apply customized values from user */
++	ret = __v4l2_ctrl_handler_setup(imx500->sd.ctrl_handler);
++
++	/* Disable any sensor startup frame drops. This must be written here! */
++	cci_write(imx500->regmap, CCI_REG8(0xD405), 0, &ret);
++
++	/* set stream on register */
++	cci_write(imx500->regmap, IMX500_REG_MODE_SELECT, IMX500_MODE_STREAMING,
++		  &ret);
++
++	return ret;
++}
++
++/* Stop streaming */
++static void imx500_stop_streaming(struct imx500 *imx500)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx500->sd);
++	int ret;
++
++	/* set stream off register */
++	ret = cci_write(imx500->regmap, IMX500_REG_MODE_SELECT,
++			IMX500_MODE_STANDBY, NULL);
++	if (ret)
++		dev_err(&client->dev, "%s failed to set stream\n", __func__);
++
++	/* Disable DNN */
++	ret = cci_write(imx500->regmap, CCI_REG8(0xD100), 0, NULL);
++	if (ret)
++		dev_err(&client->dev, "%s failed to disable DNN\n", __func__);
++
++	pm_runtime_mark_last_busy(&client->dev);
++	pm_runtime_put_autosuspend(&client->dev);
++}
++
++static int imx500_set_stream(struct v4l2_subdev *sd, int enable)
++{
++	struct imx500 *imx500 = to_imx500(sd);
++	int ret = 0;
++
++	mutex_lock(&imx500->mutex);
++	if (imx500->streaming == enable) {
++		mutex_unlock(&imx500->mutex);
++		return 0;
++	}
++
++	if (enable) {
++		/*
++		 * Apply default & customized values
++		 * and then start streaming.
++		 */
++		ret = imx500_start_streaming(imx500);
++		if (ret)
++			goto err_start_streaming;
++	} else {
++		imx500_stop_streaming(imx500);
++	}
++
++	imx500->streaming = enable;
++
++	/* vflip and hflip cannot change during streaming */
++	__v4l2_ctrl_grab(imx500->vflip, enable);
++	__v4l2_ctrl_grab(imx500->hflip, enable);
++	__v4l2_ctrl_grab(imx500->network_fw_ctrl, enable);
++
++	mutex_unlock(&imx500->mutex);
++
++	return ret;
++
++err_start_streaming:
++	mutex_unlock(&imx500->mutex);
++
++	return ret;
++}
++
++/* Power/clock management functions */
++static int imx500_power_on(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx500 *imx500 = to_imx500(sd);
++	int ret;
++
++	ret = regulator_bulk_enable(IMX500_NUM_SUPPLIES, imx500->supplies);
++	if (ret) {
++		dev_err(&client->dev, "%s: failed to enable regulators\n",
++			__func__);
++		return ret;
++	}
++
++	/* T4 - 1us
++	 * Ambiguous: Regulators rising to INCK start is specified by the datasheet
++	 * but also "Presence of INCK during Power off is acceptable"
++	 */
++	udelay(2);
++
++	ret = clk_prepare_enable(imx500->xclk);
++	if (ret) {
++		dev_err(&client->dev, "%s: failed to enable clock\n", __func__);
++		goto reg_off;
++	}
++
++	/* T5 - 0ms
++	 * Ambiguous: Regulators rising to XCLR rising is specified by the datasheet
++	 * as 0ms but also "XCLR pin should be set to 'High' after INCK supplied.".
++	 * T4 and T5 are shown as overlapping.
++	 */
++	gpiod_set_value_cansleep(imx500->reset_gpio, 1);
++
++	/* T7 - 9ms
++	 * "INCK start and CXLR rising till Send Streaming Command wait time"
++	 */
++	usleep_range(9000, 12000);
++
++	return 0;
++
++reg_off:
++	regulator_bulk_disable(IMX500_NUM_SUPPLIES, imx500->supplies);
++	return ret;
++}
++
++static int imx500_power_off(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx500 *imx500 = to_imx500(sd);
++
++	/* Datasheet specifies power down sequence as INCK disable, XCLR low,
++	 * regulator disable.  T1 (XCLR neg-edge to regulator disable) is specified
++	 * as 0us.
++	 *
++	 * Note, this is not the reverse order of power up.
++	 */
++	clk_disable_unprepare(imx500->xclk);
++	gpiod_set_value_cansleep(imx500->reset_gpio, 0);
++	regulator_bulk_disable(IMX500_NUM_SUPPLIES, imx500->supplies);
++
++	/* Force reprogramming of the common registers when powered up again. */
++	imx500->fsm_state = IMX500_STATE_RESET;
++	imx500->common_regs_written = false;
++	imx500->loader_and_main_written = false;
++	imx500_clear_fw_network(imx500);
++
++	return 0;
++}
++
++static int imx500_get_regulators(struct imx500 *imx500)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx500->sd);
++	unsigned int i;
++
++	for (i = 0; i < IMX500_NUM_SUPPLIES; i++)
++		imx500->supplies[i].supply = imx500_supply_name[i];
++
++	return devm_regulator_bulk_get(&client->dev, IMX500_NUM_SUPPLIES,
++				       imx500->supplies);
++}
++
++/* Verify chip ID */
++static int imx500_identify_module(struct imx500 *imx500)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(&imx500->sd);
++	int ret;
++	u64 val;
++
++	ret = cci_read(imx500->regmap, IMX500_REG_CHIP_ID, &val, NULL);
++	if (ret) {
++		dev_err(&client->dev,
++			"failed to read chip id %x, with error %d\n",
++			IMX500_CHIP_ID, ret);
++		return ret;
++	}
++
++	if (val != IMX500_CHIP_ID) {
++		dev_err(&client->dev, "chip id mismatch: %x!=%llx\n",
++			IMX500_CHIP_ID, val);
++		return -EIO;
++	}
++
++	dev_info(&client->dev, "Device found is imx%llx\n", val);
++
++	return 0;
++}
++
++static const struct v4l2_subdev_core_ops imx500_core_ops = {
++	.subscribe_event = v4l2_ctrl_subdev_subscribe_event,
++	.unsubscribe_event = v4l2_event_subdev_unsubscribe,
++};
++
++static const struct v4l2_subdev_video_ops imx500_video_ops = {
++	.s_stream = imx500_set_stream,
++};
++
++static const struct v4l2_subdev_pad_ops imx500_pad_ops = {
++	.enum_mbus_code = imx500_enum_mbus_code,
++	.get_fmt = imx500_get_pad_format,
++	.set_fmt = imx500_set_pad_format,
++	.get_selection = imx500_get_selection,
++	.enum_frame_size = imx500_enum_frame_size,
++};
++
++static const struct v4l2_subdev_ops imx500_subdev_ops = {
++	.core = &imx500_core_ops,
++	.video = &imx500_video_ops,
++	.pad = &imx500_pad_ops,
++};
++
++static const s64 imx500_link_freq_menu[] = {
++	IMX500_DEFAULT_LINK_FREQ,
++};
++
++/* Custom control for inference window */
++static const struct v4l2_ctrl_config inf_window_ctrl = {
++	.name		= "IMX500 Inference Windows",
++	.id		= V4L2_CID_USER_IMX500_INFERENCE_WINDOW,
++	.dims[0]	= 4,
++	.ops		= &imx500_ctrl_ops,
++	.type		= V4L2_CTRL_TYPE_U32,
++	.elem_size	= sizeof(u32),
++	.flags		= V4L2_CTRL_FLAG_EXECUTE_ON_WRITE |
++			  V4L2_CTRL_FLAG_HAS_PAYLOAD,
++	.def		= 0,
++	.min		= 0x00,
++	.max		= 4032,
++	.step		= 1,
++};
++
++/* Custom control for network firmware file FD */
++static const struct v4l2_ctrl_config network_fw_fd = {
++	.name		= "IMX500 Network Firmware File FD",
++	.id		= V4L2_CID_USER_IMX500_NETWORK_FW_FD,
++	.ops		= &imx500_ctrl_ops,
++	.type		= V4L2_CTRL_TYPE_INTEGER,
++	.flags		= V4L2_CTRL_FLAG_EXECUTE_ON_WRITE |
++			  V4L2_CTRL_FLAG_WRITE_ONLY,
++	.min		= -1,
++	.max		= S32_MAX,
++	.step		= 1,
++	.def		= -1,
++};
++
++/* Initialize control handlers */
++static int imx500_init_controls(struct imx500 *imx500)
++{
++	struct v4l2_ctrl_handler *ctrl_hdlr;
++	struct i2c_client *client = v4l2_get_subdevdata(&imx500->sd);
++	struct v4l2_fwnode_device_properties props;
++	int ret;
++
++	ctrl_hdlr = &imx500->ctrl_handler;
++	ret = v4l2_ctrl_handler_init(ctrl_hdlr, 16);
++	if (ret)
++		return ret;
++
++	mutex_init(&imx500->mutex);
++	ctrl_hdlr->lock = &imx500->mutex;
++
++	/* By default, PIXEL_RATE is read only */
++	imx500->pixel_rate = v4l2_ctrl_new_std(
++		ctrl_hdlr, &imx500_ctrl_ops, V4L2_CID_PIXEL_RATE,
++		IMX500_PIXEL_RATE, IMX500_PIXEL_RATE, 1, IMX500_PIXEL_RATE);
++
++	/* LINK_FREQ is also read only */
++	imx500->link_freq =
++		v4l2_ctrl_new_int_menu(ctrl_hdlr, &imx500_ctrl_ops,
++				       V4L2_CID_LINK_FREQ,
++				       ARRAY_SIZE(imx500_link_freq_menu) - 1, 0,
++				       imx500_link_freq_menu);
++	if (imx500->link_freq)
++		imx500->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++
++	/*
++	 * Create the controls here, but mode specific limits are setup
++	 * in the imx500_set_framing_limits() call below.
++	 */
++	imx500->vblank = v4l2_ctrl_new_std(ctrl_hdlr, &imx500_ctrl_ops,
++					   V4L2_CID_VBLANK, IMX500_VBLANK_MIN,
++					   0xffff, 1, IMX500_VBLANK_MIN);
++	imx500->hblank = v4l2_ctrl_new_std(ctrl_hdlr, &imx500_ctrl_ops,
++					   V4L2_CID_HBLANK, 0, 0xffff, 1, 0);
++
++	imx500->exposure = v4l2_ctrl_new_std(
++		ctrl_hdlr, &imx500_ctrl_ops, V4L2_CID_EXPOSURE,
++		IMX500_EXPOSURE_MIN, IMX500_EXPOSURE_MAX, IMX500_EXPOSURE_STEP,
++		IMX500_EXPOSURE_DEFAULT);
++
++	v4l2_ctrl_new_std(ctrl_hdlr, &imx500_ctrl_ops, V4L2_CID_ANALOGUE_GAIN,
++			  IMX500_ANA_GAIN_MIN, IMX500_ANA_GAIN_MAX,
++			  IMX500_ANA_GAIN_STEP, IMX500_ANA_GAIN_DEFAULT);
++
++	imx500->hflip = v4l2_ctrl_new_std(ctrl_hdlr, &imx500_ctrl_ops,
++					  V4L2_CID_HFLIP, 0, 1, 1, 0);
++	if (imx500->hflip)
++		imx500->hflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++
++	imx500->vflip = v4l2_ctrl_new_std(ctrl_hdlr, &imx500_ctrl_ops,
++					  V4L2_CID_VFLIP, 0, 1, 1, 0);
++	if (imx500->vflip)
++		imx500->vflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++
++	v4l2_ctrl_new_custom(ctrl_hdlr, &imx500_notify_gains_ctrl, NULL);
++	v4l2_ctrl_new_custom(ctrl_hdlr, &inf_window_ctrl, NULL);
++	imx500->network_fw_ctrl =
++		v4l2_ctrl_new_custom(ctrl_hdlr, &network_fw_fd, NULL);
++
++	if (ctrl_hdlr->error) {
++		ret = ctrl_hdlr->error;
++		dev_err(&client->dev, "%s control init failed (%d)\n", __func__,
++			ret);
++		goto error;
++	}
++
++	ret = v4l2_fwnode_device_parse(&client->dev, &props);
++	if (ret)
++		goto error;
++
++	ret = v4l2_ctrl_new_fwnode_properties(ctrl_hdlr, &imx500_ctrl_ops,
++					      &props);
++	if (ret)
++		goto error;
++
++	imx500->sd.ctrl_handler = ctrl_hdlr;
++
++	/* Setup exposure and frame/line length limits. */
++	imx500_set_framing_limits(imx500);
++
++	return 0;
++
++error:
++	v4l2_ctrl_handler_free(ctrl_hdlr);
++	mutex_destroy(&imx500->mutex);
++
++	return ret;
++}
++
++static void imx500_free_controls(struct imx500 *imx500)
++{
++	v4l2_ctrl_handler_free(imx500->sd.ctrl_handler);
++	mutex_destroy(&imx500->mutex);
++}
++
++static int imx500_check_hwcfg(struct device *dev)
++{
++	struct fwnode_handle *endpoint;
++	struct v4l2_fwnode_endpoint ep_cfg = { .bus_type =
++						       V4L2_MBUS_CSI2_DPHY };
++	int ret = -EINVAL;
++
++	endpoint = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
++	if (!endpoint) {
++		dev_err(dev, "endpoint node not found\n");
++		return -EINVAL;
++	}
++
++	if (v4l2_fwnode_endpoint_alloc_parse(endpoint, &ep_cfg)) {
++		dev_err(dev, "could not parse endpoint\n");
++		goto error_out;
++	}
++
++	/* Check the number of MIPI CSI2 data lanes */
++	if (ep_cfg.bus.mipi_csi2.num_data_lanes != 2) {
++		dev_err(dev, "only 2 data lanes are currently supported\n");
++		goto error_out;
++	}
++
++	/* Check the link frequency set in device tree */
++	if (!ep_cfg.nr_of_link_frequencies) {
++		dev_err(dev, "link-frequency property not found in DT\n");
++		goto error_out;
++	}
++
++	if (ep_cfg.nr_of_link_frequencies != 1 ||
++	    ep_cfg.link_frequencies[0] != IMX500_DEFAULT_LINK_FREQ) {
++		dev_err(dev, "Link frequency not supported: %lld\n",
++			ep_cfg.link_frequencies[0]);
++		goto error_out;
++	}
++
++	ret = 0;
++
++error_out:
++	v4l2_fwnode_endpoint_free(&ep_cfg);
++	fwnode_handle_put(endpoint);
++
++	return ret;
++}
++
++static int fw_progress_show(struct seq_file *s, void *data)
++{
++	struct imx500 *imx500 = s->private;
++
++	seq_printf(s, "%d %zu %zu\n", imx500->fw_stage, imx500->fw_progress,
++		   imx500->fw_network_size);
++	return 0;
++}
++DEFINE_SHOW_ATTRIBUTE(fw_progress);
++
++static int imx500_probe(struct i2c_client *client)
++{
++	struct device *dev = &client->dev;
++	struct spi_device *spi = NULL;
++	char debugfs_name[128];
++	struct imx500 *imx500;
++	int ret;
++
++	struct device_node *spi_node = of_parse_phandle(dev->of_node, "spi", 0);
++
++	if (spi_node) {
++		struct device *tmp =
++			bus_find_device_by_of_node(&spi_bus_type, spi_node);
++		of_node_put(spi_node);
++		spi = tmp ? to_spi_device(tmp) : NULL;
++		if (!spi)
++			return -EPROBE_DEFER;
++	}
++
++	imx500 = devm_kzalloc(&client->dev, sizeof(*imx500), GFP_KERNEL);
++	if (!imx500)
++		return -ENOMEM;
++
++	imx500->regmap = devm_cci_regmap_init_i2c(client, 16);
++	if (IS_ERR(imx500->regmap))
++		return dev_err_probe(dev, PTR_ERR(imx500->regmap),
++				     "failed to initialise CCI\n");
++
++	imx500->spi_device = spi;
++
++	v4l2_i2c_subdev_init(&imx500->sd, client, &imx500_subdev_ops);
++
++	/* Check the hardware configuration in device tree */
++	if (imx500_check_hwcfg(dev))
++		return -EINVAL;
++
++	/* Get system clock (xclk) */
++	imx500->xclk = devm_clk_get(dev, NULL);
++	if (IS_ERR(imx500->xclk))
++		return dev_err_probe(dev, PTR_ERR(imx500->xclk),
++				     "failed to get xclk\n");
++
++	imx500->xclk_freq = clk_get_rate(imx500->xclk);
++	if (imx500->xclk_freq != IMX500_XCLK_FREQ) {
++		dev_err(dev, "xclk frequency not supported: %d Hz\n",
++			imx500->xclk_freq);
++		return -EINVAL;
++	}
++
++	ret = imx500_get_regulators(imx500);
++	if (ret) {
++		dev_err(dev, "failed to get regulators\n");
++		return ret;
++	}
++
++	imx500->led_gpio = devm_gpiod_get_optional(dev, "led", GPIOD_OUT_LOW);
++
++	imx500->reset_gpio =
++		devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH);
++
++	/*
++	 * The sensor must be powered for imx500_identify_module()
++	 * to be able to read the CHIP_ID register
++	 */
++	ret = imx500_power_on(dev);
++	if (ret)
++		return ret;
++
++	pm_runtime_set_active(dev);
++	pm_runtime_get_noresume(dev);
++	pm_runtime_enable(dev);
++	pm_runtime_set_autosuspend_delay(dev, 5000);
++	pm_runtime_use_autosuspend(dev);
++
++	ret = imx500_identify_module(imx500);
++	if (ret)
++		goto error_power_off;
++
++	/* Initialize default format */
++	imx500_set_default_format(imx500);
++
++	/* This needs the pm runtime to be registered. */
++	ret = imx500_init_controls(imx500);
++	if (ret)
++		goto error_power_off;
++
++	/* Initialize subdev */
++	imx500->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE |
++			    V4L2_SUBDEV_FL_HAS_EVENTS;
++	imx500->sd.entity.function = MEDIA_ENT_F_CAM_SENSOR;
++
++	/* Initialize source pads */
++	imx500->pad[IMAGE_PAD].flags = MEDIA_PAD_FL_SOURCE;
++	imx500->pad[METADATA_PAD].flags = MEDIA_PAD_FL_SOURCE;
++
++	ret = media_entity_pads_init(&imx500->sd.entity, NUM_PADS, imx500->pad);
++	if (ret) {
++		dev_err(dev, "failed to init entity pads: %d\n", ret);
++		goto error_handler_free;
++	}
++
++	ret = v4l2_async_register_subdev_sensor(&imx500->sd);
++	if (ret < 0) {
++		dev_err(dev, "failed to register sensor sub-device: %d\n", ret);
++		goto error_media_entity;
++	}
++
++	snprintf(debugfs_name, sizeof(debugfs_name), "imx500-fw:%s",
++		 dev_name(dev));
++	imx500->debugfs = debugfs_create_dir(debugfs_name, NULL);
++	debugfs_create_file("fw_progress", 0444, imx500->debugfs, imx500,
++			    &fw_progress_fops);
++
++	pm_runtime_mark_last_busy(&client->dev);
++	pm_runtime_put_autosuspend(&client->dev);
++
++	return 0;
++
++error_media_entity:
++	media_entity_cleanup(&imx500->sd.entity);
++
++error_handler_free:
++	imx500_free_controls(imx500);
++
++error_power_off:
++	pm_runtime_disable(&client->dev);
++	pm_runtime_put_noidle(&client->dev);
++	imx500_power_off(&client->dev);
++
++	return ret;
++}
++
++static void imx500_remove(struct i2c_client *client)
++{
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct imx500 *imx500 = to_imx500(sd);
++
++	if (imx500->spi_device)
++		put_device(&imx500->spi_device->dev);
++
++	v4l2_async_unregister_subdev(sd);
++	media_entity_cleanup(&sd->entity);
++	imx500_free_controls(imx500);
++
++	if (imx500->fw_loader)
++		release_firmware(imx500->fw_loader);
++
++	if (imx500->fw_main)
++		release_firmware(imx500->fw_main);
++
++	imx500->fw_loader = NULL;
++	imx500->fw_main = NULL;
++	imx500_clear_fw_network(imx500);
++
++	pm_runtime_disable(&client->dev);
++	if (!pm_runtime_status_suspended(&client->dev))
++		imx500_power_off(&client->dev);
++	pm_runtime_set_suspended(&client->dev);
++}
++
++static const struct of_device_id imx500_dt_ids[] = {
++	{ .compatible = "sony,imx500" },
++	{ /* sentinel */ }
++};
++
++MODULE_DEVICE_TABLE(of, imx500_dt_ids);
++
++static const struct dev_pm_ops imx500_pm_ops = { SET_RUNTIME_PM_OPS(
++	imx500_power_off, imx500_power_on, NULL) };
++
++static struct i2c_driver imx500_i2c_driver = {
++	.driver = {
++		.name = "imx500",
++		.of_match_table	= imx500_dt_ids,
++		.pm = &imx500_pm_ops,
++	},
++	.probe = imx500_probe,
++	.remove = imx500_remove,
++};
++
++static int imx500_spi_probe(struct spi_device *spi)
++{
++	int result;
++
++	spi->bits_per_word = 8;
++	spi->max_speed_hz = 35000000;
++	spi->mode = SPI_MODE_3;
++
++	result = spi_setup(spi);
++	if (result < 0)
++		return dev_err_probe(&spi->dev, result, "spi_setup() failed");
++
++	return 0;
++}
++
++static void imx500_spi_remove(struct spi_device *spi)
++{
++}
++
++static const struct spi_device_id imx500_spi_id[] = {
++	{ "imx500", 0 },
++	{},
++};
++MODULE_DEVICE_TABLE(spi, imx500_spi_id);
++
++static struct spi_driver imx500_spi_driver = {
++	.driver = {
++		.name = "imx500",
++		.of_match_table = imx500_dt_ids,
++	},
++	.probe = imx500_spi_probe,
++	.remove = imx500_spi_remove,
++	.id_table = imx500_spi_id,
++};
++
++static int __init imx500_driver_init(void)
++{
++	int ret;
++
++	ret = spi_register_driver(&imx500_spi_driver);
++	if (ret)
++		return ret;
++
++	ret = i2c_add_driver(&imx500_i2c_driver);
++	if (ret)
++		spi_unregister_driver(&imx500_spi_driver);
++
++	return ret;
++}
++module_init(imx500_driver_init);
++
++static void __exit imx500_driver_exit(void)
++{
++	i2c_del_driver(&imx500_i2c_driver);
++	spi_unregister_driver(&imx500_spi_driver);
++}
++module_exit(imx500_driver_exit);
++
++MODULE_AUTHOR("Naushir Patuck <naush@raspberrypi.com>");
++MODULE_DESCRIPTION("Sony IMX500 sensor driver");
++MODULE_LICENSE("GPL");
+--- a/include/uapi/linux/v4l2-controls.h
++++ b/include/uapi/linux/v4l2-controls.h
+@@ -219,6 +219,12 @@ enum v4l2_colorfx {
+  * We reserve 16 controls for this driver. */
+ #define V4L2_CID_USER_BCM2835_ISP_BASE		(V4L2_CID_USER_BASE + 0x10e0)
+ 
++/*
++ * The base for IMX500 driver controls.
++ * We reserve 16 controls for this driver.
++ */
++#define V4L2_CID_USER_IMX500_BASE		(V4L2_CID_USER_BASE + 0x2000)
++
+ /* MPEG-class control IDs */
+ /* The MPEG controls are applicable to all codec controls
+  * and the 'MPEG' part of the define is historical */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0508-lib-earlycpio-export-symbol-find_cpio_data.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0508-lib-earlycpio-export-symbol-find_cpio_data.patch
new file mode 100644
index 00000000..de0c66a4
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0508-lib-earlycpio-export-symbol-find_cpio_data.patch
@@ -0,0 +1,20 @@
+From e06bbd3f0ba3a8f18da91b4e361aac05ff5b90f2 Mon Sep 17 00:00:00 2001
+From: Richard Oliver <richard.oliver@raspberrypi.com>
+Date: Thu, 20 Jun 2024 09:58:32 +0100
+Subject: [PATCH 508/697] lib: earlycpio: export symbol find_cpio_data()
+
+Add EXPORT_SYMBOL_GPL() for find_cpio_data() so that loadable modules
+may also parse uncompressed cpio.
+
+Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
+---
+ lib/earlycpio.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/lib/earlycpio.c
++++ b/lib/earlycpio.c
+@@ -139,3 +139,4 @@ struct cpio_data find_cpio_data(const ch
+ quit:
+ 	return cd;
+ }
++EXPORT_SYMBOL_GPL(find_cpio_data);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0509-media-i2c-ov5647-Add-control-of-V4L2_CID_HBLANK.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0509-media-i2c-ov5647-Add-control-of-V4L2_CID_HBLANK.patch
new file mode 100644
index 00000000..14fe0dc3
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0509-media-i2c-ov5647-Add-control-of-V4L2_CID_HBLANK.patch
@@ -0,0 +1,126 @@
+From 9baa5b608aba7cf3f4354a1eb822d29816c6858e Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 9 Sep 2024 16:41:12 +0100
+Subject: [PATCH 509/697] media: i2c: ov5647: Add control of V4L2_CID_HBLANK
+
+The driver did expose V4L2_CID_HBLANK, but as a READ_ONLY control.
+
+The sensor only uses the HTS register to control the line length,
+so convert this control to read/write, with the appropriate ranges.
+Adopt the old fixed values as the minimum values permitted in each
+mode to avoid issues of it not streaming.
+
+This should allow exposure times up to ~3 seconds (up from ~1sec).
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/ov5647.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+--- a/drivers/media/i2c/ov5647.c
++++ b/drivers/media/i2c/ov5647.c
+@@ -53,6 +53,8 @@
+ #define OV5647_REG_AEC_AGC		0x3503
+ #define OV5647_REG_GAIN_HI		0x350a
+ #define OV5647_REG_GAIN_LO		0x350b
++#define OV5647_REG_HTS_HI		0x380c
++#define OV5647_REG_HTS_LO		0x380d
+ #define OV5647_REG_VTS_HI		0x380e
+ #define OV5647_REG_VTS_LO		0x380f
+ #define OV5647_REG_VFLIP		0x3820
+@@ -79,6 +81,8 @@
+ #define OV5647_VBLANK_MIN		24
+ #define OV5647_VTS_MAX			32767
+ 
++#define OV5647_HTS_MAX			0x1fff
++
+ #define OV5647_EXPOSURE_MIN		4
+ #define OV5647_EXPOSURE_STEP		1
+ #define OV5647_EXPOSURE_DEFAULT		1000
+@@ -187,8 +191,6 @@ static struct regval_list ov5647_2592x19
+ 	{0x3a19, 0xf8},
+ 	{0x3c01, 0x80},
+ 	{0x3b07, 0x0c},
+-	{0x380c, 0x0b},
+-	{0x380d, 0x1c},
+ 	{0x3814, 0x11},
+ 	{0x3815, 0x11},
+ 	{0x3708, 0x64},
+@@ -276,8 +278,6 @@ static struct regval_list ov5647_1080p30
+ 	{0x3a19, 0xf8},
+ 	{0x3c01, 0x80},
+ 	{0x3b07, 0x0c},
+-	{0x380c, 0x09},
+-	{0x380d, 0x70},
+ 	{0x3814, 0x11},
+ 	{0x3815, 0x11},
+ 	{0x3708, 0x64},
+@@ -375,8 +375,6 @@ static struct regval_list ov5647_2x2binn
+ 	{0x3809, 0x10},
+ 	{0x380a, 0x03},
+ 	{0x380b, 0xcc},
+-	{0x380c, 0x07},
+-	{0x380d, 0x68},
+ 	{0x3811, 0x0c},
+ 	{0x3813, 0x06},
+ 	{0x3814, 0x31},
+@@ -450,8 +448,6 @@ static struct regval_list ov5647_640x480
+ 	{0x3a19, 0xf8},
+ 	{0x3c01, 0x80},
+ 	{0x3b07, 0x0c},
+-	{0x380c, 0x07},
+-	{0x380d, 0x3c},
+ 	{0x3814, 0x35},
+ 	{0x3815, 0x35},
+ 	{0x3708, 0x64},
+@@ -1073,7 +1069,8 @@ static int ov5647_set_pad_fmt(struct v4l
+ 					 mode->pixel_rate, 1, mode->pixel_rate);
+ 
+ 		hblank = mode->hts - mode->format.width;
+-		__v4l2_ctrl_modify_range(sensor->hblank, hblank, hblank, 1,
++		__v4l2_ctrl_modify_range(sensor->hblank, hblank,
++					 OV5647_HTS_MAX - mode->format.width, 1,
+ 					 hblank);
+ 
+ 		vblank = mode->vts - mode->format.height;
+@@ -1337,6 +1334,10 @@ static int ov5647_s_ctrl(struct v4l2_ctr
+ 		ret = ov5647_write16(sd, OV5647_REG_VTS_HI,
+ 				     sensor->mode->format.height + ctrl->val);
+ 		break;
++	case V4L2_CID_HBLANK:
++		ret = ov5647_write16(sd, OV5647_REG_HTS_HI,
++				     sensor->mode->format.width + ctrl->val);
++		break;
+ 	case V4L2_CID_TEST_PATTERN:
+ 		ret = ov5647_write(sd, OV5647_REG_ISPCTRL3D,
+ 				   ov5647_test_pattern_val[ctrl->val]);
+@@ -1344,7 +1345,6 @@ static int ov5647_s_ctrl(struct v4l2_ctr
+ 
+ 	/* Read-only, but we adjust it based on mode. */
+ 	case V4L2_CID_PIXEL_RATE:
+-	case V4L2_CID_HBLANK:
+ 		/* Read-only, but we adjust it based on mode. */
+ 		break;
+ 
+@@ -1421,10 +1421,11 @@ static int ov5647_init_controls(struct o
+ 					       sensor->mode->pixel_rate, 1,
+ 					       sensor->mode->pixel_rate);
+ 
+-	/* By default, HBLANK is read only, but it does change per mode. */
+ 	hblank = sensor->mode->hts - sensor->mode->format.width;
+ 	sensor->hblank = v4l2_ctrl_new_std(&sensor->ctrls, &ov5647_ctrl_ops,
+-					   V4L2_CID_HBLANK, hblank, hblank, 1,
++					   V4L2_CID_HBLANK, hblank,
++					   OV5647_HTS_MAX -
++					   sensor->mode->format.width, 1,
+ 					   hblank);
+ 
+ 	sensor->vblank = v4l2_ctrl_new_std(&sensor->ctrls, &ov5647_ctrl_ops,
+@@ -1458,7 +1459,6 @@ static int ov5647_init_controls(struct o
+ 		goto handler_free;
+ 
+ 	sensor->pixel_rate->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+-	sensor->hblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+ 	sensor->sd.ctrl_handler = &sensor->ctrls;
+ 
+ 	return 0;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0510-drm-panel-ili9881-Correct-symmetry-on-enable-disable.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0510-drm-panel-ili9881-Correct-symmetry-on-enable-disable.patch
new file mode 100644
index 00000000..e78713f1
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0510-drm-panel-ili9881-Correct-symmetry-on-enable-disable.patch
@@ -0,0 +1,35 @@
+From 05957e50503d530abb813623b9d011ad5020b344 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 13 Sep 2024 14:44:08 +0100
+Subject: [PATCH 510/697] drm: panel: ili9881: Correct symmetry on
+ enable/disable return codes
+
+ili9881c_enable is always returning 0.
+
+ili9881c_disable was returning the error code from
+mipi_dsi_dcs_set_display_off.
+If non-zero, the drm_panel framework will leave the panel marked as
+enabled, and not run the enable hook next time around. That isn't
+helpful, particularly as we're expecting unprepare to disable
+resets and regulators.
+
+Change ili9881c_disable to match enable in always returning 0.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/panel/panel-ilitek-ili9881c.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
++++ b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
+@@ -2138,7 +2138,9 @@ static int ili9881c_disable(struct drm_p
+ {
+ 	struct ili9881c *ctx = panel_to_ili9881c(panel);
+ 
+-	return mipi_dsi_dcs_set_display_off(ctx->dsi);
++	mipi_dsi_dcs_set_display_off(ctx->dsi);
++
++	return 0;
+ }
+ 
+ static int ili9881c_unprepare(struct drm_panel *panel)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0511-drm-panel-ili9881-Add-option-to-reconfigure-setup-co.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0511-drm-panel-ili9881-Add-option-to-reconfigure-setup-co.patch
new file mode 100644
index 00000000..920f50f3
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0511-drm-panel-ili9881-Add-option-to-reconfigure-setup-co.patch
@@ -0,0 +1,102 @@
+From 03f1e8dfb1d5a3ef4f507f7153ee6ae7500f51d8 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 18 Sep 2024 16:09:28 +0100
+Subject: [PATCH 511/697] drm: panel: ili9881: Add option to reconfigure setup
+ commands
+
+The driver is typically asking for LP commands, but then tries
+to send set_display_[on|off] from enable/disable when the host
+will be in HS mode.
+It also sends shutdown commands just before it asserts reset and
+disables the regulator, which is rather redundant.
+
+Add an option to configure these two choices from the panel_desc.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/panel/panel-ilitek-ili9881c.c | 32 ++++++++++++++++---
+ 1 file changed, 28 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
++++ b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
+@@ -40,12 +40,19 @@ struct ili9881c_instr {
+ 	} arg;
+ };
+ 
++enum ili9881_desc_flags {
++	ILI9881_FLAGS_NO_SHUTDOWN_CMDS = BIT(0),
++	ILI9881_FLAGS_PANEL_ON_IN_PREPARE = BIT(1),
++	ILI9881_FLAGS_MAX = BIT(31),
++};
++
+ struct ili9881c_desc {
+ 	const struct ili9881c_instr *init;
+ 	const size_t init_length;
+ 	const struct drm_display_mode *mode;
+ 	const unsigned long mode_flags;
+ 	unsigned int lanes;
++	enum ili9881_desc_flags flags;
+ };
+ 
+ struct ili9881c {
+@@ -2120,6 +2127,12 @@ static int ili9881c_prepare(struct drm_p
+ 	if (ret)
+ 		return ret;
+ 
++	if (ctx->desc->flags & ILI9881_FLAGS_PANEL_ON_IN_PREPARE) {
++		msleep(120);
++
++		ret = mipi_dsi_dcs_set_display_on(ctx->dsi);
++	}
++
+ 	return 0;
+ }
+ 
+@@ -2127,9 +2140,11 @@ static int ili9881c_enable(struct drm_pa
+ {
+ 	struct ili9881c *ctx = panel_to_ili9881c(panel);
+ 
+-	msleep(120);
++	if (!(ctx->desc->flags & ILI9881_FLAGS_PANEL_ON_IN_PREPARE)) {
++		msleep(120);
+ 
+-	mipi_dsi_dcs_set_display_on(ctx->dsi);
++		mipi_dsi_dcs_set_display_on(ctx->dsi);
++	}
+ 
+ 	return 0;
+ }
+@@ -2138,7 +2153,8 @@ static int ili9881c_disable(struct drm_p
+ {
+ 	struct ili9881c *ctx = panel_to_ili9881c(panel);
+ 
+-	mipi_dsi_dcs_set_display_off(ctx->dsi);
++	if (!(ctx->desc->flags & ILI9881_FLAGS_PANEL_ON_IN_PREPARE))
++		mipi_dsi_dcs_set_display_off(ctx->dsi);
+ 
+ 	return 0;
+ }
+@@ -2147,7 +2163,13 @@ static int ili9881c_unprepare(struct drm
+ {
+ 	struct ili9881c *ctx = panel_to_ili9881c(panel);
+ 
+-	mipi_dsi_dcs_enter_sleep_mode(ctx->dsi);
++	if (!(ctx->desc->flags & ILI9881_FLAGS_NO_SHUTDOWN_CMDS)) {
++		if (ctx->desc->flags & ILI9881_FLAGS_PANEL_ON_IN_PREPARE)
++			mipi_dsi_dcs_set_display_off(ctx->dsi);
++
++		mipi_dsi_dcs_enter_sleep_mode(ctx->dsi);
++	}
++
+ 	regulator_disable(ctx->power);
+ 	gpiod_set_value_cansleep(ctx->reset, 1);
+ 
+@@ -2510,6 +2532,8 @@ static const struct ili9881c_desc rpi_7i
+ 	.mode = &rpi_7inch_default_mode,
+ 	.mode_flags =  MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_LPM,
+ 	.lanes = 2,
++	.flags = ILI9881_FLAGS_NO_SHUTDOWN_CMDS |
++		 ILI9881_FLAGS_PANEL_ON_IN_PREPARE,
+ };
+ 
+ static const struct of_device_id ili9881c_of_match[] = {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0512-drivers-media-imx500-Enable-LS-correction.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0512-drivers-media-imx500-Enable-LS-correction.patch
new file mode 100644
index 00000000..abf94194
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0512-drivers-media-imx500-Enable-LS-correction.patch
@@ -0,0 +1,408 @@
+From 075977bd1fa51753f9f0d3f69c9b53ae299173d7 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Fri, 11 Oct 2024 12:32:46 +0100
+Subject: [PATCH 512/697] drivers: media: imx500: Enable LS correction
+
+This correction is calibrated to approx 5000K.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/i2c/imx500.c | 387 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 387 insertions(+)
+
+--- a/drivers/media/i2c/imx500.c
++++ b/drivers/media/i2c/imx500.c
+@@ -888,6 +888,393 @@ static const struct cci_reg_sequence dnn
+ 	{ CCI_REG32(0xd950), 0xfb00f7 },
+ 	{ CCI_REG16(0xd954), 0xff },
+ 	{ CCI_REG8(0xd826), 1 },
++	/* LSC */
++	{ CCI_REG32(0xe000), 0x2e502a0 },
++	{ CCI_REG32(0xe004), 0x2c80283 },
++	{ CCI_REG32(0xe008), 0x2700233 },
++	{ CCI_REG32(0xe00c), 0x22d01f6 },
++	{ CCI_REG32(0xe010), 0x1f401c3 },
++	{ CCI_REG32(0xe014), 0x1c5019c },
++	{ CCI_REG32(0xe018), 0x1bb0192 },
++	{ CCI_REG32(0xe01c), 0x1ba0192 },
++	{ CCI_REG32(0xe020), 0x1b90192 },
++	{ CCI_REG32(0xe024), 0x1ba0192 },
++	{ CCI_REG32(0xe028), 0x1ca019f },
++	{ CCI_REG32(0xe02c), 0x1fb01c8 },
++	{ CCI_REG32(0xe030), 0x23601fb },
++	{ CCI_REG32(0xe034), 0x27a0239 },
++	{ CCI_REG32(0xe038), 0x2d5028a },
++	{ CCI_REG32(0xe03c), 0x2f302a8 },
++	{ CCI_REG32(0xe040), 0x2c60283 },
++	{ CCI_REG32(0xe044), 0x27c0240 },
++	{ CCI_REG32(0xe048), 0x22d01f6 },
++	{ CCI_REG32(0xe04c), 0x1fd01cd },
++	{ CCI_REG32(0xe050), 0x1c4019c },
++	{ CCI_REG32(0xe054), 0x19c017b },
++	{ CCI_REG32(0xe058), 0x1810165 },
++	{ CCI_REG32(0xe05c), 0x175015c },
++	{ CCI_REG32(0xe060), 0x175015c },
++	{ CCI_REG32(0xe064), 0x1840167 },
++	{ CCI_REG32(0xe068), 0x1a0017e },
++	{ CCI_REG32(0xe06c), 0x1cc01a1 },
++	{ CCI_REG32(0xe070), 0x20501d1 },
++	{ CCI_REG32(0xe074), 0x23601fc },
++	{ CCI_REG32(0xe078), 0x2890246 },
++	{ CCI_REG32(0xe07c), 0x2d3028a },
++	{ CCI_REG32(0xe080), 0x2800243 },
++	{ CCI_REG32(0xe084), 0x245020e },
++	{ CCI_REG32(0xe088), 0x1ff01ce },
++	{ CCI_REG32(0xe08c), 0x1c4019c },
++	{ CCI_REG32(0xe090), 0x19a017b },
++	{ CCI_REG32(0xe094), 0x1650150 },
++	{ CCI_REG32(0xe098), 0x14a013a },
++	{ CCI_REG32(0xe09c), 0x13f0131 },
++	{ CCI_REG32(0xe0a0), 0x1400131 },
++	{ CCI_REG32(0xe0a4), 0x14d013c },
++	{ CCI_REG32(0xe0a8), 0x16a0154 },
++	{ CCI_REG32(0xe0ac), 0x1a1017e },
++	{ CCI_REG32(0xe0b0), 0x1cc01a1 },
++	{ CCI_REG32(0xe0b4), 0x20801d3 },
++	{ CCI_REG32(0xe0b8), 0x2510214 },
++	{ CCI_REG32(0xe0bc), 0x28b0249 },
++	{ CCI_REG32(0xe0c0), 0x2640229 },
++	{ CCI_REG32(0xe0c4), 0x22101ed },
++	{ CCI_REG32(0xe0c8), 0x1dc01b0 },
++	{ CCI_REG32(0xe0cc), 0x19c017c },
++	{ CCI_REG32(0xe0d0), 0x1650150 },
++	{ CCI_REG32(0xe0d4), 0x148013a },
++	{ CCI_REG32(0xe0d8), 0x123011c },
++	{ CCI_REG32(0xe0dc), 0x1190113 },
++	{ CCI_REG32(0xe0e0), 0x1190113 },
++	{ CCI_REG32(0xe0e4), 0x1280120 },
++	{ CCI_REG32(0xe0e8), 0x14c013c },
++	{ CCI_REG32(0xe0ec), 0x16b0154 },
++	{ CCI_REG32(0xe0f0), 0x1a30181 },
++	{ CCI_REG32(0xe0f4), 0x1e601b6 },
++	{ CCI_REG32(0xe0f8), 0x22c01f3 },
++	{ CCI_REG32(0xe0fc), 0x2700230 },
++	{ CCI_REG32(0xe100), 0x257021d },
++	{ CCI_REG32(0xe104), 0x20901d8 },
++	{ CCI_REG32(0xe108), 0x1c4019d },
++	{ CCI_REG32(0xe10c), 0x1820167 },
++	{ CCI_REG32(0xe110), 0x14b013b },
++	{ CCI_REG32(0xe114), 0x124011c },
++	{ CCI_REG32(0xe118), 0x1170113 },
++	{ CCI_REG32(0xe11c), 0x1010101 },
++	{ CCI_REG32(0xe120), 0x1030102 },
++	{ CCI_REG32(0xe124), 0x1190113 },
++	{ CCI_REG32(0xe128), 0x1280120 },
++	{ CCI_REG32(0xe12c), 0x14f013f },
++	{ CCI_REG32(0xe130), 0x189016c },
++	{ CCI_REG32(0xe134), 0x1ce01a3 },
++	{ CCI_REG32(0xe138), 0x21601df },
++	{ CCI_REG32(0xe13c), 0x2630224 },
++	{ CCI_REG32(0xe140), 0x257021d },
++	{ CCI_REG32(0xe144), 0x20101d0 },
++	{ CCI_REG32(0xe148), 0x1ba0194 },
++	{ CCI_REG32(0xe14c), 0x176015d },
++	{ CCI_REG32(0xe150), 0x13e0132 },
++	{ CCI_REG32(0xe154), 0x1190114 },
++	{ CCI_REG32(0xe158), 0x1010101 },
++	{ CCI_REG32(0xe15c), 0x1000100 },
++	{ CCI_REG32(0xe160), 0x1010100 },
++	{ CCI_REG32(0xe164), 0x1040103 },
++	{ CCI_REG32(0xe168), 0x11d0118 },
++	{ CCI_REG32(0xe16c), 0x1450136 },
++	{ CCI_REG32(0xe170), 0x17d0163 },
++	{ CCI_REG32(0xe174), 0x1c4019a },
++	{ CCI_REG32(0xe178), 0x20d01d6 },
++	{ CCI_REG32(0xe17c), 0x2630224 },
++	{ CCI_REG32(0xe180), 0x257021d },
++	{ CCI_REG32(0xe184), 0x20001d0 },
++	{ CCI_REG32(0xe188), 0x1b90194 },
++	{ CCI_REG32(0xe18c), 0x175015d },
++	{ CCI_REG32(0xe190), 0x13e0132 },
++	{ CCI_REG32(0xe194), 0x1180114 },
++	{ CCI_REG32(0xe198), 0x1040103 },
++	{ CCI_REG32(0xe19c), 0x1000100 },
++	{ CCI_REG32(0xe1a0), 0x1030102 },
++	{ CCI_REG32(0xe1a4), 0x1050103 },
++	{ CCI_REG32(0xe1a8), 0x11d0118 },
++	{ CCI_REG32(0xe1ac), 0x1450136 },
++	{ CCI_REG32(0xe1b0), 0x17d0163 },
++	{ CCI_REG32(0xe1b4), 0x1c4019a },
++	{ CCI_REG32(0xe1b8), 0x20d01d6 },
++	{ CCI_REG32(0xe1bc), 0x2640224 },
++	{ CCI_REG32(0xe1c0), 0x258021f },
++	{ CCI_REG32(0xe1c4), 0x20e01db },
++	{ CCI_REG32(0xe1c8), 0x1c7019f },
++	{ CCI_REG32(0xe1cc), 0x1840169 },
++	{ CCI_REG32(0xe1d0), 0x14d013e },
++	{ CCI_REG32(0xe1d4), 0x1290120 },
++	{ CCI_REG32(0xe1d8), 0x1180114 },
++	{ CCI_REG32(0xe1dc), 0x1050103 },
++	{ CCI_REG32(0xe1e0), 0x1050103 },
++	{ CCI_REG32(0xe1e4), 0x11e0117 },
++	{ CCI_REG32(0xe1e8), 0x12c0123 },
++	{ CCI_REG32(0xe1ec), 0x1530142 },
++	{ CCI_REG32(0xe1f0), 0x18d016f },
++	{ CCI_REG32(0xe1f4), 0x1d201a6 },
++	{ CCI_REG32(0xe1f8), 0x21a01e2 },
++	{ CCI_REG32(0xe1fc), 0x2640225 },
++	{ CCI_REG32(0xe200), 0x269022d },
++	{ CCI_REG32(0xe204), 0x22601f1 },
++	{ CCI_REG32(0xe208), 0x1e101b4 },
++	{ CCI_REG32(0xe20c), 0x1a10181 },
++	{ CCI_REG32(0xe210), 0x16c0156 },
++	{ CCI_REG32(0xe214), 0x14d013e },
++	{ CCI_REG32(0xe218), 0x1290120 },
++	{ CCI_REG32(0xe21c), 0x11f0118 },
++	{ CCI_REG32(0xe220), 0x11f0118 },
++	{ CCI_REG32(0xe224), 0x12b0123 },
++	{ CCI_REG32(0xe228), 0x1530142 },
++	{ CCI_REG32(0xe22c), 0x172015a },
++	{ CCI_REG32(0xe230), 0x1aa0187 },
++	{ CCI_REG32(0xe234), 0x1ec01bb },
++	{ CCI_REG32(0xe238), 0x23301f8 },
++	{ CCI_REG32(0xe23c), 0x2750233 },
++	{ CCI_REG32(0xe240), 0x28b024c },
++	{ CCI_REG32(0xe244), 0x24f0216 },
++	{ CCI_REG32(0xe248), 0x20701d4 },
++	{ CCI_REG32(0xe24c), 0x1ce01a4 },
++	{ CCI_REG32(0xe250), 0x1a10181 },
++	{ CCI_REG32(0xe254), 0x16c0156 },
++	{ CCI_REG32(0xe258), 0x1520141 },
++	{ CCI_REG32(0xe25c), 0x1480138 },
++	{ CCI_REG32(0xe260), 0x1480138 },
++	{ CCI_REG32(0xe264), 0x1550143 },
++	{ CCI_REG32(0xe268), 0x172015a },
++	{ CCI_REG32(0xe26c), 0x1aa0187 },
++	{ CCI_REG32(0xe270), 0x1d701a9 },
++	{ CCI_REG32(0xe274), 0x21201db },
++	{ CCI_REG32(0xe278), 0x25d021d },
++	{ CCI_REG32(0xe27c), 0x2990254 },
++	{ CCI_REG32(0xe280), 0x2d70291 },
++	{ CCI_REG32(0xe284), 0x28c024c },
++	{ CCI_REG32(0xe288), 0x2390201 },
++	{ CCI_REG32(0xe28c), 0x20701d4 },
++	{ CCI_REG32(0xe290), 0x1ce01a4 },
++	{ CCI_REG32(0xe294), 0x1a70184 },
++	{ CCI_REG32(0xe298), 0x18c016e },
++	{ CCI_REG32(0xe29c), 0x1810164 },
++	{ CCI_REG32(0xe2a0), 0x1810164 },
++	{ CCI_REG32(0xe2a4), 0x1900170 },
++	{ CCI_REG32(0xe2a8), 0x1ad0188 },
++	{ CCI_REG32(0xe2ac), 0x1d601a9 },
++	{ CCI_REG32(0xe2b0), 0x21201da },
++	{ CCI_REG32(0xe2b4), 0x2450207 },
++	{ CCI_REG32(0xe2b8), 0x29a0254 },
++	{ CCI_REG32(0xe2bc), 0x2ea029d },
++	{ CCI_REG32(0xe2c0), 0x2f602ae },
++	{ CCI_REG32(0xe2c4), 0x2d80291 },
++	{ CCI_REG32(0xe2c8), 0x280023f },
++	{ CCI_REG32(0xe2cc), 0x2390200 },
++	{ CCI_REG32(0xe2d0), 0x1fe01cc },
++	{ CCI_REG32(0xe2d4), 0x1d201a4 },
++	{ CCI_REG32(0xe2d8), 0x1c6019b },
++	{ CCI_REG32(0xe2dc), 0x1c6019b },
++	{ CCI_REG32(0xe2e0), 0x1c6019b },
++	{ CCI_REG32(0xe2e4), 0x1c8019b },
++	{ CCI_REG32(0xe2e8), 0x1d701a9 },
++	{ CCI_REG32(0xe2ec), 0x20801d1 },
++	{ CCI_REG32(0xe2f0), 0x2450206 },
++	{ CCI_REG32(0xe2f4), 0x28e0248 },
++	{ CCI_REG32(0xe2f8), 0x2ec029d },
++	{ CCI_REG32(0xe2fc), 0x30902b9 },
++	{ CCI_REG32(0xe300), 0x2a002a4 },
++	{ CCI_REG32(0xe304), 0x2830286 },
++	{ CCI_REG32(0xe308), 0x2330234 },
++	{ CCI_REG32(0xe30c), 0x1f601f7 },
++	{ CCI_REG32(0xe310), 0x1c301c4 },
++	{ CCI_REG32(0xe314), 0x19c019c },
++	{ CCI_REG32(0xe318), 0x1920193 },
++	{ CCI_REG32(0xe31c), 0x1920193 },
++	{ CCI_REG32(0xe320), 0x1920192 },
++	{ CCI_REG32(0xe324), 0x1920193 },
++	{ CCI_REG32(0xe328), 0x19f01a1 },
++	{ CCI_REG32(0xe32c), 0x1c801ca },
++	{ CCI_REG32(0xe330), 0x1fb01fe },
++	{ CCI_REG32(0xe334), 0x239023e },
++	{ CCI_REG32(0xe338), 0x28a0292 },
++	{ CCI_REG32(0xe33c), 0x2a802b0 },
++	{ CCI_REG32(0xe340), 0x2830287 },
++	{ CCI_REG32(0xe344), 0x2400242 },
++	{ CCI_REG32(0xe348), 0x1f601f8 },
++	{ CCI_REG32(0xe34c), 0x1cd01ce },
++	{ CCI_REG32(0xe350), 0x19c019d },
++	{ CCI_REG32(0xe354), 0x17b017d },
++	{ CCI_REG32(0xe358), 0x1650166 },
++	{ CCI_REG32(0xe35c), 0x15c015d },
++	{ CCI_REG32(0xe360), 0x15c015d },
++	{ CCI_REG32(0xe364), 0x1670168 },
++	{ CCI_REG32(0xe368), 0x17e0180 },
++	{ CCI_REG32(0xe36c), 0x1a101a3 },
++	{ CCI_REG32(0xe370), 0x1d101d3 },
++	{ CCI_REG32(0xe374), 0x1fc0200 },
++	{ CCI_REG32(0xe378), 0x246024c },
++	{ CCI_REG32(0xe37c), 0x28a0291 },
++	{ CCI_REG32(0xe380), 0x2430245 },
++	{ CCI_REG32(0xe384), 0x20e0211 },
++	{ CCI_REG32(0xe388), 0x1ce01d0 },
++	{ CCI_REG32(0xe38c), 0x19c019e },
++	{ CCI_REG32(0xe390), 0x17b017c },
++	{ CCI_REG32(0xe394), 0x1500152 },
++	{ CCI_REG32(0xe398), 0x13a013c },
++	{ CCI_REG32(0xe39c), 0x1310134 },
++	{ CCI_REG32(0xe3a0), 0x1310134 },
++	{ CCI_REG32(0xe3a4), 0x13c013f },
++	{ CCI_REG32(0xe3a8), 0x1540156 },
++	{ CCI_REG32(0xe3ac), 0x17e0180 },
++	{ CCI_REG32(0xe3b0), 0x1a101a4 },
++	{ CCI_REG32(0xe3b4), 0x1d301d8 },
++	{ CCI_REG32(0xe3b8), 0x2140219 },
++	{ CCI_REG32(0xe3bc), 0x249024e },
++	{ CCI_REG32(0xe3c0), 0x229022b },
++	{ CCI_REG32(0xe3c4), 0x1ed01ef },
++	{ CCI_REG32(0xe3c8), 0x1b001b2 },
++	{ CCI_REG32(0xe3cc), 0x17c017e },
++	{ CCI_REG32(0xe3d0), 0x1500151 },
++	{ CCI_REG32(0xe3d4), 0x13a013c },
++	{ CCI_REG32(0xe3d8), 0x11c011f },
++	{ CCI_REG32(0xe3dc), 0x1130117 },
++	{ CCI_REG32(0xe3e0), 0x1130117 },
++	{ CCI_REG32(0xe3e4), 0x1200123 },
++	{ CCI_REG32(0xe3e8), 0x13c013f },
++	{ CCI_REG32(0xe3ec), 0x1540156 },
++	{ CCI_REG32(0xe3f0), 0x1810183 },
++	{ CCI_REG32(0xe3f4), 0x1b601ba },
++	{ CCI_REG32(0xe3f8), 0x1f301f6 },
++	{ CCI_REG32(0xe3fc), 0x2300234 },
++	{ CCI_REG32(0xe400), 0x21d0221 },
++	{ CCI_REG32(0xe404), 0x1d801db },
++	{ CCI_REG32(0xe408), 0x19d019f },
++	{ CCI_REG32(0xe40c), 0x1670169 },
++	{ CCI_REG32(0xe410), 0x13b013d },
++	{ CCI_REG32(0xe414), 0x11c011f },
++	{ CCI_REG32(0xe418), 0x1130117 },
++	{ CCI_REG32(0xe41c), 0x1010106 },
++	{ CCI_REG32(0xe420), 0x1020108 },
++	{ CCI_REG32(0xe424), 0x1130117 },
++	{ CCI_REG32(0xe428), 0x1200123 },
++	{ CCI_REG32(0xe42c), 0x13f0142 },
++	{ CCI_REG32(0xe430), 0x16c016f },
++	{ CCI_REG32(0xe434), 0x1a301a6 },
++	{ CCI_REG32(0xe438), 0x1df01e2 },
++	{ CCI_REG32(0xe43c), 0x2240228 },
++	{ CCI_REG32(0xe440), 0x21d0220 },
++	{ CCI_REG32(0xe444), 0x1d001d3 },
++	{ CCI_REG32(0xe448), 0x1940196 },
++	{ CCI_REG32(0xe44c), 0x15d0160 },
++	{ CCI_REG32(0xe450), 0x1320135 },
++	{ CCI_REG32(0xe454), 0x1140118 },
++	{ CCI_REG32(0xe458), 0x1010106 },
++	{ CCI_REG32(0xe45c), 0x1000106 },
++	{ CCI_REG32(0xe460), 0x1000106 },
++	{ CCI_REG32(0xe464), 0x1030109 },
++	{ CCI_REG32(0xe468), 0x118011b },
++	{ CCI_REG32(0xe46c), 0x136013a },
++	{ CCI_REG32(0xe470), 0x1630165 },
++	{ CCI_REG32(0xe474), 0x19a019c },
++	{ CCI_REG32(0xe478), 0x1d601d9 },
++	{ CCI_REG32(0xe47c), 0x2240227 },
++	{ CCI_REG32(0xe480), 0x21d0220 },
++	{ CCI_REG32(0xe484), 0x1d001d3 },
++	{ CCI_REG32(0xe488), 0x1940196 },
++	{ CCI_REG32(0xe48c), 0x15d0160 },
++	{ CCI_REG32(0xe490), 0x1320135 },
++	{ CCI_REG32(0xe494), 0x1140118 },
++	{ CCI_REG32(0xe498), 0x1030109 },
++	{ CCI_REG32(0xe49c), 0x1000106 },
++	{ CCI_REG32(0xe4a0), 0x1020108 },
++	{ CCI_REG32(0xe4a4), 0x1030109 },
++	{ CCI_REG32(0xe4a8), 0x118011b },
++	{ CCI_REG32(0xe4ac), 0x1360139 },
++	{ CCI_REG32(0xe4b0), 0x1630165 },
++	{ CCI_REG32(0xe4b4), 0x19a019c },
++	{ CCI_REG32(0xe4b8), 0x1d601d9 },
++	{ CCI_REG32(0xe4bc), 0x2240227 },
++	{ CCI_REG32(0xe4c0), 0x21f0221 },
++	{ CCI_REG32(0xe4c4), 0x1db01de },
++	{ CCI_REG32(0xe4c8), 0x19f01a2 },
++	{ CCI_REG32(0xe4cc), 0x169016c },
++	{ CCI_REG32(0xe4d0), 0x13e0141 },
++	{ CCI_REG32(0xe4d4), 0x1200124 },
++	{ CCI_REG32(0xe4d8), 0x1140119 },
++	{ CCI_REG32(0xe4dc), 0x1030109 },
++	{ CCI_REG32(0xe4e0), 0x1030109 },
++	{ CCI_REG32(0xe4e4), 0x117011c },
++	{ CCI_REG32(0xe4e8), 0x1230126 },
++	{ CCI_REG32(0xe4ec), 0x1420145 },
++	{ CCI_REG32(0xe4f0), 0x16f0171 },
++	{ CCI_REG32(0xe4f4), 0x1a601a8 },
++	{ CCI_REG32(0xe4f8), 0x1e201e4 },
++	{ CCI_REG32(0xe4fc), 0x2250227 },
++	{ CCI_REG32(0xe500), 0x22d0231 },
++	{ CCI_REG32(0xe504), 0x1f101f4 },
++	{ CCI_REG32(0xe508), 0x1b401b7 },
++	{ CCI_REG32(0xe50c), 0x1810183 },
++	{ CCI_REG32(0xe510), 0x1560159 },
++	{ CCI_REG32(0xe514), 0x13e0141 },
++	{ CCI_REG32(0xe518), 0x1200124 },
++	{ CCI_REG32(0xe51c), 0x118011c },
++	{ CCI_REG32(0xe520), 0x118011c },
++	{ CCI_REG32(0xe524), 0x1230126 },
++	{ CCI_REG32(0xe528), 0x1420145 },
++	{ CCI_REG32(0xe52c), 0x15a015c },
++	{ CCI_REG32(0xe530), 0x1870188 },
++	{ CCI_REG32(0xe534), 0x1bb01bd },
++	{ CCI_REG32(0xe538), 0x1f801fb },
++	{ CCI_REG32(0xe53c), 0x2330236 },
++	{ CCI_REG32(0xe540), 0x24c0250 },
++	{ CCI_REG32(0xe544), 0x2160219 },
++	{ CCI_REG32(0xe548), 0x1d401d7 },
++	{ CCI_REG32(0xe54c), 0x1a401a6 },
++	{ CCI_REG32(0xe550), 0x1810183 },
++	{ CCI_REG32(0xe554), 0x1560158 },
++	{ CCI_REG32(0xe558), 0x1410144 },
++	{ CCI_REG32(0xe55c), 0x138013b },
++	{ CCI_REG32(0xe560), 0x138013b },
++	{ CCI_REG32(0xe564), 0x1430146 },
++	{ CCI_REG32(0xe568), 0x15a015c },
++	{ CCI_REG32(0xe56c), 0x1870188 },
++	{ CCI_REG32(0xe570), 0x1a901ab },
++	{ CCI_REG32(0xe574), 0x1db01dd },
++	{ CCI_REG32(0xe578), 0x21d0221 },
++	{ CCI_REG32(0xe57c), 0x2540259 },
++	{ CCI_REG32(0xe580), 0x2910296 },
++	{ CCI_REG32(0xe584), 0x24c0251 },
++	{ CCI_REG32(0xe588), 0x2010204 },
++	{ CCI_REG32(0xe58c), 0x1d401d6 },
++	{ CCI_REG32(0xe590), 0x1a401a5 },
++	{ CCI_REG32(0xe594), 0x1840186 },
++	{ CCI_REG32(0xe598), 0x16e0170 },
++	{ CCI_REG32(0xe59c), 0x1640167 },
++	{ CCI_REG32(0xe5a0), 0x1640167 },
++	{ CCI_REG32(0xe5a4), 0x1700173 },
++	{ CCI_REG32(0xe5a8), 0x188018a },
++	{ CCI_REG32(0xe5ac), 0x1a901ab },
++	{ CCI_REG32(0xe5b0), 0x1da01dd },
++	{ CCI_REG32(0xe5b4), 0x207020a },
++	{ CCI_REG32(0xe5b8), 0x2540259 },
++	{ CCI_REG32(0xe5bc), 0x29d02a3 },
++	{ CCI_REG32(0xe5c0), 0x2ae02b4 },
++	{ CCI_REG32(0xe5c4), 0x2910297 },
++	{ CCI_REG32(0xe5c8), 0x23f0243 },
++	{ CCI_REG32(0xe5cc), 0x2000201 },
++	{ CCI_REG32(0xe5d0), 0x1cc01cd },
++	{ CCI_REG32(0xe5d4), 0x1a401a6 },
++	{ CCI_REG32(0xe5d8), 0x19b019d },
++	{ CCI_REG32(0xe5dc), 0x19b019d },
++	{ CCI_REG32(0xe5e0), 0x19b019d },
++	{ CCI_REG32(0xe5e4), 0x19b019e },
++	{ CCI_REG32(0xe5e8), 0x1a901ab },
++	{ CCI_REG32(0xe5ec), 0x1d101d3 },
++	{ CCI_REG32(0xe5f0), 0x2060209 },
++	{ CCI_REG32(0xe5f4), 0x248024b },
++	{ CCI_REG32(0xe5f8), 0x29d02a3 },
++	{ CCI_REG32(0xe5fc), 0x2b902c0 },
++	{ CCI_REG8(0xd822), 0x01 },
++	{ CCI_REG8(0xd823), 0x0f },
+ };
+ 
+ /* Mode configs */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0513-NotForUpstream-media-video-mux-Propagate-controls-to.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0513-NotForUpstream-media-video-mux-Propagate-controls-to.patch
new file mode 100644
index 00000000..7b4e49c1
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0513-NotForUpstream-media-video-mux-Propagate-controls-to.patch
@@ -0,0 +1,51 @@
+From 7de8cd80f6abaaa182d6b61c0711879575e92eed Mon Sep 17 00:00:00 2001
+From: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Date: Thu, 10 Oct 2024 14:52:52 +0100
+Subject: [PATCH 513/697] NotForUpstream: media: video-mux: Propagate controls
+ to source
+
+The i.MX8MP makes calls on it's source device to determine
+the link-frequency that should be configured on the CSI2 receiver.
+
+When the source is behind a video mux, we need to pass this call through
+to the connected device.
+
+Map the control handler of the source device to the video-mux,
+essentially proxying all controls on the mux to the device which has
+it's link enabled.
+
+Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+---
+ drivers/media/platform/video-mux.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/media/platform/video-mux.c
++++ b/drivers/media/platform/video-mux.c
+@@ -69,6 +69,7 @@ static int video_mux_link_setup(struct m
+ 				const struct media_pad *remote, u32 flags)
+ {
+ 	struct v4l2_subdev *sd = media_entity_to_v4l2_subdev(entity);
++	struct v4l2_subdev *source_sd;
+ 	struct video_mux *vmux = v4l2_subdev_to_video_mux(sd);
+ 	u16 source_pad = entity->num_pads - 1;
+ 	int ret = 0;
+@@ -111,6 +112,10 @@ static int video_mux_link_setup(struct m
+ 		*source_mbusformat = *v4l2_subdev_state_get_format(sd_state,
+ 								   vmux->active);
+ 		v4l2_subdev_unlock_state(sd_state);
++
++		source_sd = media_entity_to_v4l2_subdev(remote->entity);
++		vmux->subdev.ctrl_handler = source_sd->ctrl_handler;
++
+ 	} else {
+ 		if (vmux->active != local->index)
+ 			goto out;
+@@ -118,6 +123,8 @@ static int video_mux_link_setup(struct m
+ 		dev_dbg(sd->dev, "going inactive\n");
+ 		mux_control_deselect(vmux->mux);
+ 		vmux->active = -1;
++
++		vmux->subdev.ctrl_handler = NULL;
+ 	}
+ 
+ out:
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0514-media-platform-video-mux-Fix-mutex-locking.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0514-media-platform-video-mux-Fix-mutex-locking.patch
new file mode 100644
index 00000000..d3926d83
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0514-media-platform-video-mux-Fix-mutex-locking.patch
@@ -0,0 +1,59 @@
+From 6490c816e38f19227f9ad5f906203091e29727e4 Mon Sep 17 00:00:00 2001
+From: Paul Elder <paul.elder@ideasonboard.com>
+Date: Thu, 10 Oct 2024 14:52:53 +0100
+Subject: [PATCH 514/697] media: platform: video-mux: Fix mutex locking
+
+The current order of locking between the driver mutex and the v4l2
+subdev state lock causes a circuluar locking dependency when trying to
+set up a link. Fix this.
+
+Signed-off-by: Paul Elder <paul.elder@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+---
+ drivers/media/platform/video-mux.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/platform/video-mux.c
++++ b/drivers/media/platform/video-mux.c
+@@ -70,6 +70,7 @@ static int video_mux_link_setup(struct m
+ {
+ 	struct v4l2_subdev *sd = media_entity_to_v4l2_subdev(entity);
+ 	struct v4l2_subdev *source_sd;
++	struct v4l2_subdev_state *sd_state;
+ 	struct video_mux *vmux = v4l2_subdev_to_video_mux(sd);
+ 	u16 source_pad = entity->num_pads - 1;
+ 	int ret = 0;
+@@ -85,10 +86,10 @@ static int video_mux_link_setup(struct m
+ 		remote->entity->name, remote->index, local->entity->name,
+ 		local->index, flags & MEDIA_LNK_FL_ENABLED);
+ 
++	sd_state = v4l2_subdev_lock_and_get_active_state(sd);
+ 	mutex_lock(&vmux->lock);
+ 
+ 	if (flags & MEDIA_LNK_FL_ENABLED) {
+-		struct v4l2_subdev_state *sd_state;
+ 		struct v4l2_mbus_framefmt *source_mbusformat;
+ 
+ 		if (vmux->active == local->index)
+@@ -106,12 +107,10 @@ static int video_mux_link_setup(struct m
+ 		vmux->active = local->index;
+ 
+ 		/* Propagate the active format to the source */
+-		sd_state = v4l2_subdev_lock_and_get_active_state(sd);
+ 		source_mbusformat = v4l2_subdev_state_get_format(sd_state,
+ 								 source_pad);
+ 		*source_mbusformat = *v4l2_subdev_state_get_format(sd_state,
+ 								   vmux->active);
+-		v4l2_subdev_unlock_state(sd_state);
+ 
+ 		source_sd = media_entity_to_v4l2_subdev(remote->entity);
+ 		vmux->subdev.ctrl_handler = source_sd->ctrl_handler;
+@@ -129,6 +128,7 @@ static int video_mux_link_setup(struct m
+ 
+ out:
+ 	mutex_unlock(&vmux->lock);
++	v4l2_subdev_unlock_state(sd_state);
+ 	return ret;
+ }
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0515-media-i2c-ov5647-Tidy-up-mode-registers-to-make-the-.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0515-media-i2c-ov5647-Tidy-up-mode-registers-to-make-the-.patch
new file mode 100644
index 00000000..56b1130e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0515-media-i2c-ov5647-Tidy-up-mode-registers-to-make-the-.patch
@@ -0,0 +1,94 @@
+From c138bf6b295882bd2bd485e9e36978bb885156c5 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 15 Oct 2024 16:05:57 +0100
+Subject: [PATCH 515/697] media: i2c: ov5647: Tidy up mode registers to make
+ the order common
+
+To make comparisons of the mode registers easier, put the registers
+for the binned and VGA modes in the same order as the others.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/ov5647.c | 33 ++++++++++++++-------------------
+ 1 file changed, 14 insertions(+), 19 deletions(-)
+
+--- a/drivers/media/i2c/ov5647.c
++++ b/drivers/media/i2c/ov5647.c
+@@ -343,6 +343,8 @@ static struct regval_list ov5647_2x2binn
+ 	{0x3036, 0x62},
+ 	{0x303c, 0x11},
+ 	{0x3106, 0xf5},
++	{0x3821, 0x01},
++	{0x3820, 0x41},
+ 	{0x3827, 0xec},
+ 	{0x370c, 0x03},
+ 	{0x3612, 0x59},
+@@ -415,8 +417,6 @@ static struct regval_list ov5647_2x2binn
+ 	{0x4837, 0x16},
+ 	{0x4800, 0x24},
+ 	{0x3503, 0x03},
+-	{0x3820, 0x41},
+-	{0x3821, 0x01},
+ 	{0x350a, 0x00},
+ 	{0x350b, 0x10},
+ 	{0x3500, 0x00},
+@@ -429,20 +429,27 @@ static struct regval_list ov5647_2x2binn
+ static struct regval_list ov5647_640x480_10bpp[] = {
+ 	{0x0100, 0x00},
+ 	{0x0103, 0x01},
+-	{0x3035, 0x11},
++	{0x3034, 0x1a},
++	{0x3035, 0x21},
+ 	{0x3036, 0x46},
+ 	{0x303c, 0x11},
++	{0x3106, 0xf5},
+ 	{0x3821, 0x01},
+ 	{0x3820, 0x41},
++	{0x3827, 0xec},
+ 	{0x370c, 0x03},
+ 	{0x3612, 0x59},
+ 	{0x3618, 0x00},
+ 	{0x5000, 0x06},
+ 	{0x5003, 0x08},
+ 	{0x5a00, 0x08},
+-	{0x3000, 0xff},
+-	{0x3001, 0xff},
+-	{0x3002, 0xff},
++	{0x3000, 0x00},
++	{0x3001, 0x00},
++	{0x3002, 0x00},
++	{0x3016, 0x08},
++	{0x3017, 0xe0},
++	{0x3018, 0x44},
++	{0x301c, 0xf8},
+ 	{0x301d, 0xf0},
+ 	{0x3a18, 0x00},
+ 	{0x3a19, 0xf8},
+@@ -468,6 +475,7 @@ static struct regval_list ov5647_640x480
+ 	{0x3632, 0xe2},
+ 	{0x3633, 0x23},
+ 	{0x3634, 0x44},
++	{0x3636, 0x06},
+ 	{0x3620, 0x64},
+ 	{0x3621, 0xe0},
+ 	{0x3600, 0x37},
+@@ -496,19 +504,6 @@ static struct regval_list ov5647_640x480
+ 	{0x4001, 0x02},
+ 	{0x4004, 0x02},
+ 	{0x4000, 0x09},
+-	{0x3000, 0x00},
+-	{0x3001, 0x00},
+-	{0x3002, 0x00},
+-	{0x3017, 0xe0},
+-	{0x301c, 0xfc},
+-	{0x3636, 0x06},
+-	{0x3016, 0x08},
+-	{0x3827, 0xec},
+-	{0x3018, 0x44},
+-	{0x3035, 0x21},
+-	{0x3106, 0xf5},
+-	{0x3034, 0x1a},
+-	{0x301c, 0xf8},
+ 	{0x4800, 0x34},
+ 	{0x3503, 0x03},
+ 	{0x0100, 0x01},
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0516-media-i2c-ov5647-Separate-out-the-common-registers.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0516-media-i2c-ov5647-Separate-out-the-common-registers.patch
new file mode 100644
index 00000000..d4f5599d
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0516-media-i2c-ov5647-Separate-out-the-common-registers.patch
@@ -0,0 +1,392 @@
+From bd7c083cd7c5925a98b3b5466d693463c618eb5c Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 15 Oct 2024 17:02:39 +0100
+Subject: [PATCH 516/697] media: i2c: ov5647: Separate out the common
+ registers.
+
+There are many registers in common between all the modes.
+Pull those out into one common table.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/ov5647.c | 243 ++++++++-----------------------------
+ 1 file changed, 50 insertions(+), 193 deletions(-)
+
+--- a/drivers/media/i2c/ov5647.c
++++ b/drivers/media/i2c/ov5647.c
+@@ -161,22 +161,16 @@ static const struct regval_list sensor_o
+ 	{0x3002, 0xe4},
+ };
+ 
+-static struct regval_list ov5647_2592x1944_10bpp[] = {
++static struct regval_list ov5647_common_regs[] = {
+ 	{0x0100, 0x00},
+ 	{0x0103, 0x01},
+ 	{0x3034, 0x1a},
+ 	{0x3035, 0x21},
+-	{0x3036, 0x69},
+ 	{0x303c, 0x11},
+ 	{0x3106, 0xf5},
+-	{0x3821, 0x00},
+-	{0x3820, 0x00},
+ 	{0x3827, 0xec},
+ 	{0x370c, 0x03},
+-	{0x3612, 0x5b},
+-	{0x3618, 0x04},
+ 	{0x5000, 0x06},
+-	{0x5002, 0x41},
+ 	{0x5003, 0x08},
+ 	{0x5a00, 0x08},
+ 	{0x3000, 0x00},
+@@ -191,24 +185,6 @@ static struct regval_list ov5647_2592x19
+ 	{0x3a19, 0xf8},
+ 	{0x3c01, 0x80},
+ 	{0x3b07, 0x0c},
+-	{0x3814, 0x11},
+-	{0x3815, 0x11},
+-	{0x3708, 0x64},
+-	{0x3709, 0x12},
+-	{0x3808, 0x0a},
+-	{0x3809, 0x20},
+-	{0x380a, 0x07},
+-	{0x380b, 0x98},
+-	{0x3800, 0x00},
+-	{0x3801, 0x00},
+-	{0x3802, 0x00},
+-	{0x3803, 0x00},
+-	{0x3804, 0x0a},
+-	{0x3805, 0x3f},
+-	{0x3806, 0x07},
+-	{0x3807, 0xa3},
+-	{0x3811, 0x10},
+-	{0x3813, 0x06},
+ 	{0x3630, 0x2e},
+ 	{0x3632, 0xe2},
+ 	{0x3633, 0x23},
+@@ -228,11 +204,6 @@ static struct regval_list ov5647_2592x19
+ 	{0x3f06, 0x10},
+ 	{0x3f01, 0x0a},
+ 	{0x3a08, 0x01},
+-	{0x3a09, 0x28},
+-	{0x3a0a, 0x00},
+-	{0x3a0b, 0xf6},
+-	{0x3a0d, 0x08},
+-	{0x3a0e, 0x06},
+ 	{0x3a0f, 0x58},
+ 	{0x3a10, 0x50},
+ 	{0x3a1b, 0x58},
+@@ -240,52 +211,57 @@ static struct regval_list ov5647_2592x19
+ 	{0x3a11, 0x60},
+ 	{0x3a1f, 0x28},
+ 	{0x4001, 0x02},
+-	{0x4004, 0x04},
+ 	{0x4000, 0x09},
++	{0x3503, 0x03},
++};
++
++static struct regval_list ov5647_2592x1944_10bpp[] = {
++	{0x3036, 0x69},
++	{0x3821, 0x00},
++	{0x3820, 0x00},
++	{0x3612, 0x5b},
++	{0x3618, 0x04},
++	{0x5002, 0x41},
++	{0x3814, 0x11},
++	{0x3815, 0x11},
++	{0x3708, 0x64},
++	{0x3709, 0x12},
++	{0x3800, 0x00},
++	{0x3801, 0x00},
++	{0x3802, 0x00},
++	{0x3803, 0x00},
++	{0x3804, 0x0a},
++	{0x3805, 0x3f},
++	{0x3806, 0x07},
++	{0x3807, 0xa3},
++	{0x3808, 0x0a},
++	{0x3809, 0x20},
++	{0x380a, 0x07},
++	{0x380b, 0x98},
++	{0x3811, 0x10},
++	{0x3813, 0x06},
++	{0x3a09, 0x28},
++	{0x3a0a, 0x00},
++	{0x3a0b, 0xf6},
++	{0x3a0d, 0x08},
++	{0x3a0e, 0x06},
++	{0x4004, 0x04},
+ 	{0x4837, 0x19},
+ 	{0x4800, 0x24},
+-	{0x3503, 0x03},
+ 	{0x0100, 0x01},
+ };
+ 
+ static struct regval_list ov5647_1080p30_10bpp[] = {
+-	{0x0100, 0x00},
+-	{0x0103, 0x01},
+-	{0x3034, 0x1a},
+-	{0x3035, 0x21},
+ 	{0x3036, 0x62},
+-	{0x303c, 0x11},
+-	{0x3106, 0xf5},
+ 	{0x3821, 0x00},
+ 	{0x3820, 0x00},
+-	{0x3827, 0xec},
+-	{0x370c, 0x03},
+ 	{0x3612, 0x5b},
+ 	{0x3618, 0x04},
+-	{0x5000, 0x06},
+ 	{0x5002, 0x41},
+-	{0x5003, 0x08},
+-	{0x5a00, 0x08},
+-	{0x3000, 0x00},
+-	{0x3001, 0x00},
+-	{0x3002, 0x00},
+-	{0x3016, 0x08},
+-	{0x3017, 0xe0},
+-	{0x3018, 0x44},
+-	{0x301c, 0xf8},
+-	{0x301d, 0xf0},
+-	{0x3a18, 0x00},
+-	{0x3a19, 0xf8},
+-	{0x3c01, 0x80},
+-	{0x3b07, 0x0c},
+ 	{0x3814, 0x11},
+ 	{0x3815, 0x11},
+ 	{0x3708, 0x64},
+ 	{0x3709, 0x12},
+-	{0x3808, 0x07},
+-	{0x3809, 0x80},
+-	{0x380a, 0x04},
+-	{0x380b, 0x38},
+ 	{0x3800, 0x01},
+ 	{0x3801, 0x5c},
+ 	{0x3802, 0x01},
+@@ -294,77 +270,30 @@ static struct regval_list ov5647_1080p30
+ 	{0x3805, 0xe3},
+ 	{0x3806, 0x05},
+ 	{0x3807, 0xf1},
++	{0x3808, 0x07},
++	{0x3809, 0x80},
++	{0x380a, 0x04},
++	{0x380b, 0x38},
+ 	{0x3811, 0x04},
+ 	{0x3813, 0x02},
+-	{0x3630, 0x2e},
+-	{0x3632, 0xe2},
+-	{0x3633, 0x23},
+-	{0x3634, 0x44},
+-	{0x3636, 0x06},
+-	{0x3620, 0x64},
+-	{0x3621, 0xe0},
+-	{0x3600, 0x37},
+-	{0x3704, 0xa0},
+-	{0x3703, 0x5a},
+-	{0x3715, 0x78},
+-	{0x3717, 0x01},
+-	{0x3731, 0x02},
+-	{0x370b, 0x60},
+-	{0x3705, 0x1a},
+-	{0x3f05, 0x02},
+-	{0x3f06, 0x10},
+-	{0x3f01, 0x0a},
+-	{0x3a08, 0x01},
+ 	{0x3a09, 0x4b},
+ 	{0x3a0a, 0x01},
+ 	{0x3a0b, 0x13},
+ 	{0x3a0d, 0x04},
+ 	{0x3a0e, 0x03},
+-	{0x3a0f, 0x58},
+-	{0x3a10, 0x50},
+-	{0x3a1b, 0x58},
+-	{0x3a1e, 0x50},
+-	{0x3a11, 0x60},
+-	{0x3a1f, 0x28},
+-	{0x4001, 0x02},
+ 	{0x4004, 0x04},
+-	{0x4000, 0x09},
+ 	{0x4837, 0x19},
+ 	{0x4800, 0x34},
+-	{0x3503, 0x03},
+ 	{0x0100, 0x01},
+ };
+ 
+ static struct regval_list ov5647_2x2binned_10bpp[] = {
+-	{0x0100, 0x00},
+-	{0x0103, 0x01},
+-	{0x3034, 0x1a},
+-	{0x3035, 0x21},
+ 	{0x3036, 0x62},
+-	{0x303c, 0x11},
+-	{0x3106, 0xf5},
+ 	{0x3821, 0x01},
+ 	{0x3820, 0x41},
+-	{0x3827, 0xec},
+-	{0x370c, 0x03},
+ 	{0x3612, 0x59},
+ 	{0x3618, 0x00},
+-	{0x5000, 0x06},
+ 	{0x5002, 0x41},
+-	{0x5003, 0x08},
+-	{0x5a00, 0x08},
+-	{0x3000, 0x00},
+-	{0x3001, 0x00},
+-	{0x3002, 0x00},
+-	{0x3016, 0x08},
+-	{0x3017, 0xe0},
+-	{0x3018, 0x44},
+-	{0x301c, 0xf8},
+-	{0x301d, 0xf0},
+-	{0x3a18, 0x00},
+-	{0x3a19, 0xf8},
+-	{0x3c01, 0x80},
+-	{0x3b07, 0x0c},
+ 	{0x3800, 0x00},
+ 	{0x3801, 0x00},
+ 	{0x3802, 0x00},
+@@ -381,42 +310,14 @@ static struct regval_list ov5647_2x2binn
+ 	{0x3813, 0x06},
+ 	{0x3814, 0x31},
+ 	{0x3815, 0x31},
+-	{0x3630, 0x2e},
+-	{0x3632, 0xe2},
+-	{0x3633, 0x23},
+-	{0x3634, 0x44},
+-	{0x3636, 0x06},
+-	{0x3620, 0x64},
+-	{0x3621, 0xe0},
+-	{0x3600, 0x37},
+-	{0x3704, 0xa0},
+-	{0x3703, 0x5a},
+-	{0x3715, 0x78},
+-	{0x3717, 0x01},
+-	{0x3731, 0x02},
+-	{0x370b, 0x60},
+-	{0x3705, 0x1a},
+-	{0x3f05, 0x02},
+-	{0x3f06, 0x10},
+-	{0x3f01, 0x0a},
+-	{0x3a08, 0x01},
+ 	{0x3a09, 0x28},
+ 	{0x3a0a, 0x00},
+ 	{0x3a0b, 0xf6},
+ 	{0x3a0d, 0x08},
+ 	{0x3a0e, 0x06},
+-	{0x3a0f, 0x58},
+-	{0x3a10, 0x50},
+-	{0x3a1b, 0x58},
+-	{0x3a1e, 0x50},
+-	{0x3a11, 0x60},
+-	{0x3a1f, 0x28},
+-	{0x4001, 0x02},
+ 	{0x4004, 0x04},
+-	{0x4000, 0x09},
+ 	{0x4837, 0x16},
+ 	{0x4800, 0x24},
+-	{0x3503, 0x03},
+ 	{0x350a, 0x00},
+ 	{0x350b, 0x10},
+ 	{0x3500, 0x00},
+@@ -427,42 +328,15 @@ static struct regval_list ov5647_2x2binn
+ };
+ 
+ static struct regval_list ov5647_640x480_10bpp[] = {
+-	{0x0100, 0x00},
+-	{0x0103, 0x01},
+-	{0x3034, 0x1a},
+-	{0x3035, 0x21},
+ 	{0x3036, 0x46},
+-	{0x303c, 0x11},
+-	{0x3106, 0xf5},
+ 	{0x3821, 0x01},
+ 	{0x3820, 0x41},
+-	{0x3827, 0xec},
+-	{0x370c, 0x03},
+ 	{0x3612, 0x59},
+ 	{0x3618, 0x00},
+-	{0x5000, 0x06},
+-	{0x5003, 0x08},
+-	{0x5a00, 0x08},
+-	{0x3000, 0x00},
+-	{0x3001, 0x00},
+-	{0x3002, 0x00},
+-	{0x3016, 0x08},
+-	{0x3017, 0xe0},
+-	{0x3018, 0x44},
+-	{0x301c, 0xf8},
+-	{0x301d, 0xf0},
+-	{0x3a18, 0x00},
+-	{0x3a19, 0xf8},
+-	{0x3c01, 0x80},
+-	{0x3b07, 0x0c},
+ 	{0x3814, 0x35},
+ 	{0x3815, 0x35},
+ 	{0x3708, 0x64},
+ 	{0x3709, 0x52},
+-	{0x3808, 0x02},
+-	{0x3809, 0x80},
+-	{0x380a, 0x01},
+-	{0x380b, 0xe0},
+ 	{0x3800, 0x00},
+ 	{0x3801, 0x10},
+ 	{0x3802, 0x00},
+@@ -471,41 +345,17 @@ static struct regval_list ov5647_640x480
+ 	{0x3805, 0x2f},
+ 	{0x3806, 0x07},
+ 	{0x3807, 0x9f},
+-	{0x3630, 0x2e},
+-	{0x3632, 0xe2},
+-	{0x3633, 0x23},
+-	{0x3634, 0x44},
+-	{0x3636, 0x06},
+-	{0x3620, 0x64},
+-	{0x3621, 0xe0},
+-	{0x3600, 0x37},
+-	{0x3704, 0xa0},
+-	{0x3703, 0x5a},
+-	{0x3715, 0x78},
+-	{0x3717, 0x01},
+-	{0x3731, 0x02},
+-	{0x370b, 0x60},
+-	{0x3705, 0x1a},
+-	{0x3f05, 0x02},
+-	{0x3f06, 0x10},
+-	{0x3f01, 0x0a},
+-	{0x3a08, 0x01},
++	{0x3808, 0x02},
++	{0x3809, 0x80},
++	{0x380a, 0x01},
++	{0x380b, 0xe0},
+ 	{0x3a09, 0x2e},
+ 	{0x3a0a, 0x00},
+ 	{0x3a0b, 0xfb},
+ 	{0x3a0d, 0x02},
+ 	{0x3a0e, 0x01},
+-	{0x3a0f, 0x58},
+-	{0x3a10, 0x50},
+-	{0x3a1b, 0x58},
+-	{0x3a1e, 0x50},
+-	{0x3a11, 0x60},
+-	{0x3a1f, 0x28},
+-	{0x4001, 0x02},
+ 	{0x4004, 0x02},
+-	{0x4000, 0x09},
+ 	{0x4800, 0x34},
+-	{0x3503, 0x03},
+ 	{0x0100, 0x01},
+ };
+ 
+@@ -714,6 +564,13 @@ static int ov5647_set_mode(struct v4l2_s
+ 	if (ret < 0)
+ 		return ret;
+ 
++	ret = ov5647_write_array(sd, ov5647_common_regs,
++				 ARRAY_SIZE(ov5647_common_regs));
++	if (ret < 0) {
++		dev_err(&client->dev, "write sensor common regs error\n");
++		return ret;
++	}
++
+ 	ret = ov5647_write_array(sd, sensor->mode->reg_list,
+ 				 sensor->mode->num_regs);
+ 	if (ret < 0) {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0517-media-i2c-ov5647-Use-the-same-PLL-config-for-full-10.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0517-media-i2c-ov5647-Use-the-same-PLL-config-for-full-10.patch
new file mode 100644
index 00000000..9e68c1a1
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0517-media-i2c-ov5647-Use-the-same-PLL-config-for-full-10.patch
@@ -0,0 +1,53 @@
+From 111d072bbd32d60a24b693b5e310784ba3060bf7 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 15 Oct 2024 19:36:13 +0100
+Subject: [PATCH 517/697] media: i2c: ov5647: Use the same PLL config for full,
+ 1080p, and binned modes
+
+In order to simplify the driver slightly, use the same PLL
+configuration, and hence pixel rate and link frequency (to be
+added) for the full, 1080p, and binned modes.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/ov5647.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/i2c/ov5647.c
++++ b/drivers/media/i2c/ov5647.c
+@@ -252,7 +252,7 @@ static struct regval_list ov5647_2592x19
+ };
+ 
+ static struct regval_list ov5647_1080p30_10bpp[] = {
+-	{0x3036, 0x62},
++	{0x3036, 0x69},
+ 	{0x3821, 0x00},
+ 	{0x3820, 0x00},
+ 	{0x3612, 0x5b},
+@@ -288,7 +288,7 @@ static struct regval_list ov5647_1080p30
+ };
+ 
+ static struct regval_list ov5647_2x2binned_10bpp[] = {
+-	{0x3036, 0x62},
++	{0x3036, 0x69},
+ 	{0x3821, 0x01},
+ 	{0x3820, 0x41},
+ 	{0x3612, 0x59},
+@@ -396,7 +396,7 @@ static const struct ov5647_mode ov5647_m
+ 			.width		= 1928,
+ 			.height		= 1080,
+ 		},
+-		.pixel_rate	= 81666700,
++		.pixel_rate	= 87500000,
+ 		.hts		= 2416,
+ 		.vts		= 0x450,
+ 		.reg_list	= ov5647_1080p30_10bpp,
+@@ -417,7 +417,7 @@ static const struct ov5647_mode ov5647_m
+ 			.width		= 2592,
+ 			.height		= 1944,
+ 		},
+-		.pixel_rate	= 81666700,
++		.pixel_rate	= 87500000,
+ 		.hts		= 1896,
+ 		.vts		= 0x59b,
+ 		.reg_list	= ov5647_2x2binned_10bpp,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0518-media-i2c-ov5647-Add-V4L2_CID_LINK_FREQUENCY-control.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0518-media-i2c-ov5647-Add-V4L2_CID_LINK_FREQUENCY-control.patch
new file mode 100644
index 00000000..6ac0d903
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0518-media-i2c-ov5647-Add-V4L2_CID_LINK_FREQUENCY-control.patch
@@ -0,0 +1,111 @@
+From 80b1b1b7c03fed2d475ebbbc7b3dcda468642a4c Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 15 Oct 2024 19:46:01 +0100
+Subject: [PATCH 518/697] media: i2c: ov5647: Add V4L2_CID_LINK_FREQUENCY
+ control
+
+The link frequency can vary between modes, so add it as a
+control.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/ov5647.c | 25 ++++++++++++++++++++++++-
+ 1 file changed, 24 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/ov5647.c
++++ b/drivers/media/i2c/ov5647.c
+@@ -97,6 +97,13 @@ static const char * const ov5647_supply_
+ 
+ #define OV5647_NUM_SUPPLIES ARRAY_SIZE(ov5647_supply_names)
+ 
++#define FREQ_INDEX_FULL		0
++#define FREQ_INDEX_VGA		1
++static const s64 ov5647_link_freqs[] = {
++	[FREQ_INDEX_FULL]	= 218500000,
++	[FREQ_INDEX_VGA]	= 208333000,
++};
++
+ struct regval_list {
+ 	u16 addr;
+ 	u8 data;
+@@ -106,6 +113,7 @@ struct ov5647_mode {
+ 	struct v4l2_mbus_framefmt	format;
+ 	struct v4l2_rect		crop;
+ 	u64				pixel_rate;
++	unsigned int			link_freq_index;
+ 	int				hts;
+ 	int				vts;
+ 	const struct regval_list	*reg_list;
+@@ -128,6 +136,7 @@ struct ov5647 {
+ 	struct v4l2_ctrl		*exposure;
+ 	struct v4l2_ctrl		*hflip;
+ 	struct v4l2_ctrl		*vflip;
++	struct v4l2_ctrl		*link_freq;
+ };
+ 
+ static inline struct ov5647 *to_sensor(struct v4l2_subdev *sd)
+@@ -376,6 +385,7 @@ static const struct ov5647_mode ov5647_m
+ 			.height		= 1944
+ 		},
+ 		.pixel_rate	= 87500000,
++		.link_freq_index = FREQ_INDEX_FULL,
+ 		.hts		= 2844,
+ 		.vts		= 0x7b0,
+ 		.reg_list	= ov5647_2592x1944_10bpp,
+@@ -397,6 +407,7 @@ static const struct ov5647_mode ov5647_m
+ 			.height		= 1080,
+ 		},
+ 		.pixel_rate	= 87500000,
++		.link_freq_index = FREQ_INDEX_FULL,
+ 		.hts		= 2416,
+ 		.vts		= 0x450,
+ 		.reg_list	= ov5647_1080p30_10bpp,
+@@ -418,6 +429,7 @@ static const struct ov5647_mode ov5647_m
+ 			.height		= 1944,
+ 		},
+ 		.pixel_rate	= 87500000,
++		.link_freq_index = FREQ_INDEX_FULL,
+ 		.hts		= 1896,
+ 		.vts		= 0x59b,
+ 		.reg_list	= ov5647_2x2binned_10bpp,
+@@ -439,6 +451,7 @@ static const struct ov5647_mode ov5647_m
+ 			.height		= 1920,
+ 		},
+ 		.pixel_rate	= 55000000,
++		.link_freq_index = FREQ_INDEX_VGA,
+ 		.hts		= 1852,
+ 		.vts		= 0x1f8,
+ 		.reg_list	= ov5647_640x480_10bpp,
+@@ -937,6 +950,8 @@ static int ov5647_set_pad_fmt(struct v4l
+ 					 sensor->exposure->minimum,
+ 					 exposure_max, sensor->exposure->step,
+ 					 exposure_def);
++
++		__v4l2_ctrl_s_ctrl(sensor->link_freq, mode->link_freq_index);
+ 	}
+ 	*fmt = mode->format;
+ 	/* The code we pass back must reflect the current h/vflips. */
+@@ -1242,7 +1257,7 @@ static int ov5647_init_controls(struct o
+ 	int hblank, exposure_max, exposure_def;
+ 	struct v4l2_fwnode_device_properties props;
+ 
+-	v4l2_ctrl_handler_init(&sensor->ctrls, 9);
++	v4l2_ctrl_handler_init(&sensor->ctrls, 10);
+ 
+ 	v4l2_ctrl_new_std(&sensor->ctrls, &ov5647_ctrl_ops,
+ 			  V4L2_CID_AUTOGAIN, 0, 1, 1, 0);
+@@ -1302,6 +1317,14 @@ static int ov5647_init_controls(struct o
+ 	if (sensor->vflip)
+ 		sensor->vflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
+ 
++	sensor->link_freq =
++		v4l2_ctrl_new_int_menu(&sensor->ctrls, &ov5647_ctrl_ops,
++				       V4L2_CID_LINK_FREQ,
++				       ARRAY_SIZE(ov5647_link_freqs) - 1, 0,
++				       ov5647_link_freqs);
++	if (sensor->link_freq)
++		sensor->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++
+ 	v4l2_fwnode_device_parse(dev, &props);
+ 
+ 	v4l2_ctrl_new_fwnode_properties(&sensor->ctrls, &ov5647_ctrl_ops,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0519-dma-buf-system_heap-Allow-specifying-maximum-allocat.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0519-dma-buf-system_heap-Allow-specifying-maximum-allocat.patch
new file mode 100644
index 00000000..c9f56e92
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0519-dma-buf-system_heap-Allow-specifying-maximum-allocat.patch
@@ -0,0 +1,46 @@
+From f1dc89efa80fab8818b3d68c8f5438ae11a7f5dc Mon Sep 17 00:00:00 2001
+From: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Date: Wed, 17 Jul 2024 09:33:21 +0100
+Subject: [PATCH 519/697] dma-buf: system_heap: Allow specifying maximum
+ allocation order
+
+system_heap.max_order=<uint>
+
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+---
+ drivers/dma-buf/heaps/system_heap.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma-buf/heaps/system_heap.c
++++ b/drivers/dma-buf/heaps/system_heap.c
+@@ -54,6 +54,11 @@ static gfp_t order_flags[] = {HIGH_ORDER
+ static const unsigned int orders[] = {8, 4, 0};
+ #define NUM_ORDERS ARRAY_SIZE(orders)
+ 
++static unsigned int module_max_order = orders[0];
++
++module_param_named(max_order, module_max_order, uint, 0400);
++MODULE_PARM_DESC(max_order, "Maximum allocation order override.");
++
+ static struct sg_table *dup_sg_table(struct sg_table *table)
+ {
+ 	struct sg_table *new_table;
+@@ -339,7 +344,7 @@ static struct dma_buf *system_heap_alloc
+ 	struct system_heap_buffer *buffer;
+ 	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
+ 	unsigned long size_remaining = len;
+-	unsigned int max_order = orders[0];
++	unsigned int max_order = module_max_order;
+ 	struct dma_buf *dmabuf;
+ 	struct sg_table *table;
+ 	struct scatterlist *sg;
+@@ -433,6 +438,9 @@ static int system_heap_create(void)
+ 	if (IS_ERR(sys_heap))
+ 		return PTR_ERR(sys_heap);
+ 
++	if (module_max_order > orders[0])
++		module_max_order = orders[0];
++
+ 	return 0;
+ }
+ module_init(system_heap_create);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0520-mm-numa-Allow-override-of-kernel-s-default-NUMA-poli.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0520-mm-numa-Allow-override-of-kernel-s-default-NUMA-poli.patch
new file mode 100644
index 00000000..323fc8a4
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0520-mm-numa-Allow-override-of-kernel-s-default-NUMA-poli.patch
@@ -0,0 +1,115 @@
+From f276db925170785d2c7bdf95c615c329ff420d20 Mon Sep 17 00:00:00 2001
+From: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Date: Wed, 22 May 2024 17:12:16 +0100
+Subject: [PATCH 520/697] mm/numa: Allow override of kernel's default NUMA
+ policy
+
+Add numa_policy kernel argument to allow overriding the kernel's default
+NUMA policy at boot time.
+
+Syntax identical to what tmpfs accepts as it's mpol argument is accepted.
+
+Some examples:
+
+ numa_policy=interleave
+ numa_policy=interleave=skip-interleave
+ numa_policy=bind:0-3,5,7,9-15
+ numa_policy=bind=static:1-2
+
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+---
+ mm/mempolicy.c | 49 ++++++++++++++++++++++++++++++++++++++++++-------
+ 1 file changed, 42 insertions(+), 7 deletions(-)
+
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -3146,7 +3146,9 @@ void __init numa_policy_init(void)
+ /* Reset policy of current process to default */
+ void numa_default_policy(void)
+ {
+-	do_set_mempolicy(MPOL_DEFAULT, 0, NULL);
++	struct mempolicy *pol = &default_policy;
++
++	do_set_mempolicy(pol->mode, pol->flags, &pol->nodes);
+ }
+ 
+ /*
+@@ -3163,7 +3165,6 @@ static const char * const policy_modes[]
+ 	[MPOL_PREFERRED_MANY]  = "prefer (many)",
+ };
+ 
+-#ifdef CONFIG_TMPFS
+ /**
+  * mpol_parse_str - parse string to mempolicy, for tmpfs mpol mount option.
+  * @str:  string containing mempolicy to parse
+@@ -3176,13 +3177,18 @@ static const char * const policy_modes[]
+  */
+ int mpol_parse_str(char *str, struct mempolicy **mpol)
+ {
+-	struct mempolicy *new = NULL;
++	struct mempolicy *new;
+ 	unsigned short mode_flags;
+ 	nodemask_t nodes;
+ 	char *nodelist = strchr(str, ':');
+ 	char *flags = strchr(str, '=');
+ 	int err = 1, mode;
+ 
++	if (*mpol)
++		new = *mpol;
++	else
++		new = NULL;
++
+ 	if (flags)
+ 		*flags++ = '\0';	/* terminate mode string */
+ 
+@@ -3262,9 +3268,16 @@ int mpol_parse_str(char *str, struct mem
+ 			goto out;
+ 	}
+ 
+-	new = mpol_new(mode, mode_flags, &nodes);
+-	if (IS_ERR(new))
+-		goto out;
++	if (!new) {
++		new = mpol_new(mode, mode_flags, &nodes);
++		if (IS_ERR(new))
++			goto out;
++	} else {
++		atomic_set(&new->refcnt, 1);
++		new->mode = mode;
++		new->flags = mode_flags;
++		new->home_node = NUMA_NO_NODE;
++	}
+ 
+ 	/*
+ 	 * Save nodes for mpol_to_str() to show the tmpfs mount options
+@@ -3297,7 +3310,29 @@ out:
+ 		*mpol = new;
+ 	return err;
+ }
+-#endif /* CONFIG_TMPFS */
++
++static int __init setup_numapolicy(char *str)
++{
++	struct mempolicy pol = { }, *ppol = &pol;
++	char buf[128];
++	int ret;
++
++	if (str)
++		ret = mpol_parse_str(str, &ppol);
++	else
++		ret = -EINVAL;
++
++	if (!ret) {
++		default_policy = pol;
++		mpol_to_str(buf, sizeof(buf), &pol);
++		pr_info("NUMA default policy overridden to '%s'\n", buf);
++	} else {
++		pr_warn("Unable to parse numa_policy=\n");
++	}
++
++	return ret == 0;
++}
++__setup("numa_policy=", setup_numapolicy);
+ 
+ /**
+  * mpol_to_str - format a mempolicy structure for printing
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0521-numa-emulation-Check-emulated-zones-around-the-CMA-w.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0521-numa-emulation-Check-emulated-zones-around-the-CMA-w.patch
new file mode 100644
index 00000000..3d9f2df5
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0521-numa-emulation-Check-emulated-zones-around-the-CMA-w.patch
@@ -0,0 +1,108 @@
+From 1d23676f5a87e806b13f2d1f844d16f83317d241 Mon Sep 17 00:00:00 2001
+From: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Date: Mon, 29 Jul 2024 16:53:18 +0100
+Subject: [PATCH 521/697] numa/emulation: Check emulated zones around the CMA
+ window
+
+... Make sure CMA zones do not straddle the emulated NUMA nodes ...
+
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+---
+ include/linux/cma.h |  6 ++++++
+ mm/cma.c            | 36 ++++++++++++++++++++++++++++++++++++
+ mm/numa_emulation.c |  6 ++++++
+ 3 files changed, 48 insertions(+)
+
+--- a/include/linux/cma.h
++++ b/include/linux/cma.h
+@@ -56,6 +56,7 @@ extern void cma_reserve_pages_on_error(s
+ #ifdef CONFIG_CMA
+ struct folio *cma_alloc_folio(struct cma *cma, int order, gfp_t gfp);
+ bool cma_free_folio(struct cma *cma, const struct folio *folio);
++int cma_check_range(u64 *start, u64 *end);
+ #else
+ static inline struct folio *cma_alloc_folio(struct cma *cma, int order, gfp_t gfp)
+ {
+@@ -66,6 +67,11 @@ static inline bool cma_free_folio(struct
+ {
+ 	return false;
+ }
++
++static inline int cma_check_range(u64 *start, u64 *end)
++{
++	return 0;
++}
+ #endif
+ 
+ #endif
+--- a/mm/cma.c
++++ b/mm/cma.c
+@@ -602,3 +602,39 @@ int cma_for_each_area(int (*it)(struct c
+ 
+ 	return 0;
+ }
++
++struct cma_check_range_data {
++	u64 start, end;
++};
++
++static int check_range(struct cma *cma_, void *data)
++{
++	struct cma_check_range_data *range = data;
++	struct cma_check_range_data cma;
++	bool starts_in_range;
++	bool ends_in_range;
++
++	cma.start = cma_get_base(cma_);
++	cma.end = cma.start + cma_get_size(cma_) - 1;
++
++	starts_in_range = cma.start >= range->start && cma.start <= range->end;
++	ends_in_range = cma.end >= range->start && cma.end <= range->end;
++
++	if (starts_in_range == ends_in_range)
++		return 0;
++
++	pr_notice("CMA %s [%llx-%llx] straddles range [%llx-%llx]\n",
++		  cma_->name, cma.start, cma.end, range->start, range->end);
++
++	return -EINVAL;
++}
++
++int cma_check_range(u64 *start, u64 *end)
++{
++	struct cma_check_range_data range = {
++		.start = *start,
++		.end = *end,
++	};
++
++	return cma_for_each_area(check_range, &range);
++}
+--- a/mm/numa_emulation.c
++++ b/mm/numa_emulation.c
+@@ -7,6 +7,7 @@
+ #include <linux/topology.h>
+ #include <linux/memblock.h>
+ #include <linux/numa_memblks.h>
++#include <linux/cma.h>
+ #include <asm/numa.h>
+ 
+ #define FAKE_NODE_MIN_SIZE	((u64)32 << 20)
+@@ -51,6 +52,7 @@ static int __init emu_setup_memblk(struc
+ {
+ 	struct numa_memblk *eb = &ei->blk[ei->nr_blks];
+ 	struct numa_memblk *pb = &pi->blk[phys_blk];
++	int ret;
+ 
+ 	if (ei->nr_blks >= NR_NODE_MEMBLKS) {
+ 		pr_err("NUMA: Too many emulated memblks, failing emulation\n");
+@@ -62,6 +64,10 @@ static int __init emu_setup_memblk(struc
+ 	eb->end = pb->start + size;
+ 	eb->nid = nid;
+ 
++	ret = cma_check_range(&eb->start, &eb->end);
++	if (ret)
++		return ret;
++
+ 	if (emu_nid_to_phys[nid] == NUMA_NO_NODE)
+ 		emu_nid_to_phys[nid] = pb->nid;
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0522-drivers-media-bcm2835_isp-Cache-LS-table-dmabuf.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0522-drivers-media-bcm2835_isp-Cache-LS-table-dmabuf.patch
new file mode 100644
index 00000000..d3b6df4a
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0522-drivers-media-bcm2835_isp-Cache-LS-table-dmabuf.patch
@@ -0,0 +1,141 @@
+From 13d5d96d767617843354b2fda0ffb8359bd73276 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Fri, 18 Oct 2024 09:18:10 +0100
+Subject: [PATCH 522/697] drivers: media: bcm2835_isp: Cache LS table dmabuf
+
+Clients such as libcamera do not change the LS table dmabuf on every
+frame. In such cases instead of mapping/remapping the same dmabuf on
+every frame to send to the firmware, cache the dmabuf once and only
+update and remap if the dmabuf has been changed by the userland client.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../bcm2835-isp/bcm2835-v4l2-isp.c            | 77 +++++++++++--------
+ 1 file changed, 46 insertions(+), 31 deletions(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
+@@ -140,6 +140,8 @@ struct bcm2835_isp_dev {
+ 	/* Image pipeline controls. */
+ 	int r_gain;
+ 	int b_gain;
++	struct dma_buf *last_ls_dmabuf;
++	struct mmal_parameter_lens_shading_v2 ls;
+ };
+ 
+ struct bcm2835_isp_buffer {
+@@ -658,18 +660,18 @@ static void bcm2835_isp_node_stop_stream
+ 	atomic_dec(&dev->num_streaming);
+ 	/* If all ports disabled, then disable the component */
+ 	if (atomic_read(&dev->num_streaming) == 0) {
+-		struct bcm2835_isp_lens_shading ls;
+ 		/*
+ 		 * The ISP component on the firmware has a reference to the
+ 		 * dmabuf handle for the lens shading table.  Pass a null handle
+ 		 * to remove that reference now.
+ 		 */
+-		memset(&ls, 0, sizeof(ls));
++		memset(&dev->ls, 0, sizeof(dev->ls));
+ 		/* Must set a valid grid size for the FW */
+-		ls.grid_cell_size = 16;
++		dev->ls.grid_cell_size = 16;
+ 		set_isp_param(&dev->node[0],
+ 			      MMAL_PARAMETER_LENS_SHADING_OVERRIDE,
+-			      &ls, sizeof(ls));
++			      &dev->ls, sizeof(dev->ls));
++		dev->last_ls_dmabuf = NULL;
+ 
+ 		ret = vchiq_mmal_component_disable(dev->mmal_instance,
+ 						   dev->component);
+@@ -720,6 +722,36 @@ static inline unsigned int get_sizeimage
+ 	return (bpl * height * fmt->size_multiplier_x2) >> 1;
+ }
+ 
++static int map_ls_table(struct bcm2835_isp_dev *dev, struct dma_buf *dmabuf,
++			const struct bcm2835_isp_lens_shading *v4l2_ls)
++{
++	void *vcsm_handle;
++	int ret;
++
++	if (IS_ERR_OR_NULL(dmabuf))
++		return -EINVAL;
++
++	/*
++	 * struct bcm2835_isp_lens_shading and struct
++	 * mmal_parameter_lens_shading_v2 match so that we can do a
++	 * simple memcpy here.
++	 * Only the dmabuf to the actual table needs any manipulation.
++	 */
++	memcpy(&dev->ls, v4l2_ls, sizeof(dev->ls));
++	ret = vc_sm_cma_import_dmabuf(dmabuf, &vcsm_handle);
++	if (ret) {
++		dma_buf_put(dmabuf);
++		return ret;
++	}
++
++	dev->ls.mem_handle_table = vc_sm_cma_int_handle(vcsm_handle);
++	dev->last_ls_dmabuf = dmabuf;
++
++	vc_sm_cma_free(vcsm_handle);
++
++	return 0;
++}
++
+ static int bcm2835_isp_s_ctrl(struct v4l2_ctrl *ctrl)
+ {
+ 	struct bcm2835_isp_dev *dev =
+@@ -755,44 +787,27 @@ static int bcm2835_isp_s_ctrl(struct v4l
+ 	case V4L2_CID_USER_BCM2835_ISP_LENS_SHADING:
+ 	{
+ 		struct bcm2835_isp_lens_shading *v4l2_ls;
+-		struct mmal_parameter_lens_shading_v2 ls;
+-		struct dma_buf *dmabuf;
+-		void *vcsm_handle;
+ 
+ 		v4l2_ls = (struct bcm2835_isp_lens_shading *)ctrl->p_new.p_u8;
+-		/*
+-		 * struct bcm2835_isp_lens_shading and struct
+-		 * mmal_parameter_lens_shading_v2 match so that we can do a
+-		 * simple memcpy here.
+-		 * Only the dmabuf to the actual table needs any manipulation.
+-		 */
+-		memcpy(&ls, v4l2_ls, sizeof(ls));
++		struct dma_buf *dmabuf = dma_buf_get(v4l2_ls->dmabuf);
+ 
+-		dmabuf = dma_buf_get(v4l2_ls->dmabuf);
+-		if (IS_ERR_OR_NULL(dmabuf))
+-			return -EINVAL;
+-
+-		ret = vc_sm_cma_import_dmabuf(dmabuf, &vcsm_handle);
+-		if (ret) {
+-			dma_buf_put(dmabuf);
+-			return -EINVAL;
+-		}
++		if (dmabuf != dev->last_ls_dmabuf)
++			ret = map_ls_table(dev, dmabuf, v4l2_ls);
+ 
+-		ls.mem_handle_table = vc_sm_cma_int_handle(vcsm_handle);
+-		if (ls.mem_handle_table)
+-			/* The VPU will take a reference on the vcsm handle,
++		if (!ret && dev->ls.mem_handle_table)
++			/*
++			 * The VPU will take a reference on the vcsm handle,
+ 			 * which in turn will retain a reference on the dmabuf.
+ 			 * This code can therefore safely release all
+ 			 * references to the buffer.
+ 			 */
+-			ret = set_isp_param(node,
+-					    MMAL_PARAMETER_LENS_SHADING_OVERRIDE,
+-					    &ls,
+-					    sizeof(ls));
++			ret =
++			set_isp_param(node,
++				      MMAL_PARAMETER_LENS_SHADING_OVERRIDE,
++				      &dev->ls, sizeof(dev->ls));
+ 		else
+ 			ret = -EINVAL;
+ 
+-		vc_sm_cma_free(vcsm_handle);
+ 		dma_buf_put(dmabuf);
+ 		break;
+ 	}
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0523-mm-vmscan-Maintain-TLB-coherency-in-LRU-code.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0523-mm-vmscan-Maintain-TLB-coherency-in-LRU-code.patch
new file mode 100644
index 00000000..67180d8d
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0523-mm-vmscan-Maintain-TLB-coherency-in-LRU-code.patch
@@ -0,0 +1,27 @@
+From 683841a7fb9fb5810f8f8b1b7e51dbe7cd0545fc Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 12 Sep 2024 10:06:50 +0100
+Subject: [PATCH 523/697] mm/vmscan: Maintain TLB coherency in LRU code
+
+As a workaround (and possibly a fix) for CPU spins observed on BCM2837,
+use ptep_clear_flush_young instead of ptep_test_and_clear_young inside
+lru_gen_look_around in order to expose PTE changes to the MMU. Note that
+on architectures that don't require an explicit flush,
+ptep_clear_flush_young just calls ptep_test_and_clear_young.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ mm/vmscan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -4113,7 +4113,7 @@ bool lru_gen_look_around(struct page_vma
+ 		if (!folio)
+ 			continue;
+ 
+-		if (!ptep_clear_young_notify(vma, addr, pte + i))
++		if (!ptep_clear_flush_young_notify(vma, addr, pte + i))
+ 			continue;
+ 
+ 		young++;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0524-mmc-quirks-add-more-broken-Kingston-Canvas-Go-SD-car.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0524-mmc-quirks-add-more-broken-Kingston-Canvas-Go-SD-car.patch
new file mode 100644
index 00000000..31bf4db7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0524-mmc-quirks-add-more-broken-Kingston-Canvas-Go-SD-car.patch
@@ -0,0 +1,42 @@
+From 8e1db12a95cfdfac3884f55ec81c1b976f346fe0 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Tue, 29 Oct 2024 13:33:21 +0000
+Subject: [PATCH 524/697] mmc: quirks: add more broken Kingston Canvas Go! SD
+ card date ranges
+
+A user has reported that a card of this model from late 2021 doesn't
+work, so extend the date range and make it match on all card sizes.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/core/quirks.h | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+--- a/drivers/mmc/core/quirks.h
++++ b/drivers/mmc/core/quirks.h
+@@ -18,10 +18,22 @@
+ static const struct mmc_fixup __maybe_unused mmc_sd_fixups[] = {
+ 	/*
+ 	 * Kingston Canvas Go! Plus microSD cards never finish SD cache flush.
+-	 * This has so far only been observed on cards from 11/2019, while new
+-	 * cards from 2023/05 do not exhibit this behavior.
++	 * This has been observed on cards from 2019/11 and 2021/11, while new
++	 * cards from 2023/05 and 2024/08 do not exhibit this behavior.
+ 	 */
+-	_FIXUP_EXT("SD64G", CID_MANFID_KINGSTON_SD, 0x5449, 2019, 11,
++	_FIXUP_EXT(CID_NAME_ANY, CID_MANFID_KINGSTON_SD, 0x5449, 2019, CID_MONTH_ANY,
++		   0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
++		   MMC_QUIRK_BROKEN_SD_CACHE, EXT_CSD_REV_ANY),
++
++	_FIXUP_EXT(CID_NAME_ANY, CID_MANFID_KINGSTON_SD, 0x5449, 2020, CID_MONTH_ANY,
++		   0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
++		   MMC_QUIRK_BROKEN_SD_CACHE, EXT_CSD_REV_ANY),
++
++	_FIXUP_EXT(CID_NAME_ANY, CID_MANFID_KINGSTON_SD, 0x5449, 2021, CID_MONTH_ANY,
++		   0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
++		   MMC_QUIRK_BROKEN_SD_CACHE, EXT_CSD_REV_ANY),
++
++	_FIXUP_EXT(CID_NAME_ANY, CID_MANFID_KINGSTON_SD, 0x5449, 2022, CID_MONTH_ANY,
+ 		   0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
+ 		   MMC_QUIRK_BROKEN_SD_CACHE, EXT_CSD_REV_ANY),
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0525-dt-bindings-usb-snps-dwc3-add-FS-HS-periodic-NAK-pol.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0525-dt-bindings-usb-snps-dwc3-add-FS-HS-periodic-NAK-pol.patch
new file mode 100644
index 00000000..b5e2d621
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0525-dt-bindings-usb-snps-dwc3-add-FS-HS-periodic-NAK-pol.patch
@@ -0,0 +1,35 @@
+From 207afad49f2caaace0e4a20abecdb33c1b0219cb Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 6 Nov 2024 10:26:55 +0000
+Subject: [PATCH 525/697] dt-bindings: usb: snps,dwc3: add FS/HS periodic NAK
+ polling quirk
+
+Add two quirk properties that control whether or not the controller
+issues many more handshakes to FS/HS Async endpoints in a single
+(micro)frame. Enabling these can significantly increase throughput for
+endpoints that frequently respond with NAKs.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ Documentation/devicetree/bindings/usb/snps,dwc3.yaml | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/Documentation/devicetree/bindings/usb/snps,dwc3.yaml
++++ b/Documentation/devicetree/bindings/usb/snps,dwc3.yaml
+@@ -232,6 +232,16 @@ properties:
+     description: When set, disable u2mac linestate check during HS transmit
+     type: boolean
+ 
++  snps,enhanced-nak-fs-quirk:
++    description:
++      When set, the controller schedules many more handshakes to Async FS
++      endpoints, improving throughput when they frequently respond with NAKs.
++
++  snps,enhanced-nak-hs-quirk:
++    description:
++      When set, the controller schedules many more handshakes to Async HS
++      endpoints, improving throughput when they frequently respond with NAKs.
++
+   snps,parkmode-disable-ss-quirk:
+     description:
+       When set, disable park mode for all Superspeed bus instances.
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0526-usb-dwc3-core-add-support-for-setting-NAK-enhancemen.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0526-usb-dwc3-core-add-support-for-setting-NAK-enhancemen.patch
new file mode 100644
index 00000000..12b4a002
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0526-usb-dwc3-core-add-support-for-setting-NAK-enhancemen.patch
@@ -0,0 +1,77 @@
+From 2c2c9614fa4f040d797631963fba7a83bf8d5e78 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 6 Nov 2024 10:45:24 +0000
+Subject: [PATCH 526/697] usb: dwc3: core: add support for setting NAK
+ enhancement bits for FS/HS
+
+If a device frequently NAKs, it can exhaust the scheduled handshakes in
+a frame. It will then not get polled by the controller until the next
+frame interval. This is most noticeable on FS devices as the controller
+schedules a small set of transactions only once per full-speed frame.
+
+Setting the ENH_PER_NAK_FS/LS bits in the GUCTL1 register increases the
+number of transactions that can be scheduled to Async (Control/Bulk)
+endpoints in the respective frame time. In the FS case, this only
+applies to FS devices directly connected to root ports.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/dwc3/core.c | 10 ++++++++++
+ drivers/usb/dwc3/core.h |  6 ++++++
+ 2 files changed, 16 insertions(+)
+
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1464,6 +1464,12 @@ static int dwc3_core_init(struct dwc3 *d
+ 		if (dwc->dis_tx_ipgap_linecheck_quirk)
+ 			reg |= DWC3_GUCTL1_TX_IPGAP_LINECHECK_DIS;
+ 
++		if (dwc->enh_nak_fs_quirk)
++			reg |= DWC3_GUCTL1_NAK_PER_ENH_FS;
++
++		if (dwc->enh_nak_hs_quirk)
++			reg |= DWC3_GUCTL1_NAK_PER_ENH_HS;
++
+ 		if (dwc->parkmode_disable_ss_quirk)
+ 			reg |= DWC3_GUCTL1_PARKMODE_DISABLE_SS;
+ 
+@@ -1824,6 +1830,10 @@ static void dwc3_get_properties(struct d
+ 				"snps,resume-hs-terminations");
+ 	dwc->ulpi_ext_vbus_drv = device_property_read_bool(dev,
+ 				"snps,ulpi-ext-vbus-drv");
++	dwc->enh_nak_fs_quirk = device_property_read_bool(dev,
++				"snps,enhanced-nak-fs-quirk");
++	dwc->enh_nak_hs_quirk = device_property_read_bool(dev,
++				"snps,enhanced-nak-hs-quirk");
+ 	dwc->parkmode_disable_ss_quirk = device_property_read_bool(dev,
+ 				"snps,parkmode-disable-ss-quirk");
+ 	dwc->parkmode_disable_hs_quirk = device_property_read_bool(dev,
+--- a/drivers/usb/dwc3/core.h
++++ b/drivers/usb/dwc3/core.h
+@@ -282,6 +282,8 @@
+ #define DWC3_GUCTL1_TX_IPGAP_LINECHECK_DIS	BIT(28)
+ #define DWC3_GUCTL1_DEV_FORCE_20_CLK_FOR_30_CLK	BIT(26)
+ #define DWC3_GUCTL1_DEV_L1_EXIT_BY_HW		BIT(24)
++#define DWC3_GUCTL1_NAK_PER_ENH_FS		BIT(19)
++#define DWC3_GUCTL1_NAK_PER_ENH_HS		BIT(18)
+ #define DWC3_GUCTL1_PARKMODE_DISABLE_SS		BIT(17)
+ #define DWC3_GUCTL1_PARKMODE_DISABLE_HS		BIT(16)
+ #define DWC3_GUCTL1_PARKMODE_DISABLE_FSLS	BIT(15)
+@@ -1142,6 +1144,8 @@ struct dwc3_scratchpad_array {
+  *			generation after resume from suspend.
+  * @ulpi_ext_vbus_drv: Set to confiure the upli chip to drives CPEN pin
+  *			VBUS with an external supply.
++ * @enh_nak_fs_quirk: Set to schedule more handshakes to Async FS endpoints.
++ * @enh_nak_hs_quirk: Set to schedule more handshakes to Async HS endpoints.
+  * @parkmode_disable_ss_quirk: If set, disable park mode feature for all
+  *			Superspeed instances.
+  * @parkmode_disable_hs_quirk: If set, disable park mode feature for all
+@@ -1382,6 +1386,8 @@ struct dwc3 {
+ 	unsigned		dis_tx_ipgap_linecheck_quirk:1;
+ 	unsigned		resume_hs_terminations:1;
+ 	unsigned		ulpi_ext_vbus_drv:1;
++	unsigned		enh_nak_fs_quirk:1;
++	unsigned		enh_nak_hs_quirk:1;
+ 	unsigned		parkmode_disable_ss_quirk:1;
+ 	unsigned		parkmode_disable_hs_quirk:1;
+ 	unsigned		parkmode_disable_fsls_quirk:1;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0527-drivers-usb-xhci-prevent-a-theoretical-race-on-non-c.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0527-drivers-usb-xhci-prevent-a-theoretical-race-on-non-c.patch
new file mode 100644
index 00000000..8810adb7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0527-drivers-usb-xhci-prevent-a-theoretical-race-on-non-c.patch
@@ -0,0 +1,50 @@
+From dde2d6b66d9757d73a1a0e39f8e24231cdb6e187 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 6 Nov 2024 11:07:55 +0000
+Subject: [PATCH 527/697] drivers: usb: xhci: prevent a theoretical race on
+ non-coherent platforms
+
+For platforms that have xHCI controllers attached over PCIe, and
+non-coherent routes to main memory, a theoretical race exists between
+posting new TRBs to a ring, and writing to the doorbell register.
+
+In a contended system, write traffic from the CPU may be stalled before
+the memory controller, whereas the CPU to Endpoint route is separate
+and not likely to be contended. Similarly, the DMA route from the
+endpoint to main memory may be separate and uncontended.
+
+Therefore the xHCI can receive a doorbell write and find a stale view
+of a transfer ring. In cases where only a single TRB is ping-ponged at
+a time, this can cause the endpoint to not get polled at all.
+
+Adding a readl() before the write forces a round-trip transaction
+across PCIe, definitively serialising the CPU along the PCI
+producer-consumer ordering rules.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/host/xhci-ring.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -509,6 +509,19 @@ void xhci_ring_ep_doorbell(struct xhci_h
+ 
+ 	trace_xhci_ring_ep_doorbell(slot_id, DB_VALUE(ep_index, stream_id));
+ 
++	/*
++	 * For non-coherent systems with PCIe DMA (such as Pi 4, Pi 5) there
++	 * is a theoretical race between the TRB write and barrier, which
++	 * is reported complete as soon as the write leaves the CPU domain,
++	 * the doorbell write, which may be reported as complete by the RC
++	 * at some arbitrary point, and the visibility of new TRBs in system
++	 * RAM by the endpoint DMA engine.
++	 *
++	 * This read before the write positively serialises the CPU state
++	 * by incurring a round-trip across the link.
++	 */
++	readl(db_addr);
++
+ 	writel(DB_VALUE(ep_index, stream_id), db_addr);
+ 	/* flush the write */
+ 	readl(db_addr);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0528-iio-humidity-dht11-Allow-non-zero-decimals.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0528-iio-humidity-dht11-Allow-non-zero-decimals.patch
new file mode 100644
index 00000000..23599d6d
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0528-iio-humidity-dht11-Allow-non-zero-decimals.patch
@@ -0,0 +1,32 @@
+From b1497979b41bc6e5e7ae391b99e0eeb91f5a318a Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 4 Nov 2024 14:10:53 +0000
+Subject: [PATCH 528/697] iio: humidity: dht11: Allow non-zero decimals
+
+The DHT11 datasheet is pretty cryptic, but it does suggest that after
+each integer value (humidity and temperature) there are "decimal"
+values. Validate these as integers in the range 0-9 and treat them as
+tenths of a unit.
+
+Link: https://github.com/raspberrypi/linux/issues/6220
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/iio/humidity/dht11.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/iio/humidity/dht11.c
++++ b/drivers/iio/humidity/dht11.c
+@@ -152,9 +152,9 @@ static int dht11_decode(struct dht11 *dh
+ 		dht11->temperature = (((temp_int & 0x7f) << 8) + temp_dec) *
+ 					((temp_int & 0x80) ? -100 : 100);
+ 		dht11->humidity = ((hum_int << 8) + hum_dec) * 100;
+-	} else if (temp_dec == 0 && hum_dec == 0) {  /* DHT11 */
+-		dht11->temperature = temp_int * 1000;
+-		dht11->humidity = hum_int * 1000;
++	} else if (temp_dec < 10 && hum_dec < 10) {  /* DHT11 */
++		dht11->temperature = temp_int * 1000 + temp_dec * 100;
++		dht11->humidity = hum_int * 1000 + hum_dec * 100;
+ 	} else {
+ 		dev_err(dht11->dev,
+ 			"Don't know how to decode data: %d %d %d %d\n",
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0529-drm-Set-non-desktop-property-to-true-for-writeback-a.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0529-drm-Set-non-desktop-property-to-true-for-writeback-a.patch
new file mode 100644
index 00000000..8dc1b5d9
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0529-drm-Set-non-desktop-property-to-true-for-writeback-a.patch
@@ -0,0 +1,30 @@
+From 3ba21aa757ce7dce0735f8f14888550876968d14 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 20 Aug 2024 16:25:10 +0100
+Subject: [PATCH 529/697] drm: Set non-desktop property to true for writeback
+ and virtual connectors
+
+The non-desktop property "Indicates the output should be ignored for
+purposes of displaying a standard desktop environment or console."
+
+That sounds like it should be true for all writeback and virtual
+connectors as you shouldn't render a desktop to them, so set it
+by default.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/drm_connector.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_connector.c
++++ b/drivers/gpu/drm/drm_connector.c
+@@ -362,7 +362,8 @@ static int __drm_connector_init(struct d
+ 
+ 	drm_object_attach_property(&connector->base,
+ 				   config->non_desktop_property,
+-				   0);
++				   (connector_type != DRM_MODE_CONNECTOR_VIRTUAL &&
++				   connector_type != DRM_MODE_CONNECTOR_WRITEBACK) ? 0 : 1);
+ 	drm_object_attach_property(&connector->base,
+ 				   config->tile_property,
+ 				   0);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0530-drm-Increase-plane_mask-to-64bit.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0530-drm-Increase-plane_mask-to-64bit.patch
new file mode 100644
index 00000000..c64ec86d
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0530-drm-Increase-plane_mask-to-64bit.patch
@@ -0,0 +1,101 @@
+From 6c10d71fcb16c8c4c759ac4fa28e4b36fdd6eb12 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 21 Oct 2022 14:26:12 +0100
+Subject: [PATCH 530/697] drm: Increase plane_mask to 64bit.
+
+The limit of 32 planes per DRM device is dictated by the use
+of planes_mask returning a u32.
+
+Change to a u64 such that 64 planes can be supported by a device.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/drm_atomic.c           | 2 +-
+ drivers/gpu/drm/drm_framebuffer.c      | 2 +-
+ drivers/gpu/drm/drm_mode_config.c      | 2 +-
+ drivers/gpu/drm/drm_plane.c            | 2 +-
+ drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c | 2 +-
+ include/drm/drm_crtc.h                 | 2 +-
+ include/drm/drm_plane.h                | 4 ++--
+ 7 files changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/drm_atomic.c
++++ b/drivers/gpu/drm/drm_atomic.c
+@@ -449,7 +449,7 @@ static void drm_atomic_crtc_print_state(
+ 	drm_printf(p, "\tactive_changed=%d\n", state->active_changed);
+ 	drm_printf(p, "\tconnectors_changed=%d\n", state->connectors_changed);
+ 	drm_printf(p, "\tcolor_mgmt_changed=%d\n", state->color_mgmt_changed);
+-	drm_printf(p, "\tplane_mask=%x\n", state->plane_mask);
++	drm_printf(p, "\tplane_mask=%llx\n", state->plane_mask);
+ 	drm_printf(p, "\tconnector_mask=%x\n", state->connector_mask);
+ 	drm_printf(p, "\tencoder_mask=%x\n", state->encoder_mask);
+ 	drm_printf(p, "\tmode: " DRM_MODE_FMT "\n", DRM_MODE_ARG(&state->mode));
+--- a/drivers/gpu/drm/drm_framebuffer.c
++++ b/drivers/gpu/drm/drm_framebuffer.c
+@@ -975,7 +975,7 @@ static int atomic_remove_fb(struct drm_f
+ 	struct drm_connector *conn __maybe_unused;
+ 	struct drm_connector_state *conn_state;
+ 	int i, ret;
+-	unsigned plane_mask;
++	u64 plane_mask;
+ 	bool disable_crtcs = false;
+ 
+ retry_disable:
+--- a/drivers/gpu/drm/drm_mode_config.c
++++ b/drivers/gpu/drm/drm_mode_config.c
+@@ -643,7 +643,7 @@ void drm_mode_config_validate(struct drm
+ 	struct drm_encoder *encoder;
+ 	struct drm_crtc *crtc;
+ 	struct drm_plane *plane;
+-	u32 primary_with_crtc = 0, cursor_with_crtc = 0;
++	u64 primary_with_crtc = 0, cursor_with_crtc = 0;
+ 	unsigned int num_primary = 0;
+ 
+ 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
+--- a/drivers/gpu/drm/drm_plane.c
++++ b/drivers/gpu/drm/drm_plane.c
+@@ -365,7 +365,7 @@ static int __drm_universal_plane_init(st
+ 	int ret;
+ 
+ 	/* plane index is used with 32bit bitmasks */
+-	if (WARN_ON(config->num_total_plane >= 32))
++	if (WARN_ON(config->num_total_plane >= 64))
+ 		return -EINVAL;
+ 
+ 	/*
+--- a/drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c
++++ b/drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c
+@@ -230,7 +230,7 @@ static int ipu_crtc_atomic_check(struct
+ {
+ 	struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state,
+ 									  crtc);
+-	u32 primary_plane_mask = drm_plane_mask(crtc->primary);
++	u64 primary_plane_mask = drm_plane_mask(crtc->primary);
+ 
+ 	if (crtc_state->active && (primary_plane_mask & crtc_state->plane_mask) == 0)
+ 		return -EINVAL;
+--- a/include/drm/drm_crtc.h
++++ b/include/drm/drm_crtc.h
+@@ -192,7 +192,7 @@ struct drm_crtc_state {
+ 	 * @plane_mask: Bitmask of drm_plane_mask(plane) of planes attached to
+ 	 * this CRTC.
+ 	 */
+-	u32 plane_mask;
++	u64 plane_mask;
+ 
+ 	/**
+ 	 * @connector_mask: Bitmask of drm_connector_mask(connector) of
+--- a/include/drm/drm_plane.h
++++ b/include/drm/drm_plane.h
+@@ -938,9 +938,9 @@ static inline unsigned int drm_plane_ind
+  * drm_plane_mask - find the mask of a registered plane
+  * @plane: plane to find mask for
+  */
+-static inline u32 drm_plane_mask(const struct drm_plane *plane)
++static inline u64 drm_plane_mask(const struct drm_plane *plane)
+ {
+-	return 1 << drm_plane_index(plane);
++	return 1ULL << drm_plane_index(plane);
+ }
+ 
+ struct drm_plane * drm_plane_from_index(struct drm_device *dev, int idx);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0531-drm-Add-a-DRM_MODE_TRANSPOSE-option-to-the-DRM-rotat.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0531-drm-Add-a-DRM_MODE_TRANSPOSE-option-to-the-DRM-rotat.patch
new file mode 100644
index 00000000..da8935ba
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0531-drm-Add-a-DRM_MODE_TRANSPOSE-option-to-the-DRM-rotat.patch
@@ -0,0 +1,47 @@
+From 13773d71a079a52a5847144d7a59ce072ceaa575 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 22 Oct 2024 17:17:31 +0100
+Subject: [PATCH 531/697] drm: Add a DRM_MODE_TRANSPOSE option to the DRM
+ rotation property
+
+Some hardware will implement transpose as a rotation operation,
+which when combined with X and Y reflect can result in a rotation,
+but is a discrete operation in its own right.
+
+Add an option for transpose only.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/drm_blend.c | 3 +++
+ include/uapi/drm/drm_mode.h | 1 +
+ 2 files changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/drm_blend.c
++++ b/drivers/gpu/drm/drm_blend.c
+@@ -263,6 +263,8 @@ EXPORT_SYMBOL(drm_plane_create_alpha_pro
+  * 	"reflect-x"
+  * DRM_MODE_REFLECT_Y:
+  * 	"reflect-y"
++ * DRM_MODE_TRANSPOSE:
++ * 	"transpose"
+  *
+  * Rotation is the specified amount in degrees in counter clockwise direction,
+  * the X and Y axis are within the source rectangle, i.e.  the X/Y axis before
+@@ -280,6 +282,7 @@ int drm_plane_create_rotation_property(s
+ 		{ __builtin_ffs(DRM_MODE_ROTATE_270) - 1, "rotate-270" },
+ 		{ __builtin_ffs(DRM_MODE_REFLECT_X) - 1,  "reflect-x" },
+ 		{ __builtin_ffs(DRM_MODE_REFLECT_Y) - 1,  "reflect-y" },
++		{ __builtin_ffs(DRM_MODE_TRANSPOSE) - 1,  "transpose" },
+ 	};
+ 	struct drm_property *prop;
+ 
+--- a/include/uapi/drm/drm_mode.h
++++ b/include/uapi/drm/drm_mode.h
+@@ -203,6 +203,7 @@ extern "C" {
+  */
+ #define DRM_MODE_REFLECT_X      (1<<4)
+ #define DRM_MODE_REFLECT_Y      (1<<5)
++#define DRM_MODE_TRANSPOSE      (1<<6)
+ 
+ /*
+  * DRM_MODE_REFLECT_MASK
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0532-drm-Add-a-rotation-parameter-to-connectors.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0532-drm-Add-a-rotation-parameter-to-connectors.patch
new file mode 100644
index 00000000..cd24a158
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0532-drm-Add-a-rotation-parameter-to-connectors.patch
@@ -0,0 +1,164 @@
+From d8c8ffb64675f2207c0568577eaa17b5b46f6e9a Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 22 Oct 2024 17:22:40 +0100
+Subject: [PATCH 532/697] drm: Add a rotation parameter to connectors.
+
+Some connectors, particularly writeback, can implement flip
+or transpose operations as writing back to memory.
+
+Add a connector rotation property to control this.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/drm_atomic_uapi.c |  4 +++
+ drivers/gpu/drm/drm_blend.c       | 50 ++++++++++++++++++++++++-------
+ include/drm/drm_blend.h           |  5 ++++
+ include/drm/drm_connector.h       | 11 +++++++
+ 4 files changed, 60 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/drm_atomic_uapi.c
++++ b/drivers/gpu/drm/drm_atomic_uapi.c
+@@ -791,6 +791,8 @@ static int drm_atomic_connector_set_prop
+ 		state->privacy_screen_sw_state = val;
+ 	} else if (property == connector->broadcast_rgb_property) {
+ 		state->hdmi.broadcast_rgb = val;
++	} else if (property == connector->rotation_property) {
++		state->rotation = val;
+ 	} else if (connector->funcs->atomic_set_property) {
+ 		return connector->funcs->atomic_set_property(connector,
+ 				state, property, val);
+@@ -882,6 +884,8 @@ drm_atomic_connector_get_property(struct
+ 		*val = state->privacy_screen_sw_state;
+ 	} else if (property == connector->broadcast_rgb_property) {
+ 		*val = state->hdmi.broadcast_rgb;
++	} else if (property == connector->rotation_property) {
++		*val = state->rotation;
+ 	} else if (connector->funcs->atomic_get_property) {
+ 		return connector->funcs->atomic_get_property(connector,
+ 				state, property, val);
+--- a/drivers/gpu/drm/drm_blend.c
++++ b/drivers/gpu/drm/drm_blend.c
+@@ -235,6 +235,16 @@ int drm_plane_create_alpha_property(stru
+ }
+ EXPORT_SYMBOL(drm_plane_create_alpha_property);
+ 
++static const struct drm_prop_enum_list drm_rotate_props[] = {
++	{ __builtin_ffs(DRM_MODE_ROTATE_0) - 1,   "rotate-0" },
++	{ __builtin_ffs(DRM_MODE_ROTATE_90) - 1,  "rotate-90" },
++	{ __builtin_ffs(DRM_MODE_ROTATE_180) - 1, "rotate-180" },
++	{ __builtin_ffs(DRM_MODE_ROTATE_270) - 1, "rotate-270" },
++	{ __builtin_ffs(DRM_MODE_REFLECT_X) - 1,  "reflect-x" },
++	{ __builtin_ffs(DRM_MODE_REFLECT_Y) - 1,  "reflect-y" },
++	{ __builtin_ffs(DRM_MODE_TRANSPOSE) - 1,  "transpose" },
++};
++
+ /**
+  * drm_plane_create_rotation_property - create a new rotation property
+  * @plane: drm plane
+@@ -275,15 +285,6 @@ int drm_plane_create_rotation_property(s
+ 				       unsigned int rotation,
+ 				       unsigned int supported_rotations)
+ {
+-	static const struct drm_prop_enum_list props[] = {
+-		{ __builtin_ffs(DRM_MODE_ROTATE_0) - 1,   "rotate-0" },
+-		{ __builtin_ffs(DRM_MODE_ROTATE_90) - 1,  "rotate-90" },
+-		{ __builtin_ffs(DRM_MODE_ROTATE_180) - 1, "rotate-180" },
+-		{ __builtin_ffs(DRM_MODE_ROTATE_270) - 1, "rotate-270" },
+-		{ __builtin_ffs(DRM_MODE_REFLECT_X) - 1,  "reflect-x" },
+-		{ __builtin_ffs(DRM_MODE_REFLECT_Y) - 1,  "reflect-y" },
+-		{ __builtin_ffs(DRM_MODE_TRANSPOSE) - 1,  "transpose" },
+-	};
+ 	struct drm_property *prop;
+ 
+ 	WARN_ON((supported_rotations & DRM_MODE_ROTATE_MASK) == 0);
+@@ -291,7 +292,8 @@ int drm_plane_create_rotation_property(s
+ 	WARN_ON(rotation & ~supported_rotations);
+ 
+ 	prop = drm_property_create_bitmask(plane->dev, 0, "rotation",
+-					   props, ARRAY_SIZE(props),
++					   drm_rotate_props,
++					   ARRAY_SIZE(drm_rotate_props),
+ 					   supported_rotations);
+ 	if (!prop)
+ 		return -ENOMEM;
+@@ -307,6 +309,34 @@ int drm_plane_create_rotation_property(s
+ }
+ EXPORT_SYMBOL(drm_plane_create_rotation_property);
+ 
++int drm_connector_create_rotation_property(struct drm_connector *conn,
++					   unsigned int rotation,
++					   unsigned int supported_rotations)
++{
++	struct drm_property *prop;
++
++	WARN_ON((supported_rotations & DRM_MODE_ROTATE_MASK) == 0);
++	WARN_ON(!is_power_of_2(rotation & DRM_MODE_ROTATE_MASK));
++	WARN_ON(rotation & ~supported_rotations);
++
++	prop = drm_property_create_bitmask(conn->dev, 0, "rotation",
++					   drm_rotate_props,
++					   ARRAY_SIZE(drm_rotate_props),
++					   supported_rotations);
++	if (!prop)
++		return -ENOMEM;
++
++	drm_object_attach_property(&conn->base, prop, rotation);
++
++	if (conn->state)
++		conn->state->rotation = rotation;
++
++	conn->rotation_property = prop;
++
++	return 0;
++}
++EXPORT_SYMBOL(drm_connector_create_rotation_property);
++
+ /**
+  * drm_rotation_simplify() - Try to simplify the rotation
+  * @rotation: Rotation to be simplified
+--- a/include/drm/drm_blend.h
++++ b/include/drm/drm_blend.h
+@@ -34,6 +34,7 @@
+ struct drm_device;
+ struct drm_atomic_state;
+ struct drm_plane;
++struct drm_connector;
+ 
+ static inline bool drm_rotation_90_or_270(unsigned int rotation)
+ {
+@@ -58,4 +59,8 @@ int drm_atomic_normalize_zpos(struct drm
+ 			      struct drm_atomic_state *state);
+ int drm_plane_create_blend_mode_property(struct drm_plane *plane,
+ 					 unsigned int supported_modes);
++
++int drm_connector_create_rotation_property(struct drm_connector *conn,
++					   unsigned int rotation,
++					   unsigned int supported_rotations);
+ #endif
+--- a/include/drm/drm_connector.h
++++ b/include/drm/drm_connector.h
+@@ -1139,6 +1139,11 @@ struct drm_connector_state {
+ 	 * @drm_atomic_helper_connector_hdmi_check().
+ 	 */
+ 	struct drm_connector_hdmi_state hdmi;
++
++	/**
++	 * @rotation: Connector property to rotate the maximum output image.
++	 */
++	u32 rotation;
+ };
+ 
+ /**
+@@ -1926,6 +1931,12 @@ struct drm_connector {
+ 	 */
+ 	struct drm_property *broadcast_rgb_property;
+ 
++	/**
++	 * @rotation_property: Optional DRM property controlling rotation of the
++	 * output.
++	 */
++	struct drm_property *rotation_property;
++
+ #define DRM_CONNECTOR_POLL_HPD (1 << 0)
+ #define DRM_CONNECTOR_POLL_CONNECT (1 << 1)
+ #define DRM_CONNECTOR_POLL_DISCONNECT (1 << 2)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0533-dmaengine-dw-axi-dmac-Allow-client-chosen-width.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0533-dmaengine-dw-axi-dmac-Allow-client-chosen-width.patch
new file mode 100644
index 00000000..45fdeed0
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0533-dmaengine-dw-axi-dmac-Allow-client-chosen-width.patch
@@ -0,0 +1,40 @@
+From 1027fcaf5dcef34c5ab2833dc91ab455ec97cf52 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 19 Sep 2024 18:05:00 +0100
+Subject: [PATCH 533/697] dmaengine: dw-axi-dmac: Allow client-chosen width
+
+For devices where transfer lengths are not known upfront, there is a
+danger when the destination is wider than the source that partial words
+can be lost at the end of a transfer. Ideally the controller would be
+able to flush the residue, but it can't - it's not even possible to tell
+that there is any.
+
+Instead, allow the client driver to avoid the problem by setting a
+smaller width.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
++++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+@@ -771,6 +771,18 @@ static int dw_axi_dma_set_hw_desc(struct
+ 	case DMA_DEV_TO_MEM:
+ 		reg_burst_msize = axi_dma_encode_msize(chan->config.src_maxburst);
+ 		reg_width = __ffs(chan->config.src_addr_width);
++		/*
++		 * For devices where transfer lengths are not known upfront,
++		 * there is a danger when the destination is wider than the
++		 * source that partial words can be lost at the end of a transfer.
++		 * Ideally the controller would be able to flush the residue, but
++		 * it can't - it's not even possible to tell that there is any.
++		 * Instead, allow the client driver to avoid the problem by setting
++		 * a smaller width.
++		 */
++		if (chan->config.dst_addr_width &&
++		    (chan->config.dst_addr_width < mem_width))
++			mem_width = chan->config.dst_addr_width;
+ 		device_addr = phys_to_dma(chan->chip->dev, chan->config.src_addr);
+ 		ctllo = reg_width << CH_CTL_L_SRC_WIDTH_POS |
+ 			mem_width << CH_CTL_L_DST_WIDTH_POS |
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0534-spi-dw-Let-the-DMAC-set-the-transfer-widths.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0534-spi-dw-Let-the-DMAC-set-the-transfer-widths.patch
new file mode 100644
index 00000000..e9c7278b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0534-spi-dw-Let-the-DMAC-set-the-transfer-widths.patch
@@ -0,0 +1,31 @@
+From ac4eff62ec8b90d5d1ee620f2724dc2cddbc5b1f Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 19 Sep 2024 18:12:12 +0100
+Subject: [PATCH 534/697] spi: dw: Let the DMAC set the transfer widths
+
+SPI transfers are of defined length, unlike some UART traffic, so it is
+safe to let the DMA controller choose a suitable memory width.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/spi/spi-dw-dma.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/spi/spi-dw-dma.c
++++ b/drivers/spi/spi-dw-dma.c
+@@ -330,7 +330,6 @@ static int dw_spi_dma_config_tx(struct d
+ 	txconf.direction = DMA_MEM_TO_DEV;
+ 	txconf.dst_addr = dws->dma_addr;
+ 	txconf.dst_maxburst = dws->txburst;
+-	txconf.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+ 	txconf.dst_addr_width = dw_spi_dma_convert_width(dws->n_bytes);
+ 	txconf.device_fc = false;
+ 
+@@ -431,7 +430,6 @@ static int dw_spi_dma_config_rx(struct d
+ 	rxconf.direction = DMA_DEV_TO_MEM;
+ 	rxconf.src_addr = dws->dma_addr;
+ 	rxconf.src_maxburst = dws->rxburst;
+-	rxconf.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+ 	rxconf.src_addr_width = dw_spi_dma_convert_width(dws->n_bytes);
+ 	rxconf.device_fc = false;
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0535-serial-pl011-Request-a-memory-width-of-1-byte.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0535-serial-pl011-Request-a-memory-width-of-1-byte.patch
new file mode 100644
index 00000000..3e2bddf0
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0535-serial-pl011-Request-a-memory-width-of-1-byte.patch
@@ -0,0 +1,25 @@
+From ed20f1ed7da6fd1c5e2eb8aa283c229fa34782db Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 19 Sep 2024 18:22:24 +0100
+Subject: [PATCH 535/697] serial: pl011: Request a memory width of 1 byte
+
+In order to avoid losing residue bytes when a receive is terminated
+early, set the destination width to single bytes.
+
+Link: https://github.com/raspberrypi/linux/issues/6365
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/tty/serial/amba-pl011.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -465,6 +465,7 @@ static void pl011_dma_probe(struct uart_
+ 			.src_addr = uap->port.mapbase +
+ 				pl011_reg_to_offset(uap, REG_DR),
+ 			.src_addr_width = DMA_SLAVE_BUSWIDTH_1_BYTE,
++			.dst_addr_width = DMA_SLAVE_BUSWIDTH_1_BYTE,
+ 			.direction = DMA_DEV_TO_MEM,
+ 			.src_maxburst = uap->fifosize >> 2,
+ 			.device_fc = false,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0536-drivers-usb-xhci-set-HID-bit-in-streaming-endpoint-c.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0536-drivers-usb-xhci-set-HID-bit-in-streaming-endpoint-c.patch
new file mode 100644
index 00000000..a7926843
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0536-drivers-usb-xhci-set-HID-bit-in-streaming-endpoint-c.patch
@@ -0,0 +1,56 @@
+From c2c38772ce711166e27582f8fc75cef6aa8b2932 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Mon, 11 Nov 2024 10:30:38 +0000
+Subject: [PATCH 536/697] drivers: usb: xhci: set HID bit in streaming endpoint
+ contexts
+
+The xHC may commence Host Initiated Data Moves for streaming endpoints -
+see USB3.2 spec s8.12.1.4.2.4. However, this behaviour is typically
+counterproductive as the submission of UAS URBs in {Status, Data,
+Command} order and 1 outstanding IO per stream ID means the device never
+enters Move Data after a HIMD for Status or Data stages with the same
+stream ID. For OUT transfers this is especially inefficient as the host
+will start transmitting multiple bulk packets as a burst, all of which
+get NAKed by the device - wasting bandwidth.
+
+Also, some buggy UAS adapters don't properly handle the EP flow control
+state this creates - e.g. RTL9210.
+
+Set Host Initiated Data Move Disable to always defer stream selection to
+the device. xHC implementations may treat this field as "don't care,
+forced to 1" anyway - xHCI 1.2 s4.12.1.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/host/xhci-mem.c | 8 ++++++++
+ drivers/usb/host/xhci.h     | 2 ++
+ 2 files changed, 10 insertions(+)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -715,6 +715,14 @@ void xhci_setup_streams_ep_input_ctx(str
+ 	ep_ctx->ep_info &= cpu_to_le32(~EP_MAXPSTREAMS_MASK);
+ 	ep_ctx->ep_info |= cpu_to_le32(EP_MAXPSTREAMS(max_primary_streams)
+ 				       | EP_HAS_LSA);
++
++	/*
++	 * Set Host Initiated Data Move Disable to always defer stream
++	 * selection to the device. xHC implementations may treat this
++	 * field as "don't care, forced to 1" anyway - xHCI 1.2 s4.12.1.
++	 */
++	ep_ctx->ep_info2 |= EP_HID;
++
+ 	ep_ctx->deq  = cpu_to_le64(stream_info->ctx_array_dma);
+ }
+ 
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -465,6 +465,8 @@ struct xhci_ep_ctx {
+ #define CTX_TO_EP_MAXPSTREAMS(p)	(((p) & EP_MAXPSTREAMS_MASK) >> 10)
+ /* Endpoint is set up with a Linear Stream Array (vs. Secondary Stream Array) */
+ #define	EP_HAS_LSA		(1 << 15)
++/* Host initiated data move disable in info2 */
++#define EP_HID			(1 << 7)
+ /* hosts with LEC=1 use bits 31:24 as ESIT high bits. */
+ #define CTX_TO_MAX_ESIT_PAYLOAD_HI(p)	(((p) >> 24) & 0xff)
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0537-media-i2c-imx477-Add-options-for-slightly-modifying-.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0537-media-i2c-imx477-Add-options-for-slightly-modifying-.patch
new file mode 100644
index 00000000..6897fde5
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0537-media-i2c-imx477-Add-options-for-slightly-modifying-.patch
@@ -0,0 +1,199 @@
+From 8f97600e055bb89672ff90a9c1f96c26a4a59bb4 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 14 Nov 2024 13:14:02 +0000
+Subject: [PATCH 537/697] media: i2c: imx477: Add options for slightly
+ modifying the link freq
+
+The default link frequency of 450MHz has been noted to interfere
+with GPS if they are in close proximty.
+Add the option for 453 and 456MHz to move the signal slightly out
+of the band. (447MHz can not be offered as corruption is then observed
+on the 133x992 10bit mode).
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+fixup imx477 gps
+---
+ drivers/media/i2c/imx477.c | 86 +++++++++++++++++++++++++++++---------
+ 1 file changed, 67 insertions(+), 19 deletions(-)
+
+--- a/drivers/media/i2c/imx477.c
++++ b/drivers/media/i2c/imx477.c
+@@ -164,8 +164,48 @@ struct imx477_mode {
+ 	struct imx477_reg_list reg_list;
+ };
+ 
+-static const s64 imx477_link_freq_menu[] = {
+-	IMX477_DEFAULT_LINK_FREQ,
++/* Link frequency setup */
++enum {
++	IMX477_LINK_FREQ_450MHZ,
++	IMX477_LINK_FREQ_453MHZ,
++	IMX477_LINK_FREQ_456MHZ,
++};
++
++static const s64 link_freqs[] = {
++	[IMX477_LINK_FREQ_450MHZ] = 450000000,
++	[IMX477_LINK_FREQ_453MHZ] = 453000000,
++	[IMX477_LINK_FREQ_456MHZ] = 456000000,
++};
++
++/* 450MHz is the nominal "default" link frequency */
++static const struct imx477_reg link_450Mhz_regs[] = {
++	{0x030E, 0x00},
++	{0x030F, 0x96},
++};
++
++static const struct imx477_reg link_453Mhz_regs[] = {
++	{0x030E, 0x00},
++	{0x030F, 0x97},
++};
++
++static const struct imx477_reg link_456Mhz_regs[] = {
++	{0x030E, 0x00},
++	{0x030F, 0x98},
++};
++
++static const struct imx477_reg_list link_freq_regs[] = {
++	[IMX477_LINK_FREQ_450MHZ] = {
++		.regs = link_450Mhz_regs,
++		.num_of_regs = ARRAY_SIZE(link_450Mhz_regs)
++	},
++	[IMX477_LINK_FREQ_453MHZ] = {
++		.regs = link_453Mhz_regs,
++		.num_of_regs = ARRAY_SIZE(link_453Mhz_regs)
++	},
++	[IMX477_LINK_FREQ_456MHZ] = {
++		.regs = link_456Mhz_regs,
++		.num_of_regs = ARRAY_SIZE(link_456Mhz_regs)
++	},
+ };
+ 
+ static const struct imx477_reg mode_common_regs[] = {
+@@ -558,8 +598,6 @@ static const struct imx477_reg mode_4056
+ 	{0x0309, 0x0c},
+ 	{0x030b, 0x02},
+ 	{0x030d, 0x02},
+-	{0x030e, 0x00},
+-	{0x030f, 0x96},
+ 	{0x0310, 0x01},
+ 	{0x0820, 0x07},
+ 	{0x0821, 0x08},
+@@ -659,8 +697,6 @@ static const struct imx477_reg mode_2028
+ 	{0x0309, 0x0c},
+ 	{0x030b, 0x02},
+ 	{0x030d, 0x02},
+-	{0x030e, 0x00},
+-	{0x030f, 0x96},
+ 	{0x0310, 0x01},
+ 	{0x0820, 0x07},
+ 	{0x0821, 0x08},
+@@ -760,8 +796,6 @@ static const struct imx477_reg mode_2028
+ 	{0x0309, 0x0c},
+ 	{0x030b, 0x02},
+ 	{0x030d, 0x02},
+-	{0x030e, 0x00},
+-	{0x030f, 0x96},
+ 	{0x0310, 0x01},
+ 	{0x0820, 0x07},
+ 	{0x0821, 0x08},
+@@ -890,8 +924,6 @@ static const struct imx477_reg mode_1332
+ 	{0x0309, 0x0a},
+ 	{0x030b, 0x02},
+ 	{0x030d, 0x02},
+-	{0x030e, 0x00},
+-	{0x030f, 0x96},
+ 	{0x0310, 0x01},
+ 	{0x0820, 0x07},
+ 	{0x0821, 0x08},
+@@ -1121,6 +1153,8 @@ struct imx477 {
+ 	struct v4l2_ctrl *vblank;
+ 	struct v4l2_ctrl *hblank;
+ 
++	unsigned int link_freq_idx;
++
+ 	/* Current mode */
+ 	const struct imx477_mode *mode;
+ 
+@@ -1712,7 +1746,7 @@ static int imx477_get_selection(struct v
+ static int imx477_start_streaming(struct imx477 *imx477)
+ {
+ 	struct i2c_client *client = v4l2_get_subdevdata(&imx477->sd);
+-	const struct imx477_reg_list *reg_list;
++	const struct imx477_reg_list *reg_list, *freq_regs;
+ 	const struct imx477_reg_list *extra_regs;
+ 	int ret, tm;
+ 
+@@ -1725,6 +1759,13 @@ static int imx477_start_streaming(struct
+ 						extra_regs->num_of_regs);
+ 		}
+ 
++		if (!ret) {
++			/* Update the link frequency registers */
++			freq_regs = &link_freq_regs[imx477->link_freq_idx];
++			ret = imx477_write_regs(imx477, freq_regs->regs,
++						freq_regs->num_of_regs);
++		}
++
+ 		if (ret) {
+ 			dev_err(&client->dev, "%s failed to set common settings\n",
+ 				__func__);
+@@ -2010,9 +2051,8 @@ static int imx477_init_controls(struct i
+ 	/* LINK_FREQ is also read only */
+ 	imx477->link_freq =
+ 		v4l2_ctrl_new_int_menu(ctrl_hdlr, &imx477_ctrl_ops,
+-				       V4L2_CID_LINK_FREQ,
+-				       ARRAY_SIZE(imx477_link_freq_menu) - 1, 0,
+-				       imx477_link_freq_menu);
++				       V4L2_CID_LINK_FREQ, 1, 0,
++				       &link_freqs[imx477->link_freq_idx]);
+ 	if (imx477->link_freq)
+ 		imx477->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+ 
+@@ -2110,13 +2150,14 @@ static void imx477_free_controls(struct
+ 	mutex_destroy(&imx477->mutex);
+ }
+ 
+-static int imx477_check_hwcfg(struct device *dev)
++static int imx477_check_hwcfg(struct device *dev, struct imx477 *imx477)
+ {
+ 	struct fwnode_handle *endpoint;
+ 	struct v4l2_fwnode_endpoint ep_cfg = {
+ 		.bus_type = V4L2_MBUS_CSI2_DPHY
+ 	};
+ 	int ret = -EINVAL;
++	int i;
+ 
+ 	endpoint = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
+ 	if (!endpoint) {
+@@ -2141,11 +2182,18 @@ static int imx477_check_hwcfg(struct dev
+ 		goto error_out;
+ 	}
+ 
+-	if (ep_cfg.nr_of_link_frequencies != 1 ||
+-	    ep_cfg.link_frequencies[0] != IMX477_DEFAULT_LINK_FREQ) {
++	for (i = 0; i < ARRAY_SIZE(link_freqs); i++) {
++		if (link_freqs[i] == ep_cfg.link_frequencies[0]) {
++			imx477->link_freq_idx = i;
++			break;
++		}
++	}
++
++	if (i == ARRAY_SIZE(link_freqs)) {
+ 		dev_err(dev, "Link frequency not supported: %lld\n",
+ 			ep_cfg.link_frequencies[0]);
+-		goto error_out;
++			ret = -EINVAL;
++			goto error_out;
+ 	}
+ 
+ 	ret = 0;
+@@ -2206,7 +2254,7 @@ static int imx477_probe(struct i2c_clien
+ 		(const struct imx477_compatible_data *)match->data;
+ 
+ 	/* Check the hardware configuration in device tree */
+-	if (imx477_check_hwcfg(dev))
++	if (imx477_check_hwcfg(dev, imx477))
+ 		return -EINVAL;
+ 
+ 	/* Default the trigger mode from OF to -1, which means invalid */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0538-dtoverlays-Add-link-frequency-override-to-imx477-378.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0538-dtoverlays-Add-link-frequency-override-to-imx477-378.patch
new file mode 100644
index 00000000..1490211d
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0538-dtoverlays-Add-link-frequency-override-to-imx477-378.patch
@@ -0,0 +1,44 @@
+From 05a68e985fdd91b6b60f6cc4bf5d8edc507b8807 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 14 Nov 2024 13:15:24 +0000
+Subject: [PATCH 538/697] dtoverlays: Add link-frequency override to imx477/378
+ overlay
+
+Copy of the imx708 change.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README                  | 4 ++++
+ arch/arm/boot/dts/overlays/imx477_378-overlay.dtsi | 1 +
+ 2 files changed, 5 insertions(+)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -2812,6 +2812,8 @@ Params: rotation                Mounting
+                                 camera clamping I/Os such as XVS to 0V.
+         sync-source             Configure as vsync source
+         sync-sink               Configure as vsync sink
++        link-frequency          Allowable link frequency values to use in Hz:
++                                450000000 (default), 453000000, 456000000.
+ 
+ 
+ Name:   imx462
+@@ -2854,6 +2856,8 @@ Params: rotation                Mounting
+                                 camera clamping I/Os such as XVS to 0V.
+         sync-source             Configure as vsync source
+         sync-sink               Configure as vsync sink
++        link-frequency          Allowable link frequency values to use in Hz:
++                                450000000 (default), 453000000, 456000000.
+ 
+ 
+ Name:   imx500
+--- a/arch/arm/boot/dts/overlays/imx477_378-overlay.dtsi
++++ b/arch/arm/boot/dts/overlays/imx477_378-overlay.dtsi
+@@ -86,6 +86,7 @@
+ 		       <&cam_node>, "clocks:0=",<&cam0_clk>,
+ 		       <&cam_node>, "VANA-supply:0=",<&cam0_reg>;
+ 		always-on = <0>, "+99";
++		link-frequency = <&cam_endpoint>,"link-frequencies#0";
+ 	};
+ };
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0539-dmaengine-dw-axi-dmac-Only-start-idle-channels.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0539-dmaengine-dw-axi-dmac-Only-start-idle-channels.patch
new file mode 100644
index 00000000..a56463c1
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0539-dmaengine-dw-axi-dmac-Only-start-idle-channels.patch
@@ -0,0 +1,29 @@
+From 25687d21ebd0c8ab048f7eda021aff8422fe26f1 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 13 Nov 2024 10:37:22 +0000
+Subject: [PATCH 539/697] dmaengine: dw-axi-dmac: Only start idle channels
+
+Attempting to start a non-idle channel causes an error message to be
+logged, and is inefficient. Test for emptiness of the desc_issued list
+before doing so.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
++++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+@@ -583,9 +583,11 @@ static void dma_chan_issue_pending(struc
+ {
+ 	struct axi_dma_chan *chan = dchan_to_axi_dma_chan(dchan);
+ 	unsigned long flags;
++	bool was_empty;
+ 
+ 	spin_lock_irqsave(&chan->vc.lock, flags);
+-	if (vchan_issue_pending(&chan->vc))
++	was_empty = list_empty(&chan->vc.desc_issued);
++	if (vchan_issue_pending(&chan->vc) && was_empty)
+ 		axi_chan_start_first_queued(chan);
+ 	spin_unlock_irqrestore(&chan->vc.lock, flags);
+ }
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0540-mailbox-Add-RP1-mailbox-support.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0540-mailbox-Add-RP1-mailbox-support.patch
new file mode 100644
index 00000000..93e2042a
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0540-mailbox-Add-RP1-mailbox-support.patch
@@ -0,0 +1,252 @@
+From c3456722ee5502e51e00bfa899c7bdf012d7128f Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 31 Oct 2024 17:33:38 +0000
+Subject: [PATCH 540/697] mailbox: Add RP1 mailbox support
+
+The Raspberry Pi RP1 includes 2 M3 cores running firmware. This driver
+adds a mailbox communication channel to them via a doorbell and some
+shared memory.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/mailbox/Kconfig       |   9 ++
+ drivers/mailbox/Makefile      |   2 +
+ drivers/mailbox/rp1-mailbox.c | 208 ++++++++++++++++++++++++++++++++++
+ 3 files changed, 219 insertions(+)
+ create mode 100644 drivers/mailbox/rp1-mailbox.c
+
+--- a/drivers/mailbox/Kconfig
++++ b/drivers/mailbox/Kconfig
+@@ -295,4 +295,13 @@ config QCOM_IPCC
+ 	  acts as an interrupt controller for receiving interrupts from clients.
+ 	  Say Y here if you want to build this driver.
+ 
++config MBOX_RP1
++	tristate "RP1 Mailbox"
++	depends on MFD_RP1
++	help
++	  An implementation of a mailbox interface to the Raspberry Pi RP1 I/O
++	  interface. Although written as a mailbox driver, the hardware only
++	  provides an array of 32 doorbells.
++	  Say Y here if you want to use the RP1 Mailbox.
++
+ endif
+--- a/drivers/mailbox/Makefile
++++ b/drivers/mailbox/Makefile
+@@ -64,3 +64,5 @@ obj-$(CONFIG_SPRD_MBOX)		+= sprd-mailbox
+ obj-$(CONFIG_QCOM_CPUCP_MBOX)	+= qcom-cpucp-mbox.o
+ 
+ obj-$(CONFIG_QCOM_IPCC)		+= qcom-ipcc.o
++
++obj-$(CONFIG_MBOX_RP1)		+= rp1-mailbox.o
+--- /dev/null
++++ b/drivers/mailbox/rp1-mailbox.c
+@@ -0,0 +1,208 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ *  Copyright (C) 2023 Raspberry Pi Ltd.
++ *
++ * Parts of this driver are based on:
++ *  - bcm2835-mailbox.c
++ *    Copyright (C) 2010,2015 Broadcom
++ *    Copyright (C) 2013-2014 Lubomir Rintel
++ *    Copyright (C) 2013 Craig McGeachie
++ */
++
++#include <linux/compat.h>
++#include <linux/device.h>
++#include <linux/dma-mapping.h>
++#include <linux/err.h>
++#include <linux/interrupt.h>
++#include <linux/irq.h>
++#include <linux/kernel.h>
++#include <linux/mailbox_controller.h>
++#include <linux/miscdevice.h>
++#include <linux/module.h>
++#include <linux/of_address.h>
++#include <linux/of_irq.h>
++#include <linux/platform_device.h>
++
++/*
++ * RP1's PROC_EVENTS register can generate interrupts on the M3 cores (when
++ * enabled). The 32-bit register is treated as 32 events, all of which share a
++ * common interrupt. HOST_EVENTS is the same in the reverse direction.
++ */
++#define SYSCFG_PROC_EVENTS		0x00000008
++#define SYSCFG_HOST_EVENTS		0x0000000c
++#define SYSCFG_HOST_EVENT_IRQ_EN	0x00000010
++#define SYSCFG_HOST_EVENT_IRQ		0x00000014
++
++#define HW_SET_BITS			0x00002000
++#define HW_CLR_BITS			0x00003000
++
++#define MAX_CHANS	4 /* 32 is the hardware limit */
++
++struct rp1_mbox {
++	void __iomem *regs;
++	unsigned int irq;
++	struct mbox_controller controller;
++};
++
++static struct rp1_mbox *rp1_chan_mbox(struct mbox_chan *chan)
++{
++	return container_of(chan->mbox, struct rp1_mbox, controller);
++}
++
++static unsigned int rp1_chan_event(struct mbox_chan *chan)
++{
++	return (unsigned int)(uintptr_t)chan->con_priv;
++}
++
++static irqreturn_t rp1_mbox_irq(int irq, void *dev_id)
++{
++	struct rp1_mbox *mbox = dev_id;
++	struct mbox_chan *chan;
++	unsigned int doorbell;
++	unsigned int evs;
++
++	evs = readl(mbox->regs + SYSCFG_HOST_EVENT_IRQ);
++	writel(evs, mbox->regs + SYSCFG_HOST_EVENTS + HW_CLR_BITS);
++
++	while (evs) {
++		doorbell = __ffs(evs);
++		chan = &mbox->controller.chans[doorbell];
++		mbox_chan_received_data(chan, NULL);
++		evs &= ~(1 << doorbell);
++	}
++	return IRQ_HANDLED;
++}
++
++static int rp1_send_data(struct mbox_chan *chan, void *data)
++{
++	struct rp1_mbox *mbox = rp1_chan_mbox(chan);
++	unsigned int event = rp1_chan_event(chan);
++
++	writel(event, mbox->regs + SYSCFG_PROC_EVENTS + HW_SET_BITS);
++
++	return 0;
++}
++
++static int rp1_startup(struct mbox_chan *chan)
++{
++	struct rp1_mbox *mbox = rp1_chan_mbox(chan);
++	unsigned int event = rp1_chan_event(chan);
++
++	writel(event, mbox->regs + SYSCFG_HOST_EVENT_IRQ_EN + HW_SET_BITS);
++
++	return 0;
++}
++
++static void rp1_shutdown(struct mbox_chan *chan)
++{
++	struct rp1_mbox *mbox = rp1_chan_mbox(chan);
++	unsigned int event = rp1_chan_event(chan);
++
++	writel(event, mbox->regs + SYSCFG_HOST_EVENT_IRQ_EN + HW_CLR_BITS);
++}
++
++static bool rp1_last_tx_done(struct mbox_chan *chan)
++{
++	struct rp1_mbox *mbox = rp1_chan_mbox(chan);
++	unsigned int event = rp1_chan_event(chan);
++	unsigned int evs;
++
++	evs = readl(mbox->regs + SYSCFG_HOST_EVENT_IRQ);
++
++	return !(evs & event);
++}
++
++static const struct mbox_chan_ops rp1_mbox_chan_ops = {
++	.send_data	= rp1_send_data,
++	.startup	= rp1_startup,
++	.shutdown	= rp1_shutdown,
++	.last_tx_done	= rp1_last_tx_done
++};
++
++static struct mbox_chan *rp1_mbox_xlate(struct mbox_controller *mbox,
++					const struct of_phandle_args *spec)
++{
++	struct mbox_chan *chan;
++	unsigned int doorbell;
++
++	if (spec->args_count != 1)
++		return ERR_PTR(-EINVAL);
++
++	doorbell = spec->args[0];
++	if (doorbell >= MAX_CHANS)
++		return ERR_PTR(-EINVAL);
++
++	chan = &mbox->chans[doorbell];
++	if (chan->con_priv)
++		return ERR_PTR(-EBUSY);
++
++	chan->con_priv = (void *)(uintptr_t)(1 << doorbell);
++
++	return chan;
++}
++
++static int rp1_mbox_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct mbox_chan *chans;
++	struct rp1_mbox *mbox;
++	int ret = 0;
++
++	mbox = devm_kzalloc(dev, sizeof(*mbox), GFP_KERNEL);
++	if (mbox == NULL)
++		return -ENOMEM;
++
++	ret = devm_request_irq(dev, platform_get_irq(pdev, 0),
++			       rp1_mbox_irq, 0, dev_name(dev), mbox);
++	if (ret) {
++		dev_err(dev, "Failed to register a mailbox IRQ handler: %d\n",
++			ret);
++		return -ENODEV;
++	}
++
++	mbox->regs = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(mbox->regs)) {
++		ret = PTR_ERR(mbox->regs);
++		return ret;
++	}
++
++	chans = devm_kcalloc(dev, MAX_CHANS, sizeof(*chans), GFP_KERNEL);
++	if (!chans)
++		return -ENOMEM;
++
++	mbox->controller.txdone_poll = true;
++	mbox->controller.txpoll_period = 5;
++	mbox->controller.ops = &rp1_mbox_chan_ops;
++	mbox->controller.of_xlate = &rp1_mbox_xlate;
++	mbox->controller.dev = dev;
++	mbox->controller.num_chans = MAX_CHANS;
++	mbox->controller.chans = chans;
++
++	ret = devm_mbox_controller_register(dev, &mbox->controller);
++	if (ret)
++		return ret;
++
++	platform_set_drvdata(pdev, mbox);
++
++	return 0;
++}
++
++static const struct of_device_id rp1_mbox_of_match[] = {
++	{ .compatible = "raspberrypi,rp1-mbox", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, rp1_mbox_of_match);
++
++static struct platform_driver rp1_mbox_driver = {
++	.driver = {
++		.name = "rp1-mbox",
++		.of_match_table = rp1_mbox_of_match,
++	},
++	.probe = rp1_mbox_probe,
++};
++
++module_platform_driver(rp1_mbox_driver);
++
++MODULE_AUTHOR("Phil Elwell <phil@raspberrypi.com>");
++MODULE_DESCRIPTION("RP1 mailbox IPC driver");
++MODULE_LICENSE("GPL v2");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0541-firmware-Add-an-RP1-firmware-interface-over-mbox.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0541-firmware-Add-an-RP1-firmware-interface-over-mbox.patch
new file mode 100644
index 00000000..b0c5d1af
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0541-firmware-Add-an-RP1-firmware-interface-over-mbox.patch
@@ -0,0 +1,419 @@
+From 2e04901aa0be1b9d4b98de5d2d1b4df1bd0805cc Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 31 Oct 2024 17:36:54 +0000
+Subject: [PATCH 541/697] firmware: Add an RP1 firmware interface over mbox
+
+The RP1 firmware runs a simple communications channel over some shared
+memory and a mailbox. This driver provides access to that channel.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/firmware/Kconfig     |   9 +
+ drivers/firmware/Makefile    |   1 +
+ drivers/firmware/rp1.c       | 314 +++++++++++++++++++++++++++++++++++
+ include/linux/rp1-firmware.h |  53 ++++++
+ 4 files changed, 377 insertions(+)
+ create mode 100644 drivers/firmware/rp1.c
+ create mode 100644 include/linux/rp1-firmware.h
+
+--- a/drivers/firmware/Kconfig
++++ b/drivers/firmware/Kconfig
+@@ -120,6 +120,15 @@ config RASPBERRYPI_FIRMWARE
+ 	  This option enables support for communicating with the firmware on the
+ 	  Raspberry Pi.
+ 
++config FIRMWARE_RP1
++	tristate "RP1 Firmware Driver"
++	depends on MBOX_RP1
++	help
++	  The Raspberry Pi RP1 processor presents a firmware
++	  interface using shared memory and a mailbox. To enable
++	  the driver that communicates with it, say Y. Otherwise,
++	  say N.
++
+ config FW_CFG_SYSFS
+ 	tristate "QEMU fw_cfg device support in sysfs"
+ 	depends on SYSFS && (ARM || ARM64 || PARISC || PPC_PMAC || RISCV || SPARC || X86)
+--- a/drivers/firmware/Makefile
++++ b/drivers/firmware/Makefile
+@@ -15,6 +15,7 @@ obj-$(CONFIG_ISCSI_IBFT)	+= iscsi_ibft.o
+ obj-$(CONFIG_FIRMWARE_MEMMAP)	+= memmap.o
+ obj-$(CONFIG_MTK_ADSP_IPC)	+= mtk-adsp-ipc.o
+ obj-$(CONFIG_RASPBERRYPI_FIRMWARE) += raspberrypi.o
++obj-$(CONFIG_FIRMWARE_RP1)	+= rp1.o
+ obj-$(CONFIG_FW_CFG_SYSFS)	+= qemu_fw_cfg.o
+ obj-$(CONFIG_SYSFB)		+= sysfb.o
+ obj-$(CONFIG_SYSFB_SIMPLEFB)	+= sysfb_simplefb.o
+--- /dev/null
++++ b/drivers/firmware/rp1.c
+@@ -0,0 +1,314 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ *  Copyright (C) 2023-24 Raspberry Pi Ltd.
++ *
++ * Parts of this driver are based on:
++ *  - raspberrypi.c, by Eric Anholt <eric@anholt.net>
++ *    Copyright (C) 2015 Broadcom
++ */
++
++#include <linux/dma-mapping.h>
++#include <linux/kref.h>
++#include <linux/mailbox_client.h>
++#include <linux/module.h>
++#include <linux/of_address.h>
++#include <linux/of_platform.h>
++#include <linux/platform_device.h>
++#include <linux/rp1-firmware.h>
++
++#define RP1_MAILBOX_FIRMWARE		0
++
++enum rp1_firmware_ops {
++	MBOX_SUCCESS		= 0x0000,
++	GET_FIRMWARE_VERSION	= 0x0001, // na -> 160-bit version
++	GET_FEATURE		= 0x0002, // FOURCC -> op base (0 == unsupported), op count
++
++	COMMON_COUNT
++};
++
++struct rp1_firmware {
++	struct mbox_client cl;
++	struct mbox_chan *chan;	/* The doorbell channel */
++	uint32_t __iomem *buf;	/* The shared buffer */
++	u32 buf_size;		/* The size of the shared buffer */
++	struct completion c;
++
++	struct kref consumers;
++};
++
++struct rp1_get_feature_resp {
++	uint32_t op_base;
++	uint32_t op_count;
++};
++
++static DEFINE_MUTEX(transaction_lock);
++
++static const struct of_device_id rp1_firmware_of_match[] = {
++	{ .compatible = "raspberrypi,rp1-firmware", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, rp1_firmware_of_match);
++
++static void response_callback(struct mbox_client *cl, void *msg)
++{
++	struct rp1_firmware *fw = container_of(cl, struct rp1_firmware, cl);
++
++	complete(&fw->c);
++}
++
++/*
++ * Sends a request to the RP1 firmware and synchronously waits for the reply.
++ * Returns zero or a positive count of response bytes on success, negative on
++ * error.
++ */
++
++int rp1_firmware_message(struct rp1_firmware *fw, uint16_t op,
++			 const void *data, unsigned int data_len,
++			 void *resp, unsigned int resp_space)
++{
++	int ret;
++	u32 rc;
++
++	if (data_len + 4 > fw->buf_size)
++		return -EINVAL;
++
++	mutex_lock(&transaction_lock);
++
++	memcpy_toio(&fw->buf[1], data, data_len);
++	writel((op << 16) | data_len, fw->buf);
++
++	reinit_completion(&fw->c);
++	ret = mbox_send_message(fw->chan, NULL);
++	if (ret >= 0) {
++		if (wait_for_completion_timeout(&fw->c, HZ))
++			ret = 0;
++		else
++			ret = -ETIMEDOUT;
++	} else {
++		dev_err(fw->cl.dev, "mbox_send_message returned %d\n", ret);
++	}
++
++	if (ret == 0) {
++		rc = readl(fw->buf);
++		if (rc & 0x80000000) {
++			ret = (int32_t)rc;
++		} else {
++			ret = min(rc, resp_space);
++			memcpy_fromio(resp, &fw->buf[1], ret);
++		}
++	}
++
++	mutex_unlock(&transaction_lock);
++
++	return ret;
++}
++EXPORT_SYMBOL_GPL(rp1_firmware_message);
++
++static void rp1_firmware_delete(struct kref *kref)
++{
++	struct rp1_firmware *fw = container_of(kref, struct rp1_firmware, consumers);
++
++	mbox_free_channel(fw->chan);
++	kfree(fw);
++}
++
++void rp1_firmware_put(struct rp1_firmware *fw)
++{
++	kref_put(&fw->consumers, rp1_firmware_delete);
++}
++EXPORT_SYMBOL_GPL(rp1_firmware_put);
++
++int rp1_firmware_get_feature(struct rp1_firmware *fw, uint32_t fourcc,
++			     uint32_t *op_base, uint32_t *op_count)
++{
++	struct rp1_get_feature_resp resp;
++	int ret;
++
++	memset(&resp, 0, sizeof(resp));
++	ret = rp1_firmware_message(fw, GET_FEATURE,
++				   &fourcc, sizeof(fourcc),
++				   &resp, sizeof(resp));
++	*op_base = resp.op_base;
++	*op_count = resp.op_count;
++	if (ret < 0)
++		return ret;
++	if (ret < sizeof(resp) || !resp.op_base)
++		return -EOPNOTSUPP;
++	return 0;
++}
++EXPORT_SYMBOL_GPL(rp1_firmware_get_feature);
++
++static void devm_rp1_firmware_put(void *data)
++{
++	struct rp1_firmware *fw = data;
++
++	rp1_firmware_put(fw);
++}
++
++/**
++ * rp1_firmware_get - Get pointer to rp1_firmware structure.
++ *
++ * The reference to rp1_firmware has to be released with rp1_firmware_put().
++ *
++ * Returns an error pointer on failure.
++ */
++struct rp1_firmware *rp1_firmware_get(struct device_node *client)
++{
++	const char *match = rp1_firmware_of_match[0].compatible;
++	struct platform_device *pdev;
++	struct device_node *fwnode;
++	struct rp1_firmware *fw;
++
++	if (client) {
++		fwnode = of_parse_phandle(client, "firmware", 0);
++		if (!fwnode)
++			fwnode = of_get_parent(client);
++		if (fwnode && !of_device_is_compatible(fwnode, match)) {
++			of_node_put(fwnode);
++			fwnode = NULL;
++		}
++	}
++
++	if (!fwnode)
++		fwnode = of_find_matching_node(NULL, rp1_firmware_of_match);
++
++	if (!fwnode)
++		return ERR_PTR(-ENOENT);
++
++	pdev = of_find_device_by_node(fwnode);
++	of_node_put(fwnode);
++
++	if (!pdev)
++		return ERR_PTR(-EPROBE_DEFER);
++
++	fw = platform_get_drvdata(pdev);
++	if (!fw)
++		goto err_defer;
++
++	if (!kref_get_unless_zero(&fw->consumers))
++		goto err_defer;
++
++	put_device(&pdev->dev);
++
++	return fw;
++
++err_defer:
++	put_device(&pdev->dev);
++	return ERR_PTR(-EPROBE_DEFER);
++}
++EXPORT_SYMBOL_GPL(rp1_firmware_get);
++
++/**
++ * devm_rp1_firmware_get - Get pointer to rp1_firmware structure.
++ * @firmware_node:    Pointer to the firmware Device Tree node.
++ *
++ * Returns NULL is the firmware device is not ready.
++ */
++struct rp1_firmware *devm_rp1_firmware_get(struct device *dev, struct device_node *client)
++{
++	struct rp1_firmware *fw;
++	int ret;
++
++	fw = rp1_firmware_get(client);
++	if (IS_ERR(fw))
++		return fw;
++
++	ret = devm_add_action_or_reset(dev, devm_rp1_firmware_put, fw);
++	if (ret)
++		return ERR_PTR(ret);
++
++	return fw;
++}
++EXPORT_SYMBOL_GPL(devm_rp1_firmware_get);
++
++static int rp1_firmware_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct device_node *shmem;
++	struct rp1_firmware *fw;
++	struct resource res;
++	uint32_t version[5];
++	int ret;
++
++	shmem = of_parse_phandle(dev->of_node, "shmem", 0);
++	if (!of_device_is_compatible(shmem, "raspberrypi,rp1-shmem")) {
++		of_node_put(shmem);
++		return -ENXIO;
++	}
++
++	ret = of_address_to_resource(shmem, 0, &res);
++	of_node_put(shmem);
++	if (ret) {
++		dev_err(dev, "failed to get shared memory (%pOF) - %d\n", shmem, ret);
++		return ret;
++	}
++
++	/*
++	 * Memory will be freed by rp1_firmware_delete() once all users have
++	 * released their firmware handles. Don't use devm_kzalloc() here.
++	 */
++	fw = kzalloc(sizeof(*fw), GFP_KERNEL);
++	if (!fw)
++		return -ENOMEM;
++
++	fw->buf_size = resource_size(&res);
++	fw->buf = devm_ioremap(dev, res.start, fw->buf_size);
++	if (!fw->buf) {
++		dev_err(dev, "failed to ioremap shared memory\n");
++		kfree(fw);
++		return -EADDRNOTAVAIL;
++	}
++
++	fw->cl.dev = dev;
++	fw->cl.rx_callback = response_callback;
++	fw->cl.tx_block = false;
++
++	fw->chan = mbox_request_channel(&fw->cl, RP1_MAILBOX_FIRMWARE);
++	if (IS_ERR(fw->chan)) {
++		int ret = PTR_ERR(fw->chan);
++
++		if (ret != -EPROBE_DEFER)
++			dev_err(dev, "Failed to get mbox channel: %d\n", ret);
++		kfree(fw);
++		return ret;
++	}
++
++	init_completion(&fw->c);
++	kref_init(&fw->consumers);
++
++	platform_set_drvdata(pdev, fw);
++
++	ret = rp1_firmware_message(fw, GET_FIRMWARE_VERSION,
++				   NULL, 0, &version, sizeof(version));
++	if (ret == sizeof(version)) {
++		dev_info(dev, "RP1 Firmware version %08x%08x%08x%08x%08x\n",
++			 version[0], version[1], version[2], version[3], version[4]);
++		ret = 0;
++	} else if (ret >= 0) {
++		ret = -EIO;
++	}
++
++	return ret;
++}
++
++static void rp1_firmware_remove(struct platform_device *pdev)
++{
++	struct rp1_firmware *fw = platform_get_drvdata(pdev);
++
++	rp1_firmware_put(fw);
++}
++
++static struct platform_driver rp1_firmware_driver = {
++	.driver = {
++		.name = "rp1-firmware",
++		.of_match_table = rp1_firmware_of_match,
++	},
++	.probe		= rp1_firmware_probe,
++	.remove		= rp1_firmware_remove,
++};
++
++module_platform_driver(rp1_firmware_driver);
++
++MODULE_AUTHOR("Phil Elwell <phil@raspberrypi.com>");
++MODULE_DESCRIPTION("RP1 firmware driver");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/include/linux/rp1-firmware.h
+@@ -0,0 +1,53 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ *  Copyright (C) 2023 2023-2024 Raspberry Pi Ltd.
++ */
++
++#ifndef __SOC_RP1_FIRMWARE_H__
++#define __SOC_RP1_FIRMWARE_H__
++
++#include <linux/types.h>
++#include <linux/of_device.h>
++
++#define RP1_FOURCC(s) ((uint32_t)((s[0] << 24) | (s[1] << 16) | (s[2] << 8) | (s[3] << 0)))
++
++struct rp1_firmware;
++
++#if IS_ENABLED(CONFIG_FIRMWARE_RP1)
++int rp1_firmware_message(struct rp1_firmware *fw, uint16_t op,
++			 const void *data, unsigned int data_len,
++			 void *resp, unsigned int resp_space);
++void rp1_firmware_put(struct rp1_firmware *fw);
++struct rp1_firmware *rp1_firmware_get(struct device_node *fwnode);
++struct rp1_firmware *devm_rp1_firmware_get(struct device *dev, struct device_node *fwnode);
++int rp1_firmware_get_feature(struct rp1_firmware *fw, uint32_t fourcc,
++			     uint32_t *op_base, uint32_t *op_count);
++#else
++static inline int rp1_firmware_message(struct rp1_firmware *fw, uint16_t op,
++				       const void *data, unsigned int data_len,
++				       void *resp, unsigned int resp_space)
++{
++	return -EOPNOTSUPP;
++}
++
++static inline void rp1_firmware_put(struct rp1_firmware *fw) { }
++
++static inline struct rp1_firmware *rp1_firmware_get(struct device_node *fwnode)
++{
++	return NULL;
++}
++
++static inline struct rp1_firmware *devm_rp1_firmware_get(struct device *dev,
++							 struct device_node *fwnode)
++{
++	return NULL;
++}
++
++static inline int rp1_firmware_get_feature(struct rp1_firmware *fw, uint32_t fourcc,
++					   uint32_t *op_base, uint32_t *op_count)
++{
++	return -EOPNOTSUPP;
++}
++#endif
++
++#endif /* __SOC_RP1_FIRMWARE_H__ */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0542-dts-bcm2712-rpi-Add-RP1-firmware-and-mailboxes.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0542-dts-bcm2712-rpi-Add-RP1-firmware-and-mailboxes.patch
new file mode 100644
index 00000000..afb13b96
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0542-dts-bcm2712-rpi-Add-RP1-firmware-and-mailboxes.patch
@@ -0,0 +1,118 @@
+From cec3002c71cb328124b4e95199e71043686c98a8 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 1 Nov 2024 09:12:01 +0000
+Subject: [PATCH 542/697] dts: bcm2712-rpi: Add RP1 firmware and mailboxes
+
+Declare the communications channel to RP1.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ .../boot/dts/broadcom/bcm2712-rpi-5-b.dts     |  4 +--
+ .../boot/dts/broadcom/bcm2712-rpi-cm5.dtsi    |  4 +--
+ arch/arm64/boot/dts/broadcom/bcm2712-rpi.dtsi |  4 +++
+ arch/arm64/boot/dts/broadcom/rp1.dtsi         | 27 +++++++++++++++++++
+ 4 files changed, 35 insertions(+), 4 deletions(-)
+
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b.dts
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b.dts
+@@ -152,7 +152,7 @@ rp1_target: &pcie2 {
+ 	// This is the RP1 peripheral space
+ 	ranges = <0xc0 0x40000000
+ 		  0x02000000 0x00 0x00000000
+-		  0x00 0x00400000>;
++		  0x00 0x00410000>;
+ 
+ 	dma-ranges =
+ 	// inbound RP1 1x_xxxxxxxx -> PCIe 1x_xxxxxxxx
+@@ -164,7 +164,7 @@ rp1_target: &pcie2 {
+ 	// This allows the RP1 DMA controller to address RP1 hardware
+ 		     <0xc0 0x40000000
+ 		      0x02000000 0x0 0x00000000
+-		      0x0 0x00400000>,
++		      0x0 0x00410000>,
+ 
+ 	// inbound RP1 0x_xxxxxxxx -> PCIe 1x_xxxxxxxx
+ 		     <0x00 0x00000000
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi
+@@ -133,7 +133,7 @@ rp1_target: &pcie2 {
+ 	// This is the RP1 peripheral space
+ 	ranges = <0xc0 0x40000000
+ 		  0x02000000 0x00 0x00000000
+-		  0x00 0x00400000>;
++		  0x00 0x00410000>;
+ 
+ 	dma-ranges =
+ 	// inbound RP1 1x_xxxxxxxx -> PCIe 1x_xxxxxxxx
+@@ -145,7 +145,7 @@ rp1_target: &pcie2 {
+ 	// This allows the RP1 DMA controller to address RP1 hardware
+ 		     <0xc0 0x40000000
+ 		      0x02000000 0x0 0x00000000
+-		      0x0 0x00400000>,
++		      0x0 0x00410000>,
+ 
+ 	// inbound RP1 0x_xxxxxxxx -> PCIe 1x_xxxxxxxx
+ 		     <0x00 0x00000000
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi.dtsi
+@@ -294,6 +294,10 @@ pciex4: &pcie2 { };
+ 	status = "okay";
+ };
+ 
++&rp1_mbox {
++	status = "okay";
++};
++
+ /* Add some gpiomem nodes to make the devices accessible to userspace.
+  * /dev/gpiomem<n> should expose the registers for the interface with DT alias
+  * gpio<n>.
+--- a/arch/arm64/boot/dts/broadcom/rp1.dtsi
++++ b/arch/arm64/boot/dts/broadcom/rp1.dtsi
+@@ -13,6 +13,14 @@
+ 
+ 		// ranges and dma-ranges must be provided by the includer
+ 
++		rp1_mbox: mailbox@8000 {
++			compatible = "raspberrypi,rp1-mbox";
++			status = "disabled";
++			reg = <0xc0 0x40008000  0x0 0x4000>;  // SYSCFG
++			interrupts = <RP1_INT_SYSCFG IRQ_TYPE_LEVEL_HIGH>;
++			#mbox-cells = <1>;
++		};
++
+ 		rp1_clocks: clocks@18000 {
+ 			compatible = "raspberrypi,rp1-clocks";
+ 			#clock-cells = <1>;
+@@ -1183,6 +1191,19 @@
+ 			assigned-clocks        = <&rp1_clocks RP1_CLK_DPI>;
+ 			assigned-clock-parents = <&rp1_clocks RP1_PLL_VIDEO>;
+ 		};
++
++		sram: sram@400000 {
++			compatible = "mmio-sram";
++			reg = <0xc0 0x40400000  0x0 0x10000>;
++			#address-cells = <1>;
++			#size-cells = <1>;
++			ranges = <0  0xc0 0x40400000  0x10000>;
++
++			rp1_fw_shmem: shmem@ff00 {
++				compatible = "raspberrypi,rp1-shmem";
++				reg = <0xff00 0x100>; // firmware mailbox buffer
++			};
++		};
+ 	};
+ };
+ 
+@@ -1281,6 +1302,12 @@
+ };
+ 
+ / {
++	rp1_firmware: rp1_firmware {
++		compatible = "raspberrypi,rp1-firmware", "simple-mfd";
++		mboxes = <&rp1_mbox 0>;
++		shmem = <&rp1_fw_shmem>;
++	};
++
+ 	rp1_vdd_3v3: rp1_vdd_3v3 {
+ 		compatible = "regulator-fixed";
+ 		regulator-name = "vdd-3v3";
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0543-misc-Add-RP1-PIO-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0543-misc-Add-RP1-PIO-driver.patch
new file mode 100644
index 00000000..c821bf3b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0543-misc-Add-RP1-PIO-driver.patch
@@ -0,0 +1,3010 @@
+From 1b7da6cb533b78ce8bd3fc4f68edb787290e59f8 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 31 Oct 2024 18:26:00 +0000
+Subject: [PATCH 543/697] misc: Add RP1 PIO driver
+
+Provide remote access to the PIO hardware in RP1. There is a single
+instance, with 4 state machines.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/misc/Kconfig             |    8 +
+ drivers/misc/Makefile            |    1 +
+ drivers/misc/rp1-fw-pio.h        |   56 ++
+ drivers/misc/rp1-pio.c           | 1226 ++++++++++++++++++++++++++++++
+ include/linux/pio_instructions.h |  481 ++++++++++++
+ include/linux/pio_rp1.h          |  962 +++++++++++++++++++++++
+ include/uapi/misc/rp1_pio_if.h   |  219 ++++++
+ 7 files changed, 2953 insertions(+)
+ create mode 100644 drivers/misc/rp1-fw-pio.h
+ create mode 100644 drivers/misc/rp1-pio.c
+ create mode 100644 include/linux/pio_instructions.h
+ create mode 100644 include/linux/pio_rp1.h
+ create mode 100644 include/uapi/misc/rp1_pio_if.h
+
+--- a/drivers/misc/Kconfig
++++ b/drivers/misc/Kconfig
+@@ -17,6 +17,14 @@ config BCM2835_SMI
+ 		Driver for enabling and using Broadcom's Secondary/Slow Memory Interface.
+ 		Appears as /dev/bcm2835_smi. For ioctl interface see drivers/misc/bcm2835_smi.h
+ 
++config RP1_PIO
++	tristate "Raspberry Pi RP1 PIO driver"
++	select FIRMWARE_RP1
++	default n
++	help
++		Driver providing control of the Raspberry Pi PIO block, as found in
++		RP1.
++
+ config AD525X_DPOT
+ 	tristate "Analog Devices Digital Potentiometers"
+ 	depends on (I2C || SPI) && SYSFS
+--- a/drivers/misc/Makefile
++++ b/drivers/misc/Makefile
+@@ -19,6 +19,7 @@ obj-$(CONFIG_PHANTOM)		+= phantom.o
+ obj-$(CONFIG_RPMB)		+= rpmb-core.o
+ obj-$(CONFIG_QCOM_COINCELL)	+= qcom-coincell.o
+ obj-$(CONFIG_QCOM_FASTRPC)	+= fastrpc.o
++obj-$(CONFIG_RP1_PIO)		+= rp1-pio.o
+ obj-$(CONFIG_SENSORS_BH1770)	+= bh1770glc.o
+ obj-$(CONFIG_SENSORS_APDS990X)	+= apds990x.o
+ obj-$(CONFIG_ENCLOSURE_SERVICES) += enclosure.o
+--- /dev/null
++++ b/drivers/misc/rp1-fw-pio.h
+@@ -0,0 +1,56 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ *  Copyright (C) 2023 2023-2024 Raspberry Pi Ltd.
++ */
++
++#ifndef __SOC_RP1_FIRMWARE_OPS_H__
++#define __SOC_RP1_FIRMWARE_OPS_H__
++
++#include <linux/rp1-firmware.h>
++
++#define FOURCC_PIO RP1_FOURCC("PIO ")
++
++enum rp1_pio_ops {
++	PIO_CAN_ADD_PROGRAM,	// u16 num_instrs, u16 origin -> origin
++	PIO_ADD_PROGRAM,	// u16 num_instrs, u16 origin, u16 prog[] -> rc
++	PIO_REMOVE_PROGRAM,	// u16 num_instrs, u16 origin
++	PIO_CLEAR_INSTR_MEM,	// -
++
++	PIO_SM_CLAIM,		// u16 mask -> sm
++	PIO_SM_UNCLAIM,		// u16 mask
++	PIO_SM_IS_CLAIMED,	// u16 mask -> claimed
++
++	PIO_SM_INIT,		// u16 sm, u16 initial_pc, u32 sm_config[4]
++	PIO_SM_SET_CONFIG,	// u16 sm, u16 rsvd, u32 sm_config[4]
++	PIO_SM_EXEC,		// u16 sm, u16 instr, u8 blocking, u8 rsvd
++	PIO_SM_CLEAR_FIFOS,	// u16 sm
++	PIO_SM_SET_CLKDIV,	// u16 sm, u16 div_int, u8 div_frac, u8 rsvd
++	PIO_SM_SET_PINS,	// u16 sm, u16 rsvd, u32 values, u32 mask
++	PIO_SM_SET_PINDIRS,	// u16 sm, u16 rsvd, u32 dirs, u32 mask
++	PIO_SM_SET_ENABLED,	// u16 mask, u8 enable, u8 rsvd
++	PIO_SM_RESTART,		// u16 mask
++	PIO_SM_CLKDIV_RESTART,	// u16 mask
++	PIO_SM_ENABLE_SYNC,	// u16 mask
++	PIO_SM_PUT,		// u16 sm, u8 blocking, u8 rsvd, u32 data
++	PIO_SM_GET,		// u16 sm, u8 blocking, u8 rsvd -> u32 data
++	PIO_SM_SET_DMACTRL,	// u16 sm, u16 is_tx, u32 ctrl
++
++	GPIO_INIT,		// u16 gpio
++	GPIO_SET_FUNCTION,	// u16 gpio, u16 fn
++	GPIO_SET_PULLS,		// u16 gpio, u8 up, u8 down
++	GPIO_SET_OUTOVER,	// u16 gpio, u16 value
++	GPIO_SET_INOVER,	// u16 gpio, u16 value
++	GPIO_SET_OEOVER,	// u16 gpio, u16 value
++	GPIO_SET_INPUT_ENABLED,	// u16 gpio, u16 value
++	GPIO_SET_DRIVE_STRENGTH,	// u16 gpio, u16 value
++
++	READ_HW,		// src address, len -> data bytes
++	WRITE_HW,		// dst address, data
++
++	PIO_SM_FIFO_STATE,	// u16 sm, u8 tx -> u16 level, u8 empty, u8 full
++	PIO_SM_DRAIN_TX,	// u16 sm
++
++	PIO_COUNT
++};
++
++#endif
+--- /dev/null
++++ b/drivers/misc/rp1-pio.c
+@@ -0,0 +1,1226 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * PIO driver for RP1
++ *
++ * Copyright (C) 2023-2024 Raspberry Pi Ltd.
++ *
++ * Parts of this driver are based on:
++ *  - vcio.c, by Noralf Trønnes
++ *    Copyright (C) 2010 Broadcom
++ *    Copyright (C) 2015 Noralf Trønnes
++ *    Copyright (C) 2021 Raspberry Pi (Trading) Ltd.
++ *  - bcm2835_smi.c & bcm2835_smi_dev.c by Luke Wren
++ *    Copyright (c) 2015 Raspberry Pi (Trading) Ltd.
++ */
++
++#include <linux/cdev.h>
++#include <linux/compat.h>
++#include <linux/device.h>
++#include <linux/dmaengine.h>
++#include <linux/dma-mapping.h>
++#include <linux/fs.h>
++#include <linux/init.h>
++#include <linux/ioctl.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/pio_rp1.h>
++#include <linux/platform_device.h>
++#include <linux/rp1-firmware.h>
++#include <linux/semaphore.h>
++#include <linux/slab.h>
++#include <linux/spinlock.h>
++#include <linux/uaccess.h>
++#include <uapi/misc/rp1_pio_if.h>
++
++#include "rp1-fw-pio.h"
++
++#define DRIVER_NAME		"rp1-pio"
++
++#define RP1_PIO_SMS_COUNT	4
++#define RP1_PIO_INSTR_COUNT	32
++
++#define MAX_ARG_SIZE		256
++
++#define RP1_PIO_FIFO_TX0	0x00
++#define RP1_PIO_FIFO_TX1	0x04
++#define RP1_PIO_FIFO_TX2	0x08
++#define RP1_PIO_FIFO_TX3	0x0c
++#define RP1_PIO_FIFO_RX0	0x10
++#define RP1_PIO_FIFO_RX1	0x14
++#define RP1_PIO_FIFO_RX2	0x18
++#define RP1_PIO_FIFO_RX3	0x1c
++
++#define RP1_PIO_DMACTRL_DEFAULT	0x80000104
++
++#define HANDLER(_n, _f) \
++	[_IOC_NR(PIO_IOC_ ## _n)] = { #_n, rp1_pio_ ## _f, _IOC_SIZE(PIO_IOC_ ## _n) }
++
++
++#define ROUND_UP(x, y) (((x) + (y) - 1) - (((x) + (y) - 1) % (y)))
++
++#define DMA_BOUNCE_BUFFER_SIZE 0x1000
++#define DMA_BOUNCE_BUFFER_COUNT 4
++
++struct dma_buf_info {
++	void *buf;
++	dma_addr_t phys;
++	struct scatterlist sgl;
++};
++
++struct dma_info {
++	struct semaphore buf_sem;
++	struct dma_chan *chan;
++	size_t buf_size;
++	size_t buf_count;
++	unsigned int head_idx;
++	unsigned int tail_idx;
++	struct dma_buf_info bufs[DMA_BOUNCE_BUFFER_COUNT];
++};
++
++struct rp1_pio_device {
++	struct platform_device *pdev;
++	struct rp1_firmware *fw;
++	uint16_t fw_pio_base;
++	uint16_t fw_pio_count;
++	dev_t dev_num;
++	struct class *dev_class;
++	struct cdev cdev;
++	phys_addr_t phys_addr;
++	uint32_t claimed_sms;
++	uint32_t claimed_dmas;
++	spinlock_t lock;
++	struct mutex instr_mutex;
++	struct dma_info dma_configs[RP1_PIO_SMS_COUNT][RP1_PIO_DIR_COUNT];
++	uint32_t used_instrs;
++	uint8_t instr_refcounts[RP1_PIO_INSTR_COUNT];
++	uint16_t instrs[RP1_PIO_INSTR_COUNT];
++	uint client_count;
++};
++
++struct rp1_pio_client {
++	struct rp1_pio_device *pio;
++	uint32_t claimed_sms;
++	uint32_t claimed_instrs;
++	uint32_t claimed_dmas;
++	int error;
++};
++
++static struct rp1_pio_device *g_pio;
++
++static int rp1_pio_message(struct rp1_pio_device *pio,
++			   uint16_t op, const void *data, unsigned int data_len)
++{
++	uint32_t rc;
++	int ret;
++
++	if (op >= pio->fw_pio_count)
++		return -EOPNOTSUPP;
++	ret = rp1_firmware_message(pio->fw, pio->fw_pio_base + op,
++				   data, data_len,
++				   &rc, sizeof(rc));
++	if (ret == 4)
++		ret = rc;
++	return ret;
++}
++
++static int rp1_pio_message_resp(struct rp1_pio_device *pio,
++				uint16_t op, const void *data, unsigned int data_len,
++				void *resp, void __user *userbuf, unsigned int resp_len)
++{
++	uint32_t resp_buf[1 + 32];
++	int ret;
++
++	if (op >= pio->fw_pio_count)
++		return -EOPNOTSUPP;
++	if (resp_len + 4 >= sizeof(resp_buf))
++		return -EINVAL;
++	if (!resp && !userbuf)
++		return -EINVAL;
++	ret = rp1_firmware_message(pio->fw, pio->fw_pio_base + op,
++				   data, data_len,
++				   resp_buf, resp_len + 4);
++	if (ret >= 4 && !resp_buf[0]) {
++		ret -= 4;
++		if (resp)
++			memcpy(resp, &resp_buf[1], ret);
++		else if (copy_to_user(userbuf, &resp_buf[1], ret))
++			ret = -EFAULT;
++	} else if (ret >= 0) {
++		ret = -EIO;
++	}
++	return ret;
++}
++
++static int rp1_pio_read_hw(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_device *pio = client->pio;
++	struct rp1_access_hw_args *args = param;
++
++	return rp1_pio_message_resp(pio, READ_HW,
++				    args, 8, NULL, args->data, args->len);
++}
++
++static int rp1_pio_write_hw(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_device *pio = client->pio;
++	struct rp1_access_hw_args *args = param;
++	uint32_t write_buf[32 + 1];
++	int len;
++
++	len = min(args->len, sizeof(write_buf) - 4);
++	write_buf[0] = args->addr;
++	if (copy_from_user(&write_buf[1], args->data, len))
++		return -EFAULT;
++	return rp1_firmware_message(pio->fw, pio->fw_pio_base + WRITE_HW,
++				    write_buf, 4 + len, NULL, 0);
++}
++
++static int rp1_pio_find_program(struct rp1_pio_device *pio,
++				struct rp1_pio_add_program_args *prog)
++{
++	uint start, end, prog_size;
++	uint32_t used_mask;
++	uint i;
++
++	start = (prog->origin != RP1_PIO_ORIGIN_ANY) ? prog->origin : 0;
++	end = (prog->origin != RP1_PIO_ORIGIN_ANY) ? prog->origin :
++			(RP1_PIO_INSTRUCTION_COUNT - prog->num_instrs);
++	prog_size = sizeof(prog->instrs[0]) * prog->num_instrs;
++	used_mask = (uint32_t)(~0) >> (32 - prog->num_instrs);
++
++	/* Find the best match */
++	for (i = start; i <= end; i++) {
++		uint32_t mask = used_mask << i;
++
++		if ((pio->used_instrs & mask) != mask)
++			continue;
++		if (!memcmp(pio->instrs + i, prog->instrs, prog_size))
++			return i;
++	}
++
++	return -1;
++}
++
++int rp1_pio_can_add_program(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_add_program_args *args = param;
++	struct rp1_pio_device *pio = client->pio;
++	int offset;
++
++	if (args->num_instrs > RP1_PIO_INSTR_COUNT ||
++		((args->origin != RP1_PIO_ORIGIN_ANY) &&
++		 (args->origin >= RP1_PIO_INSTR_COUNT ||
++		  ((args->origin + args->num_instrs) > RP1_PIO_INSTR_COUNT))))
++		return -EINVAL;
++
++	mutex_lock(&pio->instr_mutex);
++	offset = rp1_pio_find_program(pio, args);
++	mutex_unlock(&pio->instr_mutex);
++	if (offset >= 0)
++		return offset;
++
++	/* Don't send the instructions, just the header */
++	return rp1_pio_message(pio, PIO_CAN_ADD_PROGRAM, args,
++			       offsetof(struct rp1_pio_add_program_args, instrs));
++}
++EXPORT_SYMBOL_GPL(rp1_pio_can_add_program);
++
++int rp1_pio_add_program(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_add_program_args *args = param;
++	struct rp1_pio_device *pio = client->pio;
++	int offset;
++	uint i;
++
++	if (args->num_instrs > RP1_PIO_INSTR_COUNT ||
++		((args->origin != RP1_PIO_ORIGIN_ANY) &&
++		 (args->origin >= RP1_PIO_INSTR_COUNT ||
++		  ((args->origin + args->num_instrs) > RP1_PIO_INSTR_COUNT))))
++		return -EINVAL;
++
++	mutex_lock(&pio->instr_mutex);
++	offset = rp1_pio_find_program(pio, args);
++	if (offset < 0)
++		offset = rp1_pio_message(client->pio, PIO_ADD_PROGRAM, args, sizeof(*args));
++
++	if (offset >= 0) {
++		uint32_t used_mask;
++		uint prog_size;
++
++		used_mask = ((uint32_t)(~0) >> (-args->num_instrs & 0x1f)) << offset;
++		prog_size = sizeof(args->instrs[0]) * args->num_instrs;
++
++		if ((pio->used_instrs & used_mask) != used_mask) {
++			pio->used_instrs |= used_mask;
++			memcpy(pio->instrs + offset, args->instrs, prog_size);
++		}
++		client->claimed_instrs |= used_mask;
++		for (i = 0; i < args->num_instrs; i++)
++			pio->instr_refcounts[offset + i]++;
++	}
++	mutex_unlock(&pio->instr_mutex);
++	return offset;
++}
++EXPORT_SYMBOL_GPL(rp1_pio_add_program);
++
++static void rp1_pio_remove_instrs(struct rp1_pio_device *pio, uint32_t mask)
++{
++	struct rp1_pio_remove_program_args args;
++	uint i;
++
++	mutex_lock(&pio->instr_mutex);
++	args.num_instrs = 0;
++	for (i = 0; ; i++, mask >>= 1) {
++		if ((mask & 1) && pio->instr_refcounts[i] && !--pio->instr_refcounts[i]) {
++			pio->used_instrs &= ~(1 << i);
++			args.num_instrs++;
++		} else if (args.num_instrs) {
++			args.origin = i - args.num_instrs;
++			rp1_pio_message(pio, PIO_REMOVE_PROGRAM, &args, sizeof(args));
++			args.num_instrs = 0;
++		}
++		if (!mask)
++			break;
++	}
++	mutex_unlock(&pio->instr_mutex);
++}
++
++int rp1_pio_remove_program(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_remove_program_args *args = param;
++	uint32_t used_mask;
++	int ret = -ENOENT;
++
++	if (args->num_instrs > RP1_PIO_INSTR_COUNT ||
++		args->origin >= RP1_PIO_INSTR_COUNT ||
++		(args->origin + args->num_instrs) > RP1_PIO_INSTR_COUNT)
++		return -EINVAL;
++
++	used_mask = ((uint32_t)(~0) >> (32 - args->num_instrs)) << args->origin;
++	if ((client->claimed_instrs & used_mask) == used_mask) {
++		client->claimed_instrs &= ~used_mask;
++		rp1_pio_remove_instrs(client->pio, used_mask);
++		ret = 0;
++	}
++	return ret;
++}
++EXPORT_SYMBOL_GPL(rp1_pio_remove_program);
++
++int rp1_pio_clear_instr_mem(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_device *pio = client->pio;
++
++	mutex_lock(&pio->instr_mutex);
++	(void)rp1_pio_message(client->pio, PIO_CLEAR_INSTR_MEM, NULL, 0);
++	memset(pio->instr_refcounts, 0, sizeof(pio->instr_refcounts));
++	pio->used_instrs = 0;
++	client->claimed_instrs = 0;
++	mutex_unlock(&pio->instr_mutex);
++	return 0;
++}
++EXPORT_SYMBOL_GPL(rp1_pio_clear_instr_mem);
++
++int rp1_pio_sm_claim(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_claim_args *args = param;
++	struct rp1_pio_device *pio = client->pio;
++	int ret;
++
++	mutex_lock(&pio->instr_mutex);
++	ret = rp1_pio_message(client->pio, PIO_SM_CLAIM, args, sizeof(*args));
++	if (ret >= 0) {
++		if (args->mask)
++			client->claimed_sms |= args->mask;
++		else
++			client->claimed_sms |= (1 << ret);
++		pio->claimed_sms |= client->claimed_sms;
++	}
++	mutex_unlock(&pio->instr_mutex);
++	return ret;
++}
++EXPORT_SYMBOL_GPL(rp1_pio_sm_claim);
++
++int rp1_pio_sm_unclaim(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_claim_args *args = param;
++	struct rp1_pio_device *pio = client->pio;
++
++	mutex_lock(&pio->instr_mutex);
++	(void)rp1_pio_message(client->pio, PIO_SM_UNCLAIM, args, sizeof(*args));
++	client->claimed_sms &= ~args->mask;
++	pio->claimed_sms &= ~args->mask;
++	mutex_unlock(&pio->instr_mutex);
++	return 0;
++}
++EXPORT_SYMBOL_GPL(rp1_pio_sm_unclaim);
++
++int rp1_pio_sm_is_claimed(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_claim_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_IS_CLAIMED, args, sizeof(*args));
++}
++EXPORT_SYMBOL_GPL(rp1_pio_sm_is_claimed);
++
++int rp1_pio_sm_init(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_init_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_INIT, args, sizeof(*args));
++}
++EXPORT_SYMBOL_GPL(rp1_pio_sm_init);
++
++int rp1_pio_sm_set_config(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_set_config_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_SET_CONFIG, args, sizeof(*args));
++}
++EXPORT_SYMBOL_GPL(rp1_pio_sm_set_config);
++
++int rp1_pio_sm_exec(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_exec_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_EXEC, args, sizeof(*args));
++}
++EXPORT_SYMBOL_GPL(rp1_pio_sm_exec);
++
++int rp1_pio_sm_clear_fifos(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_clear_fifos_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_CLEAR_FIFOS, args, sizeof(*args));
++}
++EXPORT_SYMBOL_GPL(rp1_pio_sm_clear_fifos);
++
++int rp1_pio_sm_set_clkdiv(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_set_clkdiv_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_SET_CLKDIV, args, sizeof(*args));
++}
++EXPORT_SYMBOL_GPL(rp1_pio_sm_set_clkdiv);
++
++int rp1_pio_sm_set_pins(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_set_pins_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_SET_PINS, args, sizeof(*args));
++}
++EXPORT_SYMBOL_GPL(rp1_pio_sm_set_pins);
++
++int rp1_pio_sm_set_pindirs(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_set_pindirs_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_SET_PINDIRS, args, sizeof(*args));
++}
++EXPORT_SYMBOL_GPL(rp1_pio_sm_set_pindirs);
++
++int rp1_pio_sm_set_enabled(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_set_enabled_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_SET_ENABLED, args, sizeof(*args));
++}
++EXPORT_SYMBOL_GPL(rp1_pio_sm_set_enabled);
++
++int rp1_pio_sm_restart(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_restart_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_RESTART, args, sizeof(*args));
++}
++EXPORT_SYMBOL_GPL(rp1_pio_sm_restart);
++
++int rp1_pio_sm_clkdiv_restart(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_restart_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_CLKDIV_RESTART, args, sizeof(*args));
++}
++EXPORT_SYMBOL_GPL(rp1_pio_sm_clkdiv_restart);
++
++int rp1_pio_sm_enable_sync(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_enable_sync_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_ENABLE_SYNC, args, sizeof(*args));
++}
++EXPORT_SYMBOL_GPL(rp1_pio_sm_enable_sync);
++
++int rp1_pio_sm_put(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_put_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_PUT, args, sizeof(*args));
++}
++EXPORT_SYMBOL_GPL(rp1_pio_sm_put);
++
++int rp1_pio_sm_get(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_get_args *args = param;
++	int ret;
++
++	ret = rp1_pio_message_resp(client->pio, PIO_SM_GET, args, sizeof(*args),
++				   &args->data, NULL, sizeof(args->data));
++	if (ret >= 0)
++		return offsetof(struct rp1_pio_sm_get_args, data) + ret;
++	return ret;
++}
++EXPORT_SYMBOL_GPL(rp1_pio_sm_get);
++
++int rp1_pio_sm_set_dmactrl(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_set_dmactrl_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_SET_DMACTRL, args, sizeof(*args));
++}
++EXPORT_SYMBOL_GPL(rp1_pio_sm_set_dmactrl);
++
++int rp1_pio_sm_fifo_state(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_fifo_state_args *args = param;
++	const int level_offset = offsetof(struct rp1_pio_sm_fifo_state_args, level);
++	int ret;
++
++	ret = rp1_pio_message_resp(client->pio, PIO_SM_FIFO_STATE, args, sizeof(*args),
++				   &args->level, NULL, sizeof(*args) - level_offset);
++	if (ret >= 0)
++		return level_offset + ret;
++	return ret;
++}
++EXPORT_SYMBOL_GPL(rp1_pio_sm_fifo_state);
++
++int rp1_pio_sm_drain_tx(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_clear_fifos_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_DRAIN_TX, args, sizeof(*args));
++}
++EXPORT_SYMBOL_GPL(rp1_pio_sm_drain_tx);
++
++int rp1_pio_gpio_init(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_gpio_init_args *args = param;
++
++	return rp1_pio_message(client->pio, GPIO_INIT, args, sizeof(*args));
++}
++EXPORT_SYMBOL_GPL(rp1_pio_gpio_init);
++
++int rp1_pio_gpio_set_function(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_gpio_set_function_args *args = param;
++
++	return rp1_pio_message(client->pio, GPIO_SET_FUNCTION, args, sizeof(*args));
++}
++EXPORT_SYMBOL_GPL(rp1_pio_gpio_set_function);
++
++int rp1_pio_gpio_set_pulls(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_gpio_set_pulls_args *args = param;
++
++	return rp1_pio_message(client->pio, GPIO_SET_PULLS, args, sizeof(*args));
++}
++EXPORT_SYMBOL_GPL(rp1_pio_gpio_set_pulls);
++
++int rp1_pio_gpio_set_outover(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_gpio_set_args *args = param;
++
++	return rp1_pio_message(client->pio, GPIO_SET_OUTOVER, args, sizeof(*args));
++}
++EXPORT_SYMBOL_GPL(rp1_pio_gpio_set_outover);
++
++int rp1_pio_gpio_set_inover(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_gpio_set_args *args = param;
++
++	return rp1_pio_message(client->pio, GPIO_SET_INOVER, args, sizeof(*args));
++}
++EXPORT_SYMBOL_GPL(rp1_pio_gpio_set_inover);
++
++int rp1_pio_gpio_set_oeover(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_gpio_set_args *args = param;
++
++	return rp1_pio_message(client->pio, GPIO_SET_OEOVER, args, sizeof(*args));
++}
++EXPORT_SYMBOL_GPL(rp1_pio_gpio_set_oeover);
++
++int rp1_pio_gpio_set_input_enabled(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_gpio_set_args *args = param;
++
++	return rp1_pio_message(client->pio, GPIO_SET_INPUT_ENABLED, args, sizeof(*args));
++}
++EXPORT_SYMBOL_GPL(rp1_pio_gpio_set_input_enabled);
++
++int rp1_pio_gpio_set_drive_strength(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_gpio_set_args *args = param;
++
++	return rp1_pio_message(client->pio, GPIO_SET_DRIVE_STRENGTH, args, sizeof(*args));
++}
++EXPORT_SYMBOL_GPL(rp1_pio_gpio_set_drive_strength);
++
++static void rp1_pio_sm_dma_callback(void *param)
++{
++	struct dma_info *dma = param;
++
++	up(&dma->buf_sem);
++}
++
++static void rp1_pio_sm_dma_free(struct device *dev, struct dma_info *dma)
++{
++	dmaengine_terminate_all(dma->chan);
++	while (dma->buf_count > 0) {
++		dma->buf_count--;
++		dma_free_coherent(dev, ROUND_UP(dma->buf_size, PAGE_SIZE),
++				  dma->bufs[dma->buf_count].buf, dma->bufs[dma->buf_count].phys);
++	}
++
++	dma_release_channel(dma->chan);
++}
++
++static int rp1_pio_sm_config_xfer(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_config_xfer_args *args = param;
++	struct rp1_pio_sm_set_dmactrl_args set_dmactrl_args;
++	struct rp1_pio_device *pio = client->pio;
++	struct platform_device *pdev = pio->pdev;
++	struct device *dev = &pdev->dev;
++	struct dma_slave_config config = {};
++	phys_addr_t fifo_addr;
++	struct dma_info *dma;
++	uint32_t dma_mask;
++	char chan_name[4];
++	uint buf_size;
++	int ret = 0;
++
++	if (args->sm >= RP1_PIO_SMS_COUNT || args->dir >= RP1_PIO_DIR_COUNT ||
++	    !args->buf_size || (args->buf_size & 3) ||
++	    !args->buf_count || args->buf_count > DMA_BOUNCE_BUFFER_COUNT)
++		return -EINVAL;
++
++	dma_mask = 1 << (args->sm * 2 + args->dir);
++
++	dma = &pio->dma_configs[args->sm][args->dir];
++
++	spin_lock(&pio->lock);
++	if (pio->claimed_dmas & dma_mask)
++		rp1_pio_sm_dma_free(dev, dma);
++	pio->claimed_dmas |= dma_mask;
++	client->claimed_dmas |= dma_mask;
++	spin_unlock(&pio->lock);
++
++	dma->buf_size = args->buf_size;
++	/* Round up the allocations */
++	buf_size = ROUND_UP(args->buf_size, PAGE_SIZE);
++	sema_init(&dma->buf_sem, 0);
++
++	/* Allocate and configure a DMA channel */
++	/* Careful - each SM FIFO has its own DREQ value */
++	chan_name[0] = (args->dir == RP1_PIO_DIR_TO_SM) ? 't' : 'r';
++	chan_name[1] = 'x';
++	chan_name[2] = '0' + args->sm;
++	chan_name[3] = '\0';
++
++	dma->chan = dma_request_chan(dev, chan_name);
++	if (IS_ERR(dma->chan))
++		return PTR_ERR(dma->chan);
++
++	/* Alloc and map bounce buffers */
++	for (dma->buf_count = 0; dma->buf_count < args->buf_count; dma->buf_count++) {
++		struct dma_buf_info *dbi = &dma->bufs[dma->buf_count];
++
++		dbi->buf = dma_alloc_coherent(dma->chan->device->dev, buf_size,
++					      &dbi->phys, GFP_KERNEL);
++		if (!dbi->buf) {
++			ret = -ENOMEM;
++			goto err_dma_free;
++		}
++		sg_init_table(&dbi->sgl, 1);
++		sg_dma_address(&dbi->sgl) = dbi->phys;
++	}
++
++	fifo_addr = pio->phys_addr;
++	fifo_addr += args->sm * (RP1_PIO_FIFO_TX1 - RP1_PIO_FIFO_TX0);
++	fifo_addr += (args->dir == RP1_PIO_DIR_TO_SM) ? RP1_PIO_FIFO_TX0 : RP1_PIO_FIFO_RX0;
++
++	config.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
++	config.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
++	config.src_addr = fifo_addr;
++	config.dst_addr = fifo_addr;
++	config.direction = (args->dir == RP1_PIO_DIR_TO_SM) ? DMA_MEM_TO_DEV : DMA_DEV_TO_MEM;
++
++	ret = dmaengine_slave_config(dma->chan, &config);
++	if (ret)
++		goto err_dma_free;
++
++	set_dmactrl_args.sm = args->sm;
++	set_dmactrl_args.is_tx = (args->dir == RP1_PIO_DIR_TO_SM);
++	set_dmactrl_args.ctrl = RP1_PIO_DMACTRL_DEFAULT;
++	if (args->dir == RP1_PIO_DIR_FROM_SM)
++		set_dmactrl_args.ctrl = (RP1_PIO_DMACTRL_DEFAULT & ~0x1f) | 1;
++
++	ret = rp1_pio_sm_set_dmactrl(client, &set_dmactrl_args);
++	if (ret)
++		goto err_dma_free;
++
++	return 0;
++
++err_dma_free:
++	rp1_pio_sm_dma_free(dev, dma);
++
++	spin_lock(&pio->lock);
++	client->claimed_dmas &= ~dma_mask;
++	pio->claimed_dmas &= ~dma_mask;
++	spin_unlock(&pio->lock);
++
++	return ret;
++}
++
++static int rp1_pio_sm_tx_user(struct rp1_pio_device *pio, struct dma_info *dma,
++			      const void __user *userbuf, size_t bytes)
++{
++	struct platform_device *pdev = pio->pdev;
++	struct dma_async_tx_descriptor *desc;
++	struct device *dev = &pdev->dev;
++	int ret = 0;
++
++	/* Clean the slate - we're running synchronously */
++	dma->head_idx = 0;
++	dma->tail_idx = 0;
++
++	while (bytes > 0) {
++		size_t copy_bytes = min(bytes, dma->buf_size);
++		struct dma_buf_info *dbi;
++
++		/* grab the next free buffer, waiting if they're all full */
++		if (dma->head_idx - dma->tail_idx == dma->buf_count) {
++			if (down_timeout(&dma->buf_sem,
++				msecs_to_jiffies(1000))) {
++				dev_err(dev, "DMA bounce timed out\n");
++				break;
++			}
++			dma->tail_idx++;
++		}
++
++		dbi = &dma->bufs[dma->head_idx % dma->buf_count];
++
++		sg_dma_len(&dbi->sgl) = copy_bytes;
++
++		ret = copy_from_user(dbi->buf, userbuf, copy_bytes);
++		if (ret < 0)
++			break;
++
++		userbuf += copy_bytes;
++
++		desc = dmaengine_prep_slave_sg(dma->chan, &dbi->sgl, 1,
++					       DMA_MEM_TO_DEV,
++					       DMA_PREP_INTERRUPT | DMA_CTRL_ACK |
++					       DMA_PREP_FENCE);
++		if (!desc) {
++			dev_err(dev, "DMA preparation failedzn");
++			ret = -EIO;
++			break;
++		}
++
++		desc->callback = rp1_pio_sm_dma_callback;
++		desc->callback_param = dma;
++
++		/* Submit the buffer - the callback will kick the semaphore */
++		ret = dmaengine_submit(desc);
++		if (ret < 0)
++			break;
++		ret = 0;
++
++		dma_async_issue_pending(dma->chan);
++
++		dma->head_idx++;
++		bytes -= copy_bytes;
++	}
++
++	/* Block for completion */
++	while (dma->tail_idx != dma->head_idx) {
++		if (down_timeout(&dma->buf_sem, msecs_to_jiffies(1000))) {
++			dev_err(dev, "DMA wait timed out\n");
++			ret = -ETIMEDOUT;
++			break;
++		}
++		dma->tail_idx++;
++	}
++
++	return ret;
++}
++
++static int rp1_pio_sm_rx_user(struct rp1_pio_device *pio, struct dma_info *dma,
++			      void __user *userbuf, size_t bytes)
++{
++	struct platform_device *pdev = pio->pdev;
++	struct dma_async_tx_descriptor *desc;
++	struct device *dev = &pdev->dev;
++	int ret = 0;
++
++	/* Clean the slate - we're running synchronously */
++	dma->head_idx = 0;
++	dma->tail_idx = 0;
++
++	while (bytes || dma->tail_idx != dma->head_idx) {
++		size_t copy_bytes = min(bytes, dma->buf_size);
++		struct dma_buf_info *dbi;
++
++		/*
++		 * wait for the next RX to complete if all the buffers are
++		 * outstanding or we're finishing up.
++		 */
++		if (!bytes || dma->head_idx - dma->tail_idx == dma->buf_count) {
++			if (down_timeout(&dma->buf_sem,
++				msecs_to_jiffies(1000))) {
++				dev_err(dev, "DMA wait timed out");
++				ret = -ETIMEDOUT;
++				break;
++			}
++
++			dbi = &dma->bufs[dma->tail_idx++ % dma->buf_count];
++			ret = copy_to_user(userbuf, dbi->buf, sg_dma_len(&dbi->sgl));
++			if (ret < 0)
++				break;
++			userbuf += sg_dma_len(&dbi->sgl);
++
++			if (!bytes)
++				continue;
++		}
++
++		dbi = &dma->bufs[dma->head_idx % dma->buf_count];
++		sg_dma_len(&dbi->sgl) = copy_bytes;
++		desc = dmaengine_prep_slave_sg(dma->chan, &dbi->sgl, 1,
++					       DMA_DEV_TO_MEM,
++					       DMA_PREP_INTERRUPT | DMA_CTRL_ACK |
++					       DMA_PREP_FENCE);
++		if (!desc) {
++			dev_err(dev, "DMA preparation failed");
++			ret = -EIO;
++			break;
++		}
++
++		desc->callback = rp1_pio_sm_dma_callback;
++		desc->callback_param = dma;
++
++		// Submit the buffer - the callback will kick the semaphore
++
++		ret = dmaengine_submit(desc);
++		if (ret < 0)
++			break;
++
++		dma_async_issue_pending(dma->chan);
++
++		dma->head_idx++;
++		bytes -= copy_bytes;
++	}
++
++	return ret;
++}
++
++static int rp1_pio_sm_xfer_data(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_xfer_data_args *args = param;
++	struct rp1_pio_device *pio = client->pio;
++	struct dma_info *dma;
++
++	if (args->sm >= RP1_PIO_SMS_COUNT || args->dir >= RP1_PIO_DIR_COUNT ||
++	    !args->data_bytes || !args->data)
++		return -EINVAL;
++
++	dma = &pio->dma_configs[args->sm][args->dir];
++
++	if (args->dir == RP1_PIO_DIR_TO_SM)
++		return rp1_pio_sm_tx_user(pio, dma, args->data, args->data_bytes);
++	else
++		return rp1_pio_sm_rx_user(pio, dma, args->data, args->data_bytes);
++}
++
++struct handler_info {
++	const char *name;
++	int (*func)(struct rp1_pio_client *client, void *param);
++	int argsize;
++} ioctl_handlers[] = {
++	HANDLER(SM_CONFIG_XFER, sm_config_xfer),
++	HANDLER(SM_XFER_DATA, sm_xfer_data),
++
++	HANDLER(CAN_ADD_PROGRAM, can_add_program),
++	HANDLER(ADD_PROGRAM, add_program),
++	HANDLER(REMOVE_PROGRAM, remove_program),
++	HANDLER(CLEAR_INSTR_MEM, clear_instr_mem),
++
++	HANDLER(SM_CLAIM, sm_claim),
++	HANDLER(SM_UNCLAIM, sm_unclaim),
++	HANDLER(SM_IS_CLAIMED, sm_is_claimed),
++
++	HANDLER(SM_INIT, sm_init),
++	HANDLER(SM_SET_CONFIG, sm_set_config),
++	HANDLER(SM_EXEC, sm_exec),
++	HANDLER(SM_CLEAR_FIFOS, sm_clear_fifos),
++	HANDLER(SM_SET_CLKDIV, sm_set_clkdiv),
++	HANDLER(SM_SET_PINS, sm_set_pins),
++	HANDLER(SM_SET_PINDIRS, sm_set_pindirs),
++	HANDLER(SM_SET_ENABLED, sm_set_enabled),
++	HANDLER(SM_RESTART, sm_restart),
++	HANDLER(SM_CLKDIV_RESTART, sm_clkdiv_restart),
++	HANDLER(SM_ENABLE_SYNC, sm_enable_sync),
++	HANDLER(SM_PUT, sm_put),
++	HANDLER(SM_GET, sm_get),
++	HANDLER(SM_SET_DMACTRL, sm_set_dmactrl),
++	HANDLER(SM_FIFO_STATE, sm_fifo_state),
++	HANDLER(SM_DRAIN_TX, sm_drain_tx),
++
++	HANDLER(GPIO_INIT, gpio_init),
++	HANDLER(GPIO_SET_FUNCTION, gpio_set_function),
++	HANDLER(GPIO_SET_PULLS, gpio_set_pulls),
++	HANDLER(GPIO_SET_OUTOVER, gpio_set_outover),
++	HANDLER(GPIO_SET_INOVER, gpio_set_inover),
++	HANDLER(GPIO_SET_OEOVER, gpio_set_oeover),
++	HANDLER(GPIO_SET_INPUT_ENABLED, gpio_set_input_enabled),
++	HANDLER(GPIO_SET_DRIVE_STRENGTH, gpio_set_drive_strength),
++
++	HANDLER(READ_HW, read_hw),
++	HANDLER(WRITE_HW, write_hw),
++};
++
++struct rp1_pio_client *pio_open(void)
++{
++	struct rp1_pio_client *client;
++
++	client = kzalloc(sizeof(*client), GFP_KERNEL);
++	if (!client)
++		return ERR_PTR(-ENOMEM);
++
++	client->pio = g_pio;
++
++	return client;
++}
++EXPORT_SYMBOL_GPL(pio_open);
++
++void pio_close(struct rp1_pio_client *client)
++{
++	struct rp1_pio_device *pio = client->pio;
++	uint claimed_dmas = client->claimed_dmas;
++	int i;
++
++	/* Free any allocated resources */
++
++	for (i = 0; claimed_dmas; i++) {
++		uint mask = (1 << i);
++
++		if (claimed_dmas & mask) {
++			struct dma_info *dma = &pio->dma_configs[i >> 1][i & 1];
++
++			claimed_dmas &= ~mask;
++			rp1_pio_sm_dma_free(&pio->pdev->dev, dma);
++		}
++	}
++
++	spin_lock(&pio->lock);
++	pio->claimed_dmas &= ~client->claimed_dmas;
++	spin_unlock(&pio->lock);
++
++	if (client->claimed_sms) {
++		struct rp1_pio_sm_set_enabled_args se_args = {
++			.mask = client->claimed_sms, .enable = 0
++		};
++		struct rp1_pio_sm_claim_args uc_args = {
++			.mask = client->claimed_sms
++		};
++
++		rp1_pio_sm_set_enabled(client, &se_args);
++		rp1_pio_sm_unclaim(client, &uc_args);
++	}
++
++	if (client->claimed_instrs)
++		rp1_pio_remove_instrs(pio, client->claimed_instrs);
++
++	/* Reinitialise the SM? */
++
++	kfree(client);
++}
++EXPORT_SYMBOL_GPL(pio_close);
++
++void pio_set_error(struct rp1_pio_client *client, int err)
++{
++	client->error = err;
++}
++EXPORT_SYMBOL_GPL(pio_set_error);
++
++int pio_get_error(const struct rp1_pio_client *client)
++{
++	return client->error;
++}
++EXPORT_SYMBOL_GPL(pio_get_error);
++
++void pio_clear_error(struct rp1_pio_client *client)
++{
++	client->error = 0;
++}
++EXPORT_SYMBOL_GPL(pio_clear_error);
++
++static int rp1_pio_open(struct inode *inode, struct file *filp)
++{
++	struct rp1_pio_client *client;
++
++	client = pio_open();
++	if (IS_ERR(client))
++		return PTR_ERR(client);
++
++	filp->private_data = client;
++
++	return 0;
++}
++
++static int rp1_pio_release(struct inode *inode, struct file *filp)
++{
++	struct rp1_pio_client *client = filp->private_data;
++
++	pio_close(client);
++
++	return 0;
++}
++
++static long rp1_pio_ioctl(struct file *filp, unsigned int ioctl_num,
++			  unsigned long ioctl_param)
++{
++	struct rp1_pio_client *client = filp->private_data;
++	struct device *dev = &client->pio->pdev->dev;
++	void __user *argp = (void __user *)ioctl_param;
++	int nr = _IOC_NR(ioctl_num);
++	int sz = _IOC_SIZE(ioctl_num);
++	struct handler_info *hdlr = &ioctl_handlers[nr];
++	uint32_t argbuf[MAX_ARG_SIZE/sizeof(uint32_t)];
++	int ret;
++
++	if (nr >= ARRAY_SIZE(ioctl_handlers) || !hdlr->func) {
++		dev_err(dev, "unknown ioctl: %x\n", ioctl_num);
++		return -EOPNOTSUPP;
++	}
++
++	if (sz != hdlr->argsize) {
++		dev_err(dev, "wrong %s argsize (expected %d, got %d)\n",
++			hdlr->name, hdlr->argsize, sz);
++		return -EINVAL;
++	}
++
++	if (copy_from_user(argbuf, argp, sz))
++		return -EFAULT;
++
++	ret = (hdlr->func)(client, argbuf);
++	dev_dbg(dev, "%s: %s -> %d\n", __func__, hdlr->name, ret);
++	if (ret > 0) {
++		if (copy_to_user(argp, argbuf, ret))
++			ret = -EFAULT;
++	}
++
++	return ret;
++}
++
++#ifdef CONFIG_COMPAT
++
++struct rp1_pio_sm_xfer_data_args_compat {
++	uint16_t sm;
++	uint16_t dir;
++	uint16_t data_bytes;
++	compat_uptr_t data;
++};
++
++struct rp1_access_hw_args_compat {
++	uint32_t addr;
++	uint32_t len;
++	compat_uptr_t data;
++};
++
++#define PIO_IOC_SM_XFER_DATA_COMPAT _IOW(PIO_IOC_MAGIC, 1, struct rp1_pio_sm_xfer_data_args_compat)
++#define PIO_IOC_READ_HW_COMPAT _IOW(PIO_IOC_MAGIC, 8, struct rp1_access_hw_args_compat)
++#define PIO_IOC_WRITE_HW_COMPAT _IOW(PIO_IOC_MAGIC, 9, struct rp1_access_hw_args_compat)
++
++static long rp1_pio_compat_ioctl(struct file *filp, unsigned int ioctl_num,
++				 unsigned long ioctl_param)
++{
++	struct rp1_pio_client *client = filp->private_data;
++
++	switch (ioctl_num) {
++	case PIO_IOC_SM_XFER_DATA_COMPAT:
++	{
++		struct rp1_pio_sm_xfer_data_args_compat compat_param;
++		struct rp1_pio_sm_xfer_data_args param;
++
++		if (copy_from_user(&compat_param, compat_ptr(ioctl_param), sizeof(compat_param)))
++			return -EFAULT;
++		param.sm = compat_param.sm;
++		param.dir = compat_param.dir;
++		param.data_bytes = compat_param.data_bytes;
++		param.data = compat_ptr(compat_param.data);
++		return rp1_pio_sm_xfer_data(client, &param);
++	}
++
++	case PIO_IOC_READ_HW_COMPAT:
++	case PIO_IOC_WRITE_HW_COMPAT:
++	{
++		struct rp1_access_hw_args_compat compat_param;
++		struct rp1_access_hw_args param;
++
++		if (copy_from_user(&compat_param, compat_ptr(ioctl_param), sizeof(compat_param)))
++			return -EFAULT;
++		param.addr = compat_param.addr;
++		param.len = compat_param.len;
++		param.data = compat_ptr(compat_param.data);
++		if (ioctl_num == PIO_IOC_READ_HW_COMPAT)
++			return rp1_pio_read_hw(client, &param);
++		else
++			return rp1_pio_write_hw(client, &param);
++	}
++	default:
++		return rp1_pio_ioctl(filp, ioctl_num, ioctl_param);
++	}
++}
++#else
++#define rp1_pio_compat_ioctl NULL
++#endif
++
++const struct file_operations rp1_pio_fops = {
++	.owner =	THIS_MODULE,
++	.open =		rp1_pio_open,
++	.release =	rp1_pio_release,
++	.unlocked_ioctl = rp1_pio_ioctl,
++	.compat_ioctl = rp1_pio_compat_ioctl,
++};
++
++static int rp1_pio_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct resource *ioresource;
++	struct rp1_pio_device *pio;
++	struct rp1_firmware *fw;
++	uint32_t op_count = 0;
++	uint32_t op_base = 0;
++	struct device *cdev;
++	char dev_name[16];
++	void *p;
++	int ret;
++	int i;
++
++	/* Run-time check for a build-time misconfiguration */
++	for (i = 0; i < ARRAY_SIZE(ioctl_handlers); i++) {
++		struct handler_info *hdlr = &ioctl_handlers[i];
++
++		if (WARN_ON(hdlr->argsize > MAX_ARG_SIZE))
++			return -EINVAL;
++	}
++
++	fw = devm_rp1_firmware_get(dev, dev->of_node);
++	if (IS_ERR(fw))
++		return PTR_ERR(fw);
++
++	ret = rp1_firmware_get_feature(fw, FOURCC_PIO, &op_base, &op_count);
++	if (ret < 0)
++		return ret;
++
++	pio = devm_kzalloc(&pdev->dev, sizeof(*pio), GFP_KERNEL);
++	if (!pio)
++		return -ENOMEM;
++
++	platform_set_drvdata(pdev, pio);
++	pio->fw_pio_base = op_base;
++	pio->fw_pio_count = op_count;
++	pio->pdev = pdev;
++	pio->fw = fw;
++	spin_lock_init(&pio->lock);
++	mutex_init(&pio->instr_mutex);
++
++	p = devm_platform_get_and_ioremap_resource(pdev, 0, &ioresource);
++	if (IS_ERR(p))
++		return PTR_ERR(p);
++
++	pio->phys_addr = ioresource->start;
++
++	ret = alloc_chrdev_region(&pio->dev_num, 0, 1, DRIVER_NAME);
++	if (ret < 0) {
++		dev_err(dev, "alloc_chrdev_region failed (rc=%d)\n", ret);
++		goto out_err;
++	}
++
++	cdev_init(&pio->cdev, &rp1_pio_fops);
++	ret = cdev_add(&pio->cdev, pio->dev_num, 1);
++	if (ret) {
++		dev_err(dev, "cdev_add failed (err %d)\n", ret);
++		goto out_unregister;
++	}
++
++	pio->dev_class = class_create(DRIVER_NAME);
++	if (IS_ERR(pio->dev_class)) {
++		ret = PTR_ERR(pio->dev_class);
++		dev_err(dev, "class_create failed (err %d)\n", ret);
++		goto out_cdev_del;
++	}
++	pdev->id = of_alias_get_id(pdev->dev.of_node, "pio");
++	if (pdev->id < 0) {
++		dev_err(dev, "alias is missing\n");
++		return -EINVAL;
++		goto out_class_destroy;
++	}
++	sprintf(dev_name, "pio%d", pdev->id);
++	cdev = device_create(pio->dev_class, NULL, pio->dev_num, NULL, dev_name);
++	if (IS_ERR(cdev)) {
++		ret = PTR_ERR(cdev);
++		dev_err(dev, "%s: device_create failed (err %d)\n", __func__, ret);
++		goto out_class_destroy;
++	}
++
++	g_pio = pio;
++
++	dev_info(dev, "Created instance as %s\n", dev_name);
++	return 0;
++
++out_class_destroy:
++	class_destroy(pio->dev_class);
++
++out_cdev_del:
++	cdev_del(&pio->cdev);
++
++out_unregister:
++	unregister_chrdev_region(pio->dev_num, 1);
++
++out_err:
++	return ret;
++}
++
++static void rp1_pio_remove(struct platform_device *pdev)
++{
++	struct rp1_pio_device *pio = platform_get_drvdata(pdev);
++
++	/* There should be no clients */
++
++	if (g_pio == pio)
++		g_pio = NULL;
++}
++
++static const struct of_device_id rp1_pio_ids[] = {
++	{ .compatible = "raspberrypi,rp1-pio" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, rp1_pio_ids);
++
++static struct platform_driver rp1_pio_driver = {
++	.driver	= {
++		.name		= "rp1-pio",
++		.of_match_table	= of_match_ptr(rp1_pio_ids),
++	},
++	.probe		= rp1_pio_probe,
++	.remove_new	= rp1_pio_remove,
++	.shutdown	= rp1_pio_remove,
++};
++
++module_platform_driver(rp1_pio_driver);
++
++MODULE_DESCRIPTION("PIO controller driver for Raspberry Pi RP1");
++MODULE_AUTHOR("Phil Elwell");
++MODULE_LICENSE("GPL");
+--- /dev/null
++++ b/include/linux/pio_instructions.h
+@@ -0,0 +1,481 @@
++/* SPDX-License-Identifier: BSD-3-Clause */
++/*
++ * Copyright (c) 2020 Raspberry Pi (Trading) Ltd.
++ */
++
++#ifndef _HARDWARE_PIO_INSTRUCTIONS_H
++#define _HARDWARE_PIO_INSTRUCTIONS_H
++
++/** \brief PIO instruction encoding
++ *  \defgroup pio_instructions pio_instructions
++ *  \ingroup hardware_pio
++ *
++ * Functions for generating PIO instruction encodings programmatically. In debug builds
++ *`PARAM_ASSERTIONS_ENABLED_PIO_INSTRUCTIONS` can be set to 1 to enable validation of encoding function
++ * parameters.
++ *
++ * For fuller descriptions of the instructions in question see the "RP2040 Datasheet"
++ */
++
++// PICO_CONFIG: PARAM_ASSERTIONS_ENABLED_PIO_INSTRUCTIONS, Enable/disable assertions in the PIO instructions, type=bool, default=0, group=pio_instructions
++#ifndef PARAM_ASSERTIONS_ENABLED_PIO_INSTRUCTIONS
++#define PARAM_ASSERTIONS_ENABLED_PIO_INSTRUCTIONS 0
++#endif
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++enum pio_instr_bits {
++    pio_instr_bits_jmp = 0x0000,
++    pio_instr_bits_wait = 0x2000,
++    pio_instr_bits_in = 0x4000,
++    pio_instr_bits_out = 0x6000,
++    pio_instr_bits_push = 0x8000,
++    pio_instr_bits_pull = 0x8080,
++    pio_instr_bits_mov = 0xa000,
++    pio_instr_bits_irq = 0xc000,
++    pio_instr_bits_set = 0xe000,
++};
++
++#ifndef NDEBUG
++#define _PIO_INVALID_IN_SRC    0x08u
++#define _PIO_INVALID_OUT_DEST 0x10u
++#define _PIO_INVALID_SET_DEST 0x20u
++#define _PIO_INVALID_MOV_SRC  0x40u
++#define _PIO_INVALID_MOV_DEST 0x80u
++#else
++#define _PIO_INVALID_IN_SRC    0u
++#define _PIO_INVALID_OUT_DEST 0u
++#define _PIO_INVALID_SET_DEST 0u
++#define _PIO_INVALID_MOV_SRC  0u
++#define _PIO_INVALID_MOV_DEST 0u
++#endif
++
++/*! \brief Enumeration of values to pass for source/destination args for instruction encoding functions
++ *  \ingroup pio_instructions
++ *
++ * \note Not all values are suitable for all functions. Validity is only checked in debug mode when
++ * `PARAM_ASSERTIONS_ENABLED_PIO_INSTRUCTIONS` is 1
++ */
++enum pio_src_dest {
++    pio_pins = 0u,
++    pio_x = 1u,
++    pio_y = 2u,
++    pio_null = 3u | _PIO_INVALID_SET_DEST | _PIO_INVALID_MOV_DEST,
++    pio_pindirs = 4u | _PIO_INVALID_IN_SRC | _PIO_INVALID_MOV_SRC | _PIO_INVALID_MOV_DEST,
++    pio_exec_mov = 4u | _PIO_INVALID_IN_SRC | _PIO_INVALID_OUT_DEST | _PIO_INVALID_SET_DEST | _PIO_INVALID_MOV_SRC,
++    pio_status = 5u | _PIO_INVALID_IN_SRC | _PIO_INVALID_OUT_DEST | _PIO_INVALID_SET_DEST | _PIO_INVALID_MOV_DEST,
++    pio_pc = 5u | _PIO_INVALID_IN_SRC | _PIO_INVALID_SET_DEST | _PIO_INVALID_MOV_SRC,
++    pio_isr = 6u | _PIO_INVALID_SET_DEST,
++    pio_osr = 7u | _PIO_INVALID_OUT_DEST | _PIO_INVALID_SET_DEST,
++    pio_exec_out = 7u | _PIO_INVALID_IN_SRC | _PIO_INVALID_SET_DEST | _PIO_INVALID_MOV_SRC | _PIO_INVALID_MOV_DEST,
++};
++
++static inline uint _pio_major_instr_bits(uint instr) {
++    return instr & 0xe000u;
++}
++
++static inline uint _pio_encode_instr_and_args(enum pio_instr_bits instr_bits, uint arg1, uint arg2) {
++    valid_params_if(PIO_INSTRUCTIONS, arg1 <= 0x7);
++#if PARAM_ASSERTIONS_ENABLED(PIO_INSTRUCTIONS)
++    uint32_t major = _pio_major_instr_bits(instr_bits);
++    if (major == pio_instr_bits_in || major == pio_instr_bits_out) {
++        assert(arg2 && arg2 <= 32);
++    } else {
++        assert(arg2 <= 31);
++    }
++#endif
++    return instr_bits | (arg1 << 5u) | (arg2 & 0x1fu);
++}
++
++static inline uint _pio_encode_instr_and_src_dest(enum pio_instr_bits instr_bits, enum pio_src_dest dest, uint value) {
++    return _pio_encode_instr_and_args(instr_bits, dest & 7u, value);
++}
++
++/*! \brief Encode just the delay slot bits of an instruction
++ *  \ingroup pio_instructions
++ *
++ * \note This function does not return a valid instruction encoding; instead it returns an encoding of the delay
++ * slot suitable for `OR`ing with the result of an encoding function for an actual instruction. Care should be taken when
++ * combining the results of this function with the results of \ref pio_encode_sideset and \ref pio_encode_sideset_opt
++ * as they share the same bits within the instruction encoding.
++ *
++ * \param cycles the number of cycles 0-31 (or less if side set is being used)
++ * \return the delay slot bits to be ORed with an instruction encoding
++ */
++static inline uint pio_encode_delay(uint cycles) {
++    // note that the maximum cycles will be smaller if sideset_bit_count > 0
++    valid_params_if(PIO_INSTRUCTIONS, cycles <= 0x1f);
++    return cycles << 8u;
++}
++
++/*! \brief Encode just the side set bits of an instruction (in non optional side set mode)
++ *  \ingroup pio_instructions
++ *
++ * \note This function does not return a valid instruction encoding; instead it returns an encoding of the side set bits
++ * suitable for `OR`ing with the result of an encoding function for an actual instruction. Care should be taken when
++ * combining the results of this function with the results of \ref pio_encode_delay as they share the same bits
++ * within the instruction encoding.
++ *
++ * \param sideset_bit_count number of side set bits as would be specified via `.sideset` in pioasm
++ * \param value the value to sideset on the pins
++ * \return the side set bits to be ORed with an instruction encoding
++ */
++static inline uint pio_encode_sideset(uint sideset_bit_count, uint value) {
++    valid_params_if(PIO_INSTRUCTIONS, sideset_bit_count >= 1 && sideset_bit_count <= 5);
++    valid_params_if(PIO_INSTRUCTIONS, value <= ((1u << sideset_bit_count) - 1));
++    return value << (13u - sideset_bit_count);
++}
++
++/*! \brief Encode just the side set bits of an instruction (in optional -`opt` side set mode)
++ *  \ingroup pio_instructions
++ *
++ * \note This function does not return a valid instruction encoding; instead it returns an encoding of the side set bits
++ * suitable for `OR`ing with the result of an encoding function for an actual instruction. Care should be taken when
++ * combining the results of this function with the results of \ref pio_encode_delay as they share the same bits
++ * within the instruction encoding.
++ *
++ * \param sideset_bit_count number of side set bits as would be specified via `.sideset <n> opt` in pioasm
++ * \param value the value to sideset on the pins
++ * \return the side set bits to be ORed with an instruction encoding
++ */
++static inline uint pio_encode_sideset_opt(uint sideset_bit_count, uint value) {
++    valid_params_if(PIO_INSTRUCTIONS, sideset_bit_count >= 1 && sideset_bit_count <= 4);
++    valid_params_if(PIO_INSTRUCTIONS, value <= ((1u << sideset_bit_count) - 1));
++    return 0x1000u | value << (12u - sideset_bit_count);
++}
++
++/*! \brief Encode an unconditional JMP instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `JMP <addr>`
++ *
++ * \param addr The target address 0-31 (an absolute address within the PIO instruction memory)
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_jmp(uint addr) {
++    return _pio_encode_instr_and_args(pio_instr_bits_jmp, 0, addr);
++}
++
++/*! \brief Encode a conditional JMP if scratch X zero instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `JMP !X <addr>`
++ *
++ * \param addr The target address 0-31 (an absolute address within the PIO instruction memory)
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_jmp_not_x(uint addr) {
++    return _pio_encode_instr_and_args(pio_instr_bits_jmp, 1, addr);
++}
++
++/*! \brief Encode a conditional JMP if scratch X non-zero (and post-decrement X) instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `JMP X-- <addr>`
++ *
++ * \param addr The target address 0-31 (an absolute address within the PIO instruction memory)
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_jmp_x_dec(uint addr) {
++    return _pio_encode_instr_and_args(pio_instr_bits_jmp, 2, addr);
++}
++
++/*! \brief Encode a conditional JMP if scratch Y zero instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `JMP !Y <addr>`
++ *
++ * \param addr The target address 0-31 (an absolute address within the PIO instruction memory)
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_jmp_not_y(uint addr) {
++    return _pio_encode_instr_and_args(pio_instr_bits_jmp, 3, addr);
++}
++
++/*! \brief Encode a conditional JMP if scratch Y non-zero (and post-decrement Y) instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `JMP Y-- <addr>`
++ *
++ * \param addr The target address 0-31 (an absolute address within the PIO instruction memory)
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_jmp_y_dec(uint addr) {
++    return _pio_encode_instr_and_args(pio_instr_bits_jmp, 4, addr);
++}
++
++/*! \brief Encode a conditional JMP if scratch X not equal scratch Y instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `JMP X!=Y <addr>`
++ *
++ * \param addr The target address 0-31 (an absolute address within the PIO instruction memory)
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_jmp_x_ne_y(uint addr) {
++    return _pio_encode_instr_and_args(pio_instr_bits_jmp, 5, addr);
++}
++
++/*! \brief Encode a conditional JMP if input pin high instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `JMP PIN <addr>`
++ *
++ * \param addr The target address 0-31 (an absolute address within the PIO instruction memory)
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_jmp_pin(uint addr) {
++    return _pio_encode_instr_and_args(pio_instr_bits_jmp, 6, addr);
++}
++
++/*! \brief Encode a conditional JMP if output shift register not empty instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `JMP !OSRE <addr>`
++ *
++ * \param addr The target address 0-31 (an absolute address within the PIO instruction memory)
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_jmp_not_osre(uint addr) {
++    return _pio_encode_instr_and_args(pio_instr_bits_jmp, 7, addr);
++}
++
++static inline uint _pio_encode_irq(bool relative, uint irq) {
++    valid_params_if(PIO_INSTRUCTIONS, irq <= 7);
++    return (relative ? 0x10u : 0x0u) | irq;
++}
++
++/*! \brief Encode a WAIT for GPIO pin instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `WAIT <polarity> GPIO <gpio>`
++ *
++ * \param polarity true for `WAIT 1`, false for `WAIT 0`
++ * \param gpio The real GPIO number 0-31
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_wait_gpio(bool polarity, uint gpio) {
++    return _pio_encode_instr_and_args(pio_instr_bits_wait, 0u | (polarity ? 4u : 0u), gpio);
++}
++
++/*! \brief Encode a WAIT for pin instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `WAIT <polarity> PIN <pin>`
++ *
++ * \param polarity true for `WAIT 1`, false for `WAIT 0`
++ * \param pin The pin number 0-31 relative to the executing SM's input pin mapping
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_wait_pin(bool polarity, uint pin) {
++    return _pio_encode_instr_and_args(pio_instr_bits_wait, 1u | (polarity ? 4u : 0u), pin);
++}
++
++/*! \brief Encode a WAIT for IRQ instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `WAIT <polarity> IRQ <irq> <relative>`
++ *
++ * \param polarity true for `WAIT 1`, false for `WAIT 0`
++ * \param relative true for a `WAIT IRQ <irq> REL`, false for regular `WAIT IRQ <irq>`
++ * \param irq the irq number 0-7
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_wait_irq(bool polarity, bool relative, uint irq) {
++    valid_params_if(PIO_INSTRUCTIONS, irq <= 7);
++    return _pio_encode_instr_and_args(pio_instr_bits_wait, 2u | (polarity ? 4u : 0u), _pio_encode_irq(relative, irq));
++}
++
++/*! \brief Encode an IN instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `IN <src>, <count>`
++ *
++ * \param src The source to take data from
++ * \param count The number of bits 1-32
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_in(enum pio_src_dest src, uint count) {
++    valid_params_if(PIO_INSTRUCTIONS, !(src & _PIO_INVALID_IN_SRC));
++    return _pio_encode_instr_and_src_dest(pio_instr_bits_in, src, count);
++}
++
++/*! \brief Encode an OUT instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `OUT <src>, <count>`
++ *
++ * \param dest The destination to write data to
++ * \param count The number of bits 1-32
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_out(enum pio_src_dest dest, uint count) {
++    valid_params_if(PIO_INSTRUCTIONS, !(dest & _PIO_INVALID_OUT_DEST));
++    return _pio_encode_instr_and_src_dest(pio_instr_bits_out, dest, count);
++}
++
++/*! \brief Encode a PUSH instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `PUSH <if_full>, <block>`
++ *
++ * \param if_full true for `PUSH IF_FULL ...`, false for `PUSH ...`
++ * \param block true for `PUSH ... BLOCK`, false for `PUSH ...`
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_push(bool if_full, bool block) {
++    return _pio_encode_instr_and_args(pio_instr_bits_push, (if_full ? 2u : 0u) | (block ? 1u : 0u), 0);
++}
++
++/*! \brief Encode a PULL instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `PULL <if_empty>, <block>`
++ *
++ * \param if_empty true for `PULL IF_EMPTY ...`, false for `PULL ...`
++ * \param block true for `PULL ... BLOCK`, false for `PULL ...`
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_pull(bool if_empty, bool block) {
++    return _pio_encode_instr_and_args(pio_instr_bits_pull, (if_empty ? 2u : 0u) | (block ? 1u : 0u), 0);
++}
++
++/*! \brief Encode a MOV instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `MOV <dest>, <src>`
++ *
++ * \param dest The destination to write data to
++ * \param src The source to take data from
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_mov(enum pio_src_dest dest, enum pio_src_dest src) {
++    valid_params_if(PIO_INSTRUCTIONS, !(dest & _PIO_INVALID_MOV_DEST));
++    valid_params_if(PIO_INSTRUCTIONS, !(src & _PIO_INVALID_MOV_SRC));
++    return _pio_encode_instr_and_src_dest(pio_instr_bits_mov, dest, src & 7u);
++}
++
++/*! \brief Encode a MOV instruction with bit invert
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `MOV <dest>, ~<src>`
++ *
++ * \param dest The destination to write inverted data to
++ * \param src The source to take data from
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_mov_not(enum pio_src_dest dest, enum pio_src_dest src) {
++    valid_params_if(PIO_INSTRUCTIONS, !(dest & _PIO_INVALID_MOV_DEST));
++    valid_params_if(PIO_INSTRUCTIONS, !(src & _PIO_INVALID_MOV_SRC));
++    return _pio_encode_instr_and_src_dest(pio_instr_bits_mov, dest, (1u << 3u) | (src & 7u));
++}
++
++/*! \brief Encode a MOV instruction with bit reverse
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `MOV <dest>, ::<src>`
++ *
++ * \param dest The destination to write bit reversed data to
++ * \param src The source to take data from
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_mov_reverse(enum pio_src_dest dest, enum pio_src_dest src) {
++    valid_params_if(PIO_INSTRUCTIONS, !(dest & _PIO_INVALID_MOV_DEST));
++    valid_params_if(PIO_INSTRUCTIONS, !(src & _PIO_INVALID_MOV_SRC));
++    return _pio_encode_instr_and_src_dest(pio_instr_bits_mov, dest, (2u << 3u) | (src & 7u));
++}
++
++/*! \brief Encode a IRQ SET instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `IRQ SET <irq> <relative>`
++ *
++ * \param relative true for a `IRQ SET <irq> REL`, false for regular `IRQ SET <irq>`
++ * \param irq the irq number 0-7
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_irq_set(bool relative, uint irq) {
++    return _pio_encode_instr_and_args(pio_instr_bits_irq, 0, _pio_encode_irq(relative, irq));
++}
++
++/*! \brief Encode a IRQ WAIT instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `IRQ WAIT <irq> <relative>`
++ *
++ * \param relative true for a `IRQ WAIT <irq> REL`, false for regular `IRQ WAIT <irq>`
++ * \param irq the irq number 0-7
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_irq_wait(bool relative, uint irq) {
++    return _pio_encode_instr_and_args(pio_instr_bits_irq, 1, _pio_encode_irq(relative, irq));
++}
++
++/*! \brief Encode a IRQ CLEAR instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `IRQ CLEAR <irq> <relative>`
++ *
++ * \param relative true for a `IRQ CLEAR <irq> REL`, false for regular `IRQ CLEAR <irq>`
++ * \param irq the irq number 0-7
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_irq_clear(bool relative, uint irq) {
++    return _pio_encode_instr_and_args(pio_instr_bits_irq, 2, _pio_encode_irq(relative, irq));
++}
++
++/*! \brief Encode a SET instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `SET <dest>, <value>`
++ *
++ * \param dest The destination to apply the value to
++ * \param value The value 0-31
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_set(enum pio_src_dest dest, uint value) {
++    valid_params_if(PIO_INSTRUCTIONS, !(dest & _PIO_INVALID_SET_DEST));
++    return _pio_encode_instr_and_src_dest(pio_instr_bits_set, dest, value);
++}
++
++/*! \brief Encode a NOP instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `NOP` which is itself encoded as `MOV y, y`
++ *
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_nop(void) {
++    return pio_encode_mov(pio_y, pio_y);
++}
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif
+--- /dev/null
++++ b/include/linux/pio_rp1.h
+@@ -0,0 +1,962 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * Copyright (c) 2024 Raspberry Pi Ltd.
++ * All rights reserved.
++ */
++
++#ifndef _PIO_RP1_H
++#define _PIO_RP1_H
++
++#include <uapi/misc/rp1_pio_if.h>
++
++#define PARAM_WARNINGS_ENABLED 1
++
++#ifdef DEBUG
++#define PARAM_WARNINGS_ENABLED 1
++#endif
++
++#ifndef PARAM_WARNINGS_ENABLED
++#define PARAM_WARNINGS_ENABLED 0
++#endif
++
++#define bad_params_if(client, test) \
++	({ bool f = (test); if (f) pio_set_error(client, -EINVAL); \
++		if (f && PARAM_WARNINGS_ENABLED) WARN_ON((test)); \
++		f; })
++
++#ifndef PARAM_ASSERTIONS_ENABLE_ALL
++#define PARAM_ASSERTIONS_ENABLE_ALL 0
++#endif
++
++#ifndef PARAM_ASSERTIONS_DISABLE_ALL
++#define PARAM_ASSERTIONS_DISABLE_ALL 0
++#endif
++
++#define PARAM_ASSERTIONS_ENABLED(x) \
++	((PARAM_ASSERTIONS_ENABLED_ ## x || PARAM_ASSERTIONS_ENABLE_ALL) && \
++	 !PARAM_ASSERTIONS_DISABLE_ALL)
++#define valid_params_if(x, test) ({if (PARAM_ASSERTIONS_ENABLED(x)) WARN_ON(test); })
++
++#include <linux/pio_instructions.h>
++
++#define NUM_PIO_STATE_MACHINES		4
++#define PIO_INSTRUCTION_COUNT		32
++#define PIO_ORIGIN_ANY			((uint)(~0))
++#define GPIOS_MASK			((1 << RP1_PIO_GPIO_COUNT) - 1)
++
++#define PICO_NO_HARDWARE		0
++
++#define pio0				pio_open_helper(0)
++
++#define PROC_PIO_SM0_PINCTRL_OUT_BASE_BITS	0x0000001f
++#define PROC_PIO_SM0_PINCTRL_OUT_BASE_LSB	0
++#define PROC_PIO_SM0_PINCTRL_OUT_COUNT_BITS	0x03f00000
++#define PROC_PIO_SM0_PINCTRL_OUT_COUNT_LSB	20
++#define PROC_PIO_SM0_PINCTRL_SET_BASE_BITS	0x000003e0
++#define PROC_PIO_SM0_PINCTRL_SET_BASE_LSB	5
++#define PROC_PIO_SM0_PINCTRL_SET_COUNT_BITS	0x1c000000
++#define PROC_PIO_SM0_PINCTRL_SET_COUNT_LSB	26
++#define PROC_PIO_SM0_PINCTRL_IN_BASE_BITS	0x000f8000
++#define PROC_PIO_SM0_PINCTRL_IN_BASE_LSB	15
++#define PROC_PIO_SM0_PINCTRL_SIDESET_BASE_BITS	0x00007c00
++#define PROC_PIO_SM0_PINCTRL_SIDESET_BASE_LSB	10
++#define PROC_PIO_SM0_PINCTRL_SIDESET_COUNT_BITS	0xe0000000
++#define PROC_PIO_SM0_PINCTRL_SIDESET_COUNT_LSB	29
++#define PROC_PIO_SM0_EXECCTRL_SIDE_EN_BITS	0x40000000
++#define PROC_PIO_SM0_EXECCTRL_SIDE_EN_LSB	30
++#define PROC_PIO_SM0_EXECCTRL_SIDE_PINDIR_BITS	0x20000000
++#define PROC_PIO_SM0_EXECCTRL_SIDE_PINDIR_LSB	29
++#define PROC_PIO_SM0_CLKDIV_INT_LSB		16
++#define PROC_PIO_SM0_CLKDIV_FRAC_LSB		8
++#define PROC_PIO_SM0_EXECCTRL_WRAP_TOP_BITS	0x0001f000
++#define PROC_PIO_SM0_EXECCTRL_WRAP_TOP_LSB	12
++#define PROC_PIO_SM0_EXECCTRL_WRAP_BOTTOM_BITS	0x00000f80
++#define PROC_PIO_SM0_EXECCTRL_WRAP_BOTTOM_LSB	7
++#define PROC_PIO_SM0_EXECCTRL_JMP_PIN_BITS	0x1f000000
++#define PROC_PIO_SM0_EXECCTRL_JMP_PIN_LSB	24
++#define PROC_PIO_SM0_SHIFTCTRL_IN_SHIFTDIR_BITS	0x00040000
++#define PROC_PIO_SM0_SHIFTCTRL_IN_SHIFTDIR_LSB	18
++#define PROC_PIO_SM0_SHIFTCTRL_AUTOPULL_BITS	0x00020000
++#define PROC_PIO_SM0_SHIFTCTRL_AUTOPULL_LSB	17
++#define PROC_PIO_SM0_SHIFTCTRL_AUTOPUSH_BITS	0x00010000
++#define PROC_PIO_SM0_SHIFTCTRL_AUTOPUSH_LSB	16
++#define PROC_PIO_SM0_SHIFTCTRL_PUSH_THRESH_BITS	0x01f00000
++#define PROC_PIO_SM0_SHIFTCTRL_PUSH_THRESH_LSB	20
++#define PROC_PIO_SM0_SHIFTCTRL_OUT_SHIFTDIR_BITS	0x00080000
++#define PROC_PIO_SM0_SHIFTCTRL_OUT_SHIFTDIR_LSB	19
++#define PROC_PIO_SM0_SHIFTCTRL_PULL_THRESH_BITS	0x3e000000
++#define PROC_PIO_SM0_SHIFTCTRL_PULL_THRESH_LSB	25
++#define PROC_PIO_SM0_SHIFTCTRL_FJOIN_TX_BITS	0x40000000
++#define PROC_PIO_SM0_SHIFTCTRL_FJOIN_TX_LSB	30
++#define PROC_PIO_SM0_SHIFTCTRL_FJOIN_RX_BITS	0x80000000
++#define PROC_PIO_SM0_SHIFTCTRL_FJOIN_RX_LSB	31
++#define PROC_PIO_SM0_EXECCTRL_OUT_STICKY_BITS	0x00020000
++#define PROC_PIO_SM0_EXECCTRL_OUT_STICKY_LSB	17
++#define PROC_PIO_SM0_EXECCTRL_INLINE_OUT_EN_BITS	0x00040000
++#define PROC_PIO_SM0_EXECCTRL_INLINE_OUT_EN_LSB	18
++#define PROC_PIO_SM0_EXECCTRL_OUT_EN_SEL_BITS	0x00f80000
++#define PROC_PIO_SM0_EXECCTRL_OUT_EN_SEL_LSB	19
++#define PROC_PIO_SM0_EXECCTRL_STATUS_SEL_BITS	0x00000020
++#define PROC_PIO_SM0_EXECCTRL_STATUS_SEL_LSB	5
++#define PROC_PIO_SM0_EXECCTRL_STATUS_N_BITS	0x0000001f
++#define PROC_PIO_SM0_EXECCTRL_STATUS_N_LSB	0
++
++enum pio_fifo_join {
++	PIO_FIFO_JOIN_NONE = 0,
++	PIO_FIFO_JOIN_TX = 1,
++	PIO_FIFO_JOIN_RX = 2,
++};
++
++enum pio_mov_status_type {
++	STATUS_TX_LESSTHAN = 0,
++	STATUS_RX_LESSTHAN = 1
++};
++
++enum pio_xfer_dir {
++	PIO_DIR_TO_SM,
++	PIO_DIR_FROM_SM,
++	PIO_DIR_COUNT
++};
++
++enum clock_index {
++	clk_sys = 5
++};
++
++typedef struct pio_program {
++	const uint16_t *instructions;
++	uint8_t length;
++	int8_t origin; // required instruction memory origin or -1
++} pio_program_t;
++
++enum gpio_function {
++	GPIO_FUNC_FSEL0 = 0,
++	GPIO_FUNC_FSEL1 = 1,
++	GPIO_FUNC_FSEL2 = 2,
++	GPIO_FUNC_FSEL3 = 3,
++	GPIO_FUNC_FSEL4 = 4,
++	GPIO_FUNC_FSEL5 = 5,
++	GPIO_FUNC_FSEL6 = 6,
++	GPIO_FUNC_FSEL7 = 7,
++	GPIO_FUNC_FSEL8 = 8,
++	GPIO_FUNC_NULL = 0x1f,
++
++	// Name a few
++	GPIO_FUNC_SYS_RIO = 5,
++	GPIO_FUNC_PROC_RIO = 6,
++	GPIO_FUNC_PIO = 7,
++};
++
++enum gpio_irq_level {
++	GPIO_IRQ_LEVEL_LOW = 0x1u,
++	GPIO_IRQ_LEVEL_HIGH = 0x2u,
++	GPIO_IRQ_EDGE_FALL = 0x4u,
++	GPIO_IRQ_EDGE_RISE = 0x8u,
++};
++
++enum gpio_override {
++	GPIO_OVERRIDE_NORMAL = 0,
++	GPIO_OVERRIDE_INVERT = 1,
++	GPIO_OVERRIDE_LOW = 2,
++	GPIO_OVERRIDE_HIGH = 3,
++};
++enum gpio_slew_rate {
++	GPIO_SLEW_RATE_SLOW = 0,
++	GPIO_SLEW_RATE_FAST = 1
++};
++
++enum gpio_drive_strength {
++	GPIO_DRIVE_STRENGTH_2MA = 0,
++	GPIO_DRIVE_STRENGTH_4MA = 1,
++	GPIO_DRIVE_STRENGTH_8MA = 2,
++	GPIO_DRIVE_STRENGTH_12MA = 3
++};
++
++typedef rp1_pio_sm_config pio_sm_config;
++
++typedef struct rp1_pio_client *PIO;
++
++void pio_set_error(struct rp1_pio_client *client, int err);
++int pio_get_error(const struct rp1_pio_client *client);
++void pio_clear_error(struct rp1_pio_client *client);
++
++int rp1_pio_can_add_program(struct rp1_pio_client *client, void *param);
++int rp1_pio_add_program(struct rp1_pio_client *client, void *param);
++int rp1_pio_remove_program(struct rp1_pio_client *client, void *param);
++int rp1_pio_clear_instr_mem(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_claim(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_unclaim(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_is_claimed(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_init(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_set_config(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_exec(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_clear_fifos(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_set_clkdiv(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_set_pins(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_set_pindirs(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_set_enabled(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_restart(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_clkdiv_restart(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_enable_sync(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_put(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_get(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_set_dmactrl(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_fifo_state(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_drain_tx(struct rp1_pio_client *client, void *param);
++int rp1_pio_gpio_init(struct rp1_pio_client *client, void *param);
++int rp1_pio_gpio_set_function(struct rp1_pio_client *client, void *param);
++int rp1_pio_gpio_set_pulls(struct rp1_pio_client *client, void *param);
++int rp1_pio_gpio_set_outover(struct rp1_pio_client *client, void *param);
++int rp1_pio_gpio_set_inover(struct rp1_pio_client *client, void *param);
++int rp1_pio_gpio_set_oeover(struct rp1_pio_client *client, void *param);
++int rp1_pio_gpio_set_input_enabled(struct rp1_pio_client *client, void *param);
++int rp1_pio_gpio_set_drive_strength(struct rp1_pio_client *client, void *param);
++
++int pio_init(void);
++PIO pio_open(void);
++void pio_close(PIO pio);
++
++int pio_sm_config_xfer(PIO pio, uint sm, uint dir, uint buf_size, uint buf_count);
++int pio_sm_xfer_data(PIO pio, uint sm, uint dir, uint data_bytes, void *data);
++
++static inline bool pio_can_add_program(struct rp1_pio_client *client,
++				       const pio_program_t *program)
++{
++	struct rp1_pio_add_program_args args;
++
++	if (bad_params_if(client, program->length > PIO_INSTRUCTION_COUNT))
++		return false;
++	args.origin = (program->origin == -1) ? PIO_ORIGIN_ANY : program->origin;
++	args.num_instrs = program->length;
++
++	memcpy(args.instrs, program->instructions, args.num_instrs * sizeof(args.instrs[0]));
++	return rp1_pio_can_add_program(client, &args);
++}
++
++static inline bool pio_can_add_program_at_offset(struct rp1_pio_client *client,
++						 const pio_program_t *program, uint offset)
++{
++	struct rp1_pio_add_program_args args;
++
++	if (bad_params_if(client, program->length > PIO_INSTRUCTION_COUNT ||
++			  offset >= PIO_INSTRUCTION_COUNT))
++		return false;
++	args.origin = offset;
++	args.num_instrs = program->length;
++
++	memcpy(args.instrs, program->instructions, args.num_instrs * sizeof(args.instrs[0]));
++	return !rp1_pio_can_add_program(client, &args);
++}
++
++static inline uint pio_add_program(struct rp1_pio_client *client, const pio_program_t *program)
++{
++	struct rp1_pio_add_program_args args;
++	int offset;
++
++	if (bad_params_if(client, program->length > PIO_INSTRUCTION_COUNT))
++		return PIO_ORIGIN_ANY;
++	args.origin = (program->origin == -1) ? PIO_ORIGIN_ANY : program->origin;
++	args.num_instrs = program->length;
++
++	memcpy(args.instrs, program->instructions, args.num_instrs * sizeof(args.instrs[0]));
++	offset = rp1_pio_add_program(client, &args);
++	return (offset >= 0) ? offset : PIO_ORIGIN_ANY;
++}
++
++static inline int pio_add_program_at_offset(struct rp1_pio_client *client,
++					    const pio_program_t *program, uint offset)
++{
++	struct rp1_pio_add_program_args args;
++
++	if (bad_params_if(client, program->length > PIO_INSTRUCTION_COUNT ||
++				  offset >= PIO_INSTRUCTION_COUNT))
++		return -EINVAL;
++	args.origin = offset;
++	args.num_instrs = program->length;
++
++	memcpy(args.instrs, program->instructions, args.num_instrs * sizeof(args.instrs[0]));
++	return rp1_pio_add_program(client, &args);
++}
++
++static inline int pio_remove_program(struct rp1_pio_client *client, const pio_program_t *program,
++				     uint loaded_offset)
++{
++	struct rp1_pio_remove_program_args args;
++
++	args.origin = loaded_offset;
++	args.num_instrs = program->length;
++
++	return rp1_pio_remove_program(client, &args);
++}
++
++static inline int pio_clear_instruction_memory(struct rp1_pio_client *client)
++{
++	return rp1_pio_clear_instr_mem(client, NULL);
++}
++
++static inline int pio_sm_claim(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_claim_args args = { .mask = 1 << sm };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++
++	return rp1_pio_sm_claim(client, &args);
++}
++
++static inline int pio_claim_sm_mask(struct rp1_pio_client *client, uint mask)
++{
++	struct rp1_pio_sm_claim_args args = { .mask = mask };
++
++	if (bad_params_if(client, mask >= (1 << NUM_PIO_STATE_MACHINES)))
++		return -EINVAL;
++
++	return rp1_pio_sm_claim(client, &args);
++}
++
++static inline int pio_sm_unclaim(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_claim_args args = { .mask = 1 << sm };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++
++	return rp1_pio_sm_claim(client, &args);
++}
++
++static inline int pio_claim_unused_sm(struct rp1_pio_client *client, bool required)
++{
++	struct rp1_pio_sm_claim_args args = { .mask = 0 };
++	int sm;
++
++	sm = rp1_pio_sm_claim(client, &args);
++	if (sm < 0 && required)
++		WARN_ON("No PIO state machines are available");
++	return sm;
++}
++
++static inline bool pio_sm_is_claimed(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_claim_args args = { .mask = (1 << sm) };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return true;
++	return rp1_pio_sm_is_claimed(client, &args);
++}
++
++static inline int pio_sm_init(struct rp1_pio_client *client, uint sm, uint initial_pc,
++			      const pio_sm_config *config)
++{
++	struct rp1_pio_sm_init_args args = { .sm = sm, .initial_pc = initial_pc,
++					     .config = *config };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES ||
++				  initial_pc >= PIO_INSTRUCTION_COUNT))
++		return -EINVAL;
++
++	return rp1_pio_sm_init(client, &args);
++}
++
++static inline int pio_sm_set_config(struct rp1_pio_client *client, uint sm,
++				    const pio_sm_config *config)
++{
++	struct rp1_pio_sm_init_args args = { .sm = sm, .config = *config };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++
++	return rp1_pio_sm_set_config(client, &args);
++}
++
++static inline int pio_sm_exec(struct rp1_pio_client *client, uint sm, uint instr)
++{
++	struct rp1_pio_sm_exec_args args = { .sm = sm, .instr = instr, .blocking = false };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES || instr > (uint16_t)~0))
++		return -EINVAL;
++
++	return rp1_pio_sm_exec(client, &args);
++}
++
++static inline int pio_sm_exec_wait_blocking(struct rp1_pio_client *client, uint sm, uint instr)
++{
++	struct rp1_pio_sm_exec_args args = { .sm = sm, .instr = instr, .blocking = true };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES || instr > (uint16_t)~0))
++		return -EINVAL;
++
++	return rp1_pio_sm_exec(client, &args);
++}
++
++static inline int pio_sm_clear_fifos(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_clear_fifos_args args = { .sm = sm };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	return rp1_pio_sm_clear_fifos(client, &args);
++}
++
++static inline bool pio_calculate_clkdiv_from_float(float div, uint16_t *div_int,
++						   uint8_t *div_frac)
++{
++	if (bad_params_if(NULL, div < 1 || div > 65536))
++		return false;
++	*div_int = (uint16_t)div;
++	if (*div_int == 0)
++		*div_frac = 0;
++	else
++		*div_frac = (uint8_t)((div - (float)*div_int) * (1u << 8u));
++	return true;
++}
++
++static inline int pio_sm_set_clkdiv_int_frac(struct rp1_pio_client *client, uint sm,
++					     uint16_t div_int, uint8_t div_frac)
++{
++	struct rp1_pio_sm_set_clkdiv_args args = { .sm = sm, .div_int = div_int,
++						   .div_frac = div_frac };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES ||
++			  (div_int == 0 && div_frac != 0)))
++		return -EINVAL;
++	return rp1_pio_sm_set_clkdiv(client, &args);
++}
++
++static inline int pio_sm_set_clkdiv(struct rp1_pio_client *client, uint sm, float div)
++{
++	struct rp1_pio_sm_set_clkdiv_args args = { .sm = sm };
++
++	if (!pio_calculate_clkdiv_from_float(div, &args.div_int, &args.div_frac))
++		return -EINVAL;
++	return rp1_pio_sm_set_clkdiv(client, &args);
++}
++
++static inline int pio_sm_set_pins(struct rp1_pio_client *client, uint sm, uint32_t pin_values)
++{
++	struct rp1_pio_sm_set_pins_args args = { .sm = sm, .values = pin_values,
++						 .mask = GPIOS_MASK };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	return rp1_pio_sm_set_pins(client, &args);
++}
++
++static inline int pio_sm_set_pins_with_mask(struct rp1_pio_client *client, uint sm,
++					    uint32_t pin_values, uint32_t pin_mask)
++{
++	struct rp1_pio_sm_set_pins_args args = { .sm = sm, .values = pin_values,
++						 .mask = pin_mask };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	return rp1_pio_sm_set_pins(client, &args);
++}
++
++static inline int pio_sm_set_pindirs_with_mask(struct rp1_pio_client *client, uint sm,
++					       uint32_t pin_dirs, uint32_t pin_mask)
++{
++	struct rp1_pio_sm_set_pindirs_args args = { .sm = sm, .dirs = pin_dirs,
++						    .mask = pin_mask };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES ||
++			      (pin_dirs & GPIOS_MASK) != pin_dirs ||
++			      (pin_mask & pin_mask) != pin_mask))
++		return -EINVAL;
++	return rp1_pio_sm_set_pindirs(client, &args);
++}
++
++static inline int pio_sm_set_consecutive_pindirs(struct rp1_pio_client *client, uint sm,
++						 uint pin_base, uint pin_count, bool is_out)
++{
++	uint32_t mask = ((1 << pin_count) - 1) << pin_base;
++	struct rp1_pio_sm_set_pindirs_args args = { .sm = sm, .dirs = is_out ? mask : 0,
++						    .mask = mask };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES ||
++			      pin_base >= RP1_PIO_GPIO_COUNT ||
++			      pin_count > RP1_PIO_GPIO_COUNT ||
++			      (pin_base + pin_count) > RP1_PIO_GPIO_COUNT))
++		return -EINVAL;
++	return rp1_pio_sm_set_pindirs(client, &args);
++}
++
++static inline int pio_sm_set_enabled(struct rp1_pio_client *client, uint sm, bool enabled)
++{
++	struct rp1_pio_sm_set_enabled_args args = { .mask = (1 << sm), .enable = enabled };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	return rp1_pio_sm_set_enabled(client, &args);
++}
++
++static inline int pio_set_sm_mask_enabled(struct rp1_pio_client *client, uint32_t mask,
++					  bool enabled)
++{
++	struct rp1_pio_sm_set_enabled_args args = { .mask = mask, .enable = enabled };
++
++	if (bad_params_if(client, mask >= (1 << NUM_PIO_STATE_MACHINES)))
++		return -EINVAL;
++	return rp1_pio_sm_set_enabled(client, &args);
++}
++
++static inline int pio_sm_restart(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_restart_args args = { .mask = (1 << sm) };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	return rp1_pio_sm_restart(client, &args);
++}
++
++static inline int pio_restart_sm_mask(struct rp1_pio_client *client, uint32_t mask)
++{
++	struct rp1_pio_sm_restart_args args = { .mask = (uint16_t)mask };
++
++	if (bad_params_if(client, mask >= (1 << NUM_PIO_STATE_MACHINES)))
++		return -EINVAL;
++	return rp1_pio_sm_restart(client, &args);
++}
++
++static inline int pio_sm_clkdiv_restart(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_restart_args args = { .mask = (1 << sm) };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	return rp1_pio_sm_clkdiv_restart(client, &args);
++}
++
++static inline int pio_clkdiv_restart_sm_mask(struct rp1_pio_client *client, uint32_t mask)
++{
++	struct rp1_pio_sm_restart_args args = { .mask = (uint16_t)mask };
++
++	if (bad_params_if(client, mask >= (1 << NUM_PIO_STATE_MACHINES)))
++		return -EINVAL;
++	return rp1_pio_sm_clkdiv_restart(client, &args);
++}
++
++static inline int pio_enable_sm_in_sync_mask(struct rp1_pio_client *client, uint32_t mask)
++{
++	struct rp1_pio_sm_enable_sync_args args = { .mask = (uint16_t)mask };
++
++	if (bad_params_if(client, mask >= (1 << NUM_PIO_STATE_MACHINES)))
++		return -EINVAL;
++	return rp1_pio_sm_enable_sync(client, &args);
++}
++
++static inline int pio_sm_set_dmactrl(struct rp1_pio_client *client, uint sm, bool is_tx,
++				     uint32_t ctrl)
++{
++	struct rp1_pio_sm_set_dmactrl_args args = { .sm = sm, .is_tx = is_tx, .ctrl = ctrl };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	return rp1_pio_sm_set_dmactrl(client, &args);
++};
++
++static inline int pio_sm_drain_tx_fifo(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_clear_fifos_args args = { .sm = sm };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	return rp1_pio_sm_drain_tx(client, &args);
++};
++
++static inline int pio_sm_put(struct rp1_pio_client *client, uint sm, uint32_t data)
++{
++	struct rp1_pio_sm_put_args args = { .sm = (uint16_t)sm, .blocking = false, .data = data };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	return rp1_pio_sm_put(client, &args);
++}
++
++static inline int pio_sm_put_blocking(struct rp1_pio_client *client, uint sm, uint32_t data)
++{
++	struct rp1_pio_sm_put_args args = { .sm = (uint16_t)sm, .blocking = true, .data = data };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	return rp1_pio_sm_put(client, &args);
++}
++
++static inline uint32_t pio_sm_get(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_get_args args = { .sm = (uint16_t)sm, .blocking = false };
++
++	if (!bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		rp1_pio_sm_get(client, &args);
++	return args.data;
++}
++
++static inline uint32_t pio_sm_get_blocking(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_get_args args = { .sm = (uint16_t)sm, .blocking = true };
++
++	if (!bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		rp1_pio_sm_get(client, &args);
++	return args.data;
++}
++
++static inline int pio_sm_is_rx_fifo_empty(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_fifo_state_args args = { .sm = sm, .tx = false };
++	int ret;
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	ret = rp1_pio_sm_fifo_state(client, &args);
++	if (ret == sizeof(args))
++		ret = args.empty;
++	return ret;
++};
++
++static inline int pio_sm_is_rx_fifo_full(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_fifo_state_args args = { .sm = sm, .tx = false };
++	int ret;
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	ret = rp1_pio_sm_fifo_state(client, &args);
++	if (ret == sizeof(args))
++		ret = args.full;
++	return ret;
++};
++
++static inline int pio_sm_rx_fifo_level(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_fifo_state_args args = { .sm = sm, .tx = false };
++	int ret;
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	ret = rp1_pio_sm_fifo_state(client, &args);
++	if (ret == sizeof(args))
++		ret = args.level;
++	return ret;
++};
++
++static inline int pio_sm_is_tx_fifo_empty(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_fifo_state_args args = { .sm = sm, .tx = true };
++	int ret;
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	ret = rp1_pio_sm_fifo_state(client, &args);
++	if (ret == sizeof(args))
++		ret = args.empty;
++	return ret;
++};
++
++static inline int pio_sm_is_tx_fifo_full(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_fifo_state_args args = { .sm = sm, .tx = true };
++	int ret;
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	ret = rp1_pio_sm_fifo_state(client, &args);
++	if (ret == sizeof(args))
++		ret = args.full;
++	return ret;
++};
++
++static inline int pio_sm_tx_fifo_level(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_fifo_state_args args = { .sm = sm, .tx = true };
++	int ret;
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	ret = rp1_pio_sm_fifo_state(client, &args);
++	if (ret == sizeof(args))
++		ret = args.level;
++	return ret;
++};
++
++static inline void sm_config_set_out_pins(pio_sm_config *c, uint out_base, uint out_count)
++{
++	if (bad_params_if(NULL, out_base >= RP1_PIO_GPIO_COUNT ||
++				    out_count > RP1_PIO_GPIO_COUNT))
++		return;
++
++	c->pinctrl = (c->pinctrl & ~(PROC_PIO_SM0_PINCTRL_OUT_BASE_BITS |
++				     PROC_PIO_SM0_PINCTRL_OUT_COUNT_BITS)) |
++			(out_base << PROC_PIO_SM0_PINCTRL_OUT_BASE_LSB) |
++			(out_count << PROC_PIO_SM0_PINCTRL_OUT_COUNT_LSB);
++}
++
++static inline void sm_config_set_set_pins(pio_sm_config *c, uint set_base, uint set_count)
++{
++	if (bad_params_if(NULL, set_base >= RP1_PIO_GPIO_COUNT ||
++				    set_count > 5))
++		return;
++
++	c->pinctrl = (c->pinctrl & ~(PROC_PIO_SM0_PINCTRL_SET_BASE_BITS |
++				     PROC_PIO_SM0_PINCTRL_SET_COUNT_BITS)) |
++			(set_base << PROC_PIO_SM0_PINCTRL_SET_BASE_LSB) |
++			(set_count << PROC_PIO_SM0_PINCTRL_SET_COUNT_LSB);
++}
++
++
++static inline void sm_config_set_in_pins(pio_sm_config *c, uint in_base)
++{
++	if (bad_params_if(NULL, in_base >= RP1_PIO_GPIO_COUNT))
++		return;
++
++	c->pinctrl = (c->pinctrl & ~PROC_PIO_SM0_PINCTRL_IN_BASE_BITS) |
++			(in_base << PROC_PIO_SM0_PINCTRL_IN_BASE_LSB);
++}
++
++static inline void sm_config_set_sideset_pins(pio_sm_config *c, uint sideset_base)
++{
++	if (bad_params_if(NULL, sideset_base >= RP1_PIO_GPIO_COUNT))
++		return;
++
++	c->pinctrl = (c->pinctrl & ~PROC_PIO_SM0_PINCTRL_SIDESET_BASE_BITS) |
++			(sideset_base << PROC_PIO_SM0_PINCTRL_SIDESET_BASE_LSB);
++}
++
++static inline void sm_config_set_sideset(pio_sm_config *c, uint bit_count, bool optional,
++					 bool pindirs)
++{
++	if (bad_params_if(NULL, bit_count > 5 ||
++				    (optional && (bit_count == 0))))
++		return;
++	c->pinctrl = (c->pinctrl & ~PROC_PIO_SM0_PINCTRL_SIDESET_COUNT_BITS) |
++			(bit_count << PROC_PIO_SM0_PINCTRL_SIDESET_COUNT_LSB);
++
++	c->execctrl = (c->execctrl & ~(PROC_PIO_SM0_EXECCTRL_SIDE_EN_BITS |
++				       PROC_PIO_SM0_EXECCTRL_SIDE_PINDIR_BITS)) |
++			(optional << PROC_PIO_SM0_EXECCTRL_SIDE_EN_LSB) |
++			(pindirs << PROC_PIO_SM0_EXECCTRL_SIDE_PINDIR_LSB);
++}
++
++static inline void sm_config_set_clkdiv_int_frac(pio_sm_config *c, uint16_t div_int,
++						 uint8_t div_frac)
++{
++	if (bad_params_if(NULL, div_int == 0 && div_frac != 0))
++		return;
++
++	c->clkdiv =
++		(((uint)div_frac) << PROC_PIO_SM0_CLKDIV_FRAC_LSB) |
++		(((uint)div_int) << PROC_PIO_SM0_CLKDIV_INT_LSB);
++}
++
++static inline void sm_config_set_clkdiv(pio_sm_config *c, float div)
++{
++	uint16_t div_int;
++	uint8_t div_frac;
++
++	pio_calculate_clkdiv_from_float(div, &div_int, &div_frac);
++	sm_config_set_clkdiv_int_frac(c, div_int, div_frac);
++}
++
++static inline void sm_config_set_wrap(pio_sm_config *c, uint wrap_target, uint wrap)
++{
++	if (bad_params_if(NULL, wrap >= PIO_INSTRUCTION_COUNT ||
++				    wrap_target >= PIO_INSTRUCTION_COUNT))
++		return;
++
++	c->execctrl = (c->execctrl & ~(PROC_PIO_SM0_EXECCTRL_WRAP_TOP_BITS |
++				       PROC_PIO_SM0_EXECCTRL_WRAP_BOTTOM_BITS)) |
++			(wrap_target << PROC_PIO_SM0_EXECCTRL_WRAP_BOTTOM_LSB) |
++			(wrap << PROC_PIO_SM0_EXECCTRL_WRAP_TOP_LSB);
++}
++
++static inline void sm_config_set_jmp_pin(pio_sm_config *c, uint pin)
++{
++	if (bad_params_if(NULL, pin >= RP1_PIO_GPIO_COUNT))
++		return;
++
++	c->execctrl = (c->execctrl & ~PROC_PIO_SM0_EXECCTRL_JMP_PIN_BITS) |
++		(pin << PROC_PIO_SM0_EXECCTRL_JMP_PIN_LSB);
++}
++
++static inline void sm_config_set_in_shift(pio_sm_config *c, bool shift_right, bool autopush,
++					  uint push_threshold)
++{
++	if (bad_params_if(NULL, push_threshold > 32))
++		return;
++
++	c->shiftctrl = (c->shiftctrl &
++		~(PROC_PIO_SM0_SHIFTCTRL_IN_SHIFTDIR_BITS |
++		PROC_PIO_SM0_SHIFTCTRL_AUTOPUSH_BITS |
++		PROC_PIO_SM0_SHIFTCTRL_PUSH_THRESH_BITS)) |
++		(shift_right << PROC_PIO_SM0_SHIFTCTRL_IN_SHIFTDIR_LSB) |
++		(autopush << PROC_PIO_SM0_SHIFTCTRL_AUTOPUSH_LSB) |
++		((push_threshold & 0x1fu) << PROC_PIO_SM0_SHIFTCTRL_PUSH_THRESH_LSB);
++}
++
++static inline void sm_config_set_out_shift(pio_sm_config *c, bool shift_right, bool autopull,
++					   uint pull_threshold)
++{
++	if (bad_params_if(NULL, pull_threshold > 32))
++		return;
++
++	c->shiftctrl = (c->shiftctrl &
++		~(PROC_PIO_SM0_SHIFTCTRL_OUT_SHIFTDIR_BITS |
++		PROC_PIO_SM0_SHIFTCTRL_AUTOPULL_BITS |
++		PROC_PIO_SM0_SHIFTCTRL_PULL_THRESH_BITS)) |
++		(shift_right << PROC_PIO_SM0_SHIFTCTRL_OUT_SHIFTDIR_LSB) |
++		(autopull << PROC_PIO_SM0_SHIFTCTRL_AUTOPULL_LSB) |
++		((pull_threshold & 0x1fu) << PROC_PIO_SM0_SHIFTCTRL_PULL_THRESH_LSB);
++}
++
++static inline void sm_config_set_fifo_join(pio_sm_config *c, enum pio_fifo_join join)
++{
++	if (bad_params_if(NULL, join != PIO_FIFO_JOIN_NONE &&
++				    join != PIO_FIFO_JOIN_TX &&
++				    join != PIO_FIFO_JOIN_RX))
++		return;
++
++	c->shiftctrl = (c->shiftctrl & (uint)~(PROC_PIO_SM0_SHIFTCTRL_FJOIN_TX_BITS |
++					       PROC_PIO_SM0_SHIFTCTRL_FJOIN_RX_BITS)) |
++		(((uint)join) << PROC_PIO_SM0_SHIFTCTRL_FJOIN_TX_LSB);
++}
++
++static inline void sm_config_set_out_special(pio_sm_config *c, bool sticky, bool has_enable_pin,
++					     uint enable_pin_index)
++{
++	c->execctrl = (c->execctrl &
++		(uint)~(PROC_PIO_SM0_EXECCTRL_OUT_STICKY_BITS |
++			PROC_PIO_SM0_EXECCTRL_INLINE_OUT_EN_BITS |
++		PROC_PIO_SM0_EXECCTRL_OUT_EN_SEL_BITS)) |
++		(sticky << PROC_PIO_SM0_EXECCTRL_OUT_STICKY_LSB) |
++		(has_enable_pin << PROC_PIO_SM0_EXECCTRL_INLINE_OUT_EN_LSB) |
++		((enable_pin_index << PROC_PIO_SM0_EXECCTRL_OUT_EN_SEL_LSB) &
++		 PROC_PIO_SM0_EXECCTRL_OUT_EN_SEL_BITS);
++}
++
++static inline void sm_config_set_mov_status(pio_sm_config *c, enum pio_mov_status_type status_sel,
++					    uint status_n)
++{
++	if (bad_params_if(NULL, status_sel != STATUS_TX_LESSTHAN &&
++				status_sel != STATUS_RX_LESSTHAN))
++		return;
++
++	c->execctrl = (c->execctrl
++		& ~(PROC_PIO_SM0_EXECCTRL_STATUS_SEL_BITS | PROC_PIO_SM0_EXECCTRL_STATUS_N_BITS))
++		| ((((uint)status_sel) << PROC_PIO_SM0_EXECCTRL_STATUS_SEL_LSB) &
++		   PROC_PIO_SM0_EXECCTRL_STATUS_SEL_BITS)
++		| ((status_n << PROC_PIO_SM0_EXECCTRL_STATUS_N_LSB) &
++		   PROC_PIO_SM0_EXECCTRL_STATUS_N_BITS);
++}
++
++static inline pio_sm_config pio_get_default_sm_config(void)
++{
++	pio_sm_config c = { 0 };
++
++	sm_config_set_clkdiv_int_frac(&c, 1, 0);
++	sm_config_set_wrap(&c, 0, 31);
++	sm_config_set_in_shift(&c, true, false, 32);
++	sm_config_set_out_shift(&c, true, false, 32);
++	return c;
++}
++
++static inline uint32_t clock_get_hz(enum clock_index clk_index)
++{
++	const uint32_t MHZ = 1000000;
++
++	if (bad_params_if(NULL, clk_index != clk_sys))
++		return 0;
++	return 200 * MHZ;
++}
++
++static inline int pio_gpio_set_function(struct rp1_pio_client *client, uint gpio,
++					enum gpio_function fn)
++{
++	struct rp1_gpio_set_function_args args = { .gpio = gpio, .fn = fn };
++
++	if (bad_params_if(client, gpio >= RP1_PIO_GPIO_COUNT))
++		return -EINVAL;
++	return rp1_pio_gpio_set_function(client, &args);
++}
++
++static inline int pio_gpio_init(struct rp1_pio_client *client, uint gpio)
++{
++	struct rp1_gpio_init_args args = { .gpio = gpio };
++	int ret;
++
++	if (bad_params_if(client, gpio >= RP1_PIO_GPIO_COUNT))
++		return -EINVAL;
++	ret = rp1_pio_gpio_init(client, &args);
++	if (ret)
++		return ret;
++	return pio_gpio_set_function(client, gpio, RP1_GPIO_FUNC_PIO);
++}
++
++static inline int pio_gpio_set_pulls(struct rp1_pio_client *client, uint gpio, bool up, bool down)
++{
++	struct rp1_gpio_set_pulls_args args = { .gpio = gpio, .up = up, .down = down };
++
++	if (bad_params_if(client, gpio >= RP1_PIO_GPIO_COUNT))
++		return -EINVAL;
++	return rp1_pio_gpio_set_pulls(client, &args);
++}
++
++static inline int pio_gpio_set_outover(struct rp1_pio_client *client, uint gpio, uint value)
++{
++	struct rp1_gpio_set_args args = { .gpio = gpio, .value = value };
++
++	if (bad_params_if(client, gpio >= RP1_PIO_GPIO_COUNT))
++		return -EINVAL;
++	return rp1_pio_gpio_set_outover(client, &args);
++}
++
++static inline int pio_gpio_set_inover(struct rp1_pio_client *client, uint gpio, uint value)
++{
++	struct rp1_gpio_set_args args = { .gpio = gpio, .value = value };
++
++	if (bad_params_if(client, gpio >= RP1_PIO_GPIO_COUNT))
++		return -EINVAL;
++	return rp1_pio_gpio_set_inover(client, &args);
++}
++
++static inline int pio_gpio_set_oeover(struct rp1_pio_client *client, uint gpio, uint value)
++{
++	struct rp1_gpio_set_args args = { .gpio = gpio, .value = value };
++
++	if (bad_params_if(client, gpio >= RP1_PIO_GPIO_COUNT))
++		return -EINVAL;
++	return rp1_pio_gpio_set_oeover(client, &args);
++}
++
++static inline int pio_gpio_set_input_enabled(struct rp1_pio_client *client, uint gpio,
++					     bool enabled)
++{
++	struct rp1_gpio_set_args args = { .gpio = gpio, .value = enabled };
++
++	if (bad_params_if(client, gpio >= RP1_PIO_GPIO_COUNT))
++		return -EINVAL;
++	return rp1_pio_gpio_set_input_enabled(client, &args);
++}
++
++static inline int pio_gpio_set_drive_strength(struct rp1_pio_client *client, uint gpio,
++					      enum gpio_drive_strength drive)
++{
++	struct rp1_gpio_set_args args = { .gpio = gpio, .value = drive };
++
++	if (bad_params_if(client, gpio >= RP1_PIO_GPIO_COUNT))
++		return -EINVAL;
++	return rp1_pio_gpio_set_drive_strength(client, &args);
++}
++
++static inline int pio_gpio_pull_up(struct rp1_pio_client *client, uint gpio)
++{
++	return pio_gpio_set_pulls(client, gpio, true, false);
++}
++
++static inline int pio_gpio_pull_down(struct rp1_pio_client *client, uint gpio)
++{
++	return pio_gpio_set_pulls(client, gpio, false, true);
++}
++
++static inline int pio_gpio_disable_pulls(struct rp1_pio_client *client, uint gpio)
++{
++	return pio_gpio_set_pulls(client, gpio, false, false);
++}
++
++#endif
+--- /dev/null
++++ b/include/uapi/misc/rp1_pio_if.h
+@@ -0,0 +1,219 @@
++/* SPDX-License-Identifier: GPL-2.0 + WITH Linux-syscall-note */
++/*
++ * Copyright (c) 2023-24 Raspberry Pi Ltd.
++ * All rights reserved.
++ */
++#ifndef _PIO_RP1_IF_H
++#define _PIO_RP1_IF_H
++
++#include <linux/ioctl.h>
++
++#define RP1_PIO_INSTRUCTION_COUNT   32
++#define RP1_PIO_SM_COUNT            4
++#define RP1_PIO_GPIO_COUNT          28
++#define RP1_GPIO_FUNC_PIO           7
++
++#define RP1_PIO_ORIGIN_ANY          ((uint16_t)(~0))
++
++#define RP1_PIO_DIR_TO_SM           0
++#define RP1_PIO_DIR_FROM_SM         1
++#define RP1_PIO_DIR_COUNT           2
++
++typedef struct {
++	uint32_t clkdiv;
++	uint32_t execctrl;
++	uint32_t shiftctrl;
++	uint32_t pinctrl;
++} rp1_pio_sm_config;
++
++struct rp1_pio_add_program_args {
++	uint16_t num_instrs;
++	uint16_t origin;
++	uint16_t instrs[RP1_PIO_INSTRUCTION_COUNT];
++};
++
++struct rp1_pio_remove_program_args {
++	uint16_t num_instrs;
++	uint16_t origin;
++};
++
++struct rp1_pio_sm_claim_args {
++	uint16_t mask;
++};
++
++struct rp1_pio_sm_init_args {
++	uint16_t sm;
++	uint16_t initial_pc;
++	rp1_pio_sm_config config;
++};
++
++struct rp1_pio_sm_set_config_args {
++	uint16_t sm;
++	uint16_t rsvd;
++	rp1_pio_sm_config config;
++};
++
++struct rp1_pio_sm_exec_args {
++	uint16_t sm;
++	uint16_t instr;
++	uint8_t blocking;
++	uint8_t rsvd;
++};
++
++struct rp1_pio_sm_clear_fifos_args {
++	uint16_t sm;
++};
++
++struct rp1_pio_sm_set_clkdiv_args {
++	uint16_t sm;
++	uint16_t div_int;
++	uint8_t div_frac;
++	uint8_t rsvd;
++};
++
++struct rp1_pio_sm_set_pins_args {
++	uint16_t sm;
++	uint16_t rsvd;
++	uint32_t values;
++	uint32_t mask;
++};
++
++struct rp1_pio_sm_set_pindirs_args {
++	uint16_t sm;
++	uint16_t rsvd;
++	uint32_t dirs;
++	uint32_t mask;
++};
++
++struct rp1_pio_sm_set_enabled_args {
++	uint16_t mask;
++	uint8_t enable;
++	uint8_t rsvd;
++};
++
++struct rp1_pio_sm_restart_args {
++	uint16_t mask;
++};
++
++struct rp1_pio_sm_clkdiv_restart_args {
++	uint16_t mask;
++};
++
++struct rp1_pio_sm_enable_sync_args {
++	uint16_t mask;
++};
++
++struct rp1_pio_sm_put_args {
++	uint16_t sm;
++	uint8_t blocking;
++	uint8_t rsvd;
++	uint32_t data;
++};
++
++struct rp1_pio_sm_get_args {
++	uint16_t sm;
++	uint8_t blocking;
++	uint8_t rsvd;
++	uint32_t data; /* OUT */
++};
++
++struct rp1_pio_sm_set_dmactrl_args {
++	uint16_t sm;
++	uint8_t is_tx;
++	uint8_t rsvd;
++	uint32_t ctrl;
++};
++
++struct rp1_pio_sm_fifo_state_args {
++	uint16_t sm;
++	uint8_t tx;
++	uint8_t rsvd;
++	uint16_t level; /* OUT */
++	uint8_t empty; /* OUT */
++	uint8_t full; /* OUT */
++};
++
++struct rp1_gpio_init_args {
++	uint16_t gpio;
++};
++
++struct rp1_gpio_set_function_args {
++	uint16_t gpio;
++	uint16_t fn;
++};
++
++struct rp1_gpio_set_pulls_args {
++	uint16_t gpio;
++	uint8_t up;
++	uint8_t down;
++};
++
++struct rp1_gpio_set_args {
++	uint16_t gpio;
++	uint16_t value;
++};
++
++struct rp1_pio_sm_config_xfer_args {
++	uint16_t sm;
++	uint16_t dir;
++	uint16_t buf_size;
++	uint16_t buf_count;
++};
++
++struct rp1_pio_sm_xfer_data_args {
++	uint16_t sm;
++	uint16_t dir;
++	uint16_t data_bytes;
++	void *data;
++};
++
++struct rp1_access_hw_args {
++	uint32_t addr;
++	uint32_t len;
++	void *data;
++};
++
++#define PIO_IOC_MAGIC 102
++
++#define PIO_IOC_SM_CONFIG_XFER _IOW(PIO_IOC_MAGIC, 0, struct rp1_pio_sm_config_xfer_args)
++#define PIO_IOC_SM_XFER_DATA _IOW(PIO_IOC_MAGIC, 1, struct rp1_pio_sm_xfer_data_args)
++
++#define PIO_IOC_READ_HW _IOW(PIO_IOC_MAGIC, 8, struct rp1_access_hw_args)
++#define PIO_IOC_WRITE_HW _IOW(PIO_IOC_MAGIC, 9, struct rp1_access_hw_args)
++
++#define PIO_IOC_CAN_ADD_PROGRAM _IOW(PIO_IOC_MAGIC, 10, struct rp1_pio_add_program_args)
++#define PIO_IOC_ADD_PROGRAM _IOW(PIO_IOC_MAGIC, 11, struct rp1_pio_add_program_args)
++#define PIO_IOC_REMOVE_PROGRAM _IOW(PIO_IOC_MAGIC, 12, struct rp1_pio_remove_program_args)
++#define PIO_IOC_CLEAR_INSTR_MEM _IO(PIO_IOC_MAGIC, 13)
++
++#define PIO_IOC_SM_CLAIM _IOW(PIO_IOC_MAGIC, 20, struct rp1_pio_sm_claim_args)
++#define PIO_IOC_SM_UNCLAIM _IOW(PIO_IOC_MAGIC, 21, struct rp1_pio_sm_claim_args)
++#define PIO_IOC_SM_IS_CLAIMED _IOW(PIO_IOC_MAGIC, 22, struct rp1_pio_sm_claim_args)
++
++#define PIO_IOC_SM_INIT _IOW(PIO_IOC_MAGIC, 30, struct rp1_pio_sm_init_args)
++#define PIO_IOC_SM_SET_CONFIG _IOW(PIO_IOC_MAGIC, 31, struct rp1_pio_sm_set_config_args)
++#define PIO_IOC_SM_EXEC _IOW(PIO_IOC_MAGIC, 32, struct rp1_pio_sm_exec_args)
++#define PIO_IOC_SM_CLEAR_FIFOS _IOW(PIO_IOC_MAGIC, 33, struct rp1_pio_sm_clear_fifos_args)
++#define PIO_IOC_SM_SET_CLKDIV _IOW(PIO_IOC_MAGIC, 34, struct rp1_pio_sm_set_clkdiv_args)
++#define PIO_IOC_SM_SET_PINS _IOW(PIO_IOC_MAGIC, 35, struct rp1_pio_sm_set_pins_args)
++#define PIO_IOC_SM_SET_PINDIRS _IOW(PIO_IOC_MAGIC, 36, struct rp1_pio_sm_set_pindirs_args)
++#define PIO_IOC_SM_SET_ENABLED _IOW(PIO_IOC_MAGIC, 37, struct rp1_pio_sm_set_enabled_args)
++#define PIO_IOC_SM_RESTART _IOW(PIO_IOC_MAGIC, 38, struct rp1_pio_sm_restart_args)
++#define PIO_IOC_SM_CLKDIV_RESTART _IOW(PIO_IOC_MAGIC, 39, struct rp1_pio_sm_restart_args)
++#define PIO_IOC_SM_ENABLE_SYNC _IOW(PIO_IOC_MAGIC, 40, struct rp1_pio_sm_enable_sync_args)
++#define PIO_IOC_SM_PUT _IOW(PIO_IOC_MAGIC, 41, struct rp1_pio_sm_put_args)
++#define PIO_IOC_SM_GET _IOWR(PIO_IOC_MAGIC, 42, struct rp1_pio_sm_get_args)
++#define PIO_IOC_SM_SET_DMACTRL _IOW(PIO_IOC_MAGIC, 43, struct rp1_pio_sm_set_dmactrl_args)
++#define PIO_IOC_SM_FIFO_STATE _IOW(PIO_IOC_MAGIC, 44, struct rp1_pio_sm_fifo_state_args)
++#define PIO_IOC_SM_DRAIN_TX _IOW(PIO_IOC_MAGIC, 45, struct rp1_pio_sm_clear_fifos_args)
++
++#define PIO_IOC_GPIO_INIT _IOW(PIO_IOC_MAGIC, 50, struct rp1_gpio_init_args)
++#define PIO_IOC_GPIO_SET_FUNCTION _IOW(PIO_IOC_MAGIC, 51, struct rp1_gpio_set_function_args)
++#define PIO_IOC_GPIO_SET_PULLS _IOW(PIO_IOC_MAGIC, 52, struct rp1_gpio_set_pulls_args)
++#define PIO_IOC_GPIO_SET_OUTOVER _IOW(PIO_IOC_MAGIC, 53, struct rp1_gpio_set_args)
++#define PIO_IOC_GPIO_SET_INOVER _IOW(PIO_IOC_MAGIC, 54, struct rp1_gpio_set_args)
++#define PIO_IOC_GPIO_SET_OEOVER _IOW(PIO_IOC_MAGIC, 55, struct rp1_gpio_set_args)
++#define PIO_IOC_GPIO_SET_INPUT_ENABLED _IOW(PIO_IOC_MAGIC, 56, struct rp1_gpio_set_args)
++#define PIO_IOC_GPIO_SET_DRIVE_STRENGTH _IOW(PIO_IOC_MAGIC, 57, struct rp1_gpio_set_args)
++
++#endif
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0545-dts-bcm2712-rpi-Add-the-RP1-PIO-device.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0545-dts-bcm2712-rpi-Add-the-RP1-PIO-device.patch
new file mode 100644
index 00000000..089b7c30
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0545-dts-bcm2712-rpi-Add-the-RP1-PIO-device.patch
@@ -0,0 +1,55 @@
+From f623ce4eff9ce560e44a1ac94b07c52473dc0a27 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 1 Nov 2024 09:13:53 +0000
+Subject: [PATCH 545/697] dts: bcm2712-rpi: Add the RP1 PIO device
+
+Declare the device that proxies RP1's PIO hardware.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/bcm2712-rpi.dtsi |  5 +++++
+ arch/arm64/boot/dts/broadcom/rp1.dtsi         | 12 ++++++++++++
+ 2 files changed, 17 insertions(+)
+
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi.dtsi
+@@ -97,6 +97,10 @@
+ 	};
+ };
+ 
++pio: &rp1_pio {
++	status = "okay";
++};
++
+ / {
+ 	chosen: chosen {
+ 		bootargs = "reboot=w coherent_pool=1M 8250.nr_uarts=1 pci=pcie_bus_safe cgroup_disable=memory numa_policy=interleave";
+@@ -129,6 +133,7 @@
+ 		i2c12 = &i2c10;
+ 		mailbox = &mailbox;
+ 		mmc0 = &sdio1;
++		pio0 = &pio;
+ 		serial0 = &uart0;
+ 		serial1 = &uart1;
+ 		serial10 = &uart10;
+--- a/arch/arm64/boot/dts/broadcom/rp1.dtsi
++++ b/arch/arm64/boot/dts/broadcom/rp1.dtsi
+@@ -1028,6 +1028,18 @@
+ 			status = "disabled";
+ 		};
+ 
++		rp1_pio: pio@178000 {
++			reg = <0xc0 0x40178000  0x0 0x20>;
++			compatible = "raspberrypi,rp1-pio";
++			firmware = <&rp1_firmware>;
++			dmas = <&rp1_dma RP1_DMA_PIO_CH0_TX>, <&rp1_dma RP1_DMA_PIO_CH0_RX>,
++				   <&rp1_dma RP1_DMA_PIO_CH1_TX>, <&rp1_dma RP1_DMA_PIO_CH1_RX>,
++				   <&rp1_dma RP1_DMA_PIO_CH2_TX>, <&rp1_dma RP1_DMA_PIO_CH2_RX>,
++				   <&rp1_dma RP1_DMA_PIO_CH3_TX>, <&rp1_dma RP1_DMA_PIO_CH3_RX>;
++			dma-names = "tx0", "rx0", "tx1", "rx1", "tx2", "rx2", "tx3", "rx3";
++			status = "disabled";
++		};
++
+ 		rp1_mmc0: mmc@180000 {
+ 			reg = <0xc0 0x40180000  0x0 0x100>;
+ 			compatible = "raspberrypi,rp1-dwcmshc";
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0546-pwm-Add-pwm-pio-rp1-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0546-pwm-Add-pwm-pio-rp1-driver.patch
new file mode 100644
index 00000000..b7e51f1a
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0546-pwm-Add-pwm-pio-rp1-driver.patch
@@ -0,0 +1,298 @@
+From ce2a7348968962af00b56510a3ef60d994887bcc Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 8 Nov 2024 09:37:58 +0000
+Subject: [PATCH 546/697] pwm: Add pwm-pio-rp1 driver
+
+Use the PIO hardware on RP1 to implement a PWM interface.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/pwm/Kconfig       |  11 ++
+ drivers/pwm/Makefile      |   1 +
+ drivers/pwm/pwm-pio-rp1.c | 250 ++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 262 insertions(+)
+ create mode 100644 drivers/pwm/pwm-pio-rp1.c
+
+--- a/drivers/pwm/Kconfig
++++ b/drivers/pwm/Kconfig
+@@ -491,6 +491,17 @@ config PWM_PCA9685
+ 	  To compile this driver as a module, choose M here: the module
+ 	  will be called pwm-pca9685.
+ 
++config PWM_PIO_RP1
++	tristate "RP1 PIO PWM support"
++	depends on FIRMWARE_RP1 || COMPILE_TEST
++	help
++	  This is a PWM framework driver for Raspberry Pi 5, using the PIO
++	  hardware of RP1 to provide PWM functionality. Supports up to 4
++	  instances on GPIOs in bank 0.
++
++	  To compile this driver as a module, choose M here: the module
++	  will be called pwm-pio-rp1.
++
+ config PWM_PXA
+ 	tristate "PXA PWM support"
+ 	depends on ARCH_PXA || ARCH_MMP || COMPILE_TEST
+--- a/drivers/pwm/Makefile
++++ b/drivers/pwm/Makefile
+@@ -44,6 +44,7 @@ obj-$(CONFIG_PWM_MXS)		+= pwm-mxs.o
+ obj-$(CONFIG_PWM_NTXEC)		+= pwm-ntxec.o
+ obj-$(CONFIG_PWM_OMAP_DMTIMER)	+= pwm-omap-dmtimer.o
+ obj-$(CONFIG_PWM_PCA9685)	+= pwm-pca9685.o
++obj-$(CONFIG_PWM_PIO_RP1)	+= pwm-pio-rp1.o
+ obj-$(CONFIG_PWM_PXA)		+= pwm-pxa.o
+ obj-$(CONFIG_PWM_RASPBERRYPI_POE)	+= pwm-raspberrypi-poe.o
+ obj-$(CONFIG_PWM_RP1)		+= pwm-rp1.o
+--- /dev/null
++++ b/drivers/pwm/pwm-pio-rp1.c
+@@ -0,0 +1,250 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * Raspberry Pi PIO PWM.
++ *
++ * Copyright (C) 2024 Raspberry Pi Ltd.
++ *
++ * Author: Phil Elwell (phil@raspberrypi.com)
++ *
++ * Based on the pwm-rp1 driver by:
++ *   Naushir Patuck <naush@raspberrypi.com>
++ * and on the pwm-gpio driver by:
++ *   Vincent Whitchurch <vincent.whitchurch@axis.com>
++ */
++
++#include <linux/err.h>
++#include <linux/gpio/consumer.h>
++#include <linux/module.h>
++#include <linux/mutex.h>
++#include <linux/of.h>
++#include <linux/pio_rp1.h>
++#include <linux/platform_device.h>
++#include <linux/pwm.h>
++
++struct pwm_pio_rp1 {
++	struct pwm_chip chip;
++	struct device *dev;
++	struct gpio_desc *gpiod;
++	struct mutex mutex;
++	PIO pio;
++	uint sm;
++	uint offset;
++	uint gpio;
++	uint32_t period;		/* In SM cycles */
++	uint32_t duty_cycle;		/* In SM cycles */
++	enum pwm_polarity polarity;
++	bool enabled;
++};
++
++/* Generated from pwm.pio by pioasm */
++#define pwm_wrap_target 0
++#define pwm_wrap 6
++#define pwm_loop_ticks 3
++
++static const uint16_t pwm_program_instructions[] = {
++		//     .wrap_target
++	0x9080, //  0: pull   noblock         side 0
++	0xa027, //  1: mov    x, osr
++	0xa046, //  2: mov    y, isr
++	0x00a5, //  3: jmp    x != y, 5
++	0x1806, //  4: jmp    6               side 1
++	0xa042, //  5: nop
++	0x0083, //  6: jmp    y--, 3
++		//     .wrap
++};
++
++static const struct pio_program pwm_program = {
++	.instructions = pwm_program_instructions,
++	.length = 7,
++	.origin = -1,
++};
++
++static unsigned int pwm_pio_resolution __read_mostly;
++
++static inline pio_sm_config pwm_program_get_default_config(uint offset)
++{
++	pio_sm_config c = pio_get_default_sm_config();
++
++	sm_config_set_wrap(&c, offset + pwm_wrap_target, offset + pwm_wrap);
++	sm_config_set_sideset(&c, 2, true, false);
++	return c;
++}
++
++static inline void pwm_program_init(PIO pio, uint sm, uint offset, uint pin)
++{
++	pio_gpio_init(pio, pin);
++
++	pio_sm_set_consecutive_pindirs(pio, sm, pin, 1, true);
++	pio_sm_config c = pwm_program_get_default_config(offset);
++
++	sm_config_set_sideset_pins(&c, pin);
++	pio_sm_init(pio, sm, offset, &c);
++}
++
++/* Write `period` to the input shift register - must be disabled */
++static void pio_pwm_set_period(PIO pio, uint sm, uint32_t period)
++{
++	pio_sm_put_blocking(pio, sm, period);
++	pio_sm_exec(pio, sm, pio_encode_pull(false, false));
++	pio_sm_exec(pio, sm, pio_encode_out(pio_isr, 32));
++}
++
++/* Write `level` to TX FIFO. State machine will copy this into X. */
++static void pio_pwm_set_level(PIO pio, uint sm, uint32_t level)
++{
++	pio_sm_put_blocking(pio, sm, level);
++}
++
++static int pwm_pio_rp1_apply(struct pwm_chip *chip, struct pwm_device *pwm,
++			  const struct pwm_state *state)
++{
++	struct pwm_pio_rp1 *ppwm = container_of(chip, struct pwm_pio_rp1, chip);
++	uint32_t new_duty_cycle;
++	uint32_t new_period;
++
++	if (state->duty_cycle && state->duty_cycle < pwm_pio_resolution)
++		return -EINVAL;
++
++	if (state->duty_cycle != state->period &&
++	    (state->period - state->duty_cycle < pwm_pio_resolution))
++		return -EINVAL;
++
++	new_period = state->period / pwm_pio_resolution;
++	new_duty_cycle = state->duty_cycle / pwm_pio_resolution;
++
++	mutex_lock(&ppwm->mutex);
++
++	if ((ppwm->enabled && !state->enabled) || new_period != ppwm->period) {
++		pio_sm_set_enabled(ppwm->pio, ppwm->sm, false);
++		ppwm->enabled = false;
++	}
++
++	if (new_period != ppwm->period) {
++		pio_pwm_set_period(ppwm->pio, ppwm->sm, new_period);
++		ppwm->period = new_period;
++	}
++
++	if (state->enabled && new_duty_cycle != ppwm->duty_cycle) {
++		pio_pwm_set_level(ppwm->pio, ppwm->sm, new_duty_cycle);
++		ppwm->duty_cycle = new_duty_cycle;
++	}
++
++	if (state->polarity != ppwm->polarity) {
++		pio_gpio_set_outover(ppwm->pio, ppwm->gpio,
++			(state->polarity == PWM_POLARITY_INVERSED) ?
++			GPIO_OVERRIDE_INVERT : GPIO_OVERRIDE_NORMAL);
++		ppwm->polarity = state->polarity;
++	}
++
++	if (!ppwm->enabled && state->enabled) {
++		pio_sm_set_enabled(ppwm->pio, ppwm->sm, true);
++		ppwm->enabled = true;
++	}
++
++	mutex_unlock(&ppwm->mutex);
++
++	return 0;
++}
++
++static const struct pwm_ops pwm_pio_rp1_ops = {
++	.apply = pwm_pio_rp1_apply,
++};
++
++static int pwm_pio_rp1_probe(struct platform_device *pdev)
++{
++	struct device_node *np = pdev->dev.of_node;
++	struct of_phandle_args of_args = { 0 };
++	struct device *dev = &pdev->dev;
++	struct pwm_pio_rp1 *ppwm;
++	struct pwm_chip *chip;
++	bool is_rp1;
++
++	chip = devm_pwmchip_alloc(dev, 1, sizeof(*ppwm));
++	if (IS_ERR(chip))
++		return PTR_ERR(chip);
++
++	ppwm = pwmchip_get_drvdata(chip);
++
++	mutex_init(&ppwm->mutex);
++
++	ppwm->gpiod = devm_gpiod_get(dev, NULL, GPIOD_ASIS);
++	/* Need to check that this is an RP1 GPIO in the first bank, and retrieve the offset */
++	/* Unfortunately I think this has to be done by parsing the gpios property */
++	if (IS_ERR(ppwm->gpiod))
++		return dev_err_probe(dev, PTR_ERR(ppwm->gpiod),
++				     "could not get a gpio\n");
++
++	/* This really shouldn't fail, given that we have a gpiod */
++	if (of_parse_phandle_with_args(np, "gpios", "#gpio-cells", 0, &of_args))
++		return dev_err_probe(dev, -EINVAL,
++				     "can't find gpio declaration\n");
++
++	is_rp1 = of_device_is_compatible(of_args.np, "raspberrypi,rp1-gpio");
++	of_node_put(of_args.np);
++	if (!is_rp1 || of_args.args_count != 2)
++		return dev_err_probe(dev, -EINVAL,
++				     "not an RP1 gpio\n");
++
++	ppwm->gpio = of_args.args[0];
++
++	ppwm->pio = pio_open();
++	if (IS_ERR(ppwm->pio))
++		return dev_err_probe(dev, PTR_ERR(ppwm->pio),
++				     "%pfw: could not open PIO\n",
++				     dev_fwnode(dev));
++
++	ppwm->sm = pio_claim_unused_sm(ppwm->pio, false);
++	if ((int)ppwm->sm < 0) {
++		pio_close(ppwm->pio);
++		return dev_err_probe(dev, -EBUSY,
++				     "%pfw: no free PIO SM\n",
++				     dev_fwnode(dev));
++	}
++
++	ppwm->offset = pio_add_program(ppwm->pio, &pwm_program);
++	if (ppwm->offset == PIO_ORIGIN_ANY) {
++		pio_close(ppwm->pio);
++		return dev_err_probe(dev, -EBUSY,
++				     "%pfw: not enough PIO program space\n",
++				     dev_fwnode(dev));
++	}
++
++	pwm_program_init(ppwm->pio, ppwm->sm, ppwm->offset, ppwm->gpio);
++
++	pwm_pio_resolution = (1000u * 1000 * 1000 * pwm_loop_ticks) / clock_get_hz(clk_sys);
++
++	chip->ops = &pwm_pio_rp1_ops;
++	chip->atomic = true;
++	chip->npwm = 1;
++
++	platform_set_drvdata(pdev, ppwm);
++
++	return devm_pwmchip_add(dev, chip);
++}
++
++static void pwm_pio_rp1_remove(struct platform_device *pdev)
++{
++	struct pwm_pio_rp1 *ppwm = platform_get_drvdata(pdev);
++
++	pio_close(ppwm->pio);
++}
++
++static const struct of_device_id pwm_pio_rp1_dt_ids[] = {
++	{ .compatible = "raspberrypi,pwm-pio-rp1" },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, pwm_pio_rp1_dt_ids);
++
++static struct platform_driver pwm_pio_rp1_driver = {
++	.driver = {
++		.name = "pwm-pio-rp1",
++		.of_match_table = pwm_pio_rp1_dt_ids,
++	},
++	.probe = pwm_pio_rp1_probe,
++	.remove_new = pwm_pio_rp1_remove,
++};
++module_platform_driver(pwm_pio_rp1_driver);
++
++MODULE_DESCRIPTION("PWM PIO RP1 driver");
++MODULE_AUTHOR("Phil Elwell");
++MODULE_LICENSE("GPL");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0548-overlays-Add-pwm-pio-overlay.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0548-overlays-Add-pwm-pio-overlay.patch
new file mode 100644
index 00000000..8dd3a50e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0548-overlays-Add-pwm-pio-overlay.patch
@@ -0,0 +1,99 @@
+From fabe12ad3a4bda8ff4da26ff47a59cd48af4c5ba Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 7 Nov 2024 11:41:33 +0000
+Subject: [PATCH 548/697] overlays: Add pwm-pio overlay
+
+Add an overlay to enable a single-channel PIO-assisted PWM interface on any
+header pin.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/Makefile           |  1 +
+ arch/arm/boot/dts/overlays/README             |  8 ++++
+ arch/arm/boot/dts/overlays/overlay_map.dts    |  4 ++
+ .../arm/boot/dts/overlays/pwm-pio-overlay.dts | 39 +++++++++++++++++++
+ 4 files changed, 52 insertions(+)
+ create mode 100644 arch/arm/boot/dts/overlays/pwm-pio-overlay.dts
+
+--- a/arch/arm/boot/dts/overlays/Makefile
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -220,6 +220,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
+ 	pwm-2chan.dtbo \
+ 	pwm-gpio.dtbo \
+ 	pwm-ir-tx.dtbo \
++	pwm-pio.dtbo \
+ 	pwm1.dtbo \
+ 	qca7000.dtbo \
+ 	qca7000-uart0.dtbo \
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -3960,6 +3960,14 @@ Params: gpio_pin                Output G
+         func                    Pin function (default 2 = Alt5)
+ 
+ 
++Name:   pwm-pio
++Info:   Configures a GPIO pin as PIO-assisted PWM output. Unlike hardware PWM,
++        this can be used on any RP1 GPIO in bank 0 (0-27). Up to 4 are
++        supported, assuming nothing else is using PIO. Pi 5 only.
++Load:   dtoverlay=pwm-pio,<param>=<val>
++Params: gpio                    Output GPIO (0-27, default 4)
++
++
+ Name:   pwm1
+ Info:   Configures one or two PWM channel on PWM1 (BCM2711 only)
+         N.B.:
+--- a/arch/arm/boot/dts/overlays/overlay_map.dts
++++ b/arch/arm/boot/dts/overlays/overlay_map.dts
+@@ -240,6 +240,10 @@
+ 		bcm2712;
+ 	};
+ 
++	pwm-pio {
++		bcm2712;
++	};
++
+ 	pwm1 {
+ 		bcm2711;
+ 	};
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pwm-pio-overlay.dts
+@@ -0,0 +1,39 @@
++// SPDX-License-Identifier: GPL-2.0
++// Device tree overlay for RP1 PIO PWM.
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			pwm_pio_pins: pwm_pio_pins@4 {
++				brcm,pins = <4>; /* gpio 4 */
++				function = "pio";
++				bias-disable;
++			};
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			pwm_pio: pwm_pio@4 {
++				  compatible = "raspberrypi,pwm-pio-rp1";
++				  pinctrl-names = "default";
++				  pinctrl-0 = <&pwm_pio_pins>;
++				  gpios = <&gpio 4 0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		gpio = <&pwm_pio>,"gpios:4",
++		       <&pwm_pio_pins>,"brcm,pins:0",
++		       /* modify reg values to allow multiple instantiation */
++		       <&pwm_pio>,"reg:0",
++		       <&pwm_pio_pins>,"reg:0";
++	};
++};
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0550-drivers-media-pci-Update-Hailo-accelerator-device-dr.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0550-drivers-media-pci-Update-Hailo-accelerator-device-dr.patch
new file mode 100644
index 00000000..b6a70a04
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0550-drivers-media-pci-Update-Hailo-accelerator-device-dr.patch
@@ -0,0 +1,3585 @@
+From 1db8a5d4dcb5d6baba521bace088795205ecff45 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Thu, 17 Oct 2024 11:37:29 +0100
+Subject: [PATCH 550/697] drivers: media: pci: Update Hailo accelerator device
+ driver to v4.19
+
+Sourced from https://github.com/hailo-ai/hailort-drivers/
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/pci/hailo/Makefile              |   4 +-
+ drivers/media/pci/hailo/common/fw_operation.c |  50 ++-
+ drivers/media/pci/hailo/common/fw_operation.h |   8 +-
+ .../media/pci/hailo/common/fw_validation.c    |  10 +-
+ .../media/pci/hailo/common/fw_validation.h    |   7 +-
+ .../pci/hailo/common/hailo_ioctl_common.h     |  28 +-
+ .../media/pci/hailo/common/hailo_resource.c   |  23 +-
+ .../media/pci/hailo/common/hailo_resource.h   |   2 +-
+ drivers/media/pci/hailo/common/pcie_common.c  | 378 +++++++++---------
+ drivers/media/pci/hailo/common/pcie_common.h  |  38 +-
+ drivers/media/pci/hailo/common/soc_structs.h  |  79 ++++
+ drivers/media/pci/hailo/common/utils.h        |  23 +-
+ drivers/media/pci/hailo/common/vdma_common.c  |  93 +++--
+ drivers/media/pci/hailo/common/vdma_common.h  |  22 +-
+ drivers/media/pci/hailo/src/fops.c            | 284 ++-----------
+ drivers/media/pci/hailo/src/fops.h            |   5 +-
+ drivers/media/pci/hailo/src/nnc.c             | 299 ++++++++++++++
+ drivers/media/pci/hailo/src/nnc.h             |  22 +
+ drivers/media/pci/hailo/src/pci_soc_ioctl.c   | 155 -------
+ drivers/media/pci/hailo/src/pcie.c            | 166 +++-----
+ drivers/media/pci/hailo/src/pcie.h            |  26 +-
+ drivers/media/pci/hailo/src/soc.c             | 244 +++++++++++
+ .../pci/hailo/src/{pci_soc_ioctl.h => soc.h}  |  13 +-
+ drivers/media/pci/hailo/src/sysfs.c           |   2 +-
+ drivers/media/pci/hailo/src/sysfs.h           |   2 +-
+ drivers/media/pci/hailo/src/utils.c           |  26 --
+ drivers/media/pci/hailo/utils/compact.h       |   2 +-
+ drivers/media/pci/hailo/utils/fw_common.h     |   2 +-
+ .../pci/hailo/utils/integrated_nnc_utils.c    |  10 +-
+ .../pci/hailo/utils/integrated_nnc_utils.h    |   2 +-
+ drivers/media/pci/hailo/utils/logs.c          |   2 +-
+ drivers/media/pci/hailo/utils/logs.h          |   2 +-
+ drivers/media/pci/hailo/vdma/ioctl.c          |  18 +-
+ drivers/media/pci/hailo/vdma/ioctl.h          |   6 +-
+ drivers/media/pci/hailo/vdma/memory.c         |  12 +-
+ drivers/media/pci/hailo/vdma/memory.h         |   2 +-
+ drivers/media/pci/hailo/vdma/vdma.c           |  39 +-
+ drivers/media/pci/hailo/vdma/vdma.h           |   5 +-
+ 38 files changed, 1223 insertions(+), 888 deletions(-)
+ create mode 100644 drivers/media/pci/hailo/common/soc_structs.h
+ create mode 100644 drivers/media/pci/hailo/src/nnc.c
+ create mode 100644 drivers/media/pci/hailo/src/nnc.h
+ delete mode 100755 drivers/media/pci/hailo/src/pci_soc_ioctl.c
+ create mode 100644 drivers/media/pci/hailo/src/soc.c
+ rename drivers/media/pci/hailo/src/{pci_soc_ioctl.h => soc.h} (56%)
+ mode change 100755 => 100644
+ delete mode 100644 drivers/media/pci/hailo/src/utils.c
+
+--- a/drivers/media/pci/hailo/Makefile
++++ b/drivers/media/pci/hailo/Makefile
+@@ -8,9 +8,9 @@ obj-$(CONFIG_MEDIA_PCI_HAILO) := hailo_p
+ 
+ hailo_pci-objs += src/pcie.o
+ hailo_pci-objs += src/fops.o
+-hailo_pci-objs += src/utils.o
+ hailo_pci-objs += src/sysfs.o
+-hailo_pci-objs += src/pci_soc_ioctl.o
++hailo_pci-objs += src/nnc.o
++hailo_pci-objs += src/soc.o
+ 
+ hailo_pci-objs += $(COMMON_SRC_DIRECTORY)/fw_validation.o
+ hailo_pci-objs += $(COMMON_SRC_DIRECTORY)/fw_operation.o
+--- a/drivers/media/pci/hailo/common/fw_operation.c
++++ b/drivers/media/pci/hailo/common/fw_operation.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: MIT
+ /**
+- * Copyright (c) 2022 Hailo Technologies Ltd. All rights reserved.
+-**/
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
++ **/
+ 
+ #include "fw_operation.h"
+ 
+@@ -15,7 +15,10 @@ typedef struct {
+     u32 chip_offset;
+ } FW_DEBUG_BUFFER_HEADER_t;
+ 
+-#define DEBUG_BUFFER_DATA_SIZE (DEBUG_BUFFER_TOTAL_SIZE - sizeof(FW_DEBUG_BUFFER_HEADER_t))
++#define DEBUG_BUFFER_DATA_SIZE              (DEBUG_BUFFER_TOTAL_SIZE - sizeof(FW_DEBUG_BUFFER_HEADER_t))
++#define PCIE_D2H_NOTIFICATION_SRAM_OFFSET   (0x640 + 0x640)
++#define PCIE_APP_CPU_DEBUG_OFFSET           (8*1024)
++#define PCIE_CORE_CPU_DEBUG_OFFSET          (PCIE_APP_CPU_DEBUG_OFFSET + DEBUG_BUFFER_TOTAL_SIZE)
+ 
+ int hailo_read_firmware_notification(struct hailo_resource *resource, struct hailo_d2h_notification *notification)
+ {
+@@ -35,6 +38,21 @@ int hailo_read_firmware_notification(str
+     return 0;
+ }
+ 
++int hailo_pcie_read_firmware_notification(struct hailo_resource *resource,
++    struct hailo_d2h_notification *notification)
++{
++    struct hailo_resource notification_resource;
++
++    if (PCIE_D2H_NOTIFICATION_SRAM_OFFSET > resource->size) {
++        return -EINVAL;
++    }
++
++    notification_resource.address = resource->address + PCIE_D2H_NOTIFICATION_SRAM_OFFSET,
++    notification_resource.size = sizeof(struct hailo_d2h_notification);
++
++    return hailo_read_firmware_notification(&notification_resource, notification);
++}
++
+ static inline size_t calculate_log_ready_to_read(FW_DEBUG_BUFFER_HEADER_t *header)
+ {
+     size_t ready_to_read = 0;
+@@ -100,4 +118,30 @@ long hailo_read_firmware_log(struct hail
+     
+     params->read_bytes = ready_to_read;
+     return 0;
++}
++
++long hailo_pcie_read_firmware_log(struct hailo_resource *resource, struct hailo_read_log_params *params)
++{
++    long err = 0;
++    struct hailo_resource log_resource = {resource->address, DEBUG_BUFFER_TOTAL_SIZE};
++
++    if (HAILO_CPU_ID_CPU0 == params->cpu_id) {
++        log_resource.address += PCIE_APP_CPU_DEBUG_OFFSET;
++    } else if (HAILO_CPU_ID_CPU1 == params->cpu_id) {
++        log_resource.address += PCIE_CORE_CPU_DEBUG_OFFSET;
++    } else {
++        return -EINVAL;
++    }
++
++    if (0 == params->buffer_size) {
++        params->read_bytes = 0;
++        return 0;
++    }
++
++    err = hailo_read_firmware_log(&log_resource, params);
++    if (0 != err) {
++        return err;
++    }
++
++    return 0;
+ }
+\ No newline at end of file
+--- a/drivers/media/pci/hailo/common/fw_operation.h
++++ b/drivers/media/pci/hailo/common/fw_operation.h
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: MIT
+ /**
+- * Copyright (c) 2022 Hailo Technologies Ltd. All rights reserved.
+-**/
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
++ **/
+ 
+ #ifndef _HAILO_COMMON_FIRMWARE_OPERATION_H_
+ #define _HAILO_COMMON_FIRMWARE_OPERATION_H_
+@@ -16,8 +16,12 @@ extern "C" {
+ 
+ int hailo_read_firmware_notification(struct hailo_resource *resource, struct hailo_d2h_notification *notification);
+ 
++int hailo_pcie_read_firmware_notification(struct hailo_resource *resource, struct hailo_d2h_notification *notification);
++
+ long hailo_read_firmware_log(struct hailo_resource *fw_logger_resource, struct hailo_read_log_params *params);
+ 
++long hailo_pcie_read_firmware_log(struct hailo_resource *resource, struct hailo_read_log_params *params);
++
+ #ifdef __cplusplus
+ }
+ #endif
+--- a/drivers/media/pci/hailo/common/fw_validation.c
++++ b/drivers/media/pci/hailo/common/fw_validation.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: MIT
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #include "fw_validation.h"
+@@ -85,15 +85,15 @@ exit:
+ }
+ 
+ int FW_VALIDATION__validate_cert_header(uintptr_t firmware_base_address,
+-    size_t firmware_size, u32 *outer_consumed_firmware_offset, secure_boot_certificate_t **out_firmware_cert)
++    size_t firmware_size, u32 *outer_consumed_firmware_offset, secure_boot_certificate_header_t **out_firmware_cert)
+ {
+ 
+-    secure_boot_certificate_t *firmware_cert = NULL;
++    secure_boot_certificate_header_t *firmware_cert = NULL;
+     int err = -EINVAL;
+     u32 consumed_firmware_offset = *outer_consumed_firmware_offset;
+ 
+-    firmware_cert = (secure_boot_certificate_t *) (firmware_base_address + consumed_firmware_offset);
+-    CONSUME_FIRMWARE(sizeof(secure_boot_certificate_t), -EINVAL);
++    firmware_cert = (secure_boot_certificate_header_t *) (firmware_base_address + consumed_firmware_offset);
++    CONSUME_FIRMWARE(sizeof(secure_boot_certificate_header_t), -EINVAL);
+ 
+     if ((MAXIMUM_FIRMWARE_CERT_KEY_SIZE < firmware_cert->key_size) ||
+         (MAXIMUM_FIRMWARE_CERT_CONTENT_SIZE < firmware_cert->content_size)) {
+--- a/drivers/media/pci/hailo/common/fw_validation.h
++++ b/drivers/media/pci/hailo/common/fw_validation.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: MIT
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef PCIE_COMMON_FIRMWARE_HEADER_UTILS_H_
+@@ -44,8 +44,7 @@ typedef struct {
+ typedef struct {
+     u32 key_size;
+     u32 content_size;
+-    u8 certificates_data[0];
+-} secure_boot_certificate_t;
++} secure_boot_certificate_header_t;
+ 
+ #ifdef _MSC_VER
+ #pragma warning(pop)
+@@ -60,6 +59,6 @@ int FW_VALIDATION__validate_fw_header(ui
+     firmware_header_t **out_firmware_header, enum hailo_board_type board_type);
+ 
+ int FW_VALIDATION__validate_cert_header(uintptr_t firmware_base_address,
+-    size_t firmware_size, u32 *outer_consumed_firmware_offset, secure_boot_certificate_t **out_firmware_cert);
++    size_t firmware_size, u32 *outer_consumed_firmware_offset, secure_boot_certificate_header_t **out_firmware_cert);
+ 
+ #endif
+\ No newline at end of file
+--- a/drivers/media/pci/hailo/common/hailo_ioctl_common.h
++++ b/drivers/media/pci/hailo/common/hailo_ioctl_common.h
+@@ -1,13 +1,13 @@
+ // SPDX-License-Identifier: (GPL-2.0 WITH Linux-syscall-note) AND MIT
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _HAILO_IOCTL_COMMON_H_
+ #define _HAILO_IOCTL_COMMON_H_
+ 
+ #define HAILO_DRV_VER_MAJOR 4
+-#define HAILO_DRV_VER_MINOR 18
++#define HAILO_DRV_VER_MINOR 19
+ #define HAILO_DRV_VER_REVISION 0
+ 
+ #define _STRINGIFY_EXPANDED( x ) #x
+@@ -17,10 +17,11 @@
+ 
+ // This value is not easily changeable.
+ // For example: the channel interrupts ioctls assume we have up to 32 channels
+-#define MAX_VDMA_CHANNELS_PER_ENGINE    (32)
+-#define MAX_VDMA_ENGINES                (3)
+-#define SIZE_OF_VDMA_DESCRIPTOR         (16)
+-#define VDMA_DEST_CHANNELS_START        (16)
++#define MAX_VDMA_CHANNELS_PER_ENGINE            (32)
++#define VDMA_CHANNELS_PER_ENGINE_PER_DIRECTION  (16)
++#define MAX_VDMA_ENGINES                        (3)
++#define SIZE_OF_VDMA_DESCRIPTOR                 (16)
++#define VDMA_DEST_CHANNELS_START                (16)
+ 
+ #define HAILO_VDMA_MAX_ONGOING_TRANSFERS (128)
+ #define HAILO_VDMA_MAX_ONGOING_TRANSFERS_MASK (HAILO_VDMA_MAX_ONGOING_TRANSFERS - 1)
+@@ -37,8 +38,8 @@
+ #define FW_ACCESS_APP_CPU_CONTROL_MASK      (1 << FW_ACCESS_CONTROL_INTERRUPT_SHIFT)
+ #define FW_ACCESS_DRIVER_SHUTDOWN_SHIFT     (2)
+ #define FW_ACCESS_DRIVER_SHUTDOWN_MASK      (1 << FW_ACCESS_DRIVER_SHUTDOWN_SHIFT)
+-#define FW_ACCESS_SOC_CONNECT_SHIFT         (3)
+-#define FW_ACCESS_SOC_CONNECT_MASK          (1 << FW_ACCESS_SOC_CONNECT_SHIFT)
++#define FW_ACCESS_SOC_CONTROL_SHIFT         (3)
++#define FW_ACCESS_SOC_CONTROL_MASK          (1 << FW_ACCESS_SOC_CONTROL_SHIFT)
+ 
+ #define INVALID_VDMA_CHANNEL                (0xff)
+ 
+@@ -245,6 +246,12 @@ struct hailo_desc_list_release_params {
+     uintptr_t desc_handle;      // in
+ };
+ 
++struct hailo_write_action_list_params {
++    uint8_t *data;              // in
++    size_t size;                // in
++    uint64_t dma_address;       // out
++};
++
+ /* structure used in ioctl HAILO_DESC_LIST_BIND_VDMA_BUFFER */
+ struct hailo_desc_list_program_params {
+     size_t buffer_handle;       // in
+@@ -508,6 +515,7 @@ struct hailo_vdma_launch_transfer_params
+ 
+ /* structure used in ioctl HAILO_SOC_CONNECT */
+ struct hailo_soc_connect_params {
++    uint16_t port_number;           // in
+     uint8_t input_channel_index;    // out
+     uint8_t output_channel_index;   // out
+     uintptr_t input_desc_handle;    // in
+@@ -522,6 +530,7 @@ struct hailo_soc_close_params {
+ 
+ /* structure used in ioctl HAILO_PCI_EP_ACCEPT */
+ struct hailo_pci_ep_accept_params {
++    uint16_t port_number;           // in
+     uint8_t input_channel_index;    // out
+     uint8_t output_channel_index;   // out
+     uintptr_t input_desc_handle;    // in
+@@ -562,6 +571,7 @@ struct tCompatibleHailoIoctlData
+         struct hailo_soc_close_params SocCloseParams;
+         struct hailo_pci_ep_accept_params AcceptParams;
+         struct hailo_pci_ep_close_params PciEpCloseParams;
++        struct hailo_write_action_list_params WriteActionListParams;
+     } Buffer;
+ };
+ #endif // _MSC_VER
+@@ -632,6 +642,7 @@ enum hailo_nnc_ioctl_code {
+     HAILO_DISABLE_NOTIFICATION_CODE,
+     HAILO_READ_LOG_CODE,
+     HAILO_RESET_NN_CORE_CODE,
++    HAILO_WRITE_ACTION_LIST_CODE,
+ 
+     // Must be last
+     HAILO_NNC_IOCTL_MAX_NR
+@@ -642,6 +653,7 @@ enum hailo_nnc_ioctl_code {
+ #define HAILO_DISABLE_NOTIFICATION      _IO_(HAILO_NNC_IOCTL_MAGIC,    HAILO_DISABLE_NOTIFICATION_CODE)
+ #define HAILO_READ_LOG                  _IOWR_(HAILO_NNC_IOCTL_MAGIC,  HAILO_READ_LOG_CODE,                   struct hailo_read_log_params)
+ #define HAILO_RESET_NN_CORE             _IO_(HAILO_NNC_IOCTL_MAGIC,    HAILO_RESET_NN_CORE_CODE)
++#define HAILO_WRITE_ACTION_LIST         _IOW_(HAILO_NNC_IOCTL_MAGIC,    HAILO_WRITE_ACTION_LIST_CODE,     struct hailo_write_action_list_params)
+ 
+ enum hailo_soc_ioctl_code {
+     HAILO_SOC_IOCTL_CONNECT_CODE,
+--- a/drivers/media/pci/hailo/common/hailo_resource.c
++++ b/drivers/media/pci/hailo/common/hailo_resource.c
+@@ -1,24 +1,31 @@
+ // SPDX-License-Identifier: MIT
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #include "hailo_resource.h"
+ 
++#include "utils.h"
++
+ #include <linux/io.h>
+ #include <linux/errno.h>
+ #include <linux/types.h>
+ #include <linux/kernel.h>
+ 
++#define ALIGN_TO_32_BIT(addr) ((addr) & (~((uintptr_t)0x3)))
+ 
+ u8 hailo_resource_read8(struct hailo_resource *resource, size_t offset)
+ {
+-    return ioread8((u8*)resource->address + offset);
++    u32 val = ioread32((u8*)ALIGN_TO_32_BIT(resource->address + offset));
++    u64 offset_in_bits = BITS_IN_BYTE * ((resource->address + offset) - ALIGN_TO_32_BIT(resource->address + offset));
++    return (u8)READ_BITS_AT_OFFSET(BYTE_SIZE * BITS_IN_BYTE, offset_in_bits, val);
+ }
+ 
+ u16 hailo_resource_read16(struct hailo_resource *resource, size_t offset)
+ {
+-    return ioread16((u8*)resource->address + offset);
++    u32 val = ioread32((u8*)ALIGN_TO_32_BIT(resource->address + offset));
++    u64 offset_in_bits = BITS_IN_BYTE * ((resource->address + offset) - ALIGN_TO_32_BIT(resource->address + offset));
++    return (u16)READ_BITS_AT_OFFSET(WORD_SIZE * BITS_IN_BYTE, offset_in_bits, val);
+ }
+ 
+ u32 hailo_resource_read32(struct hailo_resource *resource, size_t offset)
+@@ -28,12 +35,18 @@ u32 hailo_resource_read32(struct hailo_r
+ 
+ void hailo_resource_write8(struct hailo_resource *resource, size_t offset, u8 value)
+ {
+-    iowrite8(value, (u8*)resource->address + offset);
++    u32 initial_val = ioread32((u8*)ALIGN_TO_32_BIT(resource->address + offset));
++    u64 offset_in_bits = BITS_IN_BYTE * ((resource->address + offset) - ALIGN_TO_32_BIT(resource->address + offset));
++    iowrite32(WRITE_BITS_AT_OFFSET(BYTE_SIZE * BITS_IN_BYTE, offset_in_bits, initial_val, value),
++        (u8*)ALIGN_TO_32_BIT(resource->address + offset));
+ }
+ 
+ void hailo_resource_write16(struct hailo_resource *resource, size_t offset, u16 value)
+ {
+-    iowrite16(value, (u8*)resource->address + offset);
++    u32 initial_val = ioread32((u8*)ALIGN_TO_32_BIT(resource->address + offset));
++    u64 offset_in_bits = BITS_IN_BYTE * ((resource->address + offset) - ALIGN_TO_32_BIT(resource->address + offset));
++    iowrite32(WRITE_BITS_AT_OFFSET(WORD_SIZE * BITS_IN_BYTE, offset_in_bits, initial_val, value),
++        (u8*)ALIGN_TO_32_BIT(resource->address + offset));
+ }
+ 
+ void hailo_resource_write32(struct hailo_resource *resource, size_t offset, u32 value)
+--- a/drivers/media/pci/hailo/common/hailo_resource.h
++++ b/drivers/media/pci/hailo/common/hailo_resource.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: MIT
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _HAILO_COMMON_HAILO_RESOURCE_H_
+--- a/drivers/media/pci/hailo/common/pcie_common.c
++++ b/drivers/media/pci/hailo/common/pcie_common.c
+@@ -1,10 +1,11 @@
+ // SPDX-License-Identifier: MIT
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #include "pcie_common.h"
+ #include "fw_operation.h"
++#include "soc_structs.h"
+ 
+ #include <linux/errno.h>
+ #include <linux/bug.h>
+@@ -35,10 +36,6 @@
+ #define FIRMWARE_LOAD_WAIT_MAX_RETRIES (100)
+ #define FIRMWARE_LOAD_SLEEP_MS         (50)
+ 
+-#define PCIE_APP_CPU_DEBUG_OFFSET (8*1024)
+-#define PCIE_CORE_CPU_DEBUG_OFFSET (PCIE_APP_CPU_DEBUG_OFFSET + DEBUG_BUFFER_TOTAL_SIZE)
+-
+-#define PCIE_D2H_NOTIFICATION_SRAM_OFFSET (0x640 + 0x640)
+ #define PCIE_REQUEST_SIZE_OFFSET (0x640)
+ 
+ #define PCIE_CONFIG_VENDOR_OFFSET (0x0098)
+@@ -59,7 +56,6 @@ struct hailo_fw_addresses {
+     u32 app_fw_code_ram_base;
+     u32 boot_key_cert;
+     u32 boot_cont_cert;
+-    u32 boot_fw_trigger;
+     u32 core_code_ram_base;
+     u32 core_fw_header;
+     u32 atr0_trsl_addr1;
+@@ -69,13 +65,11 @@ struct hailo_fw_addresses {
+ 
+ struct loading_stage {
+     const struct hailo_file_batch *batch;
++    u32 trigger_address;
+ };
+ 
+ struct hailo_board_compatibility {
+     struct hailo_fw_addresses fw_addresses;
+-    const char *fw_filename;
+-    const struct hailo_config_constants board_cfg;
+-    const struct hailo_config_constants fw_cfg;
+     const struct loading_stage stages[MAX_LOADING_STAGES];
+ };
+ 
+@@ -85,28 +79,32 @@ static const struct hailo_file_batch hai
+         .address = 0xA0000,
+         .max_size = 0x8004,
+         .is_mandatory = true,
+-        .has_header = false
++        .has_header = false,
++        .has_core = false
+     },
+     {
+         .filename = "hailo/hailo10h/u-boot.dtb.signed",
+         .address = 0xA8004,
+         .max_size = 0x20000,
+         .is_mandatory = true,
+-        .has_header = false
++        .has_header = false,
++        .has_core = false
+     },
+     {
+         .filename = "hailo/hailo10h/scu_fw.bin",
+         .address = 0x20000,
+         .max_size = 0x40000,
+         .is_mandatory = true,
+-        .has_header = true
++        .has_header = true,
++        .has_core = false
+     },
+     {
+         .filename = NULL,
+         .address = 0x00,
+         .max_size = 0x00,
+         .is_mandatory = false,
+-        .has_header = false
++        .has_header = false,
++        .has_core = false
+     }
+ };
+ 
+@@ -116,36 +114,140 @@ static const struct hailo_file_batch hai
+         .address = 0x85000000,
+         .max_size = 0x1000000,
+         .is_mandatory = true,
+-        .has_header = false
++        .has_header = false,
++        .has_core = false
+     },
+     {
+         .filename = "hailo/hailo10h/u-boot-tfa.itb",
+         .address = 0x86000000,
+         .max_size = 0x1000000,
+         .is_mandatory = true,
+-        .has_header = false
++        .has_header = false,
++        .has_core = false
+     },
+     {
+         .filename = "hailo/hailo10h/fitImage",
+         .address = 0x87000000,
+         .max_size = 0x1000000,
+         .is_mandatory = true,
+-        .has_header = false
++        .has_header = false,
++        .has_core = false
+     },
+     {
+         .filename = "hailo/hailo10h/core-image-minimal-hailo10-m2.ext4.gz",
+         .address = 0x88000000,
+         .max_size = 0x20000000, // Max size 512MB
+         .is_mandatory = true,
+-        .has_header = false
++        .has_header = false,
++        .has_core = false
+     },
+ };
+ 
++// If loading linux from EMMC - only need few files from second batch (u-boot-spl.bin and u-boot-tfa.itb)
++static const struct hailo_file_batch hailo10h_files_stg2_linux_in_emmc[] = {
++    {
++        .filename = "hailo/hailo10h/u-boot-spl.bin",
++        .address = 0x85000000,
++        .max_size = 0x1000000,
++        .is_mandatory = true,
++        .has_header = false,
++        .has_core = false
++    },
++    {
++        .filename = "hailo/hailo10h/u-boot-tfa.itb",
++        .address = 0x86000000,
++        .max_size = 0x1000000,
++        .is_mandatory = true,
++        .has_header = false,
++        .has_core = false
++    },
++    {
++        .filename = NULL,
++        .address = 0x00,
++        .max_size = 0x00,
++        .is_mandatory = false,
++        .has_header = false,
++        .has_core = false
++    },
++};
++
++static const struct hailo_file_batch hailo8_files_stg1[] = {
++    {
++        .filename = "hailo/hailo8_fw.4.19.0.bin",
++        .address = 0x20000,
++        .max_size = 0x50000,
++        .is_mandatory = true,
++        .has_header = true,
++        .has_core = true
++    },
++    {
++        .filename = "hailo/hailo8_board_cfg.bin",
++        .address = 0x60001000,
++        .max_size = PCIE_HAILO8_BOARD_CFG_MAX_SIZE,
++        .is_mandatory = false,
++        .has_header = false,
++        .has_core = false
++    },
++    {
++        .filename = "hailo/hailo8_fw_cfg.bin",
++        .address = 0x60001500,
++        .max_size = PCIE_HAILO8_FW_CFG_MAX_SIZE,
++        .is_mandatory = false,
++        .has_header = false,
++        .has_core = false
++    },
++    {
++        .filename = NULL,
++        .address = 0x00,
++        .max_size = 0x00,
++        .is_mandatory = false,
++        .has_header = false,
++        .has_core = false
++    }
++};
++
++static const struct hailo_file_batch hailo10h_legacy_files_stg1[] = {
++    {
++        .filename = "hailo/hailo15_fw.bin",
++        .address = 0x20000,
++        .max_size = 0x100000,
++        .is_mandatory = true,
++        .has_header = true,
++        .has_core = true
++    },
++    {
++        .filename = NULL,
++        .address = 0x00,
++        .max_size = 0x00,
++        .is_mandatory = false,
++        .has_header = false,
++        .has_core = false
++    }
++};
++
++static const struct hailo_file_batch pluto_files_stg1[] = {
++    {
++        .filename = "hailo/pluto_fw.bin",
++        .address = 0x20000,
++        .max_size = 0x100000,
++        .is_mandatory = true,
++        .has_header = true,
++        .has_core = true
++    },
++    {
++        .filename = NULL,
++        .address = 0x00,
++        .max_size = 0x00,
++        .is_mandatory = false,
++        .has_header = false,
++        .has_core = false
++    }
++};
++
+ static const struct hailo_board_compatibility compat[HAILO_BOARD_TYPE_COUNT] = {
+     [HAILO_BOARD_TYPE_HAILO8] = {
+         .fw_addresses = {
+             .boot_fw_header = 0xE0030,
+-            .boot_fw_trigger = 0xE0980,
+             .boot_key_cert = 0xE0048,
+             .boot_cont_cert = 0xE0390,
+             .app_fw_code_ram_base = 0x60000,
+@@ -155,22 +257,16 @@ static const struct hailo_board_compatib
+             .raise_ready_offset = 0x1684,
+             .boot_status = 0xe0000,
+         },
+-        .fw_filename = "hailo/hailo8_fw.bin",
+-        .board_cfg = {
+-            .filename = "hailo/hailo8_board_cfg.bin",
+-            .address = 0x60001000,
+-            .max_size = PCIE_HAILO8_BOARD_CFG_MAX_SIZE,
+-        },
+-        .fw_cfg = {
+-            .filename = "hailo/hailo8_fw_cfg.bin",
+-            .address = 0x60001500,
+-            .max_size = PCIE_HAILO8_FW_CFG_MAX_SIZE,
++        .stages = {
++            {
++                .batch = hailo8_files_stg1,
++                .trigger_address = 0xE0980
++            },
+         },
+     },
+     [HAILO_BOARD_TYPE_HAILO10H_LEGACY] = {
+         .fw_addresses = {
+             .boot_fw_header = 0x88000,
+-            .boot_fw_trigger = 0x88c98,
+             .boot_key_cert = 0x88018,
+             .boot_cont_cert = 0x886a8,
+             .app_fw_code_ram_base = 0x20000,
+@@ -180,22 +276,16 @@ static const struct hailo_board_compatib
+             .raise_ready_offset = 0x1754,
+             .boot_status = 0x80000,
+         },
+-        .fw_filename = "hailo/hailo15_fw.bin",
+-        .board_cfg = {
+-            .filename = NULL,
+-            .address = 0,
+-            .max_size = 0,
+-        },
+-        .fw_cfg = {
+-            .filename = NULL,
+-            .address = 0,
+-            .max_size = 0,
++        .stages = {
++            {
++                .batch = hailo10h_legacy_files_stg1,
++                .trigger_address = 0x88c98
++            },
+         },
+     },
+     [HAILO_BOARD_TYPE_HAILO10H] = {
+         .fw_addresses = {
+             .boot_fw_header = 0x88000,
+-            .boot_fw_trigger = 0x88c98,
+             .boot_key_cert = 0x88018,
+             .boot_cont_cert = 0x886a8,
+             .app_fw_code_ram_base = 0x20000,
+@@ -205,23 +295,18 @@ static const struct hailo_board_compatib
+             .raise_ready_offset = 0x1754,
+             .boot_status = 0x80000,
+         },
+-        .fw_filename = NULL,
+-        .board_cfg = {
+-            .filename = NULL,
+-            .address = 0,
+-            .max_size = 0,
+-        },
+-        .fw_cfg = {
+-            .filename = NULL,
+-            .address = 0,
+-            .max_size = 0,
+-        },
+         .stages = {
+             {
+                 .batch = hailo10h_files_stg1,
++                .trigger_address = 0x88c98
+             },
+             {
+                 .batch = hailo10h_files_stg2,
++                .trigger_address = 0x84000000
++            },
++            {
++                .batch = hailo10h_files_stg2_linux_in_emmc,
++                .trigger_address = 0x84000000
+             },
+         },
+     },
+@@ -230,7 +315,6 @@ static const struct hailo_board_compatib
+     [HAILO_BOARD_TYPE_PLUTO] = {
+         .fw_addresses = {
+             .boot_fw_header = 0x88000,
+-            .boot_fw_trigger = 0x88c98,
+             .boot_key_cert = 0x88018,
+             .boot_cont_cert = 0x886a8,
+             .app_fw_code_ram_base = 0x20000,
+@@ -241,16 +325,11 @@ static const struct hailo_board_compatib
+             .raise_ready_offset = 0x174c,
+             .boot_status = 0x80000,
+         },
+-        .fw_filename = "hailo/pluto_fw.bin",
+-        .board_cfg = {
+-            .filename = NULL,
+-            .address = 0,
+-            .max_size = 0,
+-        },
+-        .fw_cfg = {
+-            .filename = NULL,
+-            .address = 0,
+-            .max_size = 0,
++        .stages = {
++            {
++                .batch = pluto_files_stg1,
++                .trigger_address = 0x88c98
++            },
+         },
+     }
+ };
+@@ -340,21 +419,6 @@ void hailo_pcie_write_firmware_driver_sh
+     hailo_resource_write32(&resources->fw_access, fw_addresses->raise_ready_offset, fw_access_value);
+ }
+ 
+-int hailo_pcie_read_firmware_notification(struct hailo_pcie_resources *resources,
+-    struct hailo_d2h_notification *notification)
+-{
+-    struct hailo_resource notification_resource;
+-
+-    if (PCIE_D2H_NOTIFICATION_SRAM_OFFSET > resources->fw_access.size) {
+-        return -EINVAL;
+-    }
+-
+-    notification_resource.address = resources->fw_access.address + PCIE_D2H_NOTIFICATION_SRAM_OFFSET,
+-    notification_resource.size = sizeof(struct hailo_d2h_notification);
+-
+-    return hailo_read_firmware_notification(&notification_resource, notification);
+-}
+-
+ int hailo_pcie_configure_atr_table(struct hailo_resource *bridge_config, u64 trsl_addr, u32 atr_index)
+ {
+     size_t offset = 0;
+@@ -388,7 +452,7 @@ static void write_memory_chunk(struct ha
+     u32 ATR_INDEX = 0;
+     BUG_ON(dest_offset + len > (u32)resources->fw_access.size);
+ 
+-    (void)hailo_pcie_configure_atr_table(&resources->config, (u64)dest, ATR_INDEX);
++    (void)hailo_pcie_configure_atr_table(&resources->config, dest, ATR_INDEX);
+     (void)hailo_resource_write_buffer(&resources->fw_access, dest_offset, len, src);
+ }
+ 
+@@ -398,13 +462,13 @@ static void read_memory_chunk(
+     u32 ATR_INDEX = 0;
+     BUG_ON(src_offset + len > (u32)resources->fw_access.size);
+ 
+-    (void)hailo_pcie_configure_atr_table(&resources->config, (u64)src, ATR_INDEX);
++    (void)hailo_pcie_configure_atr_table(&resources->config, src, ATR_INDEX);
+     (void)hailo_resource_read_buffer(&resources->fw_access, src_offset, len, dest);
+ }
+ 
+ // Note: this function modify the device ATR table (that is also used by the firmware for control and vdma).
+ // Use with caution, and restore the original atr if needed.
+-void write_memory(struct hailo_pcie_resources *resources, hailo_ptr_t dest, const void *src, u32 len)
++static void write_memory(struct hailo_pcie_resources *resources, hailo_ptr_t dest, const void *src, u32 len)
+ {
+     struct hailo_atr_config previous_atr = {0};
+     hailo_ptr_t base_address = (dest & ~ATR_TABLE_SIZE_MASK);
+@@ -417,8 +481,8 @@ void write_memory(struct hailo_pcie_reso
+ 
+     if (base_address != dest) {
+         // Data is not aligned, write the first chunk
+-        chunk_len = min(base_address + ATR_TABLE_SIZE - dest, len);
+-        write_memory_chunk(resources, base_address, dest - base_address, src, chunk_len);
++        chunk_len = min((u32)(base_address + ATR_TABLE_SIZE - dest), len);
++        write_memory_chunk(resources, base_address, (u32)(dest - base_address), src, chunk_len);
+         offset += chunk_len;
+     }
+ 
+@@ -447,8 +511,8 @@ static void read_memory(struct hailo_pci
+ 
+     if (base_address != src) {
+         // Data is not aligned, write the first chunk
+-        chunk_len = min(base_address + ATR_TABLE_SIZE - src, len);
+-        read_memory_chunk(resources, base_address, src - base_address, dest, chunk_len);
++        chunk_len = min((u32)(base_address + ATR_TABLE_SIZE - src), len);
++        read_memory_chunk(resources, base_address, (u32)(src - base_address), dest, chunk_len);
+         offset += chunk_len;
+     }
+ 
+@@ -463,12 +527,12 @@ static void read_memory(struct hailo_pci
+ }
+ 
+ static void hailo_write_app_firmware(struct hailo_pcie_resources *resources, firmware_header_t *fw_header,
+-    secure_boot_certificate_t *fw_cert)
++    secure_boot_certificate_header_t *fw_cert)
+ {
+     const struct hailo_fw_addresses *fw_addresses = &(compat[resources->board_type].fw_addresses);
+-    void *fw_code = (void*)((u8*)fw_header + sizeof(firmware_header_t));
+-    void *key_data = &fw_cert->certificates_data[0];
+-    void *content_data = &fw_cert->certificates_data[fw_cert->key_size];
++    u8 *fw_code = ((u8*)fw_header + sizeof(firmware_header_t));
++    u8 *key_data = ((u8*)fw_cert + sizeof(secure_boot_certificate_header_t));
++    u8 *content_data = key_data + fw_cert->key_size;
+ 
+     write_memory(resources, fw_addresses->boot_fw_header, fw_header, sizeof(firmware_header_t));
+ 
+@@ -487,13 +551,11 @@ static void hailo_write_core_firmware(st
+     write_memory(resources, fw_addresses->core_fw_header, fw_header, sizeof(firmware_header_t));
+ }
+ 
+-void hailo_trigger_firmware_boot(struct hailo_pcie_resources *resources)
++void hailo_trigger_firmware_boot(struct hailo_pcie_resources *resources, u32 address)
+ {
+-    const struct hailo_fw_addresses *fw_addresses = &(compat[resources->board_type].fw_addresses);
+     u32 pcie_finished = 1;
+ 
+-    write_memory(resources, fw_addresses->boot_fw_trigger,
+-        (void*)&pcie_finished, sizeof(pcie_finished));
++    write_memory(resources, address, (void*)&pcie_finished, sizeof(pcie_finished));
+ }
+ 
+ u32 hailo_get_boot_status(struct hailo_pcie_resources *resources)
+@@ -501,8 +563,7 @@ u32 hailo_get_boot_status(struct hailo_p
+     u32 boot_status = 0;
+     const struct hailo_fw_addresses *fw_addresses = &(compat[resources->board_type].fw_addresses);
+ 
+-    read_memory(resources, fw_addresses->boot_status,
+-        &boot_status, sizeof(boot_status));
++    read_memory(resources, fw_addresses->boot_status, &boot_status, sizeof(boot_status));
+ 
+     return boot_status;
+ }
+@@ -517,11 +578,11 @@ u32 hailo_get_boot_status(struct hailo_p
+ */
+ static int FW_VALIDATION__validate_fw_headers(uintptr_t firmware_base_address, size_t firmware_size,
+     firmware_header_t **out_app_firmware_header, firmware_header_t **out_core_firmware_header,
+-    secure_boot_certificate_t **out_firmware_cert, enum hailo_board_type board_type)
++    secure_boot_certificate_header_t **out_firmware_cert, enum hailo_board_type board_type)
+ {
+     firmware_header_t *app_firmware_header = NULL;
+     firmware_header_t *core_firmware_header = NULL;
+-    secure_boot_certificate_t *firmware_cert = NULL;
++    secure_boot_certificate_header_t *firmware_cert = NULL;
+     int err = -EINVAL;
+     u32 consumed_firmware_offset = 0;
+ 
+@@ -571,25 +632,25 @@ exit:
+     return err;
+ }
+ 
+-static int write_single_file(struct hailo_pcie_resources *resources, const struct hailo_file_batch *files_batch, struct device *dev)
++static int write_single_file(struct hailo_pcie_resources *resources, const struct hailo_file_batch *file_info, struct device *dev)
+ {
+     const struct firmware *firmware = NULL;
+     firmware_header_t *app_firmware_header = NULL;
+-    secure_boot_certificate_t *firmware_cert = NULL;
++    secure_boot_certificate_header_t *firmware_cert = NULL;
+     firmware_header_t *core_firmware_header = NULL;
+     int err = 0;
+ 
+-    err = request_firmware_direct(&firmware, files_batch->filename, dev);
++    err = request_firmware_direct(&firmware, file_info->filename, dev);
+     if (err < 0) {
+         return err;
+     }
+ 
+-    if (firmware->size > files_batch->max_size) {
++    if (firmware->size > file_info->max_size) {
+         release_firmware(firmware);
+         return -EFBIG;
+     }
+ 
+-    if (files_batch->has_header) {
++    if (file_info->has_header) {
+         err = FW_VALIDATION__validate_fw_headers((uintptr_t)firmware->data, firmware->size,
+             &app_firmware_header, &core_firmware_header, &firmware_cert, resources->board_type);
+         if (err < 0) {
+@@ -598,8 +659,11 @@ static int write_single_file(struct hail
+         }
+ 
+         hailo_write_app_firmware(resources, app_firmware_header, firmware_cert);
++        if (file_info->has_core) {
++            hailo_write_core_firmware(resources, core_firmware_header);
++        }
+     } else {
+-        write_memory(resources, files_batch->address, (void*)firmware->data, firmware->size);
++        write_memory(resources, file_info->address, (void*)firmware->data, firmware->size);
+     }
+ 
+     release_firmware(firmware);
+@@ -632,25 +696,7 @@ int hailo_pcie_write_firmware_batch(stru
+         dev_notice(dev, "File %s written successfully\n", files_batch[file_index].filename);
+     }
+ 
+-    return 0;
+-}
+-
+-int hailo_pcie_write_firmware(struct hailo_pcie_resources *resources, const void *fw_data, size_t fw_size)
+-{
+-    firmware_header_t *app_firmware_header = NULL;
+-    secure_boot_certificate_t *firmware_cert = NULL;
+-    firmware_header_t *core_firmware_header = NULL;
+-
+-    int err = FW_VALIDATION__validate_fw_headers((uintptr_t)fw_data, fw_size,
+-        &app_firmware_header, &core_firmware_header, &firmware_cert, resources->board_type);
+-    if (err < 0) {
+-        return err;
+-    }
+-
+-    hailo_write_app_firmware(resources, app_firmware_header, firmware_cert);
+-    hailo_write_core_firmware(resources, core_firmware_header);
+-
+-    hailo_trigger_firmware_boot(resources);
++    hailo_trigger_firmware_boot(resources, compat[resources->board_type].stages[stage].trigger_address);
+ 
+     return 0;
+ }
+@@ -691,32 +737,6 @@ bool hailo_pcie_wait_for_firmware(struct
+     return false;
+ }
+ 
+-int hailo_pcie_write_config_common(struct hailo_pcie_resources *resources, const void* config_data,
+-    const size_t config_size, const struct hailo_config_constants *config_consts)
+-{
+-    if (config_size > config_consts->max_size) {
+-        return -EINVAL;
+-    }
+-
+-    write_memory(resources, config_consts->address, config_data, (u32)config_size);
+-    return 0;
+-}
+-
+-const struct hailo_config_constants* hailo_pcie_get_board_config_constants(const enum hailo_board_type board_type) {
+-    BUG_ON(board_type >= HAILO_BOARD_TYPE_COUNT || board_type < 0);
+-    return &compat[board_type].board_cfg;
+-}
+-
+-const struct hailo_config_constants* hailo_pcie_get_user_config_constants(const enum hailo_board_type board_type) {
+-    BUG_ON(board_type >= HAILO_BOARD_TYPE_COUNT || board_type < 0);
+-    return &compat[board_type].fw_cfg;
+-}
+-
+-const char* hailo_pcie_get_fw_filename(const enum hailo_board_type board_type) {
+-    BUG_ON(board_type >= HAILO_BOARD_TYPE_COUNT || board_type < 0);
+-    return compat[board_type].fw_filename;
+-}
+-
+ void hailo_pcie_update_channel_interrupts_mask(struct hailo_pcie_resources* resources, u32 channels_bitmap)
+ {
+     size_t i = 0;
+@@ -745,7 +765,7 @@ void hailo_pcie_enable_interrupts(struct
+     hailo_resource_write32(&resources->config, BCS_SOURCE_INTERRUPT_PER_CHANNEL, 0xFFFFFFFF);
+ 
+     mask |= (BCS_ISTATUS_HOST_FW_IRQ_CONTROL_MASK | BCS_ISTATUS_HOST_FW_IRQ_NOTIFICATION |
+-        BCS_ISTATUS_HOST_DRIVER_DOWN | BCS_ISTATUS_SOC_CONNECT_ACCEPTED);
++        BCS_ISTATUS_HOST_DRIVER_DOWN | BCS_ISTATUS_SOC_CONNECT_ACCEPTED | BCS_ISTATUS_SOC_CLOSED_IRQ);
+     hailo_resource_write32(&resources->config, BSC_IMASK_HOST, mask);
+ }
+ 
+@@ -754,45 +774,15 @@ void hailo_pcie_disable_interrupts(struc
+     hailo_resource_write32(&resources->config, BSC_IMASK_HOST, 0);
+ }
+ 
+-long hailo_pcie_read_firmware_log(struct hailo_pcie_resources *resources, struct hailo_read_log_params *params)
+-{
+-    long err = 0;
+-    struct hailo_resource log_resource = {resources->fw_access.address, DEBUG_BUFFER_TOTAL_SIZE};
+-
+-    if (HAILO_CPU_ID_CPU0 == params->cpu_id) {
+-        log_resource.address += PCIE_APP_CPU_DEBUG_OFFSET;
+-    } else if (HAILO_CPU_ID_CPU1 == params->cpu_id) {
+-        log_resource.address += PCIE_CORE_CPU_DEBUG_OFFSET;
+-    } else {
+-        return -EINVAL;
+-    }
+-
+-    if (0 == params->buffer_size) {
+-        params->read_bytes = 0;
+-        return 0;
+-    }
+-
+-    err = hailo_read_firmware_log(&log_resource, params);
+-    if (0 != err) {
+-        return err;
+-    }
+-
+-    return 0;
+-}
+-
+ static int direct_memory_transfer(struct hailo_pcie_resources *resources,
+     struct hailo_memory_transfer_params *params)
+ {
+-    if (params->address > U32_MAX) {
+-        return -EFAULT;
+-    }
+-
+     switch (params->transfer_direction) {
+     case TRANSFER_READ:
+-        read_memory(resources, (u32)params->address, params->buffer, (u32)params->count);
++        read_memory(resources, params->address, params->buffer, (u32)params->count);
+         break;
+     case TRANSFER_WRITE:
+-        write_memory(resources, (u32)params->address, params->buffer, (u32)params->count);
++        write_memory(resources, params->address, params->buffer, (u32)params->count);
+         break;
+     default:
+         return -EINVAL;
+@@ -845,16 +835,18 @@ int hailo_set_device_type(struct hailo_p
+     return 0;
+ }
+ 
+-// On PCIe, just return the address
+-static u64 encode_dma_address(dma_addr_t dma_address, u8 channel_id)
++// On PCIe, just return the start address
++u64 hailo_pcie_encode_desc_dma_address_range(dma_addr_t dma_address_start, dma_addr_t dma_address_end, u32 step, u8 channel_id)
+ {
+     (void)channel_id;
+-    return (u64)dma_address;
++    (void)dma_address_end;
++    (void)step;
++    return (u64)dma_address_start;
+ }
+ 
+ struct hailo_vdma_hw hailo_pcie_vdma_hw = {
+     .hw_ops = {
+-        .encode_desc_dma_address = encode_dma_address
++        .encode_desc_dma_address_range = hailo_pcie_encode_desc_dma_address_range,
+     },
+     .ddr_data_id = HAILO_PCIE_HOST_DMA_DATA_ID,
+     .device_interrupts_bitmask = HAILO_PCIE_DMA_DEVICE_INTERRUPTS_BITMASK,
+@@ -862,11 +854,19 @@ struct hailo_vdma_hw hailo_pcie_vdma_hw
+     .src_channels_bitmask = HAILO_PCIE_DMA_SRC_CHANNELS_BITMASK,
+ };
+ 
+-void hailo_soc_write_soc_connect(struct hailo_pcie_resources *resources)
++void hailo_pcie_soc_write_request(struct hailo_pcie_resources *resources,
++    const struct hailo_pcie_soc_request *request)
+ {
+     const struct hailo_fw_addresses *fw_addresses = &(compat[resources->board_type].fw_addresses);
+-    const u32 soc_connect_value = FW_ACCESS_SOC_CONNECT_MASK;
++    BUILD_BUG_ON_MSG((sizeof(*request) % sizeof(u32)) != 0, "Request must be a multiple of 4 bytes");
+ 
+-    // Write shutdown flag to FW
+-    hailo_resource_write32(&resources->fw_access, fw_addresses->raise_ready_offset, soc_connect_value);
+-}
+\ No newline at end of file
++    hailo_resource_write_buffer(&resources->fw_access, 0, sizeof(*request), (void*)request);
++    hailo_resource_write32(&resources->fw_access, fw_addresses->raise_ready_offset, FW_ACCESS_SOC_CONTROL_MASK);
++}
++
++void hailo_pcie_soc_read_response(struct hailo_pcie_resources *resources,
++    struct hailo_pcie_soc_response *response)
++{
++    BUILD_BUG_ON_MSG((sizeof(*response) % sizeof(u32)) != 0, "Request must be a multiple of 4 bytes");
++    hailo_resource_read_buffer(&resources->fw_access, 0, sizeof(*response), response);
++}
+--- a/drivers/media/pci/hailo/common/pcie_common.h
++++ b/drivers/media/pci/hailo/common/pcie_common.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: MIT
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _HAILO_COMMON_PCIE_COMMON_H_
+@@ -12,6 +12,7 @@
+ #include "fw_operation.h"
+ #include "utils.h"
+ #include "vdma_common.h"
++#include "soc_structs.h"
+ 
+ #include <linux/types.h>
+ #include <linux/firmware.h>
+@@ -21,6 +22,7 @@
+ #define BCS_ISTATUS_HOST_FW_IRQ_NOTIFICATION (0x02000000)
+ #define BCS_ISTATUS_HOST_DRIVER_DOWN         (0x08000000)
+ #define BCS_ISTATUS_SOC_CONNECT_ACCEPTED     (0x10000000)
++#define BCS_ISTATUS_SOC_CLOSED_IRQ           (0x20000000)
+ #define BCS_ISTATUS_HOST_VDMA_SRC_IRQ_MASK   (0x000000FF)
+ #define BCS_ISTATUS_HOST_VDMA_DEST_IRQ_MASK  (0x0000FF00)
+ 
+@@ -42,7 +44,7 @@
+ #define PCI_DEVICE_ID_HAILO_HAILO15   0x45C4
+ #define PCI_DEVICE_ID_HAILO_PLUTO     0x43a2
+ 
+-typedef u32 hailo_ptr_t;
++typedef u64 hailo_ptr_t;
+ 
+ struct hailo_pcie_resources {
+     struct hailo_resource config;               // BAR0
+@@ -63,7 +65,8 @@ struct hailo_atr_config {
+ enum loading_stages {
+     FIRST_STAGE = 0,
+     SECOND_STAGE = 1,
+-    MAX_LOADING_STAGES = 2
++    SECOND_STAGE_LINUX_IN_EMMC = 2,
++    MAX_LOADING_STAGES = 3
+ };
+ 
+ enum hailo_pcie_interrupt_masks {
+@@ -71,6 +74,7 @@ enum hailo_pcie_interrupt_masks {
+     FW_NOTIFICATION = BCS_ISTATUS_HOST_FW_IRQ_NOTIFICATION,
+     DRIVER_DOWN = BCS_ISTATUS_HOST_DRIVER_DOWN,
+     SOC_CONNECT_ACCEPTED = BCS_ISTATUS_SOC_CONNECT_ACCEPTED,
++    SOC_CLOSED_IRQ = BCS_ISTATUS_SOC_CLOSED_IRQ,
+     VDMA_SRC_IRQ_MASK = BCS_ISTATUS_HOST_VDMA_SRC_IRQ_MASK,
+     VDMA_DEST_IRQ_MASK = BCS_ISTATUS_HOST_VDMA_DEST_IRQ_MASK
+ };
+@@ -80,18 +84,13 @@ struct hailo_pcie_interrupt_source {
+     u32 vdma_channels_bitmap;
+ };
+ 
+-struct hailo_config_constants {
+-    const char *filename;
+-    u32 address;
+-    size_t max_size;
+-};
+-
+ struct hailo_file_batch {
+     const char *filename;
+     u32 address;
+     size_t max_size;
+     bool is_mandatory;
+     bool has_header;
++    bool has_core;
+ };
+ 
+ // TODO: HRT-6144 - Align Windows/Linux to QNX
+@@ -130,27 +129,15 @@ void hailo_pcie_disable_interrupts(struc
+ int hailo_pcie_write_firmware_control(struct hailo_pcie_resources *resources, const struct hailo_fw_control *command);
+ int hailo_pcie_read_firmware_control(struct hailo_pcie_resources *resources, struct hailo_fw_control *command);
+ 
+-int hailo_pcie_write_firmware(struct hailo_pcie_resources *resources, const void *fw_data, size_t fw_size);
+ int hailo_pcie_write_firmware_batch(struct device *dev, struct hailo_pcie_resources *resources, u32 stage);
+ bool hailo_pcie_is_firmware_loaded(struct hailo_pcie_resources *resources);
+ bool hailo_pcie_wait_for_firmware(struct hailo_pcie_resources *resources);
+ 
+-int hailo_pcie_read_firmware_notification(struct hailo_pcie_resources *resources,
+-    struct hailo_d2h_notification *notification);
+-
+-int hailo_pcie_write_config_common(struct hailo_pcie_resources *resources, const void* config_data,
+-    const size_t config_size, const struct hailo_config_constants *config_consts);
+-const struct hailo_config_constants* hailo_pcie_get_board_config_constants(const enum hailo_board_type board_type);
+-const struct hailo_config_constants* hailo_pcie_get_user_config_constants(const enum hailo_board_type board_type);
+-const char* hailo_pcie_get_fw_filename(const enum hailo_board_type board_type);
+-
+-long hailo_pcie_read_firmware_log(struct hailo_pcie_resources *resources, struct hailo_read_log_params *params);
+ int hailo_pcie_memory_transfer(struct hailo_pcie_resources *resources, struct hailo_memory_transfer_params *params);
+ 
+ bool hailo_pcie_is_device_connected(struct hailo_pcie_resources *resources);
+ void hailo_pcie_write_firmware_driver_shutdown(struct hailo_pcie_resources *resources);
+-void write_memory(struct hailo_pcie_resources *resources, hailo_ptr_t dest, const void *src, u32 len);
+-void hailo_trigger_firmware_boot(struct hailo_pcie_resources *resources);
++void hailo_trigger_firmware_boot(struct hailo_pcie_resources *resources, u32 address);
+ 
+ int hailo_set_device_type(struct hailo_pcie_resources *resources);
+ 
+@@ -159,7 +146,12 @@ u32 hailo_get_boot_status(struct hailo_p
+ int hailo_pcie_configure_atr_table(struct hailo_resource *bridge_config, u64 trsl_addr, u32 atr_index);
+ void hailo_pcie_read_atr_table(struct hailo_resource *bridge_config, struct hailo_atr_config *atr, u32 atr_index);
+ 
+-void hailo_soc_write_soc_connect(struct hailo_pcie_resources *resources);
++u64 hailo_pcie_encode_desc_dma_address_range(dma_addr_t dma_address_start, dma_addr_t dma_address_end, u32 step, u8 channel_id);
++
++void hailo_pcie_soc_write_request(struct hailo_pcie_resources *resources,
++    const struct hailo_pcie_soc_request *request);
++void hailo_pcie_soc_read_response(struct hailo_pcie_resources *resources,
++    struct hailo_pcie_soc_response *response);
+ 
+ #ifdef __cplusplus
+ }
+--- /dev/null
++++ b/drivers/media/pci/hailo/common/soc_structs.h
+@@ -0,0 +1,79 @@
++// SPDX-License-Identifier: MIT
++/**
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
++ **/
++/**
++ * Contains definitions for pcie soc to pcie ep communication
++ */
++
++#ifndef __HAILO_COMMON_SOC_STRUCTS__
++#define __HAILO_COMMON_SOC_STRUCTS__
++
++#include <linux/types.h>
++
++#pragma pack(push, 1)
++
++struct hailo_pcie_soc_connect_request {
++    u16 port;
++};
++
++struct hailo_pcie_soc_connect_response {
++    u8 input_channel_index;
++    u8 output_channel_index;
++};
++
++
++struct hailo_pcie_soc_close_request {
++    u32 channels_bitmap;
++};
++
++struct hailo_pcie_soc_close_response {
++    u8 reserved;
++};
++
++enum hailo_pcie_soc_control_code {
++    // Start from big initial value to ensure the right code was used (using 0
++    // as initiale may cause confusion if the code was not set correctly).
++    HAILO_PCIE_SOC_CONTROL_CODE_CONNECT = 0x100,
++    HAILO_PCIE_SOC_CONTROL_CODE_CLOSE,
++    HAILO_PCIE_SOC_CONTROL_CODE_INVALID,
++};
++
++#define HAILO_PCIE_SOC_MAX_REQUEST_SIZE_BYTES  (16)
++#define HAILO_PCIE_SOC_MAX_RESPONSE_SIZE_BYTES (16)
++
++// IRQ to signal the PCIe that the EP was closed/released
++#define PCI_EP_SOC_CLOSED_IRQ       (0x00000020)
++#define PCI_EP_SOC_CONNECT_RESPONSE (0x00000010)
++
++struct hailo_pcie_soc_request {
++    u32 control_code;
++    union {
++        struct hailo_pcie_soc_connect_request connect;
++        struct hailo_pcie_soc_close_request close;
++        u8 pad[HAILO_PCIE_SOC_MAX_REQUEST_SIZE_BYTES];
++    };
++};
++
++struct hailo_pcie_soc_response {
++    u32 control_code;
++    s32 status;
++    union {
++        struct hailo_pcie_soc_connect_response connect;
++        struct hailo_pcie_soc_close_response close;
++        u8 pad[HAILO_PCIE_SOC_MAX_RESPONSE_SIZE_BYTES];
++    };
++};
++
++#pragma pack(pop)
++
++// Compile time validate function. Don't need to call it.
++static inline void __validate_soc_struct_sizes(void)
++{
++    BUILD_BUG_ON_MSG(sizeof(struct hailo_pcie_soc_request) !=
++        sizeof(u32) + HAILO_PCIE_SOC_MAX_REQUEST_SIZE_BYTES, "Invalid request size");
++    BUILD_BUG_ON_MSG(sizeof(struct hailo_pcie_soc_response) !=
++        sizeof(u32) + sizeof(s32) + HAILO_PCIE_SOC_MAX_RESPONSE_SIZE_BYTES, "Invalid response size");
++}
++
++#endif /* __HAILO_COMMON_SOC_STRUCTS__ */
+\ No newline at end of file
+--- a/drivers/media/pci/hailo/common/utils.h
++++ b/drivers/media/pci/hailo/common/utils.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: MIT
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _HAILO_DRIVER_UTILS_H_
+@@ -8,6 +8,11 @@
+ 
+ #include <linux/bitops.h>
+ 
++#define DWORD_SIZE                  (4)
++#define WORD_SIZE                   (2)
++#define BYTE_SIZE                   (1)
++#define BITS_IN_BYTE                (8)
++
+ #define hailo_clear_bit(bit, pval)  { *(pval) &= ~(1 << bit); }
+ #define hailo_test_bit(pos,var_addr)  ((*var_addr) & (1<<(pos)))
+ 
+@@ -50,6 +55,22 @@ static inline uint8_t ceil_log2(uint32_t
+     return result;
+ }
+ 
++// Gets the nearest power of 2 >= value, for any value <= MAX_POWER_OF_2_VALUE. Otherwise POWER_OF_2_ERROR is returned.
++#define MAX_POWER_OF_2_VALUE (0x80000000)
++#define POWER_OF_2_ERROR ((uint32_t)-1)
++static inline uint32_t get_nearest_powerof_2(uint32_t value)
++{
++    uint32_t power_of_2 = 1;
++    if (value > MAX_POWER_OF_2_VALUE) {
++        return POWER_OF_2_ERROR;
++    }
++
++    while (value > power_of_2) {
++        power_of_2 <<=  1;
++    }
++    return power_of_2;
++}
++
+ #ifndef DIV_ROUND_UP
+ #define DIV_ROUND_UP(n,d) (((n) + (d) - 1) / (d))
+ #endif
+--- a/drivers/media/pci/hailo/common/vdma_common.c
++++ b/drivers/media/pci/hailo/common/vdma_common.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: MIT
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #include "vdma_common.h"
+@@ -62,11 +62,6 @@
+ #define VDMA_CHANNEL_NUM_PROCESSED_MASK ((1 << VDMA_CHANNEL_NUM_PROCESSED_WIDTH) - 1)
+ #define VDMA_CHANNEL_NUM_ONGOING_MASK VDMA_CHANNEL_NUM_PROCESSED_MASK
+ 
+-#define DWORD_SIZE                  (4)
+-#define WORD_SIZE                   (2)
+-#define BYTE_SIZE                   (1)
+-#define BITS_IN_BYTE                (8)
+-
+ #define TIMESTAMPS_CIRC_SPACE(timestamp_list) \
+     CIRC_SPACE((timestamp_list).head, (timestamp_list).tail, CHANNEL_IRQ_TIMESTAMPS_SIZE)
+ #define TIMESTAMPS_CIRC_CNT(timestamp_list) \
+@@ -150,7 +145,7 @@ static bool validate_last_desc_status(st
+     return true;
+ }
+ 
+-void hailo_vdma_program_descriptor(struct hailo_vdma_descriptor *descriptor, u64 dma_address, size_t page_size,
++static void hailo_vdma_program_descriptor(struct hailo_vdma_descriptor *descriptor, u64 dma_address, size_t page_size,
+     u8 data_id)
+ {
+     descriptor->PageSize_DescControl = (u32)((page_size << DESCRIPTOR_PAGE_SIZE_SHIFT) +
+@@ -174,33 +169,45 @@ static int program_descriptors_in_chunk(
+     u32 max_desc_index,
+     u8 channel_id)
+ {
+-    const u32 desc_per_chunk = DIV_ROUND_UP(chunk_size, desc_list->desc_page_size);
++    const u16 page_size = desc_list->desc_page_size;
++    const u8 ddr_data_id = vdma_hw->ddr_data_id;
++    const u32 descs_to_program = DIV_ROUND_UP(chunk_size, page_size);
++    const u32 starting_desc_index = desc_index;
++    const u32 residue_size = chunk_size % page_size;
+     struct hailo_vdma_descriptor *dma_desc = NULL;
+-    u16 size_to_program = 0;
+-    u32 index = 0;
+     u64 encoded_addr = 0;
+ 
+-    for (index = 0; index < desc_per_chunk; index++) {
+-        if (desc_index > max_desc_index) {
+-            return -ERANGE;
+-        }
+-
+-        encoded_addr = vdma_hw->hw_ops.encode_desc_dma_address(chunk_addr, channel_id);
+-        if (INVALID_VDMA_ADDRESS == encoded_addr) {
+-            return -EFAULT;
+-        }
++    if (descs_to_program == 0) {
++        // Nothing to program
++        return 0;
++    }
+ 
+-        dma_desc = &desc_list->desc_list[desc_index % desc_list->desc_count];
+-        size_to_program = chunk_size > desc_list->desc_page_size ?
+-            desc_list->desc_page_size : (u16)chunk_size;
+-        hailo_vdma_program_descriptor(dma_desc, encoded_addr, size_to_program, vdma_hw->ddr_data_id);
++    // We iterate through descriptors [desc_index, desc_index + descs_to_program)
++    if (desc_index + descs_to_program > max_desc_index + 1) {
++        return -ERANGE;
++    }
+ 
+-        chunk_addr += size_to_program;
+-        chunk_size -= size_to_program;
+-        desc_index++;
++    encoded_addr = vdma_hw->hw_ops.encode_desc_dma_address_range(chunk_addr, chunk_addr + chunk_size, page_size, channel_id);
++    if (INVALID_VDMA_ADDRESS == encoded_addr) {
++        return -EFAULT;
+     }
+ 
+-    return (int)desc_per_chunk;
++    // Program all descriptors except the last one
++    for (desc_index = starting_desc_index; desc_index < starting_desc_index + descs_to_program - 1; desc_index++) {
++        // 'desc_index & desc_list_len_mask' is used instead of modulo; see hailo_vdma_descriptors_list documentation.
++        hailo_vdma_program_descriptor(
++            &desc_list->desc_list[desc_index & desc_list->desc_count_mask],
++            encoded_addr, page_size, ddr_data_id);
++        encoded_addr += page_size;
++    }
++
++    // Handle the last descriptor outside of the loop
++    // 'desc_index & desc_list_len_mask' is used instead of modulo; see hailo_vdma_descriptors_list documentation.
++    dma_desc = &desc_list->desc_list[desc_index & desc_list->desc_count_mask];
++    hailo_vdma_program_descriptor(dma_desc, encoded_addr,
++        (residue_size == 0) ? page_size : (u16)residue_size, ddr_data_id);
++
++    return (int)descs_to_program;
+ }
+ 
+ static unsigned long get_interrupts_bitmask(struct hailo_vdma_hw *vdma_hw,
+@@ -236,11 +243,11 @@ static int bind_and_program_descriptors_
+ {
+     const u8 channel_id = get_channel_id(channel_index);
+     int desc_programmed = 0;
++    int descs_programmed_in_chunk = 0;
+     u32 max_desc_index = 0;
+     u32 chunk_size = 0;
+     struct scatterlist *sg_entry = NULL;
+     unsigned int i = 0;
+-    int ret = 0;
+     size_t buffer_current_offset = 0;
+     dma_addr_t chunk_start_addr = 0;
+     u32 program_size = buffer->size;
+@@ -272,14 +279,14 @@ static int bind_and_program_descriptors_
+             (u32)(sg_dma_len(sg_entry));
+         chunk_size = min((u32)program_size, chunk_size);
+ 
+-        ret = program_descriptors_in_chunk(vdma_hw, chunk_start_addr, chunk_size, desc_list,
++        descs_programmed_in_chunk  = program_descriptors_in_chunk(vdma_hw, chunk_start_addr, chunk_size, desc_list,
+             starting_desc, max_desc_index, channel_id);
+-        if (ret < 0) {
+-            return ret;
++        if (descs_programmed_in_chunk < 0) {
++            return descs_programmed_in_chunk;
+         }
+ 
+-        desc_programmed += ret;
+-        starting_desc = starting_desc + ret;
++        desc_programmed += descs_programmed_in_chunk;
++        starting_desc = starting_desc + descs_programmed_in_chunk;
+         program_size -= chunk_size;
+         buffer_current_offset += sg_dma_len(sg_entry);
+     }
+@@ -583,21 +590,23 @@ void hailo_vdma_engine_disable_channels(
+     engine->enabled_channels &= ~bitmap;
+ 
+     for_each_vdma_channel(engine, channel, channel_index) {
+-        channel_state_init(&channel->state);
++        if (hailo_test_bit(channel_index, &bitmap)) {
++            channel_state_init(&channel->state);
+ 
+-        while (ONGOING_TRANSFERS_CIRC_CNT(channel->ongoing_transfers) > 0) {
+-            struct hailo_ongoing_transfer transfer;
+-            ongoing_transfer_pop(channel, &transfer);
+-
+-            if (channel->last_desc_list == NULL) {
+-                pr_err("Channel %d has ongoing transfers but no desc list\n", channel->index);
+-                continue;
++            while (ONGOING_TRANSFERS_CIRC_CNT(channel->ongoing_transfers) > 0) {
++                struct hailo_ongoing_transfer transfer;
++                ongoing_transfer_pop(channel, &transfer);
++
++                if (channel->last_desc_list == NULL) {
++                    pr_err("Channel %d has ongoing transfers but no desc list\n", channel->index);
++                    continue;
++                }
++
++                clear_dirty_descs(channel, &transfer);
+             }
+ 
+-            clear_dirty_descs(channel, &transfer);
++            channel->last_desc_list = NULL;
+         }
+-
+-        channel->last_desc_list = NULL;
+     }
+ }
+ 
+--- a/drivers/media/pci/hailo/common/vdma_common.h
++++ b/drivers/media/pci/hailo/common/vdma_common.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: MIT
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _HAILO_COMMON_VDMA_COMMON_H_
+@@ -30,7 +30,13 @@ struct hailo_vdma_descriptor {
+ 
+ struct hailo_vdma_descriptors_list {
+     struct hailo_vdma_descriptor *desc_list;
+-    u32                           desc_count;  // Must be power of 2 if is_circular is set.
++    // Must be power of 2 if is_circular is set.
++    u32                           desc_count;
++    // The nearest power of 2 to desc_count (including desc_count), minus 1.
++    // * If the list is circular, then 'index & desc_count_mask' can be used instead of modulo.
++    // * Otherwise, we can't wrap around the list anyway. However, for any index < desc_count, 'index & desc_count_mask'
++    //   will return the same value.
++    u32                           desc_count_mask;
+     u16                           desc_page_size;
+     bool                          is_circular;
+ };
+@@ -113,9 +119,10 @@ struct hailo_vdma_engine {
+ };
+ 
+ struct hailo_vdma_hw_ops {
+-    // Accepts some dma_addr_t mapped to the device and encodes it using
+-    // hw specific encode. returns INVALID_VDMA_ADDRESS on failure.
+-    u64 (*encode_desc_dma_address)(dma_addr_t dma_address, u8 channel_id);
++    // Accepts start, end and step of an address range (of type  dma_addr_t).
++    // Returns the encoded base address or INVALID_VDMA_ADDRESS if the range/step is invalid.
++    // All addresses in the range of [returned_addr, returned_addr + step, returned_addr + 2*step, ..., dma_address_end) are valid.
++    u64 (*encode_desc_dma_address_range)(dma_addr_t dma_address_start, dma_addr_t dma_address_end, u32 step, u8 channel_id);
+ };
+ 
+ struct hailo_vdma_hw {
+@@ -136,12 +143,9 @@ struct hailo_vdma_hw {
+     for (index = 0, element = &array[index]; index < size; index++, element = &array[index])
+ 
+ #define for_each_vdma_channel(engine, channel, channel_index) \
+-    _for_each_element_array(engine->channels, MAX_VDMA_CHANNELS_PER_ENGINE,   \
++    _for_each_element_array((engine)->channels, MAX_VDMA_CHANNELS_PER_ENGINE,   \
+         channel, channel_index)
+ 
+-void hailo_vdma_program_descriptor(struct hailo_vdma_descriptor *descriptor, u64 dma_address, size_t page_size,
+-    u8 data_id);
+-
+ /**
+  * Program the given descriptors list to map the given buffer.
+  *
+--- a/drivers/media/pci/hailo/src/fops.c
++++ b/drivers/media/pci/hailo/src/fops.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #include <linux/version.h>
+@@ -19,14 +19,14 @@
+ #include <linux/sched/signal.h>
+ #endif
+ 
+-#include "utils.h"
+ #include "fops.h"
+ #include "vdma_common.h"
+ #include "utils/logs.h"
+ #include "vdma/memory.h"
+ #include "vdma/ioctl.h"
+ #include "utils/compact.h"
+-#include "pci_soc_ioctl.h"
++#include "nnc.h"
++#include "soc.h"
+ 
+ 
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION( 4, 13, 0 )
+@@ -48,13 +48,6 @@
+ // On pcie driver there is only one dma engine
+ #define DEFAULT_VDMA_ENGINE_INDEX       (0)
+ 
+-#if !defined(HAILO_EMULATOR)
+-#define DEFAULT_SHUTDOWN_TIMEOUT_MS (5)
+-#else /* !defined(HAILO_EMULATOR) */
+-#define DEFAULT_SHUTDOWN_TIMEOUT_MS (1000)
+-#endif /* !defined(HAILO_EMULATOR) */
+-
+-static long hailo_add_notification_wait(struct hailo_pcie_board *board, struct file *filp);
+ 
+ static struct hailo_file_context *create_file_context(struct hailo_pcie_board *board, struct file *filp)
+ {
+@@ -124,7 +117,7 @@ int hailo_pcie_fops_open(struct inode *i
+ 
+     previous_power_state = pBoard->pDev->current_state;
+     if (PCI_D0 != previous_power_state) {
+-        hailo_info(pBoard, "Waking up board");
++        hailo_info(pBoard, "Waking up board change state from %d to PCI_D0\n", previous_power_state);
+         err = pci_set_power_state(pBoard->pDev, PCI_D0);
+         if (err < 0) {
+             hailo_err(pBoard, "Failed waking up board %d", err);
+@@ -148,7 +141,11 @@ int hailo_pcie_fops_open(struct inode *i
+         interrupts_enabled_by_filp = true;
+     }
+ 
+-    err = hailo_add_notification_wait(pBoard, filp);
++    if (pBoard->pcie_resources.accelerator_type == HAILO_ACCELERATOR_TYPE_NNC) {
++        err = hailo_nnc_file_context_init(pBoard, context);
++    } else {
++        err = hailo_soc_file_context_init(pBoard, context);
++    }
+     if (err < 0) {
+         goto l_release_irq;
+     }
+@@ -166,6 +163,7 @@ l_release_irq:
+ 
+ l_revert_power_state:
+     if (pBoard->pDev->current_state != previous_power_state) {
++        hailo_info(pBoard, "Power changing state from %d to %d\n", previous_power_state, pBoard->pDev->current_state);
+         if (pci_set_power_state(pBoard->pDev, previous_power_state) < 0) {
+             hailo_err(pBoard, "Failed setting power state back to %d\n", (int)previous_power_state);
+         }
+@@ -180,34 +178,6 @@ l_exit:
+     return err;
+ }
+ 
+-int hailo_pcie_driver_down(struct hailo_pcie_board *board)
+-{
+-    long completion_result = 0;
+-    int err = 0;
+-
+-    reinit_completion(&board->driver_down.reset_completed);
+-
+-    hailo_pcie_write_firmware_driver_shutdown(&board->pcie_resources);
+-
+-    // Wait for response
+-    completion_result =
+-        wait_for_completion_timeout(&board->driver_down.reset_completed, msecs_to_jiffies(DEFAULT_SHUTDOWN_TIMEOUT_MS));
+-    if (completion_result <= 0) {
+-        if (0 == completion_result) {
+-            hailo_err(board, "hailo_pcie_driver_down, timeout waiting for shutdown response (timeout_ms=%d)\n", DEFAULT_SHUTDOWN_TIMEOUT_MS);
+-            err = -ETIMEDOUT;
+-        } else {
+-            hailo_info(board, "hailo_pcie_driver_down, wait for completion failed with err=%ld (process was interrupted or killed)\n",
+-                completion_result);
+-            err = completion_result;
+-        }
+-        goto l_exit;
+-    }
+-
+-l_exit:
+-    return err;
+-}
+-
+ int hailo_pcie_fops_release(struct inode *inode, struct file *filp)
+ {
+     struct hailo_pcie_board *board = (struct hailo_pcie_board *)filp->private_data;
+@@ -234,12 +204,10 @@ int hailo_pcie_fops_release(struct inode
+             hailo_err(board, "Invalid file context\n");
+         }
+ 
+-        hailo_pcie_clear_notification_wait_list(board, filp);
+-
+-        if (filp == board->vdma.used_by_filp) {
+-            if (hailo_pcie_driver_down(board)) {
+-                hailo_err(board, "Failed sending FW shutdown event");
+-            }
++        if (board->pcie_resources.accelerator_type == HAILO_ACCELERATOR_TYPE_NNC) {
++            hailo_nnc_file_context_finalize(board, context);
++        } else {
++            hailo_soc_file_context_finalize(board, context);
+         }
+ 
+         hailo_vdma_file_context_finalize(&context->vdma_context, &board->vdma, filp);
+@@ -250,6 +218,7 @@ int hailo_pcie_fops_release(struct inode
+             hailo_disable_interrupts(board);
+ 
+             if (power_mode_enabled()) {
++                hailo_info(board, "Power change state to PCI_D3hot\n");
+                 if (board->pDev && pci_set_power_state(board->pDev, PCI_D3hot) < 0) {
+                     hailo_err(board, "Failed setting power state to D3hot");
+                 }
+@@ -301,44 +270,23 @@ static long hailo_memory_transfer_ioctl(
+     return err;
+ }
+ 
+-static long hailo_read_log_ioctl(struct hailo_pcie_board *pBoard, unsigned long arg)
+-{
+-    long err = 0;
+-    struct hailo_read_log_params params;
+-
+-    if (copy_from_user(&params, (void __user*)arg, sizeof(params))) {
+-        hailo_err(pBoard, "HAILO_READ_LOG, copy_from_user fail\n");
+-        return -ENOMEM;
+-    }
+-
+-    if (0 > (err = hailo_pcie_read_firmware_log(&pBoard->pcie_resources, &params))) {
+-        hailo_err(pBoard, "HAILO_READ_LOG, reading from log failed with error: %ld \n", err);
+-        return err;
+-    }
+-
+-    if (copy_to_user((void*)arg, &params, sizeof(params))) {
+-        return -ENOMEM;
+-    }
+-
+-    return 0;
+-}
+-
+ static void firmware_notification_irq_handler(struct hailo_pcie_board *board)
+ {
+     struct hailo_notification_wait *notif_wait_cursor = NULL;
+     int err = 0;
+     unsigned long irq_saved_flags = 0;
+ 
+-    spin_lock_irqsave(&board->notification_read_spinlock, irq_saved_flags);
+-    err = hailo_pcie_read_firmware_notification(&board->pcie_resources, &board->notification_cache);
+-    spin_unlock_irqrestore(&board->notification_read_spinlock, irq_saved_flags);
++    spin_lock_irqsave(&board->nnc.notification_read_spinlock, irq_saved_flags);
++    err = hailo_pcie_read_firmware_notification(&board->pcie_resources.fw_access, &board->nnc.notification_cache);
++    spin_unlock_irqrestore(&board->nnc.notification_read_spinlock, irq_saved_flags);
+ 
+     if (err < 0) {
+         hailo_err(board, "Failed reading firmware notification");
+     }
+     else {
++        // TODO: HRT-14502 move interrupt handling to nnc
+         rcu_read_lock();
+-        list_for_each_entry_rcu(notif_wait_cursor, &board->notification_wait_list, notification_wait_list)
++        list_for_each_entry_rcu(notif_wait_cursor, &board->nnc.notification_wait_list, notification_wait_list)
+         {
+             complete(&notif_wait_cursor->notification_completion);
+         }
+@@ -374,7 +322,7 @@ irqreturn_t hailo_irqhandler(int irq, vo
+ 
+         // wake fw_control if needed
+         if (irq_source.interrupt_bitmask & FW_CONTROL) {
+-            complete(&board->fw_control.completion);
++            complete(&board->nnc.fw_control.completion);
+         }
+ 
+         // wake driver_down if needed
+@@ -392,7 +340,14 @@ irqreturn_t hailo_irqhandler(int irq, vo
+         }
+ 
+         if (irq_source.interrupt_bitmask & SOC_CONNECT_ACCEPTED) {
+-            complete_all(&board->soc_connect_accepted);
++            complete_all(&board->soc.control_resp_ready);
++        }
++
++        if (irq_source.interrupt_bitmask & SOC_CLOSED_IRQ) {
++            hailo_info(board, "hailo_irqhandler - SOC_CLOSED_IRQ\n");
++            // always use bitmap=0xFFFFFFFF - it is ok to wake all interrupts since each handler will check if the stream was aborted or not. 
++            hailo_vdma_wakeup_interrupts(&board->vdma, &board->vdma.vdma_engines[DEFAULT_VDMA_ENGINE_INDEX],
++                0xFFFFFFFF);
+         }
+ 
+         if (0 != irq_source.vdma_channels_bitmap) {
+@@ -404,170 +359,11 @@ irqreturn_t hailo_irqhandler(int irq, vo
+     return return_value;
+ }
+ 
+-static long hailo_get_notification_wait_thread(struct hailo_pcie_board *pBoard, struct file *filp,
+-    struct hailo_notification_wait **current_waiting_thread)
+-{
+-    struct hailo_notification_wait *cursor = NULL;
+-    // note: safe to access without rcu because the notification_wait_list is closed only on file release
+-    list_for_each_entry(cursor, &pBoard->notification_wait_list, notification_wait_list)
+-    {
+-        if ((current->tgid == cursor->tgid) && (filp == cursor->filp)) {
+-            *current_waiting_thread = cursor;
+-            return 0;
+-        }
+-    }
+-
+-    return -EFAULT;
+-}
+-
+-static long hailo_add_notification_wait(struct hailo_pcie_board *board, struct file *filp)
+-{
+-    struct hailo_notification_wait *new_notification_wait = NULL;
+-    if (!(new_notification_wait = kmalloc(sizeof(*new_notification_wait), GFP_KERNEL))) {
+-        hailo_err(board, "Failed to allocate notification wait structure.\n");
+-        return -ENOMEM;
+-    }
+-    new_notification_wait->tgid = current->tgid;
+-    new_notification_wait->filp = filp;
+-    new_notification_wait->is_disabled = false;
+-    init_completion(&new_notification_wait->notification_completion);
+-    list_add_rcu(&new_notification_wait->notification_wait_list, &board->notification_wait_list);
+-    return 0;
+-}
+-
+-static long hailo_read_notification_ioctl(struct hailo_pcie_board *pBoard, unsigned long arg, struct file *filp,
+-    bool* should_up_board_mutex)
+-{
+-    long err = 0;
+-    struct hailo_notification_wait *current_waiting_thread = NULL;
+-    struct hailo_d2h_notification *notification = &pBoard->notification_to_user;
+-    unsigned long irq_saved_flags;
+-
+-    err = hailo_get_notification_wait_thread(pBoard, filp, &current_waiting_thread);
+-    if (0 != err) {
+-        goto l_exit;
+-    }
+-    up(&pBoard->mutex);
+-
+-    if (0 > (err = wait_for_completion_interruptible(&current_waiting_thread->notification_completion))) {
+-        hailo_info(pBoard,
+-            "HAILO_READ_NOTIFICATION - wait_for_completion_interruptible error. err=%ld. tgid=%d (process was interrupted or killed)\n",
+-            err, current_waiting_thread->tgid);
+-        *should_up_board_mutex = false;
+-        goto l_exit;
+-    }
+-
+-    if (down_interruptible(&pBoard->mutex)) {
+-        hailo_info(pBoard, "HAILO_READ_NOTIFICATION - down_interruptible error (process was interrupted or killed)\n");
+-        *should_up_board_mutex = false;
+-        err = -ERESTARTSYS;
+-        goto l_exit;
+-    }
+-
+-    // Check if was disabled
+-    if (current_waiting_thread->is_disabled) {
+-        hailo_info(pBoard, "HAILO_READ_NOTIFICATION, can't find notification wait for tgid=%d\n", current->tgid);
+-        err = -EINVAL;
+-        goto l_exit;
+-    }
+-
+-    reinit_completion(&current_waiting_thread->notification_completion);
+-    
+-    spin_lock_irqsave(&pBoard->notification_read_spinlock, irq_saved_flags);
+-    notification->buffer_len = pBoard->notification_cache.buffer_len;
+-    memcpy(notification->buffer, pBoard->notification_cache.buffer, notification->buffer_len);
+-    spin_unlock_irqrestore(&pBoard->notification_read_spinlock, irq_saved_flags);
+-
+-    if (copy_to_user((void __user*)arg, notification, sizeof(*notification))) {
+-        hailo_err(pBoard, "HAILO_READ_NOTIFICATION copy_to_user fail\n");
+-        err = -ENOMEM;
+-        goto l_exit;
+-    }
+-
+-l_exit:
+-    return err;
+-}
+-
+-static long hailo_disable_notification(struct hailo_pcie_board *pBoard, struct file *filp)
+-{
+-    struct hailo_notification_wait *cursor = NULL;
+-
+-    hailo_info(pBoard, "HAILO_DISABLE_NOTIFICATION: disable notification");
+-    rcu_read_lock();
+-    list_for_each_entry_rcu(cursor, &pBoard->notification_wait_list, notification_wait_list) {
+-        if ((current->tgid == cursor->tgid) && (filp == cursor->filp)) {
+-            cursor->is_disabled = true;
+-            complete(&cursor->notification_completion);
+-            break;
+-        }
+-    }
+-    rcu_read_unlock();
+-
+-    return 0;
+-}
+-
+-static int hailo_fw_control(struct hailo_pcie_board *pBoard, unsigned long arg, bool* should_up_board_mutex)
+-{
+-    struct hailo_fw_control *command = &pBoard->fw_control.command;
+-    long completion_result = 0;
+-    int err = 0;
+-
+-    up(&pBoard->mutex);
+-    *should_up_board_mutex = false;
+-
+-    if (down_interruptible(&pBoard->fw_control.mutex)) {
+-        hailo_info(pBoard, "hailo_fw_control down_interruptible fail tgid:%d (process was interrupted or killed)\n", current->tgid);
+-        return -ERESTARTSYS;
+-    }
+-
+-    if (copy_from_user(command, (void __user*)arg, sizeof(*command))) {
+-        hailo_err(pBoard, "hailo_fw_control, copy_from_user fail\n");
+-        err = -ENOMEM;
+-        goto l_exit;
+-    }
+-
+-    reinit_completion(&pBoard->fw_control.completion);
+-
+-    err = hailo_pcie_write_firmware_control(&pBoard->pcie_resources, command);
+-    if (err < 0) {
+-        hailo_err(pBoard, "Failed writing fw control to pcie\n");
+-        goto l_exit;
+-    }
+-
+-    // Wait for response
+-    completion_result = wait_for_completion_interruptible_timeout(&pBoard->fw_control.completion, msecs_to_jiffies(command->timeout_ms));
+-    if (completion_result <= 0) {
+-        if (0 == completion_result) {
+-            hailo_err(pBoard, "hailo_fw_control, timeout waiting for control (timeout_ms=%d)\n", command->timeout_ms);
+-            err = -ETIMEDOUT;
+-        } else {
+-            hailo_info(pBoard, "hailo_fw_control, wait for completion failed with err=%ld (process was interrupted or killed)\n", completion_result);
+-            err = -EINTR;
+-        }
+-        goto l_exit;
+-    }
+-
+-    err = hailo_pcie_read_firmware_control(&pBoard->pcie_resources, command);
+-    if (err < 0) {
+-        hailo_err(pBoard, "Failed reading fw control from pcie\n");
+-        goto l_exit;
+-    }
+-
+-    if (copy_to_user((void __user*)arg, command, sizeof(*command))) {
+-        hailo_err(pBoard, "hailo_fw_control, copy_to_user fail\n");
+-        err = -ENOMEM;
+-        goto l_exit;
+-    }
+-
+-l_exit:
+-    up(&pBoard->fw_control.mutex);
+-    return err;
+-}
+-
+ static long hailo_query_device_properties(struct hailo_pcie_board *board, unsigned long arg)
+ {
+     struct hailo_device_properties props = {
+         .desc_max_page_size = board->desc_max_page_size,
++        .board_type = board->pcie_resources.board_type,
+         .allocation_mode = board->allocation_mode,
+         .dma_type = HAILO_DMA_TYPE_PCIE,
+         .dma_engines_count = board->vdma.vdma_engines_count,
+@@ -618,24 +414,6 @@ static long hailo_general_ioctl(struct h
+     }
+ }
+ 
+-static long hailo_nnc_ioctl(struct hailo_pcie_board *board, unsigned int cmd, unsigned long arg,
+-    struct file *filp, bool *should_up_board_mutex)
+-{
+-    switch (cmd) {
+-    case HAILO_FW_CONTROL:
+-        return hailo_fw_control(board, arg, should_up_board_mutex);
+-    case HAILO_READ_NOTIFICATION:
+-        return hailo_read_notification_ioctl(board, arg, filp, should_up_board_mutex);
+-    case HAILO_DISABLE_NOTIFICATION:
+-        return hailo_disable_notification(board, filp);
+-    case HAILO_READ_LOG:
+-        return hailo_read_log_ioctl(board, arg);
+-    default:
+-        hailo_err(board, "Invalid nnc ioctl code 0x%x (nr: %d)\n", cmd, _IOC_NR(cmd));
+-        return -ENOTTY;
+-    }
+-}
+-
+ long hailo_pcie_fops_unlockedioctl(struct file* filp, unsigned int cmd, unsigned long arg)
+ {
+     long err = 0;
+@@ -694,7 +472,7 @@ long hailo_pcie_fops_unlockedioctl(struc
+             hailo_err(board, "Ioctl %d is not supported on this accelerator type\n", _IOC_TYPE(cmd));
+             err = -EINVAL;
+         } else {
+-            err = hailo_soc_ioctl(board, &context->vdma_context, &board->vdma, cmd, arg);
++            err = hailo_soc_ioctl(board, context, &board->vdma, cmd, arg);
+         }
+         break;
+     case HAILO_NNC_IOCTL_MAGIC:
+--- a/drivers/media/pci/hailo/src/fops.h
++++ b/drivers/media/pci/hailo/src/fops.h
+@@ -1,16 +1,17 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _HAILO_PCI_FOPS_H_
+ #define _HAILO_PCI_FOPS_H_
+ 
++#include "pcie.h"
++
+ int hailo_pcie_fops_open(struct inode* inode, struct file* filp);
+ int hailo_pcie_fops_release(struct inode* inode, struct file* filp);
+ long hailo_pcie_fops_unlockedioctl(struct file* filp, unsigned int cmd, unsigned long arg);
+ int hailo_pcie_fops_mmap(struct file* filp, struct vm_area_struct *vma);
+-int hailo_pcie_driver_down(struct hailo_pcie_board *board);
+ void hailo_pcie_ep_init(struct hailo_pcie_board *board);
+ 
+ #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,22)
+--- /dev/null
++++ b/drivers/media/pci/hailo/src/nnc.c
+@@ -0,0 +1,299 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
++ **/
++/**
++ * A Hailo PCIe NNC device is a device contains a NNC (neural network core) and some basic FW.
++ * The device supports sending controls, receiving notification and reading the FW log.
++ */
++
++#include "nnc.h"
++#include "hailo_ioctl_common.h"
++
++#include "utils/logs.h"
++#include "utils/compact.h"
++
++#include <linux/uaccess.h>
++
++#if !defined(HAILO_EMULATOR)
++#define DEFAULT_SHUTDOWN_TIMEOUT_MS (5)
++#else /* !defined(HAILO_EMULATOR) */
++#define DEFAULT_SHUTDOWN_TIMEOUT_MS (1000)
++#endif /* !defined(HAILO_EMULATOR) */
++
++void hailo_nnc_init(struct hailo_pcie_nnc *nnc)
++{
++    sema_init(&nnc->fw_control.mutex, 1);
++    spin_lock_init(&nnc->notification_read_spinlock);
++    init_completion(&nnc->fw_control.completion);
++    INIT_LIST_HEAD(&nnc->notification_wait_list);
++    memset(&nnc->notification_cache, 0, sizeof(nnc->notification_cache));
++}
++
++void hailo_nnc_finalize(struct hailo_pcie_nnc *nnc)
++{
++    struct hailo_notification_wait *cursor = NULL;
++
++    // Lock rcu_read_lock and send notification_completion to wake anyone waiting on the notification_wait_list when removed
++    rcu_read_lock();
++    list_for_each_entry_rcu(cursor, &nnc->notification_wait_list, notification_wait_list) {
++        cursor->is_disabled = true;
++        complete(&cursor->notification_completion);
++    }
++    rcu_read_unlock();
++}
++
++static int hailo_fw_control(struct hailo_pcie_board *board, unsigned long arg, bool* should_up_board_mutex)
++{
++    struct hailo_fw_control *command = &board->nnc.fw_control.command;
++    long completion_result = 0;
++    int err = 0;
++
++    up(&board->mutex);
++    *should_up_board_mutex = false;
++
++    if (down_interruptible(&board->nnc.fw_control.mutex)) {
++        hailo_info(board, "hailo_fw_control down_interruptible fail tgid:%d (process was interrupted or killed)\n", current->tgid);
++        return -ERESTARTSYS;
++    }
++
++    if (copy_from_user(command, (void __user*)arg, sizeof(*command))) {
++        hailo_err(board, "hailo_fw_control, copy_from_user fail\n");
++        err = -ENOMEM;
++        goto l_exit;
++    }
++
++    reinit_completion(&board->nnc.fw_control.completion);
++
++    err = hailo_pcie_write_firmware_control(&board->pcie_resources, command);
++    if (err < 0) {
++        hailo_err(board, "Failed writing fw control to pcie\n");
++        goto l_exit;
++    }
++
++    // Wait for response
++    completion_result = wait_for_completion_interruptible_timeout(&board->nnc.fw_control.completion, msecs_to_jiffies(command->timeout_ms));
++    if (completion_result <= 0) {
++        if (0 == completion_result) {
++            hailo_err(board, "hailo_fw_control, timeout waiting for control (timeout_ms=%d)\n", command->timeout_ms);
++            err = -ETIMEDOUT;
++        } else {
++            hailo_info(board, "hailo_fw_control, wait for completion failed with err=%ld (process was interrupted or killed)\n", completion_result);
++            err = -EINTR;
++        }
++        goto l_exit;
++    }
++
++    err = hailo_pcie_read_firmware_control(&board->pcie_resources, command);
++    if (err < 0) {
++        hailo_err(board, "Failed reading fw control from pcie\n");
++        goto l_exit;
++    }
++
++    if (copy_to_user((void __user*)arg, command, sizeof(*command))) {
++        hailo_err(board, "hailo_fw_control, copy_to_user fail\n");
++        err = -ENOMEM;
++        goto l_exit;
++    }
++
++l_exit:
++    up(&board->nnc.fw_control.mutex);
++    return err;
++}
++
++static long hailo_get_notification_wait_thread(struct hailo_pcie_board *board, struct file *filp,
++    struct hailo_notification_wait **current_waiting_thread)
++{
++    struct hailo_notification_wait *cursor = NULL;
++    // note: safe to access without rcu because the notification_wait_list is closed only on file release
++    list_for_each_entry(cursor, &board->nnc.notification_wait_list, notification_wait_list)
++    {
++        if ((current->tgid == cursor->tgid) && (filp == cursor->filp)) {
++            *current_waiting_thread = cursor;
++            return 0;
++        }
++    }
++
++    return -EFAULT;
++}
++
++static long hailo_read_notification_ioctl(struct hailo_pcie_board *board, unsigned long arg, struct file *filp,
++    bool* should_up_board_mutex)
++{
++    long err = 0;
++    struct hailo_notification_wait *current_waiting_thread = NULL;
++    struct hailo_d2h_notification *notification = &board->nnc.notification_to_user;
++    unsigned long irq_saved_flags;
++
++    err = hailo_get_notification_wait_thread(board, filp, &current_waiting_thread);
++    if (0 != err) {
++        goto l_exit;
++    }
++    up(&board->mutex);
++
++    if (0 > (err = wait_for_completion_interruptible(&current_waiting_thread->notification_completion))) {
++        hailo_info(board,
++            "HAILO_READ_NOTIFICATION - wait_for_completion_interruptible error. err=%ld. tgid=%d (process was interrupted or killed)\n",
++            err, current_waiting_thread->tgid);
++        *should_up_board_mutex = false;
++        goto l_exit;
++    }
++
++    if (down_interruptible(&board->mutex)) {
++        hailo_info(board, "HAILO_READ_NOTIFICATION - down_interruptible error (process was interrupted or killed)\n");
++        *should_up_board_mutex = false;
++        err = -ERESTARTSYS;
++        goto l_exit;
++    }
++
++    // Check if was disabled
++    if (current_waiting_thread->is_disabled) {
++        hailo_info(board, "HAILO_READ_NOTIFICATION, can't find notification wait for tgid=%d\n", current->tgid);
++        err = -EINVAL;
++        goto l_exit;
++    }
++
++    reinit_completion(&current_waiting_thread->notification_completion);
++
++    spin_lock_irqsave(&board->nnc.notification_read_spinlock, irq_saved_flags);
++    notification->buffer_len = board->nnc.notification_cache.buffer_len;
++    memcpy(notification->buffer, board->nnc.notification_cache.buffer, notification->buffer_len);
++    spin_unlock_irqrestore(&board->nnc.notification_read_spinlock, irq_saved_flags);
++
++    if (copy_to_user((void __user*)arg, notification, sizeof(*notification))) {
++        hailo_err(board, "HAILO_READ_NOTIFICATION copy_to_user fail\n");
++        err = -ENOMEM;
++        goto l_exit;
++    }
++
++l_exit:
++    return err;
++}
++
++static long hailo_disable_notification(struct hailo_pcie_board *board, struct file *filp)
++{
++    struct hailo_notification_wait *cursor = NULL;
++
++    hailo_info(board, "HAILO_DISABLE_NOTIFICATION: disable notification");
++    rcu_read_lock();
++    list_for_each_entry_rcu(cursor, &board->nnc.notification_wait_list, notification_wait_list) {
++        if ((current->tgid == cursor->tgid) && (filp == cursor->filp)) {
++            cursor->is_disabled = true;
++            complete(&cursor->notification_completion);
++            break;
++        }
++    }
++    rcu_read_unlock();
++
++    return 0;
++}
++
++static long hailo_read_log_ioctl(struct hailo_pcie_board *board, unsigned long arg)
++{
++    long err = 0;
++    struct hailo_read_log_params params;
++
++    if (copy_from_user(&params, (void __user*)arg, sizeof(params))) {
++        hailo_err(board, "HAILO_READ_LOG, copy_from_user fail\n");
++        return -ENOMEM;
++    }
++
++    if (0 > (err = hailo_pcie_read_firmware_log(&board->pcie_resources.fw_access, &params))) {
++        hailo_err(board, "HAILO_READ_LOG, reading from log failed with error: %ld \n", err);
++        return err;
++    }
++
++    if (copy_to_user((void*)arg, &params, sizeof(params))) {
++        return -ENOMEM;
++    }
++
++    return 0;
++}
++
++long hailo_nnc_ioctl(struct hailo_pcie_board *board, unsigned int cmd, unsigned long arg,
++    struct file *filp, bool *should_up_board_mutex)
++{
++    switch (cmd) {
++    case HAILO_FW_CONTROL:
++        return hailo_fw_control(board, arg, should_up_board_mutex);
++    case HAILO_READ_NOTIFICATION:
++        return hailo_read_notification_ioctl(board, arg, filp, should_up_board_mutex);
++    case HAILO_DISABLE_NOTIFICATION:
++        return hailo_disable_notification(board, filp);
++    case HAILO_READ_LOG:
++        return hailo_read_log_ioctl(board, arg);
++    default:
++        hailo_err(board, "Invalid nnc ioctl code 0x%x (nr: %d)\n", cmd, _IOC_NR(cmd));
++        return -ENOTTY;
++    }
++}
++
++
++static int add_notification_wait(struct hailo_pcie_board *board, struct file *filp)
++{
++    struct hailo_notification_wait *wait = kmalloc(sizeof(*wait), GFP_KERNEL);
++    if (!wait) {
++        hailo_err(board, "Failed to allocate notification wait structure.\n");
++        return -ENOMEM;
++    }
++    wait->tgid = current->tgid;
++    wait->filp = filp;
++    wait->is_disabled = false;
++    init_completion(&wait->notification_completion);
++    list_add_rcu(&wait->notification_wait_list, &board->nnc.notification_wait_list);
++    return 0;
++}
++
++int hailo_nnc_file_context_init(struct hailo_pcie_board *board, struct hailo_file_context *context)
++{
++    return add_notification_wait(board, context->filp);
++}
++
++static void clear_notification_wait_list(struct hailo_pcie_board *board, struct file *filp)
++{
++    struct hailo_notification_wait *cur = NULL, *next = NULL;
++    list_for_each_entry_safe(cur, next, &board->nnc.notification_wait_list, notification_wait_list) {
++        if (cur->filp == filp) {
++            list_del_rcu(&cur->notification_wait_list);
++            synchronize_rcu();
++            kfree(cur);
++        }
++    }
++}
++
++int hailo_nnc_driver_down(struct hailo_pcie_board *board)
++{
++    long completion_result = 0;
++    int err = 0;
++
++    reinit_completion(&board->driver_down.reset_completed);
++
++    hailo_pcie_write_firmware_driver_shutdown(&board->pcie_resources);
++
++    // Wait for response
++    completion_result =
++        wait_for_completion_timeout(&board->driver_down.reset_completed, msecs_to_jiffies(DEFAULT_SHUTDOWN_TIMEOUT_MS));
++    if (completion_result <= 0) {
++        if (0 == completion_result) {
++            hailo_err(board, "hailo_nnc_driver_down, timeout waiting for shutdown response (timeout_ms=%d)\n", DEFAULT_SHUTDOWN_TIMEOUT_MS);
++            err = -ETIMEDOUT;
++        } else {
++            hailo_info(board, "hailo_nnc_driver_down, wait for completion failed with err=%ld (process was interrupted or killed)\n",
++                completion_result);
++            err = completion_result;
++        }
++        goto l_exit;
++    }
++
++l_exit:
++    return err;
++}
++
++void hailo_nnc_file_context_finalize(struct hailo_pcie_board *board, struct hailo_file_context *context)
++{
++    clear_notification_wait_list(board, context->filp);
++
++    if (context->filp == board->vdma.used_by_filp) {
++        hailo_nnc_driver_down(board);
++    }
++}
+\ No newline at end of file
+--- /dev/null
++++ b/drivers/media/pci/hailo/src/nnc.h
+@@ -0,0 +1,22 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#ifndef _HAILO_PCI_NNC_H_
++#define _HAILO_PCI_NNC_H_
++
++#include "pcie.h"
++
++void hailo_nnc_init(struct hailo_pcie_nnc *nnc);
++void hailo_nnc_finalize(struct hailo_pcie_nnc *nnc);
++
++long hailo_nnc_ioctl(struct hailo_pcie_board *board, unsigned int cmd, unsigned long arg,
++    struct file *filp, bool *should_up_board_mutex);
++
++int hailo_nnc_file_context_init(struct hailo_pcie_board *board, struct hailo_file_context *context);
++void hailo_nnc_file_context_finalize(struct hailo_pcie_board *board, struct hailo_file_context *context);
++
++int hailo_nnc_driver_down(struct hailo_pcie_board *board);
++
++#endif /* _HAILO_PCI_NNC_H_ */
+\ No newline at end of file
+--- a/drivers/media/pci/hailo/src/pci_soc_ioctl.c
++++ /dev/null
+@@ -1,155 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/**
+- * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+- **/
+-#include "pci_soc_ioctl.h"
+-
+-#include "utils.h"
+-#include "vdma_common.h"
+-#include "utils/logs.h"
+-#include "vdma/memory.h"
+-
+-#define PCI_SOC_VDMA_ENGINE_INDEX           (0)
+-#define PCI_SOC_WAIT_FOR_CONNECT_TIMEOUT_MS (10000)
+-
+-long hailo_soc_ioctl(struct hailo_pcie_board *board, struct hailo_vdma_file_context *context,
+-    struct hailo_vdma_controller *controller, unsigned int cmd, unsigned long arg)
+-{
+-    switch (cmd) {
+-    case HAILO_SOC_CONNECT:
+-        return hailo_soc_connect_ioctl(board, context, controller, arg);
+-    case HAILO_SOC_CLOSE:
+-        return hailo_soc_close_ioctl(board, controller, arg);
+-    default:
+-        hailo_err(board, "Invalid pcie EP ioctl code 0x%x (nr: %d)\n", cmd, _IOC_NR(cmd));
+-        return -ENOTTY;
+-    }
+-}
+-
+-long hailo_soc_connect_ioctl(struct hailo_pcie_board *board, struct hailo_vdma_file_context *context,
+-    struct hailo_vdma_controller *controller, unsigned long arg)
+-{
+-    struct hailo_soc_connect_params params;
+-    struct hailo_vdma_channel *input_channel = NULL;
+-    struct hailo_vdma_channel *output_channel = NULL;
+-    struct hailo_vdma_engine *vdma_engine = NULL;
+-    struct hailo_descriptors_list_buffer *input_descriptors_buffer = NULL;
+-    struct hailo_descriptors_list_buffer *output_descriptors_buffer = NULL;
+-    uint8_t depth = 0;
+-    int err = 0;
+-    long completion_result = 0;
+-
+-    if (copy_from_user(&params, (void *)arg, sizeof(params))) {
+-        hailo_err(board, "copy_from_user fail\n");
+-        return -ENOMEM;
+-    }
+-
+-    // TODO: have pci_ep choose the channel indexes the soc will use - for now use 0 and 16
+-    params.input_channel_index = 0;
+-    params.output_channel_index = 16;
+-
+-    reinit_completion(&board->soc_connect_accepted);
+-    hailo_soc_write_soc_connect(&board->pcie_resources);
+-
+-    // Wait for completion
+-    completion_result = wait_for_completion_interruptible_timeout(&board->soc_connect_accepted,
+-        msecs_to_jiffies(PCI_SOC_WAIT_FOR_CONNECT_TIMEOUT_MS));
+-    if (0 > completion_result) {
+-        if (0 == completion_result) {
+-            hailo_err(board, "Timeout waiting for connect to be accepted (timeout_ms=%d)\n", PCI_SOC_WAIT_FOR_CONNECT_TIMEOUT_MS);
+-            return -ETIMEDOUT;
+-        } else {
+-            hailo_info(board, "soc connect failed with err=%ld (process was interrupted or killed)\n",
+-                completion_result);
+-            return -EINTR;
+-        }
+-    }
+-
+-    vdma_engine = &controller->vdma_engines[PCI_SOC_VDMA_ENGINE_INDEX];
+-    input_channel = &vdma_engine->channels[params.input_channel_index];
+-    output_channel = &vdma_engine->channels[params.output_channel_index];
+-
+-    input_descriptors_buffer = hailo_vdma_find_descriptors_buffer(context, params.input_desc_handle);
+-    output_descriptors_buffer = hailo_vdma_find_descriptors_buffer(context, params.output_desc_handle);
+-    if (NULL == input_descriptors_buffer || NULL == output_descriptors_buffer) {
+-        hailo_dev_err(&board->pDev->dev, "input / output descriptors buffer not found \n");
+-        return -EINVAL;
+-    }
+-
+-    // Make sure channels that we are accepting are not already enabled
+-    if (0 != (vdma_engine->enabled_channels & params.input_channel_index) ||
+-        0 != (vdma_engine->enabled_channels & params.output_channel_index)) {
+-        hailo_dev_err(&board->pDev->dev, "Trying to accept already enabled channels\n");
+-        return -EINVAL;
+-    }
+-
+-    if (!is_powerof2((size_t)input_descriptors_buffer->desc_list.desc_count) ||
+-        !is_powerof2((size_t)output_descriptors_buffer->desc_list.desc_count)) {
+-        hailo_dev_err(&board->pDev->dev, "Invalid desc list size\n");
+-        return -EINVAL;
+-    }
+-
+-    // configure and start input channel
+-    depth = ceil_log2(input_descriptors_buffer->desc_list.desc_count);
+-    // DMA Direction is only to get channel index - so 
+-    err = hailo_vdma_start_channel(input_channel->host_regs, input_descriptors_buffer->dma_address, depth,
+-        board->vdma.hw->ddr_data_id);
+-    if (err < 0) {
+-        hailo_dev_err(&board->pDev->dev, "Error starting vdma input channel index %u\n", params.input_channel_index);
+-        return -EINVAL;
+-    }
+-    
+-    // configure and start output channel
+-    depth = ceil_log2(output_descriptors_buffer->desc_list.desc_count);
+-    // DMA Direction is only to get channel index - so 
+-    err = hailo_vdma_start_channel(output_channel->host_regs, output_descriptors_buffer->dma_address, depth,
+-        board->vdma.hw->ddr_data_id);
+-    if (err < 0) {
+-        hailo_dev_err(&board->pDev->dev, "Error starting vdma output channel index %u\n", params.output_channel_index);
+-        // Close input channel
+-        hailo_vdma_stop_channel(input_channel->host_regs);
+-        return -EINVAL;
+-    }
+-
+-    if (copy_to_user((void *)arg, &params, sizeof(params))) {
+-        hailo_dev_err(&board->pDev->dev, "copy_to_user fail\n");
+-        return -ENOMEM;
+-    }
+-
+-    return 0;
+-}
+-
+-long hailo_soc_close_ioctl(struct hailo_pcie_board *board, struct hailo_vdma_controller *controller, unsigned long arg)
+-{
+-    struct hailo_soc_close_params params;
+-    struct hailo_vdma_channel *input_channel = NULL;
+-    struct hailo_vdma_channel *output_channel = NULL;
+-    struct hailo_vdma_engine *vdma_engine = NULL;
+-
+-    if (copy_from_user(&params, (void *)arg, sizeof(params))) {
+-        hailo_dev_err(&board->pDev->dev, "copy_from_user fail\n");
+-        return -ENOMEM;
+-    }
+-
+-    vdma_engine = &controller->vdma_engines[PCI_SOC_VDMA_ENGINE_INDEX];
+-
+-    if (!hailo_check_channel_index(params.input_channel_index, controller->hw->src_channels_bitmask, true)) {
+-        hailo_dev_err(&board->pDev->dev, "Invalid input channel index %u\n", params.input_channel_index);
+-        return -EINVAL;
+-    }
+-
+-    if (!hailo_check_channel_index(params.output_channel_index, controller->hw->src_channels_bitmask, false)) {
+-        hailo_dev_err(&board->pDev->dev, "Invalid output channel index %u\n", params.output_channel_index);
+-        return -EINVAL;
+-    }
+-
+-    input_channel = &vdma_engine->channels[params.input_channel_index];
+-    output_channel = &vdma_engine->channels[params.output_channel_index];
+-
+-    // Close channels
+-    hailo_vdma_stop_channel(input_channel->host_regs);
+-    hailo_vdma_stop_channel(output_channel->host_regs);
+-
+-    hailo_pcie_write_firmware_driver_shutdown(&board->pcie_resources);
+-    return 0;
+-}
+\ No newline at end of file
+--- a/drivers/media/pci/hailo/src/pcie.c
++++ b/drivers/media/pci/hailo/src/pcie.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #include <linux/version.h>
+@@ -22,6 +22,8 @@
+ 
+ #include "hailo_ioctl_common.h"
+ #include "pcie.h"
++#include "nnc.h"
++#include "soc.h"
+ #include "fops.h"
+ #include "sysfs.h"
+ #include "utils/logs.h"
+@@ -40,11 +42,12 @@ enum hailo_allocate_driver_buffer_driver
+     HAILO_FORCE_BUFFER_FROM_DRIVER = 2,
+ };
+ 
+-//Debug flag
++// Debug flag
+ static int force_desc_page_size = 0;
+ static bool g_is_power_mode_enabled = true;
+ static int force_allocation_from_driver = HAILO_NO_FORCE_BUFFER;
+ static bool force_hailo15_legacy_mode = false;
++static bool force_boot_linux_from_eemc = false;
+ 
+ #define DEVICE_NODE_NAME "hailo"
+ static int char_major = 0;
+@@ -206,7 +209,7 @@ static int hailo_pcie_disable_aspm(struc
+     /* Double-check ASPM control.  If not disabled by the above, the
+      * BIOS is preventing that from happening (or CONFIG_PCIEASPM is
+      * not enabled); override by writing PCI config space directly.
+-     */                       
++     */
+     err = pcie_capability_read_word(pdev, PCI_EXP_LNKCTL, &pdev_aspmc);
+     if (err < 0) {
+         hailo_err(board, "Couldn't read LNKCTL capability\n");
+@@ -288,101 +291,59 @@ static void hailo_pcie_remove_board(stru
+     up(&g_hailo_add_board_mutex);
+ }
+ 
+-static int hailo_write_config(struct hailo_pcie_resources *resources, struct device *dev,
+-    const struct hailo_config_constants *config_consts)
+-{
+-    const struct firmware *config = NULL;
+-    int err = 0;
+-
+-    if (NULL == config_consts->filename) {
+-        // Config not supported for platform
+-        return 0;
+-    }
+-
+-    err = request_firmware_direct(&config, config_consts->filename, dev);
+-    if (err < 0) {
+-        hailo_dev_info(dev, "Config %s not found\n", config_consts->filename);
+-        return 0;
+-    }
+-
+-    hailo_dev_notice(dev, "Writing config %s\n", config_consts->filename);
+-
+-    err = hailo_pcie_write_config_common(resources, config->data, config->size, config_consts);
+-    if (err < 0) {
+-        if (-EINVAL == err) {
+-            hailo_dev_warn(dev, "Config size %zu is bigger than max %zu\n", config->size, config_consts->max_size);
+-        }
+-        release_firmware(config);
+-        return err;
+-    }
+-
+-    release_firmware(config);
+-    return 0;
+-}
+-
+ static bool wait_for_firmware_completion(struct completion *fw_load_completion)
+ {
+     return (0 != wait_for_completion_timeout(fw_load_completion, msecs_to_jiffies(FIRMWARE_WAIT_TIMEOUT_MS)));
+ }
+ 
+-static int hailo_load_firmware(struct hailo_pcie_resources *resources,
++static int hailo_load_soc_firmware(struct hailo_pcie_resources *resources,
+     struct device *dev, struct completion *fw_load_completion)
+ {
+-    const struct firmware *firmware = NULL;
+-    int err = 0;
+     u32 boot_status = 0;
++    int err = 0;
++    u32 second_stage = force_boot_linux_from_eemc ? SECOND_STAGE_LINUX_IN_EMMC : SECOND_STAGE;
+ 
+     if (hailo_pcie_is_firmware_loaded(resources)) {
+-        hailo_dev_warn(dev, "Firmware was already loaded\n");
++        hailo_dev_warn(dev, "Firmware batch was already loaded\n");
+         return 0;
+     }
+ 
+-    reinit_completion(fw_load_completion);
+-
+-    err = hailo_write_config(resources, dev, hailo_pcie_get_board_config_constants(resources->board_type));
+-    if (err < 0) {
+-        hailo_dev_err(dev, "Failed writing board config");
+-        return err;
+-    }
++    init_completion(fw_load_completion);
+ 
+-    err = hailo_write_config(resources, dev, hailo_pcie_get_user_config_constants(resources->board_type));
++    err = hailo_pcie_write_firmware_batch(dev, resources, FIRST_STAGE);
+     if (err < 0) {
+-        hailo_dev_err(dev, "Failed writing fw config");
++        hailo_dev_err(dev, "Failed writing firmware files. err %d\n", err);
+         return err;
+     }
+ 
+-    // read firmware file
+-    err = request_firmware_direct(&firmware, hailo_pcie_get_fw_filename(resources->board_type), dev);
+-    if (err < 0) {
+-        hailo_dev_warn(dev, "Firmware file not found (/lib/firmware/%s), please upload the firmware manually \n",
+-            hailo_pcie_get_fw_filename(resources->board_type));
+-        return 0;
++    if (!wait_for_firmware_completion(fw_load_completion)) {
++        boot_status = hailo_get_boot_status(resources);
++        hailo_dev_err(dev, "Timeout waiting for firmware file, boot status %u\n", boot_status);
++        return -ETIMEDOUT;
+     }
++    reinit_completion(fw_load_completion);
+ 
+-    err = hailo_pcie_write_firmware(resources, firmware->data, firmware->size);
++    err = hailo_pcie_write_firmware_batch(dev, resources, second_stage);
+     if (err < 0) {
+-        hailo_dev_err(dev, "Failed writing firmware. err %d\n", err);
+-        release_firmware(firmware);
++        hailo_dev_err(dev, "Failed writing firmware files. err %d\n", err);
+         return err;
+     }
+ 
+-    release_firmware(firmware);
+-
+     if (!wait_for_firmware_completion(fw_load_completion)) {
+         boot_status = hailo_get_boot_status(resources);
+         hailo_dev_err(dev, "Timeout waiting for firmware file, boot status %u\n", boot_status);
+         return -ETIMEDOUT;
+     }
+ 
+-    hailo_dev_notice(dev, "Firmware was loaded successfully\n");
++    hailo_dev_notice(dev, "Firmware Batch loaded successfully\n");
++
+     return 0;
+ }
+ 
+-static int hailo_load_firmware_batch(struct hailo_pcie_resources *resources,
++static int hailo_load_nnc_firmware(struct hailo_pcie_resources *resources,
+     struct device *dev, struct completion *fw_load_completion)
+ {
+     u32 boot_status = 0;
+-    u32 pcie_finished = 1;
+     int err = 0;
+ 
+     if (hailo_pcie_is_firmware_loaded(resources)) {
+@@ -398,31 +359,13 @@ static int hailo_load_firmware_batch(str
+         return err;
+     }
+ 
+-    hailo_trigger_firmware_boot(resources);
+-
+     if (!wait_for_firmware_completion(fw_load_completion)) {
+         boot_status = hailo_get_boot_status(resources);
+         hailo_dev_err(dev, "Timeout waiting for firmware file, boot status %u\n", boot_status);
+         return -ETIMEDOUT;
+     }
+-    reinit_completion(fw_load_completion);
+ 
+-    err = hailo_pcie_write_firmware_batch(dev, resources, SECOND_STAGE);
+-    if (err < 0) {
+-        hailo_dev_err(dev, "Failed writing firmware files. err %d\n", err);
+-        return err;
+-    }
+-
+-    // TODO: HRT-13838 - Remove, move address to compat, make write_memory static
+-    write_memory(resources, 0x84000000, (void*)&pcie_finished, sizeof(pcie_finished));
+-
+-    if (!wait_for_firmware_completion(fw_load_completion)) {
+-        boot_status = hailo_get_boot_status(resources);
+-        hailo_dev_err(dev, "Timeout waiting for firmware file, boot status %u\n", boot_status);
+-        return -ETIMEDOUT;
+-    }
+-
+-    hailo_dev_notice(dev, "Firmware Batch loaded successfully\n");
++    hailo_dev_notice(dev, "Firmware loaded successfully\n");
+ 
+     return 0;
+ }
+@@ -439,15 +382,13 @@ static int hailo_activate_board(struct h
+         return err;
+     }
+ 
+-    switch (board->pcie_resources.board_type) {
+-    case HAILO_BOARD_TYPE_HAILO10H:
+-        err = hailo_load_firmware_batch(&board->pcie_resources, &board->pDev->dev,
++    switch (board->pcie_resources.accelerator_type) {
++    case HAILO_ACCELERATOR_TYPE_SOC:
++        err = hailo_load_soc_firmware(&board->pcie_resources, &board->pDev->dev,
+             &board->fw_loaded_completion);
+         break;
+-    case HAILO_BOARD_TYPE_HAILO10H_LEGACY:
+-    case HAILO_BOARD_TYPE_PLUTO:
+-    case HAILO_BOARD_TYPE_HAILO8:
+-        err = hailo_load_firmware(&board->pcie_resources, &board->pDev->dev,
++    case HAILO_ACCELERATOR_TYPE_NNC:
++        err = hailo_load_nnc_firmware(&board->pcie_resources, &board->pDev->dev,
+             &board->fw_loaded_completion);
+         break;
+     default:
+@@ -464,6 +405,7 @@ static int hailo_activate_board(struct h
+ 
+     if (power_mode_enabled()) {
+         // Setting the device to low power state, until the user opens the device
++        hailo_info(board, "Power change state  to PCI_D3hot\n");
+         err = pci_set_power_state(board->pDev, PCI_D3hot);
+         if (err < 0) {
+             hailo_err(board, "Set power state failed %d\n", err);
+@@ -755,21 +697,17 @@ static int hailo_pcie_probe(struct pci_d
+ 
+     pBoard->interrupts_enabled = false;
+     init_completion(&pBoard->fw_loaded_completion);
+-    init_completion(&pBoard->soc_connect_accepted);
+ 
+     sema_init(&pBoard->mutex, 1);
+     atomic_set(&pBoard->ref_count, 0);
+     INIT_LIST_HEAD(&pBoard->open_files_list);
+ 
+-    sema_init(&pBoard->fw_control.mutex, 1);
+-    spin_lock_init(&pBoard->notification_read_spinlock);
+-    init_completion(&pBoard->fw_control.completion);
++    // Init both soc and nnc, since the interrupts are shared.
++    hailo_nnc_init(&pBoard->nnc);
++    hailo_soc_init(&pBoard->soc);
+ 
+     init_completion(&pBoard->driver_down.reset_completed);
+ 
+-    INIT_LIST_HEAD(&pBoard->notification_wait_list);
+-
+-    memset(&pBoard->notification_cache, 0, sizeof(pBoard->notification_cache));
+     memset(&pBoard->memory_transfer_params, 0, sizeof(pBoard->memory_transfer_params));
+ 
+     err = hailo_pcie_vdma_controller_init(&pBoard->vdma, &pBoard->pDev->dev,
+@@ -832,7 +770,6 @@ probe_exit:
+ static void hailo_pcie_remove(struct pci_dev* pDev)
+ {
+     struct hailo_pcie_board* pBoard = (struct hailo_pcie_board*) pci_get_drvdata(pDev);
+-    struct hailo_notification_wait *cursor = NULL;
+ 
+     pci_notice(pDev, "Remove: Releasing board\n");
+ 
+@@ -864,13 +801,7 @@ static void hailo_pcie_remove(struct pci
+ 
+         pci_set_drvdata(pDev, NULL);
+ 
+-        // Lock rcu_read_lock and send notification_completion to wake anyone waiting on the notification_wait_list when removed
+-        rcu_read_lock();
+-        list_for_each_entry_rcu(cursor, &pBoard->notification_wait_list, notification_wait_list) {
+-            cursor->is_disabled = true;
+-            complete(&cursor->notification_completion);
+-        }
+-        rcu_read_unlock();
++        hailo_nnc_finalize(&pBoard->nnc);
+ 
+         up(&pBoard->mutex);
+ 
+@@ -889,6 +820,15 @@ static void hailo_pcie_remove(struct pci
+ 
+ }
+ 
++inline int driver_down(struct hailo_pcie_board *board)
++{
++    if (board->pcie_resources.accelerator_type == HAILO_ACCELERATOR_TYPE_NNC) {
++        return hailo_nnc_driver_down(board);
++    } else {
++        return hailo_soc_driver_down(board);
++    }
++}
++
+ #ifdef CONFIG_PM_SLEEP
+ static int hailo_pcie_suspend(struct device *dev)
+ {
+@@ -899,17 +839,16 @@ static int hailo_pcie_suspend(struct dev
+     // lock board to wait for any pending operations
+     down(&board->mutex);
+ 
+-    // Disable all interrupts. All interrupts from Hailo chip would be masked.
+-    hailo_disable_interrupts(board);
+-
+-    // Close all vDMA channels
+     if (board->vdma.used_by_filp != NULL) {
+-        err = hailo_pcie_driver_down(board);
++        err = driver_down(board);
+         if (err < 0) {
+             dev_notice(dev, "Error while trying to call FW to close vdma channels\n");
+         }
+     }
+ 
++    // Disable all interrupts. All interrupts from Hailo chip would be masked.
++    hailo_disable_interrupts(board);
++
+     // Un validate all activae file contexts so every new action would return error to the user.
+     list_for_each_entry(cur, &board->open_files_list, open_files_list) {
+         cur->is_valid = false;
+@@ -919,8 +858,8 @@ static int hailo_pcie_suspend(struct dev
+     up(&board->mutex);
+ 
+     dev_notice(dev, "PM's suspend\n");
+-    // Continue system suspend
+-    return err;
++    // Success Oriented - Continue system suspend even in case of error (otherwise system will not suspend correctly)
++    return 0;
+ }
+ 
+ static int hailo_pcie_resume(struct device *dev)
+@@ -930,10 +869,10 @@ static int hailo_pcie_resume(struct devi
+ 
+     if ((err = hailo_activate_board(board)) < 0) {
+         dev_err(dev, "Failed activating board %d\n", err);
+-        return err;
+     }
+ 
+     dev_notice(dev, "PM's resume\n");
++    // Success Oriented - Continue system resume even in case of error (otherwise system will not suspend correctly)
+     return 0;
+ }
+ #endif /* CONFIG_PM_SLEEP */
+@@ -954,7 +893,7 @@ static void hailo_pci_reset_prepare(stru
+         down(&board->mutex);
+         if (board->vdma.used_by_filp != NULL) {
+             // Try to close all vDMA channels before reset
+-            err = hailo_pcie_driver_down(board);
++            err = driver_down(board);
+             if (err < 0) {
+                 pci_err(pdev, "Error while trying to call FW to close vdma channels (errno %d)\n", err);
+             }
+@@ -1088,6 +1027,9 @@ MODULE_PARM_DESC(force_desc_page_size, "
+ module_param(force_hailo15_legacy_mode, bool, S_IRUGO);
+ MODULE_PARM_DESC(force_hailo15_legacy_mode, "Forces work with Hailo15 in legacy mode(relevant for emulators)");
+ 
++module_param(force_boot_linux_from_eemc, bool, S_IRUGO);
++MODULE_PARM_DESC(force_boot_linux_from_eemc, "Boot the linux image from eemc (Requires special Image)");
++
+ MODULE_AUTHOR("Hailo Technologies Ltd.");
+ MODULE_DESCRIPTION("Hailo PCIe driver");
+ MODULE_LICENSE("GPL v2");
+--- a/drivers/media/pci/hailo/src/pcie.h
++++ b/drivers/media/pci/hailo/src/pcie.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _HAILO_PCI_PCIE_H_
+@@ -41,6 +41,19 @@ struct hailo_fw_boot {
+ };
+ 
+ 
++struct hailo_pcie_nnc {
++    struct hailo_fw_control_info fw_control;
++
++    spinlock_t notification_read_spinlock;
++    struct list_head notification_wait_list;
++    struct hailo_d2h_notification notification_cache;
++    struct hailo_d2h_notification notification_to_user;
++};
++
++struct hailo_pcie_soc {
++    struct completion control_resp_ready;
++};
++
+ // Context for each open file handle
+ // TODO: store board and use as actual context
+ struct hailo_file_context {
+@@ -48,6 +61,7 @@ struct hailo_file_context {
+     struct file *filp;
+     struct hailo_vdma_file_context vdma_context;
+     bool is_valid;
++    u32 soc_used_channels_bitmap;
+ };
+ 
+ struct hailo_pcie_board {
+@@ -57,21 +71,17 @@ struct hailo_pcie_board {
+     atomic_t ref_count;
+     struct list_head open_files_list;
+     struct hailo_pcie_resources pcie_resources;
+-    struct hailo_fw_control_info fw_control;
++    struct hailo_pcie_nnc nnc;
++    struct hailo_pcie_soc soc;
+     struct hailo_pcie_driver_down_info driver_down;
+     struct semaphore mutex;
+     struct hailo_vdma_controller vdma;
+-    spinlock_t notification_read_spinlock;
+-    struct list_head notification_wait_list;
+-    struct hailo_d2h_notification notification_cache;
+-    struct hailo_d2h_notification notification_to_user;
++
+     struct hailo_memory_transfer_params memory_transfer_params;
+     u32 desc_max_page_size;
+     enum hailo_allocation_mode allocation_mode;
+     struct completion fw_loaded_completion;
+     bool interrupts_enabled;
+-    // Only needed in accelerator type soc
+-    struct completion soc_connect_accepted;
+ };
+ 
+ bool power_mode_enabled(void);
+--- /dev/null
++++ b/drivers/media/pci/hailo/src/soc.c
+@@ -0,0 +1,244 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
++ **/
++/**
++ * A Hailo PCIe NNC device is a device contains a full SoC over PCIe. The SoC contains NNC (neural network core) and
++ * some application processor (pci_ep).
++ */
++
++#include "soc.h"
++
++#include "vdma_common.h"
++#include "utils/logs.h"
++#include "vdma/memory.h"
++
++#include <linux/uaccess.h>
++
++#define PCI_SOC_VDMA_ENGINE_INDEX           (0)
++#define PCI_SOC_CONTROL_CONNECT_TIMEOUT_MS (1000)
++#define PCI_SOC_INPUT_CHANNEL_BITMASK       (0x000000FF)
++
++void hailo_soc_init(struct hailo_pcie_soc *soc)
++{
++    init_completion(&soc->control_resp_ready);
++}
++
++long hailo_soc_ioctl(struct hailo_pcie_board *board, struct hailo_file_context *context,
++    struct hailo_vdma_controller *controller, unsigned int cmd, unsigned long arg)
++{
++    switch (cmd) {
++    case HAILO_SOC_CONNECT:
++        return hailo_soc_connect_ioctl(board, context, controller, arg);
++    case HAILO_SOC_CLOSE:
++        return hailo_soc_close_ioctl(board, controller, context, arg);
++    default:
++        hailo_err(board, "Invalid pcie EP ioctl code 0x%x (nr: %d)\n", cmd, _IOC_NR(cmd));
++        return -ENOTTY;
++    }
++}
++
++static int soc_control(struct hailo_pcie_board *board,
++    const struct hailo_pcie_soc_request *request,
++    struct hailo_pcie_soc_response *response)
++{
++    int ret = 0;
++    reinit_completion(&board->soc.control_resp_ready);
++
++    hailo_pcie_soc_write_request(&board->pcie_resources, request);
++
++    ret = wait_for_completion_interruptible_timeout(&board->soc.control_resp_ready,
++        msecs_to_jiffies(PCI_SOC_CONTROL_CONNECT_TIMEOUT_MS));
++    if (ret <= 0) {
++        if (0 == ret) {
++            hailo_err(board, "Timeout waiting for soc control (timeout_ms=%d)\n", PCI_SOC_CONTROL_CONNECT_TIMEOUT_MS);
++            return -ETIMEDOUT;
++        } else {
++            hailo_info(board, "soc control failed with err=%d (process was interrupted or killed)\n",
++                ret);
++            return ret;
++        }
++    }
++
++    hailo_pcie_soc_read_response(&board->pcie_resources, response);
++    
++    if (response->status < 0) {
++        hailo_err(board, "soc control failed with status=%d\n", response->status);
++        return response->status;
++    }
++
++    if (response->control_code != request->control_code) {
++        hailo_err(board, "Invalid response control code %d (expected %d)\n",
++            response->control_code, request->control_code);
++        return -EINVAL;
++    }
++
++    return 0;
++}
++
++long hailo_soc_connect_ioctl(struct hailo_pcie_board *board, struct hailo_file_context *context,
++    struct hailo_vdma_controller *controller, unsigned long arg)
++{
++    struct hailo_pcie_soc_request request = {0};
++    struct hailo_pcie_soc_response response = {0};
++    struct hailo_soc_connect_params params;
++    struct hailo_vdma_channel *input_channel = NULL;
++    struct hailo_vdma_channel *output_channel = NULL;
++    struct hailo_vdma_engine *vdma_engine = &controller->vdma_engines[PCI_SOC_VDMA_ENGINE_INDEX];
++    struct hailo_descriptors_list_buffer *input_descriptors_buffer = NULL;
++    struct hailo_descriptors_list_buffer *output_descriptors_buffer = NULL;
++    uint8_t depth = 0;
++    int err = 0;
++
++    if (copy_from_user(&params, (void *)arg, sizeof(params))) {
++        hailo_err(board, "copy_from_user fail\n");
++        return -ENOMEM;
++    }
++
++    request = (struct hailo_pcie_soc_request) {
++        .control_code = HAILO_PCIE_SOC_CONTROL_CODE_CONNECT,
++        .connect = {
++            .port = params.port_number
++        }
++    };
++    err = soc_control(board, &request, &response);
++    if (err < 0) {
++        return err;
++    }
++
++    params.input_channel_index = response.connect.input_channel_index;
++    params.output_channel_index = response.connect.output_channel_index;
++
++    if (!hailo_check_channel_index(params.input_channel_index, controller->hw->src_channels_bitmask, true)) {
++        hailo_dev_err(&board->pDev->dev, "Invalid input channel index %u\n", params.input_channel_index);
++        return -EINVAL;
++    }
++
++    if (!hailo_check_channel_index(params.output_channel_index, controller->hw->src_channels_bitmask, false)) {
++        hailo_dev_err(&board->pDev->dev, "Invalid output channel index %u\n", params.output_channel_index);
++        return -EINVAL;
++    }
++
++    input_channel = &vdma_engine->channels[params.input_channel_index];
++    output_channel = &vdma_engine->channels[params.output_channel_index];
++
++    input_descriptors_buffer = hailo_vdma_find_descriptors_buffer(&context->vdma_context, params.input_desc_handle);
++    output_descriptors_buffer = hailo_vdma_find_descriptors_buffer(&context->vdma_context, params.output_desc_handle);
++    if (NULL == input_descriptors_buffer || NULL == output_descriptors_buffer) {
++        hailo_dev_err(&board->pDev->dev, "input / output descriptors buffer not found \n");
++        return -EINVAL;
++    }
++
++    if (!is_powerof2((size_t)input_descriptors_buffer->desc_list.desc_count) ||
++        !is_powerof2((size_t)output_descriptors_buffer->desc_list.desc_count)) {
++        hailo_dev_err(&board->pDev->dev, "Invalid desc list size\n");
++        return -EINVAL;
++    }
++
++    // configure and start input channel
++    depth = ceil_log2(input_descriptors_buffer->desc_list.desc_count);
++    // DMA Direction is only to get channel index - so 
++    err = hailo_vdma_start_channel(input_channel->host_regs, input_descriptors_buffer->dma_address, depth,
++        board->vdma.hw->ddr_data_id);
++    if (err < 0) {
++        hailo_dev_err(&board->pDev->dev, "Error starting vdma input channel index %u\n", params.input_channel_index);
++        return -EINVAL;
++    }
++
++    // Store the input channels state in bitmap (open)
++    hailo_set_bit(params.input_channel_index, &context->soc_used_channels_bitmap);
++    
++    // configure and start output channel
++    depth = ceil_log2(output_descriptors_buffer->desc_list.desc_count);
++    // DMA Direction is only to get channel index - so 
++    err = hailo_vdma_start_channel(output_channel->host_regs, output_descriptors_buffer->dma_address, depth,
++        board->vdma.hw->ddr_data_id);
++    if (err < 0) {
++        hailo_dev_err(&board->pDev->dev, "Error starting vdma output channel index %u\n", params.output_channel_index);
++        // Close input channel
++        hailo_vdma_stop_channel(input_channel->host_regs);
++        return -EINVAL;
++    }
++
++    // Store the output channels state in bitmap (open)
++    hailo_set_bit(params.output_channel_index, &context->soc_used_channels_bitmap);
++
++    if (copy_to_user((void *)arg, &params, sizeof(params))) {
++        hailo_dev_err(&board->pDev->dev, "copy_to_user fail\n");
++        return -ENOMEM;
++    }
++
++    return 0;
++}
++
++static int close_channels(struct hailo_pcie_board *board, u32 channels_bitmap)
++{
++    struct hailo_pcie_soc_request request = {0};
++    struct hailo_pcie_soc_response response = {0};
++    struct hailo_vdma_engine *engine = &board->vdma.vdma_engines[PCI_SOC_VDMA_ENGINE_INDEX];
++    struct hailo_vdma_channel *channel = NULL;
++    u8 channel_index = 0;
++
++    hailo_info(board, "Closing channels bitmap 0x%x\n", channels_bitmap);
++    for_each_vdma_channel(engine, channel, channel_index) {
++        if (hailo_test_bit(channel_index, &channels_bitmap)) {
++            hailo_vdma_stop_channel(channel->host_regs);
++        }
++    }
++
++    request = (struct hailo_pcie_soc_request) {
++        .control_code = HAILO_PCIE_SOC_CONTROL_CODE_CLOSE,
++        .close = {
++            .channels_bitmap = channels_bitmap
++        }
++    };
++    return soc_control(board, &request, &response);
++}
++
++long hailo_soc_close_ioctl(struct hailo_pcie_board *board, struct hailo_vdma_controller *controller, 
++    struct hailo_file_context *context, unsigned long arg)
++{
++    struct hailo_soc_close_params params;
++    u32 channels_bitmap = 0;
++    int err = 0;
++
++    if (copy_from_user(&params, (void *)arg, sizeof(params))) {
++        hailo_dev_err(&board->pDev->dev, "copy_from_user fail\n");
++        return -ENOMEM;
++    }
++
++    // TOOD: check channels are connected
++
++    channels_bitmap = (1 << params.input_channel_index) | (1 << params.output_channel_index);
++
++    err = close_channels(board, channels_bitmap);
++    if (0 != err) {
++        hailo_dev_err(&board->pDev->dev, "Error closing channels\n");
++        return err;
++    }
++
++    // Store the channel state in bitmap (closed)
++    hailo_clear_bit(params.input_channel_index, &context->soc_used_channels_bitmap);
++    hailo_clear_bit(params.output_channel_index, &context->soc_used_channels_bitmap);
++
++    return err;
++}
++
++int hailo_soc_file_context_init(struct hailo_pcie_board *board, struct hailo_file_context *context)
++{
++    // Nothing to init yet
++    return 0;
++}
++
++void hailo_soc_file_context_finalize(struct hailo_pcie_board *board, struct hailo_file_context *context)
++{
++    // close only channels connected by this (by bitmap)
++    if (context->soc_used_channels_bitmap != 0) {
++        close_channels(board, context->soc_used_channels_bitmap);
++    }
++}
++
++int hailo_soc_driver_down(struct hailo_pcie_board *board)
++{
++    return close_channels(board, 0xFFFFFFFF);
++}
+\ No newline at end of file
+--- a/drivers/media/pci/hailo/src/pci_soc_ioctl.h
++++ /dev/null
+@@ -1,19 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/**
+- * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+- **/
+-
+-#ifndef _HAILO_PCI_SOC_IOCTL_H_
+-#define _HAILO_PCI_SOC_IOCTL_H_
+-
+-#include "vdma/ioctl.h"
+-#include "pcie.h"
+-
+-
+-long hailo_soc_ioctl(struct hailo_pcie_board *board, struct hailo_vdma_file_context *context,
+-    struct hailo_vdma_controller *controller, unsigned int cmd, unsigned long arg);
+-long hailo_soc_connect_ioctl(struct hailo_pcie_board *board, struct hailo_vdma_file_context *context,
+-    struct hailo_vdma_controller *controller, unsigned long arg);
+-long hailo_soc_close_ioctl(struct hailo_pcie_board *board, struct hailo_vdma_controller *controller, unsigned long arg);
+-
+-#endif // _HAILO_PCI_SOC_IOCTL_H_
+\ No newline at end of file
+--- /dev/null
++++ b/drivers/media/pci/hailo/src/soc.h
+@@ -0,0 +1,26 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#ifndef _HAILO_PCI_SOC_IOCTL_H_
++#define _HAILO_PCI_SOC_IOCTL_H_
++
++#include "vdma/ioctl.h"
++#include "pcie.h"
++
++
++void hailo_soc_init(struct hailo_pcie_soc *soc);
++
++long hailo_soc_ioctl(struct hailo_pcie_board *board, struct hailo_file_context *context,
++    struct hailo_vdma_controller *controller, unsigned int cmd, unsigned long arg);
++long hailo_soc_connect_ioctl(struct hailo_pcie_board *board, struct hailo_file_context *context,
++    struct hailo_vdma_controller *controller, unsigned long arg);
++long hailo_soc_close_ioctl(struct hailo_pcie_board *board, struct hailo_vdma_controller *controller, struct hailo_file_context *context, unsigned long arg);
++
++int hailo_soc_file_context_init(struct hailo_pcie_board *board, struct hailo_file_context *context);
++void hailo_soc_file_context_finalize(struct hailo_pcie_board *board, struct hailo_file_context *context);
++
++int hailo_soc_driver_down(struct hailo_pcie_board *board);
++
++#endif // _HAILO_PCI_SOC_IOCTL_H_
+\ No newline at end of file
+--- a/drivers/media/pci/hailo/src/sysfs.c
++++ b/drivers/media/pci/hailo/src/sysfs.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #include "sysfs.h"
+--- a/drivers/media/pci/hailo/src/sysfs.h
++++ b/drivers/media/pci/hailo/src/sysfs.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _HAILO_PCI_SYSFS_H_
+--- a/drivers/media/pci/hailo/src/utils.c
++++ /dev/null
+@@ -1,26 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
+- **/
+-
+-#include <linux/version.h>
+-#include <linux/init.h>
+-#include <linux/module.h>
+-#include <linux/pci.h>
+-
+-#include "pcie.h"
+-#include "utils.h"
+-#include "utils/logs.h"
+-
+-
+-void hailo_pcie_clear_notification_wait_list(struct hailo_pcie_board *pBoard, struct file *filp)
+-{
+-    struct hailo_notification_wait *cur = NULL, *next = NULL;
+-    list_for_each_entry_safe(cur, next, &pBoard->notification_wait_list, notification_wait_list) {
+-        if (cur->filp == filp) {
+-            list_del_rcu(&cur->notification_wait_list);
+-            synchronize_rcu();
+-            kfree(cur);
+-        }
+-    }
+-}
+--- a/drivers/media/pci/hailo/utils/compact.h
++++ b/drivers/media/pci/hailo/utils/compact.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _HAILO_PCI_COMPACT_H_
+--- a/drivers/media/pci/hailo/utils/fw_common.h
++++ b/drivers/media/pci/hailo/utils/fw_common.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _HAILO_LINUX_COMMON_H_
+--- a/drivers/media/pci/hailo/utils/integrated_nnc_utils.c
++++ b/drivers/media/pci/hailo/utils/integrated_nnc_utils.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #include "integrated_nnc_utils.h"
+@@ -43,11 +43,19 @@ int hailo_ioremap_shmem(struct platform_
+     void __iomem * remap_ptr;
+ 
+     shmem = of_parse_phandle(pdev->dev.of_node, "shmem", index);
++    if (!shmem) {
++        hailo_dev_err(&pdev->dev, "Failed to find shmem node index: %d in device tree\n", index);
++        return -ENODEV;
++    }
++
+     ret = of_address_to_resource(shmem, 0, &res);
+     if (ret) {
+         hailo_dev_err(&pdev->dev, "hailo_ioremap_shmem, failed to get memory (index: %d)\n", index);
++        of_node_put(shmem);
+         return ret;
+     }
++
++    // Decrement the refcount of the node
+     of_node_put(shmem);
+ 
+     remap_ptr = devm_ioremap(&pdev->dev, res.start, resource_size(&res));
+--- a/drivers/media/pci/hailo/utils/integrated_nnc_utils.h
++++ b/drivers/media/pci/hailo/utils/integrated_nnc_utils.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _INTEGRATED_NNC_UTILS_H_
+--- a/drivers/media/pci/hailo/utils/logs.c
++++ b/drivers/media/pci/hailo/utils/logs.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #include "logs.h"
+--- a/drivers/media/pci/hailo/utils/logs.h
++++ b/drivers/media/pci/hailo/utils/logs.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _COMMON_LOGS_H_
+--- a/drivers/media/pci/hailo/vdma/ioctl.c
++++ b/drivers/media/pci/hailo/vdma/ioctl.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #include "ioctl.h"
+@@ -12,7 +12,7 @@
+ #include <linux/uaccess.h>
+ 
+ 
+-long hailo_vdma_enable_channels_ioctl(struct hailo_vdma_controller *controller, unsigned long arg)
++long hailo_vdma_enable_channels_ioctl(struct hailo_vdma_controller *controller, unsigned long arg, struct hailo_vdma_file_context *context)
+ {
+     struct hailo_vdma_enable_channels_params input;
+     struct hailo_vdma_engine *engine = NULL;
+@@ -40,12 +40,15 @@ long hailo_vdma_enable_channels_ioctl(st
+         hailo_vdma_update_interrupts_mask(controller, engine_index);
+         hailo_dev_info(controller->dev, "Enabled interrupts for engine %u, channels bitmap 0x%x\n",
+             engine_index, channels_bitmap);
++
++        // Update the context with the enabled channels bitmap
++        context->enabled_channels_bitmap[engine_index] |= channels_bitmap;
+     }
+ 
+     return 0;
+ }
+ 
+-long hailo_vdma_disable_channels_ioctl(struct hailo_vdma_controller *controller, unsigned long arg)
++long hailo_vdma_disable_channels_ioctl(struct hailo_vdma_controller *controller, unsigned long arg, struct hailo_vdma_file_context *context)
+ {
+     struct hailo_vdma_disable_channels_params input;
+     struct hailo_vdma_engine *engine = NULL;
+@@ -77,6 +80,9 @@ long hailo_vdma_disable_channels_ioctl(s
+ 
+         hailo_dev_info(controller->dev, "Disabled channels for engine %u, bitmap 0x%x\n",
+             engine_index, channels_bitmap);
++
++        // Update the context with the disabled channels bitmap
++        context->enabled_channels_bitmap[engine_index] &= ~channels_bitmap;
+     }
+ 
+     // Wake up threads waiting
+@@ -204,7 +210,7 @@ long hailo_vdma_buffer_map_ioctl(struct
+         return -EFAULT;
+     }
+ 
+-    hailo_dev_info(controller->dev, "address %lx tgid %d size: %zu\n",
++    hailo_dev_dbg(controller->dev, "address %lx tgid %d size: %zu\n",
+         buf_info.user_address, current->tgid, buf_info.size);
+ 
+     direction = get_dma_direction(buf_info.data_direction);
+@@ -231,7 +237,7 @@ long hailo_vdma_buffer_map_ioctl(struct
+     }
+ 
+     list_add(&mapped_buffer->mapped_user_buffer_list, &context->mapped_user_buffer_list);
+-    hailo_dev_info(controller->dev, "buffer %lx (handle %zu) is mapped\n",
++    hailo_dev_dbg(controller->dev, "buffer %lx (handle %zu) is mapped\n",
+         buf_info.user_address, buf_info.mapped_handle);
+     return 0;
+ }
+@@ -247,7 +253,7 @@ long hailo_vdma_buffer_unmap_ioctl(struc
+         return -EFAULT;
+     }
+ 
+-    hailo_dev_info(controller->dev, "unmap user buffer handle %zu\n", buffer_unmap_params.mapped_handle);
++    hailo_dev_dbg(controller->dev, "unmap user buffer handle %zu\n", buffer_unmap_params.mapped_handle);
+ 
+     mapped_buffer = hailo_vdma_find_mapped_user_buffer(context, buffer_unmap_params.mapped_handle);
+     if (mapped_buffer == NULL) {
+--- a/drivers/media/pci/hailo/vdma/ioctl.h
++++ b/drivers/media/pci/hailo/vdma/ioctl.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _HAILO_VDMA_IOCTL_H_
+@@ -8,8 +8,8 @@
+ 
+ #include "vdma/vdma.h"
+ 
+-long hailo_vdma_enable_channels_ioctl(struct hailo_vdma_controller *controller, unsigned long arg);
+-long hailo_vdma_disable_channels_ioctl(struct hailo_vdma_controller *controller, unsigned long arg);
++long hailo_vdma_enable_channels_ioctl(struct hailo_vdma_controller *controller, unsigned long arg, struct hailo_vdma_file_context *context);
++long hailo_vdma_disable_channels_ioctl(struct hailo_vdma_controller *controller, unsigned long arg, struct hailo_vdma_file_context *context);
+ long hailo_vdma_interrupts_wait_ioctl(struct hailo_vdma_controller *controller, unsigned long arg,
+     struct semaphore *mutex, bool *should_up_board_mutex);
+ 
+--- a/drivers/media/pci/hailo/vdma/memory.c
++++ b/drivers/media/pci/hailo/vdma/memory.c
+@@ -1,11 +1,12 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #define pr_fmt(fmt) "hailo: " fmt
+ 
+ #include "memory.h"
++#include "utils.h"
+ #include "utils/compact.h"
+ 
+ #include <linux/highmem-internal.h>
+@@ -316,6 +317,11 @@ int hailo_desc_list_create(struct device
+     size_t buffer_size = 0;
+     const u64 align = VDMA_DESCRIPTOR_LIST_ALIGN; //First addr must be aligned on 64 KB  (from the VDMA registers documentation)
+ 
++    if (MAX_POWER_OF_2_VALUE < descriptors_count) {
++        dev_err(dev, "Invalid descriptors count %u\n", descriptors_count);
++        return -EINVAL;
++    }
++
+     buffer_size = descriptors_count * sizeof(struct hailo_vdma_descriptor);
+     buffer_size = ALIGN(buffer_size, align);
+ 
+@@ -323,7 +329,7 @@ int hailo_desc_list_create(struct device
+         &descriptors->dma_address, GFP_KERNEL | __GFP_ZERO);
+     if (descriptors->kernel_address == NULL) {
+         dev_err(dev, "Failed to allocate descriptors list, desc_count 0x%x, buffer_size 0x%zx, This failure means there is not a sufficient amount of CMA memory "
+-            "(contiguous physical memory), This usually is caused by lack of general system memory. Please check you have sufficent memory.\n",
++            "(contiguous physical memory), This usually is caused by lack of general system memory. Please check you have sufficient memory.\n",
+             descriptors_count, buffer_size);
+         return -ENOMEM;
+     }
+@@ -333,6 +339,8 @@ int hailo_desc_list_create(struct device
+ 
+     descriptors->desc_list.desc_list = descriptors->kernel_address;
+     descriptors->desc_list.desc_count = descriptors_count;
++    // No need to check the return value of get_nearest_powerof_2 because we already checked the input
++    descriptors->desc_list.desc_count_mask = is_circular ? (descriptors_count - 1) : (get_nearest_powerof_2(descriptors_count) - 1);
+     descriptors->desc_list.desc_page_size = desc_page_size;
+     descriptors->desc_list.is_circular = is_circular;
+ 
+--- a/drivers/media/pci/hailo/vdma/memory.h
++++ b/drivers/media/pci/hailo/vdma/memory.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ /**
+  * vDMA memory utility (including allocation and mappings)
+--- a/drivers/media/pci/hailo/vdma/vdma.c
++++ b/drivers/media/pci/hailo/vdma/vdma.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #define pr_fmt(fmt) "hailo: " fmt
+@@ -105,6 +105,9 @@ void hailo_vdma_file_context_init(struct
+     INIT_LIST_HEAD(&context->descriptors_buffer_list);
+     INIT_LIST_HEAD(&context->vdma_low_memory_buffer_list);
+     INIT_LIST_HEAD(&context->continuous_buffer_list);
++
++    BUILD_BUG_ON_MSG(MAX_VDMA_CHANNELS_PER_ENGINE > sizeof(context->enabled_channels_bitmap[0]) * BITS_IN_BYTE,
++        "Unexpected amount of VDMA channels per engine");
+ }
+ 
+ void hailo_vdma_update_interrupts_mask(struct hailo_vdma_controller *controller,
+@@ -119,21 +122,22 @@ void hailo_vdma_file_context_finalize(st
+ {
+     size_t engine_index = 0;
+     struct hailo_vdma_engine *engine = NULL;
+-    const u32 channels_bitmap = 0xFFFFFFFF; // disable all channel interrupts
+     unsigned long irq_saved_flags = 0;
+     // In case of FLR, the vdma registers will be NULL
+     const bool is_device_up = (NULL != controller->dev);
+ 
+-    if (filp == controller->used_by_filp) {
+-        for_each_vdma_engine(controller, engine, engine_index) {
+-            hailo_vdma_engine_disable_channels(engine, channels_bitmap);
++    for_each_vdma_engine(controller, engine, engine_index) {
++        if (context->enabled_channels_bitmap[engine_index]) {
++            hailo_dev_info(controller->dev, "Disabling channels for engine %zu, channels bitmap 0x%x\n", engine_index, 
++            context->enabled_channels_bitmap[engine_index]);
++            hailo_vdma_engine_disable_channels(engine, context->enabled_channels_bitmap[engine_index]);
+ 
+             if (is_device_up) {
+                 hailo_vdma_update_interrupts_mask(controller, engine_index);
+             }
+ 
+             spin_lock_irqsave(&controller->interrupts_lock, irq_saved_flags);
+-            hailo_vdma_engine_clear_channel_interrupts(engine, channels_bitmap);
++            hailo_vdma_engine_clear_channel_interrupts(engine, context->enabled_channels_bitmap[engine_index]);
+             spin_unlock_irqrestore(&controller->interrupts_lock, irq_saved_flags);
+         }
+     }
+@@ -148,10 +152,21 @@ void hailo_vdma_file_context_finalize(st
+     }
+ }
+ 
++void hailo_vdma_wakeup_interrupts(struct hailo_vdma_controller *controller, struct hailo_vdma_engine *engine, 
++    u32 channels_bitmap)
++{
++    unsigned long irq_saved_flags = 0;
++
++    spin_lock_irqsave(&controller->interrupts_lock, irq_saved_flags);
++    hailo_vdma_engine_set_channel_interrupts(engine, channels_bitmap);
++    spin_unlock_irqrestore(&controller->interrupts_lock, irq_saved_flags);
++
++    wake_up_interruptible_all(&controller->interrupts_wq);
++}
++
+ void hailo_vdma_irq_handler(struct hailo_vdma_controller *controller,
+     size_t engine_index, u32 channels_bitmap)
+ {
+-    unsigned long irq_saved_flags = 0;
+     struct hailo_vdma_engine *engine = NULL;
+ 
+     BUG_ON(engine_index >= controller->vdma_engines_count);
+@@ -159,11 +174,7 @@ void hailo_vdma_irq_handler(struct hailo
+ 
+     hailo_vdma_engine_push_timestamps(engine, channels_bitmap);
+ 
+-    spin_lock_irqsave(&controller->interrupts_lock, irq_saved_flags);
+-    hailo_vdma_engine_set_channel_interrupts(engine, channels_bitmap);
+-    spin_unlock_irqrestore(&controller->interrupts_lock, irq_saved_flags);
+-
+-    wake_up_interruptible_all(&controller->interrupts_wq);
++    hailo_vdma_wakeup_interrupts(controller, engine, channels_bitmap);
+ }
+ 
+ long hailo_vdma_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller,
+@@ -171,9 +182,9 @@ long hailo_vdma_ioctl(struct hailo_vdma_
+ {
+     switch (cmd) {
+     case HAILO_VDMA_ENABLE_CHANNELS:
+-        return hailo_vdma_enable_channels_ioctl(controller, arg);
++        return hailo_vdma_enable_channels_ioctl(controller, arg, context);
+     case HAILO_VDMA_DISABLE_CHANNELS:
+-        return hailo_vdma_disable_channels_ioctl(controller, arg);
++        return hailo_vdma_disable_channels_ioctl(controller, arg, context);
+     case HAILO_VDMA_INTERRUPTS_WAIT:
+         return hailo_vdma_interrupts_wait_ioctl(controller, arg, mutex, should_up_board_mutex);
+     case HAILO_VDMA_INTERRUPTS_READ_TIMESTAMPS:
+--- a/drivers/media/pci/hailo/vdma/vdma.h
++++ b/drivers/media/pci/hailo/vdma/vdma.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ /**
+  * Hailo vdma engine definitions
+@@ -130,6 +130,7 @@ struct hailo_vdma_file_context {
+     struct list_head descriptors_buffer_list;
+     struct list_head vdma_low_memory_buffer_list;
+     struct list_head continuous_buffer_list;
++    u32 enabled_channels_bitmap[MAX_VDMA_ENGINES];
+ };
+ 
+ 
+@@ -145,6 +146,8 @@ void hailo_vdma_file_context_init(struct
+ void hailo_vdma_file_context_finalize(struct hailo_vdma_file_context *context,
+     struct hailo_vdma_controller *controller, struct file *filp);
+ 
++void hailo_vdma_wakeup_interrupts(struct hailo_vdma_controller *controller, struct hailo_vdma_engine *engine, 
++    u32 channels_bitmap);
+ void hailo_vdma_irq_handler(struct hailo_vdma_controller *controller, size_t engine_index,
+     u32 channels_bitmap);
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0551-dtoverlays-enable-SPI-CS-active-high.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0551-dtoverlays-enable-SPI-CS-active-high.patch
new file mode 100644
index 00000000..efaa890f
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0551-dtoverlays-enable-SPI-CS-active-high.patch
@@ -0,0 +1,108 @@
+From 09d1088398d1f64ee178ddbc2c2d91f98dbfe73e Mon Sep 17 00:00:00 2001
+From: Iker Pedrosa <ikerpedrosam@gmail.com>
+Date: Mon, 18 Nov 2024 10:55:33 +0100
+Subject: [PATCH 551/697] dtoverlays: enable SPI CS active-high
+
+The documentation isn't very clear explaining how to enable SPI CS
+active-high and it takes a long time to understand it. Adding a specific
+overlay as a simple example on how to invert this signal can help
+understand the solution.
+
+Link: https://forums.raspberrypi.com/viewtopic.php?t=378222
+Signed-off-by: Iker Pedrosa <ikerpedrosam@gmail.com>
+---
+ arch/arm/boot/dts/overlays/Makefile           |  1 +
+ arch/arm/boot/dts/overlays/README             |  8 +++
+ .../overlays/spi0-1cs-inverted-overlay.dts    | 59 +++++++++++++++++++
+ 3 files changed, 68 insertions(+)
+ create mode 100644 arch/arm/boot/dts/overlays/spi0-1cs-inverted-overlay.dts
+
+--- a/arch/arm/boot/dts/overlays/Makefile
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -260,6 +260,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
+ 	spi-rtc.dtbo \
+ 	spi0-0cs.dtbo \
+ 	spi0-1cs.dtbo \
++	spi0-1cs-inverted.dtbo \
+ 	spi0-2cs.dtbo \
+ 	spi1-1cs.dtbo \
+ 	spi1-2cs.dtbo \
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -4472,6 +4472,14 @@ Params: cs0_pin                 GPIO pin
+                                 it for other uses.
+ 
+ 
++Name:   spi0-1cs-inverted
++Info:   Only use one CS pin for SPI0 and set to active-high
++Load:   dtoverlay=spi0-1cs-inverted,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 8)
++        no_miso                 Don't claim and use the MISO pin (9), freeing
++                                it for other uses.
++
++
+ Name:   spi0-2cs
+ Info:   Change the CS pins for SPI0
+ Load:   dtoverlay=spi0-2cs,<param>=<val>
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi0-1cs-inverted-overlay.dts
+@@ -0,0 +1,59 @@
++/dts-v1/;
++/plugin/;
++
++/*
++ * There are some devices that need an inverted Chip Select (CS) to select the
++ * device signal, as an example the AZDelivery 12864 display. That means that
++ * the CS polarity is active-high. To invert the CS signal the DT needs to set
++ * the cs-gpio to GPIO_ACTIVE_HIGH (0) in the controller and set the
++ * spi-cs-high in the peripheral property. On top of that, since this is a
++ * display the DT also needs to specify the write-only property.
++*/
++
++#include <dt-bindings/gpio/gpio.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0_cs_pins>;
++		frag0: __overlay__ {
++			brcm,pins = <8>;
++		};
++	};
++
++	fragment@1 {
++		target = <&spi0>;
++		frag1: __overlay__ {
++			cs-gpios = <&gpio 8 GPIO_ACTIVE_HIGH>;
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&spi0_pins>;
++		__dormant__ {
++			brcm,pins = <10 11>;
++		};
++	};
++
++	fragment@4 {
++		target = <&spidev0>;
++		__overlay__ {
++			spi-cs-high;
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag0>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		no_miso = <0>,"=3";
++	};
++};
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0552-overlays-Enable-Raspberry-Touch-2-rotation-with-over.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0552-overlays-Enable-Raspberry-Touch-2-rotation-with-over.patch
new file mode 100644
index 00000000..49348a3a
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0552-overlays-Enable-Raspberry-Touch-2-rotation-with-over.patch
@@ -0,0 +1,32 @@
+From 5fd5531d9d4aa8ddada1fc06fd283bfd9544a6ee Mon Sep 17 00:00:00 2001
+From: Just a nerd <157698061+foonerd@users.noreply.github.com>
+Date: Wed, 20 Nov 2024 14:08:48 +0000
+Subject: [PATCH 552/697] overlays: Enable Raspberry Touch 2 rotation with
+ overlay
+
+See: https://github.com/raspberrypi/linux/pull/6480
+Signed-off-by: foonerd <foonerd@github.com>
+---
+ arch/arm/boot/dts/overlays/README                                | 1 +
+ arch/arm/boot/dts/overlays/vc4-kms-dsi-ili9881-7inch-overlay.dts | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -5291,6 +5291,7 @@ Params: sizex                   Touchscr
+         invy                    Touchscreen inverted y axis
+         swapxy                  Touchscreen swapped x y axis
+         disable_touch           Disables the touch screen overlay driver
++        rotation                Display rotation {0,90,180,270} (default 0)
+         dsi0                    Use DSI0 and i2c_csi_dsi0 (rather than
+                                 the default DSI1 and i2c_csi_dsi).
+ 
+--- a/arch/arm/boot/dts/overlays/vc4-kms-dsi-ili9881-7inch-overlay.dts
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dsi-ili9881-7inch-overlay.dts
+@@ -118,5 +118,6 @@
+ 		invy = <0>, "+11";
+ 		swapxy = <&gt911>,"touchscreen-swapped-x-y?";
+ 		disable_touch = <&gt911>, "status=disabled";
++		rotation = <&dsi_panel>, "rotation:0";
+ 	};
+ };
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0553-PCI-brcmstb-set-link-speed-before-deasserting-fundam.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0553-PCI-brcmstb-set-link-speed-before-deasserting-fundam.patch
new file mode 100644
index 00000000..4e140b46
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0553-PCI-brcmstb-set-link-speed-before-deasserting-fundam.patch
@@ -0,0 +1,41 @@
+From 00aa888bfc542d26368adc4aae461b4f0f73cbb4 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Fri, 22 Nov 2024 11:56:30 +0000
+Subject: [PATCH 553/697] PCI: brcmstb: set link speed before deasserting
+ fundamental reset
+
+If autonomous speed negotiation is unreliable then brcm_pcie_set_gen()
+can be used to override/limit this behaviour. However, setting the limit
+after the linkup poll means the link can temporarily enter a bad speed
+which may result in link failure. Move the speed setup to just prior to
+releasing perst_n.
+
+Fixes: 0693b4207fd7 ("PCI: brcmstb: Split post-link up initialization to brcm_pcie_start_link()")
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/pci/controller/pcie-brcmstb.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/pci/controller/pcie-brcmstb.c
++++ b/drivers/pci/controller/pcie-brcmstb.c
+@@ -1715,6 +1715,9 @@ static int brcm_pcie_start_link(struct b
+ 	u16 tmp16;
+ 	int ret, i;
+ 
++	if (pcie->gen)
++		brcm_pcie_set_gen(pcie, pcie->gen);
++
+ 	/* Unassert the fundamental reset */
+ 	if (pcie->tperst_clk_ms) {
+ 		/*
+@@ -1759,9 +1762,6 @@ static int brcm_pcie_start_link(struct b
+ 
+ 	brcm_config_clkreq(pcie);
+ 
+-	if (pcie->gen)
+-		brcm_pcie_set_gen(pcie, pcie->gen);
+-
+ 	if (pcie->ssc) {
+ 		ret = brcm_pcie_set_ssc(pcie);
+ 		if (ret == 0)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0554-drm-connector-Initialise-max_bpc-to-the-minimum-valu.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0554-drm-connector-Initialise-max_bpc-to-the-minimum-valu.patch
new file mode 100644
index 00000000..12da3877
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0554-drm-connector-Initialise-max_bpc-to-the-minimum-valu.patch
@@ -0,0 +1,45 @@
+From 98a85de792e71b5bb188d74e907ad5cf456953c9 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 21 Nov 2024 18:30:07 +0000
+Subject: [PATCH 554/697] drm/connector: Initialise max_bpc to the minimum
+ value supported
+
+Using increased bit depth for no reason increases power
+consumption, and differs from the behaviour prior to the
+conversion to use the HDMI helper functions.
+
+Initialise the state max_bpc and requested_max_bpc to the
+minimum value supported. This only affects Raspberry Pi,
+as the other users of the helpers (rockchip/inno_hdmi and
+sunx4i) only support a bit depth of 8.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/display/drm_hdmi_state_helper.c | 2 +-
+ drivers/gpu/drm/drm_connector.c                 | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/display/drm_hdmi_state_helper.c
++++ b/drivers/gpu/drm/display/drm_hdmi_state_helper.c
+@@ -24,7 +24,7 @@ void __drm_atomic_helper_connector_hdmi_
+ 	unsigned int max_bpc = connector->max_bpc;
+ 
+ 	new_conn_state->max_bpc = max_bpc;
+-	new_conn_state->max_requested_bpc = max_bpc;
++	new_conn_state->max_requested_bpc = 8;
+ 	new_conn_state->hdmi.broadcast_rgb = DRM_HDMI_BROADCAST_RGB_AUTO;
+ }
+ EXPORT_SYMBOL(__drm_atomic_helper_connector_hdmi_reset);
+--- a/drivers/gpu/drm/drm_connector.c
++++ b/drivers/gpu/drm/drm_connector.c
+@@ -2723,8 +2723,8 @@ int drm_connector_attach_max_bpc_propert
+ 	}
+ 
+ 	drm_object_attach_property(&connector->base, prop, max);
+-	connector->state->max_requested_bpc = max;
+-	connector->state->max_bpc = max;
++	connector->state->max_requested_bpc = min;
++	connector->state->max_bpc = min;
+ 
+ 	return 0;
+ }
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0555-drm-connector-hdmi-Disable-the-infoframes-by-default.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0555-drm-connector-hdmi-Disable-the-infoframes-by-default.patch
new file mode 100644
index 00000000..a0118fd6
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0555-drm-connector-hdmi-Disable-the-infoframes-by-default.patch
@@ -0,0 +1,55 @@
+From da50fdd23bac000e3626bee189c6f139ebf6e85e Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 21 Nov 2024 18:33:11 +0000
+Subject: [PATCH 555/697] drm/connector: hdmi: Disable the infoframes by
+ default
+
+If an infoframe was ever enabled, duplicate_state would
+memcpy the infoframe including the "set" flag. The
+infoframe functions then never cleared it, so once set
+it was always set. This was most obvious with the HDR
+infoframe as it resulted in bad colour rendering.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/display/drm_hdmi_state_helper.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/gpu/drm/display/drm_hdmi_state_helper.c
++++ b/drivers/gpu/drm/display/drm_hdmi_state_helper.c
+@@ -347,6 +347,8 @@ static int hdmi_generate_avi_infoframe(c
+ 		is_limited_range ? HDMI_QUANTIZATION_RANGE_LIMITED : HDMI_QUANTIZATION_RANGE_FULL;
+ 	int ret;
+ 
++	infoframe->set = false;
++
+ 	ret = drm_hdmi_avi_infoframe_from_display_mode(frame, connector, mode);
+ 	if (ret)
+ 		return ret;
+@@ -376,6 +378,8 @@ static int hdmi_generate_spd_infoframe(c
+ 		&infoframe->data.spd;
+ 	int ret;
+ 
++	infoframe->set = false;
++
+ 	ret = hdmi_spd_infoframe_init(frame,
+ 				      connector->hdmi.vendor,
+ 				      connector->hdmi.product);
+@@ -398,6 +402,8 @@ static int hdmi_generate_hdr_infoframe(c
+ 		&infoframe->data.drm;
+ 	int ret;
+ 
++	infoframe->set = false;
++
+ 	if (connector->max_bpc < 10)
+ 		return 0;
+ 
+@@ -425,6 +431,8 @@ static int hdmi_generate_hdmi_vendor_inf
+ 		&infoframe->data.vendor.hdmi;
+ 	int ret;
+ 
++	infoframe->set = false;
++
+ 	if (!info->has_hdmi_infoframe)
+ 		return 0;
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0556-drm-connector-hdmi-Attempt-YUV422-output-if-RGB-isn-.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0556-drm-connector-hdmi-Attempt-YUV422-output-if-RGB-isn-.patch
new file mode 100644
index 00000000..c4968d67
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0556-drm-connector-hdmi-Attempt-YUV422-output-if-RGB-isn-.patch
@@ -0,0 +1,29 @@
+From 094f00cecb3d55917c1bc0e63a8b549627b108ad Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 21 Nov 2024 18:43:28 +0000
+Subject: [PATCH 556/697] drm/connector: hdmi: Attempt YUV422 output if RGB
+ isn't supported
+
+Drop from RGB to YUV422 output if RGB couldn't be supported
+within the defined max_bpc and TMDS rates, and then try
+dropping max_bpc.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/display/drm_hdmi_state_helper.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/gpu/drm/display/drm_hdmi_state_helper.c
++++ b/drivers/gpu/drm/display/drm_hdmi_state_helper.c
+@@ -294,6 +294,11 @@ hdmi_compute_format(const struct drm_con
+ 		return 0;
+ 	}
+ 
++	if (hdmi_try_format_bpc(connector, conn_state, mode, bpc, HDMI_COLORSPACE_YUV422)) {
++		conn_state->hdmi.output_format = HDMI_COLORSPACE_YUV422;
++		return 0;
++	}
++
+ 	drm_dbg_kms(dev, "Failed. No Format Supported for that bpc count.\n");
+ 
+ 	return -EINVAL;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0557-Adding-Pimidi-kernel-module.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0557-Adding-Pimidi-kernel-module.patch
new file mode 100644
index 00000000..5308d2ee
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0557-Adding-Pimidi-kernel-module.patch
@@ -0,0 +1,1167 @@
+From 932fc0121f73f9f1d35c445fca07f4e1bc7b7cfa Mon Sep 17 00:00:00 2001
+From: Giedrius <giedrius@blokas.io>
+Date: Thu, 21 Nov 2024 08:04:02 +0000
+Subject: [PATCH 557/697] Adding Pimidi kernel module.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Giedrius Trainavičius <giedrius@blokas.io>
+---
+ sound/drivers/Kconfig  |   10 +
+ sound/drivers/Makefile |    2 +
+ sound/drivers/pimidi.c | 1113 ++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 1125 insertions(+)
+ create mode 100644 sound/drivers/pimidi.c
+
+--- a/sound/drivers/Kconfig
++++ b/sound/drivers/Kconfig
+@@ -263,4 +263,14 @@ config SND_AC97_POWER_SAVE_DEFAULT
+ 
+ 	  See SND_AC97_POWER_SAVE for more details.
+ 
++config SND_PIMIDI
++	tristate "Pimidi driver"
++	depends on SND_SEQUENCER && CRC8
++	select SND_RAWMIDI
++	help
++	  Say Y here to include support for Blokas Pimidi.
++
++	  To compile this driver as a module, choose M here: the module
++	  will be called snd-pimidi.
++
+ endif	# SND_DRIVERS
+--- a/sound/drivers/Makefile
++++ b/sound/drivers/Makefile
+@@ -9,6 +9,7 @@ snd-aloop-y := aloop.o
+ snd-mtpav-y := mtpav.o
+ snd-mts64-y := mts64.o
+ snd-pcmtest-y := pcmtest.o
++snd-pimidi-y := pimidi.o
+ snd-portman2x4-y := portman2x4.o
+ snd-serial-u16550-y := serial-u16550.o
+ snd-serial-generic-y := serial-generic.o
+@@ -23,6 +24,7 @@ obj-$(CONFIG_SND_SERIAL_U16550) += snd-s
+ obj-$(CONFIG_SND_SERIAL_GENERIC) += snd-serial-generic.o
+ obj-$(CONFIG_SND_MTPAV) += snd-mtpav.o
+ obj-$(CONFIG_SND_MTS64) += snd-mts64.o
++obj-$(CONFIG_SND_PIMIDI) += snd-pimidi.o
+ obj-$(CONFIG_SND_PORTMAN2X4) += snd-portman2x4.o
+ 
+ obj-$(CONFIG_SND) += opl3/ opl4/ mpu401/ vx/ pcsp/
+--- /dev/null
++++ b/sound/drivers/pimidi.c
+@@ -0,0 +1,1113 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * Pimidi Linux kernel module.
++ * Copyright (C) 2017-2024  Vilniaus Blokas UAB, https://blokas.io/
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * as published by the Free Software Foundation; version 2 of the
++ * License.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#include <linux/completion.h>
++#include <linux/module.h>
++#include <linux/i2c.h>
++#include <linux/irq.h>
++#include <linux/irqdesc.h>
++#include <linux/bitops.h>
++#include <linux/of_irq.h>
++#include <linux/kfifo.h>
++#include <linux/list.h>
++#include <linux/workqueue.h>
++#include <linux/gpio.h>
++#include <linux/gpio/consumer.h>
++#include <linux/interrupt.h>
++#include <linux/mutex.h>
++#include <linux/refcount.h>
++#include <linux/crc8.h>
++#include <linux/delay.h>
++
++#include <sound/core.h>
++#include <sound/initval.h>
++#include <sound/rawmidi.h>
++#include <sound/asequencer.h>
++#include <sound/info.h>
++
++#define PIMIDI_LOG_IMPL(instance, log_func, msg, ...) log_func("pimidi(%s)[%c]: " msg "\n", \
++	__func__, (instance) ? (instance)->d + '0' : 'G', ## __VA_ARGS__)
++
++#ifdef PIMIDI_DEBUG
++#	define printd(instance, ...) PIMIDI_LOG_IMPL(instance, pr_alert, __VA_ARGS__)
++#	define printd_rl(instance, ...) PIMIDI_LOG_IMPL(instance, pr_alert_ratelimited, __VA_ARGS__)
++#	define printd_g(...) printd((struct pimidi_instance *)NULL, __VA_ARGS__)
++#else
++#	define printd(instance, ...) do {} while (0)
++#	define printd_rl(instance, ...) do {} while (0)
++#	define printd_g(...) do {} while (0)
++#endif
++
++#define printe(instance, ...) PIMIDI_LOG_IMPL(instance, pr_err, __VA_ARGS__)
++#define printe_rl(instance, ...) PIMIDI_LOG_IMPL(instance, pr_err_ratelimited, __VA_ARGS__)
++#define printi(instance, ...) PIMIDI_LOG_IMPL(instance, pr_info, __VA_ARGS__)
++#define printw(instance, ...) PIMIDI_LOG_IMPL(instance, pr_warn, __VA_ARGS__)
++#define printw_rl(instance, ...) PIMIDI_LOG_IMPL(instance, pr_warn_ratelimited, __VA_ARGS__)
++
++#define printe_g(...) printe((struct pimidi_instance *)NULL, __VA_ARGS__)
++#define printi_g(...) printi((struct pimidi_instance *)NULL, __VA_ARGS__)
++
++DECLARE_CRC8_TABLE(pimidi_crc8_table);
++enum { PIMIDI_CRC8_POLYNOMIAL = 0x83 };
++enum { PIMIDI_MAX_DEVICES = 4 };
++enum { PIMIDI_MAX_PACKET_SIZE = 17 };
++enum { PIMIDI_PORTS = 2 };
++
++struct pimidi_shared {
++	// lock protects the shared reset_gpio and devices list.
++	struct mutex            lock;
++	struct gpio_desc        *reset_gpio;
++	struct workqueue_struct *work_queue;
++	struct list_head        devices;
++};
++
++static struct pimidi_shared pimidi_global = {
++	.devices = LIST_HEAD_INIT(pimidi_global.devices),
++};
++
++struct pimidi_version_t {
++	u8 hwrev;
++	u8 major;
++	u8 minor;
++	u8 build;
++};
++
++enum { PIMIDI_IN_FIFO_SIZE = 4096 };
++
++struct pimidi_midi_port {
++	// in_lock protects the input substream.
++	struct mutex                      in_lock;
++	// out_lock protects the output substream.
++	struct mutex                      out_lock;
++	DECLARE_KFIFO(in_fifo, uint8_t, PIMIDI_IN_FIFO_SIZE);
++	unsigned int                      last_output_at;
++	unsigned int                      output_buffer_used_in_millibytes;
++	struct work_struct                in_handler;
++	struct delayed_work               out_handler;
++	unsigned long                     enabled_streams;
++	unsigned int                      tx_cnt;
++	unsigned int                      rx_cnt;
++};
++
++struct pimidi_instance {
++	struct list_head                  list;
++	struct i2c_client                 *i2c_client;
++	struct pimidi_version_t           version;
++	char                              serial[11];
++	char                              d;
++	struct gpio_desc                  *data_ready_gpio;
++
++	struct work_struct                drdy_handler;
++
++	// comm_lock serializes I2C communication.
++	struct mutex                      comm_lock;
++	char                              *rx_buf;
++	size_t                            rx_len;
++	int                               rx_status;
++	struct completion                 *rx_completion;
++
++	struct snd_rawmidi                *rawmidi;
++	struct pimidi_midi_port           midi_port[PIMIDI_PORTS];
++	bool                              stopping;
++};
++
++static struct snd_rawmidi_substream *pimidi_find_substream(struct snd_rawmidi *rawmidi,
++							   int stream,
++							   int number
++	)
++{
++	struct snd_rawmidi_substream *substream;
++
++	list_for_each_entry(substream, &rawmidi->streams[stream].substreams, list) {
++		if (substream->number == number)
++			return substream;
++	}
++	return NULL;
++}
++
++static void pimidi_midi_in_handler(struct pimidi_instance *instance, int port)
++{
++	int i, n, err;
++
++	printd(instance, "(%d)", port);
++
++	struct pimidi_midi_port *midi_port = &instance->midi_port[port];
++
++	if (!test_bit(SNDRV_RAWMIDI_STREAM_INPUT, &midi_port->enabled_streams)) {
++		printd(instance, "Input not enabled for %d", port);
++		return;
++	}
++
++	u8 data[512];
++
++	n = kfifo_out_peek(&midi_port->in_fifo, data, sizeof(data));
++	printd(instance, "Peeked %d MIDI bytes", n);
++
++	mutex_lock(&midi_port->in_lock);
++	struct snd_rawmidi_substream *substream =
++		pimidi_find_substream(instance->rawmidi,
++				      SNDRV_RAWMIDI_STREAM_INPUT,
++				      port);
++
++	err = snd_rawmidi_receive(substream, data, n);
++	if (err > 0)
++		midi_port->rx_cnt += err;
++	mutex_unlock(&midi_port->in_lock);
++
++	for (i = 0; i < err; ++i)
++		kfifo_skip(&midi_port->in_fifo);
++
++	if (n != err)
++		printw_rl(instance,
++			  "Not all MIDI data consumed for port %d: %d / %d", port, err, n);
++
++	if (!kfifo_is_empty(&midi_port->in_fifo) && !instance->stopping)
++		queue_work(pimidi_global.work_queue, &midi_port->in_handler);
++
++	printd(instance, "Done");
++}
++
++static void pimidi_midi_in_handler_0(struct work_struct *work)
++{
++	pimidi_midi_in_handler(container_of(work, struct pimidi_instance, midi_port[0].in_handler),
++			       0);
++}
++
++static void pimidi_midi_in_handler_1(struct work_struct *work)
++{
++	pimidi_midi_in_handler(container_of(work, struct pimidi_instance, midi_port[1].in_handler),
++			       1);
++}
++
++static void pimidi_midi_out_handler(struct pimidi_instance *instance, int port)
++{
++	printd(instance, "(%d)", port);
++	if (!test_bit(SNDRV_RAWMIDI_STREAM_OUTPUT, &instance->midi_port[port].enabled_streams)) {
++		printd(instance, "Output not enabled for %d", port);
++		return;
++	}
++
++	struct pimidi_midi_port *midi_port = &instance->midi_port[port];
++
++	struct snd_rawmidi_substream *substream =
++		pimidi_find_substream(instance->rawmidi, SNDRV_RAWMIDI_STREAM_OUTPUT, port);
++
++	mutex_lock(&midi_port->out_lock);
++
++	enum { MIDI_MILLI_BYTES_PER_JIFFY = 3125000 / HZ };
++	enum { MIDI_MAX_OUTPUT_BUFFER_SIZE_IN_MILLIBYTES =
++		(512 - PIMIDI_MAX_PACKET_SIZE - 1) * 1000 };
++
++	unsigned int now = jiffies;
++	unsigned int millibytes_became_available =
++		(MIDI_MILLI_BYTES_PER_JIFFY) * (now - midi_port->last_output_at);
++
++	midi_port->output_buffer_used_in_millibytes =
++		midi_port->output_buffer_used_in_millibytes <=
++		millibytes_became_available ? 0 : midi_port->output_buffer_used_in_millibytes -
++		millibytes_became_available;
++
++	unsigned int output_buffer_available =
++		(MIDI_MAX_OUTPUT_BUFFER_SIZE_IN_MILLIBYTES
++		- midi_port->output_buffer_used_in_millibytes)
++		/ 1000;
++
++	u8 buffer[PIMIDI_MAX_PACKET_SIZE];
++	int n, batch, err;
++
++	for (batch = 0; batch < 3; ++batch) {
++		if (output_buffer_available == 0)
++			printd(instance, "Buffer full");
++
++		printd(instance, "Buffer available: %u (%u +%u, %u -> %u, dt %u) (%u) @ %u",
++		       output_buffer_available, midi_port->output_buffer_used_in_millibytes,
++		       millibytes_became_available, midi_port->last_output_at, now,
++		       now - midi_port->last_output_at, midi_port->tx_cnt, HZ);
++		midi_port->last_output_at = now;
++
++		n = output_buffer_available
++			? snd_rawmidi_transmit_peek(substream, buffer + 1,
++						    min(output_buffer_available,
++							sizeof(buffer) - 2))
++			: 0;
++		if (n > 0) {
++			printd(instance, "Peeked: %d", n);
++			snd_rawmidi_transmit_ack(substream, n);
++
++			buffer[0] = (port << 4) | n;
++			buffer[n + 1] = ~crc8(pimidi_crc8_table, buffer, n + 1, CRC8_INIT_VALUE);
++
++#ifdef PIMIDI_DEBUG
++			pr_debug("%s[%d]: Sending %d bytes:", __func__, instance->d, n + 2);
++			int i;
++
++			for (i = 0; i < n + 2; ++i)
++				pr_cont(" %02x", buffer[i]);
++
++			pr_cont("\n");
++#endif
++			mutex_lock(&instance->comm_lock);
++			err = i2c_master_send(instance->i2c_client, buffer, n + 2);
++			mutex_unlock(&instance->comm_lock);
++
++			if (err < 0) {
++				printe(instance,
++				       "Error occurred when sending MIDI data over I2C! (%d)",
++				       err);
++				goto cleanup;
++			}
++
++			midi_port->tx_cnt += n;
++			midi_port->output_buffer_used_in_millibytes += n * 1000;
++			output_buffer_available -= n;
++		} else if (n < 0) {
++			err = n;
++			printe(instance, "snd_rawmidi_transmit_peek returned error %d!", err);
++			goto cleanup;
++		} else {
++			break;
++		}
++	}
++
++	printd(instance, "Checking if empty %p", substream);
++	if (!snd_rawmidi_transmit_empty(substream) && !instance->stopping) {
++		unsigned int delay = 1;
++
++		if (output_buffer_available == 0)
++			delay = 125000 / MIDI_MILLI_BYTES_PER_JIFFY;
++		printd(instance, "Queue more work after %u jiffies", delay);
++		mod_delayed_work(pimidi_global.work_queue, &midi_port->out_handler, delay);
++	}
++
++cleanup:
++	mutex_unlock(&midi_port->out_lock);
++	printd(instance, "Done");
++}
++
++static void pimidi_midi_out_handler_0(struct work_struct *work)
++{
++	pimidi_midi_out_handler(container_of(work, struct pimidi_instance,
++					     midi_port[0].out_handler.work), 0);
++}
++
++static void pimidi_midi_out_handler_1(struct work_struct *work)
++{
++	pimidi_midi_out_handler(container_of(work, struct pimidi_instance,
++					     midi_port[1].out_handler.work), 1);
++}
++
++static void pimidi_midi_output_trigger(struct snd_rawmidi_substream *substream, int up)
++{
++	struct pimidi_instance *instance = substream->rmidi->private_data;
++
++	printd(instance, "(%d, %d, %d)", substream->stream, substream->number, up);
++
++	if (up == 0) {
++		clear_bit(substream->stream,
++			  &instance->midi_port[substream->number].enabled_streams);
++	} else {
++		set_bit(substream->stream,
++			&instance->midi_port[substream->number].enabled_streams);
++		if (!delayed_work_pending(&instance->midi_port[substream->number].out_handler)) {
++			printd(instance, "Queueing work");
++			queue_delayed_work(pimidi_global.work_queue,
++					   &instance->midi_port[substream->number].out_handler, 0);
++		}
++	}
++}
++
++static void pimidi_midi_output_drain(struct snd_rawmidi_substream *substream)
++{
++	struct pimidi_instance *instance = substream->rmidi->private_data;
++
++	printd(instance, "(%d, %d)", substream->stream, substream->number);
++
++	printd(instance, "Begin draining!");
++
++	queue_delayed_work(pimidi_global.work_queue,
++			   &instance->midi_port[substream->number].out_handler, 0);
++
++	unsigned long deadline = jiffies + 5 * HZ;
++
++	do {
++		printd(instance, "Before flush");
++		while (delayed_work_pending(&instance->midi_port[substream->number].out_handler))
++			flush_delayed_work(&instance->midi_port[substream->number].out_handler);
++		printd(instance, "Flushed");
++	} while (!snd_rawmidi_transmit_empty(substream) && time_before(jiffies, deadline));
++
++	printd(instance, "Done!");
++}
++
++static int pimidi_midi_output_close(struct snd_rawmidi_substream *substream)
++{
++	struct pimidi_instance *instance = substream->rmidi->private_data;
++	struct pimidi_midi_port *midi_port = &instance->midi_port[substream->number];
++
++	mutex_lock(&midi_port->out_lock);
++	clear_bit(substream->stream, &midi_port->enabled_streams);
++	mutex_unlock(&midi_port->out_lock);
++	return 0;
++}
++
++static int pimidi_midi_input_close(struct snd_rawmidi_substream *substream)
++{
++	struct pimidi_instance *instance = substream->rmidi->private_data;
++	struct pimidi_midi_port *midi_port = &instance->midi_port[substream->number];
++
++	mutex_lock(&midi_port->in_lock);
++	clear_bit(substream->stream, &midi_port->enabled_streams);
++	mutex_unlock(&midi_port->in_lock);
++	return 0;
++}
++
++static void pimidi_midi_input_trigger(struct snd_rawmidi_substream *substream, int up)
++{
++	struct pimidi_instance *instance = substream->rmidi->private_data;
++
++	printd(instance, "(%d, %d, %d)", substream->stream, substream->number, up);
++
++	if (up == 0) {
++		clear_bit(substream->stream,
++			  &instance->midi_port[substream->number].enabled_streams);
++		cancel_work_sync(&instance->midi_port[substream->number].in_handler);
++	} else {
++		set_bit(substream->stream,
++			&instance->midi_port[substream->number].enabled_streams);
++		if (!instance->stopping)
++			queue_work(pimidi_global.work_queue,
++				   &instance->midi_port[substream->number].in_handler);
++	}
++}
++
++static void pimidi_get_port_info(struct snd_rawmidi *rmidi, int number,
++				 struct snd_seq_port_info *seq_port_info)
++{
++	printd_g("%p, %d, %p", rmidi, number, seq_port_info);
++	seq_port_info->type =
++		SNDRV_SEQ_PORT_TYPE_MIDI_GENERIC |
++		SNDRV_SEQ_PORT_TYPE_HARDWARE |
++		SNDRV_SEQ_PORT_TYPE_PORT;
++	strscpy(seq_port_info->name, number == 0 ? "a" : "b",
++		sizeof(seq_port_info->name));
++	seq_port_info->midi_voices = 0;
++}
++
++static const struct snd_rawmidi_global_ops pimidi_midi_ops = {
++	.get_port_info = pimidi_get_port_info,
++};
++
++static int pimidi_midi_open(struct snd_rawmidi_substream *substream)
++{
++	printd_g("(%p) stream=%d number=%d", substream, substream->stream, substream->number);
++	return 0;
++}
++
++static const struct snd_rawmidi_ops pimidi_midi_output_ops = {
++	.open = pimidi_midi_open,
++	.close = pimidi_midi_output_close,
++	.trigger = pimidi_midi_output_trigger,
++	.drain = pimidi_midi_output_drain,
++};
++
++static const struct snd_rawmidi_ops pimidi_midi_input_ops = {
++	.open = pimidi_midi_open,
++	.close = pimidi_midi_input_close,
++	.trigger = pimidi_midi_input_trigger,
++};
++
++static int pimidi_register(struct pimidi_instance *instance)
++{
++	int err = 0;
++
++	mutex_lock(&pimidi_global.lock);
++	printd(instance, "Registering...");
++	if (!pimidi_global.reset_gpio) {
++		printd_g("Getting reset pin.");
++		pimidi_global.reset_gpio = gpiod_get(&instance->i2c_client->dev, "reset",
++						     GPIOD_OUT_LOW);
++		if (IS_ERR(pimidi_global.reset_gpio)) {
++			err = PTR_ERR(pimidi_global.reset_gpio);
++			printe_g("gpiod_get failed: %d", err);
++			pimidi_global.reset_gpio = NULL;
++			mutex_unlock(&pimidi_global.lock);
++			return err;
++		}
++	}
++	list_add_tail(&instance->list, &pimidi_global.devices);
++	mutex_unlock(&pimidi_global.lock);
++	return err;
++}
++
++static void pimidi_unregister(struct pimidi_instance *instance)
++{
++	mutex_lock(&pimidi_global.lock);
++	printd(instance, "Unregistering...");
++	list_del(&instance->list);
++	if (list_empty(&pimidi_global.devices)) {
++		printd_g("Releasing reset pin");
++		gpiod_put(pimidi_global.reset_gpio);
++		pimidi_global.reset_gpio = NULL;
++	}
++	mutex_unlock(&pimidi_global.lock);
++}
++
++static void pimidi_perform_reset(void)
++{
++	mutex_lock(&pimidi_global.lock);
++
++	printd_g("Performing reset.");
++
++	struct list_head *p;
++
++	list_for_each(p, &pimidi_global.devices) {
++		struct pimidi_instance *instance = list_entry(p, struct pimidi_instance, list);
++
++		printd(instance, "Pausing...");
++		instance->stopping = true;
++		disable_irq(instance->i2c_client->irq);
++		cancel_work(&instance->drdy_handler);
++
++		int i;
++
++		for (i = 0; i < PIMIDI_PORTS; ++i) {
++			cancel_work(&instance->midi_port[i].in_handler);
++			cancel_delayed_work(&instance->midi_port[i].out_handler);
++		}
++
++		drain_workqueue(pimidi_global.work_queue);
++	}
++
++	printd_g("Reset = low");
++	gpiod_set_value(pimidi_global.reset_gpio, 1);
++
++	list_for_each(p, &pimidi_global.devices) {
++		struct pimidi_instance *instance = list_entry(p, struct pimidi_instance, list);
++
++		if (gpiod_is_active_low(instance->data_ready_gpio))
++			gpiod_toggle_active_low(instance->data_ready_gpio);
++		gpiod_direction_output(instance->data_ready_gpio, 1);
++		printd(instance, "DRDY high");
++	}
++
++	usleep_range(1000, 5000);
++	printd_g("Reset = high");
++	gpiod_set_value(pimidi_global.reset_gpio, 0);
++	msleep(30);
++
++	int i;
++
++	for (i = 0; i < PIMIDI_MAX_DEVICES; ++i) {
++		usleep_range(1000, 3000);
++		list_for_each(p, &pimidi_global.devices) {
++			struct pimidi_instance *instance = list_entry(p, struct pimidi_instance,
++								      list);
++
++			if (instance->d < i)
++				continue;
++			printd(instance, "DRDY -> %d", !gpiod_get_value(instance->data_ready_gpio));
++			gpiod_set_value(instance->data_ready_gpio,
++					!gpiod_get_value(instance->data_ready_gpio));
++		}
++	}
++	usleep_range(16000, 20000);
++
++	list_for_each(p, &pimidi_global.devices) {
++		struct pimidi_instance *instance = list_entry(p, struct pimidi_instance, list);
++
++		if (!gpiod_is_active_low(instance->data_ready_gpio))
++			gpiod_toggle_active_low(instance->data_ready_gpio);
++
++		printd(instance, "DRDY input");
++		gpiod_direction_input(instance->data_ready_gpio);
++
++		printd(instance, "Resume...");
++		instance->stopping = false;
++		enable_irq(instance->i2c_client->irq);
++	}
++
++	printd_g("Reset done.");
++	usleep_range(16000, 20000);
++
++	mutex_unlock(&pimidi_global.lock);
++}
++
++static int pimidi_read_version(struct pimidi_version_t *version, struct pimidi_instance *instance)
++{
++	memset(version, 0, sizeof(*version));
++
++	const char cmd[4] = { 0xb2, 0x01, 0x01, 0x95 };
++
++	char result[9];
++
++	memset(result, 0, sizeof(result));
++
++	DECLARE_COMPLETION_ONSTACK(done);
++
++	mutex_lock(&instance->comm_lock);
++	int err = i2c_master_send(instance->i2c_client, cmd, sizeof(cmd));
++
++	if (err < 0) {
++		mutex_unlock(&instance->comm_lock);
++		return err;
++	}
++	instance->rx_buf = result;
++	instance->rx_len = sizeof(result);
++	instance->rx_completion = &done;
++	mutex_unlock(&instance->comm_lock);
++
++	printd(instance, "Waiting for drdy");
++	wait_for_completion_io_timeout(&done, msecs_to_jiffies(1000u));
++	printd(instance, "Done waiting");
++
++	if (!completion_done(&done)) {
++		mutex_lock(&instance->comm_lock);
++		instance->rx_buf = NULL;
++		instance->rx_len = 0;
++		instance->rx_status = -ETIMEDOUT;
++		instance->rx_completion = NULL;
++		mutex_unlock(&instance->comm_lock);
++		return -ETIMEDOUT;
++	}
++
++	if (CRC8_GOOD_VALUE(pimidi_crc8_table) != crc8(pimidi_crc8_table, result, sizeof(result),
++						       CRC8_INIT_VALUE))
++		return -EIO;
++
++	const char expected[4] = { 0xb7, 0x81, 0x01, 0x00 };
++
++	if (memcmp(result, expected, sizeof(expected)) != 0)
++		return -EPROTO;
++
++	u32 v = ntohl(*(uint32_t *)(result + 4));
++
++	version->hwrev = v >> 24;
++	version->major = (v & 0x00ff0000) >> 16;
++	version->minor = (v & 0x0000ff00) >> 8;
++	version->build = v & 0x000000ff;
++
++	return 0;
++}
++
++static int pimidi_read_serial(char serial[11], struct pimidi_instance *instance)
++{
++	memset(serial, 0, sizeof(char[11]));
++
++	const char cmd[4] = { 0xb2, 0x03, 0x04, 0x97 };
++
++	char result[PIMIDI_MAX_PACKET_SIZE];
++
++	memset(result, 0, sizeof(result));
++
++	DECLARE_COMPLETION_ONSTACK(done);
++
++	mutex_lock(&instance->comm_lock);
++	int err = i2c_master_send(instance->i2c_client, cmd, sizeof(cmd));
++
++	if (err < 0) {
++		mutex_unlock(&instance->comm_lock);
++		return err;
++	}
++	instance->rx_buf = result;
++	instance->rx_len = sizeof(result);
++	instance->rx_completion = &done;
++	mutex_unlock(&instance->comm_lock);
++
++	printd(instance, "Waiting for drdy");
++	wait_for_completion_io_timeout(&done, msecs_to_jiffies(1000u));
++	printd(instance, "Done waiting");
++
++	if (!completion_done(&done)) {
++		mutex_lock(&instance->comm_lock);
++		instance->rx_buf = NULL;
++		instance->rx_len = 0;
++		instance->rx_status = -ETIMEDOUT;
++		instance->rx_completion = NULL;
++		mutex_unlock(&instance->comm_lock);
++		printe(instance, "Timed out");
++		return -ETIMEDOUT;
++	}
++
++	if (CRC8_GOOD_VALUE(pimidi_crc8_table) != crc8(pimidi_crc8_table, result,
++						       (result[0] & 0x0f) + 2, CRC8_INIT_VALUE))
++		return -EIO;
++
++	const char expected[4] = { 0xbd, 0x83, 0x04, 0x0a };
++
++	if (memcmp(result, expected, sizeof(expected)) != 0) {
++		printe(instance, "Unexpected response: %02x %02x %02x %02x", result[0], result[1],
++		       result[2], result[3]);
++		return -EPROTO;
++	}
++
++	memcpy(serial, result + 4, 10);
++
++	if (strspn(serial, "\xff") == 10)
++		strscpy(serial, "(unset)", 8);
++
++	return 0;
++}
++
++static void pimidi_handle_midi_data(struct pimidi_instance *instance, int port, const uint8_t *data,
++				    unsigned int n)
++{
++	printd(instance, "Handling MIDI data for port %d (%u bytes)", port, n);
++	if (n == 0)
++		return;
++
++	struct pimidi_midi_port *midi_port = &instance->midi_port[port];
++
++	kfifo_in(&midi_port->in_fifo, data, n);
++
++	if (!instance->stopping)
++		queue_work(pimidi_global.work_queue, &midi_port->in_handler);
++
++	printd(instance, "Done");
++}
++
++static void pimidi_drdy_continue(struct pimidi_instance *instance)
++{
++	if (instance->stopping) {
++		printd(instance, "Refusing to queue work / enable IRQ due to stopping.");
++		return;
++	}
++
++	if (gpiod_get_value(instance->data_ready_gpio)) {
++		printd_rl(instance, "Queue work due to DRDY line still low");
++		queue_work(pimidi_global.work_queue, &instance->drdy_handler);
++	} else {
++		printd_rl(instance, "Enabling irq for more data");
++		enable_irq(gpiod_to_irq(instance->data_ready_gpio));
++	}
++}
++
++static void pimidi_drdy_handler(struct work_struct *work)
++{
++	struct pimidi_instance *instance = container_of(work, struct pimidi_instance, drdy_handler);
++
++	printd(instance, "(%p)", work);
++
++	mutex_lock(&instance->comm_lock);
++	if (!instance->rx_completion) {
++		u8 data[PIMIDI_MAX_PACKET_SIZE];
++		int n = i2c_master_recv(instance->i2c_client, data, 3);
++
++		if (n < 0) {
++			printe(instance, "Error reading from device: %d", n);
++			mutex_unlock(&instance->comm_lock);
++			pimidi_drdy_continue(instance);
++			return;
++		}
++
++		if (data[0] == 0xfe) {
++			printe_rl(instance, "Invalid packet 0x%02x 0x%02x 0x%02x", data[0], data[1],
++				  data[2]);
++			mutex_unlock(&instance->comm_lock);
++			pimidi_drdy_continue(instance);
++			return;
++		}
++
++		int len = (data[0] & 0x0f) + 2;
++
++		if (len > n) {
++			printd(instance, "Need %d more bytes", len - n);
++			int err = i2c_master_recv(instance->i2c_client, data + n, len - n);
++
++			if (err < 0) {
++				printe(instance, "Error reading remainder from device: %d", err);
++				mutex_unlock(&instance->comm_lock);
++				pimidi_drdy_continue(instance);
++				return;
++#ifdef PIMIDI_DEBUG
++			} else {
++				pr_debug("Recv_2:");
++				int i;
++
++				for (i = n; i < len; ++i)
++					pr_cont(" %02x", data[i]);
++				pr_cont("\n");
++#endif
++			}
++		}
++
++		if (CRC8_GOOD_VALUE(pimidi_crc8_table) == crc8(pimidi_crc8_table, data, len,
++							       CRC8_INIT_VALUE)) {
++			switch (data[0] & 0xf0) {
++			case 0x00:
++				pimidi_handle_midi_data(instance, 0, data + 1, len - 2);
++				break;
++			case 0x10:
++				pimidi_handle_midi_data(instance, 1, data + 1, len - 2);
++				break;
++			default:
++				printd(instance, "Unhandled command %02x", data[0]);
++				break;
++			}
++		} else {
++			printe(instance, "I2C rx corruption detected.");
++			pr_info("Packet [%d]:", len);
++			int i;
++
++			for (i = 0; i < len; ++i)
++				pr_cont(" %02x", data[i]);
++			pr_cont("\n");
++		}
++
++		mutex_unlock(&instance->comm_lock);
++	} else {
++		printd(instance, "Completing drdy");
++		instance->rx_status = i2c_master_recv(instance->i2c_client, instance->rx_buf, 3);
++		printd(instance, "Recv_1 %02x %02x %02x", instance->rx_buf[0], instance->rx_buf[1],
++		       instance->rx_buf[2]);
++		if (instance->rx_len > 3 && instance->rx_status == 3) {
++			instance->rx_status = i2c_master_recv(instance->i2c_client,
++							      instance->rx_buf + 3,
++							      instance->rx_len - 3);
++			if (instance->rx_status >= 0)
++				instance->rx_status += 3;
++#ifdef PIMIDI_DEBUG
++			pr_debug("Recv_2:");
++			int i;
++
++			for (i = 3; i < instance->rx_len; ++i)
++				pr_cont(" %02x", instance->rx_buf[i]);
++			pr_cont("\n");
++#endif
++		}
++		struct completion *done = instance->rx_completion;
++
++		instance->rx_buf = NULL;
++		instance->rx_len = 0;
++		instance->rx_completion = NULL;
++		complete_all(done);
++		mutex_unlock(&instance->comm_lock);
++	}
++
++	pimidi_drdy_continue(instance);
++}
++
++static irqreturn_t pimidi_drdy_interrupt_handler(int irq, void *dev_id)
++{
++	struct pimidi_instance *instance = (struct pimidi_instance *)dev_id;
++
++	if (instance->stopping) {
++		printd(instance, "DRDY interrupt, but stopping, ignoring...");
++		return IRQ_HANDLED;
++	}
++
++	printd(instance, "DRDY interrupt, masking");
++	disable_irq_nosync(irq);
++
++	printd(instance, "Queue work due to DRDY interrupt");
++	queue_work(pimidi_global.work_queue, &instance->drdy_handler);
++
++	return IRQ_HANDLED;
++}
++
++static void pimidi_proc_stat_show(struct snd_info_entry *entry, struct snd_info_buffer *buffer)
++{
++	const unsigned int *d = entry->private_data;
++
++	snd_iprintf(buffer, "%u\n", *d);
++}
++
++static void pimidi_proc_serial_show(struct snd_info_entry *entry, struct snd_info_buffer *buffer)
++{
++	struct pimidi_instance *instance = entry->private_data;
++
++	snd_iprintf(buffer, "%s\n", instance->serial);
++}
++
++static void pimidi_proc_version_show(struct snd_info_entry *entry, struct snd_info_buffer *buffer)
++{
++	struct pimidi_instance *instance = entry->private_data;
++
++	snd_iprintf(buffer, "%u.%u.%u\n", instance->version.major, instance->version.minor,
++		    instance->version.build);
++}
++
++static void pimidi_proc_hwrev_show(struct snd_info_entry *entry, struct snd_info_buffer *buffer)
++{
++	struct pimidi_instance *instance = entry->private_data;
++
++	snd_iprintf(buffer, "%u\n", instance->version.hwrev);
++}
++
++static int pimidi_i2c_probe(struct i2c_client *client)
++{
++	struct snd_card *card = NULL;
++	int err, d, i;
++
++	d = client->addr - 0x20;
++
++	if (d < 0 || d >= 8) {
++		printe_g("Unexpected device address: %d", client->addr);
++		err = -EINVAL;
++		goto finalize;
++	}
++
++	err = snd_card_new(&client->dev, SNDRV_DEFAULT_IDX1, SNDRV_DEFAULT_STR1, THIS_MODULE,
++			   sizeof(struct pimidi_instance), &card);
++
++	if (err) {
++		printe_g("snd_card_new failed: %d", err);
++		return err;
++	}
++
++	struct pimidi_instance *instance = (struct pimidi_instance *)card->private_data;
++
++	instance->i2c_client = client;
++	instance->d = d;
++
++	struct snd_rawmidi *rawmidi;
++
++	err = snd_rawmidi_new(card, card->shortname, 0, 2, 2, &rawmidi);
++	if (err < 0) {
++		printe(instance, "snd_rawmidi_new failed: %d", err);
++		goto finalize;
++	}
++
++	instance->rawmidi = rawmidi;
++	strscpy(rawmidi->name, "pimidi", sizeof(rawmidi->name));
++
++	rawmidi->info_flags =
++		SNDRV_RAWMIDI_INFO_OUTPUT | SNDRV_RAWMIDI_INFO_INPUT | SNDRV_RAWMIDI_INFO_DUPLEX;
++	rawmidi->private_data = instance;
++	rawmidi->ops = &pimidi_midi_ops;
++
++	snd_rawmidi_set_ops(rawmidi, SNDRV_RAWMIDI_STREAM_OUTPUT, &pimidi_midi_output_ops);
++	snd_rawmidi_set_ops(rawmidi, SNDRV_RAWMIDI_STREAM_INPUT, &pimidi_midi_input_ops);
++
++	instance->data_ready_gpio = devm_gpiod_get(&client->dev, "data-ready", GPIOD_OUT_HIGH);
++	if (IS_ERR(instance->data_ready_gpio)) {
++		err = PTR_ERR(instance->data_ready_gpio);
++		printe(instance, "devm_gpiod_get failed: %d", err);
++		goto finalize;
++	}
++
++	err = pimidi_register(instance);
++	if (err < 0) {
++		printe(instance, "pimidi_register failed: %d", err);
++		goto finalize;
++	}
++
++	pimidi_perform_reset();
++
++	INIT_WORK(&instance->drdy_handler, pimidi_drdy_handler);
++	mutex_init(&instance->comm_lock);
++
++	err = devm_request_irq(&client->dev, client->irq, pimidi_drdy_interrupt_handler,
++			       IRQF_SHARED | IRQF_TRIGGER_LOW, "data_ready_int", instance);
++
++	if (err != 0) {
++		printe(instance, "data_available IRQ request failed! %d", err);
++		goto finalize;
++	}
++
++	err = pimidi_read_version(&instance->version, instance);
++	if (err < 0) {
++		printe(instance, "pimidi_read_version failed: %d", err);
++		goto finalize;
++	}
++
++	err = pimidi_read_serial(instance->serial, instance);
++	if (err < 0) {
++		printe(instance, "pimidi_read_serial failed: %d", err);
++		goto finalize;
++	} else if (instance->serial[0] != 'P' || instance->serial[1] != 'M' ||
++		   strlen(instance->serial) != 10) {
++		printe(instance, "Unexpected serial number: %s", instance->serial);
++		err = -EIO;
++		goto finalize;
++	}
++
++	printi(instance, "pimidi%d hw:%d version %u.%u.%u-%u, serial %s",
++	       d,
++	       card->number,
++	       instance->version.major,
++	       instance->version.minor,
++	       instance->version.build,
++	       instance->version.hwrev,
++	       instance->serial
++	       );
++
++	strscpy(card->driver, "snd-pimidi", sizeof(card->driver));
++	snprintf(card->shortname, sizeof(card->shortname), "pimidi%d", d);
++	snprintf(card->longname, sizeof(card->longname), "pimidi%d %s", d, instance->serial);
++	snprintf(card->id, sizeof(card->id), "pimidi%d", d);
++
++	snprintf(pimidi_find_substream(rawmidi, SNDRV_RAWMIDI_STREAM_OUTPUT, 0)->name,
++		 10u, "pimidi%d-a", d);
++	snprintf(pimidi_find_substream(rawmidi, SNDRV_RAWMIDI_STREAM_INPUT,  0)->name,
++		 10u, "pimidi%d-a", d);
++	snprintf(pimidi_find_substream(rawmidi, SNDRV_RAWMIDI_STREAM_OUTPUT, 1)->name,
++		 10u, "pimidi%d-b", d);
++	snprintf(pimidi_find_substream(rawmidi, SNDRV_RAWMIDI_STREAM_INPUT,  1)->name,
++		 10u, "pimidi%d-b", d);
++
++	err = snd_card_ro_proc_new(card, "a-tx", &instance->midi_port[0].tx_cnt,
++				   pimidi_proc_stat_show);
++	err = snd_card_ro_proc_new(card, "a-rx", &instance->midi_port[0].rx_cnt,
++				   pimidi_proc_stat_show);
++	err = snd_card_ro_proc_new(card, "b-tx", &instance->midi_port[1].tx_cnt,
++				   pimidi_proc_stat_show);
++	err = snd_card_ro_proc_new(card, "b-rx", &instance->midi_port[1].rx_cnt,
++				   pimidi_proc_stat_show);
++	err = snd_card_ro_proc_new(card, "serial", instance, pimidi_proc_serial_show);
++	err = snd_card_ro_proc_new(card, "version", instance, pimidi_proc_version_show);
++	err = snd_card_ro_proc_new(card, "hwrev", instance, pimidi_proc_hwrev_show);
++	if (err < 0) {
++		printe(instance, "snd_card_ro_proc_new failed: %d", err);
++		goto finalize;
++	}
++
++	err = snd_card_register(card);
++	if (err < 0) {
++		printe(instance, "snd_card_register failed: %d", err);
++		goto finalize;
++	}
++
++finalize:
++	if (err) {
++		instance->stopping = true;
++		cancel_work_sync(&instance->drdy_handler);
++		mutex_destroy(&instance->comm_lock);
++		pimidi_unregister(instance);
++		snd_card_free(card);
++		return err;
++	}
++
++	for (i = 0; i < PIMIDI_PORTS; ++i) {
++		struct pimidi_midi_port *port = &instance->midi_port[i];
++
++		mutex_init(&port->in_lock);
++		mutex_init(&port->out_lock);
++		INIT_WORK(&port->in_handler,
++			  i == 0 ? pimidi_midi_in_handler_0 : pimidi_midi_in_handler_1);
++		INIT_DELAYED_WORK(&port->out_handler,
++				  i == 0 ? pimidi_midi_out_handler_0 : pimidi_midi_out_handler_1);
++		INIT_KFIFO(port->in_fifo);
++		port->last_output_at = jiffies;
++	}
++
++	i2c_set_clientdata(client, card);
++	return 0;
++}
++
++static void pimidi_i2c_remove(struct i2c_client *client)
++{
++	printd_g("(%p)", client);
++
++	int i;
++	struct snd_card *card = i2c_get_clientdata(client);
++
++	if (card) {
++		printi_g("Unloading hw:%d %s", card->number, card->longname);
++		struct pimidi_instance *instance = (struct pimidi_instance *)card->private_data;
++
++		instance->stopping = true;
++		i2c_set_clientdata(client, NULL);
++		devm_free_irq(&client->dev, client->irq, instance);
++		cancel_work_sync(&instance->drdy_handler);
++
++		for (i = 0; i < PIMIDI_PORTS; ++i) {
++			cancel_work_sync(&instance->midi_port[i].in_handler);
++			cancel_delayed_work_sync(&instance->midi_port[i].out_handler);
++			mutex_destroy(&instance->midi_port[i].out_lock);
++			mutex_destroy(&instance->midi_port[i].in_lock);
++			kfifo_free(&instance->midi_port[i].in_fifo);
++		}
++
++		mutex_destroy(&instance->comm_lock);
++		pimidi_unregister(instance);
++		snd_card_free(card);
++	}
++}
++
++static const struct i2c_device_id pimidi_i2c_ids[] = {
++	{ "pimidi", 0 },
++	{}
++};
++MODULE_DEVICE_TABLE(i2c, pimidi_i2c_ids);
++
++static const struct of_device_id pimidi_i2c_dt_ids[] = {
++	{ .compatible = "blokaslabs,pimidi", },
++	{}
++};
++MODULE_DEVICE_TABLE(of, pimidi_i2c_dt_ids);
++
++static struct i2c_driver pimidi_i2c_driver = {
++	.driver = {
++		.name = "pimidi",
++		.owner = THIS_MODULE,
++		.of_match_table = of_match_ptr(pimidi_i2c_dt_ids),
++	},
++	.probe = pimidi_i2c_probe,
++	.remove = pimidi_i2c_remove,
++	.id_table = pimidi_i2c_ids,
++};
++
++static int pimidi_module_init(void)
++{
++	int err = 0;
++
++	mutex_init(&pimidi_global.lock);
++
++	INIT_LIST_HEAD(&pimidi_global.devices);
++
++	pimidi_global.work_queue = create_singlethread_workqueue("pimidi");
++	if (!pimidi_global.work_queue) {
++		err = -ENOMEM;
++		goto cleanup;
++	}
++
++	err = i2c_add_driver(&pimidi_i2c_driver);
++	if (err < 0)
++		goto cleanup;
++
++	crc8_populate_msb(pimidi_crc8_table, PIMIDI_CRC8_POLYNOMIAL);
++
++	return 0;
++
++cleanup:
++	mutex_destroy(&pimidi_global.lock);
++	return err;
++}
++
++static void pimidi_module_exit(void)
++{
++	i2c_del_driver(&pimidi_i2c_driver);
++	mutex_lock(&pimidi_global.lock);
++	if (pimidi_global.reset_gpio) {
++		gpiod_put(pimidi_global.reset_gpio);
++		pimidi_global.reset_gpio = NULL;
++	}
++	mutex_unlock(&pimidi_global.lock);
++
++	destroy_workqueue(pimidi_global.work_queue);
++	pimidi_global.work_queue = NULL;
++
++	mutex_destroy(&pimidi_global.lock);
++}
++
++module_init(pimidi_module_init);
++module_exit(pimidi_module_exit);
++
++MODULE_AUTHOR("Giedrius Trainavi\xc4\x8dius <giedrius@blokas.io>");
++MODULE_DESCRIPTION("MIDI driver for Blokas Pimidi, https://blokas.io/");
++MODULE_LICENSE("GPL");
++
++/* vim: set ts=8 sw=8 noexpandtab: */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0559-Adding-pimidi-overlay.dts.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0559-Adding-pimidi-overlay.dts.patch
new file mode 100644
index 00000000..1ad90b25
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0559-Adding-pimidi-overlay.dts.patch
@@ -0,0 +1,100 @@
+From 2a76aea7356075ebe32456398e4c1080f24c0b67 Mon Sep 17 00:00:00 2001
+From: Giedrius <giedrius@blokas.io>
+Date: Thu, 21 Nov 2024 08:05:49 +0000
+Subject: [PATCH 559/697] Adding pimidi-overlay.dts
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Giedrius Trainavičius <giedrius@blokas.io>
+---
+ arch/arm/boot/dts/overlays/Makefile           |  1 +
+ arch/arm/boot/dts/overlays/README             |  8 +++
+ arch/arm/boot/dts/overlays/pimidi-overlay.dts | 54 +++++++++++++++++++
+ 3 files changed, 63 insertions(+)
+ create mode 100644 arch/arm/boot/dts/overlays/pimidi-overlay.dts
+
+--- a/arch/arm/boot/dts/overlays/Makefile
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -204,6 +204,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
+ 	pifi-dac-zero.dtbo \
+ 	pifi-mini-210.dtbo \
+ 	piglow.dtbo \
++	pimidi.dtbo \
+ 	pineboards-hat-ai.dtbo \
+ 	pineboards-hatdrive-poe-plus.dtbo \
+ 	piscreen.dtbo \
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -3735,6 +3735,14 @@ Load:   dtoverlay=piglow
+ Params: <None>
+ 
+ 
++Name:   pimidi
++Info:   Configures the Blokas Labs Pimidi card
++Load:   dtoverlay=pimidi,<param>=<val>
++Params: sel                     The position used for the sel rotary switch.
++                                Each unit in the stack must be set on a unique
++                                position. If param is omitted, sel=0 is assumed.
++
++
+ Name:   pineboards-hat-ai
+ Info:   Pineboards Hat Ai! overlay for the Google Coral Edge TPU
+ Load:   dtoverlay=pineboards-hat-ai
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pimidi-overlay.dts
+@@ -0,0 +1,54 @@
++/*
++ * Pimidi Linux kernel module.
++ * Copyright (C) 2017-2024  Vilniaus Blokas UAB, https://blokas.io/
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * as published by the Free Software Foundation; version 2 of the
++ * License.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/interrupt-controller/irq.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_arm>;
++		__overlay__ {
++			status = "okay";
++			clock-frequency=<1000000>;
++
++			pimidi_ctrl: pimidi_ctrl@20 {
++				compatible = "blokaslabs,pimidi";
++
++				reg = <0x20>;
++				status = "okay";
++
++				interrupt-parent = <&gpio>;
++				interrupts = <23 IRQ_TYPE_LEVEL_LOW>;
++				interrupt-names = "data_ready";
++				interrupt-controller;
++				#interrupt-cells = <2>;
++
++				data-ready-gpios = <&gpio 23 (GPIO_ACTIVE_LOW | GPIO_PULL_UP)>;
++				reset-gpios = <&gpio 22 (GPIO_ACTIVE_LOW | GPIO_PULL_UP)>;
++			};
++		};
++	};
++
++	__overrides__ {
++		sel = <&pimidi_ctrl>,"reg:0{0=0x20,1=0x21,2=0x22,3=0x23}",
++			<&pimidi_ctrl>,"data-ready-gpios:4{0=23,1=5,2=6,3=27}",
++			<&pimidi_ctrl>,"interrupts:0{0=23,1=5,2=6,3=27}";
++	};
++};
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0560-media-i2c-imx477-Fix-link-frequency-menu.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0560-media-i2c-imx477-Fix-link-frequency-menu.patch
new file mode 100644
index 00000000..6378f889
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0560-media-i2c-imx477-Fix-link-frequency-menu.patch
@@ -0,0 +1,25 @@
+From ef1c0f2f580f6d0fff320370f13d0cda42f5c81b Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 21 Nov 2024 15:54:58 +0000
+Subject: [PATCH 560/697] media: i2c: imx477: Fix link frequency menu
+
+"media: i2c: imx477: Add options for slightly modifying the link freq"
+created a link frequency menu with 2 items in instead of one.
+Correct this.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/imx477.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/imx477.c
++++ b/drivers/media/i2c/imx477.c
+@@ -2051,7 +2051,7 @@ static int imx477_init_controls(struct i
+ 	/* LINK_FREQ is also read only */
+ 	imx477->link_freq =
+ 		v4l2_ctrl_new_int_menu(ctrl_hdlr, &imx477_ctrl_ops,
+-				       V4L2_CID_LINK_FREQ, 1, 0,
++				       V4L2_CID_LINK_FREQ, 0, 0,
+ 				       &link_freqs[imx477->link_freq_idx]);
+ 	if (imx477->link_freq)
+ 		imx477->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0561-misc-rp1-pio-Fix-copy-paste-error-in-pio_rp1.h.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0561-misc-rp1-pio-Fix-copy-paste-error-in-pio_rp1.h.patch
new file mode 100644
index 00000000..930f4af9
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0561-misc-rp1-pio-Fix-copy-paste-error-in-pio_rp1.h.patch
@@ -0,0 +1,25 @@
+From 6471b211626e75e1e9fb3275ab5d2e85d5b7f9c4 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 25 Nov 2024 16:19:55 +0000
+Subject: [PATCH 561/697] misc/rp1-pio: Fix copy/paste error in pio_rp1.h
+
+As per the subject, there was a copy/paste error that caused
+pio_sm_unclaim from a driver to result in a call to
+pio_sm_claim. Fix it.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ include/linux/pio_rp1.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/pio_rp1.h
++++ b/include/linux/pio_rp1.h
+@@ -320,7 +320,7 @@ static inline int pio_sm_unclaim(struct
+ 	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
+ 		return -EINVAL;
+ 
+-	return rp1_pio_sm_claim(client, &args);
++	return rp1_pio_sm_unclaim(client, &args);
+ }
+ 
+ static inline int pio_claim_unused_sm(struct rp1_pio_client *client, bool required)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0562-misc-rp1-pio-Fix-parameter-checks-wihout-client.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0562-misc-rp1-pio-Fix-parameter-checks-wihout-client.patch
new file mode 100644
index 00000000..7511cbd0
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0562-misc-rp1-pio-Fix-parameter-checks-wihout-client.patch
@@ -0,0 +1,25 @@
+From 5268150b90286d326f3b5deef0228de8326f501a Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 25 Nov 2024 21:51:13 +0000
+Subject: [PATCH 562/697] misc: rp1-pio: Fix parameter checks wihout client
+
+Passing bad parameters to an API call without a pio pointer will cause
+a NULL pointer exception when the persistent error is set. Guard
+against that.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ include/linux/pio_rp1.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/pio_rp1.h
++++ b/include/linux/pio_rp1.h
+@@ -20,7 +20,7 @@
+ #endif
+ 
+ #define bad_params_if(client, test) \
+-	({ bool f = (test); if (f) pio_set_error(client, -EINVAL); \
++	({ bool f = (test); if (f && client) pio_set_error(client, -EINVAL); \
+ 		if (f && PARAM_WARNINGS_ENABLED) WARN_ON((test)); \
+ 		f; })
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0563-drm-vc4-dsi-Handle-the-different-command-FIFO-widths.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0563-drm-vc4-dsi-Handle-the-different-command-FIFO-widths.patch
new file mode 100644
index 00000000..4e01b2cd
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0563-drm-vc4-dsi-Handle-the-different-command-FIFO-widths.patch
@@ -0,0 +1,148 @@
+From 6180142e8476ddc8cddf34f33c00acac53a5087d Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 20 Nov 2024 13:58:08 +0000
+Subject: [PATCH 563/697] drm: vc4: dsi: Handle the different command FIFO
+ widths
+
+DSI0 and DSI1 have different widths for the command FIFO (24bit
+vs 32bit), but the driver was assuming the 32bit width of DSI1
+in all cases.
+DSI0 also wants the data packed as 24bit big endian, so the
+formatting code needs updating.
+
+Handle the difference via the variant structure.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_dsi.c | 64 ++++++++++++++++++++++++-----------
+ 1 file changed, 44 insertions(+), 20 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_dsi.c
++++ b/drivers/gpu/drm/vc4/vc4_dsi.c
+@@ -44,7 +44,6 @@
+ 
+ #define DSI_CMD_FIFO_DEPTH  16
+ #define DSI_PIX_FIFO_DEPTH 256
+-#define DSI_PIX_FIFO_WIDTH   4
+ 
+ #define DSI0_CTRL		0x00
+ 
+@@ -170,11 +169,15 @@
+ #define DSI1_DISP1_CTRL		0x2c
+ /* Format of the data written to TXPKT_PIX_FIFO. */
+ # define DSI_DISP1_PFORMAT_MASK		VC4_MASK(2, 1)
+-# define DSI_DISP1_PFORMAT_SHIFT	1
+-# define DSI_DISP1_PFORMAT_16BIT	0
+-# define DSI_DISP1_PFORMAT_24BIT	1
+-# define DSI_DISP1_PFORMAT_32BIT_LE	2
+-# define DSI_DISP1_PFORMAT_32BIT_BE	3
++# define DSI1_DISP1_PFORMAT_SHIFT	1
++# define DSI0_DISP1_PFORMAT_16BIT	0
++# define DSI0_DISP1_PFORMAT_16BIT_ADJ	1
++# define DSI0_DISP1_PFORMAT_24BIT	2
++# define DSI0_DISP1_PFORMAT_32BIT_LE	3 /* NB Invalid, but required for macros to work */
++# define DSI1_DISP1_PFORMAT_16BIT	0
++# define DSI1_DISP1_PFORMAT_24BIT	1
++# define DSI1_DISP1_PFORMAT_32BIT_LE	2
++# define DSI1_DISP1_PFORMAT_32BIT_BE	3
+ 
+ /* DISP1 is always command mode. */
+ # define DSI_DISP1_ENABLE		BIT(0)
+@@ -540,6 +543,7 @@ struct vc4_dsi_variant {
+ 	unsigned int port;
+ 
+ 	bool broken_axi_workaround;
++	unsigned int cmd_fifo_width;
+ 
+ 	const char *debugfs_name;
+ 	const struct debugfs_reg32 *regs;
+@@ -1110,10 +1114,16 @@ static void vc4_dsi_bridge_pre_enable(st
+ 	/* Set up DISP1 for transferring long command payloads through
+ 	 * the pixfifo.
+ 	 */
+-	DSI_PORT_WRITE(DISP1_CTRL,
+-		       VC4_SET_FIELD(DSI_DISP1_PFORMAT_32BIT_LE,
+-				     DSI_DISP1_PFORMAT) |
+-		       DSI_DISP1_ENABLE);
++	if (dsi->variant->cmd_fifo_width == 4)
++		DSI_PORT_WRITE(DISP1_CTRL,
++			       VC4_SET_FIELD(DSI_PORT_BIT(DISP1_PFORMAT_32BIT_LE),
++					     DSI_DISP1_PFORMAT) |
++			       DSI_DISP1_ENABLE);
++	else
++		DSI_PORT_WRITE(DISP1_CTRL,
++			       VC4_SET_FIELD(DSI_PORT_BIT(DISP1_PFORMAT_24BIT),
++					     DSI_DISP1_PFORMAT) |
++			       DSI_DISP1_ENABLE);
+ 
+ 	/* Ungate the block. */
+ 	if (dsi->variant->port == 0)
+@@ -1202,9 +1212,9 @@ static ssize_t vc4_dsi_host_transfer(str
+ 			pix_fifo_len = 0;
+ 		} else {
+ 			cmd_fifo_len = (packet.payload_length %
+-					DSI_PIX_FIFO_WIDTH);
++					dsi->variant->cmd_fifo_width);
+ 			pix_fifo_len = ((packet.payload_length - cmd_fifo_len) /
+-					DSI_PIX_FIFO_WIDTH);
++					dsi->variant->cmd_fifo_width);
+ 		}
+ 
+ 		WARN_ON_ONCE(pix_fifo_len >= DSI_PIX_FIFO_DEPTH);
+@@ -1222,14 +1232,25 @@ static ssize_t vc4_dsi_host_transfer(str
+ 
+ 	for (i = 0; i < cmd_fifo_len; i++)
+ 		DSI_PORT_WRITE(TXPKT_CMD_FIFO, packet.payload[i]);
+-	for (i = 0; i < pix_fifo_len; i++) {
+-		const u8 *pix = packet.payload + cmd_fifo_len + i * 4;
++	if (dsi->variant->cmd_fifo_width == 4) {
++		for (i = 0; i < pix_fifo_len; i++) {
++			const u8 *pix = packet.payload + cmd_fifo_len + i * 4;
++
++			DSI_PORT_WRITE(TXPKT_PIX_FIFO,
++				       pix[0] |
++				       pix[1] << 8 |
++				       pix[2] << 16 |
++				       pix[3] << 24);
++		}
++	} else {
++		for (i = 0; i < pix_fifo_len; i++) {
++			const u8 *pix = packet.payload + cmd_fifo_len + i * 3;
+ 
+-		DSI_PORT_WRITE(TXPKT_PIX_FIFO,
+-			       pix[0] |
+-			       pix[1] << 8 |
+-			       pix[2] << 16 |
+-			       pix[3] << 24);
++			DSI_PORT_WRITE(TXPKT_PIX_FIFO,
++				       pix[2] |
++				       pix[1] << 8 |
++				       pix[0] << 16);
++		}
+ 	}
+ 
+ 	if (msg->flags & MIPI_DSI_MSG_USE_LPM)
+@@ -1437,6 +1458,7 @@ static const struct drm_encoder_funcs vc
+ 
+ static const struct vc4_dsi_variant bcm2711_dsi1_variant = {
+ 	.port			= 1,
++	.cmd_fifo_width		= 4,
+ 	.debugfs_name		= "dsi1_regs",
+ 	.regs			= dsi1_regs,
+ 	.nregs			= ARRAY_SIZE(dsi1_regs),
+@@ -1444,6 +1466,7 @@ static const struct vc4_dsi_variant bcm2
+ 
+ static const struct vc4_dsi_variant bcm2835_dsi0_variant = {
+ 	.port			= 0,
++	.cmd_fifo_width		= 3,
+ 	.debugfs_name		= "dsi0_regs",
+ 	.regs			= dsi0_regs,
+ 	.nregs			= ARRAY_SIZE(dsi0_regs),
+@@ -1451,6 +1474,7 @@ static const struct vc4_dsi_variant bcm2
+ 
+ static const struct vc4_dsi_variant bcm2835_dsi1_variant = {
+ 	.port			= 1,
++	.cmd_fifo_width		= 4,
+ 	.broken_axi_workaround	= true,
+ 	.debugfs_name		= "dsi1_regs",
+ 	.regs			= dsi1_regs,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0564-dts-bcm2712-rpi-For-CM5IO-i2c_csi_dsi-needs-to-be-CA.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0564-dts-bcm2712-rpi-For-CM5IO-i2c_csi_dsi-needs-to-be-CA.patch
new file mode 100644
index 00000000..f2290026
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0564-dts-bcm2712-rpi-For-CM5IO-i2c_csi_dsi-needs-to-be-CA.patch
@@ -0,0 +1,30 @@
+From 72058c59cb78e3a0ffe92460a8b2253d73cdf60c Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 26 Nov 2024 15:53:24 +0000
+Subject: [PATCH 564/697] dts: bcm2712-rpi: For CM5IO, i2c_csi_dsi needs to be
+ CAM/DISP1
+
+Noted setting up a display on CM5IO. Add
+"dtoverlay=vc4-kms-dsi-ili7881-7inch" fails as it tries to
+find the regulator/backlight/touch on i2c_csi_dsi, which pointed
+at i2c_csi_dsi0 by default.
+
+Adding the dsi0 override updated to point at dsi0, and pointed
+the i2c at i2c_csi_dsi0, which all works.
+
+The default with i2c_csi_dsi needs to be consistent in using
+dsi1/csi1 and the corresponding i2c interface (i2c_csi_dsi1).
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5io.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5io.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5io.dtsi
+@@ -11,4 +11,4 @@ i2c_csi_dsi0: &i2c6 { // Note: This is f
+ 	symlink = "i2c-6";
+ };
+ 
+-i2c_csi_dsi: &i2c_csi_dsi0 { }; // The connector that needs no jumper to enable
++i2c_csi_dsi: &i2c_csi_dsi1 { }; // The connector that needs no jumper to enable
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0565-dts-bcm2712-rpi-cm5-Remove-inaccessible-USB_OC_N.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0565-dts-bcm2712-rpi-cm5-Remove-inaccessible-USB_OC_N.patch
new file mode 100644
index 00000000..bde6bc78
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0565-dts-bcm2712-rpi-cm5-Remove-inaccessible-USB_OC_N.patch
@@ -0,0 +1,25 @@
+From d55504adce3471f5d1ab393de6a1f65346ef82e8 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 27 Nov 2024 10:24:47 +0000
+Subject: [PATCH 565/697] dts: bcm2712-rpi-cm5: Remove inaccessible USB_OC_N
+
+Although VBUS_EN on GPIO42 appears on the CM5's 100-way headers,
+USB_OC_N on GPIO43 does not. Remove the signal name to avoid further
+confusion and disappointment.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi
+@@ -676,7 +676,7 @@ spi10_cs_pins: &spi10_cs_gpio1 {};
+ 		"-", // GPIO40
+ 		"-", // GPIO41
+ 		"USB_VBUS_EN", // GPIO42
+-		"USB_OC_N", // GPIO43
++		"-", // GPIO43
+ 		"RP1_STAT_LED", // GPIO44
+ 		"FAN_PWM", // GPIO45
+ 		"-", // GPIO46
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0566-overlays-qca7000-replace-URL-with-textual-hint.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0566-overlays-qca7000-replace-URL-with-textual-hint.patch
new file mode 100644
index 00000000..136ab259
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0566-overlays-qca7000-replace-URL-with-textual-hint.patch
@@ -0,0 +1,33 @@
+From 583481130e5749698434b9bd5382cc7c0f2ff7ca Mon Sep 17 00:00:00 2001
+From: Michael Heimpold <michael.heimpold@chargebyte.com>
+Date: Fri, 29 Nov 2024 14:10:04 +0100
+Subject: [PATCH 566/697] overlays: qca7000: replace URL with textual hint
+
+The deep link into the website is not that stable, so let's
+replace it with a textual description where to find the
+product information.
+
+Signed-off-by: Michael Heimpold <michael.heimpold@chargebyte.com>
+---
+ arch/arm/boot/dts/overlays/qca7000-overlay.dts       | 2 +-
+ arch/arm/boot/dts/overlays/qca7000-uart0-overlay.dts | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/qca7000-overlay.dts
++++ b/arch/arm/boot/dts/overlays/qca7000-overlay.dts
+@@ -1,5 +1,5 @@
+ // Overlay for the Qualcomm Atheros QCA7000 on PLC Stamp micro EVK
+-// Visit: https://chargebyte.com/products/evaluation-tools/plc-stamp-micro-2-evaluation-board for details
++// Visit: https://chargebyte.com -> Controllers & Modules -> Evaluation Tools -> PLC Stamp Micro 2 Evaluation Board for details
+ 
+ /dts-v1/;
+ /plugin/;
+--- a/arch/arm/boot/dts/overlays/qca7000-uart0-overlay.dts
++++ b/arch/arm/boot/dts/overlays/qca7000-uart0-overlay.dts
+@@ -1,5 +1,5 @@
+ // Overlay for the Qualcomm Atheros QCA7000 on PLC Stamp micro EVK
+-// Visit: https://in-tech-smartcharging.com/products/evaluation-tools/plc-stamp-micro-2-evaluation-board for details
++// Visit: https://chargebyte.com -> Controllers & Modules -> Evaluation Tools -> PLC Stamp Micro 2 Evaluation Board for details
+ 
+ /dts-v1/;
+ /plugin/;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0567-dt-bindings-net-cdns-macb-Add-compatible-for-Raspber.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0567-dt-bindings-net-cdns-macb-Add-compatible-for-Raspber.patch
new file mode 100644
index 00000000..f37bad6b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0567-dt-bindings-net-cdns-macb-Add-compatible-for-Raspber.patch
@@ -0,0 +1,24 @@
+From b4e6747e667dfc2ec95470014a24994519fcb528 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 11 Nov 2024 16:38:01 +0000
+Subject: [PATCH 567/697] dt-bindings: net: cdns,macb: Add compatible for
+ Raspberry Pi RP1
+
+The Raspberry Pi RP1 chip has the Cadence GEM ethernet
+controller, so add a compatible string for it.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ Documentation/devicetree/bindings/net/cdns,macb.yaml | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/Documentation/devicetree/bindings/net/cdns,macb.yaml
++++ b/Documentation/devicetree/bindings/net/cdns,macb.yaml
+@@ -54,6 +54,7 @@ properties:
+           - cdns,np4-macb             # NP4 SoC devices
+           - microchip,sama7g5-emac    # Microchip SAMA7G5 ethernet interface
+           - microchip,sama7g5-gem     # Microchip SAMA7G5 gigabit ethernet interface
++          - raspberrypi,rp1-gem       # Raspberry Pi RP1 gigabit ethernet interface
+           - sifive,fu540-c000-gem     # SiFive FU540-C000 SoC
+           - cdns,emac                 # Generic
+           - cdns,gem                  # Generic
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0568-net-macb-Add-support-for-Raspberry-Pi-RP1-ethernet-c.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0568-net-macb-Add-support-for-Raspberry-Pi-RP1-ethernet-c.patch
new file mode 100644
index 00000000..07eb22df
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0568-net-macb-Add-support-for-Raspberry-Pi-RP1-ethernet-c.patch
@@ -0,0 +1,43 @@
+From bb01000f1240bd3d7913020895b17f6fb5f000df Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 11 Nov 2024 16:40:07 +0000
+Subject: [PATCH 568/697] net: macb: Add support for Raspberry Pi RP1 ethernet
+ controller
+
+The RP1 chip has the Cadence GEM block, but wants the tx_clock
+to always run at 125MHz, in the same way as sama7g5.
+Add the relevant configuration.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -5072,6 +5072,17 @@ static const struct macb_config versal_c
+ 	.usrio = &macb_default_usrio,
+ };
+ 
++static const struct macb_config raspberrypi_rp1_config = {
++	.caps = MACB_CAPS_GIGABIT_MODE_AVAILABLE | MACB_CAPS_CLK_HW_CHG |
++		MACB_CAPS_JUMBO |
++		MACB_CAPS_GEM_HAS_PTP,
++	.dma_burst_length = 16,
++	.clk_init = macb_clk_init,
++	.init = macb_init,
++	.usrio = &macb_default_usrio,
++	.jumbo_max_len = 10240,
++};
++
+ static const struct of_device_id macb_dt_ids[] = {
+ 	{ .compatible = "cdns,at91sam9260-macb", .data = &at91sam9260_config },
+ 	{ .compatible = "cdns,macb" },
+@@ -5092,6 +5103,7 @@ static const struct of_device_id macb_dt
+ 	{ .compatible = "microchip,mpfs-macb", .data = &mpfs_config },
+ 	{ .compatible = "microchip,sama7g5-gem", .data = &sama7g5_gem_config },
+ 	{ .compatible = "microchip,sama7g5-emac", .data = &sama7g5_emac_config },
++	{ .compatible = "raspberrypi,rp1-gem", .data = &raspberrypi_rp1_config },
+ 	{ .compatible = "xlnx,zynqmp-gem", .data = &zynqmp_config},
+ 	{ .compatible = "xlnx,zynq-gem", .data = &zynq_config },
+ 	{ .compatible = "xlnx,versal-gem", .data = &versal_config},
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0569-rp1-clk-Only-set-PLL_SEC_RST-in-rp1_pll_divider_off.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0569-rp1-clk-Only-set-PLL_SEC_RST-in-rp1_pll_divider_off.patch
new file mode 100644
index 00000000..ed1b3ea0
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0569-rp1-clk-Only-set-PLL_SEC_RST-in-rp1_pll_divider_off.patch
@@ -0,0 +1,26 @@
+From 5f9331f342532c75f77ba5f0427be6c10f4933ac Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 25 Nov 2024 12:30:06 +0000
+Subject: [PATCH 569/697] rp1: clk: Only set PLL_SEC_RST in rp1_pll_divider_off
+
+Rather than clearing all the bits in rp1_pll_divider_off
+and setting PLL_SEC_RST, retain the status of all the other
+bits.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/clk/clk-rp1.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/clk-rp1.c
++++ b/drivers/clk/clk-rp1.c
+@@ -927,7 +927,8 @@ static void rp1_pll_divider_off(struct c
+ 	const struct rp1_pll_data *data = divider->data;
+ 
+ 	spin_lock(&clockman->regs_lock);
+-	clockman_write(clockman, data->ctrl_reg, PLL_SEC_RST);
++	clockman_write(clockman, data->ctrl_reg,
++		       clockman_read(clockman, data->ctrl_reg) | PLL_SEC_RST);
+ 	spin_unlock(&clockman->regs_lock);
+ }
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0570-rp1-clk-Rationalise-the-use-of-the-CLK_IS_CRITICAL-f.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0570-rp1-clk-Rationalise-the-use-of-the-CLK_IS_CRITICAL-f.patch
new file mode 100644
index 00000000..c4a85b87
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0570-rp1-clk-Rationalise-the-use-of-the-CLK_IS_CRITICAL-f.patch
@@ -0,0 +1,124 @@
+From a9d2f5f0bc8d73484511c7634602e7a35b83880c Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 8 Nov 2024 17:36:13 +0000
+Subject: [PATCH 570/697] rp1: clk: Rationalise the use of the CLK_IS_CRITICAL
+ flag
+
+The clock setup had been copied from clk-bcm2835 which had to cope
+with the firmware having configured clocks, so there were flags
+of CLK_IS_CRITICAL and CLK_IGNORE_UNUSED dotted around.
+
+That isn't the situation with RP1 where only the main PLLs, CLK_SYS,
+and CLK_SLOW_SYS are critical, so update the configuration to match.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/clk/clk-rp1.c | 41 ++++++-----------------------------------
+ 1 file changed, 6 insertions(+), 35 deletions(-)
+
+--- a/drivers/clk/clk-rp1.c
++++ b/drivers/clk/clk-rp1.c
+@@ -1504,8 +1504,6 @@ static const struct clk_ops rp1_varsrc_o
+ 	.round_rate = rp1_varsrc_round_rate,
+ };
+ 
+-static bool rp1_clk_is_claimed(const char *name);
+-
+ static struct clk_hw *rp1_register_pll_core(struct rp1_clockman *clockman,
+ 					    const void *data)
+ {
+@@ -1521,7 +1519,7 @@ static struct clk_hw *rp1_register_pll_c
+ 	init.num_parents = 1;
+ 	init.name = pll_core_data->name;
+ 	init.ops = &rp1_pll_core_ops;
+-	init.flags = pll_core_data->flags | CLK_IGNORE_UNUSED | CLK_IS_CRITICAL;
++	init.flags = pll_core_data->flags | CLK_IS_CRITICAL;
+ 
+ 	pll_core = kzalloc(sizeof(*pll_core), GFP_KERNEL);
+ 	if (!pll_core)
+@@ -1554,7 +1552,7 @@ static struct clk_hw *rp1_register_pll(s
+ 	init.num_parents = 1;
+ 	init.name = pll_data->name;
+ 	init.ops = &rp1_pll_ops;
+-	init.flags = pll_data->flags | CLK_IGNORE_UNUSED | CLK_IS_CRITICAL;
++	init.flags = pll_data->flags | CLK_IGNORE_UNUSED;
+ 
+ 	pll = kzalloc(sizeof(*pll), GFP_KERNEL);
+ 	if (!pll)
+@@ -1635,11 +1633,6 @@ static struct clk_hw *rp1_register_pll_d
+ 	divider->div.hw.init = &init;
+ 	divider->div.table = pll_sec_div_table;
+ 
+-	if (!rp1_clk_is_claimed(divider_data->source_pll))
+-		init.flags |= CLK_IS_CRITICAL;
+-	if (!rp1_clk_is_claimed(divider_data->name))
+-		divider->div.flags |= CLK_IS_CRITICAL;
+-
+ 	divider->clockman = clockman;
+ 	divider->data = divider_data;
+ 
+@@ -1861,6 +1854,8 @@ static const struct rp1_clk_desc clk_des
+ 				.max_freq = 200 * MHz,
+ 				.fc0_src = FC_NUM(0, 4),
+ 				.clk_src_mask = 0x3,
++				/* Always enabled in hardware */
++				.flags = CLK_IS_CRITICAL,
+ 				),
+ 
+ 	[RP1_CLK_SLOW_SYS] = REGISTER_CLK(
+@@ -1875,6 +1870,8 @@ static const struct rp1_clk_desc clk_des
+ 				.max_freq = 50 * MHz,
+ 				.fc0_src = FC_NUM(1, 4),
+ 				.clk_src_mask = 0x1,
++				/* Always enabled in hardware */
++				.flags = CLK_IS_CRITICAL,
+ 				),
+ 
+ 	[RP1_CLK_UART] = REGISTER_CLK(
+@@ -2394,24 +2391,6 @@ static const struct rp1_clk_desc clk_des
+ 	[RP1_CLK_MIPI1_DSI_BYTECLOCK] = REGISTER_VARSRC("clksrc_mipi1_dsi_byteclk"),
+ };
+ 
+-static bool rp1_clk_claimed[ARRAY_SIZE(clk_desc_array)];
+-
+-static bool rp1_clk_is_claimed(const char *name)
+-{
+-	unsigned int i;
+-
+-	for (i = 0; i < ARRAY_SIZE(clk_desc_array); i++) {
+-		if (clk_desc_array[i].data) {
+-			const char *clk_name = *(const char **)(clk_desc_array[i].data);
+-
+-			if (!strcmp(name, clk_name))
+-				return rp1_clk_claimed[i];
+-		}
+-	}
+-
+-	return false;
+-}
+-
+ static int rp1_clk_probe(struct platform_device *pdev)
+ {
+ 	const struct rp1_clk_desc *desc;
+@@ -2422,7 +2401,6 @@ static int rp1_clk_probe(struct platform
+ 	const size_t asize = ARRAY_SIZE(clk_desc_array);
+ 	u32 chip_id, platform;
+ 	unsigned int i;
+-	u32 clk_id;
+ 	int ret;
+ 
+ 	clockman = devm_kzalloc(dev, struct_size(clockman, onecell.hws, asize),
+@@ -2439,13 +2417,6 @@ static int rp1_clk_probe(struct platform
+ 	if (IS_ERR(clockman->regs))
+ 		return PTR_ERR(clockman->regs);
+ 
+-	memset(rp1_clk_claimed, 0, sizeof(rp1_clk_claimed));
+-	for (i = 0;
+-	     !of_property_read_u32_index(pdev->dev.of_node, "claim-clocks",
+-					 i, &clk_id);
+-	     i++)
+-		rp1_clk_claimed[clk_id] = true;
+-
+ 	platform_set_drvdata(pdev, clockman);
+ 
+ 	clockman->onecell.num = asize;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0571-dt-arm64-Fixup-RP1-ethernet-DT-configuration.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0571-dt-arm64-Fixup-RP1-ethernet-DT-configuration.patch
new file mode 100644
index 00000000..c9361d14
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0571-dt-arm64-Fixup-RP1-ethernet-DT-configuration.patch
@@ -0,0 +1,50 @@
+From b235c2406b113594bbf7ef17fbaa017adb4d67c6 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 11 Nov 2024 15:18:14 +0000
+Subject: [PATCH 571/697] dt: arm64: Fixup RP1 ethernet DT configuration
+
+Configure RP1's ethernet block to do the correct thing.
+clk_eth is intended to be fixed at 125MHz, so use a new compatible,
+and use assigned-clocks to configure the clock appropriately.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/rp1.dtsi | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/arch/arm64/boot/dts/broadcom/rp1.dtsi
++++ b/arch/arm64/boot/dts/broadcom/rp1.dtsi
+@@ -32,6 +32,7 @@
+ 					  // RP1_PLL_VIDEO_CORE and dividers are now managed by VEC,DPI drivers
+ 					  <&rp1_clocks RP1_PLL_SYS>,
+ 					  <&rp1_clocks RP1_PLL_SYS_SEC>,
++					  <&rp1_clocks RP1_CLK_ETH>,
+ 					  <&rp1_clocks RP1_PLL_AUDIO>,
+ 					  <&rp1_clocks RP1_PLL_AUDIO_SEC>,
+ 					  <&rp1_clocks RP1_CLK_SYS>,
+@@ -46,6 +47,7 @@
+ 					       <1536000000>, // RP1_PLL_AUDIO_CORE
+ 					       <200000000>,  // RP1_PLL_SYS
+ 					       <125000000>,  // RP1_PLL_SYS_SEC
++					       <125000000>,  // RP1_CLK_ETH
+ 					       <61440000>,   // RP1_PLL_AUDIO
+ 					       <192000000>,  // RP1_PLL_AUDIO_SEC
+ 					       <200000000>,  // RP1_CLK_SYS
+@@ -976,12 +978,14 @@
+ 
+ 		rp1_eth: ethernet@100000 {
+ 			reg = <0xc0 0x40100000  0x0 0x4000>;
+-			compatible = "cdns,macb";
++			compatible = "raspberrypi,rp1-gem", "cdns,macb";
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+ 			interrupts = <RP1_INT_ETH IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&macb_pclk &macb_hclk &rp1_clocks RP1_CLK_ETH_TSU>;
+-			clock-names = "pclk", "hclk", "tsu_clk";
++			clocks = <&macb_pclk &macb_hclk
++				  &rp1_clocks RP1_CLK_ETH_TSU
++				  &rp1_clocks RP1_CLK_ETH>;
++			clock-names = "pclk", "hclk", "tsu_clk", "tx_clk";
+ 			phy-mode = "rgmii-id";
+ 			cdns,aw2w-max-pipe = /bits/ 8 <8>;
+ 			cdns,ar2r-max-pipe = /bits/ 8 <8>;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0572-clk-rp1-Add-RP1_CLK_DMA.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0572-clk-rp1-Add-RP1_CLK_DMA.patch
new file mode 100644
index 00000000..ba81e768
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0572-clk-rp1-Add-RP1_CLK_DMA.patch
@@ -0,0 +1,44 @@
+From aa99f721203150579a82f623897188ad8bfb2068 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 13 Nov 2024 13:10:27 +0000
+Subject: [PATCH 572/697] clk: rp1: Add RP1_CLK_DMA.
+
+The DMA block has a clock, but wasn't defined in the driver. This
+resulted in the parent being disabled as unused, and then DMA
+stopped working.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/clk/clk-rp1.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+--- a/drivers/clk/clk-rp1.c
++++ b/drivers/clk/clk-rp1.c
+@@ -1874,6 +1874,27 @@ static const struct rp1_clk_desc clk_des
+ 				.flags = CLK_IS_CRITICAL,
+ 				),
+ 
++	[RP1_CLK_DMA] = REGISTER_CLK(
++				.name = "clk_dma",
++				.parents = {"pll_sys_pri_ph",
++					    "pll_video",
++					    "xosc",
++					    "clksrc_gp0",
++					    "clksrc_gp1",
++					    "clksrc_gp2",
++					    "clksrc_gp3",
++					    "clksrc_gp4",
++					    "clksrc_gp5"},
++				.num_std_parents = 0,
++				.num_aux_parents = 9,
++				.ctrl_reg = CLK_DMA_CTRL,
++				.div_int_reg = CLK_DMA_DIV_INT,
++				.sel_reg = CLK_DMA_SEL,
++				.div_int_max = DIV_INT_8BIT_MAX,
++				.max_freq = 100 * MHz,
++				.fc0_src = FC_NUM(2, 2),
++				),
++
+ 	[RP1_CLK_UART] = REGISTER_CLK(
+ 				.name = "clk_uart",
+ 				.parents = {"pll_sys_pri_ph",
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0573-rp1-clk-Remove-CLK_IGNORE_UNUSED-flags.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0573-rp1-clk-Remove-CLK_IGNORE_UNUSED-flags.patch
new file mode 100644
index 00000000..35a790be
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0573-rp1-clk-Remove-CLK_IGNORE_UNUSED-flags.patch
@@ -0,0 +1,59 @@
+From c4bcdaa52e667619d9e60b26868deeca6d346508 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 8 Nov 2024 17:37:08 +0000
+Subject: [PATCH 573/697] rp1: clk: Remove CLK_IGNORE_UNUSED flags
+
+There should be no issue in disabling the RP1 clocks as long as
+the kernel knows about all consumers.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/clk/clk-rp1.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/drivers/clk/clk-rp1.c
++++ b/drivers/clk/clk-rp1.c
+@@ -1552,7 +1552,7 @@ static struct clk_hw *rp1_register_pll(s
+ 	init.num_parents = 1;
+ 	init.name = pll_data->name;
+ 	init.ops = &rp1_pll_ops;
+-	init.flags = pll_data->flags | CLK_IGNORE_UNUSED;
++	init.flags = pll_data->flags;
+ 
+ 	pll = kzalloc(sizeof(*pll), GFP_KERNEL);
+ 	if (!pll)
+@@ -1586,7 +1586,7 @@ static struct clk_hw *rp1_register_pll_p
+ 	init.num_parents = 1;
+ 	init.name = ph_data->name;
+ 	init.ops = &rp1_pll_ph_ops;
+-	init.flags = ph_data->flags | CLK_IGNORE_UNUSED;
++	init.flags = ph_data->flags;
+ 
+ 	ph = kzalloc(sizeof(*ph), GFP_KERNEL);
+ 	if (!ph)
+@@ -1619,7 +1619,7 @@ static struct clk_hw *rp1_register_pll_d
+ 	init.num_parents = 1;
+ 	init.name = divider_data->name;
+ 	init.ops = &rp1_pll_divider_ops;
+-	init.flags = divider_data->flags | CLK_IGNORE_UNUSED;
++	init.flags = divider_data->flags;
+ 
+ 	divider = devm_kzalloc(clockman->dev, sizeof(*divider), GFP_KERNEL);
+ 	if (!divider)
+@@ -1662,7 +1662,7 @@ static struct clk_hw *rp1_register_clock
+ 	init.num_parents =
+ 		clock_data->num_std_parents + clock_data->num_aux_parents;
+ 	init.name = clock_data->name;
+-	init.flags = clock_data->flags | CLK_IGNORE_UNUSED;
++	init.flags = clock_data->flags;
+ 	init.ops = &rp1_clk_ops;
+ 
+ 	clock = devm_kzalloc(clockman->dev, sizeof(*clock), GFP_KERNEL);
+@@ -1692,7 +1692,6 @@ static struct clk_hw *rp1_register_varsr
+ 	init.parent_names = &ref_clock;
+ 	init.num_parents = 1;
+ 	init.name = name;
+-	init.flags = CLK_IGNORE_UNUSED;
+ 	init.ops = &rp1_varsrc_ops;
+ 
+ 	clock = devm_kzalloc(clockman->dev, sizeof(*clock), GFP_KERNEL);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0574-dt-rp1-Use-clk_sys-for-ethernet-hclk-and-pclk.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0574-dt-rp1-Use-clk_sys-for-ethernet-hclk-and-pclk.patch
new file mode 100644
index 00000000..e9ce4cc2
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0574-dt-rp1-Use-clk_sys-for-ethernet-hclk-and-pclk.patch
@@ -0,0 +1,45 @@
+From 206679c2e21214bcf268fd71efe3c29b3883ea96 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 11 Nov 2024 17:11:18 +0000
+Subject: [PATCH 574/697] dt: rp1: Use clk_sys for ethernet hclk and pclk
+
+hclk and pclk of the MAC are connected to clk_sys, so define
+them as being connected accordingly, rather than having fake
+fixed clocks for them.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/rp1.dtsi | 15 ++-------------
+ 1 file changed, 2 insertions(+), 13 deletions(-)
+
+--- a/arch/arm64/boot/dts/broadcom/rp1.dtsi
++++ b/arch/arm64/boot/dts/broadcom/rp1.dtsi
+@@ -982,7 +982,8 @@
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+ 			interrupts = <RP1_INT_ETH IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&macb_pclk &macb_hclk
++			clocks = <&rp1_clocks RP1_CLK_SYS
++				  &rp1_clocks RP1_CLK_SYS
+ 				  &rp1_clocks RP1_CLK_ETH_TSU
+ 				  &rp1_clocks RP1_CLK_ETH>;
+ 			clock-names = "pclk", "hclk", "tsu_clk", "tx_clk";
+@@ -1230,18 +1231,6 @@
+ 		clock-output-names = "xosc";
+ 		clock-frequency = <50000000>;
+ 	};
+-	macb_pclk: macb_pclk {
+-		compatible = "fixed-clock";
+-		#clock-cells = <0>;
+-		clock-output-names = "pclk";
+-		clock-frequency = <200000000>;
+-	};
+-	macb_hclk: macb_hclk {
+-		compatible = "fixed-clock";
+-		#clock-cells = <0>;
+-		clock-output-names = "hclk";
+-		clock-frequency = <200000000>;
+-	};
+ 	sdio_src: sdio_src {
+ 		// 400 MHz on FPGA. PLL sys VCO on asic
+ 		compatible = "fixed-clock";
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0575-dt-rp1-Link-RP1-DMA-to-the-associated-clock.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0575-dt-rp1-Link-RP1-DMA-to-the-associated-clock.patch
new file mode 100644
index 00000000..174bd518
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0575-dt-rp1-Link-RP1-DMA-to-the-associated-clock.patch
@@ -0,0 +1,24 @@
+From 2e0bc33c729a2d47864f1cc148b6a93e2766249d Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 13 Nov 2024 13:11:33 +0000
+Subject: [PATCH 575/697] dt: rp1: Link RP1 DMA to the associated clock
+
+This makes the kernel representation of the clock structure
+match reality.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/rp1.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/broadcom/rp1.dtsi
++++ b/arch/arm64/boot/dts/broadcom/rp1.dtsi
+@@ -1081,7 +1081,7 @@
+ 			reg = <0xc0 0x40188000  0x0 0x1000>;
+ 			compatible = "snps,axi-dma-1.01a";
+ 			interrupts = <RP1_INT_DMA IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&sdhci_core &rp1_clocks RP1_CLK_SYS>;
++			clocks = <&rp1_clocks RP1_CLK_DMA &rp1_clocks RP1_CLK_SYS>;
+ 			clock-names = "core-clk", "cfgr-clk";
+ 
+ 			#dma-cells = <1>;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0576-dts-bcm2712-ds-Restore-the-A76-PMU-declaration.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0576-dts-bcm2712-ds-Restore-the-A76-PMU-declaration.patch
new file mode 100644
index 00000000..965802be
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0576-dts-bcm2712-ds-Restore-the-A76-PMU-declaration.patch
@@ -0,0 +1,33 @@
+From c249b6f965d04ddb1514fd4fe20c2a4ad8109744 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 3 Dec 2024 12:00:26 +0000
+Subject: [PATCH 576/697] dts: bcm2712-ds: Restore the A76 PMU declaration
+
+In the move to the upstream bcm2712.dts, the A76 PMU was omitted from
+the required downstream additions.
+
+Link: https://github.com/raspberrypi/linux/issues/6507
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/bcm2712-ds.dtsi | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-ds.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-ds.dtsi
+@@ -23,6 +23,15 @@
+ 	};
+ #endif
+ 
++	arm-pmu {
++		compatible = "arm,cortex-a76-pmu";
++		interrupts = <GIC_SPI 16 IRQ_TYPE_LEVEL_HIGH>,
++			<GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>,
++			<GIC_SPI 18 IRQ_TYPE_LEVEL_HIGH>,
++			<GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH>;
++		interrupt-affinity = <&cpu0>, <&cpu1>, <&cpu2>, <&cpu3>;
++	};
++
+ 	clocks: clocks {
+ 		compatible = "simple-bus";
+ 		#address-cells = <1>;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0577-dts-rp1-Re-enable-DMA-to-RP1-UART0.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0577-dts-rp1-Re-enable-DMA-to-RP1-UART0.patch
new file mode 100644
index 00000000..5fe3c2a4
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0577-dts-rp1-Re-enable-DMA-to-RP1-UART0.patch
@@ -0,0 +1,32 @@
+From 59c2d6530a850c2ff4047adf447b3d0f8af89d4f Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 3 Dec 2024 12:04:55 +0000
+Subject: [PATCH 577/697] dts: rp1: Re-enable DMA to RP1 UART0
+
+Following the merging of [1], it is safe to re-enable DMA to UART0
+without fear of losing data.
+
+Seen while looking at https://github.com/raspberrypi/linux/issues/6507.
+
+[1] dmaengine: dw-axi-dmac: Allow client-chosen width
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/rp1.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/arm64/boot/dts/broadcom/rp1.dtsi
++++ b/arch/arm64/boot/dts/broadcom/rp1.dtsi
+@@ -65,9 +65,9 @@
+ 			interrupts = <RP1_INT_UART0 IRQ_TYPE_LEVEL_HIGH>;
+ 			clocks = <&rp1_clocks RP1_CLK_UART &rp1_clocks RP1_PLL_SYS_PRI_PH>;
+ 			clock-names = "uartclk", "apb_pclk";
+-			// dmas = <&rp1_dma RP1_DMA_UART0_TX>,
+-			//        <&rp1_dma RP1_DMA_UART0_RX>;
+-			// dma-names = "tx", "rx";
++			dmas = <&rp1_dma RP1_DMA_UART0_TX>,
++			       <&rp1_dma RP1_DMA_UART0_RX>;
++			dma-names = "tx", "rx";
+ 			pinctrl-names = "default";
+ 			arm,primecell-periphid = <0x00541011>;
+ 			uart-has-rtscts;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0578-dts-bcm2712-ds-Restore-gpio-direct-to-gio_aon.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0578-dts-bcm2712-ds-Restore-gpio-direct-to-gio_aon.patch
new file mode 100644
index 00000000..ad4afff8
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0578-dts-bcm2712-ds-Restore-gpio-direct-to-gio_aon.patch
@@ -0,0 +1,26 @@
+From 8dfbbb5f6ab5b25a4bb0e7264c74fe1d89812f20 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 3 Dec 2024 12:46:48 +0000
+Subject: [PATCH 578/697] dts: bcm2712-ds: Restore gpio-direct to gio_aon
+
+gpio-direct mode is a modification of the brcmstb GPIO driver that
+makes it play nicely with the userspace pinctrl utility. The mode
+forces the drive to read its state from the hardware each time, rather
+than relying on cached state. Doing so slightly reduces performance,
+but this is not a heavily used code path.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/bcm2712-ds.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-ds.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-ds.dtsi
+@@ -815,3 +815,7 @@
+ 		};
+ 	};
+ };
++
++&gio_aon {
++	brcm,gpio-direct;
++};
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0579-drm-vc4-plane-Keep-fractional-source-coords-inside-s.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0579-drm-vc4-plane-Keep-fractional-source-coords-inside-s.patch
new file mode 100644
index 00000000..08275327
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0579-drm-vc4-plane-Keep-fractional-source-coords-inside-s.patch
@@ -0,0 +1,218 @@
+From 0057cb0c54299dc35dc579302e1fab21b5f05678 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Fri, 21 Jun 2024 16:20:25 +0100
+Subject: [PATCH 579/697] drm/vc4: plane: Keep fractional source coords inside
+ state
+
+Fractional source co-ordinates can be used to setup the scaling
+filters, so retain the information.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-2-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_drv.h   |  2 +-
+ drivers/gpu/drm/vc4/vc4_plane.c | 68 ++++++++++++++++-----------------
+ 2 files changed, 34 insertions(+), 36 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -410,7 +410,7 @@ struct vc4_plane_state {
+ 
+ 	/* Clipped coordinates of the plane on the display. */
+ 	int crtc_x, crtc_y, crtc_w, crtc_h;
+-	/* Clipped area being scanned from in the FB. */
++	/* Clipped area being scanned from in the FB in u16.16 format */
+ 	u32 src_x, src_y;
+ 
+ 	u32 src_w[2], src_h[2];
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -251,9 +251,9 @@ static const struct hvs_format *vc4_get_
+ 
+ static enum vc4_scaling_mode vc4_get_scaling_mode(u32 src, u32 dst)
+ {
+-	if (dst == src)
++	if (dst == src >> 16)
+ 		return VC4_SCALING_NONE;
+-	if (3 * dst >= 2 * src)
++	if (3 * dst >= 2 * (src >> 16))
+ 		return VC4_SCALING_PPF;
+ 	else
+ 		return VC4_SCALING_TPZ;
+@@ -462,15 +462,10 @@ static int vc4_plane_setup_clipping_and_
+ 		vc4_state->offsets[i] = bo->dma_addr + fb->offsets[i];
+ 	}
+ 
+-	/*
+-	 * We don't support subpixel source positioning for scaling,
+-	 * but fractional coordinates can be generated by clipping
+-	 * so just round for now
+-	 */
+-	vc4_state->src_x = DIV_ROUND_CLOSEST(state->src.x1, 1 << 16);
+-	vc4_state->src_y = DIV_ROUND_CLOSEST(state->src.y1, 1 << 16);
+-	vc4_state->src_w[0] = DIV_ROUND_CLOSEST(state->src.x2, 1 << 16) - vc4_state->src_x;
+-	vc4_state->src_h[0] = DIV_ROUND_CLOSEST(state->src.y2, 1 << 16) - vc4_state->src_y;
++	vc4_state->src_x = state->src.x1;
++	vc4_state->src_y = state->src.y1;
++	vc4_state->src_w[0] = state->src.x2 - vc4_state->src_x;
++	vc4_state->src_h[0] = state->src.y2 - vc4_state->src_y;
+ 
+ 	vc4_state->crtc_x = state->dst.x1;
+ 	vc4_state->crtc_y = state->dst.y1;
+@@ -523,7 +518,7 @@ static void vc4_write_tpz(struct vc4_pla
+ {
+ 	u32 scale, recip;
+ 
+-	scale = (1 << 16) * src / dst;
++	scale = src / dst;
+ 
+ 	/* The specs note that while the reciprocal would be defined
+ 	 * as (1<<32)/scale, ~0 is close enough.
+@@ -569,7 +564,7 @@ static u32 vc4_lbm_size(struct drm_plane
+ 	if (vc4_state->x_scaling[0] == VC4_SCALING_TPZ)
+ 		pix_per_line = vc4_state->crtc_w;
+ 	else
+-		pix_per_line = vc4_state->src_w[0];
++		pix_per_line = vc4_state->src_w[0] >> 16;
+ 
+ 	if (!vc4_state->is_yuv) {
+ 		if (vc4_state->y_scaling[0] == VC4_SCALING_TPZ)
+@@ -660,7 +655,8 @@ static void vc4_plane_calc_load(struct d
+ 	for (i = 0; i < fb->format->num_planes; i++) {
+ 		/* Even if the bandwidth/plane required for a single frame is
+ 		 *
+-		 * vc4_state->src_w[i] * vc4_state->src_h[i] * cpp * vrefresh
++		 * (vc4_state->src_w[i] >> 16) * (vc4_state->src_h[i] >> 16) *
++		 *  cpp * vrefresh
+ 		 *
+ 		 * when downscaling, we have to read more pixels per line in
+ 		 * the time frame reserved for a single line, so the bandwidth
+@@ -669,11 +665,11 @@ static void vc4_plane_calc_load(struct d
+ 		 * load by this number. We're likely over-estimating the read
+ 		 * demand, but that's better than under-estimating it.
+ 		 */
+-		vscale_factor = DIV_ROUND_UP(vc4_state->src_h[i],
++		vscale_factor = DIV_ROUND_UP(vc4_state->src_h[i] >> 16,
+ 					     vc4_state->crtc_h);
+-		vc4_state->membus_load += vc4_state->src_w[i] *
+-					  vc4_state->src_h[i] * vscale_factor *
+-					  fb->format->cpp[i];
++		vc4_state->membus_load += (vc4_state->src_w[i] >> 16) *
++					  (vc4_state->src_h[i] >> 16) *
++					  vscale_factor * fb->format->cpp[i];
+ 		vc4_state->hvs_load += vc4_state->crtc_h * vc4_state->crtc_w;
+ 	}
+ 
+@@ -826,7 +822,8 @@ static int vc4_plane_mode_set(struct drm
+ 	bool mix_plane_alpha;
+ 	bool covers_screen;
+ 	u32 scl0, scl1, pitch0;
+-	u32 tiling, src_y;
++	u32 tiling, src_x, src_y;
++	u32 width, height;
+ 	u32 hvs_format = format->hvs;
+ 	unsigned int rotation;
+ 	int ret, i;
+@@ -838,6 +835,9 @@ static int vc4_plane_mode_set(struct drm
+ 	if (ret)
+ 		return ret;
+ 
++	width = vc4_state->src_w[0] >> 16;
++	height = vc4_state->src_h[0] >> 16;
++
+ 	/* SCL1 is used for Cb/Cr scaling of planar formats.  For RGB
+ 	 * and 4:4:4, scl1 should be set to scl0 so both channels of
+ 	 * the scaler do the same thing.  For YUV, the Y plane needs
+@@ -858,9 +858,11 @@ static int vc4_plane_mode_set(struct drm
+ 					 DRM_MODE_REFLECT_Y);
+ 
+ 	/* We must point to the last line when Y reflection is enabled. */
+-	src_y = vc4_state->src_y;
++	src_y = vc4_state->src_y >> 16;
+ 	if (rotation & DRM_MODE_REFLECT_Y)
+-		src_y += vc4_state->src_h[0] - 1;
++		src_y += height - 1;
++
++	src_x = vc4_state->src_x >> 16;
+ 
+ 	switch (base_format_mod) {
+ 	case DRM_FORMAT_MOD_LINEAR:
+@@ -875,7 +877,7 @@ static int vc4_plane_mode_set(struct drm
+ 						 (i ? v_subsample : 1) *
+ 						 fb->pitches[i];
+ 
+-			vc4_state->offsets[i] += vc4_state->src_x /
++			vc4_state->offsets[i] += src_x /
+ 						 (i ? h_subsample : 1) *
+ 						 fb->format->cpp[i];
+ 		}
+@@ -898,7 +900,7 @@ static int vc4_plane_mode_set(struct drm
+ 		 *	pitch * tile_h == tile_size * tiles_per_row
+ 		 */
+ 		u32 tiles_w = fb->pitches[0] >> (tile_size_shift - tile_h_shift);
+-		u32 tiles_l = vc4_state->src_x >> tile_w_shift;
++		u32 tiles_l = src_x >> tile_w_shift;
+ 		u32 tiles_r = tiles_w - tiles_l;
+ 		u32 tiles_t = src_y >> tile_h_shift;
+ 		/* Intra-tile offsets, which modify the base address (the
+@@ -908,7 +910,7 @@ static int vc4_plane_mode_set(struct drm
+ 		u32 tile_y = (src_y >> 4) & 1;
+ 		u32 subtile_y = (src_y >> 2) & 3;
+ 		u32 utile_y = src_y & 3;
+-		u32 x_off = vc4_state->src_x & tile_w_mask;
++		u32 x_off = src_x & tile_w_mask;
+ 		u32 y_off = src_y & tile_h_mask;
+ 
+ 		/* When Y reflection is requested we must set the
+@@ -1004,7 +1006,7 @@ static int vc4_plane_mode_set(struct drm
+ 				 * of the 12-pixels in that 128-bit word is the
+ 				 * first pixel to be used
+ 				 */
+-				u32 remaining_pixels = vc4_state->src_x % 96;
++				u32 remaining_pixels = src_x % 96;
+ 				u32 aligned = remaining_pixels / 12;
+ 				u32 last_bits = remaining_pixels % 12;
+ 
+@@ -1026,12 +1028,12 @@ static int vc4_plane_mode_set(struct drm
+ 					return -EINVAL;
+ 				}
+ 				pix_per_tile = tile_w / fb->format->cpp[0];
+-				x_off = (vc4_state->src_x % pix_per_tile) /
++				x_off = (src_x % pix_per_tile) /
+ 					(i ? h_subsample : 1) *
+ 					fb->format->cpp[i];
+ 			}
+ 
+-			tile = vc4_state->src_x / pix_per_tile;
++			tile = src_x / pix_per_tile;
+ 
+ 			vc4_state->offsets[i] += param * tile_w * tile;
+ 			vc4_state->offsets[i] += src_y /
+@@ -1092,10 +1094,8 @@ static int vc4_plane_mode_set(struct drm
+ 		vc4_dlist_write(vc4_state,
+ 				(mix_plane_alpha ? SCALER_POS2_ALPHA_MIX : 0) |
+ 				vc4_hvs4_get_alpha_blend_mode(state) |
+-				VC4_SET_FIELD(vc4_state->src_w[0],
+-					      SCALER_POS2_WIDTH) |
+-				VC4_SET_FIELD(vc4_state->src_h[0],
+-					      SCALER_POS2_HEIGHT));
++				VC4_SET_FIELD(width, SCALER_POS2_WIDTH) |
++				VC4_SET_FIELD(height, SCALER_POS2_HEIGHT));
+ 
+ 		/* Position Word 3: Context.  Written by the HVS. */
+ 		vc4_dlist_write(vc4_state, 0xc0c0c0c0);
+@@ -1148,10 +1148,8 @@ static int vc4_plane_mode_set(struct drm
+ 		/* Position Word 2: Source Image Size */
+ 		vc4_state->pos2_offset = vc4_state->dlist_count;
+ 		vc4_dlist_write(vc4_state,
+-				VC4_SET_FIELD(vc4_state->src_w[0],
+-					      SCALER5_POS2_WIDTH) |
+-				VC4_SET_FIELD(vc4_state->src_h[0],
+-					      SCALER5_POS2_HEIGHT));
++				VC4_SET_FIELD(width, SCALER5_POS2_WIDTH) |
++				VC4_SET_FIELD(height, SCALER5_POS2_HEIGHT));
+ 
+ 		/* Position Word 3: Context.  Written by the HVS. */
+ 		vc4_dlist_write(vc4_state, 0xc0c0c0c0);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0580-drm-vc4-plane-Handle-fractional-coordinates-using-th.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0580-drm-vc4-plane-Handle-fractional-coordinates-using-th.patch
new file mode 100644
index 00000000..df0f8e5a
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0580-drm-vc4-plane-Handle-fractional-coordinates-using-th.patch
@@ -0,0 +1,144 @@
+From 0158bb45f34b601f59fde4dac3016848efbc1d01 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Fri, 21 Jun 2024 16:20:26 +0100
+Subject: [PATCH 580/697] drm/vc4: plane: Handle fractional coordinates using
+ the phase field
+
+Apply fractional source co-ordinates into the scaling filters.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-3-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 87 ++++++++++++++++++++++++++++-----
+ 1 file changed, 76 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -532,14 +532,61 @@ static void vc4_write_tpz(struct vc4_pla
+ 			VC4_SET_FIELD(recip, SCALER_TPZ1_RECIP));
+ }
+ 
+-static void vc4_write_ppf(struct vc4_plane_state *vc4_state, u32 src, u32 dst)
++/* phase magnitude bits */
++#define PHASE_BITS 6
++
++static void vc4_write_ppf(struct vc4_plane_state *vc4_state, u32 src, u32 dst,
++			  u32 xy, int channel)
+ {
+-	u32 scale = (1 << 16) * src / dst;
++	u32 scale = src / dst;
++	s32 offset, offset2;
++	s32 phase;
++
++	/*
++	 * Start the phase at 1/2 pixel from the 1st pixel at src_x.
++	 * 1/4 pixel for YUV.
++	 */
++	if (channel) {
++		/*
++		 * The phase is relative to scale_src->x, so shift it for
++		 * display list's x value
++		 */
++		offset = (xy & 0x1ffff) >> (16 - PHASE_BITS) >> 1;
++		offset += -(1 << PHASE_BITS >> 2);
++	} else {
++		/*
++		 * The phase is relative to scale_src->x, so shift it for
++		 * display list's x value
++		 */
++		offset = (xy & 0xffff) >> (16 - PHASE_BITS);
++		offset += -(1 << PHASE_BITS >> 1);
++
++		/*
++		 * This is a kludge to make sure the scaling factors are
++		 * consistent with YUV's luma scaling. We lose 1-bit precision
++		 * because of this.
++		 */
++		scale &= ~1;
++	}
++
++	/*
++	 * There may be a also small error introduced by precision of scale.
++	 * Add half of that as a compromise
++	 */
++	offset2 = src - dst * scale;
++	offset2 >>= 16 - PHASE_BITS;
++	phase = offset + (offset2 >> 1);
++
++	/* Ensure +ve values don't touch the sign bit, then truncate negative values */
++	if (phase >= 1 << PHASE_BITS)
++		phase = (1 << PHASE_BITS) - 1;
++
++	phase &= SCALER_PPF_IPHASE_MASK;
+ 
+ 	vc4_dlist_write(vc4_state,
+ 			SCALER_PPF_AGC |
+ 			VC4_SET_FIELD(scale, SCALER_PPF_SCALE) |
+-			VC4_SET_FIELD(0, SCALER_PPF_IPHASE));
++			VC4_SET_FIELD(phase, SCALER_PPF_IPHASE));
+ }
+ 
+ static u32 vc4_lbm_size(struct drm_plane_state *state)
+@@ -597,27 +644,27 @@ static void vc4_write_scaling_parameters
+ 
+ 	/* Ch0 H-PPF Word 0: Scaling Parameters */
+ 	if (vc4_state->x_scaling[channel] == VC4_SCALING_PPF) {
+-		vc4_write_ppf(vc4_state,
+-			      vc4_state->src_w[channel], vc4_state->crtc_w);
++		vc4_write_ppf(vc4_state, vc4_state->src_w[channel],
++			      vc4_state->crtc_w, vc4_state->src_x, channel);
+ 	}
+ 
+ 	/* Ch0 V-PPF Words 0-1: Scaling Parameters, Context */
+ 	if (vc4_state->y_scaling[channel] == VC4_SCALING_PPF) {
+-		vc4_write_ppf(vc4_state,
+-			      vc4_state->src_h[channel], vc4_state->crtc_h);
++		vc4_write_ppf(vc4_state, vc4_state->src_h[channel],
++			      vc4_state->crtc_h, vc4_state->src_y, channel);
+ 		vc4_dlist_write(vc4_state, 0xc0c0c0c0);
+ 	}
+ 
+ 	/* Ch0 H-TPZ Words 0-1: Scaling Parameters, Recip */
+ 	if (vc4_state->x_scaling[channel] == VC4_SCALING_TPZ) {
+-		vc4_write_tpz(vc4_state,
+-			      vc4_state->src_w[channel], vc4_state->crtc_w);
++		vc4_write_tpz(vc4_state, vc4_state->src_w[channel],
++			      vc4_state->crtc_w);
+ 	}
+ 
+ 	/* Ch0 V-TPZ Words 0-2: Scaling Parameters, Recip, Context */
+ 	if (vc4_state->y_scaling[channel] == VC4_SCALING_TPZ) {
+-		vc4_write_tpz(vc4_state,
+-			      vc4_state->src_h[channel], vc4_state->crtc_h);
++		vc4_write_tpz(vc4_state, vc4_state->src_h[channel],
++			      vc4_state->crtc_h);
+ 		vc4_dlist_write(vc4_state, 0xc0c0c0c0);
+ 	}
+ }
+@@ -1052,6 +1099,24 @@ static int vc4_plane_mode_set(struct drm
+ 		return -EINVAL;
+ 	}
+ 
++	/* fetch an extra pixel if we don't actually line up with the left edge. */
++	if ((vc4_state->src_x & 0xffff) && vc4_state->src_x < (state->fb->width << 16))
++		width++;
++
++	/* same for the right side */
++	if (((vc4_state->src_x + vc4_state->src_w[0]) & 0xffff) &&
++	    vc4_state->src_x + vc4_state->src_w[0] < (state->fb->width << 16))
++		width++;
++
++	/* now for the top */
++	if ((vc4_state->src_y & 0xffff) && vc4_state->src_y < (state->fb->height << 16))
++		height++;
++
++	/* and the bottom */
++	if (((vc4_state->src_y + vc4_state->src_h[0]) & 0xffff) &&
++	    vc4_state->src_y + vc4_state->src_h[0] < (state->fb->height << 16))
++		height++;
++
+ 	/* Don't waste cycles mixing with plane alpha if the set alpha
+ 	 * is opaque or there is no per-pixel alpha information.
+ 	 * In any case we use the alpha property value as the fixed alpha.
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0581-drm-vc4-crtc-Force-trigger-of-dlist-update-on-margin.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0581-drm-vc4-crtc-Force-trigger-of-dlist-update-on-margin.patch
new file mode 100644
index 00000000..1a30af76
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0581-drm-vc4-crtc-Force-trigger-of-dlist-update-on-margin.patch
@@ -0,0 +1,61 @@
+From 59fa9c0e67e25aa83a4b202ad7caf95ba4281dc3 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 21 Jun 2024 16:20:27 +0100
+Subject: [PATCH 581/697] drm/vc4: crtc: Force trigger of dlist update on
+ margins change
+
+When the margins are changed, the dlist needs to be regenerated
+with the changed updated dest regions for each of the planes.
+
+Setting the zpos_changed flag is sufficient to trigger that
+without doing a full modeset, therefore set it should the
+margins be changed.
+
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-4-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c | 15 +++++++++++----
+ drivers/gpu/drm/vc4/vc4_drv.h  |  7 +------
+ 2 files changed, 12 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -735,10 +735,17 @@ int vc4_crtc_atomic_check(struct drm_crt
+ 		if (conn_state->crtc != crtc)
+ 			continue;
+ 
+-		vc4_state->margins.left = conn_state->tv.margins.left;
+-		vc4_state->margins.right = conn_state->tv.margins.right;
+-		vc4_state->margins.top = conn_state->tv.margins.top;
+-		vc4_state->margins.bottom = conn_state->tv.margins.bottom;
++		if (memcmp(&vc4_state->margins, &conn_state->tv.margins,
++			   sizeof(vc4_state->margins))) {
++			memcpy(&vc4_state->margins, &conn_state->tv.margins,
++			       sizeof(vc4_state->margins));
++
++			/*
++			 * Need to force the dlist entries for all planes to be
++			 * updated so that the dest rectangles are changed.
++			 */
++			crtc_state->zpos_changed = true;
++		}
+ 		break;
+ 	}
+ 
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -604,12 +604,7 @@ struct vc4_crtc_state {
+ 	bool txp_armed;
+ 	unsigned int assigned_channel;
+ 
+-	struct {
+-		unsigned int left;
+-		unsigned int right;
+-		unsigned int top;
+-		unsigned int bottom;
+-	} margins;
++	struct drm_connector_tv_margins margins;
+ 
+ 	unsigned long hvs_load;
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0582-drm-vc4-plane-Add-support-for-YUV444-formats.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0582-drm-vc4-plane-Add-support-for-YUV444-formats.patch
new file mode 100644
index 00000000..899367fb
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0582-drm-vc4-plane-Add-support-for-YUV444-formats.patch
@@ -0,0 +1,58 @@
+From aae202111259b98824bdbee91d656ba4da06808c Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Fri, 21 Jun 2024 16:20:29 +0100
+Subject: [PATCH 582/697] drm/vc4: plane: Add support for YUV444 formats
+
+Support displaying DRM_FORMAT_YUV444 and DRM_FORMAT_YVU444 formats.
+Tested with kmstest and kodi. e.g.
+
+kmstest -r 1920x1080@60 -f 400x300-YU24
+
+Note: without the shift of width, only half the chroma is fetched,
+resulting in correct left half of image and corrupt colours on right half.
+
+The increase in width shouldn't affect fetching of Y data,
+as the hardware will clamp at dest width.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-6-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -110,6 +110,18 @@ static const struct hvs_format {
+ 		.pixel_order_hvs5 = HVS_PIXEL_ORDER_XYCRCB,
+ 	},
+ 	{
++		.drm = DRM_FORMAT_YUV444,
++		.hvs = HVS_PIXEL_FORMAT_YCBCR_YUV422_3PLANE,
++		.pixel_order = HVS_PIXEL_ORDER_XYCBCR,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_XYCBCR,
++	},
++	{
++		.drm = DRM_FORMAT_YVU444,
++		.hvs = HVS_PIXEL_FORMAT_YCBCR_YUV422_3PLANE,
++		.pixel_order = HVS_PIXEL_ORDER_XYCRCB,
++		.pixel_order_hvs5 = HVS_PIXEL_ORDER_XYCRCB,
++	},
++	{
+ 		.drm = DRM_FORMAT_YUV420,
+ 		.hvs = HVS_PIXEL_FORMAT_YCBCR_YUV420_3PLANE,
+ 		.pixel_order = HVS_PIXEL_ORDER_XYCBCR,
+@@ -1117,6 +1129,12 @@ static int vc4_plane_mode_set(struct drm
+ 	    vc4_state->src_y + vc4_state->src_h[0] < (state->fb->height << 16))
+ 		height++;
+ 
++	/* For YUV444 the hardware wants double the width, otherwise it doesn't
++	 * fetch full width of chroma
++	 */
++	if (format->drm == DRM_FORMAT_YUV444 || format->drm == DRM_FORMAT_YVU444)
++		width <<= 1;
++
+ 	/* Don't waste cycles mixing with plane alpha if the set alpha
+ 	 * is opaque or there is no per-pixel alpha information.
+ 	 * In any case we use the alpha property value as the fixed alpha.
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0583-drm-vc4-hdmi-Warn-if-writing-to-an-unknown-HDMI-regi.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0583-drm-vc4-hdmi-Warn-if-writing-to-an-unknown-HDMI-regi.patch
new file mode 100644
index 00000000..6255903b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0583-drm-vc4-hdmi-Warn-if-writing-to-an-unknown-HDMI-regi.patch
@@ -0,0 +1,35 @@
+From e4208c7412d9e677b046e4306aa4e81f9974362e Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 21 Jun 2024 16:20:32 +0100
+Subject: [PATCH 583/697] drm/vc4: hdmi: Warn if writing to an unknown HDMI
+ register
+
+The VC4 HDMI driver has a bunch of accessors to read from a register.
+The read accessor was warning when accessing an unknown register, but
+the write one was just returning silently.
+
+Let's make sure we warn also when writing to an unknown register.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-9-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi_regs.h | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi_regs.h
++++ b/drivers/gpu/drm/vc4/vc4_hdmi_regs.h
+@@ -498,8 +498,11 @@ static inline void vc4_hdmi_write(struct
+ 
+ 	field = &variant->registers[reg];
+ 	base = __vc4_hdmi_get_field_base(hdmi, field->reg);
+-	if (!base)
++	if (!base) {
++		dev_warn(&hdmi->pdev->dev,
++			 "Unknown register ID %u\n", reg);
+ 		return;
++	}
+ 
+ 	writel(value, base + field->offset);
+ }
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0584-drm-vc4-hvs-More-logging-for-dlist-generation.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0584-drm-vc4-hvs-More-logging-for-dlist-generation.patch
new file mode 100644
index 00000000..46e87cc7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0584-drm-vc4-hvs-More-logging-for-dlist-generation.patch
@@ -0,0 +1,43 @@
+From 931182381c3139e68a8684c2666612a03086fc54 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 21 Jun 2024 16:20:33 +0100
+Subject: [PATCH 584/697] drm/vc4: hvs: More logging for dlist generation
+
+DLIST generation can get pretty tricky and there's not a lot of debug in
+the driver to help. Let's add a few more to track the generated DLIST
+size.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-10-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -460,11 +460,21 @@ int vc4_hvs_atomic_check(struct drm_crtc
+ 	if (hweight32(crtc_state->connector_mask) > 1)
+ 		return -EINVAL;
+ 
+-	drm_atomic_crtc_state_for_each_plane_state(plane, plane_state, crtc_state)
+-		dlist_count += vc4_plane_dlist_size(plane_state);
++	drm_atomic_crtc_state_for_each_plane_state(plane, plane_state, crtc_state) {
++		u32 plane_dlist_count = vc4_plane_dlist_size(plane_state);
++
++		drm_dbg_driver(dev, "[CRTC:%d:%s] Found [PLANE:%d:%s] with DLIST size: %u\n",
++			       crtc->base.id, crtc->name,
++			       plane->base.id, plane->name,
++			       plane_dlist_count);
++
++		dlist_count += plane_dlist_count;
++	}
+ 
+ 	dlist_count++; /* Account for SCALER_CTL0_END. */
+ 
++	drm_dbg_driver(dev, "[CRTC:%d:%s] Allocating DLIST block with size: %u\n",
++		       crtc->base.id, crtc->name, dlist_count);
+ 	spin_lock_irqsave(&vc4->hvs->mm_lock, flags);
+ 	ret = drm_mm_insert_node(&vc4->hvs->dlist_mm, &vc4_state->mm,
+ 				 dlist_count);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0585-drm-vc4-hvs-Print-error-if-we-fail-an-allocation.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0585-drm-vc4-hvs-Print-error-if-we-fail-an-allocation.patch
new file mode 100644
index 00000000..54d86b97
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0585-drm-vc4-hvs-Print-error-if-we-fail-an-allocation.patch
@@ -0,0 +1,60 @@
+From 913025355f6b9c5ad5b115230cf01d7623c64702 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 21 Jun 2024 16:20:34 +0100
+Subject: [PATCH 585/697] drm/vc4: hvs: Print error if we fail an allocation
+
+We need to allocate a few additional structures when checking our
+atomic_state, especially related to hardware SRAM that will hold the
+plane descriptors (DLIST) and the current line context (LBM) during
+composition.
+
+Since those allocation can fail, let's add some error message in that
+case to help debug what goes wrong.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-11-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c   | 4 +++-
+ drivers/gpu/drm/vc4/vc4_plane.c | 7 +++++--
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -479,8 +479,10 @@ int vc4_hvs_atomic_check(struct drm_crtc
+ 	ret = drm_mm_insert_node(&vc4->hvs->dlist_mm, &vc4_state->mm,
+ 				 dlist_count);
+ 	spin_unlock_irqrestore(&vc4->hvs->mm_lock, flags);
+-	if (ret)
++	if (ret) {
++		drm_err(dev, "Failed to allocate DLIST entry: %d\n", ret);
+ 		return ret;
++	}
+ 
+ 	return 0;
+ }
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -739,7 +739,8 @@ static void vc4_plane_calc_load(struct d
+ 
+ static int vc4_plane_allocate_lbm(struct drm_plane_state *state)
+ {
+-	struct vc4_dev *vc4 = to_vc4_dev(state->plane->dev);
++	struct drm_device *drm = state->plane->dev;
++	struct vc4_dev *vc4 = to_vc4_dev(drm);
+ 	struct vc4_plane_state *vc4_state = to_vc4_plane_state(state);
+ 	unsigned long irqflags;
+ 	u32 lbm_size;
+@@ -765,8 +766,10 @@ static int vc4_plane_allocate_lbm(struct
+ 						 0, 0);
+ 		spin_unlock_irqrestore(&vc4->hvs->mm_lock, irqflags);
+ 
+-		if (ret)
++		if (ret) {
++			drm_err(drm, "Failed to allocate LBM entry: %d\n", ret);
+ 			return ret;
++		}
+ 	} else {
+ 		WARN_ON_ONCE(lbm_size != vc4_state->lbm.size);
+ 	}
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0586-drm-vc4-plane-Add-more-debugging-for-LBM-allocation.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0586-drm-vc4-plane-Add-more-debugging-for-LBM-allocation.patch
new file mode 100644
index 00000000..127efa15
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0586-drm-vc4-plane-Add-more-debugging-for-LBM-allocation.patch
@@ -0,0 +1,39 @@
+From f1b80e6e581e0f7939e0768137bd3558e57b2dc9 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 21 Jun 2024 16:20:35 +0100
+Subject: [PATCH 586/697] drm/vc4: plane: Add more debugging for LBM allocation
+
+LBM allocations need a different size depending on the line length,
+format, etc.
+
+This can get tricky, and fail. Let's add some more prints to ease the
+debugging when it does.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-12-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -741,6 +741,7 @@ static int vc4_plane_allocate_lbm(struct
+ {
+ 	struct drm_device *drm = state->plane->dev;
+ 	struct vc4_dev *vc4 = to_vc4_dev(drm);
++	struct drm_plane *plane = state->plane;
+ 	struct vc4_plane_state *vc4_state = to_vc4_plane_state(state);
+ 	unsigned long irqflags;
+ 	u32 lbm_size;
+@@ -749,6 +750,9 @@ static int vc4_plane_allocate_lbm(struct
+ 	if (!lbm_size)
+ 		return 0;
+ 
++	drm_dbg_driver(drm, "[PLANE:%d:%s] LBM Allocation Size: %u\n",
++		       plane->base.id, plane->name, lbm_size);
++
+ 	if (WARN_ON(!vc4_state->lbm_offset))
+ 		return -EINVAL;
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0587-drm-vc4-plane-Use-return-variable-in-atomic_check.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0587-drm-vc4-plane-Use-return-variable-in-atomic_check.patch
new file mode 100644
index 00000000..d8699ef7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0587-drm-vc4-plane-Use-return-variable-in-atomic_check.patch
@@ -0,0 +1,34 @@
+From 5a90b7f1ea383160ac7a5b7c63feca8e80f82817 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 21 Jun 2024 16:20:36 +0100
+Subject: [PATCH 587/697] drm/vc4: plane: Use return variable in atomic_check
+
+The vc4_plane_atomic_check() directly returns the result of the final
+function it calls.
+
+Using the already defined ret variable to check its content on error,
+and a separate return 0 on success, makes it easier to extend.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-13-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -1386,7 +1386,11 @@ static int vc4_plane_atomic_check(struct
+ 	if (ret)
+ 		return ret;
+ 
+-	return vc4_plane_allocate_lbm(new_plane_state);
++	ret = vc4_plane_allocate_lbm(new_plane_state);
++	if (ret)
++		return ret;
++
++	return 0;
+ }
+ 
+ static void vc4_plane_atomic_update(struct drm_plane *plane,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0588-drm-vc4-crtc-Move-assigned_channel-to-a-variable.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0588-drm-vc4-crtc-Move-assigned_channel-to-a-variable.patch
new file mode 100644
index 00000000..82c61626
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0588-drm-vc4-crtc-Move-assigned_channel-to-a-variable.patch
@@ -0,0 +1,50 @@
+From d57f64084cbe5f6cc311061fae07710a120b61ed Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 21 Jun 2024 16:20:37 +0100
+Subject: [PATCH 588/697] drm/vc4: crtc: Move assigned_channel to a variable
+
+We access multiple times the vc4_crtc_state->assigned_channel variable
+in the vc4_crtc_get_scanout_position() function, so let's store it in a
+local variable.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-14-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -105,6 +105,7 @@ static bool vc4_crtc_get_scanout_positio
+ 	struct vc4_hvs *hvs = vc4->hvs;
+ 	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
+ 	struct vc4_crtc_state *vc4_crtc_state = to_vc4_crtc_state(crtc->state);
++	unsigned int channel = vc4_crtc_state->assigned_channel;
+ 	unsigned int cob_size;
+ 	u32 val;
+ 	int fifo_lines;
+@@ -121,7 +122,7 @@ static bool vc4_crtc_get_scanout_positio
+ 	 * Read vertical scanline which is currently composed for our
+ 	 * pixelvalve by the HVS, and also the scaler status.
+ 	 */
+-	val = HVS_READ(SCALER_DISPSTATX(vc4_crtc_state->assigned_channel));
++	val = HVS_READ(SCALER_DISPSTATX(channel));
+ 
+ 	/* Get optional system timestamp after query. */
+ 	if (etime)
+@@ -137,11 +138,11 @@ static bool vc4_crtc_get_scanout_positio
+ 		*vpos /= 2;
+ 
+ 		/* Use hpos to correct for field offset in interlaced mode. */
+-		if (vc4_hvs_get_fifo_frame_count(hvs, vc4_crtc_state->assigned_channel) % 2)
++		if (vc4_hvs_get_fifo_frame_count(hvs, channel) % 2)
+ 			*hpos += mode->crtc_htotal / 2;
+ 	}
+ 
+-	cob_size = vc4_crtc_get_cob_allocation(vc4, vc4_crtc_state->assigned_channel);
++	cob_size = vc4_crtc_get_cob_allocation(vc4, channel);
+ 	/* This is the offset we need for translating hvs -> pv scanout pos. */
+ 	fifo_lines = cob_size / mode->crtc_hdisplay;
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0589-drm-vc4-plane-YUV-planes-require-vertical-scaling-to.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0589-drm-vc4-plane-YUV-planes-require-vertical-scaling-to.patch
new file mode 100644
index 00000000..a33305a0
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0589-drm-vc4-plane-YUV-planes-require-vertical-scaling-to.patch
@@ -0,0 +1,33 @@
+From b04c8b3a1a9f3452fc033455cea9cd2cf3751d92 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 21 Jun 2024 16:20:39 +0100
+Subject: [PATCH 589/697] drm/vc4: plane: YUV planes require vertical scaling
+ to always be enabled
+
+It has been observed that a YUV422 unity scaled plane isn't displayed.
+Enabling vertical scaling on the UV planes solves this. There is
+already a similar clause to always enable horizontal scaling on the
+UV planes.
+
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-16-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -517,6 +517,12 @@ static int vc4_plane_setup_clipping_and_
+ 		 */
+ 		if (vc4_state->x_scaling[1] == VC4_SCALING_NONE)
+ 			vc4_state->x_scaling[1] = VC4_SCALING_PPF;
++
++		/* Similarly UV needs vertical scaling to be enabled.
++		 * Without this a 1:1 scaled YUV422 plane isn't rendered.
++		 */
++		if (vc4_state->y_scaling[1] == VC4_SCALING_NONE)
++			vc4_state->y_scaling[1] = VC4_SCALING_PPF;
+ 	} else {
+ 		vc4_state->is_yuv = false;
+ 		vc4_state->x_scaling[1] = VC4_SCALING_NONE;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0590-drm-vc4-hvs-Remove-ABORT_ON_EMPTY-flag.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0590-drm-vc4-hvs-Remove-ABORT_ON_EMPTY-flag.patch
new file mode 100644
index 00000000..7e085f68
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0590-drm-vc4-hvs-Remove-ABORT_ON_EMPTY-flag.patch
@@ -0,0 +1,53 @@
+From fa64e3ddef39f3861acdd1be709e8c64b0102be1 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Fri, 21 Jun 2024 16:20:43 +0100
+Subject: [PATCH 590/697] drm/vc4: hvs: Remove ABORT_ON_EMPTY flag
+
+ABORT_ON_EMPTY chooses whether the HVS abandons the current frame
+when it experiences an underflow, or attempts to continue.
+
+In theory the frame should be black from the point of underflow,
+compared to a shift of sebsequent pixels to the left.
+
+Unfortunately it seems to put the HVS is a bad state where it is not
+possible to recover simply. This typically requires a reboot
+following the 'flip done timed out message'.
+
+Discussion with Broadcom has suggested we don't use this flag.
+All their testing is done with it disabled.
+
+Additionally setting BLANK_INSERT_EN causes the HDMI to output
+blank pixels on an underflow which avoids it losing sync.
+
+After this change a 'flip done timed out' due to sdram bandwidth
+starvation or too low a clock is recoverable once the situation improves.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-20-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 1 +
+ drivers/gpu/drm/vc4/vc4_regs.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -1598,6 +1598,7 @@ static void vc4_hdmi_encoder_post_crtc_e
+ 		   VC4_HD_VID_CTL_CLRRGB |
+ 		   VC4_HD_VID_CTL_UNDERFLOW_ENABLE |
+ 		   VC4_HD_VID_CTL_FRAME_COUNTER_RESET |
++		   VC4_HD_VID_CTL_BLANK_INSERT_EN |
+ 		   (vsync_pos ? 0 : VC4_HD_VID_CTL_VSYNC_LOW) |
+ 		   (hsync_pos ? 0 : VC4_HD_VID_CTL_HSYNC_LOW));
+ 
+--- a/drivers/gpu/drm/vc4/vc4_regs.h
++++ b/drivers/gpu/drm/vc4/vc4_regs.h
+@@ -777,6 +777,7 @@ enum {
+ # define VC4_HD_VID_CTL_CLRSYNC			BIT(24)
+ # define VC4_HD_VID_CTL_CLRRGB			BIT(23)
+ # define VC4_HD_VID_CTL_BLANKPIX		BIT(18)
++# define VC4_HD_VID_CTL_BLANK_INSERT_EN		BIT(16)
+ 
+ # define VC4_HD_CSC_CTL_ORDER_MASK		VC4_MASK(7, 5)
+ # define VC4_HD_CSC_CTL_ORDER_SHIFT		5
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0591-drm-vc4-Make-v3d-paths-unavailable-on-any-generation.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0591-drm-vc4-Make-v3d-paths-unavailable-on-any-generation.patch
new file mode 100644
index 00000000..16e72fea
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0591-drm-vc4-Make-v3d-paths-unavailable-on-any-generation.patch
@@ -0,0 +1,580 @@
+From a08f1ca6bf43714f0e90bc7ac544f698b220d54c Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 21 Jun 2024 16:20:45 +0100
+Subject: [PATCH 591/697] drm/vc4: Make v3d paths unavailable on any generation
+ newer than vc4
+
+The V3D IP has been separate since BCM2711, so let's make sure we issue
+a WARN if we're running not only on BCM2711, but also anything newer.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-22-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_bo.c               | 28 +++++++++++-----------
+ drivers/gpu/drm/vc4/vc4_crtc.c             |  4 ++--
+ drivers/gpu/drm/vc4/vc4_drv.c              |  8 +++----
+ drivers/gpu/drm/vc4/vc4_gem.c              | 24 +++++++++----------
+ drivers/gpu/drm/vc4/vc4_irq.c              | 10 ++++----
+ drivers/gpu/drm/vc4/vc4_kms.c              |  2 +-
+ drivers/gpu/drm/vc4/vc4_perfmon.c          | 20 ++++++++--------
+ drivers/gpu/drm/vc4/vc4_render_cl.c        |  2 +-
+ drivers/gpu/drm/vc4/vc4_v3d.c              | 10 ++++----
+ drivers/gpu/drm/vc4/vc4_validate.c         |  8 +++----
+ drivers/gpu/drm/vc4/vc4_validate_shaders.c |  2 +-
+ 11 files changed, 59 insertions(+), 59 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_bo.c
++++ b/drivers/gpu/drm/vc4/vc4_bo.c
+@@ -251,7 +251,7 @@ void vc4_bo_add_to_purgeable_pool(struct
+ {
+ 	struct vc4_dev *vc4 = to_vc4_dev(bo->base.base.dev);
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return;
+ 
+ 	mutex_lock(&vc4->purgeable.lock);
+@@ -265,7 +265,7 @@ static void vc4_bo_remove_from_purgeable
+ {
+ 	struct vc4_dev *vc4 = to_vc4_dev(bo->base.base.dev);
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return;
+ 
+ 	/* list_del_init() is used here because the caller might release
+@@ -396,7 +396,7 @@ struct drm_gem_object *vc4_create_object
+ 	struct vc4_dev *vc4 = to_vc4_dev(dev);
+ 	struct vc4_bo *bo;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return ERR_PTR(-ENODEV);
+ 
+ 	bo = kzalloc(sizeof(*bo), GFP_KERNEL);
+@@ -427,7 +427,7 @@ struct vc4_bo *vc4_bo_create(struct drm_
+ 	struct drm_gem_dma_object *dma_obj;
+ 	struct vc4_bo *bo;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return ERR_PTR(-ENODEV);
+ 
+ 	if (size == 0)
+@@ -496,7 +496,7 @@ int vc4_bo_dumb_create(struct drm_file *
+ 	struct vc4_bo *bo = NULL;
+ 	int ret;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	ret = vc4_dumb_fixup_args(args);
+@@ -622,7 +622,7 @@ int vc4_bo_inc_usecnt(struct vc4_bo *bo)
+ 	struct vc4_dev *vc4 = to_vc4_dev(bo->base.base.dev);
+ 	int ret;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	/* Fast path: if the BO is already retained by someone, no need to
+@@ -661,7 +661,7 @@ void vc4_bo_dec_usecnt(struct vc4_bo *bo
+ {
+ 	struct vc4_dev *vc4 = to_vc4_dev(bo->base.base.dev);
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return;
+ 
+ 	/* Fast path: if the BO is still retained by someone, no need to test
+@@ -783,7 +783,7 @@ int vc4_create_bo_ioctl(struct drm_devic
+ 	struct vc4_bo *bo = NULL;
+ 	int ret;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	ret = vc4_grab_bin_bo(vc4, vc4file);
+@@ -813,7 +813,7 @@ int vc4_mmap_bo_ioctl(struct drm_device
+ 	struct drm_vc4_mmap_bo *args = data;
+ 	struct drm_gem_object *gem_obj;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	gem_obj = drm_gem_object_lookup(file_priv, args->handle);
+@@ -839,7 +839,7 @@ vc4_create_shader_bo_ioctl(struct drm_de
+ 	struct vc4_bo *bo = NULL;
+ 	int ret;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	if (args->size == 0)
+@@ -918,7 +918,7 @@ int vc4_set_tiling_ioctl(struct drm_devi
+ 	struct vc4_bo *bo;
+ 	bool t_format;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	if (args->flags != 0)
+@@ -964,7 +964,7 @@ int vc4_get_tiling_ioctl(struct drm_devi
+ 	struct drm_gem_object *gem_obj;
+ 	struct vc4_bo *bo;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	if (args->flags != 0 || args->modifier != 0)
+@@ -1007,7 +1007,7 @@ int vc4_bo_cache_init(struct drm_device
+ 	int ret;
+ 	int i;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	/* Create the initial set of BO labels that the kernel will
+@@ -1071,7 +1071,7 @@ int vc4_label_bo_ioctl(struct drm_device
+ 	struct drm_gem_object *gem_obj;
+ 	int ret = 0, label;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	if (!args->len)
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -1008,7 +1008,7 @@ static int vc4_async_page_flip(struct dr
+ 	struct vc4_bo *bo = to_vc4_bo(&dma_bo->base);
+ 	int ret;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	/*
+@@ -1051,7 +1051,7 @@ int vc4_page_flip(struct drm_crtc *crtc,
+ 		struct drm_device *dev = crtc->dev;
+ 		struct vc4_dev *vc4 = to_vc4_dev(dev);
+ 
+-		if (vc4->gen == VC4_GEN_5)
++		if (vc4->gen > VC4_GEN_4)
+ 			return vc5_async_page_flip(crtc, fb, event, flags);
+ 		else
+ 			return vc4_async_page_flip(crtc, fb, event, flags);
+--- a/drivers/gpu/drm/vc4/vc4_drv.c
++++ b/drivers/gpu/drm/vc4/vc4_drv.c
+@@ -98,7 +98,7 @@ static int vc4_get_param_ioctl(struct dr
+ 	if (args->pad != 0)
+ 		return -EINVAL;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	if (!vc4->v3d)
+@@ -147,7 +147,7 @@ static int vc4_open(struct drm_device *d
+ 	struct vc4_dev *vc4 = to_vc4_dev(dev);
+ 	struct vc4_file *vc4file;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	vc4file = kzalloc(sizeof(*vc4file), GFP_KERNEL);
+@@ -165,7 +165,7 @@ static void vc4_close(struct drm_device
+ 	struct vc4_dev *vc4 = to_vc4_dev(dev);
+ 	struct vc4_file *vc4file = file->driver_priv;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return;
+ 
+ 	if (vc4file->bin_bo_used)
+@@ -301,7 +301,7 @@ static int vc4_drm_bind(struct device *d
+ 	else
+ 		gen = VC4_GEN_4;
+ 
+-	if (gen == VC4_GEN_5)
++	if (gen > VC4_GEN_4)
+ 		driver = &vc5_drm_driver;
+ 	else
+ 		driver = &vc4_drm_driver;
+--- a/drivers/gpu/drm/vc4/vc4_gem.c
++++ b/drivers/gpu/drm/vc4/vc4_gem.c
+@@ -76,7 +76,7 @@ vc4_get_hang_state_ioctl(struct drm_devi
+ 	u32 i;
+ 	int ret = 0;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	if (!vc4->v3d) {
+@@ -389,7 +389,7 @@ vc4_wait_for_seqno(struct drm_device *de
+ 	unsigned long timeout_expire;
+ 	DEFINE_WAIT(wait);
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	if (vc4->finished_seqno >= seqno)
+@@ -474,7 +474,7 @@ vc4_submit_next_bin_job(struct drm_devic
+ 	struct vc4_dev *vc4 = to_vc4_dev(dev);
+ 	struct vc4_exec_info *exec;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return;
+ 
+ again:
+@@ -522,7 +522,7 @@ vc4_submit_next_render_job(struct drm_de
+ 	if (!exec)
+ 		return;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return;
+ 
+ 	/* A previous RCL may have written to one of our textures, and
+@@ -543,7 +543,7 @@ vc4_move_job_to_render(struct drm_device
+ 	struct vc4_dev *vc4 = to_vc4_dev(dev);
+ 	bool was_empty = list_empty(&vc4->render_job_list);
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return;
+ 
+ 	list_move_tail(&exec->head, &vc4->render_job_list);
+@@ -970,7 +970,7 @@ vc4_job_handle_completed(struct vc4_dev
+ 	unsigned long irqflags;
+ 	struct vc4_seqno_cb *cb, *cb_temp;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return;
+ 
+ 	spin_lock_irqsave(&vc4->job_lock, irqflags);
+@@ -1009,7 +1009,7 @@ int vc4_queue_seqno_cb(struct drm_device
+ 	struct vc4_dev *vc4 = to_vc4_dev(dev);
+ 	unsigned long irqflags;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	cb->func = func;
+@@ -1065,7 +1065,7 @@ vc4_wait_seqno_ioctl(struct drm_device *
+ 	struct vc4_dev *vc4 = to_vc4_dev(dev);
+ 	struct drm_vc4_wait_seqno *args = data;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	return vc4_wait_for_seqno_ioctl_helper(dev, args->seqno,
+@@ -1082,7 +1082,7 @@ vc4_wait_bo_ioctl(struct drm_device *dev
+ 	struct drm_gem_object *gem_obj;
+ 	struct vc4_bo *bo;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	if (args->pad != 0)
+@@ -1131,7 +1131,7 @@ vc4_submit_cl_ioctl(struct drm_device *d
+ 				  args->shader_rec_size,
+ 				  args->bo_handle_count);
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	if (!vc4->v3d) {
+@@ -1267,7 +1267,7 @@ int vc4_gem_init(struct drm_device *dev)
+ 	struct vc4_dev *vc4 = to_vc4_dev(dev);
+ 	int ret;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	vc4->dma_fence_context = dma_fence_context_alloc(1);
+@@ -1326,7 +1326,7 @@ int vc4_gem_madvise_ioctl(struct drm_dev
+ 	struct vc4_bo *bo;
+ 	int ret;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	switch (args->madv) {
+--- a/drivers/gpu/drm/vc4/vc4_irq.c
++++ b/drivers/gpu/drm/vc4/vc4_irq.c
+@@ -263,7 +263,7 @@ vc4_irq_enable(struct drm_device *dev)
+ {
+ 	struct vc4_dev *vc4 = to_vc4_dev(dev);
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return;
+ 
+ 	if (!vc4->v3d)
+@@ -280,7 +280,7 @@ vc4_irq_disable(struct drm_device *dev)
+ {
+ 	struct vc4_dev *vc4 = to_vc4_dev(dev);
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return;
+ 
+ 	if (!vc4->v3d)
+@@ -303,7 +303,7 @@ int vc4_irq_install(struct drm_device *d
+ 	struct vc4_dev *vc4 = to_vc4_dev(dev);
+ 	int ret;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	if (irq == IRQ_NOTCONNECTED)
+@@ -324,7 +324,7 @@ void vc4_irq_uninstall(struct drm_device
+ {
+ 	struct vc4_dev *vc4 = to_vc4_dev(dev);
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return;
+ 
+ 	vc4_irq_disable(dev);
+@@ -337,7 +337,7 @@ void vc4_irq_reset(struct drm_device *de
+ 	struct vc4_dev *vc4 = to_vc4_dev(dev);
+ 	unsigned long irqflags;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return;
+ 
+ 	/* Acknowledge any stale IRQs. */
+--- a/drivers/gpu/drm/vc4/vc4_kms.c
++++ b/drivers/gpu/drm/vc4/vc4_kms.c
+@@ -461,7 +461,7 @@ static struct drm_framebuffer *vc4_fb_cr
+ 	struct vc4_dev *vc4 = to_vc4_dev(dev);
+ 	struct drm_mode_fb_cmd2 mode_cmd_local;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return ERR_PTR(-ENODEV);
+ 
+ 	/* If the user didn't specify a modifier, use the
+--- a/drivers/gpu/drm/vc4/vc4_perfmon.c
++++ b/drivers/gpu/drm/vc4/vc4_perfmon.c
+@@ -23,7 +23,7 @@ void vc4_perfmon_get(struct vc4_perfmon
+ 		return;
+ 
+ 	vc4 = perfmon->dev;
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return;
+ 
+ 	refcount_inc(&perfmon->refcnt);
+@@ -37,7 +37,7 @@ void vc4_perfmon_put(struct vc4_perfmon
+ 		return;
+ 
+ 	vc4 = perfmon->dev;
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return;
+ 
+ 	if (refcount_dec_and_test(&perfmon->refcnt))
+@@ -49,7 +49,7 @@ void vc4_perfmon_start(struct vc4_dev *v
+ 	unsigned int i;
+ 	u32 mask;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return;
+ 
+ 	if (WARN_ON_ONCE(!perfmon || vc4->active_perfmon))
+@@ -69,7 +69,7 @@ void vc4_perfmon_stop(struct vc4_dev *vc
+ {
+ 	unsigned int i;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return;
+ 
+ 	if (WARN_ON_ONCE(!vc4->active_perfmon ||
+@@ -90,7 +90,7 @@ struct vc4_perfmon *vc4_perfmon_find(str
+ 	struct vc4_dev *vc4 = vc4file->dev;
+ 	struct vc4_perfmon *perfmon;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return NULL;
+ 
+ 	mutex_lock(&vc4file->perfmon.lock);
+@@ -105,7 +105,7 @@ void vc4_perfmon_open_file(struct vc4_fi
+ {
+ 	struct vc4_dev *vc4 = vc4file->dev;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return;
+ 
+ 	mutex_init(&vc4file->perfmon.lock);
+@@ -131,7 +131,7 @@ void vc4_perfmon_close_file(struct vc4_f
+ {
+ 	struct vc4_dev *vc4 = vc4file->dev;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return;
+ 
+ 	mutex_lock(&vc4file->perfmon.lock);
+@@ -151,7 +151,7 @@ int vc4_perfmon_create_ioctl(struct drm_
+ 	unsigned int i;
+ 	int ret;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	if (!vc4->v3d) {
+@@ -205,7 +205,7 @@ int vc4_perfmon_destroy_ioctl(struct drm
+ 	struct drm_vc4_perfmon_destroy *req = data;
+ 	struct vc4_perfmon *perfmon;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	if (!vc4->v3d) {
+@@ -233,7 +233,7 @@ int vc4_perfmon_get_values_ioctl(struct
+ 	struct vc4_perfmon *perfmon;
+ 	int ret;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	if (!vc4->v3d) {
+--- a/drivers/gpu/drm/vc4/vc4_render_cl.c
++++ b/drivers/gpu/drm/vc4/vc4_render_cl.c
+@@ -599,7 +599,7 @@ int vc4_get_rcl(struct drm_device *dev,
+ 	bool has_bin = args->bin_cl_size != 0;
+ 	int ret;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	if (args->min_x_tile > args->max_x_tile ||
+--- a/drivers/gpu/drm/vc4/vc4_v3d.c
++++ b/drivers/gpu/drm/vc4/vc4_v3d.c
+@@ -127,7 +127,7 @@ static int vc4_v3d_debugfs_ident(struct
+ int
+ vc4_v3d_pm_get(struct vc4_dev *vc4)
+ {
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	mutex_lock(&vc4->power_lock);
+@@ -148,7 +148,7 @@ vc4_v3d_pm_get(struct vc4_dev *vc4)
+ void
+ vc4_v3d_pm_put(struct vc4_dev *vc4)
+ {
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return;
+ 
+ 	mutex_lock(&vc4->power_lock);
+@@ -178,7 +178,7 @@ int vc4_v3d_get_bin_slot(struct vc4_dev
+ 	uint64_t seqno = 0;
+ 	struct vc4_exec_info *exec;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ try_again:
+@@ -325,7 +325,7 @@ int vc4_v3d_bin_bo_get(struct vc4_dev *v
+ {
+ 	int ret = 0;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	mutex_lock(&vc4->bin_bo_lock);
+@@ -360,7 +360,7 @@ static void bin_bo_release(struct kref *
+ 
+ void vc4_v3d_bin_bo_put(struct vc4_dev *vc4)
+ {
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return;
+ 
+ 	mutex_lock(&vc4->bin_bo_lock);
+--- a/drivers/gpu/drm/vc4/vc4_validate.c
++++ b/drivers/gpu/drm/vc4/vc4_validate.c
+@@ -109,7 +109,7 @@ vc4_use_bo(struct vc4_exec_info *exec, u
+ 	struct drm_gem_dma_object *obj;
+ 	struct vc4_bo *bo;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return NULL;
+ 
+ 	if (hindex >= exec->bo_count) {
+@@ -169,7 +169,7 @@ vc4_check_tex_size(struct vc4_exec_info
+ 	uint32_t utile_w = utile_width(cpp);
+ 	uint32_t utile_h = utile_height(cpp);
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return false;
+ 
+ 	/* The shaded vertex format stores signed 12.4 fixed point
+@@ -495,7 +495,7 @@ vc4_validate_bin_cl(struct drm_device *d
+ 	uint32_t dst_offset = 0;
+ 	uint32_t src_offset = 0;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	while (src_offset < len) {
+@@ -942,7 +942,7 @@ vc4_validate_shader_recs(struct drm_devi
+ 	uint32_t i;
+ 	int ret = 0;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return -ENODEV;
+ 
+ 	for (i = 0; i < exec->shader_state_count; i++) {
+--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
++++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+@@ -786,7 +786,7 @@ vc4_validate_shader(struct drm_gem_dma_o
+ 	struct vc4_validated_shader_info *validated_shader = NULL;
+ 	struct vc4_shader_validation_state validation_state;
+ 
+-	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
++	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
+ 		return NULL;
+ 
+ 	memset(&validation_state, 0, sizeof(validation_state));
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0592-drm-vc4-hvs-Use-switch-statement-to-simplify-vc4_hvs.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0592-drm-vc4-hvs-Use-switch-statement-to-simplify-vc4_hvs.patch
new file mode 100644
index 00000000..dd4e1add
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0592-drm-vc4-hvs-Use-switch-statement-to-simplify-vc4_hvs.patch
@@ -0,0 +1,122 @@
+From da87f37b0b331dd7f1bb8166030dd04c72e20178 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 21 Jun 2024 16:20:46 +0100
+Subject: [PATCH 592/697] drm/vc4: hvs: Use switch statement to simplify
+ vc4_hvs_get_fifo_from_output
+
+Since we'll support BCM2712 soon, let's move the logic behind
+vc4_hvs_get_fifo_from_output() to a switch to extend it more easily.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-23-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 77 +++++++++++++++++++----------------
+ 1 file changed, 42 insertions(+), 35 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -297,53 +297,60 @@ int vc4_hvs_get_fifo_from_output(struct
+ 	u32 reg;
+ 	int ret;
+ 
+-	if (vc4->gen == VC4_GEN_4)
++	switch (vc4->gen) {
++	case VC4_GEN_4:
+ 		return output;
+ 
+-	/*
+-	 * NOTE: We should probably use drm_dev_enter()/drm_dev_exit()
+-	 * here, but this function is only used during the DRM device
+-	 * initialization, so we should be fine.
+-	 */
+-
+-	switch (output) {
+-	case 0:
+-		return 0;
+-
+-	case 1:
+-		return 1;
+-
+-	case 2:
+-		reg = HVS_READ(SCALER_DISPECTRL);
+-		ret = FIELD_GET(SCALER_DISPECTRL_DSP2_MUX_MASK, reg);
+-		if (ret == 0)
+-			return 2;
+-
+-		return 0;
+-
+-	case 3:
+-		reg = HVS_READ(SCALER_DISPCTRL);
+-		ret = FIELD_GET(SCALER_DISPCTRL_DSP3_MUX_MASK, reg);
+-		if (ret == 3)
+-			return -EPIPE;
++	case VC4_GEN_5:
++		/*
++		 * NOTE: We should probably use
++		 * drm_dev_enter()/drm_dev_exit() here, but this
++		 * function is only used during the DRM device
++		 * initialization, so we should be fine.
++		 */
++
++		switch (output) {
++		case 0:
++			return 0;
++
++		case 1:
++			return 1;
++
++		case 2:
++			reg = HVS_READ(SCALER_DISPECTRL);
++			ret = FIELD_GET(SCALER_DISPECTRL_DSP2_MUX_MASK, reg);
++			if (ret == 0)
++				return 2;
++
++			return 0;
++
++		case 3:
++			reg = HVS_READ(SCALER_DISPCTRL);
++			ret = FIELD_GET(SCALER_DISPCTRL_DSP3_MUX_MASK, reg);
++			if (ret == 3)
++				return -EPIPE;
++
++			return ret;
++
++		case 4:
++			reg = HVS_READ(SCALER_DISPEOLN);
++			ret = FIELD_GET(SCALER_DISPEOLN_DSP4_MUX_MASK, reg);
++			if (ret == 3)
++				return -EPIPE;
++
++			return ret;
++
++		case 5:
++			reg = HVS_READ(SCALER_DISPDITHER);
++			ret = FIELD_GET(SCALER_DISPDITHER_DSP5_MUX_MASK, reg);
++			if (ret == 3)
++				return -EPIPE;
+ 
+-		return ret;
++			return ret;
+ 
+-	case 4:
+-		reg = HVS_READ(SCALER_DISPEOLN);
+-		ret = FIELD_GET(SCALER_DISPEOLN_DSP4_MUX_MASK, reg);
+-		if (ret == 3)
++		default:
+ 			return -EPIPE;
+-
+-		return ret;
+-
+-	case 5:
+-		reg = HVS_READ(SCALER_DISPDITHER);
+-		ret = FIELD_GET(SCALER_DISPDITHER_DSP5_MUX_MASK, reg);
+-		if (ret == 3)
+-			return -EPIPE;
+-
+-		return ret;
++		}
+ 
+ 	default:
+ 		return -EPIPE;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0593-drm-vc4-hvs-Create-hw_init-function.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0593-drm-vc4-hvs-Create-hw_init-function.patch
new file mode 100644
index 00000000..60480ed4
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0593-drm-vc4-hvs-Create-hw_init-function.patch
@@ -0,0 +1,191 @@
+From ad69b82f16e14a10032e5e682e3aafb126258b5f Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 21 Jun 2024 16:20:47 +0100
+Subject: [PATCH 593/697] drm/vc4: hvs: Create hw_init function
+
+Since the BCM2712 will feature a significantly different HVS, let's move
+the hardware initialisation part of our bind function into a separate
+function.
+
+That way, it will be easier to extend in the future.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-24-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 155 ++++++++++++++++++----------------
+ 1 file changed, 83 insertions(+), 72 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -852,79 +852,10 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
+ 	return hvs;
+ }
+ 
+-static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)
++static int vc4_hvs_hw_init(struct vc4_hvs *hvs)
+ {
+-	struct platform_device *pdev = to_platform_device(dev);
+-	struct drm_device *drm = dev_get_drvdata(master);
+-	struct vc4_dev *vc4 = to_vc4_dev(drm);
+-	struct vc4_hvs *hvs = NULL;
+-	int ret;
+-	u32 dispctrl;
+-	u32 reg, top;
+-
+-	hvs = __vc4_hvs_alloc(vc4, NULL);
+-	if (IS_ERR(hvs))
+-		return PTR_ERR(hvs);
+-
+-	hvs->regs = vc4_ioremap_regs(pdev, 0);
+-	if (IS_ERR(hvs->regs))
+-		return PTR_ERR(hvs->regs);
+-
+-	hvs->regset.base = hvs->regs;
+-	hvs->regset.regs = hvs_regs;
+-	hvs->regset.nregs = ARRAY_SIZE(hvs_regs);
+-
+-	if (vc4->gen == VC4_GEN_5) {
+-		struct rpi_firmware *firmware;
+-		struct device_node *node;
+-		unsigned int max_rate;
+-
+-		node = rpi_firmware_find_node();
+-		if (!node)
+-			return -EINVAL;
+-
+-		firmware = rpi_firmware_get(node);
+-		of_node_put(node);
+-		if (!firmware)
+-			return -EPROBE_DEFER;
+-
+-		hvs->core_clk = devm_clk_get(&pdev->dev, NULL);
+-		if (IS_ERR(hvs->core_clk)) {
+-			dev_err(&pdev->dev, "Couldn't get core clock\n");
+-			return PTR_ERR(hvs->core_clk);
+-		}
+-
+-		max_rate = rpi_firmware_clk_get_max_rate(firmware,
+-							 RPI_FIRMWARE_CORE_CLK_ID);
+-		rpi_firmware_put(firmware);
+-		if (max_rate >= 550000000)
+-			hvs->vc5_hdmi_enable_hdmi_20 = true;
+-
+-		if (max_rate >= 600000000)
+-			hvs->vc5_hdmi_enable_4096by2160 = true;
+-
+-		hvs->max_core_rate = max_rate;
+-
+-		ret = clk_prepare_enable(hvs->core_clk);
+-		if (ret) {
+-			dev_err(&pdev->dev, "Couldn't enable the core clock\n");
+-			return ret;
+-		}
+-	}
+-
+-	if (vc4->gen == VC4_GEN_4)
+-		hvs->dlist = hvs->regs + SCALER_DLIST_START;
+-	else
+-		hvs->dlist = hvs->regs + SCALER5_DLIST_START;
+-
+-	/* Upload filter kernels.  We only have the one for now, so we
+-	 * keep it around for the lifetime of the driver.
+-	 */
+-	ret = vc4_hvs_upload_linear_kernel(hvs,
+-					   &hvs->mitchell_netravali_filter,
+-					   mitchell_netravali_1_3_1_3_kernel);
+-	if (ret)
+-		return ret;
++	struct vc4_dev *vc4 = hvs->vc4;
++	u32 dispctrl, reg;
+ 
+ 	reg = HVS_READ(SCALER_DISPECTRL);
+ 	reg &= ~SCALER_DISPECTRL_DSP2_MUX_MASK;
+@@ -1006,6 +937,86 @@ static int vc4_hvs_bind(struct device *d
+ 
+ 	HVS_WRITE(SCALER_DISPCTRL, dispctrl);
+ 
++	return 0;
++}
++
++static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)
++{
++	struct platform_device *pdev = to_platform_device(dev);
++	struct drm_device *drm = dev_get_drvdata(master);
++	struct vc4_dev *vc4 = to_vc4_dev(drm);
++	struct vc4_hvs *hvs = NULL;
++	int ret;
++	u32 reg, top;
++
++	hvs = __vc4_hvs_alloc(vc4, NULL);
++	if (IS_ERR(hvs))
++		return PTR_ERR(hvs);
++
++	hvs->regs = vc4_ioremap_regs(pdev, 0);
++	if (IS_ERR(hvs->regs))
++		return PTR_ERR(hvs->regs);
++
++	hvs->regset.base = hvs->regs;
++	hvs->regset.regs = hvs_regs;
++	hvs->regset.nregs = ARRAY_SIZE(hvs_regs);
++
++	if (vc4->gen == VC4_GEN_5) {
++		struct rpi_firmware *firmware;
++		struct device_node *node;
++		unsigned int max_rate;
++
++		node = rpi_firmware_find_node();
++		if (!node)
++			return -EINVAL;
++
++		firmware = rpi_firmware_get(node);
++		of_node_put(node);
++		if (!firmware)
++			return -EPROBE_DEFER;
++
++		hvs->core_clk = devm_clk_get(&pdev->dev, NULL);
++		if (IS_ERR(hvs->core_clk)) {
++			dev_err(&pdev->dev, "Couldn't get core clock\n");
++			return PTR_ERR(hvs->core_clk);
++		}
++
++		max_rate = rpi_firmware_clk_get_max_rate(firmware,
++							 RPI_FIRMWARE_CORE_CLK_ID);
++		rpi_firmware_put(firmware);
++		if (max_rate >= 550000000)
++			hvs->vc5_hdmi_enable_hdmi_20 = true;
++
++		if (max_rate >= 600000000)
++			hvs->vc5_hdmi_enable_4096by2160 = true;
++
++		hvs->max_core_rate = max_rate;
++
++		ret = clk_prepare_enable(hvs->core_clk);
++		if (ret) {
++			dev_err(&pdev->dev, "Couldn't enable the core clock\n");
++			return ret;
++		}
++	}
++
++	if (vc4->gen == VC4_GEN_4)
++		hvs->dlist = hvs->regs + SCALER_DLIST_START;
++	else
++		hvs->dlist = hvs->regs + SCALER5_DLIST_START;
++
++	/* Upload filter kernels.  We only have the one for now, so we
++	 * keep it around for the lifetime of the driver.
++	 */
++	ret = vc4_hvs_upload_linear_kernel(hvs,
++					   &hvs->mitchell_netravali_filter,
++					   mitchell_netravali_1_3_1_3_kernel);
++	if (ret)
++		return ret;
++
++	ret = vc4_hvs_hw_init(hvs);
++	if (ret)
++		return ret;
++
+ 	/* Recompute Composite Output Buffer (COB) allocations for the displays
+ 	 */
+ 	if (vc4->gen == VC4_GEN_4) {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0594-drm-vc4-hvs-Create-cob_init-function.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0594-drm-vc4-hvs-Create-cob_init-function.patch
new file mode 100644
index 00000000..6cf47b04
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0594-drm-vc4-hvs-Create-cob_init-function.patch
@@ -0,0 +1,170 @@
+From a8f2332d49ab927de1081a230136316c846fde08 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 21 Jun 2024 16:20:48 +0100
+Subject: [PATCH 594/697] drm/vc4: hvs: Create cob_init function
+
+Just like the HVS itself, the COB parameters will be fairly different in
+the BCM2712.
+
+Let's move the COB parameters computation and its initialisation to a
+separate function that will be easier to extend in the future.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-25-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 128 ++++++++++++++++++++--------------
+ 1 file changed, 74 insertions(+), 54 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -940,6 +940,77 @@ static int vc4_hvs_hw_init(struct vc4_hv
+ 	return 0;
+ }
+ 
++static int vc4_hvs_cob_init(struct vc4_hvs *hvs)
++{
++	struct vc4_dev *vc4 = hvs->vc4;
++	u32 reg, top;
++
++	/*
++	 * Recompute Composite Output Buffer (COB) allocations for the
++	 * displays
++	 */
++	switch (vc4->gen) {
++	case VC4_GEN_4:
++		/* The COB is 20736 pixels, or just over 10 lines at 2048 wide.
++		 * The bottom 2048 pixels are full 32bpp RGBA (intended for the
++		 * TXP composing RGBA to memory), whilst the remainder are only
++		 * 24bpp RGB.
++		 *
++		 * Assign 3 lines to channels 1 & 2, and just over 4 lines to
++		 * channel 0.
++		 */
++		#define VC4_COB_SIZE		20736
++		#define VC4_COB_LINE_WIDTH	2048
++		#define VC4_COB_NUM_LINES	3
++		reg = 0;
++		top = VC4_COB_LINE_WIDTH * VC4_COB_NUM_LINES;
++		reg |= (top - 1) << 16;
++		HVS_WRITE(SCALER_DISPBASE2, reg);
++		reg = top;
++		top += VC4_COB_LINE_WIDTH * VC4_COB_NUM_LINES;
++		reg |= (top - 1) << 16;
++		HVS_WRITE(SCALER_DISPBASE1, reg);
++		reg = top;
++		top = VC4_COB_SIZE;
++		reg |= (top - 1) << 16;
++		HVS_WRITE(SCALER_DISPBASE0, reg);
++		break;
++
++	case VC4_GEN_5:
++		/* The COB is 44416 pixels, or 10.8 lines at 4096 wide.
++		 * The bottom 4096 pixels are full RGBA (intended for the TXP
++		 * composing RGBA to memory), whilst the remainder are only
++		 * RGB. Addressing is always pixel wide.
++		 *
++		 * Assign 3 lines of 4096 to channels 1 & 2, and just over 4
++		 * lines. to channel 0.
++		 */
++		#define VC5_COB_SIZE		44416
++		#define VC5_COB_LINE_WIDTH	4096
++		#define VC5_COB_NUM_LINES	3
++		reg = 0;
++		top = VC5_COB_LINE_WIDTH * VC5_COB_NUM_LINES;
++		reg |= top << 16;
++		HVS_WRITE(SCALER_DISPBASE2, reg);
++		top += 16;
++		reg = top;
++		top += VC5_COB_LINE_WIDTH * VC5_COB_NUM_LINES;
++		reg |= top << 16;
++		HVS_WRITE(SCALER_DISPBASE1, reg);
++		top += 16;
++		reg = top;
++		top = VC5_COB_SIZE;
++		reg |= top << 16;
++		HVS_WRITE(SCALER_DISPBASE0, reg);
++		break;
++
++	default:
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
+ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)
+ {
+ 	struct platform_device *pdev = to_platform_device(dev);
+@@ -947,7 +1018,6 @@ static int vc4_hvs_bind(struct device *d
+ 	struct vc4_dev *vc4 = to_vc4_dev(drm);
+ 	struct vc4_hvs *hvs = NULL;
+ 	int ret;
+-	u32 reg, top;
+ 
+ 	hvs = __vc4_hvs_alloc(vc4, NULL);
+ 	if (IS_ERR(hvs))
+@@ -1017,59 +1087,9 @@ static int vc4_hvs_bind(struct device *d
+ 	if (ret)
+ 		return ret;
+ 
+-	/* Recompute Composite Output Buffer (COB) allocations for the displays
+-	 */
+-	if (vc4->gen == VC4_GEN_4) {
+-		/* The COB is 20736 pixels, or just over 10 lines at 2048 wide.
+-		 * The bottom 2048 pixels are full 32bpp RGBA (intended for the
+-		 * TXP composing RGBA to memory), whilst the remainder are only
+-		 * 24bpp RGB.
+-		 *
+-		 * Assign 3 lines to channels 1 & 2, and just over 4 lines to
+-		 * channel 0.
+-		 */
+-		#define VC4_COB_SIZE		20736
+-		#define VC4_COB_LINE_WIDTH	2048
+-		#define VC4_COB_NUM_LINES	3
+-		reg = 0;
+-		top = VC4_COB_LINE_WIDTH * VC4_COB_NUM_LINES;
+-		reg |= (top - 1) << 16;
+-		HVS_WRITE(SCALER_DISPBASE2, reg);
+-		reg = top;
+-		top += VC4_COB_LINE_WIDTH * VC4_COB_NUM_LINES;
+-		reg |= (top - 1) << 16;
+-		HVS_WRITE(SCALER_DISPBASE1, reg);
+-		reg = top;
+-		top = VC4_COB_SIZE;
+-		reg |= (top - 1) << 16;
+-		HVS_WRITE(SCALER_DISPBASE0, reg);
+-	} else {
+-		/* The COB is 44416 pixels, or 10.8 lines at 4096 wide.
+-		 * The bottom 4096 pixels are full RGBA (intended for the TXP
+-		 * composing RGBA to memory), whilst the remainder are only
+-		 * RGB. Addressing is always pixel wide.
+-		 *
+-		 * Assign 3 lines of 4096 to channels 1 & 2, and just over 4
+-		 * lines. to channel 0.
+-		 */
+-		#define VC5_COB_SIZE		44416
+-		#define VC5_COB_LINE_WIDTH	4096
+-		#define VC5_COB_NUM_LINES	3
+-		reg = 0;
+-		top = VC5_COB_LINE_WIDTH * VC5_COB_NUM_LINES;
+-		reg |= top << 16;
+-		HVS_WRITE(SCALER_DISPBASE2, reg);
+-		top += 16;
+-		reg = top;
+-		top += VC5_COB_LINE_WIDTH * VC5_COB_NUM_LINES;
+-		reg |= top << 16;
+-		HVS_WRITE(SCALER_DISPBASE1, reg);
+-		top += 16;
+-		reg = top;
+-		top = VC5_COB_SIZE;
+-		reg |= top << 16;
+-		HVS_WRITE(SCALER_DISPBASE0, reg);
+-	}
++	ret = vc4_hvs_cob_init(hvs);
++	if (ret)
++		return ret;
+ 
+ 	ret = devm_request_irq(dev, platform_get_irq(pdev, 0),
+ 			       vc4_hvs_irq_handler, 0, "vc4 hvs", drm);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0595-drm-vc4-hvs-Rename-hvs_regs-list.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0595-drm-vc4-hvs-Rename-hvs_regs-list.patch
new file mode 100644
index 00000000..9bf0b980
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0595-drm-vc4-hvs-Rename-hvs_regs-list.patch
@@ -0,0 +1,41 @@
+From 1df6adc0e070cec769a4479225c3af64a2c77f56 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 21 Jun 2024 16:20:49 +0100
+Subject: [PATCH 595/697] drm/vc4: hvs: Rename hvs_regs list
+
+The HVS register set has been heavily modified in the BCM2712, and we'll
+thus need a separate debugfs_reg32 array for it.
+
+The name hvs_regs is thus a bit too generic, so let's rename it to
+something more specific.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-26-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -33,7 +33,7 @@
+ #include "vc4_drv.h"
+ #include "vc4_regs.h"
+ 
+-static const struct debugfs_reg32 hvs_regs[] = {
++static const struct debugfs_reg32 vc4_hvs_regs[] = {
+ 	VC4_REG32(SCALER_DISPCTRL),
+ 	VC4_REG32(SCALER_DISPSTAT),
+ 	VC4_REG32(SCALER_DISPID),
+@@ -1028,8 +1028,8 @@ static int vc4_hvs_bind(struct device *d
+ 		return PTR_ERR(hvs->regs);
+ 
+ 	hvs->regset.base = hvs->regs;
+-	hvs->regset.regs = hvs_regs;
+-	hvs->regset.nregs = ARRAY_SIZE(hvs_regs);
++	hvs->regset.regs = vc4_hvs_regs;
++	hvs->regset.nregs = ARRAY_SIZE(vc4_hvs_regs);
+ 
+ 	if (vc4->gen == VC4_GEN_5) {
+ 		struct rpi_firmware *firmware;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0596-drm-vc4-plane-Change-ptr0_offset-to-an-array.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0596-drm-vc4-plane-Change-ptr0_offset-to-an-array.patch
new file mode 100644
index 00000000..bf087fab
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0596-drm-vc4-plane-Change-ptr0_offset-to-an-array.patch
@@ -0,0 +1,106 @@
+From f177dbf0b5d462c8b1385e8d27df5e9f79410ea5 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 21 Jun 2024 16:20:50 +0100
+Subject: [PATCH 596/697] drm/vc4: plane: Change ptr0_offset to an array
+
+The BCM2712 will have a fairly different dlist, that will feature one
+Pointer 0 word for each plane.
+
+Let's prepare by changing the ptr0_offset variable that holds the offset
+in a dlist of the pointer 0 word to an array.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-27-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_drv.h   |  3 ++-
+ drivers/gpu/drm/vc4/vc4_plane.c | 18 +++++++++---------
+ 2 files changed, 11 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -15,6 +15,7 @@
+ #include <drm/drm_debugfs.h>
+ #include <drm/drm_device.h>
+ #include <drm/drm_encoder.h>
++#include <drm/drm_fourcc.h>
+ #include <drm/drm_gem_dma_helper.h>
+ #include <drm/drm_managed.h>
+ #include <drm/drm_mm.h>
+@@ -400,7 +401,7 @@ struct vc4_plane_state {
+ 	 */
+ 	u32 pos0_offset;
+ 	u32 pos2_offset;
+-	u32 ptr0_offset;
++	u32 ptr0_offset[DRM_FORMAT_MAX_PLANES];
+ 	u32 lbm_offset;
+ 
+ 	/* Offset where the plane's dlist was last stored in the
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -1256,7 +1256,7 @@ static int vc4_plane_mode_set(struct drm
+ 	 *
+ 	 * The pointers may be any byte address.
+ 	 */
+-	vc4_state->ptr0_offset = vc4_state->dlist_count;
++	vc4_state->ptr0_offset[0] = vc4_state->dlist_count;
+ 	for (i = 0; i < num_planes; i++)
+ 		vc4_dlist_write(vc4_state, vc4_state->offsets[i]);
+ 
+@@ -1460,13 +1460,13 @@ void vc4_plane_async_set_fb(struct drm_p
+ 	 * scanout will start from this address as soon as the FIFO
+ 	 * needs to refill with pixels.
+ 	 */
+-	writel(addr, &vc4_state->hw_dlist[vc4_state->ptr0_offset]);
++	writel(addr, &vc4_state->hw_dlist[vc4_state->ptr0_offset[0]]);
+ 
+ 	/* Also update the CPU-side dlist copy, so that any later
+ 	 * atomic updates that don't do a new modeset on our plane
+ 	 * also use our updated address.
+ 	 */
+-	vc4_state->dlist[vc4_state->ptr0_offset] = addr;
++	vc4_state->dlist[vc4_state->ptr0_offset[0]] = addr;
+ 
+ 	drm_dev_exit(idx);
+ }
+@@ -1530,8 +1530,8 @@ static void vc4_plane_atomic_async_updat
+ 		new_vc4_state->dlist[vc4_state->pos0_offset];
+ 	vc4_state->dlist[vc4_state->pos2_offset] =
+ 		new_vc4_state->dlist[vc4_state->pos2_offset];
+-	vc4_state->dlist[vc4_state->ptr0_offset] =
+-		new_vc4_state->dlist[vc4_state->ptr0_offset];
++	vc4_state->dlist[vc4_state->ptr0_offset[0]] =
++		new_vc4_state->dlist[vc4_state->ptr0_offset[0]];
+ 
+ 	/* Note that we can't just call vc4_plane_write_dlist()
+ 	 * because that would smash the context data that the HVS is
+@@ -1541,8 +1541,8 @@ static void vc4_plane_atomic_async_updat
+ 	       &vc4_state->hw_dlist[vc4_state->pos0_offset]);
+ 	writel(vc4_state->dlist[vc4_state->pos2_offset],
+ 	       &vc4_state->hw_dlist[vc4_state->pos2_offset]);
+-	writel(vc4_state->dlist[vc4_state->ptr0_offset],
+-	       &vc4_state->hw_dlist[vc4_state->ptr0_offset]);
++	writel(vc4_state->dlist[vc4_state->ptr0_offset[0]],
++	       &vc4_state->hw_dlist[vc4_state->ptr0_offset[0]]);
+ 
+ 	drm_dev_exit(idx);
+ }
+@@ -1569,7 +1569,7 @@ static int vc4_plane_atomic_async_check(
+ 	if (old_vc4_state->dlist_count != new_vc4_state->dlist_count ||
+ 	    old_vc4_state->pos0_offset != new_vc4_state->pos0_offset ||
+ 	    old_vc4_state->pos2_offset != new_vc4_state->pos2_offset ||
+-	    old_vc4_state->ptr0_offset != new_vc4_state->ptr0_offset ||
++	    old_vc4_state->ptr0_offset[0] != new_vc4_state->ptr0_offset[0] ||
+ 	    vc4_lbm_size(plane->state) != vc4_lbm_size(new_plane_state))
+ 		return -EINVAL;
+ 
+@@ -1579,7 +1579,7 @@ static int vc4_plane_atomic_async_check(
+ 	for (i = 0; i < new_vc4_state->dlist_count; i++) {
+ 		if (i == new_vc4_state->pos0_offset ||
+ 		    i == new_vc4_state->pos2_offset ||
+-		    i == new_vc4_state->ptr0_offset ||
++		    i == new_vc4_state->ptr0_offset[0] ||
+ 		    (new_vc4_state->lbm_offset &&
+ 		     i == new_vc4_state->lbm_offset))
+ 			continue;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0597-drm-vc4-hvs-Rework-LBM-alignment.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0597-drm-vc4-hvs-Rework-LBM-alignment.patch
new file mode 100644
index 00000000..38b0919d
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0597-drm-vc4-hvs-Rework-LBM-alignment.patch
@@ -0,0 +1,48 @@
+From 7fad97c41efc31d6e11bd4e2a02fffa3a00b7137 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 21 Jun 2024 16:20:51 +0100
+Subject: [PATCH 597/697] drm/vc4: hvs: Rework LBM alignment
+
+With the introduction of the support for BCM2712, the check of whether
+we're running on vc5 or not to compute the LBM alignment requirement
+doesn't work anymore.
+
+Moreover, the LBM size will need to be computed in words for the
+BCM2712, while we've had sizes in bytes so far.
+
+Aligning on either 64 or 32 words is thus fairly harmful on BCM2712, so
+let's just explicitly align the size when needed, and then call
+drm_mm_insert_node_generic() with an alignment of 1.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-28-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -756,6 +756,11 @@ static int vc4_plane_allocate_lbm(struct
+ 	if (!lbm_size)
+ 		return 0;
+ 
++	if (vc4->gen == VC4_GEN_5)
++		lbm_size = ALIGN(lbm_size, 64);
++	else if (vc4->gen == VC4_GEN_4)
++		lbm_size = ALIGN(lbm_size, 32);
++
+ 	drm_dbg_driver(drm, "[PLANE:%d:%s] LBM Allocation Size: %u\n",
+ 		       plane->base.id, plane->name, lbm_size);
+ 
+@@ -771,8 +776,7 @@ static int vc4_plane_allocate_lbm(struct
+ 		spin_lock_irqsave(&vc4->hvs->mm_lock, irqflags);
+ 		ret = drm_mm_insert_node_generic(&vc4->hvs->lbm_mm,
+ 						 &vc4_state->lbm,
+-						 lbm_size,
+-						 vc4->gen == VC4_GEN_5 ? 64 : 32,
++						 lbm_size, 1,
+ 						 0, 0);
+ 		spin_unlock_irqrestore(&vc4->hvs->mm_lock, irqflags);
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0598-drm-vc4-hvs-Change-prototype-of-__vc4_hvs_alloc-to-p.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0598-drm-vc4-hvs-Change-prototype-of-__vc4_hvs_alloc-to-p.patch
new file mode 100644
index 00000000..5267a875
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0598-drm-vc4-hvs-Change-prototype-of-__vc4_hvs_alloc-to-p.patch
@@ -0,0 +1,96 @@
+From d6e14d51f2ba0cd897f78c2ff487a0dc637e4a68 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 21 Jun 2024 16:20:52 +0100
+Subject: [PATCH 598/697] drm/vc4: hvs: Change prototype of __vc4_hvs_alloc to
+ pass registers
+
+The BCM2712 HVS has registers to report the size of the various SRAM the
+driver uses, and their size actually differ depending on the stepping.
+
+The initialisation of the memory pools happen in the __vc4_hvs_alloc()
+function that also allocates the main HVS structure, that will then hold
+the pointer to the memory mapping of the registers.
+
+This creates some kind of circular dependency that we can break by
+passing the mapping pointer as an argument for __vc4_hvs_alloc() to use
+to query to get the SRAM sizes and initialise the memory pools
+accordingly.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-29-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/tests/vc4_mock.c |  2 +-
+ drivers/gpu/drm/vc4/vc4_drv.h        |  4 +++-
+ drivers/gpu/drm/vc4/vc4_hvs.c        | 16 ++++++++++------
+ 3 files changed, 14 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/tests/vc4_mock.c
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock.c
+@@ -175,7 +175,7 @@ static struct vc4_dev *__mock_device(str
+ 	vc4->dev = dev;
+ 	vc4->gen = gen;
+ 
+-	vc4->hvs = __vc4_hvs_alloc(vc4, NULL);
++	vc4->hvs = __vc4_hvs_alloc(vc4, NULL, NULL);
+ 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, vc4->hvs);
+ 
+ 	drm = &vc4->base;
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -1004,7 +1004,9 @@ void vc4_irq_reset(struct drm_device *de
+ 
+ /* vc4_hvs.c */
+ extern struct platform_driver vc4_hvs_driver;
+-struct vc4_hvs *__vc4_hvs_alloc(struct vc4_dev *vc4, struct platform_device *pdev);
++struct vc4_hvs *__vc4_hvs_alloc(struct vc4_dev *vc4,
++				void __iomem *regs,
++				struct platform_device *pdev);
+ void vc4_hvs_stop_channel(struct vc4_hvs *hvs, unsigned int output);
+ int vc4_hvs_get_fifo_from_output(struct vc4_hvs *hvs, unsigned int output);
+ u8 vc4_hvs_get_fifo_frame_count(struct vc4_hvs *hvs, unsigned int fifo);
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -811,7 +811,9 @@ int vc4_hvs_debugfs_init(struct drm_mino
+ 	return 0;
+ }
+ 
+-struct vc4_hvs *__vc4_hvs_alloc(struct vc4_dev *vc4, struct platform_device *pdev)
++struct vc4_hvs *__vc4_hvs_alloc(struct vc4_dev *vc4,
++				void __iomem *regs,
++				struct platform_device *pdev)
+ {
+ 	struct drm_device *drm = &vc4->base;
+ 	struct vc4_hvs *hvs;
+@@ -821,6 +823,7 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
+ 		return ERR_PTR(-ENOMEM);
+ 
+ 	hvs->vc4 = vc4;
++	hvs->regs = regs;
+ 	hvs->pdev = pdev;
+ 
+ 	spin_lock_init(&hvs->mm_lock);
+@@ -1017,16 +1020,17 @@ static int vc4_hvs_bind(struct device *d
+ 	struct drm_device *drm = dev_get_drvdata(master);
+ 	struct vc4_dev *vc4 = to_vc4_dev(drm);
+ 	struct vc4_hvs *hvs = NULL;
++	void __iomem *regs;
+ 	int ret;
+ 
+-	hvs = __vc4_hvs_alloc(vc4, NULL);
++	regs = vc4_ioremap_regs(pdev, 0);
++	if (IS_ERR(regs))
++		return PTR_ERR(regs);
++
++	hvs = __vc4_hvs_alloc(vc4, regs, pdev);
+ 	if (IS_ERR(hvs))
+ 		return PTR_ERR(hvs);
+ 
+-	hvs->regs = vc4_ioremap_regs(pdev, 0);
+-	if (IS_ERR(hvs->regs))
+-		return PTR_ERR(hvs->regs);
+-
+ 	hvs->regset.base = hvs->regs;
+ 	hvs->regset.regs = vc4_hvs_regs;
+ 	hvs->regset.nregs = ARRAY_SIZE(vc4_hvs_regs);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0599-drm-vc4-plane-Move-the-buffer-offset-out-of-the-vc4_.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0599-drm-vc4-plane-Move-the-buffer-offset-out-of-the-vc4_.patch
new file mode 100644
index 00000000..8f37e03c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0599-drm-vc4-plane-Move-the-buffer-offset-out-of-the-vc4_.patch
@@ -0,0 +1,157 @@
+From 420fd006fa57734fb038c45b64b7a13ef21f181c Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 21 Jun 2024 16:20:53 +0100
+Subject: [PATCH 599/697] drm/vc4: plane: Move the buffer offset out of the
+ vc4_plane_state
+
+The offset fields in vc4_plane_state are described as being
+the offset for each buffer in the bo, however it is used to
+store the complete DMA address that is then written into the
+register.
+
+The DMA address including the fb ofset can be retrieved
+using drm_fb_dma_get_gem_addr, and the offset adjustment due to
+clipping is local to vc4_plane_mode_set.
+Drop the offset field from the state, and compute the complete
+DMA address in vc4_plane_mode_set.
+
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-30-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_drv.h   |  5 ----
+ drivers/gpu/drm/vc4/vc4_plane.c | 51 +++++++++++++--------------------
+ 2 files changed, 20 insertions(+), 36 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -421,11 +421,6 @@ struct vc4_plane_state {
+ 	bool is_unity;
+ 	bool is_yuv;
+ 
+-	/* Offset to start scanning out from the start of the plane's
+-	 * BO.
+-	 */
+-	u32 offsets[3];
+-
+ 	/* Our allocation in LBM for temporary storage during scaling. */
+ 	struct drm_mm_node lbm;
+ 
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -450,12 +450,11 @@ static int vc4_plane_setup_clipping_and_
+ {
+ 	struct vc4_plane_state *vc4_state = to_vc4_plane_state(state);
+ 	struct drm_framebuffer *fb = state->fb;
+-	struct drm_gem_dma_object *bo;
+ 	int num_planes = fb->format->num_planes;
+ 	struct drm_crtc_state *crtc_state;
+ 	u32 h_subsample = fb->format->hsub;
+ 	u32 v_subsample = fb->format->vsub;
+-	int i, ret;
++	int ret;
+ 
+ 	crtc_state = drm_atomic_get_existing_crtc_state(state->state,
+ 							state->crtc);
+@@ -469,11 +468,6 @@ static int vc4_plane_setup_clipping_and_
+ 	if (ret)
+ 		return ret;
+ 
+-	for (i = 0; i < num_planes; i++) {
+-		bo = drm_fb_dma_get_gem_obj(fb, i);
+-		vc4_state->offsets[i] = bo->dma_addr + fb->offsets[i];
+-	}
+-
+ 	vc4_state->src_x = state->src.x1;
+ 	vc4_state->src_y = state->src.y1;
+ 	vc4_state->src_w[0] = state->src.x2 - vc4_state->src_x;
+@@ -902,6 +896,7 @@ static int vc4_plane_mode_set(struct drm
+ 	u32 width, height;
+ 	u32 hvs_format = format->hvs;
+ 	unsigned int rotation;
++	u32 offsets[3] = { 0 };
+ 	int ret, i;
+ 
+ 	if (vc4_state->dlist_initialized)
+@@ -949,13 +944,8 @@ static int vc4_plane_mode_set(struct drm
+ 		 * out.
+ 		 */
+ 		for (i = 0; i < num_planes; i++) {
+-			vc4_state->offsets[i] += src_y /
+-						 (i ? v_subsample : 1) *
+-						 fb->pitches[i];
+-
+-			vc4_state->offsets[i] += src_x /
+-						 (i ? h_subsample : 1) *
+-						 fb->format->cpp[i];
++			offsets[i] += src_y / (i ? v_subsample : 1) * fb->pitches[i];
++			offsets[i] += src_x / (i ? h_subsample : 1) * fb->format->cpp[i];
+ 		}
+ 
+ 		break;
+@@ -1010,19 +1000,18 @@ static int vc4_plane_mode_set(struct drm
+ 			   VC4_SET_FIELD(y_off, SCALER_PITCH0_TILE_Y_OFFSET) |
+ 			   VC4_SET_FIELD(tiles_l, SCALER_PITCH0_TILE_WIDTH_L) |
+ 			   VC4_SET_FIELD(tiles_r, SCALER_PITCH0_TILE_WIDTH_R));
+-		vc4_state->offsets[0] += tiles_t * (tiles_w << tile_size_shift);
+-		vc4_state->offsets[0] += subtile_y << 8;
+-		vc4_state->offsets[0] += utile_y << 4;
++		offsets[0] += tiles_t * (tiles_w << tile_size_shift);
++		offsets[0] += subtile_y << 8;
++		offsets[0] += utile_y << 4;
+ 
+ 		/* Rows of tiles alternate left-to-right and right-to-left. */
+ 		if (tiles_t & 1) {
+ 			pitch0 |= SCALER_PITCH0_TILE_INITIAL_LINE_DIR;
+-			vc4_state->offsets[0] += (tiles_w - tiles_l) <<
+-						 tile_size_shift;
+-			vc4_state->offsets[0] -= (1 + !tile_y) << 10;
++			offsets[0] += (tiles_w - tiles_l) << tile_size_shift;
++			offsets[0] -= (1 + !tile_y) << 10;
+ 		} else {
+-			vc4_state->offsets[0] += tiles_l << tile_size_shift;
+-			vc4_state->offsets[0] += tile_y << 10;
++			offsets[0] += tiles_l << tile_size_shift;
++			offsets[0] += tile_y << 10;
+ 		}
+ 
+ 		break;
+@@ -1111,11 +1100,9 @@ static int vc4_plane_mode_set(struct drm
+ 
+ 			tile = src_x / pix_per_tile;
+ 
+-			vc4_state->offsets[i] += param * tile_w * tile;
+-			vc4_state->offsets[i] += src_y /
+-						 (i ? v_subsample : 1) *
+-						 tile_w;
+-			vc4_state->offsets[i] += x_off & ~(i ? 1 : 0);
++			offsets[i] += param * tile_w * tile;
++			offsets[i] += src_y / (i ? v_subsample : 1) * tile_w;
++			offsets[i] += x_off & ~(i ? 1 : 0);
+ 		}
+ 
+ 		pitch0 = VC4_SET_FIELD(param, SCALER_TILE_HEIGHT);
+@@ -1261,8 +1248,12 @@ static int vc4_plane_mode_set(struct drm
+ 	 * The pointers may be any byte address.
+ 	 */
+ 	vc4_state->ptr0_offset[0] = vc4_state->dlist_count;
+-	for (i = 0; i < num_planes; i++)
+-		vc4_dlist_write(vc4_state, vc4_state->offsets[i]);
++
++	for (i = 0; i < num_planes; i++) {
++		struct drm_gem_dma_object *bo = drm_fb_dma_get_gem_obj(fb, i);
++
++		vc4_dlist_write(vc4_state, bo->dma_addr + fb->offsets[i] + offsets[i]);
++	}
+ 
+ 	/* Pointer Context Word 0/1/2: Written by the HVS */
+ 	for (i = 0; i < num_planes; i++)
+@@ -1525,8 +1516,6 @@ static void vc4_plane_atomic_async_updat
+ 	       sizeof(vc4_state->y_scaling));
+ 	vc4_state->is_unity = new_vc4_state->is_unity;
+ 	vc4_state->is_yuv = new_vc4_state->is_yuv;
+-	memcpy(vc4_state->offsets, new_vc4_state->offsets,
+-	       sizeof(vc4_state->offsets));
+ 	vc4_state->needs_bg_fill = new_vc4_state->needs_bg_fill;
+ 
+ 	/* Update the current vc4_state pos0, pos2 and ptr0 dlist entries. */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0600-drm-vc4-hvs-Enable-SCALER_CONTROL-early-in-HVS-init.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0600-drm-vc4-hvs-Enable-SCALER_CONTROL-early-in-HVS-init.patch
new file mode 100644
index 00000000..89c58d12
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0600-drm-vc4-hvs-Enable-SCALER_CONTROL-early-in-HVS-init.patch
@@ -0,0 +1,62 @@
+From 3296bfaf306fc3ebd224ececb6e58dcad10de3f6 Mon Sep 17 00:00:00 2001
+From: Tim Gover <tim.gover@raspberrypi.com>
+Date: Fri, 21 Jun 2024 16:20:54 +0100
+Subject: [PATCH 600/697] drm/vc4: hvs: Enable SCALER_CONTROL early in HVS init
+
+Always enable SCALER_CONTROL before attempting other HVS
+operations. It's safe to write to some parts of the HVS but
+in general it's dangerous to do this because it can cause bus
+lockups.
+
+Signed-off-by: Tim Gover <tim.gover@raspberrypi.com>
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-31-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -860,6 +860,10 @@ static int vc4_hvs_hw_init(struct vc4_hv
+ 	struct vc4_dev *vc4 = hvs->vc4;
+ 	u32 dispctrl, reg;
+ 
++	dispctrl = HVS_READ(SCALER_DISPCTRL);
++	dispctrl |= SCALER_DISPCTRL_ENABLE;
++	HVS_WRITE(SCALER_DISPCTRL, dispctrl);
++
+ 	reg = HVS_READ(SCALER_DISPECTRL);
+ 	reg &= ~SCALER_DISPECTRL_DSP2_MUX_MASK;
+ 	HVS_WRITE(SCALER_DISPECTRL,
+@@ -881,8 +885,6 @@ static int vc4_hvs_hw_init(struct vc4_hv
+ 		  reg | VC4_SET_FIELD(3, SCALER_DISPDITHER_DSP5_MUX));
+ 
+ 	dispctrl = HVS_READ(SCALER_DISPCTRL);
+-
+-	dispctrl |= SCALER_DISPCTRL_ENABLE;
+ 	dispctrl |= SCALER_DISPCTRL_DISPEIRQ(0) |
+ 		    SCALER_DISPCTRL_DISPEIRQ(1) |
+ 		    SCALER_DISPCTRL_DISPEIRQ(2);
+@@ -1078,6 +1080,10 @@ static int vc4_hvs_bind(struct device *d
+ 	else
+ 		hvs->dlist = hvs->regs + SCALER5_DLIST_START;
+ 
++	ret = vc4_hvs_hw_init(hvs);
++	if (ret)
++		return ret;
++
+ 	/* Upload filter kernels.  We only have the one for now, so we
+ 	 * keep it around for the lifetime of the driver.
+ 	 */
+@@ -1087,10 +1093,6 @@ static int vc4_hvs_bind(struct device *d
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = vc4_hvs_hw_init(hvs);
+-	if (ret)
+-		return ret;
+-
+ 	ret = vc4_hvs_cob_init(hvs);
+ 	if (ret)
+ 		return ret;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0601-drm-vc4-Use-vc4_perfmon_find.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0601-drm-vc4-Use-vc4_perfmon_find.patch
new file mode 100644
index 00000000..763277c9
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0601-drm-vc4-Use-vc4_perfmon_find.patch
@@ -0,0 +1,35 @@
+From 3c52fad51bd6034ebd16fa5fc414192712ee8248 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ma=C3=ADra=20Canal?= <mcanal@igalia.com>
+Date: Fri, 4 Oct 2024 09:35:59 -0300
+Subject: [PATCH 601/697] drm/vc4: Use `vc4_perfmon_find()`
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Similar to commit f2a4bcb25328 ("drm/v3d: Use v3d_perfmon_find()"),
+replace the open-coded `vc4_perfmon_find()` with the real thing.
+
+Cc: Christian Gmeiner <cgmeiner@igalia.com>
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Reviewed-by: Juan A. Suarez <jasuarez@igalia.com>
+Reviewed-by: Christian Gmeiner <cgmeiner@igalia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241004123817.890016-1-mcanal@igalia.com
+---
+ drivers/gpu/drm/vc4/vc4_perfmon.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_perfmon.c
++++ b/drivers/gpu/drm/vc4/vc4_perfmon.c
+@@ -241,11 +241,7 @@ int vc4_perfmon_get_values_ioctl(struct
+ 		return -ENODEV;
+ 	}
+ 
+-	mutex_lock(&vc4file->perfmon.lock);
+-	perfmon = idr_find(&vc4file->perfmon.idr, req->id);
+-	vc4_perfmon_get(perfmon);
+-	mutex_unlock(&vc4file->perfmon.lock);
+-
++	perfmon = vc4_perfmon_find(vc4file, req->id);
+ 	if (!perfmon)
+ 		return -EINVAL;
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0602-drm-vc4-Use-of_device_get_match_data-to-set-generati.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0602-drm-vc4-Use-of_device_get_match_data-to-set-generati.patch
new file mode 100644
index 00000000..d7e7a3ad
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0602-drm-vc4-Use-of_device_get_match_data-to-set-generati.patch
@@ -0,0 +1,44 @@
+From 8307ff5a016b7253cf41120f644ba52eceee0211 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 25 Oct 2024 18:15:32 +0100
+Subject: [PATCH 602/697] drm/vc4: Use of_device_get_match_data to set
+ generation
+
+Use of_device_get_match_data to retrieve the generation value
+as set in the struct of_device_id, rather than manually comparing
+compatible strings.
+
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241025-drm-vc4-2712-support-v2-1-35efa83c8fc0@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_drv.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_drv.c
++++ b/drivers/gpu/drm/vc4/vc4_drv.c
+@@ -296,10 +296,7 @@ static int vc4_drm_bind(struct device *d
+ 
+ 	dev->coherent_dma_mask = DMA_BIT_MASK(32);
+ 
+-	if (of_device_is_compatible(dev->of_node, "brcm,bcm2711-vc5"))
+-		gen = VC4_GEN_5;
+-	else
+-		gen = VC4_GEN_4;
++	gen = (enum vc4_gen)of_device_get_match_data(dev);
+ 
+ 	if (gen > VC4_GEN_4)
+ 		driver = &vc5_drm_driver;
+@@ -458,9 +455,9 @@ static void vc4_platform_drm_shutdown(st
+ }
+ 
+ static const struct of_device_id vc4_of_match[] = {
+-	{ .compatible = "brcm,bcm2711-vc5", },
+-	{ .compatible = "brcm,bcm2835-vc4", },
+-	{ .compatible = "brcm,cygnus-vc4", },
++	{ .compatible = "brcm,bcm2711-vc5", .data = (void *)VC4_GEN_5 },
++	{ .compatible = "brcm,bcm2835-vc4", .data = (void *)VC4_GEN_4 },
++	{ .compatible = "brcm,cygnus-vc4", .data = (void *)VC4_GEN_4 },
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(of, vc4_of_match);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0603-drm-vc4-Fix-reading-of-frame-count-on-GEN5-Pi4.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0603-drm-vc4-Fix-reading-of-frame-count-on-GEN5-Pi4.patch
new file mode 100644
index 00000000..d7d20da7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0603-drm-vc4-Fix-reading-of-frame-count-on-GEN5-Pi4.patch
@@ -0,0 +1,96 @@
+From e44a4363b5e09600764cd349b25590681b21fb5e Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 25 Oct 2024 18:15:33 +0100
+Subject: [PATCH 603/697] drm/vc4: Fix reading of frame count on GEN5 / Pi4
+
+The frame count values moved within registers DISPSTAT1 and
+DISPSTAT2 with GEN5, so update the accessor function to
+accommodate that.
+
+Fixes: b51cd7ad143d ("drm/vc4: hvs: Fix frame count register readout")
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241025-drm-vc4-2712-support-v2-2-35efa83c8fc0@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c  | 45 +++++++++++++++++++++++++---------
+ drivers/gpu/drm/vc4/vc4_regs.h |  6 +++++
+ 2 files changed, 40 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -272,19 +272,42 @@ u8 vc4_hvs_get_fifo_frame_count(struct v
+ 	if (!drm_dev_enter(drm, &idx))
+ 		return 0;
+ 
+-	switch (fifo) {
+-	case 0:
+-		field = VC4_GET_FIELD(HVS_READ(SCALER_DISPSTAT1),
+-				      SCALER_DISPSTAT1_FRCNT0);
++	switch (vc4->gen) {
++	case VC4_GEN_5:
++		switch (fifo) {
++		case 0:
++			field = VC4_GET_FIELD(HVS_READ(SCALER_DISPSTAT1),
++					      SCALER5_DISPSTAT1_FRCNT0);
++			break;
++		case 1:
++			field = VC4_GET_FIELD(HVS_READ(SCALER_DISPSTAT1),
++					      SCALER5_DISPSTAT1_FRCNT1);
++			break;
++		case 2:
++			field = VC4_GET_FIELD(HVS_READ(SCALER_DISPSTAT2),
++					      SCALER5_DISPSTAT2_FRCNT2);
++			break;
++		}
+ 		break;
+-	case 1:
+-		field = VC4_GET_FIELD(HVS_READ(SCALER_DISPSTAT1),
+-				      SCALER_DISPSTAT1_FRCNT1);
+-		break;
+-	case 2:
+-		field = VC4_GET_FIELD(HVS_READ(SCALER_DISPSTAT2),
+-				      SCALER_DISPSTAT2_FRCNT2);
++	case VC4_GEN_4:
++		switch (fifo) {
++		case 0:
++			field = VC4_GET_FIELD(HVS_READ(SCALER_DISPSTAT1),
++					      SCALER_DISPSTAT1_FRCNT0);
++			break;
++		case 1:
++			field = VC4_GET_FIELD(HVS_READ(SCALER_DISPSTAT1),
++					      SCALER_DISPSTAT1_FRCNT1);
++			break;
++		case 2:
++			field = VC4_GET_FIELD(HVS_READ(SCALER_DISPSTAT2),
++					      SCALER_DISPSTAT2_FRCNT2);
++			break;
++		}
+ 		break;
++	default:
++		drm_err(drm, "Unknown VC4 generation: %d", vc4->gen);
++		return 0;
+ 	}
+ 
+ 	drm_dev_exit(idx);
+--- a/drivers/gpu/drm/vc4/vc4_regs.h
++++ b/drivers/gpu/drm/vc4/vc4_regs.h
+@@ -418,6 +418,10 @@
+ # define SCALER_DISPSTAT1_FRCNT0_SHIFT		18
+ # define SCALER_DISPSTAT1_FRCNT1_MASK		VC4_MASK(17, 12)
+ # define SCALER_DISPSTAT1_FRCNT1_SHIFT		12
++# define SCALER5_DISPSTAT1_FRCNT0_MASK		VC4_MASK(25, 20)
++# define SCALER5_DISPSTAT1_FRCNT0_SHIFT		20
++# define SCALER5_DISPSTAT1_FRCNT1_MASK		VC4_MASK(19, 14)
++# define SCALER5_DISPSTAT1_FRCNT1_SHIFT		14
+ 
+ #define SCALER_DISPSTATX(x)			(SCALER_DISPSTAT0 +        \
+ 						 (x) * (SCALER_DISPSTAT1 - \
+@@ -436,6 +440,8 @@
+ #define SCALER_DISPSTAT2                        0x00000068
+ # define SCALER_DISPSTAT2_FRCNT2_MASK		VC4_MASK(17, 12)
+ # define SCALER_DISPSTAT2_FRCNT2_SHIFT		12
++# define SCALER5_DISPSTAT2_FRCNT2_MASK		VC4_MASK(19, 14)
++# define SCALER5_DISPSTAT2_FRCNT2_SHIFT		14
+ 
+ #define SCALER_DISPBASE2                        0x0000006c
+ #define SCALER_DISPALPHA2                       0x00000070
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0604-drm-vc4-drv-Support-BCM2712.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0604-drm-vc4-drv-Support-BCM2712.patch
new file mode 100644
index 00000000..db6bc04e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0604-drm-vc4-drv-Support-BCM2712.patch
@@ -0,0 +1,38 @@
+From 79c908b36a7a8650c29a7f94d1b947bcdd6a9e71 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 25 Oct 2024 18:15:40 +0100
+Subject: [PATCH 604/697] drm/vc4: drv: Support BCM2712
+
+The BCM2712 has an improved display pipeline, most notably with a
+different HVS and only HDMI and writeback outputs.
+
+Let's introduce it as a new VideoCore generation and compatible.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241025-drm-vc4-2712-support-v2-9-35efa83c8fc0@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_drv.c | 1 +
+ drivers/gpu/drm/vc4/vc4_drv.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_drv.c
++++ b/drivers/gpu/drm/vc4/vc4_drv.c
+@@ -456,6 +456,7 @@ static void vc4_platform_drm_shutdown(st
+ 
+ static const struct of_device_id vc4_of_match[] = {
+ 	{ .compatible = "brcm,bcm2711-vc5", .data = (void *)VC4_GEN_5 },
++	{ .compatible = "brcm,bcm2712-vc6", .data = (void *)VC4_GEN_6_C },
+ 	{ .compatible = "brcm,bcm2835-vc4", .data = (void *)VC4_GEN_4 },
+ 	{ .compatible = "brcm,cygnus-vc4", .data = (void *)VC4_GEN_4 },
+ 	{},
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -84,6 +84,7 @@ struct vc4_perfmon {
+ enum vc4_gen {
+ 	VC4_GEN_4,
+ 	VC4_GEN_5,
++	VC4_GEN_6_C,
+ };
+ 
+ struct vc4_dev {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0605-drm-vc4-hvs-Add-support-for-BCM2712-HVS.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0605-drm-vc4-hvs-Add-support-for-BCM2712-HVS.patch
new file mode 100644
index 00000000..6562ad21
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0605-drm-vc4-hvs-Add-support-for-BCM2712-HVS.patch
@@ -0,0 +1,2217 @@
+From 30032b3232903e2e54bf783c843202c2b1e9a305 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 25 Oct 2024 18:15:41 +0100
+Subject: [PATCH 605/697] drm/vc4: hvs: Add support for BCM2712 HVS
+
+The HVS found in the BCM2712, while having a similar role, is very
+different from the one found in the previous SoCs. Indeed, the register
+layout is fairly different, and the DLIST format is new as well.
+
+Let's introduce the needed functions to support the new HVS.
+
+This commit adds the C-step register layout. The D-step will be
+added later.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241025-drm-vc4-2712-support-v2-10-35efa83c8fc0@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c  |  47 +-
+ drivers/gpu/drm/vc4/vc4_drv.c   |   6 +
+ drivers/gpu/drm/vc4/vc4_drv.h   |  30 ++
+ drivers/gpu/drm/vc4/vc4_hvs.c   | 564 +++++++++++++++++++++--
+ drivers/gpu/drm/vc4/vc4_kms.c   |  98 +++-
+ drivers/gpu/drm/vc4/vc4_plane.c | 767 +++++++++++++++++++++++++++++++-
+ drivers/gpu/drm/vc4/vc4_regs.h  | 181 ++++++++
+ 7 files changed, 1616 insertions(+), 77 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -83,13 +83,22 @@ static unsigned int
+ vc4_crtc_get_cob_allocation(struct vc4_dev *vc4, unsigned int channel)
+ {
+ 	struct vc4_hvs *hvs = vc4->hvs;
+-	u32 dispbase = HVS_READ(SCALER_DISPBASEX(channel));
++	u32 dispbase, top, base;
++
+ 	/* Top/base are supposed to be 4-pixel aligned, but the
+ 	 * Raspberry Pi firmware fills the low bits (which are
+ 	 * presumably ignored).
+ 	 */
+-	u32 top = VC4_GET_FIELD(dispbase, SCALER_DISPBASEX_TOP) & ~3;
+-	u32 base = VC4_GET_FIELD(dispbase, SCALER_DISPBASEX_BASE) & ~3;
++
++	if (vc4->gen >= VC4_GEN_6_C) {
++		dispbase = HVS_READ(SCALER6_DISPX_COB(channel));
++		top = VC4_GET_FIELD(dispbase, SCALER6_DISPX_COB_TOP) & ~3;
++		base = VC4_GET_FIELD(dispbase, SCALER6_DISPX_COB_BASE) & ~3;
++	} else {
++		dispbase = HVS_READ(SCALER_DISPBASEX(channel));
++		top = VC4_GET_FIELD(dispbase, SCALER_DISPBASEX_TOP) & ~3;
++		base = VC4_GET_FIELD(dispbase, SCALER_DISPBASEX_BASE) & ~3;
++	}
+ 
+ 	return top - base + 4;
+ }
+@@ -122,7 +131,10 @@ static bool vc4_crtc_get_scanout_positio
+ 	 * Read vertical scanline which is currently composed for our
+ 	 * pixelvalve by the HVS, and also the scaler status.
+ 	 */
+-	val = HVS_READ(SCALER_DISPSTATX(channel));
++	if (vc4->gen >= VC4_GEN_6_C)
++		val = HVS_READ(SCALER6_DISPX_STATUS(channel));
++	else
++		val = HVS_READ(SCALER_DISPSTATX(channel));
+ 
+ 	/* Get optional system timestamp after query. */
+ 	if (etime)
+@@ -131,7 +143,12 @@ static bool vc4_crtc_get_scanout_positio
+ 	/* preempt_enable_rt() should go right here in PREEMPT_RT patchset. */
+ 
+ 	/* Vertical position of hvs composed scanline. */
+-	*vpos = VC4_GET_FIELD(val, SCALER_DISPSTATX_LINE);
++
++	if (vc4->gen >= VC4_GEN_6_C)
++		*vpos = VC4_GET_FIELD(val, SCALER6_DISPX_STATUS_YLINE);
++	else
++		*vpos = VC4_GET_FIELD(val, SCALER_DISPSTATX_LINE);
++
+ 	*hpos = 0;
+ 
+ 	if (mode->flags & DRM_MODE_FLAG_INTERLACE) {
+@@ -459,8 +476,10 @@ static void require_hvs_enabled(struct d
+ 	struct vc4_dev *vc4 = to_vc4_dev(dev);
+ 	struct vc4_hvs *hvs = vc4->hvs;
+ 
+-	WARN_ON_ONCE((HVS_READ(SCALER_DISPCTRL) & SCALER_DISPCTRL_ENABLE) !=
+-		     SCALER_DISPCTRL_ENABLE);
++	if (vc4->gen >= VC4_GEN_6_C)
++		WARN_ON_ONCE(!(HVS_READ(SCALER6_CONTROL) & SCALER6_CONTROL_HVS_EN));
++	else
++		WARN_ON_ONCE(!(HVS_READ(SCALER_DISPCTRL) & SCALER_DISPCTRL_ENABLE));
+ }
+ 
+ static int vc4_crtc_disable(struct drm_crtc *crtc,
+@@ -789,14 +808,21 @@ static void vc4_crtc_handle_page_flip(st
+ 	struct drm_device *dev = crtc->dev;
+ 	struct vc4_dev *vc4 = to_vc4_dev(dev);
+ 	struct vc4_hvs *hvs = vc4->hvs;
++	unsigned int current_dlist;
+ 	u32 chan = vc4_crtc->current_hvs_channel;
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&dev->event_lock, flags);
+ 	spin_lock(&vc4_crtc->irq_lock);
++
++	if (vc4->gen >= VC4_GEN_6_C)
++		current_dlist = VC4_GET_FIELD(HVS_READ(SCALER6_DISPX_DL(chan)),
++					      SCALER6_DISPX_DL_LACT);
++	else
++		current_dlist = HVS_READ(SCALER_DISPLACTX(chan));
++
+ 	if (vc4_crtc->event &&
+-	    (vc4_crtc->current_dlist == HVS_READ(SCALER_DISPLACTX(chan)) ||
+-	     vc4_crtc->feeds_txp)) {
++	    (vc4_crtc->current_dlist == current_dlist || vc4_crtc->feeds_txp)) {
+ 		drm_crtc_send_vblank_event(crtc, vc4_crtc->event);
+ 		vc4_crtc->event = NULL;
+ 		drm_crtc_vblank_put(crtc);
+@@ -807,7 +833,8 @@ static void vc4_crtc_handle_page_flip(st
+ 		 * the CRTC and encoder already reconfigured, leading to
+ 		 * underruns. This can be seen when reconfiguring the CRTC.
+ 		 */
+-		vc4_hvs_unmask_underrun(hvs, chan);
++		if (vc4->gen < VC4_GEN_6_C)
++			vc4_hvs_unmask_underrun(hvs, chan);
+ 	}
+ 	spin_unlock(&vc4_crtc->irq_lock);
+ 	spin_unlock_irqrestore(&dev->event_lock, flags);
+--- a/drivers/gpu/drm/vc4/vc4_drv.c
++++ b/drivers/gpu/drm/vc4/vc4_drv.c
+@@ -275,6 +275,7 @@ static void vc4_component_unbind_all(voi
+ 
+ static const struct of_device_id vc4_dma_range_matches[] = {
+ 	{ .compatible = "brcm,bcm2711-hvs" },
++	{ .compatible = "brcm,bcm2712-hvs" },
+ 	{ .compatible = "brcm,bcm2835-hvs" },
+ 	{ .compatible = "brcm,bcm2835-v3d" },
+ 	{ .compatible = "brcm,cygnus-v3d" },
+@@ -303,6 +304,11 @@ static int vc4_drm_bind(struct device *d
+ 	else
+ 		driver = &vc4_drm_driver;
+ 
++	if (gen >= VC4_GEN_6_C)
++		dma_set_mask_and_coherent(dev, DMA_BIT_MASK(36));
++	else
++		dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32));
++
+ 	node = of_find_matching_node_and_match(NULL, vc4_dma_range_matches,
+ 					       NULL);
+ 	if (node) {
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -317,6 +317,21 @@ struct vc4_v3d {
+ 	struct debugfs_regset32 regset;
+ };
+ 
++#define VC4_NUM_UPM_HANDLES 32
++struct vc4_upm_refcounts {
++	refcount_t refcount;
++
++	/* Allocation size */
++	size_t size;
++	/* Our allocation in UPM for prefetching. */
++	struct drm_mm_node upm;
++
++	/* Pointer back to the HVS structure */
++	struct vc4_hvs *hvs;
++};
++
++#define HVS_NUM_CHANNELS 3
++
+ struct vc4_hvs {
+ 	struct vc4_dev *vc4;
+ 	struct platform_device *pdev;
+@@ -325,6 +340,7 @@ struct vc4_hvs {
+ 	unsigned int dlist_mem_size;
+ 
+ 	struct clk *core_clk;
++	struct clk *disp_clk;
+ 
+ 	unsigned long max_core_rate;
+ 
+@@ -332,8 +348,15 @@ struct vc4_hvs {
+ 	 * list.  Units are dwords.
+ 	 */
+ 	struct drm_mm dlist_mm;
++
+ 	/* Memory manager for the LBM memory used by HVS scaling. */
+ 	struct drm_mm lbm_mm;
++
++	/* Memory manager for the UPM memory used for prefetching. */
++	struct drm_mm upm_mm;
++	struct ida upm_handles;
++	struct vc4_upm_refcounts upm_refcounts[VC4_NUM_UPM_HANDLES + 1];
++
+ 	spinlock_t mm_lock;
+ 
+ 	struct drm_mm_node mitchell_netravali_filter;
+@@ -356,6 +379,7 @@ struct vc4_hvs {
+ };
+ 
+ #define HVS_NUM_CHANNELS 3
++#define HVS_UBM_WORD_SIZE 256
+ 
+ struct vc4_hvs_state {
+ 	struct drm_private_state base;
+@@ -425,6 +449,12 @@ struct vc4_plane_state {
+ 	/* Our allocation in LBM for temporary storage during scaling. */
+ 	struct drm_mm_node lbm;
+ 
++	/* The Unified Pre-Fetcher Handle */
++	unsigned int upm_handle[DRM_FORMAT_MAX_PLANES];
++
++	/* Number of lines to pre-fetch */
++	unsigned int upm_buffer_lines;
++
+ 	/* Set when the plane has per-pixel alpha content or does not cover
+ 	 * the entire screen. This is a hint to the CRTC that it might need
+ 	 * to enable background color fill.
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -67,6 +67,80 @@ static const struct debugfs_reg32 vc4_hv
+ 	VC4_REG32(SCALER_OLEDCOEF2),
+ };
+ 
++static const struct debugfs_reg32 vc6_hvs_regs[] = {
++	VC4_REG32(SCALER6_VERSION),
++	VC4_REG32(SCALER6_CXM_SIZE),
++	VC4_REG32(SCALER6_LBM_SIZE),
++	VC4_REG32(SCALER6_UBM_SIZE),
++	VC4_REG32(SCALER6_COBA_SIZE),
++	VC4_REG32(SCALER6_COB_SIZE),
++	VC4_REG32(SCALER6_CONTROL),
++	VC4_REG32(SCALER6_FETCHER_STATUS),
++	VC4_REG32(SCALER6_FETCH_STATUS),
++	VC4_REG32(SCALER6_HANDLE_ERROR),
++	VC4_REG32(SCALER6_DISP0_CTRL0),
++	VC4_REG32(SCALER6_DISP0_CTRL1),
++	VC4_REG32(SCALER6_DISP0_BGND),
++	VC4_REG32(SCALER6_DISP0_LPTRS),
++	VC4_REG32(SCALER6_DISP0_COB),
++	VC4_REG32(SCALER6_DISP0_STATUS),
++	VC4_REG32(SCALER6_DISP0_DL),
++	VC4_REG32(SCALER6_DISP0_RUN),
++	VC4_REG32(SCALER6_DISP1_CTRL0),
++	VC4_REG32(SCALER6_DISP1_CTRL1),
++	VC4_REG32(SCALER6_DISP1_BGND),
++	VC4_REG32(SCALER6_DISP1_LPTRS),
++	VC4_REG32(SCALER6_DISP1_COB),
++	VC4_REG32(SCALER6_DISP1_STATUS),
++	VC4_REG32(SCALER6_DISP1_DL),
++	VC4_REG32(SCALER6_DISP1_RUN),
++	VC4_REG32(SCALER6_DISP2_CTRL0),
++	VC4_REG32(SCALER6_DISP2_CTRL1),
++	VC4_REG32(SCALER6_DISP2_BGND),
++	VC4_REG32(SCALER6_DISP2_LPTRS),
++	VC4_REG32(SCALER6_DISP2_COB),
++	VC4_REG32(SCALER6_DISP2_STATUS),
++	VC4_REG32(SCALER6_DISP2_DL),
++	VC4_REG32(SCALER6_DISP2_RUN),
++	VC4_REG32(SCALER6_EOLN),
++	VC4_REG32(SCALER6_DL_STATUS),
++	VC4_REG32(SCALER6_BFG_MISC),
++	VC4_REG32(SCALER6_QOS0),
++	VC4_REG32(SCALER6_PROF0),
++	VC4_REG32(SCALER6_QOS1),
++	VC4_REG32(SCALER6_PROF1),
++	VC4_REG32(SCALER6_QOS2),
++	VC4_REG32(SCALER6_PROF2),
++	VC4_REG32(SCALER6_PRI_MAP0),
++	VC4_REG32(SCALER6_PRI_MAP1),
++	VC4_REG32(SCALER6_HISTCTRL),
++	VC4_REG32(SCALER6_HISTBIN0),
++	VC4_REG32(SCALER6_HISTBIN1),
++	VC4_REG32(SCALER6_HISTBIN2),
++	VC4_REG32(SCALER6_HISTBIN3),
++	VC4_REG32(SCALER6_HISTBIN4),
++	VC4_REG32(SCALER6_HISTBIN5),
++	VC4_REG32(SCALER6_HISTBIN6),
++	VC4_REG32(SCALER6_HISTBIN7),
++	VC4_REG32(SCALER6_HDR_CFG_REMAP),
++	VC4_REG32(SCALER6_COL_SPACE),
++	VC4_REG32(SCALER6_HVS_ID),
++	VC4_REG32(SCALER6_CFC1),
++	VC4_REG32(SCALER6_DISP_UPM_ISO0),
++	VC4_REG32(SCALER6_DISP_UPM_ISO1),
++	VC4_REG32(SCALER6_DISP_UPM_ISO2),
++	VC4_REG32(SCALER6_DISP_LBM_ISO0),
++	VC4_REG32(SCALER6_DISP_LBM_ISO1),
++	VC4_REG32(SCALER6_DISP_LBM_ISO2),
++	VC4_REG32(SCALER6_DISP_COB_ISO0),
++	VC4_REG32(SCALER6_DISP_COB_ISO1),
++	VC4_REG32(SCALER6_DISP_COB_ISO2),
++	VC4_REG32(SCALER6_BAD_COB),
++	VC4_REG32(SCALER6_BAD_LBM),
++	VC4_REG32(SCALER6_BAD_UPM),
++	VC4_REG32(SCALER6_BAD_AXI),
++};
++
+ void vc4_hvs_dump_state(struct vc4_hvs *hvs)
+ {
+ 	struct drm_device *drm = &hvs->vc4->base;
+@@ -145,6 +219,76 @@ static int vc4_hvs_debugfs_dlist(struct
+ 	return 0;
+ }
+ 
++static int vc6_hvs_debugfs_dlist(struct seq_file *m, void *data)
++{
++	struct drm_info_node *node = m->private;
++	struct drm_device *dev = node->minor->dev;
++	struct vc4_dev *vc4 = to_vc4_dev(dev);
++	struct vc4_hvs *hvs = vc4->hvs;
++	struct drm_printer p = drm_seq_file_printer(m);
++	unsigned int dlist_mem_size = hvs->dlist_mem_size;
++	unsigned int next_entry_start;
++	unsigned int i;
++
++	for (i = 0; i < SCALER_CHANNELS_COUNT; i++) {
++		unsigned int active_dlist, dispstat;
++		unsigned int j;
++
++		dispstat = VC4_GET_FIELD(HVS_READ(SCALER6_DISPX_STATUS(i)),
++					 SCALER6_DISPX_STATUS_MODE);
++		if (dispstat == SCALER6_DISPX_STATUS_MODE_DISABLED ||
++		    dispstat == SCALER6_DISPX_STATUS_MODE_EOF) {
++			drm_printf(&p, "HVS chan %u disabled\n", i);
++			continue;
++		}
++
++		drm_printf(&p, "HVS chan %u:\n", i);
++
++		active_dlist = VC4_GET_FIELD(HVS_READ(SCALER6_DISPX_DL(i)),
++					     SCALER6_DISPX_DL_LACT);
++		next_entry_start = 0;
++
++		for (j = active_dlist; j < dlist_mem_size; j++) {
++			u32 dlist_word;
++
++			dlist_word = readl((u32 __iomem *)vc4->hvs->dlist + j);
++			drm_printf(&p, "dlist: %02d: 0x%08x\n", j,
++				   dlist_word);
++			if (!next_entry_start ||
++			    next_entry_start == j) {
++				if (dlist_word & SCALER_CTL0_END)
++					break;
++				next_entry_start = j +
++					VC4_GET_FIELD(dlist_word,
++						      SCALER_CTL0_SIZE);
++			}
++		}
++	}
++
++	return 0;
++}
++
++static int vc6_hvs_debugfs_upm_allocs(struct seq_file *m, void *data)
++{
++	struct drm_debugfs_entry *entry = m->private;
++	struct drm_device *dev = entry->dev;
++	struct vc4_dev *vc4 = to_vc4_dev(dev);
++	struct vc4_hvs *hvs = vc4->hvs;
++	struct drm_printer p = drm_seq_file_printer(m);
++	struct vc4_upm_refcounts *refcount;
++	unsigned int i;
++
++	drm_printf(&p, "UPM Handles:\n");
++	for (i = 1; i <= VC4_NUM_UPM_HANDLES; i++) {
++		refcount = &hvs->upm_refcounts[i];
++		drm_printf(&p, "handle %u: refcount %u, size %zu [%08llx + %08llx]\n",
++			   i, refcount_read(&refcount->refcount), refcount->size,
++			   refcount->upm.start, refcount->upm.size);
++	}
++
++	return 0;
++}
++
+ /* The filter kernel is composed of dwords each containing 3 9-bit
+  * signed integers packed next to each other.
+  */
+@@ -265,7 +409,8 @@ static void vc4_hvs_update_gamma_lut(str
+ 
+ u8 vc4_hvs_get_fifo_frame_count(struct vc4_hvs *hvs, unsigned int fifo)
+ {
+-	struct drm_device *drm = &hvs->vc4->base;
++	struct vc4_dev *vc4 = hvs->vc4;
++	struct drm_device *drm = &vc4->base;
+ 	u8 field = 0;
+ 	int idx;
+ 
+@@ -273,6 +418,10 @@ u8 vc4_hvs_get_fifo_frame_count(struct v
+ 		return 0;
+ 
+ 	switch (vc4->gen) {
++	case VC4_GEN_6_C:
++		field = VC4_GET_FIELD(HVS_READ(SCALER6_DISPX_STATUS(fifo)),
++				      SCALER6_DISPX_STATUS_FRCNT);
++		break;
+ 	case VC4_GEN_5:
+ 		switch (fifo) {
+ 		case 0:
+@@ -375,6 +524,23 @@ int vc4_hvs_get_fifo_from_output(struct
+ 			return -EPIPE;
+ 		}
+ 
++	case VC4_GEN_6_C:
++		switch (output) {
++		case 0:
++			return 0;
++
++		case 2:
++			return 2;
++
++		case 1:
++		case 3:
++		case 4:
++			return 1;
++
++		default:
++			return -EPIPE;
++		}
++
+ 	default:
+ 		return -EPIPE;
+ 	}
+@@ -443,7 +609,41 @@ static int vc4_hvs_init_channel(struct v
+ 	return 0;
+ }
+ 
+-void vc4_hvs_stop_channel(struct vc4_hvs *hvs, unsigned int chan)
++static int vc6_hvs_init_channel(struct vc4_hvs *hvs, struct drm_crtc *crtc,
++				struct drm_display_mode *mode, bool oneshot)
++{
++	struct vc4_dev *vc4 = hvs->vc4;
++	struct drm_device *drm = &vc4->base;
++	struct vc4_crtc_state *vc4_crtc_state = to_vc4_crtc_state(crtc->state);
++	unsigned int chan = vc4_crtc_state->assigned_channel;
++	bool interlace = mode->flags & DRM_MODE_FLAG_INTERLACE;
++	u32 disp_ctrl1;
++	int idx;
++
++	if (!drm_dev_enter(drm, &idx))
++		return -ENODEV;
++
++	HVS_WRITE(SCALER6_DISPX_CTRL0(chan), SCALER6_DISPX_CTRL0_RESET);
++
++	disp_ctrl1 = HVS_READ(SCALER6_DISPX_CTRL1(chan));
++	disp_ctrl1 &= ~SCALER6_DISPX_CTRL1_INTLACE;
++	HVS_WRITE(SCALER6_DISPX_CTRL1(chan),
++		  disp_ctrl1 | (interlace ? SCALER6_DISPX_CTRL1_INTLACE : 0));
++
++	HVS_WRITE(SCALER6_DISPX_CTRL0(chan),
++		  SCALER6_DISPX_CTRL0_ENB |
++		  VC4_SET_FIELD(mode->hdisplay - 1,
++				SCALER6_DISPX_CTRL0_FWIDTH) |
++		  (oneshot ? SCALER6_DISPX_CTRL0_ONESHOT : 0) |
++		  VC4_SET_FIELD(mode->vdisplay - 1,
++				SCALER6_DISPX_CTRL0_LINES));
++
++	drm_dev_exit(idx);
++
++	return 0;
++}
++
++static void __vc4_hvs_stop_channel(struct vc4_hvs *hvs, unsigned int chan)
+ {
+ 	struct drm_device *drm = &hvs->vc4->base;
+ 	int idx;
+@@ -472,6 +672,42 @@ out:
+ 	drm_dev_exit(idx);
+ }
+ 
++static void __vc6_hvs_stop_channel(struct vc4_hvs *hvs, unsigned int chan)
++{
++	struct vc4_dev *vc4 = hvs->vc4;
++	struct drm_device *drm = &vc4->base;
++	int idx;
++
++	if (!drm_dev_enter(drm, &idx))
++		return;
++
++	if (!(HVS_READ(SCALER6_DISPX_CTRL0(chan)) & SCALER6_DISPX_CTRL0_ENB))
++		goto out;
++
++	HVS_WRITE(SCALER6_DISPX_CTRL0(chan),
++		  HVS_READ(SCALER6_DISPX_CTRL0(chan)) | SCALER6_DISPX_CTRL0_RESET);
++
++	HVS_WRITE(SCALER6_DISPX_CTRL0(chan),
++		  HVS_READ(SCALER6_DISPX_CTRL0(chan)) & ~SCALER6_DISPX_CTRL0_ENB);
++
++	WARN_ON_ONCE(VC4_GET_FIELD(HVS_READ(SCALER6_DISPX_STATUS(chan)),
++				   SCALER6_DISPX_STATUS_MODE) !=
++		     SCALER6_DISPX_STATUS_MODE_DISABLED);
++
++out:
++	drm_dev_exit(idx);
++}
++
++void vc4_hvs_stop_channel(struct vc4_hvs *hvs, unsigned int chan)
++{
++	struct vc4_dev *vc4 = hvs->vc4;
++
++	if (vc4->gen >= VC4_GEN_6_C)
++		__vc6_hvs_stop_channel(hvs, chan);
++	else
++		__vc4_hvs_stop_channel(hvs, chan);
++}
++
+ int vc4_hvs_atomic_check(struct drm_crtc *crtc, struct drm_atomic_state *state)
+ {
+ 	struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
+@@ -528,8 +764,13 @@ static void vc4_hvs_install_dlist(struct
+ 	if (!drm_dev_enter(dev, &idx))
+ 		return;
+ 
+-	HVS_WRITE(SCALER_DISPLISTX(vc4_state->assigned_channel),
+-		  vc4_state->mm.start);
++	if (vc4->gen >= VC4_GEN_6_C)
++		HVS_WRITE(SCALER6_DISPX_LPTRS(vc4_state->assigned_channel),
++			  VC4_SET_FIELD(vc4_state->mm.start,
++					SCALER6_DISPX_LPTRS_HEADE));
++	else
++		HVS_WRITE(SCALER_DISPLISTX(vc4_state->assigned_channel),
++			  vc4_state->mm.start);
+ 
+ 	drm_dev_exit(idx);
+ }
+@@ -584,7 +825,11 @@ void vc4_hvs_atomic_enable(struct drm_cr
+ 
+ 	vc4_hvs_install_dlist(crtc);
+ 	vc4_hvs_update_dlist(crtc);
+-	vc4_hvs_init_channel(vc4->hvs, crtc, mode, oneshot);
++
++	if (vc4->gen >= VC4_GEN_6_C)
++		vc6_hvs_init_channel(vc4->hvs, crtc, mode, oneshot);
++	else
++		vc4_hvs_init_channel(vc4->hvs, crtc, mode, oneshot);
+ }
+ 
+ void vc4_hvs_atomic_disable(struct drm_crtc *crtc,
+@@ -668,13 +913,26 @@ void vc4_hvs_atomic_flush(struct drm_crt
+ 
+ 	WARN_ON_ONCE(dlist_next - dlist_start != vc4_state->mm.size);
+ 
+-	if (enable_bg_fill)
++	if (vc4->gen >= VC4_GEN_6_C) {
+ 		/* This sets a black background color fill, as is the case
+ 		 * with other DRM drivers.
+ 		 */
++		if (enable_bg_fill)
++			HVS_WRITE(SCALER6_DISPX_CTRL1(channel),
++				  HVS_READ(SCALER6_DISPX_CTRL1(channel)) |
++				  SCALER6_DISPX_CTRL1_BGENB);
++		else
++			HVS_WRITE(SCALER6_DISPX_CTRL1(channel),
++				  HVS_READ(SCALER6_DISPX_CTRL1(channel)) &
++				  ~SCALER6_DISPX_CTRL1_BGENB);
++	} else {
++		/* we can actually run with a lower core clock when background
++		 * fill is enabled on VC4_GEN_5 so leave it enabled always.
++		 */
+ 		HVS_WRITE(SCALER_DISPBKGNDX(channel),
+ 			  HVS_READ(SCALER_DISPBKGNDX(channel)) |
+ 			  SCALER_DISPBKGND_FILL);
++	}
+ 
+ 	/* Only update DISPLIST if the CRTC was already running and is not
+ 	 * being disabled.
+@@ -825,7 +1083,12 @@ int vc4_hvs_debugfs_init(struct drm_mino
+ 				    minor->debugfs_root,
+ 				    &vc4->load_tracker_enabled);
+ 
+-	drm_debugfs_add_file(drm, "hvs_dlists", vc4_hvs_debugfs_dlist, NULL);
++	if (vc4->gen >= VC4_GEN_6_C) {
++		drm_debugfs_add_file(drm, "hvs_dlists", vc6_hvs_debugfs_dlist, NULL);
++		drm_debugfs_add_file(drm, "hvs_upm", vc6_hvs_debugfs_upm_allocs, NULL);
++	} else {
++		drm_debugfs_add_file(drm, "hvs_dlists", vc4_hvs_debugfs_dlist, NULL);
++	}
+ 
+ 	drm_debugfs_add_file(drm, "hvs_underrun", vc4_hvs_debugfs_underrun, NULL);
+ 
+@@ -840,6 +1103,10 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
+ {
+ 	struct drm_device *drm = &vc4->base;
+ 	struct vc4_hvs *hvs;
++	unsigned int dlist_start;
++	size_t dlist_size;
++	size_t lbm_size;
++	unsigned int i;
+ 
+ 	hvs = drmm_kzalloc(drm, sizeof(*hvs), GFP_KERNEL);
+ 	if (!hvs)
+@@ -851,27 +1118,92 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
+ 
+ 	spin_lock_init(&hvs->mm_lock);
+ 
+-	/* Set up the HVS display list memory manager.  We never
+-	 * overwrite the setup from the bootloader (just 128b out of
+-	 * our 16K), since we don't want to scramble the screen when
+-	 * transitioning from the firmware's boot setup to runtime.
+-	 */
+-	hvs->dlist_mem_size = (SCALER_DLIST_SIZE >> 2) - HVS_BOOTLOADER_DLIST_END;
+-	drm_mm_init(&hvs->dlist_mm,
+-		    HVS_BOOTLOADER_DLIST_END,
+-		    hvs->dlist_mem_size);
++	switch (vc4->gen) {
++	case VC4_GEN_4:
++	case VC4_GEN_5:
++		/* Set up the HVS display list memory manager. We never
++		 * overwrite the setup from the bootloader (just 128b
++		 * out of our 16K), since we don't want to scramble the
++		 * screen when transitioning from the firmware's boot
++		 * setup to runtime.
++		 */
++		dlist_start = HVS_BOOTLOADER_DLIST_END;
++		dlist_size = (SCALER_DLIST_SIZE >> 2) - HVS_BOOTLOADER_DLIST_END;
++		break;
++
++	case VC4_GEN_6_C:
++		dlist_start = HVS_BOOTLOADER_DLIST_END;
++
++		/*
++		 * If we are running a test, it means that we can't
++		 * access a register. Use a plausible size then.
++		 */
++		if (!kunit_get_current_test())
++			dlist_size = HVS_READ(SCALER6_CXM_SIZE);
++		else
++			dlist_size = 4096;
++
++		for (i = 0; i < VC4_NUM_UPM_HANDLES; i++) {
++			refcount_set(&hvs->upm_refcounts[i].refcount, 0);
++			hvs->upm_refcounts[i].hvs = hvs;
++		}
++
++		break;
++
++	default:
++		drm_err(drm, "Unknown VC4 generation: %d", vc4->gen);
++		return ERR_PTR(-ENODEV);
++	}
++
++	drm_mm_init(&hvs->dlist_mm, dlist_start, dlist_size);
++
++	hvs->dlist_mem_size = dlist_size;
+ 
+ 	/* Set up the HVS LBM memory manager.  We could have some more
+ 	 * complicated data structure that allowed reuse of LBM areas
+ 	 * between planes when they don't overlap on the screen, but
+ 	 * for now we just allocate globally.
+ 	 */
+-	if (vc4->gen == VC4_GEN_4)
++
++	switch (vc4->gen) {
++	case VC4_GEN_4:
+ 		/* 48k words of 2x12-bit pixels */
+-		drm_mm_init(&hvs->lbm_mm, 0, 48 * 1024);
+-	else
++		lbm_size = 48 * SZ_1K;
++		break;
++
++	case VC4_GEN_5:
+ 		/* 60k words of 4x12-bit pixels */
+-		drm_mm_init(&hvs->lbm_mm, 0, 60 * 1024);
++		lbm_size = 60 * SZ_1K;
++		break;
++
++	case VC4_GEN_6_C:
++		/*
++		 * If we are running a test, it means that we can't
++		 * access a register. Use a plausible size then.
++		 */
++		lbm_size = 1024;
++		break;
++
++	default:
++		drm_err(drm, "Unknown VC4 generation: %d", vc4->gen);
++		return ERR_PTR(-ENODEV);
++	}
++
++	drm_mm_init(&hvs->lbm_mm, 0, lbm_size);
++
++	if (vc4->gen >= VC4_GEN_6_C) {
++		ida_init(&hvs->upm_handles);
++
++		/*
++		 * NOTE: On BCM2712, the size can also be read through
++		 * the SCALER_UBM_SIZE register. We would need to do a
++		 * register access though, which we can't do with kunit
++		 * that also uses this function to create its mock
++		 * device.
++		 */
++		drm_mm_init(&hvs->upm_mm, 0, 1024 * HVS_UBM_WORD_SIZE);
++	}
++
+ 
+ 	vc4->hvs = hvs;
+ 
+@@ -968,10 +1300,124 @@ static int vc4_hvs_hw_init(struct vc4_hv
+ 	return 0;
+ }
+ 
++#define CFC1_N_NL_CSC_CTRL(x)		(0xa000 + ((x) * 0x3000))
++#define CFC1_N_MA_CSC_COEFF_C00(x)	(0xa008 + ((x) * 0x3000))
++#define CFC1_N_MA_CSC_COEFF_C01(x)	(0xa00c + ((x) * 0x3000))
++#define CFC1_N_MA_CSC_COEFF_C02(x)	(0xa010 + ((x) * 0x3000))
++#define CFC1_N_MA_CSC_COEFF_C03(x)	(0xa014 + ((x) * 0x3000))
++#define CFC1_N_MA_CSC_COEFF_C04(x)	(0xa018 + ((x) * 0x3000))
++#define CFC1_N_MA_CSC_COEFF_C10(x)	(0xa01c + ((x) * 0x3000))
++#define CFC1_N_MA_CSC_COEFF_C11(x)	(0xa020 + ((x) * 0x3000))
++#define CFC1_N_MA_CSC_COEFF_C12(x)	(0xa024 + ((x) * 0x3000))
++#define CFC1_N_MA_CSC_COEFF_C13(x)	(0xa028 + ((x) * 0x3000))
++#define CFC1_N_MA_CSC_COEFF_C14(x)	(0xa02c + ((x) * 0x3000))
++#define CFC1_N_MA_CSC_COEFF_C20(x)	(0xa030 + ((x) * 0x3000))
++#define CFC1_N_MA_CSC_COEFF_C21(x)	(0xa034 + ((x) * 0x3000))
++#define CFC1_N_MA_CSC_COEFF_C22(x)	(0xa038 + ((x) * 0x3000))
++#define CFC1_N_MA_CSC_COEFF_C23(x)	(0xa03c + ((x) * 0x3000))
++#define CFC1_N_MA_CSC_COEFF_C24(x)	(0xa040 + ((x) * 0x3000))
++
++/* 4 S2.22 multiplication factors, and 1 S9.15 addititive element for each of 3
++ * output components
++ */
++struct vc6_csc_coeff_entry {
++	u32 csc[3][5];
++};
++
++static const struct vc6_csc_coeff_entry csc_coeffs[2][3] = {
++	[DRM_COLOR_YCBCR_LIMITED_RANGE] = {
++		[DRM_COLOR_YCBCR_BT601] = {
++			.csc = {
++				{ 0x004A8542, 0x0, 0x0066254A, 0x0, 0xFF908A0D },
++				{ 0x004A8542, 0xFFE6ED5D, 0xFFCBF856, 0x0, 0x0043C9A3 },
++				{ 0x004A8542, 0x00811A54, 0x0, 0x0, 0xFF759502 }
++			}
++		},
++		[DRM_COLOR_YCBCR_BT709] = {
++			.csc = {
++				{ 0x004A8542, 0x0, 0x0072BC44, 0x0, 0xFF83F312 },
++				{ 0x004A8542, 0xFFF25A22, 0xFFDDE4D0, 0x0, 0x00267064 },
++				{ 0x004A8542, 0x00873197, 0x0, 0x0, 0xFF6F7DC0 }
++			}
++		},
++		[DRM_COLOR_YCBCR_BT2020] = {
++			.csc = {
++				{ 0x004A8542, 0x0, 0x006B4A17, 0x0, 0xFF8B653F },
++				{ 0x004A8542, 0xFFF402D9, 0xFFDDE4D0, 0x0, 0x0024C7AE },
++				{ 0x004A8542, 0x008912CC, 0x0, 0x0, 0xFF6D9C8B }
++			}
++		}
++	},
++	[DRM_COLOR_YCBCR_FULL_RANGE] = {
++		[DRM_COLOR_YCBCR_BT601] = {
++			.csc = {
++				{ 0x00400000, 0x0, 0x0059BA5E, 0x0, 0xFFA645A1 },
++				{ 0x00400000, 0xFFE9F9AC, 0xFFD24B97, 0x0, 0x0043BABB },
++				{ 0x00400000, 0x00716872, 0x0, 0x0, 0xFF8E978D }
++			}
++		},
++		[DRM_COLOR_YCBCR_BT709] = {
++			.csc = {
++				{ 0x00400000, 0x0, 0x0064C985, 0x0, 0xFF9B367A },
++				{ 0x00400000, 0xFFF402E1, 0xFFE20A40, 0x0, 0x0029F2DE },
++				{ 0x00400000, 0x0076C226, 0x0, 0x0, 0xFF893DD9 }
++			}
++		},
++		[DRM_COLOR_YCBCR_BT2020] = {
++			.csc = {
++				{ 0x00400000, 0x0, 0x005E3F14, 0x0, 0xFFA1C0EB },
++				{ 0x00400000, 0xFFF577F6, 0xFFDB580F, 0x0, 0x002F2FFA },
++				{ 0x00400000, 0x007868DB, 0x0, 0x0, 0xFF879724 }
++			}
++		}
++	}
++};
++
++static int vc6_hvs_hw_init(struct vc4_hvs *hvs)
++{
++	const struct vc6_csc_coeff_entry *coeffs;
++	unsigned int i;
++
++	HVS_WRITE(SCALER6_CONTROL,
++		  SCALER6_CONTROL_HVS_EN |
++		  VC4_SET_FIELD(8, SCALER6_CONTROL_PF_LINES) |
++		  VC4_SET_FIELD(15, SCALER6_CONTROL_MAX_REQS));
++
++	/* Set HVS arbiter priority to max */
++	HVS_WRITE(SCALER6_PRI_MAP0, 0xffffffff);
++	HVS_WRITE(SCALER6_PRI_MAP1, 0xffffffff);
++
++	for (i = 0; i < 6; i++) {
++		coeffs = &csc_coeffs[i / 3][i % 3];
++
++		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C00(i), coeffs->csc[0][0]);
++		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C01(i), coeffs->csc[0][1]);
++		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C02(i), coeffs->csc[0][2]);
++		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C03(i), coeffs->csc[0][3]);
++		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C04(i), coeffs->csc[0][4]);
++
++		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C10(i), coeffs->csc[1][0]);
++		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C11(i), coeffs->csc[1][1]);
++		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C12(i), coeffs->csc[1][2]);
++		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C13(i), coeffs->csc[1][3]);
++		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C14(i), coeffs->csc[1][4]);
++
++		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C20(i), coeffs->csc[2][0]);
++		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C21(i), coeffs->csc[2][1]);
++		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C22(i), coeffs->csc[2][2]);
++		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C23(i), coeffs->csc[2][3]);
++		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C24(i), coeffs->csc[2][4]);
++
++		HVS_WRITE(CFC1_N_NL_CSC_CTRL(i), BIT(15));
++	}
++
++	return 0;
++}
++
+ static int vc4_hvs_cob_init(struct vc4_hvs *hvs)
+ {
+ 	struct vc4_dev *vc4 = hvs->vc4;
+-	u32 reg, top;
++	u32 reg, top, base;
+ 
+ 	/*
+ 	 * Recompute Composite Output Buffer (COB) allocations for the
+@@ -1032,6 +1478,31 @@ static int vc4_hvs_cob_init(struct vc4_h
+ 		HVS_WRITE(SCALER_DISPBASE0, reg);
+ 		break;
+ 
++	case VC4_GEN_6_C:
++		#define VC6_COB_LINE_WIDTH	3840
++		#define VC6_COB_NUM_LINES	4
++		base = 0;
++		top = 3840;
++
++		HVS_WRITE(SCALER6_DISP2_COB,
++			  VC4_SET_FIELD(top, SCALER6_DISPX_COB_TOP) |
++			  VC4_SET_FIELD(base, SCALER6_DISPX_COB_BASE));
++
++		base = top + 16;
++		top += VC6_COB_LINE_WIDTH * VC6_COB_NUM_LINES;
++
++		HVS_WRITE(SCALER6_DISP1_COB,
++			  VC4_SET_FIELD(top, SCALER6_DISPX_COB_TOP) |
++			  VC4_SET_FIELD(base, SCALER6_DISPX_COB_BASE));
++
++		base = top + 16;
++		top += VC6_COB_LINE_WIDTH * VC6_COB_NUM_LINES;
++
++		HVS_WRITE(SCALER6_DISP0_COB,
++			  VC4_SET_FIELD(top, SCALER6_DISPX_COB_TOP) |
++			  VC4_SET_FIELD(base, SCALER6_DISPX_COB_BASE));
++		break;
++
+ 	default:
+ 		return -EINVAL;
+ 	}
+@@ -1057,10 +1528,16 @@ static int vc4_hvs_bind(struct device *d
+ 		return PTR_ERR(hvs);
+ 
+ 	hvs->regset.base = hvs->regs;
+-	hvs->regset.regs = vc4_hvs_regs;
+-	hvs->regset.nregs = ARRAY_SIZE(vc4_hvs_regs);
+ 
+-	if (vc4->gen == VC4_GEN_5) {
++	if (vc4->gen >= VC4_GEN_6_C) {
++		hvs->regset.regs = vc6_hvs_regs;
++		hvs->regset.nregs = ARRAY_SIZE(vc6_hvs_regs);
++	} else {
++		hvs->regset.regs = vc4_hvs_regs;
++		hvs->regset.nregs = ARRAY_SIZE(vc4_hvs_regs);
++	}
++
++	if (vc4->gen >= VC4_GEN_5) {
+ 		struct rpi_firmware *firmware;
+ 		struct device_node *node;
+ 		unsigned int max_rate;
+@@ -1074,12 +1551,20 @@ static int vc4_hvs_bind(struct device *d
+ 		if (!firmware)
+ 			return -EPROBE_DEFER;
+ 
+-		hvs->core_clk = devm_clk_get(&pdev->dev, NULL);
++		hvs->core_clk = devm_clk_get(&pdev->dev,
++					     (vc4->gen >= VC4_GEN_6_C) ? "core" : NULL);
+ 		if (IS_ERR(hvs->core_clk)) {
+ 			dev_err(&pdev->dev, "Couldn't get core clock\n");
+ 			return PTR_ERR(hvs->core_clk);
+ 		}
+ 
++		hvs->disp_clk = devm_clk_get(&pdev->dev,
++					     (vc4->gen >= VC4_GEN_6_C) ? "disp" : NULL);
++		if (IS_ERR(hvs->disp_clk)) {
++			dev_err(&pdev->dev, "Couldn't get disp clock\n");
++			return PTR_ERR(hvs->disp_clk);
++		}
++
+ 		max_rate = rpi_firmware_clk_get_max_rate(firmware,
+ 							 RPI_FIRMWARE_CORE_CLK_ID);
+ 		rpi_firmware_put(firmware);
+@@ -1096,14 +1581,23 @@ static int vc4_hvs_bind(struct device *d
+ 			dev_err(&pdev->dev, "Couldn't enable the core clock\n");
+ 			return ret;
+ 		}
++
++		ret = clk_prepare_enable(hvs->disp_clk);
++		if (ret) {
++			dev_err(&pdev->dev, "Couldn't enable the disp clock\n");
++			return ret;
++		}
+ 	}
+ 
+-	if (vc4->gen == VC4_GEN_4)
+-		hvs->dlist = hvs->regs + SCALER_DLIST_START;
+-	else
++	if (vc4->gen >= VC4_GEN_5)
+ 		hvs->dlist = hvs->regs + SCALER5_DLIST_START;
++	else
++		hvs->dlist = hvs->regs + SCALER_DLIST_START;
+ 
+-	ret = vc4_hvs_hw_init(hvs);
++	if (vc4->gen >= VC4_GEN_6_C)
++		ret = vc6_hvs_hw_init(hvs);
++	else
++		ret = vc4_hvs_hw_init(hvs);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -1120,10 +1614,12 @@ static int vc4_hvs_bind(struct device *d
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = devm_request_irq(dev, platform_get_irq(pdev, 0),
+-			       vc4_hvs_irq_handler, 0, "vc4 hvs", drm);
+-	if (ret)
+-		return ret;
++	if (vc4->gen < VC4_GEN_6_C) {
++		ret = devm_request_irq(dev, platform_get_irq(pdev, 0),
++				       vc4_hvs_irq_handler, 0, "vc4 hvs", drm);
++		if (ret)
++			return ret;
++	}
+ 
+ 	return 0;
+ }
+@@ -1148,6 +1644,7 @@ static void vc4_hvs_unbind(struct device
+ 		drm_mm_remove_node(node);
+ 	drm_mm_takedown(&vc4->hvs->lbm_mm);
+ 
++	clk_disable_unprepare(hvs->disp_clk);
+ 	clk_disable_unprepare(hvs->core_clk);
+ 
+ 	vc4->hvs = NULL;
+@@ -1170,6 +1667,7 @@ static void vc4_hvs_dev_remove(struct pl
+ 
+ static const struct of_device_id vc4_hvs_dt_match[] = {
+ 	{ .compatible = "brcm,bcm2711-hvs" },
++	{ .compatible = "brcm,bcm2712-hvs" },
+ 	{ .compatible = "brcm,bcm2835-hvs" },
+ 	{}
+ };
+--- a/drivers/gpu/drm/vc4/vc4_kms.c
++++ b/drivers/gpu/drm/vc4/vc4_kms.c
+@@ -320,17 +320,62 @@ static void vc5_hvs_pv_muxing_commit(str
+ 	}
+ }
+ 
++static void vc6_hvs_pv_muxing_commit(struct vc4_dev *vc4,
++				     struct drm_atomic_state *state)
++{
++	struct vc4_hvs *hvs = vc4->hvs;
++	struct drm_crtc_state *crtc_state;
++	struct drm_crtc *crtc;
++	unsigned int i;
++
++	WARN_ON_ONCE(vc4->gen != VC4_GEN_6_C);
++
++	for_each_new_crtc_in_state(state, crtc, crtc_state, i) {
++		struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(crtc_state);
++		struct vc4_encoder *vc4_encoder;
++		struct drm_encoder *encoder;
++		unsigned char mux;
++		u32 reg;
++
++		if (!vc4_state->update_muxing)
++			continue;
++
++		if (vc4_state->assigned_channel != 1)
++			continue;
++
++		encoder = vc4_get_crtc_encoder(crtc, crtc_state);
++		vc4_encoder = to_vc4_encoder(encoder);
++		switch (vc4_encoder->type) {
++		case VC4_ENCODER_TYPE_HDMI1:
++			mux = 0;
++			break;
++
++		case VC4_ENCODER_TYPE_TXP:
++			mux = 2;
++			break;
++
++		default:
++			drm_err(&vc4->base, "Unhandled encoder type for PV muxing %d",
++				vc4_encoder->type);
++			mux = 0;
++			break;
++		}
++
++		reg = HVS_READ(SCALER6_CONTROL);
++		HVS_WRITE(SCALER6_CONTROL,
++			  (reg & ~SCALER6_CONTROL_DSP1_TARGET_MASK) |
++			  VC4_SET_FIELD(mux, SCALER6_CONTROL_DSP1_TARGET));
++	}
++}
++
+ static void vc4_atomic_commit_tail(struct drm_atomic_state *state)
+ {
+ 	struct drm_device *dev = state->dev;
+ 	struct vc4_dev *vc4 = to_vc4_dev(dev);
+ 	struct vc4_hvs *hvs = vc4->hvs;
+-	struct drm_crtc_state *new_crtc_state;
+ 	struct vc4_hvs_state *new_hvs_state;
+-	struct drm_crtc *crtc;
+ 	struct vc4_hvs_state *old_hvs_state;
+ 	unsigned int channel;
+-	int i;
+ 
+ 	old_hvs_state = vc4_hvs_get_old_global_state(state);
+ 	if (WARN_ON(IS_ERR(old_hvs_state)))
+@@ -340,14 +385,20 @@ static void vc4_atomic_commit_tail(struc
+ 	if (WARN_ON(IS_ERR(new_hvs_state)))
+ 		return;
+ 
+-	for_each_new_crtc_in_state(state, crtc, new_crtc_state, i) {
+-		struct vc4_crtc_state *vc4_crtc_state;
++	if (vc4->gen < VC4_GEN_6_C) {
++		struct drm_crtc_state *new_crtc_state;
++		struct drm_crtc *crtc;
++		int i;
+ 
+-		if (!new_crtc_state->commit)
+-			continue;
++		for_each_new_crtc_in_state(state, crtc, new_crtc_state, i) {
++			struct vc4_crtc_state *vc4_crtc_state;
++
++			if (!new_crtc_state->commit)
++				continue;
+ 
+-		vc4_crtc_state = to_vc4_crtc_state(new_crtc_state);
+-		vc4_hvs_mask_underrun(hvs, vc4_crtc_state->assigned_channel);
++			vc4_crtc_state = to_vc4_crtc_state(new_crtc_state);
++			vc4_hvs_mask_underrun(hvs, vc4_crtc_state->assigned_channel);
++		}
+ 	}
+ 
+ 	for (channel = 0; channel < HVS_NUM_CHANNELS; channel++) {
+@@ -382,16 +433,31 @@ static void vc4_atomic_commit_tail(struc
+ 		 * modeset.
+ 		 */
+ 		WARN_ON(clk_set_min_rate(hvs->core_clk, core_rate));
++		WARN_ON(clk_set_min_rate(hvs->disp_clk, core_rate));
+ 	}
+ 
+ 	drm_atomic_helper_commit_modeset_disables(dev, state);
+ 
+-	vc4_ctm_commit(vc4, state);
++	if (vc4->gen <= VC4_GEN_5)
++		vc4_ctm_commit(vc4, state);
+ 
+-	if (vc4->gen == VC4_GEN_5)
+-		vc5_hvs_pv_muxing_commit(vc4, state);
+-	else
++	switch (vc4->gen) {
++	case VC4_GEN_4:
+ 		vc4_hvs_pv_muxing_commit(vc4, state);
++		break;
++
++	case VC4_GEN_5:
++		vc5_hvs_pv_muxing_commit(vc4, state);
++		break;
++
++	case VC4_GEN_6_C:
++		vc6_hvs_pv_muxing_commit(vc4, state);
++		break;
++
++	default:
++		drm_err(dev, "Unknown VC4 generation: %d", vc4->gen);
++		break;
++	}
+ 
+ 	drm_atomic_helper_commit_planes(dev, state,
+ 					DRM_PLANE_COMMIT_ACTIVE_ONLY);
+@@ -418,6 +484,7 @@ static void vc4_atomic_commit_tail(struc
+ 		 * requirements.
+ 		 */
+ 		WARN_ON(clk_set_min_rate(hvs->core_clk, core_rate));
++		WARN_ON(clk_set_min_rate(hvs->disp_clk, core_rate));
+ 
+ 		drm_dbg(dev, "Core clock actual rate: %lu Hz\n",
+ 			clk_get_rate(hvs->core_clk));
+@@ -1056,7 +1123,10 @@ int vc4_kms_load(struct drm_device *dev)
+ 		return ret;
+ 	}
+ 
+-	if (vc4->gen == VC4_GEN_5) {
++	if (vc4->gen >= VC4_GEN_6_C) {
++		dev->mode_config.max_width = 8192;
++		dev->mode_config.max_height = 8192;
++	} else if (vc4->gen >= VC4_GEN_5) {
+ 		dev->mode_config.max_width = 7680;
+ 		dev->mode_config.max_height = 7680;
+ 	} else {
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -278,7 +278,10 @@ static bool plane_enabled(struct drm_pla
+ 
+ static struct drm_plane_state *vc4_plane_duplicate_state(struct drm_plane *plane)
+ {
++	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
++	struct vc4_hvs *hvs = vc4->hvs;
+ 	struct vc4_plane_state *vc4_state;
++	unsigned int i;
+ 
+ 	if (WARN_ON(!plane->state))
+ 		return NULL;
+@@ -288,6 +291,12 @@ static struct drm_plane_state *vc4_plane
+ 		return NULL;
+ 
+ 	memset(&vc4_state->lbm, 0, sizeof(vc4_state->lbm));
++
++	for (i = 0; i < DRM_FORMAT_MAX_PLANES; i++) {
++		if (vc4_state->upm_handle[i])
++			refcount_inc(&hvs->upm_refcounts[vc4_state->upm_handle[i]].refcount);
++	}
++
+ 	vc4_state->dlist_initialized = 0;
+ 
+ 	__drm_atomic_helper_plane_duplicate_state(plane, &vc4_state->base);
+@@ -306,18 +315,47 @@ static struct drm_plane_state *vc4_plane
+ 	return &vc4_state->base;
+ }
+ 
++static void vc4_plane_release_upm_ida(struct vc4_hvs *hvs, unsigned int upm_handle)
++{
++	struct vc4_upm_refcounts *refcount = &hvs->upm_refcounts[upm_handle];
++	unsigned long irqflags;
++
++	spin_lock_irqsave(&hvs->mm_lock, irqflags);
++	drm_mm_remove_node(&refcount->upm);
++	spin_unlock_irqrestore(&hvs->mm_lock, irqflags);
++	refcount->upm.start = 0;
++	refcount->upm.size = 0;
++	refcount->size = 0;
++
++	ida_free(&hvs->upm_handles, upm_handle);
++}
++
+ static void vc4_plane_destroy_state(struct drm_plane *plane,
+ 				    struct drm_plane_state *state)
+ {
+ 	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
++	struct vc4_hvs *hvs = vc4->hvs;
+ 	struct vc4_plane_state *vc4_state = to_vc4_plane_state(state);
++	unsigned int i;
+ 
+ 	if (drm_mm_node_allocated(&vc4_state->lbm)) {
+ 		unsigned long irqflags;
+ 
+-		spin_lock_irqsave(&vc4->hvs->mm_lock, irqflags);
++		spin_lock_irqsave(&hvs->mm_lock, irqflags);
+ 		drm_mm_remove_node(&vc4_state->lbm);
+-		spin_unlock_irqrestore(&vc4->hvs->mm_lock, irqflags);
++		spin_unlock_irqrestore(&hvs->mm_lock, irqflags);
++	}
++
++	for (i = 0; i < DRM_FORMAT_MAX_PLANES; i++) {
++		struct vc4_upm_refcounts *refcount;
++
++		if (!vc4_state->upm_handle[i])
++			continue;
++
++		refcount = &hvs->upm_refcounts[vc4_state->upm_handle[i]];
++
++		if (refcount_dec_and_test(&refcount->refcount))
++			vc4_plane_release_upm_ida(hvs, vc4_state->upm_handle[i]);
+ 	}
+ 
+ 	kfree(vc4_state->dlist);
+@@ -538,6 +576,11 @@ static void vc4_write_tpz(struct vc4_pla
+ 	recip = ~0 / scale;
+ 
+ 	vc4_dlist_write(vc4_state,
++			/*
++			 * The BCM2712 is lacking BIT(31) compared to
++			 * the previous generations, but we don't use
++			 * it.
++			 */
+ 			VC4_SET_FIELD(scale, SCALER_TPZ0_SCALE) |
+ 			VC4_SET_FIELD(0, SCALER_TPZ0_IPHASE));
+ 	vc4_dlist_write(vc4_state,
+@@ -598,10 +641,15 @@ static void vc4_write_ppf(struct vc4_pla
+ 	vc4_dlist_write(vc4_state,
+ 			SCALER_PPF_AGC |
+ 			VC4_SET_FIELD(scale, SCALER_PPF_SCALE) |
++			/*
++			 * The register layout documentation is slightly
++			 * different to setup the phase in the BCM2712,
++			 * but they seem equivalent.
++			 */
+ 			VC4_SET_FIELD(phase, SCALER_PPF_IPHASE));
+ }
+ 
+-static u32 vc4_lbm_size(struct drm_plane_state *state)
++static u32 __vc4_lbm_size(struct drm_plane_state *state)
+ {
+ 	struct vc4_plane_state *vc4_state = to_vc4_plane_state(state);
+ 	struct vc4_dev *vc4 = to_vc4_dev(state->plane->dev);
+@@ -649,6 +697,131 @@ static u32 vc4_lbm_size(struct drm_plane
+ 	return lbm;
+ }
+ 
++static unsigned int vc4_lbm_words_per_component(const struct drm_plane_state *state,
++						unsigned int channel)
++{
++	const struct vc4_plane_state *vc4_state = to_vc4_plane_state(state);
++
++	switch (vc4_state->y_scaling[channel]) {
++	case VC4_SCALING_PPF:
++		return 4;
++
++	case VC4_SCALING_TPZ:
++		return 2;
++
++	default:
++		return 0;
++	}
++}
++
++static unsigned int vc4_lbm_components(const struct drm_plane_state *state,
++				       unsigned int channel)
++{
++	const struct drm_format_info *info = state->fb->format;
++	const struct vc4_plane_state *vc4_state = to_vc4_plane_state(state);
++
++	if (vc4_state->y_scaling[channel] == VC4_SCALING_NONE)
++		return 0;
++
++	if (info->is_yuv)
++		return channel ? 2 : 1;
++
++	if (info->has_alpha)
++		return 4;
++
++	return 3;
++}
++
++static unsigned int vc4_lbm_channel_size(const struct drm_plane_state *state,
++					 unsigned int channel)
++{
++	const struct drm_format_info *info = state->fb->format;
++	const struct vc4_plane_state *vc4_state = to_vc4_plane_state(state);
++	unsigned int channels_scaled = 0;
++	unsigned int components, words, wpc;
++	unsigned int width, lines;
++	unsigned int i;
++
++	/* LBM is meant to use the smaller of source or dest width, but there
++	 * is a issue with UV scaling that the size required for the second
++	 * channel is based on the source width only.
++	 */
++	if (info->hsub > 1 && channel == 1)
++		width = state->src_w >> 16;
++	else
++		width = min(state->src_w >> 16, state->crtc_w);
++	width = round_up(width / info->hsub, 4);
++
++	wpc = vc4_lbm_words_per_component(state, channel);
++	if (!wpc)
++		return 0;
++
++	components = vc4_lbm_components(state, channel);
++	if (!components)
++		return 0;
++
++	if (state->alpha != DRM_BLEND_ALPHA_OPAQUE && info->has_alpha)
++		components -= 1;
++
++	words = width * wpc * components;
++
++	lines = DIV_ROUND_UP(words, 128 / info->hsub);
++
++	for (i = 0; i < 2; i++)
++		if (vc4_state->y_scaling[channel] != VC4_SCALING_NONE)
++			channels_scaled++;
++
++	if (channels_scaled == 1)
++		lines = lines / 2;
++
++	return lines;
++}
++
++static unsigned int __vc6_lbm_size(const struct drm_plane_state *state)
++{
++	const struct drm_format_info *info = state->fb->format;
++
++	if (info->hsub > 1)
++		return max(vc4_lbm_channel_size(state, 0),
++			   vc4_lbm_channel_size(state, 1));
++	else
++		return vc4_lbm_channel_size(state, 0);
++}
++
++static u32 vc4_lbm_size(struct drm_plane_state *state)
++{
++	struct vc4_plane_state *vc4_state = to_vc4_plane_state(state);
++	struct vc4_dev *vc4 = to_vc4_dev(state->plane->dev);
++
++	/* LBM is not needed when there's no vertical scaling. */
++	if (vc4_state->y_scaling[0] == VC4_SCALING_NONE &&
++	    vc4_state->y_scaling[1] == VC4_SCALING_NONE)
++		return 0;
++
++	if (vc4->gen >= VC4_GEN_6_C)
++		return __vc6_lbm_size(state);
++	else
++		return __vc4_lbm_size(state);
++}
++
++static size_t vc6_upm_size(const struct drm_plane_state *state,
++			   unsigned int plane)
++{
++	const struct vc4_plane_state *vc4_state = to_vc4_plane_state(state);
++	unsigned int stride = state->fb->pitches[plane];
++
++	/*
++	 * TODO: This only works for raster formats, and is sub-optimal
++	 * for buffers with a stride aligned on 32 bytes.
++	 */
++	unsigned int words_per_line = (stride + 62) / 32;
++	unsigned int fetch_region_size = words_per_line * 32;
++	unsigned int buffer_lines = 2 << vc4_state->upm_buffer_lines;
++	unsigned int buffer_size = fetch_region_size * buffer_lines;
++
++	return ALIGN(buffer_size, HVS_UBM_WORD_SIZE);
++}
++
+ static void vc4_write_scaling_parameters(struct drm_plane_state *state,
+ 					 int channel)
+ {
+@@ -750,6 +923,10 @@ static int vc4_plane_allocate_lbm(struct
+ 	if (!lbm_size)
+ 		return 0;
+ 
++	/*
++	 * NOTE: BCM2712 doesn't need to be aligned, since the size
++	 * returned by vc4_lbm_size() is in words already.
++	 */
+ 	if (vc4->gen == VC4_GEN_5)
+ 		lbm_size = ALIGN(lbm_size, 64);
+ 	else if (vc4->gen == VC4_GEN_4)
+@@ -787,6 +964,108 @@ static int vc4_plane_allocate_lbm(struct
+ 	return 0;
+ }
+ 
++static int vc6_plane_allocate_upm(struct drm_plane_state *state)
++{
++	const struct drm_format_info *info = state->fb->format;
++	struct drm_device *drm = state->plane->dev;
++	struct vc4_dev *vc4 = to_vc4_dev(drm);
++	struct vc4_hvs *hvs = vc4->hvs;
++	struct vc4_plane_state *vc4_state = to_vc4_plane_state(state);
++	unsigned int i;
++	int ret;
++
++	WARN_ON_ONCE(vc4->gen < VC4_GEN_6_C);
++
++	vc4_state->upm_buffer_lines = SCALER6_PTR0_UPM_BUFF_SIZE_2_LINES;
++
++	for (i = 0; i < info->num_planes; i++) {
++		struct vc4_upm_refcounts *refcount;
++		int upm_handle;
++		unsigned long irqflags;
++		size_t upm_size;
++
++		upm_size = vc6_upm_size(state, i);
++		if (!upm_size)
++			return -EINVAL;
++		upm_handle = vc4_state->upm_handle[i];
++
++		if (upm_handle &&
++		    hvs->upm_refcounts[upm_handle].size == upm_size) {
++			/* Allocation is the same size as the previous user of
++			 * the plane. Keep the allocation.
++			 */
++			vc4_state->upm_handle[i] = upm_handle;
++		} else {
++			if (upm_handle &&
++			    refcount_dec_and_test(&hvs->upm_refcounts[upm_handle].refcount)) {
++				vc4_plane_release_upm_ida(hvs, upm_handle);
++				vc4_state->upm_handle[i] = 0;
++			}
++
++			upm_handle = ida_alloc_range(&hvs->upm_handles, 1,
++						     VC4_NUM_UPM_HANDLES,
++						     GFP_KERNEL);
++			if (upm_handle < 0) {
++				drm_dbg(drm, "Out of upm_handles\n");
++				return upm_handle;
++			}
++			vc4_state->upm_handle[i] = upm_handle;
++
++			refcount = &hvs->upm_refcounts[upm_handle];
++			refcount_set(&refcount->refcount, 1);
++			refcount->size = upm_size;
++
++			spin_lock_irqsave(&hvs->mm_lock, irqflags);
++			ret = drm_mm_insert_node_generic(&hvs->upm_mm,
++							 &refcount->upm,
++							 upm_size, HVS_UBM_WORD_SIZE,
++							 0, 0);
++			spin_unlock_irqrestore(&hvs->mm_lock, irqflags);
++			if (ret) {
++				drm_err(drm, "Failed to allocate UPM entry: %d\n", ret);
++				refcount_set(&refcount->refcount, 0);
++				ida_free(&hvs->upm_handles, upm_handle);
++				vc4_state->upm_handle[i] = 0;
++				return ret;
++			}
++		}
++
++		refcount = &hvs->upm_refcounts[upm_handle];
++		vc4_state->dlist[vc4_state->ptr0_offset[i]] |=
++			VC4_SET_FIELD(refcount->upm.start / HVS_UBM_WORD_SIZE,
++				      SCALER6_PTR0_UPM_BASE) |
++			VC4_SET_FIELD(vc4_state->upm_handle[i] - 1,
++				      SCALER6_PTR0_UPM_HANDLE) |
++			VC4_SET_FIELD(vc4_state->upm_buffer_lines,
++				      SCALER6_PTR0_UPM_BUFF_SIZE);
++	}
++
++	return 0;
++}
++
++static void vc6_plane_free_upm(struct drm_plane_state *state)
++{
++	struct vc4_plane_state *vc4_state = to_vc4_plane_state(state);
++	struct drm_device *drm = state->plane->dev;
++	struct vc4_dev *vc4 = to_vc4_dev(drm);
++	struct vc4_hvs *hvs = vc4->hvs;
++	unsigned int i;
++
++	WARN_ON_ONCE(vc4->gen < VC4_GEN_6_C);
++
++	for (i = 0; i < DRM_FORMAT_MAX_PLANES; i++) {
++		unsigned int upm_handle;
++
++		upm_handle = vc4_state->upm_handle[i];
++		if (!upm_handle)
++			continue;
++
++		if (refcount_dec_and_test(&hvs->upm_refcounts[upm_handle].refcount))
++			vc4_plane_release_upm_ida(hvs, upm_handle);
++		vc4_state->upm_handle[i] = 0;
++	}
++}
++
+ /*
+  * The colorspace conversion matrices are held in 3 entries in the dlist.
+  * Create an array of them, with entries for each full and limited mode, and
+@@ -1363,6 +1642,412 @@ static int vc4_plane_mode_set(struct drm
+ 	return 0;
+ }
+ 
++static u32 vc6_plane_get_csc_mode(struct vc4_plane_state *vc4_state)
++{
++	struct drm_plane_state *state = &vc4_state->base;
++	u32 ret = 0;
++
++	if (vc4_state->is_yuv) {
++		enum drm_color_encoding color_encoding = state->color_encoding;
++		enum drm_color_range color_range = state->color_range;
++
++		ret |= SCALER6_CTL2_CSC_ENABLE;
++
++		/* CSC pre-loaded with:
++		 * 0 = BT601 limited range
++		 * 1 = BT709 limited range
++		 * 2 = BT2020 limited range
++		 * 3 = BT601 full range
++		 * 4 = BT709 full range
++		 * 5 = BT2020 full range
++		 */
++		if (color_encoding > DRM_COLOR_YCBCR_BT2020)
++			color_encoding = DRM_COLOR_YCBCR_BT601;
++		if (color_range > DRM_COLOR_YCBCR_FULL_RANGE)
++			color_range = DRM_COLOR_YCBCR_LIMITED_RANGE;
++
++		ret |= VC4_SET_FIELD(color_encoding + (color_range * 3),
++				     SCALER6_CTL2_BRCM_CFC_CONTROL);
++	}
++
++	return ret;
++}
++
++static int vc6_plane_mode_set(struct drm_plane *plane,
++			      struct drm_plane_state *state)
++{
++	struct drm_device *drm = plane->dev;
++	struct vc4_dev *vc4 = to_vc4_dev(drm);
++	struct vc4_plane_state *vc4_state = to_vc4_plane_state(state);
++	struct drm_framebuffer *fb = state->fb;
++	const struct hvs_format *format = vc4_get_hvs_format(fb->format->format);
++	u64 base_format_mod = fourcc_mod_broadcom_mod(fb->modifier);
++	int num_planes = fb->format->num_planes;
++	u32 h_subsample = fb->format->hsub;
++	u32 v_subsample = fb->format->vsub;
++	bool mix_plane_alpha;
++	bool covers_screen;
++	u32 scl0, scl1, pitch0;
++	u32 tiling, src_x, src_y;
++	u32 width, height;
++	u32 hvs_format = format->hvs;
++	u32 offsets[3] = { 0 };
++	unsigned int rotation;
++	int ret, i;
++
++	if (vc4_state->dlist_initialized)
++		return 0;
++
++	ret = vc4_plane_setup_clipping_and_scaling(state);
++	if (ret)
++		return ret;
++
++	width = vc4_state->src_w[0] >> 16;
++	height = vc4_state->src_h[0] >> 16;
++
++	/* SCL1 is used for Cb/Cr scaling of planar formats.  For RGB
++	 * and 4:4:4, scl1 should be set to scl0 so both channels of
++	 * the scaler do the same thing.  For YUV, the Y plane needs
++	 * to be put in channel 1 and Cb/Cr in channel 0, so we swap
++	 * the scl fields here.
++	 */
++	if (num_planes == 1) {
++		scl0 = vc4_get_scl_field(state, 0);
++		scl1 = scl0;
++	} else {
++		scl0 = vc4_get_scl_field(state, 1);
++		scl1 = vc4_get_scl_field(state, 0);
++	}
++
++	rotation = drm_rotation_simplify(state->rotation,
++					 DRM_MODE_ROTATE_0 |
++					 DRM_MODE_REFLECT_X |
++					 DRM_MODE_REFLECT_Y);
++
++	/* We must point to the last line when Y reflection is enabled. */
++	src_y = vc4_state->src_y >> 16;
++	if (rotation & DRM_MODE_REFLECT_Y)
++		src_y += height - 1;
++
++	src_x = vc4_state->src_x >> 16;
++
++	switch (base_format_mod) {
++	case DRM_FORMAT_MOD_LINEAR:
++		tiling = SCALER6_CTL0_ADDR_MODE_LINEAR;
++
++		/* Adjust the base pointer to the first pixel to be scanned
++		 * out.
++		 */
++		for (i = 0; i < num_planes; i++) {
++			offsets[i] += src_y / (i ? v_subsample : 1) * fb->pitches[i];
++			offsets[i] += src_x / (i ? h_subsample : 1) * fb->format->cpp[i];
++		}
++
++		break;
++
++	case DRM_FORMAT_MOD_BROADCOM_SAND128:
++	case DRM_FORMAT_MOD_BROADCOM_SAND256: {
++		uint32_t param = fourcc_mod_broadcom_param(fb->modifier);
++		u32 components_per_word;
++		u32 starting_offset;
++		u32 fetch_count;
++
++		if (param > SCALER_TILE_HEIGHT_MASK) {
++			DRM_DEBUG_KMS("SAND height too large (%d)\n",
++				      param);
++			return -EINVAL;
++		}
++
++		if (fb->format->format == DRM_FORMAT_P030) {
++			hvs_format = HVS_PIXEL_FORMAT_YCBCR_10BIT;
++			tiling = SCALER6_CTL0_ADDR_MODE_128B;
++		} else {
++			hvs_format = HVS_PIXEL_FORMAT_YCBCR_YUV420_2PLANE;
++
++			switch (base_format_mod) {
++			case DRM_FORMAT_MOD_BROADCOM_SAND128:
++				tiling = SCALER6_CTL0_ADDR_MODE_128B;
++				break;
++			case DRM_FORMAT_MOD_BROADCOM_SAND256:
++				tiling = SCALER6_CTL0_ADDR_MODE_256B;
++				break;
++			default:
++				return -EINVAL;
++			}
++		}
++
++		/* Adjust the base pointer to the first pixel to be scanned
++		 * out.
++		 *
++		 * For P030, y_ptr [31:4] is the 128bit word for the start pixel
++		 * y_ptr [3:0] is the pixel (0-11) contained within that 128bit
++		 * word that should be taken as the first pixel.
++		 * Ditto uv_ptr [31:4] vs [3:0], however [3:0] contains the
++		 * element within the 128bit word, eg for pixel 3 the value
++		 * should be 6.
++		 */
++		for (i = 0; i < num_planes; i++) {
++			u32 tile_w, tile, x_off, pix_per_tile;
++
++			if (fb->format->format == DRM_FORMAT_P030) {
++				/*
++				 * Spec says: bits [31:4] of the given address
++				 * should point to the 128-bit word containing
++				 * the desired starting pixel, and bits[3:0]
++				 * should be between 0 and 11, indicating which
++				 * of the 12-pixels in that 128-bit word is the
++				 * first pixel to be used
++				 */
++				u32 remaining_pixels = src_x % 96;
++				u32 aligned = remaining_pixels / 12;
++				u32 last_bits = remaining_pixels % 12;
++
++				x_off = aligned * 16 + last_bits;
++				tile_w = 128;
++				pix_per_tile = 96;
++			} else {
++				switch (base_format_mod) {
++				case DRM_FORMAT_MOD_BROADCOM_SAND128:
++					tile_w = 128;
++					break;
++				case DRM_FORMAT_MOD_BROADCOM_SAND256:
++					tile_w = 256;
++					break;
++				default:
++					return -EINVAL;
++				}
++				pix_per_tile = tile_w / fb->format->cpp[0];
++				x_off = (src_x % pix_per_tile) /
++					(i ? h_subsample : 1) *
++					fb->format->cpp[i];
++			}
++
++			tile = src_x / pix_per_tile;
++
++			offsets[i] += param * tile_w * tile;
++			offsets[i] += src_y / (i ? v_subsample : 1) * tile_w;
++			offsets[i] += x_off & ~(i ? 1 : 0);
++		}
++
++		components_per_word = fb->format->format == DRM_FORMAT_P030 ? 24 : 32;
++		starting_offset = src_x % components_per_word;
++		fetch_count = (width + starting_offset + components_per_word - 1) /
++			components_per_word;
++
++		pitch0 = VC4_SET_FIELD(param, SCALER6_PTR2_PITCH) |
++			 VC4_SET_FIELD(fetch_count - 1, SCALER6_PTR2_FETCH_COUNT);
++		break;
++	}
++
++	default:
++		DRM_DEBUG_KMS("Unsupported FB tiling flag 0x%16llx",
++			      (long long)fb->modifier);
++		return -EINVAL;
++	}
++
++	/* fetch an extra pixel if we don't actually line up with the left edge. */
++	if ((vc4_state->src_x & 0xffff) && vc4_state->src_x < (state->fb->width << 16))
++		width++;
++
++	/* same for the right side */
++	if (((vc4_state->src_x + vc4_state->src_w[0]) & 0xffff) &&
++	    vc4_state->src_x + vc4_state->src_w[0] < (state->fb->width << 16))
++		width++;
++
++	/* now for the top */
++	if ((vc4_state->src_y & 0xffff) && vc4_state->src_y < (state->fb->height << 16))
++		height++;
++
++	/* and the bottom */
++	if (((vc4_state->src_y + vc4_state->src_h[0]) & 0xffff) &&
++	    vc4_state->src_y + vc4_state->src_h[0] < (state->fb->height << 16))
++		height++;
++
++	/* for YUV444 hardware wants double the width, otherwise it doesn't
++	 * fetch full width of chroma
++	 */
++	if (format->drm == DRM_FORMAT_YUV444 || format->drm == DRM_FORMAT_YVU444)
++		width <<= 1;
++
++	/* Don't waste cycles mixing with plane alpha if the set alpha
++	 * is opaque or there is no per-pixel alpha information.
++	 * In any case we use the alpha property value as the fixed alpha.
++	 */
++	mix_plane_alpha = state->alpha != DRM_BLEND_ALPHA_OPAQUE &&
++			  fb->format->has_alpha;
++
++	/* Control Word 0: Scaling Configuration & Element Validity*/
++	vc4_dlist_write(vc4_state,
++			SCALER6_CTL0_VALID |
++			VC4_SET_FIELD(tiling, SCALER6_CTL0_ADDR_MODE) |
++			VC4_SET_FIELD(0, SCALER6_CTL0_ALPHA_MASK) |
++			(vc4_state->is_unity ? SCALER6_CTL0_UNITY : 0) |
++			VC4_SET_FIELD(format->pixel_order_hvs5, SCALER6_CTL0_ORDERRGBA) |
++			VC4_SET_FIELD(scl1, SCALER6_CTL0_SCL1_MODE) |
++			VC4_SET_FIELD(scl0, SCALER6_CTL0_SCL0_MODE) |
++			VC4_SET_FIELD(hvs_format, SCALER6_CTL0_PIXEL_FORMAT));
++
++	/* Position Word 0: Image Position */
++	vc4_state->pos0_offset = vc4_state->dlist_count;
++	vc4_dlist_write(vc4_state,
++			VC4_SET_FIELD(vc4_state->crtc_y, SCALER6_POS0_START_Y) |
++			(rotation & DRM_MODE_REFLECT_X ? SCALER6_POS0_HFLIP : 0) |
++			VC4_SET_FIELD(vc4_state->crtc_x, SCALER6_POS0_START_X));
++
++	/* Control Word 2: Alpha Value & CSC */
++	vc4_dlist_write(vc4_state,
++			vc6_plane_get_csc_mode(vc4_state) |
++			vc4_hvs5_get_alpha_blend_mode(state) |
++			(mix_plane_alpha ? SCALER6_CTL2_ALPHA_MIX : 0) |
++			VC4_SET_FIELD(state->alpha >> 4, SCALER5_CTL2_ALPHA));
++
++	/* Position Word 1: Scaled Image Dimensions */
++	if (!vc4_state->is_unity)
++		vc4_dlist_write(vc4_state,
++				VC4_SET_FIELD(vc4_state->crtc_h - 1,
++					      SCALER6_POS1_SCL_LINES) |
++				VC4_SET_FIELD(vc4_state->crtc_w - 1,
++					      SCALER6_POS1_SCL_WIDTH));
++
++	/* Position Word 2: Source Image Size */
++	vc4_state->pos2_offset = vc4_state->dlist_count;
++	vc4_dlist_write(vc4_state,
++			VC4_SET_FIELD(height - 1,
++				      SCALER6_POS2_SRC_LINES) |
++			VC4_SET_FIELD(width - 1,
++				      SCALER6_POS2_SRC_WIDTH));
++
++	/* Position Word 3: Context */
++	vc4_dlist_write(vc4_state, 0xc0c0c0c0);
++
++	/*
++	 * TODO: This only covers Raster Scan Order planes
++	 */
++	for (i = 0; i < num_planes; i++) {
++		struct drm_gem_dma_object *bo = drm_fb_dma_get_gem_obj(fb, i);
++		dma_addr_t paddr = bo->dma_addr + fb->offsets[i] + offsets[i];
++
++		/* Pointer Word 0 */
++		vc4_state->ptr0_offset[i] = vc4_state->dlist_count;
++		vc4_dlist_write(vc4_state,
++				(rotation & DRM_MODE_REFLECT_Y ? SCALER6_PTR0_VFLIP : 0) |
++				/*
++				 * The UPM buffer will be allocated in
++				 * vc6_plane_allocate_upm().
++				 */
++				VC4_SET_FIELD(upper_32_bits(paddr) & 0xff,
++					      SCALER6_PTR0_UPPER_ADDR));
++
++		/* Pointer Word 1 */
++		vc4_dlist_write(vc4_state, lower_32_bits(paddr));
++
++		/* Pointer Word 2 */
++		if (base_format_mod != DRM_FORMAT_MOD_BROADCOM_SAND128 &&
++		    base_format_mod != DRM_FORMAT_MOD_BROADCOM_SAND256) {
++			vc4_dlist_write(vc4_state,
++					VC4_SET_FIELD(fb->pitches[i],
++						      SCALER6_PTR2_PITCH));
++		} else {
++			vc4_dlist_write(vc4_state, pitch0);
++		}
++	}
++
++	/*
++	 * Palette Word 0
++	 * TODO: We're not using the palette mode
++	 */
++
++	/*
++	 * Trans Word 0
++	 * TODO: It's only relevant if we set the trans_rgb bit in the
++	 * control word 0, and we don't at the moment.
++	 */
++
++	vc4_state->lbm_offset = 0;
++
++	if (!vc4_state->is_unity || fb->format->is_yuv) {
++		/*
++		 * Reserve a slot for the LBM Base Address. The real value will
++		 * be set when calling vc4_plane_allocate_lbm().
++		 */
++		if (vc4_state->y_scaling[0] != VC4_SCALING_NONE ||
++		    vc4_state->y_scaling[1] != VC4_SCALING_NONE) {
++			vc4_state->lbm_offset = vc4_state->dlist_count;
++			vc4_dlist_counter_increment(vc4_state);
++		}
++
++		if (vc4_state->x_scaling[0] != VC4_SCALING_NONE ||
++		    vc4_state->x_scaling[1] != VC4_SCALING_NONE ||
++		    vc4_state->y_scaling[0] != VC4_SCALING_NONE ||
++		    vc4_state->y_scaling[1] != VC4_SCALING_NONE) {
++			if (num_planes > 1)
++				/*
++				 * Emit Cb/Cr as channel 0 and Y as channel
++				 * 1. This matches how we set up scl0/scl1
++				 * above.
++				 */
++				vc4_write_scaling_parameters(state, 1);
++
++			vc4_write_scaling_parameters(state, 0);
++		}
++
++		/*
++		 * If any PPF setup was done, then all the kernel
++		 * pointers get uploaded.
++		 */
++		if (vc4_state->x_scaling[0] == VC4_SCALING_PPF ||
++		    vc4_state->y_scaling[0] == VC4_SCALING_PPF ||
++		    vc4_state->x_scaling[1] == VC4_SCALING_PPF ||
++		    vc4_state->y_scaling[1] == VC4_SCALING_PPF) {
++			u32 kernel =
++				VC4_SET_FIELD(vc4->hvs->mitchell_netravali_filter.start,
++					      SCALER_PPF_KERNEL_OFFSET);
++
++			/* HPPF plane 0 */
++			vc4_dlist_write(vc4_state, kernel);
++			/* VPPF plane 0 */
++			vc4_dlist_write(vc4_state, kernel);
++			/* HPPF plane 1 */
++			vc4_dlist_write(vc4_state, kernel);
++			/* VPPF plane 1 */
++				vc4_dlist_write(vc4_state, kernel);
++		}
++	}
++
++	vc4_dlist_write(vc4_state, SCALER6_CTL0_END);
++
++	vc4_state->dlist[0] |=
++		VC4_SET_FIELD(vc4_state->dlist_count, SCALER6_CTL0_NEXT);
++
++	/* crtc_* are already clipped coordinates. */
++	covers_screen = vc4_state->crtc_x == 0 && vc4_state->crtc_y == 0 &&
++			vc4_state->crtc_w == state->crtc->mode.hdisplay &&
++			vc4_state->crtc_h == state->crtc->mode.vdisplay;
++
++	/*
++	 * Background fill might be necessary when the plane has per-pixel
++	 * alpha content or a non-opaque plane alpha and could blend from the
++	 * background or does not cover the entire screen.
++	 */
++	vc4_state->needs_bg_fill = fb->format->has_alpha || !covers_screen ||
++				   state->alpha != DRM_BLEND_ALPHA_OPAQUE;
++
++	/*
++	 * Flag the dlist as initialized to avoid checking it twice in case
++	 * the async update check already called vc4_plane_mode_set() and
++	 * decided to fallback to sync update because async update was not
++	 * possible.
++	 */
++	vc4_state->dlist_initialized = 1;
++
++	vc4_plane_calc_load(state);
++
++	drm_dbg_driver(drm, "[PLANE:%d:%s] Computed DLIST size: %u\n",
++		       plane->base.id, plane->name, vc4_state->dlist_count);
++
++	return 0;
++}
++
+ /* If a modeset involves changing the setup of a plane, the atomic
+  * infrastructure will call this to validate a proposed plane setup.
+  * However, if a plane isn't getting updated, this (and the
+@@ -1373,6 +2058,7 @@ static int vc4_plane_mode_set(struct drm
+ static int vc4_plane_atomic_check(struct drm_plane *plane,
+ 				  struct drm_atomic_state *state)
+ {
++	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
+ 	struct drm_plane_state *new_plane_state = drm_atomic_get_new_plane_state(state,
+ 										 plane);
+ 	struct vc4_plane_state *vc4_state = to_vc4_plane_state(new_plane_state);
+@@ -1380,10 +2066,21 @@ static int vc4_plane_atomic_check(struct
+ 
+ 	vc4_state->dlist_count = 0;
+ 
+-	if (!plane_enabled(new_plane_state))
++	if (!plane_enabled(new_plane_state)) {
++		struct drm_plane_state *old_plane_state =
++				drm_atomic_get_old_plane_state(state, plane);
++
++		if (vc4->gen >= VC4_GEN_6_C && old_plane_state &&
++		    plane_enabled(old_plane_state)) {
++			vc6_plane_free_upm(new_plane_state);
++		}
+ 		return 0;
++	}
+ 
+-	ret = vc4_plane_mode_set(plane, new_plane_state);
++	if (vc4->gen >= VC4_GEN_6_C)
++		ret = vc6_plane_mode_set(plane, new_plane_state);
++	else
++		ret = vc4_plane_mode_set(plane, new_plane_state);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -1391,6 +2088,12 @@ static int vc4_plane_atomic_check(struct
+ 	if (ret)
+ 		return ret;
+ 
++	if (vc4->gen >= VC4_GEN_6_C) {
++		ret = vc6_plane_allocate_upm(new_plane_state);
++		if (ret)
++			return ret;
++	}
++
+ 	return 0;
+ }
+ 
+@@ -1439,7 +2142,8 @@ void vc4_plane_async_set_fb(struct drm_p
+ {
+ 	struct vc4_plane_state *vc4_state = to_vc4_plane_state(plane->state);
+ 	struct drm_gem_dma_object *bo = drm_fb_dma_get_gem_obj(fb, 0);
+-	uint32_t addr;
++	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
++	dma_addr_t dma_addr = bo->dma_addr + fb->offsets[0];
+ 	int idx;
+ 
+ 	if (!drm_dev_enter(plane->dev, &idx))
+@@ -1449,19 +2153,38 @@ void vc4_plane_async_set_fb(struct drm_p
+ 	 * because this is only called on the primary plane.
+ 	 */
+ 	WARN_ON_ONCE(plane->state->crtc_x < 0 || plane->state->crtc_y < 0);
+-	addr = bo->dma_addr + fb->offsets[0];
+ 
+-	/* Write the new address into the hardware immediately.  The
+-	 * scanout will start from this address as soon as the FIFO
+-	 * needs to refill with pixels.
+-	 */
+-	writel(addr, &vc4_state->hw_dlist[vc4_state->ptr0_offset[0]]);
++	if (vc4->gen == VC4_GEN_6_C) {
++		u32 value;
+ 
+-	/* Also update the CPU-side dlist copy, so that any later
+-	 * atomic updates that don't do a new modeset on our plane
+-	 * also use our updated address.
+-	 */
+-	vc4_state->dlist[vc4_state->ptr0_offset[0]] = addr;
++		value = vc4_state->dlist[vc4_state->ptr0_offset[0]] &
++					~SCALER6_PTR0_UPPER_ADDR_MASK;
++		value |= VC4_SET_FIELD(upper_32_bits(dma_addr) & 0xff,
++				       SCALER6_PTR0_UPPER_ADDR);
++
++		writel(value, &vc4_state->hw_dlist[vc4_state->ptr0_offset[0]]);
++		vc4_state->dlist[vc4_state->ptr0_offset[0]] = value;
++
++		value = lower_32_bits(dma_addr);
++		writel(value, &vc4_state->hw_dlist[vc4_state->ptr0_offset[0] + 1]);
++		vc4_state->dlist[vc4_state->ptr0_offset[0] + 1] = value;
++	} else {
++		u32 addr;
++
++		addr = (u32)dma_addr;
++
++		/* Write the new address into the hardware immediately.  The
++		 * scanout will start from this address as soon as the FIFO
++		 * needs to refill with pixels.
++		 */
++		writel(addr, &vc4_state->hw_dlist[vc4_state->ptr0_offset[0]]);
++
++		/* Also update the CPU-side dlist copy, so that any later
++		 * atomic updates that don't do a new modeset on our plane
++		 * also use our updated address.
++		 */
++		vc4_state->dlist[vc4_state->ptr0_offset[0]] = addr;
++	}
+ 
+ 	drm_dev_exit(idx);
+ }
+@@ -1543,13 +2266,17 @@ static void vc4_plane_atomic_async_updat
+ static int vc4_plane_atomic_async_check(struct drm_plane *plane,
+ 					struct drm_atomic_state *state)
+ {
++	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
+ 	struct drm_plane_state *new_plane_state = drm_atomic_get_new_plane_state(state,
+ 										 plane);
+ 	struct vc4_plane_state *old_vc4_state, *new_vc4_state;
+ 	int ret;
+ 	u32 i;
+ 
+-	ret = vc4_plane_mode_set(plane, new_plane_state);
++	if (vc4->gen <= VC4_GEN_5)
++		ret = vc4_plane_mode_set(plane, new_plane_state);
++	else
++		ret = vc6_plane_mode_set(plane, new_plane_state);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -1723,7 +2450,7 @@ struct drm_plane *vc4_plane_init(struct
+ 	};
+ 
+ 	for (i = 0; i < ARRAY_SIZE(hvs_formats); i++) {
+-		if (!hvs_formats[i].hvs5_only || vc4->gen == VC4_GEN_5) {
++		if (!hvs_formats[i].hvs5_only || vc4->gen >= VC4_GEN_5) {
+ 			formats[num_formats] = hvs_formats[i].drm;
+ 			num_formats++;
+ 		}
+@@ -1738,7 +2465,7 @@ struct drm_plane *vc4_plane_init(struct
+ 		return ERR_CAST(vc4_plane);
+ 	plane = &vc4_plane->base;
+ 
+-	if (vc4->gen == VC4_GEN_5)
++	if (vc4->gen >= VC4_GEN_5)
+ 		drm_plane_helper_add(plane, &vc5_plane_helper_funcs);
+ 	else
+ 		drm_plane_helper_add(plane, &vc4_plane_helper_funcs);
+--- a/drivers/gpu/drm/vc4/vc4_regs.h
++++ b/drivers/gpu/drm/vc4/vc4_regs.h
+@@ -520,6 +520,130 @@
+ 
+ #define SCALER5_DLIST_START			0x00004000
+ 
++#define SCALER6_VERSION				0x00000000
++#define SCALER6_CXM_SIZE			0x00000004
++#define SCALER6_LBM_SIZE			0x00000008
++#define SCALER6_UBM_SIZE			0x0000000c
++#define SCALER6_COBA_SIZE			0x00000010
++#define SCALER6_COB_SIZE			0x00000014
++
++#define SCALER6_CONTROL				0x00000020
++# define SCALER6_CONTROL_HVS_EN			BIT(31)
++# define SCALER6_CONTROL_PF_LINES_MASK		VC4_MASK(22, 18)
++# define SCALER6_CONTROL_ABORT_ON_EMPTY		BIT(16)
++# define SCALER6_CONTROL_DSP1_TARGET_MASK	VC4_MASK(13, 12)
++# define SCALER6_CONTROL_MAX_REQS_MASK		VC4_MASK(7, 4)
++
++#define SCALER6_FETCHER_STATUS			0x00000024
++#define SCALER6_FETCH_STATUS			0x00000028
++#define SCALER6_HANDLE_ERROR			0x0000002c
++
++#define SCALER6_DISP0_CTRL0			0x00000030
++#define SCALER6_DISPX_CTRL0(x)						\
++	(SCALER6_DISP0_CTRL0 + ((x) * (SCALER6_DISP1_CTRL0 - SCALER6_DISP0_CTRL0)))
++# define SCALER6_DISPX_CTRL0_ENB		BIT(31)
++# define SCALER6_DISPX_CTRL0_RESET		BIT(30)
++# define SCALER6_DISPX_CTRL0_FWIDTH_MASK	VC4_MASK(28, 16)
++# define SCALER6_DISPX_CTRL0_ONESHOT		BIT(15)
++# define SCALER6_DISPX_CTRL0_ONECTX_MASK	VC4_MASK(14, 13)
++# define SCALER6_DISPX_CTRL0_LINES_MASK		VC4_MASK(12, 0)
++
++#define SCALER6_DISP0_CTRL1			0x00000034
++#define SCALER6_DISPX_CTRL1(x)						\
++	(SCALER6_DISP0_CTRL1 + ((x) * (SCALER6_DISP1_CTRL1 - SCALER6_DISP0_CTRL1)))
++# define SCALER6_DISPX_CTRL1_BGENB		BIT(8)
++# define SCALER6_DISPX_CTRL1_INTLACE		BIT(0)
++
++#define SCALER6_DISP0_BGND			0x00000038
++#define SCALER6_DISPX_BGND(x)						\
++	(SCALER6_DISP0_BGND + ((x) * (SCALER6_DISP1_BGND - SCALER6_DISP0_BGND)))
++
++#define SCALER6_DISP0_LPTRS			0x0000003c
++#define SCALER6_DISPX_LPTRS(x)						\
++	(SCALER6_DISP0_LPTRS + ((x) * (SCALER6_DISP1_LPTRS - SCALER6_DISP0_LPTRS)))
++# define SCALER6_DISPX_LPTRS_HEADE_MASK		VC4_MASK(11, 0)
++
++#define SCALER6_DISP0_COB			0x00000040
++#define SCALER6_DISPX_COB(x)						\
++	(SCALER6_DISP0_COB + ((x) * (SCALER6_DISP1_COB - SCALER6_DISP0_COB)))
++# define SCALER6_DISPX_COB_TOP_MASK		VC4_MASK(31, 16)
++# define SCALER6_DISPX_COB_BASE_MASK		VC4_MASK(15, 0)
++
++#define SCALER6_DISP0_STATUS			0x00000044
++
++#define SCALER6_DISPX_STATUS(x)						\
++	(SCALER6_DISP0_STATUS + ((x) * (SCALER6_DISP1_STATUS - SCALER6_DISP0_STATUS)))
++# define SCALER6_DISPX_STATUS_EMPTY		BIT(22)
++# define SCALER6_DISPX_STATUS_FRCNT_MASK	VC4_MASK(21, 16)
++# define SCALER6_DISPX_STATUS_OFIELD		BIT(15)
++# define SCALER6_DISPX_STATUS_MODE_MASK		VC4_MASK(14, 13)
++# define SCALER6_DISPX_STATUS_MODE_DISABLED	0
++# define SCALER6_DISPX_STATUS_MODE_INIT		1
++# define SCALER6_DISPX_STATUS_MODE_RUN		2
++# define SCALER6_DISPX_STATUS_MODE_EOF		3
++# define SCALER6_DISPX_STATUS_YLINE_MASK	VC4_MASK(12, 0)
++
++#define SCALER6_DISP0_DL			0x00000048
++
++#define SCALER6_DISPX_DL(x)						\
++	(SCALER6_DISP0_DL + ((x) * (SCALER6_DISP1_DL - SCALER6_DISP0_DL)))
++# define SCALER6_DISPX_DL_LACT_MASK		VC4_MASK(11, 0)
++
++#define SCALER6_DISP0_RUN			0x0000004c
++#define SCALER6_DISP1_CTRL0			0x00000050
++#define SCALER6_DISP1_CTRL1			0x00000054
++#define SCALER6_DISP1_BGND			0x00000058
++#define SCALER6_DISP1_LPTRS			0x0000005c
++#define SCALER6_DISP1_COB			0x00000060
++#define SCALER6_DISP1_STATUS			0x00000064
++#define SCALER6_DISP1_DL			0x00000068
++#define SCALER6_DISP1_RUN			0x0000006c
++#define SCALER6_DISP2_CTRL0			0x00000070
++#define SCALER6_DISP2_CTRL1			0x00000074
++#define SCALER6_DISP2_BGND			0x00000078
++#define SCALER6_DISP2_LPTRS			0x0000007c
++#define SCALER6_DISP2_COB			0x00000080
++#define SCALER6_DISP2_STATUS			0x00000084
++#define SCALER6_DISP2_DL			0x00000088
++#define SCALER6_DISP2_RUN			0x0000008c
++#define SCALER6_EOLN				0x00000090
++#define SCALER6_DL_STATUS			0x00000094
++#define SCALER6_BFG_MISC			0x0000009c
++#define SCALER6_QOS0				0x000000a0
++#define SCALER6_PROF0				0x000000a4
++#define SCALER6_QOS1				0x000000a8
++#define SCALER6_PROF1				0x000000ac
++#define SCALER6_QOS2				0x000000b0
++#define SCALER6_PROF2				0x000000b4
++#define SCALER6_PRI_MAP0			0x000000b8
++#define SCALER6_PRI_MAP1			0x000000bc
++#define SCALER6_HISTCTRL			0x000000c0
++#define SCALER6_HISTBIN0			0x000000c4
++#define SCALER6_HISTBIN1			0x000000c8
++#define SCALER6_HISTBIN2			0x000000cc
++#define SCALER6_HISTBIN3			0x000000d0
++#define SCALER6_HISTBIN4			0x000000d4
++#define SCALER6_HISTBIN5			0x000000d8
++#define SCALER6_HISTBIN6			0x000000dc
++#define SCALER6_HISTBIN7			0x000000e0
++#define SCALER6_HDR_CFG_REMAP			0x000000f4
++#define SCALER6_COL_SPACE			0x000000f8
++#define SCALER6_HVS_ID				0x000000fc
++#define SCALER6_CFC1				0x00000100
++#define SCALER6_DISP_UPM_ISO0			0x00000200
++#define SCALER6_DISP_UPM_ISO1			0x00000204
++#define SCALER6_DISP_UPM_ISO2			0x00000208
++#define SCALER6_DISP_LBM_ISO0			0x0000020c
++#define SCALER6_DISP_LBM_ISO1			0x00000210
++#define SCALER6_DISP_LBM_ISO2			0x00000214
++#define SCALER6_DISP_COB_ISO0			0x00000218
++#define SCALER6_DISP_COB_ISO1			0x0000021c
++#define SCALER6_DISP_COB_ISO2			0x00000220
++#define SCALER6_BAD_COB				0x00000224
++#define SCALER6_BAD_LBM				0x00000228
++#define SCALER6_BAD_UPM				0x0000022c
++#define SCALER6_BAD_AXI				0x00000230
++
+ # define VC4_HDMI_SW_RESET_FORMAT_DETECT	BIT(1)
+ # define VC4_HDMI_SW_RESET_HDMI			BIT(0)
+ 
+@@ -1115,4 +1239,61 @@ enum hvs_pixel_format {
+ #define SCALER_PITCH0_TILE_WIDTH_R_MASK		VC4_MASK(6, 0)
+ #define SCALER_PITCH0_TILE_WIDTH_R_SHIFT	0
+ 
++#define SCALER6_CTL0_END			BIT(31)
++#define SCALER6_CTL0_VALID			BIT(30)
++#define SCALER6_CTL0_NEXT_MASK			VC4_MASK(29, 24)
++#define SCALER6_CTL0_RGB_TRANS			BIT(23)
++#define SCALER6_CTL0_ADDR_MODE_MASK		VC4_MASK(22, 20)
++#define SCALER6_CTL0_ADDR_MODE_LINEAR		0
++#define SCALER6_CTL0_ADDR_MODE_128B		1
++#define SCALER6_CTL0_ADDR_MODE_256B		2
++#define SCALER6_CTL0_ADDR_MODE_MAP8		3
++#define SCALER6_CTL0_ADDR_MODE_UIF		4
++
++#define SCALER6_CTL0_ALPHA_MASK_MASK		VC4_MASK(19, 18)
++#define SCALER6_CTL0_UNITY			BIT(15)
++#define SCALER6_CTL0_ORDERRGBA_MASK		VC4_MASK(14, 13)
++#define SCALER6_CTL0_SCL1_MODE_MASK		VC4_MASK(10, 8)
++#define SCALER6_CTL0_SCL0_MODE_MASK		VC4_MASK(7, 5)
++#define SCALER6_CTL0_PIXEL_FORMAT_MASK		VC4_MASK(4, 0)
++
++#define SCALER6_POS0_START_Y_MASK		VC4_MASK(28, 16)
++#define SCALER6_POS0_HFLIP			BIT(15)
++#define SCALER6_POS0_START_X_MASK		VC4_MASK(12, 0)
++
++#define SCALER6_CTL2_ALPHA_MODE_MASK		VC4_MASK(31, 30)
++#define SCALER6_CTL2_ALPHA_PREMULT		BIT(29)
++#define SCALER6_CTL2_ALPHA_MIX			BIT(28)
++#define SCALER6_CTL2_BFG			BIT(26)
++#define SCALER6_CTL2_CSC_ENABLE			BIT(25)
++#define SCALER6_CTL2_BRCM_CFC_CONTROL_MASK	VC4_MASK(18, 16)
++#define SCALER6_CTL2_ALPHA_MASK			VC4_MASK(15, 4)
++
++#define SCALER6_POS1_SCL_LINES_MASK		VC4_MASK(28, 16)
++#define SCALER6_POS1_SCL_WIDTH_MASK		VC4_MASK(12, 0)
++
++#define SCALER6_POS2_SRC_LINES_MASK		VC4_MASK(28, 16)
++#define SCALER6_POS2_SRC_WIDTH_MASK		VC4_MASK(12, 0)
++
++#define SCALER6_PTR0_VFLIP			BIT(31)
++#define SCALER6_PTR0_UPM_BASE_MASK		VC4_MASK(28, 16)
++#define SCALER6_PTR0_UPM_HANDLE_MASK		VC4_MASK(14, 10)
++#define SCALER6_PTR0_UPM_BUFF_SIZE_MASK		VC4_MASK(9, 8)
++#define SCALER6_PTR0_UPM_BUFF_SIZE_16_LINES	3
++#define SCALER6_PTR0_UPM_BUFF_SIZE_8_LINES	2
++#define SCALER6_PTR0_UPM_BUFF_SIZE_4_LINES	1
++#define SCALER6_PTR0_UPM_BUFF_SIZE_2_LINES	0
++#define SCALER6_PTR0_UPPER_ADDR_MASK		VC4_MASK(7, 0)
++
++#define SCALER6_PTR2_ALPHA_BPP_MASK		VC4_MASK(31, 31)
++#define SCALER6_PTR2_ALPHA_BPP_1BPP		1
++#define SCALER6_PTR2_ALPHA_BPP_8BPP		0
++#define SCALER6_PTR2_ALPHA_ORDER_MASK		VC4_MASK(30, 30)
++#define SCALER6_PTR2_ALPHA_ORDER_MSB_TO_LSB	1
++#define SCALER6_PTR2_ALPHA_ORDER_LSB_TO_MSB	0
++#define SCALER6_PTR2_ALPHA_OFFS_MASK		VC4_MASK(29, 27)
++#define SCALER6_PTR2_LSKIP_MASK			VC4_MASK(26, 24)
++#define SCALER6_PTR2_PITCH_MASK			VC4_MASK(16, 0)
++#define SCALER6_PTR2_FETCH_COUNT_MASK		VC4_MASK(26, 16)
++
+ #endif /* VC4_REGS_H */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0606-drm-vc4-crtc-Add-support-for-BCM2712-PixelValves.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0606-drm-vc4-crtc-Add-support-for-BCM2712-PixelValves.patch
new file mode 100644
index 00000000..72b18ee9
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0606-drm-vc4-crtc-Add-support-for-BCM2712-PixelValves.patch
@@ -0,0 +1,159 @@
+From 1939226dd4ccade4dfba4a9f03dd00d67a8a7a02 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 25 Oct 2024 18:15:42 +0100
+Subject: [PATCH 606/697] drm/vc4: crtc: Add support for BCM2712 PixelValves
+
+The PixelValves found on the BCM2712 are similar to the ones found in
+the previous generation.
+
+Compared to BCM2711:
+- the pixelvalves only drive one HDMI controller each
+- HDMI1 PixelValve has a FIFO long enough to support 4k at 60Hz
+- support has been added for odd horizontal timings whilst at 2pixels/clock
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241025-drm-vc4-2712-support-v2-11-35efa83c8fc0@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c | 49 ++++++++++++++++++++++++++++++++--
+ drivers/gpu/drm/vc4/vc4_drv.h  |  2 ++
+ drivers/gpu/drm/vc4/vc4_regs.h |  6 +++++
+ 3 files changed, 55 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -240,6 +240,11 @@ static u32 vc4_get_fifo_full_level(struc
+ 	const struct vc4_crtc_data *crtc_data = vc4_crtc_to_vc4_crtc_data(vc4_crtc);
+ 	const struct vc4_pv_data *pv_data = vc4_crtc_to_vc4_pv_data(vc4_crtc);
+ 	struct vc4_dev *vc4 = to_vc4_dev(vc4_crtc->base.dev);
++
++	/*
++	 * NOTE: Could we use register 0x68 (PV_HW_CFG1) to get the FIFO
++	 * size?
++	 */
+ 	u32 fifo_len_bytes = pv_data->fifo_depth;
+ 
+ 	/*
+@@ -421,6 +426,7 @@ static void vc4_crtc_config_pv(struct dr
+ 		 */
+ 		CRTC_WRITE(PV_V_CONTROL,
+ 			   PV_VCONTROL_CONTINUOUS |
++			   (vc4->gen >= VC4_GEN_6_C ? PV_VCONTROL_ODD_TIMING : 0) |
+ 			   (is_dsi ? PV_VCONTROL_DSI : 0) |
+ 			   PV_VCONTROL_INTERLACE |
+ 			   (odd_field_first
+@@ -432,6 +438,7 @@ static void vc4_crtc_config_pv(struct dr
+ 	} else {
+ 		CRTC_WRITE(PV_V_CONTROL,
+ 			   PV_VCONTROL_CONTINUOUS |
++			   (vc4->gen >= VC4_GEN_6_C ? PV_VCONTROL_ODD_TIMING : 0) |
+ 			   (is_dsi ? PV_VCONTROL_DSI : 0));
+ 		CRTC_WRITE(PV_VSYNCD_EVEN, 0);
+ 	}
+@@ -446,11 +453,17 @@ static void vc4_crtc_config_pv(struct dr
+ 	if (is_dsi)
+ 		CRTC_WRITE(PV_HACT_ACT, mode->hdisplay * pixel_rep);
+ 
+-	if (vc4->gen == VC4_GEN_5)
++	if (vc4->gen >= VC4_GEN_5)
+ 		CRTC_WRITE(PV_MUX_CFG,
+ 			   VC4_SET_FIELD(PV_MUX_CFG_RGB_PIXEL_MUX_MODE_NO_SWAP,
+ 					 PV_MUX_CFG_RGB_PIXEL_MUX_MODE));
+ 
++	if (vc4->gen >= VC4_GEN_6_C)
++		CRTC_WRITE(PV_PIPE_INIT_CTRL,
++			   VC4_SET_FIELD(1, PV_PIPE_INIT_CTRL_PV_INIT_WIDTH) |
++			   VC4_SET_FIELD(1, PV_PIPE_INIT_CTRL_PV_INIT_IDLE) |
++			   PV_PIPE_INIT_CTRL_PV_INIT_EN);
++
+ 	CRTC_WRITE(PV_CONTROL, PV_CONTROL_FIFO_CLR |
+ 		   vc4_crtc_get_fifo_full_level_bits(vc4_crtc, format) |
+ 		   VC4_SET_FIELD(format, PV_CONTROL_FORMAT) |
+@@ -549,7 +562,11 @@ int vc4_crtc_disable_at_boot(struct drm_
+ 	if (!(of_device_is_compatible(vc4_crtc->pdev->dev.of_node,
+ 				      "brcm,bcm2711-pixelvalve2") ||
+ 	      of_device_is_compatible(vc4_crtc->pdev->dev.of_node,
+-				      "brcm,bcm2711-pixelvalve4")))
++				      "brcm,bcm2711-pixelvalve4") ||
++	      of_device_is_compatible(vc4_crtc->pdev->dev.of_node,
++				      "brcm,bcm2712-pixelvalve0") ||
++	      of_device_is_compatible(vc4_crtc->pdev->dev.of_node,
++				      "brcm,bcm2712-pixelvalve1")))
+ 		return 0;
+ 
+ 	if (!(CRTC_READ(PV_CONTROL) & PV_CONTROL_EN))
+@@ -1292,6 +1309,32 @@ const struct vc4_pv_data bcm2711_pv4_dat
+ 	},
+ };
+ 
++const struct vc4_pv_data bcm2712_pv0_data = {
++	.base = {
++		.debugfs_name = "crtc0_regs",
++		.hvs_available_channels = BIT(0),
++		.hvs_output = 0,
++	},
++	.fifo_depth = 64,
++	.pixels_per_clock = 1,
++	.encoder_types = {
++		[0] = VC4_ENCODER_TYPE_HDMI0,
++	},
++};
++
++const struct vc4_pv_data bcm2712_pv1_data = {
++	.base = {
++		.debugfs_name = "crtc1_regs",
++		.hvs_available_channels = BIT(1),
++		.hvs_output = 1,
++	},
++	.fifo_depth = 64,
++	.pixels_per_clock = 1,
++	.encoder_types = {
++		[0] = VC4_ENCODER_TYPE_HDMI1,
++	},
++};
++
+ static const struct of_device_id vc4_crtc_dt_match[] = {
+ 	{ .compatible = "brcm,bcm2835-pixelvalve0", .data = &bcm2835_pv0_data },
+ 	{ .compatible = "brcm,bcm2835-pixelvalve1", .data = &bcm2835_pv1_data },
+@@ -1301,6 +1344,8 @@ static const struct of_device_id vc4_crt
+ 	{ .compatible = "brcm,bcm2711-pixelvalve2", .data = &bcm2711_pv2_data },
+ 	{ .compatible = "brcm,bcm2711-pixelvalve3", .data = &bcm2711_pv3_data },
+ 	{ .compatible = "brcm,bcm2711-pixelvalve4", .data = &bcm2711_pv4_data },
++	{ .compatible = "brcm,bcm2712-pixelvalve0", .data = &bcm2712_pv0_data },
++	{ .compatible = "brcm,bcm2712-pixelvalve1", .data = &bcm2712_pv1_data },
+ 	{}
+ };
+ 
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -558,6 +558,8 @@ extern const struct vc4_pv_data bcm2711_
+ extern const struct vc4_pv_data bcm2711_pv2_data;
+ extern const struct vc4_pv_data bcm2711_pv3_data;
+ extern const struct vc4_pv_data bcm2711_pv4_data;
++extern const struct vc4_pv_data bcm2712_pv0_data;
++extern const struct vc4_pv_data bcm2712_pv1_data;
+ 
+ struct vc4_crtc {
+ 	struct drm_crtc base;
+--- a/drivers/gpu/drm/vc4/vc4_regs.h
++++ b/drivers/gpu/drm/vc4/vc4_regs.h
+@@ -155,6 +155,7 @@
+ # define PV_CONTROL_EN				BIT(0)
+ 
+ #define PV_V_CONTROL				0x04
++# define PV_VCONTROL_ODD_TIMING			BIT(29)
+ # define PV_VCONTROL_ODD_DELAY_MASK		VC4_MASK(22, 6)
+ # define PV_VCONTROL_ODD_DELAY_SHIFT		6
+ # define PV_VCONTROL_ODD_FIRST			BIT(5)
+@@ -215,6 +216,11 @@
+ # define PV_MUX_CFG_RGB_PIXEL_MUX_MODE_SHIFT	2
+ # define PV_MUX_CFG_RGB_PIXEL_MUX_MODE_NO_SWAP	8
+ 
++#define PV_PIPE_INIT_CTRL			0x94
++# define PV_PIPE_INIT_CTRL_PV_INIT_WIDTH_MASK	VC4_MASK(11, 8)
++# define PV_PIPE_INIT_CTRL_PV_INIT_IDLE_MASK	VC4_MASK(7, 4)
++# define PV_PIPE_INIT_CTRL_PV_INIT_EN		BIT(0)
++
+ #define SCALER_CHANNELS_COUNT			3
+ 
+ #define SCALER_DISPCTRL                         0x00000000
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0607-drm-vc4-hdmi-Add-support-for-BCM2712-HDMI-controller.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0607-drm-vc4-hdmi-Add-support-for-BCM2712-HDMI-controller.patch
new file mode 100644
index 00000000..98acc88b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0607-drm-vc4-hdmi-Add-support-for-BCM2712-HDMI-controller.patch
@@ -0,0 +1,1080 @@
+From d9fd7547ab1f9156f9bd315a884b8d829bb7831d Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 25 Oct 2024 18:15:43 +0100
+Subject: [PATCH 607/697] drm/vc4: hdmi: Add support for BCM2712 HDMI
+ controllers
+
+The HDMI controllers found in the BCM2712 are largely the ones found in
+the BCM2711 with a different PHY.
+
+There's some difference with how timings are split between registers,
+and HDMI1 is now able to run at 4k/60Hz.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241025-drm-vc4-2712-support-v2-12-35efa83c8fc0@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c      |  88 +++-
+ drivers/gpu/drm/vc4/vc4_hdmi.h      |   4 +
+ drivers/gpu/drm/vc4/vc4_hdmi_phy.c  | 640 ++++++++++++++++++++++++++++
+ drivers/gpu/drm/vc4/vc4_hdmi_regs.h | 217 ++++++++++
+ 4 files changed, 943 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -845,6 +845,7 @@ static void vc4_hdmi_encoder_post_crtc_d
+ {
+ 	struct vc4_hdmi *vc4_hdmi = encoder_to_vc4_hdmi(encoder);
+ 	struct drm_device *drm = vc4_hdmi->connector.dev;
++	struct vc4_dev *vc4 = to_vc4_dev(drm);
+ 	unsigned long flags;
+ 	int idx;
+ 
+@@ -861,14 +862,25 @@ static void vc4_hdmi_encoder_post_crtc_d
+ 
+ 	HDMI_WRITE(HDMI_VID_CTL, HDMI_READ(HDMI_VID_CTL) | VC4_HD_VID_CTL_CLRRGB);
+ 
++	if (vc4->gen >= VC4_GEN_6_C)
++		HDMI_WRITE(HDMI_VID_CTL, HDMI_READ(HDMI_VID_CTL) |
++			   VC4_HD_VID_CTL_BLANKPIX);
++
+ 	spin_unlock_irqrestore(&vc4_hdmi->hw_lock, flags);
+ 
+ 	mdelay(1);
+ 
+-	spin_lock_irqsave(&vc4_hdmi->hw_lock, flags);
+-	HDMI_WRITE(HDMI_VID_CTL,
+-		   HDMI_READ(HDMI_VID_CTL) & ~VC4_HD_VID_CTL_ENABLE);
+-	spin_unlock_irqrestore(&vc4_hdmi->hw_lock, flags);
++	/*
++	 * TODO: This should work on BCM2712, but doesn't for some
++	 * reason and result in a system lockup.
++	 */
++	if (vc4->gen < VC4_GEN_6_C) {
++		spin_lock_irqsave(&vc4_hdmi->hw_lock, flags);
++		HDMI_WRITE(HDMI_VID_CTL,
++			   HDMI_READ(HDMI_VID_CTL) &
++			   ~VC4_HD_VID_CTL_ENABLE);
++		spin_unlock_irqrestore(&vc4_hdmi->hw_lock, flags);
++	}
+ 
+ 	vc4_hdmi_disable_scrambling(encoder);
+ 
+@@ -1488,7 +1500,6 @@ static void vc4_hdmi_encoder_pre_crtc_co
+ 		goto err_put_runtime_pm;
+ 	}
+ 
+-
+ 	vc4_hdmi_cec_update_clk_div(vc4_hdmi);
+ 
+ 	if (tmds_char_rate > 297000000)
+@@ -1594,6 +1605,8 @@ static void vc4_hdmi_encoder_post_crtc_e
+ 	spin_lock_irqsave(&vc4_hdmi->hw_lock, flags);
+ 
+ 	HDMI_WRITE(HDMI_VID_CTL,
++		   (HDMI_READ(HDMI_VID_CTL) &
++			~(VC4_HD_VID_CTL_VSYNC_LOW | VC4_HD_VID_CTL_HSYNC_LOW)) |
+ 		   VC4_HD_VID_CTL_ENABLE |
+ 		   VC4_HD_VID_CTL_CLRRGB |
+ 		   VC4_HD_VID_CTL_UNDERFLOW_ENABLE |
+@@ -3121,6 +3134,7 @@ static int vc4_hdmi_runtime_suspend(stru
+ {
+ 	struct vc4_hdmi *vc4_hdmi = dev_get_drvdata(dev);
+ 
++	clk_disable_unprepare(vc4_hdmi->audio_clock);
+ 	clk_disable_unprepare(vc4_hdmi->hsm_clock);
+ 
+ 	return 0;
+@@ -3153,6 +3167,10 @@ static int vc4_hdmi_runtime_resume(struc
+ 		goto err_disable_clk;
+ 	}
+ 
++	ret = clk_prepare_enable(vc4_hdmi->audio_clock);
++	if (ret)
++		goto err_disable_clk;
++
+ 	if (vc4_hdmi->variant->reset)
+ 		vc4_hdmi->variant->reset(vc4_hdmi);
+ 
+@@ -3273,7 +3291,9 @@ static int vc4_hdmi_bind(struct device *
+ 		return ret;
+ 
+ 	if ((of_device_is_compatible(dev->of_node, "brcm,bcm2711-hdmi0") ||
+-	     of_device_is_compatible(dev->of_node, "brcm,bcm2711-hdmi1")) &&
++	     of_device_is_compatible(dev->of_node, "brcm,bcm2711-hdmi1") ||
++	     of_device_is_compatible(dev->of_node, "brcm,bcm2712-hdmi0") ||
++	     of_device_is_compatible(dev->of_node, "brcm,bcm2712-hdmi1")) &&
+ 	    HDMI_READ(HDMI_VID_CTL) & VC4_HD_VID_CTL_ENABLE) {
+ 		clk_prepare_enable(vc4_hdmi->pixel_clock);
+ 		clk_prepare_enable(vc4_hdmi->hsm_clock);
+@@ -3407,10 +3427,66 @@ static const struct vc4_hdmi_variant bcm
+ 	.hp_detect		= vc5_hdmi_hp_detect,
+ };
+ 
++static const struct vc4_hdmi_variant bcm2712_hdmi0_variant = {
++	.encoder_type		= VC4_ENCODER_TYPE_HDMI0,
++	.debugfs_name		= "hdmi0_regs",
++	.card_name		= "vc4-hdmi-0",
++	.max_pixel_clock	= 600000000,
++	.registers		= vc6_hdmi_hdmi0_fields,
++	.num_registers		= ARRAY_SIZE(vc6_hdmi_hdmi0_fields),
++	.phy_lane_mapping	= {
++		PHY_LANE_0,
++		PHY_LANE_1,
++		PHY_LANE_2,
++		PHY_LANE_CK,
++	},
++	.unsupported_odd_h_timings	= false,
++	.external_irq_controller	= true,
++
++	.init_resources		= vc5_hdmi_init_resources,
++	.csc_setup		= vc5_hdmi_csc_setup,
++	.reset			= vc5_hdmi_reset,
++	.set_timings		= vc5_hdmi_set_timings,
++	.phy_init		= vc6_hdmi_phy_init,
++	.phy_disable		= vc6_hdmi_phy_disable,
++	.channel_map		= vc5_hdmi_channel_map,
++	.supports_hdr		= true,
++	.hp_detect		= vc5_hdmi_hp_detect,
++};
++
++static const struct vc4_hdmi_variant bcm2712_hdmi1_variant = {
++	.encoder_type		= VC4_ENCODER_TYPE_HDMI1,
++	.debugfs_name		= "hdmi1_regs",
++	.card_name		= "vc4-hdmi-1",
++	.max_pixel_clock	= 600000000,
++	.registers		= vc6_hdmi_hdmi1_fields,
++	.num_registers		= ARRAY_SIZE(vc6_hdmi_hdmi1_fields),
++	.phy_lane_mapping	= {
++		PHY_LANE_0,
++		PHY_LANE_1,
++		PHY_LANE_2,
++		PHY_LANE_CK,
++	},
++	.unsupported_odd_h_timings	= false,
++	.external_irq_controller	= true,
++
++	.init_resources		= vc5_hdmi_init_resources,
++	.csc_setup		= vc5_hdmi_csc_setup,
++	.reset			= vc5_hdmi_reset,
++	.set_timings		= vc5_hdmi_set_timings,
++	.phy_init		= vc6_hdmi_phy_init,
++	.phy_disable		= vc6_hdmi_phy_disable,
++	.channel_map		= vc5_hdmi_channel_map,
++	.supports_hdr		= true,
++	.hp_detect		= vc5_hdmi_hp_detect,
++};
++
+ static const struct of_device_id vc4_hdmi_dt_match[] = {
+ 	{ .compatible = "brcm,bcm2835-hdmi", .data = &bcm2835_variant },
+ 	{ .compatible = "brcm,bcm2711-hdmi0", .data = &bcm2711_hdmi0_variant },
+ 	{ .compatible = "brcm,bcm2711-hdmi1", .data = &bcm2711_hdmi1_variant },
++	{ .compatible = "brcm,bcm2712-hdmi0", .data = &bcm2712_hdmi0_variant },
++	{ .compatible = "brcm,bcm2712-hdmi1", .data = &bcm2712_hdmi1_variant },
+ 	{}
+ };
+ 
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.h
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.h
+@@ -237,4 +237,8 @@ void vc5_hdmi_phy_disable(struct vc4_hdm
+ void vc5_hdmi_phy_rng_enable(struct vc4_hdmi *vc4_hdmi);
+ void vc5_hdmi_phy_rng_disable(struct vc4_hdmi *vc4_hdmi);
+ 
++void vc6_hdmi_phy_init(struct vc4_hdmi *vc4_hdmi,
++		       struct drm_connector_state *conn_state);
++void vc6_hdmi_phy_disable(struct vc4_hdmi *vc4_hdmi);
++
+ #endif /* _VC4_HDMI_H_ */
+--- a/drivers/gpu/drm/vc4/vc4_hdmi_phy.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi_phy.c
+@@ -125,6 +125,48 @@
+ #define VC4_HDMI_RM_FORMAT_SHIFT_SHIFT			24
+ #define VC4_HDMI_RM_FORMAT_SHIFT_MASK			VC4_MASK(25, 24)
+ 
++#define VC6_HDMI_TX_PHY_HDMI_POWERUP_CTL_BG_PWRUP	BIT(8)
++#define VC6_HDMI_TX_PHY_HDMI_POWERUP_CTL_LDO_PWRUP	BIT(7)
++#define VC6_HDMI_TX_PHY_HDMI_POWERUP_CTL_BIAS_PWRUP	BIT(6)
++#define VC6_HDMI_TX_PHY_HDMI_POWERUP_CTL_RNDGEN_PWRUP	BIT(4)
++#define VC6_HDMI_TX_PHY_HDMI_POWERUP_CTL_TX_CK_PWRUP	BIT(3)
++#define VC6_HDMI_TX_PHY_HDMI_POWERUP_CTL_TX_2_PWRUP	BIT(2)
++#define VC6_HDMI_TX_PHY_HDMI_POWERUP_CTL_TX_1_PWRUP	BIT(1)
++#define VC6_HDMI_TX_PHY_HDMI_POWERUP_CTL_TX_0_PWRUP	BIT(0)
++
++#define VC6_HDMI_TX_PHY_PLL_REFCLK_REFCLK_SEL_CMOS	BIT(13)
++#define VC6_HDMI_TX_PHY_PLL_REFCLK_REFFRQ_MASK		VC4_MASK(9, 0)
++
++#define VC6_HDMI_TX_PHY_PLL_POST_KDIV_CLK0_SEL_MASK	VC4_MASK(3, 2)
++#define VC6_HDMI_TX_PHY_PLL_POST_KDIV_KDIV_MASK		VC4_MASK(1, 0)
++
++#define VC6_HDMI_TX_PHY_PLL_VCOCLK_DIV_VCODIV_EN	BIT(10)
++#define VC6_HDMI_TX_PHY_PLL_VCOCLK_DIV_VCODIV_MASK	VC4_MASK(9, 0)
++
++#define VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_EXT_CURRENT_CTL_MASK	VC4_MASK(31, 28)
++#define VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_FFE_ENABLE_MASK		VC4_MASK(27, 27)
++#define VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_SLEW_RATE_CTL_MASK	VC4_MASK(26, 26)
++#define VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_FFE_POST_TAP_EN_MASK	VC4_MASK(25, 25)
++#define VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_LDMOS_BIAS_CTL_MASK	VC4_MASK(24, 23)
++#define VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_COM_MODE_LDMOS_EN_MASK	VC4_MASK(22, 22)
++#define VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_EDGE_SEL_MASK		VC4_MASK(21, 21)
++#define VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_EXT_CURRENT_SRC_HS_EN_MASK	VC4_MASK(20, 20)
++#define VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_TERM_CTL_MASK		VC4_MASK(19, 18)
++#define VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_EXT_CURRENT_SRC_EN_MASK	VC4_MASK(17, 17)
++#define VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_INT_CURRENT_SRC_EN_MASK	VC4_MASK(16, 16)
++#define VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_INT_CURRENT_CTL_MASK	VC4_MASK(15, 12)
++#define VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_INT_CURRENT_SRC_HS_EN_MASK	VC4_MASK(11, 11)
++#define VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_MAIN_TAP_CURRENT_SELECT_MASK	VC4_MASK(10, 8)
++#define VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_POST_TAP_CURRENT_SELECT_MASK	VC4_MASK(7, 5)
++#define VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_SLEW_CTL_SLOW_LOADING_MASK	VC4_MASK(4, 3)
++#define VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_SLEW_CTL_SLOW_DRIVING_MASK	VC4_MASK(2, 1)
++#define VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_FFE_PRE_TAP_EN_MASK	VC4_MASK(0, 0)
++
++#define VC6_HDMI_TX_PHY_PLL_RESET_CTL_PLL_PLLPOST_RESETB	BIT(1)
++#define VC6_HDMI_TX_PHY_PLL_RESET_CTL_PLL_RESETB	BIT(0)
++
++#define VC6_HDMI_TX_PHY_PLL_POWERUP_CTL_PLL_PWRUP	BIT(0)
++
+ #define OSCILLATOR_FREQUENCY	54000000
+ 
+ void vc4_hdmi_phy_init(struct vc4_hdmi *vc4_hdmi,
+@@ -558,3 +600,601 @@ void vc5_hdmi_phy_rng_disable(struct vc4
+ 		   VC4_HDMI_TX_PHY_POWERDOWN_CTL_RNDGEN_PWRDN);
+ 	spin_unlock_irqrestore(&vc4_hdmi->hw_lock, flags);
+ }
++
++#define VC6_VCO_MIN_FREQ	(8ULL * 1000 * 1000 * 1000)
++#define VC6_VCO_MAX_FREQ	(12ULL * 1000 * 1000 * 1000)
++
++static unsigned long long
++vc6_phy_get_vco_freq(unsigned long long tmds_rate, unsigned int *vco_div)
++{
++	unsigned int min_div;
++	unsigned int max_div;
++	unsigned int div;
++
++	div = 0;
++	while (tmds_rate * div * 10 < VC6_VCO_MIN_FREQ)
++		div++;
++	min_div = div;
++
++	while (tmds_rate * (div + 1) * 10 < VC6_VCO_MAX_FREQ)
++		div++;
++	max_div = div;
++
++	div = min_div + (max_div - min_div) / 2;
++
++	*vco_div = div;
++	return tmds_rate * div * 10;
++}
++
++struct vc6_phy_lane_settings {
++	unsigned int ext_current_ctl:4;
++	unsigned int ffe_enable:1;
++	unsigned int slew_rate_ctl:1;
++	unsigned int ffe_post_tap_en:1;
++	unsigned int ldmos_bias_ctl:2;
++	unsigned int com_mode_ldmos_en:1;
++	unsigned int edge_sel:1;
++	unsigned int ext_current_src_hs_en:1;
++	unsigned int term_ctl:2;
++	unsigned int ext_current_src_en:1;
++	unsigned int int_current_src_en:1;
++	unsigned int int_current_ctl:4;
++	unsigned int int_current_src_hs_en:1;
++	unsigned int main_tap_current_select:3;
++	unsigned int post_tap_current_select:3;
++	unsigned int slew_ctl_slow_loading:2;
++	unsigned int slew_ctl_slow_driving:2;
++	unsigned int ffe_pre_tap_en:1;
++};
++
++struct vc6_phy_settings {
++	unsigned long long min_rate;
++	unsigned long long max_rate;
++	struct vc6_phy_lane_settings channel[3];
++	struct vc6_phy_lane_settings clock;
++};
++
++static const struct vc6_phy_settings vc6_hdmi_phy_settings[] = {
++	{
++		0, 222000000,
++		{
++			{
++				/* 200mA */
++				.ext_current_ctl = 8,
++
++				/* 0.85V */
++				.ldmos_bias_ctl = 1,
++
++				/* Enable External Current Source */
++				.ext_current_src_en = 1,
++
++				/* 200mA */
++				.int_current_ctl = 8,
++
++				/* 17.6 mA */
++				.main_tap_current_select = 7,
++			},
++			{
++				/* 200mA */
++				.ext_current_ctl = 8,
++
++				/* 0.85V */
++				.ldmos_bias_ctl = 1,
++
++				/* Enable External Current Source */
++				.ext_current_src_en = 1,
++
++				/* 200mA */
++				.int_current_ctl = 8,
++
++				/* 17.6 mA */
++				.main_tap_current_select = 7,
++			},
++			{
++				/* 200mA */
++				.ext_current_ctl = 8,
++
++				/* 0.85V */
++				.ldmos_bias_ctl = 1,
++
++				/* Enable External Current Source */
++				.ext_current_src_en = 1,
++
++				/* 200mA */
++				.int_current_ctl = 8,
++
++				/* 17.6 mA */
++				.main_tap_current_select = 7,
++			},
++		},
++		{
++			/* 200mA */
++			.ext_current_ctl = 8,
++
++			/* 0.85V */
++			.ldmos_bias_ctl = 1,
++
++			/* Enable External Current Source */
++			.ext_current_src_en = 1,
++
++			/* 200mA */
++			.int_current_ctl = 8,
++
++			/* 17.6 mA */
++			.main_tap_current_select = 7,
++		},
++	},
++	{
++		222000001, 297000000,
++		{
++			{
++				/* 200mA and 180mA ?! */
++				.ext_current_ctl = 12,
++
++				/* 0.85V */
++				.ldmos_bias_ctl = 1,
++
++				/* 100 Ohm */
++				.term_ctl = 1,
++
++				/* Enable External Current Source */
++				.ext_current_src_en = 1,
++
++				/* Enable Internal Current Source */
++				.int_current_src_en = 1,
++			},
++			{
++				/* 200mA and 180mA ?! */
++				.ext_current_ctl = 12,
++
++				/* 0.85V */
++				.ldmos_bias_ctl = 1,
++
++				/* 100 Ohm */
++				.term_ctl = 1,
++
++				/* Enable External Current Source */
++				.ext_current_src_en = 1,
++
++				/* Enable Internal Current Source */
++				.int_current_src_en = 1,
++			},
++			{
++				/* 200mA and 180mA ?! */
++				.ext_current_ctl = 12,
++
++				/* 0.85V */
++				.ldmos_bias_ctl = 1,
++
++				/* 100 Ohm */
++				.term_ctl = 1,
++
++				/* Enable External Current Source */
++				.ext_current_src_en = 1,
++
++				/* Enable Internal Current Source */
++				.int_current_src_en = 1,
++			},
++		},
++		{
++			/* 200mA and 180mA ?! */
++			.ext_current_ctl = 12,
++
++			/* 0.85V */
++			.ldmos_bias_ctl = 1,
++
++			/* 100 Ohm */
++			.term_ctl = 1,
++
++			/* Enable External Current Source */
++			.ext_current_src_en = 1,
++
++			/* Enable Internal Current Source */
++			.int_current_src_en = 1,
++
++			/* Internal Current Source Half Swing Enable*/
++			.int_current_src_hs_en = 1,
++		},
++	},
++	{
++		297000001, 597000044,
++		{
++			{
++				/* 200mA */
++				.ext_current_ctl = 8,
++
++				/* Normal Slew Rate Control */
++				.slew_rate_ctl = 1,
++
++				/* 0.85V */
++				.ldmos_bias_ctl = 1,
++
++				/* 50 Ohms */
++				.term_ctl = 3,
++
++				/* Enable External Current Source */
++				.ext_current_src_en = 1,
++
++				/* Enable Internal Current Source */
++				.int_current_src_en = 1,
++
++				/* 200mA */
++				.int_current_ctl = 8,
++
++				/* 17.6 mA */
++				.main_tap_current_select = 7,
++			},
++			{
++				/* 200mA */
++				.ext_current_ctl = 8,
++
++				/* Normal Slew Rate Control */
++				.slew_rate_ctl = 1,
++
++				/* 0.85V */
++				.ldmos_bias_ctl = 1,
++
++				/* 50 Ohms */
++				.term_ctl = 3,
++
++				/* Enable External Current Source */
++				.ext_current_src_en = 1,
++
++				/* Enable Internal Current Source */
++				.int_current_src_en = 1,
++
++				/* 200mA */
++				.int_current_ctl = 8,
++
++				/* 17.6 mA */
++				.main_tap_current_select = 7,
++			},
++			{
++				/* 200mA */
++				.ext_current_ctl = 8,
++
++				/* Normal Slew Rate Control */
++				.slew_rate_ctl = 1,
++
++				/* 0.85V */
++				.ldmos_bias_ctl = 1,
++
++				/* 50 Ohms */
++				.term_ctl = 3,
++
++				/* Enable External Current Source */
++				.ext_current_src_en = 1,
++
++				/* Enable Internal Current Source */
++				.int_current_src_en = 1,
++
++				/* 200mA */
++				.int_current_ctl = 8,
++
++				/* 17.6 mA */
++				.main_tap_current_select = 7,
++			},
++		},
++		{
++			/* 200mA */
++			.ext_current_ctl = 8,
++
++			/* Normal Slew Rate Control */
++			.slew_rate_ctl = 1,
++
++			/* 0.85V */
++			.ldmos_bias_ctl = 1,
++
++			/* External Current Source Half Swing Enable*/
++			.ext_current_src_hs_en = 1,
++
++			/* 50 Ohms */
++			.term_ctl = 3,
++
++			/* Enable External Current Source */
++			.ext_current_src_en = 1,
++
++			/* Enable Internal Current Source */
++			.int_current_src_en = 1,
++
++			/* 200mA */
++			.int_current_ctl = 8,
++
++			/* Internal Current Source Half Swing Enable*/
++			.int_current_src_hs_en = 1,
++
++			/* 17.6 mA */
++			.main_tap_current_select = 7,
++		},
++	},
++};
++
++static const struct vc6_phy_settings *
++vc6_phy_get_settings(unsigned long long tmds_rate)
++{
++	unsigned int count = ARRAY_SIZE(vc6_hdmi_phy_settings);
++	unsigned int i;
++
++	for (i = 0; i < count; i++) {
++		const struct vc6_phy_settings *s = &vc6_hdmi_phy_settings[i];
++
++		if (tmds_rate >= s->min_rate && tmds_rate <= s->max_rate)
++			return s;
++	}
++
++	/*
++	 * If the pixel clock exceeds our max setting, try the max
++	 * setting anyway.
++	 */
++	return &vc6_hdmi_phy_settings[count - 1];
++}
++
++static const struct vc6_phy_lane_settings *
++vc6_phy_get_channel_settings(enum vc4_hdmi_phy_channel chan,
++			     unsigned long long tmds_rate)
++{
++	const struct vc6_phy_settings *settings = vc6_phy_get_settings(tmds_rate);
++
++	if (chan == PHY_LANE_CK)
++		return &settings->clock;
++
++	return &settings->channel[chan];
++}
++
++static void vc6_hdmi_reset_phy(struct vc4_hdmi *vc4_hdmi)
++{
++	lockdep_assert_held(&vc4_hdmi->hw_lock);
++
++	HDMI_WRITE(HDMI_TX_PHY_RESET_CTL, 0);
++	HDMI_WRITE(HDMI_TX_PHY_POWERUP_CTL, 0);
++}
++
++void vc6_hdmi_phy_init(struct vc4_hdmi *vc4_hdmi,
++		       struct drm_connector_state *conn_state)
++{
++	const struct vc6_phy_lane_settings *chan0_settings;
++	const struct vc6_phy_lane_settings *chan1_settings;
++	const struct vc6_phy_lane_settings *chan2_settings;
++	const struct vc6_phy_lane_settings *clock_settings;
++	const struct vc4_hdmi_variant *variant = vc4_hdmi->variant;
++	unsigned long long pixel_freq = conn_state->hdmi.tmds_char_rate;
++	unsigned long long vco_freq;
++	unsigned char word_sel;
++	unsigned long flags;
++	unsigned int vco_div;
++
++	vco_freq = vc6_phy_get_vco_freq(pixel_freq, &vco_div);
++
++	spin_lock_irqsave(&vc4_hdmi->hw_lock, flags);
++
++	vc6_hdmi_reset_phy(vc4_hdmi);
++
++	HDMI_WRITE(HDMI_TX_PHY_PLL_MISC_0, 0x810c6000);
++	HDMI_WRITE(HDMI_TX_PHY_PLL_MISC_1, 0x00b8c451);
++	HDMI_WRITE(HDMI_TX_PHY_PLL_MISC_2, 0x46402e31);
++	HDMI_WRITE(HDMI_TX_PHY_PLL_MISC_3, 0x00b8c005);
++	HDMI_WRITE(HDMI_TX_PHY_PLL_MISC_4, 0x42410261);
++	HDMI_WRITE(HDMI_TX_PHY_PLL_MISC_5, 0xcc021001);
++	HDMI_WRITE(HDMI_TX_PHY_PLL_MISC_6, 0xc8301c80);
++	HDMI_WRITE(HDMI_TX_PHY_PLL_MISC_7, 0xb0804444);
++	HDMI_WRITE(HDMI_TX_PHY_PLL_MISC_8, 0xf80f8000);
++
++	HDMI_WRITE(HDMI_TX_PHY_PLL_REFCLK,
++		   VC6_HDMI_TX_PHY_PLL_REFCLK_REFCLK_SEL_CMOS |
++		   VC4_SET_FIELD(54, VC6_HDMI_TX_PHY_PLL_REFCLK_REFFRQ));
++
++	HDMI_WRITE(HDMI_TX_PHY_RESET_CTL, 0x7f);
++
++	HDMI_WRITE(HDMI_RM_OFFSET,
++		   VC4_HDMI_RM_OFFSET_ONLY |
++		   VC4_SET_FIELD(phy_get_rm_offset(vco_freq),
++				 VC4_HDMI_RM_OFFSET_OFFSET));
++
++	HDMI_WRITE(HDMI_TX_PHY_PLL_VCOCLK_DIV,
++		   VC6_HDMI_TX_PHY_PLL_VCOCLK_DIV_VCODIV_EN |
++		   VC4_SET_FIELD(vco_div,
++				 VC6_HDMI_TX_PHY_PLL_VCOCLK_DIV_VCODIV));
++
++	HDMI_WRITE(HDMI_TX_PHY_PLL_CFG,
++		   VC4_SET_FIELD(0, VC4_HDMI_TX_PHY_PLL_CFG_PDIV));
++
++	HDMI_WRITE(HDMI_TX_PHY_PLL_POST_KDIV,
++		   VC4_SET_FIELD(2, VC6_HDMI_TX_PHY_PLL_POST_KDIV_CLK0_SEL) |
++		   VC4_SET_FIELD(1, VC6_HDMI_TX_PHY_PLL_POST_KDIV_KDIV));
++
++	chan0_settings =
++		vc6_phy_get_channel_settings(variant->phy_lane_mapping[PHY_LANE_0],
++					     pixel_freq);
++	HDMI_WRITE(HDMI_TX_PHY_CTL_0,
++		   VC4_SET_FIELD(chan0_settings->ext_current_ctl,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_EXT_CURRENT_CTL) |
++		   VC4_SET_FIELD(chan0_settings->ffe_enable,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_FFE_ENABLE) |
++		   VC4_SET_FIELD(chan0_settings->slew_rate_ctl,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_SLEW_RATE_CTL) |
++		   VC4_SET_FIELD(chan0_settings->ffe_post_tap_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_FFE_POST_TAP_EN) |
++		   VC4_SET_FIELD(chan0_settings->ldmos_bias_ctl,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_LDMOS_BIAS_CTL) |
++		   VC4_SET_FIELD(chan0_settings->com_mode_ldmos_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_COM_MODE_LDMOS_EN) |
++		   VC4_SET_FIELD(chan0_settings->edge_sel,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_EDGE_SEL) |
++		   VC4_SET_FIELD(chan0_settings->ext_current_src_hs_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_EXT_CURRENT_SRC_HS_EN) |
++		   VC4_SET_FIELD(chan0_settings->term_ctl,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_TERM_CTL) |
++		   VC4_SET_FIELD(chan0_settings->ext_current_src_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_EXT_CURRENT_SRC_EN) |
++		   VC4_SET_FIELD(chan0_settings->int_current_src_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_INT_CURRENT_SRC_EN) |
++		   VC4_SET_FIELD(chan0_settings->int_current_ctl,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_INT_CURRENT_CTL) |
++		   VC4_SET_FIELD(chan0_settings->int_current_src_hs_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_INT_CURRENT_SRC_HS_EN) |
++		   VC4_SET_FIELD(chan0_settings->main_tap_current_select,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_MAIN_TAP_CURRENT_SELECT) |
++		   VC4_SET_FIELD(chan0_settings->post_tap_current_select,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_POST_TAP_CURRENT_SELECT) |
++		   VC4_SET_FIELD(chan0_settings->slew_ctl_slow_loading,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_SLEW_CTL_SLOW_LOADING) |
++		   VC4_SET_FIELD(chan0_settings->slew_ctl_slow_driving,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_SLEW_CTL_SLOW_DRIVING) |
++		   VC4_SET_FIELD(chan0_settings->ffe_pre_tap_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_FFE_PRE_TAP_EN));
++
++	chan1_settings =
++		vc6_phy_get_channel_settings(variant->phy_lane_mapping[PHY_LANE_1],
++					     pixel_freq);
++	HDMI_WRITE(HDMI_TX_PHY_CTL_1,
++		   VC4_SET_FIELD(chan1_settings->ext_current_ctl,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_EXT_CURRENT_CTL) |
++		   VC4_SET_FIELD(chan1_settings->ffe_enable,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_FFE_ENABLE) |
++		   VC4_SET_FIELD(chan1_settings->slew_rate_ctl,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_SLEW_RATE_CTL) |
++		   VC4_SET_FIELD(chan1_settings->ffe_post_tap_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_FFE_POST_TAP_EN) |
++		   VC4_SET_FIELD(chan1_settings->ldmos_bias_ctl,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_LDMOS_BIAS_CTL) |
++		   VC4_SET_FIELD(chan1_settings->com_mode_ldmos_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_COM_MODE_LDMOS_EN) |
++		   VC4_SET_FIELD(chan1_settings->edge_sel,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_EDGE_SEL) |
++		   VC4_SET_FIELD(chan1_settings->ext_current_src_hs_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_EXT_CURRENT_SRC_HS_EN) |
++		   VC4_SET_FIELD(chan1_settings->term_ctl,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_TERM_CTL) |
++		   VC4_SET_FIELD(chan1_settings->ext_current_src_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_EXT_CURRENT_SRC_EN) |
++		   VC4_SET_FIELD(chan1_settings->int_current_src_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_INT_CURRENT_SRC_EN) |
++		   VC4_SET_FIELD(chan1_settings->int_current_ctl,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_INT_CURRENT_CTL) |
++		   VC4_SET_FIELD(chan1_settings->int_current_src_hs_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_INT_CURRENT_SRC_HS_EN) |
++		   VC4_SET_FIELD(chan1_settings->main_tap_current_select,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_MAIN_TAP_CURRENT_SELECT) |
++		   VC4_SET_FIELD(chan1_settings->post_tap_current_select,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_POST_TAP_CURRENT_SELECT) |
++		   VC4_SET_FIELD(chan1_settings->slew_ctl_slow_loading,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_SLEW_CTL_SLOW_LOADING) |
++		   VC4_SET_FIELD(chan1_settings->slew_ctl_slow_driving,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_SLEW_CTL_SLOW_DRIVING) |
++		   VC4_SET_FIELD(chan1_settings->ffe_pre_tap_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_FFE_PRE_TAP_EN));
++
++	chan2_settings =
++		vc6_phy_get_channel_settings(variant->phy_lane_mapping[PHY_LANE_2],
++					     pixel_freq);
++	HDMI_WRITE(HDMI_TX_PHY_CTL_2,
++		   VC4_SET_FIELD(chan2_settings->ext_current_ctl,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_EXT_CURRENT_CTL) |
++		   VC4_SET_FIELD(chan2_settings->ffe_enable,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_FFE_ENABLE) |
++		   VC4_SET_FIELD(chan2_settings->slew_rate_ctl,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_SLEW_RATE_CTL) |
++		   VC4_SET_FIELD(chan2_settings->ffe_post_tap_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_FFE_POST_TAP_EN) |
++		   VC4_SET_FIELD(chan2_settings->ldmos_bias_ctl,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_LDMOS_BIAS_CTL) |
++		   VC4_SET_FIELD(chan2_settings->com_mode_ldmos_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_COM_MODE_LDMOS_EN) |
++		   VC4_SET_FIELD(chan2_settings->edge_sel,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_EDGE_SEL) |
++		   VC4_SET_FIELD(chan2_settings->ext_current_src_hs_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_EXT_CURRENT_SRC_HS_EN) |
++		   VC4_SET_FIELD(chan2_settings->term_ctl,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_TERM_CTL) |
++		   VC4_SET_FIELD(chan2_settings->ext_current_src_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_EXT_CURRENT_SRC_EN) |
++		   VC4_SET_FIELD(chan2_settings->int_current_src_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_INT_CURRENT_SRC_EN) |
++		   VC4_SET_FIELD(chan2_settings->int_current_ctl,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_INT_CURRENT_CTL) |
++		   VC4_SET_FIELD(chan2_settings->int_current_src_hs_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_INT_CURRENT_SRC_HS_EN) |
++		   VC4_SET_FIELD(chan2_settings->main_tap_current_select,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_MAIN_TAP_CURRENT_SELECT) |
++		   VC4_SET_FIELD(chan2_settings->post_tap_current_select,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_POST_TAP_CURRENT_SELECT) |
++		   VC4_SET_FIELD(chan2_settings->slew_ctl_slow_loading,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_SLEW_CTL_SLOW_LOADING) |
++		   VC4_SET_FIELD(chan2_settings->slew_ctl_slow_driving,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_SLEW_CTL_SLOW_DRIVING) |
++		   VC4_SET_FIELD(chan2_settings->ffe_pre_tap_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_FFE_PRE_TAP_EN));
++
++	clock_settings =
++		vc6_phy_get_channel_settings(variant->phy_lane_mapping[PHY_LANE_CK],
++					     pixel_freq);
++	HDMI_WRITE(HDMI_TX_PHY_CTL_CK,
++		   VC4_SET_FIELD(clock_settings->ext_current_ctl,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_EXT_CURRENT_CTL) |
++		   VC4_SET_FIELD(clock_settings->ffe_enable,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_FFE_ENABLE) |
++		   VC4_SET_FIELD(clock_settings->slew_rate_ctl,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_SLEW_RATE_CTL) |
++		   VC4_SET_FIELD(clock_settings->ffe_post_tap_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_FFE_POST_TAP_EN) |
++		   VC4_SET_FIELD(clock_settings->ldmos_bias_ctl,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_LDMOS_BIAS_CTL) |
++		   VC4_SET_FIELD(clock_settings->com_mode_ldmos_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_COM_MODE_LDMOS_EN) |
++		   VC4_SET_FIELD(clock_settings->edge_sel,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_EDGE_SEL) |
++		   VC4_SET_FIELD(clock_settings->ext_current_src_hs_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_EXT_CURRENT_SRC_HS_EN) |
++		   VC4_SET_FIELD(clock_settings->term_ctl,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_TERM_CTL) |
++		   VC4_SET_FIELD(clock_settings->ext_current_src_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_EXT_CURRENT_SRC_EN) |
++		   VC4_SET_FIELD(clock_settings->int_current_src_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_INT_CURRENT_SRC_EN) |
++		   VC4_SET_FIELD(clock_settings->int_current_ctl,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_INT_CURRENT_CTL) |
++		   VC4_SET_FIELD(clock_settings->int_current_src_hs_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_INT_CURRENT_SRC_HS_EN) |
++		   VC4_SET_FIELD(clock_settings->main_tap_current_select,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_MAIN_TAP_CURRENT_SELECT) |
++		   VC4_SET_FIELD(clock_settings->post_tap_current_select,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_POST_TAP_CURRENT_SELECT) |
++		   VC4_SET_FIELD(clock_settings->slew_ctl_slow_loading,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_SLEW_CTL_SLOW_LOADING) |
++		   VC4_SET_FIELD(clock_settings->slew_ctl_slow_driving,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_SLEW_CTL_SLOW_DRIVING) |
++		   VC4_SET_FIELD(clock_settings->ffe_pre_tap_en,
++				 VC6_HDMI_TX_PHY_HDMI_CTRL_CHX_FFE_PRE_TAP_EN));
++
++	if (pixel_freq >= 340000000)
++		word_sel = 3;
++	else
++		word_sel = 0;
++	HDMI_WRITE(HDMI_TX_PHY_TMDS_CLK_WORD_SEL, word_sel);
++
++	HDMI_WRITE(HDMI_TX_PHY_POWERUP_CTL,
++		   VC6_HDMI_TX_PHY_HDMI_POWERUP_CTL_BG_PWRUP |
++		   VC6_HDMI_TX_PHY_HDMI_POWERUP_CTL_LDO_PWRUP |
++		   VC6_HDMI_TX_PHY_HDMI_POWERUP_CTL_BIAS_PWRUP |
++		   VC6_HDMI_TX_PHY_HDMI_POWERUP_CTL_TX_CK_PWRUP |
++		   VC6_HDMI_TX_PHY_HDMI_POWERUP_CTL_TX_2_PWRUP |
++		   VC6_HDMI_TX_PHY_HDMI_POWERUP_CTL_TX_1_PWRUP |
++		   VC6_HDMI_TX_PHY_HDMI_POWERUP_CTL_TX_0_PWRUP);
++
++	HDMI_WRITE(HDMI_TX_PHY_PLL_POWERUP_CTL,
++		   VC6_HDMI_TX_PHY_PLL_POWERUP_CTL_PLL_PWRUP);
++
++	HDMI_WRITE(HDMI_TX_PHY_PLL_RESET_CTL,
++		   HDMI_READ(HDMI_TX_PHY_PLL_RESET_CTL) &
++		   ~VC6_HDMI_TX_PHY_PLL_RESET_CTL_PLL_RESETB);
++
++	HDMI_WRITE(HDMI_TX_PHY_PLL_RESET_CTL,
++		   HDMI_READ(HDMI_TX_PHY_PLL_RESET_CTL) |
++		   VC6_HDMI_TX_PHY_PLL_RESET_CTL_PLL_RESETB);
++
++	spin_unlock_irqrestore(&vc4_hdmi->hw_lock, flags);
++}
++
++void vc6_hdmi_phy_disable(struct vc4_hdmi *vc4_hdmi)
++{
++}
+--- a/drivers/gpu/drm/vc4/vc4_hdmi_regs.h
++++ b/drivers/gpu/drm/vc4/vc4_hdmi_regs.h
+@@ -111,13 +111,30 @@ enum vc4_hdmi_field {
+ 	HDMI_TX_PHY_CTL_1,
+ 	HDMI_TX_PHY_CTL_2,
+ 	HDMI_TX_PHY_CTL_3,
++	HDMI_TX_PHY_CTL_CK,
+ 	HDMI_TX_PHY_PLL_CALIBRATION_CONFIG_1,
+ 	HDMI_TX_PHY_PLL_CALIBRATION_CONFIG_2,
+ 	HDMI_TX_PHY_PLL_CALIBRATION_CONFIG_4,
+ 	HDMI_TX_PHY_PLL_CFG,
++	HDMI_TX_PHY_PLL_CFG_PDIV,
+ 	HDMI_TX_PHY_PLL_CTL_0,
+ 	HDMI_TX_PHY_PLL_CTL_1,
++	HDMI_TX_PHY_PLL_MISC_0,
++	HDMI_TX_PHY_PLL_MISC_1,
++	HDMI_TX_PHY_PLL_MISC_2,
++	HDMI_TX_PHY_PLL_MISC_3,
++	HDMI_TX_PHY_PLL_MISC_4,
++	HDMI_TX_PHY_PLL_MISC_5,
++	HDMI_TX_PHY_PLL_MISC_6,
++	HDMI_TX_PHY_PLL_MISC_7,
++	HDMI_TX_PHY_PLL_MISC_8,
++	HDMI_TX_PHY_PLL_POST_KDIV,
++	HDMI_TX_PHY_PLL_POWERUP_CTL,
++	HDMI_TX_PHY_PLL_REFCLK,
++	HDMI_TX_PHY_PLL_RESET_CTL,
++	HDMI_TX_PHY_PLL_VCOCLK_DIV,
+ 	HDMI_TX_PHY_POWERDOWN_CTL,
++	HDMI_TX_PHY_POWERUP_CTL,
+ 	HDMI_TX_PHY_RESET_CTL,
+ 	HDMI_TX_PHY_TMDS_CLK_WORD_SEL,
+ 	HDMI_VEC_INTERFACE_CFG,
+@@ -383,6 +400,206 @@ static const struct vc4_hdmi_register __
+ 
+ 	VC5_RM_REG(HDMI_RM_CONTROL, 0x000),
+ 	VC5_RM_REG(HDMI_RM_OFFSET, 0x018),
++	VC5_RM_REG(HDMI_RM_FORMAT, 0x01c),
++
++	VC5_RAM_REG(HDMI_RAM_PACKET_START, 0x000),
++
++	VC5_CEC_REG(HDMI_CEC_CNTRL_1, 0x010),
++	VC5_CEC_REG(HDMI_CEC_CNTRL_2, 0x014),
++	VC5_CEC_REG(HDMI_CEC_CNTRL_3, 0x018),
++	VC5_CEC_REG(HDMI_CEC_CNTRL_4, 0x01c),
++	VC5_CEC_REG(HDMI_CEC_CNTRL_5, 0x020),
++	VC5_CEC_REG(HDMI_CEC_TX_DATA_1, 0x028),
++	VC5_CEC_REG(HDMI_CEC_TX_DATA_2, 0x02c),
++	VC5_CEC_REG(HDMI_CEC_TX_DATA_3, 0x030),
++	VC5_CEC_REG(HDMI_CEC_TX_DATA_4, 0x034),
++	VC5_CEC_REG(HDMI_CEC_RX_DATA_1, 0x038),
++	VC5_CEC_REG(HDMI_CEC_RX_DATA_2, 0x03c),
++	VC5_CEC_REG(HDMI_CEC_RX_DATA_3, 0x040),
++	VC5_CEC_REG(HDMI_CEC_RX_DATA_4, 0x044),
++
++	VC5_CSC_REG(HDMI_CSC_CTL, 0x000),
++	VC5_CSC_REG(HDMI_CSC_12_11, 0x004),
++	VC5_CSC_REG(HDMI_CSC_14_13, 0x008),
++	VC5_CSC_REG(HDMI_CSC_22_21, 0x00c),
++	VC5_CSC_REG(HDMI_CSC_24_23, 0x010),
++	VC5_CSC_REG(HDMI_CSC_32_31, 0x014),
++	VC5_CSC_REG(HDMI_CSC_34_33, 0x018),
++	VC5_CSC_REG(HDMI_CSC_CHANNEL_CTL, 0x02c),
++};
++
++static const struct vc4_hdmi_register __maybe_unused vc6_hdmi_hdmi0_fields[] = {
++	VC4_HD_REG(HDMI_DVP_CTL, 0x0000),
++	VC4_HD_REG(HDMI_MAI_CTL, 0x0010),
++	VC4_HD_REG(HDMI_MAI_THR, 0x0014),
++	VC4_HD_REG(HDMI_MAI_FMT, 0x0018),
++	VC4_HD_REG(HDMI_MAI_DATA, 0x001c),
++	VC4_HD_REG(HDMI_MAI_SMP, 0x0020),
++	VC4_HD_REG(HDMI_VID_CTL, 0x0044),
++	VC4_HD_REG(HDMI_FRAME_COUNT, 0x0060),
++
++	VC4_HDMI_REG(HDMI_FIFO_CTL, 0x07c),
++	VC4_HDMI_REG(HDMI_AUDIO_PACKET_CONFIG, 0x0c0),
++	VC4_HDMI_REG(HDMI_RAM_PACKET_CONFIG, 0x0c4),
++	VC4_HDMI_REG(HDMI_RAM_PACKET_STATUS, 0x0cc),
++	VC4_HDMI_REG(HDMI_CRP_CFG, 0x0d0),
++	VC4_HDMI_REG(HDMI_CTS_0, 0x0d4),
++	VC4_HDMI_REG(HDMI_CTS_1, 0x0d8),
++	VC4_HDMI_REG(HDMI_SCHEDULER_CONTROL, 0x0e8),
++	VC4_HDMI_REG(HDMI_HORZA, 0x0ec),
++	VC4_HDMI_REG(HDMI_HORZB, 0x0f0),
++	VC4_HDMI_REG(HDMI_VERTA0, 0x0f4),
++	VC4_HDMI_REG(HDMI_VERTB0, 0x0f8),
++	VC4_HDMI_REG(HDMI_VERTA1, 0x100),
++	VC4_HDMI_REG(HDMI_VERTB1, 0x104),
++	VC4_HDMI_REG(HDMI_MISC_CONTROL, 0x114),
++	VC4_HDMI_REG(HDMI_MAI_CHANNEL_MAP, 0x0a4),
++	VC4_HDMI_REG(HDMI_MAI_CONFIG, 0x0a8),
++	VC4_HDMI_REG(HDMI_FORMAT_DET_1, 0x148),
++	VC4_HDMI_REG(HDMI_FORMAT_DET_2, 0x14c),
++	VC4_HDMI_REG(HDMI_FORMAT_DET_3, 0x150),
++	VC4_HDMI_REG(HDMI_FORMAT_DET_4, 0x158),
++	VC4_HDMI_REG(HDMI_FORMAT_DET_5, 0x15c),
++	VC4_HDMI_REG(HDMI_FORMAT_DET_6, 0x160),
++	VC4_HDMI_REG(HDMI_FORMAT_DET_7, 0x164),
++	VC4_HDMI_REG(HDMI_FORMAT_DET_8, 0x168),
++	VC4_HDMI_REG(HDMI_FORMAT_DET_9, 0x16c),
++	VC4_HDMI_REG(HDMI_FORMAT_DET_10, 0x170),
++	VC4_HDMI_REG(HDMI_DEEP_COLOR_CONFIG_1, 0x18c),
++	VC4_HDMI_REG(HDMI_GCP_CONFIG, 0x194),
++	VC4_HDMI_REG(HDMI_GCP_WORD_1, 0x198),
++	VC4_HDMI_REG(HDMI_HOTPLUG, 0x1c8),
++	VC4_HDMI_REG(HDMI_SCRAMBLER_CTL, 0x1e4),
++
++	VC5_DVP_REG(HDMI_CLOCK_STOP, 0x0bc),
++	VC5_DVP_REG(HDMI_VEC_INTERFACE_CFG, 0x0f0),
++	VC5_DVP_REG(HDMI_VEC_INTERFACE_XBAR, 0x0f4),
++
++	VC5_PHY_REG(HDMI_TX_PHY_RESET_CTL, 0x000),
++	VC5_PHY_REG(HDMI_TX_PHY_POWERUP_CTL, 0x004),
++	VC5_PHY_REG(HDMI_TX_PHY_CTL_0, 0x008),
++	VC5_PHY_REG(HDMI_TX_PHY_CTL_1, 0x00c),
++	VC5_PHY_REG(HDMI_TX_PHY_CTL_2, 0x010),
++	VC5_PHY_REG(HDMI_TX_PHY_CTL_CK, 0x014),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_REFCLK, 0x01c),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_POST_KDIV, 0x028),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_VCOCLK_DIV, 0x02c),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_CFG, 0x044),
++	VC5_PHY_REG(HDMI_TX_PHY_TMDS_CLK_WORD_SEL, 0x054),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_MISC_0, 0x060),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_MISC_1, 0x064),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_MISC_2, 0x068),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_MISC_3, 0x06c),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_MISC_4, 0x070),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_MISC_5, 0x074),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_MISC_6, 0x078),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_MISC_7, 0x07c),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_MISC_8, 0x080),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_RESET_CTL, 0x190),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_POWERUP_CTL, 0x194),
++
++	VC5_RM_REG(HDMI_RM_CONTROL, 0x000),
++	VC5_RM_REG(HDMI_RM_OFFSET, 0x018),
++	VC5_RM_REG(HDMI_RM_FORMAT, 0x01c),
++
++	VC5_RAM_REG(HDMI_RAM_PACKET_START, 0x000),
++
++	VC5_CEC_REG(HDMI_CEC_CNTRL_1, 0x010),
++	VC5_CEC_REG(HDMI_CEC_CNTRL_2, 0x014),
++	VC5_CEC_REG(HDMI_CEC_CNTRL_3, 0x018),
++	VC5_CEC_REG(HDMI_CEC_CNTRL_4, 0x01c),
++	VC5_CEC_REG(HDMI_CEC_CNTRL_5, 0x020),
++	VC5_CEC_REG(HDMI_CEC_TX_DATA_1, 0x028),
++	VC5_CEC_REG(HDMI_CEC_TX_DATA_2, 0x02c),
++	VC5_CEC_REG(HDMI_CEC_TX_DATA_3, 0x030),
++	VC5_CEC_REG(HDMI_CEC_TX_DATA_4, 0x034),
++	VC5_CEC_REG(HDMI_CEC_RX_DATA_1, 0x038),
++	VC5_CEC_REG(HDMI_CEC_RX_DATA_2, 0x03c),
++	VC5_CEC_REG(HDMI_CEC_RX_DATA_3, 0x040),
++	VC5_CEC_REG(HDMI_CEC_RX_DATA_4, 0x044),
++
++	VC5_CSC_REG(HDMI_CSC_CTL, 0x000),
++	VC5_CSC_REG(HDMI_CSC_12_11, 0x004),
++	VC5_CSC_REG(HDMI_CSC_14_13, 0x008),
++	VC5_CSC_REG(HDMI_CSC_22_21, 0x00c),
++	VC5_CSC_REG(HDMI_CSC_24_23, 0x010),
++	VC5_CSC_REG(HDMI_CSC_32_31, 0x014),
++	VC5_CSC_REG(HDMI_CSC_34_33, 0x018),
++	VC5_CSC_REG(HDMI_CSC_CHANNEL_CTL, 0x02c),
++};
++
++static const struct vc4_hdmi_register __maybe_unused vc6_hdmi_hdmi1_fields[] = {
++	VC4_HD_REG(HDMI_DVP_CTL, 0x0000),
++	VC4_HD_REG(HDMI_MAI_CTL, 0x0030),
++	VC4_HD_REG(HDMI_MAI_THR, 0x0034),
++	VC4_HD_REG(HDMI_MAI_FMT, 0x0038),
++	VC4_HD_REG(HDMI_MAI_DATA, 0x003c),
++	VC4_HD_REG(HDMI_MAI_SMP, 0x0040),
++	VC4_HD_REG(HDMI_VID_CTL, 0x0048),
++	VC4_HD_REG(HDMI_FRAME_COUNT, 0x0064),
++
++	VC4_HDMI_REG(HDMI_FIFO_CTL, 0x07c),
++	VC4_HDMI_REG(HDMI_AUDIO_PACKET_CONFIG, 0x0c0),
++	VC4_HDMI_REG(HDMI_RAM_PACKET_CONFIG, 0x0c4),
++	VC4_HDMI_REG(HDMI_RAM_PACKET_STATUS, 0x0cc),
++	VC4_HDMI_REG(HDMI_CRP_CFG, 0x0d0),
++	VC4_HDMI_REG(HDMI_CTS_0, 0x0d4),
++	VC4_HDMI_REG(HDMI_CTS_1, 0x0d8),
++	VC4_HDMI_REG(HDMI_SCHEDULER_CONTROL, 0x0e8),
++	VC4_HDMI_REG(HDMI_HORZA, 0x0ec),
++	VC4_HDMI_REG(HDMI_HORZB, 0x0f0),
++	VC4_HDMI_REG(HDMI_VERTA0, 0x0f4),
++	VC4_HDMI_REG(HDMI_VERTB0, 0x0f8),
++	VC4_HDMI_REG(HDMI_VERTA1, 0x100),
++	VC4_HDMI_REG(HDMI_VERTB1, 0x104),
++	VC4_HDMI_REG(HDMI_MISC_CONTROL, 0x114),
++	VC4_HDMI_REG(HDMI_MAI_CHANNEL_MAP, 0x0a4),
++	VC4_HDMI_REG(HDMI_MAI_CONFIG, 0x0a8),
++	VC4_HDMI_REG(HDMI_FORMAT_DET_1, 0x148),
++	VC4_HDMI_REG(HDMI_FORMAT_DET_2, 0x14c),
++	VC4_HDMI_REG(HDMI_FORMAT_DET_3, 0x150),
++	VC4_HDMI_REG(HDMI_FORMAT_DET_4, 0x158),
++	VC4_HDMI_REG(HDMI_FORMAT_DET_5, 0x15c),
++	VC4_HDMI_REG(HDMI_FORMAT_DET_6, 0x160),
++	VC4_HDMI_REG(HDMI_FORMAT_DET_7, 0x164),
++	VC4_HDMI_REG(HDMI_FORMAT_DET_8, 0x168),
++	VC4_HDMI_REG(HDMI_FORMAT_DET_9, 0x16c),
++	VC4_HDMI_REG(HDMI_FORMAT_DET_10, 0x170),
++	VC4_HDMI_REG(HDMI_DEEP_COLOR_CONFIG_1, 0x18c),
++	VC4_HDMI_REG(HDMI_GCP_CONFIG, 0x194),
++	VC4_HDMI_REG(HDMI_GCP_WORD_1, 0x198),
++	VC4_HDMI_REG(HDMI_HOTPLUG, 0x1c8),
++	VC4_HDMI_REG(HDMI_SCRAMBLER_CTL, 0x1e4),
++
++	VC5_DVP_REG(HDMI_CLOCK_STOP, 0x0bc),
++	VC5_DVP_REG(HDMI_VEC_INTERFACE_CFG, 0x0f0),
++	VC5_DVP_REG(HDMI_VEC_INTERFACE_XBAR, 0x0f4),
++
++	VC5_PHY_REG(HDMI_TX_PHY_RESET_CTL, 0x000),
++	VC5_PHY_REG(HDMI_TX_PHY_POWERUP_CTL, 0x004),
++	VC5_PHY_REG(HDMI_TX_PHY_CTL_0, 0x008),
++	VC5_PHY_REG(HDMI_TX_PHY_CTL_1, 0x00c),
++	VC5_PHY_REG(HDMI_TX_PHY_CTL_2, 0x010),
++	VC5_PHY_REG(HDMI_TX_PHY_CTL_CK, 0x014),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_REFCLK, 0x01c),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_POST_KDIV, 0x028),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_VCOCLK_DIV, 0x02c),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_CFG, 0x044),
++	VC5_PHY_REG(HDMI_TX_PHY_TMDS_CLK_WORD_SEL, 0x054),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_MISC_0, 0x060),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_MISC_1, 0x064),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_MISC_2, 0x068),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_MISC_3, 0x06c),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_MISC_4, 0x070),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_MISC_5, 0x074),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_MISC_6, 0x078),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_MISC_7, 0x07c),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_MISC_8, 0x080),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_RESET_CTL, 0x190),
++	VC5_PHY_REG(HDMI_TX_PHY_PLL_POWERUP_CTL, 0x194),
++
++	VC5_RM_REG(HDMI_RM_CONTROL, 0x000),
++	VC5_RM_REG(HDMI_RM_OFFSET, 0x018),
+ 	VC5_RM_REG(HDMI_RM_FORMAT, 0x01c),
+ 
+ 	VC5_RAM_REG(HDMI_RAM_PACKET_START, 0x000),
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0608-drm-vc4-txp-Introduce-structure-to-deal-with-revisio.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0608-drm-vc4-txp-Introduce-structure-to-deal-with-revisio.patch
new file mode 100644
index 00000000..8a7f6c5c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0608-drm-vc4-txp-Introduce-structure-to-deal-with-revisio.patch
@@ -0,0 +1,119 @@
+From d5d827e1cef04bf554e8cca8e9c704d0d8fa2561 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 25 Oct 2024 18:15:44 +0100
+Subject: [PATCH 608/697] drm/vc4: txp: Introduce structure to deal with
+ revision differences
+
+The BCM2712 will have several TXP with small differences. Let's add a
+structure tied to the compatible to deal with those differences.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241025-drm-vc4-2712-support-v2-13-35efa83c8fc0@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/tests/vc4_mock.c |  4 ++--
+ drivers/gpu/drm/vc4/vc4_drv.h        |  6 +++++-
+ drivers/gpu/drm/vc4/vc4_txp.c        | 23 ++++++++++++++++-------
+ 3 files changed, 23 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/tests/vc4_mock.c
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock.c
+@@ -51,7 +51,7 @@ struct vc4_mock_desc {
+ 
+ static const struct vc4_mock_desc vc4_mock =
+ 	VC4_MOCK_DESC(
+-		VC4_MOCK_CRTC_DESC(&vc4_txp_crtc_data,
++		VC4_MOCK_CRTC_DESC(&vc4_txp_data.base,
+ 				   VC4_MOCK_OUTPUT_DESC(VC4_ENCODER_TYPE_TXP,
+ 							DRM_MODE_ENCODER_VIRTUAL,
+ 							DRM_MODE_CONNECTOR_WRITEBACK)),
+@@ -77,7 +77,7 @@ static const struct vc4_mock_desc vc4_mo
+ 
+ static const struct vc4_mock_desc vc5_mock =
+ 	VC4_MOCK_DESC(
+-		VC4_MOCK_CRTC_DESC(&vc4_txp_crtc_data,
++		VC4_MOCK_CRTC_DESC(&vc4_txp_data.base,
+ 				   VC4_MOCK_OUTPUT_DESC(VC4_ENCODER_TYPE_TXP,
+ 							DRM_MODE_ENCODER_VIRTUAL,
+ 							DRM_MODE_CONNECTOR_WRITEBACK)),
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -536,7 +536,11 @@ struct vc4_crtc_data {
+ 	int hvs_output;
+ };
+ 
+-extern const struct vc4_crtc_data vc4_txp_crtc_data;
++struct vc4_txp_data {
++	struct vc4_crtc_data	base;
++};
++
++extern const struct vc4_txp_data vc4_txp_data;
+ 
+ struct vc4_pv_data {
+ 	struct vc4_crtc_data	base;
+--- a/drivers/gpu/drm/vc4/vc4_txp.c
++++ b/drivers/gpu/drm/vc4/vc4_txp.c
+@@ -159,6 +159,7 @@
+ 
+ struct vc4_txp {
+ 	struct vc4_crtc	base;
++	const struct vc4_txp_data *data;
+ 
+ 	struct platform_device *pdev;
+ 
+@@ -484,17 +485,20 @@ static irqreturn_t vc4_txp_interrupt(int
+ 	return IRQ_HANDLED;
+ }
+ 
+-const struct vc4_crtc_data vc4_txp_crtc_data = {
+-	.name = "txp",
+-	.debugfs_name = "txp_regs",
+-	.hvs_available_channels = BIT(2),
+-	.hvs_output = 2,
++const struct vc4_txp_data vc4_txp_data = {
++	.base = {
++		.name = "txp",
++		.debugfs_name = "txp_regs",
++		.hvs_available_channels = BIT(2),
++		.hvs_output = 2,
++	},
+ };
+ 
+ static int vc4_txp_bind(struct device *dev, struct device *master, void *data)
+ {
+ 	struct platform_device *pdev = to_platform_device(dev);
+ 	struct drm_device *drm = dev_get_drvdata(master);
++	const struct vc4_txp_data *txp_data;
+ 	struct vc4_encoder *vc4_encoder;
+ 	struct drm_encoder *encoder;
+ 	struct vc4_crtc *vc4_crtc;
+@@ -509,6 +513,11 @@ static int vc4_txp_bind(struct device *d
+ 	if (!txp)
+ 		return -ENOMEM;
+ 
++	txp_data = of_device_get_match_data(dev);
++	if (!txp_data)
++		return -ENODEV;
++
++	txp->data = txp_data;
+ 	txp->pdev = pdev;
+ 	txp->regs = vc4_ioremap_regs(pdev, 0);
+ 	if (IS_ERR(txp->regs))
+@@ -519,7 +528,7 @@ static int vc4_txp_bind(struct device *d
+ 	vc4_crtc->regset.regs = txp_regs;
+ 	vc4_crtc->regset.nregs = ARRAY_SIZE(txp_regs);
+ 
+-	ret = vc4_crtc_init(drm, pdev, vc4_crtc, &vc4_txp_crtc_data,
++	ret = vc4_crtc_init(drm, pdev, vc4_crtc, &txp_data->base,
+ 			    &vc4_txp_crtc_funcs, &vc4_txp_crtc_helper_funcs, true);
+ 	if (ret)
+ 		return ret;
+@@ -579,7 +588,7 @@ static void vc4_txp_remove(struct platfo
+ }
+ 
+ static const struct of_device_id vc4_txp_dt_match[] = {
+-	{ .compatible = "brcm,bcm2835-txp" },
++	{ .compatible = "brcm,bcm2835-txp", .data = &vc4_txp_data },
+ 	{ /* sentinel */ },
+ };
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0609-drm-vc4-txp-Rename-TXP-data-structure.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0609-drm-vc4-txp-Rename-TXP-data-structure.patch
new file mode 100644
index 00000000..81e10263
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0609-drm-vc4-txp-Rename-TXP-data-structure.patch
@@ -0,0 +1,68 @@
+From 6ebc6d155b41fe1067b9ef98e48ed918ac4c1246 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 25 Oct 2024 18:15:45 +0100
+Subject: [PATCH 609/697] drm/vc4: txp: Rename TXP data structure
+
+The TXP data structure has a name too generic for the multiple variants
+we'll have to support. Let's rename it to mention the SoC it applies to.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241025-drm-vc4-2712-support-v2-14-35efa83c8fc0@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/tests/vc4_mock.c | 4 ++--
+ drivers/gpu/drm/vc4/vc4_drv.h        | 2 +-
+ drivers/gpu/drm/vc4/vc4_txp.c        | 4 ++--
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/tests/vc4_mock.c
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock.c
+@@ -51,7 +51,7 @@ struct vc4_mock_desc {
+ 
+ static const struct vc4_mock_desc vc4_mock =
+ 	VC4_MOCK_DESC(
+-		VC4_MOCK_CRTC_DESC(&vc4_txp_data.base,
++		VC4_MOCK_CRTC_DESC(&bcm2835_txp_data.base,
+ 				   VC4_MOCK_OUTPUT_DESC(VC4_ENCODER_TYPE_TXP,
+ 							DRM_MODE_ENCODER_VIRTUAL,
+ 							DRM_MODE_CONNECTOR_WRITEBACK)),
+@@ -77,7 +77,7 @@ static const struct vc4_mock_desc vc4_mo
+ 
+ static const struct vc4_mock_desc vc5_mock =
+ 	VC4_MOCK_DESC(
+-		VC4_MOCK_CRTC_DESC(&vc4_txp_data.base,
++		VC4_MOCK_CRTC_DESC(&bcm2835_txp_data.base,
+ 				   VC4_MOCK_OUTPUT_DESC(VC4_ENCODER_TYPE_TXP,
+ 							DRM_MODE_ENCODER_VIRTUAL,
+ 							DRM_MODE_CONNECTOR_WRITEBACK)),
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -540,7 +540,7 @@ struct vc4_txp_data {
+ 	struct vc4_crtc_data	base;
+ };
+ 
+-extern const struct vc4_txp_data vc4_txp_data;
++extern const struct vc4_txp_data bcm2835_txp_data;
+ 
+ struct vc4_pv_data {
+ 	struct vc4_crtc_data	base;
+--- a/drivers/gpu/drm/vc4/vc4_txp.c
++++ b/drivers/gpu/drm/vc4/vc4_txp.c
+@@ -485,7 +485,7 @@ static irqreturn_t vc4_txp_interrupt(int
+ 	return IRQ_HANDLED;
+ }
+ 
+-const struct vc4_txp_data vc4_txp_data = {
++const struct vc4_txp_data bcm2835_txp_data = {
+ 	.base = {
+ 		.name = "txp",
+ 		.debugfs_name = "txp_regs",
+@@ -588,7 +588,7 @@ static void vc4_txp_remove(struct platfo
+ }
+ 
+ static const struct of_device_id vc4_txp_dt_match[] = {
+-	{ .compatible = "brcm,bcm2835-txp", .data = &vc4_txp_data },
++	{ .compatible = "brcm,bcm2835-txp", .data = &bcm2835_txp_data },
+ 	{ /* sentinel */ },
+ };
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0610-drm-vc4-txp-Add-byte-enable-toggle-bit.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0610-drm-vc4-txp-Add-byte-enable-toggle-bit.patch
new file mode 100644
index 00000000..eda257fb
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0610-drm-vc4-txp-Add-byte-enable-toggle-bit.patch
@@ -0,0 +1,58 @@
+From 27d445432c32974eca2701da84039fc2418d532e Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 25 Oct 2024 18:15:46 +0100
+Subject: [PATCH 610/697] drm/vc4: txp: Add byte enable toggle bit
+
+The MOPLET doesn't have the BYTE_ENABLE field to set, but the TXP and
+MOP do, so let's add a boolean to control whether or not we need to set
+it.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241025-drm-vc4-2712-support-v2-15-35efa83c8fc0@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_drv.h | 1 +
+ drivers/gpu/drm/vc4/vc4_txp.c | 6 +++++-
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -538,6 +538,7 @@ struct vc4_crtc_data {
+ 
+ struct vc4_txp_data {
+ 	struct vc4_crtc_data	base;
++	unsigned int has_byte_enable:1;
+ };
+ 
+ extern const struct vc4_txp_data bcm2835_txp_data;
+--- a/drivers/gpu/drm/vc4/vc4_txp.c
++++ b/drivers/gpu/drm/vc4/vc4_txp.c
+@@ -287,6 +287,7 @@ static void vc4_txp_connector_atomic_com
+ 	struct drm_connector_state *conn_state = drm_atomic_get_new_connector_state(state,
+ 										    conn);
+ 	struct vc4_txp *txp = connector_to_vc4_txp(conn);
++	const struct vc4_txp_data *txp_data = txp->data;
+ 	struct drm_gem_dma_object *gem;
+ 	struct drm_display_mode *mode;
+ 	struct drm_framebuffer *fb;
+@@ -309,9 +310,11 @@ static void vc4_txp_connector_atomic_com
+ 		return;
+ 
+ 	ctrl = TXP_GO | TXP_EI |
+-	       VC4_SET_FIELD(0xf, TXP_BYTE_ENABLE) |
+ 	       VC4_SET_FIELD(txp_fmts[i], TXP_FORMAT);
+ 
++	if (txp_data->has_byte_enable)
++		ctrl |= VC4_SET_FIELD(0xf, TXP_BYTE_ENABLE);
++
+ 	if (fb->format->has_alpha)
+ 		ctrl |= TXP_ALPHA_ENABLE;
+ 	else
+@@ -492,6 +495,7 @@ const struct vc4_txp_data bcm2835_txp_da
+ 		.hvs_available_channels = BIT(2),
+ 		.hvs_output = 2,
+ 	},
++	.has_byte_enable = true,
+ };
+ 
+ static int vc4_txp_bind(struct device *dev, struct device *master, void *data)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0611-drm-vc4-txp-Add-horizontal-and-vertical-size-offset-.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0611-drm-vc4-txp-Add-horizontal-and-vertical-size-offset-.patch
new file mode 100644
index 00000000..8fec53b2
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0611-drm-vc4-txp-Add-horizontal-and-vertical-size-offset-.patch
@@ -0,0 +1,61 @@
+From d53a9815355f7a69248bb860abdec6885366fc86 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 25 Oct 2024 18:15:47 +0100
+Subject: [PATCH 611/697] drm/vc4: txp: Add horizontal and vertical size offset
+ toggle bit
+
+The new writeback controllers that can be found on the BCM2712 require
+to have their horizontal and vertical size reduced by one.
+
+Let's tie that behaviour to the compatible so we can support both the
+new and old controllers.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241025-drm-vc4-2712-support-v2-16-35efa83c8fc0@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_drv.h |  1 +
+ drivers/gpu/drm/vc4/vc4_txp.c | 14 ++++++++++++--
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -539,6 +539,7 @@ struct vc4_crtc_data {
+ struct vc4_txp_data {
+ 	struct vc4_crtc_data	base;
+ 	unsigned int has_byte_enable:1;
++	unsigned int size_minus_one:1;
+ };
+ 
+ extern const struct vc4_txp_data bcm2835_txp_data;
+--- a/drivers/gpu/drm/vc4/vc4_txp.c
++++ b/drivers/gpu/drm/vc4/vc4_txp.c
+@@ -291,6 +291,8 @@ static void vc4_txp_connector_atomic_com
+ 	struct drm_gem_dma_object *gem;
+ 	struct drm_display_mode *mode;
+ 	struct drm_framebuffer *fb;
++	unsigned int hdisplay;
++	unsigned int vdisplay;
+ 	u32 ctrl;
+ 	int idx;
+ 	int i;
+@@ -330,9 +332,17 @@ static void vc4_txp_connector_atomic_com
+ 	gem = drm_fb_dma_get_gem_obj(fb, 0);
+ 	TXP_WRITE(TXP_DST_PTR, gem->dma_addr + fb->offsets[0]);
+ 	TXP_WRITE(TXP_DST_PITCH, fb->pitches[0]);
++
++	hdisplay = mode->hdisplay ?: 1;
++	vdisplay = mode->vdisplay ?: 1;
++	if (txp_data->size_minus_one) {
++		hdisplay -= 1;
++		vdisplay -= 1;
++	}
++
+ 	TXP_WRITE(TXP_DIM,
+-		  VC4_SET_FIELD(mode->hdisplay, TXP_WIDTH) |
+-		  VC4_SET_FIELD(mode->vdisplay, TXP_HEIGHT));
++		  VC4_SET_FIELD(hdisplay, TXP_WIDTH) |
++		  VC4_SET_FIELD(vdisplay, TXP_HEIGHT));
+ 
+ 	TXP_WRITE(TXP_DST_CTRL, ctrl);
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0612-drm-vc4-txp-Handle-40-bits-DMA-Addresses.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0612-drm-vc4-txp-Handle-40-bits-DMA-Addresses.patch
new file mode 100644
index 00000000..49db4f41
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0612-drm-vc4-txp-Handle-40-bits-DMA-Addresses.patch
@@ -0,0 +1,66 @@
+From 5ac6d61aff0177fed13c76dd9c6762a35edcdf26 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 25 Oct 2024 18:15:48 +0100
+Subject: [PATCH 612/697] drm/vc4: txp: Handle 40-bits DMA Addresses
+
+The BCM2712 MOP and MOPLET can handle addresses larger than 32bits
+through an extra register. We can easily support it and make it
+conditional based on the compatible through a boolean in our variant
+structure.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241025-drm-vc4-2712-support-v2-17-35efa83c8fc0@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_drv.h |  2 ++
+ drivers/gpu/drm/vc4/vc4_txp.c | 12 +++++++++++-
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -538,8 +538,10 @@ struct vc4_crtc_data {
+ 
+ struct vc4_txp_data {
+ 	struct vc4_crtc_data	base;
++	unsigned int high_addr_ptr_reg;
+ 	unsigned int has_byte_enable:1;
+ 	unsigned int size_minus_one:1;
++	unsigned int supports_40bit_addresses:1;
+ };
+ 
+ extern const struct vc4_txp_data bcm2835_txp_data;
+--- a/drivers/gpu/drm/vc4/vc4_txp.c
++++ b/drivers/gpu/drm/vc4/vc4_txp.c
+@@ -145,6 +145,9 @@
+ /* Number of lines received and committed to memory. */
+ #define TXP_PROGRESS		0x10
+ 
++#define TXP_DST_PTR_HIGH_MOPLET	0x1c
++#define TXP_DST_PTR_HIGH_MOP	0x24
++
+ #define TXP_READ(offset)								\
+ 	({										\
+ 		kunit_fail_current_test("Accessing a register in a unit test!\n");	\
+@@ -293,6 +296,7 @@ static void vc4_txp_connector_atomic_com
+ 	struct drm_framebuffer *fb;
+ 	unsigned int hdisplay;
+ 	unsigned int vdisplay;
++	dma_addr_t addr;
+ 	u32 ctrl;
+ 	int idx;
+ 	int i;
+@@ -330,7 +334,13 @@ static void vc4_txp_connector_atomic_com
+ 		return;
+ 
+ 	gem = drm_fb_dma_get_gem_obj(fb, 0);
+-	TXP_WRITE(TXP_DST_PTR, gem->dma_addr + fb->offsets[0]);
++	addr = gem->dma_addr + fb->offsets[0];
++
++	TXP_WRITE(TXP_DST_PTR, lower_32_bits(addr));
++
++	if (txp_data->supports_40bit_addresses)
++		TXP_WRITE(txp_data->high_addr_ptr_reg, upper_32_bits(addr) & 0xff);
++
+ 	TXP_WRITE(TXP_DST_PITCH, fb->pitches[0]);
+ 
+ 	hdisplay = mode->hdisplay ?: 1;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0613-drm-vc4-txp-Move-the-encoder-type-in-the-variant-str.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0613-drm-vc4-txp-Move-the-encoder-type-in-the-variant-str.patch
new file mode 100644
index 00000000..b935eaae
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0613-drm-vc4-txp-Move-the-encoder-type-in-the-variant-str.patch
@@ -0,0 +1,47 @@
+From f66c375af067a09b234e3979ae9b1607cd2f40f5 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 25 Oct 2024 18:15:49 +0100
+Subject: [PATCH 613/697] drm/vc4: txp: Move the encoder type in the variant
+ structure
+
+We'll have multiple TXP instances in the BCM2712, so we can't use a
+single encoder type anymore. Let's tie the encoder type to the
+compatible.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241025-drm-vc4-2712-support-v2-18-35efa83c8fc0@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_drv.h | 1 +
+ drivers/gpu/drm/vc4/vc4_txp.c | 3 ++-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -538,6 +538,7 @@ struct vc4_crtc_data {
+ 
+ struct vc4_txp_data {
+ 	struct vc4_crtc_data	base;
++	enum vc4_encoder_type encoder_type;
+ 	unsigned int high_addr_ptr_reg;
+ 	unsigned int has_byte_enable:1;
+ 	unsigned int size_minus_one:1;
+--- a/drivers/gpu/drm/vc4/vc4_txp.c
++++ b/drivers/gpu/drm/vc4/vc4_txp.c
+@@ -515,6 +515,7 @@ const struct vc4_txp_data bcm2835_txp_da
+ 		.hvs_available_channels = BIT(2),
+ 		.hvs_output = 2,
+ 	},
++	.encoder_type = VC4_ENCODER_TYPE_TXP,
+ 	.has_byte_enable = true,
+ };
+ 
+@@ -558,7 +559,7 @@ static int vc4_txp_bind(struct device *d
+ 		return ret;
+ 
+ 	vc4_encoder = &txp->encoder;
+-	txp->encoder.type = VC4_ENCODER_TYPE_TXP;
++	txp->encoder.type = txp_data->encoder_type;
+ 
+ 	encoder = &vc4_encoder->base;
+ 	encoder->possible_crtcs = drm_crtc_mask(&vc4_crtc->base);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0614-drm-vc4-txp-Add-a-new-TXP-encoder-type.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0614-drm-vc4-txp-Add-a-new-TXP-encoder-type.patch
new file mode 100644
index 00000000..36cfecee
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0614-drm-vc4-txp-Add-a-new-TXP-encoder-type.patch
@@ -0,0 +1,477 @@
+From 1315aecbf5b0243227b6c96624b047893250a7c1 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 25 Oct 2024 18:15:50 +0100
+Subject: [PATCH 614/697] drm/vc4: txp: Add a new TXP encoder type
+
+Starting with BCM2712, we'll have a two TXP. Let's follow the HDMI
+example and add two encoder types for TXP: TXP0 and TXP1.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241025-drm-vc4-2712-support-v2-19-35efa83c8fc0@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/tests/vc4_mock.c          |   4 +-
+ .../gpu/drm/vc4/tests/vc4_test_pv_muxing.c    | 106 +++++++++---------
+ drivers/gpu/drm/vc4/vc4_drv.h                 |   3 +-
+ drivers/gpu/drm/vc4/vc4_kms.c                 |   2 +-
+ drivers/gpu/drm/vc4/vc4_txp.c                 |   2 +-
+ 5 files changed, 59 insertions(+), 58 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/tests/vc4_mock.c
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock.c
+@@ -52,7 +52,7 @@ struct vc4_mock_desc {
+ static const struct vc4_mock_desc vc4_mock =
+ 	VC4_MOCK_DESC(
+ 		VC4_MOCK_CRTC_DESC(&bcm2835_txp_data.base,
+-				   VC4_MOCK_OUTPUT_DESC(VC4_ENCODER_TYPE_TXP,
++				   VC4_MOCK_OUTPUT_DESC(VC4_ENCODER_TYPE_TXP0,
+ 							DRM_MODE_ENCODER_VIRTUAL,
+ 							DRM_MODE_CONNECTOR_WRITEBACK)),
+ 		VC4_MOCK_PIXELVALVE_DESC(&bcm2835_pv0_data,
+@@ -78,7 +78,7 @@ static const struct vc4_mock_desc vc4_mo
+ static const struct vc4_mock_desc vc5_mock =
+ 	VC4_MOCK_DESC(
+ 		VC4_MOCK_CRTC_DESC(&bcm2835_txp_data.base,
+-				   VC4_MOCK_OUTPUT_DESC(VC4_ENCODER_TYPE_TXP,
++				   VC4_MOCK_OUTPUT_DESC(VC4_ENCODER_TYPE_TXP0,
+ 							DRM_MODE_ENCODER_VIRTUAL,
+ 							DRM_MODE_CONNECTOR_WRITEBACK)),
+ 		VC4_MOCK_PIXELVALVE_DESC(&bcm2711_pv0_data,
+--- a/drivers/gpu/drm/vc4/tests/vc4_test_pv_muxing.c
++++ b/drivers/gpu/drm/vc4/tests/vc4_test_pv_muxing.c
+@@ -90,7 +90,7 @@ static const struct encoder_constraint v
+ 	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_DSI0, 0),
+ 	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_HDMI0, 1),
+ 	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_VEC, 1),
+-	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_TXP, 2),
++	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_TXP0, 2),
+ 	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_DSI1, 2),
+ };
+ 
+@@ -98,7 +98,7 @@ static const struct encoder_constraint v
+ 	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_DPI, 0),
+ 	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_DSI0, 0),
+ 	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_VEC, 1),
+-	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_TXP, 0, 2),
++	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_TXP0, 0, 2),
+ 	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_DSI1, 0, 1, 2),
+ 	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_HDMI0, 0, 1, 2),
+ 	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_HDMI1, 0, 1, 2),
+@@ -207,7 +207,7 @@ static const struct pv_muxing_param vc4_
+ 	VC4_PV_MUXING_TEST("1 output: DSI1",
+ 			   VC4_ENCODER_TYPE_DSI1),
+ 	VC4_PV_MUXING_TEST("1 output: TXP",
+-			   VC4_ENCODER_TYPE_TXP),
++			   VC4_ENCODER_TYPE_TXP0),
+ 	VC4_PV_MUXING_TEST("2 outputs: DSI0, HDMI0",
+ 			   VC4_ENCODER_TYPE_DSI0,
+ 			   VC4_ENCODER_TYPE_HDMI0),
+@@ -219,7 +219,7 @@ static const struct pv_muxing_param vc4_
+ 			   VC4_ENCODER_TYPE_DSI1),
+ 	VC4_PV_MUXING_TEST("2 outputs: DSI0, TXP",
+ 			   VC4_ENCODER_TYPE_DSI0,
+-			   VC4_ENCODER_TYPE_TXP),
++			   VC4_ENCODER_TYPE_TXP0),
+ 	VC4_PV_MUXING_TEST("2 outputs: DPI, HDMI0",
+ 			   VC4_ENCODER_TYPE_DPI,
+ 			   VC4_ENCODER_TYPE_HDMI0),
+@@ -231,19 +231,19 @@ static const struct pv_muxing_param vc4_
+ 			   VC4_ENCODER_TYPE_DSI1),
+ 	VC4_PV_MUXING_TEST("2 outputs: DPI, TXP",
+ 			   VC4_ENCODER_TYPE_DPI,
+-			   VC4_ENCODER_TYPE_TXP),
++			   VC4_ENCODER_TYPE_TXP0),
+ 	VC4_PV_MUXING_TEST("2 outputs: HDMI0, DSI1",
+ 			   VC4_ENCODER_TYPE_HDMI0,
+ 			   VC4_ENCODER_TYPE_DSI1),
+ 	VC4_PV_MUXING_TEST("2 outputs: HDMI0, TXP",
+ 			   VC4_ENCODER_TYPE_HDMI0,
+-			   VC4_ENCODER_TYPE_TXP),
++			   VC4_ENCODER_TYPE_TXP0),
+ 	VC4_PV_MUXING_TEST("2 outputs: VEC, DSI1",
+ 			   VC4_ENCODER_TYPE_VEC,
+ 			   VC4_ENCODER_TYPE_DSI1),
+ 	VC4_PV_MUXING_TEST("2 outputs: VEC, TXP",
+ 			   VC4_ENCODER_TYPE_VEC,
+-			   VC4_ENCODER_TYPE_TXP),
++			   VC4_ENCODER_TYPE_TXP0),
+ 	VC4_PV_MUXING_TEST("3 outputs: DSI0, HDMI0, DSI1",
+ 			   VC4_ENCODER_TYPE_DSI0,
+ 			   VC4_ENCODER_TYPE_HDMI0,
+@@ -251,7 +251,7 @@ static const struct pv_muxing_param vc4_
+ 	VC4_PV_MUXING_TEST("3 outputs: DSI0, HDMI0, TXP",
+ 			   VC4_ENCODER_TYPE_DSI0,
+ 			   VC4_ENCODER_TYPE_HDMI0,
+-			   VC4_ENCODER_TYPE_TXP),
++			   VC4_ENCODER_TYPE_TXP0),
+ 	VC4_PV_MUXING_TEST("3 outputs: DSI0, VEC, DSI1",
+ 			   VC4_ENCODER_TYPE_DSI0,
+ 			   VC4_ENCODER_TYPE_VEC,
+@@ -259,7 +259,7 @@ static const struct pv_muxing_param vc4_
+ 	VC4_PV_MUXING_TEST("3 outputs: DSI0, VEC, TXP",
+ 			   VC4_ENCODER_TYPE_DSI0,
+ 			   VC4_ENCODER_TYPE_VEC,
+-			   VC4_ENCODER_TYPE_TXP),
++			   VC4_ENCODER_TYPE_TXP0),
+ 	VC4_PV_MUXING_TEST("3 outputs: DPI, HDMI0, DSI1",
+ 			   VC4_ENCODER_TYPE_DPI,
+ 			   VC4_ENCODER_TYPE_HDMI0,
+@@ -267,7 +267,7 @@ static const struct pv_muxing_param vc4_
+ 	VC4_PV_MUXING_TEST("3 outputs: DPI, HDMI0, TXP",
+ 			   VC4_ENCODER_TYPE_DPI,
+ 			   VC4_ENCODER_TYPE_HDMI0,
+-			   VC4_ENCODER_TYPE_TXP),
++			   VC4_ENCODER_TYPE_TXP0),
+ 	VC4_PV_MUXING_TEST("3 outputs: DPI, VEC, DSI1",
+ 			   VC4_ENCODER_TYPE_DPI,
+ 			   VC4_ENCODER_TYPE_VEC,
+@@ -275,7 +275,7 @@ static const struct pv_muxing_param vc4_
+ 	VC4_PV_MUXING_TEST("3 outputs: DPI, VEC, TXP",
+ 			   VC4_ENCODER_TYPE_DPI,
+ 			   VC4_ENCODER_TYPE_VEC,
+-			   VC4_ENCODER_TYPE_TXP),
++			   VC4_ENCODER_TYPE_TXP0),
+ };
+ 
+ KUNIT_ARRAY_PARAM(vc4_test_pv_muxing,
+@@ -287,7 +287,7 @@ static const struct pv_muxing_param vc4_
+ 			   VC4_ENCODER_TYPE_DPI,
+ 			   VC4_ENCODER_TYPE_DSI0),
+ 	VC4_PV_MUXING_TEST("TXP/DSI1 Conflict",
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_DSI1),
+ 	VC4_PV_MUXING_TEST("HDMI0/VEC Conflict",
+ 			   VC4_ENCODER_TYPE_HDMI0,
+@@ -296,22 +296,22 @@ static const struct pv_muxing_param vc4_
+ 			   VC4_ENCODER_TYPE_DSI0,
+ 			   VC4_ENCODER_TYPE_HDMI0,
+ 			   VC4_ENCODER_TYPE_DSI1,
+-			   VC4_ENCODER_TYPE_TXP),
++			   VC4_ENCODER_TYPE_TXP0),
+ 	VC4_PV_MUXING_TEST("More than 3 outputs: DSI0, VEC, DSI1, TXP",
+ 			   VC4_ENCODER_TYPE_DSI0,
+ 			   VC4_ENCODER_TYPE_VEC,
+ 			   VC4_ENCODER_TYPE_DSI1,
+-			   VC4_ENCODER_TYPE_TXP),
++			   VC4_ENCODER_TYPE_TXP0),
+ 	VC4_PV_MUXING_TEST("More than 3 outputs: DPI, HDMI0, DSI1, TXP",
+ 			   VC4_ENCODER_TYPE_DPI,
+ 			   VC4_ENCODER_TYPE_HDMI0,
+ 			   VC4_ENCODER_TYPE_DSI1,
+-			   VC4_ENCODER_TYPE_TXP),
++			   VC4_ENCODER_TYPE_TXP0),
+ 	VC4_PV_MUXING_TEST("More than 3 outputs: DPI, VEC, DSI1, TXP",
+ 			   VC4_ENCODER_TYPE_DPI,
+ 			   VC4_ENCODER_TYPE_VEC,
+ 			   VC4_ENCODER_TYPE_DSI1,
+-			   VC4_ENCODER_TYPE_TXP),
++			   VC4_ENCODER_TYPE_TXP0),
+ };
+ 
+ KUNIT_ARRAY_PARAM(vc4_test_pv_muxing_invalid,
+@@ -342,7 +342,7 @@ static const struct pv_muxing_param vc5_
+ 			   VC4_ENCODER_TYPE_HDMI1),
+ 	VC5_PV_MUXING_TEST("2 outputs: DPI, TXP",
+ 			   VC4_ENCODER_TYPE_DPI,
+-			   VC4_ENCODER_TYPE_TXP),
++			   VC4_ENCODER_TYPE_TXP0),
+ 	VC5_PV_MUXING_TEST("2 outputs: DPI, VEC",
+ 			   VC4_ENCODER_TYPE_DPI,
+ 			   VC4_ENCODER_TYPE_VEC),
+@@ -360,7 +360,7 @@ static const struct pv_muxing_param vc5_
+ 			   VC4_ENCODER_TYPE_HDMI1),
+ 	VC5_PV_MUXING_TEST("2 outputs: DSI0, TXP",
+ 			   VC4_ENCODER_TYPE_DSI0,
+-			   VC4_ENCODER_TYPE_TXP),
++			   VC4_ENCODER_TYPE_TXP0),
+ 	VC5_PV_MUXING_TEST("2 outputs: DSI0, VEC",
+ 			   VC4_ENCODER_TYPE_DSI0,
+ 			   VC4_ENCODER_TYPE_VEC),
+@@ -372,7 +372,7 @@ static const struct pv_muxing_param vc5_
+ 			   VC4_ENCODER_TYPE_VEC),
+ 	VC5_PV_MUXING_TEST("2 outputs: DSI1, TXP",
+ 			   VC4_ENCODER_TYPE_DSI1,
+-			   VC4_ENCODER_TYPE_TXP),
++			   VC4_ENCODER_TYPE_TXP0),
+ 	VC5_PV_MUXING_TEST("2 outputs: DSI1, HDMI0",
+ 			   VC4_ENCODER_TYPE_DSI1,
+ 			   VC4_ENCODER_TYPE_HDMI0),
+@@ -384,7 +384,7 @@ static const struct pv_muxing_param vc5_
+ 			   VC4_ENCODER_TYPE_VEC),
+ 	VC5_PV_MUXING_TEST("2 outputs: HDMI0, TXP",
+ 			   VC4_ENCODER_TYPE_HDMI0,
+-			   VC4_ENCODER_TYPE_TXP),
++			   VC4_ENCODER_TYPE_TXP0),
+ 	VC5_PV_MUXING_TEST("2 outputs: HDMI0, HDMI1",
+ 			   VC4_ENCODER_TYPE_HDMI0,
+ 			   VC4_ENCODER_TYPE_HDMI1),
+@@ -393,14 +393,14 @@ static const struct pv_muxing_param vc5_
+ 			   VC4_ENCODER_TYPE_VEC),
+ 	VC5_PV_MUXING_TEST("2 outputs: HDMI1, TXP",
+ 			   VC4_ENCODER_TYPE_HDMI1,
+-			   VC4_ENCODER_TYPE_TXP),
++			   VC4_ENCODER_TYPE_TXP0),
+ 	VC5_PV_MUXING_TEST("2 outputs: TXP, VEC",
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_VEC),
+ 	VC5_PV_MUXING_TEST("3 outputs: DPI, VEC, TXP",
+ 			   VC4_ENCODER_TYPE_DPI,
+ 			   VC4_ENCODER_TYPE_VEC,
+-			   VC4_ENCODER_TYPE_TXP),
++			   VC4_ENCODER_TYPE_TXP0),
+ 	VC5_PV_MUXING_TEST("3 outputs: DPI, VEC, DSI1",
+ 			   VC4_ENCODER_TYPE_DPI,
+ 			   VC4_ENCODER_TYPE_VEC,
+@@ -415,15 +415,15 @@ static const struct pv_muxing_param vc5_
+ 			   VC4_ENCODER_TYPE_HDMI1),
+ 	VC5_PV_MUXING_TEST("3 outputs: DPI, TXP, DSI1",
+ 			   VC4_ENCODER_TYPE_DPI,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_DSI1),
+ 	VC5_PV_MUXING_TEST("3 outputs: DPI, TXP, HDMI0",
+ 			   VC4_ENCODER_TYPE_DPI,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_HDMI0),
+ 	VC5_PV_MUXING_TEST("3 outputs: DPI, TXP, HDMI1",
+ 			   VC4_ENCODER_TYPE_DPI,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_HDMI1),
+ 	VC5_PV_MUXING_TEST("3 outputs: DPI, DSI1, HDMI0",
+ 			   VC4_ENCODER_TYPE_DPI,
+@@ -440,7 +440,7 @@ static const struct pv_muxing_param vc5_
+ 	VC5_PV_MUXING_TEST("3 outputs: DSI0, VEC, TXP",
+ 			   VC4_ENCODER_TYPE_DSI0,
+ 			   VC4_ENCODER_TYPE_VEC,
+-			   VC4_ENCODER_TYPE_TXP),
++			   VC4_ENCODER_TYPE_TXP0),
+ 	VC5_PV_MUXING_TEST("3 outputs: DSI0, VEC, DSI1",
+ 			   VC4_ENCODER_TYPE_DSI0,
+ 			   VC4_ENCODER_TYPE_VEC,
+@@ -455,15 +455,15 @@ static const struct pv_muxing_param vc5_
+ 			   VC4_ENCODER_TYPE_HDMI1),
+ 	VC5_PV_MUXING_TEST("3 outputs: DSI0, TXP, DSI1",
+ 			   VC4_ENCODER_TYPE_DSI0,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_DSI1),
+ 	VC5_PV_MUXING_TEST("3 outputs: DSI0, TXP, HDMI0",
+ 			   VC4_ENCODER_TYPE_DSI0,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_HDMI0),
+ 	VC5_PV_MUXING_TEST("3 outputs: DSI0, TXP, HDMI1",
+ 			   VC4_ENCODER_TYPE_DSI0,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_HDMI1),
+ 	VC5_PV_MUXING_TEST("3 outputs: DSI0, DSI1, HDMI0",
+ 			   VC4_ENCODER_TYPE_DSI0,
+@@ -490,17 +490,17 @@ static const struct pv_muxing_param vc5_
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, VEC, TXP, DSI1",
+ 			   VC4_ENCODER_TYPE_DPI,
+ 			   VC4_ENCODER_TYPE_VEC,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_DSI1),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, VEC, TXP, HDMI0",
+ 			   VC4_ENCODER_TYPE_DPI,
+ 			   VC4_ENCODER_TYPE_VEC,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_HDMI0),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, VEC, TXP, HDMI1",
+ 			   VC4_ENCODER_TYPE_DPI,
+ 			   VC4_ENCODER_TYPE_VEC,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_HDMI1),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, VEC, DSI1, HDMI0",
+ 			   VC4_ENCODER_TYPE_DPI,
+@@ -519,17 +519,17 @@ static const struct pv_muxing_param vc5_
+ 			   VC4_ENCODER_TYPE_HDMI1),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, TXP, DSI1, HDMI0",
+ 			   VC4_ENCODER_TYPE_DPI,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_DSI1,
+ 			   VC4_ENCODER_TYPE_HDMI0),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, TXP, DSI1, HDMI1",
+ 			   VC4_ENCODER_TYPE_DPI,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_DSI1,
+ 			   VC4_ENCODER_TYPE_HDMI1),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, TXP, HDMI0, HDMI1",
+ 			   VC4_ENCODER_TYPE_DPI,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_HDMI0,
+ 			   VC4_ENCODER_TYPE_HDMI1),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, DSI1, HDMI0, HDMI1",
+@@ -540,19 +540,19 @@ static const struct pv_muxing_param vc5_
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, VEC, TXP, DSI1, HDMI0",
+ 			   VC4_ENCODER_TYPE_DPI,
+ 			   VC4_ENCODER_TYPE_VEC,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_DSI1,
+ 			   VC4_ENCODER_TYPE_HDMI0),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, VEC, TXP, DSI1, HDMI1",
+ 			   VC4_ENCODER_TYPE_DPI,
+ 			   VC4_ENCODER_TYPE_VEC,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_DSI1,
+ 			   VC4_ENCODER_TYPE_HDMI1),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, VEC, TXP, HDMI0, HDMI1",
+ 			   VC4_ENCODER_TYPE_DPI,
+ 			   VC4_ENCODER_TYPE_VEC,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_HDMI0,
+ 			   VC4_ENCODER_TYPE_HDMI1),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, VEC, DSI1, HDMI0, HDMI1",
+@@ -563,24 +563,24 @@ static const struct pv_muxing_param vc5_
+ 			   VC4_ENCODER_TYPE_HDMI1),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, TXP, DSI1, HDMI0, HDMI1",
+ 			   VC4_ENCODER_TYPE_DPI,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_DSI1,
+ 			   VC4_ENCODER_TYPE_HDMI0,
+ 			   VC4_ENCODER_TYPE_HDMI1),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, VEC, TXP, DSI1",
+ 			   VC4_ENCODER_TYPE_DSI0,
+ 			   VC4_ENCODER_TYPE_VEC,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_DSI1),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, VEC, TXP, HDMI0",
+ 			   VC4_ENCODER_TYPE_DSI0,
+ 			   VC4_ENCODER_TYPE_VEC,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_HDMI0),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, VEC, TXP, HDMI1",
+ 			   VC4_ENCODER_TYPE_DSI0,
+ 			   VC4_ENCODER_TYPE_VEC,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_HDMI1),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, VEC, DSI1, HDMI0",
+ 			   VC4_ENCODER_TYPE_DSI0,
+@@ -599,17 +599,17 @@ static const struct pv_muxing_param vc5_
+ 			   VC4_ENCODER_TYPE_HDMI1),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, TXP, DSI1, HDMI0",
+ 			   VC4_ENCODER_TYPE_DSI0,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_DSI1,
+ 			   VC4_ENCODER_TYPE_HDMI0),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, TXP, DSI1, HDMI1",
+ 			   VC4_ENCODER_TYPE_DSI0,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_DSI1,
+ 			   VC4_ENCODER_TYPE_HDMI1),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, TXP, HDMI0, HDMI1",
+ 			   VC4_ENCODER_TYPE_DSI0,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_HDMI0,
+ 			   VC4_ENCODER_TYPE_HDMI1),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, DSI1, HDMI0, HDMI1",
+@@ -620,19 +620,19 @@ static const struct pv_muxing_param vc5_
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, VEC, TXP, DSI1, HDMI0",
+ 			   VC4_ENCODER_TYPE_DSI0,
+ 			   VC4_ENCODER_TYPE_VEC,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_DSI1,
+ 			   VC4_ENCODER_TYPE_HDMI0),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, VEC, TXP, DSI1, HDMI1",
+ 			   VC4_ENCODER_TYPE_DSI0,
+ 			   VC4_ENCODER_TYPE_VEC,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_DSI1,
+ 			   VC4_ENCODER_TYPE_HDMI1),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, VEC, TXP, HDMI0, HDMI1",
+ 			   VC4_ENCODER_TYPE_DSI0,
+ 			   VC4_ENCODER_TYPE_VEC,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_HDMI0,
+ 			   VC4_ENCODER_TYPE_HDMI1),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, VEC, DSI1, HDMI0, HDMI1",
+@@ -643,27 +643,27 @@ static const struct pv_muxing_param vc5_
+ 			   VC4_ENCODER_TYPE_HDMI1),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, TXP, DSI1, HDMI0, HDMI1",
+ 			   VC4_ENCODER_TYPE_DSI0,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_DSI1,
+ 			   VC4_ENCODER_TYPE_HDMI0,
+ 			   VC4_ENCODER_TYPE_HDMI1),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: VEC, TXP, DSI1, HDMI0, HDMI1",
+ 			   VC4_ENCODER_TYPE_VEC,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_DSI1,
+ 			   VC4_ENCODER_TYPE_HDMI0,
+ 			   VC4_ENCODER_TYPE_HDMI1),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DPI, VEC, TXP, DSI1, HDMI0, HDMI1",
+ 			   VC4_ENCODER_TYPE_DPI,
+ 			   VC4_ENCODER_TYPE_VEC,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_DSI1,
+ 			   VC4_ENCODER_TYPE_HDMI0,
+ 			   VC4_ENCODER_TYPE_HDMI1),
+ 	VC5_PV_MUXING_TEST("More than 3 outputs: DSI0, VEC, TXP, DSI1, HDMI0, HDMI1",
+ 			   VC4_ENCODER_TYPE_DSI0,
+ 			   VC4_ENCODER_TYPE_VEC,
+-			   VC4_ENCODER_TYPE_TXP,
++			   VC4_ENCODER_TYPE_TXP0,
+ 			   VC4_ENCODER_TYPE_DSI1,
+ 			   VC4_ENCODER_TYPE_HDMI0,
+ 			   VC4_ENCODER_TYPE_HDMI1),
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -489,7 +489,8 @@ enum vc4_encoder_type {
+ 	VC4_ENCODER_TYPE_DSI1,
+ 	VC4_ENCODER_TYPE_SMI,
+ 	VC4_ENCODER_TYPE_DPI,
+-	VC4_ENCODER_TYPE_TXP,
++	VC4_ENCODER_TYPE_TXP0,
++	VC4_ENCODER_TYPE_TXP1,
+ };
+ 
+ struct vc4_encoder {
+--- a/drivers/gpu/drm/vc4/vc4_kms.c
++++ b/drivers/gpu/drm/vc4/vc4_kms.c
+@@ -350,7 +350,7 @@ static void vc6_hvs_pv_muxing_commit(str
+ 			mux = 0;
+ 			break;
+ 
+-		case VC4_ENCODER_TYPE_TXP:
++		case VC4_ENCODER_TYPE_TXP1:
+ 			mux = 2;
+ 			break;
+ 
+--- a/drivers/gpu/drm/vc4/vc4_txp.c
++++ b/drivers/gpu/drm/vc4/vc4_txp.c
+@@ -515,7 +515,7 @@ const struct vc4_txp_data bcm2835_txp_da
+ 		.hvs_available_channels = BIT(2),
+ 		.hvs_output = 2,
+ 	},
+-	.encoder_type = VC4_ENCODER_TYPE_TXP,
++	.encoder_type = VC4_ENCODER_TYPE_TXP0,
+ 	.has_byte_enable = true,
+ };
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0615-drm-vc4-txp-Add-support-for-BCM2712-MOP.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0615-drm-vc4-txp-Add-support-for-BCM2712-MOP.patch
new file mode 100644
index 00000000..f5bfb89c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0615-drm-vc4-txp-Add-support-for-BCM2712-MOP.patch
@@ -0,0 +1,67 @@
+From aec89f6fa5f40d03231bb585ce82880ac0128701 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 25 Oct 2024 18:15:51 +0100
+Subject: [PATCH 615/697] drm/vc4: txp: Add support for BCM2712 MOP
+
+The BCM2712 has an evolution of what used to be called TXP in the
+earlier SoCs, but is now called MOP.
+
+There's a few differences still, so we can add a new compatible to deal
+with them easily.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241025-drm-vc4-2712-support-v2-20-35efa83c8fc0@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_txp.c | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_txp.c
++++ b/drivers/gpu/drm/vc4/vc4_txp.c
+@@ -386,6 +386,7 @@ static const struct drm_connector_funcs
+ static void vc4_txp_encoder_disable(struct drm_encoder *encoder)
+ {
+ 	struct drm_device *drm = encoder->dev;
++	struct vc4_dev *vc4 = to_vc4_dev(drm);
+ 	struct vc4_txp *txp = encoder_to_vc4_txp(encoder);
+ 	int idx;
+ 
+@@ -404,7 +405,8 @@ static void vc4_txp_encoder_disable(stru
+ 		WARN_ON(TXP_READ(TXP_DST_CTRL) & TXP_BUSY);
+ 	}
+ 
+-	TXP_WRITE(TXP_DST_CTRL, TXP_POWERDOWN);
++	if (vc4->gen < VC4_GEN_6_C)
++		TXP_WRITE(TXP_DST_CTRL, TXP_POWERDOWN);
+ 
+ 	drm_dev_exit(idx);
+ }
+@@ -508,6 +510,20 @@ static irqreturn_t vc4_txp_interrupt(int
+ 	return IRQ_HANDLED;
+ }
+ 
++static const struct vc4_txp_data bcm2712_mop_data = {
++	.base = {
++		.name = "mop",
++		.debugfs_name = "mop_regs",
++		.hvs_available_channels = BIT(2),
++		.hvs_output = 2,
++	},
++	.encoder_type = VC4_ENCODER_TYPE_TXP0,
++	.high_addr_ptr_reg = TXP_DST_PTR_HIGH_MOP,
++	.has_byte_enable = true,
++	.size_minus_one = true,
++	.supports_40bit_addresses = true,
++};
++
+ const struct vc4_txp_data bcm2835_txp_data = {
+ 	.base = {
+ 		.name = "txp",
+@@ -613,6 +629,7 @@ static void vc4_txp_remove(struct platfo
+ }
+ 
+ static const struct of_device_id vc4_txp_dt_match[] = {
++	{ .compatible = "brcm,bcm2712-mop", .data = &bcm2712_mop_data },
+ 	{ .compatible = "brcm,bcm2835-txp", .data = &bcm2835_txp_data },
+ 	{ /* sentinel */ },
+ };
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0616-drm-vc4-txp-Add-BCM2712-MOPLET-support.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0616-drm-vc4-txp-Add-BCM2712-MOPLET-support.patch
new file mode 100644
index 00000000..e2ceee6e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0616-drm-vc4-txp-Add-BCM2712-MOPLET-support.patch
@@ -0,0 +1,45 @@
+From d2a6ca2ded407d25e55a6f9945cfc0520f55690a Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 25 Oct 2024 18:15:52 +0100
+Subject: [PATCH 616/697] drm/vc4: txp: Add BCM2712 MOPLET support
+
+The BCM2712 features a simpler TXP called MOPLET. Let's add support for
+it.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241025-drm-vc4-2712-support-v2-21-35efa83c8fc0@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_txp.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_txp.c
++++ b/drivers/gpu/drm/vc4/vc4_txp.c
+@@ -524,6 +524,19 @@ static const struct vc4_txp_data bcm2712
+ 	.supports_40bit_addresses = true,
+ };
+ 
++static const struct vc4_txp_data bcm2712_moplet_data = {
++	.base = {
++		.name = "moplet",
++		.debugfs_name = "moplet_regs",
++		.hvs_available_channels = BIT(1),
++		.hvs_output = 4,
++	},
++	.encoder_type = VC4_ENCODER_TYPE_TXP1,
++	.high_addr_ptr_reg = TXP_DST_PTR_HIGH_MOPLET,
++	.size_minus_one = true,
++	.supports_40bit_addresses = true,
++};
++
+ const struct vc4_txp_data bcm2835_txp_data = {
+ 	.base = {
+ 		.name = "txp",
+@@ -630,6 +643,7 @@ static void vc4_txp_remove(struct platfo
+ 
+ static const struct of_device_id vc4_txp_dt_match[] = {
+ 	{ .compatible = "brcm,bcm2712-mop", .data = &bcm2712_mop_data },
++	{ .compatible = "brcm,bcm2712-moplet", .data = &bcm2712_moplet_data },
+ 	{ .compatible = "brcm,bcm2835-txp", .data = &bcm2835_txp_data },
+ 	{ /* sentinel */ },
+ };
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0617-drm-vc4-drv-Add-support-for-2712-D-step.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0617-drm-vc4-drv-Add-support-for-2712-D-step.patch
new file mode 100644
index 00000000..33f2e1b7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0617-drm-vc4-drv-Add-support-for-2712-D-step.patch
@@ -0,0 +1,62 @@
+From c16c5eb559fdd090af8275d5bcf50a7bb5cdd0bd Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 25 Oct 2024 18:15:53 +0100
+Subject: [PATCH 617/697] drm/vc4: drv: Add support for 2712 D-step
+
+Add in the compatible string and VC4_GEN_ enum for the D-step
+
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241025-drm-vc4-2712-support-v2-22-35efa83c8fc0@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_drv.c  | 1 +
+ drivers/gpu/drm/vc4/vc4_drv.h  | 1 +
+ drivers/gpu/drm/vc4/vc4_hvs.c  | 4 ++++
+ drivers/gpu/drm/vc4/vc4_regs.h | 3 +++
+ 4 files changed, 9 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_drv.c
++++ b/drivers/gpu/drm/vc4/vc4_drv.c
+@@ -462,6 +462,7 @@ static void vc4_platform_drm_shutdown(st
+ 
+ static const struct of_device_id vc4_of_match[] = {
+ 	{ .compatible = "brcm,bcm2711-vc5", .data = (void *)VC4_GEN_5 },
++	/* NB GEN_6_C will be corrected on D0 hw to GEN_6_D via vc4_hvs_bind */
+ 	{ .compatible = "brcm,bcm2712-vc6", .data = (void *)VC4_GEN_6_C },
+ 	{ .compatible = "brcm,bcm2835-vc4", .data = (void *)VC4_GEN_4 },
+ 	{ .compatible = "brcm,cygnus-vc4", .data = (void *)VC4_GEN_4 },
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -85,6 +85,7 @@ enum vc4_gen {
+ 	VC4_GEN_4,
+ 	VC4_GEN_5,
+ 	VC4_GEN_6_C,
++	VC4_GEN_6_D,
+ };
+ 
+ struct vc4_dev {
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -1532,6 +1532,10 @@ static int vc4_hvs_bind(struct device *d
+ 	if (vc4->gen >= VC4_GEN_6_C) {
+ 		hvs->regset.regs = vc6_hvs_regs;
+ 		hvs->regset.nregs = ARRAY_SIZE(vc6_hvs_regs);
++
++		if (VC4_GET_FIELD(HVS_READ(SCALER6_VERSION), SCALER6_VERSION) ==
++						SCALER6_VERSION_D0)
++			vc4->gen = VC4_GEN_6_D;
+ 	} else {
+ 		hvs->regset.regs = vc4_hvs_regs;
+ 		hvs->regset.nregs = ARRAY_SIZE(vc4_hvs_regs);
+--- a/drivers/gpu/drm/vc4/vc4_regs.h
++++ b/drivers/gpu/drm/vc4/vc4_regs.h
+@@ -527,6 +527,9 @@
+ #define SCALER5_DLIST_START			0x00004000
+ 
+ #define SCALER6_VERSION				0x00000000
++# define SCALER6_VERSION_MASK			VC4_MASK(7, 0)
++# define SCALER6_VERSION_C0			0x00000053
++# define SCALER6_VERSION_D0			0x00000054
+ #define SCALER6_CXM_SIZE			0x00000004
+ #define SCALER6_LBM_SIZE			0x00000008
+ #define SCALER6_UBM_SIZE			0x0000000c
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0618-drm-vc4-hvs-Add-in-support-for-2712-D-step.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0618-drm-vc4-hvs-Add-in-support-for-2712-D-step.patch
new file mode 100644
index 00000000..4a753066
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0618-drm-vc4-hvs-Add-in-support-for-2712-D-step.patch
@@ -0,0 +1,458 @@
+From 770d2b408f5683547accbdca8103e15cf738f7ac Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 25 Oct 2024 18:15:54 +0100
+Subject: [PATCH 618/697] drm/vc4: hvs: Add in support for 2712 D-step.
+
+The registers have been moved around, and a couple of minor changes
+made, so adapt for this.
+
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241025-drm-vc4-2712-support-v2-23-35efa83c8fc0@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_drv.h  |   6 ++
+ drivers/gpu/drm/vc4/vc4_hvs.c  | 154 ++++++++++++++++++++++++++-------
+ drivers/gpu/drm/vc4/vc4_kms.c  |   3 +-
+ drivers/gpu/drm/vc4/vc4_regs.h | 117 +++++++++++++++++++++----
+ 4 files changed, 234 insertions(+), 46 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -681,6 +681,12 @@ struct vc4_crtc_state {
+ 		writel(val, hvs->regs + (offset));					\
+ 	} while (0)
+ 
++#define HVS_READ6(offset) \
++	HVS_READ(hvs->vc4->gen == VC4_GEN_6_C ? SCALER6_ ## offset : SCALER6D_ ## offset)
++
++#define HVS_WRITE6(offset, val) \
++	HVS_WRITE(hvs->vc4->gen == VC4_GEN_6_C ? SCALER6_ ## offset : SCALER6D_ ## offset, val)
++
+ #define VC4_REG32(reg) { .name = #reg, .offset = reg }
+ 
+ struct vc4_exec_info {
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -141,6 +141,66 @@ static const struct debugfs_reg32 vc6_hv
+ 	VC4_REG32(SCALER6_BAD_AXI),
+ };
+ 
++static const struct debugfs_reg32 vc6_d_hvs_regs[] = {
++	VC4_REG32(SCALER6D_VERSION),
++	VC4_REG32(SCALER6D_CXM_SIZE),
++	VC4_REG32(SCALER6D_LBM_SIZE),
++	VC4_REG32(SCALER6D_UBM_SIZE),
++	VC4_REG32(SCALER6D_COBA_SIZE),
++	VC4_REG32(SCALER6D_COB_SIZE),
++	VC4_REG32(SCALER6D_CONTROL),
++	VC4_REG32(SCALER6D_FETCHER_STATUS),
++	VC4_REG32(SCALER6D_FETCH_STATUS),
++	VC4_REG32(SCALER6D_HANDLE_ERROR),
++	VC4_REG32(SCALER6D_DISP0_CTRL0),
++	VC4_REG32(SCALER6D_DISP0_CTRL1),
++	VC4_REG32(SCALER6D_DISP0_BGND0),
++	VC4_REG32(SCALER6D_DISP0_BGND1),
++	VC4_REG32(SCALER6D_DISP0_LPTRS),
++	VC4_REG32(SCALER6D_DISP0_COB),
++	VC4_REG32(SCALER6D_DISP0_STATUS),
++	VC4_REG32(SCALER6D_DISP0_DL),
++	VC4_REG32(SCALER6D_DISP0_RUN),
++	VC4_REG32(SCALER6D_DISP1_CTRL0),
++	VC4_REG32(SCALER6D_DISP1_CTRL1),
++	VC4_REG32(SCALER6D_DISP1_BGND0),
++	VC4_REG32(SCALER6D_DISP1_BGND1),
++	VC4_REG32(SCALER6D_DISP1_LPTRS),
++	VC4_REG32(SCALER6D_DISP1_COB),
++	VC4_REG32(SCALER6D_DISP1_STATUS),
++	VC4_REG32(SCALER6D_DISP1_DL),
++	VC4_REG32(SCALER6D_DISP1_RUN),
++	VC4_REG32(SCALER6D_DISP2_CTRL0),
++	VC4_REG32(SCALER6D_DISP2_CTRL1),
++	VC4_REG32(SCALER6D_DISP2_BGND0),
++	VC4_REG32(SCALER6D_DISP2_BGND1),
++	VC4_REG32(SCALER6D_DISP2_LPTRS),
++	VC4_REG32(SCALER6D_DISP2_COB),
++	VC4_REG32(SCALER6D_DISP2_STATUS),
++	VC4_REG32(SCALER6D_DISP2_DL),
++	VC4_REG32(SCALER6D_DISP2_RUN),
++	VC4_REG32(SCALER6D_EOLN),
++	VC4_REG32(SCALER6D_DL_STATUS),
++	VC4_REG32(SCALER6D_QOS0),
++	VC4_REG32(SCALER6D_PROF0),
++	VC4_REG32(SCALER6D_QOS1),
++	VC4_REG32(SCALER6D_PROF1),
++	VC4_REG32(SCALER6D_QOS2),
++	VC4_REG32(SCALER6D_PROF2),
++	VC4_REG32(SCALER6D_PRI_MAP0),
++	VC4_REG32(SCALER6D_PRI_MAP1),
++	VC4_REG32(SCALER6D_HISTCTRL),
++	VC4_REG32(SCALER6D_HISTBIN0),
++	VC4_REG32(SCALER6D_HISTBIN1),
++	VC4_REG32(SCALER6D_HISTBIN2),
++	VC4_REG32(SCALER6D_HISTBIN3),
++	VC4_REG32(SCALER6D_HISTBIN4),
++	VC4_REG32(SCALER6D_HISTBIN5),
++	VC4_REG32(SCALER6D_HISTBIN6),
++	VC4_REG32(SCALER6D_HISTBIN7),
++	VC4_REG32(SCALER6D_HVS_ID),
++};
++
+ void vc4_hvs_dump_state(struct vc4_hvs *hvs)
+ {
+ 	struct drm_device *drm = &hvs->vc4->base;
+@@ -419,6 +479,7 @@ u8 vc4_hvs_get_fifo_frame_count(struct v
+ 
+ 	switch (vc4->gen) {
+ 	case VC4_GEN_6_C:
++	case VC4_GEN_6_D:
+ 		field = VC4_GET_FIELD(HVS_READ(SCALER6_DISPX_STATUS(fifo)),
+ 				      SCALER6_DISPX_STATUS_FRCNT);
+ 		break;
+@@ -525,6 +586,7 @@ int vc4_hvs_get_fifo_from_output(struct
+ 		}
+ 
+ 	case VC4_GEN_6_C:
++	case VC4_GEN_6_D:
+ 		switch (output) {
+ 		case 0:
+ 			return 0;
+@@ -1132,6 +1194,7 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
+ 		break;
+ 
+ 	case VC4_GEN_6_C:
++	case VC4_GEN_6_D:
+ 		dlist_start = HVS_BOOTLOADER_DLIST_END;
+ 
+ 		/*
+@@ -1177,6 +1240,7 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
+ 		break;
+ 
+ 	case VC4_GEN_6_C:
++	case VC4_GEN_6_D:
+ 		/*
+ 		 * If we are running a test, it means that we can't
+ 		 * access a register. Use a plausible size then.
+@@ -1317,6 +1381,17 @@ static int vc4_hvs_hw_init(struct vc4_hv
+ #define CFC1_N_MA_CSC_COEFF_C23(x)	(0xa03c + ((x) * 0x3000))
+ #define CFC1_N_MA_CSC_COEFF_C24(x)	(0xa040 + ((x) * 0x3000))
+ 
++#define SCALER_PI_CMP_CSC_RED0(x)		(0x200 + ((x) * 0x40))
++#define SCALER_PI_CMP_CSC_RED1(x)		(0x204 + ((x) * 0x40))
++#define SCALER_PI_CMP_CSC_RED_CLAMP(x)		(0x208 + ((x) * 0x40))
++#define SCALER_PI_CMP_CSC_CFG(x)		(0x20c + ((x) * 0x40))
++#define SCALER_PI_CMP_CSC_GREEN0(x)		(0x210 + ((x) * 0x40))
++#define SCALER_PI_CMP_CSC_GREEN1(x)		(0x214 + ((x) * 0x40))
++#define SCALER_PI_CMP_CSC_GREEN_CLAMP(x)	(0x218 + ((x) * 0x40))
++#define SCALER_PI_CMP_CSC_BLUE0(x)		(0x220 + ((x) * 0x40))
++#define SCALER_PI_CMP_CSC_BLUE1(x)		(0x224 + ((x) * 0x40))
++#define SCALER_PI_CMP_CSC_BLUE_CLAMP(x)		(0x228 + ((x) * 0x40))
++
+ /* 4 S2.22 multiplication factors, and 1 S9.15 addititive element for each of 3
+  * output components
+  */
+@@ -1384,31 +1459,46 @@ static int vc6_hvs_hw_init(struct vc4_hv
+ 		  VC4_SET_FIELD(15, SCALER6_CONTROL_MAX_REQS));
+ 
+ 	/* Set HVS arbiter priority to max */
+-	HVS_WRITE(SCALER6_PRI_MAP0, 0xffffffff);
+-	HVS_WRITE(SCALER6_PRI_MAP1, 0xffffffff);
++	HVS_WRITE(SCALER6(PRI_MAP0), 0xffffffff);
++	HVS_WRITE(SCALER6(PRI_MAP1), 0xffffffff);
+ 
+-	for (i = 0; i < 6; i++) {
+-		coeffs = &csc_coeffs[i / 3][i % 3];
++	if (hvs->vc4->gen == VC4_GEN_6_C) {
++		for (i = 0; i < 6; i++) {
++			coeffs = &csc_coeffs[i / 3][i % 3];
++
++			HVS_WRITE(CFC1_N_MA_CSC_COEFF_C00(i), coeffs->csc[0][0]);
++			HVS_WRITE(CFC1_N_MA_CSC_COEFF_C01(i), coeffs->csc[0][1]);
++			HVS_WRITE(CFC1_N_MA_CSC_COEFF_C02(i), coeffs->csc[0][2]);
++			HVS_WRITE(CFC1_N_MA_CSC_COEFF_C03(i), coeffs->csc[0][3]);
++			HVS_WRITE(CFC1_N_MA_CSC_COEFF_C04(i), coeffs->csc[0][4]);
++
++			HVS_WRITE(CFC1_N_MA_CSC_COEFF_C10(i), coeffs->csc[1][0]);
++			HVS_WRITE(CFC1_N_MA_CSC_COEFF_C11(i), coeffs->csc[1][1]);
++			HVS_WRITE(CFC1_N_MA_CSC_COEFF_C12(i), coeffs->csc[1][2]);
++			HVS_WRITE(CFC1_N_MA_CSC_COEFF_C13(i), coeffs->csc[1][3]);
++			HVS_WRITE(CFC1_N_MA_CSC_COEFF_C14(i), coeffs->csc[1][4]);
++
++			HVS_WRITE(CFC1_N_MA_CSC_COEFF_C20(i), coeffs->csc[2][0]);
++			HVS_WRITE(CFC1_N_MA_CSC_COEFF_C21(i), coeffs->csc[2][1]);
++			HVS_WRITE(CFC1_N_MA_CSC_COEFF_C22(i), coeffs->csc[2][2]);
++			HVS_WRITE(CFC1_N_MA_CSC_COEFF_C23(i), coeffs->csc[2][3]);
++			HVS_WRITE(CFC1_N_MA_CSC_COEFF_C24(i), coeffs->csc[2][4]);
+ 
+-		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C00(i), coeffs->csc[0][0]);
+-		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C01(i), coeffs->csc[0][1]);
+-		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C02(i), coeffs->csc[0][2]);
+-		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C03(i), coeffs->csc[0][3]);
+-		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C04(i), coeffs->csc[0][4]);
+-
+-		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C10(i), coeffs->csc[1][0]);
+-		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C11(i), coeffs->csc[1][1]);
+-		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C12(i), coeffs->csc[1][2]);
+-		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C13(i), coeffs->csc[1][3]);
+-		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C14(i), coeffs->csc[1][4]);
+-
+-		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C20(i), coeffs->csc[2][0]);
+-		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C21(i), coeffs->csc[2][1]);
+-		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C22(i), coeffs->csc[2][2]);
+-		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C23(i), coeffs->csc[2][3]);
+-		HVS_WRITE(CFC1_N_MA_CSC_COEFF_C24(i), coeffs->csc[2][4]);
+-
+-		HVS_WRITE(CFC1_N_NL_CSC_CTRL(i), BIT(15));
++			HVS_WRITE(CFC1_N_NL_CSC_CTRL(i), BIT(15));
++		}
++	} else {
++		for (i = 0; i < 8; i++) {
++			HVS_WRITE(SCALER_PI_CMP_CSC_RED0(i), 0x1f002566);
++			HVS_WRITE(SCALER_PI_CMP_CSC_RED1(i), 0x3994);
++			HVS_WRITE(SCALER_PI_CMP_CSC_RED_CLAMP(i), 0xfff00000);
++			HVS_WRITE(SCALER_PI_CMP_CSC_CFG(i), 0x1);
++			HVS_WRITE(SCALER_PI_CMP_CSC_GREEN0(i), 0x18002566);
++			HVS_WRITE(SCALER_PI_CMP_CSC_GREEN1(i), 0xf927eee2);
++			HVS_WRITE(SCALER_PI_CMP_CSC_GREEN_CLAMP(i), 0xfff00000);
++			HVS_WRITE(SCALER_PI_CMP_CSC_BLUE0(i), 0x18002566);
++			HVS_WRITE(SCALER_PI_CMP_CSC_BLUE1(i), 0x43d80000);
++			HVS_WRITE(SCALER_PI_CMP_CSC_BLUE_CLAMP(i), 0xfff00000);
++		}
+ 	}
+ 
+ 	return 0;
+@@ -1479,26 +1569,27 @@ static int vc4_hvs_cob_init(struct vc4_h
+ 		break;
+ 
+ 	case VC4_GEN_6_C:
++	case VC4_GEN_6_D:
+ 		#define VC6_COB_LINE_WIDTH	3840
+ 		#define VC6_COB_NUM_LINES	4
+ 		base = 0;
+ 		top = 3840;
+ 
+-		HVS_WRITE(SCALER6_DISP2_COB,
++		HVS_WRITE(SCALER6_DISPX_COB(2),
+ 			  VC4_SET_FIELD(top, SCALER6_DISPX_COB_TOP) |
+ 			  VC4_SET_FIELD(base, SCALER6_DISPX_COB_BASE));
+ 
+ 		base = top + 16;
+ 		top += VC6_COB_LINE_WIDTH * VC6_COB_NUM_LINES;
+ 
+-		HVS_WRITE(SCALER6_DISP1_COB,
++		HVS_WRITE(SCALER6_DISPX_COB(1),
+ 			  VC4_SET_FIELD(top, SCALER6_DISPX_COB_TOP) |
+ 			  VC4_SET_FIELD(base, SCALER6_DISPX_COB_BASE));
+ 
+ 		base = top + 16;
+ 		top += VC6_COB_LINE_WIDTH * VC6_COB_NUM_LINES;
+ 
+-		HVS_WRITE(SCALER6_DISP0_COB,
++		HVS_WRITE(SCALER6_DISPX_COB(0),
+ 			  VC4_SET_FIELD(top, SCALER6_DISPX_COB_TOP) |
+ 			  VC4_SET_FIELD(base, SCALER6_DISPX_COB_BASE));
+ 		break;
+@@ -1529,13 +1620,16 @@ static int vc4_hvs_bind(struct device *d
+ 
+ 	hvs->regset.base = hvs->regs;
+ 
+-	if (vc4->gen >= VC4_GEN_6_C) {
++	if (vc4->gen == VC4_GEN_6_C) {
+ 		hvs->regset.regs = vc6_hvs_regs;
+ 		hvs->regset.nregs = ARRAY_SIZE(vc6_hvs_regs);
+ 
+ 		if (VC4_GET_FIELD(HVS_READ(SCALER6_VERSION), SCALER6_VERSION) ==
+-						SCALER6_VERSION_D0)
++						SCALER6_VERSION_D0) {
+ 			vc4->gen = VC4_GEN_6_D;
++			hvs->regset.regs = vc6_d_hvs_regs;
++			hvs->regset.nregs = ARRAY_SIZE(vc6_d_hvs_regs);
++		}
+ 	} else {
+ 		hvs->regset.regs = vc4_hvs_regs;
+ 		hvs->regset.nregs = ARRAY_SIZE(vc4_hvs_regs);
+--- a/drivers/gpu/drm/vc4/vc4_kms.c
++++ b/drivers/gpu/drm/vc4/vc4_kms.c
+@@ -328,7 +328,7 @@ static void vc6_hvs_pv_muxing_commit(str
+ 	struct drm_crtc *crtc;
+ 	unsigned int i;
+ 
+-	WARN_ON_ONCE(vc4->gen != VC4_GEN_6_C);
++	WARN_ON_ONCE(vc4->gen != VC4_GEN_6_C && vc4->gen != VC4_GEN_6_D);
+ 
+ 	for_each_new_crtc_in_state(state, crtc, crtc_state, i) {
+ 		struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(crtc_state);
+@@ -451,6 +451,7 @@ static void vc4_atomic_commit_tail(struc
+ 		break;
+ 
+ 	case VC4_GEN_6_C:
++	case VC4_GEN_6_D:
+ 		vc6_hvs_pv_muxing_commit(vc4, state);
+ 		break;
+ 
+--- a/drivers/gpu/drm/vc4/vc4_regs.h
++++ b/drivers/gpu/drm/vc4/vc4_regs.h
+@@ -19,6 +19,20 @@
+ 
+ #define VC4_GET_FIELD(word, field) FIELD_GET(field##_MASK, word)
+ 
++#define VC6_SET_FIELD(value, field)					\
++	({								\
++		WARN_ON(!FIELD_FIT(hvs->vc4->gen == VC4_GEN_6_C ?	\
++				    SCALER6_ ## field ## _MASK :	\
++				    SCALER6D_ ## field ## _MASK, value));\
++		FIELD_PREP(hvs->vc4->gen == VC4_GEN_6_C ?		\
++				    SCALER6_ ## field ## _MASK :	\
++				    SCALER6D_ ## field ## _MASK, value);	\
++	 })
++
++#define VC6_GET_FIELD(word, field) FIELD_GET(hvs->vc4->gen == VC4_GEN_6_C ?	\
++					     SCALER6_ ## field ## _MASK :	\
++					     SCALER6D_ ## field ## _MASK, word)
++
+ #define V3D_IDENT0   0x00000
+ # define V3D_EXPECTED_IDENT0 \
+ 	((2 << 24) | \
+@@ -548,8 +562,9 @@
+ #define SCALER6_HANDLE_ERROR			0x0000002c
+ 
+ #define SCALER6_DISP0_CTRL0			0x00000030
+-#define SCALER6_DISPX_CTRL0(x)						\
+-	(SCALER6_DISP0_CTRL0 + ((x) * (SCALER6_DISP1_CTRL0 - SCALER6_DISP0_CTRL0)))
++#define SCALER6_DISPX_CTRL0(x)		((hvs->vc4->gen == VC4_GEN_6_C) ? \
++	(SCALER6_DISP0_CTRL0 + ((x) * (SCALER6_DISP1_CTRL0 - SCALER6_DISP0_CTRL0))) : \
++	(SCALER6D_DISP0_CTRL0 + ((x) * (SCALER6D_DISP1_CTRL0 - SCALER6D_DISP0_CTRL0))))
+ # define SCALER6_DISPX_CTRL0_ENB		BIT(31)
+ # define SCALER6_DISPX_CTRL0_RESET		BIT(30)
+ # define SCALER6_DISPX_CTRL0_FWIDTH_MASK	VC4_MASK(28, 16)
+@@ -558,30 +573,34 @@
+ # define SCALER6_DISPX_CTRL0_LINES_MASK		VC4_MASK(12, 0)
+ 
+ #define SCALER6_DISP0_CTRL1			0x00000034
+-#define SCALER6_DISPX_CTRL1(x)						\
+-	(SCALER6_DISP0_CTRL1 + ((x) * (SCALER6_DISP1_CTRL1 - SCALER6_DISP0_CTRL1)))
++#define SCALER6_DISPX_CTRL1(x)		((hvs->vc4->gen == VC4_GEN_6_C) ? \
++	(SCALER6_DISP0_CTRL1 + ((x) * (SCALER6_DISP1_CTRL1 - SCALER6_DISP0_CTRL1))) : \
++	(SCALER6D_DISP0_CTRL1 + ((x) * (SCALER6D_DISP1_CTRL1 - SCALER6D_DISP0_CTRL1))))
+ # define SCALER6_DISPX_CTRL1_BGENB		BIT(8)
+ # define SCALER6_DISPX_CTRL1_INTLACE		BIT(0)
+ 
+ #define SCALER6_DISP0_BGND			0x00000038
+-#define SCALER6_DISPX_BGND(x)						\
+-	(SCALER6_DISP0_BGND + ((x) * (SCALER6_DISP1_BGND - SCALER6_DISP0_BGND)))
++#define SCALER6_DISPX_BGND(x)		((hvs->vc4->gen == VC4_GEN_6_C) ? \
++	(SCALER6_DISP0_BGND + ((x) * (SCALER6_DISP1_BGND - SCALER6_DISP0_BGND))) : \
++	(SCALER6D_DISP0_BGND + ((x) * (SCALER6D_DISP1_BGND - SCALER6D_DISP0_BGND))))
+ 
+ #define SCALER6_DISP0_LPTRS			0x0000003c
+-#define SCALER6_DISPX_LPTRS(x)						\
+-	(SCALER6_DISP0_LPTRS + ((x) * (SCALER6_DISP1_LPTRS - SCALER6_DISP0_LPTRS)))
++#define SCALER6_DISPX_LPTRS(x)		((hvs->vc4->gen == VC4_GEN_6_C) ? \
++	(SCALER6_DISP0_LPTRS + ((x) * (SCALER6_DISP1_LPTRS - SCALER6_DISP0_LPTRS))) : \
++	(SCALER6D_DISP0_LPTRS + ((x) * (SCALER6D_DISP1_LPTRS - SCALER6D_DISP0_LPTRS))))
+ # define SCALER6_DISPX_LPTRS_HEADE_MASK		VC4_MASK(11, 0)
+ 
+ #define SCALER6_DISP0_COB			0x00000040
+-#define SCALER6_DISPX_COB(x)						\
+-	(SCALER6_DISP0_COB + ((x) * (SCALER6_DISP1_COB - SCALER6_DISP0_COB)))
++#define SCALER6_DISPX_COB(x)		((hvs->vc4->gen == VC4_GEN_6_C) ? \
++	(SCALER6_DISP0_COB + ((x) * (SCALER6_DISP1_COB - SCALER6_DISP0_COB))) : \
++	(SCALER6D_DISP0_COB + ((x) * (SCALER6D_DISP1_COB - SCALER6D_DISP0_COB))))
+ # define SCALER6_DISPX_COB_TOP_MASK		VC4_MASK(31, 16)
+ # define SCALER6_DISPX_COB_BASE_MASK		VC4_MASK(15, 0)
+ 
+ #define SCALER6_DISP0_STATUS			0x00000044
+-
+-#define SCALER6_DISPX_STATUS(x)						\
+-	(SCALER6_DISP0_STATUS + ((x) * (SCALER6_DISP1_STATUS - SCALER6_DISP0_STATUS)))
++#define SCALER6_DISPX_STATUS(x)		((hvs->vc4->gen == VC4_GEN_6_C) ? \
++	(SCALER6_DISP0_STATUS + ((x) * (SCALER6_DISP1_STATUS - SCALER6_DISP0_STATUS))) : \
++	(SCALER6D_DISP0_STATUS + ((x) * (SCALER6D_DISP1_STATUS - SCALER6D_DISP0_STATUS))))
+ # define SCALER6_DISPX_STATUS_EMPTY		BIT(22)
+ # define SCALER6_DISPX_STATUS_FRCNT_MASK	VC4_MASK(21, 16)
+ # define SCALER6_DISPX_STATUS_OFIELD		BIT(15)
+@@ -594,8 +613,9 @@
+ 
+ #define SCALER6_DISP0_DL			0x00000048
+ 
+-#define SCALER6_DISPX_DL(x)						\
+-	(SCALER6_DISP0_DL + ((x) * (SCALER6_DISP1_DL - SCALER6_DISP0_DL)))
++#define SCALER6_DISPX_DL(x)		((hvs->vc4->gen == VC4_GEN_6_C) ? \
++	(SCALER6_DISP0_DL + ((x) * (SCALER6_DISP1_DL - SCALER6_DISP0_DL))) : \
++	(SCALER6D_DISP0_DL + ((x) * (SCALER6D_DISP1_DL - SCALER6D_DISP0_DL))))
+ # define SCALER6_DISPX_DL_LACT_MASK		VC4_MASK(11, 0)
+ 
+ #define SCALER6_DISP0_RUN			0x0000004c
+@@ -653,6 +673,73 @@
+ #define SCALER6_BAD_UPM				0x0000022c
+ #define SCALER6_BAD_AXI				0x00000230
+ 
++#define SCALER6D_VERSION			0x00000000
++#define SCALER6D_CXM_SIZE			0x00000004
++#define SCALER6D_LBM_SIZE			0x00000008
++#define SCALER6D_UBM_SIZE			0x0000000c
++#define SCALER6D_COBA_SIZE			0x00000010
++#define SCALER6D_COB_SIZE			0x00000014
++#define SCALER6D_CONTROL			0x00000020
++#define SCALER6D_FETCHER_STATUS			0x00000024
++#define SCALER6D_FETCH_STATUS			0x00000028
++#define SCALER6D_HANDLE_ERROR			0x0000002c
++#define SCALER6D_EOLN				0x00000030
++#define SCALER6D_DL_STATUS			0x00000034
++#define SCALER6D_PRI_MAP0			0x00000038
++#define SCALER6D_PRI_MAP1			0x0000003c
++#define SCALER6D_HISTCTRL			0x000000d0
++#define SCALER6D_HISTBIN0			0x000000d4
++#define SCALER6D_HISTBIN1			0x000000d8
++#define SCALER6D_HISTBIN2			0x000000dc
++#define SCALER6D_HISTBIN3			0x000000e0
++#define SCALER6D_HISTBIN4			0x000000e4
++#define SCALER6D_HISTBIN5			0x000000e8
++#define SCALER6D_HISTBIN6			0x000000ec
++#define SCALER6D_HISTBIN7			0x000000f0
++#define SCALER6D_HVS_ID				0x000000fc
++
++#define SCALER6D_DISP0_CTRL0			0x00000100
++#define SCALER6D_DISP0_CTRL1			0x00000104
++#define SCALER6D_DISP0_BGND			0x00000108
++#define SCALER6D_DISP0_LPTRS			0x00000110
++#define SCALER6D_DISP0_COB			0x00000114
++#define SCALER6D_DISP0_STATUS			0x00000118
++#define SCALER6D_DISP0_CTRL0			0x00000100
++#define SCALER6D_DISP0_CTRL1			0x00000104
++#define SCALER6D_DISP0_BGND0			0x00000108
++#define SCALER6D_DISP0_BGND1			0x0000010c
++#define SCALER6D_DISP0_LPTRS			0x00000110
++#define SCALER6D_DISP0_COB			0x00000114
++#define SCALER6D_DISP0_STATUS			0x00000118
++#define SCALER6D_DISP0_DL			0x0000011c
++#define SCALER6D_DISP0_RUN			0x00000120
++#define SCALER6D_QOS0				0x00000124
++#define SCALER6D_PROF0				0x00000128
++#define SCALER6D_DISP1_CTRL0			0x00000140
++#define SCALER6D_DISP1_CTRL1			0x00000144
++#define SCALER6D_DISP1_BGND0			0x00000148
++#define SCALER6D_DISP1_BGND1			0x0000014c
++#define SCALER6D_DISP1_LPTRS			0x00000150
++#define SCALER6D_DISP1_COB			0x00000154
++#define SCALER6D_DISP1_STATUS			0x00000158
++#define SCALER6D_DISP1_DL			0x0000015c
++#define SCALER6D_DISP1_RUN			0x00000160
++#define SCALER6D_QOS1				0x00000164
++#define SCALER6D_PROF1				0x00000168
++#define SCALER6D_DISP2_CTRL0			0x00000180
++#define SCALER6D_DISP2_CTRL1			0x00000184
++#define SCALER6D_DISP2_BGND0			0x00000188
++#define SCALER6D_DISP2_BGND1			0x0000018c
++#define SCALER6D_DISP2_LPTRS			0x00000190
++#define SCALER6D_DISP2_COB			0x00000194
++#define SCALER6D_DISP2_STATUS			0x00000198
++#define SCALER6D_DISP2_DL			0x0000019c
++#define SCALER6D_DISP2_RUN			0x000001a0
++#define SCALER6D_QOS2				0x000001a4
++#define SCALER6D_PROF2				0x000001a8
++
++#define SCALER6(x) ((hvs->vc4->gen == VC4_GEN_6_C) ? SCALER6_ ## x : SCALER6D_ ## x)
++
+ # define VC4_HDMI_SW_RESET_FORMAT_DETECT	BIT(1)
+ # define VC4_HDMI_SW_RESET_HDMI			BIT(0)
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0619-drm-vc4-plane-Add-support-for-2712-D-step.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0619-drm-vc4-plane-Add-support-for-2712-D-step.patch
new file mode 100644
index 00000000..f4fb0286
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0619-drm-vc4-plane-Add-support-for-2712-D-step.patch
@@ -0,0 +1,162 @@
+From 2fd4e951df243805120a421b617ad8114293dc25 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 25 Oct 2024 18:15:55 +0100
+Subject: [PATCH 619/697] drm/vc4: plane: Add support for 2712 D-step.
+
+There are a few minor changes in the display list generation
+for the D-step of the chip, so add them.
+
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241025-drm-vc4-2712-support-v2-24-35efa83c8fc0@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 72 ++++++++++++++++++++++++---------
+ drivers/gpu/drm/vc4/vc4_regs.h  |  9 ++++-
+ 2 files changed, 60 insertions(+), 21 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -1134,25 +1134,53 @@ static u32 vc4_hvs4_get_alpha_blend_mode
+ 
+ static u32 vc4_hvs5_get_alpha_blend_mode(struct drm_plane_state *state)
+ {
+-	if (!state->fb->format->has_alpha)
+-		return VC4_SET_FIELD(SCALER5_CTL2_ALPHA_MODE_FIXED,
+-				     SCALER5_CTL2_ALPHA_MODE);
+-
+-	switch (state->pixel_blend_mode) {
+-	case DRM_MODE_BLEND_PIXEL_NONE:
+-		return VC4_SET_FIELD(SCALER5_CTL2_ALPHA_MODE_FIXED,
+-				     SCALER5_CTL2_ALPHA_MODE);
++	struct drm_device *dev = state->state->dev;
++	struct vc4_dev *vc4 = to_vc4_dev(dev);
++
++	switch (vc4->gen) {
+ 	default:
+-	case DRM_MODE_BLEND_PREMULTI:
+-		return VC4_SET_FIELD(SCALER5_CTL2_ALPHA_MODE_PIPELINE,
+-				     SCALER5_CTL2_ALPHA_MODE) |
+-			SCALER5_CTL2_ALPHA_PREMULT;
+-	case DRM_MODE_BLEND_COVERAGE:
+-		return VC4_SET_FIELD(SCALER5_CTL2_ALPHA_MODE_PIPELINE,
+-				     SCALER5_CTL2_ALPHA_MODE);
++	case VC4_GEN_5:
++	case VC4_GEN_6_C:
++		if (!state->fb->format->has_alpha)
++			return VC4_SET_FIELD(SCALER5_CTL2_ALPHA_MODE_FIXED,
++					     SCALER5_CTL2_ALPHA_MODE);
++
++		switch (state->pixel_blend_mode) {
++		case DRM_MODE_BLEND_PIXEL_NONE:
++			return VC4_SET_FIELD(SCALER5_CTL2_ALPHA_MODE_FIXED,
++					     SCALER5_CTL2_ALPHA_MODE);
++		default:
++		case DRM_MODE_BLEND_PREMULTI:
++			return VC4_SET_FIELD(SCALER5_CTL2_ALPHA_MODE_PIPELINE,
++					     SCALER5_CTL2_ALPHA_MODE) |
++				SCALER5_CTL2_ALPHA_PREMULT;
++		case DRM_MODE_BLEND_COVERAGE:
++			return VC4_SET_FIELD(SCALER5_CTL2_ALPHA_MODE_PIPELINE,
++					     SCALER5_CTL2_ALPHA_MODE);
++		}
++	case VC4_GEN_6_D:
++		/* 2712-D configures fixed alpha mode in CTL0 */
++		return state->pixel_blend_mode == DRM_MODE_BLEND_PREMULTI ?
++			SCALER5_CTL2_ALPHA_PREMULT : 0;
+ 	}
+ }
+ 
++static u32 vc4_hvs6_get_alpha_mask_mode(struct drm_plane_state *state)
++{
++	struct drm_device *dev = state->state->dev;
++	struct vc4_dev *vc4 = to_vc4_dev(dev);
++
++	WARN_ON_ONCE(vc4->gen != VC4_GEN_6_C && vc4->gen != VC4_GEN_6_D);
++
++	if (vc4->gen == VC4_GEN_6_D &&
++	    (!state->fb->format->has_alpha ||
++	     state->pixel_blend_mode == DRM_MODE_BLEND_PIXEL_NONE))
++		return VC4_SET_FIELD(SCALER6D_CTL0_ALPHA_MASK_FIXED,
++				     SCALER6_CTL0_ALPHA_MASK);
++
++	return VC4_SET_FIELD(SCALER6_CTL0_ALPHA_MASK_NONE, SCALER6_CTL0_ALPHA_MASK);
++}
++
+ /* Writes out a full display list for an active plane to the plane's
+  * private dlist state.
+  */
+@@ -1645,14 +1673,13 @@ static int vc4_plane_mode_set(struct drm
+ static u32 vc6_plane_get_csc_mode(struct vc4_plane_state *vc4_state)
+ {
+ 	struct drm_plane_state *state = &vc4_state->base;
++	struct vc4_dev *vc4 = to_vc4_dev(state->plane->dev);
+ 	u32 ret = 0;
+ 
+ 	if (vc4_state->is_yuv) {
+ 		enum drm_color_encoding color_encoding = state->color_encoding;
+ 		enum drm_color_range color_range = state->color_range;
+ 
+-		ret |= SCALER6_CTL2_CSC_ENABLE;
+-
+ 		/* CSC pre-loaded with:
+ 		 * 0 = BT601 limited range
+ 		 * 1 = BT709 limited range
+@@ -1666,8 +1693,15 @@ static u32 vc6_plane_get_csc_mode(struct
+ 		if (color_range > DRM_COLOR_YCBCR_FULL_RANGE)
+ 			color_range = DRM_COLOR_YCBCR_LIMITED_RANGE;
+ 
+-		ret |= VC4_SET_FIELD(color_encoding + (color_range * 3),
+-				     SCALER6_CTL2_BRCM_CFC_CONTROL);
++		if (vc4->gen == VC4_GEN_6_C) {
++			ret |= SCALER6C_CTL2_CSC_ENABLE;
++			ret |= VC4_SET_FIELD(color_encoding + (color_range * 3),
++					     SCALER6C_CTL2_BRCM_CFC_CONTROL);
++		} else {
++			ret |= SCALER6D_CTL2_CSC_ENABLE;
++			ret |= VC4_SET_FIELD(color_encoding + (color_range * 3),
++					     SCALER6D_CTL2_BRCM_CFC_CONTROL);
++		}
+ 	}
+ 
+ 	return ret;
+@@ -1880,7 +1914,7 @@ static int vc6_plane_mode_set(struct drm
+ 	vc4_dlist_write(vc4_state,
+ 			SCALER6_CTL0_VALID |
+ 			VC4_SET_FIELD(tiling, SCALER6_CTL0_ADDR_MODE) |
+-			VC4_SET_FIELD(0, SCALER6_CTL0_ALPHA_MASK) |
++			vc4_hvs6_get_alpha_mask_mode(state) |
+ 			(vc4_state->is_unity ? SCALER6_CTL0_UNITY : 0) |
+ 			VC4_SET_FIELD(format->pixel_order_hvs5, SCALER6_CTL0_ORDERRGBA) |
+ 			VC4_SET_FIELD(scl1, SCALER6_CTL0_SCL1_MODE) |
+--- a/drivers/gpu/drm/vc4/vc4_regs.h
++++ b/drivers/gpu/drm/vc4/vc4_regs.h
+@@ -1194,6 +1194,9 @@ enum hvs_pixel_format {
+ #define SCALER5_CTL2_ALPHA_MASK			VC4_MASK(15, 4)
+ #define SCALER5_CTL2_ALPHA_SHIFT		4
+ 
++#define SCALER6D_CTL2_CSC_ENABLE		BIT(19)
++#define SCALER6D_CTL2_BRCM_CFC_CONTROL_MASK	VC4_MASK(22, 20)
++
+ #define SCALER_POS1_SCL_HEIGHT_MASK		VC4_MASK(27, 16)
+ #define SCALER_POS1_SCL_HEIGHT_SHIFT		16
+ 
+@@ -1347,6 +1350,8 @@ enum hvs_pixel_format {
+ #define SCALER6_CTL0_ADDR_MODE_UIF		4
+ 
+ #define SCALER6_CTL0_ALPHA_MASK_MASK		VC4_MASK(19, 18)
++#define SCALER6_CTL0_ALPHA_MASK_NONE		0
++#define SCALER6D_CTL0_ALPHA_MASK_FIXED		3
+ #define SCALER6_CTL0_UNITY			BIT(15)
+ #define SCALER6_CTL0_ORDERRGBA_MASK		VC4_MASK(14, 13)
+ #define SCALER6_CTL0_SCL1_MODE_MASK		VC4_MASK(10, 8)
+@@ -1361,8 +1366,8 @@ enum hvs_pixel_format {
+ #define SCALER6_CTL2_ALPHA_PREMULT		BIT(29)
+ #define SCALER6_CTL2_ALPHA_MIX			BIT(28)
+ #define SCALER6_CTL2_BFG			BIT(26)
+-#define SCALER6_CTL2_CSC_ENABLE			BIT(25)
+-#define SCALER6_CTL2_BRCM_CFC_CONTROL_MASK	VC4_MASK(18, 16)
++#define SCALER6C_CTL2_CSC_ENABLE		BIT(25)
++#define SCALER6C_CTL2_BRCM_CFC_CONTROL_MASK	VC4_MASK(18, 16)
+ #define SCALER6_CTL2_ALPHA_MASK			VC4_MASK(15, 4)
+ 
+ #define SCALER6_POS1_SCL_LINES_MASK		VC4_MASK(28, 16)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0620-drm-vc4-hdmi-Support-2712-D-step-register-map.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0620-drm-vc4-hdmi-Support-2712-D-step-register-map.patch
new file mode 100644
index 00000000..1289c684
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0620-drm-vc4-hdmi-Support-2712-D-step-register-map.patch
@@ -0,0 +1,73 @@
+From 4bd8d106e3a7c5fc144d7d0fc35f0d787588241c Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 25 Oct 2024 18:15:56 +0100
+Subject: [PATCH 620/697] drm/vc4: hdmi: Support 2712 D-step register map
+
+The D-step has increased FIFO sizes of the MAI_THR blocks,
+resulting in changes to the register masking. Add support for
+it.
+
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241025-drm-vc4-2712-support-v2-25-35efa83c8fc0@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 19 +++++++++++++++++--
+ drivers/gpu/drm/vc4/vc4_regs.h |  9 +++++++++
+ 2 files changed, 26 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -2123,18 +2123,33 @@ static int vc4_hdmi_audio_prepare(struct
+ 					     VC4_HDMI_AUDIO_PACKET_CEA_MASK);
+ 
+ 	/* Set the MAI threshold */
+-	if (vc4->gen >= VC4_GEN_5)
++	switch (vc4->gen) {
++	case VC4_GEN_6_D:
++		HDMI_WRITE(HDMI_MAI_THR,
++			   VC4_SET_FIELD(0x10, VC6_D_HD_MAI_THR_PANICHIGH) |
++			   VC4_SET_FIELD(0x10, VC6_D_HD_MAI_THR_PANICLOW) |
++			   VC4_SET_FIELD(0x1c, VC6_D_HD_MAI_THR_DREQHIGH) |
++			   VC4_SET_FIELD(0x1c, VC6_D_HD_MAI_THR_DREQLOW));
++		break;
++	case VC4_GEN_6_C:
++	case VC4_GEN_5:
+ 		HDMI_WRITE(HDMI_MAI_THR,
+ 			   VC4_SET_FIELD(0x10, VC4_HD_MAI_THR_PANICHIGH) |
+ 			   VC4_SET_FIELD(0x10, VC4_HD_MAI_THR_PANICLOW) |
+ 			   VC4_SET_FIELD(0x1c, VC4_HD_MAI_THR_DREQHIGH) |
+ 			   VC4_SET_FIELD(0x1c, VC4_HD_MAI_THR_DREQLOW));
+-	else
++		break;
++	case VC4_GEN_4:
+ 		HDMI_WRITE(HDMI_MAI_THR,
+ 			   VC4_SET_FIELD(0x8, VC4_HD_MAI_THR_PANICHIGH) |
+ 			   VC4_SET_FIELD(0x8, VC4_HD_MAI_THR_PANICLOW) |
+ 			   VC4_SET_FIELD(0x6, VC4_HD_MAI_THR_DREQHIGH) |
+ 			   VC4_SET_FIELD(0x8, VC4_HD_MAI_THR_DREQLOW));
++		break;
++	default:
++		drm_err(drm, "Unknown VC4 generation: %d", vc4->gen);
++		break;
++	}
+ 
+ 	HDMI_WRITE(HDMI_MAI_CONFIG,
+ 		   VC4_HDMI_MAI_CONFIG_BIT_REVERSE |
+--- a/drivers/gpu/drm/vc4/vc4_regs.h
++++ b/drivers/gpu/drm/vc4/vc4_regs.h
+@@ -987,6 +987,15 @@ enum {
+ # define VC4_HD_MAI_THR_DREQLOW_MASK		VC4_MASK(5, 0)
+ # define VC4_HD_MAI_THR_DREQLOW_SHIFT		0
+ 
++# define VC6_D_HD_MAI_THR_PANICHIGH_MASK	VC4_MASK(29, 23)
++# define VC6_D_HD_MAI_THR_PANICHIGH_SHIFT	23
++# define VC6_D_HD_MAI_THR_PANICLOW_MASK		VC4_MASK(21, 15)
++# define VC6_D_HD_MAI_THR_PANICLOW_SHIFT	15
++# define VC6_D_HD_MAI_THR_DREQHIGH_MASK		VC4_MASK(13, 7)
++# define VC6_D_HD_MAI_THR_DREQHIGH_SHIFT	7
++# define VC6_D_HD_MAI_THR_DREQLOW_MASK		VC4_MASK(6, 0)
++# define VC6_D_HD_MAI_THR_DREQLOW_SHIFT		0
++
+ /* Divider from HDMI HSM clock to MAI serial clock.  Sampling period
+  * converges to N / (M + 1) cycles.
+  */
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0621-drm-vc4-Add-additional-warn_on-for-incorrect-revisio.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0621-drm-vc4-Add-additional-warn_on-for-incorrect-revisio.patch
new file mode 100644
index 00000000..b3435009
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0621-drm-vc4-Add-additional-warn_on-for-incorrect-revisio.patch
@@ -0,0 +1,232 @@
+From 0fa0ce0037c13e035960e70af1a1709cb421d6f3 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <mripard@kernel.org>
+Date: Fri, 25 Oct 2024 18:15:57 +0100
+Subject: [PATCH 621/697] drm/vc4: Add additional warn_on for incorrect
+ revisions
+
+Some code path in vc4 are conditional to a generation and cannot be
+executed on others. Let's put a WARN_ON if that ever happens.
+
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241025-drm-vc4-2712-support-v2-26-35efa83c8fc0@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c   | 30 ++++++++++++++++++++++++++++--
+ drivers/gpu/drm/vc4/vc4_kms.c   |  6 ++++++
+ drivers/gpu/drm/vc4/vc4_plane.c | 17 +++++++++++++++++
+ 3 files changed, 51 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -419,12 +419,15 @@ static int vc4_hvs_upload_linear_kernel(
+ static void vc4_hvs_lut_load(struct vc4_hvs *hvs,
+ 			     struct vc4_crtc *vc4_crtc)
+ {
+-	struct drm_device *drm = &hvs->vc4->base;
++	struct vc4_dev *vc4 = hvs->vc4;
++	struct drm_device *drm = &vc4->base;
+ 	struct drm_crtc *crtc = &vc4_crtc->base;
+ 	struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(crtc->state);
+ 	int idx;
+ 	u32 i;
+ 
++	WARN_ON_ONCE(vc4->gen > VC4_GEN_5);
++
+ 	if (!drm_dev_enter(drm, &idx))
+ 		return;
+ 
+@@ -474,6 +477,8 @@ u8 vc4_hvs_get_fifo_frame_count(struct v
+ 	u8 field = 0;
+ 	int idx;
+ 
++	WARN_ON_ONCE(vc4->gen > VC4_GEN_6_D);
++
+ 	if (!drm_dev_enter(drm, &idx))
+ 		return 0;
+ 
+@@ -530,6 +535,8 @@ int vc4_hvs_get_fifo_from_output(struct
+ 	u32 reg;
+ 	int ret;
+ 
++	WARN_ON_ONCE(vc4->gen > VC4_GEN_6_D);
++
+ 	switch (vc4->gen) {
+ 	case VC4_GEN_4:
+ 		return output;
+@@ -621,6 +628,8 @@ static int vc4_hvs_init_channel(struct v
+ 	u32 dispctrl;
+ 	int idx;
+ 
++	WARN_ON_ONCE(vc4->gen > VC4_GEN_5);
++
+ 	if (!drm_dev_enter(drm, &idx))
+ 		return -ENODEV;
+ 
+@@ -682,6 +691,8 @@ static int vc6_hvs_init_channel(struct v
+ 	u32 disp_ctrl1;
+ 	int idx;
+ 
++	WARN_ON_ONCE(vc4->gen < VC4_GEN_6_C);
++
+ 	if (!drm_dev_enter(drm, &idx))
+ 		return -ENODEV;
+ 
+@@ -707,9 +718,12 @@ static int vc6_hvs_init_channel(struct v
+ 
+ static void __vc4_hvs_stop_channel(struct vc4_hvs *hvs, unsigned int chan)
+ {
+-	struct drm_device *drm = &hvs->vc4->base;
++	struct vc4_dev *vc4 = hvs->vc4;
++	struct drm_device *drm = &vc4->base;
+ 	int idx;
+ 
++	WARN_ON_ONCE(vc4->gen > VC4_GEN_5);
++
+ 	if (!drm_dev_enter(drm, &idx))
+ 		return;
+ 
+@@ -740,6 +754,8 @@ static void __vc6_hvs_stop_channel(struc
+ 	struct drm_device *drm = &vc4->base;
+ 	int idx;
+ 
++	WARN_ON_ONCE(vc4->gen < VC4_GEN_6_C);
++
+ 	if (!drm_dev_enter(drm, &idx))
+ 		return;
+ 
+@@ -927,6 +943,8 @@ void vc4_hvs_atomic_flush(struct drm_crt
+ 	bool found = false;
+ 	int idx;
+ 
++	WARN_ON_ONCE(vc4->gen > VC4_GEN_6_D);
++
+ 	if (!drm_dev_enter(dev, &idx)) {
+ 		vc4_crtc_send_vblank(crtc);
+ 		return;
+@@ -1011,6 +1029,8 @@ void vc4_hvs_atomic_flush(struct drm_crt
+ 	if (crtc->state->color_mgmt_changed) {
+ 		u32 dispbkgndx = HVS_READ(SCALER_DISPBKGNDX(channel));
+ 
++		WARN_ON_ONCE(vc4->gen > VC4_GEN_5);
++
+ 		if (crtc->state->gamma_lut) {
+ 			vc4_hvs_update_gamma_lut(hvs, vc4_crtc);
+ 			dispbkgndx |= SCALER_DISPBKGND_GAMMA;
+@@ -1040,6 +1060,8 @@ void vc4_hvs_mask_underrun(struct vc4_hv
+ 	u32 dispctrl;
+ 	int idx;
+ 
++	WARN_ON(vc4->gen > VC4_GEN_5);
++
+ 	if (!drm_dev_enter(drm, &idx))
+ 		return;
+ 
+@@ -1060,6 +1082,8 @@ void vc4_hvs_unmask_underrun(struct vc4_
+ 	u32 dispctrl;
+ 	int idx;
+ 
++	WARN_ON(vc4->gen > VC4_GEN_5);
++
+ 	if (!drm_dev_enter(drm, &idx))
+ 		return;
+ 
+@@ -1094,6 +1118,8 @@ static irqreturn_t vc4_hvs_irq_handler(i
+ 	u32 status;
+ 	u32 dspeislur;
+ 
++	WARN_ON(vc4->gen > VC4_GEN_5);
++
+ 	/*
+ 	 * NOTE: We don't need to protect the register access using
+ 	 * drm_dev_enter() there because the interrupt handler lifetime
+--- a/drivers/gpu/drm/vc4/vc4_kms.c
++++ b/drivers/gpu/drm/vc4/vc4_kms.c
+@@ -138,6 +138,8 @@ vc4_ctm_commit(struct vc4_dev *vc4, stru
+ 	struct vc4_ctm_state *ctm_state = to_vc4_ctm_state(vc4->ctm_manager.state);
+ 	struct drm_color_ctm *ctm = ctm_state->ctm;
+ 
++	WARN_ON_ONCE(vc4->gen > VC4_GEN_5);
++
+ 	if (ctm_state->fifo) {
+ 		HVS_WRITE(SCALER_OLEDCOEF2,
+ 			  VC4_SET_FIELD(vc4_ctm_s31_32_to_s0_9(ctm->matrix[0]),
+@@ -213,6 +215,8 @@ static void vc4_hvs_pv_muxing_commit(str
+ 	struct drm_crtc *crtc;
+ 	unsigned int i;
+ 
++	WARN_ON_ONCE(vc4->gen != VC4_GEN_4);
++
+ 	for_each_new_crtc_in_state(state, crtc, crtc_state, i) {
+ 		struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
+ 		struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(crtc_state);
+@@ -256,6 +260,8 @@ static void vc5_hvs_pv_muxing_commit(str
+ 	unsigned int i;
+ 	u32 reg;
+ 
++	WARN_ON_ONCE(vc4->gen != VC4_GEN_5);
++
+ 	for_each_new_crtc_in_state(state, crtc, crtc_state, i) {
+ 		struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(crtc_state);
+ 		struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -566,8 +566,11 @@ static int vc4_plane_setup_clipping_and_
+ 
+ static void vc4_write_tpz(struct vc4_plane_state *vc4_state, u32 src, u32 dst)
+ {
++	struct vc4_dev *vc4 = to_vc4_dev(vc4_state->base.plane->dev);
+ 	u32 scale, recip;
+ 
++	WARN_ON_ONCE(vc4->gen > VC4_GEN_6_D);
++
+ 	scale = src / dst;
+ 
+ 	/* The specs note that while the reciprocal would be defined
+@@ -593,10 +596,13 @@ static void vc4_write_tpz(struct vc4_pla
+ static void vc4_write_ppf(struct vc4_plane_state *vc4_state, u32 src, u32 dst,
+ 			  u32 xy, int channel)
+ {
++	struct vc4_dev *vc4 = to_vc4_dev(vc4_state->base.plane->dev);
+ 	u32 scale = src / dst;
+ 	s32 offset, offset2;
+ 	s32 phase;
+ 
++	WARN_ON_ONCE(vc4->gen > VC4_GEN_6_D);
++
+ 	/*
+ 	 * Start the phase at 1/2 pixel from the 1st pixel at src_x.
+ 	 * 1/4 pixel for YUV.
+@@ -825,8 +831,11 @@ static size_t vc6_upm_size(const struct
+ static void vc4_write_scaling_parameters(struct drm_plane_state *state,
+ 					 int channel)
+ {
++	struct vc4_dev *vc4 = to_vc4_dev(state->plane->dev);
+ 	struct vc4_plane_state *vc4_state = to_vc4_plane_state(state);
+ 
++	WARN_ON_ONCE(vc4->gen > VC4_GEN_6_D);
++
+ 	/* Ch0 H-PPF Word 0: Scaling Parameters */
+ 	if (vc4_state->x_scaling[channel] == VC4_SCALING_PPF) {
+ 		vc4_write_ppf(vc4_state, vc4_state->src_w[channel],
+@@ -1113,6 +1122,11 @@ static const u32 colorspace_coeffs[2][DR
+ 
+ static u32 vc4_hvs4_get_alpha_blend_mode(struct drm_plane_state *state)
+ {
++	struct drm_device *dev = state->state->dev;
++	struct vc4_dev *vc4 = to_vc4_dev(dev);
++
++	WARN_ON_ONCE(vc4->gen != VC4_GEN_4);
++
+ 	if (!state->fb->format->has_alpha)
+ 		return VC4_SET_FIELD(SCALER_POS2_ALPHA_MODE_FIXED,
+ 				     SCALER_POS2_ALPHA_MODE);
+@@ -1137,6 +1151,9 @@ static u32 vc4_hvs5_get_alpha_blend_mode
+ 	struct drm_device *dev = state->state->dev;
+ 	struct vc4_dev *vc4 = to_vc4_dev(dev);
+ 
++	WARN_ON_ONCE(vc4->gen != VC4_GEN_5 && vc4->gen != VC4_GEN_6_C &&
++		     vc4->gen != VC4_GEN_6_D);
++
+ 	switch (vc4->gen) {
+ 	default:
+ 	case VC4_GEN_5:
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0622-drm-vc4-Enable-bg_fill-if-there-are-no-planes-enable.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0622-drm-vc4-Enable-bg_fill-if-there-are-no-planes-enable.patch
new file mode 100644
index 00000000..566ced74
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0622-drm-vc4-Enable-bg_fill-if-there-are-no-planes-enable.patch
@@ -0,0 +1,32 @@
+From 2545c41cb176612d9ee860ad613eb55fb8e433de Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 25 Oct 2024 18:15:58 +0100
+Subject: [PATCH 622/697] drm/vc4: Enable bg_fill if there are no planes
+ enabled
+
+The default was to have enable_bg_fill disabled and the first
+plane set it if it wasn't opaque and covering the whole screen.
+However that meant that if no planes were enabled, then the
+background fill wasn't enabled, and would give a striped
+output from the uninitialised output buffer.
+
+Initialise it to enabled to avoid this.
+
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241025-drm-vc4-2712-support-v2-27-35efa83c8fc0@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -936,7 +936,7 @@ void vc4_hvs_atomic_flush(struct drm_crt
+ 	struct drm_plane *plane;
+ 	struct vc4_plane_state *vc4_plane_state;
+ 	bool debug_dump_regs = false;
+-	bool enable_bg_fill = false;
++	bool enable_bg_fill = true;
+ 	u32 __iomem *dlist_start = vc4->hvs->dlist + vc4_state->mm.start;
+ 	u32 __iomem *dlist_next = dlist_start;
+ 	unsigned int zpos = 0;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0623-drm-vc4-Drop-planes-that-are-completely-off-screen-o.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0623-drm-vc4-Drop-planes-that-are-completely-off-screen-o.patch
new file mode 100644
index 00000000..738eeb39
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0623-drm-vc4-Drop-planes-that-are-completely-off-screen-o.patch
@@ -0,0 +1,70 @@
+From 6205e9e5bef2556972e73d63df48cdad7272dcf7 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 25 Oct 2024 18:15:59 +0100
+Subject: [PATCH 623/697] drm/vc4: Drop planes that are completely off-screen
+ or 0 crtc size
+
+It is permitted for a plane to be configured such that none
+of it is on-screen via either negative dest rectangle X,Y
+offset, or an offset that is greater than the crtc dimensions.
+
+These planes were resized via drm_atomic_helper_check_plane_state
+such that the source rectangle had a zero width or height, but
+they still created a dlist entry even though they contributed
+no pixels. In the case of vc6_plane_mode_set, that it could result
+in negative values being written into registers, which caused
+incorrect behaviour.
+
+Drop planes that result in a source width or height of 0 pixels
+or an on-screen size of 0 pixels to avoid the incorrect rendering.
+
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241025-drm-vc4-2712-support-v2-28-35efa83c8fc0@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -1230,6 +1230,13 @@ static int vc4_plane_mode_set(struct drm
+ 	if (ret)
+ 		return ret;
+ 
++	if (!vc4_state->src_w[0] || !vc4_state->src_h[0] ||
++	    !vc4_state->crtc_w || !vc4_state->crtc_h) {
++		/* 0 source size probably means the plane is offscreen */
++		vc4_state->dlist_initialized = 1;
++		return 0;
++	}
++
+ 	width = vc4_state->src_w[0] >> 16;
+ 	height = vc4_state->src_h[0] >> 16;
+ 
+@@ -1753,6 +1760,15 @@ static int vc6_plane_mode_set(struct drm
+ 	if (ret)
+ 		return ret;
+ 
++	if (!vc4_state->src_w[0] || !vc4_state->src_h[0] ||
++	    !vc4_state->crtc_w || !vc4_state->crtc_h) {
++		/* 0 source size probably means the plane is offscreen.
++		 * 0 destination size is a redundant plane.
++		 */
++		vc4_state->dlist_initialized = 1;
++		return 0;
++	}
++
+ 	width = vc4_state->src_w[0] >> 16;
+ 	height = vc4_state->src_h[0] >> 16;
+ 
+@@ -2135,6 +2151,10 @@ static int vc4_plane_atomic_check(struct
+ 	if (ret)
+ 		return ret;
+ 
++	if (!vc4_state->src_w[0] || !vc4_state->src_h[0] ||
++	    !vc4_state->crtc_w || !vc4_state->crtc_h)
++		return 0;
++
+ 	ret = vc4_plane_allocate_lbm(new_plane_state);
+ 	if (ret)
+ 		return ret;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0624-dt-Disabled-vc4-by-default-on-2712.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0624-dt-Disabled-vc4-by-default-on-2712.patch
new file mode 100644
index 00000000..c65dc7b4
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0624-dt-Disabled-vc4-by-default-on-2712.patch
@@ -0,0 +1,19 @@
+From a1e746e2b093a9426f59d1b0f844d877f7f00ae2 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 4 Dec 2024 10:42:12 +0000
+Subject: [PATCH 624/697] dt: Disabled vc4 by default on 2712
+
+---
+ arch/arm64/boot/dts/broadcom/bcm2712-ds.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-ds.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-ds.dtsi
+@@ -471,6 +471,7 @@
+ 
+ 		vc4: gpu {
+ 			compatible = "brcm,bcm2712-vc6";
++			status = "disabled";
+ 		};
+ 
+ 		iommu2: iommu@5100 {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0625-arch-arm64-broadcom-Add-firmware-clocks-node.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0625-arch-arm64-broadcom-Add-firmware-clocks-node.patch
new file mode 100644
index 00000000..3decffab
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0625-arch-arm64-broadcom-Add-firmware-clocks-node.patch
@@ -0,0 +1,47 @@
+From 3d8f87028ce38cf123d5fc6842ffebc1b1a426f3 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 21 Jun 2024 18:17:44 +0100
+Subject: [PATCH 625/697] arch: arm64: broadcom: Add firmware clocks node
+
+BCM2712 still uses the firmware clocks driver, so add this to the
+base device tree.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../boot/dts/broadcom/bcm2712-rpi-5-b.dts     | 28 +++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b.dts
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b.dts
+@@ -706,3 +706,31 @@ spi10_cs_pins: &spi10_cs_gpio1 {};
+ 		sd_cqe = <&sdio1>, "supports-cqe?";
+ 	};
+ };
++
++&soc {
++	firmware: firmware {
++		compatible = "raspberrypi,bcm2835-firmware", "simple-mfd";
++		#address-cells = <1>;
++		#size-cells = <1>;
++
++		mboxes = <&mailbox>;
++		dma-ranges;
++
++		firmware_clocks: clocks {
++			compatible = "raspberrypi,firmware-clocks";
++			#clock-cells = <1>;
++		};
++
++		reset: reset {
++			compatible = "raspberrypi,firmware-reset";
++			#reset-cells = <1>;
++		};
++	};
++
++	power: power {
++		compatible = "raspberrypi,bcm2835-power";
++		firmware = <&firmware>;
++		#power-domain-cells = <1>;
++	};
++
++};
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0626-arm64-dts-broadcom-Add-display-pipeline-support-to-B.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0626-arm64-dts-broadcom-Add-display-pipeline-support-to-B.patch
new file mode 100644
index 00000000..da1d14f0
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0626-arm64-dts-broadcom-Add-display-pipeline-support-to-B.patch
@@ -0,0 +1,240 @@
+From 557adae2534a0e383563e6ae9f8017adbd11ac46 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 21 Jun 2024 16:59:51 +0100
+Subject: [PATCH 626/697] arm64: dts: broadcom: Add display pipeline support to
+ BCM2712
+
+Adds the HVS and associated hardware blocks to support the HDMI
+and writeback connectors on BCM2712 / Pi5.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../boot/dts/broadcom/bcm2712-rpi-5-b.dts     |  14 ++
+ arch/arm64/boot/dts/broadcom/bcm2712.dtsi     | 189 ++++++++++++++++++
+ 2 files changed, 203 insertions(+)
+
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b.dts
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b.dts
+@@ -732,5 +732,19 @@ spi10_cs_pins: &spi10_cs_gpio1 {};
+ 		firmware = <&firmware>;
+ 		#power-domain-cells = <1>;
+ 	};
++};
++
++&hvs {
++	clocks = <&firmware_clocks 4>, <&firmware_clocks 16>;
++	clock-names = "core", "disp";
++};
++
++&hdmi0 {
++	clocks = <&firmware_clocks 13>, <&firmware_clocks 14>, <&dvp 0>, <&clk_27MHz>;
++	clock-names = "hdmi", "bvb", "audio", "cec";
++};
+ 
++&hdmi1 {
++	clocks = <&firmware_clocks 13>, <&firmware_clocks 14>, <&dvp 1>, <&clk_27MHz>;
++	clock-names = "hdmi", "bvb", "audio", "cec";
+ };
+--- a/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
+@@ -265,6 +265,172 @@
+ 			interrupt-controller;
+ 			#interrupt-cells = <3>;
+ 		};
++
++		aon_intr: interrupt-controller@7d510600 {
++			compatible = "brcm,bcm2711-l2-intc", "brcm,l2-intc";
++			reg = <0x7d510600 0x30>;
++			interrupts = <GIC_SPI 239 IRQ_TYPE_LEVEL_HIGH>;
++			interrupt-controller;
++			#interrupt-cells = <1>;
++		};
++
++		pixelvalve0: pixelvalve@7c410000 {
++			compatible = "brcm,bcm2712-pixelvalve0";
++			reg = <0x7c410000 0x100>;
++			interrupts = <GIC_SPI 101 IRQ_TYPE_LEVEL_HIGH>;
++		};
++
++		pixelvalve1: pixelvalve@7c411000 {
++			compatible = "brcm,bcm2712-pixelvalve1";
++			reg = <0x7c411000 0x100>;
++			interrupts = <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH>;
++		};
++
++		mop: mop@7c500000 {
++			compatible = "brcm,bcm2712-mop";
++			reg = <0x7c500000 0x28>;
++			interrupt-parent = <&disp_intr>;
++			interrupts = <1>;
++		};
++
++		moplet: moplet@7c501000 {
++			compatible = "brcm,bcm2712-moplet";
++			reg = <0x7c501000 0x20>;
++			interrupt-parent = <&disp_intr>;
++			interrupts = <0>;
++		};
++
++		disp_intr: interrupt-controller@7c502000 {
++			compatible = "brcm,bcm2711-l2-intc", "brcm,l2-intc";
++			reg = <0x7c502000 0x30>;
++			interrupts = <GIC_SPI 97 IRQ_TYPE_LEVEL_HIGH>;
++			interrupt-controller;
++			#interrupt-cells = <1>;
++		};
++
++		dvp: clock@7c700000 {
++			compatible = "brcm,brcm2711-dvp";
++			reg = <0x7c700000 0x10>;
++			clocks = <&clk_108MHz>;
++			#clock-cells = <1>;
++			#reset-cells = <1>;
++		};
++
++		ddc0: i2c@7d508200 {
++			compatible = "brcm,brcmstb-i2c";
++			reg = <0x7d508200 0x58>;
++			interrupt-parent = <&bsc_irq>;
++			interrupts = <1>;
++			clock-frequency = <97500>;
++			#address-cells = <1>;
++			#size-cells = <0>;
++		};
++
++		ddc1: i2c@7d508280 {
++			compatible = "brcm,brcmstb-i2c";
++			reg = <0x7d508280 0x58>;
++			interrupt-parent = <&bsc_irq>;
++			interrupts = <2>;
++			clock-frequency = <97500>;
++			#address-cells = <1>;
++			#size-cells = <0>;
++		};
++
++		bsc_irq: intc@7d508380 {
++			compatible = "brcm,bcm7271-l2-intc";
++			reg = <0x7d508380 0x10>;
++			interrupts = <GIC_SPI 242 IRQ_TYPE_LEVEL_HIGH>;
++			interrupt-controller;
++			#interrupt-cells = <1>;
++		};
++
++		main_irq: intc@7d508400 {
++			compatible = "brcm,bcm7271-l2-intc";
++			reg = <0x7d508400 0x10>;
++			interrupts = <GIC_SPI 244 IRQ_TYPE_LEVEL_HIGH>;
++			interrupt-controller;
++			#interrupt-cells = <1>;
++		};
++
++		hdmi0: hdmi@7ef00700 {
++			compatible = "brcm,bcm2712-hdmi0";
++			reg = <0x7c701400 0x300>,
++			      <0x7c701000 0x200>,
++			      <0x7c701d00 0x300>,
++			      <0x7c702000 0x80>,
++			      <0x7c703800 0x200>,
++			      <0x7c704000 0x800>,
++			      <0x7c700100 0x80>,
++			      <0x7d510800 0x100>,
++			      <0x7c720000 0x100>;
++			reg-names = "hdmi",
++				    "dvp",
++				    "phy",
++				    "rm",
++				    "packet",
++				    "metadata",
++				    "csc",
++				    "cec",
++				    "hd";
++			resets = <&dvp 1>;
++			interrupt-parent = <&aon_intr>;
++			interrupts = <1>, <2>, <3>,
++				     <7>, <8>;
++			interrupt-names = "cec-tx", "cec-rx", "cec-low",
++					  "hpd-connected", "hpd-removed";
++			ddc = <&ddc0>;
++		};
++
++		hdmi1: hdmi@7ef05700 {
++			compatible = "brcm,bcm2712-hdmi1";
++			reg = <0x7c706400 0x300>,
++			      <0x7c706000 0x200>,
++			      <0x7c706d00 0x300>,
++			      <0x7c707000 0x80>,
++			      <0x7c708800 0x200>,
++			      <0x7c709000 0x800>,
++			      <0x7c700180 0x80>,
++			      <0x7d511000 0x100>,
++			      <0x7c720000 0x100>;
++			reg-names = "hdmi",
++				    "dvp",
++				    "phy",
++				    "rm",
++				    "packet",
++				    "metadata",
++				    "csc",
++				    "cec",
++				    "hd";
++			resets = <&dvp 2>;
++			interrupt-parent = <&aon_intr>;
++			interrupts = <11>, <12>, <13>,
++				     <14>, <15>;
++			interrupt-names = "cec-tx", "cec-rx", "cec-low",
++					  "hpd-connected", "hpd-removed";
++			ddc = <&ddc1>;
++		};
++	};
++
++	axi: axi {
++		compatible = "simple-bus";
++		#address-cells = <2>;
++		#size-cells = <2>;
++
++		ranges = <0x00 0x00000000  0x00 0x00000000  0x10 0x00000000>,
++			 <0x10 0x00000000  0x10 0x00000000  0x01 0x00000000>,
++			 <0x14 0x00000000  0x14 0x00000000  0x04 0x00000000>,
++			 <0x18 0x00000000  0x18 0x00000000  0x04 0x00000000>,
++			 <0x1c 0x00000000  0x1c 0x00000000  0x04 0x00000000>;
++
++		dma-ranges = <0x00 0x00000000  0x00 0x00000000  0x10 0x00000000>,
++			     <0x10 0x00000000  0x10 0x00000000  0x01 0x00000000>,
++			     <0x14 0x00000000  0x14 0x00000000  0x04 0x00000000>,
++			     <0x18 0x00000000  0x18 0x00000000  0x04 0x00000000>,
++			     <0x1c 0x00000000  0x1c 0x00000000  0x04 0x00000000>;
++
++		vc4: gpu {
++			compatible = "brcm,bcm2712-vc6";
++		};
+ 	};
+ 
+ 	timer {
+@@ -280,4 +446,27 @@
+ 			     <GIC_PPI 12 (GIC_CPU_MASK_SIMPLE(4) |
+ 					  IRQ_TYPE_LEVEL_LOW)>;
+ 	};
++
++	clk_27MHz: clk-27M {
++		#clock-cells = <0>;
++		compatible = "fixed-clock";
++		clock-frequency = <27000000>;
++		clock-output-names = "27MHz-clock";
++	};
++
++	clk_108MHz: clk-108M {
++		#clock-cells = <0>;
++		compatible = "fixed-clock";
++		clock-frequency = <108000000>;
++		clock-output-names = "108MHz-clock";
++	};
++
++	hvs: hvs@107c580000 {
++		compatible = "brcm,bcm2712-hvs";
++		reg = <0x10 0x7c580000 0x0 0x1a000>;
++		interrupt-parent = <&disp_intr>;
++		interrupts = <2>, <9>, <16>;
++		interrupt-names = "ch0-eof", "ch1-eof", "ch2-eof";
++		//iommus = <&iommu4>;
++	};
+ };
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0627-arm64-dts-broadcom-Add-DT-for-D-step-version-of-BCM2.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0627-arm64-dts-broadcom-Add-DT-for-D-step-version-of-BCM2.patch
new file mode 100644
index 00000000..f5af7548
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0627-arm64-dts-broadcom-Add-DT-for-D-step-version-of-BCM2.patch
@@ -0,0 +1,68 @@
+From f6ee9cc483bdea4b27f67878b91b24c0a529272d Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 3 Oct 2024 18:08:42 +0100
+Subject: [PATCH 627/697] arm64: dts: broadcom: Add DT for D-step version of
+ BCM2712
+
+The D-Step has some minor variations in the hardware, so needs
+matching changes to DT.
+
+Add a new DTS file that modifies the existing (C-step) devicetree.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/Makefile         |  1 +
+ .../boot/dts/broadcom/bcm2712-d-rpi-5-b.dts   | 37 +++++++++++++++++++
+ 2 files changed, 38 insertions(+)
+ create mode 100644 arch/arm64/boot/dts/broadcom/bcm2712-d-rpi-5-b.dts
+
+--- a/arch/arm64/boot/dts/broadcom/Makefile
++++ b/arch/arm64/boot/dts/broadcom/Makefile
+@@ -7,6 +7,7 @@ dtb-$(CONFIG_ARCH_BCM2835) += bcm2711-rp
+ 			      bcm2711-rpi-4-b.dtb \
+ 			      bcm2711-rpi-cm4-io.dtb \
+ 			      bcm2712-rpi-5-b.dtb \
++			      bcm2712-d-rpi-5-b.dtb \
+ 			      bcm2837-rpi-3-a-plus.dtb \
+ 			      bcm2837-rpi-3-b.dtb \
+ 			      bcm2837-rpi-3-b-plus.dtb \
+--- /dev/null
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-d-rpi-5-b.dts
+@@ -0,0 +1,37 @@
++// SPDX-License-Identifier: (GPL-2.0 OR MIT)
++/dts-v1/;
++
++#include "bcm2712-rpi-5-b.dts"
++
++&gio_aon {
++	brcm,gpio-bank-widths = <15 6>;
++
++	gpio-line-names =
++		"RP1_SDA", // AON_GPIO_00
++		"RP1_SCL", // AON_GPIO_01
++		"RP1_RUN", // AON_GPIO_02
++		"SD_IOVDD_SEL", // AON_GPIO_03
++		"SD_PWR_ON", // AON_GPIO_04
++		"SD_CDET_N", // AON_GPIO_05
++		"SD_FLG_N", // AON_GPIO_06
++		"", // AON_GPIO_07
++		"2712_WAKE", // AON_GPIO_08
++		"2712_STAT_LED", // AON_GPIO_09
++		"", // AON_GPIO_10
++		"", // AON_GPIO_11
++		"PMIC_INT", // AON_GPIO_12
++		"UART_TX_FS", // AON_GPIO_13
++		"UART_RX_FS", // AON_GPIO_14
++		"", // AON_GPIO_15
++		"", // AON_GPIO_16
++
++		// Pad bank0 out to 32 entries
++		"", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
++
++		"HDMI0_SCL", // AON_SGPIO_00
++		"HDMI0_SDA", // AON_SGPIO_01
++		"HDMI1_SCL", // AON_SGPIO_02
++		"HDMI1_SDA", // AON_SGPIO_03
++		"PMIC_SCL", // AON_SGPIO_04
++		"PMIC_SDA"; // AON_SGPIO_05
++};
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0628-arm64-dts-broadcom-Fixup-downstream-DT-changes-due-t.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0628-arm64-dts-broadcom-Fixup-downstream-DT-changes-due-t.patch
new file mode 100644
index 00000000..3cdf124b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0628-arm64-dts-broadcom-Fixup-downstream-DT-changes-due-t.patch
@@ -0,0 +1,303 @@
+From 2f8ba990cfd63b9f37576f71590266e1fd7debf2 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 4 Dec 2024 11:52:19 +0000
+Subject: [PATCH 628/697] arm64: dts: broadcom: Fixup downstream DT changes due
+ to DRM merge
+
+Now we have a load of the DRM nodes in the base bcm2712.dtsi
+file, remove them from the downstream file.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/bcm2712-ds.dtsi  | 205 ++++--------------
+ .../boot/dts/broadcom/bcm2712-rpi-5-b.dts     |  27 ---
+ 2 files changed, 44 insertions(+), 188 deletions(-)
+
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-ds.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-ds.dtsi
+@@ -43,20 +43,6 @@
+ 			clock-output-names = "otg";
+ 			clock-frequency = <480000000>;
+ 		};
+-
+-		clk_27MHz: clk-27M {
+-			#clock-cells = <0>;
+-			compatible = "fixed-clock";
+-			clock-frequency = <27000000>;
+-			clock-output-names = "27MHz-clock";
+-		};
+-
+-		clk_108MHz: clk-108M {
+-			#clock-cells = <0>;
+-			compatible = "fixed-clock";
+-			clock-frequency = <108000000>;
+-			clock-output-names = "108MHz-clock";
+-		};
+ 	};
+ 
+ 	thermal-zones {
+@@ -112,53 +98,6 @@
+ 		status = "disabled";
+ 	};
+ 
+-	pixelvalve0: pixelvalve@7c410000 {
+-		compatible = "brcm,bcm2712-pixelvalve0";
+-		reg = <0x7c410000 0x100>;
+-		interrupts = <GIC_SPI 101 IRQ_TYPE_LEVEL_HIGH>;
+-		status = "disabled";
+-	};
+-
+-	pixelvalve1: pixelvalve@7c411000 {
+-		compatible = "brcm,bcm2712-pixelvalve1";
+-		reg = <0x7c411000 0x100>;
+-		interrupts = <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH>;
+-		status = "disabled";
+-	};
+-
+-	mop: mop@7c500000 {
+-		compatible = "brcm,bcm2712-mop";
+-		reg = <0x7c500000 0x28>;
+-		interrupt-parent = <&disp_intr>;
+-		interrupts = <1>;
+-		status = "disabled";
+-	};
+-
+-	moplet: moplet@7c501000 {
+-		compatible = "brcm,bcm2712-moplet";
+-		reg = <0x7c501000 0x20>;
+-		interrupt-parent = <&disp_intr>;
+-		interrupts = <0>;
+-		status = "disabled";
+-	};
+-
+-	disp_intr: interrupt-controller@7c502000 {
+-		compatible = "brcm,bcm2711-l2-intc", "brcm,l2-intc";
+-		reg = <0x7c502000 0x30>;
+-		interrupts = <GIC_SPI 97 IRQ_TYPE_LEVEL_HIGH>;
+-		interrupt-controller;
+-		#interrupt-cells = <1>;
+-		status = "disabled";
+-	};
+-
+-	dvp: clock@7c700000 {
+-		compatible = "brcm,brcm2711-dvp";
+-		reg = <0x7c700000 0x10>;
+-		clocks = <&clk_108MHz>;
+-		#clock-cells = <1>;
+-		#reset-cells = <1>;
+-	};
+-
+ 	spi10: spi@7d004000 {
+ 		compatible = "brcm,bcm2835-spi";
+ 		reg = <0x7d004000 0x200>;
+@@ -249,28 +188,6 @@
+ 		};
+ 	};
+ 
+-	ddc0: i2c@7d508200 {
+-		compatible = "brcm,brcmstb-i2c";
+-		reg = <0x7d508200 0x58>;
+-		interrupt-parent = <&bsc_irq>;
+-		interrupts = <1>;
+-		clock-frequency = <97500>;
+-		#address-cells = <1>;
+-		#size-cells = <0>;
+-		status = "disabled";
+-	};
+-
+-	ddc1: i2c@7d508280 {
+-		compatible = "brcm,brcmstb-i2c";
+-		reg = <0x7d508280 0x58>;
+-		interrupt-parent = <&bsc_irq>;
+-		interrupts = <2>;
+-		clock-frequency = <97500>;
+-		#address-cells = <1>;
+-		#size-cells = <0>;
+-		status = "disabled";
+-	};
+-
+ 	bsc_irq: intc@7d508380 {
+ 		compatible = "brcm,bcm7271-l2-intc";
+ 		reg = <0x7d508380 0x10>;
+@@ -385,70 +302,6 @@
+ 			#thermal-sensor-cells = <0>;
+ 		};
+ 	};
+-
+-	hdmi0: hdmi@7ef00700 {
+-		compatible = "brcm,bcm2712-hdmi0";
+-		reg = <0x7c701400 0x300>,
+-				<0x7c701000 0x200>,
+-				<0x7c701d00 0x300>,
+-				<0x7c702000 0x80>,
+-				<0x7c703800 0x200>,
+-				<0x7c704000 0x800>,
+-				<0x7c700100 0x80>,
+-				<0x7d510800 0x100>,
+-				<0x7c720000 0x100>;
+-		reg-names = "hdmi",
+-				"dvp",
+-				"phy",
+-				"rm",
+-				"packet",
+-				"metadata",
+-				"csc",
+-				"cec",
+-				"hd";
+-		resets = <&dvp 1>;
+-		interrupt-parent = <&aon_intr>;
+-		interrupts = <1>, <2>, <3>,
+-					<7>, <8>;
+-		interrupt-names = "cec-tx", "cec-rx", "cec-low",
+-					"hpd-connected", "hpd-removed";
+-		ddc = <&ddc0>;
+-		dmas = <&dma32 10>;
+-		dma-names = "audio-rx";
+-		status = "disabled";
+-	};
+-
+-	hdmi1: hdmi@7ef05700 {
+-		compatible = "brcm,bcm2712-hdmi1";
+-		reg = <0x7c706400 0x300>,
+-				<0x7c706000 0x200>,
+-				<0x7c706d00 0x300>,
+-				<0x7c707000 0x80>,
+-				<0x7c708800 0x200>,
+-				<0x7c709000 0x800>,
+-				<0x7c700180 0x80>,
+-				<0x7d511000 0x100>,
+-				<0x7c720000 0x100>;
+-		reg-names = "hdmi",
+-				"dvp",
+-				"phy",
+-				"rm",
+-				"packet",
+-				"metadata",
+-				"csc",
+-				"cec",
+-				"hd";
+-		ddc = <&ddc1>;
+-		resets = <&dvp 2>;
+-		interrupt-parent = <&aon_intr>;
+-		interrupts = <11>, <12>, <13>,
+-					<14>, <15>;
+-		interrupt-names = "cec-tx", "cec-rx", "cec-low",
+-					"hpd-connected", "hpd-removed";
+-		dmas = <&dma32 17>;
+-		dma-names = "audio-rx";
+-		status = "disabled";
+-	};
+ };
+ 
+ / {
+@@ -469,11 +322,6 @@
+ 			     <0x18 0x00000000  0x18 0x00000000  0x04 0x00000000>,
+ 			     <0x1c 0x00000000  0x1c 0x00000000  0x04 0x00000000>;
+ 
+-		vc4: gpu {
+-			compatible = "brcm,bcm2712-vc6";
+-			status = "disabled";
+-		};
+-
+ 		iommu2: iommu@5100 {
+ 			/* IOMMU2 for PISP-BE, HEVC; and (unused) H264 accelerators */
+ 			compatible = "brcm,bcm2712-iommu";
+@@ -805,18 +653,53 @@
+ 				     <GIC_SPI 249 IRQ_TYPE_LEVEL_HIGH>;
+ 			status = "disabled";
+ 		};
+-
+-		hvs: hvs@7c580000 {
+-			compatible = "brcm,bcm2712-hvs";
+-			reg = <0x10 0x7c580000  0x0 0x1a000>;
+-			interrupt-parent = <&disp_intr>;
+-			interrupts = <2>, <9>, <16>;
+-			interrupt-names = "ch0-eof", "ch1-eof", "ch2-eof";
+-			status = "disabled";
+-		};
+ 	};
+ };
+ 
+ &gio_aon {
+ 	brcm,gpio-direct;
+ };
++
++&hvs {
++	status = "disabled";
++};
++
++&hdmi0 {
++	status = "disabled";
++};
++
++&hdmi1 {
++	status = "disabled";
++};
++
++&pixelvalve0 {
++	status = "disabled";
++};
++
++&pixelvalve1 {
++	status = "disabled";
++};
++
++&mop {
++	status = "disabled";
++};
++
++&moplet {
++	status = "disabled";
++};
++
++&ddc0 {
++	status = "disabled";
++};
++
++&ddc1 {
++	status = "disabled";
++};
++
++&disp_intr {
++	status = "disabled";
++};
++
++&vc4 {
++	status = "disabled";
++};
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b.dts
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b.dts
+@@ -707,33 +707,6 @@ spi10_cs_pins: &spi10_cs_gpio1 {};
+ 	};
+ };
+ 
+-&soc {
+-	firmware: firmware {
+-		compatible = "raspberrypi,bcm2835-firmware", "simple-mfd";
+-		#address-cells = <1>;
+-		#size-cells = <1>;
+-
+-		mboxes = <&mailbox>;
+-		dma-ranges;
+-
+-		firmware_clocks: clocks {
+-			compatible = "raspberrypi,firmware-clocks";
+-			#clock-cells = <1>;
+-		};
+-
+-		reset: reset {
+-			compatible = "raspberrypi,firmware-reset";
+-			#reset-cells = <1>;
+-		};
+-	};
+-
+-	power: power {
+-		compatible = "raspberrypi,bcm2835-power";
+-		firmware = <&firmware>;
+-		#power-domain-cells = <1>;
+-	};
+-};
+-
+ &hvs {
+ 	clocks = <&firmware_clocks 4>, <&firmware_clocks 16>;
+ 	clock-names = "core", "disp";
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0629-dtoverlays-enable-gpu-node-from-vc4-kms-v3d-pi5.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0629-dtoverlays-enable-gpu-node-from-vc4-kms-v3d-pi5.patch
new file mode 100644
index 00000000..33bf6165
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0629-dtoverlays-enable-gpu-node-from-vc4-kms-v3d-pi5.patch
@@ -0,0 +1,19 @@
+From beced6efc407a36dffce6188cbbc8f4e027cc39e Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 4 Dec 2024 13:39:31 +0000
+Subject: [PATCH 629/697] dtoverlays: enable gpu node from vc4-kms-v3d-pi5
+
+---
+ arch/arm/boot/dts/overlays/vc4-kms-v3d-pi5-overlay.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/boot/dts/overlays/vc4-kms-v3d-pi5-overlay.dts
++++ b/arch/arm/boot/dts/overlays/vc4-kms-v3d-pi5-overlay.dts
+@@ -124,6 +124,7 @@
+ 	fragment@17 {
+ 		target = <&vc4>;
+ 		__overlay__  {
++			status = "okay";
+ 			/* IOMMU attaches here, where we allocate DMA buffers */
+ 			iommus = <&iommu4>;
+ 		};
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0630-drm-vc4-Use-phys-addresses-for-slave-DMA-config.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0630-drm-vc4-Use-phys-addresses-for-slave-DMA-config.patch
new file mode 100644
index 00000000..ad9b7e77
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0630-drm-vc4-Use-phys-addresses-for-slave-DMA-config.patch
@@ -0,0 +1,51 @@
+From 71aa8f204a8cbbaf83e4b37251b865bce4abe2c9 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 11 May 2023 16:08:15 +0100
+Subject: [PATCH 630/697] drm/vc4: Use phys addresses for slave DMA config
+
+Slave addresses for DMA are meant to be supplied as physical addresses
+(contrary to what struct snd_dmaengine_dai_dma_data does).
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 14 +++++---------
+ 1 file changed, 5 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -2257,7 +2257,7 @@ static int vc4_hdmi_audio_init(struct vc
+ 	struct snd_soc_card *card = &vc4_hdmi->audio.card;
+ 	struct device *dev = &vc4_hdmi->pdev->dev;
+ 	struct platform_device *codec_pdev;
+-	const __be32 *addr;
++	struct resource *iomem;
+ 	int index, len;
+ 	int ret;
+ 
+@@ -2293,22 +2293,18 @@ static int vc4_hdmi_audio_init(struct vc
+ 	}
+ 
+ 	/*
+-	 * Get the physical address of VC4_HD_MAI_DATA. We need to retrieve
+-	 * the bus address specified in the DT, because the physical address
+-	 * (the one returned by platform_get_resource()) is not appropriate
+-	 * for DMA transfers.
+-	 * This VC/MMU should probably be exposed to avoid this kind of hacks.
++	 * Get the physical address of VC4_HD_MAI_DATA.
+ 	 */
+ 	index = of_property_match_string(dev->of_node, "reg-names", "hd");
+ 	/* Before BCM2711, we don't have a named register range */
+ 	if (index < 0)
+ 		index = 1;
+ 
+-	addr = of_get_address(dev->of_node, index, NULL, NULL);
+-	if (!addr)
++	iomem = platform_get_resource(vc4_hdmi->pdev, IORESOURCE_MEM, index);
++	if (!iomem)
+ 		return -EINVAL;
+ 
+-	vc4_hdmi->audio.dma_data.addr = be32_to_cpup(addr) + mai_data->offset;
++	vc4_hdmi->audio.dma_data.addr = iomem->start + mai_data->offset;
+ 	vc4_hdmi->audio.dma_data.addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+ 	vc4_hdmi->audio.dma_data.maxburst = 2;
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0631-arm64-dts-broadcom-Fixup-HVS-address-for-downstream-.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0631-arm64-dts-broadcom-Fixup-HVS-address-for-downstream-.patch
new file mode 100644
index 00000000..1c116041
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0631-arm64-dts-broadcom-Fixup-HVS-address-for-downstream-.patch
@@ -0,0 +1,29 @@
+From 821d82eebb15adc853f1c6860445bce0f577c35a Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 4 Dec 2024 13:43:31 +0000
+Subject: [PATCH 631/697] arm64: dts: broadcom: Fixup HVS address for
+ downstream size-cells
+
+Downstream is setting #size-cells = <1> cf <2> for upstream.
+Update the HVS regs property to match.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/bcm2712.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
+@@ -463,10 +463,10 @@
+ 
+ 	hvs: hvs@107c580000 {
+ 		compatible = "brcm,bcm2712-hvs";
+-		reg = <0x10 0x7c580000 0x0 0x1a000>;
++		reg = <0x10 0x7c580000 0x1a000>;
+ 		interrupt-parent = <&disp_intr>;
+ 		interrupts = <2>, <9>, <16>;
+ 		interrupt-names = "ch0-eof", "ch1-eof", "ch2-eof";
+-		//iommus = <&iommu4>;
++		iommus = <&iommu4>;
+ 	};
+ };
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0632-drm-vc4-hvs-Defer-dlist-slots-deallocation.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0632-drm-vc4-hvs-Defer-dlist-slots-deallocation.patch
new file mode 100644
index 00000000..99a9f1c9
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0632-drm-vc4-hvs-Defer-dlist-slots-deallocation.patch
@@ -0,0 +1,634 @@
+From 1c4d209b23f5799ef89a72656b924017e26406df Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Thu, 16 Dec 2021 14:54:54 +0100
+Subject: [PATCH 632/697] drm/vc4: hvs: Defer dlist slots deallocation
+
+During normal operations, the cursor position update is done through an
+asynchronous plane update, which on the vc4 driver basically just
+modifies the right dlist word to move the plane to the new coordinates.
+
+However, when we have the overscan margins setup, we fall back to a
+regular commit when we are next to the edges. And since that commit
+happens to be on a cursor plane, it's considered a legacy cursor update
+by KMS.
+
+The main difference it makes is that it won't wait for its completion
+(ie, next vblank) before returning. This means if we have multiple
+commits happening in rapid succession, we can have several of them
+happening before the next vblank.
+
+In parallel, our dlist allocation is tied to a CRTC state, and each time
+we do a commit we end up with a new CRTC state, with the previous one
+being freed. This means that we free our previous dlist entry (but don't
+clear it though) every time a new one is being committed.
+
+Now, if we were to have two commits happening before the next vblank, we
+could end up freeing reusing the same dlist entries before the next
+vblank.
+
+Indeed, we would start from an initial state taking, for example, the
+dlist entries 10 to 20, then start a commit taking the entries 20 to 30
+and setting the dlist pointer to 20, and freeing the dlist entries 10 to
+20. However, since we haven't reach vblank yet, the HVS is still using
+the entries 10 to 20.
+
+If we were to make a new commit now, chances are the allocator are going
+to give the 10 to 20 entries back, and we would change their content to
+match the new state. If vblank hasn't happened yet, we just corrupted
+the active dlist entries.
+
+A first attempt to solve this was made by creating an intermediate dlist
+buffer to store the current (ie, as of the last commit) dlist content,
+that we would update each time the HVS is done with a frame. However, if
+the interrupt handler missed the vblank window, we would end up copying
+our intermediate dlist to the hardware one during the composition,
+essentially creating the same issue.
+
+Since making sure that our interrupt handler runs within a fixed,
+constrained, time window would require to make Linux a real-time kernel,
+this seems a bit out of scope.
+
+Instead, we can work around our original issue by keeping the dlist
+slots allocation longer. That way, we won't reuse a dlist slot while
+it's still in flight. In order to achieve this, instead of freeing the
+dlist slot when its associated CRTC state is destroyed, we'll queue it
+in a list.
+
+A naive implementation would free the buffers in that queue when we get
+our end of frame interrupt. However, there's still a race since, just
+like in the shadow dlist case, we don't control when the handler for
+that interrupt is going to run. Thus, we can end up with a commit adding
+an old dlist allocation to our queue during the window between our
+actual interrupt and when our handler will run. And since that buffer is
+still being used for the composition of the current frame, we can't free
+it right away, exposing us to the original bug.
+
+Fortunately for us, the hardware provides a frame counter that is
+increased each time the first line of a frame is being generated.
+Associating the frame counter the image is supposed to go away to the
+allocation, and then only deallocate buffers that have a counter below
+or equal to the one we see when the deallocation code should prevent the
+above race from occurring.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c |  12 +-
+ drivers/gpu/drm/vc4/vc4_drv.h  |  22 +-
+ drivers/gpu/drm/vc4/vc4_hvs.c  | 369 +++++++++++++++++++++++++++++++--
+ 3 files changed, 376 insertions(+), 27 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -640,6 +640,8 @@ static void vc4_crtc_atomic_disable(stru
+ 
+ 	vc4_crtc_disable(crtc, encoder, state, old_vc4_state->assigned_channel);
+ 
++	vc4_hvs_atomic_disable(crtc, state);
++
+ 	/*
+ 	 * Make sure we issue a vblank event after disabling the CRTC if
+ 	 * someone was waiting it.
+@@ -1126,14 +1128,8 @@ void vc4_crtc_destroy_state(struct drm_c
+ 	struct vc4_dev *vc4 = to_vc4_dev(crtc->dev);
+ 	struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(state);
+ 
+-	if (drm_mm_node_allocated(&vc4_state->mm)) {
+-		unsigned long flags;
+-
+-		spin_lock_irqsave(&vc4->hvs->mm_lock, flags);
+-		drm_mm_remove_node(&vc4_state->mm);
+-		spin_unlock_irqrestore(&vc4->hvs->mm_lock, flags);
+-
+-	}
++	vc4_hvs_mark_dlist_entry_stale(vc4->hvs, vc4_state->mm);
++	vc4_state->mm = NULL;
+ 
+ 	drm_atomic_helper_crtc_destroy_state(crtc, state);
+ }
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -343,6 +343,11 @@ struct vc4_hvs {
+ 	struct clk *core_clk;
+ 	struct clk *disp_clk;
+ 
++	struct {
++		unsigned int desc;
++		unsigned int enabled: 1;
++	} eof_irq[HVS_NUM_CHANNELS];
++
+ 	unsigned long max_core_rate;
+ 
+ 	/* Memory manager for CRTCs to allocate space in the display
+@@ -360,6 +365,9 @@ struct vc4_hvs {
+ 
+ 	spinlock_t mm_lock;
+ 
++	struct list_head stale_dlist_entries;
++	struct work_struct free_dlist_work;
++
+ 	struct drm_mm_node mitchell_netravali_filter;
+ 
+ 	struct debugfs_regset32 regset;
+@@ -379,7 +387,6 @@ struct vc4_hvs {
+ 	bool vc5_hdmi_enable_4096by2160;
+ };
+ 
+-#define HVS_NUM_CHANNELS 3
+ #define HVS_UBM_WORD_SIZE 256
+ 
+ struct vc4_hvs_state {
+@@ -637,10 +644,17 @@ vc4_crtc_to_vc4_pv_data(const struct vc4
+ struct drm_encoder *vc4_get_crtc_encoder(struct drm_crtc *crtc,
+ 					 struct drm_crtc_state *state);
+ 
++struct vc4_hvs_dlist_allocation {
++	struct list_head node;
++	struct drm_mm_node mm_node;
++	unsigned int channel;
++	u8 target_frame_count;
++	bool dlist_programmed;
++};
++
+ struct vc4_crtc_state {
+ 	struct drm_crtc_state base;
+-	/* Dlist area for this CRTC configuration. */
+-	struct drm_mm_node mm;
++	struct vc4_hvs_dlist_allocation *mm;
+ 	bool txp_armed;
+ 	unsigned int assigned_channel;
+ 
+@@ -1055,6 +1069,8 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
+ void vc4_hvs_stop_channel(struct vc4_hvs *hvs, unsigned int output);
+ int vc4_hvs_get_fifo_from_output(struct vc4_hvs *hvs, unsigned int output);
+ u8 vc4_hvs_get_fifo_frame_count(struct vc4_hvs *hvs, unsigned int fifo);
++void vc4_hvs_mark_dlist_entry_stale(struct vc4_hvs *hvs,
++				    struct vc4_hvs_dlist_allocation *alloc);
+ int vc4_hvs_atomic_check(struct drm_crtc *crtc, struct drm_atomic_state *state);
+ void vc4_hvs_atomic_begin(struct drm_crtc *crtc, struct drm_atomic_state *state);
+ void vc4_hvs_atomic_enable(struct drm_crtc *crtc, struct drm_atomic_state *state);
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -470,6 +470,273 @@ static void vc4_hvs_update_gamma_lut(str
+ 	vc4_hvs_lut_load(hvs, vc4_crtc);
+ }
+ 
++static void vc4_hvs_irq_enable_eof(struct vc4_hvs *hvs,
++				   unsigned int channel)
++{
++	struct vc4_dev *vc4 = hvs->vc4;
++
++	if (hvs->eof_irq[channel].enabled)
++		return;
++
++	switch (vc4->gen) {
++	case VC4_GEN_4:
++		HVS_WRITE(SCALER_DISPCTRL,
++			  HVS_READ(SCALER_DISPCTRL) |
++			  SCALER_DISPCTRL_DSPEIEOF(channel));
++		break;
++
++	case VC4_GEN_5:
++		HVS_WRITE(SCALER_DISPCTRL,
++			  HVS_READ(SCALER_DISPCTRL) |
++			  SCALER5_DISPCTRL_DSPEIEOF(channel));
++		break;
++
++	case VC4_GEN_6_C:
++	case VC4_GEN_6_D:
++		enable_irq(hvs->eof_irq[channel].desc);
++		break;
++
++	default:
++		break;
++	}
++
++	hvs->eof_irq[channel].enabled = true;
++}
++
++static void vc4_hvs_irq_clear_eof(struct vc4_hvs *hvs,
++				  unsigned int channel)
++{
++	struct vc4_dev *vc4 = hvs->vc4;
++
++	if (!hvs->eof_irq[channel].enabled)
++		return;
++
++	switch (vc4->gen) {
++	case VC4_GEN_4:
++		HVS_WRITE(SCALER_DISPCTRL,
++			  HVS_READ(SCALER_DISPCTRL) &
++			  ~SCALER_DISPCTRL_DSPEIEOF(channel));
++		break;
++
++	case VC4_GEN_5:
++		HVS_WRITE(SCALER_DISPCTRL,
++			  HVS_READ(SCALER_DISPCTRL) &
++			  ~SCALER5_DISPCTRL_DSPEIEOF(channel));
++		break;
++
++	case VC4_GEN_6_C:
++	case VC4_GEN_6_D:
++		disable_irq_nosync(hvs->eof_irq[channel].desc);
++		break;
++
++	default:
++		break;
++	}
++
++	hvs->eof_irq[channel].enabled = false;
++}
++
++static void vc4_hvs_free_dlist_entry_locked(struct vc4_hvs *hvs,
++					    struct vc4_hvs_dlist_allocation *alloc);
++
++static struct vc4_hvs_dlist_allocation *
++vc4_hvs_alloc_dlist_entry(struct vc4_hvs *hvs,
++			  unsigned int channel,
++			  size_t dlist_count)
++{
++	struct vc4_dev *vc4 = hvs->vc4;
++	struct drm_device *dev = &vc4->base;
++	struct vc4_hvs_dlist_allocation *alloc;
++	struct vc4_hvs_dlist_allocation *cur, *next;
++	unsigned long flags;
++	int ret;
++
++	if (channel == VC4_HVS_CHANNEL_DISABLED)
++		return NULL;
++
++	alloc = kzalloc(sizeof(*alloc), GFP_KERNEL);
++	if (!alloc)
++		return ERR_PTR(-ENOMEM);
++
++	INIT_LIST_HEAD(&alloc->node);
++
++	spin_lock_irqsave(&hvs->mm_lock, flags);
++	ret = drm_mm_insert_node(&hvs->dlist_mm, &alloc->mm_node,
++				 dlist_count);
++	spin_unlock_irqrestore(&hvs->mm_lock, flags);
++
++	if (ret) {
++		drm_err(dev, "Failed to allocate DLIST entry. Requested size=%zu. ret=%d. DISPCTRL is %08x\n",
++			dlist_count, ret, HVS_READ(SCALER_DISPCTRL));
++
++		/* This should never happen as stale entries should get released
++		 * as the frame counter interrupt triggers.
++		 * However we've seen this fail for reasons currently unknown.
++		 * Free all stale entries now so we should be able to complete
++		 * this allocation.
++		 */
++		spin_lock_irqsave(&hvs->mm_lock, flags);
++		list_for_each_entry_safe(cur, next, &hvs->stale_dlist_entries, node) {
++			vc4_hvs_free_dlist_entry_locked(hvs, cur);
++		}
++
++		ret = drm_mm_insert_node(&hvs->dlist_mm, &alloc->mm_node,
++					 dlist_count);
++		spin_unlock_irqrestore(&hvs->mm_lock, flags);
++
++		if (ret)
++			return ERR_PTR(ret);
++	}
++
++	alloc->channel = channel;
++
++	return alloc;
++}
++
++static void vc4_hvs_free_dlist_entry_locked(struct vc4_hvs *hvs,
++					    struct vc4_hvs_dlist_allocation *alloc)
++{
++	lockdep_assert_held(&hvs->mm_lock);
++
++	if (!list_empty(&alloc->node))
++		list_del(&alloc->node);
++
++	drm_mm_remove_node(&alloc->mm_node);
++	kfree(alloc);
++}
++
++void vc4_hvs_mark_dlist_entry_stale(struct vc4_hvs *hvs,
++				    struct vc4_hvs_dlist_allocation *alloc)
++{
++	unsigned long flags;
++	u8 frcnt;
++
++	if (!alloc)
++		return;
++
++	if (!drm_mm_node_allocated(&alloc->mm_node))
++		return;
++
++	/*
++	 * Kunit tests run with a mock device and we consider any hardware
++	 * access a test failure. Let's free the dlist allocation right away if
++	 * we're running under kunit, we won't risk a dlist corruption anyway.
++	 *
++	 * Likewise if the allocation was only checked and never programmed, we
++	 * can destroy the allocation immediately.
++	 */
++	if (kunit_get_current_test() || !alloc->dlist_programmed) {
++		spin_lock_irqsave(&hvs->mm_lock, flags);
++		vc4_hvs_free_dlist_entry_locked(hvs, alloc);
++		spin_unlock_irqrestore(&hvs->mm_lock, flags);
++		return;
++	}
++
++	frcnt = vc4_hvs_get_fifo_frame_count(hvs, alloc->channel);
++	alloc->target_frame_count = (frcnt + 1) & ((1 << 6) - 1);
++
++	spin_lock_irqsave(&hvs->mm_lock, flags);
++
++	list_add_tail(&alloc->node, &hvs->stale_dlist_entries);
++
++	HVS_WRITE(SCALER_DISPSTAT, SCALER_DISPSTAT_EOF(alloc->channel));
++	vc4_hvs_irq_enable_eof(hvs, alloc->channel);
++
++	spin_unlock_irqrestore(&hvs->mm_lock, flags);
++}
++
++static void vc4_hvs_schedule_dlist_sweep(struct vc4_hvs *hvs,
++					 unsigned int channel)
++{
++	unsigned long flags;
++
++	spin_lock_irqsave(&hvs->mm_lock, flags);
++
++	if (!list_empty(&hvs->stale_dlist_entries))
++		queue_work(system_unbound_wq, &hvs->free_dlist_work);
++
++	if (list_empty(&hvs->stale_dlist_entries))
++		vc4_hvs_irq_clear_eof(hvs, channel);
++
++	spin_unlock_irqrestore(&hvs->mm_lock, flags);
++}
++
++/*
++ * Frame counts are essentially sequence numbers over 6 bits, and we
++ * thus can use sequence number arithmetic and follow the RFC1982 to
++ * implement proper comparison between them.
++ */
++static bool vc4_hvs_frcnt_lte(u8 cnt1, u8 cnt2)
++{
++	return (s8)((cnt1 << 2) - (cnt2 << 2)) <= 0;
++}
++
++static bool vc4_hvs_check_channel_active(struct vc4_hvs *hvs, unsigned int fifo)
++{
++	struct vc4_dev *vc4 = hvs->vc4;
++	struct drm_device *drm = &vc4->base;
++	bool enabled = false;
++	int idx;
++
++	if (!drm_dev_enter(drm, &idx))
++		return 0;
++
++	if (vc4->gen >= VC4_GEN_6_C)
++		enabled = HVS_READ(SCALER6_DISPX_CTRL0(fifo)) & SCALER6_DISPX_CTRL0_ENB;
++	else
++		enabled = HVS_READ(SCALER_DISPCTRLX(fifo)) & SCALER_DISPCTRLX_ENABLE;
++
++	drm_dev_exit(idx);
++	return enabled;
++}
++
++/*
++ * Some atomic commits (legacy cursor updates, mostly) will not wait for
++ * the next vblank and will just return once the commit has been pushed
++ * to the hardware.
++ *
++ * On the hardware side, our HVS stores the planes parameters in its
++ * context RAM, and will use part of the RAM to store data during the
++ * frame rendering.
++ *
++ * This interacts badly if we get multiple commits before the next
++ * vblank since we could end up overwriting the DLIST entries used by
++ * previous commits if our dlist allocation reuses that entry. In such a
++ * case, we would overwrite the data currently being used by the
++ * hardware, resulting in a corrupted frame.
++ *
++ * In order to work around this, we'll queue the dlist entries in a list
++ * once the associated CRTC state is destroyed. The HVS only allows us
++ * to know which entry is being active, but not which one are no longer
++ * being used, so in order to avoid freeing entries that are still used
++ * by the hardware we add a guesstimate of the frame count where our
++ * entry will no longer be used, and thus will only free those entries
++ * when we will have reached that frame count.
++ */
++static void vc4_hvs_dlist_free_work(struct work_struct *work)
++{
++	struct vc4_hvs *hvs = container_of(work, struct vc4_hvs, free_dlist_work);
++	struct vc4_hvs_dlist_allocation *cur, *next;
++	unsigned long flags;
++	bool active[3];
++	u8 frcnt[3];
++	int i;
++
++	spin_lock_irqsave(&hvs->mm_lock, flags);
++	for (i = 0; i < 3; i++) {
++		frcnt[i] = vc4_hvs_get_fifo_frame_count(hvs, i);
++		active[i] = vc4_hvs_check_channel_active(hvs, i);
++	}
++	list_for_each_entry_safe(cur, next, &hvs->stale_dlist_entries, node) {
++		if (active[cur->channel] &&
++		    !vc4_hvs_frcnt_lte(cur->target_frame_count, frcnt[cur->channel]))
++			continue;
++
++		vc4_hvs_free_dlist_entry_locked(hvs, cur);
++	}
++	spin_unlock_irqrestore(&hvs->mm_lock, flags);
++}
++
+ u8 vc4_hvs_get_fifo_frame_count(struct vc4_hvs *hvs, unsigned int fifo)
+ {
+ 	struct vc4_dev *vc4 = hvs->vc4;
+@@ -790,13 +1057,12 @@ int vc4_hvs_atomic_check(struct drm_crtc
+ {
+ 	struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
+ 	struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(crtc_state);
++	struct vc4_hvs_dlist_allocation *alloc;
+ 	struct drm_device *dev = crtc->dev;
+ 	struct vc4_dev *vc4 = to_vc4_dev(dev);
+ 	struct drm_plane *plane;
+-	unsigned long flags;
+ 	const struct drm_plane_state *plane_state;
+ 	u32 dlist_count = 0;
+-	int ret;
+ 
+ 	/* The pixelvalve can only feed one encoder (and encoders are
+ 	 * 1:1 with connectors.)
+@@ -819,14 +1085,11 @@ int vc4_hvs_atomic_check(struct drm_crtc
+ 
+ 	drm_dbg_driver(dev, "[CRTC:%d:%s] Allocating DLIST block with size: %u\n",
+ 		       crtc->base.id, crtc->name, dlist_count);
+-	spin_lock_irqsave(&vc4->hvs->mm_lock, flags);
+-	ret = drm_mm_insert_node(&vc4->hvs->dlist_mm, &vc4_state->mm,
+-				 dlist_count);
+-	spin_unlock_irqrestore(&vc4->hvs->mm_lock, flags);
+-	if (ret) {
+-		drm_err(dev, "Failed to allocate DLIST entry: %d\n", ret);
+-		return ret;
+-	}
++	alloc = vc4_hvs_alloc_dlist_entry(vc4->hvs, vc4_state->assigned_channel, dlist_count);
++	if (IS_ERR(alloc))
++		return PTR_ERR(alloc);
++
++	vc4_state->mm = alloc;
+ 
+ 	return 0;
+ }
+@@ -842,13 +1105,17 @@ static void vc4_hvs_install_dlist(struct
+ 	if (!drm_dev_enter(dev, &idx))
+ 		return;
+ 
++	WARN_ON(!vc4_state->mm);
++
++	vc4_state->mm->dlist_programmed = true;
++
+ 	if (vc4->gen >= VC4_GEN_6_C)
+ 		HVS_WRITE(SCALER6_DISPX_LPTRS(vc4_state->assigned_channel),
+-			  VC4_SET_FIELD(vc4_state->mm.start,
++			  VC4_SET_FIELD(vc4_state->mm->mm_node.start,
+ 					SCALER6_DISPX_LPTRS_HEADE));
+ 	else
+ 		HVS_WRITE(SCALER_DISPLISTX(vc4_state->assigned_channel),
+-			  vc4_state->mm.start);
++			  vc4_state->mm->mm_node.start);
+ 
+ 	drm_dev_exit(idx);
+ }
+@@ -875,8 +1142,10 @@ static void vc4_hvs_update_dlist(struct
+ 		spin_unlock_irqrestore(&dev->event_lock, flags);
+ 	}
+ 
++	WARN_ON(!vc4_state->mm);
++
+ 	spin_lock_irqsave(&vc4_crtc->irq_lock, flags);
+-	vc4_crtc->current_dlist = vc4_state->mm.start;
++	vc4_crtc->current_dlist = vc4_state->mm->mm_node.start;
+ 	spin_unlock_irqrestore(&vc4_crtc->irq_lock, flags);
+ }
+ 
+@@ -937,8 +1206,7 @@ void vc4_hvs_atomic_flush(struct drm_crt
+ 	struct vc4_plane_state *vc4_plane_state;
+ 	bool debug_dump_regs = false;
+ 	bool enable_bg_fill = true;
+-	u32 __iomem *dlist_start = vc4->hvs->dlist + vc4_state->mm.start;
+-	u32 __iomem *dlist_next = dlist_start;
++	u32 __iomem *dlist_start, *dlist_next;
+ 	unsigned int zpos = 0;
+ 	bool found = false;
+ 	int idx;
+@@ -958,6 +1226,9 @@ void vc4_hvs_atomic_flush(struct drm_crt
+ 		vc4_hvs_dump_state(hvs);
+ 	}
+ 
++	dlist_start = vc4->hvs->dlist + vc4_state->mm->mm_node.start;
++	dlist_next = dlist_start;
++
+ 	/* Copy all the active planes' dlist contents to the hardware dlist. */
+ 	do {
+ 		found = false;
+@@ -991,7 +1262,8 @@ void vc4_hvs_atomic_flush(struct drm_crt
+ 	writel(SCALER_CTL0_END, dlist_next);
+ 	dlist_next++;
+ 
+-	WARN_ON_ONCE(dlist_next - dlist_start != vc4_state->mm.size);
++	WARN_ON(!vc4_state->mm);
++	WARN_ON_ONCE(dlist_next - dlist_start != vc4_state->mm->mm_node.size);
+ 
+ 	if (vc4->gen >= VC4_GEN_6_C) {
+ 		/* This sets a black background color fill, as is the case
+@@ -1147,6 +1419,11 @@ static irqreturn_t vc4_hvs_irq_handler(i
+ 
+ 			irqret = IRQ_HANDLED;
+ 		}
++
++		if (status & SCALER_DISPSTAT_EOF(channel)) {
++			vc4_hvs_schedule_dlist_sweep(hvs, channel);
++			irqret = IRQ_HANDLED;
++		}
+ 	}
+ 
+ 	/* Clear every per-channel interrupt flag. */
+@@ -1157,6 +1434,27 @@ static irqreturn_t vc4_hvs_irq_handler(i
+ 	return irqret;
+ }
+ 
++static irqreturn_t vc6_hvs_eof_irq_handler(int irq, void *data)
++{
++	struct drm_device *dev = data;
++	struct vc4_dev *vc4 = to_vc4_dev(dev);
++	struct vc4_hvs *hvs = vc4->hvs;
++	unsigned int i;
++
++	for (i = 0; i < HVS_NUM_CHANNELS; i++) {
++		if (!hvs->eof_irq[i].enabled)
++			continue;
++
++		if (hvs->eof_irq[i].desc != irq)
++			continue;
++
++		vc4_hvs_schedule_dlist_sweep(hvs, i);
++		return IRQ_HANDLED;
++	}
++
++	return IRQ_NONE;
++}
++
+ int vc4_hvs_debugfs_init(struct drm_minor *minor)
+ {
+ 	struct drm_device *drm = minor->dev;
+@@ -1248,6 +1546,18 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
+ 
+ 	hvs->dlist_mem_size = dlist_size;
+ 
++	INIT_LIST_HEAD(&hvs->stale_dlist_entries);
++	INIT_WORK(&hvs->free_dlist_work, vc4_hvs_dlist_free_work);
++
++	/* Set up the HVS display list memory manager.  We never
++	 * overwrite the setup from the bootloader (just 128b out of
++	 * our 16K), since we don't want to scramble the screen when
++	 * transitioning from the firmware's boot setup to runtime.
++	 */
++	drm_mm_init(&hvs->dlist_mm,
++		    HVS_BOOTLOADER_DLIST_END,
++		    (SCALER_DLIST_SIZE >> 2) - HVS_BOOTLOADER_DLIST_END);
++
+ 	/* Set up the HVS LBM memory manager.  We could have some more
+ 	 * complicated data structure that allowed reuse of LBM areas
+ 	 * between planes when they don't overlap on the screen, but
+@@ -1743,6 +2053,33 @@ static int vc4_hvs_bind(struct device *d
+ 				       vc4_hvs_irq_handler, 0, "vc4 hvs", drm);
+ 		if (ret)
+ 			return ret;
++	} else {
++		unsigned int i;
++
++		for (i = 0; i < HVS_NUM_CHANNELS; i++) {
++			char irq_name[16];
++			int irq;
++
++			snprintf(irq_name, sizeof(irq_name), "ch%u-eof", i);
++
++			irq = platform_get_irq_byname(pdev, irq_name);
++			if (irq < 0) {
++				dev_err(&pdev->dev,
++					"Couldn't get %s interrupt: %d\n",
++					irq_name, irq);
++
++				return irq;
++			}
++
++			ret = devm_request_irq(&pdev->dev,
++					       irq,
++					       vc6_hvs_eof_irq_handler,
++					       IRQF_NO_AUTOEN,
++					       dev_name(&pdev->dev),
++					       drm);
++
++			hvs->eof_irq[i].desc = irq;
++		}
+ 	}
+ 
+ 	return 0;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0633-drm-vc4-Add-hvs_dlist_allocs-debugfs-function.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0633-drm-vc4-Add-hvs_dlist_allocs-debugfs-function.patch
new file mode 100644
index 00000000..55dde35e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0633-drm-vc4-Add-hvs_dlist_allocs-debugfs-function.patch
@@ -0,0 +1,61 @@
+From 5bef0efa7eea39373fba71fdd1c8d2cd4821ffda Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 27 Oct 2023 16:46:04 +0100
+Subject: [PATCH 633/697] drm/vc4: Add hvs_dlist_allocs debugfs function.
+
+Users are reporting running out of DLIST memory. Add a
+debugfs file to dump out all the allocations.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 32 ++++++++++++++++++++++++++++++++
+ 1 file changed, 32 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -349,6 +349,36 @@ static int vc6_hvs_debugfs_upm_allocs(st
+ 	return 0;
+ }
+ 
++static int vc4_hvs_debugfs_dlist_allocs(struct seq_file *m, void *data)
++{
++	struct drm_debugfs_entry *entry = m->private;
++	struct drm_device *dev = entry->dev;
++	struct vc4_dev *vc4 = to_vc4_dev(dev);
++	struct vc4_hvs *hvs = vc4->hvs;
++	struct drm_printer p = drm_seq_file_printer(m);
++	struct vc4_hvs_dlist_allocation *cur, *next;
++	struct drm_mm_node *mm_node;
++	unsigned long flags;
++
++	spin_lock_irqsave(&hvs->mm_lock, flags);
++
++	drm_printf(&p, "Allocated nodes:\n");
++	list_for_each_entry(mm_node, drm_mm_nodes(&hvs->dlist_mm), node_list) {
++		drm_printf(&p, "node [%08llx + %08llx]\n", mm_node->start, mm_node->size);
++	}
++
++	drm_printf(&p, "Stale nodes:\n");
++	list_for_each_entry_safe(cur, next, &hvs->stale_dlist_entries, node) {
++		drm_printf(&p, "node [%08llx + %08llx] channel %u frcnt %u\n",
++			   cur->mm_node.start, cur->mm_node.size, cur->channel,
++			   cur->target_frame_count);
++	}
++
++	spin_unlock_irqrestore(&hvs->mm_lock, flags);
++
++	return 0;
++}
++
+ /* The filter kernel is composed of dwords each containing 3 9-bit
+  * signed integers packed next to each other.
+  */
+@@ -1478,6 +1508,8 @@ int vc4_hvs_debugfs_init(struct drm_mino
+ 
+ 	drm_debugfs_add_file(drm, "hvs_underrun", vc4_hvs_debugfs_underrun, NULL);
+ 
++	drm_debugfs_add_file(drm, "hvs_dlist_allocs", vc4_hvs_debugfs_dlist_allocs, NULL);
++
+ 	vc4_debugfs_add_regset32(drm, "hvs_regs", &hvs->regset);
+ 
+ 	return 0;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0634-drm-vc4-Disable-overrun-interrupts.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0634-drm-vc4-Disable-overrun-interrupts.patch
new file mode 100644
index 00000000..a3cd4cbb
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0634-drm-vc4-Disable-overrun-interrupts.patch
@@ -0,0 +1,40 @@
+From 0dcdd8cdcac5404fbb399f4651d138498e7508c7 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 24 Jan 2024 16:35:11 +0000
+Subject: [PATCH 634/697] drm/vc4: Disable overrun interrupts
+
+We have a read-modify-write race when updating SCALER_DISPCTRL for
+underrun and end-of-frame interrupts.
+Ideally it would be fixed via a spinlock or similar, but that will
+require a reasonable amount of study to ensure we don't get deadlocks.
+
+The underrun reporting is only for debug, so disable it for now.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c | 2 +-
+ drivers/gpu/drm/vc4/vc4_kms.c  | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -852,7 +852,7 @@ static void vc4_crtc_handle_page_flip(st
+ 		 * the CRTC and encoder already reconfigured, leading to
+ 		 * underruns. This can be seen when reconfiguring the CRTC.
+ 		 */
+-		if (vc4->gen < VC4_GEN_6_C)
++		if (0 && vc4->gen < VC4_GEN_6_C)
+ 			vc4_hvs_unmask_underrun(hvs, chan);
+ 	}
+ 	spin_unlock(&vc4_crtc->irq_lock);
+--- a/drivers/gpu/drm/vc4/vc4_kms.c
++++ b/drivers/gpu/drm/vc4/vc4_kms.c
+@@ -391,7 +391,7 @@ static void vc4_atomic_commit_tail(struc
+ 	if (WARN_ON(IS_ERR(new_hvs_state)))
+ 		return;
+ 
+-	if (vc4->gen < VC4_GEN_6_C) {
++	if (0 && vc4->gen < VC4_GEN_6_C) {
+ 		struct drm_crtc_state *new_crtc_state;
+ 		struct drm_crtc *crtc;
+ 		int i;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0635-drm-vc4-Block-swiotlb-bounce-buffers-being-imported-.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0635-drm-vc4-Block-swiotlb-bounce-buffers-being-imported-.patch
new file mode 100644
index 00000000..dc8405b4
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0635-drm-vc4-Block-swiotlb-bounce-buffers-being-imported-.patch
@@ -0,0 +1,78 @@
+From 8b0bafcd3398bbcaa7bc0117b5fa274f363ad865 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 22 Nov 2023 19:17:44 +0000
+Subject: [PATCH 635/697] drm: vc4: Block swiotlb bounce buffers being imported
+ as dmabuf
+
+The dmabuf import already checks that the backing buffer is contiguous
+and rejects it if it isn't. vc4 also requires that the buffer is
+in the bottom 1GB of RAM, and this is all correctly defined via
+dma-ranges.
+
+However the kernel silently uses swiotlb to bounce dma buffers
+around if they are in the wrong region. This relies on dma sync
+functions to be called in order to copy the data to/from the
+bounce buffer.
+
+DRM is based on all memory allocations being coherent with the
+GPU so that any updates to a framebuffer will be acted on without
+the need for any additional update. This is fairly fundamentally
+incompatible with needing to call dma_sync_ to handle the bounce
+buffer copies, and therefore we have to detect and reject mappings
+that use bounce buffers.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_drv.c | 20 ++++++++++++++++++--
+ 1 file changed, 18 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_drv.c
++++ b/drivers/gpu/drm/vc4/vc4_drv.c
+@@ -29,6 +29,7 @@
+ #include <linux/of_device.h>
+ #include <linux/platform_device.h>
+ #include <linux/pm_runtime.h>
++#include <linux/dma-direct.h>
+ 
+ #include <drm/drm_aperture.h>
+ #include <drm/drm_atomic_helper.h>
+@@ -175,6 +176,19 @@ static void vc4_close(struct drm_device
+ 	kfree(vc4file);
+ }
+ 
++static struct drm_gem_object *
++vc4_prime_import_sg_table(struct drm_device *dev,
++			  struct dma_buf_attachment *attach,
++			  struct sg_table *sgt)
++{
++	phys_addr_t phys = dma_to_phys(dev->dev, sg_dma_address(sgt->sgl));
++
++	if (swiotlb_find_pool(dev->dev, phys))
++		return ERR_PTR(-EINVAL);
++
++	return drm_gem_dma_prime_import_sg_table(dev, attach, sgt);
++}
++
+ DEFINE_DRM_GEM_FOPS(vc4_drm_fops);
+ 
+ static const struct drm_ioctl_desc vc4_drm_ioctls[] = {
+@@ -211,7 +225,8 @@ const struct drm_driver vc4_drm_driver =
+ 
+ 	.gem_create_object = vc4_create_object,
+ 
+-	DRM_GEM_DMA_DRIVER_OPS_WITH_DUMB_CREATE(vc4_bo_dumb_create),
++	.dumb_create		= vc4_bo_dumb_create,
++	.gem_prime_import_sg_table = vc4_prime_import_sg_table,
+ 
+ 	.ioctls = vc4_drm_ioctls,
+ 	.num_ioctls = ARRAY_SIZE(vc4_drm_ioctls),
+@@ -234,7 +249,8 @@ const struct drm_driver vc5_drm_driver =
+ 	.debugfs_init = vc4_debugfs_init,
+ #endif
+ 
+-	DRM_GEM_DMA_DRIVER_OPS_WITH_DUMB_CREATE(vc5_dumb_create),
++	.dumb_create		= vc5_dumb_create,
++	.gem_prime_import_sg_table = vc4_prime_import_sg_table,
+ 
+ 	.fops = &vc4_drm_fops,
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0636-drm-vc4-Add-option-to-call-from-crtc-to-encoder-on-v.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0636-drm-vc4-Add-option-to-call-from-crtc-to-encoder-on-v.patch
new file mode 100644
index 00000000..809e6b7c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0636-drm-vc4-Add-option-to-call-from-crtc-to-encoder-on-v.patch
@@ -0,0 +1,60 @@
+From fd62b28c34b39e2bccb7fc25846de2c0e97ae17d Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 5 Apr 2024 17:34:09 +0100
+Subject: [PATCH 636/697] drm/vc4: Add option to call from crtc to encoder on
+ vblank
+
+DSI0 is misbehaving and needs to action things on vblank to
+work around it.
+Add a new hook to call across during vblank.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c | 12 +++++++++++-
+ drivers/gpu/drm/vc4/vc4_drv.h  |  1 +
+ 2 files changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -811,12 +811,15 @@ static void vc4_disable_vblank(struct dr
+ {
+ 	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
+ 	struct drm_device *dev = crtc->dev;
++	struct drm_encoder *encoder = vc4_get_crtc_encoder(crtc, crtc->state);
++	struct vc4_encoder *vc4_encoder = to_vc4_encoder(encoder);
+ 	int idx;
+ 
+ 	if (!drm_dev_enter(dev, &idx))
+ 		return;
+ 
+-	CRTC_WRITE(PV_INTEN, 0);
++	if (!vc4_encoder || vc4_encoder->type != VC4_ENCODER_TYPE_DSI0)
++		CRTC_WRITE(PV_INTEN, 0);
+ 
+ 	drm_dev_exit(idx);
+ }
+@@ -861,7 +864,14 @@ static void vc4_crtc_handle_page_flip(st
+ 
+ void vc4_crtc_handle_vblank(struct vc4_crtc *crtc)
+ {
++	struct drm_encoder *encoder = vc4_get_crtc_encoder(&crtc->base, crtc->base.state);
++	struct vc4_encoder *vc4_encoder = to_vc4_encoder(encoder);
++
+ 	crtc->t_vblank = ktime_get();
++
++	if (vc4_encoder && vc4_encoder->vblank)
++		vc4_encoder->vblank(encoder);
++
+ 	drm_crtc_handle_vblank(&crtc->base);
+ 	vc4_crtc_handle_page_flip(crtc);
+ }
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -512,6 +512,7 @@ struct vc4_encoder {
+ 
+ 	void (*post_crtc_disable)(struct drm_encoder *encoder, struct drm_atomic_state *state);
+ 	void (*post_crtc_powerdown)(struct drm_encoder *encoder, struct drm_atomic_state *state);
++	void (*vblank)(struct drm_encoder *encoder);
+ };
+ 
+ #define to_vc4_encoder(_encoder)				\
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0637-drm-vc4-dsi-Clocks-should-be-running-before-reset.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0637-drm-vc4-dsi-Clocks-should-be-running-before-reset.patch
new file mode 100644
index 00000000..d7cbef9c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0637-drm-vc4-dsi-Clocks-should-be-running-before-reset.patch
@@ -0,0 +1,60 @@
+From 083e5c4d246f0bebd8ba33e7ebecc24594e2e25a Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 8 Jun 2022 17:23:47 +0100
+Subject: [PATCH 637/697] drm: vc4: dsi: Clocks should be running before reset
+
+The initialisation sequence differs slightly from the documentation
+in that the clocks are meant to be running before resets and
+similar.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_dsi.c | 30 +++++++++++++++---------------
+ 1 file changed, 15 insertions(+), 15 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_dsi.c
++++ b/drivers/gpu/drm/vc4/vc4_dsi.c
+@@ -931,6 +931,21 @@ static void vc4_dsi_bridge_pre_enable(st
+ 			"Failed to set phy clock to %ld: %d\n", phy_clock, ret);
+ 	}
+ 
++	ret = clk_prepare_enable(dsi->escape_clock);
++	if (ret) {
++		drm_err(bridge->dev, "Failed to turn on DSI escape clock: %d\n",
++			ret);
++		return;
++	}
++
++	ret = clk_prepare_enable(dsi->pll_phy_clock);
++	if (ret) {
++		drm_err(bridge->dev, "Failed to turn on DSI PLL: %d\n", ret);
++		return;
++	}
++
++	hs_clock = clk_get_rate(dsi->pll_phy_clock);
++
+ 	/* Reset the DSI and all its fifos. */
+ 	DSI_PORT_WRITE(CTRL,
+ 		       DSI_CTRL_SOFT_RESET_CFG |
+@@ -989,21 +1004,6 @@ static void vc4_dsi_bridge_pre_enable(st
+ 		mdelay(1);
+ 	}
+ 
+-	ret = clk_prepare_enable(dsi->escape_clock);
+-	if (ret) {
+-		drm_err(bridge->dev, "Failed to turn on DSI escape clock: %d\n",
+-			ret);
+-		return;
+-	}
+-
+-	ret = clk_prepare_enable(dsi->pll_phy_clock);
+-	if (ret) {
+-		drm_err(bridge->dev, "Failed to turn on DSI PLL: %d\n", ret);
+-		return;
+-	}
+-
+-	hs_clock = clk_get_rate(dsi->pll_phy_clock);
+-
+ 	/* Yes, we set the DSI0P/DSI1P pixel clock to the byte rate,
+ 	 * not the pixel clock rate.  DSIxP take from the APHY's byte,
+ 	 * DDR2, or DDR4 clock (we use byte) and feed into the PV at
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0638-drm-vc4-Reset-DSI-AFE-on-disable.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0638-drm-vc4-Reset-DSI-AFE-on-disable.patch
new file mode 100644
index 00000000..f609b1e4
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0638-drm-vc4-Reset-DSI-AFE-on-disable.patch
@@ -0,0 +1,49 @@
+From dec8be269d4397f22fff87a6289e6a2612ba6596 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 26 May 2022 18:56:19 +0100
+Subject: [PATCH 638/697] drm: vc4: Reset DSI AFE on disable
+
+vc4_dsi_bridge_disable wasn't resetting things during shutdown,
+so add that in.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_dsi.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_dsi.c
++++ b/drivers/gpu/drm/vc4/vc4_dsi.c
+@@ -361,6 +361,16 @@
+ # define DSI_PHY_AFEC0_CTATADJ_MASK		VC4_MASK(3, 0)
+ # define DSI_PHY_AFEC0_CTATADJ_SHIFT		0
+ 
++# define DSI0_AFEC0_PD_ALL_LANES	(DSI0_PHY_AFEC0_PD | \
++					 DSI0_PHY_AFEC0_PD_BG | \
++					 DSI0_PHY_AFEC0_PD_DLANE1)
++
++# define DSI1_AFEC0_PD_ALL_LANES	(DSI1_PHY_AFEC0_PD | \
++					 DSI1_PHY_AFEC0_PD_BG | \
++					 DSI1_PHY_AFEC0_PD_DLANE3 | \
++					 DSI1_PHY_AFEC0_PD_DLANE2 | \
++					 DSI1_PHY_AFEC0_PD_DLANE1)
++
+ #define DSI0_PHY_AFEC1		0x68
+ # define DSI0_PHY_AFEC1_IDR_DLANE1_MASK		VC4_MASK(10, 8)
+ # define DSI0_PHY_AFEC1_IDR_DLANE1_SHIFT	8
+@@ -812,6 +822,16 @@ static void vc4_dsi_bridge_disable(struc
+ 	disp0_ctrl = DSI_PORT_READ(DISP0_CTRL);
+ 	disp0_ctrl &= ~DSI_DISP0_ENABLE;
+ 	DSI_PORT_WRITE(DISP0_CTRL, disp0_ctrl);
++
++	/* Reset the DSI and all its fifos. */
++	DSI_PORT_WRITE(CTRL, DSI_CTRL_SOFT_RESET_CFG |
++		       DSI_PORT_BIT(CTRL_RESET_FIFOS));
++
++	/* Power down the analogue front end. */
++	DSI_PORT_WRITE(PHY_AFEC0, DSI_PORT_BIT(PHY_AFEC0_RESET) |
++		       DSI_PORT_BIT(PHY_AFEC0_PD) |
++		       DSI_PORT_BIT(AFEC0_PD_ALL_LANES));
++
+ }
+ 
+ static void vc4_dsi_bridge_post_disable(struct drm_bridge *bridge,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0639-drm-vc4-Ensure-DSI-is-enabled-for-FIFO-resets.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0639-drm-vc4-Ensure-DSI-is-enabled-for-FIFO-resets.patch
new file mode 100644
index 00000000..c92d6390
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0639-drm-vc4-Ensure-DSI-is-enabled-for-FIFO-resets.patch
@@ -0,0 +1,57 @@
+From 43540f8218d291041f217404793a5808d188be1a Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 5 Apr 2024 17:51:55 +0100
+Subject: [PATCH 639/697] drm/vc4: Ensure DSI is enabled for FIFO resets
+
+The block must be enabled for the FIFO resets to be actioned,
+so ensure this is the case.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_dsi.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_dsi.c
++++ b/drivers/gpu/drm/vc4/vc4_dsi.c
+@@ -411,7 +411,8 @@
+ # define DSI1_CTRL_DISABLE_DISP_ECCC	BIT(1)
+ # define DSI0_CTRL_CTRL0		BIT(0)
+ # define DSI1_CTRL_EN			BIT(0)
+-# define DSI0_CTRL_RESET_FIFOS		(DSI_CTRL_CLR_LDF | \
++# define DSI0_CTRL_RESET_FIFOS		(DSI0_CTRL_CTRL0 | \
++					 DSI_CTRL_CLR_LDF | \
+ 					 DSI0_CTRL_CLR_PBCF | \
+ 					 DSI0_CTRL_CLR_CPBCF |	\
+ 					 DSI0_CTRL_CLR_PDF | \
+@@ -966,12 +967,17 @@ static void vc4_dsi_bridge_pre_enable(st
+ 
+ 	hs_clock = clk_get_rate(dsi->pll_phy_clock);
+ 
+-	/* Reset the DSI and all its fifos. */
++	/*
++	 * Reset the DSI and all its fifos. The block must be enabled for the
++	 * FIFO resets to trigger.
++	 */
+ 	DSI_PORT_WRITE(CTRL,
+ 		       DSI_CTRL_SOFT_RESET_CFG |
+ 		       DSI_PORT_BIT(CTRL_RESET_FIFOS));
+ 
+ 	DSI_PORT_WRITE(CTRL,
++		       ((dsi->variant->port == 0) ?
++					DSI0_CTRL_CTRL0 : DSI1_CTRL_EN) |
+ 		       DSI_CTRL_HSDT_EOT_DISABLE |
+ 		       DSI_CTRL_RX_LPDT_EOT_DISABLE);
+ 
+@@ -1145,12 +1151,6 @@ static void vc4_dsi_bridge_pre_enable(st
+ 					     DSI_DISP1_PFORMAT) |
+ 			       DSI_DISP1_ENABLE);
+ 
+-	/* Ungate the block. */
+-	if (dsi->variant->port == 0)
+-		DSI_PORT_WRITE(CTRL, DSI_PORT_READ(CTRL) | DSI0_CTRL_CTRL0);
+-	else
+-		DSI_PORT_WRITE(CTRL, DSI_PORT_READ(CTRL) | DSI1_CTRL_EN);
+-
+ 	/* Bring AFE out of reset. */
+ 	DSI_PORT_WRITE(PHY_AFEC0,
+ 		       DSI_PORT_READ(PHY_AFEC0) &
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0640-drm-vc4-Add-vblank-callback-to-DSI0-to-reset-FIFO.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0640-drm-vc4-Add-vblank-callback-to-DSI0-to-reset-FIFO.patch
new file mode 100644
index 00000000..07fbf325
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0640-drm-vc4-Add-vblank-callback-to-DSI0-to-reset-FIFO.patch
@@ -0,0 +1,42 @@
+From de67ab5f808d8228bbbb8c94bb8fc995046f775e Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 5 Apr 2024 17:40:05 +0100
+Subject: [PATCH 640/697] drm/vc4: Add vblank callback to DSI0 to reset FIFO
+
+The pixel to byte FIFO appears to not always reset correctly,
+which can lead to colour errors and/or horizontal shifts.
+Reset on every vblank to work around the issue.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_dsi.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_dsi.c
++++ b/drivers/gpu/drm/vc4/vc4_dsi.c
+@@ -1462,6 +1462,15 @@ static const struct drm_bridge_funcs vc4
+ 	.mode_fixup = vc4_dsi_bridge_mode_fixup,
+ };
+ 
++static void vc4_dsi_reset_fifo(struct drm_encoder *encoder)
++{
++	struct vc4_dsi *dsi = to_vc4_dsi(encoder);
++	u32 val;
++
++	val = DSI_PORT_READ(CTRL);
++	DSI_PORT_WRITE(CTRL, val | DSI0_CTRL_CLR_PBCF);
++}
++
+ static int vc4_dsi_late_register(struct drm_encoder *encoder)
+ {
+ 	struct drm_device *drm = encoder->dev;
+@@ -1710,6 +1719,9 @@ static int vc4_dsi_bind(struct device *d
+ 	dsi->encoder.type = dsi->variant->port ?
+ 		VC4_ENCODER_TYPE_DSI1 : VC4_ENCODER_TYPE_DSI0;
+ 
++	if (dsi->encoder.type == VC4_ENCODER_TYPE_DSI0)
++		dsi->encoder.vblank = vc4_dsi_reset_fifo;
++
+ 	dsi->regs = vc4_ioremap_regs(pdev, 0);
+ 	if (IS_ERR(dsi->regs))
+ 		return PTR_ERR(dsi->regs);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0641-drm-vc4-Fixup-mode-for-7inch-panel-on-DSI0.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0641-drm-vc4-Fixup-mode-for-7inch-panel-on-DSI0.patch
new file mode 100644
index 00000000..81acac8c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0641-drm-vc4-Fixup-mode-for-7inch-panel-on-DSI0.patch
@@ -0,0 +1,60 @@
+From c82222219729020790111b4dc560a5ef1125b0e9 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 26 Apr 2024 17:48:06 +0100
+Subject: [PATCH 641/697] drm/vc4: Fixup mode for 7inch panel on DSI0
+
+The TC358762 bridge and panel decodes the mode differently on
+DSI0 to DSI1 for no obvious reason, and results in a shift off
+the screen.
+Whilst it would be possible to change the compatible used for
+the panel, that then messes up Pi5.
+
+As it appears to be restricted to vc4 DSI0, fix up the mode
+in vc4_dsi.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_dsi.c | 22 +++++++++++++++++++---
+ 1 file changed, 19 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_dsi.c
++++ b/drivers/gpu/drm/vc4/vc4_dsi.c
+@@ -871,6 +871,7 @@ static bool vc4_dsi_bridge_mode_fixup(st
+ 	unsigned long pixel_clock_hz = mode->clock * 1000;
+ 	unsigned long pll_clock = pixel_clock_hz * dsi->divider;
+ 	int divider;
++	u16 htotal;
+ 
+ 	/* Find what divider gets us a faster clock than the requested
+ 	 * pixel clock.
+@@ -887,12 +888,27 @@ static bool vc4_dsi_bridge_mode_fixup(st
+ 	pixel_clock_hz = pll_clock / dsi->divider;
+ 
+ 	adjusted_mode->clock = pixel_clock_hz / 1000;
++	htotal = mode->htotal;
++
++	if (dsi->variant->port == 0 && mode->clock == 30000 &&
++	    mode->hdisplay == 800 && mode->htotal == (800 + 59 + 2 + 45) &&
++	    mode->vdisplay == 480 && mode->vtotal == (480 + 7 + 2 + 22)) {
++		/*
++		 * Raspberry Pi 7" panel via TC358762 seems to have an issue on
++		 * DSI0 that it doesn't actually follow the vertical timing that
++		 * is otherwise identical to that produced on DSI1.
++		 * Fixup the mode.
++		 */
++		htotal = 800 + 59 + 2 + 47;
++		adjusted_mode->vtotal = 480 + 7 + 2 + 45;
++		adjusted_mode->crtc_vtotal = 480 + 7 + 2 + 45;
++	}
+ 
+ 	/* Given the new pixel clock, adjust HFP to keep vrefresh the same. */
+-	adjusted_mode->htotal = adjusted_mode->clock * mode->htotal /
++	adjusted_mode->htotal = adjusted_mode->clock * htotal /
+ 				mode->clock;
+-	adjusted_mode->hsync_end += adjusted_mode->htotal - mode->htotal;
+-	adjusted_mode->hsync_start += adjusted_mode->htotal - mode->htotal;
++	adjusted_mode->hsync_end += adjusted_mode->htotal - htotal;
++	adjusted_mode->hsync_start += adjusted_mode->htotal - htotal;
+ 
+ 	return true;
+ }
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0642-drm-vc4-dsi-Don-t-reset-the-host-until-post_disable.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0642-drm-vc4-dsi-Don-t-reset-the-host-until-post_disable.patch
new file mode 100644
index 00000000..8701fe62
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0642-drm-vc4-dsi-Don-t-reset-the-host-until-post_disable.patch
@@ -0,0 +1,49 @@
+From 8f9bfac44c5cad6ff680653c7ed51f2b5ae2fd40 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 2 May 2024 12:03:58 +0100
+Subject: [PATCH 642/697] drm/vc4: dsi: Don't reset the host until post_disable
+
+Some DSI peripheral drivers wish to send commands in the
+post_disable or panel unprepare callback. These are called
+after the DSI host's disable call, but before the host's
+post_disable if pre_enable_prev_first is set.
+
+Don't reset the block until post_disable to allow these
+commands to be sent.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_dsi.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_dsi.c
++++ b/drivers/gpu/drm/vc4/vc4_dsi.c
+@@ -823,6 +823,13 @@ static void vc4_dsi_bridge_disable(struc
+ 	disp0_ctrl = DSI_PORT_READ(DISP0_CTRL);
+ 	disp0_ctrl &= ~DSI_DISP0_ENABLE;
+ 	DSI_PORT_WRITE(DISP0_CTRL, disp0_ctrl);
++}
++
++static void vc4_dsi_bridge_post_disable(struct drm_bridge *bridge,
++					struct drm_bridge_state *state)
++{
++	struct vc4_dsi *dsi = bridge_to_vc4_dsi(bridge);
++	struct device *dev = &dsi->pdev->dev;
+ 
+ 	/* Reset the DSI and all its fifos. */
+ 	DSI_PORT_WRITE(CTRL, DSI_CTRL_SOFT_RESET_CFG |
+@@ -833,14 +840,6 @@ static void vc4_dsi_bridge_disable(struc
+ 		       DSI_PORT_BIT(PHY_AFEC0_PD) |
+ 		       DSI_PORT_BIT(AFEC0_PD_ALL_LANES));
+ 
+-}
+-
+-static void vc4_dsi_bridge_post_disable(struct drm_bridge *bridge,
+-					struct drm_bridge_state *state)
+-{
+-	struct vc4_dsi *dsi = bridge_to_vc4_dsi(bridge);
+-	struct device *dev = &dsi->pdev->dev;
+-
+ 	clk_disable_unprepare(dsi->pll_phy_clock);
+ 	clk_disable_unprepare(dsi->escape_clock);
+ 	clk_disable_unprepare(dsi->pixel_clock);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0643-drm-vc4-dsi-enable-video-and-then-retry-failed-trans.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0643-drm-vc4-dsi-enable-video-and-then-retry-failed-trans.patch
new file mode 100644
index 00000000..cdb7ca47
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0643-drm-vc4-dsi-enable-video-and-then-retry-failed-trans.patch
@@ -0,0 +1,111 @@
+From fd37cc2d3e7f852ae96c326a321002b61de7ce3a Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 20 Sep 2024 12:05:18 +0100
+Subject: [PATCH 643/697] drm: vc4: dsi: enable video and then retry failed
+ transfers
+
+The DSI block appears to be able to come up stuck in a condition where
+it leaves the lanes in HS mode or just jabbering. This stops LP
+transfers from completing as there is no LP time available. This is
+signalled via the LP1 contention error.
+
+Enabling video briefly clears that condition, so if we detect the
+error condition, enable video mode and then retry.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_dsi.c | 54 +++++++++++++++++++++++++++++------
+ 1 file changed, 46 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_dsi.c
++++ b/drivers/gpu/drm/vc4/vc4_dsi.c
+@@ -289,6 +289,8 @@
+ 					 DSI1_INT_PR_TO)
+ 
+ #define DSI0_STAT		0x2c
++# define DSI0_STAT_ERR_CONT_LP1		BIT(6)
++# define DSI0_STAT_ERR_CONT_LP0		BIT(5)
+ #define DSI0_HSTX_TO_CNT	0x30
+ #define DSI0_LPRX_TO_CNT	0x34
+ #define DSI0_TA_TO_CNT		0x38
+@@ -1215,10 +1217,9 @@ static int vc4_dsi_bridge_attach(struct
+ 				 &dsi->bridge, flags);
+ }
+ 
+-static ssize_t vc4_dsi_host_transfer(struct mipi_dsi_host *host,
+-				     const struct mipi_dsi_msg *msg)
++static ssize_t vc4_dsi_transfer(struct vc4_dsi *dsi,
++				const struct mipi_dsi_msg *msg, bool log_error)
+ {
+-	struct vc4_dsi *dsi = host_to_dsi(host);
+ 	struct drm_device *drm = dsi->bridge.dev;
+ 	struct mipi_dsi_packet packet;
+ 	u32 pkth = 0, pktc = 0;
+@@ -1339,10 +1340,12 @@ static ssize_t vc4_dsi_host_transfer(str
+ 	DSI_PORT_WRITE(TXPKT1C, pktc);
+ 
+ 	if (!wait_for_completion_timeout(&dsi->xfer_completion,
+-					 msecs_to_jiffies(1000))) {
+-		dev_err(&dsi->pdev->dev, "transfer interrupt wait timeout");
+-		dev_err(&dsi->pdev->dev, "instat: 0x%08x\n",
+-			DSI_PORT_READ(INT_STAT));
++					 msecs_to_jiffies(500))) {
++		if (log_error) {
++			dev_err(&dsi->pdev->dev, "transfer interrupt wait timeout");
++			dev_err(&dsi->pdev->dev, "instat: 0x%08x, stat: 0x%08x\n",
++				DSI_PORT_READ(INT_STAT), DSI_PORT_READ(INT_STAT));
++		}
+ 		ret = -ETIMEDOUT;
+ 	} else {
+ 		ret = dsi->xfer_result;
+@@ -1385,7 +1388,8 @@ static ssize_t vc4_dsi_host_transfer(str
+ 	return ret;
+ 
+ reset_fifo_and_return:
+-	drm_err(drm, "DSI transfer failed, resetting: %d\n", ret);
++	if (log_error)
++		drm_err(drm, "DSI transfer failed, resetting: %d\n", ret);
+ 
+ 	DSI_PORT_WRITE(TXPKT1C, DSI_PORT_READ(TXPKT1C) & ~DSI_TXPKT1C_CMD_EN);
+ 	udelay(1);
+@@ -1398,6 +1402,40 @@ reset_fifo_and_return:
+ 	return ret;
+ }
+ 
++static ssize_t vc4_dsi_host_transfer(struct mipi_dsi_host *host,
++				     const struct mipi_dsi_msg *msg)
++{
++	struct vc4_dsi *dsi = host_to_dsi(host);
++	u32 stat, disp0_ctrl;
++	int ret;
++
++	ret = vc4_dsi_transfer(dsi, msg, false);
++
++	if (ret == -ETIMEDOUT) {
++		stat = DSI_PORT_READ(STAT);
++		disp0_ctrl = DSI_PORT_READ(DISP0_CTRL);
++
++		DSI_PORT_WRITE(STAT, DSI_PORT_BIT(STAT_ERR_CONT_LP1));
++		if (!(disp0_ctrl & DSI_DISP0_ENABLE)) {
++			/* If video mode not enabled, then try recovering by
++			 * enabling it briefly to clear FIFOs and the state.
++			 */
++			disp0_ctrl |= DSI_DISP0_ENABLE;
++			DSI_PORT_WRITE(DISP0_CTRL, disp0_ctrl);
++			msleep(30);
++			disp0_ctrl &= ~DSI_DISP0_ENABLE;
++			DSI_PORT_WRITE(DISP0_CTRL, disp0_ctrl);
++			msleep(30);
++
++			ret = vc4_dsi_transfer(dsi, msg, true);
++		} else {
++			DRM_ERROR("DSI transfer failed whilst in HS mode stat: 0x%08x\n",
++				  stat);
++		}
++	}
++	return ret;
++}
++
+ static const struct component_ops vc4_dsi_ops;
+ static int vc4_dsi_host_attach(struct mipi_dsi_host *host,
+ 			       struct mipi_dsi_device *device)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0644-drm-vc4-Allow-setting-the-TV-norm-via-module-paramet.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0644-drm-vc4-Allow-setting-the-TV-norm-via-module-paramet.patch
new file mode 100644
index 00000000..48f1b44e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0644-drm-vc4-Allow-setting-the-TV-norm-via-module-paramet.patch
@@ -0,0 +1,213 @@
+From b4c6181c3a830c39f4ac95587b03a1f8773617b4 Mon Sep 17 00:00:00 2001
+From: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
+Date: Thu, 15 Jul 2021 01:08:01 +0200
+Subject: [PATCH 644/697] drm/vc4: Allow setting the TV norm via module
+ parameter
+
+Similar to the ch7006 and nouveau drivers, introduce a "tv_mode" module
+parameter that allow setting the TV norm by specifying vc4.tv_norm= on
+the kernel command line.
+
+If that is not specified, try inferring one of the most popular norms
+(PAL or NTSC) from the video mode specified on the command line. On
+Raspberry Pis, this causes the most common cases of the sdtv_mode
+setting in config.txt to be respected.
+
+Signed-off-by: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
+
+drm/vc4: Do not reset tv mode as this is already handled by framework
+
+In vc4_vec_connector_reset, the tv mode is already reset to the
+property default by drm_atomic_helper_connector_tv_reset, so there
+is no need for a local fixup to potentially some other default.
+
+Fixes: 96922af14473 ("drm/vc4: Allow setting the TV norm via module parameter")
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_vec.c | 107 +++++++++++++++++++++++++---------
+ 1 file changed, 78 insertions(+), 29 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_vec.c
++++ b/drivers/gpu/drm/vc4/vc4_vec.c
+@@ -67,7 +67,7 @@
+ #define VEC_CONFIG0_YCDELAY		BIT(4)
+ #define VEC_CONFIG0_RAMPEN		BIT(2)
+ #define VEC_CONFIG0_YCDIS		BIT(2)
+-#define VEC_CONFIG0_STD_MASK		GENMASK(1, 0)
++#define VEC_CONFIG0_STD_MASK		(VEC_CONFIG0_SECAM_STD | GENMASK(1, 0))
+ #define VEC_CONFIG0_NTSC_STD		0
+ #define VEC_CONFIG0_PAL_BDGHI_STD	1
+ #define VEC_CONFIG0_PAL_M_STD		2
+@@ -186,6 +186,8 @@
+ #define VEC_DAC_MISC_DAC_RST_N		BIT(0)
+ 
+ 
++static char *vc4_vec_tv_norm;
++
+ struct vc4_vec_variant {
+ 	u32 dac_config;
+ };
+@@ -371,6 +373,33 @@ static const struct drm_prop_enum_list l
+ 	{ VC4_VEC_TV_MODE_MONOCHROME, "Mono", },
+ };
+ 
++static enum drm_connector_tv_mode
++vc4_vec_get_default_mode(struct drm_connector *connector)
++{
++	if (vc4_vec_tv_norm) {
++		int ret;
++
++		ret = drm_get_tv_mode_from_name(vc4_vec_tv_norm, strlen(vc4_vec_tv_norm));
++		if (ret >= 0)
++			return ret;
++	} else if (connector->cmdline_mode.specified &&
++		   ((connector->cmdline_mode.refresh_specified &&
++		     (connector->cmdline_mode.refresh == 25 ||
++		      connector->cmdline_mode.refresh == 50)) ||
++		    (!connector->cmdline_mode.refresh_specified &&
++		     (connector->cmdline_mode.yres == 288 ||
++		      connector->cmdline_mode.yres == 576)))) {
++		/*
++		 * no explicitly specified TV norm; use PAL if a mode that
++		 * looks like PAL has been specified on the command line
++		 */
++		return DRM_MODE_TV_MODE_PAL;
++	}
++
++	/* in all other cases, default to NTSC */
++	return DRM_MODE_TV_MODE_NTSC;
++}
++
+ static enum drm_connector_status
+ vc4_vec_connector_detect(struct drm_connector *connector, bool force)
+ {
+@@ -436,52 +465,55 @@ vc4_vec_connector_set_property(struct dr
+ }
+ 
+ static int
+-vc4_vec_connector_get_property(struct drm_connector *connector,
+-			       const struct drm_connector_state *state,
+-			       struct drm_property *property,
+-			       uint64_t *val)
++vc4_vec_generic_tv_mode_to_legacy(enum drm_connector_tv_mode tv_mode)
+ {
+-	struct vc4_vec *vec = connector_to_vc4_vec(connector);
+-
+-	if (property != vec->legacy_tv_mode_property)
+-		return -EINVAL;
+-
+-	switch (state->tv.mode) {
++	switch (tv_mode) {
+ 	case DRM_MODE_TV_MODE_NTSC:
+-		*val = VC4_VEC_TV_MODE_NTSC;
+-		break;
++		return VC4_VEC_TV_MODE_NTSC;
+ 
+ 	case DRM_MODE_TV_MODE_NTSC_443:
+-		*val = VC4_VEC_TV_MODE_NTSC_443;
+-		break;
++		return VC4_VEC_TV_MODE_NTSC_443;
+ 
+ 	case DRM_MODE_TV_MODE_NTSC_J:
+-		*val = VC4_VEC_TV_MODE_NTSC_J;
+-		break;
++		return VC4_VEC_TV_MODE_NTSC_J;
+ 
+ 	case DRM_MODE_TV_MODE_PAL:
+-		*val = VC4_VEC_TV_MODE_PAL;
+-		break;
++		return VC4_VEC_TV_MODE_PAL;
+ 
+ 	case DRM_MODE_TV_MODE_PAL_M:
+-		*val = VC4_VEC_TV_MODE_PAL_M;
+-		break;
++		return VC4_VEC_TV_MODE_PAL_M;
+ 
+ 	case DRM_MODE_TV_MODE_PAL_N:
+-		*val = VC4_VEC_TV_MODE_PAL_N;
+-		break;
++		return VC4_VEC_TV_MODE_PAL_N;
+ 
+ 	case DRM_MODE_TV_MODE_SECAM:
+-		*val = VC4_VEC_TV_MODE_SECAM;
+-		break;
++		return VC4_VEC_TV_MODE_SECAM;
+ 
+ 	case DRM_MODE_TV_MODE_MONOCHROME:
+-		*val = VC4_VEC_TV_MODE_MONOCHROME;
+-		break;
++		return VC4_VEC_TV_MODE_MONOCHROME;
+ 
+ 	default:
+ 		return -EINVAL;
+ 	}
++}
++
++static int
++vc4_vec_connector_get_property(struct drm_connector *connector,
++			       const struct drm_connector_state *state,
++			       struct drm_property *property,
++			       uint64_t *val)
++{
++	struct vc4_vec *vec = connector_to_vc4_vec(connector);
++	enum vc4_vec_tv_mode_id legacy_mode;
++
++	if (property != vec->legacy_tv_mode_property)
++		return -EINVAL;
++
++	legacy_mode = vc4_vec_generic_tv_mode_to_legacy(state->tv.mode);
++	if (legacy_mode < 0)
++		return legacy_mode;
++
++	*val = legacy_mode;
+ 
+ 	return 0;
+ }
+@@ -504,6 +536,8 @@ static const struct drm_connector_helper
+ static int vc4_vec_connector_init(struct drm_device *dev, struct vc4_vec *vec)
+ {
+ 	struct drm_connector *connector = &vec->connector;
++	enum vc4_vec_tv_mode_id legacy_default_mode;
++	enum drm_connector_tv_mode default_mode;
+ 	struct drm_property *prop;
+ 	int ret;
+ 
+@@ -516,9 +550,17 @@ static int vc4_vec_connector_init(struct
+ 
+ 	drm_connector_helper_add(connector, &vc4_vec_connector_helper_funcs);
+ 
++	default_mode = vc4_vec_get_default_mode(connector);
++	if (default_mode < 0)
++		return default_mode;
++
+ 	drm_object_attach_property(&connector->base,
+ 				   dev->mode_config.tv_mode_property,
+-				   DRM_MODE_TV_MODE_NTSC);
++				   default_mode);
++
++	legacy_default_mode = vc4_vec_generic_tv_mode_to_legacy(default_mode);
++	if (legacy_default_mode < 0)
++		return legacy_default_mode;
+ 
+ 	prop = drm_property_create_enum(dev, 0, "mode",
+ 					legacy_tv_mode_names,
+@@ -527,7 +569,7 @@ static int vc4_vec_connector_init(struct
+ 		return -ENOMEM;
+ 	vec->legacy_tv_mode_property = prop;
+ 
+-	drm_object_attach_property(&connector->base, prop, VC4_VEC_TV_MODE_NTSC);
++	drm_object_attach_property(&connector->base, prop, legacy_default_mode);
+ 
+ 	drm_connector_attach_tv_margin_properties(connector);
+ 
+@@ -854,3 +896,10 @@ struct platform_driver vc4_vec_driver =
+ 		.of_match_table = vc4_vec_dt_match,
+ 	},
+ };
++
++module_param_named(tv_norm, vc4_vec_tv_norm, charp, 0600);
++MODULE_PARM_DESC(tv_norm, "Default TV norm.\n"
++		 "\t\tSupported: NTSC, NTSC-J, NTSC-443, PAL, PAL-M, PAL-N,\n"
++		 "\t\t\tPAL60, SECAM.\n"
++		 "\t\tDefault: PAL if a 50 Hz mode has been set via video=,\n"
++		 "\t\t\tNTSC otherwise");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0645-drm-vc4-Make-VEC-progressive-modes-readily-accessibl.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0645-drm-vc4-Make-VEC-progressive-modes-readily-accessibl.patch
new file mode 100644
index 00000000..7d877efc
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0645-drm-vc4-Make-VEC-progressive-modes-readily-accessibl.patch
@@ -0,0 +1,68 @@
+From 973273f51bb1a3612ae50344e6493b0416f847b7 Mon Sep 17 00:00:00 2001
+From: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
+Date: Thu, 15 Jul 2021 01:08:11 +0200
+Subject: [PATCH 645/697] drm/vc4: Make VEC progressive modes readily
+ accessible
+
+Add predefined modelines for the 240p (NTSC) and 288p (PAL) progressive
+modes, and report them through vc4_vec_connector_get_modes().
+
+Signed-off-by: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
+---
+ drivers/gpu/drm/vc4/vc4_vec.c | 36 ++++++++++++++++++++++++++++++++++-
+ 1 file changed, 35 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_vec.c
++++ b/drivers/gpu/drm/vc4/vc4_vec.c
+@@ -274,6 +274,18 @@ static const struct debugfs_reg32 vec_re
+ 	VC4_REG32(VEC_DAC_MISC),
+ };
+ 
++static const struct drm_display_mode drm_mode_240p = {
++	DRM_MODE("720x240", DRM_MODE_TYPE_DRIVER, 13500,
++		 720, 720 + 14, 720 + 14 + 64, 720 + 14 + 64 + 60, 0,
++		 240, 240 + 3, 240 + 3 + 3, 262, 0, 0)
++};
++
++static const struct drm_display_mode drm_mode_288p = {
++	DRM_MODE("720x288", DRM_MODE_TYPE_DRIVER, 13500,
++		 720, 720 + 20, 720 + 20 + 64, 720 + 20 + 64 + 60, 0,
++		 288, 288 + 2, 288 + 2 + 3, 312, 0, 0)
++};
++
+ static const struct vc4_vec_tv_mode vc4_vec_tv_modes[] = {
+ 	{
+ 		.mode = DRM_MODE_TV_MODE_NTSC,
+@@ -528,9 +540,31 @@ static const struct drm_connector_funcs
+ 	.atomic_set_property = vc4_vec_connector_set_property,
+ };
+ 
++static int vc4_vec_connector_get_modes(struct drm_connector *connector)
++{
++	struct drm_display_mode *mode;
++	int count = drm_connector_helper_tv_get_modes(connector);
++
++	mode = drm_mode_duplicate(connector->dev, &drm_mode_240p);
++	if (!mode)
++		return -ENOMEM;
++
++	drm_mode_probed_add(connector, mode);
++	count++;
++
++	mode = drm_mode_duplicate(connector->dev, &drm_mode_288p);
++	if (!mode)
++		return -ENOMEM;
++
++	drm_mode_probed_add(connector, mode);
++	count++;
++
++	return count;
++}
++
+ static const struct drm_connector_helper_funcs vc4_vec_connector_helper_funcs = {
+ 	.atomic_check = drm_atomic_helper_connector_tv_check,
+-	.get_modes = drm_connector_helper_tv_get_modes,
++	.get_modes = vc4_vec_connector_get_modes,
+ };
+ 
+ static int vc4_vec_connector_init(struct drm_device *dev, struct vc4_vec *vec)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0646-drm-vc4-Initialise-the-tv_mode-property-default-from.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0646-drm-vc4-Initialise-the-tv_mode-property-default-from.patch
new file mode 100644
index 00000000..0139d288
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0646-drm-vc4-Initialise-the-tv_mode-property-default-from.patch
@@ -0,0 +1,28 @@
+From 0eede5695e2078aa2e53ed668106080176f05471 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 25 Jan 2024 17:27:42 +0000
+Subject: [PATCH 646/697] drm/vc4: Initialise the tv_mode property default from
+ cmdline_mode.
+
+With the command line parser now providing the information about
+the tv mode, use that as the preferred choice for initialising the
+default of the tv_mode property.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_vec.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_vec.c
++++ b/drivers/gpu/drm/vc4/vc4_vec.c
+@@ -388,7 +388,9 @@ static const struct drm_prop_enum_list l
+ static enum drm_connector_tv_mode
+ vc4_vec_get_default_mode(struct drm_connector *connector)
+ {
+-	if (vc4_vec_tv_norm) {
++	if (connector->cmdline_mode.tv_mode_specified) {
++		return connector->cmdline_mode.tv_mode;
++	} else if (vc4_vec_tv_norm) {
+ 		int ret;
+ 
+ 		ret = drm_get_tv_mode_from_name(vc4_vec_tv_norm, strlen(vc4_vec_tv_norm));
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0647-vc4-Add-jack-detection-to-HDMI-audio-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0647-vc4-Add-jack-detection-to-HDMI-audio-driver.patch
new file mode 100644
index 00000000..1c21371e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0647-vc4-Add-jack-detection-to-HDMI-audio-driver.patch
@@ -0,0 +1,188 @@
+From d57c7f32741db7df5716b35257c28b43142f4882 Mon Sep 17 00:00:00 2001
+From: David Turner <david.turner@raspberrypi.com>
+Date: Wed, 28 Feb 2024 10:55:39 +0000
+Subject: [PATCH 647/697] vc4: Add jack detection to HDMI audio driver
+
+Add ALSA jack detection to the vc4-hdmi audio driver so userspace knows
+when to add/remove HDMI audio devices.
+
+Signed-off-by: David Turner <david.turner@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 62 ++++++++++++++++++++++++++++++++--
+ drivers/gpu/drm/vc4/vc4_hdmi.h | 27 +++++++++++++++
+ 2 files changed, 86 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -50,6 +50,7 @@
+ #include <linux/reset.h>
+ #include <sound/dmaengine_pcm.h>
+ #include <sound/hdmi-codec.h>
++#include <sound/jack.h>
+ #include <sound/pcm_drm_eld.h>
+ #include <sound/pcm_params.h>
+ #include <sound/soc.h>
+@@ -383,7 +384,7 @@ static void vc4_hdmi_handle_hotplug(stru
+ 				    enum drm_connector_status status)
+ {
+ 	struct drm_connector *connector = &vc4_hdmi->connector;
+-	const struct drm_edid *drm_edid;
++	const struct drm_edid *drm_edid = NULL;
+ 	int ret;
+ 
+ 	/*
+@@ -400,13 +401,25 @@ static void vc4_hdmi_handle_hotplug(stru
+ 	 * the lock for now.
+ 	 */
+ 
++	if (status != connector_status_disconnected)
++		drm_edid = drm_edid_read_ddc(connector, vc4_hdmi->ddc);
++
++	/*
++	 * Report plugged/unplugged events to ALSA jack detection.  Do this
++	 * *after* EDID probing, otherwise userspace might try to bring up
++	 * audio before it's ready.
++	 */
++	mutex_lock(&vc4_hdmi->update_plugged_status_lock);
++	if (vc4_hdmi->plugged_cb && vc4_hdmi->codec_dev)
++		vc4_hdmi->plugged_cb(vc4_hdmi->codec_dev,
++				     status != connector_status_disconnected);
++	mutex_unlock(&vc4_hdmi->update_plugged_status_lock);
++
+ 	if (status == connector_status_disconnected) {
+ 		cec_phys_addr_invalidate(vc4_hdmi->cec_adap);
+ 		return;
+ 	}
+ 
+-	drm_edid = drm_edid_read_ddc(connector, vc4_hdmi->ddc);
+-
+ 	drm_edid_connector_update(connector, drm_edid);
+ 	cec_s_phys_addr(vc4_hdmi->cec_adap,
+ 			connector->display_info.source_physical_address, false);
+@@ -2228,8 +2241,23 @@ static int vc4_hdmi_audio_get_eld(struct
+ 	return 0;
+ }
+ 
++static int vc4_hdmi_audio_hook_plugged_cb(struct device *dev, void *data,
++					   hdmi_codec_plugged_cb fn,
++					   struct device *codec_dev)
++{
++	struct vc4_hdmi *vc4_hdmi = dev_get_drvdata(dev);
++
++	mutex_lock(&vc4_hdmi->update_plugged_status_lock);
++	vc4_hdmi->plugged_cb = fn;
++	vc4_hdmi->codec_dev = codec_dev;
++	mutex_unlock(&vc4_hdmi->update_plugged_status_lock);
++
++	return 0;
++}
++
+ static const struct hdmi_codec_ops vc4_hdmi_codec_ops = {
+ 	.get_eld = vc4_hdmi_audio_get_eld,
++	.hook_plugged_cb = vc4_hdmi_audio_hook_plugged_cb,
+ 	.prepare = vc4_hdmi_audio_prepare,
+ 	.audio_shutdown = vc4_hdmi_audio_shutdown,
+ 	.audio_startup = vc4_hdmi_audio_startup,
+@@ -2249,6 +2277,22 @@ static void vc4_hdmi_audio_codec_release
+ 	vc4_hdmi->audio.codec_pdev = NULL;
+ }
+ 
++static int vc4_hdmi_codec_init(struct snd_soc_pcm_runtime *rtd)
++{
++	struct vc4_hdmi *vc4_hdmi = snd_soc_card_get_drvdata(rtd->card);
++	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
++	int ret;
++
++	ret = snd_soc_card_jack_new(rtd->card, "HDMI Jack", SND_JACK_LINEOUT,
++				    &vc4_hdmi->hdmi_jack);
++	if (ret) {
++		dev_err(rtd->dev, "HDMI Jack creation failed: %d\n", ret);
++		return ret;
++	}
++
++	return snd_soc_component_set_jack(component, &vc4_hdmi->hdmi_jack, NULL);
++}
++
+ static int vc4_hdmi_audio_init(struct vc4_hdmi *vc4_hdmi)
+ {
+ 	const struct vc4_hdmi_register *mai_data =
+@@ -2374,6 +2418,8 @@ static int vc4_hdmi_audio_init(struct vc
+ 	dai_link->codecs->name = dev_name(&codec_pdev->dev);
+ 	dai_link->platforms->name = dev_name(dev);
+ 
++	dai_link->init = vc4_hdmi_codec_init;
++
+ 	card->dai_link = dai_link;
+ 	card->num_links = 1;
+ 	card->name = vc4_hdmi->variant->card_name;
+@@ -3234,6 +3280,8 @@ static int vc4_hdmi_bind(struct device *
+ 	if (ret)
+ 		return ret;
+ 
++	mutex_init(&vc4_hdmi->update_plugged_status_lock);
++
+ 	spin_lock_init(&vc4_hdmi->hw_lock);
+ 	INIT_DELAYED_WORK(&vc4_hdmi->scrambling_work, vc4_hdmi_scrambling_wq);
+ 
+@@ -3346,8 +3394,16 @@ err_put_runtime_pm:
+ 	return ret;
+ }
+ 
++static void vc4_hdmi_unbind(struct device *dev, struct device *master, void *data)
++{
++	struct vc4_hdmi *vc4_hdmi = dev_get_drvdata(dev);
++
++	mutex_destroy(&vc4_hdmi->update_plugged_status_lock);
++}
++
+ static const struct component_ops vc4_hdmi_ops = {
+ 	.bind   = vc4_hdmi_bind,
++	.unbind = vc4_hdmi_unbind,
+ };
+ 
+ static int vc4_hdmi_dev_probe(struct platform_device *pdev)
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.h
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.h
+@@ -2,8 +2,10 @@
+ #define _VC4_HDMI_H_
+ 
+ #include <drm/drm_connector.h>
++#include <linux/mutex.h>
+ #include <media/cec.h>
+ #include <sound/dmaengine_pcm.h>
++#include <sound/hdmi-codec.h>
+ #include <sound/soc.h>
+ 
+ #include "vc4_drv.h"
+@@ -213,6 +215,31 @@ struct vc4_hdmi {
+ 	 * KMS hooks. Protected by @mutex.
+ 	 */
+ 	enum hdmi_colorspace output_format;
++
++	/**
++	 * @plugged_cb: Callback provided by hdmi-codec to indicate that an
++	 * HDMI hotplug occurred and jack state should be updated. Protected by
++	 * @update_plugged_status_lock.
++	 */
++	hdmi_codec_plugged_cb plugged_cb;
++
++	/**
++	 * @plugged_cb: Context for plugged_cb. Protected by
++	 * @update_plugged_status_lock.
++	 */
++	struct device *codec_dev;
++
++	/**
++	 * @update_plugged_status_lock: Prevents a race condition where an HDMI
++	 * hotplug might occur between @plugged_cb and @codec_dev being set.
++	 */
++	struct mutex update_plugged_status_lock;
++
++	/**
++	 * @hdmi_jack: Represents the connection state of the HDMI plug, for
++	 * ALSA jack detection.
++	 */
++	struct snd_soc_jack hdmi_jack;
+ };
+ 
+ #define connector_to_vc4_hdmi(_connector)				\
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0648-drm-vc4-hdmi-Add-a-clear_infoframe-hook.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0648-drm-vc4-hdmi-Add-a-clear_infoframe-hook.patch
new file mode 100644
index 00000000..38cced19
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0648-drm-vc4-hdmi-Add-a-clear_infoframe-hook.patch
@@ -0,0 +1,49 @@
+From 4a07eb9d91cd302db29b4eba78996bbec1926736 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 21 Nov 2024 18:28:22 +0000
+Subject: [PATCH 648/697] drm/vc4: hdmi: Add a clear_infoframe hook
+
+If you disable HDR metadata, then the hardware should stop
+sending the infoframe, and that is implemented by the
+clear_infoframe hook which wasn't implemented. Add it.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -764,6 +764,24 @@ out:
+ 	return ret;
+ }
+ 
++static int vc4_hdmi_clear_infoframe(struct drm_connector *connector,
++				    enum hdmi_infoframe_type type)
++{
++	struct vc4_hdmi *vc4_hdmi = connector_to_vc4_hdmi(connector);
++	struct drm_device *drm = connector->dev;
++	int ret;
++	int idx;
++
++	if (!drm_dev_enter(drm, &idx))
++		return 0;
++
++	ret = vc4_hdmi_stop_packet(vc4_hdmi, type, true);
++	if (ret)
++		drm_err(drm, "Failed to wait for infoframe to go idle: %d\n", ret);
++
++	drm_dev_exit(idx);
++	return ret;
++}
+ #define SCRAMBLING_POLLING_DELAY_MS	1000
+ 
+ static void vc4_hdmi_enable_scrambling(struct drm_encoder *encoder)
+@@ -1722,6 +1740,7 @@ vc4_hdmi_connector_clock_valid(const str
+ static const struct drm_connector_hdmi_funcs vc4_hdmi_hdmi_connector_funcs = {
+ 	.tmds_char_rate_valid	= vc4_hdmi_connector_clock_valid,
+ 	.write_infoframe	= vc4_hdmi_write_infoframe,
++	.clear_infoframe	= vc4_hdmi_clear_infoframe,
+ };
+ 
+ #define WIFI_2_4GHz_CH1_MIN_FREQ	2400000000ULL
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0649-drm-vc4_hdmi-Allow-hotplug-detect-to-be-forced.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0649-drm-vc4_hdmi-Allow-hotplug-detect-to-be-forced.patch
new file mode 100644
index 00000000..fecb1b64
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0649-drm-vc4_hdmi-Allow-hotplug-detect-to-be-forced.patch
@@ -0,0 +1,58 @@
+From 71d796eedb3dfad70417a63e886a0b62e976fa7c Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Wed, 1 Jun 2022 15:43:51 +0100
+Subject: [PATCH 649/697] drm/vc4_hdmi: Allow hotplug detect to be forced
+
+See: https://forum.libreelec.tv/thread/24783-tv-avr-turns-back-on-right-after-turning-them-off
+
+While the kernel provides a :D flag for assuming device is connected,
+it doesn't stop this function from being called and generating a cec_phys_addr_invalidate
+message when hotplug is deasserted.
+
+That message provokes a flurry of CEC messages which for many users results in the TV
+switching back on again and it's very hard to get it to stay switched off.
+
+It seems to only occur with an AVR and TV connected but has been observed across a
+number of manufacturers.
+
+The issue started with https://github.com/raspberrypi/linux/pull/4371
+and this provides an optional way of getting back the old behaviour
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -43,6 +43,8 @@
+ #include <linux/component.h>
+ #include <linux/gpio/consumer.h>
+ #include <linux/i2c.h>
++#include <linux/module.h>
++#include <linux/moduleparam.h>
+ #include <linux/of.h>
+ #include <linux/of_address.h>
+ #include <linux/pm_runtime.h>
+@@ -112,6 +114,10 @@
+ 
+ #define HDMI_14_MAX_TMDS_CLK   (340 * 1000 * 1000)
+ 
++/* bit field to force hotplug detection. bit0 = HDMI0 */
++static int force_hotplug;
++module_param(force_hotplug, int, 0644);
++
+ static bool vc4_hdmi_supports_scrambling(struct vc4_hdmi *vc4_hdmi)
+ {
+ 	struct drm_display_info *display = &vc4_hdmi->connector.display_info;
+@@ -466,7 +472,9 @@ static int vc4_hdmi_connector_detect_ctx
+ 		return connector_status_unknown;
+ 	}
+ 
+-	if (vc4_hdmi->hpd_gpio) {
++	if (force_hotplug & BIT(vc4_hdmi->encoder.type - VC4_ENCODER_TYPE_HDMI0))
++		status = connector_status_connected;
++	else if (vc4_hdmi->hpd_gpio) {
+ 		if (gpiod_get_value_cansleep(vc4_hdmi->hpd_gpio))
+ 			status = connector_status_connected;
+ 	} else {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0650-vc4-hdmi-Ignore-hotplug-interrupt-with-force_hotplug.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0650-vc4-hdmi-Ignore-hotplug-interrupt-with-force_hotplug.patch
new file mode 100644
index 00000000..728e7971
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0650-vc4-hdmi-Ignore-hotplug-interrupt-with-force_hotplug.patch
@@ -0,0 +1,41 @@
+From 23174f1a02ea5b05d11aaf339d3ce7b4fd4aef3b Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Tue, 23 Apr 2024 17:30:56 +0100
+Subject: [PATCH 650/697] vc4/hdmi: Ignore hotplug interrupt with force_hotplug
+
+The intention of the vc4.force_hotplug setting is to
+ignore hotplug completely.
+
+It can be used when a display toggles hotplug when
+switching AV inputs, going into standby or changing a
+KVM switch, and some side effect of that is unwanted.
+
+It turns out while vc4.force_hotplug currently makes
+hotplug always read as asserted, that isn't enough to
+stop drm doing lots of stuff, including re-reading
+the edid.
+
+An example of what drm does with a hotplug deasert/assert
+and vc4.force_hotplug=1 currently is:
+
+https://paste.debian.net/hidden/dc07434b/
+
+That is unwanted. Lets ignore the hotplug interrupt
+completely so drm is blissfully unaware of the hotplug change.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -2476,7 +2476,7 @@ static irqreturn_t vc4_hdmi_hpd_irq_thre
+ 	struct drm_connector *connector = &vc4_hdmi->connector;
+ 	struct drm_device *dev = connector->dev;
+ 
+-	if (dev && dev->registered)
++	if (dev && dev->registered && !force_hotplug)
+ 		drm_connector_helper_hpd_irq_event(connector);
+ 
+ 	return IRQ_HANDLED;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0651-drm-vc4-Add-a-delay-after-disabling-hdmi-phy-output.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0651-drm-vc4-Add-a-delay-after-disabling-hdmi-phy-output.patch
new file mode 100644
index 00000000..8c56129d
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0651-drm-vc4-Add-a-delay-after-disabling-hdmi-phy-output.patch
@@ -0,0 +1,33 @@
+From 084560b8c42ec2fde7b6c0eb5d8e6fa46878bdeb Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Mon, 12 Aug 2024 13:31:58 +0100
+Subject: [PATCH 651/697] drm/vc4: Add a delay after disabling hdmi phy output
+
+There appears to be a requirement for some devices
+(I'm testing with a 8K VRROOM 40Gbps HDMI switch)
+for a measable delay between removing the hdmi phy output from
+the old mode, to enabling the hdmi phy output for the new mode.
+
+Without the delay, a mode switch has a small change of getting a permanent
+'no signal', which requires a subsequent mode switch or a unplug/replug
+to redetect.
+
+Switching between 4kp24/25/30 modes fails about 5% of time in my testing.
+
+Add a delay to make it impossible to switch faster than this.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -647,6 +647,7 @@ static void vc4_crtc_atomic_disable(stru
+ 	 * someone was waiting it.
+ 	 */
+ 	vc4_crtc_send_vblank(crtc);
++	msleep(20);
+ }
+ 
+ static void vc4_crtc_atomic_enable(struct drm_crtc *crtc,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0652-drm-vc4-Implement-vc6_hdmi_phy_disable.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0652-drm-vc4-Implement-vc6_hdmi_phy_disable.patch
new file mode 100644
index 00000000..7dbc5fc2
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0652-drm-vc4-Implement-vc6_hdmi_phy_disable.patch
@@ -0,0 +1,25 @@
+From 4f27680a9b8475616b03dd997433d84ccc447b9c Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Tue, 13 Aug 2024 16:13:16 +0100
+Subject: [PATCH 652/697] drm/vc4: Implement vc6_hdmi_phy_disable
+
+The body of this function was missing so we don't reset the phy
+when disabling it.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi_phy.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi_phy.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi_phy.c
+@@ -1197,4 +1197,9 @@ void vc6_hdmi_phy_init(struct vc4_hdmi *
+ 
+ void vc6_hdmi_phy_disable(struct vc4_hdmi *vc4_hdmi)
+ {
++	unsigned long flags;
++
++	spin_lock_irqsave(&vc4_hdmi->hw_lock, flags);
++	vc6_hdmi_reset_phy(vc4_hdmi);
++	spin_unlock_irqrestore(&vc4_hdmi->hw_lock, flags);
+ }
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0653-drm-vc4-Also-power-down-the-PLL-core-when-resetting-.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0653-drm-vc4-Also-power-down-the-PLL-core-when-resetting-.patch
new file mode 100644
index 00000000..1a51e193
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0653-drm-vc4-Also-power-down-the-PLL-core-when-resetting-.patch
@@ -0,0 +1,35 @@
+From 833c81096b141f42131074f29805e120b64ba06a Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Tue, 13 Aug 2024 17:18:51 +0100
+Subject: [PATCH 653/697] drm/vc4: Also power down the PLL core when resetting
+ PHY
+
+The current reset code doesn't actually stop the hdmi output.
+That makes it difficult for displays to handle a mode set.
+
+Powering down the PLL does actually remove the hdmi signal
+and makes mode sets more reliable
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi_phy.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi_phy.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi_phy.c
+@@ -137,6 +137,7 @@
+ #define VC6_HDMI_TX_PHY_PLL_REFCLK_REFCLK_SEL_CMOS	BIT(13)
+ #define VC6_HDMI_TX_PHY_PLL_REFCLK_REFFRQ_MASK		VC4_MASK(9, 0)
+ 
++#define VC6_HDMI_TX_PHY_PLL_POST_KDIV_BYPASS_EN		BIT(4)
+ #define VC6_HDMI_TX_PHY_PLL_POST_KDIV_CLK0_SEL_MASK	VC4_MASK(3, 2)
+ #define VC6_HDMI_TX_PHY_PLL_POST_KDIV_KDIV_MASK		VC4_MASK(1, 0)
+ 
+@@ -947,6 +948,7 @@ static void vc6_hdmi_reset_phy(struct vc
+ 
+ 	HDMI_WRITE(HDMI_TX_PHY_RESET_CTL, 0);
+ 	HDMI_WRITE(HDMI_TX_PHY_POWERUP_CTL, 0);
++	HDMI_WRITE(HDMI_TX_PHY_PLL_POST_KDIV, VC6_HDMI_TX_PHY_PLL_POST_KDIV_BYPASS_EN);
+ }
+ 
+ void vc6_hdmi_phy_init(struct vc4_hdmi *vc4_hdmi,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0654-drm-vc4-dpi-Add-override-for-RGB-order.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0654-drm-vc4-dpi-Add-override-for-RGB-order.patch
new file mode 100644
index 00000000..e170559b
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0654-drm-vc4-dpi-Add-override-for-RGB-order.patch
@@ -0,0 +1,67 @@
+From 91b31018ef7f38a9b76dbff63db6c2b5f7fc8a47 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 10 May 2024 11:30:25 +0100
+Subject: [PATCH 654/697] drm/vc4: dpi: Add override for RGB order
+
+There are no MEDIA_BUS_FMT_* defines for GRB or BRG, and adding
+them is a pain.
+
+Add a DT override to allow setting the order.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_dpi.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_dpi.c
++++ b/drivers/gpu/drm/vc4/vc4_dpi.c
+@@ -95,6 +95,8 @@ struct vc4_dpi {
+ 	struct clk *core_clock;
+ 
+ 	struct debugfs_regset32 regset;
++
++	int rgb_order_override;
+ };
+ 
+ #define to_vc4_dpi(_encoder)						\
+@@ -205,6 +207,11 @@ static void vc4_dpi_encoder_enable(struc
+ 			}
+ 		}
+ 
++		if (dpi->rgb_order_override >= 0) {
++			dpi_c &= ~DPI_ORDER_MASK;
++			dpi_c |= VC4_SET_FIELD(dpi->rgb_order_override, DPI_ORDER);
++		}
++
+ 		if (connector->display_info.bus_flags & DRM_BUS_FLAG_PIXDATA_DRIVE_NEGEDGE)
+ 			dpi_c |= DPI_PIXEL_CLK_INVERT;
+ 
+@@ -313,6 +320,7 @@ static int vc4_dpi_bind(struct device *d
+ {
+ 	struct platform_device *pdev = to_platform_device(dev);
+ 	struct drm_device *drm = dev_get_drvdata(master);
++	const char *rgb_order = NULL;
+ 	struct vc4_dpi *dpi;
+ 	int ret;
+ 
+@@ -361,6 +369,20 @@ static int vc4_dpi_bind(struct device *d
+ 	if (ret)
+ 		return ret;
+ 
++	dpi->rgb_order_override = -1;
++	if (!of_property_read_string(dev->of_node, "rgb_order", &rgb_order)) {
++		if (!strcmp(rgb_order, "rgb"))
++			dpi->rgb_order_override = DPI_ORDER_RGB;
++		else if (!strcmp(rgb_order, "bgr"))
++			dpi->rgb_order_override = DPI_ORDER_BGR;
++		else if (!strcmp(rgb_order, "grb"))
++			dpi->rgb_order_override = DPI_ORDER_GRB;
++		else if (!strcmp(rgb_order, "brg"))
++			dpi->rgb_order_override = DPI_ORDER_BRG;
++		else
++			DRM_ERROR("Invalid dpi order %s - ignored\n", rgb_order);
++	}
++
+ 	ret = drmm_encoder_init(drm, &dpi->encoder.base,
+ 				&vc4_dpi_encoder_funcs,
+ 				DRM_MODE_ENCODER_DPI,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0655-vc4-drm-plane-Make-use-of-chroma-siting-parameter.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0655-vc4-drm-plane-Make-use-of-chroma-siting-parameter.patch
new file mode 100644
index 00000000..f98eacd1
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0655-vc4-drm-plane-Make-use-of-chroma-siting-parameter.patch
@@ -0,0 +1,65 @@
+From 0a7192e44470ebb19e3443cebb1f95a7f11ccabd Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Thu, 27 Jan 2022 15:32:04 +0000
+Subject: [PATCH 655/697] vc4/drm:plane: Make use of chroma siting parameter
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -594,7 +594,7 @@ static void vc4_write_tpz(struct vc4_pla
+ #define PHASE_BITS 6
+ 
+ static void vc4_write_ppf(struct vc4_plane_state *vc4_state, u32 src, u32 dst,
+-			  u32 xy, int channel)
++			  u32 xy, int channel, int chroma_offset)
+ {
+ 	struct vc4_dev *vc4 = to_vc4_dev(vc4_state->base.plane->dev);
+ 	u32 scale = src / dst;
+@@ -605,7 +605,7 @@ static void vc4_write_ppf(struct vc4_pla
+ 
+ 	/*
+ 	 * Start the phase at 1/2 pixel from the 1st pixel at src_x.
+-	 * 1/4 pixel for YUV.
++	 * 1/4 pixel for YUV, plus the offset for chroma siting.
+ 	 */
+ 	if (channel) {
+ 		/*
+@@ -613,6 +613,7 @@ static void vc4_write_ppf(struct vc4_pla
+ 		 * display list's x value
+ 		 */
+ 		offset = (xy & 0x1ffff) >> (16 - PHASE_BITS) >> 1;
++		offset -= chroma_offset >> (17 - PHASE_BITS);
+ 		offset += -(1 << PHASE_BITS >> 2);
+ 	} else {
+ 		/*
+@@ -839,13 +840,15 @@ static void vc4_write_scaling_parameters
+ 	/* Ch0 H-PPF Word 0: Scaling Parameters */
+ 	if (vc4_state->x_scaling[channel] == VC4_SCALING_PPF) {
+ 		vc4_write_ppf(vc4_state, vc4_state->src_w[channel],
+-			      vc4_state->crtc_w, vc4_state->src_x, channel);
++			      vc4_state->crtc_w, vc4_state->src_x, channel,
++			      state->chroma_siting_h);
+ 	}
+ 
+ 	/* Ch0 V-PPF Words 0-1: Scaling Parameters, Context */
+ 	if (vc4_state->y_scaling[channel] == VC4_SCALING_PPF) {
+ 		vc4_write_ppf(vc4_state, vc4_state->src_h[channel],
+-			      vc4_state->crtc_h, vc4_state->src_y, channel);
++			      vc4_state->crtc_h, vc4_state->src_y, channel,
++			      state->chroma_siting_v);
+ 		vc4_dlist_write(vc4_state, 0xc0c0c0c0);
+ 	}
+ 
+@@ -2561,6 +2564,8 @@ struct drm_plane *vc4_plane_init(struct
+ 					  DRM_COLOR_YCBCR_BT709,
+ 					  DRM_COLOR_YCBCR_LIMITED_RANGE);
+ 
++	drm_plane_create_chroma_siting_properties(plane, 0, 0);
++
+ 	if (type == DRM_PLANE_TYPE_PRIMARY)
+ 		drm_plane_create_zpos_immutable_property(plane, 0);
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0656-drm-vc4-Add-support-for-per-plane-scaling-filter-sel.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0656-drm-vc4-Add-support-for-per-plane-scaling-filter-sel.patch
new file mode 100644
index 00000000..bb434927
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0656-drm-vc4-Add-support-for-per-plane-scaling-filter-sel.patch
@@ -0,0 +1,166 @@
+From d74c5581b22c32d1a3b1b4b7330860af8bbc8483 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 25 Jul 2024 15:42:41 +0100
+Subject: [PATCH 656/697] drm/vc4: Add support for per plane scaling filter
+ selection
+
+Seeing as the HVS can be configured with regard the scaling filter,
+and DRM now supports selecting scaling filters at a per CRTC or
+per plane level, we can implement it.
+
+Default remains as the Mitchell/Netravali filter, but nearest
+neighbour is now also implemented.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_drv.h   |  1 +
+ drivers/gpu/drm/vc4/vc4_hvs.c   | 14 +++++++++--
+ drivers/gpu/drm/vc4/vc4_plane.c | 43 +++++++++++++++++++++++++++------
+ 3 files changed, 49 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -369,6 +369,7 @@ struct vc4_hvs {
+ 	struct work_struct free_dlist_work;
+ 
+ 	struct drm_mm_node mitchell_netravali_filter;
++	struct drm_mm_node nearest_neighbour_filter;
+ 
+ 	struct debugfs_regset32 regset;
+ 
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -412,6 +412,9 @@ static int vc4_hvs_debugfs_dlist_allocs(
+ static const u32 mitchell_netravali_1_3_1_3_kernel[] =
+ 	VC4_LINEAR_PHASE_KERNEL(0, -2, -6, -8, -10, -8, -3, 2, 18,
+ 				50, 82, 119, 155, 187, 213, 227);
++static const u32 nearest_neighbour_kernel[] =
++	VC4_LINEAR_PHASE_KERNEL(0, 0, 0, 0, 0, 0, 0, 0,
++				1, 1, 1, 1, 255, 255, 255, 255);
+ 
+ static int vc4_hvs_upload_linear_kernel(struct vc4_hvs *hvs,
+ 					struct drm_mm_node *space,
+@@ -2067,14 +2070,19 @@ static int vc4_hvs_bind(struct device *d
+ 	if (ret)
+ 		return ret;
+ 
+-	/* Upload filter kernels.  We only have the one for now, so we
+-	 * keep it around for the lifetime of the driver.
++	/* Upload filter kernels.  We only have the two for now, so we
++	 * keep them around for the lifetime of the driver.
+ 	 */
+ 	ret = vc4_hvs_upload_linear_kernel(hvs,
+ 					   &hvs->mitchell_netravali_filter,
+ 					   mitchell_netravali_1_3_1_3_kernel);
+ 	if (ret)
+ 		return ret;
++	ret = vc4_hvs_upload_linear_kernel(hvs,
++					   &hvs->nearest_neighbour_filter,
++					   nearest_neighbour_kernel);
++	if (ret)
++		return ret;
+ 
+ 	ret = vc4_hvs_cob_init(hvs);
+ 	if (ret)
+@@ -2127,6 +2135,8 @@ static void vc4_hvs_unbind(struct device
+ 
+ 	if (drm_mm_node_allocated(&vc4->hvs->mitchell_netravali_filter))
+ 		drm_mm_remove_node(&vc4->hvs->mitchell_netravali_filter);
++	if (drm_mm_node_allocated(&vc4->hvs->nearest_neighbour_filter))
++		drm_mm_remove_node(&vc4->hvs->nearest_neighbour_filter);
+ 
+ 	drm_mm_for_each_node_safe(node, next, &vc4->hvs->dlist_mm)
+ 		drm_mm_remove_node(node);
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -594,7 +594,8 @@ static void vc4_write_tpz(struct vc4_pla
+ #define PHASE_BITS 6
+ 
+ static void vc4_write_ppf(struct vc4_plane_state *vc4_state, u32 src, u32 dst,
+-			  u32 xy, int channel, int chroma_offset)
++			  u32 xy, int channel, int chroma_offset,
++			  bool no_interpolate)
+ {
+ 	struct vc4_dev *vc4 = to_vc4_dev(vc4_state->base.plane->dev);
+ 	u32 scale = src / dst;
+@@ -646,6 +647,7 @@ static void vc4_write_ppf(struct vc4_pla
+ 	phase &= SCALER_PPF_IPHASE_MASK;
+ 
+ 	vc4_dlist_write(vc4_state,
++			(no_interpolate ? SCALER_PPF_NOINTERP : 0) |
+ 			SCALER_PPF_AGC |
+ 			VC4_SET_FIELD(scale, SCALER_PPF_SCALE) |
+ 			/*
+@@ -841,14 +843,16 @@ static void vc4_write_scaling_parameters
+ 	if (vc4_state->x_scaling[channel] == VC4_SCALING_PPF) {
+ 		vc4_write_ppf(vc4_state, vc4_state->src_w[channel],
+ 			      vc4_state->crtc_w, vc4_state->src_x, channel,
+-			      state->chroma_siting_h);
++			      state->chroma_siting_h,
++			      state->scaling_filter == DRM_SCALING_FILTER_NEAREST_NEIGHBOR);
+ 	}
+ 
+ 	/* Ch0 V-PPF Words 0-1: Scaling Parameters, Context */
+ 	if (vc4_state->y_scaling[channel] == VC4_SCALING_PPF) {
+ 		vc4_write_ppf(vc4_state, vc4_state->src_h[channel],
+ 			      vc4_state->crtc_h, vc4_state->src_y, channel,
+-			      state->chroma_siting_v);
++			      state->chroma_siting_v,
++			      state->scaling_filter == DRM_SCALING_FILTER_NEAREST_NEIGHBOR);
+ 		vc4_dlist_write(vc4_state, 0xc0c0c0c0);
+ 	}
+ 
+@@ -1657,7 +1661,18 @@ static int vc4_plane_mode_set(struct drm
+ 		    vc4_state->y_scaling[0] == VC4_SCALING_PPF ||
+ 		    vc4_state->x_scaling[1] == VC4_SCALING_PPF ||
+ 		    vc4_state->y_scaling[1] == VC4_SCALING_PPF) {
+-			u32 kernel = VC4_SET_FIELD(vc4->hvs->mitchell_netravali_filter.start,
++			struct drm_mm_node *filter;
++
++			switch (state->scaling_filter) {
++			case DRM_SCALING_FILTER_DEFAULT:
++			default:
++				filter = &vc4->hvs->mitchell_netravali_filter;
++				break;
++			case DRM_SCALING_FILTER_NEAREST_NEIGHBOR:
++				filter = &vc4->hvs->nearest_neighbour_filter;
++				break;
++			}
++			u32 kernel = VC4_SET_FIELD(filter->start,
+ 						   SCALER_PPF_KERNEL_OFFSET);
+ 
+ 			/* HPPF plane 0 */
+@@ -2069,9 +2084,19 @@ static int vc6_plane_mode_set(struct drm
+ 		    vc4_state->y_scaling[0] == VC4_SCALING_PPF ||
+ 		    vc4_state->x_scaling[1] == VC4_SCALING_PPF ||
+ 		    vc4_state->y_scaling[1] == VC4_SCALING_PPF) {
+-			u32 kernel =
+-				VC4_SET_FIELD(vc4->hvs->mitchell_netravali_filter.start,
+-					      SCALER_PPF_KERNEL_OFFSET);
++			struct drm_mm_node *filter;
++
++			switch (state->scaling_filter) {
++			case DRM_SCALING_FILTER_DEFAULT:
++			default:
++				filter = &vc4->hvs->mitchell_netravali_filter;
++				break;
++			case DRM_SCALING_FILTER_NEAREST_NEIGHBOR:
++				filter = &vc4->hvs->nearest_neighbour_filter;
++				break;
++			}
++			u32 kernel = VC4_SET_FIELD(filter->start,
++						   SCALER_PPF_KERNEL_OFFSET);
+ 
+ 			/* HPPF plane 0 */
+ 			vc4_dlist_write(vc4_state, kernel);
+@@ -2564,6 +2589,10 @@ struct drm_plane *vc4_plane_init(struct
+ 					  DRM_COLOR_YCBCR_BT709,
+ 					  DRM_COLOR_YCBCR_LIMITED_RANGE);
+ 
++	drm_plane_create_scaling_filter_property(plane,
++						 BIT(DRM_SCALING_FILTER_DEFAULT) |
++						 BIT(DRM_SCALING_FILTER_NEAREST_NEIGHBOR));
++
+ 	drm_plane_create_chroma_siting_properties(plane, 0, 0);
+ 
+ 	if (type == DRM_PLANE_TYPE_PRIMARY)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0657-drm-vc4-Use-the-TPZ-scaling-filter-for-1x1-source-im.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0657-drm-vc4-Use-the-TPZ-scaling-filter-for-1x1-source-im.patch
new file mode 100644
index 00000000..91a3d899
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0657-drm-vc4-Use-the-TPZ-scaling-filter-for-1x1-source-im.patch
@@ -0,0 +1,60 @@
+From 1d2ece41603c10a795176480ab1f1201a4b06501 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 11 Sep 2024 15:23:33 +0100
+Subject: [PATCH 657/697] drm/vc4: Use the TPZ scaling filter for 1x1 source
+ images
+
+The documentation says that the TPZ filter can not upscale,
+and requesting a scaling factor > 1:1 will output the original
+image in the top left, and repeat the right/bottom most pixels
+thereafter.
+That fits perfectly with upscaling a 1x1 image which is done
+a fair amount by some compositors to give solid colour, and it
+saves a large amount of LBM (TPZ is based on src size, whilst
+PPF is based on dest size).
+
+Select TPZ filter for images with source rectangle <=1.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -265,7 +265,11 @@ static enum vc4_scaling_mode vc4_get_sca
+ {
+ 	if (dst == src >> 16)
+ 		return VC4_SCALING_NONE;
+-	if (3 * dst >= 2 * (src >> 16))
++
++	if (src <= (1 << 16))
++		/* Source rectangle <= 1 pixel can use TPZ for resize/upscale */
++		return VC4_SCALING_TPZ;
++	else if (3 * dst >= 2 * (src >> 16))
+ 		return VC4_SCALING_PPF;
+ 	else
+ 		return VC4_SCALING_TPZ;
+@@ -571,12 +575,17 @@ static void vc4_write_tpz(struct vc4_pla
+ 
+ 	WARN_ON_ONCE(vc4->gen > VC4_GEN_6_D);
+ 
+-	scale = src / dst;
++	if ((dst << 16) < src) {
++		scale = src / dst;
+ 
+-	/* The specs note that while the reciprocal would be defined
+-	 * as (1<<32)/scale, ~0 is close enough.
+-	 */
+-	recip = ~0 / scale;
++		/* The specs note that while the reciprocal would be defined
++		 * as (1<<32)/scale, ~0 is close enough.
++		 */
++		recip = ~0 / scale;
++	} else {
++		scale = (1 << 16) + 1;
++		recip = (1 << 16) - 1;
++	}
+ 
+ 	vc4_dlist_write(vc4_state,
+ 			/*
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0658-drm-vc4-hvs-Defer-updating-the-enable_bg_fill-until-.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0658-drm-vc4-hvs-Defer-updating-the-enable_bg_fill-until-.patch
new file mode 100644
index 00000000..a18ac9e0
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0658-drm-vc4-hvs-Defer-updating-the-enable_bg_fill-until-.patch
@@ -0,0 +1,65 @@
+From cca44194387571f95bd315b7dc8929d6119d329d Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 12 Nov 2024 17:58:52 +0000
+Subject: [PATCH 658/697] drm/vc4: hvs: Defer updating the enable_bg_fill until
+ vblank
+
+The register to enable/disable background fill was being set
+from atomic flush, however that will be applied immediately and
+can be a while before the vblank. If it was required for the
+current frame but not for the next one, that can result in
+corruption for part of the current frame.
+
+Store the state in vc4_hvs, and update it on vblank.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_drv.h |  2 ++
+ drivers/gpu/drm/vc4/vc4_hvs.c | 18 ++++++++++--------
+ 2 files changed, 12 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -348,6 +348,8 @@ struct vc4_hvs {
+ 		unsigned int enabled: 1;
+ 	} eof_irq[HVS_NUM_CHANNELS];
+ 
++	bool bg_fill[HVS_NUM_CHANNELS];
++
+ 	unsigned long max_core_rate;
+ 
+ 	/* Memory manager for CRTCs to allocate space in the display
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -1302,14 +1302,7 @@ void vc4_hvs_atomic_flush(struct drm_crt
+ 		/* This sets a black background color fill, as is the case
+ 		 * with other DRM drivers.
+ 		 */
+-		if (enable_bg_fill)
+-			HVS_WRITE(SCALER6_DISPX_CTRL1(channel),
+-				  HVS_READ(SCALER6_DISPX_CTRL1(channel)) |
+-				  SCALER6_DISPX_CTRL1_BGENB);
+-		else
+-			HVS_WRITE(SCALER6_DISPX_CTRL1(channel),
+-				  HVS_READ(SCALER6_DISPX_CTRL1(channel)) &
+-				  ~SCALER6_DISPX_CTRL1_BGENB);
++		hvs->bg_fill[channel] = enable_bg_fill;
+ 	} else {
+ 		/* we can actually run with a lower core clock when background
+ 		 * fill is enabled on VC4_GEN_5 so leave it enabled always.
+@@ -1481,6 +1474,15 @@ static irqreturn_t vc6_hvs_eof_irq_handl
+ 		if (hvs->eof_irq[i].desc != irq)
+ 			continue;
+ 
++		if (hvs->bg_fill[i])
++			HVS_WRITE(SCALER6_DISPX_CTRL1(i),
++				  HVS_READ(SCALER6_DISPX_CTRL1(i)) |
++				  SCALER6_DISPX_CTRL1_BGENB);
++		else
++			HVS_WRITE(SCALER6_DISPX_CTRL1(i),
++				  HVS_READ(SCALER6_DISPX_CTRL1(i)) &
++				  ~SCALER6_DISPX_CTRL1_BGENB);
++
+ 		vc4_hvs_schedule_dlist_sweep(hvs, i);
+ 		return IRQ_HANDLED;
+ 	}
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0659-drm-vc4-Increase-number-of-overlay-planes-from-16-to.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0659-drm-vc4-Increase-number-of-overlay-planes-from-16-to.patch
new file mode 100644
index 00000000..26416367
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0659-drm-vc4-Increase-number-of-overlay-planes-from-16-to.patch
@@ -0,0 +1,31 @@
+From e259aaf9e4aba7232016683bd2084481ee191d62 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 21 Oct 2022 14:27:45 +0100
+Subject: [PATCH 659/697] drm/vc4: Increase number of overlay planes from 16 to
+ 48
+
+The HVS can accept an arbitrary number of planes, provided
+that the overall pixel read load is within limits, and
+the display list can fit into the dlist memory.
+
+Now that DRM will support 64 planes per device, increase
+the number of overlay planes from 16 to 48 so that the
+dlist complexity can be increased (eg 4x4 video wall on
+each of 3 displays).
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -2610,7 +2610,7 @@ struct drm_plane *vc4_plane_init(struct
+ 	return plane;
+ }
+ 
+-#define VC4_NUM_OVERLAY_PLANES	16
++#define VC4_NUM_OVERLAY_PLANES	48
+ 
+ int vc4_plane_create_additional_planes(struct drm_device *drm)
+ {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0660-drm-vc4-Assign-32-overlay-planes-to-writeback-only.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0660-drm-vc4-Assign-32-overlay-planes-to-writeback-only.patch
new file mode 100644
index 00000000..7af28cea
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0660-drm-vc4-Assign-32-overlay-planes-to-writeback-only.patch
@@ -0,0 +1,71 @@
+From f80ecdc739cc5febf4d65874e120abe614af78a6 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 15 Aug 2023 15:44:34 +0100
+Subject: [PATCH 660/697] drm/vc4: Assign 32 overlay planes to writeback only
+
+Instead of having 48 generic overlay planes, assign 32 to the
+writeback connector so that there is no ambiguity in wlroots
+when trying to find a plane for composition using the writeback
+connector vs display.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 34 +++++++++++++++++++++++++++++++--
+ 1 file changed, 32 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -2610,13 +2610,28 @@ struct drm_plane *vc4_plane_init(struct
+ 	return plane;
+ }
+ 
+-#define VC4_NUM_OVERLAY_PLANES	48
++#define VC4_NUM_OVERLAY_PLANES	16
++#define VC4_NUM_TXP_OVERLAY_PLANES 32
+ 
+ int vc4_plane_create_additional_planes(struct drm_device *drm)
+ {
+ 	struct drm_plane *cursor_plane;
+ 	struct drm_crtc *crtc;
+ 	unsigned int i;
++	struct drm_crtc *txp_crtc;
++	uint32_t non_txp_crtc_mask;
++
++	drm_for_each_crtc(crtc, drm) {
++		struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
++
++		if (vc4_crtc->feeds_txp) {
++			txp_crtc = crtc;
++			break;
++		}
++	}
++
++	non_txp_crtc_mask = GENMASK(drm->mode_config.num_crtc - 1, 0) -
++					drm_crtc_mask(txp_crtc);
+ 
+ 	/* Set up some arbitrary number of planes.  We're not limited
+ 	 * by a set number of physical registers, just the space in
+@@ -2630,7 +2645,22 @@ int vc4_plane_create_additional_planes(s
+ 	for (i = 0; i < VC4_NUM_OVERLAY_PLANES; i++) {
+ 		struct drm_plane *plane =
+ 			vc4_plane_init(drm, DRM_PLANE_TYPE_OVERLAY,
+-				       GENMASK(drm->mode_config.num_crtc - 1, 0));
++				       non_txp_crtc_mask);
++
++		if (IS_ERR(plane))
++			continue;
++
++		/* Create zpos property. Max of all the overlays + 1 primary +
++		 * 1 cursor plane on a crtc.
++		 */
++		drm_plane_create_zpos_property(plane, i + 1, 1,
++					       VC4_NUM_OVERLAY_PLANES + 1);
++	}
++
++	for (i = 0; i < VC4_NUM_TXP_OVERLAY_PLANES; i++) {
++		struct drm_plane *plane =
++			vc4_plane_init(drm, DRM_PLANE_TYPE_OVERLAY,
++				       drm_crtc_mask(txp_crtc));
+ 
+ 		if (IS_ERR(plane))
+ 			continue;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0661-drm-vc4-Do-not-include-writeback-conn-load-in-load-t.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0661-drm-vc4-Do-not-include-writeback-conn-load-in-load-t.patch
new file mode 100644
index 00000000..ad0f6165
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0661-drm-vc4-Do-not-include-writeback-conn-load-in-load-t.patch
@@ -0,0 +1,48 @@
+From 9aa05766b55ff89bcb234fa361529c3c831d9391 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 9 Sep 2024 17:28:00 +0100
+Subject: [PATCH 661/697] drm/vc4: Do not include writeback conn load in load
+ tracker
+
+The transposer/writeback connector should be running with a
+lower priority, so shouldn't be factored into the load
+calculations.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_kms.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_kms.c
++++ b/drivers/gpu/drm/vc4/vc4_kms.c
+@@ -660,17 +660,26 @@ static int vc4_load_tracker_atomic_check
+ 	for_each_oldnew_plane_in_state(state, plane, old_plane_state,
+ 				       new_plane_state, i) {
+ 		struct vc4_plane_state *vc4_plane_state;
++		struct vc4_crtc *vc4_crtc;
+ 
+ 		if (old_plane_state->fb && old_plane_state->crtc) {
+ 			vc4_plane_state = to_vc4_plane_state(old_plane_state);
+-			load_state->membus_load -= vc4_plane_state->membus_load;
+-			load_state->hvs_load -= vc4_plane_state->hvs_load;
++			vc4_crtc = to_vc4_crtc(old_plane_state->crtc);
++
++			if (!vc4_crtc->feeds_txp) {
++				load_state->membus_load -= vc4_plane_state->membus_load;
++				load_state->hvs_load -= vc4_plane_state->hvs_load;
++			}
+ 		}
+ 
+ 		if (new_plane_state->fb && new_plane_state->crtc) {
+ 			vc4_plane_state = to_vc4_plane_state(new_plane_state);
+-			load_state->membus_load += vc4_plane_state->membus_load;
+-			load_state->hvs_load += vc4_plane_state->hvs_load;
++			vc4_crtc = to_vc4_crtc(new_plane_state->crtc);
++
++			if (!vc4_crtc->feeds_txp) {
++				load_state->membus_load += vc4_plane_state->membus_load;
++				load_state->hvs_load += vc4_plane_state->hvs_load;
++			}
+ 		}
+ 	}
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0662-drm-vc4-Drop-panic-priority-for-writeback-connector.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0662-drm-vc4-Drop-panic-priority-for-writeback-connector.patch
new file mode 100644
index 00000000..3bfddb14
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0662-drm-vc4-Drop-panic-priority-for-writeback-connector.patch
@@ -0,0 +1,53 @@
+From 503cc6954f1771338fc8aecbf0e8fd306945ec09 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 9 Sep 2024 17:38:45 +0100
+Subject: [PATCH 662/697] drm/vc4: Drop panic priority for writeback connector
+
+As the writeback connector doesn't have the same realtime
+constraints of a live display, drop the panic priority for it.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_kms.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_kms.c
++++ b/drivers/gpu/drm/vc4/vc4_kms.c
+@@ -221,7 +221,7 @@ static void vc4_hvs_pv_muxing_commit(str
+ 		struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
+ 		struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(crtc_state);
+ 		u32 dispctrl;
+-		u32 dsp3_mux;
++		u32 dsp3_mux_pri;
+ 
+ 		if (!crtc_state->active)
+ 			continue;
+@@ -238,15 +238,22 @@ static void vc4_hvs_pv_muxing_commit(str
+ 		 * enabled. In this case, FIFO 2 is directly accessed by the
+ 		 * TXP IP, and we need to disable the FIFO2 -> pixelvalve1
+ 		 * route.
++		 *
++		 * TXP can also run with a lower panic level than a live display,
++		 * as it doesn't have the same real-time constraint.
+ 		 */
+-		if (vc4_crtc->feeds_txp)
+-			dsp3_mux = VC4_SET_FIELD(3, SCALER_DISPCTRL_DSP3_MUX);
+-		else
+-			dsp3_mux = VC4_SET_FIELD(2, SCALER_DISPCTRL_DSP3_MUX);
++		if (vc4_crtc->feeds_txp) {
++			dsp3_mux_pri = VC4_SET_FIELD(3, SCALER_DISPCTRL_DSP3_MUX);
++			dsp3_mux_pri |= VC4_SET_FIELD(0, SCALER_DISPCTRL_PANIC2);
++		} else {
++			dsp3_mux_pri = VC4_SET_FIELD(2, SCALER_DISPCTRL_DSP3_MUX);
++			dsp3_mux_pri |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC2);
++		}
+ 
+ 		dispctrl = HVS_READ(SCALER_DISPCTRL) &
+-			   ~SCALER_DISPCTRL_DSP3_MUX_MASK;
+-		HVS_WRITE(SCALER_DISPCTRL, dispctrl | dsp3_mux);
++			   ~(SCALER_DISPCTRL_DSP3_MUX_MASK |
++			     SCALER_DISPCTRL_PANIC2_MASK);
++		HVS_WRITE(SCALER_DISPCTRL, dispctrl | dsp3_mux_pri);
+ 	}
+ }
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0663-drm-vc4-txp-Add-a-rotation-property-to-the-writeback.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0663-drm-vc4-txp-Add-a-rotation-property-to-the-writeback.patch
new file mode 100644
index 00000000..35bea134
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0663-drm-vc4-txp-Add-a-rotation-property-to-the-writeback.patch
@@ -0,0 +1,65 @@
+From d58089949f31b6c7e25828d19cd521962d4bcee6 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 14 Aug 2024 16:41:07 +0100
+Subject: [PATCH 663/697] drm/vc4: txp: Add a rotation property to the
+ writeback connector
+
+The txp block can implement transpose as it writes out the image
+data, so expose that through the new connector rotation property.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_txp.c | 21 +++++++++++++++++----
+ 1 file changed, 17 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_txp.c
++++ b/drivers/gpu/drm/vc4/vc4_txp.c
+@@ -15,6 +15,7 @@
+ 
+ #include <drm/drm_atomic.h>
+ #include <drm/drm_atomic_helper.h>
++#include <drm/drm_blend.h>
+ #include <drm/drm_drv.h>
+ #include <drm/drm_edid.h>
+ #include <drm/drm_fb_dma_helper.h>
+@@ -259,10 +260,15 @@ static int vc4_txp_connector_atomic_chec
+ 	crtc_state = drm_atomic_get_new_crtc_state(state, conn_state->crtc);
+ 
+ 	fb = conn_state->writeback_job->fb;
+-	if (fb->width != crtc_state->mode.hdisplay ||
+-	    fb->height != crtc_state->mode.vdisplay) {
+-		DRM_DEBUG_KMS("Invalid framebuffer size %ux%u\n",
+-			      fb->width, fb->height);
++	if ((conn_state->rotation == DRM_MODE_ROTATE_0 &&
++	     fb->width != crtc_state->mode.hdisplay &&
++	     fb->height != crtc_state->mode.vdisplay) ||
++	    (conn_state->rotation == (DRM_MODE_ROTATE_0 | DRM_MODE_TRANSPOSE) &&
++	     fb->width != crtc_state->mode.vdisplay &&
++	     fb->height != crtc_state->mode.hdisplay)) {
++		DRM_DEBUG_KMS("Invalid framebuffer size %ux%u vs mode %ux%u\n",
++			      fb->width, fb->height,
++			      crtc_state->mode.hdisplay, crtc_state->mode.vdisplay);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -330,6 +336,9 @@ static void vc4_txp_connector_atomic_com
+ 		 */
+ 		ctrl |= TXP_ALPHA_INVERT;
+ 
++	if (conn_state->rotation & DRM_MODE_TRANSPOSE)
++		ctrl |= TXP_TRANSPOSE;
++
+ 	if (!drm_dev_enter(drm, &idx))
+ 		return;
+ 
+@@ -608,6 +617,10 @@ static int vc4_txp_bind(struct device *d
+ 	if (ret)
+ 		return ret;
+ 
++	drm_connector_create_rotation_property(&txp->connector.base, DRM_MODE_ROTATE_0,
++					       DRM_MODE_ROTATE_0 |
++					       DRM_MODE_TRANSPOSE);
++
+ 	ret = devm_request_irq(dev, irq, vc4_txp_interrupt, 0,
+ 			       dev_name(dev), txp);
+ 	if (ret)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0664-drm-vc4-Remove-request-for-min-clocks-when-hdmi-outp.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0664-drm-vc4-Remove-request-for-min-clocks-when-hdmi-outp.patch
new file mode 100644
index 00000000..b2ade1d7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0664-drm-vc4-Remove-request-for-min-clocks-when-hdmi-outp.patch
@@ -0,0 +1,74 @@
+From 0bc9fca6c37729ab3d2f08d469ac33185979e544 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Mon, 14 Oct 2024 18:55:00 +0100
+Subject: [PATCH 664/697] drm/vc4: Remove request for min clocks when hdmi
+ output is disabled
+
+Currently, booting with no hdmi connected has:
+pi@pi4:~ $ vcgencmd measure_clock hdmi pixel
+frequency(9)=120010256
+frequency(29)=74988280
+
+After connecting hdmi we get:
+pi@pi4:~ $ vcgencmd measure_clock hdmi pixel
+frequency(9)=300005856
+frequency(29)=149989744
+
+and that persists after disconnecting hdmi
+
+I can measure this on a power supply as 10mA@5.2V (52mW).
+
+We should always remove clk_set_min_rate requests
+when we no longer need them.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 4 ++++
+ drivers/gpu/drm/vc4/vc4_hvs.c  | 3 +++
+ drivers/gpu/drm/vc4/vc4_v3d.c  | 2 ++
+ 3 files changed, 9 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -951,6 +951,8 @@ static void vc4_hdmi_encoder_post_crtc_p
+ 	if (vc4_hdmi->variant->phy_disable)
+ 		vc4_hdmi->variant->phy_disable(vc4_hdmi);
+ 
++	/* we no longer require a minimum clock rate */
++	clk_set_min_rate(vc4_hdmi->pixel_bvb_clock, 0);
+ 	clk_disable_unprepare(vc4_hdmi->pixel_bvb_clock);
+ 	clk_disable_unprepare(vc4_hdmi->pixel_clock);
+ 
+@@ -3219,6 +3221,8 @@ static int vc4_hdmi_runtime_suspend(stru
+ 	struct vc4_hdmi *vc4_hdmi = dev_get_drvdata(dev);
+ 
+ 	clk_disable_unprepare(vc4_hdmi->audio_clock);
++	/* we no longer require a minimum clock rate */
++	clk_set_min_rate(vc4_hdmi->hsm_clock, 0);
+ 	clk_disable_unprepare(vc4_hdmi->hsm_clock);
+ 
+ 	return 0;
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -2149,7 +2149,10 @@ static void vc4_hvs_unbind(struct device
+ 		drm_mm_remove_node(node);
+ 	drm_mm_takedown(&vc4->hvs->lbm_mm);
+ 
++	/* we no longer require a minimum clock rate */
++	clk_set_min_rate(hvs->disp_clk, 0);
+ 	clk_disable_unprepare(hvs->disp_clk);
++	clk_set_min_rate(hvs->core_clk, 0);
+ 	clk_disable_unprepare(hvs->core_clk);
+ 
+ 	vc4->hvs = NULL;
+--- a/drivers/gpu/drm/vc4/vc4_v3d.c
++++ b/drivers/gpu/drm/vc4/vc4_v3d.c
+@@ -376,6 +376,8 @@ static int vc4_v3d_runtime_suspend(struc
+ 
+ 	vc4_irq_disable(&vc4->base);
+ 
++	/* we no longer require a minimum clock rate */
++	clk_set_min_rate(v3d->clk, 0);
+ 	clk_disable_unprepare(v3d->clk);
+ 
+ 	return 0;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0665-drm-vc4-Disable-the-2pixel-clock-odd-timings-workaro.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0665-drm-vc4-Disable-the-2pixel-clock-odd-timings-workaro.patch
new file mode 100644
index 00000000..ac9b37c3
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0665-drm-vc4-Disable-the-2pixel-clock-odd-timings-workaro.patch
@@ -0,0 +1,204 @@
+From 007d3c4426302a447b71aaccfe778f194a4c599d Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Tue, 24 Oct 2023 16:20:42 +0100
+Subject: [PATCH 665/697] drm/vc4: Disable the 2pixel/clock odd timings
+ workaround for interlaced
+
+Whilst BCM2712 does fix using odd horizontal timings, it doesn't
+work with interlaced modes.
+
+Drop the workaround for interlaced modes and revert to the same
+behaviour as BCM2711.
+
+https://github.com/raspberrypi/linux/issues/6281
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c | 20 +++++++++++++++++---
+ drivers/gpu/drm/vc4/vc4_drv.h  |  2 ++
+ drivers/gpu/drm/vc4/vc4_hdmi.c |  8 +++++++-
+ drivers/gpu/drm/vc4/vc4_hdmi.h |  4 ++++
+ 4 files changed, 30 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -361,7 +361,9 @@ static void vc4_crtc_config_pv(struct dr
+ 	bool is_dsi1 = vc4_encoder->type == VC4_ENCODER_TYPE_DSI1;
+ 	bool is_vec = vc4_encoder->type == VC4_ENCODER_TYPE_VEC;
+ 	u32 format = is_dsi1 ? PV_CONTROL_FORMAT_DSIV_24 : PV_CONTROL_FORMAT_24;
+-	u8 ppc = pv_data->pixels_per_clock;
++	u8 ppc = (mode->flags & DRM_MODE_FLAG_INTERLACE) ?
++			pv_data->pixels_per_clock_int :
++			pv_data->pixels_per_clock;
+ 
+ 	u16 vert_bp = mode->crtc_vtotal - mode->crtc_vsync_end;
+ 	u16 vert_sync = mode->crtc_vsync_end - mode->crtc_vsync_start;
+@@ -426,7 +428,8 @@ static void vc4_crtc_config_pv(struct dr
+ 		 */
+ 		CRTC_WRITE(PV_V_CONTROL,
+ 			   PV_VCONTROL_CONTINUOUS |
+-			   (vc4->gen >= VC4_GEN_6_C ? PV_VCONTROL_ODD_TIMING : 0) |
++			   (vc4->gen >= VC4_GEN_6_C && ppc == 1 ?
++					PV_VCONTROL_ODD_TIMING : 0) |
+ 			   (is_dsi ? PV_VCONTROL_DSI : 0) |
+ 			   PV_VCONTROL_INTERLACE |
+ 			   (odd_field_first
+@@ -438,7 +441,8 @@ static void vc4_crtc_config_pv(struct dr
+ 	} else {
+ 		CRTC_WRITE(PV_V_CONTROL,
+ 			   PV_VCONTROL_CONTINUOUS |
+-			   (vc4->gen >= VC4_GEN_6_C ? PV_VCONTROL_ODD_TIMING : 0) |
++			   (vc4->gen >= VC4_GEN_6_C && ppc == 1 ?
++					PV_VCONTROL_ODD_TIMING : 0) |
+ 			   (is_dsi ? PV_VCONTROL_DSI : 0));
+ 		CRTC_WRITE(PV_VSYNCD_EVEN, 0);
+ 	}
+@@ -1208,6 +1212,7 @@ const struct vc4_pv_data bcm2835_pv0_dat
+ 	},
+ 	.fifo_depth = 64,
+ 	.pixels_per_clock = 1,
++	.pixels_per_clock_int = 1,
+ 	.encoder_types = {
+ 		[PV_CONTROL_CLK_SELECT_DSI] = VC4_ENCODER_TYPE_DSI0,
+ 		[PV_CONTROL_CLK_SELECT_DPI_SMI_HDMI] = VC4_ENCODER_TYPE_DPI,
+@@ -1223,6 +1228,7 @@ const struct vc4_pv_data bcm2835_pv1_dat
+ 	},
+ 	.fifo_depth = 64,
+ 	.pixels_per_clock = 1,
++	.pixels_per_clock_int = 1,
+ 	.encoder_types = {
+ 		[PV_CONTROL_CLK_SELECT_DSI] = VC4_ENCODER_TYPE_DSI1,
+ 		[PV_CONTROL_CLK_SELECT_DPI_SMI_HDMI] = VC4_ENCODER_TYPE_SMI,
+@@ -1238,6 +1244,7 @@ const struct vc4_pv_data bcm2835_pv2_dat
+ 	},
+ 	.fifo_depth = 64,
+ 	.pixels_per_clock = 1,
++	.pixels_per_clock_int = 1,
+ 	.encoder_types = {
+ 		[PV_CONTROL_CLK_SELECT_DPI_SMI_HDMI] = VC4_ENCODER_TYPE_HDMI0,
+ 		[PV_CONTROL_CLK_SELECT_VEC] = VC4_ENCODER_TYPE_VEC,
+@@ -1253,6 +1260,7 @@ const struct vc4_pv_data bcm2711_pv0_dat
+ 	},
+ 	.fifo_depth = 64,
+ 	.pixels_per_clock = 1,
++	.pixels_per_clock_int = 1,
+ 	.encoder_types = {
+ 		[0] = VC4_ENCODER_TYPE_DSI0,
+ 		[1] = VC4_ENCODER_TYPE_DPI,
+@@ -1268,6 +1276,7 @@ const struct vc4_pv_data bcm2711_pv1_dat
+ 	},
+ 	.fifo_depth = 64,
+ 	.pixels_per_clock = 1,
++	.pixels_per_clock_int = 1,
+ 	.encoder_types = {
+ 		[0] = VC4_ENCODER_TYPE_DSI1,
+ 		[1] = VC4_ENCODER_TYPE_SMI,
+@@ -1283,6 +1292,7 @@ const struct vc4_pv_data bcm2711_pv2_dat
+ 	},
+ 	.fifo_depth = 256,
+ 	.pixels_per_clock = 2,
++	.pixels_per_clock_int = 2,
+ 	.encoder_types = {
+ 		[0] = VC4_ENCODER_TYPE_HDMI0,
+ 	},
+@@ -1297,6 +1307,7 @@ const struct vc4_pv_data bcm2711_pv3_dat
+ 	},
+ 	.fifo_depth = 64,
+ 	.pixels_per_clock = 1,
++	.pixels_per_clock_int = 1,
+ 	.encoder_types = {
+ 		[PV_CONTROL_CLK_SELECT_VEC] = VC4_ENCODER_TYPE_VEC,
+ 	},
+@@ -1311,6 +1322,7 @@ const struct vc4_pv_data bcm2711_pv4_dat
+ 	},
+ 	.fifo_depth = 64,
+ 	.pixels_per_clock = 2,
++	.pixels_per_clock_int = 2,
+ 	.encoder_types = {
+ 		[0] = VC4_ENCODER_TYPE_HDMI1,
+ 	},
+@@ -1324,6 +1336,7 @@ const struct vc4_pv_data bcm2712_pv0_dat
+ 	},
+ 	.fifo_depth = 64,
+ 	.pixels_per_clock = 1,
++	.pixels_per_clock_int = 2,
+ 	.encoder_types = {
+ 		[0] = VC4_ENCODER_TYPE_HDMI0,
+ 	},
+@@ -1337,6 +1350,7 @@ const struct vc4_pv_data bcm2712_pv1_dat
+ 	},
+ 	.fifo_depth = 64,
+ 	.pixels_per_clock = 1,
++	.pixels_per_clock_int = 2,
+ 	.encoder_types = {
+ 		[0] = VC4_ENCODER_TYPE_HDMI1,
+ 	},
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -568,6 +568,8 @@ struct vc4_pv_data {
+ 
+ 	/* Number of pixels output per clock period */
+ 	u8 pixels_per_clock;
++	/* Number of pixels output per clock period when in an interlaced mode */
++	u8 pixels_per_clock_int;
+ 
+ 	enum vc4_encoder_type encoder_types[4];
+ };
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -1765,7 +1765,9 @@ static int vc4_hdmi_encoder_atomic_check
+ 	unsigned long long tmds_char_rate = mode->clock * 1000;
+ 	unsigned long long tmds_bit_rate;
+ 
+-	if (vc4_hdmi->variant->unsupported_odd_h_timings) {
++	if (vc4_hdmi->variant->unsupported_odd_h_timings ||
++	    (vc4_hdmi->variant->unsupported_int_odd_h_timings &&
++		(mode->flags & DRM_MODE_FLAG_INTERLACE))) {
+ 		if (mode->flags & DRM_MODE_FLAG_DBLCLK) {
+ 			/* Only try to fixup DBLCLK modes to get 480i and 576i
+ 			 * working.
+@@ -3481,6 +3483,7 @@ static const struct vc4_hdmi_variant bcm
+ 		PHY_LANE_CK,
+ 	},
+ 	.unsupported_odd_h_timings	= true,
++	.unsupported_int_odd_h_timings	= true,
+ 	.external_irq_controller	= true,
+ 
+ 	.init_resources		= vc5_hdmi_init_resources,
+@@ -3510,6 +3513,7 @@ static const struct vc4_hdmi_variant bcm
+ 		PHY_LANE_2,
+ 	},
+ 	.unsupported_odd_h_timings	= true,
++	.unsupported_int_odd_h_timings	= true,
+ 	.external_irq_controller	= true,
+ 
+ 	.init_resources		= vc5_hdmi_init_resources,
+@@ -3539,6 +3543,7 @@ static const struct vc4_hdmi_variant bcm
+ 		PHY_LANE_CK,
+ 	},
+ 	.unsupported_odd_h_timings	= false,
++	.unsupported_int_odd_h_timings	= true,
+ 	.external_irq_controller	= true,
+ 
+ 	.init_resources		= vc5_hdmi_init_resources,
+@@ -3566,6 +3571,7 @@ static const struct vc4_hdmi_variant bcm
+ 		PHY_LANE_CK,
+ 	},
+ 	.unsupported_odd_h_timings	= false,
++	.unsupported_int_odd_h_timings	= true,
+ 	.external_irq_controller	= true,
+ 
+ 	.init_resources		= vc5_hdmi_init_resources,
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.h
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.h
+@@ -48,6 +48,10 @@ struct vc4_hdmi_variant {
+ 
+ 	/* The BCM2711 cannot deal with odd horizontal pixel timings */
+ 	bool unsupported_odd_h_timings;
++	/* The BCM2712 can handle odd horizontal pixel timings, but not in
++	 * interlaced modes
++	 */
++	bool unsupported_int_odd_h_timings;
+ 
+ 	/*
+ 	 * The BCM2711 CEC/hotplug IRQ controller is shared between the
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0666-drm-vc4-fkms-Add-firmware-kms-mode.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0666-drm-vc4-fkms-Add-firmware-kms-mode.patch
new file mode 100644
index 00000000..1b40822e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0666-drm-vc4-fkms-Add-firmware-kms-mode.patch
@@ -0,0 +1,2645 @@
+From b8c35fa7c90dfd8b3efdf960006467846e0c2cfc Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 7 Sep 2020 17:32:27 +0100
+Subject: [PATCH 666/697] drm/vc4: fkms: Add firmware-kms mode
+
+This is a squash of all firmware-kms related patches from previous
+branches, up to and including
+"drm/vc4: Set the possible crtcs mask correctly for planes with FKMS"
+plus a couple of minor fixups for the 5.9 branch.
+Please refer to earlier branches for full history.
+
+This patch includes work by Eric Anholt, James Hughes, Phil Elwell,
+Dave Stevenson, Dom Cobley, and Jonathon Bell.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/vc4: Fixup firmware-kms after "drm/atomic: Pass the full state to CRTC atomic enable/disable"
+
+Prototype for those calls changed, so amend fkms (which isn't
+upstream) to match.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/vc4: Fixup fkms for API change
+
+Atomic flush and check changed API, so fix up the downstream-only
+FKMS driver.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/vc4: Make normalize_zpos conditional on using fkms
+
+Eric's view was that there was no point in having zpos
+support on vc4 as all the planes had the same functionality.
+
+Can be later squashed into (and fixes):
+drm/vc4: Add firmware-kms mode
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+drm/vc4: FKMS: Change of Broadcast RGB mode needs a mode change
+
+The Broadcast RGB (aka HDMI limited/full range) property is only
+notified to the firmware on mode change, so this needs to be
+signalled when set.
+
+https://github.com/raspberrypi/firmware/issues/1580
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+vc4/drv: Only notify firmware of display done with kms
+
+fkms driver still wants firmware display to be active
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+ydrm/vc4: fkms: Fix margin calculations for the right/bottom edges
+
+The calculations clipped the right/bottom edge of the clipped
+range based on the left/top margins.
+
+https://github.com/raspberrypi/linux/issues/4447
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/vc4: fkms: Use new devm_rpi_firmware_get api
+
+drm/kms: Add allow_fb_modifiers
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+
+drm/vc4: Add async update support for cursor planes
+
+Now that cursors are implemented as regular planes, all cursor
+movements result in atomic updates. As the firmware-kms driver
+doesn't support asynchronous updates, these are synchronous, which
+limits the update rate to the screen refresh rate. Xorg seems unaware
+of this (or at least of the effect of this), because if the mouse is
+configured with a higher update rate than the screen then continuous
+mouse movement results in an increasing backlog of mouse events -
+cue extreme lag.
+
+Add minimal support for asynchronous updates - limited to cursor
+planes - to eliminate the lag.
+
+See: https://github.com/raspberrypi/linux/pull/4971
+     https://github.com/raspberrypi/linux/issues/4988
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+
+drivers/gpu/drm/vc4: Add missing 32-bit RGB formats
+
+The missing 32-bit per pixel ABGR and various "RGB with an X value"
+formats are added. Change sent by Dave Stevenson.
+
+Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
+
+drm: vc4: Fixup duplicated macro definition in vc4_firmware_kms
+
+Both vc4_drv.h and vc4_firmware_kms.c had definitions for
+to_vc4_crtc.
+
+Rename the fkms one to make it unique, and drop the magic
+define vc4_crtc vc4_kms_crtc
+define to_vc4_crtc to_vc4_kms_crtc
+that renamed half the variable and function names in a slightly
+unexpected way.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/vc4: Fix FKMS for when the YUV chroma planes are different buffers
+
+The code was assuming that it was a single buffer with offsets,
+when kmstest uses separate buffers and 0 offsets for each plane.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/vc4: fkms: Rename plane related functions
+
+The name collide with the Full KMS functions that are going to be made
+public.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+
+drm/vc4_fkms: Fix up interrupt handler for both 2835/2711 and 2712
+
+2712 has switched from using the SMI peripheral to another interrupt
+source for the vsync interrupt, so handle both sources cleanly.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+drm/vc4: fkms: No SMI abuse needed on BCM2712
+
+Since we don't use the (absent) SMI block to create interrupts on
+BCM2712, there's no need to map any registers.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/Makefile           |    1 +
+ drivers/gpu/drm/vc4/vc4_debugfs.c      |    3 +-
+ drivers/gpu/drm/vc4/vc4_drv.c          |   29 +-
+ drivers/gpu/drm/vc4/vc4_drv.h          |    7 +
+ drivers/gpu/drm/vc4/vc4_firmware_kms.c | 2079 ++++++++++++++++++++++++
+ drivers/gpu/drm/vc4/vc4_kms.c          |   54 +-
+ drivers/gpu/drm/vc4/vc_image_types.h   |  175 ++
+ 7 files changed, 2324 insertions(+), 24 deletions(-)
+ create mode 100644 drivers/gpu/drm/vc4/vc4_firmware_kms.c
+ create mode 100644 drivers/gpu/drm/vc4/vc_image_types.h
+
+--- a/drivers/gpu/drm/vc4/Makefile
++++ b/drivers/gpu/drm/vc4/Makefile
+@@ -9,6 +9,7 @@ vc4-y := \
+ 	vc4_dpi.o \
+ 	vc4_dsi.o \
+ 	vc4_fence.o \
++	vc4_firmware_kms.o \
+ 	vc4_kms.o \
+ 	vc4_gem.o \
+ 	vc4_hdmi.o \
+--- a/drivers/gpu/drm/vc4/vc4_debugfs.c
++++ b/drivers/gpu/drm/vc4/vc4_debugfs.c
+@@ -24,7 +24,8 @@ vc4_debugfs_init(struct drm_minor *minor
+ 	struct vc4_dev *vc4 = to_vc4_dev(minor->dev);
+ 	struct drm_device *drm = &vc4->base;
+ 
+-	drm_WARN_ON(drm, vc4_hvs_debugfs_init(minor));
++	if (vc4->hvs)
++		drm_WARN_ON(drm, vc4_hvs_debugfs_init(minor));
+ 
+ 	if (vc4->v3d) {
+ 		drm_WARN_ON(drm, vc4_bo_debugfs_init(minor));
+--- a/drivers/gpu/drm/vc4/vc4_drv.c
++++ b/drivers/gpu/drm/vc4/vc4_drv.c
+@@ -299,6 +299,18 @@ static const struct of_device_id vc4_dma
+ 	{}
+ };
+ 
++/*
++ * we need this helper function for determining presence of fkms
++ * before it's been bound
++ */
++static bool firmware_kms(void)
++{
++	return of_device_is_available(of_find_compatible_node(NULL, NULL,
++	       "raspberrypi,rpi-firmware-kms")) ||
++	       of_device_is_available(of_find_compatible_node(NULL, NULL,
++	       "raspberrypi,rpi-firmware-kms-2711"));
++}
++
+ static int vc4_drm_bind(struct device *dev)
+ {
+ 	struct platform_device *pdev = to_platform_device(dev);
+@@ -379,7 +391,7 @@ static int vc4_drm_bind(struct device *d
+ 	if (ret)
+ 		goto err;
+ 
+-	if (firmware) {
++	if (firmware && !firmware_kms()) {
+ 		ret = rpi_firmware_property(firmware,
+ 					    RPI_FIRMWARE_NOTIFY_DISPLAY_DONE,
+ 					    NULL, 0);
+@@ -397,16 +409,20 @@ static int vc4_drm_bind(struct device *d
+ 	if (ret)
+ 		goto err;
+ 
+-	ret = vc4_plane_create_additional_planes(drm);
+-	if (ret)
+-		goto err;
++	if (!vc4->firmware_kms) {
++		ret = vc4_plane_create_additional_planes(drm);
++		if (ret)
++			goto err;
++	}
+ 
+ 	ret = vc4_kms_load(drm);
+ 	if (ret < 0)
+ 		goto err;
+ 
+-	drm_for_each_crtc(crtc, drm)
+-		vc4_crtc_disable_at_boot(crtc);
++	if (!vc4->firmware_kms) {
++		drm_for_each_crtc(crtc, drm)
++			vc4_crtc_disable_at_boot(crtc);
++	}
+ 
+ 	ret = drm_dev_register(drm, 0);
+ 	if (ret < 0)
+@@ -452,6 +468,7 @@ static struct platform_driver *const com
+ 	&vc4_dsi_driver,
+ 	&vc4_txp_driver,
+ 	&vc4_crtc_driver,
++	&vc4_firmware_kms_driver,
+ 	&vc4_v3d_driver,
+ };
+ 
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -96,8 +96,12 @@ struct vc4_dev {
+ 
+ 	unsigned int irq;
+ 
++	bool firmware_kms;
++	struct rpi_firmware *firmware;
++
+ 	struct vc4_hvs *hvs;
+ 	struct vc4_v3d *v3d;
++	struct vc4_fkms *fkms;
+ 
+ 	struct vc4_hang_state *hang_state;
+ 
+@@ -1031,6 +1035,9 @@ extern struct platform_driver vc4_dsi_dr
+ /* vc4_fence.c */
+ extern const struct dma_fence_ops vc4_fence_ops;
+ 
++/* vc4_firmware_kms.c */
++extern struct platform_driver vc4_firmware_kms_driver;
++
+ /* vc4_gem.c */
+ int vc4_gem_init(struct drm_device *dev);
+ int vc4_submit_cl_ioctl(struct drm_device *dev, void *data,
+--- /dev/null
++++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+@@ -0,0 +1,2079 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * Copyright (C) 2016 Broadcom
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++/**
++ * DOC: VC4 firmware KMS module.
++ *
++ * As a hack to get us from the current closed source driver world
++ * toward a totally open stack, implement KMS on top of the Raspberry
++ * Pi's firmware display stack.
++ */
++
++#include <drm/drm_atomic_helper.h>
++#include <drm/drm_crtc_helper.h>
++#include <drm/drm_blend.h>
++#include <drm/drm_drv.h>
++#include <drm/drm_edid.h>
++#include <drm/drm_fb_dma_helper.h>
++#include <drm/drm_fourcc.h>
++#include <drm/drm_framebuffer.h>
++#include <drm/drm_gem_atomic_helper.h>
++#include <drm/drm_plane_helper.h>
++#include <drm/drm_probe_helper.h>
++#include <drm/drm_vblank.h>
++
++#include <linux/component.h>
++#include <linux/clk.h>
++#include <linux/debugfs.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++
++#include <soc/bcm2835/raspberrypi-firmware.h>
++
++#include "vc4_drv.h"
++#include "vc4_regs.h"
++#include "vc_image_types.h"
++
++int fkms_max_refresh_rate = 85;
++module_param(fkms_max_refresh_rate, int, 0644);
++MODULE_PARM_DESC(fkms_max_refresh_rate, "Max supported refresh rate");
++
++struct get_display_cfg {
++	u32  max_pixel_clock[2];  //Max pixel clock for each display
++};
++
++enum vc4_fkms_revision {
++	BCM2835_6_7,
++	BCM2711,
++	BCM2712,
++};
++
++struct vc4_fkms {
++	struct get_display_cfg cfg;
++	enum vc4_fkms_revision revision;
++};
++
++#define PLANES_PER_CRTC		8
++
++struct set_plane {
++	u8 display;
++	u8 plane_id;
++	u8 vc_image_type;
++	s8 layer;
++
++	u16 width;
++	u16 height;
++
++	u16 pitch;
++	u16 vpitch;
++
++	u32 src_x;	/* 16p16 */
++	u32 src_y;	/* 16p16 */
++
++	u32 src_w;	/* 16p16 */
++	u32 src_h;	/* 16p16 */
++
++	s16 dst_x;
++	s16 dst_y;
++
++	u16 dst_w;
++	u16 dst_h;
++
++	u8 alpha;
++	u8 num_planes;
++	u8 is_vu;
++	u8 color_encoding;
++
++	u32 planes[4];  /* DMA address of each plane */
++
++	u32 transform;
++};
++
++/* Values for the transform field */
++#define TRANSFORM_NO_ROTATE	0
++#define TRANSFORM_ROTATE_180	BIT(1)
++#define TRANSFORM_FLIP_HRIZ	BIT(16)
++#define TRANSFORM_FLIP_VERT	BIT(17)
++
++struct mailbox_set_plane {
++	struct rpi_firmware_property_tag_header tag;
++	struct set_plane plane;
++};
++
++struct mailbox_blank_display {
++	struct rpi_firmware_property_tag_header tag1;
++	u32 display;
++	struct rpi_firmware_property_tag_header tag2;
++	u32 blank;
++};
++
++struct mailbox_display_pwr {
++	struct rpi_firmware_property_tag_header tag1;
++	u32 display;
++	u32 state;
++};
++
++struct mailbox_get_edid {
++	struct rpi_firmware_property_tag_header tag1;
++	u32 block;
++	u32 display_number;
++	u8 edid[128];
++};
++
++struct set_timings {
++	u8 display;
++	u8 padding;
++	u16 video_id_code;
++
++	u32 clock;		/* in kHz */
++
++	u16 hdisplay;
++	u16 hsync_start;
++
++	u16 hsync_end;
++	u16 htotal;
++
++	u16 hskew;
++	u16 vdisplay;
++
++	u16 vsync_start;
++	u16 vsync_end;
++
++	u16 vtotal;
++	u16 vscan;
++
++	u16 vrefresh;
++	u16 padding2;
++
++	u32 flags;
++#define  TIMINGS_FLAGS_H_SYNC_POS	BIT(0)
++#define  TIMINGS_FLAGS_H_SYNC_NEG	0
++#define  TIMINGS_FLAGS_V_SYNC_POS	BIT(1)
++#define  TIMINGS_FLAGS_V_SYNC_NEG	0
++#define  TIMINGS_FLAGS_INTERLACE	BIT(2)
++
++#define TIMINGS_FLAGS_ASPECT_MASK	GENMASK(7, 4)
++#define TIMINGS_FLAGS_ASPECT_NONE	(0 << 4)
++#define TIMINGS_FLAGS_ASPECT_4_3	(1 << 4)
++#define TIMINGS_FLAGS_ASPECT_16_9	(2 << 4)
++#define TIMINGS_FLAGS_ASPECT_64_27	(3 << 4)
++#define TIMINGS_FLAGS_ASPECT_256_135	(4 << 4)
++
++/* Limited range RGB flag. Not set corresponds to full range. */
++#define TIMINGS_FLAGS_RGB_LIMITED	BIT(8)
++/* DVI monitor, therefore disable infoframes. Not set corresponds to HDMI. */
++#define TIMINGS_FLAGS_DVI		BIT(9)
++/* Double clock */
++#define TIMINGS_FLAGS_DBL_CLK		BIT(10)
++};
++
++struct mailbox_set_mode {
++	struct rpi_firmware_property_tag_header tag1;
++	struct set_timings timings;
++};
++
++static const struct vc_image_format {
++	u32 drm;	/* DRM_FORMAT_* */
++	u32 vc_image;	/* VC_IMAGE_* */
++	u32 is_vu;
++} vc_image_formats[] = {
++	{
++		.drm = DRM_FORMAT_XRGB8888,
++		.vc_image = VC_IMAGE_XRGB8888,
++	},
++	{
++		.drm = DRM_FORMAT_ARGB8888,
++		.vc_image = VC_IMAGE_ARGB8888,
++	},
++	{
++		.drm = DRM_FORMAT_XBGR8888,
++		.vc_image = VC_IMAGE_RGBX32,
++	},
++	{
++		.drm = DRM_FORMAT_ABGR8888,
++		.vc_image = VC_IMAGE_RGBA32,
++	},
++	{
++		.drm = DRM_FORMAT_RGBX8888,
++		.vc_image = VC_IMAGE_BGRX8888,
++	},
++	{
++		.drm = DRM_FORMAT_BGRX8888,
++		.vc_image = VC_IMAGE_RGBX8888,
++	},
++	{
++		.drm = DRM_FORMAT_RGB565,
++		.vc_image = VC_IMAGE_RGB565,
++	},
++	{
++		.drm = DRM_FORMAT_RGB888,
++		.vc_image = VC_IMAGE_BGR888,
++	},
++	{
++		.drm = DRM_FORMAT_BGR888,
++		.vc_image = VC_IMAGE_RGB888,
++	},
++	{
++		.drm = DRM_FORMAT_YUV422,
++		.vc_image = VC_IMAGE_YUV422PLANAR,
++	},
++	{
++		.drm = DRM_FORMAT_YUV420,
++		.vc_image = VC_IMAGE_YUV420,
++	},
++	{
++		.drm = DRM_FORMAT_YVU420,
++		.vc_image = VC_IMAGE_YUV420,
++		.is_vu = 1,
++	},
++	{
++		.drm = DRM_FORMAT_NV12,
++		.vc_image = VC_IMAGE_YUV420SP,
++	},
++	{
++		.drm = DRM_FORMAT_NV21,
++		.vc_image = VC_IMAGE_YUV420SP,
++		.is_vu = 1,
++	},
++	{
++		.drm = DRM_FORMAT_P030,
++		.vc_image = VC_IMAGE_YUV10COL,
++	},
++};
++
++static const struct vc_image_format *vc4_get_vc_image_fmt(u32 drm_format)
++{
++	unsigned int i;
++
++	for (i = 0; i < ARRAY_SIZE(vc_image_formats); i++) {
++		if (vc_image_formats[i].drm == drm_format)
++			return &vc_image_formats[i];
++	}
++
++	return NULL;
++}
++
++/* The firmware delivers a vblank interrupt to us through the SMI
++ * hardware, which has only this one register.
++ */
++#define SMICS 0x0
++#define SMIDSW0 0x14
++#define SMIDSW1 0x1C
++#define SMICS_INTERRUPTS (BIT(9) | BIT(10) | BIT(11))
++
++/* Flag to denote that the firmware is giving multiple display callbacks */
++#define SMI_NEW 0xabcd0000
++
++struct vc4_fkms_crtc {
++	struct drm_crtc base;
++	struct drm_encoder *encoder;
++	struct drm_connector *connector;
++	void __iomem *regs;
++
++	struct drm_pending_vblank_event *event;
++	bool vblank_enabled;
++	u32 display_number;
++	u32 display_type;
++};
++
++static inline struct vc4_fkms_crtc *to_vc4_fkms_crtc(struct drm_crtc *crtc)
++{
++	return container_of(crtc, struct vc4_fkms_crtc, base);
++}
++
++struct vc4_fkms_encoder {
++	struct drm_encoder base;
++	bool hdmi_monitor;
++	bool rgb_range_selectable;
++	int display_num;
++};
++
++static inline struct vc4_fkms_encoder *
++to_vc4_fkms_encoder(struct drm_encoder *encoder)
++{
++	return container_of(encoder, struct vc4_fkms_encoder, base);
++}
++
++/* "Broadcast RGB" property.
++ * Allows overriding of HDMI full or limited range RGB
++ */
++#define VC4_BROADCAST_RGB_AUTO 0
++#define VC4_BROADCAST_RGB_FULL 1
++#define VC4_BROADCAST_RGB_LIMITED 2
++
++/* VC4 FKMS connector KMS struct */
++struct vc4_fkms_connector {
++	struct drm_connector base;
++
++	/* Since the connector is attached to just the one encoder,
++	 * this is the reference to it so we can do the best_encoder()
++	 * hook.
++	 */
++	struct drm_encoder *encoder;
++	struct vc4_dev *vc4_dev;
++	u32 display_number;
++	u32 display_type;
++
++	struct drm_property *broadcast_rgb_property;
++};
++
++static inline struct vc4_fkms_connector *
++to_vc4_fkms_connector(struct drm_connector *connector)
++{
++	return container_of(connector, struct vc4_fkms_connector, base);
++}
++
++/* VC4 FKMS connector state */
++struct vc4_fkms_connector_state {
++	struct drm_connector_state base;
++
++	int broadcast_rgb;
++};
++
++#define to_vc4_fkms_connector_state(x) \
++			container_of(x, struct vc4_fkms_connector_state, base)
++
++static u32 vc4_get_display_type(u32 display_number)
++{
++	const u32 display_types[] = {
++		/* The firmware display (DispmanX) IDs map to specific types in
++		 * a fixed manner.
++		 */
++		DRM_MODE_ENCODER_DSI,	/* MAIN_LCD - DSI or DPI */
++		DRM_MODE_ENCODER_DSI,	/* AUX_LCD */
++		DRM_MODE_ENCODER_TMDS,	/* HDMI0 */
++		DRM_MODE_ENCODER_TVDAC,	/* VEC */
++		DRM_MODE_ENCODER_NONE,	/* FORCE_LCD */
++		DRM_MODE_ENCODER_NONE,	/* FORCE_TV */
++		DRM_MODE_ENCODER_NONE,	/* FORCE_OTHER */
++		DRM_MODE_ENCODER_TMDS,	/* HDMI1 */
++		DRM_MODE_ENCODER_NONE,	/* FORCE_TV2 */
++	};
++	return display_number > ARRAY_SIZE(display_types) - 1 ?
++			DRM_MODE_ENCODER_NONE : display_types[display_number];
++}
++
++/* Firmware's structure for making an FB mbox call. */
++struct fbinfo_s {
++	u32 xres, yres, xres_virtual, yres_virtual;
++	u32 pitch, bpp;
++	u32 xoffset, yoffset;
++	u32 base;
++	u32 screen_size;
++	u16 cmap[256];
++};
++
++struct vc4_fkms_plane {
++	struct drm_plane base;
++	struct fbinfo_s *fbinfo;
++	dma_addr_t fbinfo_bus_addr;
++	u32 pitch;
++	struct mailbox_set_plane mb;
++};
++
++static inline struct vc4_fkms_plane *to_vc4_fkms_plane(struct drm_plane *plane)
++{
++	return (struct vc4_fkms_plane *)plane;
++}
++
++static int vc4_plane_set_blank(struct drm_plane *plane, bool blank)
++{
++	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
++	struct vc4_fkms_plane *vc4_plane = to_vc4_fkms_plane(plane);
++	struct mailbox_set_plane blank_mb = {
++		.tag = { RPI_FIRMWARE_SET_PLANE, sizeof(struct set_plane), 0 },
++		.plane = {
++			.display = vc4_plane->mb.plane.display,
++			.plane_id = vc4_plane->mb.plane.plane_id,
++		}
++	};
++	static const char * const plane_types[] = {
++							"overlay",
++							"primary",
++							"cursor"
++						  };
++	int ret;
++
++	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] %s plane %s",
++			 plane->base.id, plane->name, plane_types[plane->type],
++			 blank ? "blank" : "unblank");
++
++	if (blank)
++		ret = rpi_firmware_property_list(vc4->firmware, &blank_mb,
++						 sizeof(blank_mb));
++	else
++		ret = rpi_firmware_property_list(vc4->firmware, &vc4_plane->mb,
++						 sizeof(vc4_plane->mb));
++
++	WARN_ONCE(ret, "%s: firmware call failed. Please update your firmware",
++		  __func__);
++	return ret;
++}
++
++static void vc4_fkms_crtc_get_margins(struct drm_crtc_state *state,
++				      unsigned int *left, unsigned int *right,
++				      unsigned int *top, unsigned int *bottom)
++{
++	struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(state);
++	struct drm_connector_state *conn_state;
++	struct drm_connector *conn;
++	int i;
++
++	*left = vc4_state->margins.left;
++	*right = vc4_state->margins.right;
++	*top = vc4_state->margins.top;
++	*bottom = vc4_state->margins.bottom;
++
++	/* We have to interate over all new connector states because
++	 * vc4_fkms_crtc_get_margins() might be called before
++	 * vc4_fkms_crtc_atomic_check() which means margins info in
++	 * vc4_crtc_state might be outdated.
++	 */
++	for_each_new_connector_in_state(state->state, conn, conn_state, i) {
++		if (conn_state->crtc != state->crtc)
++			continue;
++
++		*left = conn_state->tv.margins.left;
++		*right = conn_state->tv.margins.right;
++		*top = conn_state->tv.margins.top;
++		*bottom = conn_state->tv.margins.bottom;
++		break;
++	}
++}
++
++static int vc4_fkms_margins_adj(struct drm_plane_state *pstate,
++				struct set_plane *plane)
++{
++	unsigned int left, right, top, bottom;
++	int adjhdisplay, adjvdisplay;
++	struct drm_crtc_state *crtc_state;
++
++	crtc_state = drm_atomic_get_new_crtc_state(pstate->state,
++						   pstate->crtc);
++
++	vc4_fkms_crtc_get_margins(crtc_state, &left, &right, &top, &bottom);
++
++	if (!left && !right && !top && !bottom)
++		return 0;
++
++	if (left + right >= crtc_state->mode.hdisplay ||
++	    top + bottom >= crtc_state->mode.vdisplay)
++		return -EINVAL;
++
++	adjhdisplay = crtc_state->mode.hdisplay - (left + right);
++	plane->dst_x = DIV_ROUND_CLOSEST(plane->dst_x * adjhdisplay,
++					 (int)crtc_state->mode.hdisplay);
++	plane->dst_x += left;
++	if (plane->dst_x > (int)(crtc_state->mode.hdisplay - right))
++		plane->dst_x = crtc_state->mode.hdisplay - right;
++
++	adjvdisplay = crtc_state->mode.vdisplay - (top + bottom);
++	plane->dst_y = DIV_ROUND_CLOSEST(plane->dst_y * adjvdisplay,
++					 (int)crtc_state->mode.vdisplay);
++	plane->dst_y += top;
++	if (plane->dst_y > (int)(crtc_state->mode.vdisplay - bottom))
++		plane->dst_y = crtc_state->mode.vdisplay - bottom;
++
++	plane->dst_w = DIV_ROUND_CLOSEST(plane->dst_w * adjhdisplay,
++					 crtc_state->mode.hdisplay);
++	plane->dst_h = DIV_ROUND_CLOSEST(plane->dst_h * adjvdisplay,
++					 crtc_state->mode.vdisplay);
++
++	if (!plane->dst_w || !plane->dst_h)
++		return -EINVAL;
++
++	return 0;
++}
++
++static void vc4_plane_atomic_update(struct drm_plane *plane,
++				    struct drm_atomic_state *old_state)
++{
++	struct drm_plane_state *state = plane->state;
++
++	/*
++	 * Do NOT set now, as we haven't checked if the crtc is active or not.
++	 * Set from vc4_plane_set_blank instead.
++	 *
++	 * If the CRTC is on (or going to be on) and we're enabled,
++	 * then unblank.  Otherwise, stay blank until CRTC enable.
++	 */
++	if (state->crtc->state->active)
++		vc4_plane_set_blank(plane, false);
++}
++
++static void vc4_plane_atomic_disable(struct drm_plane *plane,
++				     struct drm_atomic_state *old_state)
++{
++	struct drm_plane_state *state = plane->state;
++	struct vc4_fkms_plane *vc4_plane = to_vc4_fkms_plane(plane);
++
++	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] plane disable %dx%d@%d +%d,%d\n",
++			 plane->base.id, plane->name,
++			 state->crtc_w,
++			 state->crtc_h,
++			 vc4_plane->mb.plane.vc_image_type,
++			 state->crtc_x,
++			 state->crtc_y);
++	vc4_plane_set_blank(plane, true);
++}
++
++static bool plane_enabled(struct drm_plane_state *state)
++{
++	return state->fb && state->crtc;
++}
++
++static int vc4_plane_to_mb(struct drm_plane *plane,
++			   struct mailbox_set_plane *mb,
++			   struct drm_plane_state *state)
++{
++	struct drm_framebuffer *fb = state->fb;
++	struct drm_gem_dma_object *bo;
++	const struct drm_format_info *drm_fmt = fb->format;
++	const struct vc_image_format *vc_fmt =
++					vc4_get_vc_image_fmt(drm_fmt->format);
++	int num_planes = fb->format->num_planes;
++	unsigned int rotation;
++
++	mb->plane.vc_image_type = vc_fmt->vc_image;
++	mb->plane.width = fb->width;
++	mb->plane.height = fb->height;
++	mb->plane.pitch = fb->pitches[0];
++	mb->plane.src_w = state->src_w;
++	mb->plane.src_h = state->src_h;
++	mb->plane.src_x = state->src_x;
++	mb->plane.src_y = state->src_y;
++	mb->plane.dst_w = state->crtc_w;
++	mb->plane.dst_h = state->crtc_h;
++	mb->plane.dst_x = state->crtc_x;
++	mb->plane.dst_y = state->crtc_y;
++	mb->plane.alpha = state->alpha >> 8;
++	mb->plane.layer = state->normalized_zpos ?
++					state->normalized_zpos : -127;
++	mb->plane.num_planes = num_planes;
++	mb->plane.is_vu = vc_fmt->is_vu;
++	bo = drm_fb_dma_get_gem_obj(fb, 0);
++	mb->plane.planes[0] = bo->dma_addr + fb->offsets[0];
++
++	rotation = drm_rotation_simplify(state->rotation,
++					 DRM_MODE_ROTATE_0 |
++					 DRM_MODE_REFLECT_X |
++					 DRM_MODE_REFLECT_Y);
++
++	mb->plane.transform = TRANSFORM_NO_ROTATE;
++	if (rotation & DRM_MODE_REFLECT_X)
++		mb->plane.transform |= TRANSFORM_FLIP_HRIZ;
++	if (rotation & DRM_MODE_REFLECT_Y)
++		mb->plane.transform |= TRANSFORM_FLIP_VERT;
++
++	vc4_fkms_margins_adj(state, &mb->plane);
++
++	if (num_planes > 1) {
++		/* Assume this must be YUV */
++		/* Makes assumptions on the stride for the chroma planes as we
++		 * can't easily plumb in non-standard pitches.
++		 */
++		bo = drm_fb_dma_get_gem_obj(fb, 1);
++		mb->plane.planes[1] = bo->dma_addr + fb->offsets[1];
++		if (num_planes > 2) {
++			bo = drm_fb_dma_get_gem_obj(fb, 2);
++			mb->plane.planes[2] = bo->dma_addr + fb->offsets[2];
++		} else {
++			mb->plane.planes[2] = 0;
++		}
++
++		/* Special case the YUV420 with U and V as line interleaved
++		 * planes as we have special handling for that case.
++		 */
++		if (num_planes == 3 &&
++		    (fb->offsets[2] - fb->offsets[1]) == fb->pitches[1])
++			mb->plane.vc_image_type = VC_IMAGE_YUV420_S;
++
++		switch (state->color_encoding) {
++		default:
++		case DRM_COLOR_YCBCR_BT601:
++			if (state->color_range == DRM_COLOR_YCBCR_LIMITED_RANGE)
++				mb->plane.color_encoding =
++						VC_IMAGE_YUVINFO_CSC_ITUR_BT601;
++			else
++				mb->plane.color_encoding =
++						VC_IMAGE_YUVINFO_CSC_JPEG_JFIF;
++			break;
++		case DRM_COLOR_YCBCR_BT709:
++			/* Currently no support for a full range BT709 */
++			mb->plane.color_encoding =
++						VC_IMAGE_YUVINFO_CSC_ITUR_BT709;
++			break;
++		case DRM_COLOR_YCBCR_BT2020:
++			/* Currently no support for a full range BT2020 */
++			mb->plane.color_encoding =
++					VC_IMAGE_YUVINFO_CSC_REC_2020;
++			break;
++		}
++	} else {
++		mb->plane.planes[1] = 0;
++		mb->plane.planes[2] = 0;
++	}
++	mb->plane.planes[3] = 0;
++
++	switch (fourcc_mod_broadcom_mod(fb->modifier)) {
++	case DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED:
++		switch (mb->plane.vc_image_type) {
++		case VC_IMAGE_XRGB8888:
++			mb->plane.vc_image_type = VC_IMAGE_TF_RGBX32;
++			break;
++		case VC_IMAGE_ARGB8888:
++			mb->plane.vc_image_type = VC_IMAGE_TF_RGBA32;
++			break;
++		case VC_IMAGE_RGB565:
++			mb->plane.vc_image_type = VC_IMAGE_TF_RGB565;
++			break;
++		}
++		break;
++	case DRM_FORMAT_MOD_BROADCOM_SAND128:
++		switch (mb->plane.vc_image_type) {
++		case VC_IMAGE_YUV420SP:
++			mb->plane.vc_image_type = VC_IMAGE_YUV_UV;
++			break;
++		/* VC_IMAGE_YUV10COL could be included in here, but it is only
++		 * valid as a SAND128 format, so the table at the top will have
++		 * already set the correct format.
++		 */
++		}
++		/* Note that the column pitch is passed across in lines, not
++		 * bytes.
++		 */
++		mb->plane.pitch = fourcc_mod_broadcom_param(fb->modifier);
++		break;
++	}
++
++	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] plane update %dx%d@%d +dst(%d,%d, %d,%d) +src(%d,%d, %d,%d) 0x%08x/%08x/%08x/%d, alpha %u zpos %u\n",
++			 plane->base.id, plane->name,
++			 mb->plane.width,
++			 mb->plane.height,
++			 mb->plane.vc_image_type,
++			 state->crtc_x,
++			 state->crtc_y,
++			 state->crtc_w,
++			 state->crtc_h,
++			 mb->plane.src_x,
++			 mb->plane.src_y,
++			 mb->plane.src_w,
++			 mb->plane.src_h,
++			 mb->plane.planes[0],
++			 mb->plane.planes[1],
++			 mb->plane.planes[2],
++			 fb->pitches[0],
++			 state->alpha,
++			 state->normalized_zpos);
++
++	return 0;
++}
++
++static int vc4_fkms_plane_atomic_check(struct drm_plane *plane,
++				       struct drm_atomic_state *state)
++{
++	struct drm_plane_state *new_plane_state = drm_atomic_get_new_plane_state(state,
++										 plane);
++	struct vc4_fkms_plane *vc4_plane = to_vc4_fkms_plane(plane);
++
++	if (!plane_enabled(new_plane_state))
++		return 0;
++
++	return vc4_plane_to_mb(plane, &vc4_plane->mb, new_plane_state);
++}
++
++static void vc4_plane_atomic_async_update(struct drm_plane *plane,
++					  struct drm_atomic_state *state)
++{
++	struct drm_plane_state *new_plane_state =
++		drm_atomic_get_new_plane_state(state, plane);
++
++	swap(plane->state->fb, new_plane_state->fb);
++	plane->state->crtc_x = new_plane_state->crtc_x;
++	plane->state->crtc_y = new_plane_state->crtc_y;
++	plane->state->crtc_w = new_plane_state->crtc_w;
++	plane->state->crtc_h = new_plane_state->crtc_h;
++	plane->state->src_x = new_plane_state->src_x;
++	plane->state->src_y = new_plane_state->src_y;
++	plane->state->src_w = new_plane_state->src_w;
++	plane->state->src_h = new_plane_state->src_h;
++	plane->state->alpha = new_plane_state->alpha;
++	plane->state->pixel_blend_mode = new_plane_state->pixel_blend_mode;
++	plane->state->rotation = new_plane_state->rotation;
++	plane->state->zpos = new_plane_state->zpos;
++	plane->state->normalized_zpos = new_plane_state->normalized_zpos;
++	plane->state->color_encoding = new_plane_state->color_encoding;
++	plane->state->color_range = new_plane_state->color_range;
++	plane->state->src = new_plane_state->src;
++	plane->state->dst = new_plane_state->dst;
++	plane->state->visible = new_plane_state->visible;
++
++	vc4_plane_set_blank(plane, false);
++}
++
++static int vc4_plane_atomic_async_check(struct drm_plane *plane,
++					struct drm_atomic_state *state)
++{
++	struct drm_plane_state *new_plane_state =
++		drm_atomic_get_new_plane_state(state, plane);
++	int ret = -EINVAL;
++
++	if (plane->type == 2 &&
++	    plane->state->fb &&
++	    new_plane_state->crtc->state->active)
++		ret = 0;
++
++	return ret;
++}
++
++/* Called during init to allocate the plane's atomic state. */
++static void vc4_fkms_plane_reset(struct drm_plane *plane)
++{
++	struct vc4_plane_state *vc4_state;
++
++	WARN_ON(plane->state);
++
++	vc4_state = kzalloc(sizeof(*vc4_state), GFP_KERNEL);
++	if (!vc4_state)
++		return;
++
++	__drm_atomic_helper_plane_reset(plane, &vc4_state->base);
++}
++
++static void vc4_plane_destroy(struct drm_plane *plane)
++{
++	drm_plane_cleanup(plane);
++}
++
++static bool vc4_fkms_format_mod_supported(struct drm_plane *plane,
++					  uint32_t format,
++					  uint64_t modifier)
++{
++	/* Support T_TILING for RGB formats only. */
++	switch (format) {
++	case DRM_FORMAT_XRGB8888:
++	case DRM_FORMAT_ARGB8888:
++	case DRM_FORMAT_RGB565:
++		switch (modifier) {
++		case DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED:
++		case DRM_FORMAT_MOD_LINEAR:
++			return true;
++		default:
++			return false;
++		}
++	case DRM_FORMAT_NV12:
++		switch (fourcc_mod_broadcom_mod(modifier)) {
++		case DRM_FORMAT_MOD_LINEAR:
++		case DRM_FORMAT_MOD_BROADCOM_SAND128:
++			return true;
++		default:
++			return false;
++		}
++	case DRM_FORMAT_P030:
++		switch (fourcc_mod_broadcom_mod(modifier)) {
++		case DRM_FORMAT_MOD_BROADCOM_SAND128:
++			return true;
++		default:
++			return false;
++		}
++	case DRM_FORMAT_NV21:
++	case DRM_FORMAT_RGB888:
++	case DRM_FORMAT_BGR888:
++	case DRM_FORMAT_YUV422:
++	case DRM_FORMAT_YUV420:
++	case DRM_FORMAT_YVU420:
++	default:
++		return (modifier == DRM_FORMAT_MOD_LINEAR);
++	}
++}
++
++static struct drm_plane_state *vc4_fkms_plane_duplicate_state(struct drm_plane *plane)
++{
++	struct vc4_plane_state *vc4_state;
++
++	if (WARN_ON(!plane->state))
++		return NULL;
++
++	vc4_state = kzalloc(sizeof(*vc4_state), GFP_KERNEL);
++	if (!vc4_state)
++		return NULL;
++
++	__drm_atomic_helper_plane_duplicate_state(plane, &vc4_state->base);
++
++	return &vc4_state->base;
++}
++
++static const struct drm_plane_funcs vc4_plane_funcs = {
++	.update_plane = drm_atomic_helper_update_plane,
++	.disable_plane = drm_atomic_helper_disable_plane,
++	.destroy = vc4_plane_destroy,
++	.set_property = NULL,
++	.reset = vc4_fkms_plane_reset,
++	.atomic_duplicate_state = vc4_fkms_plane_duplicate_state,
++	.atomic_destroy_state = drm_atomic_helper_plane_destroy_state,
++	.format_mod_supported = vc4_fkms_format_mod_supported,
++};
++
++static const struct drm_plane_helper_funcs vc4_plane_helper_funcs = {
++	.prepare_fb = drm_gem_plane_helper_prepare_fb,
++	.cleanup_fb = NULL,
++	.atomic_check = vc4_fkms_plane_atomic_check,
++	.atomic_update = vc4_plane_atomic_update,
++	.atomic_disable = vc4_plane_atomic_disable,
++	.atomic_async_check = vc4_plane_atomic_async_check,
++	.atomic_async_update = vc4_plane_atomic_async_update,
++};
++
++static struct drm_plane *vc4_fkms_plane_init(struct drm_device *dev,
++					     enum drm_plane_type type,
++					     u8 display_num,
++					     u8 plane_id)
++{
++	struct drm_plane *plane = NULL;
++	struct vc4_fkms_plane *vc4_plane;
++	u32 formats[ARRAY_SIZE(vc_image_formats)];
++	unsigned int default_zpos = 0;
++	u32 num_formats = 0;
++	int ret = 0;
++	static const uint64_t modifiers[] = {
++		DRM_FORMAT_MOD_LINEAR,
++		/* VC4_T_TILED should come after linear, because we
++		 * would prefer to scan out linear (less bus traffic).
++		 */
++		DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED,
++		DRM_FORMAT_MOD_BROADCOM_SAND128,
++		DRM_FORMAT_MOD_INVALID,
++	};
++	int i;
++
++	vc4_plane = devm_kzalloc(dev->dev, sizeof(*vc4_plane),
++				 GFP_KERNEL);
++	if (!vc4_plane) {
++		ret = -ENOMEM;
++		goto fail;
++	}
++
++	for (i = 0; i < ARRAY_SIZE(vc_image_formats); i++)
++		formats[num_formats++] = vc_image_formats[i].drm;
++
++	plane = &vc4_plane->base;
++	ret = drm_universal_plane_init(dev, plane, 0,
++				       &vc4_plane_funcs,
++				       formats, num_formats, modifiers,
++				       type, NULL);
++
++	/* FIXME: Do we need to be checking return values from all these calls?
++	 */
++	drm_plane_helper_add(plane, &vc4_plane_helper_funcs);
++
++	drm_plane_create_alpha_property(plane);
++	drm_plane_create_rotation_property(plane, DRM_MODE_ROTATE_0,
++					   DRM_MODE_ROTATE_0 |
++					   DRM_MODE_ROTATE_180 |
++					   DRM_MODE_REFLECT_X |
++					   DRM_MODE_REFLECT_Y);
++	drm_plane_create_color_properties(plane,
++					  BIT(DRM_COLOR_YCBCR_BT601) |
++					  BIT(DRM_COLOR_YCBCR_BT709) |
++					  BIT(DRM_COLOR_YCBCR_BT2020),
++					  BIT(DRM_COLOR_YCBCR_LIMITED_RANGE) |
++					  BIT(DRM_COLOR_YCBCR_FULL_RANGE),
++					  DRM_COLOR_YCBCR_BT709,
++					  DRM_COLOR_YCBCR_LIMITED_RANGE);
++
++	/*
++	 * Default frame buffer setup is with FB on -127, and raspistill etc
++	 * tend to drop overlays on layer 2. Cursor plane was on layer +127.
++	 *
++	 * For F-KMS the mailbox call allows for a s8.
++	 * Remap zpos 0 to -127 for the background layer, but leave all the
++	 * other layers as requested by KMS.
++	 */
++	switch (type) {
++	default:
++	case DRM_PLANE_TYPE_PRIMARY:
++		default_zpos = 0;
++		break;
++	case DRM_PLANE_TYPE_OVERLAY:
++		default_zpos = 1;
++		break;
++	case DRM_PLANE_TYPE_CURSOR:
++		default_zpos = 2;
++		break;
++	}
++	drm_plane_create_zpos_property(plane, default_zpos, 0, 127);
++
++	/* Prepare the static elements of the mailbox structure */
++	vc4_plane->mb.tag.tag = RPI_FIRMWARE_SET_PLANE;
++	vc4_plane->mb.tag.buf_size = sizeof(struct set_plane);
++	vc4_plane->mb.tag.req_resp_size = 0;
++	vc4_plane->mb.plane.display = display_num;
++	vc4_plane->mb.plane.plane_id = plane_id;
++	vc4_plane->mb.plane.layer = default_zpos ? default_zpos : -127;
++
++	return plane;
++fail:
++	if (plane)
++		vc4_plane_destroy(plane);
++
++	return ERR_PTR(ret);
++}
++
++static void vc4_crtc_mode_set_nofb(struct drm_crtc *crtc)
++{
++	struct drm_device *dev = crtc->dev;
++	struct vc4_dev *vc4 = to_vc4_dev(dev);
++	struct vc4_fkms_crtc *vc4_fkms_crtc = to_vc4_fkms_crtc(crtc);
++	struct drm_display_mode *mode = &crtc->state->adjusted_mode;
++	struct vc4_fkms_encoder *vc4_encoder =
++					to_vc4_fkms_encoder(vc4_fkms_crtc->encoder);
++	struct mailbox_set_mode mb = {
++		.tag1 = { RPI_FIRMWARE_SET_TIMING,
++			  sizeof(struct set_timings), 0},
++	};
++	union hdmi_infoframe frame;
++	int ret;
++
++	ret = drm_hdmi_avi_infoframe_from_display_mode(&frame.avi, vc4_fkms_crtc->connector, mode);
++	if (ret < 0) {
++		DRM_ERROR("couldn't fill AVI infoframe\n");
++		return;
++	}
++
++	DRM_DEBUG_KMS("Setting mode for display num %u mode name %s, clk %d, h(disp %d, start %d, end %d, total %d, skew %d) v(disp %d, start %d, end %d, total %d, scan %d), vrefresh %d, par %u, flags 0x%04x\n",
++		      vc4_fkms_crtc->display_number, mode->name, mode->clock,
++		      mode->hdisplay, mode->hsync_start, mode->hsync_end,
++		      mode->htotal, mode->hskew, mode->vdisplay,
++		      mode->vsync_start, mode->vsync_end, mode->vtotal,
++		      mode->vscan, drm_mode_vrefresh(mode),
++		      mode->picture_aspect_ratio, mode->flags);
++	mb.timings.display = vc4_fkms_crtc->display_number;
++
++	mb.timings.clock = mode->clock;
++	mb.timings.hdisplay = mode->hdisplay;
++	mb.timings.hsync_start = mode->hsync_start;
++	mb.timings.hsync_end = mode->hsync_end;
++	mb.timings.htotal = mode->htotal;
++	mb.timings.hskew = mode->hskew;
++	mb.timings.vdisplay = mode->vdisplay;
++	mb.timings.vsync_start = mode->vsync_start;
++	mb.timings.vsync_end = mode->vsync_end;
++	mb.timings.vtotal = mode->vtotal;
++	mb.timings.vscan = mode->vscan;
++	mb.timings.vrefresh = drm_mode_vrefresh(mode);
++	mb.timings.flags = 0;
++	if (mode->flags & DRM_MODE_FLAG_PHSYNC)
++		mb.timings.flags |= TIMINGS_FLAGS_H_SYNC_POS;
++	if (mode->flags & DRM_MODE_FLAG_PVSYNC)
++		mb.timings.flags |= TIMINGS_FLAGS_V_SYNC_POS;
++
++	switch (frame.avi.picture_aspect) {
++	default:
++	case HDMI_PICTURE_ASPECT_NONE:
++		mb.timings.flags |= TIMINGS_FLAGS_ASPECT_NONE;
++		break;
++	case HDMI_PICTURE_ASPECT_4_3:
++		mb.timings.flags |= TIMINGS_FLAGS_ASPECT_4_3;
++		break;
++	case HDMI_PICTURE_ASPECT_16_9:
++		mb.timings.flags |= TIMINGS_FLAGS_ASPECT_16_9;
++		break;
++	case HDMI_PICTURE_ASPECT_64_27:
++		mb.timings.flags |= TIMINGS_FLAGS_ASPECT_64_27;
++		break;
++	case HDMI_PICTURE_ASPECT_256_135:
++		mb.timings.flags |= TIMINGS_FLAGS_ASPECT_256_135;
++		break;
++	}
++
++	if (mode->flags & DRM_MODE_FLAG_INTERLACE)
++		mb.timings.flags |= TIMINGS_FLAGS_INTERLACE;
++	if (mode->flags & DRM_MODE_FLAG_DBLCLK)
++		mb.timings.flags |= TIMINGS_FLAGS_DBL_CLK;
++
++	mb.timings.video_id_code = frame.avi.video_code;
++
++	if (!vc4_encoder->hdmi_monitor) {
++		mb.timings.flags |= TIMINGS_FLAGS_DVI;
++	} else {
++		struct vc4_fkms_connector_state *conn_state =
++			to_vc4_fkms_connector_state(vc4_fkms_crtc->connector->state);
++
++		if (conn_state->broadcast_rgb == VC4_BROADCAST_RGB_AUTO) {
++			/* See CEA-861-E - 5.1 Default Encoding Parameters */
++			if (drm_default_rgb_quant_range(mode) ==
++					HDMI_QUANTIZATION_RANGE_LIMITED)
++				mb.timings.flags |= TIMINGS_FLAGS_RGB_LIMITED;
++		} else {
++			if (conn_state->broadcast_rgb ==
++						VC4_BROADCAST_RGB_LIMITED)
++				mb.timings.flags |= TIMINGS_FLAGS_RGB_LIMITED;
++
++			/* If not using the default range, then do not provide
++			 * a VIC as the HDMI spec requires that we do not
++			 * signal the opposite of the defined range in the AVI
++			 * infoframe.
++			 */
++			if (!!(mb.timings.flags & TIMINGS_FLAGS_RGB_LIMITED) !=
++			    (drm_default_rgb_quant_range(mode) ==
++					HDMI_QUANTIZATION_RANGE_LIMITED))
++				mb.timings.video_id_code = 0;
++		}
++	}
++
++	/*
++	 * FIXME: To implement
++	 * switch(mode->flag & DRM_MODE_FLAG_3D_MASK) {
++	 * case DRM_MODE_FLAG_3D_NONE:
++	 * case DRM_MODE_FLAG_3D_FRAME_PACKING:
++	 * case DRM_MODE_FLAG_3D_FIELD_ALTERNATIVE:
++	 * case DRM_MODE_FLAG_3D_LINE_ALTERNATIVE:
++	 * case DRM_MODE_FLAG_3D_SIDE_BY_SIDE_FULL:
++	 * case DRM_MODE_FLAG_3D_L_DEPTH:
++	 * case DRM_MODE_FLAG_3D_L_DEPTH_GFX_GFX_DEPTH:
++	 * case DRM_MODE_FLAG_3D_TOP_AND_BOTTOM:
++	 * case DRM_MODE_FLAG_3D_SIDE_BY_SIDE_HALF:
++	 * }
++	 */
++
++	ret = rpi_firmware_property_list(vc4->firmware, &mb, sizeof(mb));
++}
++
++static void vc4_crtc_disable(struct drm_crtc *crtc,
++			     struct drm_atomic_state *state)
++{
++	struct drm_device *dev = crtc->dev;
++	struct drm_plane *plane;
++
++	DRM_DEBUG_KMS("[CRTC:%d] vblanks off.\n",
++		      crtc->base.id);
++	drm_crtc_vblank_off(crtc);
++
++	/* Always turn the planes off on CRTC disable. In DRM, planes
++	 * are enabled/disabled through the update/disable hooks
++	 * above, and the CRTC enable/disable independently controls
++	 * whether anything scans out at all, but the firmware doesn't
++	 * give us a CRTC-level control for that.
++	 */
++
++	drm_atomic_crtc_for_each_plane(plane, crtc)
++		vc4_plane_atomic_disable(plane, state);
++
++	/*
++	 * Make sure we issue a vblank event after disabling the CRTC if
++	 * someone was waiting it.
++	 */
++	if (crtc->state->event) {
++		unsigned long flags;
++
++		spin_lock_irqsave(&dev->event_lock, flags);
++		drm_crtc_send_vblank_event(crtc, crtc->state->event);
++		crtc->state->event = NULL;
++		spin_unlock_irqrestore(&dev->event_lock, flags);
++	}
++}
++
++static void vc4_crtc_consume_event(struct drm_crtc *crtc)
++{
++	struct vc4_fkms_crtc *vc4_fkms_crtc = to_vc4_fkms_crtc(crtc);
++	struct drm_device *dev = crtc->dev;
++	unsigned long flags;
++
++	if (!crtc->state->event)
++		return;
++
++	crtc->state->event->pipe = drm_crtc_index(crtc);
++
++	WARN_ON(drm_crtc_vblank_get(crtc) != 0);
++
++	spin_lock_irqsave(&dev->event_lock, flags);
++	vc4_fkms_crtc->event = crtc->state->event;
++	crtc->state->event = NULL;
++	spin_unlock_irqrestore(&dev->event_lock, flags);
++}
++
++static void vc4_crtc_enable(struct drm_crtc *crtc,
++			    struct drm_atomic_state *state)
++{
++	struct drm_plane *plane;
++
++	DRM_DEBUG_KMS("[CRTC:%d] vblanks on.\n",
++		      crtc->base.id);
++	drm_crtc_vblank_on(crtc);
++	vc4_crtc_consume_event(crtc);
++
++	/* Unblank the planes (if they're supposed to be displayed). */
++	drm_atomic_crtc_for_each_plane(plane, crtc)
++		if (plane->state->fb)
++			vc4_plane_set_blank(plane, plane->state->visible);
++}
++
++static enum drm_mode_status
++vc4_crtc_mode_valid(struct drm_crtc *crtc, const struct drm_display_mode *mode)
++{
++	struct vc4_fkms_crtc *vc4_fkms_crtc = to_vc4_fkms_crtc(crtc);
++	struct drm_device *dev = crtc->dev;
++	struct vc4_dev *vc4 = to_vc4_dev(dev);
++	struct vc4_fkms *fkms = vc4->fkms;
++
++	/* Do not allow doublescan modes from user space */
++	if (mode->flags & DRM_MODE_FLAG_DBLSCAN) {
++		DRM_DEBUG_KMS("[CRTC:%d] Doublescan mode rejected.\n",
++			      crtc->base.id);
++		return MODE_NO_DBLESCAN;
++	}
++
++	/* Disable refresh rates > defined threshold (default 85Hz) as limited
++	 * gain from them
++	 */
++	if (drm_mode_vrefresh(mode) > fkms_max_refresh_rate)
++		return MODE_BAD_VVALUE;
++
++	/* Limit the pixel clock based on the HDMI clock limits from the
++	 * firmware
++	 */
++	switch (vc4_fkms_crtc->display_number) {
++	case 2:	/* HDMI0 */
++		if (fkms->cfg.max_pixel_clock[0] &&
++		    mode->clock > fkms->cfg.max_pixel_clock[0])
++			return MODE_CLOCK_HIGH;
++		break;
++	case 7:	/* HDMI1 */
++		if (fkms->cfg.max_pixel_clock[1] &&
++		    mode->clock > fkms->cfg.max_pixel_clock[1])
++			return MODE_CLOCK_HIGH;
++		break;
++	}
++
++	/* Pi4 can't generate odd horizontal timings on HDMI, so reject modes
++	 * that would set them.
++	 */
++	if (fkms->revision >= BCM2711 &&
++	    (vc4_fkms_crtc->display_number == 2 || vc4_fkms_crtc->display_number == 7) &&
++	    !(mode->flags & DRM_MODE_FLAG_DBLCLK) &&
++	    ((mode->hdisplay |				/* active */
++	      (mode->hsync_start - mode->hdisplay) |	/* front porch */
++	      (mode->hsync_end - mode->hsync_start) |	/* sync pulse */
++	      (mode->htotal - mode->hsync_end)) & 1))	/* back porch */ {
++		DRM_DEBUG_KMS("[CRTC:%d] Odd timing rejected %u %u %u %u.\n",
++			      crtc->base.id, mode->hdisplay, mode->hsync_start,
++			      mode->hsync_end, mode->htotal);
++		return MODE_H_ILLEGAL;
++	}
++
++	return MODE_OK;
++}
++
++static int vc4_fkms_crtc_atomic_check(struct drm_crtc *crtc,
++				 struct drm_atomic_state *state)
++{
++	struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state,
++									  crtc);
++	struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(crtc_state);
++	struct drm_connector *conn;
++	struct drm_connector_state *conn_state;
++	int i;
++
++	DRM_DEBUG_KMS("[CRTC:%d] crtc_atomic_check.\n", crtc->base.id);
++
++	for_each_new_connector_in_state(crtc_state->state, conn, conn_state, i) {
++		if (conn_state->crtc != crtc)
++			continue;
++
++		vc4_state->margins.left = conn_state->tv.margins.left;
++		vc4_state->margins.right = conn_state->tv.margins.right;
++		vc4_state->margins.top = conn_state->tv.margins.top;
++		vc4_state->margins.bottom = conn_state->tv.margins.bottom;
++		break;
++	}
++	return 0;
++}
++
++static void vc4_crtc_atomic_flush(struct drm_crtc *crtc,
++				  struct drm_atomic_state *state)
++{
++	struct drm_crtc_state *old_state = drm_atomic_get_old_crtc_state(state,
++									 crtc);
++
++	DRM_DEBUG_KMS("[CRTC:%d] crtc_atomic_flush.\n",
++		      crtc->base.id);
++	if (crtc->state->active && old_state->active && crtc->state->event)
++		vc4_crtc_consume_event(crtc);
++}
++
++static void vc4_crtc_handle_page_flip(struct vc4_fkms_crtc *vc4_fkms_crtc)
++{
++	struct drm_crtc *crtc = &vc4_fkms_crtc->base;
++	struct drm_device *dev = crtc->dev;
++	unsigned long flags;
++
++	spin_lock_irqsave(&dev->event_lock, flags);
++	if (vc4_fkms_crtc->event) {
++		drm_crtc_send_vblank_event(crtc, vc4_fkms_crtc->event);
++		vc4_fkms_crtc->event = NULL;
++		drm_crtc_vblank_put(crtc);
++	}
++	spin_unlock_irqrestore(&dev->event_lock, flags);
++}
++
++static irqreturn_t vc4_crtc_irq_handler(int irq, void *data)
++{
++	struct vc4_fkms_crtc **crtc_list = data;
++	int i;
++	u32 stat = readl(crtc_list[0]->regs + SMICS);
++	irqreturn_t ret = IRQ_NONE;
++	u32 chan;
++
++	if (stat & SMICS_INTERRUPTS) {
++		writel(0, crtc_list[0]->regs + SMICS);
++
++		chan = readl(crtc_list[0]->regs + SMIDSW0);
++
++		if ((chan & 0xFFFF0000) != SMI_NEW) {
++			/* Older firmware. Treat the one interrupt as vblank/
++			 * complete for all crtcs.
++			 */
++			for (i = 0; crtc_list[i]; i++) {
++				if (crtc_list[i]->vblank_enabled)
++					drm_crtc_handle_vblank(&crtc_list[i]->base);
++				vc4_crtc_handle_page_flip(crtc_list[i]);
++			}
++		} else {
++			if (chan & 1) {
++				writel(SMI_NEW, crtc_list[0]->regs + SMIDSW0);
++				if (crtc_list[0]->vblank_enabled)
++					drm_crtc_handle_vblank(&crtc_list[0]->base);
++				vc4_crtc_handle_page_flip(crtc_list[0]);
++			}
++
++			if (crtc_list[1]) {
++				/* Check for the secondary display too */
++				chan = readl(crtc_list[0]->regs + SMIDSW1);
++
++				if (chan & 1) {
++					writel(SMI_NEW, crtc_list[0]->regs + SMIDSW1);
++
++					if (crtc_list[1]->vblank_enabled)
++						drm_crtc_handle_vblank(&crtc_list[1]->base);
++					vc4_crtc_handle_page_flip(crtc_list[1]);
++				}
++			}
++		}
++
++		ret = IRQ_HANDLED;
++	}
++
++	return ret;
++}
++
++static irqreturn_t vc4_crtc2712_irq_handler(int irq, void *data)
++{
++	struct vc4_fkms_crtc **crtc_list = data;
++	int i;
++
++	for (i = 0; crtc_list[i]; i++) {
++		if (crtc_list[i]->vblank_enabled)
++			drm_crtc_handle_vblank(&crtc_list[i]->base);
++		vc4_crtc_handle_page_flip(crtc_list[i]);
++	}
++
++	return IRQ_HANDLED;
++}
++
++static int vc4_fkms_page_flip(struct drm_crtc *crtc,
++			      struct drm_framebuffer *fb,
++			      struct drm_pending_vblank_event *event,
++			      uint32_t flags,
++			      struct drm_modeset_acquire_ctx *ctx)
++{
++	if (flags & DRM_MODE_PAGE_FLIP_ASYNC) {
++		DRM_ERROR("Async flips aren't allowed\n");
++		return -EINVAL;
++	}
++
++	return drm_atomic_helper_page_flip(crtc, fb, event, flags, ctx);
++}
++
++static struct drm_crtc_state *
++vc4_fkms_crtc_duplicate_state(struct drm_crtc *crtc)
++{
++	struct vc4_crtc_state *vc4_state, *old_vc4_state;
++
++	vc4_state = kzalloc(sizeof(*vc4_state), GFP_KERNEL);
++	if (!vc4_state)
++		return NULL;
++
++	old_vc4_state = to_vc4_crtc_state(crtc->state);
++	vc4_state->margins = old_vc4_state->margins;
++
++	__drm_atomic_helper_crtc_duplicate_state(crtc, &vc4_state->base);
++	return &vc4_state->base;
++}
++
++static void
++vc4_fkms_crtc_reset(struct drm_crtc *crtc)
++{
++	if (crtc->state)
++		__drm_atomic_helper_crtc_destroy_state(crtc->state);
++
++	crtc->state = kzalloc(sizeof(*crtc->state), GFP_KERNEL);
++	if (crtc->state)
++		crtc->state->crtc = crtc;
++}
++
++static int vc4_fkms_enable_vblank(struct drm_crtc *crtc)
++{
++	struct vc4_fkms_crtc *vc4_fkms_crtc = to_vc4_fkms_crtc(crtc);
++
++	DRM_DEBUG_KMS("[CRTC:%d] enable_vblank.\n",
++		      crtc->base.id);
++	vc4_fkms_crtc->vblank_enabled = true;
++
++	return 0;
++}
++
++static void vc4_fkms_disable_vblank(struct drm_crtc *crtc)
++{
++	struct vc4_fkms_crtc *vc4_fkms_crtc = to_vc4_fkms_crtc(crtc);
++
++	DRM_DEBUG_KMS("[CRTC:%d] disable_vblank.\n",
++		      crtc->base.id);
++	vc4_fkms_crtc->vblank_enabled = false;
++}
++
++static const struct drm_crtc_funcs vc4_crtc_funcs = {
++	.set_config = drm_atomic_helper_set_config,
++	.destroy = drm_crtc_cleanup,
++	.page_flip = vc4_fkms_page_flip,
++	.set_property = NULL,
++	.cursor_set = NULL, /* handled by drm_mode_cursor_universal */
++	.cursor_move = NULL, /* handled by drm_mode_cursor_universal */
++	.reset = vc4_fkms_crtc_reset,
++	.atomic_duplicate_state = vc4_fkms_crtc_duplicate_state,
++	.atomic_destroy_state = drm_atomic_helper_crtc_destroy_state,
++	.enable_vblank = vc4_fkms_enable_vblank,
++	.disable_vblank = vc4_fkms_disable_vblank,
++};
++
++static const struct drm_crtc_helper_funcs vc4_crtc_helper_funcs = {
++	.mode_set_nofb = vc4_crtc_mode_set_nofb,
++	.mode_valid = vc4_crtc_mode_valid,
++	.atomic_check = vc4_fkms_crtc_atomic_check,
++	.atomic_flush = vc4_crtc_atomic_flush,
++	.atomic_enable = vc4_crtc_enable,
++	.atomic_disable = vc4_crtc_disable,
++};
++
++static const struct of_device_id vc4_firmware_kms_dt_match[] = {
++	{ .compatible = "raspberrypi,rpi-firmware-kms",
++	  .data = (void *)BCM2835_6_7 },
++	{ .compatible = "raspberrypi,rpi-firmware-kms-2711",
++	  .data = (void *)BCM2711 },
++	{ .compatible = "raspberrypi,rpi-firmware-kms-2712",
++	  .data = (void *)BCM2712 },
++	{}
++};
++
++static enum drm_connector_status
++vc4_fkms_connector_detect(struct drm_connector *connector, bool force)
++{
++	DRM_DEBUG_KMS("connector detect.\n");
++	return connector_status_connected;
++}
++
++/* Queries the firmware to populate a drm_mode structure for this display */
++static int vc4_fkms_get_fw_mode(struct vc4_fkms_connector *fkms_connector,
++				struct drm_display_mode *mode)
++{
++	struct vc4_dev *vc4 = fkms_connector->vc4_dev;
++	struct set_timings timings = { 0 };
++	int ret;
++
++	timings.display = fkms_connector->display_number;
++
++	ret = rpi_firmware_property(vc4->firmware,
++				    RPI_FIRMWARE_GET_DISPLAY_TIMING, &timings,
++				    sizeof(timings));
++	if (ret || !timings.clock)
++		/* No mode returned - abort */
++		return -1;
++
++	/* Equivalent to DRM_MODE macro. */
++	memset(mode, 0, sizeof(*mode));
++	strncpy(mode->name, "FIXED_MODE", sizeof(mode->name));
++	mode->status = 0;
++	mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
++	mode->clock = timings.clock;
++	mode->hdisplay = timings.hdisplay;
++	mode->hsync_start = timings.hsync_start;
++	mode->hsync_end = timings.hsync_end;
++	mode->htotal = timings.htotal;
++	mode->hskew = 0;
++	mode->vdisplay = timings.vdisplay;
++	mode->vsync_start = timings.vsync_start;
++	mode->vsync_end = timings.vsync_end;
++	mode->vtotal = timings.vtotal;
++	mode->vscan = timings.vscan;
++
++	if (timings.flags & TIMINGS_FLAGS_H_SYNC_POS)
++		mode->flags |= DRM_MODE_FLAG_PHSYNC;
++	else
++		mode->flags |= DRM_MODE_FLAG_NHSYNC;
++
++	if (timings.flags & TIMINGS_FLAGS_V_SYNC_POS)
++		mode->flags |= DRM_MODE_FLAG_PVSYNC;
++	else
++		mode->flags |= DRM_MODE_FLAG_NVSYNC;
++
++	if (timings.flags & TIMINGS_FLAGS_INTERLACE)
++		mode->flags |= DRM_MODE_FLAG_INTERLACE;
++
++	return 0;
++}
++
++static int vc4_fkms_get_edid_block(void *data, u8 *buf, unsigned int block,
++				   size_t len)
++{
++	struct vc4_fkms_connector *fkms_connector =
++					(struct vc4_fkms_connector *)data;
++	struct vc4_dev *vc4 = fkms_connector->vc4_dev;
++	struct mailbox_get_edid mb = {
++		.tag1 = { RPI_FIRMWARE_GET_EDID_BLOCK_DISPLAY,
++			  128 + 8, 0 },
++		.block = block,
++		.display_number = fkms_connector->display_number,
++	};
++	int ret = 0;
++
++	ret = rpi_firmware_property_list(vc4->firmware, &mb, sizeof(mb));
++
++	if (!ret)
++		memcpy(buf, mb.edid, len);
++
++	return ret;
++}
++
++static int vc4_fkms_connector_get_modes(struct drm_connector *connector)
++{
++	struct vc4_fkms_connector *fkms_connector =
++					to_vc4_fkms_connector(connector);
++	struct drm_encoder *encoder = fkms_connector->encoder;
++	struct vc4_fkms_encoder *vc4_encoder = to_vc4_fkms_encoder(encoder);
++	struct drm_display_mode fw_mode;
++	struct drm_display_mode *mode;
++	const struct drm_edid *drm_edid;
++	const struct edid *edid;
++	int num_modes;
++
++	if (!vc4_fkms_get_fw_mode(fkms_connector, &fw_mode)) {
++		drm_mode_debug_printmodeline(&fw_mode);
++		mode = drm_mode_duplicate(connector->dev,
++					  &fw_mode);
++		drm_mode_probed_add(connector, mode);
++		num_modes = 1;	/* 1 mode */
++	} else {
++		drm_edid = drm_edid_read_custom(connector, vc4_fkms_get_edid_block,
++				       fkms_connector);
++		edid = drm_edid_raw(drm_edid);
++
++		/* FIXME: Can we do CEC?
++		 * cec_s_phys_addr_from_edid(vc4->hdmi->cec_adap, edid);
++		 * if (!edid)
++		 *	return -ENODEV;
++		 */
++
++		vc4_encoder->hdmi_monitor = drm_detect_hdmi_monitor(edid);
++
++		drm_connector_update_edid_property(connector, edid);
++		num_modes = drm_add_edid_modes(connector, (struct edid *)edid);
++		kfree(drm_edid);
++	}
++
++	return num_modes;
++}
++
++/* This is the DSI panel resolution. Use this as a default should the firmware
++ * not respond to our request for the timings.
++ */
++static const struct drm_display_mode lcd_mode = {
++	DRM_MODE("800x480", DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED,
++		 25979400 / 1000,
++		 800, 800 + 1, 800 + 1 + 2, 800 + 1 + 2 + 46, 0,
++		 480, 480 + 7, 480 + 7 + 2, 480 + 7 + 2 + 21, 0,
++		 0)
++};
++
++static int vc4_fkms_lcd_connector_get_modes(struct drm_connector *connector)
++{
++	struct vc4_fkms_connector *fkms_connector =
++					to_vc4_fkms_connector(connector);
++	struct drm_display_mode *mode;
++	struct drm_display_mode fw_mode;
++
++	if (!vc4_fkms_get_fw_mode(fkms_connector, &fw_mode) && fw_mode.clock)
++		mode = drm_mode_duplicate(connector->dev,
++					  &fw_mode);
++	else
++		mode = drm_mode_duplicate(connector->dev,
++					  &lcd_mode);
++
++	if (!mode) {
++		DRM_ERROR("Failed to create a new display mode\n");
++		return -ENOMEM;
++	}
++
++	drm_mode_probed_add(connector, mode);
++
++	/* We have one mode */
++	return 1;
++}
++
++static struct drm_encoder *
++vc4_fkms_connector_best_encoder(struct drm_connector *connector)
++{
++	struct vc4_fkms_connector *fkms_connector =
++		to_vc4_fkms_connector(connector);
++	DRM_DEBUG_KMS("best_connector.\n");
++	return fkms_connector->encoder;
++}
++
++static void vc4_fkms_connector_destroy(struct drm_connector *connector)
++{
++	DRM_DEBUG_KMS("[CONNECTOR:%d] destroy.\n",
++		      connector->base.id);
++	drm_connector_unregister(connector);
++	drm_connector_cleanup(connector);
++}
++
++/**
++ * vc4_connector_duplicate_state - duplicate connector state
++ * @connector: digital connector
++ *
++ * Allocates and returns a copy of the connector state (both common and
++ * digital connector specific) for the specified connector.
++ *
++ * Returns: The newly allocated connector state, or NULL on failure.
++ */
++static struct drm_connector_state *
++vc4_connector_duplicate_state(struct drm_connector *connector)
++{
++	struct vc4_fkms_connector_state *state;
++
++	state = kmemdup(connector->state, sizeof(*state), GFP_KERNEL);
++	if (!state)
++		return NULL;
++
++	__drm_atomic_helper_connector_duplicate_state(connector, &state->base);
++	return &state->base;
++}
++
++/**
++ * vc4_connector_atomic_get_property - hook for connector->atomic_get_property.
++ * @connector: Connector to get the property for.
++ * @state: Connector state to retrieve the property from.
++ * @property: Property to retrieve.
++ * @val: Return value for the property.
++ *
++ * Returns the atomic property value for a digital connector.
++ */
++static int vc4_connector_atomic_get_property(struct drm_connector *connector,
++				      const struct drm_connector_state *state,
++				      struct drm_property *property,
++				      uint64_t *val)
++{
++	struct vc4_fkms_connector *fkms_connector =
++					to_vc4_fkms_connector(connector);
++	struct vc4_fkms_connector_state *vc4_conn_state =
++					to_vc4_fkms_connector_state(state);
++
++	if (property == fkms_connector->broadcast_rgb_property) {
++		*val = vc4_conn_state->broadcast_rgb;
++	} else {
++		DRM_DEBUG_ATOMIC("Unknown property [PROP:%d:%s]\n",
++				 property->base.id, property->name);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++/**
++ * vc4_connector_atomic_set_property - hook for connector->atomic_set_property.
++ * @connector: Connector to set the property for.
++ * @state: Connector state to set the property on.
++ * @property: Property to set.
++ * @val: New value for the property.
++ *
++ * Sets the atomic property value for a digital connector.
++ */
++static int vc4_connector_atomic_set_property(struct drm_connector *connector,
++				      struct drm_connector_state *state,
++				      struct drm_property *property,
++				      uint64_t val)
++{
++	struct vc4_fkms_connector *fkms_connector =
++					to_vc4_fkms_connector(connector);
++	struct vc4_fkms_connector_state *vc4_conn_state =
++					to_vc4_fkms_connector_state(state);
++
++	if (property == fkms_connector->broadcast_rgb_property) {
++		vc4_conn_state->broadcast_rgb = val;
++		return 0;
++	}
++
++	DRM_DEBUG_ATOMIC("Unknown property [PROP:%d:%s]\n",
++			 property->base.id, property->name);
++	return -EINVAL;
++}
++
++static int vc4_connector_atomic_check(struct drm_connector *connector,
++			       struct drm_atomic_state *state)
++{
++	struct drm_connector_state *old_state =
++		drm_atomic_get_old_connector_state(state, connector);
++	struct vc4_fkms_connector_state *vc4_old_state =
++					to_vc4_fkms_connector_state(old_state);
++	struct drm_connector_state *new_state =
++		drm_atomic_get_new_connector_state(state, connector);
++	struct vc4_fkms_connector_state *vc4_new_state =
++					to_vc4_fkms_connector_state(new_state);
++	struct drm_crtc *crtc = new_state->crtc;
++
++	if (!crtc)
++		return 0;
++
++	if (vc4_old_state->broadcast_rgb != vc4_new_state->broadcast_rgb) {
++		struct drm_crtc_state *crtc_state;
++
++		crtc_state = drm_atomic_get_crtc_state(state, crtc);
++		if (IS_ERR(crtc_state))
++			return PTR_ERR(crtc_state);
++
++		crtc_state->mode_changed = true;
++	}
++	return 0;
++}
++
++static void vc4_hdmi_connector_reset(struct drm_connector *connector)
++{
++	drm_atomic_helper_connector_reset(connector);
++	drm_atomic_helper_connector_tv_margins_reset(connector);
++}
++
++static const struct drm_connector_funcs vc4_fkms_connector_funcs = {
++	.detect = vc4_fkms_connector_detect,
++	.fill_modes = drm_helper_probe_single_connector_modes,
++	.destroy = vc4_fkms_connector_destroy,
++	.reset = vc4_hdmi_connector_reset,
++	.atomic_duplicate_state = vc4_connector_duplicate_state,
++	.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
++	.atomic_get_property = vc4_connector_atomic_get_property,
++	.atomic_set_property = vc4_connector_atomic_set_property,
++};
++
++static const struct drm_connector_helper_funcs vc4_fkms_connector_helper_funcs = {
++	.get_modes = vc4_fkms_connector_get_modes,
++	.best_encoder = vc4_fkms_connector_best_encoder,
++	.atomic_check = vc4_connector_atomic_check,
++};
++
++static const struct drm_connector_helper_funcs vc4_fkms_lcd_conn_helper_funcs = {
++	.get_modes = vc4_fkms_lcd_connector_get_modes,
++	.best_encoder = vc4_fkms_connector_best_encoder,
++};
++
++static const struct drm_prop_enum_list broadcast_rgb_names[] = {
++	{ VC4_BROADCAST_RGB_AUTO, "Automatic" },
++	{ VC4_BROADCAST_RGB_FULL, "Full" },
++	{ VC4_BROADCAST_RGB_LIMITED, "Limited 16:235" },
++};
++
++static void
++vc4_attach_broadcast_rgb_property(struct vc4_fkms_connector *fkms_connector)
++{
++	struct drm_device *dev = fkms_connector->base.dev;
++	struct drm_property *prop;
++
++	prop = fkms_connector->broadcast_rgb_property;
++	if (!prop) {
++		prop = drm_property_create_enum(dev, DRM_MODE_PROP_ENUM,
++						"Broadcast RGB",
++						broadcast_rgb_names,
++						ARRAY_SIZE(broadcast_rgb_names));
++		if (!prop)
++			return;
++
++		fkms_connector->broadcast_rgb_property = prop;
++	}
++
++	drm_object_attach_property(&fkms_connector->base.base, prop, 0);
++}
++
++static struct drm_connector *
++vc4_fkms_connector_init(struct drm_device *dev, struct drm_encoder *encoder,
++			u32 display_num)
++{
++	struct drm_connector *connector = NULL;
++	struct vc4_fkms_connector *fkms_connector;
++	struct vc4_fkms_connector_state *conn_state = NULL;
++	struct vc4_dev *vc4_dev = to_vc4_dev(dev);
++	int ret = 0;
++
++	DRM_DEBUG_KMS("connector_init, display_num %u\n", display_num);
++
++	fkms_connector = devm_kzalloc(dev->dev, sizeof(*fkms_connector),
++				      GFP_KERNEL);
++	if (!fkms_connector)
++		return ERR_PTR(-ENOMEM);
++
++	/*
++	 * Allocate enough memory to hold vc4_fkms_connector_state,
++	 */
++	conn_state = kzalloc(sizeof(*conn_state), GFP_KERNEL);
++	if (!conn_state) {
++		kfree(fkms_connector);
++		return ERR_PTR(-ENOMEM);
++	}
++
++	connector = &fkms_connector->base;
++
++	fkms_connector->encoder = encoder;
++	fkms_connector->display_number = display_num;
++	fkms_connector->display_type = vc4_get_display_type(display_num);
++	fkms_connector->vc4_dev = vc4_dev;
++
++	__drm_atomic_helper_connector_reset(connector,
++					    &conn_state->base);
++
++	if (fkms_connector->display_type == DRM_MODE_ENCODER_DSI) {
++		drm_connector_init(dev, connector, &vc4_fkms_connector_funcs,
++				   DRM_MODE_CONNECTOR_DSI);
++		drm_connector_helper_add(connector,
++					 &vc4_fkms_lcd_conn_helper_funcs);
++		connector->interlace_allowed = 0;
++	} else if (fkms_connector->display_type == DRM_MODE_ENCODER_TVDAC) {
++		drm_connector_init(dev, connector, &vc4_fkms_connector_funcs,
++				   DRM_MODE_CONNECTOR_Composite);
++		drm_connector_helper_add(connector,
++					 &vc4_fkms_lcd_conn_helper_funcs);
++		connector->interlace_allowed = 1;
++	} else {
++		drm_connector_init(dev, connector, &vc4_fkms_connector_funcs,
++				   DRM_MODE_CONNECTOR_HDMIA);
++		drm_connector_helper_add(connector,
++					 &vc4_fkms_connector_helper_funcs);
++		connector->interlace_allowed = 1;
++	}
++
++	ret = drm_mode_create_tv_margin_properties(dev);
++	if (ret)
++		goto fail;
++
++	drm_connector_attach_tv_margin_properties(connector);
++
++	connector->polled = (DRM_CONNECTOR_POLL_CONNECT |
++			     DRM_CONNECTOR_POLL_DISCONNECT);
++
++	connector->doublescan_allowed = 0;
++
++	vc4_attach_broadcast_rgb_property(fkms_connector);
++
++	drm_connector_attach_encoder(connector, encoder);
++
++	return connector;
++
++ fail:
++	if (connector)
++		vc4_fkms_connector_destroy(connector);
++
++	return ERR_PTR(ret);
++}
++
++static void vc4_fkms_encoder_destroy(struct drm_encoder *encoder)
++{
++	DRM_DEBUG_KMS("Encoder_destroy\n");
++	drm_encoder_cleanup(encoder);
++}
++
++static const struct drm_encoder_funcs vc4_fkms_encoder_funcs = {
++	.destroy = vc4_fkms_encoder_destroy,
++};
++
++static void vc4_fkms_display_power(struct drm_encoder *encoder, bool power)
++{
++	struct vc4_fkms_encoder *vc4_encoder = to_vc4_fkms_encoder(encoder);
++	struct vc4_dev *vc4 = to_vc4_dev(encoder->dev);
++
++	struct mailbox_display_pwr pwr = {
++		.tag1 = {RPI_FIRMWARE_SET_DISPLAY_POWER, 8, 0, },
++		.display = vc4_encoder->display_num,
++		.state = power ? 1 : 0,
++	};
++
++	rpi_firmware_property_list(vc4->firmware, &pwr, sizeof(pwr));
++}
++
++static void vc4_fkms_encoder_enable(struct drm_encoder *encoder)
++{
++	vc4_fkms_display_power(encoder, true);
++	DRM_DEBUG_KMS("Encoder_enable\n");
++}
++
++static void vc4_fkms_encoder_disable(struct drm_encoder *encoder)
++{
++	vc4_fkms_display_power(encoder, false);
++	DRM_DEBUG_KMS("Encoder_disable\n");
++}
++
++static const struct drm_encoder_helper_funcs vc4_fkms_encoder_helper_funcs = {
++	.enable = vc4_fkms_encoder_enable,
++	.disable = vc4_fkms_encoder_disable,
++};
++
++static int vc4_fkms_create_screen(struct device *dev, struct drm_device *drm,
++				  int display_idx, int display_ref,
++				  struct vc4_fkms_crtc **ret_crtc)
++{
++	struct vc4_dev *vc4 = to_vc4_dev(drm);
++	struct vc4_fkms_crtc *vc4_fkms_crtc;
++	struct vc4_fkms_encoder *vc4_encoder;
++	struct drm_crtc *crtc;
++	struct drm_plane *destroy_plane, *temp;
++	struct mailbox_blank_display blank = {
++		.tag1 = {RPI_FIRMWARE_FRAMEBUFFER_SET_DISPLAY_NUM, 4, 0, },
++		.display = display_idx,
++		.tag2 = { RPI_FIRMWARE_FRAMEBUFFER_BLANK, 4, 0, },
++		.blank = 1,
++	};
++	struct drm_plane *planes[PLANES_PER_CRTC];
++	int ret, i;
++
++	vc4_fkms_crtc = devm_kzalloc(dev, sizeof(*vc4_fkms_crtc), GFP_KERNEL);
++	if (!vc4_fkms_crtc)
++		return -ENOMEM;
++	crtc = &vc4_fkms_crtc->base;
++
++	vc4_fkms_crtc->display_number = display_ref;
++	vc4_fkms_crtc->display_type = vc4_get_display_type(display_ref);
++
++	/* Blank the firmware provided framebuffer */
++	rpi_firmware_property_list(vc4->firmware, &blank, sizeof(blank));
++
++	for (i = 0; i < PLANES_PER_CRTC; i++) {
++		planes[i] = vc4_fkms_plane_init(drm,
++						(i == 0) ?
++						  DRM_PLANE_TYPE_PRIMARY :
++						  (i == PLANES_PER_CRTC - 1) ?
++							DRM_PLANE_TYPE_CURSOR :
++							DRM_PLANE_TYPE_OVERLAY,
++						display_ref,
++						i + (display_idx * PLANES_PER_CRTC)
++					       );
++		if (IS_ERR(planes[i])) {
++			dev_err(dev, "failed to construct plane %u\n", i);
++			ret = PTR_ERR(planes[i]);
++			goto err;
++		}
++	}
++
++	drm_crtc_init_with_planes(drm, crtc, planes[0],
++				  planes[PLANES_PER_CRTC - 1], &vc4_crtc_funcs,
++				  NULL);
++	drm_crtc_helper_add(crtc, &vc4_crtc_helper_funcs);
++
++	/* Update the possible_crtcs mask for the overlay plane(s) */
++	for (i = 1; i < (PLANES_PER_CRTC - 1); i++)
++		planes[i]->possible_crtcs = drm_crtc_mask(crtc);
++
++	vc4_encoder = devm_kzalloc(dev, sizeof(*vc4_encoder), GFP_KERNEL);
++	if (!vc4_encoder)
++		return -ENOMEM;
++	vc4_fkms_crtc->encoder = &vc4_encoder->base;
++
++	vc4_encoder->display_num = display_ref;
++	vc4_encoder->base.possible_crtcs |= drm_crtc_mask(crtc);
++
++	drm_encoder_init(drm, &vc4_encoder->base, &vc4_fkms_encoder_funcs,
++			 vc4_fkms_crtc->display_type, NULL);
++	drm_encoder_helper_add(&vc4_encoder->base,
++			       &vc4_fkms_encoder_helper_funcs);
++
++	vc4_fkms_crtc->connector = vc4_fkms_connector_init(drm, &vc4_encoder->base,
++							   display_ref);
++	if (IS_ERR(vc4_fkms_crtc->connector)) {
++		ret = PTR_ERR(vc4_fkms_crtc->connector);
++		goto err_destroy_encoder;
++	}
++
++	*ret_crtc = vc4_fkms_crtc;
++
++	return 0;
++
++err_destroy_encoder:
++	vc4_fkms_encoder_destroy(vc4_fkms_crtc->encoder);
++	list_for_each_entry_safe(destroy_plane, temp,
++				 &drm->mode_config.plane_list, head) {
++		if (destroy_plane->possible_crtcs == 1 << drm_crtc_index(crtc))
++			destroy_plane->funcs->destroy(destroy_plane);
++	}
++err:
++	return ret;
++}
++
++static int vc4_fkms_bind(struct device *dev, struct device *master, void *data)
++{
++	struct platform_device *pdev = to_platform_device(dev);
++	struct drm_device *drm = dev_get_drvdata(master);
++	struct vc4_dev *vc4 = to_vc4_dev(drm);
++	struct device_node *firmware_node;
++	const struct of_device_id *match;
++	struct vc4_fkms_crtc **crtc_list;
++	u32 num_displays, display_num;
++	struct vc4_fkms *fkms;
++	int ret;
++	u32 display_id;
++
++	vc4->firmware_kms = true;
++
++	fkms = devm_kzalloc(dev, sizeof(*fkms), GFP_KERNEL);
++	if (!fkms)
++		return -ENOMEM;
++
++	match = of_match_device(vc4_firmware_kms_dt_match, dev);
++	if (!match)
++		return -ENODEV;
++	fkms->revision = (enum vc4_fkms_revision)match->data;
++
++	firmware_node = of_parse_phandle(dev->of_node, "brcm,firmware", 0);
++	vc4->firmware = devm_rpi_firmware_get(&pdev->dev, firmware_node);
++	if (!vc4->firmware) {
++		DRM_DEBUG("Failed to get Raspberry Pi firmware reference.\n");
++		return -EPROBE_DEFER;
++	}
++	of_node_put(firmware_node);
++
++	ret = rpi_firmware_property(vc4->firmware,
++				    RPI_FIRMWARE_FRAMEBUFFER_GET_NUM_DISPLAYS,
++				    &num_displays, sizeof(u32));
++
++	/* If we fail to get the number of displays, then
++	 * assume old firmware that doesn't have the mailbox call, so just
++	 * set one display
++	 */
++	if (ret) {
++		num_displays = 1;
++		DRM_WARN("Unable to determine number of displays - assuming 1\n");
++		ret = 0;
++	}
++
++	ret = rpi_firmware_property(vc4->firmware,
++				    RPI_FIRMWARE_GET_DISPLAY_CFG,
++				    &fkms->cfg, sizeof(fkms->cfg));
++
++	if (ret)
++		return -EINVAL;
++	/* The firmware works in Hz. This will be compared against kHz, so div
++	 * 1000 now rather than multiple times later.
++	 */
++	fkms->cfg.max_pixel_clock[0] /= 1000;
++	fkms->cfg.max_pixel_clock[1] /= 1000;
++
++	/* Allocate a list, with space for a NULL on the end */
++	crtc_list = devm_kzalloc(dev, sizeof(crtc_list) * (num_displays + 1),
++				 GFP_KERNEL);
++	if (!crtc_list)
++		return -ENOMEM;
++
++	for (display_num = 0; display_num < num_displays; display_num++) {
++		display_id = display_num;
++		ret = rpi_firmware_property(vc4->firmware,
++					    RPI_FIRMWARE_FRAMEBUFFER_GET_DISPLAY_ID,
++					    &display_id, sizeof(display_id));
++		/* FIXME: Determine the correct error handling here.
++		 * Should we fail to create the one "screen" but keep the
++		 * others, or fail the whole thing?
++		 */
++		if (ret)
++			DRM_ERROR("Failed to get display id %u\n", display_num);
++
++		ret = vc4_fkms_create_screen(dev, drm, display_num, display_id,
++					     &crtc_list[display_num]);
++		if (ret)
++			DRM_ERROR("Oh dear, failed to create display %u\n",
++				  display_num);
++	}
++
++	if (num_displays > 0) {
++		if (fkms->revision >= BCM2712) {
++			ret = devm_request_irq(dev, platform_get_irq(pdev, 0),
++					       vc4_crtc2712_irq_handler, 0,
++					       "vc4 firmware kms", crtc_list);
++		} else {
++			/* Map the SMI interrupt reg */
++			crtc_list[0]->regs = vc4_ioremap_regs(pdev, 0);
++			if (IS_ERR(crtc_list[0]->regs))
++				DRM_ERROR("Oh dear, failed to map registers\n");
++
++			writel(0, crtc_list[0]->regs + SMICS);
++			ret = devm_request_irq(dev, platform_get_irq(pdev, 0),
++					       vc4_crtc_irq_handler, 0,
++					       "vc4 firmware kms", crtc_list);
++		}
++		if (ret)
++			DRM_ERROR("Oh dear, failed to register IRQ\n");
++	} else {
++		DRM_WARN("No displays found. Consider forcing hotplug if HDMI is attached\n");
++	}
++
++	vc4->fkms = fkms;
++
++	platform_set_drvdata(pdev, crtc_list);
++
++	return 0;
++}
++
++static void vc4_fkms_unbind(struct device *dev, struct device *master,
++			    void *data)
++{
++	struct platform_device *pdev = to_platform_device(dev);
++	struct vc4_fkms_crtc **crtc_list = dev_get_drvdata(dev);
++	int i;
++
++	for (i = 0; crtc_list[i]; i++) {
++		vc4_fkms_connector_destroy(crtc_list[i]->connector);
++		vc4_fkms_encoder_destroy(crtc_list[i]->encoder);
++		drm_crtc_cleanup(&crtc_list[i]->base);
++	}
++
++	platform_set_drvdata(pdev, NULL);
++}
++
++static const struct component_ops vc4_fkms_ops = {
++	.bind   = vc4_fkms_bind,
++	.unbind = vc4_fkms_unbind,
++};
++
++static int vc4_fkms_probe(struct platform_device *pdev)
++{
++	return component_add(&pdev->dev, &vc4_fkms_ops);
++}
++
++static void vc4_fkms_remove(struct platform_device *pdev)
++{
++	component_del(&pdev->dev, &vc4_fkms_ops);
++}
++
++struct platform_driver vc4_firmware_kms_driver = {
++	.probe = vc4_fkms_probe,
++	.remove = vc4_fkms_remove,
++	.driver = {
++		.name = "vc4_firmware_kms",
++		.of_match_table = vc4_firmware_kms_dt_match,
++	},
++};
+--- a/drivers/gpu/drm/vc4/vc4_kms.c
++++ b/drivers/gpu/drm/vc4/vc4_kms.c
+@@ -138,6 +138,9 @@ vc4_ctm_commit(struct vc4_dev *vc4, stru
+ 	struct vc4_ctm_state *ctm_state = to_vc4_ctm_state(vc4->ctm_manager.state);
+ 	struct drm_color_ctm *ctm = ctm_state->ctm;
+ 
++	if (vc4->firmware_kms)
++		return;
++
+ 	WARN_ON_ONCE(vc4->gen > VC4_GEN_5);
+ 
+ 	if (ctm_state->fifo) {
+@@ -406,9 +409,10 @@ static void vc4_atomic_commit_tail(struc
+ 		for_each_new_crtc_in_state(state, crtc, new_crtc_state, i) {
+ 			struct vc4_crtc_state *vc4_crtc_state;
+ 
+-			if (!new_crtc_state->commit)
++			if (!new_crtc_state->commit || vc4->firmware_kms)
+ 				continue;
+ 
++
+ 			vc4_crtc_state = to_vc4_crtc_state(new_crtc_state);
+ 			vc4_hvs_mask_underrun(hvs, vc4_crtc_state->assigned_channel);
+ 		}
+@@ -433,7 +437,7 @@ static void vc4_atomic_commit_tail(struc
+ 		old_hvs_state->fifo_state[channel].pending_commit = NULL;
+ 	}
+ 
+-	if (vc4->gen == VC4_GEN_5) {
++	if (vc4->gen == VC4_GEN_5 && !vc4->firmware_kms) {
+ 		unsigned long state_rate = max(old_hvs_state->core_clock_rate,
+ 					       new_hvs_state->core_clock_rate);
+ 		unsigned long core_rate = clamp_t(unsigned long, state_rate,
+@@ -454,23 +458,25 @@ static void vc4_atomic_commit_tail(struc
+ 	if (vc4->gen <= VC4_GEN_5)
+ 		vc4_ctm_commit(vc4, state);
+ 
+-	switch (vc4->gen) {
+-	case VC4_GEN_4:
+-		vc4_hvs_pv_muxing_commit(vc4, state);
+-		break;
+-
+-	case VC4_GEN_5:
+-		vc5_hvs_pv_muxing_commit(vc4, state);
+-		break;
+-
+-	case VC4_GEN_6_C:
+-	case VC4_GEN_6_D:
+-		vc6_hvs_pv_muxing_commit(vc4, state);
+-		break;
+-
+-	default:
+-		drm_err(dev, "Unknown VC4 generation: %d", vc4->gen);
+-		break;
++	if (!vc4->firmware_kms) {
++		switch (vc4->gen) {
++		case VC4_GEN_4:
++			vc4_hvs_pv_muxing_commit(vc4, state);
++			break;
++
++		case VC4_GEN_5:
++			vc5_hvs_pv_muxing_commit(vc4, state);
++			break;
++
++		case VC4_GEN_6_C:
++		case VC4_GEN_6_D:
++			vc6_hvs_pv_muxing_commit(vc4, state);
++			break;
++
++		default:
++			drm_err(dev, "Unknown VC4 generation: %d", vc4->gen);
++			break;
++		}
+ 	}
+ 
+ 	drm_atomic_helper_commit_planes(dev, state,
+@@ -486,7 +492,7 @@ static void vc4_atomic_commit_tail(struc
+ 
+ 	drm_atomic_helper_cleanup_planes(dev, state);
+ 
+-	if (vc4->gen == VC4_GEN_5) {
++	if (vc4->gen == VC4_GEN_5 && !vc4->firmware_kms) {
+ 		unsigned long core_rate = min_t(unsigned long,
+ 						hvs->max_core_rate,
+ 						new_hvs_state->core_clock_rate);
+@@ -507,11 +513,21 @@ static void vc4_atomic_commit_tail(struc
+ 
+ static int vc4_atomic_commit_setup(struct drm_atomic_state *state)
+ {
++	struct drm_device *dev = state->dev;
++	struct vc4_dev *vc4 = to_vc4_dev(dev);
+ 	struct drm_crtc_state *crtc_state;
+ 	struct vc4_hvs_state *hvs_state;
+ 	struct drm_crtc *crtc;
+ 	unsigned int i;
+ 
++	/* We know for sure we don't want an async update here. Set
++	 * state->legacy_cursor_update to false to prevent
++	 * drm_atomic_helper_setup_commit() from auto-completing
++	 * commit->flip_done.
++	 */
++	if (!vc4->firmware_kms)
++		state->legacy_cursor_update = false;
++
+ 	hvs_state = vc4_hvs_get_new_global_state(state);
+ 	if (WARN_ON(IS_ERR(hvs_state)))
+ 		return PTR_ERR(hvs_state);
+@@ -889,6 +905,7 @@ static int cmp_vc4_crtc_hvs_output(const
+ static int vc4_pv_muxing_atomic_check(struct drm_device *dev,
+ 				      struct drm_atomic_state *state)
+ {
++	struct vc4_dev *vc4 = to_vc4_dev(state->dev);
+ 	struct vc4_hvs_state *hvs_new_state;
+ 	struct drm_crtc **sorted_crtcs;
+ 	struct drm_crtc *crtc;
+@@ -896,6 +913,9 @@ static int vc4_pv_muxing_atomic_check(st
+ 	unsigned int i;
+ 	int ret;
+ 
++	if (vc4->firmware_kms)
++		return 0;
++
+ 	hvs_new_state = vc4_hvs_get_global_state(state);
+ 	if (IS_ERR(hvs_new_state))
+ 		return PTR_ERR(hvs_new_state);
+--- /dev/null
++++ b/drivers/gpu/drm/vc4/vc_image_types.h
+@@ -0,0 +1,175 @@
++
++/*
++ * Copyright (c) 2012, Broadcom Europe Ltd
++ *
++ * Values taken from vc_image_types.h released by Broadcom at
++ * https://github.com/raspberrypi/userland/blob/master/interface/vctypes/vc_image_types.h
++ * and vc_image_structs.h at
++ * https://github.com/raspberrypi/userland/blob/master/interface/vctypes/vc_image_structs.h
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++enum {
++	VC_IMAGE_MIN = 0, //bounds for error checking
++
++	VC_IMAGE_RGB565 = 1,
++	VC_IMAGE_1BPP,
++	VC_IMAGE_YUV420,
++	VC_IMAGE_48BPP,
++	VC_IMAGE_RGB888,
++	VC_IMAGE_8BPP,
++	/* 4bpp palettised image */
++	VC_IMAGE_4BPP,
++	/* A separated format of 16 colour/light shorts followed by 16 z
++	 * values
++	 */
++	VC_IMAGE_3D32,
++	/* 16 colours followed by 16 z values */
++	VC_IMAGE_3D32B,
++	/* A separated format of 16 material/colour/light shorts followed by
++	 * 16 z values
++	 */
++	VC_IMAGE_3D32MAT,
++	/* 32 bit format containing 18 bits of 6.6.6 RGB, 9 bits per short */
++	VC_IMAGE_RGB2X9,
++	/* 32-bit format holding 18 bits of 6.6.6 RGB */
++	VC_IMAGE_RGB666,
++	/* 4bpp palettised image with embedded palette */
++	VC_IMAGE_PAL4_OBSOLETE,
++	/* 8bpp palettised image with embedded palette */
++	VC_IMAGE_PAL8_OBSOLETE,
++	/* RGB888 with an alpha byte after each pixel */
++	VC_IMAGE_RGBA32,
++	/* a line of Y (32-byte padded), a line of U (16-byte padded), and a
++	 * line of V (16-byte padded)
++	 */
++	VC_IMAGE_YUV422,
++	/* RGB565 with a transparent patch */
++	VC_IMAGE_RGBA565,
++	/* Compressed (4444) version of RGBA32 */
++	VC_IMAGE_RGBA16,
++	/* VCIII codec format */
++	VC_IMAGE_YUV_UV,
++	/* VCIII T-format RGBA8888 */
++	VC_IMAGE_TF_RGBA32,
++	/* VCIII T-format RGBx8888 */
++	VC_IMAGE_TF_RGBX32,
++	/* VCIII T-format float */
++	VC_IMAGE_TF_FLOAT,
++	/* VCIII T-format RGBA4444 */
++	VC_IMAGE_TF_RGBA16,
++	/* VCIII T-format RGB5551 */
++	VC_IMAGE_TF_RGBA5551,
++	/* VCIII T-format RGB565 */
++	VC_IMAGE_TF_RGB565,
++	/* VCIII T-format 8-bit luma and 8-bit alpha */
++	VC_IMAGE_TF_YA88,
++	/* VCIII T-format 8 bit generic sample */
++	VC_IMAGE_TF_BYTE,
++	/* VCIII T-format 8-bit palette */
++	VC_IMAGE_TF_PAL8,
++	/* VCIII T-format 4-bit palette */
++	VC_IMAGE_TF_PAL4,
++	/* VCIII T-format Ericsson Texture Compressed */
++	VC_IMAGE_TF_ETC1,
++	/* RGB888 with R & B swapped */
++	VC_IMAGE_BGR888,
++	/* RGB888 with R & B swapped, but with no pitch, i.e. no padding after
++	 * each row of pixels
++	 */
++	VC_IMAGE_BGR888_NP,
++	/* Bayer image, extra defines which variant is being used */
++	VC_IMAGE_BAYER,
++	/* General wrapper for codec images e.g. JPEG from camera */
++	VC_IMAGE_CODEC,
++	/* VCIII codec format */
++	VC_IMAGE_YUV_UV32,
++	/* VCIII T-format 8-bit luma */
++	VC_IMAGE_TF_Y8,
++	/* VCIII T-format 8-bit alpha */
++	VC_IMAGE_TF_A8,
++	/* VCIII T-format 16-bit generic sample */
++	VC_IMAGE_TF_SHORT,
++	/* VCIII T-format 1bpp black/white */
++	VC_IMAGE_TF_1BPP,
++	VC_IMAGE_OPENGL,
++	/* VCIII-B0 HVS YUV 4:4:4 interleaved samples */
++	VC_IMAGE_YUV444I,
++	/* Y, U, & V planes separately (VC_IMAGE_YUV422 has them interleaved on
++	 * a per line basis)
++	 */
++	VC_IMAGE_YUV422PLANAR,
++	/* 32bpp with 8bit alpha at MS byte, with R, G, B (LS byte) */
++	VC_IMAGE_ARGB8888,
++	/* 32bpp with 8bit unused at MS byte, with R, G, B (LS byte) */
++	VC_IMAGE_XRGB8888,
++
++	/* interleaved 8 bit samples of Y, U, Y, V (4 flavours) */
++	VC_IMAGE_YUV422YUYV,
++	VC_IMAGE_YUV422YVYU,
++	VC_IMAGE_YUV422UYVY,
++	VC_IMAGE_YUV422VYUY,
++
++	/* 32bpp like RGBA32 but with unused alpha */
++	VC_IMAGE_RGBX32,
++	/* 32bpp, corresponding to RGBA with unused alpha */
++	VC_IMAGE_RGBX8888,
++	/* 32bpp, corresponding to BGRA with unused alpha */
++	VC_IMAGE_BGRX8888,
++
++	/* Y as a plane, then UV byte interleaved in plane with same pitch,
++	 * half height
++	 */
++	VC_IMAGE_YUV420SP,
++
++	/* Y, U, & V planes separately 4:4:4 */
++	VC_IMAGE_YUV444PLANAR,
++
++	/* T-format 8-bit U - same as TF_Y8 buf from U plane */
++	VC_IMAGE_TF_U8,
++	/* T-format 8-bit U - same as TF_Y8 buf from V plane */
++	VC_IMAGE_TF_V8,
++
++	/* YUV4:2:0 planar, 16bit values */
++	VC_IMAGE_YUV420_16,
++	/* YUV4:2:0 codec format, 16bit values */
++	VC_IMAGE_YUV_UV_16,
++	/* YUV4:2:0 with U,V in side-by-side format */
++	VC_IMAGE_YUV420_S,
++	/* 10-bit YUV 420 column image format */
++	VC_IMAGE_YUV10COL,
++	/* 32-bpp, 10-bit R/G/B, 2-bit Alpha */
++	VC_IMAGE_RGBA1010102,
++
++	VC_IMAGE_MAX,     /* bounds for error checking */
++	VC_IMAGE_FORCE_ENUM_16BIT = 0xffff,
++};
++
++enum {
++	/* Unknown or unset - defaults to BT601 interstitial */
++	VC_IMAGE_YUVINFO_UNSPECIFIED    = 0,
++
++	/* colour-space conversions data [4 bits] */
++
++	/* ITU-R BT.601-5 [SDTV] (compatible with VideoCore-II) */
++	VC_IMAGE_YUVINFO_CSC_ITUR_BT601      = 1,
++	/* ITU-R BT.709-3 [HDTV] */
++	VC_IMAGE_YUVINFO_CSC_ITUR_BT709      = 2,
++	/* JPEG JFIF */
++	VC_IMAGE_YUVINFO_CSC_JPEG_JFIF       = 3,
++	/* Title 47 Code of Federal Regulations (2003) 73.682 (a) (20) */
++	VC_IMAGE_YUVINFO_CSC_FCC             = 4,
++	/* Society of Motion Picture and Television Engineers 240M (1999) */
++	VC_IMAGE_YUVINFO_CSC_SMPTE_240M      = 5,
++	/* ITU-R BT.470-2 System M */
++	VC_IMAGE_YUVINFO_CSC_ITUR_BT470_2_M  = 6,
++	/* ITU-R BT.470-2 System B,G */
++	VC_IMAGE_YUVINFO_CSC_ITUR_BT470_2_BG = 7,
++	/* JPEG JFIF, but with 16..255 luma */
++	VC_IMAGE_YUVINFO_CSC_JPEG_JFIF_Y16_255 = 8,
++	/* Rec 2020 */
++	VC_IMAGE_YUVINFO_CSC_REC_2020        = 9,
++};
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0667-drm-vc4-tests-Switch-generation-mockup-to-a-switch.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0667-drm-vc4-tests-Switch-generation-mockup-to-a-switch.patch
new file mode 100644
index 00000000..eced5c33
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0667-drm-vc4-tests-Switch-generation-mockup-to-a-switch.patch
@@ -0,0 +1,47 @@
+From dc71c9912c75f596b1bb871247a67d4c81e4a94f Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Fri, 17 Feb 2023 13:35:16 +0100
+Subject: [PATCH 667/697] drm/vc4: tests: Switch generation mockup to a switch
+
+Testing whether the VideoCore generation we want to mock is vc5 or vc4
+worked so far, but will be difficult to extend to support BCM2712 (VC6).
+
+Convert to a switch.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/tests/vc4_mock.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/tests/vc4_mock.c
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock.c
+@@ -157,13 +157,27 @@ KUNIT_DEFINE_ACTION_WRAPPER(kunit_action
+ 
+ static struct vc4_dev *__mock_device(struct kunit *test, enum vc4_gen gen)
+ {
++	const struct vc4_mock_desc *desc;
++	const struct drm_driver *drv;
+ 	struct drm_device *drm;
+-	const struct drm_driver *drv = (gen == VC4_GEN_5) ? &vc5_drm_driver : &vc4_drm_driver;
+-	const struct vc4_mock_desc *desc = (gen == VC4_GEN_5) ? &vc5_mock : &vc4_mock;
+ 	struct vc4_dev *vc4;
+ 	struct device *dev;
+ 	int ret;
+ 
++	switch (gen) {
++	case VC4_GEN_4:
++		drv = &vc4_drm_driver;
++		desc = &vc4_mock;
++		break;
++	case VC4_GEN_5:
++		drv = &vc5_drm_driver;
++		desc = &vc5_mock;
++		break;
++
++	default:
++		return NULL;
++	}
++
+ 	dev = drm_kunit_helper_alloc_device(test);
+ 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, dev);
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0668-drm-vc4-tests-Drop-drm-parameter-for-vc4_find_crtc_f.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0668-drm-vc4-tests-Drop-drm-parameter-for-vc4_find_crtc_f.patch
new file mode 100644
index 00000000..601d1858
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0668-drm-vc4-tests-Drop-drm-parameter-for-vc4_find_crtc_f.patch
@@ -0,0 +1,63 @@
+From 5d023e65c847dd448c3500e8028dd162adea7e79 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Fri, 24 Mar 2023 09:58:15 +0100
+Subject: [PATCH 668/697] drm/vc4: tests: Drop drm parameter for
+ vc4_find_crtc_for_encoder
+
+The DRM device pointer and the DRM encoder pointer are redundant, since
+the latter is attached to the former and we can just follow the
+drm_encoder->dev pointer.
+
+Let's remove the drm_device pointer argument.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/tests/vc4_mock.h           | 2 +-
+ drivers/gpu/drm/vc4/tests/vc4_mock_output.c    | 4 ++--
+ drivers/gpu/drm/vc4/tests/vc4_test_pv_muxing.c | 2 +-
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/tests/vc4_mock.h
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock.h
+@@ -7,9 +7,9 @@
+ 
+ static inline
+ struct drm_crtc *vc4_find_crtc_for_encoder(struct kunit *test,
+-					   struct drm_device *drm,
+ 					   struct drm_encoder *encoder)
+ {
++	struct drm_device *drm = encoder->dev;
+ 	struct drm_crtc *crtc;
+ 
+ 	KUNIT_ASSERT_EQ(test, hweight32(encoder->possible_crtcs), 1);
+--- a/drivers/gpu/drm/vc4/tests/vc4_mock_output.c
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock_output.c
+@@ -77,7 +77,7 @@ int vc4_mock_atomic_add_output(struct ku
+ 	encoder = vc4_find_encoder_by_type(drm, type);
+ 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, encoder);
+ 
+-	crtc = vc4_find_crtc_for_encoder(test, drm, encoder);
++	crtc = vc4_find_crtc_for_encoder(test, encoder);
+ 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, crtc);
+ 
+ 	output = encoder_to_vc4_dummy_output(encoder);
+@@ -115,7 +115,7 @@ int vc4_mock_atomic_del_output(struct ku
+ 	encoder = vc4_find_encoder_by_type(drm, type);
+ 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, encoder);
+ 
+-	crtc = vc4_find_crtc_for_encoder(test, drm, encoder);
++	crtc = vc4_find_crtc_for_encoder(test, encoder);
+ 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, crtc);
+ 
+ 	crtc_state = drm_atomic_get_crtc_state(state, crtc);
+--- a/drivers/gpu/drm/vc4/tests/vc4_test_pv_muxing.c
++++ b/drivers/gpu/drm/vc4/tests/vc4_test_pv_muxing.c
+@@ -131,7 +131,7 @@ get_vc4_crtc_state_for_encoder(struct ku
+ 	encoder = vc4_find_encoder_by_type(drm, type);
+ 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, encoder);
+ 
+-	crtc = vc4_find_crtc_for_encoder(test, drm, encoder);
++	crtc = vc4_find_crtc_for_encoder(test, encoder);
+ 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, crtc);
+ 
+ 	new_crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0669-drm-vc4-tests-Return-the-allocated-output.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0669-drm-vc4-tests-Return-the-allocated-output.patch
new file mode 100644
index 00000000..b407313e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0669-drm-vc4-tests-Return-the-allocated-output.patch
@@ -0,0 +1,174 @@
+From 0fbb27d1670527dcea95e20b038842a93a9159fe Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Fri, 24 Mar 2023 10:02:59 +0100
+Subject: [PATCH 669/697] drm/vc4: tests: Return the allocated output
+
+Some tests will need to retrieve the output that was just allocated by
+vc4_mock_atomic_add_output().
+
+Instead of making them look them up in the DRM device, we can simply
+make vc4_mock_atomic_add_output() return an error pointer that holds the
+allocated output instead of the error code.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/tests/vc4_mock.h          |  7 ++--
+ drivers/gpu/drm/vc4/tests/vc4_mock_output.c   |  9 +++--
+ .../gpu/drm/vc4/tests/vc4_test_pv_muxing.c    | 37 +++++++++++--------
+ 3 files changed, 30 insertions(+), 23 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/tests/vc4_mock.h
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock.h
+@@ -51,9 +51,10 @@ struct vc4_dummy_output *vc4_dummy_outpu
+ struct vc4_dev *vc4_mock_device(struct kunit *test);
+ struct vc4_dev *vc5_mock_device(struct kunit *test);
+ 
+-int vc4_mock_atomic_add_output(struct kunit *test,
+-			       struct drm_atomic_state *state,
+-			       enum vc4_encoder_type type);
++struct vc4_dummy_output *
++vc4_mock_atomic_add_output(struct kunit *test,
++			   struct drm_atomic_state *state,
++			   enum vc4_encoder_type type);
+ int vc4_mock_atomic_del_output(struct kunit *test,
+ 			       struct drm_atomic_state *state,
+ 			       enum vc4_encoder_type type);
+--- a/drivers/gpu/drm/vc4/tests/vc4_mock_output.c
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock_output.c
+@@ -61,9 +61,10 @@ static const struct drm_display_mode def
+ 	DRM_SIMPLE_MODE(640, 480, 64, 48)
+ };
+ 
+-int vc4_mock_atomic_add_output(struct kunit *test,
+-			       struct drm_atomic_state *state,
+-			       enum vc4_encoder_type type)
++struct vc4_dummy_output *
++vc4_mock_atomic_add_output(struct kunit *test,
++			   struct drm_atomic_state *state,
++			   enum vc4_encoder_type type)
+ {
+ 	struct drm_device *drm = state->dev;
+ 	struct drm_connector_state *conn_state;
+@@ -96,7 +97,7 @@ int vc4_mock_atomic_add_output(struct ku
+ 
+ 	crtc_state->active = true;
+ 
+-	return 0;
++	return output;
+ }
+ 
+ int vc4_mock_atomic_del_output(struct kunit *test,
+--- a/drivers/gpu/drm/vc4/tests/vc4_test_pv_muxing.c
++++ b/drivers/gpu/drm/vc4/tests/vc4_test_pv_muxing.c
+@@ -682,10 +682,11 @@ static void drm_vc4_test_pv_muxing(struc
+ 	int ret;
+ 
+ 	for (i = 0; i < params->nencoders; i++) {
++		struct vc4_dummy_output *output;
+ 		enum vc4_encoder_type enc_type = params->encoders[i];
+ 
+-		ret = vc4_mock_atomic_add_output(test, state, enc_type);
+-		KUNIT_ASSERT_EQ(test, ret, 0);
++		output = vc4_mock_atomic_add_output(test, state, enc_type);
++		KUNIT_ASSERT_NOT_ERR_OR_NULL(test, output);
+ 	}
+ 
+ 	ret = drm_atomic_check_only(state);
+@@ -711,10 +712,11 @@ static void drm_vc4_test_pv_muxing_inval
+ 	int ret;
+ 
+ 	for (i = 0; i < params->nencoders; i++) {
++		struct vc4_dummy_output *output;
+ 		enum vc4_encoder_type enc_type = params->encoders[i];
+ 
+-		ret = vc4_mock_atomic_add_output(test, state, enc_type);
+-		KUNIT_ASSERT_EQ(test, ret, 0);
++		output = vc4_mock_atomic_add_output(test, state, enc_type);
++		KUNIT_ASSERT_NOT_ERR_OR_NULL(test, output);
+ 	}
+ 
+ 	ret = drm_atomic_check_only(state);
+@@ -784,6 +786,7 @@ static void drm_test_vc5_pv_muxing_bugs_
+ {
+ 	struct drm_modeset_acquire_ctx *ctx;
+ 	struct drm_atomic_state *state;
++	struct vc4_dummy_output *output;
+ 	struct vc4_crtc_state *new_vc4_crtc_state;
+ 	struct vc4_hvs_state *new_hvs_state;
+ 	unsigned int hdmi0_channel;
+@@ -802,8 +805,8 @@ static void drm_test_vc5_pv_muxing_bugs_
+ 	state = drm_kunit_helper_atomic_state_alloc(test, drm, ctx);
+ 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, state);
+ 
+-	ret = vc4_mock_atomic_add_output(test, state, VC4_ENCODER_TYPE_HDMI0);
+-	KUNIT_ASSERT_EQ(test, ret, 0);
++	output = vc4_mock_atomic_add_output(test, state, VC4_ENCODER_TYPE_HDMI0);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, output);
+ 
+ 	ret = drm_atomic_check_only(state);
+ 	KUNIT_ASSERT_EQ(test, ret, 0);
+@@ -825,8 +828,8 @@ static void drm_test_vc5_pv_muxing_bugs_
+ 	state = drm_kunit_helper_atomic_state_alloc(test, drm, ctx);
+ 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, state);
+ 
+-	ret = vc4_mock_atomic_add_output(test, state, VC4_ENCODER_TYPE_HDMI1);
+-	KUNIT_ASSERT_EQ(test, ret, 0);
++	output = vc4_mock_atomic_add_output(test, state, VC4_ENCODER_TYPE_HDMI1);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, output);
+ 
+ 	ret = drm_atomic_check_only(state);
+ 	KUNIT_ASSERT_EQ(test, ret, 0);
+@@ -856,6 +859,7 @@ static void drm_test_vc5_pv_muxing_bugs_
+ {
+ 	struct drm_modeset_acquire_ctx *ctx;
+ 	struct drm_atomic_state *state;
++	struct vc4_dummy_output *output;
+ 	struct vc4_crtc_state *new_vc4_crtc_state;
+ 	struct vc4_hvs_state *new_hvs_state;
+ 	unsigned int old_hdmi0_channel;
+@@ -874,11 +878,11 @@ static void drm_test_vc5_pv_muxing_bugs_
+ 	state = drm_kunit_helper_atomic_state_alloc(test, drm, ctx);
+ 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, state);
+ 
+-	ret = vc4_mock_atomic_add_output(test, state, VC4_ENCODER_TYPE_HDMI0);
+-	KUNIT_ASSERT_EQ(test, ret, 0);
++	output = vc4_mock_atomic_add_output(test, state, VC4_ENCODER_TYPE_HDMI0);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, output);
+ 
+-	ret = vc4_mock_atomic_add_output(test, state, VC4_ENCODER_TYPE_HDMI1);
+-	KUNIT_ASSERT_EQ(test, ret, 0);
++	output = vc4_mock_atomic_add_output(test, state, VC4_ENCODER_TYPE_HDMI1);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, output);
+ 
+ 	ret = drm_atomic_check_only(state);
+ 	KUNIT_ASSERT_EQ(test, ret, 0);
+@@ -951,6 +955,7 @@ drm_test_vc5_pv_muxing_bugs_subsequent_c
+ {
+ 	struct drm_modeset_acquire_ctx *ctx;
+ 	struct drm_atomic_state *state;
++	struct vc4_dummy_output *output;
+ 	struct vc4_crtc_state *new_vc4_crtc_state;
+ 	struct drm_device *drm;
+ 	struct vc4_dev *vc4;
+@@ -966,8 +971,8 @@ drm_test_vc5_pv_muxing_bugs_subsequent_c
+ 	state = drm_kunit_helper_atomic_state_alloc(test, drm, ctx);
+ 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, state);
+ 
+-	ret = vc4_mock_atomic_add_output(test, state, VC4_ENCODER_TYPE_HDMI0);
+-	KUNIT_ASSERT_EQ(test, ret, 0);
++	output = vc4_mock_atomic_add_output(test, state, VC4_ENCODER_TYPE_HDMI0);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, output);
+ 
+ 	ret = drm_atomic_check_only(state);
+ 	KUNIT_ASSERT_EQ(test, ret, 0);
+@@ -978,8 +983,8 @@ drm_test_vc5_pv_muxing_bugs_subsequent_c
+ 	state = drm_kunit_helper_atomic_state_alloc(test, drm, ctx);
+ 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, state);
+ 
+-	ret = vc4_mock_atomic_add_output(test, state, VC4_ENCODER_TYPE_HDMI1);
+-	KUNIT_ASSERT_EQ(test, ret, 0);
++	output = vc4_mock_atomic_add_output(test, state, VC4_ENCODER_TYPE_HDMI1);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, output);
+ 
+ 	ret = drm_atomic_check_only(state);
+ 	KUNIT_ASSERT_EQ(test, ret, 0);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0670-drm-vc4-tests-Add-BCM2712-mock-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0670-drm-vc4-tests-Add-BCM2712-mock-driver.patch
new file mode 100644
index 00000000..6bb1c215
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0670-drm-vc4-tests-Add-BCM2712-mock-driver.patch
@@ -0,0 +1,108 @@
+From d6855b3372e945e9a33f821cbb02788134ff3d39 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Fri, 17 Feb 2023 13:38:10 +0100
+Subject: [PATCH 670/697] drm/vc4: tests: Add BCM2712 mock driver
+
+The BCM2712 has a simpler pipeline that can only output to a writeback
+connector and two HDMI controllers.
+
+Let's allow our kunit tests to create a mock of that pipeline.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/tests/vc4_mock.c | 29 ++++++++++++++++++++++++++++
+ drivers/gpu/drm/vc4/tests/vc4_mock.h |  1 +
+ drivers/gpu/drm/vc4/vc4_drv.h        |  2 ++
+ drivers/gpu/drm/vc4/vc4_txp.c        |  4 ++--
+ 4 files changed, 34 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/tests/vc4_mock.c
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock.c
+@@ -106,6 +106,26 @@ static const struct vc4_mock_desc vc5_mo
+ 							      DRM_MODE_CONNECTOR_HDMIA)),
+ );
+ 
++static const struct vc4_mock_desc vc6_mock =
++	VC4_MOCK_DESC(
++		VC4_MOCK_CRTC_DESC(&bcm2712_mop_data.base,
++				   VC4_MOCK_OUTPUT_DESC(VC4_ENCODER_TYPE_TXP0,
++							DRM_MODE_ENCODER_VIRTUAL,
++							DRM_MODE_CONNECTOR_WRITEBACK)),
++		VC4_MOCK_CRTC_DESC(&bcm2712_moplet_data.base,
++				   VC4_MOCK_OUTPUT_DESC(VC4_ENCODER_TYPE_TXP1,
++							DRM_MODE_ENCODER_VIRTUAL,
++							DRM_MODE_CONNECTOR_WRITEBACK)),
++		VC4_MOCK_PIXELVALVE_DESC(&bcm2712_pv0_data,
++					 VC4_MOCK_OUTPUT_DESC(VC4_ENCODER_TYPE_HDMI0,
++							      DRM_MODE_ENCODER_TMDS,
++							      DRM_MODE_CONNECTOR_HDMIA)),
++		VC4_MOCK_PIXELVALVE_DESC(&bcm2712_pv1_data,
++					 VC4_MOCK_OUTPUT_DESC(VC4_ENCODER_TYPE_HDMI1,
++							      DRM_MODE_ENCODER_TMDS,
++							      DRM_MODE_CONNECTOR_HDMIA)),
++);
++
+ static int __build_one_pipe(struct kunit *test, struct drm_device *drm,
+ 			    const struct vc4_mock_pipe_desc *pipe)
+ {
+@@ -173,6 +193,10 @@ static struct vc4_dev *__mock_device(str
+ 		drv = &vc5_drm_driver;
+ 		desc = &vc5_mock;
+ 		break;
++	case VC4_GEN_6_C:
++		drv = &vc5_drm_driver;
++		desc = &vc6_mock;
++		break;
+ 
+ 	default:
+ 		return NULL;
+@@ -219,3 +243,8 @@ struct vc4_dev *vc5_mock_device(struct k
+ {
+ 	return __mock_device(test, VC4_GEN_5);
+ }
++
++struct vc4_dev *vc6_mock_device(struct kunit *test)
++{
++	return __mock_device(test, VC4_GEN_6_C);
++}
+--- a/drivers/gpu/drm/vc4/tests/vc4_mock.h
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock.h
+@@ -50,6 +50,7 @@ struct vc4_dummy_output *vc4_dummy_outpu
+ 
+ struct vc4_dev *vc4_mock_device(struct kunit *test);
+ struct vc4_dev *vc5_mock_device(struct kunit *test);
++struct vc4_dev *vc6_mock_device(struct kunit *test);
+ 
+ struct vc4_dummy_output *
+ vc4_mock_atomic_add_output(struct kunit *test,
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -562,6 +562,8 @@ struct vc4_txp_data {
+ 	unsigned int supports_40bit_addresses:1;
+ };
+ 
++extern const struct vc4_txp_data bcm2712_mop_data;
++extern const struct vc4_txp_data bcm2712_moplet_data;
+ extern const struct vc4_txp_data bcm2835_txp_data;
+ 
+ struct vc4_pv_data {
+--- a/drivers/gpu/drm/vc4/vc4_txp.c
++++ b/drivers/gpu/drm/vc4/vc4_txp.c
+@@ -519,7 +519,7 @@ static irqreturn_t vc4_txp_interrupt(int
+ 	return IRQ_HANDLED;
+ }
+ 
+-static const struct vc4_txp_data bcm2712_mop_data = {
++const struct vc4_txp_data bcm2712_mop_data = {
+ 	.base = {
+ 		.name = "mop",
+ 		.debugfs_name = "mop_regs",
+@@ -533,7 +533,7 @@ static const struct vc4_txp_data bcm2712
+ 	.supports_40bit_addresses = true,
+ };
+ 
+-static const struct vc4_txp_data bcm2712_moplet_data = {
++const struct vc4_txp_data bcm2712_moplet_data = {
+ 	.base = {
+ 		.name = "moplet",
+ 		.debugfs_name = "moplet_regs",
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0671-drm-vc4-tests-Add-tests-for-BCM2712-PixelValve-Muxin.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0671-drm-vc4-tests-Add-tests-for-BCM2712-PixelValve-Muxin.patch
new file mode 100644
index 00000000..3c2853ff
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0671-drm-vc4-tests-Add-tests-for-BCM2712-PixelValve-Muxin.patch
@@ -0,0 +1,139 @@
+From d9c23e8efe51cbac76e5f033db371675a31b4430 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Fri, 14 Apr 2023 11:14:22 +0200
+Subject: [PATCH 671/697] drm/vc4: tests: Add tests for BCM2712 PixelValve
+ Muxing
+
+The BCM2712 has a simpler pipeline than the BCM2711, and thus the muxing
+requirements are different. Create some tests to make sure we get proper
+muxing decisions.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ .../gpu/drm/vc4/tests/vc4_test_pv_muxing.c    | 81 +++++++++++++++++++
+ 1 file changed, 81 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/tests/vc4_test_pv_muxing.c
++++ b/drivers/gpu/drm/vc4/tests/vc4_test_pv_muxing.c
+@@ -104,6 +104,13 @@ static const struct encoder_constraint v
+ 	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_HDMI1, 0, 1, 2),
+ };
+ 
++static const struct encoder_constraint vc6_encoder_constraints[] = {
++	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_HDMI0, 0),
++	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_HDMI1, 1),
++	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_TXP1, 1),
++	ENCODER_CONSTRAINT(VC4_ENCODER_TYPE_TXP0, 2),
++};
++
+ static bool check_vc4_encoder_constraints(enum vc4_encoder_type type, unsigned int channel)
+ {
+ 	return __check_encoder_constraints(vc4_encoder_constraints,
+@@ -118,6 +125,13 @@ static bool check_vc5_encoder_constraint
+ 					   type, channel);
+ }
+ 
++static bool check_vc6_encoder_constraints(enum vc4_encoder_type type, unsigned int channel)
++{
++	return __check_encoder_constraints(vc6_encoder_constraints,
++					   ARRAY_SIZE(vc6_encoder_constraints),
++					   type, channel);
++}
++
+ static struct vc4_crtc_state *
+ get_vc4_crtc_state_for_encoder(struct kunit *test,
+ 			       const struct drm_atomic_state *state,
+@@ -195,6 +209,9 @@ static void vc4_test_pv_muxing_desc(cons
+ #define VC5_PV_MUXING_TEST(_name, ...)		\
+ 	PV_MUXING_TEST(_name, vc5_mock_device, check_vc5_encoder_constraints, __VA_ARGS__)
+ 
++#define VC6_PV_MUXING_TEST(_name, ...)		\
++	PV_MUXING_TEST(_name, vc6_mock_device, check_vc6_encoder_constraints, __VA_ARGS__)
++
+ static const struct pv_muxing_param vc4_test_pv_muxing_params[] = {
+ 	VC4_PV_MUXING_TEST("1 output: DSI0",
+ 			   VC4_ENCODER_TYPE_DSI0),
+@@ -673,6 +690,54 @@ KUNIT_ARRAY_PARAM(vc5_test_pv_muxing_inv
+ 		  vc5_test_pv_muxing_invalid_params,
+ 		  vc4_test_pv_muxing_desc);
+ 
++static const struct pv_muxing_param vc6_test_pv_muxing_params[] = {
++	VC6_PV_MUXING_TEST("1 output: HDMI0",
++			   VC4_ENCODER_TYPE_HDMI0),
++	VC6_PV_MUXING_TEST("1 output: HDMI1",
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC6_PV_MUXING_TEST("1 output: MOPLET",
++			   VC4_ENCODER_TYPE_TXP1),
++	VC6_PV_MUXING_TEST("1 output: MOP",
++			   VC4_ENCODER_TYPE_TXP0),
++	VC6_PV_MUXING_TEST("2 outputs: HDMI0, HDMI1",
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_HDMI1),
++	VC6_PV_MUXING_TEST("2 outputs: HDMI0, MOPLET",
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_TXP1),
++	VC6_PV_MUXING_TEST("2 outputs: HDMI0, MOP",
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_TXP0),
++	VC6_PV_MUXING_TEST("2 outputs: HDMI1, MOP",
++			   VC4_ENCODER_TYPE_HDMI1,
++			   VC4_ENCODER_TYPE_TXP0),
++	VC6_PV_MUXING_TEST("2 outputs: MOPLET, MOP",
++			   VC4_ENCODER_TYPE_TXP1,
++			   VC4_ENCODER_TYPE_TXP0),
++	VC6_PV_MUXING_TEST("3 outputs: HDMI0, HDMI1, MOP",
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_HDMI1,
++			   VC4_ENCODER_TYPE_TXP0),
++	VC6_PV_MUXING_TEST("3 outputs: HDMI0, MOPLET, MOP",
++			   VC4_ENCODER_TYPE_HDMI0,
++			   VC4_ENCODER_TYPE_TXP1,
++			   VC4_ENCODER_TYPE_TXP0),
++};
++
++KUNIT_ARRAY_PARAM(vc6_test_pv_muxing,
++		  vc6_test_pv_muxing_params,
++		  vc4_test_pv_muxing_desc);
++
++static const struct pv_muxing_param vc6_test_pv_muxing_invalid_params[] = {
++	VC6_PV_MUXING_TEST("HDMI1/MOPLET Conflict",
++			   VC4_ENCODER_TYPE_HDMI1,
++			   VC4_ENCODER_TYPE_TXP1),
++};
++
++KUNIT_ARRAY_PARAM(vc6_test_pv_muxing_invalid,
++		  vc6_test_pv_muxing_invalid_params,
++		  vc4_test_pv_muxing_desc);
++
+ static void drm_vc4_test_pv_muxing(struct kunit *test)
+ {
+ 	const struct pv_muxing_param *params = test->param_value;
+@@ -777,6 +842,21 @@ static struct kunit_suite vc5_pv_muxing_
+ 	.test_cases = vc5_pv_muxing_tests,
+ };
+ 
++static struct kunit_case vc6_pv_muxing_tests[] = {
++	KUNIT_CASE_PARAM(drm_vc4_test_pv_muxing,
++			 vc6_test_pv_muxing_gen_params),
++	KUNIT_CASE_PARAM(drm_vc4_test_pv_muxing_invalid,
++			 vc6_test_pv_muxing_invalid_gen_params),
++	{}
++};
++
++static struct kunit_suite vc6_pv_muxing_test_suite = {
++	.name = "vc6-pv-muxing-combinations",
++	.init = vc4_pv_muxing_test_init,
++	.exit = vc4_pv_muxing_test_exit,
++	.test_cases = vc6_pv_muxing_tests,
++};
++
+ /* See
+  * https://lore.kernel.org/all/3e113525-aa89-b1e2-56b7-ca55bd41d057@samsung.com/
+  * and
+@@ -1009,5 +1089,6 @@ static struct kunit_suite vc5_pv_muxing_
+ kunit_test_suites(
+ 	&vc4_pv_muxing_test_suite,
+ 	&vc5_pv_muxing_test_suite,
++	&vc6_pv_muxing_test_suite,
+ 	&vc5_pv_muxing_bugs_test_suite
+ );
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0672-drm-vc4-tests-Use-custom-plane-state-for-mock.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0672-drm-vc4-tests-Use-custom-plane-state-for-mock.patch
new file mode 100644
index 00000000..e16bd4c9
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0672-drm-vc4-tests-Use-custom-plane-state-for-mock.patch
@@ -0,0 +1,99 @@
+From ae1797f5399dc144fa607e8f6addab407181fe8d Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Fri, 14 Apr 2023 11:24:37 +0200
+Subject: [PATCH 672/697] drm/vc4: tests: Use custom plane state for mock
+
+The current mock planes were just using the regular drm_plane_state,
+while the driver expect struct vc4_plane_state that subclasses
+drm_plane_state.
+
+Hook the proper implementations of reset, duplicate_state, destroy and
+atomic_check to create vc4_plane_state.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/tests/vc4_mock_plane.c | 14 ++++++++++++++
+ drivers/gpu/drm/vc4/vc4_drv.h              |  6 ++++++
+ drivers/gpu/drm/vc4/vc4_plane.c            | 12 ++++++------
+ 3 files changed, 26 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/tests/vc4_mock_plane.c
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock_plane.c
+@@ -7,6 +7,20 @@
+ 
+ #include "vc4_mock.h"
+ 
++static const struct drm_plane_helper_funcs vc4_dummy_plane_helper_funcs = {
++	.atomic_check = vc4_plane_atomic_check,
++};
++
++static const struct drm_plane_funcs vc4_dummy_plane_funcs = {
++	.atomic_destroy_state	= vc4_plane_destroy_state,
++	.atomic_duplicate_state	= vc4_plane_duplicate_state,
++	.reset			= vc4_plane_reset,
++};
++
++static const uint32_t vc4_dummy_plane_formats[] = {
++	DRM_FORMAT_XRGB8888,
++};
++
+ struct drm_plane *vc4_dummy_plane(struct kunit *test, struct drm_device *drm,
+ 				  enum drm_plane_type type)
+ {
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -1103,6 +1103,12 @@ int vc4_kms_load(struct drm_device *dev)
+ struct drm_plane *vc4_plane_init(struct drm_device *dev,
+ 				 enum drm_plane_type type,
+ 				 uint32_t possible_crtcs);
++void vc4_plane_reset(struct drm_plane *plane);
++void vc4_plane_destroy_state(struct drm_plane *plane,
++			     struct drm_plane_state *state);
++struct drm_plane_state *vc4_plane_duplicate_state(struct drm_plane *plane);
++int vc4_plane_atomic_check(struct drm_plane *plane,
++			   struct drm_atomic_state *state);
+ int vc4_plane_create_additional_planes(struct drm_device *dev);
+ u32 vc4_plane_write_dlist(struct drm_plane *plane, u32 __iomem *dlist);
+ u32 vc4_plane_dlist_size(const struct drm_plane_state *state);
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -280,7 +280,7 @@ static bool plane_enabled(struct drm_pla
+ 	return state->fb && !WARN_ON(!state->crtc);
+ }
+ 
+-static struct drm_plane_state *vc4_plane_duplicate_state(struct drm_plane *plane)
++struct drm_plane_state *vc4_plane_duplicate_state(struct drm_plane *plane)
+ {
+ 	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
+ 	struct vc4_hvs *hvs = vc4->hvs;
+@@ -334,8 +334,8 @@ static void vc4_plane_release_upm_ida(st
+ 	ida_free(&hvs->upm_handles, upm_handle);
+ }
+ 
+-static void vc4_plane_destroy_state(struct drm_plane *plane,
+-				    struct drm_plane_state *state)
++void vc4_plane_destroy_state(struct drm_plane *plane,
++			     struct drm_plane_state *state)
+ {
+ 	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
+ 	struct vc4_hvs *hvs = vc4->hvs;
+@@ -368,7 +368,7 @@ static void vc4_plane_destroy_state(stru
+ }
+ 
+ /* Called during init to allocate the plane's atomic state. */
+-static void vc4_plane_reset(struct drm_plane *plane)
++void vc4_plane_reset(struct drm_plane *plane)
+ {
+ 	struct vc4_plane_state *vc4_state;
+ 
+@@ -2159,8 +2159,8 @@ static int vc6_plane_mode_set(struct drm
+  * compute the dlist here and have all active plane dlists get updated
+  * in the CRTC's flush.
+  */
+-static int vc4_plane_atomic_check(struct drm_plane *plane,
+-				  struct drm_atomic_state *state)
++int vc4_plane_atomic_check(struct drm_plane *plane,
++			   struct drm_atomic_state *state)
+ {
+ 	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
+ 	struct drm_plane_state *new_plane_state = drm_atomic_get_new_plane_state(state,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0673-drm-vc4-tests-Add-function-to-lookup-a-plane-for-a-C.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0673-drm-vc4-tests-Add-function-to-lookup-a-plane-for-a-C.patch
new file mode 100644
index 00000000..42f660e2
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0673-drm-vc4-tests-Add-function-to-lookup-a-plane-for-a-C.patch
@@ -0,0 +1,41 @@
+From 6c7d744f2da544995e2df6805c46c1168e38683f Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Fri, 14 Apr 2023 11:26:58 +0200
+Subject: [PATCH 673/697] drm/vc4: tests: Add function to lookup a plane for a
+ CRTC
+
+Some tests will need to find a plane to run a test on for a given CRTC.
+Let's create a small helper to do that.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/tests/vc4_mock.h | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/tests/vc4_mock.h
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock.h
+@@ -21,6 +21,24 @@ struct drm_crtc *vc4_find_crtc_for_encod
+ 	return NULL;
+ }
+ 
++static inline
++struct drm_plane *vc4_mock_find_plane_for_crtc(struct kunit *test,
++					       struct drm_crtc *crtc)
++{
++	struct drm_device *drm = crtc->dev;
++	struct drm_plane *plane;
++
++	drm_for_each_plane(plane, drm)
++		if (plane->possible_crtcs & drm_crtc_mask(crtc))
++			return plane;
++
++	return NULL;
++}
++
++struct vc4_dummy_plane {
++	struct vc4_plane plane;
++};
++
+ struct drm_plane *vc4_dummy_plane(struct kunit *test, struct drm_device *drm,
+ 				  enum drm_plane_type type);
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0674-drm-vc4-tests-Add-helper-to-add-a-new-plane-to-a-sta.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0674-drm-vc4-tests-Add-helper-to-add-a-new-plane-to-a-sta.patch
new file mode 100644
index 00000000..e94e09e5
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0674-drm-vc4-tests-Add-helper-to-add-a-new-plane-to-a-sta.patch
@@ -0,0 +1,62 @@
+From 9292511010b0797f5dde1c8dfc4e61358115972e Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Fri, 14 Apr 2023 12:57:53 +0200
+Subject: [PATCH 674/697] drm/vc4: tests: Add helper to add a new plane to a
+ state
+
+We'll start to add some tests for the plane state logic, so let's create
+a helper to add a plane to an existing atomic state.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/tests/vc4_mock.h       |  3 +++
+ drivers/gpu/drm/vc4/tests/vc4_mock_plane.c | 22 ++++++++++++++++++++++
+ 2 files changed, 25 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/tests/vc4_mock.h
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock.h
+@@ -39,6 +39,9 @@ struct vc4_dummy_plane {
+ 	struct vc4_plane plane;
+ };
+ 
++struct vc4_dummy_plane *vc4_dummy_plane(struct kunit *test,
++					struct drm_device *drm,
++					enum drm_plane_type type);
+ struct drm_plane *vc4_dummy_plane(struct kunit *test, struct drm_device *drm,
+ 				  enum drm_plane_type type);
+ 
+--- a/drivers/gpu/drm/vc4/tests/vc4_mock_plane.c
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock_plane.c
+@@ -1,6 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0
+ 
+ #include <drm/drm_kunit_helpers.h>
++#include <drm/drm_atomic_uapi.h>
+ #include <drm/drm_plane.h>
+ 
+ #include <kunit/test.h>
+@@ -37,3 +38,24 @@ struct drm_plane *vc4_dummy_plane(struct
+ 
+ 	return plane;
+ }
++
++struct drm_plane *
++vc4_mock_atomic_add_plane(struct kunit *test,
++			  struct drm_atomic_state *state,
++			  struct drm_crtc *crtc)
++{
++	struct drm_plane_state *plane_state;
++	struct drm_plane *plane;
++	int ret;
++
++	plane = vc4_mock_find_plane_for_crtc(test, crtc);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, plane);
++
++	plane_state = drm_atomic_get_plane_state(state, plane);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, plane_state);
++
++	ret = drm_atomic_set_crtc_for_plane(plane_state, crtc);
++	KUNIT_EXPECT_EQ(test, ret, 0);
++
++	return plane;
++}
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0675-drm-vc4-tests-Support-a-few-more-plane-formats.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0675-drm-vc4-tests-Support-a-few-more-plane-formats.patch
new file mode 100644
index 00000000..603250b5
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0675-drm-vc4-tests-Support-a-few-more-plane-formats.patch
@@ -0,0 +1,26 @@
+From 23e9130c5c624469f56a2674e69066b115432798 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Fri, 14 Apr 2023 12:59:05 +0200
+Subject: [PATCH 675/697] drm/vc4: tests: Support a few more plane formats
+
+We'll start testing our planes code in situations where we will use more
+than XRGB8888, so let's add a few common pixel formats.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/tests/vc4_mock_plane.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/tests/vc4_mock_plane.c
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock_plane.c
+@@ -19,7 +19,10 @@ static const struct drm_plane_funcs vc4_
+ };
+ 
+ static const uint32_t vc4_dummy_plane_formats[] = {
++	DRM_FORMAT_ARGB8888,
+ 	DRM_FORMAT_XRGB8888,
++	DRM_FORMAT_YUV420,
++	DRM_FORMAT_YUV422,
+ };
+ 
+ struct drm_plane *vc4_dummy_plane(struct kunit *test, struct drm_device *drm,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0676-drm-vc4-tests-Introduce-a-test-for-LBM-buffer-size.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0676-drm-vc4-tests-Introduce-a-test-for-LBM-buffer-size.patch
new file mode 100644
index 00000000..c6f42a5e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0676-drm-vc4-tests-Introduce-a-test-for-LBM-buffer-size.patch
@@ -0,0 +1,350 @@
+From 4c880995fbe48d73ce18d4b7ab7a870f38b27548 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Fri, 14 Apr 2023 13:43:32 +0200
+Subject: [PATCH 676/697] drm/vc4: tests: Introduce a test for LBM buffer size
+
+The BCM2712 comes with a different LBM size computation than the
+previous generations, so let's add the few examples provided as kunit
+tests to make sure we always satisfy those requirements.
+
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+---
+ drivers/gpu/drm/vc4/Makefile                  |   3 +-
+ drivers/gpu/drm/vc4/tests/vc4_test_lbm_size.c | 308 ++++++++++++++++++
+ .../gpu/drm/vc4/tests/vc4_test_pv_muxing.c    |   1 -
+ 3 files changed, 310 insertions(+), 2 deletions(-)
+ create mode 100644 drivers/gpu/drm/vc4/tests/vc4_test_lbm_size.c
+
+--- a/drivers/gpu/drm/vc4/Makefile
++++ b/drivers/gpu/drm/vc4/Makefile
+@@ -31,7 +31,8 @@ vc4-$(CONFIG_DRM_VC4_KUNIT_TEST) += \
+ 	tests/vc4_mock_crtc.o \
+ 	tests/vc4_mock_output.o \
+ 	tests/vc4_mock_plane.o \
+-	tests/vc4_test_pv_muxing.o
++	tests/vc4_test_pv_muxing.o \
++	tests/vc4_test_lbm_size.o
+ 
+ vc4-$(CONFIG_DEBUG_FS) += vc4_debugfs.o
+ 
+--- /dev/null
++++ b/drivers/gpu/drm/vc4/tests/vc4_test_lbm_size.c
+@@ -0,0 +1,308 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include <drm/drm_atomic_helper.h>
++#include <drm/drm_atomic_uapi.h>
++#include <drm/drm_drv.h>
++#include <drm/drm_fourcc.h>
++#include <drm/drm_framebuffer.h>
++#include <drm/drm_plane.h>
++#include <drm/drm_kunit_helpers.h>
++
++#include "../../drm_crtc_internal.h"
++#include "../../drm_internal.h"
++
++#include <kunit/test.h>
++
++#include "../vc4_drv.h"
++
++#include "vc4_mock.h"
++
++u32 vc4_lbm_size(struct drm_plane_state *state);
++
++struct vc4_lbm_size_priv {
++	struct vc4_dev *vc4;
++	struct drm_file *file;
++	struct drm_modeset_acquire_ctx ctx;
++	struct drm_atomic_state *state;
++};
++
++struct vc4_lbm_size_param {
++	unsigned int src_w, src_h;
++	unsigned int crtc_w, crtc_h;
++	bool forced_alpha;
++	u32 fourcc;
++	enum vc4_scaling_mode expected_x_scaling[2];
++	enum vc4_scaling_mode expected_y_scaling[2];
++	unsigned int expected_lbm_size;
++};
++
++static const struct vc4_lbm_size_param vc4_test_lbm_size_params[] = {
++	{
++		.src_w = 256,
++		.crtc_w = 256,
++		.src_h = 256,
++		.crtc_h = 512,
++		.fourcc = DRM_FORMAT_ARGB8888,
++		.expected_x_scaling = { VC4_SCALING_NONE, },
++		.expected_y_scaling = { VC4_SCALING_PPF, },
++		.expected_lbm_size = 32,
++	},
++	{
++		.src_w = 256,
++		.crtc_w = 179,
++		.src_h = 256,
++		.crtc_h = 512,
++		.fourcc = DRM_FORMAT_ARGB8888,
++		.expected_x_scaling = { VC4_SCALING_PPF, },
++		.expected_y_scaling = { VC4_SCALING_PPF, },
++		.expected_lbm_size = 23,
++	},
++	{
++		.src_w = 256,
++		.crtc_w = 256,
++		.src_h = 256,
++		.crtc_h = 512,
++		.fourcc = DRM_FORMAT_XRGB8888,
++		.expected_x_scaling = { VC4_SCALING_NONE, },
++		.expected_y_scaling = { VC4_SCALING_PPF, },
++		.expected_lbm_size = 24,
++	},
++	{
++		.src_w = 100,
++		.crtc_w = 73,
++		.src_h = 100,
++		.crtc_h = 73,
++		.fourcc = DRM_FORMAT_XRGB8888,
++		.expected_x_scaling = { VC4_SCALING_PPF, },
++		.expected_y_scaling = { VC4_SCALING_PPF, },
++		.expected_lbm_size = 8,
++	},
++	{
++		.src_w = 256,
++		.crtc_w = 256,
++		.src_h = 256,
++		.crtc_h = 512,
++		.forced_alpha = true,
++		.fourcc = DRM_FORMAT_ARGB8888,
++		.expected_x_scaling = { VC4_SCALING_NONE, },
++		.expected_y_scaling = { VC4_SCALING_PPF, },
++		.expected_lbm_size = 24,
++	},
++	{
++		.src_w = 100,
++		.crtc_w = 73,
++		.src_h = 100,
++		.crtc_h = 73,
++		.forced_alpha = true,
++		.fourcc = DRM_FORMAT_ARGB8888,
++		.expected_x_scaling = { VC4_SCALING_PPF, },
++		.expected_y_scaling = { VC4_SCALING_PPF, },
++		.expected_lbm_size = 8,
++	},
++	{
++		.src_w = 256,
++		.crtc_w = 94,
++		.src_h = 256,
++		.crtc_h = 94,
++		.fourcc = DRM_FORMAT_ARGB8888,
++		.expected_x_scaling = { VC4_SCALING_TPZ, },
++		.expected_y_scaling = { VC4_SCALING_TPZ, },
++		.expected_lbm_size = 6,
++	},
++
++/*
++ * TODO: Those tests reflect the LBM size calculation examples, but the
++ * driver ends up taking different scaler filters decisions, and thus
++ * doesn't end up with the same sizes. It would be valuable to have
++ * those tests, but the driver doesn't take a bad decision either, so
++ * it's not clear what we should do at this point.
++ */
++#if 0
++	{
++		.src_w = 320,
++		.crtc_w = 320,
++		.src_h = 320,
++		.crtc_h = 320,
++		.fourcc = DRM_FORMAT_YUV420,
++		.expected_x_scaling = { VC4_SCALING_NONE, VC4_SCALING_NONE, },
++		.expected_y_scaling = { VC4_SCALING_NONE, VC4_SCALING_PPF, },
++		.expected_lbm_size = 10,
++	},
++	{
++		.src_w = 512,
++		.crtc_w = 512,
++		.src_h = 512,
++		.crtc_h = 256,
++		.fourcc = DRM_FORMAT_YUV420,
++		.expected_x_scaling = { VC4_SCALING_NONE, VC4_SCALING_NONE, },
++		.expected_y_scaling = { VC4_SCALING_TPZ, VC4_SCALING_NONE, },
++		.expected_lbm_size = 5,
++	},
++	{
++		.src_w = 486,
++		.crtc_w = 157,
++		.src_h = 404,
++		.crtc_h = 929,
++		.fourcc = DRM_FORMAT_YUV422,
++		.expected_x_scaling = { VC4_SCALING_PPF, VC4_SCALING_PPF, },
++		.expected_y_scaling = { VC4_SCALING_PPF, VC4_SCALING_PPF, },
++		.expected_lbm_size = 20,
++	},
++	{
++		.src_w = 320,
++		.crtc_w = 128,
++		.src_h = 176,
++		.crtc_h = 70,
++		.fourcc = DRM_FORMAT_YUV420,
++		.expected_x_scaling = { VC4_SCALING_TPZ, VC4_SCALING_TPZ, },
++		.expected_y_scaling = { VC4_SCALING_TPZ, VC4_SCALING_TPZ, },
++		.expected_lbm_size = 8,
++	},
++#endif
++};
++
++static void vc4_test_lbm_size_desc(const struct vc4_lbm_size_param *t, char *desc)
++{
++	snprintf(desc, KUNIT_PARAM_DESC_SIZE,
++		 "%ux%u to %ux%u %s(%p4cc)",
++		 t->src_w, t->src_h,
++		 t->crtc_w, t->crtc_h,
++		 t->forced_alpha ? "with forced alpha " : "",
++		 &t->fourcc);
++}
++
++KUNIT_ARRAY_PARAM(vc4_test_lbm_size,
++		  vc4_test_lbm_size_params,
++		  vc4_test_lbm_size_desc);
++
++static void drm_vc4_test_vc4_lbm_size(struct kunit *test)
++{
++	const struct vc4_lbm_size_param *params = test->param_value;
++	const struct vc4_lbm_size_priv *priv = test->priv;
++	const struct drm_format_info *info;
++	struct drm_mode_fb_cmd2 fb_req = { };
++	struct drm_atomic_state *state = priv->state;
++	struct vc4_plane_state *vc4_plane_state;
++	struct drm_plane_state *plane_state;
++	struct vc4_dummy_output *output;
++	struct drm_framebuffer *fb;
++	struct drm_plane *plane;
++	struct drm_crtc *crtc;
++	unsigned int i;
++	int ret;
++
++	info = drm_format_info(params->fourcc);
++	KUNIT_ASSERT_NOT_NULL(test, info);
++
++	output = vc4_mock_atomic_add_output(test, state, VC4_ENCODER_TYPE_HDMI0);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, output);
++
++	crtc = vc4_find_crtc_for_encoder(test, &output->encoder.base);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, crtc);
++
++	plane = vc4_mock_atomic_add_plane(test, state, crtc);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, plane);
++
++	plane_state = drm_atomic_get_plane_state(state, plane);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, plane_state);
++
++	vc4_plane_state = to_vc4_plane_state(plane_state);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, vc4_plane_state);
++
++	fb_req.pixel_format = params->fourcc;
++	fb_req.width = params->src_w;
++	fb_req.height = params->src_h;
++
++	for (i = 0; i < info->num_planes; i++) {
++		struct drm_mode_create_dumb dumb_args = { };
++
++		dumb_args.width = params->src_w;
++		dumb_args.height = params->src_h;
++		dumb_args.bpp = drm_format_info_bpp(info, i);
++
++		ret = drm_mode_create_dumb(state->dev, &dumb_args, priv->file);
++		KUNIT_ASSERT_EQ(test, ret, 0);
++
++		fb_req.handles[i] = dumb_args.handle;
++		fb_req.pitches[i] = dumb_args.pitch;
++	}
++
++	fb = drm_internal_framebuffer_create(state->dev, &fb_req, priv->file);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, fb);
++
++	drm_atomic_set_fb_for_plane(plane_state, fb);
++
++	plane_state->src_x = 0;
++	plane_state->src_y = 0;
++	plane_state->src_h = params->src_h << 16;
++	plane_state->src_w = params->src_w << 16;
++
++	plane_state->crtc_x = 0;
++	plane_state->crtc_y = 0;
++	plane_state->crtc_h = params->crtc_h;
++	plane_state->crtc_w = params->crtc_w;
++
++	if (params->forced_alpha)
++		plane_state->alpha = 128;
++
++	ret = drm_atomic_check_only(state);
++	KUNIT_ASSERT_EQ(test, ret, 0);
++
++	KUNIT_EXPECT_EQ(test, vc4_plane_state->lbm.size, params->expected_lbm_size);
++
++	for (i = 0; i < 2; i++) {
++		KUNIT_EXPECT_EQ(test,
++				vc4_plane_state->x_scaling[i],
++				params->expected_x_scaling[i]);
++		KUNIT_EXPECT_EQ(test,
++				vc4_plane_state->y_scaling[i],
++				params->expected_y_scaling[i]);
++	}
++
++	drm_framebuffer_put(fb);
++
++	for (i = 0; i < info->num_planes; i++)
++		drm_mode_destroy_dumb(state->dev, fb_req.handles[i], priv->file);
++}
++
++static struct kunit_case vc4_lbm_size_tests[] = {
++	KUNIT_CASE_PARAM(drm_vc4_test_vc4_lbm_size,
++			 vc4_test_lbm_size_gen_params),
++	{}
++};
++
++static int vc4_lbm_size_test_init(struct kunit *test)
++{
++	struct drm_modeset_acquire_ctx *ctx;
++	struct vc4_lbm_size_priv *priv;
++	struct drm_device *drm;
++	struct vc4_dev *vc4;
++
++	priv = kunit_kzalloc(test, sizeof(*priv), GFP_KERNEL);
++	KUNIT_ASSERT_NOT_NULL(test, priv);
++	test->priv = priv;
++
++	vc4 = vc6_mock_device(test);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, vc4);
++	priv->vc4 = vc4;
++
++	priv->file = drm_file_alloc(priv->vc4->base.primary);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, priv->file);
++
++	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
++
++	drm = &vc4->base;
++	priv->state = drm_kunit_helper_atomic_state_alloc(test, drm, ctx);
++	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, priv->state);
++
++	return 0;
++}
++
++static struct kunit_suite vc4_lbm_size_test_suite = {
++	.name = "vc4-lbm-size",
++	.init = vc4_lbm_size_test_init,
++	.test_cases = vc4_lbm_size_tests,
++};
++
++kunit_test_suite(vc4_lbm_size_test_suite);
+--- a/drivers/gpu/drm/vc4/tests/vc4_test_pv_muxing.c
++++ b/drivers/gpu/drm/vc4/tests/vc4_test_pv_muxing.c
+@@ -853,7 +853,6 @@ static struct kunit_case vc6_pv_muxing_t
+ static struct kunit_suite vc6_pv_muxing_test_suite = {
+ 	.name = "vc6-pv-muxing-combinations",
+ 	.init = vc4_pv_muxing_test_init,
+-	.exit = vc4_pv_muxing_test_exit,
+ 	.test_cases = vc6_pv_muxing_tests,
+ };
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0677-drm-vc4-backport-27e0a194a256-and-b3bf19552ea3.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0677-drm-vc4-backport-27e0a194a256-and-b3bf19552ea3.patch
new file mode 100644
index 00000000..0b856815
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0677-drm-vc4-backport-27e0a194a256-and-b3bf19552ea3.patch
@@ -0,0 +1,63 @@
+From a0bda02653b026d0a883df557093217284798d8a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ma=C3=ADra=20Canal?= <mcanal@igalia.com>
+Date: Tue, 6 Aug 2024 12:02:52 -0300
+Subject: [PATCH 677/697] drm/vc4: backport 27e0a194a256 and b3bf19552ea3
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Get the KUnit tests passing.
+
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+---
+ drivers/gpu/drm/vc4/tests/vc4_mock.h       | 12 +++++-------
+ drivers/gpu/drm/vc4/tests/vc4_mock_plane.c |  8 +++++---
+ 2 files changed, 10 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/tests/vc4_mock.h
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock.h
+@@ -35,16 +35,14 @@ struct drm_plane *vc4_mock_find_plane_fo
+ 	return NULL;
+ }
+ 
+-struct vc4_dummy_plane {
+-	struct vc4_plane plane;
+-};
+-
+-struct vc4_dummy_plane *vc4_dummy_plane(struct kunit *test,
+-					struct drm_device *drm,
+-					enum drm_plane_type type);
+ struct drm_plane *vc4_dummy_plane(struct kunit *test, struct drm_device *drm,
+ 				  enum drm_plane_type type);
+ 
++struct drm_plane *
++vc4_mock_atomic_add_plane(struct kunit *test,
++			  struct drm_atomic_state *state,
++			  struct drm_crtc *crtc);
++
+ struct vc4_dummy_crtc {
+ 	struct vc4_crtc crtc;
+ };
+--- a/drivers/gpu/drm/vc4/tests/vc4_mock_plane.c
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock_plane.c
+@@ -1,5 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ 
++#include <drm/drm_modeset_helper_vtables.h>
+ #include <drm/drm_kunit_helpers.h>
+ #include <drm/drm_atomic_uapi.h>
+ #include <drm/drm_plane.h>
+@@ -33,9 +34,10 @@ struct drm_plane *vc4_dummy_plane(struct
+ 	KUNIT_ASSERT_EQ(test, type, DRM_PLANE_TYPE_PRIMARY);
+ 
+ 	plane = drm_kunit_helper_create_primary_plane(test, drm,
+-						      NULL,
+-						      NULL,
+-						      NULL, 0,
++						      &vc4_dummy_plane_funcs,
++						      &vc4_dummy_plane_helper_funcs,
++						      vc4_dummy_plane_formats,
++						      ARRAY_SIZE(vc4_dummy_plane_formats),
+ 						      NULL);
+ 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, plane);
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0678-drm-vc4-Cache-LBM-allocations-to-avoid-double-buffer.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0678-drm-vc4-Cache-LBM-allocations-to-avoid-double-buffer.patch
new file mode 100644
index 00000000..cb7d8372
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0678-drm-vc4-Cache-LBM-allocations-to-avoid-double-buffer.patch
@@ -0,0 +1,298 @@
+From cd3dbe8b7d3333a61cb6dbc2c5217d66cc19674c Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 27 Sep 2024 16:54:01 +0100
+Subject: [PATCH 678/697] drm/vc4: Cache LBM allocations to avoid
+ double-buffering
+
+LBM is only relevant for each active dlist, so there is
+no need to double-buffer the allocations.
+
+Cache the allocations per plane so that we can ensure the
+allocations are possible.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/tests/vc4_test_lbm_size.c |  8 +-
+ drivers/gpu/drm/vc4/vc4_drv.h                 | 17 +++-
+ drivers/gpu/drm/vc4/vc4_hvs.c                 | 24 +++++
+ drivers/gpu/drm/vc4/vc4_plane.c               | 99 +++++++++++++++----
+ 4 files changed, 128 insertions(+), 20 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/tests/vc4_test_lbm_size.c
++++ b/drivers/gpu/drm/vc4/tests/vc4_test_lbm_size.c
+@@ -188,6 +188,7 @@ static void drm_vc4_test_vc4_lbm_size(st
+ 	struct drm_framebuffer *fb;
+ 	struct drm_plane *plane;
+ 	struct drm_crtc *crtc;
++	struct vc4_dev *vc4;
+ 	unsigned int i;
+ 	int ret;
+ 
+@@ -248,7 +249,12 @@ static void drm_vc4_test_vc4_lbm_size(st
+ 	ret = drm_atomic_check_only(state);
+ 	KUNIT_ASSERT_EQ(test, ret, 0);
+ 
+-	KUNIT_EXPECT_EQ(test, vc4_plane_state->lbm.size, params->expected_lbm_size);
++	vc4 = to_vc4_dev(state->dev);
++	KUNIT_ASSERT_NOT_NULL(test, vc4);
++	KUNIT_ASSERT_NOT_NULL(test, vc4->hvs);
++	KUNIT_EXPECT_EQ(test,
++			vc4->hvs->lbm_refcounts[vc4_plane_state->lbm_handle].size,
++			params->expected_lbm_size);
+ 
+ 	for (i = 0; i < 2; i++) {
+ 		KUNIT_EXPECT_EQ(test,
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -322,6 +322,19 @@ struct vc4_v3d {
+ 	struct debugfs_regset32 regset;
+ };
+ 
++#define VC4_NUM_LBM_HANDLES 64
++struct vc4_lbm_refcounts {
++	refcount_t refcount;
++
++	/* Allocation size */
++	size_t size;
++	/* Our allocation in LBM. */
++	struct drm_mm_node lbm;
++
++	/* Pointer back to the HVS structure */
++	struct vc4_hvs *hvs;
++};
++
+ #define VC4_NUM_UPM_HANDLES 32
+ struct vc4_upm_refcounts {
+ 	refcount_t refcount;
+@@ -363,6 +376,8 @@ struct vc4_hvs {
+ 
+ 	/* Memory manager for the LBM memory used by HVS scaling. */
+ 	struct drm_mm lbm_mm;
++	struct ida lbm_handles;
++	struct vc4_lbm_refcounts lbm_refcounts[VC4_NUM_LBM_HANDLES + 1];
+ 
+ 	/* Memory manager for the UPM memory used for prefetching. */
+ 	struct drm_mm upm_mm;
+@@ -462,7 +477,7 @@ struct vc4_plane_state {
+ 	bool is_yuv;
+ 
+ 	/* Our allocation in LBM for temporary storage during scaling. */
+-	struct drm_mm_node lbm;
++	unsigned int lbm_handle;
+ 
+ 	/* The Unified Pre-Fetcher Handle */
+ 	unsigned int upm_handle[DRM_FORMAT_MAX_PLANES];
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -379,6 +379,27 @@ static int vc4_hvs_debugfs_dlist_allocs(
+ 	return 0;
+ }
+ 
++static int vc4_hvs_debugfs_lbm_allocs(struct seq_file *m, void *data)
++{
++	struct drm_debugfs_entry *entry = m->private;
++	struct drm_device *dev = entry->dev;
++	struct vc4_dev *vc4 = to_vc4_dev(dev);
++	struct vc4_hvs *hvs = vc4->hvs;
++	struct drm_printer p = drm_seq_file_printer(m);
++	struct vc4_lbm_refcounts *refcount;
++	unsigned int i;
++
++	drm_printf(&p, "LBM Handles:\n");
++	for (i = 0; i < VC4_NUM_LBM_HANDLES; i++) {
++		refcount = &hvs->lbm_refcounts[i];
++		drm_printf(&p, "handle %u: refcount %u, size %zu [%08llx + %08llx]\n",
++			   i, refcount_read(&refcount->refcount), refcount->size,
++			   refcount->lbm.start, refcount->lbm.size);
++	}
++
++	return 0;
++}
++
+ /* The filter kernel is composed of dwords each containing 3 9-bit
+  * signed integers packed next to each other.
+  */
+@@ -1511,6 +1532,8 @@ int vc4_hvs_debugfs_init(struct drm_mino
+ 		drm_debugfs_add_file(drm, "hvs_dlists", vc4_hvs_debugfs_dlist, NULL);
+ 	}
+ 
++	drm_debugfs_add_file(drm, "hvs_lbm", vc4_hvs_debugfs_lbm_allocs, NULL);
++
+ 	drm_debugfs_add_file(drm, "hvs_underrun", vc4_hvs_debugfs_underrun, NULL);
+ 
+ 	drm_debugfs_add_file(drm, "hvs_dlist_allocs", vc4_hvs_debugfs_dlist_allocs, NULL);
+@@ -1627,6 +1650,7 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
+ 	}
+ 
+ 	drm_mm_init(&hvs->lbm_mm, 0, lbm_size);
++	ida_init(&hvs->lbm_handles);
+ 
+ 	if (vc4->gen >= VC4_GEN_6_C) {
+ 		ida_init(&hvs->upm_handles);
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -294,12 +294,12 @@ struct drm_plane_state *vc4_plane_duplic
+ 	if (!vc4_state)
+ 		return NULL;
+ 
+-	memset(&vc4_state->lbm, 0, sizeof(vc4_state->lbm));
+-
+ 	for (i = 0; i < DRM_FORMAT_MAX_PLANES; i++) {
+ 		if (vc4_state->upm_handle[i])
+ 			refcount_inc(&hvs->upm_refcounts[vc4_state->upm_handle[i]].refcount);
+ 	}
++	if (vc4_state->lbm_handle)
++		refcount_inc(&hvs->lbm_refcounts[vc4_state->lbm_handle].refcount);
+ 
+ 	vc4_state->dlist_initialized = 0;
+ 
+@@ -319,6 +319,21 @@ struct drm_plane_state *vc4_plane_duplic
+ 	return &vc4_state->base;
+ }
+ 
++static void vc4_plane_release_lbm_ida(struct vc4_hvs *hvs, unsigned int lbm_handle)
++{
++	struct vc4_lbm_refcounts *refcount = &hvs->lbm_refcounts[lbm_handle];
++	unsigned long irqflags;
++
++	spin_lock_irqsave(&hvs->mm_lock, irqflags);
++	drm_mm_remove_node(&refcount->lbm);
++	spin_unlock_irqrestore(&hvs->mm_lock, irqflags);
++	refcount->lbm.start = 0;
++	refcount->lbm.size = 0;
++	refcount->size = 0;
++
++	ida_free(&hvs->lbm_handles, lbm_handle);
++}
++
+ static void vc4_plane_release_upm_ida(struct vc4_hvs *hvs, unsigned int upm_handle)
+ {
+ 	struct vc4_upm_refcounts *refcount = &hvs->upm_refcounts[upm_handle];
+@@ -342,12 +357,13 @@ void vc4_plane_destroy_state(struct drm_
+ 	struct vc4_plane_state *vc4_state = to_vc4_plane_state(state);
+ 	unsigned int i;
+ 
+-	if (drm_mm_node_allocated(&vc4_state->lbm)) {
+-		unsigned long irqflags;
++	if (vc4_state->lbm_handle) {
++		struct vc4_lbm_refcounts *refcount;
+ 
+-		spin_lock_irqsave(&hvs->mm_lock, irqflags);
+-		drm_mm_remove_node(&vc4_state->lbm);
+-		spin_unlock_irqrestore(&hvs->mm_lock, irqflags);
++		refcount = &hvs->lbm_refcounts[vc4_state->lbm_handle];
++
++		if (refcount_dec_and_test(&refcount->refcount))
++			vc4_plane_release_lbm_ida(hvs, vc4_state->lbm_handle);
+ 	}
+ 
+ 	for (i = 0; i < DRM_FORMAT_MAX_PLANES; i++) {
+@@ -939,10 +955,14 @@ static int vc4_plane_allocate_lbm(struct
+ {
+ 	struct drm_device *drm = state->plane->dev;
+ 	struct vc4_dev *vc4 = to_vc4_dev(drm);
++	struct vc4_hvs *hvs = vc4->hvs;
+ 	struct drm_plane *plane = state->plane;
+ 	struct vc4_plane_state *vc4_state = to_vc4_plane_state(state);
++	struct vc4_lbm_refcounts *refcount;
+ 	unsigned long irqflags;
++	int lbm_handle;
+ 	u32 lbm_size;
++	int ret;
+ 
+ 	lbm_size = vc4_lbm_size(state);
+ 	if (!lbm_size)
+@@ -966,29 +986,71 @@ static int vc4_plane_allocate_lbm(struct
+ 	/* Allocate the LBM memory that the HVS will use for temporary
+ 	 * storage due to our scaling/format conversion.
+ 	 */
+-	if (!drm_mm_node_allocated(&vc4_state->lbm)) {
+-		int ret;
++	lbm_handle = vc4_state->lbm_handle;
++	if (lbm_handle &&
++	    hvs->lbm_refcounts[lbm_handle].size == lbm_size) {
++		/* Allocation is the same size as the previous user of
++		 * the plane. Keep the allocation.
++		 */
++		vc4_state->lbm_handle = lbm_handle;
++	} else {
++		if (lbm_handle &&
++		    refcount_dec_and_test(&hvs->lbm_refcounts[lbm_handle].refcount)) {
++			vc4_plane_release_lbm_ida(hvs, lbm_handle);
++			vc4_state->lbm_handle = 0;
++		}
++
++		lbm_handle = ida_alloc_range(&hvs->lbm_handles, 1,
++					     VC4_NUM_LBM_HANDLES,
++					     GFP_KERNEL);
++		if (lbm_handle < 0) {
++			drm_err(drm, "Out of lbm_handles\n");
++			return lbm_handle;
++		}
++		vc4_state->lbm_handle = lbm_handle;
++
++		refcount = &hvs->lbm_refcounts[lbm_handle];
++		refcount_set(&refcount->refcount, 1);
++		refcount->size = lbm_size;
+ 
+-		spin_lock_irqsave(&vc4->hvs->mm_lock, irqflags);
++		spin_lock_irqsave(&hvs->mm_lock, irqflags);
+ 		ret = drm_mm_insert_node_generic(&vc4->hvs->lbm_mm,
+-						 &vc4_state->lbm,
++						 &refcount->lbm,
+ 						 lbm_size, 1,
+ 						 0, 0);
+-		spin_unlock_irqrestore(&vc4->hvs->mm_lock, irqflags);
++		spin_unlock_irqrestore(&hvs->mm_lock, irqflags);
+ 
+ 		if (ret) {
+ 			drm_err(drm, "Failed to allocate LBM entry: %d\n", ret);
++			refcount_set(&refcount->refcount, 0);
++			ida_free(&hvs->lbm_handles, lbm_handle);
++			vc4_state->lbm_handle = 0;
+ 			return ret;
+ 		}
+-	} else {
+-		WARN_ON_ONCE(lbm_size != vc4_state->lbm.size);
+ 	}
+ 
+-	vc4_state->dlist[vc4_state->lbm_offset] = vc4_state->lbm.start;
++	vc4_state->dlist[vc4_state->lbm_offset] = hvs->lbm_refcounts[lbm_handle].lbm.start;
+ 
+ 	return 0;
+ }
+ 
++static void vc4_plane_free_lbm(struct drm_plane_state *state)
++{
++	struct vc4_plane_state *vc4_state = to_vc4_plane_state(state);
++	struct drm_device *drm = state->plane->dev;
++	struct vc4_dev *vc4 = to_vc4_dev(drm);
++	struct vc4_hvs *hvs = vc4->hvs;
++	unsigned int lbm_handle;
++
++	lbm_handle = vc4_state->lbm_handle;
++	if (!lbm_handle)
++		return;
++
++	if (refcount_dec_and_test(&hvs->lbm_refcounts[lbm_handle].refcount))
++		vc4_plane_release_lbm_ida(hvs, lbm_handle);
++	vc4_state->lbm_handle = 0;
++}
++
+ static int vc6_plane_allocate_upm(struct drm_plane_state *state)
+ {
+ 	const struct drm_format_info *info = state->fb->format;
+@@ -2174,9 +2236,10 @@ int vc4_plane_atomic_check(struct drm_pl
+ 		struct drm_plane_state *old_plane_state =
+ 				drm_atomic_get_old_plane_state(state, plane);
+ 
+-		if (vc4->gen >= VC4_GEN_6_C && old_plane_state &&
+-		    plane_enabled(old_plane_state)) {
+-			vc6_plane_free_upm(new_plane_state);
++		if (old_plane_state && plane_enabled(old_plane_state)) {
++			if (vc4->gen >= VC4_GEN_6_C)
++				vc6_plane_free_upm(new_plane_state);
++			vc4_plane_free_lbm(new_plane_state);
+ 		}
+ 		return 0;
+ 	}
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0679-dtoverlays-bcm2712d0-Don-t-change-vc4-compatible-str.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0679-dtoverlays-bcm2712d0-Don-t-change-vc4-compatible-str.patch
new file mode 100644
index 00000000..dad63074
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0679-dtoverlays-bcm2712d0-Don-t-change-vc4-compatible-str.patch
@@ -0,0 +1,55 @@
+From 7972ef1fb797157bf9a7a00de1927b552f11d9f9 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 4 Dec 2024 17:42:20 +0000
+Subject: [PATCH 679/697] dtoverlays: bcm2712d0 - Don't change vc4 compatible
+ string
+
+The mainline version of D0 support reads the version string
+from the hardware, so we don't need to change the compatible
+string.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/bcm2712d0-overlay.dts | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/bcm2712d0-overlay.dts
++++ b/arch/arm/boot/dts/overlays/bcm2712d0-overlay.dts
+@@ -39,34 +39,27 @@
+ 	};
+ 
+ 	fragment@4 {
+-		target = <&vc4>;
+-		__overlay__ {
+-			compatible = "brcm,bcm2712d0-vc6", "brcm,bcm2712-vc6";
+-		};
+-	};
+-
+-	fragment@5 {
+ 		target = <&uart10>;
+ 		__overlay__ {
+ 			interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>;
+ 		};
+ 	};
+ 
+-	fragment@6 {
++	fragment@5 {
+ 		target = <&spi10>;
+ 		__overlay__ {
+ 			dmas = <&dma40 3>, <&dma40 4>;
+ 		};
+ 	};
+ 
+-	fragment@7 {
++	fragment@6 {
+ 		target = <&hdmi0>;
+ 		__overlay__ {
+ 			dmas = <&dma40 (12|(1<<30)|(1<<24)|(10<<16)|(15<<20))>;
+ 		};
+ 	};
+ 
+-	fragment@8 {
++	fragment@7 {
+ 		target = <&hdmi1>;
+ 		__overlay__ {
+ 			dmas = <&dma40 (13|(1<<30)|(1<<24)|(10<<16)|(15<<20))>;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0680-arm64-dts-broadcom-Add-dma-names-for-HDMI-audio-DMA.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0680-arm64-dts-broadcom-Add-dma-names-for-HDMI-audio-DMA.patch
new file mode 100644
index 00000000..3941448e
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0680-arm64-dts-broadcom-Add-dma-names-for-HDMI-audio-DMA.patch
@@ -0,0 +1,28 @@
+From 2cf6e8bec3e4f9ec5115276b78b8e1733fd7e39a Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 4 Dec 2024 18:02:25 +0000
+Subject: [PATCH 680/697] arm64: dts: broadcom: Add dma-names for HDMI audio
+ DMA
+
+The frameworks seem to want it now, so make it happy.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/bcm2712-rpi.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi.dtsi
+@@ -252,10 +252,12 @@ pciex4: &pcie2 { };
+ 
+ &hdmi0 {
+ 	dmas = <&dma40 (10|(1<<30)|(1<<24)|(10<<16)|(15<<20))>;
++	dma-names = "audio-rx";
+ };
+ 
+ &hdmi1 {
+ 	dmas = <&dma40 (17|(1<<30)|(1<<24)|(10<<16)|(15<<20))>;
++	dma-names = "audio-rx";
+ };
+ 
+ &spi10 {
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0681-raspberrypi-firmware-Add-the-RPI-firmware-UART-APIs.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0681-raspberrypi-firmware-Add-the-RPI-firmware-UART-APIs.patch
new file mode 100644
index 00000000..093e33f9
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0681-raspberrypi-firmware-Add-the-RPI-firmware-UART-APIs.patch
@@ -0,0 +1,23 @@
+From 9f98fed28d6be03a4d352afdf60883d286b5f820 Mon Sep 17 00:00:00 2001
+From: Tim Gover <tim.gover@raspberrypi.com>
+Date: Fri, 1 Nov 2024 19:42:17 +0000
+Subject: [PATCH 681/697] raspberrypi-firmware: Add the RPI firmware UART APIs
+
+Add VideoCore mailbox definitions for the new RPi firmware UART.
+
+Signed-off-by: Tim Gover <tim.gover@raspberrypi.com>
+---
+ include/soc/bcm2835/raspberrypi-firmware.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/include/soc/bcm2835/raspberrypi-firmware.h
++++ b/include/soc/bcm2835/raspberrypi-firmware.h
+@@ -98,6 +98,8 @@ enum rpi_firmware_property_tag {
+ 	RPI_FIRMWARE_GET_REBOOT_FLAGS =                       0x00030064,
+ 	RPI_FIRMWARE_SET_REBOOT_FLAGS =                       0x00038064,
+ 	RPI_FIRMWARE_NOTIFY_DISPLAY_DONE =                    0x00030066,
++	RPI_FIRMWARE_GET_SW_UART =                            0x0003008a,
++	RPI_FIRMWARE_SET_SW_UART =                            0x0003808a,
+ 
+ 	/* Dispmanx TAGS */
+ 	RPI_FIRMWARE_FRAMEBUFFER_ALLOCATE =                   0x00040001,
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0682-serial-core-Add-the-Raspberry-Pi-firmware-UART-id.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0682-serial-core-Add-the-Raspberry-Pi-firmware-UART-id.patch
new file mode 100644
index 00000000..64634689
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0682-serial-core-Add-the-Raspberry-Pi-firmware-UART-id.patch
@@ -0,0 +1,24 @@
+From 4775aa5cbd4c2dc3f307bfdef34efb1e878feed8 Mon Sep 17 00:00:00 2001
+From: Tim Gover <tim.gover@raspberrypi.com>
+Date: Fri, 1 Nov 2024 19:43:21 +0000
+Subject: [PATCH 682/697] serial: core: Add the Raspberry Pi firmware UART id
+
+Assign a new serial core number for the RPi firmware UART.
+
+Signed-off-by: Tim Gover <tim.gover@raspberrypi.com>
+---
+ include/uapi/linux/serial_core.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/include/uapi/linux/serial_core.h
++++ b/include/uapi/linux/serial_core.h
+@@ -231,6 +231,9 @@
+ /* Sunplus UART */
+ #define PORT_SUNPLUS	123
+ 
++/* RPi firmware UART */
++#define PORT_RPI_FW	124
++
+ /* Generic type identifier for ports which type is not important to userspace. */
+ #define PORT_GENERIC	(-1)
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0683-serial-tty-Add-a-driver-for-the-RPi-firmware-UART.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0683-serial-tty-Add-a-driver-for-the-RPi-firmware-UART.patch
new file mode 100644
index 00000000..3e988a02
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0683-serial-tty-Add-a-driver-for-the-RPi-firmware-UART.patch
@@ -0,0 +1,629 @@
+From be6e497d7d791ab390e72a5313fb0b219c96f2c1 Mon Sep 17 00:00:00 2001
+From: Tim Gover <tim.gover@raspberrypi.com>
+Date: Wed, 28 Aug 2024 09:46:50 +0100
+Subject: [PATCH 683/697] serial: tty: Add a driver for the RPi firmware UART
+
+On Raspberry Pi 4 and earlier models the firmware provides
+a low speed (up to 115200 baud) bit-bashed UART on arbitrary
+GPIOs using the second VPU core.
+
+The firmware driver is designed to support 19200 baud. Higher
+rates up to 115200 seem to work but there may be more jitter.
+
+This can be useful for debug or managing additional low
+speed peripherals if the hardware PL011 and 8250 hardware
+UARTs are already used for console / bluetooth.
+
+The firmware driver requires a fixed core clock frequency
+and also requires the VPU PWM audio driver to be disabled
+(dtparam=audio=off)
+
+Runtime configuration is handled via the vc-mailbox APIs
+with the FIFO buffers being allocated in uncached VPU
+addressable memory. The FIFO pointers are stored in spare
+VideoCore multi-core sync registers in order to reduce the number
+of uncached SDRAM accesses thereby reducing jitter.
+
+Signed-off-by: Tim Gover <tim.gover@raspberrypi.com>
+---
+ drivers/tty/serial/Kconfig       |  11 +
+ drivers/tty/serial/Makefile      |   1 +
+ drivers/tty/serial/rpi-fw-uart.c | 562 +++++++++++++++++++++++++++++++
+ 3 files changed, 574 insertions(+)
+ create mode 100644 drivers/tty/serial/rpi-fw-uart.c
+
+--- a/drivers/tty/serial/Kconfig
++++ b/drivers/tty/serial/Kconfig
+@@ -1600,6 +1600,17 @@ config SERIAL_ESP32_ACM
+ 	  snippet may be used:
+ 	    earlycon=esp32s3acm,mmio32,0x60038000
+ 
++config SERIAL_RPI_FW
++	tristate "Raspberry Pi Firmware software UART support"
++	depends on RASPBERRYPI_FIRMWARE || COMPILE_TEST
++	select SERIAL_CORE
++	help
++	  This selects the Raspberry Pi firmware UART. This is a bit-bashed
++	  implementation running on the Raspbery Pi VPU core.
++	  This is not supported on Raspberry Pi 5 or newer platforms.
++
++	  If unsure, say N.
++
+ endmenu
+ 
+ config SERIAL_MCTRL_GPIO
+--- a/drivers/tty/serial/Makefile
++++ b/drivers/tty/serial/Makefile
+@@ -71,6 +71,7 @@ obj-$(CONFIG_SERIAL_QCOM_GENI)		+= qcom_
+ obj-$(CONFIG_SERIAL_QE)			+= ucc_uart.o
+ obj-$(CONFIG_SERIAL_RDA)		+= rda-uart.o
+ obj-$(CONFIG_SERIAL_RP2)		+= rp2.o
++obj-$(CONFIG_SERIAL_RPI_FW) 		+= rpi-fw-uart.o
+ obj-$(CONFIG_SERIAL_SA1100)		+= sa1100.o
+ obj-$(CONFIG_SERIAL_SAMSUNG)		+= samsung_tty.o
+ obj-$(CONFIG_SERIAL_SB1250_DUART)	+= sb1250-duart.o
+--- /dev/null
++++ b/drivers/tty/serial/rpi-fw-uart.c
+@@ -0,0 +1,562 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (c) 2024, Raspberry Pi Ltd.  All rights reserved.
++ */
++
++#include <linux/console.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/gpio/consumer.h>
++#include <linux/platform_device.h>
++#include <linux/serial.h>
++#include <linux/serial_core.h>
++#include <linux/slab.h>
++#include <linux/tty.h>
++#include <linux/tty_flip.h>
++#include <soc/bcm2835/raspberrypi-firmware.h>
++#include <linux/dma-mapping.h>
++
++#define RPI_FW_UART_RX_FIFO_RD	0xb0
++#define RPI_FW_UART_RX_FIFO_WR	0xb4
++#define RPI_FW_UART_TX_FIFO_RD	0xb8
++#define RPI_FW_UART_TX_FIFO_WR	0xbc
++
++#define RPI_FW_UART_FIFO_SIZE		32
++#define RPI_FW_UART_FIFO_SIZE_MASK	(RPI_FW_UART_FIFO_SIZE - 1)
++
++#define RPI_FW_UART_MIN_VERSION	3
++
++struct rpi_fw_uart_params {
++	u32 start;
++	u32 baud;
++	u32 data_bits;
++	u32 stop_bits;
++	u32 gpio_rx;
++	u32 gpio_tx;
++	u32 flags;
++	u32 fifosize;
++	u32 rx_buffer;
++	u32 tx_buffer;
++	u32 version;
++	u32 fifo_reg_base;
++};
++
++struct rpi_fw_uart {
++	struct uart_driver	driver;
++	struct uart_port	port;
++	struct rpi_firmware	*firmware;
++	struct gpio_desc	*rx_gpiod;
++	struct gpio_desc	*tx_gpiod;
++	unsigned int		rx_gpio;
++	unsigned int		tx_gpio;
++	unsigned int		baud;
++	unsigned int		data_bits;
++	unsigned int		stop_bits;
++	unsigned char __iomem	*base;
++	size_t			dma_buffer_size;
++
++	struct hrtimer		trigger_start_rx;
++	ktime_t			rx_poll_delay;
++	void			*rx_buffer;
++	dma_addr_t		rx_buffer_dma_addr;
++	int			rx_stop;
++
++	void			*tx_buffer;
++	dma_addr_t		tx_buffer_dma_addr;
++};
++
++static unsigned int rpi_fw_uart_tx_is_full(struct uart_port *port)
++{
++	struct rpi_fw_uart *rfu = container_of(port, struct rpi_fw_uart, port);
++	u32 rd, wr;
++
++	rd = readl(rfu->base + RPI_FW_UART_TX_FIFO_RD);
++	wr = readl(rfu->base + RPI_FW_UART_TX_FIFO_WR);
++	return ((wr + 1) & RPI_FW_UART_FIFO_SIZE_MASK) == rd;
++}
++
++static unsigned int rpi_fw_uart_tx_is_empty(struct uart_port *port)
++{
++	struct rpi_fw_uart *rfu = container_of(port, struct rpi_fw_uart, port);
++	u32 rd, wr;
++
++	if (!rfu->tx_buffer)
++		return 1;
++
++	rd = readl(rfu->base + RPI_FW_UART_TX_FIFO_RD);
++	wr = readl(rfu->base + RPI_FW_UART_TX_FIFO_WR);
++
++	return rd == wr;
++}
++
++static unsigned int rpi_fw_uart_rx_is_empty(struct uart_port *port)
++{
++	struct rpi_fw_uart *rfu = container_of(port, struct rpi_fw_uart, port);
++	u32 rd, wr;
++
++	if (!rfu->rx_buffer)
++		return 1;
++
++	rd = readl(rfu->base + RPI_FW_UART_RX_FIFO_RD);
++	wr = readl(rfu->base + RPI_FW_UART_RX_FIFO_WR);
++
++	return rd == wr;
++}
++
++static unsigned int rpi_fw_uart_tx_empty(struct uart_port *port)
++{
++	return rpi_fw_uart_tx_is_empty(port) ? TIOCSER_TEMT : 0;
++}
++
++static void rpi_fw_uart_set_mctrl(struct uart_port *port, unsigned int mctrl)
++{
++	/*
++	 * No hardware flow control, firmware automatically configures
++	 * TX to output high and RX to input low.
++	 */
++	dev_dbg(port->dev, "%s mctrl %u\n", __func__, mctrl);
++}
++
++static unsigned int rpi_fw_uart_get_mctrl(struct uart_port *port)
++{
++	/* No hardware flow control */
++	return TIOCM_CTS;
++}
++
++static void rpi_fw_uart_stop(struct uart_port *port)
++{
++	struct rpi_fw_uart_params msg = {.start = 0};
++	struct rpi_fw_uart *rfu = container_of(port, struct rpi_fw_uart, port);
++
++	hrtimer_cancel(&rfu->trigger_start_rx);
++
++	if (rpi_firmware_property(rfu->firmware,
++				RPI_FIRMWARE_SET_SW_UART,
++				&msg, sizeof(msg)))
++		dev_warn(port->dev,
++			 "Failed to shutdown rpi-fw uart. Firmware not configured?");
++}
++
++static void rpi_fw_uart_stop_tx(struct uart_port *port)
++{
++	/* No supported by the current firmware APIs. */
++}
++
++static void rpi_fw_uart_stop_rx(struct uart_port *port)
++{
++	struct rpi_fw_uart *rfu = container_of(port, struct rpi_fw_uart, port);
++
++	rfu->rx_stop = 1;
++}
++
++static unsigned int rpi_fw_write(struct uart_port *port, const char *s,
++				unsigned int count)
++{
++	struct rpi_fw_uart *rfu = container_of(port, struct rpi_fw_uart, port);
++	u8 *out = rfu->tx_buffer;
++	unsigned int consumed = 0;
++
++	while (consumed < count && !rpi_fw_uart_tx_is_full(port)) {
++		u32 wp = readl(rfu->base + RPI_FW_UART_TX_FIFO_WR)
++			& RPI_FW_UART_FIFO_SIZE_MASK;
++		out[wp] = s[consumed++];
++		wp = (wp + 1) & RPI_FW_UART_FIFO_SIZE_MASK;
++		writel(wp, rfu->base + RPI_FW_UART_TX_FIFO_WR);
++	}
++	return consumed;
++}
++
++/* Called with port.lock taken */
++static void rpi_fw_uart_start_tx(struct uart_port *port)
++{
++	struct tty_port *tport = &port->state->port;
++
++	for (;;) {
++		unsigned int consumed;
++		unsigned char *tail;
++		unsigned int count;
++
++		count = kfifo_out_linear_ptr(&tport->xmit_fifo, &tail, port->fifosize);
++		if (!count)
++			break;
++
++		consumed = rpi_fw_write(port, tail, count);
++		uart_xmit_advance(port, consumed);
++	}
++	uart_write_wakeup(port);
++}
++
++/* Called with port.lock taken */
++static void rpi_fw_uart_start_rx(struct uart_port *port)
++{
++	struct tty_port *tty_port = &port->state->port;
++	struct rpi_fw_uart *rfu = container_of(port, struct rpi_fw_uart, port);
++	int count = 0;
++
++	/*
++	 * RX is polled, read up to a full buffer of data before trying again
++	 * so that this can be interrupted if the firmware is filling the
++	 * buffer too fast
++	 */
++	while (!rpi_fw_uart_rx_is_empty(port) && count < port->fifosize) {
++		const u8 *in = rfu->rx_buffer;
++		u32 rp = readl(rfu->base + RPI_FW_UART_RX_FIFO_RD)
++			& RPI_FW_UART_FIFO_SIZE_MASK;
++
++		tty_insert_flip_char(tty_port, in[rp], TTY_NORMAL);
++		rp = (rp + 1) & RPI_FW_UART_FIFO_SIZE_MASK;
++		writel(rp, rfu->base + RPI_FW_UART_RX_FIFO_RD);
++		count++;
++	}
++	if (count)
++		tty_flip_buffer_push(tty_port);
++}
++
++static enum hrtimer_restart rpi_fw_uart_trigger_rx(struct hrtimer *t)
++{
++	unsigned long flags;
++	struct rpi_fw_uart *rfu = container_of(t, struct rpi_fw_uart,
++					      trigger_start_rx);
++
++	spin_lock_irqsave(&rfu->port.lock, flags);
++	if (rfu->rx_stop) {
++		spin_unlock_irqrestore(&rfu->port.lock, flags);
++		return HRTIMER_NORESTART;
++	}
++
++	rpi_fw_uart_start_rx(&rfu->port);
++	spin_unlock_irqrestore(&rfu->port.lock, flags);
++	hrtimer_forward_now(t, rfu->rx_poll_delay);
++	return HRTIMER_RESTART;
++}
++
++static void rpi_fw_uart_break_ctl(struct uart_port *port, int ctl)
++{
++	dev_dbg(port->dev, "%s ctl %d\n", __func__, ctl);
++}
++
++static int rpi_fw_uart_configure(struct uart_port *port)
++{
++	struct rpi_fw_uart *rfu = container_of(port, struct rpi_fw_uart, port);
++	struct rpi_fw_uart_params msg;
++	unsigned long flags;
++	int rc;
++
++	rpi_fw_uart_stop(port);
++
++	memset(&msg, 0, sizeof(msg));
++	msg.start = 1;
++	msg.gpio_rx = rfu->rx_gpio;
++	msg.gpio_tx = rfu->tx_gpio;
++	msg.data_bits = rfu->data_bits;
++	msg.stop_bits = rfu->stop_bits;
++	msg.baud = rfu->baud;
++	msg.fifosize = RPI_FW_UART_FIFO_SIZE;
++	msg.rx_buffer = (u32) rfu->rx_buffer_dma_addr;
++	msg.tx_buffer = (u32) rfu->tx_buffer_dma_addr;
++
++	rfu->rx_poll_delay = ms_to_ktime(50);
++
++	/*
++	 * Reconfigures the firmware UART with the new settings. On the first
++	 * call retrieve the addresses of the FIFO buffers. The buffers are
++	 * allocated at startup and are not de-allocated.
++	 * NB rpi_firmware_property can block
++	 */
++	rc = rpi_firmware_property(rfu->firmware,
++				RPI_FIRMWARE_SET_SW_UART,
++				&msg, sizeof(msg));
++	if (rc)
++		goto fail;
++
++	rc = rpi_firmware_property(rfu->firmware,
++			RPI_FIRMWARE_GET_SW_UART,
++			&msg, sizeof(msg));
++	if (rc)
++		goto fail;
++
++	dev_dbg(port->dev, "version %08x, reg addr %x\n", msg.version,
++		msg.fifo_reg_base);
++
++	dev_info(port->dev, "started %d baud %u data %u stop %u rx %u tx %u flags %u fifosize %u\n",
++			msg.start, msg.baud, msg.data_bits, msg.stop_bits,
++			msg.gpio_rx, msg.gpio_tx, msg.flags, msg.fifosize);
++
++	if (msg.fifosize != port->fifosize) {
++		dev_err(port->dev, "Expected fifo size %u actual %u",
++				port->fifosize, msg.fifosize);
++		rc = -EINVAL;
++		goto fail;
++	}
++
++	if (!msg.start) {
++		dev_err(port->dev, "Firmware service not running\n");
++		rc = -EINVAL;
++	}
++
++	spin_lock_irqsave(&rfu->port.lock, flags);
++	rfu->rx_stop = 0;
++	hrtimer_start(&rfu->trigger_start_rx,
++		      rfu->rx_poll_delay, HRTIMER_MODE_REL);
++	spin_unlock_irqrestore(&rfu->port.lock, flags);
++	return 0;
++fail:
++	dev_err(port->dev, "Failed to configure rpi-fw uart. Firmware not configured?");
++	return rc;
++}
++
++static void rpi_fw_uart_free_buffers(struct uart_port *port)
++{
++	struct rpi_fw_uart *rfu = container_of(port, struct rpi_fw_uart, port);
++
++	if (rfu->rx_buffer)
++		dma_free_coherent(port->dev, rfu->dma_buffer_size,
++				rfu->rx_buffer, GFP_ATOMIC);
++
++	if (rfu->tx_buffer)
++		dma_free_coherent(port->dev, rfu->dma_buffer_size,
++				rfu->tx_buffer, GFP_ATOMIC);
++
++	rfu->rx_buffer = NULL;
++	rfu->tx_buffer = NULL;
++	rfu->rx_buffer_dma_addr = 0;
++	rfu->tx_buffer_dma_addr = 0;
++}
++
++static int rpi_fw_uart_alloc_buffers(struct uart_port *port)
++{
++	struct rpi_fw_uart *rfu = container_of(port, struct rpi_fw_uart, port);
++
++	if (rfu->tx_buffer)
++		return 0;
++
++	rfu->dma_buffer_size = PAGE_ALIGN(RPI_FW_UART_FIFO_SIZE);
++
++	rfu->rx_buffer = dma_alloc_coherent(port->dev, rfu->dma_buffer_size,
++		&rfu->rx_buffer_dma_addr, GFP_ATOMIC);
++
++	if (!rfu->rx_buffer)
++		goto alloc_fail;
++
++	rfu->tx_buffer = dma_alloc_coherent(port->dev, rfu->dma_buffer_size,
++		&rfu->tx_buffer_dma_addr, GFP_ATOMIC);
++
++	if (!rfu->tx_buffer)
++		goto alloc_fail;
++
++	dev_dbg(port->dev, "alloc-buffers %p %x %p %x\n",
++		rfu->rx_buffer, (u32) rfu->rx_buffer_dma_addr,
++		rfu->tx_buffer, (u32) rfu->tx_buffer_dma_addr);
++	return 0;
++
++alloc_fail:
++	dev_err(port->dev, "%s uart buffer allocation failed\n", __func__);
++	rpi_fw_uart_free_buffers(port);
++	return -ENOMEM;
++}
++
++static int rpi_fw_uart_startup(struct uart_port *port)
++{
++	int rc;
++
++	rc = rpi_fw_uart_alloc_buffers(port);
++	if (rc)
++		dev_err(port->dev, "Failed to start\n");
++	return rc;
++}
++
++static void rpi_fw_uart_shutdown(struct uart_port *port)
++{
++	rpi_fw_uart_stop(port);
++	rpi_fw_uart_free_buffers(port);
++}
++
++static void rpi_fw_uart_set_termios(struct uart_port *port,
++				       struct ktermios *new,
++				       const struct ktermios *old)
++{
++	struct rpi_fw_uart *rfu =
++		container_of(port, struct rpi_fw_uart, port);
++	rfu->baud = uart_get_baud_rate(port, new, old, 50, 115200);
++	rfu->stop_bits = (new->c_cflag & CSTOPB) ? 2 : 1;
++
++	rpi_fw_uart_configure(port);
++}
++
++static const struct uart_ops rpi_fw_uart_ops = {
++	.tx_empty = rpi_fw_uart_tx_empty,
++	.set_mctrl = rpi_fw_uart_set_mctrl,
++	.get_mctrl = rpi_fw_uart_get_mctrl,
++	.stop_rx = rpi_fw_uart_stop_rx,
++	.stop_tx = rpi_fw_uart_stop_tx,
++	.start_tx = rpi_fw_uart_start_tx,
++	.break_ctl = rpi_fw_uart_break_ctl,
++	.startup = rpi_fw_uart_startup,
++	.shutdown = rpi_fw_uart_shutdown,
++	.set_termios = rpi_fw_uart_set_termios,
++};
++
++static int rpi_fw_uart_get_gpio_offset(struct device *dev, const char *name)
++{
++	struct of_phandle_args of_args = { 0 };
++	bool is_bcm28xx;
++
++	/* This really shouldn't fail, given that we have a gpiod */
++	if (of_parse_phandle_with_args(dev->of_node, name, "#gpio-cells", 0, &of_args))
++		return dev_err_probe(dev, -EINVAL, "can't find gpio declaration\n");
++
++	is_bcm28xx = of_device_is_compatible(of_args.np, "brcm,bcm2835-gpio") ||
++		     of_device_is_compatible(of_args.np, "brcm,bcm2711-gpio");
++	of_node_put(of_args.np);
++	if (!is_bcm28xx || of_args.args_count != 2)
++		return dev_err_probe(dev, -EINVAL, "not a BCM28xx gpio\n");
++
++	return of_args.args[0];
++}
++
++static int rpi_fw_uart_probe(struct platform_device *pdev)
++{
++	struct device_node *firmware_node;
++	struct device *dev = &pdev->dev;
++	struct rpi_firmware *firmware;
++	struct uart_port *port;
++	struct rpi_fw_uart *rfu;
++	struct rpi_fw_uart_params msg;
++	int version_major;
++	int err;
++
++	dev_dbg(dev, "%s of_node %p\n", __func__, dev->of_node);
++
++	/*
++	 * We can be probed either through the an old-fashioned
++	 * platform device registration or through a DT node that is a
++	 * child of the firmware node. Handle both cases.
++	 */
++	if (dev->of_node)
++		firmware_node = of_parse_phandle(dev->of_node, "firmware", 0);
++	else
++		firmware_node = of_find_compatible_node(NULL, NULL,
++				"raspberrypi,bcm2835-firmware");
++	if (!firmware_node) {
++		dev_err(dev, "Missing firmware node\n");
++		return -ENOENT;
++	}
++
++	firmware = devm_rpi_firmware_get(dev, firmware_node);
++	of_node_put(firmware_node);
++	if (!firmware)
++		return -EPROBE_DEFER;
++
++	rfu = devm_kzalloc(dev, sizeof(*rfu), GFP_KERNEL);
++	if (!rfu)
++		return -ENOMEM;
++
++	rfu->firmware = firmware;
++
++	err = rpi_firmware_property(rfu->firmware, RPI_FIRMWARE_GET_SW_UART,
++			&msg, sizeof(msg));
++	if (err) {
++		dev_err(dev, "VC firmware does not support rpi-fw-uart\n");
++		return err;
++	}
++
++	version_major = msg.version >> 16;
++	if (msg.version < RPI_FW_UART_MIN_VERSION) {
++		dev_err(dev, "rpi-fw-uart fw version %d is too old min version %d\n",
++				version_major, RPI_FW_UART_MIN_VERSION);
++		return -EINVAL;
++	}
++
++	rfu->rx_gpiod = devm_gpiod_get(dev, "rx", GPIOD_IN);
++	if (IS_ERR(rfu->rx_gpiod))
++		return PTR_ERR(rfu->rx_gpiod);
++
++	rfu->tx_gpiod = devm_gpiod_get(dev, "tx", GPIOD_OUT_HIGH);
++	if (IS_ERR(rfu->tx_gpiod))
++		return PTR_ERR(rfu->tx_gpiod);
++
++	rfu->rx_gpio = rpi_fw_uart_get_gpio_offset(dev, "rx-gpios");
++	if (rfu->rx_gpio < 0)
++		return rfu->rx_gpio;
++	rfu->tx_gpio = rpi_fw_uart_get_gpio_offset(dev, "tx-gpios");
++	if (rfu->tx_gpio < 0)
++		return rfu->tx_gpio;
++
++	rfu->base = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(rfu->base))
++		return PTR_ERR(rfu->base);
++
++	/* setup the driver */
++	rfu->driver.owner = THIS_MODULE;
++	rfu->driver.driver_name = "ttyRFU";
++	rfu->driver.dev_name = "ttyRFU";
++	rfu->driver.nr = 1;
++	rfu->data_bits = 8;
++
++	/* RX is polled */
++	hrtimer_init(&rfu->trigger_start_rx, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
++	rfu->trigger_start_rx.function = rpi_fw_uart_trigger_rx;
++
++	err = uart_register_driver(&rfu->driver);
++	if (err) {
++		dev_err(dev, "failed to register UART driver: %d\n",
++			err);
++		return err;
++	}
++
++	/* setup the port */
++	port = &rfu->port;
++	spin_lock_init(&port->lock);
++	port->dev = &pdev->dev;
++	port->type = PORT_RPI_FW;
++	port->ops = &rpi_fw_uart_ops;
++	port->fifosize = RPI_FW_UART_FIFO_SIZE;
++	port->iotype = UPIO_MEM;
++	port->flags = UPF_BOOT_AUTOCONF;
++	port->private_data = rfu;
++
++	err = uart_add_one_port(&rfu->driver, port);
++	if (err) {
++		dev_err(dev, "failed to add UART port: %d\n", err);
++		goto unregister_uart;
++	}
++	platform_set_drvdata(pdev, rfu);
++
++	dev_info(dev, "version %d.%d gpios tx %u rx %u\n",
++			msg.version >> 16, msg.version & 0xffff,
++			rfu->tx_gpio, rfu->rx_gpio);
++	return 0;
++
++unregister_uart:
++	uart_unregister_driver(&rfu->driver);
++
++	return err;
++}
++
++static void rpi_fw_uart_remove(struct platform_device *pdev)
++{
++	struct rpi_fw_uart *rfu = platform_get_drvdata(pdev);
++
++	uart_remove_one_port(&rfu->driver, &rfu->port);
++	uart_unregister_driver(&rfu->driver);
++}
++
++static const struct of_device_id rpi_fw_match[] = {
++	{ .compatible = "raspberrypi,firmware-uart" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, rpi_fw_match);
++
++static struct platform_driver rpi_fw_driver = {
++	.driver = {
++		.name = "rpi_fw-uart",
++		.of_match_table = rpi_fw_match,
++	},
++	.probe = rpi_fw_uart_probe,
++	.remove = rpi_fw_uart_remove,
++};
++module_platform_driver(rpi_fw_driver);
++
++MODULE_AUTHOR("Tim Gover <tim.gover@rasberrypi.com>");
++MODULE_LICENSE("GPL");
++MODULE_DESCRIPTION("Raspberry Pi Firmware Software UART driver");
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0684-configs-Enable-the-RPi-FW-UART-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0684-configs-Enable-the-RPi-FW-UART-driver.patch
new file mode 100644
index 00000000..e69de29b
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0685-dtoverlay-Add-an-overlay-for-the-Raspberry-Pi-firmwa.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0685-dtoverlay-Add-an-overlay-for-the-Raspberry-Pi-firmwa.patch
new file mode 100644
index 00000000..8e339a5c
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0685-dtoverlay-Add-an-overlay-for-the-Raspberry-Pi-firmwa.patch
@@ -0,0 +1,96 @@
+From 4d9968cebc144140513fbff4b0daaa02a63a89e2 Mon Sep 17 00:00:00 2001
+From: Tim Gover <tim.gover@raspberrypi.com>
+Date: Mon, 4 Nov 2024 13:44:10 +0000
+Subject: [PATCH 685/697] dtoverlay: Add an overlay for the Raspberry Pi
+ firmware UART
+
+Add a device-tree overlay to configure the GPIOs for the
+Raspberry Pi firmware UART.
+
+Example config.txt
+dtoverlay=rpi-fw-uart,txd0_pin=20,rxd0_pin=21
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+Signed-off-by: Tim Gover <tim.gover@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/Makefile           |  1 +
+ arch/arm/boot/dts/overlays/README             | 12 ++++++
+ .../boot/dts/overlays/rpi-fw-uart-overlay.dts | 41 +++++++++++++++++++
+ 3 files changed, 54 insertions(+)
+ create mode 100644 arch/arm/boot/dts/overlays/rpi-fw-uart-overlay.dts
+
+--- a/arch/arm/boot/dts/overlays/Makefile
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -234,6 +234,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
+ 	rpi-dacpro.dtbo \
+ 	rpi-digiampplus.dtbo \
+ 	rpi-ft5406.dtbo \
++	rpi-fw-uart.dtbo \
+ 	rpi-poe.dtbo \
+ 	rpi-poe-plus.dtbo \
+ 	rpi-sense.dtbo \
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -4175,6 +4175,18 @@ Params: touchscreen-size-x      Touchscr
+         touchscreen-swapped-x-y Swap X and Y cordinates (default 0);
+ 
+ 
++Name:   rpi-fw-uart
++Info:   Configures the firmware software UART driver.
++        This driver requires exclusive usage of the second VPU core. The
++        following config.txt entries should be set when this driver is used.
++        dtparam=audio=off
++        isp_use_vpu0=1
++Load:   dtoverlay=rpi-fw-uart,<param>[=<val>]
++Params: txd0_pin                GPIO pin for TXD0 (any free - default 20)
++
++        rxd0_pin                GPIO pin for RXD0 (any free - default 21)
++
++
+ Name:   rpi-poe
+ Info:   Raspberry Pi PoE HAT fan
+ Load:   dtoverlay=rpi-poe,<param>[=<val>]
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rpi-fw-uart-overlay.dts
+@@ -0,0 +1,41 @@
++// SPDX-License-Identifier: GPL-2.0
++// Overlay for the Raspberry Pi Firmware UART driver
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			rpi_fw_uart_pins: rpi_fw_uart_pins@4 {
++				brcm,pins = <20 21>;
++				brcm,function = <1 0>; /* output input */
++				brcm,pull = <0 2>; /* none pull-up */
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&soc>;
++		__overlay__ {
++			rpi_fw_uart: rpi_fw_uart@7e000000 {
++			compatible = "raspberrypi,firmware-uart";
++			reg = <0x7e000000 0x100>; /* VideoCore MS sync regs */
++			firmware = <&firmware>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&rpi_fw_uart_pins>;
++			tx-gpios = <&gpio 20 0>;
++			rx-gpios = <&gpio 21 0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		txd0_pin = <&rpi_fw_uart>,"tx-gpios:4",
++			 <&rpi_fw_uart_pins>, "brcm,pins:0";
++		rxd0_pin = <&rpi_fw_uart>,"rx-gpios:4",
++			 <&rpi_fw_uart_pins>, "brcm,pins:4";
++	};
++};
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0686-ARM-dts-Remove-duplicate-tags.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0686-ARM-dts-Remove-duplicate-tags.patch
new file mode 100644
index 00000000..e666e871
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0686-ARM-dts-Remove-duplicate-tags.patch
@@ -0,0 +1,142 @@
+From ad7af05f9446b4e18970a885917f1b4d6d88c789 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 18 Sep 2024 10:23:41 +0100
+Subject: [PATCH 686/697] ARM: dts: Remove duplicate tags
+
+A dts file should have exactly one /dts-v1/ tag, and overlays should
+also have one /plugin/ tag. Through careless inclusion of other files,
+some Device Trees and overlays end up with duplicated tags - this
+commit removes them.
+
+The change is largely cosmetic, unless using an old version of dtc.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/broadcom/bcm2711-rpi-400.dts            | 1 -
+ arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi         | 3 ---
+ arch/arm/boot/dts/overlays/imx290_327-overlay.dtsi        | 2 --
+ arch/arm/boot/dts/overlays/pisound-pi5-overlay.dts        | 3 ---
+ arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts       | 3 ---
+ arch/arm/boot/dts/overlays/vc4-fkms-v3d-pi4-overlay.dts   | 3 ---
+ arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts        | 3 ---
+ arch/arm/boot/dts/overlays/vc4-kms-v3d-pi4-overlay.dts    | 3 ---
+ arch/arm/boot/dts/overlays/w1-gpio-pi5-overlay.dts        | 3 ---
+ arch/arm/boot/dts/overlays/w1-gpio-pullup-pi5-overlay.dts | 3 ---
+ arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5l.dtsi        | 1 -
+ 11 files changed, 28 deletions(-)
+
+--- a/arch/arm/boot/dts/broadcom/bcm2711-rpi-400.dts
++++ b/arch/arm/boot/dts/broadcom/bcm2711-rpi-400.dts
+@@ -1,5 +1,4 @@
+ // SPDX-License-Identifier: GPL-2.0
+-/dts-v1/;
+ #include "bcm2711-rpi-4-b.dts"
+ 
+ / {
+--- a/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
++++ b/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
+@@ -1,7 +1,4 @@
+ // Definitions for I2C based sensors using the Industrial IO or HWMON interface.
+-/dts-v1/;
+-/plugin/;
+-
+ #include <dt-bindings/gpio/gpio.h>
+ #include <dt-bindings/interrupt-controller/irq.h>
+ 
+--- a/arch/arm/boot/dts/overlays/imx290_327-overlay.dtsi
++++ b/arch/arm/boot/dts/overlays/imx290_327-overlay.dtsi
+@@ -1,8 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ // Partial definitions for IMX290 or IMX327 camera module on VC I2C bus
+ // The compatible string should be set in an overlay that then includes this one
+-/dts-v1/;
+-/plugin/;
+ 
+ #include <dt-bindings/gpio/gpio.h>
+ 
+--- a/arch/arm/boot/dts/overlays/pisound-pi5-overlay.dts
++++ b/arch/arm/boot/dts/overlays/pisound-pi5-overlay.dts
+@@ -17,9 +17,6 @@
+  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+  */
+ 
+-/dts-v1/;
+-/plugin/;
+-
+ #include "pisound-overlay.dts"
+ 
+ &pisound_spi {
+--- a/arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts
++++ b/arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts
+@@ -2,9 +2,6 @@
+  * vc4-fkms-v3d-overlay.dts
+  */
+ 
+-/dts-v1/;
+-/plugin/;
+-
+ #include "cma-overlay.dts"
+ 
+ / {
+--- a/arch/arm/boot/dts/overlays/vc4-fkms-v3d-pi4-overlay.dts
++++ b/arch/arm/boot/dts/overlays/vc4-fkms-v3d-pi4-overlay.dts
+@@ -2,9 +2,6 @@
+  * vc4-fkms-v3d-overlay.dts
+  */
+ 
+-/dts-v1/;
+-/plugin/;
+-
+ #include "cma-overlay.dts"
+ 
+ &frag0 {
+--- a/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
++++ b/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
+@@ -2,9 +2,6 @@
+  * vc4-kms-v3d-overlay.dts
+  */
+ 
+-/dts-v1/;
+-/plugin/;
+-
+ #include <dt-bindings/clock/bcm2835.h>
+ 
+ #include "cma-overlay.dts"
+--- a/arch/arm/boot/dts/overlays/vc4-kms-v3d-pi4-overlay.dts
++++ b/arch/arm/boot/dts/overlays/vc4-kms-v3d-pi4-overlay.dts
+@@ -2,9 +2,6 @@
+  * vc4-kms-v3d-pi4-overlay.dts
+  */
+ 
+-/dts-v1/;
+-/plugin/;
+-
+ #include <dt-bindings/clock/bcm2835.h>
+ 
+ #include "cma-overlay.dts"
+--- a/arch/arm/boot/dts/overlays/w1-gpio-pi5-overlay.dts
++++ b/arch/arm/boot/dts/overlays/w1-gpio-pi5-overlay.dts
+@@ -1,6 +1,3 @@
+-/dts-v1/;
+-/plugin/;
+-
+ #include "w1-gpio-overlay.dts"
+ 
+ / {
+--- a/arch/arm/boot/dts/overlays/w1-gpio-pullup-pi5-overlay.dts
++++ b/arch/arm/boot/dts/overlays/w1-gpio-pullup-pi5-overlay.dts
+@@ -1,6 +1,3 @@
+-/dts-v1/;
+-/plugin/;
+-
+ #include "w1-gpio-pullup-overlay.dts"
+ 
+ / {
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5l.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5l.dtsi
+@@ -1,5 +1,4 @@
+ // SPDX-License-Identifier: GPL-2.0
+-/dts-v1/;
+ 
+ #include "bcm2712-rpi-cm5.dtsi"
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0687-Allow-setting-I-C-clock-frequency-via-i2c_arm_baudra.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0687-Allow-setting-I-C-clock-frequency-via-i2c_arm_baudra.patch
new file mode 100644
index 00000000..e9455b25
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0687-Allow-setting-I-C-clock-frequency-via-i2c_arm_baudra.patch
@@ -0,0 +1,25 @@
+From b42f4b28a4f94bb942b3ee8a9b90c8bafb8297db Mon Sep 17 00:00:00 2001
+From: gtrainavicius <gtrainavicius@users.noreply.github.com>
+Date: Wed, 4 Dec 2024 11:18:14 +0200
+Subject: [PATCH 687/697] =?UTF-8?q?Allow=20setting=20I=C2=B2C=20clock=20fr?=
+ =?UTF-8?q?equency=20via=20i2c=5Farm=5Fbaudrate=20dtparam=20when=20using?=
+ =?UTF-8?q?=20pimidi=20overlay.?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This change removes the forced 1MHz clock frequency, so it can be overridden using `i2c_arm_baudrate`.
+---
+ arch/arm/boot/dts/overlays/pimidi-overlay.dts | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/arm/boot/dts/overlays/pimidi-overlay.dts
++++ b/arch/arm/boot/dts/overlays/pimidi-overlay.dts
+@@ -26,7 +26,6 @@
+ 		target = <&i2c_arm>;
+ 		__overlay__ {
+ 			status = "okay";
+-			clock-frequency=<1000000>;
+ 
+ 			pimidi_ctrl: pimidi_ctrl@20 {
+ 				compatible = "blokaslabs,pimidi";
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0688-nvme-pci-Disable-Host-Memory-Buffer-usage.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0688-nvme-pci-Disable-Host-Memory-Buffer-usage.patch
new file mode 100644
index 00000000..1e24e559
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0688-nvme-pci-Disable-Host-Memory-Buffer-usage.patch
@@ -0,0 +1,48 @@
+From 430482b7e65470bb0ecbe244de0fdbcf1d445925 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 3 Dec 2024 15:57:01 +0000
+Subject: [PATCH 688/697] nvme-pci: Disable Host Memory Buffer usage
+
+Some NVME drives seem to request significant amounts of DMA coherent
+memory - enough to exhaust our standard 64MB CMA allocation.
+
+Try disabling the feature to see what effect it has - drives should
+continue to function without it.
+
+Link: https://github.com/raspberrypi/linux/issues/6504
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/nvme/host/pci.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -1969,6 +1969,7 @@ static void nvme_free_host_mem(struct nv
+ 	dev->nr_host_mem_descs = 0;
+ }
+ 
++#if 0
+ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred,
+ 		u32 chunk_size)
+ {
+@@ -2037,9 +2038,11 @@ out:
+ 	dev->host_mem_descs = NULL;
+ 	return -ENOMEM;
+ }
++#endif
+ 
+ static int nvme_alloc_host_mem(struct nvme_dev *dev, u64 min, u64 preferred)
+ {
++#if 0
+ 	u64 min_chunk = min_t(u64, preferred, PAGE_SIZE * MAX_ORDER_NR_PAGES);
+ 	u64 hmminds = max_t(u32, dev->ctrl.hmminds * 4096, PAGE_SIZE * 2);
+ 	u64 chunk_size;
+@@ -2052,6 +2055,7 @@ static int nvme_alloc_host_mem(struct nv
+ 			nvme_free_host_mem(dev);
+ 		}
+ 	}
++#endif
+ 
+ 	return -ENOMEM;
+ }
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0689-serial-rpi-fw-uart-Demote-debug-log-messages.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0689-serial-rpi-fw-uart-Demote-debug-log-messages.patch
new file mode 100644
index 00000000..a5015bcd
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0689-serial-rpi-fw-uart-Demote-debug-log-messages.patch
@@ -0,0 +1,28 @@
+From edf60b037a9ac531cfeebb8a802fe06830118e55 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 5 Dec 2024 12:08:23 +0000
+Subject: [PATCH 689/697] serial: rpi-fw-uart: Demote debug log messages
+
+A dev_info call in rpi_fw_uart_configure causes kernel log output every
+time one opens the UART. Demote it to dev_dbg.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/tty/serial/rpi-fw-uart.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/tty/serial/rpi-fw-uart.c
++++ b/drivers/tty/serial/rpi-fw-uart.c
+@@ -278,9 +278,9 @@ static int rpi_fw_uart_configure(struct
+ 	dev_dbg(port->dev, "version %08x, reg addr %x\n", msg.version,
+ 		msg.fifo_reg_base);
+ 
+-	dev_info(port->dev, "started %d baud %u data %u stop %u rx %u tx %u flags %u fifosize %u\n",
+-			msg.start, msg.baud, msg.data_bits, msg.stop_bits,
+-			msg.gpio_rx, msg.gpio_tx, msg.flags, msg.fifosize);
++	dev_dbg(port->dev, "started %d baud %u data %u stop %u rx %u tx %u flags %u fifosize %u\n",
++		msg.start, msg.baud, msg.data_bits, msg.stop_bits,
++		msg.gpio_rx, msg.gpio_tx, msg.flags, msg.fifosize);
+ 
+ 	if (msg.fifosize != port->fifosize) {
+ 		dev_err(port->dev, "Expected fifo size %u actual %u",
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0690-dtoverlays-Add-Arducam-override-for-ov9281.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0690-dtoverlays-Add-Arducam-override-for-ov9281.patch
new file mode 100644
index 00000000..b41f28d2
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0690-dtoverlays-Add-Arducam-override-for-ov9281.patch
@@ -0,0 +1,54 @@
+From 55f4d9e9855e55fdf09ba3dc21827cdfda0b1323 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 2 Dec 2024 15:41:21 +0000
+Subject: [PATCH 690/697] dtoverlays: Add Arducam override for ov9281
+
+The Arducam module is slow starting up, so add an override
+to slow the regulator down.
+https://forums.raspberrypi.com/viewtopic.php?t=380236
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README             |  2 ++
+ arch/arm/boot/dts/overlays/ov9281-overlay.dts | 12 +++++++++++-
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -3570,6 +3570,8 @@ Params: rotation                Mounting
+                                 configuring the sensor (default on)
+         cam0                    Adopt the default configuration for CAM0 on a
+                                 Compute Module (CSI0, i2c_vc, and cam0_reg).
++        arducam                 Slow down the regulator for slow Arducam
++                                modules.
+ 
+ 
+ Name:   papirus
+--- a/arch/arm/boot/dts/overlays/ov9281-overlay.dts
++++ b/arch/arm/boot/dts/overlays/ov9281-overlay.dts
+@@ -63,6 +63,14 @@
+ 		};
+ 	};
+ 
++	reg_frag: fragment@6 {
++		target = <&cam1_reg>;
++		__dormant__ {
++			startup-delay-us = <20000>;
++			off-on-delay-us = <30000>;
++		};
++	};
++
+ 	__overrides__ {
+ 		rotation = <&cam_node>,"rotation:0";
+ 		orientation = <&cam_node>,"orientation:0";
+@@ -71,7 +79,9 @@
+ 		       <&csi_frag>, "target:0=",<&csi0>,
+ 		       <&clk_frag>, "target:0=",<&cam0_clk>,
+ 		       <&cam_node>, "clocks:0=",<&cam0_clk>,
+-		       <&cam_node>, "avdd-supply:0=",<&cam0_reg>;
++		       <&cam_node>, "avdd-supply:0=",<&cam0_reg>,
++		       <&reg_frag>, "target:0=",<&cam0_reg>;
++		arducam = <0>, "+6";
+ 	};
+ };
+ 
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0691-input-Add-support-for-no-irq-to-ili210x-driver.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0691-input-Add-support-for-no-irq-to-ili210x-driver.patch
new file mode 100644
index 00000000..b9c0876d
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0691-input-Add-support-for-no-irq-to-ili210x-driver.patch
@@ -0,0 +1,117 @@
+From 207121b9bdd57ad06096a09285594f6845c133dd Mon Sep 17 00:00:00 2001
+From: eng33 <eng33@waveshare.com>
+Date: Thu, 5 Dec 2024 17:19:23 +0800
+Subject: [PATCH 691/697] input: Add support for no irq to ili210x driver
+
+Signed-off-by: eng33 <eng33@waveshare.com>
+---
+ drivers/input/touchscreen/ili210x.c | 63 ++++++++++++++++++++++++-----
+ 1 file changed, 52 insertions(+), 11 deletions(-)
+
+--- a/drivers/input/touchscreen/ili210x.c
++++ b/drivers/input/touchscreen/ili210x.c
+@@ -67,6 +67,8 @@ struct ili210x {
+ 	u8 version_proto[2];
+ 	u8 ic_mode[2];
+ 	bool stop;
++	struct timer_list poll_timer;
++	struct work_struct poll_work;
+ };
+ 
+ static int ili210x_read_reg(struct i2c_client *client,
+@@ -360,6 +362,34 @@ static irqreturn_t ili210x_irq(int irq,
+ 	return IRQ_HANDLED;
+ }
+ 
++static void ili210x_poll_work(struct work_struct *work)
++{
++	struct ili210x *priv = container_of(work, struct ili210x, poll_work);
++	struct i2c_client *client = priv->client;
++	const struct ili2xxx_chip *chip = priv->chip;
++	u8 touchdata[ILI210X_DATA_SIZE] = { 0 };
++	bool touch;
++	int error;
++
++	error = chip->get_touch_data(client, touchdata);
++	if (error) {
++		dev_err(&client->dev, "Unable to get touch data: %d\n", error);
++		return;
++	}
++
++	touch = ili210x_report_events(priv, touchdata);
++}
++
++static void ili210x_poll_timer_callback(struct timer_list *t)
++{
++	struct ili210x *priv = from_timer(priv, t, poll_timer);
++
++	schedule_work(&priv->poll_work);
++
++	if (!priv->stop)
++		mod_timer(&priv->poll_timer, jiffies + msecs_to_jiffies(ILI2XXX_POLL_PERIOD));
++}
++
+ static int ili251x_firmware_update_resolution(struct device *dev)
+ {
+ 	struct i2c_client *client = to_i2c_client(dev);
+@@ -947,11 +977,6 @@ static int ili210x_i2c_probe(struct i2c_
+ 		return -ENODEV;
+ 	}
+ 
+-	if (client->irq <= 0) {
+-		dev_err(dev, "No IRQ!\n");
+-		return -EINVAL;
+-	}
+-
+ 	reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH);
+ 	if (IS_ERR(reset_gpio))
+ 		return PTR_ERR(reset_gpio);
+@@ -1003,12 +1028,17 @@ static int ili210x_i2c_probe(struct i2c_
+ 		return error;
+ 	}
+ 
+-	error = devm_request_threaded_irq(dev, client->irq, NULL, ili210x_irq,
+-					  IRQF_ONESHOT, client->name, priv);
+-	if (error) {
+-		dev_err(dev, "Unable to request touchscreen IRQ, err: %d\n",
+-			error);
+-		return error;
++	if (client->irq) {
++		error = devm_request_threaded_irq(dev, client->irq, NULL, ili210x_irq,
++					IRQF_ONESHOT, client->name, priv);
++		if (error) {
++			dev_err(dev, "Unable to request touchscreen IRQ, err: %d\n", error);
++			return error;
++		}
++	} else {
++		timer_setup(&priv->poll_timer, ili210x_poll_timer_callback, 0);
++		mod_timer(&priv->poll_timer, jiffies + msecs_to_jiffies(ILI2XXX_POLL_PERIOD));
++		INIT_WORK(&priv->poll_work, ili210x_poll_work);
+ 	}
+ 
+ 	error = devm_add_action_or_reset(dev, ili210x_stop, priv);
+@@ -1024,6 +1054,16 @@ static int ili210x_i2c_probe(struct i2c_
+ 	return 0;
+ }
+ 
++static void ili210x_i2c_remove(struct i2c_client *client)
++{
++	struct ili210x *tsdata = i2c_get_clientdata(client);
++
++	if (!client->irq) {
++		del_timer(&tsdata->poll_timer);
++		cancel_work_sync(&tsdata->poll_work);
++	}
++}
++
+ static const struct i2c_device_id ili210x_i2c_id[] = {
+ 	{ "ili210x", (long)&ili210x_chip },
+ 	{ "ili2117", (long)&ili211x_chip },
+@@ -1050,6 +1090,7 @@ static struct i2c_driver ili210x_ts_driv
+ 	},
+ 	.id_table = ili210x_i2c_id,
+ 	.probe = ili210x_i2c_probe,
++	.remove   = ili210x_i2c_remove,
+ };
+ 
+ module_i2c_driver(ili210x_ts_driver);
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0692-drm-panel-Added-waveshare-13.3inch-panel.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0692-drm-panel-Added-waveshare-13.3inch-panel.patch
new file mode 100644
index 00000000..52d380ec
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0692-drm-panel-Added-waveshare-13.3inch-panel.patch
@@ -0,0 +1,308 @@
+From d0e4040c8f0fcbed19e091d3a17f042ad431e0bc Mon Sep 17 00:00:00 2001
+From: eng33 <eng33@waveshare.com>
+Date: Thu, 5 Dec 2024 17:20:22 +0800
+Subject: [PATCH 692/697] drm: panel: Added waveshare 13.3inch panel
+
+Signed-off-by: eng33 <eng33@waveshare.com>
+---
+ drivers/gpu/drm/panel/panel-waveshare-dsi.c | 155 +++++++++++++++++---
+ 1 file changed, 138 insertions(+), 17 deletions(-)
+
+--- a/drivers/gpu/drm/panel/panel-waveshare-dsi.c
++++ b/drivers/gpu/drm/panel/panel-waveshare-dsi.c
+@@ -32,6 +32,12 @@ struct ws_panel {
+ 	enum drm_panel_orientation orientation;
+ };
+ 
++struct ws_panel_data {
++	const struct drm_display_mode *mode;
++	int lanes;
++	unsigned long mode_flags;
++};
++
+ /* 2.8inch 480x640
+  * https://www.waveshare.com/product/raspberry-pi/displays/2.8inch-dsi-lcd.htm
+  */
+@@ -47,6 +53,12 @@ static const struct drm_display_mode ws_
+ 	.vtotal = 640 + 150 + 50 + 150,
+ };
+ 
++static const struct ws_panel_data ws_panel_2_8_data = {
++	.mode = &ws_panel_2_8_mode,
++	.lanes = 2,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_HSE | MIPI_DSI_MODE_VIDEO | MIPI_DSI_CLOCK_NON_CONTINUOUS,
++};
++
+ /* 3.4inch 800x800 Round
+  * https://www.waveshare.com/product/displays/lcd-oled/3.4inch-dsi-lcd-c.htm
+  */
+@@ -62,6 +74,12 @@ static const struct drm_display_mode ws_
+ 	.vtotal = 800 + 8 + 4 + 16,
+ };
+ 
++static const struct ws_panel_data ws_panel_3_4_data = {
++	.mode = &ws_panel_3_4_mode,
++	.lanes = 2,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_HSE | MIPI_DSI_MODE_VIDEO | MIPI_DSI_CLOCK_NON_CONTINUOUS,
++};
++
+ /* 4.0inch 480x800
+  * https://www.waveshare.com/product/raspberry-pi/displays/4inch-dsi-lcd.htm
+  */
+@@ -77,6 +95,12 @@ static const struct drm_display_mode ws_
+ 	.vtotal = 800 + 20 + 100 + 20,
+ };
+ 
++static const struct ws_panel_data ws_panel_4_0_data = {
++	.mode = &ws_panel_4_0_mode,
++	.lanes = 2,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_HSE | MIPI_DSI_MODE_VIDEO | MIPI_DSI_CLOCK_NON_CONTINUOUS,
++};
++
+ /* 7.0inch C 1024x600
+  * https://www.waveshare.com/product/raspberry-pi/displays/lcd-oled/7inch-dsi-lcd-c-with-case-a.htm
+  */
+@@ -92,6 +116,12 @@ static const struct drm_display_mode ws_
+ 	.vtotal = 600 + 10 + 10 + 10,
+ };
+ 
++static const struct ws_panel_data ws_panel_7_0_c_data = {
++	.mode = &ws_panel_7_0_c_mode,
++	.lanes = 2,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_HSE | MIPI_DSI_MODE_VIDEO | MIPI_DSI_CLOCK_NON_CONTINUOUS,
++};
++
+ /* 7.9inch 400x1280
+  * https://www.waveshare.com/product/raspberry-pi/displays/7.9inch-dsi-lcd.htm
+  */
+@@ -107,6 +137,12 @@ static const struct drm_display_mode ws_
+ 	.vtotal = 1280 + 20 + 10 + 20,
+ };
+ 
++static const struct ws_panel_data ws_panel_7_9_data = {
++	.mode = &ws_panel_7_9_mode,
++	.lanes = 2,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_HSE | MIPI_DSI_MODE_VIDEO | MIPI_DSI_CLOCK_NON_CONTINUOUS,
++};
++
+ /* 8.0inch or 10.1inch 1280x800
+  * https://www.waveshare.com/product/raspberry-pi/displays/8inch-dsi-lcd-c.htm
+  * https://www.waveshare.com/product/raspberry-pi/displays/10.1inch-dsi-lcd-c.htm
+@@ -123,6 +159,12 @@ static const struct drm_display_mode ws_
+ 	.vtotal = 800 + 40 + 48 + 40,
+ };
+ 
++static const struct ws_panel_data ws_panel_10_1_data = {
++	.mode = &ws_panel_10_1_mode,
++	.lanes = 2,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_HSE | MIPI_DSI_MODE_VIDEO | MIPI_DSI_CLOCK_NON_CONTINUOUS,
++};
++
+ /* 11.9inch 320x1480
+  * https://www.waveshare.com/product/raspberry-pi/displays/11.9inch-dsi-lcd.htm
+  */
+@@ -138,6 +180,12 @@ static const struct drm_display_mode ws_
+ 	.vtotal = 1480 + 60 + 60 + 60,
+ };
+ 
++static const struct ws_panel_data ws_panel_11_9_data = {
++	.mode = &ws_panel_11_9_mode,
++	.lanes = 2,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_HSE | MIPI_DSI_MODE_VIDEO | MIPI_DSI_CLOCK_NON_CONTINUOUS,
++};
++
+ static const struct drm_display_mode ws_panel_4_mode = {
+ 	.clock = 50000,
+ 	.hdisplay = 720,
+@@ -150,6 +198,12 @@ static const struct drm_display_mode ws_
+ 	.vtotal = 720 + 8 + 4 + 16,
+ };
+ 
++static const struct ws_panel_data ws_panel_4_data = {
++	.mode = &ws_panel_4_mode,
++	.lanes = 2,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_HSE | MIPI_DSI_MODE_VIDEO | MIPI_DSI_CLOCK_NON_CONTINUOUS,
++};
++
+ /* 5.0inch 720x1280
+  * https://www.waveshare.com/5inch-dsi-lcd-d.htm
+  */
+@@ -165,6 +219,12 @@ static const struct drm_display_mode ws_
+ 	.vtotal = 1280 + 20 + 20 + 20,
+ };
+ 
++static const struct ws_panel_data ws_panel_5_0_data = {
++	.mode = &ws_panel_5_0_mode,
++	.lanes = 2,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_HSE | MIPI_DSI_MODE_VIDEO | MIPI_DSI_CLOCK_NON_CONTINUOUS,
++};
++
+ /* 6.25inch 720x1560
+  * https://www.waveshare.com/6.25inch-dsi-lcd.htm
+  */
+@@ -180,6 +240,12 @@ static const struct drm_display_mode ws_
+ 	.vtotal = 1560 + 20 + 20 + 20,
+ };
+ 
++static const struct ws_panel_data ws_panel_6_25_data = {
++	.mode = &ws_panel_6_25_mode,
++	.lanes = 2,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_HSE | MIPI_DSI_MODE_VIDEO | MIPI_DSI_CLOCK_NON_CONTINUOUS,
++};
++
+ /* 8.8inch 480x1920
+  * https://www.waveshare.com/8.8inch-dsi-lcd.htm
+  */
+@@ -195,6 +261,48 @@ static const struct drm_display_mode ws_
+ 	.vtotal = 1920 + 20 + 20 + 20,
+ };
+ 
++static const struct ws_panel_data ws_panel_8_8_data = {
++	.mode = &ws_panel_8_8_mode,
++	.lanes = 2,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_HSE | MIPI_DSI_MODE_VIDEO | MIPI_DSI_CLOCK_NON_CONTINUOUS,
++};
++
++static const struct drm_display_mode ws_panel_13_3_4lane_mode = {
++	.clock = 148500,
++	.hdisplay = 1920,
++	.hsync_start = 1920 + 88,
++	.hsync_end = 1920 + 88 + 44,
++	.htotal = 1920 + 88 + 44 + 148,
++	.vdisplay = 1080,
++	.vsync_start = 1080 + 4,
++	.vsync_end = 1080 + 4 + 5,
++	.vtotal = 1080 + 4 + 5 + 36,
++};
++
++static const struct ws_panel_data ws_panel_13_3_4lane_data = {
++	.mode = &ws_panel_13_3_4lane_mode,
++	.lanes = 4,
++	.mode_flags = MIPI_DSI_MODE_VIDEO  | MIPI_DSI_MODE_LPM,
++};
++
++static const struct drm_display_mode ws_panel_13_3_2lane_mode = {
++	.clock = 83333,
++	.hdisplay = 1920,
++	.hsync_start = 1920 + 88,
++	.hsync_end = 1920 + 88 + 44,
++	.htotal = 1920 + 88 + 44 + 148,
++	.vdisplay = 1080,
++	.vsync_start = 1080 + 4,
++	.vsync_end = 1080 + 4 + 5,
++	.vtotal = 1080 + 4 + 5 + 36,
++};
++
++static const struct ws_panel_data ws_panel_13_3_2lane_data = {
++	.mode = &ws_panel_13_3_2lane_mode,
++	.lanes = 2,
++	.mode_flags = MIPI_DSI_MODE_VIDEO  | MIPI_DSI_MODE_LPM,
++};
++
+ static struct ws_panel *panel_to_ts(struct drm_panel *panel)
+ {
+ 	return container_of(panel, struct ws_panel, base);
+@@ -232,7 +340,10 @@ static int ws_panel_enable(struct drm_pa
+ {
+ 	struct ws_panel *ts = panel_to_ts(panel);
+ 
+-	ws_panel_i2c_write(ts, 0xad, 0x01);
++	if (ts->mode == &ws_panel_13_3_2lane_mode)
++		ws_panel_i2c_write(ts, 0xad, 0x02);
++	else
++		ws_panel_i2c_write(ts, 0xad, 0x01);
+ 
+ 	return 0;
+ }
+@@ -328,13 +439,18 @@ static int ws_panel_probe(struct i2c_cli
+ 		.channel = 0,
+ 		.node = NULL,
+ 	};
++	const struct ws_panel_data *_ws_panel_data;
+ 	int ret;
+ 
+ 	ts = devm_kzalloc(dev, sizeof(*ts), GFP_KERNEL);
+ 	if (!ts)
+ 		return -ENOMEM;
+ 
+-	ts->mode = of_device_get_match_data(dev);
++	_ws_panel_data = of_device_get_match_data(dev);
++	if (!_ws_panel_data)
++		return -EINVAL;
++
++	ts->mode = _ws_panel_data->mode;
+ 	if (!ts->mode)
+ 		return -EINVAL;
+ 
+@@ -396,10 +512,9 @@ static int ws_panel_probe(struct i2c_cli
+ 	 */
+ 	drm_panel_add(&ts->base);
+ 
+-	ts->dsi->mode_flags =  MIPI_DSI_MODE_VIDEO_HSE | MIPI_DSI_MODE_VIDEO |
+-			   MIPI_DSI_CLOCK_NON_CONTINUOUS;
++	ts->dsi->mode_flags = _ws_panel_data->mode_flags;
+ 	ts->dsi->format = MIPI_DSI_FMT_RGB888;
+-	ts->dsi->lanes = 2;
++	ts->dsi->lanes = _ws_panel_data->lanes;
+ 
+ 	ret = devm_mipi_dsi_attach(dev, ts->dsi);
+ 
+@@ -432,40 +547,46 @@ static void ws_panel_shutdown(struct i2c
+ static const struct of_device_id ws_panel_of_ids[] = {
+ 	{
+ 		.compatible = "waveshare,2.8inch-panel",
+-		.data = &ws_panel_2_8_mode,
++		.data = &ws_panel_2_8_data,
+ 	}, {
+ 		.compatible = "waveshare,3.4inch-panel",
+-		.data = &ws_panel_3_4_mode,
++		.data = &ws_panel_3_4_data,
+ 	}, {
+ 		.compatible = "waveshare,4.0inch-panel",
+-		.data = &ws_panel_4_0_mode,
++		.data = &ws_panel_4_0_data,
+ 	}, {
+ 		.compatible = "waveshare,7.0inch-c-panel",
+-		.data = &ws_panel_7_0_c_mode,
++		.data = &ws_panel_7_0_c_data,
+ 	}, {
+ 		.compatible = "waveshare,7.9inch-panel",
+-		.data = &ws_panel_7_9_mode,
++		.data = &ws_panel_7_9_data,
+ 	}, {
+ 		.compatible = "waveshare,8.0inch-panel",
+-		.data = &ws_panel_10_1_mode,
++		.data = &ws_panel_10_1_data,
+ 	}, {
+ 		.compatible = "waveshare,10.1inch-panel",
+-		.data = &ws_panel_10_1_mode,
++		.data = &ws_panel_10_1_data,
+ 	}, {
+ 		.compatible = "waveshare,11.9inch-panel",
+-		.data = &ws_panel_11_9_mode,
++		.data = &ws_panel_11_9_data,
+ 	}, {
+ 		.compatible = "waveshare,4inch-panel",
+-		.data = &ws_panel_4_mode,
++		.data = &ws_panel_4_data,
+ 	}, {
+ 		.compatible = "waveshare,5.0inch-panel",
+-		.data = &ws_panel_5_0_mode,
++		.data = &ws_panel_5_0_data,
+ 	}, {
+ 		.compatible = "waveshare,6.25inch-panel",
+-		.data = &ws_panel_6_25_mode,
++		.data = &ws_panel_6_25_data,
+ 	}, {
+ 		.compatible = "waveshare,8.8inch-panel",
+-		.data = &ws_panel_8_8_mode,
++		.data = &ws_panel_8_8_data,
++	}, {
++		.compatible = "waveshare,13.3inch-4lane-panel",
++		.data = &ws_panel_13_3_4lane_data,
++	}, {
++		.compatible = "waveshare,13.3inch-2lane-panel",
++		.data = &ws_panel_13_3_2lane_data,
+ 	}, {
+ 		/* sentinel */
+ 	}
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0693-overlays-Added-waveshare-13.3inch-panel-support.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0693-overlays-Added-waveshare-13.3inch-panel-support.patch
new file mode 100644
index 00000000..a23c69c7
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0693-overlays-Added-waveshare-13.3inch-panel-support.patch
@@ -0,0 +1,45 @@
+From 09daedfa27b17fe577ee55ce9688e45d3ce7a6f8 Mon Sep 17 00:00:00 2001
+From: eng33 <eng33@waveshare.com>
+Date: Thu, 5 Dec 2024 18:11:26 +0800
+Subject: [PATCH 693/697] overlays: Added waveshare 13.3inch panel support
+
+Signed-off-by: eng33 <eng33@waveshare.com>
+---
+ arch/arm/boot/dts/overlays/README                          | 2 ++
+ .../dts/overlays/vc4-kms-dsi-waveshare-panel-overlay.dts   | 7 +++++++
+ 2 files changed, 9 insertions(+)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -5380,6 +5380,8 @@ Params: 2_8_inch                2.8" 480
+         8_0_inch                8.0" 1280x800
+         10_1_inch               10.1" 1280x800
+         11_9_inch               11.9" 320x1480
++        13_3_inch_4lane         13.3" 1920x1080 4lane
++        13_3_inch_2lane         13.3" 1920x1080 2lane
+         i2c1                    Use i2c-1 with jumper wires from GPIOs 2&3
+         disable_touch           Disable the touch controller
+         rotation                Set the panel orientation property
+--- a/arch/arm/boot/dts/overlays/vc4-kms-dsi-waveshare-panel-overlay.dts
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dsi-waveshare-panel-overlay.dts
+@@ -51,6 +51,11 @@
+ 				reg = <0x14>;
+ 				compatible = "goodix,gt911";
+ 			};
++
++			touch2: ilitek@41 {
++				compatible = "ilitek,ili251x";
++				reg = <0x41>;
++			};
+ 		};
+ 	};
+ 
+@@ -120,6 +125,8 @@
+ 				   <&touch>, "touchscreen-inverted-x?",
+ 				   <&touch>, "touchscreen-inverted-y?";
+ 		8_8_inch = <&panel>, "compatible=waveshare,8.8inch-panel";
++		13_3_inch_4lane = <&panel>, "compatible=waveshare,13.3inch-4lane-panel";
++		13_3_inch_2lane = <&panel>, "compatible=waveshare,13.3inch-2lane-panel";
+ 		i2c1 = <&i2c_frag>, "target:0=",<&i2c1>,
+ 		       <0>, "-3-4+5";
+ 		disable_touch = <&touch>, "status=disabled";
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0694-dts-bcm2712-ds-Dedup-as-upstream-support-expands.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0694-dts-bcm2712-ds-Dedup-as-upstream-support-expands.patch
new file mode 100644
index 00000000..be4af167
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0694-dts-bcm2712-ds-Dedup-as-upstream-support-expands.patch
@@ -0,0 +1,732 @@
+From 006a12c20c6f1bd94734935bd3f4edfedb83715c Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 9 Dec 2024 12:03:17 +0000
+Subject: [PATCH 694/697] dts: bcm2712-ds: Dedup as upstream support expands
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/bcm2712-ds.dtsi | 667 +++++++++----------
+ 1 file changed, 314 insertions(+), 353 deletions(-)
+
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-ds.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-ds.dtsi
+@@ -188,22 +188,6 @@
+ 		};
+ 	};
+ 
+-	bsc_irq: intc@7d508380 {
+-		compatible = "brcm,bcm7271-l2-intc";
+-		reg = <0x7d508380 0x10>;
+-		interrupts = <GIC_SPI 242 IRQ_TYPE_LEVEL_HIGH>;
+-		interrupt-controller;
+-		#interrupt-cells = <1>;
+-	};
+-
+-	main_irq: intc@7d508400 {
+-		compatible = "brcm,bcm7271-l2-intc";
+-		reg = <0x7d508400 0x10>;
+-		interrupts = <GIC_SPI 244 IRQ_TYPE_LEVEL_HIGH>;
+-		interrupt-controller;
+-		#interrupt-cells = <1>;
+-	};
+-
+ 	gio: gpio@7d508500 {
+ 		compatible = "brcm,brcmstb-gpio";
+ 		reg = <0x7d508500 0x40>;
+@@ -228,15 +212,6 @@
+ 		status = "disabled";
+ 	};
+ 
+-	aon_intr: interrupt-controller@7d510600 {
+-		compatible = "brcm,bcm2711-l2-intc", "brcm,l2-intc";
+-		reg = <0x7d510600 0x30>;
+-		interrupts = <GIC_SPI 239 IRQ_TYPE_LEVEL_HIGH>;
+-		interrupt-controller;
+-		#interrupt-cells = <1>;
+-		status = "disabled";
+-	};
+-
+ 	pinctrl_aon: pinctrl@7d510700 {
+ 		compatible = "brcm,bcm2712-aon-pinctrl";
+ 		reg = <0x7d510700 0x20>;
+@@ -304,358 +279,344 @@
+ 	};
+ };
+ 
+-/ {
+-	axi: axi {
+-		compatible = "simple-bus";
+-		#address-cells = <2>;
++&axi {
++	iommu2: iommu@5100 {
++		/* IOMMU2 for PISP-BE, HEVC; and (unused) H264 accelerators */
++		compatible = "brcm,bcm2712-iommu";
++		reg = <0x10 0x5100  0x0 0x80>;
++		cache = <&iommuc>;
++		#iommu-cells = <0>;
++	};
++
++	iommu4: iommu@5200 {
++		/* IOMMU4 for HVS, MPL/TXP; and (unused) Unicam, PISP-FE, MiniBVN */
++		compatible = "brcm,bcm2712-iommu";
++		reg = <0x10 0x5200  0x0 0x80>;
++		cache = <&iommuc>;
++		#iommu-cells = <0>;
++		#interconnect-cells = <0>;
++	};
++
++	iommu5: iommu@5280 {
++		/* IOMMU5 for PCIe2 (RP1); and (unused) BSTM */
++		compatible = "brcm,bcm2712-iommu";
++		reg = <0x10 0x5280  0x0 0x80>;
++		cache = <&iommuc>;
++		#iommu-cells = <0>;
++		dma-iova-offset = <0x10 0x00000000>; // HACK for RP1 masters over PCIe
++	};
++
++	iommuc: iommuc@5b00 {
++		compatible = "brcm,bcm2712-iommuc";
++		reg = <0x10 0x5b00  0x0 0x80>;
++	};
++
++	dma32: dma@10000 {
++		compatible = "brcm,bcm2712-dma";
++		reg = <0x10 0x00010000 0 0x600>;
++		interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>,
++					<GIC_SPI 81 IRQ_TYPE_LEVEL_HIGH>,
++					<GIC_SPI 82 IRQ_TYPE_LEVEL_HIGH>,
++					<GIC_SPI 83 IRQ_TYPE_LEVEL_HIGH>,
++					<GIC_SPI 84 IRQ_TYPE_LEVEL_HIGH>,
++					<GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
++		interrupt-names = "dma0",
++					"dma1",
++					"dma2",
++					"dma3",
++					"dma4",
++					"dma5";
++		#dma-cells = <1>;
++		brcm,dma-channel-mask = <0x0035>;
++	};
++
++	dma40: dma@10600 {
++		compatible = "brcm,bcm2712-dma";
++		reg = <0x10 0x00010600 0 0x600>;
++		interrupts =
++			<GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>, /* dma4 6 */
++			<GIC_SPI 87 IRQ_TYPE_LEVEL_HIGH>, /* dma4 7 */
++			<GIC_SPI 88 IRQ_TYPE_LEVEL_HIGH>, /* dma4 8 */
++			<GIC_SPI 89 IRQ_TYPE_LEVEL_HIGH>, /* dma4 9 */
++			<GIC_SPI 90 IRQ_TYPE_LEVEL_HIGH>, /* dma4 10 */
++			<GIC_SPI 91 IRQ_TYPE_LEVEL_HIGH>; /* dma4 11 */
++		interrupt-names = "dma6",
++					"dma7",
++					"dma8",
++					"dma9",
++					"dma10",
++					"dma11";
++		#dma-cells = <1>;
++		brcm,dma-channel-mask = <0x0fc0>;
++	};
++
++	// Single-lane Gen3 PCIe
++	// Outbound window at 0x14_000000-0x17_ffffff
++	pcie0: pcie@100000 {
++		compatible = "brcm,bcm2712-pcie";
++		reg = <0x10 0x00100000  0x0 0x9310>;
++		device_type = "pci";
++		max-link-speed = <2>;
++		#address-cells = <3>;
++		#interrupt-cells = <1>;
+ 		#size-cells = <2>;
++		/*
++			* Unused interrupts:
++			* 208: AER
++			* 215: NMI
++			* 216: PME
++			*/
++		interrupt-parent = <&gicv2>;
++		interrupts = <GIC_SPI 213 IRQ_TYPE_LEVEL_HIGH>,
++					<GIC_SPI 214 IRQ_TYPE_LEVEL_HIGH>;
++		interrupt-names = "pcie", "msi";
++		interrupt-map-mask = <0x0 0x0 0x0 0x7>;
++		interrupt-map = <0 0 0 1 &gicv2 GIC_SPI 209
++						IRQ_TYPE_LEVEL_HIGH>,
++				<0 0 0 2 &gicv2 GIC_SPI 210
++						IRQ_TYPE_LEVEL_HIGH>,
++				<0 0 0 3 &gicv2 GIC_SPI 211
++						IRQ_TYPE_LEVEL_HIGH>,
++				<0 0 0 4 &gicv2 GIC_SPI 212
++						IRQ_TYPE_LEVEL_HIGH>;
++		resets = <&bcm_reset 5>, <&bcm_reset 42>, <&pcie_rescal>;
++		reset-names = "swinit", "bridge", "rescal";
++		msi-controller;
++		msi-parent = <&pcie0>;
++
++		ranges = <0x02000000 0x00 0x00000000
++				0x17 0x00000000
++				0x0 0xfffffffc>,
++				<0x43000000 0x04 0x00000000
++				0x14 0x00000000
++				0x3 0x00000000>;
++
++		dma-ranges = <0x43000000 0x10 0x00000000
++					0x00 0x00000000
++					0x10 0x00000000>;
+ 
+-		ranges = <0x00 0x00000000  0x00 0x00000000  0x10 0x00000000>,
+-			 <0x10 0x00000000  0x10 0x00000000  0x01 0x00000000>,
+-			 <0x14 0x00000000  0x14 0x00000000  0x04 0x00000000>,
+-			 <0x18 0x00000000  0x18 0x00000000  0x04 0x00000000>,
+-			 <0x1c 0x00000000  0x1c 0x00000000  0x04 0x00000000>;
+-
+-		dma-ranges = <0x00 0x00000000  0x00 0x00000000  0x10 0x00000000>,
+-			     <0x10 0x00000000  0x10 0x00000000  0x01 0x00000000>,
+-			     <0x14 0x00000000  0x14 0x00000000  0x04 0x00000000>,
+-			     <0x18 0x00000000  0x18 0x00000000  0x04 0x00000000>,
+-			     <0x1c 0x00000000  0x1c 0x00000000  0x04 0x00000000>;
+-
+-		iommu2: iommu@5100 {
+-			/* IOMMU2 for PISP-BE, HEVC; and (unused) H264 accelerators */
+-			compatible = "brcm,bcm2712-iommu";
+-			reg = <0x10 0x5100  0x0 0x80>;
+-			cache = <&iommuc>;
+-			#iommu-cells = <0>;
+-		};
+-
+-		iommu4: iommu@5200 {
+-			/* IOMMU4 for HVS, MPL/TXP; and (unused) Unicam, PISP-FE, MiniBVN */
+-			compatible = "brcm,bcm2712-iommu";
+-			reg = <0x10 0x5200  0x0 0x80>;
+-			cache = <&iommuc>;
+-			#iommu-cells = <0>;
+-			#interconnect-cells = <0>;
+-		};
+-
+-		iommu5: iommu@5280 {
+-			/* IOMMU5 for PCIe2 (RP1); and (unused) BSTM */
+-			compatible = "brcm,bcm2712-iommu";
+-			reg = <0x10 0x5280  0x0 0x80>;
+-			cache = <&iommuc>;
+-			#iommu-cells = <0>;
+-			dma-iova-offset = <0x10 0x00000000>; // HACK for RP1 masters over PCIe
+-		};
+-
+-		iommuc: iommuc@5b00 {
+-			compatible = "brcm,bcm2712-iommuc";
+-			reg = <0x10 0x5b00  0x0 0x80>;
+-		};
+-
+-		dma32: dma@10000 {
+-			compatible = "brcm,bcm2712-dma";
+-			reg = <0x10 0x00010000 0 0x600>;
+-			interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>,
+-				     <GIC_SPI 81 IRQ_TYPE_LEVEL_HIGH>,
+-				     <GIC_SPI 82 IRQ_TYPE_LEVEL_HIGH>,
+-				     <GIC_SPI 83 IRQ_TYPE_LEVEL_HIGH>,
+-				     <GIC_SPI 84 IRQ_TYPE_LEVEL_HIGH>,
+-				     <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
+-			interrupt-names = "dma0",
+-					  "dma1",
+-					  "dma2",
+-					  "dma3",
+-					  "dma4",
+-					  "dma5";
+-			#dma-cells = <1>;
+-			brcm,dma-channel-mask = <0x0035>;
+-		};
+-
+-		dma40: dma@10600 {
+-			compatible = "brcm,bcm2712-dma";
+-			reg = <0x10 0x00010600 0 0x600>;
+-			interrupts =
+-				<GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>, /* dma4 6 */
+-				<GIC_SPI 87 IRQ_TYPE_LEVEL_HIGH>, /* dma4 7 */
+-				<GIC_SPI 88 IRQ_TYPE_LEVEL_HIGH>, /* dma4 8 */
+-				<GIC_SPI 89 IRQ_TYPE_LEVEL_HIGH>, /* dma4 9 */
+-				<GIC_SPI 90 IRQ_TYPE_LEVEL_HIGH>, /* dma4 10 */
+-				<GIC_SPI 91 IRQ_TYPE_LEVEL_HIGH>; /* dma4 11 */
+-			interrupt-names = "dma6",
+-					  "dma7",
+-					  "dma8",
+-					  "dma9",
+-					  "dma10",
+-					  "dma11";
+-			#dma-cells = <1>;
+-			brcm,dma-channel-mask = <0x0fc0>;
+-		};
+-
+-		// Single-lane Gen3 PCIe
+-		// Outbound window at 0x14_000000-0x17_ffffff
+-		pcie0: pcie@100000 {
+-			compatible = "brcm,bcm2712-pcie";
+-			reg = <0x10 0x00100000  0x0 0x9310>;
+-			device_type = "pci";
+-			max-link-speed = <2>;
+-			#address-cells = <3>;
+-			#interrupt-cells = <1>;
+-			#size-cells = <2>;
+-			/*
+-			 * Unused interrupts:
+-			 * 208: AER
+-			 * 215: NMI
+-			 * 216: PME
+-			 */
+-			interrupt-parent = <&gicv2>;
+-			interrupts = <GIC_SPI 213 IRQ_TYPE_LEVEL_HIGH>,
+-				     <GIC_SPI 214 IRQ_TYPE_LEVEL_HIGH>;
+-			interrupt-names = "pcie", "msi";
+-			interrupt-map-mask = <0x0 0x0 0x0 0x7>;
+-			interrupt-map = <0 0 0 1 &gicv2 GIC_SPI 209
+-							IRQ_TYPE_LEVEL_HIGH>,
+-					<0 0 0 2 &gicv2 GIC_SPI 210
+-							IRQ_TYPE_LEVEL_HIGH>,
+-					<0 0 0 3 &gicv2 GIC_SPI 211
+-							IRQ_TYPE_LEVEL_HIGH>,
+-					<0 0 0 4 &gicv2 GIC_SPI 212
+-							IRQ_TYPE_LEVEL_HIGH>;
+-			resets = <&bcm_reset 5>, <&bcm_reset 42>, <&pcie_rescal>;
+-			reset-names = "swinit", "bridge", "rescal";
+-			msi-controller;
+-			msi-parent = <&pcie0>;
+-
+-			ranges = <0x02000000 0x00 0x00000000
+-				  0x17 0x00000000
+-				  0x0 0xfffffffc>,
+-				 <0x43000000 0x04 0x00000000
+-				  0x14 0x00000000
+-				  0x3 0x00000000>;
+-
+-			dma-ranges = <0x43000000 0x10 0x00000000
+-				      0x00 0x00000000
+-				      0x10 0x00000000>;
+-
+-			status = "disabled";
+-		};
+-
+-		// Single-lane Gen3 PCIe
+-		// Outbound window at 0x18_000000-0x1b_ffffff
+-		pcie1: pcie@110000 {
+-			compatible = "brcm,bcm2712-pcie";
+-			reg = <0x10 0x00110000  0x0 0x9310>;
+-			device_type = "pci";
+-			max-link-speed = <2>;
+-			#address-cells = <3>;
+-			#interrupt-cells = <1>;
+-			#size-cells = <2>;
+-			/*
+-			 * Unused interrupts:
+-			 * 218: AER
+-			 * 225: NMI
+-			 * 226: PME
+-			 */
+-			interrupt-parent = <&gicv2>;
+-			interrupts = <GIC_SPI 223 IRQ_TYPE_LEVEL_HIGH>,
+-				     <GIC_SPI 224 IRQ_TYPE_LEVEL_HIGH>;
+-			interrupt-names = "pcie", "msi";
+-			interrupt-map-mask = <0x0 0x0 0x0 0x7>;
+-			interrupt-map = <0 0 0 1 &gicv2 GIC_SPI 219
+-							IRQ_TYPE_LEVEL_HIGH>,
+-					<0 0 0 2 &gicv2 GIC_SPI 220
+-							IRQ_TYPE_LEVEL_HIGH>,
+-					<0 0 0 3 &gicv2 GIC_SPI 221
+-							IRQ_TYPE_LEVEL_HIGH>,
+-					<0 0 0 4 &gicv2 GIC_SPI 222
+-							IRQ_TYPE_LEVEL_HIGH>;
+-			resets = <&bcm_reset 7>, <&bcm_reset 43>, <&pcie_rescal>;
+-			reset-names = "swinit", "bridge", "rescal";
+-			msi-controller;
+-			msi-parent = <&mip1>;
+-
+-			// 2GB, 32-bit, non-prefetchable at PCIe 00_80000000
+-			ranges = <0x02000000 0x00 0x80000000
+-				  0x1b 0x80000000
+-				  0x00 0x80000000>,
+-			// 14GB, 64-bit, prefetchable at PCIe 04_00000000
+-				 <0x43000000 0x04 0x00000000
+-				  0x18 0x00000000
+-				  0x03 0x80000000>;
+-
+-			dma-ranges = <0x03000000 0x10 0x00000000
+-				      0x00 0x00000000
+-				      0x10 0x00000000>;
+-
+-			status = "disabled";
+-		};
+-
+-		pcie_rescal: reset-controller@119500 {
+-			compatible = "brcm,bcm7216-pcie-sata-rescal";
+-			reg = <0x10 0x00119500  0x0 0x10>;
+-			#reset-cells = <0>;
+-		};
++		status = "disabled";
++	};
+ 
+-		// Quad-lane Gen3 PCIe
+-		// Outbound window at 0x1c_000000-0x1f_ffffff
+-		pcie2: pcie@120000 {
+-			compatible = "brcm,bcm2712-pcie";
+-			reg = <0x10 0x00120000  0x0 0x9310>;
+-			device_type = "pci";
+-			max-link-speed = <2>;
+-			#address-cells = <3>;
+-			#interrupt-cells = <1>;
+-			#size-cells = <2>;
+-			/*
+-			 * Unused interrupts:
+-			 * 228: AER
+-			 * 235: NMI
+-			 * 236: PME
+-			 */
+-			interrupt-parent = <&gicv2>;
+-			interrupts = <GIC_SPI 233 IRQ_TYPE_LEVEL_HIGH>,
+-				     <GIC_SPI 234 IRQ_TYPE_LEVEL_HIGH>;
+-			interrupt-names = "pcie", "msi";
+-			interrupt-map-mask = <0x0 0x0 0x0 0x7>;
+-			interrupt-map = <0 0 0 1 &gicv2 GIC_SPI 229
+-							IRQ_TYPE_LEVEL_HIGH>,
+-					<0 0 0 2 &gicv2 GIC_SPI 230
+-							IRQ_TYPE_LEVEL_HIGH>,
+-					<0 0 0 3 &gicv2 GIC_SPI 231
+-							IRQ_TYPE_LEVEL_HIGH>,
+-					<0 0 0 4 &gicv2 GIC_SPI 232
+-							IRQ_TYPE_LEVEL_HIGH>;
+-			resets = <&bcm_reset 32>, <&bcm_reset 44>, <&pcie_rescal>;
+-			reset-names = "swinit", "bridge", "rescal";
+-			msi-controller;
+-			msi-parent = <&mip0>;
+-
+-			// ~4GB, 32-bit, not-prefetchable at PCIe 00_00000000
+-			ranges = <0x02000000 0x00 0x00000000
+-				  0x1f 0x00000000
+-				  0x0 0xfffffffc>,
+-			// 12GB, 64-bit, prefetchable at PCIe 04_00000000
+-				 <0x43000000 0x04 0x00000000
+-				  0x1c 0x00000000
+-				  0x03 0x00000000>;
+-
+-			// 64GB system RAM space at PCIe 10_00000000
+-			dma-ranges = <0x02000000 0x00 0x00000000
+-				      0x1f 0x00000000
+-				      0x00 0x00400000>,
+-				     <0x43000000 0x10 0x00000000
+-				      0x00 0x00000000
+-				      0x10 0x00000000>;
++	// Single-lane Gen3 PCIe
++	// Outbound window at 0x18_000000-0x1b_ffffff
++	pcie1: pcie@110000 {
++		compatible = "brcm,bcm2712-pcie";
++		reg = <0x10 0x00110000  0x0 0x9310>;
++		device_type = "pci";
++		max-link-speed = <2>;
++		#address-cells = <3>;
++		#interrupt-cells = <1>;
++		#size-cells = <2>;
++		/*
++			* Unused interrupts:
++			* 218: AER
++			* 225: NMI
++			* 226: PME
++			*/
++		interrupt-parent = <&gicv2>;
++		interrupts = <GIC_SPI 223 IRQ_TYPE_LEVEL_HIGH>,
++					<GIC_SPI 224 IRQ_TYPE_LEVEL_HIGH>;
++		interrupt-names = "pcie", "msi";
++		interrupt-map-mask = <0x0 0x0 0x0 0x7>;
++		interrupt-map = <0 0 0 1 &gicv2 GIC_SPI 219
++						IRQ_TYPE_LEVEL_HIGH>,
++				<0 0 0 2 &gicv2 GIC_SPI 220
++						IRQ_TYPE_LEVEL_HIGH>,
++				<0 0 0 3 &gicv2 GIC_SPI 221
++						IRQ_TYPE_LEVEL_HIGH>,
++				<0 0 0 4 &gicv2 GIC_SPI 222
++						IRQ_TYPE_LEVEL_HIGH>;
++		resets = <&bcm_reset 7>, <&bcm_reset 43>, <&pcie_rescal>;
++		reset-names = "swinit", "bridge", "rescal";
++		msi-controller;
++		msi-parent = <&mip1>;
++
++		// 2GB, 32-bit, non-prefetchable at PCIe 00_80000000
++		ranges = <0x02000000 0x00 0x80000000
++				0x1b 0x80000000
++				0x00 0x80000000>,
++		// 14GB, 64-bit, prefetchable at PCIe 04_00000000
++				<0x43000000 0x04 0x00000000
++				0x18 0x00000000
++				0x03 0x80000000>;
++
++		dma-ranges = <0x03000000 0x10 0x00000000
++					0x00 0x00000000
++					0x10 0x00000000>;
+ 
+-			status = "disabled";
+-		};
++		status = "disabled";
++	};
+ 
+-		mip0: msi-controller@130000 {
+-			compatible = "brcm,bcm2712-mip-intc";
+-			reg = <0x10 0x00130000  0x0 0xc0>;
+-			msi-controller;
+-			interrupt-controller;
+-			#interrupt-cells = <2>;
+-			brcm,msi-base-spi = <128>;
+-			brcm,msi-num-spis = <64>;
+-			brcm,msi-offset = <0>;
+-			brcm,msi-pci-addr = <0xff 0xfffff000>;
+-		};
++	pcie_rescal: reset-controller@119500 {
++		compatible = "brcm,bcm7216-pcie-sata-rescal";
++		reg = <0x10 0x00119500  0x0 0x10>;
++		#reset-cells = <0>;
++	};
+ 
+-		mip1: msi-controller@131000 {
+-			compatible = "brcm,bcm2712-mip-intc";
+-			reg = <0x10 0x00131000  0x0 0xc0>;
+-			msi-controller;
+-			interrupt-controller;
+-			#interrupt-cells = <2>;
+-			brcm,msi-base-spi = <247>;
+-			/* Actually 20 total, but the others are
+-			 * both sparse and non-consecutive */
+-			brcm,msi-num-spis = <8>;
+-			brcm,msi-offset = <8>;
+-			brcm,msi-pci-addr = <0xff 0xffffe000>;
+-		};
++	// Quad-lane Gen3 PCIe
++	// Outbound window at 0x1c_000000-0x1f_ffffff
++	pcie2: pcie@120000 {
++		compatible = "brcm,bcm2712-pcie";
++		reg = <0x10 0x00120000  0x0 0x9310>;
++		device_type = "pci";
++		max-link-speed = <2>;
++		#address-cells = <3>;
++		#interrupt-cells = <1>;
++		#size-cells = <2>;
++		/*
++			* Unused interrupts:
++			* 228: AER
++			* 235: NMI
++			* 236: PME
++			*/
++		interrupt-parent = <&gicv2>;
++		interrupts = <GIC_SPI 233 IRQ_TYPE_LEVEL_HIGH>,
++					<GIC_SPI 234 IRQ_TYPE_LEVEL_HIGH>;
++		interrupt-names = "pcie", "msi";
++		interrupt-map-mask = <0x0 0x0 0x0 0x7>;
++		interrupt-map = <0 0 0 1 &gicv2 GIC_SPI 229
++						IRQ_TYPE_LEVEL_HIGH>,
++				<0 0 0 2 &gicv2 GIC_SPI 230
++						IRQ_TYPE_LEVEL_HIGH>,
++				<0 0 0 3 &gicv2 GIC_SPI 231
++						IRQ_TYPE_LEVEL_HIGH>,
++				<0 0 0 4 &gicv2 GIC_SPI 232
++						IRQ_TYPE_LEVEL_HIGH>;
++		resets = <&bcm_reset 32>, <&bcm_reset 44>, <&pcie_rescal>;
++		reset-names = "swinit", "bridge", "rescal";
++		msi-controller;
++		msi-parent = <&mip0>;
++
++		// ~4GB, 32-bit, not-prefetchable at PCIe 00_00000000
++		ranges = <0x02000000 0x00 0x00000000
++				0x1f 0x00000000
++				0x0 0xfffffffc>,
++		// 12GB, 64-bit, prefetchable at PCIe 04_00000000
++				<0x43000000 0x04 0x00000000
++				0x1c 0x00000000
++				0x03 0x00000000>;
++
++		// 64GB system RAM space at PCIe 10_00000000
++		dma-ranges = <0x02000000 0x00 0x00000000
++					0x1f 0x00000000
++					0x00 0x00400000>,
++					<0x43000000 0x10 0x00000000
++					0x00 0x00000000
++					0x10 0x00000000>;
+ 
+-		syscon_piarbctl: syscon@400018 {
+-			compatible = "brcm,syscon-piarbctl", "syscon", "simple-mfd";
+-			reg = <0x10 0x00400018  0x0 0x18>;
+-		};
++		status = "disabled";
++	};
+ 
+-		usb: usb@480000 {
+-			compatible = "brcm,bcm2835-usb";
+-			reg = <0x10 0x00480000  0x0 0x10000>;
+-			interrupts = <GIC_SPI 73 IRQ_TYPE_LEVEL_HIGH>;
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			clocks = <&clk_usb>;
+-			clock-names = "otg";
+-			phys = <&usbphy>;
+-			phy-names = "usb2-phy";
+-			status = "disabled";
+-		};
++	mip0: msi-controller@130000 {
++		compatible = "brcm,bcm2712-mip-intc";
++		reg = <0x10 0x00130000  0x0 0xc0>;
++		msi-controller;
++		interrupt-controller;
++		#interrupt-cells = <2>;
++		brcm,msi-base-spi = <128>;
++		brcm,msi-num-spis = <64>;
++		brcm,msi-offset = <0>;
++		brcm,msi-pci-addr = <0xff 0xfffff000>;
++	};
+ 
+-		rpivid: codec@800000 {
+-			compatible = "raspberrypi,rpivid-vid-decoder";
+-			reg = <0x10 0x00800000  0x0 0x10000>, /* HEVC */
+-			      <0x10 0x00840000  0x0 0x1000>;  /* INTC */
+-			reg-names = "hevc",
+-				    "intc";
+-
+-			interrupts = <GIC_SPI 98 IRQ_TYPE_LEVEL_HIGH>;
+-
+-			clocks = <&firmware_clocks 11>;
+-			clock-names = "hevc";
+-			iommus = <&iommu2>;
+-			status = "disabled";
+-		};
++	mip1: msi-controller@131000 {
++		compatible = "brcm,bcm2712-mip-intc";
++		reg = <0x10 0x00131000  0x0 0xc0>;
++		msi-controller;
++		interrupt-controller;
++		#interrupt-cells = <2>;
++		brcm,msi-base-spi = <247>;
++		/* Actually 20 total, but the others are
++			* both sparse and non-consecutive */
++		brcm,msi-num-spis = <8>;
++		brcm,msi-offset = <8>;
++		brcm,msi-pci-addr = <0xff 0xffffe000>;
++	};
++
++	syscon_piarbctl: syscon@400018 {
++		compatible = "brcm,syscon-piarbctl", "syscon", "simple-mfd";
++		reg = <0x10 0x00400018  0x0 0x18>;
++	};
++
++	usb: usb@480000 {
++		compatible = "brcm,bcm2835-usb";
++		reg = <0x10 0x00480000  0x0 0x10000>;
++		interrupts = <GIC_SPI 73 IRQ_TYPE_LEVEL_HIGH>;
++		#address-cells = <1>;
++		#size-cells = <0>;
++		clocks = <&clk_usb>;
++		clock-names = "otg";
++		phys = <&usbphy>;
++		phy-names = "usb2-phy";
++		status = "disabled";
++	};
+ 
+-		pisp_be: pisp_be@880000  {
+-			compatible = "raspberrypi,pispbe";
+-			reg = <0x10 0x00880000  0x0 0x4000>;
+-			interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&firmware_clocks 7>;
+-			clocks-names = "isp_be";
+-			status = "okay";
+-			iommus = <&iommu2>;
+-		};
++	rpivid: codec@800000 {
++		compatible = "raspberrypi,rpivid-vid-decoder";
++		reg = <0x10 0x00800000  0x0 0x10000>, /* HEVC */
++				<0x10 0x00840000  0x0 0x1000>;  /* INTC */
++		reg-names = "hevc",
++				"intc";
++
++		interrupts = <GIC_SPI 98 IRQ_TYPE_LEVEL_HIGH>;
++
++		clocks = <&firmware_clocks 11>;
++		clock-names = "hevc";
++		iommus = <&iommu2>;
++		status = "disabled";
++	};
+ 
+-		sdio2: mmc@1100000 {
+-			compatible = "brcm,bcm2712-sdhci";
+-			reg = <0x10 0x01100000  0x0 0x260>,
+-			      <0x10 0x01100400  0x0 0x200>;
+-			reg-names = "host", "cfg";
+-			interrupts = <GIC_SPI 274 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&clk_emmc2>;
+-			sdhci-caps-mask = <0x0000C000 0x0>;
+-			sdhci-caps = <0x0 0x0>;
+-			supports-cqe;
+-			mmc-ddr-3_3v;
+-			status = "disabled";
+-		};
++	pisp_be: pisp_be@880000  {
++		compatible = "raspberrypi,pispbe";
++		reg = <0x10 0x00880000  0x0 0x4000>;
++		interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>;
++		clocks = <&firmware_clocks 7>;
++		clocks-names = "isp_be";
++		status = "okay";
++		iommus = <&iommu2>;
++	};
+ 
+-		bcm_reset: reset-controller@1504318 {
+-			compatible = "brcm,brcmstb-reset";
+-			reg = <0x10 0x01504318  0x0 0x30>;
+-			#reset-cells = <1>;
+-		};
++	sdio2: mmc@1100000 {
++		compatible = "brcm,bcm2712-sdhci";
++		reg = <0x10 0x01100000  0x0 0x260>,
++				<0x10 0x01100400  0x0 0x200>;
++		reg-names = "host", "cfg";
++		interrupts = <GIC_SPI 274 IRQ_TYPE_LEVEL_HIGH>;
++		clocks = <&clk_emmc2>;
++		sdhci-caps-mask = <0x0000C000 0x0>;
++		sdhci-caps = <0x0 0x0>;
++		supports-cqe;
++		mmc-ddr-3_3v;
++		status = "disabled";
++	};
+ 
+-		v3d: v3d@2000000 {
+-			compatible = "brcm,2712-v3d";
+-			reg = <0x10 0x02000000  0x0 0x4000>,
+-			      <0x10 0x02008000  0x0 0x6000>;
+-			reg-names = "hub", "core0";
+-
+-			power-domains = <&pm BCM2835_POWER_DOMAIN_GRAFX_V3D>;
+-			resets = <&pm BCM2835_RESET_V3D>;
+-			clocks = <&firmware_clocks 5>;
+-			clocks-names = "v3d";
+-			interrupts = <GIC_SPI 250 IRQ_TYPE_LEVEL_HIGH>,
+-				     <GIC_SPI 249 IRQ_TYPE_LEVEL_HIGH>;
+-			status = "disabled";
+-		};
++	bcm_reset: reset-controller@1504318 {
++		compatible = "brcm,brcmstb-reset";
++		reg = <0x10 0x01504318  0x0 0x30>;
++		#reset-cells = <1>;
++	};
++
++	v3d: v3d@2000000 {
++		compatible = "brcm,2712-v3d";
++		reg = <0x10 0x02000000  0x0 0x4000>,
++				<0x10 0x02008000  0x0 0x6000>;
++		reg-names = "hub", "core0";
++
++		power-domains = <&pm BCM2835_POWER_DOMAIN_GRAFX_V3D>;
++		resets = <&pm BCM2835_RESET_V3D>;
++		clocks = <&firmware_clocks 5>;
++		clocks-names = "v3d";
++		interrupts = <GIC_SPI 250 IRQ_TYPE_LEVEL_HIGH>,
++					<GIC_SPI 249 IRQ_TYPE_LEVEL_HIGH>;
++		status = "disabled";
+ 	};
+ };
+ 
++&aon_intr {
++	status = "disabled";
++};
++
+ &gio_aon {
+ 	brcm,gpio-direct;
+ };
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0695-cgroup-Add-cgroup_enable-option.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0695-cgroup-Add-cgroup_enable-option.patch
new file mode 100644
index 00000000..f2da0876
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0695-cgroup-Add-cgroup_enable-option.patch
@@ -0,0 +1,59 @@
+From 3f0ff0ec9f71b86739525d3982f9f9b086c2f1b5 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 9 Dec 2024 14:38:17 +0000
+Subject: [PATCH 695/697] cgroup: Add cgroup_enable option
+
+The upstream addition of the kernel parameter cgroup_disable makes it
+possible to configure cgroups at boot time. In theory, re-enabling a
+disabled cgroup is simply a case of removing the relevant cgroup_disable
+setting, but this is difficult if the setting comes from Device Tree.
+
+Re-introduce cgroup_enable as a way around the problem.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ kernel/cgroup/cgroup.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -6848,6 +6848,39 @@ static int __init cgroup_disable(char *s
+ }
+ __setup("cgroup_disable=", cgroup_disable);
+ 
++static int __init cgroup_enable(char *str)
++{
++	struct cgroup_subsys *ss;
++	char *token;
++	int i;
++
++	while ((token = strsep(&str, ",")) != NULL) {
++		if (!*token)
++			continue;
++
++		for_each_subsys(ss, i) {
++			if (strcmp(token, ss->name) &&
++			    strcmp(token, ss->legacy_name))
++				continue;
++
++			static_branch_enable(cgroup_subsys_enabled_key[i]);
++			pr_info("Enabling %s control group subsystem\n",
++				ss->name);
++		}
++
++		for (i = 0; i < OPT_FEATURE_COUNT; i++) {
++			if (strcmp(token, cgroup_opt_feature_names[i]))
++				continue;
++			cgroup_feature_disable_mask &= ~(1 << i);
++			pr_info("Enabling %s control group feature\n",
++				cgroup_opt_feature_names[i]);
++			break;
++		}
++	}
++	return 1;
++}
++__setup("cgroup_enable=", cgroup_enable);
++
+ void __init __weak enable_debug_cgroup(void) { }
+ 
+ static int __init enable_cgroup_debug(char *str)
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/950-0697-drm-v3d-Correct-clock-settng-calls-to-new-APIs.patch b/6.12/target/linux/bcm27xx/patches-6.12/950-0697-drm-v3d-Correct-clock-settng-calls-to-new-APIs.patch
new file mode 100644
index 00000000..bac46cfa
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/950-0697-drm-v3d-Correct-clock-settng-calls-to-new-APIs.patch
@@ -0,0 +1,44 @@
+From c7d876495ffad298d7f5fa252000c80fd4fd1b74 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Mon, 9 Dec 2024 17:58:48 +0000
+Subject: [PATCH 697/697] drm/v3d: Correct clock settng calls to new APIs
+
+There was a report that 6.12 kernel has lower benchmark
+scores than 6.6.
+
+I can confirm, and found it started with 6.8 kernel
+which moved some code into a new file (v3d_submit.c)
+and in two places the change to the clock api were missed.
+
+The effect of the bug is the v3d clock sometimes
+unwantedly drops to a lower rate.
+
+With this patch the benchmark scores are good again.
+
+Fixes: 86963038cb0c0ba99dad14665ca92936ca723f89
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/gpu/drm/v3d/v3d_submit.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/v3d/v3d_submit.c
++++ b/drivers/gpu/drm/v3d/v3d_submit.c
+@@ -18,7 +18,7 @@ v3d_clock_down_work(struct work_struct *
+ 		container_of(work, struct v3d_dev, clk_down_work.work);
+ 	int ret;
+ 
+-	ret = clk_set_rate(v3d->clk, v3d->clk_down_rate);
++	ret = clk_set_min_rate(v3d->clk, v3d->clk_down_rate);
+ 	v3d->clk_up = false;
+ 	WARN_ON_ONCE(ret != 0);
+ }
+@@ -32,7 +32,7 @@ v3d_clock_up_get(struct v3d_dev *v3d)
+ 		if (!v3d->clk_up)  {
+ 			int ret;
+ 
+-			ret = clk_set_rate(v3d->clk, v3d->clk_up_rate);
++			ret = clk_set_min_rate(v3d->clk, v3d->clk_up_rate);
+ 			WARN_ON_ONCE(ret != 0);
+ 			v3d->clk_up = true;
+ 		}
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/960-hwrng-iproc-set-quality-to-1000.patch b/6.12/target/linux/bcm27xx/patches-6.12/960-hwrng-iproc-set-quality-to-1000.patch
new file mode 100644
index 00000000..c1b4879a
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/960-hwrng-iproc-set-quality-to-1000.patch
@@ -0,0 +1,25 @@
+From d3e5e7f3a4e6f61e8c380b9a610212267ee72dbd Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Sat, 20 Feb 2021 19:24:50 +0100
+Subject: [PATCH] hwrng: iproc: set quality to 1000
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This allows khwrngd to make use of iproc-rng200.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ drivers/char/hw_random/iproc-rng200.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/char/hw_random/iproc-rng200.c
++++ b/drivers/char/hw_random/iproc-rng200.c
+@@ -252,6 +252,7 @@ static int iproc_rng200_probe(struct pla
+ 
+ 	priv->rng.name = pdev->name;
+ 	priv->rng.cleanup = iproc_rng200_cleanup;
++	priv->rng.quality = 1000;
+ 
+ 	if (of_device_is_compatible(dev->of_node, "brcm,bcm2711-rng200")) {
+ 		priv->rng.init = bcm2711_rng200_init;
diff --git a/6.12/target/linux/bcm27xx/patches-6.12/999-dts-add-hogs-on-CM5.patch b/6.12/target/linux/bcm27xx/patches-6.12/999-dts-add-hogs-on-CM5.patch
new file mode 100644
index 00000000..835a98ce
--- /dev/null
+++ b/6.12/target/linux/bcm27xx/patches-6.12/999-dts-add-hogs-on-CM5.patch
@@ -0,0 +1,40 @@
+From a4e7897eef1ad4628572a6abfd30291209a0bf43 Mon Sep 17 00:00:00 2001
+From: Richard Oliver <richard.oliver@raspberrypi.com>
+Date: Tue, 25 Feb 2025 15:06:23 +0000
+Subject: [PATCH] dts: Add hogs for RP1 GPIO 46/48 on CM5
+
+On Pi5 5, GPIOs 46/48 are made available on the 'CAM/DISP 1' connector as
+'CD1_IO0_MICCLK'/'CD1_IO1_MICDAT1'. These GPIOs are not connected on
+CM5.
+
+Add hogs for GPIO 46/48 on CM5 to prevent camera drivers from
+inadvertently using them when connected to 'CAM/DISP 1'
+
+Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi
+index 3a2b702fe6a064..0a44cffca71f57 100644
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi
+@@ -734,6 +734,18 @@ spi10_cs_pins: &spi10_cs_gpio1 {};
+ 		function = "vbus1";
+ 		pins = "gpio42", "gpio43";
+ 	};
++
++	micclk1_hog {
++		gpio-hog;
++		gpios = <46 GPIO_ACTIVE_HIGH>;
++		output-high;
++	};
++
++	micdat1_hog {
++		gpio-hog;
++		gpios = <48 GPIO_ACTIVE_HIGH>;
++		output-high;
++	};
+ };
+ 
+ / {
diff --git a/6.12/target/linux/generic/backport-6.12/410-v6.13-01-block-add-support-for-defining-read-only-partitions.patch b/6.12/target/linux/generic/backport-6.12/410-v6.13-01-block-add-support-for-defining-read-only-partitions.patch
new file mode 100644
index 00000000..d40a483f
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/410-v6.13-01-block-add-support-for-defining-read-only-partitions.patch
@@ -0,0 +1,53 @@
+From 03cb793b26834ddca170ba87057c8f883772dd45 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 3 Oct 2024 00:11:41 +0200
+Subject: [PATCH 1/5] block: add support for defining read-only partitions
+
+Add support for defining read-only partitions and complete support for
+it in the cmdline partition parser as the additional "ro" after a
+partition is scanned but never actually applied.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20241002221306.4403-2-ansuelsmth@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+---
+ block/blk.h                | 1 +
+ block/partitions/cmdline.c | 3 +++
+ block/partitions/core.c    | 3 +++
+ 3 files changed, 7 insertions(+)
+
+--- a/block/blk.h
++++ b/block/blk.h
+@@ -555,6 +555,7 @@ void blk_free_ext_minor(unsigned int min
+ #define ADDPART_FLAG_NONE	0
+ #define ADDPART_FLAG_RAID	1
+ #define ADDPART_FLAG_WHOLEDISK	2
++#define ADDPART_FLAG_READONLY	4
+ int bdev_add_partition(struct gendisk *disk, int partno, sector_t start,
+ 		sector_t length);
+ int bdev_del_partition(struct gendisk *disk, int partno);
+--- a/block/partitions/cmdline.c
++++ b/block/partitions/cmdline.c
+@@ -237,6 +237,9 @@ static int add_part(int slot, struct cmd
+ 	put_partition(state, slot, subpart->from >> 9,
+ 		      subpart->size >> 9);
+ 
++	if (subpart->flags & PF_RDONLY)
++		state->parts[slot].flags |= ADDPART_FLAG_READONLY;
++
+ 	info = &state->parts[slot].info;
+ 
+ 	strscpy(info->volname, subpart->name, sizeof(info->volname));
+--- a/block/partitions/core.c
++++ b/block/partitions/core.c
+@@ -373,6 +373,9 @@ static struct block_device *add_partitio
+ 			goto out_del;
+ 	}
+ 
++	if (flags & ADDPART_FLAG_READONLY)
++		bdev_set_flag(bdev, BD_READ_ONLY);
++
+ 	/* everything is up and running, commence */
+ 	err = xa_insert(&disk->part_tbl, partno, bdev, GFP_KERNEL);
+ 	if (err)
diff --git a/6.12/target/linux/generic/backport-6.12/410-v6.13-03-block-introduce-add_disk_fwnode.patch b/6.12/target/linux/generic/backport-6.12/410-v6.13-03-block-introduce-add_disk_fwnode.patch
new file mode 100644
index 00000000..8ed91047
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/410-v6.13-03-block-introduce-add_disk_fwnode.patch
@@ -0,0 +1,94 @@
+From e5f587242b6072ffab4f4a084a459a59f3035873 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 3 Oct 2024 00:11:43 +0200
+Subject: [PATCH 3/5] block: introduce add_disk_fwnode()
+
+Introduce add_disk_fwnode() as a replacement of device_add_disk() that
+permits to pass and attach a fwnode to disk dev.
+
+This variant can be useful for eMMC that might have the partition table
+for the disk defined in DT. A parser can later make use of the attached
+fwnode to parse the related table and init the hardcoded partition for
+the disk.
+
+device_add_disk() is converted to a simple wrapper of add_disk_fwnode()
+with the fwnode entry set as NULL.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20241002221306.4403-4-ansuelsmth@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+---
+ block/genhd.c          | 28 ++++++++++++++++++++++++----
+ include/linux/blkdev.h |  3 +++
+ 2 files changed, 27 insertions(+), 4 deletions(-)
+
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -383,16 +383,18 @@ int disk_scan_partitions(struct gendisk
+ }
+ 
+ /**
+- * device_add_disk - add disk information to kernel list
++ * add_disk_fwnode - add disk information to kernel list with fwnode
+  * @parent: parent device for the disk
+  * @disk: per-device partitioning information
+  * @groups: Additional per-device sysfs groups
++ * @fwnode: attached disk fwnode
+  *
+  * This function registers the partitioning information in @disk
+- * with the kernel.
++ * with the kernel. Also attach a fwnode to the disk device.
+  */
+-int __must_check device_add_disk(struct device *parent, struct gendisk *disk,
+-				 const struct attribute_group **groups)
++int __must_check add_disk_fwnode(struct device *parent, struct gendisk *disk,
++				 const struct attribute_group **groups,
++				 struct fwnode_handle *fwnode)
+ 
+ {
+ 	struct device *ddev = disk_to_dev(disk);
+@@ -452,6 +454,8 @@ int __must_check device_add_disk(struct
+ 	ddev->parent = parent;
+ 	ddev->groups = groups;
+ 	dev_set_name(ddev, "%s", disk->disk_name);
++	if (fwnode)
++		device_set_node(ddev, fwnode);
+ 	if (!(disk->flags & GENHD_FL_HIDDEN))
+ 		ddev->devt = MKDEV(disk->major, disk->first_minor);
+ 	ret = device_add(ddev);
+@@ -553,6 +557,22 @@ out_exit_elevator:
+ 		elevator_exit(disk->queue);
+ 	return ret;
+ }
++EXPORT_SYMBOL_GPL(add_disk_fwnode);
++
++/**
++ * device_add_disk - add disk information to kernel list
++ * @parent: parent device for the disk
++ * @disk: per-device partitioning information
++ * @groups: Additional per-device sysfs groups
++ *
++ * This function registers the partitioning information in @disk
++ * with the kernel.
++ */
++int __must_check device_add_disk(struct device *parent, struct gendisk *disk,
++				 const struct attribute_group **groups)
++{
++	return add_disk_fwnode(parent, disk, groups, NULL);
++}
+ EXPORT_SYMBOL(device_add_disk);
+ 
+ static void blk_report_disk_dead(struct gendisk *disk, bool surprise)
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -733,6 +733,9 @@ static inline unsigned int blk_queue_dep
+ #define for_each_bio(_bio)		\
+ 	for (; _bio; _bio = _bio->bi_next)
+ 
++int __must_check add_disk_fwnode(struct device *parent, struct gendisk *disk,
++				 const struct attribute_group **groups,
++				 struct fwnode_handle *fwnode);
+ int __must_check device_add_disk(struct device *parent, struct gendisk *disk,
+ 				 const struct attribute_group **groups);
+ static inline int __must_check add_disk(struct gendisk *disk)
diff --git a/6.12/target/linux/generic/backport-6.12/410-v6.13-04-mmc-block-attach-partitions-fwnode-if-found-in-mmc-c.patch b/6.12/target/linux/generic/backport-6.12/410-v6.13-04-mmc-block-attach-partitions-fwnode-if-found-in-mmc-c.patch
new file mode 100644
index 00000000..0bdeaa85
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/410-v6.13-04-mmc-block-attach-partitions-fwnode-if-found-in-mmc-c.patch
@@ -0,0 +1,104 @@
+From 45ff6c340ddfc2dade74d5b7a8962c778ab7042c Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 3 Oct 2024 00:11:44 +0200
+Subject: [PATCH 4/5] mmc: block: attach partitions fwnode if found in mmc-card
+
+Attach partitions fwnode if found in mmc-card and register disk with it.
+
+This permits block partition to reference the node and register a
+partition table defined in DT for the special case for embedded device
+that doesn't have a partition table flashed but have an hardcoded
+partition table passed from the system.
+
+JEDEC BOOT partition boot0/boot1 are supported but in DT we refer with
+the JEDEC name of boot1 and boot2 to better adhere to documentation.
+
+Also JEDEC GP partition gp0/1/2/3 are supported but in DT we refer with
+the JEDEC name of gp1/2/3/4 to better adhere to documentration.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20241002221306.4403-5-ansuelsmth@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+---
+ drivers/mmc/core/block.c | 55 +++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 54 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -2517,6 +2517,56 @@ static inline int mmc_blk_readonly(struc
+ 	       !(card->csd.cmdclass & CCC_BLOCK_WRITE);
+ }
+ 
++/*
++ * Search for a declared partitions node for the disk in mmc-card related node.
++ *
++ * This is to permit support for partition table defined in DT in special case
++ * where a partition table is not written in the disk and is expected to be
++ * passed from the running system.
++ *
++ * For the user disk, "partitions" node is searched.
++ * For the special HW disk, "partitions-" node with the appended name is used
++ * following this conversion table (to adhere to JEDEC naming)
++ * - boot0 -> partitions-boot1
++ * - boot1 -> partitions-boot2
++ * - gp0 -> partitions-gp1
++ * - gp1 -> partitions-gp2
++ * - gp2 -> partitions-gp3
++ * - gp3 -> partitions-gp4
++ */
++static struct fwnode_handle *mmc_blk_get_partitions_node(struct device *mmc_dev,
++							 const char *subname)
++{
++	const char *node_name = "partitions";
++
++	if (subname) {
++		mmc_dev = mmc_dev->parent;
++
++		/*
++		 * Check if we are allocating a BOOT disk boot0/1 disk.
++		 * In DT we use the JEDEC naming boot1/2.
++		 */
++		if (!strcmp(subname, "boot0"))
++			node_name = "partitions-boot1";
++		if (!strcmp(subname, "boot1"))
++			node_name = "partitions-boot2";
++		/*
++		 * Check if we are allocating a GP disk gp0/1/2/3 disk.
++		 * In DT we use the JEDEC naming gp1/2/3/4.
++		 */
++		if (!strcmp(subname, "gp0"))
++			node_name = "partitions-gp1";
++		if (!strcmp(subname, "gp1"))
++			node_name = "partitions-gp2";
++		if (!strcmp(subname, "gp2"))
++			node_name = "partitions-gp3";
++		if (!strcmp(subname, "gp3"))
++			node_name = "partitions-gp4";
++	}
++
++	return device_get_named_child_node(mmc_dev, node_name);
++}
++
+ static struct mmc_blk_data *mmc_blk_alloc_req(struct mmc_card *card,
+ 					      struct device *parent,
+ 					      sector_t size,
+@@ -2525,6 +2575,7 @@ static struct mmc_blk_data *mmc_blk_allo
+ 					      int area_type,
+ 					      unsigned int part_type)
+ {
++	struct fwnode_handle *disk_fwnode;
+ 	struct mmc_blk_data *md;
+ 	int devidx, ret;
+ 	char cap_str[10];
+@@ -2626,7 +2677,9 @@ static struct mmc_blk_data *mmc_blk_allo
+ 	/* used in ->open, must be set before add_disk: */
+ 	if (area_type == MMC_BLK_DATA_AREA_MAIN)
+ 		dev_set_drvdata(&card->dev, md);
+-	ret = device_add_disk(md->parent, md->disk, mmc_disk_attr_groups);
++	disk_fwnode = mmc_blk_get_partitions_node(parent, subname);
++	ret = add_disk_fwnode(md->parent, md->disk, mmc_disk_attr_groups,
++			      disk_fwnode);
+ 	if (ret)
+ 		goto err_put_disk;
+ 	return md;
diff --git a/6.12/target/linux/generic/backport-6.12/410-v6.13-05-block-add-support-for-partition-table-defined-in-OF.patch b/6.12/target/linux/generic/backport-6.12/410-v6.13-05-block-add-support-for-partition-table-defined-in-OF.patch
new file mode 100644
index 00000000..d260be16
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/410-v6.13-05-block-add-support-for-partition-table-defined-in-OF.patch
@@ -0,0 +1,200 @@
+From 884555b557e5e6d41c866e2cd8d7b32f50ec974b Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 3 Oct 2024 00:11:45 +0200
+Subject: [PATCH 5/5] block: add support for partition table defined in OF
+
+Add support for partition table defined in Device Tree. Similar to how
+it's done with MTD, add support for defining a fixed partition table in
+device tree.
+
+A common scenario for this is fixed block (eMMC) embedded devices that
+have no MBR or GPT partition table to save storage space. Bootloader
+access the block device with absolute address of data.
+
+This is to complete the functionality with an equivalent implementation
+with providing partition table with bootargs, for case where the booargs
+can't be modified and tweaking the Device Tree is the only solution to
+have an usabe partition table.
+
+The implementation follow the fixed-partitions parser used on MTD
+devices where a "partitions" node is expected to be declared with
+"fixed-partitions" compatible in the OF node of the disk device
+(mmc-card for eMMC for example) and each child node declare a label
+and a reg with offset and size. If label is not declared, the node name
+is used as fallback. Eventually is also possible to declare the read-only
+property to flag the partition as read-only.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20241002221306.4403-6-ansuelsmth@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+---
+ block/partitions/Kconfig  |   9 ++++
+ block/partitions/Makefile |   1 +
+ block/partitions/check.h  |   1 +
+ block/partitions/core.c   |   3 ++
+ block/partitions/of.c     | 110 ++++++++++++++++++++++++++++++++++++++
+ 5 files changed, 124 insertions(+)
+ create mode 100644 block/partitions/of.c
+
+--- a/block/partitions/Kconfig
++++ b/block/partitions/Kconfig
+@@ -270,4 +270,13 @@ config CMDLINE_PARTITION
+ 	  Say Y here if you want to read the partition table from bootargs.
+ 	  The format for the command line is just like mtdparts.
+ 
++config OF_PARTITION
++	bool "Device Tree partition support" if PARTITION_ADVANCED
++	depends on OF
++	help
++	  Say Y here if you want to enable support for partition table
++	  defined in Device Tree. (mainly for eMMC)
++	  The format for the device tree node is just like MTD fixed-partition
++	  schema.
++
+ endmenu
+--- a/block/partitions/Makefile
++++ b/block/partitions/Makefile
+@@ -12,6 +12,7 @@ obj-$(CONFIG_CMDLINE_PARTITION) += cmdli
+ obj-$(CONFIG_MAC_PARTITION) += mac.o
+ obj-$(CONFIG_LDM_PARTITION) += ldm.o
+ obj-$(CONFIG_MSDOS_PARTITION) += msdos.o
++obj-$(CONFIG_OF_PARTITION) += of.o
+ obj-$(CONFIG_OSF_PARTITION) += osf.o
+ obj-$(CONFIG_SGI_PARTITION) += sgi.o
+ obj-$(CONFIG_SUN_PARTITION) += sun.o
+--- a/block/partitions/check.h
++++ b/block/partitions/check.h
+@@ -62,6 +62,7 @@ int karma_partition(struct parsed_partit
+ int ldm_partition(struct parsed_partitions *state);
+ int mac_partition(struct parsed_partitions *state);
+ int msdos_partition(struct parsed_partitions *state);
++int of_partition(struct parsed_partitions *state);
+ int osf_partition(struct parsed_partitions *state);
+ int sgi_partition(struct parsed_partitions *state);
+ int sun_partition(struct parsed_partitions *state);
+--- a/block/partitions/core.c
++++ b/block/partitions/core.c
+@@ -43,6 +43,9 @@ static int (*const check_part[])(struct
+ #ifdef CONFIG_CMDLINE_PARTITION
+ 	cmdline_partition,
+ #endif
++#ifdef CONFIG_OF_PARTITION
++	of_partition,		/* cmdline have priority to OF */
++#endif
+ #ifdef CONFIG_EFI_PARTITION
+ 	efi_partition,		/* this must come before msdos */
+ #endif
+--- /dev/null
++++ b/block/partitions/of.c
+@@ -0,0 +1,110 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include <linux/blkdev.h>
++#include <linux/major.h>
++#include <linux/of.h>
++#include <linux/string.h>
++#include "check.h"
++
++static int validate_of_partition(struct device_node *np, int slot)
++{
++	u64 offset, size;
++	int len;
++
++	const __be32 *reg = of_get_property(np, "reg", &len);
++	int a_cells = of_n_addr_cells(np);
++	int s_cells = of_n_size_cells(np);
++
++	/* Make sure reg len match the expected addr and size cells */
++	if (len / sizeof(*reg) != a_cells + s_cells)
++		return -EINVAL;
++
++	/* Validate offset conversion from bytes to sectors */
++	offset = of_read_number(reg, a_cells);
++	if (offset % SECTOR_SIZE)
++		return -EINVAL;
++
++	/* Validate size conversion from bytes to sectors */
++	size = of_read_number(reg + a_cells, s_cells);
++	if (!size || size % SECTOR_SIZE)
++		return -EINVAL;
++
++	return 0;
++}
++
++static void add_of_partition(struct parsed_partitions *state, int slot,
++			     struct device_node *np)
++{
++	struct partition_meta_info *info;
++	char tmp[sizeof(info->volname) + 4];
++	const char *partname;
++	int len;
++
++	const __be32 *reg = of_get_property(np, "reg", &len);
++	int a_cells = of_n_addr_cells(np);
++	int s_cells = of_n_size_cells(np);
++
++	/* Convert bytes to sector size */
++	u64 offset = of_read_number(reg, a_cells) / SECTOR_SIZE;
++	u64 size = of_read_number(reg + a_cells, s_cells) / SECTOR_SIZE;
++
++	put_partition(state, slot, offset, size);
++
++	if (of_property_read_bool(np, "read-only"))
++		state->parts[slot].flags |= ADDPART_FLAG_READONLY;
++
++	/*
++	 * Follow MTD label logic, search for label property,
++	 * fallback to node name if not found.
++	 */
++	info = &state->parts[slot].info;
++	partname = of_get_property(np, "label", &len);
++	if (!partname)
++		partname = of_get_property(np, "name", &len);
++	strscpy(info->volname, partname, sizeof(info->volname));
++
++	snprintf(tmp, sizeof(tmp), "(%s)", info->volname);
++	strlcat(state->pp_buf, tmp, PAGE_SIZE);
++}
++
++int of_partition(struct parsed_partitions *state)
++{
++	struct device *ddev = disk_to_dev(state->disk);
++	struct device_node *np;
++	int slot;
++
++	struct device_node *partitions_np = of_node_get(ddev->of_node);
++
++	if (!partitions_np ||
++	    !of_device_is_compatible(partitions_np, "fixed-partitions"))
++		return 0;
++
++	slot = 1;
++	/* Validate parition offset and size */
++	for_each_child_of_node(partitions_np, np) {
++		if (validate_of_partition(np, slot)) {
++			of_node_put(np);
++			of_node_put(partitions_np);
++
++			return -1;
++		}
++
++		slot++;
++	}
++
++	slot = 1;
++	for_each_child_of_node(partitions_np, np) {
++		if (slot >= state->limit) {
++			of_node_put(np);
++			break;
++		}
++
++		add_of_partition(state, slot, np);
++
++		slot++;
++	}
++
++	strlcat(state->pp_buf, "\n", PAGE_SIZE);
++
++	return 1;
++}
diff --git a/6.12/target/linux/generic/backport-6.12/412-v6.14-mtd-spinand-add-support-for-FORESEE-F35SQA001G.patch b/6.12/target/linux/generic/backport-6.12/412-v6.14-mtd-spinand-add-support-for-FORESEE-F35SQA001G.patch
new file mode 100644
index 00000000..84b3b2af
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/412-v6.14-mtd-spinand-add-support-for-FORESEE-F35SQA001G.patch
@@ -0,0 +1,38 @@
+From ae461cde5c559675fc4c0ba351c7c31ace705f56 Mon Sep 17 00:00:00 2001
+From: Bohdan Chubuk <chbgdn@gmail.com>
+Date: Sun, 10 Nov 2024 22:50:47 +0200
+Subject: [PATCH] mtd: spinand: add support for FORESEE F35SQA001G
+
+Add support for FORESEE F35SQA001G SPI NAND.
+
+Similar to F35SQA002G, but differs in capacity.
+Datasheet:
+  -  https://cdn.ozdisan.com/ETicaret_Dosya/704795_871495.pdf
+
+Tested on Xiaomi AX3000T flashed with OpenWRT.
+
+Signed-off-by: Bohdan Chubuk <chbgdn@gmail.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+---
+ drivers/mtd/nand/spi/foresee.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/mtd/nand/spi/foresee.c
++++ b/drivers/mtd/nand/spi/foresee.c
+@@ -81,6 +81,16 @@ static const struct spinand_info foresee
+ 		     SPINAND_HAS_QE_BIT,
+ 		     SPINAND_ECCINFO(&f35sqa002g_ooblayout,
+ 				     f35sqa002g_ecc_get_status)),
++	SPINAND_INFO("F35SQA001G",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x71, 0x71),
++		     NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 1),
++		     NAND_ECCREQ(1, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&f35sqa002g_ooblayout,
++				     f35sqa002g_ecc_get_status)),
+ };
+ 
+ static const struct spinand_manufacturer_ops foresee_spinand_manuf_ops = {
diff --git a/6.12/target/linux/generic/backport-6.12/780-25-v6.13-r8169-remove-original-workaround-for-RTL8125-broken-.patch b/6.12/target/linux/generic/backport-6.12/780-25-v6.13-r8169-remove-original-workaround-for-RTL8125-broken-.patch
new file mode 100644
index 00000000..46d41fb2
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/780-25-v6.13-r8169-remove-original-workaround-for-RTL8125-broken-.patch
@@ -0,0 +1,33 @@
+From 854d71c555dfc3383c1fde7d9989b6046e21093d Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Wed, 9 Oct 2024 07:48:05 +0200
+Subject: [PATCH] r8169: remove original workaround for RTL8125 broken rx issue
+
+Now that we have b9c7ac4fe22c ("r8169: disable ALDPS per default for
+RTL8125"), the first attempt to fix the issue shouldn't be needed
+any longer. So let's effectively revert 621735f59064 ("r8169: fix
+rare issue with broken rx after link-down on RTL8125") and see
+whether anybody complains.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/382d8c88-cbce-400f-ad62-fda0181c7e38@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -4777,11 +4777,7 @@ static void r8169_phylink_handler(struct
+ 	if (netif_carrier_ok(ndev)) {
+ 		rtl_link_chg_patch(tp);
+ 		pm_request_resume(d);
+-		netif_wake_queue(tp->dev);
+ 	} else {
+-		/* In few cases rx is broken after link-down otherwise */
+-		if (rtl_is_8125(tp))
+-			rtl_schedule_task(tp, RTL_FLAG_TASK_RESET_NO_QUEUE_WAKE);
+ 		pm_runtime_idle(d);
+ 	}
+ 
diff --git a/6.12/target/linux/generic/backport-6.12/780-26-v6.13-r8169-enable-SG-TSO-on-selected-chip-versions-per-de.patch b/6.12/target/linux/generic/backport-6.12/780-26-v6.13-r8169-enable-SG-TSO-on-selected-chip-versions-per-de.patch
new file mode 100644
index 00000000..5a27cc4b
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/780-26-v6.13-r8169-enable-SG-TSO-on-selected-chip-versions-per-de.patch
@@ -0,0 +1,52 @@
+From b8bf38440ba94e8ed8e2ae55c5dfb0276d30e843 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Thu, 10 Oct 2024 12:58:02 +0200
+Subject: [PATCH] r8169: enable SG/TSO on selected chip versions per default
+
+Due to problem reports in the past SG and TSO/TSO6 are disabled per
+default. It's not fully clear which chip versions are affected, so we
+may impact also users of unaffected chip versions, unless they know
+how to use ethtool for enabling SG/TSO/TSO6.
+Vendor drivers r8168/r8125 enable SG/TSO/TSO6 for selected chip
+versions per default, I'd interpret this as confirmation that these
+chip versions are unaffected. So let's do the same here.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -5489,11 +5489,6 @@ static int rtl_init_one(struct pci_dev *
+ 
+ 	dev->features |= dev->hw_features;
+ 
+-	/* There has been a number of reports that using SG/TSO results in
+-	 * tx timeouts. However for a lot of people SG/TSO works fine.
+-	 * Therefore disable both features by default, but allow users to
+-	 * enable them. Use at own risk!
+-	 */
+ 	if (rtl_chip_supports_csum_v2(tp)) {
+ 		dev->hw_features |= NETIF_F_SG | NETIF_F_TSO | NETIF_F_TSO6;
+ 		netif_set_tso_max_size(dev, RTL_GSO_MAX_SIZE_V2);
+@@ -5504,6 +5499,17 @@ static int rtl_init_one(struct pci_dev *
+ 		netif_set_tso_max_segs(dev, RTL_GSO_MAX_SEGS_V1);
+ 	}
+ 
++	/* There has been a number of reports that using SG/TSO results in
++	 * tx timeouts. However for a lot of people SG/TSO works fine.
++	 * It's not fully clear which chip versions are affected. Vendor
++	 * drivers enable SG/TSO for certain chip versions per default,
++	 * let's mimic this here. On other chip versions users can
++	 * use ethtool to enable SG/TSO, use at own risk!
++	 */
++	if (tp->mac_version >= RTL_GIGA_MAC_VER_46 &&
++	    tp->mac_version != RTL_GIGA_MAC_VER_61)
++		dev->features |= dev->hw_features;
++
+ 	dev->hw_features |= NETIF_F_RXALL;
+ 	dev->hw_features |= NETIF_F_RXFCS;
+ 
diff --git a/6.12/target/linux/generic/backport-6.12/780-27-v6.13-r8169-implement-additional-ethtool-stats-ops.patch b/6.12/target/linux/generic/backport-6.12/780-27-v6.13-r8169-implement-additional-ethtool-stats-ops.patch
new file mode 100644
index 00000000..bb0b77e6
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/780-27-v6.13-r8169-implement-additional-ethtool-stats-ops.patch
@@ -0,0 +1,130 @@
+From e3fc5139bd8ffaa1498adc21be4e8ecbc6aed508 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Sun, 13 Oct 2024 11:17:39 +0200
+Subject: [PATCH] r8169: implement additional ethtool stats ops
+
+This adds support for ethtool standard statistics, and makes use of the
+extended hardware statistics being available from RTl8125.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/58e0da73-a7dd-4be3-82ae-d5b3f9069bde@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 82 +++++++++++++++++++++++
+ 1 file changed, 82 insertions(+)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -2160,6 +2160,19 @@ static void rtl8169_get_ringparam(struct
+ 	data->tx_pending = NUM_TX_DESC;
+ }
+ 
++static void rtl8169_get_pause_stats(struct net_device *dev,
++				    struct ethtool_pause_stats *pause_stats)
++{
++	struct rtl8169_private *tp = netdev_priv(dev);
++
++	if (!rtl_is_8125(tp))
++		return;
++
++	rtl8169_update_counters(tp);
++	pause_stats->tx_pause_frames = le32_to_cpu(tp->counters->tx_pause_on);
++	pause_stats->rx_pause_frames = le32_to_cpu(tp->counters->rx_pause_on);
++}
++
+ static void rtl8169_get_pauseparam(struct net_device *dev,
+ 				   struct ethtool_pauseparam *data)
+ {
+@@ -2186,6 +2199,69 @@ static int rtl8169_set_pauseparam(struct
+ 	return 0;
+ }
+ 
++static void rtl8169_get_eth_mac_stats(struct net_device *dev,
++				      struct ethtool_eth_mac_stats *mac_stats)
++{
++	struct rtl8169_private *tp = netdev_priv(dev);
++
++	rtl8169_update_counters(tp);
++
++	mac_stats->FramesTransmittedOK =
++		le64_to_cpu(tp->counters->tx_packets);
++	mac_stats->SingleCollisionFrames =
++		le32_to_cpu(tp->counters->tx_one_collision);
++	mac_stats->MultipleCollisionFrames =
++		le32_to_cpu(tp->counters->tx_multi_collision);
++	mac_stats->FramesReceivedOK =
++		le64_to_cpu(tp->counters->rx_packets);
++	mac_stats->AlignmentErrors =
++		le16_to_cpu(tp->counters->align_errors);
++	mac_stats->FramesLostDueToIntMACXmitError =
++		le64_to_cpu(tp->counters->tx_errors);
++	mac_stats->BroadcastFramesReceivedOK =
++		le64_to_cpu(tp->counters->rx_broadcast);
++	mac_stats->MulticastFramesReceivedOK =
++		le32_to_cpu(tp->counters->rx_multicast);
++
++	if (!rtl_is_8125(tp))
++		return;
++
++	mac_stats->AlignmentErrors =
++		le32_to_cpu(tp->counters->align_errors32);
++	mac_stats->OctetsTransmittedOK =
++		le64_to_cpu(tp->counters->tx_octets);
++	mac_stats->LateCollisions =
++		le32_to_cpu(tp->counters->tx_late_collision);
++	mac_stats->FramesAbortedDueToXSColls =
++		le32_to_cpu(tp->counters->tx_aborted32);
++	mac_stats->OctetsReceivedOK =
++		le64_to_cpu(tp->counters->rx_octets);
++	mac_stats->FramesLostDueToIntMACRcvError =
++		le32_to_cpu(tp->counters->rx_mac_error);
++	mac_stats->MulticastFramesXmittedOK =
++		le64_to_cpu(tp->counters->tx_multicast64);
++	mac_stats->BroadcastFramesXmittedOK =
++		le64_to_cpu(tp->counters->tx_broadcast64);
++	mac_stats->MulticastFramesReceivedOK =
++		le64_to_cpu(tp->counters->rx_multicast64);
++	 mac_stats->FrameTooLongErrors =
++		le32_to_cpu(tp->counters->rx_frame_too_long);
++}
++
++static void rtl8169_get_eth_ctrl_stats(struct net_device *dev,
++				       struct ethtool_eth_ctrl_stats *ctrl_stats)
++{
++	struct rtl8169_private *tp = netdev_priv(dev);
++
++	if (!rtl_is_8125(tp))
++		return;
++
++	rtl8169_update_counters(tp);
++
++	ctrl_stats->UnsupportedOpcodesReceived =
++		le32_to_cpu(tp->counters->rx_unknown_opcode);
++}
++
+ static const struct ethtool_ops rtl8169_ethtool_ops = {
+ 	.supported_coalesce_params = ETHTOOL_COALESCE_USECS |
+ 				     ETHTOOL_COALESCE_MAX_FRAMES,
+@@ -2207,8 +2283,11 @@ static const struct ethtool_ops rtl8169_
+ 	.get_link_ksettings	= phy_ethtool_get_link_ksettings,
+ 	.set_link_ksettings	= phy_ethtool_set_link_ksettings,
+ 	.get_ringparam		= rtl8169_get_ringparam,
++	.get_pause_stats	= rtl8169_get_pause_stats,
+ 	.get_pauseparam		= rtl8169_get_pauseparam,
+ 	.set_pauseparam		= rtl8169_set_pauseparam,
++	.get_eth_mac_stats	= rtl8169_get_eth_mac_stats,
++	.get_eth_ctrl_stats	= rtl8169_get_eth_ctrl_stats,
+ };
+ 
+ static enum mac_version rtl8169_get_mac_version(u16 xid, bool gmii)
+@@ -3893,6 +3972,9 @@ static void rtl_hw_start_8125(struct rtl
+ 		break;
+ 	}
+ 
++	/* enable extended tally counter */
++	r8168_mac_ocp_modify(tp, 0xea84, 0, BIT(1) | BIT(0));
++
+ 	rtl_hw_config(tp);
+ }
+ 
diff --git a/6.12/target/linux/generic/backport-6.12/780-28-v6.13-r8169-don-t-take-RTNL-lock-in-rtl_task.patch b/6.12/target/linux/generic/backport-6.12/780-28-v6.13-r8169-don-t-take-RTNL-lock-in-rtl_task.patch
new file mode 100644
index 00000000..77e7b432
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/780-28-v6.13-r8169-don-t-take-RTNL-lock-in-rtl_task.patch
@@ -0,0 +1,50 @@
+From ac48430368c1a4f4e6c2fa92243b4b93fd25bee4 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Wed, 16 Oct 2024 22:05:57 +0200
+Subject: [PATCH] r8169: don't take RTNL lock in rtl_task()
+
+There's not really a benefit here in taking the RTNL lock. The task
+handler does exception handling only, so we're in trouble anyway when
+we come here, and there's no need to protect against e.g. a parallel
+ethtool call.
+A benefit of removing the RTNL lock here is that we now can
+synchronously cancel the workqueue from a context holding the RTNL mutex.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -4800,10 +4800,8 @@ static void rtl_task(struct work_struct
+ 		container_of(work, struct rtl8169_private, wk.work);
+ 	int ret;
+ 
+-	rtnl_lock();
+-
+ 	if (!test_bit(RTL_FLAG_TASK_ENABLED, tp->wk.flags))
+-		goto out_unlock;
++		return;
+ 
+ 	if (test_and_clear_bit(RTL_FLAG_TASK_TX_TIMEOUT, tp->wk.flags)) {
+ 		/* if chip isn't accessible, reset bus to revive it */
+@@ -4812,7 +4810,7 @@ static void rtl_task(struct work_struct
+ 			if (ret < 0) {
+ 				netdev_err(tp->dev, "Can't reset secondary PCI bus, detach NIC\n");
+ 				netif_device_detach(tp->dev);
+-				goto out_unlock;
++				return;
+ 			}
+ 		}
+ 
+@@ -4831,8 +4829,6 @@ reset:
+ 	} else if (test_and_clear_bit(RTL_FLAG_TASK_RESET_NO_QUEUE_WAKE, tp->wk.flags)) {
+ 		rtl_reset_work(tp);
+ 	}
+-out_unlock:
+-	rtnl_unlock();
+ }
+ 
+ static int rtl8169_poll(struct napi_struct *napi, int budget)
diff --git a/6.12/target/linux/generic/backport-6.12/780-30-v6.13-r8169-avoid-duplicated-messages-if-loading-firmware-.patch b/6.12/target/linux/generic/backport-6.12/780-30-v6.13-r8169-avoid-duplicated-messages-if-loading-firmware-.patch
new file mode 100644
index 00000000..6430d322
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/780-30-v6.13-r8169-avoid-duplicated-messages-if-loading-firmware-.patch
@@ -0,0 +1,41 @@
+From 1c105bacb160b5918e917ab811552b7be69fc69c Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Wed, 16 Oct 2024 22:29:39 +0200
+Subject: [PATCH] r8169: avoid duplicated messages if loading firmware fails
+ and switch to warn level
+
+In case of a problem with firmware loading we inform at the driver level,
+in addition the firmware load code itself issues warnings. Therefore
+switch to firmware_request_nowarn() to avoid duplicated error messages.
+In addition switch to warn level because the firmware is optional and
+typically just fixes compatibility issues.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Message-ID: <d9c5094c-89a6-40e2-b5fe-8df7df4624ef@gmail.com>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+---
+ drivers/net/ethernet/realtek/r8169_firmware.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_firmware.c
++++ b/drivers/net/ethernet/realtek/r8169_firmware.c
+@@ -215,7 +215,7 @@ int rtl_fw_request_firmware(struct rtl_f
+ {
+ 	int rc;
+ 
+-	rc = request_firmware(&rtl_fw->fw, rtl_fw->fw_name, rtl_fw->dev);
++	rc = firmware_request_nowarn(&rtl_fw->fw, rtl_fw->fw_name, rtl_fw->dev);
+ 	if (rc < 0)
+ 		goto out;
+ 
+@@ -227,7 +227,7 @@ int rtl_fw_request_firmware(struct rtl_f
+ 
+ 	return 0;
+ out:
+-	dev_err(rtl_fw->dev, "Unable to load firmware %s (%d)\n",
+-		rtl_fw->fw_name, rc);
++	dev_warn(rtl_fw->dev, "Unable to load firmware %s (%d)\n",
++		 rtl_fw->fw_name, rc);
+ 	return rc;
+ }
diff --git a/6.12/target/linux/generic/backport-6.12/780-31-v6.13-r8169-remove-rtl_dash_loop_wait_high-low.patch b/6.12/target/linux/generic/backport-6.12/780-31-v6.13-r8169-remove-rtl_dash_loop_wait_high-low.patch
new file mode 100644
index 00000000..0c0e80c9
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/780-31-v6.13-r8169-remove-rtl_dash_loop_wait_high-low.patch
@@ -0,0 +1,82 @@
+From d64113c6bb5ea5a70b7c9c3a6bcadef307638187 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Wed, 16 Oct 2024 22:31:10 +0200
+Subject: [PATCH] r8169: remove rtl_dash_loop_wait_high/low
+
+Remove rtl_dash_loop_wait_high/low to simplify the code.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Message-ID: <fb8c490c-2d92-48f5-8bbf-1fc1f2ee1649@gmail.com>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 35 ++++++-----------------
+ 1 file changed, 8 insertions(+), 27 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -1346,40 +1346,19 @@ static void rtl8168ep_stop_cmac(struct r
+ 	RTL_W8(tp, IBCR0, RTL_R8(tp, IBCR0) & ~0x01);
+ }
+ 
+-static void rtl_dash_loop_wait(struct rtl8169_private *tp,
+-			       const struct rtl_cond *c,
+-			       unsigned long usecs, int n, bool high)
+-{
+-	if (!tp->dash_enabled)
+-		return;
+-	rtl_loop_wait(tp, c, usecs, n, high);
+-}
+-
+-static void rtl_dash_loop_wait_high(struct rtl8169_private *tp,
+-				    const struct rtl_cond *c,
+-				    unsigned long d, int n)
+-{
+-	rtl_dash_loop_wait(tp, c, d, n, true);
+-}
+-
+-static void rtl_dash_loop_wait_low(struct rtl8169_private *tp,
+-				   const struct rtl_cond *c,
+-				   unsigned long d, int n)
+-{
+-	rtl_dash_loop_wait(tp, c, d, n, false);
+-}
+-
+ static void rtl8168dp_driver_start(struct rtl8169_private *tp)
+ {
+ 	r8168dp_oob_notify(tp, OOB_CMD_DRIVER_START);
+-	rtl_dash_loop_wait_high(tp, &rtl_dp_ocp_read_cond, 10000, 10);
++	if (tp->dash_enabled)
++		rtl_loop_wait_high(tp, &rtl_dp_ocp_read_cond, 10000, 10);
+ }
+ 
+ static void rtl8168ep_driver_start(struct rtl8169_private *tp)
+ {
+ 	r8168ep_ocp_write(tp, 0x01, 0x180, OOB_CMD_DRIVER_START);
+ 	r8168ep_ocp_write(tp, 0x01, 0x30, r8168ep_ocp_read(tp, 0x30) | 0x01);
+-	rtl_dash_loop_wait_high(tp, &rtl_ep_ocp_read_cond, 10000, 30);
++	if (tp->dash_enabled)
++		rtl_loop_wait_high(tp, &rtl_ep_ocp_read_cond, 10000, 30);
+ }
+ 
+ static void rtl8168_driver_start(struct rtl8169_private *tp)
+@@ -1393,7 +1372,8 @@ static void rtl8168_driver_start(struct
+ static void rtl8168dp_driver_stop(struct rtl8169_private *tp)
+ {
+ 	r8168dp_oob_notify(tp, OOB_CMD_DRIVER_STOP);
+-	rtl_dash_loop_wait_low(tp, &rtl_dp_ocp_read_cond, 10000, 10);
++	if (tp->dash_enabled)
++		rtl_loop_wait_low(tp, &rtl_dp_ocp_read_cond, 10000, 10);
+ }
+ 
+ static void rtl8168ep_driver_stop(struct rtl8169_private *tp)
+@@ -1401,7 +1381,8 @@ static void rtl8168ep_driver_stop(struct
+ 	rtl8168ep_stop_cmac(tp);
+ 	r8168ep_ocp_write(tp, 0x01, 0x180, OOB_CMD_DRIVER_STOP);
+ 	r8168ep_ocp_write(tp, 0x01, 0x30, r8168ep_ocp_read(tp, 0x30) | 0x01);
+-	rtl_dash_loop_wait_low(tp, &rtl_ep_ocp_read_cond, 10000, 10);
++	if (tp->dash_enabled)
++		rtl_loop_wait_low(tp, &rtl_ep_ocp_read_cond, 10000, 10);
+ }
+ 
+ static void rtl8168_driver_stop(struct rtl8169_private *tp)
diff --git a/6.12/target/linux/generic/backport-6.12/780-32-v6.13-r8169-enable-EEE-at-2.5G-per-default-on-RTL8125B.patch b/6.12/target/linux/generic/backport-6.12/780-32-v6.13-r8169-enable-EEE-at-2.5G-per-default-on-RTL8125B.patch
new file mode 100644
index 00000000..4ec06cc6
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/780-32-v6.13-r8169-enable-EEE-at-2.5G-per-default-on-RTL8125B.patch
@@ -0,0 +1,28 @@
+From c4e64095c00cb2de413cd6b90be047c273bcd491 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Thu, 17 Oct 2024 22:27:44 +0200
+Subject: [PATCH] r8169: enable EEE at 2.5G per default on RTL8125B
+
+Register a6d/12 is shadowing register MDIO_AN_EEE_ADV2. So this line
+disables advertisement of EEE at 2.5G. Latest vendor driver r8125
+doesn't do this (any longer?), so this mode seems to be safe.
+EEE saves quite some energy, therefore enable this mode per default.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Message-ID: <95dd5a0c-09ea-4847-94d9-b7aa3063e8ff@gmail.com>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+---
+ drivers/net/ethernet/realtek/r8169_phy_config.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -99,7 +99,6 @@ static void rtl8125a_config_eee_phy(stru
+ 
+ static void rtl8125b_config_eee_phy(struct phy_device *phydev)
+ {
+-	phy_modify_paged(phydev, 0xa6d, 0x12, 0x0001, 0x0000);
+ 	phy_modify_paged(phydev, 0xa6d, 0x14, 0x0010, 0x0000);
+ 	phy_modify_paged(phydev, 0xa42, 0x14, 0x0080, 0x0000);
+ 	phy_modify_paged(phydev, 0xa4a, 0x11, 0x0200, 0x0000);
diff --git a/6.12/target/linux/generic/backport-6.12/780-33-v6.13-r8169-add-support-for-RTL8125D.patch b/6.12/target/linux/generic/backport-6.12/780-33-v6.13-r8169-add-support-for-RTL8125D.patch
new file mode 100644
index 00000000..1c322795
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/780-33-v6.13-r8169-add-support-for-RTL8125D.patch
@@ -0,0 +1,143 @@
+From f75d1fbe7809bc5ed134204b920fd9e2fc5db1df Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Thu, 24 Oct 2024 22:42:33 +0200
+Subject: [PATCH] r8169: add support for RTL8125D
+
+This adds support for new chip version RTL8125D, which can be found on
+boards like Gigabyte X870E AORUS ELITE WIFI7. Firmware rtl8125d-1.fw
+for this chip version is available in linux-firmware already.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/d0306912-e88e-4c25-8b5d-545ae8834c0c@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169.h          |  1 +
+ drivers/net/ethernet/realtek/r8169_main.c     | 23 +++++++++++++------
+ .../net/ethernet/realtek/r8169_phy_config.c   | 10 ++++++++
+ 3 files changed, 27 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169.h
++++ b/drivers/net/ethernet/realtek/r8169.h
+@@ -68,6 +68,7 @@ enum mac_version {
+ 	/* support for RTL_GIGA_MAC_VER_60 has been removed */
+ 	RTL_GIGA_MAC_VER_61,
+ 	RTL_GIGA_MAC_VER_63,
++	RTL_GIGA_MAC_VER_64,
+ 	RTL_GIGA_MAC_VER_65,
+ 	RTL_GIGA_MAC_VER_66,
+ 	RTL_GIGA_MAC_NONE
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -55,6 +55,7 @@
+ #define FIRMWARE_8107E_2	"rtl_nic/rtl8107e-2.fw"
+ #define FIRMWARE_8125A_3	"rtl_nic/rtl8125a-3.fw"
+ #define FIRMWARE_8125B_2	"rtl_nic/rtl8125b-2.fw"
++#define FIRMWARE_8125D_1	"rtl_nic/rtl8125d-1.fw"
+ #define FIRMWARE_8126A_2	"rtl_nic/rtl8126a-2.fw"
+ #define FIRMWARE_8126A_3	"rtl_nic/rtl8126a-3.fw"
+ 
+@@ -138,6 +139,7 @@ static const struct {
+ 	[RTL_GIGA_MAC_VER_61] = {"RTL8125A",		FIRMWARE_8125A_3},
+ 	/* reserve 62 for CFG_METHOD_4 in the vendor driver */
+ 	[RTL_GIGA_MAC_VER_63] = {"RTL8125B",		FIRMWARE_8125B_2},
++	[RTL_GIGA_MAC_VER_64] = {"RTL8125D",		FIRMWARE_8125D_1},
+ 	[RTL_GIGA_MAC_VER_65] = {"RTL8126A",		FIRMWARE_8126A_2},
+ 	[RTL_GIGA_MAC_VER_66] = {"RTL8126A",		FIRMWARE_8126A_3},
+ };
+@@ -707,6 +709,7 @@ MODULE_FIRMWARE(FIRMWARE_8168FP_3);
+ MODULE_FIRMWARE(FIRMWARE_8107E_2);
+ MODULE_FIRMWARE(FIRMWARE_8125A_3);
+ MODULE_FIRMWARE(FIRMWARE_8125B_2);
++MODULE_FIRMWARE(FIRMWARE_8125D_1);
+ MODULE_FIRMWARE(FIRMWARE_8126A_2);
+ MODULE_FIRMWARE(FIRMWARE_8126A_3);
+ 
+@@ -2079,10 +2082,7 @@ static void rtl_set_eee_txidle_timer(str
+ 		tp->tx_lpi_timer = timer_val;
+ 		r8168_mac_ocp_write(tp, 0xe048, timer_val);
+ 		break;
+-	case RTL_GIGA_MAC_VER_61:
+-	case RTL_GIGA_MAC_VER_63:
+-	case RTL_GIGA_MAC_VER_65:
+-	case RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_66:
+ 		tp->tx_lpi_timer = timer_val;
+ 		RTL_W16(tp, EEE_TXIDLE_TIMER_8125, timer_val);
+ 		break;
+@@ -2293,6 +2293,9 @@ static enum mac_version rtl8169_get_mac_
+ 		{ 0x7cf, 0x64a,	RTL_GIGA_MAC_VER_66 },
+ 		{ 0x7cf, 0x649,	RTL_GIGA_MAC_VER_65 },
+ 
++		/* 8125D family. */
++		{ 0x7cf, 0x688,	RTL_GIGA_MAC_VER_64 },
++
+ 		/* 8125B family. */
+ 		{ 0x7cf, 0x641,	RTL_GIGA_MAC_VER_63 },
+ 
+@@ -2560,9 +2563,7 @@ static void rtl_init_rxcfg(struct rtl816
+ 	case RTL_GIGA_MAC_VER_61:
+ 		RTL_W32(tp, RxConfig, RX_FETCH_DFLT_8125 | RX_DMA_BURST);
+ 		break;
+-	case RTL_GIGA_MAC_VER_63:
+-	case RTL_GIGA_MAC_VER_65:
+-	case RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_63 ... RTL_GIGA_MAC_VER_66:
+ 		RTL_W32(tp, RxConfig, RX_FETCH_DFLT_8125 | RX_DMA_BURST |
+ 			RX_PAUSE_SLOT_ON);
+ 		break;
+@@ -3874,6 +3875,12 @@ static void rtl_hw_start_8125b(struct rt
+ 	rtl_hw_start_8125_common(tp);
+ }
+ 
++static void rtl_hw_start_8125d(struct rtl8169_private *tp)
++{
++	rtl_set_def_aspm_entry_latency(tp);
++	rtl_hw_start_8125_common(tp);
++}
++
+ static void rtl_hw_start_8126a(struct rtl8169_private *tp)
+ {
+ 	rtl_set_def_aspm_entry_latency(tp);
+@@ -3922,6 +3929,7 @@ static void rtl_hw_config(struct rtl8169
+ 		[RTL_GIGA_MAC_VER_53] = rtl_hw_start_8117,
+ 		[RTL_GIGA_MAC_VER_61] = rtl_hw_start_8125a_2,
+ 		[RTL_GIGA_MAC_VER_63] = rtl_hw_start_8125b,
++		[RTL_GIGA_MAC_VER_64] = rtl_hw_start_8125d,
+ 		[RTL_GIGA_MAC_VER_65] = rtl_hw_start_8126a,
+ 		[RTL_GIGA_MAC_VER_66] = rtl_hw_start_8126a,
+ 	};
+@@ -3939,6 +3947,7 @@ static void rtl_hw_start_8125(struct rtl
+ 	/* disable interrupt coalescing */
+ 	switch (tp->mac_version) {
+ 	case RTL_GIGA_MAC_VER_61:
++	case RTL_GIGA_MAC_VER_64:
+ 		for (i = 0xa00; i < 0xb00; i += 4)
+ 			RTL_W32(tp, i, 0);
+ 		break;
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -1103,6 +1103,15 @@ static void rtl8125b_hw_phy_config(struc
+ 	rtl8125b_config_eee_phy(phydev);
+ }
+ 
++static void rtl8125d_hw_phy_config(struct rtl8169_private *tp,
++				   struct phy_device *phydev)
++{
++	r8169_apply_firmware(tp);
++	rtl8125_legacy_force_mode(phydev);
++	rtl8168g_disable_aldps(phydev);
++	rtl8125b_config_eee_phy(phydev);
++}
++
+ static void rtl8126a_hw_phy_config(struct rtl8169_private *tp,
+ 				   struct phy_device *phydev)
+ {
+@@ -1159,6 +1168,7 @@ void r8169_hw_phy_config(struct rtl8169_
+ 		[RTL_GIGA_MAC_VER_53] = rtl8117_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_61] = rtl8125a_2_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_63] = rtl8125b_hw_phy_config,
++		[RTL_GIGA_MAC_VER_64] = rtl8125d_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_65] = rtl8126a_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_66] = rtl8126a_hw_phy_config,
+ 	};
diff --git a/6.12/target/linux/generic/backport-6.12/780-34-v6.13-r8169-fix-inconsistent-indenting-in-rtl8169_get_eth_.patch b/6.12/target/linux/generic/backport-6.12/780-34-v6.13-r8169-fix-inconsistent-indenting-in-rtl8169_get_eth_.patch
new file mode 100644
index 00000000..5ab37cb1
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/780-34-v6.13-r8169-fix-inconsistent-indenting-in-rtl8169_get_eth_.patch
@@ -0,0 +1,30 @@
+From b8bd8c44a266c9a7dcb907eab10fbb119e3f6494 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Thu, 24 Oct 2024 22:48:59 +0200
+Subject: [PATCH] r8169: fix inconsistent indenting in
+ rtl8169_get_eth_mac_stats
+
+This fixes an inconsistent indenting introduced with e3fc5139bd8f
+("r8169: implement additional ethtool stats ops").
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202410220413.1gAxIJ4t-lkp@intel.com/
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20fd6f39-3c1b-4af0-9adc-7d1f49728fad@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -2225,7 +2225,7 @@ static void rtl8169_get_eth_mac_stats(st
+ 		le64_to_cpu(tp->counters->tx_broadcast64);
+ 	mac_stats->MulticastFramesReceivedOK =
+ 		le64_to_cpu(tp->counters->rx_multicast64);
+-	 mac_stats->FrameTooLongErrors =
++	mac_stats->FrameTooLongErrors =
+ 		le32_to_cpu(tp->counters->rx_frame_too_long);
+ }
+ 
diff --git a/6.12/target/linux/generic/backport-6.12/780-35-v6.13-r8169-align-RTL8125-EEE-config-with-vendor-driver.patch b/6.12/target/linux/generic/backport-6.12/780-35-v6.13-r8169-align-RTL8125-EEE-config-with-vendor-driver.patch
new file mode 100644
index 00000000..de2be016
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/780-35-v6.13-r8169-align-RTL8125-EEE-config-with-vendor-driver.patch
@@ -0,0 +1,49 @@
+From eb90f876b7961d702d7fc549e14614860f531e60 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Thu, 31 Oct 2024 22:42:52 +0100
+Subject: [PATCH] r8169: align RTL8125 EEE config with vendor driver
+
+Align the EEE config for RTL8125A/RTL8125B with vendor driver r8125.
+This should help to avoid compatibility issues.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/044c925e-8669-4b98-87df-95b4056f4f5f@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ .../net/ethernet/realtek/r8169_phy_config.c    | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -89,19 +89,25 @@ static void rtl8168h_config_eee_phy(stru
+ 	phy_modify_paged(phydev, 0xa42, 0x14, 0x0000, 0x0080);
+ }
+ 
+-static void rtl8125a_config_eee_phy(struct phy_device *phydev)
++static void rtl8125_common_config_eee_phy(struct phy_device *phydev)
+ {
+-	rtl8168h_config_eee_phy(phydev);
++	phy_modify_paged(phydev, 0xa6d, 0x14, 0x0010, 0x0000);
++	phy_modify_paged(phydev, 0xa42, 0x14, 0x0080, 0x0000);
++	phy_modify_paged(phydev, 0xa4a, 0x11, 0x0200, 0x0000);
++}
+ 
++static void rtl8125a_config_eee_phy(struct phy_device *phydev)
++{
++	rtl8168g_config_eee_phy(phydev);
++	/* disable EEE at 2.5Gbps */
+ 	phy_modify_paged(phydev, 0xa6d, 0x12, 0x0001, 0x0000);
+-	phy_modify_paged(phydev, 0xa6d, 0x14, 0x0010, 0x0000);
++	rtl8125_common_config_eee_phy(phydev);
+ }
+ 
+ static void rtl8125b_config_eee_phy(struct phy_device *phydev)
+ {
+-	phy_modify_paged(phydev, 0xa6d, 0x14, 0x0010, 0x0000);
+-	phy_modify_paged(phydev, 0xa42, 0x14, 0x0080, 0x0000);
+-	phy_modify_paged(phydev, 0xa4a, 0x11, 0x0200, 0x0000);
++	rtl8168g_config_eee_phy(phydev);
++	rtl8125_common_config_eee_phy(phydev);
+ }
+ 
+ static void rtl8169s_hw_phy_config(struct rtl8169_private *tp,
diff --git a/6.12/target/linux/generic/backport-6.12/780-36-v6.13-r8169-align-RTL8125-RTL8126-PHY-config-with-vendor-d.patch b/6.12/target/linux/generic/backport-6.12/780-36-v6.13-r8169-align-RTL8125-RTL8126-PHY-config-with-vendor-d.patch
new file mode 100644
index 00000000..a546c426
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/780-36-v6.13-r8169-align-RTL8125-RTL8126-PHY-config-with-vendor-d.patch
@@ -0,0 +1,46 @@
+From 4af2f60bf7378bd5c92b15a528d8c6c7d02bed6c Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Thu, 31 Oct 2024 22:43:45 +0100
+Subject: [PATCH] r8169: align RTL8125/RTL8126 PHY config with vendor driver
+
+This aligns some parameters with vendor driver r8125/r8126 to avoid
+compatibility issues. Note that for RTL8125B there's no functional
+change, just the open-coded version of the function is replaced.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/a8a9d896-fbe6-41f2-bf87-666567d3cdb3@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_phy_config.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -1073,8 +1073,8 @@ static void rtl8125b_hw_phy_config(struc
+ 				   struct phy_device *phydev)
+ {
+ 	r8169_apply_firmware(tp);
++	rtl8168g_enable_gphy_10m(phydev);
+ 
+-	phy_modify_paged(phydev, 0xa44, 0x11, 0x0000, 0x0800);
+ 	phy_modify_paged(phydev, 0xac4, 0x13, 0x00f0, 0x0090);
+ 	phy_modify_paged(phydev, 0xad3, 0x10, 0x0003, 0x0001);
+ 
+@@ -1113,6 +1113,7 @@ static void rtl8125d_hw_phy_config(struc
+ 				   struct phy_device *phydev)
+ {
+ 	r8169_apply_firmware(tp);
++	rtl8168g_enable_gphy_10m(phydev);
+ 	rtl8125_legacy_force_mode(phydev);
+ 	rtl8168g_disable_aldps(phydev);
+ 	rtl8125b_config_eee_phy(phydev);
+@@ -1122,6 +1123,9 @@ static void rtl8126a_hw_phy_config(struc
+ 				   struct phy_device *phydev)
+ {
+ 	r8169_apply_firmware(tp);
++	rtl8168g_enable_gphy_10m(phydev);
++	rtl8125_legacy_force_mode(phydev);
++	rtl8168g_disable_aldps(phydev);
+ }
+ 
+ void r8169_hw_phy_config(struct rtl8169_private *tp, struct phy_device *phydev,
diff --git a/6.12/target/linux/generic/backport-6.12/780-37-v6.13-r8169-align-RTL8126-EEE-config-with-vendor-driver.patch b/6.12/target/linux/generic/backport-6.12/780-37-v6.13-r8169-align-RTL8126-EEE-config-with-vendor-driver.patch
new file mode 100644
index 00000000..36c8041c
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/780-37-v6.13-r8169-align-RTL8126-EEE-config-with-vendor-driver.patch
@@ -0,0 +1,25 @@
+From a3d8520e6a19ab018da6c7fc22512c913697a829 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Thu, 31 Oct 2024 22:44:36 +0100
+Subject: [PATCH] r8169: align RTL8126 EEE config with vendor driver
+
+Align the EEE config for RTL8126A with vendor driver r8126 to avoid
+compatibility issues.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/71e4859e-4cd0-4b6b-b7fa-621d7721992f@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_phy_config.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -1126,6 +1126,7 @@ static void rtl8126a_hw_phy_config(struc
+ 	rtl8168g_enable_gphy_10m(phydev);
+ 	rtl8125_legacy_force_mode(phydev);
+ 	rtl8168g_disable_aldps(phydev);
++	rtl8125_common_config_eee_phy(phydev);
+ }
+ 
+ void r8169_hw_phy_config(struct rtl8169_private *tp, struct phy_device *phydev,
diff --git a/6.12/target/linux/generic/backport-6.12/780-38-v6.13-r8169-improve-initialization-of-RSS-registers-on-RTL.patch b/6.12/target/linux/generic/backport-6.12/780-38-v6.13-r8169-improve-initialization-of-RSS-registers-on-RTL.patch
new file mode 100644
index 00000000..95e126f1
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/780-38-v6.13-r8169-improve-initialization-of-RSS-registers-on-RTL.patch
@@ -0,0 +1,38 @@
+From 2cd02f2fdd8a92e5b6b85ff64eab0fc549b30c07 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Sat, 2 Nov 2024 14:49:01 +0100
+Subject: [PATCH] r8169: improve initialization of RSS registers on
+ RTL8125/RTL8126
+
+Replace the register addresses with the names used in r8125/r8126
+vendor driver, and consider that RSS_CTRL_8125 is a 32 bit register.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/3bf2f340-b369-4174-97bf-fd38d4217492@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -346,6 +346,8 @@ enum rtl8125_registers {
+ 	TxPoll_8125		= 0x90,
+ 	LEDSEL3			= 0x96,
+ 	MAC0_BKP		= 0x19e0,
++	RSS_CTRL_8125		= 0x4500,
++	Q_NUM_CTRL_8125		= 0x4800,
+ 	EEE_TXIDLE_TIMER_8125	= 0x6048,
+ };
+ 
+@@ -3768,8 +3770,8 @@ static void rtl_hw_start_8125_common(str
+ 	rtl_pcie_state_l2l3_disable(tp);
+ 
+ 	RTL_W16(tp, 0x382, 0x221b);
+-	RTL_W8(tp, 0x4500, 0);
+-	RTL_W16(tp, 0x4800, 0);
++	RTL_W32(tp, RSS_CTRL_8125, 0);
++	RTL_W16(tp, Q_NUM_CTRL_8125, 0);
+ 
+ 	/* disable UPS */
+ 	r8168_mac_ocp_modify(tp, 0xd40a, 0x0010, 0x0000);
diff --git a/6.12/target/linux/generic/backport-6.12/780-39-v6.13-r8169-remove-leftover-locks-after-reverted-change.patch b/6.12/target/linux/generic/backport-6.12/780-39-v6.13-r8169-remove-leftover-locks-after-reverted-change.patch
new file mode 100644
index 00000000..43515de4
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/780-39-v6.13-r8169-remove-leftover-locks-after-reverted-change.patch
@@ -0,0 +1,113 @@
+From 83cb4b470c66b37b19a347a35cea01e0cbdd258d Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Mon, 4 Nov 2024 23:16:20 +0100
+Subject: [PATCH] r8169: remove leftover locks after reverted change
+
+After e31a9fedc7d8 ("Revert "r8169: disable ASPM during NAPI poll"")
+these locks aren't needed any longer.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/680f2606-ac7d-4ced-8694-e5033855da9b@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 29 ++---------------------
+ 1 file changed, 2 insertions(+), 27 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -662,13 +662,9 @@ struct rtl8169_private {
+ 		struct work_struct work;
+ 	} wk;
+ 
+-	raw_spinlock_t config25_lock;
+ 	raw_spinlock_t mac_ocp_lock;
+ 	struct mutex led_lock;	/* serialize LED ctrl RMW access */
+ 
+-	raw_spinlock_t cfg9346_usage_lock;
+-	int cfg9346_usage_count;
+-
+ 	unsigned supports_gmii:1;
+ 	unsigned aspm_manageable:1;
+ 	unsigned dash_enabled:1;
+@@ -722,22 +718,12 @@ static inline struct device *tp_to_dev(s
+ 
+ static void rtl_lock_config_regs(struct rtl8169_private *tp)
+ {
+-	unsigned long flags;
+-
+-	raw_spin_lock_irqsave(&tp->cfg9346_usage_lock, flags);
+-	if (!--tp->cfg9346_usage_count)
+-		RTL_W8(tp, Cfg9346, Cfg9346_Lock);
+-	raw_spin_unlock_irqrestore(&tp->cfg9346_usage_lock, flags);
++	RTL_W8(tp, Cfg9346, Cfg9346_Lock);
+ }
+ 
+ static void rtl_unlock_config_regs(struct rtl8169_private *tp)
+ {
+-	unsigned long flags;
+-
+-	raw_spin_lock_irqsave(&tp->cfg9346_usage_lock, flags);
+-	if (!tp->cfg9346_usage_count++)
+-		RTL_W8(tp, Cfg9346, Cfg9346_Unlock);
+-	raw_spin_unlock_irqrestore(&tp->cfg9346_usage_lock, flags);
++	RTL_W8(tp, Cfg9346, Cfg9346_Unlock);
+ }
+ 
+ static void rtl_pci_commit(struct rtl8169_private *tp)
+@@ -748,24 +734,18 @@ static void rtl_pci_commit(struct rtl816
+ 
+ static void rtl_mod_config2(struct rtl8169_private *tp, u8 clear, u8 set)
+ {
+-	unsigned long flags;
+ 	u8 val;
+ 
+-	raw_spin_lock_irqsave(&tp->config25_lock, flags);
+ 	val = RTL_R8(tp, Config2);
+ 	RTL_W8(tp, Config2, (val & ~clear) | set);
+-	raw_spin_unlock_irqrestore(&tp->config25_lock, flags);
+ }
+ 
+ static void rtl_mod_config5(struct rtl8169_private *tp, u8 clear, u8 set)
+ {
+-	unsigned long flags;
+ 	u8 val;
+ 
+-	raw_spin_lock_irqsave(&tp->config25_lock, flags);
+ 	val = RTL_R8(tp, Config5);
+ 	RTL_W8(tp, Config5, (val & ~clear) | set);
+-	raw_spin_unlock_irqrestore(&tp->config25_lock, flags);
+ }
+ 
+ static bool rtl_is_8125(struct rtl8169_private *tp)
+@@ -1571,7 +1551,6 @@ static void __rtl8169_set_wol(struct rtl
+ 		{ WAKE_MAGIC, Config3, MagicPacket }
+ 	};
+ 	unsigned int i, tmp = ARRAY_SIZE(cfg);
+-	unsigned long flags;
+ 	u8 options;
+ 
+ 	rtl_unlock_config_regs(tp);
+@@ -1590,14 +1569,12 @@ static void __rtl8169_set_wol(struct rtl
+ 			r8168_mac_ocp_modify(tp, 0xc0b6, BIT(0), 0);
+ 	}
+ 
+-	raw_spin_lock_irqsave(&tp->config25_lock, flags);
+ 	for (i = 0; i < tmp; i++) {
+ 		options = RTL_R8(tp, cfg[i].reg) & ~cfg[i].mask;
+ 		if (wolopts & cfg[i].opt)
+ 			options |= cfg[i].mask;
+ 		RTL_W8(tp, cfg[i].reg, options);
+ 	}
+-	raw_spin_unlock_irqrestore(&tp->config25_lock, flags);
+ 
+ 	switch (tp->mac_version) {
+ 	case RTL_GIGA_MAC_VER_02 ... RTL_GIGA_MAC_VER_06:
+@@ -5458,8 +5435,6 @@ static int rtl_init_one(struct pci_dev *
+ 	tp->supports_gmii = ent->driver_data == RTL_CFG_NO_GBIT ? 0 : 1;
+ 	tp->ocp_base = OCP_STD_PHY_BASE;
+ 
+-	raw_spin_lock_init(&tp->cfg9346_usage_lock);
+-	raw_spin_lock_init(&tp->config25_lock);
+ 	raw_spin_lock_init(&tp->mac_ocp_lock);
+ 	mutex_init(&tp->led_lock);
+ 
diff --git a/6.12/target/linux/generic/backport-6.12/780-40-v6.13-r8169-improve-__rtl8169_set_wol.patch b/6.12/target/linux/generic/backport-6.12/780-40-v6.13-r8169-improve-__rtl8169_set_wol.patch
new file mode 100644
index 00000000..e468d637
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/780-40-v6.13-r8169-improve-__rtl8169_set_wol.patch
@@ -0,0 +1,108 @@
+From c507e96b5763b36b63ad50ad804341f72ea000e4 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Wed, 6 Nov 2024 17:55:45 +0100
+Subject: [PATCH] r8169: improve __rtl8169_set_wol
+
+Add helper r8169_mod_reg8_cond() what allows to significantly simplify
+__rtl8169_set_wol().
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/697b197a-8eac-40c6-8847-27093cacec36@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 55 ++++++++++-------------
+ 1 file changed, 24 insertions(+), 31 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -748,6 +748,20 @@ static void rtl_mod_config5(struct rtl81
+ 	RTL_W8(tp, Config5, (val & ~clear) | set);
+ }
+ 
++static void r8169_mod_reg8_cond(struct rtl8169_private *tp, int reg,
++				u8 bits, bool cond)
++{
++	u8 val, old_val;
++
++	old_val = RTL_R8(tp, reg);
++	if (cond)
++		val = old_val | bits;
++	else
++		val = old_val & ~bits;
++	if (val != old_val)
++		RTL_W8(tp, reg, val);
++}
++
+ static bool rtl_is_8125(struct rtl8169_private *tp)
+ {
+ 	return tp->mac_version >= RTL_GIGA_MAC_VER_61;
+@@ -1538,58 +1552,37 @@ static void rtl8169_get_wol(struct net_d
+ 
+ static void __rtl8169_set_wol(struct rtl8169_private *tp, u32 wolopts)
+ {
+-	static const struct {
+-		u32 opt;
+-		u16 reg;
+-		u8  mask;
+-	} cfg[] = {
+-		{ WAKE_PHY,   Config3, LinkUp },
+-		{ WAKE_UCAST, Config5, UWF },
+-		{ WAKE_BCAST, Config5, BWF },
+-		{ WAKE_MCAST, Config5, MWF },
+-		{ WAKE_ANY,   Config5, LanWake },
+-		{ WAKE_MAGIC, Config3, MagicPacket }
+-	};
+-	unsigned int i, tmp = ARRAY_SIZE(cfg);
+-	u8 options;
+-
+ 	rtl_unlock_config_regs(tp);
+ 
+ 	if (rtl_is_8168evl_up(tp)) {
+-		tmp--;
+ 		if (wolopts & WAKE_MAGIC)
+ 			rtl_eri_set_bits(tp, 0x0dc, MagicPacket_v2);
+ 		else
+ 			rtl_eri_clear_bits(tp, 0x0dc, MagicPacket_v2);
+ 	} else if (rtl_is_8125(tp)) {
+-		tmp--;
+ 		if (wolopts & WAKE_MAGIC)
+ 			r8168_mac_ocp_modify(tp, 0xc0b6, 0, BIT(0));
+ 		else
+ 			r8168_mac_ocp_modify(tp, 0xc0b6, BIT(0), 0);
++	} else {
++		r8169_mod_reg8_cond(tp, Config3, MagicPacket,
++				    wolopts & WAKE_MAGIC);
+ 	}
+ 
+-	for (i = 0; i < tmp; i++) {
+-		options = RTL_R8(tp, cfg[i].reg) & ~cfg[i].mask;
+-		if (wolopts & cfg[i].opt)
+-			options |= cfg[i].mask;
+-		RTL_W8(tp, cfg[i].reg, options);
+-	}
++	r8169_mod_reg8_cond(tp, Config3, LinkUp, wolopts & WAKE_PHY);
++	r8169_mod_reg8_cond(tp, Config5, UWF, wolopts & WAKE_UCAST);
++	r8169_mod_reg8_cond(tp, Config5, BWF, wolopts & WAKE_BCAST);
++	r8169_mod_reg8_cond(tp, Config5, MWF, wolopts & WAKE_MCAST);
++	r8169_mod_reg8_cond(tp, Config5, LanWake, wolopts);
+ 
+ 	switch (tp->mac_version) {
+ 	case RTL_GIGA_MAC_VER_02 ... RTL_GIGA_MAC_VER_06:
+-		options = RTL_R8(tp, Config1) & ~PMEnable;
+-		if (wolopts)
+-			options |= PMEnable;
+-		RTL_W8(tp, Config1, options);
++		r8169_mod_reg8_cond(tp, Config1, PMEnable, wolopts);
+ 		break;
+ 	case RTL_GIGA_MAC_VER_34:
+ 	case RTL_GIGA_MAC_VER_37:
+ 	case RTL_GIGA_MAC_VER_39 ... RTL_GIGA_MAC_VER_66:
+-		if (wolopts)
+-			rtl_mod_config2(tp, 0, PME_SIGNAL);
+-		else
+-			rtl_mod_config2(tp, PME_SIGNAL, 0);
++		r8169_mod_reg8_cond(tp, Config2, PME_SIGNAL, wolopts);
+ 		break;
+ 	default:
+ 		break;
diff --git a/6.12/target/linux/generic/backport-6.12/780-41-v6.13-r8169-improve-rtl_set_d3_pll_down.patch b/6.12/target/linux/generic/backport-6.12/780-41-v6.13-r8169-improve-rtl_set_d3_pll_down.patch
new file mode 100644
index 00000000..aeafebb2
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/780-41-v6.13-r8169-improve-rtl_set_d3_pll_down.patch
@@ -0,0 +1,44 @@
+From 330dc2297c82953dff402e0b4176a5383a618538 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Wed, 6 Nov 2024 17:56:28 +0100
+Subject: [PATCH] r8169: improve rtl_set_d3_pll_down
+
+Make use of new helper r8169_mod_reg8_cond() and move from a switch()
+to an if() clause. Benefit is that we don't have to touch this piece of
+code each time support for a new chip version is added.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/e1ccdb85-a4ed-4800-89c2-89770ff06452@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 18 +++++-------------
+ 1 file changed, 5 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -1431,19 +1431,11 @@ static enum rtl_dash_type rtl_get_dash_t
+ 
+ static void rtl_set_d3_pll_down(struct rtl8169_private *tp, bool enable)
+ {
+-	switch (tp->mac_version) {
+-	case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_26:
+-	case RTL_GIGA_MAC_VER_29 ... RTL_GIGA_MAC_VER_30:
+-	case RTL_GIGA_MAC_VER_32 ... RTL_GIGA_MAC_VER_37:
+-	case RTL_GIGA_MAC_VER_39 ... RTL_GIGA_MAC_VER_66:
+-		if (enable)
+-			RTL_W8(tp, PMCH, RTL_R8(tp, PMCH) & ~D3_NO_PLL_DOWN);
+-		else
+-			RTL_W8(tp, PMCH, RTL_R8(tp, PMCH) | D3_NO_PLL_DOWN);
+-		break;
+-	default:
+-		break;
+-	}
++	if (tp->mac_version >= RTL_GIGA_MAC_VER_25 &&
++	    tp->mac_version != RTL_GIGA_MAC_VER_28 &&
++	    tp->mac_version != RTL_GIGA_MAC_VER_31 &&
++	    tp->mac_version != RTL_GIGA_MAC_VER_38)
++		r8169_mod_reg8_cond(tp, PMCH, D3_NO_PLL_DOWN, !enable);
+ }
+ 
+ static void rtl_reset_packet_filter(struct rtl8169_private *tp)
diff --git a/6.12/target/linux/generic/backport-6.12/780-42-v6.13-r8169-align-WAKE_PHY-handling-with-r8125-r8126-vendo.patch b/6.12/target/linux/generic/backport-6.12/780-42-v6.13-r8169-align-WAKE_PHY-handling-with-r8125-r8126-vendo.patch
new file mode 100644
index 00000000..26c362dd
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/780-42-v6.13-r8169-align-WAKE_PHY-handling-with-r8125-r8126-vendo.patch
@@ -0,0 +1,29 @@
+From e3e9e9039fa6ae885c7d5c954d7b9f105fa23e8f Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Wed, 6 Nov 2024 17:57:08 +0100
+Subject: [PATCH] r8169: align WAKE_PHY handling with r8125/r8126 vendor
+ drivers
+
+Vendor drivers r8125/r8126 apply this additional magic setting when
+enabling WAKE_PHY, so do the same here.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/51130715-45be-4db5-abb7-05d87e1f5df9@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -1562,6 +1562,9 @@ static void __rtl8169_set_wol(struct rtl
+ 	}
+ 
+ 	r8169_mod_reg8_cond(tp, Config3, LinkUp, wolopts & WAKE_PHY);
++	if (rtl_is_8125(tp))
++		r8168_mac_ocp_modify(tp, 0xe0c6, 0x3f,
++				     wolopts & WAKE_PHY ? 0x13 : 0);
+ 	r8169_mod_reg8_cond(tp, Config5, UWF, wolopts & WAKE_UCAST);
+ 	r8169_mod_reg8_cond(tp, Config5, BWF, wolopts & WAKE_BCAST);
+ 	r8169_mod_reg8_cond(tp, Config5, MWF, wolopts & WAKE_MCAST);
diff --git a/6.12/target/linux/generic/backport-6.12/780-43-v6.13-r8169-use-helper-r8169_mod_reg8_cond-to-simplify-rtl.patch b/6.12/target/linux/generic/backport-6.12/780-43-v6.13-r8169-use-helper-r8169_mod_reg8_cond-to-simplify-rtl.patch
new file mode 100644
index 00000000..4bb0a941
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/780-43-v6.13-r8169-use-helper-r8169_mod_reg8_cond-to-simplify-rtl.patch
@@ -0,0 +1,117 @@
+From 7a3bcd39ae1f0e3ab896d9df62339ab4297a0bfd Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Sat, 9 Nov 2024 23:12:12 +0100
+Subject: [PATCH] r8169: use helper r8169_mod_reg8_cond to simplify
+ rtl_jumbo_config
+
+Use recently added helper r8169_mod_reg8_cond() to simplify jumbo
+mode configuration.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/3df1d484-a02e-46e7-8f75-db5b428e422e@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 77 ++++-------------------
+ 1 file changed, 11 insertions(+), 66 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -2545,86 +2545,31 @@ static void rtl8169_init_ring_indexes(st
+ 	tp->dirty_tx = tp->cur_tx = tp->cur_rx = 0;
+ }
+ 
+-static void r8168c_hw_jumbo_enable(struct rtl8169_private *tp)
+-{
+-	RTL_W8(tp, Config3, RTL_R8(tp, Config3) | Jumbo_En0);
+-	RTL_W8(tp, Config4, RTL_R8(tp, Config4) | Jumbo_En1);
+-}
+-
+-static void r8168c_hw_jumbo_disable(struct rtl8169_private *tp)
+-{
+-	RTL_W8(tp, Config3, RTL_R8(tp, Config3) & ~Jumbo_En0);
+-	RTL_W8(tp, Config4, RTL_R8(tp, Config4) & ~Jumbo_En1);
+-}
+-
+-static void r8168dp_hw_jumbo_enable(struct rtl8169_private *tp)
+-{
+-	RTL_W8(tp, Config3, RTL_R8(tp, Config3) | Jumbo_En0);
+-}
+-
+-static void r8168dp_hw_jumbo_disable(struct rtl8169_private *tp)
+-{
+-	RTL_W8(tp, Config3, RTL_R8(tp, Config3) & ~Jumbo_En0);
+-}
+-
+-static void r8168e_hw_jumbo_enable(struct rtl8169_private *tp)
+-{
+-	RTL_W8(tp, MaxTxPacketSize, 0x24);
+-	RTL_W8(tp, Config3, RTL_R8(tp, Config3) | Jumbo_En0);
+-	RTL_W8(tp, Config4, RTL_R8(tp, Config4) | 0x01);
+-}
+-
+-static void r8168e_hw_jumbo_disable(struct rtl8169_private *tp)
+-{
+-	RTL_W8(tp, MaxTxPacketSize, 0x3f);
+-	RTL_W8(tp, Config3, RTL_R8(tp, Config3) & ~Jumbo_En0);
+-	RTL_W8(tp, Config4, RTL_R8(tp, Config4) & ~0x01);
+-}
+-
+-static void r8168b_1_hw_jumbo_enable(struct rtl8169_private *tp)
+-{
+-	RTL_W8(tp, Config4, RTL_R8(tp, Config4) | (1 << 0));
+-}
+-
+-static void r8168b_1_hw_jumbo_disable(struct rtl8169_private *tp)
+-{
+-	RTL_W8(tp, Config4, RTL_R8(tp, Config4) & ~(1 << 0));
+-}
+-
+ static void rtl_jumbo_config(struct rtl8169_private *tp)
+ {
+ 	bool jumbo = tp->dev->mtu > ETH_DATA_LEN;
+ 	int readrq = 4096;
+ 
++	if (jumbo && tp->mac_version >= RTL_GIGA_MAC_VER_17 &&
++	    tp->mac_version <= RTL_GIGA_MAC_VER_26)
++		readrq = 512;
++
+ 	rtl_unlock_config_regs(tp);
+ 	switch (tp->mac_version) {
+ 	case RTL_GIGA_MAC_VER_17:
+-		if (jumbo) {
+-			readrq = 512;
+-			r8168b_1_hw_jumbo_enable(tp);
+-		} else {
+-			r8168b_1_hw_jumbo_disable(tp);
+-		}
++		r8169_mod_reg8_cond(tp, Config4, BIT(0), jumbo);
+ 		break;
+ 	case RTL_GIGA_MAC_VER_18 ... RTL_GIGA_MAC_VER_26:
+-		if (jumbo) {
+-			readrq = 512;
+-			r8168c_hw_jumbo_enable(tp);
+-		} else {
+-			r8168c_hw_jumbo_disable(tp);
+-		}
++		r8169_mod_reg8_cond(tp, Config3, Jumbo_En0, jumbo);
++		r8169_mod_reg8_cond(tp, Config4, Jumbo_En1, jumbo);
+ 		break;
+ 	case RTL_GIGA_MAC_VER_28:
+-		if (jumbo)
+-			r8168dp_hw_jumbo_enable(tp);
+-		else
+-			r8168dp_hw_jumbo_disable(tp);
++		r8169_mod_reg8_cond(tp, Config3, Jumbo_En0, jumbo);
+ 		break;
+ 	case RTL_GIGA_MAC_VER_31 ... RTL_GIGA_MAC_VER_33:
+-		if (jumbo)
+-			r8168e_hw_jumbo_enable(tp);
+-		else
+-			r8168e_hw_jumbo_disable(tp);
++		RTL_W8(tp, MaxTxPacketSize, jumbo ? 0x24 : 0x3f);
++		r8169_mod_reg8_cond(tp, Config3, Jumbo_En0, jumbo);
++		r8169_mod_reg8_cond(tp, Config4, BIT(0), jumbo);
+ 		break;
+ 	default:
+ 		break;
diff --git a/6.12/target/linux/generic/backport-6.12/780-44-v6.13-r8169-copy-vendor-driver-2.5G-5G-EEE-advertisement-c.patch b/6.12/target/linux/generic/backport-6.12/780-44-v6.13-r8169-copy-vendor-driver-2.5G-5G-EEE-advertisement-c.patch
new file mode 100644
index 00000000..9bdbaf27
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/780-44-v6.13-r8169-copy-vendor-driver-2.5G-5G-EEE-advertisement-c.patch
@@ -0,0 +1,82 @@
+From e340bff27e63ed61a1e9895bed546107859e48a7 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Fri, 8 Nov 2024 08:08:24 +0100
+Subject: [PATCH] r8169: copy vendor driver 2.5G/5G EEE advertisement
+ constraints
+
+Vendor driver r8125 doesn't advertise 2.5G EEE on RTL8125A, and r8126
+doesn't advertise 5G EEE. Likely there are compatibility issues,
+therefore do the same in r8169.
+With this change we don't have to disable 2.5G EEE advertisement in
+rtl8125a_config_eee_phy() any longer.
+We use new phylib accessor phy_set_eee_broken() to mark the respective
+EEE modes as broken.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/ce185e10-8a2f-4cf8-a49b-fd8fb3c3c8a1@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c       |  6 ++++++
+ drivers/net/ethernet/realtek/r8169_phy_config.c | 16 ++++------------
+ 2 files changed, 10 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -5234,6 +5234,11 @@ static int r8169_mdio_register(struct rt
+ 		phy_support_eee(tp->phydev);
+ 	phy_support_asym_pause(tp->phydev);
+ 
++	/* mimic behavior of r8125/r8126 vendor drivers */
++	if (tp->mac_version == RTL_GIGA_MAC_VER_61)
++		tp->phydev->eee_broken_modes |= MDIO_EEE_2_5GT;
++	tp->phydev->eee_broken_modes |= MDIO_EEE_5GT;
++
+ 	/* PHY will be woken up in rtl_open() */
+ 	phy_suspend(tp->phydev);
+ 
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -96,15 +96,7 @@ static void rtl8125_common_config_eee_ph
+ 	phy_modify_paged(phydev, 0xa4a, 0x11, 0x0200, 0x0000);
+ }
+ 
+-static void rtl8125a_config_eee_phy(struct phy_device *phydev)
+-{
+-	rtl8168g_config_eee_phy(phydev);
+-	/* disable EEE at 2.5Gbps */
+-	phy_modify_paged(phydev, 0xa6d, 0x12, 0x0001, 0x0000);
+-	rtl8125_common_config_eee_phy(phydev);
+-}
+-
+-static void rtl8125b_config_eee_phy(struct phy_device *phydev)
++static void rtl8125_config_eee_phy(struct phy_device *phydev)
+ {
+ 	rtl8168g_config_eee_phy(phydev);
+ 	rtl8125_common_config_eee_phy(phydev);
+@@ -1066,7 +1058,7 @@ static void rtl8125a_2_hw_phy_config(str
+ 	rtl8168g_enable_gphy_10m(phydev);
+ 
+ 	rtl8168g_disable_aldps(phydev);
+-	rtl8125a_config_eee_phy(phydev);
++	rtl8125_config_eee_phy(phydev);
+ }
+ 
+ static void rtl8125b_hw_phy_config(struct rtl8169_private *tp,
+@@ -1106,7 +1098,7 @@ static void rtl8125b_hw_phy_config(struc
+ 
+ 	rtl8125_legacy_force_mode(phydev);
+ 	rtl8168g_disable_aldps(phydev);
+-	rtl8125b_config_eee_phy(phydev);
++	rtl8125_config_eee_phy(phydev);
+ }
+ 
+ static void rtl8125d_hw_phy_config(struct rtl8169_private *tp,
+@@ -1116,7 +1108,7 @@ static void rtl8125d_hw_phy_config(struc
+ 	rtl8168g_enable_gphy_10m(phydev);
+ 	rtl8125_legacy_force_mode(phydev);
+ 	rtl8168g_disable_aldps(phydev);
+-	rtl8125b_config_eee_phy(phydev);
++	rtl8125_config_eee_phy(phydev);
+ }
+ 
+ static void rtl8126a_hw_phy_config(struct rtl8169_private *tp,
diff --git a/6.12/target/linux/generic/backport-6.12/780-45-v6.14-r8169-remove-unused-flag-RTL_FLAG_TASK_RESET_NO_QUEU.patch b/6.12/target/linux/generic/backport-6.12/780-45-v6.14-r8169-remove-unused-flag-RTL_FLAG_TASK_RESET_NO_QUEU.patch
new file mode 100644
index 00000000..54152e63
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/780-45-v6.14-r8169-remove-unused-flag-RTL_FLAG_TASK_RESET_NO_QUEU.patch
@@ -0,0 +1,35 @@
+From 2e20bf8cc05766dcd0357cdfcada49e1bc45512b Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Mon, 2 Dec 2024 21:14:35 +0100
+Subject: [PATCH] r8169: remove unused flag RTL_FLAG_TASK_RESET_NO_QUEUE_WAKE
+
+After 854d71c555dfc3 ("r8169: remove original workaround for RTL8125
+broken rx issue") this flag isn't used any longer. So remove it.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Link: https://patch.msgid.link/d9dd214b-3027-4f60-b0e8-6f34a0c76582@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -623,7 +623,6 @@ struct rtl8169_tc_offsets {
+ enum rtl_flag {
+ 	RTL_FLAG_TASK_ENABLED = 0,
+ 	RTL_FLAG_TASK_RESET_PENDING,
+-	RTL_FLAG_TASK_RESET_NO_QUEUE_WAKE,
+ 	RTL_FLAG_TASK_TX_TIMEOUT,
+ 	RTL_FLAG_MAX
+ };
+@@ -4728,8 +4727,6 @@ static void rtl_task(struct work_struct
+ reset:
+ 		rtl_reset_work(tp);
+ 		netif_wake_queue(tp->dev);
+-	} else if (test_and_clear_bit(RTL_FLAG_TASK_RESET_NO_QUEUE_WAKE, tp->wk.flags)) {
+-		rtl_reset_work(tp);
+ 	}
+ }
+ 
diff --git a/6.12/target/linux/generic/backport-6.12/780-46-v6.14-r8169-remove-support-for-chip-version-11.patch b/6.12/target/linux/generic/backport-6.12/780-46-v6.14-r8169-remove-support-for-chip-version-11.patch
new file mode 100644
index 00000000..0f253f99
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/780-46-v6.14-r8169-remove-support-for-chip-version-11.patch
@@ -0,0 +1,114 @@
+From bb18265c3aba92b91a1355609769f3e967b65dee Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Mon, 2 Dec 2024 21:20:02 +0100
+Subject: [PATCH] r8169: remove support for chip version 11
+
+This is a follow-up to 982300c115d2 ("r8169: remove detection of chip
+version 11 (early RTL8168b)"). Nobody complained yet, so remove
+support for this chip version.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/b689ab6d-20b5-4b64-bd7e-531a0a972ba3@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169.h            |  2 +-
+ drivers/net/ethernet/realtek/r8169_main.c       | 14 +-------------
+ drivers/net/ethernet/realtek/r8169_phy_config.c | 10 ----------
+ 3 files changed, 2 insertions(+), 24 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169.h
++++ b/drivers/net/ethernet/realtek/r8169.h
+@@ -23,7 +23,7 @@ enum mac_version {
+ 	RTL_GIGA_MAC_VER_08,
+ 	RTL_GIGA_MAC_VER_09,
+ 	RTL_GIGA_MAC_VER_10,
+-	RTL_GIGA_MAC_VER_11,
++	/* support for RTL_GIGA_MAC_VER_11 has been removed */
+ 	/* RTL_GIGA_MAC_VER_12 was handled the same as VER_17 */
+ 	/* RTL_GIGA_MAC_VER_13 was merged with VER_10 */
+ 	RTL_GIGA_MAC_VER_14,
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -103,7 +103,6 @@ static const struct {
+ 	[RTL_GIGA_MAC_VER_08] = {"RTL8102e"				},
+ 	[RTL_GIGA_MAC_VER_09] = {"RTL8102e/RTL8103e"			},
+ 	[RTL_GIGA_MAC_VER_10] = {"RTL8101e/RTL8100e"			},
+-	[RTL_GIGA_MAC_VER_11] = {"RTL8168b/8111b"			},
+ 	[RTL_GIGA_MAC_VER_14] = {"RTL8401"				},
+ 	[RTL_GIGA_MAC_VER_17] = {"RTL8168b/8111b"			},
+ 	[RTL_GIGA_MAC_VER_18] = {"RTL8168cp/8111cp"			},
+@@ -2335,7 +2334,7 @@ static enum mac_version rtl8169_get_mac_
+ 
+ 		/* 8168B family. */
+ 		{ 0x7c8, 0x380,	RTL_GIGA_MAC_VER_17 },
+-		/* This one is very old and rare, let's see if anybody complains.
++		/* This one is very old and rare, support has been removed.
+ 		 * { 0x7c8, 0x300,	RTL_GIGA_MAC_VER_11 },
+ 		 */
+ 
+@@ -3805,7 +3804,6 @@ static void rtl_hw_config(struct rtl8169
+ 		[RTL_GIGA_MAC_VER_08] = rtl_hw_start_8102e_3,
+ 		[RTL_GIGA_MAC_VER_09] = rtl_hw_start_8102e_2,
+ 		[RTL_GIGA_MAC_VER_10] = NULL,
+-		[RTL_GIGA_MAC_VER_11] = rtl_hw_start_8168b,
+ 		[RTL_GIGA_MAC_VER_14] = rtl_hw_start_8401,
+ 		[RTL_GIGA_MAC_VER_17] = rtl_hw_start_8168b,
+ 		[RTL_GIGA_MAC_VER_18] = rtl_hw_start_8168cp_1,
+@@ -4681,12 +4679,6 @@ static irqreturn_t rtl8169_interrupt(int
+ 	if (status & LinkChg)
+ 		phy_mac_interrupt(tp->phydev);
+ 
+-	if (unlikely(status & RxFIFOOver &&
+-	    tp->mac_version == RTL_GIGA_MAC_VER_11)) {
+-		netif_stop_queue(tp->dev);
+-		rtl_schedule_task(tp, RTL_FLAG_TASK_RESET_PENDING);
+-	}
+-
+ 	rtl_irq_disable(tp);
+ 	napi_schedule(&tp->napi);
+ out:
+@@ -5106,9 +5098,6 @@ static void rtl_set_irq_mask(struct rtl8
+ 
+ 	if (tp->mac_version <= RTL_GIGA_MAC_VER_06)
+ 		tp->irq_mask |= SYSErr | RxFIFOOver;
+-	else if (tp->mac_version == RTL_GIGA_MAC_VER_11)
+-		/* special workaround needed */
+-		tp->irq_mask |= RxFIFOOver;
+ }
+ 
+ static int rtl_alloc_irq(struct rtl8169_private *tp)
+@@ -5302,7 +5291,6 @@ static int rtl_jumbo_max(struct rtl8169_
+ 	case RTL_GIGA_MAC_VER_02 ... RTL_GIGA_MAC_VER_06:
+ 		return JUMBO_7K;
+ 	/* RTL8168b */
+-	case RTL_GIGA_MAC_VER_11:
+ 	case RTL_GIGA_MAC_VER_17:
+ 		return JUMBO_4K;
+ 	/* RTL8168c */
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -276,15 +276,6 @@ static void rtl8169sce_hw_phy_config(str
+ 	rtl_writephy_batch(phydev, phy_reg_init);
+ }
+ 
+-static void rtl8168bb_hw_phy_config(struct rtl8169_private *tp,
+-				    struct phy_device *phydev)
+-{
+-	phy_write(phydev, 0x1f, 0x0001);
+-	phy_set_bits(phydev, 0x16, BIT(0));
+-	phy_write(phydev, 0x10, 0xf41b);
+-	phy_write(phydev, 0x1f, 0x0000);
+-}
+-
+ static void rtl8168bef_hw_phy_config(struct rtl8169_private *tp,
+ 				     struct phy_device *phydev)
+ {
+@@ -1136,7 +1127,6 @@ void r8169_hw_phy_config(struct rtl8169_
+ 		[RTL_GIGA_MAC_VER_08] = rtl8102e_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_09] = rtl8102e_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_10] = NULL,
+-		[RTL_GIGA_MAC_VER_11] = rtl8168bb_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_14] = rtl8401_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_17] = rtl8168bef_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_18] = rtl8168cp_1_hw_phy_config,
diff --git a/6.12/target/linux/generic/backport-6.12/780-47-v6.14-r8169-adjust-version-numbering-for-RTL8126.patch b/6.12/target/linux/generic/backport-6.12/780-47-v6.14-r8169-adjust-version-numbering-for-RTL8126.patch
new file mode 100644
index 00000000..b5c0eee6
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/780-47-v6.14-r8169-adjust-version-numbering-for-RTL8126.patch
@@ -0,0 +1,257 @@
+From b299ea0069284186b0d3d54aebe87f0d195d457a Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Fri, 13 Dec 2024 20:01:41 +0100
+Subject: [PATCH] r8169: adjust version numbering for RTL8126
+
+Adjust version numbering for RTL8126, so that it doesn't overlap with
+new RTL8125 versions.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/6a354364-20e9-48ad-a198-468264288757@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169.h          |  4 +-
+ drivers/net/ethernet/realtek/r8169_main.c     | 62 +++++++++----------
+ .../net/ethernet/realtek/r8169_phy_config.c   |  4 +-
+ 3 files changed, 35 insertions(+), 35 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169.h
++++ b/drivers/net/ethernet/realtek/r8169.h
+@@ -69,8 +69,8 @@ enum mac_version {
+ 	RTL_GIGA_MAC_VER_61,
+ 	RTL_GIGA_MAC_VER_63,
+ 	RTL_GIGA_MAC_VER_64,
+-	RTL_GIGA_MAC_VER_65,
+-	RTL_GIGA_MAC_VER_66,
++	RTL_GIGA_MAC_VER_70,
++	RTL_GIGA_MAC_VER_71,
+ 	RTL_GIGA_MAC_NONE
+ };
+ 
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -139,8 +139,8 @@ static const struct {
+ 	/* reserve 62 for CFG_METHOD_4 in the vendor driver */
+ 	[RTL_GIGA_MAC_VER_63] = {"RTL8125B",		FIRMWARE_8125B_2},
+ 	[RTL_GIGA_MAC_VER_64] = {"RTL8125D",		FIRMWARE_8125D_1},
+-	[RTL_GIGA_MAC_VER_65] = {"RTL8126A",		FIRMWARE_8126A_2},
+-	[RTL_GIGA_MAC_VER_66] = {"RTL8126A",		FIRMWARE_8126A_3},
++	[RTL_GIGA_MAC_VER_70] = {"RTL8126A",		FIRMWARE_8126A_2},
++	[RTL_GIGA_MAC_VER_71] = {"RTL8126A",		FIRMWARE_8126A_3},
+ };
+ 
+ static const struct pci_device_id rtl8169_pci_tbl[] = {
+@@ -1228,7 +1228,7 @@ static void rtl_writephy(struct rtl8169_
+ 	case RTL_GIGA_MAC_VER_31:
+ 		r8168dp_2_mdio_write(tp, location, val);
+ 		break;
+-	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_71:
+ 		r8168g_mdio_write(tp, location, val);
+ 		break;
+ 	default:
+@@ -1243,7 +1243,7 @@ static int rtl_readphy(struct rtl8169_pr
+ 	case RTL_GIGA_MAC_VER_28:
+ 	case RTL_GIGA_MAC_VER_31:
+ 		return r8168dp_2_mdio_read(tp, location);
+-	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_71:
+ 		return r8168g_mdio_read(tp, location);
+ 	default:
+ 		return r8169_mdio_read(tp, location);
+@@ -1574,7 +1574,7 @@ static void __rtl8169_set_wol(struct rtl
+ 		break;
+ 	case RTL_GIGA_MAC_VER_34:
+ 	case RTL_GIGA_MAC_VER_37:
+-	case RTL_GIGA_MAC_VER_39 ... RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_39 ... RTL_GIGA_MAC_VER_71:
+ 		r8169_mod_reg8_cond(tp, Config2, PME_SIGNAL, wolopts);
+ 		break;
+ 	default:
+@@ -2047,7 +2047,7 @@ static void rtl_set_eee_txidle_timer(str
+ 		tp->tx_lpi_timer = timer_val;
+ 		r8168_mac_ocp_write(tp, 0xe048, timer_val);
+ 		break;
+-	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_71:
+ 		tp->tx_lpi_timer = timer_val;
+ 		RTL_W16(tp, EEE_TXIDLE_TIMER_8125, timer_val);
+ 		break;
+@@ -2255,8 +2255,8 @@ static enum mac_version rtl8169_get_mac_
+ 		enum mac_version ver;
+ 	} mac_info[] = {
+ 		/* 8126A family. */
+-		{ 0x7cf, 0x64a,	RTL_GIGA_MAC_VER_66 },
+-		{ 0x7cf, 0x649,	RTL_GIGA_MAC_VER_65 },
++		{ 0x7cf, 0x64a,	RTL_GIGA_MAC_VER_71 },
++		{ 0x7cf, 0x649,	RTL_GIGA_MAC_VER_70 },
+ 
+ 		/* 8125D family. */
+ 		{ 0x7cf, 0x688,	RTL_GIGA_MAC_VER_64 },
+@@ -2528,7 +2528,7 @@ static void rtl_init_rxcfg(struct rtl816
+ 	case RTL_GIGA_MAC_VER_61:
+ 		RTL_W32(tp, RxConfig, RX_FETCH_DFLT_8125 | RX_DMA_BURST);
+ 		break;
+-	case RTL_GIGA_MAC_VER_63 ... RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_63 ... RTL_GIGA_MAC_VER_71:
+ 		RTL_W32(tp, RxConfig, RX_FETCH_DFLT_8125 | RX_DMA_BURST |
+ 			RX_PAUSE_SLOT_ON);
+ 		break;
+@@ -2660,7 +2660,7 @@ static void rtl_wait_txrx_fifo_empty(str
+ 	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_61:
+ 		rtl_loop_wait_high(tp, &rtl_rxtx_empty_cond, 100, 42);
+ 		break;
+-	case RTL_GIGA_MAC_VER_63 ... RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_63 ... RTL_GIGA_MAC_VER_71:
+ 		RTL_W8(tp, ChipCmd, RTL_R8(tp, ChipCmd) | StopReq);
+ 		rtl_loop_wait_high(tp, &rtl_rxtx_empty_cond, 100, 42);
+ 		rtl_loop_wait_high(tp, &rtl_rxtx_empty_cond_2, 100, 42);
+@@ -2903,7 +2903,7 @@ static void rtl_enable_exit_l1(struct rt
+ 	case RTL_GIGA_MAC_VER_37 ... RTL_GIGA_MAC_VER_38:
+ 		rtl_eri_set_bits(tp, 0xd4, 0x0c00);
+ 		break;
+-	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_71:
+ 		r8168_mac_ocp_modify(tp, 0xc0ac, 0, 0x1f80);
+ 		break;
+ 	default:
+@@ -2917,7 +2917,7 @@ static void rtl_disable_exit_l1(struct r
+ 	case RTL_GIGA_MAC_VER_34 ... RTL_GIGA_MAC_VER_38:
+ 		rtl_eri_clear_bits(tp, 0xd4, 0x1f00);
+ 		break;
+-	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_71:
+ 		r8168_mac_ocp_modify(tp, 0xc0ac, 0x1f80, 0);
+ 		break;
+ 	default:
+@@ -2943,8 +2943,8 @@ static void rtl_hw_aspm_clkreq_enable(st
+ 
+ 		rtl_mod_config5(tp, 0, ASPM_en);
+ 		switch (tp->mac_version) {
+-		case RTL_GIGA_MAC_VER_65:
+-		case RTL_GIGA_MAC_VER_66:
++		case RTL_GIGA_MAC_VER_70:
++		case RTL_GIGA_MAC_VER_71:
+ 			val8 = RTL_R8(tp, INT_CFG0_8125) | INT_CFG0_CLKREQEN;
+ 			RTL_W8(tp, INT_CFG0_8125, val8);
+ 			break;
+@@ -2955,7 +2955,7 @@ static void rtl_hw_aspm_clkreq_enable(st
+ 
+ 		switch (tp->mac_version) {
+ 		case RTL_GIGA_MAC_VER_46 ... RTL_GIGA_MAC_VER_48:
+-		case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_66:
++		case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_71:
+ 			/* reset ephy tx/rx disable timer */
+ 			r8168_mac_ocp_modify(tp, 0xe094, 0xff00, 0);
+ 			/* chip can trigger L1.2 */
+@@ -2967,7 +2967,7 @@ static void rtl_hw_aspm_clkreq_enable(st
+ 	} else {
+ 		switch (tp->mac_version) {
+ 		case RTL_GIGA_MAC_VER_46 ... RTL_GIGA_MAC_VER_48:
+-		case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_66:
++		case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_71:
+ 			r8168_mac_ocp_modify(tp, 0xe092, 0x00ff, 0);
+ 			break;
+ 		default:
+@@ -2975,8 +2975,8 @@ static void rtl_hw_aspm_clkreq_enable(st
+ 		}
+ 
+ 		switch (tp->mac_version) {
+-		case RTL_GIGA_MAC_VER_65:
+-		case RTL_GIGA_MAC_VER_66:
++		case RTL_GIGA_MAC_VER_70:
++		case RTL_GIGA_MAC_VER_71:
+ 			val8 = RTL_R8(tp, INT_CFG0_8125) & ~INT_CFG0_CLKREQEN;
+ 			RTL_W8(tp, INT_CFG0_8125, val8);
+ 			break;
+@@ -3696,12 +3696,12 @@ static void rtl_hw_start_8125_common(str
+ 	/* disable new tx descriptor format */
+ 	r8168_mac_ocp_modify(tp, 0xeb58, 0x0001, 0x0000);
+ 
+-	if (tp->mac_version == RTL_GIGA_MAC_VER_65 ||
+-	    tp->mac_version == RTL_GIGA_MAC_VER_66)
++	if (tp->mac_version == RTL_GIGA_MAC_VER_70 ||
++	    tp->mac_version == RTL_GIGA_MAC_VER_71)
+ 		RTL_W8(tp, 0xD8, RTL_R8(tp, 0xD8) & ~0x02);
+ 
+-	if (tp->mac_version == RTL_GIGA_MAC_VER_65 ||
+-	    tp->mac_version == RTL_GIGA_MAC_VER_66)
++	if (tp->mac_version == RTL_GIGA_MAC_VER_70 ||
++	    tp->mac_version == RTL_GIGA_MAC_VER_71)
+ 		r8168_mac_ocp_modify(tp, 0xe614, 0x0700, 0x0400);
+ 	else if (tp->mac_version == RTL_GIGA_MAC_VER_63)
+ 		r8168_mac_ocp_modify(tp, 0xe614, 0x0700, 0x0200);
+@@ -3719,8 +3719,8 @@ static void rtl_hw_start_8125_common(str
+ 	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0030);
+ 	r8168_mac_ocp_modify(tp, 0xe040, 0x1000, 0x0000);
+ 	r8168_mac_ocp_modify(tp, 0xea1c, 0x0003, 0x0001);
+-	if (tp->mac_version == RTL_GIGA_MAC_VER_65 ||
+-	    tp->mac_version == RTL_GIGA_MAC_VER_66)
++	if (tp->mac_version == RTL_GIGA_MAC_VER_70 ||
++	    tp->mac_version == RTL_GIGA_MAC_VER_71)
+ 		r8168_mac_ocp_modify(tp, 0xea1c, 0x0300, 0x0000);
+ 	else
+ 		r8168_mac_ocp_modify(tp, 0xea1c, 0x0004, 0x0000);
+@@ -3839,8 +3839,8 @@ static void rtl_hw_config(struct rtl8169
+ 		[RTL_GIGA_MAC_VER_61] = rtl_hw_start_8125a_2,
+ 		[RTL_GIGA_MAC_VER_63] = rtl_hw_start_8125b,
+ 		[RTL_GIGA_MAC_VER_64] = rtl_hw_start_8125d,
+-		[RTL_GIGA_MAC_VER_65] = rtl_hw_start_8126a,
+-		[RTL_GIGA_MAC_VER_66] = rtl_hw_start_8126a,
++		[RTL_GIGA_MAC_VER_70] = rtl_hw_start_8126a,
++		[RTL_GIGA_MAC_VER_71] = rtl_hw_start_8126a,
+ 	};
+ 
+ 	if (hw_configs[tp->mac_version])
+@@ -3861,8 +3861,8 @@ static void rtl_hw_start_8125(struct rtl
+ 			RTL_W32(tp, i, 0);
+ 		break;
+ 	case RTL_GIGA_MAC_VER_63:
+-	case RTL_GIGA_MAC_VER_65:
+-	case RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_70:
++	case RTL_GIGA_MAC_VER_71:
+ 		for (i = 0xa00; i < 0xa80; i += 4)
+ 			RTL_W32(tp, i, 0);
+ 		RTL_W16(tp, INT_CFG1_8125, 0x0000);
+@@ -4094,7 +4094,7 @@ static void rtl8169_cleanup(struct rtl81
+ 		RTL_W8(tp, ChipCmd, RTL_R8(tp, ChipCmd) | StopReq);
+ 		rtl_loop_wait_high(tp, &rtl_txcfg_empty_cond, 100, 666);
+ 		break;
+-	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_71:
+ 		rtl_enable_rxdvgate(tp);
+ 		fsleep(2000);
+ 		break;
+@@ -4251,7 +4251,7 @@ static unsigned int rtl_quirk_packet_pad
+ 
+ 	switch (tp->mac_version) {
+ 	case RTL_GIGA_MAC_VER_34:
+-	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_71:
+ 		padto = max_t(unsigned int, padto, ETH_ZLEN);
+ 		break;
+ 	default:
+@@ -5272,7 +5272,7 @@ static void rtl_hw_initialize(struct rtl
+ 	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_48:
+ 		rtl_hw_init_8168g(tp);
+ 		break;
+-	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_71:
+ 		rtl_hw_init_8125(tp);
+ 		break;
+ 	default:
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -1162,8 +1162,8 @@ void r8169_hw_phy_config(struct rtl8169_
+ 		[RTL_GIGA_MAC_VER_61] = rtl8125a_2_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_63] = rtl8125b_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_64] = rtl8125d_hw_phy_config,
+-		[RTL_GIGA_MAC_VER_65] = rtl8126a_hw_phy_config,
+-		[RTL_GIGA_MAC_VER_66] = rtl8126a_hw_phy_config,
++		[RTL_GIGA_MAC_VER_70] = rtl8126a_hw_phy_config,
++		[RTL_GIGA_MAC_VER_71] = rtl8126a_hw_phy_config,
+ 	};
+ 
+ 	if (phy_configs[ver])
diff --git a/6.12/target/linux/generic/backport-6.12/780-48-v6.14-r8169-add-support-for-RTL8125D-rev.b.patch b/6.12/target/linux/generic/backport-6.12/780-48-v6.14-r8169-add-support-for-RTL8125D-rev.b.patch
new file mode 100644
index 00000000..70505806
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/780-48-v6.14-r8169-add-support-for-RTL8125D-rev.b.patch
@@ -0,0 +1,90 @@
+From b3593df26ab19f114d613693fa8a92ab202803d0 Mon Sep 17 00:00:00 2001
+From: ChunHao Lin <hau@realtek.com>
+Date: Fri, 13 Dec 2024 20:02:58 +0100
+Subject: [PATCH] r8169: add support for RTL8125D rev.b
+
+Add support for RTL8125D rev.b. Its XID is 0x689. It is basically
+based on the one with XID 0x688, but with different firmware file.
+
+Signed-off-by: ChunHao Lin <hau@realtek.com>
+[hkallweit1@gmail.com: rebased after adjusted version numbering]
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/75e5e9ec-d01f-43ac-b0f4-e7456baf18d1@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169.h            | 1 +
+ drivers/net/ethernet/realtek/r8169_main.c       | 6 ++++++
+ drivers/net/ethernet/realtek/r8169_phy_config.c | 1 +
+ 3 files changed, 8 insertions(+)
+
+--- a/drivers/net/ethernet/realtek/r8169.h
++++ b/drivers/net/ethernet/realtek/r8169.h
+@@ -69,6 +69,7 @@ enum mac_version {
+ 	RTL_GIGA_MAC_VER_61,
+ 	RTL_GIGA_MAC_VER_63,
+ 	RTL_GIGA_MAC_VER_64,
++	RTL_GIGA_MAC_VER_65,
+ 	RTL_GIGA_MAC_VER_70,
+ 	RTL_GIGA_MAC_VER_71,
+ 	RTL_GIGA_MAC_NONE
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -56,6 +56,7 @@
+ #define FIRMWARE_8125A_3	"rtl_nic/rtl8125a-3.fw"
+ #define FIRMWARE_8125B_2	"rtl_nic/rtl8125b-2.fw"
+ #define FIRMWARE_8125D_1	"rtl_nic/rtl8125d-1.fw"
++#define FIRMWARE_8125D_2	"rtl_nic/rtl8125d-2.fw"
+ #define FIRMWARE_8126A_2	"rtl_nic/rtl8126a-2.fw"
+ #define FIRMWARE_8126A_3	"rtl_nic/rtl8126a-3.fw"
+ 
+@@ -139,6 +140,7 @@ static const struct {
+ 	/* reserve 62 for CFG_METHOD_4 in the vendor driver */
+ 	[RTL_GIGA_MAC_VER_63] = {"RTL8125B",		FIRMWARE_8125B_2},
+ 	[RTL_GIGA_MAC_VER_64] = {"RTL8125D",		FIRMWARE_8125D_1},
++	[RTL_GIGA_MAC_VER_65] = {"RTL8125D",		FIRMWARE_8125D_2},
+ 	[RTL_GIGA_MAC_VER_70] = {"RTL8126A",		FIRMWARE_8126A_2},
+ 	[RTL_GIGA_MAC_VER_71] = {"RTL8126A",		FIRMWARE_8126A_3},
+ };
+@@ -706,6 +708,7 @@ MODULE_FIRMWARE(FIRMWARE_8107E_2);
+ MODULE_FIRMWARE(FIRMWARE_8125A_3);
+ MODULE_FIRMWARE(FIRMWARE_8125B_2);
+ MODULE_FIRMWARE(FIRMWARE_8125D_1);
++MODULE_FIRMWARE(FIRMWARE_8125D_2);
+ MODULE_FIRMWARE(FIRMWARE_8126A_2);
+ MODULE_FIRMWARE(FIRMWARE_8126A_3);
+ 
+@@ -2259,6 +2262,7 @@ static enum mac_version rtl8169_get_mac_
+ 		{ 0x7cf, 0x649,	RTL_GIGA_MAC_VER_70 },
+ 
+ 		/* 8125D family. */
++		{ 0x7cf, 0x689,	RTL_GIGA_MAC_VER_65 },
+ 		{ 0x7cf, 0x688,	RTL_GIGA_MAC_VER_64 },
+ 
+ 		/* 8125B family. */
+@@ -3839,6 +3843,7 @@ static void rtl_hw_config(struct rtl8169
+ 		[RTL_GIGA_MAC_VER_61] = rtl_hw_start_8125a_2,
+ 		[RTL_GIGA_MAC_VER_63] = rtl_hw_start_8125b,
+ 		[RTL_GIGA_MAC_VER_64] = rtl_hw_start_8125d,
++		[RTL_GIGA_MAC_VER_65] = rtl_hw_start_8125d,
+ 		[RTL_GIGA_MAC_VER_70] = rtl_hw_start_8126a,
+ 		[RTL_GIGA_MAC_VER_71] = rtl_hw_start_8126a,
+ 	};
+@@ -3857,6 +3862,7 @@ static void rtl_hw_start_8125(struct rtl
+ 	switch (tp->mac_version) {
+ 	case RTL_GIGA_MAC_VER_61:
+ 	case RTL_GIGA_MAC_VER_64:
++	case RTL_GIGA_MAC_VER_65:
+ 		for (i = 0xa00; i < 0xb00; i += 4)
+ 			RTL_W32(tp, i, 0);
+ 		break;
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -1162,6 +1162,7 @@ void r8169_hw_phy_config(struct rtl8169_
+ 		[RTL_GIGA_MAC_VER_61] = rtl8125a_2_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_63] = rtl8125b_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_64] = rtl8125d_hw_phy_config,
++		[RTL_GIGA_MAC_VER_65] = rtl8125d_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_70] = rtl8126a_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_71] = rtl8126a_hw_phy_config,
+ 	};
diff --git a/6.12/target/linux/generic/backport-6.12/780-49-v6.14-r8169-add-support-for-RTL8125BP-rev.b.patch b/6.12/target/linux/generic/backport-6.12/780-49-v6.14-r8169-add-support-for-RTL8125BP-rev.b.patch
new file mode 100644
index 00000000..09a45cad
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/780-49-v6.14-r8169-add-support-for-RTL8125BP-rev.b.patch
@@ -0,0 +1,184 @@
+From b11bff90f2ad52c5c55c822ecd20326619a73898 Mon Sep 17 00:00:00 2001
+From: ChunHao Lin <hau@realtek.com>
+Date: Tue, 7 Jan 2025 14:43:55 +0800
+Subject: [PATCH] r8169: add support for RTL8125BP rev.b
+
+Add support for RTL8125BP rev.b. Its XID is 0x689. This chip supports
+DASH and its dash type is "RTL_DASH_25_BP".
+
+Signed-off-by: ChunHao Lin <hau@realtek.com>
+Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/20250107064355.104711-1-hau@realtek.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/realtek/r8169.h          |  1 +
+ drivers/net/ethernet/realtek/r8169_main.c     | 30 +++++++++++++++++++
+ .../net/ethernet/realtek/r8169_phy_config.c   | 23 ++++++++++++++
+ 3 files changed, 54 insertions(+)
+
+--- a/drivers/net/ethernet/realtek/r8169.h
++++ b/drivers/net/ethernet/realtek/r8169.h
+@@ -70,6 +70,7 @@ enum mac_version {
+ 	RTL_GIGA_MAC_VER_63,
+ 	RTL_GIGA_MAC_VER_64,
+ 	RTL_GIGA_MAC_VER_65,
++	RTL_GIGA_MAC_VER_66,
+ 	RTL_GIGA_MAC_VER_70,
+ 	RTL_GIGA_MAC_VER_71,
+ 	RTL_GIGA_MAC_NONE
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -57,6 +57,7 @@
+ #define FIRMWARE_8125B_2	"rtl_nic/rtl8125b-2.fw"
+ #define FIRMWARE_8125D_1	"rtl_nic/rtl8125d-1.fw"
+ #define FIRMWARE_8125D_2	"rtl_nic/rtl8125d-2.fw"
++#define FIRMWARE_8125BP_2	"rtl_nic/rtl8125bp-2.fw"
+ #define FIRMWARE_8126A_2	"rtl_nic/rtl8126a-2.fw"
+ #define FIRMWARE_8126A_3	"rtl_nic/rtl8126a-3.fw"
+ 
+@@ -141,6 +142,7 @@ static const struct {
+ 	[RTL_GIGA_MAC_VER_63] = {"RTL8125B",		FIRMWARE_8125B_2},
+ 	[RTL_GIGA_MAC_VER_64] = {"RTL8125D",		FIRMWARE_8125D_1},
+ 	[RTL_GIGA_MAC_VER_65] = {"RTL8125D",		FIRMWARE_8125D_2},
++	[RTL_GIGA_MAC_VER_66] = {"RTL8125BP",		FIRMWARE_8125BP_2},
+ 	[RTL_GIGA_MAC_VER_70] = {"RTL8126A",		FIRMWARE_8126A_2},
+ 	[RTL_GIGA_MAC_VER_71] = {"RTL8126A",		FIRMWARE_8126A_3},
+ };
+@@ -632,6 +634,7 @@ enum rtl_dash_type {
+ 	RTL_DASH_NONE,
+ 	RTL_DASH_DP,
+ 	RTL_DASH_EP,
++	RTL_DASH_25_BP,
+ };
+ 
+ struct rtl8169_private {
+@@ -709,6 +712,7 @@ MODULE_FIRMWARE(FIRMWARE_8125A_3);
+ MODULE_FIRMWARE(FIRMWARE_8125B_2);
+ MODULE_FIRMWARE(FIRMWARE_8125D_1);
+ MODULE_FIRMWARE(FIRMWARE_8125D_2);
++MODULE_FIRMWARE(FIRMWARE_8125BP_2);
+ MODULE_FIRMWARE(FIRMWARE_8126A_2);
+ MODULE_FIRMWARE(FIRMWARE_8126A_3);
+ 
+@@ -1361,10 +1365,19 @@ static void rtl8168ep_driver_start(struc
+ 		rtl_loop_wait_high(tp, &rtl_ep_ocp_read_cond, 10000, 30);
+ }
+ 
++static void rtl8125bp_driver_start(struct rtl8169_private *tp)
++{
++	r8168ep_ocp_write(tp, 0x01, 0x14, OOB_CMD_DRIVER_START);
++	r8168ep_ocp_write(tp, 0x01, 0x18, 0x00);
++	r8168ep_ocp_write(tp, 0x01, 0x10, 0x01);
++}
++
+ static void rtl8168_driver_start(struct rtl8169_private *tp)
+ {
+ 	if (tp->dash_type == RTL_DASH_DP)
+ 		rtl8168dp_driver_start(tp);
++	else if (tp->dash_type == RTL_DASH_25_BP)
++		rtl8125bp_driver_start(tp);
+ 	else
+ 		rtl8168ep_driver_start(tp);
+ }
+@@ -1385,10 +1398,19 @@ static void rtl8168ep_driver_stop(struct
+ 		rtl_loop_wait_low(tp, &rtl_ep_ocp_read_cond, 10000, 10);
+ }
+ 
++static void rtl8125bp_driver_stop(struct rtl8169_private *tp)
++{
++	r8168ep_ocp_write(tp, 0x01, 0x14, OOB_CMD_DRIVER_STOP);
++	r8168ep_ocp_write(tp, 0x01, 0x18, 0x00);
++	r8168ep_ocp_write(tp, 0x01, 0x10, 0x01);
++}
++
+ static void rtl8168_driver_stop(struct rtl8169_private *tp)
+ {
+ 	if (tp->dash_type == RTL_DASH_DP)
+ 		rtl8168dp_driver_stop(tp);
++	else if (tp->dash_type == RTL_DASH_25_BP)
++		rtl8125bp_driver_stop(tp);
+ 	else
+ 		rtl8168ep_driver_stop(tp);
+ }
+@@ -1411,6 +1433,7 @@ static bool rtl_dash_is_enabled(struct r
+ 	case RTL_DASH_DP:
+ 		return r8168dp_check_dash(tp);
+ 	case RTL_DASH_EP:
++	case RTL_DASH_25_BP:
+ 		return r8168ep_check_dash(tp);
+ 	default:
+ 		return false;
+@@ -1425,6 +1448,8 @@ static enum rtl_dash_type rtl_get_dash_t
+ 		return RTL_DASH_DP;
+ 	case RTL_GIGA_MAC_VER_51 ... RTL_GIGA_MAC_VER_53:
+ 		return RTL_DASH_EP;
++	case RTL_GIGA_MAC_VER_66:
++		return RTL_DASH_25_BP;
+ 	default:
+ 		return RTL_DASH_NONE;
+ 	}
+@@ -2261,6 +2286,9 @@ static enum mac_version rtl8169_get_mac_
+ 		{ 0x7cf, 0x64a,	RTL_GIGA_MAC_VER_71 },
+ 		{ 0x7cf, 0x649,	RTL_GIGA_MAC_VER_70 },
+ 
++		/* 8125BP family. */
++		{ 0x7cf, 0x681,	RTL_GIGA_MAC_VER_66 },
++
+ 		/* 8125D family. */
+ 		{ 0x7cf, 0x689,	RTL_GIGA_MAC_VER_65 },
+ 		{ 0x7cf, 0x688,	RTL_GIGA_MAC_VER_64 },
+@@ -3844,6 +3872,7 @@ static void rtl_hw_config(struct rtl8169
+ 		[RTL_GIGA_MAC_VER_63] = rtl_hw_start_8125b,
+ 		[RTL_GIGA_MAC_VER_64] = rtl_hw_start_8125d,
+ 		[RTL_GIGA_MAC_VER_65] = rtl_hw_start_8125d,
++		[RTL_GIGA_MAC_VER_66] = rtl_hw_start_8125d,
+ 		[RTL_GIGA_MAC_VER_70] = rtl_hw_start_8126a,
+ 		[RTL_GIGA_MAC_VER_71] = rtl_hw_start_8126a,
+ 	};
+@@ -3863,6 +3892,7 @@ static void rtl_hw_start_8125(struct rtl
+ 	case RTL_GIGA_MAC_VER_61:
+ 	case RTL_GIGA_MAC_VER_64:
+ 	case RTL_GIGA_MAC_VER_65:
++	case RTL_GIGA_MAC_VER_66:
+ 		for (i = 0xa00; i < 0xb00; i += 4)
+ 			RTL_W32(tp, i, 0);
+ 		break;
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -1102,6 +1102,28 @@ static void rtl8125d_hw_phy_config(struc
+ 	rtl8125_config_eee_phy(phydev);
+ }
+ 
++static void rtl8125bp_hw_phy_config(struct rtl8169_private *tp,
++				    struct phy_device *phydev)
++{
++	r8169_apply_firmware(tp);
++	rtl8168g_enable_gphy_10m(phydev);
++
++	r8168g_phy_param(phydev, 0x8010, 0x0800, 0x0000);
++
++	phy_write(phydev, 0x1f, 0x0b87);
++	phy_write(phydev, 0x16, 0x8088);
++	phy_modify(phydev, 0x17, 0xff00, 0x9000);
++	phy_write(phydev, 0x16, 0x808f);
++	phy_modify(phydev, 0x17, 0xff00, 0x9000);
++	phy_write(phydev, 0x1f, 0x0000);
++
++	r8168g_phy_param(phydev, 0x8174, 0x2000, 0x1800);
++
++	rtl8125_legacy_force_mode(phydev);
++	rtl8168g_disable_aldps(phydev);
++	rtl8125_config_eee_phy(phydev);
++}
++
+ static void rtl8126a_hw_phy_config(struct rtl8169_private *tp,
+ 				   struct phy_device *phydev)
+ {
+@@ -1163,6 +1185,7 @@ void r8169_hw_phy_config(struct rtl8169_
+ 		[RTL_GIGA_MAC_VER_63] = rtl8125b_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_64] = rtl8125d_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_65] = rtl8125d_hw_phy_config,
++		[RTL_GIGA_MAC_VER_66] = rtl8125bp_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_70] = rtl8126a_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_71] = rtl8126a_hw_phy_config,
+ 	};
diff --git a/6.12/target/linux/generic/backport-6.12/781-15-v6.13-net-phy-realtek-read-duplex-and-gbit-master-from-PHY.patch b/6.12/target/linux/generic/backport-6.12/781-15-v6.13-net-phy-realtek-read-duplex-and-gbit-master-from-PHY.patch
new file mode 100644
index 00000000..e15218b1
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/781-15-v6.13-net-phy-realtek-read-duplex-and-gbit-master-from-PHY.patch
@@ -0,0 +1,106 @@
+From 081c9c0265c91b8333165aa6230c20bcbc6f7cbf Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Thu, 10 Oct 2024 14:07:16 +0100
+Subject: [PATCH 3/5] net: phy: realtek: read duplex and gbit master from PHYSR
+ register
+
+The PHYSR MMD register is present and defined equally for all RTL82xx
+Ethernet PHYs.
+Read duplex and Gbit master bits from rtlgen_decode_speed() and rename
+it to rtlgen_decode_physr().
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Link: https://patch.msgid.link/b9a76341da851a18c985bc4774fa295babec79bb.1728565530.git.daniel@makrotopia.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/phy/realtek.c | 41 +++++++++++++++++++++++++++++++--------
+ 1 file changed, 33 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -80,15 +80,18 @@
+ 
+ #define RTL822X_VND2_GANLPAR				0xa414
+ 
+-#define RTL822X_VND2_PHYSR				0xa434
+-
+ #define RTL8366RB_POWER_SAVE			0x15
+ #define RTL8366RB_POWER_SAVE_ON			BIT(12)
+ 
+ #define RTL9000A_GINMR				0x14
+ #define RTL9000A_GINMR_LINK_STATUS		BIT(4)
+ 
+-#define RTLGEN_SPEED_MASK			0x0630
++#define RTL_VND2_PHYSR				0xa434
++#define RTL_VND2_PHYSR_DUPLEX			BIT(3)
++#define RTL_VND2_PHYSR_SPEEDL			GENMASK(5, 4)
++#define RTL_VND2_PHYSR_SPEEDH			GENMASK(10, 9)
++#define RTL_VND2_PHYSR_MASTER			BIT(11)
++#define RTL_VND2_PHYSR_SPEED_MASK		(RTL_VND2_PHYSR_SPEEDL | RTL_VND2_PHYSR_SPEEDH)
+ 
+ #define RTL_GENERIC_PHYID			0x001cc800
+ #define RTL_8211FVD_PHYID			0x001cc878
+@@ -660,9 +663,18 @@ static int rtl8366rb_config_init(struct
+ }
+ 
+ /* get actual speed to cover the downshift case */
+-static void rtlgen_decode_speed(struct phy_device *phydev, int val)
++static void rtlgen_decode_physr(struct phy_device *phydev, int val)
+ {
+-	switch (val & RTLGEN_SPEED_MASK) {
++	/* bit 3
++	 * 0: Half Duplex
++	 * 1: Full Duplex
++	 */
++	if (val & RTL_VND2_PHYSR_DUPLEX)
++		phydev->duplex = DUPLEX_FULL;
++	else
++		phydev->duplex = DUPLEX_HALF;
++
++	switch (val & RTL_VND2_PHYSR_SPEED_MASK) {
+ 	case 0x0000:
+ 		phydev->speed = SPEED_10;
+ 		break;
+@@ -684,6 +696,19 @@ static void rtlgen_decode_speed(struct p
+ 	default:
+ 		break;
+ 	}
++
++	/* bit 11
++	 * 0: Slave Mode
++	 * 1: Master Mode
++	 */
++	if (phydev->speed >= 1000) {
++		if (val & RTL_VND2_PHYSR_MASTER)
++			phydev->master_slave_state = MASTER_SLAVE_STATE_MASTER;
++		else
++			phydev->master_slave_state = MASTER_SLAVE_STATE_SLAVE;
++	} else {
++		phydev->master_slave_state = MASTER_SLAVE_STATE_UNSUPPORTED;
++	}
+ }
+ 
+ static int rtlgen_read_status(struct phy_device *phydev)
+@@ -701,7 +726,7 @@ static int rtlgen_read_status(struct phy
+ 	if (val < 0)
+ 		return val;
+ 
+-	rtlgen_decode_speed(phydev, val);
++	rtlgen_decode_physr(phydev, val);
+ 
+ 	return 0;
+ }
+@@ -1007,11 +1032,11 @@ static int rtl822x_c45_read_status(struc
+ 		return 0;
+ 
+ 	/* Read actual speed from vendor register. */
+-	val = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL822X_VND2_PHYSR);
++	val = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL_VND2_PHYSR);
+ 	if (val < 0)
+ 		return val;
+ 
+-	rtlgen_decode_speed(phydev, val);
++	rtlgen_decode_physr(phydev, val);
+ 
+ 	return 0;
+ }
diff --git a/6.12/target/linux/generic/backport-6.12/781-16-v6.13-net-phy-realtek-change-order-of-calls-in-C22-read_st.patch b/6.12/target/linux/generic/backport-6.12/781-16-v6.13-net-phy-realtek-change-order-of-calls-in-C22-read_st.patch
new file mode 100644
index 00000000..be7136b3
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/781-16-v6.13-net-phy-realtek-change-order-of-calls-in-C22-read_st.patch
@@ -0,0 +1,54 @@
+From 68d5cd09e8919679ce13b85950debea4b2e98e04 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Thu, 10 Oct 2024 14:07:26 +0100
+Subject: [PATCH 4/5] net: phy: realtek: change order of calls in C22
+ read_status()
+
+Always call rtlgen_read_status() first, so genphy_read_status() which
+is called by it clears bits in case auto-negotiation has not completed.
+Also clear 10GBT link-partner advertisement bits in case auto-negotiation
+is disabled or has not completed.
+
+Suggested-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Link: https://patch.msgid.link/b15929a41621d215c6b2b57393368086589569ec.1728565530.git.daniel@makrotopia.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/phy/realtek.c | 22 +++++++++++++++-------
+ 1 file changed, 15 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -949,17 +949,25 @@ static void rtl822xb_update_interface(st
+ 
+ static int rtl822x_read_status(struct phy_device *phydev)
+ {
+-	if (phydev->autoneg == AUTONEG_ENABLE) {
+-		int lpadv = phy_read_paged(phydev, 0xa5d, 0x13);
++	int lpadv, ret;
+ 
+-		if (lpadv < 0)
+-			return lpadv;
++	ret = rtlgen_read_status(phydev);
++	if (ret < 0)
++		return ret;
+ 
+-		mii_10gbt_stat_mod_linkmode_lpa_t(phydev->lp_advertising,
+-						  lpadv);
++	if (phydev->autoneg == AUTONEG_DISABLE ||
++	    !phydev->autoneg_complete) {
++		mii_10gbt_stat_mod_linkmode_lpa_t(phydev->lp_advertising, 0);
++		return 0;
+ 	}
+ 
+-	return rtlgen_read_status(phydev);
++	lpadv = phy_read_paged(phydev, 0xa5d, 0x13);
++	if (lpadv < 0)
++		return lpadv;
++
++	mii_10gbt_stat_mod_linkmode_lpa_t(phydev->lp_advertising, lpadv);
++
++	return 0;
+ }
+ 
+ static int rtl822xb_read_status(struct phy_device *phydev)
diff --git a/6.12/target/linux/generic/backport-6.12/781-17-v6.13-net-phy-realtek-clear-1000Base-T-link-partner-advert.patch b/6.12/target/linux/generic/backport-6.12/781-17-v6.13-net-phy-realtek-clear-1000Base-T-link-partner-advert.patch
new file mode 100644
index 00000000..3847d580
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/781-17-v6.13-net-phy-realtek-clear-1000Base-T-link-partner-advert.patch
@@ -0,0 +1,30 @@
+From 5cb409b3960e75467cbb0a8e1e5596b4490570e3 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Thu, 10 Oct 2024 14:07:39 +0100
+Subject: [PATCH 5/5] net: phy: realtek: clear 1000Base-T link partner
+ advertisement
+
+Clear 1000Base-T link partner advertisement bits in Clause-45
+read_status() function in case auto-negotiation is disabled or has not
+been completed.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Link: https://patch.msgid.link/9dc9b47b2d675708afef3ad366bfd78eb584d958.1728565530.git.daniel@makrotopia.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/phy/realtek.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -1026,6 +1026,10 @@ static int rtl822x_c45_read_status(struc
+ 	if (ret < 0)
+ 		return ret;
+ 
++	if (phydev->autoneg == AUTONEG_DISABLE ||
++	    !genphy_c45_aneg_done(phydev))
++		mii_stat1000_mod_linkmode_lpa_t(phydev->lp_advertising, 0);
++
+ 	/* Vendor register as C45 has no standardized support for 1000BaseT */
+ 	if (phydev->autoneg == AUTONEG_ENABLE) {
+ 		val = phy_read_mmd(phydev, MDIO_MMD_VEND2,
diff --git a/6.12/target/linux/generic/backport-6.12/781-18-v6.13-net-phy-realtek-merge-the-drivers-for-internal-NBase.patch b/6.12/target/linux/generic/backport-6.12/781-18-v6.13-net-phy-realtek-merge-the-drivers-for-internal-NBase.patch
new file mode 100644
index 00000000..771f60df
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/781-18-v6.13-net-phy-realtek-merge-the-drivers-for-internal-NBase.patch
@@ -0,0 +1,136 @@
+From f87a17ed3b51fba4dfdd8f8b643b5423a85fc551 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Tue, 15 Oct 2024 07:47:14 +0200
+Subject: [PATCH] net: phy: realtek: merge the drivers for internal NBase-T
+ PHY's
+
+The Realtek RTL8125/RTL8126 NBase-T MAC/PHY chips have internal PHY's
+which are register-compatible, at least for the registers we use here.
+So let's use just one PHY driver to support all of them.
+These internal PHY's exist also as external C45 PHY's, but on the
+internal PHY's no access to MMD registers is possible. This can be
+used to differentiate between the internal and external version.
+
+As a side effect the drivers for two now external-only drivers don't
+require read_mmd/write_mmd hooks any longer.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/c57081a6-811f-4571-ab35-34f4ca6de9af@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/phy/realtek.c | 53 +++++++++++++++++++++++++++++++--------
+ 1 file changed, 43 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -95,6 +95,7 @@
+ 
+ #define RTL_GENERIC_PHYID			0x001cc800
+ #define RTL_8211FVD_PHYID			0x001cc878
++#define RTL_8221B				0x001cc840
+ #define RTL_8221B_VB_CG				0x001cc849
+ #define RTL_8221B_VN_CG				0x001cc84a
+ #define RTL_8251B				0x001cc862
+@@ -1077,6 +1078,23 @@ static bool rtlgen_supports_2_5gbps(stru
+ 	return val >= 0 && val & MDIO_PMA_SPEED_2_5G;
+ }
+ 
++/* On internal PHY's MMD reads over C22 always return 0.
++ * Check a MMD register which is known to be non-zero.
++ */
++static bool rtlgen_supports_mmd(struct phy_device *phydev)
++{
++	int val;
++
++	phy_lock_mdio_bus(phydev);
++	__phy_write(phydev, MII_MMD_CTRL, MDIO_MMD_PCS);
++	__phy_write(phydev, MII_MMD_DATA, MDIO_PCS_EEE_ABLE);
++	__phy_write(phydev, MII_MMD_CTRL, MDIO_MMD_PCS | MII_MMD_CTRL_NOINCR);
++	val = __phy_read(phydev, MII_MMD_DATA);
++	phy_unlock_mdio_bus(phydev);
++
++	return val > 0;
++}
++
+ static int rtlgen_match_phy_device(struct phy_device *phydev)
+ {
+ 	return phydev->phy_id == RTL_GENERIC_PHYID &&
+@@ -1086,7 +1104,8 @@ static int rtlgen_match_phy_device(struc
+ static int rtl8226_match_phy_device(struct phy_device *phydev)
+ {
+ 	return phydev->phy_id == RTL_GENERIC_PHYID &&
+-	       rtlgen_supports_2_5gbps(phydev);
++	       rtlgen_supports_2_5gbps(phydev) &&
++	       rtlgen_supports_mmd(phydev);
+ }
+ 
+ static int rtlgen_is_c45_match(struct phy_device *phydev, unsigned int id,
+@@ -1098,6 +1117,11 @@ static int rtlgen_is_c45_match(struct ph
+ 		return !is_c45 && (id == phydev->phy_id);
+ }
+ 
++static int rtl8221b_match_phy_device(struct phy_device *phydev)
++{
++	return phydev->phy_id == RTL_8221B && rtlgen_supports_mmd(phydev);
++}
++
+ static int rtl8221b_vb_cg_c22_match_phy_device(struct phy_device *phydev)
+ {
+ 	return rtlgen_is_c45_match(phydev, RTL_8221B_VB_CG, false);
+@@ -1118,9 +1142,21 @@ static int rtl8221b_vn_cg_c45_match_phy_
+ 	return rtlgen_is_c45_match(phydev, RTL_8221B_VN_CG, true);
+ }
+ 
+-static int rtl8251b_c22_match_phy_device(struct phy_device *phydev)
++static int rtl_internal_nbaset_match_phy_device(struct phy_device *phydev)
+ {
+-	return rtlgen_is_c45_match(phydev, RTL_8251B, false);
++	if (phydev->is_c45)
++		return false;
++
++	switch (phydev->phy_id) {
++	case RTL_GENERIC_PHYID:
++	case RTL_8221B:
++	case RTL_8251B:
++		break;
++	default:
++		return false;
++	}
++
++	return rtlgen_supports_2_5gbps(phydev) && !rtlgen_supports_mmd(phydev);
+ }
+ 
+ static int rtl8251b_c45_match_phy_device(struct phy_device *phydev)
+@@ -1382,10 +1418,8 @@ static struct phy_driver realtek_drvs[]
+ 		.resume		= rtlgen_resume,
+ 		.read_page	= rtl821x_read_page,
+ 		.write_page	= rtl821x_write_page,
+-		.read_mmd	= rtl822x_read_mmd,
+-		.write_mmd	= rtl822x_write_mmd,
+ 	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc840),
++		.match_phy_device = rtl8221b_match_phy_device,
+ 		.name		= "RTL8226B_RTL8221B 2.5Gbps PHY",
+ 		.get_features	= rtl822x_get_features,
+ 		.config_aneg	= rtl822x_config_aneg,
+@@ -1396,8 +1430,6 @@ static struct phy_driver realtek_drvs[]
+ 		.resume		= rtlgen_resume,
+ 		.read_page	= rtl821x_read_page,
+ 		.write_page	= rtl821x_write_page,
+-		.read_mmd	= rtl822x_read_mmd,
+-		.write_mmd	= rtl822x_write_mmd,
+ 	}, {
+ 		PHY_ID_MATCH_EXACT(0x001cc838),
+ 		.name           = "RTL8226-CG 2.5Gbps PHY",
+@@ -1475,8 +1507,9 @@ static struct phy_driver realtek_drvs[]
+ 		.read_page      = rtl821x_read_page,
+ 		.write_page     = rtl821x_write_page,
+ 	}, {
+-		.match_phy_device = rtl8251b_c22_match_phy_device,
+-		.name           = "RTL8126A-internal 5Gbps PHY",
++		.match_phy_device = rtl_internal_nbaset_match_phy_device,
++		.name           = "Realtek Internal NBASE-T PHY",
++		.flags		= PHY_IS_INTERNAL,
+ 		.get_features   = rtl822x_get_features,
+ 		.config_aneg    = rtl822x_config_aneg,
+ 		.read_status    = rtl822x_read_status,
diff --git a/6.12/target/linux/generic/backport-6.12/781-19-v6.13-net-phy-realtek-add-RTL8125D-internal-PHY.patch b/6.12/target/linux/generic/backport-6.12/781-19-v6.13-net-phy-realtek-add-RTL8125D-internal-PHY.patch
new file mode 100644
index 00000000..4b9b9e8d
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/781-19-v6.13-net-phy-realtek-add-RTL8125D-internal-PHY.patch
@@ -0,0 +1,29 @@
+From 8989bad541133c43550bff2b80edbe37b8fb9659 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Thu, 17 Oct 2024 18:01:13 +0200
+Subject: [PATCH] net: phy: realtek: add RTL8125D-internal PHY
+
+The first boards show up with Realtek's RTL8125D. This MAC/PHY chip
+comes with an integrated 2.5Gbps PHY with ID 0x001cc841. It's not
+clear yet whether there's an external version of this PHY and how
+Realtek calls it, therefore use the numeric id for now.
+
+Link: https://lore.kernel.org/netdev/2ada65e1-5dfa-456c-9334-2bc51272e9da@gmail.com/T/
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Message-ID: <7d2924de-053b-44d2-a479-870dc3878170@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+---
+ drivers/net/phy/realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -1151,6 +1151,7 @@ static int rtl_internal_nbaset_match_phy
+ 	case RTL_GENERIC_PHYID:
+ 	case RTL_8221B:
+ 	case RTL_8251B:
++	case 0x001cc841:
+ 		break;
+ 	default:
+ 		return false;
diff --git a/6.12/target/linux/generic/backport-6.12/781-20-v6.14-net-phy-realtek-clear-1000Base-T-lpa-if-link-is-down.patch b/6.12/target/linux/generic/backport-6.12/781-20-v6.14-net-phy-realtek-clear-1000Base-T-lpa-if-link-is-down.patch
new file mode 100644
index 00000000..3e9631e4
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/781-20-v6.14-net-phy-realtek-clear-1000Base-T-lpa-if-link-is-down.patch
@@ -0,0 +1,52 @@
+From 34d5a86ff7bbe225fba3ad91f9b4dc85fb408e18 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Wed, 15 Jan 2025 14:43:35 +0000
+Subject: [PATCH] net: phy: realtek: clear 1000Base-T lpa if link is down
+
+Only read 1000Base-T link partner advertisement if autonegotiation has
+completed and otherwise 1000Base-T link partner advertisement bits.
+
+This fixes bogus 1000Base-T link partner advertisement after link goes
+down (eg. by disconnecting the wire).
+Fixes: 5cb409b3960e ("net: phy: realtek: clear 1000Base-T link partner advertisement")
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/realtek.c | 19 ++++++++-----------
+ 1 file changed, 8 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -1023,23 +1023,20 @@ static int rtl822x_c45_read_status(struc
+ {
+ 	int ret, val;
+ 
+-	ret = genphy_c45_read_status(phydev);
+-	if (ret < 0)
+-		return ret;
+-
+-	if (phydev->autoneg == AUTONEG_DISABLE ||
+-	    !genphy_c45_aneg_done(phydev))
+-		mii_stat1000_mod_linkmode_lpa_t(phydev->lp_advertising, 0);
+-
+ 	/* Vendor register as C45 has no standardized support for 1000BaseT */
+-	if (phydev->autoneg == AUTONEG_ENABLE) {
++	if (phydev->autoneg == AUTONEG_ENABLE && genphy_c45_aneg_done(phydev)) {
+ 		val = phy_read_mmd(phydev, MDIO_MMD_VEND2,
+ 				   RTL822X_VND2_GANLPAR);
+ 		if (val < 0)
+ 			return val;
+-
+-		mii_stat1000_mod_linkmode_lpa_t(phydev->lp_advertising, val);
++	} else {
++		val = 0;
+ 	}
++	mii_stat1000_mod_linkmode_lpa_t(phydev->lp_advertising, val);
++
++	ret = genphy_c45_read_status(phydev);
++	if (ret < 0)
++		return ret;
+ 
+ 	if (!phydev->link)
+ 		return 0;
diff --git a/6.12/target/linux/generic/backport-6.12/781-21-v6.14-net-phy-realtek-clear-master_slave_state-if-link-is-.patch b/6.12/target/linux/generic/backport-6.12/781-21-v6.14-net-phy-realtek-clear-master_slave_state-if-link-is-.patch
new file mode 100644
index 00000000..778602d3
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/781-21-v6.14-net-phy-realtek-clear-master_slave_state-if-link-is-.patch
@@ -0,0 +1,35 @@
+From ea8318cb33e593bbfc59d637eae45a69732c5387 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Wed, 15 Jan 2025 14:43:43 +0000
+Subject: [PATCH] net: phy: realtek: clear master_slave_state if link is down
+
+rtlgen_decode_physr() which sets master_slave_state isn't called in case
+the link is down and other than rtlgen_read_status(),
+rtl822x_c45_read_status() doesn't implicitely clear master_slave_state.
+
+Avoid stale master_slave_state by always setting it to
+MASTER_SLAVE_STATE_UNKNOWN in rtl822x_c45_read_status() in case the link
+is down.
+
+Fixes: 081c9c0265c9 ("net: phy: realtek: read duplex and gbit master from PHYSR register")
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/realtek.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -1038,8 +1038,10 @@ static int rtl822x_c45_read_status(struc
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	if (!phydev->link)
++	if (!phydev->link) {
++		phydev->master_slave_state = MASTER_SLAVE_STATE_UNKNOWN;
+ 		return 0;
++	}
+ 
+ 	/* Read actual speed from vendor register. */
+ 	val = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL_VND2_PHYSR);
diff --git a/6.12/target/linux/generic/backport-6.12/781-22-v6.14-net-phy-realtek-always-clear-NBase-T-lpa.patch b/6.12/target/linux/generic/backport-6.12/781-22-v6.14-net-phy-realtek-always-clear-NBase-T-lpa.patch
new file mode 100644
index 00000000..d365ed0a
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/781-22-v6.14-net-phy-realtek-always-clear-NBase-T-lpa.patch
@@ -0,0 +1,42 @@
+From d3eb58549842c60ed46f37da7f4da969e3d6ecd3 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Wed, 15 Jan 2025 14:45:00 +0000
+Subject: [PATCH] net: phy: realtek: always clear NBase-T lpa
+
+Clear NBase-T link partner advertisement before calling
+rtlgen_read_status() to avoid phy_resolve_aneg_linkmode() wrongly
+setting speed and duplex.
+
+This fixes bogus 2.5G/5G/10G link partner advertisement and thus
+speed and duplex being set by phy_resolve_aneg_linkmode() due to stale
+NBase-T lpa.
+
+Fixes: 68d5cd09e891 ("net: phy: realtek: change order of calls in C22 read_status()")
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/realtek.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -952,15 +952,15 @@ static int rtl822x_read_status(struct ph
+ {
+ 	int lpadv, ret;
+ 
++	mii_10gbt_stat_mod_linkmode_lpa_t(phydev->lp_advertising, 0);
++
+ 	ret = rtlgen_read_status(phydev);
+ 	if (ret < 0)
+ 		return ret;
+ 
+ 	if (phydev->autoneg == AUTONEG_DISABLE ||
+-	    !phydev->autoneg_complete) {
+-		mii_10gbt_stat_mod_linkmode_lpa_t(phydev->lp_advertising, 0);
++	    !phydev->autoneg_complete)
+ 		return 0;
+-	}
+ 
+ 	lpadv = phy_read_paged(phydev, 0xa5d, 0x13);
+ 	if (lpadv < 0)
diff --git a/6.12/target/linux/generic/backport-6.12/781-23-v6.14-net-phy-realtek-add-support-for-reading-MDIO_MMD_VEN.patch b/6.12/target/linux/generic/backport-6.12/781-23-v6.14-net-phy-realtek-add-support-for-reading-MDIO_MMD_VEN.patch
new file mode 100644
index 00000000..2add672f
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/781-23-v6.14-net-phy-realtek-add-support-for-reading-MDIO_MMD_VEN.patch
@@ -0,0 +1,47 @@
+From 3d483a10327f38595f714f9f9e9dde43a622cb0f Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Sat, 11 Jan 2025 21:49:31 +0100
+Subject: [PATCH] net: phy: realtek: add support for reading MDIO_MMD_VEND2
+ regs on RTL8125/RTL8126
+
+RTL8125/RTL8126 don't support MMD access to the internal PHY, but
+provide a mechanism to access at least all MDIO_MMD_VEND2 registers.
+By exposing this mechanism standard MMD access functions can be used
+to access the MDIO_MMD_VEND2 registers.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/e821b302-5fe6-49ab-aabd-05da500581c0@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/realtek.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -736,7 +736,11 @@ static int rtlgen_read_mmd(struct phy_de
+ {
+ 	int ret;
+ 
+-	if (devnum == MDIO_MMD_PCS && regnum == MDIO_PCS_EEE_ABLE) {
++	if (devnum == MDIO_MMD_VEND2) {
++		rtl821x_write_page(phydev, regnum >> 4);
++		ret = __phy_read(phydev, 0x10 + ((regnum & 0xf) >> 1));
++		rtl821x_write_page(phydev, 0);
++	} else if (devnum == MDIO_MMD_PCS && regnum == MDIO_PCS_EEE_ABLE) {
+ 		rtl821x_write_page(phydev, 0xa5c);
+ 		ret = __phy_read(phydev, 0x12);
+ 		rtl821x_write_page(phydev, 0);
+@@ -760,7 +764,11 @@ static int rtlgen_write_mmd(struct phy_d
+ {
+ 	int ret;
+ 
+-	if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV) {
++	if (devnum == MDIO_MMD_VEND2) {
++		rtl821x_write_page(phydev, regnum >> 4);
++		ret = __phy_write(phydev, 0x10 + ((regnum & 0xf) >> 1), val);
++		rtl821x_write_page(phydev, 0);
++	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV) {
+ 		rtl821x_write_page(phydev, 0xa5d);
+ 		ret = __phy_write(phydev, 0x10, val);
+ 		rtl821x_write_page(phydev, 0);
diff --git a/6.12/target/linux/generic/backport-6.12/781-24-v6.14-net-phy-move-realtek-PHY-driver-to-its-own-subdirect.patch b/6.12/target/linux/generic/backport-6.12/781-24-v6.14-net-phy-move-realtek-PHY-driver-to-its-own-subdirect.patch
new file mode 100644
index 00000000..5f0b61e0
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/781-24-v6.14-net-phy-move-realtek-PHY-driver-to-its-own-subdirect.patch
@@ -0,0 +1,3247 @@
+From 1416a9b2ba710d31954131c06d46f298e340aa2c Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Sat, 11 Jan 2025 21:50:19 +0100
+Subject: [PATCH] net: phy: move realtek PHY driver to its own subdirectory
+
+In preparation of adding a source file with hwmon support, move the
+Realtek PHY driver to its own subdirectory and rename realtek.c to
+realtek_main.c.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/c566551b-c915-4e34-9b33-129a6ddd6e4c@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/Kconfig                               | 5 +----
+ drivers/net/phy/Makefile                              | 2 +-
+ drivers/net/phy/realtek/Kconfig                       | 5 +++++
+ drivers/net/phy/realtek/Makefile                      | 3 +++
+ drivers/net/phy/{realtek.c => realtek/realtek_main.c} | 0
+ 5 files changed, 10 insertions(+), 5 deletions(-)
+ create mode 100644 drivers/net/phy/realtek/Kconfig
+ create mode 100644 drivers/net/phy/realtek/Makefile
+ rename drivers/net/phy/{realtek.c => realtek/realtek_main.c} (100%)
+
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -358,10 +358,7 @@ config QSEMI_PHY
+ 	help
+ 	  Currently supports the qs6612
+ 
+-config REALTEK_PHY
+-	tristate "Realtek PHYs"
+-	help
+-	  Supports the Realtek 821x PHY.
++source "drivers/net/phy/realtek/Kconfig"
+ 
+ config RENESAS_PHY
+ 	tristate "Renesas PHYs"
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -95,7 +95,7 @@ obj-$(CONFIG_NXP_CBTX_PHY)	+= nxp-cbtx.o
+ obj-$(CONFIG_NXP_TJA11XX_PHY)	+= nxp-tja11xx.o
+ obj-y				+= qcom/
+ obj-$(CONFIG_QSEMI_PHY)		+= qsemi.o
+-obj-$(CONFIG_REALTEK_PHY)	+= realtek.o
++obj-$(CONFIG_REALTEK_PHY)	+= realtek/
+ obj-$(CONFIG_RENESAS_PHY)	+= uPD60620.o
+ obj-$(CONFIG_ROCKCHIP_PHY)	+= rockchip.o
+ obj-$(CONFIG_SMSC_PHY)		+= smsc.o
+--- /dev/null
++++ b/drivers/net/phy/realtek/Kconfig
+@@ -0,0 +1,5 @@
++# SPDX-License-Identifier: GPL-2.0-only
++config REALTEK_PHY
++	tristate "Realtek PHYs"
++	help
++	  Currently supports RTL821x/RTL822x and fast ethernet PHYs
+--- /dev/null
++++ b/drivers/net/phy/realtek/Makefile
+@@ -0,0 +1,3 @@
++# SPDX-License-Identifier: GPL-2.0
++realtek-y			+= realtek_main.o
++obj-$(CONFIG_REALTEK_PHY)	+= realtek.o
+--- a/drivers/net/phy/realtek.c
++++ /dev/null
+@@ -1,1589 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0+
+-/* drivers/net/phy/realtek.c
+- *
+- * Driver for Realtek PHYs
+- *
+- * Author: Johnson Leung <r58129@freescale.com>
+- *
+- * Copyright (c) 2004 Freescale Semiconductor, Inc.
+- */
+-#include <linux/bitops.h>
+-#include <linux/of.h>
+-#include <linux/phy.h>
+-#include <linux/module.h>
+-#include <linux/delay.h>
+-#include <linux/clk.h>
+-
+-#define RTL821x_PHYSR				0x11
+-#define RTL821x_PHYSR_DUPLEX			BIT(13)
+-#define RTL821x_PHYSR_SPEED			GENMASK(15, 14)
+-
+-#define RTL821x_INER				0x12
+-#define RTL8211B_INER_INIT			0x6400
+-#define RTL8211E_INER_LINK_STATUS		BIT(10)
+-#define RTL8211F_INER_LINK_STATUS		BIT(4)
+-
+-#define RTL821x_INSR				0x13
+-
+-#define RTL821x_EXT_PAGE_SELECT			0x1e
+-#define RTL821x_PAGE_SELECT			0x1f
+-
+-#define RTL8211F_PHYCR1				0x18
+-#define RTL8211F_PHYCR2				0x19
+-#define RTL8211F_INSR				0x1d
+-
+-#define RTL8211F_LEDCR				0x10
+-#define RTL8211F_LEDCR_MODE			BIT(15)
+-#define RTL8211F_LEDCR_ACT_TXRX			BIT(4)
+-#define RTL8211F_LEDCR_LINK_1000		BIT(3)
+-#define RTL8211F_LEDCR_LINK_100			BIT(1)
+-#define RTL8211F_LEDCR_LINK_10			BIT(0)
+-#define RTL8211F_LEDCR_MASK			GENMASK(4, 0)
+-#define RTL8211F_LEDCR_SHIFT			5
+-
+-#define RTL8211F_TX_DELAY			BIT(8)
+-#define RTL8211F_RX_DELAY			BIT(3)
+-
+-#define RTL8211F_ALDPS_PLL_OFF			BIT(1)
+-#define RTL8211F_ALDPS_ENABLE			BIT(2)
+-#define RTL8211F_ALDPS_XTAL_OFF			BIT(12)
+-
+-#define RTL8211E_CTRL_DELAY			BIT(13)
+-#define RTL8211E_TX_DELAY			BIT(12)
+-#define RTL8211E_RX_DELAY			BIT(11)
+-
+-#define RTL8211F_CLKOUT_EN			BIT(0)
+-
+-#define RTL8201F_ISR				0x1e
+-#define RTL8201F_ISR_ANERR			BIT(15)
+-#define RTL8201F_ISR_DUPLEX			BIT(13)
+-#define RTL8201F_ISR_LINK			BIT(11)
+-#define RTL8201F_ISR_MASK			(RTL8201F_ISR_ANERR | \
+-						 RTL8201F_ISR_DUPLEX | \
+-						 RTL8201F_ISR_LINK)
+-#define RTL8201F_IER				0x13
+-
+-#define RTL822X_VND1_SERDES_OPTION			0x697a
+-#define RTL822X_VND1_SERDES_OPTION_MODE_MASK		GENMASK(5, 0)
+-#define RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX_SGMII		0
+-#define RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX		2
+-
+-#define RTL822X_VND1_SERDES_CTRL3			0x7580
+-#define RTL822X_VND1_SERDES_CTRL3_MODE_MASK		GENMASK(5, 0)
+-#define RTL822X_VND1_SERDES_CTRL3_MODE_SGMII			0x02
+-#define RTL822X_VND1_SERDES_CTRL3_MODE_2500BASEX		0x16
+-
+-/* RTL822X_VND2_XXXXX registers are only accessible when phydev->is_c45
+- * is set, they cannot be accessed by C45-over-C22.
+- */
+-#define RTL822X_VND2_GBCR				0xa412
+-
+-#define RTL822X_VND2_GANLPAR				0xa414
+-
+-#define RTL8366RB_POWER_SAVE			0x15
+-#define RTL8366RB_POWER_SAVE_ON			BIT(12)
+-
+-#define RTL9000A_GINMR				0x14
+-#define RTL9000A_GINMR_LINK_STATUS		BIT(4)
+-
+-#define RTL_VND2_PHYSR				0xa434
+-#define RTL_VND2_PHYSR_DUPLEX			BIT(3)
+-#define RTL_VND2_PHYSR_SPEEDL			GENMASK(5, 4)
+-#define RTL_VND2_PHYSR_SPEEDH			GENMASK(10, 9)
+-#define RTL_VND2_PHYSR_MASTER			BIT(11)
+-#define RTL_VND2_PHYSR_SPEED_MASK		(RTL_VND2_PHYSR_SPEEDL | RTL_VND2_PHYSR_SPEEDH)
+-
+-#define RTL_GENERIC_PHYID			0x001cc800
+-#define RTL_8211FVD_PHYID			0x001cc878
+-#define RTL_8221B				0x001cc840
+-#define RTL_8221B_VB_CG				0x001cc849
+-#define RTL_8221B_VN_CG				0x001cc84a
+-#define RTL_8251B				0x001cc862
+-
+-#define RTL8211F_LED_COUNT			3
+-
+-MODULE_DESCRIPTION("Realtek PHY driver");
+-MODULE_AUTHOR("Johnson Leung");
+-MODULE_LICENSE("GPL");
+-
+-struct rtl821x_priv {
+-	u16 phycr1;
+-	u16 phycr2;
+-	bool has_phycr2;
+-	struct clk *clk;
+-};
+-
+-static int rtl821x_read_page(struct phy_device *phydev)
+-{
+-	return __phy_read(phydev, RTL821x_PAGE_SELECT);
+-}
+-
+-static int rtl821x_write_page(struct phy_device *phydev, int page)
+-{
+-	return __phy_write(phydev, RTL821x_PAGE_SELECT, page);
+-}
+-
+-static int rtl821x_probe(struct phy_device *phydev)
+-{
+-	struct device *dev = &phydev->mdio.dev;
+-	struct rtl821x_priv *priv;
+-	u32 phy_id = phydev->drv->phy_id;
+-	int ret;
+-
+-	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+-	if (!priv)
+-		return -ENOMEM;
+-
+-	priv->clk = devm_clk_get_optional_enabled(dev, NULL);
+-	if (IS_ERR(priv->clk))
+-		return dev_err_probe(dev, PTR_ERR(priv->clk),
+-				     "failed to get phy clock\n");
+-
+-	ret = phy_read_paged(phydev, 0xa43, RTL8211F_PHYCR1);
+-	if (ret < 0)
+-		return ret;
+-
+-	priv->phycr1 = ret & (RTL8211F_ALDPS_PLL_OFF | RTL8211F_ALDPS_ENABLE | RTL8211F_ALDPS_XTAL_OFF);
+-	if (of_property_read_bool(dev->of_node, "realtek,aldps-enable"))
+-		priv->phycr1 |= RTL8211F_ALDPS_PLL_OFF | RTL8211F_ALDPS_ENABLE | RTL8211F_ALDPS_XTAL_OFF;
+-
+-	priv->has_phycr2 = !(phy_id == RTL_8211FVD_PHYID);
+-	if (priv->has_phycr2) {
+-		ret = phy_read_paged(phydev, 0xa43, RTL8211F_PHYCR2);
+-		if (ret < 0)
+-			return ret;
+-
+-		priv->phycr2 = ret & RTL8211F_CLKOUT_EN;
+-		if (of_property_read_bool(dev->of_node, "realtek,clkout-disable"))
+-			priv->phycr2 &= ~RTL8211F_CLKOUT_EN;
+-	}
+-
+-	phydev->priv = priv;
+-
+-	return 0;
+-}
+-
+-static int rtl8201_ack_interrupt(struct phy_device *phydev)
+-{
+-	int err;
+-
+-	err = phy_read(phydev, RTL8201F_ISR);
+-
+-	return (err < 0) ? err : 0;
+-}
+-
+-static int rtl821x_ack_interrupt(struct phy_device *phydev)
+-{
+-	int err;
+-
+-	err = phy_read(phydev, RTL821x_INSR);
+-
+-	return (err < 0) ? err : 0;
+-}
+-
+-static int rtl8211f_ack_interrupt(struct phy_device *phydev)
+-{
+-	int err;
+-
+-	err = phy_read_paged(phydev, 0xa43, RTL8211F_INSR);
+-
+-	return (err < 0) ? err : 0;
+-}
+-
+-static int rtl8201_config_intr(struct phy_device *phydev)
+-{
+-	u16 val;
+-	int err;
+-
+-	if (phydev->interrupts == PHY_INTERRUPT_ENABLED) {
+-		err = rtl8201_ack_interrupt(phydev);
+-		if (err)
+-			return err;
+-
+-		val = BIT(13) | BIT(12) | BIT(11);
+-		err = phy_write_paged(phydev, 0x7, RTL8201F_IER, val);
+-	} else {
+-		val = 0;
+-		err = phy_write_paged(phydev, 0x7, RTL8201F_IER, val);
+-		if (err)
+-			return err;
+-
+-		err = rtl8201_ack_interrupt(phydev);
+-	}
+-
+-	return err;
+-}
+-
+-static int rtl8211b_config_intr(struct phy_device *phydev)
+-{
+-	int err;
+-
+-	if (phydev->interrupts == PHY_INTERRUPT_ENABLED) {
+-		err = rtl821x_ack_interrupt(phydev);
+-		if (err)
+-			return err;
+-
+-		err = phy_write(phydev, RTL821x_INER,
+-				RTL8211B_INER_INIT);
+-	} else {
+-		err = phy_write(phydev, RTL821x_INER, 0);
+-		if (err)
+-			return err;
+-
+-		err = rtl821x_ack_interrupt(phydev);
+-	}
+-
+-	return err;
+-}
+-
+-static int rtl8211e_config_intr(struct phy_device *phydev)
+-{
+-	int err;
+-
+-	if (phydev->interrupts == PHY_INTERRUPT_ENABLED) {
+-		err = rtl821x_ack_interrupt(phydev);
+-		if (err)
+-			return err;
+-
+-		err = phy_write(phydev, RTL821x_INER,
+-				RTL8211E_INER_LINK_STATUS);
+-	} else {
+-		err = phy_write(phydev, RTL821x_INER, 0);
+-		if (err)
+-			return err;
+-
+-		err = rtl821x_ack_interrupt(phydev);
+-	}
+-
+-	return err;
+-}
+-
+-static int rtl8211f_config_intr(struct phy_device *phydev)
+-{
+-	u16 val;
+-	int err;
+-
+-	if (phydev->interrupts == PHY_INTERRUPT_ENABLED) {
+-		err = rtl8211f_ack_interrupt(phydev);
+-		if (err)
+-			return err;
+-
+-		val = RTL8211F_INER_LINK_STATUS;
+-		err = phy_write_paged(phydev, 0xa42, RTL821x_INER, val);
+-	} else {
+-		val = 0;
+-		err = phy_write_paged(phydev, 0xa42, RTL821x_INER, val);
+-		if (err)
+-			return err;
+-
+-		err = rtl8211f_ack_interrupt(phydev);
+-	}
+-
+-	return err;
+-}
+-
+-static irqreturn_t rtl8201_handle_interrupt(struct phy_device *phydev)
+-{
+-	int irq_status;
+-
+-	irq_status = phy_read(phydev, RTL8201F_ISR);
+-	if (irq_status < 0) {
+-		phy_error(phydev);
+-		return IRQ_NONE;
+-	}
+-
+-	if (!(irq_status & RTL8201F_ISR_MASK))
+-		return IRQ_NONE;
+-
+-	phy_trigger_machine(phydev);
+-
+-	return IRQ_HANDLED;
+-}
+-
+-static irqreturn_t rtl821x_handle_interrupt(struct phy_device *phydev)
+-{
+-	int irq_status, irq_enabled;
+-
+-	irq_status = phy_read(phydev, RTL821x_INSR);
+-	if (irq_status < 0) {
+-		phy_error(phydev);
+-		return IRQ_NONE;
+-	}
+-
+-	irq_enabled = phy_read(phydev, RTL821x_INER);
+-	if (irq_enabled < 0) {
+-		phy_error(phydev);
+-		return IRQ_NONE;
+-	}
+-
+-	if (!(irq_status & irq_enabled))
+-		return IRQ_NONE;
+-
+-	phy_trigger_machine(phydev);
+-
+-	return IRQ_HANDLED;
+-}
+-
+-static irqreturn_t rtl8211f_handle_interrupt(struct phy_device *phydev)
+-{
+-	int irq_status;
+-
+-	irq_status = phy_read_paged(phydev, 0xa43, RTL8211F_INSR);
+-	if (irq_status < 0) {
+-		phy_error(phydev);
+-		return IRQ_NONE;
+-	}
+-
+-	if (!(irq_status & RTL8211F_INER_LINK_STATUS))
+-		return IRQ_NONE;
+-
+-	phy_trigger_machine(phydev);
+-
+-	return IRQ_HANDLED;
+-}
+-
+-static int rtl8211_config_aneg(struct phy_device *phydev)
+-{
+-	int ret;
+-
+-	ret = genphy_config_aneg(phydev);
+-	if (ret < 0)
+-		return ret;
+-
+-	/* Quirk was copied from vendor driver. Unfortunately it includes no
+-	 * description of the magic numbers.
+-	 */
+-	if (phydev->speed == SPEED_100 && phydev->autoneg == AUTONEG_DISABLE) {
+-		phy_write(phydev, 0x17, 0x2138);
+-		phy_write(phydev, 0x0e, 0x0260);
+-	} else {
+-		phy_write(phydev, 0x17, 0x2108);
+-		phy_write(phydev, 0x0e, 0x0000);
+-	}
+-
+-	return 0;
+-}
+-
+-static int rtl8211c_config_init(struct phy_device *phydev)
+-{
+-	/* RTL8211C has an issue when operating in Gigabit slave mode */
+-	return phy_set_bits(phydev, MII_CTRL1000,
+-			    CTL1000_ENABLE_MASTER | CTL1000_AS_MASTER);
+-}
+-
+-static int rtl8211f_config_init(struct phy_device *phydev)
+-{
+-	struct rtl821x_priv *priv = phydev->priv;
+-	struct device *dev = &phydev->mdio.dev;
+-	u16 val_txdly, val_rxdly;
+-	int ret;
+-
+-	ret = phy_modify_paged_changed(phydev, 0xa43, RTL8211F_PHYCR1,
+-				       RTL8211F_ALDPS_PLL_OFF | RTL8211F_ALDPS_ENABLE | RTL8211F_ALDPS_XTAL_OFF,
+-				       priv->phycr1);
+-	if (ret < 0) {
+-		dev_err(dev, "aldps mode  configuration failed: %pe\n",
+-			ERR_PTR(ret));
+-		return ret;
+-	}
+-
+-	switch (phydev->interface) {
+-	case PHY_INTERFACE_MODE_RGMII:
+-		val_txdly = 0;
+-		val_rxdly = 0;
+-		break;
+-
+-	case PHY_INTERFACE_MODE_RGMII_RXID:
+-		val_txdly = 0;
+-		val_rxdly = RTL8211F_RX_DELAY;
+-		break;
+-
+-	case PHY_INTERFACE_MODE_RGMII_TXID:
+-		val_txdly = RTL8211F_TX_DELAY;
+-		val_rxdly = 0;
+-		break;
+-
+-	case PHY_INTERFACE_MODE_RGMII_ID:
+-		val_txdly = RTL8211F_TX_DELAY;
+-		val_rxdly = RTL8211F_RX_DELAY;
+-		break;
+-
+-	default: /* the rest of the modes imply leaving delay as is. */
+-		return 0;
+-	}
+-
+-	ret = phy_modify_paged_changed(phydev, 0xd08, 0x11, RTL8211F_TX_DELAY,
+-				       val_txdly);
+-	if (ret < 0) {
+-		dev_err(dev, "Failed to update the TX delay register\n");
+-		return ret;
+-	} else if (ret) {
+-		dev_dbg(dev,
+-			"%s 2ns TX delay (and changing the value from pin-strapping RXD1 or the bootloader)\n",
+-			val_txdly ? "Enabling" : "Disabling");
+-	} else {
+-		dev_dbg(dev,
+-			"2ns TX delay was already %s (by pin-strapping RXD1 or bootloader configuration)\n",
+-			val_txdly ? "enabled" : "disabled");
+-	}
+-
+-	ret = phy_modify_paged_changed(phydev, 0xd08, 0x15, RTL8211F_RX_DELAY,
+-				       val_rxdly);
+-	if (ret < 0) {
+-		dev_err(dev, "Failed to update the RX delay register\n");
+-		return ret;
+-	} else if (ret) {
+-		dev_dbg(dev,
+-			"%s 2ns RX delay (and changing the value from pin-strapping RXD0 or the bootloader)\n",
+-			val_rxdly ? "Enabling" : "Disabling");
+-	} else {
+-		dev_dbg(dev,
+-			"2ns RX delay was already %s (by pin-strapping RXD0 or bootloader configuration)\n",
+-			val_rxdly ? "enabled" : "disabled");
+-	}
+-
+-	if (priv->has_phycr2) {
+-		ret = phy_modify_paged(phydev, 0xa43, RTL8211F_PHYCR2,
+-				       RTL8211F_CLKOUT_EN, priv->phycr2);
+-		if (ret < 0) {
+-			dev_err(dev, "clkout configuration failed: %pe\n",
+-				ERR_PTR(ret));
+-			return ret;
+-		}
+-
+-		return genphy_soft_reset(phydev);
+-	}
+-
+-	return 0;
+-}
+-
+-static int rtl821x_suspend(struct phy_device *phydev)
+-{
+-	struct rtl821x_priv *priv = phydev->priv;
+-	int ret = 0;
+-
+-	if (!phydev->wol_enabled) {
+-		ret = genphy_suspend(phydev);
+-
+-		if (ret)
+-			return ret;
+-
+-		clk_disable_unprepare(priv->clk);
+-	}
+-
+-	return ret;
+-}
+-
+-static int rtl821x_resume(struct phy_device *phydev)
+-{
+-	struct rtl821x_priv *priv = phydev->priv;
+-	int ret;
+-
+-	if (!phydev->wol_enabled)
+-		clk_prepare_enable(priv->clk);
+-
+-	ret = genphy_resume(phydev);
+-	if (ret < 0)
+-		return ret;
+-
+-	msleep(20);
+-
+-	return 0;
+-}
+-
+-static int rtl8211f_led_hw_is_supported(struct phy_device *phydev, u8 index,
+-					unsigned long rules)
+-{
+-	const unsigned long mask = BIT(TRIGGER_NETDEV_LINK_10) |
+-				   BIT(TRIGGER_NETDEV_LINK_100) |
+-				   BIT(TRIGGER_NETDEV_LINK_1000) |
+-				   BIT(TRIGGER_NETDEV_RX) |
+-				   BIT(TRIGGER_NETDEV_TX);
+-
+-	/* The RTL8211F PHY supports these LED settings on up to three LEDs:
+-	 * - Link: Configurable subset of 10/100/1000 link rates
+-	 * - Active: Blink on activity, RX or TX is not differentiated
+-	 * The Active option has two modes, A and B:
+-	 * - A: Link and Active indication at configurable, but matching,
+-	 *      subset of 10/100/1000 link rates
+-	 * - B: Link indication at configurable subset of 10/100/1000 link
+-	 *      rates and Active indication always at all three 10+100+1000
+-	 *      link rates.
+-	 * This code currently uses mode B only.
+-	 */
+-
+-	if (index >= RTL8211F_LED_COUNT)
+-		return -EINVAL;
+-
+-	/* Filter out any other unsupported triggers. */
+-	if (rules & ~mask)
+-		return -EOPNOTSUPP;
+-
+-	/* RX and TX are not differentiated, either both are set or not set. */
+-	if (!(rules & BIT(TRIGGER_NETDEV_RX)) ^ !(rules & BIT(TRIGGER_NETDEV_TX)))
+-		return -EOPNOTSUPP;
+-
+-	return 0;
+-}
+-
+-static int rtl8211f_led_hw_control_get(struct phy_device *phydev, u8 index,
+-				       unsigned long *rules)
+-{
+-	int val;
+-
+-	if (index >= RTL8211F_LED_COUNT)
+-		return -EINVAL;
+-
+-	val = phy_read_paged(phydev, 0xd04, RTL8211F_LEDCR);
+-	if (val < 0)
+-		return val;
+-
+-	val >>= RTL8211F_LEDCR_SHIFT * index;
+-	val &= RTL8211F_LEDCR_MASK;
+-
+-	if (val & RTL8211F_LEDCR_LINK_10)
+-		set_bit(TRIGGER_NETDEV_LINK_10, rules);
+-
+-	if (val & RTL8211F_LEDCR_LINK_100)
+-		set_bit(TRIGGER_NETDEV_LINK_100, rules);
+-
+-	if (val & RTL8211F_LEDCR_LINK_1000)
+-		set_bit(TRIGGER_NETDEV_LINK_1000, rules);
+-
+-	if (val & RTL8211F_LEDCR_ACT_TXRX) {
+-		set_bit(TRIGGER_NETDEV_RX, rules);
+-		set_bit(TRIGGER_NETDEV_TX, rules);
+-	}
+-
+-	return 0;
+-}
+-
+-static int rtl8211f_led_hw_control_set(struct phy_device *phydev, u8 index,
+-				       unsigned long rules)
+-{
+-	const u16 mask = RTL8211F_LEDCR_MASK << (RTL8211F_LEDCR_SHIFT * index);
+-	u16 reg = 0;
+-
+-	if (index >= RTL8211F_LED_COUNT)
+-		return -EINVAL;
+-
+-	if (test_bit(TRIGGER_NETDEV_LINK_10, &rules))
+-		reg |= RTL8211F_LEDCR_LINK_10;
+-
+-	if (test_bit(TRIGGER_NETDEV_LINK_100, &rules))
+-		reg |= RTL8211F_LEDCR_LINK_100;
+-
+-	if (test_bit(TRIGGER_NETDEV_LINK_1000, &rules))
+-		reg |= RTL8211F_LEDCR_LINK_1000;
+-
+-	if (test_bit(TRIGGER_NETDEV_RX, &rules) ||
+-	    test_bit(TRIGGER_NETDEV_TX, &rules)) {
+-		reg |= RTL8211F_LEDCR_ACT_TXRX;
+-	}
+-
+-	reg <<= RTL8211F_LEDCR_SHIFT * index;
+-	reg |= RTL8211F_LEDCR_MODE;	 /* Mode B */
+-
+-	return phy_modify_paged(phydev, 0xd04, RTL8211F_LEDCR, mask, reg);
+-}
+-
+-static int rtl8211e_config_init(struct phy_device *phydev)
+-{
+-	int ret = 0, oldpage;
+-	u16 val;
+-
+-	/* enable TX/RX delay for rgmii-* modes, and disable them for rgmii. */
+-	switch (phydev->interface) {
+-	case PHY_INTERFACE_MODE_RGMII:
+-		val = RTL8211E_CTRL_DELAY | 0;
+-		break;
+-	case PHY_INTERFACE_MODE_RGMII_ID:
+-		val = RTL8211E_CTRL_DELAY | RTL8211E_TX_DELAY | RTL8211E_RX_DELAY;
+-		break;
+-	case PHY_INTERFACE_MODE_RGMII_RXID:
+-		val = RTL8211E_CTRL_DELAY | RTL8211E_RX_DELAY;
+-		break;
+-	case PHY_INTERFACE_MODE_RGMII_TXID:
+-		val = RTL8211E_CTRL_DELAY | RTL8211E_TX_DELAY;
+-		break;
+-	default: /* the rest of the modes imply leaving delays as is. */
+-		return 0;
+-	}
+-
+-	/* According to a sample driver there is a 0x1c config register on the
+-	 * 0xa4 extension page (0x7) layout. It can be used to disable/enable
+-	 * the RX/TX delays otherwise controlled by RXDLY/TXDLY pins.
+-	 * The configuration register definition:
+-	 * 14 = reserved
+-	 * 13 = Force Tx RX Delay controlled by bit12 bit11,
+-	 * 12 = RX Delay, 11 = TX Delay
+-	 * 10:0 = Test && debug settings reserved by realtek
+-	 */
+-	oldpage = phy_select_page(phydev, 0x7);
+-	if (oldpage < 0)
+-		goto err_restore_page;
+-
+-	ret = __phy_write(phydev, RTL821x_EXT_PAGE_SELECT, 0xa4);
+-	if (ret)
+-		goto err_restore_page;
+-
+-	ret = __phy_modify(phydev, 0x1c, RTL8211E_CTRL_DELAY
+-			   | RTL8211E_TX_DELAY | RTL8211E_RX_DELAY,
+-			   val);
+-
+-err_restore_page:
+-	return phy_restore_page(phydev, oldpage, ret);
+-}
+-
+-static int rtl8211b_suspend(struct phy_device *phydev)
+-{
+-	phy_write(phydev, MII_MMD_DATA, BIT(9));
+-
+-	return genphy_suspend(phydev);
+-}
+-
+-static int rtl8211b_resume(struct phy_device *phydev)
+-{
+-	phy_write(phydev, MII_MMD_DATA, 0);
+-
+-	return genphy_resume(phydev);
+-}
+-
+-static int rtl8366rb_config_init(struct phy_device *phydev)
+-{
+-	int ret;
+-
+-	ret = phy_set_bits(phydev, RTL8366RB_POWER_SAVE,
+-			   RTL8366RB_POWER_SAVE_ON);
+-	if (ret) {
+-		dev_err(&phydev->mdio.dev,
+-			"error enabling power management\n");
+-	}
+-
+-	return ret;
+-}
+-
+-/* get actual speed to cover the downshift case */
+-static void rtlgen_decode_physr(struct phy_device *phydev, int val)
+-{
+-	/* bit 3
+-	 * 0: Half Duplex
+-	 * 1: Full Duplex
+-	 */
+-	if (val & RTL_VND2_PHYSR_DUPLEX)
+-		phydev->duplex = DUPLEX_FULL;
+-	else
+-		phydev->duplex = DUPLEX_HALF;
+-
+-	switch (val & RTL_VND2_PHYSR_SPEED_MASK) {
+-	case 0x0000:
+-		phydev->speed = SPEED_10;
+-		break;
+-	case 0x0010:
+-		phydev->speed = SPEED_100;
+-		break;
+-	case 0x0020:
+-		phydev->speed = SPEED_1000;
+-		break;
+-	case 0x0200:
+-		phydev->speed = SPEED_10000;
+-		break;
+-	case 0x0210:
+-		phydev->speed = SPEED_2500;
+-		break;
+-	case 0x0220:
+-		phydev->speed = SPEED_5000;
+-		break;
+-	default:
+-		break;
+-	}
+-
+-	/* bit 11
+-	 * 0: Slave Mode
+-	 * 1: Master Mode
+-	 */
+-	if (phydev->speed >= 1000) {
+-		if (val & RTL_VND2_PHYSR_MASTER)
+-			phydev->master_slave_state = MASTER_SLAVE_STATE_MASTER;
+-		else
+-			phydev->master_slave_state = MASTER_SLAVE_STATE_SLAVE;
+-	} else {
+-		phydev->master_slave_state = MASTER_SLAVE_STATE_UNSUPPORTED;
+-	}
+-}
+-
+-static int rtlgen_read_status(struct phy_device *phydev)
+-{
+-	int ret, val;
+-
+-	ret = genphy_read_status(phydev);
+-	if (ret < 0)
+-		return ret;
+-
+-	if (!phydev->link)
+-		return 0;
+-
+-	val = phy_read_paged(phydev, 0xa43, 0x12);
+-	if (val < 0)
+-		return val;
+-
+-	rtlgen_decode_physr(phydev, val);
+-
+-	return 0;
+-}
+-
+-static int rtlgen_read_mmd(struct phy_device *phydev, int devnum, u16 regnum)
+-{
+-	int ret;
+-
+-	if (devnum == MDIO_MMD_VEND2) {
+-		rtl821x_write_page(phydev, regnum >> 4);
+-		ret = __phy_read(phydev, 0x10 + ((regnum & 0xf) >> 1));
+-		rtl821x_write_page(phydev, 0);
+-	} else if (devnum == MDIO_MMD_PCS && regnum == MDIO_PCS_EEE_ABLE) {
+-		rtl821x_write_page(phydev, 0xa5c);
+-		ret = __phy_read(phydev, 0x12);
+-		rtl821x_write_page(phydev, 0);
+-	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV) {
+-		rtl821x_write_page(phydev, 0xa5d);
+-		ret = __phy_read(phydev, 0x10);
+-		rtl821x_write_page(phydev, 0);
+-	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_LPABLE) {
+-		rtl821x_write_page(phydev, 0xa5d);
+-		ret = __phy_read(phydev, 0x11);
+-		rtl821x_write_page(phydev, 0);
+-	} else {
+-		ret = -EOPNOTSUPP;
+-	}
+-
+-	return ret;
+-}
+-
+-static int rtlgen_write_mmd(struct phy_device *phydev, int devnum, u16 regnum,
+-			    u16 val)
+-{
+-	int ret;
+-
+-	if (devnum == MDIO_MMD_VEND2) {
+-		rtl821x_write_page(phydev, regnum >> 4);
+-		ret = __phy_write(phydev, 0x10 + ((regnum & 0xf) >> 1), val);
+-		rtl821x_write_page(phydev, 0);
+-	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV) {
+-		rtl821x_write_page(phydev, 0xa5d);
+-		ret = __phy_write(phydev, 0x10, val);
+-		rtl821x_write_page(phydev, 0);
+-	} else {
+-		ret = -EOPNOTSUPP;
+-	}
+-
+-	return ret;
+-}
+-
+-static int rtl822x_read_mmd(struct phy_device *phydev, int devnum, u16 regnum)
+-{
+-	int ret = rtlgen_read_mmd(phydev, devnum, regnum);
+-
+-	if (ret != -EOPNOTSUPP)
+-		return ret;
+-
+-	if (devnum == MDIO_MMD_PCS && regnum == MDIO_PCS_EEE_ABLE2) {
+-		rtl821x_write_page(phydev, 0xa6e);
+-		ret = __phy_read(phydev, 0x16);
+-		rtl821x_write_page(phydev, 0);
+-	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV2) {
+-		rtl821x_write_page(phydev, 0xa6d);
+-		ret = __phy_read(phydev, 0x12);
+-		rtl821x_write_page(phydev, 0);
+-	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_LPABLE2) {
+-		rtl821x_write_page(phydev, 0xa6d);
+-		ret = __phy_read(phydev, 0x10);
+-		rtl821x_write_page(phydev, 0);
+-	}
+-
+-	return ret;
+-}
+-
+-static int rtl822x_write_mmd(struct phy_device *phydev, int devnum, u16 regnum,
+-			     u16 val)
+-{
+-	int ret = rtlgen_write_mmd(phydev, devnum, regnum, val);
+-
+-	if (ret != -EOPNOTSUPP)
+-		return ret;
+-
+-	if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV2) {
+-		rtl821x_write_page(phydev, 0xa6d);
+-		ret = __phy_write(phydev, 0x12, val);
+-		rtl821x_write_page(phydev, 0);
+-	}
+-
+-	return ret;
+-}
+-
+-static int rtl822xb_config_init(struct phy_device *phydev)
+-{
+-	bool has_2500, has_sgmii;
+-	u16 mode;
+-	int ret;
+-
+-	has_2500 = test_bit(PHY_INTERFACE_MODE_2500BASEX,
+-			    phydev->host_interfaces) ||
+-		   phydev->interface == PHY_INTERFACE_MODE_2500BASEX;
+-
+-	has_sgmii = test_bit(PHY_INTERFACE_MODE_SGMII,
+-			     phydev->host_interfaces) ||
+-		    phydev->interface == PHY_INTERFACE_MODE_SGMII;
+-
+-	/* fill in possible interfaces */
+-	__assign_bit(PHY_INTERFACE_MODE_2500BASEX, phydev->possible_interfaces,
+-		     has_2500);
+-	__assign_bit(PHY_INTERFACE_MODE_SGMII, phydev->possible_interfaces,
+-		     has_sgmii);
+-
+-	if (!has_2500 && !has_sgmii)
+-		return 0;
+-
+-	/* determine SerDes option mode */
+-	if (has_2500 && !has_sgmii) {
+-		mode = RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX;
+-		phydev->rate_matching = RATE_MATCH_PAUSE;
+-	} else {
+-		mode = RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX_SGMII;
+-		phydev->rate_matching = RATE_MATCH_NONE;
+-	}
+-
+-	/* the following sequence with magic numbers sets up the SerDes
+-	 * option mode
+-	 */
+-	ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x75f3, 0);
+-	if (ret < 0)
+-		return ret;
+-
+-	ret = phy_modify_mmd_changed(phydev, MDIO_MMD_VEND1,
+-				     RTL822X_VND1_SERDES_OPTION,
+-				     RTL822X_VND1_SERDES_OPTION_MODE_MASK,
+-				     mode);
+-	if (ret < 0)
+-		return ret;
+-
+-	ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x6a04, 0x0503);
+-	if (ret < 0)
+-		return ret;
+-
+-	ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x6f10, 0xd455);
+-	if (ret < 0)
+-		return ret;
+-
+-	return phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x6f11, 0x8020);
+-}
+-
+-static int rtl822xb_get_rate_matching(struct phy_device *phydev,
+-				      phy_interface_t iface)
+-{
+-	int val;
+-
+-	/* Only rate matching at 2500base-x */
+-	if (iface != PHY_INTERFACE_MODE_2500BASEX)
+-		return RATE_MATCH_NONE;
+-
+-	val = phy_read_mmd(phydev, MDIO_MMD_VEND1, RTL822X_VND1_SERDES_OPTION);
+-	if (val < 0)
+-		return val;
+-
+-	if ((val & RTL822X_VND1_SERDES_OPTION_MODE_MASK) ==
+-	    RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX)
+-		return RATE_MATCH_PAUSE;
+-
+-	/* RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX_SGMII */
+-	return RATE_MATCH_NONE;
+-}
+-
+-static int rtl822x_get_features(struct phy_device *phydev)
+-{
+-	int val;
+-
+-	val = phy_read_paged(phydev, 0xa61, 0x13);
+-	if (val < 0)
+-		return val;
+-
+-	linkmode_mod_bit(ETHTOOL_LINK_MODE_2500baseT_Full_BIT,
+-			 phydev->supported, val & MDIO_PMA_SPEED_2_5G);
+-	linkmode_mod_bit(ETHTOOL_LINK_MODE_5000baseT_Full_BIT,
+-			 phydev->supported, val & MDIO_PMA_SPEED_5G);
+-	linkmode_mod_bit(ETHTOOL_LINK_MODE_10000baseT_Full_BIT,
+-			 phydev->supported, val & MDIO_SPEED_10G);
+-
+-	return genphy_read_abilities(phydev);
+-}
+-
+-static int rtl822x_config_aneg(struct phy_device *phydev)
+-{
+-	int ret = 0;
+-
+-	if (phydev->autoneg == AUTONEG_ENABLE) {
+-		u16 adv = linkmode_adv_to_mii_10gbt_adv_t(phydev->advertising);
+-
+-		ret = phy_modify_paged_changed(phydev, 0xa5d, 0x12,
+-					       MDIO_AN_10GBT_CTRL_ADV2_5G |
+-					       MDIO_AN_10GBT_CTRL_ADV5G,
+-					       adv);
+-		if (ret < 0)
+-			return ret;
+-	}
+-
+-	return __genphy_config_aneg(phydev, ret);
+-}
+-
+-static void rtl822xb_update_interface(struct phy_device *phydev)
+-{
+-	int val;
+-
+-	if (!phydev->link)
+-		return;
+-
+-	/* Change interface according to serdes mode */
+-	val = phy_read_mmd(phydev, MDIO_MMD_VEND1, RTL822X_VND1_SERDES_CTRL3);
+-	if (val < 0)
+-		return;
+-
+-	switch (val & RTL822X_VND1_SERDES_CTRL3_MODE_MASK) {
+-	case RTL822X_VND1_SERDES_CTRL3_MODE_2500BASEX:
+-		phydev->interface = PHY_INTERFACE_MODE_2500BASEX;
+-		break;
+-	case RTL822X_VND1_SERDES_CTRL3_MODE_SGMII:
+-		phydev->interface = PHY_INTERFACE_MODE_SGMII;
+-		break;
+-	}
+-}
+-
+-static int rtl822x_read_status(struct phy_device *phydev)
+-{
+-	int lpadv, ret;
+-
+-	mii_10gbt_stat_mod_linkmode_lpa_t(phydev->lp_advertising, 0);
+-
+-	ret = rtlgen_read_status(phydev);
+-	if (ret < 0)
+-		return ret;
+-
+-	if (phydev->autoneg == AUTONEG_DISABLE ||
+-	    !phydev->autoneg_complete)
+-		return 0;
+-
+-	lpadv = phy_read_paged(phydev, 0xa5d, 0x13);
+-	if (lpadv < 0)
+-		return lpadv;
+-
+-	mii_10gbt_stat_mod_linkmode_lpa_t(phydev->lp_advertising, lpadv);
+-
+-	return 0;
+-}
+-
+-static int rtl822xb_read_status(struct phy_device *phydev)
+-{
+-	int ret;
+-
+-	ret = rtl822x_read_status(phydev);
+-	if (ret < 0)
+-		return ret;
+-
+-	rtl822xb_update_interface(phydev);
+-
+-	return 0;
+-}
+-
+-static int rtl822x_c45_get_features(struct phy_device *phydev)
+-{
+-	linkmode_set_bit(ETHTOOL_LINK_MODE_TP_BIT,
+-			 phydev->supported);
+-
+-	return genphy_c45_pma_read_abilities(phydev);
+-}
+-
+-static int rtl822x_c45_config_aneg(struct phy_device *phydev)
+-{
+-	bool changed = false;
+-	int ret, val;
+-
+-	if (phydev->autoneg == AUTONEG_DISABLE)
+-		return genphy_c45_pma_setup_forced(phydev);
+-
+-	ret = genphy_c45_an_config_aneg(phydev);
+-	if (ret < 0)
+-		return ret;
+-	if (ret > 0)
+-		changed = true;
+-
+-	val = linkmode_adv_to_mii_ctrl1000_t(phydev->advertising);
+-
+-	/* Vendor register as C45 has no standardized support for 1000BaseT */
+-	ret = phy_modify_mmd_changed(phydev, MDIO_MMD_VEND2, RTL822X_VND2_GBCR,
+-				     ADVERTISE_1000FULL, val);
+-	if (ret < 0)
+-		return ret;
+-	if (ret > 0)
+-		changed = true;
+-
+-	return genphy_c45_check_and_restart_aneg(phydev, changed);
+-}
+-
+-static int rtl822x_c45_read_status(struct phy_device *phydev)
+-{
+-	int ret, val;
+-
+-	/* Vendor register as C45 has no standardized support for 1000BaseT */
+-	if (phydev->autoneg == AUTONEG_ENABLE && genphy_c45_aneg_done(phydev)) {
+-		val = phy_read_mmd(phydev, MDIO_MMD_VEND2,
+-				   RTL822X_VND2_GANLPAR);
+-		if (val < 0)
+-			return val;
+-	} else {
+-		val = 0;
+-	}
+-	mii_stat1000_mod_linkmode_lpa_t(phydev->lp_advertising, val);
+-
+-	ret = genphy_c45_read_status(phydev);
+-	if (ret < 0)
+-		return ret;
+-
+-	if (!phydev->link) {
+-		phydev->master_slave_state = MASTER_SLAVE_STATE_UNKNOWN;
+-		return 0;
+-	}
+-
+-	/* Read actual speed from vendor register. */
+-	val = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL_VND2_PHYSR);
+-	if (val < 0)
+-		return val;
+-
+-	rtlgen_decode_physr(phydev, val);
+-
+-	return 0;
+-}
+-
+-static int rtl822xb_c45_read_status(struct phy_device *phydev)
+-{
+-	int ret;
+-
+-	ret = rtl822x_c45_read_status(phydev);
+-	if (ret < 0)
+-		return ret;
+-
+-	rtl822xb_update_interface(phydev);
+-
+-	return 0;
+-}
+-
+-static bool rtlgen_supports_2_5gbps(struct phy_device *phydev)
+-{
+-	int val;
+-
+-	phy_write(phydev, RTL821x_PAGE_SELECT, 0xa61);
+-	val = phy_read(phydev, 0x13);
+-	phy_write(phydev, RTL821x_PAGE_SELECT, 0);
+-
+-	return val >= 0 && val & MDIO_PMA_SPEED_2_5G;
+-}
+-
+-/* On internal PHY's MMD reads over C22 always return 0.
+- * Check a MMD register which is known to be non-zero.
+- */
+-static bool rtlgen_supports_mmd(struct phy_device *phydev)
+-{
+-	int val;
+-
+-	phy_lock_mdio_bus(phydev);
+-	__phy_write(phydev, MII_MMD_CTRL, MDIO_MMD_PCS);
+-	__phy_write(phydev, MII_MMD_DATA, MDIO_PCS_EEE_ABLE);
+-	__phy_write(phydev, MII_MMD_CTRL, MDIO_MMD_PCS | MII_MMD_CTRL_NOINCR);
+-	val = __phy_read(phydev, MII_MMD_DATA);
+-	phy_unlock_mdio_bus(phydev);
+-
+-	return val > 0;
+-}
+-
+-static int rtlgen_match_phy_device(struct phy_device *phydev)
+-{
+-	return phydev->phy_id == RTL_GENERIC_PHYID &&
+-	       !rtlgen_supports_2_5gbps(phydev);
+-}
+-
+-static int rtl8226_match_phy_device(struct phy_device *phydev)
+-{
+-	return phydev->phy_id == RTL_GENERIC_PHYID &&
+-	       rtlgen_supports_2_5gbps(phydev) &&
+-	       rtlgen_supports_mmd(phydev);
+-}
+-
+-static int rtlgen_is_c45_match(struct phy_device *phydev, unsigned int id,
+-			       bool is_c45)
+-{
+-	if (phydev->is_c45)
+-		return is_c45 && (id == phydev->c45_ids.device_ids[1]);
+-	else
+-		return !is_c45 && (id == phydev->phy_id);
+-}
+-
+-static int rtl8221b_match_phy_device(struct phy_device *phydev)
+-{
+-	return phydev->phy_id == RTL_8221B && rtlgen_supports_mmd(phydev);
+-}
+-
+-static int rtl8221b_vb_cg_c22_match_phy_device(struct phy_device *phydev)
+-{
+-	return rtlgen_is_c45_match(phydev, RTL_8221B_VB_CG, false);
+-}
+-
+-static int rtl8221b_vb_cg_c45_match_phy_device(struct phy_device *phydev)
+-{
+-	return rtlgen_is_c45_match(phydev, RTL_8221B_VB_CG, true);
+-}
+-
+-static int rtl8221b_vn_cg_c22_match_phy_device(struct phy_device *phydev)
+-{
+-	return rtlgen_is_c45_match(phydev, RTL_8221B_VN_CG, false);
+-}
+-
+-static int rtl8221b_vn_cg_c45_match_phy_device(struct phy_device *phydev)
+-{
+-	return rtlgen_is_c45_match(phydev, RTL_8221B_VN_CG, true);
+-}
+-
+-static int rtl_internal_nbaset_match_phy_device(struct phy_device *phydev)
+-{
+-	if (phydev->is_c45)
+-		return false;
+-
+-	switch (phydev->phy_id) {
+-	case RTL_GENERIC_PHYID:
+-	case RTL_8221B:
+-	case RTL_8251B:
+-	case 0x001cc841:
+-		break;
+-	default:
+-		return false;
+-	}
+-
+-	return rtlgen_supports_2_5gbps(phydev) && !rtlgen_supports_mmd(phydev);
+-}
+-
+-static int rtl8251b_c45_match_phy_device(struct phy_device *phydev)
+-{
+-	return rtlgen_is_c45_match(phydev, RTL_8251B, true);
+-}
+-
+-static int rtlgen_resume(struct phy_device *phydev)
+-{
+-	int ret = genphy_resume(phydev);
+-
+-	/* Internal PHY's from RTL8168h up may not be instantly ready */
+-	msleep(20);
+-
+-	return ret;
+-}
+-
+-static int rtlgen_c45_resume(struct phy_device *phydev)
+-{
+-	int ret = genphy_c45_pma_resume(phydev);
+-
+-	msleep(20);
+-
+-	return ret;
+-}
+-
+-static int rtl9000a_config_init(struct phy_device *phydev)
+-{
+-	phydev->autoneg = AUTONEG_DISABLE;
+-	phydev->speed = SPEED_100;
+-	phydev->duplex = DUPLEX_FULL;
+-
+-	return 0;
+-}
+-
+-static int rtl9000a_config_aneg(struct phy_device *phydev)
+-{
+-	int ret;
+-	u16 ctl = 0;
+-
+-	switch (phydev->master_slave_set) {
+-	case MASTER_SLAVE_CFG_MASTER_FORCE:
+-		ctl |= CTL1000_AS_MASTER;
+-		break;
+-	case MASTER_SLAVE_CFG_SLAVE_FORCE:
+-		break;
+-	case MASTER_SLAVE_CFG_UNKNOWN:
+-	case MASTER_SLAVE_CFG_UNSUPPORTED:
+-		return 0;
+-	default:
+-		phydev_warn(phydev, "Unsupported Master/Slave mode\n");
+-		return -EOPNOTSUPP;
+-	}
+-
+-	ret = phy_modify_changed(phydev, MII_CTRL1000, CTL1000_AS_MASTER, ctl);
+-	if (ret == 1)
+-		ret = genphy_soft_reset(phydev);
+-
+-	return ret;
+-}
+-
+-static int rtl9000a_read_status(struct phy_device *phydev)
+-{
+-	int ret;
+-
+-	phydev->master_slave_get = MASTER_SLAVE_CFG_UNKNOWN;
+-	phydev->master_slave_state = MASTER_SLAVE_STATE_UNKNOWN;
+-
+-	ret = genphy_update_link(phydev);
+-	if (ret)
+-		return ret;
+-
+-	ret = phy_read(phydev, MII_CTRL1000);
+-	if (ret < 0)
+-		return ret;
+-	if (ret & CTL1000_AS_MASTER)
+-		phydev->master_slave_get = MASTER_SLAVE_CFG_MASTER_FORCE;
+-	else
+-		phydev->master_slave_get = MASTER_SLAVE_CFG_SLAVE_FORCE;
+-
+-	ret = phy_read(phydev, MII_STAT1000);
+-	if (ret < 0)
+-		return ret;
+-	if (ret & LPA_1000MSRES)
+-		phydev->master_slave_state = MASTER_SLAVE_STATE_MASTER;
+-	else
+-		phydev->master_slave_state = MASTER_SLAVE_STATE_SLAVE;
+-
+-	return 0;
+-}
+-
+-static int rtl9000a_ack_interrupt(struct phy_device *phydev)
+-{
+-	int err;
+-
+-	err = phy_read(phydev, RTL8211F_INSR);
+-
+-	return (err < 0) ? err : 0;
+-}
+-
+-static int rtl9000a_config_intr(struct phy_device *phydev)
+-{
+-	u16 val;
+-	int err;
+-
+-	if (phydev->interrupts == PHY_INTERRUPT_ENABLED) {
+-		err = rtl9000a_ack_interrupt(phydev);
+-		if (err)
+-			return err;
+-
+-		val = (u16)~RTL9000A_GINMR_LINK_STATUS;
+-		err = phy_write_paged(phydev, 0xa42, RTL9000A_GINMR, val);
+-	} else {
+-		val = ~0;
+-		err = phy_write_paged(phydev, 0xa42, RTL9000A_GINMR, val);
+-		if (err)
+-			return err;
+-
+-		err = rtl9000a_ack_interrupt(phydev);
+-	}
+-
+-	return phy_write_paged(phydev, 0xa42, RTL9000A_GINMR, val);
+-}
+-
+-static irqreturn_t rtl9000a_handle_interrupt(struct phy_device *phydev)
+-{
+-	int irq_status;
+-
+-	irq_status = phy_read(phydev, RTL8211F_INSR);
+-	if (irq_status < 0) {
+-		phy_error(phydev);
+-		return IRQ_NONE;
+-	}
+-
+-	if (!(irq_status & RTL8211F_INER_LINK_STATUS))
+-		return IRQ_NONE;
+-
+-	phy_trigger_machine(phydev);
+-
+-	return IRQ_HANDLED;
+-}
+-
+-static struct phy_driver realtek_drvs[] = {
+-	{
+-		PHY_ID_MATCH_EXACT(0x00008201),
+-		.name           = "RTL8201CP Ethernet",
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc816),
+-		.name		= "RTL8201F Fast Ethernet",
+-		.config_intr	= &rtl8201_config_intr,
+-		.handle_interrupt = rtl8201_handle_interrupt,
+-		.suspend	= genphy_suspend,
+-		.resume		= genphy_resume,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-	}, {
+-		PHY_ID_MATCH_MODEL(0x001cc880),
+-		.name		= "RTL8208 Fast Ethernet",
+-		.read_mmd	= genphy_read_mmd_unsupported,
+-		.write_mmd	= genphy_write_mmd_unsupported,
+-		.suspend	= genphy_suspend,
+-		.resume		= genphy_resume,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc910),
+-		.name		= "RTL8211 Gigabit Ethernet",
+-		.config_aneg	= rtl8211_config_aneg,
+-		.read_mmd	= &genphy_read_mmd_unsupported,
+-		.write_mmd	= &genphy_write_mmd_unsupported,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc912),
+-		.name		= "RTL8211B Gigabit Ethernet",
+-		.config_intr	= &rtl8211b_config_intr,
+-		.handle_interrupt = rtl821x_handle_interrupt,
+-		.read_mmd	= &genphy_read_mmd_unsupported,
+-		.write_mmd	= &genphy_write_mmd_unsupported,
+-		.suspend	= rtl8211b_suspend,
+-		.resume		= rtl8211b_resume,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc913),
+-		.name		= "RTL8211C Gigabit Ethernet",
+-		.config_init	= rtl8211c_config_init,
+-		.read_mmd	= &genphy_read_mmd_unsupported,
+-		.write_mmd	= &genphy_write_mmd_unsupported,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc914),
+-		.name		= "RTL8211DN Gigabit Ethernet",
+-		.config_intr	= rtl8211e_config_intr,
+-		.handle_interrupt = rtl821x_handle_interrupt,
+-		.suspend	= genphy_suspend,
+-		.resume		= genphy_resume,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc915),
+-		.name		= "RTL8211E Gigabit Ethernet",
+-		.config_init	= &rtl8211e_config_init,
+-		.config_intr	= &rtl8211e_config_intr,
+-		.handle_interrupt = rtl821x_handle_interrupt,
+-		.suspend	= genphy_suspend,
+-		.resume		= genphy_resume,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc916),
+-		.name		= "RTL8211F Gigabit Ethernet",
+-		.probe		= rtl821x_probe,
+-		.config_init	= &rtl8211f_config_init,
+-		.read_status	= rtlgen_read_status,
+-		.config_intr	= &rtl8211f_config_intr,
+-		.handle_interrupt = rtl8211f_handle_interrupt,
+-		.suspend	= rtl821x_suspend,
+-		.resume		= rtl821x_resume,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-		.flags		= PHY_ALWAYS_CALL_SUSPEND,
+-		.led_hw_is_supported = rtl8211f_led_hw_is_supported,
+-		.led_hw_control_get = rtl8211f_led_hw_control_get,
+-		.led_hw_control_set = rtl8211f_led_hw_control_set,
+-	}, {
+-		PHY_ID_MATCH_EXACT(RTL_8211FVD_PHYID),
+-		.name		= "RTL8211F-VD Gigabit Ethernet",
+-		.probe		= rtl821x_probe,
+-		.config_init	= &rtl8211f_config_init,
+-		.read_status	= rtlgen_read_status,
+-		.config_intr	= &rtl8211f_config_intr,
+-		.handle_interrupt = rtl8211f_handle_interrupt,
+-		.suspend	= rtl821x_suspend,
+-		.resume		= rtl821x_resume,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-		.flags		= PHY_ALWAYS_CALL_SUSPEND,
+-	}, {
+-		.name		= "Generic FE-GE Realtek PHY",
+-		.match_phy_device = rtlgen_match_phy_device,
+-		.read_status	= rtlgen_read_status,
+-		.suspend	= genphy_suspend,
+-		.resume		= rtlgen_resume,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-		.read_mmd	= rtlgen_read_mmd,
+-		.write_mmd	= rtlgen_write_mmd,
+-	}, {
+-		.name		= "RTL8226 2.5Gbps PHY",
+-		.match_phy_device = rtl8226_match_phy_device,
+-		.get_features	= rtl822x_get_features,
+-		.config_aneg	= rtl822x_config_aneg,
+-		.read_status	= rtl822x_read_status,
+-		.suspend	= genphy_suspend,
+-		.resume		= rtlgen_resume,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-	}, {
+-		.match_phy_device = rtl8221b_match_phy_device,
+-		.name		= "RTL8226B_RTL8221B 2.5Gbps PHY",
+-		.get_features	= rtl822x_get_features,
+-		.config_aneg	= rtl822x_config_aneg,
+-		.config_init    = rtl822xb_config_init,
+-		.get_rate_matching = rtl822xb_get_rate_matching,
+-		.read_status	= rtl822xb_read_status,
+-		.suspend	= genphy_suspend,
+-		.resume		= rtlgen_resume,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc838),
+-		.name           = "RTL8226-CG 2.5Gbps PHY",
+-		.get_features   = rtl822x_get_features,
+-		.config_aneg    = rtl822x_config_aneg,
+-		.read_status    = rtl822x_read_status,
+-		.suspend        = genphy_suspend,
+-		.resume         = rtlgen_resume,
+-		.read_page      = rtl821x_read_page,
+-		.write_page     = rtl821x_write_page,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc848),
+-		.name           = "RTL8226B-CG_RTL8221B-CG 2.5Gbps PHY",
+-		.get_features   = rtl822x_get_features,
+-		.config_aneg    = rtl822x_config_aneg,
+-		.config_init    = rtl822xb_config_init,
+-		.get_rate_matching = rtl822xb_get_rate_matching,
+-		.read_status    = rtl822xb_read_status,
+-		.suspend        = genphy_suspend,
+-		.resume         = rtlgen_resume,
+-		.read_page      = rtl821x_read_page,
+-		.write_page     = rtl821x_write_page,
+-	}, {
+-		.match_phy_device = rtl8221b_vb_cg_c22_match_phy_device,
+-		.name           = "RTL8221B-VB-CG 2.5Gbps PHY (C22)",
+-		.get_features   = rtl822x_get_features,
+-		.config_aneg    = rtl822x_config_aneg,
+-		.config_init    = rtl822xb_config_init,
+-		.get_rate_matching = rtl822xb_get_rate_matching,
+-		.read_status    = rtl822xb_read_status,
+-		.suspend        = genphy_suspend,
+-		.resume         = rtlgen_resume,
+-		.read_page      = rtl821x_read_page,
+-		.write_page     = rtl821x_write_page,
+-	}, {
+-		.match_phy_device = rtl8221b_vb_cg_c45_match_phy_device,
+-		.name           = "RTL8221B-VB-CG 2.5Gbps PHY (C45)",
+-		.config_init    = rtl822xb_config_init,
+-		.get_rate_matching = rtl822xb_get_rate_matching,
+-		.get_features   = rtl822x_c45_get_features,
+-		.config_aneg    = rtl822x_c45_config_aneg,
+-		.read_status    = rtl822xb_c45_read_status,
+-		.suspend        = genphy_c45_pma_suspend,
+-		.resume         = rtlgen_c45_resume,
+-	}, {
+-		.match_phy_device = rtl8221b_vn_cg_c22_match_phy_device,
+-		.name           = "RTL8221B-VM-CG 2.5Gbps PHY (C22)",
+-		.get_features   = rtl822x_get_features,
+-		.config_aneg    = rtl822x_config_aneg,
+-		.config_init    = rtl822xb_config_init,
+-		.get_rate_matching = rtl822xb_get_rate_matching,
+-		.read_status    = rtl822xb_read_status,
+-		.suspend        = genphy_suspend,
+-		.resume         = rtlgen_resume,
+-		.read_page      = rtl821x_read_page,
+-		.write_page     = rtl821x_write_page,
+-	}, {
+-		.match_phy_device = rtl8221b_vn_cg_c45_match_phy_device,
+-		.name           = "RTL8221B-VN-CG 2.5Gbps PHY (C45)",
+-		.config_init    = rtl822xb_config_init,
+-		.get_rate_matching = rtl822xb_get_rate_matching,
+-		.get_features   = rtl822x_c45_get_features,
+-		.config_aneg    = rtl822x_c45_config_aneg,
+-		.read_status    = rtl822xb_c45_read_status,
+-		.suspend        = genphy_c45_pma_suspend,
+-		.resume         = rtlgen_c45_resume,
+-	}, {
+-		.match_phy_device = rtl8251b_c45_match_phy_device,
+-		.name           = "RTL8251B 5Gbps PHY",
+-		.get_features   = rtl822x_get_features,
+-		.config_aneg    = rtl822x_config_aneg,
+-		.read_status    = rtl822x_read_status,
+-		.suspend        = genphy_suspend,
+-		.resume         = rtlgen_resume,
+-		.read_page      = rtl821x_read_page,
+-		.write_page     = rtl821x_write_page,
+-	}, {
+-		.match_phy_device = rtl_internal_nbaset_match_phy_device,
+-		.name           = "Realtek Internal NBASE-T PHY",
+-		.flags		= PHY_IS_INTERNAL,
+-		.get_features   = rtl822x_get_features,
+-		.config_aneg    = rtl822x_config_aneg,
+-		.read_status    = rtl822x_read_status,
+-		.suspend        = genphy_suspend,
+-		.resume         = rtlgen_resume,
+-		.read_page      = rtl821x_read_page,
+-		.write_page     = rtl821x_write_page,
+-		.read_mmd	= rtl822x_read_mmd,
+-		.write_mmd	= rtl822x_write_mmd,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001ccad0),
+-		.name		= "RTL8224 2.5Gbps PHY",
+-		.get_features   = rtl822x_c45_get_features,
+-		.config_aneg    = rtl822x_c45_config_aneg,
+-		.read_status    = rtl822x_c45_read_status,
+-		.suspend        = genphy_c45_pma_suspend,
+-		.resume         = rtlgen_c45_resume,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc961),
+-		.name		= "RTL8366RB Gigabit Ethernet",
+-		.config_init	= &rtl8366rb_config_init,
+-		/* These interrupts are handled by the irq controller
+-		 * embedded inside the RTL8366RB, they get unmasked when the
+-		 * irq is requested and ACKed by reading the status register,
+-		 * which is done by the irqchip code.
+-		 */
+-		.config_intr	= genphy_no_config_intr,
+-		.handle_interrupt = genphy_handle_interrupt_no_ack,
+-		.suspend	= genphy_suspend,
+-		.resume		= genphy_resume,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001ccb00),
+-		.name		= "RTL9000AA_RTL9000AN Ethernet",
+-		.features       = PHY_BASIC_T1_FEATURES,
+-		.config_init	= rtl9000a_config_init,
+-		.config_aneg	= rtl9000a_config_aneg,
+-		.read_status	= rtl9000a_read_status,
+-		.config_intr	= rtl9000a_config_intr,
+-		.handle_interrupt = rtl9000a_handle_interrupt,
+-		.suspend	= genphy_suspend,
+-		.resume		= genphy_resume,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc942),
+-		.name		= "RTL8365MB-VC Gigabit Ethernet",
+-		/* Interrupt handling analogous to RTL8366RB */
+-		.config_intr	= genphy_no_config_intr,
+-		.handle_interrupt = genphy_handle_interrupt_no_ack,
+-		.suspend	= genphy_suspend,
+-		.resume		= genphy_resume,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc960),
+-		.name		= "RTL8366S Gigabit Ethernet",
+-		.suspend	= genphy_suspend,
+-		.resume		= genphy_resume,
+-		.read_mmd	= genphy_read_mmd_unsupported,
+-		.write_mmd	= genphy_write_mmd_unsupported,
+-	},
+-};
+-
+-module_phy_driver(realtek_drvs);
+-
+-static const struct mdio_device_id __maybe_unused realtek_tbl[] = {
+-	{ PHY_ID_MATCH_VENDOR(0x001cc800) },
+-	{ }
+-};
+-
+-MODULE_DEVICE_TABLE(mdio, realtek_tbl);
+--- /dev/null
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -0,0 +1,1589 @@
++// SPDX-License-Identifier: GPL-2.0+
++/* drivers/net/phy/realtek.c
++ *
++ * Driver for Realtek PHYs
++ *
++ * Author: Johnson Leung <r58129@freescale.com>
++ *
++ * Copyright (c) 2004 Freescale Semiconductor, Inc.
++ */
++#include <linux/bitops.h>
++#include <linux/of.h>
++#include <linux/phy.h>
++#include <linux/module.h>
++#include <linux/delay.h>
++#include <linux/clk.h>
++
++#define RTL821x_PHYSR				0x11
++#define RTL821x_PHYSR_DUPLEX			BIT(13)
++#define RTL821x_PHYSR_SPEED			GENMASK(15, 14)
++
++#define RTL821x_INER				0x12
++#define RTL8211B_INER_INIT			0x6400
++#define RTL8211E_INER_LINK_STATUS		BIT(10)
++#define RTL8211F_INER_LINK_STATUS		BIT(4)
++
++#define RTL821x_INSR				0x13
++
++#define RTL821x_EXT_PAGE_SELECT			0x1e
++#define RTL821x_PAGE_SELECT			0x1f
++
++#define RTL8211F_PHYCR1				0x18
++#define RTL8211F_PHYCR2				0x19
++#define RTL8211F_INSR				0x1d
++
++#define RTL8211F_LEDCR				0x10
++#define RTL8211F_LEDCR_MODE			BIT(15)
++#define RTL8211F_LEDCR_ACT_TXRX			BIT(4)
++#define RTL8211F_LEDCR_LINK_1000		BIT(3)
++#define RTL8211F_LEDCR_LINK_100			BIT(1)
++#define RTL8211F_LEDCR_LINK_10			BIT(0)
++#define RTL8211F_LEDCR_MASK			GENMASK(4, 0)
++#define RTL8211F_LEDCR_SHIFT			5
++
++#define RTL8211F_TX_DELAY			BIT(8)
++#define RTL8211F_RX_DELAY			BIT(3)
++
++#define RTL8211F_ALDPS_PLL_OFF			BIT(1)
++#define RTL8211F_ALDPS_ENABLE			BIT(2)
++#define RTL8211F_ALDPS_XTAL_OFF			BIT(12)
++
++#define RTL8211E_CTRL_DELAY			BIT(13)
++#define RTL8211E_TX_DELAY			BIT(12)
++#define RTL8211E_RX_DELAY			BIT(11)
++
++#define RTL8211F_CLKOUT_EN			BIT(0)
++
++#define RTL8201F_ISR				0x1e
++#define RTL8201F_ISR_ANERR			BIT(15)
++#define RTL8201F_ISR_DUPLEX			BIT(13)
++#define RTL8201F_ISR_LINK			BIT(11)
++#define RTL8201F_ISR_MASK			(RTL8201F_ISR_ANERR | \
++						 RTL8201F_ISR_DUPLEX | \
++						 RTL8201F_ISR_LINK)
++#define RTL8201F_IER				0x13
++
++#define RTL822X_VND1_SERDES_OPTION			0x697a
++#define RTL822X_VND1_SERDES_OPTION_MODE_MASK		GENMASK(5, 0)
++#define RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX_SGMII		0
++#define RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX		2
++
++#define RTL822X_VND1_SERDES_CTRL3			0x7580
++#define RTL822X_VND1_SERDES_CTRL3_MODE_MASK		GENMASK(5, 0)
++#define RTL822X_VND1_SERDES_CTRL3_MODE_SGMII			0x02
++#define RTL822X_VND1_SERDES_CTRL3_MODE_2500BASEX		0x16
++
++/* RTL822X_VND2_XXXXX registers are only accessible when phydev->is_c45
++ * is set, they cannot be accessed by C45-over-C22.
++ */
++#define RTL822X_VND2_GBCR				0xa412
++
++#define RTL822X_VND2_GANLPAR				0xa414
++
++#define RTL8366RB_POWER_SAVE			0x15
++#define RTL8366RB_POWER_SAVE_ON			BIT(12)
++
++#define RTL9000A_GINMR				0x14
++#define RTL9000A_GINMR_LINK_STATUS		BIT(4)
++
++#define RTL_VND2_PHYSR				0xa434
++#define RTL_VND2_PHYSR_DUPLEX			BIT(3)
++#define RTL_VND2_PHYSR_SPEEDL			GENMASK(5, 4)
++#define RTL_VND2_PHYSR_SPEEDH			GENMASK(10, 9)
++#define RTL_VND2_PHYSR_MASTER			BIT(11)
++#define RTL_VND2_PHYSR_SPEED_MASK		(RTL_VND2_PHYSR_SPEEDL | RTL_VND2_PHYSR_SPEEDH)
++
++#define RTL_GENERIC_PHYID			0x001cc800
++#define RTL_8211FVD_PHYID			0x001cc878
++#define RTL_8221B				0x001cc840
++#define RTL_8221B_VB_CG				0x001cc849
++#define RTL_8221B_VN_CG				0x001cc84a
++#define RTL_8251B				0x001cc862
++
++#define RTL8211F_LED_COUNT			3
++
++MODULE_DESCRIPTION("Realtek PHY driver");
++MODULE_AUTHOR("Johnson Leung");
++MODULE_LICENSE("GPL");
++
++struct rtl821x_priv {
++	u16 phycr1;
++	u16 phycr2;
++	bool has_phycr2;
++	struct clk *clk;
++};
++
++static int rtl821x_read_page(struct phy_device *phydev)
++{
++	return __phy_read(phydev, RTL821x_PAGE_SELECT);
++}
++
++static int rtl821x_write_page(struct phy_device *phydev, int page)
++{
++	return __phy_write(phydev, RTL821x_PAGE_SELECT, page);
++}
++
++static int rtl821x_probe(struct phy_device *phydev)
++{
++	struct device *dev = &phydev->mdio.dev;
++	struct rtl821x_priv *priv;
++	u32 phy_id = phydev->drv->phy_id;
++	int ret;
++
++	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	priv->clk = devm_clk_get_optional_enabled(dev, NULL);
++	if (IS_ERR(priv->clk))
++		return dev_err_probe(dev, PTR_ERR(priv->clk),
++				     "failed to get phy clock\n");
++
++	ret = phy_read_paged(phydev, 0xa43, RTL8211F_PHYCR1);
++	if (ret < 0)
++		return ret;
++
++	priv->phycr1 = ret & (RTL8211F_ALDPS_PLL_OFF | RTL8211F_ALDPS_ENABLE | RTL8211F_ALDPS_XTAL_OFF);
++	if (of_property_read_bool(dev->of_node, "realtek,aldps-enable"))
++		priv->phycr1 |= RTL8211F_ALDPS_PLL_OFF | RTL8211F_ALDPS_ENABLE | RTL8211F_ALDPS_XTAL_OFF;
++
++	priv->has_phycr2 = !(phy_id == RTL_8211FVD_PHYID);
++	if (priv->has_phycr2) {
++		ret = phy_read_paged(phydev, 0xa43, RTL8211F_PHYCR2);
++		if (ret < 0)
++			return ret;
++
++		priv->phycr2 = ret & RTL8211F_CLKOUT_EN;
++		if (of_property_read_bool(dev->of_node, "realtek,clkout-disable"))
++			priv->phycr2 &= ~RTL8211F_CLKOUT_EN;
++	}
++
++	phydev->priv = priv;
++
++	return 0;
++}
++
++static int rtl8201_ack_interrupt(struct phy_device *phydev)
++{
++	int err;
++
++	err = phy_read(phydev, RTL8201F_ISR);
++
++	return (err < 0) ? err : 0;
++}
++
++static int rtl821x_ack_interrupt(struct phy_device *phydev)
++{
++	int err;
++
++	err = phy_read(phydev, RTL821x_INSR);
++
++	return (err < 0) ? err : 0;
++}
++
++static int rtl8211f_ack_interrupt(struct phy_device *phydev)
++{
++	int err;
++
++	err = phy_read_paged(phydev, 0xa43, RTL8211F_INSR);
++
++	return (err < 0) ? err : 0;
++}
++
++static int rtl8201_config_intr(struct phy_device *phydev)
++{
++	u16 val;
++	int err;
++
++	if (phydev->interrupts == PHY_INTERRUPT_ENABLED) {
++		err = rtl8201_ack_interrupt(phydev);
++		if (err)
++			return err;
++
++		val = BIT(13) | BIT(12) | BIT(11);
++		err = phy_write_paged(phydev, 0x7, RTL8201F_IER, val);
++	} else {
++		val = 0;
++		err = phy_write_paged(phydev, 0x7, RTL8201F_IER, val);
++		if (err)
++			return err;
++
++		err = rtl8201_ack_interrupt(phydev);
++	}
++
++	return err;
++}
++
++static int rtl8211b_config_intr(struct phy_device *phydev)
++{
++	int err;
++
++	if (phydev->interrupts == PHY_INTERRUPT_ENABLED) {
++		err = rtl821x_ack_interrupt(phydev);
++		if (err)
++			return err;
++
++		err = phy_write(phydev, RTL821x_INER,
++				RTL8211B_INER_INIT);
++	} else {
++		err = phy_write(phydev, RTL821x_INER, 0);
++		if (err)
++			return err;
++
++		err = rtl821x_ack_interrupt(phydev);
++	}
++
++	return err;
++}
++
++static int rtl8211e_config_intr(struct phy_device *phydev)
++{
++	int err;
++
++	if (phydev->interrupts == PHY_INTERRUPT_ENABLED) {
++		err = rtl821x_ack_interrupt(phydev);
++		if (err)
++			return err;
++
++		err = phy_write(phydev, RTL821x_INER,
++				RTL8211E_INER_LINK_STATUS);
++	} else {
++		err = phy_write(phydev, RTL821x_INER, 0);
++		if (err)
++			return err;
++
++		err = rtl821x_ack_interrupt(phydev);
++	}
++
++	return err;
++}
++
++static int rtl8211f_config_intr(struct phy_device *phydev)
++{
++	u16 val;
++	int err;
++
++	if (phydev->interrupts == PHY_INTERRUPT_ENABLED) {
++		err = rtl8211f_ack_interrupt(phydev);
++		if (err)
++			return err;
++
++		val = RTL8211F_INER_LINK_STATUS;
++		err = phy_write_paged(phydev, 0xa42, RTL821x_INER, val);
++	} else {
++		val = 0;
++		err = phy_write_paged(phydev, 0xa42, RTL821x_INER, val);
++		if (err)
++			return err;
++
++		err = rtl8211f_ack_interrupt(phydev);
++	}
++
++	return err;
++}
++
++static irqreturn_t rtl8201_handle_interrupt(struct phy_device *phydev)
++{
++	int irq_status;
++
++	irq_status = phy_read(phydev, RTL8201F_ISR);
++	if (irq_status < 0) {
++		phy_error(phydev);
++		return IRQ_NONE;
++	}
++
++	if (!(irq_status & RTL8201F_ISR_MASK))
++		return IRQ_NONE;
++
++	phy_trigger_machine(phydev);
++
++	return IRQ_HANDLED;
++}
++
++static irqreturn_t rtl821x_handle_interrupt(struct phy_device *phydev)
++{
++	int irq_status, irq_enabled;
++
++	irq_status = phy_read(phydev, RTL821x_INSR);
++	if (irq_status < 0) {
++		phy_error(phydev);
++		return IRQ_NONE;
++	}
++
++	irq_enabled = phy_read(phydev, RTL821x_INER);
++	if (irq_enabled < 0) {
++		phy_error(phydev);
++		return IRQ_NONE;
++	}
++
++	if (!(irq_status & irq_enabled))
++		return IRQ_NONE;
++
++	phy_trigger_machine(phydev);
++
++	return IRQ_HANDLED;
++}
++
++static irqreturn_t rtl8211f_handle_interrupt(struct phy_device *phydev)
++{
++	int irq_status;
++
++	irq_status = phy_read_paged(phydev, 0xa43, RTL8211F_INSR);
++	if (irq_status < 0) {
++		phy_error(phydev);
++		return IRQ_NONE;
++	}
++
++	if (!(irq_status & RTL8211F_INER_LINK_STATUS))
++		return IRQ_NONE;
++
++	phy_trigger_machine(phydev);
++
++	return IRQ_HANDLED;
++}
++
++static int rtl8211_config_aneg(struct phy_device *phydev)
++{
++	int ret;
++
++	ret = genphy_config_aneg(phydev);
++	if (ret < 0)
++		return ret;
++
++	/* Quirk was copied from vendor driver. Unfortunately it includes no
++	 * description of the magic numbers.
++	 */
++	if (phydev->speed == SPEED_100 && phydev->autoneg == AUTONEG_DISABLE) {
++		phy_write(phydev, 0x17, 0x2138);
++		phy_write(phydev, 0x0e, 0x0260);
++	} else {
++		phy_write(phydev, 0x17, 0x2108);
++		phy_write(phydev, 0x0e, 0x0000);
++	}
++
++	return 0;
++}
++
++static int rtl8211c_config_init(struct phy_device *phydev)
++{
++	/* RTL8211C has an issue when operating in Gigabit slave mode */
++	return phy_set_bits(phydev, MII_CTRL1000,
++			    CTL1000_ENABLE_MASTER | CTL1000_AS_MASTER);
++}
++
++static int rtl8211f_config_init(struct phy_device *phydev)
++{
++	struct rtl821x_priv *priv = phydev->priv;
++	struct device *dev = &phydev->mdio.dev;
++	u16 val_txdly, val_rxdly;
++	int ret;
++
++	ret = phy_modify_paged_changed(phydev, 0xa43, RTL8211F_PHYCR1,
++				       RTL8211F_ALDPS_PLL_OFF | RTL8211F_ALDPS_ENABLE | RTL8211F_ALDPS_XTAL_OFF,
++				       priv->phycr1);
++	if (ret < 0) {
++		dev_err(dev, "aldps mode  configuration failed: %pe\n",
++			ERR_PTR(ret));
++		return ret;
++	}
++
++	switch (phydev->interface) {
++	case PHY_INTERFACE_MODE_RGMII:
++		val_txdly = 0;
++		val_rxdly = 0;
++		break;
++
++	case PHY_INTERFACE_MODE_RGMII_RXID:
++		val_txdly = 0;
++		val_rxdly = RTL8211F_RX_DELAY;
++		break;
++
++	case PHY_INTERFACE_MODE_RGMII_TXID:
++		val_txdly = RTL8211F_TX_DELAY;
++		val_rxdly = 0;
++		break;
++
++	case PHY_INTERFACE_MODE_RGMII_ID:
++		val_txdly = RTL8211F_TX_DELAY;
++		val_rxdly = RTL8211F_RX_DELAY;
++		break;
++
++	default: /* the rest of the modes imply leaving delay as is. */
++		return 0;
++	}
++
++	ret = phy_modify_paged_changed(phydev, 0xd08, 0x11, RTL8211F_TX_DELAY,
++				       val_txdly);
++	if (ret < 0) {
++		dev_err(dev, "Failed to update the TX delay register\n");
++		return ret;
++	} else if (ret) {
++		dev_dbg(dev,
++			"%s 2ns TX delay (and changing the value from pin-strapping RXD1 or the bootloader)\n",
++			val_txdly ? "Enabling" : "Disabling");
++	} else {
++		dev_dbg(dev,
++			"2ns TX delay was already %s (by pin-strapping RXD1 or bootloader configuration)\n",
++			val_txdly ? "enabled" : "disabled");
++	}
++
++	ret = phy_modify_paged_changed(phydev, 0xd08, 0x15, RTL8211F_RX_DELAY,
++				       val_rxdly);
++	if (ret < 0) {
++		dev_err(dev, "Failed to update the RX delay register\n");
++		return ret;
++	} else if (ret) {
++		dev_dbg(dev,
++			"%s 2ns RX delay (and changing the value from pin-strapping RXD0 or the bootloader)\n",
++			val_rxdly ? "Enabling" : "Disabling");
++	} else {
++		dev_dbg(dev,
++			"2ns RX delay was already %s (by pin-strapping RXD0 or bootloader configuration)\n",
++			val_rxdly ? "enabled" : "disabled");
++	}
++
++	if (priv->has_phycr2) {
++		ret = phy_modify_paged(phydev, 0xa43, RTL8211F_PHYCR2,
++				       RTL8211F_CLKOUT_EN, priv->phycr2);
++		if (ret < 0) {
++			dev_err(dev, "clkout configuration failed: %pe\n",
++				ERR_PTR(ret));
++			return ret;
++		}
++
++		return genphy_soft_reset(phydev);
++	}
++
++	return 0;
++}
++
++static int rtl821x_suspend(struct phy_device *phydev)
++{
++	struct rtl821x_priv *priv = phydev->priv;
++	int ret = 0;
++
++	if (!phydev->wol_enabled) {
++		ret = genphy_suspend(phydev);
++
++		if (ret)
++			return ret;
++
++		clk_disable_unprepare(priv->clk);
++	}
++
++	return ret;
++}
++
++static int rtl821x_resume(struct phy_device *phydev)
++{
++	struct rtl821x_priv *priv = phydev->priv;
++	int ret;
++
++	if (!phydev->wol_enabled)
++		clk_prepare_enable(priv->clk);
++
++	ret = genphy_resume(phydev);
++	if (ret < 0)
++		return ret;
++
++	msleep(20);
++
++	return 0;
++}
++
++static int rtl8211f_led_hw_is_supported(struct phy_device *phydev, u8 index,
++					unsigned long rules)
++{
++	const unsigned long mask = BIT(TRIGGER_NETDEV_LINK_10) |
++				   BIT(TRIGGER_NETDEV_LINK_100) |
++				   BIT(TRIGGER_NETDEV_LINK_1000) |
++				   BIT(TRIGGER_NETDEV_RX) |
++				   BIT(TRIGGER_NETDEV_TX);
++
++	/* The RTL8211F PHY supports these LED settings on up to three LEDs:
++	 * - Link: Configurable subset of 10/100/1000 link rates
++	 * - Active: Blink on activity, RX or TX is not differentiated
++	 * The Active option has two modes, A and B:
++	 * - A: Link and Active indication at configurable, but matching,
++	 *      subset of 10/100/1000 link rates
++	 * - B: Link indication at configurable subset of 10/100/1000 link
++	 *      rates and Active indication always at all three 10+100+1000
++	 *      link rates.
++	 * This code currently uses mode B only.
++	 */
++
++	if (index >= RTL8211F_LED_COUNT)
++		return -EINVAL;
++
++	/* Filter out any other unsupported triggers. */
++	if (rules & ~mask)
++		return -EOPNOTSUPP;
++
++	/* RX and TX are not differentiated, either both are set or not set. */
++	if (!(rules & BIT(TRIGGER_NETDEV_RX)) ^ !(rules & BIT(TRIGGER_NETDEV_TX)))
++		return -EOPNOTSUPP;
++
++	return 0;
++}
++
++static int rtl8211f_led_hw_control_get(struct phy_device *phydev, u8 index,
++				       unsigned long *rules)
++{
++	int val;
++
++	if (index >= RTL8211F_LED_COUNT)
++		return -EINVAL;
++
++	val = phy_read_paged(phydev, 0xd04, RTL8211F_LEDCR);
++	if (val < 0)
++		return val;
++
++	val >>= RTL8211F_LEDCR_SHIFT * index;
++	val &= RTL8211F_LEDCR_MASK;
++
++	if (val & RTL8211F_LEDCR_LINK_10)
++		set_bit(TRIGGER_NETDEV_LINK_10, rules);
++
++	if (val & RTL8211F_LEDCR_LINK_100)
++		set_bit(TRIGGER_NETDEV_LINK_100, rules);
++
++	if (val & RTL8211F_LEDCR_LINK_1000)
++		set_bit(TRIGGER_NETDEV_LINK_1000, rules);
++
++	if (val & RTL8211F_LEDCR_ACT_TXRX) {
++		set_bit(TRIGGER_NETDEV_RX, rules);
++		set_bit(TRIGGER_NETDEV_TX, rules);
++	}
++
++	return 0;
++}
++
++static int rtl8211f_led_hw_control_set(struct phy_device *phydev, u8 index,
++				       unsigned long rules)
++{
++	const u16 mask = RTL8211F_LEDCR_MASK << (RTL8211F_LEDCR_SHIFT * index);
++	u16 reg = 0;
++
++	if (index >= RTL8211F_LED_COUNT)
++		return -EINVAL;
++
++	if (test_bit(TRIGGER_NETDEV_LINK_10, &rules))
++		reg |= RTL8211F_LEDCR_LINK_10;
++
++	if (test_bit(TRIGGER_NETDEV_LINK_100, &rules))
++		reg |= RTL8211F_LEDCR_LINK_100;
++
++	if (test_bit(TRIGGER_NETDEV_LINK_1000, &rules))
++		reg |= RTL8211F_LEDCR_LINK_1000;
++
++	if (test_bit(TRIGGER_NETDEV_RX, &rules) ||
++	    test_bit(TRIGGER_NETDEV_TX, &rules)) {
++		reg |= RTL8211F_LEDCR_ACT_TXRX;
++	}
++
++	reg <<= RTL8211F_LEDCR_SHIFT * index;
++	reg |= RTL8211F_LEDCR_MODE;	 /* Mode B */
++
++	return phy_modify_paged(phydev, 0xd04, RTL8211F_LEDCR, mask, reg);
++}
++
++static int rtl8211e_config_init(struct phy_device *phydev)
++{
++	int ret = 0, oldpage;
++	u16 val;
++
++	/* enable TX/RX delay for rgmii-* modes, and disable them for rgmii. */
++	switch (phydev->interface) {
++	case PHY_INTERFACE_MODE_RGMII:
++		val = RTL8211E_CTRL_DELAY | 0;
++		break;
++	case PHY_INTERFACE_MODE_RGMII_ID:
++		val = RTL8211E_CTRL_DELAY | RTL8211E_TX_DELAY | RTL8211E_RX_DELAY;
++		break;
++	case PHY_INTERFACE_MODE_RGMII_RXID:
++		val = RTL8211E_CTRL_DELAY | RTL8211E_RX_DELAY;
++		break;
++	case PHY_INTERFACE_MODE_RGMII_TXID:
++		val = RTL8211E_CTRL_DELAY | RTL8211E_TX_DELAY;
++		break;
++	default: /* the rest of the modes imply leaving delays as is. */
++		return 0;
++	}
++
++	/* According to a sample driver there is a 0x1c config register on the
++	 * 0xa4 extension page (0x7) layout. It can be used to disable/enable
++	 * the RX/TX delays otherwise controlled by RXDLY/TXDLY pins.
++	 * The configuration register definition:
++	 * 14 = reserved
++	 * 13 = Force Tx RX Delay controlled by bit12 bit11,
++	 * 12 = RX Delay, 11 = TX Delay
++	 * 10:0 = Test && debug settings reserved by realtek
++	 */
++	oldpage = phy_select_page(phydev, 0x7);
++	if (oldpage < 0)
++		goto err_restore_page;
++
++	ret = __phy_write(phydev, RTL821x_EXT_PAGE_SELECT, 0xa4);
++	if (ret)
++		goto err_restore_page;
++
++	ret = __phy_modify(phydev, 0x1c, RTL8211E_CTRL_DELAY
++			   | RTL8211E_TX_DELAY | RTL8211E_RX_DELAY,
++			   val);
++
++err_restore_page:
++	return phy_restore_page(phydev, oldpage, ret);
++}
++
++static int rtl8211b_suspend(struct phy_device *phydev)
++{
++	phy_write(phydev, MII_MMD_DATA, BIT(9));
++
++	return genphy_suspend(phydev);
++}
++
++static int rtl8211b_resume(struct phy_device *phydev)
++{
++	phy_write(phydev, MII_MMD_DATA, 0);
++
++	return genphy_resume(phydev);
++}
++
++static int rtl8366rb_config_init(struct phy_device *phydev)
++{
++	int ret;
++
++	ret = phy_set_bits(phydev, RTL8366RB_POWER_SAVE,
++			   RTL8366RB_POWER_SAVE_ON);
++	if (ret) {
++		dev_err(&phydev->mdio.dev,
++			"error enabling power management\n");
++	}
++
++	return ret;
++}
++
++/* get actual speed to cover the downshift case */
++static void rtlgen_decode_physr(struct phy_device *phydev, int val)
++{
++	/* bit 3
++	 * 0: Half Duplex
++	 * 1: Full Duplex
++	 */
++	if (val & RTL_VND2_PHYSR_DUPLEX)
++		phydev->duplex = DUPLEX_FULL;
++	else
++		phydev->duplex = DUPLEX_HALF;
++
++	switch (val & RTL_VND2_PHYSR_SPEED_MASK) {
++	case 0x0000:
++		phydev->speed = SPEED_10;
++		break;
++	case 0x0010:
++		phydev->speed = SPEED_100;
++		break;
++	case 0x0020:
++		phydev->speed = SPEED_1000;
++		break;
++	case 0x0200:
++		phydev->speed = SPEED_10000;
++		break;
++	case 0x0210:
++		phydev->speed = SPEED_2500;
++		break;
++	case 0x0220:
++		phydev->speed = SPEED_5000;
++		break;
++	default:
++		break;
++	}
++
++	/* bit 11
++	 * 0: Slave Mode
++	 * 1: Master Mode
++	 */
++	if (phydev->speed >= 1000) {
++		if (val & RTL_VND2_PHYSR_MASTER)
++			phydev->master_slave_state = MASTER_SLAVE_STATE_MASTER;
++		else
++			phydev->master_slave_state = MASTER_SLAVE_STATE_SLAVE;
++	} else {
++		phydev->master_slave_state = MASTER_SLAVE_STATE_UNSUPPORTED;
++	}
++}
++
++static int rtlgen_read_status(struct phy_device *phydev)
++{
++	int ret, val;
++
++	ret = genphy_read_status(phydev);
++	if (ret < 0)
++		return ret;
++
++	if (!phydev->link)
++		return 0;
++
++	val = phy_read_paged(phydev, 0xa43, 0x12);
++	if (val < 0)
++		return val;
++
++	rtlgen_decode_physr(phydev, val);
++
++	return 0;
++}
++
++static int rtlgen_read_mmd(struct phy_device *phydev, int devnum, u16 regnum)
++{
++	int ret;
++
++	if (devnum == MDIO_MMD_VEND2) {
++		rtl821x_write_page(phydev, regnum >> 4);
++		ret = __phy_read(phydev, 0x10 + ((regnum & 0xf) >> 1));
++		rtl821x_write_page(phydev, 0);
++	} else if (devnum == MDIO_MMD_PCS && regnum == MDIO_PCS_EEE_ABLE) {
++		rtl821x_write_page(phydev, 0xa5c);
++		ret = __phy_read(phydev, 0x12);
++		rtl821x_write_page(phydev, 0);
++	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV) {
++		rtl821x_write_page(phydev, 0xa5d);
++		ret = __phy_read(phydev, 0x10);
++		rtl821x_write_page(phydev, 0);
++	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_LPABLE) {
++		rtl821x_write_page(phydev, 0xa5d);
++		ret = __phy_read(phydev, 0x11);
++		rtl821x_write_page(phydev, 0);
++	} else {
++		ret = -EOPNOTSUPP;
++	}
++
++	return ret;
++}
++
++static int rtlgen_write_mmd(struct phy_device *phydev, int devnum, u16 regnum,
++			    u16 val)
++{
++	int ret;
++
++	if (devnum == MDIO_MMD_VEND2) {
++		rtl821x_write_page(phydev, regnum >> 4);
++		ret = __phy_write(phydev, 0x10 + ((regnum & 0xf) >> 1), val);
++		rtl821x_write_page(phydev, 0);
++	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV) {
++		rtl821x_write_page(phydev, 0xa5d);
++		ret = __phy_write(phydev, 0x10, val);
++		rtl821x_write_page(phydev, 0);
++	} else {
++		ret = -EOPNOTSUPP;
++	}
++
++	return ret;
++}
++
++static int rtl822x_read_mmd(struct phy_device *phydev, int devnum, u16 regnum)
++{
++	int ret = rtlgen_read_mmd(phydev, devnum, regnum);
++
++	if (ret != -EOPNOTSUPP)
++		return ret;
++
++	if (devnum == MDIO_MMD_PCS && regnum == MDIO_PCS_EEE_ABLE2) {
++		rtl821x_write_page(phydev, 0xa6e);
++		ret = __phy_read(phydev, 0x16);
++		rtl821x_write_page(phydev, 0);
++	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV2) {
++		rtl821x_write_page(phydev, 0xa6d);
++		ret = __phy_read(phydev, 0x12);
++		rtl821x_write_page(phydev, 0);
++	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_LPABLE2) {
++		rtl821x_write_page(phydev, 0xa6d);
++		ret = __phy_read(phydev, 0x10);
++		rtl821x_write_page(phydev, 0);
++	}
++
++	return ret;
++}
++
++static int rtl822x_write_mmd(struct phy_device *phydev, int devnum, u16 regnum,
++			     u16 val)
++{
++	int ret = rtlgen_write_mmd(phydev, devnum, regnum, val);
++
++	if (ret != -EOPNOTSUPP)
++		return ret;
++
++	if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV2) {
++		rtl821x_write_page(phydev, 0xa6d);
++		ret = __phy_write(phydev, 0x12, val);
++		rtl821x_write_page(phydev, 0);
++	}
++
++	return ret;
++}
++
++static int rtl822xb_config_init(struct phy_device *phydev)
++{
++	bool has_2500, has_sgmii;
++	u16 mode;
++	int ret;
++
++	has_2500 = test_bit(PHY_INTERFACE_MODE_2500BASEX,
++			    phydev->host_interfaces) ||
++		   phydev->interface == PHY_INTERFACE_MODE_2500BASEX;
++
++	has_sgmii = test_bit(PHY_INTERFACE_MODE_SGMII,
++			     phydev->host_interfaces) ||
++		    phydev->interface == PHY_INTERFACE_MODE_SGMII;
++
++	/* fill in possible interfaces */
++	__assign_bit(PHY_INTERFACE_MODE_2500BASEX, phydev->possible_interfaces,
++		     has_2500);
++	__assign_bit(PHY_INTERFACE_MODE_SGMII, phydev->possible_interfaces,
++		     has_sgmii);
++
++	if (!has_2500 && !has_sgmii)
++		return 0;
++
++	/* determine SerDes option mode */
++	if (has_2500 && !has_sgmii) {
++		mode = RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX;
++		phydev->rate_matching = RATE_MATCH_PAUSE;
++	} else {
++		mode = RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX_SGMII;
++		phydev->rate_matching = RATE_MATCH_NONE;
++	}
++
++	/* the following sequence with magic numbers sets up the SerDes
++	 * option mode
++	 */
++	ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x75f3, 0);
++	if (ret < 0)
++		return ret;
++
++	ret = phy_modify_mmd_changed(phydev, MDIO_MMD_VEND1,
++				     RTL822X_VND1_SERDES_OPTION,
++				     RTL822X_VND1_SERDES_OPTION_MODE_MASK,
++				     mode);
++	if (ret < 0)
++		return ret;
++
++	ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x6a04, 0x0503);
++	if (ret < 0)
++		return ret;
++
++	ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x6f10, 0xd455);
++	if (ret < 0)
++		return ret;
++
++	return phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x6f11, 0x8020);
++}
++
++static int rtl822xb_get_rate_matching(struct phy_device *phydev,
++				      phy_interface_t iface)
++{
++	int val;
++
++	/* Only rate matching at 2500base-x */
++	if (iface != PHY_INTERFACE_MODE_2500BASEX)
++		return RATE_MATCH_NONE;
++
++	val = phy_read_mmd(phydev, MDIO_MMD_VEND1, RTL822X_VND1_SERDES_OPTION);
++	if (val < 0)
++		return val;
++
++	if ((val & RTL822X_VND1_SERDES_OPTION_MODE_MASK) ==
++	    RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX)
++		return RATE_MATCH_PAUSE;
++
++	/* RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX_SGMII */
++	return RATE_MATCH_NONE;
++}
++
++static int rtl822x_get_features(struct phy_device *phydev)
++{
++	int val;
++
++	val = phy_read_paged(phydev, 0xa61, 0x13);
++	if (val < 0)
++		return val;
++
++	linkmode_mod_bit(ETHTOOL_LINK_MODE_2500baseT_Full_BIT,
++			 phydev->supported, val & MDIO_PMA_SPEED_2_5G);
++	linkmode_mod_bit(ETHTOOL_LINK_MODE_5000baseT_Full_BIT,
++			 phydev->supported, val & MDIO_PMA_SPEED_5G);
++	linkmode_mod_bit(ETHTOOL_LINK_MODE_10000baseT_Full_BIT,
++			 phydev->supported, val & MDIO_SPEED_10G);
++
++	return genphy_read_abilities(phydev);
++}
++
++static int rtl822x_config_aneg(struct phy_device *phydev)
++{
++	int ret = 0;
++
++	if (phydev->autoneg == AUTONEG_ENABLE) {
++		u16 adv = linkmode_adv_to_mii_10gbt_adv_t(phydev->advertising);
++
++		ret = phy_modify_paged_changed(phydev, 0xa5d, 0x12,
++					       MDIO_AN_10GBT_CTRL_ADV2_5G |
++					       MDIO_AN_10GBT_CTRL_ADV5G,
++					       adv);
++		if (ret < 0)
++			return ret;
++	}
++
++	return __genphy_config_aneg(phydev, ret);
++}
++
++static void rtl822xb_update_interface(struct phy_device *phydev)
++{
++	int val;
++
++	if (!phydev->link)
++		return;
++
++	/* Change interface according to serdes mode */
++	val = phy_read_mmd(phydev, MDIO_MMD_VEND1, RTL822X_VND1_SERDES_CTRL3);
++	if (val < 0)
++		return;
++
++	switch (val & RTL822X_VND1_SERDES_CTRL3_MODE_MASK) {
++	case RTL822X_VND1_SERDES_CTRL3_MODE_2500BASEX:
++		phydev->interface = PHY_INTERFACE_MODE_2500BASEX;
++		break;
++	case RTL822X_VND1_SERDES_CTRL3_MODE_SGMII:
++		phydev->interface = PHY_INTERFACE_MODE_SGMII;
++		break;
++	}
++}
++
++static int rtl822x_read_status(struct phy_device *phydev)
++{
++	int lpadv, ret;
++
++	mii_10gbt_stat_mod_linkmode_lpa_t(phydev->lp_advertising, 0);
++
++	ret = rtlgen_read_status(phydev);
++	if (ret < 0)
++		return ret;
++
++	if (phydev->autoneg == AUTONEG_DISABLE ||
++	    !phydev->autoneg_complete)
++		return 0;
++
++	lpadv = phy_read_paged(phydev, 0xa5d, 0x13);
++	if (lpadv < 0)
++		return lpadv;
++
++	mii_10gbt_stat_mod_linkmode_lpa_t(phydev->lp_advertising, lpadv);
++
++	return 0;
++}
++
++static int rtl822xb_read_status(struct phy_device *phydev)
++{
++	int ret;
++
++	ret = rtl822x_read_status(phydev);
++	if (ret < 0)
++		return ret;
++
++	rtl822xb_update_interface(phydev);
++
++	return 0;
++}
++
++static int rtl822x_c45_get_features(struct phy_device *phydev)
++{
++	linkmode_set_bit(ETHTOOL_LINK_MODE_TP_BIT,
++			 phydev->supported);
++
++	return genphy_c45_pma_read_abilities(phydev);
++}
++
++static int rtl822x_c45_config_aneg(struct phy_device *phydev)
++{
++	bool changed = false;
++	int ret, val;
++
++	if (phydev->autoneg == AUTONEG_DISABLE)
++		return genphy_c45_pma_setup_forced(phydev);
++
++	ret = genphy_c45_an_config_aneg(phydev);
++	if (ret < 0)
++		return ret;
++	if (ret > 0)
++		changed = true;
++
++	val = linkmode_adv_to_mii_ctrl1000_t(phydev->advertising);
++
++	/* Vendor register as C45 has no standardized support for 1000BaseT */
++	ret = phy_modify_mmd_changed(phydev, MDIO_MMD_VEND2, RTL822X_VND2_GBCR,
++				     ADVERTISE_1000FULL, val);
++	if (ret < 0)
++		return ret;
++	if (ret > 0)
++		changed = true;
++
++	return genphy_c45_check_and_restart_aneg(phydev, changed);
++}
++
++static int rtl822x_c45_read_status(struct phy_device *phydev)
++{
++	int ret, val;
++
++	/* Vendor register as C45 has no standardized support for 1000BaseT */
++	if (phydev->autoneg == AUTONEG_ENABLE && genphy_c45_aneg_done(phydev)) {
++		val = phy_read_mmd(phydev, MDIO_MMD_VEND2,
++				   RTL822X_VND2_GANLPAR);
++		if (val < 0)
++			return val;
++	} else {
++		val = 0;
++	}
++	mii_stat1000_mod_linkmode_lpa_t(phydev->lp_advertising, val);
++
++	ret = genphy_c45_read_status(phydev);
++	if (ret < 0)
++		return ret;
++
++	if (!phydev->link) {
++		phydev->master_slave_state = MASTER_SLAVE_STATE_UNKNOWN;
++		return 0;
++	}
++
++	/* Read actual speed from vendor register. */
++	val = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL_VND2_PHYSR);
++	if (val < 0)
++		return val;
++
++	rtlgen_decode_physr(phydev, val);
++
++	return 0;
++}
++
++static int rtl822xb_c45_read_status(struct phy_device *phydev)
++{
++	int ret;
++
++	ret = rtl822x_c45_read_status(phydev);
++	if (ret < 0)
++		return ret;
++
++	rtl822xb_update_interface(phydev);
++
++	return 0;
++}
++
++static bool rtlgen_supports_2_5gbps(struct phy_device *phydev)
++{
++	int val;
++
++	phy_write(phydev, RTL821x_PAGE_SELECT, 0xa61);
++	val = phy_read(phydev, 0x13);
++	phy_write(phydev, RTL821x_PAGE_SELECT, 0);
++
++	return val >= 0 && val & MDIO_PMA_SPEED_2_5G;
++}
++
++/* On internal PHY's MMD reads over C22 always return 0.
++ * Check a MMD register which is known to be non-zero.
++ */
++static bool rtlgen_supports_mmd(struct phy_device *phydev)
++{
++	int val;
++
++	phy_lock_mdio_bus(phydev);
++	__phy_write(phydev, MII_MMD_CTRL, MDIO_MMD_PCS);
++	__phy_write(phydev, MII_MMD_DATA, MDIO_PCS_EEE_ABLE);
++	__phy_write(phydev, MII_MMD_CTRL, MDIO_MMD_PCS | MII_MMD_CTRL_NOINCR);
++	val = __phy_read(phydev, MII_MMD_DATA);
++	phy_unlock_mdio_bus(phydev);
++
++	return val > 0;
++}
++
++static int rtlgen_match_phy_device(struct phy_device *phydev)
++{
++	return phydev->phy_id == RTL_GENERIC_PHYID &&
++	       !rtlgen_supports_2_5gbps(phydev);
++}
++
++static int rtl8226_match_phy_device(struct phy_device *phydev)
++{
++	return phydev->phy_id == RTL_GENERIC_PHYID &&
++	       rtlgen_supports_2_5gbps(phydev) &&
++	       rtlgen_supports_mmd(phydev);
++}
++
++static int rtlgen_is_c45_match(struct phy_device *phydev, unsigned int id,
++			       bool is_c45)
++{
++	if (phydev->is_c45)
++		return is_c45 && (id == phydev->c45_ids.device_ids[1]);
++	else
++		return !is_c45 && (id == phydev->phy_id);
++}
++
++static int rtl8221b_match_phy_device(struct phy_device *phydev)
++{
++	return phydev->phy_id == RTL_8221B && rtlgen_supports_mmd(phydev);
++}
++
++static int rtl8221b_vb_cg_c22_match_phy_device(struct phy_device *phydev)
++{
++	return rtlgen_is_c45_match(phydev, RTL_8221B_VB_CG, false);
++}
++
++static int rtl8221b_vb_cg_c45_match_phy_device(struct phy_device *phydev)
++{
++	return rtlgen_is_c45_match(phydev, RTL_8221B_VB_CG, true);
++}
++
++static int rtl8221b_vn_cg_c22_match_phy_device(struct phy_device *phydev)
++{
++	return rtlgen_is_c45_match(phydev, RTL_8221B_VN_CG, false);
++}
++
++static int rtl8221b_vn_cg_c45_match_phy_device(struct phy_device *phydev)
++{
++	return rtlgen_is_c45_match(phydev, RTL_8221B_VN_CG, true);
++}
++
++static int rtl_internal_nbaset_match_phy_device(struct phy_device *phydev)
++{
++	if (phydev->is_c45)
++		return false;
++
++	switch (phydev->phy_id) {
++	case RTL_GENERIC_PHYID:
++	case RTL_8221B:
++	case RTL_8251B:
++	case 0x001cc841:
++		break;
++	default:
++		return false;
++	}
++
++	return rtlgen_supports_2_5gbps(phydev) && !rtlgen_supports_mmd(phydev);
++}
++
++static int rtl8251b_c45_match_phy_device(struct phy_device *phydev)
++{
++	return rtlgen_is_c45_match(phydev, RTL_8251B, true);
++}
++
++static int rtlgen_resume(struct phy_device *phydev)
++{
++	int ret = genphy_resume(phydev);
++
++	/* Internal PHY's from RTL8168h up may not be instantly ready */
++	msleep(20);
++
++	return ret;
++}
++
++static int rtlgen_c45_resume(struct phy_device *phydev)
++{
++	int ret = genphy_c45_pma_resume(phydev);
++
++	msleep(20);
++
++	return ret;
++}
++
++static int rtl9000a_config_init(struct phy_device *phydev)
++{
++	phydev->autoneg = AUTONEG_DISABLE;
++	phydev->speed = SPEED_100;
++	phydev->duplex = DUPLEX_FULL;
++
++	return 0;
++}
++
++static int rtl9000a_config_aneg(struct phy_device *phydev)
++{
++	int ret;
++	u16 ctl = 0;
++
++	switch (phydev->master_slave_set) {
++	case MASTER_SLAVE_CFG_MASTER_FORCE:
++		ctl |= CTL1000_AS_MASTER;
++		break;
++	case MASTER_SLAVE_CFG_SLAVE_FORCE:
++		break;
++	case MASTER_SLAVE_CFG_UNKNOWN:
++	case MASTER_SLAVE_CFG_UNSUPPORTED:
++		return 0;
++	default:
++		phydev_warn(phydev, "Unsupported Master/Slave mode\n");
++		return -EOPNOTSUPP;
++	}
++
++	ret = phy_modify_changed(phydev, MII_CTRL1000, CTL1000_AS_MASTER, ctl);
++	if (ret == 1)
++		ret = genphy_soft_reset(phydev);
++
++	return ret;
++}
++
++static int rtl9000a_read_status(struct phy_device *phydev)
++{
++	int ret;
++
++	phydev->master_slave_get = MASTER_SLAVE_CFG_UNKNOWN;
++	phydev->master_slave_state = MASTER_SLAVE_STATE_UNKNOWN;
++
++	ret = genphy_update_link(phydev);
++	if (ret)
++		return ret;
++
++	ret = phy_read(phydev, MII_CTRL1000);
++	if (ret < 0)
++		return ret;
++	if (ret & CTL1000_AS_MASTER)
++		phydev->master_slave_get = MASTER_SLAVE_CFG_MASTER_FORCE;
++	else
++		phydev->master_slave_get = MASTER_SLAVE_CFG_SLAVE_FORCE;
++
++	ret = phy_read(phydev, MII_STAT1000);
++	if (ret < 0)
++		return ret;
++	if (ret & LPA_1000MSRES)
++		phydev->master_slave_state = MASTER_SLAVE_STATE_MASTER;
++	else
++		phydev->master_slave_state = MASTER_SLAVE_STATE_SLAVE;
++
++	return 0;
++}
++
++static int rtl9000a_ack_interrupt(struct phy_device *phydev)
++{
++	int err;
++
++	err = phy_read(phydev, RTL8211F_INSR);
++
++	return (err < 0) ? err : 0;
++}
++
++static int rtl9000a_config_intr(struct phy_device *phydev)
++{
++	u16 val;
++	int err;
++
++	if (phydev->interrupts == PHY_INTERRUPT_ENABLED) {
++		err = rtl9000a_ack_interrupt(phydev);
++		if (err)
++			return err;
++
++		val = (u16)~RTL9000A_GINMR_LINK_STATUS;
++		err = phy_write_paged(phydev, 0xa42, RTL9000A_GINMR, val);
++	} else {
++		val = ~0;
++		err = phy_write_paged(phydev, 0xa42, RTL9000A_GINMR, val);
++		if (err)
++			return err;
++
++		err = rtl9000a_ack_interrupt(phydev);
++	}
++
++	return phy_write_paged(phydev, 0xa42, RTL9000A_GINMR, val);
++}
++
++static irqreturn_t rtl9000a_handle_interrupt(struct phy_device *phydev)
++{
++	int irq_status;
++
++	irq_status = phy_read(phydev, RTL8211F_INSR);
++	if (irq_status < 0) {
++		phy_error(phydev);
++		return IRQ_NONE;
++	}
++
++	if (!(irq_status & RTL8211F_INER_LINK_STATUS))
++		return IRQ_NONE;
++
++	phy_trigger_machine(phydev);
++
++	return IRQ_HANDLED;
++}
++
++static struct phy_driver realtek_drvs[] = {
++	{
++		PHY_ID_MATCH_EXACT(0x00008201),
++		.name           = "RTL8201CP Ethernet",
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001cc816),
++		.name		= "RTL8201F Fast Ethernet",
++		.config_intr	= &rtl8201_config_intr,
++		.handle_interrupt = rtl8201_handle_interrupt,
++		.suspend	= genphy_suspend,
++		.resume		= genphy_resume,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++	}, {
++		PHY_ID_MATCH_MODEL(0x001cc880),
++		.name		= "RTL8208 Fast Ethernet",
++		.read_mmd	= genphy_read_mmd_unsupported,
++		.write_mmd	= genphy_write_mmd_unsupported,
++		.suspend	= genphy_suspend,
++		.resume		= genphy_resume,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001cc910),
++		.name		= "RTL8211 Gigabit Ethernet",
++		.config_aneg	= rtl8211_config_aneg,
++		.read_mmd	= &genphy_read_mmd_unsupported,
++		.write_mmd	= &genphy_write_mmd_unsupported,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001cc912),
++		.name		= "RTL8211B Gigabit Ethernet",
++		.config_intr	= &rtl8211b_config_intr,
++		.handle_interrupt = rtl821x_handle_interrupt,
++		.read_mmd	= &genphy_read_mmd_unsupported,
++		.write_mmd	= &genphy_write_mmd_unsupported,
++		.suspend	= rtl8211b_suspend,
++		.resume		= rtl8211b_resume,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001cc913),
++		.name		= "RTL8211C Gigabit Ethernet",
++		.config_init	= rtl8211c_config_init,
++		.read_mmd	= &genphy_read_mmd_unsupported,
++		.write_mmd	= &genphy_write_mmd_unsupported,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001cc914),
++		.name		= "RTL8211DN Gigabit Ethernet",
++		.config_intr	= rtl8211e_config_intr,
++		.handle_interrupt = rtl821x_handle_interrupt,
++		.suspend	= genphy_suspend,
++		.resume		= genphy_resume,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001cc915),
++		.name		= "RTL8211E Gigabit Ethernet",
++		.config_init	= &rtl8211e_config_init,
++		.config_intr	= &rtl8211e_config_intr,
++		.handle_interrupt = rtl821x_handle_interrupt,
++		.suspend	= genphy_suspend,
++		.resume		= genphy_resume,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001cc916),
++		.name		= "RTL8211F Gigabit Ethernet",
++		.probe		= rtl821x_probe,
++		.config_init	= &rtl8211f_config_init,
++		.read_status	= rtlgen_read_status,
++		.config_intr	= &rtl8211f_config_intr,
++		.handle_interrupt = rtl8211f_handle_interrupt,
++		.suspend	= rtl821x_suspend,
++		.resume		= rtl821x_resume,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++		.flags		= PHY_ALWAYS_CALL_SUSPEND,
++		.led_hw_is_supported = rtl8211f_led_hw_is_supported,
++		.led_hw_control_get = rtl8211f_led_hw_control_get,
++		.led_hw_control_set = rtl8211f_led_hw_control_set,
++	}, {
++		PHY_ID_MATCH_EXACT(RTL_8211FVD_PHYID),
++		.name		= "RTL8211F-VD Gigabit Ethernet",
++		.probe		= rtl821x_probe,
++		.config_init	= &rtl8211f_config_init,
++		.read_status	= rtlgen_read_status,
++		.config_intr	= &rtl8211f_config_intr,
++		.handle_interrupt = rtl8211f_handle_interrupt,
++		.suspend	= rtl821x_suspend,
++		.resume		= rtl821x_resume,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++		.flags		= PHY_ALWAYS_CALL_SUSPEND,
++	}, {
++		.name		= "Generic FE-GE Realtek PHY",
++		.match_phy_device = rtlgen_match_phy_device,
++		.read_status	= rtlgen_read_status,
++		.suspend	= genphy_suspend,
++		.resume		= rtlgen_resume,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++		.read_mmd	= rtlgen_read_mmd,
++		.write_mmd	= rtlgen_write_mmd,
++	}, {
++		.name		= "RTL8226 2.5Gbps PHY",
++		.match_phy_device = rtl8226_match_phy_device,
++		.get_features	= rtl822x_get_features,
++		.config_aneg	= rtl822x_config_aneg,
++		.read_status	= rtl822x_read_status,
++		.suspend	= genphy_suspend,
++		.resume		= rtlgen_resume,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++	}, {
++		.match_phy_device = rtl8221b_match_phy_device,
++		.name		= "RTL8226B_RTL8221B 2.5Gbps PHY",
++		.get_features	= rtl822x_get_features,
++		.config_aneg	= rtl822x_config_aneg,
++		.config_init    = rtl822xb_config_init,
++		.get_rate_matching = rtl822xb_get_rate_matching,
++		.read_status	= rtl822xb_read_status,
++		.suspend	= genphy_suspend,
++		.resume		= rtlgen_resume,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001cc838),
++		.name           = "RTL8226-CG 2.5Gbps PHY",
++		.get_features   = rtl822x_get_features,
++		.config_aneg    = rtl822x_config_aneg,
++		.read_status    = rtl822x_read_status,
++		.suspend        = genphy_suspend,
++		.resume         = rtlgen_resume,
++		.read_page      = rtl821x_read_page,
++		.write_page     = rtl821x_write_page,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001cc848),
++		.name           = "RTL8226B-CG_RTL8221B-CG 2.5Gbps PHY",
++		.get_features   = rtl822x_get_features,
++		.config_aneg    = rtl822x_config_aneg,
++		.config_init    = rtl822xb_config_init,
++		.get_rate_matching = rtl822xb_get_rate_matching,
++		.read_status    = rtl822xb_read_status,
++		.suspend        = genphy_suspend,
++		.resume         = rtlgen_resume,
++		.read_page      = rtl821x_read_page,
++		.write_page     = rtl821x_write_page,
++	}, {
++		.match_phy_device = rtl8221b_vb_cg_c22_match_phy_device,
++		.name           = "RTL8221B-VB-CG 2.5Gbps PHY (C22)",
++		.get_features   = rtl822x_get_features,
++		.config_aneg    = rtl822x_config_aneg,
++		.config_init    = rtl822xb_config_init,
++		.get_rate_matching = rtl822xb_get_rate_matching,
++		.read_status    = rtl822xb_read_status,
++		.suspend        = genphy_suspend,
++		.resume         = rtlgen_resume,
++		.read_page      = rtl821x_read_page,
++		.write_page     = rtl821x_write_page,
++	}, {
++		.match_phy_device = rtl8221b_vb_cg_c45_match_phy_device,
++		.name           = "RTL8221B-VB-CG 2.5Gbps PHY (C45)",
++		.config_init    = rtl822xb_config_init,
++		.get_rate_matching = rtl822xb_get_rate_matching,
++		.get_features   = rtl822x_c45_get_features,
++		.config_aneg    = rtl822x_c45_config_aneg,
++		.read_status    = rtl822xb_c45_read_status,
++		.suspend        = genphy_c45_pma_suspend,
++		.resume         = rtlgen_c45_resume,
++	}, {
++		.match_phy_device = rtl8221b_vn_cg_c22_match_phy_device,
++		.name           = "RTL8221B-VM-CG 2.5Gbps PHY (C22)",
++		.get_features   = rtl822x_get_features,
++		.config_aneg    = rtl822x_config_aneg,
++		.config_init    = rtl822xb_config_init,
++		.get_rate_matching = rtl822xb_get_rate_matching,
++		.read_status    = rtl822xb_read_status,
++		.suspend        = genphy_suspend,
++		.resume         = rtlgen_resume,
++		.read_page      = rtl821x_read_page,
++		.write_page     = rtl821x_write_page,
++	}, {
++		.match_phy_device = rtl8221b_vn_cg_c45_match_phy_device,
++		.name           = "RTL8221B-VN-CG 2.5Gbps PHY (C45)",
++		.config_init    = rtl822xb_config_init,
++		.get_rate_matching = rtl822xb_get_rate_matching,
++		.get_features   = rtl822x_c45_get_features,
++		.config_aneg    = rtl822x_c45_config_aneg,
++		.read_status    = rtl822xb_c45_read_status,
++		.suspend        = genphy_c45_pma_suspend,
++		.resume         = rtlgen_c45_resume,
++	}, {
++		.match_phy_device = rtl8251b_c45_match_phy_device,
++		.name           = "RTL8251B 5Gbps PHY",
++		.get_features   = rtl822x_get_features,
++		.config_aneg    = rtl822x_config_aneg,
++		.read_status    = rtl822x_read_status,
++		.suspend        = genphy_suspend,
++		.resume         = rtlgen_resume,
++		.read_page      = rtl821x_read_page,
++		.write_page     = rtl821x_write_page,
++	}, {
++		.match_phy_device = rtl_internal_nbaset_match_phy_device,
++		.name           = "Realtek Internal NBASE-T PHY",
++		.flags		= PHY_IS_INTERNAL,
++		.get_features   = rtl822x_get_features,
++		.config_aneg    = rtl822x_config_aneg,
++		.read_status    = rtl822x_read_status,
++		.suspend        = genphy_suspend,
++		.resume         = rtlgen_resume,
++		.read_page      = rtl821x_read_page,
++		.write_page     = rtl821x_write_page,
++		.read_mmd	= rtl822x_read_mmd,
++		.write_mmd	= rtl822x_write_mmd,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001ccad0),
++		.name		= "RTL8224 2.5Gbps PHY",
++		.get_features   = rtl822x_c45_get_features,
++		.config_aneg    = rtl822x_c45_config_aneg,
++		.read_status    = rtl822x_c45_read_status,
++		.suspend        = genphy_c45_pma_suspend,
++		.resume         = rtlgen_c45_resume,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001cc961),
++		.name		= "RTL8366RB Gigabit Ethernet",
++		.config_init	= &rtl8366rb_config_init,
++		/* These interrupts are handled by the irq controller
++		 * embedded inside the RTL8366RB, they get unmasked when the
++		 * irq is requested and ACKed by reading the status register,
++		 * which is done by the irqchip code.
++		 */
++		.config_intr	= genphy_no_config_intr,
++		.handle_interrupt = genphy_handle_interrupt_no_ack,
++		.suspend	= genphy_suspend,
++		.resume		= genphy_resume,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001ccb00),
++		.name		= "RTL9000AA_RTL9000AN Ethernet",
++		.features       = PHY_BASIC_T1_FEATURES,
++		.config_init	= rtl9000a_config_init,
++		.config_aneg	= rtl9000a_config_aneg,
++		.read_status	= rtl9000a_read_status,
++		.config_intr	= rtl9000a_config_intr,
++		.handle_interrupt = rtl9000a_handle_interrupt,
++		.suspend	= genphy_suspend,
++		.resume		= genphy_resume,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001cc942),
++		.name		= "RTL8365MB-VC Gigabit Ethernet",
++		/* Interrupt handling analogous to RTL8366RB */
++		.config_intr	= genphy_no_config_intr,
++		.handle_interrupt = genphy_handle_interrupt_no_ack,
++		.suspend	= genphy_suspend,
++		.resume		= genphy_resume,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001cc960),
++		.name		= "RTL8366S Gigabit Ethernet",
++		.suspend	= genphy_suspend,
++		.resume		= genphy_resume,
++		.read_mmd	= genphy_read_mmd_unsupported,
++		.write_mmd	= genphy_write_mmd_unsupported,
++	},
++};
++
++module_phy_driver(realtek_drvs);
++
++static const struct mdio_device_id __maybe_unused realtek_tbl[] = {
++	{ PHY_ID_MATCH_VENDOR(0x001cc800) },
++	{ }
++};
++
++MODULE_DEVICE_TABLE(mdio, realtek_tbl);
diff --git a/6.12/target/linux/generic/backport-6.12/781-25-v6.14-net-phy-realtek-add-hwmon-support-for-temp-sensor-on.patch b/6.12/target/linux/generic/backport-6.12/781-25-v6.14-net-phy-realtek-add-hwmon-support-for-temp-sensor-on.patch
new file mode 100644
index 00000000..7c1fe542
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/781-25-v6.14-net-phy-realtek-add-hwmon-support-for-temp-sensor-on.patch
@@ -0,0 +1,180 @@
+From 33700ca45b7d2e1655d4cad95e25671e8a94e2f0 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Sat, 11 Jan 2025 21:51:24 +0100
+Subject: [PATCH] net: phy: realtek: add hwmon support for temp sensor on
+ RTL822x
+
+This adds hwmon support for the temperature sensor on RTL822x.
+It's available on the standalone versions of the PHY's, and on
+the integrated PHY's in RTL8125B/RTL8125D/RTL8126.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/ad6bfe9f-6375-4a00-84b4-bfb38a21bd71@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/realtek/Kconfig         |  6 ++
+ drivers/net/phy/realtek/Makefile        |  1 +
+ drivers/net/phy/realtek/realtek.h       | 10 ++++
+ drivers/net/phy/realtek/realtek_hwmon.c | 79 +++++++++++++++++++++++++
+ drivers/net/phy/realtek/realtek_main.c  | 12 ++++
+ 5 files changed, 108 insertions(+)
+ create mode 100644 drivers/net/phy/realtek/realtek.h
+ create mode 100644 drivers/net/phy/realtek/realtek_hwmon.c
+
+--- a/drivers/net/phy/realtek/Kconfig
++++ b/drivers/net/phy/realtek/Kconfig
+@@ -3,3 +3,9 @@ config REALTEK_PHY
+ 	tristate "Realtek PHYs"
+ 	help
+ 	  Currently supports RTL821x/RTL822x and fast ethernet PHYs
++
++config REALTEK_PHY_HWMON
++	def_bool REALTEK_PHY && HWMON
++	depends on !(REALTEK_PHY=y && HWMON=m)
++	help
++	  Optional hwmon support for the temperature sensor
+--- a/drivers/net/phy/realtek/Makefile
++++ b/drivers/net/phy/realtek/Makefile
+@@ -1,3 +1,4 @@
+ # SPDX-License-Identifier: GPL-2.0
+ realtek-y			+= realtek_main.o
++realtek-$(CONFIG_REALTEK_PHY_HWMON) += realtek_hwmon.o
+ obj-$(CONFIG_REALTEK_PHY)	+= realtek.o
+--- /dev/null
++++ b/drivers/net/phy/realtek/realtek.h
+@@ -0,0 +1,10 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++
++#ifndef REALTEK_H
++#define REALTEK_H
++
++#include <linux/phy.h>
++
++int rtl822x_hwmon_init(struct phy_device *phydev);
++
++#endif /* REALTEK_H */
+--- /dev/null
++++ b/drivers/net/phy/realtek/realtek_hwmon.c
+@@ -0,0 +1,86 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * HWMON support for Realtek PHY's
++ *
++ * Author: Heiner Kallweit <hkallweit1@gmail.com>
++ */
++
++#include <linux/hwmon.h>
++#include <linux/phy.h>
++
++#include "realtek.h"
++
++#define RTL822X_VND2_TSALRM				0xa662
++#define RTL822X_VND2_TSRR				0xbd84
++#define RTL822X_VND2_TSSR				0xb54c
++
++static umode_t rtl822x_hwmon_is_visible(const void *drvdata,
++				        enum hwmon_sensor_types type,
++				        u32 attr, int channel)
++{
++	return 0444;
++}
++
++static int rtl822x_hwmon_get_temp(int raw)
++{
++	if (raw >= 512)
++		raw -= 1024;
++
++	return 1000 * raw / 2;
++}
++
++static int rtl822x_hwmon_read(struct device *dev, enum hwmon_sensor_types type,
++			      u32 attr, int channel, long *val)
++{
++	struct phy_device *phydev = dev_get_drvdata(dev);
++	int raw;
++
++	switch (attr) {
++	case hwmon_temp_input:
++		raw = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL822X_VND2_TSRR) & 0x3ff;
++		*val = rtl822x_hwmon_get_temp(raw);
++		break;
++	case hwmon_temp_max:
++		/* Chip reduces speed to 1G if threshold is exceeded */
++		raw = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL822X_VND2_TSSR) >> 6;
++		*val = rtl822x_hwmon_get_temp(raw);
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++static const struct hwmon_ops rtl822x_hwmon_ops = {
++	.is_visible = rtl822x_hwmon_is_visible,
++	.read = rtl822x_hwmon_read,
++};
++
++static const struct hwmon_channel_info * const rtl822x_hwmon_info[] = {
++	HWMON_CHANNEL_INFO(temp, HWMON_T_INPUT | HWMON_T_MAX),
++	NULL
++};
++
++static const struct hwmon_chip_info rtl822x_hwmon_chip_info = {
++	.ops = &rtl822x_hwmon_ops,
++	.info = rtl822x_hwmon_info,
++};
++
++int rtl822x_hwmon_init(struct phy_device *phydev)
++{
++	struct device *hwdev, *dev = &phydev->mdio.dev;
++	const char *name;
++
++	/* Ensure over-temp alarm is reset. */
++	phy_clear_bits_mmd(phydev, MDIO_MMD_VEND2, RTL822X_VND2_TSALRM, 3);
++
++	name = devm_hwmon_sanitize_name(dev, dev_name(dev));
++	if (IS_ERR(name))
++		return PTR_ERR(name);
++
++	hwdev = devm_hwmon_device_register_with_info(dev, name, phydev,
++						     &rtl822x_hwmon_chip_info,
++						     NULL);
++	return PTR_ERR_OR_ZERO(hwdev);
++}
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -14,6 +14,8 @@
+ #include <linux/delay.h>
+ #include <linux/clk.h>
+ 
++#include "realtek.h"
++
+ #define RTL821x_PHYSR				0x11
+ #define RTL821x_PHYSR_DUPLEX			BIT(13)
+ #define RTL821x_PHYSR_SPEED			GENMASK(15, 14)
+@@ -820,6 +822,15 @@ static int rtl822x_write_mmd(struct phy_
+ 	return ret;
+ }
+ 
++static int rtl822x_probe(struct phy_device *phydev)
++{
++	if (IS_ENABLED(CONFIG_REALTEK_PHY_HWMON) &&
++	    phydev->phy_id != RTL_GENERIC_PHYID)
++		return rtl822x_hwmon_init(phydev);
++
++	return 0;
++}
++
+ static int rtl822xb_config_init(struct phy_device *phydev)
+ {
+ 	bool has_2500, has_sgmii;
+@@ -1518,6 +1529,7 @@ static struct phy_driver realtek_drvs[]
+ 		.match_phy_device = rtl_internal_nbaset_match_phy_device,
+ 		.name           = "Realtek Internal NBASE-T PHY",
+ 		.flags		= PHY_IS_INTERNAL,
++		.probe		= rtl822x_probe,
+ 		.get_features   = rtl822x_get_features,
+ 		.config_aneg    = rtl822x_config_aneg,
+ 		.read_status    = rtl822x_read_status,
diff --git a/6.12/target/linux/generic/backport-6.12/781-26-v6.14-net-phy-realtek-HWMON-support-for-standalone-version.patch b/6.12/target/linux/generic/backport-6.12/781-26-v6.14-net-phy-realtek-HWMON-support-for-standalone-version.patch
new file mode 100644
index 00000000..8b8c97c5
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/781-26-v6.14-net-phy-realtek-HWMON-support-for-standalone-version.patch
@@ -0,0 +1,64 @@
+From 64ff63aeefb03139ae27454bd4208244579ae88e Mon Sep 17 00:00:00 2001
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+Date: Fri, 17 Jan 2025 23:24:21 +0100
+Subject: [PATCH] net: phy: realtek: HWMON support for standalone versions of
+ RTL8221B and RTL8251
+
+HWMON support has been added for the RTL8221/8251 PHYs integrated together
+with the MAC inside the RTL8125/8126 chips. This patch extends temperature
+reading support for standalone variants of the mentioned PHYs.
+
+I don't know whether the earlier revisions of the RTL8226 also have a
+built-in temperature sensor, so they have been skipped for now.
+
+Tested on RTL8221B-VB-CG.
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/realtek/realtek_main.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -1474,6 +1474,7 @@ static struct phy_driver realtek_drvs[]
+ 	}, {
+ 		.match_phy_device = rtl8221b_vb_cg_c22_match_phy_device,
+ 		.name           = "RTL8221B-VB-CG 2.5Gbps PHY (C22)",
++		.probe		= rtl822x_probe,
+ 		.get_features   = rtl822x_get_features,
+ 		.config_aneg    = rtl822x_config_aneg,
+ 		.config_init    = rtl822xb_config_init,
+@@ -1486,6 +1487,7 @@ static struct phy_driver realtek_drvs[]
+ 	}, {
+ 		.match_phy_device = rtl8221b_vb_cg_c45_match_phy_device,
+ 		.name           = "RTL8221B-VB-CG 2.5Gbps PHY (C45)",
++		.probe		= rtl822x_probe,
+ 		.config_init    = rtl822xb_config_init,
+ 		.get_rate_matching = rtl822xb_get_rate_matching,
+ 		.get_features   = rtl822x_c45_get_features,
+@@ -1496,6 +1498,7 @@ static struct phy_driver realtek_drvs[]
+ 	}, {
+ 		.match_phy_device = rtl8221b_vn_cg_c22_match_phy_device,
+ 		.name           = "RTL8221B-VM-CG 2.5Gbps PHY (C22)",
++		.probe		= rtl822x_probe,
+ 		.get_features   = rtl822x_get_features,
+ 		.config_aneg    = rtl822x_config_aneg,
+ 		.config_init    = rtl822xb_config_init,
+@@ -1508,6 +1511,7 @@ static struct phy_driver realtek_drvs[]
+ 	}, {
+ 		.match_phy_device = rtl8221b_vn_cg_c45_match_phy_device,
+ 		.name           = "RTL8221B-VN-CG 2.5Gbps PHY (C45)",
++		.probe		= rtl822x_probe,
+ 		.config_init    = rtl822xb_config_init,
+ 		.get_rate_matching = rtl822xb_get_rate_matching,
+ 		.get_features   = rtl822x_c45_get_features,
+@@ -1518,6 +1522,7 @@ static struct phy_driver realtek_drvs[]
+ 	}, {
+ 		.match_phy_device = rtl8251b_c45_match_phy_device,
+ 		.name           = "RTL8251B 5Gbps PHY",
++		.probe		= rtl822x_probe,
+ 		.get_features   = rtl822x_get_features,
+ 		.config_aneg    = rtl822x_config_aneg,
+ 		.read_status    = rtl822x_read_status,
diff --git a/6.12/target/linux/generic/backport-6.12/839-v6.13-net-phy-aquantia-allow-forcing-order-of-MDI-pairs.patch b/6.12/target/linux/generic/backport-6.12/839-v6.13-net-phy-aquantia-allow-forcing-order-of-MDI-pairs.patch
new file mode 100644
index 00000000..aabaa33e
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/839-v6.13-net-phy-aquantia-allow-forcing-order-of-MDI-pairs.patch
@@ -0,0 +1,107 @@
+From a2e1ba275eae96a8171deb19e9c7c2f5978fee7b Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Fri, 4 Oct 2024 17:18:16 +0100
+Subject: [PATCH] net: phy: aquantia: allow forcing order of MDI pairs
+
+Despite supporting Auto MDI-X, it looks like Aquantia only supports
+swapping pair (1,2) with pair (3,6) like it used to be for MDI-X on
+100MBit/s networks.
+
+When all 4 pairs are in use (for 1000MBit/s or faster) the link does not
+come up with pair order is not configured correctly, either using
+MDI_CFG pin or using the "PMA Receive Reserved Vendor Provisioning 1"
+register.
+
+Normally, the order of MDI pairs being either ABCD or DCBA is configured
+by pulling the MDI_CFG pin.
+
+However, some hardware designs require overriding the value configured
+by that bootstrap pin. The PHY allows doing that by setting a bit in
+"PMA Receive Reserved Vendor Provisioning 1" register which allows
+ignoring the state of the MDI_CFG pin and another bit configuring
+whether the order of MDI pairs should be normal (ABCD) or reverse
+(DCBA). Pair polarity is not affected and remains identical in both
+settings.
+
+Introduce property "marvell,mdi-cfg-order" which allows forcing either
+normal or reverse order of the MDI pairs from DT.
+
+If the property isn't present, the behavior is unchanged and MDI pair
+order configuration is untouched (ie. either the result of MDI_CFG pin
+pull-up/pull-down, or pair order override already configured by the
+bootloader before Linux is started).
+
+Forcing normal pair order is required on the Adtran SDG-8733A Wi-Fi 7
+residential gateway.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/9ed760ff87d5fc456f31e407ead548bbb754497d.1728058550.git.daniel@makrotopia.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/aquantia/aquantia_main.c | 33 ++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+--- a/drivers/net/phy/aquantia/aquantia_main.c
++++ b/drivers/net/phy/aquantia/aquantia_main.c
+@@ -11,6 +11,7 @@
+ #include <linux/module.h>
+ #include <linux/delay.h>
+ #include <linux/bitfield.h>
++#include <linux/of.h>
+ #include <linux/phy.h>
+ 
+ #include "aquantia.h"
+@@ -71,6 +72,11 @@
+ #define MDIO_AN_TX_VEND_INT_MASK2		0xd401
+ #define MDIO_AN_TX_VEND_INT_MASK2_LINK		BIT(0)
+ 
++#define PMAPMD_RSVD_VEND_PROV			0xe400
++#define PMAPMD_RSVD_VEND_PROV_MDI_CONF		GENMASK(1, 0)
++#define PMAPMD_RSVD_VEND_PROV_MDI_REVERSE	BIT(0)
++#define PMAPMD_RSVD_VEND_PROV_MDI_FORCE		BIT(1)
++
+ #define MDIO_AN_RX_LP_STAT1			0xe820
+ #define MDIO_AN_RX_LP_STAT1_1000BASET_FULL	BIT(15)
+ #define MDIO_AN_RX_LP_STAT1_1000BASET_HALF	BIT(14)
+@@ -485,6 +491,29 @@ static void aqr107_chip_info(struct phy_
+ 		   fw_major, fw_minor, build_id, prov_id);
+ }
+ 
++static int aqr107_config_mdi(struct phy_device *phydev)
++{
++	struct device_node *np = phydev->mdio.dev.of_node;
++	u32 mdi_conf;
++	int ret;
++
++	ret = of_property_read_u32(np, "marvell,mdi-cfg-order", &mdi_conf);
++
++	/* Do nothing in case property "marvell,mdi-cfg-order" is not present */
++	if (ret == -ENOENT)
++		return 0;
++
++	if (ret)
++		return ret;
++
++	if (mdi_conf & ~PMAPMD_RSVD_VEND_PROV_MDI_REVERSE)
++		return -EINVAL;
++
++	return phy_modify_mmd(phydev, MDIO_MMD_PMAPMD, PMAPMD_RSVD_VEND_PROV,
++			      PMAPMD_RSVD_VEND_PROV_MDI_CONF,
++			      mdi_conf | PMAPMD_RSVD_VEND_PROV_MDI_FORCE);
++}
++
+ static int aqr107_config_init(struct phy_device *phydev)
+ {
+ 	struct aqr107_priv *priv = phydev->priv;
+@@ -514,6 +543,10 @@ static int aqr107_config_init(struct phy
+ 	if (ret)
+ 		return ret;
+ 
++	ret = aqr107_config_mdi(phydev);
++	if (ret)
++		return ret;
++
+ 	/* Restore LED polarity state after reset */
+ 	for_each_set_bit(led_active_low, &priv->leds_active_low, AQR_MAX_LEDS) {
+ 		ret = aqr_phy_led_active_low_set(phydev, led_active_low, true);
diff --git a/6.12/target/linux/generic/backport-6.12/840-v6.13-net-phy-aquantia-fix-return-value-check-in-aqr107_co.patch b/6.12/target/linux/generic/backport-6.12/840-v6.13-net-phy-aquantia-fix-return-value-check-in-aqr107_co.patch
new file mode 100644
index 00000000..565edbd3
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/840-v6.13-net-phy-aquantia-fix-return-value-check-in-aqr107_co.patch
@@ -0,0 +1,31 @@
+From ce21b8fb255ebf0b49913fb4c62741d7eb05c6f6 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Fri, 11 Oct 2024 22:28:43 +0100
+Subject: [PATCH] net: phy: aquantia: fix return value check in
+ aqr107_config_mdi()
+
+of_property_read_u32() returns -EINVAL in case the property cannot be
+found rather than -ENOENT. Fix the check to not abort probing in case
+of the property being missing, and also in case CONFIG_OF is not set
+which will result in -ENOSYS.
+
+Fixes: a2e1ba275eae ("net: phy: aquantia: allow forcing order of MDI pairs")
+Reported-by: Jon Hunter <jonathanh@nvidia.com>
+Closes: https://lore.kernel.org/all/114b4c03-5d16-42ed-945d-cf78eabea12b@nvidia.com/
+Suggested-by: Hans-Frieder Vogt <hfdevel@gmx.net>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/aquantia/aquantia_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/phy/aquantia/aquantia_main.c
++++ b/drivers/net/phy/aquantia/aquantia_main.c
+@@ -500,7 +500,7 @@ static int aqr107_config_mdi(struct phy_
+ 	ret = of_property_read_u32(np, "marvell,mdi-cfg-order", &mdi_conf);
+ 
+ 	/* Do nothing in case property "marvell,mdi-cfg-order" is not present */
+-	if (ret == -ENOENT)
++	if (ret == -EINVAL || ret == -ENOSYS)
+ 		return 0;
+ 
+ 	if (ret)
diff --git a/6.12/target/linux/generic/backport-6.12/841-v6.13-net-phy-support-active-high-property-for-PHY-LEDs.patch b/6.12/target/linux/generic/backport-6.12/841-v6.13-net-phy-support-active-high-property-for-PHY-LEDs.patch
new file mode 100644
index 00000000..7781aa2c
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/841-v6.13-net-phy-support-active-high-property-for-PHY-LEDs.patch
@@ -0,0 +1,53 @@
+From a274465cc3bef2dfd9c9ea5100848dda0a8641e1 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Thu, 10 Oct 2024 13:54:19 +0100
+Subject: [PATCH 1/4] net: phy: support 'active-high' property for PHY LEDs
+
+In addition to 'active-low' and 'inactive-high-impedance' also
+support 'active-high' property for PHY LED pin configuration.
+As only either 'active-high' or 'active-low' can be set at the
+same time, WARN and return an error in case both are set.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/91598487773d768f254d5faf06cf65b13e972f0e.1728558223.git.daniel@makrotopia.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/phy/phy_device.c | 6 ++++++
+ include/linux/phy.h          | 5 +++--
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -3358,11 +3358,17 @@ static int of_phy_led(struct phy_device
+ 	if (index > U8_MAX)
+ 		return -EINVAL;
+ 
++	if (of_property_read_bool(led, "active-high"))
++		set_bit(PHY_LED_ACTIVE_HIGH, &modes);
+ 	if (of_property_read_bool(led, "active-low"))
+ 		set_bit(PHY_LED_ACTIVE_LOW, &modes);
+ 	if (of_property_read_bool(led, "inactive-high-impedance"))
+ 		set_bit(PHY_LED_INACTIVE_HIGH_IMPEDANCE, &modes);
+ 
++	if (WARN_ON(modes & BIT(PHY_LED_ACTIVE_LOW) &&
++		    modes & BIT(PHY_LED_ACTIVE_HIGH)))
++		return -EINVAL;
++
+ 	if (modes) {
+ 		/* Return error if asked to set polarity modes but not supported */
+ 		if (!phydev->drv->led_polarity_set)
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -877,8 +877,9 @@ struct phy_plca_status {
+ 
+ /* Modes for PHY LED configuration */
+ enum phy_led_modes {
+-	PHY_LED_ACTIVE_LOW = 0,
+-	PHY_LED_INACTIVE_HIGH_IMPEDANCE = 1,
++	PHY_LED_ACTIVE_HIGH = 0,
++	PHY_LED_ACTIVE_LOW = 1,
++	PHY_LED_INACTIVE_HIGH_IMPEDANCE = 2,
+ 
+ 	/* keep it last */
+ 	__PHY_LED_MODES_NUM,
diff --git a/6.12/target/linux/generic/backport-6.12/842-v6.13-net-phy-aquantia-correctly-describe-LED-polarity-ove.patch b/6.12/target/linux/generic/backport-6.12/842-v6.13-net-phy-aquantia-correctly-describe-LED-polarity-ove.patch
new file mode 100644
index 00000000..155f796f
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/842-v6.13-net-phy-aquantia-correctly-describe-LED-polarity-ove.patch
@@ -0,0 +1,108 @@
+From 9d55e68b19f222e6334ef4021c5527998f5ab537 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Thu, 10 Oct 2024 13:55:00 +0100
+Subject: [PATCH 2/4] net: phy: aquantia: correctly describe LED polarity
+ override
+
+Use newly defined 'active-high' property to set the
+VEND1_GLOBAL_LED_DRIVE_VDD bit and let 'active-low' clear that bit. This
+reflects the technical reality which was inverted in the previous
+description in which the 'active-low' property was used to actually set
+the VEND1_GLOBAL_LED_DRIVE_VDD bit, which means that VDD (ie. supply
+voltage) of the LED is driven rather than GND.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/86a413b4387c42dcb54f587cc2433a06f16aae83.1728558223.git.daniel@makrotopia.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/phy/aquantia/aquantia.h      |  1 +
+ drivers/net/phy/aquantia/aquantia_leds.c | 19 ++++++++++++++-----
+ drivers/net/phy/aquantia/aquantia_main.c | 12 +++++++++---
+ 3 files changed, 24 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/phy/aquantia/aquantia.h
++++ b/drivers/net/phy/aquantia/aquantia.h
+@@ -177,6 +177,7 @@ static const struct aqr107_hw_stat aqr10
+ struct aqr107_priv {
+ 	u64 sgmii_stats[AQR107_SGMII_STAT_SZ];
+ 	unsigned long leds_active_low;
++	unsigned long leds_active_high;
+ };
+ 
+ #if IS_REACHABLE(CONFIG_HWMON)
+--- a/drivers/net/phy/aquantia/aquantia_leds.c
++++ b/drivers/net/phy/aquantia/aquantia_leds.c
+@@ -121,13 +121,13 @@ int aqr_phy_led_active_low_set(struct ph
+ {
+ 	return phy_modify_mmd(phydev, MDIO_MMD_VEND1, AQR_LED_DRIVE(index),
+ 			      VEND1_GLOBAL_LED_DRIVE_VDD,
+-			      enable ? VEND1_GLOBAL_LED_DRIVE_VDD : 0);
++			      enable ? 0 : VEND1_GLOBAL_LED_DRIVE_VDD);
+ }
+ 
+ int aqr_phy_led_polarity_set(struct phy_device *phydev, int index, unsigned long modes)
+ {
++	bool force_active_low = false, force_active_high = false;
+ 	struct aqr107_priv *priv = phydev->priv;
+-	bool active_low = false;
+ 	u32 mode;
+ 
+ 	if (index >= AQR_MAX_LEDS)
+@@ -136,7 +136,10 @@ int aqr_phy_led_polarity_set(struct phy_
+ 	for_each_set_bit(mode, &modes, __PHY_LED_MODES_NUM) {
+ 		switch (mode) {
+ 		case PHY_LED_ACTIVE_LOW:
+-			active_low = true;
++			force_active_low = true;
++			break;
++		case PHY_LED_ACTIVE_HIGH:
++			force_active_high = true;
+ 			break;
+ 		default:
+ 			return -EINVAL;
+@@ -144,8 +147,14 @@ int aqr_phy_led_polarity_set(struct phy_
+ 	}
+ 
+ 	/* Save LED driver vdd state to restore on SW reset */
+-	if (active_low)
++	if (force_active_low)
+ 		priv->leds_active_low |= BIT(index);
+ 
+-	return aqr_phy_led_active_low_set(phydev, index, active_low);
++	if (force_active_high)
++		priv->leds_active_high |= BIT(index);
++
++	if (force_active_high || force_active_low)
++		return aqr_phy_led_active_low_set(phydev, index, force_active_low);
++
++	unreachable();
+ }
+--- a/drivers/net/phy/aquantia/aquantia_main.c
++++ b/drivers/net/phy/aquantia/aquantia_main.c
+@@ -517,7 +517,7 @@ static int aqr107_config_mdi(struct phy_
+ static int aqr107_config_init(struct phy_device *phydev)
+ {
+ 	struct aqr107_priv *priv = phydev->priv;
+-	u32 led_active_low;
++	u32 led_idx;
+ 	int ret;
+ 
+ 	/* Check that the PHY interface type is compatible */
+@@ -548,8 +548,14 @@ static int aqr107_config_init(struct phy
+ 		return ret;
+ 
+ 	/* Restore LED polarity state after reset */
+-	for_each_set_bit(led_active_low, &priv->leds_active_low, AQR_MAX_LEDS) {
+-		ret = aqr_phy_led_active_low_set(phydev, led_active_low, true);
++	for_each_set_bit(led_idx, &priv->leds_active_low, AQR_MAX_LEDS) {
++		ret = aqr_phy_led_active_low_set(phydev, led_idx, true);
++		if (ret)
++			return ret;
++	}
++
++	for_each_set_bit(led_idx, &priv->leds_active_high, AQR_MAX_LEDS) {
++		ret = aqr_phy_led_active_low_set(phydev, led_idx, false);
+ 		if (ret)
+ 			return ret;
+ 	}
diff --git a/6.12/target/linux/generic/backport-6.12/843-v6.13-net-phy-mxl-gpy-add-basic-LED-support.patch b/6.12/target/linux/generic/backport-6.12/843-v6.13-net-phy-mxl-gpy-add-basic-LED-support.patch
new file mode 100644
index 00000000..c785f8a9
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/843-v6.13-net-phy-mxl-gpy-add-basic-LED-support.patch
@@ -0,0 +1,332 @@
+From 78997e9a5e4d8a4df561e083a92c91ae23010e07 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Tue, 1 Oct 2024 01:17:18 +0100
+Subject: [PATCH] net: phy: mxl-gpy: add basic LED support
+
+Add basic support for LEDs connected to MaxLinear GPY2xx and GPY115 PHYs.
+The PHYs allow up to 4 LEDs to be connected.
+Implement controlling LEDs in software as well as netdev trigger offloading
+and LED polarity setup.
+
+The hardware claims to support 16 PWM brightness levels but there is no
+documentation on how to use that feature, hence this is not supported.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/b6ec9050339f8244ff898898a1cecc33b13a48fc.1727741563.git.daniel@makrotopia.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/mxl-gpy.c | 218 ++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 218 insertions(+)
+
+--- a/drivers/net/phy/mxl-gpy.c
++++ b/drivers/net/phy/mxl-gpy.c
+@@ -38,6 +38,7 @@
+ #define PHY_MIISTAT		0x18	/* MII state */
+ #define PHY_IMASK		0x19	/* interrupt mask */
+ #define PHY_ISTAT		0x1A	/* interrupt status */
++#define PHY_LED			0x1B	/* LEDs */
+ #define PHY_FWV			0x1E	/* firmware version */
+ 
+ #define PHY_MIISTAT_SPD_MASK	GENMASK(2, 0)
+@@ -61,6 +62,11 @@
+ 				 PHY_IMASK_ADSC | \
+ 				 PHY_IMASK_ANC)
+ 
++#define GPY_MAX_LEDS		4
++#define PHY_LED_POLARITY(idx)	BIT(12 + (idx))
++#define PHY_LED_HWCONTROL(idx)	BIT(8 + (idx))
++#define PHY_LED_ON(idx)		BIT(idx)
++
+ #define PHY_FWV_REL_MASK	BIT(15)
+ #define PHY_FWV_MAJOR_MASK	GENMASK(11, 8)
+ #define PHY_FWV_MINOR_MASK	GENMASK(7, 0)
+@@ -72,6 +78,23 @@
+ #define PHY_MDI_MDI_X_CD	0x1
+ #define PHY_MDI_MDI_X_CROSS	0x0
+ 
++/* LED */
++#define VSPEC1_LED(idx)		(1 + (idx))
++#define VSPEC1_LED_BLINKS	GENMASK(15, 12)
++#define VSPEC1_LED_PULSE	GENMASK(11, 8)
++#define VSPEC1_LED_CON		GENMASK(7, 4)
++#define VSPEC1_LED_BLINKF	GENMASK(3, 0)
++
++#define VSPEC1_LED_LINK10	BIT(0)
++#define VSPEC1_LED_LINK100	BIT(1)
++#define VSPEC1_LED_LINK1000	BIT(2)
++#define VSPEC1_LED_LINK2500	BIT(3)
++
++#define VSPEC1_LED_TXACT	BIT(0)
++#define VSPEC1_LED_RXACT	BIT(1)
++#define VSPEC1_LED_COL		BIT(2)
++#define VSPEC1_LED_NO_CON	BIT(3)
++
+ /* SGMII */
+ #define VSPEC1_SGMII_CTRL	0x08
+ #define VSPEC1_SGMII_CTRL_ANEN	BIT(12)		/* Aneg enable */
+@@ -835,6 +858,156 @@ static int gpy115_loopback(struct phy_de
+ 	return genphy_soft_reset(phydev);
+ }
+ 
++static int gpy_led_brightness_set(struct phy_device *phydev,
++				  u8 index, enum led_brightness value)
++{
++	int ret;
++
++	if (index >= GPY_MAX_LEDS)
++		return -EINVAL;
++
++	/* clear HWCONTROL and set manual LED state */
++	ret = phy_modify(phydev, PHY_LED,
++			 ((value == LED_OFF) ? PHY_LED_HWCONTROL(index) : 0) |
++			 PHY_LED_ON(index),
++			 (value == LED_OFF) ? 0 : PHY_LED_ON(index));
++	if (ret)
++		return ret;
++
++	/* ToDo: set PWM brightness */
++
++	/* clear HW LED setup */
++	if (value == LED_OFF)
++		return phy_write_mmd(phydev, MDIO_MMD_VEND1, VSPEC1_LED(index), 0);
++	else
++		return 0;
++}
++
++static const unsigned long supported_triggers = (BIT(TRIGGER_NETDEV_LINK) |
++						 BIT(TRIGGER_NETDEV_LINK_100) |
++						 BIT(TRIGGER_NETDEV_LINK_1000) |
++						 BIT(TRIGGER_NETDEV_LINK_2500) |
++						 BIT(TRIGGER_NETDEV_RX) |
++						 BIT(TRIGGER_NETDEV_TX));
++
++static int gpy_led_hw_is_supported(struct phy_device *phydev, u8 index,
++				   unsigned long rules)
++{
++	if (index >= GPY_MAX_LEDS)
++		return -EINVAL;
++
++	/* All combinations of the supported triggers are allowed */
++	if (rules & ~supported_triggers)
++		return -EOPNOTSUPP;
++
++	return 0;
++}
++
++static int gpy_led_hw_control_get(struct phy_device *phydev, u8 index,
++				  unsigned long *rules)
++{
++	int val;
++
++	if (index >= GPY_MAX_LEDS)
++		return -EINVAL;
++
++	val = phy_read_mmd(phydev, MDIO_MMD_VEND1, VSPEC1_LED(index));
++	if (val < 0)
++		return val;
++
++	if (FIELD_GET(VSPEC1_LED_CON, val) & VSPEC1_LED_LINK10)
++		*rules |= BIT(TRIGGER_NETDEV_LINK_10);
++
++	if (FIELD_GET(VSPEC1_LED_CON, val) & VSPEC1_LED_LINK100)
++		*rules |= BIT(TRIGGER_NETDEV_LINK_100);
++
++	if (FIELD_GET(VSPEC1_LED_CON, val) & VSPEC1_LED_LINK1000)
++		*rules |= BIT(TRIGGER_NETDEV_LINK_1000);
++
++	if (FIELD_GET(VSPEC1_LED_CON, val) & VSPEC1_LED_LINK2500)
++		*rules |= BIT(TRIGGER_NETDEV_LINK_2500);
++
++	if (FIELD_GET(VSPEC1_LED_CON, val) == (VSPEC1_LED_LINK10 |
++					       VSPEC1_LED_LINK100 |
++					       VSPEC1_LED_LINK1000 |
++					       VSPEC1_LED_LINK2500))
++		*rules |= BIT(TRIGGER_NETDEV_LINK);
++
++	if (FIELD_GET(VSPEC1_LED_PULSE, val) & VSPEC1_LED_TXACT)
++		*rules |= BIT(TRIGGER_NETDEV_TX);
++
++	if (FIELD_GET(VSPEC1_LED_PULSE, val) & VSPEC1_LED_RXACT)
++		*rules |= BIT(TRIGGER_NETDEV_RX);
++
++	return 0;
++}
++
++static int gpy_led_hw_control_set(struct phy_device *phydev, u8 index,
++				  unsigned long rules)
++{
++	u16 val = 0;
++	int ret;
++
++	if (index >= GPY_MAX_LEDS)
++		return -EINVAL;
++
++	if (rules & BIT(TRIGGER_NETDEV_LINK) ||
++	    rules & BIT(TRIGGER_NETDEV_LINK_10))
++		val |= FIELD_PREP(VSPEC1_LED_CON, VSPEC1_LED_LINK10);
++
++	if (rules & BIT(TRIGGER_NETDEV_LINK) ||
++	    rules & BIT(TRIGGER_NETDEV_LINK_100))
++		val |= FIELD_PREP(VSPEC1_LED_CON, VSPEC1_LED_LINK100);
++
++	if (rules & BIT(TRIGGER_NETDEV_LINK) ||
++	    rules & BIT(TRIGGER_NETDEV_LINK_1000))
++		val |= FIELD_PREP(VSPEC1_LED_CON, VSPEC1_LED_LINK1000);
++
++	if (rules & BIT(TRIGGER_NETDEV_LINK) ||
++	    rules & BIT(TRIGGER_NETDEV_LINK_2500))
++		val |= FIELD_PREP(VSPEC1_LED_CON, VSPEC1_LED_LINK2500);
++
++	if (rules & BIT(TRIGGER_NETDEV_TX))
++		val |= FIELD_PREP(VSPEC1_LED_PULSE, VSPEC1_LED_TXACT);
++
++	if (rules & BIT(TRIGGER_NETDEV_RX))
++		val |= FIELD_PREP(VSPEC1_LED_PULSE, VSPEC1_LED_RXACT);
++
++	/* allow RX/TX pulse without link indication */
++	if ((rules & BIT(TRIGGER_NETDEV_TX) || rules & BIT(TRIGGER_NETDEV_RX)) &&
++	    !(val & VSPEC1_LED_CON))
++		val |= FIELD_PREP(VSPEC1_LED_PULSE, VSPEC1_LED_NO_CON) | VSPEC1_LED_CON;
++
++	ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, VSPEC1_LED(index), val);
++	if (ret)
++		return ret;
++
++	return phy_set_bits(phydev, PHY_LED, PHY_LED_HWCONTROL(index));
++}
++
++static int gpy_led_polarity_set(struct phy_device *phydev, int index,
++				unsigned long modes)
++{
++	bool active_low = false;
++	u32 mode;
++
++	if (index >= GPY_MAX_LEDS)
++		return -EINVAL;
++
++	for_each_set_bit(mode, &modes, __PHY_LED_MODES_NUM) {
++		switch (mode) {
++		case PHY_LED_ACTIVE_LOW:
++			active_low = true;
++			break;
++		default:
++			return -EINVAL;
++		}
++	}
++
++	return phy_modify(phydev, PHY_LED, PHY_LED_POLARITY(index),
++			  active_low ? 0 : PHY_LED_POLARITY(index));
++}
++
+ static struct phy_driver gpy_drivers[] = {
+ 	{
+ 		PHY_ID_MATCH_MODEL(PHY_ID_GPY2xx),
+@@ -852,6 +1025,11 @@ static struct phy_driver gpy_drivers[] =
+ 		.set_wol	= gpy_set_wol,
+ 		.get_wol	= gpy_get_wol,
+ 		.set_loopback	= gpy_loopback,
++		.led_brightness_set = gpy_led_brightness_set,
++		.led_hw_is_supported = gpy_led_hw_is_supported,
++		.led_hw_control_get = gpy_led_hw_control_get,
++		.led_hw_control_set = gpy_led_hw_control_set,
++		.led_polarity_set = gpy_led_polarity_set,
+ 	},
+ 	{
+ 		.phy_id		= PHY_ID_GPY115B,
+@@ -870,6 +1048,11 @@ static struct phy_driver gpy_drivers[] =
+ 		.set_wol	= gpy_set_wol,
+ 		.get_wol	= gpy_get_wol,
+ 		.set_loopback	= gpy115_loopback,
++		.led_brightness_set = gpy_led_brightness_set,
++		.led_hw_is_supported = gpy_led_hw_is_supported,
++		.led_hw_control_get = gpy_led_hw_control_get,
++		.led_hw_control_set = gpy_led_hw_control_set,
++		.led_polarity_set = gpy_led_polarity_set,
+ 	},
+ 	{
+ 		PHY_ID_MATCH_MODEL(PHY_ID_GPY115C),
+@@ -887,6 +1070,11 @@ static struct phy_driver gpy_drivers[] =
+ 		.set_wol	= gpy_set_wol,
+ 		.get_wol	= gpy_get_wol,
+ 		.set_loopback	= gpy115_loopback,
++		.led_brightness_set = gpy_led_brightness_set,
++		.led_hw_is_supported = gpy_led_hw_is_supported,
++		.led_hw_control_get = gpy_led_hw_control_get,
++		.led_hw_control_set = gpy_led_hw_control_set,
++		.led_polarity_set = gpy_led_polarity_set,
+ 	},
+ 	{
+ 		.phy_id		= PHY_ID_GPY211B,
+@@ -905,6 +1093,11 @@ static struct phy_driver gpy_drivers[] =
+ 		.set_wol	= gpy_set_wol,
+ 		.get_wol	= gpy_get_wol,
+ 		.set_loopback	= gpy_loopback,
++		.led_brightness_set = gpy_led_brightness_set,
++		.led_hw_is_supported = gpy_led_hw_is_supported,
++		.led_hw_control_get = gpy_led_hw_control_get,
++		.led_hw_control_set = gpy_led_hw_control_set,
++		.led_polarity_set = gpy_led_polarity_set,
+ 	},
+ 	{
+ 		PHY_ID_MATCH_MODEL(PHY_ID_GPY211C),
+@@ -922,6 +1115,11 @@ static struct phy_driver gpy_drivers[] =
+ 		.set_wol	= gpy_set_wol,
+ 		.get_wol	= gpy_get_wol,
+ 		.set_loopback	= gpy_loopback,
++		.led_brightness_set = gpy_led_brightness_set,
++		.led_hw_is_supported = gpy_led_hw_is_supported,
++		.led_hw_control_get = gpy_led_hw_control_get,
++		.led_hw_control_set = gpy_led_hw_control_set,
++		.led_polarity_set = gpy_led_polarity_set,
+ 	},
+ 	{
+ 		.phy_id		= PHY_ID_GPY212B,
+@@ -940,6 +1138,11 @@ static struct phy_driver gpy_drivers[] =
+ 		.set_wol	= gpy_set_wol,
+ 		.get_wol	= gpy_get_wol,
+ 		.set_loopback	= gpy_loopback,
++		.led_brightness_set = gpy_led_brightness_set,
++		.led_hw_is_supported = gpy_led_hw_is_supported,
++		.led_hw_control_get = gpy_led_hw_control_get,
++		.led_hw_control_set = gpy_led_hw_control_set,
++		.led_polarity_set = gpy_led_polarity_set,
+ 	},
+ 	{
+ 		PHY_ID_MATCH_MODEL(PHY_ID_GPY212C),
+@@ -957,6 +1160,11 @@ static struct phy_driver gpy_drivers[] =
+ 		.set_wol	= gpy_set_wol,
+ 		.get_wol	= gpy_get_wol,
+ 		.set_loopback	= gpy_loopback,
++		.led_brightness_set = gpy_led_brightness_set,
++		.led_hw_is_supported = gpy_led_hw_is_supported,
++		.led_hw_control_get = gpy_led_hw_control_get,
++		.led_hw_control_set = gpy_led_hw_control_set,
++		.led_polarity_set = gpy_led_polarity_set,
+ 	},
+ 	{
+ 		.phy_id		= PHY_ID_GPY215B,
+@@ -975,6 +1183,11 @@ static struct phy_driver gpy_drivers[] =
+ 		.set_wol	= gpy_set_wol,
+ 		.get_wol	= gpy_get_wol,
+ 		.set_loopback	= gpy_loopback,
++		.led_brightness_set = gpy_led_brightness_set,
++		.led_hw_is_supported = gpy_led_hw_is_supported,
++		.led_hw_control_get = gpy_led_hw_control_get,
++		.led_hw_control_set = gpy_led_hw_control_set,
++		.led_polarity_set = gpy_led_polarity_set,
+ 	},
+ 	{
+ 		PHY_ID_MATCH_MODEL(PHY_ID_GPY215C),
+@@ -992,6 +1205,11 @@ static struct phy_driver gpy_drivers[] =
+ 		.set_wol	= gpy_set_wol,
+ 		.get_wol	= gpy_get_wol,
+ 		.set_loopback	= gpy_loopback,
++		.led_brightness_set = gpy_led_brightness_set,
++		.led_hw_is_supported = gpy_led_hw_is_supported,
++		.led_hw_control_get = gpy_led_hw_control_get,
++		.led_hw_control_set = gpy_led_hw_control_set,
++		.led_polarity_set = gpy_led_polarity_set,
+ 	},
+ 	{
+ 		PHY_ID_MATCH_MODEL(PHY_ID_GPY241B),
diff --git a/6.12/target/linux/generic/backport-6.12/844-v6.13-net-phy-mxl-gpy-add-missing-support-for-TRIGGER_NETD.patch b/6.12/target/linux/generic/backport-6.12/844-v6.13-net-phy-mxl-gpy-add-missing-support-for-TRIGGER_NETD.patch
new file mode 100644
index 00000000..39bef9b9
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/844-v6.13-net-phy-mxl-gpy-add-missing-support-for-TRIGGER_NETD.patch
@@ -0,0 +1,28 @@
+From f95b4725e796b12e5f347a0d161e1d3843142aa8 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Fri, 4 Oct 2024 16:56:35 +0100
+Subject: [PATCH] net: phy: mxl-gpy: add missing support for
+ TRIGGER_NETDEV_LINK_10
+
+The PHY also support 10MBit/s links as well as the corresponding link
+indication trigger to be offloaded. Add TRIGGER_NETDEV_LINK_10 to the
+supported triggers.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/cc5da0a989af8b0d49d823656d88053c4de2ab98.1728057367.git.daniel@makrotopia.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/mxl-gpy.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/phy/mxl-gpy.c
++++ b/drivers/net/phy/mxl-gpy.c
+@@ -884,6 +884,7 @@ static int gpy_led_brightness_set(struct
+ }
+ 
+ static const unsigned long supported_triggers = (BIT(TRIGGER_NETDEV_LINK) |
++						 BIT(TRIGGER_NETDEV_LINK_10) |
+ 						 BIT(TRIGGER_NETDEV_LINK_100) |
+ 						 BIT(TRIGGER_NETDEV_LINK_1000) |
+ 						 BIT(TRIGGER_NETDEV_LINK_2500) |
diff --git a/6.12/target/linux/generic/backport-6.12/845-v6.13-net-phy-mxl-gpy-correctly-describe-LED-polarity.patch b/6.12/target/linux/generic/backport-6.12/845-v6.13-net-phy-mxl-gpy-correctly-describe-LED-polarity.patch
new file mode 100644
index 00000000..5fd3dcc7
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/845-v6.13-net-phy-mxl-gpy-correctly-describe-LED-polarity.patch
@@ -0,0 +1,58 @@
+From eb89c79c1b8f17fc1611540768678e60df89ac42 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Thu, 10 Oct 2024 13:55:17 +0100
+Subject: [PATCH 3/4] net: phy: mxl-gpy: correctly describe LED polarity
+
+According the datasheet covering the LED (0x1b) register:
+0B Active High LEDx pin driven high when activated
+1B Active Low LEDx pin driven low when activated
+
+Make use of the now available 'active-high' property and correctly
+reflect the polarity setting which was previously inverted.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/180ccafa837f09908b852a8a874a3808c5ecd2d0.1728558223.git.daniel@makrotopia.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/phy/mxl-gpy.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/phy/mxl-gpy.c
++++ b/drivers/net/phy/mxl-gpy.c
+@@ -989,7 +989,7 @@ static int gpy_led_hw_control_set(struct
+ static int gpy_led_polarity_set(struct phy_device *phydev, int index,
+ 				unsigned long modes)
+ {
+-	bool active_low = false;
++	bool force_active_low = false, force_active_high = false;
+ 	u32 mode;
+ 
+ 	if (index >= GPY_MAX_LEDS)
+@@ -998,15 +998,23 @@ static int gpy_led_polarity_set(struct p
+ 	for_each_set_bit(mode, &modes, __PHY_LED_MODES_NUM) {
+ 		switch (mode) {
+ 		case PHY_LED_ACTIVE_LOW:
+-			active_low = true;
++			force_active_low = true;
++			break;
++		case PHY_LED_ACTIVE_HIGH:
++			force_active_high = true;
+ 			break;
+ 		default:
+ 			return -EINVAL;
+ 		}
+ 	}
+ 
+-	return phy_modify(phydev, PHY_LED, PHY_LED_POLARITY(index),
+-			  active_low ? 0 : PHY_LED_POLARITY(index));
++	if (force_active_low)
++		return phy_set_bits(phydev, PHY_LED, PHY_LED_POLARITY(index));
++
++	if (force_active_high)
++		return phy_clear_bits(phydev, PHY_LED, PHY_LED_POLARITY(index));
++
++	unreachable();
+ }
+ 
+ static struct phy_driver gpy_drivers[] = {
diff --git a/6.12/target/linux/generic/backport-6.12/846-v6.13-net-phy-intel-xway-add-support-for-PHY-LEDs.patch b/6.12/target/linux/generic/backport-6.12/846-v6.13-net-phy-intel-xway-add-support-for-PHY-LEDs.patch
new file mode 100644
index 00000000..c57b5777
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/846-v6.13-net-phy-intel-xway-add-support-for-PHY-LEDs.patch
@@ -0,0 +1,379 @@
+From 1758af47b98c17da464cb45f476875150955dd48 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Thu, 10 Oct 2024 13:55:29 +0100
+Subject: [PATCH 4/4] net: phy: intel-xway: add support for PHY LEDs
+
+The intel-xway PHY driver predates the PHY LED framework and currently
+initializes all LED pins to equal default values.
+
+Add PHY LED functions to the drivers and don't set default values if
+LEDs are defined in device tree.
+
+According the datasheets 3 LEDs are supported on all Intel XWAY PHYs.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/81f4717ab9acf38f3239727a4540ae96fd01109b.1728558223.git.daniel@makrotopia.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/phy/intel-xway.c | 253 +++++++++++++++++++++++++++++++++--
+ 1 file changed, 244 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/phy/intel-xway.c
++++ b/drivers/net/phy/intel-xway.c
+@@ -151,6 +151,13 @@
+ #define XWAY_MMD_LED3H			0x01E8
+ #define XWAY_MMD_LED3L			0x01E9
+ 
++#define XWAY_GPHY_MAX_LEDS		3
++#define XWAY_GPHY_LED_INV(idx)		BIT(12 + (idx))
++#define XWAY_GPHY_LED_EN(idx)		BIT(8 + (idx))
++#define XWAY_GPHY_LED_DA(idx)		BIT(idx)
++#define XWAY_MMD_LEDxH(idx)		(XWAY_MMD_LED0H + 2 * (idx))
++#define XWAY_MMD_LEDxL(idx)		(XWAY_MMD_LED0L + 2 * (idx))
++
+ #define PHY_ID_PHY11G_1_3		0x030260D1
+ #define PHY_ID_PHY22F_1_3		0x030260E1
+ #define PHY_ID_PHY11G_1_4		0xD565A400
+@@ -229,20 +236,12 @@ static int xway_gphy_rgmii_init(struct p
+ 			  XWAY_MDIO_MIICTRL_TXSKEW_MASK, val);
+ }
+ 
+-static int xway_gphy_config_init(struct phy_device *phydev)
++static int xway_gphy_init_leds(struct phy_device *phydev)
+ {
+ 	int err;
+ 	u32 ledxh;
+ 	u32 ledxl;
+ 
+-	/* Mask all interrupts */
+-	err = phy_write(phydev, XWAY_MDIO_IMASK, 0);
+-	if (err)
+-		return err;
+-
+-	/* Clear all pending interrupts */
+-	phy_read(phydev, XWAY_MDIO_ISTAT);
+-
+ 	/* Ensure that integrated led function is enabled for all leds */
+ 	err = phy_write(phydev, XWAY_MDIO_LED,
+ 			XWAY_MDIO_LED_LED0_EN |
+@@ -276,6 +275,26 @@ static int xway_gphy_config_init(struct
+ 	phy_write_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LED2H, ledxh);
+ 	phy_write_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LED2L, ledxl);
+ 
++	return 0;
++}
++
++static int xway_gphy_config_init(struct phy_device *phydev)
++{
++	struct device_node *np = phydev->mdio.dev.of_node;
++	int err;
++
++	/* Mask all interrupts */
++	err = phy_write(phydev, XWAY_MDIO_IMASK, 0);
++	if (err)
++		return err;
++
++	/* Use default LED configuration if 'leds' node isn't defined */
++	if (!of_get_child_by_name(np, "leds"))
++		xway_gphy_init_leds(phydev);
++
++	/* Clear all pending interrupts */
++	phy_read(phydev, XWAY_MDIO_ISTAT);
++
+ 	err = xway_gphy_rgmii_init(phydev);
+ 	if (err)
+ 		return err;
+@@ -347,6 +366,172 @@ static irqreturn_t xway_gphy_handle_inte
+ 	return IRQ_HANDLED;
+ }
+ 
++static int xway_gphy_led_brightness_set(struct phy_device *phydev,
++					u8 index, enum led_brightness value)
++{
++	int ret;
++
++	if (index >= XWAY_GPHY_MAX_LEDS)
++		return -EINVAL;
++
++	/* clear EN and set manual LED state */
++	ret = phy_modify(phydev, XWAY_MDIO_LED,
++			 ((value == LED_OFF) ? XWAY_GPHY_LED_EN(index) : 0) |
++			 XWAY_GPHY_LED_DA(index),
++			 (value == LED_OFF) ? 0 : XWAY_GPHY_LED_DA(index));
++	if (ret)
++		return ret;
++
++	/* clear HW LED setup */
++	if (value == LED_OFF) {
++		ret = phy_write_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LEDxH(index), 0);
++		if (ret)
++			return ret;
++
++		return phy_write_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LEDxL(index), 0);
++	} else {
++		return 0;
++	}
++}
++
++static const unsigned long supported_triggers = (BIT(TRIGGER_NETDEV_LINK) |
++						 BIT(TRIGGER_NETDEV_LINK_10) |
++						 BIT(TRIGGER_NETDEV_LINK_100) |
++						 BIT(TRIGGER_NETDEV_LINK_1000) |
++						 BIT(TRIGGER_NETDEV_RX) |
++						 BIT(TRIGGER_NETDEV_TX));
++
++static int xway_gphy_led_hw_is_supported(struct phy_device *phydev, u8 index,
++					 unsigned long rules)
++{
++	if (index >= XWAY_GPHY_MAX_LEDS)
++		return -EINVAL;
++
++	/* activity triggers are not possible without combination with a link
++	 * trigger.
++	 */
++	if (rules & (BIT(TRIGGER_NETDEV_RX) | BIT(TRIGGER_NETDEV_TX)) &&
++	    !(rules & (BIT(TRIGGER_NETDEV_LINK) |
++		       BIT(TRIGGER_NETDEV_LINK_10) |
++		       BIT(TRIGGER_NETDEV_LINK_100) |
++		       BIT(TRIGGER_NETDEV_LINK_1000))))
++		return -EOPNOTSUPP;
++
++	/* All other combinations of the supported triggers are allowed */
++	if (rules & ~supported_triggers)
++		return -EOPNOTSUPP;
++
++	return 0;
++}
++
++static int xway_gphy_led_hw_control_get(struct phy_device *phydev, u8 index,
++					unsigned long *rules)
++{
++	int lval, hval;
++
++	if (index >= XWAY_GPHY_MAX_LEDS)
++		return -EINVAL;
++
++	hval = phy_read_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LEDxH(index));
++	if (hval < 0)
++		return hval;
++
++	lval = phy_read_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LEDxL(index));
++	if (lval < 0)
++		return lval;
++
++	if (hval & XWAY_MMD_LEDxH_CON_LINK10)
++		*rules |= BIT(TRIGGER_NETDEV_LINK_10);
++
++	if (hval & XWAY_MMD_LEDxH_CON_LINK100)
++		*rules |= BIT(TRIGGER_NETDEV_LINK_100);
++
++	if (hval & XWAY_MMD_LEDxH_CON_LINK1000)
++		*rules |= BIT(TRIGGER_NETDEV_LINK_1000);
++
++	if ((hval & XWAY_MMD_LEDxH_CON_LINK10) &&
++	    (hval & XWAY_MMD_LEDxH_CON_LINK100) &&
++	    (hval & XWAY_MMD_LEDxH_CON_LINK1000))
++		*rules |= BIT(TRIGGER_NETDEV_LINK);
++
++	if (lval & XWAY_MMD_LEDxL_PULSE_TXACT)
++		*rules |= BIT(TRIGGER_NETDEV_TX);
++
++	if (lval & XWAY_MMD_LEDxL_PULSE_RXACT)
++		*rules |= BIT(TRIGGER_NETDEV_RX);
++
++	return 0;
++}
++
++static int xway_gphy_led_hw_control_set(struct phy_device *phydev, u8 index,
++					unsigned long rules)
++{
++	u16 hval = 0, lval = 0;
++	int ret;
++
++	if (index >= XWAY_GPHY_MAX_LEDS)
++		return -EINVAL;
++
++	if (rules & BIT(TRIGGER_NETDEV_LINK) ||
++	    rules & BIT(TRIGGER_NETDEV_LINK_10))
++		hval |= XWAY_MMD_LEDxH_CON_LINK10;
++
++	if (rules & BIT(TRIGGER_NETDEV_LINK) ||
++	    rules & BIT(TRIGGER_NETDEV_LINK_100))
++		hval |= XWAY_MMD_LEDxH_CON_LINK100;
++
++	if (rules & BIT(TRIGGER_NETDEV_LINK) ||
++	    rules & BIT(TRIGGER_NETDEV_LINK_1000))
++		hval |= XWAY_MMD_LEDxH_CON_LINK1000;
++
++	if (rules & BIT(TRIGGER_NETDEV_TX))
++		lval |= XWAY_MMD_LEDxL_PULSE_TXACT;
++
++	if (rules & BIT(TRIGGER_NETDEV_RX))
++		lval |= XWAY_MMD_LEDxL_PULSE_RXACT;
++
++	ret = phy_write_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LEDxH(index), hval);
++	if (ret)
++		return ret;
++
++	ret = phy_write_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LEDxL(index), lval);
++	if (ret)
++		return ret;
++
++	return phy_set_bits(phydev, XWAY_MDIO_LED, XWAY_GPHY_LED_EN(index));
++}
++
++static int xway_gphy_led_polarity_set(struct phy_device *phydev, int index,
++				      unsigned long modes)
++{
++	bool force_active_low = false, force_active_high = false;
++	u32 mode;
++
++	if (index >= XWAY_GPHY_MAX_LEDS)
++		return -EINVAL;
++
++	for_each_set_bit(mode, &modes, __PHY_LED_MODES_NUM) {
++		switch (mode) {
++		case PHY_LED_ACTIVE_LOW:
++			force_active_low = true;
++			break;
++		case PHY_LED_ACTIVE_HIGH:
++			force_active_high = true;
++			break;
++		default:
++			return -EINVAL;
++		}
++	}
++
++	if (force_active_low)
++		return phy_set_bits(phydev, XWAY_MDIO_LED, XWAY_GPHY_LED_INV(index));
++
++	if (force_active_high)
++		return phy_clear_bits(phydev, XWAY_MDIO_LED, XWAY_GPHY_LED_INV(index));
++
++	unreachable();
++}
++
+ static struct phy_driver xway_gphy[] = {
+ 	{
+ 		.phy_id		= PHY_ID_PHY11G_1_3,
+@@ -359,6 +544,11 @@ static struct phy_driver xway_gphy[] = {
+ 		.config_intr	= xway_gphy_config_intr,
+ 		.suspend	= genphy_suspend,
+ 		.resume		= genphy_resume,
++		.led_brightness_set = xway_gphy_led_brightness_set,
++		.led_hw_is_supported = xway_gphy_led_hw_is_supported,
++		.led_hw_control_get = xway_gphy_led_hw_control_get,
++		.led_hw_control_set = xway_gphy_led_hw_control_set,
++		.led_polarity_set = xway_gphy_led_polarity_set,
+ 	}, {
+ 		.phy_id		= PHY_ID_PHY22F_1_3,
+ 		.phy_id_mask	= 0xffffffff,
+@@ -370,6 +560,11 @@ static struct phy_driver xway_gphy[] = {
+ 		.config_intr	= xway_gphy_config_intr,
+ 		.suspend	= genphy_suspend,
+ 		.resume		= genphy_resume,
++		.led_brightness_set = xway_gphy_led_brightness_set,
++		.led_hw_is_supported = xway_gphy_led_hw_is_supported,
++		.led_hw_control_get = xway_gphy_led_hw_control_get,
++		.led_hw_control_set = xway_gphy_led_hw_control_set,
++		.led_polarity_set = xway_gphy_led_polarity_set,
+ 	}, {
+ 		.phy_id		= PHY_ID_PHY11G_1_4,
+ 		.phy_id_mask	= 0xffffffff,
+@@ -381,6 +576,11 @@ static struct phy_driver xway_gphy[] = {
+ 		.config_intr	= xway_gphy_config_intr,
+ 		.suspend	= genphy_suspend,
+ 		.resume		= genphy_resume,
++		.led_brightness_set = xway_gphy_led_brightness_set,
++		.led_hw_is_supported = xway_gphy_led_hw_is_supported,
++		.led_hw_control_get = xway_gphy_led_hw_control_get,
++		.led_hw_control_set = xway_gphy_led_hw_control_set,
++		.led_polarity_set = xway_gphy_led_polarity_set,
+ 	}, {
+ 		.phy_id		= PHY_ID_PHY22F_1_4,
+ 		.phy_id_mask	= 0xffffffff,
+@@ -392,6 +592,11 @@ static struct phy_driver xway_gphy[] = {
+ 		.config_intr	= xway_gphy_config_intr,
+ 		.suspend	= genphy_suspend,
+ 		.resume		= genphy_resume,
++		.led_brightness_set = xway_gphy_led_brightness_set,
++		.led_hw_is_supported = xway_gphy_led_hw_is_supported,
++		.led_hw_control_get = xway_gphy_led_hw_control_get,
++		.led_hw_control_set = xway_gphy_led_hw_control_set,
++		.led_polarity_set = xway_gphy_led_polarity_set,
+ 	}, {
+ 		.phy_id		= PHY_ID_PHY11G_1_5,
+ 		.phy_id_mask	= 0xffffffff,
+@@ -402,6 +607,11 @@ static struct phy_driver xway_gphy[] = {
+ 		.config_intr	= xway_gphy_config_intr,
+ 		.suspend	= genphy_suspend,
+ 		.resume		= genphy_resume,
++		.led_brightness_set = xway_gphy_led_brightness_set,
++		.led_hw_is_supported = xway_gphy_led_hw_is_supported,
++		.led_hw_control_get = xway_gphy_led_hw_control_get,
++		.led_hw_control_set = xway_gphy_led_hw_control_set,
++		.led_polarity_set = xway_gphy_led_polarity_set,
+ 	}, {
+ 		.phy_id		= PHY_ID_PHY22F_1_5,
+ 		.phy_id_mask	= 0xffffffff,
+@@ -412,6 +622,11 @@ static struct phy_driver xway_gphy[] = {
+ 		.config_intr	= xway_gphy_config_intr,
+ 		.suspend	= genphy_suspend,
+ 		.resume		= genphy_resume,
++		.led_brightness_set = xway_gphy_led_brightness_set,
++		.led_hw_is_supported = xway_gphy_led_hw_is_supported,
++		.led_hw_control_get = xway_gphy_led_hw_control_get,
++		.led_hw_control_set = xway_gphy_led_hw_control_set,
++		.led_polarity_set = xway_gphy_led_polarity_set,
+ 	}, {
+ 		.phy_id		= PHY_ID_PHY11G_VR9_1_1,
+ 		.phy_id_mask	= 0xffffffff,
+@@ -422,6 +637,11 @@ static struct phy_driver xway_gphy[] = {
+ 		.config_intr	= xway_gphy_config_intr,
+ 		.suspend	= genphy_suspend,
+ 		.resume		= genphy_resume,
++		.led_brightness_set = xway_gphy_led_brightness_set,
++		.led_hw_is_supported = xway_gphy_led_hw_is_supported,
++		.led_hw_control_get = xway_gphy_led_hw_control_get,
++		.led_hw_control_set = xway_gphy_led_hw_control_set,
++		.led_polarity_set = xway_gphy_led_polarity_set,
+ 	}, {
+ 		.phy_id		= PHY_ID_PHY22F_VR9_1_1,
+ 		.phy_id_mask	= 0xffffffff,
+@@ -432,6 +652,11 @@ static struct phy_driver xway_gphy[] = {
+ 		.config_intr	= xway_gphy_config_intr,
+ 		.suspend	= genphy_suspend,
+ 		.resume		= genphy_resume,
++		.led_brightness_set = xway_gphy_led_brightness_set,
++		.led_hw_is_supported = xway_gphy_led_hw_is_supported,
++		.led_hw_control_get = xway_gphy_led_hw_control_get,
++		.led_hw_control_set = xway_gphy_led_hw_control_set,
++		.led_polarity_set = xway_gphy_led_polarity_set,
+ 	}, {
+ 		.phy_id		= PHY_ID_PHY11G_VR9_1_2,
+ 		.phy_id_mask	= 0xffffffff,
+@@ -442,6 +667,11 @@ static struct phy_driver xway_gphy[] = {
+ 		.config_intr	= xway_gphy_config_intr,
+ 		.suspend	= genphy_suspend,
+ 		.resume		= genphy_resume,
++		.led_brightness_set = xway_gphy_led_brightness_set,
++		.led_hw_is_supported = xway_gphy_led_hw_is_supported,
++		.led_hw_control_get = xway_gphy_led_hw_control_get,
++		.led_hw_control_set = xway_gphy_led_hw_control_set,
++		.led_polarity_set = xway_gphy_led_polarity_set,
+ 	}, {
+ 		.phy_id		= PHY_ID_PHY22F_VR9_1_2,
+ 		.phy_id_mask	= 0xffffffff,
+@@ -452,6 +682,11 @@ static struct phy_driver xway_gphy[] = {
+ 		.config_intr	= xway_gphy_config_intr,
+ 		.suspend	= genphy_suspend,
+ 		.resume		= genphy_resume,
++		.led_brightness_set = xway_gphy_led_brightness_set,
++		.led_hw_is_supported = xway_gphy_led_hw_is_supported,
++		.led_hw_control_get = xway_gphy_led_hw_control_get,
++		.led_hw_control_set = xway_gphy_led_hw_control_set,
++		.led_polarity_set = xway_gphy_led_polarity_set,
+ 	},
+ };
+ module_phy_driver(xway_gphy);
diff --git a/6.12/target/linux/generic/backport-6.12/880-v6.14-gpio-regmap-Use-generic-request-free-ops.patch b/6.12/target/linux/generic/backport-6.12/880-v6.14-gpio-regmap-Use-generic-request-free-ops.patch
new file mode 100644
index 00000000..f9299f97
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/880-v6.14-gpio-regmap-Use-generic-request-free-ops.patch
@@ -0,0 +1,30 @@
+From b0fa00fe38f673c986633c11087274deeb7ce7b0 Mon Sep 17 00:00:00 2001
+From: Sander Vanheule <sander@svanheule.net>
+Date: Tue, 7 Jan 2025 21:16:20 +0100
+Subject: [PATCH] gpio: regmap: Use generic request/free ops
+
+Set the gpiochip request and free ops to the generic implementations.
+This way a user can provide a gpio-ranges property defined for a pinmux,
+easing muxing of gpio functions. Provided that the pin controller
+implementents the pinmux op .gpio_request_enable(), pins will
+automatically be muxed to their GPIO function when requested.
+
+Signed-off-by: Sander Vanheule <sander@svanheule.net>
+Acked-by: Michael Walle <mwalle@kernel.org>
+Link: https://lore.kernel.org/r/20250107201621.12467-1-sander@svanheule.net
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+---
+ drivers/gpio/gpio-regmap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpio/gpio-regmap.c
++++ b/drivers/gpio/gpio-regmap.c
+@@ -262,6 +262,8 @@ struct gpio_regmap *gpio_regmap_register
+ 	chip->label = config->label ?: dev_name(config->parent);
+ 	chip->can_sleep = regmap_might_sleep(config->regmap);
+ 
++	chip->request = gpiochip_generic_request;
++	chip->free = gpiochip_generic_free;
+ 	chip->get = gpio_regmap_get;
+ 	if (gpio->reg_set_base && gpio->reg_clr_base)
+ 		chip->set = gpio_regmap_set_with_clear;
diff --git a/6.12/target/linux/generic/backport-6.12/901-v6.13-net-dsa-mv88e6xxx-Support-LED-control.patch b/6.12/target/linux/generic/backport-6.12/901-v6.13-net-dsa-mv88e6xxx-Support-LED-control.patch
new file mode 100644
index 00000000..84d760a8
--- /dev/null
+++ b/6.12/target/linux/generic/backport-6.12/901-v6.13-net-dsa-mv88e6xxx-Support-LED-control.patch
@@ -0,0 +1,1250 @@
+From 7b590490e3aa6bfa38bf6e2069a529017fd3c1d2 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Fri, 13 Oct 2023 00:08:35 +0200
+Subject: [PATCH] net: dsa: mv88e6xxx: Support LED control
+
+This adds control over the hardware LEDs in the Marvell
+MV88E6xxx DSA switch and enables it for MV88E6352.
+
+This fixes an imminent problem on the Inteno XG6846 which
+has a WAN LED that simply do not work with hardware
+defaults: driver amendment is necessary.
+
+The patch is modeled after Christian Marangis LED support
+code for the QCA8k DSA switch, I got help with the register
+definitions from Tim Harvey.
+
+After this patch it is possible to activate hardware link
+indication like this (or with a similar script):
+
+  cd /sys/class/leds/Marvell\ 88E6352:05:00:green:wan/
+  echo netdev > trigger
+  echo 1 > link
+
+This makes the green link indicator come up on any link
+speed. It is also possible to be more elaborate, like this:
+
+  cd /sys/class/leds/Marvell\ 88E6352:05:00:green:wan/
+  echo netdev > trigger
+  echo 1 > link_1000
+  cd /sys/class/leds/Marvell\ 88E6352:05:01:amber:wan/
+  echo netdev > trigger
+  echo 1 > link_100
+
+Making the green LED come on for a gigabit link and the
+amber LED come on for a 100 mbit link.
+
+Each port has 2 LED slots (the hardware may use just one or
+none) and the hardware triggers are specified in four bits per
+LED, and some of the hardware triggers are only available on the
+SFP (fiber) uplink. The restrictions are described in the
+port.h header file where the registers are described. For
+example, selector 1 set for LED 1 on port 5 or 6 will indicate
+Fiber 1000 (gigabit) and activity with a blinking LED, but
+ONLY for an SFP connection. If port 5/6 is used with something
+not SFP, this selector is a noop: something else need to be
+selected.
+
+After the previous series rewriting the MV88E6xxx DT
+bindings to use YAML a "leds" subnode is already valid
+for each port, in my scratch device tree it looks like
+this:
+
+   leds {
+     #address-cells = <1>;
+     #size-cells = <0>;
+
+     led@0 {
+       reg = <0>;
+       color = <LED_COLOR_ID_GREEN>;
+       function = LED_FUNCTION_LAN;
+       default-state = "off";
+       linux,default-trigger = "netdev";
+     };
+     led@1 {
+       reg = <1>;
+       color = <LED_COLOR_ID_AMBER>;
+       function = LED_FUNCTION_LAN;
+       default-state = "off";
+     };
+   };
+
+This DT config is not yet configuring everything: when the netdev
+default trigger is assigned the hw acceleration callbacks are
+not called, and there is no way to set the netdev sub-trigger
+type (such as link_1000) from the device tree, such as if you want
+a gigabit link indicator. This has to be done from userspace at
+this point.
+
+We add LED operations to all switches in the 6352 family:
+6172, 6176, 6240 and 6352.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+---
+ drivers/net/dsa/mv88e6xxx/Kconfig  |  10 +
+ drivers/net/dsa/mv88e6xxx/Makefile |   1 +
+ drivers/net/dsa/mv88e6xxx/chip.c   |  38 +-
+ drivers/net/dsa/mv88e6xxx/chip.h   |  11 +
+ drivers/net/dsa/mv88e6xxx/leds.c   | 839 +++++++++++++++++++++++++++++
+ drivers/net/dsa/mv88e6xxx/port.c   |   1 +
+ drivers/net/dsa/mv88e6xxx/port.h   | 133 +++++
+ 7 files changed, 1031 insertions(+), 2 deletions(-)
+ create mode 100644 drivers/net/dsa/mv88e6xxx/leds.c
+
+--- a/drivers/net/dsa/mv88e6xxx/Kconfig
++++ b/drivers/net/dsa/mv88e6xxx/Kconfig
+@@ -17,3 +17,13 @@ config NET_DSA_MV88E6XXX_PTP
+ 	help
+ 	  Say Y to enable PTP hardware timestamping on Marvell 88E6xxx switch
+ 	  chips that support it.
++
++config NET_DSA_MV88E6XXX_LEDS
++	bool "LED support for Marvell 88E6xxx"
++	default y
++	depends on NET_DSA_MV88E6XXX
++	depends on LEDS_CLASS=y || LEDS_CLASS=NET_DSA_MV88E6XXX
++	depends on LEDS_TRIGGERS
++	help
++	  This enabled support for controlling the LEDs attached to the
++	  Marvell 88E6xxx switch chips.
+--- a/drivers/net/dsa/mv88e6xxx/Makefile
++++ b/drivers/net/dsa/mv88e6xxx/Makefile
+@@ -9,6 +9,7 @@ mv88e6xxx-objs += global2.o
+ mv88e6xxx-objs += global2_avb.o
+ mv88e6xxx-objs += global2_scratch.o
+ mv88e6xxx-$(CONFIG_NET_DSA_MV88E6XXX_PTP) += hwtstamp.o
++mv88e6xxx-$(CONFIG_NET_DSA_MV88E6XXX_LEDS) += leds.o
+ mv88e6xxx-objs += pcs-6185.o
+ mv88e6xxx-objs += pcs-6352.o
+ mv88e6xxx-objs += pcs-639x.o
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -27,6 +27,7 @@
+ #include <linux/of_irq.h>
+ #include <linux/of_mdio.h>
+ #include <linux/platform_data/mv88e6xxx.h>
++#include <linux/property.h>
+ #include <linux/netdevice.h>
+ #include <linux/gpio/consumer.h>
+ #include <linux/phylink.h>
+@@ -3371,14 +3372,43 @@ static int mv88e6xxx_setup_upstream_port
+ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
+ {
+ 	struct device_node *phy_handle = NULL;
++	struct fwnode_handle *ports_fwnode;
++	struct fwnode_handle *port_fwnode;
+ 	struct dsa_switch *ds = chip->ds;
++	struct mv88e6xxx_port *p;
+ 	struct dsa_port *dp;
+ 	int tx_amp;
+ 	int err;
+ 	u16 reg;
++	u32 val;
+ 
+-	chip->ports[port].chip = chip;
+-	chip->ports[port].port = port;
++	p = &chip->ports[port];
++	p->chip = chip;
++	p->port = port;
++
++	/* Look up corresponding fwnode if any */
++	ports_fwnode = device_get_named_child_node(chip->dev, "ethernet-ports");
++	if (!ports_fwnode)
++		ports_fwnode = device_get_named_child_node(chip->dev, "ports");
++	if (ports_fwnode) {
++		fwnode_for_each_child_node(ports_fwnode, port_fwnode) {
++			if (fwnode_property_read_u32(port_fwnode, "reg", &val))
++				continue;
++			if (val == port) {
++				p->fwnode = port_fwnode;
++				p->fiber = fwnode_property_present(port_fwnode, "sfp");
++				break;
++			}
++		}
++	} else {
++		dev_dbg(chip->dev, "no ethernet ports node defined for the device\n");
++	}
++
++	if (chip->info->ops->port_setup_leds) {
++		err = chip->info->ops->port_setup_leds(chip, port);
++		if (err && err != -EOPNOTSUPP)
++			return err;
++	}
+ 
+ 	err = mv88e6xxx_port_setup_mac(chip, port, LINK_UNFORCED,
+ 				       SPEED_UNFORCED, DUPLEX_UNFORCED,
+@@ -4597,6 +4627,7 @@ static const struct mv88e6xxx_ops mv88e6
+ 	.port_disable_learn_limit = mv88e6xxx_port_disable_learn_limit,
+ 	.port_disable_pri_override = mv88e6xxx_port_disable_pri_override,
+ 	.port_get_cmode = mv88e6352_port_get_cmode,
++	.port_setup_leds = mv88e6xxx_port_setup_leds,
+ 	.port_setup_message_port = mv88e6xxx_setup_message_port,
+ 	.stats_snapshot = mv88e6320_g1_stats_snapshot,
+ 	.stats_set_histogram = mv88e6095_g1_stats_set_histogram,
+@@ -4699,6 +4730,7 @@ static const struct mv88e6xxx_ops mv88e6
+ 	.port_disable_learn_limit = mv88e6xxx_port_disable_learn_limit,
+ 	.port_disable_pri_override = mv88e6xxx_port_disable_pri_override,
+ 	.port_get_cmode = mv88e6352_port_get_cmode,
++	.port_setup_leds = mv88e6xxx_port_setup_leds,
+ 	.port_setup_message_port = mv88e6xxx_setup_message_port,
+ 	.stats_snapshot = mv88e6320_g1_stats_snapshot,
+ 	.stats_set_histogram = mv88e6095_g1_stats_set_histogram,
+@@ -4974,6 +5006,7 @@ static const struct mv88e6xxx_ops mv88e6
+ 	.port_disable_learn_limit = mv88e6xxx_port_disable_learn_limit,
+ 	.port_disable_pri_override = mv88e6xxx_port_disable_pri_override,
+ 	.port_get_cmode = mv88e6352_port_get_cmode,
++	.port_setup_leds = mv88e6xxx_port_setup_leds,
+ 	.port_setup_message_port = mv88e6xxx_setup_message_port,
+ 	.stats_snapshot = mv88e6320_g1_stats_snapshot,
+ 	.stats_set_histogram = mv88e6095_g1_stats_set_histogram,
+@@ -5396,6 +5429,7 @@ static const struct mv88e6xxx_ops mv88e6
+ 	.port_disable_learn_limit = mv88e6xxx_port_disable_learn_limit,
+ 	.port_disable_pri_override = mv88e6xxx_port_disable_pri_override,
+ 	.port_get_cmode = mv88e6352_port_get_cmode,
++	.port_setup_leds = mv88e6xxx_port_setup_leds,
+ 	.port_setup_message_port = mv88e6xxx_setup_message_port,
+ 	.stats_snapshot = mv88e6320_g1_stats_snapshot,
+ 	.stats_set_histogram = mv88e6095_g1_stats_set_histogram,
+--- a/drivers/net/dsa/mv88e6xxx/chip.h
++++ b/drivers/net/dsa/mv88e6xxx/chip.h
+@@ -13,7 +13,9 @@
+ #include <linux/irq.h>
+ #include <linux/gpio/consumer.h>
+ #include <linux/kthread.h>
++#include <linux/leds.h>
+ #include <linux/phy.h>
++#include <linux/property.h>
+ #include <linux/ptp_clock_kernel.h>
+ #include <linux/timecounter.h>
+ #include <net/dsa.h>
+@@ -276,6 +278,7 @@ struct mv88e6xxx_vlan {
+ struct mv88e6xxx_port {
+ 	struct mv88e6xxx_chip *chip;
+ 	int port;
++	struct fwnode_handle *fwnode;
+ 	struct mv88e6xxx_vlan bridge_pvid;
+ 	u64 serdes_stats[2];
+ 	u64 atu_member_violation;
+@@ -290,6 +293,11 @@ struct mv88e6xxx_port {
+ 	struct devlink_region *region;
+ 	void *pcs_private;
+ 
++	/* LED related information */
++	bool fiber;
++	struct led_classdev led0;
++	struct led_classdev led1;
++
+ 	/* MacAuth Bypass control flag */
+ 	bool mab;
+ };
+@@ -574,6 +582,9 @@ struct mv88e6xxx_ops {
+ 			      phy_interface_t mode);
+ 	int (*port_get_cmode)(struct mv88e6xxx_chip *chip, int port, u8 *cmode);
+ 
++	/* LED control */
++	int (*port_setup_leds)(struct mv88e6xxx_chip *chip, int port);
++
+ 	/* Some devices have a per port register indicating what is
+ 	 * the upstream port this port should forward to.
+ 	 */
+--- /dev/null
++++ b/drivers/net/dsa/mv88e6xxx/leds.c
+@@ -0,0 +1,839 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++#include <linux/bitfield.h>
++#include <linux/leds.h>
++#include <linux/property.h>
++
++#include "chip.h"
++#include "global2.h"
++#include "port.h"
++
++/* Offset 0x16: LED control */
++
++static int mv88e6xxx_port_led_write(struct mv88e6xxx_chip *chip, int port, u16 reg)
++{
++	reg |= MV88E6XXX_PORT_LED_CONTROL_UPDATE;
++
++	return mv88e6xxx_port_write(chip, port, MV88E6XXX_PORT_LED_CONTROL, reg);
++}
++
++static int mv88e6xxx_port_led_read(struct mv88e6xxx_chip *chip, int port,
++				   u16 ptr, u16 *val)
++{
++	int err;
++
++	err = mv88e6xxx_port_write(chip, port, MV88E6XXX_PORT_LED_CONTROL, ptr);
++	if (err)
++		return err;
++
++	err = mv88e6xxx_port_read(chip, port, MV88E6XXX_PORT_LED_CONTROL, val);
++	*val &= 0x3ff;
++
++	return err;
++}
++
++static int mv88e6xxx_led_brightness_set(struct mv88e6xxx_port *p, int led,
++					int brightness)
++{
++	u16 reg;
++	int err;
++
++	err = mv88e6xxx_port_led_read(p->chip, p->port,
++				      MV88E6XXX_PORT_LED_CONTROL_POINTER_LED01_CTRL,
++				      &reg);
++	if (err)
++		return err;
++
++	if (led == 1)
++		reg &= ~MV88E6XXX_PORT_LED_CONTROL_LED1_SEL_MASK;
++	else
++		reg &= ~MV88E6XXX_PORT_LED_CONTROL_LED0_SEL_MASK;
++
++	if (brightness) {
++		/* Selector 0x0f == Force LED ON */
++		if (led == 1)
++			reg |= MV88E6XXX_PORT_LED_CONTROL_LED1_SELF;
++		else
++			reg |= MV88E6XXX_PORT_LED_CONTROL_LED0_SELF;
++	} else {
++		/* Selector 0x0e == Force LED OFF */
++		if (led == 1)
++			reg |= MV88E6XXX_PORT_LED_CONTROL_LED1_SELE;
++		else
++			reg |= MV88E6XXX_PORT_LED_CONTROL_LED0_SELE;
++	}
++
++	reg |= MV88E6XXX_PORT_LED_CONTROL_POINTER_LED01_CTRL;
++
++	return mv88e6xxx_port_led_write(p->chip, p->port, reg);
++}
++
++static int mv88e6xxx_led0_brightness_set_blocking(struct led_classdev *ldev,
++						  enum led_brightness brightness)
++{
++	struct mv88e6xxx_port *p = container_of(ldev, struct mv88e6xxx_port, led0);
++	int err;
++
++	mv88e6xxx_reg_lock(p->chip);
++	err = mv88e6xxx_led_brightness_set(p, 0, brightness);
++	mv88e6xxx_reg_unlock(p->chip);
++
++	return err;
++}
++
++static int mv88e6xxx_led1_brightness_set_blocking(struct led_classdev *ldev,
++						  enum led_brightness brightness)
++{
++	struct mv88e6xxx_port *p = container_of(ldev, struct mv88e6xxx_port, led1);
++	int err;
++
++	mv88e6xxx_reg_lock(p->chip);
++	err = mv88e6xxx_led_brightness_set(p, 1, brightness);
++	mv88e6xxx_reg_unlock(p->chip);
++
++	return err;
++}
++
++struct mv88e6xxx_led_hwconfig {
++	int led;
++	u8 portmask;
++	unsigned long rules;
++	bool fiber;
++	bool blink_activity;
++	u16 selector;
++};
++
++/* The following is a lookup table to check what rules we can support on a
++ * certain LED given restrictions such as that some rules only work with fiber
++ * (SFP) connections and some blink on activity by default.
++ */
++#define MV88E6XXX_PORTS_0_3 (BIT(0) | BIT(1) | BIT(2) | BIT(3))
++#define MV88E6XXX_PORTS_4_5 (BIT(4) | BIT(5))
++#define MV88E6XXX_PORT_4 BIT(4)
++#define MV88E6XXX_PORT_5 BIT(5)
++
++/* Entries are listed in selector order.
++ *
++ * These configurations vary across different switch families, list
++ * different tables per-family here.
++ */
++static const struct mv88e6xxx_led_hwconfig mv88e6352_led_hwconfigs[] = {
++	{
++		.led = 0,
++		.portmask = MV88E6XXX_PORT_4,
++		.rules = BIT(TRIGGER_NETDEV_LINK),
++		.blink_activity = true,
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED0_SEL0,
++	},
++	{
++		.led = 1,
++		.portmask = MV88E6XXX_PORT_5,
++		.rules = BIT(TRIGGER_NETDEV_LINK_1000),
++		.blink_activity = true,
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED1_SEL0,
++	},
++	{
++		.led = 0,
++		.portmask = MV88E6XXX_PORTS_0_3,
++		.rules = BIT(TRIGGER_NETDEV_LINK_100) | BIT(TRIGGER_NETDEV_LINK_1000),
++		.blink_activity = true,
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED0_SEL1,
++	},
++	{
++		.led = 1,
++		.portmask = MV88E6XXX_PORTS_0_3,
++		.rules = BIT(TRIGGER_NETDEV_LINK_10) | BIT(TRIGGER_NETDEV_LINK_100),
++		.blink_activity = true,
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED1_SEL1,
++	},
++	{
++		.led = 0,
++		.portmask = MV88E6XXX_PORTS_4_5,
++		.rules = BIT(TRIGGER_NETDEV_LINK_100),
++		.blink_activity = true,
++		.fiber = true,
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED0_SEL1,
++	},
++	{
++		.led = 1,
++		.portmask = MV88E6XXX_PORTS_4_5,
++		.rules = BIT(TRIGGER_NETDEV_LINK_1000),
++		.blink_activity = true,
++		.fiber = true,
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED1_SEL1,
++	},
++	{
++		.led = 0,
++		.portmask = MV88E6XXX_PORTS_0_3,
++		.rules = BIT(TRIGGER_NETDEV_LINK_1000),
++		.blink_activity = true,
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED0_SEL2,
++	},
++	{
++		.led = 1,
++		.portmask = MV88E6XXX_PORTS_0_3,
++		.rules = BIT(TRIGGER_NETDEV_LINK_10) | BIT(TRIGGER_NETDEV_LINK_100),
++		.blink_activity = true,
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED1_SEL2,
++	},
++	{
++		.led = 0,
++		.portmask = MV88E6XXX_PORTS_4_5,
++		.rules = BIT(TRIGGER_NETDEV_LINK_1000),
++		.blink_activity = true,
++		.fiber = true,
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED0_SEL2,
++	},
++	{
++		.led = 1,
++		.portmask = MV88E6XXX_PORTS_4_5,
++		.rules = BIT(TRIGGER_NETDEV_LINK_100),
++		.blink_activity = true,
++		.fiber = true,
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED1_SEL2,
++	},
++	{
++		.led = 0,
++		.portmask = MV88E6XXX_PORTS_0_3,
++		.rules = BIT(TRIGGER_NETDEV_LINK),
++		.blink_activity = true,
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED0_SEL3,
++	},
++	{
++		.led = 1,
++		.portmask = MV88E6XXX_PORTS_0_3,
++		.rules = BIT(TRIGGER_NETDEV_LINK_1000),
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED1_SEL3,
++	},
++	{
++		.led = 1,
++		.portmask = MV88E6XXX_PORTS_4_5,
++		.rules = BIT(TRIGGER_NETDEV_LINK),
++		.fiber = true,
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED1_SEL3,
++	},
++	{
++		.led = 1,
++		.portmask = MV88E6XXX_PORT_4,
++		.rules = BIT(TRIGGER_NETDEV_LINK),
++		.blink_activity = true,
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED1_SEL4,
++	},
++	{
++		.led = 1,
++		.portmask = MV88E6XXX_PORT_5,
++		.rules = BIT(TRIGGER_NETDEV_LINK),
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED1_SEL5,
++	},
++	{
++		.led = 0,
++		.portmask = MV88E6XXX_PORTS_0_3,
++		.rules = BIT(TRIGGER_NETDEV_FULL_DUPLEX),
++		.blink_activity = true,
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED0_SEL6,
++	},
++	{
++		.led = 1,
++		.portmask = MV88E6XXX_PORTS_0_3,
++		.rules = BIT(TRIGGER_NETDEV_LINK_10) | BIT(TRIGGER_NETDEV_LINK_1000),
++		.blink_activity = true,
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED1_SEL6,
++	},
++	{
++		.led = 0,
++		.portmask = MV88E6XXX_PORT_4,
++		.rules = BIT(TRIGGER_NETDEV_FULL_DUPLEX),
++		.blink_activity = true,
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED0_SEL6,
++	},
++	{
++		.led = 1,
++		.portmask = MV88E6XXX_PORT_5,
++		.rules = BIT(TRIGGER_NETDEV_FULL_DUPLEX),
++		.blink_activity = true,
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED1_SEL6,
++	},
++	{
++		.led = 0,
++		.portmask = MV88E6XXX_PORTS_0_3,
++		.rules = BIT(TRIGGER_NETDEV_LINK_10) | BIT(TRIGGER_NETDEV_LINK_1000),
++		.blink_activity = true,
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED0_SEL7,
++	},
++	{
++		.led = 1,
++		.portmask = MV88E6XXX_PORTS_0_3,
++		.rules = BIT(TRIGGER_NETDEV_LINK_10) | BIT(TRIGGER_NETDEV_LINK_1000),
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED1_SEL7,
++	},
++	{
++		.led = 0,
++		.portmask = MV88E6XXX_PORTS_0_3,
++		.rules = BIT(TRIGGER_NETDEV_LINK),
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED0_SEL8,
++	},
++	{
++		.led = 1,
++		.portmask = MV88E6XXX_PORTS_0_3,
++		.rules = BIT(TRIGGER_NETDEV_LINK),
++		.blink_activity = true,
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED1_SEL8,
++	},
++	{
++		.led = 0,
++		.portmask = MV88E6XXX_PORT_5,
++		.rules = BIT(TRIGGER_NETDEV_LINK),
++		.blink_activity = true,
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED0_SEL8,
++	},
++	{
++		.led = 0,
++		.portmask = MV88E6XXX_PORTS_0_3,
++		.rules = BIT(TRIGGER_NETDEV_LINK_10),
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED0_SEL9,
++	},
++	{
++		.led = 1,
++		.portmask = MV88E6XXX_PORTS_0_3,
++		.rules = BIT(TRIGGER_NETDEV_LINK_100),
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED1_SEL9,
++	},
++	{
++		.led = 0,
++		.portmask = MV88E6XXX_PORTS_0_3,
++		.rules = BIT(TRIGGER_NETDEV_LINK_10),
++		.blink_activity = true,
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED0_SELA,
++	},
++	{
++		.led = 1,
++		.portmask = MV88E6XXX_PORTS_0_3,
++		.rules = BIT(TRIGGER_NETDEV_LINK_100),
++		.blink_activity = true,
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED1_SELA,
++	},
++	{
++		.led = 0,
++		.portmask = MV88E6XXX_PORTS_0_3,
++		.rules = BIT(TRIGGER_NETDEV_LINK_100) | BIT(TRIGGER_NETDEV_LINK_1000),
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED0_SELB,
++	},
++	{
++		.led = 1,
++		.portmask = MV88E6XXX_PORTS_0_3,
++		.rules = BIT(TRIGGER_NETDEV_LINK_100) | BIT(TRIGGER_NETDEV_LINK_1000),
++		.blink_activity = true,
++		.selector = MV88E6XXX_PORT_LED_CONTROL_LED1_SELB,
++	},
++};
++
++/* mv88e6xxx_led_match_selector() - look up the appropriate LED mode selector
++ * @p: port state container
++ * @led: LED number, 0 or 1
++ * @blink_activity: blink the LED (usually blink on indicated activity)
++ * @fiber: the link is connected to fiber such as SFP
++ * @rules: LED status flags from the LED classdev core
++ * @selector: fill in the selector in this parameter with an OR operation
++ */
++static int mv88e6xxx_led_match_selector(struct mv88e6xxx_port *p, int led, bool blink_activity,
++					bool fiber, unsigned long rules, u16 *selector)
++{
++	const struct mv88e6xxx_led_hwconfig *conf;
++	int i;
++
++	/* No rules means we turn the LED off */
++	if (!rules) {
++		if (led == 1)
++			*selector |= MV88E6XXX_PORT_LED_CONTROL_LED1_SELE;
++		else
++			*selector |= MV88E6XXX_PORT_LED_CONTROL_LED0_SELE;
++		return 0;
++	}
++
++	/* TODO: these rules are for MV88E6352, when adding other families,
++	 * think about making sure you select the table that match the
++	 * specific switch family.
++	 */
++	for (i = 0; i < ARRAY_SIZE(mv88e6352_led_hwconfigs); i++) {
++		conf = &mv88e6352_led_hwconfigs[i];
++
++		if (conf->led != led)
++			continue;
++
++		if (!(conf->portmask & BIT(p->port)))
++			continue;
++
++		if (conf->blink_activity != blink_activity)
++			continue;
++
++		if (conf->fiber != fiber)
++			continue;
++
++		if (conf->rules == rules) {
++			dev_dbg(p->chip->dev, "port%d LED %d set selector %04x for rules %08lx\n",
++				p->port, led, conf->selector, rules);
++			*selector |= conf->selector;
++			return 0;
++		}
++	}
++
++	return -EOPNOTSUPP;
++}
++
++/* mv88e6xxx_led_match_selector() - find Linux netdev rules from a selector value
++ * @p: port state container
++ * @selector: the selector value from the LED actity register
++ * @led: LED number, 0 or 1
++ * @rules: Linux netdev activity rules found from selector
++ */
++static int
++mv88e6xxx_led_match_rule(struct mv88e6xxx_port *p, u16 selector, int led, unsigned long *rules)
++{
++	const struct mv88e6xxx_led_hwconfig *conf;
++	int i;
++
++	/* Find the selector in the table, we just look for the right selector
++	 * and ignore if the activity has special properties such as blinking
++	 * or is fiber-only.
++	 */
++	for (i = 0; i < ARRAY_SIZE(mv88e6352_led_hwconfigs); i++) {
++		conf = &mv88e6352_led_hwconfigs[i];
++
++		if (conf->led != led)
++			continue;
++
++		if (!(conf->portmask & BIT(p->port)))
++			continue;
++
++		if (conf->selector == selector) {
++			dev_dbg(p->chip->dev, "port%d LED %d has selector %04x, rules %08lx\n",
++				p->port, led, selector, conf->rules);
++			*rules = conf->rules;
++			return 0;
++		}
++	}
++
++	return -EINVAL;
++}
++
++/* mv88e6xxx_led_get_selector() - get the appropriate LED mode selector
++ * @p: port state container
++ * @led: LED number, 0 or 1
++ * @fiber: the link is connected to fiber such as SFP
++ * @rules: LED status flags from the LED classdev core
++ * @selector: fill in the selector in this parameter with an OR operation
++ */
++static int mv88e6xxx_led_get_selector(struct mv88e6xxx_port *p, int led,
++				      bool fiber, unsigned long rules, u16 *selector)
++{
++	int err;
++
++	/* What happens here is that we first try to locate a trigger with solid
++	 * indicator (such as LED is on for a 1000 link) else we try a second
++	 * sweep to find something suitable with a trigger that will blink on
++	 * activity.
++	 */
++	err = mv88e6xxx_led_match_selector(p, led, false, fiber, rules, selector);
++	if (err)
++		return mv88e6xxx_led_match_selector(p, led, true, fiber, rules, selector);
++
++	return 0;
++}
++
++/* Sets up the hardware blinking period */
++static int mv88e6xxx_led_set_blinking_period(struct mv88e6xxx_port *p, int led,
++					     unsigned long delay_on, unsigned long delay_off)
++{
++	unsigned long period;
++	u16 reg;
++
++	period = delay_on + delay_off;
++
++	reg = 0;
++
++	switch (period) {
++	case 21:
++		reg |= MV88E6XXX_PORT_LED_CONTROL_0x06_BLINK_RATE_21MS;
++		break;
++	case 42:
++		reg |= MV88E6XXX_PORT_LED_CONTROL_0x06_BLINK_RATE_42MS;
++		break;
++	case 84:
++		reg |= MV88E6XXX_PORT_LED_CONTROL_0x06_BLINK_RATE_84MS;
++		break;
++	case 168:
++		reg |= MV88E6XXX_PORT_LED_CONTROL_0x06_BLINK_RATE_168MS;
++		break;
++	case 336:
++		reg |= MV88E6XXX_PORT_LED_CONTROL_0x06_BLINK_RATE_336MS;
++		break;
++	case 672:
++		reg |= MV88E6XXX_PORT_LED_CONTROL_0x06_BLINK_RATE_672MS;
++		break;
++	default:
++		/* Fall back to software blinking */
++		return -EINVAL;
++	}
++
++	/* This is essentially PWM duty cycle: how long time of the period
++	 * will the LED be on. Zero isn't great in most cases.
++	 */
++	switch (delay_on) {
++	case 0:
++		/* This is usually pretty useless and will make the LED look OFF */
++		reg |= MV88E6XXX_PORT_LED_CONTROL_0x06_PULSE_STRETCH_NONE;
++		break;
++	case 21:
++		reg |= MV88E6XXX_PORT_LED_CONTROL_0x06_PULSE_STRETCH_21MS;
++		break;
++	case 42:
++		reg |= MV88E6XXX_PORT_LED_CONTROL_0x06_PULSE_STRETCH_42MS;
++		break;
++	case 84:
++		reg |= MV88E6XXX_PORT_LED_CONTROL_0x06_PULSE_STRETCH_84MS;
++		break;
++	case 168:
++		reg |= MV88E6XXX_PORT_LED_CONTROL_0x06_PULSE_STRETCH_168MS;
++		break;
++	default:
++		/* Just use something non-zero */
++		reg |= MV88E6XXX_PORT_LED_CONTROL_0x06_PULSE_STRETCH_21MS;
++		break;
++	}
++
++	/* Set up blink rate */
++	reg |= MV88E6XXX_PORT_LED_CONTROL_POINTER_STRETCH_BLINK;
++
++	return mv88e6xxx_port_led_write(p->chip, p->port, reg);
++}
++
++static int mv88e6xxx_led_blink_set(struct mv88e6xxx_port *p, int led,
++				   unsigned long *delay_on, unsigned long *delay_off)
++{
++	u16 reg;
++	int err;
++
++	/* Choose a sensible default 336 ms (~3 Hz) */
++	if ((*delay_on == 0) && (*delay_off == 0)) {
++		*delay_on = 168;
++		*delay_off = 168;
++	}
++
++	/* No off delay is just on */
++	if (*delay_off == 0)
++		return mv88e6xxx_led_brightness_set(p, led, 1);
++
++	err = mv88e6xxx_led_set_blinking_period(p, led, *delay_on, *delay_off);
++	if (err)
++		return err;
++
++	err = mv88e6xxx_port_led_read(p->chip, p->port,
++				      MV88E6XXX_PORT_LED_CONTROL_POINTER_LED01_CTRL,
++				      &reg);
++	if (err)
++		return err;
++
++	if (led == 1)
++		reg &= ~MV88E6XXX_PORT_LED_CONTROL_LED1_SEL_MASK;
++	else
++		reg &= ~MV88E6XXX_PORT_LED_CONTROL_LED0_SEL_MASK;
++
++	/* This will select the forced blinking status */
++	if (led == 1)
++		reg |= MV88E6XXX_PORT_LED_CONTROL_LED1_SELD;
++	else
++		reg |= MV88E6XXX_PORT_LED_CONTROL_LED0_SELD;
++
++	reg |= MV88E6XXX_PORT_LED_CONTROL_POINTER_LED01_CTRL;
++
++	return mv88e6xxx_port_led_write(p->chip, p->port, reg);
++}
++
++static int mv88e6xxx_led0_blink_set(struct led_classdev *ldev,
++				    unsigned long *delay_on,
++				    unsigned long *delay_off)
++{
++	struct mv88e6xxx_port *p = container_of(ldev, struct mv88e6xxx_port, led0);
++	int err;
++
++	mv88e6xxx_reg_lock(p->chip);
++	err = mv88e6xxx_led_blink_set(p, 0, delay_on, delay_off);
++	mv88e6xxx_reg_unlock(p->chip);
++
++	return err;
++}
++
++static int mv88e6xxx_led1_blink_set(struct led_classdev *ldev,
++				    unsigned long *delay_on,
++				    unsigned long *delay_off)
++{
++	struct mv88e6xxx_port *p = container_of(ldev, struct mv88e6xxx_port, led1);
++	int err;
++
++	mv88e6xxx_reg_lock(p->chip);
++	err = mv88e6xxx_led_blink_set(p, 1, delay_on, delay_off);
++	mv88e6xxx_reg_unlock(p->chip);
++
++	return err;
++}
++
++static int
++mv88e6xxx_led0_hw_control_is_supported(struct led_classdev *ldev, unsigned long rules)
++{
++	struct mv88e6xxx_port *p = container_of(ldev, struct mv88e6xxx_port, led0);
++	u16 selector = 0;
++
++	return mv88e6xxx_led_get_selector(p, 0, p->fiber, rules, &selector);
++}
++
++static int
++mv88e6xxx_led1_hw_control_is_supported(struct led_classdev *ldev, unsigned long rules)
++{
++	struct mv88e6xxx_port *p = container_of(ldev, struct mv88e6xxx_port, led1);
++	u16 selector = 0;
++
++	return mv88e6xxx_led_get_selector(p, 1, p->fiber, rules, &selector);
++}
++
++static int mv88e6xxx_led_hw_control_set(struct mv88e6xxx_port *p,
++					int led, unsigned long rules)
++{
++	u16 reg;
++	int err;
++
++	err = mv88e6xxx_port_led_read(p->chip, p->port,
++				      MV88E6XXX_PORT_LED_CONTROL_POINTER_LED01_CTRL,
++				      &reg);
++	if (err)
++		return err;
++
++	if (led == 1)
++		reg &= ~MV88E6XXX_PORT_LED_CONTROL_LED1_SEL_MASK;
++	else
++		reg &= ~MV88E6XXX_PORT_LED_CONTROL_LED0_SEL_MASK;
++
++	err = mv88e6xxx_led_get_selector(p, led, p->fiber, rules, &reg);
++	if (err)
++		return err;
++
++	reg |= MV88E6XXX_PORT_LED_CONTROL_POINTER_LED01_CTRL;
++
++	if (led == 0)
++		dev_dbg(p->chip->dev, "LED 0 hw control on port %d trigger selector 0x%02x\n",
++			p->port,
++			(unsigned int)(reg & MV88E6XXX_PORT_LED_CONTROL_LED0_SEL_MASK));
++	else
++		dev_dbg(p->chip->dev, "LED 1 hw control on port %d trigger selector 0x%02x\n",
++			p->port,
++			(unsigned int)(reg & MV88E6XXX_PORT_LED_CONTROL_LED1_SEL_MASK) >> 4);
++
++	return mv88e6xxx_port_led_write(p->chip, p->port, reg);
++}
++
++static int
++mv88e6xxx_led_hw_control_get(struct mv88e6xxx_port *p, int led, unsigned long *rules)
++{
++	u16 val;
++	int err;
++
++	mv88e6xxx_reg_lock(p->chip);
++	err = mv88e6xxx_port_led_read(p->chip, p->port,
++				      MV88E6XXX_PORT_LED_CONTROL_POINTER_LED01_CTRL, &val);
++	mv88e6xxx_reg_unlock(p->chip);
++	if (err)
++		return err;
++
++	/* Mask out the selector bits for this port */
++	if (led == 1) {
++		val &= MV88E6XXX_PORT_LED_CONTROL_LED1_SEL_MASK;
++		/* It's forced blinking/OFF/ON */
++		if (val == MV88E6XXX_PORT_LED_CONTROL_LED1_SELD ||
++		    val == MV88E6XXX_PORT_LED_CONTROL_LED1_SELE ||
++		    val == MV88E6XXX_PORT_LED_CONTROL_LED1_SELF) {
++			*rules = 0;
++			return 0;
++		}
++	} else {
++		val &= MV88E6XXX_PORT_LED_CONTROL_LED0_SEL_MASK;
++		/* It's forced blinking/OFF/ON */
++		if (val == MV88E6XXX_PORT_LED_CONTROL_LED0_SELD ||
++		    val == MV88E6XXX_PORT_LED_CONTROL_LED0_SELE ||
++		    val == MV88E6XXX_PORT_LED_CONTROL_LED0_SELF) {
++			*rules = 0;
++			return 0;
++		}
++	}
++
++	err = mv88e6xxx_led_match_rule(p, val, led, rules);
++	if (!err)
++		return 0;
++
++	dev_dbg(p->chip->dev, "couldn't find matching selector for %04x\n", val);
++	*rules = 0;
++	return 0;
++}
++
++static int
++mv88e6xxx_led0_hw_control_set(struct led_classdev *ldev, unsigned long rules)
++{
++	struct mv88e6xxx_port *p = container_of(ldev, struct mv88e6xxx_port, led0);
++	int err;
++
++	mv88e6xxx_reg_lock(p->chip);
++	err = mv88e6xxx_led_hw_control_set(p, 0, rules);
++	mv88e6xxx_reg_unlock(p->chip);
++
++	return err;
++}
++
++static int
++mv88e6xxx_led1_hw_control_set(struct led_classdev *ldev, unsigned long rules)
++{
++	struct mv88e6xxx_port *p = container_of(ldev, struct mv88e6xxx_port, led1);
++	int err;
++
++	mv88e6xxx_reg_lock(p->chip);
++	err = mv88e6xxx_led_hw_control_set(p, 1, rules);
++	mv88e6xxx_reg_unlock(p->chip);
++
++	return err;
++}
++
++static int
++mv88e6xxx_led0_hw_control_get(struct led_classdev *ldev, unsigned long *rules)
++{
++	struct mv88e6xxx_port *p = container_of(ldev, struct mv88e6xxx_port, led0);
++
++	return mv88e6xxx_led_hw_control_get(p, 0, rules);
++}
++
++static int
++mv88e6xxx_led1_hw_control_get(struct led_classdev *ldev, unsigned long *rules)
++{
++	struct mv88e6xxx_port *p = container_of(ldev, struct mv88e6xxx_port, led1);
++
++	return mv88e6xxx_led_hw_control_get(p, 1, rules);
++}
++
++static struct device *mv88e6xxx_led_hw_control_get_device(struct mv88e6xxx_port *p)
++{
++	struct dsa_port *dp;
++
++	dp = dsa_to_port(p->chip->ds, p->port);
++	if (!dp)
++		return NULL;
++	if (dp->user)
++		return &dp->user->dev;
++	return NULL;
++}
++
++static struct device *
++mv88e6xxx_led0_hw_control_get_device(struct led_classdev *ldev)
++{
++	struct mv88e6xxx_port *p = container_of(ldev, struct mv88e6xxx_port, led0);
++
++	return mv88e6xxx_led_hw_control_get_device(p);
++}
++
++static struct device *
++mv88e6xxx_led1_hw_control_get_device(struct led_classdev *ldev)
++{
++	struct mv88e6xxx_port *p = container_of(ldev, struct mv88e6xxx_port, led1);
++
++	return mv88e6xxx_led_hw_control_get_device(p);
++}
++
++int mv88e6xxx_port_setup_leds(struct mv88e6xxx_chip *chip, int port)
++{
++	struct fwnode_handle *led = NULL, *leds = NULL;
++	struct led_init_data init_data = { };
++	enum led_default_state state;
++	struct mv88e6xxx_port *p;
++	struct led_classdev *l;
++	struct device *dev;
++	u32 led_num;
++	int ret;
++
++	/* LEDs are on ports 1,2,3,4, 5 and 6 (index 0..5), no more */
++	if (port > 5)
++		return -EOPNOTSUPP;
++
++	p = &chip->ports[port];
++	if (!p->fwnode)
++		return 0;
++
++	dev = chip->dev;
++
++	leds = fwnode_get_named_child_node(p->fwnode, "leds");
++	if (!leds) {
++		dev_dbg(dev, "No Leds node specified in device tree for port %d!\n",
++			port);
++		return 0;
++	}
++
++	fwnode_for_each_child_node(leds, led) {
++		/* Reg represent the led number of the port, max 2
++		 * LEDs can be connected to each port, in some designs
++		 * only one LED is connected.
++		 */
++		if (fwnode_property_read_u32(led, "reg", &led_num))
++			continue;
++		if (led_num > 1) {
++			dev_err(dev, "invalid LED specified port %d\n", port);
++			return -EINVAL;
++		}
++
++		if (led_num == 0)
++			l = &p->led0;
++		else
++			l = &p->led1;
++
++		state = led_init_default_state_get(led);
++		switch (state) {
++		case LEDS_DEFSTATE_ON:
++			l->brightness = 1;
++			mv88e6xxx_led_brightness_set(p, led_num, 1);
++			break;
++		case LEDS_DEFSTATE_KEEP:
++			break;
++		default:
++			l->brightness = 0;
++			mv88e6xxx_led_brightness_set(p, led_num, 0);
++		}
++
++		l->max_brightness = 1;
++		if (led_num == 0) {
++			l->brightness_set_blocking = mv88e6xxx_led0_brightness_set_blocking;
++			l->blink_set = mv88e6xxx_led0_blink_set;
++			l->hw_control_is_supported = mv88e6xxx_led0_hw_control_is_supported;
++			l->hw_control_set = mv88e6xxx_led0_hw_control_set;
++			l->hw_control_get = mv88e6xxx_led0_hw_control_get;
++			l->hw_control_get_device = mv88e6xxx_led0_hw_control_get_device;
++		} else {
++			l->brightness_set_blocking = mv88e6xxx_led1_brightness_set_blocking;
++			l->blink_set = mv88e6xxx_led1_blink_set;
++			l->hw_control_is_supported = mv88e6xxx_led1_hw_control_is_supported;
++			l->hw_control_set = mv88e6xxx_led1_hw_control_set;
++			l->hw_control_get = mv88e6xxx_led1_hw_control_get;
++			l->hw_control_get_device = mv88e6xxx_led1_hw_control_get_device;
++		}
++		l->hw_control_trigger = "netdev";
++
++		init_data.default_label = ":port";
++		init_data.fwnode = led;
++		init_data.devname_mandatory = true;
++		init_data.devicename = kasprintf(GFP_KERNEL, "%s:0%d:0%d", chip->info->name,
++						 port, led_num);
++		if (!init_data.devicename)
++			return -ENOMEM;
++
++		ret = devm_led_classdev_register_ext(dev, l, &init_data);
++		kfree(init_data.devicename);
++
++		if (ret) {
++			dev_err(dev, "Failed to init LED %d for port %d", led_num, port);
++			return ret;
++		}
++	}
++
++	return 0;
++}
+--- a/drivers/net/dsa/mv88e6xxx/port.c
++++ b/drivers/net/dsa/mv88e6xxx/port.c
+@@ -12,6 +12,7 @@
+ #include <linux/if_bridge.h>
+ #include <linux/phy.h>
+ #include <linux/phylink.h>
++#include <linux/property.h>
+ 
+ #include "chip.h"
+ #include "global2.h"
+--- a/drivers/net/dsa/mv88e6xxx/port.h
++++ b/drivers/net/dsa/mv88e6xxx/port.h
+@@ -309,6 +309,130 @@
+ /* Offset 0x13: OutFiltered Counter */
+ #define MV88E6XXX_PORT_OUT_FILTERED	0x13
+ 
++/* Offset 0x16: LED Control */
++#define MV88E6XXX_PORT_LED_CONTROL				0x16
++#define MV88E6XXX_PORT_LED_CONTROL_UPDATE			BIT(15)
++#define MV88E6XXX_PORT_LED_CONTROL_POINTER_MASK			GENMASK(14, 12)
++#define MV88E6XXX_PORT_LED_CONTROL_POINTER_LED01_CTRL		(0x00 << 12) /* Control for LED 0 and 1 */
++#define MV88E6XXX_PORT_LED_CONTROL_POINTER_STRETCH_BLINK	(0x06 << 12) /* Stetch and Blink Rate */
++#define MV88E6XXX_PORT_LED_CONTROL_POINTER_CNTL_SPECIAL		(0x07 << 12) /* Control for the Port's Special LED */
++#define MV88E6XXX_PORT_LED_CONTROL_DATA_MASK			GENMASK(10, 0)
++/* Selection masks valid for either port 1,2,3,4 or 5 */
++#define MV88E6XXX_PORT_LED_CONTROL_LED0_SEL_MASK		GENMASK(3, 0)
++#define MV88E6XXX_PORT_LED_CONTROL_LED1_SEL_MASK		GENMASK(7, 4)
++/* Selection control for LED 0 and 1, ports 5 and 6 only has LED 0
++ * Bits  Function
++ * 0..3  LED 0 control selector on ports 1-5
++ * 4..7  LED 1 control selector on ports 1-4 on port 5 this controls LED 0 of port 6
++ *
++ * Sel Port LED Function for the 6352 family:
++ * 0   1-4  0   Link/Act/Speed by Blink Rate (off=no link, on=link, blink=activity, blink speed=link speed)
++ *     1-4  1   Port 2's Special LED
++ *     5-6  0   Port 5 Link/Act (off=no link, on=link, blink=activity)
++ *     5-6  1   Port 6 Link/Act (off=no link, on=link 1000, blink=activity)
++ * 1   1-4  0   100/1000 Link/Act (off=no link, on=100 or 1000 link, blink=activity)
++ *     1-4  1   10/100 Link Act (off=no link, on=10 or 100 link, blink=activity)
++ *     5-6  0   Fiber 100 Link/Act (off=no link, on=link 100, blink=activity)
++ *     5-6  1   Fiber 1000 Link/Act (off=no link, on=link 1000, blink=activity)
++ * 2   1-4  0   1000 Link/Act (off=no link, on=link 1000, blink=activity)
++ *     1-4  1   10/100 Link/Act (off=no link, on=10 or 100 link, blink=activity)
++ *     5-6  0   Fiber 1000 Link/Act (off=no link, on=link 1000, blink=activity)
++ *     5-6  1   Fiber 100 Link/Act (off=no link, on=link 100, blink=activity)
++ * 3   1-4  0   Link/Act (off=no link, on=link, blink=activity)
++ *     1-4  1   1000 Link (off=no link, on=1000 link)
++ *     5-6  0   Port 0's Special LED
++ *     5-6  1   Fiber Link (off=no link, on=link)
++ * 4   1-4  0   Port 0's Special LED
++ *     1-4  1   Port 1's Special LED
++ *     5-6  0   Port 1's Special LED
++ *     5-6  1   Port 5 Link/Act (off=no link, on=link, blink=activity)
++ * 5   1-4  0   Reserved
++ *     1-4  1   Reserved
++ *     5-6  0   Port 2's Special LED
++ *     5-6  1   Port 6 Link (off=no link, on=link)
++ * 6   1-4  0   Duplex/Collision (off=half-duplex,on=full-duplex,blink=collision)
++ *     1-4  1   10/1000 Link/Act (off=no link, on=10 or 1000 link, blink=activity)
++ *     5-6  0   Port 5 Duplex/Collision (off=half-duplex, on=full-duplex, blink=col)
++ *     5-6  1   Port 6 Duplex/Collision (off=half-duplex, on=full-duplex, blink=col)
++ * 7   1-4  0   10/1000 Link/Act (off=no link, on=10 or 1000 link, blink=activity)
++ *     1-4  1   10/1000 Link (off=no link, on=10 or 1000 link)
++ *     5-6  0   Port 5 Link/Act/Speed by Blink rate (off=no link, on=link, blink=activity, blink speed=link speed)
++ *     5-6  1   Port 6 Link/Act/Speed by Blink rate (off=no link, on=link, blink=activity,  blink speed=link speed)
++ * 8   1-4  0   Link (off=no link, on=link)
++ *     1-4  1   Activity (off=no link, blink on=activity)
++ *     5-6  0   Port 6 Link/Act (off=no link, on=link, blink=activity)
++ *     5-6  1   Port 0's Special LED
++ * 9   1-4  0   10 Link (off=no link, on=10 link)
++ *     1-4  1   100 Link (off=no link, on=100 link)
++ *     5-6  0   Reserved
++ *     5-6  1   Port 1's Special LED
++ * a   1-4  0   10 Link/Act (off=no link, on=10 link, blink=activity)
++ *     1-4  1   100 Link/Act (off=no link, on=100 link, blink=activity)
++ *     5-6  0   Reserved
++ *     5-6  1   Port 2's Special LED
++ * b   1-4  0   100/1000 Link (off=no link, on=100 or 1000 link)
++ *     1-4  1   10/100 Link (off=no link, on=100 link, blink=activity)
++ *     5-6  0   Reserved
++ *     5-6  1   Reserved
++ * c     *  *   PTP Act (blink on=PTP activity)
++ * d     *  *   Force Blink
++ * e     *  *   Force Off
++ * f     *  *   Force On
++ */
++/* Select LED0 output */
++#define MV88E6XXX_PORT_LED_CONTROL_LED0_SEL0			0x0
++#define MV88E6XXX_PORT_LED_CONTROL_LED0_SEL1			0x1
++#define MV88E6XXX_PORT_LED_CONTROL_LED0_SEL2			0x2
++#define MV88E6XXX_PORT_LED_CONTROL_LED0_SEL3			0x3
++#define MV88E6XXX_PORT_LED_CONTROL_LED0_SEL4			0x4
++#define MV88E6XXX_PORT_LED_CONTROL_LED0_SEL5			0x5
++#define MV88E6XXX_PORT_LED_CONTROL_LED0_SEL6			0x6
++#define MV88E6XXX_PORT_LED_CONTROL_LED0_SEL7			0x7
++#define MV88E6XXX_PORT_LED_CONTROL_LED0_SEL8			0x8
++#define MV88E6XXX_PORT_LED_CONTROL_LED0_SEL9			0x9
++#define MV88E6XXX_PORT_LED_CONTROL_LED0_SELA			0xa
++#define MV88E6XXX_PORT_LED_CONTROL_LED0_SELB			0xb
++#define MV88E6XXX_PORT_LED_CONTROL_LED0_SELC			0xc
++#define MV88E6XXX_PORT_LED_CONTROL_LED0_SELD			0xd
++#define MV88E6XXX_PORT_LED_CONTROL_LED0_SELE			0xe
++#define MV88E6XXX_PORT_LED_CONTROL_LED0_SELF			0xf
++#define MV88E6XXX_PORT_LED_CONTROL_LED1_SEL0			(0x0 << 4)
++#define MV88E6XXX_PORT_LED_CONTROL_LED1_SEL1			(0x1 << 4)
++#define MV88E6XXX_PORT_LED_CONTROL_LED1_SEL2			(0x2 << 4)
++#define MV88E6XXX_PORT_LED_CONTROL_LED1_SEL3			(0x3 << 4)
++#define MV88E6XXX_PORT_LED_CONTROL_LED1_SEL4			(0x4 << 4)
++#define MV88E6XXX_PORT_LED_CONTROL_LED1_SEL5			(0x5 << 4)
++#define MV88E6XXX_PORT_LED_CONTROL_LED1_SEL6			(0x6 << 4)
++#define MV88E6XXX_PORT_LED_CONTROL_LED1_SEL7			(0x7 << 4)
++#define MV88E6XXX_PORT_LED_CONTROL_LED1_SEL8			(0x8 << 4)
++#define MV88E6XXX_PORT_LED_CONTROL_LED1_SEL9			(0x9 << 4)
++#define MV88E6XXX_PORT_LED_CONTROL_LED1_SELA			(0xa << 4)
++#define MV88E6XXX_PORT_LED_CONTROL_LED1_SELB			(0xb << 4)
++#define MV88E6XXX_PORT_LED_CONTROL_LED1_SELC			(0xc << 4)
++#define MV88E6XXX_PORT_LED_CONTROL_LED1_SELD			(0xd << 4)
++#define MV88E6XXX_PORT_LED_CONTROL_LED1_SELE			(0xe << 4)
++#define MV88E6XXX_PORT_LED_CONTROL_LED1_SELF			(0xf << 4)
++/* Stretch and Blink Rate Control (Index 0x06 of LED Control) */
++/* Pulse Stretch Selection for all LED's on this port */
++#define MV88E6XXX_PORT_LED_CONTROL_0x06_PULSE_STRETCH_NONE	(0 << 4)
++#define MV88E6XXX_PORT_LED_CONTROL_0x06_PULSE_STRETCH_21MS	(1 << 4)
++#define MV88E6XXX_PORT_LED_CONTROL_0x06_PULSE_STRETCH_42MS	(2 << 4)
++#define MV88E6XXX_PORT_LED_CONTROL_0x06_PULSE_STRETCH_84MS	(3 << 4)
++#define MV88E6XXX_PORT_LED_CONTROL_0x06_PULSE_STRETCH_168MS	(4 << 4)
++/* Blink Rate Selection for all LEDs on this port */
++#define MV88E6XXX_PORT_LED_CONTROL_0x06_BLINK_RATE_21MS		0
++#define MV88E6XXX_PORT_LED_CONTROL_0x06_BLINK_RATE_42MS		1
++#define MV88E6XXX_PORT_LED_CONTROL_0x06_BLINK_RATE_84MS		2
++#define MV88E6XXX_PORT_LED_CONTROL_0x06_BLINK_RATE_168MS	3
++#define MV88E6XXX_PORT_LED_CONTROL_0x06_BLINK_RATE_336MS	4
++#define MV88E6XXX_PORT_LED_CONTROL_0x06_BLINK_RATE_672MS	5
++ /* Control for Special LED (Index 0x7 of LED Control on Port0) */
++#define MV88E6XXX_PORT_LED_CONTROL_0x07_P0_LAN_LINKACT_SHIFT	0 /* bits 6:0 LAN Link Activity LED */
++/* Control for Special LED (Index 0x7 of LED Control on Port 1) */
++#define MV88E6XXX_PORT_LED_CONTROL_0x07_P1_WAN_LINKACT_SHIFT	0 /* bits 6:0 WAN Link Activity LED */
++/* Control for Special LED (Index 0x7 of LED Control on Port 2) */
++#define MV88E6XXX_PORT_LED_CONTROL_0x07_P2_PTP_ACT		0 /* bits 6:0 PTP Activity */
++
+ /* Offset 0x18: IEEE Priority Mapping Table */
+ #define MV88E6390_PORT_IEEE_PRIO_MAP_TABLE			0x18
+ #define MV88E6390_PORT_IEEE_PRIO_MAP_TABLE_UPDATE		0x8000
+@@ -457,6 +581,15 @@ int mv88e6393x_port_set_cmode(struct mv8
+ 			      phy_interface_t mode);
+ int mv88e6185_port_get_cmode(struct mv88e6xxx_chip *chip, int port, u8 *cmode);
+ int mv88e6352_port_get_cmode(struct mv88e6xxx_chip *chip, int port, u8 *cmode);
++#ifdef CONFIG_NET_DSA_MV88E6XXX_LEDS
++int mv88e6xxx_port_setup_leds(struct mv88e6xxx_chip *chip, int port);
++#else
++static inline int mv88e6xxx_port_setup_leds(struct mv88e6xxx_chip *chip,
++					    int port)
++{
++	return 0;
++}
++#endif
+ int mv88e6xxx_port_drop_untagged(struct mv88e6xxx_chip *chip, int port,
+ 				 bool drop_untagged);
+ int mv88e6xxx_port_set_map_da(struct mv88e6xxx_chip *chip, int port, bool map);
diff --git a/6.12/target/linux/generic/config-6.12 b/6.12/target/linux/generic/config-6.12
new file mode 100644
index 00000000..2b13e335
--- /dev/null
+++ b/6.12/target/linux/generic/config-6.12
@@ -0,0 +1,8522 @@
+# CONFIG_104_QUAD_8 is not set
+CONFIG_32BIT=y
+CONFIG_64BIT_TIME=y
+# CONFIG_6LOWPAN is not set
+# CONFIG_6LOWPAN_DEBUGFS is not set
+# CONFIG_6PACK is not set
+# CONFIG_8139CP is not set
+# CONFIG_8139TOO is not set
+# CONFIG_9P_FS is not set
+# CONFIG_AB3100_CORE is not set
+# CONFIG_AB8500_CORE is not set
+# CONFIG_ABP060MG is not set
+# CONFIG_ABX500_CORE is not set
+# CONFIG_ACCESSIBILITY is not set
+# CONFIG_ACENIC is not set
+# CONFIG_ACERHDF is not set
+# CONFIG_ACER_WIRELESS is not set
+# CONFIG_ACER_WMI is not set
+# CONFIG_ACORN_PARTITION is not set
+# CONFIG_ACPI_ALS is not set
+# CONFIG_ACPI_APEI is not set
+# CONFIG_ACPI_APEI_PCIEAER is not set
+# CONFIG_ACPI_BUTTON is not set
+# CONFIG_ACPI_CONFIGFS is not set
+# CONFIG_ACPI_CUSTOM_METHOD is not set
+# CONFIG_ACPI_EXTLOG is not set
+# CONFIG_ACPI_FFH is not set
+# CONFIG_ACPI_HED is not set
+# CONFIG_ACPI_NFIT is not set
+# CONFIG_ACPI_REDUCED_HARDWARE_ONLY is not set
+# CONFIG_ACPI_TABLE_UPGRADE is not set
+# CONFIG_ACPI_TOSHIBA is not set
+# CONFIG_ACPI_VIDEO is not set
+# CONFIG_AD2S1200 is not set
+# CONFIG_AD2S1210 is not set
+# CONFIG_AD2S90 is not set
+# CONFIG_AD3552R is not set
+# CONFIG_AD5064 is not set
+# CONFIG_AD5110 is not set
+# CONFIG_AD525X_DPOT is not set
+# CONFIG_AD5272 is not set
+# CONFIG_AD5360 is not set
+# CONFIG_AD5380 is not set
+# CONFIG_AD5421 is not set
+# CONFIG_AD5446 is not set
+# CONFIG_AD5449 is not set
+# CONFIG_AD5504 is not set
+# CONFIG_AD5592R is not set
+# CONFIG_AD5593R is not set
+# CONFIG_AD5624R_SPI is not set
+# CONFIG_AD5686 is not set
+# CONFIG_AD5686_SPI is not set
+# CONFIG_AD5696_I2C is not set
+# CONFIG_AD5755 is not set
+# CONFIG_AD5758 is not set
+# CONFIG_AD5761 is not set
+# CONFIG_AD5764 is not set
+# CONFIG_AD5766 is not set
+# CONFIG_AD5770R is not set
+# CONFIG_AD5791 is not set
+# CONFIG_AD5933 is not set
+# CONFIG_AD7091R5 is not set
+# CONFIG_AD7124 is not set
+# CONFIG_AD7150 is not set
+# CONFIG_AD7152 is not set
+# CONFIG_AD7192 is not set
+# CONFIG_AD7266 is not set
+# CONFIG_AD7280 is not set
+# CONFIG_AD7291 is not set
+# CONFIG_AD7292 is not set
+# CONFIG_AD7293 is not set
+# CONFIG_AD7298 is not set
+# CONFIG_AD7303 is not set
+# CONFIG_AD74413R is not set
+# CONFIG_AD7476 is not set
+# CONFIG_AD7606 is not set
+# CONFIG_AD7606_IFACE_PARALLEL is not set
+# CONFIG_AD7606_IFACE_SPI is not set
+# CONFIG_AD7746 is not set
+# CONFIG_AD7766 is not set
+# CONFIG_AD7768_1 is not set
+# CONFIG_AD7780 is not set
+# CONFIG_AD7791 is not set
+# CONFIG_AD7793 is not set
+# CONFIG_AD7816 is not set
+# CONFIG_AD7887 is not set
+# CONFIG_AD7923 is not set
+# CONFIG_AD7949 is not set
+# CONFIG_AD799X is not set
+# CONFIG_AD8366 is not set
+# CONFIG_AD8801 is not set
+# CONFIG_AD9467 is not set
+# CONFIG_AD9523 is not set
+# CONFIG_AD9832 is not set
+# CONFIG_AD9834 is not set
+# CONFIG_ADA4250 is not set
+# CONFIG_ADAPTEC_STARFIRE is not set
+# CONFIG_ADDRESS_MASKING is not set
+# CONFIG_ADE7854 is not set
+# CONFIG_ADF4350 is not set
+# CONFIG_ADF4371 is not set
+# CONFIG_ADFS_FS is not set
+# CONFIG_ADIN1100_PHY is not set
+# CONFIG_ADIN1110 is not set
+# CONFIG_ADIN_PHY is not set
+# CONFIG_ADIS16080 is not set
+# CONFIG_ADIS16130 is not set
+# CONFIG_ADIS16136 is not set
+# CONFIG_ADIS16201 is not set
+# CONFIG_ADIS16203 is not set
+# CONFIG_ADIS16209 is not set
+# CONFIG_ADIS16240 is not set
+# CONFIG_ADIS16260 is not set
+# CONFIG_ADIS16400 is not set
+# CONFIG_ADIS16460 is not set
+# CONFIG_ADIS16475 is not set
+# CONFIG_ADIS16480 is not set
+# CONFIG_ADI_AXI_ADC is not set
+# CONFIG_ADJD_S311 is not set
+# CONFIG_ADM6996_PHY is not set
+# CONFIG_ADM8211 is not set
+# CONFIG_ADMV1013 is not set
+# CONFIG_ADMV1014 is not set
+# CONFIG_ADMV4420 is not set
+# CONFIG_ADMV8818 is not set
+# CONFIG_ADRF6780 is not set
+# CONFIG_ADT7316 is not set
+# CONFIG_ADUX1020 is not set
+# CONFIG_ADV_SWBUTTON is not set
+CONFIG_ADVISE_SYSCALLS=y
+# CONFIG_ADXL313_I2C is not set
+# CONFIG_ADXL313_SPI is not set
+# CONFIG_ADXL345_I2C is not set
+# CONFIG_ADXL345_SPI is not set
+# CONFIG_ADXL355_I2C is not set
+# CONFIG_ADXL355_SPI is not set
+# CONFIG_ADXL367_I2C is not set
+# CONFIG_ADXL367_SPI is not set
+# CONFIG_ADXL372_I2C is not set
+# CONFIG_ADXL372_SPI is not set
+# CONFIG_ADXRS290 is not set
+# CONFIG_ADXRS450 is not set
+CONFIG_AEABI=y
+# CONFIG_AFE4403 is not set
+# CONFIG_AFE4404 is not set
+# CONFIG_AFFS_FS is not set
+# CONFIG_AFS_DEBUG_CURSOR is not set
+# CONFIG_AFS_FS is not set
+# CONFIG_AF_KCM is not set
+# CONFIG_AF_RXRPC is not set
+# CONFIG_AF_RXRPC_INJECT_LOSS is not set
+# CONFIG_AF_RXRPC_IPV6 is not set
+CONFIG_AF_UNIX_OOB=y
+# CONFIG_AGP is not set
+# CONFIG_AHCI_BRCM is not set
+# CONFIG_AHCI_CEVA is not set
+# CONFIG_AHCI_DWC is not set
+# CONFIG_AHCI_IMX is not set
+# CONFIG_AHCI_MVEBU is not set
+# CONFIG_AHCI_QORIQ is not set
+# CONFIG_AHCI_XGENE is not set
+CONFIG_AIO=y
+# CONFIG_AIRO is not set
+# CONFIG_AIRO_CS is not set
+# CONFIG_AIX_PARTITION is not set
+# CONFIG_AK09911 is not set
+# CONFIG_AK8974 is not set
+# CONFIG_AK8975 is not set
+# CONFIG_AL3010 is not set
+# CONFIG_AL3320A is not set
+# CONFIG_ALIM7101_WDT is not set
+CONFIG_ALLOW_DEV_COREDUMP=y
+# CONFIG_ALTERA_MBOX is not set
+# CONFIG_ALTERA_MSGDMA is not set
+# CONFIG_ALTERA_STAPL is not set
+# CONFIG_ALTERA_TSE is not set
+# CONFIG_ALX is not set
+# CONFIG_AL_FIC is not set
+# CONFIG_AM2315 is not set
+# CONFIG_AM335X_PHY_USB is not set
+# CONFIG_AMBA_PL08X is not set
+# CONFIG_AMD8111_ETH is not set
+# CONFIG_AMD_MEM_ENCRYPT is not set
+# CONFIG_AMD_PHY is not set
+# CONFIG_AMD_PMF is not set
+# CONFIG_AMD_XGBE is not set
+# CONFIG_AMD_XGBE_HAVE_ECC is not set
+# CONFIG_AMPERE_ERRATUM_AC03_CPU_38 is not set
+# CONFIG_AMIGA_PARTITION is not set
+# CONFIG_AMILO_RFKILL is not set
+# CONFIG_AMT is not set
+# CONFIG_ANDROID is not set
+# CONFIG_ANDROID_BINDER_IPC is not set
+CONFIG_ANON_INODES=y
+# CONFIG_ANON_VMA_NAME is not set
+# CONFIG_APDS9300 is not set
+# CONFIG_APDS9802ALS is not set
+# CONFIG_APDS9960 is not set
+# CONFIG_APM8018X is not set
+# CONFIG_APM_EMULATION is not set
+# CONFIG_APPLE_GMUX is not set
+# CONFIG_APPLE_MFI_FASTCHARGE is not set
+# CONFIG_APPLE_PROPERTIES is not set
+# CONFIG_APPLICOM is not set
+# CONFIG_AQTION is not set
+# CONFIG_AQUANTIA_PHY is not set
+# CONFIG_AR5523 is not set
+# CONFIG_AR7 is not set
+# CONFIG_AR8216_PHY is not set
+# CONFIG_AR8216_PHY_LEDS is not set
+# CONFIG_ARCH_ACTIONS is not set
+# CONFIG_ARCH_AGILEX is not set
+# CONFIG_ARCH_AIROHA is not set
+# CONFIG_ARCH_ALPINE is not set
+# CONFIG_ARCH_APPLE is not set
+# CONFIG_ARCH_ARTPEC is not set
+# CONFIG_ARCH_ASPEED is not set
+# CONFIG_ARCH_AT91 is not set
+# CONFIG_ARCH_AXXIA is not set
+# CONFIG_ARCH_BCM is not set
+# CONFIG_ARCH_BCM2835 is not set
+# CONFIG_ARCH_BCM4908 is not set
+# CONFIG_ARCH_BCMBCA is not set
+# CONFIG_ARCH_BCM_21664 is not set
+# CONFIG_ARCH_BCM_23550 is not set
+# CONFIG_ARCH_BCM_281XX is not set
+# CONFIG_ARCH_BCM_5301X is not set
+# CONFIG_ARCH_BCM_53573 is not set
+# CONFIG_ARCH_BCM_63XX is not set
+# CONFIG_ARCH_BCM_CYGNUS is not set
+# CONFIG_ARCH_BCM_HR2 is not set
+# CONFIG_ARCH_BCM_IPROC is not set
+# CONFIG_ARCH_BCM_NSP is not set
+# CONFIG_ARCH_BERLIN is not set
+CONFIG_ARCH_BINFMT_ELF_STATE=y
+# CONFIG_ARCH_BITMAIN is not set
+# CONFIG_ARCH_BRCMSTB is not set
+# CONFIG_ARCH_CLPS711X is not set
+# CONFIG_ARCH_CNS3XXX is not set
+# CONFIG_ARCH_DAVINCI is not set
+# CONFIG_ARCH_DIGICOLOR is not set
+# CONFIG_ARCH_DMA_ADDR_T_64BIT is not set
+# CONFIG_ARCH_DOVE is not set
+# CONFIG_ARCH_EBSA110 is not set
+# CONFIG_ARCH_EP93XX is not set
+# CONFIG_ARCH_EXYNOS is not set
+CONFIG_ARCH_FLATMEM_ENABLE=y
+# CONFIG_ARCH_FOOTBRIDGE is not set
+CONFIG_ARCH_FORCE_MAX_ORDER=11
+# CONFIG_ARCH_GEMINI is not set
+# CONFIG_ARCH_HI3xxx is not set
+# CONFIG_ARCH_HIGHBANK is not set
+# CONFIG_ARCH_HISI is not set
+# CONFIG_ARCH_HPE is not set
+# CONFIG_ARCH_INTEGRATOR is not set
+# CONFIG_ARCH_INTEL_SOCFPGA is not set
+# CONFIG_ARCH_IOP13XX is not set
+# CONFIG_ARCH_IOP32X is not set
+# CONFIG_ARCH_IOP33X is not set
+# CONFIG_ARCH_IXP4XX is not set
+# CONFIG_ARCH_K3 is not set
+# CONFIG_ARCH_KEEMBAY is not set
+# CONFIG_ARCH_KEYSTONE is not set
+# CONFIG_ARCH_KS8695 is not set
+# CONFIG_ARCH_LAYERSCAPE is not set
+# CONFIG_ARCH_LG1K is not set
+# CONFIG_ARCH_LPC32XX is not set
+# CONFIG_ARCH_MEDIATEK is not set
+# CONFIG_ARCH_MESON is not set
+# CONFIG_ARCH_MILBEAUT is not set
+CONFIG_ARCH_MMAP_RND_BITS=8
+CONFIG_ARCH_MMAP_RND_BITS_MAX=16
+CONFIG_ARCH_MMAP_RND_BITS_MIN=8
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=16
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=8
+# CONFIG_ARCH_MMP is not set
+# CONFIG_ARCH_MSTARV7 is not set
+# CONFIG_ARCH_MULTIPLATFORM is not set
+# CONFIG_ARCH_MULTI_V6 is not set
+# CONFIG_ARCH_MULTI_V7 is not set
+# CONFIG_ARCH_MV78XX0 is not set
+# CONFIG_ARCH_MVEBU is not set
+# CONFIG_ARCH_MXC is not set
+# CONFIG_ARCH_MXS is not set
+# CONFIG_ARCH_NEEDS_CPU_IDLE_COUPLED is not set
+# CONFIG_ARCH_NETX is not set
+# CONFIG_ARCH_NOMADIK is not set
+# CONFIG_ARCH_NPCM is not set
+# CONFIG_ARCH_NSPIRE is not set
+# CONFIG_ARCH_NXP is not set
+# CONFIG_ARCH_OMAP is not set
+# CONFIG_ARCH_OMAP1 is not set
+# CONFIG_ARCH_OMAP2 is not set
+# CONFIG_ARCH_OMAP2PLUS is not set
+# CONFIG_ARCH_OMAP3 is not set
+# CONFIG_ARCH_OMAP4 is not set
+# CONFIG_ARCH_ORION5X is not set
+# CONFIG_ARCH_OXNAS is not set
+# CONFIG_ARCH_PICOXCELL is not set
+# CONFIG_ARCH_PRIMA2 is not set
+# CONFIG_ARCH_PXA is not set
+# CONFIG_ARCH_QCOM is not set
+# CONFIG_ARCH_RANDOM is not set
+# CONFIG_ARCH_RDA is not set
+# CONFIG_ARCH_REALTEK is not set
+# CONFIG_ARCH_REALVIEW is not set
+# CONFIG_ARCH_RENESAS is not set
+# CONFIG_ARCH_ROCKCHIP is not set
+# CONFIG_ARCH_RPC is not set
+# CONFIG_ARCH_S32 is not set
+# CONFIG_ARCH_S3C24XX is not set
+# CONFIG_ARCH_S3C64XX is not set
+# CONFIG_ARCH_S5PV210 is not set
+# CONFIG_ARCH_SA1100 is not set
+# CONFIG_ARCH_SEATTLE is not set
+# CONFIG_ARCH_SHMOBILE is not set
+# CONFIG_ARCH_SIRF is not set
+# CONFIG_ARCH_SOCFPGA is not set
+# CONFIG_ARCH_SPARX5 is not set
+# CONFIG_ARCH_SPRD is not set
+# CONFIG_ARCH_STI is not set
+# CONFIG_ARCH_STM32 is not set
+# CONFIG_ARCH_STRATIX10 is not set
+# CONFIG_ARCH_SUNPLUS is not set
+# CONFIG_ARCH_SUNXI is not set
+# CONFIG_ARCH_SYNQUACER is not set
+# CONFIG_ARCH_TANGO is not set
+# CONFIG_ARCH_TEGRA is not set
+# CONFIG_ARCH_THUNDER is not set
+# CONFIG_ARCH_THUNDER2 is not set
+# CONFIG_ARCH_U300 is not set
+# CONFIG_ARCH_U8500 is not set
+# CONFIG_ARCH_UNIPHIER is not set
+# CONFIG_ARCH_VERSATILE is not set
+# CONFIG_ARCH_VEXPRESS is not set
+# CONFIG_ARCH_VIRT is not set
+# CONFIG_ARCH_VISCONTI is not set
+# CONFIG_ARCH_VT8500 is not set
+# CONFIG_ARCH_VULCAN is not set
+# CONFIG_ARCH_W90X900 is not set
+# CONFIG_ARCH_WANTS_THP_SWAP is not set
+# CONFIG_ARCH_WM8505 is not set
+# CONFIG_ARCH_WM8750 is not set
+# CONFIG_ARCH_WM8850 is not set
+# CONFIG_ARCH_XGENE is not set
+# CONFIG_ARCH_ZX is not set
+# CONFIG_ARCH_ZYNQ is not set
+# CONFIG_ARCH_ZYNQMP is not set
+# CONFIG_ARCNET is not set
+# CONFIG_ARC_EMAC is not set
+# CONFIG_ARC_IRQ_NO_AUTOSAVE is not set
+# CONFIG_ARM64_4K_PAGES is not set
+# CONFIG_ARM64_16K_PAGES is not set
+# CONFIG_ARM64_64K_PAGES is not set
+# CONFIG_ARM64_AMU_EXTN is not set
+# CONFIG_ARM64_BTI is not set
+# CONFIG_ARM64_CRYPTO is not set
+# CONFIG_ARM64_E0PD is not set
+# CONFIG_ARM64_ERRATUM_1024718 is not set
+# CONFIG_ARM64_ERRATUM_1165522 is not set
+# CONFIG_ARM64_ERRATUM_1286807 is not set
+# CONFIG_ARM64_ERRATUM_1319367 is not set
+# CONFIG_ARM64_ERRATUM_1418040 is not set
+# CONFIG_ARM64_ERRATUM_1463225 is not set
+# CONFIG_ARM64_ERRATUM_1508412 is not set
+# CONFIG_ARM64_ERRATUM_1530923 is not set
+# CONFIG_ARM64_ERRATUM_1542419 is not set
+# CONFIG_ARM64_ERRATUM_1742098 is not set
+# CONFIG_ARM64_ERRATUM_2051678 is not set
+# CONFIG_ARM64_ERRATUM_2054223 is not set
+# CONFIG_ARM64_ERRATUM_2067961 is not set
+# CONFIG_ARM64_ERRATUM_2077057 is not set
+# CONFIG_ARM64_ERRATUM_2441007 is not set
+# CONFIG_ARM64_ERRATUM_2441009 is not set
+# CONFIG_ARM64_ERRATUM_2658417 is not set
+# CONFIG_ARM64_ERRATUM_819472 is not set
+# CONFIG_ARM64_ERRATUM_824069 is not set
+# CONFIG_ARM64_ERRATUM_826319 is not set
+# CONFIG_ARM64_ERRATUM_827319 is not set
+# CONFIG_ARM64_ERRATUM_832075 is not set
+# CONFIG_ARM64_ERRATUM_834220 is not set
+# CONFIG_ARM64_ERRATUM_843419 is not set
+# CONFIG_ARM64_ERRATUM_845719 is not set
+# CONFIG_ARM64_ERRATUM_858921 is not set
+# CONFIG_ARM64_HW_AFDBM is not set
+# CONFIG_ARM64_LSE_ATOMICS is not set
+CONFIG_ARM64_MODULE_PLTS=y
+# CONFIG_ARM64_MTE is not set
+# CONFIG_ARM64_PAN is not set
+# CONFIG_ARM64_PMEM is not set
+# CONFIG_ARM64_PSEUDO_NMI is not set
+# CONFIG_ARM64_PTDUMP_DEBUGFS is not set
+# CONFIG_ARM64_PTR_AUTH is not set
+# CONFIG_ARM64_RANDOMIZE_TEXT_OFFSET is not set
+# CONFIG_ARM64_RAS_EXTN is not set
+# CONFIG_ARM64_RELOC_TEST is not set
+# CONFIG_ARM64_SME is not set
+# CONFIG_ARM64_SVE is not set
+CONFIG_ARM64_SW_TTBR0_PAN=y
+# CONFIG_ARM64_TLB_RANGE is not set
+# CONFIG_ARM64_UAO is not set
+# CONFIG_ARM64_USE_LSE_ATOMICS is not set
+# CONFIG_ARM64_VA_BITS_48 is not set
+# CONFIG_ARM64_VHE is not set
+# CONFIG_ARM_APPENDED_DTB is not set
+# CONFIG_ARM_ARCH_TIMER is not set
+# CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_EXTEND is not set
+# CONFIG_ARM_BIG_LITTLE_CPUFREQ is not set
+# CONFIG_ARM_CCI is not set
+# CONFIG_ARM_CCI400_PMU is not set
+# CONFIG_ARM_CCI5xx_PMU is not set
+# CONFIG_ARM_CCI_PMU is not set
+# CONFIG_ARM_CCN is not set
+# CONFIG_ARM_CMN is not set
+# CONFIG_ARM_CPUIDLE is not set
+CONFIG_ARM_CPU_TOPOLOGY=y
+# CONFIG_ARM_CRYPTO is not set
+CONFIG_ARM_DMA_MEM_BUFFERABLE=y
+# CONFIG_ARM_DSU_PMU is not set
+# CONFIG_ARM_ERRATA_326103 is not set
+# CONFIG_ARM_ERRATA_364296 is not set
+# CONFIG_ARM_ERRATA_411920 is not set
+# CONFIG_ARM_ERRATA_430973 is not set
+# CONFIG_ARM_ERRATA_458693 is not set
+# CONFIG_ARM_ERRATA_460075 is not set
+# CONFIG_ARM_ERRATA_643719 is not set
+# CONFIG_ARM_ERRATA_720789 is not set
+# CONFIG_ARM_ERRATA_742230 is not set
+# CONFIG_ARM_ERRATA_742231 is not set
+# CONFIG_ARM_ERRATA_743622 is not set
+# CONFIG_ARM_ERRATA_751472 is not set
+# CONFIG_ARM_ERRATA_754322 is not set
+# CONFIG_ARM_ERRATA_754327 is not set
+# CONFIG_ARM_ERRATA_764319 is not set
+# CONFIG_ARM_ERRATA_764369 is not set
+# CONFIG_ARM_ERRATA_773022 is not set
+# CONFIG_ARM_ERRATA_775420 is not set
+# CONFIG_ARM_ERRATA_798181 is not set
+# CONFIG_ARM_ERRATA_814220 is not set
+# CONFIG_ARM_ERRATA_818325_852422 is not set
+# CONFIG_ARM_ERRATA_821420 is not set
+# CONFIG_ARM_ERRATA_825619 is not set
+# CONFIG_ARM_ERRATA_852421 is not set
+# CONFIG_ARM_ERRATA_852423 is not set
+# CONFIG_ARM_ERRATA_857271 is not set
+# CONFIG_ARM_ERRATA_857272 is not set
+# CONFIG_ARM_FFA_TRANSPORT is not set
+CONFIG_ARM_GIC_MAX_NR=1
+# CONFIG_ARM_KIRKWOOD_CPUFREQ is not set
+# CONFIG_ARM_KPROBES_TEST is not set
+# CONFIG_ARM_LPAE is not set
+# CONFIG_ARM_MEDIATEK_CPUFREQ_HW is not set
+# CONFIG_ARM_MHU is not set
+# CONFIG_ARM_MHU_V2 is not set
+CONFIG_ARM_MODULE_PLTS=y
+# CONFIG_ARM_PATCH_PHYS_VIRT is not set
+# CONFIG_ARM_PSCI is not set
+# CONFIG_ARM_PSCI_CHECKER is not set
+# CONFIG_ARM_PSCI_CPUIDLE is not set
+# CONFIG_ARM_PTDUMP_DEBUGFS is not set
+# CONFIG_ARM_SBSA_WATCHDOG is not set
+# CONFIG_ARM_SCMI_PROTOCOL is not set
+# CONFIG_ARM_SCPI_PROTOCOL is not set
+# CONFIG_ARM_SDE_INTERFACE is not set
+# CONFIG_ARM_SMCCC_SOC_ID is not set
+# CONFIG_ARM_SMC_WATCHDOG is not set
+# CONFIG_ARM_SP805_WATCHDOG is not set
+# CONFIG_ARM_SPE_PMU is not set
+# CONFIG_ARM_THUMBEE is not set
+# CONFIG_ARM_TIMER_SP804 is not set
+# CONFIG_ARM_UNWIND is not set
+# CONFIG_ARM_VIRT_EXT is not set
+# CONFIG_AS3935 is not set
+# CONFIG_AS73211 is not set
+# CONFIG_ASM9260_TIMER is not set
+# CONFIG_ASN1 is not set
+# CONFIG_ASUS_LAPTOP is not set
+# CONFIG_ASUS_WIRELESS is not set
+# CONFIG_ASUS_WMI is not set
+# CONFIG_ASYMMETRIC_KEY_TYPE is not set
+# CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE is not set
+# CONFIG_ASYNC_RAID6_TEST is not set
+# CONFIG_ASYNC_TX_DMA is not set
+# CONFIG_AT76C50X_USB is not set
+# CONFIG_AT803X_PHY is not set
+# CONFIG_AT91_SAMA5D2_ADC is not set
+# CONFIG_ATA is not set
+# CONFIG_ATAGS is not set
+CONFIG_ATAGS_PROC=y
+# CONFIG_ATALK is not set
+# CONFIG_ATARI_PARTITION is not set
+# CONFIG_ATA_ACPI is not set
+CONFIG_ATA_BMDMA=y
+# CONFIG_ATA_FORCE is not set
+# CONFIG_ATA_GENERIC is not set
+# CONFIG_ATA_LEDS is not set
+# CONFIG_ATA_NONSTANDARD is not set
+# CONFIG_ATA_OVER_ETH is not set
+# CONFIG_ATA_PIIX is not set
+CONFIG_ATA_SFF=y
+# CONFIG_ATA_VERBOSE_ERROR is not set
+# CONFIG_ATH10K is not set
+# CONFIG_ATH25 is not set
+# CONFIG_ATH5K is not set
+# CONFIG_ATH6KL is not set
+# CONFIG_ATH79 is not set
+# CONFIG_ATH9K is not set
+# CONFIG_ATH9K_HTC is not set
+# CONFIG_ATH_DEBUG is not set
+# CONFIG_ATL1 is not set
+# CONFIG_ATL1C is not set
+# CONFIG_ATL1E is not set
+# CONFIG_ATL2 is not set
+# CONFIG_ATLAS_EZO_SENSOR is not set
+# CONFIG_ATLAS_PH_SENSOR is not set
+# CONFIG_ATM is not set
+# CONFIG_ATMEL is not set
+# CONFIG_ATMEL_PIT is not set
+# CONFIG_ATMEL_SSC is not set
+# CONFIG_ATM_AMBASSADOR is not set
+# CONFIG_ATM_BR2684 is not set
+CONFIG_ATM_BR2684_IPFILTER=y
+# CONFIG_ATM_CLIP is not set
+CONFIG_ATM_CLIP_NO_ICMP=y
+# CONFIG_ATM_DRIVERS is not set
+# CONFIG_ATM_DUMMY is not set
+# CONFIG_ATM_ENI is not set
+# CONFIG_ATM_FIRESTREAM is not set
+# CONFIG_ATM_FORE200E is not set
+# CONFIG_ATM_HE is not set
+# CONFIG_ATM_HORIZON is not set
+# CONFIG_ATM_IA is not set
+# CONFIG_ATM_IDT77252 is not set
+# CONFIG_ATM_LANAI is not set
+# CONFIG_ATM_LANE is not set
+# CONFIG_ATM_MPOA is not set
+# CONFIG_ATM_NICSTAR is not set
+# CONFIG_ATM_SOLOS is not set
+# CONFIG_ATM_TCP is not set
+# CONFIG_ATM_ZATM is not set
+# CONFIG_ATOMIC64_SELFTEST is not set
+# CONFIG_ATP is not set
+# CONFIG_AUDIT is not set
+# CONFIG_AUDIT_ARCH_COMPAT_GENERIC is not set
+# CONFIG_AURORA_NB8800 is not set
+# CONFIG_AUTOFS4_FS is not set
+# CONFIG_AUTOFS_FS is not set
+# CONFIG_AUTO_ZRELADDR is not set
+# CONFIG_AUXDISPLAY is not set
+# CONFIG_AX25 is not set
+# CONFIG_AX25_DAMA_SLAVE is not set
+# CONFIG_AX88796 is not set
+# CONFIG_AX88796B_PHY is not set
+# CONFIG_AXP20X_ADC is not set
+# CONFIG_AXP20X_POWER is not set
+# CONFIG_AXP288_ADC is not set
+# CONFIG_AXP288_FUEL_GAUGE is not set
+# CONFIG_B43 is not set
+# CONFIG_B43LEGACY is not set
+# CONFIG_B44 is not set
+# CONFIG_B53 is not set
+# CONFIG_B53_MDIO_DRIVER is not set
+# CONFIG_B53_MMAP_DRIVER is not set
+# CONFIG_B53_SERDES is not set
+# CONFIG_B53_SPI_DRIVER is not set
+# CONFIG_B53_SRAB_DRIVER is not set
+# CONFIG_BACKLIGHT_ADP8860 is not set
+# CONFIG_BACKLIGHT_ADP8870 is not set
+# CONFIG_BACKLIGHT_APPLE is not set
+# CONFIG_BACKLIGHT_ARCXCNN is not set
+# CONFIG_BACKLIGHT_BD6107 is not set
+# CONFIG_BACKLIGHT_CLASS_DEVICE is not set
+# CONFIG_BACKLIGHT_GENERIC is not set
+# CONFIG_BACKLIGHT_GPIO is not set
+# CONFIG_BACKLIGHT_KTD253 is not set
+# CONFIG_BACKLIGHT_LCD_SUPPORT is not set
+# CONFIG_BACKLIGHT_LED is not set
+# CONFIG_BACKLIGHT_LM3630A is not set
+# CONFIG_BACKLIGHT_LM3639 is not set
+# CONFIG_BACKLIGHT_LP855X is not set
+# CONFIG_BACKLIGHT_LV5207LP is not set
+# CONFIG_BACKLIGHT_PANDORA is not set
+# CONFIG_BACKLIGHT_PM8941_WLED is not set
+# CONFIG_BACKLIGHT_PWM is not set
+# CONFIG_BACKLIGHT_QCOM_WLED is not set
+# CONFIG_BACKLIGHT_RPI is not set
+# CONFIG_BACKLIGHT_SAHARA is not set
+# CONFIG_BACKTRACE_SELF_TEST is not set
+# CONFIG_BACKTRACE_VERBOSE is not set
+# CONFIG_BAREUDP is not set
+CONFIG_BASE_FULL=y
+CONFIG_BASE_SMALL=0
+# CONFIG_BATMAN_ADV is not set
+# CONFIG_BATTERY_BQ27XXX is not set
+# CONFIG_BATTERY_BQ27XXX_HDQ is not set
+# CONFIG_BATTERY_CW2015 is not set
+# CONFIG_BATTERY_DS2760 is not set
+# CONFIG_BATTERY_DS2780 is not set
+# CONFIG_BATTERY_DS2781 is not set
+# CONFIG_BATTERY_DS2782 is not set
+# CONFIG_BATTERY_GAUGE_LTC2941 is not set
+# CONFIG_BATTERY_GOLDFISH is not set
+# CONFIG_BATTERY_LEGO_EV3 is not set
+# CONFIG_BATTERY_MAX17040 is not set
+# CONFIG_BATTERY_MAX17042 is not set
+# CONFIG_BATTERY_MAX1721X is not set
+# CONFIG_BATTERY_RT5033 is not set
+# CONFIG_BATTERY_SAMSUNG_SDI is not set
+# CONFIG_BATTERY_SBS is not set
+# CONFIG_BATTERY_UG3105 is not set
+# CONFIG_BAYCOM_EPP is not set
+# CONFIG_BAYCOM_PAR is not set
+# CONFIG_BAYCOM_SER_FDX is not set
+# CONFIG_BAYCOM_SER_HDX is not set
+# CONFIG_BCACHE is not set
+# CONFIG_BCM47XX is not set
+# CONFIG_BCM54140_PHY is not set
+# CONFIG_BCM63XX is not set
+# CONFIG_BCM63XX_PHY is not set
+# CONFIG_BCM7038_L1_IRQ is not set
+# CONFIG_BCM7038_WDT is not set
+# CONFIG_BCM7120_L2_IRQ is not set
+# CONFIG_BCM7XXX_PHY is not set
+# CONFIG_BCM84881_PHY is not set
+# CONFIG_BCM87XX_PHY is not set
+# CONFIG_BCMA is not set
+# CONFIG_BCMA_DRIVER_GPIO is not set
+CONFIG_BCMA_POSSIBLE=y
+# CONFIG_BCMGENET is not set
+# CONFIG_BCM_IPROC_ADC is not set
+# CONFIG_BCM_KONA_USB2_PHY is not set
+# CONFIG_BCM_SBA_RAID is not set
+# CONFIG_BCM_VK is not set
+# CONFIG_BDI_SWITCH is not set
+# CONFIG_BE2ISCSI is not set
+# CONFIG_BE2NET is not set
+# CONFIG_BEFS_FS is not set
+# CONFIG_BFS_FS is not set
+# CONFIG_BGMAC is not set
+# CONFIG_BH1750 is not set
+# CONFIG_BH1780 is not set
+# CONFIG_BIG_KEYS is not set
+# CONFIG_BIG_LITTLE is not set
+CONFIG_BINARY_PRINTF=y
+# CONFIG_BINFMT_AOUT is not set
+CONFIG_BINFMT_ELF=y
+# CONFIG_BINFMT_ELF_FDPIC is not set
+# CONFIG_BINFMT_FLAT is not set
+# CONFIG_BINFMT_MISC is not set
+CONFIG_BINFMT_SCRIPT=y
+CONFIG_BITREVERSE=y
+# CONFIG_BLK_CGROUP_IOCOST is not set
+# CONFIG_BLK_CGROUP_IOLATENCY is not set
+# CONFIG_BLK_CGROUP_IOPRIO is not set
+# CONFIG_BLK_CMDLINE_PARSER is not set
+# CONFIG_BLK_DEBUG_FS is not set
+CONFIG_BLK_DEV=y
+# CONFIG_BLK_DEV_3W_XXXX_RAID is not set
+# CONFIG_BLK_DEV_4DRIVES is not set
+# CONFIG_BLK_DEV_AEC62XX is not set
+# CONFIG_BLK_DEV_ALI14XX is not set
+# CONFIG_BLK_DEV_ALI15X3 is not set
+# CONFIG_BLK_DEV_AMD74XX is not set
+# CONFIG_BLK_DEV_ATIIXP is not set
+# CONFIG_BLK_DEV_BSG is not set
+# CONFIG_BLK_DEV_BSGLIB is not set
+# CONFIG_BLK_DEV_CMD640 is not set
+# CONFIG_BLK_DEV_CMD64X is not set
+# CONFIG_BLK_DEV_COW_COMMON is not set
+# CONFIG_BLK_DEV_CRYPTOLOOP is not set
+# CONFIG_BLK_DEV_CS5520 is not set
+# CONFIG_BLK_DEV_CS5530 is not set
+# CONFIG_BLK_DEV_CS5535 is not set
+# CONFIG_BLK_DEV_CS5536 is not set
+# CONFIG_BLK_DEV_CY82C693 is not set
+# CONFIG_BLK_DEV_DAC960 is not set
+# CONFIG_BLK_DEV_DELKIN is not set
+# CONFIG_BLK_DEV_DM is not set
+# CONFIG_BLK_DEV_DRBD is not set
+# CONFIG_BLK_DEV_DTC2278 is not set
+# CONFIG_BLK_DEV_FD is not set
+# CONFIG_BLK_DEV_GENERIC is not set
+# CONFIG_BLK_DEV_HPT366 is not set
+# CONFIG_BLK_DEV_HT6560B is not set
+# CONFIG_BLK_DEV_IDEACPI is not set
+# CONFIG_BLK_DEV_IDECD is not set
+# CONFIG_BLK_DEV_IDECS is not set
+# CONFIG_BLK_DEV_IDEPCI is not set
+# CONFIG_BLK_DEV_IDEPNP is not set
+# CONFIG_BLK_DEV_IDETAPE is not set
+# CONFIG_BLK_DEV_IDE_AU1XXX is not set
+# CONFIG_BLK_DEV_IDE_SATA is not set
+CONFIG_BLK_DEV_INITRD=y
+# CONFIG_BLK_DEV_INTEGRITY is not set
+# CONFIG_BLK_DEV_IO_TRACE is not set
+# CONFIG_BLK_DEV_IT8172 is not set
+# CONFIG_BLK_DEV_IT8213 is not set
+# CONFIG_BLK_DEV_IT821X is not set
+# CONFIG_BLK_DEV_JMICRON is not set
+# CONFIG_BLK_DEV_LOOP is not set
+CONFIG_BLK_DEV_LOOP_MIN_COUNT=8
+# CONFIG_BLK_DEV_MD is not set
+# CONFIG_BLK_DEV_NBD is not set
+# CONFIG_BLK_DEV_NS87415 is not set
+# CONFIG_BLK_DEV_NULL_BLK is not set
+# CONFIG_BLK_DEV_NVME is not set
+# CONFIG_BLK_DEV_OFFBOARD is not set
+# CONFIG_BLK_DEV_OPTI621 is not set
+# CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set
+# CONFIG_BLK_DEV_PDC202XX_NEW is not set
+# CONFIG_BLK_DEV_PDC202XX_OLD is not set
+# CONFIG_BLK_DEV_PIIX is not set
+# CONFIG_BLK_DEV_PLATFORM is not set
+# CONFIG_BLK_DEV_PMEM is not set
+# CONFIG_BLK_DEV_QD65XX is not set
+# CONFIG_BLK_DEV_RAM is not set
+# CONFIG_BLK_DEV_RBD is not set
+# CONFIG_BLK_DEV_RSXX is not set
+# CONFIG_BLK_DEV_RZ1000 is not set
+# CONFIG_BLK_DEV_SC1200 is not set
+# CONFIG_BLK_DEV_SD is not set
+# CONFIG_BLK_DEV_SIIMAGE is not set
+# CONFIG_BLK_DEV_SIS5513 is not set
+# CONFIG_BLK_DEV_SKD is not set
+# CONFIG_BLK_DEV_SL82C105 is not set
+# CONFIG_BLK_DEV_SLC90E66 is not set
+# CONFIG_BLK_DEV_SR is not set
+# CONFIG_BLK_DEV_SVWKS is not set
+# CONFIG_BLK_DEV_SX8 is not set
+# CONFIG_BLK_DEV_TC86C001 is not set
+# CONFIG_BLK_DEV_THROTTLING is not set
+# CONFIG_BLK_DEV_TRIFLEX is not set
+# CONFIG_BLK_DEV_TRM290 is not set
+# CONFIG_BLK_DEV_UBLK is not set
+# CONFIG_BLK_DEV_UMC8672 is not set
+# CONFIG_BLK_DEV_UMEM is not set
+# CONFIG_BLK_DEV_VIA82CXXX is not set
+# CONFIG_BLK_DEV_ZONED is not set
+# CONFIG_BLK_INLINE_ENCRYPTION is not set
+# CONFIG_BLK_SED_OPAL is not set
+# CONFIG_BLK_WBT is not set
+CONFIG_BLOCK=y
+# CONFIG_BLOCK_LEGACY_AUTOLOAD is not set
+# CONFIG_BMA180 is not set
+# CONFIG_BMA220 is not set
+# CONFIG_BMA400 is not set
+# CONFIG_BMC150_ACCEL is not set
+# CONFIG_BMC150_MAGN is not set
+# CONFIG_BMC150_MAGN_I2C is not set
+# CONFIG_BMC150_MAGN_SPI is not set
+# CONFIG_BME680 is not set
+# CONFIG_BMG160 is not set
+# CONFIG_BMI088_ACCEL is not set
+# CONFIG_BMI160_I2C is not set
+# CONFIG_BMI160_SPI is not set
+# CONFIG_BMIPS_GENERIC is not set
+# CONFIG_BMP280 is not set
+# CONFIG_BNA is not set
+# CONFIG_BNX2 is not set
+# CONFIG_BNX2X is not set
+# CONFIG_BNX2X_SRIOV is not set
+# CONFIG_BNXT is not set
+# CONFIG_BONDING is not set
+# CONFIG_BOOKE_WDT is not set
+CONFIG_BOOKE_WDT_DEFAULT_TIMEOUT=3
+# CONFIG_BOOTPARAM_HARDLOCKUP_PANIC is not set
+# CONFIG_BOOTPARAM_HUNG_TASK_PANIC is not set
+# CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC is not set
+# CONFIG_BOOTTIME_TRACING is not set
+# CONFIG_BOOT_CONFIG is not set
+# CONFIG_BOOT_PRINTK_DELAY is not set
+CONFIG_BOOT_RAW=y
+# CONFIG_BOSCH_BNO055_I2C is not set
+# CONFIG_BOSCH_BNO055_SERIAL is not set
+# CONFIG_BOUNCE is not set
+CONFIG_BPF=y
+# CONFIG_BPFILTER is not set
+CONFIG_BPF_JIT=y
+# CONFIG_BPF_JIT_ALWAYS_ON is not set
+CONFIG_BPF_JIT_DEFAULT_ON=y
+# CONFIG_BPF_PRELOAD is not set
+# CONFIG_BPF_STREAM_PARSER is not set
+CONFIG_BPF_SYSCALL=y
+CONFIG_BPF_UNPRIV_DEFAULT_OFF=y
+# CONFIG_BPQETHER is not set
+CONFIG_BQL=y
+CONFIG_BRANCH_PROFILE_NONE=y
+# CONFIG_BRCMFMAC is not set
+# CONFIG_BRCMSMAC is not set
+# CONFIG_BRCMSTB_GISB_ARB is not set
+# CONFIG_BRCMSTB_L2_IRQ is not set
+CONFIG_BRIDGE=y
+# CONFIG_BRIDGE_CFM is not set
+# CONFIG_BRIDGE_EBT_802_3 is not set
+# CONFIG_BRIDGE_EBT_AMONG is not set
+# CONFIG_BRIDGE_EBT_ARP is not set
+# CONFIG_BRIDGE_EBT_ARPREPLY is not set
+# CONFIG_BRIDGE_EBT_BROUTE is not set
+# CONFIG_BRIDGE_EBT_DNAT is not set
+# CONFIG_BRIDGE_EBT_IP is not set
+# CONFIG_BRIDGE_EBT_IP6 is not set
+# CONFIG_BRIDGE_EBT_LIMIT is not set
+# CONFIG_BRIDGE_EBT_LOG is not set
+# CONFIG_BRIDGE_EBT_MARK is not set
+# CONFIG_BRIDGE_EBT_MARK_T is not set
+# CONFIG_BRIDGE_EBT_NFLOG is not set
+# CONFIG_BRIDGE_EBT_PKTTYPE is not set
+# CONFIG_BRIDGE_EBT_REDIRECT is not set
+# CONFIG_BRIDGE_EBT_SNAT is not set
+# CONFIG_BRIDGE_EBT_STP is not set
+# CONFIG_BRIDGE_EBT_T_FILTER is not set
+# CONFIG_BRIDGE_EBT_T_NAT is not set
+# CONFIG_BRIDGE_EBT_VLAN is not set
+CONFIG_BRIDGE_IGMP_SNOOPING=y
+# CONFIG_BRIDGE_MRP is not set
+# CONFIG_BRIDGE_NETFILTER is not set
+# CONFIG_BRIDGE_NF_EBTABLES is not set
+CONFIG_BRIDGE_VLAN_FILTERING=y
+# CONFIG_BROADCOM_PHY is not set
+CONFIG_BROKEN_ON_SMP=y
+# CONFIG_BSD_DISKLABEL is not set
+# CONFIG_BSD_PROCESS_ACCT is not set
+# CONFIG_BSD_PROCESS_ACCT_V3 is not set
+# CONFIG_BT is not set
+# CONFIG_BTRFS_ASSERT is not set
+# CONFIG_BTRFS_DEBUG is not set
+# CONFIG_BTRFS_FS is not set
+# CONFIG_BTRFS_FS_POSIX_ACL is not set
+# CONFIG_BTRFS_FS_REF_VERIFY is not set
+# CONFIG_BTRFS_FS_RUN_SANITY_TESTS is not set
+# CONFIG_BT_AOSPEXT is not set
+# CONFIG_BT_ATH3K is not set
+# CONFIG_BT_BNEP is not set
+CONFIG_BT_BNEP_MC_FILTER=y
+CONFIG_BT_BNEP_PROTO_FILTER=y
+# CONFIG_BT_BREDR is not set
+# CONFIG_BT_CMTP is not set
+# CONFIG_BT_FEATURE_DEBUG is not set
+# CONFIG_BT_HCIBCM203X is not set
+# CONFIG_BT_HCIBFUSB is not set
+# CONFIG_BT_HCIBLUECARD is not set
+# CONFIG_BT_HCIBPA10X is not set
+# CONFIG_BT_HCIBT3C is not set
+# CONFIG_BT_HCIBTSDIO is not set
+# CONFIG_BT_HCIBTUSB is not set
+# CONFIG_BT_HCIBTUSB_AUTOSUSPEND is not set
+# CONFIG_BT_HCIBTUSB_MTK is not set
+# CONFIG_BT_HCIBTUSB_RTL is not set
+# CONFIG_BT_HCIDTL1 is not set
+# CONFIG_BT_HCIUART is not set
+# CONFIG_BT_HCIUART_3WIRE is not set
+# CONFIG_BT_HCIUART_AG6XX is not set
+# CONFIG_BT_HCIUART_ATH3K is not set
+CONFIG_BT_HCIUART_BCSP=y
+CONFIG_BT_HCIUART_H4=y
+# CONFIG_BT_HCIUART_LL is not set
+# CONFIG_BT_HCIUART_MRVL is not set
+# CONFIG_BT_HCIUART_QCA is not set
+# CONFIG_BT_HCIUART_RTL is not set
+# CONFIG_BT_HCIVHCI is not set
+# CONFIG_BT_HCIBTUSB_POLL_SYNC is not set
+# CONFIG_BT_HCIBCM4377 is not set
+# CONFIG_BT_HIDP is not set
+# CONFIG_BT_HS is not set
+# CONFIG_BT_LE is not set
+# CONFIG_BT_LE_L2CAP_ECRED is not set
+# CONFIG_BT_LEDS is not set
+# CONFIG_BT_MRVL is not set
+# CONFIG_BT_MSFTEXT is not set
+# CONFIG_BT_MTKSDIO is not set
+# CONFIG_BT_MTKUART is not set
+# CONFIG_BT_RFCOMM is not set
+CONFIG_BT_RFCOMM_TTY=y
+# CONFIG_BT_SELFTEST is not set
+# CONFIG_BT_VIRTIO is not set
+CONFIG_BUG=y
+# CONFIG_BUG_ON_DATA_CORRUPTION is not set
+CONFIG_BUILDTIME_EXTABLE_SORT=y
+CONFIG_BUILDTIME_TABLE_SORT=y
+# CONFIG_BUILD_BIN2C is not set
+CONFIG_BUILD_SALT=""
+# CONFIG_C2PORT is not set
+CONFIG_CACHE_L2X0_PMU=y
+CONFIG_CACHESTAT_SYSCALL=y
+# CONFIG_CADENCE_WATCHDOG is not set
+# CONFIG_CAIF is not set
+# CONFIG_CAN is not set
+# CONFIG_CAN_BCM is not set
+# CONFIG_CAN_CAN327 is not set
+# CONFIG_CAN_CTUCANFD_PCI is not set
+# CONFIG_CAN_CTUCANFD_PLATFORM is not set
+# CONFIG_CAN_DEBUG_DEVICES is not set
+# CONFIG_CAN_DEV is not set
+# CONFIG_CAN_ESD_USB is not set
+# CONFIG_CAN_ETAS_ES58X is not set
+# CONFIG_CAN_GS_USB is not set
+# CONFIG_CAN_GW is not set
+# CONFIG_CAN_HI311X is not set
+# CONFIG_CAN_IFI_CANFD is not set
+# CONFIG_CAN_ISOTP is not set
+# CONFIG_CAN_J1939 is not set
+# CONFIG_CAN_KVASER_PCIEFD is not set
+# CONFIG_CAN_MCBA_USB is not set
+# CONFIG_CAN_MCP251XFD is not set
+# CONFIG_CAN_M_CAN is not set
+# CONFIG_CAN_NETLINK is not set
+# CONFIG_CAN_PEAK_PCIEFD is not set
+# CONFIG_CAN_RAW is not set
+# CONFIG_CAN_RCAR is not set
+# CONFIG_CAN_RCAR_CANFD is not set
+# CONFIG_CAN_SLCAN is not set
+# CONFIG_CAN_SUN4I is not set
+# CONFIG_CAN_UCAN is not set
+# CONFIG_CAN_VCAN is not set
+# CONFIG_CAN_VXCAN is not set
+# CONFIG_CAPI_AVM is not set
+# CONFIG_CAPI_EICON is not set
+# CONFIG_CAPI_TRACE is not set
+CONFIG_CARDBUS=y
+# CONFIG_CARDMAN_4000 is not set
+# CONFIG_CARDMAN_4040 is not set
+# CONFIG_CARL9170 is not set
+# CONFIG_CASSINI is not set
+# CONFIG_CAVIUM_CPT is not set
+# CONFIG_CAVIUM_ERRATUM_22375 is not set
+# CONFIG_CAVIUM_ERRATUM_23144 is not set
+# CONFIG_CAVIUM_ERRATUM_23154 is not set
+# CONFIG_CAVIUM_ERRATUM_27456 is not set
+# CONFIG_CAVIUM_ERRATUM_30115 is not set
+# CONFIG_CAVIUM_OCTEON_SOC is not set
+# CONFIG_CAVIUM_PTP is not set
+# CONFIG_CAVIUM_TX2_ERRATUM_219 is not set
+# CONFIG_CB710_CORE is not set
+# CONFIG_CC10001_ADC is not set
+# CONFIG_CCS811 is not set
+CONFIG_CC_CAN_LINK=y
+CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y
+# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
+# CONFIG_CDROM_PKTCDVD is not set
+# CONFIG_CEPH_FS is not set
+# CONFIG_CEPH_LIB is not set
+# CONFIG_CFG80211 is not set
+# CONFIG_CFG80211_CERTIFICATION_ONUS is not set
+CONFIG_CFG80211_HEADERS=y
+# CONFIG_CGROUPS is not set
+# CONFIG_CGROUP_FAVOR_DYNMODS is not set
+# CONFIG_CGROUP_MISC is not set
+# CONFIG_CHARGER_ADP5061 is not set
+# CONFIG_CHARGER_BD99954 is not set
+# CONFIG_CHARGER_BQ2415X is not set
+# CONFIG_CHARGER_BQ24190 is not set
+# CONFIG_CHARGER_BQ24257 is not set
+# CONFIG_CHARGER_BQ24735 is not set
+# CONFIG_CHARGER_BQ2515X is not set
+# CONFIG_CHARGER_BQ256XX is not set
+# CONFIG_CHARGER_BQ25890 is not set
+# CONFIG_CHARGER_BQ25980 is not set
+# CONFIG_CHARGER_DETECTOR_MAX14656 is not set
+# CONFIG_CHARGER_GPIO is not set
+# CONFIG_CHARGER_ISP1704 is not set
+# CONFIG_CHARGER_LP8727 is not set
+# CONFIG_CHARGER_LT3651 is not set
+# CONFIG_CHARGER_LTC3651 is not set
+# CONFIG_CHARGER_LTC4162L is not set
+# CONFIG_CHARGER_MANAGER is not set
+# CONFIG_CHARGER_MAX77976 is not set
+# CONFIG_CHARGER_MAX8903 is not set
+# CONFIG_CHARGER_QCOM_SMBB is not set
+# CONFIG_CHARGER_RK817 is not set
+# CONFIG_CHARGER_RT9455 is not set
+# CONFIG_CHARGER_SBS is not set
+# CONFIG_CHARGER_SMB347 is not set
+# CONFIG_CHARGER_TWL4030 is not set
+# CONFIG_CHARGER_UCS1002 is not set
+# CONFIG_CHASH_SELFTEST is not set
+# CONFIG_CHASH_STATS is not set
+# CONFIG_CHECKPOINT_RESTORE is not set
+# CONFIG_CHELSIO_T1 is not set
+# CONFIG_CHELSIO_T3 is not set
+# CONFIG_CHELSIO_T4 is not set
+# CONFIG_CHELSIO_T4VF is not set
+# CONFIG_CHROME_PLATFORMS is not set
+# CONFIG_CHR_DEV_OSST is not set
+# CONFIG_CHR_DEV_SCH is not set
+# CONFIG_CHR_DEV_SG is not set
+# CONFIG_CHR_DEV_ST is not set
+# CONFIG_CICADA_PHY is not set
+# CONFIG_CIFS is not set
+# CONFIG_CIFS_ACL is not set
+CONFIG_CIFS_ALLOW_INSECURE_LEGACY=y
+# CONFIG_CIFS_DEBUG is not set
+# CONFIG_CIFS_DEBUG2 is not set
+# CONFIG_CIFS_FSCACHE is not set
+# CONFIG_CIFS_NFSD_EXPORT is not set
+CONFIG_CIFS_POSIX=y
+# CONFIG_CIFS_SMB2 is not set
+# CONFIG_CIFS_STATS is not set
+# CONFIG_CIFS_STATS2 is not set
+# CONFIG_CIFS_SWN_UPCALL is not set
+# CONFIG_CIFS_WEAK_PW_HASH is not set
+CONFIG_CIFS_XATTR=y
+# CONFIG_CIO_DAC is not set
+# CONFIG_CLEANCACHE is not set
+# CONFIG_CLKSRC_PISTACHIO is not set
+# CONFIG_CLKSRC_VERSATILE is not set
+# CONFIG_CLK_GFM_LPASS_SM8250 is not set
+# CONFIG_CLK_HSDK is not set
+# CONFIG_CLK_ICST is not set
+# CONFIG_CLK_QORIQ is not set
+# CONFIG_CLK_SP810 is not set
+# CONFIG_CLOCK_THERMAL is not set
+CONFIG_CLS_U32_MARK=y
+# CONFIG_CLS_U32_PERF is not set
+# CONFIG_CM32181 is not set
+# CONFIG_CM3232 is not set
+# CONFIG_CM3323 is not set
+# CONFIG_CM3605 is not set
+# CONFIG_CM36651 is not set
+# CONFIG_CMA is not set
+# CONFIG_CMA_SYSFS is not set
+CONFIG_CMDLINE=""
+# CONFIG_CMDLINE_BOOL is not set
+# CONFIG_CMDLINE_EXTEND is not set
+# CONFIG_CMDLINE_FORCE is not set
+# CONFIG_CMDLINE_FROM_BOOTLOADER is not set
+# CONFIG_CMDLINE_OVERRIDE is not set
+# CONFIG_CMDLINE_PARTITION is not set
+# CONFIG_CNIC is not set
+# CONFIG_CODA_FS is not set
+# CONFIG_CODE_PATCHING_SELFTEST is not set
+# CONFIG_COMEDI is not set
+# CONFIG_COMMON_CLK_AXI_CLKGEN is not set
+# CONFIG_COMMON_CLK_BOSTON is not set
+# CONFIG_COMMON_CLK_CDCE706 is not set
+# CONFIG_COMMON_CLK_CDCE925 is not set
+# CONFIG_COMMON_CLK_CS2000_CP is not set
+# CONFIG_COMMON_CLK_FIXED_MMIO is not set
+# CONFIG_COMMON_CLK_IPROC is not set
+# CONFIG_COMMON_CLK_MAX9485 is not set
+# CONFIG_COMMON_CLK_MT6765 is not set
+# CONFIG_COMMON_CLK_MT8167 is not set
+# CONFIG_COMMON_CLK_MT8167_AUDSYS is not set
+# CONFIG_COMMON_CLK_MT8167_IMGSYS is not set
+# CONFIG_COMMON_CLK_MT8167_MFGCFG is not set
+# CONFIG_COMMON_CLK_MT8167_MMSYS is not set
+# CONFIG_COMMON_CLK_MT8167_VDECSYS is not set
+# CONFIG_COMMON_CLK_MT8192 is not set
+# CONFIG_COMMON_CLK_NXP is not set
+# CONFIG_COMMON_CLK_PIC32 is not set
+# CONFIG_COMMON_CLK_PISTACHIO is not set
+# CONFIG_COMMON_CLK_PWM is not set
+# CONFIG_COMMON_CLK_PXA is not set
+# CONFIG_COMMON_CLK_QCOM is not set
+# CONFIG_COMMON_CLK_RS9_PCIE is not set
+# CONFIG_COMMON_CLK_SI514 is not set
+# CONFIG_COMMON_CLK_SI5341 is not set
+# CONFIG_COMMON_CLK_SI5351 is not set
+# CONFIG_COMMON_CLK_SI544 is not set
+# CONFIG_COMMON_CLK_SI570 is not set
+# CONFIG_COMMON_CLK_VC5 is not set
+# CONFIG_COMMON_CLK_VC7 is not set
+# CONFIG_COMMON_CLK_XGENE is not set
+# CONFIG_COMMON_CLK_XLNX_CLKWZRD is not set
+CONFIG_COMPACTION=y
+# CONFIG_COMPAL_LAPTOP is not set
+# CONFIG_COMPAT is not set
+# CONFIG_COMPAT_ALIGNMENT_FIXUPS is not set
+# CONFIG_COMPAT_BRK is not set
+# CONFIG_COMPILE_TEST is not set
+# CONFIG_CONFIGFS_FS is not set
+# CONFIG_CONNECTOR is not set
+CONFIG_CONSOLE_LOGLEVEL_DEFAULT=7
+CONFIG_CONSOLE_LOGLEVEL_QUIET=4
+CONFIG_CONSTRUCTORS=y
+# CONFIG_CONTEXT_SWITCH_TRACER is not set
+# CONFIG_COPS is not set
+# CONFIG_CORDIC is not set
+# CONFIG_COREDUMP is not set
+# CONFIG_CORESIGHT is not set
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+# CONFIG_CORTINA_PHY is not set
+# CONFIG_COUNTER is not set
+# CONFIG_CPA_DEBUG is not set
+# CONFIG_CPU_BIG_ENDIAN is not set
+# CONFIG_CPU_BPREDICT_DISABLE is not set
+# CONFIG_CPU_DCACHE_DISABLE is not set
+# CONFIG_CPU_FREQ is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set
+# CONFIG_CPU_FREQ_GOV_SCHEDUTIL is not set
+# CONFIG_CPU_FREQ_STAT_DETAILS is not set
+# CONFIG_CPU_FREQ_THERMAL is not set
+# CONFIG_CPU_HOTPLUG_STATE_CONTROL is not set
+# CONFIG_CPU_IBPB_ENTRY is not set
+# CONFIG_CPU_IBRS_ENTRY is not set
+# CONFIG_CPU_ICACHE_DISABLE is not set
+# CONFIG_CPU_ICACHE_MISMATCH_WORKAROUND is not set
+# CONFIG_CPU_IDLE is not set
+# CONFIG_CPU_IDLE_GOV_LADDER is not set
+# CONFIG_CPU_IDLE_GOV_MENU is not set
+# CONFIG_CPU_IDLE_GOV_TEO is not set
+# CONFIG_CPU_IDLE_MULTIPLE_DRIVERS is not set
+# CONFIG_CPU_ISOLATION is not set
+# CONFIG_CPU_LITTLE_ENDIAN is not set
+# CONFIG_CPU_NO_EFFICIENT_FFS is not set
+CONFIG_CPU_SW_DOMAIN_PAN=y
+# CONFIG_CPU_THERMAL is not set
+# CONFIG_CRAMFS is not set
+CONFIG_CRAMFS_BLOCKDEV=y
+# CONFIG_CRAMFS_MTD is not set
+# CONFIG_CRASH_DUMP is not set
+# CONFIG_CRASH_HOTPLUG is not set
+# CONFIG_CRC16 is not set
+CONFIG_CRC32=y
+# CONFIG_CRC32_BIT is not set
+CONFIG_CRC32_SARWATE=y
+# CONFIG_CRC32_SELFTEST is not set
+# CONFIG_CRC32_SLICEBY4 is not set
+# CONFIG_CRC32_SLICEBY8 is not set
+# CONFIG_CRC4 is not set
+# CONFIG_CRC64 is not set
+# CONFIG_CRC64_ROCKSOFT is not set
+# CONFIG_CRC7 is not set
+# CONFIG_CRC8 is not set
+# CONFIG_CRC_CCITT is not set
+# CONFIG_CRC_ITU_T is not set
+# CONFIG_CRC_T10DIF is not set
+CONFIG_CROSS_COMPILE=""
+# CONFIG_CROSS_MEMORY_ATTACH is not set
+CONFIG_CRYPTO=y
+# CONFIG_CRYPTO_842 is not set
+CONFIG_CRYPTO_ACOMP2=y
+# CONFIG_CRYPTO_ADIANTUM is not set
+CONFIG_CRYPTO_AEAD=y
+CONFIG_CRYPTO_AEAD2=y
+# CONFIG_CRYPTO_AEGIS128 is not set
+# CONFIG_CRYPTO_AEGIS128L is not set
+# CONFIG_CRYPTO_AEGIS128L_AESNI_SSE2 is not set
+# CONFIG_CRYPTO_AEGIS128_AESNI_SSE2 is not set
+# CONFIG_CRYPTO_AEGIS256 is not set
+# CONFIG_CRYPTO_AEGIS256_AESNI_SSE2 is not set
+CONFIG_CRYPTO_AES=y
+# CONFIG_CRYPTO_AES_586 is not set
+# CONFIG_CRYPTO_AES_ARM is not set
+# CONFIG_CRYPTO_AES_ARM64 is not set
+# CONFIG_CRYPTO_AES_ARM64_BS is not set
+# CONFIG_CRYPTO_AES_ARM64_CE is not set
+# CONFIG_CRYPTO_AES_ARM64_CE_BLK is not set
+# CONFIG_CRYPTO_AES_ARM64_CE_CCM is not set
+# CONFIG_CRYPTO_AES_ARM64_NEON_BLK is not set
+# CONFIG_CRYPTO_AES_ARM_BS is not set
+# CONFIG_CRYPTO_AES_ARM_CE is not set
+# CONFIG_CRYPTO_AES_NI_INTEL is not set
+# CONFIG_CRYPTO_AES_TI is not set
+CONFIG_CRYPTO_AKCIPHER=y
+CONFIG_CRYPTO_AKCIPHER2=y
+CONFIG_CRYPTO_ALGAPI=y
+CONFIG_CRYPTO_ALGAPI2=y
+# CONFIG_CRYPTO_ANSI_CPRNG is not set
+# CONFIG_CRYPTO_ANUBIS is not set
+# CONFIG_CRYPTO_ARC4 is not set
+# CONFIG_CRYPTO_ARIA is not set
+# CONFIG_CRYPTO_ARIA_AESNI_AVX_X86_64 is not set
+# CONFIG_CRYPTO_AUTHENC is not set
+# CONFIG_CRYPTO_BLAKE2B is not set
+# CONFIG_CRYPTO_BLAKE2B_NEON is not set
+# CONFIG_CRYPTO_BLAKE2S is not set
+# CONFIG_CRYPTO_BLAKE2S_ARM is not set
+# CONFIG_CRYPTO_BLAKE2S_X86 is not set
+# CONFIG_CRYPTO_BLOWFISH is not set
+# CONFIG_CRYPTO_CAMELLIA is not set
+# CONFIG_CRYPTO_CAST5 is not set
+# CONFIG_CRYPTO_CAST6 is not set
+# CONFIG_CRYPTO_CBC is not set
+CONFIG_CRYPTO_CCM=y
+# CONFIG_CRYPTO_CFB is not set
+# CONFIG_CRYPTO_CHACHA20 is not set
+# CONFIG_CRYPTO_CHACHA20POLY1305 is not set
+# CONFIG_CRYPTO_CHACHA20_NEON is not set
+# CONFIG_CRYPTO_CHACHA20_X86_64 is not set
+# CONFIG_CRYPTO_CHACHA_MIPS is not set
+# CONFIG_CRYPTO_CMAC is not set
+# CONFIG_CRYPTO_CRC32 is not set
+# CONFIG_CRYPTO_CRC32C is not set
+# CONFIG_CRYPTO_CRC32C_INTEL is not set
+# CONFIG_CRYPTO_CRC32_ARM_CE is not set
+# CONFIG_CRYPTO_CRCT10DIF is not set
+# CONFIG_CRYPTO_CRCT10DIF_ARM64_CE is not set
+# CONFIG_CRYPTO_CRCT10DIF_ARM_CE is not set
+# CONFIG_CRYPTO_CRYPTD is not set
+CONFIG_CRYPTO_CTR=y
+# CONFIG_CRYPTO_CTS is not set
+# CONFIG_CRYPTO_CURVE25519 is not set
+# CONFIG_CRYPTO_CURVE25519_NEON is not set
+# CONFIG_CRYPTO_CURVE25519_X86 is not set
+# CONFIG_CRYPTO_DEFLATE is not set
+# CONFIG_CRYPTO_DES is not set
+# CONFIG_CRYPTO_DEV_AMLOGIC_GXL is not set
+# CONFIG_CRYPTO_DEV_ATMEL_AES is not set
+# CONFIG_CRYPTO_DEV_ATMEL_AUTHENC is not set
+# CONFIG_CRYPTO_DEV_ATMEL_ECC is not set
+# CONFIG_CRYPTO_DEV_ATMEL_SHA is not set
+# CONFIG_CRYPTO_DEV_ATMEL_SHA204A is not set
+# CONFIG_CRYPTO_DEV_ATMEL_TDES is not set
+# CONFIG_CRYPTO_DEV_CAVIUM_ZIP is not set
+# CONFIG_CRYPTO_DEV_CCP is not set
+# CONFIG_CRYPTO_DEV_CCP_DEBUGFS is not set
+# CONFIG_CRYPTO_DEV_CCREE is not set
+# CONFIG_CRYPTO_DEV_FSL_CAAM is not set
+# CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API_DESC is not set
+# CONFIG_CRYPTO_DEV_HIFN_795X is not set
+# CONFIG_CRYPTO_DEV_HISI_SEC is not set
+# CONFIG_CRYPTO_DEV_HISI_ZIP is not set
+# CONFIG_CRYPTO_DEV_IMGTEC_HASH is not set
+# CONFIG_CRYPTO_DEV_MARVELL_CESA is not set
+# CONFIG_CRYPTO_DEV_MEDIATEK is not set
+# CONFIG_CRYPTO_DEV_MV_CESA is not set
+# CONFIG_CRYPTO_DEV_MXC_SCC is not set
+# CONFIG_CRYPTO_DEV_MXS_DCP is not set
+# CONFIG_CRYPTO_DEV_NITROX_CNN55XX is not set
+# CONFIG_CRYPTO_DEV_OCTEONTX_CPT is not set
+# CONFIG_CRYPTO_DEV_QAT_4XXX is not set
+# CONFIG_CRYPTO_DEV_QAT_C3XXX is not set
+# CONFIG_CRYPTO_DEV_QAT_C3XXXVF is not set
+# CONFIG_CRYPTO_DEV_QAT_C62X is not set
+# CONFIG_CRYPTO_DEV_QAT_C62XVF is not set
+# CONFIG_CRYPTO_DEV_QAT_DH895xCC is not set
+# CONFIG_CRYPTO_DEV_QAT_DH895xCCVF is not set
+# CONFIG_CRYPTO_DEV_QCE is not set
+# CONFIG_CRYPTO_DEV_S5P is not set
+# CONFIG_CRYPTO_DEV_SAFEXCEL is not set
+# CONFIG_CRYPTO_DEV_SAHARA is not set
+# CONFIG_CRYPTO_DEV_SP_PSP is not set
+# CONFIG_CRYPTO_DEV_TALITOS is not set
+# CONFIG_CRYPTO_DEV_VIRTIO is not set
+# CONFIG_CRYPTO_DH is not set
+# CONFIG_CRYPTO_DRBG_CTR is not set
+# CONFIG_CRYPTO_DRBG_HASH is not set
+# CONFIG_CRYPTO_DRBG_MENU is not set
+# CONFIG_CRYPTO_ECB is not set
+# CONFIG_CRYPTO_ECDH is not set
+# CONFIG_CRYPTO_ECDSA is not set
+# CONFIG_CRYPTO_ECHAINIV is not set
+# CONFIG_CRYPTO_ECRDSA is not set
+# CONFIG_CRYPTO_ESSIV is not set
+# CONFIG_CRYPTO_FCRYPT is not set
+# CONFIG_CRYPTO_FIPS is not set
+CONFIG_CRYPTO_GCM=y
+CONFIG_CRYPTO_GF128MUL=y
+CONFIG_CRYPTO_GHASH=y
+# CONFIG_CRYPTO_GHASH_ARM64_CE is not set
+# CONFIG_CRYPTO_GHASH_ARM_CE is not set
+# CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL is not set
+CONFIG_CRYPTO_HASH=y
+CONFIG_CRYPTO_HASH2=y
+# CONFIG_CRYPTO_HCTR2 is not set
+# CONFIG_CRYPTO_HMAC is not set
+# CONFIG_CRYPTO_HW is not set
+# CONFIG_CRYPTO_JITTERENTROPY is not set
+# CONFIG_CRYPTO_KEYWRAP is not set
+# CONFIG_CRYPTO_KHAZAD is not set
+CONFIG_CRYPTO_KPP=y
+CONFIG_CRYPTO_KPP2=y
+CONFIG_CRYPTO_LIB_AES=y
+CONFIG_CRYPTO_LIB_ARC4=y
+# CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC is not set
+# CONFIG_CRYPTO_LIB_CHACHA is not set
+# CONFIG_CRYPTO_LIB_CHACHA20POLY1305 is not set
+# CONFIG_CRYPTO_LIB_CURVE25519 is not set
+# CONFIG_CRYPTO_LIB_POLY1305 is not set
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=9
+# CONFIG_CRYPTO_LRW is not set
+# CONFIG_CRYPTO_LZ4 is not set
+# CONFIG_CRYPTO_LZ4HC is not set
+# CONFIG_CRYPTO_LZO is not set
+CONFIG_CRYPTO_MANAGER=y
+CONFIG_CRYPTO_MANAGER2=y
+CONFIG_CRYPTO_MANAGER_DISABLE_TESTS=y
+# CONFIG_CRYPTO_MCRYPTD is not set
+# CONFIG_CRYPTO_MD4 is not set
+# CONFIG_CRYPTO_MD5 is not set
+# CONFIG_CRYPTO_MICHAEL_MIC is not set
+# CONFIG_CRYPTO_MORUS1280 is not set
+# CONFIG_CRYPTO_MORUS1280_AVX2 is not set
+# CONFIG_CRYPTO_MORUS1280_SSE2 is not set
+# CONFIG_CRYPTO_MORUS640 is not set
+# CONFIG_CRYPTO_MORUS640_SSE2 is not set
+# CONFIG_CRYPTO_NHPOLY1305_NEON is not set
+CONFIG_CRYPTO_NULL=y
+CONFIG_CRYPTO_NULL2=y
+# CONFIG_CRYPTO_OFB is not set
+# CONFIG_CRYPTO_PCBC is not set
+# CONFIG_CRYPTO_PCOMP is not set
+# CONFIG_CRYPTO_PCOMP2 is not set
+CONFIG_CRYPTO_PCRYPT=y
+# CONFIG_CRYPTO_POLY1305 is not set
+# CONFIG_CRYPTO_POLY1305_ARM is not set
+# CONFIG_CRYPTO_POLY1305_MIPS is not set
+# CONFIG_CRYPTO_POLY1305_NEON is not set
+# CONFIG_CRYPTO_POLY1305_X86_64 is not set
+# CONFIG_CRYPTO_POLYVAL_ARM64_CE is not set
+# CONFIG_CRYPTO_POLYVAL_CLMUL_NI is not set
+# CONFIG_CRYPTO_RMD160 is not set
+# CONFIG_CRYPTO_RNG is not set
+# CONFIG_CRYPTO_RSA is not set
+# CONFIG_CRYPTO_SEED is not set
+# CONFIG_CRYPTO_SEQIV is not set
+# CONFIG_CRYPTO_SERPENT is not set
+# CONFIG_CRYPTO_SHA1 is not set
+# CONFIG_CRYPTO_SHA1_ARM is not set
+# CONFIG_CRYPTO_SHA1_ARM64_CE is not set
+# CONFIG_CRYPTO_SHA1_ARM_CE is not set
+# CONFIG_CRYPTO_SHA1_ARM_NEON is not set
+# CONFIG_CRYPTO_SHA256 is not set
+# CONFIG_CRYPTO_SHA256_ARM is not set
+# CONFIG_CRYPTO_SHA256_ARM64 is not set
+# CONFIG_CRYPTO_SHA2_ARM64_CE is not set
+# CONFIG_CRYPTO_SHA2_ARM_CE is not set
+# CONFIG_CRYPTO_SHA3 is not set
+# CONFIG_CRYPTO_SHA3_ARM64 is not set
+# CONFIG_CRYPTO_SHA512 is not set
+# CONFIG_CRYPTO_SHA512_ARM is not set
+# CONFIG_CRYPTO_SHA512_ARM64 is not set
+# CONFIG_CRYPTO_SHA512_ARM64_CE is not set
+# CONFIG_CRYPTO_SIMD is not set
+CONFIG_CRYPTO_SKCIPHER=y
+CONFIG_CRYPTO_SKCIPHER2=y
+# CONFIG_CRYPTO_SM2 is not set
+# CONFIG_CRYPTO_SM3 is not set
+# CONFIG_CRYPTO_SM3_ARM64_CE is not set
+# CONFIG_CRYPTO_SM3_GENERIC is not set
+# CONFIG_CRYPTO_SM3_NEON is not set
+# CONFIG_CRYPTO_SM4 is not set
+# CONFIG_CRYPTO_SM4_ARM64_CE is not set
+# CONFIG_CRYPTO_SM4_ARM64_CE_BLK is not set
+# CONFIG_CRYPTO_SM4_ARM64_NEON_BLK is not set
+# CONFIG_CRYPTO_SM4_GENERIC is not set
+# CONFIG_CRYPTO_SPECK is not set
+# CONFIG_CRYPTO_STATS is not set
+# CONFIG_CRYPTO_STREEBOG is not set
+# CONFIG_CRYPTO_TEA is not set
+# CONFIG_CRYPTO_TEST is not set
+# CONFIG_CRYPTO_TWOFISH is not set
+# CONFIG_CRYPTO_TWOFISH_586 is not set
+# CONFIG_CRYPTO_TWOFISH_COMMON is not set
+# CONFIG_CRYPTO_USER is not set
+# CONFIG_CRYPTO_USER_API_AEAD is not set
+# CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE is not set
+# CONFIG_CRYPTO_USER_API_HASH is not set
+# CONFIG_CRYPTO_USER_API_RNG is not set
+# CONFIG_CRYPTO_USER_API_RNG_CAVP is not set
+# CONFIG_CRYPTO_USER_API_SKCIPHER is not set
+# CONFIG_CRYPTO_VMAC is not set
+# CONFIG_CRYPTO_WP512 is not set
+# CONFIG_CRYPTO_XCBC is not set
+# CONFIG_CRYPTO_XTS is not set
+# CONFIG_CRYPTO_XXHASH is not set
+# CONFIG_CRYPTO_ZLIB is not set
+# CONFIG_CRYPTO_ZSTD is not set
+# CONFIG_CS5535_MFGPT is not set
+# CONFIG_CS89x0 is not set
+# CONFIG_CS89x0_PLATFORM is not set
+# CONFIG_CSD_LOCK_WAIT_DEBUG is not set
+# CONFIG_CUSE is not set
+# CONFIG_CW1200 is not set
+# CONFIG_CXD2880_SPI_DRV is not set
+# CONFIG_CXL_AFU_DRIVER_OPS is not set
+# CONFIG_CXL_BASE is not set
+# CONFIG_CXL_BUS is not set
+# CONFIG_CXL_EEH is not set
+# CONFIG_CXL_KERNEL_API is not set
+# CONFIG_CXL_LIB is not set
+# CONFIG_CYPRESS_FIRMWARE is not set
+# CONFIG_DA280 is not set
+# CONFIG_DA311 is not set
+# CONFIG_DAMON is not set
+# CONFIG_DAVICOM_PHY is not set
+# CONFIG_DAX is not set
+# CONFIG_DCB is not set
+# CONFIG_DDR is not set
+# CONFIG_DEBUG_ALIGN_RODATA is not set
+# CONFIG_DEBUG_ATOMIC_SLEEP is not set
+# CONFIG_DEBUG_BLOCK_EXT_DEVT is not set
+# CONFIG_DEBUG_BUGVERBOSE is not set
+# CONFIG_DEBUG_CREDENTIALS is not set
+# CONFIG_DEBUG_DEVRES is not set
+# CONFIG_DEBUG_DRIVER is not set
+# CONFIG_DEBUG_EFI is not set
+# CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_32B is not set
+# CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B is not set
+# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set
+CONFIG_DEBUG_FS=y
+CONFIG_DEBUG_FS_ALLOW_ALL=y
+# CONFIG_DEBUG_FS_ALLOW_NONE is not set
+# CONFIG_DEBUG_FS_DISALLOW_MOUNT is not set
+# CONFIG_DEBUG_GPIO is not set
+# CONFIG_DEBUG_HIGHMEM is not set
+# CONFIG_DEBUG_ICEDCC is not set
+# CONFIG_DEBUG_INFO is not set
+# CONFIG_DEBUG_INFO_BTF is not set
+# CONFIG_DEBUG_INFO_COMPRESSED is not set
+# CONFIG_DEBUG_INFO_DWARF4 is not set
+# CONFIG_DEBUG_INFO_DWARF5 is not set
+CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
+# CONFIG_DEBUG_INFO_NONE is not set
+# CONFIG_DEBUG_INFO_REDUCED is not set
+# CONFIG_DEBUG_INFO_SPLIT is not set
+# CONFIG_DEBUG_IRQFLAGS is not set
+CONFIG_DEBUG_KERNEL=y
+# CONFIG_DEBUG_KMAP_LOCAL is not set
+# CONFIG_DEBUG_KMEMLEAK is not set
+# CONFIG_DEBUG_KOBJECT is not set
+# CONFIG_DEBUG_KOBJECT_RELEASE is not set
+# CONFIG_DEBUG_LIST is not set
+# CONFIG_DEBUG_LL is not set
+# CONFIG_DEBUG_LL_UART_8250 is not set
+# CONFIG_DEBUG_LL_UART_PL01X is not set
+# CONFIG_DEBUG_LOCKDEP is not set
+# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
+# CONFIG_DEBUG_LOCK_ALLOC is not set
+# CONFIG_DEBUG_MAPLE_TREE is not set
+# CONFIG_DEBUG_MEMORY_INIT is not set
+# CONFIG_DEBUG_MISC is not set
+# CONFIG_DEBUG_MUTEXES is not set
+# CONFIG_DEBUG_NET is not set
+# CONFIG_DEBUG_NOTIFIERS is not set
+# CONFIG_DEBUG_NX_TEST is not set
+# CONFIG_DEBUG_OBJECTS is not set
+# CONFIG_DEBUG_PAGEALLOC is not set
+# CONFIG_DEBUG_PAGE_REF is not set
+# CONFIG_DEBUG_PERF_USE_VMALLOC is not set
+# CONFIG_DEBUG_PER_CPU_MAPS is not set
+# CONFIG_DEBUG_PINCTRL is not set
+# CONFIG_DEBUG_PI_LIST is not set
+# CONFIG_DEBUG_PLIST is not set
+# CONFIG_DEBUG_PREEMPT is not set
+# CONFIG_DEBUG_RODATA_TEST is not set
+# CONFIG_DEBUG_RSEQ is not set
+# CONFIG_DEBUG_RT_MUTEXES is not set
+# CONFIG_DEBUG_RWSEMS is not set
+# CONFIG_DEBUG_SECTION_MISMATCH is not set
+# CONFIG_DEBUG_SEMIHOSTING is not set
+# CONFIG_DEBUG_SG is not set
+# CONFIG_DEBUG_SHIRQ is not set
+# CONFIG_DEBUG_SLAB is not set
+# CONFIG_DEBUG_SPINLOCK is not set
+# CONFIG_DEBUG_STACKOVERFLOW is not set
+# CONFIG_DEBUG_STACK_USAGE is not set
+# CONFIG_DEBUG_STRICT_USER_COPY_CHECKS is not set
+# CONFIG_DEBUG_TEST_DRIVER_REMOVE is not set
+# CONFIG_DEBUG_TIMEKEEPING is not set
+# CONFIG_DEBUG_UART_8250_PALMCHIP is not set
+# CONFIG_DEBUG_UART_8250_WORD is not set
+# CONFIG_DEBUG_UART_BCM63XX is not set
+# CONFIG_DEBUG_UART_FLOW_CONTROL is not set
+# CONFIG_DEBUG_USER is not set
+# CONFIG_DEBUG_VIRTUAL is not set
+# CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_VM_PGFLAGS is not set
+# CONFIG_DEBUG_VM_PGTABLE is not set
+# CONFIG_DEBUG_VM_RB is not set
+# CONFIG_DEBUG_VM_VMACACHE is not set
+# CONFIG_DEBUG_WQ_FORCE_RR_CPU is not set
+# CONFIG_DEBUG_WW_MUTEX_SLOWPATH is not set
+# CONFIG_DEBUG_WX is not set
+# CONFIG_DEBUG_ZBOOT is not set
+# CONFIG_DECNET is not set
+# CONFIG_DEFAULT_CODEL is not set
+# CONFIG_DEFAULT_BBR is not set
+# CONFIG_DEFAULT_BBR1 is not set
+# CONFIG_DEFAULT_BBR2 is not set
+# CONFIG_DEFAULT_BIC is not set
+# CONFIG_DEFAULT_HTCP is not set
+# CONFIG_DEFAULT_HYBLA is not set
+# CONFIG_DEFAULT_VEGAS is not set
+# CONFIG_DEFAULT_VENO is not set
+# CONFIG_DEFAULT_WESTWOOD is not set
+# CONFIG_DEFAULT_DCTCP is not set
+# CONFIG_DEFAULT_CDG is not set
+CONFIG_DEFAULT_CUBIC=y
+CONFIG_DEFAULT_DEADLINE=y
+# CONFIG_DEFAULT_FQ is not set
+CONFIG_DEFAULT_FQ_CODEL=y
+# CONFIG_DEFAULT_FQ_PIE is not set
+CONFIG_DEFAULT_HOSTNAME="(none)"
+CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120
+CONFIG_DEFAULT_INIT=""
+CONFIG_DEFAULT_MMAP_MIN_ADDR=4096
+CONFIG_DEFAULT_NET_SCH="fq_codel"
+# CONFIG_DEFAULT_NOOP is not set
+# CONFIG_DEFAULT_PFIFO_FAST is not set
+# CONFIG_DEFAULT_RENO is not set
+CONFIG_DEFAULT_SECURITY=""
+CONFIG_DEFAULT_SECURITY_DAC=y
+# CONFIG_DEFAULT_SECURITY_SELINUX is not set
+# CONFIG_DEFAULT_SFQ is not set
+CONFIG_DEFAULT_TCP_CONG="cubic"
+CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
+# CONFIG_DEFERRED_STRUCT_PAGE_INIT is not set
+# CONFIG_DELL_LAPTOP is not set
+# CONFIG_DELL_RBTN is not set
+# CONFIG_DELL_SMBIOS is not set
+# CONFIG_DELL_SMO8800 is not set
+# CONFIG_DEPRECATED_PARAM_STRUCT is not set
+# CONFIG_DETECT_HUNG_TASK is not set
+# CONFIG_DEVKMEM is not set
+# CONFIG_DEVMEM is not set
+CONFIG_DEVPORT=y
+# CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
+# CONFIG_DEVTMPFS is not set
+# CONFIG_DEVTMPFS_MOUNT is not set
+# CONFIG_DEVTMPFS_SAFE is not set
+# CONFIG_DEV_DAX is not set
+# CONFIG_DGAP is not set
+# CONFIG_DGNC is not set
+# CONFIG_DHT11 is not set
+# CONFIG_DISCONTIGMEM_MANUAL is not set
+# CONFIG_DISPLAY_CONNECTOR_ANALOG_TV is not set
+# CONFIG_DISPLAY_CONNECTOR_DVI is not set
+# CONFIG_DISPLAY_CONNECTOR_HDMI is not set
+# CONFIG_DISPLAY_ENCODER_TFP410 is not set
+# CONFIG_DISPLAY_ENCODER_TPD12S015 is not set
+# CONFIG_DISPLAY_PANEL_DPI is not set
+# CONFIG_DISPLAY_PANEL_LGPHILIPS_LB035Q02 is not set
+# CONFIG_DISPLAY_PANEL_TPO_TD028TTEC1 is not set
+# CONFIG_DISPLAY_PANEL_TPO_TD043MTEA1 is not set
+# CONFIG_DL2K is not set
+# CONFIG_DLHL60D is not set
+# CONFIG_DLM is not set
+# CONFIG_DM9000 is not set
+# CONFIG_DM9051 is not set
+# CONFIG_DMABUF_DEBUG is not set
+# CONFIG_DMABUF_HEAPS is not set
+# CONFIG_DMABUF_MOVE_NOTIFY is not set
+# CONFIG_DMABUF_SELFTESTS is not set
+# CONFIG_DMABUF_SYSFS_STATS is not set
+# CONFIG_DMADEVICES is not set
+# CONFIG_DMADEVICES_DEBUG is not set
+# CONFIG_DMARD06 is not set
+# CONFIG_DMARD09 is not set
+# CONFIG_DMARD10 is not set
+# CONFIG_DMASCC is not set
+# CONFIG_DMATEST is not set
+# CONFIG_DMA_API_DEBUG is not set
+CONFIG_DMA_COHERENT_POOL=y
+CONFIG_DMA_DECLARE_COHERENT=y
+# CONFIG_DMA_ENGINE is not set
+# CONFIG_DMA_FENCE_TRACE is not set
+# CONFIG_DMA_JZ4780 is not set
+# CONFIG_DMA_MAP_BENCHMARK is not set
+CONFIG_DMA_NONCOHERENT_MMAP=y
+# CONFIG_DMA_NOOP_OPS is not set
+# CONFIG_DMA_PERNUMA_CMA is not set
+# CONFIG_DMAPOOL_TEST is not set
+# CONFIG_DMA_RESTRICTED_POOL is not set
+# CONFIG_DMA_SHARED_BUFFER is not set
+# CONFIG_DMA_VIRT_OPS is not set
+# CONFIG_DM_CACHE is not set
+# CONFIG_DM_CLONE is not set
+# CONFIG_DM_DEBUG is not set
+# CONFIG_DM_DELAY is not set
+# CONFIG_DM_DUST is not set
+# CONFIG_DM_EBS is not set
+# CONFIG_DM_ERA is not set
+# CONFIG_DM_FLAKEY is not set
+# CONFIG_DM_INTEGRITY is not set
+# CONFIG_DM_LOG_USERSPACE is not set
+# CONFIG_DM_LOG_WRITES is not set
+# CONFIG_DM_MQ_DEFAULT is not set
+# CONFIG_DM_MULTIPATH is not set
+# CONFIG_DM_RAID is not set
+# CONFIG_DM_SWITCH is not set
+# CONFIG_DM_THIN_PROVISIONING is not set
+# CONFIG_DM_UEVENT is not set
+# CONFIG_DM_UNSTRIPED is not set
+# CONFIG_DM_VERITY is not set
+# CONFIG_DM_WRITECACHE is not set
+# CONFIG_DM_ZERO is not set
+# CONFIG_DNET is not set
+# CONFIG_DNOTIFY is not set
+# CONFIG_DNS_RESOLVER is not set
+CONFIG_DOUBLEFAULT=y
+# CONFIG_DP83640_PHY is not set
+# CONFIG_DP83822_PHY is not set
+# CONFIG_DP83848_PHY is not set
+# CONFIG_DP83867_PHY is not set
+# CONFIG_DP83869_PHY is not set
+# CONFIG_DP83TC811_PHY is not set
+# CONFIG_DP83TD510_PHY is not set
+# CONFIG_DPOT_DAC is not set
+# CONFIG_DPS310 is not set
+CONFIG_DQL=y
+# CONFIG_DRAGONRISE_FF is not set
+# CONFIG_DRM is not set
+# CONFIG_DRM_AMDGPU is not set
+# CONFIG_DRM_AMDGPU_CIK is not set
+# CONFIG_DRM_AMDGPU_GART_DEBUGFS is not set
+# CONFIG_DRM_AMDGPU_SI is not set
+# CONFIG_DRM_AMDGPU_USERPTR is not set
+# CONFIG_DRM_AMD_ACP is not set
+# CONFIG_DRM_AMD_DC_DCN2_0 is not set
+# CONFIG_DRM_AMD_DC_DCN3_0 is not set
+# CONFIG_DRM_AMD_DC_HDCP is not set
+# CONFIG_DRM_AMD_DC_SI is not set
+# CONFIG_DRM_AMD_SECURE_DISPLAY is not set
+# CONFIG_DRM_ANALOGIX_ANX6345 is not set
+# CONFIG_DRM_ANALOGIX_ANX7625 is not set
+# CONFIG_DRM_ANALOGIX_ANX78XX is not set
+# CONFIG_DRM_ARCPGU is not set
+# CONFIG_DRM_ARMADA is not set
+# CONFIG_DRM_AST is not set
+# CONFIG_DRM_ATMEL_HLCDC is not set
+# CONFIG_DRM_BOCHS is not set
+# CONFIG_DRM_CDNS_DSI is not set
+# CONFIG_DRM_CDNS_MHDP8546 is not set
+# CONFIG_DRM_CHIPONE_ICN6211 is not set
+# CONFIG_DRM_CHRONTEL_CH7033 is not set
+# CONFIG_DRM_CIRRUS_QEMU is not set
+# CONFIG_DRM_DEBUG_DP_MST_TOPOLOGY_REFS is not set
+# CONFIG_DRM_DEBUG_MM is not set
+# CONFIG_DRM_DEBUG_MODESET_LOCK is not set
+# CONFIG_DRM_DEBUG_SELFTEST is not set
+# CONFIG_DRM_DISPLAY_CONNECTOR is not set
+# CONFIG_DRM_DP_AUX_CHARDEV is not set
+# CONFIG_DRM_DP_CEC is not set
+# CONFIG_DRM_DUMB_VGA_DAC is not set
+# CONFIG_DRM_DW_HDMI_CEC is not set
+# CONFIG_DRM_ETNAVIV is not set
+# CONFIG_DRM_EXYNOS is not set
+# CONFIG_DRM_FBDEV_EMULATION is not set
+# CONFIG_DRM_FBDEV_LEAK_PHYS_SMEM is not set
+# CONFIG_DRM_FSL_DCU is not set
+# CONFIG_DRM_GM12U320 is not set
+# CONFIG_DRM_GMA500 is not set
+# CONFIG_DRM_GUD is not set
+# CONFIG_DRM_HDLCD is not set
+# CONFIG_DRM_HISI_HIBMC is not set
+# CONFIG_DRM_HISI_KIRIN is not set
+# CONFIG_DRM_I2C_ADV7511 is not set
+# CONFIG_DRM_I2C_CH7006 is not set
+# CONFIG_DRM_I2C_NXP_TDA9950 is not set
+# CONFIG_DRM_I2C_NXP_TDA998X is not set
+# CONFIG_DRM_I2C_SIL164 is not set
+# CONFIG_DRM_I915 is not set
+CONFIG_DRM_I915_REQUEST_TIMEOUT=20000
+# CONFIG_DRM_IMX_LCDIF is not set
+# CONFIG_DRM_ITE_IT6505 is not set
+# CONFIG_DRM_ITE_IT66121 is not set
+# CONFIG_DRM_KOMEDA is not set
+# CONFIG_DRM_LEGACY is not set
+# CONFIG_DRM_LIB_RANDOM is not set
+# CONFIG_DRM_LIMA is not set
+# CONFIG_DRM_LOAD_EDID_FIRMWARE is not set
+# CONFIG_DRM_LOGICVC is not set
+# CONFIG_DRM_LONTIUM_LT8912B is not set
+# CONFIG_DRM_LONTIUM_LT9211 is not set
+# CONFIG_DRM_LONTIUM_LT9611 is not set
+# CONFIG_DRM_LONTIUM_LT9611UXC is not set
+# CONFIG_DRM_LVDS_CODEC is not set
+# CONFIG_DRM_LVDS_ENCODER is not set
+# CONFIG_DRM_MALI_DISPLAY is not set
+# CONFIG_DRM_MCDE is not set
+# CONFIG_DRM_MEGACHIPS_STDPXXXX_GE_B850V3_FW is not set
+# CONFIG_DRM_MGAG200 is not set
+# CONFIG_DRM_MXSFB is not set
+# CONFIG_DRM_NOUVEAU is not set
+# CONFIG_DRM_NWL_MIPI_DSI is not set
+# CONFIG_DRM_NXP_PTN3460 is not set
+# CONFIG_DRM_OMAP is not set
+# CONFIG_DRM_PANEL_ABT_Y030XX067A is not set
+# CONFIG_DRM_PANEL_ARM_VERSATILE is not set
+# CONFIG_DRM_PANEL_ASUS_Z00T_TM5P5_NT35596 is not set
+# CONFIG_DRM_PANEL_BOE_BF060Y8M_AJ0 is not set
+# CONFIG_DRM_PANEL_BOE_HIMAX8279D is not set
+# CONFIG_DRM_PANEL_BOE_TV101WUM_NL6 is not set
+# CONFIG_DRM_PANEL_DSI_CM is not set
+# CONFIG_DRM_PANEL_EBBG_FT8719 is not set
+# CONFIG_DRM_PANEL_EDP is not set
+# CONFIG_DRM_PANEL_ELIDA_KD35T133 is not set
+# CONFIG_DRM_PANEL_FEIXIN_K101_IM2BA02 is not set
+# CONFIG_DRM_PANEL_FEIYANG_FY07024DI26A30D is not set
+# CONFIG_DRM_PANEL_ILITEK_IL9322 is not set
+# CONFIG_DRM_PANEL_ILITEK_ILI9341 is not set
+# CONFIG_DRM_PANEL_ILITEK_ILI9806E is not set
+# CONFIG_DRM_PANEL_ILITEK_ILI9881C is not set
+# CONFIG_DRM_PANEL_INNOLUX_EJ030NA is not set
+# CONFIG_DRM_PANEL_INNOLUX_P079ZCA is not set
+# CONFIG_DRM_PANEL_JDI_LT070ME05000 is not set
+# CONFIG_DRM_PANEL_JDI_R63452 is not set
+# CONFIG_DRM_PANEL_KHADAS_TS050 is not set
+# CONFIG_DRM_PANEL_KINGDISPLAY_KD097D04 is not set
+# CONFIG_DRM_PANEL_LEADTEK_LTK050H3146W is not set
+# CONFIG_DRM_PANEL_LEADTEK_LTK500HD1829 is not set
+# CONFIG_DRM_PANEL_LG_LB035Q02 is not set
+# CONFIG_DRM_PANEL_LG_LG4573 is not set
+# CONFIG_DRM_PANEL_LVDS is not set
+# CONFIG_DRM_PANEL_MANTIX_MLAF057WE51 is not set
+# CONFIG_DRM_PANEL_MIPI_DBI is not set
+# CONFIG_DRM_PANEL_NEC_NL8048HL11 is not set
+# CONFIG_DRM_PANEL_NEWVISION_NV3052C is not set
+# CONFIG_DRM_PANEL_NOVATEK_NT35510 is not set
+# CONFIG_DRM_PANEL_NOVATEK_NT35560 is not set
+# CONFIG_DRM_PANEL_NOVATEK_NT35950 is not set
+# CONFIG_DRM_PANEL_NOVATEK_NT36672A is not set
+# CONFIG_DRM_PANEL_NOVATEK_NT39016 is not set
+# CONFIG_DRM_PANEL_OLIMEX_LCD_OLINUXINO is not set
+# CONFIG_DRM_PANEL_ORISETECH_OTM8009A is not set
+# CONFIG_DRM_PANEL_OSD_OSD101T2587_53TS is not set
+# CONFIG_DRM_PANEL_PANASONIC_VVX10F034N00 is not set
+# CONFIG_DRM_PANEL_RASPBERRYPI_TOUCHSCREEN is not set
+# CONFIG_DRM_PANEL_RAYDIUM_RM67191 is not set
+# CONFIG_DRM_PANEL_RAYDIUM_RM68200 is not set
+# CONFIG_DRM_PANEL_ROCKTECH_JH057N00900 is not set
+# CONFIG_DRM_PANEL_RONBO_RB070D30 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_ATNA33XC20 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_DB7430 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_LD9040 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_S6D16D0 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_S6D27A1 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_S6E3HA2 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_S6E63J0X03 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_S6E63M0 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_S6E88A0_AMS452EF01 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_S6E8AA0 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_SOFEF00 is not set
+# CONFIG_DRM_PANEL_SEIKO_43WVF1G is not set
+# CONFIG_DRM_PANEL_SHARP_LQ101R1SX01 is not set
+# CONFIG_DRM_PANEL_SHARP_LS037V7DW01 is not set
+# CONFIG_DRM_PANEL_SHARP_LS043T1LE01 is not set
+# CONFIG_DRM_PANEL_SHARP_LS060T1SX01 is not set
+# CONFIG_DRM_PANEL_SIMPLE is not set
+# CONFIG_DRM_PANEL_SITRONIX_ST7701 is not set
+# CONFIG_DRM_PANEL_SITRONIX_ST7703 is not set
+# CONFIG_DRM_PANEL_SITRONIX_ST7789V is not set
+# CONFIG_DRM_PANEL_SONY_ACX424AKP is not set
+# CONFIG_DRM_PANEL_SONY_ACX565AKM is not set
+# CONFIG_DRM_PANEL_SONY_TULIP_TRULY_NT35521 is not set
+# CONFIG_DRM_PANEL_TDO_TL070WSH30 is not set
+# CONFIG_DRM_PANEL_TPO_TD028TTEC1 is not set
+# CONFIG_DRM_PANEL_TPO_TD043MTEA1 is not set
+# CONFIG_DRM_PANEL_TPO_TPG110 is not set
+# CONFIG_DRM_PANEL_TPO_Y17P is not set
+# CONFIG_DRM_PANEL_TRULY_NT35597_WQXGA is not set
+# CONFIG_DRM_PANEL_VISIONOX_RM69299 is not set
+# CONFIG_DRM_PANEL_WAVESHARE_TOUCHSCREEN is not set
+# CONFIG_DRM_PANEL_WIDECHIPS_WS2401 is not set
+# CONFIG_DRM_PANEL_XINPENG_XPP055C272 is not set
+# CONFIG_DRM_PANFROST is not set
+# CONFIG_DRM_PARADE_PS8622 is not set
+# CONFIG_DRM_PARADE_PS8640 is not set
+# CONFIG_DRM_PL111 is not set
+# CONFIG_DRM_QXL is not set
+# CONFIG_DRM_RADEON is not set
+# CONFIG_DRM_RADEON_USERPTR is not set
+# CONFIG_DRM_RCAR_DW_HDMI is not set
+# CONFIG_DRM_RCAR_LVDS is not set
+# CONFIG_DRM_RCAR_USE_LVDS is not set
+# CONFIG_DRM_RCAR_USE_MIPI_DSI is not set
+# CONFIG_DRM_ROCKCHIP is not set
+# CONFIG_DRM_SII902X is not set
+# CONFIG_DRM_SII9234 is not set
+# CONFIG_DRM_SIL_SII8620 is not set
+# CONFIG_DRM_SIMPLEDRM is not set
+# CONFIG_DRM_SIMPLE_BRIDGE is not set
+# CONFIG_DRM_SSD130X is not set
+# CONFIG_DRM_STI is not set
+# CONFIG_DRM_STM is not set
+# CONFIG_DRM_SUN4I is not set
+# CONFIG_DRM_THINE_THC63LVD1024 is not set
+# CONFIG_DRM_TIDSS is not set
+# CONFIG_DRM_TILCDC is not set
+# CONFIG_DRM_TINYDRM is not set
+# CONFIG_DRM_TI_DLPC3433 is not set
+# CONFIG_DRM_TI_SN65DSI83 is not set
+# CONFIG_DRM_TI_SN65DSI86 is not set
+# CONFIG_DRM_TI_TFP410 is not set
+# CONFIG_DRM_TI_TPD12S015 is not set
+# CONFIG_DRM_TOSHIBA_TC358762 is not set
+# CONFIG_DRM_TOSHIBA_TC358764 is not set
+# CONFIG_DRM_TOSHIBA_TC358767 is not set
+# CONFIG_DRM_TOSHIBA_TC358768 is not set
+# CONFIG_DRM_TOSHIBA_TC358775 is not set
+# CONFIG_DRM_TVE200 is not set
+# CONFIG_DRM_UDL is not set
+# CONFIG_DRM_VBOXVIDEO is not set
+# CONFIG_DRM_VC4_HDMI_CEC is not set
+# CONFIG_DRM_VGEM is not set
+# CONFIG_DRM_VIRTIO_GPU is not set
+# CONFIG_DRM_VKMS is not set
+# CONFIG_DRM_VMWGFX is not set
+# CONFIG_DRM_XEN is not set
+# CONFIG_DRM_XEN_FRONTEND is not set
+# CONFIG_DS1682 is not set
+# CONFIG_DS1803 is not set
+# CONFIG_DS4424 is not set
+# CONFIG_DST_CACHE is not set
+# CONFIG_DTLK is not set
+# CONFIG_DUMMY is not set
+CONFIG_DUMMY_CONSOLE_COLUMNS=80
+CONFIG_DUMMY_CONSOLE_ROWS=25
+# CONFIG_DUMMY_IRQ is not set
+# CONFIG_DVB_A8293 is not set
+# CONFIG_DVB_AF9013 is not set
+# CONFIG_DVB_AF9033 is not set
+# CONFIG_DVB_AS102 is not set
+# CONFIG_DVB_ASCOT2E is not set
+# CONFIG_DVB_ATBM8830 is not set
+# CONFIG_DVB_AU8522_DTV is not set
+# CONFIG_DVB_AU8522_V4L is not set
+# CONFIG_DVB_B2C2_FLEXCOP_USB is not set
+# CONFIG_DVB_BCM3510 is not set
+# CONFIG_DVB_CORE is not set
+# CONFIG_DVB_CX22700 is not set
+# CONFIG_DVB_CX22702 is not set
+# CONFIG_DVB_CX24110 is not set
+# CONFIG_DVB_CX24116 is not set
+# CONFIG_DVB_CX24117 is not set
+# CONFIG_DVB_CX24120 is not set
+# CONFIG_DVB_CX24123 is not set
+# CONFIG_DVB_CXD2099 is not set
+# CONFIG_DVB_CXD2820R is not set
+# CONFIG_DVB_CXD2841ER is not set
+# CONFIG_DVB_CXD2880 is not set
+# CONFIG_DVB_DEMUX_SECTION_LOSS_LOG is not set
+# CONFIG_DVB_DIB3000MB is not set
+# CONFIG_DVB_DIB3000MC is not set
+# CONFIG_DVB_DIB7000M is not set
+# CONFIG_DVB_DIB7000P is not set
+# CONFIG_DVB_DIB8000 is not set
+# CONFIG_DVB_DIB9000 is not set
+# CONFIG_DVB_DRX39XYJ is not set
+# CONFIG_DVB_DRXD is not set
+# CONFIG_DVB_DRXK is not set
+# CONFIG_DVB_DS3000 is not set
+# CONFIG_DVB_DUMMY_FE is not set
+# CONFIG_DVB_DYNAMIC_MINORS is not set
+# CONFIG_DVB_EC100 is not set
+# CONFIG_DVB_FIREDTV is not set
+# CONFIG_DVB_HELENE is not set
+# CONFIG_DVB_HORUS3A is not set
+# CONFIG_DVB_ISL6405 is not set
+# CONFIG_DVB_ISL6421 is not set
+# CONFIG_DVB_ISL6423 is not set
+# CONFIG_DVB_IX2505V is not set
+# CONFIG_DVB_L64781 is not set
+# CONFIG_DVB_LG2160 is not set
+# CONFIG_DVB_LGDT3305 is not set
+# CONFIG_DVB_LGDT3306A is not set
+# CONFIG_DVB_LGDT330X is not set
+# CONFIG_DVB_LGS8GL5 is not set
+# CONFIG_DVB_LGS8GXX is not set
+# CONFIG_DVB_LNBH25 is not set
+# CONFIG_DVB_LNBH29 is not set
+# CONFIG_DVB_LNBP21 is not set
+# CONFIG_DVB_LNBP22 is not set
+# CONFIG_DVB_M88DS3103 is not set
+# CONFIG_DVB_M88RS2000 is not set
+CONFIG_DVB_MAX_ADAPTERS=16
+# CONFIG_DVB_MB86A16 is not set
+# CONFIG_DVB_MB86A20S is not set
+# CONFIG_DVB_MMAP is not set
+# CONFIG_DVB_MN88443X is not set
+# CONFIG_DVB_MN88472 is not set
+# CONFIG_DVB_MN88473 is not set
+# CONFIG_DVB_MT312 is not set
+# CONFIG_DVB_MT352 is not set
+# CONFIG_DVB_MXL5XX is not set
+# CONFIG_DVB_MXL692 is not set
+# CONFIG_DVB_NET is not set
+# CONFIG_DVB_NXT200X is not set
+# CONFIG_DVB_NXT6000 is not set
+# CONFIG_DVB_OR51132 is not set
+# CONFIG_DVB_OR51211 is not set
+# CONFIG_DVB_PLATFORM_DRIVERS is not set
+# CONFIG_DVB_PLL is not set
+# CONFIG_DVB_RTL2830 is not set
+# CONFIG_DVB_RTL2832 is not set
+# CONFIG_DVB_RTL2832_SDR is not set
+# CONFIG_DVB_S5H1409 is not set
+# CONFIG_DVB_S5H1411 is not set
+# CONFIG_DVB_S5H1420 is not set
+# CONFIG_DVB_S5H1432 is not set
+# CONFIG_DVB_S921 is not set
+# CONFIG_DVB_SI2165 is not set
+# CONFIG_DVB_SI2168 is not set
+# CONFIG_DVB_SI21XX is not set
+# CONFIG_DVB_SP2 is not set
+# CONFIG_DVB_SP8870 is not set
+# CONFIG_DVB_SP887X is not set
+# CONFIG_DVB_STB0899 is not set
+# CONFIG_DVB_STB6000 is not set
+# CONFIG_DVB_STB6100 is not set
+# CONFIG_DVB_STV0288 is not set
+# CONFIG_DVB_STV0297 is not set
+# CONFIG_DVB_STV0299 is not set
+# CONFIG_DVB_STV0367 is not set
+# CONFIG_DVB_STV0900 is not set
+# CONFIG_DVB_STV090x is not set
+# CONFIG_DVB_STV0910 is not set
+# CONFIG_DVB_STV6110 is not set
+# CONFIG_DVB_STV6110x is not set
+# CONFIG_DVB_STV6111 is not set
+# CONFIG_DVB_TC90522 is not set
+# CONFIG_DVB_TDA10021 is not set
+# CONFIG_DVB_TDA10023 is not set
+# CONFIG_DVB_TDA10048 is not set
+# CONFIG_DVB_TDA1004X is not set
+# CONFIG_DVB_TDA10071 is not set
+# CONFIG_DVB_TDA10086 is not set
+# CONFIG_DVB_TDA18271C2DD is not set
+# CONFIG_DVB_TDA665x is not set
+# CONFIG_DVB_TDA8083 is not set
+# CONFIG_DVB_TDA8261 is not set
+# CONFIG_DVB_TDA826X is not set
+# CONFIG_DVB_TEST_DRIVERS is not set
+# CONFIG_DVB_TS2020 is not set
+# CONFIG_DVB_TTUSB_BUDGET is not set
+# CONFIG_DVB_TTUSB_DEC is not set
+# CONFIG_DVB_TUA6100 is not set
+# CONFIG_DVB_TUNER_CX24113 is not set
+# CONFIG_DVB_TUNER_DIB0070 is not set
+# CONFIG_DVB_TUNER_DIB0090 is not set
+# CONFIG_DVB_TUNER_ITD1000 is not set
+# CONFIG_DVB_ULE_DEBUG is not set
+# CONFIG_DVB_USB is not set
+# CONFIG_DVB_USB_V2 is not set
+# CONFIG_DVB_VES1820 is not set
+# CONFIG_DVB_VES1X93 is not set
+# CONFIG_DVB_ZD1301_DEMOD is not set
+# CONFIG_DVB_ZL10036 is not set
+# CONFIG_DVB_ZL10039 is not set
+# CONFIG_DVB_ZL10353 is not set
+# CONFIG_DWC_XLGMAC is not set
+# CONFIG_DWMAC_DWC_QOS_ETH is not set
+# CONFIG_DWMAC_INTEL_PLAT is not set
+# CONFIG_DWMAC_IPQ806X is not set
+# CONFIG_DWMAC_LOONGSON is not set
+# CONFIG_DWMAC_LPC18XX is not set
+# CONFIG_DWMAC_MESON is not set
+# CONFIG_DWMAC_ROCKCHIP is not set
+# CONFIG_DWMAC_SOCFPGA is not set
+# CONFIG_DWMAC_STI is not set
+# CONFIG_DW_AXI_DMAC is not set
+# CONFIG_DW_DMAC is not set
+# CONFIG_DW_DMAC_PCI is not set
+# CONFIG_DW_EDMA is not set
+# CONFIG_DW_EDMA_PCIE is not set
+# CONFIG_DW_WATCHDOG is not set
+# CONFIG_DW_XDATA_PCIE is not set
+# CONFIG_DYNAMIC_DEBUG is not set
+# CONFIG_DYNAMIC_DEBUG_CORE is not set
+# CONFIG_E100 is not set
+# CONFIG_E1000 is not set
+# CONFIG_E1000E is not set
+# CONFIG_E1000E_HWTS is not set
+# CONFIG_EARLY_PRINTK_8250 is not set
+# CONFIG_EARLY_PRINTK_USB_XDBC is not set
+# CONFIG_EBC_C384_WDT is not set
+# CONFIG_ECHO is not set
+# CONFIG_ECRYPT_FS is not set
+# CONFIG_EDAC is not set
+# CONFIG_EEEPC_LAPTOP is not set
+# CONFIG_EEPROM_93CX6 is not set
+# CONFIG_EEPROM_93XX46 is not set
+# CONFIG_EEPROM_AT24 is not set
+# CONFIG_EEPROM_AT25 is not set
+# CONFIG_EEPROM_DIGSY_MTC_CFG is not set
+# CONFIG_EEPROM_EE1004 is not set
+# CONFIG_EEPROM_IDT_89HPESX is not set
+# CONFIG_EEPROM_LEGACY is not set
+# CONFIG_EEPROM_MAX6875 is not set
+# CONFIG_EFI is not set
+# CONFIG_EFI_COCO_SECRET is not set
+# CONFIG_EFI_DISABLE_RUNTIME is not set
+# CONFIG_EFI_DXE_MEM_ATTRIBUTES is not set
+CONFIG_EFI_PARTITION=y
+# CONFIG_EFI_SECRET is not set
+# CONFIG_EFI_VARS_PSTORE is not set
+# CONFIG_EFS_FS is not set
+CONFIG_ELFCORE=y
+# CONFIG_ELF_CORE is not set
+# CONFIG_EMAC_ROCKCHIP is not set
+CONFIG_EMBEDDED=y
+# CONFIG_EM_TIMER_STI is not set
+CONFIG_ENABLE_WARN_DEPRECATED=y
+# CONFIG_ENA_ETHERNET is not set
+# CONFIG_ENC28J60 is not set
+# CONFIG_ENCLOSURE_SERVICES is not set
+# CONFIG_ENCRYPTED_KEYS is not set
+# CONFIG_ENCX24J600 is not set
+# CONFIG_ENERGY_MODEL is not set
+# CONFIG_ENIC is not set
+# CONFIG_ENVELOPE_DETECTOR is not set
+# CONFIG_EPAPR_PARAVIRT is not set
+# CONFIG_EPIC100 is not set
+CONFIG_EPOLL=y
+# CONFIG_EQUALIZER is not set
+# CONFIG_EROFS_FS is not set
+# CONFIG_ET131X is not set
+CONFIG_ETHERNET=y
+# CONFIG_ETHOC is not set
+CONFIG_ETHTOOL_NETLINK=y
+CONFIG_EVENTFD=y
+# CONFIG_EVM is not set
+# CONFIG_EXAR_WDT is not set
+# CONFIG_EXFAT_FS is not set
+CONFIG_EXPERT=y
+CONFIG_EXPORTFS=y
+# CONFIG_EXPORTFS_BLOCK_OPS is not set
+# CONFIG_EXT2_FS is not set
+CONFIG_EXT2_FS_XATTR=y
+# CONFIG_EXT3_FS is not set
+# CONFIG_EXT4_DEBUG is not set
+# CONFIG_EXT4_ENCRYPTION is not set
+# CONFIG_EXT4_FS is not set
+# CONFIG_EXT4_FS_POSIX_ACL is not set
+# CONFIG_EXT4_FS_SECURITY is not set
+CONFIG_EXT4_USE_FOR_EXT2=y
+# CONFIG_EXTCON is not set
+# CONFIG_EXTCON_ADC_JACK is not set
+# CONFIG_EXTCON_ARIZONA is not set
+# CONFIG_EXTCON_AXP288 is not set
+# CONFIG_EXTCON_FSA9480 is not set
+# CONFIG_EXTCON_GPIO is not set
+# CONFIG_EXTCON_INTEL_INT3496 is not set
+# CONFIG_EXTCON_MAX3355 is not set
+# CONFIG_EXTCON_PTN5150 is not set
+# CONFIG_EXTCON_QCOM_SPMI_MISC is not set
+# CONFIG_EXTCON_RT8973A is not set
+# CONFIG_EXTCON_SM5502 is not set
+# CONFIG_EXTCON_USBC_TUSB320 is not set
+# CONFIG_EXTCON_USB_GPIO is not set
+CONFIG_EXTRA_FIRMWARE=""
+CONFIG_EXTRA_TARGETS=""
+# CONFIG_EXYNOS_ADC is not set
+# CONFIG_EXYNOS_VIDEO is not set
+# CONFIG_EZCHIP_NPS_MANAGEMENT_ENET is not set
+# CONFIG_EZX_PCAP is not set
+# CONFIG_F2FS_CHECK_FS is not set
+# CONFIG_F2FS_FAULT_INJECTION is not set
+# CONFIG_F2FS_FS is not set
+# CONFIG_F2FS_FS_COMPRESSION is not set
+# CONFIG_F2FS_FS_ENCRYPTION is not set
+# CONFIG_F2FS_FS_POSIX_ACL is not set
+# CONFIG_F2FS_FS_SECURITY is not set
+CONFIG_F2FS_FS_XATTR=y
+# CONFIG_F2FS_IOSTAT is not set
+# CONFIG_F2FS_IO_TRACE is not set
+CONFIG_F2FS_STAT_FS=y
+# CONFIG_F2FS_UNFAIR_RWSEM is not set
+# CONFIG_FAILOVER is not set
+# CONFIG_FAIR_GROUP_SCHED is not set
+# CONFIG_FANOTIFY is not set
+# CONFIG_FANOTIFY_ACCESS_PERMISSIONS is not set
+CONFIG_FAT_DEFAULT_CODEPAGE=437
+CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
+# CONFIG_FAT_DEFAULT_UTF8 is not set
+# CONFIG_FAT_FS is not set
+# CONFIG_FAULT_INJECTION is not set
+# CONFIG_FB is not set
+# CONFIG_FB_3DFX is not set
+# CONFIG_FB_ARC is not set
+# CONFIG_FB_ARK is not set
+# CONFIG_FB_ARMCLCD is not set
+# CONFIG_FB_ASILIANT is not set
+# CONFIG_FB_ATMEL is not set
+# CONFIG_FB_ATY is not set
+# CONFIG_FB_ATY128 is not set
+# CONFIG_FB_AUO_K190X is not set
+# CONFIG_FB_BACKLIGHT is not set
+# CONFIG_FB_BIG_ENDIAN is not set
+# CONFIG_FB_BOOT_VESA_SUPPORT is not set
+# CONFIG_FB_BOTH_ENDIAN is not set
+# CONFIG_FB_BROADSHEET is not set
+# CONFIG_FB_CARMINE is not set
+# CONFIG_FB_CFB_COPYAREA is not set
+# CONFIG_FB_CFB_FILLRECT is not set
+# CONFIG_FB_CFB_IMAGEBLIT is not set
+# CONFIG_FB_CFB_REV_PIXELS_IN_BYTE is not set
+# CONFIG_FB_CIRRUS is not set
+# CONFIG_FB_CYBER2000 is not set
+# CONFIG_FB_DA8XX is not set
+# CONFIG_FB_DDC is not set
+# CONFIG_FB_FLEX is not set
+# CONFIG_FB_FOREIGN_ENDIAN is not set
+# CONFIG_FB_FSL_DIU is not set
+# CONFIG_FB_GEODE is not set
+# CONFIG_FB_GOLDFISH is not set
+# CONFIG_FB_HGA is not set
+# CONFIG_FB_I740 is not set
+# CONFIG_FB_IBM_GXT4500 is not set
+# CONFIG_FB_IMSTT is not set
+# CONFIG_FB_IMX is not set
+# CONFIG_FB_KYRO is not set
+# CONFIG_FB_LE80578 is not set
+# CONFIG_FB_LITTLE_ENDIAN is not set
+# CONFIG_FB_MACMODES is not set
+# CONFIG_FB_MATROX is not set
+# CONFIG_FB_MB862XX is not set
+# CONFIG_FB_METRONOME is not set
+# CONFIG_FB_MODE_HELPERS is not set
+# CONFIG_FB_MXS is not set
+# CONFIG_FB_N411 is not set
+# CONFIG_FB_NEOMAGIC is not set
+CONFIG_FB_NOTIFY=y
+# CONFIG_FB_NVIDIA is not set
+# CONFIG_FB_OF is not set
+# CONFIG_FB_OMAP2 is not set
+# CONFIG_FB_OPENCORES is not set
+# CONFIG_FB_PM2 is not set
+# CONFIG_FB_PM3 is not set
+# CONFIG_FB_PS3 is not set
+# CONFIG_FB_PXA is not set
+# CONFIG_FB_RADEON is not set
+# CONFIG_FB_RIVA is not set
+# CONFIG_FB_S1D13XXX is not set
+# CONFIG_FB_S3 is not set
+# CONFIG_FB_SAVAGE is not set
+# CONFIG_FB_SIMPLE is not set
+# CONFIG_FB_SIS is not set
+# CONFIG_FB_SM712 is not set
+# CONFIG_FB_SM750 is not set
+# CONFIG_FB_SMSCUFX is not set
+# CONFIG_FB_SSD1307 is not set
+# CONFIG_FB_SVGALIB is not set
+# CONFIG_FB_SYS_COPYAREA is not set
+# CONFIG_FB_SYS_FILLRECT is not set
+# CONFIG_FB_SYS_FOPS is not set
+# CONFIG_FB_SYS_IMAGEBLIT is not set
+# CONFIG_FB_TFT is not set
+# CONFIG_FB_TFT_AGM1264K_FL is not set
+# CONFIG_FB_TFT_BD663474 is not set
+# CONFIG_FB_TFT_FBTFT_DEVICE is not set
+# CONFIG_FB_TFT_HX8340BN is not set
+# CONFIG_FB_TFT_HX8347D is not set
+# CONFIG_FB_TFT_HX8353D is not set
+# CONFIG_FB_TFT_HX8357D is not set
+# CONFIG_FB_TFT_ILI9163 is not set
+# CONFIG_FB_TFT_ILI9320 is not set
+# CONFIG_FB_TFT_ILI9325 is not set
+# CONFIG_FB_TFT_ILI9340 is not set
+# CONFIG_FB_TFT_ILI9341 is not set
+# CONFIG_FB_TFT_ILI9481 is not set
+# CONFIG_FB_TFT_ILI9486 is not set
+# CONFIG_FB_TFT_PCD8544 is not set
+# CONFIG_FB_TFT_RA8875 is not set
+# CONFIG_FB_TFT_S6D02A1 is not set
+# CONFIG_FB_TFT_S6D1121 is not set
+# CONFIG_FB_TFT_SEPS525 is not set
+# CONFIG_FB_TFT_SH1106 is not set
+# CONFIG_FB_TFT_SSD1289 is not set
+# CONFIG_FB_TFT_SSD1305 is not set
+# CONFIG_FB_TFT_SSD1306 is not set
+# CONFIG_FB_TFT_SSD1325 is not set
+# CONFIG_FB_TFT_SSD1331 is not set
+# CONFIG_FB_TFT_SSD1351 is not set
+# CONFIG_FB_TFT_ST7735R is not set
+# CONFIG_FB_TFT_ST7789V is not set
+# CONFIG_FB_TFT_TINYLCD is not set
+# CONFIG_FB_TFT_TLS8204 is not set
+# CONFIG_FB_TFT_UC1611 is not set
+# CONFIG_FB_TFT_UC1701 is not set
+# CONFIG_FB_TFT_UPD161704 is not set
+# CONFIG_FB_TFT_WATTEROTT is not set
+# CONFIG_FB_TILEBLITTING is not set
+# CONFIG_FB_TMIO is not set
+# CONFIG_FB_TRIDENT is not set
+# CONFIG_FB_UDL is not set
+# CONFIG_FB_UVESA is not set
+# CONFIG_FB_VGA16 is not set
+# CONFIG_FB_VIA is not set
+# CONFIG_FB_VIRTUAL is not set
+# CONFIG_FB_VOODOO1 is not set
+# CONFIG_FB_VT8623 is not set
+# CONFIG_FB_XGI is not set
+# CONFIG_FCOE is not set
+# CONFIG_FCOE_FNIC is not set
+# CONFIG_FDDI is not set
+# CONFIG_FEALNX is not set
+# CONFIG_FENCE_TRACE is not set
+# CONFIG_FHANDLE is not set
+CONFIG_FIB_RULES=y
+# CONFIG_FIELDBUS_DEV is not set
+CONFIG_FILE_LOCKING=y
+# CONFIG_FIND_BIT_BENCHMARK is not set
+# CONFIG_FIREWIRE is not set
+# CONFIG_FIREWIRE_NOSY is not set
+# CONFIG_FIREWIRE_SERIAL is not set
+# CONFIG_FIRMWARE_EDID is not set
+# CONFIG_FIRMWARE_IN_KERNEL is not set
+# CONFIG_FIRMWARE_MEMMAP is not set
+# CONFIG_FIT_PARTITION is not set
+# CONFIG_FIXED_PHY is not set
+CONFIG_FLATMEM=y
+CONFIG_FLATMEM_MANUAL=y
+CONFIG_FLAT_NODE_MEM_MAP=y
+# CONFIG_FM10K is not set
+# CONFIG_FMC is not set
+# CONFIG_FONTS is not set
+# CONFIG_FONT_6x8 is not set
+# CONFIG_FONT_TER16x32 is not set
+# CONFIG_FORCEDETH is not set
+CONFIG_FORCE_MAX_ZONEORDER=11
+# CONFIG_FORCE_NR_CPUS is not set
+CONFIG_FORTIFY_SOURCE=y
+# CONFIG_FPGA is not set
+# CONFIG_FRAMEBUFFER_CONSOLE is not set
+# CONFIG_FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER is not set
+# CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION is not set
+# CONFIG_FRAME_POINTER is not set
+# CONFIG_FREEZER is not set
+# CONFIG_FRONTSWAP is not set
+# CONFIG_FSCACHE is not set
+# CONFIG_FSI is not set
+# CONFIG_FSL_EDMA is not set
+# CONFIG_FSL_ENETC is not set
+# CONFIG_FSL_ENETC_IERB is not set
+# CONFIG_FSL_ENETC_MDIO is not set
+# CONFIG_FSL_ENETC_VF is not set
+# CONFIG_FSL_ERRATUM_A008585 is not set
+# CONFIG_FSL_MC_BUS is not set
+# CONFIG_FSL_PQ_MDIO is not set
+# CONFIG_FSL_QDMA is not set
+# CONFIG_FSL_RCPM is not set
+# CONFIG_FSL_XGMAC_MDIO is not set
+CONFIG_FSNOTIFY=y
+# CONFIG_FS_DAX is not set
+# CONFIG_FS_ENCRYPTION is not set
+# CONFIG_FS_POSIX_ACL is not set
+# CONFIG_FS_VERITY is not set
+# CONFIG_FTGMAC100 is not set
+# CONFIG_FTL is not set
+# CONFIG_FTMAC100 is not set
+# CONFIG_FTRACE is not set
+# CONFIG_FTRACE_RECORD_RECURSION is not set
+# CONFIG_FTRACE_SORT_STARTUP_TEST is not set
+# CONFIG_FTRACE_STARTUP_TEST is not set
+# CONFIG_FTR_FIXUP_SELFTEST is not set
+# CONFIG_FTWDT010_WATCHDOG is not set
+# CONFIG_FUJITSU_ERRATUM_010001 is not set
+# CONFIG_FUJITSU_ES is not set
+# CONFIG_FUJITSU_LAPTOP is not set
+# CONFIG_FUJITSU_TABLET is not set
+# CONFIG_FUNCTION_ERROR_INJECTION is not set
+# CONFIG_FUNCTION_TRACER is not set
+# CONFIG_FUN_ETH is not set
+# CONFIG_FUSE_FS is not set
+# CONFIG_FUSION is not set
+# CONFIG_FUSION_FC is not set
+# CONFIG_FUSION_SAS is not set
+# CONFIG_FUSION_SPI is not set
+CONFIG_FUTEX=y
+CONFIG_FUTEX_PI=y
+# CONFIG_FW_CFG_SYSFS is not set
+# CONFIG_FW_DEVLINK_SYNC_STATE_TIMEOUT is not set
+CONFIG_FW_LOADER=y
+# CONFIG_FW_LOADER_COMPRESS is not set
+CONFIG_FW_LOADER_USER_HELPER=y
+CONFIG_FW_LOADER_USER_HELPER_FALLBACK=y
+# CONFIG_FW_UPLOAD is not set
+# CONFIG_FXAS21002C is not set
+# CONFIG_FXLS8962AF_I2C is not set
+# CONFIG_FXLS8962AF_SPI is not set
+# CONFIG_FXOS8700_I2C is not set
+# CONFIG_FXOS8700_SPI is not set
+CONFIG_GACT_PROB=y
+# CONFIG_GADGET_UAC1 is not set
+# CONFIG_GAMEPORT is not set
+# CONFIG_GATEWORKS_GW16083 is not set
+# CONFIG_GCC_PLUGINS is not set
+# CONFIG_GCOV is not set
+# CONFIG_GCOV_KERNEL is not set
+# CONFIG_GDB_SCRIPTS is not set
+# CONFIG_GDS_FORCE_MITIGATION is not set
+# CONFIG_GEMINI_ETHERNET is not set
+# CONFIG_GENERIC_ADC_BATTERY is not set
+# CONFIG_GENERIC_ADC_THERMAL is not set
+CONFIG_GENERIC_CALIBRATE_DELAY=y
+# CONFIG_GENERIC_CPU_DEVICES is not set
+CONFIG_GENERIC_HWEIGHT=y
+# CONFIG_GENERIC_IRQ_DEBUGFS is not set
+CONFIG_GENERIC_IRQ_IPI=y
+CONFIG_GENERIC_IRQ_PROBE=y
+CONFIG_GENERIC_NET_UTILS=y
+# CONFIG_GENERIC_PHY is not set
+CONFIG_GENERIC_PTDUMP=y
+CONFIG_GENERIC_VDSO_TIME_NS=y
+# CONFIG_GENEVE is not set
+# CONFIG_GENWQE is not set
+# CONFIG_GFS2_FS is not set
+# CONFIG_GIGABYTE_WMI is not set
+# CONFIG_GIGASET_CAPI is not set
+# CONFIG_GIGASET_DEBUG is not set
+# CONFIG_GIGASET_DUMMYLL is not set
+# CONFIG_GLOB_SELFTEST is not set
+# CONFIG_GNSS is not set
+# CONFIG_GOLDFISH is not set
+# CONFIG_GOOGLE_CBMEM is not set
+# CONFIG_GOOGLE_FIRMWARE is not set
+# CONFIG_GOOGLE_FRAMEBUFFER_COREBOOT is not set
+# CONFIG_GOOGLE_MEMCONSOLE_X86_LEGACY is not set
+# CONFIG_GOOGLE_SMI is not set
+# CONFIG_GP2AP002 is not set
+# CONFIG_GP2AP020A00F is not set
+# CONFIG_GPD_POCKET_FAN is not set
+CONFIG_GPIOLIB=y
+CONFIG_GPIOLIB_FASTPATH_LIMIT=512
+# CONFIG_GPIO_104_DIO_48E is not set
+# CONFIG_GPIO_104_IDIO_16 is not set
+# CONFIG_GPIO_104_IDI_48 is not set
+# CONFIG_GPIO_74X164 is not set
+# CONFIG_GPIO_74XX_MMIO is not set
+# CONFIG_GPIO_ADNP is not set
+# CONFIG_GPIO_ADP5588 is not set
+# CONFIG_GPIO_AGGREGATOR is not set
+# CONFIG_GPIO_ALTERA is not set
+# CONFIG_GPIO_AMD8111 is not set
+# CONFIG_GPIO_AMDPT is not set
+# CONFIG_GPIO_AMD_FCH is not set
+# CONFIG_GPIO_BCM_KONA is not set
+# CONFIG_GPIO_BT8XX is not set
+# CONFIG_GPIO_CADENCE is not set
+# CONFIG_GPIO_CASCADE is not set
+# CONFIG_GPIO_CDEV is not set
+# CONFIG_GPIO_CDEV_V1 is not set
+# CONFIG_GPIO_CS5535 is not set
+# CONFIG_GPIO_DWAPB is not set
+# CONFIG_GPIO_EM is not set
+# CONFIG_GPIO_EXAR is not set
+# CONFIG_GPIO_F7188X is not set
+# CONFIG_GPIO_FTGPIO010 is not set
+# CONFIG_GPIO_GENERIC_PLATFORM is not set
+# CONFIG_GPIO_GPIO_MM is not set
+# CONFIG_GPIO_GRGPIO is not set
+# CONFIG_GPIO_GW_PLD is not set
+# CONFIG_GPIO_HLWD is not set
+# CONFIG_GPIO_ICH is not set
+# CONFIG_GPIO_IT87 is not set
+# CONFIG_GPIO_LOGICVC is not set
+# CONFIG_GPIO_LYNXPOINT is not set
+# CONFIG_GPIO_MAX3191X is not set
+# CONFIG_GPIO_MAX7300 is not set
+# CONFIG_GPIO_MAX7301 is not set
+# CONFIG_GPIO_MAX732X is not set
+# CONFIG_GPIO_MB86S7X is not set
+# CONFIG_GPIO_MC33880 is not set
+# CONFIG_GPIO_ML_IOH is not set
+# CONFIG_GPIO_MOCKUP is not set
+# CONFIG_GPIO_MPC8XXX is not set
+# CONFIG_GPIO_PCA953X is not set
+# CONFIG_GPIO_PCA953X_IRQ is not set
+# CONFIG_GPIO_PCA9570 is not set
+# CONFIG_GPIO_PCF857X is not set
+# CONFIG_GPIO_PCH is not set
+# CONFIG_GPIO_PCIE_IDIO_24 is not set
+# CONFIG_GPIO_PCI_IDIO_16 is not set
+# CONFIG_GPIO_PISOSR is not set
+# CONFIG_GPIO_PL061 is not set
+# CONFIG_GPIO_PWM is not set
+# CONFIG_GPIO_RCAR is not set
+# CONFIG_GPIO_RDC321X is not set
+# CONFIG_GPIO_SAMA5D2_PIOBU is not set
+# CONFIG_GPIO_SCH is not set
+# CONFIG_GPIO_SCH311X is not set
+# CONFIG_GPIO_SIFIVE is not set
+# CONFIG_GPIO_SIM is not set
+# CONFIG_GPIO_SX150X is not set
+# CONFIG_GPIO_SYSCON is not set
+CONFIG_GPIO_SYSFS=y
+# CONFIG_GPIO_TPIC2810 is not set
+# CONFIG_GPIO_TS4900 is not set
+# CONFIG_GPIO_TS5500 is not set
+# CONFIG_GPIO_VIRTIO is not set
+# CONFIG_GPIO_VX855 is not set
+# CONFIG_GPIO_WATCHDOG is not set
+# CONFIG_GPIO_WINBOND is not set
+# CONFIG_GPIO_WS16C48 is not set
+# CONFIG_GPIO_XGENE is not set
+# CONFIG_GPIO_XILINX is not set
+# CONFIG_GPIO_XRA1403 is not set
+# CONFIG_GPIO_ZEVIO is not set
+# CONFIG_GPIO_ZX is not set
+# CONFIG_GP_PCI1XXXX is not set
+# CONFIG_GREENASIA_FF is not set
+# CONFIG_GREYBUS is not set
+# CONFIG_GS_FPGABOOT is not set
+# CONFIG_GTP is not set
+# CONFIG_GUP_BENCHMARK is not set
+# CONFIG_GUP_TEST is not set
+# CONFIG_GVE is not set
+# CONFIG_HABANA_AI is not set
+# CONFIG_HAMACHI is not set
+# CONFIG_HAMRADIO is not set
+# CONFIG_HAPPYMEAL is not set
+CONFIG_HARDENED_USERCOPY=y
+# CONFIG_HARDENED_USERCOPY_FALLBACK is not set
+# CONFIG_HARDENED_USERCOPY_PAGESPAN is not set
+CONFIG_HARDEN_BRANCH_HISTORY=y
+CONFIG_HARDEN_EL2_VECTORS=y
+# CONFIG_HARDLOCKUP_DETECTOR is not set
+# CONFIG_HAVE_ARM_ARCH_TIMER is not set
+# CONFIG_HCALL_STATS is not set
+# CONFIG_HDC100X is not set
+# CONFIG_HDC2010 is not set
+# CONFIG_HDLC is not set
+# CONFIG_HDLC_CISCO is not set
+# CONFIG_HDLC_FR is not set
+# CONFIG_HDLC_PPP is not set
+# CONFIG_HDLC_RAW is not set
+# CONFIG_HDLC_RAW_ETH is not set
+# CONFIG_HDMI_LPE_AUDIO is not set
+# CONFIG_HDQ_MASTER_OMAP is not set
+# CONFIG_HEADERS_CHECK is not set
+# CONFIG_HEADERS_INSTALL is not set
+# CONFIG_HEADER_TEST is not set
+# CONFIG_HERMES is not set
+# CONFIG_HFSPLUS_FS is not set
+# CONFIG_HFSPLUS_FS_POSIX_ACL is not set
+# CONFIG_HFS_FS is not set
+# CONFIG_HFS_FS_POSIX_ACL is not set
+# CONFIG_HI6421V600_IRQ is not set
+# CONFIG_HI8435 is not set
+# CONFIG_HIBERNATION is not set
+# CONFIG_HID is not set
+# CONFIG_HIDRAW is not set
+# CONFIG_HID_A4TECH is not set
+# CONFIG_HID_ACCUTOUCH is not set
+# CONFIG_HID_ACRUX is not set
+# CONFIG_HID_ACRUX_FF is not set
+# CONFIG_HID_ALPS is not set
+# CONFIG_HID_APPLE is not set
+# CONFIG_HID_APPLEIR is not set
+# CONFIG_HID_ASUS is not set
+# CONFIG_HID_AUREAL is not set
+# CONFIG_HID_BATTERY_STRENGTH is not set
+# CONFIG_HID_BELKIN is not set
+# CONFIG_HID_BETOP_FF is not set
+# CONFIG_HID_BIGBEN_FF is not set
+# CONFIG_HID_CHERRY is not set
+# CONFIG_HID_CHICONY is not set
+# CONFIG_HID_CMEDIA is not set
+# CONFIG_HID_CORSAIR is not set
+# CONFIG_HID_COUGAR is not set
+# CONFIG_HID_CP2112 is not set
+# CONFIG_HID_CREATIVE_SB0540 is not set
+# CONFIG_HID_CYPRESS is not set
+# CONFIG_HID_DRAGONRISE is not set
+# CONFIG_HID_ELAN is not set
+# CONFIG_HID_ELECOM is not set
+# CONFIG_HID_ELO is not set
+# CONFIG_HID_EMS_FF is not set
+# CONFIG_HID_EZKEY is not set
+# CONFIG_HID_FT260 is not set
+# CONFIG_HID_GEMBIRD is not set
+# CONFIG_HID_GENERIC is not set
+# CONFIG_HID_GFRM is not set
+# CONFIG_HID_GLORIOUS is not set
+# CONFIG_HID_GOOGLE_HAMMER is not set
+# CONFIG_HID_GREENASIA is not set
+# CONFIG_HID_GT683R is not set
+# CONFIG_HID_GYRATION is not set
+# CONFIG_HID_HOLTEK is not set
+# CONFIG_HID_ICADE is not set
+# CONFIG_HID_ITE is not set
+# CONFIG_HID_JABRA is not set
+# CONFIG_HID_KENSINGTON is not set
+# CONFIG_HID_KEYTOUCH is not set
+# CONFIG_HID_KYE is not set
+# CONFIG_HID_LCPOWER is not set
+# CONFIG_HID_LED is not set
+# CONFIG_HID_LENOVO is not set
+# CONFIG_HID_LETSKETCH is not set
+# CONFIG_HID_LOGITECH is not set
+# CONFIG_HID_LOGITECH_DJ is not set
+# CONFIG_HID_LOGITECH_HIDPP is not set
+# CONFIG_HID_MACALLY is not set
+# CONFIG_HID_MAGICMOUSE is not set
+# CONFIG_HID_MALTRON is not set
+# CONFIG_HID_MAYFLASH is not set
+# CONFIG_HID_MCP2221 is not set
+# CONFIG_HID_MEGAWORLD_FF is not set
+# CONFIG_HID_MICROSOFT is not set
+# CONFIG_HID_MONTEREY is not set
+# CONFIG_HID_MULTITOUCH is not set
+# CONFIG_HID_NINTENDO is not set
+# CONFIG_HID_NTI is not set
+# CONFIG_HID_NTRIG is not set
+# CONFIG_HID_ORTEK is not set
+# CONFIG_HID_PANTHERLORD is not set
+# CONFIG_HID_PENMOUNT is not set
+# CONFIG_HID_PETALYNX is not set
+# CONFIG_HID_PICOLCD is not set
+# CONFIG_HID_PID is not set
+# CONFIG_HID_PLANTRONICS is not set
+# CONFIG_HID_PLAYSTATION is not set
+# CONFIG_HID_PRIMAX is not set
+# CONFIG_HID_PRODIKEYS is not set
+# CONFIG_HID_PXRC is not set
+# CONFIG_HID_RAZER is not set
+# CONFIG_HID_REDRAGON is not set
+# CONFIG_HID_RETRODE is not set
+# CONFIG_HID_RMI is not set
+# CONFIG_HID_ROCCAT is not set
+# CONFIG_HID_SAITEK is not set
+# CONFIG_HID_SAMSUNG is not set
+# CONFIG_HID_SEMITEK is not set
+# CONFIG_HID_SENSOR_HUB is not set
+# CONFIG_HID_SIGMAMICRO is not set
+# CONFIG_HID_SMARTJOYPLUS is not set
+# CONFIG_HID_SONY is not set
+# CONFIG_HID_SPEEDLINK is not set
+# CONFIG_HID_STEAM is not set
+# CONFIG_HID_STEELSERIES is not set
+# CONFIG_HID_SUNPLUS is not set
+# CONFIG_HID_THINGM is not set
+# CONFIG_HID_THRUSTMASTER is not set
+# CONFIG_HID_TIVO is not set
+# CONFIG_HID_TOPRE is not set
+# CONFIG_HID_TOPSEED is not set
+# CONFIG_HID_TWINHAN is not set
+# CONFIG_HID_U2FZERO is not set
+# CONFIG_HID_UCLOGIC is not set
+# CONFIG_HID_UDRAW_PS3 is not set
+# CONFIG_HID_VIEWSONIC is not set
+# CONFIG_HID_VIVALDI is not set
+# CONFIG_HID_VRC2 is not set
+# CONFIG_HID_WACOM is not set
+# CONFIG_HID_WALTOP is not set
+# CONFIG_HID_WIIMOTE is not set
+# CONFIG_HID_XIAOMI is not set
+# CONFIG_HID_XINMO is not set
+# CONFIG_HID_ZEROPLUS is not set
+# CONFIG_HID_ZYDACRON is not set
+# CONFIG_HIGHMEM is not set
+CONFIG_HIGH_RES_TIMERS=y
+# CONFIG_HINIC is not set
+# CONFIG_HIP04_ETH is not set
+# CONFIG_HIPPI is not set
+# CONFIG_HISILICON_ERRATUM_161010101 is not set
+# CONFIG_HISILICON_ERRATUM_161600802 is not set
+# CONFIG_HISI_DMA is not set
+# CONFIG_HISI_FEMAC is not set
+# CONFIG_HISI_HIKEY_USB is not set
+# CONFIG_HISI_PCIE_PMU is not set
+# CONFIG_HISI_PTT is not set
+# CONFIG_HIST_TRIGGERS_DEBUG is not set
+# CONFIG_HIX5HD2_GMAC is not set
+# CONFIG_HMC425 is not set
+# CONFIG_HMC6352 is not set
+# CONFIG_HNS is not set
+# CONFIG_HNS3 is not set
+# CONFIG_HNS3_PMU is not set
+# CONFIG_HNS_DSAF is not set
+# CONFIG_HNS_ENET is not set
+# CONFIG_HOSTAP is not set
+# CONFIG_HOSTAP_CS is not set
+# CONFIG_HOSTAP_PCI is not set
+# CONFIG_HOSTAP_PLX is not set
+# CONFIG_HOTPLUG_CPU is not set
+# CONFIG_HOTPLUG_PCI is not set
+# CONFIG_HOTPLUG_PCI_SHPC is not set
+# CONFIG_HP03 is not set
+# CONFIG_HP100 is not set
+# CONFIG_HP206C is not set
+CONFIG_HPET_MMAP_DEFAULT=y
+# CONFIG_HPFS_FS is not set
+# CONFIG_HP_ILO is not set
+# CONFIG_HP_WATCHDOG is not set
+# CONFIG_HP_WIRELESS is not set
+# CONFIG_HSA_AMD is not set
+# CONFIG_HSI is not set
+# CONFIG_HSR is not set
+# CONFIG_HTC_EGPIO is not set
+# CONFIG_HTC_I2CPLD is not set
+# CONFIG_HTC_PASIC3 is not set
+# CONFIG_HTE is not set
+# CONFIG_HTS221 is not set
+# CONFIG_HTU21 is not set
+# CONFIG_HUGETLBFS is not set
+# CONFIG_HUGETLB_PAGE is not set
+# CONFIG_HUAWEI_WMI is not set
+# CONFIG_HVC_DCC is not set
+# CONFIG_HVC_UDBG is not set
+# CONFIG_HWLAT_TRACER is not set
+# CONFIG_HWMON is not set
+# CONFIG_HWMON_DEBUG_CHIP is not set
+# CONFIG_HWMON_VID is not set
+# CONFIG_HWSPINLOCK is not set
+# CONFIG_HWSPINLOCK_OMAP is not set
+CONFIG_HW_PERF_EVENTS=y
+# CONFIG_HW_RANDOM is not set
+# CONFIG_HW_RANDOM_AMD is not set
+# CONFIG_HW_RANDOM_ARM_SMCCC_TRNG is not set
+# CONFIG_HW_RANDOM_ATMEL is not set
+# CONFIG_HW_RANDOM_BA431 is not set
+# CONFIG_HW_RANDOM_BCM2835 is not set
+# CONFIG_HW_RANDOM_CAVIUM is not set
+# CONFIG_HW_RANDOM_CCTRNG is not set
+# CONFIG_HW_RANDOM_CN10K is not set
+# CONFIG_HW_RANDOM_EXYNOS is not set
+# CONFIG_HW_RANDOM_GEODE is not set
+# CONFIG_HW_RANDOM_INTEL is not set
+# CONFIG_HW_RANDOM_IPROC_RNG200 is not set
+# CONFIG_HW_RANDOM_MTK is not set
+# CONFIG_HW_RANDOM_OMAP is not set
+# CONFIG_HW_RANDOM_OMAP3_ROM is not set
+# CONFIG_HW_RANDOM_PPC4XX is not set
+# CONFIG_HW_RANDOM_TIMERIOMEM is not set
+CONFIG_HW_RANDOM_TPM=y
+# CONFIG_HW_RANDOM_VIA is not set
+# CONFIG_HW_RANDOM_VIRTIO is not set
+# CONFIG_HW_RANDOM_XIPHERA is not set
+# CONFIG_HX711 is not set
+# CONFIG_HYPERV is not set
+# CONFIG_HYPERV_TSCPAGE is not set
+# CONFIG_HYSDN is not set
+CONFIG_HZ=100
+CONFIG_HZ_100=y
+# CONFIG_HZ_1000 is not set
+# CONFIG_HZ_1024 is not set
+# CONFIG_HZ_128 is not set
+# CONFIG_HZ_200 is not set
+# CONFIG_HZ_24 is not set
+# CONFIG_HZ_250 is not set
+# CONFIG_HZ_256 is not set
+# CONFIG_HZ_300 is not set
+# CONFIG_HZ_48 is not set
+# CONFIG_HZ_500 is not set
+# CONFIG_HZ_PERIODIC is not set
+# CONFIG_I2C is not set
+# CONFIG_I2C_ALGOBIT is not set
+# CONFIG_I2C_ALGOPCA is not set
+# CONFIG_I2C_ALGOPCF is not set
+# CONFIG_I2C_ALI1535 is not set
+# CONFIG_I2C_ALI1563 is not set
+# CONFIG_I2C_ALI15X3 is not set
+# CONFIG_I2C_AMD756 is not set
+# CONFIG_I2C_AMD8111 is not set
+# CONFIG_I2C_ARB_GPIO_CHALLENGE is not set
+# CONFIG_I2C_AU1550 is not set
+# CONFIG_I2C_BCM2835 is not set
+# CONFIG_I2C_BCM_IPROC is not set
+# CONFIG_I2C_BRCMSTB is not set
+# CONFIG_I2C_CADENCE is not set
+# CONFIG_I2C_CBUS_GPIO is not set
+# CONFIG_I2C_CHARDEV is not set
+# CONFIG_I2C_COMPAT is not set
+# CONFIG_I2C_CP2615 is not set
+# CONFIG_I2C_DEBUG_ALGO is not set
+# CONFIG_I2C_DEBUG_BUS is not set
+# CONFIG_I2C_DEBUG_CORE is not set
+# CONFIG_I2C_DEMUX_PINCTRL is not set
+# CONFIG_I2C_DESIGNWARE_PCI is not set
+# CONFIG_I2C_DESIGNWARE_PLATFORM is not set
+# CONFIG_I2C_DESIGNWARE_SLAVE is not set
+# CONFIG_I2C_DIOLAN_U2C is not set
+# CONFIG_I2C_EG20T is not set
+# CONFIG_I2C_ELEKTOR is not set
+# CONFIG_I2C_EMEV2 is not set
+# CONFIG_I2C_GPIO is not set
+# CONFIG_I2C_GPIO_FAULT_INJECTOR is not set
+# CONFIG_I2C_HELPER_AUTO is not set
+# CONFIG_I2C_HID is not set
+# CONFIG_I2C_HID_OF is not set
+# CONFIG_I2C_HID_OF_ELAN is not set
+# CONFIG_I2C_HID_OF_GOODIX is not set
+# CONFIG_I2C_I801 is not set
+# CONFIG_I2C_IBM_IIC is not set
+# CONFIG_I2C_IMG is not set
+# CONFIG_I2C_ISCH is not set
+# CONFIG_I2C_ISMT is not set
+# CONFIG_I2C_JZ4780 is not set
+# CONFIG_I2C_MLXCPLD is not set
+# CONFIG_I2C_MPC is not set
+# CONFIG_I2C_MT65XX is not set
+# CONFIG_I2C_MUX is not set
+# CONFIG_I2C_MUX_GPIO is not set
+# CONFIG_I2C_MUX_GPMUX is not set
+# CONFIG_I2C_MUX_LTC4306 is not set
+# CONFIG_I2C_MUX_MLXCPLD is not set
+# CONFIG_I2C_MUX_PCA9541 is not set
+# CONFIG_I2C_MUX_PCA954x is not set
+# CONFIG_I2C_MUX_PINCTRL is not set
+# CONFIG_I2C_MUX_REG is not set
+# CONFIG_I2C_MV64XXX is not set
+# CONFIG_I2C_NFORCE2 is not set
+# CONFIG_I2C_NOMADIK is not set
+# CONFIG_I2C_NVIDIA_GPU is not set
+# CONFIG_I2C_OCORES is not set
+# CONFIG_I2C_OCTEON is not set
+# CONFIG_I2C_PARPORT is not set
+# CONFIG_I2C_PARPORT_LIGHT is not set
+# CONFIG_I2C_PCA_ISA is not set
+# CONFIG_I2C_PCA_PLATFORM is not set
+# CONFIG_I2C_PCI1XXXX is not set
+# CONFIG_I2C_PIIX4 is not set
+# CONFIG_I2C_PXA_PCI is not set
+# CONFIG_I2C_PXA_SLAVE is not set
+# CONFIG_I2C_RCAR is not set
+# CONFIG_I2C_RK3X is not set
+# CONFIG_I2C_ROBOTFUZZ_OSIF is not set
+# CONFIG_I2C_S3C2410 is not set
+# CONFIG_I2C_SCMI is not set
+# CONFIG_I2C_SH_MOBILE is not set
+# CONFIG_I2C_SIMTEC is not set
+# CONFIG_I2C_SIS5595 is not set
+# CONFIG_I2C_SIS630 is not set
+# CONFIG_I2C_SIS96X is not set
+# CONFIG_I2C_SLAVE is not set
+# CONFIG_I2C_SLAVE_EEPROM is not set
+# CONFIG_I2C_SMBUS is not set
+# CONFIG_I2C_STUB is not set
+# CONFIG_I2C_TAOS_EVM is not set
+# CONFIG_I2C_THUNDERX is not set
+# CONFIG_I2C_TINY_USB is not set
+# CONFIG_I2C_VERSATILE is not set
+# CONFIG_I2C_VIA is not set
+# CONFIG_I2C_VIAPRO is not set
+# CONFIG_I2C_VIRTIO is not set
+# CONFIG_I2C_XILINX is not set
+# CONFIG_I3C is not set
+# CONFIG_I40E is not set
+# CONFIG_I40EVF is not set
+# CONFIG_I6300ESB_WDT is not set
+# CONFIG_I82092 is not set
+# CONFIG_I82365 is not set
+# CONFIG_IAQCORE is not set
+# CONFIG_IBM_ASM is not set
+# CONFIG_IBM_EMAC_DEBUG is not set
+# CONFIG_IBM_EMAC_EMAC4 is not set
+# CONFIG_IBM_EMAC_MAL_CLR_ICINTSTAT is not set
+# CONFIG_IBM_EMAC_MAL_COMMON_ERR is not set
+# CONFIG_IBM_EMAC_NO_FLOW_CTRL is not set
+# CONFIG_IBM_EMAC_RGMII is not set
+# CONFIG_IBM_EMAC_TAH is not set
+# CONFIG_IBM_EMAC_ZMII is not set
+# CONFIG_ICE is not set
+# CONFIG_ICP10100 is not set
+# CONFIG_ICPLUS_PHY is not set
+# CONFIG_ICS932S401 is not set
+# CONFIG_ICST is not set
+# CONFIG_IDE is not set
+# CONFIG_IDEAPAD_LAPTOP is not set
+# CONFIG_IDE_GD is not set
+# CONFIG_IDE_PROC_FS is not set
+# CONFIG_IDE_TASK_IOCTL is not set
+# CONFIG_IDLE_PAGE_TRACKING is not set
+# CONFIG_IEEE802154 is not set
+# CONFIG_IEEE802154_ADF7242 is not set
+# CONFIG_IEEE802154_ATUSB is not set
+# CONFIG_IEEE802154_CA8210 is not set
+# CONFIG_IEEE802154_HWSIM is not set
+# CONFIG_IEEE802154_MCR20A is not set
+# CONFIG_IFB is not set
+# CONFIG_IGB is not set
+# CONFIG_IGBVF is not set
+# CONFIG_IGC is not set
+# CONFIG_IIO is not set
+# CONFIG_IIO_BUFFER is not set
+# CONFIG_IIO_BUFFER_CB is not set
+# CONFIG_IIO_BUFFER_DMA is not set
+# CONFIG_IIO_BUFFER_DMAENGINE is not set
+# CONFIG_IIO_BUFFER_HDC2010 is not set
+# CONFIG_IIO_BUFFER_HW_CONSUMER is not set
+# CONFIG_IIO_CONFIGFS is not set
+CONFIG_IIO_CONSUMERS_PER_TRIGGER=2
+# CONFIG_IIO_CROS_EC_ACCEL_LEGACY is not set
+# CONFIG_IIO_INTERRUPT_TRIGGER is not set
+# CONFIG_IIO_MUX is not set
+# CONFIG_IIO_PERIODIC_RTC_TRIGGER is not set
+# CONFIG_IIO_RESCALE is not set
+# CONFIG_IIO_SCMI is not set
+# CONFIG_IIO_SIMPLE_DUMMY is not set
+# CONFIG_IIO_SSP_SENSORHUB is not set
+# CONFIG_IIO_ST_ACCEL_3AXIS is not set
+# CONFIG_IIO_ST_GYRO_3AXIS is not set
+# CONFIG_IIO_ST_LSM6DSX is not set
+# CONFIG_IIO_ST_LSM9DS0 is not set
+# CONFIG_IIO_ST_MAGN_3AXIS is not set
+# CONFIG_IIO_ST_PRESS is not set
+# CONFIG_IIO_SW_DEVICE is not set
+# CONFIG_IIO_SW_TRIGGER is not set
+# CONFIG_IIO_SYSFS_TRIGGER is not set
+# CONFIG_IIO_TRIGGER is not set
+# CONFIG_IIO_TRIGGERED_EVENT is not set
+# CONFIG_IKCONFIG is not set
+# CONFIG_IKCONFIG_PROC is not set
+# CONFIG_IKHEADERS is not set
+# CONFIG_IMA is not set
+# CONFIG_IMAGE_CMDLINE_HACK is not set
+# CONFIG_IMGPDC_WDT is not set
+# CONFIG_IMG_MDC_DMA is not set
+# CONFIG_IMX7D_ADC is not set
+# CONFIG_IMX_IPUV3_CORE is not set
+# CONFIG_IMX_THERMAL is not set
+# CONFIG_INA2XX_ADC is not set
+# CONFIG_INDIRECT_PIO is not set
+CONFIG_INET=y
+# CONFIG_INET6_AH is not set
+# CONFIG_INET6_ESP is not set
+# CONFIG_INET6_ESPINTCP is not set
+# CONFIG_INET6_IPCOMP is not set
+# CONFIG_INET6_TUNNEL is not set
+# CONFIG_INET6_XFRM_TUNNEL is not set
+# CONFIG_INET_AH is not set
+CONFIG_INET_DIAG=y
+# CONFIG_INET_ESP is not set
+# CONFIG_INET_ESPINTCP is not set
+# CONFIG_INET_IPCOMP is not set
+# CONFIG_INET_LRO is not set
+CONFIG_INET_MPTCP_DIAG=y
+CONFIG_INET_TABLE_PERTURB_ORDER=16
+# CONFIG_INET_TCP_DIAG is not set
+# CONFIG_INET_TUNNEL is not set
+# CONFIG_INET_UDP_DIAG is not set
+# CONFIG_INET_XFRM_TUNNEL is not set
+# CONFIG_INFINIBAND is not set
+# CONFIG_INFTL is not set
+# CONFIG_INGENIC_ADC is not set
+# CONFIG_INGENIC_CGU_JZ4725B is not set
+# CONFIG_INGENIC_CGU_JZ4740 is not set
+# CONFIG_INGENIC_CGU_JZ4760 is not set
+# CONFIG_INGENIC_CGU_JZ4770 is not set
+# CONFIG_INGENIC_CGU_JZ4780 is not set
+# CONFIG_INGENIC_CGU_X1000 is not set
+# CONFIG_INGENIC_CGU_X1830 is not set
+# CONFIG_INGENIC_OST is not set
+# CONFIG_INGENIC_SYSOST is not set
+# CONFIG_INGENIC_TCU_CLK is not set
+# CONFIG_INGENIC_TCU_IRQ is not set
+# CONFIG_INGENIC_TIMER is not set
+# CONFIG_INITRAMFS_PRESERVE_MTIME is not set
+CONFIG_INIT_ENV_ARG_LIMIT=32
+# CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set
+# CONFIG_INIT_ON_FREE_DEFAULT_ON is not set
+# CONFIG_INIT_STACK_ALL_PATTERN is not set
+# CONFIG_INIT_STACK_ALL_ZERO is not set
+CONFIG_INIT_STACK_NONE=y
+CONFIG_INOTIFY_USER=y
+# CONFIG_INPUT is not set
+# CONFIG_INPUT_AD714X is not set
+# CONFIG_INPUT_ADXL34X is not set
+# CONFIG_INPUT_APANEL is not set
+# CONFIG_INPUT_ATI_REMOTE2 is not set
+# CONFIG_INPUT_ATLAS_BTNS is not set
+# CONFIG_INPUT_ATMEL_CAPTOUCH is not set
+# CONFIG_INPUT_AXP20X_PEK is not set
+# CONFIG_INPUT_BMA150 is not set
+# CONFIG_INPUT_CM109 is not set
+# CONFIG_INPUT_CMA3000 is not set
+# CONFIG_INPUT_DA7280_HAPTICS is not set
+# CONFIG_INPUT_DRV260X_HAPTICS is not set
+# CONFIG_INPUT_DRV2665_HAPTICS is not set
+# CONFIG_INPUT_DRV2667_HAPTICS is not set
+# CONFIG_INPUT_E3X0_BUTTON is not set
+# CONFIG_INPUT_EVBUG is not set
+# CONFIG_INPUT_EVDEV is not set
+# CONFIG_INPUT_FF_MEMLESS is not set
+# CONFIG_INPUT_GP2A is not set
+# CONFIG_INPUT_GPIO_BEEPER is not set
+# CONFIG_INPUT_GPIO_DECODER is not set
+# CONFIG_INPUT_GPIO_ROTARY_ENCODER is not set
+# CONFIG_INPUT_GPIO_TILT_POLLED is not set
+# CONFIG_INPUT_GPIO_VIBRA is not set
+# CONFIG_INPUT_IDEAPAD_SLIDEBAR is not set
+# CONFIG_INPUT_IMS_PCU is not set
+# CONFIG_INPUT_IQS269A is not set
+# CONFIG_INPUT_IQS626A is not set
+# CONFIG_INPUT_IQS7222 is not set
+# CONFIG_INPUT_JOYDEV is not set
+# CONFIG_INPUT_JOYSTICK is not set
+# CONFIG_INPUT_KEYBOARD is not set
+# CONFIG_INPUT_KEYSPAN_REMOTE is not set
+# CONFIG_INPUT_KXTJ9 is not set
+# CONFIG_INPUT_LEDS is not set
+# CONFIG_INPUT_MATRIXKMAP is not set
+# CONFIG_INPUT_MAX8997_HAPTIC is not set
+CONFIG_INPUT_MISC=y
+# CONFIG_INPUT_MMA8450 is not set
+# CONFIG_INPUT_MOUSE is not set
+# CONFIG_INPUT_MOUSEDEV is not set
+# CONFIG_INPUT_MPU3050 is not set
+# CONFIG_INPUT_MSM_VIBRATOR is not set
+# CONFIG_INPUT_PALMAS_PWRBUTTON is not set
+# CONFIG_INPUT_PCF8574 is not set
+# CONFIG_INPUT_PCSPKR is not set
+# CONFIG_INPUT_PM8941_PWRKEY is not set
+# CONFIG_INPUT_PM8XXX_VIBRATOR is not set
+# CONFIG_INPUT_POLLDEV is not set
+# CONFIG_INPUT_POWERMATE is not set
+# CONFIG_INPUT_PWM_BEEPER is not set
+# CONFIG_INPUT_PWM_VIBRA is not set
+# CONFIG_INPUT_REGULATOR_HAPTIC is not set
+# CONFIG_INPUT_SOC_BUTTON_ARRAY is not set
+# CONFIG_INPUT_SPARSEKMAP is not set
+# CONFIG_INPUT_TABLET is not set
+# CONFIG_INPUT_TOUCHSCREEN is not set
+# CONFIG_INPUT_TPS65218_PWRBUTTON is not set
+# CONFIG_INPUT_TWL4030_PWRBUTTON is not set
+# CONFIG_INPUT_TWL4030_VIBRA is not set
+# CONFIG_INPUT_TWL6040_VIBRA is not set
+# CONFIG_INPUT_UINPUT is not set
+# CONFIG_INPUT_WISTRON_BTNS is not set
+# CONFIG_INPUT_YEALINK is not set
+# CONFIG_INT340X_THERMAL is not set
+# CONFIG_INTEGRITY is not set
+# CONFIG_INTEGRITY_AUDIT is not set
+# CONFIG_INTEGRITY_SIGNATURE is not set
+# CONFIG_INTEL_ATOMISP2_LED is not set
+# CONFIG_INTEL_ATOMISP2_PM is not set
+# CONFIG_INTEL_CHT_INT33FE is not set
+# CONFIG_INTEL_HID_EVENT is not set
+# CONFIG_INTEL_IDLE is not set
+# CONFIG_INTEL_IDMA64 is not set
+# CONFIG_INTEL_INT0002_VGPIO is not set
+# CONFIG_INTEL_IOATDMA is not set
+# CONFIG_INTEL_ISH_HID is not set
+# CONFIG_INTEL_MEI is not set
+# CONFIG_INTEL_MEI_GSC is not set
+# CONFIG_INTEL_MEI_ME is not set
+# CONFIG_INTEL_MEI_TXE is not set
+# CONFIG_INTEL_MIC_CARD is not set
+# CONFIG_INTEL_MIC_HOST is not set
+# CONFIG_INTEL_MID_PTI is not set
+# CONFIG_INTEL_OAKTRAIL is not set
+# CONFIG_INTEL_PMC_CORE is not set
+# CONFIG_INTEL_PUNIT_IPC is not set
+# CONFIG_INTEL_RST is not set
+# CONFIG_INTEL_SMARTCONNECT is not set
+# CONFIG_INTEL_SOC_PMIC is not set
+# CONFIG_INTEL_SOC_PMIC_CHTDC_TI is not set
+# CONFIG_INTEL_SOC_PMIC_CHTWC is not set
+# CONFIG_INTEL_TCC_COOLING is not set
+# CONFIG_INTEL_TDX_GUEST is not set
+# CONFIG_INTEL_TH is not set
+# CONFIG_INTEL_VBTN is not set
+# CONFIG_INTEL_WMI_SBL_FW_UPDATE is not set
+# CONFIG_INTEL_WMI_THUNDERBOLT is not set
+# CONFIG_INTEL_XWAY_PHY is not set
+# CONFIG_INTERCONNECT is not set
+# CONFIG_INTERVAL_TREE_TEST is not set
+# CONFIG_INV_ICM42600_I2C is not set
+# CONFIG_INV_ICM42600_SPI is not set
+# CONFIG_INV_MPU6050_I2C is not set
+# CONFIG_INV_MPU6050_IIO is not set
+# CONFIG_INV_MPU6050_SPI is not set
+# CONFIG_IOMMU_DEFAULT_PASSTHROUGH is not set
+# CONFIG_IOMMU_IO_PGTABLE_DART is not set
+# CONFIG_IOMMU_SUPPORT is not set
+# CONFIG_IONIC is not set
+# CONFIG_IOSCHED_BFQ is not set
+# CONFIG_IOSM is not set
+CONFIG_IO_STRICT_DEVMEM=y
+# CONFIG_IO_URING is not set
+CONFIG_IO_WQ=y
+# CONFIG_IP17XX_PHY is not set
+# CONFIG_IP5XXX_POWER is not set
+# CONFIG_IP6_NF_FILTER is not set
+# CONFIG_IP6_NF_IPTABLES is not set
+# CONFIG_IP6_NF_MANGLE is not set
+# CONFIG_IP6_NF_MATCH_AH is not set
+# CONFIG_IP6_NF_MATCH_EUI64 is not set
+# CONFIG_IP6_NF_MATCH_FRAG is not set
+# CONFIG_IP6_NF_MATCH_HL is not set
+# CONFIG_IP6_NF_MATCH_IPV6HEADER is not set
+# CONFIG_IP6_NF_MATCH_MH is not set
+# CONFIG_IP6_NF_MATCH_OPTS is not set
+# CONFIG_IP6_NF_MATCH_RPFILTER is not set
+# CONFIG_IP6_NF_MATCH_RT is not set
+# CONFIG_IP6_NF_MATCH_SRH is not set
+# CONFIG_IP6_NF_NAT is not set
+# CONFIG_IP6_NF_RAW is not set
+# CONFIG_IP6_NF_SECURITY is not set
+# CONFIG_IP6_NF_TARGET_HL is not set
+# CONFIG_IP6_NF_TARGET_MASQUERADE is not set
+# CONFIG_IP6_NF_TARGET_REJECT is not set
+# CONFIG_IP6_NF_TARGET_SYNPROXY is not set
+# CONFIG_IPACK_BUS is not set
+# CONFIG_IPC_NS is not set
+# CONFIG_IPMB_DEVICE_INTERFACE is not set
+# CONFIG_IPMI_HANDLER is not set
+CONFIG_IPV6=y
+# CONFIG_IPV6_FOU is not set
+# CONFIG_IPV6_FOU_TUNNEL is not set
+# CONFIG_IPV6_ILA is not set
+# CONFIG_IPV6_IOAM6_LWTUNNEL is not set
+# CONFIG_IPV6_MIP6 is not set
+# CONFIG_IPV6_MROUTE is not set
+# CONFIG_IPV6_MROUTE_MULTIPLE_TABLES is not set
+# CONFIG_IPV6_MULTIPLE_TABLES is not set
+CONFIG_IPV6_NDISC_NODETYPE=y
+# CONFIG_IPV6_OPTIMISTIC_DAD is not set
+# CONFIG_IPV6_ROUTER_PREF is not set
+# CONFIG_IPV6_ROUTE_INFO is not set
+# CONFIG_IPV6_RPL_LWTUNNEL is not set
+# CONFIG_IPV6_SEG6_HMAC is not set
+# CONFIG_IPV6_SEG6_LWTUNNEL is not set
+# CONFIG_IPV6_SIT is not set
+# CONFIG_IPV6_SIT_6RD is not set
+# CONFIG_IPV6_TUNNEL is not set
+# CONFIG_IPV6_VTI is not set
+# CONFIG_IPVLAN is not set
+# CONFIG_IPVTAP is not set
+# CONFIG_IPW2100 is not set
+# CONFIG_IPW2100_DEBUG is not set
+CONFIG_IPW2100_MONITOR=y
+# CONFIG_IPW2200 is not set
+# CONFIG_IPW2200_DEBUG is not set
+CONFIG_IPW2200_MONITOR=y
+# CONFIG_IPW2200_PROMISCUOUS is not set
+# CONFIG_IPW2200_QOS is not set
+# CONFIG_IPW2200_RADIOTAP is not set
+# CONFIG_IPWIRELESS is not set
+# CONFIG_IPX is not set
+CONFIG_IP_ADVANCED_ROUTER=y
+# CONFIG_IP_DCCP is not set
+# CONFIG_IP_FIB_TRIE_STATS is not set
+# CONFIG_IP_MROUTE is not set
+CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_MULTIPLE_TABLES=y
+# CONFIG_IP_NF_ARPFILTER is not set
+# CONFIG_IP_NF_ARPTABLES is not set
+# CONFIG_IP_NF_ARP_MANGLE is not set
+# CONFIG_IP_NF_FILTER is not set
+# CONFIG_IP_NF_IPTABLES is not set
+# CONFIG_IP_NF_MANGLE is not set
+# CONFIG_IP_NF_MATCH_AH is not set
+# CONFIG_IP_NF_MATCH_ECN is not set
+# CONFIG_IP_NF_MATCH_RPFILTER is not set
+# CONFIG_IP_NF_MATCH_TTL is not set
+# CONFIG_IP_NF_RAW is not set
+# CONFIG_IP_NF_SECURITY is not set
+# CONFIG_IP_NF_TARGET_CLUSTERIP is not set
+# CONFIG_IP_NF_TARGET_ECN is not set
+# CONFIG_IP_NF_TARGET_MASQUERADE is not set
+# CONFIG_IP_NF_TARGET_NETMAP is not set
+# CONFIG_IP_NF_TARGET_REDIRECT is not set
+# CONFIG_IP_NF_TARGET_REJECT is not set
+# CONFIG_IP_NF_TARGET_SYNPROXY is not set
+# CONFIG_IP_NF_TARGET_TTL is not set
+# CONFIG_IP_PIMSM_V1 is not set
+# CONFIG_IP_PIMSM_V2 is not set
+# CONFIG_IP_PNP is not set
+CONFIG_IP_ROUTE_MULTIPATH=y
+CONFIG_IP_ROUTE_VERBOSE=y
+# CONFIG_IP_SCTP is not set
+# CONFIG_IP_SET is not set
+# CONFIG_IP_SET_HASH_IPMAC is not set
+# CONFIG_IP_VS is not set
+# CONFIG_IP_VS_MH is not set
+CONFIG_IP_VS_MH_TAB_INDEX=10
+# CONFIG_IP_VS_TWOS is not set
+# CONFIG_IRDA is not set
+# CONFIG_IRQSOFF_TRACER is not set
+# CONFIG_IRQ_ALL_CPUS is not set
+# CONFIG_IRQ_DOMAIN_DEBUG is not set
+# CONFIG_IRQ_POLL is not set
+# CONFIG_IRQ_TIME_ACCOUNTING is not set
+# CONFIG_IR_GPIO_CIR is not set
+# CONFIG_IR_HIX5HD2 is not set
+# CONFIG_IR_IGORPLUGUSB is not set
+# CONFIG_IR_IGUANA is not set
+# CONFIG_IR_IMG is not set
+# CONFIG_IR_IMON is not set
+# CONFIG_IR_IMON_RAW is not set
+# CONFIG_IR_JVC_DECODER is not set
+# CONFIG_IR_LIRC_CODEC is not set
+# CONFIG_IR_MCEUSB is not set
+# CONFIG_IR_NEC_DECODER is not set
+# CONFIG_IR_RC5_DECODER is not set
+# CONFIG_IR_RC6_DECODER is not set
+# CONFIG_IR_REDRAT3 is not set
+# CONFIG_IR_SERIAL is not set
+# CONFIG_IR_SIR is not set
+# CONFIG_IR_SONY_DECODER is not set
+# CONFIG_IR_STREAMZAP is not set
+# CONFIG_IR_TOY is not set
+# CONFIG_IR_TTUSBIR is not set
+# CONFIG_ISA_BUS is not set
+# CONFIG_ISA_BUS_API is not set
+# CONFIG_ISCSI_BOOT_SYSFS is not set
+# CONFIG_ISCSI_TCP is not set
+CONFIG_ISDN=y
+# CONFIG_ISDN_AUDIO is not set
+# CONFIG_ISDN_CAPI is not set
+# CONFIG_ISDN_CAPI_CAPIDRV is not set
+# CONFIG_ISDN_DIVERSION is not set
+# CONFIG_ISDN_DRV_ACT2000 is not set
+# CONFIG_ISDN_DRV_GIGASET is not set
+# CONFIG_ISDN_DRV_HISAX is not set
+# CONFIG_ISDN_DRV_ICN is not set
+# CONFIG_ISDN_DRV_LOOP is not set
+# CONFIG_ISDN_DRV_PCBIT is not set
+# CONFIG_ISDN_DRV_SC is not set
+# CONFIG_ISDN_I4L is not set
+# CONFIG_ISL29003 is not set
+# CONFIG_ISL29020 is not set
+# CONFIG_ISL29125 is not set
+# CONFIG_ISL29501 is not set
+# CONFIG_ISO9660_FS is not set
+# CONFIG_ISS4xx is not set
+# CONFIG_ITG3200 is not set
+# CONFIG_IWL3945 is not set
+# CONFIG_IWLWIFI is not set
+# CONFIG_IXGB is not set
+# CONFIG_IXGBE is not set
+# CONFIG_IXGBEVF is not set
+# CONFIG_JAILHOUSE_GUEST is not set
+# CONFIG_JBD2_DEBUG is not set
+# CONFIG_JFFS2_CMODE_FAVOURLZO is not set
+# CONFIG_JFFS2_CMODE_NONE is not set
+CONFIG_JFFS2_CMODE_PRIORITY=y
+# CONFIG_JFFS2_CMODE_SIZE is not set
+CONFIG_JFFS2_COMPRESSION_OPTIONS=y
+CONFIG_JFFS2_FS=y
+CONFIG_JFFS2_FS_DEBUG=0
+# CONFIG_JFFS2_FS_POSIX_ACL is not set
+# CONFIG_JFFS2_FS_SECURITY is not set
+# CONFIG_JFFS2_FS_WBUF_VERIFY is not set
+CONFIG_JFFS2_FS_WRITEBUFFER=y
+CONFIG_JFFS2_FS_XATTR=y
+CONFIG_JFFS2_LZMA=y
+# CONFIG_JFFS2_LZO is not set
+CONFIG_JFFS2_RTIME=y
+# CONFIG_JFFS2_RUBIN is not set
+CONFIG_JFFS2_SUMMARY=y
+# CONFIG_JFFS2_ZLIB is not set
+# CONFIG_JFS_DEBUG is not set
+# CONFIG_JFS_FS is not set
+# CONFIG_JFS_POSIX_ACL is not set
+# CONFIG_JFS_SECURITY is not set
+# CONFIG_JFS_STATISTICS is not set
+# CONFIG_JME is not set
+CONFIG_JOLIET=y
+# CONFIG_JSA1212 is not set
+# CONFIG_JUMP_LABEL is not set
+# CONFIG_JZ4740_WDT is not set
+# CONFIG_JZ4770_PHY is not set
+# CONFIG_KALLSYMS is not set
+# CONFIG_KALLSYMS_ABSOLUTE_PERCPU is not set
+# CONFIG_KALLSYMS_ALL is not set
+CONFIG_KALLSYMS_BASE_RELATIVE=y
+# CONFIG_KALLSYMS_SELFTEST is not set
+# CONFIG_KALLSYMS_UNCOMPRESSED is not set
+# CONFIG_KARMA_PARTITION is not set
+# CONFIG_KASAN is not set
+# CONFIG_KASAN_MODULE_TEST is not set
+CONFIG_KASAN_STACK=y
+# CONFIG_KCMP is not set
+# CONFIG_KCOV is not set
+CONFIG_KCOV_IRQ_AREA_SIZE=0x40000
+# CONFIG_KCSAN is not set
+# CONFIG_KERNEL_BZIP2 is not set
+# CONFIG_KERNEL_CAT is not set
+# CONFIG_KERNEL_GZIP is not set
+# CONFIG_KERNEL_LZ4 is not set
+# CONFIG_KERNEL_LZMA is not set
+# CONFIG_KERNEL_LZO is not set
+CONFIG_KERNEL_MODE_NEON=y
+CONFIG_KERNEL_XZ=y
+# CONFIG_KERNEL_ZSTD is not set
+CONFIG_KERNFS=y
+# CONFIG_KEXEC is not set
+# CONFIG_KEXEC_FILE is not set
+# CONFIG_KEXEC_SIG is not set
+# CONFIG_KEYBOARD_ADC is not set
+# CONFIG_KEYBOARD_ADP5588 is not set
+# CONFIG_KEYBOARD_ADP5589 is not set
+# CONFIG_KEYBOARD_APPLESPI is not set
+# CONFIG_KEYBOARD_ATKBD is not set
+# CONFIG_KEYBOARD_BCM is not set
+# CONFIG_KEYBOARD_CAP11XX is not set
+# CONFIG_KEYBOARD_CYPRESS_SF is not set
+# CONFIG_KEYBOARD_DLINK_DIR685 is not set
+# CONFIG_KEYBOARD_GPIO is not set
+# CONFIG_KEYBOARD_GPIO_POLLED is not set
+# CONFIG_KEYBOARD_LKKBD is not set
+# CONFIG_KEYBOARD_LM8323 is not set
+# CONFIG_KEYBOARD_LM8333 is not set
+# CONFIG_KEYBOARD_MATRIX is not set
+# CONFIG_KEYBOARD_MAX7359 is not set
+# CONFIG_KEYBOARD_MCS is not set
+# CONFIG_KEYBOARD_MPR121 is not set
+# CONFIG_KEYBOARD_NEWTON is not set
+# CONFIG_KEYBOARD_OMAP4 is not set
+# CONFIG_KEYBOARD_OPENCORES is not set
+# CONFIG_KEYBOARD_PINEPHONE is not set
+# CONFIG_KEYBOARD_PXA27x is not set
+# CONFIG_KEYBOARD_QT1050 is not set
+# CONFIG_KEYBOARD_QT1070 is not set
+# CONFIG_KEYBOARD_QT2160 is not set
+# CONFIG_KEYBOARD_SAMSUNG is not set
+# CONFIG_KEYBOARD_SH_KEYSC is not set
+# CONFIG_KEYBOARD_SNVS_PWRKEY is not set
+# CONFIG_KEYBOARD_STMPE is not set
+# CONFIG_KEYBOARD_STOWAWAY is not set
+# CONFIG_KEYBOARD_SUNKBD is not set
+# CONFIG_KEYBOARD_TCA6416 is not set
+# CONFIG_KEYBOARD_TCA8418 is not set
+# CONFIG_KEYBOARD_TEGRA is not set
+# CONFIG_KEYBOARD_TM2_TOUCHKEY is not set
+# CONFIG_KEYBOARD_TWL4030 is not set
+# CONFIG_KEYBOARD_XTKBD is not set
+# CONFIG_KEYS is not set
+# CONFIG_KEYS_REQUEST_CACHE is not set
+# CONFIG_KEY_DH_OPERATIONS is not set
+# CONFIG_KFENCE is not set
+# CONFIG_KGDB is not set
+# CONFIG_KMEMCHECK is not set
+# CONFIG_KMX61 is not set
+# CONFIG_KPC2000 is not set
+# CONFIG_KPROBES is not set
+# CONFIG_KPROBES_SANITY_TEST is not set
+# CONFIG_KPROBE_EVENTS_ON_NOTRACE is not set
+# CONFIG_KPROBE_EVENT_GEN_TEST is not set
+# CONFIG_KS7010 is not set
+# CONFIG_KS8842 is not set
+# CONFIG_KS8851 is not set
+# CONFIG_KS8851_MLL is not set
+# CONFIG_KSM is not set
+# CONFIG_KSZ884X_PCI is not set
+# CONFIG_KUNIT is not set
+CONFIG_KUSER_HELPERS=y
+# CONFIG_KVM_AMD is not set
+# CONFIG_KVM_AMD_SEV is not set
+# CONFIG_KVM_GUEST is not set
+# CONFIG_KVM_INTEL is not set
+# CONFIG_KVM_PROVE_MMU is not set
+# CONFIG_KVM_SMM is not set
+# CONFIG_KVM_WERROR is not set
+# CONFIG_KVM_XEN is not set
+# CONFIG_KXCJK1013 is not set
+# CONFIG_KXSD9 is not set
+# CONFIG_L2TP is not set
+# CONFIG_L2TP_ETH is not set
+# CONFIG_L2TP_IP is not set
+# CONFIG_L2TP_V3 is not set
+# CONFIG_LAN743X is not set
+# CONFIG_LAN966X_SWITCH is not set
+# CONFIG_LANMEDIA is not set
+# CONFIG_LANTIQ is not set
+# CONFIG_LAPB is not set
+# CONFIG_LASAT is not set
+# CONFIG_LATENCYTOP is not set
+# CONFIG_LATTICE_ECP3_CONFIG is not set
+CONFIG_LBDAF=y
+# CONFIG_LCD_AMS369FG06 is not set
+# CONFIG_LCD_CLASS_DEVICE is not set
+# CONFIG_LCD_HX8357 is not set
+# CONFIG_LCD_ILI922X is not set
+# CONFIG_LCD_ILI9320 is not set
+# CONFIG_LCD_L4F00242T03 is not set
+# CONFIG_LCD_LD9040 is not set
+# CONFIG_LCD_LMS283GF05 is not set
+# CONFIG_LCD_LMS501KF03 is not set
+# CONFIG_LCD_LTV350QV is not set
+# CONFIG_LCD_OTM3225A is not set
+# CONFIG_LCD_S6E63M0 is not set
+# CONFIG_LCD_TDO24M is not set
+# CONFIG_LCD_VGG2432A4 is not set
+CONFIG_LDISC_AUTOLOAD=y
+# CONFIG_LDM_PARTITION is not set
+CONFIG_LD_DEAD_CODE_DATA_ELIMINATION=y
+# CONFIG_LD_HEAD_STUB_CATCH is not set
+# CONFIG_LEDS_AN30259A is not set
+# CONFIG_LEDS_APU is not set
+# CONFIG_LEDS_AW2013 is not set
+# CONFIG_LEDS_BCM6328 is not set
+# CONFIG_LEDS_BCM6358 is not set
+# CONFIG_LEDS_BD2802 is not set
+# CONFIG_LEDS_BLINKM is not set
+CONFIG_LEDS_BRIGHTNESS_HW_CHANGED=y
+CONFIG_LEDS_CLASS=y
+# CONFIG_LEDS_CLASS_FLASH is not set
+CONFIG_LEDS_CLASS_MULTICOLOR=y
+# CONFIG_LEDS_CR0014114 is not set
+# CONFIG_LEDS_DAC124S085 is not set
+# CONFIG_LEDS_EL15203000 is not set
+# CONFIG_LEDS_GPIO is not set
+# CONFIG_LEDS_INTEL_SS4200 is not set
+# CONFIG_LEDS_IS31FL319X is not set
+# CONFIG_LEDS_IS31FL32XX is not set
+# CONFIG_LEDS_LM3530 is not set
+# CONFIG_LEDS_LM3532 is not set
+# CONFIG_LEDS_LM355x is not set
+# CONFIG_LEDS_LM3642 is not set
+# CONFIG_LEDS_LM3692X is not set
+# CONFIG_LEDS_LP3944 is not set
+# CONFIG_LEDS_LP3952 is not set
+# CONFIG_LEDS_LP50XX is not set
+# CONFIG_LEDS_LP5521 is not set
+# CONFIG_LEDS_LP5523 is not set
+# CONFIG_LEDS_LP5562 is not set
+# CONFIG_LEDS_LP55XX_COMMON is not set
+# CONFIG_LEDS_LP8501 is not set
+# CONFIG_LEDS_LP8860 is not set
+# CONFIG_LEDS_LT3593 is not set
+# CONFIG_LEDS_MLXCPLD is not set
+# CONFIG_LEDS_MLXREG is not set
+# CONFIG_LEDS_NIC78BX is not set
+# CONFIG_LEDS_NS2 is not set
+# CONFIG_LEDS_OT200 is not set
+# CONFIG_LEDS_PCA9532 is not set
+# CONFIG_LEDS_PCA955X is not set
+# CONFIG_LEDS_PCA963X is not set
+# CONFIG_LEDS_PWM is not set
+# CONFIG_LEDS_PWM_MULTICOLOR is not set
+# CONFIG_LEDS_REGULATOR is not set
+# CONFIG_LEDS_SPI_BYTE is not set
+# CONFIG_LEDS_SYSCON is not set
+# CONFIG_LEDS_TCA6507 is not set
+# CONFIG_LEDS_TI_LMU_COMMON is not set
+# CONFIG_LEDS_TLC591XX is not set
+CONFIG_LEDS_TRIGGERS=y
+# CONFIG_LEDS_TRIGGER_ACTIVITY is not set
+# CONFIG_LEDS_TRIGGER_AUDIO is not set
+# CONFIG_LEDS_TRIGGER_BACKLIGHT is not set
+# CONFIG_LEDS_TRIGGER_CAMERA is not set
+# CONFIG_LEDS_TRIGGER_CPU is not set
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+# CONFIG_LEDS_TRIGGER_DISK is not set
+# CONFIG_LEDS_TRIGGER_GPIO is not set
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+# CONFIG_LEDS_TRIGGER_MTD is not set
+CONFIG_LEDS_TRIGGER_NETDEV=y
+# CONFIG_LEDS_TRIGGER_ONESHOT is not set
+# CONFIG_LEDS_TRIGGER_PANIC is not set
+# CONFIG_LEDS_TRIGGER_PATTERN is not set
+CONFIG_LEDS_TRIGGER_TIMER=y
+# CONFIG_LEDS_TRIGGER_TRANSIENT is not set
+# CONFIG_LEDS_TRIGGER_TTY is not set
+# CONFIG_LEDS_TURRIS_OMNIA is not set
+# CONFIG_LEDS_USER is not set
+# CONFIG_LED_TRIGGER_PHY is not set
+# CONFIG_LEGACY_PTYS is not set
+# CONFIG_LG_LAPTOP is not set
+# CONFIG_LGUEST is not set
+# CONFIG_LIB80211 is not set
+# CONFIG_LIB80211_CRYPT_CCMP is not set
+# CONFIG_LIB80211_CRYPT_TKIP is not set
+# CONFIG_LIB80211_CRYPT_WEP is not set
+# CONFIG_LIB80211_DEBUG is not set
+# CONFIG_LIBCRC32C is not set
+# CONFIG_LIBERTAS is not set
+# CONFIG_LIBERTAS_THINFIRM is not set
+# CONFIG_LIBERTAS_USB is not set
+# CONFIG_LIBFC is not set
+# CONFIG_LIBFCOE is not set
+# CONFIG_LIBIPW_DEBUG is not set
+# CONFIG_LIBNVDIMM is not set
+CONFIG_LIB_MEMNEQ=y
+# CONFIG_LIDAR_LITE_V2 is not set
+CONFIG_LINEAR_RANGES=y
+# CONFIG_LIQUIDIO is not set
+# CONFIG_LIQUIDIO_VF is not set
+# CONFIG_LIRC is not set
+# CONFIG_LIS3L02DQ is not set
+# CONFIG_LITEX_LITEETH is not set
+# CONFIG_LITEX_SOC_CONTROLLER is not set
+# CONFIG_LIVEPATCH is not set
+# CONFIG_LKDTM is not set
+CONFIG_LLC=y
+# CONFIG_LLC2 is not set
+# CONFIG_LMK04832 is not set
+# CONFIG_LMP91000 is not set
+# CONFIG_LNET is not set
+CONFIG_LOCALVERSION=""
+# CONFIG_LOCALVERSION_AUTO is not set
+# CONFIG_LOCKD is not set
+CONFIG_LOCKDEP_BITS=15
+CONFIG_LOCKDEP_CHAINS_BITS=16
+CONFIG_LOCKDEP_CIRCULAR_QUEUE_BITS=12
+CONFIG_LOCKDEP_STACK_TRACE_BITS=19
+CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS=14
+CONFIG_LOCKDEP_SUPPORT=y
+CONFIG_LOCKD_V4=y
+# CONFIG_LOCKUP_DETECTOR is not set
+# CONFIG_LOCK_EVENT_COUNTS is not set
+# CONFIG_LOCK_STAT is not set
+# CONFIG_LOCK_TORTURE_TEST is not set
+# CONFIG_LOGFS is not set
+# CONFIG_LOGIG940_FF is not set
+# CONFIG_LOGIRUMBLEPAD2_FF is not set
+# CONFIG_LOGITECH_FF is not set
+# CONFIG_LOGIWHEELS_FF is not set
+# CONFIG_LOGO is not set
+CONFIG_LOG_BUF_SHIFT=17
+CONFIG_LOG_CPU_MAX_BUF_SHIFT=12
+# CONFIG_LOONGSON_MC146818 is not set
+# CONFIG_LPC_ICH is not set
+# CONFIG_LPC_SCH is not set
+# CONFIG_LP_CONSOLE is not set
+CONFIG_LRU_GEN=y
+CONFIG_LRU_GEN_ENABLED=y
+# CONFIG_LRU_GEN_STATS is not set
+# CONFIG_LSI_ET1011C_PHY is not set
+CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity"
+CONFIG_LSM_MMAP_MIN_ADDR=65536
+# CONFIG_LTC1660 is not set
+# CONFIG_LTC2471 is not set
+# CONFIG_LTC2485 is not set
+# CONFIG_LTC2496 is not set
+# CONFIG_LTC2497 is not set
+# CONFIG_LTC2632 is not set
+# CONFIG_LTC2688 is not set
+# CONFIG_LTC2983 is not set
+# CONFIG_LTE_GDM724X is not set
+CONFIG_LTO_NONE=y
+# CONFIG_LTPC is not set
+# CONFIG_LTR501 is not set
+# CONFIG_LTRF216A is not set
+# CONFIG_LUSTRE_FS is not set
+# CONFIG_LV0104CS is not set
+# CONFIG_LWTUNNEL is not set
+# CONFIG_LXT_PHY is not set
+# CONFIG_LZ4HC_COMPRESS is not set
+# CONFIG_LZ4_COMPRESS is not set
+# CONFIG_LZ4_DECOMPRESS is not set
+CONFIG_LZMA_COMPRESS=y
+CONFIG_LZMA_DECOMPRESS=y
+# CONFIG_LZO_COMPRESS is not set
+# CONFIG_LZO_DECOMPRESS is not set
+# CONFIG_M62332 is not set
+# CONFIG_MAC80211 is not set
+# CONFIG_MAC80211_MESSAGE_TRACING is not set
+CONFIG_MAC80211_STA_HASH_MAX_SIZE=0
+# CONFIG_MACB is not set
+# CONFIG_MACH_ASM9260 is not set
+# CONFIG_MACH_DECSTATION is not set
+# CONFIG_MACH_INGENIC is not set
+# CONFIG_MACH_INGENIC_SOC is not set
+# CONFIG_MACH_JAZZ is not set
+# CONFIG_MACH_JZ4740 is not set
+# CONFIG_MACH_LOONGSON2EF is not set
+# CONFIG_MACH_LOONGSON32 is not set
+# CONFIG_MACH_LOONGSON64 is not set
+# CONFIG_MACH_NINTENDO64 is not set
+# CONFIG_MACH_PIC32 is not set
+# CONFIG_MACH_PISTACHIO is not set
+# CONFIG_MACH_REALTEK_RTL is not set
+# CONFIG_MACH_TX39XX is not set
+# CONFIG_MACH_TX49XX is not set
+# CONFIG_MACH_VR41XX is not set
+# CONFIG_MACH_XILFPGA is not set
+# CONFIG_MACINTOSH_DRIVERS is not set
+# CONFIG_MACSEC is not set
+# CONFIG_MACVLAN is not set
+# CONFIG_MACVTAP is not set
+# CONFIG_MAC_EMUMOUSEBTN is not set
+# CONFIG_MAC_PARTITION is not set
+# CONFIG_MAG3110 is not set
+# CONFIG_MAGIC_SYSRQ is not set
+CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0x1
+# CONFIG_MAGIC_SYSRQ_SERIAL is not set
+CONFIG_MAGIC_SYSRQ_SERIAL_SEQUENCE=""
+# CONFIG_MAILBOX is not set
+# CONFIG_MANAGER_SBS is not set
+# CONFIG_MANDATORY_FILE_LOCKING is not set
+# CONFIG_MANGLE_BOOTARGS is not set
+# CONFIG_MARVELL_10G_PHY is not set
+# CONFIG_MARVELL_88X2222_PHY is not set
+# CONFIG_MARVELL_PHY is not set
+# CONFIG_MAX1027 is not set
+# CONFIG_MAX11100 is not set
+# CONFIG_MAX1118 is not set
+# CONFIG_MAX11205 is not set
+# CONFIG_MAX1241 is not set
+# CONFIG_MAX1363 is not set
+# CONFIG_MAX30100 is not set
+# CONFIG_MAX30102 is not set
+# CONFIG_MAX31856 is not set
+# CONFIG_MAX31865 is not set
+# CONFIG_MAX44000 is not set
+# CONFIG_MAX44009 is not set
+# CONFIG_MAX517 is not set
+# CONFIG_MAX5432 is not set
+# CONFIG_MAX5481 is not set
+# CONFIG_MAX5487 is not set
+# CONFIG_MAX5821 is not set
+# CONFIG_MAX63XX_WATCHDOG is not set
+# CONFIG_MAX9611 is not set
+# CONFIG_MAXIM_THERMOCOUPLE is not set
+# CONFIG_MAXLINEAR_GPHY is not set
+CONFIG_MAX_SKB_FRAGS=17
+CONFIG_MAY_USE_DEVLINK=y
+# CONFIG_MB1232 is not set
+# CONFIG_MC3230 is not set
+# CONFIG_MCB is not set
+# CONFIG_MCP320X is not set
+# CONFIG_MCP3422 is not set
+# CONFIG_MCP3911 is not set
+# CONFIG_MCP4018 is not set
+# CONFIG_MCP41010 is not set
+# CONFIG_MCP4131 is not set
+# CONFIG_MCP4531 is not set
+# CONFIG_MCP4725 is not set
+# CONFIG_MCP4922 is not set
+# CONFIG_MCPM is not set
+# CONFIG_MCTP is not set
+# CONFIG_MD is not set
+# CONFIG_MDIO_BCM_UNIMAC is not set
+# CONFIG_MDIO_BITBANG is not set
+# CONFIG_MDIO_BUS_MUX_GPIO is not set
+# CONFIG_MDIO_BUS_MUX_MMIOREG is not set
+# CONFIG_MDIO_BUS_MUX_MULTIPLEXER is not set
+# CONFIG_MDIO_DEVICE is not set
+# CONFIG_MDIO_DEVRES is not set
+# CONFIG_MDIO_HISI_FEMAC is not set
+# CONFIG_MDIO_IPQ4019 is not set
+# CONFIG_MDIO_IPQ8064 is not set
+# CONFIG_MDIO_MSCC_MIIM is not set
+# CONFIG_MDIO_MVUSB is not set
+# CONFIG_MDIO_OCTEON is not set
+# CONFIG_MDIO_THUNDER is not set
+# CONFIG_MDIO_XPCS is not set
+# CONFIG_MDM_GCC_9607 is not set
+# CONFIG_MD_FAULTY is not set
+# CONFIG_MEDIATEK_GE_PHY is not set
+# CONFIG_MEDIATEK_MT6577_AUXADC is not set
+# CONFIG_MEDIA_ANALOG_TV_SUPPORT is not set
+# CONFIG_MEDIA_ATTACH is not set
+# CONFIG_MEDIA_CAMERA_SUPPORT is not set
+# CONFIG_MEDIA_CEC_SUPPORT is not set
+# CONFIG_MEDIA_CONTROLLER is not set
+# CONFIG_MEDIA_CONTROLLER_DVB is not set
+# CONFIG_MEDIA_DIGITAL_TV_SUPPORT is not set
+# CONFIG_MEDIA_PCI_SUPPORT is not set
+# CONFIG_MEDIA_PLATFORM_DRIVERS is not set
+# CONFIG_MEDIA_PLATFORM_SUPPORT is not set
+# CONFIG_MEDIA_RADIO_SUPPORT is not set
+# CONFIG_MEDIA_RC_SUPPORT is not set
+# CONFIG_MEDIA_SDR_SUPPORT is not set
+# CONFIG_MEDIA_SUBDRV_AUTOSELECT is not set
+# CONFIG_MEDIA_SUPPORT is not set
+# CONFIG_MEDIA_SUPPORT_FILTER is not set
+# CONFIG_MEDIA_TEST_SUPPORT is not set
+# CONFIG_MEDIA_TUNER_E4000 is not set
+# CONFIG_MEDIA_TUNER_FC0011 is not set
+# CONFIG_MEDIA_TUNER_FC0012 is not set
+# CONFIG_MEDIA_TUNER_FC0013 is not set
+# CONFIG_MEDIA_TUNER_FC2580 is not set
+# CONFIG_MEDIA_TUNER_IT913X is not set
+# CONFIG_MEDIA_TUNER_M88RS6000T is not set
+# CONFIG_MEDIA_TUNER_MAX2165 is not set
+# CONFIG_MEDIA_TUNER_MC44S803 is not set
+# CONFIG_MEDIA_TUNER_MSI001 is not set
+# CONFIG_MEDIA_TUNER_MT2060 is not set
+# CONFIG_MEDIA_TUNER_MT2063 is not set
+# CONFIG_MEDIA_TUNER_MT20XX is not set
+# CONFIG_MEDIA_TUNER_MT2131 is not set
+# CONFIG_MEDIA_TUNER_MT2266 is not set
+# CONFIG_MEDIA_TUNER_MXL301RF is not set
+# CONFIG_MEDIA_TUNER_MXL5005S is not set
+# CONFIG_MEDIA_TUNER_MXL5007T is not set
+# CONFIG_MEDIA_TUNER_QM1D1B0004 is not set
+# CONFIG_MEDIA_TUNER_QM1D1C0042 is not set
+# CONFIG_MEDIA_TUNER_QT1010 is not set
+# CONFIG_MEDIA_TUNER_R820T is not set
+# CONFIG_MEDIA_TUNER_SI2157 is not set
+# CONFIG_MEDIA_TUNER_SIMPLE is not set
+# CONFIG_MEDIA_TUNER_TDA18212 is not set
+# CONFIG_MEDIA_TUNER_TDA18218 is not set
+# CONFIG_MEDIA_TUNER_TDA18250 is not set
+# CONFIG_MEDIA_TUNER_TDA18271 is not set
+# CONFIG_MEDIA_TUNER_TDA827X is not set
+# CONFIG_MEDIA_TUNER_TDA8290 is not set
+# CONFIG_MEDIA_TUNER_TDA9887 is not set
+# CONFIG_MEDIA_TUNER_TEA5761 is not set
+# CONFIG_MEDIA_TUNER_TEA5767 is not set
+# CONFIG_MEDIA_TUNER_TUA9001 is not set
+# CONFIG_MEDIA_TUNER_XC2028 is not set
+# CONFIG_MEDIA_TUNER_XC4000 is not set
+# CONFIG_MEDIA_TUNER_XC5000 is not set
+# CONFIG_MEDIA_USB_SUPPORT is not set
+# CONFIG_MEGARAID_LEGACY is not set
+# CONFIG_MEGARAID_NEWGEN is not set
+# CONFIG_MEGARAID_SAS is not set
+# CONFIG_MELLANOX_PLATFORM is not set
+CONFIG_MEMBARRIER=y
+# CONFIG_MEMORY is not set
+# CONFIG_MEMORY_FAILURE is not set
+# CONFIG_MEMORY_HOTPLUG is not set
+# CONFIG_MEMSTICK is not set
+# CONFIG_MEMTEST is not set
+# CONFIG_MEN_A21_WDT is not set
+# CONFIG_MESON_SM is not set
+CONFIG_MESSAGE_LOGLEVEL_DEFAULT=4
+# CONFIG_MFD_88PM800 is not set
+# CONFIG_MFD_88PM805 is not set
+# CONFIG_MFD_88PM860X is not set
+# CONFIG_MFD_AAT2870_CORE is not set
+# CONFIG_MFD_AC100 is not set
+# CONFIG_MFD_ACT8945A is not set
+# CONFIG_MFD_ARIZONA_I2C is not set
+# CONFIG_MFD_ARIZONA_SPI is not set
+# CONFIG_MFD_AS3711 is not set
+# CONFIG_MFD_AS3722 is not set
+# CONFIG_MFD_ASIC3 is not set
+# CONFIG_MFD_ATC260X_I2C is not set
+# CONFIG_MFD_ATMEL_FLEXCOM is not set
+# CONFIG_MFD_ATMEL_HLCDC is not set
+# CONFIG_MFD_AXP20X is not set
+# CONFIG_MFD_AXP20X_I2C is not set
+# CONFIG_MFD_BCM590XX is not set
+# CONFIG_MFD_BD9571MWV is not set
+# CONFIG_MFD_CORE is not set
+# CONFIG_MFD_CPCAP is not set
+# CONFIG_MFD_CROS_EC is not set
+# CONFIG_MFD_CS5535 is not set
+# CONFIG_MFD_DA9052_I2C is not set
+# CONFIG_MFD_DA9052_SPI is not set
+# CONFIG_MFD_DA9055 is not set
+# CONFIG_MFD_DA9062 is not set
+# CONFIG_MFD_DA9063 is not set
+# CONFIG_MFD_DA9150 is not set
+# CONFIG_MFD_DLN2 is not set
+# CONFIG_MFD_EXYNOS_LPASS is not set
+# CONFIG_MFD_GATEWORKS_GSC is not set
+# CONFIG_MFD_HI6421_PMIC is not set
+# CONFIG_MFD_INTEL_M10_BMC is not set
+# CONFIG_MFD_INTEL_PMT is not set
+# CONFIG_MFD_INTEL_QUARK_I2C_GPIO is not set
+# CONFIG_MFD_IQS62X is not set
+# CONFIG_MFD_JANZ_CMODIO is not set
+# CONFIG_MFD_KEMPLD is not set
+# CONFIG_MFD_LM3533 is not set
+# CONFIG_MFD_LOCHNAGAR is not set
+# CONFIG_MFD_LP3943 is not set
+# CONFIG_MFD_LP8788 is not set
+# CONFIG_MFD_MADERA is not set
+# CONFIG_MFD_MAX14577 is not set
+# CONFIG_MFD_MAX77620 is not set
+# CONFIG_MFD_MAX77650 is not set
+# CONFIG_MFD_MAX77686 is not set
+# CONFIG_MFD_MAX77693 is not set
+# CONFIG_MFD_MAX77714 is not set
+# CONFIG_MFD_MAX77843 is not set
+# CONFIG_MFD_MAX8907 is not set
+# CONFIG_MFD_MAX8925 is not set
+# CONFIG_MFD_MAX8997 is not set
+# CONFIG_MFD_MAX8998 is not set
+# CONFIG_MFD_MC13XXX is not set
+# CONFIG_MFD_MC13XXX_I2C is not set
+# CONFIG_MFD_MC13XXX_SPI is not set
+# CONFIG_MFD_MENF21BMC is not set
+# CONFIG_MFD_MP2629 is not set
+# CONFIG_MFD_MT6360 is not set
+# CONFIG_MFD_MT6370 is not set
+# CONFIG_MFD_MT6397 is not set
+# CONFIG_MFD_NTXEC is not set
+# CONFIG_MFD_OCELOT is not set
+# CONFIG_MFD_OMAP_USB_HOST is not set
+# CONFIG_MFD_PALMAS is not set
+# CONFIG_MFD_PCF50633 is not set
+# CONFIG_MFD_PM8921_CORE is not set
+# CONFIG_MFD_PM8XXX is not set
+# CONFIG_MFD_QCOM_PM8008 is not set
+# CONFIG_MFD_RC5T583 is not set
+# CONFIG_MFD_RDC321X is not set
+# CONFIG_MFD_RETU is not set
+# CONFIG_MFD_RK808 is not set
+# CONFIG_MFD_RN5T618 is not set
+# CONFIG_MFD_ROHM_BD70528 is not set
+# CONFIG_MFD_ROHM_BD71828 is not set
+# CONFIG_MFD_ROHM_BD718XX is not set
+# CONFIG_MFD_ROHM_BD957XMUF is not set
+# CONFIG_MFD_RSMU_I2C is not set
+# CONFIG_MFD_RSMU_SPI is not set
+# CONFIG_MFD_RT4831 is not set
+# CONFIG_MFD_RT5033 is not set
+# CONFIG_MFD_RT5120 is not set
+# CONFIG_MFD_RTSX_PCI is not set
+# CONFIG_MFD_RTSX_USB is not set
+# CONFIG_MFD_SEC_CORE is not set
+# CONFIG_MFD_SI476X_CORE is not set
+# CONFIG_MFD_SKY81452 is not set
+# CONFIG_MFD_SL28CPLD is not set
+# CONFIG_MFD_SM501 is not set
+# CONFIG_MFD_SMSC is not set
+# CONFIG_MFD_STMFX is not set
+# CONFIG_MFD_STMPE is not set
+# CONFIG_MFD_STPMIC1 is not set
+# CONFIG_MFD_SY7636A is not set
+# CONFIG_MFD_SYSCON is not set
+# CONFIG_MFD_T7L66XB is not set
+# CONFIG_MFD_TC3589X is not set
+# CONFIG_MFD_TC6387XB is not set
+# CONFIG_MFD_TC6393XB is not set
+# CONFIG_MFD_TIMBERDALE is not set
+# CONFIG_MFD_TI_AM335X_TSCADC is not set
+# CONFIG_MFD_TI_LMU is not set
+# CONFIG_MFD_TI_LP873X is not set
+# CONFIG_MFD_TI_LP87565 is not set
+# CONFIG_MFD_TMIO is not set
+# CONFIG_MFD_TPS65086 is not set
+# CONFIG_MFD_TPS65090 is not set
+# CONFIG_MFD_TPS65217 is not set
+# CONFIG_MFD_TPS65218 is not set
+# CONFIG_MFD_TPS6586X is not set
+# CONFIG_MFD_TPS65910 is not set
+# CONFIG_MFD_TPS65912 is not set
+# CONFIG_MFD_TPS65912_I2C is not set
+# CONFIG_MFD_TPS65912_SPI is not set
+# CONFIG_MFD_TPS68470 is not set
+# CONFIG_MFD_TPS80031 is not set
+# CONFIG_MFD_TQMX86 is not set
+# CONFIG_MFD_VIPERBOARD is not set
+# CONFIG_MFD_VX855 is not set
+# CONFIG_MFD_WL1273_CORE is not set
+# CONFIG_MFD_WM831X is not set
+# CONFIG_MFD_WM831X_I2C is not set
+# CONFIG_MFD_WM831X_SPI is not set
+# CONFIG_MFD_WM8350_I2C is not set
+# CONFIG_MFD_WM8400 is not set
+# CONFIG_MFD_WM8994 is not set
+# CONFIG_MG_DISK is not set
+# CONFIG_MHI_BUS is not set
+# CONFIG_MHI_BUS_DEBUG is not set
+# CONFIG_MHI_BUS_EP is not set
+# CONFIG_MHI_BUS_PCI_GENERIC is not set
+# CONFIG_MHI_NET is not set
+# CONFIG_MHI_WWAN_CTRL is not set
+# CONFIG_MHI_WWAN_MBIM is not set
+# CONFIG_MICREL_KS8995MA is not set
+# CONFIG_MICREL_PHY is not set
+# CONFIG_MICROCHIP_KSZ is not set
+# CONFIG_MICROCHIP_PHY is not set
+# CONFIG_MICROCHIP_PIT64B is not set
+# CONFIG_MICROCHIP_T1_PHY is not set
+# CONFIG_MICROSEMI_PHY is not set
+# CONFIG_MIGRATION is not set
+CONFIG_MII=y
+# CONFIG_MIKROTIK is not set
+# CONFIG_MIKROTIK_RB532 is not set
+# CONFIG_MINIX_FS is not set
+# CONFIG_MINIX_FS_NATIVE_ENDIAN is not set
+# CONFIG_MINIX_SUBPARTITION is not set
+# CONFIG_MIPS32_N32 is not set
+# CONFIG_MIPS32_O32 is not set
+# CONFIG_MIPS_ALCHEMY is not set
+# CONFIG_MIPS_CDMM is not set
+# CONFIG_MIPS_CMDLINE_DTB_EXTEND is not set
+# CONFIG_MIPS_CMDLINE_FROM_DTB is not set
+# CONFIG_MIPS_CMP is not set
+# CONFIG_MIPS_COBALT is not set
+# CONFIG_MIPS_CPS is not set
+# CONFIG_MIPS_ELF_APPENDED_DTB is not set
+# CONFIG_MIPS_FPU_EMULATOR is not set
+# CONFIG_MIPS_FP_SUPPORT is not set
+# CONFIG_MIPS_GENERIC is not set
+# CONFIG_MIPS_GENERIC_KERNEL is not set
+# CONFIG_MIPS_MALTA is not set
+# CONFIG_MIPS_O32_FP64_SUPPORT is not set
+# CONFIG_MIPS_PARAVIRT is not set
+# CONFIG_MIPS_PLATFORM_DEVICES is not set
+# CONFIG_MIPS_RAW_APPENDED_DTB is not set
+# CONFIG_MIPS_SEAD3 is not set
+# CONFIG_MIPS_VA_BITS_48 is not set
+# CONFIG_MIPS_VPE_LOADER is not set
+# CONFIG_MISC_ALCOR_PCI is not set
+CONFIG_MISC_FILESYSTEMS=y
+# CONFIG_MISC_RTSX_PCI is not set
+# CONFIG_MISC_RTSX_USB is not set
+# CONFIG_MISDN is not set
+# CONFIG_MISDN_AVMFRITZ is not set
+# CONFIG_MISDN_HFCPCI is not set
+# CONFIG_MISDN_HFCUSB is not set
+# CONFIG_MISDN_INFINEON is not set
+# CONFIG_MISDN_NETJET is not set
+# CONFIG_MISDN_SPEEDFAX is not set
+# CONFIG_MISDN_W6692 is not set
+CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY=y
+# CONFIG_MKISS is not set
+# CONFIG_MLX4_CORE is not set
+# CONFIG_MLX4_EN is not set
+# CONFIG_MLX5_CORE is not set
+# CONFIG_MLX5_EN_MACSEC is not set
+# CONFIG_MLX5_SF is not set
+# CONFIG_MLX5_VFIO_PCI is not set
+# CONFIG_MLX90614 is not set
+# CONFIG_MLX90632 is not set
+# CONFIG_MLXFW is not set
+# CONFIG_MLXSW_CORE is not set
+# CONFIG_MLX_CPLD_PLATFORM is not set
+# CONFIG_MLX_PLATFORM is not set
+# CONFIG_MMA7455_I2C is not set
+# CONFIG_MMA7455_SPI is not set
+# CONFIG_MMA7660 is not set
+# CONFIG_MMA8452 is not set
+# CONFIG_MMA9551 is not set
+# CONFIG_MMA9553 is not set
+# CONFIG_MMC is not set
+# CONFIG_MMC35240 is not set
+# CONFIG_MMC_ARMMMCI is not set
+# CONFIG_MMC_AU1X is not set
+# CONFIG_MMC_BLOCK is not set
+CONFIG_MMC_BLOCK_BOUNCE=y
+CONFIG_MMC_BLOCK_MINORS=8
+# CONFIG_MMC_CAVIUM_THUNDERX is not set
+# CONFIG_MMC_CB710 is not set
+# CONFIG_MMC_CQHCI is not set
+# CONFIG_MMC_DEBUG is not set
+# CONFIG_MMC_DW is not set
+# CONFIG_MMC_HSQ is not set
+# CONFIG_MMC_JZ4740 is not set
+# CONFIG_MMC_MTK is not set
+# CONFIG_MMC_MVSDIO is not set
+# CONFIG_MMC_S3C is not set
+# CONFIG_MMC_SDHCI is not set
+# CONFIG_MMC_SDHCI_ACPI is not set
+# CONFIG_MMC_SDHCI_AM654 is not set
+# CONFIG_MMC_SDHCI_BCM_KONA is not set
+# CONFIG_MMC_SDHCI_BRCMSTB is not set
+# CONFIG_MMC_SDHCI_CADENCE is not set
+# CONFIG_MMC_SDHCI_F_SDH30 is not set
+# CONFIG_MMC_SDHCI_IPROC is not set
+# CONFIG_MMC_SDHCI_MILBEAUT is not set
+# CONFIG_MMC_SDHCI_MSM is not set
+# CONFIG_MMC_SDHCI_OF_ARASAN is not set
+# CONFIG_MMC_SDHCI_OF_ASPEED is not set
+# CONFIG_MMC_SDHCI_OF_AT91 is not set
+# CONFIG_MMC_SDHCI_OF_DWCMSHC is not set
+# CONFIG_MMC_SDHCI_OF_ESDHC is not set
+# CONFIG_MMC_SDHCI_OF_HLWD is not set
+# CONFIG_MMC_SDHCI_OMAP is not set
+# CONFIG_MMC_SDHCI_PXAV2 is not set
+# CONFIG_MMC_SDHCI_PXAV3 is not set
+# CONFIG_MMC_SDHCI_S3C is not set
+# CONFIG_MMC_SDHCI_XENON is not set
+# CONFIG_MMC_SDRICOH_CS is not set
+# CONFIG_MMC_SPI is not set
+# CONFIG_MMC_STM32_SDMMC is not set
+# CONFIG_MMC_TEST is not set
+# CONFIG_MMC_TIFM_SD is not set
+# CONFIG_MMC_TOSHIBA_PCI is not set
+# CONFIG_MMC_USDHI6ROL0 is not set
+# CONFIG_MMC_USHC is not set
+# CONFIG_MMC_VIA_SDMMC is not set
+# CONFIG_MMC_VUB300 is not set
+# CONFIG_MMIOTRACE is not set
+CONFIG_MMU=y
+CONFIG_MMU_GATHER_RCU_TABLE_FREE=y
+CONFIG_MMU_GATHER_TABLE_FREE=y
+CONFIG_MODPROBE_PATH="/sbin/modprobe"
+CONFIG_MODULES=y
+# CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS is not set
+# CONFIG_MODULE_COMPRESS is not set
+# CONFIG_MODULE_COMPRESS_GZIP is not set
+CONFIG_MODULE_COMPRESS_NONE=y
+# CONFIG_MODULE_COMPRESS_XZ is not set
+# CONFIG_MODULE_COMPRESS_ZSTD is not set
+# CONFIG_MODULE_DEBUG is not set
+# CONFIG_MODULE_FORCE_LOAD is not set
+# CONFIG_MODULE_FORCE_UNLOAD is not set
+# CONFIG_MODULE_SIG is not set
+# CONFIG_MODULE_SRCVERSION_ALL is not set
+CONFIG_MODULE_STRIPPED=y
+CONFIG_MODULE_UNLOAD=y
+# CONFIG_MODULE_UNLOAD_TAINT_TRACKING is not set
+# CONFIG_MODVERSIONS is not set
+# CONFIG_MOST is not set
+# CONFIG_MOTORCOMM_PHY is not set
+# CONFIG_MOUSE_APPLETOUCH is not set
+# CONFIG_MOUSE_ELAN_I2C is not set
+# CONFIG_MOUSE_GPIO is not set
+# CONFIG_MOUSE_INPORT is not set
+# CONFIG_MOUSE_LOGIBM is not set
+# CONFIG_MOUSE_PC110PAD is not set
+# CONFIG_MOUSE_PS2_FOCALTECH is not set
+# CONFIG_MOUSE_PS2_SENTELIC is not set
+# CONFIG_MOUSE_SYNAPTICS_I2C is not set
+# CONFIG_MOUSE_SYNAPTICS_USB is not set
+# CONFIG_MOXTET is not set
+# CONFIG_MPL115 is not set
+# CONFIG_MPL115_I2C is not set
+# CONFIG_MPL115_SPI is not set
+# CONFIG_MPL3115 is not set
+# CONFIG_MPLS is not set
+# CONFIG_MPLS_IPTUNNEL is not set
+# CONFIG_MPLS_ROUTING is not set
+CONFIG_MPTCP=y
+CONFIG_MPTCP_IPV6=y
+# CONFIG_MPU3050_I2C is not set
+# CONFIG_MQ_IOSCHED_DEADLINE is not set
+# CONFIG_MQ_IOSCHED_KYBER is not set
+# CONFIG_MS5611 is not set
+# CONFIG_MS5637 is not set
+# CONFIG_MSA311 is not set
+# CONFIG_MSCC_OCELOT_SWITCH is not set
+# CONFIG_MSDOS_FS is not set
+CONFIG_MSDOS_PARTITION=y
+# CONFIG_MSE102X is not set
+# CONFIG_MSI_BITMAP_SELFTEST is not set
+# CONFIG_MSI_LAPTOP is not set
+# CONFIG_MSI_WMI is not set
+# CONFIG_MSM_GCC_8953 is not set
+# CONFIG_MSM_MMCC_8994 is not set
+# CONFIG_MST_IRQ is not set
+CONFIG_MTD=y
+# CONFIG_MTD_ABSENT is not set
+# CONFIG_MTD_AFS_PARTS is not set
+# CONFIG_MTD_AR7_PARTS is not set
+CONFIG_MTD_BLKDEVS=y
+CONFIG_MTD_BLOCK=y
+# CONFIG_MTD_BLOCK2MTD is not set
+CONFIG_MTD_CFI=y
+# CONFIG_MTD_CFI_ADV_OPTIONS is not set
+CONFIG_MTD_CFI_AMDSTD=y
+# CONFIG_MTD_CFI_BE_BYTE_SWAP is not set
+CONFIG_MTD_CFI_I1=y
+CONFIG_MTD_CFI_I2=y
+# CONFIG_MTD_CFI_I4 is not set
+# CONFIG_MTD_CFI_I8 is not set
+CONFIG_MTD_CFI_INTELEXT=y
+# CONFIG_MTD_CFI_LE_BYTE_SWAP is not set
+CONFIG_MTD_CFI_NOSWAP=y
+# CONFIG_MTD_CFI_STAA is not set
+CONFIG_MTD_CFI_UTIL=y
+# CONFIG_MTD_CMDLINE_PARTS is not set
+CONFIG_MTD_COMPLEX_MAPPINGS=y
+# CONFIG_MTD_DATAFLASH is not set
+# CONFIG_MTD_DOCG3 is not set
+CONFIG_MTD_GEN_PROBE=y
+# CONFIG_MTD_GPIO_ADDR is not set
+# CONFIG_MTD_HYPERBUS is not set
+# CONFIG_MTD_IMPA7 is not set
+# CONFIG_MTD_INTEL_VR_NOR is not set
+# CONFIG_MTD_JEDECPROBE is not set
+# CONFIG_MTD_LATCH_ADDR is not set
+# CONFIG_MTD_LPDDR is not set
+# CONFIG_MTD_LPDDR2_NVM is not set
+# CONFIG_MTD_M25P80 is not set
+CONFIG_MTD_MAP_BANK_WIDTH_1=y
+# CONFIG_MTD_MAP_BANK_WIDTH_16 is not set
+CONFIG_MTD_MAP_BANK_WIDTH_2=y
+# CONFIG_MTD_MAP_BANK_WIDTH_32 is not set
+CONFIG_MTD_MAP_BANK_WIDTH_4=y
+# CONFIG_MTD_MAP_BANK_WIDTH_8 is not set
+# CONFIG_MTD_MCHP23K256 is not set
+# CONFIG_MTD_MCHP48L640 is not set
+# CONFIG_MTD_MT81xx_NOR is not set
+# CONFIG_MTD_MTDRAM is not set
+# CONFIG_MTD_MYLOADER_PARTS is not set
+# CONFIG_MTD_NAND is not set
+# CONFIG_MTD_NAND_AMS_DELTA is not set
+# CONFIG_MTD_NAND_AR934X is not set
+# CONFIG_MTD_NAND_AR934X_HW_ECC is not set
+# CONFIG_MTD_NAND_ARASAN is not set
+# CONFIG_MTD_NAND_ATMEL is not set
+# CONFIG_MTD_NAND_AU1550 is not set
+# CONFIG_MTD_NAND_BCH is not set
+# CONFIG_MTD_NAND_BF5XX is not set
+# CONFIG_MTD_NAND_BRCMNAND is not set
+# CONFIG_MTD_NAND_BRCMNAND_BCM63XX is not set
+# CONFIG_MTD_NAND_BRCMNAND_BCMBCA is not set
+# CONFIG_MTD_NAND_BRCMNAND_BRCMSTB is not set
+# CONFIG_MTD_NAND_BRCMNAND_IPROC is not set
+# CONFIG_MTD_NAND_CADENCE is not set
+# CONFIG_MTD_NAND_CAFE is not set
+# CONFIG_MTD_NAND_CM_X270 is not set
+# CONFIG_MTD_NAND_CS553X is not set
+# CONFIG_MTD_NAND_DAVINCI is not set
+# CONFIG_MTD_NAND_DENALI is not set
+# CONFIG_MTD_NAND_DENALI_DT is not set
+# CONFIG_MTD_NAND_DENALI_PCI is not set
+CONFIG_MTD_NAND_DENALI_SCRATCH_REG_ADDR=0xff108018
+# CONFIG_MTD_NAND_DISKONCHIP is not set
+# CONFIG_MTD_NAND_DOCG4 is not set
+# CONFIG_MTD_NAND_ECC is not set
+# CONFIG_MTD_NAND_ECC_BCH is not set
+# CONFIG_MTD_NAND_ECC_MXIC is not set
+# CONFIG_MTD_NAND_ECC_SMC is not set
+# CONFIG_MTD_NAND_ECC_SW_BCH is not set
+# CONFIG_MTD_NAND_ECC_SW_HAMMING is not set
+# CONFIG_MTD_NAND_ECC_SW_HAMMING_SMC is not set
+# CONFIG_MTD_NAND_FSL_ELBC is not set
+# CONFIG_MTD_NAND_FSL_IFC is not set
+# CONFIG_MTD_NAND_FSL_UPM is not set
+# CONFIG_MTD_NAND_FSMC is not set
+# CONFIG_MTD_NAND_GPIO is not set
+# CONFIG_MTD_NAND_GPMI_NAND is not set
+# CONFIG_MTD_NAND_HISI504 is not set
+CONFIG_MTD_NAND_IDS=y
+# CONFIG_MTD_NAND_INTEL_LGM is not set
+# CONFIG_MTD_NAND_JZ4740 is not set
+# CONFIG_MTD_NAND_MPC5121_NFC is not set
+# CONFIG_MTD_NAND_MTK is not set
+# CONFIG_MTD_NAND_MTK_BMT is not set
+# CONFIG_MTD_NAND_MXC is not set
+# CONFIG_MTD_NAND_MXIC is not set
+# CONFIG_MTD_NAND_NANDSIM is not set
+# CONFIG_MTD_NAND_NDFC is not set
+# CONFIG_MTD_NAND_NUC900 is not set
+# CONFIG_MTD_NAND_OMAP2 is not set
+# CONFIG_MTD_NAND_OMAP_BCH_BUILD is not set
+# CONFIG_MTD_NAND_ORION is not set
+# CONFIG_MTD_NAND_PASEMI is not set
+# CONFIG_MTD_NAND_PLATFORM is not set
+# CONFIG_MTD_NAND_PXA3xx is not set
+# CONFIG_MTD_NAND_RB4XX is not set
+# CONFIG_MTD_NAND_RB750 is not set
+# CONFIG_MTD_NAND_RB91X is not set
+# CONFIG_MTD_NAND_RICOH is not set
+# CONFIG_MTD_NAND_S3C2410 is not set
+# CONFIG_MTD_NAND_SHARPSL is not set
+# CONFIG_MTD_NAND_SH_FLCTL is not set
+# CONFIG_MTD_NAND_SOCRATES is not set
+# CONFIG_MTD_NAND_TMIO is not set
+# CONFIG_MTD_NAND_TXX9NDFMC is not set
+CONFIG_MTD_OF_PARTS=y
+# CONFIG_MTD_ONENAND is not set
+# CONFIG_MTD_OOPS is not set
+# CONFIG_MTD_OTP is not set
+# CONFIG_MTD_PARSER_TRX is not set
+# CONFIG_MTD_PARTITIONED_MASTER is not set
+# CONFIG_MTD_PCI is not set
+# CONFIG_MTD_PCMCIA is not set
+# CONFIG_MTD_PHRAM is not set
+# CONFIG_MTD_PHYSMAP is not set
+# CONFIG_MTD_PHYSMAP_COMPAT is not set
+# CONFIG_MTD_PHYSMAP_GEMINI is not set
+# CONFIG_MTD_PHYSMAP_GPIO_ADDR is not set
+# CONFIG_MTD_PHYSMAP_IXP4XX is not set
+CONFIG_MTD_PHYSMAP_OF=y
+# CONFIG_MTD_PHYSMAP_OF_GEMINI is not set
+# CONFIG_MTD_PHYSMAP_OF_VERSATILE is not set
+# CONFIG_MTD_PHYSMAP_VERSATILE is not set
+# CONFIG_MTD_PLATRAM is not set
+# CONFIG_MTD_PMC551 is not set
+# CONFIG_MTD_RAM is not set
+# CONFIG_MTD_RAW_NAND is not set
+CONFIG_MTD_REDBOOT_DIRECTORY_BLOCK=-1
+# CONFIG_MTD_REDBOOT_PARTS is not set
+# CONFIG_MTD_REDBOOT_PARTS_READONLY is not set
+# CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED is not set
+# CONFIG_MTD_ROM is not set
+CONFIG_MTD_ROOTFS_ROOT_DEV=y
+# CONFIG_MTD_ROUTERBOOT_PARTS is not set
+# CONFIG_MTD_SERCOMM_PARTS is not set
+# CONFIG_MTD_SLRAM is not set
+# CONFIG_MTD_SM_COMMON is not set
+# CONFIG_MTD_SPINAND_MT29F is not set
+# CONFIG_MTD_SPI_NAND is not set
+# CONFIG_MTD_SPI_NOR is not set
+# CONFIG_MTD_SPI_NOR_SWP_DISABLE is not set
+CONFIG_MTD_SPI_NOR_SWP_DISABLE_ON_VOLATILE=y
+# CONFIG_MTD_SPI_NOR_SWP_KEEP is not set
+# CONFIG_MTD_SPI_NOR_USE_4K_SECTORS is not set
+# CONFIG_MTD_SPI_NOR_USE_VARIABLE_ERASE is not set
+CONFIG_MTD_SPLIT=y
+# CONFIG_MTD_SPLIT_BCM63XX_FW is not set
+# CONFIG_MTD_SPLIT_BCM_WFI_FW is not set
+# CONFIG_MTD_SPLIT_BRNIMAGE_FW is not set
+# CONFIG_MTD_SPLIT_ELF_FW is not set
+# CONFIG_MTD_SPLIT_EVA_FW is not set
+# CONFIG_MTD_SPLIT_FIRMWARE is not set
+CONFIG_MTD_SPLIT_FIRMWARE_NAME="firmware"
+# CONFIG_MTD_SPLIT_FIT_FW is not set
+# CONFIG_MTD_SPLIT_H3C_VFS is not set
+# CONFIG_MTD_SPLIT_JIMAGE_FW is not set
+# CONFIG_MTD_SPLIT_LZMA_FW is not set
+# CONFIG_MTD_SPLIT_MINOR_FW is not set
+# CONFIG_MTD_SPLIT_SEAMA_FW is not set
+CONFIG_MTD_SPLIT_SQUASHFS_ROOT=y
+CONFIG_MTD_SPLIT_SUPPORT=y
+# CONFIG_MTD_SPLIT_TPLINK_FW is not set
+# CONFIG_MTD_SPLIT_TRX_FW is not set
+# CONFIG_MTD_SPLIT_UIMAGE_FW is not set
+# CONFIG_MTD_SPLIT_WRGG_FW is not set
+# CONFIG_MTD_SST25L is not set
+# CONFIG_MTD_SWAP is not set
+# CONFIG_MTD_TESTS is not set
+# CONFIG_MTD_UBI is not set
+# CONFIG_MTD_UBI_FASTMAP is not set
+# CONFIG_MTD_UBI_GLUEBI is not set
+# CONFIG_MTD_UIMAGE_SPLIT is not set
+# CONFIG_MTD_VIRT_CONCAT is not set
+# CONFIG_MTK_DEVAPC is not set
+# CONFIG_MTK_MMC is not set
+# CONFIG_MTK_MMSYS is not set
+# CONFIG_MTK_T7XX is not set
+# CONFIG_MTK_THERMAL is not set
+# CONFIG_MULTIPLEXER is not set
+CONFIG_MULTIUSER=y
+# CONFIG_MUTEX_SPIN_ON_OWNER is not set
+# CONFIG_MUX_ADG792A is not set
+# CONFIG_MUX_ADGS1408 is not set
+# CONFIG_MUX_GPIO is not set
+# CONFIG_MUX_MMIO is not set
+# CONFIG_MV643XX_ETH is not set
+# CONFIG_MVMDIO is not set
+# CONFIG_MVNETA_BM is not set
+# CONFIG_MVSW61XX_PHY is not set
+# CONFIG_MV_XOR_V2 is not set
+# CONFIG_MWAVE is not set
+# CONFIG_MWL8K is not set
+# CONFIG_MXC4005 is not set
+# CONFIG_MXC6255 is not set
+# CONFIG_MXM_WMI is not set
+# CONFIG_MYRI10GE is not set
+# CONFIG_NAMESPACES is not set
+# CONFIG_NATIONAL_PHY is not set
+# CONFIG_NATSEMI is not set
+# CONFIG_NAU7802 is not set
+# CONFIG_NBPFAXI_DMA is not set
+# CONFIG_NCP_FS is not set
+# CONFIG_NE2000 is not set
+# CONFIG_NE2K_PCI is not set
+# CONFIG_NEC_MARKEINS is not set
+CONFIG_NET=y
+# CONFIG_NETCONSOLE is not set
+CONFIG_NETDEVICES=y
+# CONFIG_NETDEVSIM is not set
+# CONFIG_NETFILTER is not set
+# CONFIG_NETFILTER_ADVANCED is not set
+# CONFIG_NETFILTER_DEBUG is not set
+# CONFIG_NETFILTER_EGRESS is not set
+# CONFIG_NETFILTER_INGRESS is not set
+# CONFIG_NETFILTER_NETLINK is not set
+# CONFIG_NETFILTER_NETLINK_ACCT is not set
+# CONFIG_NETFILTER_NETLINK_GLUE_CT is not set
+# CONFIG_NETFILTER_NETLINK_HOOK is not set
+# CONFIG_NETFILTER_NETLINK_LOG is not set
+# CONFIG_NETFILTER_NETLINK_OSF is not set
+# CONFIG_NETFILTER_NETLINK_QUEUE is not set
+# CONFIG_NETFILTER_XTABLES is not set
+# CONFIG_NETFILTER_XTABLES_COMPAT is not set
+# CONFIG_NETFILTER_XT_CONNMARK is not set
+# CONFIG_NETFILTER_XT_MARK is not set
+# CONFIG_NETFILTER_XT_MATCH_ADDRTYPE is not set
+# CONFIG_NETFILTER_XT_MATCH_BPF is not set
+# CONFIG_NETFILTER_XT_MATCH_CGROUP is not set
+# CONFIG_NETFILTER_XT_MATCH_CLUSTER is not set
+# CONFIG_NETFILTER_XT_MATCH_COMMENT is not set
+# CONFIG_NETFILTER_XT_MATCH_CONNBYTES is not set
+# CONFIG_NETFILTER_XT_MATCH_CONNLABEL is not set
+# CONFIG_NETFILTER_XT_MATCH_CONNLIMIT is not set
+# CONFIG_NETFILTER_XT_MATCH_CONNMARK is not set
+# CONFIG_NETFILTER_XT_MATCH_CONNTRACK is not set
+# CONFIG_NETFILTER_XT_MATCH_CPU is not set
+# CONFIG_NETFILTER_XT_MATCH_DCCP is not set
+# CONFIG_NETFILTER_XT_MATCH_DEVGROUP is not set
+# CONFIG_NETFILTER_XT_MATCH_DSCP is not set
+# CONFIG_NETFILTER_XT_MATCH_ECN is not set
+# CONFIG_NETFILTER_XT_MATCH_ESP is not set
+# CONFIG_NETFILTER_XT_MATCH_HASHLIMIT is not set
+# CONFIG_NETFILTER_XT_MATCH_HELPER is not set
+# CONFIG_NETFILTER_XT_MATCH_HL is not set
+# CONFIG_NETFILTER_XT_MATCH_IPCOMP is not set
+# CONFIG_NETFILTER_XT_MATCH_IPRANGE is not set
+# CONFIG_NETFILTER_XT_MATCH_L2TP is not set
+# CONFIG_NETFILTER_XT_MATCH_LENGTH is not set
+# CONFIG_NETFILTER_XT_MATCH_LIMIT is not set
+# CONFIG_NETFILTER_XT_MATCH_MAC is not set
+# CONFIG_NETFILTER_XT_MATCH_MARK is not set
+# CONFIG_NETFILTER_XT_MATCH_MULTIPORT is not set
+# CONFIG_NETFILTER_XT_MATCH_NFACCT is not set
+# CONFIG_NETFILTER_XT_MATCH_OSF is not set
+# CONFIG_NETFILTER_XT_MATCH_OWNER is not set
+# CONFIG_NETFILTER_XT_MATCH_PHYSDEV is not set
+# CONFIG_NETFILTER_XT_MATCH_PKTTYPE is not set
+# CONFIG_NETFILTER_XT_MATCH_POLICY is not set
+# CONFIG_NETFILTER_XT_MATCH_QUOTA is not set
+# CONFIG_NETFILTER_XT_MATCH_RATEEST is not set
+# CONFIG_NETFILTER_XT_MATCH_REALM is not set
+# CONFIG_NETFILTER_XT_MATCH_RECENT is not set
+# CONFIG_NETFILTER_XT_MATCH_SCTP is not set
+# CONFIG_NETFILTER_XT_MATCH_SOCKET is not set
+# CONFIG_NETFILTER_XT_MATCH_STATE is not set
+# CONFIG_NETFILTER_XT_MATCH_STATISTIC is not set
+# CONFIG_NETFILTER_XT_MATCH_STRING is not set
+# CONFIG_NETFILTER_XT_MATCH_TCPMSS is not set
+# CONFIG_NETFILTER_XT_MATCH_TIME is not set
+# CONFIG_NETFILTER_XT_MATCH_U32 is not set
+# CONFIG_NETFILTER_XT_TARGET_AUDIT is not set
+# CONFIG_NETFILTER_XT_TARGET_CHECKSUM is not set
+# CONFIG_NETFILTER_XT_TARGET_CLASSIFY is not set
+# CONFIG_NETFILTER_XT_TARGET_CONNMARK is not set
+# CONFIG_NETFILTER_XT_TARGET_CT is not set
+# CONFIG_NETFILTER_XT_TARGET_DSCP is not set
+# CONFIG_NETFILTER_XT_TARGET_HL is not set
+# CONFIG_NETFILTER_XT_TARGET_HMARK is not set
+# CONFIG_NETFILTER_XT_TARGET_IDLETIMER is not set
+# CONFIG_NETFILTER_XT_TARGET_LED is not set
+# CONFIG_NETFILTER_XT_TARGET_LOG is not set
+# CONFIG_NETFILTER_XT_TARGET_MARK is not set
+# CONFIG_NETFILTER_XT_TARGET_NETMAP is not set
+# CONFIG_NETFILTER_XT_TARGET_NFLOG is not set
+# CONFIG_NETFILTER_XT_TARGET_NFQUEUE is not set
+# CONFIG_NETFILTER_XT_TARGET_NOTRACK is not set
+# CONFIG_NETFILTER_XT_TARGET_RATEEST is not set
+# CONFIG_NETFILTER_XT_TARGET_REDIRECT is not set
+# CONFIG_NETFILTER_XT_TARGET_SECMARK is not set
+# CONFIG_NETFILTER_XT_TARGET_TCPMSS is not set
+# CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set
+# CONFIG_NETFILTER_XT_TARGET_TEE is not set
+# CONFIG_NETFILTER_XT_TARGET_TPROXY is not set
+# CONFIG_NETFILTER_XT_TARGET_TRACE is not set
+# CONFIG_NETFS_STATS is not set
+# CONFIG_NETLABEL is not set
+# CONFIG_NETLINK_DIAG is not set
+# CONFIG_NETLINK_MMAP is not set
+# CONFIG_NETPOLL is not set
+# CONFIG_NETROM is not set
+CONFIG_NETWORK_FILESYSTEMS=y
+# CONFIG_NETWORK_PHY_TIMESTAMPING is not set
+# CONFIG_NETWORK_SECMARK is not set
+# CONFIG_NETXEN_NIC is not set
+# CONFIG_NET_9P is not set
+# CONFIG_NET_ACT_BPF is not set
+# CONFIG_NET_ACT_CSUM is not set
+# CONFIG_NET_ACT_CT is not set
+# CONFIG_NET_ACT_GACT is not set
+# CONFIG_NET_ACT_GATE is not set
+# CONFIG_NET_ACT_IFE is not set
+# CONFIG_NET_ACT_IPT is not set
+# CONFIG_NET_ACT_MIRRED is not set
+# CONFIG_NET_ACT_MPLS is not set
+# CONFIG_NET_ACT_NAT is not set
+# CONFIG_NET_ACT_PEDIT is not set
+# CONFIG_NET_ACT_POLICE is not set
+# CONFIG_NET_ACT_SAMPLE is not set
+# CONFIG_NET_ACT_SIMP is not set
+# CONFIG_NET_ACT_SKBEDIT is not set
+# CONFIG_NET_ACT_SKBMOD is not set
+# CONFIG_NET_ACT_TUNNEL_KEY is not set
+# CONFIG_NET_ACT_VLAN is not set
+CONFIG_NET_CADENCE=y
+# CONFIG_NET_CALXEDA_XGMAC is not set
+CONFIG_NET_CLS=y
+# CONFIG_NET_CLS_ACT is not set
+# CONFIG_NET_CLS_BASIC is not set
+# CONFIG_NET_CLS_BPF is not set
+# CONFIG_NET_CLS_FLOW is not set
+# CONFIG_NET_CLS_FLOWER is not set
+# CONFIG_NET_CLS_FW is not set
+CONFIG_NET_CLS_IND=y
+# CONFIG_NET_CLS_MATCHALL is not set
+# CONFIG_NET_CLS_ROUTE4 is not set
+# CONFIG_NET_CLS_RSVP is not set
+# CONFIG_NET_CLS_RSVP6 is not set
+# CONFIG_NET_CLS_U32 is not set
+CONFIG_NET_CORE=y
+# CONFIG_NET_DEVLINK is not set
+# CONFIG_NET_DEV_REFCNT_TRACKER is not set
+# CONFIG_NET_DROP_MONITOR is not set
+# CONFIG_NET_DSA is not set
+# CONFIG_NET_DSA_AR9331 is not set
+# CONFIG_NET_DSA_BCM_SF2 is not set
+# CONFIG_NET_DSA_LANTIQ_GSWIP is not set
+# CONFIG_NET_DSA_LEGACY is not set
+# CONFIG_NET_DSA_LOOP is not set
+# CONFIG_NET_DSA_MICROCHIP_KSZ8795 is not set
+# CONFIG_NET_DSA_MICROCHIP_KSZ9477 is not set
+# CONFIG_NET_DSA_MICROCHIP_KSZ_COMMON is not set
+# CONFIG_NET_DSA_MSCC_FELIX is not set
+# CONFIG_NET_DSA_MSCC_SEVILLE is not set
+# CONFIG_NET_DSA_MT7530 is not set
+# CONFIG_NET_DSA_MV88E6060 is not set
+# CONFIG_NET_DSA_MV88E6123_61_65 is not set
+# CONFIG_NET_DSA_MV88E6131 is not set
+# CONFIG_NET_DSA_MV88E6171 is not set
+# CONFIG_NET_DSA_MV88E6352 is not set
+# CONFIG_NET_DSA_MV88E6XXX is not set
+# CONFIG_NET_DSA_MV88E6XXX_NEED_PPU is not set
+# CONFIG_NET_DSA_MV88E6XXX_PTP is not set
+# CONFIG_NET_DSA_QCA8K is not set
+# CONFIG_NET_DSA_QCA8K_LEDS_SUPPORT is not set
+# CONFIG_NET_DSA_REALTEK is not set
+# CONFIG_NET_DSA_REALTEK_SMI is not set
+# CONFIG_NET_DSA_SJA1105 is not set
+# CONFIG_NET_DSA_SMSC_LAN9303_I2C is not set
+# CONFIG_NET_DSA_SMSC_LAN9303_MDIO is not set
+# CONFIG_NET_DSA_TAG_8021Q is not set
+# CONFIG_NET_DSA_TAG_AR9331 is not set
+# CONFIG_NET_DSA_TAG_BRCM is not set
+# CONFIG_NET_DSA_TAG_BRCM_LEGACY is not set
+# CONFIG_NET_DSA_TAG_BRCM_PREPEND is not set
+# CONFIG_NET_DSA_TAG_DSA is not set
+# CONFIG_NET_DSA_TAG_EDSA is not set
+# CONFIG_NET_DSA_TAG_GSWIP is not set
+# CONFIG_NET_DSA_TAG_HELLCREEK is not set
+# CONFIG_NET_DSA_TAG_KSZ is not set
+# CONFIG_NET_DSA_TAG_LAN9303 is not set
+# CONFIG_NET_DSA_TAG_MTK is not set
+# CONFIG_NET_DSA_TAG_OCELOT is not set
+# CONFIG_NET_DSA_TAG_OCELOT_8021Q is not set
+# CONFIG_NET_DSA_TAG_QCA is not set
+# CONFIG_NET_DSA_TAG_RTL4_A is not set
+# CONFIG_NET_DSA_TAG_RTL8_4 is not set
+# CONFIG_NET_DSA_TAG_RZN1_A5PSW is not set
+# CONFIG_NET_DSA_TAG_SJA1105 is not set
+# CONFIG_NET_DSA_TAG_TRAILER is not set
+# CONFIG_NET_DSA_TAG_XRS700X is not set
+# CONFIG_NET_DSA_VITESSE_VSC73XX is not set
+# CONFIG_NET_DSA_VITESSE_VSC73XX_PLATFORM is not set
+# CONFIG_NET_DSA_VITESSE_VSC73XX_SPI is not set
+# CONFIG_NET_DSA_XRS700X_I2C is not set
+# CONFIG_NET_DSA_XRS700X_MDIO is not set
+# CONFIG_NET_EMATCH is not set
+# CONFIG_NET_EMATCH_CANID is not set
+# CONFIG_NET_EMATCH_CMP is not set
+# CONFIG_NET_EMATCH_IPT is not set
+# CONFIG_NET_EMATCH_META is not set
+# CONFIG_NET_EMATCH_NBYTE is not set
+CONFIG_NET_EMATCH_STACK=32
+# CONFIG_NET_EMATCH_TEXT is not set
+# CONFIG_NET_EMATCH_U32 is not set
+# CONFIG_NET_FAILOVER is not set
+# CONFIG_NET_FC is not set
+# CONFIG_NET_FOU is not set
+# CONFIG_NET_FOU_IP_TUNNELS is not set
+# CONFIG_NET_IFE is not set
+# CONFIG_NET_IPGRE is not set
+CONFIG_NET_IPGRE_BROADCAST=y
+# CONFIG_NET_IPGRE_DEMUX is not set
+# CONFIG_NET_IPIP is not set
+# CONFIG_NET_IPVTI is not set
+# CONFIG_NET_IP_TUNNEL is not set
+# CONFIG_NET_KEY is not set
+# CONFIG_NET_KEY_MIGRATE is not set
+# CONFIG_NET_L3_MASTER_DEV is not set
+# CONFIG_NET_MEDIATEK_STAR_EMAC is not set
+# CONFIG_NET_MPLS_GSO is not set
+# CONFIG_NET_NCSI is not set
+# CONFIG_NET_NSH is not set
+# CONFIG_NET_NS_REFCNT_TRACKER is not set
+# CONFIG_NET_PACKET_ENGINE is not set
+# CONFIG_NET_PKTGEN is not set
+# CONFIG_NET_POLL_CONTROLLER is not set
+# CONFIG_NET_PTP_CLASSIFY is not set
+CONFIG_NET_RX_BUSY_POLL=y
+# CONFIG_NET_SB1000 is not set
+CONFIG_NET_SCHED=y
+# CONFIG_NET_SCH_ATM is not set
+# CONFIG_NET_SCH_CAKE is not set
+# CONFIG_NET_SCH_CBQ is not set
+# CONFIG_NET_SCH_CBS is not set
+# CONFIG_NET_SCH_CHOKE is not set
+# CONFIG_NET_SCH_CODEL is not set
+CONFIG_NET_SCH_DEFAULT=y
+# CONFIG_NET_SCH_DRR is not set
+# CONFIG_NET_SCH_DSMARK is not set
+# CONFIG_NET_SCH_ETF is not set
+# CONFIG_NET_SCH_ETS is not set
+CONFIG_NET_SCH_FIFO=y
+# CONFIG_NET_SCH_FQ is not set
+CONFIG_NET_SCH_FQ_CODEL=y
+# CONFIG_NET_SCH_FQ_PIE is not set
+# CONFIG_NET_SCH_GRED is not set
+# CONFIG_NET_SCH_HFSC is not set
+# CONFIG_NET_SCH_HHF is not set
+# CONFIG_NET_SCH_HTB is not set
+# CONFIG_NET_SCH_INGRESS is not set
+# CONFIG_NET_SCH_MQPRIO is not set
+# CONFIG_NET_SCH_MULTIQ is not set
+# CONFIG_NET_SCH_NETEM is not set
+# CONFIG_NET_SCH_PIE is not set
+# CONFIG_NET_SCH_PLUG is not set
+# CONFIG_NET_SCH_PRIO is not set
+# CONFIG_NET_SCH_QFQ is not set
+# CONFIG_NET_SCH_RED is not set
+# CONFIG_NET_SCH_SFB is not set
+# CONFIG_NET_SCH_SFQ is not set
+# CONFIG_NET_SCH_SKBPRIO is not set
+# CONFIG_NET_SCH_TAPRIO is not set
+# CONFIG_NET_SCH_TBF is not set
+# CONFIG_NET_SCH_TEQL is not set
+# CONFIG_NET_SCTPPROBE is not set
+# CONFIG_NET_SELFTESTS is not set
+CONFIG_NET_SOCK_MSG=y
+# CONFIG_NET_SWITCHDEV is not set
+# CONFIG_NET_TCPPROBE is not set
+# CONFIG_NET_TC_SKB_EXT is not set
+# CONFIG_NET_TEAM is not set
+# CONFIG_NET_TULIP is not set
+# CONFIG_NET_UDP_TUNNEL is not set
+CONFIG_NET_VENDOR_3COM=y
+CONFIG_NET_VENDOR_8390=y
+CONFIG_NET_VENDOR_ADAPTEC=y
+CONFIG_NET_VENDOR_ADI=y
+CONFIG_NET_VENDOR_AGERE=y
+CONFIG_NET_VENDOR_ALACRITECH=y
+CONFIG_NET_VENDOR_ALTEON=y
+CONFIG_NET_VENDOR_AMAZON=y
+CONFIG_NET_VENDOR_AMD=y
+CONFIG_NET_VENDOR_AQUANTIA=y
+CONFIG_NET_VENDOR_ARC=y
+# CONFIG_NET_VENDOR_ASIX is not set
+CONFIG_NET_VENDOR_ATHEROS=y
+CONFIG_NET_VENDOR_AURORA=y
+CONFIG_NET_VENDOR_BROADCOM=y
+CONFIG_NET_VENDOR_BROCADE=y
+CONFIG_NET_VENDOR_CADENCE=y
+CONFIG_NET_VENDOR_CAVIUM=y
+CONFIG_NET_VENDOR_CHELSIO=y
+CONFIG_NET_VENDOR_CIRRUS=y
+CONFIG_NET_VENDOR_CISCO=y
+CONFIG_NET_VENDOR_CORTINA=y
+# CONFIG_NET_VENDOR_DAVICOM is not set
+CONFIG_NET_VENDOR_DEC=y
+CONFIG_NET_VENDOR_DLINK=y
+CONFIG_NET_VENDOR_EMULEX=y
+# CONFIG_NET_VENDOR_ENGLEDER is not set
+CONFIG_NET_VENDOR_EXAR=y
+CONFIG_NET_VENDOR_EZCHIP=y
+CONFIG_NET_VENDOR_FARADAY=y
+CONFIG_NET_VENDOR_FREESCALE=y
+CONFIG_NET_VENDOR_FUJITSU=y
+# CONFIG_NET_VENDOR_FUNGIBLE is not set
+CONFIG_NET_VENDOR_GOOGLE=y
+CONFIG_NET_VENDOR_HISILICON=y
+CONFIG_NET_VENDOR_HP=y
+CONFIG_NET_VENDOR_HUAWEI=y
+CONFIG_NET_VENDOR_I825XX=y
+CONFIG_NET_VENDOR_IBM=y
+CONFIG_NET_VENDOR_INTEL=y
+# CONFIG_NET_VENDOR_LITEX is not set
+CONFIG_NET_VENDOR_MARVELL=y
+CONFIG_NET_VENDOR_MELLANOX=y
+CONFIG_NET_VENDOR_MICREL=y
+CONFIG_NET_VENDOR_MICROCHIP=y
+CONFIG_NET_VENDOR_MICROSEMI=y
+# CONFIG_NET_VENDOR_MICROSOFT is not set
+CONFIG_NET_VENDOR_MYRI=y
+CONFIG_NET_VENDOR_NATSEMI=y
+CONFIG_NET_VENDOR_NETERION=y
+CONFIG_NET_VENDOR_NETRONOME=y
+CONFIG_NET_VENDOR_NI=y
+CONFIG_NET_VENDOR_NVIDIA=y
+CONFIG_NET_VENDOR_OKI=y
+CONFIG_NET_VENDOR_PACKET_ENGINES=y
+CONFIG_NET_VENDOR_PENSANDO=y
+CONFIG_NET_VENDOR_QLOGIC=y
+CONFIG_NET_VENDOR_QUALCOMM=y
+CONFIG_NET_VENDOR_RDC=y
+CONFIG_NET_VENDOR_REALTEK=y
+CONFIG_NET_VENDOR_RENESAS=y
+CONFIG_NET_VENDOR_ROCKER=y
+CONFIG_NET_VENDOR_SAMSUNG=y
+CONFIG_NET_VENDOR_SEEQ=y
+CONFIG_NET_VENDOR_SILAN=y
+CONFIG_NET_VENDOR_SIS=y
+CONFIG_NET_VENDOR_SMSC=y
+CONFIG_NET_VENDOR_SOCIONEXT=y
+CONFIG_NET_VENDOR_SOLARFLARE=y
+CONFIG_NET_VENDOR_STMICRO=y
+CONFIG_NET_VENDOR_SUN=y
+CONFIG_NET_VENDOR_SYNOPSYS=y
+CONFIG_NET_VENDOR_TEHUTI=y
+CONFIG_NET_VENDOR_TI=y
+CONFIG_NET_VENDOR_TOSHIBA=y
+# CONFIG_NET_VENDOR_VERTEXCOM is not set
+CONFIG_NET_VENDOR_VIA=y
+# CONFIG_NET_VENDOR_WANGXUN is not set
+CONFIG_NET_VENDOR_WIZNET=y
+CONFIG_NET_VENDOR_XILINX=y
+CONFIG_NET_VENDOR_XIRCOM=y
+# CONFIG_NET_VRF is not set
+# CONFIG_NET_XGENE is not set
+CONFIG_NEW_LEDS=y
+CONFIG_NF_CONNTRACK_CUSTOM=4
+# CONFIG_NFC is not set
+# CONFIG_NFP is not set
+# CONFIG_NFSD is not set
+# CONFIG_NFSD_V2_ACL is not set
+CONFIG_NFSD_V3=y
+# CONFIG_NFSD_V3_ACL is not set
+# CONFIG_NFSD_V4 is not set
+# CONFIG_NFS_ACL_SUPPORT is not set
+CONFIG_NFS_COMMON=y
+# CONFIG_NFS_DISABLE_UDP_SUPPORT is not set
+# CONFIG_NFS_FS is not set
+# CONFIG_NFS_FSCACHE is not set
+# CONFIG_NFS_SWAP is not set
+# CONFIG_NFS_V2 is not set
+CONFIG_NFS_V3=y
+# CONFIG_NFS_V3_ACL is not set
+# CONFIG_NFS_V4 is not set
+# CONFIG_NFS_V4_1 is not set
+# CONFIG_NFTL is not set
+# CONFIG_NFT_BRIDGE_META is not set
+# CONFIG_NFT_BRIDGE_REJECT is not set
+# CONFIG_NFT_CONNLIMIT is not set
+# CONFIG_NFT_DUP_IPV4 is not set
+# CONFIG_NFT_DUP_IPV6 is not set
+# CONFIG_NFT_FIB_IPV4 is not set
+# CONFIG_NFT_FIB_IPV6 is not set
+# CONFIG_NFT_FIB_NETDEV is not set
+# CONFIG_NFT_FLOW_OFFLOAD is not set
+# CONFIG_NFT_OBJREF is not set
+# CONFIG_NFT_OSF is not set
+# CONFIG_NFT_REJECT_NETDEV is not set
+# CONFIG_NFT_RT is not set
+# CONFIG_NFT_SET_BITMAP is not set
+# CONFIG_NFT_SOCKET is not set
+# CONFIG_NFT_SYNPROXY is not set
+# CONFIG_NFT_TPROXY is not set
+# CONFIG_NFT_TUNNEL is not set
+# CONFIG_NFT_XFRM is not set
+# CONFIG_NF_CONNTRACK is not set
+# CONFIG_NF_CONNTRACK_AMANDA is not set
+# CONFIG_NF_CONNTRACK_BRIDGE is not set
+# CONFIG_NF_CONNTRACK_EVENTS is not set
+# CONFIG_NF_CONNTRACK_FTP is not set
+# CONFIG_NF_CONNTRACK_H323 is not set
+# CONFIG_NF_CONNTRACK_IRC is not set
+# CONFIG_NF_CONNTRACK_LABELS is not set
+# CONFIG_NF_CONNTRACK_MARK is not set
+# CONFIG_NF_CONNTRACK_NETBIOS_NS is not set
+# CONFIG_NF_CONNTRACK_PPTP is not set
+CONFIG_NF_CONNTRACK_PROCFS=y
+# CONFIG_NF_CONNTRACK_PROC_COMPAT is not set
+# CONFIG_NF_CONNTRACK_SANE is not set
+# CONFIG_NF_CONNTRACK_SECMARK is not set
+# CONFIG_NF_CONNTRACK_SIP is not set
+# CONFIG_NF_CONNTRACK_SNMP is not set
+# CONFIG_NF_CONNTRACK_TFTP is not set
+# CONFIG_NF_CONNTRACK_TIMEOUT is not set
+# CONFIG_NF_CONNTRACK_TIMESTAMP is not set
+# CONFIG_NF_CONNTRACK_ZONES is not set
+# CONFIG_NF_CT_NETLINK is not set
+# CONFIG_NF_CT_NETLINK_HELPER is not set
+# CONFIG_NF_CT_NETLINK_TIMEOUT is not set
+# CONFIG_NF_CT_PROTO_DCCP is not set
+# CONFIG_NF_CT_PROTO_GRE is not set
+# CONFIG_NF_CT_PROTO_SCTP is not set
+# CONFIG_NF_CT_PROTO_UDPLITE is not set
+# CONFIG_NF_DEFRAG_IPV4 is not set
+# CONFIG_NF_DUP_IPV4 is not set
+# CONFIG_NF_DUP_IPV6 is not set
+# CONFIG_NF_FLOW_TABLE is not set
+# CONFIG_NF_FLOW_TABLE_PROCFS is not set
+# CONFIG_NF_LOG_ARP is not set
+# CONFIG_NF_LOG_BRIDGE is not set
+# CONFIG_NF_LOG_IPV4 is not set
+# CONFIG_NF_LOG_NETDEV is not set
+# CONFIG_NF_LOG_SYSLOG is not set
+# CONFIG_NF_NAT is not set
+# CONFIG_NF_NAT_AMANDA is not set
+# CONFIG_NF_NAT_FTP is not set
+# CONFIG_NF_NAT_H323 is not set
+# CONFIG_NF_NAT_IRC is not set
+# CONFIG_NF_NAT_NEEDED is not set
+# CONFIG_NF_NAT_PPTP is not set
+# CONFIG_NF_NAT_PROTO_GRE is not set
+# CONFIG_NF_NAT_SIP is not set
+# CONFIG_NF_NAT_SNMP_BASIC is not set
+# CONFIG_NF_NAT_TFTP is not set
+# CONFIG_NF_REJECT_IPV4 is not set
+# CONFIG_NF_REJECT_IPV6 is not set
+# CONFIG_NF_SOCKET_IPV4 is not set
+# CONFIG_NF_SOCKET_IPV6 is not set
+# CONFIG_NF_TABLES is not set
+CONFIG_NF_TABLES_ARP=y
+CONFIG_NF_TABLES_BRIDGE=y
+CONFIG_NF_TABLES_INET=y
+CONFIG_NF_TABLES_IPV4=y
+CONFIG_NF_TABLES_IPV6=y
+CONFIG_NF_TABLES_NETDEV=y
+# CONFIG_NF_TABLES_SET is not set
+# CONFIG_NF_TPROXY_IPV4 is not set
+# CONFIG_NF_TPROXY_IPV6 is not set
+# CONFIG_NGBE is not set
+# CONFIG_NI65 is not set
+# CONFIG_NI903X_WDT is not set
+# CONFIG_NIC7018_WDT is not set
+# CONFIG_NILFS2_FS is not set
+# CONFIG_NIU is not set
+# CONFIG_NI_XGE_MANAGEMENT_ENET is not set
+CONFIG_NLATTR=y
+# CONFIG_NLMON is not set
+# CONFIG_NLM_XLP_BOARD is not set
+# CONFIG_NLM_XLR_BOARD is not set
+# CONFIG_NLS is not set
+# CONFIG_NLS_ASCII is not set
+# CONFIG_NLS_CODEPAGE_1250 is not set
+# CONFIG_NLS_CODEPAGE_1251 is not set
+# CONFIG_NLS_CODEPAGE_437 is not set
+# CONFIG_NLS_CODEPAGE_737 is not set
+# CONFIG_NLS_CODEPAGE_775 is not set
+# CONFIG_NLS_CODEPAGE_850 is not set
+# CONFIG_NLS_CODEPAGE_852 is not set
+# CONFIG_NLS_CODEPAGE_855 is not set
+# CONFIG_NLS_CODEPAGE_857 is not set
+# CONFIG_NLS_CODEPAGE_860 is not set
+# CONFIG_NLS_CODEPAGE_861 is not set
+# CONFIG_NLS_CODEPAGE_862 is not set
+# CONFIG_NLS_CODEPAGE_863 is not set
+# CONFIG_NLS_CODEPAGE_864 is not set
+# CONFIG_NLS_CODEPAGE_865 is not set
+# CONFIG_NLS_CODEPAGE_866 is not set
+# CONFIG_NLS_CODEPAGE_869 is not set
+# CONFIG_NLS_CODEPAGE_874 is not set
+# CONFIG_NLS_CODEPAGE_932 is not set
+# CONFIG_NLS_CODEPAGE_936 is not set
+# CONFIG_NLS_CODEPAGE_949 is not set
+# CONFIG_NLS_CODEPAGE_950 is not set
+CONFIG_NLS_DEFAULT="iso8859-1"
+# CONFIG_NLS_ISO8859_1 is not set
+# CONFIG_NLS_ISO8859_13 is not set
+# CONFIG_NLS_ISO8859_14 is not set
+# CONFIG_NLS_ISO8859_15 is not set
+# CONFIG_NLS_ISO8859_2 is not set
+# CONFIG_NLS_ISO8859_3 is not set
+# CONFIG_NLS_ISO8859_4 is not set
+# CONFIG_NLS_ISO8859_5 is not set
+# CONFIG_NLS_ISO8859_6 is not set
+# CONFIG_NLS_ISO8859_7 is not set
+# CONFIG_NLS_ISO8859_8 is not set
+# CONFIG_NLS_ISO8859_9 is not set
+# CONFIG_NLS_KOI8_R is not set
+# CONFIG_NLS_KOI8_U is not set
+# CONFIG_NLS_MAC_CELTIC is not set
+# CONFIG_NLS_MAC_CENTEURO is not set
+# CONFIG_NLS_MAC_CROATIAN is not set
+# CONFIG_NLS_MAC_CYRILLIC is not set
+# CONFIG_NLS_MAC_GAELIC is not set
+# CONFIG_NLS_MAC_GREEK is not set
+# CONFIG_NLS_MAC_ICELAND is not set
+# CONFIG_NLS_MAC_INUIT is not set
+# CONFIG_NLS_MAC_ROMAN is not set
+# CONFIG_NLS_MAC_ROMANIAN is not set
+# CONFIG_NLS_MAC_TURKISH is not set
+# CONFIG_NLS_UTF8 is not set
+CONFIG_NMI_LOG_BUF_SHIFT=13
+# CONFIG_NOA1305 is not set
+# CONFIG_NOP_USB_XCEIV is not set
+# CONFIG_NORTEL_HERMES is not set
+# CONFIG_NOTIFIER_ERROR_INJECTION is not set
+# CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT is not set
+# CONFIG_NOZOMI is not set
+# CONFIG_NO_BOOTMEM is not set
+# CONFIG_NO_HZ is not set
+# CONFIG_NO_HZ_FULL is not set
+# CONFIG_NO_HZ_IDLE is not set
+# CONFIG_NS83820 is not set
+# CONFIG_NTB is not set
+# CONFIG_NTFS3_64BIT_CLUSTER is not set
+# CONFIG_NTFS3_FS is not set
+# CONFIG_NTFS3_FS_POSIX_ACL is not set
+# CONFIG_NTFS3_LZX_XPRESS is not set
+# CONFIG_NTFS_DEBUG is not set
+# CONFIG_NTFS_FS is not set
+# CONFIG_NTFS_RW is not set
+# CONFIG_NTP_PPS is not set
+# CONFIG_NULL_TTY is not set
+# CONFIG_NUMA is not set
+# CONFIG_NVIDIA_CARMEL_CNP_ERRATUM is not set
+# CONFIG_NVIDIA_WMI_EC_BACKLIGHT is not set
+# CONFIG_NVM is not set
+# CONFIG_NVMEM is not set
+# CONFIG_NVMEM_BCM_OCOTP is not set
+# CONFIG_NVMEM_IMX_OCOTP is not set
+# CONFIG_NVMEM_LAYOUT_ONIE_TLV is not set
+# CONFIG_NVMEM_LAYOUT_SL28_VPD is not set
+# CONFIG_NVMEM_REBOOT_MODE is not set
+# CONFIG_NVMEM_RMEM is not set
+# CONFIG_NVMEM_SYSFS is not set
+# CONFIG_NVMEM_U_BOOT_ENV is not set
+# CONFIG_NVME_AUTH is not set
+# CONFIG_NVME_FC is not set
+# CONFIG_NVME_TARGET is not set
+# CONFIG_NVME_TCP is not set
+# CONFIG_NVME_VERBOSE_ERRORS is not set
+# CONFIG_NVRAM is not set
+# CONFIG_NV_TCO is not set
+# CONFIG_NXP_C45_TJA11XX_PHY is not set
+# CONFIG_NXP_STB220 is not set
+# CONFIG_NXP_STB225 is not set
+# CONFIG_NXP_TJA11XX_PHY is not set
+# CONFIG_N_GSM is not set
+# CONFIG_OABI_COMPAT is not set
+# CONFIG_OBS600 is not set
+# CONFIG_OCFS2_FS is not set
+# CONFIG_OCTEONTX2_AF is not set
+# CONFIG_OCTEONTX2_PF is not set
+# CONFIG_OCTEON_EP is not set
+# CONFIG_OF_OVERLAY is not set
+CONFIG_OF_RESERVED_MEM=y
+# CONFIG_OF_UNITTEST is not set
+# CONFIG_OID_REGISTRY is not set
+# CONFIG_OMAP2_DSS_DEBUG is not set
+# CONFIG_OMAP2_DSS_DEBUGFS is not set
+# CONFIG_OMAP2_DSS_SDI is not set
+# CONFIG_OMAP_OCP2SCP is not set
+# CONFIG_OMAP_USB2 is not set
+# CONFIG_OMFS_FS is not set
+# CONFIG_OPENVSWITCH is not set
+# CONFIG_OPEN_DICE is not set
+# CONFIG_OPROFILE is not set
+# CONFIG_OPROFILE_EVENT_MULTIPLEX is not set
+# CONFIG_OPT3001 is not set
+CONFIG_OPTIMIZE_INLINING=y
+# CONFIG_ORANGEFS_FS is not set
+# CONFIG_ORION_WATCHDOG is not set
+# CONFIG_OSF_PARTITION is not set
+# CONFIG_OSNOISE_TRACER is not set
+CONFIG_OVERLAY_FS=y
+# CONFIG_OVERLAY_FS_INDEX is not set
+# CONFIG_OVERLAY_FS_METACOPY is not set
+CONFIG_OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW=y
+# CONFIG_OVERLAY_FS_REDIRECT_DIR is not set
+CONFIG_OVERLAY_FS_XINO_AUTO=y
+# CONFIG_OWL_LOADER is not set
+# CONFIG_P54_COMMON is not set
+# CONFIG_PA12203001 is not set
+CONFIG_PACKET=y
+# CONFIG_PACKET_DIAG is not set
+# CONFIG_PACKING is not set
+# CONFIG_PAGE_EXTENSION is not set
+# CONFIG_PAGE_OWNER is not set
+# CONFIG_PAGE_POISONING is not set
+# CONFIG_PAGE_POOL is not set
+# CONFIG_PAGE_POOL_STATS is not set
+# CONFIG_PAGE_REPORTING is not set
+# CONFIG_PAGE_SIZE_16KB is not set
+# CONFIG_PAGE_SIZE_32KB is not set
+CONFIG_PAGE_SIZE_4KB=y
+# CONFIG_PAGE_SIZE_64KB is not set
+# CONFIG_PAGE_SIZE_8KB is not set
+# CONFIG_PAGE_TABLE_CHECK is not set
+# CONFIG_PALMAS_GPADC is not set
+# CONFIG_PANASONIC_LAPTOP is not set
+# CONFIG_PANEL is not set
+CONFIG_PANIC_ON_OOPS=y
+CONFIG_PANIC_ON_OOPS_VALUE=1
+CONFIG_PANIC_TIMEOUT=1
+# CONFIG_PANTHERLORD_FF is not set
+# CONFIG_PARAVIRT is not set
+# CONFIG_PARAVIRT_TIME_ACCOUNTING is not set
+# CONFIG_PARPORT is not set
+# CONFIG_PARPORT_1284 is not set
+# CONFIG_PARPORT_AX88796 is not set
+# CONFIG_PARPORT_GSC is not set
+# CONFIG_PARPORT_PC is not set
+CONFIG_PARTITION_ADVANCED=y
+# CONFIG_PATA_ALI is not set
+# CONFIG_PATA_AMD is not set
+# CONFIG_PATA_ARASAN_CF is not set
+# CONFIG_PATA_ARTOP is not set
+# CONFIG_PATA_ATIIXP is not set
+# CONFIG_PATA_ATP867X is not set
+# CONFIG_PATA_CMD640_PCI is not set
+# CONFIG_PATA_CMD64X is not set
+# CONFIG_PATA_CS5520 is not set
+# CONFIG_PATA_CS5530 is not set
+# CONFIG_PATA_CS5535 is not set
+# CONFIG_PATA_CS5536 is not set
+# CONFIG_PATA_CYPRESS is not set
+# CONFIG_PATA_EFAR is not set
+# CONFIG_PATA_HPT366 is not set
+# CONFIG_PATA_HPT37X is not set
+# CONFIG_PATA_HPT3X2N is not set
+# CONFIG_PATA_HPT3X3 is not set
+# CONFIG_PATA_IMX is not set
+# CONFIG_PATA_ISAPNP is not set
+# CONFIG_PATA_IT8213 is not set
+# CONFIG_PATA_IT821X is not set
+# CONFIG_PATA_JMICRON is not set
+# CONFIG_PATA_LEGACY is not set
+# CONFIG_PATA_MARVELL is not set
+# CONFIG_PATA_MPIIX is not set
+# CONFIG_PATA_NETCELL is not set
+# CONFIG_PATA_NINJA32 is not set
+# CONFIG_PATA_NS87410 is not set
+# CONFIG_PATA_NS87415 is not set
+# CONFIG_PATA_OCTEON_CF is not set
+# CONFIG_PATA_OF_PLATFORM is not set
+# CONFIG_PATA_OLDPIIX is not set
+# CONFIG_PATA_OPTI is not set
+# CONFIG_PATA_OPTIDMA is not set
+# CONFIG_PATA_PCMCIA is not set
+# CONFIG_PATA_PDC2027X is not set
+# CONFIG_PATA_PDC_OLD is not set
+# CONFIG_PATA_PLATFORM is not set
+# CONFIG_PATA_QDI is not set
+# CONFIG_PATA_RADISYS is not set
+# CONFIG_PATA_RDC is not set
+# CONFIG_PATA_RZ1000 is not set
+# CONFIG_PATA_SC1200 is not set
+# CONFIG_PATA_SCH is not set
+# CONFIG_PATA_SERVERWORKS is not set
+# CONFIG_PATA_SIL680 is not set
+# CONFIG_PATA_SIS is not set
+# CONFIG_PATA_TOSHIBA is not set
+# CONFIG_PATA_TRIFLEX is not set
+# CONFIG_PATA_VIA is not set
+# CONFIG_PATA_WINBOND is not set
+# CONFIG_PATA_WINBOND_VLB is not set
+# CONFIG_PC104 is not set
+# CONFIG_PC300TOO is not set
+# CONFIG_PCCARD is not set
+# CONFIG_PCH_DMA is not set
+# CONFIG_PCH_GBE is not set
+# CONFIG_PCH_PHUB is not set
+# CONFIG_PCI is not set
+# CONFIG_PCI200SYN is not set
+# CONFIG_PCIEAER is not set
+# CONFIG_PCIEAER_INJECT is not set
+# CONFIG_PCIEASPM is not set
+# CONFIG_PCIEPORTBUS is not set
+# CONFIG_PCIE_AL is not set
+# CONFIG_PCIE_ALTERA is not set
+# CONFIG_PCIE_ARMADA_8K is not set
+CONFIG_PCIE_BUS_DEFAULT=y
+# CONFIG_PCIE_BUS_PEER2PEER is not set
+# CONFIG_PCIE_BUS_PERFORMANCE is not set
+# CONFIG_PCIE_BUS_SAFE is not set
+# CONFIG_PCIE_BUS_TUNE_OFF is not set
+# CONFIG_PCIE_BW is not set
+# CONFIG_PCIE_CADENCE_HOST is not set
+# CONFIG_PCIE_CADENCE_PLAT_HOST is not set
+# CONFIG_PCIE_DPC is not set
+# CONFIG_PCIE_DW_PLAT is not set
+# CONFIG_PCIE_DW_PLAT_HOST is not set
+# CONFIG_PCIE_ECRC is not set
+# CONFIG_PCIE_IPROC is not set
+# CONFIG_PCIE_KIRIN is not set
+# CONFIG_PCIE_LAYERSCAPE_GEN4 is not set
+# CONFIG_PCIE_MEDIATEK_GEN3 is not set
+# CONFIG_PCIE_MICROCHIP_HOST is not set
+# CONFIG_PCIE_PTM is not set
+# CONFIG_PCIE_XILINX is not set
+# CONFIG_PCIPCWATCHDOG is not set
+# CONFIG_PCI_ATMEL is not set
+# CONFIG_PCI_CNB20LE_QUIRK is not set
+# CONFIG_PCI_DEBUG is not set
+# CONFIG_PCI_DISABLE_COMMON_QUIRKS is not set
+# CONFIG_PCI_ENDPOINT is not set
+# CONFIG_PCI_ENDPOINT_TEST is not set
+# CONFIG_PCI_FTPCI100 is not set
+# CONFIG_PCI_HERMES is not set
+# CONFIG_PCI_HISI is not set
+# CONFIG_PCI_HOST_GENERIC is not set
+# CONFIG_PCI_HOST_THUNDER_ECAM is not set
+# CONFIG_PCI_HOST_THUNDER_PEM is not set
+# CONFIG_PCI_IOV is not set
+# CONFIG_PCI_J721E_HOST is not set
+# CONFIG_PCI_LAYERSCAPE is not set
+# CONFIG_PCI_MESON is not set
+# CONFIG_PCI_MSI is not set
+# CONFIG_PCI_PASID is not set
+# CONFIG_PCI_PF_STUB is not set
+# CONFIG_PCI_PRI is not set
+CONFIG_PCI_QUIRKS=y
+# CONFIG_PCI_REALLOC_ENABLE_AUTO is not set
+# CONFIG_PCI_STUB is not set
+# CONFIG_PCI_SW_SWITCHTEC is not set
+CONFIG_PCI_SYSCALL=y
+# CONFIG_PCI_V3_SEMI is not set
+# CONFIG_PCI_XGENE is not set
+# CONFIG_PCMCIA is not set
+# CONFIG_PCMCIA_3C574 is not set
+# CONFIG_PCMCIA_3C589 is not set
+# CONFIG_PCMCIA_AHA152X is not set
+# CONFIG_PCMCIA_ATMEL is not set
+# CONFIG_PCMCIA_AXNET is not set
+# CONFIG_PCMCIA_DEBUG is not set
+# CONFIG_PCMCIA_FDOMAIN is not set
+# CONFIG_PCMCIA_FMVJ18X is not set
+# CONFIG_PCMCIA_HERMES is not set
+# CONFIG_PCMCIA_LOAD_CIS is not set
+# CONFIG_PCMCIA_NINJA_SCSI is not set
+# CONFIG_PCMCIA_NMCLAN is not set
+# CONFIG_PCMCIA_PCNET is not set
+# CONFIG_PCMCIA_QLOGIC is not set
+# CONFIG_PCMCIA_RAYCS is not set
+# CONFIG_PCMCIA_SMC91C92 is not set
+# CONFIG_PCMCIA_SPECTRUM is not set
+# CONFIG_PCMCIA_SYM53C500 is not set
+# CONFIG_PCMCIA_WL3501 is not set
+# CONFIG_PCMCIA_XIRC2PS is not set
+# CONFIG_PCMCIA_XIRCOM is not set
+# CONFIG_PCNET32 is not set
+# CONFIG_PCPU_DEV_REFCNT is not set
+# CONFIG_PCSPKR_PLATFORM is not set
+# CONFIG_PCS_XPCS is not set
+# CONFIG_PD6729 is not set
+# CONFIG_PDA_POWER is not set
+# CONFIG_PDC_ADMA is not set
+# CONFIG_PEAQ_WMI is not set
+# CONFIG_PECI is not set
+# CONFIG_PERCPU_STATS is not set
+# CONFIG_PERCPU_TEST is not set
+# CONFIG_PERF_EVENTS is not set
+# CONFIG_PERF_EVENTS_AMD_POWER is not set
+# CONFIG_PERSISTENT_KEYRINGS is not set
+# CONFIG_PHANTOM is not set
+# CONFIG_PHONET is not set
+# CONFIG_PHYLIB is not set
+# CONFIG_PHYLIB_LEDS is not set
+# CONFIG_PHYS_ADDR_T_64BIT is not set
+# CONFIG_PHY_CADENCE_DP is not set
+# CONFIG_PHY_CADENCE_DPHY is not set
+# CONFIG_PHY_CADENCE_DPHY_RX is not set
+# CONFIG_PHY_CADENCE_SALVO is not set
+# CONFIG_PHY_CADENCE_SIERRA is not set
+# CONFIG_PHY_CADENCE_TORRENT is not set
+# CONFIG_PHY_CAN_TRANSCEIVER is not set
+# CONFIG_PHY_CPCAP_USB is not set
+# CONFIG_PHY_EXYNOS_DP_VIDEO is not set
+# CONFIG_PHY_EXYNOS_MIPI_VIDEO is not set
+# CONFIG_PHY_FSL_IMX8MQ_USB is not set
+# CONFIG_PHY_INGENIC_USB is not set
+# CONFIG_PHY_INTEL_KEEMBAY_EMMC is not set
+# CONFIG_PHY_LAN966X_SERDES is not set
+# CONFIG_PHY_MAPPHONE_MDM6600 is not set
+# CONFIG_PHY_MIXEL_MIPI_DPHY is not set
+# CONFIG_PHY_MTK_HDMI is not set
+# CONFIG_PHY_MTK_MIPI_DSI is not set
+# CONFIG_PHY_MVEBU_CP110_UTMI is not set
+# CONFIG_PHY_OCELOT_SERDES is not set
+# CONFIG_PHY_PISTACHIO_USB is not set
+# CONFIG_PHY_PXA_28NM_HSIC is not set
+# CONFIG_PHY_PXA_28NM_USB2 is not set
+# CONFIG_PHY_QCOM_DWC3 is not set
+# CONFIG_PHY_QCOM_USB_HS is not set
+# CONFIG_PHY_QCOM_USB_HSIC is not set
+# CONFIG_PHY_SAMSUNG_USB2 is not set
+# CONFIG_PHY_TUSB1210 is not set
+# CONFIG_PHY_XGENE is not set
+# CONFIG_PI433 is not set
+# CONFIG_PID_IN_CONTEXTIDR is not set
+# CONFIG_PID_NS is not set
+CONFIG_PINCONF=y
+# CONFIG_PINCTRL is not set
+# CONFIG_PINCTRL_AMD is not set
+# CONFIG_PINCTRL_AXP209 is not set
+# CONFIG_PINCTRL_CEDARFORK is not set
+# CONFIG_PINCTRL_CY8C95X0 is not set
+# CONFIG_PINCTRL_EXYNOS is not set
+# CONFIG_PINCTRL_EXYNOS5440 is not set
+# CONFIG_PINCTRL_ICELAKE is not set
+# CONFIG_PINCTRL_INGENIC is not set
+# CONFIG_PINCTRL_LPASS_LPI is not set
+# CONFIG_PINCTRL_MCP23S08 is not set
+# CONFIG_PINCTRL_MDM9607 is not set
+# CONFIG_PINCTRL_METEORLAKE is not set
+# CONFIG_PINCTRL_MICROCHIP_SGPIO is not set
+# CONFIG_PINCTRL_MSM8953 is not set
+# CONFIG_PINCTRL_MSM8X74 is not set
+# CONFIG_PINCTRL_MT6779 is not set
+# CONFIG_PINCTRL_MT8167 is not set
+# CONFIG_PINCTRL_MT8192 is not set
+# CONFIG_PINCTRL_MT8195 is not set
+# CONFIG_PINCTRL_MT8365 is not set
+# CONFIG_PINCTRL_MTK_V2 is not set
+# CONFIG_PINCTRL_OCELOT is not set
+# CONFIG_PINCTRL_PISTACHIO is not set
+# CONFIG_PINCTRL_SC7280 is not set
+# CONFIG_PINCTRL_SC8180X is not set
+# CONFIG_PINCTRL_SDX55 is not set
+CONFIG_PINCTRL_SINGLE=y
+# CONFIG_PINCTRL_SM6115 is not set
+# CONFIG_PINCTRL_SM6125 is not set
+# CONFIG_PINCTRL_SM8350 is not set
+# CONFIG_PINCTRL_STMFX is not set
+# CONFIG_PINCTRL_SX150X is not set
+# CONFIG_PING is not set
+CONFIG_PINMUX=y
+# CONFIG_PKCS7_MESSAGE_PARSER is not set
+# CONFIG_PL310_ERRATA_588369 is not set
+# CONFIG_PL310_ERRATA_727915 is not set
+# CONFIG_PL310_ERRATA_753970 is not set
+# CONFIG_PL310_ERRATA_769419 is not set
+# CONFIG_PL320_MBOX is not set
+# CONFIG_PL330_DMA is not set
+# CONFIG_PLATFORM_MHU is not set
+# CONFIG_PLAT_SPEAR is not set
+# CONFIG_PLIP is not set
+# CONFIG_PLX_DMA is not set
+# CONFIG_PLX_HERMES is not set
+# CONFIG_PM is not set
+# CONFIG_PMBUS is not set
+# CONFIG_PMC_MSP is not set
+# CONFIG_PMIC_ADP5520 is not set
+# CONFIG_PMIC_DA903X is not set
+# CONFIG_PMS7003 is not set
+# CONFIG_PM_AUTOSLEEP is not set
+# CONFIG_PM_DEBUG is not set
+# CONFIG_PM_DEVFREQ is not set
+# CONFIG_PM_USERSPACE_AUTOSLEEP is not set
+# CONFIG_PM_WAKELOCKS is not set
+# CONFIG_POSIX_MQUEUE is not set
+CONFIG_POSIX_TIMERS=y
+# CONFIG_POWERCAP is not set
+# CONFIG_POWER_AVS is not set
+# CONFIG_POWER_RESET is not set
+# CONFIG_POWER_RESET_BRCMKONA is not set
+# CONFIG_POWER_RESET_BRCMSTB is not set
+# CONFIG_POWER_RESET_GPIO is not set
+# CONFIG_POWER_RESET_GPIO_RESTART is not set
+# CONFIG_POWER_RESET_LINKSTATION is not set
+# CONFIG_POWER_RESET_LTC2952 is not set
+# CONFIG_POWER_RESET_PIIX4_POWEROFF is not set
+# CONFIG_POWER_RESET_QNAP is not set
+# CONFIG_POWER_RESET_REGULATOR is not set
+# CONFIG_POWER_RESET_RESTART is not set
+# CONFIG_POWER_RESET_SYSCON is not set
+# CONFIG_POWER_RESET_SYSCON_POWEROFF is not set
+# CONFIG_POWER_RESET_VERSATILE is not set
+# CONFIG_POWER_RESET_XGENE is not set
+# CONFIG_POWER_SUPPLY is not set
+# CONFIG_POWER_SUPPLY_DEBUG is not set
+# CONFIG_POWER_SUPPLY_HWMON is not set
+# CONFIG_PPC4xx_GPIO is not set
+# CONFIG_PPC_16K_PAGES is not set
+# CONFIG_PPC_256K_PAGES is not set
+CONFIG_PPC_4K_PAGES=y
+# CONFIG_PPC_64K_PAGES is not set
+# CONFIG_PPC_DISABLE_WERROR is not set
+# CONFIG_PPC_EMULATED_STATS is not set
+# CONFIG_PPC_EPAPR_HV_BYTECHAN is not set
+# CONFIG_PPC_QUEUED_SPINLOCKS is not set
+# CONFIG_PPP is not set
+# CONFIG_PPPOATM is not set
+# CONFIG_PPPOE is not set
+# CONFIG_PPPOL2TP is not set
+# CONFIG_PPP_ASYNC is not set
+# CONFIG_PPP_BSDCOMP is not set
+# CONFIG_PPP_DEFLATE is not set
+CONFIG_PPP_FILTER=y
+# CONFIG_PPP_MPPE is not set
+CONFIG_PPP_MULTILINK=y
+# CONFIG_PPP_SYNC_TTY is not set
+# CONFIG_PPS is not set
+# CONFIG_PPS_CLIENT_GPIO is not set
+# CONFIG_PPS_CLIENT_KTIMER is not set
+# CONFIG_PPS_CLIENT_LDISC is not set
+# CONFIG_PPS_CLIENT_PARPORT is not set
+# CONFIG_PPS_DEBUG is not set
+# CONFIG_PPTP is not set
+# CONFIG_PREEMPT is not set
+# CONFIG_PREEMPTIRQ_DELAY_TEST is not set
+# CONFIG_PREEMPTIRQ_EVENTS is not set
+# CONFIG_PREEMPT_DYNAMIC is not set
+CONFIG_PREEMPT_NONE=y
+# CONFIG_PREEMPT_RT is not set
+# CONFIG_PREEMPT_TRACER is not set
+# CONFIG_PREEMPT_VOLUNTARY is not set
+# CONFIG_PRESTERA is not set
+CONFIG_PREVENT_FIRMWARE_BUILD=y
+# CONFIG_PRIME_NUMBERS is not set
+CONFIG_PRINTK=y
+# CONFIG_PRINTK_CALLER is not set
+# CONFIG_PRINTK_INDEX is not set
+CONFIG_PRINTK_NMI=y
+CONFIG_PRINTK_SAFE_LOG_BUF_SHIFT=13
+# CONFIG_PRINTK_TIME is not set
+CONFIG_PRINT_STACK_DEPTH=64
+# CONFIG_PRISM2_USB is not set
+# CONFIG_PRISM54 is not set
+# CONFIG_PROC_CHILDREN is not set
+CONFIG_PROC_FS=y
+# CONFIG_PROC_KCORE is not set
+# CONFIG_PROC_PAGE_MONITOR is not set
+# CONFIG_PROC_STRIPPED is not set
+CONFIG_PROC_SYSCTL=y
+# CONFIG_PROC_VMCORE_DEVICE_DUMP is not set
+# CONFIG_PROFILE_ALL_BRANCHES is not set
+# CONFIG_PROFILE_ANNOTATED_BRANCHES is not set
+# CONFIG_PROFILING is not set
+# CONFIG_PROVE_LOCKING is not set
+# CONFIG_PROVE_RAW_LOCK_NESTING is not set
+# CONFIG_PROVE_RCU is not set
+# CONFIG_PROVE_RCU_LIST is not set
+# CONFIG_PROVE_RCU_REPEATEDLY is not set
+# CONFIG_PSAMPLE is not set
+# CONFIG_PSB6970_PHY is not set
+# CONFIG_PSE_CONTROLLER is not set
+# CONFIG_PSI is not set
+# CONFIG_PSTORE is not set
+# CONFIG_PSTORE_842_COMPRESS is not set
+# CONFIG_PSTORE_BLK is not set
+# CONFIG_PSTORE_COMPRESS is not set
+# CONFIG_PSTORE_CONSOLE is not set
+CONFIG_PSTORE_DEFAULT_KMSG_BYTES=10240
+# CONFIG_PSTORE_DEFLATE_COMPRESS is not set
+# CONFIG_PSTORE_DEFLATE_COMPRESS_DEFAULT is not set
+# CONFIG_PSTORE_FTRACE is not set
+# CONFIG_PSTORE_LZ4HC_COMPRESS is not set
+# CONFIG_PSTORE_LZ4_COMPRESS is not set
+# CONFIG_PSTORE_LZO_COMPRESS is not set
+# CONFIG_PSTORE_PMSG is not set
+# CONFIG_PSTORE_RAM is not set
+# CONFIG_PSTORE_ZSTD_COMPRESS is not set
+# CONFIG_PTDUMP_DEBUGFS is not set
+# CONFIG_PTP_1588_CLOCK is not set
+# CONFIG_PTP_1588_CLOCK_IDT82P33 is not set
+# CONFIG_PTP_1588_CLOCK_IDTCM is not set
+# CONFIG_PTP_1588_CLOCK_IXP46X is not set
+# CONFIG_PTP_1588_CLOCK_KVM is not set
+# CONFIG_PTP_1588_CLOCK_OCP is not set
+# CONFIG_PTP_1588_CLOCK_PCH is not set
+# CONFIG_PTP_1588_CLOCK_VMW is not set
+# CONFIG_PUBLIC_KEY_ALGO_RSA is not set
+# CONFIG_PVPANIC is not set
+# CONFIG_PWM is not set
+# CONFIG_PWM_ATMEL_TCB is not set
+# CONFIG_PWM_CLK is not set
+# CONFIG_PWM_DEBUG is not set
+# CONFIG_PWM_DWC is not set
+# CONFIG_PWM_FSL_FTM is not set
+# CONFIG_PWM_IMG is not set
+# CONFIG_PWM_JZ4740 is not set
+# CONFIG_PWM_MEDIATEK is not set
+# CONFIG_PWM_PCA9685 is not set
+# CONFIG_PWM_RASPBERRYPI_POE is not set
+# CONFIG_PWM_XILINX is not set
+CONFIG_PWRSEQ_EMMC=y
+# CONFIG_PWRSEQ_SD8787 is not set
+CONFIG_PWRSEQ_SIMPLE=y
+# CONFIG_QCA7000 is not set
+# CONFIG_QCA7000_SPI is not set
+# CONFIG_QCA7000_UART is not set
+# CONFIG_QCOM_A7PLL is not set
+# CONFIG_QCOM_BAM_DMUX is not set
+# CONFIG_QCOM_EMAC is not set
+# CONFIG_QCOM_FALKOR_ERRATUM_1003 is not set
+# CONFIG_QCOM_FALKOR_ERRATUM_1009 is not set
+# CONFIG_QCOM_FALKOR_ERRATUM_E1041 is not set
+# CONFIG_QCOM_GPI_DMA is not set
+# CONFIG_QCOM_HIDMA is not set
+# CONFIG_QCOM_HIDMA_MGMT is not set
+# CONFIG_QCOM_LMH is not set
+# CONFIG_QCOM_QDF2400_ERRATUM_0065 is not set
+# CONFIG_QCOM_SPMI_ADC5 is not set
+# CONFIG_QCOM_SPMI_ADC_TM5 is not set
+# CONFIG_QCOM_SPMI_IADC is not set
+# CONFIG_QCOM_SPMI_TEMP_ALARM is not set
+# CONFIG_QCOM_SPMI_VADC is not set
+# CONFIG_QCOM_SSC_BLOCK_BUS is not set
+# CONFIG_QED is not set
+# CONFIG_QFMT_V1 is not set
+# CONFIG_QLA3XXX is not set
+# CONFIG_QLCNIC is not set
+# CONFIG_QLGE is not set
+# CONFIG_QNX4FS_FS is not set
+# CONFIG_QNX6FS_FS is not set
+# CONFIG_QORIQ_CPUFREQ is not set
+# CONFIG_QORIQ_THERMAL is not set
+# CONFIG_QRTR is not set
+# CONFIG_QRTR_MHI is not set
+# CONFIG_QRTR_TUN is not set
+# CONFIG_QSEMI_PHY is not set
+# CONFIG_QUEUED_LOCK_STAT is not set
+# CONFIG_QUICC_ENGINE is not set
+# CONFIG_QUOTA is not set
+# CONFIG_QUOTACTL is not set
+# CONFIG_QUOTA_DEBUG is not set
+# CONFIG_QUOTA_NETLINK_INTERFACE is not set
+# CONFIG_R3964 is not set
+# CONFIG_R6040 is not set
+# CONFIG_R8169 is not set
+# CONFIG_R8188EU is not set
+# CONFIG_R8712U is not set
+# CONFIG_R8723AU is not set
+# CONFIG_RADIO_ADAPTERS is not set
+# CONFIG_RADIO_AZTECH is not set
+# CONFIG_RADIO_CADET is not set
+# CONFIG_RADIO_GEMTEK is not set
+# CONFIG_RADIO_MAXIRADIO is not set
+# CONFIG_RADIO_RTRACK is not set
+# CONFIG_RADIO_RTRACK2 is not set
+# CONFIG_RADIO_SF16FMI is not set
+# CONFIG_RADIO_SF16FMR2 is not set
+# CONFIG_RADIO_TERRATEC is not set
+# CONFIG_RADIO_TRUST is not set
+# CONFIG_RADIO_TYPHOON is not set
+# CONFIG_RADIO_ZOLTRIX is not set
+# CONFIG_RAID6_PQ_BENCHMARK is not set
+# CONFIG_RAID_ATTRS is not set
+# CONFIG_RALINK is not set
+# CONFIG_RANDOM_KMALLOC_CACHES is not set
+# CONFIG_RANDOM32_SELFTEST is not set
+# CONFIG_RANDOMIZE_BASE is not set
+CONFIG_RANDOMIZE_KSTACK_OFFSET=y
+# CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT is not set
+CONFIG_RANDOM_TRUST_BOOTLOADER=y
+CONFIG_RANDOM_TRUST_CPU=y
+# CONFIG_RANDSTRUCT_NONE is not set
+# CONFIG_RAPIDIO is not set
+# CONFIG_RAS is not set
+# CONFIG_RBTREE_TEST is not set
+# CONFIG_RCU_BOOST is not set
+CONFIG_RCU_CPU_STALL_TIMEOUT=60
+# CONFIG_RCU_EQS_DEBUG is not set
+# CONFIG_RCU_EXPEDITE_BOOT is not set
+# CONFIG_RCU_EXPERT is not set
+CONFIG_RCU_EXP_CPU_STALL_TIMEOUT=0
+CONFIG_RCU_KTHREAD_PRIO=0
+CONFIG_RCU_NEED_SEGCBLIST=y
+# CONFIG_RCU_PERF_TEST is not set
+# CONFIG_RCU_REF_SCALE_TEST is not set
+# CONFIG_RCU_SCALE_TEST is not set
+CONFIG_RCU_STALL_COMMON=y
+# CONFIG_RCU_STRICT_GRACE_PERIOD is not set
+# CONFIG_RCU_TORTURE_TEST is not set
+CONFIG_RCU_TORTURE_TEST_SLOW_INIT_DELAY=3
+# CONFIG_RCU_TRACE is not set
+# CONFIG_RC_ATI_REMOTE is not set
+# CONFIG_RC_CORE is not set
+# CONFIG_RC_DECODERS is not set
+# CONFIG_RC_LOOPBACK is not set
+# CONFIG_RC_MAP is not set
+# CONFIG_RC_XBOX_DVD is not set
+# CONFIG_RDS is not set
+# CONFIG_RD_BZIP2 is not set
+# CONFIG_RD_GZIP is not set
+# CONFIG_RD_LZ4 is not set
+# CONFIG_RD_LZMA is not set
+# CONFIG_RD_LZO is not set
+# CONFIG_RD_XZ is not set
+# CONFIG_RD_ZSTD is not set
+# CONFIG_READABLE_ASM is not set
+# CONFIG_READ_ONLY_THP_FOR_FS is not set
+# CONFIG_REALTEK_PHY is not set
+# CONFIG_REDWOOD is not set
+# CONFIG_REED_SOLOMON is not set
+# CONFIG_REED_SOLOMON_DEC8 is not set
+# CONFIG_REED_SOLOMON_ENC8 is not set
+# CONFIG_REED_SOLOMON_TEST is not set
+# CONFIG_REGMAP is not set
+# CONFIG_REGMAP_I2C is not set
+# CONFIG_REGMAP_MMIO is not set
+# CONFIG_REGMAP_SPI is not set
+# CONFIG_REGULATOR is not set
+# CONFIG_REGULATOR_88PG86X is not set
+# CONFIG_REGULATOR_ACT8865 is not set
+# CONFIG_REGULATOR_AD5398 is not set
+# CONFIG_REGULATOR_ANATOP is not set
+# CONFIG_REGULATOR_DA9121 is not set
+# CONFIG_REGULATOR_DA9210 is not set
+# CONFIG_REGULATOR_DA9211 is not set
+# CONFIG_REGULATOR_DEBUG is not set
+# CONFIG_REGULATOR_FAN53555 is not set
+# CONFIG_REGULATOR_FAN53880 is not set
+# CONFIG_REGULATOR_FIXED_VOLTAGE is not set
+# CONFIG_REGULATOR_GPIO is not set
+# CONFIG_REGULATOR_ISL6271A is not set
+# CONFIG_REGULATOR_ISL9305 is not set
+# CONFIG_REGULATOR_LP3971 is not set
+# CONFIG_REGULATOR_LP3972 is not set
+# CONFIG_REGULATOR_LP872X is not set
+# CONFIG_REGULATOR_LP8755 is not set
+# CONFIG_REGULATOR_LTC3589 is not set
+# CONFIG_REGULATOR_LTC3676 is not set
+# CONFIG_REGULATOR_MAX1586 is not set
+# CONFIG_REGULATOR_MAX20086 is not set
+# CONFIG_REGULATOR_MAX77620 is not set
+# CONFIG_REGULATOR_MAX77826 is not set
+# CONFIG_REGULATOR_MAX8649 is not set
+# CONFIG_REGULATOR_MAX8660 is not set
+# CONFIG_REGULATOR_MAX8893 is not set
+# CONFIG_REGULATOR_MAX8952 is not set
+# CONFIG_REGULATOR_MAX8973 is not set
+# CONFIG_REGULATOR_MCP16502 is not set
+# CONFIG_REGULATOR_MP5416 is not set
+# CONFIG_REGULATOR_MP8859 is not set
+# CONFIG_REGULATOR_MP886X is not set
+# CONFIG_REGULATOR_MPQ7920 is not set
+# CONFIG_REGULATOR_MT6311 is not set
+# CONFIG_REGULATOR_MT6315 is not set
+# CONFIG_REGULATOR_MT6359 is not set
+# CONFIG_REGULATOR_PCA9450 is not set
+# CONFIG_REGULATOR_PF8X00 is not set
+# CONFIG_REGULATOR_PFUZE100 is not set
+# CONFIG_REGULATOR_PV88060 is not set
+# CONFIG_REGULATOR_PV88080 is not set
+# CONFIG_REGULATOR_PV88090 is not set
+# CONFIG_REGULATOR_PWM is not set
+# CONFIG_REGULATOR_RASPBERRYPI_TOUCHSCREEN_ATTINY is not set
+# CONFIG_REGULATOR_RT4801 is not set
+# CONFIG_REGULATOR_RT5190A is not set
+# CONFIG_REGULATOR_RT5759 is not set
+# CONFIG_REGULATOR_RT6160 is not set
+# CONFIG_REGULATOR_RT6245 is not set
+# CONFIG_REGULATOR_RTMV20 is not set
+# CONFIG_REGULATOR_RTQ2134 is not set
+# CONFIG_REGULATOR_RTQ6752 is not set
+# CONFIG_REGULATOR_SLG51000 is not set
+# CONFIG_REGULATOR_SY8106A is not set
+# CONFIG_REGULATOR_SY8824X is not set
+# CONFIG_REGULATOR_SY8827N is not set
+# CONFIG_REGULATOR_TI_ABB is not set
+# CONFIG_REGULATOR_TPS51632 is not set
+# CONFIG_REGULATOR_TPS62360 is not set
+# CONFIG_REGULATOR_TPS6286X is not set
+# CONFIG_REGULATOR_TPS65023 is not set
+# CONFIG_REGULATOR_TPS6507X is not set
+# CONFIG_REGULATOR_TPS65132 is not set
+# CONFIG_REGULATOR_TPS6524X is not set
+# CONFIG_REGULATOR_USERSPACE_CONSUMER is not set
+# CONFIG_REGULATOR_VCTRL is not set
+# CONFIG_REGULATOR_VIRTUAL_CONSUMER is not set
+# CONFIG_REISERFS_CHECK is not set
+# CONFIG_REISERFS_FS is not set
+# CONFIG_REISERFS_FS_POSIX_ACL is not set
+# CONFIG_REISERFS_FS_SECURITY is not set
+CONFIG_REISERFS_FS_XATTR=y
+# CONFIG_REISERFS_PROC_INFO is not set
+# CONFIG_RELAY is not set
+# CONFIG_RELOCATABLE is not set
+# CONFIG_REMOTEPROC is not set
+# CONFIG_RENESAS_PHY is not set
+# CONFIG_RESET_ATH79 is not set
+# CONFIG_RESET_BERLIN is not set
+# CONFIG_RESET_BRCMSTB_RESCAL is not set
+# CONFIG_RESET_CONTROLLER is not set
+# CONFIG_RESET_IMX7 is not set
+# CONFIG_RESET_INTEL_GW is not set
+# CONFIG_RESET_LANTIQ is not set
+# CONFIG_RESET_LPC18XX is not set
+# CONFIG_RESET_MESON is not set
+# CONFIG_RESET_PISTACHIO is not set
+# CONFIG_RESET_SIMPLE is not set
+# CONFIG_RESET_SOCFPGA is not set
+# CONFIG_RESET_STM32 is not set
+# CONFIG_RESET_SUNXI is not set
+# CONFIG_RESET_TEGRA_BPMP is not set
+# CONFIG_RESET_TI_SYSCON is not set
+# CONFIG_RESET_TI_TPS380X is not set
+# CONFIG_RESET_ZYNQ is not set
+# CONFIG_RFD77402 is not set
+# CONFIG_RFD_FTL is not set
+CONFIG_RFKILL=y
+# CONFIG_RFKILL_FULL is not set
+# CONFIG_RFKILL_GPIO is not set
+# CONFIG_RFKILL_INPUT is not set
+# CONFIG_RFKILL_LEDS is not set
+# CONFIG_RFKILL_REGULATOR is not set
+# CONFIG_RICHTEK_RTQ6056 is not set
+# CONFIG_RING_BUFFER_BENCHMARK is not set
+# CONFIG_RING_BUFFER_STARTUP_TEST is not set
+# CONFIG_RING_BUFFER_VALIDATE_TIME_DELTAS is not set
+# CONFIG_RMI4_CORE is not set
+# CONFIG_RMNET is not set
+# CONFIG_ROCKCHIP_PHY is not set
+# CONFIG_ROCKER is not set
+# CONFIG_ROMFS_FS is not set
+# CONFIG_ROSE is not set
+# CONFIG_RPCSEC_GSS_KRB5 is not set
+# CONFIG_RPMSG_QCOM_GLINK_RPM is not set
+# CONFIG_RPMSG_VIRTIO is not set
+# CONFIG_RPMSG_WWAN_CTRL is not set
+# CONFIG_RPR0521 is not set
+# CONFIG_RSEQ is not set
+# CONFIG_RT2X00 is not set
+# CONFIG_RTC_CLASS is not set
+# CONFIG_RTC_DEBUG is not set
+# CONFIG_RTC_DRV_ABB5ZES3 is not set
+# CONFIG_RTC_DRV_ABEOZ9 is not set
+# CONFIG_RTC_DRV_ABX80X is not set
+# CONFIG_RTC_DRV_ARMADA38X is not set
+# CONFIG_RTC_DRV_AU1XXX is not set
+# CONFIG_RTC_DRV_BQ32K is not set
+# CONFIG_RTC_DRV_BQ4802 is not set
+# CONFIG_RTC_DRV_CADENCE is not set
+CONFIG_RTC_DRV_CMOS=y
+# CONFIG_RTC_DRV_DS1286 is not set
+# CONFIG_RTC_DRV_DS1302 is not set
+# CONFIG_RTC_DRV_DS1305 is not set
+# CONFIG_RTC_DRV_DS1307 is not set
+# CONFIG_RTC_DRV_DS1307_CENTURY is not set
+# CONFIG_RTC_DRV_DS1307_HWMON is not set
+# CONFIG_RTC_DRV_DS1343 is not set
+# CONFIG_RTC_DRV_DS1347 is not set
+# CONFIG_RTC_DRV_DS1374 is not set
+# CONFIG_RTC_DRV_DS1390 is not set
+# CONFIG_RTC_DRV_DS1511 is not set
+# CONFIG_RTC_DRV_DS1553 is not set
+# CONFIG_RTC_DRV_DS1672 is not set
+# CONFIG_RTC_DRV_DS1685_FAMILY is not set
+# CONFIG_RTC_DRV_DS1742 is not set
+# CONFIG_RTC_DRV_DS2404 is not set
+# CONFIG_RTC_DRV_DS3232 is not set
+# CONFIG_RTC_DRV_DS3234 is not set
+# CONFIG_RTC_DRV_EM3027 is not set
+# CONFIG_RTC_DRV_EP93XX is not set
+# CONFIG_RTC_DRV_FM3130 is not set
+# CONFIG_RTC_DRV_FTRTC010 is not set
+# CONFIG_RTC_DRV_GENERIC is not set
+# CONFIG_RTC_DRV_GOLDFISH is not set
+# CONFIG_RTC_DRV_HID_SENSOR_TIME is not set
+# CONFIG_RTC_DRV_HYM8563 is not set
+# CONFIG_RTC_DRV_ISL12022 is not set
+# CONFIG_RTC_DRV_ISL12026 is not set
+# CONFIG_RTC_DRV_ISL12057 is not set
+# CONFIG_RTC_DRV_ISL1208 is not set
+# CONFIG_RTC_DRV_JZ4740 is not set
+# CONFIG_RTC_DRV_M41T80 is not set
+# CONFIG_RTC_DRV_M41T93 is not set
+# CONFIG_RTC_DRV_M41T94 is not set
+# CONFIG_RTC_DRV_M48T35 is not set
+# CONFIG_RTC_DRV_M48T59 is not set
+# CONFIG_RTC_DRV_M48T86 is not set
+# CONFIG_RTC_DRV_MAX6900 is not set
+# CONFIG_RTC_DRV_MAX6902 is not set
+# CONFIG_RTC_DRV_MAX6916 is not set
+# CONFIG_RTC_DRV_MAX77686 is not set
+# CONFIG_RTC_DRV_MCP795 is not set
+# CONFIG_RTC_DRV_MOXART is not set
+# CONFIG_RTC_DRV_MPC5121 is not set
+# CONFIG_RTC_DRV_MSM6242 is not set
+# CONFIG_RTC_DRV_MT2712 is not set
+# CONFIG_RTC_DRV_NCT3018Y is not set
+# CONFIG_RTC_DRV_OMAP is not set
+# CONFIG_RTC_DRV_PCF2123 is not set
+# CONFIG_RTC_DRV_PCF2127 is not set
+# CONFIG_RTC_DRV_PCF85063 is not set
+# CONFIG_RTC_DRV_PCF8523 is not set
+# CONFIG_RTC_DRV_PCF85363 is not set
+# CONFIG_RTC_DRV_PCF8563 is not set
+# CONFIG_RTC_DRV_PCF8583 is not set
+# CONFIG_RTC_DRV_PL030 is not set
+# CONFIG_RTC_DRV_PL031 is not set
+# CONFIG_RTC_DRV_PS3 is not set
+# CONFIG_RTC_DRV_PT7C4338 is not set
+# CONFIG_RTC_DRV_R7301 is not set
+# CONFIG_RTC_DRV_R9701 is not set
+# CONFIG_RTC_DRV_RP5C01 is not set
+# CONFIG_RTC_DRV_RS5C348 is not set
+# CONFIG_RTC_DRV_RS5C372 is not set
+# CONFIG_RTC_DRV_RTC7301 is not set
+# CONFIG_RTC_DRV_RV3028 is not set
+# CONFIG_RTC_DRV_RV3029C2 is not set
+# CONFIG_RTC_DRV_RV3032 is not set
+# CONFIG_RTC_DRV_RV8803 is not set
+# CONFIG_RTC_DRV_RX4581 is not set
+# CONFIG_RTC_DRV_RX6110 is not set
+# CONFIG_RTC_DRV_RX8010 is not set
+# CONFIG_RTC_DRV_RX8025 is not set
+# CONFIG_RTC_DRV_RX8581 is not set
+# CONFIG_RTC_DRV_S35390A is not set
+# CONFIG_RTC_DRV_SD3078 is not set
+# CONFIG_RTC_DRV_SNVS is not set
+# CONFIG_RTC_DRV_STK17TA8 is not set
+# CONFIG_RTC_DRV_SUN6I is not set
+# CONFIG_RTC_DRV_TEGRA is not set
+# CONFIG_RTC_DRV_TEST is not set
+# CONFIG_RTC_DRV_V3020 is not set
+# CONFIG_RTC_DRV_X1205 is not set
+# CONFIG_RTC_DRV_XGENE is not set
+# CONFIG_RTC_DRV_ZYNQMP is not set
+CONFIG_RTC_HCTOSYS=y
+CONFIG_RTC_HCTOSYS_DEVICE="rtc0"
+CONFIG_RTC_INTF_DEV=y
+# CONFIG_RTC_INTF_DEV_UIE_EMUL is not set
+CONFIG_RTC_INTF_PROC=y
+CONFIG_RTC_INTF_SYSFS=y
+CONFIG_RTC_LIB=y
+# CONFIG_RTC_NVMEM is not set
+CONFIG_RTC_SYSTOHC=y
+CONFIG_RTC_SYSTOHC_DEVICE="rtc0"
+# CONFIG_RTL8180 is not set
+# CONFIG_RTL8187 is not set
+# CONFIG_RTL8192E is not set
+# CONFIG_RTL8192U is not set
+# CONFIG_RTL8306_PHY is not set
+# CONFIG_RTL8366RB_PHY is not set
+# CONFIG_RTL8366S_PHY is not set
+# CONFIG_RTL8366_SMI is not set
+# CONFIG_RTL8366_SMI_DEBUG_FS is not set
+# CONFIG_RTL8367B_PHY is not set
+# CONFIG_RTL8367_PHY is not set
+# CONFIG_RTLLIB is not set
+# CONFIG_RTL_CARDS is not set
+# CONFIG_RTS5208 is not set
+CONFIG_RT_MUTEXES=y
+# CONFIG_RUNTIME_DEBUG is not set
+CONFIG_RUNTIME_TESTING_MENU=y
+# CONFIG_RV is not set
+CONFIG_RWSEM_GENERIC_SPINLOCK=y
+CONFIG_RXKAD=y
+# CONFIG_S2IO is not set
+# CONFIG_SAMPLES is not set
+# CONFIG_SAMSUNG_LAPTOP is not set
+# CONFIG_SATA_ACARD_AHCI is not set
+# CONFIG_SATA_AHCI is not set
+# CONFIG_SATA_AHCI_PLATFORM is not set
+# CONFIG_SATA_DWC is not set
+# CONFIG_SATA_DWC_OLD_DMA is not set
+# CONFIG_SATA_FSL is not set
+# CONFIG_SATA_HIGHBANK is not set
+# CONFIG_SATA_HOST is not set
+# CONFIG_SATA_INIC162X is not set
+CONFIG_SATA_MOBILE_LPM_POLICY=0
+# CONFIG_SATA_MV is not set
+# CONFIG_SATA_NV is not set
+# CONFIG_SATA_PMP is not set
+# CONFIG_SATA_PROMISE is not set
+# CONFIG_SATA_QSTOR is not set
+# CONFIG_SATA_RCAR is not set
+# CONFIG_SATA_SIL is not set
+# CONFIG_SATA_SIL24 is not set
+# CONFIG_SATA_SIS is not set
+# CONFIG_SATA_SVW is not set
+# CONFIG_SATA_SX4 is not set
+# CONFIG_SATA_ULI is not set
+# CONFIG_SATA_VIA is not set
+# CONFIG_SATA_VITESSE is not set
+# CONFIG_SBC_FITPC2_WATCHDOG is not set
+CONFIG_SBITMAP=y
+# CONFIG_SC92031 is not set
+# CONFIG_SCA3000 is not set
+# CONFIG_SCA3300 is not set
+# CONFIG_SCACHE_DEBUGFS is not set
+# CONFIG_SCC is not set
+# CONFIG_SCD30_CORE is not set
+# CONFIG_SCD4X is not set
+# CONFIG_SCF_TORTURE_TEST is not set
+# CONFIG_SCHEDSTATS is not set
+# CONFIG_SCHED_AUTOGROUP is not set
+# CONFIG_SCHED_CLUSTER is not set
+# CONFIG_SCHED_DEBUG is not set
+CONFIG_SCHED_HRTICK=y
+# CONFIG_SCHED_MC is not set
+CONFIG_SCHED_OMIT_FRAME_POINTER=y
+# CONFIG_SCHED_SMT is not set
+CONFIG_SCHED_STACK_END_CHECK=y
+# CONFIG_SCHED_TRACER is not set
+# CONFIG_SCR24X is not set
+# CONFIG_SCSI is not set
+# CONFIG_SCSI_3W_9XXX is not set
+# CONFIG_SCSI_3W_SAS is not set
+# CONFIG_SCSI_7000FASST is not set
+# CONFIG_SCSI_AACRAID is not set
+# CONFIG_SCSI_ACARD is not set
+# CONFIG_SCSI_ADVANSYS is not set
+# CONFIG_SCSI_AHA152X is not set
+# CONFIG_SCSI_AHA1542 is not set
+# CONFIG_SCSI_AIC79XX is not set
+# CONFIG_SCSI_AIC7XXX is not set
+# CONFIG_SCSI_AIC94XX is not set
+# CONFIG_SCSI_AM53C974 is not set
+# CONFIG_SCSI_ARCMSR is not set
+# CONFIG_SCSI_BFA_FC is not set
+# CONFIG_SCSI_BNX2X_FCOE is not set
+# CONFIG_SCSI_BNX2_ISCSI is not set
+# CONFIG_SCSI_BUSLOGIC is not set
+# CONFIG_SCSI_CHELSIO_FCOE is not set
+# CONFIG_SCSI_CONSTANTS is not set
+# CONFIG_SCSI_CXGB3_ISCSI is not set
+# CONFIG_SCSI_CXGB4_ISCSI is not set
+# CONFIG_SCSI_DC395x is not set
+# CONFIG_SCSI_DEBUG is not set
+# CONFIG_SCSI_DH is not set
+CONFIG_SCSI_DMA=y
+# CONFIG_SCSI_DMX3191D is not set
+# CONFIG_SCSI_DPT_I2O is not set
+# CONFIG_SCSI_DTC3280 is not set
+# CONFIG_SCSI_EATA is not set
+# CONFIG_SCSI_ESAS2R is not set
+# CONFIG_SCSI_FC_ATTRS is not set
+# CONFIG_SCSI_FDOMAIN_PCI is not set
+# CONFIG_SCSI_FUTURE_DOMAIN is not set
+# CONFIG_SCSI_GDTH is not set
+# CONFIG_SCSI_GENERIC_NCR5380 is not set
+# CONFIG_SCSI_GENERIC_NCR5380_MMIO is not set
+# CONFIG_SCSI_HISI_SAS is not set
+# CONFIG_SCSI_HPSA is not set
+# CONFIG_SCSI_HPTIOP is not set
+# CONFIG_SCSI_IN2000 is not set
+# CONFIG_SCSI_INIA100 is not set
+# CONFIG_SCSI_INITIO is not set
+# CONFIG_SCSI_IPR is not set
+# CONFIG_SCSI_IPS is not set
+# CONFIG_SCSI_ISCI is not set
+# CONFIG_SCSI_ISCSI_ATTRS is not set
+# CONFIG_SCSI_LOGGING is not set
+CONFIG_SCSI_LOWLEVEL=y
+# CONFIG_SCSI_LOWLEVEL_PCMCIA is not set
+# CONFIG_SCSI_LPFC is not set
+CONFIG_SCSI_MOD=y
+# CONFIG_SCSI_MPI3MR is not set
+# CONFIG_SCSI_MPT2SAS is not set
+# CONFIG_SCSI_MPT3SAS is not set
+# CONFIG_SCSI_MQ_DEFAULT is not set
+# CONFIG_SCSI_MVSAS is not set
+# CONFIG_SCSI_MVSAS_DEBUG is not set
+# CONFIG_SCSI_MVUMI is not set
+# CONFIG_SCSI_MYRB is not set
+# CONFIG_SCSI_MYRS is not set
+# CONFIG_SCSI_NCR53C406A is not set
+# CONFIG_SCSI_NETLINK is not set
+# CONFIG_SCSI_NSP32 is not set
+# CONFIG_SCSI_OSD_INITIATOR is not set
+# CONFIG_SCSI_PAS16 is not set
+# CONFIG_SCSI_PM8001 is not set
+# CONFIG_SCSI_PMCRAID is not set
+CONFIG_SCSI_PROC_FS=y
+# CONFIG_SCSI_QLA_FC is not set
+# CONFIG_SCSI_QLA_ISCSI is not set
+# CONFIG_SCSI_QLOGIC_1280 is not set
+# CONFIG_SCSI_QLOGIC_FAS is not set
+# CONFIG_SCSI_SAS_ATTRS is not set
+# CONFIG_SCSI_SAS_LIBSAS is not set
+# CONFIG_SCSI_SCAN_ASYNC is not set
+# CONFIG_SCSI_SMARTPQI is not set
+# CONFIG_SCSI_SNIC is not set
+# CONFIG_SCSI_SPI_ATTRS is not set
+# CONFIG_SCSI_SRP_ATTRS is not set
+# CONFIG_SCSI_STEX is not set
+# CONFIG_SCSI_SYM53C416 is not set
+# CONFIG_SCSI_SYM53C8XX_2 is not set
+# CONFIG_SCSI_T128 is not set
+# CONFIG_SCSI_U14_34F is not set
+# CONFIG_SCSI_UFSHCD is not set
+# CONFIG_SCSI_ULTRASTOR is not set
+# CONFIG_SCSI_VIRTIO is not set
+# CONFIG_SCSI_WD719X is not set
+# CONFIG_SC_CAMCC_7180 is not set
+# CONFIG_SC_DISPCC_7280 is not set
+# CONFIG_SC_GCC_7280 is not set
+# CONFIG_SC_GCC_8180X is not set
+# CONFIG_SC_GPUCC_7280 is not set
+# CONFIG_SC_GPUCC_8280XP is not set
+# CONFIG_SC_VIDEOCC_7280 is not set
+# CONFIG_SCx200_ACB is not set
+# CONFIG_SDIO_UART is not set
+# CONFIG_SDM_GPUCC_660 is not set
+# CONFIG_SDM_MMCC_660 is not set
+# CONFIG_SDR_MAX2175 is not set
+# CONFIG_SDR_PLATFORM_DRIVERS is not set
+# CONFIG_SDX_GCC_55 is not set
+# CONFIG_SD_ADC_MODULATOR is not set
+# CONFIG_SECCOMP is not set
+# CONFIG_SECCOMP_CACHE_DEBUG is not set
+CONFIG_SECRETMEM=y
+CONFIG_SECTION_MISMATCH_WARN_ONLY=y
+# CONFIG_SECURITY is not set
+# CONFIG_SECURITYFS is not set
+# CONFIG_SECURITY_APPARMOR is not set
+CONFIG_SECURITY_DMESG_RESTRICT=y
+# CONFIG_SECURITY_LANDLOCK is not set
+# CONFIG_SECURITY_LOADPIN is not set
+# CONFIG_SECURITY_LOCKDOWN_LSM is not set
+# CONFIG_SECURITY_NETWORK_XFRM is not set
+# CONFIG_SECURITY_PATH is not set
+# CONFIG_SECURITY_SAFESETID is not set
+# CONFIG_SECURITY_SELINUX_AVC_STATS is not set
+# CONFIG_SECURITY_SELINUX_BOOTPARAM is not set
+CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=0
+# CONFIG_SECURITY_SELINUX_DEVELOP is not set
+# CONFIG_SECURITY_SELINUX_DISABLE is not set
+# CONFIG_SECURITY_SMACK is not set
+# CONFIG_SECURITY_TOMOYO is not set
+# CONFIG_SECURITY_YAMA is not set
+CONFIG_SELECT_MEMORY_MODEL=y
+# CONFIG_SENSEAIR_SUNRISE_CO2 is not set
+# CONFIG_SENSIRION_SGP30 is not set
+# CONFIG_SENSIRION_SGP40 is not set
+# CONFIG_SENSORS_ABITUGURU is not set
+# CONFIG_SENSORS_ABITUGURU3 is not set
+# CONFIG_SENSORS_ACPI_POWER is not set
+# CONFIG_SENSORS_AD7314 is not set
+# CONFIG_SENSORS_AD7414 is not set
+# CONFIG_SENSORS_AD7418 is not set
+# CONFIG_SENSORS_ADC128D818 is not set
+# CONFIG_SENSORS_ADCXX is not set
+# CONFIG_SENSORS_ADM1021 is not set
+# CONFIG_SENSORS_ADM1025 is not set
+# CONFIG_SENSORS_ADM1026 is not set
+# CONFIG_SENSORS_ADM1029 is not set
+# CONFIG_SENSORS_ADM1031 is not set
+# CONFIG_SENSORS_ADM1177 is not set
+# CONFIG_SENSORS_ADM1266 is not set
+# CONFIG_SENSORS_ADM1275 is not set
+# CONFIG_SENSORS_ADM9240 is not set
+# CONFIG_SENSORS_ADS1015 is not set
+# CONFIG_SENSORS_ADS7828 is not set
+# CONFIG_SENSORS_ADS7871 is not set
+# CONFIG_SENSORS_ADT7310 is not set
+# CONFIG_SENSORS_ADT7410 is not set
+# CONFIG_SENSORS_ADT7411 is not set
+# CONFIG_SENSORS_ADT7462 is not set
+# CONFIG_SENSORS_ADT7470 is not set
+# CONFIG_SENSORS_ADT7475 is not set
+# CONFIG_SENSORS_AHT10 is not set
+# CONFIG_SENSORS_AMC6821 is not set
+# CONFIG_SENSORS_APDS990X is not set
+# CONFIG_SENSORS_APPLESMC is not set
+# CONFIG_SENSORS_AQUACOMPUTER_D5NEXT is not set
+# CONFIG_SENSORS_AS370 is not set
+# CONFIG_SENSORS_ASB100 is not set
+# CONFIG_SENSORS_ASC7621 is not set
+# CONFIG_SENSORS_ASPEED is not set
+# CONFIG_SENSORS_ASUS_WMI is not set
+# CONFIG_SENSORS_ATK0110 is not set
+# CONFIG_SENSORS_ATXP1 is not set
+# CONFIG_SENSORS_AXI_FAN_CONTROL is not set
+# CONFIG_SENSORS_BEL_PFE is not set
+# CONFIG_SENSORS_BH1770 is not set
+# CONFIG_SENSORS_BH1780 is not set
+# CONFIG_SENSORS_BPA_RS600 is not set
+# CONFIG_SENSORS_CORETEMP is not set
+# CONFIG_SENSORS_CORSAIR_CPRO is not set
+# CONFIG_SENSORS_CORSAIR_PSU is not set
+# CONFIG_SENSORS_DELL_SMM is not set
+# CONFIG_SENSORS_DELTA_AHE50DC_FAN is not set
+# CONFIG_SENSORS_DME1737 is not set
+# CONFIG_SENSORS_DPS920AB is not set
+# CONFIG_SENSORS_DRIVETEMP is not set
+# CONFIG_SENSORS_DS1621 is not set
+# CONFIG_SENSORS_DS620 is not set
+# CONFIG_SENSORS_EMC1403 is not set
+# CONFIG_SENSORS_EMC2103 is not set
+# CONFIG_SENSORS_EMC2305 is not set
+# CONFIG_SENSORS_EMC6W201 is not set
+# CONFIG_SENSORS_F71805F is not set
+# CONFIG_SENSORS_F71882FG is not set
+# CONFIG_SENSORS_F75375S is not set
+# CONFIG_SENSORS_FAM15H_POWER is not set
+# CONFIG_SENSORS_FSCHMD is not set
+# CONFIG_SENSORS_FSP_3Y is not set
+# CONFIG_SENSORS_FTSTEUTATES is not set
+# CONFIG_SENSORS_G760A is not set
+# CONFIG_SENSORS_G762 is not set
+# CONFIG_SENSORS_GL518SM is not set
+# CONFIG_SENSORS_GL520SM is not set
+# CONFIG_SENSORS_GPIO_FAN is not set
+# CONFIG_SENSORS_GSC is not set
+# CONFIG_SENSORS_HDAPS is not set
+# CONFIG_SENSORS_HIH6130 is not set
+# CONFIG_SENSORS_HMC5843 is not set
+# CONFIG_SENSORS_HMC5843_I2C is not set
+# CONFIG_SENSORS_HMC5843_SPI is not set
+# CONFIG_SENSORS_HTU21 is not set
+# CONFIG_SENSORS_I5500 is not set
+# CONFIG_SENSORS_I5K_AMB is not set
+# CONFIG_SENSORS_IBM_CFFPS is not set
+# CONFIG_SENSORS_IIO_HWMON is not set
+# CONFIG_SENSORS_INA209 is not set
+# CONFIG_SENSORS_INA238 is not set
+# CONFIG_SENSORS_INA2XX is not set
+# CONFIG_SENSORS_INA3221 is not set
+# CONFIG_SENSORS_INSPUR_IPSPS is not set
+# CONFIG_SENSORS_IR35221 is not set
+# CONFIG_SENSORS_IR36021 is not set
+# CONFIG_SENSORS_IR38064 is not set
+# CONFIG_SENSORS_IRPS5401 is not set
+# CONFIG_SENSORS_ISL29018 is not set
+# CONFIG_SENSORS_ISL29028 is not set
+# CONFIG_SENSORS_ISL68137 is not set
+# CONFIG_SENSORS_IT87 is not set
+# CONFIG_SENSORS_JC42 is not set
+# CONFIG_SENSORS_K10TEMP is not set
+# CONFIG_SENSORS_K8TEMP is not set
+# CONFIG_SENSORS_LINEAGE is not set
+# CONFIG_SENSORS_LIS3LV02D is not set
+# CONFIG_SENSORS_LIS3_I2C is not set
+# CONFIG_SENSORS_LIS3_SPI is not set
+# CONFIG_SENSORS_LM25066 is not set
+# CONFIG_SENSORS_LM63 is not set
+# CONFIG_SENSORS_LM70 is not set
+# CONFIG_SENSORS_LM73 is not set
+# CONFIG_SENSORS_LM75 is not set
+# CONFIG_SENSORS_LM77 is not set
+# CONFIG_SENSORS_LM78 is not set
+# CONFIG_SENSORS_LM80 is not set
+# CONFIG_SENSORS_LM83 is not set
+# CONFIG_SENSORS_LM85 is not set
+# CONFIG_SENSORS_LM87 is not set
+# CONFIG_SENSORS_LM90 is not set
+# CONFIG_SENSORS_LM92 is not set
+# CONFIG_SENSORS_LM93 is not set
+# CONFIG_SENSORS_LM95234 is not set
+# CONFIG_SENSORS_LM95241 is not set
+# CONFIG_SENSORS_LM95245 is not set
+# CONFIG_SENSORS_LT7182S is not set
+# CONFIG_SENSORS_LTC2945 is not set
+# CONFIG_SENSORS_LTC2947_I2C is not set
+# CONFIG_SENSORS_LTC2947_SPI is not set
+# CONFIG_SENSORS_LTC2978 is not set
+# CONFIG_SENSORS_LTC2990 is not set
+# CONFIG_SENSORS_LTC2992 is not set
+# CONFIG_SENSORS_LTC3815 is not set
+# CONFIG_SENSORS_LTC4151 is not set
+# CONFIG_SENSORS_LTC4215 is not set
+# CONFIG_SENSORS_LTC4222 is not set
+# CONFIG_SENSORS_LTC4245 is not set
+# CONFIG_SENSORS_LTC4260 is not set
+# CONFIG_SENSORS_LTC4261 is not set
+# CONFIG_SENSORS_LTQ_CPUTEMP is not set
+# CONFIG_SENSORS_MAX1111 is not set
+# CONFIG_SENSORS_MAX127 is not set
+# CONFIG_SENSORS_MAX15301 is not set
+# CONFIG_SENSORS_MAX16064 is not set
+# CONFIG_SENSORS_MAX16065 is not set
+# CONFIG_SENSORS_MAX1619 is not set
+# CONFIG_SENSORS_MAX16601 is not set
+# CONFIG_SENSORS_MAX1668 is not set
+# CONFIG_SENSORS_MAX197 is not set
+# CONFIG_SENSORS_MAX20730 is not set
+# CONFIG_SENSORS_MAX20751 is not set
+# CONFIG_SENSORS_MAX31722 is not set
+# CONFIG_SENSORS_MAX31730 is not set
+# CONFIG_SENSORS_MAX31760 is not set
+# CONFIG_SENSORS_MAX31785 is not set
+# CONFIG_SENSORS_MAX31790 is not set
+# CONFIG_SENSORS_MAX34440 is not set
+# CONFIG_SENSORS_MAX6620 is not set
+# CONFIG_SENSORS_MAX6621 is not set
+# CONFIG_SENSORS_MAX6639 is not set
+# CONFIG_SENSORS_MAX6642 is not set
+# CONFIG_SENSORS_MAX6650 is not set
+# CONFIG_SENSORS_MAX6697 is not set
+# CONFIG_SENSORS_MAX8688 is not set
+# CONFIG_SENSORS_MCP3021 is not set
+# CONFIG_SENSORS_MP2888 is not set
+# CONFIG_SENSORS_MP2975 is not set
+# CONFIG_SENSORS_MP5023 is not set
+# CONFIG_SENSORS_MR75203 is not set
+# CONFIG_SENSORS_NCT6683 is not set
+# CONFIG_SENSORS_NCT6775 is not set
+# CONFIG_SENSORS_NCT6775_I2C is not set
+# CONFIG_SENSORS_NCT7802 is not set
+# CONFIG_SENSORS_NCT7904 is not set
+# CONFIG_SENSORS_NPCM7XX is not set
+# CONFIG_SENSORS_NSA320 is not set
+# CONFIG_SENSORS_NTC_THERMISTOR is not set
+# CONFIG_SENSORS_NZXT_KRAKEN2 is not set
+# CONFIG_SENSORS_NZXT_SMART2 is not set
+# CONFIG_SENSORS_OCC_P8_I2C is not set
+# CONFIG_SENSORS_PC87360 is not set
+# CONFIG_SENSORS_PC87427 is not set
+# CONFIG_SENSORS_PCF8591 is not set
+# CONFIG_SENSORS_PIM4328 is not set
+# CONFIG_SENSORS_PLI1209BC is not set
+# CONFIG_SENSORS_PM6764TR is not set
+# CONFIG_SENSORS_PMBUS is not set
+# CONFIG_SENSORS_POWR1220 is not set
+# CONFIG_SENSORS_PWM_FAN is not set
+# CONFIG_SENSORS_PXE1610 is not set
+# CONFIG_SENSORS_Q54SJ108A2 is not set
+# CONFIG_SENSORS_RM3100_I2C is not set
+# CONFIG_SENSORS_RM3100_SPI is not set
+# CONFIG_SENSORS_SBRMI is not set
+# CONFIG_SENSORS_SBTSI is not set
+# CONFIG_SENSORS_SCH5627 is not set
+# CONFIG_SENSORS_SCH5636 is not set
+# CONFIG_SENSORS_SCH56XX_COMMON is not set
+# CONFIG_SENSORS_SHT15 is not set
+# CONFIG_SENSORS_SHT21 is not set
+# CONFIG_SENSORS_SHT3x is not set
+# CONFIG_SENSORS_SHT4x is not set
+# CONFIG_SENSORS_SHTC1 is not set
+# CONFIG_SENSORS_SIS5595 is not set
+# CONFIG_SENSORS_SMM665 is not set
+# CONFIG_SENSORS_SMSC47B397 is not set
+# CONFIG_SENSORS_SMSC47M1 is not set
+# CONFIG_SENSORS_SMSC47M192 is not set
+# CONFIG_SENSORS_STPDDC60 is not set
+# CONFIG_SENSORS_STTS751 is not set
+# CONFIG_SENSORS_TC654 is not set
+# CONFIG_SENSORS_TC74 is not set
+# CONFIG_SENSORS_THMC50 is not set
+# CONFIG_SENSORS_TMP102 is not set
+# CONFIG_SENSORS_TMP103 is not set
+# CONFIG_SENSORS_TMP108 is not set
+# CONFIG_SENSORS_TMP401 is not set
+# CONFIG_SENSORS_TMP421 is not set
+# CONFIG_SENSORS_TMP464 is not set
+# CONFIG_SENSORS_TMP513 is not set
+# CONFIG_SENSORS_TPS23861 is not set
+# CONFIG_SENSORS_TPS40422 is not set
+# CONFIG_SENSORS_TPS53679 is not set
+# CONFIG_SENSORS_TPS546D24 is not set
+# CONFIG_SENSORS_TSL2550 is not set
+# CONFIG_SENSORS_TSL2563 is not set
+# CONFIG_SENSORS_UCD9000 is not set
+# CONFIG_SENSORS_UCD9200 is not set
+# CONFIG_SENSORS_VEXPRESS is not set
+# CONFIG_SENSORS_VIA686A is not set
+# CONFIG_SENSORS_VIA_CPUTEMP is not set
+# CONFIG_SENSORS_VT1211 is not set
+# CONFIG_SENSORS_VT8231 is not set
+# CONFIG_SENSORS_W83627EHF is not set
+# CONFIG_SENSORS_W83627HF is not set
+# CONFIG_SENSORS_W83773G is not set
+# CONFIG_SENSORS_W83781D is not set
+# CONFIG_SENSORS_W83791D is not set
+# CONFIG_SENSORS_W83792D is not set
+# CONFIG_SENSORS_W83793 is not set
+# CONFIG_SENSORS_W83795 is not set
+# CONFIG_SENSORS_W83L785TS is not set
+# CONFIG_SENSORS_W83L786NG is not set
+# CONFIG_SENSORS_XDPE122 is not set
+# CONFIG_SENSORS_XDPE152 is not set
+# CONFIG_SENSORS_XGENE is not set
+# CONFIG_SENSORS_ZL6100 is not set
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_16550A_VARIANTS=y
+# CONFIG_SERIAL_8250_ACCENT is not set
+# CONFIG_SERIAL_8250_ASPEED_VUART is not set
+# CONFIG_SERIAL_8250_BOCA is not set
+CONFIG_SERIAL_8250_CONSOLE=y
+# CONFIG_SERIAL_8250_CS is not set
+# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set
+# CONFIG_SERIAL_8250_DETECT_IRQ is not set
+CONFIG_SERIAL_8250_DMA=y
+# CONFIG_SERIAL_8250_DW is not set
+# CONFIG_SERIAL_8250_EM is not set
+# CONFIG_SERIAL_8250_EXAR is not set
+# CONFIG_SERIAL_8250_EXAR_ST16C554 is not set
+# CONFIG_SERIAL_8250_EXTENDED is not set
+# CONFIG_SERIAL_8250_FINTEK is not set
+# CONFIG_SERIAL_8250_FOURPORT is not set
+# CONFIG_SERIAL_8250_HUB6 is not set
+# CONFIG_SERIAL_8250_INGENIC is not set
+# CONFIG_SERIAL_8250_LPSS is not set
+# CONFIG_SERIAL_8250_MANY_PORTS is not set
+# CONFIG_SERIAL_8250_MID is not set
+# CONFIG_SERIAL_8250_MOXA is not set
+CONFIG_SERIAL_8250_NR_UARTS=2
+# CONFIG_SERIAL_8250_PCI is not set
+# CONFIG_SERIAL_8250_PERICOM is not set
+# CONFIG_SERIAL_8250_RSA is not set
+# CONFIG_SERIAL_8250_RT288X is not set
+CONFIG_SERIAL_8250_RUNTIME_UARTS=2
+# CONFIG_SERIAL_ALTERA_JTAGUART is not set
+# CONFIG_SERIAL_ALTERA_UART is not set
+# CONFIG_SERIAL_AMBA_PL010 is not set
+# CONFIG_SERIAL_AMBA_PL011 is not set
+# CONFIG_SERIAL_ARC is not set
+# CONFIG_SERIAL_BCM63XX is not set
+# CONFIG_SERIAL_CONEXANT_DIGICOLOR is not set
+CONFIG_SERIAL_CORE=y
+CONFIG_SERIAL_CORE_CONSOLE=y
+# CONFIG_SERIAL_DEV_BUS is not set
+CONFIG_SERIAL_EARLYCON=y
+# CONFIG_SERIAL_EARLYCON_ARM_SEMIHOST is not set
+# CONFIG_SERIAL_FSL_LINFLEXUART is not set
+# CONFIG_SERIAL_FSL_LPUART is not set
+# CONFIG_SERIAL_GRLIB_GAISLER_APBUART is not set
+# CONFIG_SERIAL_IFX6X60 is not set
+# CONFIG_SERIAL_JSM is not set
+# CONFIG_SERIAL_MAX3100 is not set
+# CONFIG_SERIAL_MAX310X is not set
+# CONFIG_SERIAL_MULTI_INSTANTIATE is not set
+# CONFIG_SERIAL_NONSTANDARD is not set
+# CONFIG_SERIAL_OF_PLATFORM is not set
+# CONFIG_SERIAL_OF_PLATFORM_NWPSERIAL is not set
+# CONFIG_SERIAL_PCH_UART is not set
+# CONFIG_SERIAL_RP2 is not set
+# CONFIG_SERIAL_SC16IS7XX is not set
+# CONFIG_SERIAL_SCCNXP is not set
+# CONFIG_SERIAL_SH_SCI is not set
+# CONFIG_SERIAL_SIFIVE is not set
+# CONFIG_SERIAL_SPRD is not set
+# CONFIG_SERIAL_STM32 is not set
+# CONFIG_SERIAL_ST_ASC is not set
+# CONFIG_SERIAL_TIMBERDALE is not set
+# CONFIG_SERIAL_UARTLITE is not set
+# CONFIG_SERIAL_XILINX_PS_UART is not set
+# CONFIG_SERIO is not set
+# CONFIG_SERIO_ALTERA_PS2 is not set
+# CONFIG_SERIO_AMBAKMI is not set
+# CONFIG_SERIO_APBPS2 is not set
+# CONFIG_SERIO_ARC_PS2 is not set
+# CONFIG_SERIO_CT82C710 is not set
+# CONFIG_SERIO_GPIO_PS2 is not set
+# CONFIG_SERIO_I8042 is not set
+# CONFIG_SERIO_LIBPS2 is not set
+# CONFIG_SERIO_PARKBD is not set
+# CONFIG_SERIO_PCIPS2 is not set
+# CONFIG_SERIO_PS2MULT is not set
+# CONFIG_SERIO_RAW is not set
+# CONFIG_SERIO_SERPORT is not set
+# CONFIG_SERIO_SUN4I_PS2 is not set
+# CONFIG_SFC is not set
+# CONFIG_SFC_FALCON is not set
+# CONFIG_SFC_SIENA is not set
+# CONFIG_SFI is not set
+# CONFIG_SFP is not set
+# CONFIG_SF_PDMA is not set
+# CONFIG_SGETMASK_SYSCALL is not set
+# CONFIG_SGI_IOC4 is not set
+# CONFIG_SGI_IP22 is not set
+# CONFIG_SGI_IP27 is not set
+# CONFIG_SGI_IP28 is not set
+# CONFIG_SGI_IP30 is not set
+# CONFIG_SGI_IP32 is not set
+# CONFIG_SGI_MFD_IOC3 is not set
+# CONFIG_SGI_PARTITION is not set
+# CONFIG_SG_POOL is not set
+# CONFIG_SG_SPLIT is not set
+# CONFIG_SHADOW_CALL_STACK is not set
+CONFIG_SHMEM=y
+# CONFIG_SHRINKER_DEBUG is not set
+# CONFIG_SHUFFLE_PAGE_ALLOCATOR is not set
+# CONFIG_SH_ETH is not set
+# CONFIG_SH_TIMER_CMT is not set
+# CONFIG_SH_TIMER_MTU2 is not set
+# CONFIG_SH_TIMER_TMU is not set
+# CONFIG_SI1133 is not set
+# CONFIG_SI1145 is not set
+# CONFIG_SI7005 is not set
+# CONFIG_SI7020 is not set
+# CONFIG_SIBYTE_BIGSUR is not set
+# CONFIG_SIBYTE_CARMEL is not set
+# CONFIG_SIBYTE_CRHINE is not set
+# CONFIG_SIBYTE_CRHONE is not set
+# CONFIG_SIBYTE_LITTLESUR is not set
+# CONFIG_SIBYTE_RHONE is not set
+# CONFIG_SIBYTE_SENTOSA is not set
+# CONFIG_SIBYTE_SWARM is not set
+CONFIG_SIGNALFD=y
+# CONFIG_SIGNED_PE_FILE_VERIFICATION is not set
+# CONFIG_SIMPLE_GPIO is not set
+# CONFIG_SIMPLE_PM_BUS is not set
+# CONFIG_SIOX is not set
+# CONFIG_SIS190 is not set
+# CONFIG_SIS900 is not set
+# CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
+# CONFIG_SKY2_DEBUG is not set
+# CONFIG_SLAB is not set
+# CONFIG_SLAB_DEPRECATED is not set
+CONFIG_SLABINFO=y
+CONFIG_SLAB_FREELIST_HARDENED=y
+CONFIG_SLAB_FREELIST_RANDOM=y
+CONFIG_SLAB_MERGE_DEFAULT=y
+# CONFIG_SLHC is not set
+# CONFIG_SLICOSS is not set
+# CONFIG_SLIMBUS is not set
+# CONFIG_SLIP is not set
+# CONFIG_SLOB is not set
+# CONFIG_SLS is not set
+CONFIG_SLUB=y
+CONFIG_SLUB_CPU_PARTIAL=y
+# CONFIG_SLUB_DEBUG is not set
+# CONFIG_SLUB_DEBUG_ON is not set
+# CONFIG_SLUB_MEMCG_SYSFS_ON is not set
+# CONFIG_SLUB_STATS is not set
+# CONFIG_SLUB_TINY is not set
+# CONFIG_SMARTJOYPLUS_FF is not set
+# CONFIG_SMB_SERVER is not set
+# CONFIG_SMC911X is not set
+# CONFIG_SMC9194 is not set
+# CONFIG_SMC91X is not set
+# CONFIG_SMP is not set
+# CONFIG_SMSC911X is not set
+# CONFIG_SMSC9420 is not set
+# CONFIG_SMSC_PHY is not set
+# CONFIG_SMS_SDIO_DRV is not set
+# CONFIG_SMS_USB_DRV is not set
+# CONFIG_SM_CAMCC_8250 is not set
+# CONFIG_SM_FTL is not set
+# CONFIG_SM_GCC_6115 is not set
+# CONFIG_SM_GCC_6125 is not set
+# CONFIG_SM_GCC_6350 is not set
+# CONFIG_SM_GCC_6375 is not set
+# CONFIG_SM_GCC_8350 is not set
+# CONFIG_SND is not set
+# CONFIG_SND_AC97_POWER_SAVE is not set
+# CONFIG_SND_AD1816A is not set
+# CONFIG_SND_AD1848 is not set
+# CONFIG_SND_AD1889 is not set
+# CONFIG_SND_ADLIB is not set
+# CONFIG_SND_ALI5451 is not set
+# CONFIG_SND_ALOOP is not set
+# CONFIG_SND_ALS100 is not set
+# CONFIG_SND_ALS300 is not set
+# CONFIG_SND_ALS4000 is not set
+# CONFIG_SND_AMD_ACP_CONFIG is not set
+# CONFIG_SND_ARM is not set
+# CONFIG_SND_ASIHPI is not set
+# CONFIG_SND_ATIIXP is not set
+# CONFIG_SND_ATIIXP_MODEM is not set
+# CONFIG_SND_ATMEL_AC97C is not set
+# CONFIG_SND_ATMEL_SOC is not set
+# CONFIG_SND_AU8810 is not set
+# CONFIG_SND_AU8820 is not set
+# CONFIG_SND_AU8830 is not set
+# CONFIG_SND_AUDIO_GRAPH_CARD is not set
+# CONFIG_SND_AUDIO_GRAPH_CARD2 is not set
+# CONFIG_SND_AUDIO_GRAPH_SCU_CARD is not set
+# CONFIG_SND_AW2 is not set
+# CONFIG_SND_AZT2320 is not set
+# CONFIG_SND_AZT3328 is not set
+# CONFIG_SND_BCD2000 is not set
+# CONFIG_SND_BCM63XX_I2S_WHISTLER is not set
+# CONFIG_SND_BT87X is not set
+# CONFIG_SND_CA0106 is not set
+# CONFIG_SND_CMI8330 is not set
+# CONFIG_SND_CMIPCI is not set
+# CONFIG_SND_CS4231 is not set
+# CONFIG_SND_CS4236 is not set
+# CONFIG_SND_CS4281 is not set
+# CONFIG_SND_CS46XX is not set
+# CONFIG_SND_CS5530 is not set
+# CONFIG_SND_CS5535AUDIO is not set
+# CONFIG_SND_CTL_FAST_LOOKUP is not set
+# CONFIG_SND_CTL_INPUT_VALIDATION is not set
+# CONFIG_SND_CTXFI is not set
+# CONFIG_SND_DARLA20 is not set
+# CONFIG_SND_DARLA24 is not set
+# CONFIG_SND_DEBUG is not set
+# CONFIG_SND_DESIGNWARE_I2S is not set
+CONFIG_SND_DRIVERS=y
+# CONFIG_SND_DUMMY is not set
+# CONFIG_SND_DYNAMIC_MINORS is not set
+# CONFIG_SND_ECHO3G is not set
+# CONFIG_SND_EDMA_SOC is not set
+# CONFIG_SND_EMU10K1 is not set
+# CONFIG_SND_EMU10K1X is not set
+# CONFIG_SND_EMU10K1_SEQ is not set
+# CONFIG_SND_ENS1370 is not set
+# CONFIG_SND_ENS1371 is not set
+# CONFIG_SND_ES1688 is not set
+# CONFIG_SND_ES18XX is not set
+# CONFIG_SND_ES1938 is not set
+# CONFIG_SND_ES1968 is not set
+# CONFIG_SND_FIREWIRE is not set
+# CONFIG_SND_FM801 is not set
+# CONFIG_SND_GINA20 is not set
+# CONFIG_SND_GINA24 is not set
+# CONFIG_SND_GUSCLASSIC is not set
+# CONFIG_SND_GUSEXTREME is not set
+# CONFIG_SND_GUSMAX is not set
+# CONFIG_SND_HDA_CODEC_CS8409 is not set
+# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_HDA_INTEL_DETECT_DMIC is not set
+# CONFIG_SND_HDA_INTEL_HDMI_SILENT_STREAM is not set
+CONFIG_SND_HDA_POWER_SAVE_DEFAULT=0
+CONFIG_SND_HDA_PREALLOC_SIZE=64
+# CONFIG_SND_HDSP is not set
+# CONFIG_SND_HDSPM is not set
+# CONFIG_SND_HRTIMER is not set
+# CONFIG_SND_HWDEP is not set
+# CONFIG_SND_I2S_HI6210_I2S is not set
+# CONFIG_SND_ICE1712 is not set
+# CONFIG_SND_ICE1724 is not set
+# CONFIG_SND_INDIGO is not set
+# CONFIG_SND_INDIGODJ is not set
+# CONFIG_SND_INDIGODJX is not set
+# CONFIG_SND_INDIGOIO is not set
+# CONFIG_SND_INDIGOIOX is not set
+# CONFIG_SND_INTEL8X0 is not set
+# CONFIG_SND_INTEL8X0M is not set
+# CONFIG_SND_INTERWAVE is not set
+# CONFIG_SND_INTERWAVE_STB is not set
+# CONFIG_SND_ISA is not set
+# CONFIG_SND_JZ4740_SOC_I2S is not set
+# CONFIG_SND_KIRKWOOD_SOC is not set
+# CONFIG_SND_KORG1212 is not set
+# CONFIG_SND_LAYLA20 is not set
+# CONFIG_SND_LAYLA24 is not set
+# CONFIG_SND_LOLA is not set
+# CONFIG_SND_LX6464ES is not set
+# CONFIG_SND_MAESTRO3 is not set
+CONFIG_SND_MAX_CARDS=16
+# CONFIG_SND_MIA is not set
+# CONFIG_SND_MIPS is not set
+# CONFIG_SND_MIRO is not set
+# CONFIG_SND_MIXART is not set
+# CONFIG_SND_MIXER_OSS is not set
+# CONFIG_SND_MONA is not set
+# CONFIG_SND_MPC52xx_SOC_EFIKA is not set
+# CONFIG_SND_MPU401 is not set
+# CONFIG_SND_MTPAV is not set
+# CONFIG_SND_MTS64 is not set
+# CONFIG_SND_MXS_SOC is not set
+# CONFIG_SND_NM256 is not set
+# CONFIG_SND_OPL3SA2 is not set
+# CONFIG_SND_OPL3_LIB_SEQ is not set
+# CONFIG_SND_OPL4_LIB_SEQ is not set
+# CONFIG_SND_OPTI92X_AD1848 is not set
+# CONFIG_SND_OPTI92X_CS4231 is not set
+# CONFIG_SND_OPTI93X is not set
+CONFIG_SND_OSSEMUL=y
+# CONFIG_SND_OXYGEN is not set
+CONFIG_SND_PCI=y
+# CONFIG_SND_PCM is not set
+# CONFIG_SND_PCMCIA is not set
+# CONFIG_SND_PCM_OSS is not set
+CONFIG_SND_PCM_OSS_PLUGINS=y
+# CONFIG_SND_PCM_TIMER is not set
+# CONFIG_SND_PCM_XRUN_DEBUG is not set
+# CONFIG_SND_PCXHR is not set
+# CONFIG_SND_PDAUDIOCF is not set
+# CONFIG_SND_PORTMAN2X4 is not set
+# CONFIG_SND_POWERPC_SOC is not set
+# CONFIG_SND_PPC is not set
+CONFIG_SND_PROC_FS=y
+# CONFIG_SND_RAWMIDI is not set
+# CONFIG_SND_RAWMIDI_SEQ is not set
+# CONFIG_SND_RIPTIDE is not set
+# CONFIG_SND_RME32 is not set
+# CONFIG_SND_RME96 is not set
+# CONFIG_SND_RME9652 is not set
+# CONFIG_SND_RTCTIMER is not set
+# CONFIG_SND_SB16 is not set
+# CONFIG_SND_SB8 is not set
+# CONFIG_SND_SBAWE is not set
+# CONFIG_SND_SBAWE_SEQ is not set
+# CONFIG_SND_SE6X is not set
+# CONFIG_SND_SEQUENCER is not set
+# CONFIG_SND_SERIAL_GENERIC is not set
+# CONFIG_SND_SERIAL_U16550 is not set
+# CONFIG_SND_SIMPLE_CARD is not set
+# CONFIG_SND_SIMPLE_SCU_CARD is not set
+# CONFIG_SND_SIS7019 is not set
+# CONFIG_SND_SOC is not set
+# CONFIG_SND_SOC_AC97_CODEC is not set
+# CONFIG_SND_SOC_AD193X_I2C is not set
+# CONFIG_SND_SOC_AD193X_SPI is not set
+# CONFIG_SND_SOC_ADAU1372_I2C is not set
+# CONFIG_SND_SOC_ADAU1372_SPI is not set
+# CONFIG_SND_SOC_ADAU1701 is not set
+# CONFIG_SND_SOC_ADAU1761_I2C is not set
+# CONFIG_SND_SOC_ADAU1761_SPI is not set
+# CONFIG_SND_SOC_ADAU7002 is not set
+# CONFIG_SND_SOC_ADAU7118_HW is not set
+# CONFIG_SND_SOC_ADAU7118_I2C is not set
+# CONFIG_SND_SOC_ADI is not set
+# CONFIG_SND_SOC_AK4104 is not set
+# CONFIG_SND_SOC_AK4118 is not set
+# CONFIG_SND_SOC_AK4375 is not set
+# CONFIG_SND_SOC_AK4458 is not set
+# CONFIG_SND_SOC_AK4554 is not set
+# CONFIG_SND_SOC_AK4613 is not set
+# CONFIG_SND_SOC_AK4642 is not set
+# CONFIG_SND_SOC_AK5386 is not set
+# CONFIG_SND_SOC_AK5558 is not set
+# CONFIG_SND_SOC_ALC5623 is not set
+# CONFIG_SND_SOC_AMD_ACP is not set
+# CONFIG_SND_SOC_AMD_ACP3x is not set
+# CONFIG_SND_SOC_AMD_ACP5x is not set
+# CONFIG_SND_SOC_AMD_RENOIR is not set
+# CONFIG_SND_SOC_AU1XAUDIO is not set
+# CONFIG_SND_SOC_AU1XPSC is not set
+# CONFIG_SND_SOC_AW8738 is not set
+# CONFIG_SND_SOC_BD28623 is not set
+# CONFIG_SND_SOC_BT_SCO is not set
+# CONFIG_SND_SOC_CS35L32 is not set
+# CONFIG_SND_SOC_CS35L33 is not set
+# CONFIG_SND_SOC_CS35L34 is not set
+# CONFIG_SND_SOC_CS35L35 is not set
+# CONFIG_SND_SOC_CS35L36 is not set
+# CONFIG_SND_SOC_CS35L41_I2C is not set
+# CONFIG_SND_SOC_CS35L41_SPI is not set
+# CONFIG_SND_SOC_CS35L45_I2C is not set
+# CONFIG_SND_SOC_CS35L45_SPI is not set
+# CONFIG_SND_SOC_CS4234 is not set
+# CONFIG_SND_SOC_CS4265 is not set
+# CONFIG_SND_SOC_CS4270 is not set
+# CONFIG_SND_SOC_CS4271 is not set
+# CONFIG_SND_SOC_CS4271_I2C is not set
+# CONFIG_SND_SOC_CS4271_SPI is not set
+# CONFIG_SND_SOC_CS42L42 is not set
+# CONFIG_SND_SOC_CS42L51_I2C is not set
+# CONFIG_SND_SOC_CS42L52 is not set
+# CONFIG_SND_SOC_CS42L56 is not set
+# CONFIG_SND_SOC_CS42L73 is not set
+# CONFIG_SND_SOC_CS42L83 is not set
+# CONFIG_SND_SOC_CS42XX8_I2C is not set
+# CONFIG_SND_SOC_CS43130 is not set
+# CONFIG_SND_SOC_CS4341 is not set
+# CONFIG_SND_SOC_CS4349 is not set
+# CONFIG_SND_SOC_CS53L30 is not set
+# CONFIG_SND_SOC_CX2072X is not set
+# CONFIG_SND_SOC_DA7213 is not set
+# CONFIG_SND_SOC_DIO2125 is not set
+# CONFIG_SND_SOC_DMIC is not set
+# CONFIG_SND_SOC_ES7134 is not set
+# CONFIG_SND_SOC_ES7241 is not set
+# CONFIG_SND_SOC_ES8316 is not set
+# CONFIG_SND_SOC_ES8326 is not set
+# CONFIG_SND_SOC_ES8328 is not set
+# CONFIG_SND_SOC_ES8328_I2C is not set
+# CONFIG_SND_SOC_ES8328_SPI is not set
+# CONFIG_SND_SOC_EUKREA_TLV320 is not set
+# CONFIG_SND_SOC_FSL_ASOC_CARD is not set
+# CONFIG_SND_SOC_FSL_ASRC is not set
+# CONFIG_SND_SOC_FSL_AUD2HTX is not set
+# CONFIG_SND_SOC_FSL_AUDMIX is not set
+# CONFIG_SND_SOC_FSL_ESAI is not set
+# CONFIG_SND_SOC_FSL_MICFIL is not set
+# CONFIG_SND_SOC_FSL_RPMSG is not set
+# CONFIG_SND_SOC_FSL_SAI is not set
+# CONFIG_SND_SOC_FSL_SPDIF is not set
+# CONFIG_SND_SOC_FSL_SSI is not set
+# CONFIG_SND_SOC_FSL_XCVR is not set
+# CONFIG_SND_SOC_GTM601 is not set
+# CONFIG_SND_SOC_HDA is not set
+# CONFIG_SND_SOC_ICS43432 is not set
+# CONFIG_SND_SOC_IMG is not set
+# CONFIG_SND_SOC_IMX_AUDMIX is not set
+# CONFIG_SND_SOC_IMX_AUDMUX is not set
+# CONFIG_SND_SOC_IMX_CARD is not set
+# CONFIG_SND_SOC_IMX_ES8328 is not set
+# CONFIG_SND_SOC_IMX_HDMI is not set
+# CONFIG_SND_SOC_IMX_RPMSG is not set
+# CONFIG_SND_SOC_IMX_SPDIF is not set
+# CONFIG_SND_SOC_IMX_WM8962 is not set
+# CONFIG_SND_SOC_INNO_RK3036 is not set
+# CONFIG_SND_SOC_INTEL_APL is not set
+# CONFIG_SND_SOC_INTEL_BAYTRAIL is not set
+# CONFIG_SND_SOC_INTEL_BDW_RT5677_MACH is not set
+# CONFIG_SND_SOC_INTEL_BXT_DA7219_MAX98357A_MACH is not set
+# CONFIG_SND_SOC_INTEL_BXT_RT298_MACH is not set
+# CONFIG_SND_SOC_INTEL_BYTCR_RT5640_MACH is not set
+# CONFIG_SND_SOC_INTEL_BYTCR_RT5651_MACH is not set
+# CONFIG_SND_SOC_INTEL_BYT_CHT_DA7213_MACH is not set
+# CONFIG_SND_SOC_INTEL_BYT_CHT_ES8316_MACH is not set
+# CONFIG_SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH is not set
+# CONFIG_SND_SOC_INTEL_BYT_MAX98090_MACH is not set
+# CONFIG_SND_SOC_INTEL_BYT_RT5640_MACH is not set
+# CONFIG_SND_SOC_INTEL_CATPT is not set
+# CONFIG_SND_SOC_INTEL_CFL is not set
+# CONFIG_SND_SOC_INTEL_CHT_BSW_MAX98090_TI_MACH is not set
+# CONFIG_SND_SOC_INTEL_CHT_BSW_NAU8824_MACH is not set
+# CONFIG_SND_SOC_INTEL_CHT_BSW_RT5645_MACH is not set
+# CONFIG_SND_SOC_INTEL_CHT_BSW_RT5672_MACH is not set
+# CONFIG_SND_SOC_INTEL_CML_H is not set
+# CONFIG_SND_SOC_INTEL_CML_LP is not set
+# CONFIG_SND_SOC_INTEL_CNL is not set
+# CONFIG_SND_SOC_INTEL_GLK is not set
+# CONFIG_SND_SOC_INTEL_HASWELL is not set
+# CONFIG_SND_SOC_INTEL_KBL is not set
+# CONFIG_SND_SOC_INTEL_KBL_RT5663_MAX98927_MACH is not set
+# CONFIG_SND_SOC_INTEL_KBL_RT5663_RT5514_MAX98927_MACH is not set
+# CONFIG_SND_SOC_INTEL_KEEMBAY is not set
+# CONFIG_SND_SOC_INTEL_SKL is not set
+# CONFIG_SND_SOC_INTEL_SKL_NAU88L25_MAX98357A_MACH is not set
+# CONFIG_SND_SOC_INTEL_SKL_NAU88L25_SSM4567_MACH is not set
+# CONFIG_SND_SOC_INTEL_SKL_RT286_MACH is not set
+# CONFIG_SND_SOC_INTEL_SKYLAKE is not set
+# CONFIG_SND_SOC_INTEL_SST is not set
+CONFIG_SND_SOC_INTEL_SST_TOPLEVEL=y
+# CONFIG_SND_SOC_INTEL_USER_FRIENDLY_LONG_NAMES is not set
+# CONFIG_SND_SOC_JZ4725B_CODEC is not set
+# CONFIG_SND_SOC_JZ4740_CODEC is not set
+# CONFIG_SND_SOC_JZ4770_CODEC is not set
+# CONFIG_SND_SOC_LPASS_RX_MACRO is not set
+# CONFIG_SND_SOC_LPASS_TX_MACRO is not set
+# CONFIG_SND_SOC_LPASS_VA_MACRO is not set
+# CONFIG_SND_SOC_LPASS_WSA_MACRO is not set
+# CONFIG_SND_SOC_MA120X0P is not set
+# CONFIG_SND_SOC_MAX9759 is not set
+# CONFIG_SND_SOC_MAX98088 is not set
+# CONFIG_SND_SOC_MAX98357A is not set
+# CONFIG_SND_SOC_MAX98373 is not set
+# CONFIG_SND_SOC_MAX98373_I2C is not set
+# CONFIG_SND_SOC_MAX98390 is not set
+# CONFIG_SND_SOC_MAX98396 is not set
+# CONFIG_SND_SOC_MAX98504 is not set
+# CONFIG_SND_SOC_MAX98520 is not set
+# CONFIG_SND_SOC_MAX9860 is not set
+# CONFIG_SND_SOC_MAX9867 is not set
+# CONFIG_SND_SOC_MAX98927 is not set
+# CONFIG_SND_SOC_MEDIATEK is not set
+# CONFIG_SND_SOC_MPC5200_AC97 is not set
+# CONFIG_SND_SOC_MPC5200_I2S is not set
+# CONFIG_SND_SOC_MSM8916_WCD_ANALOG is not set
+# CONFIG_SND_SOC_MSM8916_WCD_DIGITAL is not set
+# CONFIG_SND_SOC_MT2701 is not set
+# CONFIG_SND_SOC_MT6351 is not set
+# CONFIG_SND_SOC_MT6358 is not set
+# CONFIG_SND_SOC_MT6359 is not set
+# CONFIG_SND_SOC_MT6359_ACCDET is not set
+# CONFIG_SND_SOC_MT6660 is not set
+# CONFIG_SND_SOC_MT6797 is not set
+# CONFIG_SND_SOC_MT8173 is not set
+# CONFIG_SND_SOC_MT8183 is not set
+# CONFIG_SND_SOC_MT8192 is not set
+# CONFIG_SND_SOC_MT8195 is not set
+# CONFIG_SND_SOC_MTK_BTCVSD is not set
+# CONFIG_SND_SOC_NAU8315 is not set
+# CONFIG_SND_SOC_NAU8540 is not set
+# CONFIG_SND_SOC_NAU8810 is not set
+# CONFIG_SND_SOC_NAU8821 is not set
+# CONFIG_SND_SOC_NAU8822 is not set
+# CONFIG_SND_SOC_NAU8824 is not set
+# CONFIG_SND_SOC_PCM1681 is not set
+# CONFIG_SND_SOC_PCM1789_I2C is not set
+# CONFIG_SND_SOC_PCM1792A is not set
+# CONFIG_SND_SOC_PCM179X_I2C is not set
+# CONFIG_SND_SOC_PCM179X_SPI is not set
+# CONFIG_SND_SOC_PCM186X_I2C is not set
+# CONFIG_SND_SOC_PCM186X_SPI is not set
+# CONFIG_SND_SOC_PCM3060_I2C is not set
+# CONFIG_SND_SOC_PCM3060_SPI is not set
+# CONFIG_SND_SOC_PCM3168A_I2C is not set
+# CONFIG_SND_SOC_PCM3168A_SPI is not set
+# CONFIG_SND_SOC_PCM5102A is not set
+# CONFIG_SND_SOC_PCM512x_I2C is not set
+# CONFIG_SND_SOC_PCM512x_SPI is not set
+# CONFIG_SND_SOC_QCOM is not set
+# CONFIG_SND_SOC_RK3328 is not set
+# CONFIG_SND_SOC_RK817 is not set
+# CONFIG_SND_SOC_ROCKCHIP is not set
+# CONFIG_SND_SOC_RT5616 is not set
+# CONFIG_SND_SOC_RT5631 is not set
+# CONFIG_SND_SOC_RT5640 is not set
+# CONFIG_SND_SOC_RT5659 is not set
+# CONFIG_SND_SOC_RT5677_SPI is not set
+# CONFIG_SND_SOC_RT9120 is not set
+# CONFIG_SND_SOC_SGTL5000 is not set
+# CONFIG_SND_SOC_SIMPLE_AMPLIFIER is not set
+# CONFIG_SND_SOC_SIMPLE_MUX is not set
+# CONFIG_SND_SOC_SIRF_AUDIO_CODEC is not set
+# CONFIG_SND_SOC_SOF_TOPLEVEL is not set
+# CONFIG_SND_SOC_SPDIF is not set
+# CONFIG_SND_SOC_SRC4XXX_I2C is not set
+# CONFIG_SND_SOC_SSM2305 is not set
+# CONFIG_SND_SOC_SSM2518 is not set
+# CONFIG_SND_SOC_SSM2602_I2C is not set
+# CONFIG_SND_SOC_SSM2602_SPI is not set
+# CONFIG_SND_SOC_SSM4567 is not set
+# CONFIG_SND_SOC_STA32X is not set
+# CONFIG_SND_SOC_STA350 is not set
+# CONFIG_SND_SOC_STI_SAS is not set
+# CONFIG_SND_SOC_TAS2552 is not set
+# CONFIG_SND_SOC_TAS2562 is not set
+# CONFIG_SND_SOC_TAS2764 is not set
+# CONFIG_SND_SOC_TAS2770 is not set
+# CONFIG_SND_SOC_TAS2780 is not set
+# CONFIG_SND_SOC_TAS5086 is not set
+# CONFIG_SND_SOC_TAS571X is not set
+# CONFIG_SND_SOC_TAS5720 is not set
+# CONFIG_SND_SOC_TAS5805M is not set
+# CONFIG_SND_SOC_TAS6424 is not set
+# CONFIG_SND_SOC_TDA7419 is not set
+# CONFIG_SND_SOC_TFA9879 is not set
+# CONFIG_SND_SOC_TFA989X is not set
+# CONFIG_SND_SOC_TLV320ADC3XXX is not set
+# CONFIG_SND_SOC_TLV320ADCX140 is not set
+# CONFIG_SND_SOC_TLV320AIC23_I2C is not set
+# CONFIG_SND_SOC_TLV320AIC23_SPI is not set
+# CONFIG_SND_SOC_TLV320AIC31XX is not set
+# CONFIG_SND_SOC_TLV320AIC32X4_I2C is not set
+# CONFIG_SND_SOC_TLV320AIC32X4_SPI is not set
+# CONFIG_SND_SOC_TLV320AIC3X is not set
+# CONFIG_SND_SOC_TLV320AIC3X_I2C is not set
+# CONFIG_SND_SOC_TLV320AIC3X_SPI is not set
+# CONFIG_SND_SOC_TPA6130A2 is not set
+# CONFIG_SND_SOC_TS3A227E is not set
+# CONFIG_SND_SOC_TSCS42XX is not set
+# CONFIG_SND_SOC_TSCS454 is not set
+# CONFIG_SND_SOC_UDA1334 is not set
+# CONFIG_SND_SOC_WM8510 is not set
+# CONFIG_SND_SOC_WM8523 is not set
+# CONFIG_SND_SOC_WM8524 is not set
+# CONFIG_SND_SOC_WM8580 is not set
+# CONFIG_SND_SOC_WM8711 is not set
+# CONFIG_SND_SOC_WM8728 is not set
+# CONFIG_SND_SOC_WM8731 is not set
+# CONFIG_SND_SOC_WM8731_I2C is not set
+# CONFIG_SND_SOC_WM8731_SPI is not set
+# CONFIG_SND_SOC_WM8737 is not set
+# CONFIG_SND_SOC_WM8741 is not set
+# CONFIG_SND_SOC_WM8750 is not set
+# CONFIG_SND_SOC_WM8753 is not set
+# CONFIG_SND_SOC_WM8770 is not set
+# CONFIG_SND_SOC_WM8776 is not set
+# CONFIG_SND_SOC_WM8782 is not set
+# CONFIG_SND_SOC_WM8804_I2C is not set
+# CONFIG_SND_SOC_WM8804_SPI is not set
+# CONFIG_SND_SOC_WM8903 is not set
+# CONFIG_SND_SOC_WM8904 is not set
+# CONFIG_SND_SOC_WM8940 is not set
+# CONFIG_SND_SOC_WM8960 is not set
+# CONFIG_SND_SOC_WM8962 is not set
+# CONFIG_SND_SOC_WM8974 is not set
+# CONFIG_SND_SOC_WM8978 is not set
+# CONFIG_SND_SOC_WM8985 is not set
+# CONFIG_SND_SOC_XILINX_AUDIO_FORMATTER is not set
+# CONFIG_SND_SOC_XILINX_I2S is not set
+# CONFIG_SND_SOC_XILINX_SPDIF is not set
+# CONFIG_SND_SOC_XTFPGA_I2S is not set
+# CONFIG_SND_SOC_ZL38060 is not set
+# CONFIG_SND_SOC_ZX_AUD96P22 is not set
+# CONFIG_SND_SONICVIBES is not set
+# CONFIG_SND_SPI is not set
+# CONFIG_SND_SSCAPE is not set
+# CONFIG_SND_SST_ATOM_HIFI2_PLATFORM_ACPI is not set
+# CONFIG_SND_SST_ATOM_HIFI2_PLATFORM_PCI is not set
+# CONFIG_SND_SUN4I_CODEC is not set
+# CONFIG_SND_SUPPORT_OLD_API is not set
+# CONFIG_SND_TEST_COMPONENT is not set
+# CONFIG_SND_TIMER is not set
+# CONFIG_SND_TRIDENT is not set
+CONFIG_SND_USB=y
+# CONFIG_SND_USB_6FIRE is not set
+# CONFIG_SND_USB_AUDIO is not set
+# CONFIG_SND_USB_CAIAQ is not set
+# CONFIG_SND_USB_HIFACE is not set
+# CONFIG_SND_USB_POD is not set
+# CONFIG_SND_USB_PODHD is not set
+# CONFIG_SND_USB_TONEPORT is not set
+# CONFIG_SND_USB_UA101 is not set
+# CONFIG_SND_USB_US122L is not set
+# CONFIG_SND_USB_USX2Y is not set
+# CONFIG_SND_USB_VARIAX is not set
+# CONFIG_SND_VERBOSE_PRINTK is not set
+CONFIG_SND_VERBOSE_PROCFS=y
+# CONFIG_SND_VIA82XX is not set
+# CONFIG_SND_VIA82XX_MODEM is not set
+# CONFIG_SND_VIRTIO is not set
+# CONFIG_SND_VIRTUOSO is not set
+# CONFIG_SND_VX222 is not set
+# CONFIG_SND_VXPOCKET is not set
+# CONFIG_SND_WAVEFRONT is not set
+CONFIG_SND_X86=y
+# CONFIG_SND_XEN_FRONTEND is not set
+# CONFIG_SND_YMFPCI is not set
+# CONFIG_SNI_RM is not set
+# CONFIG_SOCIONEXT_SYNQUACER_PREITS is not set
+# CONFIG_SOCK_CGROUP_DATA is not set
+# CONFIG_SOC_AM33XX is not set
+# CONFIG_SOC_AM43XX is not set
+# CONFIG_SOC_BRCMSTB is not set
+# CONFIG_SOC_CAMERA is not set
+# CONFIG_SOC_DRA7XX is not set
+# CONFIG_SOC_HAS_OMAP2_SDRC is not set
+# CONFIG_SOC_OMAP5 is not set
+# CONFIG_SOC_TI is not set
+# CONFIG_SOFTLOCKUP_DETECTOR is not set
+# CONFIG_SOFT_WATCHDOG is not set
+# CONFIG_SOLARIS_X86_PARTITION is not set
+# CONFIG_SONYPI is not set
+# CONFIG_SONY_LAPTOP is not set
+# CONFIG_SOUND is not set
+# CONFIG_SOUNDWIRE is not set
+# CONFIG_SOUND_OSS_CORE is not set
+# CONFIG_SOUND_OSS_CORE_PRECLAIM is not set
+# CONFIG_SOUND_PRIME is not set
+# CONFIG_SP5100_TCO is not set
+# CONFIG_SPARSEMEM_MANUAL is not set
+# CONFIG_SPARSEMEM_STATIC is not set
+# CONFIG_SPARSEMEM_VMEMMAP_ENABLE is not set
+# CONFIG_SPARSE_IRQ is not set
+# CONFIG_SPARSE_RCU_POINTER is not set
+# CONFIG_SPEAKUP is not set
+# CONFIG_SPI is not set
+# CONFIG_SPINLOCK_TEST is not set
+# CONFIG_SPI_ALTERA is not set
+# CONFIG_SPI_AMD is not set
+# CONFIG_SPI_AU1550 is not set
+# CONFIG_SPI_AX88796C is not set
+# CONFIG_SPI_AXI_SPI_ENGINE is not set
+# CONFIG_SPI_BCM2835 is not set
+# CONFIG_SPI_BCM_QSPI is not set
+# CONFIG_SPI_BITBANG is not set
+# CONFIG_SPI_BUTTERFLY is not set
+# CONFIG_SPI_CADENCE is not set
+# CONFIG_SPI_CADENCE_QUADSPI is not set
+# CONFIG_SPI_CADENCE_XSPI is not set
+# CONFIG_SPI_DEBUG is not set
+# CONFIG_SPI_DESIGNWARE is not set
+# CONFIG_SPI_FSL_DSPI is not set
+# CONFIG_SPI_FSL_ESPI is not set
+# CONFIG_SPI_FSL_SPI is not set
+# CONFIG_SPI_GPIO is not set
+# CONFIG_SPI_GPIO_OLD is not set
+# CONFIG_SPI_IMG_SPFI is not set
+# CONFIG_SPI_LANTIQ_SSC is not set
+# CONFIG_SPI_LM70_LLP is not set
+# CONFIG_SPI_LOOPBACK_TEST is not set
+# CONFIG_SPI_MASTER is not set
+# CONFIG_SPI_MEM is not set
+# CONFIG_SPI_MICROCHIP_CORE is not set
+# CONFIG_SPI_MICROCHIP_CORE_QSPI is not set
+# CONFIG_SPI_MPC52xx is not set
+# CONFIG_SPI_MPC52xx_PSC is not set
+# CONFIG_SPI_MTK_QUADSPI is not set
+# CONFIG_SPI_MUX is not set
+# CONFIG_SPI_MXIC is not set
+# CONFIG_SPI_NXP_FLEXSPI is not set
+# CONFIG_SPI_OCTEON is not set
+# CONFIG_SPI_OC_TINY is not set
+# CONFIG_SPI_ORION is not set
+# CONFIG_SPI_PL022 is not set
+# CONFIG_SPI_PPC4xx is not set
+# CONFIG_SPI_PXA2XX is not set
+# CONFIG_SPI_PXA2XX_PCI is not set
+# CONFIG_SPI_QCOM_QSPI is not set
+# CONFIG_SPI_ROCKCHIP is not set
+# CONFIG_SPI_ROCKCHIP_SFC is not set
+# CONFIG_SPI_S3C64XX is not set
+# CONFIG_SPI_SC18IS602 is not set
+# CONFIG_SPI_SIFIVE is not set
+# CONFIG_SPI_SLAVE is not set
+# CONFIG_SPI_SPIDEV is not set
+# CONFIG_SPI_THUNDERX is not set
+# CONFIG_SPI_TI_QSPI is not set
+# CONFIG_SPI_TLE62X0 is not set
+# CONFIG_SPI_TOPCLIFF_PCH is not set
+# CONFIG_SPI_XCOMM is not set
+# CONFIG_SPI_XILINX is not set
+# CONFIG_SPI_XWAY is not set
+# CONFIG_SPI_ZYNQMP_GQSPI is not set
+CONFIG_SPLIT_PTLOCK_CPUS=4
+# CONFIG_SPMI is not set
+# CONFIG_SPS30 is not set
+# CONFIG_SPS30_I2C is not set
+# CONFIG_SPS30_SERIAL is not set
+CONFIG_SQUASHFS=y
+# CONFIG_SQUASHFS_4K_DEVBLK_SIZE is not set
+# CONFIG_SQUASHFS_DECOMP_MULTI is not set
+CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU=y
+# CONFIG_SQUASHFS_DECOMP_SINGLE is not set
+CONFIG_SQUASHFS_EMBEDDED=y
+# CONFIG_SQUASHFS_FILE_CACHE is not set
+CONFIG_SQUASHFS_FILE_DIRECT=y
+CONFIG_SQUASHFS_FRAGMENT_CACHE_SIZE=3
+# CONFIG_SQUASHFS_LZ4 is not set
+# CONFIG_SQUASHFS_LZO is not set
+# CONFIG_SQUASHFS_XATTR is not set
+CONFIG_SQUASHFS_XZ=y
+# CONFIG_SQUASHFS_ZLIB is not set
+# CONFIG_SQUASHFS_ZSTD is not set
+# CONFIG_SRAM is not set
+# CONFIG_SRF04 is not set
+# CONFIG_SRF08 is not set
+# CONFIG_SSB is not set
+# CONFIG_SSB_DEBUG is not set
+# CONFIG_SSB_DRIVER_GPIO is not set
+# CONFIG_SSB_HOST_SOC is not set
+# CONFIG_SSB_PCMCIAHOST is not set
+CONFIG_SSB_POSSIBLE=y
+# CONFIG_SSB_SDIOHOST is not set
+# CONFIG_SSB_SILENT is not set
+# CONFIG_SSFDC is not set
+# CONFIG_STACKPROTECTOR is not set
+# CONFIG_STACKPROTECTOR_PER_TASK is not set
+# CONFIG_STACKPROTECTOR_STRONG is not set
+# CONFIG_STACKTRACE is not set
+# CONFIG_STACKTRACE_BUILD_ID is not set
+CONFIG_STACKTRACE_SUPPORT=y
+CONFIG_STACK_HASH_ORDER=20
+# CONFIG_STACK_TRACER is not set
+# CONFIG_STACK_VALIDATION is not set
+CONFIG_STAGING=y
+# CONFIG_STAGING_BOARD is not set
+# CONFIG_STAGING_GASKET_FRAMEWORK is not set
+# CONFIG_STAGING_MEDIA is not set
+CONFIG_STANDALONE=y
+# CONFIG_STATIC_KEYS_SELFTEST is not set
+# CONFIG_STATIC_USERMODEHELPER is not set
+CONFIG_STDBINUTILS=y
+# CONFIG_STE10XP is not set
+# CONFIG_STE_MODEM_RPROC is not set
+# CONFIG_STK3310 is not set
+# CONFIG_STK8312 is not set
+# CONFIG_STK8BA50 is not set
+# CONFIG_STM is not set
+# CONFIG_STMMAC_ETH is not set
+# CONFIG_STMMAC_PCI is not set
+# CONFIG_STMMAC_PLATFORM is not set
+# CONFIG_STMMAC_SELFTESTS is not set
+# CONFIG_STM_DUMMY is not set
+# CONFIG_STM_SOURCE_CONSOLE is not set
+CONFIG_STP=y
+# CONFIG_STREAM_PARSER is not set
+# CONFIG_STRICT_DEVMEM is not set
+CONFIG_STRICT_KERNEL_RWX=y
+CONFIG_STRICT_MODULE_RWX=y
+# CONFIG_STRING_SELFTEST is not set
+CONFIG_STRIP_ASM_SYMS=y
+# CONFIG_STX104 is not set
+# CONFIG_ST_UVIS25 is not set
+# CONFIG_SUN4I_GPADC is not set
+# CONFIG_SUN50I_DE2_BUS is not set
+# CONFIG_SUN50I_ERRATUM_UNKNOWN1 is not set
+# CONFIG_SUNDANCE is not set
+# CONFIG_SUNGEM is not set
+# CONFIG_SUNRPC is not set
+# CONFIG_SUNRPC_DEBUG is not set
+CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES=y
+# CONFIG_SUNRPC_GSS is not set
+# CONFIG_SUNXI_SRAM is not set
+# CONFIG_SUN_PARTITION is not set
+# CONFIG_SURFACE_3_BUTTON is not set
+# CONFIG_SURFACE_PLATFORMS is not set
+# CONFIG_SUSPEND is not set
+# CONFIG_SUSPEND_SKIP_SYNC is not set
+CONFIG_SWAP=y
+# CONFIG_SWCONFIG is not set
+# CONFIG_SWCONFIG_B53 is not set
+# CONFIG_SWCONFIG_B53_MDIO_DRIVER is not set
+# CONFIG_SWCONFIG_B53_MMAP_DRIVER is not set
+# CONFIG_SWCONFIG_B53_SPI_DRIVER is not set
+# CONFIG_SWCONFIG_B53_SRAB_DRIVER is not set
+# CONFIG_SWCONFIG_LEDS is not set
+# CONFIG_SW_SYNC is not set
+# CONFIG_SX9310 is not set
+# CONFIG_SX9324 is not set
+# CONFIG_SX9360 is not set
+# CONFIG_SX9500 is not set
+# CONFIG_SXGBE_ETH is not set
+CONFIG_SYMBOLIC_ERRNAME=y
+# CONFIG_SYNCLINK_CS is not set
+# CONFIG_SYNC_FILE is not set
+# CONFIG_SYNOPSYS_DWC_ETH_QOS is not set
+# CONFIG_SYNTH_EVENTS is not set
+# CONFIG_SYNTH_EVENT_GEN_TEST is not set
+CONFIG_SYN_COOKIES=y
+# CONFIG_SYSCON_REBOOT_MODE is not set
+CONFIG_SYSCTL=y
+# CONFIG_SYSCTL_SYSCALL is not set
+CONFIG_SYSFS=y
+# CONFIG_SYSFS_DEPRECATED is not set
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
+# CONFIG_SYSFS_SYSCALL is not set
+# CONFIG_SYSTEMPORT is not set
+# CONFIG_SYSTEM_BLACKLIST_KEYRING is not set
+# CONFIG_SYSTEM_DATA_VERIFICATION is not set
+# CONFIG_SYSTEM_TRUSTED_KEYRING is not set
+CONFIG_SYSTEM_TRUSTED_KEYS=""
+# CONFIG_SYSV68_PARTITION is not set
+CONFIG_SYSVIPC=y
+CONFIG_SYSVIPC_SYSCTL=y
+# CONFIG_SYSV_FS is not set
+# CONFIG_SYS_HYPERVISOR is not set
+# CONFIG_T5403 is not set
+# CONFIG_TARGET_CORE is not set
+# CONFIG_TASKSTATS is not set
+# CONFIG_TASKS_RCU is not set
+# CONFIG_TASK_XACCT is not set
+# CONFIG_TC35815 is not set
+# CONFIG_TCG_ATMEL is not set
+# CONFIG_TCG_CRB is not set
+# CONFIG_TCG_FTPM_TEE is not set
+# CONFIG_TCG_INFINEON is not set
+# CONFIG_TCG_NSC is not set
+# CONFIG_TCG_ST33_I2C is not set
+# CONFIG_TCG_TIS is not set
+# CONFIG_TCG_TIS_I2C is not set
+# CONFIG_TCG_TIS_I2C_ATMEL is not set
+# CONFIG_TCG_TIS_I2C_CR50 is not set
+# CONFIG_TCG_TIS_I2C_INFINEON is not set
+# CONFIG_TCG_TIS_I2C_NUVOTON is not set
+# CONFIG_TCG_TIS_SPI is not set
+# CONFIG_TCG_TIS_ST33ZP24_I2C is not set
+# CONFIG_TCG_TIS_ST33ZP24_SPI is not set
+# CONFIG_TCG_TPM is not set
+# CONFIG_TCG_VTPM_PROXY is not set
+# CONFIG_TCG_XEN is not set
+# CONFIG_TCIC is not set
+CONFIG_TCP_CONG_ADVANCED=y
+CONFIG_TCP_CONG_BBR=y
+CONFIG_TCP_CONG_BBR1=y
+CONFIG_TCP_CONG_BBR2=y
+CONFIG_TCP_CONG_BIC=y
+CONFIG_TCP_CONG_CDG=y
+CONFIG_TCP_CONG_CUBIC=y
+CONFIG_TCP_CONG_DCTCP=y
+CONFIG_TCP_CONG_HSTCP=y
+CONFIG_TCP_CONG_HTCP=y
+CONFIG_TCP_CONG_HYBLA=y
+CONFIG_TCP_CONG_ILLINOIS=y
+CONFIG_TCP_CONG_LP=y
+CONFIG_TCP_CONG_NV=y
+CONFIG_TCP_CONG_SCALABLE=y
+CONFIG_TCP_CONG_VEGAS=y
+CONFIG_TCP_CONG_VENO=y
+CONFIG_TCP_CONG_WESTWOOD=y
+CONFIG_TCP_CONG_YEAH=y
+# CONFIG_TCP_MD5SIG is not set
+# CONFIG_TCS3414 is not set
+# CONFIG_TCS3472 is not set
+# CONFIG_TEE is not set
+# CONFIG_TEGRA_AHB is not set
+# CONFIG_TEGRA_HOST1X is not set
+# CONFIG_TEHUTI is not set
+# CONFIG_TERANETICS_PHY is not set
+# CONFIG_TEST_ASYNC_DRIVER_PROBE is not set
+# CONFIG_TEST_BITFIELD is not set
+# CONFIG_TEST_BITMAP is not set
+# CONFIG_TEST_BITOPS is not set
+# CONFIG_TEST_BLACKHOLE_DEV is not set
+# CONFIG_TEST_BPF is not set
+# CONFIG_TEST_CLOCKSOURCE_WATCHDOG is not set
+# CONFIG_TEST_DEBUG_VIRTUAL is not set
+# CONFIG_TEST_DIV64 is not set
+# CONFIG_TEST_DYNAMIC_DEBUG is not set
+# CONFIG_TEST_FIRMWARE is not set
+# CONFIG_TEST_FREE_PAGES is not set
+# CONFIG_TEST_HASH is not set
+# CONFIG_TEST_HEXDUMP is not set
+# CONFIG_TEST_IDA is not set
+# CONFIG_TEST_KASAN_MODULE is not set
+# CONFIG_TEST_KMOD is not set
+# CONFIG_TEST_KSTRTOX is not set
+# CONFIG_TEST_LIST_SORT is not set
+# CONFIG_TEST_LKM is not set
+# CONFIG_TEST_LOCKUP is not set
+# CONFIG_TEST_MAPLE_TREE is not set
+# CONFIG_TEST_MEMCAT_P is not set
+# CONFIG_TEST_MEMINIT is not set
+# CONFIG_TEST_MIN_HEAP is not set
+# CONFIG_TEST_OVERFLOW is not set
+# CONFIG_TEST_POWER is not set
+# CONFIG_TEST_PRINTF is not set
+# CONFIG_TEST_REF_TRACKER is not set
+# CONFIG_TEST_RHASHTABLE is not set
+# CONFIG_TEST_SCANF is not set
+# CONFIG_TEST_SIPHASH is not set
+# CONFIG_TEST_SORT is not set
+# CONFIG_TEST_STACKINIT is not set
+# CONFIG_TEST_STATIC_KEYS is not set
+# CONFIG_TEST_STRING_HELPERS is not set
+# CONFIG_TEST_STRSCPY is not set
+# CONFIG_TEST_SYSCTL is not set
+# CONFIG_TEST_UBSAN is not set
+# CONFIG_TEST_UDELAY is not set
+# CONFIG_TEST_USER_COPY is not set
+# CONFIG_TEST_UUID is not set
+# CONFIG_TEST_VMALLOC is not set
+# CONFIG_TEST_XARRAY is not set
+CONFIG_TEXTSEARCH=y
+# CONFIG_TEXTSEARCH_BM is not set
+# CONFIG_TEXTSEARCH_FSM is not set
+# CONFIG_TEXTSEARCH_KMP is not set
+# CONFIG_THERMAL is not set
+# CONFIG_THERMAL_DEFAULT_GOV_FAIR_SHARE is not set
+# CONFIG_THERMAL_DEFAULT_GOV_POWER_ALLOCATOR is not set
+# CONFIG_THERMAL_DEFAULT_GOV_USER_SPACE is not set
+# CONFIG_THERMAL_DEFAULT_GOV_BANG_BANG is not set
+# CONFIG_THERMAL_EMULATION is not set
+# CONFIG_THERMAL_GOV_BANG_BANG is not set
+# CONFIG_THERMAL_GOV_FAIR_SHARE is not set
+# CONFIG_THERMAL_GOV_POWER_ALLOCATOR is not set
+# CONFIG_THERMAL_GOV_USER_SPACE is not set
+# CONFIG_THERMAL_HWMON is not set
+# CONFIG_THERMAL_MMIO is not set
+# CONFIG_THERMAL_NETLINK is not set
+# CONFIG_THERMAL_STATISTICS is not set
+# CONFIG_THERMAL_WRITABLE_TRIPS is not set
+# CONFIG_THINKPAD_ACPI is not set
+CONFIG_THIN_ARCHIVES=y
+# CONFIG_THINKPAD_LMI is not set
+# CONFIG_THRUSTMASTER_FF is not set
+# CONFIG_THUMB2_KERNEL is not set
+# CONFIG_THUNDERBOLT is not set
+# CONFIG_THUNDER_NIC_BGX is not set
+# CONFIG_THUNDER_NIC_PF is not set
+# CONFIG_THUNDER_NIC_RGX is not set
+# CONFIG_THUNDER_NIC_VF is not set
+# CONFIG_TICK_CPU_ACCOUNTING is not set
+CONFIG_TICK_ONESHOT=y
+# CONFIG_TIFM_CORE is not set
+# CONFIG_TIGON3 is not set
+# CONFIG_TIMB_DMA is not set
+CONFIG_TIMERFD=y
+# CONFIG_TIMERLAT_TRACER is not set
+# CONFIG_TIMER_STATS is not set
+# CONFIG_TIME_NS is not set
+# CONFIG_TINYDRM_HX8357D is not set
+# CONFIG_TINYDRM_ILI9163 is not set
+# CONFIG_TINYDRM_ILI9225 is not set
+# CONFIG_TINYDRM_ILI9341 is not set
+# CONFIG_TINYDRM_ILI9486 is not set
+# CONFIG_TINYDRM_MI0283QT is not set
+# CONFIG_TINYDRM_REPAPER is not set
+# CONFIG_TINYDRM_ST7586 is not set
+# CONFIG_TINYDRM_ST7735R is not set
+CONFIG_TINY_RCU=y
+# CONFIG_TIPC is not set
+# CONFIG_TI_ADC081C is not set
+# CONFIG_TI_ADC0832 is not set
+# CONFIG_TI_ADC084S021 is not set
+# CONFIG_TI_ADC108S102 is not set
+# CONFIG_TI_ADC12138 is not set
+# CONFIG_TI_ADC128S052 is not set
+# CONFIG_TI_ADC161S626 is not set
+# CONFIG_TI_ADS1015 is not set
+# CONFIG_TI_ADS124S08 is not set
+# CONFIG_TI_ADS131E08 is not set
+# CONFIG_TI_ADS7950 is not set
+# CONFIG_TI_ADS8344 is not set
+# CONFIG_TI_ADS8688 is not set
+# CONFIG_TI_AM335X_ADC is not set
+# CONFIG_TI_CPSW is not set
+# CONFIG_TI_CPSW_ALE is not set
+# CONFIG_TI_CPSW_PHY_SEL is not set
+# CONFIG_TI_CPTS is not set
+# CONFIG_TI_DAC082S085 is not set
+# CONFIG_TI_DAC5571 is not set
+# CONFIG_TI_DAC7311 is not set
+# CONFIG_TI_DAC7512 is not set
+# CONFIG_TI_DAC7612 is not set
+# CONFIG_TI_DAVINCI_CPDMA is not set
+# CONFIG_TI_DAVINCI_MDIO is not set
+# CONFIG_TI_ST is not set
+# CONFIG_TI_SYSCON_RESET is not set
+# CONFIG_TI_TLC4541 is not set
+# CONFIG_TI_TSC2046 is not set
+# CONFIG_TLAN is not set
+# CONFIG_TLS is not set
+# CONFIG_TLS_DEVICE is not set
+# CONFIG_TLS_TOE is not set
+# CONFIG_TMD_HERMES is not set
+# CONFIG_TMP006 is not set
+# CONFIG_TMP007 is not set
+# CONFIG_TMP117 is not set
+CONFIG_TMPFS=y
+# CONFIG_TMPFS_INODE64 is not set
+# CONFIG_TMPFS_POSIX_ACL is not set
+CONFIG_TMPFS_XATTR=y
+# CONFIG_TOPSTAR_LAPTOP is not set
+# CONFIG_TORTURE_TEST is not set
+# CONFIG_TOSHIBA_HAPS is not set
+# CONFIG_TOSHIBA_WMI is not set
+# CONFIG_TOUCHSCREEN_88PM860X is not set
+# CONFIG_TOUCHSCREEN_AD7877 is not set
+# CONFIG_TOUCHSCREEN_AD7879 is not set
+# CONFIG_TOUCHSCREEN_AD7879_I2C is not set
+# CONFIG_TOUCHSCREEN_AD7879_SPI is not set
+# CONFIG_TOUCHSCREEN_ADC is not set
+# CONFIG_TOUCHSCREEN_ADS7846 is not set
+# CONFIG_TOUCHSCREEN_AR1021_I2C is not set
+# CONFIG_TOUCHSCREEN_ATMEL_MXT is not set
+# CONFIG_TOUCHSCREEN_ATMEL_MXT_T37 is not set
+# CONFIG_TOUCHSCREEN_AUO_PIXCIR is not set
+# CONFIG_TOUCHSCREEN_BU21013 is not set
+# CONFIG_TOUCHSCREEN_BU21029 is not set
+# CONFIG_TOUCHSCREEN_CHIPONE_ICN8318 is not set
+# CONFIG_TOUCHSCREEN_CHIPONE_ICN8505 is not set
+# CONFIG_TOUCHSCREEN_COLIBRI_VF50 is not set
+# CONFIG_TOUCHSCREEN_CY8CTMA140 is not set
+# CONFIG_TOUCHSCREEN_CY8CTMG110 is not set
+# CONFIG_TOUCHSCREEN_CYTTSP4_CORE is not set
+# CONFIG_TOUCHSCREEN_CYTTSP4_I2C is not set
+# CONFIG_TOUCHSCREEN_CYTTSP4_SPI is not set
+# CONFIG_TOUCHSCREEN_CYTTSP_CORE is not set
+# CONFIG_TOUCHSCREEN_CYTTSP_I2C is not set
+# CONFIG_TOUCHSCREEN_CYTTSP_SPI is not set
+# CONFIG_TOUCHSCREEN_DA9034 is not set
+# CONFIG_TOUCHSCREEN_DA9052 is not set
+# CONFIG_TOUCHSCREEN_DYNAPRO is not set
+# CONFIG_TOUCHSCREEN_EDT_FT5X06 is not set
+# CONFIG_TOUCHSCREEN_EETI is not set
+# CONFIG_TOUCHSCREEN_EGALAX is not set
+# CONFIG_TOUCHSCREEN_EGALAX_SERIAL is not set
+# CONFIG_TOUCHSCREEN_EKTF2127 is not set
+# CONFIG_TOUCHSCREEN_ELAN is not set
+# CONFIG_TOUCHSCREEN_ELO is not set
+# CONFIG_TOUCHSCREEN_EXC3000 is not set
+# CONFIG_TOUCHSCREEN_FUJITSU is not set
+# CONFIG_TOUCHSCREEN_GOODIX is not set
+# CONFIG_TOUCHSCREEN_GUNZE is not set
+# CONFIG_TOUCHSCREEN_HAMPSHIRE is not set
+# CONFIG_TOUCHSCREEN_HIDEEP is not set
+# CONFIG_TOUCHSCREEN_HP600 is not set
+# CONFIG_TOUCHSCREEN_HP7XX is not set
+# CONFIG_TOUCHSCREEN_HTCPEN is not set
+# CONFIG_TOUCHSCREEN_HYCON_HY46XX is not set
+# CONFIG_TOUCHSCREEN_ILI210X is not set
+# CONFIG_TOUCHSCREEN_ILITEK is not set
+# CONFIG_TOUCHSCREEN_IMAGIS is not set
+# CONFIG_TOUCHSCREEN_IMX6UL_TSC is not set
+# CONFIG_TOUCHSCREEN_INEXIO is not set
+# CONFIG_TOUCHSCREEN_IPAQ_MICRO is not set
+# CONFIG_TOUCHSCREEN_IPROC is not set
+# CONFIG_TOUCHSCREEN_IQS5XX is not set
+# CONFIG_TOUCHSCREEN_LPC32XX is not set
+# CONFIG_TOUCHSCREEN_MAX11801 is not set
+# CONFIG_TOUCHSCREEN_MC13783 is not set
+# CONFIG_TOUCHSCREEN_MCS5000 is not set
+# CONFIG_TOUCHSCREEN_MELFAS_MIP4 is not set
+# CONFIG_TOUCHSCREEN_MIGOR is not set
+# CONFIG_TOUCHSCREEN_MK712 is not set
+# CONFIG_TOUCHSCREEN_MMS114 is not set
+# CONFIG_TOUCHSCREEN_MSG2638 is not set
+# CONFIG_TOUCHSCREEN_MTOUCH is not set
+# CONFIG_TOUCHSCREEN_MX25 is not set
+# CONFIG_TOUCHSCREEN_MXS_LRADC is not set
+# CONFIG_TOUCHSCREEN_PCAP is not set
+# CONFIG_TOUCHSCREEN_PENMOUNT is not set
+# CONFIG_TOUCHSCREEN_PIXCIR is not set
+# CONFIG_TOUCHSCREEN_PROPERTIES is not set
+# CONFIG_TOUCHSCREEN_RASPBERRYPI_FW is not set
+# CONFIG_TOUCHSCREEN_RM_TS is not set
+# CONFIG_TOUCHSCREEN_ROHM_BU21023 is not set
+# CONFIG_TOUCHSCREEN_RPI_FT5406 is not set
+# CONFIG_TOUCHSCREEN_S3C2410 is not set
+# CONFIG_TOUCHSCREEN_S6SY761 is not set
+# CONFIG_TOUCHSCREEN_SILEAD is not set
+# CONFIG_TOUCHSCREEN_SIS_I2C is not set
+# CONFIG_TOUCHSCREEN_ST1232 is not set
+# CONFIG_TOUCHSCREEN_STMFTS is not set
+# CONFIG_TOUCHSCREEN_STMPE is not set
+# CONFIG_TOUCHSCREEN_SUN4I is not set
+# CONFIG_TOUCHSCREEN_SUR40 is not set
+# CONFIG_TOUCHSCREEN_SURFACE3_SPI is not set
+# CONFIG_TOUCHSCREEN_SX8654 is not set
+# CONFIG_TOUCHSCREEN_TI_AM335X_TSC is not set
+# CONFIG_TOUCHSCREEN_TOUCHIT213 is not set
+# CONFIG_TOUCHSCREEN_TOUCHRIGHT is not set
+# CONFIG_TOUCHSCREEN_TOUCHWIN is not set
+# CONFIG_TOUCHSCREEN_TPS6507X is not set
+# CONFIG_TOUCHSCREEN_TS4800 is not set
+# CONFIG_TOUCHSCREEN_TSC2004 is not set
+# CONFIG_TOUCHSCREEN_TSC2005 is not set
+# CONFIG_TOUCHSCREEN_TSC2007 is not set
+# CONFIG_TOUCHSCREEN_TSC2007_IIO is not set
+# CONFIG_TOUCHSCREEN_TSC200X_CORE is not set
+# CONFIG_TOUCHSCREEN_TSC_SERIO is not set
+# CONFIG_TOUCHSCREEN_UCB1400 is not set
+# CONFIG_TOUCHSCREEN_USB_3M is not set
+# CONFIG_TOUCHSCREEN_USB_COMPOSITE is not set
+# CONFIG_TOUCHSCREEN_USB_DMC_TSC10 is not set
+# CONFIG_TOUCHSCREEN_USB_E2I is not set
+# CONFIG_TOUCHSCREEN_USB_EASYTOUCH is not set
+# CONFIG_TOUCHSCREEN_USB_EGALAX is not set
+# CONFIG_TOUCHSCREEN_USB_ELO is not set
+# CONFIG_TOUCHSCREEN_USB_ETT_TC45USB is not set
+# CONFIG_TOUCHSCREEN_USB_ETURBO is not set
+# CONFIG_TOUCHSCREEN_USB_GENERAL_TOUCH is not set
+# CONFIG_TOUCHSCREEN_USB_GOTOP is not set
+# CONFIG_TOUCHSCREEN_USB_GUNZE is not set
+# CONFIG_TOUCHSCREEN_USB_IDEALTEK is not set
+# CONFIG_TOUCHSCREEN_USB_IRTOUCH is not set
+# CONFIG_TOUCHSCREEN_USB_ITM is not set
+# CONFIG_TOUCHSCREEN_USB_JASTEC is not set
+# CONFIG_TOUCHSCREEN_USB_NEXIO is not set
+# CONFIG_TOUCHSCREEN_USB_PANJIT is not set
+# CONFIG_TOUCHSCREEN_USB_ZYTRONIC is not set
+# CONFIG_TOUCHSCREEN_W90X900 is not set
+# CONFIG_TOUCHSCREEN_WACOM_I2C is not set
+# CONFIG_TOUCHSCREEN_WACOM_W8001 is not set
+# CONFIG_TOUCHSCREEN_WDT87XX_I2C is not set
+# CONFIG_TOUCHSCREEN_WM831X is not set
+# CONFIG_TOUCHSCREEN_WM9705 is not set
+# CONFIG_TOUCHSCREEN_WM9712 is not set
+# CONFIG_TOUCHSCREEN_WM9713 is not set
+# CONFIG_TOUCHSCREEN_WM97XX is not set
+# CONFIG_TOUCHSCREEN_WM97XX_MAINSTONE is not set
+# CONFIG_TOUCHSCREEN_WM97XX_ZYLONITE is not set
+# CONFIG_TOUCHSCREEN_ZET6223 is not set
+# CONFIG_TOUCHSCREEN_ZFORCE is not set
+# CONFIG_TOUCHSCREEN_ZINITIX is not set
+# CONFIG_TPL0102 is not set
+# CONFIG_TPS6105X is not set
+# CONFIG_TPS65010 is not set
+# CONFIG_TPS6507X is not set
+# CONFIG_TRACEPOINT_BENCHMARK is not set
+# CONFIG_TRACER_SNAPSHOT is not set
+# CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP is not set
+# CONFIG_TRACE_BRANCH_PROFILING is not set
+# CONFIG_TRACE_EVAL_MAP_FILE is not set
+# CONFIG_TRACE_EVENT_INJECT is not set
+CONFIG_TRACE_IRQFLAGS_SUPPORT=y
+# CONFIG_TRACE_MMIO_ACCESS is not set
+# CONFIG_TRACE_SINK is not set
+# CONFIG_TRACING_EVENTS_GPIO is not set
+CONFIG_TRACING_SUPPORT=y
+CONFIG_TRAD_SIGNALS=y
+# CONFIG_TRANSPARENT_HUGEPAGE is not set
+# CONFIG_TREE_RCU is not set
+# CONFIG_TREE_RCU_TRACE is not set
+# CONFIG_TRIM_UNUSED_KSYMS is not set
+# CONFIG_TRUSTED_FOUNDATIONS is not set
+# CONFIG_TRUSTED_KEYS is not set
+# CONFIG_TRUSTED_KEYS_TPM is not set
+# CONFIG_TRUSTED_KEYS_TEE is not set
+# CONFIG_TSL2583 is not set
+# CONFIG_TSL2591 is not set
+# CONFIG_TSL2772 is not set
+# CONFIG_TSL2x7x is not set
+# CONFIG_TSL4531 is not set
+# CONFIG_TSNEP is not set
+# CONFIG_TSYS01 is not set
+# CONFIG_TSYS02D is not set
+# CONFIG_TTPCI_EEPROM is not set
+CONFIG_TTY=y
+# CONFIG_TTY_PRINTK is not set
+# CONFIG_TUN is not set
+# CONFIG_TUN_VNET_CROSS_LE is not set
+# CONFIG_TWL4030_CORE is not set
+# CONFIG_TWL4030_MADC is not set
+# CONFIG_TWL6030_GPADC is not set
+# CONFIG_TWL6040_CORE is not set
+# CONFIG_TXGBE is not set
+# CONFIG_TYPEC is not set
+# CONFIG_TYPEC_ANX7411 is not set
+# CONFIG_TYPEC_DP_ALTMODE is not set
+# CONFIG_TYPEC_MUX_FSA4480 is not set
+# CONFIG_TYPEC_RT1719 is not set
+# CONFIG_TYPEC_TCPM is not set
+# CONFIG_TYPEC_UCSI is not set
+# CONFIG_TYPEC_WUSB3801 is not set
+# CONFIG_TYPHOON is not set
+# CONFIG_UACCESS_WITH_MEMCPY is not set
+# CONFIG_UBIFS_ATIME_SUPPORT is not set
+# CONFIG_UBIFS_FS_ADVANCED_COMPR is not set
+# CONFIG_UBIFS_FS_AUTHENTICATION is not set
+# CONFIG_UBIFS_FS_ENCRYPTION is not set
+CONFIG_UBIFS_FS_LZO=y
+# CONFIG_UBIFS_FS_SECURITY is not set
+CONFIG_UBIFS_FS_XATTR=y
+CONFIG_UBIFS_FS_ZLIB=y
+CONFIG_UBIFS_FS_ZSTD=y
+# CONFIG_UBSAN is not set
+CONFIG_UBSAN_ALIGNMENT=y
+CONFIG_UBSAN_BOOL=y
+# CONFIG_UBSAN_DIV_ZERO is not set
+CONFIG_UBSAN_ENUM=y
+# CONFIG_UBSAN_MISC is not set
+CONFIG_UBSAN_SHIFT=y
+# CONFIG_UBSAN_UNREACHABLE is not set
+# CONFIG_UCB1400_CORE is not set
+# CONFIG_UCSI is not set
+# CONFIG_UDF_FS is not set
+# CONFIG_UDMABUF is not set
+CONFIG_UEVENT_HELPER=y
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+# CONFIG_UFS_FS is not set
+# CONFIG_UHID is not set
+CONFIG_UID16=y
+# CONFIG_UIO is not set
+# CONFIG_ULTRA is not set
+# CONFIG_ULTRIX_PARTITION is not set
+# CONFIG_UNICODE is not set
+# CONFIG_UNISYSSPAR is not set
+# CONFIG_UNISYS_VISORBUS is not set
+CONFIG_UNIX=y
+CONFIG_UNIX98_PTYS=y
+# CONFIG_UNIXWARE_DISKLABEL is not set
+# CONFIG_UNIX_DIAG is not set
+CONFIG_UNIX_SCM=y
+# CONFIG_UNUSED_BOARD_FILES is not set
+# CONFIG_UNUSED_SYMBOLS is not set
+# CONFIG_UNWINDER_FRAME_POINTER is not set
+# CONFIG_UPROBES is not set
+# CONFIG_UPROBE_EVENTS is not set
+# CONFIG_US5182D is not set
+# CONFIG_USB is not set
+# CONFIG_USB4 is not set
+# CONFIG_USBIP_CORE is not set
+CONFIG_USBIP_VHCI_HC_PORTS=8
+CONFIG_USBIP_VHCI_NR_HCS=1
+# CONFIG_USBIP_VUDC is not set
+# CONFIG_USBPCWATCHDOG is not set
+# CONFIG_USB_ACM is not set
+# CONFIG_USB_ADUTUX is not set
+# CONFIG_USB_AIRSPY is not set
+CONFIG_USB_ALI_M5632=y
+# CONFIG_USB_AMD5536UDC is not set
+CONFIG_USB_AN2720=y
+# CONFIG_USB_ANNOUNCE_NEW_DEVICES is not set
+# CONFIG_USB_APPLEDISPLAY is not set
+CONFIG_USB_ARCH_HAS_HCD=y
+CONFIG_USB_ARMLINUX=y
+# CONFIG_USB_ATM is not set
+# CONFIG_USB_AUDIO is not set
+CONFIG_USB_AUTOSUSPEND_DELAY=2
+# CONFIG_USB_BDC_UDC is not set
+CONFIG_USB_BELKIN=y
+# CONFIG_USB_C67X00_HCD is not set
+# CONFIG_USB_CATC is not set
+# CONFIG_USB_CDC_COMPOSITE is not set
+# CONFIG_USB_CDNS3 is not set
+# CONFIG_USB_CDNS_SUPPORT is not set
+# CONFIG_USB_CHAOSKEY is not set
+# CONFIG_USB_CHIPIDEA is not set
+# CONFIG_USB_CHIPIDEA_GENERIC is not set
+# CONFIG_USB_CHIPIDEA_IMX is not set
+# CONFIG_USB_CHIPIDEA_MSM is not set
+# CONFIG_USB_CHIPIDEA_PCI is not set
+# CONFIG_USB_CHIPIDEA_TEGRA is not set
+# CONFIG_USB_CONFIGFS is not set
+# CONFIG_USB_CONN_GPIO is not set
+# CONFIG_USB_CXACRU is not set
+# CONFIG_USB_CYPRESS_CY7C63 is not set
+# CONFIG_USB_CYTHERM is not set
+CONFIG_USB_DEFAULT_PERSIST=y
+# CONFIG_USB_DSBR is not set
+# CONFIG_USB_DUMMY_HCD is not set
+# CONFIG_USB_DWC2 is not set
+# CONFIG_USB_DWC2_DEBUG is not set
+# CONFIG_USB_DWC2_DUAL_ROLE is not set
+# CONFIG_USB_DWC2_HOST is not set
+# CONFIG_USB_DWC2_PERIPHERAL is not set
+# CONFIG_USB_DWC2_TRACK_MISSED_SOFS is not set
+# CONFIG_USB_DWC3 is not set
+# CONFIG_USB_DWC3_EXYNOS is not set
+# CONFIG_USB_DWC3_HAPS is not set
+# CONFIG_USB_DWC3_KEYSTONE is not set
+# CONFIG_USB_DWC3_OF_SIMPLE is not set
+# CONFIG_USB_DWC3_PCI is not set
+# CONFIG_USB_DWC3_QCOM is not set
+# CONFIG_USB_DWC3_ULPI is not set
+# CONFIG_USB_DYNAMIC_MINORS is not set
+# CONFIG_USB_EG20T is not set
+# CONFIG_USB_EHCI_ATH79 is not set
+# CONFIG_USB_EHCI_FSL is not set
+# CONFIG_USB_EHCI_HCD is not set
+# CONFIG_USB_EHCI_HCD_AT91 is not set
+# CONFIG_USB_EHCI_HCD_OMAP is not set
+# CONFIG_USB_EHCI_HCD_PPC_OF is not set
+# CONFIG_USB_EHCI_MSM is not set
+# CONFIG_USB_EHCI_MV is not set
+CONFIG_USB_EHCI_ROOT_HUB_TT=y
+CONFIG_USB_EHCI_TT_NEWSCHED=y
+# CONFIG_USB_EHSET_TEST_FIXTURE is not set
+# CONFIG_USB_EMI26 is not set
+# CONFIG_USB_EMI62 is not set
+# CONFIG_USB_EPSON2888 is not set
+# CONFIG_USB_ETH is not set
+# CONFIG_USB_EZUSB_FX2 is not set
+# CONFIG_USB_FEW_INIT_RETRIES is not set
+# CONFIG_USB_FOTG210_HCD is not set
+# CONFIG_USB_FOTG210_UDC is not set
+# CONFIG_USB_FSL_USB2 is not set
+# CONFIG_USB_FTDI_ELAN is not set
+# CONFIG_USB_FUNCTIONFS is not set
+# CONFIG_USB_FUSB300 is not set
+# CONFIG_USB_GADGET is not set
+# CONFIG_USB_GADGETFS is not set
+# CONFIG_USB_GADGET_DEBUG is not set
+# CONFIG_USB_GADGET_DEBUG_FILES is not set
+# CONFIG_USB_GADGET_DEBUG_FS is not set
+CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS=2
+CONFIG_USB_GADGET_VBUS_DRAW=2
+# CONFIG_USB_GADGET_XILINX is not set
+# CONFIG_USB_GL860 is not set
+# CONFIG_USB_GOKU is not set
+# CONFIG_USB_GPIO_VBUS is not set
+# CONFIG_USB_GR_UDC is not set
+# CONFIG_USB_GSPCA is not set
+# CONFIG_USB_GSPCA_BENQ is not set
+# CONFIG_USB_GSPCA_CONEX is not set
+# CONFIG_USB_GSPCA_CPIA1 is not set
+# CONFIG_USB_GSPCA_DTCS033 is not set
+# CONFIG_USB_GSPCA_ETOMS is not set
+# CONFIG_USB_GSPCA_FINEPIX is not set
+# CONFIG_USB_GSPCA_JEILINJ is not set
+# CONFIG_USB_GSPCA_JL2005BCD is not set
+# CONFIG_USB_GSPCA_KINECT is not set
+# CONFIG_USB_GSPCA_KONICA is not set
+# CONFIG_USB_GSPCA_MARS is not set
+# CONFIG_USB_GSPCA_MR97310A is not set
+# CONFIG_USB_GSPCA_NW80X is not set
+# CONFIG_USB_GSPCA_OV519 is not set
+# CONFIG_USB_GSPCA_OV534 is not set
+# CONFIG_USB_GSPCA_OV534_9 is not set
+# CONFIG_USB_GSPCA_PAC207 is not set
+# CONFIG_USB_GSPCA_PAC7302 is not set
+# CONFIG_USB_GSPCA_PAC7311 is not set
+# CONFIG_USB_GSPCA_SE401 is not set
+# CONFIG_USB_GSPCA_SN9C2028 is not set
+# CONFIG_USB_GSPCA_SN9C20X is not set
+# CONFIG_USB_GSPCA_SONIXB is not set
+# CONFIG_USB_GSPCA_SONIXJ is not set
+# CONFIG_USB_GSPCA_SPCA1528 is not set
+# CONFIG_USB_GSPCA_SPCA500 is not set
+# CONFIG_USB_GSPCA_SPCA501 is not set
+# CONFIG_USB_GSPCA_SPCA505 is not set
+# CONFIG_USB_GSPCA_SPCA506 is not set
+# CONFIG_USB_GSPCA_SPCA508 is not set
+# CONFIG_USB_GSPCA_SPCA561 is not set
+# CONFIG_USB_GSPCA_SQ905 is not set
+# CONFIG_USB_GSPCA_SQ905C is not set
+# CONFIG_USB_GSPCA_SQ930X is not set
+# CONFIG_USB_GSPCA_STK014 is not set
+# CONFIG_USB_GSPCA_STK1135 is not set
+# CONFIG_USB_GSPCA_STV0680 is not set
+# CONFIG_USB_GSPCA_SUNPLUS is not set
+# CONFIG_USB_GSPCA_T613 is not set
+# CONFIG_USB_GSPCA_TOPRO is not set
+# CONFIG_USB_GSPCA_TOUPTEK is not set
+# CONFIG_USB_GSPCA_TV8532 is not set
+# CONFIG_USB_GSPCA_VC032X is not set
+# CONFIG_USB_GSPCA_VICAM is not set
+# CONFIG_USB_GSPCA_XIRLINK_CIT is not set
+# CONFIG_USB_GSPCA_ZC3XX is not set
+# CONFIG_USB_G_ACM_MS is not set
+# CONFIG_USB_G_DBGP is not set
+# CONFIG_USB_G_HID is not set
+# CONFIG_USB_G_MULTI is not set
+# CONFIG_USB_G_NCM is not set
+# CONFIG_USB_G_NOKIA is not set
+# CONFIG_USB_G_PRINTER is not set
+# CONFIG_USB_G_SERIAL is not set
+# CONFIG_USB_G_WEBCAM is not set
+# CONFIG_USB_HACKRF is not set
+# CONFIG_USB_HCD_TEST_MODE is not set
+# CONFIG_USB_HID is not set
+# CONFIG_USB_HIDDEV is not set
+# CONFIG_USB_HSIC_USB3503 is not set
+# CONFIG_USB_HSIC_USB4604 is not set
+# CONFIG_USB_HSO is not set
+# CONFIG_USB_HUB_USB251XB is not set
+# CONFIG_USB_HWA_HCD is not set
+# CONFIG_USB_IDMOUSE is not set
+# CONFIG_USB_IMX21_HCD is not set
+# CONFIG_USB_IOWARRIOR is not set
+# CONFIG_USB_IPHETH is not set
+# CONFIG_USB_ISIGHTFW is not set
+# CONFIG_USB_ISP116X_HCD is not set
+# CONFIG_USB_ISP1301 is not set
+# CONFIG_USB_ISP1362_HCD is not set
+# CONFIG_USB_ISP1760 is not set
+# CONFIG_USB_ISP1760_HCD is not set
+# CONFIG_USB_KAWETH is not set
+# CONFIG_USB_KBD is not set
+# CONFIG_USB_KC2190 is not set
+# CONFIG_USB_LAN78XX is not set
+# CONFIG_USB_LCD is not set
+# CONFIG_USB_LD is not set
+# CONFIG_USB_LED is not set
+# CONFIG_USB_LEDS_TRIGGER_USBPORT is not set
+# CONFIG_USB_LED_TRIG is not set
+# CONFIG_USB_LEGOTOWER is not set
+# CONFIG_USB_LGM_PHY is not set
+# CONFIG_USB_LINK_LAYER_TEST is not set
+# CONFIG_USB_M5602 is not set
+# CONFIG_USB_M66592 is not set
+# CONFIG_USB_MASS_STORAGE is not set
+# CONFIG_USB_MAX3420_UDC is not set
+# CONFIG_USB_MAX3421_HCD is not set
+# CONFIG_USB_MDC800 is not set
+# CONFIG_USB_MICROTEK is not set
+# CONFIG_USB_MIDI_GADGET is not set
+# CONFIG_USB_MON is not set
+# CONFIG_USB_MOUSE is not set
+# CONFIG_USB_MSI2500 is not set
+# CONFIG_USB_MSM_OTG is not set
+# CONFIG_USB_MTU3 is not set
+# CONFIG_USB_MUSB_GADGET is not set
+# CONFIG_USB_MUSB_HDRC is not set
+# CONFIG_USB_MUSB_HOST is not set
+# CONFIG_USB_MV_U3D is not set
+# CONFIG_USB_MV_UDC is not set
+# CONFIG_USB_MXS_PHY is not set
+# CONFIG_USB_NET2272 is not set
+# CONFIG_USB_NET2280 is not set
+# CONFIG_USB_NET_AQC111 is not set
+# CONFIG_USB_NET_AX88179_178A is not set
+# CONFIG_USB_NET_AX8817X is not set
+# CONFIG_USB_NET_CDCETHER is not set
+# CONFIG_USB_NET_CDC_EEM is not set
+# CONFIG_USB_NET_CDC_MBIM is not set
+# CONFIG_USB_NET_CDC_NCM is not set
+# CONFIG_USB_NET_CDC_SUBSET is not set
+# CONFIG_USB_NET_CH9200 is not set
+# CONFIG_USB_NET_CX82310_ETH is not set
+# CONFIG_USB_NET_DM9601 is not set
+# CONFIG_USB_NET_DRIVERS is not set
+# CONFIG_USB_NET_GL620A is not set
+# CONFIG_USB_NET_HUAWEI_CDC_NCM is not set
+# CONFIG_USB_NET_INT51X1 is not set
+# CONFIG_USB_NET_KALMIA is not set
+# CONFIG_USB_NET_MCS7830 is not set
+# CONFIG_USB_NET_NET1080 is not set
+# CONFIG_USB_NET_PLUSB is not set
+# CONFIG_USB_NET_QMI_WWAN is not set
+# CONFIG_USB_NET_RNDIS_HOST is not set
+# CONFIG_USB_NET_RNDIS_WLAN is not set
+# CONFIG_USB_NET_SMSC75XX is not set
+# CONFIG_USB_NET_SMSC95XX is not set
+# CONFIG_USB_NET_SR9700 is not set
+# CONFIG_USB_NET_SR9800 is not set
+# CONFIG_USB_NET_ZAURUS is not set
+# CONFIG_USB_OHCI_HCD is not set
+# CONFIG_USB_OHCI_HCD_PCI is not set
+# CONFIG_USB_OHCI_HCD_PPC_OF is not set
+# CONFIG_USB_OHCI_HCD_PPC_OF_BE is not set
+# CONFIG_USB_OHCI_HCD_PPC_OF_LE is not set
+# CONFIG_USB_OHCI_HCD_SSB is not set
+CONFIG_USB_OHCI_LITTLE_ENDIAN=y
+# CONFIG_USB_ONBOARD_HUB is not set
+# CONFIG_USB_OTG is not set
+# CONFIG_USB_OTG_BLACKLIST_HUB is not set
+# CONFIG_USB_OTG_DISABLE_EXTERNAL_HUB is not set
+# CONFIG_USB_OTG_FSM is not set
+# CONFIG_USB_OTG_PRODUCTLIST is not set
+# CONFIG_USB_OTG_WHITELIST is not set
+# CONFIG_USB_OXU210HP_HCD is not set
+# CONFIG_USB_PCI is not set
+# CONFIG_USB_PEGASUS is not set
+# CONFIG_USB_PHY is not set
+# CONFIG_USB_PRINTER is not set
+# CONFIG_USB_PWC_INPUT_EVDEV is not set
+# CONFIG_USB_PXA27X is not set
+# CONFIG_USB_QCOM_EUD is not set
+# CONFIG_USB_R8A66597 is not set
+# CONFIG_USB_R8A66597_HCD is not set
+# CONFIG_USB_RAW_GADGET is not set
+# CONFIG_USB_RCAR_PHY is not set
+# CONFIG_USB_RENESAS_USBHS is not set
+# CONFIG_USB_RIO500 is not set
+# CONFIG_USB_ROLES_INTEL_XHCI is not set
+# CONFIG_USB_ROLE_SWITCH is not set
+# CONFIG_USB_RTL8150 is not set
+# CONFIG_USB_RTL8152 is not set
+# CONFIG_USB_RTL8153_ECM is not set
+# CONFIG_USB_S2255 is not set
+# CONFIG_USB_SERIAL is not set
+# CONFIG_USB_SERIAL_AIRCABLE is not set
+# CONFIG_USB_SERIAL_ARK3116 is not set
+# CONFIG_USB_SERIAL_BELKIN is not set
+# CONFIG_USB_SERIAL_CH341 is not set
+# CONFIG_USB_SERIAL_CP210X is not set
+# CONFIG_USB_SERIAL_CYBERJACK is not set
+# CONFIG_USB_SERIAL_CYPRESS_M8 is not set
+# CONFIG_USB_SERIAL_DEBUG is not set
+# CONFIG_USB_SERIAL_DIGI_ACCELEPORT is not set
+# CONFIG_USB_SERIAL_EDGEPORT is not set
+# CONFIG_USB_SERIAL_EDGEPORT_TI is not set
+# CONFIG_USB_SERIAL_EMPEG is not set
+# CONFIG_USB_SERIAL_F81232 is not set
+# CONFIG_USB_SERIAL_F8153X is not set
+# CONFIG_USB_SERIAL_FTDI_SIO is not set
+# CONFIG_USB_SERIAL_GARMIN is not set
+CONFIG_USB_SERIAL_GENERIC=y
+# CONFIG_USB_SERIAL_IPAQ is not set
+# CONFIG_USB_SERIAL_IPW is not set
+# CONFIG_USB_SERIAL_IR is not set
+# CONFIG_USB_SERIAL_IUU is not set
+# CONFIG_USB_SERIAL_KEYSPAN is not set
+CONFIG_USB_SERIAL_KEYSPAN_MPR=y
+# CONFIG_USB_SERIAL_KEYSPAN_PDA is not set
+CONFIG_USB_SERIAL_KEYSPAN_USA18X=y
+CONFIG_USB_SERIAL_KEYSPAN_USA19=y
+CONFIG_USB_SERIAL_KEYSPAN_USA19QI=y
+CONFIG_USB_SERIAL_KEYSPAN_USA19QW=y
+CONFIG_USB_SERIAL_KEYSPAN_USA19W=y
+CONFIG_USB_SERIAL_KEYSPAN_USA28=y
+CONFIG_USB_SERIAL_KEYSPAN_USA28X=y
+CONFIG_USB_SERIAL_KEYSPAN_USA28XA=y
+CONFIG_USB_SERIAL_KEYSPAN_USA28XB=y
+CONFIG_USB_SERIAL_KEYSPAN_USA49W=y
+CONFIG_USB_SERIAL_KEYSPAN_USA49WLC=y
+# CONFIG_USB_SERIAL_KLSI is not set
+# CONFIG_USB_SERIAL_KOBIL_SCT is not set
+# CONFIG_USB_SERIAL_MCT_U232 is not set
+# CONFIG_USB_SERIAL_METRO is not set
+# CONFIG_USB_SERIAL_MOS7715_PARPORT is not set
+# CONFIG_USB_SERIAL_MOS7720 is not set
+# CONFIG_USB_SERIAL_MOS7840 is not set
+# CONFIG_USB_SERIAL_MXUPORT is not set
+# CONFIG_USB_SERIAL_NAVMAN is not set
+# CONFIG_USB_SERIAL_OMNINET is not set
+# CONFIG_USB_SERIAL_OPTICON is not set
+# CONFIG_USB_SERIAL_OPTION is not set
+# CONFIG_USB_SERIAL_OTI6858 is not set
+# CONFIG_USB_SERIAL_PL2303 is not set
+# CONFIG_USB_SERIAL_QCAUX is not set
+# CONFIG_USB_SERIAL_QT2 is not set
+# CONFIG_USB_SERIAL_QUALCOMM is not set
+# CONFIG_USB_SERIAL_SAFE is not set
+CONFIG_USB_SERIAL_SAFE_PADDED=y
+# CONFIG_USB_SERIAL_SIERRAWIRELESS is not set
+# CONFIG_USB_SERIAL_SIMPLE is not set
+# CONFIG_USB_SERIAL_SPCP8X5 is not set
+# CONFIG_USB_SERIAL_SSU100 is not set
+# CONFIG_USB_SERIAL_SYMBOL is not set
+# CONFIG_USB_SERIAL_TI is not set
+# CONFIG_USB_SERIAL_UPD78F0730 is not set
+# CONFIG_USB_SERIAL_VISOR is not set
+# CONFIG_USB_SERIAL_WHITEHEAT is not set
+# CONFIG_USB_SERIAL_WISHBONE is not set
+# CONFIG_USB_SERIAL_XIRCOM is not set
+# CONFIG_USB_SERIAL_XR is not set
+# CONFIG_USB_SERIAL_XSENS_MT is not set
+# CONFIG_USB_SEVSEG is not set
+# CONFIG_USB_SIERRA_NET is not set
+# CONFIG_USB_SISUSBVGA is not set
+# CONFIG_USB_SL811_HCD is not set
+# CONFIG_USB_SNP_UDC_PLAT is not set
+# CONFIG_USB_SPEEDTOUCH is not set
+# CONFIG_USB_STKWEBCAM is not set
+# CONFIG_USB_STORAGE is not set
+# CONFIG_USB_STORAGE_ALAUDA is not set
+# CONFIG_USB_STORAGE_CYPRESS_ATACB is not set
+# CONFIG_USB_STORAGE_DATAFAB is not set
+# CONFIG_USB_STORAGE_DEBUG is not set
+# CONFIG_USB_STORAGE_ENE_UB6250 is not set
+# CONFIG_USB_STORAGE_FREECOM is not set
+# CONFIG_USB_STORAGE_ISD200 is not set
+# CONFIG_USB_STORAGE_JUMPSHOT is not set
+# CONFIG_USB_STORAGE_KARMA is not set
+# CONFIG_USB_STORAGE_ONETOUCH is not set
+# CONFIG_USB_STORAGE_REALTEK is not set
+# CONFIG_USB_STORAGE_SDDR09 is not set
+# CONFIG_USB_STORAGE_SDDR55 is not set
+# CONFIG_USB_STORAGE_USBAT is not set
+# CONFIG_USB_STV06XX is not set
+# CONFIG_USB_SUPPORT is not set
+# CONFIG_USB_SWITCH_FSA9480 is not set
+# CONFIG_USB_TEST is not set
+# CONFIG_USB_TMC is not set
+# CONFIG_USB_TRANCEVIBRATOR is not set
+# CONFIG_USB_UAS is not set
+# CONFIG_USB_UEAGLEATM is not set
+# CONFIG_USB_ULPI is not set
+# CONFIG_USB_ULPI_BUS is not set
+# CONFIG_USB_USBNET is not set
+# CONFIG_USB_USS720 is not set
+# CONFIG_USB_VIDEO_CLASS is not set
+CONFIG_USB_VIDEO_CLASS_INPUT_EVDEV=y
+# CONFIG_USB_VL600 is not set
+# CONFIG_USB_WDM is not set
+# CONFIG_USB_WHCI_HCD is not set
+# CONFIG_USB_WUSB is not set
+# CONFIG_USB_WUSB_CBAF is not set
+# CONFIG_USB_XEN_HCD is not set
+# CONFIG_USB_XHCI_DBGCAP is not set
+# CONFIG_USB_XHCI_HCD is not set
+# CONFIG_USB_XHCI_MVEBU is not set
+# CONFIG_USB_XHCI_PCI_RENESAS is not set
+# CONFIG_USB_XUSBATM is not set
+# CONFIG_USB_YUREX is not set
+# CONFIG_USB_ZD1201 is not set
+# CONFIG_USB_ZERO is not set
+# CONFIG_USB_ZR364XX is not set
+# CONFIG_USELIB is not set
+# CONFIG_USERFAULTFD is not set
+# CONFIG_USERIO is not set
+# CONFIG_USER_DECRYPTED_DATA is not set
+# CONFIG_USE_OF is not set
+# CONFIG_UTS_NS is not set
+# CONFIG_UWB is not set
+# CONFIG_U_SERIAL_CONSOLE is not set
+# CONFIG_V4L_MEM2MEM_DRIVERS is not set
+# CONFIG_V4L_PLATFORM_DRIVERS is not set
+# CONFIG_V4L_TEST_DRIVERS is not set
+# CONFIG_VALIDATE_FS_PARSER is not set
+# CONFIG_VBOXGUEST is not set
+# CONFIG_VCNL3020 is not set
+# CONFIG_VCNL4000 is not set
+# CONFIG_VCNL4035 is not set
+# CONFIG_VCPU_STALL_DETECTOR is not set
+# CONFIG_VDPA is not set
+CONFIG_VDSO=y
+# CONFIG_VEML6030 is not set
+# CONFIG_VEML6070 is not set
+# CONFIG_VETH is not set
+# CONFIG_VEXPRESS_CONFIG is not set
+# CONFIG_VF610_ADC is not set
+# CONFIG_VF610_DAC is not set
+# CONFIG_VFAT_FS is not set
+# CONFIG_VFIO is not set
+# CONFIG_VGASTATE is not set
+# CONFIG_VGA_ARB is not set
+# CONFIG_VGA_CONSOLE is not set
+# CONFIG_VGA_SWITCHEROO is not set
+# CONFIG_VHOST_CROSS_ENDIAN_LEGACY is not set
+CONFIG_VHOST_MENU=y
+# CONFIG_VHOST_NET is not set
+# CONFIG_VHOST_VSOCK is not set
+# CONFIG_VIA_RHINE is not set
+# CONFIG_VIA_VELOCITY is not set
+# CONFIG_VIDEO_AD5398 is not set
+# CONFIG_VIDEO_AD5820 is not set
+# CONFIG_VIDEO_AD9389B is not set
+# CONFIG_VIDEO_ADP1653 is not set
+# CONFIG_VIDEO_ADV7170 is not set
+# CONFIG_VIDEO_ADV7175 is not set
+# CONFIG_VIDEO_ADV7180 is not set
+# CONFIG_VIDEO_ADV7183 is not set
+# CONFIG_VIDEO_ADV7343 is not set
+# CONFIG_VIDEO_ADV7393 is not set
+# CONFIG_VIDEO_ADV748X is not set
+# CONFIG_VIDEO_ADV7511 is not set
+# CONFIG_VIDEO_ADV7604 is not set
+# CONFIG_VIDEO_ADV7842 is not set
+# CONFIG_VIDEO_ADV_DEBUG is not set
+# CONFIG_VIDEO_AK7375 is not set
+# CONFIG_VIDEO_AK881X is not set
+# CONFIG_VIDEO_AM437X_VPFE is not set
+# CONFIG_VIDEO_AR0521 is not set
+# CONFIG_VIDEO_ASPEED is not set
+# CONFIG_VIDEO_ATMEL_ISC is not set
+# CONFIG_VIDEO_ATMEL_ISI is not set
+# CONFIG_VIDEO_AU0828 is not set
+# CONFIG_VIDEO_BT819 is not set
+# CONFIG_VIDEO_BT848 is not set
+# CONFIG_VIDEO_BT856 is not set
+# CONFIG_VIDEO_BT866 is not set
+# CONFIG_VIDEO_CADENCE is not set
+# CONFIG_VIDEO_CADENCE_CSI2RX is not set
+# CONFIG_VIDEO_CADENCE_CSI2TX is not set
+# CONFIG_VIDEO_CAFE_CCIC is not set
+# CONFIG_VIDEO_CCS is not set
+# CONFIG_VIDEO_CODA is not set
+# CONFIG_VIDEO_CS3308 is not set
+# CONFIG_VIDEO_CS5345 is not set
+# CONFIG_VIDEO_CS53L32A is not set
+# CONFIG_VIDEO_CX231XX is not set
+# CONFIG_VIDEO_CX2341X is not set
+# CONFIG_VIDEO_CX25840 is not set
+# CONFIG_VIDEO_CX88 is not set
+# CONFIG_VIDEO_DEV is not set
+# CONFIG_VIDEO_DM6446_CCDC is not set
+# CONFIG_VIDEO_DT3155 is not set
+# CONFIG_VIDEO_DW9714 is not set
+# CONFIG_VIDEO_DW9768 is not set
+# CONFIG_VIDEO_DW9807_VCM is not set
+# CONFIG_VIDEO_EM28XX is not set
+# CONFIG_VIDEO_ET8EK8 is not set
+# CONFIG_VIDEO_FIXED_MINOR_RANGES is not set
+# CONFIG_VIDEO_GO7007 is not set
+# CONFIG_VIDEO_GS1662 is not set
+# CONFIG_VIDEO_HDPVR is not set
+# CONFIG_VIDEO_HEXIUM_GEMINI is not set
+# CONFIG_VIDEO_HEXIUM_ORION is not set
+# CONFIG_VIDEO_HI556 is not set
+# CONFIG_VIDEO_HI846 is not set
+# CONFIG_VIDEO_HI847 is not set
+# CONFIG_VIDEO_I2C is not set
+# CONFIG_VIDEO_IMX208 is not set
+# CONFIG_VIDEO_IMX214 is not set
+# CONFIG_VIDEO_IMX219 is not set
+# CONFIG_VIDEO_IMX258 is not set
+# CONFIG_VIDEO_IMX274 is not set
+# CONFIG_VIDEO_IMX290 is not set
+# CONFIG_VIDEO_IMX319 is not set
+# CONFIG_VIDEO_IMX334 is not set
+# CONFIG_VIDEO_IMX335 is not set
+# CONFIG_VIDEO_IMX355 is not set
+# CONFIG_VIDEO_IMX412 is not set
+# CONFIG_VIDEO_IMX477 is not set
+# CONFIG_VIDEO_IMX8_JPEG is not set
+# CONFIG_VIDEO_IMX_PXP is not set
+# CONFIG_VIDEO_IRS1125 is not set
+# CONFIG_VIDEO_IR_I2C is not set
+# CONFIG_VIDEO_ISL7998X is not set
+# CONFIG_VIDEO_IVTV is not set
+# CONFIG_VIDEO_KS0127 is not set
+# CONFIG_VIDEO_LM3560 is not set
+# CONFIG_VIDEO_LM3646 is not set
+# CONFIG_VIDEO_M52790 is not set
+# CONFIG_VIDEO_M5MOLS is not set
+# CONFIG_VIDEO_MAX9286 is not set
+# CONFIG_VIDEO_MEM2MEM_DEINTERLACE is not set
+# CONFIG_VIDEO_ML86V7667 is not set
+# CONFIG_VIDEO_MSP3400 is not set
+# CONFIG_VIDEO_MT9M001 is not set
+# CONFIG_VIDEO_MT9M032 is not set
+# CONFIG_VIDEO_MT9M111 is not set
+# CONFIG_VIDEO_MT9P031 is not set
+# CONFIG_VIDEO_MT9T001 is not set
+# CONFIG_VIDEO_MT9T112 is not set
+# CONFIG_VIDEO_MT9V011 is not set
+# CONFIG_VIDEO_MT9V032 is not set
+# CONFIG_VIDEO_MT9V111 is not set
+# CONFIG_VIDEO_MUX is not set
+# CONFIG_VIDEO_MXB is not set
+# CONFIG_VIDEO_NOON010PC30 is not set
+# CONFIG_VIDEO_OG01A1B is not set
+# CONFIG_VIDEO_OMAP2_VOUT is not set
+# CONFIG_VIDEO_OV02A10 is not set
+# CONFIG_VIDEO_OV08D10 is not set
+# CONFIG_VIDEO_OV13858 is not set
+# CONFIG_VIDEO_OV13B10 is not set
+# CONFIG_VIDEO_OV2311 is not set
+# CONFIG_VIDEO_OV2640 is not set
+# CONFIG_VIDEO_OV2659 is not set
+# CONFIG_VIDEO_OV2680 is not set
+# CONFIG_VIDEO_OV2685 is not set
+# CONFIG_VIDEO_OV2740 is not set
+# CONFIG_VIDEO_OV5640 is not set
+# CONFIG_VIDEO_OV5645 is not set
+# CONFIG_VIDEO_OV5647 is not set
+# CONFIG_VIDEO_OV5648 is not set
+# CONFIG_VIDEO_OV5670 is not set
+# CONFIG_VIDEO_OV5675 is not set
+# CONFIG_VIDEO_OV5693 is not set
+# CONFIG_VIDEO_OV5695 is not set
+# CONFIG_VIDEO_OV6650 is not set
+# CONFIG_VIDEO_OV7251 is not set
+# CONFIG_VIDEO_OV7640 is not set
+# CONFIG_VIDEO_OV7670 is not set
+# CONFIG_VIDEO_OV772X is not set
+# CONFIG_VIDEO_OV7740 is not set
+# CONFIG_VIDEO_OV8856 is not set
+# CONFIG_VIDEO_OV8865 is not set
+# CONFIG_VIDEO_OV9281 is not set
+# CONFIG_VIDEO_OV9282 is not set
+# CONFIG_VIDEO_OV9640 is not set
+# CONFIG_VIDEO_OV9650 is not set
+# CONFIG_VIDEO_OV9734 is not set
+# CONFIG_VIDEO_PVRUSB2 is not set
+# CONFIG_VIDEO_RDACM20 is not set
+# CONFIG_VIDEO_RDACM21 is not set
+# CONFIG_VIDEO_RJ54N1 is not set
+# CONFIG_VIDEO_S5C73M3 is not set
+# CONFIG_VIDEO_S5K4ECGX is not set
+# CONFIG_VIDEO_S5K5BAF is not set
+# CONFIG_VIDEO_S5K6A3 is not set
+# CONFIG_VIDEO_S5K6AA is not set
+# CONFIG_VIDEO_SAA6588 is not set
+# CONFIG_VIDEO_SAA6752HS is not set
+# CONFIG_VIDEO_SAA7110 is not set
+# CONFIG_VIDEO_SAA711X is not set
+# CONFIG_VIDEO_SAA7127 is not set
+# CONFIG_VIDEO_SAA7134 is not set
+# CONFIG_VIDEO_SAA717X is not set
+# CONFIG_VIDEO_SAA7185 is not set
+# CONFIG_VIDEO_SH_MOBILE_CEU is not set
+# CONFIG_VIDEO_SMIAPP is not set
+# CONFIG_VIDEO_SONY_BTF_MPX is not set
+# CONFIG_VIDEO_SR030PC30 is not set
+# CONFIG_VIDEO_STK1160_COMMON is not set
+# CONFIG_VIDEO_ST_MIPID02 is not set
+# CONFIG_VIDEO_TC358743 is not set
+# CONFIG_VIDEO_TDA1997X is not set
+# CONFIG_VIDEO_TDA7432 is not set
+# CONFIG_VIDEO_TDA9840 is not set
+# CONFIG_VIDEO_TEA6415C is not set
+# CONFIG_VIDEO_TEA6420 is not set
+# CONFIG_VIDEO_THS7303 is not set
+# CONFIG_VIDEO_THS8200 is not set
+# CONFIG_VIDEO_TIMBERDALE is not set
+# CONFIG_VIDEO_TLV320AIC23B is not set
+# CONFIG_VIDEO_TM6000 is not set
+# CONFIG_VIDEO_TVAUDIO is not set
+# CONFIG_VIDEO_TVP514X is not set
+# CONFIG_VIDEO_TVP5150 is not set
+# CONFIG_VIDEO_TVP7002 is not set
+# CONFIG_VIDEO_TW2804 is not set
+# CONFIG_VIDEO_TW9903 is not set
+# CONFIG_VIDEO_TW9906 is not set
+# CONFIG_VIDEO_TW9910 is not set
+# CONFIG_VIDEO_UDA1342 is not set
+# CONFIG_VIDEO_UPD64031A is not set
+# CONFIG_VIDEO_UPD64083 is not set
+# CONFIG_VIDEO_USBTV is not set
+# CONFIG_VIDEO_USBVISION is not set
+# CONFIG_VIDEO_V4L2 is not set
+# CONFIG_VIDEO_VP27SMPX is not set
+# CONFIG_VIDEO_VPX3220 is not set
+# CONFIG_VIDEO_VS6624 is not set
+# CONFIG_VIDEO_WM8739 is not set
+# CONFIG_VIDEO_WM8775 is not set
+# CONFIG_VIDEO_XILINX is not set
+# CONFIG_VIDEO_ZORAN is not set
+# CONFIG_VIRTIO_BALLOON is not set
+# CONFIG_VIRTIO_BLK_SCSI is not set
+# CONFIG_VIRTIO_CONSOLE is not set
+# CONFIG_VIRTIO_FS is not set
+# CONFIG_VIRTIO_INPUT is not set
+CONFIG_VIRTIO_MENU=y
+# CONFIG_VIRTIO_MMIO is not set
+# CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES is not set
+# CONFIG_VIRTIO_PCI is not set
+# CONFIG_VIRTUALIZATION is not set
+# CONFIG_VIRT_CPU_ACCOUNTING_GEN is not set
+# CONFIG_VIRT_DRIVERS is not set
+CONFIG_VIRT_TO_BUS=y
+# CONFIG_VITESSE_PHY is not set
+# CONFIG_VL53L0X_I2C is not set
+# CONFIG_VL6180 is not set
+CONFIG_VLAN_8021Q=y
+# CONFIG_VLAN_8021Q_GVRP is not set
+# CONFIG_VLAN_8021Q_MVRP is not set
+# CONFIG_VMAP_STACK is not set
+# CONFIG_VME_BUS is not set
+# CONFIG_VMLINUX_MAP is not set
+# CONFIG_VMSPLIT_1G is not set
+# CONFIG_VMSPLIT_2G is not set
+# CONFIG_VMSPLIT_2G_OPT is not set
+CONFIG_VMSPLIT_3G=y
+# CONFIG_VMSPLIT_3G_OPT is not set
+# CONFIG_VMWARE_PVSCSI is not set
+# CONFIG_VMWARE_VMCI is not set
+# CONFIG_VMXNET3 is not set
+# CONFIG_VM_EVENT_COUNTERS is not set
+# CONFIG_VOP_BUS is not set
+# CONFIG_VORTEX is not set
+# CONFIG_VSOCKETS is not set
+# CONFIG_VSOCKETS_DIAG is not set
+# CONFIG_VT is not set
+# CONFIG_VT6655 is not set
+# CONFIG_VT6656 is not set
+# CONFIG_VXFS_FS is not set
+# CONFIG_VXGE is not set
+# CONFIG_VXLAN is not set
+# CONFIG_VZ89X is not set
+# CONFIG_W1 is not set
+# CONFIG_W1_CON is not set
+# CONFIG_W1_MASTER_DS1WM is not set
+# CONFIG_W1_MASTER_DS2482 is not set
+# CONFIG_W1_MASTER_DS2490 is not set
+# CONFIG_W1_MASTER_GPIO is not set
+# CONFIG_W1_MASTER_MATROX is not set
+# CONFIG_W1_MASTER_SGI is not set
+# CONFIG_W1_SLAVE_DS2405 is not set
+# CONFIG_W1_SLAVE_DS2406 is not set
+# CONFIG_W1_SLAVE_DS2408 is not set
+# CONFIG_W1_SLAVE_DS2413 is not set
+# CONFIG_W1_SLAVE_DS2423 is not set
+# CONFIG_W1_SLAVE_DS2430 is not set
+# CONFIG_W1_SLAVE_DS2431 is not set
+# CONFIG_W1_SLAVE_DS2433 is not set
+# CONFIG_W1_SLAVE_DS2438 is not set
+# CONFIG_W1_SLAVE_DS250X is not set
+# CONFIG_W1_SLAVE_DS2780 is not set
+# CONFIG_W1_SLAVE_DS2781 is not set
+# CONFIG_W1_SLAVE_DS2805 is not set
+# CONFIG_W1_SLAVE_DS28E04 is not set
+# CONFIG_W1_SLAVE_DS28E17 is not set
+# CONFIG_W1_SLAVE_SMEM is not set
+# CONFIG_W1_SLAVE_THERM is not set
+# CONFIG_W83627HF_WDT is not set
+# CONFIG_W83877F_WDT is not set
+# CONFIG_W83977F_WDT is not set
+# CONFIG_WAN is not set
+# CONFIG_WANXL is not set
+# CONFIG_WARN_ALL_UNSEEDED_RANDOM is not set
+CONFIG_WATCHDOG=y
+# CONFIG_WATCHDOG_CORE is not set
+CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED=y
+# CONFIG_WATCHDOG_HRTIMER_PRETIMEOUT is not set
+# CONFIG_WATCHDOG_NOWAYOUT is not set
+CONFIG_WATCHDOG_OPEN_TIMEOUT=0
+# CONFIG_WATCHDOG_PRETIMEOUT_GOV is not set
+# CONFIG_WATCHDOG_SYSFS is not set
+# CONFIG_WATCH_QUEUE is not set
+# CONFIG_WD80x3 is not set
+# CONFIG_WDAT_WDT is not set
+# CONFIG_WDTPCI is not set
+CONFIG_WERROR=y
+# CONFIG_WEXT_CORE is not set
+# CONFIG_WEXT_PRIV is not set
+# CONFIG_WEXT_PROC is not set
+# CONFIG_WEXT_SPY is not set
+CONFIG_WILINK_PLATFORM_DATA=y
+# CONFIG_WIMAX is not set
+# CONFIG_WIREGUARD is not set
+CONFIG_WIRELESS=y
+# CONFIG_WIRELESS_EXT is not set
+# CONFIG_WIRELESS_WDS is not set
+# CONFIG_WIZNET_W5100 is not set
+# CONFIG_WIZNET_W5300 is not set
+# CONFIG_WL1251 is not set
+# CONFIG_WL12XX is not set
+# CONFIG_WL18XX is not set
+CONFIG_WLAN=y
+# CONFIG_WLAN_VENDOR_ADMTEK is not set
+# CONFIG_WLAN_VENDOR_ATH is not set
+# CONFIG_WLAN_VENDOR_ATMEL is not set
+# CONFIG_WLAN_VENDOR_BROADCOM is not set
+# CONFIG_WLAN_VENDOR_CISCO is not set
+# CONFIG_WLAN_VENDOR_INTEL is not set
+# CONFIG_WLAN_VENDOR_INTERSIL is not set
+# CONFIG_WLAN_VENDOR_MARVELL is not set
+# CONFIG_WLAN_VENDOR_MEDIATEK is not set
+# CONFIG_WLAN_VENDOR_MICROCHIP is not set
+# CONFIG_WLAN_VENDOR_PURELIFI is not set
+# CONFIG_WLAN_VENDOR_QUANTENNA is not set
+# CONFIG_WLAN_VENDOR_RALINK is not set
+# CONFIG_WLAN_VENDOR_REALTEK is not set
+# CONFIG_WLAN_VENDOR_RSI is not set
+# CONFIG_WLAN_VENDOR_SILABS is not set
+# CONFIG_WLAN_VENDOR_ST is not set
+# CONFIG_WLAN_VENDOR_TI is not set
+# CONFIG_WLAN_VENDOR_ZYDAS is not set
+# CONFIG_WLCORE is not set
+# CONFIG_WMI_BMOF is not set
+CONFIG_WQ_POWER_EFFICIENT_DEFAULT=y
+# CONFIG_WQ_WATCHDOG is not set
+# CONFIG_WWAN is not set
+# CONFIG_WWAN_HWSIM is not set
+# CONFIG_WW_MUTEX_SELFTEST is not set
+# CONFIG_X25 is not set
+# CONFIG_X509_CERTIFICATE_PARSER is not set
+# CONFIG_X86_PLATFORM_DRIVERS_HP is not set
+# CONFIG_X86_PKG_TEMP_THERMAL is not set
+CONFIG_X86_SYSFB=y
+# CONFIG_XDP_SOCKETS is not set
+# CONFIG_XEN is not set
+# CONFIG_XEN_VIRTIO is not set
+# CONFIG_XEN_GRANT_DMA_ALLOC is not set
+# CONFIG_XEN_PVCALLS_FRONTEND is not set
+# CONFIG_XEN_PV_MSR_SAFE is not set
+CONFIG_XEN_SCRUB_PAGES_DEFAULT=y
+CONFIG_XFRM=y
+# CONFIG_XFRM_INTERFACE is not set
+# CONFIG_XFRM_IPCOMP is not set
+# CONFIG_XFRM_MIGRATE is not set
+# CONFIG_XFRM_STATISTICS is not set
+# CONFIG_XFRM_SUB_POLICY is not set
+# CONFIG_XFRM_USER is not set
+# CONFIG_XFRM_USER_COMPAT is not set
+# CONFIG_XFS_DEBUG is not set
+# CONFIG_XFS_FS is not set
+# CONFIG_XFS_ONLINE_SCRUB is not set
+# CONFIG_XFS_POSIX_ACL is not set
+# CONFIG_XFS_QUOTA is not set
+# CONFIG_XFS_RT is not set
+# CONFIG_XFS_SUPPORT_V4 is not set
+# CONFIG_XFS_WARN is not set
+# CONFIG_XIAOMI_WMI is not set
+# CONFIG_XILINX_AXI_EMAC is not set
+# CONFIG_XILINX_DMA is not set
+# CONFIG_XILINX_EMACLITE is not set
+# CONFIG_XILINX_GMII2RGMII is not set
+# CONFIG_XILINX_INTC is not set
+# CONFIG_XILINX_LL_TEMAC is not set
+# CONFIG_XILINX_SDFEC is not set
+# CONFIG_XILINX_VCU is not set
+# CONFIG_XILINX_WATCHDOG is not set
+# CONFIG_XILINX_XADC is not set
+# CONFIG_XILINX_ZYNQMP_DMA is not set
+# CONFIG_XILINX_ZYNQMP_DPDMA is not set
+# CONFIG_XILLYBUS is not set
+# CONFIG_XILLYUSB is not set
+# CONFIG_XIL_AXIS_FIFO is not set
+# CONFIG_XIP_KERNEL is not set
+# CONFIG_XMON is not set
+CONFIG_XZ_DEC=y
+# CONFIG_XZ_DEC_ARM is not set
+# CONFIG_XZ_DEC_ARMTHUMB is not set
+# CONFIG_XZ_DEC_BCJ is not set
+# CONFIG_XZ_DEC_IA64 is not set
+# CONFIG_XZ_DEC_MICROLZMA is not set
+# CONFIG_XZ_DEC_POWERPC is not set
+# CONFIG_XZ_DEC_SPARC is not set
+# CONFIG_XZ_DEC_TEST is not set
+# CONFIG_XZ_DEC_X86 is not set
+# CONFIG_YAM is not set
+# CONFIG_YAMAHA_YAS530 is not set
+# CONFIG_YELLOWFIN is not set
+# CONFIG_YENTA is not set
+# CONFIG_YENTA_O2 is not set
+# CONFIG_YENTA_RICOH is not set
+# CONFIG_YENTA_TI is not set
+# CONFIG_YENTA_TOSHIBA is not set
+# CONFIG_YOGABOOK_WMI is not set
+# CONFIG_ZBUD is not set
+# CONFIG_ZD1211RW is not set
+# CONFIG_ZD1211RW_DEBUG is not set
+# CONFIG_ZEROPLUS_FF is not set
+# CONFIG_ZERO_CALL_USED_REGS is not set
+# CONFIG_ZIIRAVE_WATCHDOG is not set
+# CONFIG_ZISOFS is not set
+# CONFIG_ZLIB_DEFLATE is not set
+# CONFIG_ZLIB_INFLATE is not set
+CONFIG_ZONE_DMA=y
+# CONFIG_ZOPT2201 is not set
+# CONFIG_ZPA2326 is not set
+# CONFIG_ZPOOL is not set
+# CONFIG_ZRAM is not set
+# CONFIG_ZRAM_DEF_COMP_842 is not set
+# CONFIG_ZRAM_DEF_COMP_LZ4 is not set
+# CONFIG_ZRAM_DEF_COMP_LZ4HC is not set
+# CONFIG_ZRAM_DEF_COMP_LZO is not set
+# CONFIG_ZRAM_DEF_COMP_LZORLE is not set
+# CONFIG_ZRAM_DEF_COMP_ZSTD is not set
+# CONFIG_ZRAM_MEMORY_TRACKING is not set
+# CONFIG_ZSMALLOC is not set
+# CONFIG_ZSWAP is not set
+# CONFIG_ZX_TDM is not set
+# CONFIG_AHCI_BRCM is not set
+# CONFIG_ARCH_BCM_HR2 is not set
+# CONFIG_ARM64_4K_PAGES is not set
+# CONFIG_BCM7038_L1_IRQ is not set
+# CONFIG_BCM7120_L2_IRQ is not set
+# CONFIG_BOOTPARAM_HARDLOCKUP_PANIC is not set
+# CONFIG_BRCMSTB_L2_IRQ is not set
+# CONFIG_CHARGER_QCOM_SMBB is not set
+# CONFIG_CPU_LITTLE_ENDIAN is not set
+# CONFIG_DEBUG_VM_PGFLAGS is not set
+# CONFIG_DEBUG_VM_RB is not set
+# CONFIG_DEBUG_VM_VMACACHE is not set
+# CONFIG_DVB_USB is not set
+# CONFIG_DYNAMIC_DEBUG_CORE is not set
+# CONFIG_FTRACE_SORT_STARTUP_TEST is not set
+# CONFIG_HISI_PTT is not set
+# CONFIG_HIST_TRIGGERS_DEBUG is not set
+# CONFIG_INPUT_PM8941_PWRKEY is not set
+# CONFIG_INPUT_PM8XXX_VIBRATOR is not set
+# CONFIG_IR_SIR is not set
+# CONFIG_IR_TTUSBIR is not set
+# CONFIG_KASAN_MODULE_TEST is not set
+# CONFIG_LD_HEAD_STUB_CATCH is not set
+# CONFIG_LIRC is not set
+# CONFIG_LIVEPATCH is not set
+# CONFIG_MEDIA_CONTROLLER_DVB is not set
+# CONFIG_MMC_SDHCI_BRCMSTB is not set
+# CONFIG_MTD_NAND_BRCMNAND_BCM63XX is not set
+# CONFIG_MTD_NAND_BRCMNAND_BCMBCA is not set
+# CONFIG_MTD_NAND_BRCMNAND_BRCMSTB is not set
+# CONFIG_MTD_NAND_BRCMNAND_IPROC is not set
+# CONFIG_NETFILTER_XT_MATCH_CONNLABEL is not set
+# CONFIG_NET_DSA_QCA8K_LEDS_SUPPORT is not set
+# CONFIG_NF_CONNTRACK is not set
+# CONFIG_NF_CONNTRACK_LABELS is not set
+# CONFIG_NF_TABLES is not set
+# CONFIG_NVMEM_LAYOUT_SL28_VPD is not set
+# CONFIG_PPC_QUEUED_SPINLOCKS is not set
+# CONFIG_PWM_IMG is not set
+# CONFIG_PWM_MEDIATEK is not set
+# CONFIG_RV is not set
+# CONFIG_SND_SOC_ROCKCHIP is not set
+# CONFIG_SPI_ROCKCHIP_SFC is not set
+# CONFIG_SYNTH_EVENT_GEN_TEST is not set
+# CONFIG_TEST_DEBUG_VIRTUAL is not set
+# CONFIG_TEST_DYNAMIC_DEBUG is not set
+# CONFIG_TLS_DEVICE is not set
+# CONFIG_TRACE_MMIO_ACCESS is not set
+# CONFIG_UBSAN_DIV_ZERO is not set
+# CONFIG_UBSAN_UNREACHABLE is not set
+# CONFIG_UNUSED_BOARD_FILES is not set
+# CONFIG_USB_XEN_HCD is not set
+# CONFIG_VIDEO_CODA is not set
+# CONFIG_VIDEO_IMX8_JPEG is not set
+# CONFIG_VIDEO_IMX_PXP is not set
+# CONFIG_VIDEO_MEM2MEM_DEINTERLACE is not set
+# CONFIG_WEXT_CORE is not set
+# CONFIG_WEXT_PRIV is not set
+# CONFIG_WEXT_PROC is not set
+# CONFIG_WEXT_SPY is not set
+# CONFIG_WIRELESS_EXT is not set
+# CONFIG_X86_AMD_PSTATE_UT is not set
+# CONFIG_ZRAM_DEF_COMP_842 is not set
+# CONFIG_ZRAM_MULTI_COMP is not set
+# CONFIG_PATA_PARPORT is not set
+CONFIG_MD_BITMAP_FILE=y
+# CONFIG_NETCONSOLE_EXTENDED_LOG is not set
+# CONFIG_PDS_CORE is not set
+# CONFIG_MLX5_MACSEC is not set
+# CONFIG_VCAP is not set
+# CONFIG_MARVELL_88Q2XXX_PHY is not set
+# CONFIG_MICROCHIP_T1S_PHY is not set
+# CONFIG_NXP_CBTX_PHY is not set
+# CONFIG_NCN26000_PHY is not set
+# CONFIG_PPPOE_HASH_BITS_1 is not set
+# CONFIG_PPPOE_HASH_BITS_2 is not set
+CONFIG_PPPOE_HASH_BITS_4=y
+# CONFIG_PPPOE_HASH_BITS_8 is not set
+# CONFIG_TOUCHSCREEN_CYTTSP5 is not set
+# CONFIG_TOUCHSCREEN_HYNITRON_CSTXXX is not set
+# CONFIG_TOUCHSCREEN_NOVATEK_NVT_TS is not set
+# CONFIG_TOUCHSCREEN_IQS7211 is not set
+# CONFIG_TOUCHSCREEN_HIMAX_HX83112B is not set
+# CONFIG_LEGACY_TIOCSTI is not set
+# CONFIG_SERIAL_8250_PCI1XXXX is not set
+# CONFIG_SPI_PCI1XXXX is not set
+# CONFIG_PTP_1588_CLOCK_MOCK is not set
+# CONFIG_GPIO_FXL6408 is not set
+# CONFIG_GPIO_DS4520 is not set
+# CONFIG_GPIO_ELKHARTLAKE is not set
+# CONFIG_GPIO_LATCH is not set
+# CONFIG_SENSORS_HS3001 is not set
+# CONFIG_MAX31827 is not set
+# CONFIG_SENSORS_MC34VR500 is not set
+# CONFIG_SENSORS_OXP is not set
+# CONFIG_SENSORS_ACBEL_FSG032 is not set
+# CONFIG_SENSORS_MPQ7932 is not set
+# CONFIG_SENSORS_TDA38640 is not set
+# CONFIG_SENSORS_HP_WMI is not set
+# CONFIG_ADVANTECH_EC_WDT is not set
+# CONFIG_MFD_SMPRO is not set
+# CONFIG_MFD_CS42L43_I2C is not set
+# CONFIG_MFD_MAX77541 is not set
+# CONFIG_MFD_TPS6594_I2C is not set
+# CONFIG_MFD_TPS6594_SPI is not set
+# CONFIG_MFD_INTEL_M10_BMC_SPI is not set
+# CONFIG_DRM_AMDGPU_WERROR is not set
+CONFIG_DRM_VIRTIO_GPU_KMS=y
+# CONFIG_DRM_PANEL_AUO_A030JTN01 is not set
+# CONFIG_DRM_PANEL_ORISETECH_OTA5601A is not set
+# CONFIG_DRM_LOONGSON is not set
+CONFIG_FB_DEVICE=y
+# CONFIG_BACKLIGHT_KTZ8866 is not set
+# CONFIG_DRM_ACCEL is not set
+# CONFIG_HID_EVISION is not set
+# CONFIG_HID_GOOGLE_STADIA_FF is not set
+# CONFIG_HID_NVIDIA_SHIELD is not set
+# CONFIG_LEDS_AW200XX is not set
+# CONFIG_LEDS_PCA995X is not set
+# CONFIG_LEDS_BD2606MVV is not set
+# CONFIG_XILINX_XDMA is not set
+# CONFIG_HYPERV_VTL_MODE is not set
+# CONFIG_YOGABOOK is not set
+# CONFIG_LENOVO_YMC is not set
+# CONFIG_INTEL_IFS is not set
+# CONFIG_MSI_EC is not set
+# CONFIG_WPCM450_SOC is not set
+# CONFIG_IIO_KX022A_SPI is not set
+# CONFIG_IIO_KX022A_I2C is not set
+# CONFIG_AD4130 is not set
+# CONFIG_MAX11410 is not set
+# CONFIG_TI_ADS7924 is not set
+# CONFIG_TI_ADS1100 is not set
+# CONFIG_TI_LMP92064 is not set
+# CONFIG_AD74115 is not set
+# CONFIG_MAX5522 is not set
+# CONFIG_MCP4728 is not set
+# CONFIG_ADF437 is not set
+# CONFIG_ROHM_BU27008 is not set
+# CONFIG_ROHM_BU27034 is not set
+# CONFIG_OVERLAY_FS_DEBUG is not set
+# CONFIG_TMPFS_QUOTA is not set
+# CONFIG_ADF4377 is not set
+# CONFIG_OPT4001 is not set
+# CONFIG_TI_TMAG5273 is not set
+# CONFIG_X9250 is not set
+# CONFIG_MPRLS0025PA is not set
+# CONFIG_IRSD200 is not set
+# CONFIG_MAX30208 is not set
+# CONFIG_XFS_SUPPORT_ASCII_CI is not set
+# CONFIG_SQUASHFS_CHOICE_DECOMP_BY_MOUNT is not set
+CONFIG_SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU=y
+# CONFIG_SQUASHFS_COMPILE_DECOMP_SINGLE is not set
+# CONFIG_SQUASHFS_COMPILE_DECOMP_MULTI is not set
+# CONFIG_NFSD_V2 is not set
+# CONFIG_RPCSEC_GSS_KRB5_ENCTYPES_AES_SHA1 is not set
+# CONFIG_RPCSEC_GSS_KRB5_ENCTYPES_CAMELLIA is not set
+# CONFIG_RPCSEC_GSS_KRB5_ENCTYPES_AES_SHA2 is not set
+# CONFIG_LIST_HARDENED is not set
+# CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE is not set
+# CONFIG_CRYPTO_ARIA_AESNI_AVX2_X86_64 is not set
+# CONFIG_CRYPTO_ARIA_GFNI_AVX512_X86_64 is not set
+# CONFIG_SWIOTLB_DYNAMIC is not set
+CONFIG_DEBUG_INFO_COMPRESSED_NONE=y
+# CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set
+# CONFIG_DEBUG_INFO_COMPRESSED_ZSTD is not set
+# CONFIG_PER_VMA_LOCK_STATS is not set
+# CONFIG_WQ_CPU_INTENSIVE_REPORT is not set
+# CONFIG_NMI_CHECK_CPU is not set
+# CONFIG_RCU_CPU_STALL_CPUTIME is not set
+# CONFIG_TEST_DHRY is not set
+# CONFIG_DEBUG_CGROUP_REF is not set
+# CONFIG_USER_EVENTS is not set
+# CONFIG_CHARGER_RT9467 is not set
+# CONFIG_CHARGER_RT9471 is not set
+# CONFIG_XILINX_WINDOW_WATCHDOG is not set
+# CONFIG_MFD_MAX5970 is not set
+# CONFIG_MFD_TPS65219 is not set
+# CONFIG_REGULATOR_AW37503 is not set
+# CONFIG_REGULATOR_MAX77857 is not set
+# CONFIG_REGULATOR_MAX20411 is not set
+# CONFIG_REGULATOR_RAA215300 is not set
+# CONFIG_REGULATOR_RT4803 is not set
+# CONFIG_REGULATOR_RT5739 is not set
+# CONFIG_REGULATOR_RT6190 is not set
+# CONFIG_REGULATOR_RTQ2208 is not set
+# CONFIG_REGULATOR_TPS6287X is not set
+# CONFIG_LEDS_LM3697 is not set
+# CONFIG_LEDS_GROUP_MULTICOLOR is not set
+# CONFIG_COMMON_CLK_SI521XX is not set
+# CONFIG_COMMON_CLK_VC3 is not set
+# CONFIG_CDX_BUS is not set
+# CONFIG_CRYPTO_SM4_ARM64_CE_CCM is not set
+# CONFIG_CRYPTO_SM4_ARM64_CE_GCM is not set
+CONFIG_PROBE_EVENTS_BTF_ARGS=y
+# CONFIG_ARM64_ERRATUM_3117295 is not set
+# CONFIG_MITIGATION_RFDS is not set
+# CONFIG_UIMAGE_FIT_BLK is not set
+# CONFIG_AIR_EN8811H_PHY is not set
+# CONFIG_QCA83XX_PHY is not set
+# CONFIG_QCA808X_PHY is not set
+# CONFIG_CAN_F81604 is not set
+# CONFIG_PCS_MTK_USXGMII is not set
+# CONFIG_USB_CDNS3_PCI_WRAP is not set
+# CONFIG_USB_CDNSP_PCI is not set
+# CONFIG_BLK_NVMEM is not set
+# CONFIG_MTD_UBI_NVMEM is not set
+# CONFIG_ARCH_MA35 is not set
+# CONFIG_ARM64_ERRATUM_2645198 is not set
+# CONFIG_ARM64_ERRATUM_2966298 is not set
+# CONFIG_ROCKCHIP_ERRATUM_3588001 is not set
+# CONFIG_PCI_DYNAMIC_OF_NODES is not set
+# CONFIG_MTD_SPLIT_SEIL_FW is not set
+# CONFIG_SERIAL_EARLYCON_SEMIHOST is not set
+# CONFIG_I2C_HISI is not set
+# CONFIG_SPI_SN_F_OSPI is not set
+# CONFIG_GPIO_HISI is not set
+# CONFIG_CHARGER_QCOM_SMB2 is not set
+# CONFIG_MFD_RK8XX_I2C is not set
+# CONFIG_MFD_RK8XX_SPI is not set
+# CONFIG_QCA807X_PHY is not set
+# CONFIG_LEDS_SMARTRG_LED is not set
+# CONFIG_PHY_MTK_XFI_TPHY is not set
+# CONFIG_BT_NXPUART is not set
+# CONFIG_BCMASP is not set
+# CONFIG_MFD_RPISENSE_CORE is not set
+# CONFIG_MFD_RASPBERRYPI_POE_HAT is not set
+# CONFIG_REGULATOR_RASPBERRYPI_TOUCHSCREEN_V2 is not set
+# CONFIG_VIDEO_BCM2835_UNICAM is not set
+# CONFIG_VIDEO_RASPBERRYPI_PISP_BE is not set
+# CONFIG_VIDEO_RP1_CFE is not set
+# CONFIG_VIDEO_CAMERA_SENSOR is not set
+# CONFIG_VIDEO_BU64754 is not set
+# CONFIG_VIDEO_DW9719 is not set
+# CONFIG_VIDEO_TC358746 is not set
+# CONFIG_VIDEO_DS90UB913 is not set
+# CONFIG_VIDEO_DS90UB953 is not set
+# CONFIG_VIDEO_DS90UB960 is not set
+# CONFIG_DRM_PANEL_HIMAX_HX8394 is not set
+# CONFIG_DRM_PANEL_JADARD_JD9365DA_H3 is not set
+# CONFIG_DRM_PANEL_MAGNACHIP_D53E6EA8966 is not set
+# CONFIG_DRM_PANEL_NEWVISION_NV3051D is not set
+# CONFIG_DRM_PANEL_NOVATEK_NT36523 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_S6D7AA0 is not set
+# CONFIG_DRM_PANEL_SONY_TD4353_JDI is not set
+# CONFIG_DRM_PANEL_STARTEK_KD070FHFID015 is not set
+# CONFIG_DRM_PANEL_VISIONOX_VTDR6130 is not set
+# CONFIG_DRM_PANEL_VISIONOX_R66451 is not set
+# CONFIG_DRM_SAMSUNG_DSIM is not set
+# CONFIG_DRM_V3D is not set
+# CONFIG_DRM_RP1_DSI is not set
+# CONFIG_DRM_RP1_DPI is not set
+# CONFIG_DRM_RP1_VEC is not set
+# CONFIG_FB_RPISENSE is not set
+# CONFIG_SND_SEQ_UMP is not set
+# CONFIG_SND_PCMTEST is not set
+# CONFIG_SND_USB_AUDIO_MIDI_V2 is not set
+# CONFIG_SND_SOC_CHV3_I2S is not set
+# CONFIG_SND_SOC_AUDIO_IIO_AUX is not set
+# CONFIG_SND_SOC_AW88395 is not set
+# CONFIG_SND_SOC_AW88261 is not set
+# CONFIG_SND_SOC_CHV3_CODEC is not set
+# CONFIG_SND_SOC_CS35L56_I2C is not set
+# CONFIG_SND_SOC_CS35L56_SPI is not set
+# CONFIG_SND_SOC_IDT821034 is not set
+# CONFIG_SND_SOC_MAX98090 is not set
+# CONFIG_SND_SOC_MAX98388 is not set
+# CONFIG_SND_SOC_PEB2466 is not set
+# CONFIG_SND_SOC_SMA1303 is not set
+# CONFIG_SND_SOC_SSM3515 is not set
+# CONFIG_SND_SOC_TAS2781_I2C is not set
+# CONFIG_SND_SOC_WM8961 is not set
+# CONFIG_IOMMUFD is not set
+# CONFIG_PINCTRL_RP1 is not set
+# CONFIG_PINCTRL_BCM2712 is not set
+# CONFIG_GPIO_BRCMSTB is not set
+# CONFIG_MFD_RP1 is not set
+# CONFIG_COMMON_CLK_RP1 is not set
+# CONFIG_COMMON_CLK_RP1_SDIO is not set
+# CONFIG_PWM_RP1 is not set
+# CONFIG_BCM2712_MIP is not set
+# CONFIG_RESET_BRCMSTB is not set
+# CONFIG_PHY_BRCM_USB is not set
+# CONFIG_SENSORS_RP1_ADC is not set
+# CONFIG_NET_DSA_TAG_NONE is not set
+# CONFIG_INTEL_MEI_GSC_PROXY is not set
+# CONFIG_NET_DSA_MSCC_OCELOT_EXT is not set
+# CONFIG_DRM_I915_PREEMPT_TIMEOUT_COMPUTE is not set
+CONFIG_SPECTRE_BHI_ON=y
+# CONFIG_SPECTRE_BHI_OFF is not set
+# CONFIG_SPECTRE_BHI_AUTO is not set
+# CONFIG_AIROHA_EN8801SC_PHY is not set
+# CONFIG_NF_CONNTRACK_DSCPREMARK_EXT is not set
+# CONFIG_REGULATOR_QCOM_REFGEN is not set
+# CONFIG_INGENIC_CGU_JZ4755 is not set
+CONFIG_SKB_RECYCLER=y
+CONFIG_SKB_RECYCLER_MULTI_CPU=y
+# CONFIG_MITIGATION_SPECTRE_BHI is not set
+CONFIG_DRM_I915_PREEMPT_TIMEOUT_COMPUTE=7500
+# CONFIG_CPUFREQ_DT is not set
+# CONFIG_SEL3350_PLATFORM is not set
+# CONFIG_NF_CONNTRACK_DSCPREMARK_EXT is not set
+# CONFIG_ARM_SMMU_V3_PMU is not set
+# CONFIG_ARM_CORESIGHT_PMU_ARCH_SYSTEM_PMU is not set
+# CONFIG_ARM_PMUV3 is not set
+# CONFIG_CPUFREQ_DT_PLATDEV is not set
+# CONFIG_KEYBOARD_MT6779 is not set
+# CONFIG_COMMON_CLK_MT8188 is not set
+# CONFIG_COMMON_CLK_MEDIATEK_FHCTL is not set
+# CONFIG_UACCE is not set
+# CONFIG_CPU_MITIGATIONS is not set
+# CONFIG_BLOCK_NOTIFIERS is not set
+# CONFIG_NVMEM_BLOCK is not set
+CONFIG_PCP_BATCH_SCALE_MAX=5
+# CONFIG_CZNIC_PLATFORMS is not set
+# CONFIG_AMD_XGBE_DCB is not set
+# CONFIG_IXGBE_DCB is not set
+# CONFIG_I40E_DCB is not set
+# CONFIG_QLCNIC_DCB is not set
+# CONFIG_ARM64_ERRATUM_3194386 is not set
+# CONFIG_MEMCG_V1 is not set
+# CONFIG_BASE_SMALL is not set
+# CONFIG_X86_FRED is not set
+# CONFIG_KVM_SW_PROTECTED_VM is not set
+# CONFIG_KVM_INTEL_PROVE_VE is not set
+# CONFIG_KVM_HYPERV is not set
+CONFIG_KVM_MAX_NR_VCPUS=1024
+CONFIG_BLK_DEV_WRITE_MOUNTED=y
+CONFIG_SLAB_BUCKETS=y
+# CONFIG_TCP_AO is not set
+# CONFIG_NET_DSA_TAG_VSC73XX_8021Q is not set
+# CONFIG_BT_INTEL_PCIE is not set
+# CONFIG_ZRAM_TRACK_ENTRY_ACTIME is not set
+# CONFIG_NVME_HOST_AUTH is not set
+# CONFIG_NSM is not set
+# CONFIG_KEBA_CP500 is not set
+# CONFIG_DM_VDO is not set
+# CONFIG_PFCP is not set
+# CONFIG_NETKIT is not set
+# CONFIG_IDPF is not set
+# CONFIG_OCTEON_EP_VF is not set
+# CONFIG_OA_TC6 is not set
+# CONFIG_RTASE is not set
+# CONFIG_TEHUTI_TN40 is not set
+# CONFIG_DP83TG720_PHY is not set
+# CONFIG_CAN_ESD_402_PCI is not set
+# CONFIG_TOUCHSCREEN_GOODIX_BERLIN_I2C is not set
+# CONFIG_TOUCHSCREEN_GOODIX_BERLIN_SPI is not set
+# CONFIG_TCG_TPM2_HMAC is not set
+# CONFIG_I2C_ZHAOXIN is not set
+# CONFIG_SPI_CH341 is not set
+# CONFIG_PTP_1588_CLOCK_FC3W is not set
+# CONFIG_PINCTRL_INTEL_PLATFORM is not set
+# CONFIG_PINCTRL_METEORPOINT is not set
+# CONFIG_GPIO_GRANITERAPIDS is not set
+# CONFIG_GPIO_SLOPPY_LOGIC_ANALYZER is not set
+# CONFIG_GPIO_VIRTUSER is not set
+# CONFIG_W1_MASTER_AMD_AXI is not set
+# CONFIG_POWER_SEQUENCING is not set
+# CONFIG_BATTERY_MAX1720X is not set
+# CONFIG_FUEL_GAUGE_MM8013 is not set
+# CONFIG_SENSORS_ASUS_ROG_RYUJIN is not set
+# CONFIG_SENSORS_CHIPCAP2 is not set
+# CONFIG_SENSORS_GIGABYTE_WATERFORCE is not set
+# CONFIG_SENSORS_POWERZ is not set
+# CONFIG_SENSORS_LENOVO_EC is not set
+# CONFIG_SENSORS_LTC2991 is not set
+# CONFIG_SENSORS_LTC4282 is not set
+# CONFIG_SENSORS_NZXT_KRAKEN3 is not set
+# CONFIG_SENSORS_ADP1050 is not set
+# CONFIG_SENSORS_LTC4286 is not set
+# CONFIG_SENSORS_MP2856 is not set
+# CONFIG_SENSORS_MP2891 is not set
+# CONFIG_SENSORS_MP2993 is not set
+# CONFIG_SENSORS_MP5920 is not set
+# CONFIG_SENSORS_MP5990 is not set
+# CONFIG_SENSORS_MP9941 is not set
+# CONFIG_SENSORS_MPQ8785 is not set
+# CONFIG_SENSORS_XDP710 is not set
+# CONFIG_SENSORS_PT5161L is not set
+# CONFIG_SENSORS_SPD5118 is not set
+# CONFIG_THERMAL_DEBUGFS is not set
+# CONFIG_LENOVO_SE10_WDT is not set
+# CONFIG_MFD_CS40L50_I2C is not set
+# CONFIG_MFD_CS40L50_SPI is not set
+# CONFIG_DRM_XE is not set
+# CONFIG_BACKLIGHT_KTD2801 is not set
+# CONFIG_BACKLIGHT_LM3509 is not set
+# CONFIG_HID_WINWING is not set
+# CONFIG_HID_MCP2200 is not set
+CONFIG_USB_PCI_AMD=y
+CONFIG_USB_DEFAULT_AUTHORIZATION_MODE=1
+# CONFIG_USB_LJCA is not set
+# CONFIG_LEDS_KTD202X is not set
+# CONFIG_LEDS_TRIGGER_INPUT_EVENTS is not set
+# CONFIG_RTC_DRV_MAX31335 is not set
+# CONFIG_RTC_DRV_RX8111 is not set
+# CONFIG_VFIO_DEBUGFS is not set
+# CONFIG_VIRTIO_VFIO_PCI is not set
+# CONFIG_VIRTIO_DEBUG is not set
+# CONFIG_AMD_WBRF is not set
+# CONFIG_ACPI_QUICKSTART is not set
+# CONFIG_MEEGOPAD_ANX7428 is not set
+# CONFIG_SILICOM_PLATFORM is not set
+# CONFIG_AD7091R8 is not set
+# CONFIG_AD7173 is not set
+# CONFIG_AD7380 is not set
+# CONFIG_AD7944 is not set
+# CONFIG_LTC2309 is not set
+# CONFIG_MAX34408 is not set
+# CONFIG_MCP3564 is not set
+# CONFIG_PAC1934 is not set
+# CONFIG_TI_ADS1119 is not set
+# CONFIG_TI_ADS1298 is not set
+# CONFIG_AOSONG_AGS02MA is not set
+# CONFIG_ENS160 is not set
+# CONFIG_AD9739A is not set
+# CONFIG_MCP4821 is not set
+# CONFIG_ADMFM2000 is not set
+# CONFIG_HDC3020 is not set
+# CONFIG_BMI323_I2C is not set
+# CONFIG_BMI323_SPI is not set
+# CONFIG_APDS9306 is not set
+# CONFIG_ISL76682 is not set
+# CONFIG_LTR390 is not set
+# CONFIG_VEML6040 is not set
+# CONFIG_VEML6075 is not set
+# CONFIG_ROHM_BM1390 is not set
+# CONFIG_HSC030PA is not set
+# CONFIG_MLX90635 is not set
+# CONFIG_MCP9600 is not set
+# CONFIG_LAN966X_OIC is not set
+# CONFIG_RESET_GPIO is not set
+# CONFIG_DWC_PCIE_PMU is not set
+# CONFIG_BCACHEFS_FS is not set
+CONFIG_FUSE_PASSTHROUGH=y
+# CONFIG_NETFS_DEBUG is not set
+# CONFIG_NFSD_LEGACY_CLIENT_TRACKING is not set
+# CONFIG_CRYPTO_DEV_QAT_420XX is not set
+# CONFIG_LWQ_TEST is not set
+# CONFIG_MEM_ALLOC_PROFILING is not set
+# CONFIG_TEST_OBJPOOL is not set
+# CONFIG_MLX5_DPLL is not set
+# CONFIG_NET_VENDOR_META is not set
+# CONFIG_LAN865X is not set
+# CONFIG_FDMA is not set
+# CONFIG_MICROCODE_LATE_LOADING is not set
+# CONFIG_X86_USER_SHADOW_STACK is not set
+CONFIG_EFI_HANDOVER_PROTOCOL=y
+# CONFIG_ARCH_PENSANDO is not set
+# CONFIG_COMPRESSED_INSTALL is not set
+# CONFIG_NET_AIROHA is not set
+# CONFIG_CAN_ROCKCHIP_CANFD is not set
+# CONFIG_PINCTRL_AW9523 is not set
+# CONFIG_W1_MASTER_UART is not set
+# CONFIG_MFD_88PM886_PMIC is not set
+# CONFIG_MFD_ROHM_BD96801 is not set
+# CONFIG_REGULATOR_NETLINK_EVENTS is not set
+# CONFIG_REGULATOR_MAX77503 is not set
+# CONFIG_USB_ONBOARD_DEV is not set
+# CONFIG_LEDS_LP5569 is not set
+# CONFIG_LEDS_NCP5623 is not set
+# CONFIG_AF8133J is not set
+# CONFIG_PWM_GPIO is not set
+# CONFIG_PHY_MTK_MIPI_CSI_0_5 is not set
+# CONFIG_TEST_FPU is not set
+# CONFIG_BT_HCIUART_AML is not set
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_TEE=y
+# CONFIG_INPUT_RK805_PWRKEY is not set
+# CONFIG_OPTEE is not set
+CONFIG_NF_CONNTRACK_CHAIN_EVENTS=y
+CONFIG_SHORTCUT_FE=y
+CONFIG_RANDOM_DEFAULT_IMPL=y
+CONFIG_LRNG=y
+# CONFIG_LRNG_AIS2031_NTG1_SEEDING_STRATEGY is not set
+# CONFIG_LRNG_KCAPI_IF is not set
+CONFIG_LRNG_HWRAND_IF=y
+CONFIG_LRNG_DEV_IF=y
+# CONFIG_LRNG_RUNTIME_ES_CONFIG is not set
+# CONFIG_LRNG_JENT is not set
+CONFIG_LRNG_CPU=y
+CONFIG_LRNG_CPU_ENTROPY_RATE=8
+# CONFIG_LRNG_SCHED is not set
+# CONFIG_LRNG_KERNEL_RNG is not set
+# CONFIG_LRNG_SWITCH_HASH is not set
+# CONFIG_LRNG_SWITCH_DRNG is not set
+CONFIG_LRNG_DFLT_DRNG_CHACHA20=y
+# CONFIG_LRNG_DFLT_DRNG_DRBG is not set
+# CONFIG_LRNG_DFLT_DRNG_KCAPI is not set
+# CONFIG_LRNG_TESTING_MENU is not set
+# CONFIG_LRNG_SELFTEST is not set
+# CONFIG_SCHED_CLASS_EXT is not set
+# CONFIG_CPUSETS_V1 is not set
+CONFIG_ZSMALLOC_CHAIN_SIZE=8
+# CONFIG_PCI_NPEM is not set
+# CONFIG_ZRAM_BACKEND_LZ4 is not set
+# CONFIG_ZRAM_BACKEND_LZ4HC is not set
+# CONFIG_ZRAM_BACKEND_ZSTD is not set
+# CONFIG_ZRAM_BACKEND_DEFLATE is not set
+# CONFIG_ZRAM_BACKEND_842 is not set
+# CONFIG_RPMB is not set
+# CONFIG_THERMAL_CORE_TESTING is not set
+# CONFIG_DRM_PANIC is not set
+# CONFIG_HID_GOODIX_SPI is not set
+# CONFIG_RTC_DRV_SD2405AL is not set
+# CONFIG_AMD_QDMA is not set
+# CONFIG_EXTCON_LC824206XA is not set
+# CONFIG_ADXL380_SPI is not set
+# CONFIG_ADXL380_I2C is not set
+# CONFIG_AD4000 is not set
+# CONFIG_AD4695 is not set
+# CONFIG_PAC1921 is not set
+# CONFIG_LTC2664 is not set
+# CONFIG_ENS210 is not set
+# CONFIG_BH1745 is not set
+# CONFIG_SDP500 is not set
+# CONFIG_HX9023S is not set
+# CONFIG_AW96103 is not set
+# CONFIG_NFS_LOCALIO is not set
+# CONFIG_CIFS_COMPRESSION is not set
+CONFIG_PROC_MEM_ALWAYS_FORCE=y
+# CONFIG_PROC_MEM_FORCE_PTRACE is not set
+# CONFIG_PROC_MEM_NO_FORCE is not set
+# CONFIG_XZ_DEC_ARM64 is not set
+# CONFIG_XZ_DEC_RISCV is not set
+# CONFIG_TEST_MULDIV64 is not set
+# CONFIG_ARM64_POE is not set
+# CONFIG_MFD_ADP5585 is not set
+# CONFIG_ARM_NI is not set
+# CONFIG_NVMEM_LAYOUT_U_BOOT_ENV is not set
+# CONFIG_NET_DSA_MV88E6XXX_LEDS is not set
+# CONFIG_OF_PARTITION is not set
+# CONFIG_HISILICON_ERRATUM_162100801 is not set
+# CONFIG_IMX_SCMI_MISC_DRV is not set
+# CONFIG_VIDEO_TW9900 is not set
+# CONFIG_SND_UTIMER is not set
+# CONFIG_SND_SOC_AK4619 is not set
+# CONFIG_SND_SOC_AW87390 is not set
+# CONFIG_SND_SOC_AW88399 is not set
+# CONFIG_SND_SOC_CS530X_I2C is not set
+# CONFIG_SND_SOC_ES8311 is not set
+# CONFIG_SND_SOC_PCM6240 is not set
+# CONFIG_SND_SOC_RTQ9128 is not set
+# CONFIG_SND_SOC_MT6357 is not set
+# CONFIG_INTEL_MEI_VSC_HW is not set
+# CONFIG_IMX_SCMI_MISC_DRV is not set
+# CONFIG_DRM_DISPLAY_DP_AUX_CEC is not set
+# CONFIG_BATTERY_PM8916_BMS_VM is not set
+# CONFIG_CHARGER_PM8916_LBC is not set
+# CONFIG_QCOM_PD_MAPPER is not set
+# CONFIG_QCOM_PMIC_PDCHARGER_ULOG is not set
+# CONFIG_QCOM_PBS is not set
+# CONFIG_CRYPTO_DEV_QCOM_RNG is not set
+# CONFIG_DRM_DISPLAY_DP_AUX_CHARDEV is not set
+# CONFIG_VIDEO_SOLO6X10 is not set
+# CONFIG_DRM_I915_REPLAY_GPU_HANGS_API is not set
+# CONFIG_DRM_I915_DEBUG_WAKEREF is not set
+# CONFIG_VIDEO_TW5864 is not set
+# CONFIG_VIDEO_TW68 is not set
+# CONFIG_MSI_WMI_PLATFORM is not set
+# CONFIG_INSPUR_PLATFORM_PROFILE is not set
+# CONFIG_LENOVO_WMI_CAMERA is not set
+# CONFIG_IMX_SCMI_MISC_DRV is not set
+# CONFIG_NVMEM_LAYOUT_ASCII_ENV is not set
diff --git a/6.12/target/linux/generic/files/Documentation/devicetree/bindings/mtd/partitions/openwrt,uimage.yaml b/6.12/target/linux/generic/files/Documentation/devicetree/bindings/mtd/partitions/openwrt,uimage.yaml
new file mode 100644
index 00000000..d052ab1f
--- /dev/null
+++ b/6.12/target/linux/generic/files/Documentation/devicetree/bindings/mtd/partitions/openwrt,uimage.yaml
@@ -0,0 +1,91 @@
+# SPDX-License-Identifier: GPL-2.0-only OR BSD-2-Clause
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/mtd/partitions/openwrt,uimage.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: OpenWrt variations of U-Boot Image partitions
+
+maintainers:
+  - Bjørn Mork <bjorn@mork.no>
+
+description: |
+  The image format defined by the boot loader "Das U-Boot" is often
+  modified or extended by device vendors. This defines a few optional
+  properties which can be used to describe such modifications.
+
+# partition.txt defines common properties, but has not yet been
+# converted to YAML
+#allOf:
+#  - $ref: ../partition.yaml#
+
+properties:
+  compatible:
+    items:
+      - enum:
+          - openwrt,uimage
+      - const: denx,uimage
+
+  openwrt,padding:
+    description: Number of padding bytes between header and data
+    $ref: /schemas/types.yaml#/definitions/uint32
+    default: 0
+
+  openwrt,ih-magic:
+    description: U-Boot Image Header magic number.
+    $ref: /schemas/types.yaml#/definitions/uint32
+    default: 0x27051956 # IH_MAGIC
+
+  openwrt,ih-type:
+    description: U-Boot Image type
+    $ref: /schemas/types.yaml#/definitions/uint32
+    default: 2 # IH_TYPE_KERNEL
+
+  openwrt,offset:
+    description:
+      Offset between partition start and U-Boot Image in bytes
+    $ref: /schemas/types.yaml#/definitions/uint32
+    default: 0
+
+  openwrt,partition-magic:
+    description:
+      Magic number found at the start of the partition. Will only be
+      validated if both this property and openwrt,offset is non-zero
+    $ref: /schemas/types.yaml#/definitions/uint32
+    default: 0
+
+required:
+  - compatible
+  - reg
+
+#unevaluatedProperties: false
+additionalProperties: false
+
+examples:
+  - |
+    // device with non-default magic
+    partition@300000 {
+          compatible = "openwrt,uimage", "denx,uimage";
+          reg = <0x00300000 0xe80000>;
+          label = "firmware";
+          openwrt,ih-magic = <0x4e474520>;
+    };
+  - |
+    // device with U-Boot Image at an offset, with a partition magic value
+    partition@70000 {
+          compatible = "openwrt,uimage", "denx,uimage";
+          reg = <0x00070000 0x00790000>;
+          label = "firmware";
+          openwrt,offset = <20>;
+          openwrt,partition-magic = <0x43535953>;
+    };
+  - |
+    // device using a non-default image type
+    #include "dt-bindings/mtd/partitions/uimage.h"
+    partition@6c0000 {
+          compatible = "openwrt,uimage", "denx,uimage";
+          reg = <0x6c0000 0x1900000>;
+          label = "firmware";
+          openwrt,ih-magic = <0x33373033>;
+          openwrt,ih-type = <IH_TYPE_FILESYSTEM>;
+    };
diff --git a/6.12/target/linux/generic/files/Documentation/networking/adm6996.txt b/6.12/target/linux/generic/files/Documentation/networking/adm6996.txt
new file mode 100644
index 00000000..ab59f1df
--- /dev/null
+++ b/6.12/target/linux/generic/files/Documentation/networking/adm6996.txt
@@ -0,0 +1,110 @@
+------- 
+
+ADM6996FC / ADM6996M switch chip driver
+
+
+1. General information
+
+  This driver supports the FC and M models only. The ADM6996F and L are
+  completely different chips.
+  
+  Support for the FC model is extremely limited at the moment. There is no VLAN
+  support as of yet. The driver will not offer an swconfig interface for the FC
+  chip.
+ 
+1.1 VLAN IDs
+
+  It is possible to define 16 different VLANs. Every VLAN has an identifier, its
+  VLAN ID. It is easiest if you use at most VLAN IDs 0-15. In that case, the
+  swconfig based configuration is very straightforward. To define two VLANs with
+  IDs 4 and 5, you can invoke, for example:
+  
+      # swconfig dev ethX vlan 4 set ports '0 1t 2 5t' 
+      # swconfig dev ethX vlan 5 set ports '0t 1t 5t'
+  
+  The swconfig framework will automatically invoke 'port Y set pvid Z' for every
+  port that is an untagged member of VLAN Y, setting its Primary VLAN ID. In
+  this example, ports 0 and 2 would get "pvid 4". The Primary VLAN ID of a port
+  is the VLAN ID associated with untagged packets coming in on that port.
+  
+  But if you wish to use VLAN IDs outside the range 0-15, this automatic
+  behaviour of the swconfig framework becomes a problem. The 16 VLANs that
+  swconfig can configure on the ADM6996 also have a "vid" setting. By default,
+  this is the same as the number of the VLAN entry, to make the simple behaviour
+  above possible. To still support a VLAN with a VLAN ID higher than 15
+  (presumably because you are in a network where such VLAN IDs are already in
+  use), you can change the "vid" setting of the VLAN to anything in the range
+  0-1023. But suppose you did the following:
+  
+      # swconfig dev ethX vlan 0 set vid 998 
+      # swconfig dev ethX vlan 0 set ports '0 2 5t'
+ 
+  Now the swconfig framework will issue 'port 0 set pvid 0' and 'port 2 set pvid
+  0'. But the "pvid" should be set to 998, so you are responsible for manually
+  fixing this!
+
+1.2 VLAN filtering
+
+  The switch is configured to apply source port filtering. This means that
+  packets are only accepted when the port the packets came in on is a member of
+  the VLAN the packet should go to.
+
+  Only membership of a VLAN is tested, it does not matter whether it is a tagged
+  or untagged membership.
+
+  For untagged packets, the destination VLAN is the Primary VLAN ID of the
+  incoming port. So if the PVID of a port is 0, but that port is not a member of
+  the VLAN with ID 0, this means that untagged packets on that port are dropped.
+  This can be used as a roundabout way of dropping untagged packets from a port,
+  a mode often referred to as "Admit only tagged packets".
+
+1.3 Reset
+
+  The two supported chip models do not have a sofware-initiated reset. When the
+  driver is initialised, as well as when the 'reset' swconfig option is invoked,
+  the driver will set those registers it knows about and supports to the correct
+  default value. But there are a lot of registers in the chip that the driver
+  does not support. If something changed those registers, invoking 'reset' or
+  performing a warm reboot might still leave the chip in a "broken" state. Only
+  a hardware reset will bring it back in the default state.
+
+2. Technical details on PHYs and the ADM6996
+
+  From the viewpoint of the Linux kernel, it is common that an Ethernet adapter
+  can be seen as a separate MAC entity and a separate PHY entity. The PHY entity
+  can be queried and set through registers accessible via an MDIO bus. A PHY
+  normally has a single address on that bus, in the range 0 through 31.
+
+  The ADM6996 has special-purpose registers in the range of PHYs 0 through 10.
+  Even though all these registers control a single ADM6996 chip, the Linux
+  kernel treats this as 11 separate PHYs.  The driver will bind to these
+  addresses to prevent a different PHY driver from binding and corrupting these
+  registers.
+
+  What Linux sees as the PHY on address 0 is meant for the Ethernet MAC
+  connected to the CPU port of the ADM6996 switch chip (port 5). This is the
+  Ethernet MAC you will use to send and receive data through the switch.
+
+  The PHYs at addresses 16 through 20 map to the PHYs on ports 0 through 4 of
+  the switch chip. These can be accessed with the Generic PHY driver, as the
+  registers have the common layout.
+
+  If a second Ethernet MAC on your board is wired to the port 4 PHY, that MAC
+  needs to bind to PHY address 20 for the port to work correctly.
+
+  The ADM6996 switch driver will reset the ports 0 through 3 on startup and when
+  'reset' is invoked. This could clash with a different PHY driver if the kernel
+  binds a PHY driver to address 16 through 19.
+
+  If Linux binds a PHY on addresses 1 through 10 to an Ethernet MAC, the ADM6996
+  driver will simply always report a connected 100 Mbit/s full-duplex link for
+  that PHY, and provide no other functionality. This is most likely not what you
+  want. So if you see a message in your log
+
+  	ethX: PHY overlaps ADM6996, providing fixed PHY yy.
+
+  This is most likely an indication that ethX will not work properly, and your
+  kernel needs to be configured to attach a different PHY to that Ethernet MAC.
+
+  Controlling the mapping between MACs and PHYs is usually done in platform- or
+  board-specific fixup code. The ADM6996 driver has no influence over this.
diff --git a/6.12/target/linux/generic/files/arch/mips/fw/myloader/Makefile b/6.12/target/linux/generic/files/arch/mips/fw/myloader/Makefile
new file mode 100644
index 00000000..34acfd01
--- /dev/null
+++ b/6.12/target/linux/generic/files/arch/mips/fw/myloader/Makefile
@@ -0,0 +1,5 @@
+#
+# Makefile for the Compex's MyLoader support on MIPS architecture
+#
+
+lib-y += myloader.o
diff --git a/6.12/target/linux/generic/files/arch/mips/fw/myloader/myloader.c b/6.12/target/linux/generic/files/arch/mips/fw/myloader/myloader.c
new file mode 100644
index 00000000..a26f9ad3
--- /dev/null
+++ b/6.12/target/linux/generic/files/arch/mips/fw/myloader/myloader.c
@@ -0,0 +1,63 @@
+/*
+ *  Compex's MyLoader specific prom routines
+ *
+ *  Copyright (C) 2007-2008 Gabor Juhos <juhosg@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/types.h>
+#include <linux/string.h>
+
+#include <asm/addrspace.h>
+#include <asm/fw/myloader/myloader.h>
+
+#define SYS_PARAMS_ADDR		KSEG1ADDR(0x80000800)
+#define BOARD_PARAMS_ADDR	KSEG1ADDR(0x80000A00)
+#define PART_TABLE_ADDR		KSEG1ADDR(0x80000C00)
+#define BOOT_PARAMS_ADDR	KSEG1ADDR(0x80000E00)
+
+static struct myloader_info myloader_info __initdata;
+static int myloader_found __initdata;
+
+struct myloader_info * __init myloader_get_info(void)
+{
+	struct mylo_system_params *sysp;
+	struct mylo_board_params *boardp;
+	struct mylo_partition_table *parts;
+
+	if (myloader_found)
+		return &myloader_info;
+
+	sysp = (struct mylo_system_params *)(SYS_PARAMS_ADDR);
+	boardp = (struct mylo_board_params *)(BOARD_PARAMS_ADDR);
+	parts = (struct mylo_partition_table *)(PART_TABLE_ADDR);
+
+	printk(KERN_DEBUG "MyLoader: sysp=%08x, boardp=%08x, parts=%08x\n",
+		sysp->magic, boardp->magic, parts->magic);
+
+	/* Check for some magic numbers */
+	if (sysp->magic != MYLO_MAGIC_SYS_PARAMS ||
+	    boardp->magic != MYLO_MAGIC_BOARD_PARAMS ||
+	    le32_to_cpu(parts->magic) != MYLO_MAGIC_PARTITIONS)
+		return NULL;
+
+	printk(KERN_DEBUG "MyLoader: id=%04x:%04x, sub_id=%04x:%04x\n",
+		sysp->vid, sysp->did, sysp->svid, sysp->sdid);
+
+	myloader_info.vid = sysp->vid;
+	myloader_info.did = sysp->did;
+	myloader_info.svid = sysp->svid;
+	myloader_info.sdid = sysp->sdid;
+
+	memcpy(myloader_info.macs, boardp->addr, sizeof(myloader_info.macs));
+
+	myloader_found = 1;
+
+	return &myloader_info;
+}
diff --git a/6.12/target/linux/generic/files/drivers/bcma/fallback-sprom.c b/6.12/target/linux/generic/files/drivers/bcma/fallback-sprom.c
new file mode 100644
index 00000000..6932c3c8
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/bcma/fallback-sprom.c
@@ -0,0 +1,534 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * BCMA Fallback SPROM Driver
+ *
+ * Copyright (C) 2020 Álvaro Fernández Rojas <noltari@gmail.com>
+ * Copyright (C) 2014 Jonas Gorski <jonas.gorski@gmail.com>
+ * Copyright (C) 2008 Maxime Bizon <mbizon@freebox.fr>
+ * Copyright (C) 2008 Florian Fainelli <f.fainelli@gmail.com>
+ */
+
+#include <linux/bcma/bcma.h>
+#include <linux/etherdevice.h>
+#include <linux/firmware.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/mtd/mtd.h>
+#include <linux/of_net.h>
+#include <linux/of_platform.h>
+#include "fallback-sprom.h"
+
+#define BCMA_FBS_MAX_SIZE 468
+
+/* SPROM Extraction */
+#define SPOFF(offset)	((offset) / sizeof(u16))
+
+#define SPEX(_outvar, _offset, _mask, _shift)	\
+	out->_outvar = ((in[SPOFF(_offset)] & (_mask)) >> (_shift))
+
+#define SPEX32(_outvar, _offset, _mask, _shift)	\
+	out->_outvar = ((((u32)in[SPOFF((_offset)+2)] << 16 | \
+			   in[SPOFF(_offset)]) & (_mask)) >> (_shift))
+
+#define SPEX_ARRAY8(_field, _offset, _mask, _shift)	\
+	do {	\
+		SPEX(_field[0], _offset +  0, _mask, _shift);	\
+		SPEX(_field[1], _offset +  2, _mask, _shift);	\
+		SPEX(_field[2], _offset +  4, _mask, _shift);	\
+		SPEX(_field[3], _offset +  6, _mask, _shift);	\
+		SPEX(_field[4], _offset +  8, _mask, _shift);	\
+		SPEX(_field[5], _offset + 10, _mask, _shift);	\
+		SPEX(_field[6], _offset + 12, _mask, _shift);	\
+		SPEX(_field[7], _offset + 14, _mask, _shift);	\
+	} while (0)
+
+struct bcma_fbs {
+	struct device *dev;
+	struct list_head list;
+	struct ssb_sprom sprom;
+	u32 pci_bus;
+	u32 pci_dev;
+	bool devid_override;
+};
+
+static DEFINE_SPINLOCK(bcma_fbs_lock);
+static struct list_head bcma_fbs_list = LIST_HEAD_INIT(bcma_fbs_list);
+
+int bcma_get_fallback_sprom(struct bcma_bus *bus, struct ssb_sprom *out)
+{
+	struct bcma_fbs *pos;
+	u32 pci_bus, pci_dev;
+
+	if (bus->hosttype != BCMA_HOSTTYPE_PCI)
+		return -ENOENT;
+
+	pci_bus = bus->host_pci->bus->number;
+	pci_dev = PCI_SLOT(bus->host_pci->devfn);
+
+	list_for_each_entry(pos, &bcma_fbs_list, list) {
+		if (pos->pci_bus != pci_bus ||
+		    pos->pci_dev != pci_dev)
+		    	continue;
+
+		if (pos->devid_override)
+			bus->host_pci->device = pos->sprom.dev_id;
+
+		memcpy(out, &pos->sprom, sizeof(struct ssb_sprom));
+		dev_info(pos->dev, "requested by [%x:%x]",
+			 pos->pci_bus, pos->pci_dev);
+
+		return 0;
+	}
+
+	pr_err("unable to fill SPROM for [%x:%x]\n", pci_bus, pci_dev);
+
+	return -EINVAL;
+}
+
+static s8 sprom_extract_antgain(const u16 *in, u16 offset, u16 mask, u16 shift)
+{
+	u16 v;
+	u8 gain;
+
+	v = in[SPOFF(offset)];
+	gain = (v & mask) >> shift;
+	if (gain == 0xFF) {
+		gain = 8; /* If unset use 2dBm */
+	} else {
+		/* Q5.2 Fractional part is stored in 0xC0 */
+		gain = ((gain & 0xC0) >> 6) | ((gain & 0x3F) << 2);
+	}
+
+	return (s8)gain;
+}
+
+static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
+{
+	static const u16 pwr_info_offset[] = {
+		SSB_SROM8_PWR_INFO_CORE0, SSB_SROM8_PWR_INFO_CORE1,
+		SSB_SROM8_PWR_INFO_CORE2, SSB_SROM8_PWR_INFO_CORE3
+	};
+	u16 o;
+	int i;
+
+	BUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) !=
+		     ARRAY_SIZE(out->core_pwr_info));
+
+	SPEX(board_rev, SSB_SPROM8_BOARDREV, ~0, 0);
+	SPEX(board_type, SSB_SPROM1_SPID, ~0, 0);
+
+	SPEX(txpid2g[0], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G0,
+	     SSB_SPROM4_TXPID2G0_SHIFT);
+	SPEX(txpid2g[1], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G1,
+	     SSB_SPROM4_TXPID2G1_SHIFT);
+	SPEX(txpid2g[2], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G2,
+	     SSB_SPROM4_TXPID2G2_SHIFT);
+	SPEX(txpid2g[3], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G3,
+	     SSB_SPROM4_TXPID2G3_SHIFT);
+
+	SPEX(txpid5gl[0], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL0,
+	     SSB_SPROM4_TXPID5GL0_SHIFT);
+	SPEX(txpid5gl[1], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL1,
+	     SSB_SPROM4_TXPID5GL1_SHIFT);
+	SPEX(txpid5gl[2], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL2,
+	     SSB_SPROM4_TXPID5GL2_SHIFT);
+	SPEX(txpid5gl[3], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL3,
+	     SSB_SPROM4_TXPID5GL3_SHIFT);
+
+	SPEX(txpid5g[0], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G0,
+	     SSB_SPROM4_TXPID5G0_SHIFT);
+	SPEX(txpid5g[1], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G1,
+	     SSB_SPROM4_TXPID5G1_SHIFT);
+	SPEX(txpid5g[2], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G2,
+	     SSB_SPROM4_TXPID5G2_SHIFT);
+	SPEX(txpid5g[3], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G3,
+	     SSB_SPROM4_TXPID5G3_SHIFT);
+
+	SPEX(txpid5gh[0], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH0,
+	     SSB_SPROM4_TXPID5GH0_SHIFT);
+	SPEX(txpid5gh[1], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH1,
+	     SSB_SPROM4_TXPID5GH1_SHIFT);
+	SPEX(txpid5gh[2], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH2,
+	     SSB_SPROM4_TXPID5GH2_SHIFT);
+	SPEX(txpid5gh[3], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH3,
+	     SSB_SPROM4_TXPID5GH3_SHIFT);
+
+	SPEX(boardflags_lo, SSB_SPROM8_BFLLO, ~0, 0);
+	SPEX(boardflags_hi, SSB_SPROM8_BFLHI, ~0, 0);
+	SPEX(boardflags2_lo, SSB_SPROM8_BFL2LO, ~0, 0);
+	SPEX(boardflags2_hi, SSB_SPROM8_BFL2HI, ~0, 0);
+
+	SPEX(alpha2[0], SSB_SPROM8_CCODE, 0xff00, 8);
+	SPEX(alpha2[1], SSB_SPROM8_CCODE, 0x00ff, 0);
+
+	/* Extract core's power info */
+	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
+		o = pwr_info_offset[i];
+		SPEX(core_pwr_info[i].itssi_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
+			SSB_SPROM8_2G_ITSSI, SSB_SPROM8_2G_ITSSI_SHIFT);
+		SPEX(core_pwr_info[i].maxpwr_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
+			SSB_SPROM8_2G_MAXP, 0);
+
+		SPEX(core_pwr_info[i].pa_2g[0], o + SSB_SROM8_2G_PA_0, ~0, 0);
+		SPEX(core_pwr_info[i].pa_2g[1], o + SSB_SROM8_2G_PA_1, ~0, 0);
+		SPEX(core_pwr_info[i].pa_2g[2], o + SSB_SROM8_2G_PA_2, ~0, 0);
+
+		SPEX(core_pwr_info[i].itssi_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
+			SSB_SPROM8_5G_ITSSI, SSB_SPROM8_5G_ITSSI_SHIFT);
+		SPEX(core_pwr_info[i].maxpwr_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
+			SSB_SPROM8_5G_MAXP, 0);
+		SPEX(core_pwr_info[i].maxpwr_5gh, o + SSB_SPROM8_5GHL_MAXP,
+			SSB_SPROM8_5GH_MAXP, 0);
+		SPEX(core_pwr_info[i].maxpwr_5gl, o + SSB_SPROM8_5GHL_MAXP,
+			SSB_SPROM8_5GL_MAXP, SSB_SPROM8_5GL_MAXP_SHIFT);
+
+		SPEX(core_pwr_info[i].pa_5gl[0], o + SSB_SROM8_5GL_PA_0, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gl[1], o + SSB_SROM8_5GL_PA_1, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gl[2], o + SSB_SROM8_5GL_PA_2, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5g[0], o + SSB_SROM8_5G_PA_0, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5g[1], o + SSB_SROM8_5G_PA_1, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5g[2], o + SSB_SROM8_5G_PA_2, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gh[0], o + SSB_SROM8_5GH_PA_0, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gh[1], o + SSB_SROM8_5GH_PA_1, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gh[2], o + SSB_SROM8_5GH_PA_2, ~0, 0);
+	}
+
+	SPEX(fem.ghz2.tssipos, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TSSIPOS,
+	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
+	SPEX(fem.ghz2.extpa_gain, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_EXTPA_GAIN,
+	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
+	SPEX(fem.ghz2.pdet_range, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_PDET_RANGE,
+	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
+	SPEX(fem.ghz2.tr_iso, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TR_ISO,
+	     SSB_SROM8_FEM_TR_ISO_SHIFT);
+	SPEX(fem.ghz2.antswlut, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_ANTSWLUT,
+	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
+
+	SPEX(fem.ghz5.tssipos, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TSSIPOS,
+	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
+	SPEX(fem.ghz5.extpa_gain, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_EXTPA_GAIN,
+	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
+	SPEX(fem.ghz5.pdet_range, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_PDET_RANGE,
+	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
+	SPEX(fem.ghz5.tr_iso, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TR_ISO,
+	     SSB_SROM8_FEM_TR_ISO_SHIFT);
+	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_ANTSWLUT,
+	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
+
+	SPEX(ant_available_a, SSB_SPROM8_ANTAVAIL, SSB_SPROM8_ANTAVAIL_A,
+	     SSB_SPROM8_ANTAVAIL_A_SHIFT);
+	SPEX(ant_available_bg, SSB_SPROM8_ANTAVAIL, SSB_SPROM8_ANTAVAIL_BG,
+	     SSB_SPROM8_ANTAVAIL_BG_SHIFT);
+	SPEX(maxpwr_bg, SSB_SPROM8_MAXP_BG, SSB_SPROM8_MAXP_BG_MASK, 0);
+	SPEX(itssi_bg, SSB_SPROM8_MAXP_BG, SSB_SPROM8_ITSSI_BG,
+	     SSB_SPROM8_ITSSI_BG_SHIFT);
+	SPEX(maxpwr_a, SSB_SPROM8_MAXP_A, SSB_SPROM8_MAXP_A_MASK, 0);
+	SPEX(itssi_a, SSB_SPROM8_MAXP_A, SSB_SPROM8_ITSSI_A,
+	     SSB_SPROM8_ITSSI_A_SHIFT);
+	SPEX(maxpwr_ah, SSB_SPROM8_MAXP_AHL, SSB_SPROM8_MAXP_AH_MASK, 0);
+	SPEX(maxpwr_al, SSB_SPROM8_MAXP_AHL, SSB_SPROM8_MAXP_AL_MASK,
+	     SSB_SPROM8_MAXP_AL_SHIFT);
+	SPEX(gpio0, SSB_SPROM8_GPIOA, SSB_SPROM8_GPIOA_P0, 0);
+	SPEX(gpio1, SSB_SPROM8_GPIOA, SSB_SPROM8_GPIOA_P1,
+	     SSB_SPROM8_GPIOA_P1_SHIFT);
+	SPEX(gpio2, SSB_SPROM8_GPIOB, SSB_SPROM8_GPIOB_P2, 0);
+	SPEX(gpio3, SSB_SPROM8_GPIOB, SSB_SPROM8_GPIOB_P3,
+	     SSB_SPROM8_GPIOB_P3_SHIFT);
+	SPEX(tri2g, SSB_SPROM8_TRI25G, SSB_SPROM8_TRI2G, 0);
+	SPEX(tri5g, SSB_SPROM8_TRI25G, SSB_SPROM8_TRI5G,
+	     SSB_SPROM8_TRI5G_SHIFT);
+	SPEX(tri5gl, SSB_SPROM8_TRI5GHL, SSB_SPROM8_TRI5GL, 0);
+	SPEX(tri5gh, SSB_SPROM8_TRI5GHL, SSB_SPROM8_TRI5GH,
+	     SSB_SPROM8_TRI5GH_SHIFT);
+	SPEX(rxpo2g, SSB_SPROM8_RXPO, SSB_SPROM8_RXPO2G,
+	     SSB_SPROM8_RXPO2G_SHIFT);
+	SPEX(rxpo5g, SSB_SPROM8_RXPO, SSB_SPROM8_RXPO5G,
+	     SSB_SPROM8_RXPO5G_SHIFT);
+	SPEX(rssismf2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISMF2G, 0);
+	SPEX(rssismc2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISMC2G,
+	     SSB_SPROM8_RSSISMC2G_SHIFT);
+	SPEX(rssisav2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISAV2G,
+	     SSB_SPROM8_RSSISAV2G_SHIFT);
+	SPEX(bxa2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_BXA2G,
+	     SSB_SPROM8_BXA2G_SHIFT);
+	SPEX(rssismf5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISMF5G, 0);
+	SPEX(rssismc5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISMC5G,
+	     SSB_SPROM8_RSSISMC5G_SHIFT);
+	SPEX(rssisav5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISAV5G,
+	     SSB_SPROM8_RSSISAV5G_SHIFT);
+	SPEX(bxa5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_BXA5G,
+	     SSB_SPROM8_BXA5G_SHIFT);
+
+	SPEX(pa0b0, SSB_SPROM8_PA0B0, ~0, 0);
+	SPEX(pa0b1, SSB_SPROM8_PA0B1, ~0, 0);
+	SPEX(pa0b2, SSB_SPROM8_PA0B2, ~0, 0);
+	SPEX(pa1b0, SSB_SPROM8_PA1B0, ~0, 0);
+	SPEX(pa1b1, SSB_SPROM8_PA1B1, ~0, 0);
+	SPEX(pa1b2, SSB_SPROM8_PA1B2, ~0, 0);
+	SPEX(pa1lob0, SSB_SPROM8_PA1LOB0, ~0, 0);
+	SPEX(pa1lob1, SSB_SPROM8_PA1LOB1, ~0, 0);
+	SPEX(pa1lob2, SSB_SPROM8_PA1LOB2, ~0, 0);
+	SPEX(pa1hib0, SSB_SPROM8_PA1HIB0, ~0, 0);
+	SPEX(pa1hib1, SSB_SPROM8_PA1HIB1, ~0, 0);
+	SPEX(pa1hib2, SSB_SPROM8_PA1HIB2, ~0, 0);
+	SPEX(cck2gpo, SSB_SPROM8_CCK2GPO, ~0, 0);
+	SPEX32(ofdm2gpo, SSB_SPROM8_OFDM2GPO, ~0, 0);
+	SPEX32(ofdm5glpo, SSB_SPROM8_OFDM5GLPO, ~0, 0);
+	SPEX32(ofdm5gpo, SSB_SPROM8_OFDM5GPO, ~0, 0);
+	SPEX32(ofdm5ghpo, SSB_SPROM8_OFDM5GHPO, ~0, 0);
+
+	/* Extract the antenna gain values. */
+	out->antenna_gain.a0 = sprom_extract_antgain(in,
+						     SSB_SPROM8_AGAIN01,
+						     SSB_SPROM8_AGAIN0,
+						     SSB_SPROM8_AGAIN0_SHIFT);
+	out->antenna_gain.a1 = sprom_extract_antgain(in,
+						     SSB_SPROM8_AGAIN01,
+						     SSB_SPROM8_AGAIN1,
+						     SSB_SPROM8_AGAIN1_SHIFT);
+	out->antenna_gain.a2 = sprom_extract_antgain(in,
+						     SSB_SPROM8_AGAIN23,
+						     SSB_SPROM8_AGAIN2,
+						     SSB_SPROM8_AGAIN2_SHIFT);
+	out->antenna_gain.a3 = sprom_extract_antgain(in,
+						     SSB_SPROM8_AGAIN23,
+						     SSB_SPROM8_AGAIN3,
+						     SSB_SPROM8_AGAIN3_SHIFT);
+
+	SPEX(leddc_on_time, SSB_SPROM8_LEDDC, SSB_SPROM8_LEDDC_ON,
+	     SSB_SPROM8_LEDDC_ON_SHIFT);
+	SPEX(leddc_off_time, SSB_SPROM8_LEDDC, SSB_SPROM8_LEDDC_OFF,
+	     SSB_SPROM8_LEDDC_OFF_SHIFT);
+
+	SPEX(txchain, SSB_SPROM8_TXRXC, SSB_SPROM8_TXRXC_TXCHAIN,
+	     SSB_SPROM8_TXRXC_TXCHAIN_SHIFT);
+	SPEX(rxchain, SSB_SPROM8_TXRXC, SSB_SPROM8_TXRXC_RXCHAIN,
+	     SSB_SPROM8_TXRXC_RXCHAIN_SHIFT);
+	SPEX(antswitch, SSB_SPROM8_TXRXC, SSB_SPROM8_TXRXC_SWITCH,
+	     SSB_SPROM8_TXRXC_SWITCH_SHIFT);
+
+	SPEX(opo, SSB_SPROM8_OFDM2GPO, 0x00ff, 0);
+
+	SPEX_ARRAY8(mcs2gpo, SSB_SPROM8_2G_MCSPO, ~0, 0);
+	SPEX_ARRAY8(mcs5gpo, SSB_SPROM8_5G_MCSPO, ~0, 0);
+	SPEX_ARRAY8(mcs5glpo, SSB_SPROM8_5GL_MCSPO, ~0, 0);
+	SPEX_ARRAY8(mcs5ghpo, SSB_SPROM8_5GH_MCSPO, ~0, 0);
+
+	SPEX(rawtempsense, SSB_SPROM8_RAWTS, SSB_SPROM8_RAWTS_RAWTEMP,
+	     SSB_SPROM8_RAWTS_RAWTEMP_SHIFT);
+	SPEX(measpower, SSB_SPROM8_RAWTS, SSB_SPROM8_RAWTS_MEASPOWER,
+	     SSB_SPROM8_RAWTS_MEASPOWER_SHIFT);
+	SPEX(tempsense_slope, SSB_SPROM8_OPT_CORRX,
+	     SSB_SPROM8_OPT_CORRX_TEMP_SLOPE,
+	     SSB_SPROM8_OPT_CORRX_TEMP_SLOPE_SHIFT);
+	SPEX(tempcorrx, SSB_SPROM8_OPT_CORRX, SSB_SPROM8_OPT_CORRX_TEMPCORRX,
+	     SSB_SPROM8_OPT_CORRX_TEMPCORRX_SHIFT);
+	SPEX(tempsense_option, SSB_SPROM8_OPT_CORRX,
+	     SSB_SPROM8_OPT_CORRX_TEMP_OPTION,
+	     SSB_SPROM8_OPT_CORRX_TEMP_OPTION_SHIFT);
+	SPEX(freqoffset_corr, SSB_SPROM8_HWIQ_IQSWP,
+	     SSB_SPROM8_HWIQ_IQSWP_FREQ_CORR,
+	     SSB_SPROM8_HWIQ_IQSWP_FREQ_CORR_SHIFT);
+	SPEX(iqcal_swp_dis, SSB_SPROM8_HWIQ_IQSWP,
+	     SSB_SPROM8_HWIQ_IQSWP_IQCAL_SWP,
+	     SSB_SPROM8_HWIQ_IQSWP_IQCAL_SWP_SHIFT);
+	SPEX(hw_iqcal_en, SSB_SPROM8_HWIQ_IQSWP, SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL,
+	     SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL_SHIFT);
+
+	SPEX(bw40po, SSB_SPROM8_BW40PO, ~0, 0);
+	SPEX(cddpo, SSB_SPROM8_CDDPO, ~0, 0);
+	SPEX(stbcpo, SSB_SPROM8_STBCPO, ~0, 0);
+	SPEX(bwduppo, SSB_SPROM8_BWDUPPO, ~0, 0);
+
+	SPEX(tempthresh, SSB_SPROM8_THERMAL, SSB_SPROM8_THERMAL_TRESH,
+	     SSB_SPROM8_THERMAL_TRESH_SHIFT);
+	SPEX(tempoffset, SSB_SPROM8_THERMAL, SSB_SPROM8_THERMAL_OFFSET,
+	     SSB_SPROM8_THERMAL_OFFSET_SHIFT);
+	SPEX(phycal_tempdelta, SSB_SPROM8_TEMPDELTA,
+	     SSB_SPROM8_TEMPDELTA_PHYCAL,
+	     SSB_SPROM8_TEMPDELTA_PHYCAL_SHIFT);
+	SPEX(temps_period, SSB_SPROM8_TEMPDELTA, SSB_SPROM8_TEMPDELTA_PERIOD,
+	     SSB_SPROM8_TEMPDELTA_PERIOD_SHIFT);
+	SPEX(temps_hysteresis, SSB_SPROM8_TEMPDELTA,
+	     SSB_SPROM8_TEMPDELTA_HYSTERESIS,
+	     SSB_SPROM8_TEMPDELTA_HYSTERESIS_SHIFT);
+}
+
+static int sprom_extract(struct bcma_fbs *priv, const u16 *in, u16 size)
+{
+	struct ssb_sprom *out = &priv->sprom;
+
+	memset(out, 0, sizeof(*out));
+
+	out->revision = in[size - 1] & 0x00FF;
+	if (out->revision < 8 || out->revision > 11) {
+		dev_warn(priv->dev,
+			 "Unsupported SPROM revision %d detected."
+			 " Will extract v8\n",
+			 out->revision);
+		out->revision = 8;
+	}
+
+	sprom_extract_r8(out, in);
+
+	return 0;
+}
+
+static void bcma_fbs_fixup(struct bcma_fbs *priv, u16 *sprom)
+{
+	struct device_node *node = priv->dev->of_node;
+	u32 fixups, off, val;
+	int i = 0;
+
+	if (!of_get_property(node, "brcm,sprom-fixups", &fixups))
+		return;
+
+	fixups /= sizeof(u32);
+
+	dev_info(priv->dev, "patching SPROM with %u fixups...\n", fixups >> 1);
+
+	while (i < fixups) {
+		if (of_property_read_u32_index(node, "brcm,sprom-fixups",
+					       i++, &off)) {
+			dev_err(priv->dev, "error reading fixup[%u] offset\n",
+				i - 1);
+			return;
+		}
+
+		if (of_property_read_u32_index(node, "brcm,sprom-fixups",
+					       i++, &val)) {
+			dev_err(priv->dev, "error reading fixup[%u] value\n",
+				i - 1);
+			return;
+		}
+
+		dev_dbg(priv->dev, "fixup[%d]=0x%04x\n", off, val);
+
+		sprom[off] = val;
+	}
+}
+
+static bool sprom_override_devid(struct bcma_fbs *priv, struct ssb_sprom *out,
+				 const u16 *in)
+{
+	SPEX(dev_id, 0x0060, 0xFFFF, 0);
+	return !!out->dev_id;
+}
+
+static void bcma_fbs_set(struct bcma_fbs *priv, struct device_node *node)
+{
+	struct ssb_sprom *sprom = &priv->sprom;
+	const struct firmware *fw;
+	const char *sprom_name;
+	int err;
+
+	if (of_property_read_string(node, "brcm,sprom", &sprom_name))
+		sprom_name = NULL;
+
+	if (sprom_name) {
+		err = request_firmware_direct(&fw, sprom_name, priv->dev);
+		if (err)
+			dev_err(priv->dev, "%s load error\n", sprom_name);
+	} else {
+		err = -ENOENT;
+	}
+
+	if (err) {
+		sprom->revision = 0x02;
+		sprom->board_rev = 0x0017;
+		sprom->country_code = 0x00;
+		sprom->ant_available_bg = 0x03;
+		sprom->pa0b0 = 0x15ae;
+		sprom->pa0b1 = 0xfa85;
+		sprom->pa0b2 = 0xfe8d;
+		sprom->pa1b0 = 0xffff;
+		sprom->pa1b1 = 0xffff;
+		sprom->pa1b2 = 0xffff;
+		sprom->gpio0 = 0xff;
+		sprom->gpio1 = 0xff;
+		sprom->gpio2 = 0xff;
+		sprom->gpio3 = 0xff;
+		sprom->maxpwr_bg = 0x4c;
+		sprom->itssi_bg = 0x00;
+		sprom->boardflags_lo = 0x2848;
+		sprom->boardflags_hi = 0x0000;
+		priv->devid_override = false;
+
+		dev_warn(priv->dev, "using basic SPROM\n");
+	} else {
+		size_t size = min(fw->size, (size_t) BCMA_FBS_MAX_SIZE);
+		u16 tmp_sprom[BCMA_FBS_MAX_SIZE >> 1];
+		u32 i, j;
+
+		for (i = 0, j = 0; i < size; i += 2, j++)
+			tmp_sprom[j] = (fw->data[i] << 8) | fw->data[i + 1];
+
+		release_firmware(fw);
+		bcma_fbs_fixup(priv, tmp_sprom);
+		sprom_extract(priv, tmp_sprom, size >> 1);
+
+		priv->devid_override = sprom_override_devid(priv, sprom,
+							    tmp_sprom);
+	}
+}
+
+static int bcma_fbs_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct device_node *node = dev->of_node;
+	struct bcma_fbs *priv;
+	unsigned long flags;
+	u8 mac[ETH_ALEN];
+
+	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	priv->dev = dev;
+
+	bcma_fbs_set(priv, node);
+
+	of_property_read_u32(node, "pci-bus", &priv->pci_bus);
+	of_property_read_u32(node, "pci-dev", &priv->pci_dev);
+
+	of_get_mac_address(node, mac);
+	if (is_valid_ether_addr(mac)) {
+		dev_info(dev, "mtd mac %pM\n", mac);
+	} else {
+		eth_random_addr(mac);
+		dev_info(dev, "random mac %pM\n", mac);
+	}
+
+	memcpy(priv->sprom.il0mac, mac, ETH_ALEN);
+ 	memcpy(priv->sprom.et0mac, mac, ETH_ALEN);
+ 	memcpy(priv->sprom.et1mac, mac, ETH_ALEN);
+	memcpy(priv->sprom.et2mac, mac, ETH_ALEN);
+
+	spin_lock_irqsave(&bcma_fbs_lock, flags);
+	list_add(&priv->list, &bcma_fbs_list);
+	spin_unlock_irqrestore(&bcma_fbs_lock, flags);
+
+	dev_info(dev, "registered SPROM for [%x:%x]\n",
+		 priv->pci_bus, priv->pci_dev);
+
+	return 0;
+}
+
+static const struct of_device_id bcma_fbs_of_match[] = {
+	{ .compatible = "brcm,bcma-sprom", },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, bcma_fbs_of_match);
+
+static struct platform_driver bcma_fbs_driver = {
+	.probe = bcma_fbs_probe,
+	.driver	= {
+		.name = "bcma-sprom",
+		.of_match_table = bcma_fbs_of_match,
+	},
+};
+
+int __init bcma_fbs_register(void)
+{
+	return platform_driver_register(&bcma_fbs_driver);
+}
diff --git a/6.12/target/linux/generic/files/drivers/bcma/fallback-sprom.h b/6.12/target/linux/generic/files/drivers/bcma/fallback-sprom.h
new file mode 100644
index 00000000..36366341
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/bcma/fallback-sprom.h
@@ -0,0 +1,7 @@
+#ifndef _FALLBACK_SPROM_H
+#define _FALLBACK_SPROM_H
+
+int __init bcma_fbs_register(void);
+int bcma_get_fallback_sprom(struct bcma_bus *dev, struct ssb_sprom *out);
+
+#endif /* _FALLBACK_SPROM_H */
diff --git a/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/Kconfig b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/Kconfig
new file mode 100644
index 00000000..17d59089
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/Kconfig
@@ -0,0 +1,112 @@
+config MTD_SPLIT
+	def_bool n
+	help
+	  Generic MTD split support.
+
+config MTD_SPLIT_SUPPORT
+	def_bool MTD = y
+
+comment "Rootfs partition parsers"
+
+config MTD_SPLIT_SQUASHFS_ROOT
+	bool "Squashfs based root partition parser"
+	depends on MTD_SPLIT_SUPPORT
+	select MTD_SPLIT
+	help
+	  This provides a parsing function which allows to detect the
+	  offset and size of the unused portion of a rootfs partition
+	  containing a squashfs.
+
+comment "Firmware partition parsers"
+
+config MTD_SPLIT_BCM63XX_FW
+	bool "BCM63xx firmware parser"
+	depends on MTD_SPLIT_SUPPORT
+	select MTD_SPLIT
+
+config MTD_SPLIT_BCM_WFI_FW
+	bool "Broadcom Whole Flash Image parser"
+	depends on MTD_SPLIT_SUPPORT
+	select MTD_SPLIT
+
+config MTD_SPLIT_CFE_BOOTFS
+	bool "Parser finding rootfs appended to the CFE bootfs"
+	depends on MTD_SPLIT_SUPPORT && (ARCH_BCM4908 || ARCH_BCMBCA)
+	select MTD_SPLIT
+	help
+	  cferom on BCM4908 (and bcm63xx) uses JFFS2 bootfs partition
+	  for storing kernel, cferam and some device specific files.
+	  There isn't any straight way of storing rootfs so it gets
+	  appended to the JFFS2 bootfs partition. Kernel needs to find
+	  it and run init from it. This parser is responsible for
+	  finding appended rootfs.
+
+config MTD_SPLIT_SEAMA_FW
+	bool "Seama firmware parser"
+	depends on MTD_SPLIT_SUPPORT
+	select MTD_SPLIT
+
+config MTD_SPLIT_WRGG_FW
+	bool "WRGG firmware parser"
+	depends on MTD_SPLIT_SUPPORT
+	select MTD_SPLIT
+
+config MTD_SPLIT_UIMAGE_FW
+	bool "uImage based firmware partition parser"
+	depends on MTD_SPLIT_SUPPORT
+	select MTD_SPLIT
+
+config MTD_SPLIT_FIT_FW
+	bool "FIT based firmware partition parser"
+	depends on MTD_SPLIT_SUPPORT
+	select MTD_SPLIT
+
+config MTD_SPLIT_LZMA_FW
+	bool "LZMA compressed kernel based firmware partition parser"
+	depends on MTD_SPLIT_SUPPORT
+	select MTD_SPLIT
+
+config MTD_SPLIT_TPLINK_FW
+	bool "TP-Link firmware parser"
+	depends on MTD_SPLIT_SUPPORT
+	select MTD_SPLIT
+
+config MTD_SPLIT_TRX_FW
+	bool "TRX image based firmware partition parser"
+	depends on MTD_SPLIT_SUPPORT
+	select MTD_SPLIT
+
+config MTD_SPLIT_BRNIMAGE_FW
+	bool "brnImage (brnboot image) firmware parser"
+	depends on MTD_SPLIT_SUPPORT
+	select MTD_SPLIT
+
+config MTD_SPLIT_EVA_FW
+	bool "EVA image based firmware partition parser"
+	depends on MTD_SPLIT_SUPPORT
+	select MTD_SPLIT
+
+config MTD_SPLIT_MINOR_FW
+	bool "Mikrotik NOR image based firmware partition parser"
+	depends on MTD_SPLIT_SUPPORT
+	select MTD_SPLIT
+
+config MTD_SPLIT_JIMAGE_FW
+	bool "JBOOT Image based firmware partition parser"
+	depends on MTD_SPLIT_SUPPORT
+	select MTD_SPLIT
+
+config MTD_SPLIT_ELF_FW
+	bool "ELF loader firmware partition parser"
+	depends on MTD_SPLIT_SUPPORT
+	select MTD_SPLIT
+
+config MTD_SPLIT_H3C_VFS
+	bool "Parser finding rootfs appended to H3C VFS"
+	depends on MTD_SPLIT_SUPPORT
+	select MTD_SPLIT
+
+config MTD_SPLIT_SEIL_FW
+	bool "IIJ SEIL firmware parser"
+	depends on MTD_SPLIT_SUPPORT
+	select MTD_SPLIT
diff --git a/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/Makefile b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/Makefile
new file mode 100644
index 00000000..e9d63c83
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/Makefile
@@ -0,0 +1,19 @@
+obj-$(CONFIG_MTD_SPLIT)		+= mtdsplit.o
+obj-$(CONFIG_MTD_SPLIT_BCM63XX_FW) += mtdsplit_bcm63xx.o
+obj-$(CONFIG_MTD_SPLIT_BCM_WFI_FW) += mtdsplit_bcm_wfi.o
+obj-$(CONFIG_MTD_SPLIT_CFE_BOOTFS) += mtdsplit_cfe_bootfs.o
+obj-$(CONFIG_MTD_SPLIT_SEAMA_FW) += mtdsplit_seama.o
+obj-$(CONFIG_MTD_SPLIT_SEIL_FW) += mtdsplit_seil.o
+obj-$(CONFIG_MTD_SPLIT_SQUASHFS_ROOT) += mtdsplit_squashfs.o
+obj-$(CONFIG_MTD_SPLIT_UIMAGE_FW) += mtdsplit_uimage.o
+obj-$(CONFIG_MTD_SPLIT_FIT_FW) += mtdsplit_fit.o
+obj-$(CONFIG_MTD_SPLIT_LZMA_FW) += mtdsplit_lzma.o
+obj-$(CONFIG_MTD_SPLIT_TPLINK_FW) += mtdsplit_tplink.o
+obj-$(CONFIG_MTD_SPLIT_TRX_FW) += mtdsplit_trx.o
+obj-$(CONFIG_MTD_SPLIT_BRNIMAGE_FW) += mtdsplit_brnimage.o
+obj-$(CONFIG_MTD_SPLIT_EVA_FW) += mtdsplit_eva.o
+obj-$(CONFIG_MTD_SPLIT_WRGG_FW) += mtdsplit_wrgg.o
+obj-$(CONFIG_MTD_SPLIT_MINOR_FW) += mtdsplit_minor.o
+obj-$(CONFIG_MTD_SPLIT_JIMAGE_FW) += mtdsplit_jimage.o
+obj-$(CONFIG_MTD_SPLIT_ELF_FW) += mtdsplit_elf.o
+obj-$(CONFIG_MTD_SPLIT_H3C_VFS) += mtdsplit_h3c_vfs.o
diff --git a/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit.c b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit.c
new file mode 100644
index 00000000..b2e51dcf
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit.c
@@ -0,0 +1,130 @@
+/*
+ * Copyright (C) 2009-2013 Felix Fietkau <nbd@nbd.name>
+ * Copyright (C) 2009-2013 Gabor Juhos <juhosg@openwrt.org>
+ * Copyright (C) 2012 Jonas Gorski <jogo@openwrt.org>
+ * Copyright (C) 2013 Hauke Mehrtens <hauke@hauke-m.de>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ *
+ */
+
+#define pr_fmt(fmt)	"mtdsplit: " fmt
+
+#include <linux/export.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/magic.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/byteorder/generic.h>
+
+#include "mtdsplit.h"
+
+#define UBI_EC_MAGIC			0x55424923	/* UBI# */
+
+struct squashfs_super_block {
+	__le32 s_magic;
+	__le32 pad0[9];
+	__le64 bytes_used;
+};
+
+int mtd_get_squashfs_len(struct mtd_info *master,
+			 size_t offset,
+			 size_t *squashfs_len)
+{
+	struct squashfs_super_block sb;
+	size_t retlen;
+	int err;
+
+	err = mtd_read(master, offset, sizeof(sb), &retlen, (void *)&sb);
+	if (err || (retlen != sizeof(sb))) {
+		pr_alert("error occured while reading from \"%s\"\n",
+			 master->name);
+		return -EIO;
+	}
+
+	if (le32_to_cpu(sb.s_magic) != SQUASHFS_MAGIC) {
+		pr_alert("no squashfs found in \"%s\"\n", master->name);
+		return -EINVAL;
+	}
+
+	retlen = le64_to_cpu(sb.bytes_used);
+	if (retlen <= 0) {
+		pr_alert("squashfs is empty in \"%s\"\n", master->name);
+		return -ENODEV;
+	}
+
+	if (offset + retlen > master->size) {
+		pr_alert("squashfs has invalid size in \"%s\"\n",
+			 master->name);
+		return -EINVAL;
+	}
+
+	*squashfs_len = retlen;
+	return 0;
+}
+EXPORT_SYMBOL_GPL(mtd_get_squashfs_len);
+
+static ssize_t mtd_next_eb(struct mtd_info *mtd, size_t offset)
+{
+	return mtd_rounddown_to_eb(offset, mtd) + mtd->erasesize;
+}
+
+int mtd_check_rootfs_magic(struct mtd_info *mtd, size_t offset,
+			   enum mtdsplit_part_type *type)
+{
+	u32 magic;
+	size_t retlen;
+	int ret;
+
+	ret = mtd_read(mtd, offset, sizeof(magic), &retlen,
+		       (unsigned char *) &magic);
+	if (ret)
+		return ret;
+
+	if (retlen != sizeof(magic))
+		return -EIO;
+
+	if (le32_to_cpu(magic) == SQUASHFS_MAGIC) {
+		if (type)
+			*type = MTDSPLIT_PART_TYPE_SQUASHFS;
+		return 0;
+	} else if (magic == 0x19852003) {
+		if (type)
+			*type = MTDSPLIT_PART_TYPE_JFFS2;
+		return 0;
+	} else if (be32_to_cpu(magic) == UBI_EC_MAGIC) {
+		if (type)
+			*type = MTDSPLIT_PART_TYPE_UBI;
+		return 0;
+	}
+
+	return -EINVAL;
+}
+EXPORT_SYMBOL_GPL(mtd_check_rootfs_magic);
+
+int mtd_find_rootfs_from(struct mtd_info *mtd,
+			 size_t from,
+			 size_t limit,
+			 size_t *ret_offset,
+			 enum mtdsplit_part_type *type)
+{
+	size_t offset;
+	int err;
+
+	for (offset = from; offset < limit;
+	     offset = mtd_next_eb(mtd, offset)) {
+		err = mtd_check_rootfs_magic(mtd, offset, type);
+		if (err)
+			continue;
+
+		*ret_offset = offset;
+		return 0;
+	}
+
+	return -ENODEV;
+}
+EXPORT_SYMBOL_GPL(mtd_find_rootfs_from);
+
diff --git a/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit.h b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit.h
new file mode 100644
index 00000000..71d62a89
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009-2013 Felix Fietkau <nbd@nbd.name>
+ * Copyright (C) 2009-2013 Gabor Juhos <juhosg@openwrt.org>
+ * Copyright (C) 2012 Jonas Gorski <jogo@openwrt.org>
+ * Copyright (C) 2013 Hauke Mehrtens <hauke@hauke-m.de>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ *
+ */
+
+#ifndef _MTDSPLIT_H
+#define _MTDSPLIT_H
+
+#define KERNEL_PART_NAME	"kernel"
+#define ROOTFS_PART_NAME	"rootfs"
+#define UBI_PART_NAME		"ubi"
+
+#define ROOTFS_SPLIT_NAME	"rootfs_data"
+
+enum mtdsplit_part_type {
+	MTDSPLIT_PART_TYPE_UNK = 0,
+	MTDSPLIT_PART_TYPE_SQUASHFS,
+	MTDSPLIT_PART_TYPE_JFFS2,
+	MTDSPLIT_PART_TYPE_UBI,
+};
+
+#ifdef CONFIG_MTD_SPLIT
+int mtd_get_squashfs_len(struct mtd_info *master,
+			 size_t offset,
+			 size_t *squashfs_len);
+
+int mtd_check_rootfs_magic(struct mtd_info *mtd, size_t offset,
+			   enum mtdsplit_part_type *type);
+
+int mtd_find_rootfs_from(struct mtd_info *mtd,
+			 size_t from,
+			 size_t limit,
+			 size_t *ret_offset,
+			 enum mtdsplit_part_type *type);
+
+#else
+static inline int mtd_get_squashfs_len(struct mtd_info *master,
+				       size_t offset,
+				       size_t *squashfs_len)
+{
+	return -ENODEV;
+}
+
+static inline int mtd_check_rootfs_magic(struct mtd_info *mtd, size_t offset,
+					 enum mtdsplit_part_type *type)
+{
+	return -EINVAL;
+}
+
+static inline int mtd_find_rootfs_from(struct mtd_info *mtd,
+				       size_t from,
+				       size_t limit,
+				       size_t *ret_offset,
+				       enum mtdsplit_part_type *type)
+{
+	return -ENODEV;
+}
+#endif /* CONFIG_MTD_SPLIT */
+
+#endif /* _MTDSPLIT_H */
diff --git a/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_bcm63xx.c b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_bcm63xx.c
new file mode 100644
index 00000000..3a4b8a75
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_bcm63xx.c
@@ -0,0 +1,186 @@
+/*
+ * Firmware MTD split for BCM63XX, based on bcm63xxpart.c
+ *
+ * Copyright (C) 2006-2008 Florian Fainelli <florian@openwrt.org>
+ * Copyright (C) 2006-2008 Mike Albon <malbon@openwrt.org>
+ * Copyright (C) 2009-2010 Daniel Dickinson <openwrt@cshore.neomailbox.net>
+ * Copyright (C) 2011-2013 Jonas Gorski <jonas.gorski@gmail.com>
+ * Copyright (C) 2015 Simon Arlott <simon@fire.lp0.eu>
+ * Copyright (C) 2017 Álvaro Fernández Rojas <noltari@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ *
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/bcm963xx_tag.h>
+#include <linux/crc32.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/byteorder/generic.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+
+#include "mtdsplit.h"
+
+/* Ensure strings read from flash structs are null terminated */
+#define STR_NULL_TERMINATE(x) \
+	do { char *_str = (x); _str[sizeof(x) - 1] = 0; } while (0)
+
+#define BCM63XX_NR_PARTS 2
+
+static int bcm63xx_read_image_tag(struct mtd_info *master, loff_t offset,
+				  struct bcm_tag *hdr)
+{
+	int ret;
+	size_t retlen;
+	u32 computed_crc;
+
+	ret = mtd_read(master, offset, sizeof(*hdr), &retlen, (void *) hdr);
+	if (ret)
+		return ret;
+
+	if (retlen != sizeof(*hdr))
+		return -EIO;
+
+	computed_crc = crc32_le(IMAGETAG_CRC_START, (u8 *)hdr,
+				offsetof(struct bcm_tag, header_crc));
+	if (computed_crc == hdr->header_crc) {
+	    STR_NULL_TERMINATE(hdr->board_id);
+	    STR_NULL_TERMINATE(hdr->tag_version);
+
+		pr_info("CFE image tag found at 0x%llx with version %s, "
+			"board type %s\n", offset, hdr->tag_version,
+			hdr->board_id);
+
+		return 0;
+	} else {
+		pr_err("CFE image tag at 0x%llx CRC invalid "
+		       "(expected %08x, actual %08x)\n",
+		       offset, hdr->header_crc, computed_crc);
+
+		return 1;
+	}
+}
+
+static int bcm63xx_parse_partitions(struct mtd_info *master,
+				    const struct mtd_partition **pparts,
+				    struct bcm_tag *hdr)
+{
+	struct mtd_partition *parts;
+	unsigned int flash_image_start;
+	unsigned int kernel_address;
+	unsigned int kernel_length;
+	size_t kernel_offset = 0, kernel_size = 0;
+	size_t rootfs_offset = 0, rootfs_size = 0;
+	int kernel_part, rootfs_part;
+
+	STR_NULL_TERMINATE(hdr->flash_image_start);
+	if (kstrtouint(hdr->flash_image_start, 10, &flash_image_start) ||
+	    flash_image_start < BCM963XX_EXTENDED_SIZE) {
+		pr_err("invalid rootfs address: %*ph\n",
+		       (int) sizeof(hdr->flash_image_start),
+		       hdr->flash_image_start);
+		return -EINVAL;
+	}
+
+	STR_NULL_TERMINATE(hdr->kernel_address);
+	if (kstrtouint(hdr->kernel_address, 10, &kernel_address) ||
+	    kernel_address < BCM963XX_EXTENDED_SIZE) {
+		pr_err("invalid kernel address: %*ph\n",
+		       (int) sizeof(hdr->kernel_address), hdr->kernel_address);
+		return -EINVAL;
+	}
+
+	STR_NULL_TERMINATE(hdr->kernel_length);
+	if (kstrtouint(hdr->kernel_length, 10, &kernel_length) ||
+	    !kernel_length) {
+		pr_err("invalid kernel length: %*ph\n",
+		       (int) sizeof(hdr->kernel_length), hdr->kernel_length);
+		return -EINVAL;
+	}
+
+	kernel_offset = kernel_address - BCM963XX_EXTENDED_SIZE -
+			mtdpart_get_offset(master);
+	kernel_size = kernel_length;
+
+	if (flash_image_start < kernel_address) {
+		/* rootfs first */
+		rootfs_part = 0;
+		kernel_part = 1;
+		rootfs_offset = flash_image_start - BCM963XX_EXTENDED_SIZE -
+				mtdpart_get_offset(master);
+		rootfs_size = kernel_offset - rootfs_offset;
+	} else {
+		/* kernel first */
+		kernel_part = 0;
+		rootfs_part = 1;
+		rootfs_offset = kernel_offset + kernel_size;
+		rootfs_size = master->size - rootfs_offset;
+	}
+
+	if (mtd_check_rootfs_magic(master, rootfs_offset, NULL))
+		pr_warn("rootfs magic not found\n");
+
+	parts = kzalloc(BCM63XX_NR_PARTS * sizeof(*parts), GFP_KERNEL);
+	if (!parts)
+		return -ENOMEM;
+
+	parts[kernel_part].name = KERNEL_PART_NAME;
+	parts[kernel_part].offset = kernel_offset;
+	parts[kernel_part].size = kernel_size;
+
+	parts[rootfs_part].name = ROOTFS_PART_NAME;
+	parts[rootfs_part].offset = rootfs_offset;
+	parts[rootfs_part].size = rootfs_size;
+
+	*pparts = parts;
+	return BCM63XX_NR_PARTS;
+}
+
+static int mtdsplit_parse_bcm63xx(struct mtd_info *master,
+				  const struct mtd_partition **pparts,
+				  struct mtd_part_parser_data *data)
+{
+	struct bcm_tag hdr;
+	loff_t offset;
+
+	if (mtd_type_is_nand(master))
+		return -EINVAL;
+
+	/* find bcm63xx_cfe image on erase block boundaries */
+	for (offset = 0; offset < master->size; offset += master->erasesize) {
+		if (!bcm63xx_read_image_tag(master, offset, (void *) &hdr))
+			return bcm63xx_parse_partitions(master, pparts,
+							(void *) &hdr);
+	}
+
+	return -EINVAL;
+}
+
+static const struct of_device_id mtdsplit_fit_of_match_table[] = {
+	{ .compatible = "brcm,bcm963xx-imagetag" },
+	{ },
+};
+
+static struct mtd_part_parser mtdsplit_bcm63xx_parser = {
+	.owner = THIS_MODULE,
+	.name = "bcm63xx-fw",
+	.of_match_table = mtdsplit_fit_of_match_table,
+	.parse_fn = mtdsplit_parse_bcm63xx,
+	.type = MTD_PARSER_TYPE_FIRMWARE,
+};
+
+static int __init mtdsplit_bcm63xx_init(void)
+{
+	register_mtd_parser(&mtdsplit_bcm63xx_parser);
+
+	return 0;
+}
+
+module_init(mtdsplit_bcm63xx_init);
diff --git a/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_bcm_wfi.c b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_bcm_wfi.c
new file mode 100644
index 00000000..1cafc91f
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_bcm_wfi.c
@@ -0,0 +1,535 @@
+/*
+ * MTD split for Broadcom Whole Flash Image
+ *
+ * Copyright (C) 2020 Álvaro Fernández Rojas <noltari@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ *
+ */
+
+#define je16_to_cpu(x) ((x).v16)
+#define je32_to_cpu(x) ((x).v32)
+
+#include <linux/crc32.h>
+#include <linux/init.h>
+#include <linux/jffs2.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/byteorder/generic.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+
+#include "mtdsplit.h"
+
+#define char_to_num(c)		((c >= '0' && c <= '9') ? (c - '0') : (0))
+
+#define BCM_WFI_PARTS		3
+#define BCM_WFI_SPLIT_PARTS	2
+
+#define CFERAM_NAME		"cferam"
+#define CFERAM_NAME_LEN		(sizeof(CFERAM_NAME) - 1)
+#define CFERAM_NAME_MAX_LEN	32
+#define KERNEL_NAME		"vmlinux.lz"
+#define KERNEL_NAME_LEN		(sizeof(KERNEL_NAME) - 1)
+#define OPENWRT_NAME		"1-openwrt"
+#define OPENWRT_NAME_LEN	(sizeof(OPENWRT_NAME) - 1)
+
+#define UBI_MAGIC		0x55424923
+
+#define CFE_MAGIC_PFX		"cferam."
+#define CFE_MAGIC_PFX_LEN	(sizeof(CFE_MAGIC_PFX) - 1)
+#define CFE_MAGIC		"cferam.000"
+#define CFE_MAGIC_LEN		(sizeof(CFE_MAGIC) - 1)
+#define SERCOMM_MAGIC_PFX	"eRcOmM."
+#define SERCOMM_MAGIC_PFX_LEN	(sizeof(SERCOMM_MAGIC_PFX) - 1)
+#define SERCOMM_MAGIC		"eRcOmM.000"
+#define SERCOMM_MAGIC_LEN	(sizeof(SERCOMM_MAGIC) - 1)
+
+#define PART_CFERAM		"cferam"
+#define PART_FIRMWARE		"firmware"
+#define PART_IMAGE_1		"img1"
+#define PART_IMAGE_2		"img2"
+
+static u32 jffs2_dirent_crc(struct jffs2_raw_dirent *node)
+{
+	return crc32(0, node, sizeof(struct jffs2_raw_dirent) - 8);
+}
+
+static bool jffs2_dirent_valid(struct jffs2_raw_dirent *node)
+{
+	return ((je16_to_cpu(node->magic) == JFFS2_MAGIC_BITMASK) &&
+		(je16_to_cpu(node->nodetype) == JFFS2_NODETYPE_DIRENT) &&
+		je32_to_cpu(node->ino) &&
+		je32_to_cpu(node->node_crc) == jffs2_dirent_crc(node));
+}
+
+static int jffs2_find_file(struct mtd_info *mtd, uint8_t *buf,
+			   const char *name, size_t name_len,
+			   loff_t *offs, loff_t size,
+			   char **out_name, size_t *out_name_len)
+{
+	const loff_t end = *offs + size;
+	struct jffs2_raw_dirent *node;
+	bool valid = false;
+	size_t retlen;
+	uint16_t magic;
+	int rc;
+
+	for (; *offs < end; *offs += mtd->erasesize) {
+		unsigned int block_offs = 0;
+
+		/* Skip CFE erased blocks */
+		rc = mtd_read(mtd, *offs, sizeof(magic), &retlen,
+			      (void *) &magic);
+		if (rc || retlen != sizeof(magic)) {
+			continue;
+		}
+
+		/* Skip blocks not starting with JFFS2 magic */
+		if (magic != JFFS2_MAGIC_BITMASK)
+			continue;
+
+		/* Read full block */
+		rc = mtd_read(mtd, *offs, mtd->erasesize, &retlen,
+			      (void *) buf);
+		if (rc)
+			return rc;
+		if (retlen != mtd->erasesize)
+			return -EINVAL;
+
+		while (block_offs < mtd->erasesize) {
+			node = (struct jffs2_raw_dirent *) &buf[block_offs];
+
+			if (!jffs2_dirent_valid(node)) {
+				block_offs += 4;
+				continue;
+			}
+
+			if (!memcmp(node->name, OPENWRT_NAME,
+				    OPENWRT_NAME_LEN)) {
+				valid = true;
+			} else if (!memcmp(node->name, name, name_len)) {
+				if (!valid)
+					return -EINVAL;
+
+				if (out_name)
+					*out_name = kstrndup(node->name,
+							     node->nsize,
+							     GFP_KERNEL);
+
+				if (out_name_len)
+					*out_name_len = node->nsize;
+
+				return 0;
+			}
+
+			block_offs += je32_to_cpu(node->totlen);
+			block_offs = (block_offs + 0x3) & ~0x3;
+		}
+	}
+
+	return -ENOENT;
+}
+
+static int ubifs_find(struct mtd_info *mtd, loff_t *offs, loff_t size)
+{
+	const loff_t end = *offs + size;
+	uint32_t magic;
+	size_t retlen;
+	int rc;
+
+	for (; *offs < end; *offs += mtd->erasesize) {
+		rc = mtd_read(mtd, *offs, sizeof(magic), &retlen,
+			      (unsigned char *) &magic);
+		if (rc || retlen != sizeof(magic))
+			continue;
+
+		if (be32_to_cpu(magic) == UBI_MAGIC)
+			return 0;
+	}
+
+	return -ENOENT;
+}
+
+static int parse_bcm_wfi(struct mtd_info *master,
+			 const struct mtd_partition **pparts,
+			 uint8_t *buf, loff_t off, loff_t size, bool cfe_part)
+{
+	struct device_node *mtd_node;
+	struct mtd_partition *parts;
+	loff_t cfe_off, kernel_off, rootfs_off;
+	unsigned int num_parts = BCM_WFI_PARTS, cur_part = 0;
+	const char *cferam_name = CFERAM_NAME;
+	size_t cferam_name_len;
+	int ret;
+
+	mtd_node = mtd_get_of_node(master);
+	if (mtd_node)
+		of_property_read_string(mtd_node, "brcm,cferam", &cferam_name);
+
+	cferam_name_len = strnlen(cferam_name, CFERAM_NAME_MAX_LEN);
+	if (cferam_name_len > 0)
+		cferam_name_len--;
+
+	if (cfe_part) {
+		num_parts++;
+		cfe_off = off;
+
+		ret = jffs2_find_file(master, buf, cferam_name,
+				      cferam_name_len, &cfe_off,
+				      size - (cfe_off - off), NULL, NULL);
+		if (ret)
+			return ret;
+
+		kernel_off = cfe_off + master->erasesize;
+	} else {
+		kernel_off = off;
+	}
+
+	ret = jffs2_find_file(master, buf, KERNEL_NAME, KERNEL_NAME_LEN,
+			      &kernel_off, size - (kernel_off - off),
+			      NULL, NULL);
+	if (ret)
+		return ret;
+
+	rootfs_off = kernel_off + master->erasesize;
+	ret = ubifs_find(master, &rootfs_off, size - (rootfs_off - off));
+	if (ret)
+		return ret;
+
+	parts = kzalloc(num_parts * sizeof(*parts), GFP_KERNEL);
+	if (!parts)
+		return -ENOMEM;
+
+	if (cfe_part) {
+		parts[cur_part].name = PART_CFERAM;
+		parts[cur_part].mask_flags = MTD_WRITEABLE;
+		parts[cur_part].offset = cfe_off;
+		parts[cur_part].size = kernel_off - cfe_off;
+		cur_part++;
+	}
+
+	parts[cur_part].name = PART_FIRMWARE;
+	parts[cur_part].offset = kernel_off;
+	parts[cur_part].size = size - (kernel_off - off);
+	cur_part++;
+
+	parts[cur_part].name = KERNEL_PART_NAME;
+	parts[cur_part].offset = kernel_off;
+	parts[cur_part].size = rootfs_off - kernel_off;
+	cur_part++;
+
+	parts[cur_part].name = UBI_PART_NAME;
+	parts[cur_part].offset = rootfs_off;
+	parts[cur_part].size = size - (rootfs_off - off);
+	cur_part++;
+
+	*pparts = parts;
+
+	return num_parts;
+}
+
+static int mtdsplit_parse_bcm_wfi(struct mtd_info *master,
+				  const struct mtd_partition **pparts,
+				  struct mtd_part_parser_data *data)
+{
+	struct device_node *mtd_node;
+	bool cfe_part = true;
+	uint8_t *buf;
+	int ret;
+
+	mtd_node = mtd_get_of_node(master);
+	if (!mtd_node)
+		return -EINVAL;
+
+	buf = kzalloc(master->erasesize, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	if (of_property_read_bool(mtd_node, "brcm,no-cferam"))
+		cfe_part = false;
+
+	ret = parse_bcm_wfi(master, pparts, buf, 0, master->size, cfe_part);
+
+	kfree(buf);
+
+	return ret;
+}
+
+static const struct of_device_id mtdsplit_bcm_wfi_of_match[] = {
+	{ .compatible = "brcm,wfi" },
+	{ },
+};
+
+static struct mtd_part_parser mtdsplit_bcm_wfi_parser = {
+	.owner = THIS_MODULE,
+	.name = "bcm-wfi-fw",
+	.of_match_table = mtdsplit_bcm_wfi_of_match,
+	.parse_fn = mtdsplit_parse_bcm_wfi,
+	.type = MTD_PARSER_TYPE_FIRMWARE,
+};
+
+static int cferam_bootflag_value(const char *name, size_t name_len)
+{
+	int rc = -ENOENT;
+
+	if (name &&
+	    (name_len >= CFE_MAGIC_LEN) &&
+	    !memcmp(name, CFE_MAGIC_PFX, CFE_MAGIC_PFX_LEN)) {
+		rc = char_to_num(name[CFE_MAGIC_PFX_LEN + 0]) * 100;
+		rc += char_to_num(name[CFE_MAGIC_PFX_LEN + 1]) * 10;
+		rc += char_to_num(name[CFE_MAGIC_PFX_LEN + 2]) * 1;
+	}
+
+	return rc;
+}
+
+static int mtdsplit_parse_bcm_wfi_split(struct mtd_info *master,
+					const struct mtd_partition **pparts,
+					struct mtd_part_parser_data *data)
+{
+	struct mtd_partition *parts;
+	loff_t cfe_off;
+	loff_t img1_off = 0;
+	loff_t img2_off = master->size / 2;
+	loff_t img1_size = (img2_off - img1_off);
+	loff_t img2_size = (master->size - img2_off);
+	loff_t active_off, inactive_off;
+	loff_t active_size, inactive_size;
+	const char *inactive_name;
+	uint8_t *buf;
+	char *cfe1_name = NULL, *cfe2_name = NULL;
+	size_t cfe1_size = 0, cfe2_size = 0;
+	int ret;
+	int bf1, bf2;
+
+	buf = kzalloc(master->erasesize, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	cfe_off = img1_off;
+	ret = jffs2_find_file(master, buf, CFERAM_NAME, CFERAM_NAME_LEN,
+			      &cfe_off, img1_size, &cfe1_name, &cfe1_size);
+
+	cfe_off = img2_off;
+	ret = jffs2_find_file(master, buf, CFERAM_NAME, CFERAM_NAME_LEN,
+			      &cfe_off, img2_size, &cfe2_name, &cfe2_size);
+
+	bf1 = cferam_bootflag_value(cfe1_name, cfe1_size);
+	if (bf1 >= 0)
+		printk("cferam: bootflag1=%d\n", bf1);
+
+	bf2 = cferam_bootflag_value(cfe2_name, cfe2_size);
+	if (bf2 >= 0)
+		printk("cferam: bootflag2=%d\n", bf2);
+
+	kfree(cfe1_name);
+	kfree(cfe2_name);
+
+	if (bf1 >= bf2) {
+		active_off = img1_off;
+		active_size = img1_size;
+		inactive_off = img2_off;
+		inactive_size = img2_size;
+		inactive_name = PART_IMAGE_2;
+	} else {
+		active_off = img2_off;
+		active_size = img2_size;
+		inactive_off = img1_off;
+		inactive_size = img1_size;
+		inactive_name = PART_IMAGE_1;
+	}
+
+	ret = parse_bcm_wfi(master, pparts, buf, active_off, active_size, true);
+
+	kfree(buf);
+
+	if (ret > 0) {
+		parts = kzalloc((ret + 1) * sizeof(*parts), GFP_KERNEL);
+		if (!parts)
+			return -ENOMEM;
+
+		memcpy(parts, *pparts, ret * sizeof(*parts));
+		kfree(*pparts);
+
+		parts[ret].name = inactive_name;
+		parts[ret].offset = inactive_off;
+		parts[ret].size = inactive_size;
+		ret++;
+
+		*pparts = parts;
+	} else {
+		parts = kzalloc(BCM_WFI_SPLIT_PARTS * sizeof(*parts), GFP_KERNEL);
+
+		parts[0].name = PART_IMAGE_1;
+		parts[0].offset = img1_off;
+		parts[0].size = img1_size;
+
+		parts[1].name = PART_IMAGE_2;
+		parts[1].offset = img2_off;
+		parts[1].size = img2_size;
+
+		*pparts = parts;
+	}
+
+	return ret;
+}
+
+static const struct of_device_id mtdsplit_bcm_wfi_split_of_match[] = {
+	{ .compatible = "brcm,wfi-split" },
+	{ },
+};
+
+static struct mtd_part_parser mtdsplit_bcm_wfi_split_parser = {
+	.owner = THIS_MODULE,
+	.name = "bcm-wfi-split-fw",
+	.of_match_table = mtdsplit_bcm_wfi_split_of_match,
+	.parse_fn = mtdsplit_parse_bcm_wfi_split,
+	.type = MTD_PARSER_TYPE_FIRMWARE,
+};
+
+static int sercomm_bootflag_value(struct mtd_info *mtd, uint8_t *buf)
+{
+	size_t retlen;
+	loff_t offs;
+	int rc;
+
+	for (offs = 0; offs < mtd->size; offs += mtd->erasesize) {
+		rc = mtd_read(mtd, offs, SERCOMM_MAGIC_LEN, &retlen, buf);
+		if (rc || retlen != SERCOMM_MAGIC_LEN)
+			continue;
+
+		if (memcmp(buf, SERCOMM_MAGIC_PFX, SERCOMM_MAGIC_PFX_LEN))
+			continue;
+
+		rc = char_to_num(buf[SERCOMM_MAGIC_PFX_LEN + 0]) * 100;
+		rc += char_to_num(buf[SERCOMM_MAGIC_PFX_LEN + 1]) * 10;
+		rc += char_to_num(buf[SERCOMM_MAGIC_PFX_LEN + 2]) * 1;
+
+		return rc;
+	}
+
+	return -ENOENT;
+}
+
+static int mtdsplit_parse_ser_wfi(struct mtd_info *master,
+				  const struct mtd_partition **pparts,
+				  struct mtd_part_parser_data *data)
+{
+	struct mtd_partition *parts;
+	struct mtd_info *mtd_bf1, *mtd_bf2;
+	loff_t img1_off = 0;
+	loff_t img2_off = master->size / 2;
+	loff_t img1_size = (img2_off - img1_off);
+	loff_t img2_size = (master->size - img2_off);
+	loff_t active_off, inactive_off;
+	loff_t active_size, inactive_size;
+	const char *inactive_name;
+	uint8_t *buf;
+	int bf1, bf2;
+	int ret;
+
+	mtd_bf1 = get_mtd_device_nm("bootflag1");
+	if (IS_ERR(mtd_bf1))
+		return -ENOENT;
+
+	mtd_bf2 = get_mtd_device_nm("bootflag2");
+	if (IS_ERR(mtd_bf2))
+		return -ENOENT;
+
+	buf = kzalloc(master->erasesize, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	bf1 = sercomm_bootflag_value(mtd_bf1, buf);
+	if (bf1 >= 0)
+		printk("sercomm: bootflag1=%d\n", bf1);
+
+	bf2 = sercomm_bootflag_value(mtd_bf2, buf);
+	if (bf2 >= 0)
+		printk("sercomm: bootflag2=%d\n", bf2);
+
+	if (bf1 == bf2 && bf2 >= 0) {
+		struct erase_info bf_erase;
+
+		bf2 = -ENOENT;
+		bf_erase.addr = 0;
+		bf_erase.len = mtd_bf2->size;
+		mtd_erase(mtd_bf2, &bf_erase);
+	}
+
+	if (bf1 >= bf2) {
+		active_off = img1_off;
+		active_size = img1_size;
+		inactive_off = img2_off;
+		inactive_size = img2_size;
+		inactive_name = PART_IMAGE_2;
+	} else {
+		active_off = img2_off;
+		active_size = img2_size;
+		inactive_off = img1_off;
+		inactive_size = img1_size;
+		inactive_name = PART_IMAGE_1;
+	}
+
+	ret = parse_bcm_wfi(master, pparts, buf, active_off, active_size, false);
+
+	kfree(buf);
+
+	if (ret > 0) {
+		parts = kzalloc((ret + 1) * sizeof(*parts), GFP_KERNEL);
+		if (!parts)
+			return -ENOMEM;
+
+		memcpy(parts, *pparts, ret * sizeof(*parts));
+		kfree(*pparts);
+
+		parts[ret].name = inactive_name;
+		parts[ret].offset = inactive_off;
+		parts[ret].size = inactive_size;
+		ret++;
+
+		*pparts = parts;
+	} else {
+		parts = kzalloc(BCM_WFI_SPLIT_PARTS * sizeof(*parts), GFP_KERNEL);
+
+		parts[0].name = PART_IMAGE_1;
+		parts[0].offset = img1_off;
+		parts[0].size = img1_size;
+
+		parts[1].name = PART_IMAGE_2;
+		parts[1].offset = img2_off;
+		parts[1].size = img2_size;
+
+		*pparts = parts;
+	}
+
+	return ret;
+}
+
+static const struct of_device_id mtdsplit_ser_wfi_of_match[] = {
+	{ .compatible = "sercomm,wfi" },
+	{ },
+};
+
+static struct mtd_part_parser mtdsplit_ser_wfi_parser = {
+	.owner = THIS_MODULE,
+	.name = "ser-wfi-fw",
+	.of_match_table = mtdsplit_ser_wfi_of_match,
+	.parse_fn = mtdsplit_parse_ser_wfi,
+	.type = MTD_PARSER_TYPE_FIRMWARE,
+};
+
+static int __init mtdsplit_bcm_wfi_init(void)
+{
+	register_mtd_parser(&mtdsplit_bcm_wfi_parser);
+	register_mtd_parser(&mtdsplit_bcm_wfi_split_parser);
+	register_mtd_parser(&mtdsplit_ser_wfi_parser);
+
+	return 0;
+}
+
+module_init(mtdsplit_bcm_wfi_init);
diff --git a/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_brnimage.c b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_brnimage.c
new file mode 100644
index 00000000..3f2d7960
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_brnimage.c
@@ -0,0 +1,104 @@
+/*
+ *  Copyright (C) 2012 John Crispin <blogic@openwrt.org>
+ *  Copyright (C) 2015 Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/byteorder/generic.h>
+
+#include "mtdsplit.h"
+
+#define BRNIMAGE_NR_PARTS	2
+
+#define BRNIMAGE_ALIGN_BYTES	0x400
+#define BRNIMAGE_FOOTER_SIZE	12
+
+#define BRNIMAGE_MIN_OVERHEAD	(BRNIMAGE_FOOTER_SIZE)
+#define BRNIMAGE_MAX_OVERHEAD	(BRNIMAGE_ALIGN_BYTES + BRNIMAGE_FOOTER_SIZE)
+
+static int mtdsplit_parse_brnimage(struct mtd_info *master,
+				const struct mtd_partition **pparts,
+				struct mtd_part_parser_data *data)
+{
+	struct mtd_partition *parts;
+	uint32_t buf;
+	unsigned long rootfs_offset, rootfs_size, kernel_size;
+	size_t len;
+	int ret = 0;
+
+	for (rootfs_offset = 0; rootfs_offset < master->size;
+	     rootfs_offset += BRNIMAGE_ALIGN_BYTES) {
+		ret = mtd_check_rootfs_magic(master, rootfs_offset, NULL);
+		if (!ret)
+			break;
+	}
+
+	if (ret)
+		return ret;
+
+	if (rootfs_offset >= master->size)
+		return -EINVAL;
+
+	ret = mtd_read(master, rootfs_offset - BRNIMAGE_FOOTER_SIZE, 4, &len,
+			(void *)&buf);
+	if (ret)
+		return ret;
+
+	if (len != 4)
+		return -EIO;
+
+	kernel_size = le32_to_cpu(buf);
+
+	if (kernel_size > (rootfs_offset - BRNIMAGE_MIN_OVERHEAD))
+		return -EINVAL;
+
+	if (kernel_size < (rootfs_offset - BRNIMAGE_MAX_OVERHEAD))
+		return -EINVAL;
+
+	/*
+	 * The footer must be untouched as it contains the checksum of the
+	 * original brnImage (kernel + squashfs)!
+	 */
+	rootfs_size = master->size - rootfs_offset - BRNIMAGE_FOOTER_SIZE;
+
+	parts = kzalloc(BRNIMAGE_NR_PARTS * sizeof(*parts), GFP_KERNEL);
+	if (!parts)
+		return -ENOMEM;
+
+	parts[0].name = KERNEL_PART_NAME;
+	parts[0].offset = 0;
+	parts[0].size = kernel_size;
+
+	parts[1].name = ROOTFS_PART_NAME;
+	parts[1].offset = rootfs_offset;
+	parts[1].size = rootfs_size;
+
+	*pparts = parts;
+	return BRNIMAGE_NR_PARTS;
+}
+
+static struct mtd_part_parser mtdsplit_brnimage_parser = {
+	.owner = THIS_MODULE,
+	.name = "brnimage-fw",
+	.parse_fn = mtdsplit_parse_brnimage,
+	.type = MTD_PARSER_TYPE_FIRMWARE,
+};
+
+static int __init mtdsplit_brnimage_init(void)
+{
+	register_mtd_parser(&mtdsplit_brnimage_parser);
+
+	return 0;
+}
+
+subsys_initcall(mtdsplit_brnimage_init);
diff --git a/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_cfe_bootfs.c b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_cfe_bootfs.c
new file mode 100644
index 00000000..a3474c9d
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_cfe_bootfs.c
@@ -0,0 +1,90 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2021 Rafał Miłecki <rafal@milecki.pl>
+ */
+
+#include <linux/init.h>
+#include <linux/jffs2.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/of.h>
+#include <linux/slab.h>
+
+#include "mtdsplit.h"
+
+#define je16_to_cpu(x) ((x).v16)
+#define je32_to_cpu(x) ((x).v32)
+
+#define NR_PARTS		2
+
+static int mtdsplit_cfe_bootfs_parse(struct mtd_info *mtd,
+				     const struct mtd_partition **pparts,
+				     struct mtd_part_parser_data *data)
+{
+	struct jffs2_raw_dirent node;
+	enum mtdsplit_part_type type;
+	struct mtd_partition *parts;
+	size_t rootfs_offset;
+	size_t retlen;
+	size_t offset;
+	int err;
+
+	/* Don't parse backup partitions */
+	if (strcmp(mtd->name, "firmware"))
+		return -EINVAL;
+
+	/* Find the end of JFFS2 bootfs partition */
+	offset = 0;
+	do {
+		err = mtd_read(mtd, offset, sizeof(node), &retlen, (void *)&node);
+		if (err || retlen != sizeof(node))
+			break;
+
+		if (je16_to_cpu(node.magic) != JFFS2_MAGIC_BITMASK)
+			break;
+
+		offset += je32_to_cpu(node.totlen);
+		offset = (offset + 0x3) & ~0x3;
+	} while (offset < mtd->size);
+
+	/* Find rootfs partition that follows the bootfs */
+	err = mtd_find_rootfs_from(mtd, mtd->erasesize, mtd->size, &rootfs_offset, &type);
+	if (err)
+		return err;
+
+	parts = kzalloc(NR_PARTS * sizeof(*parts), GFP_KERNEL);
+	if (!parts)
+		return -ENOMEM;
+
+	parts[0].name = "bootfs";
+	parts[0].offset = 0;
+	parts[0].size = rootfs_offset;
+
+	if (type == MTDSPLIT_PART_TYPE_UBI)
+		parts[1].name = UBI_PART_NAME;
+	else
+		parts[1].name = ROOTFS_PART_NAME;
+	parts[1].offset = rootfs_offset;
+	parts[1].size = mtd->size - rootfs_offset;
+
+	*pparts = parts;
+
+	return NR_PARTS;
+}
+
+static const struct of_device_id mtdsplit_cfe_bootfs_of_match_table[] = {
+	{ .compatible = "brcm,bcm4908-firmware" },
+	{},
+};
+MODULE_DEVICE_TABLE(of, mtdsplit_cfe_bootfs_of_match_table);
+
+static struct mtd_part_parser mtdsplit_cfe_bootfs_parser = {
+	.owner = THIS_MODULE,
+	.name = "cfe-bootfs",
+	.of_match_table = mtdsplit_cfe_bootfs_of_match_table,
+	.parse_fn = mtdsplit_cfe_bootfs_parse,
+};
+
+module_mtd_part_parser(mtdsplit_cfe_bootfs_parser);
diff --git a/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_elf.c b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_elf.c
new file mode 100644
index 00000000..47818416
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_elf.c
@@ -0,0 +1,287 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ *  MTD splitter for ELF loader firmware partitions
+ *
+ *  Copyright (C) 2020 Sander Vanheule <sander@svanheule.net>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License as published by the Free
+ *  Software Foundation; version 2.
+ *
+ *  To parse the ELF kernel loader, a small ELF parser is used that can
+ *  handle both ELF32 or ELF64 class loaders. The splitter assumes that the
+ *  kernel is always located before the rootfs, whether it is embedded in the
+ *  loader or not.
+ *
+ *  The kernel image is preferably embedded inside the ELF loader, so the end
+ *  of the loader equals the end of the kernel partition. This is due to the
+ *  way mtd_find_rootfs_from searches for the the rootfs:
+ *  - if the kernel image is embedded in the loader, the appended rootfs may
+ *    follow the loader immediately, within the same erase block.
+ *  - if the kernel image is not embedded in the loader, but placed at some
+ *    offset behind the loader (OKLI-style loader), the rootfs must be
+ *    aligned to an erase-block after the loader and kernel image.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/of.h>
+#include <linux/byteorder/generic.h>
+
+#include "mtdsplit.h"
+
+#define ELF_NR_PARTS	2
+
+#define ELF_MAGIC	0x7f454c46 /* 0x7f E L F */
+#define ELF_CLASS_32	1
+#define ELF_CLASS_64	2
+
+struct elf_header_ident {
+	uint32_t magic;
+	uint8_t class;
+	uint8_t data;
+	uint8_t version;
+	uint8_t osabi;
+	uint8_t abiversion;
+	uint8_t pad[7];
+};
+
+struct elf_header_32 {
+	uint16_t type;
+	uint16_t machine;
+	uint32_t version;
+	uint32_t entry;
+	uint32_t phoff;
+	uint32_t shoff;
+	uint32_t flags;
+	uint16_t ehsize;
+	uint16_t phentsize;
+	uint16_t phnum;
+	uint16_t shentsize;
+	uint16_t shnum;
+	uint16_t shstrndx;
+};
+
+struct elf_header_64 {
+	uint16_t type;
+	uint16_t machine;
+	uint32_t version;
+	uint64_t entry;
+	uint64_t phoff;
+	uint64_t shoff;
+	uint32_t flags;
+	uint16_t ehsize;
+	uint16_t phentsize;
+	uint16_t phnum;
+	uint16_t shentsize;
+	uint16_t shnum;
+	uint16_t shstrndx;
+};
+
+struct elf_header {
+	struct elf_header_ident ident;
+	union {
+		struct elf_header_32 elf32;
+		struct elf_header_64 elf64;
+	};
+};
+
+struct elf_program_header_32 {
+	uint32_t type;
+	uint32_t offset;
+	uint32_t vaddr;
+	uint32_t paddr;
+	uint32_t filesize;
+	uint32_t memsize;
+	uint32_t flags;
+};
+
+struct elf_program_header_64 {
+	uint32_t type;
+	uint32_t flags;
+	uint64_t offset;
+	uint64_t vaddr;
+	uint64_t paddr;
+	uint64_t filesize;
+	uint64_t memsize;
+};
+
+
+static int mtdsplit_elf_read_mtd(struct mtd_info *mtd, size_t offset,
+				 uint8_t *dst, size_t len)
+{
+	size_t retlen;
+	int ret;
+
+	ret = mtd_read(mtd, offset, len, &retlen, dst);
+	if (ret) {
+		pr_debug("read error in \"%s\"\n", mtd->name);
+		return ret;
+	}
+
+	if (retlen != len) {
+		pr_debug("short read in \"%s\"\n", mtd->name);
+		return -EIO;
+	}
+
+	return 0;
+}
+
+static int elf32_determine_size(struct mtd_info *mtd, struct elf_header *hdr,
+				size_t *size)
+{
+	struct elf_header_32 *hdr32 = &(hdr->elf32);
+	int err;
+	size_t section_end, ph_table_end, ph_entry;
+	struct elf_program_header_32 ph;
+
+	*size = 0;
+
+	if (hdr32->shoff > 0) {
+		*size = hdr32->shoff + hdr32->shentsize * hdr32->shnum;
+		return 0;
+	}
+
+	ph_entry = hdr32->phoff;
+	ph_table_end = hdr32->phoff + hdr32->phentsize * hdr32->phnum;
+
+	while (ph_entry < ph_table_end) {
+		err = mtdsplit_elf_read_mtd(mtd, ph_entry, (uint8_t *)(&ph),
+					    sizeof(ph));
+		if (err)
+			return err;
+
+		section_end = ph.offset + ph.filesize;
+		if (section_end > *size)
+			*size = section_end;
+
+		ph_entry += hdr32->phentsize;
+	}
+
+	return 0;
+}
+
+static int elf64_determine_size(struct mtd_info *mtd, struct elf_header *hdr,
+				size_t *size)
+{
+	struct elf_header_64 *hdr64 = &(hdr->elf64);
+	int err;
+	size_t section_end, ph_table_end, ph_entry;
+	struct elf_program_header_64 ph;
+
+	*size = 0;
+
+	if (hdr64->shoff > 0) {
+		*size = hdr64->shoff + hdr64->shentsize * hdr64->shnum;
+		return 0;
+	}
+
+	ph_entry = hdr64->phoff;
+	ph_table_end = hdr64->phoff + hdr64->phentsize * hdr64->phnum;
+
+	while (ph_entry < ph_table_end) {
+		err = mtdsplit_elf_read_mtd(mtd, ph_entry, (uint8_t *)(&ph),
+					    sizeof(ph));
+		if (err)
+			return err;
+
+		section_end = ph.offset + ph.filesize;
+		if (section_end > *size)
+			*size = section_end;
+
+		ph_entry += hdr64->phentsize;
+	}
+
+	return 0;
+}
+
+static int mtdsplit_parse_elf(struct mtd_info *mtd,
+			      const struct mtd_partition **pparts,
+			      struct mtd_part_parser_data *data)
+{
+	struct elf_header hdr;
+	size_t loader_size, rootfs_offset;
+	enum mtdsplit_part_type type;
+	struct mtd_partition *parts;
+	int err;
+
+	err = mtdsplit_elf_read_mtd(mtd, 0, (uint8_t *)&hdr, sizeof(hdr));
+	if (err)
+		return err;
+
+	if (be32_to_cpu(hdr.ident.magic) != ELF_MAGIC) {
+		pr_debug("invalid ELF magic %08x\n",
+			 be32_to_cpu(hdr.ident.magic));
+		return -EINVAL;
+	}
+
+	switch (hdr.ident.class) {
+	case ELF_CLASS_32:
+		err = elf32_determine_size(mtd, &hdr, &loader_size);
+		break;
+	case ELF_CLASS_64:
+		err = elf64_determine_size(mtd, &hdr, &loader_size);
+		break;
+	default:
+		pr_debug("invalid ELF class %i\n", hdr.ident.class);
+		err = -EINVAL;
+	}
+
+	if (err)
+		return err;
+
+	err = mtd_find_rootfs_from(mtd, loader_size, mtd->size,
+				   &rootfs_offset, &type);
+	if (err)
+		return err;
+
+	if (rootfs_offset == mtd->size) {
+		pr_debug("no rootfs found in \"%s\"\n", mtd->name);
+		return -ENODEV;
+	}
+
+	parts = kzalloc(ELF_NR_PARTS * sizeof(*parts), GFP_KERNEL);
+	if (!parts)
+		return -ENOMEM;
+
+	parts[0].name = KERNEL_PART_NAME;
+	parts[0].offset = 0;
+	parts[0].size = rootfs_offset;
+
+	if (type == MTDSPLIT_PART_TYPE_UBI)
+		parts[1].name = UBI_PART_NAME;
+	else
+		parts[1].name = ROOTFS_PART_NAME;
+	parts[1].offset = rootfs_offset;
+	parts[1].size = mtd->size - rootfs_offset;
+
+	*pparts = parts;
+	return ELF_NR_PARTS;
+}
+
+static const struct of_device_id mtdsplit_elf_of_match_table[] = {
+	{ .compatible = "openwrt,elf" },
+	{},
+};
+MODULE_DEVICE_TABLE(of, mtdsplit_elf_of_match_table);
+
+static struct mtd_part_parser mtdsplit_elf_parser = {
+	.owner = THIS_MODULE,
+	.name = "elf-loader-fw",
+	.of_match_table = mtdsplit_elf_of_match_table,
+	.parse_fn = mtdsplit_parse_elf,
+	.type = MTD_PARSER_TYPE_FIRMWARE,
+};
+
+static int __init mtdsplit_elf_init(void)
+{
+	register_mtd_parser(&mtdsplit_elf_parser);
+
+	return 0;
+}
+
+subsys_initcall(mtdsplit_elf_init);
diff --git a/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_eva.c b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_eva.c
new file mode 100644
index 00000000..55004a6d
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_eva.c
@@ -0,0 +1,103 @@
+/*
+ *  Copyright (C) 2012 John Crispin <blogic@openwrt.org>
+ *  Copyright (C) 2015 Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/byteorder/generic.h>
+#include <linux/of.h>
+
+#include "mtdsplit.h"
+
+#define EVA_NR_PARTS		2
+#define EVA_MAGIC		0xfeed1281
+#define EVA_FOOTER_SIZE		0x18
+#define EVA_DUMMY_SQUASHFS_SIZE	0x100
+
+struct eva_image_header {
+	uint32_t	magic;
+	uint32_t	size;
+};
+
+static int mtdsplit_parse_eva(struct mtd_info *master,
+				const struct mtd_partition **pparts,
+				struct mtd_part_parser_data *data)
+{
+	struct mtd_partition *parts;
+	struct eva_image_header hdr;
+	size_t retlen;
+	unsigned long kernel_size, rootfs_offset;
+	int err;
+
+	err = mtd_read(master, 0, sizeof(hdr), &retlen, (void *) &hdr);
+	if (err)
+		return err;
+
+	if (retlen != sizeof(hdr))
+		return -EIO;
+
+	if (le32_to_cpu(hdr.magic) != EVA_MAGIC)
+		return -EINVAL;
+
+	kernel_size = le32_to_cpu(hdr.size) + EVA_FOOTER_SIZE;
+
+	/* rootfs starts at the next 0x10000 boundary: */
+	rootfs_offset = round_up(kernel_size, 0x10000);
+
+	/* skip the dummy EVA squashfs partition (with wrong endianness): */
+	rootfs_offset += EVA_DUMMY_SQUASHFS_SIZE;
+
+	if (rootfs_offset >= master->size)
+		return -EINVAL;
+
+	err = mtd_check_rootfs_magic(master, rootfs_offset, NULL);
+	if (err)
+		return err;
+
+	parts = kzalloc(EVA_NR_PARTS * sizeof(*parts), GFP_KERNEL);
+	if (!parts)
+		return -ENOMEM;
+
+	parts[0].name = KERNEL_PART_NAME;
+	parts[0].offset = 0;
+	parts[0].size = kernel_size;
+
+	parts[1].name = ROOTFS_PART_NAME;
+	parts[1].offset = rootfs_offset;
+	parts[1].size = master->size - rootfs_offset;
+
+	*pparts = parts;
+	return EVA_NR_PARTS;
+}
+
+static const struct of_device_id mtdsplit_eva_of_match_table[] = {
+	{ .compatible = "avm,eva-firmware" },
+	{},
+};
+
+static struct mtd_part_parser mtdsplit_eva_parser = {
+	.owner = THIS_MODULE,
+	.name = "eva-fw",
+	.of_match_table = mtdsplit_eva_of_match_table,
+	.parse_fn = mtdsplit_parse_eva,
+	.type = MTD_PARSER_TYPE_FIRMWARE,
+};
+
+static int __init mtdsplit_eva_init(void)
+{
+	register_mtd_parser(&mtdsplit_eva_parser);
+
+	return 0;
+}
+
+subsys_initcall(mtdsplit_eva_init);
diff --git a/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c
new file mode 100644
index 00000000..a271a676
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c
@@ -0,0 +1,365 @@
+/*
+ * Copyright (c) 2015 The Linux Foundation
+ * Copyright (C) 2014 Gabor Juhos <juhosg@openwrt.org>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/module.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/types.h>
+#include <linux/byteorder/generic.h>
+#include <linux/slab.h>
+#include <linux/libfdt.h>
+#include <linux/of_fdt.h>
+
+#include "mtdsplit.h"
+
+// string macros from git://git.denx.de/u-boot.git/include/image.h
+
+#define FIT_IMAGES_PATH         "/images"
+#define FIT_DATA_PROP           "data"
+#define FIT_DATA_POSITION_PROP  "data-position"
+#define FIT_DATA_OFFSET_PROP    "data-offset"
+#define FIT_DATA_SIZE_PROP      "data-size"
+
+// functions from git://git.denx.de/u-boot.git/common/image-fit.c
+
+/**
+ * fit_image_get_data - get data property and its size for a given component image node
+ * @fit: pointer to the FIT format image header
+ * @noffset: component image node offset
+ * @data: double pointer to void, will hold data property's data address
+ * @size: pointer to size_t, will hold data property's data size
+ *
+ * fit_image_get_data() finds data property in a given component image node.
+ * If the property is found its data start address and size are returned to
+ * the caller.
+ *
+ * returns:
+ *     0, on success
+ *     -1, on failure
+ */
+static int fit_image_get_data(const void *fit, int noffset,
+		const void **data, size_t *size)
+{
+	int len;
+
+	*data = fdt_getprop(fit, noffset, FIT_DATA_PROP, &len);
+	if (*data == NULL) {
+		*size = 0;
+		return -1;
+	}
+
+	*size = len;
+	return 0;
+}
+
+
+/**
+ * Get 'data-offset' property from a given image node.
+ *
+ * @fit: pointer to the FIT image header
+ * @noffset: component image node offset
+ * @data_offset: holds the data-offset property
+ *
+ * returns:
+ *     0, on success
+ *     -ENOENT if the property could not be found
+ */
+static int fit_image_get_data_offset(const void *fit, int noffset, int *data_offset)
+{
+	const fdt32_t *val;
+
+	val = fdt_getprop(fit, noffset, FIT_DATA_OFFSET_PROP, NULL);
+	if (!val)
+		return -ENOENT;
+
+	*data_offset = fdt32_to_cpu(*val);
+
+	return 0;
+}
+
+/**
+ * Get 'data-position' property from a given image node.
+ *
+ * @fit: pointer to the FIT image header
+ * @noffset: component image node offset
+ * @data_position: holds the data-position property
+ *
+ * returns:
+ *     0, on success
+ *     -ENOENT if the property could not be found
+ */
+static int fit_image_get_data_position(const void *fit, int noffset,
+				int *data_position)
+{
+	const fdt32_t *val;
+
+	val = fdt_getprop(fit, noffset, FIT_DATA_POSITION_PROP, NULL);
+	if (!val)
+		return -ENOENT;
+
+	*data_position = fdt32_to_cpu(*val);
+
+	return 0;
+}
+
+/**
+ * Get 'data-size' property from a given image node.
+ *
+ * @fit: pointer to the FIT image header
+ * @noffset: component image node offset
+ * @data_size: holds the data-size property
+ *
+ * returns:
+ *     0, on success
+ *     -ENOENT if the property could not be found
+ */
+static int fit_image_get_data_size(const void *fit, int noffset, int *data_size)
+{
+	const fdt32_t *val;
+
+	val = fdt_getprop(fit, noffset, FIT_DATA_SIZE_PROP, NULL);
+	if (!val)
+		return -ENOENT;
+
+	*data_size = fdt32_to_cpu(*val);
+
+	return 0;
+}
+
+/**
+ * fit_image_get_data_and_size - get data and its size including
+ *				 both embedded and external data
+ * @fit: pointer to the FIT format image header
+ * @noffset: component image node offset
+ * @data: double pointer to void, will hold data property's data address
+ * @size: pointer to size_t, will hold data property's data size
+ *
+ * fit_image_get_data_and_size() finds data and its size including
+ * both embedded and external data. If the property is found
+ * its data start address and size are returned to the caller.
+ *
+ * returns:
+ *     0, on success
+ *     otherwise, on failure
+ */
+static int fit_image_get_data_and_size(const void *fit, int noffset,
+				const void **data, size_t *size)
+{
+	bool external_data = false;
+	int offset;
+	int len;
+	int ret;
+
+	if (!fit_image_get_data_position(fit, noffset, &offset)) {
+		external_data = true;
+	} else if (!fit_image_get_data_offset(fit, noffset, &offset)) {
+		external_data = true;
+		/*
+		 * For FIT with external data, figure out where
+		 * the external images start. This is the base
+		 * for the data-offset properties in each image.
+		 */
+		offset += ((fdt_totalsize(fit) + 3) & ~3);
+	}
+
+	if (external_data) {
+		ret = fit_image_get_data_size(fit, noffset, &len);
+		if (!ret) {
+			*data = fit + offset;
+			*size = len;
+		}
+	} else {
+		ret = fit_image_get_data(fit, noffset, data, size);
+	}
+
+	return ret;
+}
+
+static int
+mtdsplit_fit_parse(struct mtd_info *mtd,
+		   const struct mtd_partition **pparts,
+	           struct mtd_part_parser_data *data)
+{
+	struct device_node *np = mtd_get_of_node(mtd);
+	const char *cmdline_match = NULL;
+	struct fdt_header hdr;
+	size_t hdr_len, retlen;
+	size_t offset;
+	u32 offset_start = 0;
+	size_t fit_offset, fit_size;
+	size_t rootfs_offset, rootfs_size;
+	size_t data_size, img_total, max_size = 0;
+	struct mtd_partition *parts;
+	int ret, ndepth, noffset, images_noffset;
+	const void *img_data;
+	void *fit;
+
+	of_property_read_string(np, "openwrt,cmdline-match", &cmdline_match);
+	if (cmdline_match && !strstr(saved_command_line, cmdline_match))
+		return -ENODEV;
+
+	of_property_read_u32(np, "openwrt,fit-offset", &offset_start);
+
+	hdr_len = sizeof(struct fdt_header);
+
+	/* Parse the MTD device & search for the FIT image location */
+	for(offset = 0; offset + hdr_len <= mtd->size; offset += mtd->erasesize) {
+		ret = mtd_read(mtd, offset + offset_start, hdr_len, &retlen, (void*) &hdr);
+		if (ret) {
+			pr_err("read error in \"%s\" at offset 0x%llx\n",
+			       mtd->name, (unsigned long long) offset);
+			return ret;
+		}
+
+		if (retlen != hdr_len) {
+			pr_err("short read in \"%s\"\n", mtd->name);
+			return -EIO;
+		}
+
+		/* Check the magic - see if this is a FIT image */
+		if (be32_to_cpu(hdr.magic) != OF_DT_HEADER) {
+			pr_debug("no valid FIT image found in \"%s\" at offset %llx\n",
+				 mtd->name, (unsigned long long) offset);
+			continue;
+		}
+
+		/* We found a FIT image. Let's keep going */
+		break;
+	}
+
+	fit_offset = offset;
+	fit_size = be32_to_cpu(hdr.totalsize);
+
+	if (fit_size == 0) {
+		pr_err("FIT image in \"%s\" at offset %llx has null size\n",
+		       mtd->name, (unsigned long long) fit_offset);
+		return -ENODEV;
+	}
+
+	/*
+	 * Classic uImage.FIT has all data embedded into the FDT
+	 * data structure. Hence the total size of the image equals
+	 * the total size of the FDT structure.
+	 * Modern uImage.FIT may have only references to data in FDT,
+	 * hence we need to parse FDT structure to find the end of the
+	 * last external data refernced.
+	 */
+	if (fit_size > 0x1000) {
+		enum mtdsplit_part_type type;
+
+		/* Search for the rootfs partition after the FIT image */
+		ret = mtd_find_rootfs_from(mtd, fit_offset + fit_size + offset_start, mtd->size,
+					   &rootfs_offset, &type);
+		if (ret) {
+			pr_info("no rootfs found after FIT image in \"%s\"\n",
+				mtd->name);
+			return ret;
+		}
+
+		rootfs_size = mtd->size - rootfs_offset;
+
+		parts = kzalloc(2 * sizeof(*parts), GFP_KERNEL);
+		if (!parts)
+			return -ENOMEM;
+
+		parts[0].name = KERNEL_PART_NAME;
+		parts[0].offset = fit_offset;
+		parts[0].size = mtd_roundup_to_eb(fit_size + offset_start, mtd);
+
+		if (type == MTDSPLIT_PART_TYPE_UBI)
+			parts[1].name = UBI_PART_NAME;
+		else
+			parts[1].name = ROOTFS_PART_NAME;
+		parts[1].offset = rootfs_offset;
+		parts[1].size = rootfs_size;
+
+		*pparts = parts;
+
+		return 2;
+	} else {
+		/* Search for rootfs_data after FIT external data */
+		fit = kzalloc(fit_size, GFP_KERNEL);
+		ret = mtd_read(mtd, offset, fit_size + offset_start, &retlen, fit);
+		if (ret) {
+			pr_err("read error in \"%s\" at offset 0x%llx\n",
+			       mtd->name, (unsigned long long) offset);
+			return ret;
+		}
+
+		images_noffset = fdt_path_offset(fit, FIT_IMAGES_PATH);
+		if (images_noffset < 0) {
+			pr_err("Can't find images parent node '%s' (%s)\n",
+			FIT_IMAGES_PATH, fdt_strerror(images_noffset));
+			return -ENODEV;
+		}
+
+		for (ndepth = 0,
+		     noffset = fdt_next_node(fit, images_noffset, &ndepth);
+		     (noffset >= 0) && (ndepth > 0);
+		     noffset = fdt_next_node(fit, noffset, &ndepth)) {
+			if (ndepth == 1) {
+				ret = fit_image_get_data_and_size(fit, noffset, &img_data, &data_size);
+				if (ret)
+					return 0;
+
+				img_total = data_size + (img_data - fit);
+
+				max_size = (max_size > img_total) ? max_size : img_total;
+			}
+		}
+
+		parts = kzalloc(sizeof(*parts), GFP_KERNEL);
+		if (!parts)
+			return -ENOMEM;
+
+		parts[0].name = ROOTFS_SPLIT_NAME;
+		parts[0].offset = fit_offset + mtd_roundup_to_eb(max_size, mtd);
+		parts[0].size = mtd->size - parts[0].offset;
+
+		*pparts = parts;
+
+		kfree(fit);
+
+		return 1;
+	}
+}
+
+static const struct of_device_id mtdsplit_fit_of_match_table[] = {
+	{ .compatible = "denx,fit" },
+	{},
+};
+
+static struct mtd_part_parser uimage_parser = {
+	.owner = THIS_MODULE,
+	.name = "fit-fw",
+	.of_match_table = mtdsplit_fit_of_match_table,
+	.parse_fn = mtdsplit_fit_parse,
+	.type = MTD_PARSER_TYPE_FIRMWARE,
+};
+
+/**************************************************
+ * Init
+ **************************************************/
+
+static int __init mtdsplit_fit_init(void)
+{
+	register_mtd_parser(&uimage_parser);
+
+	return 0;
+}
+
+module_init(mtdsplit_fit_init);
diff --git a/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_h3c_vfs.c b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_h3c_vfs.c
new file mode 100644
index 00000000..f264233d
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_h3c_vfs.c
@@ -0,0 +1,170 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Some devices made by H3C use a "VFS" filesystem to store firmware images.
+ * This parses the start of the filesystem to read the length of the first
+ * file (the kernel image). It then searches for the rootfs after the end of
+ * the file data. This driver assumes that the filesystem was generated by
+ * mkh3cvfs, and only works if the filesystem matches the expected layout,
+ * which includes the file name of the kernel image.
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/of.h>
+#include <linux/types.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+
+#include "mtdsplit.h"
+
+#define	VFS_ERASEBLOCK_SIZE		0x10000
+#define	VFS_BLOCK_SIZE			0x400
+#define VFS_BLOCKS_PER_ERASEBLOCK	(VFS_ERASEBLOCK_SIZE / VFS_BLOCK_SIZE)
+
+#define FORMAT_FLAG_OFFSET		0x0
+
+#define FORMAT_FLAG			(VFS_ERASEBLOCK_SIZE << 12 | VFS_BLOCK_SIZE)
+
+#define FILE_ENTRY_OFFSET		0x800
+
+#define FILE_ENTRY_FLAGS		0x3f
+#define FILE_ENTRY_PARENT_BLOCK		0
+#define FILE_ENTRY_PARENT_INDEX 	0
+#define FILE_ENTRY_DATA_BLOCK	 	2
+#define FILE_ENTRY_NAME			"openwrt-kernel.bin"
+
+#define NR_PARTS			2
+
+struct file_entry {
+	uint8_t flags;
+
+	uint8_t res0[5];
+
+	uint16_t year;
+	uint8_t month;
+	uint8_t day;
+	uint8_t hour;
+	uint8_t minute;
+	uint8_t second;
+
+	uint8_t res1[3];
+
+	uint32_t length;
+
+	uint32_t parent_block;
+	uint16_t parent_index;
+
+	uint8_t res2[2];
+
+	uint32_t data_block;
+
+	char name[96];
+} __attribute__ ((packed));
+
+static inline size_t block_offset(int block)
+{
+	return VFS_ERASEBLOCK_SIZE * (block / (VFS_BLOCKS_PER_ERASEBLOCK-1))
+		+ VFS_BLOCK_SIZE * (1 + (block % (VFS_BLOCKS_PER_ERASEBLOCK-1)));
+}
+
+static inline int block_count(size_t size)
+{
+	return (size + VFS_BLOCK_SIZE - 1) / VFS_BLOCK_SIZE;
+}
+
+static int mtdsplit_h3c_vfs_parse(struct mtd_info *mtd,
+				  const struct mtd_partition **pparts,
+				  struct mtd_part_parser_data *data)
+{
+	struct mtd_partition *parts;
+	uint32_t format_flag;
+	struct file_entry file_entry;
+	size_t retlen;
+	int err;
+	size_t kernel_size;
+	size_t expected_offset;
+	size_t rootfs_offset;
+
+	if (mtd->erasesize != VFS_ERASEBLOCK_SIZE)
+		return -EINVAL;
+
+	/* Check format flag */
+	err = mtd_read(mtd, FORMAT_FLAG_OFFSET, sizeof(format_flag), &retlen,
+		       (void *) &format_flag);
+	if (err)
+		return err;
+
+	if (retlen != sizeof(format_flag))
+		return -EIO;
+
+	if (format_flag != FORMAT_FLAG)
+		return -EINVAL;
+
+	/* Check file entry */
+	err = mtd_read(mtd, FILE_ENTRY_OFFSET, sizeof(file_entry), &retlen,
+		       (void *) &file_entry);
+	if (err)
+		return err;
+
+	if (retlen != sizeof(file_entry))
+		return -EIO;
+
+	if (file_entry.flags != FILE_ENTRY_FLAGS)
+		return -EINVAL;
+
+	if (file_entry.parent_block != FILE_ENTRY_PARENT_BLOCK)
+		return -EINVAL;
+
+	if (file_entry.parent_index != FILE_ENTRY_PARENT_INDEX)
+		return -EINVAL;
+
+	if (file_entry.data_block != FILE_ENTRY_DATA_BLOCK)
+		return -EINVAL;
+
+	if (strncmp(file_entry.name, FILE_ENTRY_NAME, sizeof(file_entry.name)) != 0)
+		return -EINVAL;
+
+	/* Find rootfs offset */
+	kernel_size = block_offset(file_entry.data_block +
+				   block_count(file_entry.length) - 1) +
+		      VFS_BLOCK_SIZE;
+
+	expected_offset = mtd_roundup_to_eb(kernel_size, mtd);
+
+	err = mtd_find_rootfs_from(mtd, expected_offset, mtd->size,
+				   &rootfs_offset, NULL);
+	if (err)
+		return err;
+
+	parts = kzalloc(NR_PARTS * sizeof(*parts), GFP_KERNEL);
+	if (!parts)
+		return -ENOMEM;
+
+	parts[0].name = KERNEL_PART_NAME;
+	parts[0].offset = 0;
+	parts[0].size = rootfs_offset;
+
+	parts[1].name = ROOTFS_PART_NAME;
+	parts[1].offset = rootfs_offset;
+	parts[1].size = mtd->size - rootfs_offset;
+
+	*pparts = parts;
+	return NR_PARTS;
+}
+
+static const struct of_device_id mtdsplit_h3c_vfs_of_match_table[] = {
+	{ .compatible = "h3c,vfs-firmware" },
+	{},
+};
+MODULE_DEVICE_TABLE(of, mtdsplit_h3c_vfs_of_match_table);
+
+static struct mtd_part_parser mtdsplit_h3c_vfs_parser = {
+	.owner = THIS_MODULE,
+	.name = "h3c-vfs",
+	.of_match_table = mtdsplit_h3c_vfs_of_match_table,
+	.parse_fn = mtdsplit_h3c_vfs_parse,
+	.type = MTD_PARSER_TYPE_FIRMWARE,
+};
+
+module_mtd_part_parser(mtdsplit_h3c_vfs_parser);
diff --git a/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_jimage.c b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_jimage.c
new file mode 100644
index 00000000..1770dd47
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_jimage.c
@@ -0,0 +1,284 @@
+/*
+ *  Copyright (C) 2018 Paweł Dembicki <paweldembicki@gmail.com> 
+ *
+ *  Based on: mtdsplit_uimage.c
+ *  Copyright (C) 2013 Gabor Juhos <juhosg@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ *
+ */
+
+#define pr_fmt(fmt)	KBUILD_MODNAME ": " fmt
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/byteorder/generic.h>
+#include <linux/of.h>
+
+#include "mtdsplit.h"
+
+#define MAX_HEADER_LEN ( STAG_SIZE + SCH2_SIZE )
+
+#define STAG_SIZE 16
+#define STAG_ID 0x04
+#define STAG_MAGIC 0x2B24
+
+#define SCH2_SIZE 40
+#define SCH2_MAGIC 0x2124
+#define SCH2_VER 0x02
+
+/*
+ * Jboot image header,
+ * all data in little endian.
+ */
+
+struct jimage_header		//stag + sch2 jboot joined headers
+{
+	uint8_t stag_cmark;		// in factory 0xFF , in sysupgrade must be the same as stag_id
+	uint8_t stag_id;		// 0x04
+	uint16_t stag_magic;		//magic 0x2B24
+	uint32_t stag_time_stamp;	// timestamp calculated in jboot way
+	uint32_t stag_image_length;	// lentgh of kernel + sch2 header
+	uint16_t stag_image_checksum;	// negated jboot_checksum of sch2 + kernel
+	uint16_t stag_tag_checksum;	// negated jboot_checksum of stag header data
+	uint16_t sch2_magic;		// magic 0x2124
+	uint8_t sch2_cp_type;	// 0x00 for flat, 0x01 for jz, 0x02 for gzip, 0x03 for lzma
+	uint8_t sch2_version;	// 0x02 for sch2
+	uint32_t sch2_ram_addr;	// ram entry address
+	uint32_t sch2_image_len;	// kernel image length
+	uint32_t sch2_image_crc32;	// kernel image crc
+	uint32_t sch2_start_addr;	// ram start address
+	uint32_t sch2_rootfs_addr;	// rootfs flash address
+	uint32_t sch2_rootfs_len;	// rootfls length
+	uint32_t sch2_rootfs_crc32;	// rootfs crc32
+	uint32_t sch2_header_crc32;	// sch2 header crc32, durring calculation this area is replaced by zero
+	uint16_t sch2_header_length;	// sch2 header length: 0x28
+	uint16_t sch2_cmd_line_length;	// cmd line length, known zeros
+};
+
+static int
+read_jimage_header(struct mtd_info *mtd, size_t offset, u_char *buf,
+		   size_t header_len)
+{
+	size_t retlen;
+	int ret;
+
+	ret = mtd_read(mtd, offset, header_len, &retlen, buf);
+	if (ret) {
+		pr_debug("read error in \"%s\"\n", mtd->name);
+		return ret;
+	}
+
+	if (retlen != header_len) {
+		pr_debug("short read in \"%s\"\n", mtd->name);
+		return -EIO;
+	}
+
+	return 0;
+}
+
+/**
+ * __mtdsplit_parse_jimage - scan partition and create kernel + rootfs parts
+ *
+ * @find_header: function to call for a block of data that will return offset
+ *      of a valid jImage header if found
+ */
+static int __mtdsplit_parse_jimage(struct mtd_info *master,
+				   const struct mtd_partition **pparts,
+				   struct mtd_part_parser_data *data,
+				   ssize_t (*find_header)(u_char *buf, size_t len))
+{
+	struct mtd_partition *parts;
+	u_char *buf;
+	int nr_parts;
+	size_t offset;
+	size_t jimage_offset;
+	size_t jimage_size = 0;
+	size_t rootfs_offset;
+	size_t rootfs_size = 0;
+	int jimage_part, rf_part;
+	int ret;
+	enum mtdsplit_part_type type;
+
+	nr_parts = 2;
+	parts = kzalloc(nr_parts * sizeof(*parts), GFP_KERNEL);
+	if (!parts)
+		return -ENOMEM;
+
+	buf = vmalloc(MAX_HEADER_LEN);
+	if (!buf) {
+		ret = -ENOMEM;
+		goto err_free_parts;
+	}
+
+	/* find jImage on erase block boundaries */
+	for (offset = 0; offset < master->size; offset += master->erasesize) {
+		struct jimage_header *header;
+
+		jimage_size = 0;
+
+		ret = read_jimage_header(master, offset, buf, MAX_HEADER_LEN);
+		if (ret)
+			continue;
+
+		ret = find_header(buf, MAX_HEADER_LEN);
+		if (ret < 0) {
+			pr_debug("no valid jImage found in \"%s\" at offset %llx\n",
+				 master->name, (unsigned long long) offset);
+			continue;
+		}
+		header = (struct jimage_header *)(buf + ret);
+
+		jimage_size = sizeof(*header) + header->sch2_image_len + ret;
+		if ((offset + jimage_size) > master->size) {
+			pr_debug("jImage exceeds MTD device \"%s\"\n",
+				 master->name);
+			continue;
+		}
+		break;
+	}
+
+	if (jimage_size == 0) {
+		pr_debug("no jImage found in \"%s\"\n", master->name);
+		ret = -ENODEV;
+		goto err_free_buf;
+	}
+
+	jimage_offset = offset;
+
+	if (jimage_offset == 0) {
+		jimage_part = 0;
+		rf_part = 1;
+
+		/* find the roots after the jImage */
+		ret = mtd_find_rootfs_from(master, jimage_offset + jimage_size,
+					   master->size, &rootfs_offset, &type);
+		if (ret) {
+			pr_debug("no rootfs after jImage in \"%s\"\n",
+				 master->name);
+			goto err_free_buf;
+		}
+
+		rootfs_size = master->size - rootfs_offset;
+		jimage_size = rootfs_offset - jimage_offset;
+	} else {
+		rf_part = 0;
+		jimage_part = 1;
+
+		/* check rootfs presence at offset 0 */
+		ret = mtd_check_rootfs_magic(master, 0, &type);
+		if (ret) {
+			pr_debug("no rootfs before jImage in \"%s\"\n",
+				 master->name);
+			goto err_free_buf;
+		}
+
+		rootfs_offset = 0;
+		rootfs_size = jimage_offset;
+	}
+
+	if (rootfs_size == 0) {
+		pr_debug("no rootfs found in \"%s\"\n", master->name);
+		ret = -ENODEV;
+		goto err_free_buf;
+	}
+
+	parts[jimage_part].name = KERNEL_PART_NAME;
+	parts[jimage_part].offset = jimage_offset;
+	parts[jimage_part].size = jimage_size;
+
+	if (type == MTDSPLIT_PART_TYPE_UBI)
+		parts[rf_part].name = UBI_PART_NAME;
+	else
+		parts[rf_part].name = ROOTFS_PART_NAME;
+	parts[rf_part].offset = rootfs_offset;
+	parts[rf_part].size = rootfs_size;
+
+	vfree(buf);
+
+	*pparts = parts;
+	return nr_parts;
+
+err_free_buf:
+	vfree(buf);
+
+err_free_parts:
+	kfree(parts);
+	return ret;
+}
+
+static ssize_t jimage_verify_default(u_char *buf, size_t len)
+{
+	struct jimage_header *header = (struct jimage_header *)buf;
+
+	/* default sanity checks */
+	if (header->stag_magic != STAG_MAGIC) {
+		pr_debug("invalid jImage stag header magic: %04x\n",
+			 header->stag_magic);
+		return -EINVAL;
+	}
+	if (header->sch2_magic != SCH2_MAGIC) {
+		pr_debug("invalid jImage sch2 header magic: %04x\n",
+			 header->stag_magic);
+		return -EINVAL;
+	}
+	if (header->stag_cmark != header->stag_id) {
+		pr_debug("invalid jImage stag header cmark: %02x\n",
+			 header->stag_magic);
+		return -EINVAL;
+	}
+	if (header->stag_id != STAG_ID) {
+		pr_debug("invalid jImage stag header id: %02x\n",
+			 header->stag_magic);
+		return -EINVAL;
+	}
+	if (header->sch2_version != SCH2_VER) {
+		pr_debug("invalid jImage sch2 header version: %02x\n",
+			 header->stag_magic);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int
+mtdsplit_jimage_parse_generic(struct mtd_info *master,
+			      const struct mtd_partition **pparts,
+			      struct mtd_part_parser_data *data)
+{
+	return __mtdsplit_parse_jimage(master, pparts, data,
+				      jimage_verify_default);
+}
+
+static const struct of_device_id mtdsplit_jimage_of_match_table[] = {
+	{ .compatible = "amit,jimage" },
+	{},
+};
+
+static struct mtd_part_parser jimage_generic_parser = {
+	.owner = THIS_MODULE,
+	.name = "jimage-fw",
+	.of_match_table = mtdsplit_jimage_of_match_table,
+	.parse_fn = mtdsplit_jimage_parse_generic,
+	.type = MTD_PARSER_TYPE_FIRMWARE,
+};
+
+/**************************************************
+ * Init
+ **************************************************/
+
+static int __init mtdsplit_jimage_init(void)
+{
+	register_mtd_parser(&jimage_generic_parser);
+
+	return 0;
+}
+
+module_init(mtdsplit_jimage_init);
diff --git a/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_lzma.c b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_lzma.c
new file mode 100644
index 00000000..c58f7ae4
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_lzma.c
@@ -0,0 +1,104 @@
+/*
+ *  Copyright (C) 2014 Gabor Juhos <juhosg@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/of.h>
+
+#include <asm/unaligned.h>
+
+#include "mtdsplit.h"
+
+#define LZMA_NR_PARTS		2
+#define LZMA_PROPERTIES_SIZE	5
+
+struct lzma_header {
+	u8 props[LZMA_PROPERTIES_SIZE];
+	u8 size_low[4];
+	u8 size_high[4];
+};
+
+static int mtdsplit_parse_lzma(struct mtd_info *master,
+			       const struct mtd_partition **pparts,
+			       struct mtd_part_parser_data *data)
+{
+	struct lzma_header hdr;
+	size_t hdr_len, retlen;
+	size_t rootfs_offset;
+	u32 t;
+	struct mtd_partition *parts;
+	int err;
+
+	hdr_len = sizeof(hdr);
+	err = mtd_read(master, 0, hdr_len, &retlen, (void *) &hdr);
+	if (err)
+		return err;
+
+	if (retlen != hdr_len)
+		return -EIO;
+
+	/* verify LZMA properties */
+	if (hdr.props[0] >= (9 * 5 * 5))
+		return -EINVAL;
+
+	t = get_unaligned_le32(&hdr.props[1]);
+	if (!is_power_of_2(t))
+		return -EINVAL;
+
+	t = get_unaligned_le32(&hdr.size_high);
+	if (t)
+		return -EINVAL;
+
+	err = mtd_find_rootfs_from(master, master->erasesize, master->size,
+				   &rootfs_offset, NULL);
+	if (err)
+		return err;
+
+	parts = kzalloc(LZMA_NR_PARTS * sizeof(*parts), GFP_KERNEL);
+	if (!parts)
+		return -ENOMEM;
+
+	parts[0].name = KERNEL_PART_NAME;
+	parts[0].offset = 0;
+	parts[0].size = rootfs_offset;
+
+	parts[1].name = ROOTFS_PART_NAME;
+	parts[1].offset = rootfs_offset;
+	parts[1].size = master->size - rootfs_offset;
+
+	*pparts = parts;
+	return LZMA_NR_PARTS;
+}
+
+static const struct of_device_id mtdsplit_lzma_of_match_table[] = {
+	{ .compatible = "lzma" },
+	{},
+};
+MODULE_DEVICE_TABLE(of, mtdsplit_lzma_of_match_table);
+
+static struct mtd_part_parser mtdsplit_lzma_parser = {
+	.owner = THIS_MODULE,
+	.name = "lzma-fw",
+	.of_match_table = mtdsplit_lzma_of_match_table,
+	.parse_fn = mtdsplit_parse_lzma,
+	.type = MTD_PARSER_TYPE_FIRMWARE,
+};
+
+static int __init mtdsplit_lzma_init(void)
+{
+	register_mtd_parser(&mtdsplit_lzma_parser);
+
+	return 0;
+}
+
+subsys_initcall(mtdsplit_lzma_init);
diff --git a/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_minor.c b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_minor.c
new file mode 100644
index 00000000..053cba62
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_minor.c
@@ -0,0 +1,142 @@
+/*
+ *  MTD splitter for MikroTik NOR devices
+ *
+ *  Copyright (C) 2017 Thibaut VARENE <varenet@parisc-linux.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ *
+ *  The rootfs is expected at erase-block boundary due to the use of
+ *  mtd_find_rootfs_from(). We use a trimmed down version of the yaffs header
+ *  for two main reasons:
+ *  - the original header uses weakly defined types (int, enum...) which can
+ *    vary in length depending on build host (and the struct is not packed),
+ *    and the name field can have a different total length depending on
+ *    whether or not the yaffs code was _built_ with unicode support.
+ *  - the only field that could be of real use here (file_size_low) contains
+ *    invalid data in the header generated by kernel2minor, so we cannot use
+ *    it to infer the exact position of the rootfs and do away with
+ *    mtd_find_rootfs_from() (and thus have non-EB-aligned rootfs).
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/string.h>
+#include <linux/of.h>
+
+#include "mtdsplit.h"
+
+#define YAFFS_OBJECT_TYPE_FILE	0x1
+#define YAFFS_OBJECTID_ROOT	0x1
+#define YAFFS_SUM_UNUSED	0xFFFF
+#define YAFFS_MAX_NAME_LENGTH	127
+#define YAFFS_NAME_KERNEL	"kernel"
+#define YAFFS_NAME_BOOTIMAGE	"bootimage"
+
+#define MINOR_NR_PARTS		2
+
+/*
+ * This structure is based on yaffs_obj_hdr from yaffs_guts.h
+ * The weak types match upstream. The fields have cpu-endianness
+ */
+struct minor_header {
+	int yaffs_type;
+	int yaffs_obj_id;
+	u16 yaffs_sum_unused;
+	char yaffs_name[YAFFS_MAX_NAME_LENGTH];
+};
+
+static int mtdsplit_parse_minor(struct mtd_info *master,
+				const struct mtd_partition **pparts,
+				struct mtd_part_parser_data *data)
+{
+	struct minor_header hdr;
+	size_t hdr_len, retlen;
+	size_t rootfs_offset;
+	struct mtd_partition *parts;
+	int err;
+
+	hdr_len = sizeof(hdr);
+	err = mtd_read(master, 0, hdr_len, &retlen, (void *) &hdr);
+	if (err) {
+		pr_err("MiNOR mtd_read error: %d\n", err);
+		return err;
+	}
+
+	if (retlen != hdr_len) {
+		pr_err("MiNOR mtd_read too short\n");
+		return -EIO;
+	}
+
+	/* match header */
+	if (hdr.yaffs_type != YAFFS_OBJECT_TYPE_FILE) {
+		pr_info("MiNOR YAFFS first type not matched\n");
+		return 0;
+	}
+
+	if (hdr.yaffs_obj_id != YAFFS_OBJECTID_ROOT) {
+		pr_info("MiNOR YAFFS first objectid not matched\n");
+		return 0;
+	}
+
+	if (hdr.yaffs_sum_unused != YAFFS_SUM_UNUSED) {
+		pr_info("MiNOR YAFFS first sum not matched\n");
+		return 0;
+	}
+
+	if ((memcmp(hdr.yaffs_name, YAFFS_NAME_KERNEL, sizeof(YAFFS_NAME_KERNEL))) &&
+	    (memcmp(hdr.yaffs_name, YAFFS_NAME_BOOTIMAGE, sizeof(YAFFS_NAME_BOOTIMAGE)))) {
+		pr_info("MiNOR YAFFS first name not matched\n");
+		return 0;
+	}
+
+	err = mtd_find_rootfs_from(master, master->erasesize, master->size,
+				   &rootfs_offset, NULL);
+	if (err) {
+		pr_info("MiNOR mtd_find_rootfs_from error: %d\n", err);
+		return 0;
+	}
+
+	parts = kzalloc(MINOR_NR_PARTS * sizeof(*parts), GFP_KERNEL);
+	if (!parts)
+		return -ENOMEM;
+
+	parts[0].name = KERNEL_PART_NAME;
+	parts[0].offset = 0;
+	parts[0].size = rootfs_offset;
+
+	parts[1].name = ROOTFS_PART_NAME;
+	parts[1].offset = rootfs_offset;
+	parts[1].size = master->size - rootfs_offset;
+
+	*pparts = parts;
+	return MINOR_NR_PARTS;
+}
+
+static const struct of_device_id mtdsplit_minor_of_match_table[] = {
+	{ .compatible = "mikrotik,minor" },
+	{},
+};
+MODULE_DEVICE_TABLE(of, mtdsplit_minor_of_match_table);
+
+static struct mtd_part_parser mtdsplit_minor_parser = {
+	.owner = THIS_MODULE,
+	.name = "minor-fw",
+	.of_match_table = mtdsplit_minor_of_match_table,
+	.parse_fn = mtdsplit_parse_minor,
+	.type = MTD_PARSER_TYPE_FIRMWARE,
+};
+
+static int __init mtdsplit_minor_init(void)
+{
+	register_mtd_parser(&mtdsplit_minor_parser);
+
+	return 0;
+}
+
+subsys_initcall(mtdsplit_minor_init);
diff --git a/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_seama.c b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_seama.c
new file mode 100644
index 00000000..5d49171b
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_seama.c
@@ -0,0 +1,118 @@
+/*
+ *  Copyright (C) 2013 Gabor Juhos <juhosg@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/byteorder/generic.h>
+#include <linux/of.h>
+
+#include "mtdsplit.h"
+
+#define SEAMA_MAGIC		0x5EA3A417
+#define SEAMA_NR_PARTS		2
+#define SEAMA_MIN_ROOTFS_OFFS	0x80000	/* 512KiB */
+
+struct seama_header {
+	__be32	magic;		/* should always be SEAMA_MAGIC. */
+	__be16	reserved;	/* reserved for  */
+	__be16	metasize;	/* size of the META data */
+	__be32	size;		/* size of the image */
+	u8	md5[16];	/* digest */
+};
+
+static int mtdsplit_parse_seama(struct mtd_info *master,
+				const struct mtd_partition **pparts,
+				struct mtd_part_parser_data *data)
+{
+	struct seama_header hdr;
+	size_t hdr_len, retlen, kernel_ent_size;
+	size_t rootfs_offset;
+	struct mtd_partition *parts;
+	enum mtdsplit_part_type type;
+	int err;
+
+	hdr_len = sizeof(hdr);
+	err = mtd_read(master, 0, hdr_len, &retlen, (void *) &hdr);
+	if (err)
+		return err;
+
+	if (retlen != hdr_len)
+		return -EIO;
+
+	/* sanity checks */
+	if (be32_to_cpu(hdr.magic) != SEAMA_MAGIC)
+		return -EINVAL;
+
+	kernel_ent_size = hdr_len + be32_to_cpu(hdr.size) +
+			  be16_to_cpu(hdr.metasize);
+	if (kernel_ent_size > master->size)
+		return -EINVAL;
+
+	/* Check for the rootfs right after Seama entity with a kernel. */
+	err = mtd_check_rootfs_magic(master, kernel_ent_size, &type);
+	if (!err) {
+		rootfs_offset = kernel_ent_size;
+	} else {
+		/*
+		 * On some devices firmware entity might contain both: kernel
+		 * and rootfs. We can't determine kernel size so we just have to
+		 * look for rootfs magic.
+		 * Start the search from an arbitrary offset.
+		 */
+		err = mtd_find_rootfs_from(master, SEAMA_MIN_ROOTFS_OFFS,
+					   master->size, &rootfs_offset, &type);
+		if (err)
+			return err;
+	}
+
+	parts = kzalloc(SEAMA_NR_PARTS * sizeof(*parts), GFP_KERNEL);
+	if (!parts)
+		return -ENOMEM;
+
+	parts[0].name = KERNEL_PART_NAME;
+	parts[0].offset = sizeof hdr + be16_to_cpu(hdr.metasize);
+	parts[0].size = rootfs_offset - parts[0].offset;
+
+	if (type == MTDSPLIT_PART_TYPE_UBI)
+		parts[1].name = UBI_PART_NAME;
+	else
+		parts[1].name = ROOTFS_PART_NAME;
+	parts[1].offset = rootfs_offset;
+	parts[1].size = master->size - rootfs_offset;
+
+	*pparts = parts;
+	return SEAMA_NR_PARTS;
+}
+
+static const struct of_device_id mtdsplit_seama_of_match_table[] = {
+	{ .compatible = "seama" },
+	{},
+};
+MODULE_DEVICE_TABLE(of, mtdsplit_seama_of_match_table);
+
+static struct mtd_part_parser mtdsplit_seama_parser = {
+	.owner = THIS_MODULE,
+	.name = "seama-fw",
+	.of_match_table = mtdsplit_seama_of_match_table,
+	.parse_fn = mtdsplit_parse_seama,
+	.type = MTD_PARSER_TYPE_FIRMWARE,
+};
+
+static int __init mtdsplit_seama_init(void)
+{
+	register_mtd_parser(&mtdsplit_seama_parser);
+
+	return 0;
+}
+
+subsys_initcall(mtdsplit_seama_init);
diff --git a/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_seil.c b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_seil.c
new file mode 100644
index 00000000..e58bb49b
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_seil.c
@@ -0,0 +1,191 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/* a mtdsplit driver for IIJ SEIL devices */
+
+#define pr_fmt(fmt)	KBUILD_MODNAME ": " fmt
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+#include <linux/of.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/byteorder/generic.h>
+
+#include "mtdsplit.h"
+
+#define NR_PARTS		2
+#define SEIL_VFMT		1
+#define LDR_ENV_PART_NAME	"bootloader-env"
+#define LDR_ENV_KEY_BOOTDEV	"BOOTDEV"
+
+struct seil_header {
+	uint64_t	id;		/* Identifier */
+	uint8_t		copy[80];	/* Copyright */
+	uint32_t	dcrc;		/* Data CRC Checksum */
+	uint32_t	vfmt;		/* Image Version Format */
+	uint32_t	vmjr;		/* Image Version Major */
+	uint32_t	vmnr;		/* Image Version Minor */
+	uint8_t		vrel[32];	/* Image Version Release */
+	uint32_t	dxor;		/* xor value for Data? */
+	uint32_t	dlen;		/* Data Length */
+};
+
+/*
+ * check whether the current mtd device is active or not
+ *
+ * example of BOOTDEV value (IIJ SA-W2):
+ *   - "flash"   : primary image on flash
+ *   - "rescue"  : secondary image on flash
+ *   - "usb"     : usb storage
+ *   - "lan0/1"  : network
+ */
+static bool seil_bootdev_is_active(struct device_node *np)
+{
+	struct mtd_info *env_mtd;
+	char *buf, *var, *value, *eq;
+	const char *devnm;
+	size_t rdlen;
+	int ret;
+
+	/*
+	 * read bootdev name of the partition
+	 * if doesn't exist, return true and skip checking of active device
+	 */
+	ret = of_property_read_string(np, "iij,bootdev-name", &devnm);
+	if (ret == -EINVAL)
+		return true;
+	else if (ret < 0)
+		return false;
+
+	env_mtd = get_mtd_device_nm(LDR_ENV_PART_NAME);
+	if (IS_ERR(env_mtd)) {
+		pr_err("failed to get mtd device \"%s\"", LDR_ENV_PART_NAME);
+		return false;
+	}
+
+	buf = vmalloc(env_mtd->size);
+	if (!buf)
+		return false;
+
+	ret = mtd_read(env_mtd, 0, env_mtd->size, &rdlen, buf);
+	if (ret || rdlen != env_mtd->size) {
+		pr_err("failed to read from mtd (%d)\n", ret);
+		ret = 0;
+		goto exit_vfree;
+	}
+
+	for (var = buf, ret = false;
+	     var < buf + env_mtd->size && *var;
+	     var = value + strlen(value) + 1) {
+		eq = strchr(var, '=');
+		if (!eq)
+			break;
+		*eq = '\0';
+		value = eq + 1;
+
+		pr_debug("ENV: %s=%s\n", var, value);
+		if (!strcmp(var, LDR_ENV_KEY_BOOTDEV)) {
+			ret = !strcmp(devnm, value);
+			break;
+		}
+	}
+
+exit_vfree:
+	vfree(buf);
+
+	return ret;
+}
+
+static int mtdsplit_parse_seil_fw(struct mtd_info *master,
+				  const struct mtd_partition **pparts,
+				  struct mtd_part_parser_data *data)
+{
+	struct device_node *np = mtd_get_of_node(master);
+	struct mtd_partition *parts;
+	struct seil_header header;
+	size_t image_size = 0;
+	size_t rootfs_offset;
+	size_t hdrlen = sizeof(header);
+	size_t retlen;
+	int ret;
+	u64 id;
+
+	if (!seil_bootdev_is_active(np))
+		return -ENODEV;
+
+	ret = of_property_read_u64(np, "iij,seil-id", &id);
+	if (ret) {
+		pr_err("failed to get iij,seil-id from dt\n");
+		return ret;
+	}
+	pr_debug("got seil-id=0x%016llx from dt\n", id);
+
+	parts = kcalloc(NR_PARTS, sizeof(*parts), GFP_KERNEL);
+	if (!parts)
+		return -ENOMEM;
+
+	ret = mtd_read(master, 0, hdrlen, &retlen, (void *)&header);
+	if (ret)
+		goto err_free_parts;
+
+	if (retlen != hdrlen) {
+		ret = -EIO;
+		goto err_free_parts;
+	}
+
+	if (be64_to_cpu(header.id) != id ||
+	    be32_to_cpu(header.vfmt) != SEIL_VFMT) {
+		pr_debug("no valid seil image found in \"%s\"\n", master->name);
+		ret = -ENODEV;
+		goto err_free_parts;
+	}
+
+	image_size = hdrlen + be32_to_cpu(header.dlen);
+	if (image_size > master->size) {
+		pr_err("seil image exceeds MTD device \"%s\"\n", master->name);
+		ret = -EINVAL;
+		goto err_free_parts;
+	}
+
+	/* find the roots after the seil image */
+	ret = mtd_find_rootfs_from(master, image_size,
+				   master->size, &rootfs_offset, NULL);
+	if (ret || (master->size - rootfs_offset) == 0) {
+		pr_debug("no rootfs after seil image in \"%s\"\n",
+			 master->name);
+		ret = -ENODEV;
+		goto err_free_parts;
+	}
+
+	parts[0].name = KERNEL_PART_NAME;
+	parts[0].offset = 0;
+	parts[0].size = rootfs_offset;
+
+	parts[1].name = ROOTFS_PART_NAME;
+	parts[1].offset = rootfs_offset;
+	parts[1].size = master->size - rootfs_offset;
+
+	*pparts = parts;
+	return NR_PARTS;
+
+err_free_parts:
+	kfree(parts);
+	return ret;
+}
+
+static const struct of_device_id mtdsplit_seil_fw_of_match_table[] = {
+	{ .compatible = "iij,seil-firmware" },
+	{},
+};
+MODULE_DEVICE_TABLE(of, mtdsplit_seil_fw_of_match_table);
+
+static struct mtd_part_parser mtdsplit_seil_fw_parser = {
+	.owner = THIS_MODULE,
+	.name = "seil-fw",
+	.of_match_table = mtdsplit_seil_fw_of_match_table,
+	.parse_fn = mtdsplit_parse_seil_fw,
+	.type = MTD_PARSER_TYPE_FIRMWARE,
+};
+
+module_mtd_part_parser(mtdsplit_seil_fw_parser);
diff --git a/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_squashfs.c b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_squashfs.c
new file mode 100644
index 00000000..f6353da6
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_squashfs.c
@@ -0,0 +1,72 @@
+/*
+ *  Copyright (C) 2013 Felix Fietkau <nbd@nbd.name>
+ *  Copyright (C) 2013 Gabor Juhos <juhosg@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ *
+ */
+
+#define pr_fmt(fmt)	KBUILD_MODNAME ": " fmt
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/magic.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/byteorder/generic.h>
+
+#include "mtdsplit.h"
+
+static int
+mtdsplit_parse_squashfs(struct mtd_info *master,
+			const struct mtd_partition **pparts,
+			struct mtd_part_parser_data *data)
+{
+	struct mtd_partition *part;
+	struct mtd_info *parent_mtd;
+	size_t part_offset;
+	size_t squashfs_len;
+	int err;
+
+	err = mtd_get_squashfs_len(master, 0, &squashfs_len);
+	if (err)
+		return err;
+
+	parent_mtd = mtd_get_master(master);
+	part_offset = mtdpart_get_offset(master);
+
+	part = kzalloc(sizeof(*part), GFP_KERNEL);
+	if (!part) {
+		pr_alert("unable to allocate memory for \"%s\" partition\n",
+			 ROOTFS_SPLIT_NAME);
+		return -ENOMEM;
+	}
+
+	part->name = ROOTFS_SPLIT_NAME;
+	part->offset = mtd_roundup_to_eb(part_offset + squashfs_len,
+					 parent_mtd) - part_offset;
+	part->size = mtd_rounddown_to_eb(master->size - part->offset, master);
+
+	*pparts = part;
+	return 1;
+}
+
+static struct mtd_part_parser mtdsplit_squashfs_parser = {
+	.owner = THIS_MODULE,
+	.name = "squashfs-split",
+	.parse_fn = mtdsplit_parse_squashfs,
+	.type = MTD_PARSER_TYPE_ROOTFS,
+};
+
+static int __init mtdsplit_squashfs_init(void)
+{
+	register_mtd_parser(&mtdsplit_squashfs_parser);
+
+	return 0;
+}
+
+subsys_initcall(mtdsplit_squashfs_init);
diff --git a/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_tplink.c b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_tplink.c
new file mode 100644
index 00000000..8909c107
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_tplink.c
@@ -0,0 +1,176 @@
+/*
+ *  Copyright (C) 2013 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2014 Felix Fietkau <nbd@nbd.name>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/byteorder/generic.h>
+#include <linux/of.h>
+
+#include "mtdsplit.h"
+
+#define TPLINK_NR_PARTS		2
+#define TPLINK_MIN_ROOTFS_OFFS	0x80000	/* 512KiB */
+
+#define MD5SUM_LEN  16
+
+struct fw_v1 {
+	char		vendor_name[24];
+	char		fw_version[36];
+	uint32_t	hw_id;		/* hardware id */
+	uint32_t	hw_rev;		/* hardware revision */
+	uint32_t	unk1;
+	uint8_t		md5sum1[MD5SUM_LEN];
+	uint32_t	unk2;
+	uint8_t		md5sum2[MD5SUM_LEN];
+	uint32_t	unk3;
+	uint32_t	kernel_la;	/* kernel load address */
+	uint32_t	kernel_ep;	/* kernel entry point */
+	uint32_t	fw_length;	/* total length of the firmware */
+	uint32_t	kernel_ofs;	/* kernel data offset */
+	uint32_t	kernel_len;	/* kernel data length */
+	uint32_t	rootfs_ofs;	/* rootfs data offset */
+	uint32_t	rootfs_len;	/* rootfs data length */
+	uint32_t	boot_ofs;	/* bootloader data offset */
+	uint32_t	boot_len;	/* bootloader data length */
+	uint8_t		pad[360];
+} __attribute__ ((packed));
+
+struct fw_v2 {
+	char		fw_version[48]; /* 0x04: fw version string */
+	uint32_t	hw_id;		/* 0x34: hardware id */
+	uint32_t	hw_rev;		/* 0x38: FIXME: hardware revision? */
+	uint32_t	unk1;	        /* 0x3c: 0x00000000 */
+	uint8_t		md5sum1[MD5SUM_LEN]; /* 0x40 */
+	uint32_t	unk2;		/* 0x50: 0x00000000 */
+	uint8_t		md5sum2[MD5SUM_LEN]; /* 0x54 */
+	uint32_t	unk3;		/* 0x64: 0xffffffff */
+
+	uint32_t	kernel_la;	/* 0x68: kernel load address */
+	uint32_t	kernel_ep;	/* 0x6c: kernel entry point */
+	uint32_t	fw_length;	/* 0x70: total length of the image */
+	uint32_t	kernel_ofs;	/* 0x74: kernel data offset */
+	uint32_t	kernel_len;	/* 0x78: kernel data length */
+	uint32_t	rootfs_ofs;	/* 0x7c: rootfs data offset */
+	uint32_t	rootfs_len;	/* 0x80: rootfs data length */
+	uint32_t	boot_ofs;	/* 0x84: FIXME: seems to be unused */
+	uint32_t	boot_len;	/* 0x88: FIXME: seems to be unused */
+	uint16_t	unk4;		/* 0x8c: 0x55aa */
+	uint8_t		sver_hi;	/* 0x8e */
+	uint8_t		sver_lo;	/* 0x8f */
+	uint8_t		unk5;		/* 0x90: magic: 0xa5 */
+	uint8_t		ver_hi;         /* 0x91 */
+	uint8_t		ver_mid;        /* 0x92 */
+	uint8_t		ver_lo;         /* 0x93 */
+	uint8_t		pad[364];
+} __attribute__ ((packed));
+
+struct tplink_fw_header {
+	uint32_t version;
+	union {
+		struct fw_v1 v1;
+		struct fw_v2 v2;
+	};
+};
+
+static int mtdsplit_parse_tplink(struct mtd_info *master,
+				 const struct mtd_partition **pparts,
+				 struct mtd_part_parser_data *data)
+{
+	struct tplink_fw_header hdr;
+	size_t hdr_len, retlen, kernel_size;
+	size_t rootfs_offset;
+	struct mtd_partition *parts;
+	int err;
+
+	hdr_len = sizeof(hdr);
+	err = mtd_read(master, 0, hdr_len, &retlen, (void *) &hdr);
+	if (err)
+		return err;
+
+	if (retlen != hdr_len)
+		return -EIO;
+
+	switch (le32_to_cpu(hdr.version)) {
+	case 1:
+		if (be32_to_cpu(hdr.v1.kernel_ofs) != sizeof(hdr))
+			return -EINVAL;
+
+		kernel_size = sizeof(hdr) + be32_to_cpu(hdr.v1.kernel_len);
+		rootfs_offset = be32_to_cpu(hdr.v1.rootfs_ofs);
+		break;
+	case 2:
+	case 3:
+		if (be32_to_cpu(hdr.v2.kernel_ofs) != sizeof(hdr))
+			return -EINVAL;
+
+		kernel_size = sizeof(hdr) + be32_to_cpu(hdr.v2.kernel_len);
+		rootfs_offset = be32_to_cpu(hdr.v2.rootfs_ofs);
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	if (kernel_size > master->size)
+		return -EINVAL;
+
+	/* Find the rootfs */
+	err = mtd_check_rootfs_magic(master, rootfs_offset, NULL);
+	if (err) {
+		/*
+		 * The size in the header might cover the rootfs as well.
+		 * Start the search from an arbitrary offset.
+		 */
+		err = mtd_find_rootfs_from(master, TPLINK_MIN_ROOTFS_OFFS,
+					   master->size, &rootfs_offset, NULL);
+		if (err)
+			return err;
+	}
+
+	parts = kzalloc(TPLINK_NR_PARTS * sizeof(*parts), GFP_KERNEL);
+	if (!parts)
+		return -ENOMEM;
+
+	parts[0].name = KERNEL_PART_NAME;
+	parts[0].offset = 0;
+	parts[0].size = kernel_size;
+
+	parts[1].name = ROOTFS_PART_NAME;
+	parts[1].offset = rootfs_offset;
+	parts[1].size = master->size - rootfs_offset;
+
+	*pparts = parts;
+	return TPLINK_NR_PARTS;
+}
+
+static const struct of_device_id mtdsplit_tplink_of_match_table[] = {
+	{ .compatible = "tplink,firmware" },
+	{},
+};
+
+static struct mtd_part_parser mtdsplit_tplink_parser = {
+	.owner = THIS_MODULE,
+	.name = "tplink-fw",
+	.of_match_table = mtdsplit_tplink_of_match_table,
+	.parse_fn = mtdsplit_parse_tplink,
+	.type = MTD_PARSER_TYPE_FIRMWARE,
+};
+
+static int __init mtdsplit_tplink_init(void)
+{
+	register_mtd_parser(&mtdsplit_tplink_parser);
+
+	return 0;
+}
+
+subsys_initcall(mtdsplit_tplink_init);
diff --git a/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_trx.c b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_trx.c
new file mode 100644
index 00000000..b853ec9e
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_trx.c
@@ -0,0 +1,155 @@
+/*
+ *  Copyright (C) 2013 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2014 Felix Fietkau <nbd@nbd.name>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ *
+ */
+
+#define pr_fmt(fmt)	KBUILD_MODNAME ": " fmt
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/byteorder/generic.h>
+#include <linux/of.h>
+
+#include "mtdsplit.h"
+
+#define TRX_MAGIC   0x30524448  /* "HDR0" */
+
+struct trx_header {
+	__le32 magic;
+	__le32 len;
+	__le32 crc32;
+	__le32 flag_version;
+	__le32 offset[4];
+};
+
+static int
+read_trx_header(struct mtd_info *mtd, size_t offset,
+		   struct trx_header *header)
+{
+	size_t header_len;
+	size_t retlen;
+	int ret;
+
+	header_len = sizeof(*header);
+	ret = mtd_read(mtd, offset, header_len, &retlen,
+		       (unsigned char *) header);
+	if (ret) {
+		pr_debug("read error in \"%s\"\n", mtd->name);
+		return ret;
+	}
+
+	if (retlen != header_len) {
+		pr_debug("short read in \"%s\"\n", mtd->name);
+		return -EIO;
+	}
+
+	return 0;
+}
+
+static int
+mtdsplit_parse_trx(struct mtd_info *master,
+		   const struct mtd_partition **pparts,
+		   struct mtd_part_parser_data *data)
+{
+	struct mtd_partition *parts;
+	struct trx_header hdr;
+	int nr_parts;
+	size_t offset;
+	size_t trx_offset;
+	size_t trx_size = 0;
+	size_t rootfs_offset;
+	size_t rootfs_size = 0;
+	int ret;
+
+	nr_parts = 2;
+	parts = kzalloc(nr_parts * sizeof(*parts), GFP_KERNEL);
+	if (!parts)
+		return -ENOMEM;
+
+	/* find trx image on erase block boundaries */
+	for (offset = 0; offset < master->size; offset += master->erasesize) {
+		trx_size = 0;
+
+		ret = read_trx_header(master, offset, &hdr);
+		if (ret)
+			continue;
+
+		if (hdr.magic != cpu_to_le32(TRX_MAGIC)) {
+			pr_debug("no valid trx header found in \"%s\" at offset %llx\n",
+				 master->name, (unsigned long long) offset);
+			continue;
+		}
+
+		trx_size = le32_to_cpu(hdr.len);
+		if ((offset + trx_size) > master->size) {
+			pr_debug("trx image exceeds MTD device \"%s\"\n",
+				 master->name);
+			continue;
+		}
+		break;
+	}
+
+	if (trx_size == 0) {
+		pr_debug("no trx header found in \"%s\"\n", master->name);
+		ret = -ENODEV;
+		goto err;
+	}
+
+	trx_offset = offset + hdr.offset[0];
+	rootfs_offset = offset + hdr.offset[1];
+	rootfs_size = master->size - rootfs_offset;
+	trx_size = rootfs_offset - trx_offset;
+
+	if (rootfs_size == 0) {
+		pr_debug("no rootfs found in \"%s\"\n", master->name);
+		ret = -ENODEV;
+		goto err;
+	}
+
+	parts[0].name = KERNEL_PART_NAME;
+	parts[0].offset = trx_offset;
+	parts[0].size = trx_size;
+
+	parts[1].name = ROOTFS_PART_NAME;
+	parts[1].offset = rootfs_offset;
+	parts[1].size = rootfs_size;
+
+	*pparts = parts;
+	return nr_parts;
+
+err:
+	kfree(parts);
+	return ret;
+}
+
+static const struct of_device_id trx_parser_of_match_table[] = {
+	{ .compatible = "openwrt,trx" },
+	{},
+};
+MODULE_DEVICE_TABLE(of, trx_parser_of_match_table);
+
+static struct mtd_part_parser trx_parser = {
+	.owner = THIS_MODULE,
+	.name = "trx-fw",
+	.of_match_table = trx_parser_of_match_table,
+	.parse_fn = mtdsplit_parse_trx,
+	.type = MTD_PARSER_TYPE_FIRMWARE,
+};
+
+static int __init mtdsplit_trx_init(void)
+{
+	register_mtd_parser(&trx_parser);
+
+	return 0;
+}
+
+module_init(mtdsplit_trx_init);
diff --git a/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_uimage.c b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_uimage.c
new file mode 100644
index 00000000..a3e55fb1
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_uimage.c
@@ -0,0 +1,282 @@
+/*
+ *  Copyright (C) 2013 Gabor Juhos <juhosg@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ *
+ */
+
+#define pr_fmt(fmt)	KBUILD_MODNAME ": " fmt
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/version.h>
+#include <linux/byteorder/generic.h>
+#include <linux/of.h>
+#include <dt-bindings/mtd/partitions/uimage.h>
+
+#include "mtdsplit.h"
+
+/*
+ * Legacy format image header,
+ * all data in network byte order (aka natural aka bigendian).
+ */
+struct uimage_header {
+	uint32_t	ih_magic;	/* Image Header Magic Number	*/
+	uint32_t	ih_hcrc;	/* Image Header CRC Checksum	*/
+	uint32_t	ih_time;	/* Image Creation Timestamp	*/
+	uint32_t	ih_size;	/* Image Data Size		*/
+	uint32_t	ih_load;	/* Data	 Load  Address		*/
+	uint32_t	ih_ep;		/* Entry Point Address		*/
+	uint32_t	ih_dcrc;	/* Image Data CRC Checksum	*/
+	uint8_t		ih_os;		/* Operating System		*/
+	uint8_t		ih_arch;	/* CPU architecture		*/
+	uint8_t		ih_type;	/* Image Type			*/
+	uint8_t		ih_comp;	/* Compression Type		*/
+	uint8_t		ih_name[IH_NMLEN];	/* Image Name		*/
+};
+
+static int
+read_uimage_header(struct mtd_info *mtd, size_t offset, u_char *buf,
+		   size_t header_len)
+{
+	size_t retlen;
+	int ret;
+
+	ret = mtd_read(mtd, offset, header_len, &retlen, buf);
+	if (ret) {
+		pr_debug("read error in \"%s\"\n", mtd->name);
+		return ret;
+	}
+
+	if (retlen != header_len) {
+		pr_debug("short read in \"%s\"\n", mtd->name);
+		return -EIO;
+	}
+
+	return 0;
+}
+
+static void uimage_parse_dt(struct mtd_info *master, int *extralen,
+			    u32 *ih_magic, u32 *ih_type,
+			    u32 *header_offset, u32 *part_magic)
+{
+	struct device_node *np = mtd_get_of_node(master);
+
+	if (!np || !of_device_is_compatible(np, "openwrt,uimage"))
+		return;
+
+	if (!of_property_read_u32(np, "openwrt,padding", extralen))
+		pr_debug("got openwrt,padding=%d from device-tree\n", *extralen);
+	if (!of_property_read_u32(np, "openwrt,ih-magic", ih_magic))
+		pr_debug("got openwrt,ih-magic=%08x from device-tree\n", *ih_magic);
+	if (!of_property_read_u32(np, "openwrt,ih-type", ih_type))
+		pr_debug("got openwrt,ih-type=%08x from device-tree\n", *ih_type);
+	if (!of_property_read_u32(np, "openwrt,offset", header_offset))
+		pr_debug("got ih-start=%u from device-tree\n", *header_offset);
+	if (!of_property_read_u32(np, "openwrt,partition-magic", part_magic))
+		pr_debug("got openwrt,partition-magic=%08x from device-tree\n", *part_magic);
+}
+
+static ssize_t uimage_verify_default(u_char *buf, u32 ih_magic, u32 ih_type)
+{
+	struct uimage_header *header = (struct uimage_header *)buf;
+
+	/* default sanity checks */
+	if (be32_to_cpu(header->ih_magic) != ih_magic) {
+		pr_debug("invalid uImage magic: %08x != %08x\n",
+			 be32_to_cpu(header->ih_magic), ih_magic);
+		return -EINVAL;
+	}
+
+	if (header->ih_os != IH_OS_LINUX) {
+		pr_debug("invalid uImage OS: %08x != %08x\n",
+			 be32_to_cpu(header->ih_os), IH_OS_LINUX);
+		return -EINVAL;
+	}
+
+	if (header->ih_type != ih_type) {
+		pr_debug("invalid uImage type: %08x != %08x\n",
+			 be32_to_cpu(header->ih_type), ih_type);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+/**
+ * __mtdsplit_parse_uimage - scan partition and create kernel + rootfs parts
+ *
+ * @find_header: function to call for a block of data that will return offset
+ *      and tail padding length of a valid uImage header if found
+ */
+static int __mtdsplit_parse_uimage(struct mtd_info *master,
+				   const struct mtd_partition **pparts,
+				   struct mtd_part_parser_data *data)
+{
+	struct mtd_partition *parts;
+	u_char *buf;
+	int nr_parts;
+	size_t offset;
+	size_t uimage_offset;
+	size_t uimage_size = 0;
+	size_t rootfs_offset;
+	size_t rootfs_size = 0;
+	size_t buflen;
+	int uimage_part, rf_part;
+	int ret;
+	int extralen = 0;
+	u32 ih_magic = IH_MAGIC;
+	u32 ih_type = IH_TYPE_KERNEL;
+	u32 header_offset = 0;
+	u32 part_magic = 0;
+	enum mtdsplit_part_type type;
+
+	nr_parts = 2;
+	parts = kzalloc(nr_parts * sizeof(*parts), GFP_KERNEL);
+	if (!parts)
+		return -ENOMEM;
+
+	uimage_parse_dt(master, &extralen, &ih_magic, &ih_type, &header_offset, &part_magic);
+	buflen = sizeof(struct uimage_header) + header_offset;
+	buf = vmalloc(buflen);
+	if (!buf) {
+		ret = -ENOMEM;
+		goto err_free_parts;
+	}
+
+	/* find uImage on erase block boundaries */
+	for (offset = 0; offset < master->size; offset += master->erasesize) {
+		struct uimage_header *header;
+
+		uimage_size = 0;
+
+		ret = read_uimage_header(master, offset, buf, buflen);
+		if (ret)
+			continue;
+
+		/* verify optional partition magic before uimage header */
+		if (header_offset && part_magic && (be32_to_cpu(*(u32 *)buf) != part_magic))
+			continue;
+
+		ret = uimage_verify_default(buf + header_offset, ih_magic, ih_type);
+		if (ret < 0) {
+			pr_debug("no valid uImage found in \"%s\" at offset %llx\n",
+				 master->name, (unsigned long long) offset);
+			continue;
+		}
+
+		header = (struct uimage_header *)(buf + header_offset);
+
+		uimage_size = sizeof(*header) +
+				be32_to_cpu(header->ih_size) + header_offset + extralen;
+
+		if ((offset + uimage_size) > master->size) {
+			pr_debug("uImage exceeds MTD device \"%s\"\n",
+				 master->name);
+			continue;
+		}
+		break;
+	}
+
+	if (uimage_size == 0) {
+		pr_debug("no uImage found in \"%s\"\n", master->name);
+		ret = -ENODEV;
+		goto err_free_buf;
+	}
+
+	uimage_offset = offset;
+
+	if (uimage_offset == 0) {
+		uimage_part = 0;
+		rf_part = 1;
+
+		/* find the roots after the uImage */
+		ret = mtd_find_rootfs_from(master, uimage_offset + uimage_size,
+					   master->size, &rootfs_offset, &type);
+		if (ret) {
+			pr_debug("no rootfs after uImage in \"%s\"\n",
+				 master->name);
+			goto err_free_buf;
+		}
+
+		rootfs_size = master->size - rootfs_offset;
+		uimage_size = rootfs_offset - uimage_offset;
+	} else {
+		rf_part = 0;
+		uimage_part = 1;
+
+		/* check rootfs presence at offset 0 */
+		ret = mtd_check_rootfs_magic(master, 0, &type);
+		if (ret) {
+			pr_debug("no rootfs before uImage in \"%s\"\n",
+				 master->name);
+			goto err_free_buf;
+		}
+
+		rootfs_offset = 0;
+		rootfs_size = uimage_offset;
+	}
+
+	if (rootfs_size == 0) {
+		pr_debug("no rootfs found in \"%s\"\n", master->name);
+		ret = -ENODEV;
+		goto err_free_buf;
+	}
+
+	parts[uimage_part].name = KERNEL_PART_NAME;
+	parts[uimage_part].offset = uimage_offset;
+	parts[uimage_part].size = uimage_size;
+
+	if (type == MTDSPLIT_PART_TYPE_UBI)
+		parts[rf_part].name = UBI_PART_NAME;
+	else
+		parts[rf_part].name = ROOTFS_PART_NAME;
+	parts[rf_part].offset = rootfs_offset;
+	parts[rf_part].size = rootfs_size;
+
+	vfree(buf);
+
+	*pparts = parts;
+	return nr_parts;
+
+err_free_buf:
+	vfree(buf);
+
+err_free_parts:
+	kfree(parts);
+	return ret;
+}
+
+static const struct of_device_id mtdsplit_uimage_of_match_table[] = {
+	{ .compatible = "denx,uimage" },
+	{ .compatible = "openwrt,uimage" },
+	{},
+};
+
+static struct mtd_part_parser uimage_generic_parser = {
+	.owner = THIS_MODULE,
+	.name = "uimage-fw",
+	.of_match_table = mtdsplit_uimage_of_match_table,
+	.parse_fn = __mtdsplit_parse_uimage,
+	.type = MTD_PARSER_TYPE_FIRMWARE,
+};
+
+/**************************************************
+ * Init
+ **************************************************/
+
+static int __init mtdsplit_uimage_init(void)
+{
+	register_mtd_parser(&uimage_generic_parser);
+
+	return 0;
+}
+
+module_init(mtdsplit_uimage_init);
diff --git a/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_wrgg.c b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_wrgg.c
new file mode 100644
index 00000000..dfd6058a
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_wrgg.c
@@ -0,0 +1,142 @@
+/*
+ *  Copyright (C) 2013 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2014 Felix Fietkau <nbd@nbd.name>
+ *  Copyright (C) 2016 Stijn Tintel <stijn@linux-ipv6.be>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/byteorder/generic.h>
+#include <linux/of.h>
+
+#include "mtdsplit.h"
+
+#define WRGG_NR_PARTS		2
+#define WRGG_MIN_ROOTFS_OFFS	0x80000	/* 512KiB */
+#define WRGG03_MAGIC		0x20080321
+#define WRG_MAGIC		0x20040220
+
+struct wrgg03_header {
+	char		signature[32];
+	uint32_t	magic1;
+	uint32_t	magic2;
+	char		version[16];
+	char		model[16];
+	uint32_t	flag[2];
+	uint32_t	reserve[2];
+	char		buildno[16];
+	uint32_t	size;
+	uint32_t	offset;
+	char		devname[32];
+	char		digest[16];
+} __attribute__ ((packed));
+
+struct wrg_header {
+	char		signature[32];
+	uint32_t	magic1;
+	uint32_t	magic2;
+	uint32_t	size;
+	uint32_t	offset;
+	char		devname[32];
+	char		digest[16];
+} __attribute__ ((packed));
+
+
+static int mtdsplit_parse_wrgg(struct mtd_info *master,
+			       const struct mtd_partition **pparts,
+			       struct mtd_part_parser_data *data)
+{
+	struct wrgg03_header hdr;
+	size_t hdr_len, retlen, kernel_ent_size;
+	size_t rootfs_offset;
+	struct mtd_partition *parts;
+	enum mtdsplit_part_type type;
+	int err;
+
+	hdr_len = sizeof(hdr);
+	err = mtd_read(master, 0, hdr_len, &retlen, (void *) &hdr);
+	if (err)
+		return err;
+
+	if (retlen != hdr_len)
+		return -EIO;
+
+	/* sanity checks */
+	if (le32_to_cpu(hdr.magic1) == WRGG03_MAGIC) {
+		kernel_ent_size = hdr_len + be32_to_cpu(hdr.size);
+		/*
+		 * If this becomes silly big it's probably because the
+		 * WRGG image is little-endian.
+		 */
+		if (kernel_ent_size > master->size)
+			kernel_ent_size = hdr_len + le32_to_cpu(hdr.size);
+
+		/* Now what ?! It's neither */
+		if (kernel_ent_size > master->size)
+			return -EINVAL;
+	} else if (le32_to_cpu(hdr.magic1) == WRG_MAGIC) {
+		kernel_ent_size = sizeof(struct wrg_header) + le32_to_cpu(
+		                  ((struct wrg_header*)&hdr)->size);
+	} else {
+		return -EINVAL;
+	}
+
+	if (kernel_ent_size > master->size)
+		return -EINVAL;
+
+	/*
+	 * The size in the header covers the rootfs as well.
+	 * Start the search from an arbitrary offset.
+	 */
+	err = mtd_find_rootfs_from(master, WRGG_MIN_ROOTFS_OFFS,
+				   master->size, &rootfs_offset, &type);
+	if (err)
+		return err;
+
+	parts = kzalloc(WRGG_NR_PARTS * sizeof(*parts), GFP_KERNEL);
+	if (!parts)
+		return -ENOMEM;
+
+	parts[0].name = KERNEL_PART_NAME;
+	parts[0].offset = 0;
+	parts[0].size = rootfs_offset;
+
+	parts[1].name = ROOTFS_PART_NAME;
+	parts[1].offset = rootfs_offset;
+	parts[1].size = master->size - rootfs_offset;
+
+	*pparts = parts;
+	return WRGG_NR_PARTS;
+}
+
+static const struct of_device_id mtdsplit_wrgg_of_match_table[] = {
+	{ .compatible = "wrg" },
+	{},
+};
+MODULE_DEVICE_TABLE(of, mtdsplit_wrgg_of_match_table);
+
+static struct mtd_part_parser mtdsplit_wrgg_parser = {
+	.owner = THIS_MODULE,
+	.name = "wrgg-fw",
+	.of_match_table = mtdsplit_wrgg_of_match_table,
+	.parse_fn = mtdsplit_parse_wrgg,
+	.type = MTD_PARSER_TYPE_FIRMWARE,
+};
+
+static int __init mtdsplit_wrgg_init(void)
+{
+	register_mtd_parser(&mtdsplit_wrgg_parser);
+
+	return 0;
+}
+
+subsys_initcall(mtdsplit_wrgg_init);
diff --git a/6.12/target/linux/generic/files/drivers/mtd/nand/mtk_bmt.c b/6.12/target/linux/generic/files/drivers/mtd/nand/mtk_bmt.c
new file mode 100644
index 00000000..bcff7d6a
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/nand/mtk_bmt.c
@@ -0,0 +1,465 @@
+/*
+ * Copyright (c) 2017 MediaTek Inc.
+ * Author: Xiangsheng Hou <xiangsheng.hou@mediatek.com>
+ * Copyright (c) 2020-2022 Felix Fietkau <nbd@nbd.name>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/gfp.h>
+#include <linux/slab.h>
+#include <linux/bits.h>
+#include "mtk_bmt.h"
+
+struct bmt_desc bmtd = {};
+
+/* -------- Nand operations wrapper -------- */
+int bbt_nand_copy(u16 dest_blk, u16 src_blk, loff_t max_offset)
+{
+	int pages = bmtd.blk_size >> bmtd.pg_shift;
+	loff_t src = (loff_t)src_blk << bmtd.blk_shift;
+	loff_t dest = (loff_t)dest_blk << bmtd.blk_shift;
+	loff_t offset = 0;
+	uint8_t oob[64];
+	int i, ret;
+
+	for (i = 0; i < pages; i++) {
+		struct mtd_oob_ops rd_ops = {
+			.mode = MTD_OPS_PLACE_OOB,
+			.oobbuf = oob,
+			.ooblen = min_t(int, bmtd.mtd->oobsize / pages, sizeof(oob)),
+			.datbuf = bmtd.data_buf,
+			.len = bmtd.pg_size,
+		};
+		struct mtd_oob_ops wr_ops = {
+			.mode = MTD_OPS_PLACE_OOB,
+			.oobbuf = oob,
+			.datbuf = bmtd.data_buf,
+			.len = bmtd.pg_size,
+		};
+
+		if (offset >= max_offset)
+			break;
+
+		ret = bmtd._read_oob(bmtd.mtd, src + offset, &rd_ops);
+		if (ret < 0 && !mtd_is_bitflip(ret))
+			return ret;
+
+		if (!rd_ops.retlen)
+			break;
+
+		ret = bmtd._write_oob(bmtd.mtd, dest + offset, &wr_ops);
+		if (ret < 0)
+			return ret;
+
+		wr_ops.ooblen = rd_ops.oobretlen;
+		offset += rd_ops.retlen;
+	}
+
+	return 0;
+}
+
+/* -------- Bad Blocks Management -------- */
+bool mapping_block_in_range(int block, int *start, int *end)
+{
+	const __be32 *cur = bmtd.remap_range;
+	u32 addr = block << bmtd.blk_shift;
+	int i;
+
+	if (!cur || !bmtd.remap_range_len) {
+		*start = 0;
+		*end = bmtd.total_blks;
+		return true;
+	}
+
+	for (i = 0; i < bmtd.remap_range_len; i++, cur += 2) {
+		if (addr < be32_to_cpu(cur[0]) || addr >= be32_to_cpu(cur[1]))
+			continue;
+
+		*start = be32_to_cpu(cur[0]);
+		*end = be32_to_cpu(cur[1]);
+		return true;
+	}
+
+	return false;
+}
+
+static bool
+mtk_bmt_remap_block(u32 block, u32 mapped_block, int copy_len)
+{
+	int start, end;
+
+	if (!mapping_block_in_range(block, &start, &end))
+		return false;
+
+	return bmtd.ops->remap_block(block, mapped_block, copy_len);
+}
+
+static int
+mtk_bmt_read(struct mtd_info *mtd, loff_t from,
+	     struct mtd_oob_ops *ops)
+{
+	struct mtd_oob_ops cur_ops = *ops;
+	int retry_count = 0;
+	loff_t cur_from;
+	int ret = 0;
+	int max_bitflips = 0;
+
+	ops->retlen = 0;
+	ops->oobretlen = 0;
+
+	while (ops->retlen < ops->len || ops->oobretlen < ops->ooblen) {
+		int cur_ret;
+
+		u32 offset = from & (bmtd.blk_size - 1);
+		u32 block = from >> bmtd.blk_shift;
+		int cur_block;
+
+		cur_block = bmtd.ops->get_mapping_block(block);
+		if (cur_block < 0)
+			return -EIO;
+
+		cur_from = ((loff_t)cur_block << bmtd.blk_shift) + offset;
+
+		cur_ops.oobretlen = 0;
+		cur_ops.retlen = 0;
+		cur_ops.len = min_t(u32, mtd->erasesize - offset,
+					 ops->len - ops->retlen);
+		cur_ret = bmtd._read_oob(mtd, cur_from, &cur_ops);
+		if (cur_ret < 0)
+			ret = cur_ret;
+		else
+			max_bitflips = max_t(int, max_bitflips, cur_ret);
+		if (cur_ret < 0 && !mtd_is_bitflip(cur_ret)) {
+			if (mtk_bmt_remap_block(block, cur_block, mtd->erasesize) &&
+				retry_count++ < 10)
+				continue;
+
+			goto out;
+		}
+
+		if (mtd->bitflip_threshold && cur_ret >= mtd->bitflip_threshold)
+			mtk_bmt_remap_block(block, cur_block, mtd->erasesize);
+
+		ops->retlen += cur_ops.retlen;
+		ops->oobretlen += cur_ops.oobretlen;
+
+		cur_ops.ooboffs = 0;
+		cur_ops.datbuf += cur_ops.retlen;
+		cur_ops.oobbuf += cur_ops.oobretlen;
+		cur_ops.ooblen -= cur_ops.oobretlen;
+
+		if (!cur_ops.len)
+			cur_ops.len = mtd->erasesize - offset;
+
+		from += cur_ops.len;
+		retry_count = 0;
+	}
+
+out:
+	if (ret < 0)
+		return ret;
+
+	return max_bitflips;
+}
+
+static int
+mtk_bmt_write(struct mtd_info *mtd, loff_t to,
+	      struct mtd_oob_ops *ops)
+{
+	struct mtd_oob_ops cur_ops = *ops;
+	int retry_count = 0;
+	loff_t cur_to;
+	int ret;
+
+	ops->retlen = 0;
+	ops->oobretlen = 0;
+
+	while (ops->retlen < ops->len || ops->oobretlen < ops->ooblen) {
+		u32 offset = to & (bmtd.blk_size - 1);
+		u32 block = to >> bmtd.blk_shift;
+		int cur_block;
+
+		cur_block = bmtd.ops->get_mapping_block(block);
+		if (cur_block < 0)
+			return -EIO;
+
+		cur_to = ((loff_t)cur_block << bmtd.blk_shift) + offset;
+
+		cur_ops.oobretlen = 0;
+		cur_ops.retlen = 0;
+		cur_ops.len = min_t(u32, bmtd.blk_size - offset,
+					 ops->len - ops->retlen);
+		ret = bmtd._write_oob(mtd, cur_to, &cur_ops);
+		if (ret < 0) {
+			if (mtk_bmt_remap_block(block, cur_block, offset) &&
+			    retry_count++ < 10)
+				continue;
+
+			return ret;
+		}
+
+		ops->retlen += cur_ops.retlen;
+		ops->oobretlen += cur_ops.oobretlen;
+
+		cur_ops.ooboffs = 0;
+		cur_ops.datbuf += cur_ops.retlen;
+		cur_ops.oobbuf += cur_ops.oobretlen;
+		cur_ops.ooblen -= cur_ops.oobretlen;
+
+		if (!cur_ops.len)
+			cur_ops.len = mtd->erasesize - offset;
+
+		to += cur_ops.len;
+		retry_count = 0;
+	}
+
+	return 0;
+}
+
+static int
+mtk_bmt_mtd_erase(struct mtd_info *mtd, struct erase_info *instr)
+{
+	struct erase_info mapped_instr = {
+		.len = bmtd.blk_size,
+	};
+	int retry_count = 0;
+	u64 start_addr, end_addr;
+	int ret;
+	u16 orig_block;
+	int block;
+
+	start_addr = instr->addr & (~mtd->erasesize_mask);
+	end_addr = instr->addr + instr->len;
+
+	while (start_addr < end_addr) {
+		orig_block = start_addr >> bmtd.blk_shift;
+		block = bmtd.ops->get_mapping_block(orig_block);
+		if (block < 0)
+			return -EIO;
+		mapped_instr.addr = (loff_t)block << bmtd.blk_shift;
+		ret = bmtd._erase(mtd, &mapped_instr);
+		if (ret) {
+			if (mtk_bmt_remap_block(orig_block, block, 0) &&
+			    retry_count++ < 10)
+				continue;
+			instr->fail_addr = start_addr;
+			break;
+		}
+		start_addr += mtd->erasesize;
+		retry_count = 0;
+	}
+
+	return ret;
+}
+static int
+mtk_bmt_block_isbad(struct mtd_info *mtd, loff_t ofs)
+{
+	int retry_count = 0;
+	u16 orig_block = ofs >> bmtd.blk_shift;
+	u16 block;
+	int ret;
+
+retry:
+	block = bmtd.ops->get_mapping_block(orig_block);
+	ret = bmtd._block_isbad(mtd, (loff_t)block << bmtd.blk_shift);
+	if (ret) {
+		if (mtk_bmt_remap_block(orig_block, block, bmtd.blk_size) &&
+		    retry_count++ < 10)
+			goto retry;
+	}
+	return ret;
+}
+
+static int
+mtk_bmt_block_markbad(struct mtd_info *mtd, loff_t ofs)
+{
+	u16 orig_block = ofs >> bmtd.blk_shift;
+	int block;
+
+	block = bmtd.ops->get_mapping_block(orig_block);
+	if (block < 0)
+		return -EIO;
+
+	mtk_bmt_remap_block(orig_block, block, bmtd.blk_size);
+
+	return bmtd._block_markbad(mtd, (loff_t)block << bmtd.blk_shift);
+}
+
+static void
+mtk_bmt_replace_ops(struct mtd_info *mtd)
+{
+	bmtd._read_oob = mtd->_read_oob;
+	bmtd._write_oob = mtd->_write_oob;
+	bmtd._erase = mtd->_erase;
+	bmtd._block_isbad = mtd->_block_isbad;
+	bmtd._block_markbad = mtd->_block_markbad;
+
+	mtd->_read_oob = mtk_bmt_read;
+	mtd->_write_oob = mtk_bmt_write;
+	mtd->_erase = mtk_bmt_mtd_erase;
+	mtd->_block_isbad = mtk_bmt_block_isbad;
+	mtd->_block_markbad = mtk_bmt_block_markbad;
+}
+
+static int mtk_bmt_debug_repair(void *data, u64 val)
+{
+	int block = val >> bmtd.blk_shift;
+	int prev_block, new_block;
+
+	prev_block = bmtd.ops->get_mapping_block(block);
+	if (prev_block < 0)
+		return -EIO;
+
+	bmtd.ops->unmap_block(block);
+	new_block = bmtd.ops->get_mapping_block(block);
+	if (new_block < 0)
+		return -EIO;
+
+	if (prev_block == new_block)
+		return 0;
+
+	bbt_nand_erase(new_block);
+	bbt_nand_copy(new_block, prev_block, bmtd.blk_size);
+
+	return 0;
+}
+
+static int mtk_bmt_debug_mark_good(void *data, u64 val)
+{
+	bmtd.ops->unmap_block(val >> bmtd.blk_shift);
+
+	return 0;
+}
+
+static int mtk_bmt_debug_mark_bad(void *data, u64 val)
+{
+	u32 block = val >> bmtd.blk_shift;
+	int cur_block;
+
+	cur_block = bmtd.ops->get_mapping_block(block);
+	if (cur_block < 0)
+		return -EIO;
+
+	mtk_bmt_remap_block(block, cur_block, bmtd.blk_size);
+
+	return 0;
+}
+
+static int mtk_bmt_debug(void *data, u64 val)
+{
+	return bmtd.ops->debug(data, val);
+}
+
+
+DEFINE_DEBUGFS_ATTRIBUTE(fops_repair, NULL, mtk_bmt_debug_repair, "%llu\n");
+DEFINE_DEBUGFS_ATTRIBUTE(fops_mark_good, NULL, mtk_bmt_debug_mark_good, "%llu\n");
+DEFINE_DEBUGFS_ATTRIBUTE(fops_mark_bad, NULL, mtk_bmt_debug_mark_bad, "%llu\n");
+DEFINE_DEBUGFS_ATTRIBUTE(fops_debug, NULL, mtk_bmt_debug, "%llu\n");
+
+static void
+mtk_bmt_add_debugfs(void)
+{
+	struct dentry *dir;
+
+	dir = bmtd.debugfs_dir = debugfs_create_dir("mtk-bmt", NULL);
+	if (!dir)
+		return;
+
+	debugfs_create_file_unsafe("repair", S_IWUSR, dir, NULL, &fops_repair);
+	debugfs_create_file_unsafe("mark_good", S_IWUSR, dir, NULL, &fops_mark_good);
+	debugfs_create_file_unsafe("mark_bad", S_IWUSR, dir, NULL, &fops_mark_bad);
+	debugfs_create_file_unsafe("debug", S_IWUSR, dir, NULL, &fops_debug);
+}
+
+void mtk_bmt_detach(struct mtd_info *mtd)
+{
+	if (bmtd.mtd != mtd)
+		return;
+
+	if (bmtd.debugfs_dir)
+		debugfs_remove_recursive(bmtd.debugfs_dir);
+	bmtd.debugfs_dir = NULL;
+
+	kfree(bmtd.bbt_buf);
+	kfree(bmtd.data_buf);
+
+	mtd->_read_oob = bmtd._read_oob;
+	mtd->_write_oob = bmtd._write_oob;
+	mtd->_erase = bmtd._erase;
+	mtd->_block_isbad = bmtd._block_isbad;
+	mtd->_block_markbad = bmtd._block_markbad;
+	mtd->size = bmtd.total_blks << bmtd.blk_shift;
+
+	memset(&bmtd, 0, sizeof(bmtd));
+}
+
+
+int mtk_bmt_attach(struct mtd_info *mtd)
+{
+	struct device_node *np;
+	int ret = 0;
+
+	if (bmtd.mtd)
+		return -ENOSPC;
+
+	np = mtd_get_of_node(mtd);
+	if (!np)
+		return 0;
+
+	if (of_property_read_bool(np, "mediatek,bmt-v2"))
+		bmtd.ops = &mtk_bmt_v2_ops;
+	else if (of_property_read_bool(np, "mediatek,nmbm"))
+		bmtd.ops = &mtk_bmt_nmbm_ops;
+	else if (of_property_read_bool(np, "mediatek,bbt"))
+		bmtd.ops = &mtk_bmt_bbt_ops;
+	else
+		return 0;
+
+	bmtd.remap_range = of_get_property(np, "mediatek,bmt-remap-range",
+					   &bmtd.remap_range_len);
+	bmtd.remap_range_len /= 8;
+
+	bmtd.mtd = mtd;
+	mtk_bmt_replace_ops(mtd);
+
+	bmtd.blk_size = mtd->erasesize;
+	bmtd.blk_shift = ffs(bmtd.blk_size) - 1;
+	bmtd.pg_size = mtd->writesize;
+	bmtd.pg_shift = ffs(bmtd.pg_size) - 1;
+	bmtd.total_blks = mtd->size >> bmtd.blk_shift;
+
+	bmtd.data_buf = kzalloc(bmtd.pg_size + bmtd.mtd->oobsize, GFP_KERNEL);
+	if (!bmtd.data_buf) {
+		pr_info("nand: FATAL ERR: allocate buffer failed!\n");
+		ret = -1;
+		goto error;
+	}
+
+	memset(bmtd.data_buf, 0xff, bmtd.pg_size + bmtd.mtd->oobsize);
+
+	ret = bmtd.ops->init(np);
+	if (ret)
+		goto error;
+
+	mtk_bmt_add_debugfs();
+	return 0;
+
+error:
+	mtk_bmt_detach(mtd);
+	return ret;
+}
+
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Xiangsheng Hou <xiangsheng.hou@mediatek.com>, Felix Fietkau <nbd@nbd.name>");
+MODULE_DESCRIPTION("Bad Block mapping management v2 for MediaTek NAND Flash Driver");
+
diff --git a/6.12/target/linux/generic/files/drivers/mtd/nand/mtk_bmt.h b/6.12/target/linux/generic/files/drivers/mtd/nand/mtk_bmt.h
new file mode 100644
index 00000000..517ff741
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/nand/mtk_bmt.h
@@ -0,0 +1,137 @@
+#ifndef __MTK_BMT_PRIV_H
+#define __MTK_BMT_PRIV_H
+
+#include <linux/kernel.h>
+#include <linux/of.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/mtd/mtk_bmt.h>
+#include <linux/debugfs.h>
+
+#define MAIN_SIGNATURE_OFFSET   0
+#define OOB_SIGNATURE_OFFSET    1
+
+#define BBT_LOG(fmt, ...) pr_debug("[BBT][%s|%d] "fmt"\n", __func__, __LINE__, ##__VA_ARGS__)
+
+struct mtk_bmt_ops {
+	char *sig;
+	unsigned int sig_len;
+	int (*init)(struct device_node *np);
+	bool (*remap_block)(u16 block, u16 mapped_block, int copy_len);
+	void (*unmap_block)(u16 block);
+	int (*get_mapping_block)(int block);
+	int (*debug)(void *data, u64 val);
+};
+
+struct bbbt;
+struct nmbm_instance;
+
+struct bmt_desc {
+	struct mtd_info *mtd;
+	unsigned char *bbt_buf;
+	unsigned char *data_buf;
+
+	int (*_read_oob) (struct mtd_info *mtd, loff_t from,
+			  struct mtd_oob_ops *ops);
+	int (*_write_oob) (struct mtd_info *mtd, loff_t to,
+			   struct mtd_oob_ops *ops);
+	int (*_erase) (struct mtd_info *mtd, struct erase_info *instr);
+	int (*_block_isbad) (struct mtd_info *mtd, loff_t ofs);
+	int (*_block_markbad) (struct mtd_info *mtd, loff_t ofs);
+
+	const struct mtk_bmt_ops *ops;
+
+	union {
+		struct bbbt *bbt;
+		struct nmbm_instance *ni;
+	};
+
+	struct dentry *debugfs_dir;
+
+	u32 table_size;
+	u32 pg_size;
+	u32 blk_size;
+	u16 pg_shift;
+	u16 blk_shift;
+	/* bbt logical address */
+	u16 pool_lba;
+	/* bbt physical address */
+	u16 pool_pba;
+	/* Maximum count of bad blocks that the vendor guaranteed */
+	u16 bb_max;
+	/* Total blocks of the Nand Chip */
+	u16 total_blks;
+	/* The block(n) BMT is located at (bmt_tbl[n]) */
+	u16 bmt_blk_idx;
+	/* How many pages needs to store 'struct bbbt' */
+	u32 bmt_pgs;
+
+	const __be32 *remap_range;
+	int remap_range_len;
+
+	/* to compensate for driver level remapping */
+	u8 oob_offset;
+};
+
+extern struct bmt_desc bmtd;
+extern const struct mtk_bmt_ops mtk_bmt_v2_ops;
+extern const struct mtk_bmt_ops mtk_bmt_bbt_ops;
+extern const struct mtk_bmt_ops mtk_bmt_nmbm_ops;
+
+static inline u32 blk_pg(u16 block)
+{
+	return (u32)(block << (bmtd.blk_shift - bmtd.pg_shift));
+}
+
+static inline int
+bbt_nand_read(u32 page, unsigned char *dat, int dat_len,
+	      unsigned char *fdm, int fdm_len)
+{
+	struct mtd_oob_ops ops = {
+		.mode = MTD_OPS_PLACE_OOB,
+		.ooboffs = bmtd.oob_offset,
+		.oobbuf = fdm,
+		.ooblen = fdm_len,
+		.datbuf = dat,
+		.len = dat_len,
+	};
+	int ret;
+
+	ret = bmtd._read_oob(bmtd.mtd, page << bmtd.pg_shift, &ops);
+	if (ret < 0)
+		return ret;
+	if (ret)
+		pr_info("%s: %d bitflips\n", __func__, ret);
+	return 0;
+}
+
+static inline int bbt_nand_erase(u16 block)
+{
+	struct mtd_info *mtd = bmtd.mtd;
+	struct erase_info instr = {
+		.addr = (loff_t)block << bmtd.blk_shift,
+		.len = bmtd.blk_size,
+	};
+
+	return bmtd._erase(mtd, &instr);
+}
+
+static inline int write_bmt(u16 block, unsigned char *dat)
+{
+	struct mtd_oob_ops ops = {
+		.mode = MTD_OPS_PLACE_OOB,
+		.ooboffs = OOB_SIGNATURE_OFFSET + bmtd.oob_offset,
+		.oobbuf = bmtd.ops->sig,
+		.ooblen = bmtd.ops->sig_len,
+		.datbuf = dat,
+		.len = bmtd.bmt_pgs << bmtd.pg_shift,
+	};
+	loff_t addr = (loff_t)block << bmtd.blk_shift;
+
+	return bmtd._write_oob(bmtd.mtd, addr, &ops);
+}
+
+int bbt_nand_copy(u16 dest_blk, u16 src_blk, loff_t max_offset);
+bool mapping_block_in_range(int block, int *start, int *end);
+
+#endif
diff --git a/6.12/target/linux/generic/files/drivers/mtd/nand/mtk_bmt_bbt.c b/6.12/target/linux/generic/files/drivers/mtd/nand/mtk_bmt_bbt.c
new file mode 100644
index 00000000..519e1ed7
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/nand/mtk_bmt_bbt.c
@@ -0,0 +1,203 @@
+/*
+ * Copyright (c) 2017 MediaTek Inc.
+ * Author: Xiangsheng Hou <xiangsheng.hou@mediatek.com>
+ * Copyright (c) 2020-2022 Felix Fietkau <nbd@nbd.name>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include "mtk_bmt.h"
+
+static bool
+bbt_block_is_bad(u16 block)
+{
+	u8 cur = bmtd.bbt_buf[block / 4];
+
+	return cur & (3 << ((block % 4) * 2));
+}
+
+static void
+bbt_set_block_state(u16 block, bool bad)
+{
+	u8 mask = (3 << ((block % 4) * 2));
+
+	if (bad)
+		bmtd.bbt_buf[block / 4] |= mask;
+	else
+		bmtd.bbt_buf[block / 4] &= ~mask;
+
+	bbt_nand_erase(bmtd.bmt_blk_idx);
+	write_bmt(bmtd.bmt_blk_idx, bmtd.bbt_buf);
+}
+
+static int
+get_mapping_block_index_bbt(int block)
+{
+	int start, end, ofs;
+	int bad_blocks = 0;
+	int i;
+
+	if (!mapping_block_in_range(block, &start, &end))
+		return block;
+
+	start >>= bmtd.blk_shift;
+	end >>= bmtd.blk_shift;
+	/* skip bad blocks within the mapping range */
+	ofs = block - start;
+	for (i = start; i < end; i++) {
+		if (bbt_block_is_bad(i))
+			bad_blocks++;
+		else if (ofs)
+			ofs--;
+		else
+			break;
+	}
+
+	if (i < end)
+		return i;
+
+	/* when overflowing, remap remaining blocks to bad ones */
+	for (i = end - 1; bad_blocks > 0; i--) {
+		if (!bbt_block_is_bad(i))
+			continue;
+
+		bad_blocks--;
+		if (bad_blocks <= ofs)
+			return i;
+	}
+
+	return block;
+}
+
+static bool remap_block_bbt(u16 block, u16 mapped_blk, int copy_len)
+{
+	int start, end;
+	u16 new_blk;
+
+	if (!mapping_block_in_range(block, &start, &end))
+		return false;
+
+	bbt_set_block_state(mapped_blk, true);
+
+	new_blk = get_mapping_block_index_bbt(block);
+	bbt_nand_erase(new_blk);
+	if (copy_len > 0)
+		bbt_nand_copy(new_blk, mapped_blk, copy_len);
+
+	return true;
+}
+
+static void
+unmap_block_bbt(u16 block)
+{
+	bbt_set_block_state(block, false);
+}
+
+static int
+mtk_bmt_read_bbt(void)
+{
+	u8 oob_buf[8];
+	int i;
+
+	for (i = bmtd.total_blks - 1; i >= bmtd.total_blks - 5; i--) {
+		u32 page = i << (bmtd.blk_shift - bmtd.pg_shift);
+
+		if (bbt_nand_read(page, bmtd.bbt_buf, bmtd.pg_size,
+				  oob_buf, sizeof(oob_buf))) {
+			pr_info("read_bbt: could not read block %d\n", i);
+			continue;
+		}
+
+		if (oob_buf[0] != 0xff) {
+			pr_info("read_bbt: bad block at %d\n", i);
+			continue;
+		}
+
+		if (memcmp(&oob_buf[1], "mtknand", 7) != 0) {
+			pr_info("read_bbt: signature mismatch in block %d\n", i);
+			print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET, 16, 1, oob_buf, 8, 1);
+			continue;
+		}
+
+		pr_info("read_bbt: found bbt at block %d\n", i);
+		bmtd.bmt_blk_idx = i;
+		return 0;
+	}
+
+	return -EIO;
+}
+
+
+static int
+mtk_bmt_init_bbt(struct device_node *np)
+{
+	int buf_size = round_up(bmtd.total_blks >> 2, bmtd.blk_size);
+	int ret;
+
+	bmtd.bbt_buf = kmalloc(buf_size, GFP_KERNEL);
+	if (!bmtd.bbt_buf)
+		return -ENOMEM;
+
+	memset(bmtd.bbt_buf, 0xff, buf_size);
+	bmtd.mtd->size -= 4 * bmtd.mtd->erasesize;
+
+	ret = mtk_bmt_read_bbt();
+	if (ret)
+		return ret;
+
+	bmtd.bmt_pgs = buf_size / bmtd.pg_size;
+
+	return 0;
+}
+
+static int mtk_bmt_debug_bbt(void *data, u64 val)
+{
+	char buf[5];
+	int i, k;
+
+	switch (val) {
+	case 0:
+		for (i = 0; i < bmtd.total_blks; i += 4) {
+			u8 cur = bmtd.bbt_buf[i / 4];
+
+			for (k = 0; k < 4; k++, cur >>= 2)
+				buf[k] = (cur & 3) ? 'B' : '.';
+
+			buf[4] = 0;
+			printk("[%06x] %s\n", i * bmtd.blk_size, buf);
+		}
+		break;
+	case 100:
+#if 0
+		for (i = bmtd.bmt_blk_idx; i < bmtd.total_blks - 1; i++)
+			bbt_nand_erase(bmtd.bmt_blk_idx);
+#endif
+
+		bmtd.bmt_blk_idx = bmtd.total_blks - 1;
+		bbt_nand_erase(bmtd.bmt_blk_idx);
+		write_bmt(bmtd.bmt_blk_idx, bmtd.bbt_buf);
+		break;
+	default:
+		break;
+	}
+	return 0;
+}
+
+const struct mtk_bmt_ops mtk_bmt_bbt_ops = {
+	.sig = "mtknand",
+	.sig_len = 7,
+	.init = mtk_bmt_init_bbt,
+	.remap_block = remap_block_bbt,
+	.unmap_block = unmap_block_bbt,
+	.get_mapping_block = get_mapping_block_index_bbt,
+	.debug = mtk_bmt_debug_bbt,
+};
diff --git a/6.12/target/linux/generic/files/drivers/mtd/nand/mtk_bmt_nmbm.c b/6.12/target/linux/generic/files/drivers/mtd/nand/mtk_bmt_nmbm.c
new file mode 100644
index 00000000..a896e49e
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/nand/mtk_bmt_nmbm.c
@@ -0,0 +1,2348 @@
+#include <linux/crc32.h>
+#include <linux/slab.h>
+#include "mtk_bmt.h"
+
+#define nlog_err(ni, ...) printk(KERN_ERR __VA_ARGS__)
+#define nlog_info(ni, ...) printk(KERN_INFO __VA_ARGS__)
+#define nlog_debug(ni, ...) printk(KERN_INFO __VA_ARGS__)
+#define nlog_warn(ni, ...) printk(KERN_WARNING __VA_ARGS__)
+
+#define NMBM_MAGIC_SIGNATURE			0x304d4d4e	/* NMM0 */
+#define NMBM_MAGIC_INFO_TABLE			0x314d4d4e	/* NMM1 */
+
+#define NMBM_VERSION_MAJOR_S			0
+#define NMBM_VERSION_MAJOR_M			0xffff
+#define NMBM_VERSION_MINOR_S			16
+#define NMBM_VERSION_MINOR_M			0xffff
+#define NMBM_VERSION_MAKE(major, minor)		(((major) & NMBM_VERSION_MAJOR_M) | \
+						(((minor) & NMBM_VERSION_MINOR_M) << \
+						NMBM_VERSION_MINOR_S))
+#define NMBM_VERSION_MAJOR_GET(ver)		(((ver) >> NMBM_VERSION_MAJOR_S) & \
+						NMBM_VERSION_MAJOR_M)
+#define NMBM_VERSION_MINOR_GET(ver)		(((ver) >> NMBM_VERSION_MINOR_S) & \
+						NMBM_VERSION_MINOR_M)
+
+#define NMBM_BITMAP_UNIT_SIZE			(sizeof(u32))
+#define NMBM_BITMAP_BITS_PER_BLOCK		2
+#define NMBM_BITMAP_BITS_PER_UNIT		(8 * sizeof(u32))
+#define NMBM_BITMAP_BLOCKS_PER_UNIT		(NMBM_BITMAP_BITS_PER_UNIT / \
+						 NMBM_BITMAP_BITS_PER_BLOCK)
+
+#define NMBM_SPARE_BLOCK_MULTI			1
+#define NMBM_SPARE_BLOCK_DIV			2
+#define NMBM_SPARE_BLOCK_MIN			2
+
+#define NMBM_MGMT_DIV				16
+#define NMBM_MGMT_BLOCKS_MIN			32
+
+#define NMBM_TRY_COUNT				3
+
+#define BLOCK_ST_BAD				0
+#define BLOCK_ST_NEED_REMAP			2
+#define BLOCK_ST_GOOD				3
+#define BLOCK_ST_MASK				3
+
+#define NMBM_VER_MAJOR			1
+#define NMBM_VER_MINOR			0
+#define NMBM_VER			NMBM_VERSION_MAKE(NMBM_VER_MAJOR, \
+							  NMBM_VER_MINOR)
+
+struct nmbm_header {
+	u32 magic;
+	u32 version;
+	u32 size;
+	u32 checksum;
+};
+
+struct nmbm_signature {
+	struct nmbm_header header;
+	uint64_t nand_size;
+	u32 block_size;
+	u32 page_size;
+	u32 spare_size;
+	u32 mgmt_start_pb;
+	u8 max_try_count;
+	u8 padding[3];
+};
+
+struct nmbm_info_table_header {
+	struct nmbm_header header;
+	u32 write_count;
+	u32 state_table_off;
+	u32 mapping_table_off;
+	u32 padding;
+};
+
+struct nmbm_instance {
+	u32 rawpage_size;
+	u32 rawblock_size;
+	u32 rawchip_size;
+
+	struct nmbm_signature signature;
+
+	u8 *info_table_cache;
+	u32 info_table_size;
+	u32 info_table_spare_blocks;
+	struct nmbm_info_table_header info_table;
+
+	u32 *block_state;
+	u32 block_state_changed;
+	u32 state_table_size;
+
+	int32_t *block_mapping;
+	u32 block_mapping_changed;
+	u32 mapping_table_size;
+
+	u8 *page_cache;
+
+	int protected;
+
+	u32 block_count;
+	u32 data_block_count;
+
+	u32 mgmt_start_ba;
+	u32 main_table_ba;
+	u32 backup_table_ba;
+	u32 mapping_blocks_ba;
+	u32 mapping_blocks_top_ba;
+	u32 signature_ba;
+
+	u32 max_ratio;
+	u32 max_reserved_blocks;
+	bool empty_page_ecc_ok;
+	bool force_create;
+};
+
+static inline u32 nmbm_crc32(u32 crcval, const void *buf, size_t size)
+{
+	unsigned int chksz;
+	const unsigned char *p = buf;
+
+	while (size) {
+		if (size > UINT_MAX)
+			chksz = UINT_MAX;
+		else
+			chksz = (uint)size;
+
+		crcval = crc32_le(crcval, p, chksz);
+		size -= chksz;
+		p += chksz;
+	}
+
+	return crcval;
+}
+/*
+ * nlog_table_creation - Print log of table creation event
+ * @ni: NMBM instance structure
+ * @main_table: whether the table is main info table
+ * @start_ba: start block address of the table
+ * @end_ba: block address after the end of the table
+ */
+static void nlog_table_creation(struct nmbm_instance *ni, bool main_table,
+			       uint32_t start_ba, uint32_t end_ba)
+{
+	if (start_ba == end_ba - 1)
+		nlog_info(ni, "%s info table has been written to block %u\n",
+			 main_table ? "Main" : "Backup", start_ba);
+	else
+		nlog_info(ni, "%s info table has been written to block %u-%u\n",
+			 main_table ? "Main" : "Backup", start_ba, end_ba - 1);
+}
+
+/*
+ * nlog_table_update - Print log of table update event
+ * @ni: NMBM instance structure
+ * @main_table: whether the table is main info table
+ * @start_ba: start block address of the table
+ * @end_ba: block address after the end of the table
+ */
+static void nlog_table_update(struct nmbm_instance *ni, bool main_table,
+			     uint32_t start_ba, uint32_t end_ba)
+{
+	if (start_ba == end_ba - 1)
+		nlog_debug(ni, "%s info table has been updated in block %u\n",
+			  main_table ? "Main" : "Backup", start_ba);
+	else
+		nlog_debug(ni, "%s info table has been updated in block %u-%u\n",
+			  main_table ? "Main" : "Backup", start_ba, end_ba - 1);
+}
+
+/*
+ * nlog_table_found - Print log of table found event
+ * @ni: NMBM instance structure
+ * @first_table: whether the table is first found info table
+ * @write_count: write count of the info table
+ * @start_ba: start block address of the table
+ * @end_ba: block address after the end of the table
+ */
+static void nlog_table_found(struct nmbm_instance *ni, bool first_table,
+			    uint32_t write_count, uint32_t start_ba,
+			    uint32_t end_ba)
+{
+	if (start_ba == end_ba - 1)
+		nlog_info(ni, "%s info table with writecount %u found in block %u\n",
+			 first_table ? "First" : "Second", write_count,
+			 start_ba);
+	else
+		nlog_info(ni, "%s info table with writecount %u found in block %u-%u\n",
+			 first_table ? "First" : "Second", write_count,
+			 start_ba, end_ba - 1);
+}
+
+/*****************************************************************************/
+/* Address conversion functions */
+/*****************************************************************************/
+
+/*
+ * ba2addr - Convert a block address to linear address
+ * @ni: NMBM instance structure
+ * @ba: Block address
+ */
+static uint64_t ba2addr(struct nmbm_instance *ni, uint32_t ba)
+{
+	return (uint64_t)ba << bmtd.blk_shift;
+}
+/*
+ * size2blk - Get minimum required blocks for storing specific size of data
+ * @ni: NMBM instance structure
+ * @size: size for storing
+ */
+static uint32_t size2blk(struct nmbm_instance *ni, uint64_t size)
+{
+	return (size + bmtd.blk_size - 1) >> bmtd.blk_shift;
+}
+
+/*****************************************************************************/
+/* High level NAND chip APIs */
+/*****************************************************************************/
+
+/*
+ * nmbm_read_phys_page - Read page with retry
+ * @ni: NMBM instance structure
+ * @addr: linear address where the data will be read from
+ * @data: the main data to be read
+ * @oob: the oob data to be read
+ *
+ * Read a page for at most NMBM_TRY_COUNT times.
+ *
+ * Return 0 for success, positive value for corrected bitflip count,
+ * -EBADMSG for ecc error, other negative values for other errors
+ */
+static int nmbm_read_phys_page(struct nmbm_instance *ni, uint64_t addr,
+			       void *data, void *oob)
+{
+	int tries, ret;
+
+	for (tries = 0; tries < NMBM_TRY_COUNT; tries++) {
+		struct mtd_oob_ops ops = {
+			.mode = MTD_OPS_PLACE_OOB,
+			.oobbuf = oob,
+			.datbuf = data,
+		};
+
+		if (data)
+			ops.len = bmtd.pg_size;
+		if (oob)
+			ops.ooblen = mtd_oobavail(bmtd.mtd, &ops);
+
+		ret = bmtd._read_oob(bmtd.mtd, addr, &ops);
+		if (ret == -EUCLEAN)
+			return min_t(u32, bmtd.mtd->bitflip_threshold + 1,
+				     bmtd.mtd->ecc_strength);
+		if (ret >= 0)
+			return 0;
+	}
+
+	if (ret != -EBADMSG)
+		nlog_err(ni, "Page read failed at address 0x%08llx\n", addr);
+
+	return ret;
+}
+
+/*
+ * nmbm_write_phys_page - Write page with retry
+ * @ni: NMBM instance structure
+ * @addr: linear address where the data will be written to
+ * @data: the main data to be written
+ * @oob: the oob data to be written
+ *
+ * Write a page for at most NMBM_TRY_COUNT times.
+ */
+static bool nmbm_write_phys_page(struct nmbm_instance *ni, uint64_t addr,
+				 const void *data, const void *oob)
+{
+	int tries, ret;
+
+	for (tries = 0; tries < NMBM_TRY_COUNT; tries++) {
+		struct mtd_oob_ops ops = {
+			.mode = MTD_OPS_PLACE_OOB,
+			.oobbuf = (void *)oob,
+			.datbuf = (void *)data,
+		};
+
+		if (data)
+			ops.len = bmtd.pg_size;
+		if (oob)
+			ops.ooblen = mtd_oobavail(bmtd.mtd, &ops);
+
+		ret = bmtd._write_oob(bmtd.mtd, addr, &ops);
+		if (!ret)
+			return true;
+	}
+
+	nlog_err(ni, "Page write failed at address 0x%08llx\n", addr);
+
+	return false;
+}
+
+/*
+ * nmbm_erase_phys_block - Erase a block with retry
+ * @ni: NMBM instance structure
+ * @addr: Linear address
+ *
+ * Erase a block for at most NMBM_TRY_COUNT times.
+ */
+static bool nmbm_erase_phys_block(struct nmbm_instance *ni, uint64_t addr)
+{
+	int tries, ret;
+
+	for (tries = 0; tries < NMBM_TRY_COUNT; tries++) {
+		struct erase_info ei = {
+			.addr = addr,
+			.len = bmtd.mtd->erasesize,
+		};
+
+		ret = bmtd._erase(bmtd.mtd, &ei);
+		if (!ret)
+			return true;
+	}
+
+	nlog_err(ni, "Block erasure failed at address 0x%08llx\n", addr);
+
+	return false;
+}
+
+/*
+ * nmbm_check_bad_phys_block - Check whether a block is marked bad in OOB
+ * @ni: NMBM instance structure
+ * @ba: block address
+ */
+static bool nmbm_check_bad_phys_block(struct nmbm_instance *ni, uint32_t ba)
+{
+	uint64_t addr = ba2addr(ni, ba);
+
+	return bmtd._block_isbad(bmtd.mtd, addr);
+}
+
+/*
+ * nmbm_mark_phys_bad_block - Mark a block bad
+ * @ni: NMBM instance structure
+ * @addr: Linear address
+ */
+static int nmbm_mark_phys_bad_block(struct nmbm_instance *ni, uint32_t ba)
+{
+	uint64_t addr = ba2addr(ni, ba);
+
+	nlog_info(ni, "Block %u [0x%08llx] will be marked bad\n", ba, addr);
+
+	return bmtd._block_markbad(bmtd.mtd, addr);
+}
+
+/*****************************************************************************/
+/* NMBM related functions */
+/*****************************************************************************/
+
+/*
+ * nmbm_check_header - Check whether a NMBM structure is valid
+ * @data: pointer to a NMBM structure with a NMBM header at beginning
+ * @size: Size of the buffer pointed by @header
+ *
+ * The size of the NMBM structure may be larger than NMBM header,
+ * e.g. block mapping table and block state table.
+ */
+static bool nmbm_check_header(const void *data, uint32_t size)
+{
+	const struct nmbm_header *header = data;
+	struct nmbm_header nhdr;
+	uint32_t new_checksum;
+
+	/*
+	 * Make sure expected structure size is equal or smaller than
+	 * buffer size.
+	 */
+	if (header->size > size)
+		return false;
+
+	memcpy(&nhdr, data, sizeof(nhdr));
+
+	nhdr.checksum = 0;
+	new_checksum = nmbm_crc32(0, &nhdr, sizeof(nhdr));
+	if (header->size > sizeof(nhdr))
+		new_checksum = nmbm_crc32(new_checksum,
+			(const uint8_t *)data + sizeof(nhdr),
+			header->size - sizeof(nhdr));
+
+	if (header->checksum != new_checksum)
+		return false;
+
+	return true;
+}
+
+/*
+ * nmbm_update_checksum - Update checksum of a NMBM structure
+ * @header: pointer to a NMBM structure with a NMBM header at beginning
+ *
+ * The size of the NMBM structure must be specified by @header->size
+ */
+static void nmbm_update_checksum(struct nmbm_header *header)
+{
+	header->checksum = 0;
+	header->checksum = nmbm_crc32(0, header, header->size);
+}
+
+/*
+ * nmbm_get_spare_block_count - Calculate number of blocks should be reserved
+ * @block_count: number of blocks of data
+ *
+ * Calculate number of blocks should be reserved for data
+ */
+static uint32_t nmbm_get_spare_block_count(uint32_t block_count)
+{
+	uint32_t val;
+
+	val = (block_count + NMBM_SPARE_BLOCK_DIV / 2) / NMBM_SPARE_BLOCK_DIV;
+	val *= NMBM_SPARE_BLOCK_MULTI;
+
+	if (val < NMBM_SPARE_BLOCK_MIN)
+		val = NMBM_SPARE_BLOCK_MIN;
+
+	return val;
+}
+
+/*
+ * nmbm_get_block_state_raw - Get state of a block from raw block state table
+ * @block_state: pointer to raw block state table (bitmap)
+ * @ba: block address
+ */
+static uint32_t nmbm_get_block_state_raw(u32 *block_state,
+					 uint32_t ba)
+{
+	uint32_t unit, shift;
+
+	unit = ba / NMBM_BITMAP_BLOCKS_PER_UNIT;
+	shift = (ba % NMBM_BITMAP_BLOCKS_PER_UNIT) * NMBM_BITMAP_BITS_PER_BLOCK;
+
+	return (block_state[unit] >> shift) & BLOCK_ST_MASK;
+}
+
+/*
+ * nmbm_get_block_state - Get state of a block from block state table
+ * @ni: NMBM instance structure
+ * @ba: block address
+ */
+static uint32_t nmbm_get_block_state(struct nmbm_instance *ni, uint32_t ba)
+{
+	return nmbm_get_block_state_raw(ni->block_state, ba);
+}
+
+/*
+ * nmbm_set_block_state - Set state of a block to block state table
+ * @ni: NMBM instance structure
+ * @ba: block address
+ * @state: block state
+ *
+ * Set state of a block. If the block state changed, ni->block_state_changed
+ * will be increased.
+ */
+static bool nmbm_set_block_state(struct nmbm_instance *ni, uint32_t ba,
+				 uint32_t state)
+{
+	uint32_t unit, shift, orig;
+	u32 uv;
+
+	unit = ba / NMBM_BITMAP_BLOCKS_PER_UNIT;
+	shift = (ba % NMBM_BITMAP_BLOCKS_PER_UNIT) * NMBM_BITMAP_BITS_PER_BLOCK;
+
+	orig = (ni->block_state[unit] >> shift) & BLOCK_ST_MASK;
+	state &= BLOCK_ST_MASK;
+
+	uv = ni->block_state[unit] & (~(BLOCK_ST_MASK << shift));
+	uv |= state << shift;
+	ni->block_state[unit] = uv;
+
+	if (orig != state) {
+		ni->block_state_changed++;
+		return true;
+	}
+
+	return false;
+}
+
+/*
+ * nmbm_block_walk_asc - Skip specified number of good blocks, ascending addr.
+ * @ni: NMBM instance structure
+ * @ba: start physical block address
+ * @nba: return physical block address after walk
+ * @count: number of good blocks to be skipped
+ * @limit: highest block address allowed for walking
+ *
+ * Start from @ba, skipping any bad blocks, counting @count good blocks, and
+ * return the next good block address.
+ *
+ * If no enough good blocks counted while @limit reached, false will be returned.
+ *
+ * If @count == 0, nearest good block address will be returned.
+ * @limit is not counted in walking.
+ */
+static bool nmbm_block_walk_asc(struct nmbm_instance *ni, uint32_t ba,
+				uint32_t *nba, uint32_t count,
+				uint32_t limit)
+{
+	int32_t nblock = count;
+
+	if (limit >= ni->block_count)
+		limit = ni->block_count - 1;
+
+	while (ba < limit) {
+		if (nmbm_get_block_state(ni, ba) == BLOCK_ST_GOOD)
+			nblock--;
+
+		if (nblock < 0) {
+			*nba = ba;
+			return true;
+		}
+
+		ba++;
+	}
+
+	return false;
+}
+
+/*
+ * nmbm_block_walk_desc - Skip specified number of good blocks, descending addr
+ * @ni: NMBM instance structure
+ * @ba: start physical block address
+ * @nba: return physical block address after walk
+ * @count: number of good blocks to be skipped
+ * @limit: lowest block address allowed for walking
+ *
+ * Start from @ba, skipping any bad blocks, counting @count good blocks, and
+ * return the next good block address.
+ *
+ * If no enough good blocks counted while @limit reached, false will be returned.
+ *
+ * If @count == 0, nearest good block address will be returned.
+ * @limit is not counted in walking.
+ */
+static bool nmbm_block_walk_desc(struct nmbm_instance *ni, uint32_t ba,
+				 uint32_t *nba, uint32_t count, uint32_t limit)
+{
+	int32_t nblock = count;
+
+	if (limit >= ni->block_count)
+		limit = ni->block_count - 1;
+
+	while (ba > limit) {
+		if (nmbm_get_block_state(ni, ba) == BLOCK_ST_GOOD)
+			nblock--;
+
+		if (nblock < 0) {
+			*nba = ba;
+			return true;
+		}
+
+		ba--;
+	}
+
+	return false;
+}
+
+/*
+ * nmbm_block_walk - Skip specified number of good blocks from curr. block addr
+ * @ni: NMBM instance structure
+ * @ascending: whether to walk ascending
+ * @ba: start physical block address
+ * @nba: return physical block address after walk
+ * @count: number of good blocks to be skipped
+ * @limit: highest/lowest block address allowed for walking
+ *
+ * Start from @ba, skipping any bad blocks, counting @count good blocks, and
+ * return the next good block address.
+ *
+ * If no enough good blocks counted while @limit reached, false will be returned.
+ *
+ * If @count == 0, nearest good block address will be returned.
+ * @limit can be set to negative if no limit required.
+ * @limit is not counted in walking.
+ */
+static bool nmbm_block_walk(struct nmbm_instance *ni, bool ascending,
+			    uint32_t ba, uint32_t *nba, int32_t count,
+			    int32_t limit)
+{
+	if (ascending)
+		return nmbm_block_walk_asc(ni, ba, nba, count, limit);
+
+	return nmbm_block_walk_desc(ni, ba, nba, count, limit);
+}
+
+/*
+ * nmbm_scan_badblocks - Scan and record all bad blocks
+ * @ni: NMBM instance structure
+ *
+ * Scan the entire lower NAND chip and record all bad blocks in to block state
+ * table.
+ */
+static void nmbm_scan_badblocks(struct nmbm_instance *ni)
+{
+	uint32_t ba;
+
+	for (ba = 0; ba < ni->block_count; ba++) {
+		if (nmbm_check_bad_phys_block(ni, ba)) {
+			nmbm_set_block_state(ni, ba, BLOCK_ST_BAD);
+			nlog_info(ni, "Bad block %u [0x%08llx]\n", ba,
+				 ba2addr(ni, ba));
+		}
+	}
+}
+
+/*
+ * nmbm_build_mapping_table - Build initial block mapping table
+ * @ni: NMBM instance structure
+ *
+ * The initial mapping table will be compatible with the stratage of
+ * factory production.
+ */
+static void nmbm_build_mapping_table(struct nmbm_instance *ni)
+{
+	uint32_t pb, lb;
+
+	for (pb = 0, lb = 0; pb < ni->mgmt_start_ba; pb++) {
+		if (nmbm_get_block_state(ni, pb) == BLOCK_ST_BAD)
+			continue;
+
+		/* Always map to the next good block */
+		ni->block_mapping[lb++] = pb;
+	}
+
+	ni->data_block_count = lb;
+
+	/* Unusable/Management blocks */
+	for (pb = lb; pb < ni->block_count; pb++)
+		ni->block_mapping[pb] = -1;
+}
+
+/*
+ * nmbm_erase_block_and_check - Erase a block and check its usability
+ * @ni: NMBM instance structure
+ * @ba: block address to be erased
+ *
+ * Erase a block anc check its usability
+ *
+ * Return true if the block is usable, false if erasure failure or the block
+ * has too many bitflips.
+ */
+static bool nmbm_erase_block_and_check(struct nmbm_instance *ni, uint32_t ba)
+{
+	uint64_t addr, off;
+	bool success;
+	int ret;
+
+	success = nmbm_erase_phys_block(ni, ba2addr(ni, ba));
+	if (!success)
+		return false;
+
+	if (!ni->empty_page_ecc_ok)
+		return true;
+
+	/* Check every page to make sure there aren't too many bitflips */
+
+	addr = ba2addr(ni, ba);
+
+	for (off = 0; off < bmtd.blk_size; off += bmtd.pg_size) {
+		ret = nmbm_read_phys_page(ni, addr + off, ni->page_cache, NULL);
+		if (ret == -EBADMSG) {
+			/*
+			 * empty_page_ecc_ok means the empty page is
+			 * still protected by ECC. So reading pages with ECC
+			 * enabled and -EBADMSG means there are too many
+			 * bitflips that can't be recovered, and the block
+			 * containing the page should be marked bad.
+			 */
+			nlog_err(ni,
+				 "Too many bitflips in empty page at 0x%llx\n",
+				 addr + off);
+			return false;
+		}
+	}
+
+	return true;
+}
+
+/*
+ * nmbm_erase_range - Erase a range of blocks
+ * @ni: NMBM instance structure
+ * @ba: block address where the erasure will start
+ * @limit: top block address allowed for erasure
+ *
+ * Erase blocks within the specific range. Newly-found bad blocks will be
+ * marked.
+ *
+ * @limit is not counted into the allowed erasure address.
+ */
+static void nmbm_erase_range(struct nmbm_instance *ni, uint32_t ba,
+			     uint32_t limit)
+{
+	bool success;
+
+	while (ba < limit) {
+		if (nmbm_get_block_state(ni, ba) != BLOCK_ST_GOOD)
+			goto next_block;
+
+		/* Insurance to detect unexpected bad block marked by user */
+		if (nmbm_check_bad_phys_block(ni, ba)) {
+			nmbm_set_block_state(ni, ba, BLOCK_ST_BAD);
+			goto next_block;
+		}
+
+		success = nmbm_erase_block_and_check(ni, ba);
+		if (success)
+			goto next_block;
+
+		nmbm_mark_phys_bad_block(ni, ba);
+		nmbm_set_block_state(ni, ba, BLOCK_ST_BAD);
+
+	next_block:
+		ba++;
+	}
+}
+
+/*
+ * nmbm_write_repeated_data - Write critical data to a block with retry
+ * @ni: NMBM instance structure
+ * @ba: block address where the data will be written to
+ * @data: the data to be written
+ * @size: size of the data
+ *
+ * Write data to every page of the block. Success only if all pages within
+ * this block have been successfully written.
+ *
+ * Make sure data size is not bigger than one page.
+ *
+ * This function will write and verify every page for at most
+ * NMBM_TRY_COUNT times.
+ */
+static bool nmbm_write_repeated_data(struct nmbm_instance *ni, uint32_t ba,
+				     const void *data, uint32_t size)
+{
+	uint64_t addr, off;
+	bool success;
+	int ret;
+
+	if (size > bmtd.pg_size)
+		return false;
+
+	addr = ba2addr(ni, ba);
+
+	for (off = 0; off < bmtd.blk_size; off += bmtd.pg_size) {
+		/* Prepare page data. fill 0xff to unused region */
+		memcpy(ni->page_cache, data, size);
+		memset(ni->page_cache + size, 0xff, ni->rawpage_size - size);
+
+		success = nmbm_write_phys_page(ni, addr + off, ni->page_cache, NULL);
+		if (!success)
+			return false;
+
+		/* Verify the data just written. ECC error indicates failure */
+		ret = nmbm_read_phys_page(ni, addr + off, ni->page_cache, NULL);
+		if (ret < 0)
+			return false;
+
+		if (memcmp(ni->page_cache, data, size))
+			return false;
+	}
+
+	return true;
+}
+
+/*
+ * nmbm_write_signature - Write signature to NAND chip
+ * @ni: NMBM instance structure
+ * @limit: top block address allowed for writing
+ * @signature: the signature to be written
+ * @signature_ba: the actual block address where signature is written to
+ *
+ * Write signature within a specific range, from chip bottom to limit.
+ * At most one block will be written.
+ *
+ * @limit is not counted into the allowed write address.
+ */
+static bool nmbm_write_signature(struct nmbm_instance *ni, uint32_t limit,
+				 const struct nmbm_signature *signature,
+				 uint32_t *signature_ba)
+{
+	uint32_t ba = ni->block_count - 1;
+	bool success;
+
+	while (ba > limit) {
+		if (nmbm_get_block_state(ni, ba) != BLOCK_ST_GOOD)
+			goto next_block;
+
+		/* Insurance to detect unexpected bad block marked by user */
+		if (nmbm_check_bad_phys_block(ni, ba)) {
+			nmbm_set_block_state(ni, ba, BLOCK_ST_BAD);
+			goto next_block;
+		}
+
+		success = nmbm_erase_block_and_check(ni, ba);
+		if (!success)
+			goto skip_bad_block;
+
+		success = nmbm_write_repeated_data(ni, ba, signature,
+						   sizeof(*signature));
+		if (success) {
+			*signature_ba = ba;
+			return true;
+		}
+
+	skip_bad_block:
+		nmbm_mark_phys_bad_block(ni, ba);
+		nmbm_set_block_state(ni, ba, BLOCK_ST_BAD);
+
+	next_block:
+		ba--;
+	};
+
+	return false;
+}
+
+/*
+ * nmbn_read_data - Read data
+ * @ni: NMBM instance structure
+ * @addr: linear address where the data will be read from
+ * @data: the data to be read
+ * @size: the size of data
+ *
+ * Read data range.
+ * Every page will be tried for at most NMBM_TRY_COUNT times.
+ *
+ * Return 0 for success, positive value for corrected bitflip count,
+ * -EBADMSG for ecc error, other negative values for other errors
+ */
+static int nmbn_read_data(struct nmbm_instance *ni, uint64_t addr, void *data,
+			  uint32_t size)
+{
+	uint64_t off = addr;
+	uint8_t *ptr = data;
+	uint32_t sizeremain = size, chunksize, leading;
+	int ret;
+
+	while (sizeremain) {
+		leading = off & (bmtd.pg_size - 1);
+		chunksize = bmtd.pg_size - leading;
+		if (chunksize > sizeremain)
+			chunksize = sizeremain;
+
+		if (chunksize == bmtd.pg_size) {
+			ret = nmbm_read_phys_page(ni, off - leading, ptr, NULL);
+			if (ret < 0)
+				return ret;
+		} else {
+			ret = nmbm_read_phys_page(ni, off - leading,
+						  ni->page_cache, NULL);
+			if (ret < 0)
+				return ret;
+
+			memcpy(ptr, ni->page_cache + leading, chunksize);
+		}
+
+		off += chunksize;
+		ptr += chunksize;
+		sizeremain -= chunksize;
+	}
+
+	return 0;
+}
+
+/*
+ * nmbn_write_verify_data - Write data with validation
+ * @ni: NMBM instance structure
+ * @addr: linear address where the data will be written to
+ * @data: the data to be written
+ * @size: the size of data
+ *
+ * Write data and verify.
+ * Every page will be tried for at most NMBM_TRY_COUNT times.
+ */
+static bool nmbn_write_verify_data(struct nmbm_instance *ni, uint64_t addr,
+				   const void *data, uint32_t size)
+{
+	uint64_t off = addr;
+	const uint8_t *ptr = data;
+	uint32_t sizeremain = size, chunksize, leading;
+	bool success;
+	int ret;
+
+	while (sizeremain) {
+		leading = off & (bmtd.pg_size - 1);
+		chunksize = bmtd.pg_size - leading;
+		if (chunksize > sizeremain)
+			chunksize = sizeremain;
+
+		/* Prepare page data. fill 0xff to unused region */
+		memset(ni->page_cache, 0xff, ni->rawpage_size);
+		memcpy(ni->page_cache + leading, ptr, chunksize);
+
+		success = nmbm_write_phys_page(ni, off - leading,
+					       ni->page_cache, NULL);
+		if (!success)
+			return false;
+
+		/* Verify the data just written. ECC error indicates failure */
+		ret = nmbm_read_phys_page(ni, off - leading, ni->page_cache, NULL);
+		if (ret < 0)
+			return false;
+
+		if (memcmp(ni->page_cache + leading, ptr, chunksize))
+			return false;
+
+		off += chunksize;
+		ptr += chunksize;
+		sizeremain -= chunksize;
+	}
+
+	return true;
+}
+
+/*
+ * nmbm_write_mgmt_range - Write management data into NAND within a range
+ * @ni: NMBM instance structure
+ * @addr: preferred start block address for writing
+ * @limit: highest block address allowed for writing
+ * @data: the data to be written
+ * @size: the size of data
+ * @actual_start_ba: actual start block address of data
+ * @actual_end_ba: block address after the end of data
+ *
+ * @limit is not counted into the allowed write address.
+ */
+static bool nmbm_write_mgmt_range(struct nmbm_instance *ni, uint32_t ba,
+				  uint32_t limit, const void *data,
+				  uint32_t size, uint32_t *actual_start_ba,
+				  uint32_t *actual_end_ba)
+{
+	const uint8_t *ptr = data;
+	uint32_t sizeremain = size, chunksize;
+	bool success;
+
+	while (sizeremain && ba < limit) {
+		chunksize = sizeremain;
+		if (chunksize > bmtd.blk_size)
+			chunksize = bmtd.blk_size;
+
+		if (nmbm_get_block_state(ni, ba) != BLOCK_ST_GOOD)
+			goto next_block;
+
+		/* Insurance to detect unexpected bad block marked by user */
+		if (nmbm_check_bad_phys_block(ni, ba)) {
+			nmbm_set_block_state(ni, ba, BLOCK_ST_BAD);
+			goto next_block;
+		}
+
+		success = nmbm_erase_block_and_check(ni, ba);
+		if (!success)
+			goto skip_bad_block;
+
+		success = nmbn_write_verify_data(ni, ba2addr(ni, ba), ptr,
+						 chunksize);
+		if (!success)
+			goto skip_bad_block;
+
+		if (sizeremain == size)
+			*actual_start_ba = ba;
+
+		ptr += chunksize;
+		sizeremain -= chunksize;
+
+		goto next_block;
+
+	skip_bad_block:
+		nmbm_mark_phys_bad_block(ni, ba);
+		nmbm_set_block_state(ni, ba, BLOCK_ST_BAD);
+
+	next_block:
+		ba++;
+	}
+
+	if (sizeremain)
+		return false;
+
+	*actual_end_ba = ba;
+
+	return true;
+}
+
+/*
+ * nmbm_generate_info_table_cache - Generate info table cache data
+ * @ni: NMBM instance structure
+ *
+ * Generate info table cache data to be written into flash.
+ */
+static bool nmbm_generate_info_table_cache(struct nmbm_instance *ni)
+{
+	bool changed = false;
+
+	memset(ni->info_table_cache, 0xff, ni->info_table_size);
+
+	memcpy(ni->info_table_cache + ni->info_table.state_table_off,
+	       ni->block_state, ni->state_table_size);
+
+	memcpy(ni->info_table_cache + ni->info_table.mapping_table_off,
+		ni->block_mapping, ni->mapping_table_size);
+
+	ni->info_table.header.magic = NMBM_MAGIC_INFO_TABLE;
+	ni->info_table.header.version = NMBM_VER;
+	ni->info_table.header.size = ni->info_table_size;
+
+	if (ni->block_state_changed || ni->block_mapping_changed) {
+		ni->info_table.write_count++;
+		changed = true;
+	}
+
+	memcpy(ni->info_table_cache, &ni->info_table, sizeof(ni->info_table));
+
+	nmbm_update_checksum((struct nmbm_header *)ni->info_table_cache);
+
+	return changed;
+}
+
+/*
+ * nmbm_write_info_table - Write info table into NAND within a range
+ * @ni: NMBM instance structure
+ * @ba: preferred start block address for writing
+ * @limit: highest block address allowed for writing
+ * @actual_start_ba: actual start block address of info table
+ * @actual_end_ba: block address after the end of info table
+ *
+ * @limit is counted into the allowed write address.
+ */
+static bool nmbm_write_info_table(struct nmbm_instance *ni, uint32_t ba,
+				  uint32_t limit, uint32_t *actual_start_ba,
+				  uint32_t *actual_end_ba)
+{
+	return nmbm_write_mgmt_range(ni, ba, limit, ni->info_table_cache,
+				     ni->info_table_size, actual_start_ba,
+				     actual_end_ba);
+}
+
+/*
+ * nmbm_mark_tables_clean - Mark info table `clean'
+ * @ni: NMBM instance structure
+ */
+static void nmbm_mark_tables_clean(struct nmbm_instance *ni)
+{
+	ni->block_state_changed = 0;
+	ni->block_mapping_changed = 0;
+}
+
+/*
+ * nmbm_try_reserve_blocks - Reserve blocks with compromisation
+ * @ni: NMBM instance structure
+ * @ba: start physical block address
+ * @nba: return physical block address after reservation
+ * @count: number of good blocks to be skipped
+ * @min_count: minimum number of good blocks to be skipped
+ * @limit: highest/lowest block address allowed for walking
+ *
+ * Reserve specific blocks. If failed, try to reserve as many as possible.
+ */
+static bool nmbm_try_reserve_blocks(struct nmbm_instance *ni, uint32_t ba,
+				    uint32_t *nba, uint32_t count,
+				    int32_t min_count, int32_t limit)
+{
+	int32_t nblocks = count;
+	bool success;
+
+	while (nblocks >= min_count) {
+		success = nmbm_block_walk(ni, true, ba, nba, nblocks, limit);
+		if (success)
+			return true;
+
+		nblocks--;
+	}
+
+	return false;
+}
+
+/*
+ * nmbm_rebuild_info_table - Build main & backup info table from scratch
+ * @ni: NMBM instance structure
+ * @allow_no_gap: allow no spare blocks between two tables
+ */
+static bool nmbm_rebuild_info_table(struct nmbm_instance *ni)
+{
+	uint32_t table_start_ba, table_end_ba, next_start_ba;
+	uint32_t main_table_end_ba;
+	bool success;
+
+	/* Set initial value */
+	ni->main_table_ba = 0;
+	ni->backup_table_ba = 0;
+	ni->mapping_blocks_ba = ni->mapping_blocks_top_ba;
+
+	/* Write main table */
+	success = nmbm_write_info_table(ni, ni->mgmt_start_ba,
+					ni->mapping_blocks_top_ba,
+					&table_start_ba, &table_end_ba);
+	if (!success) {
+		/* Failed to write main table, data will be lost */
+		nlog_err(ni, "Unable to write at least one info table!\n");
+		nlog_err(ni, "Please save your data before power off!\n");
+		ni->protected = 1;
+		return false;
+	}
+
+	/* Main info table is successfully written, record its offset */
+	ni->main_table_ba = table_start_ba;
+	main_table_end_ba = table_end_ba;
+
+	/* Adjust mapping_blocks_ba */
+	ni->mapping_blocks_ba = table_end_ba;
+
+	nmbm_mark_tables_clean(ni);
+
+	nlog_table_creation(ni, true, table_start_ba, table_end_ba);
+
+	/* Reserve spare blocks for main info table. */
+	success = nmbm_try_reserve_blocks(ni, table_end_ba,
+					  &next_start_ba,
+					  ni->info_table_spare_blocks, 0,
+					  ni->mapping_blocks_top_ba -
+					  size2blk(ni, ni->info_table_size));
+	if (!success) {
+		/* There is no spare block. */
+		nlog_debug(ni, "No room for backup info table\n");
+		return true;
+	}
+
+	/* Write backup info table. */
+	success = nmbm_write_info_table(ni, next_start_ba,
+					ni->mapping_blocks_top_ba,
+					&table_start_ba, &table_end_ba);
+	if (!success) {
+		/* There is no enough blocks for backup table. */
+		nlog_debug(ni, "No room for backup info table\n");
+		return true;
+	}
+
+	/* Backup table is successfully written, record its offset */
+	ni->backup_table_ba = table_start_ba;
+
+	/* Adjust mapping_blocks_off */
+	ni->mapping_blocks_ba = table_end_ba;
+
+	/* Erase spare blocks of main table to clean possible interference data */
+	nmbm_erase_range(ni, main_table_end_ba, ni->backup_table_ba);
+
+	nlog_table_creation(ni, false, table_start_ba, table_end_ba);
+
+	return true;
+}
+
+/*
+ * nmbm_rescue_single_info_table - Rescue when there is only one info table
+ * @ni: NMBM instance structure
+ *
+ * This function is called when there is only one info table exists.
+ * This function may fail if we can't write new info table
+ */
+static bool nmbm_rescue_single_info_table(struct nmbm_instance *ni)
+{
+	uint32_t table_start_ba, table_end_ba, write_ba;
+	bool success;
+
+	/* Try to write new info table in front of existing table */
+	success = nmbm_write_info_table(ni, ni->mgmt_start_ba,
+					ni->main_table_ba,
+					&table_start_ba,
+					&table_end_ba);
+	if (success) {
+		/*
+		 * New table becomes the main table, existing table becomes
+		 * the backup table.
+		 */
+		ni->backup_table_ba = ni->main_table_ba;
+		ni->main_table_ba = table_start_ba;
+
+		nmbm_mark_tables_clean(ni);
+
+		/* Erase spare blocks of main table to clean possible interference data */
+		nmbm_erase_range(ni, table_end_ba, ni->backup_table_ba);
+
+		nlog_table_creation(ni, true, table_start_ba, table_end_ba);
+
+		return true;
+	}
+
+	/* Try to reserve spare blocks for existing table */
+	success = nmbm_try_reserve_blocks(ni, ni->mapping_blocks_ba, &write_ba,
+					  ni->info_table_spare_blocks, 0,
+					  ni->mapping_blocks_top_ba -
+					  size2blk(ni, ni->info_table_size));
+	if (!success) {
+		nlog_warn(ni, "Failed to rescue single info table\n");
+		return false;
+	}
+
+	/* Try to write new info table next to the existing table */
+	while (write_ba >= ni->mapping_blocks_ba) {
+		success = nmbm_write_info_table(ni, write_ba,
+						ni->mapping_blocks_top_ba,
+						&table_start_ba,
+						&table_end_ba);
+		if (success)
+			break;
+
+		write_ba--;
+	}
+
+	if (success) {
+		/* Erase spare blocks of main table to clean possible interference data */
+		nmbm_erase_range(ni, ni->mapping_blocks_ba, table_start_ba);
+
+		/* New table becomes the backup table */
+		ni->backup_table_ba = table_start_ba;
+		ni->mapping_blocks_ba = table_end_ba;
+
+		nmbm_mark_tables_clean(ni);
+
+		nlog_table_creation(ni, false, table_start_ba, table_end_ba);
+
+		return true;
+	}
+
+	nlog_warn(ni, "Failed to rescue single info table\n");
+	return false;
+}
+
+/*
+ * nmbm_update_single_info_table - Update specific one info table
+ * @ni: NMBM instance structure
+ */
+static bool nmbm_update_single_info_table(struct nmbm_instance *ni,
+					  bool update_main_table)
+{
+	uint32_t write_start_ba, write_limit, table_start_ba, table_end_ba;
+	bool success;
+
+	/* Determine the write range */
+	if (update_main_table) {
+		write_start_ba = ni->main_table_ba;
+		write_limit = ni->backup_table_ba;
+	} else {
+		write_start_ba = ni->backup_table_ba;
+		write_limit = ni->mapping_blocks_top_ba;
+	}
+
+	success = nmbm_write_info_table(ni, write_start_ba, write_limit,
+					&table_start_ba, &table_end_ba);
+	if (success) {
+		if (update_main_table) {
+			ni->main_table_ba = table_start_ba;
+		} else {
+			ni->backup_table_ba = table_start_ba;
+			ni->mapping_blocks_ba = table_end_ba;
+		}
+
+		nmbm_mark_tables_clean(ni);
+
+		nlog_table_update(ni, update_main_table, table_start_ba,
+				 table_end_ba);
+
+		return true;
+	}
+
+	if (update_main_table) {
+		/*
+		 * If failed to update main table, make backup table the new
+		 * main table, and call nmbm_rescue_single_info_table()
+		 */
+		nlog_warn(ni, "Unable to update %s info table\n",
+			 update_main_table ? "Main" : "Backup");
+
+		ni->main_table_ba = ni->backup_table_ba;
+		ni->backup_table_ba = 0;
+		return nmbm_rescue_single_info_table(ni);
+	}
+
+	/* Only one table left */
+	ni->mapping_blocks_ba = ni->backup_table_ba;
+	ni->backup_table_ba = 0;
+
+	return false;
+}
+
+/*
+ * nmbm_rescue_main_info_table - Rescue when failed to write main info table
+ * @ni: NMBM instance structure
+ *
+ * This function is called when main info table failed to be written, and
+ *    backup info table exists.
+ */
+static bool nmbm_rescue_main_info_table(struct nmbm_instance *ni)
+{
+	uint32_t tmp_table_start_ba, tmp_table_end_ba, main_table_start_ba;
+	uint32_t main_table_end_ba, write_ba;
+	uint32_t info_table_erasesize = size2blk(ni, ni->info_table_size);
+	bool success;
+
+	/* Try to reserve spare blocks for existing backup info table */
+	success = nmbm_try_reserve_blocks(ni, ni->mapping_blocks_ba, &write_ba,
+					  ni->info_table_spare_blocks, 0,
+					  ni->mapping_blocks_top_ba -
+					  info_table_erasesize);
+	if (!success) {
+		/* There is no spare block. Backup info table becomes the main table. */
+		nlog_err(ni, "No room for temporary info table\n");
+		ni->main_table_ba = ni->backup_table_ba;
+		ni->backup_table_ba = 0;
+		return true;
+	}
+
+	/* Try to write temporary info table into spare unmapped blocks */
+	while (write_ba >= ni->mapping_blocks_ba) {
+		success = nmbm_write_info_table(ni, write_ba,
+						ni->mapping_blocks_top_ba,
+						&tmp_table_start_ba,
+						&tmp_table_end_ba);
+		if (success)
+			break;
+
+		write_ba--;
+	}
+
+	if (!success) {
+		/* Backup info table becomes the main table */
+		nlog_err(ni, "Failed to update main info table\n");
+		ni->main_table_ba = ni->backup_table_ba;
+		ni->backup_table_ba = 0;
+		return true;
+	}
+
+	/* Adjust mapping_blocks_off */
+	ni->mapping_blocks_ba = tmp_table_end_ba;
+
+	/*
+	 * Now write main info table at the beginning of management area.
+	 * This operation will generally destroy the original backup info
+	 * table.
+	 */
+	success = nmbm_write_info_table(ni, ni->mgmt_start_ba,
+					tmp_table_start_ba,
+					&main_table_start_ba,
+					&main_table_end_ba);
+	if (!success) {
+		/* Temporary info table becomes the main table */
+		ni->main_table_ba = tmp_table_start_ba;
+		ni->backup_table_ba = 0;
+
+		nmbm_mark_tables_clean(ni);
+
+		nlog_err(ni, "Failed to update main info table\n");
+
+		return true;
+	}
+
+	/* Main info table has been successfully written, record its offset */
+	ni->main_table_ba = main_table_start_ba;
+
+	nmbm_mark_tables_clean(ni);
+
+	nlog_table_creation(ni, true, main_table_start_ba, main_table_end_ba);
+
+	/*
+	 * Temporary info table becomes the new backup info table if it's
+	 * not overwritten.
+	 */
+	if (main_table_end_ba <= tmp_table_start_ba) {
+		ni->backup_table_ba = tmp_table_start_ba;
+
+		nlog_table_creation(ni, false, tmp_table_start_ba,
+				   tmp_table_end_ba);
+
+		return true;
+	}
+
+	/* Adjust mapping_blocks_off */
+	ni->mapping_blocks_ba = main_table_end_ba;
+
+	/* Try to reserve spare blocks for new main info table */
+	success = nmbm_try_reserve_blocks(ni, main_table_end_ba, &write_ba,
+					  ni->info_table_spare_blocks, 0,
+					  ni->mapping_blocks_top_ba -
+					  info_table_erasesize);
+	if (!success) {
+		/* There is no spare block. Only main table exists. */
+		nlog_err(ni, "No room for backup info table\n");
+		ni->backup_table_ba = 0;
+		return true;
+	}
+
+	/* Write new backup info table. */
+	while (write_ba >= main_table_end_ba) {
+		success = nmbm_write_info_table(ni, write_ba,
+						ni->mapping_blocks_top_ba,
+						&tmp_table_start_ba,
+						&tmp_table_end_ba);
+		if (success)
+			break;
+
+		write_ba--;
+	}
+
+	if (!success) {
+		nlog_err(ni, "No room for backup info table\n");
+		ni->backup_table_ba = 0;
+		return true;
+	}
+
+	/* Backup info table has been successfully written, record its offset */
+	ni->backup_table_ba = tmp_table_start_ba;
+
+	/* Adjust mapping_blocks_off */
+	ni->mapping_blocks_ba = tmp_table_end_ba;
+
+	/* Erase spare blocks of main table to clean possible interference data */
+	nmbm_erase_range(ni, main_table_end_ba, ni->backup_table_ba);
+
+	nlog_table_creation(ni, false, tmp_table_start_ba, tmp_table_end_ba);
+
+	return true;
+}
+
+/*
+ * nmbm_update_info_table_once - Update info table once
+ * @ni: NMBM instance structure
+ * @force: force update
+ *
+ * Update both main and backup info table. Return true if at least one info
+ * table has been successfully written.
+ * This function only try to update info table once regard less of the result.
+ */
+static bool nmbm_update_info_table_once(struct nmbm_instance *ni, bool force)
+{
+	uint32_t table_start_ba, table_end_ba;
+	uint32_t main_table_limit;
+	bool success;
+
+	/* Do nothing if there is no change */
+	if (!nmbm_generate_info_table_cache(ni) && !force)
+		return true;
+
+	/* Check whether both two tables exist */
+	if (!ni->backup_table_ba) {
+		main_table_limit = ni->mapping_blocks_top_ba;
+		goto write_main_table;
+	}
+
+	/*
+	 * Write backup info table in its current range.
+	 * Note that limit is set to mapping_blocks_top_off to provide as many
+	 * spare blocks as possible for the backup table. If at last
+	 * unmapped blocks are used by backup table, mapping_blocks_off will
+	 * be adjusted.
+	 */
+	success = nmbm_write_info_table(ni, ni->backup_table_ba,
+					ni->mapping_blocks_top_ba,
+					&table_start_ba, &table_end_ba);
+	if (!success) {
+		/*
+		 * There is nothing to do if failed to write backup table.
+		 * Write the main table now.
+		 */
+		nlog_err(ni, "No room for backup table\n");
+		ni->mapping_blocks_ba = ni->backup_table_ba;
+		ni->backup_table_ba = 0;
+		main_table_limit = ni->mapping_blocks_top_ba;
+		goto write_main_table;
+	}
+
+	/* Backup table is successfully written, record its offset */
+	ni->backup_table_ba = table_start_ba;
+
+	/* Adjust mapping_blocks_off */
+	ni->mapping_blocks_ba = table_end_ba;
+
+	nmbm_mark_tables_clean(ni);
+
+	/* The normal limit of main table */
+	main_table_limit = ni->backup_table_ba;
+
+	nlog_table_update(ni, false, table_start_ba, table_end_ba);
+
+write_main_table:
+	if (!ni->main_table_ba)
+		goto rebuild_tables;
+
+	/* Write main info table in its current range */
+	success = nmbm_write_info_table(ni, ni->main_table_ba,
+					main_table_limit, &table_start_ba,
+					&table_end_ba);
+	if (!success) {
+		/* If failed to write main table, go rescue procedure */
+		if (!ni->backup_table_ba)
+			goto rebuild_tables;
+
+		return nmbm_rescue_main_info_table(ni);
+	}
+
+	/* Main info table is successfully written, record its offset */
+	ni->main_table_ba = table_start_ba;
+
+	/* Adjust mapping_blocks_off */
+	if (!ni->backup_table_ba)
+		ni->mapping_blocks_ba = table_end_ba;
+
+	nmbm_mark_tables_clean(ni);
+
+	nlog_table_update(ni, true, table_start_ba, table_end_ba);
+
+	return true;
+
+rebuild_tables:
+	return nmbm_rebuild_info_table(ni);
+}
+
+/*
+ * nmbm_update_info_table - Update info table
+ * @ni: NMBM instance structure
+ *
+ * Update both main and backup info table. Return true if at least one table
+ * has been successfully written.
+ * This function will try to update info table repeatedly until no new bad
+ * block found during updating.
+ */
+static bool nmbm_update_info_table(struct nmbm_instance *ni)
+{
+	bool success;
+
+	if (ni->protected)
+		return true;
+
+	while (ni->block_state_changed || ni->block_mapping_changed) {
+		success = nmbm_update_info_table_once(ni, false);
+		if (!success) {
+			nlog_err(ni, "Failed to update info table\n");
+			return false;
+		}
+	}
+
+	return true;
+}
+
+/*
+ * nmbm_map_block - Map a bad block to a unused spare block
+ * @ni: NMBM instance structure
+ * @lb: logic block addr to map
+ */
+static bool nmbm_map_block(struct nmbm_instance *ni, uint32_t lb)
+{
+	uint32_t pb;
+	bool success;
+
+	if (ni->mapping_blocks_ba == ni->mapping_blocks_top_ba) {
+		nlog_warn(ni, "No spare unmapped blocks.\n");
+		return false;
+	}
+
+	success = nmbm_block_walk(ni, false, ni->mapping_blocks_top_ba, &pb, 0,
+				  ni->mapping_blocks_ba);
+	if (!success) {
+		nlog_warn(ni, "No spare unmapped blocks.\n");
+		nmbm_update_info_table(ni);
+		ni->mapping_blocks_top_ba = ni->mapping_blocks_ba;
+		return false;
+	}
+
+	ni->block_mapping[lb] = pb;
+	ni->mapping_blocks_top_ba--;
+	ni->block_mapping_changed++;
+
+	nlog_info(ni, "Logic block %u mapped to physical block %u\n", lb, pb);
+
+	return true;
+}
+
+/*
+ * nmbm_create_info_table - Create info table(s)
+ * @ni: NMBM instance structure
+ *
+ * This function assumes that the chip has no existing info table(s)
+ */
+static bool nmbm_create_info_table(struct nmbm_instance *ni)
+{
+	uint32_t lb;
+	bool success;
+
+	/* Set initial mapping_blocks_top_off  */
+	success = nmbm_block_walk(ni, false, ni->signature_ba,
+				  &ni->mapping_blocks_top_ba, 1,
+				  ni->mgmt_start_ba);
+	if (!success) {
+		nlog_err(ni, "No room for spare blocks\n");
+		return false;
+	}
+
+	/* Generate info table cache */
+	nmbm_generate_info_table_cache(ni);
+
+	/* Write info table */
+	success = nmbm_rebuild_info_table(ni);
+	if (!success) {
+		nlog_err(ni, "Failed to build info tables\n");
+		return false;
+	}
+
+	/* Remap bad block(s) at end of data area */
+	for (lb = ni->data_block_count; lb < ni->mgmt_start_ba; lb++) {
+		success = nmbm_map_block(ni, lb);
+		if (!success)
+			break;
+
+		ni->data_block_count++;
+	}
+
+	/* If state table and/or mapping table changed, update info table. */
+	success = nmbm_update_info_table(ni);
+	if (!success)
+		return false;
+
+	return true;
+}
+
+/*
+ * nmbm_create_new - Create NMBM on a new chip
+ * @ni: NMBM instance structure
+ */
+static bool nmbm_create_new(struct nmbm_instance *ni)
+{
+	bool success;
+
+	/* Determine the boundary of management blocks */
+	ni->mgmt_start_ba = ni->block_count * (NMBM_MGMT_DIV - ni->max_ratio) / NMBM_MGMT_DIV;
+
+	if (ni->max_reserved_blocks && ni->block_count - ni->mgmt_start_ba > ni->max_reserved_blocks)
+		ni->mgmt_start_ba = ni->block_count - ni->max_reserved_blocks;
+
+	nlog_info(ni, "NMBM management region starts at block %u [0x%08llx]\n",
+		  ni->mgmt_start_ba, ba2addr(ni, ni->mgmt_start_ba));
+
+	/* Fill block state table & mapping table */
+	nmbm_scan_badblocks(ni);
+	nmbm_build_mapping_table(ni);
+
+	/* Write signature */
+	ni->signature.header.magic = NMBM_MAGIC_SIGNATURE;
+	ni->signature.header.version = NMBM_VER;
+	ni->signature.header.size = sizeof(ni->signature);
+	ni->signature.nand_size = bmtd.total_blks << bmtd.blk_shift;
+	ni->signature.block_size = bmtd.blk_size;
+	ni->signature.page_size = bmtd.pg_size;
+	ni->signature.spare_size = bmtd.mtd->oobsize;
+	ni->signature.mgmt_start_pb = ni->mgmt_start_ba;
+	ni->signature.max_try_count = NMBM_TRY_COUNT;
+	nmbm_update_checksum(&ni->signature.header);
+
+	success = nmbm_write_signature(ni, ni->mgmt_start_ba,
+				       &ni->signature, &ni->signature_ba);
+	if (!success) {
+		nlog_err(ni, "Failed to write signature to a proper offset\n");
+		return false;
+	}
+
+	nlog_info(ni, "Signature has been written to block %u [0x%08llx]\n",
+		 ni->signature_ba, ba2addr(ni, ni->signature_ba));
+
+	/* Write info table(s) */
+	success = nmbm_create_info_table(ni);
+	if (success) {
+		nlog_info(ni, "NMBM has been successfully created\n");
+		return true;
+	}
+
+	return false;
+}
+
+/*
+ * nmbm_check_info_table_header - Check if a info table header is valid
+ * @ni: NMBM instance structure
+ * @data: pointer to the info table header
+ */
+static bool nmbm_check_info_table_header(struct nmbm_instance *ni, void *data)
+{
+	struct nmbm_info_table_header *ifthdr = data;
+
+	if (ifthdr->header.magic != NMBM_MAGIC_INFO_TABLE)
+		return false;
+
+	if (ifthdr->header.size != ni->info_table_size)
+		return false;
+
+	if (ifthdr->mapping_table_off - ifthdr->state_table_off < ni->state_table_size)
+		return false;
+
+	if (ni->info_table_size - ifthdr->mapping_table_off < ni->mapping_table_size)
+		return false;
+
+	return true;
+}
+
+/*
+ * nmbm_check_info_table - Check if a whole info table is valid
+ * @ni: NMBM instance structure
+ * @start_ba: start block address of this table
+ * @end_ba: end block address of this table
+ * @data: pointer to the info table header
+ * @mapping_blocks_top_ba: return the block address of top remapped block
+ */
+static bool nmbm_check_info_table(struct nmbm_instance *ni, uint32_t start_ba,
+				  uint32_t end_ba, void *data,
+				  uint32_t *mapping_blocks_top_ba)
+{
+	struct nmbm_info_table_header *ifthdr = data;
+	int32_t *block_mapping = (int32_t *)((uintptr_t)data + ifthdr->mapping_table_off);
+	u32 *block_state = (u32 *)((uintptr_t)data + ifthdr->state_table_off);
+	uint32_t minimum_mapping_pb = ni->signature_ba;
+	uint32_t ba;
+
+	for (ba = 0; ba < ni->data_block_count; ba++) {
+		if ((block_mapping[ba] >= ni->data_block_count && block_mapping[ba] < end_ba) ||
+		    block_mapping[ba] == ni->signature_ba)
+			return false;
+
+		if (block_mapping[ba] >= end_ba && block_mapping[ba] < minimum_mapping_pb)
+			minimum_mapping_pb = block_mapping[ba];
+	}
+
+	for (ba = start_ba; ba < end_ba; ba++) {
+		if (nmbm_get_block_state(ni, ba) != BLOCK_ST_GOOD)
+			continue;
+
+		if (nmbm_get_block_state_raw(block_state, ba) != BLOCK_ST_GOOD)
+			return false;
+	}
+
+	*mapping_blocks_top_ba = minimum_mapping_pb - 1;
+
+	return true;
+}
+
+/*
+ * nmbm_try_load_info_table - Try to load info table from a address
+ * @ni: NMBM instance structure
+ * @ba: start block address of the info table
+ * @eba: return the block address after end of the table
+ * @write_count: return the write count of this table
+ * @mapping_blocks_top_ba: return the block address of top remapped block
+ * @table_loaded: used to record whether ni->info_table has valid data
+ */
+static bool nmbm_try_load_info_table(struct nmbm_instance *ni, uint32_t ba,
+				     uint32_t *eba, uint32_t *write_count,
+				     uint32_t *mapping_blocks_top_ba,
+				     bool table_loaded)
+{
+	struct nmbm_info_table_header *ifthdr = (void *)ni->info_table_cache;
+	uint8_t *off = ni->info_table_cache;
+	uint32_t limit = ba + size2blk(ni, ni->info_table_size);
+	uint32_t start_ba = 0, chunksize, sizeremain = ni->info_table_size;
+	bool success, checkhdr = true;
+	int ret;
+
+	while (sizeremain && ba < limit) {
+		if (nmbm_get_block_state(ni, ba) != BLOCK_ST_GOOD)
+			goto next_block;
+
+		if (nmbm_check_bad_phys_block(ni, ba)) {
+			nmbm_set_block_state(ni, ba, BLOCK_ST_BAD);
+			goto next_block;
+		}
+
+		chunksize = sizeremain;
+		if (chunksize > bmtd.blk_size)
+			chunksize = bmtd.blk_size;
+
+		/* Assume block with ECC error has no info table data */
+		ret = nmbn_read_data(ni, ba2addr(ni, ba), off, chunksize);
+		if (ret < 0)
+			goto skip_bad_block;
+		else if (ret > 0)
+			return false;
+
+		if (checkhdr) {
+			success = nmbm_check_info_table_header(ni, off);
+			if (!success)
+				return false;
+
+			start_ba = ba;
+			checkhdr = false;
+		}
+
+		off += chunksize;
+		sizeremain -= chunksize;
+
+		goto next_block;
+
+	skip_bad_block:
+		/* Only mark bad in memory */
+		nmbm_set_block_state(ni, ba, BLOCK_ST_BAD);
+
+	next_block:
+		ba++;
+	}
+
+	if (sizeremain)
+		return false;
+
+	success = nmbm_check_header(ni->info_table_cache, ni->info_table_size);
+	if (!success)
+		return false;
+
+	*eba = ba;
+	*write_count = ifthdr->write_count;
+
+	success = nmbm_check_info_table(ni, start_ba, ba, ni->info_table_cache,
+					mapping_blocks_top_ba);
+	if (!success)
+		return false;
+
+	if (!table_loaded || ifthdr->write_count > ni->info_table.write_count) {
+		memcpy(&ni->info_table, ifthdr, sizeof(ni->info_table));
+		memcpy(ni->block_state,
+		       (uint8_t *)ifthdr + ifthdr->state_table_off,
+		       ni->state_table_size);
+		memcpy(ni->block_mapping,
+		       (uint8_t *)ifthdr + ifthdr->mapping_table_off,
+		       ni->mapping_table_size);
+		ni->info_table.write_count = ifthdr->write_count;
+	}
+
+	return true;
+}
+
+/*
+ * nmbm_search_info_table - Search info table from specific address
+ * @ni: NMBM instance structure
+ * @ba: start block address to search
+ * @limit: highest block address allowed for searching
+ * @table_start_ba: return the start block address of this table
+ * @table_end_ba: return the block address after end of this table
+ * @write_count: return the write count of this table
+ * @mapping_blocks_top_ba: return the block address of top remapped block
+ * @table_loaded: used to record whether ni->info_table has valid data
+ */
+static bool nmbm_search_info_table(struct nmbm_instance *ni, uint32_t ba,
+				   uint32_t limit, uint32_t *table_start_ba,
+				   uint32_t *table_end_ba,
+				   uint32_t *write_count,
+				   uint32_t *mapping_blocks_top_ba,
+				   bool table_loaded)
+{
+	bool success;
+
+	while (ba < limit - size2blk(ni, ni->info_table_size)) {
+		success = nmbm_try_load_info_table(ni, ba, table_end_ba,
+						   write_count,
+						   mapping_blocks_top_ba,
+						   table_loaded);
+		if (success) {
+			*table_start_ba = ba;
+			return true;
+		}
+
+		ba++;
+	}
+
+	return false;
+}
+
+/*
+ * nmbm_load_info_table - Load info table(s) from a chip
+ * @ni: NMBM instance structure
+ * @ba: start block address to search info table
+ * @limit: highest block address allowed for searching
+ */
+static bool nmbm_load_info_table(struct nmbm_instance *ni, uint32_t ba,
+				 uint32_t limit)
+{
+	uint32_t main_table_end_ba, backup_table_end_ba, table_end_ba;
+	uint32_t main_mapping_blocks_top_ba, backup_mapping_blocks_top_ba;
+	uint32_t main_table_write_count, backup_table_write_count;
+	uint32_t i;
+	bool success;
+
+	/* Set initial value */
+	ni->main_table_ba = 0;
+	ni->backup_table_ba = 0;
+	ni->info_table.write_count = 0;
+	ni->mapping_blocks_top_ba = ni->signature_ba - 1;
+	ni->data_block_count = ni->signature.mgmt_start_pb;
+
+	/* Find first info table */
+	success = nmbm_search_info_table(ni, ba, limit, &ni->main_table_ba,
+		&main_table_end_ba, &main_table_write_count,
+		&main_mapping_blocks_top_ba, false);
+	if (!success) {
+		nlog_warn(ni, "No valid info table found\n");
+		return false;
+	}
+
+	table_end_ba = main_table_end_ba;
+
+	nlog_table_found(ni, true, main_table_write_count, ni->main_table_ba,
+			main_table_end_ba);
+
+	/* Find second info table */
+	success = nmbm_search_info_table(ni, main_table_end_ba, limit,
+		&ni->backup_table_ba, &backup_table_end_ba,
+		&backup_table_write_count, &backup_mapping_blocks_top_ba, true);
+	if (!success) {
+		nlog_warn(ni, "Second info table not found\n");
+	} else {
+		table_end_ba = backup_table_end_ba;
+
+		nlog_table_found(ni, false, backup_table_write_count,
+				ni->backup_table_ba, backup_table_end_ba);
+	}
+
+	/* Pick mapping_blocks_top_ba */
+	if (!ni->backup_table_ba) {
+		ni->mapping_blocks_top_ba= main_mapping_blocks_top_ba;
+	} else {
+		if (main_table_write_count >= backup_table_write_count)
+			ni->mapping_blocks_top_ba = main_mapping_blocks_top_ba;
+		else
+			ni->mapping_blocks_top_ba = backup_mapping_blocks_top_ba;
+	}
+
+	/* Set final mapping_blocks_ba */
+	ni->mapping_blocks_ba = table_end_ba;
+
+	/* Set final data_block_count */
+	for (i = ni->signature.mgmt_start_pb; i > 0; i--) {
+		if (ni->block_mapping[i - 1] >= 0) {
+			ni->data_block_count = i;
+			break;
+		}
+	}
+
+	/* Regenerate the info table cache from the final selected info table */
+	nmbm_generate_info_table_cache(ni);
+
+	/*
+	 * If only one table exists, try to write another table.
+	 * If two tables have different write count, try to update info table
+	 */
+	if (!ni->backup_table_ba) {
+		success = nmbm_rescue_single_info_table(ni);
+	} else if (main_table_write_count != backup_table_write_count) {
+		/* Mark state & mapping tables changed */
+		ni->block_state_changed = 1;
+		ni->block_mapping_changed = 1;
+
+		success = nmbm_update_single_info_table(ni,
+			main_table_write_count < backup_table_write_count);
+	} else {
+		success = true;
+	}
+
+	/*
+	 * If there is no spare unmapped blocks, or still only one table
+	 * exists, set the chip to read-only
+	 */
+	if (ni->mapping_blocks_ba == ni->mapping_blocks_top_ba) {
+		nlog_warn(ni, "No spare unmapped blocks. Device is now read-only\n");
+		ni->protected = 1;
+	} else if (!success) {
+		nlog_warn(ni, "Only one info table found. Device is now read-only\n");
+		ni->protected = 1;
+	}
+
+	return true;
+}
+
+/*
+ * nmbm_load_existing - Load NMBM from a new chip
+ * @ni: NMBM instance structure
+ */
+static bool nmbm_load_existing(struct nmbm_instance *ni)
+{
+	bool success;
+
+	/* Calculate the boundary of management blocks */
+	ni->mgmt_start_ba = ni->signature.mgmt_start_pb;
+
+	nlog_debug(ni, "NMBM management region starts at block %u [0x%08llx]\n",
+		  ni->mgmt_start_ba, ba2addr(ni, ni->mgmt_start_ba));
+
+	/* Look for info table(s) */
+	success = nmbm_load_info_table(ni, ni->mgmt_start_ba,
+		ni->signature_ba);
+	if (success) {
+		nlog_info(ni, "NMBM has been successfully attached\n");
+		return true;
+	}
+
+	if (!ni->force_create) {
+		printk("not creating NMBM table\n");
+		return false;
+	}
+
+	/* Fill block state table & mapping table */
+	nmbm_scan_badblocks(ni);
+	nmbm_build_mapping_table(ni);
+
+	/* Write info table(s) */
+	success = nmbm_create_info_table(ni);
+	if (success) {
+		nlog_info(ni, "NMBM has been successfully created\n");
+		return true;
+	}
+
+	return false;
+}
+
+/*
+ * nmbm_find_signature - Find signature in the lower NAND chip
+ * @ni: NMBM instance structure
+ * @signature_ba: used for storing block address of the signature
+ * @signature_ba: return the actual block address of signature block
+ *
+ * Find a valid signature from a specific range in the lower NAND chip,
+ * from bottom (highest address) to top (lowest address)
+ *
+ * Return true if found.
+ */
+static bool nmbm_find_signature(struct nmbm_instance *ni,
+				struct nmbm_signature *signature,
+				uint32_t *signature_ba)
+{
+	struct nmbm_signature sig;
+	uint64_t off, addr;
+	uint32_t block_count, ba, limit;
+	bool success;
+	int ret;
+
+	/* Calculate top and bottom block address */
+	block_count = bmtd.total_blks;
+	ba = block_count;
+	limit = (block_count / NMBM_MGMT_DIV) * (NMBM_MGMT_DIV - ni->max_ratio);
+	if (ni->max_reserved_blocks && block_count - limit > ni->max_reserved_blocks)
+		limit = block_count - ni->max_reserved_blocks;
+
+	while (ba >= limit) {
+		ba--;
+		addr = ba2addr(ni, ba);
+
+		if (nmbm_check_bad_phys_block(ni, ba))
+			continue;
+
+		/* Check every page.
+		 * As long as at leaset one page contains valid signature,
+		 * the block is treated as a valid signature block.
+		 */
+		for (off = 0; off < bmtd.blk_size;
+		     off += bmtd.pg_size) {
+			ret = nmbn_read_data(ni, addr + off, &sig,
+					     sizeof(sig));
+			if (ret)
+				continue;
+
+			/* Check for header size and checksum */
+			success = nmbm_check_header(&sig, sizeof(sig));
+			if (!success)
+				continue;
+
+			/* Check for header magic */
+			if (sig.header.magic == NMBM_MAGIC_SIGNATURE) {
+				/* Found it */
+				memcpy(signature, &sig, sizeof(sig));
+				*signature_ba = ba;
+				return true;
+			}
+		}
+	};
+
+	return false;
+}
+
+/*
+ * nmbm_calc_structure_size - Calculate the instance structure size
+ * @nld: NMBM lower device structure
+ */
+static size_t nmbm_calc_structure_size(void)
+{
+	uint32_t state_table_size, mapping_table_size, info_table_size;
+	uint32_t block_count;
+
+	block_count = bmtd.total_blks;
+
+	/* Calculate info table size */
+	state_table_size = ((block_count + NMBM_BITMAP_BLOCKS_PER_UNIT - 1) /
+		NMBM_BITMAP_BLOCKS_PER_UNIT) * NMBM_BITMAP_UNIT_SIZE;
+	mapping_table_size = block_count * sizeof(int32_t);
+
+	info_table_size = ALIGN(sizeof(struct nmbm_info_table_header),
+				     bmtd.pg_size);
+	info_table_size += ALIGN(state_table_size, bmtd.pg_size);
+	info_table_size += ALIGN(mapping_table_size, bmtd.pg_size);
+
+	return info_table_size + state_table_size + mapping_table_size +
+		sizeof(struct nmbm_instance);
+}
+
+/*
+ * nmbm_init_structure - Initialize members of instance structure
+ * @ni: NMBM instance structure
+ */
+static void nmbm_init_structure(struct nmbm_instance *ni)
+{
+	uint32_t pages_per_block, blocks_per_chip;
+	uintptr_t ptr;
+
+	pages_per_block = bmtd.blk_size / bmtd.pg_size;
+	blocks_per_chip = bmtd.total_blks;
+
+	ni->rawpage_size = bmtd.pg_size + bmtd.mtd->oobsize;
+	ni->rawblock_size = pages_per_block * ni->rawpage_size;
+	ni->rawchip_size = blocks_per_chip * ni->rawblock_size;
+
+	/* Calculate number of block this chip */
+	ni->block_count = blocks_per_chip;
+
+	/* Calculate info table size */
+	ni->state_table_size = ((ni->block_count + NMBM_BITMAP_BLOCKS_PER_UNIT - 1) /
+		NMBM_BITMAP_BLOCKS_PER_UNIT) * NMBM_BITMAP_UNIT_SIZE;
+	ni->mapping_table_size = ni->block_count * sizeof(*ni->block_mapping);
+
+	ni->info_table_size = ALIGN(sizeof(ni->info_table),
+					 bmtd.pg_size);
+	ni->info_table.state_table_off = ni->info_table_size;
+
+	ni->info_table_size += ALIGN(ni->state_table_size,
+					  bmtd.pg_size);
+	ni->info_table.mapping_table_off = ni->info_table_size;
+
+	ni->info_table_size += ALIGN(ni->mapping_table_size,
+					  bmtd.pg_size);
+
+	ni->info_table_spare_blocks = nmbm_get_spare_block_count(
+		size2blk(ni, ni->info_table_size));
+
+	/* Assign memory to members */
+	ptr = (uintptr_t)ni + sizeof(*ni);
+
+	ni->info_table_cache = (void *)ptr;
+	ptr += ni->info_table_size;
+
+	ni->block_state = (void *)ptr;
+	ptr += ni->state_table_size;
+
+	ni->block_mapping = (void *)ptr;
+	ptr += ni->mapping_table_size;
+
+	ni->page_cache = bmtd.data_buf;
+
+	/* Initialize block state table */
+	ni->block_state_changed = 0;
+	memset(ni->block_state, 0xff, ni->state_table_size);
+
+	/* Initialize block mapping table */
+	ni->block_mapping_changed = 0;
+}
+
+/*
+ * nmbm_attach - Attach to a lower device
+ * @ni: NMBM instance structure
+ */
+static int nmbm_attach(struct nmbm_instance *ni)
+{
+	bool success;
+
+	if (!ni)
+		return -EINVAL;
+
+	/* Initialize NMBM instance */
+	nmbm_init_structure(ni);
+
+	success = nmbm_find_signature(ni, &ni->signature, &ni->signature_ba);
+	if (!success) {
+		if (!ni->force_create) {
+			nlog_err(ni, "Signature not found\n");
+			return -ENODEV;
+		}
+
+		success = nmbm_create_new(ni);
+		if (!success)
+			return -ENODEV;
+
+		return 0;
+	}
+
+	nlog_info(ni, "Signature found at block %u [0x%08llx]\n",
+		 ni->signature_ba, ba2addr(ni, ni->signature_ba));
+
+	if (ni->signature.header.version != NMBM_VER) {
+		nlog_err(ni, "NMBM version %u.%u is not supported\n",
+			NMBM_VERSION_MAJOR_GET(ni->signature.header.version),
+			NMBM_VERSION_MINOR_GET(ni->signature.header.version));
+		return -EINVAL;
+	}
+
+	if (ni->signature.nand_size != bmtd.total_blks << bmtd.blk_shift ||
+	    ni->signature.block_size != bmtd.blk_size ||
+	    ni->signature.page_size != bmtd.pg_size ||
+	    ni->signature.spare_size != bmtd.mtd->oobsize) {
+		nlog_err(ni, "NMBM configuration mismatch\n");
+		return -EINVAL;
+	}
+
+	success = nmbm_load_existing(ni);
+	if (!success)
+		return -ENODEV;
+
+	return 0;
+}
+
+static bool remap_block_nmbm(u16 block, u16 mapped_block, int copy_len)
+{
+	struct nmbm_instance *ni = bmtd.ni;
+	int new_block;
+
+	if (block >= ni->data_block_count)
+		return false;
+
+	nmbm_set_block_state(ni, mapped_block, BLOCK_ST_BAD);
+	if (!nmbm_map_block(ni, block))
+		return false;
+
+	new_block = ni->block_mapping[block];
+	bbt_nand_erase(new_block);
+    if (copy_len > 0)
+		bbt_nand_copy(new_block, mapped_block, copy_len);
+	nmbm_update_info_table(ni);
+
+	return true;
+}
+
+static int get_mapping_block_index_nmbm(int block)
+{
+	struct nmbm_instance *ni = bmtd.ni;
+
+	if (block >= ni->data_block_count)
+		return -1;
+
+	return ni->block_mapping[block];
+}
+
+static int mtk_bmt_init_nmbm(struct device_node *np)
+{
+	struct nmbm_instance *ni;
+	int ret;
+
+	ni = kzalloc(nmbm_calc_structure_size(), GFP_KERNEL);
+	if (!ni)
+		return -ENOMEM;
+
+	bmtd.ni = ni;
+
+	if (of_property_read_u32(np, "mediatek,bmt-max-ratio", &ni->max_ratio))
+		ni->max_ratio = 1;
+	if (of_property_read_u32(np, "mediatek,bmt-max-reserved-blocks",
+				 &ni->max_reserved_blocks))
+		ni->max_reserved_blocks = 256;
+	if (of_property_read_bool(np, "mediatek,empty-page-ecc-protected"))
+		ni->empty_page_ecc_ok = true;
+	if (of_property_read_bool(np, "mediatek,bmt-force-create"))
+		ni->force_create = true;
+
+	ret = nmbm_attach(ni);
+	if (ret)
+		goto out;
+
+	bmtd.mtd->size = ni->data_block_count << bmtd.blk_shift;
+
+	return 0;
+
+out:
+	kfree(ni);
+	bmtd.ni = NULL;
+
+	return ret;
+}
+
+static int mtk_bmt_debug_nmbm(void *data, u64 val)
+{
+	struct nmbm_instance *ni = bmtd.ni;
+	int i;
+
+	switch (val) {
+	case 0:
+		for (i = 1; i < ni->data_block_count; i++) {
+			if (ni->block_mapping[i] < ni->mapping_blocks_ba)
+				continue;
+
+			printk("remap [%x->%x]\n", i, ni->block_mapping[i]);
+		}
+	}
+
+	return 0;
+}
+
+static void unmap_block_nmbm(u16 block)
+{
+	struct nmbm_instance *ni = bmtd.ni;
+	int start, offset;
+	int new_block;
+
+	if (block >= ni->data_block_count)
+		return;
+
+	start = block;
+	offset = 0;
+	while (ni->block_mapping[start] >= ni->mapping_blocks_ba) {
+		start--;
+		offset++;
+		if (start < 0)
+			return;
+	}
+
+	if (!offset)
+		return;
+
+	new_block = ni->block_mapping[start] + offset;
+	nmbm_set_block_state(ni, new_block, BLOCK_ST_GOOD);
+	ni->block_mapping[block] = new_block;
+	ni->block_mapping_changed++;
+
+	new_block = ni->signature_ba - 1;
+	for (block = 0; block < ni->data_block_count; block++) {
+		int cur = ni->block_mapping[block];
+
+		if (cur < ni->mapping_blocks_ba)
+			continue;
+
+		if (cur <= new_block)
+			new_block = cur - 1;
+	}
+
+	ni->mapping_blocks_top_ba = new_block;
+
+	nmbm_update_info_table(ni);
+}
+
+const struct mtk_bmt_ops mtk_bmt_nmbm_ops = {
+	.init = mtk_bmt_init_nmbm,
+	.remap_block = remap_block_nmbm,
+	.unmap_block = unmap_block_nmbm,
+	.get_mapping_block = get_mapping_block_index_nmbm,
+	.debug = mtk_bmt_debug_nmbm,
+};
diff --git a/6.12/target/linux/generic/files/drivers/mtd/nand/mtk_bmt_v2.c b/6.12/target/linux/generic/files/drivers/mtd/nand/mtk_bmt_v2.c
new file mode 100644
index 00000000..6b06948c
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/nand/mtk_bmt_v2.c
@@ -0,0 +1,506 @@
+/*
+ * Copyright (c) 2017 MediaTek Inc.
+ * Author: Xiangsheng Hou <xiangsheng.hou@mediatek.com>
+ * Copyright (c) 2020-2022 Felix Fietkau <nbd@nbd.name>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include "mtk_bmt.h"
+
+struct bbbt {
+	char signature[3];
+	/* This version is used to distinguish the legacy and new algorithm */
+#define BBMT_VERSION		2
+	unsigned char version;
+	/* Below 2 tables will be written in SLC */
+	u16 bb_tbl[];
+};
+
+struct bbmt {
+	u16 block;
+#define NO_MAPPED		0
+#define NORMAL_MAPPED	1
+#define BMT_MAPPED		2
+	u16 mapped;
+};
+
+/* Maximum 8k blocks */
+#define BBPOOL_RATIO		2
+#define BB_TABLE_MAX	bmtd.table_size
+#define BMT_TABLE_MAX	(BB_TABLE_MAX * BBPOOL_RATIO / 100)
+#define BMT_TBL_DEF_VAL	0x0
+
+static inline struct bbmt *bmt_tbl(struct bbbt *bbbt)
+{
+	return (struct bbmt *)&bbbt->bb_tbl[bmtd.table_size];
+}
+
+static u16 find_valid_block(u16 block)
+{
+	u8 fdm[4];
+	int ret;
+	int loop = 0;
+
+retry:
+	if (block >= bmtd.total_blks)
+		return 0;
+
+	ret = bbt_nand_read(blk_pg(block), bmtd.data_buf, bmtd.pg_size,
+			    fdm, sizeof(fdm));
+	/* Read the 1st byte of FDM to judge whether it's a bad
+	 * or not
+	 */
+	if (ret || fdm[0] != 0xff) {
+		pr_info("nand: found bad block 0x%x\n", block);
+		if (loop >= bmtd.bb_max) {
+			pr_info("nand: FATAL ERR: too many bad blocks!!\n");
+			return 0;
+		}
+
+		loop++;
+		block++;
+		goto retry;
+	}
+
+	return block;
+}
+
+/* Find out all bad blocks, and fill in the mapping table */
+static int scan_bad_blocks(struct bbbt *bbt)
+{
+	int i;
+	u16 block = 0;
+
+	/* First time download, the block0 MUST NOT be a bad block,
+	 * this is guaranteed by vendor
+	 */
+	bbt->bb_tbl[0] = 0;
+
+	/*
+	 * Construct the mapping table of Normal data area(non-PMT/BMTPOOL)
+	 * G - Good block; B - Bad block
+	 *			---------------------------
+	 * physical |G|G|B|G|B|B|G|G|G|G|B|G|B|
+	 *			---------------------------
+	 * What bb_tbl[i] looks like:
+	 *   physical block(i):
+	 *			 0 1 2 3 4 5 6 7 8 9 a b c
+	 *   mapped block(bb_tbl[i]):
+	 *			 0 1 3 6 7 8 9 b ......
+	 * ATTENTION:
+	 *		If new bad block ocurred(n), search bmt_tbl to find
+	 *		a available block(x), and fill in the bb_tbl[n] = x;
+	 */
+	for (i = 1; i < bmtd.pool_lba; i++) {
+		bbt->bb_tbl[i] = find_valid_block(bbt->bb_tbl[i - 1] + 1);
+		BBT_LOG("bb_tbl[0x%x] = 0x%x", i, bbt->bb_tbl[i]);
+		if (bbt->bb_tbl[i] == 0)
+			return -1;
+	}
+
+	/* Physical Block start Address of BMT pool */
+	bmtd.pool_pba = bbt->bb_tbl[i - 1] + 1;
+	if (bmtd.pool_pba >= bmtd.total_blks - 2) {
+		pr_info("nand: FATAL ERR: Too many bad blocks!!\n");
+		return -1;
+	}
+
+	BBT_LOG("pool_pba=0x%x", bmtd.pool_pba);
+	i = 0;
+	block = bmtd.pool_pba;
+	/*
+	 * The bmt table is used for runtime bad block mapping
+	 * G - Good block; B - Bad block
+	 *			---------------------------
+	 * physical |G|G|B|G|B|B|G|G|G|G|B|G|B|
+	 *			---------------------------
+	 *   block:	 0 1 2 3 4 5 6 7 8 9 a b c
+	 * What bmt_tbl[i] looks like in initial state:
+	 *   i:
+	 *			 0 1 2 3 4 5 6 7
+	 *   bmt_tbl[i].block:
+	 *			 0 1 3 6 7 8 9 b
+	 *   bmt_tbl[i].mapped:
+	 *			 N N N N N N N B
+	 *		N - Not mapped(Available)
+	 *		M - Mapped
+	 *		B - BMT
+	 * ATTENTION:
+	 *		BMT always in the last valid block in pool
+	 */
+	while ((block = find_valid_block(block)) != 0) {
+		bmt_tbl(bbt)[i].block = block;
+		bmt_tbl(bbt)[i].mapped = NO_MAPPED;
+		BBT_LOG("bmt_tbl[%d].block = 0x%x", i, block);
+		block++;
+		i++;
+	}
+
+	/* i - How many available blocks in pool, which is the length of bmt_tbl[]
+	 * bmtd.bmt_blk_idx - bmt_tbl[bmtd.bmt_blk_idx].block => the BMT block
+	 */
+	bmtd.bmt_blk_idx = i - 1;
+	bmt_tbl(bbt)[bmtd.bmt_blk_idx].mapped = BMT_MAPPED;
+
+	if (i < 1) {
+		pr_info("nand: FATAL ERR: no space to store BMT!!\n");
+		return -1;
+	}
+
+	pr_info("[BBT] %d available blocks in BMT pool\n", i);
+
+	return 0;
+}
+
+static bool is_valid_bmt(unsigned char *buf, unsigned char *fdm)
+{
+	struct bbbt *bbt = (struct bbbt *)buf;
+	u8 *sig = (u8*)bbt->signature + MAIN_SIGNATURE_OFFSET;
+
+
+	if (memcmp(bbt->signature + MAIN_SIGNATURE_OFFSET, "BMT", 3) == 0 &&
+		memcmp(fdm + OOB_SIGNATURE_OFFSET, "bmt", 3) == 0) {
+		if (bbt->version == BBMT_VERSION)
+			return true;
+	}
+	BBT_LOG("[BBT] BMT Version not match,upgrage preloader and uboot please! sig=%02x%02x%02x, fdm=%02x%02x%02x",
+		sig[0], sig[1], sig[2],
+		fdm[1], fdm[2], fdm[3]);
+	return false;
+}
+
+static u16 get_bmt_index(struct bbmt *bmt)
+{
+	int i = 0;
+
+	while (bmt[i].block != BMT_TBL_DEF_VAL) {
+		if (bmt[i].mapped == BMT_MAPPED)
+			return i;
+		i++;
+	}
+	return 0;
+}
+
+/* Write the Burner Bad Block Table to Nand Flash
+ * n - write BMT to bmt_tbl[n]
+ */
+static u16 upload_bmt(struct bbbt *bbt, int n)
+{
+	u16 block;
+
+retry:
+	if (n < 0 || bmt_tbl(bbt)[n].mapped == NORMAL_MAPPED) {
+		pr_info("nand: FATAL ERR: no space to store BMT!\n");
+		return (u16)-1;
+	}
+
+	block = bmt_tbl(bbt)[n].block;
+	BBT_LOG("n = 0x%x, block = 0x%x", n, block);
+	if (bbt_nand_erase(block)) {
+		bmt_tbl(bbt)[n].block = 0;
+		/* erase failed, try the previous block: bmt_tbl[n - 1].block */
+		n--;
+		goto retry;
+	}
+
+	/* The signature offset is fixed set to 0,
+	 * oob signature offset is fixed set to 1
+	 */
+	memcpy(bbt->signature + MAIN_SIGNATURE_OFFSET, "BMT", 3);
+	bbt->version = BBMT_VERSION;
+
+	if (write_bmt(block, (unsigned char *)bbt)) {
+		bmt_tbl(bbt)[n].block = 0;
+
+		/* write failed, try the previous block in bmt_tbl[n - 1] */
+		n--;
+		goto retry;
+	}
+
+	/* Return the current index(n) of BMT pool (bmt_tbl[n]) */
+	return n;
+}
+
+static u16 find_valid_block_in_pool(struct bbbt *bbt)
+{
+	int i;
+
+	if (bmtd.bmt_blk_idx == 0)
+		goto error;
+
+	for (i = 0; i < bmtd.bmt_blk_idx; i++) {
+		if (bmt_tbl(bbt)[i].block != 0 && bmt_tbl(bbt)[i].mapped == NO_MAPPED) {
+			bmt_tbl(bbt)[i].mapped = NORMAL_MAPPED;
+			return bmt_tbl(bbt)[i].block;
+		}
+	}
+
+error:
+	pr_info("nand: FATAL ERR: BMT pool is run out!\n");
+	return 0;
+}
+
+/* We met a bad block, mark it as bad and map it to a valid block in pool,
+ * if it's a write failure, we need to write the data to mapped block
+ */
+static bool remap_block_v2(u16 block, u16 mapped_block, int copy_len)
+{
+	u16 new_block;
+	struct bbbt *bbt;
+
+	bbt = bmtd.bbt;
+	new_block = find_valid_block_in_pool(bbt);
+	if (new_block == 0)
+		return false;
+
+	/* Map new bad block to available block in pool */
+	bbt->bb_tbl[block] = new_block;
+
+	/* Erase new block */
+	bbt_nand_erase(new_block);
+	if (copy_len > 0)
+		bbt_nand_copy(new_block, mapped_block, copy_len);
+
+	bmtd.bmt_blk_idx = upload_bmt(bbt, bmtd.bmt_blk_idx);
+
+	return true;
+}
+
+static int get_mapping_block_index_v2(int block)
+{
+	int start, end;
+
+	if (block >= bmtd.pool_lba)
+		return block;
+
+	if (!mapping_block_in_range(block, &start, &end))
+		return block;
+
+	return bmtd.bbt->bb_tbl[block];
+}
+
+static void
+unmap_block_v2(u16 block)
+{
+	bmtd.bbt->bb_tbl[block] = block;
+	bmtd.bmt_blk_idx = upload_bmt(bmtd.bbt, bmtd.bmt_blk_idx);
+}
+
+static unsigned long *
+mtk_bmt_get_mapping_mask(void)
+{
+	struct bbmt *bbmt = bmt_tbl(bmtd.bbt);
+	int main_blocks = bmtd.mtd->size >> bmtd.blk_shift;
+	unsigned long *used;
+	int i, k;
+
+	used = kcalloc(sizeof(unsigned long), BIT_WORD(bmtd.bmt_blk_idx) + 1, GFP_KERNEL);
+	if (!used)
+		return NULL;
+
+	for (i = 1; i < main_blocks; i++) {
+		if (bmtd.bbt->bb_tbl[i] == i)
+			continue;
+
+		for (k = 0; k < bmtd.bmt_blk_idx; k++) {
+			if (bmtd.bbt->bb_tbl[i] != bbmt[k].block)
+				continue;
+
+			set_bit(k, used);
+			break;
+		}
+	}
+
+	return used;
+}
+
+static int mtk_bmt_debug_v2(void *data, u64 val)
+{
+	struct bbmt *bbmt = bmt_tbl(bmtd.bbt);
+	struct mtd_info *mtd = bmtd.mtd;
+	unsigned long *used;
+	int main_blocks = mtd->size >> bmtd.blk_shift;
+	int n_remap = 0;
+	int i;
+
+	used = mtk_bmt_get_mapping_mask();
+	if (!used)
+		return -ENOMEM;
+
+	switch (val) {
+	case 0:
+		for (i = 1; i < main_blocks; i++) {
+			if (bmtd.bbt->bb_tbl[i] == i)
+				continue;
+
+			printk("remap [%x->%x]\n", i, bmtd.bbt->bb_tbl[i]);
+			n_remap++;
+		}
+		for (i = 0; i <= bmtd.bmt_blk_idx; i++) {
+			char c;
+
+			switch (bbmt[i].mapped) {
+			case NO_MAPPED:
+				continue;
+			case NORMAL_MAPPED:
+				c = 'm';
+				if (test_bit(i, used))
+					c = 'M';
+				break;
+			case BMT_MAPPED:
+				c = 'B';
+				break;
+			default:
+				c = 'X';
+				break;
+			}
+			printk("[%x:%c] = 0x%x\n", i, c, bbmt[i].block);
+		}
+		break;
+	case 100:
+		for (i = 0; i <= bmtd.bmt_blk_idx; i++) {
+			if (bbmt[i].mapped != NORMAL_MAPPED)
+				continue;
+
+			if (test_bit(i, used))
+				continue;
+
+			n_remap++;
+			bbmt[i].mapped = NO_MAPPED;
+			printk("free block [%d:%x]\n", i, bbmt[i].block);
+		}
+		if (n_remap)
+			bmtd.bmt_blk_idx = upload_bmt(bmtd.bbt, bmtd.bmt_blk_idx);
+		break;
+	}
+
+	kfree(used);
+
+	return 0;
+}
+
+static int mtk_bmt_init_v2(struct device_node *np)
+{
+	u32 bmt_pool_size, bmt_table_size;
+	u32 bufsz, block;
+	u16 pmt_block;
+
+	if (of_property_read_u32(np, "mediatek,bmt-pool-size",
+				 &bmt_pool_size) != 0)
+		bmt_pool_size = 80;
+
+	if (of_property_read_u8(np, "mediatek,bmt-oob-offset",
+				 &bmtd.oob_offset) != 0)
+		bmtd.oob_offset = 0;
+
+	if (of_property_read_u32(np, "mediatek,bmt-table-size",
+				 &bmt_table_size) != 0)
+		bmt_table_size = 0x2000U;
+
+	bmtd.table_size = bmt_table_size;
+
+	pmt_block = bmtd.total_blks - bmt_pool_size - 2;
+
+	bmtd.mtd->size = pmt_block << bmtd.blk_shift;
+
+	/*
+	 *  ---------------------------------------
+	 * | PMT(2blks) | BMT POOL(totalblks * 2%) |
+	 *  ---------------------------------------
+	 * ^            ^
+	 * |            |
+	 * pmt_block	pmt_block + 2blocks(pool_lba)
+	 *
+	 * ATTETION!!!!!!
+	 *     The blocks ahead of the boundary block are stored in bb_tbl
+	 *     and blocks behind are stored in bmt_tbl
+	 */
+
+	bmtd.pool_lba = (u16)(pmt_block + 2);
+	bmtd.bb_max = bmtd.total_blks * BBPOOL_RATIO / 100;
+
+	bufsz = round_up(sizeof(struct bbbt) +
+			 bmt_table_size * sizeof(struct bbmt), bmtd.pg_size);
+	bmtd.bmt_pgs = bufsz >> bmtd.pg_shift;
+
+	bmtd.bbt_buf = kzalloc(bufsz, GFP_KERNEL);
+	if (!bmtd.bbt_buf)
+		return -ENOMEM;
+
+	memset(bmtd.bbt_buf, 0xff, bufsz);
+
+	/* Scanning start from the first page of the last block
+	 * of whole flash
+	 */
+	bmtd.bbt = NULL;
+	for (u16 block = bmtd.total_blks - 1; !bmtd.bbt && block >= bmtd.pool_lba; block--) {
+		u8 fdm[4];
+
+		if (bbt_nand_read(blk_pg(block), bmtd.bbt_buf, bufsz, fdm, sizeof(fdm))) {
+			/* Read failed, try the previous block */
+			continue;
+		}
+
+		if (!is_valid_bmt(bmtd.bbt_buf, fdm)) {
+			/* No valid BMT found, try the previous block */
+			continue;
+		}
+
+		bmtd.bmt_blk_idx = get_bmt_index(bmt_tbl((struct bbbt *)bmtd.bbt_buf));
+		if (bmtd.bmt_blk_idx == 0) {
+			pr_info("[BBT] FATAL ERR: bmt block index is wrong!\n");
+			break;
+		}
+
+		pr_info("[BBT] BMT.v2 is found at 0x%x\n", block);
+		bmtd.bbt = (struct bbbt *)bmtd.bbt_buf;
+	}
+
+	if (!bmtd.bbt) {
+		/* BMT not found */
+		if (bmtd.total_blks > BB_TABLE_MAX + BMT_TABLE_MAX) {
+			pr_info("nand: FATAL: Too many blocks, can not support!\n");
+			return -1;
+		}
+
+		bmtd.bbt = (struct bbbt *)bmtd.bbt_buf;
+		memset(bmt_tbl(bmtd.bbt), BMT_TBL_DEF_VAL,
+		       bmtd.table_size * sizeof(struct bbmt));
+
+		if (scan_bad_blocks(bmtd.bbt))
+			return -1;
+
+		/* BMT always in the last valid block in pool */
+		bmtd.bmt_blk_idx = upload_bmt(bmtd.bbt, bmtd.bmt_blk_idx);
+		block = bmt_tbl(bmtd.bbt)[bmtd.bmt_blk_idx].block;
+		pr_notice("[BBT] BMT.v2 is written into PBA:0x%x\n", block);
+
+		if (bmtd.bmt_blk_idx == 0)
+			pr_info("nand: Warning: no available block in BMT pool!\n");
+		else if (bmtd.bmt_blk_idx == (u16)-1)
+			return -1;
+	}
+
+	return 0;
+}
+
+
+const struct mtk_bmt_ops mtk_bmt_v2_ops = {
+	.sig = "bmt",
+	.sig_len = 3,
+	.init = mtk_bmt_init_v2,
+	.remap_block = remap_block_v2,
+	.unmap_block = unmap_block_v2,
+	.get_mapping_block = get_mapping_block_index_v2,
+	.debug = mtk_bmt_debug_v2,
+};
diff --git a/6.12/target/linux/generic/files/drivers/mtd/parsers/routerbootpart.c b/6.12/target/linux/generic/files/drivers/mtd/parsers/routerbootpart.c
new file mode 100644
index 00000000..aa786cd8
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/mtd/parsers/routerbootpart.c
@@ -0,0 +1,365 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Parser for MikroTik RouterBoot partitions.
+ *
+ * Copyright (C) 2020 Thibaut VARÈNE <hacks+kernel@slashdirt.org>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ *
+ * This parser builds from the "fixed-partitions" one (see ofpart.c), but it can
+ * handle dynamic partitions as found on routerboot devices.
+ *
+ * DTS nodes are defined as follows:
+ * For fixed partitions:
+ *	node-name@unit-address {
+ *		reg = <prop-encoded-array>;
+ *		label = <string>;
+ *		read-only;
+ *		lock;
+ *	};
+ *
+ * reg property is mandatory; other properties are optional.
+ * reg format is <address length>. length can be 0 if the next partition is
+ * another fixed partition or a "well-known" partition as defined below: in that
+ * case the partition will extend up to the next one.
+ *
+ * For dynamic partitions:
+ *	node-name {
+ *		size = <prop-encoded-array>;
+ *		label = <string>;
+ *		read-only;
+ *		lock;
+ *	};
+ *
+ * size property is normally mandatory. It can only be omitted (or set to 0) if:
+ *	- the partition is a "well-known" one (as defined below), in which case
+ *	  the partition size will be automatically adjusted; or
+ *	- the next partition is a fixed one or a "well-known" one, in which case
+ *	  the current partition will extend up to the next one.
+ * Other properties are optional.
+ * size format is <length>.
+ * By default dynamic partitions are appended after the preceding one, except
+ * for "well-known" ones which are automatically located on flash.
+ *
+ * Well-known partitions (matched via label or node-name):
+ * - "hard_config"
+ * - "soft_config"
+ * - "dtb_config"
+ *
+ * Note: this parser will happily register 0-sized partitions if misused.
+ *
+ * This parser requires the DTS to list partitions in ascending order as
+ * expected on the MTD device.
+ *
+ * Since only the "hard_config" and "soft_config" partitions are used in OpenWRT,
+ * a minimal working DTS could define only these two partitions dynamically (in
+ * the right order, usually hard_config then soft_config).
+ *
+ * Note: some mips RB devices encode the hard_config offset and length in two
+ * consecutive u32 located at offset 0x14 (for ramips) or 0x24 (for ath79) on
+ * the SPI NOR flash. Unfortunately this seems inconsistent across machines and
+ * does not apply to e.g. ipq-based ones, so we ignore that information.
+ *
+ * Note: To find well-known partitions, this parser will go through the entire
+ * top mtd partition parsed, _before_ the DTS nodes are processed. This works
+ * well in the current state of affairs, and is a simpler implementation than
+ * searching for known partitions in the "holes" left between fixed-partition,
+ * _after_ processing DTS nodes.
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/of.h>
+#include <linux/of_fdt.h>
+#include <linux/libfdt_env.h>
+#include <linux/string.h>
+
+#define RB_MAGIC_HARD	(('H') | ('a' << 8) | ('r' << 16) | ('d' << 24))
+#define RB_MAGIC_SOFT	(('S') | ('o' << 8) | ('f' << 16) | ('t' << 24))
+#define RB_BLOCK_SIZE	0x1000
+
+struct routerboot_dynpart {
+	const char * const name;
+	const u32 magic;
+	int (* const size_fixup)(struct mtd_info *, struct routerboot_dynpart *);
+	size_t offset;
+	size_t size;
+	bool found;
+};
+
+static int routerboot_dtbsfixup(struct mtd_info *, struct routerboot_dynpart *);
+
+static struct routerboot_dynpart rb_dynparts[] = {
+	{
+		.name = "hard_config",
+		.magic = RB_MAGIC_HARD,	// stored in CPU-endianness on flash
+		.size_fixup = NULL,
+		.offset = 0x0,
+		.size = RB_BLOCK_SIZE,
+		.found = false,
+	}, {
+		.name = "soft_config",
+		.magic = RB_MAGIC_SOFT,	// stored in CPU-endianness on flash
+		.size_fixup = NULL,
+		.offset = 0x0,
+		.size = RB_BLOCK_SIZE,
+		.found = false,
+	}, {
+		.name = "dtb_config",
+		.magic = fdt32_to_cpu(OF_DT_HEADER),	// stored BE on flash
+		.size_fixup = routerboot_dtbsfixup,
+		.offset = 0x0,
+		.size = 0x0,
+		.found = false,
+	}
+};
+
+static int routerboot_dtbsfixup(struct mtd_info *master, struct routerboot_dynpart *rbdpart)
+{
+	int err;
+	size_t bytes_read, psize;
+	struct {
+		fdt32_t magic;
+		fdt32_t totalsize;
+		fdt32_t off_dt_struct;
+		fdt32_t off_dt_strings;
+		fdt32_t off_mem_rsvmap;
+		fdt32_t version;
+		fdt32_t last_comp_version;
+		fdt32_t boot_cpuid_phys;
+		fdt32_t size_dt_strings;
+		fdt32_t size_dt_struct;
+	} fdt_header;
+
+	err = mtd_read(master, rbdpart->offset, sizeof(fdt_header),
+		       &bytes_read, (u8 *)&fdt_header);
+	if (err)
+		return err;
+
+	if (bytes_read != sizeof(fdt_header))
+		return -EIO;
+
+	psize = fdt32_to_cpu(fdt_header.totalsize);
+	if (!psize)
+		return -EINVAL;
+
+	rbdpart->size = psize;
+	return 0;
+}
+
+static void routerboot_find_dynparts(struct mtd_info *master)
+{
+	size_t bytes_read, offset;
+	bool allfound;
+	int err, i;
+	u32 buf;
+
+	/*
+	 * Dynamic RouterBoot partitions offsets are aligned to RB_BLOCK_SIZE:
+	 * read the whole partition at RB_BLOCK_SIZE intervals to find sigs.
+	 * Skip partition content when possible.
+	 */
+	offset = 0;
+	while (offset < master->size) {
+		err = mtd_read(master, offset, sizeof(buf), &bytes_read, (u8 *)&buf);
+		if (err) {
+			pr_err("%s: mtd_read error while parsing (offset: 0x%zX): %d\n",
+			       master->name, offset, err);
+			continue;
+		}
+
+		allfound = true;
+
+		for (i = 0; i < ARRAY_SIZE(rb_dynparts); i++) {
+			if (rb_dynparts[i].found)
+				continue;
+
+			allfound = false;
+
+			if (rb_dynparts[i].magic == buf) {
+				rb_dynparts[i].offset = offset;
+
+				if (rb_dynparts[i].size_fixup) {
+					err = rb_dynparts[i].size_fixup(master, &rb_dynparts[i]);
+					if (err) {
+						pr_err("%s: size fixup error while parsing \"%s\": %d\n",
+						       master->name, rb_dynparts[i].name, err);
+						continue;
+					}
+				}
+
+				rb_dynparts[i].found = true;
+
+				/*
+				 * move offset to skip the whole partition on
+				 * next iteration if size > RB_BLOCK_SIZE.
+				 */
+				if (rb_dynparts[i].size > RB_BLOCK_SIZE)
+					offset += ALIGN_DOWN((rb_dynparts[i].size - RB_BLOCK_SIZE), RB_BLOCK_SIZE);
+
+				break;
+			}
+		}
+
+		offset += RB_BLOCK_SIZE;
+
+		if (allfound)
+			break;
+	}
+}
+
+static int routerboot_partitions_parse(struct mtd_info *master,
+				       const struct mtd_partition **pparts,
+				       struct mtd_part_parser_data *data)
+{
+	struct device_node *rbpart_node, *pp;
+	struct mtd_partition *parts;
+	const char *partname;
+	size_t master_ofs;
+	int np;
+
+	/* Pull of_node from the master device node */
+	rbpart_node = mtd_get_of_node(master);
+	if (!rbpart_node)
+		return 0;
+
+	/* First count the subnodes */
+	np = 0;
+	for_each_child_of_node(rbpart_node,  pp)
+		np++;
+
+	if (!np)
+		return 0;
+
+	parts = kcalloc(np, sizeof(*parts), GFP_KERNEL);
+	if (!parts)
+		return -ENOMEM;
+
+	/* Preemptively look for known parts in flash */
+	routerboot_find_dynparts(master);
+
+	np = 0;
+	master_ofs = 0;
+	for_each_child_of_node(rbpart_node, pp) {
+		const __be32 *reg, *sz;
+		size_t offset, size;
+		int i, len, a_cells, s_cells;
+
+		partname = of_get_property(pp, "label", &len);
+		/* Allow deprecated use of "name" instead of "label" */
+		if (!partname)
+			partname = of_get_property(pp, "name", &len);
+		/* Fallback to node name per spec if all else fails: partname is always set */
+		if (!partname)
+			partname = pp->name;
+		parts[np].name = partname;
+
+		reg = of_get_property(pp, "reg", &len);
+		if (reg) {
+			/* Fixed partition */
+			a_cells = of_n_addr_cells(pp);
+			s_cells = of_n_size_cells(pp);
+
+			if ((len / 4) != (a_cells + s_cells)) {
+				pr_debug("%s: routerboot partition %pOF (%pOF) error parsing reg property.\n",
+					 master->name, pp, rbpart_node);
+				goto rbpart_fail;
+			}
+
+			offset = of_read_number(reg, a_cells);
+			size = of_read_number(reg + a_cells, s_cells);
+		} else {
+			/* Dynamic partition */
+			/* Default: part starts at current offset, 0 size */
+			offset = master_ofs;
+			size = 0;
+
+			/* Check if well-known partition */
+			for (i = 0; i < ARRAY_SIZE(rb_dynparts); i++) {
+				if (!strcmp(partname, rb_dynparts[i].name) && rb_dynparts[i].found) {
+					offset = rb_dynparts[i].offset;
+					size = rb_dynparts[i].size;
+					break;
+				}
+			}
+
+			/* Standalone 'size' property? Override size */
+			sz = of_get_property(pp, "size", &len);
+			if (sz) {
+				s_cells = of_n_size_cells(pp);
+				if ((len / 4) != s_cells) {
+					pr_debug("%s: routerboot partition %pOF (%pOF) error parsing size property.\n",
+						 master->name, pp, rbpart_node);
+					goto rbpart_fail;
+				}
+
+				size = of_read_number(sz, s_cells);
+			}
+		}
+
+		if (np > 0) {
+			/* Minor sanity check for overlaps */
+			if (offset < (parts[np-1].offset + parts[np-1].size)) {
+				pr_err("%s: routerboot partition %pOF (%pOF) \"%s\" overlaps with previous partition \"%s\".\n",
+				       master->name, pp, rbpart_node,
+				       partname, parts[np-1].name);
+				goto rbpart_fail;
+			}
+
+			/* Fixup end of previous partition if necessary */
+			if (!parts[np-1].size)
+				parts[np-1].size = (offset - parts[np-1].offset);
+		}
+
+		if ((offset + size) > master->size) {
+			pr_err("%s: routerboot partition %pOF (%pOF) \"%s\" extends past end of segment.\n",
+			       master->name, pp, rbpart_node, partname);
+			goto rbpart_fail;
+		}
+
+		parts[np].offset = offset;
+		parts[np].size = size;
+		parts[np].of_node = pp;
+
+		if (of_get_property(pp, "read-only", &len))
+			parts[np].mask_flags |= MTD_WRITEABLE;
+
+		if (of_get_property(pp, "lock", &len))
+			parts[np].mask_flags |= MTD_POWERUP_LOCK;
+
+		/* Keep master offset aligned to RB_BLOCK_SIZE */
+		master_ofs = ALIGN(offset + size, RB_BLOCK_SIZE);
+		np++;
+	}
+
+	*pparts = parts;
+	return np;
+
+rbpart_fail:
+	pr_err("%s: error parsing routerboot partition %pOF (%pOF)\n",
+	       master->name, pp, rbpart_node);
+	of_node_put(pp);
+	kfree(parts);
+	return -EINVAL;
+}
+
+static const struct of_device_id parse_routerbootpart_match_table[] = {
+	{ .compatible = "mikrotik,routerboot-partitions" },
+	{},
+};
+MODULE_DEVICE_TABLE(of, parse_routerbootpart_match_table);
+
+static struct mtd_part_parser routerbootpart_parser = {
+	.parse_fn = routerboot_partitions_parse,
+	.name = "routerbootpart",
+	.of_match_table = parse_routerbootpart_match_table,
+};
+module_mtd_part_parser(routerbootpart_parser);
+
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("MTD partitioning for RouterBoot");
+MODULE_AUTHOR("Thibaut VARENE");
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/adm6996.c b/6.12/target/linux/generic/files/drivers/net/phy/adm6996.c
new file mode 100644
index 00000000..271df815
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/adm6996.c
@@ -0,0 +1,1249 @@
+/*
+ * ADM6996 switch driver
+ *
+ * swconfig interface based on ar8216.c
+ *
+ * Copyright (c) 2008 Felix Fietkau <nbd@nbd.name>
+ * VLAN support Copyright (c) 2010, 2011 Peter Lebbing <peter@digitalbrains.com>
+ * Copyright (c) 2013 Hauke Mehrtens <hauke@hauke-m.de>
+ * Copyright (c) 2014 Matti Laakso <malaakso@elisanet.fi>
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of the GNU General Public License v2 as published by the
+ * Free Software Foundation
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+/*#define DEBUG 1*/
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/errno.h>
+#include <linux/unistd.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/gpio.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/spinlock.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <linux/mii.h>
+#include <linux/platform_device.h>
+#include <linux/platform_data/adm6996-gpio.h>
+#include <linux/ethtool.h>
+#include <linux/phy.h>
+#include <linux/switch.h>
+#include <linux/version.h>
+
+#include <asm/io.h>
+#include <asm/irq.h>
+#include <asm/uaccess.h>
+#include "adm6996.h"
+
+MODULE_DESCRIPTION("Infineon ADM6996 Switch");
+MODULE_AUTHOR("Felix Fietkau, Peter Lebbing <peter@digitalbrains.com>");
+MODULE_LICENSE("GPL");
+
+static const char * const adm6996_model_name[] =
+{
+	NULL,
+	"ADM6996FC",
+	"ADM6996M",
+	"ADM6996L"
+};
+
+struct adm6996_mib_desc {
+	unsigned int offset;
+	const char *name;
+};
+
+struct adm6996_priv {
+	struct switch_dev dev;
+	void *priv;
+
+	u8 eecs;
+	u8 eesk;
+	u8 eedi;
+
+	enum adm6996_model model;
+
+	bool enable_vlan;
+	bool vlan_enabled;	/* Current hardware state */
+
+#ifdef DEBUG
+	u16 addr;		/* Debugging: register address to operate on */
+#endif
+
+	u16 pvid[ADM_NUM_PORTS];	/* Primary VLAN ID */
+	u8 tagged_ports;
+
+	u16 vlan_id[ADM_NUM_VLANS];
+	u8 vlan_table[ADM_NUM_VLANS];	/* bitmap, 1 = port is member */
+	u8 vlan_tagged[ADM_NUM_VLANS];	/* bitmap, 1 = tagged member */
+	
+	struct mutex mib_lock;
+	char buf[2048];
+
+	struct mutex reg_mutex;
+
+	/* use abstraction for regops, we want to add gpio support in the future */
+	u16 (*read)(struct adm6996_priv *priv, enum admreg reg);
+	void (*write)(struct adm6996_priv *priv, enum admreg reg, u16 val);
+};
+
+#define to_adm(_dev) container_of(_dev, struct adm6996_priv, dev)
+#define phy_to_adm(_phy) ((struct adm6996_priv *) (_phy)->priv)
+
+#define MIB_DESC(_o, _n)	\
+	{			\
+		.offset = (_o),	\
+		.name = (_n),	\
+	}
+
+static const struct adm6996_mib_desc adm6996_mibs[] = {
+	MIB_DESC(ADM_CL0, "RxPacket"),
+	MIB_DESC(ADM_CL6, "RxByte"),
+	MIB_DESC(ADM_CL12, "TxPacket"),
+	MIB_DESC(ADM_CL18, "TxByte"),
+	MIB_DESC(ADM_CL24, "Collision"),
+	MIB_DESC(ADM_CL30, "Error"),
+};
+
+#define ADM6996_MIB_RXB_ID	1
+#define ADM6996_MIB_TXB_ID	3
+
+static inline u16
+r16(struct adm6996_priv *priv, enum admreg reg)
+{
+	return priv->read(priv, reg);
+}
+
+static inline void
+w16(struct adm6996_priv *priv, enum admreg reg, u16 val)
+{
+	priv->write(priv, reg, val);
+}
+
+/* Minimum timing constants */
+#define EECK_EDGE_TIME  3   /* 3us - max(adm 2.5us, 93c 1us) */
+#define EEDI_SETUP_TIME 1   /* 1us - max(adm 10ns, 93c 400ns) */
+#define EECS_SETUP_TIME 1   /* 1us - max(adm no, 93c 200ns) */
+
+static void adm6996_gpio_write(struct adm6996_priv *priv, int cs, char *buf, unsigned int bits)
+{
+	int i, len = (bits + 7) / 8;
+	u8 mask;
+
+	gpio_set_value(priv->eecs, cs);
+	udelay(EECK_EDGE_TIME);
+
+	/* Byte assemble from MSB to LSB */
+	for (i = 0; i < len; i++) {
+		/* Bit bang from MSB to LSB */
+		for (mask = 0x80; mask && bits > 0; mask >>= 1, bits --) {
+			/* Clock low */
+			gpio_set_value(priv->eesk, 0);
+			udelay(EECK_EDGE_TIME);
+
+			/* Output on rising edge */
+			gpio_set_value(priv->eedi, (mask & buf[i]));
+			udelay(EEDI_SETUP_TIME);
+
+			/* Clock high */
+			gpio_set_value(priv->eesk, 1);
+			udelay(EECK_EDGE_TIME);
+		}
+	}
+
+	/* Clock low */
+	gpio_set_value(priv->eesk, 0);
+	udelay(EECK_EDGE_TIME);
+
+	if (cs)
+		gpio_set_value(priv->eecs, 0);
+}
+
+static void adm6996_gpio_read(struct adm6996_priv *priv, int cs, char *buf, unsigned int bits)
+{
+	int i, len = (bits + 7) / 8;
+	u8 mask;
+
+	gpio_set_value(priv->eecs, cs);
+	udelay(EECK_EDGE_TIME);
+
+	/* Byte assemble from MSB to LSB */
+	for (i = 0; i < len; i++) {
+		u8 byte;
+
+		/* Bit bang from MSB to LSB */
+		for (mask = 0x80, byte = 0; mask && bits > 0; mask >>= 1, bits --) {
+			u8 gp;
+
+			/* Clock low */
+			gpio_set_value(priv->eesk, 0);
+			udelay(EECK_EDGE_TIME);
+
+			/* Input on rising edge */
+			gp = gpio_get_value(priv->eedi);
+			if (gp)
+				byte |= mask;
+
+			/* Clock high */
+			gpio_set_value(priv->eesk, 1);
+			udelay(EECK_EDGE_TIME);
+		}
+
+		*buf++ = byte;
+	}
+
+	/* Clock low */
+	gpio_set_value(priv->eesk, 0);
+	udelay(EECK_EDGE_TIME);
+
+	if (cs)
+		gpio_set_value(priv->eecs, 0);
+}
+
+/* Advance clock(s) */
+static void adm6996_gpio_adclk(struct adm6996_priv *priv, int clocks)
+{
+	int i;
+	for (i = 0; i < clocks; i++) {
+		/* Clock high */
+		gpio_set_value(priv->eesk, 1);
+		udelay(EECK_EDGE_TIME);
+
+		/* Clock low */
+		gpio_set_value(priv->eesk, 0);
+		udelay(EECK_EDGE_TIME);
+	}
+}
+
+static u16
+adm6996_read_gpio_reg(struct adm6996_priv *priv, enum admreg reg)
+{
+	/* cmd: 01 10 T DD R RRRRRR */
+	u8 bits[6] = {
+		0xFF, 0xFF, 0xFF, 0xFF,
+		(0x06 << 4) | ((0 & 0x01) << 3 | (reg&64)>>6),
+		((reg&63)<<2)
+	};
+
+	u8 rbits[4];
+
+	/* Enable GPIO outputs with all pins to 0 */
+	gpio_direction_output(priv->eecs, 0);
+	gpio_direction_output(priv->eesk, 0);
+	gpio_direction_output(priv->eedi, 0);
+
+	adm6996_gpio_write(priv, 0, bits, 46);
+	gpio_direction_input(priv->eedi);
+	adm6996_gpio_adclk(priv, 2);
+	adm6996_gpio_read(priv, 0, rbits, 32);
+
+	/* Extra clock(s) required per datasheet */
+	adm6996_gpio_adclk(priv, 2);
+
+	/* Disable GPIO outputs */
+	gpio_direction_input(priv->eecs);
+	gpio_direction_input(priv->eesk);
+
+	 /* EEPROM has 16-bit registers, but pumps out two registers in one request */
+	return (reg & 0x01 ?  (rbits[0]<<8) | rbits[1] : (rbits[2]<<8) | (rbits[3]));
+}
+
+/* Write chip configuration register */
+/* Follow 93c66 timing and chip's min EEPROM timing requirement */
+static void
+adm6996_write_gpio_reg(struct adm6996_priv *priv, enum admreg reg, u16 val)
+{
+	/* cmd(27bits): sb(1) + opc(01) + addr(bbbbbbbb) + data(bbbbbbbbbbbbbbbb) */
+	u8 bits[4] = {
+		(0x05 << 5) | (reg >> 3),
+		(reg << 5) | (u8)(val >> 11),
+		(u8)(val >> 3),
+		(u8)(val << 5)
+	};
+
+	/* Enable GPIO outputs with all pins to 0 */
+	gpio_direction_output(priv->eecs, 0);
+	gpio_direction_output(priv->eesk, 0);
+	gpio_direction_output(priv->eedi, 0);
+
+	/* Write cmd. Total 27 bits */
+	adm6996_gpio_write(priv, 1, bits, 27);
+
+	/* Extra clock(s) required per datasheet */
+	adm6996_gpio_adclk(priv, 2);
+
+	/* Disable GPIO outputs */
+	gpio_direction_input(priv->eecs);
+	gpio_direction_input(priv->eesk);
+	gpio_direction_input(priv->eedi);
+}
+
+static u16
+adm6996_read_mii_reg(struct adm6996_priv *priv, enum admreg reg)
+{
+	struct phy_device *phydev = priv->priv;
+	struct mii_bus *bus = phydev->mdio.bus;
+
+	return bus->read(bus, PHYADDR(reg));
+}
+
+static void
+adm6996_write_mii_reg(struct adm6996_priv *priv, enum admreg reg, u16 val)
+{
+	struct phy_device *phydev = priv->priv;
+	struct mii_bus *bus = phydev->mdio.bus;
+
+	bus->write(bus, PHYADDR(reg), val);
+}
+
+static int
+adm6996_set_enable_vlan(struct switch_dev *dev, const struct switch_attr *attr,
+			struct switch_val *val)
+{
+	struct adm6996_priv *priv = to_adm(dev);
+
+	if (val->value.i > 1)
+		return -EINVAL;
+
+	priv->enable_vlan = val->value.i;
+
+	return 0;
+};
+
+static int
+adm6996_get_enable_vlan(struct switch_dev *dev, const struct switch_attr *attr,
+			struct switch_val *val)
+{
+	struct adm6996_priv *priv = to_adm(dev);
+
+	val->value.i = priv->enable_vlan;
+
+	return 0;
+};
+
+#ifdef DEBUG
+
+static int
+adm6996_set_addr(struct switch_dev *dev, const struct switch_attr *attr,
+		 struct switch_val *val)
+{
+	struct adm6996_priv *priv = to_adm(dev);
+
+	if (val->value.i > 1023)
+		return -EINVAL;
+
+	priv->addr = val->value.i;
+
+	return 0;
+};
+
+static int
+adm6996_get_addr(struct switch_dev *dev, const struct switch_attr *attr,
+		 struct switch_val *val)
+{
+	struct adm6996_priv *priv = to_adm(dev);
+
+	val->value.i = priv->addr;
+
+	return 0;
+};
+
+static int
+adm6996_set_data(struct switch_dev *dev, const struct switch_attr *attr,
+		 struct switch_val *val)
+{
+	struct adm6996_priv *priv = to_adm(dev);
+
+	if (val->value.i > 65535)
+		return -EINVAL;
+
+	w16(priv, priv->addr, val->value.i);
+
+	return 0;
+};
+
+static int
+adm6996_get_data(struct switch_dev *dev, const struct switch_attr *attr,
+		 struct switch_val *val)
+{
+	struct adm6996_priv *priv = to_adm(dev);
+
+	val->value.i = r16(priv, priv->addr);
+
+	return 0;
+};
+
+#endif /* def DEBUG */
+
+static int
+adm6996_set_pvid(struct switch_dev *dev, int port, int vlan)
+{
+	struct adm6996_priv *priv = to_adm(dev);
+
+	pr_devel("set_pvid port %d vlan %d\n", port, vlan);
+
+	if (vlan > ADM_VLAN_MAX_ID)
+		return -EINVAL;
+
+	priv->pvid[port] = vlan;
+
+	return 0;
+}
+
+static int
+adm6996_get_pvid(struct switch_dev *dev, int port, int *vlan)
+{
+	struct adm6996_priv *priv = to_adm(dev);
+
+	pr_devel("get_pvid port %d\n", port);
+	*vlan = priv->pvid[port];
+
+	return 0;
+}
+
+static int
+adm6996_set_vid(struct switch_dev *dev, const struct switch_attr *attr,
+		struct switch_val *val)
+{
+	struct adm6996_priv *priv = to_adm(dev);
+
+	pr_devel("set_vid port %d vid %d\n", val->port_vlan, val->value.i);
+
+	if (val->value.i > ADM_VLAN_MAX_ID)
+		return -EINVAL;
+
+	priv->vlan_id[val->port_vlan] = val->value.i;
+
+	return 0;
+};
+
+static int
+adm6996_get_vid(struct switch_dev *dev, const struct switch_attr *attr,
+		struct switch_val *val)
+{
+	struct adm6996_priv *priv = to_adm(dev);
+
+	pr_devel("get_vid port %d\n", val->port_vlan);
+
+	val->value.i = priv->vlan_id[val->port_vlan];
+
+	return 0;
+};
+
+static int
+adm6996_get_ports(struct switch_dev *dev, struct switch_val *val)
+{
+	struct adm6996_priv *priv = to_adm(dev);
+	u8 ports = priv->vlan_table[val->port_vlan];
+	u8 tagged = priv->vlan_tagged[val->port_vlan];
+	int i;
+
+	pr_devel("get_ports port_vlan %d\n", val->port_vlan);
+
+	val->len = 0;
+
+	for (i = 0; i < ADM_NUM_PORTS; i++) {
+		struct switch_port *p;
+
+		if (!(ports & (1 << i)))
+			continue;
+
+		p = &val->value.ports[val->len++];
+		p->id = i;
+		if (tagged & (1 << i))
+			p->flags = (1 << SWITCH_PORT_FLAG_TAGGED);
+		else
+			p->flags = 0;
+	}
+
+	return 0;
+};
+
+static int
+adm6996_set_ports(struct switch_dev *dev, struct switch_val *val)
+{
+	struct adm6996_priv *priv = to_adm(dev);
+	u8 *ports = &priv->vlan_table[val->port_vlan];
+	u8 *tagged = &priv->vlan_tagged[val->port_vlan];
+	int i;
+
+	pr_devel("set_ports port_vlan %d ports", val->port_vlan);
+
+	*ports = 0;
+	*tagged = 0;
+
+	for (i = 0; i < val->len; i++) {
+		struct switch_port *p = &val->value.ports[i];
+
+#ifdef DEBUG
+		pr_cont(" %d%s", p->id,
+		       ((p->flags & (1 << SWITCH_PORT_FLAG_TAGGED)) ? "T" :
+			""));
+#endif
+
+		if (p->flags & (1 << SWITCH_PORT_FLAG_TAGGED)) {
+			*tagged |= (1 << p->id);
+			priv->tagged_ports |= (1 << p->id);
+		}
+
+		*ports |= (1 << p->id);
+	}
+
+#ifdef DEBUG
+	pr_cont("\n");
+#endif
+
+	return 0;
+};
+
+/*
+ * Precondition: reg_mutex must be held
+ */
+static void
+adm6996_enable_vlan(struct adm6996_priv *priv)
+{
+	u16 reg;
+
+	reg = r16(priv, ADM_OTBE_P2_PVID);
+	reg &= ~(ADM_OTBE_MASK);
+	w16(priv, ADM_OTBE_P2_PVID, reg);
+	reg = r16(priv, ADM_IFNTE);
+	reg &= ~(ADM_IFNTE_MASK);
+	w16(priv, ADM_IFNTE, reg);
+	reg = r16(priv, ADM_VID_CHECK);
+	reg |= ADM_VID_CHECK_MASK;
+	w16(priv, ADM_VID_CHECK, reg);
+	reg = r16(priv, ADM_SYSC0);
+	reg |= ADM_NTTE;
+	reg &= ~(ADM_RVID1);
+	w16(priv, ADM_SYSC0, reg);
+	reg = r16(priv, ADM_SYSC3);
+	reg |= ADM_TBV;
+	w16(priv, ADM_SYSC3, reg);
+}
+
+static void
+adm6996_enable_vlan_6996l(struct adm6996_priv *priv)
+{
+	u16 reg;
+
+	reg = r16(priv, ADM_SYSC3);
+	reg |= ADM_TBV;
+	reg |= ADM_MAC_CLONE;
+	w16(priv, ADM_SYSC3, reg);
+}
+
+/*
+ * Disable VLANs
+ *
+ * Sets VLAN mapping for port-based VLAN with all ports connected to
+ * eachother (this is also the power-on default).
+ *
+ * Precondition: reg_mutex must be held
+ */
+static void
+adm6996_disable_vlan(struct adm6996_priv *priv)
+{
+	u16 reg;
+	int i;
+
+	for (i = 0; i < ADM_NUM_VLANS; i++) {
+		reg = ADM_VLAN_FILT_MEMBER_MASK;
+		w16(priv, ADM_VLAN_FILT_L(i), reg);
+		reg = ADM_VLAN_FILT_VALID | ADM_VLAN_FILT_VID(1);
+		w16(priv, ADM_VLAN_FILT_H(i), reg);
+	}
+
+	reg = r16(priv, ADM_OTBE_P2_PVID);
+	reg |= ADM_OTBE_MASK;
+	w16(priv, ADM_OTBE_P2_PVID, reg);
+	reg = r16(priv, ADM_IFNTE);
+	reg |= ADM_IFNTE_MASK;
+	w16(priv, ADM_IFNTE, reg);
+	reg = r16(priv, ADM_VID_CHECK);
+	reg &= ~(ADM_VID_CHECK_MASK);
+	w16(priv, ADM_VID_CHECK, reg);
+	reg = r16(priv, ADM_SYSC0);
+	reg &= ~(ADM_NTTE);
+	reg |= ADM_RVID1;
+	w16(priv, ADM_SYSC0, reg);
+	reg = r16(priv, ADM_SYSC3);
+	reg &= ~(ADM_TBV);
+	w16(priv, ADM_SYSC3, reg);
+}
+
+/*
+ * Disable VLANs
+ *
+ * Sets VLAN mapping for port-based VLAN with all ports connected to
+ * eachother (this is also the power-on default).
+ *
+ * Precondition: reg_mutex must be held
+ */
+static void
+adm6996_disable_vlan_6996l(struct adm6996_priv *priv)
+{
+	u16 reg;
+	int i;
+
+	for (i = 0; i < ADM_NUM_VLANS; i++) {
+		w16(priv, ADM_VLAN_MAP(i), 0);
+	}
+
+	reg = r16(priv, ADM_SYSC3);
+	reg &= ~(ADM_TBV);
+	reg &= ~(ADM_MAC_CLONE);
+	w16(priv, ADM_SYSC3, reg);
+}
+
+/*
+ * Precondition: reg_mutex must be held
+ */
+static void
+adm6996_apply_port_pvids(struct adm6996_priv *priv)
+{
+	u16 reg;
+	int i;
+
+	for (i = 0; i < ADM_NUM_PORTS; i++) {
+		reg = r16(priv, adm_portcfg[i]);
+		reg &= ~(ADM_PORTCFG_PVID_MASK);
+		reg |= ADM_PORTCFG_PVID(priv->pvid[i]);
+		if (priv->model == ADM6996L) {
+			if (priv->tagged_ports & (1 << i))
+				reg |= (1 << 4);
+			else
+				reg &= ~(1 << 4);
+		}
+		w16(priv, adm_portcfg[i], reg);
+	}
+
+	w16(priv, ADM_P0_PVID, ADM_P0_PVID_VAL(priv->pvid[0]));
+	w16(priv, ADM_P1_PVID, ADM_P1_PVID_VAL(priv->pvid[1]));
+	reg = r16(priv, ADM_OTBE_P2_PVID);
+	reg &= ~(ADM_P2_PVID_MASK);
+	reg |= ADM_P2_PVID_VAL(priv->pvid[2]);
+	w16(priv, ADM_OTBE_P2_PVID, reg);
+	reg = ADM_P3_PVID_VAL(priv->pvid[3]);
+	reg |= ADM_P4_PVID_VAL(priv->pvid[4]);
+	w16(priv, ADM_P3_P4_PVID, reg);
+	reg = r16(priv, ADM_P5_PVID);
+	reg &= ~(ADM_P2_PVID_MASK);
+	reg |= ADM_P5_PVID_VAL(priv->pvid[5]);
+	w16(priv, ADM_P5_PVID, reg);
+}
+
+/*
+ * Precondition: reg_mutex must be held
+ */
+static void
+adm6996_apply_vlan_filters(struct adm6996_priv *priv)
+{
+	u8 ports, tagged;
+	u16 vid, reg;
+	int i;
+
+	for (i = 0; i < ADM_NUM_VLANS; i++) {
+		vid = priv->vlan_id[i];
+		ports = priv->vlan_table[i];
+		tagged = priv->vlan_tagged[i];
+
+		if (ports == 0) {
+			/* Disable VLAN entry */
+			w16(priv, ADM_VLAN_FILT_H(i), 0);
+			w16(priv, ADM_VLAN_FILT_L(i), 0);
+			continue;
+		}
+
+		reg = ADM_VLAN_FILT_MEMBER(ports);
+		reg |= ADM_VLAN_FILT_TAGGED(tagged);
+		w16(priv, ADM_VLAN_FILT_L(i), reg);
+		reg = ADM_VLAN_FILT_VALID | ADM_VLAN_FILT_VID(vid);
+		w16(priv, ADM_VLAN_FILT_H(i), reg);
+	}
+}
+
+static void
+adm6996_apply_vlan_filters_6996l(struct adm6996_priv *priv)
+{
+	u8 ports;
+	u16 reg;
+	int i;
+
+	for (i = 0; i < ADM_NUM_VLANS; i++) {
+		ports = priv->vlan_table[i];
+
+		if (ports == 0) {
+			/* Disable VLAN entry */
+			w16(priv, ADM_VLAN_MAP(i), 0);
+			continue;
+		} else {
+			reg = ADM_VLAN_FILT(ports);
+			w16(priv, ADM_VLAN_MAP(i), reg);
+		}
+	}
+}
+
+static int
+adm6996_hw_apply(struct switch_dev *dev)
+{
+	struct adm6996_priv *priv = to_adm(dev);
+
+	pr_devel("hw_apply\n");
+
+	mutex_lock(&priv->reg_mutex);
+
+	if (!priv->enable_vlan) {
+		if (priv->vlan_enabled) {
+			if (priv->model == ADM6996L)
+				adm6996_disable_vlan_6996l(priv);
+			else
+				adm6996_disable_vlan(priv);
+			priv->vlan_enabled = 0;
+		}
+		goto out;
+	}
+
+	if (!priv->vlan_enabled) {
+		if (priv->model == ADM6996L)
+			adm6996_enable_vlan_6996l(priv);
+		else
+			adm6996_enable_vlan(priv);
+		priv->vlan_enabled = 1;
+	}
+
+	adm6996_apply_port_pvids(priv);
+	if (priv->model == ADM6996L)
+		adm6996_apply_vlan_filters_6996l(priv);
+	else
+		adm6996_apply_vlan_filters(priv);
+
+out:
+	mutex_unlock(&priv->reg_mutex);
+
+	return 0;
+}
+
+/*
+ * Reset the switch
+ *
+ * The ADM6996 can't do a software-initiated reset, so we just initialise the
+ * registers we support in this driver.
+ *
+ * Precondition: reg_mutex must be held
+ */
+static void
+adm6996_perform_reset (struct adm6996_priv *priv)
+{
+	int i;
+
+	/* initialize port and vlan settings */
+	for (i = 0; i < ADM_NUM_PORTS - 1; i++) {
+		w16(priv, adm_portcfg[i], ADM_PORTCFG_INIT |
+			ADM_PORTCFG_PVID(0));
+	}
+	w16(priv, adm_portcfg[5], ADM_PORTCFG_CPU);
+
+	if (priv->model == ADM6996M || priv->model == ADM6996FC) {
+		/* reset all PHY ports */
+		for (i = 0; i < ADM_PHY_PORTS; i++) {
+			w16(priv, ADM_PHY_PORT(i), ADM_PHYCFG_INIT);
+		}
+	}
+
+	priv->enable_vlan = 0;
+	priv->vlan_enabled = 0;
+
+	for (i = 0; i < ADM_NUM_PORTS; i++) {
+		priv->pvid[i] = 0;
+	}
+
+	for (i = 0; i < ADM_NUM_VLANS; i++) {
+		priv->vlan_id[i] = i;
+		priv->vlan_table[i] = 0;
+		priv->vlan_tagged[i] = 0;
+	}
+
+	if (priv->model == ADM6996M) {
+		/* Clear VLAN priority map so prio's are unused */
+		w16 (priv, ADM_VLAN_PRIOMAP, 0);
+
+		adm6996_disable_vlan(priv);
+		adm6996_apply_port_pvids(priv);
+	} else if (priv->model == ADM6996L) {
+		/* Clear VLAN priority map so prio's are unused */
+		w16 (priv, ADM_VLAN_PRIOMAP, 0);
+
+		adm6996_disable_vlan_6996l(priv);
+		adm6996_apply_port_pvids(priv);
+	}
+}
+
+static int
+adm6996_reset_switch(struct switch_dev *dev)
+{
+	struct adm6996_priv *priv = to_adm(dev);
+
+	pr_devel("reset\n");
+
+	mutex_lock(&priv->reg_mutex);
+	adm6996_perform_reset (priv);
+	mutex_unlock(&priv->reg_mutex);
+	return 0;
+}
+
+static int
+adm6996_get_port_link(struct switch_dev *dev, int port,
+		struct switch_port_link *link)
+{
+	struct adm6996_priv *priv = to_adm(dev);
+	
+	u16 reg = 0;
+	
+	if (port >= ADM_NUM_PORTS)
+		return -EINVAL;
+	
+	switch (port) {
+	case 0:
+		reg = r16(priv, ADM_PS0);
+		break;
+	case 1:
+		reg = r16(priv, ADM_PS0);
+		reg = reg >> 8;
+		break;
+	case 2:
+		reg = r16(priv, ADM_PS1);
+		break;
+	case 3:
+		reg = r16(priv, ADM_PS1);
+		reg = reg >> 8;
+		break;
+	case 4:
+		reg = r16(priv, ADM_PS1);
+		reg = reg >> 12;
+		break;
+	case 5:
+		reg = r16(priv, ADM_PS2);
+		/* Bits 0, 1, 3 and 4. */
+		reg = (reg & 3) | ((reg & 24) >> 1);
+		break;
+	default:
+		return -EINVAL;
+	}
+	
+	link->link = reg & ADM_PS_LS;
+	if (!link->link)
+		return 0;
+	link->aneg = true;
+	link->duplex = reg & ADM_PS_DS;
+	link->tx_flow = reg & ADM_PS_FCS;
+	link->rx_flow = reg & ADM_PS_FCS;
+	if (reg & ADM_PS_SS)
+		link->speed = SWITCH_PORT_SPEED_100;
+	else
+		link->speed = SWITCH_PORT_SPEED_10;
+
+	return 0;
+}
+
+static int
+adm6996_sw_get_port_mib(struct switch_dev *dev,
+		       const struct switch_attr *attr,
+		       struct switch_val *val)
+{
+	struct adm6996_priv *priv = to_adm(dev);
+	int port;
+	char *buf = priv->buf;
+	int i, len = 0;
+	u32 reg = 0;
+
+	port = val->port_vlan;
+	if (port >= ADM_NUM_PORTS)
+		return -EINVAL;
+
+	mutex_lock(&priv->mib_lock);
+
+	len += snprintf(buf + len, sizeof(priv->buf) - len,
+			"Port %d MIB counters\n",
+			port);
+
+	for (i = 0; i < ARRAY_SIZE(adm6996_mibs); i++) {
+		reg = r16(priv, adm6996_mibs[i].offset + ADM_OFFSET_PORT(port));
+		reg += r16(priv, adm6996_mibs[i].offset + ADM_OFFSET_PORT(port) + 1) << 16;
+		len += snprintf(buf + len, sizeof(priv->buf) - len,
+				"%-12s: %u\n",
+				adm6996_mibs[i].name,
+				reg);
+	}
+
+	mutex_unlock(&priv->mib_lock);
+
+	val->value.s = buf;
+	val->len = len;
+
+	return 0;
+}
+
+static int
+adm6996_get_port_stats(struct switch_dev *dev, int port,
+			struct switch_port_stats *stats)
+{
+	struct adm6996_priv *priv = to_adm(dev);
+	int id;
+	u32 reg = 0;
+
+	if (port >= ADM_NUM_PORTS)
+		return -EINVAL;
+
+	mutex_lock(&priv->mib_lock);
+
+	id = ADM6996_MIB_TXB_ID;
+	reg = r16(priv, adm6996_mibs[id].offset + ADM_OFFSET_PORT(port));
+	reg += r16(priv, adm6996_mibs[id].offset + ADM_OFFSET_PORT(port) + 1) << 16;
+	stats->tx_bytes = reg;
+
+	id = ADM6996_MIB_RXB_ID;
+	reg = r16(priv, adm6996_mibs[id].offset + ADM_OFFSET_PORT(port));
+	reg += r16(priv, adm6996_mibs[id].offset + ADM_OFFSET_PORT(port) + 1) << 16;
+	stats->rx_bytes = reg;
+
+	mutex_unlock(&priv->mib_lock);
+
+	return 0;
+}
+
+static struct switch_attr adm6996_globals[] = {
+	{
+	 .type = SWITCH_TYPE_INT,
+	 .name = "enable_vlan",
+	 .description = "Enable VLANs",
+	 .set = adm6996_set_enable_vlan,
+	 .get = adm6996_get_enable_vlan,
+	},
+#ifdef DEBUG
+	{
+	 .type = SWITCH_TYPE_INT,
+	 .name = "addr",
+	 .description =
+	 "Direct register access: set register address (0 - 1023)",
+	 .set = adm6996_set_addr,
+	 .get = adm6996_get_addr,
+	 },
+	{
+	 .type = SWITCH_TYPE_INT,
+	 .name = "data",
+	 .description =
+	 "Direct register access: read/write to register (0 - 65535)",
+	 .set = adm6996_set_data,
+	 .get = adm6996_get_data,
+	 },
+#endif /* def DEBUG */
+};
+
+static struct switch_attr adm6996_port[] = {
+	{
+	 .type = SWITCH_TYPE_STRING,
+	 .name = "mib",
+	 .description = "Get port's MIB counters",
+	 .set = NULL,
+	 .get = adm6996_sw_get_port_mib,
+	},
+};
+
+static struct switch_attr adm6996_vlan[] = {
+	{
+	 .type = SWITCH_TYPE_INT,
+	 .name = "vid",
+	 .description = "VLAN ID",
+	 .set = adm6996_set_vid,
+	 .get = adm6996_get_vid,
+	 },
+};
+
+static struct switch_dev_ops adm6996_ops = {
+	.attr_global = {
+			.attr = adm6996_globals,
+			.n_attr = ARRAY_SIZE(adm6996_globals),
+			},
+	.attr_port = {
+		      .attr = adm6996_port,
+		      .n_attr = ARRAY_SIZE(adm6996_port),
+		      },
+	.attr_vlan = {
+		      .attr = adm6996_vlan,
+		      .n_attr = ARRAY_SIZE(adm6996_vlan),
+		      },
+	.get_port_pvid = adm6996_get_pvid,
+	.set_port_pvid = adm6996_set_pvid,
+	.get_vlan_ports = adm6996_get_ports,
+	.set_vlan_ports = adm6996_set_ports,
+	.apply_config = adm6996_hw_apply,
+	.reset_switch = adm6996_reset_switch,
+	.get_port_link = adm6996_get_port_link,
+	.get_port_stats = adm6996_get_port_stats,
+};
+
+static int adm6996_switch_init(struct adm6996_priv *priv, const char *alias, struct net_device *netdev)
+{
+	struct switch_dev *swdev;
+	u16 test, old;
+
+	if (!priv->model) {
+		/* Detect type of chip */
+		old = r16(priv, ADM_VID_CHECK);
+		test = old ^ (1 << 12);
+		w16(priv, ADM_VID_CHECK, test);
+		test ^= r16(priv, ADM_VID_CHECK);
+		if (test & (1 << 12)) {
+			/* 
+			 * Bit 12 of this register is read-only. 
+			 * This is the FC model. 
+			 */
+			priv->model = ADM6996FC;
+		} else {
+			/* Bit 12 is read-write. This is the M model. */
+			priv->model = ADM6996M;
+			w16(priv, ADM_VID_CHECK, old);
+		}
+	}
+
+	swdev = &priv->dev;
+	swdev->name = (adm6996_model_name[priv->model]);
+	swdev->cpu_port = ADM_CPU_PORT;
+	swdev->ports = ADM_NUM_PORTS;
+	swdev->vlans = ADM_NUM_VLANS;
+	swdev->ops = &adm6996_ops;
+	swdev->alias = alias;
+
+	/* The ADM6996L connected through GPIOs does not support any switch
+	   status calls */
+	if (priv->model == ADM6996L) {
+		adm6996_ops.attr_port.n_attr = 0;
+		adm6996_ops.get_port_link = NULL;
+	}
+
+	pr_info ("%s: %s model PHY found.\n", alias, swdev->name);
+
+	mutex_lock(&priv->reg_mutex);
+	adm6996_perform_reset (priv);
+	mutex_unlock(&priv->reg_mutex);
+
+	if (priv->model == ADM6996M || priv->model == ADM6996L) {
+		return register_switch(swdev, netdev);
+	}
+
+	return -ENODEV;
+}
+
+static int adm6996_config_init(struct phy_device *pdev)
+{
+	struct adm6996_priv *priv;
+	int ret;
+
+	linkmode_zero(pdev->supported);
+	linkmode_set_bit(ETHTOOL_LINK_MODE_100baseT_Full_BIT, pdev->supported);
+	linkmode_copy(pdev->advertising, pdev->supported);
+
+	if (pdev->mdio.addr != 0) {
+		pr_info ("%s: PHY overlaps ADM6996, providing fixed PHY 0x%x.\n"
+				, pdev->attached_dev->name, pdev->mdio.addr);
+		return 0;
+	}
+
+	priv = devm_kzalloc(&pdev->mdio.dev, sizeof(struct adm6996_priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	mutex_init(&priv->reg_mutex);
+	mutex_init(&priv->mib_lock);
+	priv->priv = pdev;
+	priv->read = adm6996_read_mii_reg;
+	priv->write = adm6996_write_mii_reg;
+
+	ret = adm6996_switch_init(priv, pdev->attached_dev->name, pdev->attached_dev);
+	if (ret < 0)
+		return ret;
+
+	pdev->priv = priv;
+
+	return 0;
+}
+
+/*
+ * Warning: phydev->priv is NULL if phydev->mdio.addr != 0
+ */
+static int adm6996_read_status(struct phy_device *phydev)
+{
+	phydev->speed = SPEED_100;
+	phydev->duplex = DUPLEX_FULL;
+	phydev->link = 1;
+
+	phydev->state = PHY_RUNNING;
+	netif_carrier_on(phydev->attached_dev);
+	phydev->adjust_link(phydev->attached_dev);
+
+	return 0;
+}
+
+/*
+ * Warning: phydev->priv is NULL if phydev->mdio.addr != 0
+ */
+static int adm6996_config_aneg(struct phy_device *phydev)
+{
+	return 0;
+}
+
+static int adm6996_fixup(struct phy_device *dev)
+{
+	struct mii_bus *bus = dev->mdio.bus;
+	u16 reg;
+
+	/* Our custom registers are at PHY addresses 0-10. Claim those. */
+	if (dev->mdio.addr > 10)
+		return 0;
+
+	/* look for the switch on the bus */
+	reg = bus->read(bus, PHYADDR(ADM_SIG0)) & ADM_SIG0_MASK;
+	if (reg != ADM_SIG0_VAL)
+		return 0;
+
+	reg = bus->read(bus, PHYADDR(ADM_SIG1)) & ADM_SIG1_MASK;
+	if (reg != ADM_SIG1_VAL)
+		return 0;
+
+	dev->phy_id = (ADM_SIG0_VAL << 16) | ADM_SIG1_VAL;
+
+	return 0;
+}
+
+static int adm6996_probe(struct phy_device *pdev)
+{
+	return 0;
+}
+
+static void adm6996_remove(struct phy_device *pdev)
+{
+	struct adm6996_priv *priv = phy_to_adm(pdev);
+
+	if (priv && (priv->model == ADM6996M || priv->model == ADM6996L))
+		unregister_switch(&priv->dev);
+}
+
+static int adm6996_soft_reset(struct phy_device *phydev)
+{
+	/* we don't need an extra reset */
+	return 0;
+}
+
+static struct phy_driver adm6996_phy_driver = {
+	.name		= "Infineon ADM6996",
+	.phy_id		= (ADM_SIG0_VAL << 16) | ADM_SIG1_VAL,
+	.phy_id_mask	= 0xffffffff,
+	.features	= PHY_BASIC_FEATURES,
+	.probe		= adm6996_probe,
+	.remove		= adm6996_remove,
+	.config_init	= &adm6996_config_init,
+	.config_aneg	= &adm6996_config_aneg,
+	.read_status	= &adm6996_read_status,
+	.soft_reset	= adm6996_soft_reset,
+};
+
+static int adm6996_gpio_probe(struct platform_device *pdev)
+{
+	struct adm6996_gpio_platform_data *pdata = pdev->dev.platform_data;
+	struct adm6996_priv *priv;
+	int ret;
+
+	if (!pdata)
+		return -EINVAL;
+
+	priv = devm_kzalloc(&pdev->dev, sizeof(struct adm6996_priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	mutex_init(&priv->reg_mutex);
+	mutex_init(&priv->mib_lock);
+
+	priv->eecs = pdata->eecs;
+	priv->eedi = pdata->eedi;
+	priv->eesk = pdata->eesk;
+
+	priv->model = pdata->model;
+	priv->read = adm6996_read_gpio_reg;
+	priv->write = adm6996_write_gpio_reg;
+
+	ret = devm_gpio_request(&pdev->dev, priv->eecs, "adm_eecs");
+	if (ret)
+		return ret;
+	ret = devm_gpio_request(&pdev->dev, priv->eedi, "adm_eedi");
+	if (ret)
+		return ret;
+	ret = devm_gpio_request(&pdev->dev, priv->eesk, "adm_eesk");
+	if (ret)
+		return ret;
+
+	ret = adm6996_switch_init(priv, dev_name(&pdev->dev), NULL);
+	if (ret < 0)
+		return ret;
+
+	platform_set_drvdata(pdev, priv);
+
+	return 0;
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6,11,0)
+static int adm6996_gpio_remove(struct platform_device *pdev)
+#else
+static void adm6996_gpio_remove(struct platform_device *pdev)
+#endif
+{
+	struct adm6996_priv *priv = platform_get_drvdata(pdev);
+
+	if (priv && (priv->model == ADM6996M || priv->model == ADM6996L))
+		unregister_switch(&priv->dev);
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6,11,0)
+	return 0;
+#endif
+}
+
+static struct platform_driver adm6996_gpio_driver = {
+	.probe = adm6996_gpio_probe,
+	.remove = adm6996_gpio_remove,
+	.driver = {
+		.name = "adm6996_gpio",
+	},
+};
+
+static int __init adm6996_init(void)
+{
+	int err;
+
+	phy_register_fixup_for_id(PHY_ANY_ID, adm6996_fixup);
+	err = phy_driver_register(&adm6996_phy_driver, THIS_MODULE);
+	if (err)
+		return err;
+
+	err = platform_driver_register(&adm6996_gpio_driver);
+	if (err)
+		phy_driver_unregister(&adm6996_phy_driver);
+
+	return err;
+}
+
+static void __exit adm6996_exit(void)
+{
+	platform_driver_unregister(&adm6996_gpio_driver);
+	phy_driver_unregister(&adm6996_phy_driver);
+}
+
+module_init(adm6996_init);
+module_exit(adm6996_exit);
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/adm6996.h b/6.12/target/linux/generic/files/drivers/net/phy/adm6996.h
new file mode 100644
index 00000000..6fd460a4
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/adm6996.h
@@ -0,0 +1,186 @@
+/*
+ * ADM6996 switch driver
+ *
+ * Copyright (c) 2008 Felix Fietkau <nbd@nbd.name>
+ * Copyright (c) 2010,2011 Peter Lebbing <peter@digitalbrains.com>
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of the GNU General Public License v2 as published by the
+ * Free Software Foundation
+ */
+#ifndef __ADM6996_H
+#define __ADM6996_H
+
+/*
+ * ADM_PHY_PORTS: Number of ports with a PHY.
+ * We only control ports 0 to 3, because if 4 is connected, it is most likely
+ * not connected to the switch but to a separate MII and MAC for the WAN port.
+ */
+#define ADM_PHY_PORTS	4
+#define ADM_NUM_PORTS	6
+#define ADM_CPU_PORT	5
+
+#define ADM_NUM_VLANS 16
+#define ADM_VLAN_MAX_ID 4094
+
+enum admreg {
+	ADM_EEPROM_BASE		= 0x0,
+		ADM_P0_CFG		= ADM_EEPROM_BASE + 1,
+		ADM_P1_CFG		= ADM_EEPROM_BASE + 3,
+		ADM_P2_CFG		= ADM_EEPROM_BASE + 5,
+		ADM_P3_CFG		= ADM_EEPROM_BASE + 7,
+		ADM_P4_CFG		= ADM_EEPROM_BASE + 8,
+		ADM_P5_CFG		= ADM_EEPROM_BASE + 9,
+		ADM_SYSC0		= ADM_EEPROM_BASE + 0xa,
+		ADM_VLAN_PRIOMAP	= ADM_EEPROM_BASE + 0xe,
+		ADM_SYSC3		= ADM_EEPROM_BASE + 0x11,
+		/* Input Force No Tag Enable */
+		ADM_IFNTE		= ADM_EEPROM_BASE + 0x20,
+		ADM_VID_CHECK		= ADM_EEPROM_BASE + 0x26,
+		ADM_P0_PVID		= ADM_EEPROM_BASE + 0x28,
+		ADM_P1_PVID		= ADM_EEPROM_BASE + 0x29,
+		/* Output Tag Bypass Enable and P2 PVID */
+		ADM_OTBE_P2_PVID	= ADM_EEPROM_BASE + 0x2a,
+		ADM_P3_P4_PVID		= ADM_EEPROM_BASE + 0x2b,
+		ADM_P5_PVID		= ADM_EEPROM_BASE + 0x2c,
+	ADM_EEPROM_EXT_BASE	= 0x40,
+#define ADM_VLAN_FILT_L(n) (ADM_EEPROM_EXT_BASE + 2 * (n))
+#define ADM_VLAN_FILT_H(n) (ADM_EEPROM_EXT_BASE + 1 + 2 * (n))
+#define ADM_VLAN_MAP(n) (ADM_EEPROM_BASE + 0x13 + n)
+	ADM_COUNTER_BASE	= 0xa0,
+		ADM_SIG0		= ADM_COUNTER_BASE + 0,
+		ADM_SIG1		= ADM_COUNTER_BASE + 1,
+		ADM_PS0		= ADM_COUNTER_BASE + 2,
+		ADM_PS1		= ADM_COUNTER_BASE + 3,
+		ADM_PS2		= ADM_COUNTER_BASE + 4,
+		ADM_CL0		= ADM_COUNTER_BASE + 8, /* RxPacket */
+		ADM_CL6		= ADM_COUNTER_BASE + 0x1a, /* RxByte */
+		ADM_CL12		= ADM_COUNTER_BASE + 0x2c, /* TxPacket */
+		ADM_CL18		= ADM_COUNTER_BASE + 0x3e, /* TxByte */
+		ADM_CL24		= ADM_COUNTER_BASE + 0x50, /* Coll */
+		ADM_CL30		= ADM_COUNTER_BASE + 0x62, /* Err */
+#define ADM_OFFSET_PORT(n) ((n * 4) - (n / 4) * 2 - (n / 5) * 2)
+	ADM_PHY_BASE		= 0x200,
+#define ADM_PHY_PORT(n) (ADM_PHY_BASE + (0x20 * n))
+};
+
+/* Chip identification patterns */
+#define	ADM_SIG0_MASK	0xffff
+#define ADM_SIG0_VAL	0x1023
+#define ADM_SIG1_MASK	0xffff
+#define ADM_SIG1_VAL	0x0007
+
+enum {
+	ADM_PHYCFG_COLTST     = (1 << 7),	/* Enable collision test */
+	ADM_PHYCFG_DPLX       = (1 << 8),	/* Enable full duplex */
+	ADM_PHYCFG_ANEN_RST   = (1 << 9),	/* Restart auto negotiation (self clear) */
+	ADM_PHYCFG_ISO        = (1 << 10),	/* Isolate PHY */
+	ADM_PHYCFG_PDN        = (1 << 11),	/* Power down PHY */
+	ADM_PHYCFG_ANEN       = (1 << 12),	/* Enable auto negotiation */
+	ADM_PHYCFG_SPEED_100  = (1 << 13),	/* Enable 100 Mbit/s */
+	ADM_PHYCFG_LPBK       = (1 << 14),	/* Enable loopback operation */
+	ADM_PHYCFG_RST        = (1 << 15),	/* Reset the port (self clear) */
+	ADM_PHYCFG_INIT = (
+		ADM_PHYCFG_RST |
+		ADM_PHYCFG_SPEED_100 |
+		ADM_PHYCFG_ANEN |
+		ADM_PHYCFG_ANEN_RST
+	)
+};
+
+enum {
+	ADM_PORTCFG_FC        = (1 << 0),	/* Enable 802.x flow control */
+	ADM_PORTCFG_AN        = (1 << 1),	/* Enable auto-negotiation */
+	ADM_PORTCFG_SPEED_100 = (1 << 2),	/* Enable 100 Mbit/s */
+	ADM_PORTCFG_DPLX      = (1 << 3),	/* Enable full duplex */
+	ADM_PORTCFG_OT        = (1 << 4),	/* Output tagged packets */
+	ADM_PORTCFG_PD        = (1 << 5),	/* Port disable */
+	ADM_PORTCFG_TV_PRIO   = (1 << 6),	/* 0 = VLAN based priority
+	                                 	 * 1 = TOS based priority */
+	ADM_PORTCFG_PPE       = (1 << 7),	/* Port based priority enable */
+	ADM_PORTCFG_PP_S      = (1 << 8),	/* Port based priority, 2 bits */
+	ADM_PORTCFG_PVID_BASE = (1 << 10),	/* Primary VLAN id, 4 bits */
+	ADM_PORTCFG_FSE	      = (1 << 14),	/* Fx select enable */
+	ADM_PORTCFG_CAM       = (1 << 15),	/* Crossover Auto MDIX */
+
+	ADM_PORTCFG_INIT = (
+		ADM_PORTCFG_FC |
+		ADM_PORTCFG_AN |
+		ADM_PORTCFG_SPEED_100 |
+		ADM_PORTCFG_DPLX |
+		ADM_PORTCFG_CAM
+	),
+	ADM_PORTCFG_CPU = (
+		ADM_PORTCFG_FC |
+		ADM_PORTCFG_SPEED_100 |
+		ADM_PORTCFG_OT |
+		ADM_PORTCFG_DPLX
+	),
+};
+
+#define ADM_PORTCFG_PPID(n) ((n & 0x3) << 8)
+#define ADM_PORTCFG_PVID(n) ((n & 0xf) << 10)
+#define ADM_PORTCFG_PVID_MASK (0xf << 10)
+
+#define ADM_IFNTE_MASK (0x3f << 9)
+#define ADM_VID_CHECK_MASK (0x3f << 6)
+
+#define ADM_P0_PVID_VAL(n) ((((n) & 0xff0) >> 4) << 0)
+#define ADM_P1_PVID_VAL(n) ((((n) & 0xff0) >> 4) << 0)
+#define ADM_P2_PVID_VAL(n) ((((n) & 0xff0) >> 4) << 0)
+#define ADM_P3_PVID_VAL(n) ((((n) & 0xff0) >> 4) << 0)
+#define ADM_P4_PVID_VAL(n) ((((n) & 0xff0) >> 4) << 8)
+#define ADM_P5_PVID_VAL(n) ((((n) & 0xff0) >> 4) << 0)
+#define ADM_P2_PVID_MASK 0xff
+
+#define ADM_OTBE(n) (((n) & 0x3f) << 8)
+#define ADM_OTBE_MASK (0x3f << 8)
+
+/* ADM_SYSC0 */
+enum {
+	ADM_NTTE	= (1 << 2),	/* New Tag Transmit Enable */
+	ADM_RVID1	= (1 << 8)	/* Replace VLAN ID 1 */
+};
+
+/* Tag Based VLAN in ADM_SYSC3 */
+#define ADM_MAC_CLONE	BIT(4)
+#define ADM_TBV		BIT(5)
+
+static const u8 adm_portcfg[] = {
+	[0] = ADM_P0_CFG,
+	[1] = ADM_P1_CFG,
+	[2] = ADM_P2_CFG,
+	[3] = ADM_P3_CFG,
+	[4] = ADM_P4_CFG,
+	[5] = ADM_P5_CFG,
+};
+
+/* Fields in ADM_VLAN_FILT_L(x) */
+#define ADM_VLAN_FILT_FID(n) (((n) & 0xf) << 12)
+#define ADM_VLAN_FILT_TAGGED(n) (((n) & 0x3f) << 6)
+#define ADM_VLAN_FILT_MEMBER(n) (((n) & 0x3f) << 0)
+#define ADM_VLAN_FILT_MEMBER_MASK 0x3f
+/* Fields in ADM_VLAN_FILT_H(x) */
+#define ADM_VLAN_FILT_VALID (1 << 15)
+#define ADM_VLAN_FILT_VID(n) (((n) & 0xfff) << 0)
+
+/* Convert ports to a form for ADM6996L VLAN map */
+#define ADM_VLAN_FILT(ports) ((ports & 0x01) | ((ports & 0x02) << 1) | \
+			((ports & 0x04) << 2) | ((ports & 0x08) << 3) | \
+			((ports & 0x10) << 3) | ((ports & 0x20) << 3))
+
+/* Port status register */
+enum {
+	ADM_PS_LS = (1 << 0),	/* Link status */
+	ADM_PS_SS = (1 << 1),	/* Speed status */
+	ADM_PS_DS = (1 << 2),	/* Duplex status */
+	ADM_PS_FCS = (1 << 3)	/* Flow control status */
+};
+
+/*
+ * Split the register address in phy id and register
+ * it will get combined again by the mdio bus op
+ */
+#define PHYADDR(_reg)	((_reg >> 5) & 0xff), (_reg & 0x1f)
+
+#endif
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/ar8216.c b/6.12/target/linux/generic/files/drivers/net/phy/ar8216.c
new file mode 100644
index 00000000..84b923ff
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/ar8216.c
@@ -0,0 +1,2909 @@
+/*
+ * ar8216.c: AR8216 switch driver
+ *
+ * Copyright (C) 2009 Felix Fietkau <nbd@nbd.name>
+ * Copyright (C) 2011-2012 Gabor Juhos <juhosg@openwrt.org>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/if.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/list.h>
+#include <linux/if_ether.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/netlink.h>
+#include <linux/of_device.h>
+#include <linux/of_mdio.h>
+#include <linux/of_net.h>
+#include <linux/bitops.h>
+#include <net/genetlink.h>
+#include <linux/switch.h>
+#include <linux/delay.h>
+#include <linux/phy.h>
+#include <linux/etherdevice.h>
+#include <linux/lockdep.h>
+#include <linux/ar8216_platform.h>
+#include <linux/workqueue.h>
+
+#include "ar8216.h"
+
+extern const struct ar8xxx_chip ar8327_chip;
+extern const struct ar8xxx_chip ar8337_chip;
+
+#define MIB_DESC_BASIC(_s , _o, _n)		\
+	{					\
+		.size = (_s),			\
+		.offset = (_o),			\
+		.name = (_n),			\
+		.type = AR8XXX_MIB_BASIC,	\
+	}
+
+#define MIB_DESC_EXT(_s , _o, _n)		\
+	{					\
+		.size = (_s),			\
+		.offset = (_o),			\
+		.name = (_n),			\
+		.type = AR8XXX_MIB_EXTENDED,	\
+	}
+
+static const struct ar8xxx_mib_desc ar8216_mibs[] = {
+	MIB_DESC_EXT(1, AR8216_STATS_RXBROAD, "RxBroad"),
+	MIB_DESC_EXT(1, AR8216_STATS_RXPAUSE, "RxPause"),
+	MIB_DESC_EXT(1, AR8216_STATS_RXMULTI, "RxMulti"),
+	MIB_DESC_EXT(1, AR8216_STATS_RXFCSERR, "RxFcsErr"),
+	MIB_DESC_EXT(1, AR8216_STATS_RXALIGNERR, "RxAlignErr"),
+	MIB_DESC_EXT(1, AR8216_STATS_RXRUNT, "RxRunt"),
+	MIB_DESC_EXT(1, AR8216_STATS_RXFRAGMENT, "RxFragment"),
+	MIB_DESC_EXT(1, AR8216_STATS_RX64BYTE, "Rx64Byte"),
+	MIB_DESC_EXT(1, AR8216_STATS_RX128BYTE, "Rx128Byte"),
+	MIB_DESC_EXT(1, AR8216_STATS_RX256BYTE, "Rx256Byte"),
+	MIB_DESC_EXT(1, AR8216_STATS_RX512BYTE, "Rx512Byte"),
+	MIB_DESC_EXT(1, AR8216_STATS_RX1024BYTE, "Rx1024Byte"),
+	MIB_DESC_EXT(1, AR8216_STATS_RXMAXBYTE, "RxMaxByte"),
+	MIB_DESC_EXT(1, AR8216_STATS_RXTOOLONG, "RxTooLong"),
+	MIB_DESC_BASIC(2, AR8216_STATS_RXGOODBYTE, "RxGoodByte"),
+	MIB_DESC_EXT(2, AR8216_STATS_RXBADBYTE, "RxBadByte"),
+	MIB_DESC_EXT(1, AR8216_STATS_RXOVERFLOW, "RxOverFlow"),
+	MIB_DESC_EXT(1, AR8216_STATS_FILTERED, "Filtered"),
+	MIB_DESC_EXT(1, AR8216_STATS_TXBROAD, "TxBroad"),
+	MIB_DESC_EXT(1, AR8216_STATS_TXPAUSE, "TxPause"),
+	MIB_DESC_EXT(1, AR8216_STATS_TXMULTI, "TxMulti"),
+	MIB_DESC_EXT(1, AR8216_STATS_TXUNDERRUN, "TxUnderRun"),
+	MIB_DESC_EXT(1, AR8216_STATS_TX64BYTE, "Tx64Byte"),
+	MIB_DESC_EXT(1, AR8216_STATS_TX128BYTE, "Tx128Byte"),
+	MIB_DESC_EXT(1, AR8216_STATS_TX256BYTE, "Tx256Byte"),
+	MIB_DESC_EXT(1, AR8216_STATS_TX512BYTE, "Tx512Byte"),
+	MIB_DESC_EXT(1, AR8216_STATS_TX1024BYTE, "Tx1024Byte"),
+	MIB_DESC_EXT(1, AR8216_STATS_TXMAXBYTE, "TxMaxByte"),
+	MIB_DESC_EXT(1, AR8216_STATS_TXOVERSIZE, "TxOverSize"),
+	MIB_DESC_BASIC(2, AR8216_STATS_TXBYTE, "TxByte"),
+	MIB_DESC_EXT(1, AR8216_STATS_TXCOLLISION, "TxCollision"),
+	MIB_DESC_EXT(1, AR8216_STATS_TXABORTCOL, "TxAbortCol"),
+	MIB_DESC_EXT(1, AR8216_STATS_TXMULTICOL, "TxMultiCol"),
+	MIB_DESC_EXT(1, AR8216_STATS_TXSINGLECOL, "TxSingleCol"),
+	MIB_DESC_EXT(1, AR8216_STATS_TXEXCDEFER, "TxExcDefer"),
+	MIB_DESC_EXT(1, AR8216_STATS_TXDEFER, "TxDefer"),
+	MIB_DESC_EXT(1, AR8216_STATS_TXLATECOL, "TxLateCol"),
+};
+
+const struct ar8xxx_mib_desc ar8236_mibs[39] = {
+	MIB_DESC_EXT(1, AR8236_STATS_RXBROAD, "RxBroad"),
+	MIB_DESC_EXT(1, AR8236_STATS_RXPAUSE, "RxPause"),
+	MIB_DESC_EXT(1, AR8236_STATS_RXMULTI, "RxMulti"),
+	MIB_DESC_EXT(1, AR8236_STATS_RXFCSERR, "RxFcsErr"),
+	MIB_DESC_EXT(1, AR8236_STATS_RXALIGNERR, "RxAlignErr"),
+	MIB_DESC_EXT(1, AR8236_STATS_RXRUNT, "RxRunt"),
+	MIB_DESC_EXT(1, AR8236_STATS_RXFRAGMENT, "RxFragment"),
+	MIB_DESC_EXT(1, AR8236_STATS_RX64BYTE, "Rx64Byte"),
+	MIB_DESC_EXT(1, AR8236_STATS_RX128BYTE, "Rx128Byte"),
+	MIB_DESC_EXT(1, AR8236_STATS_RX256BYTE, "Rx256Byte"),
+	MIB_DESC_EXT(1, AR8236_STATS_RX512BYTE, "Rx512Byte"),
+	MIB_DESC_EXT(1, AR8236_STATS_RX1024BYTE, "Rx1024Byte"),
+	MIB_DESC_EXT(1, AR8236_STATS_RX1518BYTE, "Rx1518Byte"),
+	MIB_DESC_EXT(1, AR8236_STATS_RXMAXBYTE, "RxMaxByte"),
+	MIB_DESC_EXT(1, AR8236_STATS_RXTOOLONG, "RxTooLong"),
+	MIB_DESC_BASIC(2, AR8236_STATS_RXGOODBYTE, "RxGoodByte"),
+	MIB_DESC_EXT(2, AR8236_STATS_RXBADBYTE, "RxBadByte"),
+	MIB_DESC_EXT(1, AR8236_STATS_RXOVERFLOW, "RxOverFlow"),
+	MIB_DESC_EXT(1, AR8236_STATS_FILTERED, "Filtered"),
+	MIB_DESC_EXT(1, AR8236_STATS_TXBROAD, "TxBroad"),
+	MIB_DESC_EXT(1, AR8236_STATS_TXPAUSE, "TxPause"),
+	MIB_DESC_EXT(1, AR8236_STATS_TXMULTI, "TxMulti"),
+	MIB_DESC_EXT(1, AR8236_STATS_TXUNDERRUN, "TxUnderRun"),
+	MIB_DESC_EXT(1, AR8236_STATS_TX64BYTE, "Tx64Byte"),
+	MIB_DESC_EXT(1, AR8236_STATS_TX128BYTE, "Tx128Byte"),
+	MIB_DESC_EXT(1, AR8236_STATS_TX256BYTE, "Tx256Byte"),
+	MIB_DESC_EXT(1, AR8236_STATS_TX512BYTE, "Tx512Byte"),
+	MIB_DESC_EXT(1, AR8236_STATS_TX1024BYTE, "Tx1024Byte"),
+	MIB_DESC_EXT(1, AR8236_STATS_TX1518BYTE, "Tx1518Byte"),
+	MIB_DESC_EXT(1, AR8236_STATS_TXMAXBYTE, "TxMaxByte"),
+	MIB_DESC_EXT(1, AR8236_STATS_TXOVERSIZE, "TxOverSize"),
+	MIB_DESC_BASIC(2, AR8236_STATS_TXBYTE, "TxByte"),
+	MIB_DESC_EXT(1, AR8236_STATS_TXCOLLISION, "TxCollision"),
+	MIB_DESC_EXT(1, AR8236_STATS_TXABORTCOL, "TxAbortCol"),
+	MIB_DESC_EXT(1, AR8236_STATS_TXMULTICOL, "TxMultiCol"),
+	MIB_DESC_EXT(1, AR8236_STATS_TXSINGLECOL, "TxSingleCol"),
+	MIB_DESC_EXT(1, AR8236_STATS_TXEXCDEFER, "TxExcDefer"),
+	MIB_DESC_EXT(1, AR8236_STATS_TXDEFER, "TxDefer"),
+	MIB_DESC_EXT(1, AR8236_STATS_TXLATECOL, "TxLateCol"),
+};
+
+static DEFINE_MUTEX(ar8xxx_dev_list_lock);
+static LIST_HEAD(ar8xxx_dev_list);
+
+static void
+ar8xxx_mib_start(struct ar8xxx_priv *priv);
+static void
+ar8xxx_mib_stop(struct ar8xxx_priv *priv);
+
+/* inspired by phy_poll_reset in drivers/net/phy/phy_device.c */
+static int
+ar8xxx_phy_poll_reset(struct mii_bus *bus)
+{
+        unsigned int sleep_msecs = 20;
+        int ret, elapsed, i;
+
+        for (elapsed = sleep_msecs; elapsed <= 600;
+	     elapsed += sleep_msecs) {
+                msleep(sleep_msecs);
+                for (i = 0; i < AR8XXX_NUM_PHYS; i++) {
+                        ret = mdiobus_read(bus, i, MII_BMCR);
+                        if (ret < 0)
+				return ret;
+                        if (ret & BMCR_RESET)
+				break;
+                        if (i == AR8XXX_NUM_PHYS - 1) {
+                                usleep_range(1000, 2000);
+                                return 0;
+                        }
+                }
+        }
+        return -ETIMEDOUT;
+}
+
+static int
+ar8xxx_phy_check_aneg(struct phy_device *phydev)
+{
+	int ret;
+
+	if (phydev->autoneg != AUTONEG_ENABLE)
+		return 0;
+	/*
+	 * BMCR_ANENABLE might have been cleared
+	 * by phy_init_hw in certain kernel versions
+	 * therefore check for it
+	 */
+	ret = phy_read(phydev, MII_BMCR);
+	if (ret < 0)
+		return ret;
+	if (ret & BMCR_ANENABLE)
+		return 0;
+
+	dev_info(&phydev->mdio.dev, "ANEG disabled, re-enabling ...\n");
+	ret |= BMCR_ANENABLE | BMCR_ANRESTART;
+	return phy_write(phydev, MII_BMCR, ret);
+}
+
+void
+ar8xxx_phy_init(struct ar8xxx_priv *priv)
+{
+	int i;
+	struct mii_bus *bus;
+
+	bus = priv->sw_mii_bus ?: priv->mii_bus;
+	for (i = 0; i < AR8XXX_NUM_PHYS; i++) {
+		if (priv->chip->phy_fixup)
+			priv->chip->phy_fixup(priv, i);
+
+		/* initialize the port itself */
+		mdiobus_write(bus, i, MII_ADVERTISE,
+			ADVERTISE_ALL | ADVERTISE_PAUSE_CAP | ADVERTISE_PAUSE_ASYM);
+		if (ar8xxx_has_gige(priv))
+			mdiobus_write(bus, i, MII_CTRL1000, ADVERTISE_1000FULL);
+		mdiobus_write(bus, i, MII_BMCR, BMCR_RESET | BMCR_ANENABLE);
+	}
+
+	ar8xxx_phy_poll_reset(bus);
+}
+
+u32
+ar8xxx_mii_read32(struct ar8xxx_priv *priv, int phy_id, int regnum)
+{
+	struct mii_bus *bus = priv->mii_bus;
+	u16 lo, hi;
+
+	lo = bus->read(bus, phy_id, regnum);
+	hi = bus->read(bus, phy_id, regnum + 1);
+
+	return (hi << 16) | lo;
+}
+
+void
+ar8xxx_mii_write32(struct ar8xxx_priv *priv, int phy_id, int regnum, u32 val)
+{
+	struct mii_bus *bus = priv->mii_bus;
+	u16 lo, hi;
+
+	lo = val & 0xffff;
+	hi = (u16) (val >> 16);
+
+	if (priv->chip->mii_lo_first)
+	{
+		bus->write(bus, phy_id, regnum, lo);
+		bus->write(bus, phy_id, regnum + 1, hi);
+	} else {
+		bus->write(bus, phy_id, regnum + 1, hi);
+		bus->write(bus, phy_id, regnum, lo);
+	}
+}
+
+u32
+ar8xxx_read(struct ar8xxx_priv *priv, int reg)
+{
+	struct mii_bus *bus = priv->mii_bus;
+	u16 r1, r2, page;
+	u32 val;
+
+	split_addr((u32) reg, &r1, &r2, &page);
+
+	mutex_lock(&bus->mdio_lock);
+
+	bus->write(bus, 0x18, 0, page);
+	wait_for_page_switch();
+	val = ar8xxx_mii_read32(priv, 0x10 | r2, r1);
+
+	mutex_unlock(&bus->mdio_lock);
+
+	return val;
+}
+
+void
+ar8xxx_write(struct ar8xxx_priv *priv, int reg, u32 val)
+{
+	struct mii_bus *bus = priv->mii_bus;
+	u16 r1, r2, page;
+
+	split_addr((u32) reg, &r1, &r2, &page);
+
+	mutex_lock(&bus->mdio_lock);
+
+	bus->write(bus, 0x18, 0, page);
+	wait_for_page_switch();
+	ar8xxx_mii_write32(priv, 0x10 | r2, r1, val);
+
+	mutex_unlock(&bus->mdio_lock);
+}
+
+u32
+ar8xxx_rmw(struct ar8xxx_priv *priv, int reg, u32 mask, u32 val)
+{
+	struct mii_bus *bus = priv->mii_bus;
+	u16 r1, r2, page;
+	u32 ret;
+
+	split_addr((u32) reg, &r1, &r2, &page);
+
+	mutex_lock(&bus->mdio_lock);
+
+	bus->write(bus, 0x18, 0, page);
+	wait_for_page_switch();
+
+	ret = ar8xxx_mii_read32(priv, 0x10 | r2, r1);
+	ret &= ~mask;
+	ret |= val;
+	ar8xxx_mii_write32(priv, 0x10 | r2, r1, ret);
+
+	mutex_unlock(&bus->mdio_lock);
+
+	return ret;
+}
+void
+ar8xxx_phy_dbg_read(struct ar8xxx_priv *priv, int phy_addr,
+           u16 dbg_addr, u16 *dbg_data)
+{
+       struct mii_bus *bus = priv->mii_bus;
+
+       mutex_lock(&bus->mdio_lock);
+       bus->write(bus, phy_addr, MII_ATH_DBG_ADDR, dbg_addr);
+       *dbg_data = bus->read(bus, phy_addr, MII_ATH_DBG_DATA);
+       mutex_unlock(&bus->mdio_lock);
+}
+
+void
+ar8xxx_phy_dbg_write(struct ar8xxx_priv *priv, int phy_addr,
+		     u16 dbg_addr, u16 dbg_data)
+{
+	struct mii_bus *bus = priv->mii_bus;
+
+	mutex_lock(&bus->mdio_lock);
+	bus->write(bus, phy_addr, MII_ATH_DBG_ADDR, dbg_addr);
+	bus->write(bus, phy_addr, MII_ATH_DBG_DATA, dbg_data);
+	mutex_unlock(&bus->mdio_lock);
+}
+
+static inline void
+ar8xxx_phy_mmd_prep(struct mii_bus *bus, int phy_addr, u16 addr, u16 reg)
+{
+	bus->write(bus, phy_addr, MII_ATH_MMD_ADDR, addr);
+	bus->write(bus, phy_addr, MII_ATH_MMD_DATA, reg);
+	bus->write(bus, phy_addr, MII_ATH_MMD_ADDR, addr | 0x4000);
+}
+
+void
+ar8xxx_phy_mmd_write(struct ar8xxx_priv *priv, int phy_addr, u16 addr, u16 reg, u16 data)
+{
+	struct mii_bus *bus = priv->mii_bus;
+
+	mutex_lock(&bus->mdio_lock);
+	ar8xxx_phy_mmd_prep(bus, phy_addr, addr, reg);
+	bus->write(bus, phy_addr, MII_ATH_MMD_DATA, data);
+	mutex_unlock(&bus->mdio_lock);
+}
+
+u16
+ar8xxx_phy_mmd_read(struct ar8xxx_priv *priv, int phy_addr, u16 addr, u16 reg)
+{
+	struct mii_bus *bus = priv->mii_bus;
+	u16 data;
+
+	mutex_lock(&bus->mdio_lock);
+	ar8xxx_phy_mmd_prep(bus, phy_addr, addr, reg);
+	data = bus->read(bus, phy_addr, MII_ATH_MMD_DATA);
+	mutex_unlock(&bus->mdio_lock);
+
+	return data;
+}
+
+static int
+ar8xxx_reg_wait(struct ar8xxx_priv *priv, u32 reg, u32 mask, u32 val,
+		unsigned timeout)
+{
+	int i;
+
+	for (i = 0; i < timeout; i++) {
+		u32 t;
+
+		t = ar8xxx_read(priv, reg);
+		if ((t & mask) == val)
+			return 0;
+
+		usleep_range(1000, 2000);
+		cond_resched();
+	}
+
+	return -ETIMEDOUT;
+}
+
+static int
+ar8xxx_mib_op(struct ar8xxx_priv *priv, u32 op)
+{
+	unsigned mib_func = priv->chip->mib_func;
+	int ret;
+
+	lockdep_assert_held(&priv->mib_lock);
+
+	/* Capture the hardware statistics for all ports */
+	ar8xxx_rmw(priv, mib_func, AR8216_MIB_FUNC, (op << AR8216_MIB_FUNC_S));
+
+	/* Wait for the capturing to complete. */
+	ret = ar8xxx_reg_wait(priv, mib_func, AR8216_MIB_BUSY, 0, 10);
+	if (ret)
+		goto out;
+
+	ret = 0;
+
+out:
+	return ret;
+}
+
+static int
+ar8xxx_mib_capture(struct ar8xxx_priv *priv)
+{
+	return ar8xxx_mib_op(priv, AR8216_MIB_FUNC_CAPTURE);
+}
+
+static int
+ar8xxx_mib_flush(struct ar8xxx_priv *priv)
+{
+	return ar8xxx_mib_op(priv, AR8216_MIB_FUNC_FLUSH);
+}
+
+static void
+ar8xxx_mib_fetch_port_stat(struct ar8xxx_priv *priv, int port, bool flush)
+{
+	unsigned int base;
+	u64 *mib_stats;
+	int i;
+
+	WARN_ON(port >= priv->dev.ports);
+
+	lockdep_assert_held(&priv->mib_lock);
+
+	base = priv->chip->reg_port_stats_start +
+	       priv->chip->reg_port_stats_length * port;
+
+	mib_stats = &priv->mib_stats[port * priv->chip->num_mibs];
+	for (i = 0; i < priv->chip->num_mibs; i++) {
+		const struct ar8xxx_mib_desc *mib;
+		u64 t;
+
+		mib = &priv->chip->mib_decs[i];
+		if (mib->type > priv->mib_type)
+			continue;
+		t = ar8xxx_read(priv, base + mib->offset);
+		if (mib->size == 2) {
+			u64 hi;
+
+			hi = ar8xxx_read(priv, base + mib->offset + 4);
+			t |= hi << 32;
+		}
+
+		if (flush)
+			mib_stats[i] = 0;
+		else
+			mib_stats[i] += t;
+		cond_resched();
+	}
+}
+
+static void
+ar8216_read_port_link(struct ar8xxx_priv *priv, int port,
+		      struct switch_port_link *link)
+{
+	u32 status;
+	u32 speed;
+
+	memset(link, '\0', sizeof(*link));
+
+	status = priv->chip->read_port_status(priv, port);
+
+	link->aneg = !!(status & AR8216_PORT_STATUS_LINK_AUTO);
+	if (link->aneg) {
+		link->link = !!(status & AR8216_PORT_STATUS_LINK_UP);
+	} else {
+		link->link = true;
+
+		if (priv->get_port_link) {
+			int err;
+
+			err = priv->get_port_link(port);
+			if (err >= 0)
+				link->link = !!err;
+		}
+	}
+
+	if (!link->link)
+		return;
+
+	link->duplex = !!(status & AR8216_PORT_STATUS_DUPLEX);
+	link->tx_flow = !!(status & AR8216_PORT_STATUS_TXFLOW);
+	link->rx_flow = !!(status & AR8216_PORT_STATUS_RXFLOW);
+
+	if (link->aneg && link->duplex && priv->chip->read_port_eee_status)
+		link->eee = priv->chip->read_port_eee_status(priv, port);
+
+	speed = (status & AR8216_PORT_STATUS_SPEED) >>
+		 AR8216_PORT_STATUS_SPEED_S;
+
+	switch (speed) {
+	case AR8216_PORT_SPEED_10M:
+		link->speed = SWITCH_PORT_SPEED_10;
+		break;
+	case AR8216_PORT_SPEED_100M:
+		link->speed = SWITCH_PORT_SPEED_100;
+		break;
+	case AR8216_PORT_SPEED_1000M:
+		link->speed = SWITCH_PORT_SPEED_1000;
+		break;
+	default:
+		link->speed = SWITCH_PORT_SPEED_UNKNOWN;
+		break;
+	}
+}
+
+#ifdef CONFIG_ETHERNET_PACKET_MANGLE
+
+static struct sk_buff *
+ar8216_mangle_tx(struct net_device *dev, struct sk_buff *skb)
+{
+	struct ar8xxx_priv *priv = dev->phy_ptr;
+	unsigned char *buf;
+
+	if (unlikely(!priv))
+		goto error;
+
+	if (!priv->vlan)
+		goto send;
+
+	if (unlikely(skb_headroom(skb) < 2)) {
+		if (pskb_expand_head(skb, 2, 0, GFP_ATOMIC) < 0)
+			goto error;
+	}
+
+	buf = skb_push(skb, 2);
+	buf[0] = 0x10;
+	buf[1] = 0x80;
+
+send:
+	return skb;
+
+error:
+	dev_kfree_skb_any(skb);
+	return NULL;
+}
+
+static void
+ar8216_mangle_rx(struct net_device *dev, struct sk_buff *skb)
+{
+	struct ar8xxx_priv *priv;
+	unsigned char *buf;
+	int port, vlan;
+
+	priv = dev->phy_ptr;
+	if (!priv)
+		return;
+
+	/* don't strip the header if vlan mode is disabled */
+	if (!priv->vlan)
+		return;
+
+	/* strip header, get vlan id */
+	buf = skb->data;
+	skb_pull(skb, 2);
+
+	/* check for vlan header presence */
+	if ((buf[12 + 2] != 0x81) || (buf[13 + 2] != 0x00))
+		return;
+
+	port = buf[0] & 0x7;
+
+	/* no need to fix up packets coming from a tagged source */
+	if (priv->vlan_tagged & (1 << port))
+		return;
+
+	/* lookup port vid from local table, the switch passes an invalid vlan id */
+	vlan = priv->vlan_id[priv->pvid[port]];
+
+	buf[14 + 2] &= 0xf0;
+	buf[14 + 2] |= vlan >> 8;
+	buf[15 + 2] = vlan & 0xff;
+}
+
+#endif
+
+int
+ar8216_wait_bit(struct ar8xxx_priv *priv, int reg, u32 mask, u32 val)
+{
+	int timeout = 20;
+	u32 t = 0;
+
+	while (1) {
+		t = ar8xxx_read(priv, reg);
+		if ((t & mask) == val)
+			return 0;
+
+		if (timeout-- <= 0)
+			break;
+
+		udelay(10);
+		cond_resched();
+	}
+
+	pr_err("ar8216: timeout on reg %08x: %08x & %08x != %08x\n",
+	       (unsigned int) reg, t, mask, val);
+	return -ETIMEDOUT;
+}
+
+static void
+ar8216_vtu_op(struct ar8xxx_priv *priv, u32 op, u32 val)
+{
+	if (ar8216_wait_bit(priv, AR8216_REG_VTU, AR8216_VTU_ACTIVE, 0))
+		return;
+	if ((op & AR8216_VTU_OP) == AR8216_VTU_OP_LOAD) {
+		val &= AR8216_VTUDATA_MEMBER;
+		val |= AR8216_VTUDATA_VALID;
+		ar8xxx_write(priv, AR8216_REG_VTU_DATA, val);
+	}
+	op |= AR8216_VTU_ACTIVE;
+	ar8xxx_write(priv, AR8216_REG_VTU, op);
+}
+
+static void
+ar8216_vtu_flush(struct ar8xxx_priv *priv)
+{
+	ar8216_vtu_op(priv, AR8216_VTU_OP_FLUSH, 0);
+}
+
+static void
+ar8216_vtu_load_vlan(struct ar8xxx_priv *priv, u32 vid, u32 port_mask)
+{
+	u32 op;
+
+	op = AR8216_VTU_OP_LOAD | (vid << AR8216_VTU_VID_S);
+	ar8216_vtu_op(priv, op, port_mask);
+}
+
+static int
+ar8216_atu_flush(struct ar8xxx_priv *priv)
+{
+	int ret;
+
+	ret = ar8216_wait_bit(priv, AR8216_REG_ATU_FUNC0, AR8216_ATU_ACTIVE, 0);
+	if (!ret)
+		ar8xxx_write(priv, AR8216_REG_ATU_FUNC0, AR8216_ATU_OP_FLUSH |
+							 AR8216_ATU_ACTIVE);
+
+	return ret;
+}
+
+static int
+ar8216_atu_flush_port(struct ar8xxx_priv *priv, int port)
+{
+	u32 t;
+	int ret;
+
+	ret = ar8216_wait_bit(priv, AR8216_REG_ATU_FUNC0, AR8216_ATU_ACTIVE, 0);
+	if (!ret) {
+		t = (port << AR8216_ATU_PORT_NUM_S) | AR8216_ATU_OP_FLUSH_PORT;
+		t |= AR8216_ATU_ACTIVE;
+		ar8xxx_write(priv, AR8216_REG_ATU_FUNC0, t);
+	}
+
+	return ret;
+}
+
+static u32
+ar8216_read_port_status(struct ar8xxx_priv *priv, int port)
+{
+	return ar8xxx_read(priv, AR8216_REG_PORT_STATUS(port));
+}
+
+static void
+__ar8216_setup_port(struct ar8xxx_priv *priv, int port, u32 members,
+		    bool ath_hdr_en)
+{
+	u32 header;
+	u32 egress, ingress;
+	u32 pvid;
+
+	if (priv->vlan) {
+		pvid = priv->vlan_id[priv->pvid[port]];
+		if (priv->vlan_tagged & (1 << port))
+			egress = AR8216_OUT_ADD_VLAN;
+		else
+			egress = AR8216_OUT_STRIP_VLAN;
+		ingress = AR8216_IN_SECURE;
+	} else {
+		pvid = port;
+		egress = AR8216_OUT_KEEP;
+		ingress = AR8216_IN_PORT_ONLY;
+	}
+
+	header = ath_hdr_en ? AR8216_PORT_CTRL_HEADER : 0;
+
+	ar8xxx_rmw(priv, AR8216_REG_PORT_CTRL(port),
+		   AR8216_PORT_CTRL_LEARN | AR8216_PORT_CTRL_VLAN_MODE |
+		   AR8216_PORT_CTRL_SINGLE_VLAN | AR8216_PORT_CTRL_STATE |
+		   AR8216_PORT_CTRL_HEADER | AR8216_PORT_CTRL_LEARN_LOCK,
+		   AR8216_PORT_CTRL_LEARN | header |
+		   (egress << AR8216_PORT_CTRL_VLAN_MODE_S) |
+		   (AR8216_PORT_STATE_FORWARD << AR8216_PORT_CTRL_STATE_S));
+
+	ar8xxx_rmw(priv, AR8216_REG_PORT_VLAN(port),
+		   AR8216_PORT_VLAN_DEST_PORTS | AR8216_PORT_VLAN_MODE |
+		   AR8216_PORT_VLAN_DEFAULT_ID,
+		   (members << AR8216_PORT_VLAN_DEST_PORTS_S) |
+		   (ingress << AR8216_PORT_VLAN_MODE_S) |
+		   (pvid << AR8216_PORT_VLAN_DEFAULT_ID_S));
+}
+
+static void
+ar8216_setup_port(struct ar8xxx_priv *priv, int port, u32 members)
+{
+	return __ar8216_setup_port(priv, port, members,
+				   chip_is_ar8216(priv) && priv->vlan &&
+				   port == AR8216_PORT_CPU);
+}
+
+static int
+ar8216_hw_init(struct ar8xxx_priv *priv)
+{
+	if (priv->initialized)
+		return 0;
+
+	ar8xxx_write(priv, AR8216_REG_CTRL, AR8216_CTRL_RESET);
+	ar8xxx_reg_wait(priv, AR8216_REG_CTRL, AR8216_CTRL_RESET, 0, 1000);
+
+	ar8xxx_phy_init(priv);
+
+	priv->initialized = true;
+	return 0;
+}
+
+static void
+ar8216_init_globals(struct ar8xxx_priv *priv)
+{
+	/* standard atheros magic */
+	ar8xxx_write(priv, 0x38, 0xc000050e);
+
+	ar8xxx_rmw(priv, AR8216_REG_GLOBAL_CTRL,
+		   AR8216_GCTRL_MTU, 1518 + 8 + 2);
+}
+
+static void
+__ar8216_init_port(struct ar8xxx_priv *priv, int port,
+		   bool cpu_ge, bool flow_en)
+{
+	/* Enable port learning and tx */
+	ar8xxx_write(priv, AR8216_REG_PORT_CTRL(port),
+		AR8216_PORT_CTRL_LEARN |
+		(4 << AR8216_PORT_CTRL_STATE_S));
+
+	ar8xxx_write(priv, AR8216_REG_PORT_VLAN(port), 0);
+
+	if (port == AR8216_PORT_CPU) {
+		ar8xxx_write(priv, AR8216_REG_PORT_STATUS(port),
+			AR8216_PORT_STATUS_LINK_UP |
+			(cpu_ge ? AR8216_PORT_SPEED_1000M : AR8216_PORT_SPEED_100M) |
+			AR8216_PORT_STATUS_TXMAC |
+			AR8216_PORT_STATUS_RXMAC |
+			(flow_en ? AR8216_PORT_STATUS_RXFLOW : 0) |
+			(flow_en ? AR8216_PORT_STATUS_TXFLOW : 0) |
+			AR8216_PORT_STATUS_DUPLEX);
+	} else {
+		ar8xxx_write(priv, AR8216_REG_PORT_STATUS(port),
+			AR8216_PORT_STATUS_LINK_AUTO);
+	}
+}
+
+static void
+ar8216_init_port(struct ar8xxx_priv *priv, int port)
+{
+	__ar8216_init_port(priv, port, ar8xxx_has_gige(priv),
+			   chip_is_ar8316(priv));
+}
+
+static void
+ar8216_wait_atu_ready(struct ar8xxx_priv *priv, u16 r2, u16 r1)
+{
+	int timeout = 20;
+
+	while (ar8xxx_mii_read32(priv, r2, r1) & AR8216_ATU_ACTIVE && --timeout) {
+		udelay(10);
+		cond_resched();
+	}
+
+	if (!timeout)
+		pr_err("ar8216: timeout waiting for atu to become ready\n");
+}
+
+static void ar8216_get_arl_entry(struct ar8xxx_priv *priv,
+				 struct arl_entry *a, u32 *status, enum arl_op op)
+{
+	struct mii_bus *bus = priv->mii_bus;
+	u16 r2, page;
+	u16 r1_func0, r1_func1, r1_func2;
+	u32 t, val0, val1, val2;
+
+	split_addr(AR8216_REG_ATU_FUNC0, &r1_func0, &r2, &page);
+	r2 |= 0x10;
+
+	r1_func1 = (AR8216_REG_ATU_FUNC1 >> 1) & 0x1e;
+	r1_func2 = (AR8216_REG_ATU_FUNC2 >> 1) & 0x1e;
+
+	switch (op) {
+	case AR8XXX_ARL_INITIALIZE:
+		/* all ATU registers are on the same page
+		* therefore set page only once
+		*/
+		bus->write(bus, 0x18, 0, page);
+		wait_for_page_switch();
+
+		ar8216_wait_atu_ready(priv, r2, r1_func0);
+
+		ar8xxx_mii_write32(priv, r2, r1_func0, AR8216_ATU_OP_GET_NEXT);
+		ar8xxx_mii_write32(priv, r2, r1_func1, 0);
+		ar8xxx_mii_write32(priv, r2, r1_func2, 0);
+		break;
+	case AR8XXX_ARL_GET_NEXT:
+		t = ar8xxx_mii_read32(priv, r2, r1_func0);
+		t |= AR8216_ATU_ACTIVE;
+		ar8xxx_mii_write32(priv, r2, r1_func0, t);
+		ar8216_wait_atu_ready(priv, r2, r1_func0);
+
+		val0 = ar8xxx_mii_read32(priv, r2, r1_func0);
+		val1 = ar8xxx_mii_read32(priv, r2, r1_func1);
+		val2 = ar8xxx_mii_read32(priv, r2, r1_func2);
+
+		*status = (val2 & AR8216_ATU_STATUS) >> AR8216_ATU_STATUS_S;
+		if (!*status)
+			break;
+
+		a->portmap = (val2 & AR8216_ATU_PORTS) >> AR8216_ATU_PORTS_S;
+		a->mac[0] = (val0 & AR8216_ATU_ADDR5) >> AR8216_ATU_ADDR5_S;
+		a->mac[1] = (val0 & AR8216_ATU_ADDR4) >> AR8216_ATU_ADDR4_S;
+		a->mac[2] = (val1 & AR8216_ATU_ADDR3) >> AR8216_ATU_ADDR3_S;
+		a->mac[3] = (val1 & AR8216_ATU_ADDR2) >> AR8216_ATU_ADDR2_S;
+		a->mac[4] = (val1 & AR8216_ATU_ADDR1) >> AR8216_ATU_ADDR1_S;
+		a->mac[5] = (val1 & AR8216_ATU_ADDR0) >> AR8216_ATU_ADDR0_S;
+		break;
+	}
+}
+
+static int
+ar8216_phy_read(struct ar8xxx_priv *priv, int addr, int regnum)
+{
+	u32 t, val = 0xffff;
+	int err;
+
+	if (addr >= AR8216_NUM_PORTS)
+		return 0xffff;
+	t = (regnum << AR8216_MDIO_CTRL_REG_ADDR_S) |
+	    (addr << AR8216_MDIO_CTRL_PHY_ADDR_S) |
+	    AR8216_MDIO_CTRL_MASTER_EN |
+	    AR8216_MDIO_CTRL_BUSY |
+	    AR8216_MDIO_CTRL_CMD_READ;
+
+	ar8xxx_write(priv, AR8216_REG_MDIO_CTRL, t);
+	err = ar8xxx_reg_wait(priv, AR8216_REG_MDIO_CTRL,
+			      AR8216_MDIO_CTRL_BUSY, 0, 5);
+	if (!err)
+		val = ar8xxx_read(priv, AR8216_REG_MDIO_CTRL);
+
+	return val & AR8216_MDIO_CTRL_DATA_M;
+}
+
+static int
+ar8216_phy_write(struct ar8xxx_priv *priv, int addr, int regnum, u16 val)
+{
+	u32 t;
+	int ret;
+
+	if (addr >= AR8216_NUM_PORTS)
+		return -EINVAL;
+
+	t = (addr << AR8216_MDIO_CTRL_PHY_ADDR_S) |
+	    (regnum << AR8216_MDIO_CTRL_REG_ADDR_S) |
+	    AR8216_MDIO_CTRL_MASTER_EN |
+	    AR8216_MDIO_CTRL_BUSY |
+	    AR8216_MDIO_CTRL_CMD_WRITE |
+	    val;
+
+	ar8xxx_write(priv, AR8216_REG_MDIO_CTRL, t);
+	ret = ar8xxx_reg_wait(priv, AR8216_REG_MDIO_CTRL,
+			      AR8216_MDIO_CTRL_BUSY, 0, 5);
+
+	return ret;
+}
+
+static int
+ar8229_hw_init(struct ar8xxx_priv *priv)
+{
+	phy_interface_t phy_if_mode;
+
+	if (priv->initialized)
+		return 0;
+
+	ar8xxx_write(priv, AR8216_REG_CTRL, AR8216_CTRL_RESET);
+	ar8xxx_reg_wait(priv, AR8216_REG_CTRL, AR8216_CTRL_RESET, 0, 1000);
+
+	of_get_phy_mode(priv->pdev->of_node, &phy_if_mode);
+
+	if (phy_if_mode == PHY_INTERFACE_MODE_GMII) {
+		ar8xxx_write(priv, AR8229_REG_OPER_MODE0,
+				 AR8229_OPER_MODE0_MAC_GMII_EN);
+	} else if (phy_if_mode == PHY_INTERFACE_MODE_MII) {
+		ar8xxx_write(priv, AR8229_REG_OPER_MODE0,
+				 AR8229_OPER_MODE0_PHY_MII_EN);
+	} else {
+		pr_err("ar8229: unsupported mii mode\n");
+		return -EINVAL;
+	}
+
+	if (priv->port4_phy) {
+		ar8xxx_write(priv, AR8229_REG_OPER_MODE1,
+			     AR8229_REG_OPER_MODE1_PHY4_MII_EN);
+		/* disable port5 to prevent mii conflict */
+		ar8xxx_write(priv, AR8216_REG_PORT_STATUS(5), 0);
+	}
+
+	ar8xxx_phy_init(priv);
+
+	priv->initialized = true;
+	return 0;
+}
+
+static void
+ar8229_init_globals(struct ar8xxx_priv *priv)
+{
+
+	/* Enable CPU port, and disable mirror port */
+	ar8xxx_write(priv, AR8216_REG_GLOBAL_CPUPORT,
+		     AR8216_GLOBAL_CPUPORT_EN |
+		     (15 << AR8216_GLOBAL_CPUPORT_MIRROR_PORT_S));
+
+	/* Setup TAG priority mapping */
+	ar8xxx_write(priv, AR8216_REG_TAG_PRIORITY, 0xfa50);
+
+	/* Enable aging, MAC replacing */
+	ar8xxx_write(priv, AR8216_REG_ATU_CTRL,
+		     0x2b /* 5 min age time */ |
+		     AR8216_ATU_CTRL_AGE_EN |
+		     AR8216_ATU_CTRL_LEARN_CHANGE);
+
+	/* Enable ARP frame acknowledge */
+	ar8xxx_reg_set(priv, AR8229_REG_QM_CTRL,
+		       AR8229_QM_CTRL_ARP_EN);
+
+	/*
+	 * Enable Broadcast/unknown multicast and unicast frames
+	 * transmitted to the CPU port.
+	 */
+	ar8xxx_reg_set(priv, AR8216_REG_FLOOD_MASK,
+		       AR8229_FLOOD_MASK_BC_DP(0) |
+		       AR8229_FLOOD_MASK_MC_DP(0) |
+		       AR8229_FLOOD_MASK_UC_DP(0));
+
+	/* setup MTU */
+	ar8xxx_rmw(priv, AR8216_REG_GLOBAL_CTRL,
+		   AR8236_GCTRL_MTU, AR8236_GCTRL_MTU);
+
+	/* Enable MIB counters */
+	ar8xxx_reg_set(priv, AR8216_REG_MIB_FUNC,
+		       AR8236_MIB_EN);
+
+	/* setup Service TAG */
+	ar8xxx_rmw(priv, AR8216_REG_SERVICE_TAG, AR8216_SERVICE_TAG_M, 0);
+}
+
+static void
+ar8229_init_port(struct ar8xxx_priv *priv, int port)
+{
+	__ar8216_init_port(priv, port, true, true);
+}
+
+
+static int
+ar7240sw_hw_init(struct ar8xxx_priv *priv)
+{
+	if (priv->initialized)
+		return 0;
+
+	ar8xxx_write(priv, AR8216_REG_CTRL, AR8216_CTRL_RESET);
+	ar8xxx_reg_wait(priv, AR8216_REG_CTRL, AR8216_CTRL_RESET, 0, 1000);
+
+	priv->port4_phy = 1;
+	/* disable port5 to prevent mii conflict */
+	ar8xxx_write(priv, AR8216_REG_PORT_STATUS(5), 0);
+
+	ar8xxx_phy_init(priv);
+
+	priv->initialized = true;
+	return 0;
+}
+
+static void
+ar7240sw_init_globals(struct ar8xxx_priv *priv)
+{
+
+	/* Enable CPU port, and disable mirror port */
+	ar8xxx_write(priv, AR8216_REG_GLOBAL_CPUPORT,
+		     AR8216_GLOBAL_CPUPORT_EN |
+		     (15 << AR8216_GLOBAL_CPUPORT_MIRROR_PORT_S));
+
+	/* Setup TAG priority mapping */
+	ar8xxx_write(priv, AR8216_REG_TAG_PRIORITY, 0xfa50);
+
+	/* Enable ARP frame acknowledge, aging, MAC replacing */
+	ar8xxx_write(priv, AR8216_REG_ATU_CTRL,
+		AR8216_ATU_CTRL_RESERVED |
+		0x2b /* 5 min age time */ |
+		AR8216_ATU_CTRL_AGE_EN |
+		AR8216_ATU_CTRL_ARP_EN |
+		AR8216_ATU_CTRL_LEARN_CHANGE);
+
+	/* Enable Broadcast frames transmitted to the CPU */
+	ar8xxx_reg_set(priv, AR8216_REG_FLOOD_MASK,
+		       AR8216_FM_CPU_BROADCAST_EN);
+
+	/* setup MTU */
+	ar8xxx_rmw(priv, AR8216_REG_GLOBAL_CTRL,
+		   AR8216_GCTRL_MTU,
+		   AR8216_GCTRL_MTU);
+
+	/* setup Service TAG */
+	ar8xxx_rmw(priv, AR8216_REG_SERVICE_TAG, AR8216_SERVICE_TAG_M, 0);
+}
+
+static void
+ar7240sw_setup_port(struct ar8xxx_priv *priv, int port, u32 members)
+{
+	return __ar8216_setup_port(priv, port, members, false);
+}
+
+static void
+ar8236_setup_port(struct ar8xxx_priv *priv, int port, u32 members)
+{
+	u32 egress, ingress;
+	u32 pvid;
+
+	if (priv->vlan) {
+		pvid = priv->vlan_id[priv->pvid[port]];
+		if (priv->vlan_tagged & (1 << port))
+			egress = AR8216_OUT_ADD_VLAN;
+		else
+			egress = AR8216_OUT_STRIP_VLAN;
+		ingress = AR8216_IN_SECURE;
+	} else {
+		pvid = port;
+		egress = AR8216_OUT_KEEP;
+		ingress = AR8216_IN_PORT_ONLY;
+	}
+
+	ar8xxx_rmw(priv, AR8216_REG_PORT_CTRL(port),
+		   AR8216_PORT_CTRL_LEARN | AR8216_PORT_CTRL_VLAN_MODE |
+		   AR8216_PORT_CTRL_SINGLE_VLAN | AR8216_PORT_CTRL_STATE |
+		   AR8216_PORT_CTRL_HEADER | AR8216_PORT_CTRL_LEARN_LOCK,
+		   AR8216_PORT_CTRL_LEARN |
+		   (egress << AR8216_PORT_CTRL_VLAN_MODE_S) |
+		   (AR8216_PORT_STATE_FORWARD << AR8216_PORT_CTRL_STATE_S));
+
+	ar8xxx_rmw(priv, AR8236_REG_PORT_VLAN(port),
+		   AR8236_PORT_VLAN_DEFAULT_ID,
+		   (pvid << AR8236_PORT_VLAN_DEFAULT_ID_S));
+
+	ar8xxx_rmw(priv, AR8236_REG_PORT_VLAN2(port),
+		   AR8236_PORT_VLAN2_VLAN_MODE |
+		   AR8236_PORT_VLAN2_MEMBER,
+		   (ingress << AR8236_PORT_VLAN2_VLAN_MODE_S) |
+		   (members << AR8236_PORT_VLAN2_MEMBER_S));
+}
+
+static void
+ar8236_init_globals(struct ar8xxx_priv *priv)
+{
+	/* enable jumbo frames */
+	ar8xxx_rmw(priv, AR8216_REG_GLOBAL_CTRL,
+		   AR8316_GCTRL_MTU, 9018 + 8 + 2);
+
+	/* enable cpu port to receive arp frames */
+	ar8xxx_reg_set(priv, AR8216_REG_ATU_CTRL,
+		   AR8236_ATU_CTRL_RES);
+
+	/*
+	 * Enable Broadcast/unknown multicast and unicast frames
+	 * transmitted to the CPU port.
+	 */
+	ar8xxx_reg_set(priv, AR8216_REG_FLOOD_MASK,
+		       AR8229_FLOOD_MASK_BC_DP(0) |
+		       AR8229_FLOOD_MASK_MC_DP(0) |
+		       AR8229_FLOOD_MASK_UC_DP(0));
+
+	/* Enable MIB counters */
+	ar8xxx_rmw(priv, AR8216_REG_MIB_FUNC, AR8216_MIB_FUNC | AR8236_MIB_EN,
+		   (AR8216_MIB_FUNC_NO_OP << AR8216_MIB_FUNC_S) |
+		   AR8236_MIB_EN);
+}
+
+static int
+ar8316_hw_init(struct ar8xxx_priv *priv)
+{
+	u32 val, newval;
+
+	val = ar8xxx_read(priv, AR8316_REG_POSTRIP);
+
+	if (priv->phy->interface == PHY_INTERFACE_MODE_RGMII) {
+		if (priv->port4_phy) {
+			/* value taken from Ubiquiti RouterStation Pro */
+			newval = 0x81461bea;
+			pr_info("ar8316: Using port 4 as PHY\n");
+		} else {
+			newval = 0x01261be2;
+			pr_info("ar8316: Using port 4 as switch port\n");
+		}
+	} else if (priv->phy->interface == PHY_INTERFACE_MODE_GMII) {
+		/* value taken from AVM Fritz!Box 7390 sources */
+		newval = 0x010e5b71;
+	} else {
+		/* no known value for phy interface */
+		pr_err("ar8316: unsupported mii mode: %d.\n",
+		       priv->phy->interface);
+		return -EINVAL;
+	}
+
+	if (val == newval)
+		goto out;
+
+	ar8xxx_write(priv, AR8316_REG_POSTRIP, newval);
+
+	if (priv->port4_phy &&
+	    priv->phy->interface == PHY_INTERFACE_MODE_RGMII) {
+		/* work around for phy4 rgmii mode */
+		ar8xxx_phy_dbg_write(priv, 4, 0x12, 0x480c);
+		/* rx delay */
+		ar8xxx_phy_dbg_write(priv, 4, 0x0, 0x824e);
+		/* tx delay */
+		ar8xxx_phy_dbg_write(priv, 4, 0x5, 0x3d47);
+		msleep(1000);
+	}
+
+	ar8xxx_phy_init(priv);
+
+out:
+	priv->initialized = true;
+	return 0;
+}
+
+static void
+ar8316_init_globals(struct ar8xxx_priv *priv)
+{
+	/* standard atheros magic */
+	ar8xxx_write(priv, 0x38, 0xc000050e);
+
+	/* enable cpu port to receive multicast and broadcast frames */
+	ar8xxx_write(priv, AR8216_REG_FLOOD_MASK, 0x003f003f);
+
+	/* enable jumbo frames */
+	ar8xxx_rmw(priv, AR8216_REG_GLOBAL_CTRL,
+		   AR8316_GCTRL_MTU, 9018 + 8 + 2);
+
+	/* Enable MIB counters */
+	ar8xxx_rmw(priv, AR8216_REG_MIB_FUNC, AR8216_MIB_FUNC | AR8236_MIB_EN,
+		   (AR8216_MIB_FUNC_NO_OP << AR8216_MIB_FUNC_S) |
+		   AR8236_MIB_EN);
+}
+
+int
+ar8xxx_sw_set_vlan(struct switch_dev *dev, const struct switch_attr *attr,
+		   struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	priv->vlan = !!val->value.i;
+	return 0;
+}
+
+int
+ar8xxx_sw_get_vlan(struct switch_dev *dev, const struct switch_attr *attr,
+		   struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	val->value.i = priv->vlan;
+	return 0;
+}
+
+
+int
+ar8xxx_sw_set_pvid(struct switch_dev *dev, int port, int vlan)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+
+	/* make sure no invalid PVIDs get set */
+
+	if (vlan < 0 || vlan >= dev->vlans ||
+	    port < 0 || port >= AR8X16_MAX_PORTS)
+		return -EINVAL;
+
+	priv->pvid[port] = vlan;
+	return 0;
+}
+
+int
+ar8xxx_sw_get_pvid(struct switch_dev *dev, int port, int *vlan)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+
+	if (port < 0 || port >= AR8X16_MAX_PORTS)
+		return -EINVAL;
+
+	*vlan = priv->pvid[port];
+	return 0;
+}
+
+static int
+ar8xxx_sw_set_vid(struct switch_dev *dev, const struct switch_attr *attr,
+		  struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+
+	if (val->port_vlan >= dev->vlans)
+		return -EINVAL;
+
+	priv->vlan_id[val->port_vlan] = val->value.i;
+	return 0;
+}
+
+static int
+ar8xxx_sw_get_vid(struct switch_dev *dev, const struct switch_attr *attr,
+		  struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	val->value.i = priv->vlan_id[val->port_vlan];
+	return 0;
+}
+
+int
+ar8xxx_sw_get_port_link(struct switch_dev *dev, int port,
+			struct switch_port_link *link)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+
+	ar8216_read_port_link(priv, port, link);
+	return 0;
+}
+
+static int
+ar8xxx_sw_get_ports(struct switch_dev *dev, struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	u8 ports;
+	int i;
+
+	if (val->port_vlan >= dev->vlans)
+		return -EINVAL;
+
+	ports = priv->vlan_table[val->port_vlan];
+	val->len = 0;
+	for (i = 0; i < dev->ports; i++) {
+		struct switch_port *p;
+
+		if (!(ports & (1 << i)))
+			continue;
+
+		p = &val->value.ports[val->len++];
+		p->id = i;
+		if (priv->vlan_tagged & (1 << i))
+			p->flags = (1 << SWITCH_PORT_FLAG_TAGGED);
+		else
+			p->flags = 0;
+	}
+	return 0;
+}
+
+static int
+ar8xxx_sw_set_ports(struct switch_dev *dev, struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	u8 *vt = &priv->vlan_table[val->port_vlan];
+	int i, j;
+
+	*vt = 0;
+	for (i = 0; i < val->len; i++) {
+		struct switch_port *p = &val->value.ports[i];
+
+		if (p->flags & (1 << SWITCH_PORT_FLAG_TAGGED)) {
+			priv->vlan_tagged |= (1 << p->id);
+		} else {
+			priv->vlan_tagged &= ~(1 << p->id);
+			priv->pvid[p->id] = val->port_vlan;
+
+			/* make sure that an untagged port does not
+			 * appear in other vlans */
+			for (j = 0; j < dev->vlans; j++) {
+				if (j == val->port_vlan)
+					continue;
+				priv->vlan_table[j] &= ~(1 << p->id);
+			}
+		}
+
+		*vt |= 1 << p->id;
+	}
+	return 0;
+}
+
+static void
+ar8216_set_mirror_regs(struct ar8xxx_priv *priv)
+{
+	int port;
+
+	/* reset all mirror registers */
+	ar8xxx_rmw(priv, AR8216_REG_GLOBAL_CPUPORT,
+		   AR8216_GLOBAL_CPUPORT_MIRROR_PORT,
+		   (0xF << AR8216_GLOBAL_CPUPORT_MIRROR_PORT_S));
+	for (port = 0; port < AR8216_NUM_PORTS; port++) {
+		ar8xxx_reg_clear(priv, AR8216_REG_PORT_CTRL(port),
+			   AR8216_PORT_CTRL_MIRROR_RX);
+
+		ar8xxx_reg_clear(priv, AR8216_REG_PORT_CTRL(port),
+			   AR8216_PORT_CTRL_MIRROR_TX);
+	}
+
+	/* now enable mirroring if necessary */
+	if (priv->source_port >= AR8216_NUM_PORTS ||
+	    priv->monitor_port >= AR8216_NUM_PORTS ||
+	    priv->source_port == priv->monitor_port) {
+		return;
+	}
+
+	ar8xxx_rmw(priv, AR8216_REG_GLOBAL_CPUPORT,
+		   AR8216_GLOBAL_CPUPORT_MIRROR_PORT,
+		   (priv->monitor_port << AR8216_GLOBAL_CPUPORT_MIRROR_PORT_S));
+
+	if (priv->mirror_rx)
+		ar8xxx_reg_set(priv, AR8216_REG_PORT_CTRL(priv->source_port),
+			   AR8216_PORT_CTRL_MIRROR_RX);
+
+	if (priv->mirror_tx)
+		ar8xxx_reg_set(priv, AR8216_REG_PORT_CTRL(priv->source_port),
+			   AR8216_PORT_CTRL_MIRROR_TX);
+}
+
+static inline u32
+ar8xxx_age_time_val(int age_time)
+{
+	return (age_time + AR8XXX_REG_ARL_CTRL_AGE_TIME_SECS / 2) /
+	       AR8XXX_REG_ARL_CTRL_AGE_TIME_SECS;
+}
+
+static inline void
+ar8xxx_set_age_time(struct ar8xxx_priv *priv, int reg)
+{
+	u32 age_time = ar8xxx_age_time_val(priv->arl_age_time);
+	ar8xxx_rmw(priv, reg, AR8216_ATU_CTRL_AGE_TIME, age_time << AR8216_ATU_CTRL_AGE_TIME_S);
+}
+
+int
+ar8xxx_sw_hw_apply(struct switch_dev *dev)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	const struct ar8xxx_chip *chip = priv->chip;
+	u8 portmask[AR8X16_MAX_PORTS];
+	int i, j;
+
+	mutex_lock(&priv->reg_mutex);
+	/* flush all vlan translation unit entries */
+	priv->chip->vtu_flush(priv);
+
+	memset(portmask, 0, sizeof(portmask));
+	if (!priv->init) {
+		/* calculate the port destination masks and load vlans
+		 * into the vlan translation unit */
+		for (j = 0; j < dev->vlans; j++) {
+			u8 vp = priv->vlan_table[j];
+
+			if (!vp)
+				continue;
+
+			for (i = 0; i < dev->ports; i++) {
+				u8 mask = (1 << i);
+				if (vp & mask)
+					portmask[i] |= vp & ~mask;
+			}
+
+			chip->vtu_load_vlan(priv, priv->vlan_id[j],
+					    priv->vlan_table[j]);
+		}
+	} else {
+		/* vlan disabled:
+		 * isolate all ports, but connect them to the cpu port */
+		for (i = 0; i < dev->ports; i++) {
+			if (i == AR8216_PORT_CPU)
+				continue;
+
+			portmask[i] = 1 << AR8216_PORT_CPU;
+			portmask[AR8216_PORT_CPU] |= (1 << i);
+		}
+	}
+
+	/* update the port destination mask registers and tag settings */
+	for (i = 0; i < dev->ports; i++) {
+		chip->setup_port(priv, i, portmask[i]);
+	}
+
+	chip->set_mirror_regs(priv);
+
+	/* set age time */
+	if (chip->reg_arl_ctrl)
+		ar8xxx_set_age_time(priv, chip->reg_arl_ctrl);
+
+	mutex_unlock(&priv->reg_mutex);
+	return 0;
+}
+
+int
+ar8xxx_sw_reset_switch(struct switch_dev *dev)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	const struct ar8xxx_chip *chip = priv->chip;
+	int i;
+
+	mutex_lock(&priv->reg_mutex);
+	memset(&priv->ar8xxx_priv_volatile, 0, sizeof(priv->ar8xxx_priv_volatile));
+
+	for (i = 0; i < dev->vlans; i++)
+		priv->vlan_id[i] = i;
+
+	/* Configure all ports */
+	for (i = 0; i < dev->ports; i++)
+		chip->init_port(priv, i);
+
+	priv->mirror_rx = false;
+	priv->mirror_tx = false;
+	priv->source_port = 0;
+	priv->monitor_port = 0;
+	priv->arl_age_time = AR8XXX_DEFAULT_ARL_AGE_TIME;
+
+	chip->init_globals(priv);
+	chip->atu_flush(priv);
+
+	mutex_unlock(&priv->reg_mutex);
+
+	return chip->sw_hw_apply(dev);
+}
+
+int
+ar8xxx_sw_set_reset_mibs(struct switch_dev *dev,
+			 const struct switch_attr *attr,
+			 struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	unsigned int len;
+	int ret;
+
+	if (!ar8xxx_has_mib_counters(priv))
+		return -EOPNOTSUPP;
+
+	mutex_lock(&priv->mib_lock);
+
+	len = priv->dev.ports * priv->chip->num_mibs *
+	      sizeof(*priv->mib_stats);
+	memset(priv->mib_stats, '\0', len);
+	ret = ar8xxx_mib_flush(priv);
+	if (ret)
+		goto unlock;
+
+	ret = 0;
+
+unlock:
+	mutex_unlock(&priv->mib_lock);
+	return ret;
+}
+
+int
+ar8xxx_sw_set_mib_poll_interval(struct switch_dev *dev,
+			       const struct switch_attr *attr,
+			       struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+
+	if (!ar8xxx_has_mib_counters(priv))
+		return -EOPNOTSUPP;
+
+	ar8xxx_mib_stop(priv);
+	priv->mib_poll_interval = val->value.i;
+	ar8xxx_mib_start(priv);
+
+	return 0;
+}
+
+int
+ar8xxx_sw_get_mib_poll_interval(struct switch_dev *dev,
+			       const struct switch_attr *attr,
+			       struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+
+	if (!ar8xxx_has_mib_counters(priv))
+		return -EOPNOTSUPP;
+	val->value.i = priv->mib_poll_interval;
+	return 0;
+}
+
+int
+ar8xxx_sw_set_mib_type(struct switch_dev *dev,
+			       const struct switch_attr *attr,
+			       struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+
+	if (!ar8xxx_has_mib_counters(priv))
+		return -EOPNOTSUPP;
+	priv->mib_type = val->value.i;
+	return 0;
+}
+
+int
+ar8xxx_sw_get_mib_type(struct switch_dev *dev,
+			       const struct switch_attr *attr,
+			       struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+
+	if (!ar8xxx_has_mib_counters(priv))
+		return -EOPNOTSUPP;
+	val->value.i = priv->mib_type;
+	return 0;
+}
+
+int
+ar8xxx_sw_set_mirror_rx_enable(struct switch_dev *dev,
+			       const struct switch_attr *attr,
+			       struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+
+	mutex_lock(&priv->reg_mutex);
+	priv->mirror_rx = !!val->value.i;
+	priv->chip->set_mirror_regs(priv);
+	mutex_unlock(&priv->reg_mutex);
+
+	return 0;
+}
+
+int
+ar8xxx_sw_get_mirror_rx_enable(struct switch_dev *dev,
+			       const struct switch_attr *attr,
+			       struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	val->value.i = priv->mirror_rx;
+	return 0;
+}
+
+int
+ar8xxx_sw_set_mirror_tx_enable(struct switch_dev *dev,
+			       const struct switch_attr *attr,
+			       struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+
+	mutex_lock(&priv->reg_mutex);
+	priv->mirror_tx = !!val->value.i;
+	priv->chip->set_mirror_regs(priv);
+	mutex_unlock(&priv->reg_mutex);
+
+	return 0;
+}
+
+int
+ar8xxx_sw_get_mirror_tx_enable(struct switch_dev *dev,
+			       const struct switch_attr *attr,
+			       struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	val->value.i = priv->mirror_tx;
+	return 0;
+}
+
+int
+ar8xxx_sw_set_mirror_monitor_port(struct switch_dev *dev,
+				  const struct switch_attr *attr,
+				  struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+
+	mutex_lock(&priv->reg_mutex);
+	priv->monitor_port = val->value.i;
+	priv->chip->set_mirror_regs(priv);
+	mutex_unlock(&priv->reg_mutex);
+
+	return 0;
+}
+
+int
+ar8xxx_sw_get_mirror_monitor_port(struct switch_dev *dev,
+				  const struct switch_attr *attr,
+				  struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	val->value.i = priv->monitor_port;
+	return 0;
+}
+
+int
+ar8xxx_sw_set_mirror_source_port(struct switch_dev *dev,
+				 const struct switch_attr *attr,
+				 struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+
+	mutex_lock(&priv->reg_mutex);
+	priv->source_port = val->value.i;
+	priv->chip->set_mirror_regs(priv);
+	mutex_unlock(&priv->reg_mutex);
+
+	return 0;
+}
+
+int
+ar8xxx_sw_get_mirror_source_port(struct switch_dev *dev,
+				 const struct switch_attr *attr,
+				 struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	val->value.i = priv->source_port;
+	return 0;
+}
+
+int
+ar8xxx_sw_set_port_reset_mib(struct switch_dev *dev,
+			     const struct switch_attr *attr,
+			     struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	int port;
+	int ret;
+
+	if (!ar8xxx_has_mib_counters(priv))
+		return -EOPNOTSUPP;
+
+	port = val->port_vlan;
+	if (port >= dev->ports)
+		return -EINVAL;
+
+	mutex_lock(&priv->mib_lock);
+	ret = ar8xxx_mib_capture(priv);
+	if (ret)
+		goto unlock;
+
+	ar8xxx_mib_fetch_port_stat(priv, port, true);
+
+	ret = 0;
+
+unlock:
+	mutex_unlock(&priv->mib_lock);
+	return ret;
+}
+
+static void
+ar8xxx_byte_to_str(char *buf, int len, u64 byte)
+{
+	unsigned long b;
+	const char *unit;
+
+	if (byte >= 0x40000000) { /* 1 GiB */
+		b = byte * 10 / 0x40000000;
+		unit = "GiB";
+	} else if (byte >= 0x100000) { /* 1 MiB */
+		b = byte * 10 / 0x100000;
+		unit = "MiB";
+	} else if (byte >= 0x400) { /* 1 KiB */
+		b = byte * 10 / 0x400;
+		unit = "KiB";
+	} else {
+		b = byte;
+		unit = "Byte";
+	}
+	if (strcmp(unit, "Byte"))
+		snprintf(buf, len, "%lu.%lu %s", b / 10, b % 10, unit);
+	else
+		snprintf(buf, len, "%lu %s", b, unit);
+}
+
+int
+ar8xxx_sw_get_port_mib(struct switch_dev *dev,
+		       const struct switch_attr *attr,
+		       struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	const struct ar8xxx_chip *chip = priv->chip;
+	u64 *mib_stats, mib_data;
+	unsigned int port;
+	int ret;
+	char *buf = priv->buf;
+	char buf1[64];
+	const char *mib_name;
+	int i, len = 0;
+	bool mib_stats_empty = true;
+
+	if (!ar8xxx_has_mib_counters(priv) || !priv->mib_poll_interval)
+		return -EOPNOTSUPP;
+
+	port = val->port_vlan;
+	if (port >= dev->ports)
+		return -EINVAL;
+
+	mutex_lock(&priv->mib_lock);
+	ret = ar8xxx_mib_capture(priv);
+	if (ret)
+		goto unlock;
+
+	ar8xxx_mib_fetch_port_stat(priv, port, false);
+
+	len += snprintf(buf + len, sizeof(priv->buf) - len,
+			"MIB counters\n");
+
+	mib_stats = &priv->mib_stats[port * chip->num_mibs];
+	for (i = 0; i < chip->num_mibs; i++) {
+		if (chip->mib_decs[i].type > priv->mib_type)
+			continue;
+		mib_name = chip->mib_decs[i].name;
+		mib_data = mib_stats[i];
+		len += snprintf(buf + len, sizeof(priv->buf) - len,
+				"%-12s: %llu\n", mib_name, mib_data);
+		if ((!strcmp(mib_name, "TxByte") ||
+		    !strcmp(mib_name, "RxGoodByte")) &&
+		    mib_data >= 1024) {
+			ar8xxx_byte_to_str(buf1, sizeof(buf1), mib_data);
+			--len; /* discard newline at the end of buf */
+			len += snprintf(buf + len, sizeof(priv->buf) - len,
+					" (%s)\n", buf1);
+		}
+		if (mib_stats_empty && mib_data)
+			mib_stats_empty = false;
+	}
+
+	if (mib_stats_empty)
+		len = snprintf(buf, sizeof(priv->buf), "No MIB data");
+
+	val->value.s = buf;
+	val->len = len;
+
+	ret = 0;
+
+unlock:
+	mutex_unlock(&priv->mib_lock);
+	return ret;
+}
+
+int
+ar8xxx_sw_set_arl_age_time(struct switch_dev *dev, const struct switch_attr *attr,
+			   struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	int age_time = val->value.i;
+	u32 age_time_val;
+
+	if (age_time < 0)
+		return -EINVAL;
+
+	age_time_val = ar8xxx_age_time_val(age_time);
+	if (age_time_val == 0 || age_time_val > 0xffff)
+		return -EINVAL;
+
+	priv->arl_age_time = age_time;
+	return 0;
+}
+
+int
+ar8xxx_sw_get_arl_age_time(struct switch_dev *dev, const struct switch_attr *attr,
+                   struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	val->value.i = priv->arl_age_time;
+	return 0;
+}
+
+int
+ar8xxx_sw_get_arl_table(struct switch_dev *dev,
+			const struct switch_attr *attr,
+			struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	struct mii_bus *bus = priv->mii_bus;
+	const struct ar8xxx_chip *chip = priv->chip;
+	char *buf = priv->arl_buf;
+	int i, j, k, len = 0;
+	struct arl_entry *a, *a1;
+	u32 status;
+
+	if (!chip->get_arl_entry)
+		return -EOPNOTSUPP;
+
+	mutex_lock(&priv->reg_mutex);
+	mutex_lock(&bus->mdio_lock);
+
+	chip->get_arl_entry(priv, NULL, NULL, AR8XXX_ARL_INITIALIZE);
+
+	for(i = 0; i < AR8XXX_NUM_ARL_RECORDS; ++i) {
+		a = &priv->arl_table[i];
+		duplicate:
+		chip->get_arl_entry(priv, a, &status, AR8XXX_ARL_GET_NEXT);
+
+		if (!status)
+			break;
+
+		/* avoid duplicates
+		 * ARL table can include multiple valid entries
+		 * per MAC, just with differing status codes
+		 */
+		for (j = 0; j < i; ++j) {
+			a1 = &priv->arl_table[j];
+			if (!memcmp(a->mac, a1->mac, sizeof(a->mac))) {
+				/* ignore ports already seen in former entry */
+				a->portmap &= ~a1->portmap;
+				if (!a->portmap)
+					goto duplicate;
+			}
+		}
+	}
+
+	mutex_unlock(&bus->mdio_lock);
+
+	len += snprintf(buf + len, sizeof(priv->arl_buf) - len,
+                        "address resolution table\n");
+
+	if (i == AR8XXX_NUM_ARL_RECORDS)
+		len += snprintf(buf + len, sizeof(priv->arl_buf) - len,
+				"Too many entries found, displaying the first %d only!\n",
+				AR8XXX_NUM_ARL_RECORDS);
+
+	for (j = 0; j < priv->dev.ports; ++j) {
+		for (k = 0; k < i; ++k) {
+			a = &priv->arl_table[k];
+			if (!(a->portmap & BIT(j)))
+				continue;
+			len += snprintf(buf + len, sizeof(priv->arl_buf) - len,
+					"Port %d: MAC %02x:%02x:%02x:%02x:%02x:%02x\n",
+					j,
+					a->mac[5], a->mac[4], a->mac[3],
+					a->mac[2], a->mac[1], a->mac[0]);
+		}
+	}
+
+	val->value.s = buf;
+	val->len = len;
+
+	mutex_unlock(&priv->reg_mutex);
+
+	return 0;
+}
+
+int
+ar8xxx_sw_set_flush_arl_table(struct switch_dev *dev,
+			      const struct switch_attr *attr,
+			      struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	int ret;
+
+	mutex_lock(&priv->reg_mutex);
+	ret = priv->chip->atu_flush(priv);
+	mutex_unlock(&priv->reg_mutex);
+
+	return ret;
+}
+
+int
+ar8xxx_sw_set_flush_port_arl_table(struct switch_dev *dev,
+				   const struct switch_attr *attr,
+				   struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	int port, ret;
+
+	port = val->port_vlan;
+	if (port >= dev->ports)
+		return -EINVAL;
+
+	mutex_lock(&priv->reg_mutex);
+	ret = priv->chip->atu_flush_port(priv, port);
+	mutex_unlock(&priv->reg_mutex);
+
+	return ret;
+}
+
+int
+ar8xxx_sw_get_port_stats(struct switch_dev *dev, int port,
+			struct switch_port_stats *stats)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	u64 *mib_stats;
+
+	if (!ar8xxx_has_mib_counters(priv) || !priv->mib_poll_interval)
+		return -EOPNOTSUPP;
+
+	if (!(priv->chip->mib_rxb_id || priv->chip->mib_txb_id))
+		return -EOPNOTSUPP;
+
+	if (port >= dev->ports)
+		return -EINVAL;
+
+	mutex_lock(&priv->mib_lock);
+
+	mib_stats = &priv->mib_stats[port * priv->chip->num_mibs];
+
+	stats->tx_bytes = mib_stats[priv->chip->mib_txb_id];
+	stats->rx_bytes = mib_stats[priv->chip->mib_rxb_id];
+
+	mutex_unlock(&priv->mib_lock);
+	return 0;
+}
+
+static int
+ar8xxx_phy_read(struct mii_bus *bus, int phy_addr, int reg_addr)
+{
+	struct ar8xxx_priv *priv = bus->priv;
+	return priv->chip->phy_read(priv, phy_addr, reg_addr);
+}
+
+static int
+ar8xxx_phy_write(struct mii_bus *bus, int phy_addr, int reg_addr,
+		 u16 reg_val)
+{
+	struct ar8xxx_priv *priv = bus->priv;
+	return priv->chip->phy_write(priv, phy_addr, reg_addr, reg_val);
+}
+
+static const struct switch_attr ar8xxx_sw_attr_globals[] = {
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_vlan",
+		.description = "Enable VLAN mode",
+		.set = ar8xxx_sw_set_vlan,
+		.get = ar8xxx_sw_get_vlan,
+		.max = 1
+	},
+	{
+		.type = SWITCH_TYPE_NOVAL,
+		.name = "reset_mibs",
+		.description = "Reset all MIB counters",
+		.set = ar8xxx_sw_set_reset_mibs,
+	},
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "ar8xxx_mib_poll_interval",
+		.description = "MIB polling interval in msecs (0 to disable)",
+		.set = ar8xxx_sw_set_mib_poll_interval,
+		.get = ar8xxx_sw_get_mib_poll_interval
+	},
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "ar8xxx_mib_type",
+		.description = "MIB type (0=basic 1=extended)",
+		.set = ar8xxx_sw_set_mib_type,
+		.get = ar8xxx_sw_get_mib_type
+	},
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_mirror_rx",
+		.description = "Enable mirroring of RX packets",
+		.set = ar8xxx_sw_set_mirror_rx_enable,
+		.get = ar8xxx_sw_get_mirror_rx_enable,
+		.max = 1
+	},
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_mirror_tx",
+		.description = "Enable mirroring of TX packets",
+		.set = ar8xxx_sw_set_mirror_tx_enable,
+		.get = ar8xxx_sw_get_mirror_tx_enable,
+		.max = 1
+	},
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "mirror_monitor_port",
+		.description = "Mirror monitor port",
+		.set = ar8xxx_sw_set_mirror_monitor_port,
+		.get = ar8xxx_sw_get_mirror_monitor_port,
+		.max = AR8216_NUM_PORTS - 1
+	},
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "mirror_source_port",
+		.description = "Mirror source port",
+		.set = ar8xxx_sw_set_mirror_source_port,
+		.get = ar8xxx_sw_get_mirror_source_port,
+		.max = AR8216_NUM_PORTS - 1
+ 	},
+	{
+		.type = SWITCH_TYPE_STRING,
+		.name = "arl_table",
+		.description = "Get ARL table",
+		.set = NULL,
+		.get = ar8xxx_sw_get_arl_table,
+	},
+	{
+		.type = SWITCH_TYPE_NOVAL,
+		.name = "flush_arl_table",
+		.description = "Flush ARL table",
+		.set = ar8xxx_sw_set_flush_arl_table,
+	},
+};
+
+const struct switch_attr ar8xxx_sw_attr_port[] = {
+	{
+		.type = SWITCH_TYPE_NOVAL,
+		.name = "reset_mib",
+		.description = "Reset single port MIB counters",
+		.set = ar8xxx_sw_set_port_reset_mib,
+	},
+	{
+		.type = SWITCH_TYPE_STRING,
+		.name = "mib",
+		.description = "Get port's MIB counters",
+		.set = NULL,
+		.get = ar8xxx_sw_get_port_mib,
+	},
+	{
+		.type = SWITCH_TYPE_NOVAL,
+		.name = "flush_arl_table",
+		.description = "Flush port's ARL table entries",
+		.set = ar8xxx_sw_set_flush_port_arl_table,
+	},
+};
+
+const struct switch_attr ar8xxx_sw_attr_vlan[1] = {
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "vid",
+		.description = "VLAN ID (0-4094)",
+		.set = ar8xxx_sw_set_vid,
+		.get = ar8xxx_sw_get_vid,
+		.max = 4094,
+	},
+};
+
+static const struct switch_dev_ops ar8xxx_sw_ops = {
+	.attr_global = {
+		.attr = ar8xxx_sw_attr_globals,
+		.n_attr = ARRAY_SIZE(ar8xxx_sw_attr_globals),
+	},
+	.attr_port = {
+		.attr = ar8xxx_sw_attr_port,
+		.n_attr = ARRAY_SIZE(ar8xxx_sw_attr_port),
+	},
+	.attr_vlan = {
+		.attr = ar8xxx_sw_attr_vlan,
+		.n_attr = ARRAY_SIZE(ar8xxx_sw_attr_vlan),
+	},
+	.get_port_pvid = ar8xxx_sw_get_pvid,
+	.set_port_pvid = ar8xxx_sw_set_pvid,
+	.get_vlan_ports = ar8xxx_sw_get_ports,
+	.set_vlan_ports = ar8xxx_sw_set_ports,
+	.apply_config = ar8xxx_sw_hw_apply,
+	.reset_switch = ar8xxx_sw_reset_switch,
+	.get_port_link = ar8xxx_sw_get_port_link,
+	.get_port_stats = ar8xxx_sw_get_port_stats,
+};
+
+static const struct ar8xxx_chip ar7240sw_chip = {
+	.caps = AR8XXX_CAP_MIB_COUNTERS,
+
+	.reg_port_stats_start = 0x20000,
+	.reg_port_stats_length = 0x100,
+	.reg_arl_ctrl = AR8216_REG_ATU_CTRL,
+
+	.name = "Atheros AR724X/AR933X built-in",
+	.ports = AR7240SW_NUM_PORTS,
+	.vlans = AR8216_NUM_VLANS,
+	.swops = &ar8xxx_sw_ops,
+
+	.hw_init = ar7240sw_hw_init,
+	.init_globals = ar7240sw_init_globals,
+	.init_port = ar8229_init_port,
+	.phy_read = ar8216_phy_read,
+	.phy_write = ar8216_phy_write,
+	.setup_port = ar7240sw_setup_port,
+	.read_port_status = ar8216_read_port_status,
+	.atu_flush = ar8216_atu_flush,
+	.atu_flush_port = ar8216_atu_flush_port,
+	.vtu_flush = ar8216_vtu_flush,
+	.vtu_load_vlan = ar8216_vtu_load_vlan,
+	.set_mirror_regs = ar8216_set_mirror_regs,
+	.get_arl_entry = ar8216_get_arl_entry,
+	.sw_hw_apply = ar8xxx_sw_hw_apply,
+
+	.num_mibs = ARRAY_SIZE(ar8236_mibs),
+	.mib_decs = ar8236_mibs,
+	.mib_func = AR8216_REG_MIB_FUNC,
+	.mib_rxb_id = AR8236_MIB_RXB_ID,
+	.mib_txb_id = AR8236_MIB_TXB_ID,
+};
+
+static const struct ar8xxx_chip ar8216_chip = {
+	.caps = AR8XXX_CAP_MIB_COUNTERS,
+
+	.reg_port_stats_start = 0x19000,
+	.reg_port_stats_length = 0xa0,
+	.reg_arl_ctrl = AR8216_REG_ATU_CTRL,
+
+	.name = "Atheros AR8216",
+	.ports = AR8216_NUM_PORTS,
+	.vlans = AR8216_NUM_VLANS,
+	.swops = &ar8xxx_sw_ops,
+
+	.hw_init = ar8216_hw_init,
+	.init_globals = ar8216_init_globals,
+	.init_port = ar8216_init_port,
+	.setup_port = ar8216_setup_port,
+	.read_port_status = ar8216_read_port_status,
+	.atu_flush = ar8216_atu_flush,
+	.atu_flush_port = ar8216_atu_flush_port,
+	.vtu_flush = ar8216_vtu_flush,
+	.vtu_load_vlan = ar8216_vtu_load_vlan,
+	.set_mirror_regs = ar8216_set_mirror_regs,
+	.get_arl_entry = ar8216_get_arl_entry,
+	.sw_hw_apply = ar8xxx_sw_hw_apply,
+
+	.num_mibs = ARRAY_SIZE(ar8216_mibs),
+	.mib_decs = ar8216_mibs,
+	.mib_func = AR8216_REG_MIB_FUNC,
+	.mib_rxb_id = AR8216_MIB_RXB_ID,
+	.mib_txb_id = AR8216_MIB_TXB_ID,
+};
+
+static const struct ar8xxx_chip ar8229_chip = {
+	.caps = AR8XXX_CAP_MIB_COUNTERS,
+
+	.reg_port_stats_start = 0x20000,
+	.reg_port_stats_length = 0x100,
+	.reg_arl_ctrl = AR8216_REG_ATU_CTRL,
+
+	.name = "Atheros AR8229",
+	.ports = AR8216_NUM_PORTS,
+	.vlans = AR8216_NUM_VLANS,
+	.swops = &ar8xxx_sw_ops,
+
+	.hw_init = ar8229_hw_init,
+	.init_globals = ar8229_init_globals,
+	.init_port = ar8229_init_port,
+	.phy_read = ar8216_phy_read,
+	.phy_write = ar8216_phy_write,
+	.setup_port = ar8236_setup_port,
+	.read_port_status = ar8216_read_port_status,
+	.atu_flush = ar8216_atu_flush,
+	.atu_flush_port = ar8216_atu_flush_port,
+	.vtu_flush = ar8216_vtu_flush,
+	.vtu_load_vlan = ar8216_vtu_load_vlan,
+	.set_mirror_regs = ar8216_set_mirror_regs,
+	.get_arl_entry = ar8216_get_arl_entry,
+	.sw_hw_apply = ar8xxx_sw_hw_apply,
+
+	.num_mibs = ARRAY_SIZE(ar8236_mibs),
+	.mib_decs = ar8236_mibs,
+	.mib_func = AR8216_REG_MIB_FUNC,
+	.mib_rxb_id = AR8236_MIB_RXB_ID,
+	.mib_txb_id = AR8236_MIB_TXB_ID,
+};
+
+static const struct ar8xxx_chip ar8236_chip = {
+	.caps = AR8XXX_CAP_MIB_COUNTERS,
+
+	.reg_port_stats_start = 0x20000,
+	.reg_port_stats_length = 0x100,
+	.reg_arl_ctrl = AR8216_REG_ATU_CTRL,
+
+	.name = "Atheros AR8236",
+	.ports = AR8216_NUM_PORTS,
+	.vlans = AR8216_NUM_VLANS,
+	.swops = &ar8xxx_sw_ops,
+
+	.hw_init = ar8216_hw_init,
+	.init_globals = ar8236_init_globals,
+	.init_port = ar8216_init_port,
+	.setup_port = ar8236_setup_port,
+	.read_port_status = ar8216_read_port_status,
+	.atu_flush = ar8216_atu_flush,
+	.atu_flush_port = ar8216_atu_flush_port,
+	.vtu_flush = ar8216_vtu_flush,
+	.vtu_load_vlan = ar8216_vtu_load_vlan,
+	.set_mirror_regs = ar8216_set_mirror_regs,
+	.get_arl_entry = ar8216_get_arl_entry,
+	.sw_hw_apply = ar8xxx_sw_hw_apply,
+
+	.num_mibs = ARRAY_SIZE(ar8236_mibs),
+	.mib_decs = ar8236_mibs,
+	.mib_func = AR8216_REG_MIB_FUNC,
+	.mib_rxb_id = AR8236_MIB_RXB_ID,
+	.mib_txb_id = AR8236_MIB_TXB_ID,
+};
+
+static const struct ar8xxx_chip ar8316_chip = {
+	.caps = AR8XXX_CAP_GIGE | AR8XXX_CAP_MIB_COUNTERS,
+
+	.reg_port_stats_start = 0x20000,
+	.reg_port_stats_length = 0x100,
+	.reg_arl_ctrl = AR8216_REG_ATU_CTRL,
+
+	.name = "Atheros AR8316",
+	.ports = AR8216_NUM_PORTS,
+	.vlans = AR8X16_MAX_VLANS,
+	.swops = &ar8xxx_sw_ops,
+
+	.hw_init = ar8316_hw_init,
+	.init_globals = ar8316_init_globals,
+	.init_port = ar8216_init_port,
+	.setup_port = ar8216_setup_port,
+	.read_port_status = ar8216_read_port_status,
+	.atu_flush = ar8216_atu_flush,
+	.atu_flush_port = ar8216_atu_flush_port,
+	.vtu_flush = ar8216_vtu_flush,
+	.vtu_load_vlan = ar8216_vtu_load_vlan,
+	.set_mirror_regs = ar8216_set_mirror_regs,
+	.get_arl_entry = ar8216_get_arl_entry,
+	.sw_hw_apply = ar8xxx_sw_hw_apply,
+
+	.num_mibs = ARRAY_SIZE(ar8236_mibs),
+	.mib_decs = ar8236_mibs,
+	.mib_func = AR8216_REG_MIB_FUNC,
+	.mib_rxb_id = AR8236_MIB_RXB_ID,
+	.mib_txb_id = AR8236_MIB_TXB_ID,
+};
+
+static int
+ar8xxx_read_id(struct ar8xxx_priv *priv)
+{
+	u32 val;
+	u16 id;
+	int i;
+
+	val = ar8xxx_read(priv, AR8216_REG_CTRL);
+	if (val == ~0)
+		return -ENODEV;
+
+	id = val & (AR8216_CTRL_REVISION | AR8216_CTRL_VERSION);
+	for (i = 0; i < AR8X16_PROBE_RETRIES; i++) {
+		u16 t;
+
+		val = ar8xxx_read(priv, AR8216_REG_CTRL);
+		if (val == ~0)
+			return -ENODEV;
+
+		t = val & (AR8216_CTRL_REVISION | AR8216_CTRL_VERSION);
+		if (t != id)
+			return -ENODEV;
+	}
+
+	priv->chip_ver = (id & AR8216_CTRL_VERSION) >> AR8216_CTRL_VERSION_S;
+	priv->chip_rev = (id & AR8216_CTRL_REVISION);
+	return 0;
+}
+
+static int
+ar8xxx_id_chip(struct ar8xxx_priv *priv)
+{
+	int ret;
+
+	ret = ar8xxx_read_id(priv);
+	if(ret)
+		return ret;
+
+	switch (priv->chip_ver) {
+	case AR8XXX_VER_AR8216:
+		priv->chip = &ar8216_chip;
+		break;
+	case AR8XXX_VER_AR8236:
+		priv->chip = &ar8236_chip;
+		break;
+	case AR8XXX_VER_AR8316:
+		priv->chip = &ar8316_chip;
+		break;
+	case AR8XXX_VER_AR8327:
+		priv->chip = &ar8327_chip;
+		break;
+	case AR8XXX_VER_AR8337:
+		priv->chip = &ar8337_chip;
+		break;
+	default:
+		pr_err("ar8216: Unknown Atheros device [ver=%d, rev=%d]\n",
+		       priv->chip_ver, priv->chip_rev);
+
+		return -ENODEV;
+	}
+
+	return 0;
+}
+
+static void
+ar8xxx_mib_work_func(struct work_struct *work)
+{
+	struct ar8xxx_priv *priv;
+	int err, i;
+
+	priv = container_of(work, struct ar8xxx_priv, mib_work.work);
+
+	mutex_lock(&priv->mib_lock);
+
+	err = ar8xxx_mib_capture(priv);
+	if (err)
+		goto next_attempt;
+
+	for (i = 0; i < priv->dev.ports; i++)
+		ar8xxx_mib_fetch_port_stat(priv, i, false);
+
+next_attempt:
+	mutex_unlock(&priv->mib_lock);
+	schedule_delayed_work(&priv->mib_work,
+			      msecs_to_jiffies(priv->mib_poll_interval));
+}
+
+static int
+ar8xxx_mib_init(struct ar8xxx_priv *priv)
+{
+	unsigned int len;
+
+	if (!ar8xxx_has_mib_counters(priv))
+		return 0;
+
+	BUG_ON(!priv->chip->mib_decs || !priv->chip->num_mibs);
+
+	len = priv->dev.ports * priv->chip->num_mibs *
+	      sizeof(*priv->mib_stats);
+	priv->mib_stats = kzalloc(len, GFP_KERNEL);
+
+	if (!priv->mib_stats)
+		return -ENOMEM;
+
+	return 0;
+}
+
+static void
+ar8xxx_mib_start(struct ar8xxx_priv *priv)
+{
+	if (!ar8xxx_has_mib_counters(priv) || !priv->mib_poll_interval)
+		return;
+
+	schedule_delayed_work(&priv->mib_work,
+			      msecs_to_jiffies(priv->mib_poll_interval));
+}
+
+static void
+ar8xxx_mib_stop(struct ar8xxx_priv *priv)
+{
+	if (!ar8xxx_has_mib_counters(priv) || !priv->mib_poll_interval)
+		return;
+
+	cancel_delayed_work_sync(&priv->mib_work);
+}
+
+static struct ar8xxx_priv *
+ar8xxx_create(void)
+{
+	struct ar8xxx_priv *priv;
+
+	priv = kzalloc(sizeof(struct ar8xxx_priv), GFP_KERNEL);
+	if (priv == NULL)
+		return NULL;
+
+	mutex_init(&priv->reg_mutex);
+	mutex_init(&priv->mib_lock);
+	INIT_DELAYED_WORK(&priv->mib_work, ar8xxx_mib_work_func);
+
+	return priv;
+}
+
+static void
+ar8xxx_free(struct ar8xxx_priv *priv)
+{
+	if (priv->chip && priv->chip->cleanup)
+		priv->chip->cleanup(priv);
+
+	kfree(priv->chip_data);
+	kfree(priv->mib_stats);
+	kfree(priv);
+}
+
+static int
+ar8xxx_probe_switch(struct ar8xxx_priv *priv)
+{
+	const struct ar8xxx_chip *chip;
+	struct switch_dev *swdev;
+	int ret;
+
+	chip = priv->chip;
+
+	swdev = &priv->dev;
+	swdev->cpu_port = AR8216_PORT_CPU;
+	swdev->name = chip->name;
+	swdev->vlans = chip->vlans;
+	swdev->ports = chip->ports;
+	swdev->ops = chip->swops;
+
+	ret = ar8xxx_mib_init(priv);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+static int
+ar8xxx_start(struct ar8xxx_priv *priv)
+{
+	int ret;
+
+	priv->init = true;
+
+	ret = priv->chip->hw_init(priv);
+	if (ret)
+		return ret;
+
+	ret = ar8xxx_sw_reset_switch(&priv->dev);
+	if (ret)
+		return ret;
+
+	priv->init = false;
+
+	ar8xxx_mib_start(priv);
+
+	return 0;
+}
+
+static int
+ar8xxx_phy_config_init(struct phy_device *phydev)
+{
+	struct ar8xxx_priv *priv = phydev->priv;
+#ifdef CONFIG_ETHERNET_PACKET_MANGLE
+	struct net_device *dev = phydev->attached_dev;
+#endif
+	int ret;
+
+	if (WARN_ON(!priv))
+		return -ENODEV;
+
+	if (priv->chip->config_at_probe)
+		return ar8xxx_phy_check_aneg(phydev);
+
+	priv->phy = phydev;
+
+	if (phydev->mdio.addr != 0) {
+		if (chip_is_ar8316(priv)) {
+			/* switch device has been initialized, reinit */
+			priv->dev.ports = (AR8216_NUM_PORTS - 1);
+			priv->initialized = false;
+			priv->port4_phy = true;
+			ar8316_hw_init(priv);
+			return 0;
+		}
+
+		return 0;
+	}
+
+	ret = ar8xxx_start(priv);
+	if (ret)
+		return ret;
+
+#ifdef CONFIG_ETHERNET_PACKET_MANGLE
+	/* VID fixup only needed on ar8216 */
+	if (chip_is_ar8216(priv)) {
+		dev->phy_ptr = priv;
+		dev->priv_flags |= IFF_NO_IP_ALIGN;
+		dev->eth_mangle_rx = ar8216_mangle_rx;
+		dev->eth_mangle_tx = ar8216_mangle_tx;
+	}
+#endif
+
+	return 0;
+}
+
+static bool
+ar8xxx_check_link_states(struct ar8xxx_priv *priv)
+{
+	bool link_new, changed = false;
+	u32 status;
+	int i;
+
+	mutex_lock(&priv->reg_mutex);
+
+	for (i = 0; i < priv->dev.ports; i++) {
+		status = priv->chip->read_port_status(priv, i);
+		link_new = !!(status & AR8216_PORT_STATUS_LINK_UP);
+		if (link_new == priv->link_up[i])
+			continue;
+
+		priv->link_up[i] = link_new;
+		changed = true;
+		/* flush ARL entries for this port if it went down*/
+		if (!link_new)
+			priv->chip->atu_flush_port(priv, i);
+		dev_info(&priv->phy->mdio.dev, "Port %d is %s\n",
+			 i, link_new ? "up" : "down");
+	}
+
+	mutex_unlock(&priv->reg_mutex);
+
+	return changed;
+}
+
+static int
+ar8xxx_phy_read_status(struct phy_device *phydev)
+{
+	struct ar8xxx_priv *priv = phydev->priv;
+	struct switch_port_link link;
+
+	/* check for switch port link changes */
+	ar8xxx_check_link_states(priv);
+
+	if (phydev->mdio.addr != 0)
+		return genphy_read_status(phydev);
+
+	ar8216_read_port_link(priv, phydev->mdio.addr, &link);
+	phydev->link = !!link.link;
+	if (!phydev->link)
+		return 0;
+
+	switch (link.speed) {
+	case SWITCH_PORT_SPEED_10:
+		phydev->speed = SPEED_10;
+		break;
+	case SWITCH_PORT_SPEED_100:
+		phydev->speed = SPEED_100;
+		break;
+	case SWITCH_PORT_SPEED_1000:
+		phydev->speed = SPEED_1000;
+		break;
+	default:
+		phydev->speed = 0;
+	}
+	phydev->duplex = link.duplex ? DUPLEX_FULL : DUPLEX_HALF;
+
+	phydev->state = PHY_RUNNING;
+	netif_carrier_on(phydev->attached_dev);
+	if (phydev->adjust_link)
+		phydev->adjust_link(phydev->attached_dev);
+
+	return 0;
+}
+
+static int
+ar8xxx_phy_config_aneg(struct phy_device *phydev)
+{
+	if (phydev->mdio.addr == 0)
+		return 0;
+
+	return genphy_config_aneg(phydev);
+}
+
+static int
+ar8xxx_get_features(struct phy_device *phydev)
+{
+	struct ar8xxx_priv *priv = phydev->priv;
+
+	linkmode_copy(phydev->supported, PHY_BASIC_FEATURES);
+	if (ar8xxx_has_gige(priv))
+		linkmode_set_bit(ETHTOOL_LINK_MODE_1000baseT_Full_BIT, phydev->supported);
+
+	return 0;
+}
+
+static const u32 ar8xxx_phy_ids[] = {
+	0x004dd033,
+	0x004dd034, /* AR8327 */
+	0x004dd036, /* AR8337 */
+	0x004dd041,
+	0x004dd042,
+	0x004dd043, /* AR8236 */
+};
+
+static bool
+ar8xxx_phy_match(u32 phy_id)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(ar8xxx_phy_ids); i++)
+		if (phy_id == ar8xxx_phy_ids[i])
+			return true;
+
+	return false;
+}
+
+static bool
+ar8xxx_is_possible(struct mii_bus *bus)
+{
+	unsigned int i, found_phys = 0;
+
+	for (i = 0; i < 5; i++) {
+		u32 phy_id;
+
+		phy_id = mdiobus_read(bus, i, MII_PHYSID1) << 16;
+		phy_id |= mdiobus_read(bus, i, MII_PHYSID2);
+		if (ar8xxx_phy_match(phy_id)) {
+			found_phys++;
+		} else if (phy_id) {
+			pr_debug("ar8xxx: unknown PHY at %s:%02x id:%08x\n",
+				 dev_name(&bus->dev), i, phy_id);
+		}
+	}
+	return !!found_phys;
+}
+
+static int
+ar8xxx_phy_probe(struct phy_device *phydev)
+{
+	struct ar8xxx_priv *priv;
+	struct switch_dev *swdev;
+	int ret;
+
+	/* skip PHYs at unused adresses */
+	if (phydev->mdio.addr != 0 && phydev->mdio.addr != 3 && phydev->mdio.addr != 4)
+		return -ENODEV;
+
+	if (!ar8xxx_is_possible(phydev->mdio.bus))
+		return -ENODEV;
+
+	mutex_lock(&ar8xxx_dev_list_lock);
+	list_for_each_entry(priv, &ar8xxx_dev_list, list)
+		if (priv->mii_bus == phydev->mdio.bus)
+			goto found;
+
+	priv = ar8xxx_create();
+	if (priv == NULL) {
+		ret = -ENOMEM;
+		goto unlock;
+	}
+
+	priv->mii_bus = phydev->mdio.bus;
+	priv->pdev = &phydev->mdio.dev;
+
+	ret = of_property_read_u32(priv->pdev->of_node, "qca,mib-poll-interval",
+				   &priv->mib_poll_interval);
+	if (ret)
+		priv->mib_poll_interval = 0;
+
+	ret = ar8xxx_id_chip(priv);
+	if (ret)
+		goto free_priv;
+
+	ret = ar8xxx_probe_switch(priv);
+	if (ret)
+		goto free_priv;
+
+	swdev = &priv->dev;
+	swdev->alias = dev_name(&priv->mii_bus->dev);
+	ret = register_switch(swdev, NULL);
+	if (ret)
+		goto free_priv;
+
+	pr_info("%s: %s rev. %u switch registered on %s\n",
+		swdev->devname, swdev->name, priv->chip_rev,
+		dev_name(&priv->mii_bus->dev));
+
+	list_add(&priv->list, &ar8xxx_dev_list);
+
+found:
+	priv->use_count++;
+
+	if (phydev->mdio.addr == 0 && priv->chip->config_at_probe) {
+		priv->phy = phydev;
+
+		ret = ar8xxx_start(priv);
+		if (ret)
+			goto err_unregister_switch;
+	} else if (priv->chip->phy_rgmii_set) {
+		priv->chip->phy_rgmii_set(priv, phydev);
+	}
+
+	phydev->priv = priv;
+
+	mutex_unlock(&ar8xxx_dev_list_lock);
+
+	return 0;
+
+err_unregister_switch:
+	if (--priv->use_count)
+		goto unlock;
+
+	unregister_switch(&priv->dev);
+
+free_priv:
+	ar8xxx_free(priv);
+unlock:
+	mutex_unlock(&ar8xxx_dev_list_lock);
+	return ret;
+}
+
+static void
+ar8xxx_phy_detach(struct phy_device *phydev)
+{
+	struct net_device *dev = phydev->attached_dev;
+
+	if (!dev)
+		return;
+
+#ifdef CONFIG_ETHERNET_PACKET_MANGLE
+	dev->phy_ptr = NULL;
+	dev->priv_flags &= ~IFF_NO_IP_ALIGN;
+	dev->eth_mangle_rx = NULL;
+	dev->eth_mangle_tx = NULL;
+#endif
+}
+
+static void
+ar8xxx_phy_remove(struct phy_device *phydev)
+{
+	struct ar8xxx_priv *priv = phydev->priv;
+
+	if (WARN_ON(!priv))
+		return;
+
+	phydev->priv = NULL;
+
+	mutex_lock(&ar8xxx_dev_list_lock);
+
+	if (--priv->use_count > 0) {
+		mutex_unlock(&ar8xxx_dev_list_lock);
+		return;
+	}
+
+	list_del(&priv->list);
+	mutex_unlock(&ar8xxx_dev_list_lock);
+
+	unregister_switch(&priv->dev);
+	ar8xxx_mib_stop(priv);
+	ar8xxx_free(priv);
+}
+
+static struct phy_driver ar8xxx_phy_driver[] = {
+	{
+		.phy_id		= 0x004d0000,
+		.name		= "Atheros AR8216/AR8236/AR8316",
+		.phy_id_mask	= 0xffff0000,
+		.probe		= ar8xxx_phy_probe,
+		.remove		= ar8xxx_phy_remove,
+		.detach		= ar8xxx_phy_detach,
+		.config_init	= ar8xxx_phy_config_init,
+		.config_aneg	= ar8xxx_phy_config_aneg,
+		.read_status	= ar8xxx_phy_read_status,
+		.get_features	= ar8xxx_get_features,
+	}
+};
+
+static const struct of_device_id ar8xxx_mdiodev_of_match[] = {
+	{
+		.compatible = "qca,ar7240sw",
+		.data = &ar7240sw_chip,
+	}, {
+		.compatible = "qca,ar8229",
+		.data = &ar8229_chip,
+	}, {
+		.compatible = "qca,ar8236",
+		.data = &ar8236_chip,
+	}, {
+		.compatible = "qca,ar8327",
+		.data = &ar8327_chip,
+	},
+	{ /* sentinel */ },
+};
+
+static int
+ar8xxx_mdiodev_probe(struct mdio_device *mdiodev)
+{
+	const struct of_device_id *match;
+	struct ar8xxx_priv *priv;
+	struct switch_dev *swdev;
+	struct device_node *mdio_node;
+	int ret;
+
+	match = of_match_device(ar8xxx_mdiodev_of_match, &mdiodev->dev);
+	if (!match)
+		return -EINVAL;
+
+	priv = ar8xxx_create();
+	if (priv == NULL)
+		return -ENOMEM;
+
+	priv->mii_bus = mdiodev->bus;
+	priv->pdev = &mdiodev->dev;
+	priv->chip = (const struct ar8xxx_chip *) match->data;
+
+	ret = of_property_read_u32(priv->pdev->of_node, "qca,mib-poll-interval",
+				   &priv->mib_poll_interval);
+	if (ret)
+		priv->mib_poll_interval = 0;
+
+	ret = ar8xxx_read_id(priv);
+	if (ret)
+		goto free_priv;
+
+	ret = ar8xxx_probe_switch(priv);
+	if (ret)
+		goto free_priv;
+
+	if (priv->chip->phy_read && priv->chip->phy_write) {
+		priv->sw_mii_bus = devm_mdiobus_alloc(&mdiodev->dev);
+		priv->sw_mii_bus->name = "ar8xxx-mdio";
+		priv->sw_mii_bus->read = ar8xxx_phy_read;
+		priv->sw_mii_bus->write = ar8xxx_phy_write;
+		priv->sw_mii_bus->priv = priv;
+		priv->sw_mii_bus->parent = &mdiodev->dev;
+		snprintf(priv->sw_mii_bus->id, MII_BUS_ID_SIZE, "%s",
+			 dev_name(&mdiodev->dev));
+		mdio_node = of_get_child_by_name(priv->pdev->of_node, "mdio-bus");
+		ret = of_mdiobus_register(priv->sw_mii_bus, mdio_node);
+		if (ret)
+			goto free_priv;
+	}
+
+	swdev = &priv->dev;
+	swdev->alias = dev_name(&mdiodev->dev);
+
+	if (of_property_read_bool(priv->pdev->of_node, "qca,phy4-mii-enable")) {
+		priv->port4_phy = true;
+		swdev->ports--;
+	}
+
+	ret = register_switch(swdev, NULL);
+	if (ret)
+		goto free_priv;
+
+	pr_info("%s: %s rev. %u switch registered on %s\n",
+		swdev->devname, swdev->name, priv->chip_rev,
+		dev_name(&priv->mii_bus->dev));
+
+	mutex_lock(&ar8xxx_dev_list_lock);
+	list_add(&priv->list, &ar8xxx_dev_list);
+	mutex_unlock(&ar8xxx_dev_list_lock);
+
+	priv->use_count++;
+
+	ret = ar8xxx_start(priv);
+	if (ret)
+		goto err_unregister_switch;
+
+	dev_set_drvdata(&mdiodev->dev, priv);
+
+	return 0;
+
+err_unregister_switch:
+	if (--priv->use_count)
+		return ret;
+
+	unregister_switch(&priv->dev);
+
+free_priv:
+	ar8xxx_free(priv);
+	return ret;
+}
+
+static void
+ar8xxx_mdiodev_remove(struct mdio_device *mdiodev)
+{
+	struct ar8xxx_priv *priv = dev_get_drvdata(&mdiodev->dev);
+
+	if (WARN_ON(!priv))
+		return;
+
+	mutex_lock(&ar8xxx_dev_list_lock);
+
+	if (--priv->use_count > 0) {
+		mutex_unlock(&ar8xxx_dev_list_lock);
+		return;
+	}
+
+	list_del(&priv->list);
+	mutex_unlock(&ar8xxx_dev_list_lock);
+
+	unregister_switch(&priv->dev);
+	ar8xxx_mib_stop(priv);
+	if(priv->sw_mii_bus)
+		mdiobus_unregister(priv->sw_mii_bus);
+	ar8xxx_free(priv);
+}
+
+static struct mdio_driver ar8xxx_mdio_driver = {
+	.probe  = ar8xxx_mdiodev_probe,
+	.remove = ar8xxx_mdiodev_remove,
+	.mdiodrv.driver = {
+		.name = "ar8xxx-switch",
+		.of_match_table = ar8xxx_mdiodev_of_match,
+	},
+};
+
+static int __init ar8216_init(void)
+{
+	int ret;
+
+	ret = phy_drivers_register(ar8xxx_phy_driver,
+				   ARRAY_SIZE(ar8xxx_phy_driver),
+				   THIS_MODULE);
+	if (ret)
+		return ret;
+
+	ret = mdio_driver_register(&ar8xxx_mdio_driver);
+	if (ret)
+		phy_drivers_unregister(ar8xxx_phy_driver,
+				       ARRAY_SIZE(ar8xxx_phy_driver));
+
+	return ret;
+}
+module_init(ar8216_init);
+
+static void __exit ar8216_exit(void)
+{
+	mdio_driver_unregister(&ar8xxx_mdio_driver);
+	phy_drivers_unregister(ar8xxx_phy_driver,
+			        ARRAY_SIZE(ar8xxx_phy_driver));
+}
+module_exit(ar8216_exit);
+
+MODULE_LICENSE("GPL");
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/ar8216.h b/6.12/target/linux/generic/files/drivers/net/phy/ar8216.h
new file mode 100644
index 00000000..f046b35f
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/ar8216.h
@@ -0,0 +1,725 @@
+/*
+ * ar8216.h: AR8216 switch driver
+ *
+ * Copyright (C) 2009 Felix Fietkau <nbd@nbd.name>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#ifndef __AR8216_H
+#define __AR8216_H
+
+#define BITS(_s, _n)	(((1UL << (_n)) - 1) << _s)
+
+#define AR8XXX_CAP_GIGE			BIT(0)
+#define AR8XXX_CAP_MIB_COUNTERS		BIT(1)
+
+#define AR8XXX_NUM_PHYS 	5
+#define AR8216_PORT_CPU	0
+#define AR8216_NUM_PORTS	6
+#define AR8216_NUM_VLANS	16
+#define AR7240SW_NUM_PORTS	5
+#define AR8316_NUM_VLANS	4096
+
+/* size of the vlan table */
+#define AR8X16_MAX_VLANS	128
+#define AR83X7_MAX_VLANS	4096
+#define AR8XXX_MAX_VLANS	AR83X7_MAX_VLANS
+
+#define AR8X16_PROBE_RETRIES	10
+#define AR8X16_MAX_PORTS	8
+
+#define AR8XXX_REG_ARL_CTRL_AGE_TIME_SECS	7
+#define AR8XXX_DEFAULT_ARL_AGE_TIME		300
+
+/* Atheros specific MII registers */
+#define MII_ATH_MMD_ADDR		0x0d
+#define MII_ATH_MMD_DATA		0x0e
+#define MII_ATH_DBG_ADDR		0x1d
+#define MII_ATH_DBG_DATA		0x1e
+
+#define AR8216_REG_CTRL			0x0000
+#define   AR8216_CTRL_REVISION		BITS(0, 8)
+#define   AR8216_CTRL_REVISION_S	0
+#define   AR8216_CTRL_VERSION		BITS(8, 8)
+#define   AR8216_CTRL_VERSION_S		8
+#define   AR8216_CTRL_RESET		BIT(31)
+
+#define AR8216_REG_FLOOD_MASK		0x002C
+#define   AR8216_FM_UNI_DEST_PORTS	BITS(0, 6)
+#define   AR8216_FM_MULTI_DEST_PORTS	BITS(16, 6)
+#define   AR8216_FM_CPU_BROADCAST_EN	BIT(26)
+#define   AR8229_FLOOD_MASK_UC_DP(_p)	BIT(_p)
+#define   AR8229_FLOOD_MASK_MC_DP(_p)	BIT(16 + (_p))
+#define   AR8229_FLOOD_MASK_BC_DP(_p)	BIT(25 + (_p))
+
+#define AR8216_REG_GLOBAL_CTRL		0x0030
+#define   AR8216_GCTRL_MTU		BITS(0, 11)
+#define   AR8236_GCTRL_MTU		BITS(0, 14)
+#define   AR8316_GCTRL_MTU		BITS(0, 14)
+
+#define AR8216_REG_VTU			0x0040
+#define   AR8216_VTU_OP			BITS(0, 3)
+#define   AR8216_VTU_OP_NOOP		0x0
+#define   AR8216_VTU_OP_FLUSH		0x1
+#define   AR8216_VTU_OP_LOAD		0x2
+#define   AR8216_VTU_OP_PURGE		0x3
+#define   AR8216_VTU_OP_REMOVE_PORT	0x4
+#define   AR8216_VTU_ACTIVE		BIT(3)
+#define   AR8216_VTU_FULL		BIT(4)
+#define   AR8216_VTU_PORT		BITS(8, 4)
+#define   AR8216_VTU_PORT_S		8
+#define   AR8216_VTU_VID		BITS(16, 12)
+#define   AR8216_VTU_VID_S		16
+#define   AR8216_VTU_PRIO		BITS(28, 3)
+#define   AR8216_VTU_PRIO_S		28
+#define   AR8216_VTU_PRIO_EN		BIT(31)
+
+#define AR8216_REG_VTU_DATA		0x0044
+#define   AR8216_VTUDATA_MEMBER		BITS(0, 10)
+#define   AR8236_VTUDATA_MEMBER		BITS(0, 7)
+#define   AR8216_VTUDATA_VALID		BIT(11)
+
+#define AR8216_REG_ATU_FUNC0		0x0050
+#define   AR8216_ATU_OP			BITS(0, 3)
+#define   AR8216_ATU_OP_NOOP		0x0
+#define   AR8216_ATU_OP_FLUSH		0x1
+#define   AR8216_ATU_OP_LOAD		0x2
+#define   AR8216_ATU_OP_PURGE		0x3
+#define   AR8216_ATU_OP_FLUSH_UNLOCKED	0x4
+#define   AR8216_ATU_OP_FLUSH_PORT	0x5
+#define   AR8216_ATU_OP_GET_NEXT	0x6
+#define   AR8216_ATU_ACTIVE		BIT(3)
+#define   AR8216_ATU_PORT_NUM		BITS(8, 4)
+#define   AR8216_ATU_PORT_NUM_S		8
+#define   AR8216_ATU_FULL_VIO		BIT(12)
+#define   AR8216_ATU_ADDR5		BITS(16, 8)
+#define   AR8216_ATU_ADDR5_S		16
+#define   AR8216_ATU_ADDR4		BITS(24, 8)
+#define   AR8216_ATU_ADDR4_S		24
+
+#define AR8216_REG_ATU_FUNC1		0x0054
+#define   AR8216_ATU_ADDR3		BITS(0, 8)
+#define   AR8216_ATU_ADDR3_S		0
+#define   AR8216_ATU_ADDR2		BITS(8, 8)
+#define   AR8216_ATU_ADDR2_S		8
+#define   AR8216_ATU_ADDR1		BITS(16, 8)
+#define   AR8216_ATU_ADDR1_S		16
+#define   AR8216_ATU_ADDR0		BITS(24, 8)
+#define   AR8216_ATU_ADDR0_S		24
+
+#define AR8216_REG_ATU_FUNC2		0x0058
+#define   AR8216_ATU_PORTS		BITS(0, 6)
+#define   AR8216_ATU_PORTS_S		0
+#define   AR8216_ATU_PORT0		BIT(0)
+#define   AR8216_ATU_PORT1		BIT(1)
+#define   AR8216_ATU_PORT2		BIT(2)
+#define   AR8216_ATU_PORT3		BIT(3)
+#define   AR8216_ATU_PORT4		BIT(4)
+#define   AR8216_ATU_PORT5		BIT(5)
+#define   AR8216_ATU_STATUS		BITS(16, 4)
+#define   AR8216_ATU_STATUS_S		16
+
+#define AR8216_REG_ATU_CTRL		0x005C
+#define   AR8216_ATU_CTRL_AGE_EN	BIT(17)
+#define   AR8216_ATU_CTRL_AGE_TIME	BITS(0, 16)
+#define   AR8216_ATU_CTRL_AGE_TIME_S	0
+#define   AR8236_ATU_CTRL_RES		BIT(20)
+#define   AR8216_ATU_CTRL_LEARN_CHANGE	BIT(18)
+#define   AR8216_ATU_CTRL_RESERVED	BIT(19)
+#define   AR8216_ATU_CTRL_ARP_EN	BIT(20)
+
+#define AR8216_REG_TAG_PRIORITY	0x0070
+
+#define AR8216_REG_SERVICE_TAG		0x0074
+#define  AR8216_SERVICE_TAG_M		BITS(0, 16)
+
+#define AR8216_REG_MIB_FUNC		0x0080
+#define   AR8216_MIB_TIMER		BITS(0, 16)
+#define   AR8216_MIB_AT_HALF_EN		BIT(16)
+#define   AR8216_MIB_BUSY		BIT(17)
+#define   AR8216_MIB_FUNC		BITS(24, 3)
+#define   AR8216_MIB_FUNC_S		24
+#define   AR8216_MIB_FUNC_NO_OP		0x0
+#define   AR8216_MIB_FUNC_FLUSH		0x1
+#define   AR8216_MIB_FUNC_CAPTURE	0x3
+#define   AR8236_MIB_EN			BIT(30)
+
+#define AR8216_REG_GLOBAL_CPUPORT		0x0078
+#define   AR8216_GLOBAL_CPUPORT_MIRROR_PORT	BITS(4, 4)
+#define   AR8216_GLOBAL_CPUPORT_MIRROR_PORT_S	4
+#define   AR8216_GLOBAL_CPUPORT_EN		BIT(8)
+
+#define AR8216_REG_MDIO_CTRL		0x98
+#define   AR8216_MDIO_CTRL_DATA_M	BITS(0, 16)
+#define   AR8216_MDIO_CTRL_REG_ADDR_S	16
+#define   AR8216_MDIO_CTRL_PHY_ADDR_S	21
+#define   AR8216_MDIO_CTRL_CMD_WRITE	0
+#define   AR8216_MDIO_CTRL_CMD_READ	BIT(27)
+#define   AR8216_MDIO_CTRL_MASTER_EN	BIT(30)
+#define   AR8216_MDIO_CTRL_BUSY	BIT(31)
+
+#define AR8216_PORT_OFFSET(_i)		(0x0100 * (_i + 1))
+#define AR8216_REG_PORT_STATUS(_i)	(AR8216_PORT_OFFSET(_i) + 0x0000)
+#define   AR8216_PORT_STATUS_SPEED	BITS(0,2)
+#define   AR8216_PORT_STATUS_SPEED_S	0
+#define   AR8216_PORT_STATUS_TXMAC	BIT(2)
+#define   AR8216_PORT_STATUS_RXMAC	BIT(3)
+#define   AR8216_PORT_STATUS_TXFLOW	BIT(4)
+#define   AR8216_PORT_STATUS_RXFLOW	BIT(5)
+#define   AR8216_PORT_STATUS_DUPLEX	BIT(6)
+#define   AR8216_PORT_STATUS_LINK_UP	BIT(8)
+#define   AR8216_PORT_STATUS_LINK_AUTO	BIT(9)
+#define   AR8216_PORT_STATUS_LINK_PAUSE	BIT(10)
+#define   AR8216_PORT_STATUS_FLOW_CONTROL  BIT(12)
+
+#define AR8216_REG_PORT_CTRL(_i)	(AR8216_PORT_OFFSET(_i) + 0x0004)
+
+/* port forwarding state */
+#define   AR8216_PORT_CTRL_STATE	BITS(0, 3)
+#define   AR8216_PORT_CTRL_STATE_S	0
+
+#define   AR8216_PORT_CTRL_LEARN_LOCK	BIT(7)
+
+/* egress 802.1q mode */
+#define   AR8216_PORT_CTRL_VLAN_MODE	BITS(8, 2)
+#define   AR8216_PORT_CTRL_VLAN_MODE_S	8
+
+#define   AR8216_PORT_CTRL_IGMP_SNOOP	BIT(10)
+#define   AR8216_PORT_CTRL_HEADER	BIT(11)
+#define   AR8216_PORT_CTRL_MAC_LOOP	BIT(12)
+#define   AR8216_PORT_CTRL_SINGLE_VLAN	BIT(13)
+#define   AR8216_PORT_CTRL_LEARN	BIT(14)
+#define   AR8216_PORT_CTRL_MIRROR_TX	BIT(16)
+#define   AR8216_PORT_CTRL_MIRROR_RX	BIT(17)
+
+#define AR8216_REG_PORT_VLAN(_i)	(AR8216_PORT_OFFSET(_i) + 0x0008)
+
+#define   AR8216_PORT_VLAN_DEFAULT_ID	BITS(0, 12)
+#define   AR8216_PORT_VLAN_DEFAULT_ID_S	0
+
+#define   AR8216_PORT_VLAN_DEST_PORTS	BITS(16, 9)
+#define   AR8216_PORT_VLAN_DEST_PORTS_S	16
+
+/* bit0 added to the priority field of egress frames */
+#define   AR8216_PORT_VLAN_TX_PRIO	BIT(27)
+
+/* port default priority */
+#define   AR8216_PORT_VLAN_PRIORITY	BITS(28, 2)
+#define   AR8216_PORT_VLAN_PRIORITY_S	28
+
+/* ingress 802.1q mode */
+#define   AR8216_PORT_VLAN_MODE		BITS(30, 2)
+#define   AR8216_PORT_VLAN_MODE_S	30
+
+#define AR8216_REG_PORT_RATE(_i)	(AR8216_PORT_OFFSET(_i) + 0x000c)
+#define AR8216_REG_PORT_PRIO(_i)	(AR8216_PORT_OFFSET(_i) + 0x0010)
+
+#define AR8216_STATS_RXBROAD		0x00
+#define AR8216_STATS_RXPAUSE		0x04
+#define AR8216_STATS_RXMULTI		0x08
+#define AR8216_STATS_RXFCSERR		0x0c
+#define AR8216_STATS_RXALIGNERR		0x10
+#define AR8216_STATS_RXRUNT		0x14
+#define AR8216_STATS_RXFRAGMENT		0x18
+#define AR8216_STATS_RX64BYTE		0x1c
+#define AR8216_STATS_RX128BYTE		0x20
+#define AR8216_STATS_RX256BYTE		0x24
+#define AR8216_STATS_RX512BYTE		0x28
+#define AR8216_STATS_RX1024BYTE		0x2c
+#define AR8216_STATS_RXMAXBYTE		0x30
+#define AR8216_STATS_RXTOOLONG		0x34
+#define AR8216_STATS_RXGOODBYTE		0x38
+#define AR8216_STATS_RXBADBYTE		0x40
+#define AR8216_STATS_RXOVERFLOW		0x48
+#define AR8216_STATS_FILTERED		0x4c
+#define AR8216_STATS_TXBROAD		0x50
+#define AR8216_STATS_TXPAUSE		0x54
+#define AR8216_STATS_TXMULTI		0x58
+#define AR8216_STATS_TXUNDERRUN		0x5c
+#define AR8216_STATS_TX64BYTE		0x60
+#define AR8216_STATS_TX128BYTE		0x64
+#define AR8216_STATS_TX256BYTE		0x68
+#define AR8216_STATS_TX512BYTE		0x6c
+#define AR8216_STATS_TX1024BYTE		0x70
+#define AR8216_STATS_TXMAXBYTE		0x74
+#define AR8216_STATS_TXOVERSIZE		0x78
+#define AR8216_STATS_TXBYTE		0x7c
+#define AR8216_STATS_TXCOLLISION	0x84
+#define AR8216_STATS_TXABORTCOL		0x88
+#define AR8216_STATS_TXMULTICOL		0x8c
+#define AR8216_STATS_TXSINGLECOL	0x90
+#define AR8216_STATS_TXEXCDEFER		0x94
+#define AR8216_STATS_TXDEFER		0x98
+#define AR8216_STATS_TXLATECOL		0x9c
+
+#define AR8216_MIB_RXB_ID		14	/* RxGoodByte */
+#define AR8216_MIB_TXB_ID		29	/* TxByte */
+
+#define AR8229_REG_OPER_MODE0		0x04
+#define   AR8229_OPER_MODE0_MAC_GMII_EN	BIT(6)
+#define   AR8229_OPER_MODE0_PHY_MII_EN	BIT(10)
+
+#define AR8229_REG_OPER_MODE1		0x08
+#define   AR8229_REG_OPER_MODE1_PHY4_MII_EN	BIT(28)
+
+#define AR8229_REG_QM_CTRL		0x3c
+#define   AR8229_QM_CTRL_ARP_EN		BIT(15)
+
+#define AR8236_REG_PORT_VLAN(_i)	(AR8216_PORT_OFFSET((_i)) + 0x0008)
+#define   AR8236_PORT_VLAN_DEFAULT_ID	BITS(16, 12)
+#define   AR8236_PORT_VLAN_DEFAULT_ID_S	16
+#define   AR8236_PORT_VLAN_PRIORITY	BITS(29, 3)
+#define   AR8236_PORT_VLAN_PRIORITY_S	28
+
+#define AR8236_REG_PORT_VLAN2(_i)	(AR8216_PORT_OFFSET((_i)) + 0x000c)
+#define   AR8236_PORT_VLAN2_MEMBER	BITS(16, 7)
+#define   AR8236_PORT_VLAN2_MEMBER_S	16
+#define   AR8236_PORT_VLAN2_TX_PRIO	BIT(23)
+#define   AR8236_PORT_VLAN2_VLAN_MODE	BITS(30, 2)
+#define   AR8236_PORT_VLAN2_VLAN_MODE_S	30
+
+#define AR8236_STATS_RXBROAD		0x00
+#define AR8236_STATS_RXPAUSE		0x04
+#define AR8236_STATS_RXMULTI		0x08
+#define AR8236_STATS_RXFCSERR		0x0c
+#define AR8236_STATS_RXALIGNERR		0x10
+#define AR8236_STATS_RXRUNT		0x14
+#define AR8236_STATS_RXFRAGMENT		0x18
+#define AR8236_STATS_RX64BYTE		0x1c
+#define AR8236_STATS_RX128BYTE		0x20
+#define AR8236_STATS_RX256BYTE		0x24
+#define AR8236_STATS_RX512BYTE		0x28
+#define AR8236_STATS_RX1024BYTE		0x2c
+#define AR8236_STATS_RX1518BYTE		0x30
+#define AR8236_STATS_RXMAXBYTE		0x34
+#define AR8236_STATS_RXTOOLONG		0x38
+#define AR8236_STATS_RXGOODBYTE		0x3c
+#define AR8236_STATS_RXBADBYTE		0x44
+#define AR8236_STATS_RXOVERFLOW		0x4c
+#define AR8236_STATS_FILTERED		0x50
+#define AR8236_STATS_TXBROAD		0x54
+#define AR8236_STATS_TXPAUSE		0x58
+#define AR8236_STATS_TXMULTI		0x5c
+#define AR8236_STATS_TXUNDERRUN		0x60
+#define AR8236_STATS_TX64BYTE		0x64
+#define AR8236_STATS_TX128BYTE		0x68
+#define AR8236_STATS_TX256BYTE		0x6c
+#define AR8236_STATS_TX512BYTE		0x70
+#define AR8236_STATS_TX1024BYTE		0x74
+#define AR8236_STATS_TX1518BYTE		0x78
+#define AR8236_STATS_TXMAXBYTE		0x7c
+#define AR8236_STATS_TXOVERSIZE		0x80
+#define AR8236_STATS_TXBYTE		0x84
+#define AR8236_STATS_TXCOLLISION	0x8c
+#define AR8236_STATS_TXABORTCOL		0x90
+#define AR8236_STATS_TXMULTICOL		0x94
+#define AR8236_STATS_TXSINGLECOL	0x98
+#define AR8236_STATS_TXEXCDEFER		0x9c
+#define AR8236_STATS_TXDEFER		0xa0
+#define AR8236_STATS_TXLATECOL		0xa4
+
+#define AR8236_MIB_RXB_ID		15	/* RxGoodByte */
+#define AR8236_MIB_TXB_ID		31	/* TxByte */
+
+#define AR8316_REG_POSTRIP			0x0008
+#define   AR8316_POSTRIP_MAC0_GMII_EN		BIT(0)
+#define   AR8316_POSTRIP_MAC0_RGMII_EN		BIT(1)
+#define   AR8316_POSTRIP_PHY4_GMII_EN		BIT(2)
+#define   AR8316_POSTRIP_PHY4_RGMII_EN		BIT(3)
+#define   AR8316_POSTRIP_MAC0_MAC_MODE		BIT(4)
+#define   AR8316_POSTRIP_RTL_MODE		BIT(5)
+#define   AR8316_POSTRIP_RGMII_RXCLK_DELAY_EN	BIT(6)
+#define   AR8316_POSTRIP_RGMII_TXCLK_DELAY_EN	BIT(7)
+#define   AR8316_POSTRIP_SERDES_EN		BIT(8)
+#define   AR8316_POSTRIP_SEL_ANA_RST		BIT(9)
+#define   AR8316_POSTRIP_GATE_25M_EN		BIT(10)
+#define   AR8316_POSTRIP_SEL_CLK25M		BIT(11)
+#define   AR8316_POSTRIP_HIB_PULSE_HW		BIT(12)
+#define   AR8316_POSTRIP_DBG_MODE_I		BIT(13)
+#define   AR8316_POSTRIP_MAC5_MAC_MODE		BIT(14)
+#define   AR8316_POSTRIP_MAC5_PHY_MODE		BIT(15)
+#define   AR8316_POSTRIP_POWER_DOWN_HW		BIT(16)
+#define   AR8316_POSTRIP_LPW_STATE_EN		BIT(17)
+#define   AR8316_POSTRIP_MAN_EN			BIT(18)
+#define   AR8316_POSTRIP_PHY_PLL_ON		BIT(19)
+#define   AR8316_POSTRIP_LPW_EXIT		BIT(20)
+#define   AR8316_POSTRIP_TXDELAY_S0		BIT(21)
+#define   AR8316_POSTRIP_TXDELAY_S1		BIT(22)
+#define   AR8316_POSTRIP_RXDELAY_S0		BIT(23)
+#define   AR8316_POSTRIP_LED_OPEN_EN		BIT(24)
+#define   AR8316_POSTRIP_SPI_EN			BIT(25)
+#define   AR8316_POSTRIP_RXDELAY_S1		BIT(26)
+#define   AR8316_POSTRIP_POWER_ON_SEL		BIT(31)
+
+/* port speed */
+enum {
+        AR8216_PORT_SPEED_10M = 0,
+        AR8216_PORT_SPEED_100M = 1,
+        AR8216_PORT_SPEED_1000M = 2,
+        AR8216_PORT_SPEED_ERR = 3,
+};
+
+/* ingress 802.1q mode */
+enum {
+	AR8216_IN_PORT_ONLY = 0,
+	AR8216_IN_PORT_FALLBACK = 1,
+	AR8216_IN_VLAN_ONLY = 2,
+	AR8216_IN_SECURE = 3
+};
+
+/* egress 802.1q mode */
+enum {
+	AR8216_OUT_KEEP = 0,
+	AR8216_OUT_STRIP_VLAN = 1,
+	AR8216_OUT_ADD_VLAN = 2
+};
+
+/* port forwarding state */
+enum {
+	AR8216_PORT_STATE_DISABLED = 0,
+	AR8216_PORT_STATE_BLOCK = 1,
+	AR8216_PORT_STATE_LISTEN = 2,
+	AR8216_PORT_STATE_LEARN = 3,
+	AR8216_PORT_STATE_FORWARD = 4
+};
+
+/* mib counter type */
+enum {
+	AR8XXX_MIB_BASIC = 0,
+	AR8XXX_MIB_EXTENDED = 1
+};
+
+enum {
+	AR8XXX_VER_AR8216 = 0x01,
+	AR8XXX_VER_AR8236 = 0x03,
+	AR8XXX_VER_AR8316 = 0x10,
+	AR8XXX_VER_AR8327 = 0x12,
+	AR8XXX_VER_AR8337 = 0x13,
+};
+
+#define AR8XXX_NUM_ARL_RECORDS	100
+
+enum arl_op {
+	AR8XXX_ARL_INITIALIZE,
+	AR8XXX_ARL_GET_NEXT
+};
+
+struct arl_entry {
+	u16 portmap;
+	u8 mac[6];
+};
+
+struct ar8xxx_priv;
+
+struct ar8xxx_mib_desc {
+	unsigned int size;
+	unsigned int offset;
+	const char *name;
+	u8 type;
+};
+
+struct ar8xxx_chip {
+	unsigned long caps;
+	bool config_at_probe;
+	bool mii_lo_first;
+
+	/* parameters to calculate REG_PORT_STATS_BASE */
+	unsigned reg_port_stats_start;
+	unsigned reg_port_stats_length;
+
+	unsigned reg_arl_ctrl;
+
+	int (*hw_init)(struct ar8xxx_priv *priv);
+	void (*cleanup)(struct ar8xxx_priv *priv);
+
+	const char *name;
+	int vlans;
+	int ports;
+	const struct switch_dev_ops *swops;
+
+	void (*init_globals)(struct ar8xxx_priv *priv);
+	void (*init_port)(struct ar8xxx_priv *priv, int port);
+	void (*setup_port)(struct ar8xxx_priv *priv, int port, u32 members);
+	u32 (*read_port_status)(struct ar8xxx_priv *priv, int port);
+	u32 (*read_port_eee_status)(struct ar8xxx_priv *priv, int port);
+	int (*atu_flush)(struct ar8xxx_priv *priv);
+	int (*atu_flush_port)(struct ar8xxx_priv *priv, int port);
+	void (*vtu_flush)(struct ar8xxx_priv *priv);
+	void (*vtu_load_vlan)(struct ar8xxx_priv *priv, u32 vid, u32 port_mask);
+	void (*phy_fixup)(struct ar8xxx_priv *priv, int phy);
+	void (*set_mirror_regs)(struct ar8xxx_priv *priv);
+	void (*get_arl_entry)(struct ar8xxx_priv *priv, struct arl_entry *a,
+			      u32 *status, enum arl_op op);
+	int (*sw_hw_apply)(struct switch_dev *dev);
+	void (*phy_rgmii_set)(struct ar8xxx_priv *priv, struct phy_device *phydev);
+	int (*phy_read)(struct ar8xxx_priv *priv, int addr, int regnum);
+	int (*phy_write)(struct ar8xxx_priv *priv, int addr, int regnum, u16 val);
+
+	const struct ar8xxx_mib_desc *mib_decs;
+	unsigned num_mibs;
+	unsigned mib_func;
+	int mib_rxb_id;
+	int mib_txb_id;
+};
+
+struct ar8xxx_priv {
+	struct switch_dev dev;
+	struct mii_bus *mii_bus;
+	struct mii_bus *sw_mii_bus;
+	struct phy_device *phy;
+	struct device *pdev;
+
+	int (*get_port_link)(unsigned port);
+
+	const struct net_device_ops *ndo_old;
+	struct net_device_ops ndo;
+	struct mutex reg_mutex;
+	u8 chip_ver;
+	u8 chip_rev;
+	const struct ar8xxx_chip *chip;
+	void *chip_data;
+	bool initialized;
+	bool port4_phy;
+	char buf[2048];
+	struct arl_entry arl_table[AR8XXX_NUM_ARL_RECORDS];
+	char arl_buf[AR8XXX_NUM_ARL_RECORDS * 32 + 256];
+	bool link_up[AR8X16_MAX_PORTS];
+
+	bool init;
+
+	struct mutex mib_lock;
+	struct delayed_work mib_work;
+	u64 *mib_stats;
+	u32 mib_poll_interval;
+	u8 mib_type;
+
+	struct list_head list;
+	unsigned int use_count;
+
+	/* all fields below are cleared on reset */
+	struct_group(ar8xxx_priv_volatile,
+		bool vlan;
+
+		u16 vlan_id[AR8XXX_MAX_VLANS];
+		u8 vlan_table[AR8XXX_MAX_VLANS];
+		u8 vlan_tagged;
+		u16 pvid[AR8X16_MAX_PORTS];
+		int arl_age_time;
+
+		/* mirroring */
+		bool mirror_rx;
+		bool mirror_tx;
+		int source_port;
+		int monitor_port;
+		u8 port_vlan_prio[AR8X16_MAX_PORTS];
+	);
+};
+
+u32
+ar8xxx_mii_read32(struct ar8xxx_priv *priv, int phy_id, int regnum);
+void
+ar8xxx_mii_write32(struct ar8xxx_priv *priv, int phy_id, int regnum, u32 val);
+u32
+ar8xxx_read(struct ar8xxx_priv *priv, int reg);
+void
+ar8xxx_write(struct ar8xxx_priv *priv, int reg, u32 val);
+u32
+ar8xxx_rmw(struct ar8xxx_priv *priv, int reg, u32 mask, u32 val);
+
+void
+ar8xxx_phy_dbg_read(struct ar8xxx_priv *priv, int phy_addr,
+		u16 dbg_addr, u16 *dbg_data);
+void
+ar8xxx_phy_dbg_write(struct ar8xxx_priv *priv, int phy_addr,
+		     u16 dbg_addr, u16 dbg_data);
+void
+ar8xxx_phy_mmd_write(struct ar8xxx_priv *priv, int phy_addr, u16 addr, u16 reg, u16 data);
+u16
+ar8xxx_phy_mmd_read(struct ar8xxx_priv *priv, int phy_addr, u16 addr, u16 reg);
+void
+ar8xxx_phy_init(struct ar8xxx_priv *priv);
+int
+ar8xxx_sw_set_vlan(struct switch_dev *dev, const struct switch_attr *attr,
+		   struct switch_val *val);
+int
+ar8xxx_sw_get_vlan(struct switch_dev *dev, const struct switch_attr *attr,
+		   struct switch_val *val);
+int
+ar8xxx_sw_set_reset_mibs(struct switch_dev *dev,
+			 const struct switch_attr *attr,
+			 struct switch_val *val);
+int
+ar8xxx_sw_set_mib_poll_interval(struct switch_dev *dev,
+			       const struct switch_attr *attr,
+			       struct switch_val *val);
+int
+ar8xxx_sw_get_mib_poll_interval(struct switch_dev *dev,
+			       const struct switch_attr *attr,
+			       struct switch_val *val);
+int
+ar8xxx_sw_set_mib_type(struct switch_dev *dev,
+			       const struct switch_attr *attr,
+			       struct switch_val *val);
+int
+ar8xxx_sw_get_mib_type(struct switch_dev *dev,
+			       const struct switch_attr *attr,
+			       struct switch_val *val);
+int
+ar8xxx_sw_set_mirror_rx_enable(struct switch_dev *dev,
+			       const struct switch_attr *attr,
+			       struct switch_val *val);
+int
+ar8xxx_sw_get_mirror_rx_enable(struct switch_dev *dev,
+			       const struct switch_attr *attr,
+			       struct switch_val *val);
+int
+ar8xxx_sw_set_mirror_tx_enable(struct switch_dev *dev,
+			       const struct switch_attr *attr,
+			       struct switch_val *val);
+int
+ar8xxx_sw_get_mirror_tx_enable(struct switch_dev *dev,
+			       const struct switch_attr *attr,
+			       struct switch_val *val);
+int
+ar8xxx_sw_set_mirror_monitor_port(struct switch_dev *dev,
+				  const struct switch_attr *attr,
+				  struct switch_val *val);
+int
+ar8xxx_sw_get_mirror_monitor_port(struct switch_dev *dev,
+				  const struct switch_attr *attr,
+				  struct switch_val *val);
+int
+ar8xxx_sw_set_mirror_source_port(struct switch_dev *dev,
+				 const struct switch_attr *attr,
+				 struct switch_val *val);
+int
+ar8xxx_sw_get_mirror_source_port(struct switch_dev *dev,
+				 const struct switch_attr *attr,
+				 struct switch_val *val);
+int
+ar8xxx_sw_set_pvid(struct switch_dev *dev, int port, int vlan);
+int
+ar8xxx_sw_get_pvid(struct switch_dev *dev, int port, int *vlan);
+int
+ar8xxx_sw_hw_apply(struct switch_dev *dev);
+int
+ar8xxx_sw_reset_switch(struct switch_dev *dev);
+int
+ar8xxx_sw_get_port_link(struct switch_dev *dev, int port,
+			struct switch_port_link *link);
+int
+ar8xxx_sw_set_port_reset_mib(struct switch_dev *dev,
+                             const struct switch_attr *attr,
+                             struct switch_val *val);
+int
+ar8xxx_sw_get_port_mib(struct switch_dev *dev,
+                       const struct switch_attr *attr,
+                       struct switch_val *val);
+int
+ar8xxx_sw_get_arl_age_time(struct switch_dev *dev,
+			   const struct switch_attr *attr,
+			   struct switch_val *val);
+int
+ar8xxx_sw_set_arl_age_time(struct switch_dev *dev,
+			   const struct switch_attr *attr,
+			   struct switch_val *val);
+int
+ar8xxx_sw_get_arl_table(struct switch_dev *dev,
+			const struct switch_attr *attr,
+			struct switch_val *val);
+int
+ar8xxx_sw_set_flush_arl_table(struct switch_dev *dev,
+			      const struct switch_attr *attr,
+			      struct switch_val *val);
+int
+ar8xxx_sw_set_flush_port_arl_table(struct switch_dev *dev,
+				   const struct switch_attr *attr,
+				   struct switch_val *val);
+int
+ar8xxx_sw_get_port_stats(struct switch_dev *dev, int port,
+			struct switch_port_stats *stats);
+int
+ar8216_wait_bit(struct ar8xxx_priv *priv, int reg, u32 mask, u32 val);
+
+static inline struct ar8xxx_priv *
+swdev_to_ar8xxx(struct switch_dev *swdev)
+{
+	return container_of(swdev, struct ar8xxx_priv, dev);
+}
+
+static inline bool ar8xxx_has_gige(struct ar8xxx_priv *priv)
+{
+	return priv->chip->caps & AR8XXX_CAP_GIGE;
+}
+
+static inline bool ar8xxx_has_mib_counters(struct ar8xxx_priv *priv)
+{
+	return priv->chip->caps & AR8XXX_CAP_MIB_COUNTERS;
+}
+
+static inline bool chip_is_ar8216(struct ar8xxx_priv *priv)
+{
+	return priv->chip_ver == AR8XXX_VER_AR8216;
+}
+
+static inline bool chip_is_ar8236(struct ar8xxx_priv *priv)
+{
+	return priv->chip_ver == AR8XXX_VER_AR8236;
+}
+
+static inline bool chip_is_ar8316(struct ar8xxx_priv *priv)
+{
+	return priv->chip_ver == AR8XXX_VER_AR8316;
+}
+
+static inline bool chip_is_ar8327(struct ar8xxx_priv *priv)
+{
+	return priv->chip_ver == AR8XXX_VER_AR8327;
+}
+
+static inline bool chip_is_ar8337(struct ar8xxx_priv *priv)
+{
+	return priv->chip_ver == AR8XXX_VER_AR8337;
+}
+
+static inline void
+ar8xxx_reg_set(struct ar8xxx_priv *priv, int reg, u32 val)
+{
+	ar8xxx_rmw(priv, reg, 0, val);
+}
+
+static inline void
+ar8xxx_reg_clear(struct ar8xxx_priv *priv, int reg, u32 val)
+{
+	ar8xxx_rmw(priv, reg, val, 0);
+}
+
+static inline void
+split_addr(u32 regaddr, u16 *r1, u16 *r2, u16 *page)
+{
+	regaddr >>= 1;
+	*r1 = regaddr & 0x1e;
+
+	regaddr >>= 5;
+	*r2 = regaddr & 0x7;
+
+	regaddr >>= 3;
+	*page = regaddr & 0x1ff;
+}
+
+static inline void
+wait_for_page_switch(void)
+{
+	udelay(5);
+}
+
+#endif
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/ar8327.c b/6.12/target/linux/generic/files/drivers/net/phy/ar8327.c
new file mode 100644
index 00000000..7bcc317e
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/ar8327.c
@@ -0,0 +1,1551 @@
+/*
+ * ar8327.c: AR8216 switch driver
+ *
+ * Copyright (C) 2009 Felix Fietkau <nbd@nbd.name>
+ * Copyright (C) 2011-2012 Gabor Juhos <juhosg@openwrt.org>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/of.h>
+#include <linux/list.h>
+#include <linux/bitops.h>
+#include <linux/switch.h>
+#include <linux/delay.h>
+#include <linux/phy.h>
+#include <linux/lockdep.h>
+#include <linux/ar8216_platform.h>
+#include <linux/workqueue.h>
+#include <linux/of_device.h>
+#include <linux/leds.h>
+#include <linux/mdio.h>
+
+#include "ar8216.h"
+#include "ar8327.h"
+
+extern const struct ar8xxx_mib_desc ar8236_mibs[39];
+extern const struct switch_attr ar8xxx_sw_attr_vlan[1];
+
+static u32
+ar8327_get_pad_cfg(struct ar8327_pad_cfg *cfg)
+{
+	u32 t;
+
+	if (!cfg)
+		return 0;
+
+	t = 0;
+	switch (cfg->mode) {
+	case AR8327_PAD_NC:
+		break;
+
+	case AR8327_PAD_MAC2MAC_MII:
+		t = AR8327_PAD_MAC_MII_EN;
+		if (cfg->rxclk_sel)
+			t |= AR8327_PAD_MAC_MII_RXCLK_SEL;
+		if (cfg->txclk_sel)
+			t |= AR8327_PAD_MAC_MII_TXCLK_SEL;
+		break;
+
+	case AR8327_PAD_MAC2MAC_GMII:
+		t = AR8327_PAD_MAC_GMII_EN;
+		if (cfg->rxclk_sel)
+			t |= AR8327_PAD_MAC_GMII_RXCLK_SEL;
+		if (cfg->txclk_sel)
+			t |= AR8327_PAD_MAC_GMII_TXCLK_SEL;
+		break;
+
+	case AR8327_PAD_MAC_SGMII:
+		t = AR8327_PAD_SGMII_EN;
+
+		/*
+		 * WAR for the QUalcomm Atheros AP136 board.
+		 * It seems that RGMII TX/RX delay settings needs to be
+		 * applied for SGMII mode as well, The ethernet is not
+		 * reliable without this.
+		 */
+		t |= cfg->txclk_delay_sel << AR8327_PAD_RGMII_TXCLK_DELAY_SEL_S;
+		t |= cfg->rxclk_delay_sel << AR8327_PAD_RGMII_RXCLK_DELAY_SEL_S;
+		if (cfg->rxclk_delay_en)
+			t |= AR8327_PAD_RGMII_RXCLK_DELAY_EN;
+		if (cfg->txclk_delay_en)
+			t |= AR8327_PAD_RGMII_TXCLK_DELAY_EN;
+
+		if (cfg->sgmii_delay_en)
+			t |= AR8327_PAD_SGMII_DELAY_EN;
+
+		break;
+
+	case AR8327_PAD_MAC2PHY_MII:
+		t = AR8327_PAD_PHY_MII_EN;
+		if (cfg->rxclk_sel)
+			t |= AR8327_PAD_PHY_MII_RXCLK_SEL;
+		if (cfg->txclk_sel)
+			t |= AR8327_PAD_PHY_MII_TXCLK_SEL;
+		break;
+
+	case AR8327_PAD_MAC2PHY_GMII:
+		t = AR8327_PAD_PHY_GMII_EN;
+		if (cfg->pipe_rxclk_sel)
+			t |= AR8327_PAD_PHY_GMII_PIPE_RXCLK_SEL;
+		if (cfg->rxclk_sel)
+			t |= AR8327_PAD_PHY_GMII_RXCLK_SEL;
+		if (cfg->txclk_sel)
+			t |= AR8327_PAD_PHY_GMII_TXCLK_SEL;
+		break;
+
+	case AR8327_PAD_MAC_RGMII:
+		t = AR8327_PAD_RGMII_EN;
+		t |= cfg->txclk_delay_sel << AR8327_PAD_RGMII_TXCLK_DELAY_SEL_S;
+		t |= cfg->rxclk_delay_sel << AR8327_PAD_RGMII_RXCLK_DELAY_SEL_S;
+		if (cfg->rxclk_delay_en)
+			t |= AR8327_PAD_RGMII_RXCLK_DELAY_EN;
+		if (cfg->txclk_delay_en)
+			t |= AR8327_PAD_RGMII_TXCLK_DELAY_EN;
+		break;
+
+	case AR8327_PAD_PHY_GMII:
+		t = AR8327_PAD_PHYX_GMII_EN;
+		break;
+
+	case AR8327_PAD_PHY_RGMII:
+		t = AR8327_PAD_PHYX_RGMII_EN;
+		break;
+
+	case AR8327_PAD_PHY_MII:
+		t = AR8327_PAD_PHYX_MII_EN;
+		break;
+	}
+
+	return t;
+}
+
+static void
+ar8327_phy_rgmii_set(struct ar8xxx_priv *priv, struct phy_device *phydev)
+{
+	u16 phy_val = 0;
+	int phyaddr = phydev->mdio.addr;
+	struct device_node *np = phydev->mdio.dev.of_node;
+
+	if (!np)
+		return;
+
+	if (!of_property_read_bool(np, "qca,phy-rgmii-en")) {
+		pr_err("ar8327: qca,phy-rgmii-en is not specified\n");
+		return;
+	}
+	ar8xxx_phy_dbg_read(priv, phyaddr,
+				AR8327_PHY_MODE_SEL, &phy_val);
+	phy_val |= AR8327_PHY_MODE_SEL_RGMII;
+	ar8xxx_phy_dbg_write(priv, phyaddr,
+				AR8327_PHY_MODE_SEL, phy_val);
+
+	/* set rgmii tx clock delay if needed */
+	if (!of_property_read_bool(np, "qca,txclk-delay-en")) {
+		pr_err("ar8327: qca,txclk-delay-en is not specified\n");
+		return;
+	}
+	ar8xxx_phy_dbg_read(priv, phyaddr,
+				AR8327_PHY_SYS_CTRL, &phy_val);
+	phy_val |= AR8327_PHY_SYS_CTRL_RGMII_TX_DELAY;
+	ar8xxx_phy_dbg_write(priv, phyaddr,
+				AR8327_PHY_SYS_CTRL, phy_val);
+
+	/* set rgmii rx clock delay if needed */
+	if (!of_property_read_bool(np, "qca,rxclk-delay-en")) {
+		pr_err("ar8327: qca,rxclk-delay-en is not specified\n");
+		return;
+	}
+	ar8xxx_phy_dbg_read(priv, phyaddr,
+				AR8327_PHY_TEST_CTRL, &phy_val);
+	phy_val |= AR8327_PHY_TEST_CTRL_RGMII_RX_DELAY;
+	ar8xxx_phy_dbg_write(priv, phyaddr,
+				AR8327_PHY_TEST_CTRL, phy_val);
+}
+
+static void
+ar8327_phy_fixup(struct ar8xxx_priv *priv, int phy)
+{
+	switch (priv->chip_rev) {
+	case 1:
+		/* For 100M waveform */
+		ar8xxx_phy_dbg_write(priv, phy, 0, 0x02ea);
+		/* Turn on Gigabit clock */
+		ar8xxx_phy_dbg_write(priv, phy, 0x3d, 0x68a0);
+		break;
+
+	case 2:
+		ar8xxx_phy_mmd_write(priv, phy, 0x7, 0x3c, 0x0);
+		fallthrough;
+	case 4:
+		ar8xxx_phy_mmd_write(priv, phy, 0x3, 0x800d, 0x803f);
+		ar8xxx_phy_dbg_write(priv, phy, 0x3d, 0x6860);
+		ar8xxx_phy_dbg_write(priv, phy, 0x5, 0x2c46);
+		ar8xxx_phy_dbg_write(priv, phy, 0x3c, 0x6000);
+		break;
+	}
+}
+
+static u32
+ar8327_get_port_init_status(struct ar8327_port_cfg *cfg)
+{
+	u32 t;
+
+	if (!cfg->force_link)
+		return AR8216_PORT_STATUS_LINK_AUTO;
+
+	t = AR8216_PORT_STATUS_TXMAC | AR8216_PORT_STATUS_RXMAC;
+	t |= cfg->duplex ? AR8216_PORT_STATUS_DUPLEX : 0;
+	t |= cfg->rxpause ? AR8216_PORT_STATUS_RXFLOW : 0;
+	t |= cfg->txpause ? AR8216_PORT_STATUS_TXFLOW : 0;
+
+	switch (cfg->speed) {
+	case AR8327_PORT_SPEED_10:
+		t |= AR8216_PORT_SPEED_10M;
+		break;
+	case AR8327_PORT_SPEED_100:
+		t |= AR8216_PORT_SPEED_100M;
+		break;
+	case AR8327_PORT_SPEED_1000:
+		t |= AR8216_PORT_SPEED_1000M;
+		break;
+	}
+
+	return t;
+}
+
+#define AR8327_LED_ENTRY(_num, _reg, _shift) \
+	[_num] = { .reg = (_reg), .shift = (_shift) }
+
+static const struct ar8327_led_entry
+ar8327_led_map[AR8327_NUM_LEDS] = {
+	AR8327_LED_ENTRY(AR8327_LED_PHY0_0, 0, 14),
+	AR8327_LED_ENTRY(AR8327_LED_PHY0_1, 1, 14),
+	AR8327_LED_ENTRY(AR8327_LED_PHY0_2, 2, 14),
+
+	AR8327_LED_ENTRY(AR8327_LED_PHY1_0, 3, 8),
+	AR8327_LED_ENTRY(AR8327_LED_PHY1_1, 3, 10),
+	AR8327_LED_ENTRY(AR8327_LED_PHY1_2, 3, 12),
+
+	AR8327_LED_ENTRY(AR8327_LED_PHY2_0, 3, 14),
+	AR8327_LED_ENTRY(AR8327_LED_PHY2_1, 3, 16),
+	AR8327_LED_ENTRY(AR8327_LED_PHY2_2, 3, 18),
+
+	AR8327_LED_ENTRY(AR8327_LED_PHY3_0, 3, 20),
+	AR8327_LED_ENTRY(AR8327_LED_PHY3_1, 3, 22),
+	AR8327_LED_ENTRY(AR8327_LED_PHY3_2, 3, 24),
+
+	AR8327_LED_ENTRY(AR8327_LED_PHY4_0, 0, 30),
+	AR8327_LED_ENTRY(AR8327_LED_PHY4_1, 1, 30),
+	AR8327_LED_ENTRY(AR8327_LED_PHY4_2, 2, 30),
+};
+
+static void
+ar8327_set_led_pattern(struct ar8xxx_priv *priv, unsigned int led_num,
+		       enum ar8327_led_pattern pattern)
+{
+	const struct ar8327_led_entry *entry;
+
+	entry = &ar8327_led_map[led_num];
+	ar8xxx_rmw(priv, AR8327_REG_LED_CTRL(entry->reg),
+		   (3 << entry->shift), pattern << entry->shift);
+}
+
+static void
+ar8327_led_work_func(struct work_struct *work)
+{
+	struct ar8327_led *aled;
+	u8 pattern;
+
+	aled = container_of(work, struct ar8327_led, led_work);
+
+	pattern = aled->pattern;
+
+	ar8327_set_led_pattern(aled->sw_priv, aled->led_num,
+			       pattern);
+}
+
+static void
+ar8327_led_schedule_change(struct ar8327_led *aled, u8 pattern)
+{
+	if (aled->pattern == pattern)
+		return;
+
+	aled->pattern = pattern;
+	schedule_work(&aled->led_work);
+}
+
+static inline struct ar8327_led *
+led_cdev_to_ar8327_led(struct led_classdev *led_cdev)
+{
+	return container_of(led_cdev, struct ar8327_led, cdev);
+}
+
+static int
+ar8327_led_blink_set(struct led_classdev *led_cdev,
+		     unsigned long *delay_on,
+		     unsigned long *delay_off)
+{
+	struct ar8327_led *aled = led_cdev_to_ar8327_led(led_cdev);
+
+	if (*delay_on == 0 && *delay_off == 0) {
+		*delay_on = 125;
+		*delay_off = 125;
+	}
+
+	if (*delay_on != 125 || *delay_off != 125) {
+		/*
+		 * The hardware only supports blinking at 4Hz. Fall back
+		 * to software implementation in other cases.
+		 */
+		return -EINVAL;
+	}
+
+	spin_lock(&aled->lock);
+
+	aled->enable_hw_mode = false;
+	ar8327_led_schedule_change(aled, AR8327_LED_PATTERN_BLINK);
+
+	spin_unlock(&aled->lock);
+
+	return 0;
+}
+
+static void
+ar8327_led_set_brightness(struct led_classdev *led_cdev,
+			  enum led_brightness brightness)
+{
+	struct ar8327_led *aled = led_cdev_to_ar8327_led(led_cdev);
+	u8 pattern;
+	bool active;
+
+	active = (brightness != LED_OFF);
+	active ^= aled->active_low;
+
+	pattern = (active) ? AR8327_LED_PATTERN_ON :
+			     AR8327_LED_PATTERN_OFF;
+
+	spin_lock(&aled->lock);
+
+	aled->enable_hw_mode = false;
+	ar8327_led_schedule_change(aled, pattern);
+
+	spin_unlock(&aled->lock);
+}
+
+static ssize_t
+ar8327_led_enable_hw_mode_show(struct device *dev,
+			       struct device_attribute *attr,
+			       char *buf)
+{
+	struct led_classdev *led_cdev = dev_get_drvdata(dev);
+	struct ar8327_led *aled = led_cdev_to_ar8327_led(led_cdev);
+	ssize_t ret = 0;
+
+	ret += scnprintf(buf, PAGE_SIZE, "%d\n", aled->enable_hw_mode);
+
+	return ret;
+}
+
+static ssize_t
+ar8327_led_enable_hw_mode_store(struct device *dev,
+				struct device_attribute *attr,
+				const char *buf,
+				size_t size)
+{
+        struct led_classdev *led_cdev = dev_get_drvdata(dev);
+	struct ar8327_led *aled = led_cdev_to_ar8327_led(led_cdev);
+	u8 pattern;
+	u8 value;
+	int ret;
+
+	ret = kstrtou8(buf, 10, &value);
+	if (ret < 0)
+		return -EINVAL;
+
+	spin_lock(&aled->lock);
+
+	aled->enable_hw_mode = !!value;
+	if (aled->enable_hw_mode)
+		pattern = AR8327_LED_PATTERN_RULE;
+	else
+		pattern = AR8327_LED_PATTERN_OFF;
+
+	ar8327_led_schedule_change(aled, pattern);
+
+	spin_unlock(&aled->lock);
+
+	return size;
+}
+
+static DEVICE_ATTR(enable_hw_mode,  S_IRUGO | S_IWUSR,
+		   ar8327_led_enable_hw_mode_show,
+		   ar8327_led_enable_hw_mode_store);
+
+static int
+ar8327_led_register(struct ar8327_led *aled)
+{
+	int ret;
+
+	ret = led_classdev_register(NULL, &aled->cdev);
+	if (ret < 0)
+		return ret;
+
+	if (aled->mode == AR8327_LED_MODE_HW) {
+		ret = device_create_file(aled->cdev.dev,
+					 &dev_attr_enable_hw_mode);
+		if (ret)
+			goto err_unregister;
+	}
+
+	return 0;
+
+err_unregister:
+	led_classdev_unregister(&aled->cdev);
+	return ret;
+}
+
+static void
+ar8327_led_unregister(struct ar8327_led *aled)
+{
+	if (aled->mode == AR8327_LED_MODE_HW)
+		device_remove_file(aled->cdev.dev, &dev_attr_enable_hw_mode);
+
+	led_classdev_unregister(&aled->cdev);
+	cancel_work_sync(&aled->led_work);
+}
+
+static int
+ar8327_led_create(struct ar8xxx_priv *priv,
+		  const struct ar8327_led_info *led_info)
+{
+	struct ar8327_data *data = priv->chip_data;
+	struct ar8327_led *aled;
+	int ret;
+
+	if (!IS_ENABLED(CONFIG_AR8216_PHY_LEDS))
+		return 0;
+
+	if (!led_info->name)
+		return -EINVAL;
+
+	if (led_info->led_num >= AR8327_NUM_LEDS)
+		return -EINVAL;
+
+	aled = kzalloc(sizeof(*aled) + strlen(led_info->name) + 1,
+		       GFP_KERNEL);
+	if (!aled)
+		return -ENOMEM;
+
+	aled->sw_priv = priv;
+	aled->led_num = led_info->led_num;
+	aled->active_low = led_info->active_low;
+	aled->mode = led_info->mode;
+
+	if (aled->mode == AR8327_LED_MODE_HW)
+		aled->enable_hw_mode = true;
+
+	aled->name = (char *)(aled + 1);
+	strcpy(aled->name, led_info->name);
+
+	aled->cdev.name = aled->name;
+	aled->cdev.brightness_set = ar8327_led_set_brightness;
+	aled->cdev.blink_set = ar8327_led_blink_set;
+	aled->cdev.default_trigger = led_info->default_trigger;
+
+	spin_lock_init(&aled->lock);
+	mutex_init(&aled->mutex);
+	INIT_WORK(&aled->led_work, ar8327_led_work_func);
+
+	ret = ar8327_led_register(aled);
+	if (ret)
+		goto err_free;
+
+	data->leds[data->num_leds++] = aled;
+
+	return 0;
+
+err_free:
+	kfree(aled);
+	return ret;
+}
+
+static void
+ar8327_led_destroy(struct ar8327_led *aled)
+{
+	ar8327_led_unregister(aled);
+	kfree(aled);
+}
+
+static void
+ar8327_leds_init(struct ar8xxx_priv *priv)
+{
+	struct ar8327_data *data = priv->chip_data;
+	unsigned i;
+
+	if (!IS_ENABLED(CONFIG_AR8216_PHY_LEDS))
+		return;
+
+	for (i = 0; i < data->num_leds; i++) {
+		struct ar8327_led *aled;
+
+		aled = data->leds[i];
+
+		if (aled->enable_hw_mode)
+			aled->pattern = AR8327_LED_PATTERN_RULE;
+		else
+			aled->pattern = AR8327_LED_PATTERN_OFF;
+
+		ar8327_set_led_pattern(priv, aled->led_num, aled->pattern);
+	}
+}
+
+static void
+ar8327_leds_cleanup(struct ar8xxx_priv *priv)
+{
+	struct ar8327_data *data = priv->chip_data;
+	unsigned i;
+
+	if (!IS_ENABLED(CONFIG_AR8216_PHY_LEDS))
+		return;
+
+	for (i = 0; i < data->num_leds; i++) {
+		struct ar8327_led *aled;
+
+		aled = data->leds[i];
+		ar8327_led_destroy(aled);
+	}
+
+	kfree(data->leds);
+}
+
+static int
+ar8327_hw_config_pdata(struct ar8xxx_priv *priv,
+		       struct ar8327_platform_data *pdata)
+{
+	struct ar8327_led_cfg *led_cfg;
+	struct ar8327_data *data = priv->chip_data;
+	u32 pos, new_pos;
+	u32 t;
+
+	if (!pdata)
+		return -EINVAL;
+
+	priv->get_port_link = pdata->get_port_link;
+
+	data->port0_status = ar8327_get_port_init_status(&pdata->port0_cfg);
+	data->port6_status = ar8327_get_port_init_status(&pdata->port6_cfg);
+
+	t = ar8327_get_pad_cfg(pdata->pad0_cfg);
+	if (chip_is_ar8337(priv) && !pdata->pad0_cfg->mac06_exchange_dis)
+	    t |= AR8337_PAD_MAC06_EXCHANGE_EN;
+	ar8xxx_write(priv, AR8327_REG_PAD0_MODE, t);
+
+	t = ar8327_get_pad_cfg(pdata->pad5_cfg);
+	ar8xxx_write(priv, AR8327_REG_PAD5_MODE, t);
+	t = ar8327_get_pad_cfg(pdata->pad6_cfg);
+	ar8xxx_write(priv, AR8327_REG_PAD6_MODE, t);
+
+	pos = ar8xxx_read(priv, AR8327_REG_POWER_ON_STRAP);
+	new_pos = pos;
+
+	led_cfg = pdata->led_cfg;
+	if (led_cfg) {
+		if (led_cfg->open_drain)
+			new_pos |= AR8327_POWER_ON_STRAP_LED_OPEN_EN;
+		else
+			new_pos &= ~AR8327_POWER_ON_STRAP_LED_OPEN_EN;
+
+		ar8xxx_write(priv, AR8327_REG_LED_CTRL0, led_cfg->led_ctrl0);
+		ar8xxx_write(priv, AR8327_REG_LED_CTRL1, led_cfg->led_ctrl1);
+		ar8xxx_write(priv, AR8327_REG_LED_CTRL2, led_cfg->led_ctrl2);
+		ar8xxx_write(priv, AR8327_REG_LED_CTRL3, led_cfg->led_ctrl3);
+
+		if (new_pos != pos)
+			new_pos |= AR8327_POWER_ON_STRAP_POWER_ON_SEL;
+	}
+
+	if (pdata->sgmii_cfg) {
+		t = pdata->sgmii_cfg->sgmii_ctrl;
+		if (priv->chip_rev == 1)
+			t |= AR8327_SGMII_CTRL_EN_PLL |
+			     AR8327_SGMII_CTRL_EN_RX |
+			     AR8327_SGMII_CTRL_EN_TX;
+		else
+			t &= ~(AR8327_SGMII_CTRL_EN_PLL |
+			       AR8327_SGMII_CTRL_EN_RX |
+			       AR8327_SGMII_CTRL_EN_TX);
+
+		ar8xxx_write(priv, AR8327_REG_SGMII_CTRL, t);
+
+		if (pdata->sgmii_cfg->serdes_aen)
+			new_pos &= ~AR8327_POWER_ON_STRAP_SERDES_AEN;
+		else
+			new_pos |= AR8327_POWER_ON_STRAP_SERDES_AEN;
+	}
+
+	ar8xxx_write(priv, AR8327_REG_POWER_ON_STRAP, new_pos);
+
+	if (pdata->leds && pdata->num_leds) {
+		int i;
+
+		data->leds = kzalloc(pdata->num_leds * sizeof(void *),
+				     GFP_KERNEL);
+		if (!data->leds)
+			return -ENOMEM;
+
+		for (i = 0; i < pdata->num_leds; i++)
+			ar8327_led_create(priv, &pdata->leds[i]);
+	}
+
+	return 0;
+}
+
+#ifdef CONFIG_OF
+static int
+ar8327_hw_config_of(struct ar8xxx_priv *priv, struct device_node *np)
+{
+	struct ar8327_data *data = priv->chip_data;
+	const __be32 *paddr;
+	int len;
+	int i;
+
+	paddr = of_get_property(np, "qca,ar8327-initvals", &len);
+	if (!paddr || len < (2 * sizeof(*paddr)))
+		return -EINVAL;
+
+	len /= sizeof(*paddr);
+
+	for (i = 0; i < len - 1; i += 2) {
+		u32 reg;
+		u32 val;
+
+		reg = be32_to_cpup(paddr + i);
+		val = be32_to_cpup(paddr + i + 1);
+
+		switch (reg) {
+		case AR8327_REG_PORT_STATUS(0):
+			data->port0_status = val;
+			break;
+		case AR8327_REG_PORT_STATUS(6):
+			data->port6_status = val;
+			break;
+		default:
+			ar8xxx_write(priv, reg, val);
+			break;
+		}
+	}
+
+	return 0;
+}
+#else
+static inline int
+ar8327_hw_config_of(struct ar8xxx_priv *priv, struct device_node *np)
+{
+	return -EINVAL;
+}
+#endif
+
+static int
+ar8327_hw_init(struct ar8xxx_priv *priv)
+{
+	int ret;
+
+	priv->chip_data = kzalloc(sizeof(struct ar8327_data), GFP_KERNEL);
+	if (!priv->chip_data)
+		return -ENOMEM;
+
+	if (priv->pdev->of_node)
+		ret = ar8327_hw_config_of(priv, priv->pdev->of_node);
+	else
+		ret = ar8327_hw_config_pdata(priv,
+					     priv->phy->mdio.dev.platform_data);
+
+	if (ret)
+		return ret;
+
+	ar8327_leds_init(priv);
+
+	ar8xxx_phy_init(priv);
+
+	return 0;
+}
+
+static void
+ar8327_cleanup(struct ar8xxx_priv *priv)
+{
+	ar8327_leds_cleanup(priv);
+}
+
+static void
+ar8327_init_globals(struct ar8xxx_priv *priv)
+{
+	struct ar8327_data *data = priv->chip_data;
+	u32 t;
+	int i;
+
+	/* enable CPU port and disable mirror port */
+	t = AR8327_FWD_CTRL0_CPU_PORT_EN |
+	    AR8327_FWD_CTRL0_MIRROR_PORT;
+	ar8xxx_write(priv, AR8327_REG_FWD_CTRL0, t);
+
+	/* forward multicast and broadcast frames to CPU */
+	t = (AR8327_PORTS_ALL << AR8327_FWD_CTRL1_UC_FLOOD_S) |
+	    (AR8327_PORTS_ALL << AR8327_FWD_CTRL1_MC_FLOOD_S) |
+	    (AR8327_PORTS_ALL << AR8327_FWD_CTRL1_BC_FLOOD_S);
+	ar8xxx_write(priv, AR8327_REG_FWD_CTRL1, t);
+
+	/* enable jumbo frames */
+	ar8xxx_rmw(priv, AR8327_REG_MAX_FRAME_SIZE,
+		   AR8327_MAX_FRAME_SIZE_MTU, 9018 + 8 + 2);
+
+	/* Enable MIB counters */
+	ar8xxx_reg_set(priv, AR8327_REG_MODULE_EN,
+		       AR8327_MODULE_EN_MIB);
+
+	/* Disable EEE on all phy's due to stability issues */
+	for (i = 0; i < AR8XXX_NUM_PHYS; i++)
+		data->eee[i] = false;
+}
+
+static void
+ar8327_init_port(struct ar8xxx_priv *priv, int port)
+{
+	struct ar8327_data *data = priv->chip_data;
+	u32 t;
+
+	if (port == AR8216_PORT_CPU)
+		t = data->port0_status;
+	else if (port == 6)
+		t = data->port6_status;
+	else
+		t = AR8216_PORT_STATUS_LINK_AUTO;
+
+	if (port != AR8216_PORT_CPU && port != 6) {
+		/*hw limitation:if configure mac when there is traffic,
+		port MAC may work abnormal. Need disable lan&wan mac at fisrt*/
+		ar8xxx_write(priv, AR8327_REG_PORT_STATUS(port), 0);
+		msleep(100);
+		t |= AR8216_PORT_STATUS_FLOW_CONTROL;
+		ar8xxx_write(priv, AR8327_REG_PORT_STATUS(port), t);
+	} else {
+		ar8xxx_write(priv, AR8327_REG_PORT_STATUS(port), t);
+	}
+
+	ar8xxx_write(priv, AR8327_REG_PORT_HEADER(port), 0);
+
+	ar8xxx_write(priv, AR8327_REG_PORT_VLAN0(port), 0);
+
+	t = AR8327_PORT_VLAN1_OUT_MODE_UNTOUCH << AR8327_PORT_VLAN1_OUT_MODE_S;
+	ar8xxx_write(priv, AR8327_REG_PORT_VLAN1(port), t);
+
+	t = AR8327_PORT_LOOKUP_LEARN;
+	t |= AR8216_PORT_STATE_FORWARD << AR8327_PORT_LOOKUP_STATE_S;
+	ar8xxx_write(priv, AR8327_REG_PORT_LOOKUP(port), t);
+}
+
+static u32
+ar8327_read_port_status(struct ar8xxx_priv *priv, int port)
+{
+	u32 t;
+
+	t = ar8xxx_read(priv, AR8327_REG_PORT_STATUS(port));
+	/* map the flow control autoneg result bits to the flow control bits
+	 * used in forced mode to allow ar8216_read_port_link detect
+	 * flow control properly if autoneg is used
+	 */
+	if (t & AR8216_PORT_STATUS_LINK_UP &&
+	    t & AR8216_PORT_STATUS_LINK_AUTO) {
+		t &= ~(AR8216_PORT_STATUS_TXFLOW | AR8216_PORT_STATUS_RXFLOW);
+		if (t & AR8327_PORT_STATUS_TXFLOW_AUTO)
+			t |= AR8216_PORT_STATUS_TXFLOW;
+		if (t & AR8327_PORT_STATUS_RXFLOW_AUTO)
+			t |= AR8216_PORT_STATUS_RXFLOW;
+	}
+
+	return t;
+}
+
+static u32
+ar8327_read_port_eee_status(struct ar8xxx_priv *priv, int port)
+{
+	int phy;
+	u16 t;
+
+	if (port >= priv->dev.ports)
+		return 0;
+
+	if (port == 0 || port == 6)
+		return 0;
+
+	phy = port - 1;
+
+	/* EEE Ability Auto-negotiation Result */
+	t = ar8xxx_phy_mmd_read(priv, phy, 0x7, 0x8000);
+
+	return mmd_eee_adv_to_ethtool_adv_t(t);
+}
+
+static int
+ar8327_atu_flush(struct ar8xxx_priv *priv)
+{
+	int ret;
+
+	ret = ar8216_wait_bit(priv, AR8327_REG_ATU_FUNC,
+			      AR8327_ATU_FUNC_BUSY, 0);
+	if (!ret)
+		ar8xxx_write(priv, AR8327_REG_ATU_FUNC,
+			     AR8327_ATU_FUNC_OP_FLUSH |
+			     AR8327_ATU_FUNC_BUSY);
+
+	return ret;
+}
+
+static int
+ar8327_atu_flush_port(struct ar8xxx_priv *priv, int port)
+{
+	u32 t;
+	int ret;
+
+	ret = ar8216_wait_bit(priv, AR8327_REG_ATU_FUNC,
+			      AR8327_ATU_FUNC_BUSY, 0);
+	if (!ret) {
+		t = (port << AR8327_ATU_PORT_NUM_S);
+		t |= AR8327_ATU_FUNC_OP_FLUSH_PORT;
+		t |= AR8327_ATU_FUNC_BUSY;
+		ar8xxx_write(priv, AR8327_REG_ATU_FUNC, t);
+	}
+
+	return ret;
+}
+
+static int
+ar8327_get_port_igmp(struct ar8xxx_priv *priv, int port)
+{
+	u32 fwd_ctrl, frame_ack;
+
+	fwd_ctrl = (BIT(port) << AR8327_FWD_CTRL1_IGMP_S);
+	frame_ack = ((AR8327_FRAME_ACK_CTRL_IGMP_MLD |
+		      AR8327_FRAME_ACK_CTRL_IGMP_JOIN |
+		      AR8327_FRAME_ACK_CTRL_IGMP_LEAVE) <<
+		     AR8327_FRAME_ACK_CTRL_S(port));
+
+	return (ar8xxx_read(priv, AR8327_REG_FWD_CTRL1) &
+			fwd_ctrl) == fwd_ctrl &&
+		(ar8xxx_read(priv, AR8327_REG_FRAME_ACK_CTRL(port)) &
+			frame_ack) == frame_ack;
+}
+
+static void
+ar8327_set_port_igmp(struct ar8xxx_priv *priv, int port, int enable)
+{
+	int reg_frame_ack = AR8327_REG_FRAME_ACK_CTRL(port);
+	u32 val_frame_ack = (AR8327_FRAME_ACK_CTRL_IGMP_MLD |
+			  AR8327_FRAME_ACK_CTRL_IGMP_JOIN |
+			  AR8327_FRAME_ACK_CTRL_IGMP_LEAVE) <<
+			 AR8327_FRAME_ACK_CTRL_S(port);
+
+	if (enable) {
+		ar8xxx_rmw(priv, AR8327_REG_FWD_CTRL1,
+			   BIT(port) << AR8327_FWD_CTRL1_MC_FLOOD_S,
+			   BIT(port) << AR8327_FWD_CTRL1_IGMP_S);
+		ar8xxx_reg_set(priv, reg_frame_ack, val_frame_ack);
+	} else {
+		ar8xxx_rmw(priv, AR8327_REG_FWD_CTRL1,
+			   BIT(port) << AR8327_FWD_CTRL1_IGMP_S,
+			   BIT(port) << AR8327_FWD_CTRL1_MC_FLOOD_S);
+		ar8xxx_reg_clear(priv, reg_frame_ack, val_frame_ack);
+	}
+}
+
+static void
+ar8327_vtu_op(struct ar8xxx_priv *priv, u32 op, u32 val)
+{
+	if (ar8216_wait_bit(priv, AR8327_REG_VTU_FUNC1,
+			    AR8327_VTU_FUNC1_BUSY, 0))
+		return;
+
+	if ((op & AR8327_VTU_FUNC1_OP) == AR8327_VTU_FUNC1_OP_LOAD)
+		ar8xxx_write(priv, AR8327_REG_VTU_FUNC0, val);
+
+	op |= AR8327_VTU_FUNC1_BUSY;
+	ar8xxx_write(priv, AR8327_REG_VTU_FUNC1, op);
+}
+
+static void
+ar8327_vtu_flush(struct ar8xxx_priv *priv)
+{
+	ar8327_vtu_op(priv, AR8327_VTU_FUNC1_OP_FLUSH, 0);
+}
+
+static void
+ar8327_vtu_load_vlan(struct ar8xxx_priv *priv, u32 vid, u32 port_mask)
+{
+	u32 op;
+	u32 val;
+	int i;
+
+	op = AR8327_VTU_FUNC1_OP_LOAD | (vid << AR8327_VTU_FUNC1_VID_S);
+	val = AR8327_VTU_FUNC0_VALID | AR8327_VTU_FUNC0_IVL;
+	for (i = 0; i < AR8327_NUM_PORTS; i++) {
+		u32 mode;
+
+		if ((port_mask & BIT(i)) == 0)
+			mode = AR8327_VTU_FUNC0_EG_MODE_NOT;
+		else if (priv->vlan == 0)
+			mode = AR8327_VTU_FUNC0_EG_MODE_KEEP;
+		else if ((priv->vlan_tagged & BIT(i)) || (priv->vlan_id[priv->pvid[i]] != vid))
+			mode = AR8327_VTU_FUNC0_EG_MODE_TAG;
+		else
+			mode = AR8327_VTU_FUNC0_EG_MODE_UNTAG;
+
+		val |= mode << AR8327_VTU_FUNC0_EG_MODE_S(i);
+	}
+	ar8327_vtu_op(priv, op, val);
+}
+
+static void
+ar8327_setup_port(struct ar8xxx_priv *priv, int port, u32 members)
+{
+	u32 t;
+	u32 egress, ingress;
+	u32 pvid = priv->vlan_id[priv->pvid[port]];
+
+	if (priv->vlan) {
+		egress = AR8327_PORT_VLAN1_OUT_MODE_UNMOD;
+		ingress = AR8216_IN_SECURE;
+	} else {
+		egress = AR8327_PORT_VLAN1_OUT_MODE_UNTOUCH;
+		ingress = AR8216_IN_PORT_ONLY;
+	}
+
+	t = pvid << AR8327_PORT_VLAN0_DEF_SVID_S;
+	t |= pvid << AR8327_PORT_VLAN0_DEF_CVID_S;
+	if (priv->vlan && priv->port_vlan_prio[port]) {
+		u32 prio = priv->port_vlan_prio[port];
+
+		t |= prio << AR8327_PORT_VLAN0_DEF_SPRI_S;
+		t |= prio << AR8327_PORT_VLAN0_DEF_CPRI_S;
+	}
+	ar8xxx_write(priv, AR8327_REG_PORT_VLAN0(port), t);
+
+	t = AR8327_PORT_VLAN1_PORT_VLAN_PROP;
+	t |= egress << AR8327_PORT_VLAN1_OUT_MODE_S;
+	if (priv->vlan && priv->port_vlan_prio[port])
+		t |= AR8327_PORT_VLAN1_VLAN_PRI_PROP;
+
+	ar8xxx_write(priv, AR8327_REG_PORT_VLAN1(port), t);
+
+	t = members;
+	t |= AR8327_PORT_LOOKUP_LEARN;
+	t |= ingress << AR8327_PORT_LOOKUP_IN_MODE_S;
+	t |= AR8216_PORT_STATE_FORWARD << AR8327_PORT_LOOKUP_STATE_S;
+	ar8xxx_write(priv, AR8327_REG_PORT_LOOKUP(port), t);
+}
+
+static int
+ar8327_sw_get_ports(struct switch_dev *dev, struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	u8 ports = priv->vlan_table[val->port_vlan];
+	int i;
+
+	val->len = 0;
+	for (i = 0; i < dev->ports; i++) {
+		struct switch_port *p;
+
+		if (!(ports & (1 << i)))
+			continue;
+
+		p = &val->value.ports[val->len++];
+		p->id = i;
+		if ((priv->vlan_tagged & (1 << i)) || (priv->pvid[i] != val->port_vlan))
+			p->flags = (1 << SWITCH_PORT_FLAG_TAGGED);
+		else
+			p->flags = 0;
+	}
+	return 0;
+}
+
+static int
+ar8327_sw_set_ports(struct switch_dev *dev, struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	u8 *vt = &priv->vlan_table[val->port_vlan];
+	int i;
+
+	*vt = 0;
+	for (i = 0; i < val->len; i++) {
+		struct switch_port *p = &val->value.ports[i];
+
+		if (p->flags & (1 << SWITCH_PORT_FLAG_TAGGED)) {
+			if (val->port_vlan == priv->pvid[p->id]) {
+				priv->vlan_tagged |= (1 << p->id);
+			}
+		} else {
+			priv->vlan_tagged &= ~(1 << p->id);
+			priv->pvid[p->id] = val->port_vlan;
+		}
+
+		*vt |= 1 << p->id;
+	}
+	return 0;
+}
+
+static void
+ar8327_set_mirror_regs(struct ar8xxx_priv *priv)
+{
+	int port;
+
+	/* reset all mirror registers */
+	ar8xxx_rmw(priv, AR8327_REG_FWD_CTRL0,
+		   AR8327_FWD_CTRL0_MIRROR_PORT,
+		   (0xF << AR8327_FWD_CTRL0_MIRROR_PORT_S));
+	for (port = 0; port < AR8327_NUM_PORTS; port++) {
+		ar8xxx_reg_clear(priv, AR8327_REG_PORT_LOOKUP(port),
+			   AR8327_PORT_LOOKUP_ING_MIRROR_EN);
+
+		ar8xxx_reg_clear(priv, AR8327_REG_PORT_HOL_CTRL1(port),
+			   AR8327_PORT_HOL_CTRL1_EG_MIRROR_EN);
+	}
+
+	/* now enable mirroring if necessary */
+	if (priv->source_port >= AR8327_NUM_PORTS ||
+	    priv->monitor_port >= AR8327_NUM_PORTS ||
+	    priv->source_port == priv->monitor_port) {
+		return;
+	}
+
+	ar8xxx_rmw(priv, AR8327_REG_FWD_CTRL0,
+		   AR8327_FWD_CTRL0_MIRROR_PORT,
+		   (priv->monitor_port << AR8327_FWD_CTRL0_MIRROR_PORT_S));
+
+	if (priv->mirror_rx)
+		ar8xxx_reg_set(priv, AR8327_REG_PORT_LOOKUP(priv->source_port),
+			   AR8327_PORT_LOOKUP_ING_MIRROR_EN);
+
+	if (priv->mirror_tx)
+		ar8xxx_reg_set(priv, AR8327_REG_PORT_HOL_CTRL1(priv->source_port),
+			   AR8327_PORT_HOL_CTRL1_EG_MIRROR_EN);
+}
+
+static int
+ar8327_sw_set_eee(struct switch_dev *dev,
+		  const struct switch_attr *attr,
+		  struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	struct ar8327_data *data = priv->chip_data;
+	int port = val->port_vlan;
+	int phy;
+
+	if (port >= dev->ports)
+		return -EINVAL;
+	if (port == 0 || port == 6)
+		return -EOPNOTSUPP;
+
+	phy = port - 1;
+
+	data->eee[phy] = !!(val->value.i);
+
+	return 0;
+}
+
+static int
+ar8327_sw_get_eee(struct switch_dev *dev,
+		  const struct switch_attr *attr,
+		  struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	const struct ar8327_data *data = priv->chip_data;
+	int port = val->port_vlan;
+	int phy;
+
+	if (port >= dev->ports)
+		return -EINVAL;
+	if (port == 0 || port == 6)
+		return -EOPNOTSUPP;
+
+	phy = port - 1;
+
+	val->value.i = data->eee[phy];
+
+	return 0;
+}
+
+static void
+ar8327_wait_atu_ready(struct ar8xxx_priv *priv, u16 r2, u16 r1)
+{
+	int timeout = 20;
+
+	while (ar8xxx_mii_read32(priv, r2, r1) & AR8327_ATU_FUNC_BUSY && --timeout) {
+		udelay(10);
+		cond_resched();
+	}
+
+	if (!timeout)
+		pr_err("ar8327: timeout waiting for atu to become ready\n");
+}
+
+static void ar8327_get_arl_entry(struct ar8xxx_priv *priv,
+				 struct arl_entry *a, u32 *status, enum arl_op op)
+{
+	struct mii_bus *bus = priv->mii_bus;
+	u16 r2, page;
+	u16 r1_data0, r1_data1, r1_data2, r1_func;
+	u32 val0, val1, val2;
+
+	split_addr(AR8327_REG_ATU_DATA0, &r1_data0, &r2, &page);
+	r2 |= 0x10;
+
+	r1_data1 = (AR8327_REG_ATU_DATA1 >> 1) & 0x1e;
+	r1_data2 = (AR8327_REG_ATU_DATA2 >> 1) & 0x1e;
+	r1_func  = (AR8327_REG_ATU_FUNC >> 1) & 0x1e;
+
+	switch (op) {
+	case AR8XXX_ARL_INITIALIZE:
+		/* all ATU registers are on the same page
+		* therefore set page only once
+		*/
+		bus->write(bus, 0x18, 0, page);
+		wait_for_page_switch();
+
+		ar8327_wait_atu_ready(priv, r2, r1_func);
+
+		ar8xxx_mii_write32(priv, r2, r1_data0, 0);
+		ar8xxx_mii_write32(priv, r2, r1_data1, 0);
+		ar8xxx_mii_write32(priv, r2, r1_data2, 0);
+		break;
+	case AR8XXX_ARL_GET_NEXT:
+		ar8xxx_mii_write32(priv, r2, r1_func,
+				   AR8327_ATU_FUNC_OP_GET_NEXT |
+				   AR8327_ATU_FUNC_BUSY);
+		ar8327_wait_atu_ready(priv, r2, r1_func);
+
+		val0 = ar8xxx_mii_read32(priv, r2, r1_data0);
+		val1 = ar8xxx_mii_read32(priv, r2, r1_data1);
+		val2 = ar8xxx_mii_read32(priv, r2, r1_data2);
+
+		*status = val2 & AR8327_ATU_STATUS;
+		if (!*status)
+			break;
+
+		a->portmap = (val1 & AR8327_ATU_PORTS) >> AR8327_ATU_PORTS_S;
+		a->mac[0] = (val0 & AR8327_ATU_ADDR0) >> AR8327_ATU_ADDR0_S;
+		a->mac[1] = (val0 & AR8327_ATU_ADDR1) >> AR8327_ATU_ADDR1_S;
+		a->mac[2] = (val0 & AR8327_ATU_ADDR2) >> AR8327_ATU_ADDR2_S;
+		a->mac[3] = (val0 & AR8327_ATU_ADDR3) >> AR8327_ATU_ADDR3_S;
+		a->mac[4] = (val1 & AR8327_ATU_ADDR4) >> AR8327_ATU_ADDR4_S;
+		a->mac[5] = (val1 & AR8327_ATU_ADDR5) >> AR8327_ATU_ADDR5_S;
+		break;
+	}
+}
+
+static int
+ar8327_sw_hw_apply(struct switch_dev *dev)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	const struct ar8327_data *data = priv->chip_data;
+	int ret, i;
+
+	ret = ar8xxx_sw_hw_apply(dev);
+	if (ret)
+		return ret;
+
+	for (i=0; i < AR8XXX_NUM_PHYS; i++) {
+		if (data->eee[i])
+			ar8xxx_reg_clear(priv, AR8327_REG_EEE_CTRL,
+			       AR8327_EEE_CTRL_DISABLE_PHY(i));
+		else
+			ar8xxx_reg_set(priv, AR8327_REG_EEE_CTRL,
+			       AR8327_EEE_CTRL_DISABLE_PHY(i));
+	}
+
+	return 0;
+}
+
+static int
+ar8327_sw_get_port_igmp_snooping(struct switch_dev *dev,
+				 const struct switch_attr *attr,
+				 struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	int port = val->port_vlan;
+
+	if (port >= dev->ports)
+		return -EINVAL;
+
+	mutex_lock(&priv->reg_mutex);
+	val->value.i = ar8327_get_port_igmp(priv, port);
+	mutex_unlock(&priv->reg_mutex);
+
+	return 0;
+}
+
+static int
+ar8327_sw_set_port_igmp_snooping(struct switch_dev *dev,
+				 const struct switch_attr *attr,
+				 struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	int port = val->port_vlan;
+
+	if (port >= dev->ports)
+		return -EINVAL;
+
+	mutex_lock(&priv->reg_mutex);
+	ar8327_set_port_igmp(priv, port, val->value.i);
+	mutex_unlock(&priv->reg_mutex);
+
+	return 0;
+}
+
+static int
+ar8327_sw_get_igmp_snooping(struct switch_dev *dev,
+			    const struct switch_attr *attr,
+			    struct switch_val *val)
+{
+	int port;
+
+	for (port = 0; port < dev->ports; port++) {
+		val->port_vlan = port;
+		if (ar8327_sw_get_port_igmp_snooping(dev, attr, val) ||
+		    !val->value.i)
+			break;
+	}
+
+	return 0;
+}
+
+static int
+ar8327_sw_set_igmp_snooping(struct switch_dev *dev,
+			    const struct switch_attr *attr,
+			    struct switch_val *val)
+{
+	int port;
+
+	for (port = 0; port < dev->ports; port++) {
+		val->port_vlan = port;
+		if (ar8327_sw_set_port_igmp_snooping(dev, attr, val))
+			break;
+	}
+
+	return 0;
+}
+
+static int
+ar8327_sw_get_igmp_v3(struct switch_dev *dev,
+		      const struct switch_attr *attr,
+		      struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	u32 val_reg;
+
+	mutex_lock(&priv->reg_mutex);
+	val_reg = ar8xxx_read(priv, AR8327_REG_FRAME_ACK_CTRL1);
+	val->value.i = ((val_reg & AR8327_FRAME_ACK_CTRL_IGMP_V3_EN) != 0);
+	mutex_unlock(&priv->reg_mutex);
+
+	return 0;
+}
+
+static int
+ar8327_sw_set_igmp_v3(struct switch_dev *dev,
+		      const struct switch_attr *attr,
+		      struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+
+	mutex_lock(&priv->reg_mutex);
+	if (val->value.i)
+		ar8xxx_reg_set(priv, AR8327_REG_FRAME_ACK_CTRL1,
+			       AR8327_FRAME_ACK_CTRL_IGMP_V3_EN);
+	else
+		ar8xxx_reg_clear(priv, AR8327_REG_FRAME_ACK_CTRL1,
+				 AR8327_FRAME_ACK_CTRL_IGMP_V3_EN);
+	mutex_unlock(&priv->reg_mutex);
+
+	return 0;
+}
+
+static int
+ar8327_sw_set_port_vlan_prio(struct switch_dev *dev, const struct switch_attr *attr,
+			     struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	int port = val->port_vlan;
+
+	if (port >= dev->ports)
+		return -EINVAL;
+	if (port == 0 || port == 6)
+		return -EOPNOTSUPP;
+	if (val->value.i < 0 || val->value.i > 7)
+		return -EINVAL;
+
+	priv->port_vlan_prio[port] = val->value.i;
+
+	return 0;
+}
+
+static int
+ar8327_sw_get_port_vlan_prio(struct switch_dev *dev, const struct switch_attr *attr,
+                  struct switch_val *val)
+{
+	struct ar8xxx_priv *priv = swdev_to_ar8xxx(dev);
+	int port = val->port_vlan;
+
+	val->value.i = priv->port_vlan_prio[port];
+
+	return 0;
+}
+
+static const struct switch_attr ar8327_sw_attr_globals[] = {
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_vlan",
+		.description = "Enable VLAN mode",
+		.set = ar8xxx_sw_set_vlan,
+		.get = ar8xxx_sw_get_vlan,
+		.max = 1
+	},
+	{
+		.type = SWITCH_TYPE_NOVAL,
+		.name = "reset_mibs",
+		.description = "Reset all MIB counters",
+		.set = ar8xxx_sw_set_reset_mibs,
+	},
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "ar8xxx_mib_poll_interval",
+		.description = "MIB polling interval in msecs (0 to disable)",
+		.set = ar8xxx_sw_set_mib_poll_interval,
+		.get = ar8xxx_sw_get_mib_poll_interval
+	},
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "ar8xxx_mib_type",
+		.description = "MIB type (0=basic 1=extended)",
+		.set = ar8xxx_sw_set_mib_type,
+		.get = ar8xxx_sw_get_mib_type
+	},
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_mirror_rx",
+		.description = "Enable mirroring of RX packets",
+		.set = ar8xxx_sw_set_mirror_rx_enable,
+		.get = ar8xxx_sw_get_mirror_rx_enable,
+		.max = 1
+	},
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_mirror_tx",
+		.description = "Enable mirroring of TX packets",
+		.set = ar8xxx_sw_set_mirror_tx_enable,
+		.get = ar8xxx_sw_get_mirror_tx_enable,
+		.max = 1
+	},
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "mirror_monitor_port",
+		.description = "Mirror monitor port",
+		.set = ar8xxx_sw_set_mirror_monitor_port,
+		.get = ar8xxx_sw_get_mirror_monitor_port,
+		.max = AR8327_NUM_PORTS - 1
+	},
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "mirror_source_port",
+		.description = "Mirror source port",
+		.set = ar8xxx_sw_set_mirror_source_port,
+		.get = ar8xxx_sw_get_mirror_source_port,
+		.max = AR8327_NUM_PORTS - 1
+	},
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "arl_age_time",
+		.description = "ARL age time (secs)",
+		.set = ar8xxx_sw_set_arl_age_time,
+		.get = ar8xxx_sw_get_arl_age_time,
+	},
+	{
+		.type = SWITCH_TYPE_STRING,
+		.name = "arl_table",
+		.description = "Get ARL table",
+		.set = NULL,
+		.get = ar8xxx_sw_get_arl_table,
+	},
+	{
+		.type = SWITCH_TYPE_NOVAL,
+		.name = "flush_arl_table",
+		.description = "Flush ARL table",
+		.set = ar8xxx_sw_set_flush_arl_table,
+	},
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "igmp_snooping",
+		.description = "Enable IGMP Snooping",
+		.set = ar8327_sw_set_igmp_snooping,
+		.get = ar8327_sw_get_igmp_snooping,
+		.max = 1
+	},
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "igmp_v3",
+		.description = "Enable IGMPv3 support",
+		.set = ar8327_sw_set_igmp_v3,
+		.get = ar8327_sw_get_igmp_v3,
+		.max = 1
+	},
+};
+
+static const struct switch_attr ar8327_sw_attr_port[] = {
+	{
+		.type = SWITCH_TYPE_NOVAL,
+		.name = "reset_mib",
+		.description = "Reset single port MIB counters",
+		.set = ar8xxx_sw_set_port_reset_mib,
+	},
+	{
+		.type = SWITCH_TYPE_STRING,
+		.name = "mib",
+		.description = "Get port's MIB counters",
+		.set = NULL,
+		.get = ar8xxx_sw_get_port_mib,
+	},
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_eee",
+		.description = "Enable EEE PHY sleep mode",
+		.set = ar8327_sw_set_eee,
+		.get = ar8327_sw_get_eee,
+		.max = 1,
+	},
+	{
+		.type = SWITCH_TYPE_NOVAL,
+		.name = "flush_arl_table",
+		.description = "Flush port's ARL table entries",
+		.set = ar8xxx_sw_set_flush_port_arl_table,
+	},
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "igmp_snooping",
+		.description = "Enable port's IGMP Snooping",
+		.set = ar8327_sw_set_port_igmp_snooping,
+		.get = ar8327_sw_get_port_igmp_snooping,
+		.max = 1
+	},
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "vlan_prio",
+		.description = "Port VLAN default priority (VLAN PCP) (0-7)",
+		.set = ar8327_sw_set_port_vlan_prio,
+		.get = ar8327_sw_get_port_vlan_prio,
+		.max = 7,
+	},
+};
+
+static const struct switch_dev_ops ar8327_sw_ops = {
+	.attr_global = {
+		.attr = ar8327_sw_attr_globals,
+		.n_attr = ARRAY_SIZE(ar8327_sw_attr_globals),
+	},
+	.attr_port = {
+		.attr = ar8327_sw_attr_port,
+		.n_attr = ARRAY_SIZE(ar8327_sw_attr_port),
+	},
+	.attr_vlan = {
+		.attr = ar8xxx_sw_attr_vlan,
+		.n_attr = ARRAY_SIZE(ar8xxx_sw_attr_vlan),
+	},
+	.get_port_pvid = ar8xxx_sw_get_pvid,
+	.set_port_pvid = ar8xxx_sw_set_pvid,
+	.get_vlan_ports = ar8327_sw_get_ports,
+	.set_vlan_ports = ar8327_sw_set_ports,
+	.apply_config = ar8327_sw_hw_apply,
+	.reset_switch = ar8xxx_sw_reset_switch,
+	.get_port_link = ar8xxx_sw_get_port_link,
+	.get_port_stats = ar8xxx_sw_get_port_stats,
+};
+
+const struct ar8xxx_chip ar8327_chip = {
+	.caps = AR8XXX_CAP_GIGE | AR8XXX_CAP_MIB_COUNTERS,
+	.config_at_probe = true,
+	.mii_lo_first = true,
+
+	.name = "Atheros AR8327",
+	.ports = AR8327_NUM_PORTS,
+	.vlans = AR83X7_MAX_VLANS,
+	.swops = &ar8327_sw_ops,
+
+	.reg_port_stats_start = 0x1000,
+	.reg_port_stats_length = 0x100,
+	.reg_arl_ctrl = AR8327_REG_ARL_CTRL,
+
+	.hw_init = ar8327_hw_init,
+	.cleanup = ar8327_cleanup,
+	.init_globals = ar8327_init_globals,
+	.init_port = ar8327_init_port,
+	.setup_port = ar8327_setup_port,
+	.read_port_status = ar8327_read_port_status,
+	.read_port_eee_status = ar8327_read_port_eee_status,
+	.atu_flush = ar8327_atu_flush,
+	.atu_flush_port = ar8327_atu_flush_port,
+	.vtu_flush = ar8327_vtu_flush,
+	.vtu_load_vlan = ar8327_vtu_load_vlan,
+	.phy_fixup = ar8327_phy_fixup,
+	.set_mirror_regs = ar8327_set_mirror_regs,
+	.get_arl_entry = ar8327_get_arl_entry,
+	.sw_hw_apply = ar8327_sw_hw_apply,
+
+	.num_mibs = ARRAY_SIZE(ar8236_mibs),
+	.mib_decs = ar8236_mibs,
+	.mib_func = AR8327_REG_MIB_FUNC,
+	.mib_rxb_id = AR8236_MIB_RXB_ID,
+	.mib_txb_id = AR8236_MIB_TXB_ID,
+};
+
+const struct ar8xxx_chip ar8337_chip = {
+	.caps = AR8XXX_CAP_GIGE | AR8XXX_CAP_MIB_COUNTERS,
+	.config_at_probe = true,
+	.mii_lo_first = true,
+
+	.name = "Atheros AR8337",
+	.ports = AR8327_NUM_PORTS,
+	.vlans = AR83X7_MAX_VLANS,
+	.swops = &ar8327_sw_ops,
+
+	.reg_port_stats_start = 0x1000,
+	.reg_port_stats_length = 0x100,
+	.reg_arl_ctrl = AR8327_REG_ARL_CTRL,
+
+	.hw_init = ar8327_hw_init,
+	.cleanup = ar8327_cleanup,
+	.init_globals = ar8327_init_globals,
+	.init_port = ar8327_init_port,
+	.setup_port = ar8327_setup_port,
+	.read_port_status = ar8327_read_port_status,
+	.read_port_eee_status = ar8327_read_port_eee_status,
+	.atu_flush = ar8327_atu_flush,
+	.atu_flush_port = ar8327_atu_flush_port,
+	.vtu_flush = ar8327_vtu_flush,
+	.vtu_load_vlan = ar8327_vtu_load_vlan,
+	.phy_fixup = ar8327_phy_fixup,
+	.set_mirror_regs = ar8327_set_mirror_regs,
+	.get_arl_entry = ar8327_get_arl_entry,
+	.sw_hw_apply = ar8327_sw_hw_apply,
+	.phy_rgmii_set = ar8327_phy_rgmii_set,
+
+	.num_mibs = ARRAY_SIZE(ar8236_mibs),
+	.mib_decs = ar8236_mibs,
+	.mib_func = AR8327_REG_MIB_FUNC,
+	.mib_rxb_id = AR8236_MIB_RXB_ID,
+	.mib_txb_id = AR8236_MIB_TXB_ID,
+};
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/ar8327.h b/6.12/target/linux/generic/files/drivers/net/phy/ar8327.h
new file mode 100644
index 00000000..088b2886
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/ar8327.h
@@ -0,0 +1,333 @@
+/*
+ * ar8327.h: AR8216 switch driver
+ *
+ * Copyright (C) 2009 Felix Fietkau <nbd@nbd.name>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#ifndef __AR8327_H
+#define __AR8327_H
+
+#define AR8327_NUM_PORTS	7
+#define AR8327_NUM_LEDS		15
+#define AR8327_PORTS_ALL	0x7f
+#define AR8327_NUM_LED_CTRL_REGS	4
+
+#define AR8327_REG_MASK				0x000
+
+#define AR8327_REG_PAD0_MODE			0x004
+#define AR8327_REG_PAD5_MODE			0x008
+#define AR8327_REG_PAD6_MODE			0x00c
+#define   AR8327_PAD_MAC_MII_RXCLK_SEL		BIT(0)
+#define   AR8327_PAD_MAC_MII_TXCLK_SEL		BIT(1)
+#define   AR8327_PAD_MAC_MII_EN			BIT(2)
+#define   AR8327_PAD_MAC_GMII_RXCLK_SEL		BIT(4)
+#define   AR8327_PAD_MAC_GMII_TXCLK_SEL		BIT(5)
+#define   AR8327_PAD_MAC_GMII_EN		BIT(6)
+#define   AR8327_PAD_SGMII_EN			BIT(7)
+#define   AR8327_PAD_PHY_MII_RXCLK_SEL		BIT(8)
+#define   AR8327_PAD_PHY_MII_TXCLK_SEL		BIT(9)
+#define   AR8327_PAD_PHY_MII_EN			BIT(10)
+#define   AR8327_PAD_PHY_GMII_PIPE_RXCLK_SEL	BIT(11)
+#define   AR8327_PAD_PHY_GMII_RXCLK_SEL		BIT(12)
+#define   AR8327_PAD_PHY_GMII_TXCLK_SEL		BIT(13)
+#define   AR8327_PAD_PHY_GMII_EN		BIT(14)
+#define   AR8327_PAD_PHYX_GMII_EN		BIT(16)
+#define   AR8327_PAD_PHYX_RGMII_EN		BIT(17)
+#define   AR8327_PAD_PHYX_MII_EN		BIT(18)
+#define   AR8327_PAD_SGMII_DELAY_EN		BIT(19)
+#define   AR8327_PAD_RGMII_RXCLK_DELAY_SEL	BITS(20, 2)
+#define   AR8327_PAD_RGMII_RXCLK_DELAY_SEL_S	20
+#define   AR8327_PAD_RGMII_TXCLK_DELAY_SEL	BITS(22, 2)
+#define   AR8327_PAD_RGMII_TXCLK_DELAY_SEL_S	22
+#define   AR8327_PAD_RGMII_RXCLK_DELAY_EN	BIT(24)
+#define   AR8327_PAD_RGMII_TXCLK_DELAY_EN	BIT(25)
+#define   AR8327_PAD_RGMII_EN			BIT(26)
+
+#define AR8327_REG_POWER_ON_STRAP		0x010
+#define   AR8327_POWER_ON_STRAP_POWER_ON_SEL	BIT(31)
+#define   AR8327_POWER_ON_STRAP_LED_OPEN_EN	BIT(24)
+#define   AR8327_POWER_ON_STRAP_SERDES_AEN	BIT(7)
+
+#define AR8327_REG_INT_STATUS0			0x020
+#define   AR8327_INT0_VT_DONE			BIT(20)
+
+#define AR8327_REG_INT_STATUS1			0x024
+#define AR8327_REG_INT_MASK0			0x028
+#define AR8327_REG_INT_MASK1			0x02c
+
+#define AR8327_REG_MODULE_EN			0x030
+#define   AR8327_MODULE_EN_MIB			BIT(0)
+
+#define AR8327_REG_MIB_FUNC			0x034
+#define   AR8327_MIB_CPU_KEEP			BIT(20)
+
+#define AR8327_REG_SERVICE_TAG			0x048
+#define AR8327_REG_LED_CTRL(_i)			(0x050 + (_i) * 4)
+#define AR8327_REG_LED_CTRL0			0x050
+#define AR8327_REG_LED_CTRL1			0x054
+#define AR8327_REG_LED_CTRL2			0x058
+#define AR8327_REG_LED_CTRL3			0x05c
+#define AR8327_REG_MAC_ADDR0			0x060
+#define AR8327_REG_MAC_ADDR1			0x064
+
+#define AR8327_REG_MAX_FRAME_SIZE		0x078
+#define   AR8327_MAX_FRAME_SIZE_MTU		BITS(0, 14)
+
+#define AR8327_REG_PORT_STATUS(_i)		(0x07c + (_i) * 4)
+#define   AR8327_PORT_STATUS_TXFLOW_AUTO	BIT(10)
+#define   AR8327_PORT_STATUS_RXFLOW_AUTO	BIT(11)
+
+#define AR8327_REG_HEADER_CTRL			0x098
+#define AR8327_REG_PORT_HEADER(_i)		(0x09c + (_i) * 4)
+
+#define AR8327_REG_SGMII_CTRL			0x0e0
+#define   AR8327_SGMII_CTRL_EN_PLL		BIT(1)
+#define   AR8327_SGMII_CTRL_EN_RX		BIT(2)
+#define   AR8327_SGMII_CTRL_EN_TX		BIT(3)
+
+#define AR8327_REG_EEE_CTRL			0x100
+#define   AR8327_EEE_CTRL_DISABLE_PHY(_i)	BIT(4 + (_i) * 2)
+
+#define AR8327_REG_FRAME_ACK_CTRL0		0x210
+#define   AR8327_FRAME_ACK_CTRL_IGMP_MLD_EN0	BIT(0)
+#define   AR8327_FRAME_ACK_CTRL_IGMP_JOIN_EN0	BIT(1)
+#define   AR8327_FRAME_ACK_CTRL_IGMP_LEAVE_EN0	BIT(2)
+#define   AR8327_FRAME_ACK_CTRL_EAPOL_EN0	BIT(3)
+#define   AR8327_FRAME_ACK_CTRL_DHCP_EN0	BIT(4)
+#define   AR8327_FRAME_ACK_CTRL_ARP_ACK_EN0	BIT(5)
+#define   AR8327_FRAME_ACK_CTRL_ARP_REQ_EN0	BIT(6)
+#define   AR8327_FRAME_ACK_CTRL_IGMP_MLD_EN1	BIT(8)
+#define   AR8327_FRAME_ACK_CTRL_IGMP_JOIN_EN1	BIT(9)
+#define   AR8327_FRAME_ACK_CTRL_IGMP_LEAVE_EN1	BIT(10)
+#define   AR8327_FRAME_ACK_CTRL_EAPOL_EN1	BIT(11)
+#define   AR8327_FRAME_ACK_CTRL_DHCP_EN1	BIT(12)
+#define   AR8327_FRAME_ACK_CTRL_ARP_ACK_EN1	BIT(13)
+#define   AR8327_FRAME_ACK_CTRL_ARP_REQ_EN1	BIT(14)
+#define   AR8327_FRAME_ACK_CTRL_IGMP_MLD_EN2	BIT(16)
+#define   AR8327_FRAME_ACK_CTRL_IGMP_JOIN_EN2	BIT(17)
+#define   AR8327_FRAME_ACK_CTRL_IGMP_LEAVE_EN2	BIT(18)
+#define   AR8327_FRAME_ACK_CTRL_EAPOL_EN2	BIT(19)
+#define   AR8327_FRAME_ACK_CTRL_DHCP_EN2	BIT(20)
+#define   AR8327_FRAME_ACK_CTRL_ARP_ACK_EN2	BIT(21)
+#define   AR8327_FRAME_ACK_CTRL_ARP_REQ_EN2	BIT(22)
+#define   AR8327_FRAME_ACK_CTRL_IGMP_MLD_EN3	BIT(24)
+#define   AR8327_FRAME_ACK_CTRL_IGMP_JOIN_EN3	BIT(25)
+#define   AR8327_FRAME_ACK_CTRL_IGMP_LEAVE_EN3	BIT(26)
+#define   AR8327_FRAME_ACK_CTRL_EAPOL_EN3	BIT(27)
+#define   AR8327_FRAME_ACK_CTRL_DHCP_EN3	BIT(28)
+#define   AR8327_FRAME_ACK_CTRL_ARP_ACK_EN3	BIT(29)
+#define   AR8327_FRAME_ACK_CTRL_ARP_REQ_EN3	BIT(30)
+
+#define AR8327_REG_FRAME_ACK_CTRL1		0x214
+#define   AR8327_FRAME_ACK_CTRL_IGMP_MLD_EN4	BIT(0)
+#define   AR8327_FRAME_ACK_CTRL_IGMP_JOIN_EN4	BIT(1)
+#define   AR8327_FRAME_ACK_CTRL_IGMP_LEAVE_EN4	BIT(2)
+#define   AR8327_FRAME_ACK_CTRL_EAPOL_EN4	BIT(3)
+#define   AR8327_FRAME_ACK_CTRL_DHCP_EN4	BIT(4)
+#define   AR8327_FRAME_ACK_CTRL_ARP_ACK_EN4	BIT(5)
+#define   AR8327_FRAME_ACK_CTRL_ARP_REQ_EN4	BIT(6)
+#define   AR8327_FRAME_ACK_CTRL_IGMP_MLD_EN5	BIT(8)
+#define   AR8327_FRAME_ACK_CTRL_IGMP_JOIN_EN5	BIT(9)
+#define   AR8327_FRAME_ACK_CTRL_IGMP_LEAVE_EN5	BIT(10)
+#define   AR8327_FRAME_ACK_CTRL_EAPOL_EN5	BIT(11)
+#define   AR8327_FRAME_ACK_CTRL_DHCP_EN5	BIT(12)
+#define   AR8327_FRAME_ACK_CTRL_ARP_ACK_EN5	BIT(13)
+#define   AR8327_FRAME_ACK_CTRL_ARP_REQ_EN5	BIT(14)
+#define   AR8327_FRAME_ACK_CTRL_IGMP_MLD_EN6	BIT(16)
+#define   AR8327_FRAME_ACK_CTRL_IGMP_JOIN_EN6	BIT(17)
+#define   AR8327_FRAME_ACK_CTRL_IGMP_LEAVE_EN6	BIT(18)
+#define   AR8327_FRAME_ACK_CTRL_EAPOL_EN6	BIT(19)
+#define   AR8327_FRAME_ACK_CTRL_DHCP_EN6	BIT(20)
+#define   AR8327_FRAME_ACK_CTRL_ARP_ACK_EN6	BIT(21)
+#define   AR8327_FRAME_ACK_CTRL_ARP_REQ_EN6	BIT(22)
+#define   AR8327_FRAME_ACK_CTRL_IGMP_V3_EN	BIT(24)
+#define   AR8327_FRAME_ACK_CTRL_PPPOE_EN	BIT(25)
+
+#define AR8327_REG_FRAME_ACK_CTRL(_i)		(0x210 + ((_i) / 4) * 0x4)
+#define   AR8327_FRAME_ACK_CTRL_IGMP_MLD	BIT(0)
+#define   AR8327_FRAME_ACK_CTRL_IGMP_JOIN	BIT(1)
+#define   AR8327_FRAME_ACK_CTRL_IGMP_LEAVE	BIT(2)
+#define   AR8327_FRAME_ACK_CTRL_EAPOL		BIT(3)
+#define   AR8327_FRAME_ACK_CTRL_DHCP		BIT(4)
+#define   AR8327_FRAME_ACK_CTRL_ARP_ACK		BIT(5)
+#define   AR8327_FRAME_ACK_CTRL_ARP_REQ		BIT(6)
+#define   AR8327_FRAME_ACK_CTRL_S(_i)		(((_i) % 4) * 8)
+
+#define AR8327_REG_PORT_VLAN0(_i)		(0x420 + (_i) * 0x8)
+#define   AR8327_PORT_VLAN0_DEF_PRI_MASK	BITS(0, 3)
+#define   AR8327_PORT_VLAN0_DEF_SVID		BITS(0, 12)
+#define   AR8327_PORT_VLAN0_DEF_SVID_S		0
+#define   AR8327_PORT_VLAN0_DEF_SPRI		BITS(13, 3)
+#define   AR8327_PORT_VLAN0_DEF_SPRI_S		13
+#define   AR8327_PORT_VLAN0_DEF_CVID		BITS(16, 12)
+#define   AR8327_PORT_VLAN0_DEF_CVID_S		16
+#define   AR8327_PORT_VLAN0_DEF_CPRI		BITS(29, 3)
+#define   AR8327_PORT_VLAN0_DEF_CPRI_S		29
+
+#define AR8327_REG_PORT_VLAN1(_i)		(0x424 + (_i) * 0x8)
+#define   AR8327_PORT_VLAN1_VLAN_PRI_PROP	BIT(4)
+#define   AR8327_PORT_VLAN1_PORT_VLAN_PROP	BIT(6)
+#define   AR8327_PORT_VLAN1_OUT_MODE		BITS(12, 2)
+#define   AR8327_PORT_VLAN1_OUT_MODE_S		12
+#define   AR8327_PORT_VLAN1_OUT_MODE_UNMOD	0
+#define   AR8327_PORT_VLAN1_OUT_MODE_UNTAG	1
+#define   AR8327_PORT_VLAN1_OUT_MODE_TAG	2
+#define   AR8327_PORT_VLAN1_OUT_MODE_UNTOUCH	3
+
+#define AR8327_REG_ATU_DATA0			0x600
+#define   AR8327_ATU_ADDR0			BITS(0, 8)
+#define   AR8327_ATU_ADDR0_S			0
+#define   AR8327_ATU_ADDR1			BITS(8, 8)
+#define   AR8327_ATU_ADDR1_S			8
+#define   AR8327_ATU_ADDR2			BITS(16, 8)
+#define   AR8327_ATU_ADDR2_S			16
+#define   AR8327_ATU_ADDR3			BITS(24, 8)
+#define   AR8327_ATU_ADDR3_S			24
+#define AR8327_REG_ATU_DATA1			0x604
+#define   AR8327_ATU_ADDR4			BITS(0, 8)
+#define   AR8327_ATU_ADDR4_S			0
+#define   AR8327_ATU_ADDR5			BITS(8, 8)
+#define   AR8327_ATU_ADDR5_S			8
+#define   AR8327_ATU_PORTS			BITS(16, 7)
+#define   AR8327_ATU_PORTS_S			16
+#define   AR8327_ATU_PORT0			BIT(16)
+#define   AR8327_ATU_PORT1			BIT(17)
+#define   AR8327_ATU_PORT2			BIT(18)
+#define   AR8327_ATU_PORT3			BIT(19)
+#define   AR8327_ATU_PORT4			BIT(20)
+#define   AR8327_ATU_PORT5			BIT(21)
+#define   AR8327_ATU_PORT6			BIT(22)
+#define AR8327_REG_ATU_DATA2			0x608
+#define   AR8327_ATU_STATUS			BITS(0, 4)
+
+#define AR8327_REG_ATU_FUNC			0x60c
+#define   AR8327_ATU_FUNC_OP			BITS(0, 4)
+#define   AR8327_ATU_FUNC_OP_NOOP		0x0
+#define   AR8327_ATU_FUNC_OP_FLUSH		0x1
+#define   AR8327_ATU_FUNC_OP_LOAD		0x2
+#define   AR8327_ATU_FUNC_OP_PURGE		0x3
+#define   AR8327_ATU_FUNC_OP_FLUSH_UNLOCKED	0x4
+#define   AR8327_ATU_FUNC_OP_FLUSH_PORT		0x5
+#define   AR8327_ATU_FUNC_OP_GET_NEXT		0x6
+#define   AR8327_ATU_FUNC_OP_SEARCH_MAC		0x7
+#define   AR8327_ATU_FUNC_OP_CHANGE_TRUNK	0x8
+#define   AR8327_ATU_PORT_NUM			BITS(8, 4)
+#define   AR8327_ATU_PORT_NUM_S			8
+#define   AR8327_ATU_FUNC_BUSY			BIT(31)
+
+#define AR8327_REG_VTU_FUNC0			0x0610
+#define   AR8327_VTU_FUNC0_EG_MODE		BITS(4, 14)
+#define   AR8327_VTU_FUNC0_EG_MODE_S(_i)	(4 + (_i) * 2)
+#define   AR8327_VTU_FUNC0_EG_MODE_KEEP		0
+#define   AR8327_VTU_FUNC0_EG_MODE_UNTAG	1
+#define   AR8327_VTU_FUNC0_EG_MODE_TAG		2
+#define   AR8327_VTU_FUNC0_EG_MODE_NOT		3
+#define   AR8327_VTU_FUNC0_IVL			BIT(19)
+#define   AR8327_VTU_FUNC0_VALID		BIT(20)
+
+#define AR8327_REG_VTU_FUNC1			0x0614
+#define   AR8327_VTU_FUNC1_OP			BITS(0, 3)
+#define   AR8327_VTU_FUNC1_OP_NOOP		0
+#define   AR8327_VTU_FUNC1_OP_FLUSH		1
+#define   AR8327_VTU_FUNC1_OP_LOAD		2
+#define   AR8327_VTU_FUNC1_OP_PURGE		3
+#define   AR8327_VTU_FUNC1_OP_REMOVE_PORT	4
+#define   AR8327_VTU_FUNC1_OP_GET_NEXT		5
+#define   AR8327_VTU_FUNC1_OP_GET_ONE		6
+#define   AR8327_VTU_FUNC1_FULL			BIT(4)
+#define   AR8327_VTU_FUNC1_PORT			BIT(8, 4)
+#define   AR8327_VTU_FUNC1_PORT_S		8
+#define   AR8327_VTU_FUNC1_VID			BIT(16, 12)
+#define   AR8327_VTU_FUNC1_VID_S		16
+#define   AR8327_VTU_FUNC1_BUSY			BIT(31)
+
+#define AR8327_REG_ARL_CTRL			0x0618
+
+#define AR8327_REG_FWD_CTRL0			0x620
+#define   AR8327_FWD_CTRL0_CPU_PORT_EN		BIT(10)
+#define   AR8327_FWD_CTRL0_MIRROR_PORT		BITS(4, 4)
+#define   AR8327_FWD_CTRL0_MIRROR_PORT_S	4
+
+#define AR8327_REG_FWD_CTRL1			0x624
+#define   AR8327_FWD_CTRL1_UC_FLOOD		BITS(0, 7)
+#define   AR8327_FWD_CTRL1_UC_FLOOD_S		0
+#define   AR8327_FWD_CTRL1_MC_FLOOD		BITS(8, 7)
+#define   AR8327_FWD_CTRL1_MC_FLOOD_S		8
+#define   AR8327_FWD_CTRL1_BC_FLOOD		BITS(16, 7)
+#define   AR8327_FWD_CTRL1_BC_FLOOD_S		16
+#define   AR8327_FWD_CTRL1_IGMP			BITS(24, 7)
+#define   AR8327_FWD_CTRL1_IGMP_S		24
+
+#define AR8327_REG_PORT_LOOKUP(_i)		(0x660 + (_i) * 0xc)
+#define   AR8327_PORT_LOOKUP_MEMBER		BITS(0, 7)
+#define   AR8327_PORT_LOOKUP_IN_MODE		BITS(8, 2)
+#define   AR8327_PORT_LOOKUP_IN_MODE_S		8
+#define   AR8327_PORT_LOOKUP_STATE		BITS(16, 3)
+#define   AR8327_PORT_LOOKUP_STATE_S		16
+#define   AR8327_PORT_LOOKUP_LEARN		BIT(20)
+#define   AR8327_PORT_LOOKUP_ING_MIRROR_EN	BIT(25)
+
+#define AR8327_REG_PORT_PRIO(_i)		(0x664 + (_i) * 0xc)
+
+#define AR8327_REG_PORT_HOL_CTRL1(_i)		(0x974 + (_i) * 0x8)
+#define   AR8327_PORT_HOL_CTRL1_EG_MIRROR_EN	BIT(16)
+
+#define AR8337_PAD_MAC06_EXCHANGE_EN		BIT(31)
+
+#define AR8327_PHY_MODE_SEL			0x12
+#define   AR8327_PHY_MODE_SEL_RGMII		BIT(3)
+#define AR8327_PHY_TEST_CTRL			0x0
+#define   AR8327_PHY_TEST_CTRL_RGMII_RX_DELAY	BIT(15)
+#define AR8327_PHY_SYS_CTRL			0x5
+#define   AR8327_PHY_SYS_CTRL_RGMII_TX_DELAY	BIT(8)
+
+enum ar8327_led_pattern {
+	AR8327_LED_PATTERN_OFF = 0,
+	AR8327_LED_PATTERN_BLINK,
+	AR8327_LED_PATTERN_ON,
+	AR8327_LED_PATTERN_RULE,
+};
+
+struct ar8327_led_entry {
+	unsigned reg;
+	unsigned shift;
+};
+
+struct ar8327_led {
+	struct led_classdev cdev;
+	struct ar8xxx_priv *sw_priv;
+
+	char *name;
+	bool active_low;
+	u8 led_num;
+	enum ar8327_led_mode mode;
+
+	struct mutex mutex;
+	spinlock_t lock;
+	struct work_struct led_work;
+	bool enable_hw_mode;
+	enum ar8327_led_pattern pattern;
+};
+
+struct ar8327_data {
+	u32 port0_status;
+	u32 port6_status;
+
+	struct ar8327_led **leds;
+	unsigned int num_leds;
+
+	/* all fields below are cleared on reset */
+	bool eee[AR8XXX_NUM_PHYS];
+};
+
+#endif
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/b53/Kconfig b/6.12/target/linux/generic/files/drivers/net/phy/b53/Kconfig
new file mode 100644
index 00000000..08287e7a
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/b53/Kconfig
@@ -0,0 +1,37 @@
+menuconfig SWCONFIG_B53
+	tristate "Broadcom bcm53xx managed switch support"
+	depends on SWCONFIG
+	help
+	  This driver adds support for Broadcom managed switch chips. It supports
+	  BCM5325E, BCM5365, BCM539x, BCM53115 and BCM53125 as well as BCM63XX
+	  integrated switches.
+
+config SWCONFIG_B53_SPI_DRIVER
+	tristate "B53 SPI connected switch driver"
+	depends on SWCONFIG_B53 && SPI
+	help
+	  Select to enable support for registering switches configured through SPI.
+
+config SWCONFIG_B53_PHY_DRIVER
+	tristate "B53 MDIO connected switch driver"
+	depends on SWCONFIG_B53
+	select SWCONFIG_B53_PHY_FIXUP
+	help
+	  Select to enable support for registering switches configured through MDIO.
+
+config SWCONFIG_B53_MMAP_DRIVER
+	tristate "B53 MMAP connected switch driver"
+	depends on SWCONFIG_B53
+	help
+	  Select to enable support for memory-mapped switches like the BCM63XX
+	  integrated switches.
+
+config SWCONFIG_B53_SRAB_DRIVER
+	tristate "B53 SRAB connected switch driver"
+	depends on SWCONFIG_B53
+	help
+	  Select to enable support for memory-mapped Switch Register Access
+	  Bridge Registers (SRAB) like it is found on the BCM53010
+
+config SWCONFIG_B53_PHY_FIXUP
+	bool
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/b53/Makefile b/6.12/target/linux/generic/files/drivers/net/phy/b53/Makefile
new file mode 100644
index 00000000..13ff3664
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/b53/Makefile
@@ -0,0 +1,10 @@
+obj-$(CONFIG_SWCONFIG_B53)		+= b53_common.o
+
+obj-$(CONFIG_SWCONFIG_B53_PHY_FIXUP)	+= b53_phy_fixup.o
+
+obj-$(CONFIG_SWCONFIG_B53_MMAP_DRIVER)	+= b53_mmap.o
+obj-$(CONFIG_SWCONFIG_B53_SRAB_DRIVER)	+= b53_srab.o
+obj-$(CONFIG_SWCONFIG_B53_PHY_DRIVER)	+= b53_mdio.o
+obj-$(CONFIG_SWCONFIG_B53_SPI_DRIVER)	+= b53_spi.o
+
+ccflags-y				+= -Werror
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/b53/b53_common.c b/6.12/target/linux/generic/files/drivers/net/phy/b53/b53_common.c
new file mode 100644
index 00000000..d5f9bfc2
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/b53/b53_common.c
@@ -0,0 +1,1724 @@
+/*
+ * B53 switch driver main logic
+ *
+ * Copyright (C) 2011-2013 Jonas Gorski <jogo@openwrt.org>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/delay.h>
+#include <linux/export.h>
+#include <linux/gpio.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/switch.h>
+#include <linux/phy.h>
+#include <linux/of.h>
+#include <linux/of_net.h>
+#include <linux/platform_data/b53.h>
+
+#include "b53_regs.h"
+#include "b53_priv.h"
+
+/* buffer size needed for displaying all MIBs with max'd values */
+#define B53_BUF_SIZE	1188
+
+struct b53_mib_desc {
+	u8 size;
+	u8 offset;
+	const char *name;
+};
+
+/* BCM5365 MIB counters */
+static const struct b53_mib_desc b53_mibs_65[] = {
+	{ 8, 0x00, "TxOctets" },
+	{ 4, 0x08, "TxDropPkts" },
+	{ 4, 0x10, "TxBroadcastPkts" },
+	{ 4, 0x14, "TxMulticastPkts" },
+	{ 4, 0x18, "TxUnicastPkts" },
+	{ 4, 0x1c, "TxCollisions" },
+	{ 4, 0x20, "TxSingleCollision" },
+	{ 4, 0x24, "TxMultipleCollision" },
+	{ 4, 0x28, "TxDeferredTransmit" },
+	{ 4, 0x2c, "TxLateCollision" },
+	{ 4, 0x30, "TxExcessiveCollision" },
+	{ 4, 0x38, "TxPausePkts" },
+	{ 8, 0x44, "RxOctets" },
+	{ 4, 0x4c, "RxUndersizePkts" },
+	{ 4, 0x50, "RxPausePkts" },
+	{ 4, 0x54, "Pkts64Octets" },
+	{ 4, 0x58, "Pkts65to127Octets" },
+	{ 4, 0x5c, "Pkts128to255Octets" },
+	{ 4, 0x60, "Pkts256to511Octets" },
+	{ 4, 0x64, "Pkts512to1023Octets" },
+	{ 4, 0x68, "Pkts1024to1522Octets" },
+	{ 4, 0x6c, "RxOversizePkts" },
+	{ 4, 0x70, "RxJabbers" },
+	{ 4, 0x74, "RxAlignmentErrors" },
+	{ 4, 0x78, "RxFCSErrors" },
+	{ 8, 0x7c, "RxGoodOctets" },
+	{ 4, 0x84, "RxDropPkts" },
+	{ 4, 0x88, "RxUnicastPkts" },
+	{ 4, 0x8c, "RxMulticastPkts" },
+	{ 4, 0x90, "RxBroadcastPkts" },
+	{ 4, 0x94, "RxSAChanges" },
+	{ 4, 0x98, "RxFragments" },
+	{ },
+};
+
+#define B63XX_MIB_TXB_ID	0	/* TxOctets */
+#define B63XX_MIB_RXB_ID	14	/* RxOctets */
+
+/* BCM63xx MIB counters */
+static const struct b53_mib_desc b53_mibs_63xx[] = {
+	{ 8, 0x00, "TxOctets" },
+	{ 4, 0x08, "TxDropPkts" },
+	{ 4, 0x0c, "TxQoSPkts" },
+	{ 4, 0x10, "TxBroadcastPkts" },
+	{ 4, 0x14, "TxMulticastPkts" },
+	{ 4, 0x18, "TxUnicastPkts" },
+	{ 4, 0x1c, "TxCollisions" },
+	{ 4, 0x20, "TxSingleCollision" },
+	{ 4, 0x24, "TxMultipleCollision" },
+	{ 4, 0x28, "TxDeferredTransmit" },
+	{ 4, 0x2c, "TxLateCollision" },
+	{ 4, 0x30, "TxExcessiveCollision" },
+	{ 4, 0x38, "TxPausePkts" },
+	{ 8, 0x3c, "TxQoSOctets" },
+	{ 8, 0x44, "RxOctets" },
+	{ 4, 0x4c, "RxUndersizePkts" },
+	{ 4, 0x50, "RxPausePkts" },
+	{ 4, 0x54, "Pkts64Octets" },
+	{ 4, 0x58, "Pkts65to127Octets" },
+	{ 4, 0x5c, "Pkts128to255Octets" },
+	{ 4, 0x60, "Pkts256to511Octets" },
+	{ 4, 0x64, "Pkts512to1023Octets" },
+	{ 4, 0x68, "Pkts1024to1522Octets" },
+	{ 4, 0x6c, "RxOversizePkts" },
+	{ 4, 0x70, "RxJabbers" },
+	{ 4, 0x74, "RxAlignmentErrors" },
+	{ 4, 0x78, "RxFCSErrors" },
+	{ 8, 0x7c, "RxGoodOctets" },
+	{ 4, 0x84, "RxDropPkts" },
+	{ 4, 0x88, "RxUnicastPkts" },
+	{ 4, 0x8c, "RxMulticastPkts" },
+	{ 4, 0x90, "RxBroadcastPkts" },
+	{ 4, 0x94, "RxSAChanges" },
+	{ 4, 0x98, "RxFragments" },
+	{ 4, 0xa0, "RxSymbolErrors" },
+	{ 4, 0xa4, "RxQoSPkts" },
+	{ 8, 0xa8, "RxQoSOctets" },
+	{ 4, 0xb0, "Pkts1523to2047Octets" },
+	{ 4, 0xb4, "Pkts2048to4095Octets" },
+	{ 4, 0xb8, "Pkts4096to8191Octets" },
+	{ 4, 0xbc, "Pkts8192to9728Octets" },
+	{ 4, 0xc0, "RxDiscarded" },
+	{ }
+};
+
+#define B53XX_MIB_TXB_ID	0	/* TxOctets */
+#define B53XX_MIB_RXB_ID	12	/* RxOctets */
+
+/* MIB counters */
+static const struct b53_mib_desc b53_mibs[] = {
+	{ 8, 0x00, "TxOctets" },
+	{ 4, 0x08, "TxDropPkts" },
+	{ 4, 0x10, "TxBroadcastPkts" },
+	{ 4, 0x14, "TxMulticastPkts" },
+	{ 4, 0x18, "TxUnicastPkts" },
+	{ 4, 0x1c, "TxCollisions" },
+	{ 4, 0x20, "TxSingleCollision" },
+	{ 4, 0x24, "TxMultipleCollision" },
+	{ 4, 0x28, "TxDeferredTransmit" },
+	{ 4, 0x2c, "TxLateCollision" },
+	{ 4, 0x30, "TxExcessiveCollision" },
+	{ 4, 0x38, "TxPausePkts" },
+	{ 8, 0x50, "RxOctets" },
+	{ 4, 0x58, "RxUndersizePkts" },
+	{ 4, 0x5c, "RxPausePkts" },
+	{ 4, 0x60, "Pkts64Octets" },
+	{ 4, 0x64, "Pkts65to127Octets" },
+	{ 4, 0x68, "Pkts128to255Octets" },
+	{ 4, 0x6c, "Pkts256to511Octets" },
+	{ 4, 0x70, "Pkts512to1023Octets" },
+	{ 4, 0x74, "Pkts1024to1522Octets" },
+	{ 4, 0x78, "RxOversizePkts" },
+	{ 4, 0x7c, "RxJabbers" },
+	{ 4, 0x80, "RxAlignmentErrors" },
+	{ 4, 0x84, "RxFCSErrors" },
+	{ 8, 0x88, "RxGoodOctets" },
+	{ 4, 0x90, "RxDropPkts" },
+	{ 4, 0x94, "RxUnicastPkts" },
+	{ 4, 0x98, "RxMulticastPkts" },
+	{ 4, 0x9c, "RxBroadcastPkts" },
+	{ 4, 0xa0, "RxSAChanges" },
+	{ 4, 0xa4, "RxFragments" },
+	{ 4, 0xa8, "RxJumboPkts" },
+	{ 4, 0xac, "RxSymbolErrors" },
+	{ 4, 0xc0, "RxDiscarded" },
+	{ }
+};
+
+static int b53_do_vlan_op(struct b53_device *dev, u8 op)
+{
+	unsigned int i;
+
+	b53_write8(dev, B53_ARLIO_PAGE, dev->vta_regs[0], VTA_START_CMD | op);
+
+	for (i = 0; i < 10; i++) {
+		u8 vta;
+
+		b53_read8(dev, B53_ARLIO_PAGE, dev->vta_regs[0], &vta);
+		if (!(vta & VTA_START_CMD))
+			return 0;
+
+		usleep_range(100, 200);
+	}
+
+	return -EIO;
+}
+
+static void b53_set_vlan_entry(struct b53_device *dev, u16 vid, u16 members,
+			       u16 untag)
+{
+	if (is5325(dev)) {
+		u32 entry = 0;
+
+		if (members) {
+			entry = ((untag & VA_UNTAG_MASK_25) << VA_UNTAG_S_25) |
+				members;
+			if (dev->core_rev >= 3)
+				entry |= VA_VALID_25_R4 | vid << VA_VID_HIGH_S;
+			else
+				entry |= VA_VALID_25;
+		}
+
+		b53_write32(dev, B53_VLAN_PAGE, B53_VLAN_WRITE_25, entry);
+		b53_write16(dev, B53_VLAN_PAGE, B53_VLAN_TABLE_ACCESS_25, vid |
+			    VTA_RW_STATE_WR | VTA_RW_OP_EN);
+	} else if (is5365(dev)) {
+		u16 entry = 0;
+
+		if (members)
+			entry = ((untag & VA_UNTAG_MASK_65) << VA_UNTAG_S_65) |
+				members | VA_VALID_65;
+
+		b53_write16(dev, B53_VLAN_PAGE, B53_VLAN_WRITE_65, entry);
+		b53_write16(dev, B53_VLAN_PAGE, B53_VLAN_TABLE_ACCESS_65, vid |
+			    VTA_RW_STATE_WR | VTA_RW_OP_EN);
+	} else {
+		b53_write16(dev, B53_ARLIO_PAGE, dev->vta_regs[1], vid);
+		b53_write32(dev, B53_ARLIO_PAGE, dev->vta_regs[2],
+			    (untag << VTE_UNTAG_S) | members);
+
+		b53_do_vlan_op(dev, VTA_CMD_WRITE);
+	}
+}
+
+void b53_set_forwarding(struct b53_device *dev, int enable)
+{
+	u8 mgmt;
+
+	b53_read8(dev, B53_CTRL_PAGE, B53_SWITCH_MODE, &mgmt);
+
+	if (enable)
+		mgmt |= SM_SW_FWD_EN;
+	else
+		mgmt &= ~SM_SW_FWD_EN;
+
+	b53_write8(dev, B53_CTRL_PAGE, B53_SWITCH_MODE, mgmt);
+}
+
+static void b53_enable_vlan(struct b53_device *dev, int enable)
+{
+	u8 mgmt, vc0, vc1, vc4 = 0, vc5;
+
+	b53_read8(dev, B53_CTRL_PAGE, B53_SWITCH_MODE, &mgmt);
+	b53_read8(dev, B53_VLAN_PAGE, B53_VLAN_CTRL0, &vc0);
+	b53_read8(dev, B53_VLAN_PAGE, B53_VLAN_CTRL1, &vc1);
+
+	if (is5325(dev) || is5365(dev)) {
+		b53_read8(dev, B53_VLAN_PAGE, B53_VLAN_CTRL4_25, &vc4);
+		b53_read8(dev, B53_VLAN_PAGE, B53_VLAN_CTRL5_25, &vc5);
+	} else if (is63xx(dev)) {
+		b53_read8(dev, B53_VLAN_PAGE, B53_VLAN_CTRL4_63XX, &vc4);
+		b53_read8(dev, B53_VLAN_PAGE, B53_VLAN_CTRL5_63XX, &vc5);
+	} else {
+		b53_read8(dev, B53_VLAN_PAGE, B53_VLAN_CTRL4, &vc4);
+		b53_read8(dev, B53_VLAN_PAGE, B53_VLAN_CTRL5, &vc5);
+	}
+
+	mgmt &= ~SM_SW_FWD_MODE;
+
+	if (enable) {
+		vc0 |= VC0_VLAN_EN | VC0_VID_CHK_EN | VC0_VID_HASH_VID;
+		vc1 |= VC1_RX_MCST_UNTAG_EN | VC1_RX_MCST_FWD_EN;
+		vc4 &= ~VC4_ING_VID_CHECK_MASK;
+		vc4 |= VC4_ING_VID_VIO_DROP << VC4_ING_VID_CHECK_S;
+		vc5 |= VC5_DROP_VTABLE_MISS;
+
+		if (is5325(dev))
+			vc0 &= ~VC0_RESERVED_1;
+
+		if (is5325(dev) || is5365(dev))
+			vc1 |= VC1_RX_MCST_TAG_EN;
+
+		if (!is5325(dev) && !is5365(dev)) {
+			if (dev->allow_vid_4095)
+				vc5 |= VC5_VID_FFF_EN;
+			else
+				vc5 &= ~VC5_VID_FFF_EN;
+		}
+	} else {
+		vc0 &= ~(VC0_VLAN_EN | VC0_VID_CHK_EN | VC0_VID_HASH_VID);
+		vc1 &= ~(VC1_RX_MCST_UNTAG_EN | VC1_RX_MCST_FWD_EN);
+		vc4 &= ~VC4_ING_VID_CHECK_MASK;
+		vc5 &= ~VC5_DROP_VTABLE_MISS;
+
+		if (is5325(dev) || is5365(dev))
+			vc4 |= VC4_ING_VID_VIO_FWD << VC4_ING_VID_CHECK_S;
+		else
+			vc4 |= VC4_ING_VID_VIO_TO_IMP << VC4_ING_VID_CHECK_S;
+
+		if (is5325(dev) || is5365(dev))
+			vc1 &= ~VC1_RX_MCST_TAG_EN;
+
+		if (!is5325(dev) && !is5365(dev))
+			vc5 &= ~VC5_VID_FFF_EN;
+	}
+
+	b53_write8(dev, B53_VLAN_PAGE, B53_VLAN_CTRL0, vc0);
+	b53_write8(dev, B53_VLAN_PAGE, B53_VLAN_CTRL1, vc1);
+
+	if (is5325(dev) || is5365(dev)) {
+		/* enable the high 8 bit vid check on 5325 */
+		if (is5325(dev) && enable)
+			b53_write8(dev, B53_VLAN_PAGE, B53_VLAN_CTRL3,
+				   VC3_HIGH_8BIT_EN);
+		else
+			b53_write8(dev, B53_VLAN_PAGE, B53_VLAN_CTRL3, 0);
+
+		b53_write8(dev, B53_VLAN_PAGE, B53_VLAN_CTRL4_25, vc4);
+		b53_write8(dev, B53_VLAN_PAGE, B53_VLAN_CTRL5_25, vc5);
+	} else if (is63xx(dev)) {
+		b53_write16(dev, B53_VLAN_PAGE, B53_VLAN_CTRL3_63XX, 0);
+		b53_write8(dev, B53_VLAN_PAGE, B53_VLAN_CTRL4_63XX, vc4);
+		b53_write8(dev, B53_VLAN_PAGE, B53_VLAN_CTRL5_63XX, vc5);
+	} else {
+		b53_write16(dev, B53_VLAN_PAGE, B53_VLAN_CTRL3, 0);
+		b53_write8(dev, B53_VLAN_PAGE, B53_VLAN_CTRL4, vc4);
+		b53_write8(dev, B53_VLAN_PAGE, B53_VLAN_CTRL5, vc5);
+	}
+
+	b53_write8(dev, B53_CTRL_PAGE, B53_SWITCH_MODE, mgmt);
+}
+
+static int b53_set_jumbo(struct b53_device *dev, int enable, int allow_10_100)
+{
+	u32 port_mask = 0;
+	u16 max_size = JMS_MIN_SIZE;
+
+	if (is5325(dev) || is5365(dev))
+		return -EINVAL;
+
+	if (enable) {
+		port_mask = dev->enabled_ports;
+		max_size = JMS_MAX_SIZE;
+		if (allow_10_100)
+			port_mask |= JPM_10_100_JUMBO_EN;
+	}
+
+	b53_write32(dev, B53_JUMBO_PAGE, dev->jumbo_pm_reg, port_mask);
+	return b53_write16(dev, B53_JUMBO_PAGE, dev->jumbo_size_reg, max_size);
+}
+
+static int b53_flush_arl(struct b53_device *dev)
+{
+	unsigned int i;
+
+	b53_write8(dev, B53_CTRL_PAGE, B53_FAST_AGE_CTRL,
+		   FAST_AGE_DONE | FAST_AGE_DYNAMIC | FAST_AGE_STATIC);
+
+	for (i = 0; i < 10; i++) {
+		u8 fast_age_ctrl;
+
+		b53_read8(dev, B53_CTRL_PAGE, B53_FAST_AGE_CTRL,
+			  &fast_age_ctrl);
+
+		if (!(fast_age_ctrl & FAST_AGE_DONE))
+			return 0;
+
+		mdelay(1);
+	}
+
+	pr_warn("time out while flushing ARL\n");
+
+	return -EINVAL;
+}
+
+static void b53_enable_ports(struct b53_device *dev)
+{
+	unsigned i;
+
+	b53_for_each_port(dev, i) {
+		u8 port_ctrl;
+		u16 pvlan_mask;
+
+		/*
+		 * prevent leaking packets between wan and lan in unmanaged
+		 * mode through port vlans.
+		 */
+		if (dev->enable_vlan || is_cpu_port(dev, i))
+			pvlan_mask = 0x1ff;
+		else if (is531x5(dev) || is5301x(dev))
+			/* BCM53115 may use a different port as cpu port */
+			pvlan_mask = BIT(dev->sw_dev.cpu_port);
+		else
+			pvlan_mask = BIT(B53_CPU_PORT);
+
+		/* BCM5325 CPU port is at 8 */
+		if ((is5325(dev) || is5365(dev)) && i == B53_CPU_PORT_25)
+			i = B53_CPU_PORT;
+
+		if (dev->chip_id == BCM5398_DEVICE_ID && (i == 6 || i == 7))
+			/* disable unused ports 6 & 7 */
+			port_ctrl = PORT_CTRL_RX_DISABLE | PORT_CTRL_TX_DISABLE;
+		else if (i == B53_CPU_PORT)
+			port_ctrl = PORT_CTRL_RX_BCST_EN |
+				    PORT_CTRL_RX_MCST_EN |
+				    PORT_CTRL_RX_UCST_EN;
+		else
+			port_ctrl = 0;
+
+		b53_write16(dev, B53_PVLAN_PAGE, B53_PVLAN_PORT_MASK(i),
+			    pvlan_mask);
+
+		/* port state is handled by bcm63xx_enet driver */
+		if (!is63xx(dev) && !(is5301x(dev) && i == 6))
+			b53_write8(dev, B53_CTRL_PAGE, B53_PORT_CTRL(i),
+				   port_ctrl);
+	}
+}
+
+static void b53_enable_mib(struct b53_device *dev)
+{
+	u8 gc;
+
+	b53_read8(dev, B53_MGMT_PAGE, B53_GLOBAL_CONFIG, &gc);
+
+	gc &= ~(GC_RESET_MIB | GC_MIB_AC_EN);
+
+	b53_write8(dev, B53_MGMT_PAGE, B53_GLOBAL_CONFIG, gc);
+}
+
+static int b53_apply(struct b53_device *dev)
+{
+	int i;
+
+	/* clear all vlan entries */
+	if (is5325(dev) || is5365(dev)) {
+		for (i = 1; i < dev->sw_dev.vlans; i++)
+			b53_set_vlan_entry(dev, i, 0, 0);
+	} else {
+		b53_do_vlan_op(dev, VTA_CMD_CLEAR);
+	}
+
+	b53_enable_vlan(dev, dev->enable_vlan);
+
+	/* fill VLAN table */
+	if (dev->enable_vlan) {
+		for (i = 0; i < dev->sw_dev.vlans; i++) {
+			struct b53_vlan *vlan = &dev->vlans[i];
+
+			if (!vlan->members)
+				continue;
+
+			b53_set_vlan_entry(dev, i, vlan->members, vlan->untag);
+		}
+
+		b53_for_each_port(dev, i)
+			b53_write16(dev, B53_VLAN_PAGE,
+				    B53_VLAN_PORT_DEF_TAG(i),
+				    dev->ports[i].pvid);
+	} else {
+		b53_for_each_port(dev, i)
+			b53_write16(dev, B53_VLAN_PAGE,
+				    B53_VLAN_PORT_DEF_TAG(i), 1);
+
+	}
+
+	b53_enable_ports(dev);
+
+	if (!is5325(dev) && !is5365(dev))
+		b53_set_jumbo(dev, dev->enable_jumbo, 1);
+
+	return 0;
+}
+
+static void b53_switch_reset_gpio(struct b53_device *dev)
+{
+	int gpio = dev->reset_gpio;
+
+	if (gpio < 0)
+		return;
+
+	/*
+	 * Reset sequence: RESET low(50ms)->high(20ms)
+	 */
+	gpio_set_value(gpio, 0);
+	mdelay(50);
+
+	gpio_set_value(gpio, 1);
+	mdelay(20);
+
+	dev->current_page = 0xff;
+}
+
+static int b53_configure_ports_of(struct b53_device *dev)
+{
+	struct device_node *dn, *pn;
+	u32 port_num;
+
+	dn = of_get_child_by_name(dev_of_node(dev->dev), "ports");
+
+	for_each_available_child_of_node(dn, pn) {
+		struct device_node *fixed_link;
+
+		if (of_property_read_u32(pn, "reg", &port_num))
+			continue;
+
+		if (port_num > B53_CPU_PORT)
+			continue;
+
+		fixed_link = of_get_child_by_name(pn, "fixed-link");
+		if (fixed_link) {
+			u32 spd;
+			u8 po = GMII_PO_LINK;
+			phy_interface_t mode;
+
+			of_get_phy_mode(pn, &mode);
+
+			if (!of_property_read_u32(fixed_link, "speed", &spd)) {
+				switch (spd) {
+				case 10:
+					po |= GMII_PO_SPEED_10M;
+					break;
+				case 100:
+					po |= GMII_PO_SPEED_100M;
+					break;
+				case 2000:
+					if (is_imp_port(dev, port_num))
+						po |= PORT_OVERRIDE_SPEED_2000M;
+					else
+						po |= GMII_PO_SPEED_2000M;
+					fallthrough;
+				case 1000:
+					po |= GMII_PO_SPEED_1000M;
+					break;
+				}
+			}
+
+			if (of_property_read_bool(fixed_link, "full-duplex"))
+				po |= PORT_OVERRIDE_FULL_DUPLEX;
+			if (of_property_read_bool(fixed_link, "pause"))
+				po |= GMII_PO_RX_FLOW;
+			if (of_property_read_bool(fixed_link, "asym-pause"))
+				po |= GMII_PO_TX_FLOW;
+
+			if (is_imp_port(dev, port_num)) {
+				po |= PORT_OVERRIDE_EN;
+
+				if (is5325(dev) &&
+				    mode == PHY_INTERFACE_MODE_REVMII)
+					po |= PORT_OVERRIDE_RV_MII_25;
+
+				b53_write8(dev, B53_CTRL_PAGE,
+					   B53_PORT_OVERRIDE_CTRL, po);
+
+				if (is5325(dev) &&
+				    mode == PHY_INTERFACE_MODE_REVMII) {
+					b53_read8(dev, B53_CTRL_PAGE,
+						  B53_PORT_OVERRIDE_CTRL, &po);
+					if (!(po & PORT_OVERRIDE_RV_MII_25))
+					pr_err("Failed to enable reverse MII mode\n");
+					return -EINVAL;
+				}
+			} else {
+				po |= GMII_PO_EN;
+				b53_write8(dev, B53_CTRL_PAGE,
+					   B53_GMII_PORT_OVERRIDE_CTRL(port_num),
+					   po);
+			}
+		}
+	}
+
+	return 0;
+}
+
+static int b53_configure_ports(struct b53_device *dev)
+{
+	u8 cpu_port = dev->sw_dev.cpu_port;
+
+	/* configure MII port if necessary */
+	if (is5325(dev)) {
+		u8 mii_port_override;
+
+		b53_read8(dev, B53_CTRL_PAGE, B53_PORT_OVERRIDE_CTRL,
+			  &mii_port_override);
+		/* reverse mii needs to be enabled */
+		if (!(mii_port_override & PORT_OVERRIDE_RV_MII_25)) {
+			b53_write8(dev, B53_CTRL_PAGE, B53_PORT_OVERRIDE_CTRL,
+				   mii_port_override | PORT_OVERRIDE_RV_MII_25);
+			b53_read8(dev, B53_CTRL_PAGE, B53_PORT_OVERRIDE_CTRL,
+				  &mii_port_override);
+
+			if (!(mii_port_override & PORT_OVERRIDE_RV_MII_25)) {
+				pr_err("Failed to enable reverse MII mode\n");
+				return -EINVAL;
+			}
+		}
+	} else if (is531x5(dev) && cpu_port == B53_CPU_PORT) {
+		u8 mii_port_override;
+
+		b53_read8(dev, B53_CTRL_PAGE, B53_PORT_OVERRIDE_CTRL,
+			  &mii_port_override);
+		b53_write8(dev, B53_CTRL_PAGE, B53_PORT_OVERRIDE_CTRL,
+			   mii_port_override | PORT_OVERRIDE_EN |
+			   PORT_OVERRIDE_LINK);
+
+		/* BCM47189 has another interface connected to the port 5 */
+		if (dev->enabled_ports & BIT(5)) {
+			u8 po_reg = B53_GMII_PORT_OVERRIDE_CTRL(5);
+			u8 gmii_po;
+
+			b53_read8(dev, B53_CTRL_PAGE, po_reg, &gmii_po);
+			gmii_po |= GMII_PO_LINK |
+				   GMII_PO_RX_FLOW |
+				   GMII_PO_TX_FLOW |
+				   GMII_PO_EN;
+			b53_write8(dev, B53_CTRL_PAGE, po_reg, gmii_po);
+		}
+	} else if (is5301x(dev)) {
+		if (cpu_port == 8) {
+			u8 mii_port_override;
+
+			b53_read8(dev, B53_CTRL_PAGE, B53_PORT_OVERRIDE_CTRL,
+				  &mii_port_override);
+			mii_port_override |= PORT_OVERRIDE_LINK |
+					     PORT_OVERRIDE_RX_FLOW |
+					     PORT_OVERRIDE_TX_FLOW |
+					     PORT_OVERRIDE_SPEED_2000M |
+					     PORT_OVERRIDE_EN;
+			b53_write8(dev, B53_CTRL_PAGE, B53_PORT_OVERRIDE_CTRL,
+				   mii_port_override);
+
+			/* TODO: Ports 5 & 7 require some extra handling */
+		} else {
+			u8 po_reg = B53_GMII_PORT_OVERRIDE_CTRL(cpu_port);
+			u8 gmii_po;
+
+			b53_read8(dev, B53_CTRL_PAGE, po_reg, &gmii_po);
+			gmii_po |= GMII_PO_LINK |
+				   GMII_PO_RX_FLOW |
+				   GMII_PO_TX_FLOW |
+				   GMII_PO_EN |
+				   GMII_PO_SPEED_2000M;
+			b53_write8(dev, B53_CTRL_PAGE, po_reg, gmii_po);
+		}
+	}
+
+	return 0;
+}
+
+static int b53_switch_reset(struct b53_device *dev)
+{
+	int ret = 0;
+	u8 mgmt;
+
+	b53_switch_reset_gpio(dev);
+
+	if (is539x(dev)) {
+		b53_write8(dev, B53_CTRL_PAGE, B53_SOFTRESET, 0x83);
+		b53_write8(dev, B53_CTRL_PAGE, B53_SOFTRESET, 0x00);
+	}
+
+	b53_read8(dev, B53_CTRL_PAGE, B53_SWITCH_MODE, &mgmt);
+
+	if (!(mgmt & SM_SW_FWD_EN)) {
+		mgmt &= ~SM_SW_FWD_MODE;
+		mgmt |= SM_SW_FWD_EN;
+
+		b53_write8(dev, B53_CTRL_PAGE, B53_SWITCH_MODE, mgmt);
+		b53_read8(dev, B53_CTRL_PAGE, B53_SWITCH_MODE, &mgmt);
+
+		if (!(mgmt & SM_SW_FWD_EN)) {
+			pr_err("Failed to enable switch!\n");
+			return -EINVAL;
+		}
+	}
+
+	/* enable all ports */
+	b53_enable_ports(dev);
+
+	if (dev->dev->of_node)
+		ret = b53_configure_ports_of(dev);
+	else
+		ret = b53_configure_ports(dev);
+
+	if (ret)
+		return ret;
+
+	b53_enable_mib(dev);
+
+	return b53_flush_arl(dev);
+}
+
+/*
+ * Swconfig glue functions
+ */
+
+static int b53_global_get_vlan_enable(struct switch_dev *dev,
+				      const struct switch_attr *attr,
+				      struct switch_val *val)
+{
+	struct b53_device *priv = sw_to_b53(dev);
+
+	val->value.i = priv->enable_vlan;
+
+	return 0;
+}
+
+static int b53_global_set_vlan_enable(struct switch_dev *dev,
+				      const struct switch_attr *attr,
+				      struct switch_val *val)
+{
+	struct b53_device *priv = sw_to_b53(dev);
+
+	priv->enable_vlan = val->value.i;
+
+	return 0;
+}
+
+static int b53_global_get_jumbo_enable(struct switch_dev *dev,
+				       const struct switch_attr *attr,
+				       struct switch_val *val)
+{
+	struct b53_device *priv = sw_to_b53(dev);
+
+	val->value.i = priv->enable_jumbo;
+
+	return 0;
+}
+
+static int b53_global_set_jumbo_enable(struct switch_dev *dev,
+				       const struct switch_attr *attr,
+				       struct switch_val *val)
+{
+	struct b53_device *priv = sw_to_b53(dev);
+
+	priv->enable_jumbo = val->value.i;
+
+	return 0;
+}
+
+static int b53_global_get_4095_enable(struct switch_dev *dev,
+				      const struct switch_attr *attr,
+				      struct switch_val *val)
+{
+	struct b53_device *priv = sw_to_b53(dev);
+
+	val->value.i = priv->allow_vid_4095;
+
+	return 0;
+}
+
+static int b53_global_set_4095_enable(struct switch_dev *dev,
+				      const struct switch_attr *attr,
+				      struct switch_val *val)
+{
+	struct b53_device *priv = sw_to_b53(dev);
+
+	priv->allow_vid_4095 = val->value.i;
+
+	return 0;
+}
+
+static int b53_global_get_ports(struct switch_dev *dev,
+				const struct switch_attr *attr,
+				struct switch_val *val)
+{
+	struct b53_device *priv = sw_to_b53(dev);
+
+	val->len = snprintf(priv->buf, B53_BUF_SIZE, "0x%04x",
+			    priv->enabled_ports);
+	val->value.s = priv->buf;
+
+	return 0;
+}
+
+static int b53_port_get_pvid(struct switch_dev *dev, int port, int *val)
+{
+	struct b53_device *priv = sw_to_b53(dev);
+
+	*val = priv->ports[port].pvid;
+
+	return 0;
+}
+
+static int b53_port_set_pvid(struct switch_dev *dev, int port, int val)
+{
+	struct b53_device *priv = sw_to_b53(dev);
+
+	if (val > 15 && is5325(priv))
+		return -EINVAL;
+	if (val == 4095 && !priv->allow_vid_4095)
+		return -EINVAL;
+
+	priv->ports[port].pvid = val;
+
+	return 0;
+}
+
+static int b53_vlan_get_ports(struct switch_dev *dev, struct switch_val *val)
+{
+	struct b53_device *priv = sw_to_b53(dev);
+	struct switch_port *port = &val->value.ports[0];
+	struct b53_vlan *vlan = &priv->vlans[val->port_vlan];
+	int i;
+
+	val->len = 0;
+
+	if (!vlan->members)
+		return 0;
+
+	for (i = 0; i < dev->ports; i++) {
+		if (!(vlan->members & BIT(i)))
+			continue;
+
+
+		if (!(vlan->untag & BIT(i)))
+			port->flags = BIT(SWITCH_PORT_FLAG_TAGGED);
+		else
+			port->flags = 0;
+
+		port->id = i;
+		val->len++;
+		port++;
+	}
+
+	return 0;
+}
+
+static int b53_vlan_set_ports(struct switch_dev *dev, struct switch_val *val)
+{
+	struct b53_device *priv = sw_to_b53(dev);
+	struct switch_port *port;
+	struct b53_vlan *vlan = &priv->vlans[val->port_vlan];
+	int i;
+
+	/* only BCM5325 and BCM5365 supports VID 0 */
+	if (val->port_vlan == 0 && !is5325(priv) && !is5365(priv))
+		return -EINVAL;
+
+	/* VLAN 4095 needs special handling */
+	if (val->port_vlan == 4095 && !priv->allow_vid_4095)
+		return -EINVAL;
+
+	port = &val->value.ports[0];
+	vlan->members = 0;
+	vlan->untag = 0;
+	for (i = 0; i < val->len; i++, port++) {
+		vlan->members |= BIT(port->id);
+
+		if (!(port->flags & BIT(SWITCH_PORT_FLAG_TAGGED))) {
+			vlan->untag |= BIT(port->id);
+			priv->ports[port->id].pvid = val->port_vlan;
+		};
+	}
+
+	/* ignore disabled ports */
+	vlan->members &= priv->enabled_ports;
+	vlan->untag &= priv->enabled_ports;
+
+	return 0;
+}
+
+static int b53_port_get_link(struct switch_dev *dev, int port,
+			     struct switch_port_link *link)
+{
+	struct b53_device *priv = sw_to_b53(dev);
+
+	if (is_cpu_port(priv, port)) {
+		link->link = 1;
+		link->duplex = 1;
+		link->speed = is5325(priv) || is5365(priv) ?
+				SWITCH_PORT_SPEED_100 : SWITCH_PORT_SPEED_1000;
+		link->aneg = 0;
+	} else if (priv->enabled_ports & BIT(port)) {
+		u32 speed;
+		u16 lnk, duplex;
+
+		b53_read16(priv, B53_STAT_PAGE, B53_LINK_STAT, &lnk);
+		b53_read16(priv, B53_STAT_PAGE, priv->duplex_reg, &duplex);
+
+		lnk = (lnk >> port) & 1;
+		duplex = (duplex >> port) & 1;
+
+		if (is5325(priv) || is5365(priv)) {
+			u16 tmp;
+
+			b53_read16(priv, B53_STAT_PAGE, B53_SPEED_STAT, &tmp);
+			speed = SPEED_PORT_FE(tmp, port);
+		} else {
+			b53_read32(priv, B53_STAT_PAGE, B53_SPEED_STAT, &speed);
+			speed = SPEED_PORT_GE(speed, port);
+		}
+
+		link->link = lnk;
+		if (lnk) {
+			link->duplex = duplex;
+			switch (speed) {
+			case SPEED_STAT_10M:
+				link->speed = SWITCH_PORT_SPEED_10;
+				break;
+			case SPEED_STAT_100M:
+				link->speed = SWITCH_PORT_SPEED_100;
+				break;
+			case SPEED_STAT_1000M:
+				link->speed = SWITCH_PORT_SPEED_1000;
+				break;
+			}
+		}
+
+		link->aneg = 1;
+	} else {
+		link->link = 0;
+	}
+
+	return 0;
+
+}
+
+static int b53_port_set_link(struct switch_dev *sw_dev, int port,
+			     struct switch_port_link *link)
+{
+	struct b53_device *dev = sw_to_b53(sw_dev);
+
+	/*
+	 * TODO: BCM63XX requires special handling as it can have external phys
+	 * and ports might be GE or only FE
+	 */
+	if (is63xx(dev))
+		return -ENOTSUPP;
+
+	if (port == sw_dev->cpu_port)
+		return -EINVAL;
+
+	if (!(BIT(port) & dev->enabled_ports))
+		return -EINVAL;
+
+	if (link->speed == SWITCH_PORT_SPEED_1000 &&
+	    (is5325(dev) || is5365(dev)))
+		return -EINVAL;
+
+	if (link->speed == SWITCH_PORT_SPEED_1000 && !link->duplex)
+		return -EINVAL;
+
+	return switch_generic_set_link(sw_dev, port, link);
+}
+
+static int b53_phy_read16(struct switch_dev *dev, int addr, u8 reg, u16 *value)
+{
+	struct b53_device *priv = sw_to_b53(dev);
+
+	if (priv->ops->phy_read16)
+		return priv->ops->phy_read16(priv, addr, reg, value);
+
+	return b53_read16(priv, B53_PORT_MII_PAGE(addr), reg, value);
+}
+
+static int b53_phy_write16(struct switch_dev *dev, int addr, u8 reg, u16 value)
+{
+	struct b53_device *priv = sw_to_b53(dev);
+
+	if (priv->ops->phy_write16)
+		return priv->ops->phy_write16(priv, addr, reg, value);
+
+	return b53_write16(priv, B53_PORT_MII_PAGE(addr), reg, value);
+}
+
+static int b53_global_reset_switch(struct switch_dev *dev)
+{
+	struct b53_device *priv = sw_to_b53(dev);
+
+	/* reset vlans */
+	priv->enable_vlan = 0;
+	priv->enable_jumbo = 0;
+	priv->allow_vid_4095 = 0;
+
+	memset(priv->vlans, 0, sizeof(*priv->vlans) * dev->vlans);
+	memset(priv->ports, 0, sizeof(*priv->ports) * dev->ports);
+
+	return b53_switch_reset(priv);
+}
+
+static int b53_global_apply_config(struct switch_dev *dev)
+{
+	struct b53_device *priv = sw_to_b53(dev);
+
+	/* disable switching */
+	b53_set_forwarding(priv, 0);
+
+	b53_apply(priv);
+
+	/* enable switching */
+	b53_set_forwarding(priv, 1);
+
+	return 0;
+}
+
+
+static int b53_global_reset_mib(struct switch_dev *dev,
+				const struct switch_attr *attr,
+				struct switch_val *val)
+{
+	struct b53_device *priv = sw_to_b53(dev);
+	u8 gc;
+
+	b53_read8(priv, B53_MGMT_PAGE, B53_GLOBAL_CONFIG, &gc);
+
+	b53_write8(priv, B53_MGMT_PAGE, B53_GLOBAL_CONFIG, gc | GC_RESET_MIB);
+	mdelay(1);
+	b53_write8(priv, B53_MGMT_PAGE, B53_GLOBAL_CONFIG, gc & ~GC_RESET_MIB);
+	mdelay(1);
+
+	return 0;
+}
+
+static int b53_port_get_mib(struct switch_dev *sw_dev,
+			    const struct switch_attr *attr,
+			    struct switch_val *val)
+{
+	struct b53_device *dev = sw_to_b53(sw_dev);
+	const struct b53_mib_desc *mibs;
+	int port = val->port_vlan;
+	int len = 0;
+
+	if (!(BIT(port) & dev->enabled_ports))
+		return -1;
+
+	if (is5365(dev)) {
+		if (port == 5)
+			port = 8;
+
+		mibs = b53_mibs_65;
+	} else if (is63xx(dev)) {
+		mibs = b53_mibs_63xx;
+	} else {
+		mibs = b53_mibs;
+	}
+
+	dev->buf[0] = 0;
+
+	for (; mibs->size > 0; mibs++) {
+		u64 val;
+
+		if (mibs->size == 8) {
+			b53_read64(dev, B53_MIB_PAGE(port), mibs->offset, &val);
+		} else {
+			u32 val32;
+
+			b53_read32(dev, B53_MIB_PAGE(port), mibs->offset,
+				   &val32);
+			val = val32;
+		}
+
+		len += snprintf(dev->buf + len, B53_BUF_SIZE - len,
+				"%-20s: %llu\n", mibs->name, val);
+	}
+
+	val->len = len;
+	val->value.s = dev->buf;
+
+	return 0;
+}
+
+static int b53_port_get_stats(struct switch_dev *sw_dev, int port,
+				struct switch_port_stats *stats)
+{
+	struct b53_device *dev = sw_to_b53(sw_dev);
+	const struct b53_mib_desc *mibs;
+	int txb_id, rxb_id;
+	u64 rxb, txb;
+
+	if (!(BIT(port) & dev->enabled_ports))
+		return -EINVAL;
+
+	txb_id = B53XX_MIB_TXB_ID;
+	rxb_id = B53XX_MIB_RXB_ID;
+
+	if (is5365(dev)) {
+		if (port == 5)
+			port = 8;
+
+		mibs = b53_mibs_65;
+	} else if (is63xx(dev)) {
+		mibs = b53_mibs_63xx;
+		txb_id = B63XX_MIB_TXB_ID;
+		rxb_id = B63XX_MIB_RXB_ID;
+	} else {
+		mibs = b53_mibs;
+	}
+
+	dev->buf[0] = 0;
+
+	if (mibs->size == 8) {
+		b53_read64(dev, B53_MIB_PAGE(port), mibs[txb_id].offset, &txb);
+		b53_read64(dev, B53_MIB_PAGE(port), mibs[rxb_id].offset, &rxb);
+	} else {
+		u32 val32;
+
+		b53_read32(dev, B53_MIB_PAGE(port), mibs[txb_id].offset, &val32);
+		txb = val32;
+
+		b53_read32(dev, B53_MIB_PAGE(port), mibs[rxb_id].offset, &val32);
+		rxb = val32;
+	}
+
+	stats->tx_bytes = txb;
+	stats->rx_bytes = rxb;
+
+	return 0;
+}
+
+static struct switch_attr b53_global_ops_25[] = {
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_vlan",
+		.description = "Enable VLAN mode",
+		.set = b53_global_set_vlan_enable,
+		.get = b53_global_get_vlan_enable,
+		.max = 1,
+	},
+	{
+		.type = SWITCH_TYPE_STRING,
+		.name = "ports",
+		.description = "Available ports (as bitmask)",
+		.get = b53_global_get_ports,
+	},
+};
+
+static struct switch_attr b53_global_ops_65[] = {
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_vlan",
+		.description = "Enable VLAN mode",
+		.set = b53_global_set_vlan_enable,
+		.get = b53_global_get_vlan_enable,
+		.max = 1,
+	},
+	{
+		.type = SWITCH_TYPE_STRING,
+		.name = "ports",
+		.description = "Available ports (as bitmask)",
+		.get = b53_global_get_ports,
+	},
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "reset_mib",
+		.description = "Reset MIB counters",
+		.set = b53_global_reset_mib,
+	},
+};
+
+static struct switch_attr b53_global_ops[] = {
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_vlan",
+		.description = "Enable VLAN mode",
+		.set = b53_global_set_vlan_enable,
+		.get = b53_global_get_vlan_enable,
+		.max = 1,
+	},
+	{
+		.type = SWITCH_TYPE_STRING,
+		.name = "ports",
+		.description = "Available Ports (as bitmask)",
+		.get = b53_global_get_ports,
+	},
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "reset_mib",
+		.description = "Reset MIB counters",
+		.set = b53_global_reset_mib,
+	},
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_jumbo",
+		.description = "Enable Jumbo Frames",
+		.set = b53_global_set_jumbo_enable,
+		.get = b53_global_get_jumbo_enable,
+		.max = 1,
+	},
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "allow_vid_4095",
+		.description = "Allow VID 4095",
+		.set = b53_global_set_4095_enable,
+		.get = b53_global_get_4095_enable,
+		.max = 1,
+	},
+};
+
+static struct switch_attr b53_port_ops[] = {
+	{
+		.type = SWITCH_TYPE_STRING,
+		.name = "mib",
+		.description = "Get port's MIB counters",
+		.get = b53_port_get_mib,
+	},
+};
+
+static struct switch_attr b53_no_ops[] = {
+};
+
+static const struct switch_dev_ops b53_switch_ops_25 = {
+	.attr_global = {
+		.attr = b53_global_ops_25,
+		.n_attr = ARRAY_SIZE(b53_global_ops_25),
+	},
+	.attr_port = {
+		.attr = b53_no_ops,
+		.n_attr = ARRAY_SIZE(b53_no_ops),
+	},
+	.attr_vlan = {
+		.attr = b53_no_ops,
+		.n_attr = ARRAY_SIZE(b53_no_ops),
+	},
+
+	.get_vlan_ports = b53_vlan_get_ports,
+	.set_vlan_ports = b53_vlan_set_ports,
+	.get_port_pvid = b53_port_get_pvid,
+	.set_port_pvid = b53_port_set_pvid,
+	.apply_config = b53_global_apply_config,
+	.reset_switch = b53_global_reset_switch,
+	.get_port_link = b53_port_get_link,
+	.set_port_link = b53_port_set_link,
+	.get_port_stats = b53_port_get_stats,
+	.phy_read16 = b53_phy_read16,
+	.phy_write16 = b53_phy_write16,
+};
+
+static const struct switch_dev_ops b53_switch_ops_65 = {
+	.attr_global = {
+		.attr = b53_global_ops_65,
+		.n_attr = ARRAY_SIZE(b53_global_ops_65),
+	},
+	.attr_port = {
+		.attr = b53_port_ops,
+		.n_attr = ARRAY_SIZE(b53_port_ops),
+	},
+	.attr_vlan = {
+		.attr = b53_no_ops,
+		.n_attr = ARRAY_SIZE(b53_no_ops),
+	},
+
+	.get_vlan_ports = b53_vlan_get_ports,
+	.set_vlan_ports = b53_vlan_set_ports,
+	.get_port_pvid = b53_port_get_pvid,
+	.set_port_pvid = b53_port_set_pvid,
+	.apply_config = b53_global_apply_config,
+	.reset_switch = b53_global_reset_switch,
+	.get_port_link = b53_port_get_link,
+	.set_port_link = b53_port_set_link,
+	.get_port_stats = b53_port_get_stats,
+	.phy_read16 = b53_phy_read16,
+	.phy_write16 = b53_phy_write16,
+};
+
+static const struct switch_dev_ops b53_switch_ops = {
+	.attr_global = {
+		.attr = b53_global_ops,
+		.n_attr = ARRAY_SIZE(b53_global_ops),
+	},
+	.attr_port = {
+		.attr = b53_port_ops,
+		.n_attr = ARRAY_SIZE(b53_port_ops),
+	},
+	.attr_vlan = {
+		.attr = b53_no_ops,
+		.n_attr = ARRAY_SIZE(b53_no_ops),
+	},
+
+	.get_vlan_ports = b53_vlan_get_ports,
+	.set_vlan_ports = b53_vlan_set_ports,
+	.get_port_pvid = b53_port_get_pvid,
+	.set_port_pvid = b53_port_set_pvid,
+	.apply_config = b53_global_apply_config,
+	.reset_switch = b53_global_reset_switch,
+	.get_port_link = b53_port_get_link,
+	.set_port_link = b53_port_set_link,
+	.get_port_stats = b53_port_get_stats,
+	.phy_read16 = b53_phy_read16,
+	.phy_write16 = b53_phy_write16,
+};
+
+struct b53_chip_data {
+	u32 chip_id;
+	const char *dev_name;
+	const char *alias;
+	u16 vlans;
+	u16 enabled_ports;
+	u8 cpu_port;
+	u8 vta_regs[3];
+	u8 duplex_reg;
+	u8 jumbo_pm_reg;
+	u8 jumbo_size_reg;
+	const struct switch_dev_ops *sw_ops;
+};
+
+#define B53_VTA_REGS	\
+	{ B53_VT_ACCESS, B53_VT_INDEX, B53_VT_ENTRY }
+#define B53_VTA_REGS_9798 \
+	{ B53_VT_ACCESS_9798, B53_VT_INDEX_9798, B53_VT_ENTRY_9798 }
+#define B53_VTA_REGS_63XX \
+	{ B53_VT_ACCESS_63XX, B53_VT_INDEX_63XX, B53_VT_ENTRY_63XX }
+
+static const struct b53_chip_data b53_switch_chips[] = {
+	{
+		.chip_id = BCM5325_DEVICE_ID,
+		.dev_name = "BCM5325",
+		.alias = "bcm5325",
+		.vlans = 16,
+		.enabled_ports = 0x1f,
+		.cpu_port = B53_CPU_PORT_25,
+		.duplex_reg = B53_DUPLEX_STAT_FE,
+		.sw_ops = &b53_switch_ops_25,
+	},
+	{
+		.chip_id = BCM5365_DEVICE_ID,
+		.dev_name = "BCM5365",
+		.alias = "bcm5365",
+		.vlans = 256,
+		.enabled_ports = 0x1f,
+		.cpu_port = B53_CPU_PORT_25,
+		.duplex_reg = B53_DUPLEX_STAT_FE,
+		.sw_ops = &b53_switch_ops_65,
+	},
+	{
+		.chip_id = BCM5395_DEVICE_ID,
+		.dev_name = "BCM5395",
+		.alias = "bcm5395",
+		.vlans = 4096,
+		.enabled_ports = 0x1f,
+		.cpu_port = B53_CPU_PORT,
+		.vta_regs = B53_VTA_REGS,
+		.duplex_reg = B53_DUPLEX_STAT_GE,
+		.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
+		.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+		.sw_ops = &b53_switch_ops,
+	},
+	{
+		.chip_id = BCM5397_DEVICE_ID,
+		.dev_name = "BCM5397",
+		.alias = "bcm5397",
+		.vlans = 4096,
+		.enabled_ports = 0x1f,
+		.cpu_port = B53_CPU_PORT,
+		.vta_regs = B53_VTA_REGS_9798,
+		.duplex_reg = B53_DUPLEX_STAT_GE,
+		.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
+		.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+		.sw_ops = &b53_switch_ops,
+	},
+	{
+		.chip_id = BCM5398_DEVICE_ID,
+		.dev_name = "BCM5398",
+		.alias = "bcm5398",
+		.vlans = 4096,
+		.enabled_ports = 0x7f,
+		.cpu_port = B53_CPU_PORT,
+		.vta_regs = B53_VTA_REGS_9798,
+		.duplex_reg = B53_DUPLEX_STAT_GE,
+		.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
+		.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+		.sw_ops = &b53_switch_ops,
+	},
+	{
+		.chip_id = BCM53115_DEVICE_ID,
+		.dev_name = "BCM53115",
+		.alias = "bcm53115",
+		.vlans = 4096,
+		.enabled_ports = 0x1f,
+		.vta_regs = B53_VTA_REGS,
+		.cpu_port = B53_CPU_PORT,
+		.duplex_reg = B53_DUPLEX_STAT_GE,
+		.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
+		.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+		.sw_ops = &b53_switch_ops,
+	},
+	{
+		.chip_id = BCM53125_DEVICE_ID,
+		.dev_name = "BCM53125",
+		.alias = "bcm53125",
+		.vlans = 4096,
+		.enabled_ports = 0x1f,
+		.cpu_port = B53_CPU_PORT,
+		.vta_regs = B53_VTA_REGS,
+		.duplex_reg = B53_DUPLEX_STAT_GE,
+		.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
+		.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+		.sw_ops = &b53_switch_ops,
+	},
+	{
+		.chip_id = BCM53128_DEVICE_ID,
+		.dev_name = "BCM53128",
+		.alias = "bcm53128",
+		.vlans = 4096,
+		.enabled_ports = 0x1ff,
+		.cpu_port = B53_CPU_PORT,
+		.vta_regs = B53_VTA_REGS,
+		.duplex_reg = B53_DUPLEX_STAT_GE,
+		.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
+		.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+		.sw_ops = &b53_switch_ops,
+	},
+	{
+		.chip_id = BCM63XX_DEVICE_ID,
+		.dev_name = "BCM63xx",
+		.alias = "bcm63xx",
+		.vlans = 4096,
+		.enabled_ports = 0, /* pdata must provide them */
+		.cpu_port = B53_CPU_PORT,
+		.vta_regs = B53_VTA_REGS_63XX,
+		.duplex_reg = B53_DUPLEX_STAT_63XX,
+		.jumbo_pm_reg = B53_JUMBO_PORT_MASK_63XX,
+		.jumbo_size_reg = B53_JUMBO_MAX_SIZE_63XX,
+		.sw_ops = &b53_switch_ops,
+	},
+	{
+		.chip_id = BCM53010_DEVICE_ID,
+		.dev_name = "BCM53010",
+		.alias = "bcm53011",
+		.vlans = 4096,
+		.enabled_ports = 0x1f,
+		.cpu_port = B53_CPU_PORT_25, /* TODO: auto detect */
+		.vta_regs = B53_VTA_REGS,
+		.duplex_reg = B53_DUPLEX_STAT_GE,
+		.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
+		.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+		.sw_ops = &b53_switch_ops,
+	},
+	{
+		.chip_id = BCM53011_DEVICE_ID,
+		.dev_name = "BCM53011",
+		.alias = "bcm53011",
+		.vlans = 4096,
+		.enabled_ports = 0x1bf,
+		.cpu_port = B53_CPU_PORT_25, /* TODO: auto detect */
+		.vta_regs = B53_VTA_REGS,
+		.duplex_reg = B53_DUPLEX_STAT_GE,
+		.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
+		.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+		.sw_ops = &b53_switch_ops,
+	},
+	{
+		.chip_id = BCM53012_DEVICE_ID,
+		.dev_name = "BCM53012",
+		.alias = "bcm53011",
+		.vlans = 4096,
+		.enabled_ports = 0x1bf,
+		.cpu_port = B53_CPU_PORT_25, /* TODO: auto detect */
+		.vta_regs = B53_VTA_REGS,
+		.duplex_reg = B53_DUPLEX_STAT_GE,
+		.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
+		.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+		.sw_ops = &b53_switch_ops,
+	},
+	{
+		.chip_id = BCM53018_DEVICE_ID,
+		.dev_name = "BCM53018",
+		.alias = "bcm53018",
+		.vlans = 4096,
+		.enabled_ports = 0x1f,
+		.cpu_port = B53_CPU_PORT_25, /* TODO: auto detect */
+		.vta_regs = B53_VTA_REGS,
+		.duplex_reg = B53_DUPLEX_STAT_GE,
+		.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
+		.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+		.sw_ops = &b53_switch_ops,
+	},
+	{
+		.chip_id = BCM53019_DEVICE_ID,
+		.dev_name = "BCM53019",
+		.alias = "bcm53019",
+		.vlans = 4096,
+		.enabled_ports = 0x1f,
+		.cpu_port = B53_CPU_PORT_25, /* TODO: auto detect */
+		.vta_regs = B53_VTA_REGS,
+		.duplex_reg = B53_DUPLEX_STAT_GE,
+		.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
+		.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+		.sw_ops = &b53_switch_ops,
+	},
+};
+
+static int b53_switch_init_of(struct b53_device *dev)
+{
+	struct device_node *dn, *pn;
+	const char *alias;
+	u32 port_num;
+	u16 ports = 0;
+
+	dn = of_get_child_by_name(dev_of_node(dev->dev), "ports");
+	if (!dn)
+		return -EINVAL;
+
+	for_each_available_child_of_node(dn, pn) {
+		const char *label;
+		int len;
+
+		if (of_property_read_u32(pn, "reg", &port_num))
+			continue;
+
+		if (port_num > B53_CPU_PORT)
+			continue;
+
+		ports |= BIT(port_num);
+
+		label = of_get_property(pn, "label", &len);
+		if (label && !strcmp(label, "cpu"))
+			dev->sw_dev.cpu_port = port_num;
+	}
+
+	dev->enabled_ports = ports;
+
+	if (!of_property_read_string(dev_of_node(dev->dev), "lede,alias",
+						 &alias))
+		dev->sw_dev.alias = devm_kstrdup(dev->dev, alias, GFP_KERNEL);
+
+	return 0;
+}
+
+static int b53_switch_init(struct b53_device *dev)
+{
+	struct switch_dev *sw_dev = &dev->sw_dev;
+	unsigned i;
+	int ret;
+
+	for (i = 0; i < ARRAY_SIZE(b53_switch_chips); i++) {
+		const struct b53_chip_data *chip = &b53_switch_chips[i];
+
+		if (chip->chip_id == dev->chip_id) {
+			sw_dev->name = chip->dev_name;
+			if (!sw_dev->alias)
+				sw_dev->alias = chip->alias;
+			if (!dev->enabled_ports)
+				dev->enabled_ports = chip->enabled_ports;
+			dev->duplex_reg = chip->duplex_reg;
+			dev->vta_regs[0] = chip->vta_regs[0];
+			dev->vta_regs[1] = chip->vta_regs[1];
+			dev->vta_regs[2] = chip->vta_regs[2];
+			dev->jumbo_pm_reg = chip->jumbo_pm_reg;
+			sw_dev->ops = chip->sw_ops;
+			sw_dev->cpu_port = chip->cpu_port;
+			sw_dev->vlans = chip->vlans;
+			break;
+		}
+	}
+
+	if (!sw_dev->name)
+		return -EINVAL;
+
+	/* check which BCM5325x version we have */
+	if (is5325(dev)) {
+		u8 vc4;
+
+		b53_read8(dev, B53_VLAN_PAGE, B53_VLAN_CTRL4_25, &vc4);
+
+		/* check reserved bits */
+		switch (vc4 & 3) {
+		case 1:
+			/* BCM5325E */
+			break;
+		case 3:
+			/* BCM5325F - do not use port 4 */
+			dev->enabled_ports &= ~BIT(4);
+			break;
+		default:
+/* On the BCM47XX SoCs this is the supported internal switch.*/
+#ifndef CONFIG_BCM47XX
+			/* BCM5325M */
+			return -EINVAL;
+#else
+			break;
+#endif
+		}
+	} else if (dev->chip_id == BCM53115_DEVICE_ID) {
+		u64 strap_value;
+
+		b53_read48(dev, B53_STAT_PAGE, B53_STRAP_VALUE, &strap_value);
+		/* use second IMP port if GMII is enabled */
+		if (strap_value & SV_GMII_CTRL_115)
+			sw_dev->cpu_port = 5;
+	}
+
+	if (dev_of_node(dev->dev)) {
+		ret = b53_switch_init_of(dev);
+		if (ret)
+			return ret;
+	}
+
+	dev->enabled_ports |= BIT(sw_dev->cpu_port);
+	sw_dev->ports = fls(dev->enabled_ports);
+
+	dev->ports = devm_kzalloc(dev->dev,
+				  sizeof(struct b53_port) * sw_dev->ports,
+				  GFP_KERNEL);
+	if (!dev->ports)
+		return -ENOMEM;
+
+	dev->vlans = devm_kzalloc(dev->dev,
+				  sizeof(struct b53_vlan) * sw_dev->vlans,
+				  GFP_KERNEL);
+	if (!dev->vlans)
+		return -ENOMEM;
+
+	dev->buf = devm_kzalloc(dev->dev, B53_BUF_SIZE, GFP_KERNEL);
+	if (!dev->buf)
+		return -ENOMEM;
+
+	dev->reset_gpio = b53_switch_get_reset_gpio(dev);
+	if (dev->reset_gpio >= 0) {
+		ret = devm_gpio_request_one(dev->dev, dev->reset_gpio,
+					    GPIOF_OUT_INIT_HIGH, "robo_reset");
+		if (ret)
+			return ret;
+	}
+
+	return b53_switch_reset(dev);
+}
+
+struct b53_device *b53_swconfig_switch_alloc(struct device *base, struct b53_io_ops *ops,
+					     void *priv)
+{
+	struct b53_device *dev;
+
+	dev = devm_kzalloc(base, sizeof(*dev), GFP_KERNEL);
+	if (!dev)
+		return NULL;
+
+	dev->dev = base;
+	dev->ops = ops;
+	dev->priv = priv;
+	mutex_init(&dev->reg_mutex);
+
+	return dev;
+}
+EXPORT_SYMBOL(b53_swconfig_switch_alloc);
+
+int b53_swconfig_switch_detect(struct b53_device *dev)
+{
+	u32 id32;
+	u16 tmp;
+	u8 id8;
+	int ret;
+
+	ret = b53_read8(dev, B53_MGMT_PAGE, B53_DEVICE_ID, &id8);
+	if (ret)
+		return ret;
+
+	switch (id8) {
+	case 0:
+		/*
+		 * BCM5325 and BCM5365 do not have this register so reads
+		 * return 0. But the read operation did succeed, so assume
+		 * this is one of them.
+		 *
+		 * Next check if we can write to the 5325's VTA register; for
+		 * 5365 it is read only.
+		 */
+
+		b53_write16(dev, B53_VLAN_PAGE, B53_VLAN_TABLE_ACCESS_25, 0xf);
+		b53_read16(dev, B53_VLAN_PAGE, B53_VLAN_TABLE_ACCESS_25, &tmp);
+
+		if (tmp == 0xf)
+			dev->chip_id = BCM5325_DEVICE_ID;
+		else
+			dev->chip_id = BCM5365_DEVICE_ID;
+		break;
+	case BCM5395_DEVICE_ID:
+	case BCM5397_DEVICE_ID:
+	case BCM5398_DEVICE_ID:
+		dev->chip_id = id8;
+		break;
+	default:
+		ret = b53_read32(dev, B53_MGMT_PAGE, B53_DEVICE_ID, &id32);
+		if (ret)
+			return ret;
+
+		switch (id32) {
+		case BCM53115_DEVICE_ID:
+		case BCM53125_DEVICE_ID:
+		case BCM53128_DEVICE_ID:
+		case BCM53010_DEVICE_ID:
+		case BCM53011_DEVICE_ID:
+		case BCM53012_DEVICE_ID:
+		case BCM53018_DEVICE_ID:
+		case BCM53019_DEVICE_ID:
+			dev->chip_id = id32;
+			break;
+		default:
+			pr_err("unsupported switch detected (BCM53%02x/BCM%x)\n",
+			       id8, id32);
+			return -ENODEV;
+		}
+	}
+
+	if (dev->chip_id == BCM5325_DEVICE_ID)
+		return b53_read8(dev, B53_STAT_PAGE, B53_REV_ID_25,
+				 &dev->core_rev);
+	else
+		return b53_read8(dev, B53_MGMT_PAGE, B53_REV_ID,
+				 &dev->core_rev);
+}
+EXPORT_SYMBOL(b53_swconfig_switch_detect);
+
+int b53_swconfig_switch_register(struct b53_device *dev)
+{
+	int ret;
+
+	if (dev->pdata) {
+		dev->chip_id = dev->pdata->chip_id;
+		dev->enabled_ports = dev->pdata->enabled_ports;
+		dev->sw_dev.alias = dev->pdata->alias;
+	}
+
+	if (!dev->chip_id && b53_swconfig_switch_detect(dev))
+		return -EINVAL;
+
+	ret = b53_switch_init(dev);
+	if (ret)
+		return ret;
+
+	pr_info("found switch: %s, rev %i\n", dev->sw_dev.name, dev->core_rev);
+
+	return register_switch(&dev->sw_dev, NULL);
+}
+EXPORT_SYMBOL(b53_swconfig_switch_register);
+
+MODULE_AUTHOR("Jonas Gorski <jogo@openwrt.org>");
+MODULE_DESCRIPTION("B53 switch library");
+MODULE_LICENSE("Dual BSD/GPL");
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/b53/b53_mdio.c b/6.12/target/linux/generic/files/drivers/net/phy/b53/b53_mdio.c
new file mode 100644
index 00000000..c85df1f3
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/b53/b53_mdio.c
@@ -0,0 +1,436 @@
+/*
+ * B53 register access through MII registers
+ *
+ * Copyright (C) 2011-2013 Jonas Gorski <jogo@openwrt.org>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/phy.h>
+#include <linux/module.h>
+
+#include "b53_priv.h"
+
+#define B53_PSEUDO_PHY	0x1e /* Register Access Pseudo PHY */
+
+/* MII registers */
+#define REG_MII_PAGE    0x10    /* MII Page register */
+#define REG_MII_ADDR    0x11    /* MII Address register */
+#define REG_MII_DATA0   0x18    /* MII Data register 0 */
+#define REG_MII_DATA1   0x19    /* MII Data register 1 */
+#define REG_MII_DATA2   0x1a    /* MII Data register 2 */
+#define REG_MII_DATA3   0x1b    /* MII Data register 3 */
+
+#define REG_MII_PAGE_ENABLE     BIT(0)
+#define REG_MII_ADDR_WRITE      BIT(0)
+#define REG_MII_ADDR_READ       BIT(1)
+
+static int b53_mdio_op(struct b53_device *dev, u8 page, u8 reg, u16 op)
+{
+	int i;
+	u16 v;
+	int ret;
+	struct mii_bus *bus = dev->priv;
+
+	if (dev->current_page != page) {
+		/* set page number */
+		v = (page << 8) | REG_MII_PAGE_ENABLE;
+		ret = mdiobus_write(bus, B53_PSEUDO_PHY, REG_MII_PAGE, v);
+		if (ret)
+			return ret;
+		dev->current_page = page;
+	}
+
+	/* set register address */
+	v = (reg << 8) | op;
+	ret = mdiobus_write(bus, B53_PSEUDO_PHY, REG_MII_ADDR, v);
+	if (ret)
+		return ret;
+
+	/* check if operation completed */
+	for (i = 0; i < 5; ++i) {
+		v = mdiobus_read(bus, B53_PSEUDO_PHY, REG_MII_ADDR);
+		if (!(v & (REG_MII_ADDR_WRITE | REG_MII_ADDR_READ)))
+			break;
+		usleep_range(10, 100);
+	}
+
+	if (WARN_ON(i == 5))
+		return -EIO;
+
+	return 0;
+}
+
+static int b53_mdio_read8(struct b53_device *dev, u8 page, u8 reg, u8 *val)
+{
+	struct mii_bus *bus = dev->priv;
+	int ret;
+
+	ret = b53_mdio_op(dev, page, reg, REG_MII_ADDR_READ);
+	if (ret)
+		return ret;
+
+	*val = mdiobus_read(bus, B53_PSEUDO_PHY, REG_MII_DATA0) & 0xff;
+
+	return 0;
+}
+
+static int b53_mdio_read16(struct b53_device *dev, u8 page, u8 reg, u16 *val)
+{
+	struct mii_bus *bus = dev->priv;
+	int ret;
+
+	ret = b53_mdio_op(dev, page, reg, REG_MII_ADDR_READ);
+	if (ret)
+		return ret;
+
+	*val = mdiobus_read(bus, B53_PSEUDO_PHY, REG_MII_DATA0);
+
+	return 0;
+}
+
+static int b53_mdio_read32(struct b53_device *dev, u8 page, u8 reg, u32 *val)
+{
+	struct mii_bus *bus = dev->priv;
+	int ret;
+
+	ret = b53_mdio_op(dev, page, reg, REG_MII_ADDR_READ);
+	if (ret)
+		return ret;
+
+	*val = mdiobus_read(bus, B53_PSEUDO_PHY, REG_MII_DATA0);
+	*val |= mdiobus_read(bus, B53_PSEUDO_PHY, REG_MII_DATA1) << 16;
+
+	return 0;
+}
+
+static int b53_mdio_read48(struct b53_device *dev, u8 page, u8 reg, u64 *val)
+{
+	struct mii_bus *bus = dev->priv;
+	u64 temp = 0;
+	int i;
+	int ret;
+
+	ret = b53_mdio_op(dev, page, reg, REG_MII_ADDR_READ);
+	if (ret)
+		return ret;
+
+	for (i = 2; i >= 0; i--) {
+		temp <<= 16;
+		temp |= mdiobus_read(bus, B53_PSEUDO_PHY, REG_MII_DATA0 + i);
+	}
+
+	*val = temp;
+
+	return 0;
+}
+
+static int b53_mdio_read64(struct b53_device *dev, u8 page, u8 reg, u64 *val)
+{
+	struct mii_bus *bus = dev->priv;
+	u64 temp = 0;
+	int i;
+	int ret;
+
+	ret = b53_mdio_op(dev, page, reg, REG_MII_ADDR_READ);
+	if (ret)
+		return ret;
+
+	for (i = 3; i >= 0; i--) {
+		temp <<= 16;
+		temp |= mdiobus_read(bus, B53_PSEUDO_PHY, REG_MII_DATA0 + i);
+	}
+
+	*val = temp;
+
+	return 0;
+}
+
+static int b53_mdio_write8(struct b53_device *dev, u8 page, u8 reg, u8 value)
+{
+	struct mii_bus *bus = dev->priv;
+	int ret;
+
+	ret = mdiobus_write(bus, B53_PSEUDO_PHY, REG_MII_DATA0, value);
+	if (ret)
+		return ret;
+
+	return b53_mdio_op(dev, page, reg, REG_MII_ADDR_WRITE);
+}
+
+static int b53_mdio_write16(struct b53_device *dev, u8 page, u8 reg,
+			     u16 value)
+{
+	struct mii_bus *bus = dev->priv;
+	int ret;
+
+	ret = mdiobus_write(bus, B53_PSEUDO_PHY, REG_MII_DATA0, value);
+	if (ret)
+		return ret;
+
+	return b53_mdio_op(dev, page, reg, REG_MII_ADDR_WRITE);
+}
+
+static int b53_mdio_write32(struct b53_device *dev, u8 page, u8 reg,
+				    u32 value)
+{
+	struct mii_bus *bus = dev->priv;
+	unsigned int i;
+	u32 temp = value;
+
+	for (i = 0; i < 2; i++) {
+		int ret = mdiobus_write(bus, B53_PSEUDO_PHY, REG_MII_DATA0 + i,
+				    temp & 0xffff);
+		if (ret)
+			return ret;
+		temp >>= 16;
+	}
+
+	return b53_mdio_op(dev, page, reg, REG_MII_ADDR_WRITE);
+
+}
+
+static int b53_mdio_write48(struct b53_device *dev, u8 page, u8 reg,
+				    u64 value)
+{
+	struct mii_bus *bus = dev->priv;
+	unsigned i;
+	u64 temp = value;
+
+	for (i = 0; i < 3; i++) {
+		int ret = mdiobus_write(bus, B53_PSEUDO_PHY, REG_MII_DATA0 + i,
+				    temp & 0xffff);
+		if (ret)
+			return ret;
+		temp >>= 16;
+	}
+
+	return b53_mdio_op(dev, page, reg, REG_MII_ADDR_WRITE);
+
+}
+
+static int b53_mdio_write64(struct b53_device *dev, u8 page, u8 reg,
+			     u64 value)
+{
+	struct mii_bus *bus = dev->priv;
+	unsigned i;
+	u64 temp = value;
+
+	for (i = 0; i < 4; i++) {
+		int ret = mdiobus_write(bus, B53_PSEUDO_PHY, REG_MII_DATA0 + i,
+				    temp & 0xffff);
+		if (ret)
+			return ret;
+		temp >>= 16;
+	}
+
+	return b53_mdio_op(dev, page, reg, REG_MII_ADDR_WRITE);
+}
+
+static int b53_mdio_phy_read16(struct b53_device *dev, int addr, u8 reg,
+			       u16 *value)
+{
+	struct mii_bus *bus = dev->priv;
+
+	*value = mdiobus_read(bus, addr, reg);
+
+	return 0;
+}
+
+static int b53_mdio_phy_write16(struct b53_device *dev, int addr, u8 reg,
+				u16 value)
+{
+	struct mii_bus *bus = dev->priv;
+
+	return mdiobus_write(bus, addr, reg, value);
+}
+
+static struct b53_io_ops b53_mdio_ops = {
+	.read8 = b53_mdio_read8,
+	.read16 = b53_mdio_read16,
+	.read32 = b53_mdio_read32,
+	.read48 = b53_mdio_read48,
+	.read64 = b53_mdio_read64,
+	.write8 = b53_mdio_write8,
+	.write16 = b53_mdio_write16,
+	.write32 = b53_mdio_write32,
+	.write48 = b53_mdio_write48,
+	.write64 = b53_mdio_write64,
+	.phy_read16 = b53_mdio_phy_read16,
+	.phy_write16 = b53_mdio_phy_write16,
+};
+
+static int b53_phy_probe(struct phy_device *phydev)
+{
+	struct b53_device *dev;
+	int ret;
+
+	/* allow the generic phy driver to take over */
+	if (phydev->mdio.addr != B53_PSEUDO_PHY && phydev->mdio.addr != 0)
+		return -ENODEV;
+
+	dev = b53_swconfig_switch_alloc(&phydev->mdio.dev, &b53_mdio_ops, phydev->mdio.bus);
+	if (!dev)
+		return -ENOMEM;
+
+	dev->current_page = 0xff;
+	dev->priv = phydev->mdio.bus;
+	dev->ops = &b53_mdio_ops;
+	dev->pdata = NULL;
+	mutex_init(&dev->reg_mutex);
+
+	ret = b53_swconfig_switch_detect(dev);
+	if (ret)
+		return ret;
+
+	linkmode_zero(phydev->supported);
+	if (is5325(dev) || is5365(dev))
+		linkmode_set_bit(ETHTOOL_LINK_MODE_100baseT_Full_BIT, phydev->supported);
+	else
+		linkmode_set_bit(ETHTOOL_LINK_MODE_1000baseT_Full_BIT, phydev->supported);
+
+	linkmode_copy(phydev->advertising, phydev->supported);
+
+	ret = b53_swconfig_switch_register(dev);
+	if (ret) {
+		dev_err(dev->dev, "failed to register switch: %i\n", ret);
+		return ret;
+	}
+
+	phydev->priv = dev;
+
+	return 0;
+}
+
+static int b53_phy_config_init(struct phy_device *phydev)
+{
+	struct b53_device *dev = phydev->priv;
+
+	/* we don't use page 0xff, so force a page set */
+	dev->current_page = 0xff;
+	/* force the ethX as alias */
+	dev->sw_dev.alias = phydev->attached_dev->name;
+
+	return 0;
+}
+
+static void b53_phy_remove(struct phy_device *phydev)
+{
+	struct b53_device *priv = phydev->priv;
+
+	if (!priv)
+		return;
+
+	b53_switch_remove(priv);
+
+	phydev->priv = NULL;
+}
+
+static int b53_phy_config_aneg(struct phy_device *phydev)
+{
+	return 0;
+}
+
+static int b53_phy_read_status(struct phy_device *phydev)
+{
+	struct b53_device *priv = phydev->priv;
+
+	if (is5325(priv) || is5365(priv))
+		phydev->speed = 100;
+	else
+		phydev->speed = 1000;
+
+	phydev->duplex = DUPLEX_FULL;
+	phydev->link = 1;
+	phydev->state = PHY_RUNNING;
+
+	netif_carrier_on(phydev->attached_dev);
+	phydev->adjust_link(phydev->attached_dev);
+
+	return 0;
+}
+
+/* BCM5325, BCM539x */
+static struct phy_driver b53_phy_driver_id1 = {
+	.phy_id		= 0x0143bc00,
+	.name		= "Broadcom B53 (1)",
+	.phy_id_mask	= 0x1ffffc00,
+	.features	= 0,
+	.probe		= b53_phy_probe,
+	.remove		= b53_phy_remove,
+	.config_aneg	= b53_phy_config_aneg,
+	.config_init	= b53_phy_config_init,
+	.read_status	= b53_phy_read_status,
+};
+
+/* BCM53125, BCM53128 */
+static struct phy_driver b53_phy_driver_id2 = {
+	.phy_id		= 0x03625c00,
+	.name		= "Broadcom B53 (2)",
+	.phy_id_mask	= 0x1ffffc00,
+	.features	= 0,
+	.probe		= b53_phy_probe,
+	.remove		= b53_phy_remove,
+	.config_aneg	= b53_phy_config_aneg,
+	.config_init	= b53_phy_config_init,
+	.read_status	= b53_phy_read_status,
+};
+
+/* BCM5365 */
+static struct phy_driver b53_phy_driver_id3 = {
+	.phy_id		= 0x00406300,
+	.name		= "Broadcom B53 (3)",
+	.phy_id_mask	= 0x1fffff00,
+	.features	= 0,
+	.probe		= b53_phy_probe,
+	.remove		= b53_phy_remove,
+	.config_aneg	= b53_phy_config_aneg,
+	.config_init	= b53_phy_config_init,
+	.read_status	= b53_phy_read_status,
+};
+
+int __init b53_phy_driver_register(void)
+{
+	int ret;
+
+	ret = phy_driver_register(&b53_phy_driver_id1, THIS_MODULE);
+	if (ret)
+		return ret;
+
+	ret = phy_driver_register(&b53_phy_driver_id2, THIS_MODULE);
+	if (ret)
+		goto err1;
+
+	ret = phy_driver_register(&b53_phy_driver_id3, THIS_MODULE);
+	if (!ret)
+		return 0;
+
+	phy_driver_unregister(&b53_phy_driver_id2);
+err1:
+	phy_driver_unregister(&b53_phy_driver_id1);
+	return ret;
+}
+
+void __exit b53_phy_driver_unregister(void)
+{
+	phy_driver_unregister(&b53_phy_driver_id3);
+	phy_driver_unregister(&b53_phy_driver_id2);
+	phy_driver_unregister(&b53_phy_driver_id1);
+}
+
+module_init(b53_phy_driver_register);
+module_exit(b53_phy_driver_unregister);
+
+MODULE_DESCRIPTION("B53 MDIO access driver");
+MODULE_LICENSE("Dual BSD/GPL");
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/b53/b53_mmap.c b/6.12/target/linux/generic/files/drivers/net/phy/b53/b53_mmap.c
new file mode 100644
index 00000000..241ba0f7
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/b53/b53_mmap.c
@@ -0,0 +1,248 @@
+/*
+ * B53 register access through memory mapped registers
+ *
+ * Copyright (C) 2012-2013 Jonas Gorski <jogo@openwrt.org>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/platform_data/b53.h>
+#include <linux/version.h>
+
+#include "b53_priv.h"
+
+static int b53_mmap_read8(struct b53_device *dev, u8 page, u8 reg, u8 *val)
+{
+	u8 __iomem *regs = dev->priv;
+
+	*val = readb(regs + (page << 8) + reg);
+
+	return 0;
+}
+
+static int b53_mmap_read16(struct b53_device *dev, u8 page, u8 reg, u16 *val)
+{
+	u8 __iomem *regs = dev->priv;
+
+	if (WARN_ON(reg % 2))
+		return -EINVAL;
+
+	if (dev->pdata && dev->pdata->big_endian)
+		*val = readw_be(regs + (page << 8) + reg);
+	else
+		*val = readw(regs + (page << 8) + reg);
+
+	return 0;
+}
+
+static int b53_mmap_read32(struct b53_device *dev, u8 page, u8 reg, u32 *val)
+{
+	u8 __iomem *regs = dev->priv;
+
+	if (WARN_ON(reg % 4))
+		return -EINVAL;
+
+	if (dev->pdata && dev->pdata->big_endian)
+		*val = readl_be(regs + (page << 8) + reg);
+	else
+		*val = readl(regs + (page << 8) + reg);
+
+	return 0;
+}
+
+static int b53_mmap_read48(struct b53_device *dev, u8 page, u8 reg, u64 *val)
+{
+	if (WARN_ON(reg % 2))
+		return -EINVAL;
+
+	if (reg % 4) {
+		u16 lo;
+		u32 hi;
+
+		b53_mmap_read16(dev, page, reg, &lo);
+		b53_mmap_read32(dev, page, reg + 2, &hi);
+
+		*val = ((u64)hi << 16) | lo;
+	} else {
+		u32 lo;
+		u16 hi;
+
+		b53_mmap_read32(dev, page, reg, &lo);
+		b53_mmap_read16(dev, page, reg + 4, &hi);
+
+		*val = ((u64)hi << 32) | lo;
+	}
+
+	return 0;
+}
+
+static int b53_mmap_read64(struct b53_device *dev, u8 page, u8 reg, u64 *val)
+{
+	u32 hi, lo;
+
+	if (WARN_ON(reg % 4))
+		return -EINVAL;
+
+	b53_mmap_read32(dev, page, reg, &lo);
+	b53_mmap_read32(dev, page, reg + 4, &hi);
+
+	*val = ((u64)hi << 32) | lo;
+
+	return 0;
+}
+
+static int b53_mmap_write8(struct b53_device *dev, u8 page, u8 reg, u8 value)
+{
+	u8 __iomem *regs = dev->priv;
+
+	writeb(value, regs + (page << 8) + reg);
+
+	return 0;
+}
+
+static int b53_mmap_write16(struct b53_device *dev, u8 page, u8 reg,
+			     u16 value)
+{
+	u8 __iomem *regs = dev->priv;
+
+	if (WARN_ON(reg % 2))
+		return -EINVAL;
+
+	if (dev->pdata && dev->pdata->big_endian)
+		writew_be(value, regs + (page << 8) + reg);
+	else
+		writew(value, regs + (page << 8) + reg);
+
+	return 0;
+}
+
+static int b53_mmap_write32(struct b53_device *dev, u8 page, u8 reg,
+				    u32 value)
+{
+	u8 __iomem *regs = dev->priv;
+
+	if (WARN_ON(reg % 4))
+		return -EINVAL;
+
+	if (dev->pdata && dev->pdata->big_endian)
+		writel_be(value, regs + (page << 8) + reg);
+	else
+		writel(value, regs + (page << 8) + reg);
+
+	return 0;
+}
+
+static int b53_mmap_write48(struct b53_device *dev, u8 page, u8 reg,
+				    u64 value)
+{
+	if (WARN_ON(reg % 2))
+		return -EINVAL;
+
+	if (reg % 4) {
+		u32 hi = (u32)(value >> 16);
+		u16 lo = (u16)value;
+
+		b53_mmap_write16(dev, page, reg, lo);
+		b53_mmap_write32(dev, page, reg + 2, hi);
+	} else {
+		u16 hi = (u16)(value >> 32);
+		u32 lo = (u32)value;
+
+		b53_mmap_write32(dev, page, reg, lo);
+		b53_mmap_write16(dev, page, reg + 4, hi);
+	}
+
+	return 0;
+}
+
+static int b53_mmap_write64(struct b53_device *dev, u8 page, u8 reg,
+			     u64 value)
+{
+	u32 hi, lo;
+
+	hi = (u32)(value >> 32);
+	lo = (u32)value;
+
+	if (WARN_ON(reg % 4))
+		return -EINVAL;
+
+	b53_mmap_write32(dev, page, reg, lo);
+	b53_mmap_write32(dev, page, reg + 4, hi);
+
+	return 0;
+}
+
+static struct b53_io_ops b53_mmap_ops = {
+	.read8 = b53_mmap_read8,
+	.read16 = b53_mmap_read16,
+	.read32 = b53_mmap_read32,
+	.read48 = b53_mmap_read48,
+	.read64 = b53_mmap_read64,
+	.write8 = b53_mmap_write8,
+	.write16 = b53_mmap_write16,
+	.write32 = b53_mmap_write32,
+	.write48 = b53_mmap_write48,
+	.write64 = b53_mmap_write64,
+};
+
+static int b53_mmap_probe(struct platform_device *pdev)
+{
+	struct b53_platform_data *pdata = pdev->dev.platform_data;
+	struct b53_device *dev;
+
+	if (!pdata)
+		return -EINVAL;
+
+	dev = b53_swconfig_switch_alloc(&pdev->dev, &b53_mmap_ops, pdata->regs);
+	if (!dev)
+		return -ENOMEM;
+
+	if (pdata)
+		dev->pdata = pdata;
+
+	platform_set_drvdata(pdev, dev);
+
+	return b53_swconfig_switch_register(dev);
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6,11,0)
+static int b53_mmap_remove(struct platform_device *pdev)
+#else
+static void b53_mmap_remove(struct platform_device *pdev)
+#endif
+{
+	struct b53_device *dev = platform_get_drvdata(pdev);
+
+	if (dev)
+		b53_switch_remove(dev);
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6,11,0)
+	return 0;
+#endif
+}
+
+static struct platform_driver b53_mmap_driver = {
+	.probe = b53_mmap_probe,
+	.remove = b53_mmap_remove,
+	.driver = {
+		.name = "b53-switch",
+	},
+};
+
+module_platform_driver(b53_mmap_driver);
+MODULE_AUTHOR("Jonas Gorski <jogo@openwrt.org>");
+MODULE_DESCRIPTION("B53 MMAP access driver");
+MODULE_LICENSE("Dual BSD/GPL");
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/b53/b53_phy_fixup.c b/6.12/target/linux/generic/files/drivers/net/phy/b53/b53_phy_fixup.c
new file mode 100644
index 00000000..a19eccef
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/b53/b53_phy_fixup.c
@@ -0,0 +1,55 @@
+/*
+ * B53 PHY Fixup call
+ *
+ * Copyright (C) 2013 Jonas Gorski <jogo@openwrt.org>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/phy.h>
+
+#define B53_PSEUDO_PHY	0x1e /* Register Access Pseudo PHY */
+
+#define B53_BRCM_OUI_1	0x0143bc00
+#define B53_BRCM_OUI_2	0x03625c00
+#define B53_BRCM_OUI_3	0x00406300
+
+static int b53_phy_fixup(struct phy_device *dev)
+{
+	struct mii_bus *bus = dev->mdio.bus;
+	u32 phy_id;
+
+	if (dev->mdio.addr != B53_PSEUDO_PHY)
+		return 0;
+
+	/* read the first port's id */
+	phy_id = mdiobus_read(bus, 0, 2) << 16;
+	phy_id |= mdiobus_read(bus, 0, 3);
+
+	if ((phy_id & 0xfffffc00) == B53_BRCM_OUI_1 ||
+	    (phy_id & 0xfffffc00) == B53_BRCM_OUI_2 ||
+	    (phy_id & 0xffffff00) == B53_BRCM_OUI_3) {
+		dev->phy_id = phy_id;
+	}
+
+	return 0;
+}
+
+int __init b53_phy_fixup_register(void)
+{
+	return phy_register_fixup_for_id(PHY_ANY_ID, b53_phy_fixup);
+}
+
+subsys_initcall(b53_phy_fixup_register);
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/b53/b53_priv.h b/6.12/target/linux/generic/files/drivers/net/phy/b53/b53_priv.h
new file mode 100644
index 00000000..e455c755
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/b53/b53_priv.h
@@ -0,0 +1,336 @@
+/*
+ * B53 common definitions
+ *
+ * Copyright (C) 2011-2013 Jonas Gorski <jogo@openwrt.org>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef __B53_PRIV_H
+#define __B53_PRIV_H
+
+#include <linux/kernel.h>
+#include <linux/mutex.h>
+#include <linux/switch.h>
+
+struct b53_device;
+
+struct b53_io_ops {
+	int (*read8)(struct b53_device *dev, u8 page, u8 reg, u8 *value);
+	int (*read16)(struct b53_device *dev, u8 page, u8 reg, u16 *value);
+	int (*read32)(struct b53_device *dev, u8 page, u8 reg, u32 *value);
+	int (*read48)(struct b53_device *dev, u8 page, u8 reg, u64 *value);
+	int (*read64)(struct b53_device *dev, u8 page, u8 reg, u64 *value);
+	int (*write8)(struct b53_device *dev, u8 page, u8 reg, u8 value);
+	int (*write16)(struct b53_device *dev, u8 page, u8 reg, u16 value);
+	int (*write32)(struct b53_device *dev, u8 page, u8 reg, u32 value);
+	int (*write48)(struct b53_device *dev, u8 page, u8 reg, u64 value);
+	int (*write64)(struct b53_device *dev, u8 page, u8 reg, u64 value);
+	int (*phy_read16)(struct b53_device *dev, int addr, u8 reg, u16 *value);
+	int (*phy_write16)(struct b53_device *dev, int addr, u8 reg, u16 value);
+};
+
+enum {
+	BCM5325_DEVICE_ID = 0x25,
+	BCM5365_DEVICE_ID = 0x65,
+	BCM5395_DEVICE_ID = 0x95,
+	BCM5397_DEVICE_ID = 0x97,
+	BCM5398_DEVICE_ID = 0x98,
+	BCM53115_DEVICE_ID = 0x53115,
+	BCM53125_DEVICE_ID = 0x53125,
+	BCM53128_DEVICE_ID = 0x53128,
+	BCM63XX_DEVICE_ID = 0x6300,
+	BCM53010_DEVICE_ID = 0x53010,
+	BCM53011_DEVICE_ID = 0x53011,
+	BCM53012_DEVICE_ID = 0x53012,
+	BCM53018_DEVICE_ID = 0x53018,
+	BCM53019_DEVICE_ID = 0x53019,
+};
+
+#define B53_N_PORTS	9
+#define B53_N_PORTS_25	6
+
+struct b53_vlan {
+	unsigned int	members:B53_N_PORTS;
+	unsigned int	untag:B53_N_PORTS;
+};
+
+struct b53_port {
+	unsigned int	pvid:12;
+};
+
+struct b53_device {
+	struct switch_dev sw_dev;
+	struct b53_platform_data *pdata;
+
+	struct mutex reg_mutex;
+	const struct b53_io_ops *ops;
+
+	/* chip specific data */
+	u32 chip_id;
+	u8 core_rev;
+	u8 vta_regs[3];
+	u8 duplex_reg;
+	u8 jumbo_pm_reg;
+	u8 jumbo_size_reg;
+	int reset_gpio;
+
+	/* used ports mask */
+	u16 enabled_ports;
+
+	/* connect specific data */
+	u8 current_page;
+	struct device *dev;
+	void *priv;
+
+	/* run time configuration */
+	unsigned enable_vlan:1;
+	unsigned enable_jumbo:1;
+	unsigned allow_vid_4095:1;
+
+	struct b53_port *ports;
+	struct b53_vlan *vlans;
+
+	char *buf;
+};
+
+#define b53_for_each_port(dev, i) \
+	for (i = 0; i < B53_N_PORTS; i++) \
+		if (dev->enabled_ports & BIT(i))
+
+
+
+static inline int is5325(struct b53_device *dev)
+{
+	return dev->chip_id == BCM5325_DEVICE_ID;
+}
+
+static inline int is5365(struct b53_device *dev)
+{
+#ifdef CONFIG_BCM47XX
+	return dev->chip_id == BCM5365_DEVICE_ID;
+#else
+	return 0;
+#endif
+}
+
+static inline int is5397_98(struct b53_device *dev)
+{
+	return dev->chip_id == BCM5397_DEVICE_ID ||
+		dev->chip_id == BCM5398_DEVICE_ID;
+}
+
+static inline int is539x(struct b53_device *dev)
+{
+	return dev->chip_id == BCM5395_DEVICE_ID ||
+		dev->chip_id == BCM5397_DEVICE_ID ||
+		dev->chip_id == BCM5398_DEVICE_ID;
+}
+
+static inline int is531x5(struct b53_device *dev)
+{
+	return dev->chip_id == BCM53115_DEVICE_ID ||
+		dev->chip_id == BCM53125_DEVICE_ID ||
+		dev->chip_id == BCM53128_DEVICE_ID;
+}
+
+static inline int is63xx(struct b53_device *dev)
+{
+#ifdef CONFIG_BCM63XX
+	return dev->chip_id == BCM63XX_DEVICE_ID;
+#else
+	return 0;
+#endif
+}
+
+static inline int is5301x(struct b53_device *dev)
+{
+	return dev->chip_id == BCM53010_DEVICE_ID ||
+		dev->chip_id == BCM53011_DEVICE_ID ||
+		dev->chip_id == BCM53012_DEVICE_ID ||
+		dev->chip_id == BCM53018_DEVICE_ID ||
+		dev->chip_id == BCM53019_DEVICE_ID;
+}
+
+#define B53_CPU_PORT_25	5
+#define B53_CPU_PORT	8
+
+static inline int is_cpu_port(struct b53_device *dev, int port)
+{
+	return dev->sw_dev.cpu_port == port;
+}
+
+static inline int is_imp_port(struct b53_device *dev, int port)
+{
+	if (is5325(dev) || is5365(dev))
+		return port == B53_CPU_PORT_25;
+	else
+		return port == B53_CPU_PORT;
+}
+
+static inline struct b53_device *sw_to_b53(struct switch_dev *sw)
+{
+	return container_of(sw, struct b53_device, sw_dev);
+}
+
+struct b53_device *b53_swconfig_switch_alloc(struct device *base, struct b53_io_ops *ops,
+					     void *priv);
+
+int b53_swconfig_switch_detect(struct b53_device *dev);
+
+int b53_swconfig_switch_register(struct b53_device *dev);
+
+static inline void b53_switch_remove(struct b53_device *dev)
+{
+	unregister_switch(&dev->sw_dev);
+}
+
+static inline int b53_read8(struct b53_device *dev, u8 page, u8 reg, u8 *val)
+{
+	int ret;
+
+	mutex_lock(&dev->reg_mutex);
+	ret = dev->ops->read8(dev, page, reg, val);
+	mutex_unlock(&dev->reg_mutex);
+
+	return ret;
+}
+
+static inline int b53_read16(struct b53_device *dev, u8 page, u8 reg, u16 *val)
+{
+	int ret;
+
+	mutex_lock(&dev->reg_mutex);
+	ret = dev->ops->read16(dev, page, reg, val);
+	mutex_unlock(&dev->reg_mutex);
+
+	return ret;
+}
+
+static inline int b53_read32(struct b53_device *dev, u8 page, u8 reg, u32 *val)
+{
+	int ret;
+
+	mutex_lock(&dev->reg_mutex);
+	ret = dev->ops->read32(dev, page, reg, val);
+	mutex_unlock(&dev->reg_mutex);
+
+	return ret;
+}
+
+static inline int b53_read48(struct b53_device *dev, u8 page, u8 reg, u64 *val)
+{
+	int ret;
+
+	mutex_lock(&dev->reg_mutex);
+	ret = dev->ops->read48(dev, page, reg, val);
+	mutex_unlock(&dev->reg_mutex);
+
+	return ret;
+}
+
+static inline int b53_read64(struct b53_device *dev, u8 page, u8 reg, u64 *val)
+{
+	int ret;
+
+	mutex_lock(&dev->reg_mutex);
+	ret = dev->ops->read64(dev, page, reg, val);
+	mutex_unlock(&dev->reg_mutex);
+
+	return ret;
+}
+
+static inline int b53_write8(struct b53_device *dev, u8 page, u8 reg, u8 value)
+{
+	int ret;
+
+	mutex_lock(&dev->reg_mutex);
+	ret = dev->ops->write8(dev, page, reg, value);
+	mutex_unlock(&dev->reg_mutex);
+
+	return ret;
+}
+
+static inline int b53_write16(struct b53_device *dev, u8 page, u8 reg,
+			      u16 value)
+{
+	int ret;
+
+	mutex_lock(&dev->reg_mutex);
+	ret = dev->ops->write16(dev, page, reg, value);
+	mutex_unlock(&dev->reg_mutex);
+
+	return ret;
+}
+
+static inline int b53_write32(struct b53_device *dev, u8 page, u8 reg,
+			      u32 value)
+{
+	int ret;
+
+	mutex_lock(&dev->reg_mutex);
+	ret = dev->ops->write32(dev, page, reg, value);
+	mutex_unlock(&dev->reg_mutex);
+
+	return ret;
+}
+
+static inline int b53_write48(struct b53_device *dev, u8 page, u8 reg,
+			      u64 value)
+{
+	int ret;
+
+	mutex_lock(&dev->reg_mutex);
+	ret = dev->ops->write48(dev, page, reg, value);
+	mutex_unlock(&dev->reg_mutex);
+
+	return ret;
+}
+
+static inline int b53_write64(struct b53_device *dev, u8 page, u8 reg,
+			       u64 value)
+{
+	int ret;
+
+	mutex_lock(&dev->reg_mutex);
+	ret = dev->ops->write64(dev, page, reg, value);
+	mutex_unlock(&dev->reg_mutex);
+
+	return ret;
+}
+
+#ifdef CONFIG_BCM47XX
+#include <bcm47xx_board.h>
+#endif
+
+#include <linux/version.h>
+#include <linux/bcm47xx_nvram.h>
+
+static inline int b53_switch_get_reset_gpio(struct b53_device *dev)
+{
+#ifdef CONFIG_BCM47XX
+	enum bcm47xx_board board = bcm47xx_board_get();
+
+	switch (board) {
+	case BCM47XX_BOARD_LINKSYS_WRT300NV11:
+	case BCM47XX_BOARD_LINKSYS_WRT310NV1:
+		return 8;
+	default:
+		break;
+	}
+#endif
+
+	return bcm47xx_nvram_gpio_pin("robo_reset");
+}
+
+#endif
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/b53/b53_regs.h b/6.12/target/linux/generic/files/drivers/net/phy/b53/b53_regs.h
new file mode 100644
index 00000000..f0bf6744
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/b53/b53_regs.h
@@ -0,0 +1,348 @@
+/*
+ * B53 register definitions
+ *
+ * Copyright (C) 2004 Broadcom Corporation
+ * Copyright (C) 2011-2013 Jonas Gorski <jogo@openwrt.org>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef __B53_REGS_H
+#define __B53_REGS_H
+
+/* Management Port (SMP) Page offsets */
+#define B53_CTRL_PAGE			0x00 /* Control */
+#define B53_STAT_PAGE			0x01 /* Status */
+#define B53_MGMT_PAGE			0x02 /* Management Mode */
+#define B53_MIB_AC_PAGE			0x03 /* MIB Autocast */
+#define B53_ARLCTRL_PAGE		0x04 /* ARL Control */
+#define B53_ARLIO_PAGE			0x05 /* ARL Access */
+#define B53_FRAMEBUF_PAGE		0x06 /* Management frame access */
+#define B53_MEM_ACCESS_PAGE		0x08 /* Memory access */
+
+/* PHY Registers */
+#define B53_PORT_MII_PAGE(i)		(0x10 + (i)) /* Port i MII Registers */
+#define B53_IM_PORT_PAGE		0x18 /* Inverse MII Port (to EMAC) */
+#define B53_ALL_PORT_PAGE		0x19 /* All ports MII (broadcast) */
+
+/* MIB registers */
+#define B53_MIB_PAGE(i)			(0x20 + (i))
+
+/* Quality of Service (QoS) Registers */
+#define B53_QOS_PAGE			0x30
+
+/* Port VLAN Page */
+#define B53_PVLAN_PAGE			0x31
+
+/* VLAN Registers */
+#define B53_VLAN_PAGE			0x34
+
+/* Jumbo Frame Registers */
+#define B53_JUMBO_PAGE			0x40
+
+/* CFP Configuration Registers Page */
+#define B53_CFP_PAGE			0xa1
+
+/*************************************************************************
+ * Control Page registers
+ *************************************************************************/
+
+/* Port Control Register (8 bit) */
+#define B53_PORT_CTRL(i)		(0x00 + (i))
+#define   PORT_CTRL_RX_DISABLE		BIT(0)
+#define   PORT_CTRL_TX_DISABLE		BIT(1)
+#define   PORT_CTRL_RX_BCST_EN		BIT(2) /* Broadcast RX (P8 only) */
+#define   PORT_CTRL_RX_MCST_EN		BIT(3) /* Multicast RX (P8 only) */
+#define   PORT_CTRL_RX_UCST_EN		BIT(4) /* Unicast RX (P8 only) */
+#define	  PORT_CTRL_STP_STATE_S		5
+#define   PORT_CTRL_STP_STATE_MASK	(0x7 << PORT_CTRL_STP_STATE_S)
+
+/* SMP Control Register (8 bit) */
+#define B53_SMP_CTRL			0x0a
+
+/* Switch Mode Control Register (8 bit) */
+#define B53_SWITCH_MODE			0x0b
+#define   SM_SW_FWD_MODE		BIT(0)	/* 1 = Managed Mode */
+#define   SM_SW_FWD_EN			BIT(1)	/* Forwarding Enable */
+
+/* IMP Port state override register (8 bit) */
+#define B53_PORT_OVERRIDE_CTRL		0x0e
+#define   PORT_OVERRIDE_LINK		BIT(0)
+#define   PORT_OVERRIDE_FULL_DUPLEX	BIT(1) /* 0 = Half Duplex */
+#define   PORT_OVERRIDE_SPEED_S		2
+#define   PORT_OVERRIDE_SPEED_10M	(0 << PORT_OVERRIDE_SPEED_S)
+#define   PORT_OVERRIDE_SPEED_100M	(1 << PORT_OVERRIDE_SPEED_S)
+#define   PORT_OVERRIDE_SPEED_1000M	(2 << PORT_OVERRIDE_SPEED_S)
+#define   PORT_OVERRIDE_RV_MII_25	BIT(4) /* BCM5325 only */
+#define   PORT_OVERRIDE_RX_FLOW		BIT(4)
+#define   PORT_OVERRIDE_TX_FLOW		BIT(5)
+#define   PORT_OVERRIDE_SPEED_2000M	BIT(6) /* BCM5301X only, requires setting 1000M */
+#define   PORT_OVERRIDE_EN		BIT(7) /* Use the register contents */
+
+/* Power-down mode control */
+#define B53_PD_MODE_CTRL_25		0x0f
+
+/* IP Multicast control (8 bit) */
+#define B53_IP_MULTICAST_CTRL		0x21
+#define  B53_IPMC_FWD_EN		BIT(1)
+#define  B53_UC_FWD_EN			BIT(6)
+#define  B53_MC_FWD_EN			BIT(7)
+
+/* (16 bit) */
+#define B53_UC_FLOOD_MASK		0x32
+#define B53_MC_FLOOD_MASK		0x34
+#define B53_IPMC_FLOOD_MASK		0x36
+
+/*
+ * Override Ports 0-7 State on devices with xMII interfaces (8 bit)
+ *
+ * For port 8 still use B53_PORT_OVERRIDE_CTRL
+ * Please note that not all ports are available on every hardware, e.g. BCM5301X
+ * don't include overriding port 6, BCM63xx also have some limitations.
+ */
+#define B53_GMII_PORT_OVERRIDE_CTRL(i)	(0x58 + (i))
+#define   GMII_PO_LINK			BIT(0)
+#define   GMII_PO_FULL_DUPLEX		BIT(1) /* 0 = Half Duplex */
+#define   GMII_PO_SPEED_S		2
+#define   GMII_PO_SPEED_10M		(0 << GMII_PO_SPEED_S)
+#define   GMII_PO_SPEED_100M		(1 << GMII_PO_SPEED_S)
+#define   GMII_PO_SPEED_1000M		(2 << GMII_PO_SPEED_S)
+#define   GMII_PO_RX_FLOW		BIT(4)
+#define   GMII_PO_TX_FLOW		BIT(5)
+#define   GMII_PO_EN			BIT(6) /* Use the register contents */
+#define   GMII_PO_SPEED_2000M		BIT(7) /* BCM5301X only, requires setting 1000M */
+
+/* Software reset register (8 bit) */
+#define B53_SOFTRESET			0x79
+
+/* Fast Aging Control register (8 bit) */
+#define B53_FAST_AGE_CTRL		0x88
+#define   FAST_AGE_STATIC		BIT(0)
+#define   FAST_AGE_DYNAMIC		BIT(1)
+#define   FAST_AGE_PORT			BIT(2)
+#define   FAST_AGE_VLAN			BIT(3)
+#define   FAST_AGE_STP			BIT(4)
+#define   FAST_AGE_MC			BIT(5)
+#define   FAST_AGE_DONE			BIT(7)
+
+/*************************************************************************
+ * Status Page registers
+ *************************************************************************/
+
+/* Link Status Summary Register (16bit) */
+#define B53_LINK_STAT			0x00
+
+/* Link Status Change Register (16 bit) */
+#define B53_LINK_STAT_CHANGE		0x02
+
+/* Port Speed Summary Register (16 bit for FE, 32 bit for GE) */
+#define B53_SPEED_STAT			0x04
+#define  SPEED_PORT_FE(reg, port)	(((reg) >> (port)) & 1)
+#define  SPEED_PORT_GE(reg, port)	(((reg) >> 2 * (port)) & 3)
+#define  SPEED_STAT_10M			0
+#define  SPEED_STAT_100M		1
+#define  SPEED_STAT_1000M		2
+
+/* Duplex Status Summary (16 bit) */
+#define B53_DUPLEX_STAT_FE		0x06
+#define B53_DUPLEX_STAT_GE		0x08
+#define B53_DUPLEX_STAT_63XX		0x0c
+
+/* Revision ID register for BCM5325 */
+#define B53_REV_ID_25			0x50
+
+/* Strap Value (48 bit) */
+#define B53_STRAP_VALUE			0x70
+#define   SV_GMII_CTRL_115		BIT(27)
+
+/*************************************************************************
+ * Management Mode Page Registers
+ *************************************************************************/
+
+/* Global Management Config Register (8 bit) */
+#define B53_GLOBAL_CONFIG		0x00
+#define   GC_RESET_MIB			0x01
+#define   GC_RX_BPDU_EN			0x02
+#define   GC_MIB_AC_HDR_EN		0x10
+#define   GC_MIB_AC_EN			0x20
+#define   GC_FRM_MGMT_PORT_M		0xC0
+#define   GC_FRM_MGMT_PORT_04		0x00
+#define   GC_FRM_MGMT_PORT_MII		0x80
+
+/* Broadcom Header control register (8 bit) */
+#define B53_BRCM_HDR			0x03
+#define   BRCM_HDR_P8_EN		BIT(0) /* Enable tagging on port 8 */
+#define   BRCM_HDR_P5_EN		BIT(1) /* Enable tagging on port 5 */
+
+/* Device ID register (8 or 32 bit) */
+#define B53_DEVICE_ID			0x30
+
+/* Revision ID register (8 bit) */
+#define B53_REV_ID			0x40
+
+/*************************************************************************
+ * ARL Access Page Registers
+ *************************************************************************/
+
+/* VLAN Table Access Register (8 bit) */
+#define B53_VT_ACCESS			0x80
+#define B53_VT_ACCESS_9798		0x60 /* for BCM5397/BCM5398 */
+#define B53_VT_ACCESS_63XX		0x60 /* for BCM6328/62/68 */
+#define   VTA_CMD_WRITE			0
+#define   VTA_CMD_READ			1
+#define   VTA_CMD_CLEAR			2
+#define   VTA_START_CMD			BIT(7)
+
+/* VLAN Table Index Register (16 bit) */
+#define B53_VT_INDEX			0x81
+#define B53_VT_INDEX_9798		0x61
+#define B53_VT_INDEX_63XX		0x62
+
+/* VLAN Table Entry Register (32 bit) */
+#define B53_VT_ENTRY			0x83
+#define B53_VT_ENTRY_9798		0x63
+#define B53_VT_ENTRY_63XX		0x64
+#define   VTE_MEMBERS			0x1ff
+#define   VTE_UNTAG_S			9
+#define   VTE_UNTAG			(0x1ff << 9)
+
+/*************************************************************************
+ * Port VLAN Registers
+ *************************************************************************/
+
+/* Port VLAN mask (16 bit) IMP port is always 8, also on 5325 & co */
+#define B53_PVLAN_PORT_MASK(i)		((i) * 2)
+
+/*************************************************************************
+ * 802.1Q Page Registers
+ *************************************************************************/
+
+/* Global QoS Control (8 bit) */
+#define B53_QOS_GLOBAL_CTL		0x00
+
+/* Enable 802.1Q for individual Ports (16 bit) */
+#define B53_802_1P_EN			0x04
+
+/*************************************************************************
+ * VLAN Page Registers
+ *************************************************************************/
+
+/* VLAN Control 0 (8 bit) */
+#define B53_VLAN_CTRL0			0x00
+#define   VC0_8021PF_CTRL_MASK		0x3
+#define   VC0_8021PF_CTRL_NONE		0x0
+#define   VC0_8021PF_CTRL_CHANGE_PRI	0x1
+#define   VC0_8021PF_CTRL_CHANGE_VID	0x2
+#define   VC0_8021PF_CTRL_CHANGE_BOTH	0x3
+#define   VC0_8021QF_CTRL_MASK		0xc
+#define   VC0_8021QF_CTRL_CHANGE_PRI	0x1
+#define   VC0_8021QF_CTRL_CHANGE_VID	0x2
+#define   VC0_8021QF_CTRL_CHANGE_BOTH	0x3
+#define   VC0_RESERVED_1		BIT(1)
+#define   VC0_DROP_VID_MISS		BIT(4)
+#define   VC0_VID_HASH_VID		BIT(5)
+#define   VC0_VID_CHK_EN		BIT(6)	/* Use VID,DA or VID,SA */
+#define   VC0_VLAN_EN			BIT(7)	/* 802.1Q VLAN Enabled */
+
+/* VLAN Control 1 (8 bit) */
+#define B53_VLAN_CTRL1			0x01
+#define   VC1_RX_MCST_TAG_EN		BIT(1)
+#define   VC1_RX_MCST_FWD_EN		BIT(2)
+#define   VC1_RX_MCST_UNTAG_EN		BIT(3)
+
+/* VLAN Control 2 (8 bit) */
+#define B53_VLAN_CTRL2			0x02
+
+/* VLAN Control 3 (8 bit when BCM5325, 16 bit else) */
+#define B53_VLAN_CTRL3			0x03
+#define B53_VLAN_CTRL3_63XX		0x04
+#define   VC3_MAXSIZE_1532		BIT(6) /* 5325 only */
+#define   VC3_HIGH_8BIT_EN		BIT(7) /* 5325 only */
+
+/* VLAN Control 4 (8 bit) */
+#define B53_VLAN_CTRL4			0x05
+#define B53_VLAN_CTRL4_25		0x04
+#define B53_VLAN_CTRL4_63XX		0x06
+#define   VC4_ING_VID_CHECK_S		6
+#define   VC4_ING_VID_CHECK_MASK	(0x3 << VC4_ING_VID_CHECK_S)
+#define   VC4_ING_VID_VIO_FWD		0 /* forward, but do not learn */
+#define   VC4_ING_VID_VIO_DROP		1 /* drop VID violations */
+#define   VC4_NO_ING_VID_CHK		2 /* do not check */
+#define   VC4_ING_VID_VIO_TO_IMP	3 /* redirect to MII port */
+
+/* VLAN Control 5 (8 bit) */
+#define B53_VLAN_CTRL5			0x06
+#define B53_VLAN_CTRL5_25		0x05
+#define B53_VLAN_CTRL5_63XX		0x07
+#define   VC5_VID_FFF_EN		BIT(2)
+#define   VC5_DROP_VTABLE_MISS		BIT(3)
+
+/* VLAN Control 6 (8 bit) */
+#define B53_VLAN_CTRL6			0x07
+#define B53_VLAN_CTRL6_63XX		0x08
+
+/* VLAN Table Access Register (16 bit) */
+#define B53_VLAN_TABLE_ACCESS_25	0x06	/* BCM5325E/5350 */
+#define B53_VLAN_TABLE_ACCESS_65	0x08	/* BCM5365 */
+#define   VTA_VID_LOW_MASK_25		0xf
+#define   VTA_VID_LOW_MASK_65		0xff
+#define   VTA_VID_HIGH_S_25		4
+#define   VTA_VID_HIGH_S_65		8
+#define   VTA_VID_HIGH_MASK_25		(0xff << VTA_VID_HIGH_S_25E)
+#define   VTA_VID_HIGH_MASK_65		(0xf << VTA_VID_HIGH_S_65)
+#define   VTA_RW_STATE			BIT(12)
+#define   VTA_RW_STATE_RD		0
+#define   VTA_RW_STATE_WR		BIT(12)
+#define   VTA_RW_OP_EN			BIT(13)
+
+/* VLAN Read/Write Registers for (16/32 bit) */
+#define B53_VLAN_WRITE_25		0x08
+#define B53_VLAN_WRITE_65		0x0a
+#define B53_VLAN_READ			0x0c
+#define   VA_MEMBER_MASK		0x3f
+#define   VA_UNTAG_S_25			6
+#define   VA_UNTAG_MASK_25		0x3f
+#define   VA_UNTAG_S_65			7
+#define   VA_UNTAG_MASK_65		0x1f
+#define   VA_VID_HIGH_S			12
+#define   VA_VID_HIGH_MASK		(0xffff << VA_VID_HIGH_S)
+#define   VA_VALID_25			BIT(20)
+#define   VA_VALID_25_R4		BIT(24)
+#define   VA_VALID_65			BIT(14)
+
+/* VLAN Port Default Tag (16 bit) */
+#define B53_VLAN_PORT_DEF_TAG(i)	(0x10 + 2 * (i))
+
+/*************************************************************************
+ * Jumbo Frame Page Registers
+ *************************************************************************/
+
+/* Jumbo Enable Port Mask (bit i == port i enabled) (32 bit) */
+#define B53_JUMBO_PORT_MASK		0x01
+#define B53_JUMBO_PORT_MASK_63XX	0x04
+#define   JPM_10_100_JUMBO_EN		BIT(24) /* GigE always enabled */
+
+/* Good Frame Max Size without 802.1Q TAG (16 bit) */
+#define B53_JUMBO_MAX_SIZE		0x05
+#define B53_JUMBO_MAX_SIZE_63XX		0x08
+#define   JMS_MIN_SIZE			1518
+#define   JMS_MAX_SIZE			9724
+
+/*************************************************************************
+ * CFP Configuration Page Registers
+ *************************************************************************/
+
+/* CFP Control Register with ports map (8 bit) */
+#define B53_CFP_CTRL			0x00
+
+#endif /* !__B53_REGS_H */
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/b53/b53_spi.c b/6.12/target/linux/generic/files/drivers/net/phy/b53/b53_spi.c
new file mode 100644
index 00000000..400454df
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/b53/b53_spi.c
@@ -0,0 +1,344 @@
+/*
+ * B53 register access through SPI
+ *
+ * Copyright (C) 2011-2013 Jonas Gorski <jogo@openwrt.org>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <asm/unaligned.h>
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/spi/spi.h>
+#include <linux/of.h>
+#include <linux/platform_data/b53.h>
+
+#include "b53_priv.h"
+
+#define B53_SPI_DATA		0xf0
+
+#define B53_SPI_STATUS		0xfe
+#define B53_SPI_CMD_SPIF	BIT(7)
+#define B53_SPI_CMD_RACK	BIT(5)
+
+#define B53_SPI_CMD_READ	0x00
+#define B53_SPI_CMD_WRITE	0x01
+#define B53_SPI_CMD_NORMAL	0x60
+#define B53_SPI_CMD_FAST	0x10
+
+#define B53_SPI_PAGE_SELECT	0xff
+
+static inline int b53_spi_read_reg(struct spi_device *spi, u8 reg, u8 *val,
+				     unsigned len)
+{
+	u8 txbuf[2];
+
+	txbuf[0] = B53_SPI_CMD_NORMAL | B53_SPI_CMD_READ;
+	txbuf[1] = reg;
+
+	return spi_write_then_read(spi, txbuf, 2, val, len);
+}
+
+static inline int b53_spi_clear_status(struct spi_device *spi)
+{
+	unsigned int i;
+	u8 rxbuf;
+	int ret;
+
+	for (i = 0; i < 10; i++) {
+		ret = b53_spi_read_reg(spi, B53_SPI_STATUS, &rxbuf, 1);
+		if (ret)
+			return ret;
+
+		if (!(rxbuf & B53_SPI_CMD_SPIF))
+			break;
+
+		mdelay(1);
+	}
+
+	if (i == 10)
+		return -EIO;
+
+	return 0;
+}
+
+static inline int b53_spi_set_page(struct spi_device *spi, u8 page)
+{
+	u8 txbuf[3];
+
+	txbuf[0] = B53_SPI_CMD_NORMAL | B53_SPI_CMD_WRITE;
+	txbuf[1] = B53_SPI_PAGE_SELECT;
+	txbuf[2] = page;
+
+	return spi_write(spi, txbuf, sizeof(txbuf));
+}
+
+static inline int b53_prepare_reg_access(struct spi_device *spi, u8 page)
+{
+	int ret = b53_spi_clear_status(spi);
+
+	if (ret)
+		return ret;
+
+	return b53_spi_set_page(spi, page);
+}
+
+static int b53_spi_prepare_reg_read(struct spi_device *spi, u8 reg)
+{
+	u8 rxbuf;
+	int retry_count;
+	int ret;
+
+	ret = b53_spi_read_reg(spi, reg, &rxbuf, 1);
+	if (ret)
+		return ret;
+
+	for (retry_count = 0; retry_count < 10; retry_count++) {
+		ret = b53_spi_read_reg(spi, B53_SPI_STATUS, &rxbuf, 1);
+		if (ret)
+			return ret;
+
+		if (rxbuf & B53_SPI_CMD_RACK)
+			break;
+
+		mdelay(1);
+	}
+
+	if (retry_count == 10)
+		return -EIO;
+
+	return 0;
+}
+
+static int b53_spi_read(struct b53_device *dev, u8 page, u8 reg, u8 *data,
+			unsigned len)
+{
+	struct spi_device *spi = dev->priv;
+	int ret;
+
+	ret = b53_prepare_reg_access(spi, page);
+	if (ret)
+		return ret;
+
+	ret = b53_spi_prepare_reg_read(spi, reg);
+	if (ret)
+		return ret;
+
+	return b53_spi_read_reg(spi, B53_SPI_DATA, data, len);
+}
+
+static int b53_spi_read8(struct b53_device *dev, u8 page, u8 reg, u8 *val)
+{
+	return b53_spi_read(dev, page, reg, val, 1);
+}
+
+static int b53_spi_read16(struct b53_device *dev, u8 page, u8 reg, u16 *val)
+{
+	int ret = b53_spi_read(dev, page, reg, (u8 *)val, 2);
+
+	if (!ret)
+		*val = le16_to_cpu(*val);
+
+	return ret;
+}
+
+static int b53_spi_read32(struct b53_device *dev, u8 page, u8 reg, u32 *val)
+{
+	int ret = b53_spi_read(dev, page, reg, (u8 *)val, 4);
+
+	if (!ret)
+		*val = le32_to_cpu(*val);
+
+	return ret;
+}
+
+static int b53_spi_read48(struct b53_device *dev, u8 page, u8 reg, u64 *val)
+{
+	int ret;
+
+	*val = 0;
+	ret = b53_spi_read(dev, page, reg, (u8 *)val, 6);
+	if (!ret)
+		*val = le64_to_cpu(*val);
+
+	return ret;
+}
+
+static int b53_spi_read64(struct b53_device *dev, u8 page, u8 reg, u64 *val)
+{
+	int ret = b53_spi_read(dev, page, reg, (u8 *)val, 8);
+
+	if (!ret)
+		*val = le64_to_cpu(*val);
+
+	return ret;
+}
+
+static int b53_spi_write8(struct b53_device *dev, u8 page, u8 reg, u8 value)
+{
+	struct spi_device *spi = dev->priv;
+	int ret;
+	u8 txbuf[3];
+
+	ret = b53_prepare_reg_access(spi, page);
+	if (ret)
+		return ret;
+
+	txbuf[0] = B53_SPI_CMD_NORMAL | B53_SPI_CMD_WRITE;
+	txbuf[1] = reg;
+	txbuf[2] = value;
+
+	return spi_write(spi, txbuf, sizeof(txbuf));
+}
+
+static int b53_spi_write16(struct b53_device *dev, u8 page, u8 reg, u16 value)
+{
+	struct spi_device *spi = dev->priv;
+	int ret;
+	u8 txbuf[4];
+
+	ret = b53_prepare_reg_access(spi, page);
+	if (ret)
+		return ret;
+
+	txbuf[0] = B53_SPI_CMD_NORMAL | B53_SPI_CMD_WRITE;
+	txbuf[1] = reg;
+	put_unaligned_le16(value, &txbuf[2]);
+
+	return spi_write(spi, txbuf, sizeof(txbuf));
+}
+
+static int b53_spi_write32(struct b53_device *dev, u8 page, u8 reg, u32 value)
+{
+	struct spi_device *spi = dev->priv;
+	int ret;
+	u8 txbuf[6];
+
+	ret = b53_prepare_reg_access(spi, page);
+	if (ret)
+		return ret;
+
+	txbuf[0] = B53_SPI_CMD_NORMAL | B53_SPI_CMD_WRITE;
+	txbuf[1] = reg;
+	put_unaligned_le32(value, &txbuf[2]);
+
+	return spi_write(spi, txbuf, sizeof(txbuf));
+}
+
+static int b53_spi_write48(struct b53_device *dev, u8 page, u8 reg, u64 value)
+{
+	struct spi_device *spi = dev->priv;
+	int ret;
+	u8 txbuf[10];
+
+	ret = b53_prepare_reg_access(spi, page);
+	if (ret)
+		return ret;
+
+	txbuf[0] = B53_SPI_CMD_NORMAL | B53_SPI_CMD_WRITE;
+	txbuf[1] = reg;
+	put_unaligned_le64(value, &txbuf[2]);
+
+	return spi_write(spi, txbuf, sizeof(txbuf) - 2);
+}
+
+static int b53_spi_write64(struct b53_device *dev, u8 page, u8 reg, u64 value)
+{
+	struct spi_device *spi = dev->priv;
+	int ret;
+	u8 txbuf[10];
+
+	ret = b53_prepare_reg_access(spi, page);
+	if (ret)
+		return ret;
+
+	txbuf[0] = B53_SPI_CMD_NORMAL | B53_SPI_CMD_WRITE;
+	txbuf[1] = reg;
+	put_unaligned_le64(value, &txbuf[2]);
+
+	return spi_write(spi, txbuf, sizeof(txbuf));
+}
+
+static struct b53_io_ops b53_spi_ops = {
+	.read8 = b53_spi_read8,
+	.read16 = b53_spi_read16,
+	.read32 = b53_spi_read32,
+	.read48 = b53_spi_read48,
+	.read64 = b53_spi_read64,
+	.write8 = b53_spi_write8,
+	.write16 = b53_spi_write16,
+	.write32 = b53_spi_write32,
+	.write48 = b53_spi_write48,
+	.write64 = b53_spi_write64,
+};
+
+static int b53_spi_probe(struct spi_device *spi)
+{
+	struct b53_device *dev;
+	int ret;
+
+	dev = b53_swconfig_switch_alloc(&spi->dev, &b53_spi_ops, spi);
+	if (!dev)
+		return -ENOMEM;
+
+	if (spi->dev.platform_data)
+		dev->pdata = spi->dev.platform_data;
+
+	ret = b53_swconfig_switch_register(dev);
+	if (ret)
+		return ret;
+
+	spi_set_drvdata(spi, dev);
+
+	return 0;
+}
+
+static int b53_spi_remove(struct spi_device *spi)
+{
+	struct b53_device *dev = spi_get_drvdata(spi);
+
+	if (dev)
+		b53_switch_remove(dev);
+
+	return 0;
+}
+
+static const struct of_device_id b53_of_match[] = {
+	{ .compatible = "brcm,bcm5325" },
+	{ .compatible = "brcm,bcm53115" },
+	{ .compatible = "brcm,bcm53125" },
+	{ .compatible = "brcm,bcm53128" },
+	{ .compatible = "brcm,bcm5365" },
+	{ .compatible = "brcm,bcm5395" },
+	{ .compatible = "brcm,bcm5397" },
+	{ .compatible = "brcm,bcm5398" },
+	{ /* sentinel */ },
+};
+
+static struct spi_driver b53_spi_driver = {
+	.driver = {
+		.name	= "b53-switch",
+		.bus	= &spi_bus_type,
+		.owner	= THIS_MODULE,
+		.of_match_table = b53_of_match,
+	},
+	.probe	= b53_spi_probe,
+	.remove	= b53_spi_remove,
+};
+
+module_spi_driver(b53_spi_driver);
+
+MODULE_AUTHOR("Jonas Gorski <jogo@openwrt.org>");
+MODULE_DESCRIPTION("B53 SPI access driver");
+MODULE_LICENSE("Dual BSD/GPL");
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/b53/b53_srab.c b/6.12/target/linux/generic/files/drivers/net/phy/b53/b53_srab.c
new file mode 100644
index 00000000..e63a6c09
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/b53/b53_srab.c
@@ -0,0 +1,385 @@
+/*
+ * B53 register access through Switch Register Access Bridge Registers
+ *
+ * Copyright (C) 2013 Hauke Mehrtens <hauke@hauke-m.de>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/platform_data/b53.h>
+#include <linux/version.h>
+
+#include "b53_priv.h"
+
+/* command and status register of the SRAB */
+#define B53_SRAB_CMDSTAT		0x2c
+#define  B53_SRAB_CMDSTAT_RST		BIT(2)
+#define  B53_SRAB_CMDSTAT_WRITE		BIT(1)
+#define  B53_SRAB_CMDSTAT_GORDYN	BIT(0)
+#define  B53_SRAB_CMDSTAT_PAGE		24
+#define  B53_SRAB_CMDSTAT_REG		16
+
+/* high order word of write data to switch registe */
+#define B53_SRAB_WD_H			0x30
+
+/* low order word of write data to switch registe */
+#define B53_SRAB_WD_L			0x34
+
+/* high order word of read data from switch register */
+#define B53_SRAB_RD_H			0x38
+
+/* low order word of read data from switch register */
+#define B53_SRAB_RD_L			0x3c
+
+/* command and status register of the SRAB */
+#define B53_SRAB_CTRLS			0x40
+#define  B53_SRAB_CTRLS_RCAREQ		BIT(3)
+#define  B53_SRAB_CTRLS_RCAGNT		BIT(4)
+#define  B53_SRAB_CTRLS_SW_INIT_DONE	BIT(6)
+
+/* the register captures interrupt pulses from the switch */
+#define B53_SRAB_INTR			0x44
+
+static int b53_srab_request_grant(struct b53_device *dev)
+{
+	u8 __iomem *regs = dev->priv;
+	u32 ctrls;
+	int i;
+
+	ctrls = readl(regs + B53_SRAB_CTRLS);
+	ctrls |= B53_SRAB_CTRLS_RCAREQ;
+	writel(ctrls, regs + B53_SRAB_CTRLS);
+
+	for (i = 0; i < 20; i++) {
+		ctrls = readl(regs + B53_SRAB_CTRLS);
+		if (ctrls & B53_SRAB_CTRLS_RCAGNT)
+			break;
+		usleep_range(10, 100);
+	}
+	if (WARN_ON(i == 5))
+		return -EIO;
+
+	return 0;
+}
+
+static void b53_srab_release_grant(struct b53_device *dev)
+{
+	u8 __iomem *regs = dev->priv;
+	u32 ctrls;
+
+	ctrls = readl(regs + B53_SRAB_CTRLS);
+	ctrls &= ~B53_SRAB_CTRLS_RCAREQ;
+	writel(ctrls, regs + B53_SRAB_CTRLS);
+}
+
+static int b53_srab_op(struct b53_device *dev, u8 page, u8 reg, u32 op)
+{
+	int i;
+	u32 cmdstat;
+	u8 __iomem *regs = dev->priv;
+
+	/* set register address */
+	cmdstat = (page << B53_SRAB_CMDSTAT_PAGE) |
+		  (reg << B53_SRAB_CMDSTAT_REG) |
+		  B53_SRAB_CMDSTAT_GORDYN |
+		  op;
+	writel(cmdstat, regs + B53_SRAB_CMDSTAT);
+
+	/* check if operation completed */
+	for (i = 0; i < 5; ++i) {
+		cmdstat = readl(regs + B53_SRAB_CMDSTAT);
+		if (!(cmdstat & B53_SRAB_CMDSTAT_GORDYN))
+			break;
+		usleep_range(10, 100);
+	}
+
+	if (WARN_ON(i == 5))
+		return -EIO;
+
+	return 0;
+}
+
+static int b53_srab_read8(struct b53_device *dev, u8 page, u8 reg, u8 *val)
+{
+	u8 __iomem *regs = dev->priv;
+	int ret = 0;
+
+	ret = b53_srab_request_grant(dev);
+	if (ret)
+		goto err;
+
+	ret = b53_srab_op(dev, page, reg, 0);
+	if (ret)
+		goto err;
+
+	*val = readl(regs + B53_SRAB_RD_L) & 0xff;
+
+err:
+	b53_srab_release_grant(dev);
+
+	return ret;
+}
+
+static int b53_srab_read16(struct b53_device *dev, u8 page, u8 reg, u16 *val)
+{
+	u8 __iomem *regs = dev->priv;
+	int ret = 0;
+
+	ret = b53_srab_request_grant(dev);
+	if (ret)
+		goto err;
+
+	ret = b53_srab_op(dev, page, reg, 0);
+	if (ret)
+		goto err;
+
+	*val = readl(regs + B53_SRAB_RD_L) & 0xffff;
+
+err:
+	b53_srab_release_grant(dev);
+
+	return ret;
+}
+
+static int b53_srab_read32(struct b53_device *dev, u8 page, u8 reg, u32 *val)
+{
+	u8 __iomem *regs = dev->priv;
+	int ret = 0;
+
+	ret = b53_srab_request_grant(dev);
+	if (ret)
+		goto err;
+
+	ret = b53_srab_op(dev, page, reg, 0);
+	if (ret)
+		goto err;
+
+	*val = readl(regs + B53_SRAB_RD_L);
+
+err:
+	b53_srab_release_grant(dev);
+
+	return ret;
+}
+
+static int b53_srab_read48(struct b53_device *dev, u8 page, u8 reg, u64 *val)
+{
+	u8 __iomem *regs = dev->priv;
+	int ret = 0;
+
+	ret = b53_srab_request_grant(dev);
+	if (ret)
+		goto err;
+
+	ret = b53_srab_op(dev, page, reg, 0);
+	if (ret)
+		goto err;
+
+	*val = readl(regs + B53_SRAB_RD_L);
+	*val += ((u64)readl(regs + B53_SRAB_RD_H) & 0xffff) << 32;
+
+err:
+	b53_srab_release_grant(dev);
+
+	return ret;
+}
+
+static int b53_srab_read64(struct b53_device *dev, u8 page, u8 reg, u64 *val)
+{
+	u8 __iomem *regs = dev->priv;
+	int ret = 0;
+
+	ret = b53_srab_request_grant(dev);
+	if (ret)
+		goto err;
+
+	ret = b53_srab_op(dev, page, reg, 0);
+	if (ret)
+		goto err;
+
+	*val = readl(regs + B53_SRAB_RD_L);
+	*val += (u64)readl(regs + B53_SRAB_RD_H) << 32;
+
+err:
+	b53_srab_release_grant(dev);
+
+	return ret;
+}
+
+static int b53_srab_write8(struct b53_device *dev, u8 page, u8 reg, u8 value)
+{
+	u8 __iomem *regs = dev->priv;
+	int ret = 0;
+
+	ret = b53_srab_request_grant(dev);
+	if (ret)
+		goto err;
+
+	writel(value, regs + B53_SRAB_WD_L);
+
+	ret = b53_srab_op(dev, page, reg, B53_SRAB_CMDSTAT_WRITE);
+
+err:
+	b53_srab_release_grant(dev);
+
+	return ret;
+}
+
+static int b53_srab_write16(struct b53_device *dev, u8 page, u8 reg,
+			     u16 value)
+{
+	u8 __iomem *regs = dev->priv;
+	int ret = 0;
+
+	ret = b53_srab_request_grant(dev);
+	if (ret)
+		goto err;
+
+	writel(value, regs + B53_SRAB_WD_L);
+
+	ret = b53_srab_op(dev, page, reg, B53_SRAB_CMDSTAT_WRITE);
+
+err:
+	b53_srab_release_grant(dev);
+
+	return ret;
+}
+
+static int b53_srab_write32(struct b53_device *dev, u8 page, u8 reg,
+				    u32 value)
+{
+	u8 __iomem *regs = dev->priv;
+	int ret = 0;
+
+	ret = b53_srab_request_grant(dev);
+	if (ret)
+		goto err;
+
+	writel(value, regs + B53_SRAB_WD_L);
+
+	ret = b53_srab_op(dev, page, reg, B53_SRAB_CMDSTAT_WRITE);
+
+err:
+	b53_srab_release_grant(dev);
+
+	return ret;
+
+}
+
+static int b53_srab_write48(struct b53_device *dev, u8 page, u8 reg,
+				    u64 value)
+{
+	u8 __iomem *regs = dev->priv;
+	int ret = 0;
+
+	ret = b53_srab_request_grant(dev);
+	if (ret)
+		goto err;
+
+	writel((u32)value, regs + B53_SRAB_WD_L);
+	writel((u16)(value >> 32), regs + B53_SRAB_WD_H);
+
+	ret = b53_srab_op(dev, page, reg, B53_SRAB_CMDSTAT_WRITE);
+
+err:
+	b53_srab_release_grant(dev);
+
+	return ret;
+
+}
+
+static int b53_srab_write64(struct b53_device *dev, u8 page, u8 reg,
+			     u64 value)
+{
+	u8 __iomem *regs = dev->priv;
+	int ret = 0;
+
+	ret = b53_srab_request_grant(dev);
+	if (ret)
+		goto err;
+
+	writel((u32)value, regs + B53_SRAB_WD_L);
+	writel((u32)(value >> 32), regs + B53_SRAB_WD_H);
+
+	ret = b53_srab_op(dev, page, reg, B53_SRAB_CMDSTAT_WRITE);
+
+err:
+	b53_srab_release_grant(dev);
+
+	return ret;
+}
+
+static struct b53_io_ops b53_srab_ops = {
+	.read8 = b53_srab_read8,
+	.read16 = b53_srab_read16,
+	.read32 = b53_srab_read32,
+	.read48 = b53_srab_read48,
+	.read64 = b53_srab_read64,
+	.write8 = b53_srab_write8,
+	.write16 = b53_srab_write16,
+	.write32 = b53_srab_write32,
+	.write48 = b53_srab_write48,
+	.write64 = b53_srab_write64,
+};
+
+static int b53_srab_probe(struct platform_device *pdev)
+{
+	struct b53_platform_data *pdata = pdev->dev.platform_data;
+	struct b53_device *dev;
+
+	if (!pdata)
+		return -EINVAL;
+
+	dev = b53_swconfig_switch_alloc(&pdev->dev, &b53_srab_ops, pdata->regs);
+	if (!dev)
+		return -ENOMEM;
+
+	if (pdata)
+		dev->pdata = pdata;
+
+	platform_set_drvdata(pdev, dev);
+
+	return b53_swconfig_switch_register(dev);
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6,11,0)
+static int b53_srab_remove(struct platform_device *pdev)
+#else
+static void b53_srab_remove(struct platform_device *pdev)
+#endif
+{
+	struct b53_device *dev = platform_get_drvdata(pdev);
+
+	if (dev)
+		b53_switch_remove(dev);
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6,11,0)
+	return 0;
+#endif
+}
+
+static struct platform_driver b53_srab_driver = {
+	.probe = b53_srab_probe,
+	.remove = b53_srab_remove,
+	.driver = {
+		.name = "b53-srab-switch",
+	},
+};
+
+module_platform_driver(b53_srab_driver);
+MODULE_AUTHOR("Hauke Mehrtens <hauke@hauke-m.de>");
+MODULE_DESCRIPTION("B53 Switch Register Access Bridge Registers (SRAB) access driver");
+MODULE_LICENSE("Dual BSD/GPL");
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/ip17xx.c b/6.12/target/linux/generic/files/drivers/net/phy/ip17xx.c
new file mode 100644
index 00000000..c3698033
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/ip17xx.c
@@ -0,0 +1,1370 @@
+/*
+ * ip17xx.c: Swconfig configuration for IC+ IP17xx switch family
+ *
+ * Copyright (C) 2008 Patrick Horn <patrick.horn@gmail.com>
+ * Copyright (C) 2008, 2010 Martin Mares <mj@ucw.cz>
+ * Copyright (C) 2009 Felix Fietkau <nbd@nbd.name>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.	See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/list.h>
+#include <linux/skbuff.h>
+#include <linux/mii.h>
+#include <linux/phy.h>
+#include <linux/delay.h>
+#include <linux/switch.h>
+#include <linux/device.h>
+
+#define MAX_VLANS 16
+#define MAX_PORTS 9
+#undef DUMP_MII_IO
+
+typedef struct ip17xx_reg {
+	u16 p;			// phy
+	u16 m;			// mii
+} reg;
+typedef char bitnum;
+
+#define NOTSUPPORTED {-1,-1}
+
+#define REG_SUPP(x) (((x).m != ((u16)-1)) && ((x).p != (u16)-1))
+
+struct ip17xx_state;
+
+/*********** CONSTANTS ***********/
+struct register_mappings {
+	char *NAME;
+	u16 MODEL_NO;			// Compare to bits 4-9 of MII register 0,3.
+	bitnum NUM_PORTS;
+	bitnum CPU_PORT;
+
+/* The default VLAN for each port.
+	 Default: 0x0001 for Ports 0,1,2,3
+		  0x0002 for Ports 4,5 */
+	reg VLAN_DEFAULT_TAG_REG[MAX_PORTS];
+
+/* These ports are tagged.
+	 Default: 0x00 */
+	reg ADD_TAG_REG;
+	reg REMOVE_TAG_REG;
+	bitnum ADD_TAG_BIT[MAX_PORTS];
+/* These ports are untagged.
+	 Default: 0x00 (i.e. do not alter any VLAN tags...)
+	 Maybe set to 0 if user disables VLANs. */
+	bitnum REMOVE_TAG_BIT[MAX_PORTS];
+
+/* Port M and Port N are on the same VLAN.
+	 Default: All ports on all VLANs. */
+// Use register {29, 19+N/2}
+	reg VLAN_LOOKUP_REG;
+// Port 5 uses register {30, 18} but same as odd bits.
+	reg VLAN_LOOKUP_REG_5;		// in a different register on IP175C.
+	bitnum VLAN_LOOKUP_EVEN_BIT[MAX_PORTS];
+	bitnum VLAN_LOOKUP_ODD_BIT[MAX_PORTS];
+
+/* This VLAN corresponds to which ports.
+	 Default: 0x2f,0x30,0x3f,0x3f... */
+	reg TAG_VLAN_MASK_REG;
+	bitnum TAG_VLAN_MASK_EVEN_BIT[MAX_PORTS];
+	bitnum TAG_VLAN_MASK_ODD_BIT[MAX_PORTS];
+
+	int RESET_VAL;
+	reg RESET_REG;
+
+	reg MODE_REG;
+	int MODE_VAL;
+
+/* General flags */
+	reg ROUTER_CONTROL_REG;
+	reg VLAN_CONTROL_REG;
+	bitnum TAG_VLAN_BIT;
+	bitnum ROUTER_EN_BIT;
+	bitnum NUMLAN_GROUPS_MAX;
+	bitnum NUMLAN_GROUPS_BIT;
+
+	reg MII_REGISTER_EN;
+	bitnum MII_REGISTER_EN_BIT;
+
+	// set to 1 for 178C, 0 for 175C.
+	bitnum SIMPLE_VLAN_REGISTERS;	// 175C has two vlans per register but 178C has only one.
+
+	// Pointers to functions which manipulate hardware state
+	int (*update_state)(struct ip17xx_state *state);
+	int (*set_vlan_mode)(struct ip17xx_state *state);
+	int (*reset)(struct ip17xx_state *state);
+};
+
+static int ip175c_update_state(struct ip17xx_state *state);
+static int ip175c_set_vlan_mode(struct ip17xx_state *state);
+static int ip175c_reset(struct ip17xx_state *state);
+
+static const struct register_mappings IP178C = {
+	.NAME = "IP178C",
+	.MODEL_NO = 0x18,
+	.VLAN_DEFAULT_TAG_REG = {
+		{30,3},{30,4},{30,5},{30,6},{30,7},{30,8},
+		{30,9},{30,10},{30,11},
+	},
+
+	.ADD_TAG_REG = {30,12},
+	.ADD_TAG_BIT = {0,1,2,3,4,5,6,7,8},
+	.REMOVE_TAG_REG = {30,13},
+	.REMOVE_TAG_BIT = {4,5,6,7,8,9,10,11,12},
+
+	.SIMPLE_VLAN_REGISTERS = 1,
+
+	.VLAN_LOOKUP_REG = {31,0},// +N
+	.VLAN_LOOKUP_REG_5 = NOTSUPPORTED, // not used with SIMPLE_VLAN_REGISTERS
+	.VLAN_LOOKUP_EVEN_BIT = {0,1,2,3,4,5,6,7,8},
+	.VLAN_LOOKUP_ODD_BIT = {0,1,2,3,4,5,6,7,8},
+
+	.TAG_VLAN_MASK_REG = {30,14}, // +N
+	.TAG_VLAN_MASK_EVEN_BIT = {0,1,2,3,4,5,6,7,8},
+	.TAG_VLAN_MASK_ODD_BIT = {0,1,2,3,4,5,6,7,8},
+
+	.RESET_VAL = 0x55AA,
+	.RESET_REG = {30,0},
+	.MODE_VAL = 0,
+	.MODE_REG = NOTSUPPORTED,
+
+	.ROUTER_CONTROL_REG = {30,30},
+	.ROUTER_EN_BIT = 11,
+	.NUMLAN_GROUPS_MAX = 8,
+	.NUMLAN_GROUPS_BIT = 8, // {0-2}
+
+	.VLAN_CONTROL_REG = {30,13},
+	.TAG_VLAN_BIT = 3,
+
+	.CPU_PORT = 8,
+	.NUM_PORTS = 9,
+
+	.MII_REGISTER_EN = NOTSUPPORTED,
+
+	.update_state = ip175c_update_state,
+	.set_vlan_mode = ip175c_set_vlan_mode,
+	.reset = ip175c_reset,
+};
+
+static const struct register_mappings IP175C = {
+	.NAME = "IP175C",
+	.MODEL_NO = 0x18,
+	.VLAN_DEFAULT_TAG_REG = {
+		{29,24},{29,25},{29,26},{29,27},{29,28},{29,30},
+		NOTSUPPORTED,NOTSUPPORTED,NOTSUPPORTED
+	},
+
+	.ADD_TAG_REG = {29,23},
+	.REMOVE_TAG_REG = {29,23},
+	.ADD_TAG_BIT = {11,12,13,14,15,1,-1,-1,-1},
+	.REMOVE_TAG_BIT = {6,7,8,9,10,0,-1,-1,-1},
+
+	.SIMPLE_VLAN_REGISTERS = 0,
+
+	.VLAN_LOOKUP_REG = {29,19},// +N/2
+	.VLAN_LOOKUP_REG_5 = {30,18},
+	.VLAN_LOOKUP_EVEN_BIT = {8,9,10,11,12,15,-1,-1,-1},
+	.VLAN_LOOKUP_ODD_BIT = {0,1,2,3,4,7,-1,-1,-1},
+
+	.TAG_VLAN_MASK_REG = {30,1}, // +N/2
+	.TAG_VLAN_MASK_EVEN_BIT = {0,1,2,3,4,5,-1,-1,-1},
+	.TAG_VLAN_MASK_ODD_BIT = {8,9,10,11,12,13,-1,-1,-1},
+
+	.RESET_VAL = 0x175C,
+	.RESET_REG = {30,0},
+	.MODE_VAL = 0x175C,
+	.MODE_REG = {29,31},
+
+	.ROUTER_CONTROL_REG = {30,9},
+	.ROUTER_EN_BIT = 3,
+	.NUMLAN_GROUPS_MAX = 8,
+	.NUMLAN_GROUPS_BIT = 0, // {0-2}
+
+	.VLAN_CONTROL_REG = {30,9},
+	.TAG_VLAN_BIT = 7,
+
+	.NUM_PORTS = 6,
+	.CPU_PORT = 5,
+
+	.MII_REGISTER_EN = NOTSUPPORTED,
+
+	.update_state = ip175c_update_state,
+	.set_vlan_mode = ip175c_set_vlan_mode,
+	.reset = ip175c_reset,
+};
+
+static const struct register_mappings IP175A = {
+	.NAME = "IP175A",
+	.MODEL_NO = 0x05,
+	.VLAN_DEFAULT_TAG_REG = {
+		{0,24},{0,25},{0,26},{0,27},{0,28},NOTSUPPORTED,
+		NOTSUPPORTED,NOTSUPPORTED,NOTSUPPORTED
+	},
+
+	.ADD_TAG_REG = {0,23},
+	.REMOVE_TAG_REG = {0,23},
+	.ADD_TAG_BIT = {11,12,13,14,15,-1,-1,-1,-1},
+	.REMOVE_TAG_BIT = {6,7,8,9,10,-1,-1,-1,-1},
+
+	.SIMPLE_VLAN_REGISTERS = 0,
+
+	// Only programmable via EEPROM
+	.VLAN_LOOKUP_REG = NOTSUPPORTED,// +N/2
+	.VLAN_LOOKUP_REG_5 = NOTSUPPORTED,
+	.VLAN_LOOKUP_EVEN_BIT = {8,9,10,11,12,-1,-1,-1,-1},
+	.VLAN_LOOKUP_ODD_BIT = {0,1,2,3,4,-1,-1,-1,-1},
+
+	.TAG_VLAN_MASK_REG = NOTSUPPORTED, // +N/2,
+	.TAG_VLAN_MASK_EVEN_BIT = {-1,-1,-1,-1,-1,-1,-1,-1,-1},
+	.TAG_VLAN_MASK_ODD_BIT = {-1,-1,-1,-1,-1,-1,-1,-1,-1},
+
+	.RESET_VAL = -1,
+	.RESET_REG = NOTSUPPORTED,
+	.MODE_VAL = 0,
+	.MODE_REG = NOTSUPPORTED,
+
+	.ROUTER_CONTROL_REG = NOTSUPPORTED,
+	.VLAN_CONTROL_REG = NOTSUPPORTED,
+	.TAG_VLAN_BIT = -1,
+	.ROUTER_EN_BIT = -1,
+	.NUMLAN_GROUPS_MAX = -1,
+	.NUMLAN_GROUPS_BIT = -1, // {0-2}
+
+	.NUM_PORTS = 5,
+	.CPU_PORT = 4,
+
+	.MII_REGISTER_EN = {0, 18},
+	.MII_REGISTER_EN_BIT = 7,
+
+	.update_state = ip175c_update_state,
+	.set_vlan_mode = ip175c_set_vlan_mode,
+	.reset = ip175c_reset,
+};
+
+
+static int ip175d_update_state(struct ip17xx_state *state);
+static int ip175d_set_vlan_mode(struct ip17xx_state *state);
+static int ip175d_reset(struct ip17xx_state *state);
+
+static const struct register_mappings IP175D = {
+	.NAME = "IP175D",
+	.MODEL_NO = 0x18,
+
+	// The IP175D has a completely different interface, so we leave most
+	// of the registers undefined and switch to different code paths.
+
+	.VLAN_DEFAULT_TAG_REG = {
+		NOTSUPPORTED,NOTSUPPORTED,NOTSUPPORTED,NOTSUPPORTED,
+		NOTSUPPORTED,NOTSUPPORTED,NOTSUPPORTED,NOTSUPPORTED,
+	},
+
+	.ADD_TAG_REG = NOTSUPPORTED,
+	.REMOVE_TAG_REG = NOTSUPPORTED,
+
+	.SIMPLE_VLAN_REGISTERS = 0,
+
+	.VLAN_LOOKUP_REG = NOTSUPPORTED,
+	.VLAN_LOOKUP_REG_5 = NOTSUPPORTED,
+	.TAG_VLAN_MASK_REG = NOTSUPPORTED,
+
+	.RESET_VAL = 0x175D,
+	.RESET_REG = {20,2},
+	.MODE_REG = NOTSUPPORTED,
+
+	.ROUTER_CONTROL_REG = NOTSUPPORTED,
+	.ROUTER_EN_BIT = -1,
+	.NUMLAN_GROUPS_BIT = -1,
+
+	.VLAN_CONTROL_REG = NOTSUPPORTED,
+	.TAG_VLAN_BIT = -1,
+
+	.NUM_PORTS = 6,
+	.CPU_PORT = 5,
+
+	.MII_REGISTER_EN = NOTSUPPORTED,
+
+	.update_state = ip175d_update_state,
+	.set_vlan_mode = ip175d_set_vlan_mode,
+	.reset = ip175d_reset,
+};
+
+struct ip17xx_state {
+	struct switch_dev dev;
+	struct mii_bus *mii_bus;
+	bool registered;
+
+	int router_mode;		// ROUTER_EN
+	int vlan_enabled;		// TAG_VLAN_EN
+	struct port_state {
+		u16 pvid;
+		unsigned int shareports;
+	} ports[MAX_PORTS];
+	unsigned int add_tag;
+	unsigned int remove_tag;
+	int num_vlans;
+	struct vlan_state {
+		unsigned int ports;
+		unsigned int tag;	// VLAN tag (IP175D only)
+	} vlans[MAX_VLANS];
+	const struct register_mappings *regs;
+	reg proc_mii; 	// phy/reg for the low level register access via swconfig
+
+	char buf[80];
+};
+
+#define get_state(_dev) container_of((_dev), struct ip17xx_state, dev)
+
+static int ip_phy_read(struct ip17xx_state *state, int port, int reg)
+{
+	int val = mdiobus_read(state->mii_bus, port, reg);
+	if (val < 0)
+		pr_warn("IP17xx: Unable to get MII register %d,%d: error %d\n", port, reg, -val);
+#ifdef DUMP_MII_IO
+	else
+		pr_debug("IP17xx: Read MII(%d,%d) -> %04x\n", port, reg, val);
+#endif
+	return val;
+}
+
+static int ip_phy_write(struct ip17xx_state *state, int port, int reg, u16 val)
+{
+	int err;
+
+#ifdef DUMP_MII_IO
+	pr_debug("IP17xx: Write MII(%d,%d) <- %04x\n", port, reg, val);
+#endif
+	err = mdiobus_write(state->mii_bus, port, reg, val);
+	if (err < 0)
+		pr_warn("IP17xx: Unable to write MII register %d,%d: error %d\n", port, reg, -err);
+	return err;
+}
+
+static int ip_phy_write_masked(struct ip17xx_state *state, int port, int reg, unsigned int mask, unsigned int data)
+{
+	int val = ip_phy_read(state, port, reg);
+	if (val < 0)
+		return 0;
+	return ip_phy_write(state, port, reg, (val & ~mask) | data);
+}
+
+static int getPhy(struct ip17xx_state *state, reg mii)
+{
+	if (!REG_SUPP(mii))
+		return -EFAULT;
+	return ip_phy_read(state, mii.p, mii.m);
+}
+
+static int setPhy(struct ip17xx_state *state, reg mii, u16 value)
+{
+	int err;
+
+	if (!REG_SUPP(mii))
+		return -EFAULT;
+	err = ip_phy_write(state, mii.p, mii.m, value);
+	if (err < 0)
+		return err;
+	mdelay(2);
+	getPhy(state, mii);
+	return 0;
+}
+
+
+/**
+ * These two macros are to simplify the mapping of logical bits to the bits in hardware.
+ * NOTE: these macros will return if there is an error!
+ */
+
+#define GET_PORT_BITS(state, bits, addr, bit_lookup)		\
+	do {							\
+		int i, val = getPhy((state), (addr));		\
+		if (val < 0)					\
+			return val;				\
+		(bits) = 0;					\
+		for (i = 0; i < MAX_PORTS; i++) {		\
+			if ((bit_lookup)[i] == -1) continue;	\
+			if (val & (1<<(bit_lookup)[i]))		\
+				(bits) |= (1<<i);		\
+		}						\
+	} while (0)
+
+#define SET_PORT_BITS(state, bits, addr, bit_lookup)		\
+	do {							\
+		int i, val = getPhy((state), (addr));		\
+		if (val < 0)					\
+			return val;				\
+		for (i = 0; i < MAX_PORTS; i++) {		\
+			unsigned int newmask = ((bits)&(1<<i));	\
+			if ((bit_lookup)[i] == -1) continue;	\
+			val &= ~(1<<(bit_lookup)[i]);		\
+			val |= ((newmask>>i)<<(bit_lookup)[i]);	\
+		}						\
+		val = setPhy((state), (addr), val);		\
+		if (val < 0)					\
+			return val;				\
+	} while (0)
+
+
+static int get_model(struct ip17xx_state *state)
+{
+	int id1, id2;
+	int oui_id, model_no, rev_no, chip_no;
+
+	id1 = ip_phy_read(state, 0, 2);
+	id2 = ip_phy_read(state, 0, 3);
+	oui_id = (id1 << 6) | ((id2 >> 10) & 0x3f);
+	model_no = (id2 >> 4) & 0x3f;
+	rev_no = id2 & 0xf;
+	pr_debug("IP17xx: Identified oui=%06x model=%02x rev=%X\n", oui_id, model_no, rev_no);
+
+	if (oui_id != 0x0090c3)  // No other oui_id should have reached us anyway
+		return -ENODEV;
+
+	if (model_no == IP175A.MODEL_NO) {
+		state->regs = &IP175A;
+	} else if (model_no == IP175C.MODEL_NO) {
+		/*
+		 *  Several models share the same model_no:
+		 *  178C has more PHYs, so we try whether the device responds to a read from PHY5
+		 *  175D has a new chip ID register
+		 *  175C has neither
+		 */
+		if (ip_phy_read(state, 5, 2) == 0x0243) {
+			state->regs = &IP178C;
+		} else {
+			chip_no = ip_phy_read(state, 20, 0);
+			pr_debug("IP17xx: Chip ID register reads %04x\n", chip_no);
+			if (chip_no == 0x175d) {
+				state->regs = &IP175D;
+			} else {
+				state->regs = &IP175C;
+			}
+		}
+	} else {
+		pr_warn("IP17xx: Found an unknown IC+ switch with model number %02x, revision %X.\n", model_no, rev_no);
+		return -EPERM;
+	}
+	return 0;
+}
+
+/*** Low-level functions for the older models ***/
+
+/** Only set vlan and router flags in the switch **/
+static int ip175c_set_flags(struct ip17xx_state *state)
+{
+	int val;
+
+	if (!REG_SUPP(state->regs->ROUTER_CONTROL_REG)) {
+		return 0;
+	}
+
+	val = getPhy(state, state->regs->ROUTER_CONTROL_REG);
+	if (val < 0) {
+		return val;
+	}
+	if (state->regs->ROUTER_EN_BIT >= 0) {
+		if (state->router_mode) {
+			val |= (1<<state->regs->ROUTER_EN_BIT);
+		} else {
+			val &= (~(1<<state->regs->ROUTER_EN_BIT));
+		}
+	}
+	if (state->regs->TAG_VLAN_BIT >= 0) {
+		if (state->vlan_enabled) {
+			val |= (1<<state->regs->TAG_VLAN_BIT);
+		} else {
+			val &= (~(1<<state->regs->TAG_VLAN_BIT));
+		}
+	}
+	if (state->regs->NUMLAN_GROUPS_BIT >= 0) {
+		val &= (~((state->regs->NUMLAN_GROUPS_MAX-1)<<state->regs->NUMLAN_GROUPS_BIT));
+		if (state->num_vlans > state->regs->NUMLAN_GROUPS_MAX) {
+			val |= state->regs->NUMLAN_GROUPS_MAX << state->regs->NUMLAN_GROUPS_BIT;
+		} else if (state->num_vlans >= 1) {
+			val |= (state->num_vlans-1) << state->regs->NUMLAN_GROUPS_BIT;
+		}
+	}
+	return setPhy(state, state->regs->ROUTER_CONTROL_REG, val);
+}
+
+/** Set all VLAN and port state.  Usually you should call "correct_vlan_state" first. **/
+static int ip175c_set_state(struct ip17xx_state *state)
+{
+	int j;
+	int i;
+	SET_PORT_BITS(state, state->add_tag,
+				  state->regs->ADD_TAG_REG, state->regs->ADD_TAG_BIT);
+	SET_PORT_BITS(state, state->remove_tag,
+				  state->regs->REMOVE_TAG_REG, state->regs->REMOVE_TAG_BIT);
+
+	if (REG_SUPP(state->regs->VLAN_LOOKUP_REG)) {
+		for (j=0; j<state->regs->NUM_PORTS; j++) {
+			reg addr;
+			const bitnum *bit_lookup = (j%2==0)?
+				state->regs->VLAN_LOOKUP_EVEN_BIT:
+				state->regs->VLAN_LOOKUP_ODD_BIT;
+
+			addr = state->regs->VLAN_LOOKUP_REG;
+			if (state->regs->SIMPLE_VLAN_REGISTERS) {
+				addr.m += j;
+			} else {
+				switch (j) {
+				case 0:
+				case 1:
+					break;
+				case 2:
+				case 3:
+					addr.m+=1;
+					break;
+				case 4:
+					addr.m+=2;
+					break;
+				case 5:
+					addr = state->regs->VLAN_LOOKUP_REG_5;
+					break;
+				default:
+					addr.m = -1; // shouldn't get here, but...
+					break;
+				}
+			}
+			//printf("shareports for %d is %02X\n",j,state->ports[j].shareports);
+			if (REG_SUPP(addr)) {
+				SET_PORT_BITS(state, state->ports[j].shareports, addr, bit_lookup);
+			}
+		}
+	}
+	if (REG_SUPP(state->regs->TAG_VLAN_MASK_REG)) {
+		for (j=0; j<MAX_VLANS; j++) {
+			reg addr = state->regs->TAG_VLAN_MASK_REG;
+			const bitnum *bit_lookup = (j%2==0)?
+				state->regs->TAG_VLAN_MASK_EVEN_BIT:
+				state->regs->TAG_VLAN_MASK_ODD_BIT;
+			unsigned int vlan_mask;
+			if (state->regs->SIMPLE_VLAN_REGISTERS) {
+				addr.m += j;
+			} else {
+				addr.m += j/2;
+			}
+			vlan_mask = state->vlans[j].ports;
+			SET_PORT_BITS(state, vlan_mask, addr, bit_lookup);
+		}
+	}
+
+	for (i=0; i<MAX_PORTS; i++) {
+		if (REG_SUPP(state->regs->VLAN_DEFAULT_TAG_REG[i])) {
+			int err = setPhy(state, state->regs->VLAN_DEFAULT_TAG_REG[i],
+					state->ports[i].pvid);
+			if (err < 0) {
+				return err;
+			}
+		}
+	}
+
+	return ip175c_set_flags(state);
+}
+
+/**
+ *  Uses only the VLAN port mask and the add tag mask to generate the other fields:
+ *  which ports are part of the same VLAN, removing vlan tags, and VLAN tag ids.
+ */
+static void ip175c_correct_vlan_state(struct ip17xx_state *state)
+{
+	int i, j;
+	state->num_vlans = 0;
+	for (i=0; i<MAX_VLANS; i++) {
+		if (state->vlans[i].ports != 0) {
+			state->num_vlans = i+1; // Hack -- we need to store the "set" vlans somewhere...
+		}
+	}
+
+	for (i=0; i<state->regs->NUM_PORTS; i++) {
+		unsigned int portmask = (1<<i);
+		if (!state->vlan_enabled) {
+			// Share with everybody!
+			state->ports[i].shareports = (1<<state->regs->NUM_PORTS)-1;
+			continue;
+		}
+		state->ports[i].shareports = portmask;
+		for (j=0; j<MAX_VLANS; j++) {
+			if (state->vlans[j].ports & portmask)
+				state->ports[i].shareports |= state->vlans[j].ports;
+		}
+	}
+}
+
+static int ip175c_update_state(struct ip17xx_state *state)
+{
+	ip175c_correct_vlan_state(state);
+	return ip175c_set_state(state);
+}
+
+static int ip175c_set_vlan_mode(struct ip17xx_state *state)
+{
+	return ip175c_update_state(state);
+}
+
+static int ip175c_reset(struct ip17xx_state *state)
+{
+	int err;
+
+	if (REG_SUPP(state->regs->MODE_REG)) {
+		err = setPhy(state, state->regs->MODE_REG, state->regs->MODE_VAL);
+		if (err < 0)
+			return err;
+		err = getPhy(state, state->regs->MODE_REG);
+		if (err < 0)
+			return err;
+	}
+
+	return ip175c_update_state(state);
+}
+
+/*** Low-level functions for IP175D ***/
+
+static int ip175d_update_state(struct ip17xx_state *state)
+{
+	unsigned int filter_mask = 0;
+	unsigned int ports[16], add[16], rem[16];
+	int i, j;
+	int err = 0;
+
+	for (i = 0; i < 16; i++) {
+		ports[i] = 0;
+		add[i] = 0;
+		rem[i] = 0;
+		if (!state->vlan_enabled) {
+			err |= ip_phy_write(state, 22, 14+i, i+1);	// default tags
+			ports[i] = 0x3f;
+			continue;
+		}
+		if (!state->vlans[i].tag) {
+			// Reset the filter
+			err |= ip_phy_write(state, 22, 14+i, 0);	// tag
+			continue;
+		}
+		filter_mask |= 1 << i;
+		err |= ip_phy_write(state, 22, 14+i, state->vlans[i].tag);
+		ports[i] = state->vlans[i].ports;
+		for (j = 0; j < 6; j++) {
+			if (ports[i] & (1 << j)) {
+				if (state->add_tag & (1 << j))
+					add[i] |= 1 << j;
+				if (state->remove_tag & (1 << j))
+					rem[i] |= 1 << j;
+			}
+		}
+	}
+
+	// Port masks, tag adds and removals
+	for (i = 0; i < 8; i++) {
+		err |= ip_phy_write(state, 23, i, ports[2*i] | (ports[2*i+1] << 8));
+		err |= ip_phy_write(state, 23, 8+i, add[2*i] | (add[2*i+1] << 8));
+		err |= ip_phy_write(state, 23, 16+i, rem[2*i] | (rem[2*i+1] << 8));
+	}
+	err |= ip_phy_write(state, 22, 10, filter_mask);
+
+	// Default VLAN tag for each port
+	for (i = 0; i < 6; i++)
+		err |= ip_phy_write(state, 22, 4+i, state->vlans[state->ports[i].pvid].tag);
+
+	return (err ? -EIO : 0);
+}
+
+static int ip175d_set_vlan_mode(struct ip17xx_state *state)
+{
+	int i;
+	int err = 0;
+
+	if (state->vlan_enabled) {
+		// VLAN classification rules: tag-based VLANs, use VID to classify,
+		// drop packets that cannot be classified.
+		err |= ip_phy_write_masked(state, 22, 0, 0x3fff, 0x003f);
+
+		// Ingress rules: CFI=1 dropped, null VID is untagged, VID=1 passed,
+		// VID=0xfff discarded, admin both tagged and untagged, ingress
+		// filters enabled.
+		err |= ip_phy_write_masked(state, 22, 1, 0x0fff, 0x0c3f);
+
+		// Egress rules: IGMP processing off, keep VLAN header off
+		err |= ip_phy_write_masked(state, 22, 2, 0x0fff, 0x0000);
+	} else {
+		// VLAN classification rules: everything off & clear table
+		err |= ip_phy_write_masked(state, 22, 0, 0xbfff, 0x8000);
+
+		// Ingress and egress rules: set to defaults
+		err |= ip_phy_write_masked(state, 22, 1, 0x0fff, 0x0c3f);
+		err |= ip_phy_write_masked(state, 22, 2, 0x0fff, 0x0000);
+	}
+
+	// Reset default VLAN for each port to 0
+	for (i = 0; i < 6; i++)
+		state->ports[i].pvid = 0;
+
+	err |= ip175d_update_state(state);
+
+	return (err ? -EIO : 0);
+}
+
+static int ip175d_reset(struct ip17xx_state *state)
+{
+	int err = 0;
+
+	// Disable the special tagging mode
+	err |= ip_phy_write_masked(state, 21, 22, 0x0003, 0x0000);
+
+	// Set 802.1q protocol type
+	err |= ip_phy_write(state, 22, 3, 0x8100);
+
+	state->vlan_enabled = 0;
+	err |= ip175d_set_vlan_mode(state);
+
+	return (err ? -EIO : 0);
+}
+
+/*** High-level functions ***/
+
+static int ip17xx_get_enable_vlan(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	struct ip17xx_state *state = get_state(dev);
+
+	val->value.i = state->vlan_enabled;
+	return 0;
+}
+
+static void ip17xx_reset_vlan_config(struct ip17xx_state *state)
+{
+	int i;
+
+	state->remove_tag = (state->vlan_enabled ? ((1<<state->regs->NUM_PORTS)-1) : 0x0000);
+	state->add_tag = 0x0000;
+	for (i = 0; i < MAX_VLANS; i++) {
+		state->vlans[i].ports = 0x0000;
+		state->vlans[i].tag = (i ? i : 16);
+	}
+	for (i = 0; i < MAX_PORTS; i++)
+		state->ports[i].pvid = 0;
+}
+
+static int ip17xx_set_enable_vlan(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	struct ip17xx_state *state = get_state(dev);
+	int enable;
+
+	enable = val->value.i;
+	if (state->vlan_enabled == enable) {
+		// Do not change any state.
+		return 0;
+	}
+	state->vlan_enabled = enable;
+
+	// Otherwise, if we are switching state, set fields to a known default.
+	ip17xx_reset_vlan_config(state);
+
+	return state->regs->set_vlan_mode(state);
+}
+
+static int ip17xx_get_ports(struct switch_dev *dev, struct switch_val *val)
+{
+	struct ip17xx_state *state = get_state(dev);
+	int b;
+	int ind;
+	unsigned int ports;
+
+	if (val->port_vlan >= dev->vlans || val->port_vlan < 0)
+		return -EINVAL;
+
+	ports = state->vlans[val->port_vlan].ports;
+	b = 0;
+	ind = 0;
+	while (b < MAX_PORTS) {
+		if (ports&1) {
+			int istagged = ((state->add_tag >> b) & 1);
+			val->value.ports[ind].id = b;
+			val->value.ports[ind].flags = (istagged << SWITCH_PORT_FLAG_TAGGED);
+			ind++;
+		}
+		b++;
+		ports >>= 1;
+	}
+	val->len = ind;
+
+	return 0;
+}
+
+static int ip17xx_set_ports(struct switch_dev *dev, struct switch_val *val)
+{
+	struct ip17xx_state *state = get_state(dev);
+	int i;
+
+	if (val->port_vlan >= dev->vlans || val->port_vlan < 0)
+		return -EINVAL;
+
+	state->vlans[val->port_vlan].ports = 0;
+	for (i = 0; i < val->len; i++) {
+		unsigned int bitmask = (1<<val->value.ports[i].id);
+		state->vlans[val->port_vlan].ports |= bitmask;
+		if (val->value.ports[i].flags & (1<<SWITCH_PORT_FLAG_TAGGED)) {
+			state->add_tag |= bitmask;
+			state->remove_tag &= (~bitmask);
+		} else {
+			state->add_tag &= (~bitmask);
+			state->remove_tag |= bitmask;
+		}
+	}
+
+	return state->regs->update_state(state);
+}
+
+static int ip17xx_apply(struct switch_dev *dev)
+{
+	struct ip17xx_state *state = get_state(dev);
+
+	if (REG_SUPP(state->regs->MII_REGISTER_EN)) {
+		int val = getPhy(state, state->regs->MII_REGISTER_EN);
+		if (val < 0) {
+			return val;
+		}
+		val |= (1<<state->regs->MII_REGISTER_EN_BIT);
+		return setPhy(state, state->regs->MII_REGISTER_EN, val);
+	}
+	return 0;
+}
+
+static int ip17xx_reset(struct switch_dev *dev)
+{
+	struct ip17xx_state *state = get_state(dev);
+	int i, err;
+
+	if (REG_SUPP(state->regs->RESET_REG)) {
+		err = setPhy(state, state->regs->RESET_REG, state->regs->RESET_VAL);
+		if (err < 0)
+			return err;
+		err = getPhy(state, state->regs->RESET_REG);
+
+		/*
+		 *  Data sheet specifies reset period to be 2 msec.
+		 *  (I don't see any mention of the 2ms delay in the IP178C spec, only
+		 *  in IP175C, but it can't hurt.)
+		 */
+		mdelay(2);
+	}
+
+	/* reset switch ports */
+	for (i = 0; i < state->regs->NUM_PORTS-1; i++) {
+		err = ip_phy_write(state, i, MII_BMCR, BMCR_RESET);
+		if (err < 0)
+			return err;
+	}
+
+	state->router_mode = 0;
+	state->vlan_enabled = 0;
+	ip17xx_reset_vlan_config(state);
+
+	return state->regs->reset(state);
+}
+
+static int ip17xx_get_tagged(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	struct ip17xx_state *state = get_state(dev);
+
+	if (state->add_tag & (1<<val->port_vlan)) {
+		if (state->remove_tag & (1<<val->port_vlan))
+			val->value.i = 3; // shouldn't ever happen.
+		else
+			val->value.i = 1;
+	} else {
+		if (state->remove_tag & (1<<val->port_vlan))
+			val->value.i = 0;
+		else
+			val->value.i = 2;
+	}
+	return 0;
+}
+
+static int ip17xx_set_tagged(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	struct ip17xx_state *state = get_state(dev);
+
+	state->add_tag &= ~(1<<val->port_vlan);
+	state->remove_tag &= ~(1<<val->port_vlan);
+
+	if (val->value.i == 0)
+		state->remove_tag |= (1<<val->port_vlan);
+	if (val->value.i == 1)
+		state->add_tag |= (1<<val->port_vlan);
+
+	return state->regs->update_state(state);
+}
+
+/** Get the current phy address */
+static int ip17xx_get_phy(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	struct ip17xx_state *state = get_state(dev);
+
+	val->value.i = state->proc_mii.p;
+	return 0;
+}
+
+/** Set a new phy address for low level access to registers */
+static int ip17xx_set_phy(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	struct ip17xx_state *state = get_state(dev);
+	int new_reg = val->value.i;
+
+	if (new_reg < 0 || new_reg > 31)
+		state->proc_mii.p = (u16)-1;
+	else
+		state->proc_mii.p = (u16)new_reg;
+	return 0;
+}
+
+/** Get the current register number */
+static int ip17xx_get_reg(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	struct ip17xx_state *state = get_state(dev);
+
+	val->value.i = state->proc_mii.m;
+	return 0;
+}
+
+/** Set a new register address for low level access to registers */
+static int ip17xx_set_reg(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	struct ip17xx_state *state = get_state(dev);
+	int new_reg = val->value.i;
+
+	if (new_reg < 0 || new_reg > 31)
+		state->proc_mii.m = (u16)-1;
+	else
+		state->proc_mii.m = (u16)new_reg;
+	return 0;
+}
+
+/** Get the register content of state->proc_mii */
+static int ip17xx_get_val(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	struct ip17xx_state *state = get_state(dev);
+	int retval = -EINVAL;
+	if (REG_SUPP(state->proc_mii))
+		retval = getPhy(state, state->proc_mii);
+
+	if (retval < 0) {
+		return retval;
+	} else {
+		val->value.i = retval;
+		return 0;
+	}
+}
+
+/** Write a value to the register defined by phy/reg above */
+static int ip17xx_set_val(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	struct ip17xx_state *state = get_state(dev);
+	int myval, err = -EINVAL;
+
+	myval = val->value.i;
+	if (myval <= 0xffff && myval >= 0 && REG_SUPP(state->proc_mii)) {
+		err = setPhy(state, state->proc_mii, (u16)myval);
+	}
+	return err;
+}
+
+static int ip17xx_read_name(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	struct ip17xx_state *state = get_state(dev);
+	val->value.s = state->regs->NAME; // Just a const pointer, won't be freed by swconfig.
+	return 0;
+}
+
+static int ip17xx_get_tag(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	struct ip17xx_state *state = get_state(dev);
+	int vlan = val->port_vlan;
+
+	if (vlan < 0 || vlan >= MAX_VLANS)
+		return -EINVAL;
+
+	val->value.i = state->vlans[vlan].tag;
+	return 0;
+}
+
+static int ip17xx_set_tag(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	struct ip17xx_state *state = get_state(dev);
+	int vlan = val->port_vlan;
+	int tag = val->value.i;
+
+	if (vlan < 0 || vlan >= MAX_VLANS)
+		return -EINVAL;
+
+	if (tag < 0 || tag > 4095)
+		return -EINVAL;
+
+	state->vlans[vlan].tag = tag;
+	return state->regs->update_state(state);
+}
+
+static int ip17xx_set_port_speed(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	struct ip17xx_state *state = get_state(dev);
+	int nr = val->port_vlan;
+	int ctrl;
+	int autoneg;
+	int speed;
+	if (val->value.i == 100) {
+		speed = 1;
+		autoneg = 0;
+	} else if (val->value.i == 10) {
+		speed = 0;
+		autoneg = 0;
+	} else {
+		autoneg = 1;
+		speed = 1;
+	}
+
+	/* Can't set speed for cpu port */
+	if (nr == state->regs->CPU_PORT)
+		return -EINVAL;
+
+	if (nr >= dev->ports || nr < 0)
+		return -EINVAL;
+
+	ctrl = ip_phy_read(state, nr, 0);
+	if (ctrl < 0)
+		return -EIO;
+
+	ctrl &= (~(1<<12));
+	ctrl &= (~(1<<13));
+	ctrl |= (autoneg<<12);
+	ctrl |= (speed<<13);
+
+	return ip_phy_write(state, nr, 0, ctrl);
+}
+
+static int ip17xx_get_port_speed(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	struct ip17xx_state *state = get_state(dev);
+	int nr = val->port_vlan;
+	int speed, status;
+
+	if (nr == state->regs->CPU_PORT) {
+		val->value.i = 100;
+		return 0;
+	}
+
+	if (nr >= dev->ports || nr < 0)
+		return -EINVAL;
+
+	status = ip_phy_read(state, nr, 1);
+	speed = ip_phy_read(state, nr, 18);
+	if (status < 0 || speed < 0)
+		return -EIO;
+
+	if (status & 4)
+		val->value.i = ((speed & (1<<11)) ? 100 : 10);
+	else
+		val->value.i = 0;
+
+	return 0;
+}
+
+static int ip17xx_get_port_status(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	struct ip17xx_state *state = get_state(dev);
+	int ctrl, speed, status;
+	int nr = val->port_vlan;
+	int len;
+	char *buf = state->buf; // fixed-length at 80.
+
+	if (nr == state->regs->CPU_PORT) {
+		sprintf(buf, "up, 100 Mbps, cpu port");
+		val->value.s = buf;
+		return 0;
+	}
+
+	if (nr >= dev->ports || nr < 0)
+		return -EINVAL;
+
+	ctrl = ip_phy_read(state, nr, 0);
+	status = ip_phy_read(state, nr, 1);
+	speed = ip_phy_read(state, nr, 18);
+	if (ctrl < 0 || status < 0 || speed < 0)
+		return -EIO;
+
+	if (status & 4)
+		len = sprintf(buf, "up, %d Mbps, %s duplex",
+			((speed & (1<<11)) ? 100 : 10),
+			((speed & (1<<10)) ? "full" : "half"));
+	else
+		len = sprintf(buf, "down");
+
+	if (ctrl & (1<<12)) {
+		len += sprintf(buf+len, ", auto-negotiate");
+		if (!(status & (1<<5)))
+			len += sprintf(buf+len, " (in progress)");
+	} else {
+		len += sprintf(buf+len, ", fixed speed (%d)",
+			((ctrl & (1<<13)) ? 100 : 10));
+	}
+
+	buf[len] = '\0';
+	val->value.s = buf;
+	return 0;
+}
+
+static int ip17xx_get_pvid(struct switch_dev *dev, int port, int *val)
+{
+	struct ip17xx_state *state = get_state(dev);
+
+	*val = state->ports[port].pvid;
+	return 0;
+}
+
+static int ip17xx_set_pvid(struct switch_dev *dev, int port, int val)
+{
+	struct ip17xx_state *state = get_state(dev);
+
+	if (val < 0 || val >= MAX_VLANS)
+		return -EINVAL;
+
+	state->ports[port].pvid = val;
+	return state->regs->update_state(state);
+}
+
+
+enum Ports {
+	IP17XX_PORT_STATUS,
+	IP17XX_PORT_LINK,
+	IP17XX_PORT_TAGGED,
+	IP17XX_PORT_PVID,
+};
+
+enum Globals {
+	IP17XX_ENABLE_VLAN,
+	IP17XX_GET_NAME,
+	IP17XX_REGISTER_PHY,
+	IP17XX_REGISTER_MII,
+	IP17XX_REGISTER_VALUE,
+	IP17XX_REGISTER_ERRNO,
+};
+
+enum Vlans {
+	IP17XX_VLAN_TAG,
+};
+
+static const struct switch_attr ip17xx_global[] = {
+	[IP17XX_ENABLE_VLAN] = {
+		.id = IP17XX_ENABLE_VLAN,
+		.type = SWITCH_TYPE_INT,
+		.name  = "enable_vlan",
+		.description = "Flag to enable or disable VLANs and tagging",
+		.get  = ip17xx_get_enable_vlan,
+		.set = ip17xx_set_enable_vlan,
+	},
+	[IP17XX_GET_NAME] = {
+		.id = IP17XX_GET_NAME,
+		.type = SWITCH_TYPE_STRING,
+		.description = "Returns the type of IC+ chip.",
+		.name  = "name",
+		.get  = ip17xx_read_name,
+		.set = NULL,
+	},
+	/* jal: added for low level debugging etc. */
+	[IP17XX_REGISTER_PHY] = {
+		.id = IP17XX_REGISTER_PHY,
+		.type = SWITCH_TYPE_INT,
+		.description = "Direct register access: set PHY (0-4, or 29,30,31)",
+		.name  = "phy",
+		.get  = ip17xx_get_phy,
+		.set = ip17xx_set_phy,
+	},
+	[IP17XX_REGISTER_MII] = {
+		.id = IP17XX_REGISTER_MII,
+		.type = SWITCH_TYPE_INT,
+		.description = "Direct register access: set MII register number (0-31)",
+		.name  = "reg",
+		.get  = ip17xx_get_reg,
+		.set = ip17xx_set_reg,
+	},
+	[IP17XX_REGISTER_VALUE] = {
+		.id = IP17XX_REGISTER_VALUE,
+		.type = SWITCH_TYPE_INT,
+		.description = "Direct register access: read/write to register (0-65535)",
+		.name  = "val",
+		.get  = ip17xx_get_val,
+		.set = ip17xx_set_val,
+	},
+};
+
+static const struct switch_attr ip17xx_vlan[] = {
+	[IP17XX_VLAN_TAG] = {
+		.id = IP17XX_VLAN_TAG,
+		.type = SWITCH_TYPE_INT,
+		.description = "VLAN ID (0-4095) [IP175D only]",
+		.name = "vid",
+		.get = ip17xx_get_tag,
+		.set = ip17xx_set_tag,
+	}
+};
+
+static const struct switch_attr ip17xx_port[] = {
+	[IP17XX_PORT_STATUS] = {
+		.id = IP17XX_PORT_STATUS,
+		.type = SWITCH_TYPE_STRING,
+		.description = "Returns Detailed port status",
+		.name  = "status",
+		.get  = ip17xx_get_port_status,
+		.set = NULL,
+	},
+	[IP17XX_PORT_LINK] = {
+		.id = IP17XX_PORT_LINK,
+		.type = SWITCH_TYPE_INT,
+		.description = "Link speed. Can write 0 for auto-negotiate, or 10 or 100",
+		.name  = "link",
+		.get  = ip17xx_get_port_speed,
+		.set = ip17xx_set_port_speed,
+	},
+	[IP17XX_PORT_TAGGED] = {
+		.id = IP17XX_PORT_LINK,
+		.type = SWITCH_TYPE_INT,
+		.description = "0 = untag, 1 = add tags, 2 = do not alter (This value is reset if vlans are altered)",
+		.name  = "tagged",
+		.get  = ip17xx_get_tagged,
+		.set = ip17xx_set_tagged,
+	},
+};
+
+static const struct switch_dev_ops ip17xx_ops = {
+	.attr_global = {
+		.attr = ip17xx_global,
+		.n_attr = ARRAY_SIZE(ip17xx_global),
+	},
+	.attr_port = {
+		.attr = ip17xx_port,
+		.n_attr = ARRAY_SIZE(ip17xx_port),
+	},
+	.attr_vlan = {
+		.attr = ip17xx_vlan,
+		.n_attr = ARRAY_SIZE(ip17xx_vlan),
+	},
+
+	.get_port_pvid = ip17xx_get_pvid,
+	.set_port_pvid = ip17xx_set_pvid,
+	.get_vlan_ports = ip17xx_get_ports,
+	.set_vlan_ports = ip17xx_set_ports,
+	.apply_config = ip17xx_apply,
+	.reset_switch = ip17xx_reset,
+};
+
+static int ip17xx_probe(struct phy_device *pdev)
+{
+	struct ip17xx_state *state;
+	struct switch_dev *dev;
+	int err;
+
+	/* We only attach to PHY 0, but use all available PHYs */
+	if (pdev->mdio.addr != 0)
+		return -ENODEV;
+
+	state = kzalloc(sizeof(*state), GFP_KERNEL);
+	if (!state)
+		return -ENOMEM;
+
+	dev = &state->dev;
+
+	pdev->priv = state;
+	state->mii_bus = pdev->mdio.bus;
+
+	err = get_model(state);
+	if (err < 0)
+		goto error;
+
+	dev->vlans = MAX_VLANS;
+	dev->cpu_port = state->regs->CPU_PORT;
+	dev->ports = state->regs->NUM_PORTS;
+	dev->name = state->regs->NAME;
+	dev->ops = &ip17xx_ops;
+
+	pr_info("IP17xx: Found %s at %s\n", dev->name, dev_name(&pdev->mdio.dev));
+	return 0;
+
+error:
+	kfree(state);
+	return err;
+}
+
+static int ip17xx_config_init(struct phy_device *pdev)
+{
+	struct ip17xx_state *state = pdev->priv;
+	struct net_device *dev = pdev->attached_dev;
+	int err;
+
+	err = register_switch(&state->dev, dev);
+	if (err < 0)
+		return err;
+
+	state->registered = true;
+	ip17xx_reset(&state->dev);
+	return 0;
+}
+
+static void ip17xx_remove(struct phy_device *pdev)
+{
+	struct ip17xx_state *state = pdev->priv;
+
+	if (state->registered)
+		unregister_switch(&state->dev);
+	kfree(state);
+}
+
+static int ip17xx_config_aneg(struct phy_device *pdev)
+{
+	return 0;
+}
+
+static int ip17xx_aneg_done(struct phy_device *pdev)
+{
+	return 1;	/* Return any positive value */
+}
+
+static int ip17xx_read_status(struct phy_device *pdev)
+{
+	pdev->speed = SPEED_100;
+	pdev->duplex = DUPLEX_FULL;
+	pdev->pause = pdev->asym_pause = 0;
+	pdev->link = 1;
+
+	return 0;
+}
+
+static struct phy_driver ip17xx_driver[] = {
+	{
+		.name		= "IC+ IP17xx",
+		.phy_id		= 0x02430c00,
+		.phy_id_mask	= 0x0ffffc00,
+		.features	= PHY_BASIC_FEATURES,
+		.probe		= ip17xx_probe,
+		.remove		= ip17xx_remove,
+		.config_init	= ip17xx_config_init,
+		.config_aneg	= ip17xx_config_aneg,
+		.aneg_done	= ip17xx_aneg_done,
+		.read_status	= ip17xx_read_status,
+	}
+};
+
+module_phy_driver(ip17xx_driver);
+
+MODULE_AUTHOR("Patrick Horn <patrick.horn@gmail.com>");
+MODULE_AUTHOR("Felix Fietkau <nbd@nbd.name>");
+MODULE_AUTHOR("Martin Mares <mj@ucw.cz>");
+MODULE_LICENSE("GPL");
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/psb6970.c b/6.12/target/linux/generic/files/drivers/net/phy/psb6970.c
new file mode 100644
index 00000000..2587b999
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/psb6970.c
@@ -0,0 +1,443 @@
+/*
+ * Lantiq PSB6970 (Tantos) Switch driver
+ *
+ * Copyright (c) 2009,2010 Team Embedded.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of the GNU General Public License v2 as published by the
+ * Free Software Foundation.
+ *
+ * The switch programming done in this driver follows the 
+ * "Ethernet Traffic Separation using VLAN" Application Note as
+ * published by Lantiq.
+ */
+
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/switch.h>
+#include <linux/phy.h>
+#include <linux/version.h>
+
+#define PSB6970_MAX_VLANS		16
+#define PSB6970_NUM_PORTS		7
+#define PSB6970_DEFAULT_PORT_CPU	6
+#define PSB6970_IS_CPU_PORT(x)		((x) > 4)
+
+#define PHYADDR(_reg)		((_reg >> 5) & 0xff), (_reg & 0x1f)
+
+/* --- Identification --- */
+#define PSB6970_CI0		0x0100
+#define PSB6970_CI0_MASK	0x000f
+#define PSB6970_CI1		0x0101
+#define PSB6970_CI1_VAL		0x2599
+#define PSB6970_CI1_MASK	0xffff
+
+/* --- VLAN filter table --- */
+#define PSB6970_VFxL(i)		((i)*2+0x10)	/* VLAN Filter Low */
+#define PSB6970_VFxL_VV		(1 << 15)	/* VLAN_Valid */
+
+#define PSB6970_VFxH(i)		((i)*2+0x11)	/* VLAN Filter High */
+#define PSB6970_VFxH_TM_SHIFT	7		/* Tagged Member */
+
+/* --- Port registers --- */
+#define PSB6970_EC(p)		((p)*0x20+2)	/* Extended Control */
+#define PSB6970_EC_IFNTE	(1 << 1)	/* Input Force No Tag Enable */
+
+#define PSB6970_PBVM(p)		((p)*0x20+3)	/* Port Base VLAN Map */
+#define PSB6970_PBVM_VMCE	(1 << 8)
+#define PSB6970_PBVM_AOVTP	(1 << 9)
+#define PSB6970_PBVM_VSD	(1 << 10)
+#define PSB6970_PBVM_VC		(1 << 11)	/* VID Check with VID table */
+#define PSB6970_PBVM_TBVE	(1 << 13)	/* Tag-Based VLAN enable */
+
+#define PSB6970_DVID(p)		((p)*0x20+4)	/* Default VLAN ID & Priority */
+
+struct psb6970_priv {
+	struct switch_dev dev;
+	struct phy_device *phy;
+	u16 (*read) (struct phy_device* phydev, int reg);
+	void (*write) (struct phy_device* phydev, int reg, u16 val);
+	struct mutex reg_mutex;
+
+	/* all fields below are cleared on reset */
+	struct_group(psb6970_priv_volatile,
+		bool vlan;
+		u16 vlan_id[PSB6970_MAX_VLANS];
+		u8 vlan_table[PSB6970_MAX_VLANS];
+		u8 vlan_tagged;
+		u16 pvid[PSB6970_NUM_PORTS];
+	);
+};
+
+#define to_psb6970(_dev) container_of(_dev, struct psb6970_priv, dev)
+
+static u16 psb6970_mii_read(struct phy_device *phydev, int reg)
+{
+	struct mii_bus *bus = phydev->mdio.bus;
+
+	return bus->read(bus, PHYADDR(reg));
+}
+
+static void psb6970_mii_write(struct phy_device *phydev, int reg, u16 val)
+{
+	struct mii_bus *bus = phydev->mdio.bus;
+
+	bus->write(bus, PHYADDR(reg), val);
+}
+
+static int
+psb6970_set_vlan(struct switch_dev *dev, const struct switch_attr *attr,
+		 struct switch_val *val)
+{
+	struct psb6970_priv *priv = to_psb6970(dev);
+	priv->vlan = !!val->value.i;
+	return 0;
+}
+
+static int
+psb6970_get_vlan(struct switch_dev *dev, const struct switch_attr *attr,
+		 struct switch_val *val)
+{
+	struct psb6970_priv *priv = to_psb6970(dev);
+	val->value.i = priv->vlan;
+	return 0;
+}
+
+static int psb6970_set_pvid(struct switch_dev *dev, int port, int vlan)
+{
+	struct psb6970_priv *priv = to_psb6970(dev);
+
+	/* make sure no invalid PVIDs get set */
+	if (vlan >= dev->vlans)
+		return -EINVAL;
+
+	priv->pvid[port] = vlan;
+	return 0;
+}
+
+static int psb6970_get_pvid(struct switch_dev *dev, int port, int *vlan)
+{
+	struct psb6970_priv *priv = to_psb6970(dev);
+	*vlan = priv->pvid[port];
+	return 0;
+}
+
+static int
+psb6970_set_vid(struct switch_dev *dev, const struct switch_attr *attr,
+		struct switch_val *val)
+{
+	struct psb6970_priv *priv = to_psb6970(dev);
+	priv->vlan_id[val->port_vlan] = val->value.i;
+	return 0;
+}
+
+static int
+psb6970_get_vid(struct switch_dev *dev, const struct switch_attr *attr,
+		struct switch_val *val)
+{
+	struct psb6970_priv *priv = to_psb6970(dev);
+	val->value.i = priv->vlan_id[val->port_vlan];
+	return 0;
+}
+
+static struct switch_attr psb6970_globals[] = {
+	{
+	 .type = SWITCH_TYPE_INT,
+	 .name = "enable_vlan",
+	 .description = "Enable VLAN mode",
+	 .set = psb6970_set_vlan,
+	 .get = psb6970_get_vlan,
+	 .max = 1},
+};
+
+static struct switch_attr psb6970_port[] = {
+};
+
+static struct switch_attr psb6970_vlan[] = {
+	{
+	 .type = SWITCH_TYPE_INT,
+	 .name = "vid",
+	 .description = "VLAN ID (0-4094)",
+	 .set = psb6970_set_vid,
+	 .get = psb6970_get_vid,
+	 .max = 4094,
+	 },
+};
+
+static int psb6970_get_ports(struct switch_dev *dev, struct switch_val *val)
+{
+	struct psb6970_priv *priv = to_psb6970(dev);
+	u8 ports = priv->vlan_table[val->port_vlan];
+	int i;
+
+	val->len = 0;
+	for (i = 0; i < PSB6970_NUM_PORTS; i++) {
+		struct switch_port *p;
+
+		if (!(ports & (1 << i)))
+			continue;
+
+		p = &val->value.ports[val->len++];
+		p->id = i;
+		if (priv->vlan_tagged & (1 << i))
+			p->flags = (1 << SWITCH_PORT_FLAG_TAGGED);
+		else
+			p->flags = 0;
+	}
+	return 0;
+}
+
+static int psb6970_set_ports(struct switch_dev *dev, struct switch_val *val)
+{
+	struct psb6970_priv *priv = to_psb6970(dev);
+	u8 *vt = &priv->vlan_table[val->port_vlan];
+	int i, j;
+
+	*vt = 0;
+	for (i = 0; i < val->len; i++) {
+		struct switch_port *p = &val->value.ports[i];
+
+		if (p->flags & (1 << SWITCH_PORT_FLAG_TAGGED))
+			priv->vlan_tagged |= (1 << p->id);
+		else {
+			priv->vlan_tagged &= ~(1 << p->id);
+			priv->pvid[p->id] = val->port_vlan;
+
+			/* make sure that an untagged port does not
+			 * appear in other vlans */
+			for (j = 0; j < PSB6970_MAX_VLANS; j++) {
+				if (j == val->port_vlan)
+					continue;
+				priv->vlan_table[j] &= ~(1 << p->id);
+			}
+		}
+
+		*vt |= 1 << p->id;
+	}
+	return 0;
+}
+
+static int psb6970_hw_apply(struct switch_dev *dev)
+{
+	struct psb6970_priv *priv = to_psb6970(dev);
+	int i, j;
+
+	mutex_lock(&priv->reg_mutex);
+
+	if (priv->vlan) {
+		/* into the vlan translation unit */
+		for (j = 0; j < PSB6970_MAX_VLANS; j++) {
+			u8 vp = priv->vlan_table[j];
+
+			if (vp) {
+				priv->write(priv->phy, PSB6970_VFxL(j),
+					    PSB6970_VFxL_VV | priv->vlan_id[j]);
+				priv->write(priv->phy, PSB6970_VFxH(j),
+					    ((vp & priv->
+					      vlan_tagged) <<
+					     PSB6970_VFxH_TM_SHIFT) | vp);
+			} else	/* clear VLAN Valid flag for unused vlans */
+				priv->write(priv->phy, PSB6970_VFxL(j), 0);
+
+		}
+	}
+
+	/* update the port destination mask registers and tag settings */
+	for (i = 0; i < PSB6970_NUM_PORTS; i++) {
+		int dvid = 1, pbvm = 0x7f | PSB6970_PBVM_VSD, ec = 0;
+
+		if (priv->vlan) {
+			ec = PSB6970_EC_IFNTE;
+			dvid = priv->vlan_id[priv->pvid[i]];
+			pbvm |= PSB6970_PBVM_TBVE | PSB6970_PBVM_VMCE;
+
+			if ((i << 1) & priv->vlan_tagged)
+				pbvm |= PSB6970_PBVM_AOVTP | PSB6970_PBVM_VC;
+		}
+
+		priv->write(priv->phy, PSB6970_PBVM(i), pbvm);
+
+		if (!PSB6970_IS_CPU_PORT(i)) {
+			priv->write(priv->phy, PSB6970_EC(i), ec);
+			priv->write(priv->phy, PSB6970_DVID(i), dvid);
+		}
+	}
+
+	mutex_unlock(&priv->reg_mutex);
+	return 0;
+}
+
+static int psb6970_reset_switch(struct switch_dev *dev)
+{
+	struct psb6970_priv *priv = to_psb6970(dev);
+	int i;
+
+	mutex_lock(&priv->reg_mutex);
+
+	memset(&priv->psb6970_priv_volatile, 0,
+		sizeof(priv->psb6970_priv_volatile));
+
+	for (i = 0; i < PSB6970_MAX_VLANS; i++)
+		priv->vlan_id[i] = i;
+
+	mutex_unlock(&priv->reg_mutex);
+
+	return psb6970_hw_apply(dev);
+}
+
+static const struct switch_dev_ops psb6970_ops = {
+	.attr_global = {
+			.attr = psb6970_globals,
+			.n_attr = ARRAY_SIZE(psb6970_globals),
+			},
+	.attr_port = {
+		      .attr = psb6970_port,
+		      .n_attr = ARRAY_SIZE(psb6970_port),
+		      },
+	.attr_vlan = {
+		      .attr = psb6970_vlan,
+		      .n_attr = ARRAY_SIZE(psb6970_vlan),
+		      },
+	.get_port_pvid = psb6970_get_pvid,
+	.set_port_pvid = psb6970_set_pvid,
+	.get_vlan_ports = psb6970_get_ports,
+	.set_vlan_ports = psb6970_set_ports,
+	.apply_config = psb6970_hw_apply,
+	.reset_switch = psb6970_reset_switch,
+};
+
+static int psb6970_config_init(struct phy_device *pdev)
+{
+	struct psb6970_priv *priv;
+	struct switch_dev *swdev;
+	int ret;
+
+	priv = kzalloc(sizeof(struct psb6970_priv), GFP_KERNEL);
+	if (priv == NULL)
+		return -ENOMEM;
+
+	priv->phy = pdev;
+
+	if (pdev->mdio.addr == 0)
+		printk(KERN_INFO "%s: psb6970 switch driver attached.\n",
+		       pdev->attached_dev->name);
+
+	if (pdev->mdio.addr != 0) {
+		kfree(priv);
+		return 0;
+	}
+
+	linkmode_zero(pdev->supported);
+	linkmode_set_bit(ETHTOOL_LINK_MODE_100baseT_Full_BIT, pdev->supported);
+	linkmode_copy(pdev->advertising, pdev->supported);
+
+	mutex_init(&priv->reg_mutex);
+	priv->read = psb6970_mii_read;
+	priv->write = psb6970_mii_write;
+
+	pdev->priv = priv;
+
+	swdev = &priv->dev;
+	swdev->cpu_port = PSB6970_DEFAULT_PORT_CPU;
+	swdev->ops = &psb6970_ops;
+
+	swdev->name = "Lantiq PSB6970";
+	swdev->vlans = PSB6970_MAX_VLANS;
+	swdev->ports = PSB6970_NUM_PORTS;
+
+	if ((ret = register_switch(&priv->dev, pdev->attached_dev)) < 0) {
+		kfree(priv);
+		goto done;
+	}
+
+	ret = psb6970_reset_switch(&priv->dev);
+	if (ret) {
+		kfree(priv);
+		goto done;
+	}
+
+done:
+	return ret;
+}
+
+static int psb6970_read_status(struct phy_device *phydev)
+{
+	phydev->speed = SPEED_100;
+	phydev->duplex = DUPLEX_FULL;
+	phydev->link = 1;
+
+	phydev->state = PHY_RUNNING;
+	netif_carrier_on(phydev->attached_dev);
+	phydev->adjust_link(phydev->attached_dev);
+
+	return 0;
+}
+
+static int psb6970_config_aneg(struct phy_device *phydev)
+{
+	return 0;
+}
+
+static int psb6970_probe(struct phy_device *pdev)
+{
+	return 0;
+}
+
+static void psb6970_remove(struct phy_device *pdev)
+{
+	struct psb6970_priv *priv = pdev->priv;
+
+	if (!priv)
+		return;
+
+	if (pdev->mdio.addr == 0)
+		unregister_switch(&priv->dev);
+	kfree(priv);
+}
+
+static int psb6970_fixup(struct phy_device *dev)
+{
+	struct mii_bus *bus = dev->mdio.bus;
+	u16 reg;
+
+	/* look for the switch on the bus */
+	reg = bus->read(bus, PHYADDR(PSB6970_CI1)) & PSB6970_CI1_MASK;
+	if (reg != PSB6970_CI1_VAL)
+		return 0;
+
+	dev->phy_id = (reg << 16);
+	dev->phy_id |= bus->read(bus, PHYADDR(PSB6970_CI0)) & PSB6970_CI0_MASK;
+
+	return 0;
+}
+
+static struct phy_driver psb6970_driver = {
+	.name = "Lantiq PSB6970",
+	.phy_id = PSB6970_CI1_VAL << 16,
+	.phy_id_mask = 0xffff0000,
+	.features = PHY_BASIC_FEATURES,
+	.probe = psb6970_probe,
+	.remove = psb6970_remove,
+	.config_init = &psb6970_config_init,
+	.config_aneg = &psb6970_config_aneg,
+	.read_status = &psb6970_read_status,
+};
+
+int __init psb6970_init(void)
+{
+	phy_register_fixup_for_id(PHY_ANY_ID, psb6970_fixup);
+	return phy_driver_register(&psb6970_driver, THIS_MODULE);
+}
+
+module_init(psb6970_init);
+
+void __exit psb6970_exit(void)
+{
+	phy_driver_unregister(&psb6970_driver);
+}
+
+module_exit(psb6970_exit);
+
+MODULE_DESCRIPTION("Lantiq PSB6970 Switch");
+MODULE_AUTHOR("Ithamar R. Adema <ithamar.adema@team-embedded.nl>");
+MODULE_LICENSE("GPL");
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/rtl8306.c b/6.12/target/linux/generic/files/drivers/net/phy/rtl8306.c
new file mode 100644
index 00000000..31bc7589
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/rtl8306.c
@@ -0,0 +1,1063 @@
+/*
+ * rtl8306.c: RTL8306S switch driver
+ *
+ * Copyright (C) 2009 Felix Fietkau <nbd@nbd.name>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/if.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/list.h>
+#include <linux/if_ether.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/netlink.h>
+#include <net/genetlink.h>
+#include <linux/switch.h>
+#include <linux/delay.h>
+#include <linux/phy.h>
+#include <linux/version.h>
+
+//#define DEBUG 1
+
+/* Global (PHY0) */
+#define RTL8306_REG_PAGE		16
+#define RTL8306_REG_PAGE_LO		(1 << 15)
+#define RTL8306_REG_PAGE_HI		(1 << 1) /* inverted */
+
+#define RTL8306_NUM_VLANS		16
+#define RTL8306_NUM_PORTS		6
+#define RTL8306_PORT_CPU		5
+#define RTL8306_NUM_PAGES		4
+#define RTL8306_NUM_REGS		32
+
+#define RTL_NAME_S          "RTL8306S"
+#define RTL_NAME_SD         "RTL8306SD"
+#define RTL_NAME_SDM        "RTL8306SDM"
+#define RTL_NAME_UNKNOWN    "RTL8306(unknown)"
+
+#define RTL8306_MAGIC	0x8306
+
+static LIST_HEAD(phydevs);
+
+struct rtl_priv {
+	struct list_head list;
+	struct switch_dev dev;
+	int page;
+	int type;
+	int do_cpu;
+	struct mii_bus *bus;
+	char hwname[sizeof(RTL_NAME_UNKNOWN)];
+	bool fixup;
+};
+
+struct rtl_phyregs {
+	int nway;
+	int speed;
+	int duplex;
+};
+
+#define to_rtl(_dev) container_of(_dev, struct rtl_priv, dev)
+
+enum {
+	RTL_TYPE_S,
+	RTL_TYPE_SD,
+	RTL_TYPE_SDM,
+};
+
+struct rtl_reg {
+	int page;
+	int phy;
+	int reg;
+	int bits;
+	int shift;
+	int inverted;
+};
+
+#define RTL_VLAN_REGOFS(name) \
+	(RTL_REG_VLAN1_##name - RTL_REG_VLAN0_##name)
+
+#define RTL_PORT_REGOFS(name) \
+	(RTL_REG_PORT1_##name - RTL_REG_PORT0_##name)
+
+#define RTL_PORT_REG(id, reg) \
+	(RTL_REG_PORT0_##reg + (id * RTL_PORT_REGOFS(reg)))
+
+#define RTL_VLAN_REG(id, reg) \
+	(RTL_REG_VLAN0_##reg + (id * RTL_VLAN_REGOFS(reg)))
+
+#define RTL_GLOBAL_REGATTR(reg) \
+	.id = RTL_REG_##reg, \
+	.type = SWITCH_TYPE_INT, \
+	.ofs = 0, \
+	.set = rtl_attr_set_int, \
+	.get = rtl_attr_get_int
+
+#define RTL_PORT_REGATTR(reg) \
+	.id = RTL_REG_PORT0_##reg, \
+	.type = SWITCH_TYPE_INT, \
+	.ofs = RTL_PORT_REGOFS(reg), \
+	.set = rtl_attr_set_port_int, \
+	.get = rtl_attr_get_port_int
+
+#define RTL_VLAN_REGATTR(reg) \
+	.id = RTL_REG_VLAN0_##reg, \
+	.type = SWITCH_TYPE_INT, \
+	.ofs = RTL_VLAN_REGOFS(reg), \
+	.set = rtl_attr_set_vlan_int, \
+	.get = rtl_attr_get_vlan_int
+
+enum rtl_regidx {
+	RTL_REG_CHIPID,
+	RTL_REG_CHIPVER,
+	RTL_REG_CHIPTYPE,
+	RTL_REG_CPUPORT,
+
+	RTL_REG_EN_CPUPORT,
+	RTL_REG_EN_TAG_OUT,
+	RTL_REG_EN_TAG_CLR,
+	RTL_REG_EN_TAG_IN,
+	RTL_REG_TRAP_CPU,
+	RTL_REG_CPU_LINKUP,
+	RTL_REG_TRUNK_PORTSEL,
+	RTL_REG_EN_TRUNK,
+	RTL_REG_RESET,
+
+	RTL_REG_VLAN_ENABLE,
+	RTL_REG_VLAN_FILTER,
+	RTL_REG_VLAN_TAG_ONLY,
+	RTL_REG_VLAN_TAG_AWARE,
+#define RTL_VLAN_ENUM(id) \
+	RTL_REG_VLAN##id##_VID, \
+	RTL_REG_VLAN##id##_PORTMASK
+	RTL_VLAN_ENUM(0),
+	RTL_VLAN_ENUM(1),
+	RTL_VLAN_ENUM(2),
+	RTL_VLAN_ENUM(3),
+	RTL_VLAN_ENUM(4),
+	RTL_VLAN_ENUM(5),
+	RTL_VLAN_ENUM(6),
+	RTL_VLAN_ENUM(7),
+	RTL_VLAN_ENUM(8),
+	RTL_VLAN_ENUM(9),
+	RTL_VLAN_ENUM(10),
+	RTL_VLAN_ENUM(11),
+	RTL_VLAN_ENUM(12),
+	RTL_VLAN_ENUM(13),
+	RTL_VLAN_ENUM(14),
+	RTL_VLAN_ENUM(15),
+#define RTL_PORT_ENUM(id) \
+	RTL_REG_PORT##id##_PVID, \
+	RTL_REG_PORT##id##_NULL_VID_REPLACE, \
+	RTL_REG_PORT##id##_NON_PVID_DISCARD, \
+	RTL_REG_PORT##id##_VID_INSERT, \
+	RTL_REG_PORT##id##_TAG_INSERT, \
+	RTL_REG_PORT##id##_LINK, \
+	RTL_REG_PORT##id##_SPEED, \
+	RTL_REG_PORT##id##_NWAY, \
+	RTL_REG_PORT##id##_NRESTART, \
+	RTL_REG_PORT##id##_DUPLEX, \
+	RTL_REG_PORT##id##_RXEN, \
+	RTL_REG_PORT##id##_TXEN
+	RTL_PORT_ENUM(0),
+	RTL_PORT_ENUM(1),
+	RTL_PORT_ENUM(2),
+	RTL_PORT_ENUM(3),
+	RTL_PORT_ENUM(4),
+	RTL_PORT_ENUM(5),
+};
+
+static const struct rtl_reg rtl_regs[] = {
+	[RTL_REG_CHIPID]         = { 0, 4, 30, 16,  0, 0 },
+	[RTL_REG_CHIPVER]        = { 0, 4, 31,  8,  0, 0 },
+	[RTL_REG_CHIPTYPE]       = { 0, 4, 31,  2,  8, 0 },
+
+	/* CPU port number */
+	[RTL_REG_CPUPORT]        = { 2, 4, 21,  3,  0, 0 },
+	/* Enable CPU port function */
+	[RTL_REG_EN_CPUPORT]     = { 3, 2, 21,  1, 15, 1 },
+	/* Enable CPU port tag insertion */
+	[RTL_REG_EN_TAG_OUT]     = { 3, 2, 21,  1, 12, 0 },
+	/* Enable CPU port tag removal */
+	[RTL_REG_EN_TAG_CLR]     = { 3, 2, 21,  1, 11, 0 },
+	/* Enable CPU port tag checking */
+	[RTL_REG_EN_TAG_IN]      = { 0, 4, 21,  1,  7, 0 },
+	[RTL_REG_EN_TRUNK]       = { 0, 0, 19,  1, 11, 1 },
+	[RTL_REG_TRUNK_PORTSEL]  = { 0, 0, 16,  1,  6, 1 },
+	[RTL_REG_RESET]          = { 0, 0, 16,  1, 12, 0 },
+
+	[RTL_REG_TRAP_CPU]       = { 3, 2, 22,  1,  6, 0 },
+	[RTL_REG_CPU_LINKUP]     = { 0, 6, 22,  1, 15, 0 },
+
+	[RTL_REG_VLAN_TAG_ONLY]  = { 0, 0, 16,  1,  8, 1 },
+	[RTL_REG_VLAN_FILTER]    = { 0, 0, 16,  1,  9, 1 },
+	[RTL_REG_VLAN_TAG_AWARE] = { 0, 0, 16,  1, 10, 1 },
+	[RTL_REG_VLAN_ENABLE]    = { 0, 0, 18,  1,  8, 1 },
+
+#define RTL_VLAN_REGS(id, phy, page, regofs) \
+	[RTL_REG_VLAN##id##_VID] = { page, phy, 25 + regofs, 12, 0, 0 }, \
+	[RTL_REG_VLAN##id##_PORTMASK] = { page, phy, 24 + regofs, 6, 0, 0 }
+	RTL_VLAN_REGS( 0, 0, 0, 0),
+	RTL_VLAN_REGS( 1, 1, 0, 0),
+	RTL_VLAN_REGS( 2, 2, 0, 0),
+	RTL_VLAN_REGS( 3, 3, 0, 0),
+	RTL_VLAN_REGS( 4, 4, 0, 0),
+	RTL_VLAN_REGS( 5, 0, 1, 2),
+	RTL_VLAN_REGS( 6, 1, 1, 2),
+	RTL_VLAN_REGS( 7, 2, 1, 2),
+	RTL_VLAN_REGS( 8, 3, 1, 2),
+	RTL_VLAN_REGS( 9, 4, 1, 2),
+	RTL_VLAN_REGS(10, 0, 1, 4),
+	RTL_VLAN_REGS(11, 1, 1, 4),
+	RTL_VLAN_REGS(12, 2, 1, 4),
+	RTL_VLAN_REGS(13, 3, 1, 4),
+	RTL_VLAN_REGS(14, 4, 1, 4),
+	RTL_VLAN_REGS(15, 0, 1, 6),
+
+#define REG_PORT_SETTING(port, phy) \
+	[RTL_REG_PORT##port##_SPEED] = { 0, phy, 0, 1, 13, 0 }, \
+	[RTL_REG_PORT##port##_NWAY] = { 0, phy, 0, 1, 12, 0 }, \
+	[RTL_REG_PORT##port##_NRESTART] = { 0, phy, 0, 1, 9, 0 }, \
+	[RTL_REG_PORT##port##_DUPLEX] = { 0, phy, 0, 1, 8, 0 }, \
+	[RTL_REG_PORT##port##_TXEN] = { 0, phy, 24, 1, 11, 0 }, \
+	[RTL_REG_PORT##port##_RXEN] = { 0, phy, 24, 1, 10, 0 }, \
+	[RTL_REG_PORT##port##_LINK] = { 0, phy, 1, 1, 2, 0 }, \
+	[RTL_REG_PORT##port##_NULL_VID_REPLACE] = { 0, phy, 22, 1, 12, 0 }, \
+	[RTL_REG_PORT##port##_NON_PVID_DISCARD] = { 0, phy, 22, 1, 11, 0 }, \
+	[RTL_REG_PORT##port##_VID_INSERT] = { 0, phy, 22, 2, 9, 0 }, \
+	[RTL_REG_PORT##port##_TAG_INSERT] = { 0, phy, 22, 2, 0, 0 }
+
+	REG_PORT_SETTING(0, 0),
+	REG_PORT_SETTING(1, 1),
+	REG_PORT_SETTING(2, 2),
+	REG_PORT_SETTING(3, 3),
+	REG_PORT_SETTING(4, 4),
+	REG_PORT_SETTING(5, 6),
+
+#define REG_PORT_PVID(phy, page, regofs) \
+	{ page, phy, 24 + regofs, 4, 12, 0 }
+	[RTL_REG_PORT0_PVID] = REG_PORT_PVID(0, 0, 0),
+	[RTL_REG_PORT1_PVID] = REG_PORT_PVID(1, 0, 0),
+	[RTL_REG_PORT2_PVID] = REG_PORT_PVID(2, 0, 0),
+	[RTL_REG_PORT3_PVID] = REG_PORT_PVID(3, 0, 0),
+	[RTL_REG_PORT4_PVID] = REG_PORT_PVID(4, 0, 0),
+	[RTL_REG_PORT5_PVID] = REG_PORT_PVID(0, 1, 2),
+};
+
+
+static inline void
+rtl_set_page(struct rtl_priv *priv, unsigned int page)
+{
+	struct mii_bus *bus = priv->bus;
+	u16 pgsel;
+
+	if (priv->fixup)
+		return;
+
+	if (priv->page == page)
+		return;
+
+	BUG_ON(page > RTL8306_NUM_PAGES);
+	pgsel = bus->read(bus, 0, RTL8306_REG_PAGE);
+	pgsel &= ~(RTL8306_REG_PAGE_LO | RTL8306_REG_PAGE_HI);
+	if (page & (1 << 0))
+		pgsel |= RTL8306_REG_PAGE_LO;
+	if (!(page & (1 << 1))) /* bit is inverted */
+		pgsel |= RTL8306_REG_PAGE_HI;
+	bus->write(bus, 0, RTL8306_REG_PAGE, pgsel);
+}
+
+static inline int
+rtl_w16(struct switch_dev *dev, unsigned int page, unsigned int phy, unsigned int reg, u16 val)
+{
+	struct rtl_priv *priv = to_rtl(dev);
+	struct mii_bus *bus = priv->bus;
+
+	rtl_set_page(priv, page);
+	bus->write(bus, phy, reg, val);
+	bus->read(bus, phy, reg); /* flush */
+	return 0;
+}
+
+static inline int
+rtl_r16(struct switch_dev *dev, unsigned int page, unsigned int phy, unsigned int reg)
+{
+	struct rtl_priv *priv = to_rtl(dev);
+	struct mii_bus *bus = priv->bus;
+
+	rtl_set_page(priv, page);
+	return bus->read(bus, phy, reg);
+}
+
+static inline u16
+rtl_rmw(struct switch_dev *dev, unsigned int page, unsigned int phy, unsigned int reg, u16 mask, u16 val)
+{
+	struct rtl_priv *priv = to_rtl(dev);
+	struct mii_bus *bus = priv->bus;
+	u16 r;
+
+	rtl_set_page(priv, page);
+	r = bus->read(bus, phy, reg);
+	r &= ~mask;
+	r |= val;
+	bus->write(bus, phy, reg, r);
+	return bus->read(bus, phy, reg); /* flush */
+}
+
+
+static inline int
+rtl_get(struct switch_dev *dev, enum rtl_regidx s)
+{
+	const struct rtl_reg *r = &rtl_regs[s];
+	u16 val;
+
+	BUG_ON(s >= ARRAY_SIZE(rtl_regs));
+	if (r->bits == 0) /* unimplemented */
+		return 0;
+
+	val = rtl_r16(dev, r->page, r->phy, r->reg);
+
+	if (r->shift > 0)
+		val >>= r->shift;
+
+	if (r->inverted)
+		val = ~val;
+
+	val &= (1 << r->bits) - 1;
+
+	return val;
+}
+
+static int
+rtl_set(struct switch_dev *dev, enum rtl_regidx s, unsigned int val)
+{
+	const struct rtl_reg *r = &rtl_regs[s];
+	u16 mask = 0xffff;
+
+	BUG_ON(s >= ARRAY_SIZE(rtl_regs));
+
+	if (r->bits == 0) /* unimplemented */
+		return 0;
+
+	if (r->shift > 0)
+		val <<= r->shift;
+
+	if (r->inverted)
+		val = ~val;
+
+	if (r->bits != 16) {
+		mask = (1 << r->bits) - 1;
+		mask <<= r->shift;
+	}
+	val &= mask;
+	return rtl_rmw(dev, r->page, r->phy, r->reg, mask, val);
+}
+
+static void
+rtl_phy_save(struct switch_dev *dev, int port, struct rtl_phyregs *regs)
+{
+	regs->nway = rtl_get(dev, RTL_PORT_REG(port, NWAY));
+	regs->speed = rtl_get(dev, RTL_PORT_REG(port, SPEED));
+	regs->duplex = rtl_get(dev, RTL_PORT_REG(port, DUPLEX));
+}
+
+static void
+rtl_phy_restore(struct switch_dev *dev, int port, struct rtl_phyregs *regs)
+{
+	rtl_set(dev, RTL_PORT_REG(port, NWAY), regs->nway);
+	rtl_set(dev, RTL_PORT_REG(port, SPEED), regs->speed);
+	rtl_set(dev, RTL_PORT_REG(port, DUPLEX), regs->duplex);
+}
+
+static void
+rtl_port_set_enable(struct switch_dev *dev, int port, int enabled)
+{
+	rtl_set(dev, RTL_PORT_REG(port, RXEN), enabled);
+	rtl_set(dev, RTL_PORT_REG(port, TXEN), enabled);
+
+	if ((port >= 5) || !enabled)
+		return;
+
+	/* restart autonegotiation if enabled */
+	rtl_set(dev, RTL_PORT_REG(port, NRESTART), 1);
+}
+
+static int
+rtl_hw_apply(struct switch_dev *dev)
+{
+	int i;
+	int trunk_en, trunk_psel;
+	struct rtl_phyregs port5;
+
+	rtl_phy_save(dev, 5, &port5);
+
+	/* disable rx/tx from PHYs */
+	for (i = 0; i < RTL8306_NUM_PORTS - 1; i++) {
+		rtl_port_set_enable(dev, i, 0);
+	}
+
+	/* save trunking status */
+	trunk_en = rtl_get(dev, RTL_REG_EN_TRUNK);
+	trunk_psel = rtl_get(dev, RTL_REG_TRUNK_PORTSEL);
+
+	/* trunk port 3 and 4
+	 * XXX: Big WTF, but RealTek seems to do it */
+	rtl_set(dev, RTL_REG_EN_TRUNK, 1);
+	rtl_set(dev, RTL_REG_TRUNK_PORTSEL, 1);
+
+	/* execute the software reset */
+	rtl_set(dev, RTL_REG_RESET, 1);
+
+	/* wait for the reset to complete,
+	 * but don't wait for too long */
+	for (i = 0; i < 10; i++) {
+		if (rtl_get(dev, RTL_REG_RESET) == 0)
+			break;
+
+		msleep(1);
+	}
+
+	/* enable rx/tx from PHYs */
+	for (i = 0; i < RTL8306_NUM_PORTS - 1; i++) {
+		rtl_port_set_enable(dev, i, 1);
+	}
+
+	/* restore trunking settings */
+	rtl_set(dev, RTL_REG_EN_TRUNK, trunk_en);
+	rtl_set(dev, RTL_REG_TRUNK_PORTSEL, trunk_psel);
+	rtl_phy_restore(dev, 5, &port5);
+
+	rtl_set(dev, RTL_REG_CPU_LINKUP, 1);
+
+	return 0;
+}
+
+static void
+rtl_hw_init(struct switch_dev *dev)
+{
+	struct rtl_priv *priv = to_rtl(dev);
+	int cpu_mask = 1 << dev->cpu_port;
+	int i;
+
+	rtl_set(dev, RTL_REG_VLAN_ENABLE, 0);
+	rtl_set(dev, RTL_REG_VLAN_FILTER, 0);
+	rtl_set(dev, RTL_REG_EN_TRUNK, 0);
+	rtl_set(dev, RTL_REG_TRUNK_PORTSEL, 0);
+
+	/* initialize cpu port settings */
+	if (priv->do_cpu) {
+		rtl_set(dev, RTL_REG_CPUPORT, dev->cpu_port);
+		rtl_set(dev, RTL_REG_EN_CPUPORT, 1);
+	} else {
+		rtl_set(dev, RTL_REG_CPUPORT, 7);
+		rtl_set(dev, RTL_REG_EN_CPUPORT, 0);
+	}
+	rtl_set(dev, RTL_REG_EN_TAG_OUT, 0);
+	rtl_set(dev, RTL_REG_EN_TAG_IN, 0);
+	rtl_set(dev, RTL_REG_EN_TAG_CLR, 0);
+
+	/* reset all vlans */
+	for (i = 0; i < RTL8306_NUM_VLANS; i++) {
+		rtl_set(dev, RTL_VLAN_REG(i, VID), i);
+		rtl_set(dev, RTL_VLAN_REG(i, PORTMASK), 0);
+	}
+
+	/* default to port isolation */
+	for (i = 0; i < RTL8306_NUM_PORTS; i++) {
+		unsigned long mask;
+
+		if ((1 << i) == cpu_mask)
+			mask = ((1 << RTL8306_NUM_PORTS) - 1) & ~cpu_mask; /* all bits set */
+		else
+			mask = cpu_mask | (1 << i);
+
+		rtl_set(dev, RTL_VLAN_REG(i, PORTMASK), mask);
+		rtl_set(dev, RTL_PORT_REG(i, PVID), i);
+		rtl_set(dev, RTL_PORT_REG(i, NULL_VID_REPLACE), 1);
+		rtl_set(dev, RTL_PORT_REG(i, VID_INSERT), 1);
+		rtl_set(dev, RTL_PORT_REG(i, TAG_INSERT), 3);
+	}
+	rtl_hw_apply(dev);
+}
+
+#ifdef DEBUG
+static int
+rtl_set_use_cpuport(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	struct rtl_priv *priv = to_rtl(dev);
+	priv->do_cpu = val->value.i;
+	rtl_hw_init(dev);
+	return 0;
+}
+
+static int
+rtl_get_use_cpuport(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	struct rtl_priv *priv = to_rtl(dev);
+	val->value.i = priv->do_cpu;
+	return 0;
+}
+
+static int
+rtl_set_cpuport(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	dev->cpu_port = val->value.i;
+	rtl_hw_init(dev);
+	return 0;
+}
+
+static int
+rtl_get_cpuport(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	val->value.i = dev->cpu_port;
+	return 0;
+}
+#endif
+
+static int
+rtl_reset(struct switch_dev *dev)
+{
+	rtl_hw_init(dev);
+	return 0;
+}
+
+static int
+rtl_attr_set_int(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	int idx = attr->id + (val->port_vlan * attr->ofs);
+	struct rtl_phyregs port;
+
+	if (attr->id >= ARRAY_SIZE(rtl_regs))
+		return -EINVAL;
+
+	if ((attr->max > 0) && (val->value.i > attr->max))
+		return -EINVAL;
+
+	/* access to phy register 22 on port 4/5
+	 * needs phy status save/restore */
+	if ((val->port_vlan > 3) &&
+		(rtl_regs[idx].reg == 22) &&
+		(rtl_regs[idx].page == 0)) {
+
+		rtl_phy_save(dev, val->port_vlan, &port);
+		rtl_set(dev, idx, val->value.i);
+		rtl_phy_restore(dev, val->port_vlan, &port);
+	} else {
+		rtl_set(dev, idx, val->value.i);
+	}
+
+	return 0;
+}
+
+static int
+rtl_attr_get_int(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	int idx = attr->id + (val->port_vlan * attr->ofs);
+
+	if (idx >= ARRAY_SIZE(rtl_regs))
+		return -EINVAL;
+
+	val->value.i = rtl_get(dev, idx);
+	return 0;
+}
+
+static int
+rtl_attr_set_port_int(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	if (val->port_vlan >= RTL8306_NUM_PORTS)
+		return -EINVAL;
+
+	return rtl_attr_set_int(dev, attr, val);
+}
+
+static int
+rtl_attr_get_port_int(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	if (val->port_vlan >= RTL8306_NUM_PORTS)
+		return -EINVAL;
+	return rtl_attr_get_int(dev, attr, val);
+}
+
+static int 
+rtl_get_port_link(struct switch_dev *dev, int port, struct switch_port_link *link)
+{
+	if (port >= RTL8306_NUM_PORTS)
+		return -EINVAL;
+
+	/* in case the link changes from down to up, the register is only updated on read */
+	link->link = rtl_get(dev, RTL_PORT_REG(port, LINK));
+	if (!link->link)
+		link->link = rtl_get(dev, RTL_PORT_REG(port, LINK));
+
+	if (!link->link)
+		return 0;
+
+	link->duplex = rtl_get(dev, RTL_PORT_REG(port, DUPLEX));
+	link->aneg = rtl_get(dev, RTL_PORT_REG(port, NWAY));
+
+	if (rtl_get(dev, RTL_PORT_REG(port, SPEED)))
+		link->speed = SWITCH_PORT_SPEED_100;
+	else
+		link->speed = SWITCH_PORT_SPEED_10;
+
+	return 0;
+}
+
+static int
+rtl_attr_set_vlan_int(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	if (val->port_vlan >= dev->vlans)
+		return -EINVAL;
+
+	return rtl_attr_set_int(dev, attr, val);
+}
+
+static int
+rtl_attr_get_vlan_int(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	if (val->port_vlan >= dev->vlans)
+		return -EINVAL;
+
+	return rtl_attr_get_int(dev, attr, val);
+}
+
+static int
+rtl_get_ports(struct switch_dev *dev, struct switch_val *val)
+{
+	unsigned int i, mask;
+
+	mask = rtl_get(dev, RTL_VLAN_REG(val->port_vlan, PORTMASK));
+	for (i = 0; i < RTL8306_NUM_PORTS; i++) {
+		struct switch_port *port;
+
+		if (!(mask & (1 << i)))
+			continue;
+
+		port = &val->value.ports[val->len];
+		port->id = i;
+		if (rtl_get(dev, RTL_PORT_REG(i, TAG_INSERT)) == 2 || i == dev->cpu_port)
+			port->flags = (1 << SWITCH_PORT_FLAG_TAGGED);
+		val->len++;
+	}
+
+	return 0;
+}
+
+static int
+rtl_set_vlan(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	struct rtl_priv *priv = to_rtl(dev);
+	struct rtl_phyregs port;
+	int en = val->value.i;
+	int i;
+
+	rtl_set(dev, RTL_REG_EN_TAG_OUT, en && priv->do_cpu);
+	rtl_set(dev, RTL_REG_EN_TAG_IN, en && priv->do_cpu);
+	rtl_set(dev, RTL_REG_EN_TAG_CLR, en && priv->do_cpu);
+	rtl_set(dev, RTL_REG_VLAN_TAG_AWARE, en);
+	if (en)
+		rtl_set(dev, RTL_REG_VLAN_FILTER, en);
+
+	for (i = 0; i < RTL8306_NUM_PORTS; i++) {
+		if (i > 3)
+			rtl_phy_save(dev, val->port_vlan, &port);
+		rtl_set(dev, RTL_PORT_REG(i, NULL_VID_REPLACE), 1);
+		rtl_set(dev, RTL_PORT_REG(i, VID_INSERT), (en ? (i == dev->cpu_port ? 0 : 1) : 1));
+		rtl_set(dev, RTL_PORT_REG(i, TAG_INSERT), (en ? (i == dev->cpu_port ? 2 : 1) : 3));
+		if (i > 3)
+			rtl_phy_restore(dev, val->port_vlan, &port);
+	}
+	rtl_set(dev, RTL_REG_VLAN_ENABLE, en);
+
+	return 0;
+}
+
+static int
+rtl_get_vlan(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val)
+{
+	val->value.i = rtl_get(dev, RTL_REG_VLAN_ENABLE);
+	return 0;
+}
+
+static int
+rtl_set_ports(struct switch_dev *dev, struct switch_val *val)
+{
+	unsigned int mask = 0;
+	unsigned int oldmask;
+	int i;
+
+	for(i = 0; i < val->len; i++)
+	{
+		struct switch_port *port = &val->value.ports[i];
+		bool tagged = false;
+
+		mask |= (1 << port->id);
+
+		if (port->id == dev->cpu_port)
+			continue;
+
+		if ((i == dev->cpu_port) ||
+			(port->flags & (1 << SWITCH_PORT_FLAG_TAGGED)))
+			tagged = true;
+
+		/* fix up PVIDs for added ports */
+		if (!tagged)
+			rtl_set(dev, RTL_PORT_REG(port->id, PVID), val->port_vlan);
+
+		rtl_set(dev, RTL_PORT_REG(port->id, NON_PVID_DISCARD), (tagged ? 0 : 1));
+		rtl_set(dev, RTL_PORT_REG(port->id, VID_INSERT), (tagged ? 0 : 1));
+		rtl_set(dev, RTL_PORT_REG(port->id, TAG_INSERT), (tagged ? 2 : 1));
+	}
+
+	oldmask = rtl_get(dev, RTL_VLAN_REG(val->port_vlan, PORTMASK));
+	rtl_set(dev, RTL_VLAN_REG(val->port_vlan, PORTMASK), mask);
+
+	/* fix up PVIDs for removed ports, default to last vlan */
+	oldmask &= ~mask;
+	for (i = 0; i < RTL8306_NUM_PORTS; i++) {
+		if (!(oldmask & (1 << i)))
+			continue;
+
+		if (i == dev->cpu_port)
+			continue;
+
+		if (rtl_get(dev, RTL_PORT_REG(i, PVID)) == val->port_vlan)
+			rtl_set(dev, RTL_PORT_REG(i, PVID), dev->vlans - 1);
+	}
+
+	return 0;
+}
+
+static struct switch_attr rtl_globals[] = {
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_vlan",
+		.description = "Enable VLAN mode",
+		.max = 1,
+		.set = rtl_set_vlan,
+		.get = rtl_get_vlan,
+	},
+	{
+		RTL_GLOBAL_REGATTR(EN_TRUNK),
+		.name = "trunk",
+		.description = "Enable port trunking",
+		.max = 1,
+	},
+	{
+		RTL_GLOBAL_REGATTR(TRUNK_PORTSEL),
+		.name = "trunk_sel",
+		.description = "Select ports for trunking (0: 0,1 - 1: 3,4)",
+		.max = 1,
+	},
+#ifdef DEBUG
+	{
+		RTL_GLOBAL_REGATTR(VLAN_FILTER),
+		.name = "vlan_filter",
+		.description = "Filter incoming packets for allowed VLANS",
+		.max = 1,
+	},
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "cpuport",
+		.description = "CPU Port",
+		.set = rtl_set_cpuport,
+		.get = rtl_get_cpuport,
+		.max = RTL8306_NUM_PORTS,
+	},
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "use_cpuport",
+		.description = "CPU Port handling flag",
+		.set = rtl_set_use_cpuport,
+		.get = rtl_get_use_cpuport,
+		.max = RTL8306_NUM_PORTS,
+	},
+	{
+		RTL_GLOBAL_REGATTR(TRAP_CPU),
+		.name = "trap_cpu",
+		.description = "VLAN trap to CPU",
+		.max = 1,
+	},
+	{
+		RTL_GLOBAL_REGATTR(VLAN_TAG_AWARE),
+		.name = "vlan_tag_aware",
+		.description = "Enable VLAN tag awareness",
+		.max = 1,
+	},
+	{
+		RTL_GLOBAL_REGATTR(VLAN_TAG_ONLY),
+		.name = "tag_only",
+		.description = "Only accept tagged packets",
+		.max = 1,
+	},
+#endif
+};
+static struct switch_attr rtl_port[] = {
+	{
+		RTL_PORT_REGATTR(PVID),
+		.name = "pvid",
+		.description = "Port VLAN ID",
+		.max = RTL8306_NUM_VLANS - 1,
+	},
+#ifdef DEBUG
+	{
+		RTL_PORT_REGATTR(NULL_VID_REPLACE),
+		.name = "null_vid",
+		.description = "NULL VID gets replaced by port default vid",
+		.max = 1,
+	},
+	{
+		RTL_PORT_REGATTR(NON_PVID_DISCARD),
+		.name = "non_pvid_discard",
+		.description = "discard packets with VID != PVID",
+		.max = 1,
+	},
+	{
+		RTL_PORT_REGATTR(VID_INSERT),
+		.name = "vid_insert_remove",
+		.description = "how should the switch insert and remove vids ?",
+		.max = 3,
+	},
+	{
+		RTL_PORT_REGATTR(TAG_INSERT),
+		.name = "tag_insert",
+		.description = "tag insertion handling",
+		.max = 3,
+	},
+#endif
+};
+
+static struct switch_attr rtl_vlan[] = {
+	{
+		RTL_VLAN_REGATTR(VID),
+		.name = "vid",
+		.description = "VLAN ID (1-4095)",
+		.max = 4095,
+	},
+};
+
+static const struct switch_dev_ops rtl8306_ops = {
+	.attr_global = {
+		.attr = rtl_globals,
+		.n_attr = ARRAY_SIZE(rtl_globals),
+	},
+	.attr_port = {
+		.attr = rtl_port,
+		.n_attr = ARRAY_SIZE(rtl_port),
+	},
+	.attr_vlan = {
+		.attr = rtl_vlan,
+		.n_attr = ARRAY_SIZE(rtl_vlan),
+	},
+
+	.get_vlan_ports = rtl_get_ports,
+	.set_vlan_ports = rtl_set_ports,
+	.apply_config = rtl_hw_apply,
+	.reset_switch = rtl_reset,
+	.get_port_link = rtl_get_port_link,
+};
+
+static int
+rtl8306_config_init(struct phy_device *pdev)
+{
+	struct net_device *netdev = pdev->attached_dev;
+	struct rtl_priv *priv = pdev->priv;
+	struct switch_dev *dev = &priv->dev;
+	struct switch_val val;
+	unsigned int chipid, chipver, chiptype;
+	int err;
+
+	/* Only init the switch for the primary PHY */
+	if (pdev->mdio.addr != 0)
+		return 0;
+
+	val.value.i = 1;
+	priv->dev.cpu_port = RTL8306_PORT_CPU;
+	priv->dev.ports = RTL8306_NUM_PORTS;
+	priv->dev.vlans = RTL8306_NUM_VLANS;
+	priv->dev.ops = &rtl8306_ops;
+	priv->do_cpu = 0;
+	priv->page = -1;
+	priv->bus = pdev->mdio.bus;
+
+	chipid = rtl_get(dev, RTL_REG_CHIPID);
+	chipver = rtl_get(dev, RTL_REG_CHIPVER);
+	chiptype = rtl_get(dev, RTL_REG_CHIPTYPE);
+	switch(chiptype) {
+	case 0:
+	case 2:
+		strncpy(priv->hwname, RTL_NAME_S, sizeof(priv->hwname));
+		priv->type = RTL_TYPE_S;
+		break;
+	case 1:
+		strncpy(priv->hwname, RTL_NAME_SD, sizeof(priv->hwname));
+		priv->type = RTL_TYPE_SD;
+		break;
+	case 3:
+		strncpy(priv->hwname, RTL_NAME_SDM, sizeof(priv->hwname));
+		priv->type = RTL_TYPE_SDM;
+		break;
+	default:
+		strncpy(priv->hwname, RTL_NAME_UNKNOWN, sizeof(priv->hwname));
+		break;
+	}
+
+	dev->name = priv->hwname;
+	rtl_hw_init(dev);
+
+	printk(KERN_INFO "Registering %s switch with Chip ID: 0x%04x, version: 0x%04x\n", priv->hwname, chipid, chipver);
+
+	err = register_switch(dev, netdev);
+	if (err < 0) {
+		kfree(priv);
+		return err;
+	}
+
+	return 0;
+}
+
+
+static int
+rtl8306_fixup(struct phy_device *pdev)
+{
+	struct rtl_priv priv;
+	u16 chipid;
+
+	/* Attach to primary LAN port and WAN port */
+	if (pdev->mdio.addr != 0 && pdev->mdio.addr != 4)
+		return 0;
+
+	memset(&priv, 0, sizeof(priv));
+	priv.fixup = true;
+	priv.page = -1;
+	priv.bus = pdev->mdio.bus;
+	chipid = rtl_get(&priv.dev, RTL_REG_CHIPID);
+	if (chipid == 0x5988)
+		pdev->phy_id = RTL8306_MAGIC;
+
+	return 0;
+}
+
+static int
+rtl8306_probe(struct phy_device *pdev)
+{
+	struct rtl_priv *priv;
+
+	list_for_each_entry(priv, &phydevs, list) {
+		/*
+		 * share one rtl_priv instance between virtual phy
+		 * devices on the same bus
+		 */
+		if (priv->bus == pdev->mdio.bus)
+			goto found;
+	}
+	priv = kzalloc(sizeof(struct rtl_priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	priv->bus = pdev->mdio.bus;
+
+found:
+	pdev->priv = priv;
+	return 0;
+}
+
+static void
+rtl8306_remove(struct phy_device *pdev)
+{
+	struct rtl_priv *priv = pdev->priv;
+	unregister_switch(&priv->dev);
+	kfree(priv);
+}
+
+static int
+rtl8306_config_aneg(struct phy_device *pdev)
+{
+	struct rtl_priv *priv = pdev->priv;
+
+	/* Only for WAN */
+	if (pdev->mdio.addr == 0)
+		return 0;
+
+	/* Restart autonegotiation */
+	rtl_set(&priv->dev, RTL_PORT_REG(4, NWAY), 1);
+	rtl_set(&priv->dev, RTL_PORT_REG(4, NRESTART), 1);
+
+	return 0;
+}
+
+static int
+rtl8306_read_status(struct phy_device *pdev)
+{
+	struct rtl_priv *priv = pdev->priv;
+	struct switch_dev *dev = &priv->dev;
+
+	if (pdev->mdio.addr == 4) {
+		/* WAN */
+		pdev->speed = rtl_get(dev, RTL_PORT_REG(4, SPEED)) ? SPEED_100 : SPEED_10;
+		pdev->duplex = rtl_get(dev, RTL_PORT_REG(4, DUPLEX)) ? DUPLEX_FULL : DUPLEX_HALF;
+		pdev->link = !!rtl_get(dev, RTL_PORT_REG(4, LINK));
+	} else {
+		/* LAN */
+		pdev->speed = SPEED_100;
+		pdev->duplex = DUPLEX_FULL;
+		pdev->link = 1;
+	}
+
+	/*
+	 * Bypass generic PHY status read,
+	 * it doesn't work with this switch
+	 */
+	if (pdev->link) {
+		pdev->state = PHY_RUNNING;
+		netif_carrier_on(pdev->attached_dev);
+		pdev->adjust_link(pdev->attached_dev);
+	} else {
+		pdev->state = PHY_NOLINK;
+		netif_carrier_off(pdev->attached_dev);
+		pdev->adjust_link(pdev->attached_dev);
+	}
+
+	return 0;
+}
+
+
+static struct phy_driver rtl8306_driver = {
+	.name		= "Realtek RTL8306S",
+	.phy_id		= RTL8306_MAGIC,
+	.phy_id_mask	= 0xffffffff,
+	.features	= PHY_BASIC_FEATURES,
+	.probe		= &rtl8306_probe,
+	.remove		= &rtl8306_remove,
+	.config_init	= &rtl8306_config_init,
+	.config_aneg	= &rtl8306_config_aneg,
+	.read_status	= &rtl8306_read_status,
+};
+
+
+static int __init
+rtl_init(void)
+{
+	phy_register_fixup_for_id(PHY_ANY_ID, rtl8306_fixup);
+	return phy_driver_register(&rtl8306_driver, THIS_MODULE);
+}
+
+static void __exit
+rtl_exit(void)
+{
+	phy_driver_unregister(&rtl8306_driver);
+}
+
+module_init(rtl_init);
+module_exit(rtl_exit);
+MODULE_LICENSE("GPL");
+
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/rtl8366_smi.c b/6.12/target/linux/generic/files/drivers/net/phy/rtl8366_smi.c
new file mode 100644
index 00000000..89fc04fa
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/rtl8366_smi.c
@@ -0,0 +1,1625 @@
+/*
+ * Realtek RTL8366 SMI interface driver
+ *
+ * Copyright (C) 2009-2010 Gabor Juhos <juhosg@openwrt.org>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/delay.h>
+#include <linux/gpio.h>
+#include <linux/spinlock.h>
+#include <linux/skbuff.h>
+#include <linux/of.h>
+#include <linux/of_platform.h>
+#include <linux/of_gpio.h>
+#include <linux/rtl8366.h>
+#include <linux/version.h>
+#include <linux/of_mdio.h>
+
+#ifdef CONFIG_RTL8366_SMI_DEBUG_FS
+#include <linux/debugfs.h>
+#endif
+
+#include "rtl8366_smi.h"
+
+#define RTL8366_SMI_ACK_RETRY_COUNT         5
+
+#define RTL8366_SMI_HW_STOP_DELAY		25	/* msecs */
+#define RTL8366_SMI_HW_START_DELAY		100	/* msecs */
+
+static inline void rtl8366_smi_clk_delay(struct rtl8366_smi *smi)
+{
+	ndelay(smi->clk_delay);
+}
+
+static void rtl8366_smi_start(struct rtl8366_smi *smi)
+{
+	unsigned int sda = smi->gpio_sda;
+	unsigned int sck = smi->gpio_sck;
+
+	/*
+	 * Set GPIO pins to output mode, with initial state:
+	 * SCK = 0, SDA = 1
+	 */
+	gpio_direction_output(sck, 0);
+	gpio_direction_output(sda, 1);
+	rtl8366_smi_clk_delay(smi);
+
+	/* CLK 1: 0 -> 1, 1 -> 0 */
+	gpio_set_value(sck, 1);
+	rtl8366_smi_clk_delay(smi);
+	gpio_set_value(sck, 0);
+	rtl8366_smi_clk_delay(smi);
+
+	/* CLK 2: */
+	gpio_set_value(sck, 1);
+	rtl8366_smi_clk_delay(smi);
+	gpio_set_value(sda, 0);
+	rtl8366_smi_clk_delay(smi);
+	gpio_set_value(sck, 0);
+	rtl8366_smi_clk_delay(smi);
+	gpio_set_value(sda, 1);
+}
+
+static void rtl8366_smi_stop(struct rtl8366_smi *smi)
+{
+	unsigned int sda = smi->gpio_sda;
+	unsigned int sck = smi->gpio_sck;
+
+	rtl8366_smi_clk_delay(smi);
+	gpio_set_value(sda, 0);
+	gpio_set_value(sck, 1);
+	rtl8366_smi_clk_delay(smi);
+	gpio_set_value(sda, 1);
+	rtl8366_smi_clk_delay(smi);
+	gpio_set_value(sck, 1);
+	rtl8366_smi_clk_delay(smi);
+	gpio_set_value(sck, 0);
+	rtl8366_smi_clk_delay(smi);
+	gpio_set_value(sck, 1);
+
+	/* add a click */
+	rtl8366_smi_clk_delay(smi);
+	gpio_set_value(sck, 0);
+	rtl8366_smi_clk_delay(smi);
+	gpio_set_value(sck, 1);
+
+	/* set GPIO pins to input mode */
+	gpio_direction_input(sda);
+	gpio_direction_input(sck);
+}
+
+static void rtl8366_smi_write_bits(struct rtl8366_smi *smi, u32 data, u32 len)
+{
+	unsigned int sda = smi->gpio_sda;
+	unsigned int sck = smi->gpio_sck;
+
+	for (; len > 0; len--) {
+		rtl8366_smi_clk_delay(smi);
+
+		/* prepare data */
+		gpio_set_value(sda, !!(data & ( 1 << (len - 1))));
+		rtl8366_smi_clk_delay(smi);
+
+		/* clocking */
+		gpio_set_value(sck, 1);
+		rtl8366_smi_clk_delay(smi);
+		gpio_set_value(sck, 0);
+	}
+}
+
+static void rtl8366_smi_read_bits(struct rtl8366_smi *smi, u32 len, u32 *data)
+{
+	unsigned int sda = smi->gpio_sda;
+	unsigned int sck = smi->gpio_sck;
+
+	gpio_direction_input(sda);
+
+	for (*data = 0; len > 0; len--) {
+		u32 u;
+
+		rtl8366_smi_clk_delay(smi);
+
+		/* clocking */
+		gpio_set_value(sck, 1);
+		rtl8366_smi_clk_delay(smi);
+		u = !!gpio_get_value(sda);
+		gpio_set_value(sck, 0);
+
+		*data |= (u << (len - 1));
+	}
+
+	gpio_direction_output(sda, 0);
+}
+
+static int rtl8366_smi_wait_for_ack(struct rtl8366_smi *smi)
+{
+	int retry_cnt;
+
+	retry_cnt = 0;
+	do {
+		u32 ack;
+
+		rtl8366_smi_read_bits(smi, 1, &ack);
+		if (ack == 0)
+			break;
+
+		if (++retry_cnt > RTL8366_SMI_ACK_RETRY_COUNT) {
+			dev_err(smi->parent, "ACK timeout\n");
+			return -ETIMEDOUT;
+		}
+	} while (1);
+
+	return 0;
+}
+
+static int rtl8366_smi_write_byte(struct rtl8366_smi *smi, u8 data)
+{
+	rtl8366_smi_write_bits(smi, data, 8);
+	return rtl8366_smi_wait_for_ack(smi);
+}
+
+static int rtl8366_smi_write_byte_noack(struct rtl8366_smi *smi, u8 data)
+{
+	rtl8366_smi_write_bits(smi, data, 8);
+	return 0;
+}
+
+static int rtl8366_smi_read_byte0(struct rtl8366_smi *smi, u8 *data)
+{
+	u32 t;
+
+	/* read data */
+	rtl8366_smi_read_bits(smi, 8, &t);
+	*data = (t & 0xff);
+
+	/* send an ACK */
+	rtl8366_smi_write_bits(smi, 0x00, 1);
+
+	return 0;
+}
+
+static int rtl8366_smi_read_byte1(struct rtl8366_smi *smi, u8 *data)
+{
+	u32 t;
+
+	/* read data */
+	rtl8366_smi_read_bits(smi, 8, &t);
+	*data = (t & 0xff);
+
+	/* send an ACK */
+	rtl8366_smi_write_bits(smi, 0x01, 1);
+
+	return 0;
+}
+
+static int __rtl8366_smi_read_reg(struct rtl8366_smi *smi, u32 addr, u32 *data)
+{
+	unsigned long flags;
+	u8 lo = 0;
+	u8 hi = 0;
+	int ret;
+
+	spin_lock_irqsave(&smi->lock, flags);
+
+	rtl8366_smi_start(smi);
+
+	/* send READ command */
+	ret = rtl8366_smi_write_byte(smi, smi->cmd_read);
+	if (ret)
+		goto out;
+
+	/* set ADDR[7:0] */
+	ret = rtl8366_smi_write_byte(smi, addr & 0xff);
+	if (ret)
+		goto out;
+
+	/* set ADDR[15:8] */
+	ret = rtl8366_smi_write_byte(smi, addr >> 8);
+	if (ret)
+		goto out;
+
+	/* read DATA[7:0] */
+	rtl8366_smi_read_byte0(smi, &lo);
+	/* read DATA[15:8] */
+	rtl8366_smi_read_byte1(smi, &hi);
+
+	*data = ((u32) lo) | (((u32) hi) << 8);
+
+	ret = 0;
+
+ out:
+	rtl8366_smi_stop(smi);
+	spin_unlock_irqrestore(&smi->lock, flags);
+
+	return ret;
+}
+/* Read/write via mdiobus */
+#define MDC_MDIO_CTRL0_REG		31
+#define MDC_MDIO_START_REG		29
+#define MDC_MDIO_CTRL1_REG		21
+#define MDC_MDIO_ADDRESS_REG		23
+#define MDC_MDIO_DATA_WRITE_REG		24
+#define MDC_MDIO_DATA_READ_REG		25
+
+#define MDC_MDIO_START_OP		0xFFFF
+#define MDC_MDIO_ADDR_OP		0x000E
+#define MDC_MDIO_READ_OP		0x0001
+#define MDC_MDIO_WRITE_OP		0x0003
+#define MDC_REALTEK_PHY_ADDR		0x0
+
+static int __rtl8366_mdio_read_reg(struct rtl8366_smi *smi, u32 addr, u32 *data)
+{
+	u32 phy_id = smi->phy_id;
+	struct mii_bus *mbus = smi->ext_mbus;
+
+	BUG_ON(in_interrupt());
+
+	mutex_lock(&mbus->mdio_lock);
+	/* Write Start command to register 29 */
+	mbus->write(mbus, phy_id, MDC_MDIO_START_REG, MDC_MDIO_START_OP);
+
+	/* Write address control code to register 31 */
+	mbus->write(mbus, phy_id, MDC_MDIO_CTRL0_REG, MDC_MDIO_ADDR_OP);
+
+	/* Write Start command to register 29 */
+	mbus->write(mbus, phy_id, MDC_MDIO_START_REG, MDC_MDIO_START_OP);
+
+	/* Write address to register 23 */
+	mbus->write(mbus, phy_id, MDC_MDIO_ADDRESS_REG, addr);
+
+	/* Write Start command to register 29 */
+	mbus->write(mbus, phy_id, MDC_MDIO_START_REG, MDC_MDIO_START_OP);
+
+	/* Write read control code to register 21 */
+	mbus->write(mbus, phy_id, MDC_MDIO_CTRL1_REG, MDC_MDIO_READ_OP);
+
+	/* Write Start command to register 29 */
+	mbus->write(smi->ext_mbus, phy_id, MDC_MDIO_START_REG, MDC_MDIO_START_OP);
+
+	/* Read data from register 25 */
+	*data = mbus->read(mbus, phy_id, MDC_MDIO_DATA_READ_REG);
+
+	mutex_unlock(&mbus->mdio_lock);
+
+	return 0;
+}
+
+static int __rtl8366_mdio_write_reg(struct rtl8366_smi *smi, u32 addr, u32 data)
+{
+	u32 phy_id = smi->phy_id;
+	struct mii_bus *mbus = smi->ext_mbus;
+
+	BUG_ON(in_interrupt());
+
+	mutex_lock(&mbus->mdio_lock);
+
+	/* Write Start command to register 29 */
+	mbus->write(mbus, phy_id, MDC_MDIO_START_REG, MDC_MDIO_START_OP);
+
+	/* Write address control code to register 31 */
+	mbus->write(mbus, phy_id, MDC_MDIO_CTRL0_REG, MDC_MDIO_ADDR_OP);
+
+	/* Write Start command to register 29 */
+	mbus->write(mbus, phy_id, MDC_MDIO_START_REG, MDC_MDIO_START_OP);
+
+	/* Write address to register 23 */
+	mbus->write(mbus, phy_id, MDC_MDIO_ADDRESS_REG, addr);
+
+	/* Write Start command to register 29 */
+	mbus->write(mbus, phy_id, MDC_MDIO_START_REG, MDC_MDIO_START_OP);
+
+	/* Write data to register 24 */
+	mbus->write(mbus, phy_id, MDC_MDIO_DATA_WRITE_REG, data);
+
+	/* Write Start command to register 29 */
+	mbus->write(mbus, phy_id, MDC_MDIO_START_REG, MDC_MDIO_START_OP);
+
+	/* Write data control code to register 21 */
+	mbus->write(mbus, phy_id, MDC_MDIO_CTRL1_REG, MDC_MDIO_WRITE_OP);
+
+	mutex_unlock(&mbus->mdio_lock);
+	return 0;
+}
+
+int rtl8366_smi_read_reg(struct rtl8366_smi *smi, u32 addr, u32 *data)
+{
+	if (smi->ext_mbus)
+		return __rtl8366_mdio_read_reg(smi, addr, data);
+	else
+		return __rtl8366_smi_read_reg(smi, addr, data);
+}
+EXPORT_SYMBOL_GPL(rtl8366_smi_read_reg);
+
+static int __rtl8366_smi_write_reg(struct rtl8366_smi *smi,
+				   u32 addr, u32 data, bool ack)
+{
+	unsigned long flags;
+	int ret;
+
+	spin_lock_irqsave(&smi->lock, flags);
+
+	rtl8366_smi_start(smi);
+
+	/* send WRITE command */
+	ret = rtl8366_smi_write_byte(smi, smi->cmd_write);
+	if (ret)
+		goto out;
+
+	/* set ADDR[7:0] */
+	ret = rtl8366_smi_write_byte(smi, addr & 0xff);
+	if (ret)
+		goto out;
+
+	/* set ADDR[15:8] */
+	ret = rtl8366_smi_write_byte(smi, addr >> 8);
+	if (ret)
+		goto out;
+
+	/* write DATA[7:0] */
+	ret = rtl8366_smi_write_byte(smi, data & 0xff);
+	if (ret)
+		goto out;
+
+	/* write DATA[15:8] */
+	if (ack)
+		ret = rtl8366_smi_write_byte(smi, data >> 8);
+	else
+		ret = rtl8366_smi_write_byte_noack(smi, data >> 8);
+	if (ret)
+		goto out;
+
+	ret = 0;
+
+ out:
+	rtl8366_smi_stop(smi);
+	spin_unlock_irqrestore(&smi->lock, flags);
+
+	return ret;
+}
+
+int rtl8366_smi_write_reg(struct rtl8366_smi *smi, u32 addr, u32 data)
+{
+	if (smi->ext_mbus)
+		return __rtl8366_mdio_write_reg(smi, addr, data);
+	else
+		return __rtl8366_smi_write_reg(smi, addr, data, true);
+}
+EXPORT_SYMBOL_GPL(rtl8366_smi_write_reg);
+
+int rtl8366_smi_write_reg_noack(struct rtl8366_smi *smi, u32 addr, u32 data)
+{
+	return __rtl8366_smi_write_reg(smi, addr, data, false);
+}
+EXPORT_SYMBOL_GPL(rtl8366_smi_write_reg_noack);
+
+int rtl8366_smi_rmwr(struct rtl8366_smi *smi, u32 addr, u32 mask, u32 data)
+{
+	u32 t;
+	int err;
+
+	err = rtl8366_smi_read_reg(smi, addr, &t);
+	if (err)
+		return err;
+
+	err = rtl8366_smi_write_reg(smi, addr, (t & ~mask) | data);
+	return err;
+
+}
+EXPORT_SYMBOL_GPL(rtl8366_smi_rmwr);
+
+static int rtl8366_reset(struct rtl8366_smi *smi)
+{
+	if (smi->hw_reset) {
+		smi->hw_reset(smi, true);
+		msleep(RTL8366_SMI_HW_STOP_DELAY);
+		smi->hw_reset(smi, false);
+		msleep(RTL8366_SMI_HW_START_DELAY);
+		return 0;
+	}
+
+	return smi->ops->reset_chip(smi);
+}
+
+static int rtl8366_mc_is_used(struct rtl8366_smi *smi, int mc_index, int *used)
+{
+	int err;
+	int i;
+
+	*used = 0;
+	for (i = 0; i < smi->num_ports; i++) {
+		int index = 0;
+
+		err = smi->ops->get_mc_index(smi, i, &index);
+		if (err)
+			return err;
+
+		if (mc_index == index) {
+			*used = 1;
+			break;
+		}
+	}
+
+	return 0;
+}
+
+static int rtl8366_set_vlan(struct rtl8366_smi *smi, int vid, u32 member,
+			    u32 untag, u32 fid)
+{
+	struct rtl8366_vlan_4k vlan4k;
+	int err;
+	int i;
+
+	/* Update the 4K table */
+	err = smi->ops->get_vlan_4k(smi, vid, &vlan4k);
+	if (err)
+		return err;
+
+	vlan4k.member = member;
+	vlan4k.untag = untag;
+	vlan4k.fid = fid;
+	err = smi->ops->set_vlan_4k(smi, &vlan4k);
+	if (err)
+		return err;
+
+	/* Try to find an existing MC entry for this VID */
+	for (i = 0; i < smi->num_vlan_mc; i++) {
+		struct rtl8366_vlan_mc vlanmc;
+
+		err = smi->ops->get_vlan_mc(smi, i, &vlanmc);
+		if (err)
+			return err;
+
+		if (vid == vlanmc.vid) {
+			/* update the MC entry */
+			vlanmc.member = member;
+			vlanmc.untag = untag;
+			vlanmc.fid = fid;
+
+			err = smi->ops->set_vlan_mc(smi, i, &vlanmc);
+			break;
+		}
+	}
+
+	return err;
+}
+
+static int rtl8366_get_pvid(struct rtl8366_smi *smi, int port, int *val)
+{
+	struct rtl8366_vlan_mc vlanmc;
+	int err;
+	int index;
+
+	err = smi->ops->get_mc_index(smi, port, &index);
+	if (err)
+		return err;
+
+	err = smi->ops->get_vlan_mc(smi, index, &vlanmc);
+	if (err)
+		return err;
+
+	*val = vlanmc.vid;
+	return 0;
+}
+
+static int rtl8366_set_pvid(struct rtl8366_smi *smi, unsigned port,
+			    unsigned vid)
+{
+	struct rtl8366_vlan_mc vlanmc;
+	struct rtl8366_vlan_4k vlan4k;
+	int err;
+	int i;
+
+	/* Try to find an existing MC entry for this VID */
+	for (i = 0; i < smi->num_vlan_mc; i++) {
+		err = smi->ops->get_vlan_mc(smi, i, &vlanmc);
+		if (err)
+			return err;
+
+		if (vid == vlanmc.vid) {
+			err = smi->ops->set_vlan_mc(smi, i, &vlanmc);
+			if (err)
+				return err;
+
+			err = smi->ops->set_mc_index(smi, port, i);
+			return err;
+		}
+	}
+
+	/* We have no MC entry for this VID, try to find an empty one */
+	for (i = 0; i < smi->num_vlan_mc; i++) {
+		err = smi->ops->get_vlan_mc(smi, i, &vlanmc);
+		if (err)
+			return err;
+
+		if (vlanmc.vid == 0 && vlanmc.member == 0) {
+			/* Update the entry from the 4K table */
+			err = smi->ops->get_vlan_4k(smi, vid, &vlan4k);
+			if (err)
+				return err;
+
+			vlanmc.vid = vid;
+			vlanmc.member = vlan4k.member;
+			vlanmc.untag = vlan4k.untag;
+			vlanmc.fid = vlan4k.fid;
+			err = smi->ops->set_vlan_mc(smi, i, &vlanmc);
+			if (err)
+				return err;
+
+			err = smi->ops->set_mc_index(smi, port, i);
+			return err;
+		}
+	}
+
+	/* MC table is full, try to find an unused entry and replace it */
+	for (i = 0; i < smi->num_vlan_mc; i++) {
+		int used;
+
+		err = rtl8366_mc_is_used(smi, i, &used);
+		if (err)
+			return err;
+
+		if (!used) {
+			/* Update the entry from the 4K table */
+			err = smi->ops->get_vlan_4k(smi, vid, &vlan4k);
+			if (err)
+				return err;
+
+			vlanmc.vid = vid;
+			vlanmc.member = vlan4k.member;
+			vlanmc.untag = vlan4k.untag;
+			vlanmc.fid = vlan4k.fid;
+			err = smi->ops->set_vlan_mc(smi, i, &vlanmc);
+			if (err)
+				return err;
+
+			err = smi->ops->set_mc_index(smi, port, i);
+			return err;
+		}
+	}
+
+	dev_err(smi->parent,
+		"all VLAN member configurations are in use\n");
+
+	return -ENOSPC;
+}
+
+static int rtl8366_smi_enable_vlan(struct rtl8366_smi *smi, int enable)
+{
+	int err;
+
+	err = smi->ops->enable_vlan(smi, enable);
+	if (err)
+		return err;
+
+	smi->vlan_enabled = enable;
+
+	if (!enable) {
+		smi->vlan4k_enabled = 0;
+		err = smi->ops->enable_vlan4k(smi, enable);
+	}
+
+	return err;
+}
+
+static int rtl8366_smi_enable_vlan4k(struct rtl8366_smi *smi, int enable)
+{
+	int err;
+
+	if (enable) {
+		err = smi->ops->enable_vlan(smi, enable);
+		if (err)
+			return err;
+
+		smi->vlan_enabled = enable;
+	}
+
+	err = smi->ops->enable_vlan4k(smi, enable);
+	if (err)
+		return err;
+
+	smi->vlan4k_enabled = enable;
+	return 0;
+}
+
+static int rtl8366_smi_enable_all_ports(struct rtl8366_smi *smi, int enable)
+{
+	int port;
+	int err;
+
+	for (port = 0; port < smi->num_ports; port++) {
+		err = smi->ops->enable_port(smi, port, enable);
+		if (err)
+			return err;
+	}
+
+	return 0;
+}
+
+static int rtl8366_smi_reset_vlan(struct rtl8366_smi *smi)
+{
+	struct rtl8366_vlan_mc vlanmc;
+	int err;
+	int i;
+
+	rtl8366_smi_enable_vlan(smi, 0);
+	rtl8366_smi_enable_vlan4k(smi, 0);
+
+	/* clear VLAN member configurations */
+	vlanmc.vid = 0;
+	vlanmc.priority = 0;
+	vlanmc.member = 0;
+	vlanmc.untag = 0;
+	vlanmc.fid = 0;
+	for (i = 0; i < smi->num_vlan_mc; i++) {
+		err = smi->ops->set_vlan_mc(smi, i, &vlanmc);
+		if (err)
+			return err;
+	}
+
+	return 0;
+}
+
+static int rtl8366_init_vlan(struct rtl8366_smi *smi)
+{
+	int port;
+	int err;
+
+	err = rtl8366_smi_reset_vlan(smi);
+	if (err)
+		return err;
+
+	for (port = 0; port < smi->num_ports; port++) {
+		u32 mask;
+
+		if (port == smi->cpu_port)
+			mask = (1 << smi->num_ports) - 1;
+		else
+			mask = (1 << port) | (1 << smi->cpu_port);
+
+		err = rtl8366_set_vlan(smi, (port + 1), mask, mask, 0);
+		if (err)
+			return err;
+
+		err = rtl8366_set_pvid(smi, port, (port + 1));
+		if (err)
+			return err;
+	}
+
+	return rtl8366_smi_enable_vlan(smi, 1);
+}
+
+#ifdef CONFIG_RTL8366_SMI_DEBUG_FS
+int rtl8366_debugfs_open(struct inode *inode, struct file *file)
+{
+	file->private_data = inode->i_private;
+	return 0;
+}
+EXPORT_SYMBOL_GPL(rtl8366_debugfs_open);
+
+static ssize_t rtl8366_read_debugfs_vlan_mc(struct file *file,
+					      char __user *user_buf,
+					      size_t count, loff_t *ppos)
+{
+	struct rtl8366_smi *smi = (struct rtl8366_smi *)file->private_data;
+	int i, len = 0;
+	char *buf = smi->buf;
+
+	len += snprintf(buf + len, sizeof(smi->buf) - len,
+			"%2s %6s %4s %6s %6s %3s\n",
+			"id", "vid","prio", "member", "untag", "fid");
+
+	for (i = 0; i < smi->num_vlan_mc; ++i) {
+		struct rtl8366_vlan_mc vlanmc;
+
+		smi->ops->get_vlan_mc(smi, i, &vlanmc);
+
+		len += snprintf(buf + len, sizeof(smi->buf) - len,
+				"%2d %6d %4d 0x%04x 0x%04x %3d\n",
+				i, vlanmc.vid, vlanmc.priority,
+				vlanmc.member, vlanmc.untag, vlanmc.fid);
+	}
+
+	return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+#define RTL8366_VLAN4K_PAGE_SIZE	64
+#define RTL8366_VLAN4K_NUM_PAGES	(4096 / RTL8366_VLAN4K_PAGE_SIZE)
+
+static ssize_t rtl8366_read_debugfs_vlan_4k(struct file *file,
+					    char __user *user_buf,
+					    size_t count, loff_t *ppos)
+{
+	struct rtl8366_smi *smi = (struct rtl8366_smi *)file->private_data;
+	int i, len = 0;
+	int offset;
+	char *buf = smi->buf;
+
+	if (smi->dbg_vlan_4k_page >= RTL8366_VLAN4K_NUM_PAGES) {
+		len += snprintf(buf + len, sizeof(smi->buf) - len,
+				"invalid page: %u\n", smi->dbg_vlan_4k_page);
+		return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+	}
+
+	len += snprintf(buf + len, sizeof(smi->buf) - len,
+			"%4s %6s %6s %3s\n",
+			"vid", "member", "untag", "fid");
+
+	offset = RTL8366_VLAN4K_PAGE_SIZE * smi->dbg_vlan_4k_page;
+	for (i = 0; i < RTL8366_VLAN4K_PAGE_SIZE; i++) {
+		struct rtl8366_vlan_4k vlan4k;
+
+		smi->ops->get_vlan_4k(smi, offset + i, &vlan4k);
+
+		len += snprintf(buf + len, sizeof(smi->buf) - len,
+				"%4d 0x%04x 0x%04x %3d\n",
+				vlan4k.vid, vlan4k.member,
+				vlan4k.untag, vlan4k.fid);
+	}
+
+	return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t rtl8366_read_debugfs_pvid(struct file *file,
+					 char __user *user_buf,
+					 size_t count, loff_t *ppos)
+{
+	struct rtl8366_smi *smi = (struct rtl8366_smi *)file->private_data;
+	char *buf = smi->buf;
+	int len = 0;
+	int i;
+
+	len += snprintf(buf + len, sizeof(smi->buf) - len, "%4s %4s\n",
+			"port", "pvid");
+
+	for (i = 0; i < smi->num_ports; i++) {
+		int pvid;
+		int err;
+
+		err = rtl8366_get_pvid(smi, i, &pvid);
+		if (err)
+			len += snprintf(buf + len, sizeof(smi->buf) - len,
+				"%4d error\n", i);
+		else
+			len += snprintf(buf + len, sizeof(smi->buf) - len,
+				"%4d %4d\n", i, pvid);
+	}
+
+	return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t rtl8366_read_debugfs_reg(struct file *file,
+					 char __user *user_buf,
+					 size_t count, loff_t *ppos)
+{
+	struct rtl8366_smi *smi = (struct rtl8366_smi *)file->private_data;
+	u32 t, reg = smi->dbg_reg;
+	int err, len = 0;
+	char *buf = smi->buf;
+
+	memset(buf, '\0', sizeof(smi->buf));
+
+	err = rtl8366_smi_read_reg(smi, reg, &t);
+	if (err) {
+		len += snprintf(buf, sizeof(smi->buf),
+				"Read failed (reg: 0x%04x)\n", reg);
+		return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+	}
+
+	len += snprintf(buf, sizeof(smi->buf), "reg = 0x%04x, val = 0x%04x\n",
+			reg, t);
+
+	return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t rtl8366_write_debugfs_reg(struct file *file,
+					  const char __user *user_buf,
+					  size_t count, loff_t *ppos)
+{
+	struct rtl8366_smi *smi = (struct rtl8366_smi *)file->private_data;
+	unsigned long data;
+	u32 reg = smi->dbg_reg;
+	int err;
+	size_t len;
+	char *buf = smi->buf;
+
+	len = min(count, sizeof(smi->buf) - 1);
+	if (copy_from_user(buf, user_buf, len)) {
+		dev_err(smi->parent, "copy from user failed\n");
+		return -EFAULT;
+	}
+
+	buf[len] = '\0';
+	if (len > 0 && buf[len - 1] == '\n')
+		buf[len - 1] = '\0';
+
+
+	if (kstrtoul(buf, 16, &data)) {
+		dev_err(smi->parent, "Invalid reg value %s\n", buf);
+	} else {
+		err = rtl8366_smi_write_reg(smi, reg, data);
+		if (err) {
+			dev_err(smi->parent,
+				"writing reg 0x%04x val 0x%04lx failed\n",
+				reg, data);
+		}
+	}
+
+	return count;
+}
+
+static ssize_t rtl8366_read_debugfs_mibs(struct file *file,
+					 char __user *user_buf,
+					 size_t count, loff_t *ppos)
+{
+	struct rtl8366_smi *smi = file->private_data;
+	int i, j, len = 0;
+	char *buf = smi->buf;
+
+	len += snprintf(buf + len, sizeof(smi->buf) - len, "%-36s",
+			"Counter");
+
+	for (i = 0; i < smi->num_ports; i++) {
+		char port_buf[10];
+
+		snprintf(port_buf, sizeof(port_buf), "Port %d", i);
+		len += snprintf(buf + len, sizeof(smi->buf) - len, " %12s",
+				port_buf);
+	}
+	len += snprintf(buf + len, sizeof(smi->buf) - len, "\n");
+
+	for (i = 0; i < smi->num_mib_counters; i++) {
+		len += snprintf(buf + len, sizeof(smi->buf) - len, "%-36s ",
+				smi->mib_counters[i].name);
+		for (j = 0; j < smi->num_ports; j++) {
+			unsigned long long counter = 0;
+
+			if (!smi->ops->get_mib_counter(smi, i, j, &counter))
+				len += snprintf(buf + len,
+						sizeof(smi->buf) - len,
+						"%12llu ", counter);
+			else
+				len += snprintf(buf + len,
+						sizeof(smi->buf) - len,
+						"%12s ", "error");
+		}
+		len += snprintf(buf + len, sizeof(smi->buf) - len, "\n");
+	}
+
+	return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static const struct file_operations fops_rtl8366_regs = {
+	.read	= rtl8366_read_debugfs_reg,
+	.write	= rtl8366_write_debugfs_reg,
+	.open	= rtl8366_debugfs_open,
+	.owner	= THIS_MODULE
+};
+
+static const struct file_operations fops_rtl8366_vlan_mc = {
+	.read	= rtl8366_read_debugfs_vlan_mc,
+	.open	= rtl8366_debugfs_open,
+	.owner	= THIS_MODULE
+};
+
+static const struct file_operations fops_rtl8366_vlan_4k = {
+	.read	= rtl8366_read_debugfs_vlan_4k,
+	.open	= rtl8366_debugfs_open,
+	.owner	= THIS_MODULE
+};
+
+static const struct file_operations fops_rtl8366_pvid = {
+	.read	= rtl8366_read_debugfs_pvid,
+	.open	= rtl8366_debugfs_open,
+	.owner	= THIS_MODULE
+};
+
+static const struct file_operations fops_rtl8366_mibs = {
+	.read = rtl8366_read_debugfs_mibs,
+	.open = rtl8366_debugfs_open,
+	.owner = THIS_MODULE
+};
+
+static void rtl8366_debugfs_init(struct rtl8366_smi *smi)
+{
+	struct dentry *node;
+	struct dentry *root;
+
+	if (!smi->debugfs_root)
+		smi->debugfs_root = debugfs_create_dir(dev_name(smi->parent),
+						       NULL);
+
+	if (!smi->debugfs_root) {
+		dev_err(smi->parent, "Unable to create debugfs dir\n");
+		return;
+	}
+	root = smi->debugfs_root;
+
+	node = debugfs_create_x16("reg", S_IRUGO | S_IWUSR, root,
+				  &smi->dbg_reg);
+	if (!node) {
+		dev_err(smi->parent, "Creating debugfs file '%s' failed\n",
+			"reg");
+		return;
+	}
+
+	node = debugfs_create_file("val", S_IRUGO | S_IWUSR, root, smi,
+				   &fops_rtl8366_regs);
+	if (!node) {
+		dev_err(smi->parent, "Creating debugfs file '%s' failed\n",
+			"val");
+		return;
+	}
+
+	node = debugfs_create_file("vlan_mc", S_IRUSR, root, smi,
+				   &fops_rtl8366_vlan_mc);
+	if (!node) {
+		dev_err(smi->parent, "Creating debugfs file '%s' failed\n",
+			"vlan_mc");
+		return;
+	}
+
+	node = debugfs_create_u8("vlan_4k_page", S_IRUGO | S_IWUSR, root,
+				  &smi->dbg_vlan_4k_page);
+	if (!node) {
+		dev_err(smi->parent, "Creating debugfs file '%s' failed\n",
+			"vlan_4k_page");
+		return;
+	}
+
+	node = debugfs_create_file("vlan_4k", S_IRUSR, root, smi,
+				   &fops_rtl8366_vlan_4k);
+	if (!node) {
+		dev_err(smi->parent, "Creating debugfs file '%s' failed\n",
+			"vlan_4k");
+		return;
+	}
+
+	node = debugfs_create_file("pvid", S_IRUSR, root, smi,
+				   &fops_rtl8366_pvid);
+	if (!node) {
+		dev_err(smi->parent, "Creating debugfs file '%s' failed\n",
+			"pvid");
+		return;
+	}
+
+	node = debugfs_create_file("mibs", S_IRUSR, smi->debugfs_root, smi,
+				   &fops_rtl8366_mibs);
+	if (!node)
+		dev_err(smi->parent, "Creating debugfs file '%s' failed\n",
+			"mibs");
+}
+
+static void rtl8366_debugfs_remove(struct rtl8366_smi *smi)
+{
+	if (smi->debugfs_root) {
+		debugfs_remove_recursive(smi->debugfs_root);
+		smi->debugfs_root = NULL;
+	}
+}
+#else
+static inline void rtl8366_debugfs_init(struct rtl8366_smi *smi) {}
+static inline void rtl8366_debugfs_remove(struct rtl8366_smi *smi) {}
+#endif /* CONFIG_RTL8366_SMI_DEBUG_FS */
+
+static int rtl8366_smi_mii_init(struct rtl8366_smi *smi)
+{
+	int ret;
+
+#ifdef CONFIG_OF
+	struct device_node *np = NULL;
+
+	np = of_get_child_by_name(smi->parent->of_node, "mdio-bus");
+#endif
+
+	smi->mii_bus = mdiobus_alloc();
+	if (smi->mii_bus == NULL) {
+		ret = -ENOMEM;
+		goto err;
+	}
+
+	smi->mii_bus->priv = (void *) smi;
+	smi->mii_bus->name = dev_name(smi->parent);
+	smi->mii_bus->read = smi->ops->mii_read;
+	smi->mii_bus->write = smi->ops->mii_write;
+	snprintf(smi->mii_bus->id, MII_BUS_ID_SIZE, "%s",
+		 dev_name(smi->parent));
+	smi->mii_bus->parent = smi->parent;
+	smi->mii_bus->phy_mask = ~(0x1f);
+
+#ifdef CONFIG_OF
+	if (np)
+		ret = of_mdiobus_register(smi->mii_bus, np);
+	else
+#endif
+		ret = mdiobus_register(smi->mii_bus);
+
+	if (ret)
+		goto err_free;
+
+	return 0;
+
+ err_free:
+	mdiobus_free(smi->mii_bus);
+ err:
+	return ret;
+}
+
+static void rtl8366_smi_mii_cleanup(struct rtl8366_smi *smi)
+{
+	mdiobus_unregister(smi->mii_bus);
+	mdiobus_free(smi->mii_bus);
+}
+
+int rtl8366_sw_reset_switch(struct switch_dev *dev)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	int err;
+
+	err = rtl8366_reset(smi);
+	if (err)
+		return err;
+
+	err = smi->ops->setup(smi);
+	if (err)
+		return err;
+
+	err = rtl8366_smi_reset_vlan(smi);
+	if (err)
+		return err;
+
+	err = rtl8366_smi_enable_vlan(smi, 1);
+	if (err)
+		return err;
+
+	return rtl8366_smi_enable_all_ports(smi, 1);
+}
+EXPORT_SYMBOL_GPL(rtl8366_sw_reset_switch);
+
+int rtl8366_sw_get_port_pvid(struct switch_dev *dev, int port, int *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	return rtl8366_get_pvid(smi, port, val);
+}
+EXPORT_SYMBOL_GPL(rtl8366_sw_get_port_pvid);
+
+int rtl8366_sw_set_port_pvid(struct switch_dev *dev, int port, int val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	return rtl8366_set_pvid(smi, port, val);
+}
+EXPORT_SYMBOL_GPL(rtl8366_sw_set_port_pvid);
+
+int rtl8366_sw_get_port_mib(struct switch_dev *dev,
+			    const struct switch_attr *attr,
+			    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	int i, len = 0;
+	unsigned long long counter = 0;
+	char *buf = smi->buf;
+
+	if (val->port_vlan >= smi->num_ports)
+		return -EINVAL;
+
+	len += snprintf(buf + len, sizeof(smi->buf) - len,
+			"Port %d MIB counters\n",
+			val->port_vlan);
+
+	for (i = 0; i < smi->num_mib_counters; ++i) {
+		len += snprintf(buf + len, sizeof(smi->buf) - len,
+				"%-36s: ", smi->mib_counters[i].name);
+		if (!smi->ops->get_mib_counter(smi, i, val->port_vlan,
+					       &counter))
+			len += snprintf(buf + len, sizeof(smi->buf) - len,
+					"%llu\n", counter);
+		else
+			len += snprintf(buf + len, sizeof(smi->buf) - len,
+					"%s\n", "error");
+	}
+
+	val->value.s = buf;
+	val->len = len;
+	return 0;
+}
+EXPORT_SYMBOL_GPL(rtl8366_sw_get_port_mib);
+
+int rtl8366_sw_get_port_stats(struct switch_dev *dev, int port,
+				struct switch_port_stats *stats,
+				int txb_id, int rxb_id)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	unsigned long long counter = 0;
+	int ret;
+
+	if (port >= smi->num_ports)
+		return -EINVAL;
+
+	ret = smi->ops->get_mib_counter(smi, txb_id, port, &counter);
+	if (ret)
+		return ret;
+
+	stats->tx_bytes = counter;
+
+	ret = smi->ops->get_mib_counter(smi, rxb_id, port, &counter);
+	if (ret)
+		return ret;
+
+	stats->rx_bytes = counter;
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(rtl8366_sw_get_port_stats);
+
+int rtl8366_sw_get_vlan_info(struct switch_dev *dev,
+			     const struct switch_attr *attr,
+			     struct switch_val *val)
+{
+	int i;
+	u32 len = 0;
+	struct rtl8366_vlan_4k vlan4k;
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	char *buf = smi->buf;
+	int err;
+
+	if (!smi->ops->is_vlan_valid(smi, val->port_vlan))
+		return -EINVAL;
+
+	memset(buf, '\0', sizeof(smi->buf));
+
+	err = smi->ops->get_vlan_4k(smi, val->port_vlan, &vlan4k);
+	if (err)
+		return err;
+
+	len += snprintf(buf + len, sizeof(smi->buf) - len,
+			"VLAN %d: Ports: '", vlan4k.vid);
+
+	for (i = 0; i < smi->num_ports; i++) {
+		if (!(vlan4k.member & (1 << i)))
+			continue;
+
+		len += snprintf(buf + len, sizeof(smi->buf) - len, "%d%s", i,
+				(vlan4k.untag & (1 << i)) ? "" : "t");
+	}
+
+	len += snprintf(buf + len, sizeof(smi->buf) - len,
+			"', members=%04x, untag=%04x, fid=%u",
+			vlan4k.member, vlan4k.untag, vlan4k.fid);
+
+	val->value.s = buf;
+	val->len = len;
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(rtl8366_sw_get_vlan_info);
+
+int rtl8366_sw_get_vlan_ports(struct switch_dev *dev, struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	struct switch_port *port;
+	struct rtl8366_vlan_4k vlan4k;
+	int i;
+
+	if (!smi->ops->is_vlan_valid(smi, val->port_vlan))
+		return -EINVAL;
+
+	smi->ops->get_vlan_4k(smi, val->port_vlan, &vlan4k);
+
+	port = &val->value.ports[0];
+	val->len = 0;
+	for (i = 0; i < smi->num_ports; i++) {
+		if (!(vlan4k.member & BIT(i)))
+			continue;
+
+		port->id = i;
+		port->flags = (vlan4k.untag & BIT(i)) ?
+					0 : BIT(SWITCH_PORT_FLAG_TAGGED);
+		val->len++;
+		port++;
+	}
+	return 0;
+}
+EXPORT_SYMBOL_GPL(rtl8366_sw_get_vlan_ports);
+
+int rtl8366_sw_set_vlan_ports(struct switch_dev *dev, struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	struct switch_port *port;
+	u32 member = 0;
+	u32 untag = 0;
+	int err;
+	int i;
+
+	if (!smi->ops->is_vlan_valid(smi, val->port_vlan))
+		return -EINVAL;
+
+	port = &val->value.ports[0];
+	for (i = 0; i < val->len; i++, port++) {
+		int pvid = 0;
+		member |= BIT(port->id);
+
+		if (!(port->flags & BIT(SWITCH_PORT_FLAG_TAGGED)))
+			untag |= BIT(port->id);
+
+		/*
+		 * To ensure that we have a valid MC entry for this VLAN,
+		 * initialize the port VLAN ID here.
+		 */
+		err = rtl8366_get_pvid(smi, port->id, &pvid);
+		if (err < 0)
+			return err;
+		if (pvid == 0) {
+			err = rtl8366_set_pvid(smi, port->id, val->port_vlan);
+			if (err < 0)
+				return err;
+		}
+	}
+
+	return rtl8366_set_vlan(smi, val->port_vlan, member, untag, 0);
+}
+EXPORT_SYMBOL_GPL(rtl8366_sw_set_vlan_ports);
+
+int rtl8366_sw_get_vlan_fid(struct switch_dev *dev,
+			    const struct switch_attr *attr,
+			    struct switch_val *val)
+{
+	struct rtl8366_vlan_4k vlan4k;
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	int err;
+
+	if (!smi->ops->is_vlan_valid(smi, val->port_vlan))
+		return -EINVAL;
+
+	err = smi->ops->get_vlan_4k(smi, val->port_vlan, &vlan4k);
+	if (err)
+		return err;
+
+	val->value.i = vlan4k.fid;
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(rtl8366_sw_get_vlan_fid);
+
+int rtl8366_sw_set_vlan_fid(struct switch_dev *dev,
+			    const struct switch_attr *attr,
+			    struct switch_val *val)
+{
+	struct rtl8366_vlan_4k vlan4k;
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	int err;
+
+	if (!smi->ops->is_vlan_valid(smi, val->port_vlan))
+		return -EINVAL;
+
+	if (val->value.i < 0 || val->value.i > attr->max)
+		return -EINVAL;
+
+	err = smi->ops->get_vlan_4k(smi, val->port_vlan, &vlan4k);
+	if (err)
+		return err;
+
+	return rtl8366_set_vlan(smi, val->port_vlan,
+				vlan4k.member,
+				vlan4k.untag,
+				val->value.i);
+}
+EXPORT_SYMBOL_GPL(rtl8366_sw_set_vlan_fid);
+
+int rtl8366_sw_get_vlan_enable(struct switch_dev *dev,
+			       const struct switch_attr *attr,
+			       struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+
+	if (attr->ofs > 2)
+		return -EINVAL;
+
+	if (attr->ofs == 1)
+		val->value.i = smi->vlan_enabled;
+	else
+		val->value.i = smi->vlan4k_enabled;
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(rtl8366_sw_get_vlan_enable);
+
+int rtl8366_sw_set_vlan_enable(struct switch_dev *dev,
+			       const struct switch_attr *attr,
+			       struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	int err;
+
+	if (attr->ofs > 2)
+		return -EINVAL;
+
+	if (attr->ofs == 1)
+		err = rtl8366_smi_enable_vlan(smi, val->value.i);
+	else
+		err = rtl8366_smi_enable_vlan4k(smi, val->value.i);
+
+	return err;
+}
+EXPORT_SYMBOL_GPL(rtl8366_sw_set_vlan_enable);
+
+struct rtl8366_smi *rtl8366_smi_alloc(struct device *parent)
+{
+	struct rtl8366_smi *smi;
+
+	BUG_ON(!parent);
+
+	smi = kzalloc(sizeof(*smi), GFP_KERNEL);
+	if (!smi) {
+		dev_err(parent, "no memory for private data\n");
+		return NULL;
+	}
+
+	smi->parent = parent;
+	return smi;
+}
+EXPORT_SYMBOL_GPL(rtl8366_smi_alloc);
+
+static int __rtl8366_smi_init(struct rtl8366_smi *smi, const char *name)
+{
+	int err;
+
+	if (!smi->ext_mbus) {
+		err = gpio_request(smi->gpio_sda, name);
+		if (err) {
+			printk(KERN_ERR "rtl8366_smi: gpio_request failed for %u, err=%d\n",
+				smi->gpio_sda, err);
+			goto err_out;
+		}
+
+		err = gpio_request(smi->gpio_sck, name);
+		if (err) {
+			printk(KERN_ERR "rtl8366_smi: gpio_request failed for %u, err=%d\n",
+				smi->gpio_sck, err);
+			goto err_free_sda;
+		}
+	}
+
+	spin_lock_init(&smi->lock);
+
+	/* start the switch */
+	if (smi->hw_reset) {
+		smi->hw_reset(smi, false);
+		msleep(RTL8366_SMI_HW_START_DELAY);
+	}
+
+	return 0;
+
+ err_free_sda:
+	gpio_free(smi->gpio_sda);
+ err_out:
+	return err;
+}
+
+static void __rtl8366_smi_cleanup(struct rtl8366_smi *smi)
+{
+	if (smi->hw_reset)
+		smi->hw_reset(smi, true);
+
+	if (!smi->ext_mbus) {
+		gpio_free(smi->gpio_sck);
+		gpio_free(smi->gpio_sda);
+	}
+}
+
+enum rtl8366_type rtl8366_smi_detect(struct rtl8366_platform_data *pdata)
+{
+	static struct rtl8366_smi smi;
+	enum rtl8366_type type = RTL8366_TYPE_UNKNOWN;
+	u32 reg = 0;
+
+	memset(&smi, 0, sizeof(smi));
+	smi.gpio_sda = pdata->gpio_sda;
+	smi.gpio_sck = pdata->gpio_sck;
+	smi.clk_delay = 10;
+	smi.cmd_read  = 0xa9;
+	smi.cmd_write = 0xa8;
+
+	if (__rtl8366_smi_init(&smi, "rtl8366"))
+		goto out;
+
+	if (rtl8366_smi_read_reg(&smi, 0x5c, &reg))
+		goto cleanup;
+
+	switch(reg) {
+	case 0x6027:
+		printk("Found an RTL8366S switch\n");
+		type = RTL8366_TYPE_S;
+		break;
+	case 0x5937:
+		printk("Found an RTL8366RB switch\n");
+		type = RTL8366_TYPE_RB;
+		break;
+	default:
+		printk("Found an Unknown RTL8366 switch (id=0x%04x)\n", reg);
+		break;
+	}
+
+cleanup:
+	__rtl8366_smi_cleanup(&smi);
+out:
+	return type;
+}
+
+int rtl8366_smi_init(struct rtl8366_smi *smi)
+{
+	int err;
+
+	if (!smi->ops)
+		return -EINVAL;
+
+	err = __rtl8366_smi_init(smi, dev_name(smi->parent));
+	if (err)
+		goto err_out;
+
+	if (!smi->ext_mbus)
+		dev_info(smi->parent, "using GPIO pins %u (SDA) and %u (SCK)\n",
+			 smi->gpio_sda, smi->gpio_sck);
+	else
+		dev_info(smi->parent, "using MDIO bus '%s'\n", smi->ext_mbus->name);
+
+	err = smi->ops->detect(smi);
+	if (err) {
+		dev_err(smi->parent, "chip detection failed, err=%d\n", err);
+		goto err_free_sck;
+	}
+
+	err = rtl8366_reset(smi);
+	if (err)
+		goto err_free_sck;
+
+	err = smi->ops->setup(smi);
+	if (err) {
+		dev_err(smi->parent, "chip setup failed, err=%d\n", err);
+		goto err_free_sck;
+	}
+
+	err = rtl8366_init_vlan(smi);
+	if (err) {
+		dev_err(smi->parent, "VLAN initialization failed, err=%d\n",
+			err);
+		goto err_free_sck;
+	}
+
+	err = rtl8366_smi_enable_all_ports(smi, 1);
+	if (err)
+		goto err_free_sck;
+
+	err = rtl8366_smi_mii_init(smi);
+	if (err)
+		goto err_free_sck;
+
+	rtl8366_debugfs_init(smi);
+
+	return 0;
+
+ err_free_sck:
+	__rtl8366_smi_cleanup(smi);
+ err_out:
+	return err;
+}
+EXPORT_SYMBOL_GPL(rtl8366_smi_init);
+
+void rtl8366_smi_cleanup(struct rtl8366_smi *smi)
+{
+	rtl8366_debugfs_remove(smi);
+	rtl8366_smi_mii_cleanup(smi);
+	__rtl8366_smi_cleanup(smi);
+}
+EXPORT_SYMBOL_GPL(rtl8366_smi_cleanup);
+
+#ifdef CONFIG_OF
+static void rtl8366_smi_reset(struct rtl8366_smi *smi, bool active)
+{
+	if (active)
+		reset_control_assert(smi->reset);
+	else
+		reset_control_deassert(smi->reset);
+}
+
+static int rtl8366_smi_probe_of(struct platform_device *pdev, struct rtl8366_smi *smi)
+{
+	int sck = of_get_named_gpio(pdev->dev.of_node, "gpio-sck", 0);
+	int sda = of_get_named_gpio(pdev->dev.of_node, "gpio-sda", 0);
+	struct device_node *np = pdev->dev.of_node;
+	struct device_node *mdio_node;
+
+	mdio_node = of_parse_phandle(np, "mii-bus", 0);
+	if (!mdio_node) {
+		dev_err(&pdev->dev, "cannot find mdio node phandle");
+		goto try_gpio;
+	}
+
+	smi->ext_mbus = of_mdio_find_bus(mdio_node);
+	if (!smi->ext_mbus) {
+		dev_info(&pdev->dev,
+			"cannot find mdio bus from bus handle (yet)");
+		goto try_gpio;
+	}
+
+	if (of_property_read_u32(np, "phy-id", &smi->phy_id))
+		smi->phy_id = MDC_REALTEK_PHY_ADDR;
+
+	return 0;
+
+try_gpio:
+	if (!gpio_is_valid(sck) || !gpio_is_valid(sda)) {
+		if (!mdio_node) {
+			dev_err(&pdev->dev, "gpios missing in devictree\n");
+			return -EINVAL;
+		} else {
+			return -EPROBE_DEFER;
+		}
+	}
+
+	smi->gpio_sda = sda;
+	smi->gpio_sck = sck;
+	smi->reset = devm_reset_control_get(&pdev->dev, "switch");
+	if (!IS_ERR(smi->reset))
+		smi->hw_reset = rtl8366_smi_reset;
+
+	return 0;
+}
+#else
+static inline int rtl8366_smi_probe_of(struct platform_device *pdev, struct rtl8366_smi *smi)
+{
+	return -ENODEV;
+}
+#endif
+
+static int rtl8366_smi_probe_plat(struct platform_device *pdev, struct rtl8366_smi *smi)
+{
+	struct rtl8366_platform_data *pdata = pdev->dev.platform_data;
+
+	if (!pdev->dev.platform_data) {
+		dev_err(&pdev->dev, "no platform data specified\n");
+		return -EINVAL;
+	}
+
+	smi->gpio_sda = pdata->gpio_sda;
+	smi->gpio_sck = pdata->gpio_sck;
+	smi->hw_reset = pdata->hw_reset;
+	smi->phy_id = MDC_REALTEK_PHY_ADDR;
+
+	return 0;
+}
+
+
+struct rtl8366_smi *rtl8366_smi_probe(struct platform_device *pdev)
+{
+	struct rtl8366_smi *smi;
+	int err;
+
+	smi = rtl8366_smi_alloc(&pdev->dev);
+	if (!smi)
+		return NULL;
+
+	if (pdev->dev.of_node)
+		err = rtl8366_smi_probe_of(pdev, smi);
+	else
+		err = rtl8366_smi_probe_plat(pdev, smi);
+
+	if (err)
+		goto free_smi;
+
+	return smi;
+
+free_smi:
+	kfree(smi);
+	return ERR_PTR(err);
+}
+EXPORT_SYMBOL_GPL(rtl8366_smi_probe);
+
+MODULE_DESCRIPTION("Realtek RTL8366 SMI interface driver");
+MODULE_AUTHOR("Gabor Juhos <juhosg@openwrt.org>");
+MODULE_LICENSE("GPL v2");
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/rtl8366_smi.h b/6.12/target/linux/generic/files/drivers/net/phy/rtl8366_smi.h
new file mode 100644
index 00000000..2608240b
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/rtl8366_smi.h
@@ -0,0 +1,171 @@
+/*
+ * Realtek RTL8366 SMI interface driver defines
+ *
+ * Copyright (C) 2009-2010 Gabor Juhos <juhosg@openwrt.org>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ */
+
+#ifndef _RTL8366_SMI_H
+#define _RTL8366_SMI_H
+
+#include <linux/phy.h>
+#include <linux/switch.h>
+#include <linux/platform_device.h>
+#include <linux/reset.h>
+
+struct rtl8366_smi_ops;
+struct rtl8366_vlan_ops;
+struct mii_bus;
+struct dentry;
+struct inode;
+struct file;
+
+typedef enum rtl8367b_chip_e {
+	RTL8367B_CHIP_UNKNOWN,
+ /* Family B */
+	RTL8367B_CHIP_RTL8367RB,
+	RTL8367B_CHIP_RTL8367R_VB, /* chip with exception in extif assignment */
+/* Family C */
+	RTL8367B_CHIP_RTL8367RB_VB,
+	RTL8367B_CHIP_RTL8367S,
+/* Family D */
+	RTL8367B_CHIP_RTL8367S_VB /* chip with exception in extif assignment */
+} rtl8367b_chip_t;
+
+struct rtl8366_mib_counter {
+	unsigned	base;
+	unsigned	offset;
+	unsigned	length;
+	const char	*name;
+};
+
+struct rtl8366_smi {
+	struct device		*parent;
+	unsigned int		gpio_sda;
+	unsigned int		gpio_sck;
+	void			(*hw_reset)(struct rtl8366_smi *smi, bool active);
+	unsigned int		clk_delay;	/* ns */
+	u8			cmd_read;
+	u8			cmd_write;
+	spinlock_t		lock;
+	struct mii_bus		*mii_bus;
+	int			mii_irq[PHY_MAX_ADDR];
+	struct switch_dev	sw_dev;
+
+	unsigned int		cpu_port;
+	unsigned int		num_ports;
+	unsigned int		num_vlan_mc;
+	unsigned int		num_mib_counters;
+	struct rtl8366_mib_counter *mib_counters;
+
+	struct rtl8366_smi_ops	*ops;
+
+	int			vlan_enabled;
+	int			vlan4k_enabled;
+
+	char			buf[4096];
+
+	struct reset_control	*reset;
+
+#ifdef CONFIG_RTL8366_SMI_DEBUG_FS
+	struct dentry           *debugfs_root;
+	u16			dbg_reg;
+	u8			dbg_vlan_4k_page;
+#endif
+	u32			phy_id;
+	rtl8367b_chip_t		rtl8367b_chip;
+	struct mii_bus		*ext_mbus;
+	struct rtl8366_vlan_mc *emu_vlanmc;
+};
+
+struct rtl8366_vlan_mc {
+	u16	vid;
+	u16	untag;
+	u16	member;
+	u8	fid;
+	u8	priority;
+};
+
+struct rtl8366_vlan_4k {
+	u16	vid;
+	u16	untag;
+	u16	member;
+	u8	fid;
+};
+
+struct rtl8366_smi_ops {
+	int	(*detect)(struct rtl8366_smi *smi);
+	int	(*reset_chip)(struct rtl8366_smi *smi);
+	int	(*setup)(struct rtl8366_smi *smi);
+
+	int	(*mii_read)(struct mii_bus *bus, int addr, int reg);
+	int	(*mii_write)(struct mii_bus *bus, int addr, int reg, u16 val);
+
+	int	(*get_vlan_mc)(struct rtl8366_smi *smi, u32 index,
+			       struct rtl8366_vlan_mc *vlanmc);
+	int	(*set_vlan_mc)(struct rtl8366_smi *smi, u32 index,
+			       const struct rtl8366_vlan_mc *vlanmc);
+	int	(*get_vlan_4k)(struct rtl8366_smi *smi, u32 vid,
+			       struct rtl8366_vlan_4k *vlan4k);
+	int	(*set_vlan_4k)(struct rtl8366_smi *smi,
+			       const struct rtl8366_vlan_4k *vlan4k);
+	int	(*get_mc_index)(struct rtl8366_smi *smi, int port, int *val);
+	int	(*set_mc_index)(struct rtl8366_smi *smi, int port, int index);
+	int	(*get_mib_counter)(struct rtl8366_smi *smi, int counter,
+				   int port, unsigned long long *val);
+	int	(*is_vlan_valid)(struct rtl8366_smi *smi, unsigned vlan);
+	int	(*enable_vlan)(struct rtl8366_smi *smi, int enable);
+	int	(*enable_vlan4k)(struct rtl8366_smi *smi, int enable);
+	int	(*enable_port)(struct rtl8366_smi *smi, int port, int enable);
+};
+
+struct rtl8366_smi *rtl8366_smi_alloc(struct device *parent);
+int rtl8366_smi_init(struct rtl8366_smi *smi);
+void rtl8366_smi_cleanup(struct rtl8366_smi *smi);
+int rtl8366_smi_write_reg(struct rtl8366_smi *smi, u32 addr, u32 data);
+int rtl8366_smi_write_reg_noack(struct rtl8366_smi *smi, u32 addr, u32 data);
+int rtl8366_smi_read_reg(struct rtl8366_smi *smi, u32 addr, u32 *data);
+int rtl8366_smi_rmwr(struct rtl8366_smi *smi, u32 addr, u32 mask, u32 data);
+
+#ifdef CONFIG_RTL8366_SMI_DEBUG_FS
+int rtl8366_debugfs_open(struct inode *inode, struct file *file);
+#endif
+
+static inline struct rtl8366_smi *sw_to_rtl8366_smi(struct switch_dev *sw)
+{
+	return container_of(sw, struct rtl8366_smi, sw_dev);
+}
+
+int rtl8366_sw_reset_switch(struct switch_dev *dev);
+int rtl8366_sw_get_port_pvid(struct switch_dev *dev, int port, int *val);
+int rtl8366_sw_set_port_pvid(struct switch_dev *dev, int port, int val);
+int rtl8366_sw_get_port_mib(struct switch_dev *dev,
+			    const struct switch_attr *attr,
+			    struct switch_val *val);
+int rtl8366_sw_get_vlan_info(struct switch_dev *dev,
+			     const struct switch_attr *attr,
+			     struct switch_val *val);
+int rtl8366_sw_get_vlan_fid(struct switch_dev *dev,
+			     const struct switch_attr *attr,
+			     struct switch_val *val);
+int rtl8366_sw_set_vlan_fid(struct switch_dev *dev,
+			     const struct switch_attr *attr,
+			     struct switch_val *val);
+int rtl8366_sw_get_vlan_ports(struct switch_dev *dev, struct switch_val *val);
+int rtl8366_sw_set_vlan_ports(struct switch_dev *dev, struct switch_val *val);
+int rtl8366_sw_get_vlan_enable(struct switch_dev *dev,
+			       const struct switch_attr *attr,
+			       struct switch_val *val);
+int rtl8366_sw_set_vlan_enable(struct switch_dev *dev,
+			       const struct switch_attr *attr,
+			       struct switch_val *val);
+int rtl8366_sw_get_port_stats(struct switch_dev *dev, int port,
+				struct switch_port_stats *stats,
+				int txb_id, int rxb_id);
+
+struct rtl8366_smi* rtl8366_smi_probe(struct platform_device *pdev);
+
+#endif /*  _RTL8366_SMI_H */
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/rtl8366rb.c b/6.12/target/linux/generic/files/drivers/net/phy/rtl8366rb.c
new file mode 100644
index 00000000..8e985f00
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/rtl8366rb.c
@@ -0,0 +1,1538 @@
+/*
+ * Platform driver for the Realtek RTL8366RB ethernet switch
+ *
+ * Copyright (C) 2009-2010 Gabor Juhos <juhosg@openwrt.org>
+ * Copyright (C) 2010 Antti Seppälä <a.seppala@gmail.com>
+ * Copyright (C) 2010 Roman Yeryomin <roman@advem.lv>
+ * Copyright (C) 2011 Colin Leitner <colin.leitner@googlemail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/device.h>
+#include <linux/of.h>
+#include <linux/of_platform.h>
+#include <linux/delay.h>
+#include <linux/skbuff.h>
+#include <linux/rtl8366.h>
+#include <linux/version.h>
+
+#include "rtl8366_smi.h"
+
+#define RTL8366RB_DRIVER_DESC	"Realtek RTL8366RB ethernet switch driver"
+#define RTL8366RB_DRIVER_VER	"0.2.4"
+
+#define RTL8366RB_PHY_NO_MAX	4
+#define RTL8366RB_PHY_PAGE_MAX	7
+#define RTL8366RB_PHY_ADDR_MAX	31
+
+/* Switch Global Configuration register */
+#define RTL8366RB_SGCR				0x0000
+#define RTL8366RB_SGCR_EN_BC_STORM_CTRL		BIT(0)
+#define RTL8366RB_SGCR_MAX_LENGTH(_x)		(_x << 4)
+#define RTL8366RB_SGCR_MAX_LENGTH_MASK		RTL8366RB_SGCR_MAX_LENGTH(0x3)
+#define RTL8366RB_SGCR_MAX_LENGTH_1522		RTL8366RB_SGCR_MAX_LENGTH(0x0)
+#define RTL8366RB_SGCR_MAX_LENGTH_1536		RTL8366RB_SGCR_MAX_LENGTH(0x1)
+#define RTL8366RB_SGCR_MAX_LENGTH_1552		RTL8366RB_SGCR_MAX_LENGTH(0x2)
+#define RTL8366RB_SGCR_MAX_LENGTH_9216		RTL8366RB_SGCR_MAX_LENGTH(0x3)
+#define RTL8366RB_SGCR_EN_VLAN			BIT(13)
+#define RTL8366RB_SGCR_EN_VLAN_4KTB		BIT(14)
+
+/* Port Enable Control register */
+#define RTL8366RB_PECR				0x0001
+
+/* Port Mirror Control Register */
+#define RTL8366RB_PMCR				0x0007
+#define RTL8366RB_PMCR_SOURCE_PORT(_x)		(_x)
+#define RTL8366RB_PMCR_SOURCE_PORT_MASK		0x000f
+#define RTL8366RB_PMCR_MONITOR_PORT(_x)		((_x) << 4)
+#define RTL8366RB_PMCR_MONITOR_PORT_MASK	0x00f0
+#define RTL8366RB_PMCR_MIRROR_RX		BIT(8)
+#define RTL8366RB_PMCR_MIRROR_TX		BIT(9)
+#define RTL8366RB_PMCR_MIRROR_SPC		BIT(10)
+#define RTL8366RB_PMCR_MIRROR_ISO		BIT(11)
+
+/* Switch Security Control registers */
+#define RTL8366RB_SSCR0				0x0002
+#define RTL8366RB_SSCR1				0x0003
+#define RTL8366RB_SSCR2				0x0004
+#define RTL8366RB_SSCR2_DROP_UNKNOWN_DA		BIT(0)
+
+#define RTL8366RB_RESET_CTRL_REG		0x0100
+#define RTL8366RB_CHIP_CTRL_RESET_HW		1
+#define RTL8366RB_CHIP_CTRL_RESET_SW		(1 << 1)
+
+#define RTL8366RB_CHIP_VERSION_CTRL_REG		0x050A
+#define RTL8366RB_CHIP_VERSION_MASK		0xf
+#define RTL8366RB_CHIP_ID_REG			0x0509
+#define RTL8366RB_CHIP_ID_8366			0x5937
+
+/* PHY registers control */
+#define RTL8366RB_PHY_ACCESS_CTRL_REG		0x8000
+#define RTL8366RB_PHY_ACCESS_DATA_REG		0x8002
+
+#define RTL8366RB_PHY_CTRL_READ			1
+#define RTL8366RB_PHY_CTRL_WRITE		0
+
+#define RTL8366RB_PHY_REG_MASK			0x1f
+#define RTL8366RB_PHY_PAGE_OFFSET		5
+#define RTL8366RB_PHY_PAGE_MASK			(0xf << 5)
+#define RTL8366RB_PHY_NO_OFFSET			9
+#define RTL8366RB_PHY_NO_MASK			(0x1f << 9)
+
+#define RTL8366RB_VLAN_INGRESS_CTRL2_REG	0x037f
+
+/* LED control registers */
+#define RTL8366RB_LED_BLINKRATE_REG		0x0430
+#define RTL8366RB_LED_BLINKRATE_BIT		0
+#define RTL8366RB_LED_BLINKRATE_MASK		0x0007
+
+#define RTL8366RB_LED_CTRL_REG			0x0431
+#define RTL8366RB_LED_0_1_CTRL_REG		0x0432
+#define RTL8366RB_LED_2_3_CTRL_REG		0x0433
+
+#define RTL8366RB_MIB_COUNT			33
+#define RTL8366RB_GLOBAL_MIB_COUNT		1
+#define RTL8366RB_MIB_COUNTER_PORT_OFFSET	0x0050
+#define RTL8366RB_MIB_COUNTER_BASE		0x1000
+#define RTL8366RB_MIB_CTRL_REG			0x13F0
+#define RTL8366RB_MIB_CTRL_USER_MASK		0x0FFC
+#define RTL8366RB_MIB_CTRL_BUSY_MASK		BIT(0)
+#define RTL8366RB_MIB_CTRL_RESET_MASK		BIT(1)
+#define RTL8366RB_MIB_CTRL_PORT_RESET(_p)	BIT(2 + (_p))
+#define RTL8366RB_MIB_CTRL_GLOBAL_RESET		BIT(11)
+
+#define RTL8366RB_PORT_VLAN_CTRL_BASE		0x0063
+#define RTL8366RB_PORT_VLAN_CTRL_REG(_p)  \
+		(RTL8366RB_PORT_VLAN_CTRL_BASE + (_p) / 4)
+#define RTL8366RB_PORT_VLAN_CTRL_MASK		0xf
+#define RTL8366RB_PORT_VLAN_CTRL_SHIFT(_p)	(4 * ((_p) % 4))
+
+
+#define RTL8366RB_VLAN_TABLE_READ_BASE		0x018C
+#define RTL8366RB_VLAN_TABLE_WRITE_BASE		0x0185
+
+
+#define RTL8366RB_TABLE_ACCESS_CTRL_REG		0x0180
+#define RTL8366RB_TABLE_VLAN_READ_CTRL		0x0E01
+#define RTL8366RB_TABLE_VLAN_WRITE_CTRL		0x0F01
+
+#define RTL8366RB_VLAN_MC_BASE(_x)		(0x0020 + (_x) * 3)
+
+
+#define RTL8366RB_PORT_LINK_STATUS_BASE		0x0014
+#define RTL8366RB_PORT_STATUS_SPEED_MASK	0x0003
+#define RTL8366RB_PORT_STATUS_DUPLEX_MASK	0x0004
+#define RTL8366RB_PORT_STATUS_LINK_MASK		0x0010
+#define RTL8366RB_PORT_STATUS_TXPAUSE_MASK	0x0020
+#define RTL8366RB_PORT_STATUS_RXPAUSE_MASK	0x0040
+#define RTL8366RB_PORT_STATUS_AN_MASK		0x0080
+
+
+#define RTL8366RB_PORT_NUM_CPU		5
+#define RTL8366RB_NUM_PORTS		6
+#define RTL8366RB_NUM_VLANS		16
+#define RTL8366RB_NUM_LEDGROUPS		4
+#define RTL8366RB_NUM_VIDS		4096
+#define RTL8366RB_PRIORITYMAX		7
+#define RTL8366RB_FIDMAX		7
+
+
+#define RTL8366RB_PORT_1		(1 << 0) /* In userspace port 0 */
+#define RTL8366RB_PORT_2		(1 << 1) /* In userspace port 1 */
+#define RTL8366RB_PORT_3		(1 << 2) /* In userspace port 2 */
+#define RTL8366RB_PORT_4		(1 << 3) /* In userspace port 3 */
+#define RTL8366RB_PORT_5		(1 << 4) /* In userspace port 4 */
+
+#define RTL8366RB_PORT_CPU		(1 << 5) /* CPU port */
+
+#define RTL8366RB_PORT_ALL		(RTL8366RB_PORT_1 |	\
+					 RTL8366RB_PORT_2 |	\
+					 RTL8366RB_PORT_3 |	\
+					 RTL8366RB_PORT_4 |	\
+					 RTL8366RB_PORT_5 |	\
+					 RTL8366RB_PORT_CPU)
+
+#define RTL8366RB_PORT_ALL_BUT_CPU	(RTL8366RB_PORT_1 |	\
+					 RTL8366RB_PORT_2 |	\
+					 RTL8366RB_PORT_3 |	\
+					 RTL8366RB_PORT_4 |	\
+					 RTL8366RB_PORT_5)
+
+#define RTL8366RB_PORT_ALL_EXTERNAL	(RTL8366RB_PORT_1 |	\
+					 RTL8366RB_PORT_2 |	\
+					 RTL8366RB_PORT_3 |	\
+					 RTL8366RB_PORT_4)
+
+#define RTL8366RB_PORT_ALL_INTERNAL	 RTL8366RB_PORT_CPU
+
+#define RTL8366RB_VLAN_VID_MASK		0xfff
+#define RTL8366RB_VLAN_PRIORITY_SHIFT	12
+#define RTL8366RB_VLAN_PRIORITY_MASK	0x7
+#define RTL8366RB_VLAN_UNTAG_SHIFT	8
+#define RTL8366RB_VLAN_UNTAG_MASK	0xff
+#define RTL8366RB_VLAN_MEMBER_MASK	0xff
+#define RTL8366RB_VLAN_FID_MASK		0x7
+
+
+/* Port ingress bandwidth control */
+#define RTL8366RB_IB_BASE		0x0200
+#define RTL8366RB_IB_REG(pnum)		(RTL8366RB_IB_BASE + pnum)
+#define RTL8366RB_IB_BDTH_MASK		0x3fff
+#define RTL8366RB_IB_PREIFG_OFFSET	14
+#define RTL8366RB_IB_PREIFG_MASK	(1 << RTL8366RB_IB_PREIFG_OFFSET)
+
+/* Port egress bandwidth control */
+#define RTL8366RB_EB_BASE		0x02d1
+#define RTL8366RB_EB_REG(pnum)		(RTL8366RB_EB_BASE + pnum)
+#define RTL8366RB_EB_BDTH_MASK		0x3fff
+#define RTL8366RB_EB_PREIFG_REG	0x02f8
+#define RTL8366RB_EB_PREIFG_OFFSET	9
+#define RTL8366RB_EB_PREIFG_MASK	(1 << RTL8366RB_EB_PREIFG_OFFSET)
+
+#define RTL8366RB_BDTH_SW_MAX		1048512
+#define RTL8366RB_BDTH_UNIT		64
+#define RTL8366RB_BDTH_REG_DEFAULT	16383
+
+/* QOS */
+#define RTL8366RB_QOS_BIT		15
+#define RTL8366RB_QOS_MASK		(1 << RTL8366RB_QOS_BIT)
+/* Include/Exclude Preamble and IFG (20 bytes). 0:Exclude, 1:Include. */
+#define RTL8366RB_QOS_DEFAULT_PREIFG	1
+
+
+#define RTL8366RB_MIB_RXB_ID		0	/* IfInOctets */
+#define RTL8366RB_MIB_TXB_ID		20	/* IfOutOctets */
+
+static struct rtl8366_mib_counter rtl8366rb_mib_counters[] = {
+	{ 0,  0, 4, "IfInOctets"				},
+	{ 0,  4, 4, "EtherStatsOctets"				},
+	{ 0,  8, 2, "EtherStatsUnderSizePkts"			},
+	{ 0, 10, 2, "EtherFragments"				},
+	{ 0, 12, 2, "EtherStatsPkts64Octets"			},
+	{ 0, 14, 2, "EtherStatsPkts65to127Octets"		},
+	{ 0, 16, 2, "EtherStatsPkts128to255Octets"		},
+	{ 0, 18, 2, "EtherStatsPkts256to511Octets"		},
+	{ 0, 20, 2, "EtherStatsPkts512to1023Octets"		},
+	{ 0, 22, 2, "EtherStatsPkts1024to1518Octets"		},
+	{ 0, 24, 2, "EtherOversizeStats"			},
+	{ 0, 26, 2, "EtherStatsJabbers"				},
+	{ 0, 28, 2, "IfInUcastPkts"				},
+	{ 0, 30, 2, "EtherStatsMulticastPkts"			},
+	{ 0, 32, 2, "EtherStatsBroadcastPkts"			},
+	{ 0, 34, 2, "EtherStatsDropEvents"			},
+	{ 0, 36, 2, "Dot3StatsFCSErrors"			},
+	{ 0, 38, 2, "Dot3StatsSymbolErrors"			},
+	{ 0, 40, 2, "Dot3InPauseFrames"				},
+	{ 0, 42, 2, "Dot3ControlInUnknownOpcodes"		},
+	{ 0, 44, 4, "IfOutOctets"				},
+	{ 0, 48, 2, "Dot3StatsSingleCollisionFrames"		},
+	{ 0, 50, 2, "Dot3StatMultipleCollisionFrames"		},
+	{ 0, 52, 2, "Dot3sDeferredTransmissions"		},
+	{ 0, 54, 2, "Dot3StatsLateCollisions"			},
+	{ 0, 56, 2, "EtherStatsCollisions"			},
+	{ 0, 58, 2, "Dot3StatsExcessiveCollisions"		},
+	{ 0, 60, 2, "Dot3OutPauseFrames"			},
+	{ 0, 62, 2, "Dot1dBasePortDelayExceededDiscards"	},
+	{ 0, 64, 2, "Dot1dTpPortInDiscards"			},
+	{ 0, 66, 2, "IfOutUcastPkts"				},
+	{ 0, 68, 2, "IfOutMulticastPkts"			},
+	{ 0, 70, 2, "IfOutBroadcastPkts"			},
+};
+
+#define REG_WR(_smi, _reg, _val)					\
+	do {								\
+		err = rtl8366_smi_write_reg(_smi, _reg, _val);		\
+		if (err)						\
+			return err;					\
+	} while (0)
+
+#define REG_RMW(_smi, _reg, _mask, _val)				\
+	do {								\
+		err = rtl8366_smi_rmwr(_smi, _reg, _mask, _val);	\
+		if (err)						\
+			return err;					\
+	} while (0)
+
+static int rtl8366rb_reset_chip(struct rtl8366_smi *smi)
+{
+	int timeout = 10;
+	u32 data;
+
+	rtl8366_smi_write_reg_noack(smi, RTL8366RB_RESET_CTRL_REG,
+			 	    RTL8366RB_CHIP_CTRL_RESET_HW);
+	do {
+		msleep(1);
+		if (rtl8366_smi_read_reg(smi, RTL8366RB_RESET_CTRL_REG, &data))
+			return -EIO;
+
+		if (!(data & RTL8366RB_CHIP_CTRL_RESET_HW))
+			break;
+	} while (--timeout);
+
+	if (!timeout) {
+		printk("Timeout waiting for the switch to reset\n");
+		return -EIO;
+	}
+
+	return 0;
+}
+
+static int rtl8366rb_setup(struct rtl8366_smi *smi)
+{
+	int err;
+#ifdef CONFIG_OF
+	unsigned i;
+	struct device_node *np;
+	unsigned num_initvals;
+	const __be32 *paddr;
+
+	np = smi->parent->of_node;
+
+	paddr = of_get_property(np, "realtek,initvals", &num_initvals);
+	if (paddr) {
+		dev_info(smi->parent, "applying initvals from DTS\n");
+
+		if (num_initvals < (2 * sizeof(*paddr)))
+			return -EINVAL;
+
+		num_initvals /= sizeof(*paddr);
+
+		for (i = 0; i < num_initvals - 1; i += 2) {
+			u32 reg = be32_to_cpup(paddr + i);
+			u32 val = be32_to_cpup(paddr + i + 1);
+
+			REG_WR(smi, reg, val);
+		}
+	}
+#endif
+
+	/* set maximum packet length to 1536 bytes */
+	REG_RMW(smi, RTL8366RB_SGCR, RTL8366RB_SGCR_MAX_LENGTH_MASK,
+		RTL8366RB_SGCR_MAX_LENGTH_1536);
+
+	/* enable learning for all ports */
+	REG_WR(smi, RTL8366RB_SSCR0, 0);
+
+	/* enable auto ageing for all ports */
+	REG_WR(smi, RTL8366RB_SSCR1, 0);
+
+	/*
+	 * discard VLAN tagged packets if the port is not a member of
+	 * the VLAN with which the packets is associated.
+	 */
+	REG_WR(smi, RTL8366RB_VLAN_INGRESS_CTRL2_REG, RTL8366RB_PORT_ALL);
+
+	/* don't drop packets whose DA has not been learned */
+	REG_RMW(smi, RTL8366RB_SSCR2, RTL8366RB_SSCR2_DROP_UNKNOWN_DA, 0);
+
+	return 0;
+}
+
+static int rtl8366rb_read_phy_reg(struct rtl8366_smi *smi,
+				 u32 phy_no, u32 page, u32 addr, u32 *data)
+{
+	u32 reg;
+	int ret;
+
+	if (phy_no > RTL8366RB_PHY_NO_MAX)
+		return -EINVAL;
+
+	if (page > RTL8366RB_PHY_PAGE_MAX)
+		return -EINVAL;
+
+	if (addr > RTL8366RB_PHY_ADDR_MAX)
+		return -EINVAL;
+
+	ret = rtl8366_smi_write_reg(smi, RTL8366RB_PHY_ACCESS_CTRL_REG,
+				    RTL8366RB_PHY_CTRL_READ);
+	if (ret)
+		return ret;
+
+	reg = 0x8000 | (1 << (phy_no + RTL8366RB_PHY_NO_OFFSET)) |
+	      ((page << RTL8366RB_PHY_PAGE_OFFSET) & RTL8366RB_PHY_PAGE_MASK) |
+	      (addr & RTL8366RB_PHY_REG_MASK);
+
+	ret = rtl8366_smi_write_reg(smi, reg, 0);
+	if (ret)
+		return ret;
+
+	ret = rtl8366_smi_read_reg(smi, RTL8366RB_PHY_ACCESS_DATA_REG, data);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+static int rtl8366rb_write_phy_reg(struct rtl8366_smi *smi,
+				  u32 phy_no, u32 page, u32 addr, u32 data)
+{
+	u32 reg;
+	int ret;
+
+	if (phy_no > RTL8366RB_PHY_NO_MAX)
+		return -EINVAL;
+
+	if (page > RTL8366RB_PHY_PAGE_MAX)
+		return -EINVAL;
+
+	if (addr > RTL8366RB_PHY_ADDR_MAX)
+		return -EINVAL;
+
+	ret = rtl8366_smi_write_reg(smi, RTL8366RB_PHY_ACCESS_CTRL_REG,
+				    RTL8366RB_PHY_CTRL_WRITE);
+	if (ret)
+		return ret;
+
+	reg = 0x8000 | (1 << (phy_no + RTL8366RB_PHY_NO_OFFSET)) |
+	      ((page << RTL8366RB_PHY_PAGE_OFFSET) & RTL8366RB_PHY_PAGE_MASK) |
+	      (addr & RTL8366RB_PHY_REG_MASK);
+
+	ret = rtl8366_smi_write_reg(smi, reg, data);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+static int rtl8366rb_get_mib_counter(struct rtl8366_smi *smi, int counter,
+				     int port, unsigned long long *val)
+{
+	int i;
+	int err;
+	u32 addr, data;
+	u64 mibvalue;
+
+	if (port > RTL8366RB_NUM_PORTS || counter >= RTL8366RB_MIB_COUNT)
+		return -EINVAL;
+
+	addr = RTL8366RB_MIB_COUNTER_BASE +
+	       RTL8366RB_MIB_COUNTER_PORT_OFFSET * (port) +
+	       rtl8366rb_mib_counters[counter].offset;
+
+	/*
+	 * Writing access counter address first
+	 * then ASIC will prepare 64bits counter wait for being retrived
+	 */
+	data = 0; /* writing data will be discard by ASIC */
+	err = rtl8366_smi_write_reg(smi, addr, data);
+	if (err)
+		return err;
+
+	/* read MIB control register */
+	err =  rtl8366_smi_read_reg(smi, RTL8366RB_MIB_CTRL_REG, &data);
+	if (err)
+		return err;
+
+	if (data & RTL8366RB_MIB_CTRL_BUSY_MASK)
+		return -EBUSY;
+
+	if (data & RTL8366RB_MIB_CTRL_RESET_MASK)
+		return -EIO;
+
+	mibvalue = 0;
+	for (i = rtl8366rb_mib_counters[counter].length; i > 0; i--) {
+		err = rtl8366_smi_read_reg(smi, addr + (i - 1), &data);
+		if (err)
+			return err;
+
+		mibvalue = (mibvalue << 16) | (data & 0xFFFF);
+	}
+
+	*val = mibvalue;
+	return 0;
+}
+
+static int rtl8366rb_get_vlan_4k(struct rtl8366_smi *smi, u32 vid,
+				 struct rtl8366_vlan_4k *vlan4k)
+{
+	u32 data[3];
+	int err;
+	int i;
+
+	memset(vlan4k, '\0', sizeof(struct rtl8366_vlan_4k));
+
+	if (vid >= RTL8366RB_NUM_VIDS)
+		return -EINVAL;
+
+	/* write VID */
+	err = rtl8366_smi_write_reg(smi, RTL8366RB_VLAN_TABLE_WRITE_BASE,
+				    vid & RTL8366RB_VLAN_VID_MASK);
+	if (err)
+		return err;
+
+	/* write table access control word */
+	err = rtl8366_smi_write_reg(smi, RTL8366RB_TABLE_ACCESS_CTRL_REG,
+				    RTL8366RB_TABLE_VLAN_READ_CTRL);
+	if (err)
+		return err;
+
+	for (i = 0; i < 3; i++) {
+		err = rtl8366_smi_read_reg(smi,
+					   RTL8366RB_VLAN_TABLE_READ_BASE + i,
+					   &data[i]);
+		if (err)
+			return err;
+	}
+
+	vlan4k->vid = vid;
+	vlan4k->untag = (data[1] >> RTL8366RB_VLAN_UNTAG_SHIFT) &
+			RTL8366RB_VLAN_UNTAG_MASK;
+	vlan4k->member = data[1] & RTL8366RB_VLAN_MEMBER_MASK;
+	vlan4k->fid = data[2] & RTL8366RB_VLAN_FID_MASK;
+
+	return 0;
+}
+
+static int rtl8366rb_set_vlan_4k(struct rtl8366_smi *smi,
+				 const struct rtl8366_vlan_4k *vlan4k)
+{
+	u32 data[3];
+	int err;
+	int i;
+
+	if (vlan4k->vid >= RTL8366RB_NUM_VIDS ||
+	    vlan4k->member > RTL8366RB_VLAN_MEMBER_MASK ||
+	    vlan4k->untag > RTL8366RB_VLAN_UNTAG_MASK ||
+	    vlan4k->fid > RTL8366RB_FIDMAX)
+		return -EINVAL;
+
+	data[0] = vlan4k->vid & RTL8366RB_VLAN_VID_MASK;
+	data[1] = (vlan4k->member & RTL8366RB_VLAN_MEMBER_MASK) |
+		  ((vlan4k->untag & RTL8366RB_VLAN_UNTAG_MASK) <<
+			RTL8366RB_VLAN_UNTAG_SHIFT);
+	data[2] = vlan4k->fid & RTL8366RB_VLAN_FID_MASK;
+
+	for (i = 0; i < 3; i++) {
+		err = rtl8366_smi_write_reg(smi,
+					    RTL8366RB_VLAN_TABLE_WRITE_BASE + i,
+					    data[i]);
+		if (err)
+			return err;
+	}
+
+	/* write table access control word */
+	err = rtl8366_smi_write_reg(smi, RTL8366RB_TABLE_ACCESS_CTRL_REG,
+				    RTL8366RB_TABLE_VLAN_WRITE_CTRL);
+
+	return err;
+}
+
+static int rtl8366rb_get_vlan_mc(struct rtl8366_smi *smi, u32 index,
+				 struct rtl8366_vlan_mc *vlanmc)
+{
+	u32 data[3];
+	int err;
+	int i;
+
+	memset(vlanmc, '\0', sizeof(struct rtl8366_vlan_mc));
+
+	if (index >= RTL8366RB_NUM_VLANS)
+		return -EINVAL;
+
+	for (i = 0; i < 3; i++) {
+		err = rtl8366_smi_read_reg(smi,
+					   RTL8366RB_VLAN_MC_BASE(index) + i,
+					   &data[i]);
+		if (err)
+			return err;
+	}
+
+	vlanmc->vid = data[0] & RTL8366RB_VLAN_VID_MASK;
+	vlanmc->priority = (data[0] >> RTL8366RB_VLAN_PRIORITY_SHIFT) &
+			   RTL8366RB_VLAN_PRIORITY_MASK;
+	vlanmc->untag = (data[1] >> RTL8366RB_VLAN_UNTAG_SHIFT) &
+			RTL8366RB_VLAN_UNTAG_MASK;
+	vlanmc->member = data[1] & RTL8366RB_VLAN_MEMBER_MASK;
+	vlanmc->fid = data[2] & RTL8366RB_VLAN_FID_MASK;
+
+	return 0;
+}
+
+static int rtl8366rb_set_vlan_mc(struct rtl8366_smi *smi, u32 index,
+				 const struct rtl8366_vlan_mc *vlanmc)
+{
+	u32 data[3];
+	int err;
+	int i;
+
+	if (index >= RTL8366RB_NUM_VLANS ||
+	    vlanmc->vid >= RTL8366RB_NUM_VIDS ||
+	    vlanmc->priority > RTL8366RB_PRIORITYMAX ||
+	    vlanmc->member > RTL8366RB_VLAN_MEMBER_MASK ||
+	    vlanmc->untag > RTL8366RB_VLAN_UNTAG_MASK ||
+	    vlanmc->fid > RTL8366RB_FIDMAX)
+		return -EINVAL;
+
+	data[0] = (vlanmc->vid & RTL8366RB_VLAN_VID_MASK) |
+		  ((vlanmc->priority & RTL8366RB_VLAN_PRIORITY_MASK) <<
+			RTL8366RB_VLAN_PRIORITY_SHIFT);
+	data[1] = (vlanmc->member & RTL8366RB_VLAN_MEMBER_MASK) |
+		  ((vlanmc->untag & RTL8366RB_VLAN_UNTAG_MASK) <<
+			RTL8366RB_VLAN_UNTAG_SHIFT);
+	data[2] = vlanmc->fid & RTL8366RB_VLAN_FID_MASK;
+
+	for (i = 0; i < 3; i++) {
+		err = rtl8366_smi_write_reg(smi,
+					    RTL8366RB_VLAN_MC_BASE(index) + i,
+					    data[i]);
+		if (err)
+			return err;
+	}
+
+	return 0;
+}
+
+static int rtl8366rb_get_mc_index(struct rtl8366_smi *smi, int port, int *val)
+{
+	u32 data;
+	int err;
+
+	if (port >= RTL8366RB_NUM_PORTS)
+		return -EINVAL;
+
+	err = rtl8366_smi_read_reg(smi, RTL8366RB_PORT_VLAN_CTRL_REG(port),
+				   &data);
+	if (err)
+		return err;
+
+	*val = (data >> RTL8366RB_PORT_VLAN_CTRL_SHIFT(port)) &
+	       RTL8366RB_PORT_VLAN_CTRL_MASK;
+
+	return 0;
+
+}
+
+static int rtl8366rb_set_mc_index(struct rtl8366_smi *smi, int port, int index)
+{
+	if (port >= RTL8366RB_NUM_PORTS || index >= RTL8366RB_NUM_VLANS)
+		return -EINVAL;
+
+	return rtl8366_smi_rmwr(smi, RTL8366RB_PORT_VLAN_CTRL_REG(port),
+				RTL8366RB_PORT_VLAN_CTRL_MASK <<
+					RTL8366RB_PORT_VLAN_CTRL_SHIFT(port),
+				(index & RTL8366RB_PORT_VLAN_CTRL_MASK) <<
+					RTL8366RB_PORT_VLAN_CTRL_SHIFT(port));
+}
+
+static int rtl8366rb_is_vlan_valid(struct rtl8366_smi *smi, unsigned vlan)
+{
+	unsigned max = RTL8366RB_NUM_VLANS;
+
+	if (smi->vlan4k_enabled)
+		max = RTL8366RB_NUM_VIDS - 1;
+
+	if (vlan == 0 || vlan >= max)
+		return 0;
+
+	return 1;
+}
+
+static int rtl8366rb_enable_vlan(struct rtl8366_smi *smi, int enable)
+{
+	return rtl8366_smi_rmwr(smi, RTL8366RB_SGCR, RTL8366RB_SGCR_EN_VLAN,
+				(enable) ? RTL8366RB_SGCR_EN_VLAN : 0);
+}
+
+static int rtl8366rb_enable_vlan4k(struct rtl8366_smi *smi, int enable)
+{
+	return rtl8366_smi_rmwr(smi, RTL8366RB_SGCR,
+				RTL8366RB_SGCR_EN_VLAN_4KTB,
+				(enable) ? RTL8366RB_SGCR_EN_VLAN_4KTB : 0);
+}
+
+static int rtl8366rb_enable_port(struct rtl8366_smi *smi, int port, int enable)
+{
+	return rtl8366_smi_rmwr(smi, RTL8366RB_PECR, (1 << port),
+				(enable) ? 0 : (1 << port));
+}
+
+static int rtl8366rb_sw_reset_mibs(struct switch_dev *dev,
+				  const struct switch_attr *attr,
+				  struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+
+	return rtl8366_smi_rmwr(smi, RTL8366RB_MIB_CTRL_REG, 0,
+			        RTL8366RB_MIB_CTRL_GLOBAL_RESET);
+}
+
+static int rtl8366rb_sw_get_blinkrate(struct switch_dev *dev,
+				     const struct switch_attr *attr,
+				     struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+
+	rtl8366_smi_read_reg(smi, RTL8366RB_LED_BLINKRATE_REG, &data);
+
+	val->value.i = (data & (RTL8366RB_LED_BLINKRATE_MASK));
+
+	return 0;
+}
+
+static int rtl8366rb_sw_set_blinkrate(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+
+	if (val->value.i >= 6)
+		return -EINVAL;
+
+	return rtl8366_smi_rmwr(smi, RTL8366RB_LED_BLINKRATE_REG,
+				RTL8366RB_LED_BLINKRATE_MASK,
+				val->value.i);
+}
+
+static int rtl8366rb_sw_get_learning_enable(struct switch_dev *dev,
+				       const struct switch_attr *attr,
+				       struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+
+	rtl8366_smi_read_reg(smi, RTL8366RB_SSCR0, &data);
+	val->value.i = !data;
+
+	return 0;
+}
+
+
+static int rtl8366rb_sw_set_learning_enable(struct switch_dev *dev,
+				       const struct switch_attr *attr,
+				       struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 portmask = 0;
+	int err = 0;
+
+	if (!val->value.i)
+		portmask = RTL8366RB_PORT_ALL;
+
+	/* set learning for all ports */
+	REG_WR(smi, RTL8366RB_SSCR0, portmask);
+
+	/* set auto ageing for all ports */
+	REG_WR(smi, RTL8366RB_SSCR1, portmask);
+
+	return 0;
+}
+
+static int rtl8366rb_sw_get_port_link(struct switch_dev *dev,
+				     int port,
+				     struct switch_port_link *link)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data = 0;
+	u32 speed;
+
+	if (port >= RTL8366RB_NUM_PORTS)
+		return -EINVAL;
+
+	rtl8366_smi_read_reg(smi, RTL8366RB_PORT_LINK_STATUS_BASE + (port / 2),
+			     &data);
+
+	if (port % 2)
+		data = data >> 8;
+
+	link->link = !!(data & RTL8366RB_PORT_STATUS_LINK_MASK);
+	if (!link->link)
+		return 0;
+
+	link->duplex = !!(data & RTL8366RB_PORT_STATUS_DUPLEX_MASK);
+	link->rx_flow = !!(data & RTL8366RB_PORT_STATUS_RXPAUSE_MASK);
+	link->tx_flow = !!(data & RTL8366RB_PORT_STATUS_TXPAUSE_MASK);
+	link->aneg = !!(data & RTL8366RB_PORT_STATUS_AN_MASK);
+
+	speed = (data & RTL8366RB_PORT_STATUS_SPEED_MASK);
+	switch (speed) {
+	case 0:
+		link->speed = SWITCH_PORT_SPEED_10;
+		break;
+	case 1:
+		link->speed = SWITCH_PORT_SPEED_100;
+		break;
+	case 2:
+		link->speed = SWITCH_PORT_SPEED_1000;
+		break;
+	default:
+		link->speed = SWITCH_PORT_SPEED_UNKNOWN;
+		break;
+	}
+
+	return 0;
+}
+
+static int rtl8366rb_sw_set_port_led(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+	u32 mask;
+	u32 reg;
+
+	if (val->port_vlan >= RTL8366RB_NUM_PORTS)
+		return -EINVAL;
+
+	if (val->port_vlan == RTL8366RB_PORT_NUM_CPU) {
+		reg = RTL8366RB_LED_BLINKRATE_REG;
+		mask = 0xF << 4;
+		data = val->value.i << 4;
+	} else {
+		reg = RTL8366RB_LED_CTRL_REG;
+		mask = 0xF << (val->port_vlan * 4),
+		data = val->value.i << (val->port_vlan * 4);
+	}
+
+	return rtl8366_smi_rmwr(smi, reg, mask, data);
+}
+
+static int rtl8366rb_sw_get_port_led(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data = 0;
+
+	if (val->port_vlan >= RTL8366RB_NUM_LEDGROUPS)
+		return -EINVAL;
+
+	rtl8366_smi_read_reg(smi, RTL8366RB_LED_CTRL_REG, &data);
+	val->value.i = (data >> (val->port_vlan * 4)) & 0x000F;
+
+	return 0;
+}
+
+static int rtl8366rb_sw_set_port_disable(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 mask, data;
+
+	if (val->port_vlan >= RTL8366RB_NUM_PORTS)
+		return -EINVAL;
+
+	mask = 1 << val->port_vlan ;
+	if (val->value.i)
+		data = mask;
+	else
+		data = 0;
+
+	return rtl8366_smi_rmwr(smi, RTL8366RB_PECR, mask, data);
+}
+
+static int rtl8366rb_sw_get_port_disable(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+
+	if (val->port_vlan >= RTL8366RB_NUM_PORTS)
+		return -EINVAL;
+
+	rtl8366_smi_read_reg(smi, RTL8366RB_PECR, &data);
+	if (data & (1 << val->port_vlan))
+		val->value.i = 1;
+	else
+		val->value.i = 0;
+
+	return 0;
+}
+
+static int rtl8366rb_sw_set_port_rate_in(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+
+	if (val->port_vlan >= RTL8366RB_NUM_PORTS)
+		return -EINVAL;
+
+	if (val->value.i > 0 && val->value.i < RTL8366RB_BDTH_SW_MAX)
+		val->value.i = (val->value.i - 1) / RTL8366RB_BDTH_UNIT;
+	else
+		val->value.i = RTL8366RB_BDTH_REG_DEFAULT;
+
+	return rtl8366_smi_rmwr(smi, RTL8366RB_IB_REG(val->port_vlan),
+		RTL8366RB_IB_BDTH_MASK | RTL8366RB_IB_PREIFG_MASK,
+		val->value.i |
+		(RTL8366RB_QOS_DEFAULT_PREIFG << RTL8366RB_IB_PREIFG_OFFSET));
+
+}
+
+static int rtl8366rb_sw_get_port_rate_in(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+
+	if (val->port_vlan >= RTL8366RB_NUM_PORTS)
+		return -EINVAL;
+
+	rtl8366_smi_read_reg(smi, RTL8366RB_IB_REG(val->port_vlan), &data);
+	data &= RTL8366RB_IB_BDTH_MASK;
+	if (data < RTL8366RB_IB_BDTH_MASK)
+		data += 1;
+
+	val->value.i = (int)data * RTL8366RB_BDTH_UNIT;
+
+	return 0;
+}
+
+static int rtl8366rb_sw_set_port_rate_out(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+
+	if (val->port_vlan >= RTL8366RB_NUM_PORTS)
+		return -EINVAL;
+
+	rtl8366_smi_rmwr(smi, RTL8366RB_EB_PREIFG_REG,
+		RTL8366RB_EB_PREIFG_MASK,
+		(RTL8366RB_QOS_DEFAULT_PREIFG << RTL8366RB_EB_PREIFG_OFFSET));
+
+	if (val->value.i > 0 && val->value.i < RTL8366RB_BDTH_SW_MAX)
+		val->value.i = (val->value.i - 1) / RTL8366RB_BDTH_UNIT;
+	else
+		val->value.i = RTL8366RB_BDTH_REG_DEFAULT;
+
+	return rtl8366_smi_rmwr(smi, RTL8366RB_EB_REG(val->port_vlan),
+			RTL8366RB_EB_BDTH_MASK, val->value.i );
+
+}
+
+static int rtl8366rb_sw_get_port_rate_out(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+
+	if (val->port_vlan >= RTL8366RB_NUM_PORTS)
+		return -EINVAL;
+
+	rtl8366_smi_read_reg(smi, RTL8366RB_EB_REG(val->port_vlan), &data);
+	data &= RTL8366RB_EB_BDTH_MASK;
+	if (data < RTL8366RB_EB_BDTH_MASK)
+		data += 1;
+
+	val->value.i = (int)data * RTL8366RB_BDTH_UNIT;
+
+	return 0;
+}
+
+static int rtl8366rb_sw_set_qos_enable(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+
+	if (val->value.i)
+		data = RTL8366RB_QOS_MASK;
+	else
+		data = 0;
+
+	return rtl8366_smi_rmwr(smi, RTL8366RB_SGCR, RTL8366RB_QOS_MASK, data);
+}
+
+static int rtl8366rb_sw_get_qos_enable(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+
+	rtl8366_smi_read_reg(smi, RTL8366RB_SGCR, &data);
+	if (data & RTL8366RB_QOS_MASK)
+		val->value.i = 1;
+	else
+		val->value.i = 0;
+
+	return 0;
+}
+
+static int rtl8366rb_sw_set_mirror_rx_enable(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+
+	if (val->value.i)
+		data = RTL8366RB_PMCR_MIRROR_RX;
+	else
+		data = 0;
+
+	return rtl8366_smi_rmwr(smi, RTL8366RB_PMCR, RTL8366RB_PMCR_MIRROR_RX, data);
+}
+
+static int rtl8366rb_sw_get_mirror_rx_enable(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+
+	rtl8366_smi_read_reg(smi, RTL8366RB_PMCR, &data);
+	if (data & RTL8366RB_PMCR_MIRROR_RX)
+		val->value.i = 1;
+	else
+		val->value.i = 0;
+
+	return 0;
+}
+
+static int rtl8366rb_sw_set_mirror_tx_enable(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+
+	if (val->value.i)
+		data = RTL8366RB_PMCR_MIRROR_TX;
+	else
+		data = 0;
+
+	return rtl8366_smi_rmwr(smi, RTL8366RB_PMCR, RTL8366RB_PMCR_MIRROR_TX, data);
+}
+
+static int rtl8366rb_sw_get_mirror_tx_enable(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+
+	rtl8366_smi_read_reg(smi, RTL8366RB_PMCR, &data);
+	if (data & RTL8366RB_PMCR_MIRROR_TX)
+		val->value.i = 1;
+	else
+		val->value.i = 0;
+
+	return 0;
+}
+
+static int rtl8366rb_sw_set_monitor_isolation_enable(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+
+	if (val->value.i)
+		data = RTL8366RB_PMCR_MIRROR_ISO;
+	else
+		data = 0;
+
+	return rtl8366_smi_rmwr(smi, RTL8366RB_PMCR, RTL8366RB_PMCR_MIRROR_ISO, data);
+}
+
+static int rtl8366rb_sw_get_monitor_isolation_enable(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+
+	rtl8366_smi_read_reg(smi, RTL8366RB_PMCR, &data);
+	if (data & RTL8366RB_PMCR_MIRROR_ISO)
+		val->value.i = 1;
+	else
+		val->value.i = 0;
+
+	return 0;
+}
+
+static int rtl8366rb_sw_set_mirror_pause_frames_enable(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+
+	if (val->value.i)
+		data = RTL8366RB_PMCR_MIRROR_SPC;
+	else
+		data = 0;
+
+	return rtl8366_smi_rmwr(smi, RTL8366RB_PMCR, RTL8366RB_PMCR_MIRROR_SPC, data);
+}
+
+static int rtl8366rb_sw_get_mirror_pause_frames_enable(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+
+	rtl8366_smi_read_reg(smi, RTL8366RB_PMCR, &data);
+	if (data & RTL8366RB_PMCR_MIRROR_SPC)
+		val->value.i = 1;
+	else
+		val->value.i = 0;
+
+	return 0;
+}
+
+static int rtl8366rb_sw_set_mirror_monitor_port(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+
+	data = RTL8366RB_PMCR_MONITOR_PORT(val->value.i);
+
+	return rtl8366_smi_rmwr(smi, RTL8366RB_PMCR, RTL8366RB_PMCR_MONITOR_PORT_MASK, data);
+}
+
+static int rtl8366rb_sw_get_mirror_monitor_port(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+
+	rtl8366_smi_read_reg(smi, RTL8366RB_PMCR, &data);
+	val->value.i = (data & RTL8366RB_PMCR_MONITOR_PORT_MASK) >> 4;
+
+	return 0;
+}
+
+static int rtl8366rb_sw_set_mirror_source_port(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+
+	data = RTL8366RB_PMCR_SOURCE_PORT(val->value.i);
+
+	return rtl8366_smi_rmwr(smi, RTL8366RB_PMCR, RTL8366RB_PMCR_SOURCE_PORT_MASK, data);
+}
+
+static int rtl8366rb_sw_get_mirror_source_port(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+
+	rtl8366_smi_read_reg(smi, RTL8366RB_PMCR, &data);
+	val->value.i = data & RTL8366RB_PMCR_SOURCE_PORT_MASK;
+
+	return 0;
+}
+
+static int rtl8366rb_sw_reset_port_mibs(struct switch_dev *dev,
+				       const struct switch_attr *attr,
+				       struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+
+	if (val->port_vlan >= RTL8366RB_NUM_PORTS)
+		return -EINVAL;
+
+	return rtl8366_smi_rmwr(smi, RTL8366RB_MIB_CTRL_REG, 0,
+				RTL8366RB_MIB_CTRL_PORT_RESET(val->port_vlan));
+}
+
+static int rtl8366rb_sw_get_port_stats(struct switch_dev *dev, int port,
+					struct switch_port_stats *stats)
+{
+	return (rtl8366_sw_get_port_stats(dev, port, stats,
+				RTL8366RB_MIB_TXB_ID, RTL8366RB_MIB_RXB_ID));
+}
+
+static struct switch_attr rtl8366rb_globals[] = {
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_learning",
+		.description = "Enable learning, enable aging",
+		.set = rtl8366rb_sw_set_learning_enable,
+		.get = rtl8366rb_sw_get_learning_enable,
+		.max = 1
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_vlan",
+		.description = "Enable VLAN mode",
+		.set = rtl8366_sw_set_vlan_enable,
+		.get = rtl8366_sw_get_vlan_enable,
+		.max = 1,
+		.ofs = 1
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_vlan4k",
+		.description = "Enable VLAN 4K mode",
+		.set = rtl8366_sw_set_vlan_enable,
+		.get = rtl8366_sw_get_vlan_enable,
+		.max = 1,
+		.ofs = 2
+	}, {
+		.type = SWITCH_TYPE_NOVAL,
+		.name = "reset_mibs",
+		.description = "Reset all MIB counters",
+		.set = rtl8366rb_sw_reset_mibs,
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "blinkrate",
+		.description = "Get/Set LED blinking rate (0 = 43ms, 1 = 84ms,"
+		" 2 = 120ms, 3 = 170ms, 4 = 340ms, 5 = 670ms)",
+		.set = rtl8366rb_sw_set_blinkrate,
+		.get = rtl8366rb_sw_get_blinkrate,
+		.max = 5
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_qos",
+		.description = "Enable QOS",
+		.set = rtl8366rb_sw_set_qos_enable,
+		.get = rtl8366rb_sw_get_qos_enable,
+		.max = 1
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_mirror_rx",
+		.description = "Enable mirroring of RX packets",
+		.set = rtl8366rb_sw_set_mirror_rx_enable,
+		.get = rtl8366rb_sw_get_mirror_rx_enable,
+		.max = 1
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_mirror_tx",
+		.description = "Enable mirroring of TX packets",
+		.set = rtl8366rb_sw_set_mirror_tx_enable,
+		.get = rtl8366rb_sw_get_mirror_tx_enable,
+		.max = 1
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_monitor_isolation",
+		.description = "Enable isolation of monitor port (TX packets will be dropped)",
+		.set = rtl8366rb_sw_set_monitor_isolation_enable,
+		.get = rtl8366rb_sw_get_monitor_isolation_enable,
+		.max = 1
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_mirror_pause_frames",
+		.description = "Enable mirroring of RX pause frames",
+		.set = rtl8366rb_sw_set_mirror_pause_frames_enable,
+		.get = rtl8366rb_sw_get_mirror_pause_frames_enable,
+		.max = 1
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "mirror_monitor_port",
+		.description = "Mirror monitor port",
+		.set = rtl8366rb_sw_set_mirror_monitor_port,
+		.get = rtl8366rb_sw_get_mirror_monitor_port,
+		.max = 5
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "mirror_source_port",
+		.description = "Mirror source port",
+		.set = rtl8366rb_sw_set_mirror_source_port,
+		.get = rtl8366rb_sw_get_mirror_source_port,
+		.max = 5
+	},
+};
+
+static struct switch_attr rtl8366rb_port[] = {
+	{
+		.type = SWITCH_TYPE_NOVAL,
+		.name = "reset_mib",
+		.description = "Reset single port MIB counters",
+		.set = rtl8366rb_sw_reset_port_mibs,
+	}, {
+		.type = SWITCH_TYPE_STRING,
+		.name = "mib",
+		.description = "Get MIB counters for port",
+		.max = 33,
+		.set = NULL,
+		.get = rtl8366_sw_get_port_mib,
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "led",
+		.description = "Get/Set port group (0 - 3) led mode (0 - 15)",
+		.max = 15,
+		.set = rtl8366rb_sw_set_port_led,
+		.get = rtl8366rb_sw_get_port_led,
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "disable",
+		.description = "Get/Set port state (enabled or disabled)",
+		.max = 1,
+		.set = rtl8366rb_sw_set_port_disable,
+		.get = rtl8366rb_sw_get_port_disable,
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "rate_in",
+		.description = "Get/Set port ingress (incoming) bandwidth limit in kbps",
+		.max = RTL8366RB_BDTH_SW_MAX,
+		.set = rtl8366rb_sw_set_port_rate_in,
+		.get = rtl8366rb_sw_get_port_rate_in,
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "rate_out",
+		.description = "Get/Set port egress (outgoing) bandwidth limit in kbps",
+		.max = RTL8366RB_BDTH_SW_MAX,
+		.set = rtl8366rb_sw_set_port_rate_out,
+		.get = rtl8366rb_sw_get_port_rate_out,
+	},
+};
+
+static struct switch_attr rtl8366rb_vlan[] = {
+	{
+		.type = SWITCH_TYPE_STRING,
+		.name = "info",
+		.description = "Get vlan information",
+		.max = 1,
+		.set = NULL,
+		.get = rtl8366_sw_get_vlan_info,
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "fid",
+		.description = "Get/Set vlan FID",
+		.max = RTL8366RB_FIDMAX,
+		.set = rtl8366_sw_set_vlan_fid,
+		.get = rtl8366_sw_get_vlan_fid,
+	},
+};
+
+static const struct switch_dev_ops rtl8366_ops = {
+	.attr_global = {
+		.attr = rtl8366rb_globals,
+		.n_attr = ARRAY_SIZE(rtl8366rb_globals),
+	},
+	.attr_port = {
+		.attr = rtl8366rb_port,
+		.n_attr = ARRAY_SIZE(rtl8366rb_port),
+	},
+	.attr_vlan = {
+		.attr = rtl8366rb_vlan,
+		.n_attr = ARRAY_SIZE(rtl8366rb_vlan),
+	},
+
+	.get_vlan_ports = rtl8366_sw_get_vlan_ports,
+	.set_vlan_ports = rtl8366_sw_set_vlan_ports,
+	.get_port_pvid = rtl8366_sw_get_port_pvid,
+	.set_port_pvid = rtl8366_sw_set_port_pvid,
+	.reset_switch = rtl8366_sw_reset_switch,
+	.get_port_link = rtl8366rb_sw_get_port_link,
+	.get_port_stats = rtl8366rb_sw_get_port_stats,
+};
+
+static int rtl8366rb_switch_init(struct rtl8366_smi *smi)
+{
+	struct switch_dev *dev = &smi->sw_dev;
+	int err;
+
+	dev->name = "RTL8366RB";
+	dev->cpu_port = RTL8366RB_PORT_NUM_CPU;
+	dev->ports = RTL8366RB_NUM_PORTS;
+	dev->vlans = RTL8366RB_NUM_VIDS;
+	dev->ops = &rtl8366_ops;
+	dev->alias = dev_name(smi->parent);
+
+	err = register_switch(dev, NULL);
+	if (err)
+		dev_err(smi->parent, "switch registration failed\n");
+
+	return err;
+}
+
+static void rtl8366rb_switch_cleanup(struct rtl8366_smi *smi)
+{
+	unregister_switch(&smi->sw_dev);
+}
+
+static int rtl8366rb_mii_read(struct mii_bus *bus, int addr, int reg)
+{
+	struct rtl8366_smi *smi = bus->priv;
+	u32 val = 0;
+	int err;
+
+	err = rtl8366rb_read_phy_reg(smi, addr, 0, reg, &val);
+	if (err)
+		return 0xffff;
+
+	return val;
+}
+
+static int rtl8366rb_mii_write(struct mii_bus *bus, int addr, int reg, u16 val)
+{
+	struct rtl8366_smi *smi = bus->priv;
+	u32 t;
+	int err;
+
+	err = rtl8366rb_write_phy_reg(smi, addr, 0, reg, val);
+	/* flush write */
+	(void) rtl8366rb_read_phy_reg(smi, addr, 0, reg, &t);
+
+	return err;
+}
+
+static int rtl8366rb_detect(struct rtl8366_smi *smi)
+{
+	u32 chip_id = 0;
+	u32 chip_ver = 0;
+	int ret;
+
+	ret = rtl8366_smi_read_reg(smi, RTL8366RB_CHIP_ID_REG, &chip_id);
+	if (ret) {
+		dev_err(smi->parent, "unable to read chip id\n");
+		return ret;
+	}
+
+	switch (chip_id) {
+	case RTL8366RB_CHIP_ID_8366:
+		break;
+	default:
+		dev_err(smi->parent, "unknown chip id (%04x)\n", chip_id);
+		return -ENODEV;
+	}
+
+	ret = rtl8366_smi_read_reg(smi, RTL8366RB_CHIP_VERSION_CTRL_REG,
+				   &chip_ver);
+	if (ret) {
+		dev_err(smi->parent, "unable to read chip version\n");
+		return ret;
+	}
+
+	dev_info(smi->parent, "RTL%04x ver. %u chip found\n",
+		 chip_id, chip_ver & RTL8366RB_CHIP_VERSION_MASK);
+
+	return 0;
+}
+
+static struct rtl8366_smi_ops rtl8366rb_smi_ops = {
+	.detect		= rtl8366rb_detect,
+	.reset_chip	= rtl8366rb_reset_chip,
+	.setup		= rtl8366rb_setup,
+
+	.mii_read	= rtl8366rb_mii_read,
+	.mii_write	= rtl8366rb_mii_write,
+
+	.get_vlan_mc	= rtl8366rb_get_vlan_mc,
+	.set_vlan_mc	= rtl8366rb_set_vlan_mc,
+	.get_vlan_4k	= rtl8366rb_get_vlan_4k,
+	.set_vlan_4k	= rtl8366rb_set_vlan_4k,
+	.get_mc_index	= rtl8366rb_get_mc_index,
+	.set_mc_index	= rtl8366rb_set_mc_index,
+	.get_mib_counter = rtl8366rb_get_mib_counter,
+	.is_vlan_valid	= rtl8366rb_is_vlan_valid,
+	.enable_vlan	= rtl8366rb_enable_vlan,
+	.enable_vlan4k	= rtl8366rb_enable_vlan4k,
+	.enable_port	= rtl8366rb_enable_port,
+};
+
+static int rtl8366rb_probe(struct platform_device *pdev)
+{
+	static int rtl8366_smi_version_printed;
+	struct rtl8366_smi *smi;
+	int err;
+
+	if (!rtl8366_smi_version_printed++)
+		printk(KERN_NOTICE RTL8366RB_DRIVER_DESC
+		       " version " RTL8366RB_DRIVER_VER"\n");
+
+	smi = rtl8366_smi_probe(pdev);
+	if (IS_ERR(smi))
+		return PTR_ERR(smi);
+
+	smi->clk_delay = 10;
+	smi->cmd_read = 0xa9;
+	smi->cmd_write = 0xa8;
+	smi->ops = &rtl8366rb_smi_ops;
+	smi->cpu_port = RTL8366RB_PORT_NUM_CPU;
+	smi->num_ports = RTL8366RB_NUM_PORTS;
+	smi->num_vlan_mc = RTL8366RB_NUM_VLANS;
+	smi->mib_counters = rtl8366rb_mib_counters;
+	smi->num_mib_counters = ARRAY_SIZE(rtl8366rb_mib_counters);
+
+	err = rtl8366_smi_init(smi);
+	if (err)
+		goto err_free_smi;
+
+	platform_set_drvdata(pdev, smi);
+
+	err = rtl8366rb_switch_init(smi);
+	if (err)
+		goto err_clear_drvdata;
+
+	return 0;
+
+ err_clear_drvdata:
+	platform_set_drvdata(pdev, NULL);
+	rtl8366_smi_cleanup(smi);
+ err_free_smi:
+	kfree(smi);
+	return err;
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6,11,0)
+static int rtl8366rb_remove(struct platform_device *pdev)
+#else
+static void rtl8366rb_remove(struct platform_device *pdev)
+#endif
+{
+	struct rtl8366_smi *smi = platform_get_drvdata(pdev);
+
+	if (smi) {
+		rtl8366rb_switch_cleanup(smi);
+		platform_set_drvdata(pdev, NULL);
+		rtl8366_smi_cleanup(smi);
+		kfree(smi);
+	}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6,11,0)
+	return 0;
+#endif
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id rtl8366rb_match[] = {
+	{ .compatible = "realtek,rtl8366rb" },
+	{},
+};
+MODULE_DEVICE_TABLE(of, rtl8366rb_match);
+#endif
+
+static struct platform_driver rtl8366rb_driver = {
+	.driver = {
+		.name		= RTL8366RB_DRIVER_NAME,
+		.of_match_table = of_match_ptr(rtl8366rb_match),
+	},
+	.probe		= rtl8366rb_probe,
+	.remove		= rtl8366rb_remove,
+};
+
+static int __init rtl8366rb_module_init(void)
+{
+	return platform_driver_register(&rtl8366rb_driver);
+}
+module_init(rtl8366rb_module_init);
+
+static void __exit rtl8366rb_module_exit(void)
+{
+	platform_driver_unregister(&rtl8366rb_driver);
+}
+module_exit(rtl8366rb_module_exit);
+
+MODULE_DESCRIPTION(RTL8366RB_DRIVER_DESC);
+MODULE_VERSION(RTL8366RB_DRIVER_VER);
+MODULE_AUTHOR("Gabor Juhos <juhosg@openwrt.org>");
+MODULE_AUTHOR("Antti Seppälä <a.seppala@gmail.com>");
+MODULE_AUTHOR("Roman Yeryomin <roman@advem.lv>");
+MODULE_AUTHOR("Colin Leitner <colin.leitner@googlemail.com>");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:" RTL8366RB_DRIVER_NAME);
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/rtl8366s.c b/6.12/target/linux/generic/files/drivers/net/phy/rtl8366s.c
new file mode 100644
index 00000000..9ecedd8e
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/rtl8366s.c
@@ -0,0 +1,1326 @@
+/*
+ * Platform driver for the Realtek RTL8366S ethernet switch
+ *
+ * Copyright (C) 2009-2010 Gabor Juhos <juhosg@openwrt.org>
+ * Copyright (C) 2010 Antti Seppälä <a.seppala@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/device.h>
+#include <linux/of.h>
+#include <linux/of_platform.h>
+#include <linux/delay.h>
+#include <linux/skbuff.h>
+#include <linux/rtl8366.h>
+#include <linux/version.h>
+
+#include "rtl8366_smi.h"
+
+#define RTL8366S_DRIVER_DESC	"Realtek RTL8366S ethernet switch driver"
+#define RTL8366S_DRIVER_VER	"0.2.2"
+
+#define RTL8366S_PHY_NO_MAX	4
+#define RTL8366S_PHY_PAGE_MAX	7
+#define RTL8366S_PHY_ADDR_MAX	31
+
+/* Switch Global Configuration register */
+#define RTL8366S_SGCR				0x0000
+#define RTL8366S_SGCR_EN_BC_STORM_CTRL		BIT(0)
+#define RTL8366S_SGCR_MAX_LENGTH(_x)		(_x << 4)
+#define RTL8366S_SGCR_MAX_LENGTH_MASK		RTL8366S_SGCR_MAX_LENGTH(0x3)
+#define RTL8366S_SGCR_MAX_LENGTH_1522		RTL8366S_SGCR_MAX_LENGTH(0x0)
+#define RTL8366S_SGCR_MAX_LENGTH_1536		RTL8366S_SGCR_MAX_LENGTH(0x1)
+#define RTL8366S_SGCR_MAX_LENGTH_1552		RTL8366S_SGCR_MAX_LENGTH(0x2)
+#define RTL8366S_SGCR_MAX_LENGTH_16000		RTL8366S_SGCR_MAX_LENGTH(0x3)
+#define RTL8366S_SGCR_EN_VLAN			BIT(13)
+
+/* Port Enable Control register */
+#define RTL8366S_PECR				0x0001
+
+/* Green Ethernet Feature (based on GPL_BELKIN_F5D8235-4_v1000 v1.01.24) */
+#define RTL8366S_GREEN_ETHERNET_CTRL_REG	0x000a
+#define RTL8366S_GREEN_ETHERNET_CTRL_MASK	0x0018
+#define RTL8366S_GREEN_ETHERNET_TX_BIT		(1 << 3)
+#define RTL8366S_GREEN_ETHERNET_RX_BIT		(1 << 4)
+
+/* Switch Security Control registers */
+#define RTL8366S_SSCR0				0x0002
+#define RTL8366S_SSCR1				0x0003
+#define RTL8366S_SSCR2				0x0004
+#define RTL8366S_SSCR2_DROP_UNKNOWN_DA		BIT(0)
+
+#define RTL8366S_RESET_CTRL_REG			0x0100
+#define RTL8366S_CHIP_CTRL_RESET_HW		1
+#define RTL8366S_CHIP_CTRL_RESET_SW		(1 << 1)
+
+#define RTL8366S_CHIP_VERSION_CTRL_REG		0x0104
+#define RTL8366S_CHIP_VERSION_MASK		0xf
+#define RTL8366S_CHIP_ID_REG			0x0105
+#define RTL8366S_CHIP_ID_8366			0x8366
+
+/* PHY registers control */
+#define RTL8366S_PHY_ACCESS_CTRL_REG		0x8028
+#define RTL8366S_PHY_ACCESS_DATA_REG		0x8029
+
+#define RTL8366S_PHY_CTRL_READ			1
+#define RTL8366S_PHY_CTRL_WRITE			0
+
+#define RTL8366S_PHY_REG_MASK			0x1f
+#define RTL8366S_PHY_PAGE_OFFSET		5
+#define RTL8366S_PHY_PAGE_MASK			(0x7 << 5)
+#define RTL8366S_PHY_NO_OFFSET			9
+#define RTL8366S_PHY_NO_MASK			(0x1f << 9)
+
+/* Green Ethernet Feature for PHY ports */
+#define RTL8366S_PHY_POWER_SAVING_CTRL_REG	12
+#define RTL8366S_PHY_POWER_SAVING_MASK		0x1000
+
+/* LED control registers */
+#define RTL8366S_LED_BLINKRATE_REG		0x0420
+#define RTL8366S_LED_BLINKRATE_BIT		0
+#define RTL8366S_LED_BLINKRATE_MASK		0x0007
+
+#define RTL8366S_LED_CTRL_REG			0x0421
+#define RTL8366S_LED_0_1_CTRL_REG		0x0422
+#define RTL8366S_LED_2_3_CTRL_REG		0x0423
+
+#define RTL8366S_MIB_COUNT			33
+#define RTL8366S_GLOBAL_MIB_COUNT		1
+#define RTL8366S_MIB_COUNTER_PORT_OFFSET	0x0040
+#define RTL8366S_MIB_COUNTER_BASE		0x1000
+#define RTL8366S_MIB_COUNTER_PORT_OFFSET2	0x0008
+#define RTL8366S_MIB_COUNTER_BASE2		0x1180
+#define RTL8366S_MIB_CTRL_REG			0x11F0
+#define RTL8366S_MIB_CTRL_USER_MASK		0x01FF
+#define RTL8366S_MIB_CTRL_BUSY_MASK		0x0001
+#define RTL8366S_MIB_CTRL_RESET_MASK		0x0002
+
+#define RTL8366S_MIB_CTRL_GLOBAL_RESET_MASK	0x0004
+#define RTL8366S_MIB_CTRL_PORT_RESET_BIT	0x0003
+#define RTL8366S_MIB_CTRL_PORT_RESET_MASK	0x01FC
+
+
+#define RTL8366S_PORT_VLAN_CTRL_BASE		0x0058
+#define RTL8366S_PORT_VLAN_CTRL_REG(_p)  \
+		(RTL8366S_PORT_VLAN_CTRL_BASE + (_p) / 4)
+#define RTL8366S_PORT_VLAN_CTRL_MASK		0xf
+#define RTL8366S_PORT_VLAN_CTRL_SHIFT(_p)	(4 * ((_p) % 4))
+
+
+#define RTL8366S_VLAN_TABLE_READ_BASE		0x018B
+#define RTL8366S_VLAN_TABLE_WRITE_BASE		0x0185
+
+#define RTL8366S_VLAN_TB_CTRL_REG		0x010F
+
+#define RTL8366S_TABLE_ACCESS_CTRL_REG		0x0180
+#define RTL8366S_TABLE_VLAN_READ_CTRL		0x0E01
+#define RTL8366S_TABLE_VLAN_WRITE_CTRL		0x0F01
+
+#define RTL8366S_VLAN_MC_BASE(_x)		(0x0016 + (_x) * 2)
+
+#define RTL8366S_VLAN_MEMBERINGRESS_REG		0x0379
+
+#define RTL8366S_PORT_LINK_STATUS_BASE		0x0060
+#define RTL8366S_PORT_STATUS_SPEED_MASK		0x0003
+#define RTL8366S_PORT_STATUS_DUPLEX_MASK	0x0004
+#define RTL8366S_PORT_STATUS_LINK_MASK		0x0010
+#define RTL8366S_PORT_STATUS_TXPAUSE_MASK	0x0020
+#define RTL8366S_PORT_STATUS_RXPAUSE_MASK	0x0040
+#define RTL8366S_PORT_STATUS_AN_MASK		0x0080
+
+
+#define RTL8366S_PORT_NUM_CPU		5
+#define RTL8366S_NUM_PORTS		6
+#define RTL8366S_NUM_VLANS		16
+#define RTL8366S_NUM_LEDGROUPS		4
+#define RTL8366S_NUM_VIDS		4096
+#define RTL8366S_PRIORITYMAX		7
+#define RTL8366S_FIDMAX			7
+
+
+#define RTL8366S_PORT_1			(1 << 0) /* In userspace port 0 */
+#define RTL8366S_PORT_2			(1 << 1) /* In userspace port 1 */
+#define RTL8366S_PORT_3			(1 << 2) /* In userspace port 2 */
+#define RTL8366S_PORT_4			(1 << 3) /* In userspace port 3 */
+
+#define RTL8366S_PORT_UNKNOWN		(1 << 4) /* No known connection */
+#define RTL8366S_PORT_CPU		(1 << 5) /* CPU port */
+
+#define RTL8366S_PORT_ALL		(RTL8366S_PORT_1 |	\
+					 RTL8366S_PORT_2 |	\
+					 RTL8366S_PORT_3 |	\
+					 RTL8366S_PORT_4 |	\
+					 RTL8366S_PORT_UNKNOWN | \
+					 RTL8366S_PORT_CPU)
+
+#define RTL8366S_PORT_ALL_BUT_CPU	(RTL8366S_PORT_1 |	\
+					 RTL8366S_PORT_2 |	\
+					 RTL8366S_PORT_3 |	\
+					 RTL8366S_PORT_4 |	\
+					 RTL8366S_PORT_UNKNOWN)
+
+#define RTL8366S_PORT_ALL_EXTERNAL	(RTL8366S_PORT_1 |	\
+					 RTL8366S_PORT_2 |	\
+					 RTL8366S_PORT_3 |	\
+					 RTL8366S_PORT_4)
+
+#define RTL8366S_PORT_ALL_INTERNAL	(RTL8366S_PORT_UNKNOWN | \
+					 RTL8366S_PORT_CPU)
+
+#define RTL8366S_VLAN_VID_MASK		0xfff
+#define RTL8366S_VLAN_PRIORITY_SHIFT	12
+#define RTL8366S_VLAN_PRIORITY_MASK	0x7
+#define RTL8366S_VLAN_MEMBER_MASK	0x3f
+#define RTL8366S_VLAN_UNTAG_SHIFT	6
+#define RTL8366S_VLAN_UNTAG_MASK	0x3f
+#define RTL8366S_VLAN_FID_SHIFT		12
+#define RTL8366S_VLAN_FID_MASK		0x7
+
+#define RTL8366S_MIB_RXB_ID		0	/* IfInOctets */
+#define RTL8366S_MIB_TXB_ID		20	/* IfOutOctets */
+
+static struct rtl8366_mib_counter rtl8366s_mib_counters[] = {
+	{ 0,  0, 4, "IfInOctets"				},
+	{ 0,  4, 4, "EtherStatsOctets"				},
+	{ 0,  8, 2, "EtherStatsUnderSizePkts"			},
+	{ 0, 10, 2, "EtherFragments"				},
+	{ 0, 12, 2, "EtherStatsPkts64Octets"			},
+	{ 0, 14, 2, "EtherStatsPkts65to127Octets"		},
+	{ 0, 16, 2, "EtherStatsPkts128to255Octets"		},
+	{ 0, 18, 2, "EtherStatsPkts256to511Octets"		},
+	{ 0, 20, 2, "EtherStatsPkts512to1023Octets"		},
+	{ 0, 22, 2, "EtherStatsPkts1024to1518Octets"		},
+	{ 0, 24, 2, "EtherOversizeStats"			},
+	{ 0, 26, 2, "EtherStatsJabbers"				},
+	{ 0, 28, 2, "IfInUcastPkts"				},
+	{ 0, 30, 2, "EtherStatsMulticastPkts"			},
+	{ 0, 32, 2, "EtherStatsBroadcastPkts"			},
+	{ 0, 34, 2, "EtherStatsDropEvents"			},
+	{ 0, 36, 2, "Dot3StatsFCSErrors"			},
+	{ 0, 38, 2, "Dot3StatsSymbolErrors"			},
+	{ 0, 40, 2, "Dot3InPauseFrames"				},
+	{ 0, 42, 2, "Dot3ControlInUnknownOpcodes"		},
+	{ 0, 44, 4, "IfOutOctets"				},
+	{ 0, 48, 2, "Dot3StatsSingleCollisionFrames"		},
+	{ 0, 50, 2, "Dot3StatMultipleCollisionFrames"		},
+	{ 0, 52, 2, "Dot3sDeferredTransmissions"		},
+	{ 0, 54, 2, "Dot3StatsLateCollisions"			},
+	{ 0, 56, 2, "EtherStatsCollisions"			},
+	{ 0, 58, 2, "Dot3StatsExcessiveCollisions"		},
+	{ 0, 60, 2, "Dot3OutPauseFrames"			},
+	{ 0, 62, 2, "Dot1dBasePortDelayExceededDiscards"	},
+
+	/*
+	 * The following counters are accessible at a different
+	 * base address.
+	 */
+	{ 1,  0, 2, "Dot1dTpPortInDiscards"			},
+	{ 1,  2, 2, "IfOutUcastPkts"				},
+	{ 1,  4, 2, "IfOutMulticastPkts"			},
+	{ 1,  6, 2, "IfOutBroadcastPkts"			},
+};
+
+#define REG_WR(_smi, _reg, _val)					\
+	do {								\
+		err = rtl8366_smi_write_reg(_smi, _reg, _val);		\
+		if (err)						\
+			return err;					\
+	} while (0)
+
+#define REG_RMW(_smi, _reg, _mask, _val)				\
+	do {								\
+		err = rtl8366_smi_rmwr(_smi, _reg, _mask, _val);	\
+		if (err)						\
+			return err;					\
+	} while (0)
+
+static int rtl8366s_reset_chip(struct rtl8366_smi *smi)
+{
+	int timeout = 10;
+	u32 data;
+
+	rtl8366_smi_write_reg_noack(smi, RTL8366S_RESET_CTRL_REG,
+				    RTL8366S_CHIP_CTRL_RESET_HW);
+	do {
+		msleep(1);
+		if (rtl8366_smi_read_reg(smi, RTL8366S_RESET_CTRL_REG, &data))
+			return -EIO;
+
+		if (!(data & RTL8366S_CHIP_CTRL_RESET_HW))
+			break;
+	} while (--timeout);
+
+	if (!timeout) {
+		printk("Timeout waiting for the switch to reset\n");
+		return -EIO;
+	}
+
+	return 0;
+}
+
+static int rtl8366s_read_phy_reg(struct rtl8366_smi *smi,
+				 u32 phy_no, u32 page, u32 addr, u32 *data)
+{
+	u32 reg;
+	int ret;
+
+	if (phy_no > RTL8366S_PHY_NO_MAX)
+		return -EINVAL;
+
+	if (page > RTL8366S_PHY_PAGE_MAX)
+		return -EINVAL;
+
+	if (addr > RTL8366S_PHY_ADDR_MAX)
+		return -EINVAL;
+
+	ret = rtl8366_smi_write_reg(smi, RTL8366S_PHY_ACCESS_CTRL_REG,
+				    RTL8366S_PHY_CTRL_READ);
+	if (ret)
+		return ret;
+
+	reg = 0x8000 | (1 << (phy_no + RTL8366S_PHY_NO_OFFSET)) |
+	      ((page << RTL8366S_PHY_PAGE_OFFSET) & RTL8366S_PHY_PAGE_MASK) |
+	      (addr & RTL8366S_PHY_REG_MASK);
+
+	ret = rtl8366_smi_write_reg(smi, reg, 0);
+	if (ret)
+		return ret;
+
+	ret = rtl8366_smi_read_reg(smi, RTL8366S_PHY_ACCESS_DATA_REG, data);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+static int rtl8366s_write_phy_reg(struct rtl8366_smi *smi,
+				  u32 phy_no, u32 page, u32 addr, u32 data)
+{
+	u32 reg;
+	int ret;
+
+	if (phy_no > RTL8366S_PHY_NO_MAX)
+		return -EINVAL;
+
+	if (page > RTL8366S_PHY_PAGE_MAX)
+		return -EINVAL;
+
+	if (addr > RTL8366S_PHY_ADDR_MAX)
+		return -EINVAL;
+
+	ret = rtl8366_smi_write_reg(smi, RTL8366S_PHY_ACCESS_CTRL_REG,
+				    RTL8366S_PHY_CTRL_WRITE);
+	if (ret)
+		return ret;
+
+	reg = 0x8000 | (1 << (phy_no + RTL8366S_PHY_NO_OFFSET)) |
+	      ((page << RTL8366S_PHY_PAGE_OFFSET) & RTL8366S_PHY_PAGE_MASK) |
+	      (addr & RTL8366S_PHY_REG_MASK);
+
+	ret = rtl8366_smi_write_reg(smi, reg, data);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+static int rtl8366s_set_green_port(struct rtl8366_smi *smi, int port, int enable)
+{
+	int err;
+	u32 phyData;
+
+	if (port >= RTL8366S_NUM_PORTS)
+		return -EINVAL;
+
+	err = rtl8366s_read_phy_reg(smi, port, 0, RTL8366S_PHY_POWER_SAVING_CTRL_REG, &phyData);
+	if (err)
+		return err;
+
+	if (enable)
+		phyData |= RTL8366S_PHY_POWER_SAVING_MASK;
+	else
+		phyData &= ~RTL8366S_PHY_POWER_SAVING_MASK;
+
+	err = rtl8366s_write_phy_reg(smi, port, 0, RTL8366S_PHY_POWER_SAVING_CTRL_REG, phyData);
+	if (err)
+		return err;
+
+	return 0;
+}
+
+static int rtl8366s_set_green(struct rtl8366_smi *smi, int enable)
+{
+	int err;
+	unsigned i;
+	u32 data = 0;
+
+	if (!enable) {
+		for (i = 0; i <= RTL8366S_PHY_NO_MAX; i++) {
+			rtl8366s_set_green_port(smi, i, 0);
+		}
+	}
+
+	if (enable)
+		data = (RTL8366S_GREEN_ETHERNET_TX_BIT | RTL8366S_GREEN_ETHERNET_RX_BIT);
+
+	REG_RMW(smi, RTL8366S_GREEN_ETHERNET_CTRL_REG, RTL8366S_GREEN_ETHERNET_CTRL_MASK, data);
+
+	return 0;
+}
+
+static int rtl8366s_setup(struct rtl8366_smi *smi)
+{
+	struct rtl8366_platform_data *pdata;
+	int err;
+	unsigned i;
+#ifdef CONFIG_OF
+	struct device_node *np;
+	unsigned num_initvals;
+	const __be32 *paddr;
+#endif
+
+	pdata = smi->parent->platform_data;
+	if (pdata && pdata->num_initvals && pdata->initvals) {
+		dev_info(smi->parent, "applying initvals\n");
+		for (i = 0; i < pdata->num_initvals; i++)
+			REG_WR(smi, pdata->initvals[i].reg,
+			       pdata->initvals[i].val);
+	}
+
+#ifdef CONFIG_OF
+	np = smi->parent->of_node;
+
+	paddr = of_get_property(np, "realtek,initvals", &num_initvals);
+	if (paddr) {
+		dev_info(smi->parent, "applying initvals from DTS\n");
+
+		if (num_initvals < (2 * sizeof(*paddr)))
+			return -EINVAL;
+
+		num_initvals /= sizeof(*paddr);
+
+		for (i = 0; i < num_initvals - 1; i += 2) {
+			u32 reg = be32_to_cpup(paddr + i);
+			u32 val = be32_to_cpup(paddr + i + 1);
+
+			REG_WR(smi, reg, val);
+		}
+	}
+
+	if (of_property_read_bool(np, "realtek,green-ethernet-features")) {
+		dev_info(smi->parent, "activating Green Ethernet features\n");
+
+		err = rtl8366s_set_green(smi, 1);
+		if (err)
+			return err;
+
+		for (i = 0; i <= RTL8366S_PHY_NO_MAX; i++) {
+			err = rtl8366s_set_green_port(smi, i, 1);
+			if (err)
+				return err;
+		}
+	}
+#endif
+
+	/* set maximum packet length to 1536 bytes */
+	REG_RMW(smi, RTL8366S_SGCR, RTL8366S_SGCR_MAX_LENGTH_MASK,
+		RTL8366S_SGCR_MAX_LENGTH_1536);
+
+	/* enable learning for all ports */
+	REG_WR(smi, RTL8366S_SSCR0, 0);
+
+	/* enable auto ageing for all ports */
+	REG_WR(smi, RTL8366S_SSCR1, 0);
+
+	/*
+	 * discard VLAN tagged packets if the port is not a member of
+	 * the VLAN with which the packets is associated.
+	 */
+	REG_WR(smi, RTL8366S_VLAN_MEMBERINGRESS_REG, RTL8366S_PORT_ALL);
+
+	/* don't drop packets whose DA has not been learned */
+	REG_RMW(smi, RTL8366S_SSCR2, RTL8366S_SSCR2_DROP_UNKNOWN_DA, 0);
+
+	return 0;
+}
+
+static int rtl8366_get_mib_counter(struct rtl8366_smi *smi, int counter,
+				   int port, unsigned long long *val)
+{
+	int i;
+	int err;
+	u32 addr, data;
+	u64 mibvalue;
+
+	if (port > RTL8366S_NUM_PORTS || counter >= RTL8366S_MIB_COUNT)
+		return -EINVAL;
+
+	switch (rtl8366s_mib_counters[counter].base) {
+	case 0:
+		addr = RTL8366S_MIB_COUNTER_BASE +
+		       RTL8366S_MIB_COUNTER_PORT_OFFSET * port;
+		break;
+
+	case 1:
+		addr = RTL8366S_MIB_COUNTER_BASE2 +
+			RTL8366S_MIB_COUNTER_PORT_OFFSET2 * port;
+		break;
+
+	default:
+		return -EINVAL;
+	}
+
+	addr += rtl8366s_mib_counters[counter].offset;
+
+	/*
+	 * Writing access counter address first
+	 * then ASIC will prepare 64bits counter wait for being retrived
+	 */
+	data = 0; /* writing data will be discard by ASIC */
+	err = rtl8366_smi_write_reg(smi, addr, data);
+	if (err)
+		return err;
+
+	/* read MIB control register */
+	err =  rtl8366_smi_read_reg(smi, RTL8366S_MIB_CTRL_REG, &data);
+	if (err)
+		return err;
+
+	if (data & RTL8366S_MIB_CTRL_BUSY_MASK)
+		return -EBUSY;
+
+	if (data & RTL8366S_MIB_CTRL_RESET_MASK)
+		return -EIO;
+
+	mibvalue = 0;
+	for (i = rtl8366s_mib_counters[counter].length; i > 0; i--) {
+		err = rtl8366_smi_read_reg(smi, addr + (i - 1), &data);
+		if (err)
+			return err;
+
+		mibvalue = (mibvalue << 16) | (data & 0xFFFF);
+	}
+
+	*val = mibvalue;
+	return 0;
+}
+
+static int rtl8366s_get_vlan_4k(struct rtl8366_smi *smi, u32 vid,
+				struct rtl8366_vlan_4k *vlan4k)
+{
+	u32 data[2];
+	int err;
+	int i;
+
+	memset(vlan4k, '\0', sizeof(struct rtl8366_vlan_4k));
+
+	if (vid >= RTL8366S_NUM_VIDS)
+		return -EINVAL;
+
+	/* write VID */
+	err = rtl8366_smi_write_reg(smi, RTL8366S_VLAN_TABLE_WRITE_BASE,
+				    vid & RTL8366S_VLAN_VID_MASK);
+	if (err)
+		return err;
+
+	/* write table access control word */
+	err = rtl8366_smi_write_reg(smi, RTL8366S_TABLE_ACCESS_CTRL_REG,
+				    RTL8366S_TABLE_VLAN_READ_CTRL);
+	if (err)
+		return err;
+
+	for (i = 0; i < 2; i++) {
+		err = rtl8366_smi_read_reg(smi,
+					   RTL8366S_VLAN_TABLE_READ_BASE + i,
+					   &data[i]);
+		if (err)
+			return err;
+	}
+
+	vlan4k->vid = vid;
+	vlan4k->untag = (data[1] >> RTL8366S_VLAN_UNTAG_SHIFT) &
+			RTL8366S_VLAN_UNTAG_MASK;
+	vlan4k->member = data[1] & RTL8366S_VLAN_MEMBER_MASK;
+	vlan4k->fid = (data[1] >> RTL8366S_VLAN_FID_SHIFT) &
+			RTL8366S_VLAN_FID_MASK;
+
+	return 0;
+}
+
+static int rtl8366s_set_vlan_4k(struct rtl8366_smi *smi,
+				const struct rtl8366_vlan_4k *vlan4k)
+{
+	u32 data[2];
+	int err;
+	int i;
+
+	if (vlan4k->vid >= RTL8366S_NUM_VIDS ||
+	    vlan4k->member > RTL8366S_VLAN_MEMBER_MASK ||
+	    vlan4k->untag > RTL8366S_VLAN_UNTAG_MASK ||
+	    vlan4k->fid > RTL8366S_FIDMAX)
+		return -EINVAL;
+
+	data[0] = vlan4k->vid & RTL8366S_VLAN_VID_MASK;
+	data[1] = (vlan4k->member & RTL8366S_VLAN_MEMBER_MASK) |
+		  ((vlan4k->untag & RTL8366S_VLAN_UNTAG_MASK) <<
+			RTL8366S_VLAN_UNTAG_SHIFT) |
+		  ((vlan4k->fid & RTL8366S_VLAN_FID_MASK) <<
+			RTL8366S_VLAN_FID_SHIFT);
+
+	for (i = 0; i < 2; i++) {
+		err = rtl8366_smi_write_reg(smi,
+					    RTL8366S_VLAN_TABLE_WRITE_BASE + i,
+					    data[i]);
+		if (err)
+			return err;
+	}
+
+	/* write table access control word */
+	err = rtl8366_smi_write_reg(smi, RTL8366S_TABLE_ACCESS_CTRL_REG,
+				    RTL8366S_TABLE_VLAN_WRITE_CTRL);
+
+	return err;
+}
+
+static int rtl8366s_get_vlan_mc(struct rtl8366_smi *smi, u32 index,
+				struct rtl8366_vlan_mc *vlanmc)
+{
+	u32 data[2];
+	int err;
+	int i;
+
+	memset(vlanmc, '\0', sizeof(struct rtl8366_vlan_mc));
+
+	if (index >= RTL8366S_NUM_VLANS)
+		return -EINVAL;
+
+	for (i = 0; i < 2; i++) {
+		err = rtl8366_smi_read_reg(smi,
+					   RTL8366S_VLAN_MC_BASE(index) + i,
+					   &data[i]);
+		if (err)
+			return err;
+	}
+
+	vlanmc->vid = data[0] & RTL8366S_VLAN_VID_MASK;
+	vlanmc->priority = (data[0] >> RTL8366S_VLAN_PRIORITY_SHIFT) &
+			   RTL8366S_VLAN_PRIORITY_MASK;
+	vlanmc->untag = (data[1] >> RTL8366S_VLAN_UNTAG_SHIFT) &
+			RTL8366S_VLAN_UNTAG_MASK;
+	vlanmc->member = data[1] & RTL8366S_VLAN_MEMBER_MASK;
+	vlanmc->fid = (data[1] >> RTL8366S_VLAN_FID_SHIFT) &
+		      RTL8366S_VLAN_FID_MASK;
+
+	return 0;
+}
+
+static int rtl8366s_set_vlan_mc(struct rtl8366_smi *smi, u32 index,
+				const struct rtl8366_vlan_mc *vlanmc)
+{
+	u32 data[2];
+	int err;
+	int i;
+
+	if (index >= RTL8366S_NUM_VLANS ||
+	    vlanmc->vid >= RTL8366S_NUM_VIDS ||
+	    vlanmc->priority > RTL8366S_PRIORITYMAX ||
+	    vlanmc->member > RTL8366S_VLAN_MEMBER_MASK ||
+	    vlanmc->untag > RTL8366S_VLAN_UNTAG_MASK ||
+	    vlanmc->fid > RTL8366S_FIDMAX)
+		return -EINVAL;
+
+	data[0] = (vlanmc->vid & RTL8366S_VLAN_VID_MASK) |
+		  ((vlanmc->priority & RTL8366S_VLAN_PRIORITY_MASK) <<
+			RTL8366S_VLAN_PRIORITY_SHIFT);
+	data[1] = (vlanmc->member & RTL8366S_VLAN_MEMBER_MASK) |
+		  ((vlanmc->untag & RTL8366S_VLAN_UNTAG_MASK) <<
+			RTL8366S_VLAN_UNTAG_SHIFT) |
+		  ((vlanmc->fid & RTL8366S_VLAN_FID_MASK) <<
+			RTL8366S_VLAN_FID_SHIFT);
+
+	for (i = 0; i < 2; i++) {
+		err = rtl8366_smi_write_reg(smi,
+					    RTL8366S_VLAN_MC_BASE(index) + i,
+					    data[i]);
+		if (err)
+			return err;
+	}
+
+	return 0;
+}
+
+static int rtl8366s_get_mc_index(struct rtl8366_smi *smi, int port, int *val)
+{
+	u32 data;
+	int err;
+
+	if (port >= RTL8366S_NUM_PORTS)
+		return -EINVAL;
+
+	err = rtl8366_smi_read_reg(smi, RTL8366S_PORT_VLAN_CTRL_REG(port),
+				   &data);
+	if (err)
+		return err;
+
+	*val = (data >> RTL8366S_PORT_VLAN_CTRL_SHIFT(port)) &
+	       RTL8366S_PORT_VLAN_CTRL_MASK;
+
+	return 0;
+}
+
+static int rtl8366s_set_mc_index(struct rtl8366_smi *smi, int port, int index)
+{
+	if (port >= RTL8366S_NUM_PORTS || index >= RTL8366S_NUM_VLANS)
+		return -EINVAL;
+
+	return rtl8366_smi_rmwr(smi, RTL8366S_PORT_VLAN_CTRL_REG(port),
+				RTL8366S_PORT_VLAN_CTRL_MASK <<
+					RTL8366S_PORT_VLAN_CTRL_SHIFT(port),
+				(index & RTL8366S_PORT_VLAN_CTRL_MASK) <<
+					RTL8366S_PORT_VLAN_CTRL_SHIFT(port));
+}
+
+static int rtl8366s_enable_vlan(struct rtl8366_smi *smi, int enable)
+{
+	return rtl8366_smi_rmwr(smi, RTL8366S_SGCR, RTL8366S_SGCR_EN_VLAN,
+				(enable) ? RTL8366S_SGCR_EN_VLAN : 0);
+}
+
+static int rtl8366s_enable_vlan4k(struct rtl8366_smi *smi, int enable)
+{
+	return rtl8366_smi_rmwr(smi, RTL8366S_VLAN_TB_CTRL_REG,
+				1, (enable) ? 1 : 0);
+}
+
+static int rtl8366s_is_vlan_valid(struct rtl8366_smi *smi, unsigned vlan)
+{
+	unsigned max = RTL8366S_NUM_VLANS;
+
+	if (smi->vlan4k_enabled)
+		max = RTL8366S_NUM_VIDS - 1;
+
+	if (vlan == 0 || vlan >= max)
+		return 0;
+
+	return 1;
+}
+
+static int rtl8366s_enable_port(struct rtl8366_smi *smi, int port, int enable)
+{
+	return rtl8366_smi_rmwr(smi, RTL8366S_PECR, (1 << port),
+				(enable) ? 0 : (1 << port));
+}
+
+static int rtl8366s_sw_reset_mibs(struct switch_dev *dev,
+				  const struct switch_attr *attr,
+				  struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+
+	return rtl8366_smi_rmwr(smi, RTL8366S_MIB_CTRL_REG, 0, (1 << 2));
+}
+
+static int rtl8366s_sw_get_blinkrate(struct switch_dev *dev,
+				     const struct switch_attr *attr,
+				     struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+
+	rtl8366_smi_read_reg(smi, RTL8366S_LED_BLINKRATE_REG, &data);
+
+	val->value.i = (data & (RTL8366S_LED_BLINKRATE_MASK));
+
+	return 0;
+}
+
+static int rtl8366s_sw_set_blinkrate(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+
+	if (val->value.i >= 6)
+		return -EINVAL;
+
+	return rtl8366_smi_rmwr(smi, RTL8366S_LED_BLINKRATE_REG,
+				RTL8366S_LED_BLINKRATE_MASK,
+				val->value.i);
+}
+
+static int rtl8366s_sw_get_max_length(struct switch_dev *dev,
+					const struct switch_attr *attr,
+					struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+
+	rtl8366_smi_read_reg(smi, RTL8366S_SGCR, &data);
+
+	val->value.i = ((data & (RTL8366S_SGCR_MAX_LENGTH_MASK)) >> 4);
+
+	return 0;
+}
+
+static int rtl8366s_sw_set_max_length(struct switch_dev *dev,
+					const struct switch_attr *attr,
+					struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	char length_code;
+
+	switch (val->value.i) {
+		case 0:
+			length_code = RTL8366S_SGCR_MAX_LENGTH_1522;
+			break;
+		case 1:
+			length_code = RTL8366S_SGCR_MAX_LENGTH_1536;
+			break;
+		case 2:
+			length_code = RTL8366S_SGCR_MAX_LENGTH_1552;
+			break;
+		case 3:
+			length_code = RTL8366S_SGCR_MAX_LENGTH_16000;
+			break;
+		default:
+			return -EINVAL;
+	}
+
+	return rtl8366_smi_rmwr(smi, RTL8366S_SGCR,
+			RTL8366S_SGCR_MAX_LENGTH_MASK,
+			length_code);
+}
+
+static int rtl8366s_sw_get_learning_enable(struct switch_dev *dev,
+					   const struct switch_attr *attr,
+					   struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+
+	rtl8366_smi_read_reg(smi,RTL8366S_SSCR0, &data);
+	val->value.i = !data;
+
+	return 0;
+}
+
+
+static int rtl8366s_sw_set_learning_enable(struct switch_dev *dev,
+					   const struct switch_attr *attr,
+					   struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 portmask = 0;
+	int err = 0;
+
+	if (!val->value.i)
+		portmask = RTL8366S_PORT_ALL;
+
+	/* set learning for all ports */
+	REG_WR(smi, RTL8366S_SSCR0, portmask);
+
+	/* set auto ageing for all ports */
+	REG_WR(smi, RTL8366S_SSCR1, portmask);
+
+	return 0;
+}
+
+static int rtl8366s_sw_get_green(struct switch_dev *dev,
+			      const struct switch_attr *attr,
+			      struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+	int err;
+
+	err = rtl8366_smi_read_reg(smi, RTL8366S_GREEN_ETHERNET_CTRL_REG, &data);
+	if (err)
+		return err;
+
+	val->value.i = ((data & (RTL8366S_GREEN_ETHERNET_TX_BIT | RTL8366S_GREEN_ETHERNET_RX_BIT)) != 0) ? 1 : 0;
+
+	return 0;
+}
+
+static int rtl8366s_sw_set_green(struct switch_dev *dev,
+				 const struct switch_attr *attr,
+				 struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+
+	return rtl8366s_set_green(smi, val->value.i);
+}
+
+static int rtl8366s_sw_get_port_link(struct switch_dev *dev,
+				     int port,
+				     struct switch_port_link *link)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data = 0;
+	u32 speed;
+
+	if (port >= RTL8366S_NUM_PORTS)
+		return -EINVAL;
+
+	rtl8366_smi_read_reg(smi, RTL8366S_PORT_LINK_STATUS_BASE + (port / 2),
+			     &data);
+
+	if (port % 2)
+		data = data >> 8;
+
+	link->link = !!(data & RTL8366S_PORT_STATUS_LINK_MASK);
+	if (!link->link)
+		return 0;
+
+	link->duplex = !!(data & RTL8366S_PORT_STATUS_DUPLEX_MASK);
+	link->rx_flow = !!(data & RTL8366S_PORT_STATUS_RXPAUSE_MASK);
+	link->tx_flow = !!(data & RTL8366S_PORT_STATUS_TXPAUSE_MASK);
+	link->aneg = !!(data & RTL8366S_PORT_STATUS_AN_MASK);
+
+	speed = (data & RTL8366S_PORT_STATUS_SPEED_MASK);
+	switch (speed) {
+	case 0:
+		link->speed = SWITCH_PORT_SPEED_10;
+		break;
+	case 1:
+		link->speed = SWITCH_PORT_SPEED_100;
+		break;
+	case 2:
+		link->speed = SWITCH_PORT_SPEED_1000;
+		break;
+	default:
+		link->speed = SWITCH_PORT_SPEED_UNKNOWN;
+		break;
+	}
+
+	return 0;
+}
+
+static int rtl8366s_sw_set_port_led(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+	u32 mask;
+	u32 reg;
+
+	if (val->port_vlan >= RTL8366S_NUM_PORTS ||
+	    (1 << val->port_vlan) == RTL8366S_PORT_UNKNOWN)
+		return -EINVAL;
+
+	if (val->port_vlan == RTL8366S_PORT_NUM_CPU) {
+		reg = RTL8366S_LED_BLINKRATE_REG;
+		mask = 0xF << 4;
+		data = val->value.i << 4;
+	} else {
+		reg = RTL8366S_LED_CTRL_REG;
+		mask = 0xF << (val->port_vlan * 4),
+		data = val->value.i << (val->port_vlan * 4);
+	}
+
+	return rtl8366_smi_rmwr(smi, reg, mask, data);
+}
+
+static int rtl8366s_sw_get_port_led(struct switch_dev *dev,
+				    const struct switch_attr *attr,
+				    struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data = 0;
+
+	if (val->port_vlan >= RTL8366S_NUM_LEDGROUPS)
+		return -EINVAL;
+
+	rtl8366_smi_read_reg(smi, RTL8366S_LED_CTRL_REG, &data);
+	val->value.i = (data >> (val->port_vlan * 4)) & 0x000F;
+
+	return 0;
+}
+
+static int rtl8366s_sw_get_green_port(struct switch_dev *dev,
+				      const struct switch_attr *attr,
+				      struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	int err;
+	u32 phyData;
+
+	if (val->port_vlan >= RTL8366S_NUM_PORTS)
+		return -EINVAL;
+
+	err = rtl8366s_read_phy_reg(smi, val->port_vlan, 0, RTL8366S_PHY_POWER_SAVING_CTRL_REG, &phyData);
+	if (err)
+		return err;
+
+	val->value.i = ((phyData & RTL8366S_PHY_POWER_SAVING_MASK) != 0) ? 1 : 0;
+
+	return 0;
+}
+
+static int rtl8366s_sw_set_green_port(struct switch_dev *dev,
+				      const struct switch_attr *attr,
+				      struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	return rtl8366s_set_green_port(smi, val->port_vlan, val->value.i);
+}
+
+static int rtl8366s_sw_reset_port_mibs(struct switch_dev *dev,
+				       const struct switch_attr *attr,
+				       struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+
+	if (val->port_vlan >= RTL8366S_NUM_PORTS)
+		return -EINVAL;
+
+
+	return rtl8366_smi_rmwr(smi, RTL8366S_MIB_CTRL_REG,
+				0, (1 << (val->port_vlan + 3)));
+}
+
+static int rtl8366s_sw_get_port_stats(struct switch_dev *dev, int port,
+                                        struct switch_port_stats *stats)
+{
+	return (rtl8366_sw_get_port_stats(dev, port, stats,
+				RTL8366S_MIB_TXB_ID, RTL8366S_MIB_RXB_ID));
+}
+
+static struct switch_attr rtl8366s_globals[] = {
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_learning",
+		.description = "Enable learning, enable aging",
+		.set = rtl8366s_sw_set_learning_enable,
+		.get = rtl8366s_sw_get_learning_enable,
+		.max = 1,
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_vlan",
+		.description = "Enable VLAN mode",
+		.set = rtl8366_sw_set_vlan_enable,
+		.get = rtl8366_sw_get_vlan_enable,
+		.max = 1,
+		.ofs = 1
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_vlan4k",
+		.description = "Enable VLAN 4K mode",
+		.set = rtl8366_sw_set_vlan_enable,
+		.get = rtl8366_sw_get_vlan_enable,
+		.max = 1,
+		.ofs = 2
+	}, {
+		.type = SWITCH_TYPE_NOVAL,
+		.name = "reset_mibs",
+		.description = "Reset all MIB counters",
+		.set = rtl8366s_sw_reset_mibs,
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "blinkrate",
+		.description = "Get/Set LED blinking rate (0 = 43ms, 1 = 84ms,"
+		" 2 = 120ms, 3 = 170ms, 4 = 340ms, 5 = 670ms)",
+		.set = rtl8366s_sw_set_blinkrate,
+		.get = rtl8366s_sw_get_blinkrate,
+		.max = 5
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "max_length",
+		.description = "Get/Set the maximum length of valid packets"
+		" (0 = 1522, 1 = 1536, 2 = 1552, 3 = 16000 (9216?))",
+		.set = rtl8366s_sw_set_max_length,
+		.get = rtl8366s_sw_get_max_length,
+		.max = 3,
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "green_mode",
+		.description = "Get/Set the router green feature",
+		.set = rtl8366s_sw_set_green,
+		.get = rtl8366s_sw_get_green,
+		.max = 1,
+	},
+};
+
+static struct switch_attr rtl8366s_port[] = {
+	{
+		.type = SWITCH_TYPE_NOVAL,
+		.name = "reset_mib",
+		.description = "Reset single port MIB counters",
+		.set = rtl8366s_sw_reset_port_mibs,
+	}, {
+		.type = SWITCH_TYPE_STRING,
+		.name = "mib",
+		.description = "Get MIB counters for port",
+		.max = 33,
+		.set = NULL,
+		.get = rtl8366_sw_get_port_mib,
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "led",
+		.description = "Get/Set port group (0 - 3) led mode (0 - 15)",
+		.max = 15,
+		.set = rtl8366s_sw_set_port_led,
+		.get = rtl8366s_sw_get_port_led,
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "green_port",
+		.description = "Get/Set port green feature (0 - 1)",
+		.max = 1,
+		.set = rtl8366s_sw_set_green_port,
+		.get = rtl8366s_sw_get_green_port,
+	},
+};
+
+static struct switch_attr rtl8366s_vlan[] = {
+	{
+		.type = SWITCH_TYPE_STRING,
+		.name = "info",
+		.description = "Get vlan information",
+		.max = 1,
+		.set = NULL,
+		.get = rtl8366_sw_get_vlan_info,
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "fid",
+		.description = "Get/Set vlan FID",
+		.max = RTL8366S_FIDMAX,
+		.set = rtl8366_sw_set_vlan_fid,
+		.get = rtl8366_sw_get_vlan_fid,
+	},
+};
+
+static const struct switch_dev_ops rtl8366_ops = {
+	.attr_global = {
+		.attr = rtl8366s_globals,
+		.n_attr = ARRAY_SIZE(rtl8366s_globals),
+	},
+	.attr_port = {
+		.attr = rtl8366s_port,
+		.n_attr = ARRAY_SIZE(rtl8366s_port),
+	},
+	.attr_vlan = {
+		.attr = rtl8366s_vlan,
+		.n_attr = ARRAY_SIZE(rtl8366s_vlan),
+	},
+
+	.get_vlan_ports = rtl8366_sw_get_vlan_ports,
+	.set_vlan_ports = rtl8366_sw_set_vlan_ports,
+	.get_port_pvid = rtl8366_sw_get_port_pvid,
+	.set_port_pvid = rtl8366_sw_set_port_pvid,
+	.reset_switch = rtl8366_sw_reset_switch,
+	.get_port_link = rtl8366s_sw_get_port_link,
+	.get_port_stats = rtl8366s_sw_get_port_stats,
+};
+
+static int rtl8366s_switch_init(struct rtl8366_smi *smi)
+{
+	struct switch_dev *dev = &smi->sw_dev;
+	int err;
+
+	dev->name = "RTL8366S";
+	dev->cpu_port = RTL8366S_PORT_NUM_CPU;
+	dev->ports = RTL8366S_NUM_PORTS;
+	dev->vlans = RTL8366S_NUM_VIDS;
+	dev->ops = &rtl8366_ops;
+	dev->alias = dev_name(smi->parent);
+
+	err = register_switch(dev, NULL);
+	if (err)
+		dev_err(smi->parent, "switch registration failed\n");
+
+	return err;
+}
+
+static void rtl8366s_switch_cleanup(struct rtl8366_smi *smi)
+{
+	unregister_switch(&smi->sw_dev);
+}
+
+static int rtl8366s_mii_read(struct mii_bus *bus, int addr, int reg)
+{
+	struct rtl8366_smi *smi = bus->priv;
+	u32 val = 0;
+	int err;
+
+	err = rtl8366s_read_phy_reg(smi, addr, 0, reg, &val);
+	if (err)
+		return 0xffff;
+
+	return val;
+}
+
+static int rtl8366s_mii_write(struct mii_bus *bus, int addr, int reg, u16 val)
+{
+	struct rtl8366_smi *smi = bus->priv;
+	u32 t;
+	int err;
+
+	err = rtl8366s_write_phy_reg(smi, addr, 0, reg, val);
+	/* flush write */
+	(void) rtl8366s_read_phy_reg(smi, addr, 0, reg, &t);
+
+	return err;
+}
+
+static int rtl8366s_detect(struct rtl8366_smi *smi)
+{
+	u32 chip_id = 0;
+	u32 chip_ver = 0;
+	int ret;
+
+	ret = rtl8366_smi_read_reg(smi, RTL8366S_CHIP_ID_REG, &chip_id);
+	if (ret) {
+		dev_err(smi->parent, "unable to read chip id\n");
+		return ret;
+	}
+
+	switch (chip_id) {
+	case RTL8366S_CHIP_ID_8366:
+		break;
+	default:
+		dev_err(smi->parent, "unknown chip id (%04x)\n", chip_id);
+		return -ENODEV;
+	}
+
+	ret = rtl8366_smi_read_reg(smi, RTL8366S_CHIP_VERSION_CTRL_REG,
+				   &chip_ver);
+	if (ret) {
+		dev_err(smi->parent, "unable to read chip version\n");
+		return ret;
+	}
+
+	dev_info(smi->parent, "RTL%04x ver. %u chip found\n",
+		 chip_id, chip_ver & RTL8366S_CHIP_VERSION_MASK);
+
+	return 0;
+}
+
+static struct rtl8366_smi_ops rtl8366s_smi_ops = {
+	.detect		= rtl8366s_detect,
+	.reset_chip	= rtl8366s_reset_chip,
+	.setup		= rtl8366s_setup,
+
+	.mii_read	= rtl8366s_mii_read,
+	.mii_write	= rtl8366s_mii_write,
+
+	.get_vlan_mc	= rtl8366s_get_vlan_mc,
+	.set_vlan_mc	= rtl8366s_set_vlan_mc,
+	.get_vlan_4k	= rtl8366s_get_vlan_4k,
+	.set_vlan_4k	= rtl8366s_set_vlan_4k,
+	.get_mc_index	= rtl8366s_get_mc_index,
+	.set_mc_index	= rtl8366s_set_mc_index,
+	.get_mib_counter = rtl8366_get_mib_counter,
+	.is_vlan_valid	= rtl8366s_is_vlan_valid,
+	.enable_vlan	= rtl8366s_enable_vlan,
+	.enable_vlan4k	= rtl8366s_enable_vlan4k,
+	.enable_port	= rtl8366s_enable_port,
+};
+
+static int rtl8366s_probe(struct platform_device *pdev)
+{
+	static int rtl8366_smi_version_printed;
+	struct rtl8366_smi *smi;
+	int err;
+
+	if (!rtl8366_smi_version_printed++)
+		printk(KERN_NOTICE RTL8366S_DRIVER_DESC
+		       " version " RTL8366S_DRIVER_VER"\n");
+
+	smi = rtl8366_smi_probe(pdev);
+	if (IS_ERR(smi))
+		return PTR_ERR(smi);
+
+	smi->clk_delay = 10;
+	smi->cmd_read = 0xa9;
+	smi->cmd_write = 0xa8;
+	smi->ops = &rtl8366s_smi_ops;
+	smi->cpu_port = RTL8366S_PORT_NUM_CPU;
+	smi->num_ports = RTL8366S_NUM_PORTS;
+	smi->num_vlan_mc = RTL8366S_NUM_VLANS;
+	smi->mib_counters = rtl8366s_mib_counters;
+	smi->num_mib_counters = ARRAY_SIZE(rtl8366s_mib_counters);
+
+	err = rtl8366_smi_init(smi);
+	if (err)
+		goto err_free_smi;
+
+	platform_set_drvdata(pdev, smi);
+
+	err = rtl8366s_switch_init(smi);
+	if (err)
+		goto err_clear_drvdata;
+
+	return 0;
+
+ err_clear_drvdata:
+	platform_set_drvdata(pdev, NULL);
+	rtl8366_smi_cleanup(smi);
+ err_free_smi:
+	kfree(smi);
+	return err;
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6,11,0)
+static int rtl8366s_remove(struct platform_device *pdev)
+#else
+static void rtl8366s_remove(struct platform_device *pdev)
+#endif
+{
+	struct rtl8366_smi *smi = platform_get_drvdata(pdev);
+
+	if (smi) {
+		rtl8366s_switch_cleanup(smi);
+		platform_set_drvdata(pdev, NULL);
+		rtl8366_smi_cleanup(smi);
+		kfree(smi);
+	}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6,11,0)
+	return 0;
+#endif
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id rtl8366s_match[] = {
+	{ .compatible = "realtek,rtl8366s" },
+	{},
+};
+MODULE_DEVICE_TABLE(of, rtl8366s_match);
+#endif
+
+static struct platform_driver rtl8366s_driver = {
+	.driver = {
+		.name		= RTL8366S_DRIVER_NAME,
+#ifdef CONFIG_OF
+		.of_match_table = of_match_ptr(rtl8366s_match),
+#endif
+	},
+	.probe		= rtl8366s_probe,
+	.remove		= rtl8366s_remove,
+};
+
+static int __init rtl8366s_module_init(void)
+{
+	return platform_driver_register(&rtl8366s_driver);
+}
+module_init(rtl8366s_module_init);
+
+static void __exit rtl8366s_module_exit(void)
+{
+	platform_driver_unregister(&rtl8366s_driver);
+}
+module_exit(rtl8366s_module_exit);
+
+MODULE_DESCRIPTION(RTL8366S_DRIVER_DESC);
+MODULE_VERSION(RTL8366S_DRIVER_VER);
+MODULE_AUTHOR("Gabor Juhos <juhosg@openwrt.org>");
+MODULE_AUTHOR("Antti Seppälä <a.seppala@gmail.com>");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:" RTL8366S_DRIVER_NAME);
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/rtl8367.c b/6.12/target/linux/generic/files/drivers/net/phy/rtl8367.c
new file mode 100644
index 00000000..97dc4d20
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/rtl8367.c
@@ -0,0 +1,1868 @@
+/*
+ * Platform driver for the Realtek RTL8367R/M ethernet switches
+ *
+ * Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/device.h>
+#include <linux/of.h>
+#include <linux/of_platform.h>
+#include <linux/delay.h>
+#include <linux/skbuff.h>
+#include <linux/rtl8367.h>
+#include <linux/version.h>
+
+#include "rtl8366_smi.h"
+
+#define RTL8367_RESET_DELAY	1000	/* msecs*/
+
+#define RTL8367_PHY_ADDR_MAX	8
+#define RTL8367_PHY_REG_MAX	31
+
+#define RTL8367_VID_MASK	0xffff
+#define RTL8367_FID_MASK	0xfff
+#define RTL8367_UNTAG_MASK	0xffff
+#define RTL8367_MEMBER_MASK	0xffff
+
+#define RTL8367_PORT_CFG_REG(_p)		(0x000e + 0x20 * (_p))
+#define   RTL8367_PORT_CFG_EGRESS_MODE_SHIFT	4
+#define   RTL8367_PORT_CFG_EGRESS_MODE_MASK	0x3
+#define   RTL8367_PORT_CFG_EGRESS_MODE_ORIGINAL	0
+#define   RTL8367_PORT_CFG_EGRESS_MODE_KEEP	1
+#define   RTL8367_PORT_CFG_EGRESS_MODE_PRI	2
+#define   RTL8367_PORT_CFG_EGRESS_MODE_REAL	3
+
+#define RTL8367_BYPASS_LINE_RATE_REG		0x03f7
+
+#define RTL8367_TA_CTRL_REG			0x0500
+#define   RTL8367_TA_CTRL_STATUS		BIT(12)
+#define   RTL8367_TA_CTRL_METHOD		BIT(5)
+#define   RTL8367_TA_CTRL_CMD_SHIFT		4
+#define   RTL8367_TA_CTRL_CMD_READ		0
+#define   RTL8367_TA_CTRL_CMD_WRITE		1
+#define   RTL8367_TA_CTRL_TABLE_SHIFT		0
+#define   RTL8367_TA_CTRL_TABLE_ACLRULE		1
+#define   RTL8367_TA_CTRL_TABLE_ACLACT		2
+#define   RTL8367_TA_CTRL_TABLE_CVLAN		3
+#define   RTL8367_TA_CTRL_TABLE_L2		4
+#define   RTL8367_TA_CTRL_CVLAN_READ \
+		((RTL8367_TA_CTRL_CMD_READ << RTL8367_TA_CTRL_CMD_SHIFT) | \
+		 RTL8367_TA_CTRL_TABLE_CVLAN)
+#define   RTL8367_TA_CTRL_CVLAN_WRITE \
+		((RTL8367_TA_CTRL_CMD_WRITE << RTL8367_TA_CTRL_CMD_SHIFT) | \
+		 RTL8367_TA_CTRL_TABLE_CVLAN)
+
+#define RTL8367_TA_ADDR_REG			0x0501
+#define   RTL8367_TA_ADDR_MASK			0x3fff
+
+#define RTL8367_TA_DATA_REG(_x)			(0x0503 + (_x))
+#define   RTL8367_TA_VLAN_DATA_SIZE		4
+#define   RTL8367_TA_VLAN_VID_MASK		RTL8367_VID_MASK
+#define   RTL8367_TA_VLAN_MEMBER_SHIFT		0
+#define   RTL8367_TA_VLAN_MEMBER_MASK		RTL8367_MEMBER_MASK
+#define   RTL8367_TA_VLAN_FID_SHIFT		0
+#define   RTL8367_TA_VLAN_FID_MASK		RTL8367_FID_MASK
+#define   RTL8367_TA_VLAN_UNTAG1_SHIFT		14
+#define   RTL8367_TA_VLAN_UNTAG1_MASK		0x3
+#define   RTL8367_TA_VLAN_UNTAG2_SHIFT		0
+#define   RTL8367_TA_VLAN_UNTAG2_MASK		0x3fff
+
+#define RTL8367_VLAN_PVID_CTRL_REG(_p)		(0x0700 + (_p) / 2)
+#define RTL8367_VLAN_PVID_CTRL_MASK		0x1f
+#define RTL8367_VLAN_PVID_CTRL_SHIFT(_p)	(8 * ((_p) % 2))
+
+#define RTL8367_VLAN_MC_BASE(_x)		(0x0728 + (_x) * 4)
+#define   RTL8367_VLAN_MC_DATA_SIZE		4
+#define   RTL8367_VLAN_MC_MEMBER_SHIFT		0
+#define   RTL8367_VLAN_MC_MEMBER_MASK		RTL8367_MEMBER_MASK
+#define   RTL8367_VLAN_MC_FID_SHIFT		0
+#define   RTL8367_VLAN_MC_FID_MASK		RTL8367_FID_MASK
+#define   RTL8367_VLAN_MC_EVID_SHIFT		0
+#define   RTL8367_VLAN_MC_EVID_MASK		RTL8367_VID_MASK
+
+#define RTL8367_VLAN_CTRL_REG			0x07a8
+#define   RTL8367_VLAN_CTRL_ENABLE		BIT(0)
+
+#define RTL8367_VLAN_INGRESS_REG		0x07a9
+
+#define RTL8367_PORT_ISOLATION_REG(_p)		(0x08a2 + (_p))
+
+#define RTL8367_MIB_COUNTER_REG(_x)		(0x1000 + (_x))
+
+#define RTL8367_MIB_ADDRESS_REG			0x1004
+
+#define RTL8367_MIB_CTRL_REG(_x)		(0x1005 + (_x))
+#define   RTL8367_MIB_CTRL_GLOBAL_RESET_MASK	BIT(11)
+#define   RTL8367_MIB_CTRL_QM_RESET_MASK	BIT(10)
+#define   RTL8367_MIB_CTRL_PORT_RESET_MASK(_p)	BIT(2 + (_p))
+#define   RTL8367_MIB_CTRL_RESET_MASK		BIT(1)
+#define   RTL8367_MIB_CTRL_BUSY_MASK		BIT(0)
+
+#define RTL8367_MIB_COUNT			36
+#define RTL8367_MIB_COUNTER_PORT_OFFSET		0x0050
+
+#define RTL8367_SWC0_REG			0x1200
+#define   RTL8367_SWC0_MAX_LENGTH_SHIFT		13
+#define   RTL8367_SWC0_MAX_LENGTH(_x)		((_x) << 13)
+#define   RTL8367_SWC0_MAX_LENGTH_MASK		RTL8367_SWC0_MAX_LENGTH(0x3)
+#define   RTL8367_SWC0_MAX_LENGTH_1522		RTL8367_SWC0_MAX_LENGTH(0)
+#define   RTL8367_SWC0_MAX_LENGTH_1536		RTL8367_SWC0_MAX_LENGTH(1)
+#define   RTL8367_SWC0_MAX_LENGTH_1552		RTL8367_SWC0_MAX_LENGTH(2)
+#define   RTL8367_SWC0_MAX_LENGTH_16000		RTL8367_SWC0_MAX_LENGTH(3)
+
+#define RTL8367_CHIP_NUMBER_REG			0x1300
+
+#define RTL8367_CHIP_VER_REG			0x1301
+#define   RTL8367_CHIP_VER_RLVID_SHIFT		12
+#define   RTL8367_CHIP_VER_RLVID_MASK		0xf
+#define   RTL8367_CHIP_VER_MCID_SHIFT		8
+#define   RTL8367_CHIP_VER_MCID_MASK		0xf
+#define   RTL8367_CHIP_VER_BOID_SHIFT		4
+#define   RTL8367_CHIP_VER_BOID_MASK		0xf
+
+#define RTL8367_CHIP_MODE_REG			0x1302
+#define   RTL8367_CHIP_MODE_MASK		0x7
+
+#define RTL8367_CHIP_DEBUG0_REG			0x1303
+#define   RTL8367_CHIP_DEBUG0_DUMMY0(_x)	BIT(8 + (_x))
+
+#define RTL8367_CHIP_DEBUG1_REG			0x1304
+
+#define RTL8367_DIS_REG				0x1305
+#define   RTL8367_DIS_SKIP_MII_RXER(_x)		BIT(12 + (_x))
+#define   RTL8367_DIS_RGMII_SHIFT(_x)		(4 * (_x))
+#define   RTL8367_DIS_RGMII_MASK		0x7
+
+#define RTL8367_EXT_RGMXF_REG(_x)		(0x1306 + (_x))
+#define   RTL8367_EXT_RGMXF_DUMMY0_SHIFT	5
+#define   RTL8367_EXT_RGMXF_DUMMY0_MASK	0x7ff
+#define   RTL8367_EXT_RGMXF_TXDELAY_SHIFT	3
+#define   RTL8367_EXT_RGMXF_TXDELAY_MASK	1
+#define   RTL8367_EXT_RGMXF_RXDELAY_MASK	0x7
+
+#define RTL8367_DI_FORCE_REG(_x)		(0x1310 + (_x))
+#define   RTL8367_DI_FORCE_MODE			BIT(12)
+#define   RTL8367_DI_FORCE_NWAY			BIT(7)
+#define   RTL8367_DI_FORCE_TXPAUSE		BIT(6)
+#define   RTL8367_DI_FORCE_RXPAUSE		BIT(5)
+#define   RTL8367_DI_FORCE_LINK			BIT(4)
+#define   RTL8367_DI_FORCE_DUPLEX		BIT(2)
+#define   RTL8367_DI_FORCE_SPEED_MASK		3
+#define   RTL8367_DI_FORCE_SPEED_10		0
+#define   RTL8367_DI_FORCE_SPEED_100		1
+#define   RTL8367_DI_FORCE_SPEED_1000		2
+
+#define RTL8367_MAC_FORCE_REG(_x)		(0x1312 + (_x))
+
+#define RTL8367_CHIP_RESET_REG			0x1322
+#define   RTL8367_CHIP_RESET_SW			BIT(1)
+#define   RTL8367_CHIP_RESET_HW			BIT(0)
+
+#define RTL8367_PORT_STATUS_REG(_p)		(0x1352 + (_p))
+#define   RTL8367_PORT_STATUS_NWAY		BIT(7)
+#define   RTL8367_PORT_STATUS_TXPAUSE		BIT(6)
+#define   RTL8367_PORT_STATUS_RXPAUSE		BIT(5)
+#define   RTL8367_PORT_STATUS_LINK		BIT(4)
+#define   RTL8367_PORT_STATUS_DUPLEX		BIT(2)
+#define   RTL8367_PORT_STATUS_SPEED_MASK	0x0003
+#define   RTL8367_PORT_STATUS_SPEED_10		0
+#define   RTL8367_PORT_STATUS_SPEED_100		1
+#define   RTL8367_PORT_STATUS_SPEED_1000	2
+
+#define RTL8367_RTL_NO_REG			0x13c0
+#define   RTL8367_RTL_NO_8367R			0x3670
+#define   RTL8367_RTL_NO_8367M			0x3671
+
+#define RTL8367_RTL_VER_REG			0x13c1
+#define   RTL8367_RTL_VER_MASK			0xf
+
+#define RTL8367_RTL_MAGIC_ID_REG		0x13c2
+#define   RTL8367_RTL_MAGIC_ID_VAL		0x0249
+
+#define RTL8367_LED_SYS_CONFIG_REG		0x1b00
+#define RTL8367_LED_MODE_REG			0x1b02
+#define   RTL8367_LED_MODE_RATE_M		0x7
+#define   RTL8367_LED_MODE_RATE_S		1
+
+#define RTL8367_LED_CONFIG_REG			0x1b03
+#define   RTL8367_LED_CONFIG_DATA_S		12
+#define   RTL8367_LED_CONFIG_DATA_M		0x3
+#define   RTL8367_LED_CONFIG_SEL		BIT(14)
+#define   RTL8367_LED_CONFIG_LED_CFG_M		0xf
+
+#define RTL8367_PARA_LED_IO_EN1_REG		0x1b24
+#define RTL8367_PARA_LED_IO_EN2_REG		0x1b25
+#define   RTL8367_PARA_LED_IO_EN_PMASK		0xff
+
+#define RTL8367_IA_CTRL_REG			0x1f00
+#define   RTL8367_IA_CTRL_RW(_x)		((_x) << 1)
+#define   RTL8367_IA_CTRL_RW_READ		RTL8367_IA_CTRL_RW(0)
+#define   RTL8367_IA_CTRL_RW_WRITE		RTL8367_IA_CTRL_RW(1)
+#define   RTL8367_IA_CTRL_CMD_MASK		BIT(0)
+
+#define RTL8367_IA_STATUS_REG			0x1f01
+#define   RTL8367_IA_STATUS_PHY_BUSY		BIT(2)
+#define   RTL8367_IA_STATUS_SDS_BUSY		BIT(1)
+#define   RTL8367_IA_STATUS_MDX_BUSY		BIT(0)
+
+#define RTL8367_IA_ADDRESS_REG			0x1f02
+
+#define RTL8367_IA_WRITE_DATA_REG		0x1f03
+#define RTL8367_IA_READ_DATA_REG		0x1f04
+
+#define RTL8367_INTERNAL_PHY_REG(_a, _r)	(0x2000 + 32 * (_a) + (_r))
+
+#define RTL8367_CPU_PORT_NUM		9
+#define RTL8367_NUM_PORTS		10
+#define RTL8367_NUM_VLANS		32
+#define RTL8367_NUM_LEDGROUPS		4
+#define RTL8367_NUM_VIDS		4096
+#define RTL8367_PRIORITYMAX		7
+#define RTL8367_FIDMAX			7
+
+#define RTL8367_PORT_0			BIT(0)
+#define RTL8367_PORT_1			BIT(1)
+#define RTL8367_PORT_2			BIT(2)
+#define RTL8367_PORT_3			BIT(3)
+#define RTL8367_PORT_4			BIT(4)
+#define RTL8367_PORT_5			BIT(5)
+#define RTL8367_PORT_6			BIT(6)
+#define RTL8367_PORT_7			BIT(7)
+#define RTL8367_PORT_E1			BIT(8)	/* external port 1 */
+#define RTL8367_PORT_E0			BIT(9)	/* external port 0 */
+
+#define RTL8367_PORTS_ALL					\
+	(RTL8367_PORT_0 | RTL8367_PORT_1 | RTL8367_PORT_2 |	\
+	 RTL8367_PORT_3 | RTL8367_PORT_4 | RTL8367_PORT_5 |	\
+	 RTL8367_PORT_6 | RTL8367_PORT_7 | RTL8367_PORT_E1 |	\
+	 RTL8367_PORT_E0)
+
+#define RTL8367_PORTS_ALL_BUT_CPU				\
+	(RTL8367_PORT_0 | RTL8367_PORT_1 | RTL8367_PORT_2 |	\
+	 RTL8367_PORT_3 | RTL8367_PORT_4 | RTL8367_PORT_5 |	\
+	 RTL8367_PORT_6 | RTL8367_PORT_7 | RTL8367_PORT_E1)
+
+struct rtl8367_initval {
+	u16 reg;
+	u16 val;
+};
+
+#define RTL8367_MIB_RXB_ID		0	/* IfInOctets */
+#define RTL8367_MIB_TXB_ID		20	/* IfOutOctets */
+
+static struct rtl8366_mib_counter rtl8367_mib_counters[] = {
+	{ 0,  0, 4, "IfInOctets"				},
+	{ 0,  4, 2, "Dot3StatsFCSErrors"			},
+	{ 0,  6, 2, "Dot3StatsSymbolErrors"			},
+	{ 0,  8, 2, "Dot3InPauseFrames"				},
+	{ 0, 10, 2, "Dot3ControlInUnknownOpcodes"		},
+	{ 0, 12, 2, "EtherStatsFragments"			},
+	{ 0, 14, 2, "EtherStatsJabbers"				},
+	{ 0, 16, 2, "IfInUcastPkts"				},
+	{ 0, 18, 2, "EtherStatsDropEvents"			},
+	{ 0, 20, 4, "EtherStatsOctets"				},
+
+	{ 0, 24, 2, "EtherStatsUnderSizePkts"			},
+	{ 0, 26, 2, "EtherOversizeStats"			},
+	{ 0, 28, 2, "EtherStatsPkts64Octets"			},
+	{ 0, 30, 2, "EtherStatsPkts65to127Octets"		},
+	{ 0, 32, 2, "EtherStatsPkts128to255Octets"		},
+	{ 0, 34, 2, "EtherStatsPkts256to511Octets"		},
+	{ 0, 36, 2, "EtherStatsPkts512to1023Octets"		},
+	{ 0, 38, 2, "EtherStatsPkts1024to1518Octets"		},
+	{ 0, 40, 2, "EtherStatsMulticastPkts"			},
+	{ 0, 42, 2, "EtherStatsBroadcastPkts"			},
+
+	{ 0, 44, 4, "IfOutOctets"				},
+
+	{ 0, 48, 2, "Dot3StatsSingleCollisionFrames"		},
+	{ 0, 50, 2, "Dot3StatMultipleCollisionFrames"		},
+	{ 0, 52, 2, "Dot3sDeferredTransmissions"		},
+	{ 0, 54, 2, "Dot3StatsLateCollisions"			},
+	{ 0, 56, 2, "EtherStatsCollisions"			},
+	{ 0, 58, 2, "Dot3StatsExcessiveCollisions"		},
+	{ 0, 60, 2, "Dot3OutPauseFrames"			},
+	{ 0, 62, 2, "Dot1dBasePortDelayExceededDiscards"	},
+	{ 0, 64, 2, "Dot1dTpPortInDiscards"			},
+	{ 0, 66, 2, "IfOutUcastPkts"				},
+	{ 0, 68, 2, "IfOutMulticastPkts"			},
+	{ 0, 70, 2, "IfOutBroadcastPkts"			},
+	{ 0, 72, 2, "OutOampduPkts"				},
+	{ 0, 74, 2, "InOampduPkts"				},
+	{ 0, 76, 2, "PktgenPkts"				},
+};
+
+#define REG_RD(_smi, _reg, _val)					\
+	do {								\
+		err = rtl8366_smi_read_reg(_smi, _reg, _val);		\
+		if (err)						\
+			return err;					\
+	} while (0)
+
+#define REG_WR(_smi, _reg, _val)					\
+	do {								\
+		err = rtl8366_smi_write_reg(_smi, _reg, _val);		\
+		if (err)						\
+			return err;					\
+	} while (0)
+
+#define REG_RMW(_smi, _reg, _mask, _val)				\
+	do {								\
+		err = rtl8366_smi_rmwr(_smi, _reg, _mask, _val);	\
+		if (err)						\
+			return err;					\
+	} while (0)
+
+static const struct rtl8367_initval rtl8367_initvals_0_0[] = {
+	{0x133f, 0x0030}, {0x133e, 0x000e}, {0x221f, 0x0000}, {0x2215, 0x1006},
+	{0x221f, 0x0005}, {0x2200, 0x00c6}, {0x221f, 0x0007}, {0x221e, 0x0048},
+	{0x2215, 0x6412}, {0x2216, 0x6412}, {0x2217, 0x6412}, {0x2218, 0x6412},
+	{0x2219, 0x6412}, {0x221A, 0x6412}, {0x221f, 0x0001}, {0x220c, 0xdbf0},
+	{0x2209, 0x2576}, {0x2207, 0x287E}, {0x220A, 0x68E5}, {0x221D, 0x3DA4},
+	{0x221C, 0xE7F7}, {0x2214, 0x7F52}, {0x2218, 0x7FCE}, {0x2208, 0x04B7},
+	{0x2206, 0x4072}, {0x2210, 0xF05E}, {0x221B, 0xB414}, {0x221F, 0x0003},
+	{0x221A, 0x06A6}, {0x2210, 0xF05E}, {0x2213, 0x06EB}, {0x2212, 0xF4D2},
+	{0x220E, 0xE120}, {0x2200, 0x7C00}, {0x2202, 0x5FD0}, {0x220D, 0x0207},
+	{0x221f, 0x0002}, {0x2205, 0x0978}, {0x2202, 0x8C01}, {0x2207, 0x3620},
+	{0x221C, 0x0001}, {0x2203, 0x0420}, {0x2204, 0x80C8}, {0x133e, 0x0ede},
+	{0x221f, 0x0002}, {0x220c, 0x0073}, {0x220d, 0xEB65}, {0x220e, 0x51d1},
+	{0x220f, 0x5dcb}, {0x2210, 0x3044}, {0x2211, 0x1800}, {0x2212, 0x7E00},
+	{0x2213, 0x0000}, {0x133f, 0x0010}, {0x133e, 0x0ffe}, {0x207f, 0x0002},
+	{0x2074, 0x3D22}, {0x2075, 0x2000}, {0x2076, 0x6040}, {0x2077, 0x0000},
+	{0x2078, 0x0f0a}, {0x2079, 0x50AB}, {0x207a, 0x0000}, {0x207b, 0x0f0f},
+	{0x205f, 0x0002}, {0x2054, 0xFF00}, {0x2055, 0x000A}, {0x2056, 0x000A},
+	{0x2057, 0x0005}, {0x2058, 0x0005}, {0x2059, 0x0000}, {0x205A, 0x0005},
+	{0x205B, 0x0005}, {0x205C, 0x0005}, {0x209f, 0x0002}, {0x2094, 0x00AA},
+	{0x2095, 0x00AA}, {0x2096, 0x00AA}, {0x2097, 0x00AA}, {0x2098, 0x0055},
+	{0x2099, 0x00AA}, {0x209A, 0x00AA}, {0x209B, 0x00AA}, {0x1363, 0x8354},
+	{0x1270, 0x3333}, {0x1271, 0x3333}, {0x1272, 0x3333}, {0x1330, 0x00DB},
+	{0x1203, 0xff00}, {0x1200, 0x7fc4}, {0x121d, 0x1006}, {0x121e, 0x03e8},
+	{0x121f, 0x02b3}, {0x1220, 0x028f}, {0x1221, 0x029b}, {0x1222, 0x0277},
+	{0x1223, 0x02b3}, {0x1224, 0x028f}, {0x1225, 0x029b}, {0x1226, 0x0277},
+	{0x1227, 0x00c0}, {0x1228, 0x00b4}, {0x122f, 0x00c0}, {0x1230, 0x00b4},
+	{0x1229, 0x0020}, {0x122a, 0x000c}, {0x1231, 0x0030}, {0x1232, 0x0024},
+	{0x0219, 0x0032}, {0x0200, 0x03e8}, {0x0201, 0x03e8}, {0x0202, 0x03e8},
+	{0x0203, 0x03e8}, {0x0204, 0x03e8}, {0x0205, 0x03e8}, {0x0206, 0x03e8},
+	{0x0207, 0x03e8}, {0x0218, 0x0032}, {0x0208, 0x029b}, {0x0209, 0x029b},
+	{0x020a, 0x029b}, {0x020b, 0x029b}, {0x020c, 0x029b}, {0x020d, 0x029b},
+	{0x020e, 0x029b}, {0x020f, 0x029b}, {0x0210, 0x029b}, {0x0211, 0x029b},
+	{0x0212, 0x029b}, {0x0213, 0x029b}, {0x0214, 0x029b}, {0x0215, 0x029b},
+	{0x0216, 0x029b}, {0x0217, 0x029b}, {0x0900, 0x0000}, {0x0901, 0x0000},
+	{0x0902, 0x0000}, {0x0903, 0x0000}, {0x0865, 0x3210}, {0x087b, 0x0000},
+	{0x087c, 0xff00}, {0x087d, 0x0000}, {0x087e, 0x0000}, {0x0801, 0x0100},
+	{0x0802, 0x0100}, {0x1700, 0x014C}, {0x0301, 0x00FF}, {0x12AA, 0x0096},
+	{0x133f, 0x0030}, {0x133e, 0x000e}, {0x221f, 0x0005}, {0x2200, 0x00C4},
+	{0x221f, 0x0000}, {0x2210, 0x05EF}, {0x2204, 0x05E1}, {0x2200, 0x1340},
+	{0x133f, 0x0010}, {0x20A0, 0x1940}, {0x20C0, 0x1940}, {0x20E0, 0x1940},
+};
+
+static const struct rtl8367_initval rtl8367_initvals_0_1[] = {
+	{0x133f, 0x0030}, {0x133e, 0x000e}, {0x221f, 0x0000}, {0x2215, 0x1006},
+	{0x221f, 0x0005}, {0x2200, 0x00c6}, {0x221f, 0x0007}, {0x221e, 0x0048},
+	{0x2215, 0x6412}, {0x2216, 0x6412}, {0x2217, 0x6412}, {0x2218, 0x6412},
+	{0x2219, 0x6412}, {0x221A, 0x6412}, {0x221f, 0x0001}, {0x220c, 0xdbf0},
+	{0x2209, 0x2576}, {0x2207, 0x287E}, {0x220A, 0x68E5}, {0x221D, 0x3DA4},
+	{0x221C, 0xE7F7}, {0x2214, 0x7F52}, {0x2218, 0x7FCE}, {0x2208, 0x04B7},
+	{0x2206, 0x4072}, {0x2210, 0xF05E}, {0x221B, 0xB414}, {0x221F, 0x0003},
+	{0x221A, 0x06A6}, {0x2210, 0xF05E}, {0x2213, 0x06EB}, {0x2212, 0xF4D2},
+	{0x220E, 0xE120}, {0x2200, 0x7C00}, {0x2202, 0x5FD0}, {0x220D, 0x0207},
+	{0x221f, 0x0002}, {0x2205, 0x0978}, {0x2202, 0x8C01}, {0x2207, 0x3620},
+	{0x221C, 0x0001}, {0x2203, 0x0420}, {0x2204, 0x80C8}, {0x133e, 0x0ede},
+	{0x221f, 0x0002}, {0x220c, 0x0073}, {0x220d, 0xEB65}, {0x220e, 0x51d1},
+	{0x220f, 0x5dcb}, {0x2210, 0x3044}, {0x2211, 0x1800}, {0x2212, 0x7E00},
+	{0x2213, 0x0000}, {0x133f, 0x0010}, {0x133e, 0x0ffe}, {0x207f, 0x0002},
+	{0x2074, 0x3D22}, {0x2075, 0x2000}, {0x2076, 0x6040}, {0x2077, 0x0000},
+	{0x2078, 0x0f0a}, {0x2079, 0x50AB}, {0x207a, 0x0000}, {0x207b, 0x0f0f},
+	{0x205f, 0x0002}, {0x2054, 0xFF00}, {0x2055, 0x000A}, {0x2056, 0x000A},
+	{0x2057, 0x0005}, {0x2058, 0x0005}, {0x2059, 0x0000}, {0x205A, 0x0005},
+	{0x205B, 0x0005}, {0x205C, 0x0005}, {0x209f, 0x0002}, {0x2094, 0x00AA},
+	{0x2095, 0x00AA}, {0x2096, 0x00AA}, {0x2097, 0x00AA}, {0x2098, 0x0055},
+	{0x2099, 0x00AA}, {0x209A, 0x00AA}, {0x209B, 0x00AA}, {0x1363, 0x8354},
+	{0x1270, 0x3333}, {0x1271, 0x3333}, {0x1272, 0x3333}, {0x1330, 0x00DB},
+	{0x1203, 0xff00}, {0x1200, 0x7fc4}, {0x121d, 0x1b06}, {0x121e, 0x07f0},
+	{0x121f, 0x0438}, {0x1220, 0x040f}, {0x1221, 0x040f}, {0x1222, 0x03eb},
+	{0x1223, 0x0438}, {0x1224, 0x040f}, {0x1225, 0x040f}, {0x1226, 0x03eb},
+	{0x1227, 0x0144}, {0x1228, 0x0138}, {0x122f, 0x0144}, {0x1230, 0x0138},
+	{0x1229, 0x0020}, {0x122a, 0x000c}, {0x1231, 0x0030}, {0x1232, 0x0024},
+	{0x0219, 0x0032}, {0x0200, 0x07d0}, {0x0201, 0x07d0}, {0x0202, 0x07d0},
+	{0x0203, 0x07d0}, {0x0204, 0x07d0}, {0x0205, 0x07d0}, {0x0206, 0x07d0},
+	{0x0207, 0x07d0}, {0x0218, 0x0032}, {0x0208, 0x0190}, {0x0209, 0x0190},
+	{0x020a, 0x0190}, {0x020b, 0x0190}, {0x020c, 0x0190}, {0x020d, 0x0190},
+	{0x020e, 0x0190}, {0x020f, 0x0190}, {0x0210, 0x0190}, {0x0211, 0x0190},
+	{0x0212, 0x0190}, {0x0213, 0x0190}, {0x0214, 0x0190}, {0x0215, 0x0190},
+	{0x0216, 0x0190}, {0x0217, 0x0190}, {0x0900, 0x0000}, {0x0901, 0x0000},
+	{0x0902, 0x0000}, {0x0903, 0x0000}, {0x0865, 0x3210}, {0x087b, 0x0000},
+	{0x087c, 0xff00}, {0x087d, 0x0000}, {0x087e, 0x0000}, {0x0801, 0x0100},
+	{0x0802, 0x0100}, {0x1700, 0x0125}, {0x0301, 0x00FF}, {0x12AA, 0x0096},
+	{0x133f, 0x0030}, {0x133e, 0x000e}, {0x221f, 0x0005}, {0x2200, 0x00C4},
+	{0x221f, 0x0000}, {0x2210, 0x05EF}, {0x2204, 0x05E1}, {0x2200, 0x1340},
+	{0x133f, 0x0010},
+};
+
+static const struct rtl8367_initval rtl8367_initvals_1_0[] = {
+	{0x1B24, 0x0000}, {0x1B25, 0x0000}, {0x1B26, 0x0000}, {0x1B27, 0x0000},
+	{0x207F, 0x0002}, {0x2079, 0x0200}, {0x207F, 0x0000}, {0x133F, 0x0030},
+	{0x133E, 0x000E}, {0x221F, 0x0005}, {0x2201, 0x0700}, {0x2205, 0x8B82},
+	{0x2206, 0x05CB}, {0x221F, 0x0002}, {0x2204, 0x80C2}, {0x2205, 0x0938},
+	{0x221F, 0x0003}, {0x2212, 0xC4D2}, {0x220D, 0x0207}, {0x221F, 0x0001},
+	{0x2207, 0x267E}, {0x221C, 0xE5F7}, {0x221B, 0x0424}, {0x221F, 0x0007},
+	{0x221E, 0x0040}, {0x2218, 0x0000}, {0x221F, 0x0007}, {0x221E, 0x002C},
+	{0x2218, 0x008B}, {0x221F, 0x0005}, {0x2205, 0xFFF6}, {0x2206, 0x0080},
+	{0x2205, 0x8000}, {0x2206, 0xF8E0}, {0x2206, 0xE000}, {0x2206, 0xE1E0},
+	{0x2206, 0x01AC}, {0x2206, 0x2408}, {0x2206, 0xE08B}, {0x2206, 0x84F7},
+	{0x2206, 0x20E4}, {0x2206, 0x8B84}, {0x2206, 0xFC05}, {0x2206, 0xF8FA},
+	{0x2206, 0xEF69}, {0x2206, 0xE08B}, {0x2206, 0x86AC}, {0x2206, 0x201A},
+	{0x2206, 0xBF80}, {0x2206, 0x59D0}, {0x2206, 0x2402}, {0x2206, 0x803D},
+	{0x2206, 0xE0E0}, {0x2206, 0xE4E1}, {0x2206, 0xE0E5}, {0x2206, 0x5806},
+	{0x2206, 0x68C0}, {0x2206, 0xD1D2}, {0x2206, 0xE4E0}, {0x2206, 0xE4E5},
+	{0x2206, 0xE0E5}, {0x2206, 0xEF96}, {0x2206, 0xFEFC}, {0x2206, 0x05FB},
+	{0x2206, 0x0BFB}, {0x2206, 0x58FF}, {0x2206, 0x9E11}, {0x2206, 0x06F0},
+	{0x2206, 0x0C81}, {0x2206, 0x8AE0}, {0x2206, 0x0019}, {0x2206, 0x1B89},
+	{0x2206, 0xCFEB}, {0x2206, 0x19EB}, {0x2206, 0x19B0}, {0x2206, 0xEFFF},
+	{0x2206, 0x0BFF}, {0x2206, 0x0425}, {0x2206, 0x0807}, {0x2206, 0x2640},
+	{0x2206, 0x7227}, {0x2206, 0x267E}, {0x2206, 0x2804}, {0x2206, 0xB729},
+	{0x2206, 0x2576}, {0x2206, 0x2A68}, {0x2206, 0xE52B}, {0x2206, 0xAD00},
+	{0x2206, 0x2CDB}, {0x2206, 0xF02D}, {0x2206, 0x67BB}, {0x2206, 0x2E7B},
+	{0x2206, 0x0F2F}, {0x2206, 0x7365}, {0x2206, 0x31AC}, {0x2206, 0xCC32},
+	{0x2206, 0x2300}, {0x2206, 0x332D}, {0x2206, 0x1734}, {0x2206, 0x7F52},
+	{0x2206, 0x3510}, {0x2206, 0x0036}, {0x2206, 0x0600}, {0x2206, 0x370C},
+	{0x2206, 0xC038}, {0x2206, 0x7FCE}, {0x2206, 0x3CE5}, {0x2206, 0xF73D},
+	{0x2206, 0x3DA4}, {0x2206, 0x6530}, {0x2206, 0x3E67}, {0x2206, 0x0053},
+	{0x2206, 0x69D2}, {0x2206, 0x0F6A}, {0x2206, 0x012C}, {0x2206, 0x6C2B},
+	{0x2206, 0x136E}, {0x2206, 0xE100}, {0x2206, 0x6F12}, {0x2206, 0xF771},
+	{0x2206, 0x006B}, {0x2206, 0x7306}, {0x2206, 0xEB74}, {0x2206, 0x94C7},
+	{0x2206, 0x7698}, {0x2206, 0x0A77}, {0x2206, 0x5000}, {0x2206, 0x788A},
+	{0x2206, 0x1579}, {0x2206, 0x7F6F}, {0x2206, 0x7A06}, {0x2206, 0xA600},
+	{0x2205, 0x8B90}, {0x2206, 0x8000}, {0x2205, 0x8B92}, {0x2206, 0x8000},
+	{0x2205, 0x8B94}, {0x2206, 0x8014}, {0x2208, 0xFFFA}, {0x2202, 0x3C65},
+	{0x2205, 0xFFF6}, {0x2206, 0x00F7}, {0x221F, 0x0000}, {0x221F, 0x0007},
+	{0x221E, 0x0042}, {0x2218, 0x0000}, {0x221E, 0x002D}, {0x2218, 0xF010},
+	{0x221E, 0x0020}, {0x2215, 0x0000}, {0x221E, 0x0023}, {0x2216, 0x8000},
+	{0x221F, 0x0000}, {0x133F, 0x0010}, {0x133E, 0x0FFE}, {0x1362, 0x0115},
+	{0x1363, 0x0002}, {0x1363, 0x0000}, {0x1306, 0x000C}, {0x1307, 0x000C},
+	{0x1303, 0x0067}, {0x1304, 0x4444}, {0x1203, 0xFF00}, {0x1200, 0x7FC4},
+	{0x121D, 0x7D16}, {0x121E, 0x03E8}, {0x121F, 0x024E}, {0x1220, 0x0230},
+	{0x1221, 0x0244}, {0x1222, 0x0226}, {0x1223, 0x024E}, {0x1224, 0x0230},
+	{0x1225, 0x0244}, {0x1226, 0x0226}, {0x1227, 0x00C0}, {0x1228, 0x00B4},
+	{0x122F, 0x00C0}, {0x1230, 0x00B4}, {0x0208, 0x03E8}, {0x0209, 0x03E8},
+	{0x020A, 0x03E8}, {0x020B, 0x03E8}, {0x020C, 0x03E8}, {0x020D, 0x03E8},
+	{0x020E, 0x03E8}, {0x020F, 0x03E8}, {0x0210, 0x03E8}, {0x0211, 0x03E8},
+	{0x0212, 0x03E8}, {0x0213, 0x03E8}, {0x0214, 0x03E8}, {0x0215, 0x03E8},
+	{0x0216, 0x03E8}, {0x0217, 0x03E8}, {0x0900, 0x0000}, {0x0901, 0x0000},
+	{0x0902, 0x0000}, {0x0903, 0x0000}, {0x0865, 0x3210}, {0x087B, 0x0000},
+	{0x087C, 0xFF00}, {0x087D, 0x0000}, {0x087E, 0x0000}, {0x0801, 0x0100},
+	{0x0802, 0x0100}, {0x0A20, 0x2040}, {0x0A21, 0x2040}, {0x0A22, 0x2040},
+	{0x0A23, 0x2040}, {0x0A24, 0x2040}, {0x0A28, 0x2040}, {0x0A29, 0x2040},
+	{0x133F, 0x0030}, {0x133E, 0x000E}, {0x221F, 0x0000}, {0x2200, 0x1340},
+	{0x221F, 0x0000}, {0x133F, 0x0010}, {0x133E, 0x0FFE}, {0x20A0, 0x1940},
+	{0x20C0, 0x1940}, {0x20E0, 0x1940}, {0x130c, 0x0050},
+};
+
+static const struct rtl8367_initval rtl8367_initvals_1_1[] = {
+	{0x1B24, 0x0000}, {0x1B25, 0x0000}, {0x1B26, 0x0000}, {0x1B27, 0x0000},
+	{0x207F, 0x0002}, {0x2079, 0x0200}, {0x207F, 0x0000}, {0x133F, 0x0030},
+	{0x133E, 0x000E}, {0x221F, 0x0005}, {0x2201, 0x0700}, {0x2205, 0x8B82},
+	{0x2206, 0x05CB}, {0x221F, 0x0002}, {0x2204, 0x80C2}, {0x2205, 0x0938},
+	{0x221F, 0x0003}, {0x2212, 0xC4D2}, {0x220D, 0x0207}, {0x221F, 0x0001},
+	{0x2207, 0x267E}, {0x221C, 0xE5F7}, {0x221B, 0x0424}, {0x221F, 0x0007},
+	{0x221E, 0x0040}, {0x2218, 0x0000}, {0x221F, 0x0007}, {0x221E, 0x002C},
+	{0x2218, 0x008B}, {0x221F, 0x0005}, {0x2205, 0xFFF6}, {0x2206, 0x0080},
+	{0x2205, 0x8000}, {0x2206, 0xF8E0}, {0x2206, 0xE000}, {0x2206, 0xE1E0},
+	{0x2206, 0x01AC}, {0x2206, 0x2408}, {0x2206, 0xE08B}, {0x2206, 0x84F7},
+	{0x2206, 0x20E4}, {0x2206, 0x8B84}, {0x2206, 0xFC05}, {0x2206, 0xF8FA},
+	{0x2206, 0xEF69}, {0x2206, 0xE08B}, {0x2206, 0x86AC}, {0x2206, 0x201A},
+	{0x2206, 0xBF80}, {0x2206, 0x59D0}, {0x2206, 0x2402}, {0x2206, 0x803D},
+	{0x2206, 0xE0E0}, {0x2206, 0xE4E1}, {0x2206, 0xE0E5}, {0x2206, 0x5806},
+	{0x2206, 0x68C0}, {0x2206, 0xD1D2}, {0x2206, 0xE4E0}, {0x2206, 0xE4E5},
+	{0x2206, 0xE0E5}, {0x2206, 0xEF96}, {0x2206, 0xFEFC}, {0x2206, 0x05FB},
+	{0x2206, 0x0BFB}, {0x2206, 0x58FF}, {0x2206, 0x9E11}, {0x2206, 0x06F0},
+	{0x2206, 0x0C81}, {0x2206, 0x8AE0}, {0x2206, 0x0019}, {0x2206, 0x1B89},
+	{0x2206, 0xCFEB}, {0x2206, 0x19EB}, {0x2206, 0x19B0}, {0x2206, 0xEFFF},
+	{0x2206, 0x0BFF}, {0x2206, 0x0425}, {0x2206, 0x0807}, {0x2206, 0x2640},
+	{0x2206, 0x7227}, {0x2206, 0x267E}, {0x2206, 0x2804}, {0x2206, 0xB729},
+	{0x2206, 0x2576}, {0x2206, 0x2A68}, {0x2206, 0xE52B}, {0x2206, 0xAD00},
+	{0x2206, 0x2CDB}, {0x2206, 0xF02D}, {0x2206, 0x67BB}, {0x2206, 0x2E7B},
+	{0x2206, 0x0F2F}, {0x2206, 0x7365}, {0x2206, 0x31AC}, {0x2206, 0xCC32},
+	{0x2206, 0x2300}, {0x2206, 0x332D}, {0x2206, 0x1734}, {0x2206, 0x7F52},
+	{0x2206, 0x3510}, {0x2206, 0x0036}, {0x2206, 0x0600}, {0x2206, 0x370C},
+	{0x2206, 0xC038}, {0x2206, 0x7FCE}, {0x2206, 0x3CE5}, {0x2206, 0xF73D},
+	{0x2206, 0x3DA4}, {0x2206, 0x6530}, {0x2206, 0x3E67}, {0x2206, 0x0053},
+	{0x2206, 0x69D2}, {0x2206, 0x0F6A}, {0x2206, 0x012C}, {0x2206, 0x6C2B},
+	{0x2206, 0x136E}, {0x2206, 0xE100}, {0x2206, 0x6F12}, {0x2206, 0xF771},
+	{0x2206, 0x006B}, {0x2206, 0x7306}, {0x2206, 0xEB74}, {0x2206, 0x94C7},
+	{0x2206, 0x7698}, {0x2206, 0x0A77}, {0x2206, 0x5000}, {0x2206, 0x788A},
+	{0x2206, 0x1579}, {0x2206, 0x7F6F}, {0x2206, 0x7A06}, {0x2206, 0xA600},
+	{0x2205, 0x8B90}, {0x2206, 0x8000}, {0x2205, 0x8B92}, {0x2206, 0x8000},
+	{0x2205, 0x8B94}, {0x2206, 0x8014}, {0x2208, 0xFFFA}, {0x2202, 0x3C65},
+	{0x2205, 0xFFF6}, {0x2206, 0x00F7}, {0x221F, 0x0000}, {0x221F, 0x0007},
+	{0x221E, 0x0042}, {0x2218, 0x0000}, {0x221E, 0x002D}, {0x2218, 0xF010},
+	{0x221E, 0x0020}, {0x2215, 0x0000}, {0x221E, 0x0023}, {0x2216, 0x8000},
+	{0x221F, 0x0000}, {0x133F, 0x0010}, {0x133E, 0x0FFE}, {0x1362, 0x0115},
+	{0x1363, 0x0002}, {0x1363, 0x0000}, {0x1306, 0x000C}, {0x1307, 0x000C},
+	{0x1303, 0x0067}, {0x1304, 0x4444}, {0x1203, 0xFF00}, {0x1200, 0x7FC4},
+	{0x0900, 0x0000}, {0x0901, 0x0000}, {0x0902, 0x0000}, {0x0903, 0x0000},
+	{0x0865, 0x3210}, {0x087B, 0x0000}, {0x087C, 0xFF00}, {0x087D, 0x0000},
+	{0x087E, 0x0000}, {0x0801, 0x0100}, {0x0802, 0x0100}, {0x0A20, 0x2040},
+	{0x0A21, 0x2040}, {0x0A22, 0x2040}, {0x0A23, 0x2040}, {0x0A24, 0x2040},
+	{0x0A25, 0x2040}, {0x0A26, 0x2040}, {0x0A27, 0x2040}, {0x0A28, 0x2040},
+	{0x0A29, 0x2040}, {0x133F, 0x0030}, {0x133E, 0x000E}, {0x221F, 0x0000},
+	{0x2200, 0x1340}, {0x221F, 0x0000}, {0x133F, 0x0010}, {0x133E, 0x0FFE},
+	{0x1B03, 0x0876},
+};
+
+static const struct rtl8367_initval rtl8367_initvals_2_0[] = {
+	{0x1b24, 0x0000}, {0x1b25, 0x0000}, {0x1b26, 0x0000}, {0x1b27, 0x0000},
+	{0x133f, 0x0030}, {0x133e, 0x000e}, {0x221f, 0x0007}, {0x221e, 0x0048},
+	{0x2219, 0x4012}, {0x221f, 0x0003}, {0x2201, 0x3554}, {0x2202, 0x63e8},
+	{0x2203, 0x99c2}, {0x2204, 0x0113}, {0x2205, 0x303e}, {0x220d, 0x0207},
+	{0x220e, 0xe100}, {0x221f, 0x0007}, {0x221e, 0x0040}, {0x2218, 0x0000},
+	{0x221f, 0x0007}, {0x221e, 0x002c}, {0x2218, 0x008b}, {0x221f, 0x0005},
+	{0x2205, 0xfff6}, {0x2206, 0x0080}, {0x221f, 0x0005}, {0x2205, 0x8000},
+	{0x2206, 0x0280}, {0x2206, 0x2bf7}, {0x2206, 0x00e0}, {0x2206, 0xfff7},
+	{0x2206, 0xa080}, {0x2206, 0x02ae}, {0x2206, 0xf602}, {0x2206, 0x804e},
+	{0x2206, 0x0201}, {0x2206, 0x5002}, {0x2206, 0x0163}, {0x2206, 0x0201},
+	{0x2206, 0x79e0}, {0x2206, 0x8b8c}, {0x2206, 0xe18b}, {0x2206, 0x8d1e},
+	{0x2206, 0x01e1}, {0x2206, 0x8b8e}, {0x2206, 0x1e01}, {0x2206, 0xa000},
+	{0x2206, 0xe4ae}, {0x2206, 0xd8bf}, {0x2206, 0x8b88}, {0x2206, 0xec00},
+	{0x2206, 0x19a9}, {0x2206, 0x8b90}, {0x2206, 0xf9ee}, {0x2206, 0xfff6},
+	{0x2206, 0x00ee}, {0x2206, 0xfff7}, {0x2206, 0xfce0}, {0x2206, 0xe140},
+	{0x2206, 0xe1e1}, {0x2206, 0x41f7}, {0x2206, 0x2ff6}, {0x2206, 0x28e4},
+	{0x2206, 0xe140}, {0x2206, 0xe5e1}, {0x2206, 0x4104}, {0x2206, 0xf8fa},
+	{0x2206, 0xef69}, {0x2206, 0xe08b}, {0x2206, 0x86ac}, {0x2206, 0x201a},
+	{0x2206, 0xbf80}, {0x2206, 0x77d0}, {0x2206, 0x6c02}, {0x2206, 0x2978},
+	{0x2206, 0xe0e0}, {0x2206, 0xe4e1}, {0x2206, 0xe0e5}, {0x2206, 0x5806},
+	{0x2206, 0x68c0}, {0x2206, 0xd1d2}, {0x2206, 0xe4e0}, {0x2206, 0xe4e5},
+	{0x2206, 0xe0e5}, {0x2206, 0xef96}, {0x2206, 0xfefc}, {0x2206, 0x0425},
+	{0x2206, 0x0807}, {0x2206, 0x2640}, {0x2206, 0x7227}, {0x2206, 0x267e},
+	{0x2206, 0x2804}, {0x2206, 0xb729}, {0x2206, 0x2576}, {0x2206, 0x2a68},
+	{0x2206, 0xe52b}, {0x2206, 0xad00}, {0x2206, 0x2cdb}, {0x2206, 0xf02d},
+	{0x2206, 0x67bb}, {0x2206, 0x2e7b}, {0x2206, 0x0f2f}, {0x2206, 0x7365},
+	{0x2206, 0x31ac}, {0x2206, 0xcc32}, {0x2206, 0x2300}, {0x2206, 0x332d},
+	{0x2206, 0x1734}, {0x2206, 0x7f52}, {0x2206, 0x3510}, {0x2206, 0x0036},
+	{0x2206, 0x0600}, {0x2206, 0x370c}, {0x2206, 0xc038}, {0x2206, 0x7fce},
+	{0x2206, 0x3ce5}, {0x2206, 0xf73d}, {0x2206, 0x3da4}, {0x2206, 0x6530},
+	{0x2206, 0x3e67}, {0x2206, 0x0053}, {0x2206, 0x69d2}, {0x2206, 0x0f6a},
+	{0x2206, 0x012c}, {0x2206, 0x6c2b}, {0x2206, 0x136e}, {0x2206, 0xe100},
+	{0x2206, 0x6f12}, {0x2206, 0xf771}, {0x2206, 0x006b}, {0x2206, 0x7306},
+	{0x2206, 0xeb74}, {0x2206, 0x94c7}, {0x2206, 0x7698}, {0x2206, 0x0a77},
+	{0x2206, 0x5000}, {0x2206, 0x788a}, {0x2206, 0x1579}, {0x2206, 0x7f6f},
+	{0x2206, 0x7a06}, {0x2206, 0xa600}, {0x2201, 0x0701}, {0x2200, 0x0405},
+	{0x221f, 0x0000}, {0x2200, 0x1340}, {0x221f, 0x0000}, {0x133f, 0x0010},
+	{0x133e, 0x0ffe}, {0x1203, 0xff00}, {0x1200, 0x7fc4}, {0x121d, 0x7D16},
+	{0x121e, 0x03e8}, {0x121f, 0x024e}, {0x1220, 0x0230}, {0x1221, 0x0244},
+	{0x1222, 0x0226}, {0x1223, 0x024e}, {0x1224, 0x0230}, {0x1225, 0x0244},
+	{0x1226, 0x0226}, {0x1227, 0x00c0}, {0x1228, 0x00b4}, {0x122f, 0x00c0},
+	{0x1230, 0x00b4}, {0x0208, 0x03e8}, {0x0209, 0x03e8}, {0x020a, 0x03e8},
+	{0x020b, 0x03e8}, {0x020c, 0x03e8}, {0x020d, 0x03e8}, {0x020e, 0x03e8},
+	{0x020f, 0x03e8}, {0x0210, 0x03e8}, {0x0211, 0x03e8}, {0x0212, 0x03e8},
+	{0x0213, 0x03e8}, {0x0214, 0x03e8}, {0x0215, 0x03e8}, {0x0216, 0x03e8},
+	{0x0217, 0x03e8}, {0x0900, 0x0000}, {0x0901, 0x0000}, {0x0902, 0x0000},
+	{0x0903, 0x0000}, {0x0865, 0x3210}, {0x087b, 0x0000}, {0x087c, 0xff00},
+	{0x087d, 0x0000}, {0x087e, 0x0000}, {0x0801, 0x0100}, {0x0802, 0x0100},
+	{0x0A20, 0x2040}, {0x0A21, 0x2040}, {0x0A22, 0x2040}, {0x0A23, 0x2040},
+	{0x0A24, 0x2040}, {0x0A28, 0x2040}, {0x0A29, 0x2040}, {0x20A0, 0x1940},
+	{0x20C0, 0x1940}, {0x20E0, 0x1940}, {0x130c, 0x0050},
+};
+
+static const struct rtl8367_initval rtl8367_initvals_2_1[] = {
+	{0x1b24, 0x0000}, {0x1b25, 0x0000}, {0x1b26, 0x0000}, {0x1b27, 0x0000},
+	{0x133f, 0x0030}, {0x133e, 0x000e}, {0x221f, 0x0007}, {0x221e, 0x0048},
+	{0x2219, 0x4012}, {0x221f, 0x0003}, {0x2201, 0x3554}, {0x2202, 0x63e8},
+	{0x2203, 0x99c2}, {0x2204, 0x0113}, {0x2205, 0x303e}, {0x220d, 0x0207},
+	{0x220e, 0xe100}, {0x221f, 0x0007}, {0x221e, 0x0040}, {0x2218, 0x0000},
+	{0x221f, 0x0007}, {0x221e, 0x002c}, {0x2218, 0x008b}, {0x221f, 0x0005},
+	{0x2205, 0xfff6}, {0x2206, 0x0080}, {0x221f, 0x0005}, {0x2205, 0x8000},
+	{0x2206, 0x0280}, {0x2206, 0x2bf7}, {0x2206, 0x00e0}, {0x2206, 0xfff7},
+	{0x2206, 0xa080}, {0x2206, 0x02ae}, {0x2206, 0xf602}, {0x2206, 0x804e},
+	{0x2206, 0x0201}, {0x2206, 0x5002}, {0x2206, 0x0163}, {0x2206, 0x0201},
+	{0x2206, 0x79e0}, {0x2206, 0x8b8c}, {0x2206, 0xe18b}, {0x2206, 0x8d1e},
+	{0x2206, 0x01e1}, {0x2206, 0x8b8e}, {0x2206, 0x1e01}, {0x2206, 0xa000},
+	{0x2206, 0xe4ae}, {0x2206, 0xd8bf}, {0x2206, 0x8b88}, {0x2206, 0xec00},
+	{0x2206, 0x19a9}, {0x2206, 0x8b90}, {0x2206, 0xf9ee}, {0x2206, 0xfff6},
+	{0x2206, 0x00ee}, {0x2206, 0xfff7}, {0x2206, 0xfce0}, {0x2206, 0xe140},
+	{0x2206, 0xe1e1}, {0x2206, 0x41f7}, {0x2206, 0x2ff6}, {0x2206, 0x28e4},
+	{0x2206, 0xe140}, {0x2206, 0xe5e1}, {0x2206, 0x4104}, {0x2206, 0xf8fa},
+	{0x2206, 0xef69}, {0x2206, 0xe08b}, {0x2206, 0x86ac}, {0x2206, 0x201a},
+	{0x2206, 0xbf80}, {0x2206, 0x77d0}, {0x2206, 0x6c02}, {0x2206, 0x2978},
+	{0x2206, 0xe0e0}, {0x2206, 0xe4e1}, {0x2206, 0xe0e5}, {0x2206, 0x5806},
+	{0x2206, 0x68c0}, {0x2206, 0xd1d2}, {0x2206, 0xe4e0}, {0x2206, 0xe4e5},
+	{0x2206, 0xe0e5}, {0x2206, 0xef96}, {0x2206, 0xfefc}, {0x2206, 0x0425},
+	{0x2206, 0x0807}, {0x2206, 0x2640}, {0x2206, 0x7227}, {0x2206, 0x267e},
+	{0x2206, 0x2804}, {0x2206, 0xb729}, {0x2206, 0x2576}, {0x2206, 0x2a68},
+	{0x2206, 0xe52b}, {0x2206, 0xad00}, {0x2206, 0x2cdb}, {0x2206, 0xf02d},
+	{0x2206, 0x67bb}, {0x2206, 0x2e7b}, {0x2206, 0x0f2f}, {0x2206, 0x7365},
+	{0x2206, 0x31ac}, {0x2206, 0xcc32}, {0x2206, 0x2300}, {0x2206, 0x332d},
+	{0x2206, 0x1734}, {0x2206, 0x7f52}, {0x2206, 0x3510}, {0x2206, 0x0036},
+	{0x2206, 0x0600}, {0x2206, 0x370c}, {0x2206, 0xc038}, {0x2206, 0x7fce},
+	{0x2206, 0x3ce5}, {0x2206, 0xf73d}, {0x2206, 0x3da4}, {0x2206, 0x6530},
+	{0x2206, 0x3e67}, {0x2206, 0x0053}, {0x2206, 0x69d2}, {0x2206, 0x0f6a},
+	{0x2206, 0x012c}, {0x2206, 0x6c2b}, {0x2206, 0x136e}, {0x2206, 0xe100},
+	{0x2206, 0x6f12}, {0x2206, 0xf771}, {0x2206, 0x006b}, {0x2206, 0x7306},
+	{0x2206, 0xeb74}, {0x2206, 0x94c7}, {0x2206, 0x7698}, {0x2206, 0x0a77},
+	{0x2206, 0x5000}, {0x2206, 0x788a}, {0x2206, 0x1579}, {0x2206, 0x7f6f},
+	{0x2206, 0x7a06}, {0x2206, 0xa600}, {0x2201, 0x0701}, {0x2200, 0x0405},
+	{0x221f, 0x0000}, {0x2200, 0x1340}, {0x221f, 0x0000}, {0x133f, 0x0010},
+	{0x133e, 0x0ffe}, {0x1203, 0xff00}, {0x1200, 0x7fc4}, {0x0900, 0x0000},
+	{0x0901, 0x0000}, {0x0902, 0x0000}, {0x0903, 0x0000}, {0x0865, 0x3210},
+	{0x087b, 0x0000}, {0x087c, 0xff00}, {0x087d, 0x0000}, {0x087e, 0x0000},
+	{0x0801, 0x0100}, {0x0802, 0x0100}, {0x0A20, 0x2040}, {0x0A21, 0x2040},
+	{0x0A22, 0x2040}, {0x0A23, 0x2040}, {0x0A24, 0x2040}, {0x0A25, 0x2040},
+	{0x0A26, 0x2040}, {0x0A27, 0x2040}, {0x0A28, 0x2040}, {0x0A29, 0x2040},
+	{0x130c, 0x0050},
+};
+
+static int rtl8367_write_initvals(struct rtl8366_smi *smi,
+				  const struct rtl8367_initval *initvals,
+				  int count)
+{
+	int err;
+	int i;
+
+	for (i = 0; i < count; i++)
+		REG_WR(smi, initvals[i].reg, initvals[i].val);
+
+	return 0;
+}
+
+static int rtl8367_read_phy_reg(struct rtl8366_smi *smi,
+				u32 phy_addr, u32 phy_reg, u32 *val)
+{
+	int timeout;
+	u32 data;
+	int err;
+
+	if (phy_addr > RTL8367_PHY_ADDR_MAX)
+		return -EINVAL;
+
+	if (phy_reg > RTL8367_PHY_REG_MAX)
+		return -EINVAL;
+
+	REG_RD(smi, RTL8367_IA_STATUS_REG, &data);
+	if (data & RTL8367_IA_STATUS_PHY_BUSY)
+		return -ETIMEDOUT;
+
+	/* prepare address */
+	REG_WR(smi, RTL8367_IA_ADDRESS_REG,
+	       RTL8367_INTERNAL_PHY_REG(phy_addr, phy_reg));
+
+	/* send read command */
+	REG_WR(smi, RTL8367_IA_CTRL_REG,
+	       RTL8367_IA_CTRL_CMD_MASK | RTL8367_IA_CTRL_RW_READ);
+
+	timeout = 5;
+	do {
+		REG_RD(smi, RTL8367_IA_STATUS_REG, &data);
+		if ((data & RTL8367_IA_STATUS_PHY_BUSY) == 0)
+			break;
+
+		if (timeout--) {
+			dev_err(smi->parent, "phy read timed out\n");
+			return -ETIMEDOUT;
+		}
+
+		udelay(1);
+	} while (1);
+
+	/* read data */
+	REG_RD(smi, RTL8367_IA_READ_DATA_REG, val);
+
+	dev_dbg(smi->parent, "phy_read: addr:%02x, reg:%02x, val:%04x\n",
+		phy_addr, phy_reg, *val);
+	return 0;
+}
+
+static int rtl8367_write_phy_reg(struct rtl8366_smi *smi,
+				 u32 phy_addr, u32 phy_reg, u32 val)
+{
+	int timeout;
+	u32 data;
+	int err;
+
+	dev_dbg(smi->parent, "phy_write: addr:%02x, reg:%02x, val:%04x\n",
+		phy_addr, phy_reg, val);
+
+	if (phy_addr > RTL8367_PHY_ADDR_MAX)
+		return -EINVAL;
+
+	if (phy_reg > RTL8367_PHY_REG_MAX)
+		return -EINVAL;
+
+	REG_RD(smi, RTL8367_IA_STATUS_REG, &data);
+	if (data & RTL8367_IA_STATUS_PHY_BUSY)
+		return -ETIMEDOUT;
+
+	/* preapre data */
+	REG_WR(smi, RTL8367_IA_WRITE_DATA_REG, val);
+
+	/* prepare address */
+	REG_WR(smi, RTL8367_IA_ADDRESS_REG,
+	       RTL8367_INTERNAL_PHY_REG(phy_addr, phy_reg));
+
+	/* send write command */
+	REG_WR(smi, RTL8367_IA_CTRL_REG,
+	       RTL8367_IA_CTRL_CMD_MASK | RTL8367_IA_CTRL_RW_WRITE);
+
+	timeout = 5;
+	do {
+		REG_RD(smi, RTL8367_IA_STATUS_REG, &data);
+		if ((data & RTL8367_IA_STATUS_PHY_BUSY) == 0)
+			break;
+
+		if (timeout--) {
+			dev_err(smi->parent, "phy write timed out\n");
+			return -ETIMEDOUT;
+		}
+
+		udelay(1);
+	} while (1);
+
+	return 0;
+}
+
+static int rtl8367_init_regs0(struct rtl8366_smi *smi, unsigned mode)
+{
+	const struct rtl8367_initval *initvals;
+	int count;
+	int err;
+
+	switch (mode) {
+	case 0:
+		initvals = rtl8367_initvals_0_0;
+		count = ARRAY_SIZE(rtl8367_initvals_0_0);
+		break;
+
+	case 1:
+	case 2:
+		initvals = rtl8367_initvals_0_1;
+		count = ARRAY_SIZE(rtl8367_initvals_0_1);
+		break;
+
+	default:
+		dev_err(smi->parent, "%s: unknow mode %u\n", __func__, mode);
+		return -ENODEV;
+	}
+
+	err = rtl8367_write_initvals(smi, initvals, count);
+	if (err)
+		return err;
+
+	/* TODO: complete this */
+
+	return 0;
+}
+
+static int rtl8367_init_regs1(struct rtl8366_smi *smi, unsigned mode)
+{
+	const struct rtl8367_initval *initvals;
+	int count;
+
+	switch (mode) {
+	case 0:
+		initvals = rtl8367_initvals_1_0;
+		count = ARRAY_SIZE(rtl8367_initvals_1_0);
+		break;
+
+	case 1:
+	case 2:
+		initvals = rtl8367_initvals_1_1;
+		count = ARRAY_SIZE(rtl8367_initvals_1_1);
+		break;
+
+	default:
+		dev_err(smi->parent, "%s: unknow mode %u\n", __func__, mode);
+		return -ENODEV;
+	}
+
+	return rtl8367_write_initvals(smi, initvals, count);
+}
+
+static int rtl8367_init_regs2(struct rtl8366_smi *smi, unsigned mode)
+{
+	const struct rtl8367_initval *initvals;
+	int count;
+
+	switch (mode) {
+	case 0:
+		initvals = rtl8367_initvals_2_0;
+		count = ARRAY_SIZE(rtl8367_initvals_2_0);
+		break;
+
+	case 1:
+	case 2:
+		initvals = rtl8367_initvals_2_1;
+		count = ARRAY_SIZE(rtl8367_initvals_2_1);
+		break;
+
+	default:
+		dev_err(smi->parent, "%s: unknow mode %u\n", __func__, mode);
+		return -ENODEV;
+	}
+
+	return rtl8367_write_initvals(smi, initvals, count);
+}
+
+static int rtl8367_init_regs(struct rtl8366_smi *smi)
+{
+	u32 data;
+	u32 rlvid;
+	u32 mode;
+	int err;
+
+	REG_WR(smi, RTL8367_RTL_MAGIC_ID_REG, RTL8367_RTL_MAGIC_ID_VAL);
+
+	REG_RD(smi, RTL8367_CHIP_VER_REG, &data);
+	rlvid = (data >> RTL8367_CHIP_VER_RLVID_SHIFT) &
+		RTL8367_CHIP_VER_RLVID_MASK;
+
+	REG_RD(smi, RTL8367_CHIP_MODE_REG, &data);
+	mode = data & RTL8367_CHIP_MODE_MASK;
+
+	switch (rlvid) {
+	case 0:
+		err = rtl8367_init_regs0(smi, mode);
+		break;
+
+	case 1:
+		err = rtl8367_write_phy_reg(smi, 0, 31, 5);
+		if (err)
+			break;
+
+		err = rtl8367_write_phy_reg(smi, 0, 5, 0x3ffe);
+		if (err)
+			break;
+
+		err = rtl8367_read_phy_reg(smi, 0, 6, &data);
+		if (err)
+			break;
+
+		if (data == 0x94eb) {
+			err = rtl8367_init_regs1(smi, mode);
+		} else if (data == 0x2104) {
+			err = rtl8367_init_regs2(smi, mode);
+		} else {
+			dev_err(smi->parent, "unknow phy data %04x\n", data);
+			return -ENODEV;
+		}
+
+		break;
+
+	default:
+		dev_err(smi->parent, "unknow rlvid %u\n", rlvid);
+		err = -ENODEV;
+		break;
+	}
+
+	return err;
+}
+
+static int rtl8367_reset_chip(struct rtl8366_smi *smi)
+{
+	int timeout = 10;
+	int err;
+	u32 data;
+
+	REG_WR(smi, RTL8367_CHIP_RESET_REG, RTL8367_CHIP_RESET_HW);
+	msleep(RTL8367_RESET_DELAY);
+
+	do {
+		REG_RD(smi, RTL8367_CHIP_RESET_REG, &data);
+		if (!(data & RTL8367_CHIP_RESET_HW))
+			break;
+
+		msleep(1);
+	} while (--timeout);
+
+	if (!timeout) {
+		dev_err(smi->parent, "chip reset timed out\n");
+		return -ETIMEDOUT;
+	}
+
+	return 0;
+}
+
+static int rtl8367_extif_set_mode(struct rtl8366_smi *smi, int id,
+				  enum rtl8367_extif_mode mode)
+{
+	int err;
+
+	/* set port mode */
+	switch (mode) {
+	case RTL8367_EXTIF_MODE_RGMII:
+	case RTL8367_EXTIF_MODE_RGMII_33V:
+		REG_WR(smi, RTL8367_CHIP_DEBUG0_REG, 0x0367);
+		REG_WR(smi, RTL8367_CHIP_DEBUG1_REG, 0x7777);
+		break;
+
+	case RTL8367_EXTIF_MODE_TMII_MAC:
+	case RTL8367_EXTIF_MODE_TMII_PHY:
+		REG_RMW(smi, RTL8367_BYPASS_LINE_RATE_REG,
+			BIT((id + 1) % 2), BIT((id + 1) % 2));
+		break;
+
+	case RTL8367_EXTIF_MODE_GMII:
+		REG_RMW(smi, RTL8367_CHIP_DEBUG0_REG,
+		        RTL8367_CHIP_DEBUG0_DUMMY0(id),
+			RTL8367_CHIP_DEBUG0_DUMMY0(id));
+		REG_RMW(smi, RTL8367_EXT_RGMXF_REG(id), BIT(6), BIT(6));
+		break;
+
+	case RTL8367_EXTIF_MODE_MII_MAC:
+	case RTL8367_EXTIF_MODE_MII_PHY:
+	case RTL8367_EXTIF_MODE_DISABLED:
+		REG_RMW(smi, RTL8367_BYPASS_LINE_RATE_REG,
+			BIT((id + 1) % 2), 0);
+		REG_RMW(smi, RTL8367_EXT_RGMXF_REG(id), BIT(6), 0);
+		break;
+
+	default:
+		dev_err(smi->parent,
+			"invalid mode for external interface %d\n", id);
+		return -EINVAL;
+	}
+
+	REG_RMW(smi, RTL8367_DIS_REG,
+		RTL8367_DIS_RGMII_MASK << RTL8367_DIS_RGMII_SHIFT(id),
+		mode << RTL8367_DIS_RGMII_SHIFT(id));
+
+	return 0;
+}
+
+static int rtl8367_extif_set_force(struct rtl8366_smi *smi, int id,
+				   struct rtl8367_port_ability *pa)
+{
+	u32 mask;
+	u32 val;
+	int err;
+
+	mask = (RTL8367_DI_FORCE_MODE |
+		RTL8367_DI_FORCE_NWAY |
+		RTL8367_DI_FORCE_TXPAUSE |
+		RTL8367_DI_FORCE_RXPAUSE |
+		RTL8367_DI_FORCE_LINK |
+		RTL8367_DI_FORCE_DUPLEX |
+		RTL8367_DI_FORCE_SPEED_MASK);
+
+	val = pa->speed;
+	val |= pa->force_mode ? RTL8367_DI_FORCE_MODE : 0;
+	val |= pa->nway ? RTL8367_DI_FORCE_NWAY : 0;
+	val |= pa->txpause ? RTL8367_DI_FORCE_TXPAUSE : 0;
+	val |= pa->rxpause ? RTL8367_DI_FORCE_RXPAUSE : 0;
+	val |= pa->link ? RTL8367_DI_FORCE_LINK : 0;
+	val |= pa->duplex ? RTL8367_DI_FORCE_DUPLEX : 0;
+
+	REG_RMW(smi, RTL8367_DI_FORCE_REG(id), mask, val);
+
+	return 0;
+}
+
+static int rtl8367_extif_set_rgmii_delay(struct rtl8366_smi *smi, int id,
+					 unsigned txdelay, unsigned rxdelay)
+{
+	u32 mask;
+	u32 val;
+	int err;
+
+	mask = (RTL8367_EXT_RGMXF_RXDELAY_MASK |
+		(RTL8367_EXT_RGMXF_TXDELAY_MASK <<
+			RTL8367_EXT_RGMXF_TXDELAY_SHIFT));
+
+	val = rxdelay;
+	val |= txdelay << RTL8367_EXT_RGMXF_TXDELAY_SHIFT;
+
+	REG_RMW(smi, RTL8367_EXT_RGMXF_REG(id), mask, val);
+
+	return 0;
+}
+
+static int rtl8367_extif_init(struct rtl8366_smi *smi, int id,
+			      struct rtl8367_extif_config *cfg)
+{
+	enum rtl8367_extif_mode mode;
+	int err;
+
+	mode = (cfg) ? cfg->mode : RTL8367_EXTIF_MODE_DISABLED;
+
+	err = rtl8367_extif_set_mode(smi, id, mode);
+	if (err)
+		return err;
+
+	if (mode != RTL8367_EXTIF_MODE_DISABLED) {
+		err = rtl8367_extif_set_force(smi, id, &cfg->ability);
+		if (err)
+			return err;
+
+		err = rtl8367_extif_set_rgmii_delay(smi, id, cfg->txdelay,
+						     cfg->rxdelay);
+		if (err)
+			return err;
+	}
+
+	return 0;
+}
+
+static int rtl8367_led_group_set_ports(struct rtl8366_smi *smi,
+				       unsigned int group, u16 port_mask)
+{
+	u32 reg;
+	u32 s;
+	int err;
+
+	port_mask &= RTL8367_PARA_LED_IO_EN_PMASK;
+	s = (group % 2) * 8;
+	reg = RTL8367_PARA_LED_IO_EN1_REG + (group / 2);
+
+	REG_RMW(smi, reg, (RTL8367_PARA_LED_IO_EN_PMASK << s), port_mask << s);
+
+	return 0;
+}
+
+static int rtl8367_led_group_set_mode(struct rtl8366_smi *smi,
+				      unsigned int mode)
+{
+	u16 mask;
+	u16 set;
+	int err;
+
+	mode &= RTL8367_LED_CONFIG_DATA_M;
+
+	mask = (RTL8367_LED_CONFIG_DATA_M << RTL8367_LED_CONFIG_DATA_S) |
+		RTL8367_LED_CONFIG_SEL;
+	set = (mode << RTL8367_LED_CONFIG_DATA_S) | RTL8367_LED_CONFIG_SEL;
+
+	REG_RMW(smi, RTL8367_LED_CONFIG_REG, mask, set);
+
+	return 0;
+}
+
+static int rtl8367_led_group_set_config(struct rtl8366_smi *smi,
+				        unsigned int led, unsigned int cfg)
+{
+	u16 mask;
+	u16 set;
+	int err;
+
+	mask = (RTL8367_LED_CONFIG_LED_CFG_M << (led * 4)) |
+		RTL8367_LED_CONFIG_SEL;
+	set = (cfg & RTL8367_LED_CONFIG_LED_CFG_M) << (led * 4);
+
+	REG_RMW(smi, RTL8367_LED_CONFIG_REG, mask, set);
+	return 0;
+}
+
+static int rtl8367_led_op_select_parallel(struct rtl8366_smi *smi)
+{
+	int err;
+
+	REG_WR(smi, RTL8367_LED_SYS_CONFIG_REG, 0x1472);
+	return 0;
+}
+
+static int rtl8367_led_blinkrate_set(struct rtl8366_smi *smi, unsigned int rate)
+{
+	u16 mask;
+	u16 set;
+	int err;
+
+	mask = RTL8367_LED_MODE_RATE_M << RTL8367_LED_MODE_RATE_S;
+	set = (rate & RTL8367_LED_MODE_RATE_M) << RTL8367_LED_MODE_RATE_S;
+	REG_RMW(smi, RTL8367_LED_MODE_REG, mask, set);
+
+	return 0;
+}
+
+#ifdef CONFIG_OF
+static int rtl8367_extif_init_of(struct rtl8366_smi *smi,
+				 const char *name)
+{
+	struct rtl8367_extif_config *cfg;
+	const __be32 *prop;
+	int size;
+	int err;
+	unsigned cpu_port;
+	unsigned id = UINT_MAX;
+
+	prop = of_get_property(smi->parent->of_node, name, &size);
+	if (!prop || (size != (10 * sizeof(*prop)))) {
+		dev_err(smi->parent, "%s property is not defined or invalid\n", name);
+		err = -EINVAL;
+		goto err_init;
+	}
+
+	cpu_port = be32_to_cpup(prop++);
+	switch (cpu_port) {
+	case RTL8367_CPU_PORT_NUM - 1:
+	case RTL8367_CPU_PORT_NUM:
+		id = RTL8367_CPU_PORT_NUM - cpu_port;
+		if (smi->cpu_port == UINT_MAX) {
+			dev_info(smi->parent, "cpu_port:%u, assigned to extif%u\n", cpu_port, id);
+			smi->cpu_port = cpu_port;
+		}
+		break;
+	default:
+		dev_err(smi->parent, "wrong cpu_port %u in %s property\n", cpu_port, name);
+		err = -EINVAL;
+		goto err_init;
+	}
+
+	cfg = kzalloc(sizeof(struct rtl8367_extif_config), GFP_KERNEL);
+	if (!cfg)
+		return -ENOMEM;
+
+	cfg->txdelay = be32_to_cpup(prop++);
+	cfg->rxdelay = be32_to_cpup(prop++);
+	cfg->mode = be32_to_cpup(prop++);
+	cfg->ability.force_mode = be32_to_cpup(prop++);
+	cfg->ability.txpause = be32_to_cpup(prop++);
+	cfg->ability.rxpause = be32_to_cpup(prop++);
+	cfg->ability.link = be32_to_cpup(prop++);
+	cfg->ability.duplex = be32_to_cpup(prop++);
+	cfg->ability.speed = be32_to_cpup(prop++);
+
+	err = rtl8367_extif_init(smi, id, cfg);
+	kfree(cfg);
+
+err_init:
+	if (id != 0) rtl8367_extif_init(smi, 0, NULL);
+	if (id != 1) rtl8367_extif_init(smi, 1, NULL);
+
+	return err;
+}
+#else
+static int rtl8367_extif_init_of(struct rtl8366_smi *smi,
+				 const char *name)
+{
+	return -EINVAL;
+}
+#endif
+
+static int rtl8367_setup(struct rtl8366_smi *smi)
+{
+	struct rtl8367_platform_data *pdata;
+	int err;
+	int i;
+
+	pdata = smi->parent->platform_data;
+
+	err = rtl8367_init_regs(smi);
+	if (err)
+		return err;
+
+	/* initialize external interfaces */
+	if (smi->parent->of_node) {
+		err = rtl8367_extif_init_of(smi, "realtek,extif");
+		if (err)
+			return err;
+	} else {
+		err = rtl8367_extif_init(smi, 0, pdata->extif0_cfg);
+		if (err)
+			return err;
+
+		err = rtl8367_extif_init(smi, 1, pdata->extif1_cfg);
+		if (err)
+			return err;
+	}
+
+	/* set maximum packet length to 1536 bytes */
+	REG_RMW(smi, RTL8367_SWC0_REG, RTL8367_SWC0_MAX_LENGTH_MASK,
+		RTL8367_SWC0_MAX_LENGTH_1536);
+
+	/*
+	 * discard VLAN tagged packets if the port is not a member of
+	 * the VLAN with which the packets is associated.
+	 */
+	REG_WR(smi, RTL8367_VLAN_INGRESS_REG, RTL8367_PORTS_ALL);
+
+	/*
+	 * Setup egress tag mode for each port.
+	 */
+	for (i = 0; i < RTL8367_NUM_PORTS; i++)
+		REG_RMW(smi,
+			RTL8367_PORT_CFG_REG(i),
+			RTL8367_PORT_CFG_EGRESS_MODE_MASK <<
+				RTL8367_PORT_CFG_EGRESS_MODE_SHIFT,
+			RTL8367_PORT_CFG_EGRESS_MODE_ORIGINAL <<
+				RTL8367_PORT_CFG_EGRESS_MODE_SHIFT);
+
+	/* setup LEDs */
+	err = rtl8367_led_group_set_ports(smi, 0, RTL8367_PORTS_ALL);
+	if (err)
+		return err;
+
+	err = rtl8367_led_group_set_mode(smi, 0);
+	if (err)
+		return err;
+
+	err = rtl8367_led_op_select_parallel(smi);
+	if (err)
+		return err;
+
+	err = rtl8367_led_blinkrate_set(smi, 1);
+	if (err)
+		return err;
+
+	err = rtl8367_led_group_set_config(smi, 0, 2);
+	if (err)
+		return err;
+
+	return 0;
+}
+
+static int rtl8367_get_mib_counter(struct rtl8366_smi *smi, int counter,
+				   int port, unsigned long long *val)
+{
+	struct rtl8366_mib_counter *mib;
+	int offset;
+	int i;
+	int err;
+	u32 addr, data;
+	u64 mibvalue;
+
+	if (port > RTL8367_NUM_PORTS || counter >= RTL8367_MIB_COUNT)
+		return -EINVAL;
+
+	mib = &rtl8367_mib_counters[counter];
+	addr = RTL8367_MIB_COUNTER_PORT_OFFSET * port + mib->offset;
+
+	/*
+	 * Writing access counter address first
+	 * then ASIC will prepare 64bits counter wait for being retrived
+	 */
+	REG_WR(smi, RTL8367_MIB_ADDRESS_REG, addr >> 2);
+
+	/* read MIB control register */
+	REG_RD(smi, RTL8367_MIB_CTRL_REG(0), &data);
+
+	if (data & RTL8367_MIB_CTRL_BUSY_MASK)
+		return -EBUSY;
+
+	if (data & RTL8367_MIB_CTRL_RESET_MASK)
+		return -EIO;
+
+	if (mib->length == 4)
+		offset = 3;
+	else
+		offset = (mib->offset + 1) % 4;
+
+	mibvalue = 0;
+	for (i = 0; i < mib->length; i++) {
+		REG_RD(smi, RTL8367_MIB_COUNTER_REG(offset - i), &data);
+		mibvalue = (mibvalue << 16) | (data & 0xFFFF);
+	}
+
+	*val = mibvalue;
+	return 0;
+}
+
+static int rtl8367_get_vlan_4k(struct rtl8366_smi *smi, u32 vid,
+				struct rtl8366_vlan_4k *vlan4k)
+{
+	u32 data[RTL8367_TA_VLAN_DATA_SIZE];
+	int err;
+	int i;
+
+	memset(vlan4k, '\0', sizeof(struct rtl8366_vlan_4k));
+
+	if (vid >= RTL8367_NUM_VIDS)
+		return -EINVAL;
+
+	/* write VID */
+	REG_WR(smi, RTL8367_TA_ADDR_REG, vid);
+
+	/* write table access control word */
+	REG_WR(smi, RTL8367_TA_CTRL_REG, RTL8367_TA_CTRL_CVLAN_READ);
+
+	for (i = 0; i < ARRAY_SIZE(data); i++)
+		REG_RD(smi, RTL8367_TA_DATA_REG(i), &data[i]);
+
+	vlan4k->vid = vid;
+	vlan4k->member = (data[0] >> RTL8367_TA_VLAN_MEMBER_SHIFT) &
+			 RTL8367_TA_VLAN_MEMBER_MASK;
+	vlan4k->fid = (data[1] >> RTL8367_TA_VLAN_FID_SHIFT) &
+		      RTL8367_TA_VLAN_FID_MASK;
+	vlan4k->untag = (data[2] >> RTL8367_TA_VLAN_UNTAG1_SHIFT) &
+			RTL8367_TA_VLAN_UNTAG1_MASK;
+	vlan4k->untag |= ((data[3] >> RTL8367_TA_VLAN_UNTAG2_SHIFT) &
+			  RTL8367_TA_VLAN_UNTAG2_MASK) << 2;
+
+	return 0;
+}
+
+static int rtl8367_set_vlan_4k(struct rtl8366_smi *smi,
+				const struct rtl8366_vlan_4k *vlan4k)
+{
+	u32 data[RTL8367_TA_VLAN_DATA_SIZE];
+	int err;
+	int i;
+
+	if (vlan4k->vid >= RTL8367_NUM_VIDS ||
+	    vlan4k->member > RTL8367_TA_VLAN_MEMBER_MASK ||
+	    vlan4k->untag > RTL8367_UNTAG_MASK ||
+	    vlan4k->fid > RTL8367_FIDMAX)
+		return -EINVAL;
+
+	data[0] = (vlan4k->member & RTL8367_TA_VLAN_MEMBER_MASK) <<
+		  RTL8367_TA_VLAN_MEMBER_SHIFT;
+	data[1] = (vlan4k->fid & RTL8367_TA_VLAN_FID_MASK) <<
+		  RTL8367_TA_VLAN_FID_SHIFT;
+	data[2] = (vlan4k->untag & RTL8367_TA_VLAN_UNTAG1_MASK) <<
+		  RTL8367_TA_VLAN_UNTAG1_SHIFT;
+	data[3] = ((vlan4k->untag >> 2) & RTL8367_TA_VLAN_UNTAG2_MASK) <<
+		  RTL8367_TA_VLAN_UNTAG2_SHIFT;
+
+	for (i = 0; i < ARRAY_SIZE(data); i++)
+		REG_WR(smi, RTL8367_TA_DATA_REG(i), data[i]);
+
+	/* write VID */
+	REG_WR(smi, RTL8367_TA_ADDR_REG,
+	       vlan4k->vid & RTL8367_TA_VLAN_VID_MASK);
+
+	/* write table access control word */
+	REG_WR(smi, RTL8367_TA_CTRL_REG, RTL8367_TA_CTRL_CVLAN_WRITE);
+
+	return 0;
+}
+
+static int rtl8367_get_vlan_mc(struct rtl8366_smi *smi, u32 index,
+				struct rtl8366_vlan_mc *vlanmc)
+{
+	u32 data[RTL8367_VLAN_MC_DATA_SIZE];
+	int err;
+	int i;
+
+	memset(vlanmc, '\0', sizeof(struct rtl8366_vlan_mc));
+
+	if (index >= RTL8367_NUM_VLANS)
+		return -EINVAL;
+
+	for (i = 0; i < ARRAY_SIZE(data); i++)
+		REG_RD(smi, RTL8367_VLAN_MC_BASE(index) + i, &data[i]);
+
+	vlanmc->member = (data[0] >> RTL8367_VLAN_MC_MEMBER_SHIFT) &
+			 RTL8367_VLAN_MC_MEMBER_MASK;
+	vlanmc->fid = (data[1] >> RTL8367_VLAN_MC_FID_SHIFT) &
+		      RTL8367_VLAN_MC_FID_MASK;
+	vlanmc->vid = (data[3] >> RTL8367_VLAN_MC_EVID_SHIFT) &
+		      RTL8367_VLAN_MC_EVID_MASK;
+
+	return 0;
+}
+
+static int rtl8367_set_vlan_mc(struct rtl8366_smi *smi, u32 index,
+				const struct rtl8366_vlan_mc *vlanmc)
+{
+	u32 data[RTL8367_VLAN_MC_DATA_SIZE];
+	int err;
+	int i;
+
+	if (index >= RTL8367_NUM_VLANS ||
+	    vlanmc->vid >= RTL8367_NUM_VIDS ||
+	    vlanmc->priority > RTL8367_PRIORITYMAX ||
+	    vlanmc->member > RTL8367_VLAN_MC_MEMBER_MASK ||
+	    vlanmc->untag > RTL8367_UNTAG_MASK ||
+	    vlanmc->fid > RTL8367_FIDMAX)
+		return -EINVAL;
+
+	data[0] = (vlanmc->member & RTL8367_VLAN_MC_MEMBER_MASK) <<
+		  RTL8367_VLAN_MC_MEMBER_SHIFT;
+	data[1] = (vlanmc->fid & RTL8367_VLAN_MC_FID_MASK) <<
+		  RTL8367_VLAN_MC_FID_SHIFT;
+	data[2] = 0;
+	data[3] = (vlanmc->vid & RTL8367_VLAN_MC_EVID_MASK) <<
+		   RTL8367_VLAN_MC_EVID_SHIFT;
+
+	for (i = 0; i < ARRAY_SIZE(data); i++)
+		REG_WR(smi, RTL8367_VLAN_MC_BASE(index) + i, data[i]);
+
+	return 0;
+}
+
+static int rtl8367_get_mc_index(struct rtl8366_smi *smi, int port, int *val)
+{
+	u32 data;
+	int err;
+
+	if (port >= RTL8367_NUM_PORTS)
+		return -EINVAL;
+
+	REG_RD(smi, RTL8367_VLAN_PVID_CTRL_REG(port), &data);
+
+	*val = (data >> RTL8367_VLAN_PVID_CTRL_SHIFT(port)) &
+	       RTL8367_VLAN_PVID_CTRL_MASK;
+
+	return 0;
+}
+
+static int rtl8367_set_mc_index(struct rtl8366_smi *smi, int port, int index)
+{
+	if (port >= RTL8367_NUM_PORTS || index >= RTL8367_NUM_VLANS)
+		return -EINVAL;
+
+	return rtl8366_smi_rmwr(smi, RTL8367_VLAN_PVID_CTRL_REG(port),
+				RTL8367_VLAN_PVID_CTRL_MASK <<
+					RTL8367_VLAN_PVID_CTRL_SHIFT(port),
+				(index & RTL8367_VLAN_PVID_CTRL_MASK) <<
+					RTL8367_VLAN_PVID_CTRL_SHIFT(port));
+}
+
+static int rtl8367_enable_vlan(struct rtl8366_smi *smi, int enable)
+{
+	return rtl8366_smi_rmwr(smi, RTL8367_VLAN_CTRL_REG,
+				RTL8367_VLAN_CTRL_ENABLE,
+				(enable) ? RTL8367_VLAN_CTRL_ENABLE : 0);
+}
+
+static int rtl8367_enable_vlan4k(struct rtl8366_smi *smi, int enable)
+{
+	return 0;
+}
+
+static int rtl8367_is_vlan_valid(struct rtl8366_smi *smi, unsigned vlan)
+{
+	unsigned max = RTL8367_NUM_VLANS;
+
+	if (smi->vlan4k_enabled)
+		max = RTL8367_NUM_VIDS - 1;
+
+	if (vlan == 0 || vlan >= max)
+		return 0;
+
+	return 1;
+}
+
+static int rtl8367_enable_port(struct rtl8366_smi *smi, int port, int enable)
+{
+	int err;
+
+	REG_WR(smi, RTL8367_PORT_ISOLATION_REG(port),
+	       (enable) ? RTL8367_PORTS_ALL : 0);
+
+	return 0;
+}
+
+static int rtl8367_sw_reset_mibs(struct switch_dev *dev,
+				  const struct switch_attr *attr,
+				  struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+
+	return rtl8366_smi_rmwr(smi, RTL8367_MIB_CTRL_REG(0), 0,
+				RTL8367_MIB_CTRL_GLOBAL_RESET_MASK);
+}
+
+static int rtl8367_sw_get_port_link(struct switch_dev *dev,
+				    int port,
+				    struct switch_port_link *link)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data = 0;
+	u32 speed;
+
+	if (port >= RTL8367_NUM_PORTS)
+		return -EINVAL;
+
+	rtl8366_smi_read_reg(smi, RTL8367_PORT_STATUS_REG(port), &data);
+
+	link->link = !!(data & RTL8367_PORT_STATUS_LINK);
+	if (!link->link)
+		return 0;
+
+	link->duplex = !!(data & RTL8367_PORT_STATUS_DUPLEX);
+	link->rx_flow = !!(data & RTL8367_PORT_STATUS_RXPAUSE);
+	link->tx_flow = !!(data & RTL8367_PORT_STATUS_TXPAUSE);
+	link->aneg = !!(data & RTL8367_PORT_STATUS_NWAY);
+
+	speed = (data & RTL8367_PORT_STATUS_SPEED_MASK);
+	switch (speed) {
+	case 0:
+		link->speed = SWITCH_PORT_SPEED_10;
+		break;
+	case 1:
+		link->speed = SWITCH_PORT_SPEED_100;
+		break;
+	case 2:
+		link->speed = SWITCH_PORT_SPEED_1000;
+		break;
+	default:
+		link->speed = SWITCH_PORT_SPEED_UNKNOWN;
+		break;
+	}
+
+	return 0;
+}
+
+static int rtl8367_sw_get_max_length(struct switch_dev *dev,
+				     const struct switch_attr *attr,
+				     struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+
+	rtl8366_smi_read_reg(smi, RTL8367_SWC0_REG, &data);
+	val->value.i = (data & RTL8367_SWC0_MAX_LENGTH_MASK) >>
+			RTL8367_SWC0_MAX_LENGTH_SHIFT;
+
+	return 0;
+}
+
+static int rtl8367_sw_set_max_length(struct switch_dev *dev,
+				     const struct switch_attr *attr,
+				     struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 max_len;
+
+	switch (val->value.i) {
+	case 0:
+		max_len = RTL8367_SWC0_MAX_LENGTH_1522;
+		break;
+	case 1:
+		max_len = RTL8367_SWC0_MAX_LENGTH_1536;
+		break;
+	case 2:
+		max_len = RTL8367_SWC0_MAX_LENGTH_1552;
+		break;
+	case 3:
+		max_len = RTL8367_SWC0_MAX_LENGTH_16000;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	return rtl8366_smi_rmwr(smi, RTL8367_SWC0_REG,
+			        RTL8367_SWC0_MAX_LENGTH_MASK, max_len);
+}
+
+
+static int rtl8367_sw_reset_port_mibs(struct switch_dev *dev,
+				       const struct switch_attr *attr,
+				       struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	int port;
+
+	port = val->port_vlan;
+	if (port >= RTL8367_NUM_PORTS)
+		return -EINVAL;
+
+	return rtl8366_smi_rmwr(smi, RTL8367_MIB_CTRL_REG(port / 8), 0,
+				RTL8367_MIB_CTRL_PORT_RESET_MASK(port % 8));
+}
+
+static int rtl8367_sw_get_port_stats(struct switch_dev *dev, int port,
+                                        struct switch_port_stats *stats)
+{
+	return (rtl8366_sw_get_port_stats(dev, port, stats,
+				RTL8367_MIB_TXB_ID, RTL8367_MIB_RXB_ID));
+}
+
+static struct switch_attr rtl8367_globals[] = {
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_vlan",
+		.description = "Enable VLAN mode",
+		.set = rtl8366_sw_set_vlan_enable,
+		.get = rtl8366_sw_get_vlan_enable,
+		.max = 1,
+		.ofs = 1
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_vlan4k",
+		.description = "Enable VLAN 4K mode",
+		.set = rtl8366_sw_set_vlan_enable,
+		.get = rtl8366_sw_get_vlan_enable,
+		.max = 1,
+		.ofs = 2
+	}, {
+		.type = SWITCH_TYPE_NOVAL,
+		.name = "reset_mibs",
+		.description = "Reset all MIB counters",
+		.set = rtl8367_sw_reset_mibs,
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "max_length",
+		.description = "Get/Set the maximum length of valid packets"
+			       "(0:1522, 1:1536, 2:1552, 3:16000)",
+		.set = rtl8367_sw_set_max_length,
+		.get = rtl8367_sw_get_max_length,
+		.max = 3,
+	}
+};
+
+static struct switch_attr rtl8367_port[] = {
+	{
+		.type = SWITCH_TYPE_NOVAL,
+		.name = "reset_mib",
+		.description = "Reset single port MIB counters",
+		.set = rtl8367_sw_reset_port_mibs,
+	}, {
+		.type = SWITCH_TYPE_STRING,
+		.name = "mib",
+		.description = "Get MIB counters for port",
+		.max = 33,
+		.set = NULL,
+		.get = rtl8366_sw_get_port_mib,
+	},
+};
+
+static struct switch_attr rtl8367_vlan[] = {
+	{
+		.type = SWITCH_TYPE_STRING,
+		.name = "info",
+		.description = "Get vlan information",
+		.max = 1,
+		.set = NULL,
+		.get = rtl8366_sw_get_vlan_info,
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "fid",
+		.description = "Get/Set vlan FID",
+		.max = RTL8367_FIDMAX,
+		.set = rtl8366_sw_set_vlan_fid,
+		.get = rtl8366_sw_get_vlan_fid,
+	},
+};
+
+static const struct switch_dev_ops rtl8367_sw_ops = {
+	.attr_global = {
+		.attr = rtl8367_globals,
+		.n_attr = ARRAY_SIZE(rtl8367_globals),
+	},
+	.attr_port = {
+		.attr = rtl8367_port,
+		.n_attr = ARRAY_SIZE(rtl8367_port),
+	},
+	.attr_vlan = {
+		.attr = rtl8367_vlan,
+		.n_attr = ARRAY_SIZE(rtl8367_vlan),
+	},
+
+	.get_vlan_ports = rtl8366_sw_get_vlan_ports,
+	.set_vlan_ports = rtl8366_sw_set_vlan_ports,
+	.get_port_pvid = rtl8366_sw_get_port_pvid,
+	.set_port_pvid = rtl8366_sw_set_port_pvid,
+	.reset_switch = rtl8366_sw_reset_switch,
+	.get_port_link = rtl8367_sw_get_port_link,
+	.get_port_stats = rtl8367_sw_get_port_stats,
+};
+
+static int rtl8367_switch_init(struct rtl8366_smi *smi)
+{
+	struct switch_dev *dev = &smi->sw_dev;
+	int err;
+
+	dev->name = "RTL8367";
+	dev->cpu_port = smi->cpu_port;
+	dev->ports = RTL8367_NUM_PORTS;
+	dev->vlans = RTL8367_NUM_VIDS;
+	dev->ops = &rtl8367_sw_ops;
+	dev->alias = dev_name(smi->parent);
+
+	err = register_switch(dev, NULL);
+	if (err)
+		dev_err(smi->parent, "switch registration failed\n");
+
+	return err;
+}
+
+static void rtl8367_switch_cleanup(struct rtl8366_smi *smi)
+{
+	unregister_switch(&smi->sw_dev);
+}
+
+static int rtl8367_mii_read(struct mii_bus *bus, int addr, int reg)
+{
+	struct rtl8366_smi *smi = bus->priv;
+	u32 val = 0;
+	int err;
+
+	err = rtl8367_read_phy_reg(smi, addr, reg, &val);
+	if (err)
+		return 0xffff;
+
+	return val;
+}
+
+static int rtl8367_mii_write(struct mii_bus *bus, int addr, int reg, u16 val)
+{
+	struct rtl8366_smi *smi = bus->priv;
+	u32 t;
+	int err;
+
+	err = rtl8367_write_phy_reg(smi, addr, reg, val);
+	if (err)
+		return err;
+
+	/* flush write */
+	(void) rtl8367_read_phy_reg(smi, addr, reg, &t);
+
+	return err;
+}
+
+static int rtl8367_detect(struct rtl8366_smi *smi)
+{
+	u32 rtl_no = 0;
+	u32 rtl_ver = 0;
+	char *chip_name;
+	int ret;
+
+	ret = rtl8366_smi_read_reg(smi, RTL8367_RTL_NO_REG, &rtl_no);
+	if (ret) {
+		dev_err(smi->parent, "unable to read chip number\n");
+		return ret;
+	}
+
+	switch (rtl_no) {
+	case RTL8367_RTL_NO_8367R:
+		chip_name = "8367R";
+		break;
+	case RTL8367_RTL_NO_8367M:
+		chip_name = "8367M";
+		break;
+	default:
+		dev_err(smi->parent, "unknown chip number (%04x)\n", rtl_no);
+		return -ENODEV;
+	}
+
+	ret = rtl8366_smi_read_reg(smi, RTL8367_RTL_VER_REG, &rtl_ver);
+	if (ret) {
+		dev_err(smi->parent, "unable to read chip version\n");
+		return ret;
+	}
+
+	dev_info(smi->parent, "RTL%s ver. %u chip found\n",
+		 chip_name, rtl_ver & RTL8367_RTL_VER_MASK);
+
+	return 0;
+}
+
+static struct rtl8366_smi_ops rtl8367_smi_ops = {
+	.detect		= rtl8367_detect,
+	.reset_chip	= rtl8367_reset_chip,
+	.setup		= rtl8367_setup,
+
+	.mii_read	= rtl8367_mii_read,
+	.mii_write	= rtl8367_mii_write,
+
+	.get_vlan_mc	= rtl8367_get_vlan_mc,
+	.set_vlan_mc	= rtl8367_set_vlan_mc,
+	.get_vlan_4k	= rtl8367_get_vlan_4k,
+	.set_vlan_4k	= rtl8367_set_vlan_4k,
+	.get_mc_index	= rtl8367_get_mc_index,
+	.set_mc_index	= rtl8367_set_mc_index,
+	.get_mib_counter = rtl8367_get_mib_counter,
+	.is_vlan_valid	= rtl8367_is_vlan_valid,
+	.enable_vlan	= rtl8367_enable_vlan,
+	.enable_vlan4k	= rtl8367_enable_vlan4k,
+	.enable_port	= rtl8367_enable_port,
+};
+
+static int rtl8367_probe(struct platform_device *pdev)
+{
+	struct rtl8366_smi *smi;
+	int err;
+
+	smi = rtl8366_smi_probe(pdev);
+	if (IS_ERR(smi))
+		return PTR_ERR(smi);
+
+	smi->clk_delay = 1500;
+	smi->cmd_read = 0xb9;
+	smi->cmd_write = 0xb8;
+	smi->ops = &rtl8367_smi_ops;
+	smi->cpu_port = UINT_MAX; /* not defined yet */
+	smi->num_ports = RTL8367_NUM_PORTS;
+	smi->num_vlan_mc = RTL8367_NUM_VLANS;
+	smi->mib_counters = rtl8367_mib_counters;
+	smi->num_mib_counters = ARRAY_SIZE(rtl8367_mib_counters);
+
+	err = rtl8366_smi_init(smi);
+	if (err)
+		goto err_free_smi;
+
+	platform_set_drvdata(pdev, smi);
+
+	err = rtl8367_switch_init(smi);
+	if (err)
+		goto err_clear_drvdata;
+
+	return 0;
+
+ err_clear_drvdata:
+	platform_set_drvdata(pdev, NULL);
+	rtl8366_smi_cleanup(smi);
+ err_free_smi:
+	kfree(smi);
+	return err;
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6,11,0)
+static int rtl8367_remove(struct platform_device *pdev)
+#else
+static void rtl8367_remove(struct platform_device *pdev)
+#endif
+{
+	struct rtl8366_smi *smi = platform_get_drvdata(pdev);
+
+	if (smi) {
+		rtl8367_switch_cleanup(smi);
+		platform_set_drvdata(pdev, NULL);
+		rtl8366_smi_cleanup(smi);
+		kfree(smi);
+	}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6,11,0)
+	return 0;
+#endif
+}
+
+static void rtl8367_shutdown(struct platform_device *pdev)
+{
+	struct rtl8366_smi *smi = platform_get_drvdata(pdev);
+
+	if (smi)
+		rtl8367_reset_chip(smi);
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id rtl8367_match[] = {
+       { .compatible = "realtek,rtl8367" },
+       {},
+};
+MODULE_DEVICE_TABLE(of, rtl8367_match);
+#endif
+
+static struct platform_driver rtl8367_driver = {
+	.driver = {
+		.name		= RTL8367_DRIVER_NAME,
+#ifdef CONFIG_OF
+		.of_match_table = of_match_ptr(rtl8367_match),
+#endif
+	},
+	.probe		= rtl8367_probe,
+	.remove		= rtl8367_remove,
+	.shutdown	= rtl8367_shutdown,
+};
+
+static int __init rtl8367_module_init(void)
+{
+	return platform_driver_register(&rtl8367_driver);
+}
+module_init(rtl8367_module_init);
+
+static void __exit rtl8367_module_exit(void)
+{
+	platform_driver_unregister(&rtl8367_driver);
+}
+module_exit(rtl8367_module_exit);
+
+MODULE_DESCRIPTION("Realtek RTL8367 ethernet switch driver");
+MODULE_AUTHOR("Gabor Juhos <juhosg@openwrt.org>");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:" RTL8367_DRIVER_NAME);
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/rtl8367b.c b/6.12/target/linux/generic/files/drivers/net/phy/rtl8367b.c
new file mode 100644
index 00000000..6345afb2
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/rtl8367b.c
@@ -0,0 +1,1658 @@
+/*
+ * Platform driver for Realtek RTL8367B family chips, i.e. RTL8367RB and RTL8367R-VB
+ * extended with support for RTL8367C family chips, i.e. RTL8367RB-VB and RTL8367S
+ * extended with support for RTL8367D family chips, i.e. RTL8367S-VB
+ *
+ * Copyright (C) 2012 Gabor Juhos <juhosg@openwrt.org>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/device.h>
+#include <linux/of.h>
+#include <linux/of_platform.h>
+#include <linux/delay.h>
+#include <linux/skbuff.h>
+#include <linux/rtl8367.h>
+#include <linux/version.h>
+
+#include "rtl8366_smi.h"
+
+#define RTL8367B_RESET_DELAY	1000	/* msecs*/
+
+#define RTL8367B_PHY_ADDR_MAX	8
+#define RTL8367B_PHY_REG_MAX	31
+
+#define RTL8367B_VID_MASK	0x3fff
+#define RTL8367B_FID_MASK	0xf
+#define RTL8367B_UNTAG_MASK	0xff
+#define RTL8367B_MEMBER_MASK	0xff
+
+#define RTL8367B_PORT_MISC_CFG_REG(_p)		(0x000e + 0x20 * (_p))
+#define   RTL8367B_PORT_MISC_CFG_EGRESS_MODE_SHIFT	4
+#define   RTL8367B_PORT_MISC_CFG_EGRESS_MODE_MASK	0x3
+#define   RTL8367B_PORT_MISC_CFG_EGRESS_MODE_ORIGINAL	0
+#define   RTL8367B_PORT_MISC_CFG_EGRESS_MODE_KEEP	1
+#define   RTL8367B_PORT_MISC_CFG_EGRESS_MODE_PRI	2
+#define   RTL8367B_PORT_MISC_CFG_EGRESS_MODE_REAL	3
+
+#define RTL8367B_BYPASS_LINE_RATE_REG		0x03f7
+
+#define RTL8367B_TA_CTRL_REG			0x0500 /*GOOD*/
+#define   RTL8367B_TA_CTRL_SPA_SHIFT		8
+#define   RTL8367B_TA_CTRL_SPA_MASK		0x7
+#define   RTL8367B_TA_CTRL_METHOD		BIT(4)/*GOOD*/
+#define   RTL8367B_TA_CTRL_CMD_SHIFT		3
+#define   RTL8367B_TA_CTRL_CMD_READ		0
+#define   RTL8367B_TA_CTRL_CMD_WRITE		1
+#define   RTL8367B_TA_CTRL_TABLE_SHIFT		0 /*GOOD*/
+#define   RTL8367B_TA_CTRL_TABLE_ACLRULE	1
+#define   RTL8367B_TA_CTRL_TABLE_ACLACT		2
+#define   RTL8367B_TA_CTRL_TABLE_CVLAN		3
+#define   RTL8367B_TA_CTRL_TABLE_L2		4
+#define   RTL8367B_TA_CTRL_CVLAN_READ \
+		((RTL8367B_TA_CTRL_CMD_READ << RTL8367B_TA_CTRL_CMD_SHIFT) | \
+		 RTL8367B_TA_CTRL_TABLE_CVLAN)
+#define   RTL8367B_TA_CTRL_CVLAN_WRITE \
+		((RTL8367B_TA_CTRL_CMD_WRITE << RTL8367B_TA_CTRL_CMD_SHIFT) | \
+		 RTL8367B_TA_CTRL_TABLE_CVLAN)
+
+#define RTL8367B_TA_ADDR_REG			0x0501/*GOOD*/
+#define   RTL8367B_TA_ADDR_MASK			0x3fff/*GOOD*/
+
+#define RTL8367B_TA_LUT_REG			0x0502/*GOOD*/
+
+#define RTL8367B_TA_WRDATA_REG(_x)		(0x0510 + (_x))/*GOOD*/
+#define   RTL8367B_TA_VLAN_NUM_WORDS		2
+#define   RTL8367B_TA_VLAN_VID_MASK		RTL8367B_VID_MASK
+#define   RTL8367B_TA_VLAN0_MEMBER_SHIFT	0
+#define   RTL8367B_TA_VLAN0_MEMBER_MASK		RTL8367B_MEMBER_MASK
+#define   RTL8367B_TA_VLAN0_UNTAG_SHIFT		8
+#define   RTL8367B_TA_VLAN0_UNTAG_MASK		RTL8367B_MEMBER_MASK
+#define   RTL8367B_TA_VLAN1_FID_SHIFT		0
+#define   RTL8367B_TA_VLAN1_FID_MASK		RTL8367B_FID_MASK
+
+#define RTL8367B_TA_RDDATA_REG(_x)		(0x0520 + (_x))/*GOOD*/
+
+#define RTL8367B_VLAN_PVID_CTRL_REG(_p)		(0x0700 + (_p) / 2) /*GOOD*/
+#define RTL8367B_VLAN_PVID_CTRL_MASK		0x1f /*GOOD*/
+#define RTL8367B_VLAN_PVID_CTRL_SHIFT(_p)	(8 * ((_p) % 2)) /*GOOD*/
+
+#define RTL8367B_VLAN_MC_BASE(_x)		(0x0728 + (_x) * 4) /*GOOD*/
+#define   RTL8367B_VLAN_MC_NUM_WORDS		4 /*GOOD*/
+#define   RTL8367B_VLAN_MC0_MEMBER_SHIFT	0/*GOOD*/
+#define   RTL8367B_VLAN_MC0_MEMBER_MASK		RTL8367B_MEMBER_MASK/*GOOD*/
+#define   RTL8367B_VLAN_MC1_FID_SHIFT		0/*GOOD*/
+#define   RTL8367B_VLAN_MC1_FID_MASK		RTL8367B_FID_MASK/*GOOD*/
+#define   RTL8367B_VLAN_MC3_EVID_SHIFT		0/*GOOD*/
+#define   RTL8367B_VLAN_MC3_EVID_MASK		RTL8367B_VID_MASK/*GOOD*/
+
+#define RTL8367B_VLAN_CTRL_REG			0x07a8 /*GOOD*/
+#define   RTL8367B_VLAN_CTRL_ENABLE		BIT(0)
+
+#define RTL8367B_VLAN_INGRESS_REG		0x07a9 /*GOOD*/
+
+#define RTL8367B_PORT_ISOLATION_REG(_p)		(0x08a2 + (_p)) /*GOOD*/
+
+#define RTL8367B_MIB_COUNTER_REG(_x)		(0x1000 + (_x))	/*GOOD*/
+#define RTL8367B_MIB_COUNTER_PORT_OFFSET	0x007c /*GOOD*/
+
+#define RTL8367B_MIB_ADDRESS_REG		0x1004 /*GOOD*/
+
+#define RTL8367B_MIB_CTRL0_REG(_x)		(0x1005 + (_x)) /*GOOD*/
+#define   RTL8367B_MIB_CTRL0_GLOBAL_RESET_MASK	BIT(11)	/*GOOD*/
+#define   RTL8367B_MIB_CTRL0_QM_RESET_MASK	BIT(10) /*GOOD*/
+#define   RTL8367B_MIB_CTRL0_PORT_RESET_MASK(_p) BIT(2 + (_p)) /*GOOD*/
+#define   RTL8367B_MIB_CTRL0_RESET_MASK		BIT(1) /*GOOD*/
+#define   RTL8367B_MIB_CTRL0_BUSY_MASK		BIT(0) /*GOOD*/
+
+#define RTL8367B_SWC0_REG			0x1200/*GOOD*/
+#define   RTL8367B_SWC0_MAX_LENGTH_SHIFT	13/*GOOD*/
+#define   RTL8367B_SWC0_MAX_LENGTH(_x)		((_x) << 13) /*GOOD*/
+#define   RTL8367B_SWC0_MAX_LENGTH_MASK		RTL8367B_SWC0_MAX_LENGTH(0x3)
+#define   RTL8367B_SWC0_MAX_LENGTH_1522		RTL8367B_SWC0_MAX_LENGTH(0)
+#define   RTL8367B_SWC0_MAX_LENGTH_1536		RTL8367B_SWC0_MAX_LENGTH(1)
+#define   RTL8367B_SWC0_MAX_LENGTH_1552		RTL8367B_SWC0_MAX_LENGTH(2)
+#define   RTL8367B_SWC0_MAX_LENGTH_16000	RTL8367B_SWC0_MAX_LENGTH(3)
+
+#define RTL8367B_CHIP_NUMBER_REG		0x1300/*GOOD*/
+
+#define RTL8367B_CHIP_VER_REG			0x1301/*GOOD*/
+#define   RTL8367B_CHIP_VER_RLVID_SHIFT		12/*GOOD*/
+#define   RTL8367B_CHIP_VER_RLVID_MASK		0xf/*GOOD*/
+#define   RTL8367B_CHIP_VER_MCID_SHIFT		8/*GOOD*/
+#define   RTL8367B_CHIP_VER_MCID_MASK		0xf/*GOOD*/
+#define   RTL8367B_CHIP_VER_BOID_SHIFT		4/*GOOD*/
+#define   RTL8367B_CHIP_VER_BOID_MASK		0xf/*GOOD*/
+#define   RTL8367B_CHIP_VER_AFE_SHIFT		0/*GOOD*/
+#define   RTL8367B_CHIP_VER_AFE_MASK		0x1/*GOOD*/
+
+#define RTL8367B_CHIP_MODE_REG			0x1302
+#define   RTL8367B_CHIP_MODE_MASK		0x7
+
+#define RTL8367B_CHIP_DEBUG0_REG		0x1303
+#define   RTL8367B_DEBUG0_SEL33(_x)		BIT(8 + (_x))
+#define   RTL8367B_DEBUG0_DRI_OTHER		BIT(7)
+#define   RTL8367B_DEBUG0_DRI_RG(_x)		BIT(5 + (_x))
+#define   RTL8367B_DEBUG0_DRI(_x)		BIT(3 + (_x))
+#define   RTL8367B_DEBUG0_SLR_OTHER		BIT(2)
+#define   RTL8367B_DEBUG0_SLR(_x)		BIT(_x)
+
+#define RTL8367B_CHIP_DEBUG1_REG		0x1304
+#define   RTL8367B_DEBUG1_DN_MASK(_x)		\
+	    GENMASK(6 + (_x)*8, 4 + (_x)*8)
+#define   RTL8367B_DEBUG1_DN_SHIFT(_x)		(4 + (_x) * 8)
+#define   RTL8367B_DEBUG1_DP_MASK(_x)		\
+	    GENMASK(2 + (_x) * 8, (_x) * 8)
+#define   RTL8367B_DEBUG1_DP_SHIFT(_x)		((_x) * 8)
+
+#define RTL8367B_CHIP_DEBUG2_REG		0x13e2
+#define   RTL8367B_DEBUG2_RG2_DN_MASK		GENMASK(8, 6)
+#define   RTL8367B_DEBUG2_RG2_DN_SHIFT		6
+#define   RTL8367B_DEBUG2_RG2_DP_MASK		GENMASK(5, 3)
+#define   RTL8367B_DEBUG2_RG2_DP_SHIFT		3
+#define   RTL8367B_DEBUG2_DRI_EXT2_RG		BIT(2)
+#define   RTL8367B_DEBUG2_DRI_EXT2		BIT(1)
+#define   RTL8367B_DEBUG2_SLR_EXT2		BIT(0)
+
+#define RTL8367B_DIS_REG			0x1305
+#define   RTL8367B_DIS_SKIP_MII_RXER(_x)	BIT(12 + (_x))
+#define   RTL8367B_DIS_RGMII_SHIFT(_x)		(4 * (_x))
+#define   RTL8367B_DIS_RGMII_MASK		0x7
+
+#define RTL8367B_DIS2_REG			0x13c3
+#define   RTL8367B_DIS2_SKIP_MII_RXER_SHIFT	4
+#define   RTL8367B_DIS2_SKIP_MII_RXER		0x10
+#define   RTL8367B_DIS2_RGMII_SHIFT		0
+#define   RTL8367B_DIS2_RGMII_MASK		0xf
+
+#define RTL8367B_EXT_RGMXF_REG(_x)		\
+	  ((_x) == 2 ? 0x13c5 : 0x1306 + (_x))
+#define   RTL8367B_EXT_RGMXF_DUMMY0_SHIFT	5
+#define   RTL8367B_EXT_RGMXF_DUMMY0_MASK	0x7ff
+#define   RTL8367B_EXT_RGMXF_TXDELAY_SHIFT	3
+#define   RTL8367B_EXT_RGMXF_TXDELAY_MASK	1
+#define   RTL8367B_EXT_RGMXF_RXDELAY_MASK	0x7
+
+#define RTL8367B_DI_FORCE_REG(_x)		\
+	  ((_x) == 2 ? 0x13c4 : 0x1310 + (_x))
+#define   RTL8367B_DI_FORCE_MODE		BIT(12)
+#define   RTL8367B_DI_FORCE_NWAY		BIT(7)
+#define   RTL8367B_DI_FORCE_TXPAUSE		BIT(6)
+#define   RTL8367B_DI_FORCE_RXPAUSE		BIT(5)
+#define   RTL8367B_DI_FORCE_LINK		BIT(4)
+#define   RTL8367B_DI_FORCE_DUPLEX		BIT(2)
+#define   RTL8367B_DI_FORCE_SPEED_MASK		3
+#define   RTL8367B_DI_FORCE_SPEED_10		0
+#define   RTL8367B_DI_FORCE_SPEED_100		1
+#define   RTL8367B_DI_FORCE_SPEED_1000		2
+
+#define RTL8367B_MAC_FORCE_REG(_x)		(0x1312 + (_x))
+
+#define RTL8367B_CHIP_RESET_REG			0x1322 /*GOOD*/
+#define   RTL8367B_CHIP_RESET_SW		BIT(1) /*GOOD*/
+#define   RTL8367B_CHIP_RESET_HW		BIT(0) /*GOOD*/
+
+#define RTL8367B_PORT_STATUS_REG(_p)		(0x1352 + (_p)) /*GOOD*/
+#define   RTL8367B_PORT_STATUS_EN_1000_SPI	BIT(11) /*GOOD*/
+#define   RTL8367B_PORT_STATUS_EN_100_SPI	BIT(10)/*GOOD*/
+#define   RTL8367B_PORT_STATUS_NWAY_FAULT	BIT(9)/*GOOD*/
+#define   RTL8367B_PORT_STATUS_LINK_MASTER	BIT(8)/*GOOD*/
+#define   RTL8367B_PORT_STATUS_NWAY		BIT(7)/*GOOD*/
+#define   RTL8367B_PORT_STATUS_TXPAUSE		BIT(6)/*GOOD*/
+#define   RTL8367B_PORT_STATUS_RXPAUSE		BIT(5)/*GOOD*/
+#define   RTL8367B_PORT_STATUS_LINK		BIT(4)/*GOOD*/
+#define   RTL8367B_PORT_STATUS_DUPLEX		BIT(2)/*GOOD*/
+#define   RTL8367B_PORT_STATUS_SPEED_MASK	0x0003/*GOOD*/
+#define   RTL8367B_PORT_STATUS_SPEED_10		0/*GOOD*/
+#define   RTL8367B_PORT_STATUS_SPEED_100	1/*GOOD*/
+#define   RTL8367B_PORT_STATUS_SPEED_1000	2/*GOOD*/
+
+#define RTL8367B_RTL_MAGIC_ID_REG		0x13c2
+#define   RTL8367B_RTL_MAGIC_ID_VAL		0x0249
+
+#define RTL8367B_IA_CTRL_REG			0x1f00
+#define   RTL8367B_IA_CTRL_RW(_x)		((_x) << 1)
+#define   RTL8367B_IA_CTRL_RW_READ		RTL8367B_IA_CTRL_RW(0)
+#define   RTL8367B_IA_CTRL_RW_WRITE		RTL8367B_IA_CTRL_RW(1)
+#define   RTL8367B_IA_CTRL_CMD_MASK		BIT(0)
+
+#define RTL8367B_IA_STATUS_REG			0x1f01
+#define   RTL8367B_IA_STATUS_PHY_BUSY		BIT(2)
+#define   RTL8367B_IA_STATUS_SDS_BUSY		BIT(1)
+#define   RTL8367B_IA_STATUS_MDX_BUSY		BIT(0)
+
+#define RTL8367B_IA_ADDRESS_REG			0x1f02
+#define RTL8367B_IA_WRITE_DATA_REG		0x1f03
+#define RTL8367B_IA_READ_DATA_REG		0x1f04
+
+#define RTL8367B_INTERNAL_PHY_REG(_a, _r)	(0x2000 + 32 * (_a) + (_r))
+
+#define RTL8367B_NUM_MIB_COUNTERS	58
+
+#define RTL8367B_CPU_PORT_NUM		5
+#define RTL8367B_NUM_PORTS		8
+#define RTL8367B_NUM_VLANS		32
+#define RTL8367B_NUM_VIDS		4096
+#define RTL8367B_PRIORITYMAX		7
+#define RTL8367B_FIDMAX			7
+
+#define RTL8367B_PORT_0			BIT(0)
+#define RTL8367B_PORT_1			BIT(1)
+#define RTL8367B_PORT_2			BIT(2)
+#define RTL8367B_PORT_3			BIT(3)
+#define RTL8367B_PORT_4			BIT(4)
+#define RTL8367B_PORT_E0		BIT(5)	/* External port 0 */
+#define RTL8367B_PORT_E1		BIT(6)	/* External port 1 */
+#define RTL8367B_PORT_E2		BIT(7)	/* External port 2 */
+
+#define RTL8367B_PORTS_ALL					\
+	(RTL8367B_PORT_0 | RTL8367B_PORT_1 | RTL8367B_PORT_2 |	\
+	 RTL8367B_PORT_3 | RTL8367B_PORT_4 | RTL8367B_PORT_E0 | \
+	 RTL8367B_PORT_E1 | RTL8367B_PORT_E2)
+
+#define RTL8367B_PORTS_ALL_BUT_CPU				\
+	(RTL8367B_PORT_0 | RTL8367B_PORT_1 | RTL8367B_PORT_2 |	\
+	 RTL8367B_PORT_3 | RTL8367B_PORT_4 | RTL8367B_PORT_E1 |	\
+	 RTL8367B_PORT_E2)
+
+struct rtl8367b_initval {
+	u16 reg;
+	u16 val;
+};
+
+#define RTL8367B_MIB_RXB_ID		0	/* IfInOctets */
+#define RTL8367B_MIB_TXB_ID		28	/* IfOutOctets */
+
+#define RTL8367D_PORT_STATUS_REG(_p)		(0x12d0 + (_p))
+
+#define RTL8367D_PORT_STATUS_SPEED1_MASK	0x3000
+#define RTL8367D_PORT_STATUS_SPEED1_SHIFT	10 /*12-2*/
+
+#define RTL8367D_REG_MAC0_FORCE_SELECT		0x12c0
+#define RTL8367D_REG_MAC0_FORCE_SELECT_EN	0x12c8
+
+#define RTL8367D_VLAN_PVID_CTRL_REG(_p)		(0x0700 + (_p))
+#define RTL8367D_VLAN_PVID_CTRL_MASK		0xfff
+#define RTL8367D_VLAN_PVID_CTRL_SHIFT(_p)	0
+
+#define RTL8367D_FIDMAX			3
+#define RTL8367D_FID_MASK		3
+#define RTL8367D_TA_VLAN1_FID_SHIFT	0
+#define RTL8367D_TA_VLAN1_FID_MASK	RTL8367D_FID_MASK
+
+#define RTL8367D_VID_MASK		0xfff
+#define RTL8367D_TA_VLAN_VID_MASK	RTL8367D_VID_MASK
+
+#define RTL8367D_REG_EXT_TXC_DLY		0x13f9
+#define RTL8367D_EXT1_RGMII_TX_DLY_MASK		0x38
+
+#define RTL8367D_REG_TOP_CON0			0x1d70
+#define   RTL8367D_MAC7_SEL_EXT1_MASK		0x2000
+#define   RTL8367D_MAC4_SEL_EXT1_MASK		0x1000
+
+#define RTL8367D_REG_SDS1_MISC0			0x1d78
+#define   RTL8367D_SDS1_MODE_MASK		0x1f
+#define   RTL8367D_PORT_SDS_MODE_DISABLE		0x1f
+
+static struct rtl8366_mib_counter
+rtl8367b_mib_counters[RTL8367B_NUM_MIB_COUNTERS] = {
+	{0,   0, 4, "ifInOctets"			},
+	{0,   4, 2, "dot3StatsFCSErrors"		},
+	{0,   6, 2, "dot3StatsSymbolErrors"		},
+	{0,   8, 2, "dot3InPauseFrames"			},
+	{0,  10, 2, "dot3ControlInUnknownOpcodes"	},
+	{0,  12, 2, "etherStatsFragments"		},
+	{0,  14, 2, "etherStatsJabbers"			},
+	{0,  16, 2, "ifInUcastPkts"			},
+	{0,  18, 2, "etherStatsDropEvents"		},
+	{0,  20, 2, "ifInMulticastPkts"			},
+	{0,  22, 2, "ifInBroadcastPkts"			},
+	{0,  24, 2, "inMldChecksumError"		},
+	{0,  26, 2, "inIgmpChecksumError"		},
+	{0,  28, 2, "inMldSpecificQuery"		},
+	{0,  30, 2, "inMldGeneralQuery"			},
+	{0,  32, 2, "inIgmpSpecificQuery"		},
+	{0,  34, 2, "inIgmpGeneralQuery"		},
+	{0,  36, 2, "inMldLeaves"			},
+	{0,  38, 2, "inIgmpLeaves"			},
+
+	{0,  40, 4, "etherStatsOctets"			},
+	{0,  44, 2, "etherStatsUnderSizePkts"		},
+	{0,  46, 2, "etherOversizeStats"		},
+	{0,  48, 2, "etherStatsPkts64Octets"		},
+	{0,  50, 2, "etherStatsPkts65to127Octets"	},
+	{0,  52, 2, "etherStatsPkts128to255Octets"	},
+	{0,  54, 2, "etherStatsPkts256to511Octets"	},
+	{0,  56, 2, "etherStatsPkts512to1023Octets"	},
+	{0,  58, 2, "etherStatsPkts1024to1518Octets"	},
+
+	{0,  60, 4, "ifOutOctets"			},
+	{0,  64, 2, "dot3StatsSingleCollisionFrames"	},
+	{0,  66, 2, "dot3StatMultipleCollisionFrames"	},
+	{0,  68, 2, "dot3sDeferredTransmissions"	},
+	{0,  70, 2, "dot3StatsLateCollisions"		},
+	{0,  72, 2, "etherStatsCollisions"		},
+	{0,  74, 2, "dot3StatsExcessiveCollisions"	},
+	{0,  76, 2, "dot3OutPauseFrames"		},
+	{0,  78, 2, "ifOutDiscards"			},
+	{0,  80, 2, "dot1dTpPortInDiscards"		},
+	{0,  82, 2, "ifOutUcastPkts"			},
+	{0,  84, 2, "ifOutMulticastPkts"		},
+	{0,  86, 2, "ifOutBroadcastPkts"		},
+	{0,  88, 2, "outOampduPkts"			},
+	{0,  90, 2, "inOampduPkts"			},
+	{0,  92, 2, "inIgmpJoinsSuccess"		},
+	{0,  94, 2, "inIgmpJoinsFail"			},
+	{0,  96, 2, "inMldJoinsSuccess"			},
+	{0,  98, 2, "inMldJoinsFail"			},
+	{0, 100, 2, "inReportSuppressionDrop"		},
+	{0, 102, 2, "inLeaveSuppressionDrop"		},
+	{0, 104, 2, "outIgmpReports"			},
+	{0, 106, 2, "outIgmpLeaves"			},
+	{0, 108, 2, "outIgmpGeneralQuery"		},
+	{0, 110, 2, "outIgmpSpecificQuery"		},
+	{0, 112, 2, "outMldReports"			},
+	{0, 114, 2, "outMldLeaves"			},
+	{0, 116, 2, "outMldGeneralQuery"		},
+	{0, 118, 2, "outMldSpecificQuery"		},
+	{0, 120, 2, "inKnownMulticastPkts"		},
+};
+
+#define REG_RD(_smi, _reg, _val)					\
+	do {								\
+		err = rtl8366_smi_read_reg(_smi, _reg, _val);		\
+		if (err)						\
+			return err;					\
+	} while (0)
+
+#define REG_WR(_smi, _reg, _val)					\
+	do {								\
+		err = rtl8366_smi_write_reg(_smi, _reg, _val);		\
+		if (err)						\
+			return err;					\
+	} while (0)
+
+#define REG_RMW(_smi, _reg, _mask, _val)				\
+	do {								\
+		err = rtl8366_smi_rmwr(_smi, _reg, _mask, _val);	\
+		if (err)						\
+			return err;					\
+	} while (0)
+
+static const struct rtl8367b_initval rtl8367b_initvals[] = {
+	{0x1B03, 0x0876}, {0x1200, 0x7FC4}, {0x1305, 0xC000}, {0x121E, 0x03CA},
+	{0x1233, 0x0352}, {0x1234, 0x0064}, {0x1237, 0x0096}, {0x1238, 0x0078},
+	{0x1239, 0x0084}, {0x123A, 0x0030}, {0x205F, 0x0002}, {0x2059, 0x1A00},
+	{0x205F, 0x0000}, {0x207F, 0x0002}, {0x2077, 0x0000}, {0x2078, 0x0000},
+	{0x2079, 0x0000}, {0x207A, 0x0000}, {0x207B, 0x0000}, {0x207F, 0x0000},
+	{0x205F, 0x0002}, {0x2053, 0x0000}, {0x2054, 0x0000}, {0x2055, 0x0000},
+	{0x2056, 0x0000}, {0x2057, 0x0000}, {0x205F, 0x0000}, {0x133F, 0x0030},
+	{0x133E, 0x000E}, {0x221F, 0x0005}, {0x2205, 0x8B86}, {0x2206, 0x800E},
+	{0x221F, 0x0000}, {0x133F, 0x0010}, {0x12A3, 0x2200}, {0x6107, 0xE58B},
+	{0x6103, 0xA970}, {0x0018, 0x0F00}, {0x0038, 0x0F00}, {0x0058, 0x0F00},
+	{0x0078, 0x0F00}, {0x0098, 0x0F00}, {0x133F, 0x0030}, {0x133E, 0x000E},
+	{0x221F, 0x0005}, {0x2205, 0x8B6E}, {0x2206, 0x0000}, {0x220F, 0x0100},
+	{0x2205, 0xFFF6}, {0x2206, 0x0080}, {0x2205, 0x8000}, {0x2206, 0x0280},
+	{0x2206, 0x2BF7}, {0x2206, 0x00E0}, {0x2206, 0xFFF7}, {0x2206, 0xA080},
+	{0x2206, 0x02AE}, {0x2206, 0xF602}, {0x2206, 0x0153}, {0x2206, 0x0201},
+	{0x2206, 0x6602}, {0x2206, 0x8044}, {0x2206, 0x0201}, {0x2206, 0x7CE0},
+	{0x2206, 0x8B8C}, {0x2206, 0xE18B}, {0x2206, 0x8D1E}, {0x2206, 0x01E1},
+	{0x2206, 0x8B8E}, {0x2206, 0x1E01}, {0x2206, 0xA000}, {0x2206, 0xE4AE},
+	{0x2206, 0xD8EE}, {0x2206, 0x85C0}, {0x2206, 0x00EE}, {0x2206, 0x85C1},
+	{0x2206, 0x00EE}, {0x2206, 0x8AFC}, {0x2206, 0x07EE}, {0x2206, 0x8AFD},
+	{0x2206, 0x73EE}, {0x2206, 0xFFF6}, {0x2206, 0x00EE}, {0x2206, 0xFFF7},
+	{0x2206, 0xFC04}, {0x2206, 0xF8E0}, {0x2206, 0x8B8E}, {0x2206, 0xAD20},
+	{0x2206, 0x0302}, {0x2206, 0x8050}, {0x2206, 0xFC04}, {0x2206, 0xF8F9},
+	{0x2206, 0xE08B}, {0x2206, 0x85AD}, {0x2206, 0x2548}, {0x2206, 0xE08A},
+	{0x2206, 0xE4E1}, {0x2206, 0x8AE5}, {0x2206, 0x7C00}, {0x2206, 0x009E},
+	{0x2206, 0x35EE}, {0x2206, 0x8AE4}, {0x2206, 0x00EE}, {0x2206, 0x8AE5},
+	{0x2206, 0x00E0}, {0x2206, 0x8AFC}, {0x2206, 0xE18A}, {0x2206, 0xFDE2},
+	{0x2206, 0x85C0}, {0x2206, 0xE385}, {0x2206, 0xC102}, {0x2206, 0x2DAC},
+	{0x2206, 0xAD20}, {0x2206, 0x12EE}, {0x2206, 0x8AE4}, {0x2206, 0x03EE},
+	{0x2206, 0x8AE5}, {0x2206, 0xB7EE}, {0x2206, 0x85C0}, {0x2206, 0x00EE},
+	{0x2206, 0x85C1}, {0x2206, 0x00AE}, {0x2206, 0x1115}, {0x2206, 0xE685},
+	{0x2206, 0xC0E7}, {0x2206, 0x85C1}, {0x2206, 0xAE08}, {0x2206, 0xEE85},
+	{0x2206, 0xC000}, {0x2206, 0xEE85}, {0x2206, 0xC100}, {0x2206, 0xFDFC},
+	{0x2206, 0x0400}, {0x2205, 0xE142}, {0x2206, 0x0701}, {0x2205, 0xE140},
+	{0x2206, 0x0405}, {0x220F, 0x0000}, {0x221F, 0x0000}, {0x133E, 0x000E},
+	{0x133F, 0x0010}, {0x13EB, 0x11BB}, {0x207F, 0x0002}, {0x2073, 0x1D22},
+	{0x207F, 0x0000}, {0x133F, 0x0030}, {0x133E, 0x000E}, {0x2200, 0x1340},
+	{0x133E, 0x000E}, {0x133F, 0x0010},
+};
+
+static const struct rtl8367b_initval rtl8367c_initvals[] = {
+	{0x13c2, 0x0000}, {0x0018, 0x0f00}, {0x0038, 0x0f00}, {0x0058, 0x0f00},
+	{0x0078, 0x0f00}, {0x0098, 0x0f00}, {0x1d15, 0x0a69}, {0x2000, 0x1340},
+	{0x2020, 0x1340}, {0x2040, 0x1340}, {0x2060, 0x1340}, {0x2080, 0x1340},
+	{0x13eb, 0x15bb}, {0x1303, 0x06d6}, {0x1304, 0x0700}, {0x13E2, 0x003F},
+	{0x13F9, 0x0090}, {0x121e, 0x03CA}, {0x1233, 0x0352}, {0x1237, 0x00a0},
+	{0x123a, 0x0030}, {0x1239, 0x0084}, {0x0301, 0x1000}, {0x1349, 0x001F},
+	{0x18e0, 0x4004}, {0x122b, 0x641c}, {0x1305, 0xc000}, {0x1200, 0x7fcb},
+	{0x0884, 0x0003}, {0x06eb, 0x0001}, {0x00cf, 0xffff}, {0x00d0, 0x0007},
+	{0x00ce, 0x48b0}, {0x00ce, 0x48b0}, {0x0398, 0xffff}, {0x0399, 0x0007},
+	{0x0300, 0x0001}, {0x03fa, 0x0007}, {0x08c8, 0x00c0}, {0x0a30, 0x020e},
+	{0x0800, 0x0000}, {0x0802, 0x0000}, {0x09da, 0x0017}, {0x1d32, 0x0002},
+};
+
+static int rtl8367b_write_initvals(struct rtl8366_smi *smi,
+				  const struct rtl8367b_initval *initvals,
+				  int count)
+{
+	int err;
+	int i;
+
+	for (i = 0; i < count; i++)
+		REG_WR(smi, initvals[i].reg, initvals[i].val);
+
+	return 0;
+}
+
+static int rtl8367b_read_phy_reg(struct rtl8366_smi *smi,
+				u32 phy_addr, u32 phy_reg, u32 *val)
+{
+	int timeout;
+	u32 data;
+	int err;
+
+	if (phy_addr > RTL8367B_PHY_ADDR_MAX)
+		return -EINVAL;
+
+	if (phy_reg > RTL8367B_PHY_REG_MAX)
+		return -EINVAL;
+
+	REG_RD(smi, RTL8367B_IA_STATUS_REG, &data);
+	if (data & RTL8367B_IA_STATUS_PHY_BUSY)
+		return -ETIMEDOUT;
+
+	/* prepare address */
+	REG_WR(smi, RTL8367B_IA_ADDRESS_REG,
+	       RTL8367B_INTERNAL_PHY_REG(phy_addr, phy_reg));
+
+	/* send read command */
+	REG_WR(smi, RTL8367B_IA_CTRL_REG,
+	       RTL8367B_IA_CTRL_CMD_MASK | RTL8367B_IA_CTRL_RW_READ);
+
+	timeout = 5;
+	do {
+		REG_RD(smi, RTL8367B_IA_STATUS_REG, &data);
+		if ((data & RTL8367B_IA_STATUS_PHY_BUSY) == 0)
+			break;
+
+		if (timeout--) {
+			dev_err(smi->parent, "phy read timed out\n");
+			return -ETIMEDOUT;
+		}
+
+		udelay(1);
+	} while (1);
+
+	/* read data */
+	REG_RD(smi, RTL8367B_IA_READ_DATA_REG, val);
+
+	dev_dbg(smi->parent, "phy_read: addr:%02x, reg:%02x, val:%04x\n",
+		phy_addr, phy_reg, *val);
+	return 0;
+}
+
+static int rtl8367b_write_phy_reg(struct rtl8366_smi *smi,
+				 u32 phy_addr, u32 phy_reg, u32 val)
+{
+	int timeout;
+	u32 data;
+	int err;
+
+	dev_dbg(smi->parent, "phy_write: addr:%02x, reg:%02x, val:%04x\n",
+		phy_addr, phy_reg, val);
+
+	if (phy_addr > RTL8367B_PHY_ADDR_MAX)
+		return -EINVAL;
+
+	if (phy_reg > RTL8367B_PHY_REG_MAX)
+		return -EINVAL;
+
+	REG_RD(smi, RTL8367B_IA_STATUS_REG, &data);
+	if (data & RTL8367B_IA_STATUS_PHY_BUSY)
+		return -ETIMEDOUT;
+
+	/* preapre data */
+	REG_WR(smi, RTL8367B_IA_WRITE_DATA_REG, val);
+
+	/* prepare address */
+	REG_WR(smi, RTL8367B_IA_ADDRESS_REG,
+	       RTL8367B_INTERNAL_PHY_REG(phy_addr, phy_reg));
+
+	/* send write command */
+	REG_WR(smi, RTL8367B_IA_CTRL_REG,
+	       RTL8367B_IA_CTRL_CMD_MASK | RTL8367B_IA_CTRL_RW_WRITE);
+
+	timeout = 5;
+	do {
+		REG_RD(smi, RTL8367B_IA_STATUS_REG, &data);
+		if ((data & RTL8367B_IA_STATUS_PHY_BUSY) == 0)
+			break;
+
+		if (timeout--) {
+			dev_err(smi->parent, "phy write timed out\n");
+			return -ETIMEDOUT;
+		}
+
+		udelay(1);
+	} while (1);
+
+	return 0;
+}
+
+static int rtl8367b_init_regs(struct rtl8366_smi *smi)
+{
+	const struct rtl8367b_initval *initvals;
+	int count;
+
+	switch (smi->rtl8367b_chip) {
+	case RTL8367B_CHIP_RTL8367RB:
+	case RTL8367B_CHIP_RTL8367R_VB:
+		initvals = rtl8367b_initvals;
+		count = ARRAY_SIZE(rtl8367b_initvals);
+		break;
+	case RTL8367B_CHIP_RTL8367RB_VB:
+	case RTL8367B_CHIP_RTL8367S:
+	case RTL8367B_CHIP_RTL8367S_VB:
+		initvals = rtl8367c_initvals;
+		count = ARRAY_SIZE(rtl8367c_initvals);
+		if ((smi->rtl8367b_chip == RTL8367B_CHIP_RTL8367S_VB) && (smi->emu_vlanmc == NULL)) {
+			smi->emu_vlanmc = kzalloc(sizeof(struct rtl8366_vlan_mc) * smi->num_vlan_mc, GFP_KERNEL);
+			dev_info(smi->parent, "alloc vlan mc emulator");
+		}
+		break;
+	default:
+		return -ENODEV;
+	}
+
+	return rtl8367b_write_initvals(smi, initvals, count);
+}
+
+static int rtl8367b_reset_chip(struct rtl8366_smi *smi)
+{
+	int timeout = 10;
+	int err;
+	u32 data;
+
+	REG_WR(smi, RTL8367B_CHIP_RESET_REG, RTL8367B_CHIP_RESET_HW);
+	msleep(RTL8367B_RESET_DELAY);
+
+	do {
+		REG_RD(smi, RTL8367B_CHIP_RESET_REG, &data);
+		if (!(data & RTL8367B_CHIP_RESET_HW))
+			break;
+
+		msleep(1);
+	} while (--timeout);
+
+	if (!timeout) {
+		dev_err(smi->parent, "chip reset timed out\n");
+		return -ETIMEDOUT;
+	}
+
+	return 0;
+}
+
+static int rtl8367b_extif_set_mode(struct rtl8366_smi *smi, int id,
+				   enum rtl8367_extif_mode mode)
+{
+	int err;
+	u32 data;
+
+	/* set port mode */
+	switch (mode) {
+	case RTL8367_EXTIF_MODE_RGMII:
+		REG_RMW(smi, RTL8367B_CHIP_DEBUG0_REG,
+			RTL8367B_DEBUG0_SEL33(id),
+			RTL8367B_DEBUG0_SEL33(id));
+		if (id <= 1) {
+			REG_RMW(smi, RTL8367B_CHIP_DEBUG0_REG,
+				RTL8367B_DEBUG0_DRI(id) |
+					RTL8367B_DEBUG0_DRI_RG(id) |
+					RTL8367B_DEBUG0_SLR(id),
+				RTL8367B_DEBUG0_DRI_RG(id) |
+					RTL8367B_DEBUG0_SLR(id));
+			REG_RMW(smi, RTL8367B_CHIP_DEBUG1_REG,
+				RTL8367B_DEBUG1_DN_MASK(id) |
+					RTL8367B_DEBUG1_DP_MASK(id),
+				(7 << RTL8367B_DEBUG1_DN_SHIFT(id)) |
+					(7 << RTL8367B_DEBUG1_DP_SHIFT(id)));
+			if ((smi->rtl8367b_chip == RTL8367B_CHIP_RTL8367S_VB) && (id == 1)) {
+				REG_RMW(smi, RTL8367D_REG_EXT_TXC_DLY, RTL8367D_EXT1_RGMII_TX_DLY_MASK, 0);
+				/* Configure RGMII/MII mux to port 7 if UTP_PORT4 is not RGMII mode */
+				REG_RD(smi, RTL8367D_REG_TOP_CON0, &data);
+				data &= RTL8367D_MAC4_SEL_EXT1_MASK;
+				if (data == 0)
+					REG_RMW(smi, RTL8367D_REG_TOP_CON0, RTL8367D_MAC7_SEL_EXT1_MASK, RTL8367D_MAC7_SEL_EXT1_MASK);
+				REG_RMW(smi, RTL8367D_REG_SDS1_MISC0, RTL8367D_SDS1_MODE_MASK, RTL8367D_PORT_SDS_MODE_DISABLE);
+			}
+		} else {
+			REG_RMW(smi, RTL8367B_CHIP_DEBUG2_REG,
+				RTL8367B_DEBUG2_DRI_EXT2 |
+					RTL8367B_DEBUG2_DRI_EXT2_RG |
+					RTL8367B_DEBUG2_SLR_EXT2 |
+					RTL8367B_DEBUG2_RG2_DN_MASK |
+					RTL8367B_DEBUG2_RG2_DP_MASK,
+				RTL8367B_DEBUG2_DRI_EXT2_RG |
+					RTL8367B_DEBUG2_SLR_EXT2 |
+					(7 << RTL8367B_DEBUG2_RG2_DN_SHIFT) |
+					(7 << RTL8367B_DEBUG2_RG2_DP_SHIFT));
+		}
+		break;
+
+	case RTL8367_EXTIF_MODE_TMII_MAC:
+	case RTL8367_EXTIF_MODE_TMII_PHY:
+		REG_RMW(smi, RTL8367B_BYPASS_LINE_RATE_REG, BIT(id), BIT(id));
+		break;
+
+	case RTL8367_EXTIF_MODE_GMII:
+		REG_RMW(smi, RTL8367B_CHIP_DEBUG0_REG,
+			RTL8367B_DEBUG0_SEL33(id),
+			RTL8367B_DEBUG0_SEL33(id));
+		REG_RMW(smi, RTL8367B_EXT_RGMXF_REG(id), BIT(6), BIT(6));
+		break;
+
+	case RTL8367_EXTIF_MODE_MII_MAC:
+	case RTL8367_EXTIF_MODE_MII_PHY:
+	case RTL8367_EXTIF_MODE_DISABLED:
+		REG_RMW(smi, RTL8367B_BYPASS_LINE_RATE_REG, BIT(id), 0);
+		REG_RMW(smi, RTL8367B_EXT_RGMXF_REG(id), BIT(6), 0);
+		break;
+
+	default:
+		dev_err(smi->parent,
+			"invalid mode for external interface %d\n", id);
+		return -EINVAL;
+	}
+
+	if (id <= 1)
+		REG_RMW(smi, RTL8367B_DIS_REG,
+			RTL8367B_DIS_RGMII_MASK << RTL8367B_DIS_RGMII_SHIFT(id),
+			mode << RTL8367B_DIS_RGMII_SHIFT(id));
+	else
+		REG_RMW(smi, RTL8367B_DIS2_REG,
+			RTL8367B_DIS2_RGMII_MASK << RTL8367B_DIS2_RGMII_SHIFT,
+			mode << RTL8367B_DIS2_RGMII_SHIFT);
+
+	return 0;
+}
+
+static int rtl8367b_extif_set_force(struct rtl8366_smi *smi, int id,
+				    struct rtl8367_port_ability *pa)
+{
+	u32 mask;
+	u32 val;
+	int err;
+
+	val = pa->speed & RTL8367B_DI_FORCE_SPEED_MASK;
+	val |= pa->nway ? RTL8367B_DI_FORCE_NWAY : 0;
+	val |= pa->txpause ? RTL8367B_DI_FORCE_TXPAUSE : 0;
+	val |= pa->rxpause ? RTL8367B_DI_FORCE_RXPAUSE : 0;
+	val |= pa->link ? RTL8367B_DI_FORCE_LINK : 0;
+	val |= pa->duplex ? RTL8367B_DI_FORCE_DUPLEX : 0;
+
+	if (smi->rtl8367b_chip >= RTL8367B_CHIP_RTL8367S_VB) { /* Family D */
+		val |= (pa->speed << RTL8367D_PORT_STATUS_SPEED1_SHIFT) & RTL8367D_PORT_STATUS_SPEED1_MASK;
+		if (smi->cpu_port != UINT_MAX) {
+			REG_WR(smi, RTL8367D_REG_MAC0_FORCE_SELECT + smi->cpu_port, val);
+			REG_WR(smi, RTL8367D_REG_MAC0_FORCE_SELECT_EN + smi->cpu_port, pa->force_mode ? 0xffff : 0x0000);
+		}
+	} else {
+		val |= pa->force_mode ? RTL8367B_DI_FORCE_MODE : 0;
+		mask = (RTL8367B_DI_FORCE_MODE |
+			RTL8367B_DI_FORCE_NWAY |
+			RTL8367B_DI_FORCE_TXPAUSE |
+			RTL8367B_DI_FORCE_RXPAUSE |
+			RTL8367B_DI_FORCE_LINK |
+			RTL8367B_DI_FORCE_DUPLEX |
+			RTL8367B_DI_FORCE_SPEED_MASK);
+
+		REG_RMW(smi, RTL8367B_DI_FORCE_REG(id), mask, val);
+	}
+
+	return 0;
+}
+
+static int rtl8367b_extif_set_rgmii_delay(struct rtl8366_smi *smi, int id,
+					 unsigned txdelay, unsigned rxdelay)
+{
+	u32 mask;
+	u32 val;
+	int err;
+
+	mask = (RTL8367B_EXT_RGMXF_RXDELAY_MASK |
+		(RTL8367B_EXT_RGMXF_TXDELAY_MASK <<
+			RTL8367B_EXT_RGMXF_TXDELAY_SHIFT));
+
+	val = rxdelay;
+	val |= txdelay << RTL8367B_EXT_RGMXF_TXDELAY_SHIFT;
+
+	REG_RMW(smi, RTL8367B_EXT_RGMXF_REG(id), mask, val);
+
+	return 0;
+}
+
+static int rtl8367b_extif_init(struct rtl8366_smi *smi, int id,
+			       struct rtl8367_extif_config *cfg)
+{
+	enum rtl8367_extif_mode mode;
+	int err;
+
+	mode = (cfg) ? cfg->mode : RTL8367_EXTIF_MODE_DISABLED;
+
+	err = rtl8367b_extif_set_mode(smi, id, mode);
+	if (err)
+		return err;
+
+	if (mode != RTL8367_EXTIF_MODE_DISABLED) {
+		err = rtl8367b_extif_set_force(smi, id, &cfg->ability);
+		if (err)
+			return err;
+
+		err = rtl8367b_extif_set_rgmii_delay(smi, id, cfg->txdelay,
+						     cfg->rxdelay);
+		if (err)
+			return err;
+	}
+
+	return 0;
+}
+
+#ifdef CONFIG_OF
+static int rtl8367b_extif_init_of(struct rtl8366_smi *smi,
+				  const char *name)
+{
+	struct rtl8367_extif_config *cfg;
+	const __be32 *prop;
+	int size;
+	int err;
+	unsigned cpu_port;
+	unsigned id = UINT_MAX;
+
+	prop = of_get_property(smi->parent->of_node, name, &size);
+	if (!prop || (size != (10 * sizeof(*prop)))) {
+		dev_err(smi->parent, "%s property is not defined or invalid\n", name);
+		err = -EINVAL;
+		goto err_init;
+	}
+
+	cpu_port = be32_to_cpup(prop++);
+	switch (cpu_port) {
+	case RTL8367B_CPU_PORT_NUM:
+	case RTL8367B_CPU_PORT_NUM + 1:
+	case RTL8367B_CPU_PORT_NUM + 2:
+		if (smi->rtl8367b_chip == RTL8367B_CHIP_RTL8367R_VB) { /* for the RTL8367R-VB chip, cpu_port 5 corresponds to extif1 */
+			if (cpu_port == RTL8367B_CPU_PORT_NUM)
+				id = 1;
+			else {
+				dev_err(smi->parent, "wrong cpu_port %u in %s property\n", cpu_port, name);
+				err = -EINVAL;
+				goto err_init;
+			}
+		} else if (smi->rtl8367b_chip == RTL8367B_CHIP_RTL8367S_VB) { /* for the RTL8367S-VB chip, cpu_port 7 corresponds to extif1, cpu_port 6 corresponds to extif0 */
+			if (cpu_port != RTL8367B_CPU_PORT_NUM) {
+				id = cpu_port - RTL8367B_CPU_PORT_NUM - 1;
+			} else {
+				dev_err(smi->parent, "wrong cpu_port %u in %s property\n", cpu_port, name);
+				err = -EINVAL;
+				goto err_init;
+			}
+		} else {
+			id = cpu_port - RTL8367B_CPU_PORT_NUM;
+		}
+		if (smi->cpu_port == UINT_MAX) {
+			dev_info(smi->parent, "cpu_port:%u, assigned to extif%u\n", cpu_port, id);
+			smi->cpu_port = cpu_port;
+		}
+		break;
+	default:
+		dev_err(smi->parent, "wrong cpu_port %u in %s property\n", cpu_port, name);
+		err = -EINVAL;
+		goto err_init;
+	}
+
+	cfg = kzalloc(sizeof(struct rtl8367_extif_config), GFP_KERNEL);
+	if (!cfg)
+		return -ENOMEM;
+
+	cfg->txdelay = be32_to_cpup(prop++);
+	cfg->rxdelay = be32_to_cpup(prop++);
+	cfg->mode = be32_to_cpup(prop++);
+	cfg->ability.force_mode = be32_to_cpup(prop++);
+	cfg->ability.txpause = be32_to_cpup(prop++);
+	cfg->ability.rxpause = be32_to_cpup(prop++);
+	cfg->ability.link = be32_to_cpup(prop++);
+	cfg->ability.duplex = be32_to_cpup(prop++);
+	cfg->ability.speed = be32_to_cpup(prop++);
+
+	err = rtl8367b_extif_init(smi, id, cfg);
+	kfree(cfg);
+
+err_init:
+	if (id != 0) rtl8367b_extif_init(smi, 0, NULL);
+	if (id != 1) rtl8367b_extif_init(smi, 1, NULL);
+	if (id != 2) rtl8367b_extif_init(smi, 2, NULL);
+
+	return err;
+}
+#else
+static int rtl8367b_extif_init_of(struct rtl8366_smi *smi,
+				  const char *name)
+{
+	return -EINVAL;
+}
+#endif
+
+static int rtl8367b_setup(struct rtl8366_smi *smi)
+{
+	struct rtl8367_platform_data *pdata;
+	int err;
+	int i;
+
+	pdata = smi->parent->platform_data;
+
+	err = rtl8367b_init_regs(smi);
+	if (err)
+		return err;
+
+	/* initialize external interfaces */
+	if (smi->parent->of_node) {
+		err = rtl8367b_extif_init_of(smi, "realtek,extif");
+		if (err)
+			return err;
+	} else {
+		err = rtl8367b_extif_init(smi, 0, pdata->extif0_cfg);
+		if (err)
+			return err;
+
+		err = rtl8367b_extif_init(smi, 1, pdata->extif1_cfg);
+		if (err)
+			return err;
+	}
+
+	/* set maximum packet length to 1536 bytes */
+	REG_RMW(smi, RTL8367B_SWC0_REG, RTL8367B_SWC0_MAX_LENGTH_MASK,
+		RTL8367B_SWC0_MAX_LENGTH_1536);
+
+	/*
+	 * discard VLAN tagged packets if the port is not a member of
+	 * the VLAN with which the packets is associated.
+	 */
+	REG_WR(smi, RTL8367B_VLAN_INGRESS_REG, RTL8367B_PORTS_ALL);
+
+	/*
+	 * Setup egress tag mode for each port.
+	 */
+	for (i = 0; i < RTL8367B_NUM_PORTS; i++)
+		REG_RMW(smi,
+			RTL8367B_PORT_MISC_CFG_REG(i),
+			RTL8367B_PORT_MISC_CFG_EGRESS_MODE_MASK <<
+				RTL8367B_PORT_MISC_CFG_EGRESS_MODE_SHIFT,
+			RTL8367B_PORT_MISC_CFG_EGRESS_MODE_ORIGINAL <<
+				RTL8367B_PORT_MISC_CFG_EGRESS_MODE_SHIFT);
+
+	return 0;
+}
+
+static int rtl8367b_get_mib_counter(struct rtl8366_smi *smi, int counter,
+				    int port, unsigned long long *val)
+{
+	struct rtl8366_mib_counter *mib;
+	int offset;
+	int i;
+	int err;
+	u32 addr, data;
+	u64 mibvalue;
+
+	if (port > RTL8367B_NUM_PORTS ||
+	    counter >= RTL8367B_NUM_MIB_COUNTERS)
+		return -EINVAL;
+
+	mib = &rtl8367b_mib_counters[counter];
+	addr = RTL8367B_MIB_COUNTER_PORT_OFFSET * port + mib->offset;
+
+	/*
+	 * Writing access counter address first
+	 * then ASIC will prepare 64bits counter wait for being retrived
+	 */
+	REG_WR(smi, RTL8367B_MIB_ADDRESS_REG, addr >> 2);
+
+	/* read MIB control register */
+	REG_RD(smi, RTL8367B_MIB_CTRL0_REG(0), &data);
+
+	if (data & RTL8367B_MIB_CTRL0_BUSY_MASK)
+		return -EBUSY;
+
+	if (data & RTL8367B_MIB_CTRL0_RESET_MASK)
+		return -EIO;
+
+	if (mib->length == 4)
+		offset = 3;
+	else
+		offset = (mib->offset + 1) % 4;
+
+	mibvalue = 0;
+	for (i = 0; i < mib->length; i++) {
+		REG_RD(smi, RTL8367B_MIB_COUNTER_REG(offset - i), &data);
+		mibvalue = (mibvalue << 16) | (data & 0xFFFF);
+	}
+
+	*val = mibvalue;
+	return 0;
+}
+
+static int rtl8367b_get_vlan_4k(struct rtl8366_smi *smi, u32 vid,
+				struct rtl8366_vlan_4k *vlan4k)
+{
+	u32 data[RTL8367B_TA_VLAN_NUM_WORDS];
+	int err;
+	int i;
+
+	memset(vlan4k, '\0', sizeof(struct rtl8366_vlan_4k));
+
+	if (vid >= RTL8367B_NUM_VIDS)
+		return -EINVAL;
+
+	/* write VID */
+	REG_WR(smi, RTL8367B_TA_ADDR_REG, vid);
+
+	/* write table access control word */
+	REG_WR(smi, RTL8367B_TA_CTRL_REG, RTL8367B_TA_CTRL_CVLAN_READ);
+
+	for (i = 0; i < ARRAY_SIZE(data); i++)
+		REG_RD(smi, RTL8367B_TA_RDDATA_REG(i), &data[i]);
+
+	vlan4k->vid = vid;
+	vlan4k->member = (data[0] >> RTL8367B_TA_VLAN0_MEMBER_SHIFT) &
+			 RTL8367B_TA_VLAN0_MEMBER_MASK;
+	vlan4k->untag = (data[0] >> RTL8367B_TA_VLAN0_UNTAG_SHIFT) &
+			RTL8367B_TA_VLAN0_UNTAG_MASK;
+	if (smi->rtl8367b_chip >= RTL8367B_CHIP_RTL8367S_VB) /* Family D */
+		vlan4k->fid = (data[1] >> RTL8367D_TA_VLAN1_FID_SHIFT) &
+				RTL8367D_TA_VLAN1_FID_MASK;
+	else
+		vlan4k->fid = (data[1] >> RTL8367B_TA_VLAN1_FID_SHIFT) &
+				RTL8367B_TA_VLAN1_FID_MASK;
+
+	return 0;
+}
+
+static int rtl8367b_set_vlan_4k(struct rtl8366_smi *smi,
+				const struct rtl8366_vlan_4k *vlan4k)
+{
+	u32 data[RTL8367B_TA_VLAN_NUM_WORDS];
+	int err;
+	int i;
+
+	if (vlan4k->vid >= RTL8367B_NUM_VIDS ||
+	    vlan4k->member > RTL8367B_TA_VLAN0_MEMBER_MASK ||
+	    vlan4k->untag > RTL8367B_UNTAG_MASK ||
+	    vlan4k->fid > ((smi->rtl8367b_chip >= RTL8367B_CHIP_RTL8367S_VB) ? RTL8367D_FIDMAX : RTL8367B_FIDMAX))
+		return -EINVAL;
+
+	memset(data, 0, sizeof(data));
+
+	data[0] = (vlan4k->member & RTL8367B_TA_VLAN0_MEMBER_MASK) <<
+		  RTL8367B_TA_VLAN0_MEMBER_SHIFT;
+	data[0] |= (vlan4k->untag & RTL8367B_TA_VLAN0_UNTAG_MASK) <<
+		   RTL8367B_TA_VLAN0_UNTAG_SHIFT;
+
+	if (smi->rtl8367b_chip >= RTL8367B_CHIP_RTL8367S_VB) /* Family D */
+		data[1] = ((vlan4k->fid & RTL8367D_TA_VLAN1_FID_MASK) <<
+			   RTL8367D_TA_VLAN1_FID_SHIFT) | 12; /* ivl_svl - BIT(3), svlan_chek_ivl_svl - BIT(2) */
+	else
+		data[1] = (vlan4k->fid & RTL8367B_TA_VLAN1_FID_MASK) <<
+			   RTL8367B_TA_VLAN1_FID_SHIFT;
+
+	for (i = 0; i < ARRAY_SIZE(data); i++)
+		REG_WR(smi, RTL8367B_TA_WRDATA_REG(i), data[i]);
+
+	/* write VID */
+	if (smi->rtl8367b_chip >= RTL8367B_CHIP_RTL8367S_VB) /* Family D */
+		REG_WR(smi, RTL8367B_TA_ADDR_REG,
+		       vlan4k->vid & RTL8367D_TA_VLAN_VID_MASK);
+	else
+		REG_WR(smi, RTL8367B_TA_ADDR_REG,
+		       vlan4k->vid & RTL8367B_TA_VLAN_VID_MASK);
+
+	/* write table access control word */
+	REG_WR(smi, RTL8367B_TA_CTRL_REG, RTL8367B_TA_CTRL_CVLAN_WRITE);
+
+	return 0;
+}
+
+static int rtl8367b_get_vlan_mc(struct rtl8366_smi *smi, u32 index,
+				struct rtl8366_vlan_mc *vlanmc)
+{
+	u32 data[RTL8367B_VLAN_MC_NUM_WORDS];
+	int err;
+	int i;
+
+	memset(vlanmc, '\0', sizeof(struct rtl8366_vlan_mc));
+
+	if (index >= RTL8367B_NUM_VLANS)
+		return -EINVAL;
+
+	if (smi->emu_vlanmc) { /* use vlan mc emulation */
+		vlanmc->vid = smi->emu_vlanmc[index].vid;
+		vlanmc->member = smi->emu_vlanmc[index].member;
+		vlanmc->fid = smi->emu_vlanmc[index].fid;
+		vlanmc->untag = smi->emu_vlanmc[index].untag;
+		return 0;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(data); i++)
+		REG_RD(smi, RTL8367B_VLAN_MC_BASE(index) + i, &data[i]);
+
+	vlanmc->member = (data[0] >> RTL8367B_VLAN_MC0_MEMBER_SHIFT) &
+			 RTL8367B_VLAN_MC0_MEMBER_MASK;
+	vlanmc->fid = (data[1] >> RTL8367B_VLAN_MC1_FID_SHIFT) &
+		      RTL8367B_VLAN_MC1_FID_MASK;
+	vlanmc->vid = (data[3] >> RTL8367B_VLAN_MC3_EVID_SHIFT) &
+		      RTL8367B_VLAN_MC3_EVID_MASK;
+
+	return 0;
+}
+
+static int rtl8367b_set_vlan_mc(struct rtl8366_smi *smi, u32 index,
+				const struct rtl8366_vlan_mc *vlanmc)
+{
+	u32 data[RTL8367B_VLAN_MC_NUM_WORDS];
+	int err;
+	int i;
+
+	if (index >= RTL8367B_NUM_VLANS ||
+	    vlanmc->vid >= RTL8367B_NUM_VIDS ||
+	    vlanmc->priority > RTL8367B_PRIORITYMAX ||
+	    vlanmc->member > RTL8367B_VLAN_MC0_MEMBER_MASK ||
+	    vlanmc->untag > RTL8367B_UNTAG_MASK ||
+	    vlanmc->fid > ((smi->rtl8367b_chip >= RTL8367B_CHIP_RTL8367S_VB) ? RTL8367D_FIDMAX : RTL8367B_FIDMAX))
+		return -EINVAL;
+
+	if (smi->emu_vlanmc) { /* use vlanmc emulation */
+		smi->emu_vlanmc[index].vid = vlanmc->vid;
+		smi->emu_vlanmc[index].member = vlanmc->member;
+		smi->emu_vlanmc[index].fid = vlanmc->fid;
+		smi->emu_vlanmc[index].untag = vlanmc->untag;
+		return 0;
+	}
+
+	data[0] = (vlanmc->member & RTL8367B_VLAN_MC0_MEMBER_MASK) <<
+		  RTL8367B_VLAN_MC0_MEMBER_SHIFT;
+	data[1] = (vlanmc->fid & RTL8367B_VLAN_MC1_FID_MASK) <<
+		  RTL8367B_VLAN_MC1_FID_SHIFT;
+	data[2] = 0;
+	data[3] = (vlanmc->vid & RTL8367B_VLAN_MC3_EVID_MASK) <<
+		   RTL8367B_VLAN_MC3_EVID_SHIFT;
+
+	for (i = 0; i < ARRAY_SIZE(data); i++)
+		REG_WR(smi, RTL8367B_VLAN_MC_BASE(index) + i, data[i]);
+
+	return 0;
+}
+
+static int rtl8367b_get_mc_index(struct rtl8366_smi *smi, int port, int *val)
+{
+	u32 data;
+	int err;
+
+	if (port >= RTL8367B_NUM_PORTS)
+		return -EINVAL;
+
+	if (smi->rtl8367b_chip >= RTL8367B_CHIP_RTL8367S_VB) { /* Family D */
+		int i;
+		struct rtl8366_vlan_mc vlanmc;
+
+		err = rtl8366_smi_read_reg(smi, RTL8367D_VLAN_PVID_CTRL_REG(port), &data);
+
+		if (err) {
+			dev_err(smi->parent, "read pvid register 0x%04x fail", RTL8367D_VLAN_PVID_CTRL_REG(port));
+			return err;
+		}
+
+		data &= RTL8367D_VLAN_PVID_CTRL_MASK;
+		for (i = 0; i < smi->num_vlan_mc; i++) {
+			err = rtl8367b_get_vlan_mc(smi, i, &vlanmc);
+
+			if (err) {
+				dev_err(smi->parent, "get vlan mc index %d fail", i);
+				return err;
+			}
+
+			if (data == vlanmc.vid) break;
+		}
+
+		if (i < smi->num_vlan_mc) {
+			*val = i;
+		} else {
+			dev_err(smi->parent, "vlan mc index for pvid %d not found", data);
+			return -EINVAL;
+		}
+	} else {
+		REG_RD(smi, RTL8367B_VLAN_PVID_CTRL_REG(port), &data);
+
+		*val = (data >> RTL8367B_VLAN_PVID_CTRL_SHIFT(port)) &
+			RTL8367B_VLAN_PVID_CTRL_MASK;
+	}
+
+	return 0;
+}
+
+static int rtl8367b_set_mc_index(struct rtl8366_smi *smi, int port, int index)
+{
+	if (port >= RTL8367B_NUM_PORTS || index >= RTL8367B_NUM_VLANS)
+		return -EINVAL;
+
+	if (smi->rtl8367b_chip >= RTL8367B_CHIP_RTL8367S_VB) { /* Family D */
+		int pvid, err;
+		struct rtl8366_vlan_mc vlanmc;
+
+		err = rtl8367b_get_vlan_mc(smi, index, &vlanmc);
+
+		if (err) {
+			dev_err(smi->parent, "get vlan mc index %d fail", index);
+			return err;
+		}
+
+		pvid = vlanmc.vid & RTL8367D_VLAN_PVID_CTRL_MASK;
+		err = rtl8366_smi_write_reg(smi, RTL8367D_VLAN_PVID_CTRL_REG(port), pvid);
+
+		if (err) {
+			dev_err(smi->parent, "set port %d pvid %d fail", port, pvid);
+			return err;
+		}
+
+		return 0;
+	} else
+		return rtl8366_smi_rmwr(smi, RTL8367B_VLAN_PVID_CTRL_REG(port),
+				RTL8367B_VLAN_PVID_CTRL_MASK <<
+					RTL8367B_VLAN_PVID_CTRL_SHIFT(port),
+				(index & RTL8367B_VLAN_PVID_CTRL_MASK) <<
+					RTL8367B_VLAN_PVID_CTRL_SHIFT(port));
+}
+
+static int rtl8367b_enable_vlan(struct rtl8366_smi *smi, int enable)
+{
+	return rtl8366_smi_rmwr(smi, RTL8367B_VLAN_CTRL_REG,
+				RTL8367B_VLAN_CTRL_ENABLE,
+				(enable) ? RTL8367B_VLAN_CTRL_ENABLE : 0);
+}
+
+static int rtl8367b_enable_vlan4k(struct rtl8366_smi *smi, int enable)
+{
+	return 0;
+}
+
+static int rtl8367b_is_vlan_valid(struct rtl8366_smi *smi, unsigned vlan)
+{
+	unsigned max = RTL8367B_NUM_VLANS;
+
+	if (smi->vlan4k_enabled)
+		max = RTL8367B_NUM_VIDS - 1;
+
+	if (vlan == 0 || vlan >= max)
+		return 0;
+
+	return 1;
+}
+
+static int rtl8367b_enable_port(struct rtl8366_smi *smi, int port, int enable)
+{
+	int err;
+
+	REG_WR(smi, RTL8367B_PORT_ISOLATION_REG(port),
+	       (enable) ? RTL8367B_PORTS_ALL : 0);
+
+	return 0;
+}
+
+static int rtl8367b_sw_reset_mibs(struct switch_dev *dev,
+				  const struct switch_attr *attr,
+				  struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+
+	return rtl8366_smi_rmwr(smi, RTL8367B_MIB_CTRL0_REG(0), 0,
+				RTL8367B_MIB_CTRL0_GLOBAL_RESET_MASK);
+}
+
+static int rtl8367b_sw_get_port_link(struct switch_dev *dev,
+				    int port,
+				    struct switch_port_link *link)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data = 0;
+	u32 speed;
+
+	if (port >= RTL8367B_NUM_PORTS)
+		return -EINVAL;
+
+	if (smi->rtl8367b_chip >= RTL8367B_CHIP_RTL8367S_VB) /* Family D */
+		rtl8366_smi_read_reg(smi, RTL8367D_PORT_STATUS_REG(port), &data);
+	else
+		rtl8366_smi_read_reg(smi, RTL8367B_PORT_STATUS_REG(port), &data);
+
+	link->link = !!(data & RTL8367B_PORT_STATUS_LINK);
+	if (!link->link)
+		return 0;
+
+	link->duplex = !!(data & RTL8367B_PORT_STATUS_DUPLEX);
+	link->rx_flow = !!(data & RTL8367B_PORT_STATUS_RXPAUSE);
+	link->tx_flow = !!(data & RTL8367B_PORT_STATUS_TXPAUSE);
+	link->aneg = !!(data & RTL8367B_PORT_STATUS_NWAY);
+
+	if (smi->rtl8367b_chip >= RTL8367B_CHIP_RTL8367S_VB) /* Family D */
+		speed = (data & RTL8367B_PORT_STATUS_SPEED_MASK) | ((data & RTL8367D_PORT_STATUS_SPEED1_MASK) >> RTL8367D_PORT_STATUS_SPEED1_SHIFT);
+	else
+		speed = (data & RTL8367B_PORT_STATUS_SPEED_MASK);
+	switch (speed) {
+	case RTL8367B_PORT_STATUS_SPEED_10:
+		link->speed = SWITCH_PORT_SPEED_10;
+		break;
+	case RTL8367B_PORT_STATUS_SPEED_100:
+		link->speed = SWITCH_PORT_SPEED_100;
+		break;
+	case RTL8367B_PORT_STATUS_SPEED_1000:
+		link->speed = SWITCH_PORT_SPEED_1000;
+		break;
+	default:
+		link->speed = SWITCH_PORT_SPEED_UNKNOWN;
+		break;
+	}
+
+	return 0;
+}
+
+static int rtl8367b_sw_get_max_length(struct switch_dev *dev,
+				     const struct switch_attr *attr,
+				     struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 data;
+
+	rtl8366_smi_read_reg(smi, RTL8367B_SWC0_REG, &data);
+	val->value.i = (data & RTL8367B_SWC0_MAX_LENGTH_MASK) >>
+			RTL8367B_SWC0_MAX_LENGTH_SHIFT;
+
+	return 0;
+}
+
+static int rtl8367b_sw_set_max_length(struct switch_dev *dev,
+				     const struct switch_attr *attr,
+				     struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	u32 max_len;
+
+	switch (val->value.i) {
+	case 0:
+		max_len = RTL8367B_SWC0_MAX_LENGTH_1522;
+		break;
+	case 1:
+		max_len = RTL8367B_SWC0_MAX_LENGTH_1536;
+		break;
+	case 2:
+		max_len = RTL8367B_SWC0_MAX_LENGTH_1552;
+		break;
+	case 3:
+		max_len = RTL8367B_SWC0_MAX_LENGTH_16000;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	return rtl8366_smi_rmwr(smi, RTL8367B_SWC0_REG,
+			        RTL8367B_SWC0_MAX_LENGTH_MASK, max_len);
+}
+
+
+static int rtl8367b_sw_reset_port_mibs(struct switch_dev *dev,
+				       const struct switch_attr *attr,
+				       struct switch_val *val)
+{
+	struct rtl8366_smi *smi = sw_to_rtl8366_smi(dev);
+	int port;
+
+	port = val->port_vlan;
+	if (port >= RTL8367B_NUM_PORTS)
+		return -EINVAL;
+
+	return rtl8366_smi_rmwr(smi, RTL8367B_MIB_CTRL0_REG(port / 8), 0,
+				RTL8367B_MIB_CTRL0_PORT_RESET_MASK(port % 8));
+}
+
+static int rtl8367b_sw_get_port_stats(struct switch_dev *dev, int port,
+                                        struct switch_port_stats *stats)
+{
+	return (rtl8366_sw_get_port_stats(dev, port, stats,
+				RTL8367B_MIB_TXB_ID, RTL8367B_MIB_RXB_ID));
+}
+
+static struct switch_attr rtl8367b_globals[] = {
+	{
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_vlan",
+		.description = "Enable VLAN mode",
+		.set = rtl8366_sw_set_vlan_enable,
+		.get = rtl8366_sw_get_vlan_enable,
+		.max = 1,
+		.ofs = 1
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "enable_vlan4k",
+		.description = "Enable VLAN 4K mode",
+		.set = rtl8366_sw_set_vlan_enable,
+		.get = rtl8366_sw_get_vlan_enable,
+		.max = 1,
+		.ofs = 2
+	}, {
+		.type = SWITCH_TYPE_NOVAL,
+		.name = "reset_mibs",
+		.description = "Reset all MIB counters",
+		.set = rtl8367b_sw_reset_mibs,
+	}, {
+		.type = SWITCH_TYPE_INT,
+		.name = "max_length",
+		.description = "Get/Set the maximum length of valid packets"
+			       "(0:1522, 1:1536, 2:1552, 3:16000)",
+		.set = rtl8367b_sw_set_max_length,
+		.get = rtl8367b_sw_get_max_length,
+		.max = 3,
+	}
+};
+
+static struct switch_attr rtl8367b_port[] = {
+	{
+		.type = SWITCH_TYPE_NOVAL,
+		.name = "reset_mib",
+		.description = "Reset single port MIB counters",
+		.set = rtl8367b_sw_reset_port_mibs,
+	}, {
+		.type = SWITCH_TYPE_STRING,
+		.name = "mib",
+		.description = "Get MIB counters for port",
+		.max = 33,
+		.set = NULL,
+		.get = rtl8366_sw_get_port_mib,
+	},
+};
+
+static struct switch_attr rtl8367b_vlan[] = {
+	{
+		.type = SWITCH_TYPE_STRING,
+		.name = "info",
+		.description = "Get vlan information",
+		.max = 1,
+		.set = NULL,
+		.get = rtl8366_sw_get_vlan_info,
+	},
+};
+
+static const struct switch_dev_ops rtl8367b_sw_ops = {
+	.attr_global = {
+		.attr = rtl8367b_globals,
+		.n_attr = ARRAY_SIZE(rtl8367b_globals),
+	},
+	.attr_port = {
+		.attr = rtl8367b_port,
+		.n_attr = ARRAY_SIZE(rtl8367b_port),
+	},
+	.attr_vlan = {
+		.attr = rtl8367b_vlan,
+		.n_attr = ARRAY_SIZE(rtl8367b_vlan),
+	},
+
+	.get_vlan_ports = rtl8366_sw_get_vlan_ports,
+	.set_vlan_ports = rtl8366_sw_set_vlan_ports,
+	.get_port_pvid = rtl8366_sw_get_port_pvid,
+	.set_port_pvid = rtl8366_sw_set_port_pvid,
+	.reset_switch = rtl8366_sw_reset_switch,
+	.get_port_link = rtl8367b_sw_get_port_link,
+	.get_port_stats = rtl8367b_sw_get_port_stats,
+};
+
+static int rtl8367b_switch_init(struct rtl8366_smi *smi)
+{
+	struct switch_dev *dev = &smi->sw_dev;
+	int err;
+
+	dev->name = "RTL8367B";
+	dev->cpu_port = smi->cpu_port;
+	dev->ports = RTL8367B_NUM_PORTS;
+	dev->vlans = RTL8367B_NUM_VIDS;
+	dev->ops = &rtl8367b_sw_ops;
+	dev->alias = dev_name(smi->parent);
+
+	err = register_switch(dev, NULL);
+	if (err)
+		dev_err(smi->parent, "switch registration failed\n");
+
+	return err;
+}
+
+static void rtl8367b_switch_cleanup(struct rtl8366_smi *smi)
+{
+	unregister_switch(&smi->sw_dev);
+}
+
+static int rtl8367b_mii_read(struct mii_bus *bus, int addr, int reg)
+{
+	struct rtl8366_smi *smi = bus->priv;
+	u32 val = 0;
+	int err;
+
+	err = rtl8367b_read_phy_reg(smi, addr, reg, &val);
+	if (err)
+		return 0xffff;
+
+	return val;
+}
+
+static int rtl8367b_mii_write(struct mii_bus *bus, int addr, int reg, u16 val)
+{
+	struct rtl8366_smi *smi = bus->priv;
+	u32 t;
+	int err;
+
+	err = rtl8367b_write_phy_reg(smi, addr, reg, val);
+	if (err)
+		return err;
+
+	/* flush write */
+	(void) rtl8367b_read_phy_reg(smi, addr, reg, &t);
+
+	return err;
+}
+
+static int rtl8367b_detect(struct rtl8366_smi *smi)
+{
+	const char *chip_name = NULL;
+	u32 chip_num;
+	u32 chip_ver;
+	int ret;
+
+	smi->emu_vlanmc = NULL;
+	smi->rtl8367b_chip = RTL8367B_CHIP_UNKNOWN;
+
+	rtl8366_smi_write_reg(smi, RTL8367B_RTL_MAGIC_ID_REG,
+			      RTL8367B_RTL_MAGIC_ID_VAL);
+
+	ret = rtl8366_smi_read_reg(smi, RTL8367B_CHIP_NUMBER_REG, &chip_num);
+	if (ret) {
+		dev_err(smi->parent, "unable to read %s register\n",
+			"chip number");
+		return ret;
+	}
+
+	ret = rtl8366_smi_read_reg(smi, RTL8367B_CHIP_VER_REG, &chip_ver);
+	if (ret) {
+		dev_err(smi->parent, "unable to read %s register\n",
+			"chip version");
+		return ret;
+	}
+
+	switch (chip_ver) {
+	case 0x0010:
+		if (chip_num == 0x6642) {
+			chip_name = "8367S-VB";
+			smi->rtl8367b_chip = RTL8367B_CHIP_RTL8367S_VB;
+		}
+		break;
+	case 0x0020:
+		if (chip_num == 0x6367) {
+			chip_name = "8367RB-VB";
+			smi->rtl8367b_chip = RTL8367B_CHIP_RTL8367RB_VB;
+		}
+		break;
+	case 0x00A0:
+		if (chip_num == 0x6367) {
+			chip_name = "8367S";
+			smi->rtl8367b_chip = RTL8367B_CHIP_RTL8367S;
+		}
+		break;
+	case 0x1000:
+		chip_name = "8367RB";
+		smi->rtl8367b_chip = RTL8367B_CHIP_RTL8367RB;
+		break;
+	case 0x1010:
+		chip_name = "8367R-VB";
+		smi->rtl8367b_chip = RTL8367B_CHIP_RTL8367R_VB;
+	}
+
+	if (!chip_name) {
+		dev_err(smi->parent,
+			"unknown chip (num:%04x ver:%04x)\n",
+			chip_num, chip_ver);
+		return -ENODEV;
+	}
+
+	dev_info(smi->parent, "RTL%s chip found (num:%04x ver:%04x)\n", chip_name, chip_num, chip_ver);
+
+	return 0;
+}
+
+static struct rtl8366_smi_ops rtl8367b_smi_ops = {
+	.detect		= rtl8367b_detect,
+	.reset_chip	= rtl8367b_reset_chip,
+	.setup		= rtl8367b_setup,
+
+	.mii_read	= rtl8367b_mii_read,
+	.mii_write	= rtl8367b_mii_write,
+
+	.get_vlan_mc	= rtl8367b_get_vlan_mc,
+	.set_vlan_mc	= rtl8367b_set_vlan_mc,
+	.get_vlan_4k	= rtl8367b_get_vlan_4k,
+	.set_vlan_4k	= rtl8367b_set_vlan_4k,
+	.get_mc_index	= rtl8367b_get_mc_index,
+	.set_mc_index	= rtl8367b_set_mc_index,
+	.get_mib_counter = rtl8367b_get_mib_counter,
+	.is_vlan_valid	= rtl8367b_is_vlan_valid,
+	.enable_vlan	= rtl8367b_enable_vlan,
+	.enable_vlan4k	= rtl8367b_enable_vlan4k,
+	.enable_port	= rtl8367b_enable_port,
+};
+
+static int  rtl8367b_probe(struct platform_device *pdev)
+{
+	struct rtl8366_smi *smi;
+	int err;
+
+	smi = rtl8366_smi_probe(pdev);
+	if (IS_ERR(smi))
+		return PTR_ERR(smi);
+
+	smi->clk_delay = 1500;
+	smi->cmd_read = 0xb9;
+	smi->cmd_write = 0xb8;
+	smi->ops = &rtl8367b_smi_ops;
+	smi->num_ports = RTL8367B_NUM_PORTS;
+	smi->cpu_port = UINT_MAX; /* not defined yet */
+	smi->num_vlan_mc = RTL8367B_NUM_VLANS;
+	smi->mib_counters = rtl8367b_mib_counters;
+	smi->num_mib_counters = ARRAY_SIZE(rtl8367b_mib_counters);
+
+	err = rtl8366_smi_init(smi);
+	if (err)
+		goto err_free_smi;
+
+	platform_set_drvdata(pdev, smi);
+
+	err = rtl8367b_switch_init(smi);
+	if (err)
+		goto err_clear_drvdata;
+
+	return 0;
+
+ err_clear_drvdata:
+	platform_set_drvdata(pdev, NULL);
+	rtl8366_smi_cleanup(smi);
+ err_free_smi:
+	if (smi->emu_vlanmc)
+		kfree(smi->emu_vlanmc);
+	kfree(smi);
+	return err;
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6,11,0)
+static int rtl8367b_remove(struct platform_device *pdev)
+#else
+static void rtl8367b_remove(struct platform_device *pdev)
+#endif
+{
+	struct rtl8366_smi *smi = platform_get_drvdata(pdev);
+
+	if (smi) {
+		rtl8367b_switch_cleanup(smi);
+		platform_set_drvdata(pdev, NULL);
+		rtl8366_smi_cleanup(smi);
+		kfree(smi);
+	}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6,11,0)
+	return 0;
+#endif
+}
+
+static void rtl8367b_shutdown(struct platform_device *pdev)
+{
+	struct rtl8366_smi *smi = platform_get_drvdata(pdev);
+
+	if (smi)
+		rtl8367b_reset_chip(smi);
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id rtl8367b_match[] = {
+	{ .compatible = "realtek,rtl8367b" },
+	{},
+};
+MODULE_DEVICE_TABLE(of, rtl8367b_match);
+#endif
+
+static struct platform_driver rtl8367b_driver = {
+	.driver = {
+		.name		= RTL8367B_DRIVER_NAME,
+#ifdef CONFIG_OF
+		.of_match_table = of_match_ptr(rtl8367b_match),
+#endif
+	},
+	.probe		= rtl8367b_probe,
+	.remove		= rtl8367b_remove,
+	.shutdown	= rtl8367b_shutdown,
+};
+
+module_platform_driver(rtl8367b_driver);
+
+MODULE_DESCRIPTION("Realtek RTL8367B ethernet switch driver");
+MODULE_AUTHOR("Gabor Juhos <juhosg@openwrt.org>");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:" RTL8367B_DRIVER_NAME);
+
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/swconfig.c b/6.12/target/linux/generic/files/drivers/net/phy/swconfig.c
new file mode 100644
index 00000000..71dd5b31
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/swconfig.c
@@ -0,0 +1,1242 @@
+/*
+ * swconfig.c: Switch configuration API
+ *
+ * Copyright (C) 2008 Felix Fietkau <nbd@nbd.name>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/types.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/list.h>
+#include <linux/if.h>
+#include <linux/if_ether.h>
+#include <linux/capability.h>
+#include <linux/skbuff.h>
+#include <linux/switch.h>
+#include <linux/of.h>
+#include <uapi/linux/mii.h>
+
+#define SWCONFIG_DEVNAME	"switch%d"
+
+#include "swconfig_leds.c"
+
+MODULE_AUTHOR("Felix Fietkau <nbd@nbd.name>");
+MODULE_LICENSE("GPL");
+
+static int swdev_id;
+static struct list_head swdevs;
+static DEFINE_MUTEX(swdevs_lock);
+struct swconfig_callback;
+
+struct swconfig_callback {
+	struct sk_buff *msg;
+	struct genlmsghdr *hdr;
+	struct genl_info *info;
+	int cmd;
+
+	/* callback for filling in the message data */
+	int (*fill)(struct swconfig_callback *cb, void *arg);
+
+	/* callback for closing the message before sending it */
+	int (*close)(struct swconfig_callback *cb, void *arg);
+
+	struct nlattr *nest[4];
+	int args[4];
+};
+
+/* defaults */
+
+static int
+swconfig_get_vlan_ports(struct switch_dev *dev, const struct switch_attr *attr,
+			struct switch_val *val)
+{
+	int ret;
+	if (val->port_vlan >= dev->vlans)
+		return -EINVAL;
+
+	if (!dev->ops->get_vlan_ports)
+		return -EOPNOTSUPP;
+
+	ret = dev->ops->get_vlan_ports(dev, val);
+	return ret;
+}
+
+static int
+swconfig_set_vlan_ports(struct switch_dev *dev, const struct switch_attr *attr,
+			struct switch_val *val)
+{
+	struct switch_port *ports = val->value.ports;
+	const struct switch_dev_ops *ops = dev->ops;
+	int i;
+
+	if (val->port_vlan >= dev->vlans)
+		return -EINVAL;
+
+	/* validate ports */
+	if (val->len > dev->ports)
+		return -EINVAL;
+
+	if (!ops->set_vlan_ports)
+		return -EOPNOTSUPP;
+
+	for (i = 0; i < val->len; i++) {
+		if (ports[i].id >= dev->ports)
+			return -EINVAL;
+
+		if (ops->set_port_pvid &&
+		    !(ports[i].flags & (1 << SWITCH_PORT_FLAG_TAGGED)))
+			ops->set_port_pvid(dev, ports[i].id, val->port_vlan);
+	}
+
+	return ops->set_vlan_ports(dev, val);
+}
+
+static int
+swconfig_set_pvid(struct switch_dev *dev, const struct switch_attr *attr,
+			struct switch_val *val)
+{
+	if (val->port_vlan >= dev->ports)
+		return -EINVAL;
+
+	if (!dev->ops->set_port_pvid)
+		return -EOPNOTSUPP;
+
+	return dev->ops->set_port_pvid(dev, val->port_vlan, val->value.i);
+}
+
+static int
+swconfig_get_pvid(struct switch_dev *dev, const struct switch_attr *attr,
+			struct switch_val *val)
+{
+	if (val->port_vlan >= dev->ports)
+		return -EINVAL;
+
+	if (!dev->ops->get_port_pvid)
+		return -EOPNOTSUPP;
+
+	return dev->ops->get_port_pvid(dev, val->port_vlan, &val->value.i);
+}
+
+static int
+swconfig_set_link(struct switch_dev *dev, const struct switch_attr *attr,
+			struct switch_val *val)
+{
+	if (!dev->ops->set_port_link)
+		return -EOPNOTSUPP;
+
+	return dev->ops->set_port_link(dev, val->port_vlan, val->value.link);
+}
+
+static int
+swconfig_get_link(struct switch_dev *dev, const struct switch_attr *attr,
+			struct switch_val *val)
+{
+	struct switch_port_link *link = val->value.link;
+
+	if (val->port_vlan >= dev->ports)
+		return -EINVAL;
+
+	if (!dev->ops->get_port_link)
+		return -EOPNOTSUPP;
+
+	memset(link, 0, sizeof(*link));
+	return dev->ops->get_port_link(dev, val->port_vlan, link);
+}
+
+static int
+swconfig_apply_config(struct switch_dev *dev, const struct switch_attr *attr,
+			struct switch_val *val)
+{
+	/* don't complain if not supported by the switch driver */
+	if (!dev->ops->apply_config)
+		return 0;
+
+	return dev->ops->apply_config(dev);
+}
+
+static int
+swconfig_reset_switch(struct switch_dev *dev, const struct switch_attr *attr,
+			struct switch_val *val)
+{
+	/* don't complain if not supported by the switch driver */
+	if (!dev->ops->reset_switch)
+		return 0;
+
+	return dev->ops->reset_switch(dev);
+}
+
+enum global_defaults {
+	GLOBAL_APPLY,
+	GLOBAL_RESET,
+};
+
+enum vlan_defaults {
+	VLAN_PORTS,
+};
+
+enum port_defaults {
+	PORT_PVID,
+	PORT_LINK,
+};
+
+static struct switch_attr default_global[] = {
+	[GLOBAL_APPLY] = {
+		.type = SWITCH_TYPE_NOVAL,
+		.name = "apply",
+		.description = "Activate changes in the hardware",
+		.set = swconfig_apply_config,
+	},
+	[GLOBAL_RESET] = {
+		.type = SWITCH_TYPE_NOVAL,
+		.name = "reset",
+		.description = "Reset the switch",
+		.set = swconfig_reset_switch,
+	}
+};
+
+static struct switch_attr default_port[] = {
+	[PORT_PVID] = {
+		.type = SWITCH_TYPE_INT,
+		.name = "pvid",
+		.description = "Primary VLAN ID",
+		.set = swconfig_set_pvid,
+		.get = swconfig_get_pvid,
+	},
+	[PORT_LINK] = {
+		.type = SWITCH_TYPE_LINK,
+		.name = "link",
+		.description = "Get port link information",
+		.set = swconfig_set_link,
+		.get = swconfig_get_link,
+	}
+};
+
+static struct switch_attr default_vlan[] = {
+	[VLAN_PORTS] = {
+		.type = SWITCH_TYPE_PORTS,
+		.name = "ports",
+		.description = "VLAN port mapping",
+		.set = swconfig_set_vlan_ports,
+		.get = swconfig_get_vlan_ports,
+	},
+};
+
+static const struct switch_attr *
+swconfig_find_attr_by_name(const struct switch_attrlist *alist,
+				const char *name)
+{
+	int i;
+
+	for (i = 0; i < alist->n_attr; i++)
+		if (strcmp(name, alist->attr[i].name) == 0)
+			return &alist->attr[i];
+
+	return NULL;
+}
+
+static void swconfig_defaults_init(struct switch_dev *dev)
+{
+	const struct switch_dev_ops *ops = dev->ops;
+
+	dev->def_global = 0;
+	dev->def_vlan = 0;
+	dev->def_port = 0;
+
+	if (ops->get_vlan_ports || ops->set_vlan_ports)
+		set_bit(VLAN_PORTS, &dev->def_vlan);
+
+	if (ops->get_port_pvid || ops->set_port_pvid)
+		set_bit(PORT_PVID, &dev->def_port);
+
+	if (ops->get_port_link &&
+	    !swconfig_find_attr_by_name(&ops->attr_port, "link"))
+		set_bit(PORT_LINK, &dev->def_port);
+
+	/* always present, can be no-op */
+	set_bit(GLOBAL_APPLY, &dev->def_global);
+	set_bit(GLOBAL_RESET, &dev->def_global);
+}
+
+
+static struct genl_family switch_fam;
+
+static const struct nla_policy switch_policy[SWITCH_ATTR_MAX+1] = {
+	[SWITCH_ATTR_ID] = { .type = NLA_U32 },
+	[SWITCH_ATTR_OP_ID] = { .type = NLA_U32 },
+	[SWITCH_ATTR_OP_PORT] = { .type = NLA_U32 },
+	[SWITCH_ATTR_OP_VLAN] = { .type = NLA_U32 },
+	[SWITCH_ATTR_OP_VALUE_INT] = { .type = NLA_U32 },
+	[SWITCH_ATTR_OP_VALUE_STR] = { .type = NLA_NUL_STRING },
+	[SWITCH_ATTR_OP_VALUE_PORTS] = { .type = NLA_NESTED },
+	[SWITCH_ATTR_TYPE] = { .type = NLA_U32 },
+};
+
+static const struct nla_policy port_policy[SWITCH_PORT_ATTR_MAX+1] = {
+	[SWITCH_PORT_ID] = { .type = NLA_U32 },
+	[SWITCH_PORT_FLAG_TAGGED] = { .type = NLA_FLAG },
+};
+
+static struct nla_policy link_policy[SWITCH_LINK_ATTR_MAX] = {
+	[SWITCH_LINK_FLAG_DUPLEX] = { .type = NLA_FLAG },
+	[SWITCH_LINK_FLAG_ANEG] = { .type = NLA_FLAG },
+	[SWITCH_LINK_SPEED] = { .type = NLA_U32 },
+};
+
+static inline void
+swconfig_lock(void)
+{
+	mutex_lock(&swdevs_lock);
+}
+
+static inline void
+swconfig_unlock(void)
+{
+	mutex_unlock(&swdevs_lock);
+}
+
+static struct switch_dev *
+swconfig_get_dev(struct genl_info *info)
+{
+	struct switch_dev *dev = NULL;
+	struct switch_dev *p;
+	int id;
+
+	if (!info->attrs[SWITCH_ATTR_ID])
+		goto done;
+
+	id = nla_get_u32(info->attrs[SWITCH_ATTR_ID]);
+	swconfig_lock();
+	list_for_each_entry(p, &swdevs, dev_list) {
+		if (id != p->id)
+			continue;
+
+		dev = p;
+		break;
+	}
+	if (dev)
+		mutex_lock(&dev->sw_mutex);
+	else
+		pr_debug("device %d not found\n", id);
+	swconfig_unlock();
+done:
+	return dev;
+}
+
+static inline void
+swconfig_put_dev(struct switch_dev *dev)
+{
+	mutex_unlock(&dev->sw_mutex);
+}
+
+static int
+swconfig_dump_attr(struct swconfig_callback *cb, void *arg)
+{
+	struct switch_attr *op = arg;
+	struct genl_info *info = cb->info;
+	struct sk_buff *msg = cb->msg;
+	int id = cb->args[0];
+	void *hdr;
+
+	hdr = genlmsg_put(msg, info->snd_portid, info->snd_seq, &switch_fam,
+			NLM_F_MULTI, SWITCH_CMD_NEW_ATTR);
+	if (IS_ERR(hdr))
+		return -1;
+
+	if (nla_put_u32(msg, SWITCH_ATTR_OP_ID, id))
+		goto nla_put_failure;
+	if (nla_put_u32(msg, SWITCH_ATTR_OP_TYPE, op->type))
+		goto nla_put_failure;
+	if (nla_put_string(msg, SWITCH_ATTR_OP_NAME, op->name))
+		goto nla_put_failure;
+	if (op->description)
+		if (nla_put_string(msg, SWITCH_ATTR_OP_DESCRIPTION,
+			op->description))
+			goto nla_put_failure;
+
+	genlmsg_end(msg, hdr);
+	return msg->len;
+nla_put_failure:
+	genlmsg_cancel(msg, hdr);
+	return -EMSGSIZE;
+}
+
+/* spread multipart messages across multiple message buffers */
+static int
+swconfig_send_multipart(struct swconfig_callback *cb, void *arg)
+{
+	struct genl_info *info = cb->info;
+	int restart = 0;
+	int err;
+
+	do {
+		if (!cb->msg) {
+			cb->msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+			if (cb->msg == NULL)
+				goto error;
+		}
+
+		if (!(cb->fill(cb, arg) < 0))
+			break;
+
+		/* fill failed, check if this was already the second attempt */
+		if (restart)
+			goto error;
+
+		/* try again in a new message, send the current one */
+		restart = 1;
+		if (cb->close) {
+			if (cb->close(cb, arg) < 0)
+				goto error;
+		}
+		err = genlmsg_reply(cb->msg, info);
+		cb->msg = NULL;
+		if (err < 0)
+			goto error;
+
+	} while (restart);
+
+	return 0;
+
+error:
+	if (cb->msg)
+		nlmsg_free(cb->msg);
+	return -1;
+}
+
+static int
+swconfig_list_attrs(struct sk_buff *skb, struct genl_info *info)
+{
+	struct genlmsghdr *hdr = nlmsg_data(info->nlhdr);
+	const struct switch_attrlist *alist;
+	struct switch_dev *dev;
+	struct swconfig_callback cb;
+	int err = -EINVAL;
+	int i;
+
+	/* defaults */
+	struct switch_attr *def_list;
+	unsigned long *def_active;
+	int n_def;
+
+	dev = swconfig_get_dev(info);
+	if (!dev)
+		return -EINVAL;
+
+	switch (hdr->cmd) {
+	case SWITCH_CMD_LIST_GLOBAL:
+		alist = &dev->ops->attr_global;
+		def_list = default_global;
+		def_active = &dev->def_global;
+		n_def = ARRAY_SIZE(default_global);
+		break;
+	case SWITCH_CMD_LIST_VLAN:
+		alist = &dev->ops->attr_vlan;
+		def_list = default_vlan;
+		def_active = &dev->def_vlan;
+		n_def = ARRAY_SIZE(default_vlan);
+		break;
+	case SWITCH_CMD_LIST_PORT:
+		alist = &dev->ops->attr_port;
+		def_list = default_port;
+		def_active = &dev->def_port;
+		n_def = ARRAY_SIZE(default_port);
+		break;
+	default:
+		WARN_ON(1);
+		goto out;
+	}
+
+	memset(&cb, 0, sizeof(cb));
+	cb.info = info;
+	cb.fill = swconfig_dump_attr;
+	for (i = 0; i < alist->n_attr; i++) {
+		if (alist->attr[i].disabled)
+			continue;
+		cb.args[0] = i;
+		err = swconfig_send_multipart(&cb, (void *) &alist->attr[i]);
+		if (err < 0)
+			goto error;
+	}
+
+	/* defaults */
+	for (i = 0; i < n_def; i++) {
+		if (!test_bit(i, def_active))
+			continue;
+		cb.args[0] = SWITCH_ATTR_DEFAULTS_OFFSET + i;
+		err = swconfig_send_multipart(&cb, (void *) &def_list[i]);
+		if (err < 0)
+			goto error;
+	}
+	swconfig_put_dev(dev);
+
+	if (!cb.msg)
+		return 0;
+
+	return genlmsg_reply(cb.msg, info);
+
+error:
+	if (cb.msg)
+		nlmsg_free(cb.msg);
+out:
+	swconfig_put_dev(dev);
+	return err;
+}
+
+static const struct switch_attr *
+swconfig_lookup_attr(struct switch_dev *dev, struct genl_info *info,
+		struct switch_val *val)
+{
+	struct genlmsghdr *hdr = nlmsg_data(info->nlhdr);
+	const struct switch_attrlist *alist;
+	const struct switch_attr *attr = NULL;
+	unsigned int attr_id;
+
+	/* defaults */
+	struct switch_attr *def_list;
+	unsigned long *def_active;
+	int n_def;
+
+	if (!info->attrs[SWITCH_ATTR_OP_ID])
+		goto done;
+
+	switch (hdr->cmd) {
+	case SWITCH_CMD_SET_GLOBAL:
+	case SWITCH_CMD_GET_GLOBAL:
+		alist = &dev->ops->attr_global;
+		def_list = default_global;
+		def_active = &dev->def_global;
+		n_def = ARRAY_SIZE(default_global);
+		break;
+	case SWITCH_CMD_SET_VLAN:
+	case SWITCH_CMD_GET_VLAN:
+		alist = &dev->ops->attr_vlan;
+		def_list = default_vlan;
+		def_active = &dev->def_vlan;
+		n_def = ARRAY_SIZE(default_vlan);
+		if (!info->attrs[SWITCH_ATTR_OP_VLAN])
+			goto done;
+		val->port_vlan = nla_get_u32(info->attrs[SWITCH_ATTR_OP_VLAN]);
+		if (val->port_vlan >= dev->vlans)
+			goto done;
+		break;
+	case SWITCH_CMD_SET_PORT:
+	case SWITCH_CMD_GET_PORT:
+		alist = &dev->ops->attr_port;
+		def_list = default_port;
+		def_active = &dev->def_port;
+		n_def = ARRAY_SIZE(default_port);
+		if (!info->attrs[SWITCH_ATTR_OP_PORT])
+			goto done;
+		val->port_vlan = nla_get_u32(info->attrs[SWITCH_ATTR_OP_PORT]);
+		if (val->port_vlan >= dev->ports)
+			goto done;
+		break;
+	default:
+		WARN_ON(1);
+		goto done;
+	}
+
+	if (!alist)
+		goto done;
+
+	attr_id = nla_get_u32(info->attrs[SWITCH_ATTR_OP_ID]);
+	if (attr_id >= SWITCH_ATTR_DEFAULTS_OFFSET) {
+		attr_id -= SWITCH_ATTR_DEFAULTS_OFFSET;
+		if (attr_id >= n_def)
+			goto done;
+		if (!test_bit(attr_id, def_active))
+			goto done;
+		attr = &def_list[attr_id];
+	} else {
+		if (attr_id >= alist->n_attr)
+			goto done;
+		attr = &alist->attr[attr_id];
+	}
+
+	if (attr->disabled)
+		attr = NULL;
+
+done:
+	if (!attr)
+		pr_debug("attribute lookup failed\n");
+	val->attr = attr;
+	return attr;
+}
+
+static int
+swconfig_parse_ports(struct sk_buff *msg, struct nlattr *head,
+		struct switch_val *val, int max)
+{
+	struct nlattr *nla;
+	int rem;
+
+	val->len = 0;
+	nla_for_each_nested(nla, head, rem) {
+		struct nlattr *tb[SWITCH_PORT_ATTR_MAX+1];
+		struct switch_port *port;
+
+		if (val->len >= max)
+			return -EINVAL;
+
+		port = &val->value.ports[val->len];
+
+		if (nla_parse_nested_deprecated(tb, SWITCH_PORT_ATTR_MAX, nla,
+				port_policy, NULL))
+			return -EINVAL;
+
+		if (!tb[SWITCH_PORT_ID])
+			return -EINVAL;
+
+		port->id = nla_get_u32(tb[SWITCH_PORT_ID]);
+		if (tb[SWITCH_PORT_FLAG_TAGGED])
+			port->flags |= (1 << SWITCH_PORT_FLAG_TAGGED);
+		val->len++;
+	}
+
+	return 0;
+}
+
+static int
+swconfig_parse_link(struct sk_buff *msg, struct nlattr *nla,
+		    struct switch_port_link *link)
+{
+	struct nlattr *tb[SWITCH_LINK_ATTR_MAX + 1];
+
+	if (nla_parse_nested_deprecated(tb, SWITCH_LINK_ATTR_MAX, nla, link_policy, NULL))
+		return -EINVAL;
+
+	link->duplex = !!tb[SWITCH_LINK_FLAG_DUPLEX];
+	link->aneg = !!tb[SWITCH_LINK_FLAG_ANEG];
+	link->speed = nla_get_u32(tb[SWITCH_LINK_SPEED]);
+
+	return 0;
+}
+
+static int
+swconfig_set_attr(struct sk_buff *skb, struct genl_info *info)
+{
+	const struct switch_attr *attr;
+	struct switch_dev *dev;
+	struct switch_val val;
+	int err = -EINVAL;
+
+	if (!capable(CAP_NET_ADMIN))
+		return -EPERM;
+
+	dev = swconfig_get_dev(info);
+	if (!dev)
+		return -EINVAL;
+
+	memset(&val, 0, sizeof(val));
+	attr = swconfig_lookup_attr(dev, info, &val);
+	if (!attr || !attr->set)
+		goto error;
+
+	val.attr = attr;
+	switch (attr->type) {
+	case SWITCH_TYPE_NOVAL:
+		break;
+	case SWITCH_TYPE_INT:
+		if (!info->attrs[SWITCH_ATTR_OP_VALUE_INT])
+			goto error;
+		val.value.i =
+			nla_get_u32(info->attrs[SWITCH_ATTR_OP_VALUE_INT]);
+		break;
+	case SWITCH_TYPE_STRING:
+		if (!info->attrs[SWITCH_ATTR_OP_VALUE_STR])
+			goto error;
+		val.value.s =
+			nla_data(info->attrs[SWITCH_ATTR_OP_VALUE_STR]);
+		break;
+	case SWITCH_TYPE_PORTS:
+		val.value.ports = dev->portbuf;
+		memset(dev->portbuf, 0,
+			sizeof(struct switch_port) * dev->ports);
+
+		/* TODO: implement multipart? */
+		if (info->attrs[SWITCH_ATTR_OP_VALUE_PORTS]) {
+			err = swconfig_parse_ports(skb,
+				info->attrs[SWITCH_ATTR_OP_VALUE_PORTS],
+				&val, dev->ports);
+			if (err < 0)
+				goto error;
+		} else {
+			val.len = 0;
+			err = 0;
+		}
+		break;
+	case SWITCH_TYPE_LINK:
+		val.value.link = &dev->linkbuf;
+		memset(&dev->linkbuf, 0, sizeof(struct switch_port_link));
+
+		if (info->attrs[SWITCH_ATTR_OP_VALUE_LINK]) {
+			err = swconfig_parse_link(skb,
+						  info->attrs[SWITCH_ATTR_OP_VALUE_LINK],
+						  val.value.link);
+			if (err < 0)
+				goto error;
+		} else {
+			val.len = 0;
+			err = 0;
+		}
+		break;
+	default:
+		goto error;
+	}
+
+	err = attr->set(dev, attr, &val);
+error:
+	swconfig_put_dev(dev);
+	return err;
+}
+
+static int
+swconfig_close_portlist(struct swconfig_callback *cb, void *arg)
+{
+	if (cb->nest[0])
+		nla_nest_end(cb->msg, cb->nest[0]);
+	return 0;
+}
+
+static int
+swconfig_send_port(struct swconfig_callback *cb, void *arg)
+{
+	const struct switch_port *port = arg;
+	struct nlattr *p = NULL;
+
+	if (!cb->nest[0]) {
+		cb->nest[0] = nla_nest_start(cb->msg, cb->cmd);
+		if (!cb->nest[0])
+			return -1;
+	}
+
+	p = nla_nest_start(cb->msg, SWITCH_ATTR_PORT);
+	if (!p)
+		goto error;
+
+	if (nla_put_u32(cb->msg, SWITCH_PORT_ID, port->id))
+		goto nla_put_failure;
+	if (port->flags & (1 << SWITCH_PORT_FLAG_TAGGED)) {
+		if (nla_put_flag(cb->msg, SWITCH_PORT_FLAG_TAGGED))
+			goto nla_put_failure;
+	}
+
+	nla_nest_end(cb->msg, p);
+	return 0;
+
+nla_put_failure:
+		nla_nest_cancel(cb->msg, p);
+error:
+	nla_nest_cancel(cb->msg, cb->nest[0]);
+	return -1;
+}
+
+static int
+swconfig_send_ports(struct sk_buff **msg, struct genl_info *info, int attr,
+		const struct switch_val *val)
+{
+	struct swconfig_callback cb;
+	int err = 0;
+	int i;
+
+	if (!val->value.ports)
+		return -EINVAL;
+
+	memset(&cb, 0, sizeof(cb));
+	cb.cmd = attr;
+	cb.msg = *msg;
+	cb.info = info;
+	cb.fill = swconfig_send_port;
+	cb.close = swconfig_close_portlist;
+
+	cb.nest[0] = nla_nest_start(cb.msg, cb.cmd);
+	for (i = 0; i < val->len; i++) {
+		err = swconfig_send_multipart(&cb, &val->value.ports[i]);
+		if (err)
+			goto done;
+	}
+	err = val->len;
+	swconfig_close_portlist(&cb, NULL);
+	*msg = cb.msg;
+
+done:
+	return err;
+}
+
+static int
+swconfig_send_link(struct sk_buff *msg, struct genl_info *info, int attr,
+		   const struct switch_port_link *link)
+{
+	struct nlattr *p = NULL;
+	int err = 0;
+
+	p = nla_nest_start(msg, attr);
+	if (link->link) {
+		if (nla_put_flag(msg, SWITCH_LINK_FLAG_LINK))
+			goto nla_put_failure;
+	}
+	if (link->duplex) {
+		if (nla_put_flag(msg, SWITCH_LINK_FLAG_DUPLEX))
+			goto nla_put_failure;
+	}
+	if (link->aneg) {
+		if (nla_put_flag(msg, SWITCH_LINK_FLAG_ANEG))
+			goto nla_put_failure;
+	}
+	if (link->tx_flow) {
+		if (nla_put_flag(msg, SWITCH_LINK_FLAG_TX_FLOW))
+			goto nla_put_failure;
+	}
+	if (link->rx_flow) {
+		if (nla_put_flag(msg, SWITCH_LINK_FLAG_RX_FLOW))
+			goto nla_put_failure;
+	}
+	if (nla_put_u32(msg, SWITCH_LINK_SPEED, link->speed))
+		goto nla_put_failure;
+	if (link->eee & ADVERTISED_100baseT_Full) {
+		if (nla_put_flag(msg, SWITCH_LINK_FLAG_EEE_100BASET))
+			goto nla_put_failure;
+	}
+	if (link->eee & ADVERTISED_1000baseT_Full) {
+		if (nla_put_flag(msg, SWITCH_LINK_FLAG_EEE_1000BASET))
+			goto nla_put_failure;
+	}
+	nla_nest_end(msg, p);
+
+	return err;
+
+nla_put_failure:
+	nla_nest_cancel(msg, p);
+	return -1;
+}
+
+static int
+swconfig_get_attr(struct sk_buff *skb, struct genl_info *info)
+{
+	struct genlmsghdr *hdr = nlmsg_data(info->nlhdr);
+	const struct switch_attr *attr;
+	struct switch_dev *dev;
+	struct sk_buff *msg = NULL;
+	struct switch_val val;
+	int err = -EINVAL;
+	int cmd = hdr->cmd;
+
+	dev = swconfig_get_dev(info);
+	if (!dev)
+		return -EINVAL;
+
+	memset(&val, 0, sizeof(val));
+	attr = swconfig_lookup_attr(dev, info, &val);
+	if (!attr || !attr->get)
+		goto error;
+
+	if (attr->type == SWITCH_TYPE_PORTS) {
+		val.value.ports = dev->portbuf;
+		memset(dev->portbuf, 0,
+			sizeof(struct switch_port) * dev->ports);
+	} else if (attr->type == SWITCH_TYPE_LINK) {
+		val.value.link = &dev->linkbuf;
+		memset(&dev->linkbuf, 0, sizeof(struct switch_port_link));
+	}
+
+	err = attr->get(dev, attr, &val);
+	if (err)
+		goto error;
+
+	msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+	if (!msg)
+		goto error;
+
+	hdr = genlmsg_put(msg, info->snd_portid, info->snd_seq, &switch_fam,
+			0, cmd);
+	if (IS_ERR(hdr))
+		goto nla_put_failure;
+
+	switch (attr->type) {
+	case SWITCH_TYPE_INT:
+		if (nla_put_u32(msg, SWITCH_ATTR_OP_VALUE_INT, val.value.i))
+			goto nla_put_failure;
+		break;
+	case SWITCH_TYPE_STRING:
+		if (nla_put_string(msg, SWITCH_ATTR_OP_VALUE_STR, val.value.s))
+			goto nla_put_failure;
+		break;
+	case SWITCH_TYPE_PORTS:
+		err = swconfig_send_ports(&msg, info,
+				SWITCH_ATTR_OP_VALUE_PORTS, &val);
+		if (err < 0)
+			goto nla_put_failure;
+		break;
+	case SWITCH_TYPE_LINK:
+		err = swconfig_send_link(msg, info,
+					 SWITCH_ATTR_OP_VALUE_LINK, val.value.link);
+		if (err < 0)
+			goto nla_put_failure;
+		break;
+	default:
+		pr_debug("invalid type in attribute\n");
+		err = -EINVAL;
+		goto nla_put_failure;
+	}
+	genlmsg_end(msg, hdr);
+	err = msg->len;
+	if (err < 0)
+		goto nla_put_failure;
+
+	swconfig_put_dev(dev);
+	return genlmsg_reply(msg, info);
+
+nla_put_failure:
+	if (msg)
+		nlmsg_free(msg);
+error:
+	swconfig_put_dev(dev);
+	if (!err)
+		err = -ENOMEM;
+	return err;
+}
+
+static int
+swconfig_send_switch(struct sk_buff *msg, u32 pid, u32 seq, int flags,
+		const struct switch_dev *dev)
+{
+	struct nlattr *p = NULL, *m = NULL;
+	void *hdr;
+	int i;
+
+	hdr = genlmsg_put(msg, pid, seq, &switch_fam, flags,
+			SWITCH_CMD_NEW_ATTR);
+	if (IS_ERR(hdr))
+		return -1;
+
+	if (nla_put_u32(msg, SWITCH_ATTR_ID, dev->id))
+		goto nla_put_failure;
+	if (nla_put_string(msg, SWITCH_ATTR_DEV_NAME, dev->devname))
+		goto nla_put_failure;
+	if (nla_put_string(msg, SWITCH_ATTR_ALIAS, dev->alias))
+		goto nla_put_failure;
+	if (nla_put_string(msg, SWITCH_ATTR_NAME, dev->name))
+		goto nla_put_failure;
+	if (nla_put_u32(msg, SWITCH_ATTR_VLANS, dev->vlans))
+		goto nla_put_failure;
+	if (nla_put_u32(msg, SWITCH_ATTR_PORTS, dev->ports))
+		goto nla_put_failure;
+	if (nla_put_u32(msg, SWITCH_ATTR_CPU_PORT, dev->cpu_port))
+		goto nla_put_failure;
+
+	m = nla_nest_start(msg, SWITCH_ATTR_PORTMAP);
+	if (!m)
+		goto nla_put_failure;
+	for (i = 0; i < dev->ports; i++) {
+		p = nla_nest_start(msg, SWITCH_ATTR_PORTS);
+		if (!p)
+			continue;
+		if (dev->portmap[i].s) {
+			if (nla_put_string(msg, SWITCH_PORTMAP_SEGMENT,
+						dev->portmap[i].s))
+				goto nla_put_failure;
+			if (nla_put_u32(msg, SWITCH_PORTMAP_VIRT,
+						dev->portmap[i].virt))
+				goto nla_put_failure;
+		}
+		nla_nest_end(msg, p);
+	}
+	nla_nest_end(msg, m);
+	genlmsg_end(msg, hdr);
+	return msg->len;
+nla_put_failure:
+	genlmsg_cancel(msg, hdr);
+	return -EMSGSIZE;
+}
+
+static int swconfig_dump_switches(struct sk_buff *skb,
+		struct netlink_callback *cb)
+{
+	struct switch_dev *dev;
+	int start = cb->args[0];
+	int idx = 0;
+
+	swconfig_lock();
+	list_for_each_entry(dev, &swdevs, dev_list) {
+		if (++idx <= start)
+			continue;
+		if (swconfig_send_switch(skb, NETLINK_CB(cb->skb).portid,
+				cb->nlh->nlmsg_seq, NLM_F_MULTI,
+				dev) < 0)
+			break;
+	}
+	swconfig_unlock();
+	cb->args[0] = idx;
+
+	return skb->len;
+}
+
+static int
+swconfig_done(struct netlink_callback *cb)
+{
+	return 0;
+}
+
+static struct genl_ops swconfig_ops[] = {
+	{
+		.cmd = SWITCH_CMD_LIST_GLOBAL,
+		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+		.doit = swconfig_list_attrs,
+	},
+	{
+		.cmd = SWITCH_CMD_LIST_VLAN,
+		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+		.doit = swconfig_list_attrs,
+	},
+	{
+		.cmd = SWITCH_CMD_LIST_PORT,
+		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+		.doit = swconfig_list_attrs,
+	},
+	{
+		.cmd = SWITCH_CMD_GET_GLOBAL,
+		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+		.doit = swconfig_get_attr,
+	},
+	{
+		.cmd = SWITCH_CMD_GET_VLAN,
+		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+		.doit = swconfig_get_attr,
+	},
+	{
+		.cmd = SWITCH_CMD_GET_PORT,
+		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+		.doit = swconfig_get_attr,
+	},
+	{
+		.cmd = SWITCH_CMD_SET_GLOBAL,
+		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+		.flags = GENL_ADMIN_PERM,
+		.doit = swconfig_set_attr,
+	},
+	{
+		.cmd = SWITCH_CMD_SET_VLAN,
+		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+		.flags = GENL_ADMIN_PERM,
+		.doit = swconfig_set_attr,
+	},
+	{
+		.cmd = SWITCH_CMD_SET_PORT,
+		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+		.flags = GENL_ADMIN_PERM,
+		.doit = swconfig_set_attr,
+	},
+	{
+		.cmd = SWITCH_CMD_GET_SWITCH,
+		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+		.dumpit = swconfig_dump_switches,
+		.done = swconfig_done,
+	}
+};
+
+static struct genl_family switch_fam = {
+	.name = "switch",
+	.hdrsize = 0,
+	.version = 1,
+	.maxattr = SWITCH_ATTR_MAX,
+	.policy = switch_policy,
+	.module = THIS_MODULE,
+	.ops = swconfig_ops,
+	.n_ops = ARRAY_SIZE(swconfig_ops),
+	.resv_start_op = SWITCH_CMD_SET_VLAN + 1,
+};
+
+#ifdef CONFIG_OF
+static void
+of_switch_load_portmap(struct switch_dev *dev)
+{
+	struct device_node *port;
+
+	if (!dev->of_node)
+		return;
+
+	for_each_child_of_node(dev->of_node, port) {
+		const __be32 *prop;
+		const char *segment;
+		int size, phys;
+
+		if (!of_device_is_compatible(port, "swconfig,port"))
+			continue;
+
+		if (of_property_read_string(port, "swconfig,segment", &segment))
+			continue;
+
+		prop = of_get_property(port, "swconfig,portmap", &size);
+		if (!prop)
+			continue;
+
+		if (size != (2 * sizeof(*prop))) {
+			pr_err("%s: failed to parse port mapping\n",
+					port->name);
+			continue;
+		}
+
+		phys = be32_to_cpup(prop++);
+		if ((phys < 0) | (phys >= dev->ports)) {
+			pr_err("%s: physical port index out of range\n",
+					port->name);
+			continue;
+		}
+
+		dev->portmap[phys].s = kstrdup(segment, GFP_KERNEL);
+		dev->portmap[phys].virt = be32_to_cpup(prop);
+		pr_debug("Found port: %s, physical: %d, virtual: %d\n",
+			segment, phys, dev->portmap[phys].virt);
+	}
+}
+#endif
+
+int
+register_switch(struct switch_dev *dev, struct net_device *netdev)
+{
+	struct switch_dev *sdev;
+	const int max_switches = 8 * sizeof(unsigned long);
+	unsigned long in_use = 0;
+	int err;
+	int i;
+
+	INIT_LIST_HEAD(&dev->dev_list);
+	if (netdev) {
+		dev->netdev = netdev;
+		if (!dev->alias)
+			dev->alias = netdev->name;
+	}
+	BUG_ON(!dev->alias);
+
+	/* Make sure swdev_id doesn't overflow */
+	if (swdev_id == INT_MAX) {
+		return -ENOMEM;
+	}
+
+	if (dev->ports > 0) {
+		dev->portbuf = kzalloc(sizeof(struct switch_port) *
+				dev->ports, GFP_KERNEL);
+		if (!dev->portbuf)
+			return -ENOMEM;
+		dev->portmap = kzalloc(sizeof(struct switch_portmap) *
+				dev->ports, GFP_KERNEL);
+		if (!dev->portmap) {
+			kfree(dev->portbuf);
+			return -ENOMEM;
+		}
+	}
+	swconfig_defaults_init(dev);
+	mutex_init(&dev->sw_mutex);
+	swconfig_lock();
+	dev->id = ++swdev_id;
+
+	list_for_each_entry(sdev, &swdevs, dev_list) {
+		if (!sscanf(sdev->devname, SWCONFIG_DEVNAME, &i))
+			continue;
+		if (i < 0 || i > max_switches)
+			continue;
+
+		set_bit(i, &in_use);
+	}
+	i = find_first_zero_bit(&in_use, max_switches);
+
+	if (i == max_switches) {
+		swconfig_unlock();
+		return -ENFILE;
+	}
+
+#ifdef CONFIG_OF
+	if (dev->ports)
+		of_switch_load_portmap(dev);
+#endif
+
+	/* fill device name */
+	snprintf(dev->devname, IFNAMSIZ, SWCONFIG_DEVNAME, i);
+
+	list_add_tail(&dev->dev_list, &swdevs);
+	swconfig_unlock();
+
+	err = swconfig_create_led_trigger(dev);
+	if (err)
+		return err;
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(register_switch);
+
+void
+unregister_switch(struct switch_dev *dev)
+{
+	swconfig_destroy_led_trigger(dev);
+	kfree(dev->portbuf);
+	mutex_lock(&dev->sw_mutex);
+	swconfig_lock();
+	list_del(&dev->dev_list);
+	swconfig_unlock();
+	mutex_unlock(&dev->sw_mutex);
+}
+EXPORT_SYMBOL_GPL(unregister_switch);
+
+int
+switch_generic_set_link(struct switch_dev *dev, int port,
+			struct switch_port_link *link)
+{
+	if (WARN_ON(!dev->ops->phy_write16))
+		return -ENOTSUPP;
+
+	/* Generic implementation */
+	if (link->aneg) {
+		dev->ops->phy_write16(dev, port, MII_BMCR, 0x0000);
+		dev->ops->phy_write16(dev, port, MII_BMCR, BMCR_ANENABLE | BMCR_ANRESTART);
+	} else {
+		u16 bmcr = 0;
+
+		if (link->duplex)
+			bmcr |= BMCR_FULLDPLX;
+
+		switch (link->speed) {
+		case SWITCH_PORT_SPEED_10:
+			break;
+		case SWITCH_PORT_SPEED_100:
+			bmcr |= BMCR_SPEED100;
+			break;
+		case SWITCH_PORT_SPEED_1000:
+			bmcr |= BMCR_SPEED1000;
+			break;
+		default:
+			return -ENOTSUPP;
+		}
+
+		dev->ops->phy_write16(dev, port, MII_BMCR, bmcr);
+	}
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(switch_generic_set_link);
+
+static int __init
+swconfig_init(void)
+{
+	INIT_LIST_HEAD(&swdevs);
+
+	return genl_register_family(&switch_fam);
+}
+
+static void __exit
+swconfig_exit(void)
+{
+	genl_unregister_family(&switch_fam);
+}
+
+module_init(swconfig_init);
+module_exit(swconfig_exit);
diff --git a/6.12/target/linux/generic/files/drivers/net/phy/swconfig_leds.c b/6.12/target/linux/generic/files/drivers/net/phy/swconfig_leds.c
new file mode 100644
index 00000000..1fcd4432
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/net/phy/swconfig_leds.c
@@ -0,0 +1,555 @@
+/*
+ * swconfig_led.c: LED trigger support for the switch configuration API
+ *
+ * Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ */
+
+#ifdef CONFIG_SWCONFIG_LEDS
+
+#include <linux/leds.h>
+#include <linux/ctype.h>
+#include <linux/device.h>
+#include <linux/workqueue.h>
+
+#define SWCONFIG_LED_TIMER_INTERVAL	(HZ / 10)
+#define SWCONFIG_LED_NUM_PORTS		32
+
+#define SWCONFIG_LED_PORT_SPEED_NA	0x01	/* unknown speed */
+#define SWCONFIG_LED_PORT_SPEED_10	0x02	/* 10 Mbps */
+#define SWCONFIG_LED_PORT_SPEED_100	0x04	/* 100 Mbps */
+#define SWCONFIG_LED_PORT_SPEED_1000	0x08	/* 1000 Mbps */
+#define SWCONFIG_LED_PORT_SPEED_ALL	(SWCONFIG_LED_PORT_SPEED_NA | \
+					 SWCONFIG_LED_PORT_SPEED_10 | \
+					 SWCONFIG_LED_PORT_SPEED_100 | \
+					 SWCONFIG_LED_PORT_SPEED_1000)
+
+#define SWCONFIG_LED_MODE_LINK		0x01
+#define SWCONFIG_LED_MODE_TX		0x02
+#define SWCONFIG_LED_MODE_RX		0x04
+#define SWCONFIG_LED_MODE_TXRX		(SWCONFIG_LED_MODE_TX   | \
+					 SWCONFIG_LED_MODE_RX)
+#define SWCONFIG_LED_MODE_ALL		(SWCONFIG_LED_MODE_LINK | \
+					 SWCONFIG_LED_MODE_TX   | \
+					 SWCONFIG_LED_MODE_RX)
+
+struct switch_led_trigger {
+	struct led_trigger trig;
+	struct switch_dev *swdev;
+
+	struct delayed_work sw_led_work;
+	u32 port_mask;
+	u32 port_link;
+	unsigned long long port_tx_traffic[SWCONFIG_LED_NUM_PORTS];
+	unsigned long long port_rx_traffic[SWCONFIG_LED_NUM_PORTS];
+	u8 link_speed[SWCONFIG_LED_NUM_PORTS];
+};
+
+struct swconfig_trig_data {
+	struct led_classdev *led_cdev;
+	struct switch_dev *swdev;
+
+	rwlock_t lock;
+	u32 port_mask;
+
+	bool prev_link;
+	unsigned long prev_traffic;
+	enum led_brightness prev_brightness;
+	u8 mode;
+	u8 speed_mask;
+};
+
+static void
+swconfig_trig_set_brightness(struct swconfig_trig_data *trig_data,
+			     enum led_brightness brightness)
+{
+	led_set_brightness(trig_data->led_cdev, brightness);
+	trig_data->prev_brightness = brightness;
+}
+
+static void
+swconfig_trig_update_port_mask(struct led_trigger *trigger)
+{
+	struct list_head *entry;
+	struct switch_led_trigger *sw_trig;
+	u32 port_mask;
+
+	if (!trigger)
+		return;
+
+	sw_trig = (void *) trigger;
+
+	port_mask = 0;
+	spin_lock(&trigger->leddev_list_lock);
+	list_for_each(entry, &trigger->led_cdevs) {
+		struct led_classdev *led_cdev;
+		struct swconfig_trig_data *trig_data;
+
+		led_cdev = list_entry(entry, struct led_classdev, trig_list);
+		trig_data = led_cdev->trigger_data;
+		if (trig_data) {
+			read_lock(&trig_data->lock);
+			port_mask |= trig_data->port_mask;
+			read_unlock(&trig_data->lock);
+		}
+	}
+	spin_unlock(&trigger->leddev_list_lock);
+
+	sw_trig->port_mask = port_mask;
+
+	if (port_mask)
+		schedule_delayed_work(&sw_trig->sw_led_work,
+				      SWCONFIG_LED_TIMER_INTERVAL);
+	else
+		cancel_delayed_work_sync(&sw_trig->sw_led_work);
+}
+
+static ssize_t
+swconfig_trig_port_mask_store(struct device *dev, struct device_attribute *attr,
+			      const char *buf, size_t size)
+{
+	struct led_classdev *led_cdev = dev_get_drvdata(dev);
+	struct swconfig_trig_data *trig_data = led_cdev->trigger_data;
+	unsigned long port_mask;
+	int ret;
+	bool changed;
+
+	ret = kstrtoul(buf, 0, &port_mask);
+	if (ret)
+		return ret;
+
+	write_lock(&trig_data->lock);
+	changed = (trig_data->port_mask != port_mask);
+	trig_data->port_mask = port_mask;
+	write_unlock(&trig_data->lock);
+
+	if (changed) {
+		if (port_mask == 0)
+			swconfig_trig_set_brightness(trig_data, LED_OFF);
+
+		swconfig_trig_update_port_mask(led_cdev->trigger);
+	}
+
+	return size;
+}
+
+static ssize_t
+swconfig_trig_port_mask_show(struct device *dev, struct device_attribute *attr,
+			     char *buf)
+{
+	struct led_classdev *led_cdev = dev_get_drvdata(dev);
+	struct swconfig_trig_data *trig_data = led_cdev->trigger_data;
+	u32 port_mask;
+
+	read_lock(&trig_data->lock);
+	port_mask = trig_data->port_mask;
+	read_unlock(&trig_data->lock);
+
+	sprintf(buf, "%#x\n", port_mask);
+
+	return strlen(buf) + 1;
+}
+
+static DEVICE_ATTR(port_mask, 0644, swconfig_trig_port_mask_show,
+		   swconfig_trig_port_mask_store);
+
+/* speed_mask file handler - display value */
+static ssize_t swconfig_trig_speed_mask_show(struct device *dev,
+					     struct device_attribute *attr,
+					     char *buf)
+{
+	struct led_classdev *led_cdev = dev_get_drvdata(dev);
+	struct swconfig_trig_data *trig_data = led_cdev->trigger_data;
+	u8 speed_mask;
+
+	read_lock(&trig_data->lock);
+	speed_mask = trig_data->speed_mask;
+	read_unlock(&trig_data->lock);
+
+	sprintf(buf, "%#x\n", speed_mask);
+
+	return strlen(buf) + 1;
+}
+
+/* speed_mask file handler - store value */
+static ssize_t swconfig_trig_speed_mask_store(struct device *dev,
+					      struct device_attribute *attr,
+					      const char *buf, size_t size)
+{
+	struct led_classdev *led_cdev = dev_get_drvdata(dev);
+	struct swconfig_trig_data *trig_data = led_cdev->trigger_data;
+	u8 speed_mask;
+	int ret;
+
+	ret = kstrtou8(buf, 0, &speed_mask);
+	if (ret)
+		return ret;
+
+	write_lock(&trig_data->lock);
+	trig_data->speed_mask = speed_mask & SWCONFIG_LED_PORT_SPEED_ALL;
+	write_unlock(&trig_data->lock);
+
+	return size;
+}
+
+/* speed_mask special file */
+static DEVICE_ATTR(speed_mask, 0644, swconfig_trig_speed_mask_show,
+		   swconfig_trig_speed_mask_store);
+
+static ssize_t swconfig_trig_mode_show(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct led_classdev *led_cdev = dev_get_drvdata(dev);
+	struct swconfig_trig_data *trig_data = led_cdev->trigger_data;
+	u8 mode;
+
+	read_lock(&trig_data->lock);
+	mode = trig_data->mode;
+	read_unlock(&trig_data->lock);
+
+	if (mode == 0) {
+		strcpy(buf, "none\n");
+	} else {
+		if (mode & SWCONFIG_LED_MODE_LINK)
+			strcat(buf, "link ");
+		if (mode & SWCONFIG_LED_MODE_TX)
+			strcat(buf, "tx ");
+		if (mode & SWCONFIG_LED_MODE_RX)
+			strcat(buf, "rx ");
+		strcat(buf, "\n");
+	}
+
+	return strlen(buf)+1;
+}
+
+static ssize_t swconfig_trig_mode_store(struct device *dev,
+		struct device_attribute *attr, const char *buf, size_t size)
+{
+	struct led_classdev *led_cdev = dev_get_drvdata(dev);
+	struct swconfig_trig_data *trig_data = led_cdev->trigger_data;
+	char copybuf[128];
+	int new_mode = -1;
+	char *p, *token;
+
+	/* take a copy since we don't want to trash the inbound buffer when using strsep */
+	strncpy(copybuf, buf, sizeof(copybuf));
+	copybuf[sizeof(copybuf) - 1] = 0;
+	p = copybuf;
+
+	while ((token = strsep(&p, " \t\n")) != NULL) {
+		if (!*token)
+			continue;
+
+		if (new_mode < 0)
+			new_mode = 0;
+
+		if (!strcmp(token, "none"))
+			new_mode = 0;
+		else if (!strcmp(token, "tx"))
+			new_mode |= SWCONFIG_LED_MODE_TX;
+		else if (!strcmp(token, "rx"))
+			new_mode |= SWCONFIG_LED_MODE_RX;
+		else if (!strcmp(token, "link"))
+			new_mode |= SWCONFIG_LED_MODE_LINK;
+		else
+			return -EINVAL;
+	}
+
+	if (new_mode < 0)
+		return -EINVAL;
+
+	write_lock(&trig_data->lock);
+	trig_data->mode = (u8)new_mode;
+	write_unlock(&trig_data->lock);
+
+	return size;
+}
+
+/* mode special file */
+static DEVICE_ATTR(mode, 0644, swconfig_trig_mode_show,
+		   swconfig_trig_mode_store);
+
+static int
+swconfig_trig_activate(struct led_classdev *led_cdev)
+{
+	struct switch_led_trigger *sw_trig;
+	struct swconfig_trig_data *trig_data;
+	int err;
+
+	trig_data = kzalloc(sizeof(struct swconfig_trig_data), GFP_KERNEL);
+	if (!trig_data)
+		return -ENOMEM;
+
+	sw_trig = (void *) led_cdev->trigger;
+
+	rwlock_init(&trig_data->lock);
+	trig_data->led_cdev = led_cdev;
+	trig_data->swdev = sw_trig->swdev;
+	trig_data->speed_mask = SWCONFIG_LED_PORT_SPEED_ALL;
+	trig_data->mode = SWCONFIG_LED_MODE_ALL;
+	led_cdev->trigger_data = trig_data;
+
+	err = device_create_file(led_cdev->dev, &dev_attr_port_mask);
+	if (err)
+		goto err_free;
+
+	err = device_create_file(led_cdev->dev, &dev_attr_speed_mask);
+	if (err)
+		goto err_dev_free;
+
+	err = device_create_file(led_cdev->dev, &dev_attr_mode);
+	if (err)
+		goto err_mode_free;
+
+	return 0;
+
+err_mode_free:
+	device_remove_file(led_cdev->dev, &dev_attr_speed_mask);
+
+err_dev_free:
+	device_remove_file(led_cdev->dev, &dev_attr_port_mask);
+
+err_free:
+	led_cdev->trigger_data = NULL;
+	kfree(trig_data);
+
+	return err;
+}
+
+static void
+swconfig_trig_deactivate(struct led_classdev *led_cdev)
+{
+	struct swconfig_trig_data *trig_data;
+
+	swconfig_trig_update_port_mask(led_cdev->trigger);
+
+	trig_data = (void *) led_cdev->trigger_data;
+	if (trig_data) {
+		device_remove_file(led_cdev->dev, &dev_attr_port_mask);
+		device_remove_file(led_cdev->dev, &dev_attr_speed_mask);
+		device_remove_file(led_cdev->dev, &dev_attr_mode);
+		kfree(trig_data);
+	}
+}
+
+/*
+ * link off -> led off (can't be any other reason to turn it on)
+ * link on:
+ *	mode link: led on by default only if speed matches, else off
+ *	mode txrx: blink only if speed matches, else off
+ */
+static void
+swconfig_trig_led_event(struct switch_led_trigger *sw_trig,
+			struct led_classdev *led_cdev)
+{
+	struct swconfig_trig_data *trig_data;
+	u32 port_mask;
+	bool link;
+	u8 speed_mask, mode;
+	enum led_brightness led_base, led_blink;
+
+	trig_data = led_cdev->trigger_data;
+	if (!trig_data)
+		return;
+
+	read_lock(&trig_data->lock);
+	port_mask = trig_data->port_mask;
+	speed_mask = trig_data->speed_mask;
+	mode = trig_data->mode;
+	read_unlock(&trig_data->lock);
+
+	link = !!(sw_trig->port_link & port_mask);
+	if (!link) {
+		if (trig_data->prev_brightness != LED_OFF)
+			swconfig_trig_set_brightness(trig_data, LED_OFF); /* and stop */
+	}
+	else {
+		unsigned long traffic;
+		int speedok;	/* link speed flag */
+		int i;
+
+		led_base = LED_FULL;
+		led_blink = LED_OFF;
+		traffic = 0;
+		speedok = 0;
+		for (i = 0; i < SWCONFIG_LED_NUM_PORTS; i++) {
+			if (port_mask & (1 << i)) {
+				if (sw_trig->link_speed[i] & speed_mask) {
+					traffic += ((mode & SWCONFIG_LED_MODE_TX) ?
+						    sw_trig->port_tx_traffic[i] : 0) +
+						((mode & SWCONFIG_LED_MODE_RX) ?
+						 sw_trig->port_rx_traffic[i] : 0);
+					speedok = 1;
+				}
+			}
+		}
+
+		if (speedok) {
+			/* At least one port speed matches speed_mask */
+			if (!(mode & SWCONFIG_LED_MODE_LINK)) {
+				led_base = LED_OFF;
+				led_blink = LED_FULL;
+			}
+
+			if (trig_data->prev_brightness != led_base)
+				swconfig_trig_set_brightness(trig_data,
+							     led_base);
+			else if (traffic != trig_data->prev_traffic)
+				swconfig_trig_set_brightness(trig_data,
+							     led_blink);
+		} else if (trig_data->prev_brightness != LED_OFF)
+			swconfig_trig_set_brightness(trig_data, LED_OFF);
+
+		trig_data->prev_traffic = traffic;
+	}
+
+	trig_data->prev_link = link;
+}
+
+static void
+swconfig_trig_update_leds(struct switch_led_trigger *sw_trig)
+{
+	struct list_head *entry;
+	struct led_trigger *trigger;
+
+	trigger = &sw_trig->trig;
+	spin_lock(&trigger->leddev_list_lock);
+	list_for_each(entry, &trigger->led_cdevs) {
+		struct led_classdev *led_cdev;
+
+		led_cdev = list_entry(entry, struct led_classdev, trig_list);
+		swconfig_trig_led_event(sw_trig, led_cdev);
+	}
+	spin_unlock(&trigger->leddev_list_lock);
+}
+
+static void
+swconfig_led_work_func(struct work_struct *work)
+{
+	struct switch_led_trigger *sw_trig;
+	struct switch_dev *swdev;
+	u32 port_mask;
+	u32 link;
+	int i;
+
+	sw_trig = container_of(work, struct switch_led_trigger,
+			       sw_led_work.work);
+
+	port_mask = sw_trig->port_mask;
+	swdev = sw_trig->swdev;
+
+	link = 0;
+	for (i = 0; i < SWCONFIG_LED_NUM_PORTS; i++) {
+		u32 port_bit;
+
+		sw_trig->link_speed[i] = 0;
+
+		port_bit = BIT(i);
+		if ((port_mask & port_bit) == 0)
+			continue;
+
+		if (swdev->ops->get_port_link) {
+			struct switch_port_link port_link;
+
+			memset(&port_link, '\0', sizeof(port_link));
+			swdev->ops->get_port_link(swdev, i, &port_link);
+
+			if (port_link.link) {
+				link |= port_bit;
+				switch (port_link.speed) {
+				case SWITCH_PORT_SPEED_UNKNOWN:
+					sw_trig->link_speed[i] =
+						SWCONFIG_LED_PORT_SPEED_NA;
+					break;
+				case SWITCH_PORT_SPEED_10:
+					sw_trig->link_speed[i] =
+						SWCONFIG_LED_PORT_SPEED_10;
+					break;
+				case SWITCH_PORT_SPEED_100:
+					sw_trig->link_speed[i] =
+						SWCONFIG_LED_PORT_SPEED_100;
+					break;
+				case SWITCH_PORT_SPEED_1000:
+					sw_trig->link_speed[i] =
+						SWCONFIG_LED_PORT_SPEED_1000;
+					break;
+				}
+			}
+		}
+
+		if (swdev->ops->get_port_stats) {
+			struct switch_port_stats port_stats;
+
+			memset(&port_stats, '\0', sizeof(port_stats));
+			swdev->ops->get_port_stats(swdev, i, &port_stats);
+			sw_trig->port_tx_traffic[i] = port_stats.tx_bytes;
+			sw_trig->port_rx_traffic[i] = port_stats.rx_bytes;
+		}
+	}
+
+	sw_trig->port_link = link;
+
+	swconfig_trig_update_leds(sw_trig);
+
+	schedule_delayed_work(&sw_trig->sw_led_work,
+			      SWCONFIG_LED_TIMER_INTERVAL);
+}
+
+static int
+swconfig_create_led_trigger(struct switch_dev *swdev)
+{
+	struct switch_led_trigger *sw_trig;
+	int err;
+
+	if (!swdev->ops->get_port_link)
+		return 0;
+
+	sw_trig = kzalloc(sizeof(struct switch_led_trigger), GFP_KERNEL);
+	if (!sw_trig)
+		return -ENOMEM;
+
+	sw_trig->swdev = swdev;
+	sw_trig->trig.name = swdev->devname;
+	sw_trig->trig.activate = swconfig_trig_activate;
+	sw_trig->trig.deactivate = swconfig_trig_deactivate;
+
+	INIT_DELAYED_WORK(&sw_trig->sw_led_work, swconfig_led_work_func);
+
+	err = led_trigger_register(&sw_trig->trig);
+	if (err)
+		goto err_free;
+
+	swdev->led_trigger = sw_trig;
+
+	return 0;
+
+err_free:
+	kfree(sw_trig);
+	return err;
+}
+
+static void
+swconfig_destroy_led_trigger(struct switch_dev *swdev)
+{
+	struct switch_led_trigger *sw_trig;
+
+	sw_trig = swdev->led_trigger;
+	if (sw_trig) {
+		cancel_delayed_work_sync(&sw_trig->sw_led_work);
+		led_trigger_unregister(&sw_trig->trig);
+		kfree(sw_trig);
+	}
+}
+
+#else /* SWCONFIG_LEDS */
+static inline int
+swconfig_create_led_trigger(struct switch_dev *swdev) { return 0; }
+
+static inline void
+swconfig_destroy_led_trigger(struct switch_dev *swdev) { }
+#endif /* CONFIG_SWCONFIG_LEDS */
diff --git a/6.12/target/linux/generic/files/drivers/platform/mikrotik/Kconfig b/6.12/target/linux/generic/files/drivers/platform/mikrotik/Kconfig
new file mode 100644
index 00000000..85fe7b20
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/platform/mikrotik/Kconfig
@@ -0,0 +1,31 @@
+menuconfig MIKROTIK
+	bool "Platform support for MikroTik RouterBoard virtual devices"
+	help
+	  Say Y here to get to see options for the MikroTik RouterBoard platform.
+	  This option alone does not add any kernel code.
+
+
+if MIKROTIK
+
+config MIKROTIK_RB_SYSFS
+	tristate "RouterBoot sysfs support"
+	depends on MTD
+	select LZO_DECOMPRESS
+	select CRC32
+	help
+	  This driver exposes RouterBoot configuration in sysfs.
+
+config NVMEM_LAYOUT_MIKROTIK
+	tristate "RouterBoot NVMEM layout support"
+	depends on NVMEM_LAYOUTS
+	help
+	  This driver exposes MikroTik hard_config via NVMEM layout.
+
+config MIKROTIK_WLAN_DECOMPRESS_LZ77
+	tristate "Mikrotik factory Wi-Fi caldata LZ77 decompression support"
+	depends on MIKROTIK_RB_SYSFS
+	help
+	  Allow Mikrotik LZ77 factory flashed Wi-Fi calibration data to be
+	  decompressed
+
+endif # MIKROTIK
diff --git a/6.12/target/linux/generic/files/drivers/platform/mikrotik/Makefile b/6.12/target/linux/generic/files/drivers/platform/mikrotik/Makefile
new file mode 100644
index 00000000..9ffb355c
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/platform/mikrotik/Makefile
@@ -0,0 +1,6 @@
+#
+# Makefile for MikroTik RouterBoard platform specific drivers
+#
+obj-$(CONFIG_MIKROTIK_RB_SYSFS)     += routerboot.o rb_hardconfig.o rb_softconfig.o
+obj-$(CONFIG_NVMEM_LAYOUT_MIKROTIK)     += rb_nvmem.o
+obj-$(CONFIG_MIKROTIK_WLAN_DECOMPRESS_LZ77)  += rb_lz77.o
diff --git a/6.12/target/linux/generic/files/drivers/platform/mikrotik/rb_hardconfig.c b/6.12/target/linux/generic/files/drivers/platform/mikrotik/rb_hardconfig.c
new file mode 100644
index 00000000..4c1edad0
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/platform/mikrotik/rb_hardconfig.c
@@ -0,0 +1,844 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Driver for MikroTik RouterBoot hard config.
+ *
+ * Copyright (C) 2020 Thibaut VARÈNE <hacks+kernel@slashdirt.org>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ *
+ * This driver exposes the data encoded in the "hard_config" flash segment of
+ * MikroTik RouterBOARDs devices. It presents the data in a sysfs folder
+ * named "hard_config". The WLAN calibration data is available on demand via
+ * the 'wlan_data' sysfs file in that folder.
+ *
+ * This driver permanently allocates a chunk of RAM as large as the hard_config
+ * MTD partition, although it is technically possible to operate entirely from
+ * the MTD device without using a local buffer (except when requesting WLAN
+ * calibration data), at the cost of a performance penalty.
+ *
+ * Note: PAGE_SIZE is assumed to be >= 4K, hence the device attribute show
+ * routines need not check for output overflow.
+ *
+ * Some constant defines extracted from routerboot.{c,h} by Gabor Juhos
+ * <juhosg@openwrt.org>
+ */
+
+#include <linux/types.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/errno.h>
+#include <linux/kobject.h>
+#include <linux/bitops.h>
+#include <linux/string.h>
+#include <linux/mtd/mtd.h>
+#include <linux/sysfs.h>
+#include <linux/lzo.h>
+
+#include "rb_hardconfig.h"
+#include "routerboot.h"
+#include "rb_lz77.h"
+
+#define RB_HARDCONFIG_VER		"0.08"
+#define RB_HC_PR_PFX			"[rb_hardconfig] "
+
+/* Bit definitions for hardware options */
+#define RB_HW_OPT_NO_UART		BIT(0)
+#define RB_HW_OPT_HAS_VOLTAGE		BIT(1)
+#define RB_HW_OPT_HAS_USB		BIT(2)
+#define RB_HW_OPT_HAS_ATTINY		BIT(3)
+#define RB_HW_OPT_PULSE_DUTY_CYCLE	BIT(9)
+#define RB_HW_OPT_NO_NAND		BIT(14)
+#define RB_HW_OPT_HAS_LCD		BIT(15)
+#define RB_HW_OPT_HAS_POE_OUT		BIT(16)
+#define RB_HW_OPT_HAS_uSD		BIT(17)
+#define RB_HW_OPT_HAS_SIM		BIT(18)
+#define RB_HW_OPT_HAS_SFP		BIT(20)
+#define RB_HW_OPT_HAS_WIFI		BIT(21)
+#define RB_HW_OPT_HAS_TS_FOR_ADC	BIT(22)
+#define RB_HW_OPT_HAS_PLC		BIT(29)
+
+/*
+ * Tag ID values for ERD data.
+ * Mikrotik used to pack all calibration data under a single tag id 0x1, but
+ * recently switched to a new scheme where each radio calibration gets a
+ * separate tag. The new scheme has tag id bit 15 always set and seems to be
+ * mutually exclusive with the old scheme.
+ */
+#define RB_WLAN_ERD_ID_SOLO		0x0001
+#define RB_WLAN_ERD_ID_MULTI_8001	0x8001
+#define RB_WLAN_ERD_ID_MULTI_8201	0x8201
+
+static struct kobject *hc_kobj;
+static u8 *hc_buf;		// ro buffer after init(): no locking required
+static size_t hc_buflen;
+
+/*
+ * For LZOR style WLAN data unpacking.
+ * This binary blob is prepended to the data encoded on some devices as
+ * RB_ID_WLAN_DATA, the result is then first decompressed with LZO, and then
+ * finally RLE-decoded.
+ * This binary blob has been extracted from RouterOS by
+ * https://forum.openwrt.org/u/ius
+ */
+static const u8 hc_lzor_prefix[] = {
+	0x00, 0x05, 0x4c, 0x4c, 0x44, 0x00, 0x34, 0xfe,
+	0xfe, 0x34, 0x11, 0x3c, 0x1e, 0x3c, 0x2e, 0x3c,
+	0x4c, 0x34, 0x00, 0x52, 0x62, 0x92, 0xa2, 0xb2,
+	0xc3, 0x2a, 0x14, 0x00, 0x00, 0x05, 0xfe, 0x6a,
+	0x3c, 0x16, 0x32, 0x16, 0x11, 0x1e, 0x12, 0x46,
+	0x32, 0x46, 0x11, 0x4e, 0x12, 0x36, 0x32, 0x36,
+	0x11, 0x3e, 0x12, 0x5a, 0x9a, 0x64, 0x00, 0x04,
+	0xfe, 0x10, 0x3c, 0x00, 0x01, 0x00, 0x00, 0x28,
+	0x0c, 0x00, 0x0f, 0xfe, 0x14, 0x00, 0x24, 0x24,
+	0x23, 0x24, 0x24, 0x23, 0x25, 0x22, 0x21, 0x21,
+	0x23, 0x22, 0x21, 0x22, 0x21, 0x2d, 0x38, 0x00,
+	0x0c, 0x25, 0x25, 0x24, 0x25, 0x25, 0x24, 0x23,
+	0x22, 0x21, 0x20, 0x23, 0x21, 0x21, 0x22, 0x21,
+	0x2d, 0x38, 0x00, 0x28, 0xb0, 0x00, 0x00, 0x22,
+	0x00, 0x00, 0xc0, 0xfe, 0x03, 0x00, 0xc0, 0x00,
+	0x62, 0xff, 0x62, 0xff, 0xfe, 0x06, 0x00, 0xbb,
+	0xff, 0xba, 0xff, 0xfe, 0x08, 0x00, 0x9e, 0xff,
+	0xfe, 0x0a, 0x00, 0x53, 0xff, 0xfe, 0x02, 0x00,
+	0x20, 0xff, 0xb1, 0xfe, 0xfe, 0xb2, 0xfe, 0xfe,
+	0xed, 0xfe, 0xfe, 0xfe, 0x04, 0x00, 0x3a, 0xff,
+	0x3a, 0xff, 0xde, 0xfd, 0x5f, 0x04, 0x33, 0xff,
+	0x4c, 0x74, 0x03, 0x05, 0x05, 0xff, 0x6d, 0xfe,
+	0xfe, 0x6d, 0xfe, 0xfe, 0xaf, 0x08, 0x63, 0xff,
+	0x64, 0x6f, 0x08, 0xac, 0xff, 0xbf, 0x6d, 0x08,
+	0x7a, 0x6d, 0x08, 0x96, 0x74, 0x04, 0x00, 0x08,
+	0x79, 0xff, 0xda, 0xfe, 0xfe, 0xdb, 0xfe, 0xfe,
+	0x56, 0xff, 0xfe, 0x04, 0x00, 0x5e, 0xff, 0x5e,
+	0xff, 0x6c, 0xfe, 0xfe, 0xfe, 0x06, 0x00, 0x41,
+	0xff, 0x7f, 0x74, 0x03, 0x00, 0x11, 0x44, 0xff,
+	0xa9, 0xfe, 0xfe, 0xa9, 0xfe, 0xfe, 0xa5, 0x8f,
+	0x01, 0x00, 0x08, 0x01, 0x01, 0x02, 0x04, 0x08,
+	0x02, 0x04, 0x08, 0x08, 0x01, 0x01, 0xfe, 0x22,
+	0x00, 0x4c, 0x60, 0x64, 0x8c, 0x90, 0xd0, 0xd4,
+	0xd8, 0x5c, 0x10, 0x09, 0xd8, 0xff, 0xb0, 0xff,
+	0x00, 0x00, 0xba, 0xff, 0x14, 0x00, 0xba, 0xff,
+	0x64, 0x00, 0x00, 0x08, 0xfe, 0x06, 0x00, 0x74,
+	0xff, 0x42, 0xff, 0xce, 0xff, 0x60, 0xff, 0x0a,
+	0x00, 0xb4, 0x00, 0xa0, 0x00, 0xa0, 0xfe, 0x07,
+	0x00, 0x0a, 0x00, 0xb0, 0xff, 0x96, 0x4d, 0x00,
+	0x56, 0x57, 0x18, 0xa6, 0xff, 0x92, 0x70, 0x11,
+	0x00, 0x12, 0x90, 0x90, 0x76, 0x5a, 0x54, 0x54,
+	0x4c, 0x46, 0x38, 0x00, 0x10, 0x10, 0x08, 0xfe,
+	0x05, 0x00, 0x38, 0x29, 0x25, 0x23, 0x22, 0x22,
+	0x1f, 0x00, 0x00, 0x00, 0xf6, 0xe1, 0xdd, 0xf8,
+	0xfe, 0x00, 0xfe, 0x15, 0x00, 0x00, 0xd0, 0x02,
+	0x74, 0x02, 0x08, 0xf8, 0xe5, 0xde, 0x02, 0x04,
+	0x04, 0xfd, 0x00, 0x00, 0x00, 0x07, 0x50, 0x2d,
+	0x01, 0x90, 0x90, 0x76, 0x60, 0xb0, 0x07, 0x07,
+	0x0c, 0x0c, 0x04, 0xfe, 0x05, 0x00, 0x66, 0x66,
+	0x5a, 0x56, 0xbc, 0x01, 0x06, 0xfc, 0xfc, 0xf1,
+	0xfe, 0x07, 0x00, 0x24, 0x95, 0x70, 0x64, 0x18,
+	0x06, 0x2c, 0xff, 0xb5, 0xfe, 0xfe, 0xb5, 0xfe,
+	0xfe, 0xe2, 0x8c, 0x24, 0x02, 0x2f, 0xff, 0x2f,
+	0xff, 0xb4, 0x78, 0x02, 0x05, 0x73, 0xff, 0xed,
+	0xfe, 0xfe, 0x4f, 0xff, 0x36, 0x74, 0x1e, 0x09,
+	0x4f, 0xff, 0x50, 0xff, 0xfe, 0x16, 0x00, 0x70,
+	0xac, 0x70, 0x8e, 0xac, 0x40, 0x0e, 0x01, 0x70,
+	0x7f, 0x8e, 0xac, 0x6c, 0x00, 0x0b, 0xfe, 0x02,
+	0x00, 0xfe, 0x0a, 0x2c, 0x2a, 0x2a, 0x28, 0x26,
+	0x1e, 0x1e, 0xfe, 0x02, 0x20, 0x65, 0x20, 0x00,
+	0x00, 0x05, 0x12, 0x00, 0x11, 0x1e, 0x11, 0x11,
+	0x41, 0x1e, 0x41, 0x11, 0x31, 0x1e, 0x31, 0x11,
+	0x70, 0x75, 0x7a, 0x7f, 0x84, 0x89, 0x8e, 0x93,
+	0x98, 0x30, 0x20, 0x00, 0x02, 0x00, 0xfe, 0x06,
+	0x3c, 0xbc, 0x32, 0x0c, 0x00, 0x00, 0x2a, 0x12,
+	0x1e, 0x12, 0x2e, 0x12, 0xcc, 0x12, 0x11, 0x1a,
+	0x1e, 0x1a, 0x2e, 0x1a, 0x4c, 0x10, 0x1e, 0x10,
+	0x11, 0x18, 0x1e, 0x42, 0x1e, 0x42, 0x2e, 0x42,
+	0xcc, 0x42, 0x11, 0x4a, 0x1e, 0x4a, 0x2e, 0x4a,
+	0x4c, 0x40, 0x1e, 0x40, 0x11, 0x48, 0x1e, 0x32,
+	0x1e, 0x32, 0x2e, 0x32, 0xcc, 0x32, 0x11, 0x3a,
+	0x1e, 0x3a, 0x2e, 0x3a, 0x4c, 0x30, 0x1e, 0x30,
+	0x11, 0x38, 0x1e, 0x27, 0x9a, 0x01, 0x9d, 0xa2,
+	0x2f, 0x28, 0x00, 0x00, 0x46, 0xde, 0xc4, 0xbf,
+	0xa6, 0x9d, 0x81, 0x7b, 0x5c, 0x61, 0x40, 0xc7,
+	0xc0, 0xae, 0xa9, 0x8c, 0x83, 0x6a, 0x62, 0x50,
+	0x3e, 0xce, 0xc2, 0xae, 0xa3, 0x8c, 0x7b, 0x6a,
+	0x5a, 0x50, 0x35, 0xd7, 0xc2, 0xb7, 0xa4, 0x95,
+	0x7e, 0x72, 0x5a, 0x59, 0x37, 0xfe, 0x02, 0xf8,
+	0x8c, 0x95, 0x90, 0x8f, 0x00, 0xd7, 0xc0, 0xb7,
+	0xa2, 0x95, 0x7b, 0x72, 0x56, 0x59, 0x32, 0xc7,
+	0xc3, 0xae, 0xad, 0x8c, 0x85, 0x6a, 0x63, 0x50,
+	0x3e, 0xce, 0xc3, 0xae, 0xa4, 0x8c, 0x7c, 0x6a,
+	0x59, 0x50, 0x34, 0xd7, 0xc2, 0xb7, 0xa5, 0x95,
+	0x7e, 0x72, 0x59, 0x59, 0x36, 0xfc, 0x05, 0x00,
+	0x02, 0xce, 0xc5, 0xae, 0xa5, 0x95, 0x83, 0x72,
+	0x5c, 0x59, 0x36, 0xbf, 0xc6, 0xa5, 0xab, 0x8c,
+	0x8c, 0x6a, 0x67, 0x50, 0x41, 0x64, 0x07, 0x00,
+	0x02, 0x95, 0x8c, 0x72, 0x65, 0x59, 0x3f, 0xce,
+	0xc7, 0xae, 0xa8, 0x95, 0x86, 0x72, 0x5f, 0x59,
+	0x39, 0xfe, 0x02, 0xf8, 0x8b, 0x7c, 0x0b, 0x09,
+	0xb7, 0xc2, 0x9d, 0xa4, 0x83, 0x85, 0x6a, 0x6b,
+	0x50, 0x44, 0xb7, 0xc1, 0x64, 0x01, 0x00, 0x06,
+	0x61, 0x5d, 0x48, 0x3d, 0xae, 0xc4, 0x9d, 0xad,
+	0x7b, 0x85, 0x61, 0x66, 0x48, 0x46, 0xae, 0xc3,
+	0x95, 0xa3, 0x72, 0x7c, 0x59, 0x56, 0x38, 0x31,
+	0x7c, 0x0b, 0x00, 0x0c, 0x96, 0x91, 0x8f, 0x00,
+	0xb7, 0xc0, 0xa5, 0xab, 0x8c, 0x8a, 0x6a, 0x64,
+	0x50, 0x3c, 0xb7, 0xc0, 0x9d, 0xa0, 0x83, 0x80,
+	0x6a, 0x64, 0x50, 0x3d, 0xb7, 0xc5, 0x9d, 0xa5,
+	0x83, 0x87, 0x6c, 0x08, 0x07, 0xae, 0xc0, 0x9d,
+	0xa8, 0x83, 0x88, 0x6a, 0x6d, 0x50, 0x46, 0xfc,
+	0x05, 0x00, 0x16, 0xbf, 0xc0, 0xa5, 0xa2, 0x8c,
+	0x7f, 0x6a, 0x57, 0x50, 0x2f, 0xb7, 0xc7, 0xa5,
+	0xb1, 0x8c, 0x8e, 0x72, 0x6d, 0x59, 0x45, 0xbf,
+	0xc6, 0xa5, 0xa8, 0x8c, 0x87, 0x6a, 0x5f, 0x50,
+	0x37, 0xbf, 0xc2, 0xa5, 0xa4, 0x8c, 0x83, 0x6a,
+	0x5c, 0x50, 0x34, 0xbc, 0x05, 0x00, 0x0e, 0x90,
+	0x00, 0xc7, 0xc2, 0xae, 0xaa, 0x95, 0x82, 0x7b,
+	0x60, 0x61, 0x3f, 0xb7, 0xc6, 0xa5, 0xb1, 0x8c,
+	0x8d, 0x72, 0x6b, 0x61, 0x51, 0xbf, 0xc4, 0xa5,
+	0xa5, 0x8c, 0x82, 0x72, 0x61, 0x59, 0x39, 0x6c,
+	0x26, 0x03, 0x95, 0x82, 0x7b, 0x61, 0x61, 0x40,
+	0xfc, 0x05, 0x00, 0x00, 0x7e, 0xd7, 0xc3, 0xb7,
+	0xa8, 0x9d, 0x80, 0x83, 0x5d, 0x6a, 0x3f, 0xbf,
+	0xc7, 0xa5, 0xa8, 0x8c, 0x84, 0x72, 0x60, 0x61,
+	0x46, 0xbf, 0xc2, 0xae, 0xb0, 0x9d, 0x92, 0x83,
+	0x6f, 0x6a, 0x50, 0xd7, 0xc3, 0xb7, 0xa7, 0x9d,
+	0x80, 0x83, 0x5e, 0x6a, 0x40, 0xfe, 0x02, 0xf8,
+	0x8d, 0x96, 0x90, 0x90, 0xfe, 0x05, 0x00, 0x8a,
+	0xc4, 0x63, 0xb8, 0x3c, 0xa6, 0x29, 0x97, 0x16,
+	0x81, 0x84, 0xb7, 0x5b, 0xa9, 0x33, 0x94, 0x1e,
+	0x83, 0x11, 0x70, 0xb8, 0xc2, 0x70, 0xb1, 0x4d,
+	0xa3, 0x2a, 0x8d, 0x1b, 0x7b, 0xa8, 0xbc, 0x68,
+	0xab, 0x47, 0x9d, 0x27, 0x87, 0x18, 0x75, 0xae,
+	0xc6, 0x7d, 0xbb, 0x4d, 0xaa, 0x1c, 0x84, 0x11,
+	0x72, 0xa3, 0xbb, 0x6e, 0xad, 0x3c, 0x97, 0x24,
+	0x85, 0x16, 0x71, 0x80, 0xb2, 0x57, 0xa4, 0x30,
+	0x8e, 0x1c, 0x7c, 0x10, 0x68, 0xbb, 0xbd, 0x75,
+	0xac, 0x4f, 0x9e, 0x2b, 0x87, 0x1a, 0x76, 0x96,
+	0xc5, 0x5e, 0xb5, 0x3e, 0xa5, 0x1f, 0x8c, 0x12,
+	0x7a, 0xc1, 0xc6, 0x42, 0x9f, 0x27, 0x8c, 0x16,
+	0x77, 0x0f, 0x67, 0x9d, 0xbc, 0x68, 0xad, 0x36,
+	0x95, 0x20, 0x83, 0x11, 0x6d, 0x9b, 0xb8, 0x67,
+	0xa8, 0x34, 0x90, 0x1f, 0x7c, 0x10, 0x67, 0x9e,
+	0xc9, 0x6a, 0xbb, 0x37, 0xa4, 0x20, 0x90, 0x11,
+	0x7b, 0xc6, 0xc8, 0x47, 0xa4, 0x2a, 0x90, 0x18,
+	0x7b, 0x10, 0x6c, 0xae, 0xc4, 0x5d, 0xad, 0x37,
+	0x9a, 0x1f, 0x85, 0x13, 0x75, 0x70, 0xad, 0x42,
+	0x99, 0x25, 0x84, 0x17, 0x74, 0x0b, 0x56, 0x87,
+	0xc8, 0x57, 0xb8, 0x2b, 0x9e, 0x19, 0x8a, 0x0d,
+	0x74, 0xa7, 0xc8, 0x6e, 0xb9, 0x36, 0xa0, 0x1f,
+	0x8b, 0x11, 0x75, 0x94, 0xbe, 0x4b, 0xa5, 0x2a,
+	0x92, 0x18, 0x7c, 0x0f, 0x6b, 0xaf, 0xc0, 0x58,
+	0xa8, 0x34, 0x94, 0x1d, 0x7d, 0x12, 0x6d, 0x82,
+	0xc0, 0x52, 0xb0, 0x25, 0x94, 0x14, 0x7f, 0x0c,
+	0x68, 0x84, 0xbf, 0x3e, 0xa4, 0x22, 0x8e, 0x10,
+	0x76, 0x0b, 0x65, 0x88, 0xb6, 0x42, 0x9b, 0x26,
+	0x87, 0x14, 0x70, 0x0c, 0x5f, 0xc5, 0xc2, 0x3e,
+	0x97, 0x23, 0x83, 0x13, 0x6c, 0x0c, 0x5c, 0xb1,
+	0xc9, 0x76, 0xbc, 0x4a, 0xaa, 0x20, 0x8d, 0x12,
+	0x78, 0x93, 0xbf, 0x46, 0xa3, 0x26, 0x8d, 0x14,
+	0x74, 0x0c, 0x62, 0xc8, 0xc4, 0x3b, 0x97, 0x21,
+	0x82, 0x11, 0x6a, 0x0a, 0x59, 0xa3, 0xb9, 0x68,
+	0xa9, 0x30, 0x8d, 0x1a, 0x78, 0x0f, 0x61, 0xa0,
+	0xc9, 0x73, 0xbe, 0x50, 0xb1, 0x30, 0x9f, 0x14,
+	0x80, 0x83, 0xb7, 0x3c, 0x9a, 0x20, 0x84, 0x0e,
+	0x6a, 0x0a, 0x57, 0xac, 0xc2, 0x68, 0xb0, 0x2e,
+	0x92, 0x19, 0x7c, 0x0d, 0x63, 0x93, 0xbe, 0x62,
+	0xb0, 0x3c, 0x9e, 0x1a, 0x80, 0x0e, 0x6b, 0xbb,
+	0x02, 0xa0, 0x02, 0xa0, 0x02, 0x6f, 0x00, 0x75,
+	0x00, 0x75, 0x00, 0x00, 0x00, 0xad, 0x02, 0xb3,
+	0x02, 0x6f, 0x00, 0x87, 0x00, 0x85, 0xfe, 0x03,
+	0x00, 0xc2, 0x02, 0x82, 0x4d, 0x92, 0x6e, 0x4d,
+	0xb1, 0xa8, 0x84, 0x01, 0x00, 0x07, 0x7e, 0x00,
+	0xa8, 0x02, 0xa4, 0x02, 0xa4, 0x02, 0xa2, 0x00,
+	0xa6, 0x00, 0xa6, 0x00, 0x00, 0x00, 0xb4, 0x02,
+	0xb4, 0x02, 0x92, 0x00, 0x96, 0x00, 0x96, 0x46,
+	0x04, 0xb0, 0x02, 0x64, 0x02, 0x0a, 0x8c, 0x00,
+	0x90, 0x02, 0x98, 0x02, 0x98, 0x02, 0x0e, 0x01,
+	0x11, 0x01, 0x11, 0x50, 0xc3, 0x08, 0x88, 0x02,
+	0x88, 0x02, 0x19, 0x01, 0x02, 0x01, 0x02, 0x01,
+	0xf3, 0x2d, 0x00, 0x00
+};
+
+/* Array of known hw_options bits with human-friendly parsing */
+static struct hc_hwopt {
+	const u32 bit;
+	const char *str;
+} const hc_hwopts[] = {
+	{
+		.bit = RB_HW_OPT_NO_UART,
+		.str = "no UART\t\t",
+	}, {
+		.bit = RB_HW_OPT_HAS_VOLTAGE,
+		.str = "has Vreg\t",
+	}, {
+		.bit = RB_HW_OPT_HAS_USB,
+		.str = "has usb\t\t",
+	}, {
+		.bit = RB_HW_OPT_HAS_ATTINY,
+		.str = "has ATtiny\t",
+	}, {
+		.bit = RB_HW_OPT_NO_NAND,
+		.str = "no NAND\t\t",
+	}, {
+		.bit = RB_HW_OPT_HAS_LCD,
+		.str = "has LCD\t\t",
+	}, {
+		.bit = RB_HW_OPT_HAS_POE_OUT,
+		.str = "has POE out\t",
+	}, {
+		.bit = RB_HW_OPT_HAS_uSD,
+		.str = "has MicroSD\t",
+	}, {
+		.bit = RB_HW_OPT_HAS_SIM,
+		.str = "has SIM\t\t",
+	}, {
+		.bit = RB_HW_OPT_HAS_SFP,
+		.str = "has SFP\t\t",
+	}, {
+		.bit = RB_HW_OPT_HAS_WIFI,
+		.str = "has WiFi\t",
+	}, {
+		.bit = RB_HW_OPT_HAS_TS_FOR_ADC,
+		.str = "has TS ADC\t",
+	}, {
+		.bit = RB_HW_OPT_HAS_PLC,
+		.str = "has PLC\t\t",
+	},
+};
+
+/*
+ * The MAC is stored network-endian on all devices, in 2 32-bit segments:
+ * <XX:XX:XX:XX> <XX:XX:00:00>. Kernel print has us covered.
+ */
+static ssize_t hc_tag_show_mac(const u8 *pld, u16 pld_len, char *buf)
+{
+	if (8 != pld_len)
+		return -EINVAL;
+
+	return sprintf(buf, "%pM\n", pld);
+}
+
+/*
+ * Print HW options in a human readable way:
+ * The raw number and in decoded form
+ */
+static ssize_t hc_tag_show_hwoptions(const u8 *pld, u16 pld_len, char *buf)
+{
+	char *out = buf;
+	u32 data;	// cpu-endian
+	int i;
+
+	if (sizeof(data) != pld_len)
+		return -EINVAL;
+
+	data = *(u32 *)pld;
+	out += sprintf(out, "raw\t\t: 0x%08x\n\n", data);
+
+	for (i = 0; i < ARRAY_SIZE(hc_hwopts); i++)
+		out += sprintf(out, "%s: %s\n", hc_hwopts[i].str,
+			       (data & hc_hwopts[i].bit) ? "true" : "false");
+
+	return out - buf;
+}
+
+static ssize_t hc_wlan_data_bin_read(struct file *filp, struct kobject *kobj,
+				     struct bin_attribute *attr, char *buf,
+				     loff_t off, size_t count);
+
+static struct hc_wlan_attr {
+	const u16 erd_tag_id;
+	struct bin_attribute battr;
+	u16 pld_ofs;
+	u16 pld_len;
+} hc_wd_multi_battrs[] = {
+	{
+		.erd_tag_id = RB_WLAN_ERD_ID_MULTI_8001,
+		.battr = __BIN_ATTR(data_0, S_IRUSR, hc_wlan_data_bin_read, NULL, 0),
+	}, {
+		.erd_tag_id = RB_WLAN_ERD_ID_MULTI_8201,
+		.battr = __BIN_ATTR(data_2, S_IRUSR, hc_wlan_data_bin_read, NULL, 0),
+	}
+};
+
+static struct hc_wlan_attr hc_wd_solo_battr = {
+	.erd_tag_id = RB_WLAN_ERD_ID_SOLO,
+	.battr = __BIN_ATTR(wlan_data, S_IRUSR, hc_wlan_data_bin_read, NULL, 0),
+};
+
+static ssize_t hc_attr_show(struct kobject *kobj, struct kobj_attribute *attr,
+			    char *buf);
+
+/* Array of known tags to publish in sysfs */
+static struct hc_attr {
+	const u16 tag_id;
+	ssize_t (* const tshow)(const u8 *pld, u16 pld_len, char *buf);
+	struct kobj_attribute kattr;
+	u16 pld_ofs;
+	u16 pld_len;
+} hc_attrs[] = {
+	{
+		.tag_id = RB_ID_FLASH_INFO,
+		.tshow = routerboot_tag_show_u32s,
+		.kattr = __ATTR(flash_info, S_IRUSR, hc_attr_show, NULL),
+	}, {
+		.tag_id = RB_ID_MAC_ADDRESS_PACK,
+		.tshow = hc_tag_show_mac,
+		.kattr = __ATTR(mac_base, S_IRUSR, hc_attr_show, NULL),
+	}, {
+		.tag_id = RB_ID_BOARD_PRODUCT_CODE,
+		.tshow = routerboot_tag_show_string,
+		.kattr = __ATTR(board_product_code, S_IRUSR, hc_attr_show, NULL),
+	}, {
+		.tag_id = RB_ID_BIOS_VERSION,
+		.tshow = routerboot_tag_show_string,
+		.kattr = __ATTR(booter_version, S_IRUSR, hc_attr_show, NULL),
+	}, {
+		.tag_id = RB_ID_SERIAL_NUMBER,
+		.tshow = routerboot_tag_show_string,
+		.kattr = __ATTR(board_serial, S_IRUSR, hc_attr_show, NULL),
+	}, {
+		.tag_id = RB_ID_MEMORY_SIZE,
+		.tshow = routerboot_tag_show_u32s,
+		.kattr = __ATTR(mem_size, S_IRUSR, hc_attr_show, NULL),
+	}, {
+		.tag_id = RB_ID_MAC_ADDRESS_COUNT,
+		.tshow = routerboot_tag_show_u32s,
+		.kattr = __ATTR(mac_count, S_IRUSR, hc_attr_show, NULL),
+	}, {
+		.tag_id = RB_ID_HW_OPTIONS,
+		.tshow = hc_tag_show_hwoptions,
+		.kattr = __ATTR(hw_options, S_IRUSR, hc_attr_show, NULL),
+	}, {
+		.tag_id = RB_ID_WLAN_DATA,
+		.tshow = NULL,
+	}, {
+		.tag_id = RB_ID_BOARD_IDENTIFIER,
+		.tshow = routerboot_tag_show_string,
+		.kattr = __ATTR(board_identifier, S_IRUSR, hc_attr_show, NULL),
+	}, {
+		.tag_id = RB_ID_PRODUCT_NAME,
+		.tshow = routerboot_tag_show_string,
+		.kattr = __ATTR(product_name, S_IRUSR, hc_attr_show, NULL),
+	}, {
+		.tag_id = RB_ID_DEFCONF,
+		.tshow = routerboot_tag_show_string,
+		.kattr = __ATTR(defconf, S_IRUSR, hc_attr_show, NULL),
+	}, {
+		.tag_id = RB_ID_BOARD_REVISION,
+		.tshow = routerboot_tag_show_string,
+		.kattr = __ATTR(board_revision, S_IRUSR, hc_attr_show, NULL),
+	}
+};
+
+/*
+ * If the RB_ID_WLAN_DATA payload starts with RB_MAGIC_ERD, then past
+ * that magic number the payload itself contains a routerboot tag node
+ * locating the LZO-compressed calibration data. So far this scheme is only
+ * known to use a single tag at id 0x1.
+ */
+static int hc_wlan_data_unpack_erd(const u16 tag_id, const u8 *inbuf, size_t inlen,
+				   void *outbuf, size_t *outlen)
+{
+	u16 lzo_ofs, lzo_len;
+	int ret;
+
+	/* Find embedded tag */
+	ret = routerboot_tag_find(inbuf, inlen, tag_id, &lzo_ofs, &lzo_len);
+	if (ret) {
+		pr_debug(RB_HC_PR_PFX "no ERD data for id 0x%04x\n", tag_id);
+		goto fail;
+	}
+
+	if (lzo_len > inlen) {
+		pr_debug(RB_HC_PR_PFX "Invalid ERD data length\n");
+		ret = -EINVAL;
+		goto fail;
+	}
+
+	ret = lzo1x_decompress_safe(inbuf+lzo_ofs, lzo_len, outbuf, outlen);
+	if (ret)
+		pr_debug(RB_HC_PR_PFX "LZO decompression error (%d)\n", ret);
+
+fail:
+	return ret;
+}
+
+/*
+ * If the RB_ID_WLAN_DATA payload starts with RB_MAGIC_LZOR, then past
+ * that magic number is a payload that must be appended to the hc_lzor_prefix,
+ * the resulting blob is LZO-compressed.
+ * If payload starts with RB_MAGIC_LZ77, a separate (bit level LZ77)
+ * decompression function needs to be used. In the decompressed result,
+ * the RB_MAGIC_ERD magic number (aligned) must be located. Following that
+ * magic, there is one or more routerboot tag node(s) locating the RLE-encoded
+ * calibration data payload.
+ */
+static int hc_wlan_data_unpack_lzor_lz77(const u16 tag_id, const u8 *inbuf, size_t inlen,
+					 void *outbuf, size_t *outlen, u32 magic)
+{
+	u16 rle_ofs, rle_len;
+	const u32 *needle;
+	u8 *tempbuf;
+	size_t templen, lzo_len;
+	int ret;
+	const char lzor[] = "LZOR";
+	const char lz77[] = "LZ77";
+	const char *lz_type;
+
+	/* Temporary buffer same size as the outbuf */
+	templen = *outlen;
+	tempbuf = kmalloc(templen, GFP_KERNEL);
+	if (!tempbuf)
+		return -ENOMEM;
+
+	lzo_len = inlen;
+	if (magic == RB_MAGIC_LZOR)
+		lzo_len += sizeof(hc_lzor_prefix);
+	if (lzo_len > *outlen)
+		return -EFBIG;
+
+	switch (magic) {
+	case RB_MAGIC_LZOR:
+		lz_type = lzor;
+
+		/* Concatenate into the outbuf */
+		memcpy(outbuf, hc_lzor_prefix, sizeof(hc_lzor_prefix));
+		memcpy(outbuf + sizeof(hc_lzor_prefix), inbuf, inlen);
+
+		/* LZO-decompress lzo_len bytes of outbuf into the tempbuf */
+		ret = lzo1x_decompress_safe(outbuf, lzo_len, tempbuf, &templen);
+		if (ret) {
+			if (LZO_E_INPUT_NOT_CONSUMED == ret) {
+				/*
+				 * The tag length is always aligned thus the LZO payload may be padded,
+				 * which can trigger a spurious error which we ignore here.
+				 */
+				pr_debug(RB_HC_PR_PFX "LZOR: LZO EOF before buffer end - this may be harmless\n");
+			} else {
+				pr_debug(RB_HC_PR_PFX "LZOR: LZO decompression error (%d)\n", ret);
+				goto fail;
+			}
+		}
+		break;
+	case RB_MAGIC_LZ77:
+		lz_type = lz77;
+		/* LZO-decompress lzo_len bytes of inbuf into the tempbuf */
+		ret = rb_lz77_decompress(inbuf, inlen, tempbuf, &templen);
+		if (ret) {
+			pr_err(RB_HC_PR_PFX "LZ77: LZ77 decompress error %d\n", ret);
+			goto fail;
+		}
+
+		pr_debug(RB_HC_PR_PFX "LZ77: decompressed from %zu to %zu\n",
+				inlen, templen);
+		break;
+	default:
+		return -EINVAL;
+		break;
+	}
+
+	/*
+	 * Post decompression we have a blob (possibly byproduct of the lzo
+	 * dictionary). We need to find RB_MAGIC_ERD. The magic number seems to
+	 * be 32bit-aligned in the decompression output.
+	 */
+	needle = (const u32 *)tempbuf;
+	while (RB_MAGIC_ERD != *needle++) {
+		if ((u8 *)needle >= tempbuf+templen) {
+			pr_warn(RB_HC_PR_PFX "%s: ERD magic not found. Decompressed first word: 0x%08x\n", lz_type, *(u32 *)tempbuf);
+			ret = -ENODATA;
+			goto fail;
+		}
+	};
+	templen -= (u8 *)needle - tempbuf;
+
+	/* Past magic. Look for tag node */
+	ret = routerboot_tag_find((u8 *)needle, templen, tag_id, &rle_ofs, &rle_len);
+	if (ret) {
+		pr_debug(RB_HC_PR_PFX "%s: no RLE data for id 0x%04x\n", lz_type, tag_id);
+		goto fail;
+	}
+
+	if (rle_len > templen) {
+		pr_debug(RB_HC_PR_PFX "%s: Invalid RLE data length\n", lz_type);
+		ret = -EINVAL;
+		goto fail;
+	}
+
+	/* RLE-decode tempbuf from needle back into the outbuf */
+	ret = routerboot_rle_decode((u8 *)needle+rle_ofs, rle_len, outbuf, outlen);
+	if (ret)
+		pr_debug(RB_HC_PR_PFX "%s: RLE decoding error (%d)\n", lz_type, ret);
+
+fail:
+	kfree(tempbuf);
+	return ret;
+}
+
+static int hc_wlan_data_unpack(const u16 tag_id, const size_t tofs, size_t tlen,
+			       void *outbuf, size_t *outlen)
+{
+	const u8 *lbuf;
+	u32 magic;
+	int ret;
+
+	/* Caller ensure tlen > 0. tofs is aligned */
+	if ((tofs + tlen) > hc_buflen)
+		return -EIO;
+
+	lbuf = hc_buf + tofs;
+	magic = *(u32 *)lbuf;
+
+	ret = -ENODATA;
+	switch (magic) {
+	case RB_MAGIC_LZ77:
+		/* no known instances of lz77 without 8001/8201 data, skip SOLO */
+		if (tag_id == RB_WLAN_ERD_ID_SOLO) {
+			pr_debug(RB_HC_PR_PFX "skipped LZ77 decompress in search for SOLO tag\n");
+			break;
+		}
+		fallthrough;
+	case RB_MAGIC_LZOR:
+		/* Skip magic */
+		lbuf += sizeof(magic);
+		tlen -= sizeof(magic);
+		ret = hc_wlan_data_unpack_lzor_lz77(tag_id, lbuf, tlen, outbuf, outlen, magic);
+		break;
+	case RB_MAGIC_ERD:
+		/* Skip magic */
+		lbuf += sizeof(magic);
+		tlen -= sizeof(magic);
+		ret = hc_wlan_data_unpack_erd(tag_id, lbuf, tlen, outbuf, outlen);
+		break;
+	default:
+		/*
+		 * If the RB_ID_WLAN_DATA payload doesn't start with a
+		 * magic number, the payload itself is the raw RLE-encoded
+		 * calibration data. Only RB_WLAN_ERD_ID_SOLO makes sense here.
+		 */
+		if (RB_WLAN_ERD_ID_SOLO == tag_id) {
+			ret = routerboot_rle_decode(lbuf, tlen, outbuf, outlen);
+			if (ret)
+				pr_debug(RB_HC_PR_PFX "RLE decoding error (%d)\n", ret);
+		}
+		break;
+	}
+
+	return ret;
+}
+
+static ssize_t hc_attr_show(struct kobject *kobj, struct kobj_attribute *attr,
+			    char *buf)
+{
+	const struct hc_attr *hc_attr;
+	const u8 *pld;
+	u16 pld_len;
+
+	hc_attr = container_of(attr, typeof(*hc_attr), kattr);
+
+	if (!hc_attr->pld_len)
+		return -ENOENT;
+
+	pld = hc_buf + hc_attr->pld_ofs;
+	pld_len = hc_attr->pld_len;
+
+	return hc_attr->tshow(pld, pld_len, buf);
+}
+
+/*
+ * This function will allocate and free memory every time it is called. This
+ * is not the fastest way to do this, but since the data is rarely read (mainly
+ * at boot time to load wlan caldata), this makes it possible to save memory for
+ * the system.
+ */
+static ssize_t hc_wlan_data_bin_read(struct file *filp, struct kobject *kobj,
+				     struct bin_attribute *attr, char *buf,
+				     loff_t off, size_t count)
+{
+	struct hc_wlan_attr *hc_wattr;
+	size_t outlen;
+	void *outbuf;
+	int ret;
+
+	hc_wattr = container_of(attr, typeof(*hc_wattr), battr);
+
+	if (!hc_wattr->pld_len)
+		return -ENOENT;
+
+	outlen = RB_ART_SIZE;
+
+	/* Don't bother unpacking if the source is already too large */
+	if (hc_wattr->pld_len > outlen)
+		return -EFBIG;
+
+	outbuf = kmalloc(outlen, GFP_KERNEL);
+	if (!outbuf)
+		return -ENOMEM;
+
+	ret = hc_wlan_data_unpack(hc_wattr->erd_tag_id, hc_wattr->pld_ofs, hc_wattr->pld_len, outbuf, &outlen);
+	if (ret) {
+		kfree(outbuf);
+		return ret;
+	}
+
+	if (off >= outlen) {
+		kfree(outbuf);
+		return 0;
+	}
+
+	if (off + count > outlen)
+		count = outlen - off;
+
+	memcpy(buf, outbuf + off, count);
+
+	kfree(outbuf);
+	return count;
+}
+
+int rb_hardconfig_init(struct kobject *rb_kobj, struct mtd_info *mtd)
+{
+	struct kobject *hc_wlan_kobj;
+	size_t bytes_read, buflen, outlen;
+	const u8 *buf;
+	void *outbuf;
+	int i, j, ret;
+	u32 magic;
+
+	hc_buf = NULL;
+	hc_kobj = NULL;
+	hc_wlan_kobj = NULL;
+
+	ret = __get_mtd_device(mtd);
+	if (ret)
+		return -ENODEV;
+
+	hc_buflen = mtd->size;
+	hc_buf = kmalloc(hc_buflen, GFP_KERNEL);
+	if (!hc_buf) {
+		__put_mtd_device(mtd);
+		return -ENOMEM;
+	}
+
+	ret = mtd_read(mtd, 0, hc_buflen, &bytes_read, hc_buf);
+	__put_mtd_device(mtd);
+
+	if (ret)
+		goto fail;
+
+	if (bytes_read != hc_buflen) {
+		ret = -EIO;
+		goto fail;
+	}
+
+	/* Check we have what we expect */
+	magic = *(const u32 *)hc_buf;
+	if (RB_MAGIC_HARD != magic) {
+		ret = -EINVAL;
+		goto fail;
+	}
+
+	/* Skip magic */
+	buf = hc_buf + sizeof(magic);
+	buflen = hc_buflen - sizeof(magic);
+
+	/* Populate sysfs */
+	ret = -ENOMEM;
+	hc_kobj = kobject_create_and_add(RB_MTD_HARD_CONFIG, rb_kobj);
+	if (!hc_kobj)
+		goto fail;
+
+	/* Locate and publish all known tags */
+	for (i = 0; i < ARRAY_SIZE(hc_attrs); i++) {
+		ret = routerboot_tag_find(buf, buflen, hc_attrs[i].tag_id,
+					  &hc_attrs[i].pld_ofs, &hc_attrs[i].pld_len);
+		if (ret) {
+			hc_attrs[i].pld_ofs = hc_attrs[i].pld_len = 0;
+			continue;
+		}
+
+		/* Account for skipped magic */
+		hc_attrs[i].pld_ofs += sizeof(magic);
+
+		/*
+		 * Special case RB_ID_WLAN_DATA to prep and create the binary attribute.
+		 * We first check if the data is "old style" within a single tag (or no tag at all):
+		 * If it is we publish this single blob as a binary attribute child of hc_kobj to
+		 * preserve backward compatibility.
+		 * If it isn't and instead uses multiple ERD tags, we create a subfolder and
+		 * publish the known ones there.
+		 */
+		if ((RB_ID_WLAN_DATA == hc_attrs[i].tag_id) && hc_attrs[i].pld_len) {
+			outlen = RB_ART_SIZE;
+			outbuf = kmalloc(outlen, GFP_KERNEL);
+			if (!outbuf) {
+				pr_warn(RB_HC_PR_PFX "Out of memory parsing WLAN tag\n");
+				continue;
+			}
+
+			/* Test ID_SOLO first, if found: done */
+			ret = hc_wlan_data_unpack(RB_WLAN_ERD_ID_SOLO, hc_attrs[i].pld_ofs, hc_attrs[i].pld_len, outbuf, &outlen);
+			if (!ret) {
+				hc_wd_solo_battr.pld_ofs = hc_attrs[i].pld_ofs;
+				hc_wd_solo_battr.pld_len = hc_attrs[i].pld_len;
+
+				ret = sysfs_create_bin_file(hc_kobj, &hc_wd_solo_battr.battr);
+				if (ret)
+					pr_warn(RB_HC_PR_PFX "Could not create %s sysfs entry (%d)\n",
+						hc_wd_solo_battr.battr.attr.name, ret);
+			}
+			/* Otherwise, create "wlan_data" subtree and publish known data */
+			else {
+				hc_wlan_kobj = kobject_create_and_add("wlan_data", hc_kobj);
+				if (!hc_wlan_kobj) {
+					kfree(outbuf);
+					pr_warn(RB_HC_PR_PFX "Could not create wlan_data sysfs folder\n");
+					continue;
+				}
+
+				for (j = 0; j < ARRAY_SIZE(hc_wd_multi_battrs); j++) {
+					outlen = RB_ART_SIZE;
+					ret = hc_wlan_data_unpack(hc_wd_multi_battrs[j].erd_tag_id,
+								  hc_attrs[i].pld_ofs, hc_attrs[i].pld_len, outbuf, &outlen);
+					if (ret) {
+						hc_wd_multi_battrs[j].pld_ofs = hc_wd_multi_battrs[j].pld_len = 0;
+						continue;
+					}
+
+					hc_wd_multi_battrs[j].pld_ofs = hc_attrs[i].pld_ofs;
+					hc_wd_multi_battrs[j].pld_len = hc_attrs[i].pld_len;
+
+					ret = sysfs_create_bin_file(hc_wlan_kobj, &hc_wd_multi_battrs[j].battr);
+					if (ret)
+						pr_warn(RB_HC_PR_PFX "Could not create wlan_data/%s sysfs entry (%d)\n",
+							hc_wd_multi_battrs[j].battr.attr.name, ret);
+				}
+			}
+
+			kfree(outbuf);
+		}
+		/* All other tags are published via standard attributes */
+		else {
+			ret = sysfs_create_file(hc_kobj, &hc_attrs[i].kattr.attr);
+			if (ret)
+				pr_warn(RB_HC_PR_PFX "Could not create %s sysfs entry (%d)\n",
+				       hc_attrs[i].kattr.attr.name, ret);
+		}
+	}
+
+	pr_info("MikroTik RouterBOARD hardware configuration sysfs driver v" RB_HARDCONFIG_VER "\n");
+
+	return 0;
+
+fail:
+	kfree(hc_buf);
+	hc_buf = NULL;
+	return ret;
+}
+
+void rb_hardconfig_exit(void)
+{
+	kobject_put(hc_kobj);
+	hc_kobj = NULL;
+	kfree(hc_buf);
+	hc_buf = NULL;
+}
diff --git a/6.12/target/linux/generic/files/drivers/platform/mikrotik/rb_hardconfig.h b/6.12/target/linux/generic/files/drivers/platform/mikrotik/rb_hardconfig.h
new file mode 100644
index 00000000..328f4fe3
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/platform/mikrotik/rb_hardconfig.h
@@ -0,0 +1,32 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Common definitions for MikroTik RouterBoot hard config data.
+ *
+ * Copyright (C) 2020 Thibaut VARÈNE <hacks+kernel@slashdirt.org>
+ *
+ * Some constant defines extracted from routerboot.{c,h} by Gabor Juhos
+ * <juhosg@openwrt.org>
+ */
+
+#ifndef _ROUTERBOOT_HARD_CONFIG_H_
+#define _ROUTERBOOT_HARD_CONFIG_H_
+
+/* ID values for hardware settings */
+#define RB_ID_FLASH_INFO		0x03
+#define RB_ID_MAC_ADDRESS_PACK		0x04
+#define RB_ID_BOARD_PRODUCT_CODE	0x05
+#define RB_ID_BIOS_VERSION		0x06
+#define RB_ID_SDRAM_TIMINGS		0x08
+#define RB_ID_DEVICE_TIMINGS		0x09
+#define RB_ID_SOFTWARE_ID		0x0A
+#define RB_ID_SERIAL_NUMBER		0x0B
+#define RB_ID_MEMORY_SIZE		0x0D
+#define RB_ID_MAC_ADDRESS_COUNT		0x0E
+#define RB_ID_HW_OPTIONS		0x15
+#define RB_ID_WLAN_DATA			0x16
+#define RB_ID_BOARD_IDENTIFIER		0x17
+#define RB_ID_PRODUCT_NAME		0x21
+#define RB_ID_DEFCONF			0x26
+#define RB_ID_BOARD_REVISION		0x27
+
+#endif /* _ROUTERBOOT_HARD_CONFIG_H_ */
diff --git a/6.12/target/linux/generic/files/drivers/platform/mikrotik/rb_lz77.c b/6.12/target/linux/generic/files/drivers/platform/mikrotik/rb_lz77.c
new file mode 100644
index 00000000..d443adb1
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/platform/mikrotik/rb_lz77.c
@@ -0,0 +1,446 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (C) 2023 John Thomson
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/errno.h>
+#include <linux/minmax.h>
+
+#include "rb_lz77.h"
+
+#define MIKRO_LZ77 "[rb lz77] "
+
+/*
+ * The maximum number of bits used in a counter.
+ * For the look behind window, long instruction match offsets
+ * up to 6449 have been seen in provided compressed caldata blobs
+ * (that would need 21 counter bits: 4 to 12 + 11 to 0).
+ * conservative value here: 27 provides offset up to 0x8000 bytes
+ * uses a u8 in this code
+ */
+#define MIKRO_LZ77_MAX_COUNT_BIT_LEN 27
+
+enum rb_lz77_instruction {
+	INSTR_ERROR = -1,
+	INSTR_LITERAL_BYTE = 0,
+	/* a (non aligned) byte follows this instruction,
+	 * which is directly copied into output
+	 */
+	INSTR_PREVIOUS_OFFSET = 1,
+	/* this group is a match, with a bytes length defined by
+	 * following counter bits, starting at bitshift 0,
+	 * less the built-in count of 1
+	 * using the previous offset as source
+	 */
+	INSTR_LONG = 2
+	/* this group has two counters,
+	 * the first counter starts at bitshift 4,
+	 *	 if this counter == 0, this is a non-matching group
+	 *	 the second counter (bytes length) starts at bitshift 4,
+	 *	 less the built-in count of 11+1.
+	 *	 The final match group has this count 0,
+	 *	 and following bits which pad to byte-alignment.
+	 *
+	 *	 if this counter > 0, this is a matching group
+	 *	 this first count is the match offset (in bytes)
+	 *	 the second count is the match length (in bytes),
+	 *	 less the built-in count of 2
+	 *	 these groups can source bytes that are part of this group
+	 */
+};
+
+struct rb_lz77_instr_opcodes {
+	/* group instruction */
+	enum rb_lz77_instruction instruction;
+	/* if >0, a match group,
+	 * which starts at byte output_position - 1*offset
+	 */
+	size_t offset;
+	/* how long the match group is,
+	 * or how long the (following counter) non-match group is
+	 */
+	size_t length;
+	/* how many bits were used for this instruction + op code(s) */
+	size_t bits_used;
+	/* input char */
+	u8 *in;
+	/* offset where this instruction started */
+	size_t in_pos;
+};
+
+/**
+ * rb_lz77_get_bit
+ *
+ * @in:			compressed data ptr
+ * @in_offset_bit:	bit offset to extract
+ *
+ * convert the bit offset to byte offset,
+ * shift to modulo of bits per bytes, so that wanted bit is lsb
+ * and to extract only that bit.
+ * Caller is responsible for ensuring that in_offset_bit/8
+ * does not exceed input length
+ */
+static inline u8 rb_lz77_get_bit(const u8 *in, const size_t in_offset_bit)
+{
+	return ((in[in_offset_bit / BITS_PER_BYTE] >>
+		 (in_offset_bit % BITS_PER_BYTE)) &
+		1);
+}
+
+/**
+ * rb_lz77_get_byte
+ *
+ * @in:			compressed data
+ * @in_offset_bit:	bit offset to extract byte
+ */
+static inline u8 rb_lz77_get_byte(const u8 *in, const size_t in_offset_bit)
+{
+	u8 buf = 0;
+	int i;
+
+	/* built a reversed byte from (likely) unaligned bits */
+	for (i = 0; i <= 7; ++i)
+		buf += rb_lz77_get_bit(in, in_offset_bit + i) << (7 - i);
+	return buf;
+}
+
+/**
+ * rb_lz77_decode_count - decode bits at given offset as a count
+ *
+ * @in:			compressed data
+ * @in_len:		length of compressed data
+ * @in_offset_bit:	bit offset where count starts
+ * @shift:		left shift operand value of first count bit
+ * @count:		initial count
+ * @bits_used:		how many bits were consumed by this count
+ * @max_bits:		maximum bit count for this counter
+ *
+ * Returns the decoded count
+ */
+static int rb_lz77_decode_count(const u8 *in, const size_t in_len,
+				const size_t in_offset_bit, u8 shift,
+				size_t count, u8 *bits_used, const u8 max_bits)
+{
+	size_t pos = in_offset_bit;
+	const size_t max_pos = min(pos + max_bits, in_len * BITS_PER_BYTE);
+	bool up = true;
+
+	*bits_used = 0;
+	pr_debug(MIKRO_LZ77
+		 "decode_count inbit: %zu, start shift:%u, initial count:%zu\n",
+		 in_offset_bit, shift, count);
+
+	while (true) {
+		/* check the input offset bit does not overflow the minimum of
+		 * a reasonable length for this encoded count, and
+		 * the end of the input */
+		if (unlikely(pos >= max_pos)) {
+			pr_err(MIKRO_LZ77
+			       "max bit index reached before count completed\n");
+			return -EFBIG;
+		}
+
+		/* if the bit value at offset is set */
+		if (rb_lz77_get_bit(in, pos))
+			count += (1 << shift);
+
+		/* shift increases until we find an unsed bit */
+		else if (up)
+			up = false;
+
+		if (up)
+			++shift;
+		else {
+			if (!shift) {
+				*bits_used = pos - in_offset_bit + 1;
+				return count;
+			}
+			--shift;
+		}
+
+		++pos;
+	}
+
+	return -EINVAL;
+}
+
+/**
+ * rb_lz77_decode_instruction
+ *
+ * @in:			compressed data
+ * @in_offset_bit:	bit offset where instruction starts
+ * @bits_used:		how many bits were consumed by this count
+ *
+ * Returns the decoded instruction
+ */
+static enum rb_lz77_instruction
+rb_lz77_decode_instruction(const u8 *in, size_t in_offset_bit, u8 *bits_used)
+{
+	if (rb_lz77_get_bit(in, in_offset_bit)) {
+		*bits_used = 2;
+		if (rb_lz77_get_bit(in, ++in_offset_bit))
+			return INSTR_LONG;
+		else
+			return INSTR_PREVIOUS_OFFSET;
+	} else {
+		*bits_used = 1;
+		return INSTR_LITERAL_BYTE;
+	}
+	return INSTR_ERROR;
+}
+
+/**
+ * rb_lz77_decode_instruction_operators
+ *
+ * @in:			compressed data
+ * @in_len:		length of compressed data
+ * @in_offset_bit:	bit offset where instruction starts
+ * @previous_offset:	last used match offset
+ * @opcode:		struct to hold instruction & operators
+ *
+ * Returns error code
+ */
+static int rb_lz77_decode_instruction_operators(
+	const u8 *in, const size_t in_len, const size_t in_offset_bit,
+	const size_t previous_offset, struct rb_lz77_instr_opcodes *opcode)
+{
+	enum rb_lz77_instruction instruction;
+	u8 bit_count = 0;
+	u8 bits_used = 0;
+	int offset = 0;
+	int length = 0;
+
+	instruction = rb_lz77_decode_instruction(in, in_offset_bit, &bit_count);
+
+	/* skip bits used by instruction */
+	bits_used += bit_count;
+
+	switch (instruction) {
+	case INSTR_LITERAL_BYTE:
+		/* non-matching char */
+		offset = 0;
+		length = 1;
+		break;
+
+	case INSTR_PREVIOUS_OFFSET:
+		/* matching group uses previous offset */
+		offset = previous_offset;
+
+		length = rb_lz77_decode_count(in, in_len,
+					      in_offset_bit + bits_used, 0, 1,
+					      &bit_count,
+					      MIKRO_LZ77_MAX_COUNT_BIT_LEN);
+		if (unlikely(length < 0))
+			return length;
+		/* skip bits used by count */
+		bits_used += bit_count;
+		break;
+
+	case INSTR_LONG:
+		offset = rb_lz77_decode_count(in, in_len,
+					      in_offset_bit + bits_used, 4, 0,
+					      &bit_count,
+					      MIKRO_LZ77_MAX_COUNT_BIT_LEN);
+		if (unlikely(offset < 0))
+			return offset;
+
+		/* skip bits used by offset count */
+		bits_used += bit_count;
+
+		if (offset == 0) {
+			/* non-matching long group */
+			length = rb_lz77_decode_count(
+				in, in_len, in_offset_bit + bits_used, 4, 12,
+				&bit_count, MIKRO_LZ77_MAX_COUNT_BIT_LEN);
+			if (unlikely(length < 0))
+				return length;
+			/* skip bits used by length count */
+			bits_used += bit_count;
+		} else {
+			/* matching group */
+			length = rb_lz77_decode_count(
+				in, in_len, in_offset_bit + bits_used, 0, 2,
+				&bit_count, MIKRO_LZ77_MAX_COUNT_BIT_LEN);
+			if (unlikely(length < 0))
+				return length;
+			/* skip bits used by length count */
+			bits_used += bit_count;
+		}
+
+		break;
+
+	case INSTR_ERROR:
+		return -EINVAL;
+	}
+
+	opcode->instruction = instruction;
+	opcode->offset = offset;
+	opcode->length = length;
+	opcode->bits_used = bits_used;
+	opcode->in = (u8 *)in;
+	opcode->in_pos = in_offset_bit;
+	return 0;
+}
+
+/**
+ * rb_lz77_decompress
+ *
+ * @in:			compressed data ptr
+ * @in_len:		length of compressed data
+ * @out:		buffer ptr to decompress into
+ * @out_len:		length of decompressed buffer in input,
+ *			length of decompressed data in success
+ *
+ * Returns 0 on success, or negative error
+ */
+int rb_lz77_decompress(const u8 *in, const size_t in_len, u8 *out,
+		       size_t *out_len)
+{
+	u8 *output_ptr;
+	size_t input_bit = 0;
+	const u8 *output_end = out + *out_len;
+	struct rb_lz77_instr_opcodes *opcode;
+	size_t match_offset = 0;
+	int rc = 0;
+	size_t match_length, partial_count, i;
+
+	output_ptr = out;
+
+	if (unlikely((in_len * BITS_PER_BYTE) > SIZE_MAX)) {
+		pr_err(MIKRO_LZ77 "input longer than expected\n");
+		return -EFBIG;
+	}
+
+	opcode = kmalloc(sizeof(*opcode), GFP_KERNEL);
+	if (!opcode)
+		return -ENOMEM;
+
+	while (true) {
+		if (unlikely(output_ptr > output_end)) {
+			pr_err(MIKRO_LZ77 "output overrun\n");
+			rc = -EOVERFLOW;
+			goto free_lz77_struct;
+		}
+		if (unlikely(input_bit > in_len * BITS_PER_BYTE)) {
+			pr_err(MIKRO_LZ77 "input overrun\n");
+			rc = -ENODATA;
+			goto free_lz77_struct;
+		}
+
+		rc = rb_lz77_decode_instruction_operators(in, in_len, input_bit,
+							  match_offset, opcode);
+		if (unlikely(rc < 0)) {
+			pr_err(MIKRO_LZ77
+			       "instruction operands decode error\n");
+			goto free_lz77_struct;
+		}
+
+		pr_debug(MIKRO_LZ77 "inbit:0x%zx->outbyte:0x%zx", input_bit,
+			 output_ptr - out);
+
+		input_bit += opcode->bits_used;
+		switch (opcode->instruction) {
+		case INSTR_LITERAL_BYTE:
+			pr_debug(" short");
+			fallthrough;
+		case INSTR_LONG:
+			if (opcode->offset == 0) {
+				/* this is a non-matching group */
+				pr_debug(" non-match, len: 0x%zx\n",
+					 opcode->length);
+				/* test end marker */
+				if (opcode->length == 0xc &&
+				    ((input_bit +
+				      opcode->length * BITS_PER_BYTE) >
+				     in_len)) {
+					*out_len = output_ptr - out;
+					pr_debug(
+						MIKRO_LZ77
+						"lz77 decompressed from %zu to %zu\n",
+						in_len, *out_len);
+					rc = 0;
+					goto free_lz77_struct;
+				}
+				for (i = opcode->length; i > 0; --i) {
+					*output_ptr =
+						rb_lz77_get_byte(in, input_bit);
+					++output_ptr;
+					input_bit += BITS_PER_BYTE;
+				}
+				/* do no fallthrough if a non-match group */
+				break;
+			}
+			match_offset = opcode->offset;
+			fallthrough;
+		case INSTR_PREVIOUS_OFFSET:
+			match_length = opcode->length;
+			partial_count = 0;
+
+			pr_debug(" match, offset: 0x%zx, len: 0x%zx",
+				 opcode->offset, match_length);
+
+			if (unlikely(opcode->offset == 0)) {
+				pr_err(MIKRO_LZ77
+				       "match group missing opcode->offset\n");
+				rc = -EBADMSG;
+				goto free_lz77_struct;
+			}
+
+			/* overflow */
+			if (unlikely((output_ptr + match_length) >
+				     output_end)) {
+				pr_err(MIKRO_LZ77
+				       "match group output overflow\n");
+				rc = -ENOBUFS;
+				goto free_lz77_struct;
+			}
+
+			/* underflow */
+			if (unlikely((output_ptr - opcode->offset) < out)) {
+				pr_err(MIKRO_LZ77
+				       "match group offset underflow\n");
+				rc = -ESPIPE;
+				goto free_lz77_struct;
+			}
+
+			/* there are cases where the match (length) includes
+			 * data that is a part of the same match
+			 */
+			while (opcode->offset < match_length) {
+				++partial_count;
+				memcpy(output_ptr, output_ptr - opcode->offset,
+				       opcode->offset);
+				output_ptr += opcode->offset;
+				match_length -= opcode->offset;
+			}
+			memcpy(output_ptr, output_ptr - opcode->offset,
+			       match_length);
+			output_ptr += match_length;
+			if (partial_count)
+				pr_debug(" (%zu partial memcpy)",
+					 partial_count);
+			pr_debug("\n");
+
+			break;
+
+		case INSTR_ERROR:
+			rc = -EINVAL;
+			goto free_lz77_struct;
+		}
+	}
+
+	pr_err(MIKRO_LZ77 "decode loop broken\n");
+	rc = -EINVAL;
+
+free_lz77_struct:
+	kfree(opcode);
+	return rc;
+}
+EXPORT_SYMBOL_GPL(rb_lz77_decompress);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Mikrotik Wi-Fi caldata LZ77 decompressor");
+MODULE_AUTHOR("John Thomson");
diff --git a/6.12/target/linux/generic/files/drivers/platform/mikrotik/rb_lz77.h b/6.12/target/linux/generic/files/drivers/platform/mikrotik/rb_lz77.h
new file mode 100644
index 00000000..55179fcb
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/platform/mikrotik/rb_lz77.h
@@ -0,0 +1,35 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (C) 2024 John Thomson
+ */
+
+#ifndef __MIKROTIK_WLAN_LZ77_H__
+#define __MIKROTIK_WLAN_LZ77_H__
+
+#include <linux/errno.h>
+
+#ifdef CONFIG_MIKROTIK_WLAN_DECOMPRESS_LZ77
+/**
+ * rb_lz77_decompress
+ *
+ * @in:			compressed data ptr
+ * @in_len:		length of compressed data
+ * @out:		buffer ptr to decompress into
+ * @out_len:		length of decompressed buffer in input,
+ *			length of decompressed data in success
+ *
+ * Returns 0 on success, or negative error
+ */
+int rb_lz77_decompress(const u8 *in, const size_t in_len, u8 *out,
+		       size_t *out_len);
+
+#else /* CONFIG_MIKROTIK_WLAN_DECOMPRESS_LZ77 */
+
+static inline int rb_lz77_decompress(const u8 *in, const size_t in_len, u8 *out,
+				     size_t *out_len)
+{
+	return -EOPNOTSUPP;
+}
+
+#endif /* CONFIG_MIKROTIK_WLAN_DECOMPRESS_LZ77 */
+#endif /* __MIKROTIK_WLAN_LZ77_H__ */
diff --git a/6.12/target/linux/generic/files/drivers/platform/mikrotik/rb_nvmem.c b/6.12/target/linux/generic/files/drivers/platform/mikrotik/rb_nvmem.c
new file mode 100644
index 00000000..6f785ce7
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/platform/mikrotik/rb_nvmem.c
@@ -0,0 +1,230 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * NVMEM layout driver for MikroTik Routerboard hard config cells
+ *
+ * Copyright (C) 2024 Robert Marko <robimarko@gmail.com>
+ * Based on the sysfs hard config driver by Thibaut VARÈNE <hacks+kernel@slashdirt.org>
+ * Comments documenting the format carried over from routerboot.c
+ */
+
+#include <linux/bitfield.h>
+#include <linux/etherdevice.h>
+#include <linux/mod_devicetable.h>
+#include <linux/nvmem-consumer.h>
+#include <linux/nvmem-provider.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+
+#include "rb_hardconfig.h"
+#include "routerboot.h"
+
+#define TLV_TAG_MASK 	GENMASK(15, 0)
+#define TLV_LEN_MASK 	GENMASK(31, 16)
+
+static const char *rb_tlv_cell_name(u16 tag)
+{
+	switch (tag) {
+	case RB_ID_FLASH_INFO:
+		return "flash-info";
+	case RB_ID_MAC_ADDRESS_PACK:
+		return "base-mac-address";
+	case RB_ID_BOARD_PRODUCT_CODE:
+		return "board-product-code";
+	case RB_ID_BIOS_VERSION:
+		return "booter-version";
+	case RB_ID_SERIAL_NUMBER:
+		return "board-serial";
+	case RB_ID_MEMORY_SIZE:
+		return "mem-size";
+	case RB_ID_MAC_ADDRESS_COUNT:
+		return "mac-count";
+	case RB_ID_HW_OPTIONS:
+		return "hw-options";
+	case RB_ID_WLAN_DATA:
+		return "wlan-data";
+	case RB_ID_BOARD_IDENTIFIER:
+		return "board-identifier";
+	case RB_ID_PRODUCT_NAME:
+		return "product-name";
+	case RB_ID_DEFCONF:
+		return "defconf";
+	case RB_ID_BOARD_REVISION:
+		return "board-revision";
+	default:
+		break;
+	}
+
+	return NULL;
+}
+
+static int rb_tlv_mac_read_cb(void *priv, const char *id, int index,
+			      unsigned int offset, void *buf,
+			      size_t bytes)
+{
+	if (index < 0)
+		return -EINVAL;
+
+	if (!is_valid_ether_addr(buf))
+		return -EINVAL;
+
+	eth_addr_add(buf, index);
+
+	return 0;
+}
+
+static nvmem_cell_post_process_t rb_tlv_read_cb(u16 tag)
+{
+	switch (tag) {
+	case RB_ID_MAC_ADDRESS_PACK:
+		return &rb_tlv_mac_read_cb;
+	default:
+		break;
+	}
+
+	return NULL;
+}
+
+static int rb_add_cells(struct device *dev, struct nvmem_device *nvmem,
+			const size_t data_len, u8 *data)
+{
+	u32 node, offset = sizeof(RB_MAGIC_HARD);
+	struct nvmem_cell_info cell = {};
+	struct device_node *layout;
+	u16 tlv_tag, tlv_len;
+	int ret;
+
+	layout = of_nvmem_layout_get_container(nvmem);
+	if (!layout)
+		return -ENOENT;
+
+	/*
+	 * Routerboot tag nodes are u32 values:
+	 * - The low nibble is the tag identification number,
+	 * - The high nibble is the tag payload length (node excluded) in bytes.
+	 * Tag nodes are CPU-endian.
+	 * Tag nodes are 32bit-aligned.
+	 *
+	 * The payload immediately follows the tag node.
+	 * Payload offset will always be aligned. while length may not end on 32bit
+	 * boundary (the only known case is when parsing ERD data).
+	 * The payload is CPU-endian when applicable.
+	 * Tag nodes are not ordered (by ID) on flash.
+	 */
+	while ((offset + sizeof(node)) <= data_len) {
+		node = *((const u32 *) (data + offset));
+		/* Tag list ends with null node */
+		if (!node)
+			break;
+
+		tlv_tag = FIELD_GET(TLV_TAG_MASK, node);
+		tlv_len = FIELD_GET(TLV_LEN_MASK, node);
+
+		offset += sizeof(node);
+		if (offset + tlv_len > data_len) {
+			dev_err(dev, "Out of bounds field (0x%x bytes at 0x%x)\n",
+			        tlv_len, offset);
+			break;
+		}
+
+		cell.name = rb_tlv_cell_name(tlv_tag);
+		if (!cell.name)
+			goto skip;
+
+		cell.offset = offset;
+		/*
+		 * MikroTik stores MAC-s with length of 8 bytes,
+		 * but kernel expects it to be ETH_ALEN (6 bytes),
+		 * so we need to make sure that is the case.
+		 */
+		if (tlv_tag == RB_ID_MAC_ADDRESS_PACK)
+			cell.bytes = ETH_ALEN;
+		else
+			cell.bytes = tlv_len;
+		cell.np = of_get_child_by_name(layout, cell.name);
+		cell.read_post_process = rb_tlv_read_cb(tlv_tag);
+
+		ret = nvmem_add_one_cell(nvmem, &cell);
+		if (ret) {
+			of_node_put(layout);
+			return ret;
+		}
+
+		/*
+		 * The only known situation where len may not end on 32bit
+		 * boundary is within ERD data. Since we're only extracting
+		 * one tag (the first and only one) from that data, we should
+		 * never need to forcefully ALIGN(). Do it anyway, this is not a
+		 * performance path.
+		 */
+skip:
+		offset += ALIGN(tlv_len, sizeof(offset));
+	}
+
+	of_node_put(layout);
+
+	return 0;
+}
+
+static int rb_parse_table(struct nvmem_layout *layout)
+{
+	struct nvmem_device *nvmem = layout->nvmem;
+	struct device *dev = &layout->dev;
+	size_t mtd_size;
+	u8 *data;
+	u32 hdr;
+	int ret;
+
+	ret = nvmem_device_read(nvmem, 0, sizeof(hdr), &hdr);
+	if (ret < 0)
+		return ret;
+
+	if (hdr != RB_MAGIC_HARD) {
+		dev_err(dev, "Invalid header\n");
+		return -EINVAL;
+	}
+
+	mtd_size = nvmem_dev_size(nvmem);
+
+	data = devm_kmalloc(dev, mtd_size, GFP_KERNEL);
+	if (!data)
+		return -ENOMEM;
+
+	ret = nvmem_device_read(nvmem, 0, mtd_size, data);
+	if (ret != mtd_size)
+		return ret;
+
+	return rb_add_cells(dev, nvmem, mtd_size, data);
+}
+
+static int rb_nvmem_probe(struct nvmem_layout *layout)
+{
+	layout->add_cells = rb_parse_table;
+
+	return nvmem_layout_register(layout);
+}
+
+static void rb_nvmem_remove(struct nvmem_layout *layout)
+{
+	nvmem_layout_unregister(layout);
+}
+
+static const struct of_device_id rb_nvmem_of_match_table[] = {
+	{ .compatible = "mikrotik,routerboot-nvmem", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, rb_nvmem_of_match_table);
+
+static struct nvmem_layout_driver rb_nvmem_layout = {
+	.probe = rb_nvmem_probe,
+	.remove = rb_nvmem_remove,
+	.driver = {
+		.owner = THIS_MODULE,
+		.name = "rb_nvmem",
+		.of_match_table = rb_nvmem_of_match_table,
+	},
+};
+module_nvmem_layout_driver(rb_nvmem_layout);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Robert Marko <robimarko@gmail.com>");
+MODULE_DESCRIPTION("NVMEM layout driver for MikroTik Routerboard hard config cells");
diff --git a/6.12/target/linux/generic/files/drivers/platform/mikrotik/rb_softconfig.c b/6.12/target/linux/generic/files/drivers/platform/mikrotik/rb_softconfig.c
new file mode 100644
index 00000000..5acff6aa
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/platform/mikrotik/rb_softconfig.c
@@ -0,0 +1,795 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Driver for MikroTik RouterBoot soft config.
+ *
+ * Copyright (C) 2020 Thibaut VARÈNE <hacks+kernel@slashdirt.org>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ *
+ * This driver exposes the data encoded in the "soft_config" flash segment of
+ * MikroTik RouterBOARDs devices. It presents the data in a sysfs folder
+ * named "soft_config". The data is presented in a user/machine-friendly way
+ * with just as much parsing as can be generalized across mikrotik platforms
+ * (as inferred from reverse-engineering).
+ *
+ * The known soft_config tags are presented in the "soft_config" sysfs folder,
+ * with the addition of one specific file named "commit", which is only
+ * available if the driver supports writes to the mtd device: no modifications
+ * made to any of the other attributes are actually written back to flash media
+ * until a true value is input into this file (e.g. [Yy1]). This is to avoid
+ * unnecessary flash wear, and to permit to revert all changes by issuing a
+ * false value ([Nn0]). Reading the content of this file shows the current
+ * status of the driver: if the data in sysfs matches the content of the
+ * soft_config partition, the file will read "clean". Otherwise, it will read
+ * "dirty".
+ *
+ * The writeable sysfs files presented by this driver will accept only inputs
+ * which are in a valid range for the given tag. As a design choice, the driver
+ * will not assess whether the inputs are identical to the existing data.
+ *
+ * Note: PAGE_SIZE is assumed to be >= 4K, hence the device attribute show
+ * routines need not check for output overflow.
+ *
+ * Some constant defines extracted from rbcfg.h by Gabor Juhos
+ * <juhosg@openwrt.org>
+ */
+
+#include <linux/types.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/errno.h>
+#include <linux/kobject.h>
+#include <linux/string.h>
+#include <linux/mtd/mtd.h>
+#include <linux/sysfs.h>
+#include <linux/version.h>
+#include <linux/capability.h>
+#include <linux/spinlock.h>
+#include <linux/crc32.h>
+
+#ifdef CONFIG_ATH79
+ #include <asm/mach-ath79/ath79.h>
+#endif
+
+#include "routerboot.h"
+
+#define RB_SOFTCONFIG_VER		"0.05"
+#define RB_SC_PR_PFX			"[rb_softconfig] "
+
+#define RB_SC_HAS_WRITE_SUPPORT	true
+#define RB_SC_WMODE			S_IWUSR
+#define RB_SC_RMODE			S_IRUSR
+
+/* ID values for software settings */
+#define RB_SCID_UART_SPEED		0x01	// u32*1
+#define RB_SCID_BOOT_DELAY		0x02	// u32*1
+#define RB_SCID_BOOT_DEVICE		0x03	// u32*1
+#define RB_SCID_BOOT_KEY		0x04	// u32*1
+#define RB_SCID_CPU_MODE		0x05	// u32*1
+#define RB_SCID_BIOS_VERSION		0x06	// str
+#define RB_SCID_BOOT_PROTOCOL		0x09	// u32*1
+#define RB_SCID_CPU_FREQ_IDX		0x0C	// u32*1
+#define RB_SCID_BOOTER			0x0D	// u32*1
+#define RB_SCID_SILENT_BOOT		0x0F	// u32*1
+/*
+ * protected_routerboot seems to use tag 0x1F. It only works in combination with
+ * RouterOS, resulting in a wiped board otherwise, so it's not implemented here.
+ * The tag values are as follows:
+ * - off: 0x0
+ * - on: the lower halfword encodes the max value in s for the reset feature,
+ *	 the higher halfword encodes the min value in s for the reset feature.
+ * Default value when on: 0x00140258: 0x14 = 20s / 0x258= 600s
+ * See details here: https://wiki.mikrotik.com/wiki/Manual:RouterBOARD_settings#Protected_bootloader
+ */
+
+/* Tag values */
+
+#define RB_UART_SPEED_115200		0
+#define RB_UART_SPEED_57600		1
+#define RB_UART_SPEED_38400		2
+#define RB_UART_SPEED_19200		3
+#define RB_UART_SPEED_9600		4
+#define RB_UART_SPEED_4800		5
+#define RB_UART_SPEED_2400		6
+#define RB_UART_SPEED_1200		7
+#define RB_UART_SPEED_OFF		8
+
+/* valid boot delay: 1 - 9s in 1s increment */
+#define RB_BOOT_DELAY_MIN		1
+#define RB_BOOT_DELAY_MAX		9
+
+#define RB_BOOT_DEVICE_ETHER		0	// "boot over Ethernet"
+#define RB_BOOT_DEVICE_NANDETH		1	// "boot from NAND, if fail then Ethernet"
+#define RB_BOOT_DEVICE_CFCARD		2	// (not available in rbcfg)
+#define RB_BOOT_DEVICE_ETHONCE		3	// "boot Ethernet once, then NAND"
+#define RB_BOOT_DEVICE_NANDONLY		5	// "boot from NAND only"
+#define RB_BOOT_DEVICE_FLASHCFG		7	// "boot in flash configuration mode"
+#define RB_BOOT_DEVICE_FLSHONCE		8	// "boot in flash configuration mode once, then NAND"
+
+/*
+ * ATH79 9xxx CPU frequency indices.
+ * It is unknown if they apply to all ATH79 RBs, and some do not seem to feature
+ * the upper levels (QCA955x), while F is presumably AR9344-only.
+ */
+#define RB_CPU_FREQ_IDX_ATH79_9X_A	(0 << 3)
+#define RB_CPU_FREQ_IDX_ATH79_9X_B	(1 << 3)	// 0x8
+#define RB_CPU_FREQ_IDX_ATH79_9X_C	(2 << 3)	// 0x10 - factory freq for many devices
+#define RB_CPU_FREQ_IDX_ATH79_9X_D	(3 << 3)	// 0x18
+#define RB_CPU_FREQ_IDX_ATH79_9X_E	(4 << 3)	// 0x20
+#define RB_CPU_FREQ_IDX_ATH79_9X_F	(5 << 3)	// 0x28
+
+#define RB_CPU_FREQ_IDX_ATH79_9X_MIN		0	// all devices support lowest setting
+#define RB_CPU_FREQ_IDX_ATH79_9X_AR9334_MAX	5	// stops at F
+#define RB_CPU_FREQ_IDX_ATH79_9X_QCA953X_MAX	4	// stops at E
+#define RB_CPU_FREQ_IDX_ATH79_9X_QCA9556_MAX	2	// stops at C
+#define RB_CPU_FREQ_IDX_ATH79_9X_QCA9558_MAX	3	// stops at D
+
+/* ATH79 7xxx CPU frequency indices. */
+#define RB_CPU_FREQ_IDX_ATH79_7X_A	((0 * 9) << 4)
+#define RB_CPU_FREQ_IDX_ATH79_7X_B	((1 * 9) << 4)
+#define RB_CPU_FREQ_IDX_ATH79_7X_C	((2 * 9) << 4)
+#define RB_CPU_FREQ_IDX_ATH79_7X_D	((3 * 9) << 4)
+#define RB_CPU_FREQ_IDX_ATH79_7X_E	((4 * 9) << 4)
+#define RB_CPU_FREQ_IDX_ATH79_7X_F	((5 * 9) << 4)
+#define RB_CPU_FREQ_IDX_ATH79_7X_G	((6 * 9) << 4)
+#define RB_CPU_FREQ_IDX_ATH79_7X_H	((7 * 9) << 4)
+
+#define RB_CPU_FREQ_IDX_ATH79_7X_MIN		0	// all devices support lowest setting
+#define RB_CPU_FREQ_IDX_ATH79_7X_AR724X_MAX	3	// stops at D
+#define RB_CPU_FREQ_IDX_ATH79_7X_AR7161_MAX	7	// stops at H - check if applies to all AR71xx devices
+
+#define RB_SC_CRC32_OFFSET		4	// located right after magic
+
+static struct kobject *sc_kobj;
+static u8 *sc_buf;
+static size_t sc_buflen;
+static rwlock_t sc_bufrwl;		// rw lock to sc_buf
+
+/* MUST be used with lock held */
+#define RB_SC_CLRCRC()		*(u32 *)(sc_buf + RB_SC_CRC32_OFFSET) = 0
+#define RB_SC_GETCRC()		*(u32 *)(sc_buf + RB_SC_CRC32_OFFSET)
+#define RB_SC_SETCRC(_crc)	*(u32 *)(sc_buf + RB_SC_CRC32_OFFSET) = (_crc)
+
+struct sc_u32tvs {
+	const u32 val;
+	const char *str;
+};
+
+#define RB_SC_TVS(_val, _str) {		\
+	.val = (_val),			\
+	.str = (_str),			\
+}
+
+static ssize_t sc_tag_show_u32tvs(const u8 *pld, u16 pld_len, char *buf,
+				  const struct sc_u32tvs tvs[], const int tvselmts)
+{
+	const char *fmt;
+	char *out = buf;
+	u32 data;	// cpu-endian
+	int i;
+
+	// fallback to raw hex output if we can't handle the input
+	if (tvselmts < 0)
+		return routerboot_tag_show_u32s(pld, pld_len, buf);
+
+	if (sizeof(data) != pld_len)
+		return -EINVAL;
+
+	read_lock(&sc_bufrwl);
+	data = *(u32 *)pld;		// pld aliases sc_buf
+	read_unlock(&sc_bufrwl);
+
+	for (i = 0; i < tvselmts; i++) {
+		fmt = (tvs[i].val == data) ? "[%s] " : "%s ";
+		out += sprintf(out, fmt, tvs[i].str);
+	}
+
+	out += sprintf(out, "\n");
+	return out - buf;
+}
+
+static ssize_t sc_tag_store_u32tvs(const u8 *pld, u16 pld_len, const char *buf, size_t count,
+				   const struct sc_u32tvs tvs[], const int tvselmts)
+{
+	int i;
+
+	if (tvselmts < 0)
+		return tvselmts;
+
+	if (sizeof(u32) != pld_len)
+		return -EINVAL;
+
+	for (i = 0; i < tvselmts; i++) {
+		if (sysfs_streq(buf, tvs[i].str)) {
+			write_lock(&sc_bufrwl);
+			*(u32 *)pld = tvs[i].val;	// pld aliases sc_buf
+			RB_SC_CLRCRC();
+			write_unlock(&sc_bufrwl);
+			return count;
+		}
+	}
+
+	return -EINVAL;
+}
+
+struct sc_boolts {
+	const char *strfalse;
+	const char *strtrue;
+};
+
+static ssize_t sc_tag_show_boolts(const u8 *pld, u16 pld_len, char *buf,
+				  const struct sc_boolts *bts)
+{
+	const char *fmt;
+	char *out = buf;
+	u32 data;	// cpu-endian
+
+	if (sizeof(data) != pld_len)
+		return -EINVAL;
+
+	read_lock(&sc_bufrwl);
+	data = *(u32 *)pld;		// pld aliases sc_buf
+	read_unlock(&sc_bufrwl);
+
+	fmt = (data) ? "%s [%s]\n" : "[%s] %s\n";
+	out += sprintf(out, fmt, bts->strfalse, bts->strtrue);
+
+	return out - buf;
+}
+
+static ssize_t sc_tag_store_boolts(const u8 *pld, u16 pld_len, const char *buf, size_t count,
+				   const struct sc_boolts *bts)
+{
+	u32 data;	// cpu-endian
+
+	if (sizeof(data) != pld_len)
+		return -EINVAL;
+
+	if (sysfs_streq(buf, bts->strfalse))
+		data = 0;
+	else if (sysfs_streq(buf, bts->strtrue))
+		data = 1;
+	else
+		return -EINVAL;
+
+	write_lock(&sc_bufrwl);
+	*(u32 *)pld = data;		// pld aliases sc_buf
+	RB_SC_CLRCRC();
+	write_unlock(&sc_bufrwl);
+
+	return count;
+}
+static struct sc_u32tvs const sc_uartspeeds[] = {
+	RB_SC_TVS(RB_UART_SPEED_OFF,	"off"),
+	RB_SC_TVS(RB_UART_SPEED_1200,	"1200"),
+	RB_SC_TVS(RB_UART_SPEED_2400,	"2400"),
+	RB_SC_TVS(RB_UART_SPEED_4800,	"4800"),
+	RB_SC_TVS(RB_UART_SPEED_9600,	"9600"),
+	RB_SC_TVS(RB_UART_SPEED_19200,	"19200"),
+	RB_SC_TVS(RB_UART_SPEED_38400,	"38400"),
+	RB_SC_TVS(RB_UART_SPEED_57600,	"57600"),
+	RB_SC_TVS(RB_UART_SPEED_115200,	"115200"),
+};
+
+/*
+ * While the defines are carried over from rbcfg, use strings that more clearly
+ * show the actual setting purpose (especially since the NAND* settings apply
+ * to both nand- and nor-based devices). "cfcard" was disabled in rbcfg: disable
+ * it here too.
+ */
+static struct sc_u32tvs const sc_bootdevices[] = {
+	RB_SC_TVS(RB_BOOT_DEVICE_ETHER,		"eth"),
+	RB_SC_TVS(RB_BOOT_DEVICE_NANDETH,	"flasheth"),
+	//RB_SC_TVS(RB_BOOT_DEVICE_CFCARD,	"cfcard"),
+	RB_SC_TVS(RB_BOOT_DEVICE_ETHONCE,	"ethonce"),
+	RB_SC_TVS(RB_BOOT_DEVICE_NANDONLY,	"flash"),
+	RB_SC_TVS(RB_BOOT_DEVICE_FLASHCFG,	"cfg"),
+	RB_SC_TVS(RB_BOOT_DEVICE_FLSHONCE,	"cfgonce"),
+};
+
+static struct sc_boolts const sc_bootkey = {
+	.strfalse = "any",
+	.strtrue = "del",
+};
+
+static struct sc_boolts const sc_cpumode = {
+	.strfalse = "powersave",
+	.strtrue = "regular",
+};
+
+static struct sc_boolts const sc_bootproto = {
+	.strfalse = "bootp",
+	.strtrue = "dhcp",
+};
+
+static struct sc_boolts const sc_booter = {
+	.strfalse = "regular",
+	.strtrue = "backup",
+};
+
+static struct sc_boolts const sc_silent_boot = {
+	.strfalse = "off",
+	.strtrue = "on",
+};
+
+#define SC_TAG_SHOW_STORE_U32TVS_FUNCS(_name)		\
+static ssize_t sc_tag_show_##_name(const u8 *pld, u16 pld_len, char *buf)	\
+{										\
+	return sc_tag_show_u32tvs(pld, pld_len, buf, sc_##_name, ARRAY_SIZE(sc_##_name));	\
+}										\
+static ssize_t sc_tag_store_##_name(const u8 *pld, u16 pld_len, const char *buf, size_t count)	\
+{										\
+	return sc_tag_store_u32tvs(pld, pld_len, buf, count, sc_##_name, ARRAY_SIZE(sc_##_name));	\
+}
+
+#define SC_TAG_SHOW_STORE_BOOLTS_FUNCS(_name)		\
+static ssize_t sc_tag_show_##_name(const u8 *pld, u16 pld_len, char *buf)	\
+{										\
+	return sc_tag_show_boolts(pld, pld_len, buf, &sc_##_name);	\
+}										\
+static ssize_t sc_tag_store_##_name(const u8 *pld, u16 pld_len, const char *buf, size_t count)	\
+{										\
+	return sc_tag_store_boolts(pld, pld_len, buf, count, &sc_##_name);	\
+}
+
+SC_TAG_SHOW_STORE_U32TVS_FUNCS(uartspeeds)
+SC_TAG_SHOW_STORE_U32TVS_FUNCS(bootdevices)
+SC_TAG_SHOW_STORE_BOOLTS_FUNCS(bootkey)
+SC_TAG_SHOW_STORE_BOOLTS_FUNCS(cpumode)
+SC_TAG_SHOW_STORE_BOOLTS_FUNCS(bootproto)
+SC_TAG_SHOW_STORE_BOOLTS_FUNCS(booter)
+SC_TAG_SHOW_STORE_BOOLTS_FUNCS(silent_boot)
+
+static ssize_t sc_tag_show_bootdelays(const u8 *pld, u16 pld_len, char *buf)
+{
+	const char *fmt;
+	char *out = buf;
+	u32 data;	// cpu-endian
+	int i;
+
+	if (sizeof(data) != pld_len)
+		return -EINVAL;
+
+	read_lock(&sc_bufrwl);
+	data = *(u32 *)pld;		// pld aliases sc_buf
+	read_unlock(&sc_bufrwl);
+
+	for (i = RB_BOOT_DELAY_MIN; i <= RB_BOOT_DELAY_MAX; i++) {
+		fmt = (i == data) ? "[%d] " : "%d ";
+		out += sprintf(out, fmt, i);
+	}
+
+	out += sprintf(out, "\n");
+	return out - buf;
+}
+
+static ssize_t sc_tag_store_bootdelays(const u8 *pld, u16 pld_len, const char *buf, size_t count)
+{
+	u32 data;	// cpu-endian
+	int ret;
+
+	if (sizeof(data) != pld_len)
+		return -EINVAL;
+
+	ret = kstrtou32(buf, 10, &data);
+	if (ret)
+		return ret;
+
+	if ((data < RB_BOOT_DELAY_MIN) || (RB_BOOT_DELAY_MAX < data))
+		return -EINVAL;
+
+	write_lock(&sc_bufrwl);
+	*(u32 *)pld = data;		// pld aliases sc_buf
+	RB_SC_CLRCRC();
+	write_unlock(&sc_bufrwl);
+
+	return count;
+}
+
+/* Support CPU frequency accessors only when the tag format has been asserted */
+#if defined(CONFIG_ATH79)
+/* Use the same letter-based nomenclature as RouterBOOT */
+static struct sc_u32tvs const sc_cpufreq_indexes_ath79_9x[] = {
+	RB_SC_TVS(RB_CPU_FREQ_IDX_ATH79_9X_A,	"a"),
+	RB_SC_TVS(RB_CPU_FREQ_IDX_ATH79_9X_B,	"b"),
+	RB_SC_TVS(RB_CPU_FREQ_IDX_ATH79_9X_C,	"c"),
+	RB_SC_TVS(RB_CPU_FREQ_IDX_ATH79_9X_D,	"d"),
+	RB_SC_TVS(RB_CPU_FREQ_IDX_ATH79_9X_E,	"e"),
+	RB_SC_TVS(RB_CPU_FREQ_IDX_ATH79_9X_F,	"f"),
+};
+
+static struct sc_u32tvs const sc_cpufreq_indexes_ath79_7x[] = {
+	RB_SC_TVS(RB_CPU_FREQ_IDX_ATH79_7X_A,	"a"),
+	RB_SC_TVS(RB_CPU_FREQ_IDX_ATH79_7X_B,	"b"),
+	RB_SC_TVS(RB_CPU_FREQ_IDX_ATH79_7X_C,	"c"),
+	RB_SC_TVS(RB_CPU_FREQ_IDX_ATH79_7X_D,	"d"),
+	RB_SC_TVS(RB_CPU_FREQ_IDX_ATH79_7X_E,	"e"),
+	RB_SC_TVS(RB_CPU_FREQ_IDX_ATH79_7X_F,	"f"),
+	RB_SC_TVS(RB_CPU_FREQ_IDX_ATH79_7X_G,	"g"),
+	RB_SC_TVS(RB_CPU_FREQ_IDX_ATH79_7X_H,	"h"),
+};
+
+static int sc_tag_cpufreq_ath79_arraysize(void)
+{
+	int idx_max;
+
+	if (ATH79_SOC_AR7161 == ath79_soc)
+		idx_max = RB_CPU_FREQ_IDX_ATH79_7X_AR7161_MAX+1;
+	else if (soc_is_ar724x())
+		idx_max = RB_CPU_FREQ_IDX_ATH79_7X_AR724X_MAX+1;
+	else if (soc_is_ar9344())
+		idx_max = RB_CPU_FREQ_IDX_ATH79_9X_AR9334_MAX+1;
+	else if (soc_is_qca953x())
+		idx_max = RB_CPU_FREQ_IDX_ATH79_9X_QCA953X_MAX+1;
+	else if (soc_is_qca9556())
+		idx_max = RB_CPU_FREQ_IDX_ATH79_9X_QCA9556_MAX+1;
+	else if (soc_is_qca9558())
+		idx_max = RB_CPU_FREQ_IDX_ATH79_9X_QCA9558_MAX+1;
+	else
+		idx_max = -EOPNOTSUPP;
+
+	return idx_max;
+}
+
+static ssize_t sc_tag_show_cpufreq_indexes(const u8 *pld, u16 pld_len, char *buf)
+{
+	const struct sc_u32tvs *tvs;
+
+	if (soc_is_ar71xx() || soc_is_ar724x())
+		tvs = sc_cpufreq_indexes_ath79_7x;
+	else
+		tvs = sc_cpufreq_indexes_ath79_9x;
+
+	return sc_tag_show_u32tvs(pld, pld_len, buf, tvs, sc_tag_cpufreq_ath79_arraysize());
+}
+
+static ssize_t sc_tag_store_cpufreq_indexes(const u8 *pld, u16 pld_len, const char *buf, size_t count)
+{
+	const struct sc_u32tvs *tvs;
+
+	if (soc_is_ar71xx() || soc_is_ar724x())
+		tvs = sc_cpufreq_indexes_ath79_7x;
+	else
+		tvs = sc_cpufreq_indexes_ath79_9x;
+
+	return sc_tag_store_u32tvs(pld, pld_len, buf, count, tvs, sc_tag_cpufreq_ath79_arraysize());
+}
+#else
+ /* By default we only show the raw value to help with reverse-engineering */
+ #define sc_tag_show_cpufreq_indexes	routerboot_tag_show_u32s
+ #define sc_tag_store_cpufreq_indexes	NULL
+#endif
+
+static ssize_t sc_attr_show(struct kobject *kobj, struct kobj_attribute *attr,
+			    char *buf);
+static ssize_t sc_attr_store(struct kobject *kobj, struct kobj_attribute *attr,
+			     const char *buf, size_t count);
+
+/* Array of known tags to publish in sysfs */
+static struct sc_attr {
+	const u16 tag_id;
+	/* sysfs tag show attribute. Must lock sc_buf when dereferencing pld */
+	ssize_t (* const tshow)(const u8 *pld, u16 pld_len, char *buf);
+	/* sysfs tag store attribute. Must lock sc_buf when dereferencing pld */
+	ssize_t (* const tstore)(const u8 *pld, u16 pld_len, const char *buf, size_t count);
+	struct kobj_attribute kattr;
+	u16 pld_ofs;
+	u16 pld_len;
+} sc_attrs[] = {
+	{
+		.tag_id = RB_SCID_UART_SPEED,
+		.tshow = sc_tag_show_uartspeeds,
+		.tstore = sc_tag_store_uartspeeds,
+		.kattr = __ATTR(uart_speed, RB_SC_RMODE|RB_SC_WMODE, sc_attr_show, sc_attr_store),
+	}, {
+		.tag_id = RB_SCID_BOOT_DELAY,
+		.tshow = sc_tag_show_bootdelays,
+		.tstore = sc_tag_store_bootdelays,
+		.kattr = __ATTR(boot_delay, RB_SC_RMODE|RB_SC_WMODE, sc_attr_show, sc_attr_store),
+	}, {
+		.tag_id = RB_SCID_BOOT_DEVICE,
+		.tshow = sc_tag_show_bootdevices,
+		.tstore = sc_tag_store_bootdevices,
+		.kattr = __ATTR(boot_device, RB_SC_RMODE|RB_SC_WMODE, sc_attr_show, sc_attr_store),
+	}, {
+		.tag_id = RB_SCID_BOOT_KEY,
+		.tshow = sc_tag_show_bootkey,
+		.tstore = sc_tag_store_bootkey,
+		.kattr = __ATTR(boot_key, RB_SC_RMODE|RB_SC_WMODE, sc_attr_show, sc_attr_store),
+	}, {
+		.tag_id = RB_SCID_CPU_MODE,
+		.tshow = sc_tag_show_cpumode,
+		.tstore = sc_tag_store_cpumode,
+		.kattr = __ATTR(cpu_mode, RB_SC_RMODE|RB_SC_WMODE, sc_attr_show, sc_attr_store),
+	}, {
+		.tag_id = RB_SCID_BIOS_VERSION,
+		.tshow = routerboot_tag_show_string,
+		.tstore = NULL,
+		.kattr = __ATTR(bios_version, RB_SC_RMODE, sc_attr_show, NULL),
+	}, {
+		.tag_id = RB_SCID_BOOT_PROTOCOL,
+		.tshow = sc_tag_show_bootproto,
+		.tstore = sc_tag_store_bootproto,
+		.kattr = __ATTR(boot_proto, RB_SC_RMODE|RB_SC_WMODE, sc_attr_show, sc_attr_store),
+	}, {
+		.tag_id = RB_SCID_CPU_FREQ_IDX,
+		.tshow = sc_tag_show_cpufreq_indexes,
+		.tstore = sc_tag_store_cpufreq_indexes,
+		.kattr = __ATTR(cpufreq_index, RB_SC_RMODE|RB_SC_WMODE, sc_attr_show, sc_attr_store),
+	}, {
+		.tag_id = RB_SCID_BOOTER,
+		.tshow = sc_tag_show_booter,
+		.tstore = sc_tag_store_booter,
+		.kattr = __ATTR(booter, RB_SC_RMODE|RB_SC_WMODE, sc_attr_show, sc_attr_store),
+	}, {
+		.tag_id = RB_SCID_SILENT_BOOT,
+		.tshow = sc_tag_show_silent_boot,
+		.tstore = sc_tag_store_silent_boot,
+		.kattr = __ATTR(silent_boot, RB_SC_RMODE|RB_SC_WMODE, sc_attr_show, sc_attr_store),
+	},
+};
+
+static ssize_t sc_attr_show(struct kobject *kobj, struct kobj_attribute *attr,
+			    char *buf)
+{
+	const struct sc_attr *sc_attr;
+	const u8 *pld;
+	u16 pld_len;
+
+	sc_attr = container_of(attr, typeof(*sc_attr), kattr);
+
+	if (!sc_attr->pld_len)
+		return -ENOENT;
+
+	pld = sc_buf + sc_attr->pld_ofs;	// pld aliases sc_buf -> lock!
+	pld_len = sc_attr->pld_len;
+
+	return sc_attr->tshow(pld, pld_len, buf);
+}
+
+static ssize_t sc_attr_store(struct kobject *kobj, struct kobj_attribute *attr,
+			     const char *buf, size_t count)
+{
+	const struct sc_attr *sc_attr;
+	const u8 *pld;
+	u16 pld_len;
+
+	if (!RB_SC_HAS_WRITE_SUPPORT)
+		return -EOPNOTSUPP;
+
+	if (!capable(CAP_SYS_ADMIN))
+		return -EACCES;
+
+	sc_attr = container_of(attr, typeof(*sc_attr), kattr);
+
+	if (!sc_attr->tstore)
+		return -EOPNOTSUPP;
+
+	if (!sc_attr->pld_len)
+		return -ENOENT;
+
+	pld = sc_buf + sc_attr->pld_ofs;	// pld aliases sc_buf -> lock!
+	pld_len = sc_attr->pld_len;
+
+	return sc_attr->tstore(pld, pld_len, buf, count);
+}
+
+/*
+ * Shows the current buffer status:
+ * "clean": the buffer is in sync with the mtd data
+ * "dirty": the buffer is out of sync with the mtd data
+ */
+static ssize_t sc_commit_show(struct kobject *kobj, struct kobj_attribute *attr,
+			      char *buf)
+{
+	const char *str;
+	char *out = buf;
+	u32 crc;
+
+	read_lock(&sc_bufrwl);
+	crc = RB_SC_GETCRC();
+	read_unlock(&sc_bufrwl);
+
+	str = (crc) ? "clean" : "dirty";
+	out += sprintf(out, "%s\n", str);
+
+	return out - buf;
+}
+
+/*
+ * Performs buffer flushing:
+ * This routine expects an input compatible with kstrtobool().
+ * - a "false" input discards the current changes and reads data back from mtd.
+ * - a "true" input commits the current changes to mtd.
+ * If there is no pending changes, this routine is a no-op.
+ * Handling failures is left as an exercise to userspace.
+ */
+static ssize_t sc_commit_store(struct kobject *kobj, struct kobj_attribute *attr,
+			      const char *buf, size_t count)
+{
+	struct mtd_info *mtd;
+	struct erase_info ei;
+	size_t bytes_rw, ret = count;
+	bool flush;
+	u32 crc;
+
+	if (!RB_SC_HAS_WRITE_SUPPORT)
+		return -EOPNOTSUPP;
+
+	read_lock(&sc_bufrwl);
+	crc = RB_SC_GETCRC();
+	read_unlock(&sc_bufrwl);
+
+	if (crc)
+		return count;	// NO-OP
+
+	ret = kstrtobool(buf, &flush);
+	if (ret)
+		return ret;
+
+	mtd = get_mtd_device_nm(RB_MTD_SOFT_CONFIG);	// TODO allow override
+	if (IS_ERR(mtd))
+		return -ENODEV;
+
+	write_lock(&sc_bufrwl);
+	if (!flush)	// reread
+		ret = mtd_read(mtd, 0, mtd->size, &bytes_rw, sc_buf);
+	else {	// crc32 + commit
+		/*
+		 * CRC32 is computed on the entire buffer, excluding the CRC
+		 * value itself. CRC is already null when we reach this point,
+		 * so we can compute the CRC32 on the buffer as is.
+		 * The expected CRC32 is Ethernet FCS style, meaning the seed is
+		 * ~0 and the final result is also bitflipped.
+		 */
+
+		crc = ~crc32(~0, sc_buf, sc_buflen);
+		RB_SC_SETCRC(crc);
+
+		/*
+		 * The soft_config partition is assumed to be entirely contained
+		 * in a single eraseblock.
+		 */
+
+		ei.addr = 0;
+		ei.len = mtd->size;
+		ret = mtd_erase(mtd, &ei);
+		if (!ret)
+			ret = mtd_write(mtd, 0, mtd->size, &bytes_rw, sc_buf);
+
+		/*
+		 * Handling mtd_write() failure here is a tricky situation. The
+		 * proposed approach is to let userspace deal with retrying,
+		 * with the caveat that it must try to flush the buffer again as
+		 * rereading the mtd contents could potentially read garbage.
+		 * The rationale is: even if we keep a shadow buffer of the
+		 * original content, there is no guarantee that we will ever be
+		 * able to write it anyway.
+		 * Regardless, it appears that RouterBOOT will ignore an invalid
+		 * soft_config (including a completely wiped segment) and will
+		 * write back factory defaults when it happens.
+		 */
+	}
+	write_unlock(&sc_bufrwl);
+
+	put_mtd_device(mtd);
+
+	if (ret)
+		goto mtdfail;
+
+	if (bytes_rw != sc_buflen) {
+		ret = -EIO;
+		goto mtdfail;
+	}
+
+	return count;
+
+mtdfail:
+	RB_SC_CLRCRC();	// mark buffer content as dirty/invalid
+	return ret;
+}
+
+static struct kobj_attribute sc_kattrcommit = __ATTR(commit, RB_SC_RMODE|RB_SC_WMODE, sc_commit_show, sc_commit_store);
+
+int rb_softconfig_init(struct kobject *rb_kobj, struct mtd_info *mtd)
+{
+	size_t bytes_read, buflen;
+	const u8 *buf;
+	int i, ret;
+	u32 magic;
+
+	sc_buf = NULL;
+	sc_kobj = NULL;
+
+	ret = __get_mtd_device(mtd);
+	if (ret)
+		return -ENODEV;
+
+	sc_buflen = mtd->size;
+	sc_buf = kmalloc(sc_buflen, GFP_KERNEL);
+	if (!sc_buf) {
+		__put_mtd_device(mtd);
+		return -ENOMEM;
+	}
+
+	ret = mtd_read(mtd, 0, sc_buflen, &bytes_read, sc_buf);
+	__put_mtd_device(mtd);
+
+	if (ret)
+		goto fail;
+
+	if (bytes_read != sc_buflen) {
+		ret = -EIO;
+		goto fail;
+	}
+
+	/* Check we have what we expect */
+	magic = *(const u32 *)sc_buf;
+	if (RB_MAGIC_SOFT != magic) {
+		ret = -EINVAL;
+		goto fail;
+	}
+
+	/* Skip magic and 32bit CRC located immediately after */
+	buf = sc_buf + (sizeof(magic) + sizeof(u32));
+	buflen = sc_buflen - (sizeof(magic) + sizeof(u32));
+
+	/* Populate sysfs */
+	ret = -ENOMEM;
+	sc_kobj = kobject_create_and_add(RB_MTD_SOFT_CONFIG, rb_kobj);
+	if (!sc_kobj)
+		goto fail;
+
+	rwlock_init(&sc_bufrwl);
+
+	/* Locate and publish all known tags */
+	for (i = 0; i < ARRAY_SIZE(sc_attrs); i++) {
+		ret = routerboot_tag_find(buf, buflen, sc_attrs[i].tag_id,
+					  &sc_attrs[i].pld_ofs, &sc_attrs[i].pld_len);
+		if (ret) {
+			sc_attrs[i].pld_ofs = sc_attrs[i].pld_len = 0;
+			continue;
+		}
+
+		/* Account for skipped magic and crc32 */
+		sc_attrs[i].pld_ofs += sizeof(magic) + sizeof(u32);
+
+		ret = sysfs_create_file(sc_kobj, &sc_attrs[i].kattr.attr);
+		if (ret)
+			pr_warn(RB_SC_PR_PFX "Could not create %s sysfs entry (%d)\n",
+			       sc_attrs[i].kattr.attr.name, ret);
+	}
+
+	/* Finally add the 'commit' attribute */
+	if (RB_SC_HAS_WRITE_SUPPORT) {
+		ret = sysfs_create_file(sc_kobj, &sc_kattrcommit.attr);
+		if (ret) {
+			pr_err(RB_SC_PR_PFX "Could not create %s sysfs entry (%d), aborting!\n",
+			       sc_kattrcommit.attr.name, ret);
+			goto sysfsfail;	// required attribute
+		}
+	}
+
+	pr_info("MikroTik RouterBOARD software configuration sysfs driver v" RB_SOFTCONFIG_VER "\n");
+
+	return 0;
+
+sysfsfail:
+	kobject_put(sc_kobj);
+	sc_kobj = NULL;
+fail:
+	kfree(sc_buf);
+	sc_buf = NULL;
+	return ret;
+}
+
+void rb_softconfig_exit(void)
+{
+	kobject_put(sc_kobj);
+	sc_kobj = NULL;
+	kfree(sc_buf);
+	sc_buf = NULL;
+}
diff --git a/6.12/target/linux/generic/files/drivers/platform/mikrotik/routerboot.c b/6.12/target/linux/generic/files/drivers/platform/mikrotik/routerboot.c
new file mode 100644
index 00000000..96f24609
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/platform/mikrotik/routerboot.c
@@ -0,0 +1,251 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Driver for MikroTik RouterBoot flash data. Common routines.
+ *
+ * Copyright (C) 2020 Thibaut VARÈNE <hacks+kernel@slashdirt.org>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ */
+
+#include <linux/types.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/sysfs.h>
+#include <linux/mtd/mtd.h>
+
+#include "routerboot.h"
+
+static struct kobject *rb_kobj;
+
+/**
+ * routerboot_tag_find() - Locate a given tag in routerboot config data.
+ * @bufhead: the buffer to look into. Must start with a tag node.
+ * @buflen: size of bufhead
+ * @tag_id: the tag identifier to look for
+ * @pld_ofs: will be updated with tag payload offset in bufhead, if tag found
+ * @pld_len: will be updated with tag payload size, if tag found
+ *
+ * This incarnation of tag_find() does only that: it finds a specific routerboot
+ * tag node in the input buffer. Routerboot tag nodes are u32 values:
+ * - The low nibble is the tag identification number,
+ * - The high nibble is the tag payload length (node excluded) in bytes.
+ * The payload immediately follows the tag node. Tag nodes are 32bit-aligned.
+ * The returned pld_ofs will always be aligned. pld_len may not end on 32bit
+ * boundary (the only known case is when parsing ERD data).
+ * The nodes are cpu-endian on the flash media. The payload is cpu-endian when
+ * applicable. Tag nodes are not ordered (by ID) on flash.
+ *
+ * Return: 0 on success (tag found) or errno
+ */
+int routerboot_tag_find(const u8 *bufhead, const size_t buflen, const u16 tag_id,
+			u16 *pld_ofs, u16 *pld_len)
+{
+	const u32 *datum, *bufend;
+	u32 node;
+	u16 id, len;
+	int ret;
+
+	if (!bufhead || !tag_id)
+		return -EINVAL;
+
+	ret = -ENOENT;
+	datum = (const u32 *)bufhead;
+	bufend = (const u32 *)(bufhead + buflen);
+
+	while (datum < bufend) {
+		node = *datum++;
+
+		/* Tag list ends with null node */
+		if (!node)
+			break;
+
+		id = node & 0xFFFF;
+		len = node >> 16;
+
+		if (tag_id == id) {
+			if (datum >= bufend)
+				break;
+
+			if (pld_ofs)
+				*pld_ofs = (u16)((u8 *)datum - bufhead);
+			if (pld_len)
+				*pld_len = len;
+
+			ret = 0;
+			break;
+		}
+
+		/*
+		 * The only known situation where len may not end on 32bit
+		 * boundary is within ERD data. Since we're only extracting
+		 * one tag (the first and only one) from that data, we should
+		 * never need to forcefully ALIGN(). Do it anyway, this is not a
+		 * performance path.
+		 */
+		len = ALIGN(len, sizeof(*datum));
+		datum += len / sizeof(*datum);
+	}
+
+	return ret;
+}
+
+/**
+ * routerboot_rle_decode() - Simple RLE (MikroTik variant) decoding routine.
+ * @in: input buffer to decode
+ * @inlen: size of in
+ * @out: output buffer to write decoded data to
+ * @outlen: pointer to out size when function is called, will be updated with
+ * size of decoded output on return
+ *
+ * MikroTik's variant of RLE operates as follows, considering a signed run byte:
+ * - positive run => classic RLE
+ * - negative run => the next -<run> bytes must be copied verbatim
+ * The API is matched to the lzo1x routines for convenience.
+ *
+ * NB: The output buffer cannot overlap with the input buffer.
+ *
+ * Return: 0 on success or errno
+ */
+int routerboot_rle_decode(const u8 *in, size_t inlen, u8 *out, size_t *outlen)
+{
+	int ret, run, nbytes;	// use native types for speed
+	u8 byte;
+
+	if (!in || (inlen < 2) || !out)
+		return -EINVAL;
+
+	ret = -ENOSPC;
+	nbytes = 0;
+	while (inlen >= 2) {
+		run = *in++;
+		inlen--;
+
+		/* Verbatim copies */
+		if (run & 0x80) {
+			/* Invert run byte sign */
+			run = ~run & 0xFF;
+			run++;
+
+			if (run > inlen)
+				goto fail;
+
+			inlen -= run;
+
+			nbytes += run;
+			if (nbytes > *outlen)
+				goto fail;
+
+			/* Basic memcpy */
+			while (run-- > 0)
+				*out++ = *in++;
+		}
+		/* Stream of half-words RLE: <run><byte>. run == 0 is ignored */
+		else {
+			byte = *in++;
+			inlen--;
+
+			nbytes += run;
+			if (nbytes > *outlen)
+				goto fail;
+
+			while (run-- > 0)
+				*out++ = byte;
+		}
+	}
+
+	ret = 0;
+fail:
+	*outlen = nbytes;
+	return ret;
+}
+
+static void routerboot_mtd_notifier_add(struct mtd_info *mtd)
+{
+	/* Currently routerboot is only known to live on NOR flash */
+	if (mtd->type != MTD_NORFLASH)
+		return;
+
+	/*
+	 * We ignore the following return values and always register.
+	 * These init() routines are designed so that their failed state is
+	 * always manageable by the corresponding exit() calls.
+	 * Notifier is called with MTD mutex held: use __get/__put variants.
+	 * TODO: allow partition names override
+	 */
+	if (!strcmp(mtd->name, RB_MTD_HARD_CONFIG))
+		rb_hardconfig_init(rb_kobj, mtd);
+	else if (!strcmp(mtd->name, RB_MTD_SOFT_CONFIG))
+		rb_softconfig_init(rb_kobj, mtd);
+}
+
+static void routerboot_mtd_notifier_remove(struct mtd_info *mtd)
+{
+	if (mtd->type != MTD_NORFLASH)
+		return;
+
+	if (!strcmp(mtd->name, RB_MTD_HARD_CONFIG))
+		rb_hardconfig_exit();
+	else if (!strcmp(mtd->name, RB_MTD_SOFT_CONFIG))
+		rb_softconfig_exit();
+}
+
+/* Note: using a notifier prevents qualifying init()/exit() functions with __init/__exit */
+static struct mtd_notifier routerboot_mtd_notifier = {
+	.add = routerboot_mtd_notifier_add,
+	.remove = routerboot_mtd_notifier_remove,
+};
+
+static int __init routerboot_init(void)
+{
+	rb_kobj = kobject_create_and_add("mikrotik", firmware_kobj);
+	if (!rb_kobj)
+		return -ENOMEM;
+
+	register_mtd_user(&routerboot_mtd_notifier);
+
+	return 0;
+}
+
+static void __exit routerboot_exit(void)
+{
+	unregister_mtd_user(&routerboot_mtd_notifier);
+	/* Exit routines are idempotent */
+	rb_softconfig_exit();
+	rb_hardconfig_exit();
+	kobject_put(rb_kobj);	// recursive afaict
+}
+
+/* Common routines */
+
+ssize_t routerboot_tag_show_string(const u8 *pld, u16 pld_len, char *buf)
+{
+	return scnprintf(buf, pld_len+1, "%s\n", pld);
+}
+
+ssize_t routerboot_tag_show_u32s(const u8 *pld, u16 pld_len, char *buf)
+{
+	char *out = buf;
+	u32 *data;	// cpu-endian
+
+	/* Caller ensures pld_len > 0 */
+	if (pld_len % sizeof(*data))
+		return -EINVAL;
+
+	data = (u32 *)pld;
+
+	do {
+		out += sprintf(out, "0x%08x\n", *data);
+		data++;
+	} while ((pld_len -= sizeof(*data)));
+
+	return out - buf;
+}
+
+module_init(routerboot_init);
+module_exit(routerboot_exit);
+
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("MikroTik RouterBoot sysfs support");
+MODULE_AUTHOR("Thibaut VARENE");
diff --git a/6.12/target/linux/generic/files/drivers/platform/mikrotik/routerboot.h b/6.12/target/linux/generic/files/drivers/platform/mikrotik/routerboot.h
new file mode 100644
index 00000000..723f993e
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/platform/mikrotik/routerboot.h
@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Common definitions for MikroTik RouterBoot data.
+ *
+ * Copyright (C) 2020 Thibaut VARÈNE <hacks+kernel@slashdirt.org>
+ */
+
+
+#ifndef _ROUTERBOOT_H_
+#define _ROUTERBOOT_H_
+
+#include <linux/types.h>
+
+// these magic values are stored in cpu-endianness on flash
+#define RB_MAGIC_HARD	(('H') | ('a' << 8) | ('r' << 16) | ('d' << 24))
+#define RB_MAGIC_SOFT	(('S') | ('o' << 8) | ('f' << 16) | ('t' << 24))
+#define RB_MAGIC_LZOR	(('L') | ('Z' << 8) | ('O' << 16) | ('R' << 24))
+#define RB_MAGIC_LZ77	(('L' << 24) | ('Z' << 16) | ('7' << 8) | ('7'))
+#define RB_MAGIC_ERD	(('E' << 16) | ('R' << 8) | ('D'))
+
+#define RB_ART_SIZE	0x10000
+
+#define RB_MTD_HARD_CONFIG	"hard_config"
+#define RB_MTD_SOFT_CONFIG	"soft_config"
+
+int routerboot_tag_find(const u8 *bufhead, const size_t buflen, const u16 tag_id, u16 *pld_ofs, u16 *pld_len);
+int routerboot_rle_decode(const u8 *in, size_t inlen, u8 *out, size_t *outlen);
+
+int rb_hardconfig_init(struct kobject *rb_kobj, struct mtd_info *mtd);
+void rb_hardconfig_exit(void);
+
+int rb_softconfig_init(struct kobject *rb_kobj, struct mtd_info *mtd);
+void rb_softconfig_exit(void);
+
+ssize_t routerboot_tag_show_string(const u8 *pld, u16 pld_len, char *buf);
+ssize_t routerboot_tag_show_u32s(const u8 *pld, u16 pld_len, char *buf);
+
+#endif /* _ROUTERBOOT_H_ */
diff --git a/6.12/target/linux/generic/files/drivers/ssb/fallback-sprom.c b/6.12/target/linux/generic/files/drivers/ssb/fallback-sprom.c
new file mode 100644
index 00000000..9c2511fe
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/ssb/fallback-sprom.c
@@ -0,0 +1,745 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * SSB Fallback SPROM Driver
+ *
+ * Copyright (C) 2020 Álvaro Fernández Rojas <noltari@gmail.com>
+ * Copyright (C) 2014 Jonas Gorski <jonas.gorski@gmail.com>
+ * Copyright (C) 2008 Maxime Bizon <mbizon@freebox.fr>
+ * Copyright (C) 2008 Florian Fainelli <f.fainelli@gmail.com>
+ */
+
+#include <linux/etherdevice.h>
+#include <linux/firmware.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/mtd/mtd.h>
+#include <linux/of_net.h>
+#include <linux/of_platform.h>
+#include <linux/ssb/ssb.h>
+#include "fallback-sprom.h"
+
+#define SSB_FBS_MAX_SIZE 440
+
+/* Get the word-offset for a SSB_SPROM_XXX define. */
+#define SPOFF(offset)	((offset) / sizeof(u16))
+/* Helper to extract some _offset, which is one of the SSB_SPROM_XXX defines. */
+#define SPEX16(_outvar, _offset, _mask, _shift)	\
+	out->_outvar = ((in[SPOFF(_offset)] & (_mask)) >> (_shift))
+#define SPEX32(_outvar, _offset, _mask, _shift)	\
+	out->_outvar = ((((u32)in[SPOFF((_offset)+2)] << 16 | \
+			   in[SPOFF(_offset)]) & (_mask)) >> (_shift))
+#define SPEX(_outvar, _offset, _mask, _shift) \
+	SPEX16(_outvar, _offset, _mask, _shift)
+
+#define SPEX_ARRAY8(_field, _offset, _mask, _shift)	\
+	do {	\
+		SPEX(_field[0], _offset +  0, _mask, _shift);	\
+		SPEX(_field[1], _offset +  2, _mask, _shift);	\
+		SPEX(_field[2], _offset +  4, _mask, _shift);	\
+		SPEX(_field[3], _offset +  6, _mask, _shift);	\
+		SPEX(_field[4], _offset +  8, _mask, _shift);	\
+		SPEX(_field[5], _offset + 10, _mask, _shift);	\
+		SPEX(_field[6], _offset + 12, _mask, _shift);	\
+		SPEX(_field[7], _offset + 14, _mask, _shift);	\
+	} while (0)
+
+struct ssb_fbs {
+	struct device *dev;
+	struct list_head list;
+	struct ssb_sprom sprom;
+	u32 pci_bus;
+	u32 pci_dev;
+	bool devid_override;
+};
+
+static DEFINE_SPINLOCK(ssb_fbs_lock);
+static struct list_head ssb_fbs_list = LIST_HEAD_INIT(ssb_fbs_list);
+
+int ssb_get_fallback_sprom(struct ssb_bus *bus, struct ssb_sprom *out)
+{
+	struct ssb_fbs *pos;
+	u32 pci_bus, pci_dev;
+
+	if (bus->bustype != SSB_BUSTYPE_PCI)
+		return -ENOENT;
+
+	pci_bus = bus->host_pci->bus->number;
+	pci_dev = PCI_SLOT(bus->host_pci->devfn);
+
+	list_for_each_entry(pos, &ssb_fbs_list, list) {
+		if (pos->pci_bus != pci_bus ||
+		    pos->pci_dev != pci_dev)
+		    	continue;
+
+		if (pos->devid_override)
+			bus->host_pci->device = pos->sprom.dev_id;
+
+		memcpy(out, &pos->sprom, sizeof(struct ssb_sprom));
+		dev_info(pos->dev, "requested by [%x:%x]",
+			 pos->pci_bus, pos->pci_dev);
+
+		return 0;
+	}
+
+	pr_err("unable to fill SPROM for [%x:%x]\n", pci_bus, pci_dev);
+
+	return -EINVAL;
+}
+
+static s8 sprom_extract_antgain(u8 sprom_revision, const u16 *in, u16 offset,
+				u16 mask, u16 shift)
+{
+	u16 v;
+	u8 gain;
+
+	v = in[SPOFF(offset)];
+	gain = (v & mask) >> shift;
+	if (gain == 0xFF)
+		gain = 2; /* If unset use 2dBm */
+	if (sprom_revision == 1) {
+		/* Convert to Q5.2 */
+		gain <<= 2;
+	} else {
+		/* Q5.2 Fractional part is stored in 0xC0 */
+		gain = ((gain & 0xC0) >> 6) | ((gain & 0x3F) << 2);
+	}
+
+	return (s8)gain;
+}
+
+static void sprom_extract_r23(struct ssb_sprom *out, const u16 *in)
+{
+	SPEX(boardflags_hi, SSB_SPROM2_BFLHI, 0xFFFF, 0);
+	SPEX(opo, SSB_SPROM2_OPO, SSB_SPROM2_OPO_VALUE, 0);
+	SPEX(pa1lob0, SSB_SPROM2_PA1LOB0, 0xFFFF, 0);
+	SPEX(pa1lob1, SSB_SPROM2_PA1LOB1, 0xFFFF, 0);
+	SPEX(pa1lob2, SSB_SPROM2_PA1LOB2, 0xFFFF, 0);
+	SPEX(pa1hib0, SSB_SPROM2_PA1HIB0, 0xFFFF, 0);
+	SPEX(pa1hib1, SSB_SPROM2_PA1HIB1, 0xFFFF, 0);
+	SPEX(pa1hib2, SSB_SPROM2_PA1HIB2, 0xFFFF, 0);
+	SPEX(maxpwr_ah, SSB_SPROM2_MAXP_A, SSB_SPROM2_MAXP_A_HI, 0);
+	SPEX(maxpwr_al, SSB_SPROM2_MAXP_A, SSB_SPROM2_MAXP_A_LO,
+	     SSB_SPROM2_MAXP_A_LO_SHIFT);
+}
+
+static void sprom_extract_r123(struct ssb_sprom *out, const u16 *in)
+{
+	SPEX(et0phyaddr, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET0A, 0);
+	SPEX(et1phyaddr, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET1A,
+	     SSB_SPROM1_ETHPHY_ET1A_SHIFT);
+	SPEX(et0mdcport, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET0M, 14);
+	SPEX(et1mdcport, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET1M, 15);
+	SPEX(board_rev, SSB_SPROM1_BINF, SSB_SPROM1_BINF_BREV, 0);
+	SPEX(board_type, SSB_SPROM1_SPID, 0xFFFF, 0);
+	if (out->revision == 1)
+		SPEX(country_code, SSB_SPROM1_BINF, SSB_SPROM1_BINF_CCODE,
+		     SSB_SPROM1_BINF_CCODE_SHIFT);
+	SPEX(ant_available_a, SSB_SPROM1_BINF, SSB_SPROM1_BINF_ANTA,
+	     SSB_SPROM1_BINF_ANTA_SHIFT);
+	SPEX(ant_available_bg, SSB_SPROM1_BINF, SSB_SPROM1_BINF_ANTBG,
+	     SSB_SPROM1_BINF_ANTBG_SHIFT);
+	SPEX(pa0b0, SSB_SPROM1_PA0B0, 0xFFFF, 0);
+	SPEX(pa0b1, SSB_SPROM1_PA0B1, 0xFFFF, 0);
+	SPEX(pa0b2, SSB_SPROM1_PA0B2, 0xFFFF, 0);
+	SPEX(pa1b0, SSB_SPROM1_PA1B0, 0xFFFF, 0);
+	SPEX(pa1b1, SSB_SPROM1_PA1B1, 0xFFFF, 0);
+	SPEX(pa1b2, SSB_SPROM1_PA1B2, 0xFFFF, 0);
+	SPEX(gpio0, SSB_SPROM1_GPIOA, SSB_SPROM1_GPIOA_P0, 0);
+	SPEX(gpio1, SSB_SPROM1_GPIOA, SSB_SPROM1_GPIOA_P1,
+	     SSB_SPROM1_GPIOA_P1_SHIFT);
+	SPEX(gpio2, SSB_SPROM1_GPIOB, SSB_SPROM1_GPIOB_P2, 0);
+	SPEX(gpio3, SSB_SPROM1_GPIOB, SSB_SPROM1_GPIOB_P3,
+	     SSB_SPROM1_GPIOB_P3_SHIFT);
+	SPEX(maxpwr_a, SSB_SPROM1_MAXPWR, SSB_SPROM1_MAXPWR_A,
+	     SSB_SPROM1_MAXPWR_A_SHIFT);
+	SPEX(maxpwr_bg, SSB_SPROM1_MAXPWR, SSB_SPROM1_MAXPWR_BG, 0);
+	SPEX(itssi_a, SSB_SPROM1_ITSSI, SSB_SPROM1_ITSSI_A,
+	     SSB_SPROM1_ITSSI_A_SHIFT);
+	SPEX(itssi_bg, SSB_SPROM1_ITSSI, SSB_SPROM1_ITSSI_BG, 0);
+	SPEX(boardflags_lo, SSB_SPROM1_BFLLO, 0xFFFF, 0);
+
+	SPEX(alpha2[0], SSB_SPROM1_CCODE, 0xff00, 8);
+	SPEX(alpha2[1], SSB_SPROM1_CCODE, 0x00ff, 0);
+
+	/* Extract the antenna gain values. */
+	out->antenna_gain.a0 = sprom_extract_antgain(out->revision, in,
+						     SSB_SPROM1_AGAIN,
+						     SSB_SPROM1_AGAIN_BG,
+						     SSB_SPROM1_AGAIN_BG_SHIFT);
+	out->antenna_gain.a1 = sprom_extract_antgain(out->revision, in,
+						     SSB_SPROM1_AGAIN,
+						     SSB_SPROM1_AGAIN_A,
+						     SSB_SPROM1_AGAIN_A_SHIFT);
+	if (out->revision >= 2)
+		sprom_extract_r23(out, in);
+}
+
+/* Revs 4 5 and 8 have partially shared layout */
+static void sprom_extract_r458(struct ssb_sprom *out, const u16 *in)
+{
+	SPEX(txpid2g[0], SSB_SPROM4_TXPID2G01,
+	     SSB_SPROM4_TXPID2G0, SSB_SPROM4_TXPID2G0_SHIFT);
+	SPEX(txpid2g[1], SSB_SPROM4_TXPID2G01,
+	     SSB_SPROM4_TXPID2G1, SSB_SPROM4_TXPID2G1_SHIFT);
+	SPEX(txpid2g[2], SSB_SPROM4_TXPID2G23,
+	     SSB_SPROM4_TXPID2G2, SSB_SPROM4_TXPID2G2_SHIFT);
+	SPEX(txpid2g[3], SSB_SPROM4_TXPID2G23,
+	     SSB_SPROM4_TXPID2G3, SSB_SPROM4_TXPID2G3_SHIFT);
+
+	SPEX(txpid5gl[0], SSB_SPROM4_TXPID5GL01,
+	     SSB_SPROM4_TXPID5GL0, SSB_SPROM4_TXPID5GL0_SHIFT);
+	SPEX(txpid5gl[1], SSB_SPROM4_TXPID5GL01,
+	     SSB_SPROM4_TXPID5GL1, SSB_SPROM4_TXPID5GL1_SHIFT);
+	SPEX(txpid5gl[2], SSB_SPROM4_TXPID5GL23,
+	     SSB_SPROM4_TXPID5GL2, SSB_SPROM4_TXPID5GL2_SHIFT);
+	SPEX(txpid5gl[3], SSB_SPROM4_TXPID5GL23,
+	     SSB_SPROM4_TXPID5GL3, SSB_SPROM4_TXPID5GL3_SHIFT);
+
+	SPEX(txpid5g[0], SSB_SPROM4_TXPID5G01,
+	     SSB_SPROM4_TXPID5G0, SSB_SPROM4_TXPID5G0_SHIFT);
+	SPEX(txpid5g[1], SSB_SPROM4_TXPID5G01,
+	     SSB_SPROM4_TXPID5G1, SSB_SPROM4_TXPID5G1_SHIFT);
+	SPEX(txpid5g[2], SSB_SPROM4_TXPID5G23,
+	     SSB_SPROM4_TXPID5G2, SSB_SPROM4_TXPID5G2_SHIFT);
+	SPEX(txpid5g[3], SSB_SPROM4_TXPID5G23,
+	     SSB_SPROM4_TXPID5G3, SSB_SPROM4_TXPID5G3_SHIFT);
+
+	SPEX(txpid5gh[0], SSB_SPROM4_TXPID5GH01,
+	     SSB_SPROM4_TXPID5GH0, SSB_SPROM4_TXPID5GH0_SHIFT);
+	SPEX(txpid5gh[1], SSB_SPROM4_TXPID5GH01,
+	     SSB_SPROM4_TXPID5GH1, SSB_SPROM4_TXPID5GH1_SHIFT);
+	SPEX(txpid5gh[2], SSB_SPROM4_TXPID5GH23,
+	     SSB_SPROM4_TXPID5GH2, SSB_SPROM4_TXPID5GH2_SHIFT);
+	SPEX(txpid5gh[3], SSB_SPROM4_TXPID5GH23,
+	     SSB_SPROM4_TXPID5GH3, SSB_SPROM4_TXPID5GH3_SHIFT);
+}
+
+static void sprom_extract_r45(struct ssb_sprom *out, const u16 *in)
+{
+	static const u16 pwr_info_offset[] = {
+		SSB_SPROM4_PWR_INFO_CORE0, SSB_SPROM4_PWR_INFO_CORE1,
+		SSB_SPROM4_PWR_INFO_CORE2, SSB_SPROM4_PWR_INFO_CORE3
+	};
+	int i;
+
+	BUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) !=
+		     ARRAY_SIZE(out->core_pwr_info));
+
+	SPEX(et0phyaddr, SSB_SPROM4_ETHPHY, SSB_SPROM4_ETHPHY_ET0A, 0);
+	SPEX(et1phyaddr, SSB_SPROM4_ETHPHY, SSB_SPROM4_ETHPHY_ET1A,
+	     SSB_SPROM4_ETHPHY_ET1A_SHIFT);
+	SPEX(board_rev, SSB_SPROM4_BOARDREV, 0xFFFF, 0);
+	SPEX(board_type, SSB_SPROM1_SPID, 0xFFFF, 0);
+	if (out->revision == 4) {
+		SPEX(alpha2[0], SSB_SPROM4_CCODE, 0xff00, 8);
+		SPEX(alpha2[1], SSB_SPROM4_CCODE, 0x00ff, 0);
+		SPEX(boardflags_lo, SSB_SPROM4_BFLLO, 0xFFFF, 0);
+		SPEX(boardflags_hi, SSB_SPROM4_BFLHI, 0xFFFF, 0);
+		SPEX(boardflags2_lo, SSB_SPROM4_BFL2LO, 0xFFFF, 0);
+		SPEX(boardflags2_hi, SSB_SPROM4_BFL2HI, 0xFFFF, 0);
+	} else {
+		SPEX(alpha2[0], SSB_SPROM5_CCODE, 0xff00, 8);
+		SPEX(alpha2[1], SSB_SPROM5_CCODE, 0x00ff, 0);
+		SPEX(boardflags_lo, SSB_SPROM5_BFLLO, 0xFFFF, 0);
+		SPEX(boardflags_hi, SSB_SPROM5_BFLHI, 0xFFFF, 0);
+		SPEX(boardflags2_lo, SSB_SPROM5_BFL2LO, 0xFFFF, 0);
+		SPEX(boardflags2_hi, SSB_SPROM5_BFL2HI, 0xFFFF, 0);
+	}
+	SPEX(ant_available_a, SSB_SPROM4_ANTAVAIL, SSB_SPROM4_ANTAVAIL_A,
+	     SSB_SPROM4_ANTAVAIL_A_SHIFT);
+	SPEX(ant_available_bg, SSB_SPROM4_ANTAVAIL, SSB_SPROM4_ANTAVAIL_BG,
+	     SSB_SPROM4_ANTAVAIL_BG_SHIFT);
+	SPEX(maxpwr_bg, SSB_SPROM4_MAXP_BG, SSB_SPROM4_MAXP_BG_MASK, 0);
+	SPEX(itssi_bg, SSB_SPROM4_MAXP_BG, SSB_SPROM4_ITSSI_BG,
+	     SSB_SPROM4_ITSSI_BG_SHIFT);
+	SPEX(maxpwr_a, SSB_SPROM4_MAXP_A, SSB_SPROM4_MAXP_A_MASK, 0);
+	SPEX(itssi_a, SSB_SPROM4_MAXP_A, SSB_SPROM4_ITSSI_A,
+	     SSB_SPROM4_ITSSI_A_SHIFT);
+	if (out->revision == 4) {
+		SPEX(gpio0, SSB_SPROM4_GPIOA, SSB_SPROM4_GPIOA_P0, 0);
+		SPEX(gpio1, SSB_SPROM4_GPIOA, SSB_SPROM4_GPIOA_P1,
+		     SSB_SPROM4_GPIOA_P1_SHIFT);
+		SPEX(gpio2, SSB_SPROM4_GPIOB, SSB_SPROM4_GPIOB_P2, 0);
+		SPEX(gpio3, SSB_SPROM4_GPIOB, SSB_SPROM4_GPIOB_P3,
+		     SSB_SPROM4_GPIOB_P3_SHIFT);
+	} else {
+		SPEX(gpio0, SSB_SPROM5_GPIOA, SSB_SPROM5_GPIOA_P0, 0);
+		SPEX(gpio1, SSB_SPROM5_GPIOA, SSB_SPROM5_GPIOA_P1,
+		     SSB_SPROM5_GPIOA_P1_SHIFT);
+		SPEX(gpio2, SSB_SPROM5_GPIOB, SSB_SPROM5_GPIOB_P2, 0);
+		SPEX(gpio3, SSB_SPROM5_GPIOB, SSB_SPROM5_GPIOB_P3,
+		     SSB_SPROM5_GPIOB_P3_SHIFT);
+	}
+
+	/* Extract the antenna gain values. */
+	out->antenna_gain.a0 = sprom_extract_antgain(out->revision, in,
+						     SSB_SPROM4_AGAIN01,
+						     SSB_SPROM4_AGAIN0,
+						     SSB_SPROM4_AGAIN0_SHIFT);
+	out->antenna_gain.a1 = sprom_extract_antgain(out->revision, in,
+						     SSB_SPROM4_AGAIN01,
+						     SSB_SPROM4_AGAIN1,
+						     SSB_SPROM4_AGAIN1_SHIFT);
+	out->antenna_gain.a2 = sprom_extract_antgain(out->revision, in,
+						     SSB_SPROM4_AGAIN23,
+						     SSB_SPROM4_AGAIN2,
+						     SSB_SPROM4_AGAIN2_SHIFT);
+	out->antenna_gain.a3 = sprom_extract_antgain(out->revision, in,
+						     SSB_SPROM4_AGAIN23,
+						     SSB_SPROM4_AGAIN3,
+						     SSB_SPROM4_AGAIN3_SHIFT);
+
+	/* Extract cores power info info */
+	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
+		u16 o = pwr_info_offset[i];
+
+		SPEX(core_pwr_info[i].itssi_2g, o + SSB_SPROM4_2G_MAXP_ITSSI,
+			SSB_SPROM4_2G_ITSSI, SSB_SPROM4_2G_ITSSI_SHIFT);
+		SPEX(core_pwr_info[i].maxpwr_2g, o + SSB_SPROM4_2G_MAXP_ITSSI,
+			SSB_SPROM4_2G_MAXP, 0);
+
+		SPEX(core_pwr_info[i].pa_2g[0], o + SSB_SPROM4_2G_PA_0, ~0, 0);
+		SPEX(core_pwr_info[i].pa_2g[1], o + SSB_SPROM4_2G_PA_1, ~0, 0);
+		SPEX(core_pwr_info[i].pa_2g[2], o + SSB_SPROM4_2G_PA_2, ~0, 0);
+		SPEX(core_pwr_info[i].pa_2g[3], o + SSB_SPROM4_2G_PA_3, ~0, 0);
+
+		SPEX(core_pwr_info[i].itssi_5g, o + SSB_SPROM4_5G_MAXP_ITSSI,
+			SSB_SPROM4_5G_ITSSI, SSB_SPROM4_5G_ITSSI_SHIFT);
+		SPEX(core_pwr_info[i].maxpwr_5g, o + SSB_SPROM4_5G_MAXP_ITSSI,
+			SSB_SPROM4_5G_MAXP, 0);
+		SPEX(core_pwr_info[i].maxpwr_5gh, o + SSB_SPROM4_5GHL_MAXP,
+			SSB_SPROM4_5GH_MAXP, 0);
+		SPEX(core_pwr_info[i].maxpwr_5gl, o + SSB_SPROM4_5GHL_MAXP,
+			SSB_SPROM4_5GL_MAXP, SSB_SPROM4_5GL_MAXP_SHIFT);
+
+		SPEX(core_pwr_info[i].pa_5gl[0], o + SSB_SPROM4_5GL_PA_0, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gl[1], o + SSB_SPROM4_5GL_PA_1, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gl[2], o + SSB_SPROM4_5GL_PA_2, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gl[3], o + SSB_SPROM4_5GL_PA_3, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5g[0], o + SSB_SPROM4_5G_PA_0, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5g[1], o + SSB_SPROM4_5G_PA_1, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5g[2], o + SSB_SPROM4_5G_PA_2, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5g[3], o + SSB_SPROM4_5G_PA_3, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gh[0], o + SSB_SPROM4_5GH_PA_0, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gh[1], o + SSB_SPROM4_5GH_PA_1, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gh[2], o + SSB_SPROM4_5GH_PA_2, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gh[3], o + SSB_SPROM4_5GH_PA_3, ~0, 0);
+	}
+
+	sprom_extract_r458(out, in);
+
+	/* TODO - get remaining rev 4 stuff needed */
+}
+
+static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
+{
+	int i;
+	u16 o;
+	static const u16 pwr_info_offset[] = {
+		SSB_SROM8_PWR_INFO_CORE0, SSB_SROM8_PWR_INFO_CORE1,
+		SSB_SROM8_PWR_INFO_CORE2, SSB_SROM8_PWR_INFO_CORE3
+	};
+	BUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) !=
+			ARRAY_SIZE(out->core_pwr_info));
+
+	SPEX(board_rev, SSB_SPROM8_BOARDREV, 0xFFFF, 0);
+	SPEX(board_type, SSB_SPROM1_SPID, 0xFFFF, 0);
+	SPEX(alpha2[0], SSB_SPROM8_CCODE, 0xff00, 8);
+	SPEX(alpha2[1], SSB_SPROM8_CCODE, 0x00ff, 0);
+	SPEX(boardflags_lo, SSB_SPROM8_BFLLO, 0xFFFF, 0);
+	SPEX(boardflags_hi, SSB_SPROM8_BFLHI, 0xFFFF, 0);
+	SPEX(boardflags2_lo, SSB_SPROM8_BFL2LO, 0xFFFF, 0);
+	SPEX(boardflags2_hi, SSB_SPROM8_BFL2HI, 0xFFFF, 0);
+	SPEX(ant_available_a, SSB_SPROM8_ANTAVAIL, SSB_SPROM8_ANTAVAIL_A,
+	     SSB_SPROM8_ANTAVAIL_A_SHIFT);
+	SPEX(ant_available_bg, SSB_SPROM8_ANTAVAIL, SSB_SPROM8_ANTAVAIL_BG,
+	     SSB_SPROM8_ANTAVAIL_BG_SHIFT);
+	SPEX(maxpwr_bg, SSB_SPROM8_MAXP_BG, SSB_SPROM8_MAXP_BG_MASK, 0);
+	SPEX(itssi_bg, SSB_SPROM8_MAXP_BG, SSB_SPROM8_ITSSI_BG,
+	     SSB_SPROM8_ITSSI_BG_SHIFT);
+	SPEX(maxpwr_a, SSB_SPROM8_MAXP_A, SSB_SPROM8_MAXP_A_MASK, 0);
+	SPEX(itssi_a, SSB_SPROM8_MAXP_A, SSB_SPROM8_ITSSI_A,
+	     SSB_SPROM8_ITSSI_A_SHIFT);
+	SPEX(maxpwr_ah, SSB_SPROM8_MAXP_AHL, SSB_SPROM8_MAXP_AH_MASK, 0);
+	SPEX(maxpwr_al, SSB_SPROM8_MAXP_AHL, SSB_SPROM8_MAXP_AL_MASK,
+	     SSB_SPROM8_MAXP_AL_SHIFT);
+	SPEX(gpio0, SSB_SPROM8_GPIOA, SSB_SPROM8_GPIOA_P0, 0);
+	SPEX(gpio1, SSB_SPROM8_GPIOA, SSB_SPROM8_GPIOA_P1,
+	     SSB_SPROM8_GPIOA_P1_SHIFT);
+	SPEX(gpio2, SSB_SPROM8_GPIOB, SSB_SPROM8_GPIOB_P2, 0);
+	SPEX(gpio3, SSB_SPROM8_GPIOB, SSB_SPROM8_GPIOB_P3,
+	     SSB_SPROM8_GPIOB_P3_SHIFT);
+	SPEX(tri2g, SSB_SPROM8_TRI25G, SSB_SPROM8_TRI2G, 0);
+	SPEX(tri5g, SSB_SPROM8_TRI25G, SSB_SPROM8_TRI5G,
+	     SSB_SPROM8_TRI5G_SHIFT);
+	SPEX(tri5gl, SSB_SPROM8_TRI5GHL, SSB_SPROM8_TRI5GL, 0);
+	SPEX(tri5gh, SSB_SPROM8_TRI5GHL, SSB_SPROM8_TRI5GH,
+	     SSB_SPROM8_TRI5GH_SHIFT);
+	SPEX(rxpo2g, SSB_SPROM8_RXPO, SSB_SPROM8_RXPO2G, 0);
+	SPEX(rxpo5g, SSB_SPROM8_RXPO, SSB_SPROM8_RXPO5G,
+	     SSB_SPROM8_RXPO5G_SHIFT);
+	SPEX(rssismf2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISMF2G, 0);
+	SPEX(rssismc2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISMC2G,
+	     SSB_SPROM8_RSSISMC2G_SHIFT);
+	SPEX(rssisav2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISAV2G,
+	     SSB_SPROM8_RSSISAV2G_SHIFT);
+	SPEX(bxa2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_BXA2G,
+	     SSB_SPROM8_BXA2G_SHIFT);
+	SPEX(rssismf5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISMF5G, 0);
+	SPEX(rssismc5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISMC5G,
+	     SSB_SPROM8_RSSISMC5G_SHIFT);
+	SPEX(rssisav5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISAV5G,
+	     SSB_SPROM8_RSSISAV5G_SHIFT);
+	SPEX(bxa5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_BXA5G,
+	     SSB_SPROM8_BXA5G_SHIFT);
+	SPEX(pa0b0, SSB_SPROM8_PA0B0, 0xFFFF, 0);
+	SPEX(pa0b1, SSB_SPROM8_PA0B1, 0xFFFF, 0);
+	SPEX(pa0b2, SSB_SPROM8_PA0B2, 0xFFFF, 0);
+	SPEX(pa1b0, SSB_SPROM8_PA1B0, 0xFFFF, 0);
+	SPEX(pa1b1, SSB_SPROM8_PA1B1, 0xFFFF, 0);
+	SPEX(pa1b2, SSB_SPROM8_PA1B2, 0xFFFF, 0);
+	SPEX(pa1lob0, SSB_SPROM8_PA1LOB0, 0xFFFF, 0);
+	SPEX(pa1lob1, SSB_SPROM8_PA1LOB1, 0xFFFF, 0);
+	SPEX(pa1lob2, SSB_SPROM8_PA1LOB2, 0xFFFF, 0);
+	SPEX(pa1hib0, SSB_SPROM8_PA1HIB0, 0xFFFF, 0);
+	SPEX(pa1hib1, SSB_SPROM8_PA1HIB1, 0xFFFF, 0);
+	SPEX(pa1hib2, SSB_SPROM8_PA1HIB2, 0xFFFF, 0);
+	SPEX(cck2gpo, SSB_SPROM8_CCK2GPO, 0xFFFF, 0);
+	SPEX32(ofdm2gpo, SSB_SPROM8_OFDM2GPO, 0xFFFFFFFF, 0);
+	SPEX32(ofdm5glpo, SSB_SPROM8_OFDM5GLPO, 0xFFFFFFFF, 0);
+	SPEX32(ofdm5gpo, SSB_SPROM8_OFDM5GPO, 0xFFFFFFFF, 0);
+	SPEX32(ofdm5ghpo, SSB_SPROM8_OFDM5GHPO, 0xFFFFFFFF, 0);
+
+	/* Extract the antenna gain values. */
+	out->antenna_gain.a0 = sprom_extract_antgain(out->revision, in,
+						     SSB_SPROM8_AGAIN01,
+						     SSB_SPROM8_AGAIN0,
+						     SSB_SPROM8_AGAIN0_SHIFT);
+	out->antenna_gain.a1 = sprom_extract_antgain(out->revision, in,
+						     SSB_SPROM8_AGAIN01,
+						     SSB_SPROM8_AGAIN1,
+						     SSB_SPROM8_AGAIN1_SHIFT);
+	out->antenna_gain.a2 = sprom_extract_antgain(out->revision, in,
+						     SSB_SPROM8_AGAIN23,
+						     SSB_SPROM8_AGAIN2,
+						     SSB_SPROM8_AGAIN2_SHIFT);
+	out->antenna_gain.a3 = sprom_extract_antgain(out->revision, in,
+						     SSB_SPROM8_AGAIN23,
+						     SSB_SPROM8_AGAIN3,
+						     SSB_SPROM8_AGAIN3_SHIFT);
+
+	/* Extract cores power info info */
+	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
+		o = pwr_info_offset[i];
+		SPEX(core_pwr_info[i].itssi_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
+			SSB_SPROM8_2G_ITSSI, SSB_SPROM8_2G_ITSSI_SHIFT);
+		SPEX(core_pwr_info[i].maxpwr_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
+			SSB_SPROM8_2G_MAXP, 0);
+
+		SPEX(core_pwr_info[i].pa_2g[0], o + SSB_SROM8_2G_PA_0, ~0, 0);
+		SPEX(core_pwr_info[i].pa_2g[1], o + SSB_SROM8_2G_PA_1, ~0, 0);
+		SPEX(core_pwr_info[i].pa_2g[2], o + SSB_SROM8_2G_PA_2, ~0, 0);
+
+		SPEX(core_pwr_info[i].itssi_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
+			SSB_SPROM8_5G_ITSSI, SSB_SPROM8_5G_ITSSI_SHIFT);
+		SPEX(core_pwr_info[i].maxpwr_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
+			SSB_SPROM8_5G_MAXP, 0);
+		SPEX(core_pwr_info[i].maxpwr_5gh, o + SSB_SPROM8_5GHL_MAXP,
+			SSB_SPROM8_5GH_MAXP, 0);
+		SPEX(core_pwr_info[i].maxpwr_5gl, o + SSB_SPROM8_5GHL_MAXP,
+			SSB_SPROM8_5GL_MAXP, SSB_SPROM8_5GL_MAXP_SHIFT);
+
+		SPEX(core_pwr_info[i].pa_5gl[0], o + SSB_SROM8_5GL_PA_0, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gl[1], o + SSB_SROM8_5GL_PA_1, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gl[2], o + SSB_SROM8_5GL_PA_2, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5g[0], o + SSB_SROM8_5G_PA_0, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5g[1], o + SSB_SROM8_5G_PA_1, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5g[2], o + SSB_SROM8_5G_PA_2, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gh[0], o + SSB_SROM8_5GH_PA_0, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gh[1], o + SSB_SROM8_5GH_PA_1, ~0, 0);
+		SPEX(core_pwr_info[i].pa_5gh[2], o + SSB_SROM8_5GH_PA_2, ~0, 0);
+	}
+
+	/* Extract FEM info */
+	SPEX(fem.ghz2.tssipos, SSB_SPROM8_FEM2G,
+		SSB_SROM8_FEM_TSSIPOS, SSB_SROM8_FEM_TSSIPOS_SHIFT);
+	SPEX(fem.ghz2.extpa_gain, SSB_SPROM8_FEM2G,
+		SSB_SROM8_FEM_EXTPA_GAIN, SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
+	SPEX(fem.ghz2.pdet_range, SSB_SPROM8_FEM2G,
+		SSB_SROM8_FEM_PDET_RANGE, SSB_SROM8_FEM_PDET_RANGE_SHIFT);
+	SPEX(fem.ghz2.tr_iso, SSB_SPROM8_FEM2G,
+		SSB_SROM8_FEM_TR_ISO, SSB_SROM8_FEM_TR_ISO_SHIFT);
+	SPEX(fem.ghz2.antswlut, SSB_SPROM8_FEM2G,
+		SSB_SROM8_FEM_ANTSWLUT, SSB_SROM8_FEM_ANTSWLUT_SHIFT);
+
+	SPEX(fem.ghz5.tssipos, SSB_SPROM8_FEM5G,
+		SSB_SROM8_FEM_TSSIPOS, SSB_SROM8_FEM_TSSIPOS_SHIFT);
+	SPEX(fem.ghz5.extpa_gain, SSB_SPROM8_FEM5G,
+		SSB_SROM8_FEM_EXTPA_GAIN, SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
+	SPEX(fem.ghz5.pdet_range, SSB_SPROM8_FEM5G,
+		SSB_SROM8_FEM_PDET_RANGE, SSB_SROM8_FEM_PDET_RANGE_SHIFT);
+	SPEX(fem.ghz5.tr_iso, SSB_SPROM8_FEM5G,
+		SSB_SROM8_FEM_TR_ISO, SSB_SROM8_FEM_TR_ISO_SHIFT);
+	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G,
+		SSB_SROM8_FEM_ANTSWLUT, SSB_SROM8_FEM_ANTSWLUT_SHIFT);
+
+	SPEX(leddc_on_time, SSB_SPROM8_LEDDC, SSB_SPROM8_LEDDC_ON,
+	     SSB_SPROM8_LEDDC_ON_SHIFT);
+	SPEX(leddc_off_time, SSB_SPROM8_LEDDC, SSB_SPROM8_LEDDC_OFF,
+	     SSB_SPROM8_LEDDC_OFF_SHIFT);
+
+	SPEX(txchain, SSB_SPROM8_TXRXC, SSB_SPROM8_TXRXC_TXCHAIN,
+	     SSB_SPROM8_TXRXC_TXCHAIN_SHIFT);
+	SPEX(rxchain, SSB_SPROM8_TXRXC, SSB_SPROM8_TXRXC_RXCHAIN,
+	     SSB_SPROM8_TXRXC_RXCHAIN_SHIFT);
+	SPEX(antswitch, SSB_SPROM8_TXRXC, SSB_SPROM8_TXRXC_SWITCH,
+	     SSB_SPROM8_TXRXC_SWITCH_SHIFT);
+
+	SPEX(opo, SSB_SPROM8_OFDM2GPO, 0x00ff, 0);
+
+	SPEX_ARRAY8(mcs2gpo, SSB_SPROM8_2G_MCSPO, ~0, 0);
+	SPEX_ARRAY8(mcs5gpo, SSB_SPROM8_5G_MCSPO, ~0, 0);
+	SPEX_ARRAY8(mcs5glpo, SSB_SPROM8_5GL_MCSPO, ~0, 0);
+	SPEX_ARRAY8(mcs5ghpo, SSB_SPROM8_5GH_MCSPO, ~0, 0);
+
+	SPEX(rawtempsense, SSB_SPROM8_RAWTS, SSB_SPROM8_RAWTS_RAWTEMP,
+	     SSB_SPROM8_RAWTS_RAWTEMP_SHIFT);
+	SPEX(measpower, SSB_SPROM8_RAWTS, SSB_SPROM8_RAWTS_MEASPOWER,
+	     SSB_SPROM8_RAWTS_MEASPOWER_SHIFT);
+	SPEX(tempsense_slope, SSB_SPROM8_OPT_CORRX,
+	     SSB_SPROM8_OPT_CORRX_TEMP_SLOPE,
+	     SSB_SPROM8_OPT_CORRX_TEMP_SLOPE_SHIFT);
+	SPEX(tempcorrx, SSB_SPROM8_OPT_CORRX, SSB_SPROM8_OPT_CORRX_TEMPCORRX,
+	     SSB_SPROM8_OPT_CORRX_TEMPCORRX_SHIFT);
+	SPEX(tempsense_option, SSB_SPROM8_OPT_CORRX,
+	     SSB_SPROM8_OPT_CORRX_TEMP_OPTION,
+	     SSB_SPROM8_OPT_CORRX_TEMP_OPTION_SHIFT);
+	SPEX(freqoffset_corr, SSB_SPROM8_HWIQ_IQSWP,
+	     SSB_SPROM8_HWIQ_IQSWP_FREQ_CORR,
+	     SSB_SPROM8_HWIQ_IQSWP_FREQ_CORR_SHIFT);
+	SPEX(iqcal_swp_dis, SSB_SPROM8_HWIQ_IQSWP,
+	     SSB_SPROM8_HWIQ_IQSWP_IQCAL_SWP,
+	     SSB_SPROM8_HWIQ_IQSWP_IQCAL_SWP_SHIFT);
+	SPEX(hw_iqcal_en, SSB_SPROM8_HWIQ_IQSWP, SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL,
+	     SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL_SHIFT);
+
+	SPEX(bw40po, SSB_SPROM8_BW40PO, ~0, 0);
+	SPEX(cddpo, SSB_SPROM8_CDDPO, ~0, 0);
+	SPEX(stbcpo, SSB_SPROM8_STBCPO, ~0, 0);
+	SPEX(bwduppo, SSB_SPROM8_BWDUPPO, ~0, 0);
+
+	SPEX(tempthresh, SSB_SPROM8_THERMAL, SSB_SPROM8_THERMAL_TRESH,
+	     SSB_SPROM8_THERMAL_TRESH_SHIFT);
+	SPEX(tempoffset, SSB_SPROM8_THERMAL, SSB_SPROM8_THERMAL_OFFSET,
+	     SSB_SPROM8_THERMAL_OFFSET_SHIFT);
+	SPEX(phycal_tempdelta, SSB_SPROM8_TEMPDELTA,
+	     SSB_SPROM8_TEMPDELTA_PHYCAL,
+	     SSB_SPROM8_TEMPDELTA_PHYCAL_SHIFT);
+	SPEX(temps_period, SSB_SPROM8_TEMPDELTA, SSB_SPROM8_TEMPDELTA_PERIOD,
+	     SSB_SPROM8_TEMPDELTA_PERIOD_SHIFT);
+	SPEX(temps_hysteresis, SSB_SPROM8_TEMPDELTA,
+	     SSB_SPROM8_TEMPDELTA_HYSTERESIS,
+	     SSB_SPROM8_TEMPDELTA_HYSTERESIS_SHIFT);
+	sprom_extract_r458(out, in);
+
+	/* TODO - get remaining rev 8 stuff needed */
+}
+
+static int sprom_extract(struct ssb_fbs *priv, const u16 *in, u16 size)
+{
+	struct ssb_sprom *out = &priv->sprom;
+
+	memset(out, 0, sizeof(*out));
+
+	out->revision = in[size - 1] & 0x00FF;
+
+	switch (out->revision) {
+	case 1:
+	case 2:
+	case 3:
+		sprom_extract_r123(out, in);
+		break;
+	case 4:
+	case 5:
+		sprom_extract_r45(out, in);
+		break;
+	case 8:
+		sprom_extract_r8(out, in);
+		break;
+	default:
+		dev_warn(priv->dev,
+			 "Unsupported SPROM revision %d detected."
+			 " Will extract v1\n",
+			 out->revision);
+		out->revision = 1;
+		sprom_extract_r123(out, in);
+	}
+
+	if (out->boardflags_lo == 0xFFFF)
+		out->boardflags_lo = 0;  /* per specs */
+	if (out->boardflags_hi == 0xFFFF)
+		out->boardflags_hi = 0;  /* per specs */
+
+	return 0;
+}
+
+static void ssb_fbs_fixup(struct ssb_fbs *priv, u16 *sprom)
+{
+	struct device_node *node = priv->dev->of_node;
+	u32 fixups, off, val;
+	int i = 0;
+
+	if (!of_get_property(node, "brcm,sprom-fixups", &fixups))
+		return;
+
+	fixups /= sizeof(u32);
+
+	dev_info(priv->dev, "patching SPROM with %u fixups...\n", fixups >> 1);
+
+	while (i < fixups) {
+		if (of_property_read_u32_index(node, "brcm,sprom-fixups",
+					       i++, &off)) {
+			dev_err(priv->dev, "error reading fixup[%u] offset\n",
+				i - 1);
+			return;
+		}
+
+		if (of_property_read_u32_index(node, "brcm,sprom-fixups",
+					       i++, &val)) {
+			dev_err(priv->dev, "error reading fixup[%u] value\n",
+				i - 1);
+			return;
+		}
+
+		dev_dbg(priv->dev, "fixup[%d]=0x%04x\n", off, val);
+
+		sprom[off] = val;
+	}
+}
+
+static bool sprom_override_devid(struct ssb_fbs *priv, struct ssb_sprom *out,
+				 const u16 *in)
+{
+	SPEX(dev_id, SSB_SPROM1_PID, 0xFFFF, 0);
+	return !!out->dev_id;
+}
+
+static int ssb_fbs_set(struct ssb_fbs *priv, struct device_node *node)
+{
+	struct ssb_sprom *sprom = &priv->sprom;
+	const struct firmware *fw;
+	const char *sprom_name;
+	int err;
+
+	if (of_property_read_string(node, "brcm,sprom", &sprom_name))
+		sprom_name = NULL;
+
+	if (sprom_name) {
+		err = request_firmware_direct(&fw, sprom_name, priv->dev);
+		if (err)
+			dev_err(priv->dev, "%s load error\n", sprom_name);
+	} else {
+		err = -ENOENT;
+	}
+
+	if (err) {
+		sprom->revision = 0x02;
+		sprom->board_rev = 0x0017;
+		sprom->country_code = 0x00;
+		sprom->ant_available_bg = 0x03;
+		sprom->pa0b0 = 0x15ae;
+		sprom->pa0b1 = 0xfa85;
+		sprom->pa0b2 = 0xfe8d;
+		sprom->pa1b0 = 0xffff;
+		sprom->pa1b1 = 0xffff;
+		sprom->pa1b2 = 0xffff;
+		sprom->gpio0 = 0xff;
+		sprom->gpio1 = 0xff;
+		sprom->gpio2 = 0xff;
+		sprom->gpio3 = 0xff;
+		sprom->maxpwr_bg = 0x4c;
+		sprom->itssi_bg = 0x00;
+		sprom->boardflags_lo = 0x2848;
+		sprom->boardflags_hi = 0x0000;
+		priv->devid_override = false;
+
+		dev_warn(priv->dev, "using basic SPROM\n");
+	} else {
+		size_t size = min(fw->size, (size_t) SSB_FBS_MAX_SIZE);
+		u16 tmp_sprom[SSB_FBS_MAX_SIZE >> 1];
+		u32 i, j;
+
+		for (i = 0, j = 0; i < size; i += 2, j++)
+			tmp_sprom[j] = (fw->data[i] << 8) | fw->data[i + 1];
+
+		release_firmware(fw);
+		ssb_fbs_fixup(priv, tmp_sprom);
+		sprom_extract(priv, tmp_sprom, size >> 1);
+
+		priv->devid_override = sprom_override_devid(priv, sprom,
+							    tmp_sprom);
+	}
+
+	return 0;
+}
+
+static int ssb_fbs_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct device_node *node = dev->of_node;
+	struct ssb_fbs *priv;
+	unsigned long flags;
+	u8 mac[ETH_ALEN];
+
+	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	priv->dev = dev;
+
+	ssb_fbs_set(priv, node);
+
+	of_property_read_u32(node, "pci-bus", &priv->pci_bus);
+	of_property_read_u32(node, "pci-dev", &priv->pci_dev);
+
+	of_get_mac_address(node, mac);
+	if (is_valid_ether_addr(mac)) {
+		dev_info(dev, "mtd mac %pM\n", mac);
+	} else {
+		eth_random_addr(mac);
+		dev_info(dev, "random mac %pM\n", mac);
+	}
+
+	memcpy(priv->sprom.il0mac, mac, ETH_ALEN);
+ 	memcpy(priv->sprom.et0mac, mac, ETH_ALEN);
+ 	memcpy(priv->sprom.et1mac, mac, ETH_ALEN);
+	memcpy(priv->sprom.et2mac, mac, ETH_ALEN);
+
+	spin_lock_irqsave(&ssb_fbs_lock, flags);
+	list_add(&priv->list, &ssb_fbs_list);
+	spin_unlock_irqrestore(&ssb_fbs_lock, flags);
+
+	dev_info(dev, "registered SPROM for [%x:%x]\n",
+		 priv->pci_bus, priv->pci_dev);
+
+	return 0;
+}
+
+static const struct of_device_id ssb_fbs_of_match[] = {
+	{ .compatible = "brcm,ssb-sprom", },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, ssb_fbs_of_match);
+
+static struct platform_driver ssb_fbs_driver = {
+	.probe = ssb_fbs_probe,
+	.driver	= {
+		.name = "ssb-sprom",
+		.of_match_table = ssb_fbs_of_match,
+	},
+};
+
+int __init ssb_fbs_register(void)
+{
+	return platform_driver_register(&ssb_fbs_driver);
+}
diff --git a/6.12/target/linux/generic/files/drivers/ssb/fallback-sprom.h b/6.12/target/linux/generic/files/drivers/ssb/fallback-sprom.h
new file mode 100644
index 00000000..3966a18b
--- /dev/null
+++ b/6.12/target/linux/generic/files/drivers/ssb/fallback-sprom.h
@@ -0,0 +1,7 @@
+#ifndef _FALLBACK_SPROM_H
+#define _FALLBACK_SPROM_H
+
+int __init ssb_fbs_register(void);
+int ssb_get_fallback_sprom(struct ssb_bus *dev, struct ssb_sprom *out);
+
+#endif /* _FALLBACK_SPROM_H */
diff --git a/6.12/target/linux/generic/files/include/dt-bindings/mtd/partitions/uimage.h b/6.12/target/linux/generic/files/include/dt-bindings/mtd/partitions/uimage.h
new file mode 100644
index 00000000..43d5f7b5
--- /dev/null
+++ b/6.12/target/linux/generic/files/include/dt-bindings/mtd/partitions/uimage.h
@@ -0,0 +1,198 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ *    *** IMPORTANT ***
+ * This file is not only included from C-code but also from devicetree source
+ * files. As such this file MUST only contain comments and defines.
+ *
+ * Based on image.h from U-Boot which is
+ * (C) Copyright 2008 Semihalf
+ * (C) Copyright 2000-2005 Wolfgang Denk, DENX Software Engineering, wd@denx.de.
+ */
+
+#ifndef __UIMAGE_H__
+#define __UIMAGE_H__
+
+/*
+ * Operating System Codes
+ *
+ * The following are exposed to uImage header.
+ * New IDs *MUST* be appended at the end of the list and *NEVER*
+ * inserted for backward compatibility.
+ */
+#define	IH_OS_INVALID		0	/* Invalid OS	*/
+#define	IH_OS_OPENBSD		1	/* OpenBSD	*/
+#define	IH_OS_NETBSD		2	/* NetBSD	*/
+#define	IH_OS_FREEBSD		3	/* FreeBSD	*/
+#define	IH_OS_4_4BSD		4	/* 4.4BSD	*/
+#define	IH_OS_LINUX		5	/* Linux	*/
+#define	IH_OS_SVR4		6	/* SVR4		*/
+#define	IH_OS_ESIX		7	/* Esix		*/
+#define	IH_OS_SOLARIS		8	/* Solaris	*/
+#define	IH_OS_IRIX		9	/* Irix		*/
+#define	IH_OS_SCO	       10	/* SCO		*/
+#define	IH_OS_DELL	       11	/* Dell		*/
+#define	IH_OS_NCR	       12	/* NCR		*/
+#define	IH_OS_LYNXOS	       13	/* LynxOS	*/
+#define	IH_OS_VXWORKS	       14	/* VxWorks	*/
+#define	IH_OS_PSOS	       15	/* pSOS		*/
+#define	IH_OS_QNX	       16	/* QNX		*/
+#define	IH_OS_U_BOOT	       17	/* Firmware	*/
+#define	IH_OS_RTEMS	       18	/* RTEMS	*/
+#define	IH_OS_ARTOS	       19	/* ARTOS	*/
+#define	IH_OS_UNITY	       20	/* Unity OS	*/
+#define	IH_OS_INTEGRITY	       21	/* INTEGRITY	*/
+#define	IH_OS_OSE	       22	/* OSE		*/
+#define	IH_OS_PLAN9	       23	/* Plan 9	*/
+#define	IH_OS_OPENRTOS	       24	/* OpenRTOS	*/
+#define	IH_OS_ARM_TRUSTED_FIRMWARE 25    /* ARM Trusted Firmware */
+#define	IH_OS_TEE	       26	/* Trusted Execution Environment */
+#define	IH_OS_OPENSBI	       27	/* RISC-V OpenSBI */
+#define	IH_OS_EFI	       28	/* EFI Firmware (e.g. GRUB2) */
+
+/*
+ * CPU Architecture Codes (supported by Linux)
+ *
+ * The following are exposed to uImage header.
+ * New IDs *MUST* be appended at the end of the list and *NEVER*
+ * inserted for backward compatibility.
+ */
+#define	IH_ARCH_INVALID		0	/* Invalid CPU	*/
+#define	IH_ARCH_ALPHA		1	/* Alpha	*/
+#define	IH_ARCH_ARM		2	/* ARM		*/
+#define	IH_ARCH_I386		3	/* Intel x86	*/
+#define	IH_ARCH_IA64		4	/* IA64		*/
+#define	IH_ARCH_MIPS		5	/* MIPS		*/
+#define	IH_ARCH_MIPS64		6	/* MIPS	 64 Bit */
+#define	IH_ARCH_PPC		7	/* PowerPC	*/
+#define	IH_ARCH_S390		8	/* IBM S390	*/
+#define	IH_ARCH_SH		9	/* SuperH	*/
+#define	IH_ARCH_SPARC	       10	/* Sparc	*/
+#define	IH_ARCH_SPARC64	       11	/* Sparc 64 Bit */
+#define	IH_ARCH_M68K	       12	/* M68K		*/
+#define	IH_ARCH_NIOS	       13	/* Nios-32	*/
+#define	IH_ARCH_MICROBLAZE     14	/* MicroBlaze   */
+#define	IH_ARCH_NIOS2	       15	/* Nios-II	*/
+#define	IH_ARCH_BLACKFIN       16	/* Blackfin	*/
+#define	IH_ARCH_AVR32	       17	/* AVR32	*/
+#define	IH_ARCH_ST200	       18	/* STMicroelectronics ST200  */
+#define	IH_ARCH_SANDBOX	       19	/* Sandbox architecture (test only) */
+#define	IH_ARCH_NDS32	       20	/* ANDES Technology - NDS32  */
+#define	IH_ARCH_OPENRISC       21	/* OpenRISC 1000  */
+#define	IH_ARCH_ARM64	       22	/* ARM64	*/
+#define	IH_ARCH_ARC	       23	/* Synopsys DesignWare ARC */
+#define	IH_ARCH_X86_64	       24	/* AMD x86_64, Intel and Via */
+#define	IH_ARCH_XTENSA	       25	/* Xtensa	*/
+#define	IH_ARCH_RISCV	       26	/* RISC-V */
+
+/*
+ * Image Types
+ *
+ * "Standalone Programs" are directly runnable in the environment
+ *	provided by U-Boot; it is expected that (if they behave
+ *	well) you can continue to work in U-Boot after return from
+ *	the Standalone Program.
+ * "OS Kernel Images" are usually images of some Embedded OS which
+ *	will take over control completely. Usually these programs
+ *	will install their own set of exception handlers, device
+ *	drivers, set up the MMU, etc. - this means, that you cannot
+ *	expect to re-enter U-Boot except by resetting the CPU.
+ * "RAMDisk Images" are more or less just data blocks, and their
+ *	parameters (address, size) are passed to an OS kernel that is
+ *	being started.
+ * "Multi-File Images" contain several images, typically an OS
+ *	(Linux) kernel image and one or more data images like
+ *	RAMDisks. This construct is useful for instance when you want
+ *	to boot over the network using BOOTP etc., where the boot
+ *	server provides just a single image file, but you want to get
+ *	for instance an OS kernel and a RAMDisk image.
+ *
+ *	"Multi-File Images" start with a list of image sizes, each
+ *	image size (in bytes) specified by an "uint32_t" in network
+ *	byte order. This list is terminated by an "(uint32_t)0".
+ *	Immediately after the terminating 0 follow the images, one by
+ *	one, all aligned on "uint32_t" boundaries (size rounded up to
+ *	a multiple of 4 bytes - except for the last file).
+ *
+ * "Firmware Images" are binary images containing firmware (like
+ *	U-Boot or FPGA images) which usually will be programmed to
+ *	flash memory.
+ *
+ * "Script files" are command sequences that will be executed by
+ *	U-Boot's command interpreter; this feature is especially
+ *	useful when you configure U-Boot to use a real shell (hush)
+ *	as command interpreter (=> Shell Scripts).
+ *
+ * The following are exposed to uImage header.
+ * New IDs *MUST* be appended at the end of the list and *NEVER*
+ * inserted for backward compatibility.
+ */
+#define	IH_TYPE_INVALID		0	/* Invalid Image		*/
+#define	IH_TYPE_STANDALONE	1	/* Standalone Program		*/
+#define	IH_TYPE_KERNEL		2	/* OS Kernel Image		*/
+#define	IH_TYPE_RAMDISK		3	/* RAMDisk Image		*/
+#define	IH_TYPE_MULTI		4	/* Multi-File Image		*/
+#define	IH_TYPE_FIRMWARE	5	/* Firmware Image		*/
+#define	IH_TYPE_SCRIPT		6	/* Script file			*/
+#define	IH_TYPE_FILESYSTEM	7	/* Filesystem Image (any type)	*/
+#define	IH_TYPE_FLATDT		8	/* Binary Flat Device Tree Blob	*/
+#define	IH_TYPE_KWBIMAGE	9	/* Kirkwood Boot Image		*/
+#define	IH_TYPE_IMXIMAGE       10	/* Freescale IMXBoot Image	*/
+#define	IH_TYPE_UBLIMAGE       11	/* Davinci UBL Image		*/
+#define	IH_TYPE_OMAPIMAGE      12	/* TI OMAP Config Header Image	*/
+#define	IH_TYPE_AISIMAGE       13	/* TI Davinci AIS Image		*/
+	/* OS Kernel Image, can run from any load address */
+#define	IH_TYPE_KERNEL_NOLOAD  14
+#define	IH_TYPE_PBLIMAGE       15	/* Freescale PBL Boot Image	*/
+#define	IH_TYPE_MXSIMAGE       16	/* Freescale MXSBoot Image	*/
+#define	IH_TYPE_GPIMAGE	       17	/* TI Keystone GPHeader Image	*/
+#define	IH_TYPE_ATMELIMAGE     18	/* ATMEL ROM bootable Image	*/
+#define	IH_TYPE_SOCFPGAIMAGE   19	/* Altera SOCFPGA CV/AV Preloader */
+#define	IH_TYPE_X86_SETUP      20	/* x86 setup.bin Image		*/
+#define	IH_TYPE_LPC32XXIMAGE   21	/* x86 setup.bin Image		*/
+#define	IH_TYPE_LOADABLE       22	/* A list of typeless images	*/
+#define	IH_TYPE_RKIMAGE	       23	/* Rockchip Boot Image		*/
+#define	IH_TYPE_RKSD	       24	/* Rockchip SD card		*/
+#define	IH_TYPE_RKSPI	       25	/* Rockchip SPI image		*/
+#define	IH_TYPE_ZYNQIMAGE      26	/* Xilinx Zynq Boot Image */
+#define	IH_TYPE_ZYNQMPIMAGE    27	/* Xilinx ZynqMP Boot Image */
+#define	IH_TYPE_ZYNQMPBIF      28	/* Xilinx ZynqMP Boot Image (bif) */
+#define	IH_TYPE_FPGA	       29	/* FPGA Image */
+#define	IH_TYPE_VYBRIDIMAGE    30	/* VYBRID .vyb Image */
+#define	IH_TYPE_TEE            31	/* Trusted Execution Environment OS Image */
+#define	IH_TYPE_FIRMWARE_IVT   32	/* Firmware Image with HABv4 IVT */
+#define	IH_TYPE_PMMC           33	/* TI Power Management Micro-Controller Firmware */
+#define	IH_TYPE_STM32IMAGE     34	/* STMicroelectronics STM32 Image */
+#define	IH_TYPE_SOCFPGAIMAGE_V1 35	/* Altera SOCFPGA A10 Preloader	*/
+#define	IH_TYPE_MTKIMAGE       36	/* MediaTek BootROM loadable Image */
+#define	IH_TYPE_IMX8MIMAGE     37	/* Freescale IMX8MBoot Image	*/
+#define	IH_TYPE_IMX8IMAGE      38	/* Freescale IMX8Boot Image	*/
+#define	IH_TYPE_COPRO	       39	/* Coprocessor Image for remoteproc*/
+
+
+/*
+ * Compression Types
+ *
+ * The following are exposed to uImage header.
+ * New IDs *MUST* be appended at the end of the list and *NEVER*
+ * inserted for backward compatibility.
+ */
+#define	IH_COMP_NONE		0	/*  No	 Compression Used	*/
+#define	IH_COMP_GZIP		1	/* gzip	 Compression Used	*/
+#define	IH_COMP_BZIP2		2	/* bzip2 Compression Used	*/
+#define	IH_COMP_LZMA		3	/* lzma  Compression Used	*/
+#define	IH_COMP_LZO		4	/* lzo   Compression Used	*/
+#define	IH_COMP_LZ4		5	/* lz4   Compression Used	*/
+
+
+#define LZ4F_MAGIC	0x184D2204	/* LZ4 Magic Number		*/
+#define IH_MAGIC	0x27051956	/* Image Magic Number		*/
+#define IH_NMLEN		32	/* Image Name Length		*/
+
+/*
+ * Magic values specific to "openwrt,uimage" partitions
+ */
+#define IH_MAGIC_OKLI	0x4f4b4c49	/* 'OKLI'			*/
+#define FW_EDIMAX_OFFSET	20	/* Edimax Firmware Offset	*/
+#define FW_MAGIC_EDIMAX	0x43535953	/* Edimax Firmware Magic Number */
+
+#endif	/* __UIMAGE_H__ */
diff --git a/6.12/target/linux/generic/files/include/linux/ar8216_platform.h b/6.12/target/linux/generic/files/include/linux/ar8216_platform.h
new file mode 100644
index 00000000..24bc442a
--- /dev/null
+++ b/6.12/target/linux/generic/files/include/linux/ar8216_platform.h
@@ -0,0 +1,133 @@
+/*
+ * AR8216 switch driver platform data
+ *
+ * Copyright (C) 2012 Gabor Juhos <juhosg@openwrt.org>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#ifndef AR8216_PLATFORM_H
+#define AR8216_PLATFORM_H
+
+enum ar8327_pad_mode {
+	AR8327_PAD_NC = 0,
+	AR8327_PAD_MAC2MAC_MII,
+	AR8327_PAD_MAC2MAC_GMII,
+	AR8327_PAD_MAC_SGMII,
+	AR8327_PAD_MAC2PHY_MII,
+	AR8327_PAD_MAC2PHY_GMII,
+	AR8327_PAD_MAC_RGMII,
+	AR8327_PAD_PHY_GMII,
+	AR8327_PAD_PHY_RGMII,
+	AR8327_PAD_PHY_MII,
+};
+
+enum ar8327_clk_delay_sel {
+	AR8327_CLK_DELAY_SEL0 = 0,
+	AR8327_CLK_DELAY_SEL1,
+	AR8327_CLK_DELAY_SEL2,
+	AR8327_CLK_DELAY_SEL3,
+};
+
+struct ar8327_pad_cfg {
+	enum ar8327_pad_mode mode;
+	bool rxclk_sel;
+	bool txclk_sel;
+	bool pipe_rxclk_sel;
+	bool txclk_delay_en;
+	bool rxclk_delay_en;
+	bool sgmii_delay_en;
+	enum ar8327_clk_delay_sel txclk_delay_sel;
+	enum ar8327_clk_delay_sel rxclk_delay_sel;
+	bool mac06_exchange_dis;
+};
+
+enum ar8327_port_speed {
+	AR8327_PORT_SPEED_10 = 0,
+	AR8327_PORT_SPEED_100,
+	AR8327_PORT_SPEED_1000,
+};
+
+struct ar8327_port_cfg {
+	int force_link:1;
+	enum ar8327_port_speed speed;
+	int txpause:1;
+	int rxpause:1;
+	int duplex:1;
+};
+
+struct ar8327_sgmii_cfg {
+	u32 sgmii_ctrl;
+	bool serdes_aen;
+};
+
+struct ar8327_led_cfg {
+	u32 led_ctrl0;
+	u32 led_ctrl1;
+	u32 led_ctrl2;
+	u32 led_ctrl3;
+	bool open_drain;
+};
+
+enum ar8327_led_num {
+	AR8327_LED_PHY0_0 = 0,
+	AR8327_LED_PHY0_1,
+	AR8327_LED_PHY0_2,
+	AR8327_LED_PHY1_0,
+	AR8327_LED_PHY1_1,
+	AR8327_LED_PHY1_2,
+	AR8327_LED_PHY2_0,
+	AR8327_LED_PHY2_1,
+	AR8327_LED_PHY2_2,
+	AR8327_LED_PHY3_0,
+	AR8327_LED_PHY3_1,
+	AR8327_LED_PHY3_2,
+	AR8327_LED_PHY4_0,
+	AR8327_LED_PHY4_1,
+	AR8327_LED_PHY4_2,
+};
+
+enum ar8327_led_mode {
+	AR8327_LED_MODE_HW = 0,
+	AR8327_LED_MODE_SW,
+};
+
+struct ar8327_led_info {
+	const char *name;
+	const char *default_trigger;
+	bool active_low;
+	enum ar8327_led_num led_num;
+	enum ar8327_led_mode mode;
+};
+
+#define AR8327_LED_INFO(_led, _mode, _name) {	\
+	.name = (_name), 	   		\
+	.led_num = AR8327_LED_ ## _led,		\
+	.mode = AR8327_LED_MODE_ ## _mode 	\
+}
+
+struct ar8327_platform_data {
+	struct ar8327_pad_cfg *pad0_cfg;
+	struct ar8327_pad_cfg *pad5_cfg;
+	struct ar8327_pad_cfg *pad6_cfg;
+	struct ar8327_sgmii_cfg *sgmii_cfg;
+	struct ar8327_port_cfg port0_cfg;
+	struct ar8327_port_cfg port6_cfg;
+	struct ar8327_led_cfg *led_cfg;
+
+	int (*get_port_link)(unsigned port);
+
+	unsigned num_leds;
+	const struct ar8327_led_info *leds;
+};
+
+#endif /* AR8216_PLATFORM_H */
+
diff --git a/6.12/target/linux/generic/files/include/linux/ath5k_platform.h b/6.12/target/linux/generic/files/include/linux/ath5k_platform.h
new file mode 100644
index 00000000..ec852245
--- /dev/null
+++ b/6.12/target/linux/generic/files/include/linux/ath5k_platform.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2009 Gabor Juhos <juhosg@openwrt.org>
+ * Copyright (c) 2009 Imre Kaloz <kaloz@openwrt.org>
+ * Copyright (c) 2010 Daniel Golle <daniel.golle@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _LINUX_ATH5K_PLATFORM_H
+#define _LINUX_ATH5K_PLATFORM_H
+
+#define ATH5K_PLAT_EEP_MAX_WORDS	2048
+
+struct ath5k_platform_data {
+	u16 *eeprom_data;
+	u8 *macaddr;
+};
+
+#endif /* _LINUX_ATH5K_PLATFORM_H */
diff --git a/6.12/target/linux/generic/files/include/linux/ath9k_platform.h b/6.12/target/linux/generic/files/include/linux/ath9k_platform.h
new file mode 100644
index 00000000..e2101085
--- /dev/null
+++ b/6.12/target/linux/generic/files/include/linux/ath9k_platform.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (c) 2008 Atheros Communications Inc.
+ * Copyright (c) 2009 Gabor Juhos <juhosg@openwrt.org>
+ * Copyright (c) 2009 Imre Kaloz <kaloz@openwrt.org>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _LINUX_ATH9K_PLATFORM_H
+#define _LINUX_ATH9K_PLATFORM_H
+
+#define ATH9K_PLAT_EEP_MAX_WORDS	2048
+
+struct ath9k_platform_data {
+	const char *eeprom_name;
+
+	u16 eeprom_data[ATH9K_PLAT_EEP_MAX_WORDS];
+	u8 *macaddr;
+
+	int led_pin;
+	u32 gpio_mask;
+	u32 gpio_val;
+
+	u32 bt_active_pin;
+	u32 bt_priority_pin;
+	u32 wlan_active_pin;
+
+	bool endian_check;
+	bool is_clk_25mhz;
+	bool tx_gain_buffalo;
+	bool disable_2ghz;
+	bool disable_5ghz;
+	bool led_active_high;
+
+	int (*get_mac_revision)(void);
+	int (*external_reset)(void);
+
+	bool use_eeprom;
+
+	int num_leds;
+	const struct gpio_led *leds;
+
+	unsigned num_btns;
+	const struct gpio_keys_button *btns;
+	unsigned btn_poll_interval;
+};
+
+#endif /* _LINUX_ATH9K_PLATFORM_H */
diff --git a/6.12/target/linux/generic/files/include/linux/mtd/mtk_bmt.h b/6.12/target/linux/generic/files/include/linux/mtd/mtk_bmt.h
new file mode 100644
index 00000000..cbb6d04d
--- /dev/null
+++ b/6.12/target/linux/generic/files/include/linux/mtd/mtk_bmt.h
@@ -0,0 +1,18 @@
+#ifndef __MTK_BMT_H
+#define __MTK_BMT_H
+
+#ifdef CONFIG_MTD_NAND_MTK_BMT
+int mtk_bmt_attach(struct mtd_info *mtd);
+void mtk_bmt_detach(struct mtd_info *mtd);
+#else
+static inline int mtk_bmt_attach(struct mtd_info *mtd)
+{
+	return 0;
+}
+
+static inline void mtk_bmt_detach(struct mtd_info *mtd)
+{
+}
+#endif
+
+#endif
diff --git a/6.12/target/linux/generic/files/include/linux/myloader.h b/6.12/target/linux/generic/files/include/linux/myloader.h
new file mode 100644
index 00000000..d89e415f
--- /dev/null
+++ b/6.12/target/linux/generic/files/include/linux/myloader.h
@@ -0,0 +1,121 @@
+/*
+ *  Compex's MyLoader specific definitions
+ *
+ *  Copyright (C) 2006-2008 Gabor Juhos <juhosg@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ *
+ */
+
+#ifndef _MYLOADER_H_
+#define _MYLOADER_H_
+
+/* Myloader specific magic numbers */
+#define MYLO_MAGIC_SYS_PARAMS	0x20021107
+#define MYLO_MAGIC_PARTITIONS	0x20021103
+#define MYLO_MAGIC_BOARD_PARAMS	0x20021103
+
+/* Vendor ID's (seems to be same as the PCI vendor ID's) */
+#define VENID_COMPEX		0x11F6
+
+/* Devices based on the ADM5120 */
+#define DEVID_COMPEX_NP27G	0x0078
+#define DEVID_COMPEX_NP28G	0x044C
+#define DEVID_COMPEX_NP28GHS	0x044E
+#define DEVID_COMPEX_WP54Gv1C	0x0514
+#define DEVID_COMPEX_WP54G	0x0515
+#define DEVID_COMPEX_WP54AG	0x0546
+#define DEVID_COMPEX_WPP54AG	0x0550
+#define DEVID_COMPEX_WPP54G	0x0555
+
+/* Devices based on the Atheros AR2317 */
+#define DEVID_COMPEX_NP25G	0x05E6
+#define DEVID_COMPEX_WPE53G	0x05DC
+
+/* Devices based on the Atheros AR71xx */
+#define DEVID_COMPEX_WP543	0x0640
+#define DEVID_COMPEX_WPE72	0x0672
+
+/* Devices based on the IXP422 */
+#define DEVID_COMPEX_WP18	0x047E
+#define DEVID_COMPEX_NP18A	0x0489
+
+/* Other devices */
+#define DEVID_COMPEX_NP26G8M	0x03E8
+#define DEVID_COMPEX_NP26G16M	0x03E9
+
+struct mylo_partition {
+	uint16_t	flags;	/* partition flags */
+	uint16_t	type;	/* type of the partition */
+	uint32_t	addr;	/* relative address of the partition from the
+				   flash start */
+	uint32_t	size;	/* size of the partition in bytes */
+	uint32_t	param;	/* if this is the active partition, the
+				   MyLoader load code to this address */
+};
+
+#define PARTITION_FLAG_ACTIVE	0x8000 /* this is the active partition,
+					* MyLoader loads firmware from here */
+#define PARTITION_FLAG_ISRAM	0x2000 /* FIXME: this is a RAM partition? */
+#define PARTIIION_FLAG_RAMLOAD	0x1000 /* FIXME: load this partition into the RAM? */
+#define PARTITION_FLAG_PRELOAD	0x0800 /* the partition data preloaded to RAM
+					* before decompression */
+#define PARTITION_FLAG_LZMA	0x0100 /* partition data compressed by LZMA */
+#define PARTITION_FLAG_HAVEHDR  0x0002 /* the partition data have a header */
+
+#define PARTITION_TYPE_FREE	0
+#define PARTITION_TYPE_USED	1
+
+#define MYLO_MAX_PARTITIONS	8	/* maximum number of partitions in the
+					   partition table */
+
+struct mylo_partition_table {
+	uint32_t	magic;		/* must be MYLO_MAGIC_PARTITIONS */
+	uint32_t	res0;		/* unknown/unused */
+	uint32_t	res1;		/* unknown/unused */
+	uint32_t 	res2;		/* unknown/unused */
+	struct mylo_partition partitions[MYLO_MAX_PARTITIONS];
+};
+
+struct mylo_partition_header {
+	uint32_t	len;		/* length of the partition data */
+	uint32_t	crc;		/* CRC value of the partition data */
+};
+
+struct mylo_system_params {
+	uint32_t	magic;		/* must be MYLO_MAGIC_SYS_PARAMS */
+	uint32_t	res0;
+	uint32_t	res1;
+	uint32_t	mylo_ver;
+	uint16_t	vid;		/* Vendor ID */
+	uint16_t	did;		/* Device ID */
+	uint16_t	svid;		/* Sub Vendor ID */
+	uint16_t	sdid;		/* Sub Device ID */
+	uint32_t	rev;		/* device revision */
+	uint32_t	fwhi;
+	uint32_t	fwlo;
+	uint32_t	tftp_addr;
+	uint32_t	prog_start;
+	uint32_t	flash_size;	/* size of boot FLASH in bytes */
+	uint32_t	dram_size;	/* size of onboard RAM in bytes */
+};
+
+struct mylo_eth_addr {
+	uint8_t	mac[6];
+	uint8_t	csum[2];
+};
+
+#define MYLO_ETHADDR_COUNT	8	/* maximum number of ethernet address
+					   in the board parameters */
+
+struct mylo_board_params {
+	uint32_t	magic;	/* must be MYLO_MAGIC_BOARD_PARAMS */
+	uint32_t	res0;
+	uint32_t	res1;
+	uint32_t	res2;
+	struct mylo_eth_addr addr[MYLO_ETHADDR_COUNT];
+};
+
+#endif /* _MYLOADER_H_*/
diff --git a/6.12/target/linux/generic/files/include/linux/platform_data/adm6996-gpio.h b/6.12/target/linux/generic/files/include/linux/platform_data/adm6996-gpio.h
new file mode 100644
index 00000000..d5af9bbf
--- /dev/null
+++ b/6.12/target/linux/generic/files/include/linux/platform_data/adm6996-gpio.h
@@ -0,0 +1,29 @@
+/*
+ * ADM6996 GPIO platform data
+ *
+ * Copyright (C) 2013 Hauke Mehrtens <hauke@hauke-m.de>
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of the GNU General Public License v2 as published by the
+ * Free Software Foundation
+ */
+
+#ifndef __PLATFORM_ADM6996_GPIO_H
+#define __PLATFORM_ADM6996_GPIO_H
+
+#include <linux/kernel.h>
+
+enum adm6996_model {
+	ADM6996FC = 1,
+	ADM6996M = 2,
+	ADM6996L = 3,
+};
+
+struct adm6996_gpio_platform_data {
+	u8 eecs;
+	u8 eesk;
+	u8 eedi;
+	enum adm6996_model model;
+};
+
+#endif
diff --git a/6.12/target/linux/generic/files/include/linux/routerboot.h b/6.12/target/linux/generic/files/include/linux/routerboot.h
new file mode 100644
index 00000000..3cda858c
--- /dev/null
+++ b/6.12/target/linux/generic/files/include/linux/routerboot.h
@@ -0,0 +1,106 @@
+/*
+ *  Mikrotik's RouterBOOT definitions
+ *
+ *  Copyright (C) 2007-2008 Gabor Juhos <juhosg@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ *
+ */
+
+#ifndef _ROUTERBOOT_H
+#define _ROUTERBOOT_H
+
+#define RB_MAC_SIZE		6
+
+/*
+ * Magic numbers
+ */
+#define RB_MAGIC_HARD	0x64726148 /* "Hard" */
+#define RB_MAGIC_SOFT	0x74666F53 /* "Soft" */
+#define RB_MAGIC_DAWN	0x6E776144 /* "Dawn" */
+
+#define RB_ID_TERMINATOR	0
+
+/*
+ * ID values for Hardware settings
+ */
+#define RB_ID_HARD_01		1
+#define RB_ID_HARD_02		2
+#define RB_ID_FLASH_INFO	3
+#define RB_ID_MAC_ADDRESS_PACK	4
+#define RB_ID_BOARD_NAME	5
+#define RB_ID_BIOS_VERSION	6
+#define RB_ID_HARD_07		7
+#define RB_ID_SDRAM_TIMINGS	8
+#define RB_ID_DEVICE_TIMINGS	9
+#define RB_ID_SOFTWARE_ID	10
+#define RB_ID_SERIAL_NUMBER	11
+#define RB_ID_HARD_12		12
+#define RB_ID_MEMORY_SIZE	13
+#define RB_ID_MAC_ADDRESS_COUNT	14
+#define RB_ID_HW_OPTIONS	21
+#define RB_ID_WLAN_DATA		22
+
+/*
+ * ID values for Software settings
+ */
+#define RB_ID_UART_SPEED	1
+#define RB_ID_BOOT_DELAY	2
+#define RB_ID_BOOT_DEVICE	3
+#define RB_ID_BOOT_KEY		4
+#define RB_ID_CPU_MODE		5
+#define RB_ID_FW_VERSION	6
+#define RB_ID_SOFT_07		7
+#define RB_ID_SOFT_08		8
+#define RB_ID_BOOT_PROTOCOL	9
+#define RB_ID_SOFT_10		10
+#define RB_ID_SOFT_11		11
+
+/*
+ * UART_SPEED values
+ */
+#define RB_UART_SPEED_115200	0
+#define RB_UART_SPEED_57600	1
+#define RB_UART_SPEED_38400	2
+#define RB_UART_SPEED_19200	3
+#define RB_UART_SPEED_9600	4
+#define RB_UART_SPEED_4800	5
+#define RB_UART_SPEED_2400	6
+#define RB_UART_SPEED_1200	7
+
+/*
+ * BOOT_DELAY values
+ */
+#define RB_BOOT_DELAY_0SEC	0
+#define RB_BOOT_DELAY_1SEC	1
+#define RB_BOOT_DELAY_2SEC	2
+
+/*
+ * BOOT_DEVICE values
+ */
+#define RB_BOOT_DEVICE_ETHER	0
+#define RB_BOOT_DEVICE_NANDETH	1
+#define RB_BOOT_DEVICE_ETHONCE	2
+#define RB_BOOT_DEVICE_NANDONLY	3
+
+/*
+ * BOOT_KEY values
+ */
+#define RB_BOOT_KEY_ANY		0
+#define RB_BOOT_KEY_DEL		1
+
+/*
+ * CPU_MODE values
+ */
+#define RB_CPU_MODE_POWERSAVE	0
+#define RB_CPU_MODE_REGULAR	1
+
+/*
+ * BOOT_PROTOCOL values
+ */
+#define RB_BOOT_PROTOCOL_BOOTP	0
+#define RB_BOOT_PROTOCOL_DHCP	1
+
+#endif /* _ROUTERBOOT_H */
diff --git a/6.12/target/linux/generic/files/include/linux/rt2x00_platform.h b/6.12/target/linux/generic/files/include/linux/rt2x00_platform.h
new file mode 100644
index 00000000..e10377e2
--- /dev/null
+++ b/6.12/target/linux/generic/files/include/linux/rt2x00_platform.h
@@ -0,0 +1,23 @@
+/*
+ * Platform data definition for the rt2x00 driver
+ *
+ * Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ *
+ */
+
+#ifndef _RT2X00_PLATFORM_H
+#define _RT2X00_PLATFORM_H
+
+struct rt2x00_platform_data {
+	char *eeprom_file_name;
+	const u8 *mac_address;
+
+	int disable_2ghz;
+	int disable_5ghz;
+};
+
+#endif /* _RT2X00_PLATFORM_H */
diff --git a/6.12/target/linux/generic/files/include/linux/rtl8366.h b/6.12/target/linux/generic/files/include/linux/rtl8366.h
new file mode 100644
index 00000000..e3ce8f53
--- /dev/null
+++ b/6.12/target/linux/generic/files/include/linux/rtl8366.h
@@ -0,0 +1,42 @@
+/*
+ * Platform data definition for the Realtek RTL8366RB/S ethernet switch driver
+ *
+ * Copyright (C) 2009-2010 Gabor Juhos <juhosg@openwrt.org>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ */
+
+#ifndef _RTL8366_H
+#define _RTL8366_H
+
+#define RTL8366_DRIVER_NAME	"rtl8366"
+#define RTL8366S_DRIVER_NAME	"rtl8366s"
+#define RTL8366RB_DRIVER_NAME	"rtl8366rb"
+
+struct rtl8366_smi;
+
+enum rtl8366_type {
+	RTL8366_TYPE_UNKNOWN,
+	RTL8366_TYPE_S,
+	RTL8366_TYPE_RB,
+};
+
+struct rtl8366_initval {
+	unsigned	reg;
+	u16		val;
+};
+
+struct rtl8366_platform_data {
+	unsigned	gpio_sda;
+	unsigned	gpio_sck;
+	void		(*hw_reset)(struct rtl8366_smi *smi, bool active);
+
+	unsigned	num_initvals;
+	struct rtl8366_initval *initvals;
+};
+
+enum rtl8366_type rtl8366_smi_detect(struct rtl8366_platform_data *pdata);
+
+#endif /*  _RTL8366_H */
diff --git a/6.12/target/linux/generic/files/include/linux/rtl8367.h b/6.12/target/linux/generic/files/include/linux/rtl8367.h
new file mode 100644
index 00000000..14150393
--- /dev/null
+++ b/6.12/target/linux/generic/files/include/linux/rtl8367.h
@@ -0,0 +1,63 @@
+/*
+ * Platform data definition for the Realtek RTL8367 ethernet switch driver
+ *
+ * Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ */
+
+#ifndef _RTL8367_H
+#define _RTL8367_H
+
+#define RTL8367_DRIVER_NAME	"rtl8367"
+#define RTL8367B_DRIVER_NAME	"rtl8367b"
+
+enum rtl8367_port_speed {
+	RTL8367_PORT_SPEED_10 = 0,
+	RTL8367_PORT_SPEED_100,
+	RTL8367_PORT_SPEED_1000,
+};
+
+struct rtl8367_port_ability {
+	int force_mode;
+	int nway;
+	int txpause;
+	int rxpause;
+	int link;
+	int duplex;
+	enum rtl8367_port_speed speed;
+};
+
+enum rtl8367_extif_mode {
+	RTL8367_EXTIF_MODE_DISABLED = 0,
+	RTL8367_EXTIF_MODE_RGMII,
+	RTL8367_EXTIF_MODE_MII_MAC,
+	RTL8367_EXTIF_MODE_MII_PHY,
+	RTL8367_EXTIF_MODE_TMII_MAC,
+	RTL8367_EXTIF_MODE_TMII_PHY,
+	RTL8367_EXTIF_MODE_GMII,
+	RTL8367_EXTIF_MODE_RGMII_33V,
+	RTL8367B_EXTIF_MODE_RMII_MAC = 7,
+	RTL8367B_EXTIF_MODE_RMII_PHY,
+	RTL8367B_EXTIF_MODE_RGMII_33V,
+};
+
+struct rtl8367_extif_config {
+	unsigned int txdelay;
+	unsigned int rxdelay;
+	enum rtl8367_extif_mode mode;
+	struct rtl8367_port_ability ability;
+};
+
+struct rtl8367_platform_data {
+	unsigned gpio_sda;
+	unsigned gpio_sck;
+	void (*hw_reset)(bool active);
+
+	struct rtl8367_extif_config *extif0_cfg;
+	struct rtl8367_extif_config *extif1_cfg;
+};
+
+#endif /*  _RTL8367_H */
diff --git a/6.12/target/linux/generic/files/include/linux/switch.h b/6.12/target/linux/generic/files/include/linux/switch.h
new file mode 100644
index 00000000..4e623847
--- /dev/null
+++ b/6.12/target/linux/generic/files/include/linux/switch.h
@@ -0,0 +1,179 @@
+/*
+ * switch.h: Switch configuration API
+ *
+ * Copyright (C) 2008 Felix Fietkau <nbd@nbd.name>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+#ifndef _LINUX_SWITCH_H
+#define _LINUX_SWITCH_H
+
+#include <net/genetlink.h>
+#include <uapi/linux/switch.h>
+
+struct switch_dev;
+struct switch_op;
+struct switch_val;
+struct switch_attr;
+struct switch_attrlist;
+struct switch_led_trigger;
+
+int register_switch(struct switch_dev *dev, struct net_device *netdev);
+void unregister_switch(struct switch_dev *dev);
+
+/**
+ * struct switch_attrlist - attribute list
+ *
+ * @n_attr: number of attributes
+ * @attr: pointer to the attributes array
+ */
+struct switch_attrlist {
+	int n_attr;
+	const struct switch_attr *attr;
+};
+
+enum switch_port_speed {
+	SWITCH_PORT_SPEED_UNKNOWN = 0,
+	SWITCH_PORT_SPEED_10 = 10,
+	SWITCH_PORT_SPEED_100 = 100,
+	SWITCH_PORT_SPEED_1000 = 1000,
+};
+
+struct switch_port_link {
+	bool link;
+	bool duplex;
+	bool aneg;
+	bool tx_flow;
+	bool rx_flow;
+	enum switch_port_speed speed;
+	/* in ethtool adv_t format */
+	u32 eee;
+};
+
+struct switch_port_stats {
+	unsigned long long tx_bytes;
+	unsigned long long rx_bytes;
+};
+
+/**
+ * struct switch_dev_ops - switch driver operations
+ *
+ * @attr_global: global switch attribute list
+ * @attr_port: port attribute list
+ * @attr_vlan: vlan attribute list
+ *
+ * Callbacks:
+ *
+ * @get_vlan_ports: read the port list of a VLAN
+ * @set_vlan_ports: set the port list of a VLAN
+ *
+ * @get_port_pvid: get the primary VLAN ID of a port
+ * @set_port_pvid: set the primary VLAN ID of a port
+ *
+ * @apply_config: apply all changed settings to the switch
+ * @reset_switch: resetting the switch
+ */
+struct switch_dev_ops {
+	struct switch_attrlist attr_global, attr_port, attr_vlan;
+
+	int (*get_vlan_ports)(struct switch_dev *dev, struct switch_val *val);
+	int (*set_vlan_ports)(struct switch_dev *dev, struct switch_val *val);
+
+	int (*get_port_pvid)(struct switch_dev *dev, int port, int *val);
+	int (*set_port_pvid)(struct switch_dev *dev, int port, int val);
+
+	int (*apply_config)(struct switch_dev *dev);
+	int (*reset_switch)(struct switch_dev *dev);
+
+	int (*get_port_link)(struct switch_dev *dev, int port,
+			     struct switch_port_link *link);
+	int (*set_port_link)(struct switch_dev *dev, int port,
+			     struct switch_port_link *link);
+	int (*get_port_stats)(struct switch_dev *dev, int port,
+			      struct switch_port_stats *stats);
+
+	int (*phy_read16)(struct switch_dev *dev, int addr, u8 reg, u16 *value);
+	int (*phy_write16)(struct switch_dev *dev, int addr, u8 reg, u16 value);
+};
+
+struct switch_dev {
+	struct device_node *of_node;
+	const struct switch_dev_ops *ops;
+	/* will be automatically filled */
+	char devname[IFNAMSIZ];
+
+	const char *name;
+	/* NB: either alias or netdev must be set */
+	const char *alias;
+	struct net_device *netdev;
+
+	unsigned int ports;
+	unsigned int vlans;
+	unsigned int cpu_port;
+
+	/* the following fields are internal for swconfig */
+	unsigned int id;
+	struct list_head dev_list;
+	unsigned long def_global, def_port, def_vlan;
+
+	struct mutex sw_mutex;
+	struct switch_port *portbuf;
+	struct switch_portmap *portmap;
+	struct switch_port_link linkbuf;
+
+	char buf[128];
+
+#ifdef CONFIG_SWCONFIG_LEDS
+	struct switch_led_trigger *led_trigger;
+#endif
+};
+
+struct switch_port {
+	u32 id;
+	u32 flags;
+};
+
+struct switch_portmap {
+	u32 virt;
+	const char *s;
+};
+
+struct switch_val {
+	const struct switch_attr *attr;
+	unsigned int port_vlan;
+	unsigned int len;
+	union {
+		const char *s;
+		u32 i;
+		struct switch_port *ports;
+		struct switch_port_link *link;
+	} value;
+};
+
+struct switch_attr {
+	int disabled;
+	int type;
+	const char *name;
+	const char *description;
+
+	int (*set)(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val);
+	int (*get)(struct switch_dev *dev, const struct switch_attr *attr, struct switch_val *val);
+
+	/* for driver internal use */
+	int id;
+	int ofs;
+	int max;
+};
+
+int switch_generic_set_link(struct switch_dev *dev, int port,
+			    struct switch_port_link *link);
+
+#endif /* _LINUX_SWITCH_H */
diff --git a/6.12/target/linux/generic/files/include/uapi/linux/switch.h b/6.12/target/linux/generic/files/include/uapi/linux/switch.h
new file mode 100644
index 00000000..ea449653
--- /dev/null
+++ b/6.12/target/linux/generic/files/include/uapi/linux/switch.h
@@ -0,0 +1,119 @@
+/*
+ * switch.h: Switch configuration API
+ *
+ * Copyright (C) 2008 Felix Fietkau <nbd@nbd.name>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#ifndef _UAPI_LINUX_SWITCH_H
+#define _UAPI_LINUX_SWITCH_H
+
+#include <linux/types.h>
+#include <linux/netdevice.h>
+#include <linux/netlink.h>
+#include <linux/genetlink.h>
+#ifndef __KERNEL__
+#include <netlink/netlink.h>
+#include <netlink/genl/genl.h>
+#include <netlink/genl/ctrl.h>
+#endif
+
+/* main attributes */
+enum {
+	SWITCH_ATTR_UNSPEC,
+	/* global */
+	SWITCH_ATTR_TYPE,
+	/* device */
+	SWITCH_ATTR_ID,
+	SWITCH_ATTR_DEV_NAME,
+	SWITCH_ATTR_ALIAS,
+	SWITCH_ATTR_NAME,
+	SWITCH_ATTR_VLANS,
+	SWITCH_ATTR_PORTS,
+	SWITCH_ATTR_PORTMAP,
+	SWITCH_ATTR_CPU_PORT,
+	/* attributes */
+	SWITCH_ATTR_OP_ID,
+	SWITCH_ATTR_OP_TYPE,
+	SWITCH_ATTR_OP_NAME,
+	SWITCH_ATTR_OP_PORT,
+	SWITCH_ATTR_OP_VLAN,
+	SWITCH_ATTR_OP_VALUE_INT,
+	SWITCH_ATTR_OP_VALUE_STR,
+	SWITCH_ATTR_OP_VALUE_PORTS,
+	SWITCH_ATTR_OP_VALUE_LINK,
+	SWITCH_ATTR_OP_DESCRIPTION,
+	/* port lists */
+	SWITCH_ATTR_PORT,
+	SWITCH_ATTR_MAX
+};
+
+enum {
+	/* port map */
+	SWITCH_PORTMAP_PORTS,
+	SWITCH_PORTMAP_SEGMENT,
+	SWITCH_PORTMAP_VIRT,
+	SWITCH_PORTMAP_MAX
+};
+
+/* commands */
+enum {
+	SWITCH_CMD_UNSPEC,
+	SWITCH_CMD_GET_SWITCH,
+	SWITCH_CMD_NEW_ATTR,
+	SWITCH_CMD_LIST_GLOBAL,
+	SWITCH_CMD_GET_GLOBAL,
+	SWITCH_CMD_SET_GLOBAL,
+	SWITCH_CMD_LIST_PORT,
+	SWITCH_CMD_GET_PORT,
+	SWITCH_CMD_SET_PORT,
+	SWITCH_CMD_LIST_VLAN,
+	SWITCH_CMD_GET_VLAN,
+	SWITCH_CMD_SET_VLAN
+};
+
+/* data types */
+enum switch_val_type {
+	SWITCH_TYPE_UNSPEC,
+	SWITCH_TYPE_INT,
+	SWITCH_TYPE_STRING,
+	SWITCH_TYPE_PORTS,
+	SWITCH_TYPE_LINK,
+	SWITCH_TYPE_NOVAL,
+};
+
+/* port nested attributes */
+enum {
+	SWITCH_PORT_UNSPEC,
+	SWITCH_PORT_ID,
+	SWITCH_PORT_FLAG_TAGGED,
+	SWITCH_PORT_ATTR_MAX
+};
+
+/* link nested attributes */
+enum {
+	SWITCH_LINK_UNSPEC,
+	SWITCH_LINK_FLAG_LINK,
+	SWITCH_LINK_FLAG_DUPLEX,
+	SWITCH_LINK_FLAG_ANEG,
+	SWITCH_LINK_FLAG_TX_FLOW,
+	SWITCH_LINK_FLAG_RX_FLOW,
+	SWITCH_LINK_SPEED,
+	SWITCH_LINK_FLAG_EEE_100BASET,
+	SWITCH_LINK_FLAG_EEE_1000BASET,
+	SWITCH_LINK_ATTR_MAX,
+};
+
+#define SWITCH_ATTR_DEFAULTS_OFFSET	0x1000
+
+
+#endif /* _UAPI_LINUX_SWITCH_H */
diff --git a/6.12/target/linux/generic/hack-6.12/204-module_strip.patch b/6.12/target/linux/generic/hack-6.12/204-module_strip.patch
new file mode 100644
index 00000000..9a070f5d
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/204-module_strip.patch
@@ -0,0 +1,177 @@
+From a779a482fb9b9f8fcdf8b2519c789b4b9bb5dd05 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 7 Jul 2017 16:56:48 +0200
+Subject: build: add a hack for removing non-essential module info
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ include/linux/module.h      | 13 ++++++++-----
+ include/linux/moduleparam.h | 15 ++++++++++++---
+ init/Kconfig                |  7 +++++++
+ kernel/module.c             |  5 ++++-
+ scripts/mod/modpost.c       | 12 ++++++++++++
+ 5 files changed, 43 insertions(+), 9 deletions(-)
+
+--- a/include/linux/module.h
++++ b/include/linux/module.h
+@@ -164,6 +164,7 @@ extern void cleanup_module(void);
+ 
+ /* Generic info of form tag = "info" */
+ #define MODULE_INFO(tag, info) __MODULE_INFO(tag, tag, info)
++#define MODULE_INFO_STRIP(tag, info) __MODULE_INFO_STRIP(tag, tag, info)
+ 
+ /* For userspace: you can also call me... */
+ #define MODULE_ALIAS(_alias) MODULE_INFO(alias, _alias)
+@@ -239,12 +240,12 @@ extern void cleanup_module(void);
+  * Author(s), use "Name <email>" or just "Name", for multiple
+  * authors use multiple MODULE_AUTHOR() statements/lines.
+  */
+-#define MODULE_AUTHOR(_author) MODULE_INFO(author, _author)
++#define MODULE_AUTHOR(_author) MODULE_INFO_STRIP(author, _author)
+ 
+ /* What your module does. */
+-#define MODULE_DESCRIPTION(_description) MODULE_INFO(description, _description)
++#define MODULE_DESCRIPTION(_description) MODULE_INFO_STRIP(description, _description)
+ 
+-#ifdef MODULE
++#if defined(MODULE) && !defined(CONFIG_MODULE_STRIPPED)
+ /* Creates an alias so file2alias.c can find device table. */
+ #define MODULE_DEVICE_TABLE(type, name)					\
+ extern typeof(name) __mod_##type##__##name##_device_table		\
+@@ -271,7 +272,9 @@ extern typeof(name) __mod_##type##__##na
+  */
+ 
+ #if defined(MODULE) || !defined(CONFIG_SYSFS)
+-#define MODULE_VERSION(_version) MODULE_INFO(version, _version)
++#define MODULE_VERSION(_version) MODULE_INFO_STRIP(version, _version)
++#elif defined(CONFIG_MODULE_STRIPPED)
++#define MODULE_VERSION(_version) __MODULE_INFO_DISABLED(version)
+ #else
+ #define MODULE_VERSION(_version)					\
+ 	MODULE_INFO(version, _version);					\
+@@ -294,7 +297,7 @@ extern typeof(name) __mod_##type##__##na
+ /* Optional firmware file (or files) needed by the module
+  * format is simply firmware file name.  Multiple firmware
+  * files require multiple MODULE_FIRMWARE() specifiers */
+-#define MODULE_FIRMWARE(_firmware) MODULE_INFO(firmware, _firmware)
++#define MODULE_FIRMWARE(_firmware) MODULE_INFO_STRIP(firmware, _firmware)
+ 
+ #define MODULE_IMPORT_NS(ns)	MODULE_INFO(import_ns, __stringify(ns))
+ 
+--- a/include/linux/moduleparam.h
++++ b/include/linux/moduleparam.h
+@@ -20,6 +20,16 @@
+ /* Chosen so that structs with an unsigned long line up. */
+ #define MAX_PARAM_PREFIX_LEN (64 - sizeof(unsigned long))
+ 
++/* This struct is here for syntactic coherency, it is not used */
++#define __MODULE_INFO_DISABLED(name)					  \
++  struct __UNIQUE_ID(name) {}
++
++#ifdef CONFIG_MODULE_STRIPPED
++#define __MODULE_INFO_STRIP(tag, name, info) __MODULE_INFO_DISABLED(name)
++#else
++#define __MODULE_INFO_STRIP(tag, name, info) __MODULE_INFO(tag, name, info)
++#endif
++
+ #define __MODULE_INFO(tag, name, info)					  \
+ 	static const char __UNIQUE_ID(name)[]				  \
+ 		__used __section(".modinfo") __aligned(1)		  \
+@@ -31,7 +41,7 @@
+ /* One for each parameter, describing how to use it.  Some files do
+    multiple of these per line, so can't just use MODULE_INFO. */
+ #define MODULE_PARM_DESC(_parm, desc) \
+-	__MODULE_INFO(parm, _parm, #_parm ":" desc)
++	__MODULE_INFO_STRIP(parm, _parm, #_parm ":" desc)
+ 
+ struct kernel_param;
+ 
+--- a/kernel/module/Kconfig
++++ b/kernel/module/Kconfig
+@@ -401,4 +401,11 @@ config MODULES_TREE_LOOKUP
+ 	def_bool y
+ 	depends on PERF_EVENTS || TRACING || CFI_CLANG
+ 
++config MODULE_STRIPPED
++	bool "Reduce module size"
++	depends on MODULES
++	help
++	  Remove module parameter descriptions, author info, version, aliases,
++	  device tables, etc.
++
+ endif # MODULES
+--- a/kernel/module/main.c
++++ b/kernel/module/main.c
+@@ -999,6 +999,7 @@ size_t modinfo_attrs_count = ARRAY_SIZE(
+ 
+ static const char vermagic[] = VERMAGIC_STRING;
+ 
++#if defined(CONFIG_MODVERSIONS) || !defined(CONFIG_MODULE_STRIPPED)
+ int try_to_force_load(struct module *mod, const char *reason)
+ {
+ #ifdef CONFIG_MODULE_FORCE_LOAD
+@@ -1010,6 +1011,7 @@ int try_to_force_load(struct module *mod
+ 	return -ENOEXEC;
+ #endif
+ }
++#endif
+ 
+ /* Parse tag=value strings from .modinfo section */
+ char *module_next_tag_pair(char *string, unsigned long *secsize)
+@@ -2093,9 +2095,11 @@ static void module_augment_kernel_taints
+ 
+ static int check_modinfo(struct module *mod, struct load_info *info, int flags)
+ {
+-	const char *modmagic = get_modinfo(info, "vermagic");
+ 	int err;
+ 
++#ifndef CONFIG_MODULE_STRIPPED
++	const char *modmagic = get_modinfo(info, "vermagic");
++
+ 	if (flags & MODULE_INIT_IGNORE_VERMAGIC)
+ 		modmagic = NULL;
+ 
+@@ -2109,6 +2113,7 @@ static int check_modinfo(struct module *
+ 		       info->name, modmagic, vermagic);
+ 		return -ENOEXEC;
+ 	}
++#endif
+ 
+ 	err = check_modinfo_livepatch(mod, info);
+ 	if (err)
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -1601,7 +1601,9 @@ static void read_symbols(const char *mod
+ 		symname = remove_dot(info.strtab + sym->st_name);
+ 
+ 		handle_symbol(mod, &info, sym, symname);
++#ifndef CONFIG_MODULE_STRIPPED
+ 		handle_moddevtable(mod, &info, sym, symname);
++#endif
+ 	}
+ 
+ 	check_sec_ref(mod, &info);
+@@ -1886,11 +1888,13 @@ static void add_depends(struct buffer *b
+ 
+ static void add_srcversion(struct buffer *b, struct module *mod)
+ {
++#ifndef CONFIG_MODULE_STRIPPED
+ 	if (mod->srcversion[0]) {
+ 		buf_printf(b, "\n");
+ 		buf_printf(b, "MODULE_INFO(srcversion, \"%s\");\n",
+ 			   mod->srcversion);
+ 	}
++#endif
+ }
+ 
+ static void write_buf(struct buffer *b, const char *fname)
+@@ -1973,7 +1977,9 @@ static void write_mod_c_file(struct modu
+ 	add_exported_symbols(&buf, mod);
+ 	add_versions(&buf, mod);
+ 	add_depends(&buf, mod);
++#ifndef CONFIG_MODULE_STRIPPED
+ 	add_moddevtable(&buf, mod);
++#endif
+ 	add_srcversion(&buf, mod);
+ 
+ 	ret = snprintf(fname, sizeof(fname), "%s.mod.c", mod->name);
diff --git a/6.12/target/linux/generic/hack-6.12/205-kconfig-abort-configuration-on-unset-symbol.patch b/6.12/target/linux/generic/hack-6.12/205-kconfig-abort-configuration-on-unset-symbol.patch
new file mode 100644
index 00000000..d7416d81
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/205-kconfig-abort-configuration-on-unset-symbol.patch
@@ -0,0 +1,41 @@
+From 310e8e04a05d9eb43fa9dd7f00143300afcaa37a Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Fri, 11 Nov 2022 13:33:44 +0100
+Subject: [PATCH] kconfig: abort configuration on unset symbol
+
+When a target configuration has unset Kconfig symbols, the build will
+fail when OpenWrt is compiled with V=s and stdin is connected to a tty.
+
+In case OpenWrt is compiled without either of these preconditions, the
+build will succeed with the symbols in question being unset.
+
+Modify the kernel configuration in a way it fails on unset symbols
+regardless of the aforementioned preconditions.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ scripts/kconfig/conf.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/scripts/kconfig/conf.c
++++ b/scripts/kconfig/conf.c
+@@ -312,6 +312,9 @@ static int conf_askvalue(struct symbol *
+ 		}
+ 		/* fall through */
+ 	default:
++		if (!tty_stdio && getenv("FAIL_ON_UNCONFIGURED")) {
++			exit(1);
++		}
+ 		fflush(stdout);
+ 		xfgets(line, sizeof(line), stdin);
+ 		break;
+@@ -470,6 +473,9 @@ static void conf_choice(struct menu *men
+ 			}
+ 			/* fall through */
+ 		case oldaskconfig:
++			if (!tty_stdio && getenv("FAIL_ON_UNCONFIGURED")) {
++				exit(1);
++			}
+ 			fflush(stdout);
+ 			xfgets(line, sizeof(line), stdin);
+ 			strip(line);
diff --git a/6.12/target/linux/generic/hack-6.12/210-darwin_scripts_include.patch b/6.12/target/linux/generic/hack-6.12/210-darwin_scripts_include.patch
new file mode 100644
index 00000000..be59ca4f
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/210-darwin_scripts_include.patch
@@ -0,0 +1,3053 @@
+From db7c30dcd9a0391bf13b62c9f91e144d762ef43a Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Fri, 7 Jul 2017 17:00:49 +0200
+Subject: Add an OSX specific patch to make the kernel be compiled
+
+lede-commit: 3fc2a24f0422b2f55f9ed43f116db3111f700526
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ scripts/kconfig/Makefile   |    3 +
+ scripts/mod/elf.h          | 3007 ++++++++++++++++++++++++++++++++++++++++++++
+ scripts/mod/mk_elfconfig.c |    4 +
+ scripts/mod/modpost.h      |    4 +
+ 4 files changed, 3018 insertions(+)
+ create mode 100644 scripts/mod/elf.h
+
+--- /dev/null
++++ b/scripts/mod/elf.h
+@@ -0,0 +1,3007 @@
++/* This file defines standard ELF types, structures, and macros.
++   Copyright (C) 1995-2012 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <http://www.gnu.org/licenses/>.  */
++
++#ifndef _ELF_H
++#define	_ELF_H 1
++
++/* Standard ELF types.  */
++
++#include <stdint.h>
++
++/* Type for a 16-bit quantity.  */
++typedef uint16_t Elf32_Half;
++typedef uint16_t Elf64_Half;
++
++/* Types for signed and unsigned 32-bit quantities.  */
++typedef uint32_t Elf32_Word;
++typedef	int32_t  Elf32_Sword;
++typedef uint32_t Elf64_Word;
++typedef	int32_t  Elf64_Sword;
++
++/* Types for signed and unsigned 64-bit quantities.  */
++typedef uint64_t Elf32_Xword;
++typedef	int64_t  Elf32_Sxword;
++typedef uint64_t Elf64_Xword;
++typedef	int64_t  Elf64_Sxword;
++
++/* Type of addresses.  */
++typedef uint32_t Elf32_Addr;
++typedef uint64_t Elf64_Addr;
++
++/* Type of file offsets.  */
++typedef uint32_t Elf32_Off;
++typedef uint64_t Elf64_Off;
++
++/* Type for section indices, which are 16-bit quantities.  */
++typedef uint16_t Elf32_Section;
++typedef uint16_t Elf64_Section;
++
++/* Type for version symbol information.  */
++typedef Elf32_Half Elf32_Versym;
++typedef Elf64_Half Elf64_Versym;
++
++
++/* The ELF file header.  This appears at the start of every ELF file.  */
++
++#define EI_NIDENT (16)
++
++typedef struct
++{
++  unsigned char	e_ident[EI_NIDENT];	/* Magic number and other info */
++  Elf32_Half	e_type;			/* Object file type */
++  Elf32_Half	e_machine;		/* Architecture */
++  Elf32_Word	e_version;		/* Object file version */
++  Elf32_Addr	e_entry;		/* Entry point virtual address */
++  Elf32_Off	e_phoff;		/* Program header table file offset */
++  Elf32_Off	e_shoff;		/* Section header table file offset */
++  Elf32_Word	e_flags;		/* Processor-specific flags */
++  Elf32_Half	e_ehsize;		/* ELF header size in bytes */
++  Elf32_Half	e_phentsize;		/* Program header table entry size */
++  Elf32_Half	e_phnum;		/* Program header table entry count */
++  Elf32_Half	e_shentsize;		/* Section header table entry size */
++  Elf32_Half	e_shnum;		/* Section header table entry count */
++  Elf32_Half	e_shstrndx;		/* Section header string table index */
++} Elf32_Ehdr;
++
++typedef struct
++{
++  unsigned char	e_ident[EI_NIDENT];	/* Magic number and other info */
++  Elf64_Half	e_type;			/* Object file type */
++  Elf64_Half	e_machine;		/* Architecture */
++  Elf64_Word	e_version;		/* Object file version */
++  Elf64_Addr	e_entry;		/* Entry point virtual address */
++  Elf64_Off	e_phoff;		/* Program header table file offset */
++  Elf64_Off	e_shoff;		/* Section header table file offset */
++  Elf64_Word	e_flags;		/* Processor-specific flags */
++  Elf64_Half	e_ehsize;		/* ELF header size in bytes */
++  Elf64_Half	e_phentsize;		/* Program header table entry size */
++  Elf64_Half	e_phnum;		/* Program header table entry count */
++  Elf64_Half	e_shentsize;		/* Section header table entry size */
++  Elf64_Half	e_shnum;		/* Section header table entry count */
++  Elf64_Half	e_shstrndx;		/* Section header string table index */
++} Elf64_Ehdr;
++
++/* Fields in the e_ident array.  The EI_* macros are indices into the
++   array.  The macros under each EI_* macro are the values the byte
++   may have.  */
++
++#define EI_MAG0		0		/* File identification byte 0 index */
++#define ELFMAG0		0x7f		/* Magic number byte 0 */
++
++#define EI_MAG1		1		/* File identification byte 1 index */
++#define ELFMAG1		'E'		/* Magic number byte 1 */
++
++#define EI_MAG2		2		/* File identification byte 2 index */
++#define ELFMAG2		'L'		/* Magic number byte 2 */
++
++#define EI_MAG3		3		/* File identification byte 3 index */
++#define ELFMAG3		'F'		/* Magic number byte 3 */
++
++/* Conglomeration of the identification bytes, for easy testing as a word.  */
++#define	ELFMAG		"\177ELF"
++#define	SELFMAG		4
++
++#define EI_CLASS	4		/* File class byte index */
++#define ELFCLASSNONE	0		/* Invalid class */
++#define ELFCLASS32	1		/* 32-bit objects */
++#define ELFCLASS64	2		/* 64-bit objects */
++#define ELFCLASSNUM	3
++
++#define EI_DATA		5		/* Data encoding byte index */
++#define ELFDATANONE	0		/* Invalid data encoding */
++#define ELFDATA2LSB	1		/* 2's complement, little endian */
++#define ELFDATA2MSB	2		/* 2's complement, big endian */
++#define ELFDATANUM	3
++
++#define EI_VERSION	6		/* File version byte index */
++					/* Value must be EV_CURRENT */
++
++#define EI_OSABI	7		/* OS ABI identification */
++#define ELFOSABI_NONE		0	/* UNIX System V ABI */
++#define ELFOSABI_SYSV		0	/* Alias.  */
++#define ELFOSABI_HPUX		1	/* HP-UX */
++#define ELFOSABI_NETBSD		2	/* NetBSD.  */
++#define ELFOSABI_GNU		3	/* Object uses GNU ELF extensions.  */
++#define ELFOSABI_LINUX		ELFOSABI_GNU /* Compatibility alias.  */
++#define ELFOSABI_SOLARIS	6	/* Sun Solaris.  */
++#define ELFOSABI_AIX		7	/* IBM AIX.  */
++#define ELFOSABI_IRIX		8	/* SGI Irix.  */
++#define ELFOSABI_FREEBSD	9	/* FreeBSD.  */
++#define ELFOSABI_TRU64		10	/* Compaq TRU64 UNIX.  */
++#define ELFOSABI_MODESTO	11	/* Novell Modesto.  */
++#define ELFOSABI_OPENBSD	12	/* OpenBSD.  */
++#define ELFOSABI_ARM_AEABI	64	/* ARM EABI */
++#define ELFOSABI_ARM		97	/* ARM */
++#define ELFOSABI_STANDALONE	255	/* Standalone (embedded) application */
++
++#define EI_ABIVERSION	8		/* ABI version */
++
++#define EI_PAD		9		/* Byte index of padding bytes */
++
++/* Legal values for e_type (object file type).  */
++
++#define ET_NONE		0		/* No file type */
++#define ET_REL		1		/* Relocatable file */
++#define ET_EXEC		2		/* Executable file */
++#define ET_DYN		3		/* Shared object file */
++#define ET_CORE		4		/* Core file */
++#define	ET_NUM		5		/* Number of defined types */
++#define ET_LOOS		0xfe00		/* OS-specific range start */
++#define ET_HIOS		0xfeff		/* OS-specific range end */
++#define ET_LOPROC	0xff00		/* Processor-specific range start */
++#define ET_HIPROC	0xffff		/* Processor-specific range end */
++
++/* Legal values for e_machine (architecture).  */
++
++#define EM_NONE		 0		/* No machine */
++#define EM_M32		 1		/* AT&T WE 32100 */
++#define EM_SPARC	 2		/* SUN SPARC */
++#define EM_386		 3		/* Intel 80386 */
++#define EM_68K		 4		/* Motorola m68k family */
++#define EM_88K		 5		/* Motorola m88k family */
++#define EM_860		 7		/* Intel 80860 */
++#define EM_MIPS		 8		/* MIPS R3000 big-endian */
++#define EM_S370		 9		/* IBM System/370 */
++#define EM_MIPS_RS3_LE	10		/* MIPS R3000 little-endian */
++
++#define EM_PARISC	15		/* HPPA */
++#define EM_VPP500	17		/* Fujitsu VPP500 */
++#define EM_SPARC32PLUS	18		/* Sun's "v8plus" */
++#define EM_960		19		/* Intel 80960 */
++#define EM_PPC		20		/* PowerPC */
++#define EM_PPC64	21		/* PowerPC 64-bit */
++#define EM_S390		22		/* IBM S390 */
++
++#define EM_V800		36		/* NEC V800 series */
++#define EM_FR20		37		/* Fujitsu FR20 */
++#define EM_RH32		38		/* TRW RH-32 */
++#define EM_RCE		39		/* Motorola RCE */
++#define EM_ARM		40		/* ARM */
++#define EM_FAKE_ALPHA	41		/* Digital Alpha */
++#define EM_SH		42		/* Hitachi SH */
++#define EM_SPARCV9	43		/* SPARC v9 64-bit */
++#define EM_TRICORE	44		/* Siemens Tricore */
++#define EM_ARC		45		/* Argonaut RISC Core */
++#define EM_H8_300	46		/* Hitachi H8/300 */
++#define EM_H8_300H	47		/* Hitachi H8/300H */
++#define EM_H8S		48		/* Hitachi H8S */
++#define EM_H8_500	49		/* Hitachi H8/500 */
++#define EM_IA_64	50		/* Intel Merced */
++#define EM_MIPS_X	51		/* Stanford MIPS-X */
++#define EM_COLDFIRE	52		/* Motorola Coldfire */
++#define EM_68HC12	53		/* Motorola M68HC12 */
++#define EM_MMA		54		/* Fujitsu MMA Multimedia Accelerator*/
++#define EM_PCP		55		/* Siemens PCP */
++#define EM_NCPU		56		/* Sony nCPU embeeded RISC */
++#define EM_NDR1		57		/* Denso NDR1 microprocessor */
++#define EM_STARCORE	58		/* Motorola Start*Core processor */
++#define EM_ME16		59		/* Toyota ME16 processor */
++#define EM_ST100	60		/* STMicroelectronic ST100 processor */
++#define EM_TINYJ	61		/* Advanced Logic Corp. Tinyj emb.fam*/
++#define EM_X86_64	62		/* AMD x86-64 architecture */
++#define EM_PDSP		63		/* Sony DSP Processor */
++
++#define EM_FX66		66		/* Siemens FX66 microcontroller */
++#define EM_ST9PLUS	67		/* STMicroelectronics ST9+ 8/16 mc */
++#define EM_ST7		68		/* STmicroelectronics ST7 8 bit mc */
++#define EM_68HC16	69		/* Motorola MC68HC16 microcontroller */
++#define EM_68HC11	70		/* Motorola MC68HC11 microcontroller */
++#define EM_68HC08	71		/* Motorola MC68HC08 microcontroller */
++#define EM_68HC05	72		/* Motorola MC68HC05 microcontroller */
++#define EM_SVX		73		/* Silicon Graphics SVx */
++#define EM_ST19		74		/* STMicroelectronics ST19 8 bit mc */
++#define EM_VAX		75		/* Digital VAX */
++#define EM_CRIS		76		/* Axis Communications 32-bit embedded processor */
++#define EM_JAVELIN	77		/* Infineon Technologies 32-bit embedded processor */
++#define EM_FIREPATH	78		/* Element 14 64-bit DSP Processor */
++#define EM_ZSP		79		/* LSI Logic 16-bit DSP Processor */
++#define EM_MMIX		80		/* Donald Knuth's educational 64-bit processor */
++#define EM_HUANY	81		/* Harvard University machine-independent object files */
++#define EM_PRISM	82		/* SiTera Prism */
++#define EM_AVR		83		/* Atmel AVR 8-bit microcontroller */
++#define EM_FR30		84		/* Fujitsu FR30 */
++#define EM_D10V		85		/* Mitsubishi D10V */
++#define EM_D30V		86		/* Mitsubishi D30V */
++#define EM_V850		87		/* NEC v850 */
++#define EM_M32R		88		/* Mitsubishi M32R */
++#define EM_MN10300	89		/* Matsushita MN10300 */
++#define EM_MN10200	90		/* Matsushita MN10200 */
++#define EM_PJ		91		/* picoJava */
++#define EM_OPENRISC	92		/* OpenRISC 32-bit embedded processor */
++#define EM_ARC_A5	93		/* ARC Cores Tangent-A5 */
++#define EM_XTENSA	94		/* Tensilica Xtensa Architecture */
++#define EM_TILEPRO	188		/* Tilera TILEPro */
++#define EM_TILEGX	191		/* Tilera TILE-Gx */
++#define EM_NUM		192
++
++/* If it is necessary to assign new unofficial EM_* values, please
++   pick large random numbers (0x8523, 0xa7f2, etc.) to minimize the
++   chances of collision with official or non-GNU unofficial values.  */
++
++#define EM_ALPHA	0x9026
++
++/* Legal values for e_version (version).  */
++
++#define EV_NONE		0		/* Invalid ELF version */
++#define EV_CURRENT	1		/* Current version */
++#define EV_NUM		2
++
++/* Section header.  */
++
++typedef struct
++{
++  Elf32_Word	sh_name;		/* Section name (string tbl index) */
++  Elf32_Word	sh_type;		/* Section type */
++  Elf32_Word	sh_flags;		/* Section flags */
++  Elf32_Addr	sh_addr;		/* Section virtual addr at execution */
++  Elf32_Off	sh_offset;		/* Section file offset */
++  Elf32_Word	sh_size;		/* Section size in bytes */
++  Elf32_Word	sh_link;		/* Link to another section */
++  Elf32_Word	sh_info;		/* Additional section information */
++  Elf32_Word	sh_addralign;		/* Section alignment */
++  Elf32_Word	sh_entsize;		/* Entry size if section holds table */
++} Elf32_Shdr;
++
++typedef struct
++{
++  Elf64_Word	sh_name;		/* Section name (string tbl index) */
++  Elf64_Word	sh_type;		/* Section type */
++  Elf64_Xword	sh_flags;		/* Section flags */
++  Elf64_Addr	sh_addr;		/* Section virtual addr at execution */
++  Elf64_Off	sh_offset;		/* Section file offset */
++  Elf64_Xword	sh_size;		/* Section size in bytes */
++  Elf64_Word	sh_link;		/* Link to another section */
++  Elf64_Word	sh_info;		/* Additional section information */
++  Elf64_Xword	sh_addralign;		/* Section alignment */
++  Elf64_Xword	sh_entsize;		/* Entry size if section holds table */
++} Elf64_Shdr;
++
++/* Special section indices.  */
++
++#define SHN_UNDEF	0		/* Undefined section */
++#define SHN_LORESERVE	0xff00		/* Start of reserved indices */
++#define SHN_LOPROC	0xff00		/* Start of processor-specific */
++#define SHN_BEFORE	0xff00		/* Order section before all others
++					   (Solaris).  */
++#define SHN_AFTER	0xff01		/* Order section after all others
++					   (Solaris).  */
++#define SHN_HIPROC	0xff1f		/* End of processor-specific */
++#define SHN_LOOS	0xff20		/* Start of OS-specific */
++#define SHN_HIOS	0xff3f		/* End of OS-specific */
++#define SHN_ABS		0xfff1		/* Associated symbol is absolute */
++#define SHN_COMMON	0xfff2		/* Associated symbol is common */
++#define SHN_XINDEX	0xffff		/* Index is in extra table.  */
++#define SHN_HIRESERVE	0xffff		/* End of reserved indices */
++
++/* Legal values for sh_type (section type).  */
++
++#define SHT_NULL	  0		/* Section header table entry unused */
++#define SHT_PROGBITS	  1		/* Program data */
++#define SHT_SYMTAB	  2		/* Symbol table */
++#define SHT_STRTAB	  3		/* String table */
++#define SHT_RELA	  4		/* Relocation entries with addends */
++#define SHT_HASH	  5		/* Symbol hash table */
++#define SHT_DYNAMIC	  6		/* Dynamic linking information */
++#define SHT_NOTE	  7		/* Notes */
++#define SHT_NOBITS	  8		/* Program space with no data (bss) */
++#define SHT_REL		  9		/* Relocation entries, no addends */
++#define SHT_SHLIB	  10		/* Reserved */
++#define SHT_DYNSYM	  11		/* Dynamic linker symbol table */
++#define SHT_INIT_ARRAY	  14		/* Array of constructors */
++#define SHT_FINI_ARRAY	  15		/* Array of destructors */
++#define SHT_PREINIT_ARRAY 16		/* Array of pre-constructors */
++#define SHT_GROUP	  17		/* Section group */
++#define SHT_SYMTAB_SHNDX  18		/* Extended section indeces */
++#define	SHT_NUM		  19		/* Number of defined types.  */
++#define SHT_LOOS	  0x60000000	/* Start OS-specific.  */
++#define SHT_GNU_ATTRIBUTES 0x6ffffff5	/* Object attributes.  */
++#define SHT_GNU_HASH	  0x6ffffff6	/* GNU-style hash table.  */
++#define SHT_GNU_LIBLIST	  0x6ffffff7	/* Prelink library list */
++#define SHT_CHECKSUM	  0x6ffffff8	/* Checksum for DSO content.  */
++#define SHT_LOSUNW	  0x6ffffffa	/* Sun-specific low bound.  */
++#define SHT_SUNW_move	  0x6ffffffa
++#define SHT_SUNW_COMDAT   0x6ffffffb
++#define SHT_SUNW_syminfo  0x6ffffffc
++#define SHT_GNU_verdef	  0x6ffffffd	/* Version definition section.  */
++#define SHT_GNU_verneed	  0x6ffffffe	/* Version needs section.  */
++#define SHT_GNU_versym	  0x6fffffff	/* Version symbol table.  */
++#define SHT_HISUNW	  0x6fffffff	/* Sun-specific high bound.  */
++#define SHT_HIOS	  0x6fffffff	/* End OS-specific type */
++#define SHT_LOPROC	  0x70000000	/* Start of processor-specific */
++#define SHT_HIPROC	  0x7fffffff	/* End of processor-specific */
++#define SHT_LOUSER	  0x80000000	/* Start of application-specific */
++#define SHT_HIUSER	  0x8fffffff	/* End of application-specific */
++
++/* Legal values for sh_flags (section flags).  */
++
++#define SHF_WRITE	     (1 << 0)	/* Writable */
++#define SHF_ALLOC	     (1 << 1)	/* Occupies memory during execution */
++#define SHF_EXECINSTR	     (1 << 2)	/* Executable */
++#define SHF_MERGE	     (1 << 4)	/* Might be merged */
++#define SHF_STRINGS	     (1 << 5)	/* Contains nul-terminated strings */
++#define SHF_INFO_LINK	     (1 << 6)	/* `sh_info' contains SHT index */
++#define SHF_LINK_ORDER	     (1 << 7)	/* Preserve order after combining */
++#define SHF_OS_NONCONFORMING (1 << 8)	/* Non-standard OS specific handling
++					   required */
++#define SHF_GROUP	     (1 << 9)	/* Section is member of a group.  */
++#define SHF_TLS		     (1 << 10)	/* Section hold thread-local data.  */
++#define SHF_MASKOS	     0x0ff00000	/* OS-specific.  */
++#define SHF_MASKPROC	     0xf0000000	/* Processor-specific */
++#define SHF_ORDERED	     (1 << 30)	/* Special ordering requirement
++					   (Solaris).  */
++#define SHF_EXCLUDE	     (1 << 31)	/* Section is excluded unless
++					   referenced or allocated (Solaris).*/
++
++/* Section group handling.  */
++#define GRP_COMDAT	0x1		/* Mark group as COMDAT.  */
++
++/* Symbol table entry.  */
++
++typedef struct
++{
++  Elf32_Word	st_name;		/* Symbol name (string tbl index) */
++  Elf32_Addr	st_value;		/* Symbol value */
++  Elf32_Word	st_size;		/* Symbol size */
++  unsigned char	st_info;		/* Symbol type and binding */
++  unsigned char	st_other;		/* Symbol visibility */
++  Elf32_Section	st_shndx;		/* Section index */
++} Elf32_Sym;
++
++typedef struct
++{
++  Elf64_Word	st_name;		/* Symbol name (string tbl index) */
++  unsigned char	st_info;		/* Symbol type and binding */
++  unsigned char st_other;		/* Symbol visibility */
++  Elf64_Section	st_shndx;		/* Section index */
++  Elf64_Addr	st_value;		/* Symbol value */
++  Elf64_Xword	st_size;		/* Symbol size */
++} Elf64_Sym;
++
++/* The syminfo section if available contains additional information about
++   every dynamic symbol.  */
++
++typedef struct
++{
++  Elf32_Half si_boundto;		/* Direct bindings, symbol bound to */
++  Elf32_Half si_flags;			/* Per symbol flags */
++} Elf32_Syminfo;
++
++typedef struct
++{
++  Elf64_Half si_boundto;		/* Direct bindings, symbol bound to */
++  Elf64_Half si_flags;			/* Per symbol flags */
++} Elf64_Syminfo;
++
++/* Possible values for si_boundto.  */
++#define SYMINFO_BT_SELF		0xffff	/* Symbol bound to self */
++#define SYMINFO_BT_PARENT	0xfffe	/* Symbol bound to parent */
++#define SYMINFO_BT_LOWRESERVE	0xff00	/* Beginning of reserved entries */
++
++/* Possible bitmasks for si_flags.  */
++#define SYMINFO_FLG_DIRECT	0x0001	/* Direct bound symbol */
++#define SYMINFO_FLG_PASSTHRU	0x0002	/* Pass-thru symbol for translator */
++#define SYMINFO_FLG_COPY	0x0004	/* Symbol is a copy-reloc */
++#define SYMINFO_FLG_LAZYLOAD	0x0008	/* Symbol bound to object to be lazy
++					   loaded */
++/* Syminfo version values.  */
++#define SYMINFO_NONE		0
++#define SYMINFO_CURRENT		1
++#define SYMINFO_NUM		2
++
++
++/* How to extract and insert information held in the st_info field.  */
++
++#define ELF32_ST_BIND(val)		(((unsigned char) (val)) >> 4)
++#define ELF32_ST_TYPE(val)		((val) & 0xf)
++#define ELF32_ST_INFO(bind, type)	(((bind) << 4) + ((type) & 0xf))
++
++/* Both Elf32_Sym and Elf64_Sym use the same one-byte st_info field.  */
++#define ELF64_ST_BIND(val)		ELF32_ST_BIND (val)
++#define ELF64_ST_TYPE(val)		ELF32_ST_TYPE (val)
++#define ELF64_ST_INFO(bind, type)	ELF32_ST_INFO ((bind), (type))
++
++/* Legal values for ST_BIND subfield of st_info (symbol binding).  */
++
++#define STB_LOCAL	0		/* Local symbol */
++#define STB_GLOBAL	1		/* Global symbol */
++#define STB_WEAK	2		/* Weak symbol */
++#define	STB_NUM		3		/* Number of defined types.  */
++#define STB_LOOS	10		/* Start of OS-specific */
++#define STB_GNU_UNIQUE	10		/* Unique symbol.  */
++#define STB_HIOS	12		/* End of OS-specific */
++#define STB_LOPROC	13		/* Start of processor-specific */
++#define STB_HIPROC	15		/* End of processor-specific */
++
++/* Legal values for ST_TYPE subfield of st_info (symbol type).  */
++
++#define STT_NOTYPE	0		/* Symbol type is unspecified */
++#define STT_OBJECT	1		/* Symbol is a data object */
++#define STT_FUNC	2		/* Symbol is a code object */
++#define STT_SECTION	3		/* Symbol associated with a section */
++#define STT_FILE	4		/* Symbol's name is file name */
++#define STT_COMMON	5		/* Symbol is a common data object */
++#define STT_TLS		6		/* Symbol is thread-local data object*/
++#define	STT_NUM		7		/* Number of defined types.  */
++#define STT_LOOS	10		/* Start of OS-specific */
++#define STT_GNU_IFUNC	10		/* Symbol is indirect code object */
++#define STT_HIOS	12		/* End of OS-specific */
++#define STT_LOPROC	13		/* Start of processor-specific */
++#define STT_HIPROC	15		/* End of processor-specific */
++
++
++/* Symbol table indices are found in the hash buckets and chain table
++   of a symbol hash table section.  This special index value indicates
++   the end of a chain, meaning no further symbols are found in that bucket.  */
++
++#define STN_UNDEF	0		/* End of a chain.  */
++
++
++/* How to extract and insert information held in the st_other field.  */
++
++#define ELF32_ST_VISIBILITY(o)	((o) & 0x03)
++
++/* For ELF64 the definitions are the same.  */
++#define ELF64_ST_VISIBILITY(o)	ELF32_ST_VISIBILITY (o)
++
++/* Symbol visibility specification encoded in the st_other field.  */
++#define STV_DEFAULT	0		/* Default symbol visibility rules */
++#define STV_INTERNAL	1		/* Processor specific hidden class */
++#define STV_HIDDEN	2		/* Sym unavailable in other modules */
++#define STV_PROTECTED	3		/* Not preemptible, not exported */
++
++
++/* Relocation table entry without addend (in section of type SHT_REL).  */
++
++typedef struct
++{
++  Elf32_Addr	r_offset;		/* Address */
++  Elf32_Word	r_info;			/* Relocation type and symbol index */
++} Elf32_Rel;
++
++/* I have seen two different definitions of the Elf64_Rel and
++   Elf64_Rela structures, so we'll leave them out until Novell (or
++   whoever) gets their act together.  */
++/* The following, at least, is used on Sparc v9, MIPS, and Alpha.  */
++
++typedef struct
++{
++  Elf64_Addr	r_offset;		/* Address */
++  Elf64_Xword	r_info;			/* Relocation type and symbol index */
++} Elf64_Rel;
++
++/* Relocation table entry with addend (in section of type SHT_RELA).  */
++
++typedef struct
++{
++  Elf32_Addr	r_offset;		/* Address */
++  Elf32_Word	r_info;			/* Relocation type and symbol index */
++  Elf32_Sword	r_addend;		/* Addend */
++} Elf32_Rela;
++
++typedef struct
++{
++  Elf64_Addr	r_offset;		/* Address */
++  Elf64_Xword	r_info;			/* Relocation type and symbol index */
++  Elf64_Sxword	r_addend;		/* Addend */
++} Elf64_Rela;
++
++/* How to extract and insert information held in the r_info field.  */
++
++#define ELF32_R_SYM(val)		((val) >> 8)
++#define ELF32_R_TYPE(val)		((val) & 0xff)
++#define ELF32_R_INFO(sym, type)		(((sym) << 8) + ((type) & 0xff))
++
++#define ELF64_R_SYM(i)			((i) >> 32)
++#define ELF64_R_TYPE(i)			((i) & 0xffffffff)
++#define ELF64_R_INFO(sym,type)		((((Elf64_Xword) (sym)) << 32) + (type))
++
++/* Program segment header.  */
++
++typedef struct
++{
++  Elf32_Word	p_type;			/* Segment type */
++  Elf32_Off	p_offset;		/* Segment file offset */
++  Elf32_Addr	p_vaddr;		/* Segment virtual address */
++  Elf32_Addr	p_paddr;		/* Segment physical address */
++  Elf32_Word	p_filesz;		/* Segment size in file */
++  Elf32_Word	p_memsz;		/* Segment size in memory */
++  Elf32_Word	p_flags;		/* Segment flags */
++  Elf32_Word	p_align;		/* Segment alignment */
++} Elf32_Phdr;
++
++typedef struct
++{
++  Elf64_Word	p_type;			/* Segment type */
++  Elf64_Word	p_flags;		/* Segment flags */
++  Elf64_Off	p_offset;		/* Segment file offset */
++  Elf64_Addr	p_vaddr;		/* Segment virtual address */
++  Elf64_Addr	p_paddr;		/* Segment physical address */
++  Elf64_Xword	p_filesz;		/* Segment size in file */
++  Elf64_Xword	p_memsz;		/* Segment size in memory */
++  Elf64_Xword	p_align;		/* Segment alignment */
++} Elf64_Phdr;
++
++/* Special value for e_phnum.  This indicates that the real number of
++   program headers is too large to fit into e_phnum.  Instead the real
++   value is in the field sh_info of section 0.  */
++
++#define PN_XNUM		0xffff
++
++/* Legal values for p_type (segment type).  */
++
++#define	PT_NULL		0		/* Program header table entry unused */
++#define PT_LOAD		1		/* Loadable program segment */
++#define PT_DYNAMIC	2		/* Dynamic linking information */
++#define PT_INTERP	3		/* Program interpreter */
++#define PT_NOTE		4		/* Auxiliary information */
++#define PT_SHLIB	5		/* Reserved */
++#define PT_PHDR		6		/* Entry for header table itself */
++#define PT_TLS		7		/* Thread-local storage segment */
++#define	PT_NUM		8		/* Number of defined types */
++#define PT_LOOS		0x60000000	/* Start of OS-specific */
++#define PT_GNU_EH_FRAME	0x6474e550	/* GCC .eh_frame_hdr segment */
++#define PT_GNU_STACK	0x6474e551	/* Indicates stack executability */
++#define PT_GNU_RELRO	0x6474e552	/* Read-only after relocation */
++#define PT_LOSUNW	0x6ffffffa
++#define PT_SUNWBSS	0x6ffffffa	/* Sun Specific segment */
++#define PT_SUNWSTACK	0x6ffffffb	/* Stack segment */
++#define PT_HISUNW	0x6fffffff
++#define PT_HIOS		0x6fffffff	/* End of OS-specific */
++#define PT_LOPROC	0x70000000	/* Start of processor-specific */
++#define PT_HIPROC	0x7fffffff	/* End of processor-specific */
++
++/* Legal values for p_flags (segment flags).  */
++
++#define PF_X		(1 << 0)	/* Segment is executable */
++#define PF_W		(1 << 1)	/* Segment is writable */
++#define PF_R		(1 << 2)	/* Segment is readable */
++#define PF_MASKOS	0x0ff00000	/* OS-specific */
++#define PF_MASKPROC	0xf0000000	/* Processor-specific */
++
++/* Legal values for note segment descriptor types for core files. */
++
++#define NT_PRSTATUS	1		/* Contains copy of prstatus struct */
++#define NT_FPREGSET	2		/* Contains copy of fpregset struct */
++#define NT_PRPSINFO	3		/* Contains copy of prpsinfo struct */
++#define NT_PRXREG	4		/* Contains copy of prxregset struct */
++#define NT_TASKSTRUCT	4		/* Contains copy of task structure */
++#define NT_PLATFORM	5		/* String from sysinfo(SI_PLATFORM) */
++#define NT_AUXV		6		/* Contains copy of auxv array */
++#define NT_GWINDOWS	7		/* Contains copy of gwindows struct */
++#define NT_ASRS		8		/* Contains copy of asrset struct */
++#define NT_PSTATUS	10		/* Contains copy of pstatus struct */
++#define NT_PSINFO	13		/* Contains copy of psinfo struct */
++#define NT_PRCRED	14		/* Contains copy of prcred struct */
++#define NT_UTSNAME	15		/* Contains copy of utsname struct */
++#define NT_LWPSTATUS	16		/* Contains copy of lwpstatus struct */
++#define NT_LWPSINFO	17		/* Contains copy of lwpinfo struct */
++#define NT_PRFPXREG	20		/* Contains copy of fprxregset struct */
++#define NT_PRXFPREG	0x46e62b7f	/* Contains copy of user_fxsr_struct */
++#define NT_PPC_VMX	0x100		/* PowerPC Altivec/VMX registers */
++#define NT_PPC_SPE	0x101		/* PowerPC SPE/EVR registers */
++#define NT_PPC_VSX	0x102		/* PowerPC VSX registers */
++#define NT_386_TLS	0x200		/* i386 TLS slots (struct user_desc) */
++#define NT_386_IOPERM	0x201		/* x86 io permission bitmap (1=deny) */
++#define NT_X86_XSTATE	0x202		/* x86 extended state using xsave */
++
++/* Legal values for the note segment descriptor types for object files.  */
++
++#define NT_VERSION	1		/* Contains a version string.  */
++
++
++/* Dynamic section entry.  */
++
++typedef struct
++{
++  Elf32_Sword	d_tag;			/* Dynamic entry type */
++  union
++    {
++      Elf32_Word d_val;			/* Integer value */
++      Elf32_Addr d_ptr;			/* Address value */
++    } d_un;
++} Elf32_Dyn;
++
++typedef struct
++{
++  Elf64_Sxword	d_tag;			/* Dynamic entry type */
++  union
++    {
++      Elf64_Xword d_val;		/* Integer value */
++      Elf64_Addr d_ptr;			/* Address value */
++    } d_un;
++} Elf64_Dyn;
++
++/* Legal values for d_tag (dynamic entry type).  */
++
++#define DT_NULL		0		/* Marks end of dynamic section */
++#define DT_NEEDED	1		/* Name of needed library */
++#define DT_PLTRELSZ	2		/* Size in bytes of PLT relocs */
++#define DT_PLTGOT	3		/* Processor defined value */
++#define DT_HASH		4		/* Address of symbol hash table */
++#define DT_STRTAB	5		/* Address of string table */
++#define DT_SYMTAB	6		/* Address of symbol table */
++#define DT_RELA		7		/* Address of Rela relocs */
++#define DT_RELASZ	8		/* Total size of Rela relocs */
++#define DT_RELAENT	9		/* Size of one Rela reloc */
++#define DT_STRSZ	10		/* Size of string table */
++#define DT_SYMENT	11		/* Size of one symbol table entry */
++#define DT_INIT		12		/* Address of init function */
++#define DT_FINI		13		/* Address of termination function */
++#define DT_SONAME	14		/* Name of shared object */
++#define DT_RPATH	15		/* Library search path (deprecated) */
++#define DT_SYMBOLIC	16		/* Start symbol search here */
++#define DT_REL		17		/* Address of Rel relocs */
++#define DT_RELSZ	18		/* Total size of Rel relocs */
++#define DT_RELENT	19		/* Size of one Rel reloc */
++#define DT_PLTREL	20		/* Type of reloc in PLT */
++#define DT_DEBUG	21		/* For debugging; unspecified */
++#define DT_TEXTREL	22		/* Reloc might modify .text */
++#define DT_JMPREL	23		/* Address of PLT relocs */
++#define	DT_BIND_NOW	24		/* Process relocations of object */
++#define	DT_INIT_ARRAY	25		/* Array with addresses of init fct */
++#define	DT_FINI_ARRAY	26		/* Array with addresses of fini fct */
++#define	DT_INIT_ARRAYSZ	27		/* Size in bytes of DT_INIT_ARRAY */
++#define	DT_FINI_ARRAYSZ	28		/* Size in bytes of DT_FINI_ARRAY */
++#define DT_RUNPATH	29		/* Library search path */
++#define DT_FLAGS	30		/* Flags for the object being loaded */
++#define DT_ENCODING	32		/* Start of encoded range */
++#define DT_PREINIT_ARRAY 32		/* Array with addresses of preinit fct*/
++#define DT_PREINIT_ARRAYSZ 33		/* size in bytes of DT_PREINIT_ARRAY */
++#define	DT_NUM		34		/* Number used */
++#define DT_LOOS		0x6000000d	/* Start of OS-specific */
++#define DT_HIOS		0x6ffff000	/* End of OS-specific */
++#define DT_LOPROC	0x70000000	/* Start of processor-specific */
++#define DT_HIPROC	0x7fffffff	/* End of processor-specific */
++#define	DT_PROCNUM	DT_MIPS_NUM	/* Most used by any processor */
++
++/* DT_* entries which fall between DT_VALRNGHI & DT_VALRNGLO use the
++   Dyn.d_un.d_val field of the Elf*_Dyn structure.  This follows Sun's
++   approach.  */
++#define DT_VALRNGLO	0x6ffffd00
++#define DT_GNU_PRELINKED 0x6ffffdf5	/* Prelinking timestamp */
++#define DT_GNU_CONFLICTSZ 0x6ffffdf6	/* Size of conflict section */
++#define DT_GNU_LIBLISTSZ 0x6ffffdf7	/* Size of library list */
++#define DT_CHECKSUM	0x6ffffdf8
++#define DT_PLTPADSZ	0x6ffffdf9
++#define DT_MOVEENT	0x6ffffdfa
++#define DT_MOVESZ	0x6ffffdfb
++#define DT_FEATURE_1	0x6ffffdfc	/* Feature selection (DTF_*).  */
++#define DT_POSFLAG_1	0x6ffffdfd	/* Flags for DT_* entries, effecting
++					   the following DT_* entry.  */
++#define DT_SYMINSZ	0x6ffffdfe	/* Size of syminfo table (in bytes) */
++#define DT_SYMINENT	0x6ffffdff	/* Entry size of syminfo */
++#define DT_VALRNGHI	0x6ffffdff
++#define DT_VALTAGIDX(tag)	(DT_VALRNGHI - (tag))	/* Reverse order! */
++#define DT_VALNUM 12
++
++/* DT_* entries which fall between DT_ADDRRNGHI & DT_ADDRRNGLO use the
++   Dyn.d_un.d_ptr field of the Elf*_Dyn structure.
++
++   If any adjustment is made to the ELF object after it has been
++   built these entries will need to be adjusted.  */
++#define DT_ADDRRNGLO	0x6ffffe00
++#define DT_GNU_HASH	0x6ffffef5	/* GNU-style hash table.  */
++#define DT_TLSDESC_PLT	0x6ffffef6
++#define DT_TLSDESC_GOT	0x6ffffef7
++#define DT_GNU_CONFLICT	0x6ffffef8	/* Start of conflict section */
++#define DT_GNU_LIBLIST	0x6ffffef9	/* Library list */
++#define DT_CONFIG	0x6ffffefa	/* Configuration information.  */
++#define DT_DEPAUDIT	0x6ffffefb	/* Dependency auditing.  */
++#define DT_AUDIT	0x6ffffefc	/* Object auditing.  */
++#define	DT_PLTPAD	0x6ffffefd	/* PLT padding.  */
++#define	DT_MOVETAB	0x6ffffefe	/* Move table.  */
++#define DT_SYMINFO	0x6ffffeff	/* Syminfo table.  */
++#define DT_ADDRRNGHI	0x6ffffeff
++#define DT_ADDRTAGIDX(tag)	(DT_ADDRRNGHI - (tag))	/* Reverse order! */
++#define DT_ADDRNUM 11
++
++/* The versioning entry types.  The next are defined as part of the
++   GNU extension.  */
++#define DT_VERSYM	0x6ffffff0
++
++#define DT_RELACOUNT	0x6ffffff9
++#define DT_RELCOUNT	0x6ffffffa
++
++/* These were chosen by Sun.  */
++#define DT_FLAGS_1	0x6ffffffb	/* State flags, see DF_1_* below.  */
++#define	DT_VERDEF	0x6ffffffc	/* Address of version definition
++					   table */
++#define	DT_VERDEFNUM	0x6ffffffd	/* Number of version definitions */
++#define	DT_VERNEED	0x6ffffffe	/* Address of table with needed
++					   versions */
++#define	DT_VERNEEDNUM	0x6fffffff	/* Number of needed versions */
++#define DT_VERSIONTAGIDX(tag)	(DT_VERNEEDNUM - (tag))	/* Reverse order! */
++#define DT_VERSIONTAGNUM 16
++
++/* Sun added these machine-independent extensions in the "processor-specific"
++   range.  Be compatible.  */
++#define DT_AUXILIARY    0x7ffffffd      /* Shared object to load before self */
++#define DT_FILTER       0x7fffffff      /* Shared object to get values from */
++#define DT_EXTRATAGIDX(tag)	((Elf32_Word)-((Elf32_Sword) (tag) <<1>>1)-1)
++#define DT_EXTRANUM	3
++
++/* Values of `d_un.d_val' in the DT_FLAGS entry.  */
++#define DF_ORIGIN	0x00000001	/* Object may use DF_ORIGIN */
++#define DF_SYMBOLIC	0x00000002	/* Symbol resolutions starts here */
++#define DF_TEXTREL	0x00000004	/* Object contains text relocations */
++#define DF_BIND_NOW	0x00000008	/* No lazy binding for this object */
++#define DF_STATIC_TLS	0x00000010	/* Module uses the static TLS model */
++
++/* State flags selectable in the `d_un.d_val' element of the DT_FLAGS_1
++   entry in the dynamic section.  */
++#define DF_1_NOW	0x00000001	/* Set RTLD_NOW for this object.  */
++#define DF_1_GLOBAL	0x00000002	/* Set RTLD_GLOBAL for this object.  */
++#define DF_1_GROUP	0x00000004	/* Set RTLD_GROUP for this object.  */
++#define DF_1_NODELETE	0x00000008	/* Set RTLD_NODELETE for this object.*/
++#define DF_1_LOADFLTR	0x00000010	/* Trigger filtee loading at runtime.*/
++#define DF_1_INITFIRST	0x00000020	/* Set RTLD_INITFIRST for this object*/
++#define DF_1_NOOPEN	0x00000040	/* Set RTLD_NOOPEN for this object.  */
++#define DF_1_ORIGIN	0x00000080	/* $ORIGIN must be handled.  */
++#define DF_1_DIRECT	0x00000100	/* Direct binding enabled.  */
++#define DF_1_TRANS	0x00000200
++#define DF_1_INTERPOSE	0x00000400	/* Object is used to interpose.  */
++#define DF_1_NODEFLIB	0x00000800	/* Ignore default lib search path.  */
++#define DF_1_NODUMP	0x00001000	/* Object can't be dldump'ed.  */
++#define DF_1_CONFALT	0x00002000	/* Configuration alternative created.*/
++#define DF_1_ENDFILTEE	0x00004000	/* Filtee terminates filters search. */
++#define	DF_1_DISPRELDNE	0x00008000	/* Disp reloc applied at build time. */
++#define	DF_1_DISPRELPND	0x00010000	/* Disp reloc applied at run-time.  */
++
++/* Flags for the feature selection in DT_FEATURE_1.  */
++#define DTF_1_PARINIT	0x00000001
++#define DTF_1_CONFEXP	0x00000002
++
++/* Flags in the DT_POSFLAG_1 entry effecting only the next DT_* entry.  */
++#define DF_P1_LAZYLOAD	0x00000001	/* Lazyload following object.  */
++#define DF_P1_GROUPPERM	0x00000002	/* Symbols from next object are not
++					   generally available.  */
++
++/* Version definition sections.  */
++
++typedef struct
++{
++  Elf32_Half	vd_version;		/* Version revision */
++  Elf32_Half	vd_flags;		/* Version information */
++  Elf32_Half	vd_ndx;			/* Version Index */
++  Elf32_Half	vd_cnt;			/* Number of associated aux entries */
++  Elf32_Word	vd_hash;		/* Version name hash value */
++  Elf32_Word	vd_aux;			/* Offset in bytes to verdaux array */
++  Elf32_Word	vd_next;		/* Offset in bytes to next verdef
++					   entry */
++} Elf32_Verdef;
++
++typedef struct
++{
++  Elf64_Half	vd_version;		/* Version revision */
++  Elf64_Half	vd_flags;		/* Version information */
++  Elf64_Half	vd_ndx;			/* Version Index */
++  Elf64_Half	vd_cnt;			/* Number of associated aux entries */
++  Elf64_Word	vd_hash;		/* Version name hash value */
++  Elf64_Word	vd_aux;			/* Offset in bytes to verdaux array */
++  Elf64_Word	vd_next;		/* Offset in bytes to next verdef
++					   entry */
++} Elf64_Verdef;
++
++
++/* Legal values for vd_version (version revision).  */
++#define VER_DEF_NONE	0		/* No version */
++#define VER_DEF_CURRENT	1		/* Current version */
++#define VER_DEF_NUM	2		/* Given version number */
++
++/* Legal values for vd_flags (version information flags).  */
++#define VER_FLG_BASE	0x1		/* Version definition of file itself */
++#define VER_FLG_WEAK	0x2		/* Weak version identifier */
++
++/* Versym symbol index values.  */
++#define	VER_NDX_LOCAL		0	/* Symbol is local.  */
++#define	VER_NDX_GLOBAL		1	/* Symbol is global.  */
++#define	VER_NDX_LORESERVE	0xff00	/* Beginning of reserved entries.  */
++#define	VER_NDX_ELIMINATE	0xff01	/* Symbol is to be eliminated.  */
++
++/* Auxialiary version information.  */
++
++typedef struct
++{
++  Elf32_Word	vda_name;		/* Version or dependency names */
++  Elf32_Word	vda_next;		/* Offset in bytes to next verdaux
++					   entry */
++} Elf32_Verdaux;
++
++typedef struct
++{
++  Elf64_Word	vda_name;		/* Version or dependency names */
++  Elf64_Word	vda_next;		/* Offset in bytes to next verdaux
++					   entry */
++} Elf64_Verdaux;
++
++
++/* Version dependency section.  */
++
++typedef struct
++{
++  Elf32_Half	vn_version;		/* Version of structure */
++  Elf32_Half	vn_cnt;			/* Number of associated aux entries */
++  Elf32_Word	vn_file;		/* Offset of filename for this
++					   dependency */
++  Elf32_Word	vn_aux;			/* Offset in bytes to vernaux array */
++  Elf32_Word	vn_next;		/* Offset in bytes to next verneed
++					   entry */
++} Elf32_Verneed;
++
++typedef struct
++{
++  Elf64_Half	vn_version;		/* Version of structure */
++  Elf64_Half	vn_cnt;			/* Number of associated aux entries */
++  Elf64_Word	vn_file;		/* Offset of filename for this
++					   dependency */
++  Elf64_Word	vn_aux;			/* Offset in bytes to vernaux array */
++  Elf64_Word	vn_next;		/* Offset in bytes to next verneed
++					   entry */
++} Elf64_Verneed;
++
++
++/* Legal values for vn_version (version revision).  */
++#define VER_NEED_NONE	 0		/* No version */
++#define VER_NEED_CURRENT 1		/* Current version */
++#define VER_NEED_NUM	 2		/* Given version number */
++
++/* Auxiliary needed version information.  */
++
++typedef struct
++{
++  Elf32_Word	vna_hash;		/* Hash value of dependency name */
++  Elf32_Half	vna_flags;		/* Dependency specific information */
++  Elf32_Half	vna_other;		/* Unused */
++  Elf32_Word	vna_name;		/* Dependency name string offset */
++  Elf32_Word	vna_next;		/* Offset in bytes to next vernaux
++					   entry */
++} Elf32_Vernaux;
++
++typedef struct
++{
++  Elf64_Word	vna_hash;		/* Hash value of dependency name */
++  Elf64_Half	vna_flags;		/* Dependency specific information */
++  Elf64_Half	vna_other;		/* Unused */
++  Elf64_Word	vna_name;		/* Dependency name string offset */
++  Elf64_Word	vna_next;		/* Offset in bytes to next vernaux
++					   entry */
++} Elf64_Vernaux;
++
++
++/* Legal values for vna_flags.  */
++#define VER_FLG_WEAK	0x2		/* Weak version identifier */
++
++
++/* Auxiliary vector.  */
++
++/* This vector is normally only used by the program interpreter.  The
++   usual definition in an ABI supplement uses the name auxv_t.  The
++   vector is not usually defined in a standard <elf.h> file, but it
++   can't hurt.  We rename it to avoid conflicts.  The sizes of these
++   types are an arrangement between the exec server and the program
++   interpreter, so we don't fully specify them here.  */
++
++typedef struct
++{
++  uint32_t a_type;		/* Entry type */
++  union
++    {
++      uint32_t a_val;		/* Integer value */
++      /* We use to have pointer elements added here.  We cannot do that,
++	 though, since it does not work when using 32-bit definitions
++	 on 64-bit platforms and vice versa.  */
++    } a_un;
++} Elf32_auxv_t;
++
++typedef struct
++{
++  uint64_t a_type;		/* Entry type */
++  union
++    {
++      uint64_t a_val;		/* Integer value */
++      /* We use to have pointer elements added here.  We cannot do that,
++	 though, since it does not work when using 32-bit definitions
++	 on 64-bit platforms and vice versa.  */
++    } a_un;
++} Elf64_auxv_t;
++
++/* Legal values for a_type (entry type).  */
++
++#define AT_NULL		0		/* End of vector */
++#define AT_IGNORE	1		/* Entry should be ignored */
++#define AT_EXECFD	2		/* File descriptor of program */
++#define AT_PHDR		3		/* Program headers for program */
++#define AT_PHENT	4		/* Size of program header entry */
++#define AT_PHNUM	5		/* Number of program headers */
++#define AT_PAGESZ	6		/* System page size */
++#define AT_BASE		7		/* Base address of interpreter */
++#define AT_FLAGS	8		/* Flags */
++#define AT_ENTRY	9		/* Entry point of program */
++#define AT_NOTELF	10		/* Program is not ELF */
++#define AT_UID		11		/* Real uid */
++#define AT_EUID		12		/* Effective uid */
++#define AT_GID		13		/* Real gid */
++#define AT_EGID		14		/* Effective gid */
++#define AT_CLKTCK	17		/* Frequency of times() */
++
++/* Some more special a_type values describing the hardware.  */
++#define AT_PLATFORM	15		/* String identifying platform.  */
++#define AT_HWCAP	16		/* Machine dependent hints about
++					   processor capabilities.  */
++
++/* This entry gives some information about the FPU initialization
++   performed by the kernel.  */
++#define AT_FPUCW	18		/* Used FPU control word.  */
++
++/* Cache block sizes.  */
++#define AT_DCACHEBSIZE	19		/* Data cache block size.  */
++#define AT_ICACHEBSIZE	20		/* Instruction cache block size.  */
++#define AT_UCACHEBSIZE	21		/* Unified cache block size.  */
++
++/* A special ignored value for PPC, used by the kernel to control the
++   interpretation of the AUXV. Must be > 16.  */
++#define AT_IGNOREPPC	22		/* Entry should be ignored.  */
++
++#define	AT_SECURE	23		/* Boolean, was exec setuid-like?  */
++
++#define AT_BASE_PLATFORM 24		/* String identifying real platforms.*/
++
++#define AT_RANDOM	25		/* Address of 16 random bytes.  */
++
++#define AT_EXECFN	31		/* Filename of executable.  */
++
++/* Pointer to the global system page used for system calls and other
++   nice things.  */
++#define AT_SYSINFO	32
++#define AT_SYSINFO_EHDR	33
++
++/* Shapes of the caches.  Bits 0-3 contains associativity; bits 4-7 contains
++   log2 of line size; mask those to get cache size.  */
++#define AT_L1I_CACHESHAPE	34
++#define AT_L1D_CACHESHAPE	35
++#define AT_L2_CACHESHAPE	36
++#define AT_L3_CACHESHAPE	37
++
++/* Note section contents.  Each entry in the note section begins with
++   a header of a fixed form.  */
++
++typedef struct
++{
++  Elf32_Word n_namesz;			/* Length of the note's name.  */
++  Elf32_Word n_descsz;			/* Length of the note's descriptor.  */
++  Elf32_Word n_type;			/* Type of the note.  */
++} Elf32_Nhdr;
++
++typedef struct
++{
++  Elf64_Word n_namesz;			/* Length of the note's name.  */
++  Elf64_Word n_descsz;			/* Length of the note's descriptor.  */
++  Elf64_Word n_type;			/* Type of the note.  */
++} Elf64_Nhdr;
++
++/* Known names of notes.  */
++
++/* Solaris entries in the note section have this name.  */
++#define ELF_NOTE_SOLARIS	"SUNW Solaris"
++
++/* Note entries for GNU systems have this name.  */
++#define ELF_NOTE_GNU		"GNU"
++
++
++/* Defined types of notes for Solaris.  */
++
++/* Value of descriptor (one word) is desired pagesize for the binary.  */
++#define ELF_NOTE_PAGESIZE_HINT	1
++
++
++/* Defined note types for GNU systems.  */
++
++/* ABI information.  The descriptor consists of words:
++   word 0: OS descriptor
++   word 1: major version of the ABI
++   word 2: minor version of the ABI
++   word 3: subminor version of the ABI
++*/
++#define NT_GNU_ABI_TAG	1
++#define ELF_NOTE_ABI	NT_GNU_ABI_TAG /* Old name.  */
++
++/* Known OSes.  These values can appear in word 0 of an
++   NT_GNU_ABI_TAG note section entry.  */
++#define ELF_NOTE_OS_LINUX	0
++#define ELF_NOTE_OS_GNU		1
++#define ELF_NOTE_OS_SOLARIS2	2
++#define ELF_NOTE_OS_FREEBSD	3
++
++/* Synthetic hwcap information.  The descriptor begins with two words:
++   word 0: number of entries
++   word 1: bitmask of enabled entries
++   Then follow variable-length entries, one byte followed by a
++   '\0'-terminated hwcap name string.  The byte gives the bit
++   number to test if enabled, (1U << bit) & bitmask.  */
++#define NT_GNU_HWCAP	2
++
++/* Build ID bits as generated by ld --build-id.
++   The descriptor consists of any nonzero number of bytes.  */
++#define NT_GNU_BUILD_ID	3
++
++/* Version note generated by GNU gold containing a version string.  */
++#define NT_GNU_GOLD_VERSION	4
++
++
++/* Move records.  */
++typedef struct
++{
++  Elf32_Xword m_value;		/* Symbol value.  */
++  Elf32_Word m_info;		/* Size and index.  */
++  Elf32_Word m_poffset;		/* Symbol offset.  */
++  Elf32_Half m_repeat;		/* Repeat count.  */
++  Elf32_Half m_stride;		/* Stride info.  */
++} Elf32_Move;
++
++typedef struct
++{
++  Elf64_Xword m_value;		/* Symbol value.  */
++  Elf64_Xword m_info;		/* Size and index.  */
++  Elf64_Xword m_poffset;	/* Symbol offset.  */
++  Elf64_Half m_repeat;		/* Repeat count.  */
++  Elf64_Half m_stride;		/* Stride info.  */
++} Elf64_Move;
++
++/* Macro to construct move records.  */
++#define ELF32_M_SYM(info)	((info) >> 8)
++#define ELF32_M_SIZE(info)	((unsigned char) (info))
++#define ELF32_M_INFO(sym, size)	(((sym) << 8) + (unsigned char) (size))
++
++#define ELF64_M_SYM(info)	ELF32_M_SYM (info)
++#define ELF64_M_SIZE(info)	ELF32_M_SIZE (info)
++#define ELF64_M_INFO(sym, size)	ELF32_M_INFO (sym, size)
++
++
++/* Motorola 68k specific definitions.  */
++
++/* Values for Elf32_Ehdr.e_flags.  */
++#define EF_CPU32	0x00810000
++
++/* m68k relocs.  */
++
++#define R_68K_NONE	0		/* No reloc */
++#define R_68K_32	1		/* Direct 32 bit  */
++#define R_68K_16	2		/* Direct 16 bit  */
++#define R_68K_8		3		/* Direct 8 bit  */
++#define R_68K_PC32	4		/* PC relative 32 bit */
++#define R_68K_PC16	5		/* PC relative 16 bit */
++#define R_68K_PC8	6		/* PC relative 8 bit */
++#define R_68K_GOT32	7		/* 32 bit PC relative GOT entry */
++#define R_68K_GOT16	8		/* 16 bit PC relative GOT entry */
++#define R_68K_GOT8	9		/* 8 bit PC relative GOT entry */
++#define R_68K_GOT32O	10		/* 32 bit GOT offset */
++#define R_68K_GOT16O	11		/* 16 bit GOT offset */
++#define R_68K_GOT8O	12		/* 8 bit GOT offset */
++#define R_68K_PLT32	13		/* 32 bit PC relative PLT address */
++#define R_68K_PLT16	14		/* 16 bit PC relative PLT address */
++#define R_68K_PLT8	15		/* 8 bit PC relative PLT address */
++#define R_68K_PLT32O	16		/* 32 bit PLT offset */
++#define R_68K_PLT16O	17		/* 16 bit PLT offset */
++#define R_68K_PLT8O	18		/* 8 bit PLT offset */
++#define R_68K_COPY	19		/* Copy symbol at runtime */
++#define R_68K_GLOB_DAT	20		/* Create GOT entry */
++#define R_68K_JMP_SLOT	21		/* Create PLT entry */
++#define R_68K_RELATIVE	22		/* Adjust by program base */
++#define R_68K_TLS_GD32      25          /* 32 bit GOT offset for GD */
++#define R_68K_TLS_GD16      26          /* 16 bit GOT offset for GD */
++#define R_68K_TLS_GD8       27          /* 8 bit GOT offset for GD */
++#define R_68K_TLS_LDM32     28          /* 32 bit GOT offset for LDM */
++#define R_68K_TLS_LDM16     29          /* 16 bit GOT offset for LDM */
++#define R_68K_TLS_LDM8      30          /* 8 bit GOT offset for LDM */
++#define R_68K_TLS_LDO32     31          /* 32 bit module-relative offset */
++#define R_68K_TLS_LDO16     32          /* 16 bit module-relative offset */
++#define R_68K_TLS_LDO8      33          /* 8 bit module-relative offset */
++#define R_68K_TLS_IE32      34          /* 32 bit GOT offset for IE */
++#define R_68K_TLS_IE16      35          /* 16 bit GOT offset for IE */
++#define R_68K_TLS_IE8       36          /* 8 bit GOT offset for IE */
++#define R_68K_TLS_LE32      37          /* 32 bit offset relative to
++					   static TLS block */
++#define R_68K_TLS_LE16      38          /* 16 bit offset relative to
++					   static TLS block */
++#define R_68K_TLS_LE8       39          /* 8 bit offset relative to
++					   static TLS block */
++#define R_68K_TLS_DTPMOD32  40          /* 32 bit module number */
++#define R_68K_TLS_DTPREL32  41          /* 32 bit module-relative offset */
++#define R_68K_TLS_TPREL32   42          /* 32 bit TP-relative offset */
++/* Keep this the last entry.  */
++#define R_68K_NUM	43
++
++/* Intel 80386 specific definitions.  */
++
++/* i386 relocs.  */
++
++#define R_386_NONE	   0		/* No reloc */
++#define R_386_32	   1		/* Direct 32 bit  */
++#define R_386_PC32	   2		/* PC relative 32 bit */
++#define R_386_GOT32	   3		/* 32 bit GOT entry */
++#define R_386_PLT32	   4		/* 32 bit PLT address */
++#define R_386_COPY	   5		/* Copy symbol at runtime */
++#define R_386_GLOB_DAT	   6		/* Create GOT entry */
++#define R_386_JMP_SLOT	   7		/* Create PLT entry */
++#define R_386_RELATIVE	   8		/* Adjust by program base */
++#define R_386_GOTOFF	   9		/* 32 bit offset to GOT */
++#define R_386_GOTPC	   10		/* 32 bit PC relative offset to GOT */
++#define R_386_32PLT	   11
++#define R_386_TLS_TPOFF	   14		/* Offset in static TLS block */
++#define R_386_TLS_IE	   15		/* Address of GOT entry for static TLS
++					   block offset */
++#define R_386_TLS_GOTIE	   16		/* GOT entry for static TLS block
++					   offset */
++#define R_386_TLS_LE	   17		/* Offset relative to static TLS
++					   block */
++#define R_386_TLS_GD	   18		/* Direct 32 bit for GNU version of
++					   general dynamic thread local data */
++#define R_386_TLS_LDM	   19		/* Direct 32 bit for GNU version of
++					   local dynamic thread local data
++					   in LE code */
++#define R_386_16	   20
++#define R_386_PC16	   21
++#define R_386_8		   22
++#define R_386_PC8	   23
++#define R_386_TLS_GD_32	   24		/* Direct 32 bit for general dynamic
++					   thread local data */
++#define R_386_TLS_GD_PUSH  25		/* Tag for pushl in GD TLS code */
++#define R_386_TLS_GD_CALL  26		/* Relocation for call to
++					   __tls_get_addr() */
++#define R_386_TLS_GD_POP   27		/* Tag for popl in GD TLS code */
++#define R_386_TLS_LDM_32   28		/* Direct 32 bit for local dynamic
++					   thread local data in LE code */
++#define R_386_TLS_LDM_PUSH 29		/* Tag for pushl in LDM TLS code */
++#define R_386_TLS_LDM_CALL 30		/* Relocation for call to
++					   __tls_get_addr() in LDM code */
++#define R_386_TLS_LDM_POP  31		/* Tag for popl in LDM TLS code */
++#define R_386_TLS_LDO_32   32		/* Offset relative to TLS block */
++#define R_386_TLS_IE_32	   33		/* GOT entry for negated static TLS
++					   block offset */
++#define R_386_TLS_LE_32	   34		/* Negated offset relative to static
++					   TLS block */
++#define R_386_TLS_DTPMOD32 35		/* ID of module containing symbol */
++#define R_386_TLS_DTPOFF32 36		/* Offset in TLS block */
++#define R_386_TLS_TPOFF32  37		/* Negated offset in static TLS block */
++/* 38? */
++#define R_386_TLS_GOTDESC  39		/* GOT offset for TLS descriptor.  */
++#define R_386_TLS_DESC_CALL 40		/* Marker of call through TLS
++					   descriptor for
++					   relaxation.  */
++#define R_386_TLS_DESC     41		/* TLS descriptor containing
++					   pointer to code and to
++					   argument, returning the TLS
++					   offset for the symbol.  */
++#define R_386_IRELATIVE	   42		/* Adjust indirectly by program base */
++/* Keep this the last entry.  */
++#define R_386_NUM	   43
++
++/* SUN SPARC specific definitions.  */
++
++/* Legal values for ST_TYPE subfield of st_info (symbol type).  */
++
++#define STT_SPARC_REGISTER	13	/* Global register reserved to app. */
++
++/* Values for Elf64_Ehdr.e_flags.  */
++
++#define EF_SPARCV9_MM		3
++#define EF_SPARCV9_TSO		0
++#define EF_SPARCV9_PSO		1
++#define EF_SPARCV9_RMO		2
++#define EF_SPARC_LEDATA		0x800000 /* little endian data */
++#define EF_SPARC_EXT_MASK	0xFFFF00
++#define EF_SPARC_32PLUS		0x000100 /* generic V8+ features */
++#define EF_SPARC_SUN_US1	0x000200 /* Sun UltraSPARC1 extensions */
++#define EF_SPARC_HAL_R1		0x000400 /* HAL R1 extensions */
++#define EF_SPARC_SUN_US3	0x000800 /* Sun UltraSPARCIII extensions */
++
++/* SPARC relocs.  */
++
++#define R_SPARC_NONE		0	/* No reloc */
++#define R_SPARC_8		1	/* Direct 8 bit */
++#define R_SPARC_16		2	/* Direct 16 bit */
++#define R_SPARC_32		3	/* Direct 32 bit */
++#define R_SPARC_DISP8		4	/* PC relative 8 bit */
++#define R_SPARC_DISP16		5	/* PC relative 16 bit */
++#define R_SPARC_DISP32		6	/* PC relative 32 bit */
++#define R_SPARC_WDISP30		7	/* PC relative 30 bit shifted */
++#define R_SPARC_WDISP22		8	/* PC relative 22 bit shifted */
++#define R_SPARC_HI22		9	/* High 22 bit */
++#define R_SPARC_22		10	/* Direct 22 bit */
++#define R_SPARC_13		11	/* Direct 13 bit */
++#define R_SPARC_LO10		12	/* Truncated 10 bit */
++#define R_SPARC_GOT10		13	/* Truncated 10 bit GOT entry */
++#define R_SPARC_GOT13		14	/* 13 bit GOT entry */
++#define R_SPARC_GOT22		15	/* 22 bit GOT entry shifted */
++#define R_SPARC_PC10		16	/* PC relative 10 bit truncated */
++#define R_SPARC_PC22		17	/* PC relative 22 bit shifted */
++#define R_SPARC_WPLT30		18	/* 30 bit PC relative PLT address */
++#define R_SPARC_COPY		19	/* Copy symbol at runtime */
++#define R_SPARC_GLOB_DAT	20	/* Create GOT entry */
++#define R_SPARC_JMP_SLOT	21	/* Create PLT entry */
++#define R_SPARC_RELATIVE	22	/* Adjust by program base */
++#define R_SPARC_UA32		23	/* Direct 32 bit unaligned */
++
++/* Additional Sparc64 relocs.  */
++
++#define R_SPARC_PLT32		24	/* Direct 32 bit ref to PLT entry */
++#define R_SPARC_HIPLT22		25	/* High 22 bit PLT entry */
++#define R_SPARC_LOPLT10		26	/* Truncated 10 bit PLT entry */
++#define R_SPARC_PCPLT32		27	/* PC rel 32 bit ref to PLT entry */
++#define R_SPARC_PCPLT22		28	/* PC rel high 22 bit PLT entry */
++#define R_SPARC_PCPLT10		29	/* PC rel trunc 10 bit PLT entry */
++#define R_SPARC_10		30	/* Direct 10 bit */
++#define R_SPARC_11		31	/* Direct 11 bit */
++#define R_SPARC_64		32	/* Direct 64 bit */
++#define R_SPARC_OLO10		33	/* 10bit with secondary 13bit addend */
++#define R_SPARC_HH22		34	/* Top 22 bits of direct 64 bit */
++#define R_SPARC_HM10		35	/* High middle 10 bits of ... */
++#define R_SPARC_LM22		36	/* Low middle 22 bits of ... */
++#define R_SPARC_PC_HH22		37	/* Top 22 bits of pc rel 64 bit */
++#define R_SPARC_PC_HM10		38	/* High middle 10 bit of ... */
++#define R_SPARC_PC_LM22		39	/* Low miggle 22 bits of ... */
++#define R_SPARC_WDISP16		40	/* PC relative 16 bit shifted */
++#define R_SPARC_WDISP19		41	/* PC relative 19 bit shifted */
++#define R_SPARC_GLOB_JMP	42	/* was part of v9 ABI but was removed */
++#define R_SPARC_7		43	/* Direct 7 bit */
++#define R_SPARC_5		44	/* Direct 5 bit */
++#define R_SPARC_6		45	/* Direct 6 bit */
++#define R_SPARC_DISP64		46	/* PC relative 64 bit */
++#define R_SPARC_PLT64		47	/* Direct 64 bit ref to PLT entry */
++#define R_SPARC_HIX22		48	/* High 22 bit complemented */
++#define R_SPARC_LOX10		49	/* Truncated 11 bit complemented */
++#define R_SPARC_H44		50	/* Direct high 12 of 44 bit */
++#define R_SPARC_M44		51	/* Direct mid 22 of 44 bit */
++#define R_SPARC_L44		52	/* Direct low 10 of 44 bit */
++#define R_SPARC_REGISTER	53	/* Global register usage */
++#define R_SPARC_UA64		54	/* Direct 64 bit unaligned */
++#define R_SPARC_UA16		55	/* Direct 16 bit unaligned */
++#define R_SPARC_TLS_GD_HI22	56
++#define R_SPARC_TLS_GD_LO10	57
++#define R_SPARC_TLS_GD_ADD	58
++#define R_SPARC_TLS_GD_CALL	59
++#define R_SPARC_TLS_LDM_HI22	60
++#define R_SPARC_TLS_LDM_LO10	61
++#define R_SPARC_TLS_LDM_ADD	62
++#define R_SPARC_TLS_LDM_CALL	63
++#define R_SPARC_TLS_LDO_HIX22	64
++#define R_SPARC_TLS_LDO_LOX10	65
++#define R_SPARC_TLS_LDO_ADD	66
++#define R_SPARC_TLS_IE_HI22	67
++#define R_SPARC_TLS_IE_LO10	68
++#define R_SPARC_TLS_IE_LD	69
++#define R_SPARC_TLS_IE_LDX	70
++#define R_SPARC_TLS_IE_ADD	71
++#define R_SPARC_TLS_LE_HIX22	72
++#define R_SPARC_TLS_LE_LOX10	73
++#define R_SPARC_TLS_DTPMOD32	74
++#define R_SPARC_TLS_DTPMOD64	75
++#define R_SPARC_TLS_DTPOFF32	76
++#define R_SPARC_TLS_DTPOFF64	77
++#define R_SPARC_TLS_TPOFF32	78
++#define R_SPARC_TLS_TPOFF64	79
++#define R_SPARC_GOTDATA_HIX22	80
++#define R_SPARC_GOTDATA_LOX10	81
++#define R_SPARC_GOTDATA_OP_HIX22	82
++#define R_SPARC_GOTDATA_OP_LOX10	83
++#define R_SPARC_GOTDATA_OP	84
++#define R_SPARC_H34		85
++#define R_SPARC_SIZE32		86
++#define R_SPARC_SIZE64		87
++#define R_SPARC_WDISP10		88
++#define R_SPARC_JMP_IREL	248
++#define R_SPARC_IRELATIVE	249
++#define R_SPARC_GNU_VTINHERIT	250
++#define R_SPARC_GNU_VTENTRY	251
++#define R_SPARC_REV32		252
++/* Keep this the last entry.  */
++#define R_SPARC_NUM		253
++
++/* For Sparc64, legal values for d_tag of Elf64_Dyn.  */
++
++#define DT_SPARC_REGISTER 0x70000001
++#define DT_SPARC_NUM	2
++
++/* MIPS R3000 specific definitions.  */
++
++/* Legal values for e_flags field of Elf32_Ehdr.  */
++
++#define EF_MIPS_NOREORDER   1		/* A .noreorder directive was used */
++#define EF_MIPS_PIC	    2		/* Contains PIC code */
++#define EF_MIPS_CPIC	    4		/* Uses PIC calling sequence */
++#define EF_MIPS_XGOT	    8
++#define EF_MIPS_64BIT_WHIRL 16
++#define EF_MIPS_ABI2	    32
++#define EF_MIPS_ABI_ON32    64
++#define EF_MIPS_ARCH	    0xf0000000	/* MIPS architecture level */
++
++/* Legal values for MIPS architecture level.  */
++
++#define EF_MIPS_ARCH_1	    0x00000000	/* -mips1 code.  */
++#define EF_MIPS_ARCH_2	    0x10000000	/* -mips2 code.  */
++#define EF_MIPS_ARCH_3	    0x20000000	/* -mips3 code.  */
++#define EF_MIPS_ARCH_4	    0x30000000	/* -mips4 code.  */
++#define EF_MIPS_ARCH_5	    0x40000000	/* -mips5 code.  */
++#define EF_MIPS_ARCH_32	    0x60000000	/* MIPS32 code.  */
++#define EF_MIPS_ARCH_64	    0x70000000	/* MIPS64 code.  */
++
++/* The following are non-official names and should not be used.  */
++
++#define E_MIPS_ARCH_1	  0x00000000	/* -mips1 code.  */
++#define E_MIPS_ARCH_2	  0x10000000	/* -mips2 code.  */
++#define E_MIPS_ARCH_3	  0x20000000	/* -mips3 code.  */
++#define E_MIPS_ARCH_4	  0x30000000	/* -mips4 code.  */
++#define E_MIPS_ARCH_5	  0x40000000	/* -mips5 code.  */
++#define E_MIPS_ARCH_32	  0x60000000	/* MIPS32 code.  */
++#define E_MIPS_ARCH_64	  0x70000000	/* MIPS64 code.  */
++
++/* Special section indices.  */
++
++#define SHN_MIPS_ACOMMON    0xff00	/* Allocated common symbols */
++#define SHN_MIPS_TEXT	    0xff01	/* Allocated test symbols.  */
++#define SHN_MIPS_DATA	    0xff02	/* Allocated data symbols.  */
++#define SHN_MIPS_SCOMMON    0xff03	/* Small common symbols */
++#define SHN_MIPS_SUNDEFINED 0xff04	/* Small undefined symbols */
++
++/* Legal values for sh_type field of Elf32_Shdr.  */
++
++#define SHT_MIPS_LIBLIST       0x70000000 /* Shared objects used in link */
++#define SHT_MIPS_MSYM	       0x70000001
++#define SHT_MIPS_CONFLICT      0x70000002 /* Conflicting symbols */
++#define SHT_MIPS_GPTAB	       0x70000003 /* Global data area sizes */
++#define SHT_MIPS_UCODE	       0x70000004 /* Reserved for SGI/MIPS compilers */
++#define SHT_MIPS_DEBUG	       0x70000005 /* MIPS ECOFF debugging information*/
++#define SHT_MIPS_REGINFO       0x70000006 /* Register usage information */
++#define SHT_MIPS_PACKAGE       0x70000007
++#define SHT_MIPS_PACKSYM       0x70000008
++#define SHT_MIPS_RELD	       0x70000009
++#define SHT_MIPS_IFACE         0x7000000b
++#define SHT_MIPS_CONTENT       0x7000000c
++#define SHT_MIPS_OPTIONS       0x7000000d /* Miscellaneous options.  */
++#define SHT_MIPS_SHDR	       0x70000010
++#define SHT_MIPS_FDESC	       0x70000011
++#define SHT_MIPS_EXTSYM	       0x70000012
++#define SHT_MIPS_DENSE	       0x70000013
++#define SHT_MIPS_PDESC	       0x70000014
++#define SHT_MIPS_LOCSYM	       0x70000015
++#define SHT_MIPS_AUXSYM	       0x70000016
++#define SHT_MIPS_OPTSYM	       0x70000017
++#define SHT_MIPS_LOCSTR	       0x70000018
++#define SHT_MIPS_LINE	       0x70000019
++#define SHT_MIPS_RFDESC	       0x7000001a
++#define SHT_MIPS_DELTASYM      0x7000001b
++#define SHT_MIPS_DELTAINST     0x7000001c
++#define SHT_MIPS_DELTACLASS    0x7000001d
++#define SHT_MIPS_DWARF         0x7000001e /* DWARF debugging information.  */
++#define SHT_MIPS_DELTADECL     0x7000001f
++#define SHT_MIPS_SYMBOL_LIB    0x70000020
++#define SHT_MIPS_EVENTS	       0x70000021 /* Event section.  */
++#define SHT_MIPS_TRANSLATE     0x70000022
++#define SHT_MIPS_PIXIE	       0x70000023
++#define SHT_MIPS_XLATE	       0x70000024
++#define SHT_MIPS_XLATE_DEBUG   0x70000025
++#define SHT_MIPS_WHIRL	       0x70000026
++#define SHT_MIPS_EH_REGION     0x70000027
++#define SHT_MIPS_XLATE_OLD     0x70000028
++#define SHT_MIPS_PDR_EXCEPTION 0x70000029
++
++/* Legal values for sh_flags field of Elf32_Shdr.  */
++
++#define SHF_MIPS_GPREL	 0x10000000	/* Must be part of global data area */
++#define SHF_MIPS_MERGE	 0x20000000
++#define SHF_MIPS_ADDR	 0x40000000
++#define SHF_MIPS_STRINGS 0x80000000
++#define SHF_MIPS_NOSTRIP 0x08000000
++#define SHF_MIPS_LOCAL	 0x04000000
++#define SHF_MIPS_NAMES	 0x02000000
++#define SHF_MIPS_NODUPE	 0x01000000
++
++
++/* Symbol tables.  */
++
++/* MIPS specific values for `st_other'.  */
++#define STO_MIPS_DEFAULT		0x0
++#define STO_MIPS_INTERNAL		0x1
++#define STO_MIPS_HIDDEN			0x2
++#define STO_MIPS_PROTECTED		0x3
++#define STO_MIPS_PLT			0x8
++#define STO_MIPS_SC_ALIGN_UNUSED	0xff
++
++/* MIPS specific values for `st_info'.  */
++#define STB_MIPS_SPLIT_COMMON		13
++
++/* Entries found in sections of type SHT_MIPS_GPTAB.  */
++
++typedef union
++{
++  struct
++    {
++      Elf32_Word gt_current_g_value;	/* -G value used for compilation */
++      Elf32_Word gt_unused;		/* Not used */
++    } gt_header;			/* First entry in section */
++  struct
++    {
++      Elf32_Word gt_g_value;		/* If this value were used for -G */
++      Elf32_Word gt_bytes;		/* This many bytes would be used */
++    } gt_entry;				/* Subsequent entries in section */
++} Elf32_gptab;
++
++/* Entry found in sections of type SHT_MIPS_REGINFO.  */
++
++typedef struct
++{
++  Elf32_Word	ri_gprmask;		/* General registers used */
++  Elf32_Word	ri_cprmask[4];		/* Coprocessor registers used */
++  Elf32_Sword	ri_gp_value;		/* $gp register value */
++} Elf32_RegInfo;
++
++/* Entries found in sections of type SHT_MIPS_OPTIONS.  */
++
++typedef struct
++{
++  unsigned char kind;		/* Determines interpretation of the
++				   variable part of descriptor.  */
++  unsigned char size;		/* Size of descriptor, including header.  */
++  Elf32_Section section;	/* Section header index of section affected,
++				   0 for global options.  */
++  Elf32_Word info;		/* Kind-specific information.  */
++} Elf_Options;
++
++/* Values for `kind' field in Elf_Options.  */
++
++#define ODK_NULL	0	/* Undefined.  */
++#define ODK_REGINFO	1	/* Register usage information.  */
++#define ODK_EXCEPTIONS	2	/* Exception processing options.  */
++#define ODK_PAD		3	/* Section padding options.  */
++#define ODK_HWPATCH	4	/* Hardware workarounds performed */
++#define ODK_FILL	5	/* record the fill value used by the linker. */
++#define ODK_TAGS	6	/* reserve space for desktop tools to write. */
++#define ODK_HWAND	7	/* HW workarounds.  'AND' bits when merging. */
++#define ODK_HWOR	8	/* HW workarounds.  'OR' bits when merging.  */
++
++/* Values for `info' in Elf_Options for ODK_EXCEPTIONS entries.  */
++
++#define OEX_FPU_MIN	0x1f	/* FPE's which MUST be enabled.  */
++#define OEX_FPU_MAX	0x1f00	/* FPE's which MAY be enabled.  */
++#define OEX_PAGE0	0x10000	/* page zero must be mapped.  */
++#define OEX_SMM		0x20000	/* Force sequential memory mode?  */
++#define OEX_FPDBUG	0x40000	/* Force floating point debug mode?  */
++#define OEX_PRECISEFP	OEX_FPDBUG
++#define OEX_DISMISS	0x80000	/* Dismiss invalid address faults?  */
++
++#define OEX_FPU_INVAL	0x10
++#define OEX_FPU_DIV0	0x08
++#define OEX_FPU_OFLO	0x04
++#define OEX_FPU_UFLO	0x02
++#define OEX_FPU_INEX	0x01
++
++/* Masks for `info' in Elf_Options for an ODK_HWPATCH entry.  */
++
++#define OHW_R4KEOP	0x1	/* R4000 end-of-page patch.  */
++#define OHW_R8KPFETCH	0x2	/* may need R8000 prefetch patch.  */
++#define OHW_R5KEOP	0x4	/* R5000 end-of-page patch.  */
++#define OHW_R5KCVTL	0x8	/* R5000 cvt.[ds].l bug.  clean=1.  */
++
++#define OPAD_PREFIX	0x1
++#define OPAD_POSTFIX	0x2
++#define OPAD_SYMBOL	0x4
++
++/* Entry found in `.options' section.  */
++
++typedef struct
++{
++  Elf32_Word hwp_flags1;	/* Extra flags.  */
++  Elf32_Word hwp_flags2;	/* Extra flags.  */
++} Elf_Options_Hw;
++
++/* Masks for `info' in ElfOptions for ODK_HWAND and ODK_HWOR entries.  */
++
++#define OHWA0_R4KEOP_CHECKED	0x00000001
++#define OHWA1_R4KEOP_CLEAN	0x00000002
++
++/* MIPS relocs.  */
++
++#define R_MIPS_NONE		0	/* No reloc */
++#define R_MIPS_16		1	/* Direct 16 bit */
++#define R_MIPS_32		2	/* Direct 32 bit */
++#define R_MIPS_REL32		3	/* PC relative 32 bit */
++#define R_MIPS_26		4	/* Direct 26 bit shifted */
++#define R_MIPS_HI16		5	/* High 16 bit */
++#define R_MIPS_LO16		6	/* Low 16 bit */
++#define R_MIPS_GPREL16		7	/* GP relative 16 bit */
++#define R_MIPS_LITERAL		8	/* 16 bit literal entry */
++#define R_MIPS_GOT16		9	/* 16 bit GOT entry */
++#define R_MIPS_PC16		10	/* PC relative 16 bit */
++#define R_MIPS_CALL16		11	/* 16 bit GOT entry for function */
++#define R_MIPS_GPREL32		12	/* GP relative 32 bit */
++
++#define R_MIPS_SHIFT5		16
++#define R_MIPS_SHIFT6		17
++#define R_MIPS_64		18
++#define R_MIPS_GOT_DISP		19
++#define R_MIPS_GOT_PAGE		20
++#define R_MIPS_GOT_OFST		21
++#define R_MIPS_GOT_HI16		22
++#define R_MIPS_GOT_LO16		23
++#define R_MIPS_SUB		24
++#define R_MIPS_INSERT_A		25
++#define R_MIPS_INSERT_B		26
++#define R_MIPS_DELETE		27
++#define R_MIPS_HIGHER		28
++#define R_MIPS_HIGHEST		29
++#define R_MIPS_CALL_HI16	30
++#define R_MIPS_CALL_LO16	31
++#define R_MIPS_SCN_DISP		32
++#define R_MIPS_REL16		33
++#define R_MIPS_ADD_IMMEDIATE	34
++#define R_MIPS_PJUMP		35
++#define R_MIPS_RELGOT		36
++#define R_MIPS_JALR		37
++#define R_MIPS_TLS_DTPMOD32	38	/* Module number 32 bit */
++#define R_MIPS_TLS_DTPREL32	39	/* Module-relative offset 32 bit */
++#define R_MIPS_TLS_DTPMOD64	40	/* Module number 64 bit */
++#define R_MIPS_TLS_DTPREL64	41	/* Module-relative offset 64 bit */
++#define R_MIPS_TLS_GD		42	/* 16 bit GOT offset for GD */
++#define R_MIPS_TLS_LDM		43	/* 16 bit GOT offset for LDM */
++#define R_MIPS_TLS_DTPREL_HI16	44	/* Module-relative offset, high 16 bits */
++#define R_MIPS_TLS_DTPREL_LO16	45	/* Module-relative offset, low 16 bits */
++#define R_MIPS_TLS_GOTTPREL	46	/* 16 bit GOT offset for IE */
++#define R_MIPS_TLS_TPREL32	47	/* TP-relative offset, 32 bit */
++#define R_MIPS_TLS_TPREL64	48	/* TP-relative offset, 64 bit */
++#define R_MIPS_TLS_TPREL_HI16	49	/* TP-relative offset, high 16 bits */
++#define R_MIPS_TLS_TPREL_LO16	50	/* TP-relative offset, low 16 bits */
++#define R_MIPS_GLOB_DAT		51
++#define R_MIPS_COPY		126
++#define R_MIPS_JUMP_SLOT        127
++/* Keep this the last entry.  */
++#define R_MIPS_NUM		128
++
++/* Legal values for p_type field of Elf32_Phdr.  */
++
++#define PT_MIPS_REGINFO	0x70000000	/* Register usage information */
++#define PT_MIPS_RTPROC  0x70000001	/* Runtime procedure table. */
++#define PT_MIPS_OPTIONS 0x70000002
++
++/* Special program header types.  */
++
++#define PF_MIPS_LOCAL	0x10000000
++
++/* Legal values for d_tag field of Elf32_Dyn.  */
++
++#define DT_MIPS_RLD_VERSION  0x70000001	/* Runtime linker interface version */
++#define DT_MIPS_TIME_STAMP   0x70000002	/* Timestamp */
++#define DT_MIPS_ICHECKSUM    0x70000003	/* Checksum */
++#define DT_MIPS_IVERSION     0x70000004	/* Version string (string tbl index) */
++#define DT_MIPS_FLAGS	     0x70000005	/* Flags */
++#define DT_MIPS_BASE_ADDRESS 0x70000006	/* Base address */
++#define DT_MIPS_MSYM	     0x70000007
++#define DT_MIPS_CONFLICT     0x70000008	/* Address of CONFLICT section */
++#define DT_MIPS_LIBLIST	     0x70000009	/* Address of LIBLIST section */
++#define DT_MIPS_LOCAL_GOTNO  0x7000000a	/* Number of local GOT entries */
++#define DT_MIPS_CONFLICTNO   0x7000000b	/* Number of CONFLICT entries */
++#define DT_MIPS_LIBLISTNO    0x70000010	/* Number of LIBLIST entries */
++#define DT_MIPS_SYMTABNO     0x70000011	/* Number of DYNSYM entries */
++#define DT_MIPS_UNREFEXTNO   0x70000012	/* First external DYNSYM */
++#define DT_MIPS_GOTSYM	     0x70000013	/* First GOT entry in DYNSYM */
++#define DT_MIPS_HIPAGENO     0x70000014	/* Number of GOT page table entries */
++#define DT_MIPS_RLD_MAP	     0x70000016	/* Address of run time loader map.  */
++#define DT_MIPS_DELTA_CLASS  0x70000017	/* Delta C++ class definition.  */
++#define DT_MIPS_DELTA_CLASS_NO    0x70000018 /* Number of entries in
++						DT_MIPS_DELTA_CLASS.  */
++#define DT_MIPS_DELTA_INSTANCE    0x70000019 /* Delta C++ class instances.  */
++#define DT_MIPS_DELTA_INSTANCE_NO 0x7000001a /* Number of entries in
++						DT_MIPS_DELTA_INSTANCE.  */
++#define DT_MIPS_DELTA_RELOC  0x7000001b /* Delta relocations.  */
++#define DT_MIPS_DELTA_RELOC_NO 0x7000001c /* Number of entries in
++					     DT_MIPS_DELTA_RELOC.  */
++#define DT_MIPS_DELTA_SYM    0x7000001d /* Delta symbols that Delta
++					   relocations refer to.  */
++#define DT_MIPS_DELTA_SYM_NO 0x7000001e /* Number of entries in
++					   DT_MIPS_DELTA_SYM.  */
++#define DT_MIPS_DELTA_CLASSSYM 0x70000020 /* Delta symbols that hold the
++					     class declaration.  */
++#define DT_MIPS_DELTA_CLASSSYM_NO 0x70000021 /* Number of entries in
++						DT_MIPS_DELTA_CLASSSYM.  */
++#define DT_MIPS_CXX_FLAGS    0x70000022 /* Flags indicating for C++ flavor.  */
++#define DT_MIPS_PIXIE_INIT   0x70000023
++#define DT_MIPS_SYMBOL_LIB   0x70000024
++#define DT_MIPS_LOCALPAGE_GOTIDX 0x70000025
++#define DT_MIPS_LOCAL_GOTIDX 0x70000026
++#define DT_MIPS_HIDDEN_GOTIDX 0x70000027
++#define DT_MIPS_PROTECTED_GOTIDX 0x70000028
++#define DT_MIPS_OPTIONS	     0x70000029 /* Address of .options.  */
++#define DT_MIPS_INTERFACE    0x7000002a /* Address of .interface.  */
++#define DT_MIPS_DYNSTR_ALIGN 0x7000002b
++#define DT_MIPS_INTERFACE_SIZE 0x7000002c /* Size of the .interface section. */
++#define DT_MIPS_RLD_TEXT_RESOLVE_ADDR 0x7000002d /* Address of rld_text_rsolve
++						    function stored in GOT.  */
++#define DT_MIPS_PERF_SUFFIX  0x7000002e /* Default suffix of dso to be added
++					   by rld on dlopen() calls.  */
++#define DT_MIPS_COMPACT_SIZE 0x7000002f /* (O32)Size of compact rel section. */
++#define DT_MIPS_GP_VALUE     0x70000030 /* GP value for aux GOTs.  */
++#define DT_MIPS_AUX_DYNAMIC  0x70000031 /* Address of aux .dynamic.  */
++/* The address of .got.plt in an executable using the new non-PIC ABI.  */
++#define DT_MIPS_PLTGOT	     0x70000032
++/* The base of the PLT in an executable using the new non-PIC ABI if that
++   PLT is writable.  For a non-writable PLT, this is omitted or has a zero
++   value.  */
++#define DT_MIPS_RWPLT        0x70000034
++#define DT_MIPS_NUM	     0x35
++
++/* Legal values for DT_MIPS_FLAGS Elf32_Dyn entry.  */
++
++#define RHF_NONE		   0		/* No flags */
++#define RHF_QUICKSTART		   (1 << 0)	/* Use quickstart */
++#define RHF_NOTPOT		   (1 << 1)	/* Hash size not power of 2 */
++#define RHF_NO_LIBRARY_REPLACEMENT (1 << 2)	/* Ignore LD_LIBRARY_PATH */
++#define RHF_NO_MOVE		   (1 << 3)
++#define RHF_SGI_ONLY		   (1 << 4)
++#define RHF_GUARANTEE_INIT	   (1 << 5)
++#define RHF_DELTA_C_PLUS_PLUS	   (1 << 6)
++#define RHF_GUARANTEE_START_INIT   (1 << 7)
++#define RHF_PIXIE		   (1 << 8)
++#define RHF_DEFAULT_DELAY_LOAD	   (1 << 9)
++#define RHF_REQUICKSTART	   (1 << 10)
++#define RHF_REQUICKSTARTED	   (1 << 11)
++#define RHF_CORD		   (1 << 12)
++#define RHF_NO_UNRES_UNDEF	   (1 << 13)
++#define RHF_RLD_ORDER_SAFE	   (1 << 14)
++
++/* Entries found in sections of type SHT_MIPS_LIBLIST.  */
++
++typedef struct
++{
++  Elf32_Word l_name;		/* Name (string table index) */
++  Elf32_Word l_time_stamp;	/* Timestamp */
++  Elf32_Word l_checksum;	/* Checksum */
++  Elf32_Word l_version;		/* Interface version */
++  Elf32_Word l_flags;		/* Flags */
++} Elf32_Lib;
++
++typedef struct
++{
++  Elf64_Word l_name;		/* Name (string table index) */
++  Elf64_Word l_time_stamp;	/* Timestamp */
++  Elf64_Word l_checksum;	/* Checksum */
++  Elf64_Word l_version;		/* Interface version */
++  Elf64_Word l_flags;		/* Flags */
++} Elf64_Lib;
++
++
++/* Legal values for l_flags.  */
++
++#define LL_NONE		  0
++#define LL_EXACT_MATCH	  (1 << 0)	/* Require exact match */
++#define LL_IGNORE_INT_VER (1 << 1)	/* Ignore interface version */
++#define LL_REQUIRE_MINOR  (1 << 2)
++#define LL_EXPORTS	  (1 << 3)
++#define LL_DELAY_LOAD	  (1 << 4)
++#define LL_DELTA	  (1 << 5)
++
++/* Entries found in sections of type SHT_MIPS_CONFLICT.  */
++
++typedef Elf32_Addr Elf32_Conflict;
++
++
++/* HPPA specific definitions.  */
++
++/* Legal values for e_flags field of Elf32_Ehdr.  */
++
++#define EF_PARISC_TRAPNIL	0x00010000 /* Trap nil pointer dereference.  */
++#define EF_PARISC_EXT		0x00020000 /* Program uses arch. extensions. */
++#define EF_PARISC_LSB		0x00040000 /* Program expects little endian. */
++#define EF_PARISC_WIDE		0x00080000 /* Program expects wide mode.  */
++#define EF_PARISC_NO_KABP	0x00100000 /* No kernel assisted branch
++					      prediction.  */
++#define EF_PARISC_LAZYSWAP	0x00400000 /* Allow lazy swapping.  */
++#define EF_PARISC_ARCH		0x0000ffff /* Architecture version.  */
++
++/* Defined values for `e_flags & EF_PARISC_ARCH' are:  */
++
++#define EFA_PARISC_1_0		    0x020b /* PA-RISC 1.0 big-endian.  */
++#define EFA_PARISC_1_1		    0x0210 /* PA-RISC 1.1 big-endian.  */
++#define EFA_PARISC_2_0		    0x0214 /* PA-RISC 2.0 big-endian.  */
++
++/* Additional section indeces.  */
++
++#define SHN_PARISC_ANSI_COMMON	0xff00	   /* Section for tenatively declared
++					      symbols in ANSI C.  */
++#define SHN_PARISC_HUGE_COMMON	0xff01	   /* Common blocks in huge model.  */
++
++/* Legal values for sh_type field of Elf32_Shdr.  */
++
++#define SHT_PARISC_EXT		0x70000000 /* Contains product specific ext. */
++#define SHT_PARISC_UNWIND	0x70000001 /* Unwind information.  */
++#define SHT_PARISC_DOC		0x70000002 /* Debug info for optimized code. */
++
++/* Legal values for sh_flags field of Elf32_Shdr.  */
++
++#define SHF_PARISC_SHORT	0x20000000 /* Section with short addressing. */
++#define SHF_PARISC_HUGE		0x40000000 /* Section far from gp.  */
++#define SHF_PARISC_SBP		0x80000000 /* Static branch prediction code. */
++
++/* Legal values for ST_TYPE subfield of st_info (symbol type).  */
++
++#define STT_PARISC_MILLICODE	13	/* Millicode function entry point.  */
++
++#define STT_HP_OPAQUE		(STT_LOOS + 0x1)
++#define STT_HP_STUB		(STT_LOOS + 0x2)
++
++/* HPPA relocs.  */
++
++#define R_PARISC_NONE		0	/* No reloc.  */
++#define R_PARISC_DIR32		1	/* Direct 32-bit reference.  */
++#define R_PARISC_DIR21L		2	/* Left 21 bits of eff. address.  */
++#define R_PARISC_DIR17R		3	/* Right 17 bits of eff. address.  */
++#define R_PARISC_DIR17F		4	/* 17 bits of eff. address.  */
++#define R_PARISC_DIR14R		6	/* Right 14 bits of eff. address.  */
++#define R_PARISC_PCREL32	9	/* 32-bit rel. address.  */
++#define R_PARISC_PCREL21L	10	/* Left 21 bits of rel. address.  */
++#define R_PARISC_PCREL17R	11	/* Right 17 bits of rel. address.  */
++#define R_PARISC_PCREL17F	12	/* 17 bits of rel. address.  */
++#define R_PARISC_PCREL14R	14	/* Right 14 bits of rel. address.  */
++#define R_PARISC_DPREL21L	18	/* Left 21 bits of rel. address.  */
++#define R_PARISC_DPREL14R	22	/* Right 14 bits of rel. address.  */
++#define R_PARISC_GPREL21L	26	/* GP-relative, left 21 bits.  */
++#define R_PARISC_GPREL14R	30	/* GP-relative, right 14 bits.  */
++#define R_PARISC_LTOFF21L	34	/* LT-relative, left 21 bits.  */
++#define R_PARISC_LTOFF14R	38	/* LT-relative, right 14 bits.  */
++#define R_PARISC_SECREL32	41	/* 32 bits section rel. address.  */
++#define R_PARISC_SEGBASE	48	/* No relocation, set segment base.  */
++#define R_PARISC_SEGREL32	49	/* 32 bits segment rel. address.  */
++#define R_PARISC_PLTOFF21L	50	/* PLT rel. address, left 21 bits.  */
++#define R_PARISC_PLTOFF14R	54	/* PLT rel. address, right 14 bits.  */
++#define R_PARISC_LTOFF_FPTR32	57	/* 32 bits LT-rel. function pointer. */
++#define R_PARISC_LTOFF_FPTR21L	58	/* LT-rel. fct ptr, left 21 bits. */
++#define R_PARISC_LTOFF_FPTR14R	62	/* LT-rel. fct ptr, right 14 bits. */
++#define R_PARISC_FPTR64		64	/* 64 bits function address.  */
++#define R_PARISC_PLABEL32	65	/* 32 bits function address.  */
++#define R_PARISC_PLABEL21L	66	/* Left 21 bits of fdesc address.  */
++#define R_PARISC_PLABEL14R	70	/* Right 14 bits of fdesc address.  */
++#define R_PARISC_PCREL64	72	/* 64 bits PC-rel. address.  */
++#define R_PARISC_PCREL22F	74	/* 22 bits PC-rel. address.  */
++#define R_PARISC_PCREL14WR	75	/* PC-rel. address, right 14 bits.  */
++#define R_PARISC_PCREL14DR	76	/* PC rel. address, right 14 bits.  */
++#define R_PARISC_PCREL16F	77	/* 16 bits PC-rel. address.  */
++#define R_PARISC_PCREL16WF	78	/* 16 bits PC-rel. address.  */
++#define R_PARISC_PCREL16DF	79	/* 16 bits PC-rel. address.  */
++#define R_PARISC_DIR64		80	/* 64 bits of eff. address.  */
++#define R_PARISC_DIR14WR	83	/* 14 bits of eff. address.  */
++#define R_PARISC_DIR14DR	84	/* 14 bits of eff. address.  */
++#define R_PARISC_DIR16F		85	/* 16 bits of eff. address.  */
++#define R_PARISC_DIR16WF	86	/* 16 bits of eff. address.  */
++#define R_PARISC_DIR16DF	87	/* 16 bits of eff. address.  */
++#define R_PARISC_GPREL64	88	/* 64 bits of GP-rel. address.  */
++#define R_PARISC_GPREL14WR	91	/* GP-rel. address, right 14 bits.  */
++#define R_PARISC_GPREL14DR	92	/* GP-rel. address, right 14 bits.  */
++#define R_PARISC_GPREL16F	93	/* 16 bits GP-rel. address.  */
++#define R_PARISC_GPREL16WF	94	/* 16 bits GP-rel. address.  */
++#define R_PARISC_GPREL16DF	95	/* 16 bits GP-rel. address.  */
++#define R_PARISC_LTOFF64	96	/* 64 bits LT-rel. address.  */
++#define R_PARISC_LTOFF14WR	99	/* LT-rel. address, right 14 bits.  */
++#define R_PARISC_LTOFF14DR	100	/* LT-rel. address, right 14 bits.  */
++#define R_PARISC_LTOFF16F	101	/* 16 bits LT-rel. address.  */
++#define R_PARISC_LTOFF16WF	102	/* 16 bits LT-rel. address.  */
++#define R_PARISC_LTOFF16DF	103	/* 16 bits LT-rel. address.  */
++#define R_PARISC_SECREL64	104	/* 64 bits section rel. address.  */
++#define R_PARISC_SEGREL64	112	/* 64 bits segment rel. address.  */
++#define R_PARISC_PLTOFF14WR	115	/* PLT-rel. address, right 14 bits.  */
++#define R_PARISC_PLTOFF14DR	116	/* PLT-rel. address, right 14 bits.  */
++#define R_PARISC_PLTOFF16F	117	/* 16 bits LT-rel. address.  */
++#define R_PARISC_PLTOFF16WF	118	/* 16 bits PLT-rel. address.  */
++#define R_PARISC_PLTOFF16DF	119	/* 16 bits PLT-rel. address.  */
++#define R_PARISC_LTOFF_FPTR64	120	/* 64 bits LT-rel. function ptr.  */
++#define R_PARISC_LTOFF_FPTR14WR	123	/* LT-rel. fct. ptr., right 14 bits. */
++#define R_PARISC_LTOFF_FPTR14DR	124	/* LT-rel. fct. ptr., right 14 bits. */
++#define R_PARISC_LTOFF_FPTR16F	125	/* 16 bits LT-rel. function ptr.  */
++#define R_PARISC_LTOFF_FPTR16WF	126	/* 16 bits LT-rel. function ptr.  */
++#define R_PARISC_LTOFF_FPTR16DF	127	/* 16 bits LT-rel. function ptr.  */
++#define R_PARISC_LORESERVE	128
++#define R_PARISC_COPY		128	/* Copy relocation.  */
++#define R_PARISC_IPLT		129	/* Dynamic reloc, imported PLT */
++#define R_PARISC_EPLT		130	/* Dynamic reloc, exported PLT */
++#define R_PARISC_TPREL32	153	/* 32 bits TP-rel. address.  */
++#define R_PARISC_TPREL21L	154	/* TP-rel. address, left 21 bits.  */
++#define R_PARISC_TPREL14R	158	/* TP-rel. address, right 14 bits.  */
++#define R_PARISC_LTOFF_TP21L	162	/* LT-TP-rel. address, left 21 bits. */
++#define R_PARISC_LTOFF_TP14R	166	/* LT-TP-rel. address, right 14 bits.*/
++#define R_PARISC_LTOFF_TP14F	167	/* 14 bits LT-TP-rel. address.  */
++#define R_PARISC_TPREL64	216	/* 64 bits TP-rel. address.  */
++#define R_PARISC_TPREL14WR	219	/* TP-rel. address, right 14 bits.  */
++#define R_PARISC_TPREL14DR	220	/* TP-rel. address, right 14 bits.  */
++#define R_PARISC_TPREL16F	221	/* 16 bits TP-rel. address.  */
++#define R_PARISC_TPREL16WF	222	/* 16 bits TP-rel. address.  */
++#define R_PARISC_TPREL16DF	223	/* 16 bits TP-rel. address.  */
++#define R_PARISC_LTOFF_TP64	224	/* 64 bits LT-TP-rel. address.  */
++#define R_PARISC_LTOFF_TP14WR	227	/* LT-TP-rel. address, right 14 bits.*/
++#define R_PARISC_LTOFF_TP14DR	228	/* LT-TP-rel. address, right 14 bits.*/
++#define R_PARISC_LTOFF_TP16F	229	/* 16 bits LT-TP-rel. address.  */
++#define R_PARISC_LTOFF_TP16WF	230	/* 16 bits LT-TP-rel. address.  */
++#define R_PARISC_LTOFF_TP16DF	231	/* 16 bits LT-TP-rel. address.  */
++#define R_PARISC_GNU_VTENTRY	232
++#define R_PARISC_GNU_VTINHERIT	233
++#define R_PARISC_TLS_GD21L	234	/* GD 21-bit left.  */
++#define R_PARISC_TLS_GD14R	235	/* GD 14-bit right.  */
++#define R_PARISC_TLS_GDCALL	236	/* GD call to __t_g_a.  */
++#define R_PARISC_TLS_LDM21L	237	/* LD module 21-bit left.  */
++#define R_PARISC_TLS_LDM14R	238	/* LD module 14-bit right.  */
++#define R_PARISC_TLS_LDMCALL	239	/* LD module call to __t_g_a.  */
++#define R_PARISC_TLS_LDO21L	240	/* LD offset 21-bit left.  */
++#define R_PARISC_TLS_LDO14R	241	/* LD offset 14-bit right.  */
++#define R_PARISC_TLS_DTPMOD32	242	/* DTP module 32-bit.  */
++#define R_PARISC_TLS_DTPMOD64	243	/* DTP module 64-bit.  */
++#define R_PARISC_TLS_DTPOFF32	244	/* DTP offset 32-bit.  */
++#define R_PARISC_TLS_DTPOFF64	245	/* DTP offset 32-bit.  */
++#define R_PARISC_TLS_LE21L	R_PARISC_TPREL21L
++#define R_PARISC_TLS_LE14R	R_PARISC_TPREL14R
++#define R_PARISC_TLS_IE21L	R_PARISC_LTOFF_TP21L
++#define R_PARISC_TLS_IE14R	R_PARISC_LTOFF_TP14R
++#define R_PARISC_TLS_TPREL32	R_PARISC_TPREL32
++#define R_PARISC_TLS_TPREL64	R_PARISC_TPREL64
++#define R_PARISC_HIRESERVE	255
++
++/* Legal values for p_type field of Elf32_Phdr/Elf64_Phdr.  */
++
++#define PT_HP_TLS		(PT_LOOS + 0x0)
++#define PT_HP_CORE_NONE		(PT_LOOS + 0x1)
++#define PT_HP_CORE_VERSION	(PT_LOOS + 0x2)
++#define PT_HP_CORE_KERNEL	(PT_LOOS + 0x3)
++#define PT_HP_CORE_COMM		(PT_LOOS + 0x4)
++#define PT_HP_CORE_PROC		(PT_LOOS + 0x5)
++#define PT_HP_CORE_LOADABLE	(PT_LOOS + 0x6)
++#define PT_HP_CORE_STACK	(PT_LOOS + 0x7)
++#define PT_HP_CORE_SHM		(PT_LOOS + 0x8)
++#define PT_HP_CORE_MMF		(PT_LOOS + 0x9)
++#define PT_HP_PARALLEL		(PT_LOOS + 0x10)
++#define PT_HP_FASTBIND		(PT_LOOS + 0x11)
++#define PT_HP_OPT_ANNOT		(PT_LOOS + 0x12)
++#define PT_HP_HSL_ANNOT		(PT_LOOS + 0x13)
++#define PT_HP_STACK		(PT_LOOS + 0x14)
++
++#define PT_PARISC_ARCHEXT	0x70000000
++#define PT_PARISC_UNWIND	0x70000001
++
++/* Legal values for p_flags field of Elf32_Phdr/Elf64_Phdr.  */
++
++#define PF_PARISC_SBP		0x08000000
++
++#define PF_HP_PAGE_SIZE		0x00100000
++#define PF_HP_FAR_SHARED	0x00200000
++#define PF_HP_NEAR_SHARED	0x00400000
++#define PF_HP_CODE		0x01000000
++#define PF_HP_MODIFY		0x02000000
++#define PF_HP_LAZYSWAP		0x04000000
++#define PF_HP_SBP		0x08000000
++
++
++/* Alpha specific definitions.  */
++
++/* Legal values for e_flags field of Elf64_Ehdr.  */
++
++#define EF_ALPHA_32BIT		1	/* All addresses must be < 2GB.  */
++#define EF_ALPHA_CANRELAX	2	/* Relocations for relaxing exist.  */
++
++/* Legal values for sh_type field of Elf64_Shdr.  */
++
++/* These two are primerily concerned with ECOFF debugging info.  */
++#define SHT_ALPHA_DEBUG		0x70000001
++#define SHT_ALPHA_REGINFO	0x70000002
++
++/* Legal values for sh_flags field of Elf64_Shdr.  */
++
++#define SHF_ALPHA_GPREL		0x10000000
++
++/* Legal values for st_other field of Elf64_Sym.  */
++#define STO_ALPHA_NOPV		0x80	/* No PV required.  */
++#define STO_ALPHA_STD_GPLOAD	0x88	/* PV only used for initial ldgp.  */
++
++/* Alpha relocs.  */
++
++#define R_ALPHA_NONE		0	/* No reloc */
++#define R_ALPHA_REFLONG		1	/* Direct 32 bit */
++#define R_ALPHA_REFQUAD		2	/* Direct 64 bit */
++#define R_ALPHA_GPREL32		3	/* GP relative 32 bit */
++#define R_ALPHA_LITERAL		4	/* GP relative 16 bit w/optimization */
++#define R_ALPHA_LITUSE		5	/* Optimization hint for LITERAL */
++#define R_ALPHA_GPDISP		6	/* Add displacement to GP */
++#define R_ALPHA_BRADDR		7	/* PC+4 relative 23 bit shifted */
++#define R_ALPHA_HINT		8	/* PC+4 relative 16 bit shifted */
++#define R_ALPHA_SREL16		9	/* PC relative 16 bit */
++#define R_ALPHA_SREL32		10	/* PC relative 32 bit */
++#define R_ALPHA_SREL64		11	/* PC relative 64 bit */
++#define R_ALPHA_GPRELHIGH	17	/* GP relative 32 bit, high 16 bits */
++#define R_ALPHA_GPRELLOW	18	/* GP relative 32 bit, low 16 bits */
++#define R_ALPHA_GPREL16		19	/* GP relative 16 bit */
++#define R_ALPHA_COPY		24	/* Copy symbol at runtime */
++#define R_ALPHA_GLOB_DAT	25	/* Create GOT entry */
++#define R_ALPHA_JMP_SLOT	26	/* Create PLT entry */
++#define R_ALPHA_RELATIVE	27	/* Adjust by program base */
++#define R_ALPHA_TLS_GD_HI	28
++#define R_ALPHA_TLSGD		29
++#define R_ALPHA_TLS_LDM		30
++#define R_ALPHA_DTPMOD64	31
++#define R_ALPHA_GOTDTPREL	32
++#define R_ALPHA_DTPREL64	33
++#define R_ALPHA_DTPRELHI	34
++#define R_ALPHA_DTPRELLO	35
++#define R_ALPHA_DTPREL16	36
++#define R_ALPHA_GOTTPREL	37
++#define R_ALPHA_TPREL64		38
++#define R_ALPHA_TPRELHI		39
++#define R_ALPHA_TPRELLO		40
++#define R_ALPHA_TPREL16		41
++/* Keep this the last entry.  */
++#define R_ALPHA_NUM		46
++
++/* Magic values of the LITUSE relocation addend.  */
++#define LITUSE_ALPHA_ADDR	0
++#define LITUSE_ALPHA_BASE	1
++#define LITUSE_ALPHA_BYTOFF	2
++#define LITUSE_ALPHA_JSR	3
++#define LITUSE_ALPHA_TLS_GD	4
++#define LITUSE_ALPHA_TLS_LDM	5
++
++/* Legal values for d_tag of Elf64_Dyn.  */
++#define DT_ALPHA_PLTRO		(DT_LOPROC + 0)
++#define DT_ALPHA_NUM		1
++
++/* PowerPC specific declarations */
++
++/* Values for Elf32/64_Ehdr.e_flags.  */
++#define EF_PPC_EMB		0x80000000	/* PowerPC embedded flag */
++
++/* Cygnus local bits below */
++#define EF_PPC_RELOCATABLE	0x00010000	/* PowerPC -mrelocatable flag*/
++#define EF_PPC_RELOCATABLE_LIB	0x00008000	/* PowerPC -mrelocatable-lib
++						   flag */
++
++/* PowerPC relocations defined by the ABIs */
++#define R_PPC_NONE		0
++#define R_PPC_ADDR32		1	/* 32bit absolute address */
++#define R_PPC_ADDR24		2	/* 26bit address, 2 bits ignored.  */
++#define R_PPC_ADDR16		3	/* 16bit absolute address */
++#define R_PPC_ADDR16_LO		4	/* lower 16bit of absolute address */
++#define R_PPC_ADDR16_HI		5	/* high 16bit of absolute address */
++#define R_PPC_ADDR16_HA		6	/* adjusted high 16bit */
++#define R_PPC_ADDR14		7	/* 16bit address, 2 bits ignored */
++#define R_PPC_ADDR14_BRTAKEN	8
++#define R_PPC_ADDR14_BRNTAKEN	9
++#define R_PPC_REL24		10	/* PC relative 26 bit */
++#define R_PPC_REL14		11	/* PC relative 16 bit */
++#define R_PPC_REL14_BRTAKEN	12
++#define R_PPC_REL14_BRNTAKEN	13
++#define R_PPC_GOT16		14
++#define R_PPC_GOT16_LO		15
++#define R_PPC_GOT16_HI		16
++#define R_PPC_GOT16_HA		17
++#define R_PPC_PLTREL24		18
++#define R_PPC_COPY		19
++#define R_PPC_GLOB_DAT		20
++#define R_PPC_JMP_SLOT		21
++#define R_PPC_RELATIVE		22
++#define R_PPC_LOCAL24PC		23
++#define R_PPC_UADDR32		24
++#define R_PPC_UADDR16		25
++#define R_PPC_REL32		26
++#define R_PPC_PLT32		27
++#define R_PPC_PLTREL32		28
++#define R_PPC_PLT16_LO		29
++#define R_PPC_PLT16_HI		30
++#define R_PPC_PLT16_HA		31
++#define R_PPC_SDAREL16		32
++#define R_PPC_SECTOFF		33
++#define R_PPC_SECTOFF_LO	34
++#define R_PPC_SECTOFF_HI	35
++#define R_PPC_SECTOFF_HA	36
++
++/* PowerPC relocations defined for the TLS access ABI.  */
++#define R_PPC_TLS		67 /* none	(sym+add)@tls */
++#define R_PPC_DTPMOD32		68 /* word32	(sym+add)@dtpmod */
++#define R_PPC_TPREL16		69 /* half16*	(sym+add)@tprel */
++#define R_PPC_TPREL16_LO	70 /* half16	(sym+add)@tprel@l */
++#define R_PPC_TPREL16_HI	71 /* half16	(sym+add)@tprel@h */
++#define R_PPC_TPREL16_HA	72 /* half16	(sym+add)@tprel@ha */
++#define R_PPC_TPREL32		73 /* word32	(sym+add)@tprel */
++#define R_PPC_DTPREL16		74 /* half16*	(sym+add)@dtprel */
++#define R_PPC_DTPREL16_LO	75 /* half16	(sym+add)@dtprel@l */
++#define R_PPC_DTPREL16_HI	76 /* half16	(sym+add)@dtprel@h */
++#define R_PPC_DTPREL16_HA	77 /* half16	(sym+add)@dtprel@ha */
++#define R_PPC_DTPREL32		78 /* word32	(sym+add)@dtprel */
++#define R_PPC_GOT_TLSGD16	79 /* half16*	(sym+add)@got@tlsgd */
++#define R_PPC_GOT_TLSGD16_LO	80 /* half16	(sym+add)@got@tlsgd@l */
++#define R_PPC_GOT_TLSGD16_HI	81 /* half16	(sym+add)@got@tlsgd@h */
++#define R_PPC_GOT_TLSGD16_HA	82 /* half16	(sym+add)@got@tlsgd@ha */
++#define R_PPC_GOT_TLSLD16	83 /* half16*	(sym+add)@got@tlsld */
++#define R_PPC_GOT_TLSLD16_LO	84 /* half16	(sym+add)@got@tlsld@l */
++#define R_PPC_GOT_TLSLD16_HI	85 /* half16	(sym+add)@got@tlsld@h */
++#define R_PPC_GOT_TLSLD16_HA	86 /* half16	(sym+add)@got@tlsld@ha */
++#define R_PPC_GOT_TPREL16	87 /* half16*	(sym+add)@got@tprel */
++#define R_PPC_GOT_TPREL16_LO	88 /* half16	(sym+add)@got@tprel@l */
++#define R_PPC_GOT_TPREL16_HI	89 /* half16	(sym+add)@got@tprel@h */
++#define R_PPC_GOT_TPREL16_HA	90 /* half16	(sym+add)@got@tprel@ha */
++#define R_PPC_GOT_DTPREL16	91 /* half16*	(sym+add)@got@dtprel */
++#define R_PPC_GOT_DTPREL16_LO	92 /* half16*	(sym+add)@got@dtprel@l */
++#define R_PPC_GOT_DTPREL16_HI	93 /* half16*	(sym+add)@got@dtprel@h */
++#define R_PPC_GOT_DTPREL16_HA	94 /* half16*	(sym+add)@got@dtprel@ha */
++
++/* The remaining relocs are from the Embedded ELF ABI, and are not
++   in the SVR4 ELF ABI.  */
++#define R_PPC_EMB_NADDR32	101
++#define R_PPC_EMB_NADDR16	102
++#define R_PPC_EMB_NADDR16_LO	103
++#define R_PPC_EMB_NADDR16_HI	104
++#define R_PPC_EMB_NADDR16_HA	105
++#define R_PPC_EMB_SDAI16	106
++#define R_PPC_EMB_SDA2I16	107
++#define R_PPC_EMB_SDA2REL	108
++#define R_PPC_EMB_SDA21		109	/* 16 bit offset in SDA */
++#define R_PPC_EMB_MRKREF	110
++#define R_PPC_EMB_RELSEC16	111
++#define R_PPC_EMB_RELST_LO	112
++#define R_PPC_EMB_RELST_HI	113
++#define R_PPC_EMB_RELST_HA	114
++#define R_PPC_EMB_BIT_FLD	115
++#define R_PPC_EMB_RELSDA	116	/* 16 bit relative offset in SDA */
++
++/* Diab tool relocations.  */
++#define R_PPC_DIAB_SDA21_LO	180	/* like EMB_SDA21, but lower 16 bit */
++#define R_PPC_DIAB_SDA21_HI	181	/* like EMB_SDA21, but high 16 bit */
++#define R_PPC_DIAB_SDA21_HA	182	/* like EMB_SDA21, adjusted high 16 */
++#define R_PPC_DIAB_RELSDA_LO	183	/* like EMB_RELSDA, but lower 16 bit */
++#define R_PPC_DIAB_RELSDA_HI	184	/* like EMB_RELSDA, but high 16 bit */
++#define R_PPC_DIAB_RELSDA_HA	185	/* like EMB_RELSDA, adjusted high 16 */
++
++/* GNU extension to support local ifunc.  */
++#define R_PPC_IRELATIVE		248
++
++/* GNU relocs used in PIC code sequences.  */
++#define R_PPC_REL16		249	/* half16   (sym+add-.) */
++#define R_PPC_REL16_LO		250	/* half16   (sym+add-.)@l */
++#define R_PPC_REL16_HI		251	/* half16   (sym+add-.)@h */
++#define R_PPC_REL16_HA		252	/* half16   (sym+add-.)@ha */
++
++/* This is a phony reloc to handle any old fashioned TOC16 references
++   that may still be in object files.  */
++#define R_PPC_TOC16		255
++
++/* PowerPC specific values for the Dyn d_tag field.  */
++#define DT_PPC_GOT		(DT_LOPROC + 0)
++#define DT_PPC_NUM		1
++
++/* PowerPC64 relocations defined by the ABIs */
++#define R_PPC64_NONE		R_PPC_NONE
++#define R_PPC64_ADDR32		R_PPC_ADDR32 /* 32bit absolute address */
++#define R_PPC64_ADDR24		R_PPC_ADDR24 /* 26bit address, word aligned */
++#define R_PPC64_ADDR16		R_PPC_ADDR16 /* 16bit absolute address */
++#define R_PPC64_ADDR16_LO	R_PPC_ADDR16_LO	/* lower 16bits of address */
++#define R_PPC64_ADDR16_HI	R_PPC_ADDR16_HI	/* high 16bits of address. */
++#define R_PPC64_ADDR16_HA	R_PPC_ADDR16_HA /* adjusted high 16bits.  */
++#define R_PPC64_ADDR14		R_PPC_ADDR14 /* 16bit address, word aligned */
++#define R_PPC64_ADDR14_BRTAKEN	R_PPC_ADDR14_BRTAKEN
++#define R_PPC64_ADDR14_BRNTAKEN	R_PPC_ADDR14_BRNTAKEN
++#define R_PPC64_REL24		R_PPC_REL24 /* PC-rel. 26 bit, word aligned */
++#define R_PPC64_REL14		R_PPC_REL14 /* PC relative 16 bit */
++#define R_PPC64_REL14_BRTAKEN	R_PPC_REL14_BRTAKEN
++#define R_PPC64_REL14_BRNTAKEN	R_PPC_REL14_BRNTAKEN
++#define R_PPC64_GOT16		R_PPC_GOT16
++#define R_PPC64_GOT16_LO	R_PPC_GOT16_LO
++#define R_PPC64_GOT16_HI	R_PPC_GOT16_HI
++#define R_PPC64_GOT16_HA	R_PPC_GOT16_HA
++
++#define R_PPC64_COPY		R_PPC_COPY
++#define R_PPC64_GLOB_DAT	R_PPC_GLOB_DAT
++#define R_PPC64_JMP_SLOT	R_PPC_JMP_SLOT
++#define R_PPC64_RELATIVE	R_PPC_RELATIVE
++
++#define R_PPC64_UADDR32		R_PPC_UADDR32
++#define R_PPC64_UADDR16		R_PPC_UADDR16
++#define R_PPC64_REL32		R_PPC_REL32
++#define R_PPC64_PLT32		R_PPC_PLT32
++#define R_PPC64_PLTREL32	R_PPC_PLTREL32
++#define R_PPC64_PLT16_LO	R_PPC_PLT16_LO
++#define R_PPC64_PLT16_HI	R_PPC_PLT16_HI
++#define R_PPC64_PLT16_HA	R_PPC_PLT16_HA
++
++#define R_PPC64_SECTOFF		R_PPC_SECTOFF
++#define R_PPC64_SECTOFF_LO	R_PPC_SECTOFF_LO
++#define R_PPC64_SECTOFF_HI	R_PPC_SECTOFF_HI
++#define R_PPC64_SECTOFF_HA	R_PPC_SECTOFF_HA
++#define R_PPC64_ADDR30		37 /* word30 (S + A - P) >> 2 */
++#define R_PPC64_ADDR64		38 /* doubleword64 S + A */
++#define R_PPC64_ADDR16_HIGHER	39 /* half16 #higher(S + A) */
++#define R_PPC64_ADDR16_HIGHERA	40 /* half16 #highera(S + A) */
++#define R_PPC64_ADDR16_HIGHEST	41 /* half16 #highest(S + A) */
++#define R_PPC64_ADDR16_HIGHESTA	42 /* half16 #highesta(S + A) */
++#define R_PPC64_UADDR64		43 /* doubleword64 S + A */
++#define R_PPC64_REL64		44 /* doubleword64 S + A - P */
++#define R_PPC64_PLT64		45 /* doubleword64 L + A */
++#define R_PPC64_PLTREL64	46 /* doubleword64 L + A - P */
++#define R_PPC64_TOC16		47 /* half16* S + A - .TOC */
++#define R_PPC64_TOC16_LO	48 /* half16 #lo(S + A - .TOC.) */
++#define R_PPC64_TOC16_HI	49 /* half16 #hi(S + A - .TOC.) */
++#define R_PPC64_TOC16_HA	50 /* half16 #ha(S + A - .TOC.) */
++#define R_PPC64_TOC		51 /* doubleword64 .TOC */
++#define R_PPC64_PLTGOT16	52 /* half16* M + A */
++#define R_PPC64_PLTGOT16_LO	53 /* half16 #lo(M + A) */
++#define R_PPC64_PLTGOT16_HI	54 /* half16 #hi(M + A) */
++#define R_PPC64_PLTGOT16_HA	55 /* half16 #ha(M + A) */
++
++#define R_PPC64_ADDR16_DS	56 /* half16ds* (S + A) >> 2 */
++#define R_PPC64_ADDR16_LO_DS	57 /* half16ds  #lo(S + A) >> 2 */
++#define R_PPC64_GOT16_DS	58 /* half16ds* (G + A) >> 2 */
++#define R_PPC64_GOT16_LO_DS	59 /* half16ds  #lo(G + A) >> 2 */
++#define R_PPC64_PLT16_LO_DS	60 /* half16ds  #lo(L + A) >> 2 */
++#define R_PPC64_SECTOFF_DS	61 /* half16ds* (R + A) >> 2 */
++#define R_PPC64_SECTOFF_LO_DS	62 /* half16ds  #lo(R + A) >> 2 */
++#define R_PPC64_TOC16_DS	63 /* half16ds* (S + A - .TOC.) >> 2 */
++#define R_PPC64_TOC16_LO_DS	64 /* half16ds  #lo(S + A - .TOC.) >> 2 */
++#define R_PPC64_PLTGOT16_DS	65 /* half16ds* (M + A) >> 2 */
++#define R_PPC64_PLTGOT16_LO_DS	66 /* half16ds  #lo(M + A) >> 2 */
++
++/* PowerPC64 relocations defined for the TLS access ABI.  */
++#define R_PPC64_TLS		67 /* none	(sym+add)@tls */
++#define R_PPC64_DTPMOD64	68 /* doubleword64 (sym+add)@dtpmod */
++#define R_PPC64_TPREL16		69 /* half16*	(sym+add)@tprel */
++#define R_PPC64_TPREL16_LO	70 /* half16	(sym+add)@tprel@l */
++#define R_PPC64_TPREL16_HI	71 /* half16	(sym+add)@tprel@h */
++#define R_PPC64_TPREL16_HA	72 /* half16	(sym+add)@tprel@ha */
++#define R_PPC64_TPREL64		73 /* doubleword64 (sym+add)@tprel */
++#define R_PPC64_DTPREL16	74 /* half16*	(sym+add)@dtprel */
++#define R_PPC64_DTPREL16_LO	75 /* half16	(sym+add)@dtprel@l */
++#define R_PPC64_DTPREL16_HI	76 /* half16	(sym+add)@dtprel@h */
++#define R_PPC64_DTPREL16_HA	77 /* half16	(sym+add)@dtprel@ha */
++#define R_PPC64_DTPREL64	78 /* doubleword64 (sym+add)@dtprel */
++#define R_PPC64_GOT_TLSGD16	79 /* half16*	(sym+add)@got@tlsgd */
++#define R_PPC64_GOT_TLSGD16_LO	80 /* half16	(sym+add)@got@tlsgd@l */
++#define R_PPC64_GOT_TLSGD16_HI	81 /* half16	(sym+add)@got@tlsgd@h */
++#define R_PPC64_GOT_TLSGD16_HA	82 /* half16	(sym+add)@got@tlsgd@ha */
++#define R_PPC64_GOT_TLSLD16	83 /* half16*	(sym+add)@got@tlsld */
++#define R_PPC64_GOT_TLSLD16_LO	84 /* half16	(sym+add)@got@tlsld@l */
++#define R_PPC64_GOT_TLSLD16_HI	85 /* half16	(sym+add)@got@tlsld@h */
++#define R_PPC64_GOT_TLSLD16_HA	86 /* half16	(sym+add)@got@tlsld@ha */
++#define R_PPC64_GOT_TPREL16_DS	87 /* half16ds*	(sym+add)@got@tprel */
++#define R_PPC64_GOT_TPREL16_LO_DS 88 /* half16ds (sym+add)@got@tprel@l */
++#define R_PPC64_GOT_TPREL16_HI	89 /* half16	(sym+add)@got@tprel@h */
++#define R_PPC64_GOT_TPREL16_HA	90 /* half16	(sym+add)@got@tprel@ha */
++#define R_PPC64_GOT_DTPREL16_DS	91 /* half16ds*	(sym+add)@got@dtprel */
++#define R_PPC64_GOT_DTPREL16_LO_DS 92 /* half16ds (sym+add)@got@dtprel@l */
++#define R_PPC64_GOT_DTPREL16_HI	93 /* half16	(sym+add)@got@dtprel@h */
++#define R_PPC64_GOT_DTPREL16_HA	94 /* half16	(sym+add)@got@dtprel@ha */
++#define R_PPC64_TPREL16_DS	95 /* half16ds*	(sym+add)@tprel */
++#define R_PPC64_TPREL16_LO_DS	96 /* half16ds	(sym+add)@tprel@l */
++#define R_PPC64_TPREL16_HIGHER	97 /* half16	(sym+add)@tprel@higher */
++#define R_PPC64_TPREL16_HIGHERA	98 /* half16	(sym+add)@tprel@highera */
++#define R_PPC64_TPREL16_HIGHEST	99 /* half16	(sym+add)@tprel@highest */
++#define R_PPC64_TPREL16_HIGHESTA 100 /* half16	(sym+add)@tprel@highesta */
++#define R_PPC64_DTPREL16_DS	101 /* half16ds* (sym+add)@dtprel */
++#define R_PPC64_DTPREL16_LO_DS	102 /* half16ds	(sym+add)@dtprel@l */
++#define R_PPC64_DTPREL16_HIGHER	103 /* half16	(sym+add)@dtprel@higher */
++#define R_PPC64_DTPREL16_HIGHERA 104 /* half16	(sym+add)@dtprel@highera */
++#define R_PPC64_DTPREL16_HIGHEST 105 /* half16	(sym+add)@dtprel@highest */
++#define R_PPC64_DTPREL16_HIGHESTA 106 /* half16	(sym+add)@dtprel@highesta */
++
++/* GNU extension to support local ifunc.  */
++#define R_PPC64_JMP_IREL	247
++#define R_PPC64_IRELATIVE	248
++#define R_PPC64_REL16		249	/* half16   (sym+add-.) */
++#define R_PPC64_REL16_LO	250	/* half16   (sym+add-.)@l */
++#define R_PPC64_REL16_HI	251	/* half16   (sym+add-.)@h */
++#define R_PPC64_REL16_HA	252	/* half16   (sym+add-.)@ha */
++
++/* PowerPC64 specific values for the Dyn d_tag field.  */
++#define DT_PPC64_GLINK  (DT_LOPROC + 0)
++#define DT_PPC64_OPD	(DT_LOPROC + 1)
++#define DT_PPC64_OPDSZ	(DT_LOPROC + 2)
++#define DT_PPC64_NUM    3
++
++
++/* ARM specific declarations */
++
++/* Processor specific flags for the ELF header e_flags field.  */
++#define EF_ARM_RELEXEC		0x01
++#define EF_ARM_HASENTRY		0x02
++#define EF_ARM_INTERWORK	0x04
++#define EF_ARM_APCS_26		0x08
++#define EF_ARM_APCS_FLOAT	0x10
++#define EF_ARM_PIC		0x20
++#define EF_ARM_ALIGN8		0x40 /* 8-bit structure alignment is in use */
++#define EF_ARM_NEW_ABI		0x80
++#define EF_ARM_OLD_ABI		0x100
++#define EF_ARM_SOFT_FLOAT	0x200
++#define EF_ARM_VFP_FLOAT	0x400
++#define EF_ARM_MAVERICK_FLOAT	0x800
++
++
++/* Other constants defined in the ARM ELF spec. version B-01.  */
++/* NB. These conflict with values defined above.  */
++#define EF_ARM_SYMSARESORTED	0x04
++#define EF_ARM_DYNSYMSUSESEGIDX	0x08
++#define EF_ARM_MAPSYMSFIRST	0x10
++#define EF_ARM_EABIMASK		0XFF000000
++
++/* Constants defined in AAELF.  */
++#define EF_ARM_BE8	    0x00800000
++#define EF_ARM_LE8	    0x00400000
++
++#define EF_ARM_EABI_VERSION(flags)	((flags) & EF_ARM_EABIMASK)
++#define EF_ARM_EABI_UNKNOWN	0x00000000
++#define EF_ARM_EABI_VER1	0x01000000
++#define EF_ARM_EABI_VER2	0x02000000
++#define EF_ARM_EABI_VER3	0x03000000
++#define EF_ARM_EABI_VER4	0x04000000
++#define EF_ARM_EABI_VER5	0x05000000
++
++/* Additional symbol types for Thumb.  */
++#define STT_ARM_TFUNC		STT_LOPROC /* A Thumb function.  */
++#define STT_ARM_16BIT		STT_HIPROC /* A Thumb label.  */
++
++/* ARM-specific values for sh_flags */
++#define SHF_ARM_ENTRYSECT	0x10000000 /* Section contains an entry point */
++#define SHF_ARM_COMDEF		0x80000000 /* Section may be multiply defined
++					      in the input to a link step.  */
++
++/* ARM-specific program header flags */
++#define PF_ARM_SB		0x10000000 /* Segment contains the location
++					      addressed by the static base. */
++#define PF_ARM_PI		0x20000000 /* Position-independent segment.  */
++#define PF_ARM_ABS		0x40000000 /* Absolute segment.  */
++
++/* Processor specific values for the Phdr p_type field.  */
++#define PT_ARM_EXIDX		(PT_LOPROC + 1)	/* ARM unwind segment.  */
++
++/* Processor specific values for the Shdr sh_type field.  */
++#define SHT_ARM_EXIDX		(SHT_LOPROC + 1) /* ARM unwind section.  */
++#define SHT_ARM_PREEMPTMAP	(SHT_LOPROC + 2) /* Preemption details.  */
++#define SHT_ARM_ATTRIBUTES	(SHT_LOPROC + 3) /* ARM attributes section.  */
++
++
++/* ARM relocs.  */
++
++#define R_ARM_NONE		0	/* No reloc */
++#define R_ARM_PC24		1	/* PC relative 26 bit branch */
++#define R_ARM_ABS32		2	/* Direct 32 bit  */
++#define R_ARM_REL32		3	/* PC relative 32 bit */
++#define R_ARM_PC13		4
++#define R_ARM_ABS16		5	/* Direct 16 bit */
++#define R_ARM_ABS12		6	/* Direct 12 bit */
++#define R_ARM_THM_ABS5		7
++#define R_ARM_ABS8		8	/* Direct 8 bit */
++#define R_ARM_SBREL32		9
++#define R_ARM_THM_PC22		10
++#define R_ARM_THM_PC8		11
++#define R_ARM_AMP_VCALL9	12
++#define R_ARM_SWI24		13	/* Obsolete static relocation.  */
++#define R_ARM_TLS_DESC		13      /* Dynamic relocation.  */
++#define R_ARM_THM_SWI8		14
++#define R_ARM_XPC25		15
++#define R_ARM_THM_XPC22		16
++#define R_ARM_TLS_DTPMOD32	17	/* ID of module containing symbol */
++#define R_ARM_TLS_DTPOFF32	18	/* Offset in TLS block */
++#define R_ARM_TLS_TPOFF32	19	/* Offset in static TLS block */
++#define R_ARM_COPY		20	/* Copy symbol at runtime */
++#define R_ARM_GLOB_DAT		21	/* Create GOT entry */
++#define R_ARM_JUMP_SLOT		22	/* Create PLT entry */
++#define R_ARM_RELATIVE		23	/* Adjust by program base */
++#define R_ARM_GOTOFF		24	/* 32 bit offset to GOT */
++#define R_ARM_GOTPC		25	/* 32 bit PC relative offset to GOT */
++#define R_ARM_GOT32		26	/* 32 bit GOT entry */
++#define R_ARM_PLT32		27	/* 32 bit PLT address */
++#define R_ARM_ALU_PCREL_7_0	32
++#define R_ARM_ALU_PCREL_15_8	33
++#define R_ARM_ALU_PCREL_23_15	34
++#define R_ARM_LDR_SBREL_11_0	35
++#define R_ARM_ALU_SBREL_19_12	36
++#define R_ARM_ALU_SBREL_27_20	37
++#define R_ARM_TLS_GOTDESC	90
++#define R_ARM_TLS_CALL		91
++#define R_ARM_TLS_DESCSEQ	92
++#define R_ARM_THM_TLS_CALL	93
++#define R_ARM_GNU_VTENTRY	100
++#define R_ARM_GNU_VTINHERIT	101
++#define R_ARM_THM_PC11		102	/* thumb unconditional branch */
++#define R_ARM_THM_PC9		103	/* thumb conditional branch */
++#define R_ARM_TLS_GD32		104	/* PC-rel 32 bit for global dynamic
++					   thread local data */
++#define R_ARM_TLS_LDM32		105	/* PC-rel 32 bit for local dynamic
++					   thread local data */
++#define R_ARM_TLS_LDO32		106	/* 32 bit offset relative to TLS
++					   block */
++#define R_ARM_TLS_IE32		107	/* PC-rel 32 bit for GOT entry of
++					   static TLS block offset */
++#define R_ARM_TLS_LE32		108	/* 32 bit offset relative to static
++					   TLS block */
++#define	R_ARM_THM_TLS_DESCSEQ	129
++#define R_ARM_IRELATIVE		160
++#define R_ARM_RXPC25		249
++#define R_ARM_RSBREL32		250
++#define R_ARM_THM_RPC22		251
++#define R_ARM_RREL32		252
++#define R_ARM_RABS22		253
++#define R_ARM_RPC24		254
++#define R_ARM_RBASE		255
++/* Keep this the last entry.  */
++#define R_ARM_NUM		256
++
++/* IA-64 specific declarations.  */
++
++/* Processor specific flags for the Ehdr e_flags field.  */
++#define EF_IA_64_MASKOS		0x0000000f	/* os-specific flags */
++#define EF_IA_64_ABI64		0x00000010	/* 64-bit ABI */
++#define EF_IA_64_ARCH		0xff000000	/* arch. version mask */
++
++/* Processor specific values for the Phdr p_type field.  */
++#define PT_IA_64_ARCHEXT	(PT_LOPROC + 0)	/* arch extension bits */
++#define PT_IA_64_UNWIND		(PT_LOPROC + 1)	/* ia64 unwind bits */
++#define PT_IA_64_HP_OPT_ANOT	(PT_LOOS + 0x12)
++#define PT_IA_64_HP_HSL_ANOT	(PT_LOOS + 0x13)
++#define PT_IA_64_HP_STACK	(PT_LOOS + 0x14)
++
++/* Processor specific flags for the Phdr p_flags field.  */
++#define PF_IA_64_NORECOV	0x80000000	/* spec insns w/o recovery */
++
++/* Processor specific values for the Shdr sh_type field.  */
++#define SHT_IA_64_EXT		(SHT_LOPROC + 0) /* extension bits */
++#define SHT_IA_64_UNWIND	(SHT_LOPROC + 1) /* unwind bits */
++
++/* Processor specific flags for the Shdr sh_flags field.  */
++#define SHF_IA_64_SHORT		0x10000000	/* section near gp */
++#define SHF_IA_64_NORECOV	0x20000000	/* spec insns w/o recovery */
++
++/* Processor specific values for the Dyn d_tag field.  */
++#define DT_IA_64_PLT_RESERVE	(DT_LOPROC + 0)
++#define DT_IA_64_NUM		1
++
++/* IA-64 relocations.  */
++#define R_IA64_NONE		0x00	/* none */
++#define R_IA64_IMM14		0x21	/* symbol + addend, add imm14 */
++#define R_IA64_IMM22		0x22	/* symbol + addend, add imm22 */
++#define R_IA64_IMM64		0x23	/* symbol + addend, mov imm64 */
++#define R_IA64_DIR32MSB		0x24	/* symbol + addend, data4 MSB */
++#define R_IA64_DIR32LSB		0x25	/* symbol + addend, data4 LSB */
++#define R_IA64_DIR64MSB		0x26	/* symbol + addend, data8 MSB */
++#define R_IA64_DIR64LSB		0x27	/* symbol + addend, data8 LSB */
++#define R_IA64_GPREL22		0x2a	/* @gprel(sym + add), add imm22 */
++#define R_IA64_GPREL64I		0x2b	/* @gprel(sym + add), mov imm64 */
++#define R_IA64_GPREL32MSB	0x2c	/* @gprel(sym + add), data4 MSB */
++#define R_IA64_GPREL32LSB	0x2d	/* @gprel(sym + add), data4 LSB */
++#define R_IA64_GPREL64MSB	0x2e	/* @gprel(sym + add), data8 MSB */
++#define R_IA64_GPREL64LSB	0x2f	/* @gprel(sym + add), data8 LSB */
++#define R_IA64_LTOFF22		0x32	/* @ltoff(sym + add), add imm22 */
++#define R_IA64_LTOFF64I		0x33	/* @ltoff(sym + add), mov imm64 */
++#define R_IA64_PLTOFF22		0x3a	/* @pltoff(sym + add), add imm22 */
++#define R_IA64_PLTOFF64I	0x3b	/* @pltoff(sym + add), mov imm64 */
++#define R_IA64_PLTOFF64MSB	0x3e	/* @pltoff(sym + add), data8 MSB */
++#define R_IA64_PLTOFF64LSB	0x3f	/* @pltoff(sym + add), data8 LSB */
++#define R_IA64_FPTR64I		0x43	/* @fptr(sym + add), mov imm64 */
++#define R_IA64_FPTR32MSB	0x44	/* @fptr(sym + add), data4 MSB */
++#define R_IA64_FPTR32LSB	0x45	/* @fptr(sym + add), data4 LSB */
++#define R_IA64_FPTR64MSB	0x46	/* @fptr(sym + add), data8 MSB */
++#define R_IA64_FPTR64LSB	0x47	/* @fptr(sym + add), data8 LSB */
++#define R_IA64_PCREL60B		0x48	/* @pcrel(sym + add), brl */
++#define R_IA64_PCREL21B		0x49	/* @pcrel(sym + add), ptb, call */
++#define R_IA64_PCREL21M		0x4a	/* @pcrel(sym + add), chk.s */
++#define R_IA64_PCREL21F		0x4b	/* @pcrel(sym + add), fchkf */
++#define R_IA64_PCREL32MSB	0x4c	/* @pcrel(sym + add), data4 MSB */
++#define R_IA64_PCREL32LSB	0x4d	/* @pcrel(sym + add), data4 LSB */
++#define R_IA64_PCREL64MSB	0x4e	/* @pcrel(sym + add), data8 MSB */
++#define R_IA64_PCREL64LSB	0x4f	/* @pcrel(sym + add), data8 LSB */
++#define R_IA64_LTOFF_FPTR22	0x52	/* @ltoff(@fptr(s+a)), imm22 */
++#define R_IA64_LTOFF_FPTR64I	0x53	/* @ltoff(@fptr(s+a)), imm64 */
++#define R_IA64_LTOFF_FPTR32MSB	0x54	/* @ltoff(@fptr(s+a)), data4 MSB */
++#define R_IA64_LTOFF_FPTR32LSB	0x55	/* @ltoff(@fptr(s+a)), data4 LSB */
++#define R_IA64_LTOFF_FPTR64MSB	0x56	/* @ltoff(@fptr(s+a)), data8 MSB */
++#define R_IA64_LTOFF_FPTR64LSB	0x57	/* @ltoff(@fptr(s+a)), data8 LSB */
++#define R_IA64_SEGREL32MSB	0x5c	/* @segrel(sym + add), data4 MSB */
++#define R_IA64_SEGREL32LSB	0x5d	/* @segrel(sym + add), data4 LSB */
++#define R_IA64_SEGREL64MSB	0x5e	/* @segrel(sym + add), data8 MSB */
++#define R_IA64_SEGREL64LSB	0x5f	/* @segrel(sym + add), data8 LSB */
++#define R_IA64_SECREL32MSB	0x64	/* @secrel(sym + add), data4 MSB */
++#define R_IA64_SECREL32LSB	0x65	/* @secrel(sym + add), data4 LSB */
++#define R_IA64_SECREL64MSB	0x66	/* @secrel(sym + add), data8 MSB */
++#define R_IA64_SECREL64LSB	0x67	/* @secrel(sym + add), data8 LSB */
++#define R_IA64_REL32MSB		0x6c	/* data 4 + REL */
++#define R_IA64_REL32LSB		0x6d	/* data 4 + REL */
++#define R_IA64_REL64MSB		0x6e	/* data 8 + REL */
++#define R_IA64_REL64LSB		0x6f	/* data 8 + REL */
++#define R_IA64_LTV32MSB		0x74	/* symbol + addend, data4 MSB */
++#define R_IA64_LTV32LSB		0x75	/* symbol + addend, data4 LSB */
++#define R_IA64_LTV64MSB		0x76	/* symbol + addend, data8 MSB */
++#define R_IA64_LTV64LSB		0x77	/* symbol + addend, data8 LSB */
++#define R_IA64_PCREL21BI	0x79	/* @pcrel(sym + add), 21bit inst */
++#define R_IA64_PCREL22		0x7a	/* @pcrel(sym + add), 22bit inst */
++#define R_IA64_PCREL64I		0x7b	/* @pcrel(sym + add), 64bit inst */
++#define R_IA64_IPLTMSB		0x80	/* dynamic reloc, imported PLT, MSB */
++#define R_IA64_IPLTLSB		0x81	/* dynamic reloc, imported PLT, LSB */
++#define R_IA64_COPY		0x84	/* copy relocation */
++#define R_IA64_SUB		0x85	/* Addend and symbol difference */
++#define R_IA64_LTOFF22X		0x86	/* LTOFF22, relaxable.  */
++#define R_IA64_LDXMOV		0x87	/* Use of LTOFF22X.  */
++#define R_IA64_TPREL14		0x91	/* @tprel(sym + add), imm14 */
++#define R_IA64_TPREL22		0x92	/* @tprel(sym + add), imm22 */
++#define R_IA64_TPREL64I		0x93	/* @tprel(sym + add), imm64 */
++#define R_IA64_TPREL64MSB	0x96	/* @tprel(sym + add), data8 MSB */
++#define R_IA64_TPREL64LSB	0x97	/* @tprel(sym + add), data8 LSB */
++#define R_IA64_LTOFF_TPREL22	0x9a	/* @ltoff(@tprel(s+a)), imm2 */
++#define R_IA64_DTPMOD64MSB	0xa6	/* @dtpmod(sym + add), data8 MSB */
++#define R_IA64_DTPMOD64LSB	0xa7	/* @dtpmod(sym + add), data8 LSB */
++#define R_IA64_LTOFF_DTPMOD22	0xaa	/* @ltoff(@dtpmod(sym + add)), imm22 */
++#define R_IA64_DTPREL14		0xb1	/* @dtprel(sym + add), imm14 */
++#define R_IA64_DTPREL22		0xb2	/* @dtprel(sym + add), imm22 */
++#define R_IA64_DTPREL64I	0xb3	/* @dtprel(sym + add), imm64 */
++#define R_IA64_DTPREL32MSB	0xb4	/* @dtprel(sym + add), data4 MSB */
++#define R_IA64_DTPREL32LSB	0xb5	/* @dtprel(sym + add), data4 LSB */
++#define R_IA64_DTPREL64MSB	0xb6	/* @dtprel(sym + add), data8 MSB */
++#define R_IA64_DTPREL64LSB	0xb7	/* @dtprel(sym + add), data8 LSB */
++#define R_IA64_LTOFF_DTPREL22	0xba	/* @ltoff(@dtprel(s+a)), imm22 */
++
++/* SH specific declarations */
++
++/* Processor specific flags for the ELF header e_flags field.  */
++#define EF_SH_MACH_MASK		0x1f
++#define EF_SH_UNKNOWN		0x0
++#define EF_SH1			0x1
++#define EF_SH2			0x2
++#define EF_SH3			0x3
++#define EF_SH_DSP		0x4
++#define EF_SH3_DSP		0x5
++#define EF_SH4AL_DSP		0x6
++#define EF_SH3E			0x8
++#define EF_SH4			0x9
++#define EF_SH2E			0xb
++#define EF_SH4A			0xc
++#define EF_SH2A			0xd
++#define EF_SH4_NOFPU		0x10
++#define EF_SH4A_NOFPU		0x11
++#define EF_SH4_NOMMU_NOFPU	0x12
++#define EF_SH2A_NOFPU		0x13
++#define EF_SH3_NOMMU		0x14
++#define EF_SH2A_SH4_NOFPU	0x15
++#define EF_SH2A_SH3_NOFPU	0x16
++#define EF_SH2A_SH4		0x17
++#define EF_SH2A_SH3E		0x18
++
++/* SH relocs.  */
++#define	R_SH_NONE		0
++#define	R_SH_DIR32		1
++#define	R_SH_REL32		2
++#define	R_SH_DIR8WPN		3
++#define	R_SH_IND12W		4
++#define	R_SH_DIR8WPL		5
++#define	R_SH_DIR8WPZ		6
++#define	R_SH_DIR8BP		7
++#define	R_SH_DIR8W		8
++#define	R_SH_DIR8L		9
++#define	R_SH_SWITCH16		25
++#define	R_SH_SWITCH32		26
++#define	R_SH_USES		27
++#define	R_SH_COUNT		28
++#define	R_SH_ALIGN		29
++#define	R_SH_CODE		30
++#define	R_SH_DATA		31
++#define	R_SH_LABEL		32
++#define	R_SH_SWITCH8		33
++#define	R_SH_GNU_VTINHERIT	34
++#define	R_SH_GNU_VTENTRY	35
++#define	R_SH_TLS_GD_32		144
++#define	R_SH_TLS_LD_32		145
++#define	R_SH_TLS_LDO_32		146
++#define	R_SH_TLS_IE_32		147
++#define	R_SH_TLS_LE_32		148
++#define	R_SH_TLS_DTPMOD32	149
++#define	R_SH_TLS_DTPOFF32	150
++#define	R_SH_TLS_TPOFF32	151
++#define	R_SH_GOT32		160
++#define	R_SH_PLT32		161
++#define	R_SH_COPY		162
++#define	R_SH_GLOB_DAT		163
++#define	R_SH_JMP_SLOT		164
++#define	R_SH_RELATIVE		165
++#define	R_SH_GOTOFF		166
++#define	R_SH_GOTPC		167
++/* Keep this the last entry.  */
++#define	R_SH_NUM		256
++
++/* S/390 specific definitions.  */
++
++/* Valid values for the e_flags field.  */
++
++#define EF_S390_HIGH_GPRS    0x00000001  /* High GPRs kernel facility needed.  */
++
++/* Additional s390 relocs */
++
++#define R_390_NONE		0	/* No reloc.  */
++#define R_390_8			1	/* Direct 8 bit.  */
++#define R_390_12		2	/* Direct 12 bit.  */
++#define R_390_16		3	/* Direct 16 bit.  */
++#define R_390_32		4	/* Direct 32 bit.  */
++#define R_390_PC32		5	/* PC relative 32 bit.	*/
++#define R_390_GOT12		6	/* 12 bit GOT offset.  */
++#define R_390_GOT32		7	/* 32 bit GOT offset.  */
++#define R_390_PLT32		8	/* 32 bit PC relative PLT address.  */
++#define R_390_COPY		9	/* Copy symbol at runtime.  */
++#define R_390_GLOB_DAT		10	/* Create GOT entry.  */
++#define R_390_JMP_SLOT		11	/* Create PLT entry.  */
++#define R_390_RELATIVE		12	/* Adjust by program base.  */
++#define R_390_GOTOFF32		13	/* 32 bit offset to GOT.	 */
++#define R_390_GOTPC		14	/* 32 bit PC relative offset to GOT.  */
++#define R_390_GOT16		15	/* 16 bit GOT offset.  */
++#define R_390_PC16		16	/* PC relative 16 bit.	*/
++#define R_390_PC16DBL		17	/* PC relative 16 bit shifted by 1.  */
++#define R_390_PLT16DBL		18	/* 16 bit PC rel. PLT shifted by 1.  */
++#define R_390_PC32DBL		19	/* PC relative 32 bit shifted by 1.  */
++#define R_390_PLT32DBL		20	/* 32 bit PC rel. PLT shifted by 1.  */
++#define R_390_GOTPCDBL		21	/* 32 bit PC rel. GOT shifted by 1.  */
++#define R_390_64		22	/* Direct 64 bit.  */
++#define R_390_PC64		23	/* PC relative 64 bit.	*/
++#define R_390_GOT64		24	/* 64 bit GOT offset.  */
++#define R_390_PLT64		25	/* 64 bit PC relative PLT address.  */
++#define R_390_GOTENT		26	/* 32 bit PC rel. to GOT entry >> 1. */
++#define R_390_GOTOFF16		27	/* 16 bit offset to GOT. */
++#define R_390_GOTOFF64		28	/* 64 bit offset to GOT. */
++#define R_390_GOTPLT12		29	/* 12 bit offset to jump slot.	*/
++#define R_390_GOTPLT16		30	/* 16 bit offset to jump slot.	*/
++#define R_390_GOTPLT32		31	/* 32 bit offset to jump slot.	*/
++#define R_390_GOTPLT64		32	/* 64 bit offset to jump slot.	*/
++#define R_390_GOTPLTENT		33	/* 32 bit rel. offset to jump slot.  */
++#define R_390_PLTOFF16		34	/* 16 bit offset from GOT to PLT. */
++#define R_390_PLTOFF32		35	/* 32 bit offset from GOT to PLT. */
++#define R_390_PLTOFF64		36	/* 16 bit offset from GOT to PLT. */
++#define R_390_TLS_LOAD		37	/* Tag for load insn in TLS code.  */
++#define R_390_TLS_GDCALL	38	/* Tag for function call in general
++					   dynamic TLS code. */
++#define R_390_TLS_LDCALL	39	/* Tag for function call in local
++					   dynamic TLS code. */
++#define R_390_TLS_GD32		40	/* Direct 32 bit for general dynamic
++					   thread local data.  */
++#define R_390_TLS_GD64		41	/* Direct 64 bit for general dynamic
++					  thread local data.  */
++#define R_390_TLS_GOTIE12	42	/* 12 bit GOT offset for static TLS
++					   block offset.  */
++#define R_390_TLS_GOTIE32	43	/* 32 bit GOT offset for static TLS
++					   block offset.  */
++#define R_390_TLS_GOTIE64	44	/* 64 bit GOT offset for static TLS
++					   block offset. */
++#define R_390_TLS_LDM32		45	/* Direct 32 bit for local dynamic
++					   thread local data in LE code.  */
++#define R_390_TLS_LDM64		46	/* Direct 64 bit for local dynamic
++					   thread local data in LE code.  */
++#define R_390_TLS_IE32		47	/* 32 bit address of GOT entry for
++					   negated static TLS block offset.  */
++#define R_390_TLS_IE64		48	/* 64 bit address of GOT entry for
++					   negated static TLS block offset.  */
++#define R_390_TLS_IEENT		49	/* 32 bit rel. offset to GOT entry for
++					   negated static TLS block offset.  */
++#define R_390_TLS_LE32		50	/* 32 bit negated offset relative to
++					   static TLS block.  */
++#define R_390_TLS_LE64		51	/* 64 bit negated offset relative to
++					   static TLS block.  */
++#define R_390_TLS_LDO32		52	/* 32 bit offset relative to TLS
++					   block.  */
++#define R_390_TLS_LDO64		53	/* 64 bit offset relative to TLS
++					   block.  */
++#define R_390_TLS_DTPMOD	54	/* ID of module containing symbol.  */
++#define R_390_TLS_DTPOFF	55	/* Offset in TLS block.	 */
++#define R_390_TLS_TPOFF		56	/* Negated offset in static TLS
++					   block.  */
++#define R_390_20		57	/* Direct 20 bit.  */
++#define R_390_GOT20		58	/* 20 bit GOT offset.  */
++#define R_390_GOTPLT20		59	/* 20 bit offset to jump slot.  */
++#define R_390_TLS_GOTIE20	60	/* 20 bit GOT offset for static TLS
++					   block offset.  */
++#define R_390_IRELATIVE         61      /* STT_GNU_IFUNC relocation.  */
++/* Keep this the last entry.  */
++#define R_390_NUM		62
++
++
++/* CRIS relocations.  */
++#define R_CRIS_NONE		0
++#define R_CRIS_8		1
++#define R_CRIS_16		2
++#define R_CRIS_32		3
++#define R_CRIS_8_PCREL		4
++#define R_CRIS_16_PCREL		5
++#define R_CRIS_32_PCREL		6
++#define R_CRIS_GNU_VTINHERIT	7
++#define R_CRIS_GNU_VTENTRY	8
++#define R_CRIS_COPY		9
++#define R_CRIS_GLOB_DAT		10
++#define R_CRIS_JUMP_SLOT	11
++#define R_CRIS_RELATIVE		12
++#define R_CRIS_16_GOT		13
++#define R_CRIS_32_GOT		14
++#define R_CRIS_16_GOTPLT	15
++#define R_CRIS_32_GOTPLT	16
++#define R_CRIS_32_GOTREL	17
++#define R_CRIS_32_PLT_GOTREL	18
++#define R_CRIS_32_PLT_PCREL	19
++
++#define R_CRIS_NUM		20
++
++
++/* AMD x86-64 relocations.  */
++#define R_X86_64_NONE		0	/* No reloc */
++#define R_X86_64_64		1	/* Direct 64 bit  */
++#define R_X86_64_PC32		2	/* PC relative 32 bit signed */
++#define R_X86_64_GOT32		3	/* 32 bit GOT entry */
++#define R_X86_64_PLT32		4	/* 32 bit PLT address */
++#define R_X86_64_COPY		5	/* Copy symbol at runtime */
++#define R_X86_64_GLOB_DAT	6	/* Create GOT entry */
++#define R_X86_64_JUMP_SLOT	7	/* Create PLT entry */
++#define R_X86_64_RELATIVE	8	/* Adjust by program base */
++#define R_X86_64_GOTPCREL	9	/* 32 bit signed PC relative
++					   offset to GOT */
++#define R_X86_64_32		10	/* Direct 32 bit zero extended */
++#define R_X86_64_32S		11	/* Direct 32 bit sign extended */
++#define R_X86_64_16		12	/* Direct 16 bit zero extended */
++#define R_X86_64_PC16		13	/* 16 bit sign extended pc relative */
++#define R_X86_64_8		14	/* Direct 8 bit sign extended  */
++#define R_X86_64_PC8		15	/* 8 bit sign extended pc relative */
++#define R_X86_64_DTPMOD64	16	/* ID of module containing symbol */
++#define R_X86_64_DTPOFF64	17	/* Offset in module's TLS block */
++#define R_X86_64_TPOFF64	18	/* Offset in initial TLS block */
++#define R_X86_64_TLSGD		19	/* 32 bit signed PC relative offset
++					   to two GOT entries for GD symbol */
++#define R_X86_64_TLSLD		20	/* 32 bit signed PC relative offset
++					   to two GOT entries for LD symbol */
++#define R_X86_64_DTPOFF32	21	/* Offset in TLS block */
++#define R_X86_64_GOTTPOFF	22	/* 32 bit signed PC relative offset
++					   to GOT entry for IE symbol */
++#define R_X86_64_TPOFF32	23	/* Offset in initial TLS block */
++#define R_X86_64_PC64		24	/* PC relative 64 bit */
++#define R_X86_64_GOTOFF64	25	/* 64 bit offset to GOT */
++#define R_X86_64_GOTPC32	26	/* 32 bit signed pc relative
++					   offset to GOT */
++#define R_X86_64_GOT64		27	/* 64-bit GOT entry offset */
++#define R_X86_64_GOTPCREL64	28	/* 64-bit PC relative offset
++					   to GOT entry */
++#define R_X86_64_GOTPC64	29	/* 64-bit PC relative offset to GOT */
++#define R_X86_64_GOTPLT64	30 	/* like GOT64, says PLT entry needed */
++#define R_X86_64_PLTOFF64	31	/* 64-bit GOT relative offset
++					   to PLT entry */
++#define R_X86_64_SIZE32		32	/* Size of symbol plus 32-bit addend */
++#define R_X86_64_SIZE64		33	/* Size of symbol plus 64-bit addend */
++#define R_X86_64_GOTPC32_TLSDESC 34	/* GOT offset for TLS descriptor.  */
++#define R_X86_64_TLSDESC_CALL   35	/* Marker for call through TLS
++					   descriptor.  */
++#define R_X86_64_TLSDESC        36	/* TLS descriptor.  */
++#define R_X86_64_IRELATIVE	37	/* Adjust indirectly by program base */
++#define R_X86_64_RELATIVE64	38	/* 64-bit adjust by program base */
++
++#define R_X86_64_NUM		39
++
++
++/* AM33 relocations.  */
++#define R_MN10300_NONE		0	/* No reloc.  */
++#define R_MN10300_32		1	/* Direct 32 bit.  */
++#define R_MN10300_16		2	/* Direct 16 bit.  */
++#define R_MN10300_8		3	/* Direct 8 bit.  */
++#define R_MN10300_PCREL32	4	/* PC-relative 32-bit.  */
++#define R_MN10300_PCREL16	5	/* PC-relative 16-bit signed.  */
++#define R_MN10300_PCREL8	6	/* PC-relative 8-bit signed.  */
++#define R_MN10300_GNU_VTINHERIT	7	/* Ancient C++ vtable garbage... */
++#define R_MN10300_GNU_VTENTRY	8	/* ... collection annotation.  */
++#define R_MN10300_24		9	/* Direct 24 bit.  */
++#define R_MN10300_GOTPC32	10	/* 32-bit PCrel offset to GOT.  */
++#define R_MN10300_GOTPC16	11	/* 16-bit PCrel offset to GOT.  */
++#define R_MN10300_GOTOFF32	12	/* 32-bit offset from GOT.  */
++#define R_MN10300_GOTOFF24	13	/* 24-bit offset from GOT.  */
++#define R_MN10300_GOTOFF16	14	/* 16-bit offset from GOT.  */
++#define R_MN10300_PLT32		15	/* 32-bit PCrel to PLT entry.  */
++#define R_MN10300_PLT16		16	/* 16-bit PCrel to PLT entry.  */
++#define R_MN10300_GOT32		17	/* 32-bit offset to GOT entry.  */
++#define R_MN10300_GOT24		18	/* 24-bit offset to GOT entry.  */
++#define R_MN10300_GOT16		19	/* 16-bit offset to GOT entry.  */
++#define R_MN10300_COPY		20	/* Copy symbol at runtime.  */
++#define R_MN10300_GLOB_DAT	21	/* Create GOT entry.  */
++#define R_MN10300_JMP_SLOT	22	/* Create PLT entry.  */
++#define R_MN10300_RELATIVE	23	/* Adjust by program base.  */
++
++#define R_MN10300_NUM		24
++
++
++/* M32R relocs.  */
++#define R_M32R_NONE		0	/* No reloc. */
++#define R_M32R_16		1	/* Direct 16 bit. */
++#define R_M32R_32		2	/* Direct 32 bit. */
++#define R_M32R_24		3	/* Direct 24 bit. */
++#define R_M32R_10_PCREL		4	/* PC relative 10 bit shifted. */
++#define R_M32R_18_PCREL		5	/* PC relative 18 bit shifted. */
++#define R_M32R_26_PCREL		6	/* PC relative 26 bit shifted. */
++#define R_M32R_HI16_ULO		7	/* High 16 bit with unsigned low. */
++#define R_M32R_HI16_SLO		8	/* High 16 bit with signed low. */
++#define R_M32R_LO16		9	/* Low 16 bit. */
++#define R_M32R_SDA16		10	/* 16 bit offset in SDA. */
++#define R_M32R_GNU_VTINHERIT	11
++#define R_M32R_GNU_VTENTRY	12
++/* M32R relocs use SHT_RELA.  */
++#define R_M32R_16_RELA		33	/* Direct 16 bit. */
++#define R_M32R_32_RELA		34	/* Direct 32 bit. */
++#define R_M32R_24_RELA		35	/* Direct 24 bit. */
++#define R_M32R_10_PCREL_RELA	36	/* PC relative 10 bit shifted. */
++#define R_M32R_18_PCREL_RELA	37	/* PC relative 18 bit shifted. */
++#define R_M32R_26_PCREL_RELA	38	/* PC relative 26 bit shifted. */
++#define R_M32R_HI16_ULO_RELA	39	/* High 16 bit with unsigned low */
++#define R_M32R_HI16_SLO_RELA	40	/* High 16 bit with signed low */
++#define R_M32R_LO16_RELA	41	/* Low 16 bit */
++#define R_M32R_SDA16_RELA	42	/* 16 bit offset in SDA */
++#define R_M32R_RELA_GNU_VTINHERIT	43
++#define R_M32R_RELA_GNU_VTENTRY	44
++#define R_M32R_REL32		45	/* PC relative 32 bit.  */
++
++#define R_M32R_GOT24		48	/* 24 bit GOT entry */
++#define R_M32R_26_PLTREL	49	/* 26 bit PC relative to PLT shifted */
++#define R_M32R_COPY		50	/* Copy symbol at runtime */
++#define R_M32R_GLOB_DAT		51	/* Create GOT entry */
++#define R_M32R_JMP_SLOT		52	/* Create PLT entry */
++#define R_M32R_RELATIVE		53	/* Adjust by program base */
++#define R_M32R_GOTOFF		54	/* 24 bit offset to GOT */
++#define R_M32R_GOTPC24		55	/* 24 bit PC relative offset to GOT */
++#define R_M32R_GOT16_HI_ULO	56	/* High 16 bit GOT entry with unsigned
++					   low */
++#define R_M32R_GOT16_HI_SLO	57	/* High 16 bit GOT entry with signed
++					   low */
++#define R_M32R_GOT16_LO		58	/* Low 16 bit GOT entry */
++#define R_M32R_GOTPC_HI_ULO	59	/* High 16 bit PC relative offset to
++					   GOT with unsigned low */
++#define R_M32R_GOTPC_HI_SLO	60	/* High 16 bit PC relative offset to
++					   GOT with signed low */
++#define R_M32R_GOTPC_LO		61	/* Low 16 bit PC relative offset to
++					   GOT */
++#define R_M32R_GOTOFF_HI_ULO	62	/* High 16 bit offset to GOT
++					   with unsigned low */
++#define R_M32R_GOTOFF_HI_SLO	63	/* High 16 bit offset to GOT
++					   with signed low */
++#define R_M32R_GOTOFF_LO	64	/* Low 16 bit offset to GOT */
++#define R_M32R_NUM		256	/* Keep this the last entry. */
++
++
++/* TILEPro relocations.  */
++#define R_TILEPRO_NONE		0	/* No reloc */
++#define R_TILEPRO_32		1	/* Direct 32 bit */
++#define R_TILEPRO_16		2	/* Direct 16 bit */
++#define R_TILEPRO_8		3	/* Direct 8 bit */
++#define R_TILEPRO_32_PCREL	4	/* PC relative 32 bit */
++#define R_TILEPRO_16_PCREL	5	/* PC relative 16 bit */
++#define R_TILEPRO_8_PCREL	6	/* PC relative 8 bit */
++#define R_TILEPRO_LO16		7	/* Low 16 bit */
++#define R_TILEPRO_HI16		8	/* High 16 bit */
++#define R_TILEPRO_HA16		9	/* High 16 bit, adjusted */
++#define R_TILEPRO_COPY		10	/* Copy relocation */
++#define R_TILEPRO_GLOB_DAT	11	/* Create GOT entry */
++#define R_TILEPRO_JMP_SLOT	12	/* Create PLT entry */
++#define R_TILEPRO_RELATIVE	13	/* Adjust by program base */
++#define R_TILEPRO_BROFF_X1	14	/* X1 pipe branch offset */
++#define R_TILEPRO_JOFFLONG_X1	15	/* X1 pipe jump offset */
++#define R_TILEPRO_JOFFLONG_X1_PLT 16	/* X1 pipe jump offset to PLT */
++#define R_TILEPRO_IMM8_X0	17	/* X0 pipe 8-bit */
++#define R_TILEPRO_IMM8_Y0	18	/* Y0 pipe 8-bit */
++#define R_TILEPRO_IMM8_X1	19	/* X1 pipe 8-bit */
++#define R_TILEPRO_IMM8_Y1	20	/* Y1 pipe 8-bit */
++#define R_TILEPRO_MT_IMM15_X1	21	/* X1 pipe mtspr */
++#define R_TILEPRO_MF_IMM15_X1	22	/* X1 pipe mfspr */
++#define R_TILEPRO_IMM16_X0	23	/* X0 pipe 16-bit */
++#define R_TILEPRO_IMM16_X1	24	/* X1 pipe 16-bit */
++#define R_TILEPRO_IMM16_X0_LO	25	/* X0 pipe low 16-bit */
++#define R_TILEPRO_IMM16_X1_LO	26	/* X1 pipe low 16-bit */
++#define R_TILEPRO_IMM16_X0_HI	27	/* X0 pipe high 16-bit */
++#define R_TILEPRO_IMM16_X1_HI	28	/* X1 pipe high 16-bit */
++#define R_TILEPRO_IMM16_X0_HA	29	/* X0 pipe high 16-bit, adjusted */
++#define R_TILEPRO_IMM16_X1_HA	30	/* X1 pipe high 16-bit, adjusted */
++#define R_TILEPRO_IMM16_X0_PCREL 31	/* X0 pipe PC relative 16 bit */
++#define R_TILEPRO_IMM16_X1_PCREL 32	/* X1 pipe PC relative 16 bit */
++#define R_TILEPRO_IMM16_X0_LO_PCREL 33	/* X0 pipe PC relative low 16 bit */
++#define R_TILEPRO_IMM16_X1_LO_PCREL 34	/* X1 pipe PC relative low 16 bit */
++#define R_TILEPRO_IMM16_X0_HI_PCREL 35	/* X0 pipe PC relative high 16 bit */
++#define R_TILEPRO_IMM16_X1_HI_PCREL 36	/* X1 pipe PC relative high 16 bit */
++#define R_TILEPRO_IMM16_X0_HA_PCREL 37	/* X0 pipe PC relative ha() 16 bit */
++#define R_TILEPRO_IMM16_X1_HA_PCREL 38	/* X1 pipe PC relative ha() 16 bit */
++#define R_TILEPRO_IMM16_X0_GOT	39	/* X0 pipe 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X1_GOT	40	/* X1 pipe 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X0_GOT_LO 41	/* X0 pipe low 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X1_GOT_LO 42	/* X1 pipe low 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X0_GOT_HI 43	/* X0 pipe high 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X1_GOT_HI 44	/* X1 pipe high 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X0_GOT_HA 45	/* X0 pipe ha() 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X1_GOT_HA 46	/* X1 pipe ha() 16-bit GOT offset */
++#define R_TILEPRO_MMSTART_X0	47	/* X0 pipe mm "start" */
++#define R_TILEPRO_MMEND_X0	48	/* X0 pipe mm "end" */
++#define R_TILEPRO_MMSTART_X1	49	/* X1 pipe mm "start" */
++#define R_TILEPRO_MMEND_X1	50	/* X1 pipe mm "end" */
++#define R_TILEPRO_SHAMT_X0	51	/* X0 pipe shift amount */
++#define R_TILEPRO_SHAMT_X1	52	/* X1 pipe shift amount */
++#define R_TILEPRO_SHAMT_Y0	53	/* Y0 pipe shift amount */
++#define R_TILEPRO_SHAMT_Y1	54	/* Y1 pipe shift amount */
++#define R_TILEPRO_DEST_IMM8_X1	55	/* X1 pipe destination 8-bit */
++/* Relocs 56-59 are currently not defined.  */
++#define R_TILEPRO_TLS_GD_CALL	60	/* "jal" for TLS GD */
++#define R_TILEPRO_IMM8_X0_TLS_GD_ADD 61	/* X0 pipe "addi" for TLS GD */
++#define R_TILEPRO_IMM8_X1_TLS_GD_ADD 62	/* X1 pipe "addi" for TLS GD */
++#define R_TILEPRO_IMM8_Y0_TLS_GD_ADD 63	/* Y0 pipe "addi" for TLS GD */
++#define R_TILEPRO_IMM8_Y1_TLS_GD_ADD 64	/* Y1 pipe "addi" for TLS GD */
++#define R_TILEPRO_TLS_IE_LOAD	65	/* "lw_tls" for TLS IE */
++#define R_TILEPRO_IMM16_X0_TLS_GD 66	/* X0 pipe 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X1_TLS_GD 67	/* X1 pipe 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X0_TLS_GD_LO 68	/* X0 pipe low 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X1_TLS_GD_LO 69	/* X1 pipe low 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X0_TLS_GD_HI 70	/* X0 pipe high 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X1_TLS_GD_HI 71	/* X1 pipe high 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X0_TLS_GD_HA 72	/* X0 pipe ha() 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X1_TLS_GD_HA 73	/* X1 pipe ha() 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X0_TLS_IE 74	/* X0 pipe 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X1_TLS_IE 75	/* X1 pipe 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X0_TLS_IE_LO 76	/* X0 pipe low 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X1_TLS_IE_LO 77	/* X1 pipe low 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X0_TLS_IE_HI 78	/* X0 pipe high 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X1_TLS_IE_HI 79	/* X1 pipe high 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X0_TLS_IE_HA 80	/* X0 pipe ha() 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X1_TLS_IE_HA 81	/* X1 pipe ha() 16-bit TLS IE offset */
++#define R_TILEPRO_TLS_DTPMOD32	82	/* ID of module containing symbol */
++#define R_TILEPRO_TLS_DTPOFF32	83	/* Offset in TLS block */
++#define R_TILEPRO_TLS_TPOFF32	84	/* Offset in static TLS block */
++#define R_TILEPRO_IMM16_X0_TLS_LE 85	/* X0 pipe 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X1_TLS_LE 86	/* X1 pipe 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X0_TLS_LE_LO 87	/* X0 pipe low 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X1_TLS_LE_LO 88	/* X1 pipe low 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X0_TLS_LE_HI 89	/* X0 pipe high 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X1_TLS_LE_HI 90	/* X1 pipe high 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X0_TLS_LE_HA 91	/* X0 pipe ha() 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X1_TLS_LE_HA 92	/* X1 pipe ha() 16-bit TLS LE offset */
++
++#define R_TILEPRO_GNU_VTINHERIT	128	/* GNU C++ vtable hierarchy */
++#define R_TILEPRO_GNU_VTENTRY	129	/* GNU C++ vtable member usage */
++
++#define R_TILEPRO_NUM		130
++
++
++/* TILE-Gx relocations.  */
++#define R_TILEGX_NONE		0	/* No reloc */
++#define R_TILEGX_64		1	/* Direct 64 bit */
++#define R_TILEGX_32		2	/* Direct 32 bit */
++#define R_TILEGX_16		3	/* Direct 16 bit */
++#define R_TILEGX_8		4	/* Direct 8 bit */
++#define R_TILEGX_64_PCREL	5	/* PC relative 64 bit */
++#define R_TILEGX_32_PCREL	6	/* PC relative 32 bit */
++#define R_TILEGX_16_PCREL	7	/* PC relative 16 bit */
++#define R_TILEGX_8_PCREL	8	/* PC relative 8 bit */
++#define R_TILEGX_HW0		9	/* hword 0 16-bit */
++#define R_TILEGX_HW1		10	/* hword 1 16-bit */
++#define R_TILEGX_HW2		11	/* hword 2 16-bit */
++#define R_TILEGX_HW3		12	/* hword 3 16-bit */
++#define R_TILEGX_HW0_LAST	13	/* last hword 0 16-bit */
++#define R_TILEGX_HW1_LAST	14	/* last hword 1 16-bit */
++#define R_TILEGX_HW2_LAST	15	/* last hword 2 16-bit */
++#define R_TILEGX_COPY		16	/* Copy relocation */
++#define R_TILEGX_GLOB_DAT	17	/* Create GOT entry */
++#define R_TILEGX_JMP_SLOT	18	/* Create PLT entry */
++#define R_TILEGX_RELATIVE	19	/* Adjust by program base */
++#define R_TILEGX_BROFF_X1	20	/* X1 pipe branch offset */
++#define R_TILEGX_JUMPOFF_X1	21	/* X1 pipe jump offset */
++#define R_TILEGX_JUMPOFF_X1_PLT	22	/* X1 pipe jump offset to PLT */
++#define R_TILEGX_IMM8_X0	23	/* X0 pipe 8-bit */
++#define R_TILEGX_IMM8_Y0	24	/* Y0 pipe 8-bit */
++#define R_TILEGX_IMM8_X1	25	/* X1 pipe 8-bit */
++#define R_TILEGX_IMM8_Y1	26	/* Y1 pipe 8-bit */
++#define R_TILEGX_DEST_IMM8_X1	27	/* X1 pipe destination 8-bit */
++#define R_TILEGX_MT_IMM14_X1	28	/* X1 pipe mtspr */
++#define R_TILEGX_MF_IMM14_X1	29	/* X1 pipe mfspr */
++#define R_TILEGX_MMSTART_X0	30	/* X0 pipe mm "start" */
++#define R_TILEGX_MMEND_X0	31	/* X0 pipe mm "end" */
++#define R_TILEGX_SHAMT_X0	32	/* X0 pipe shift amount */
++#define R_TILEGX_SHAMT_X1	33	/* X1 pipe shift amount */
++#define R_TILEGX_SHAMT_Y0	34	/* Y0 pipe shift amount */
++#define R_TILEGX_SHAMT_Y1	35	/* Y1 pipe shift amount */
++#define R_TILEGX_IMM16_X0_HW0	36	/* X0 pipe hword 0 */
++#define R_TILEGX_IMM16_X1_HW0	37	/* X1 pipe hword 0 */
++#define R_TILEGX_IMM16_X0_HW1	38	/* X0 pipe hword 1 */
++#define R_TILEGX_IMM16_X1_HW1	39	/* X1 pipe hword 1 */
++#define R_TILEGX_IMM16_X0_HW2	40	/* X0 pipe hword 2 */
++#define R_TILEGX_IMM16_X1_HW2	41	/* X1 pipe hword 2 */
++#define R_TILEGX_IMM16_X0_HW3	42	/* X0 pipe hword 3 */
++#define R_TILEGX_IMM16_X1_HW3	43	/* X1 pipe hword 3 */
++#define R_TILEGX_IMM16_X0_HW0_LAST 44	/* X0 pipe last hword 0 */
++#define R_TILEGX_IMM16_X1_HW0_LAST 45	/* X1 pipe last hword 0 */
++#define R_TILEGX_IMM16_X0_HW1_LAST 46	/* X0 pipe last hword 1 */
++#define R_TILEGX_IMM16_X1_HW1_LAST 47	/* X1 pipe last hword 1 */
++#define R_TILEGX_IMM16_X0_HW2_LAST 48	/* X0 pipe last hword 2 */
++#define R_TILEGX_IMM16_X1_HW2_LAST 49	/* X1 pipe last hword 2 */
++#define R_TILEGX_IMM16_X0_HW0_PCREL 50	/* X0 pipe PC relative hword 0 */
++#define R_TILEGX_IMM16_X1_HW0_PCREL 51	/* X1 pipe PC relative hword 0 */
++#define R_TILEGX_IMM16_X0_HW1_PCREL 52	/* X0 pipe PC relative hword 1 */
++#define R_TILEGX_IMM16_X1_HW1_PCREL 53	/* X1 pipe PC relative hword 1 */
++#define R_TILEGX_IMM16_X0_HW2_PCREL 54	/* X0 pipe PC relative hword 2 */
++#define R_TILEGX_IMM16_X1_HW2_PCREL 55	/* X1 pipe PC relative hword 2 */
++#define R_TILEGX_IMM16_X0_HW3_PCREL 56	/* X0 pipe PC relative hword 3 */
++#define R_TILEGX_IMM16_X1_HW3_PCREL 57	/* X1 pipe PC relative hword 3 */
++#define R_TILEGX_IMM16_X0_HW0_LAST_PCREL 58 /* X0 pipe PC-rel last hword 0 */
++#define R_TILEGX_IMM16_X1_HW0_LAST_PCREL 59 /* X1 pipe PC-rel last hword 0 */
++#define R_TILEGX_IMM16_X0_HW1_LAST_PCREL 60 /* X0 pipe PC-rel last hword 1 */
++#define R_TILEGX_IMM16_X1_HW1_LAST_PCREL 61 /* X1 pipe PC-rel last hword 1 */
++#define R_TILEGX_IMM16_X0_HW2_LAST_PCREL 62 /* X0 pipe PC-rel last hword 2 */
++#define R_TILEGX_IMM16_X1_HW2_LAST_PCREL 63 /* X1 pipe PC-rel last hword 2 */
++#define R_TILEGX_IMM16_X0_HW0_GOT 64	/* X0 pipe hword 0 GOT offset */
++#define R_TILEGX_IMM16_X1_HW0_GOT 65	/* X1 pipe hword 0 GOT offset */
++/* Relocs 66-71 are currently not defined.  */
++#define R_TILEGX_IMM16_X0_HW0_LAST_GOT 72 /* X0 pipe last hword 0 GOT offset */
++#define R_TILEGX_IMM16_X1_HW0_LAST_GOT 73 /* X1 pipe last hword 0 GOT offset */
++#define R_TILEGX_IMM16_X0_HW1_LAST_GOT 74 /* X0 pipe last hword 1 GOT offset */
++#define R_TILEGX_IMM16_X1_HW1_LAST_GOT 75 /* X1 pipe last hword 1 GOT offset */
++/* Relocs 76-77 are currently not defined.  */
++#define R_TILEGX_IMM16_X0_HW0_TLS_GD 78	/* X0 pipe hword 0 TLS GD offset */
++#define R_TILEGX_IMM16_X1_HW0_TLS_GD 79	/* X1 pipe hword 0 TLS GD offset */
++#define R_TILEGX_IMM16_X0_HW0_TLS_LE 80	/* X0 pipe hword 0 TLS LE offset */
++#define R_TILEGX_IMM16_X1_HW0_TLS_LE 81	/* X1 pipe hword 0 TLS LE offset */
++#define R_TILEGX_IMM16_X0_HW0_LAST_TLS_LE 82 /* X0 pipe last hword 0 LE off */
++#define R_TILEGX_IMM16_X1_HW0_LAST_TLS_LE 83 /* X1 pipe last hword 0 LE off */
++#define R_TILEGX_IMM16_X0_HW1_LAST_TLS_LE 84 /* X0 pipe last hword 1 LE off */
++#define R_TILEGX_IMM16_X1_HW1_LAST_TLS_LE 85 /* X1 pipe last hword 1 LE off */
++#define R_TILEGX_IMM16_X0_HW0_LAST_TLS_GD 86 /* X0 pipe last hword 0 GD off */
++#define R_TILEGX_IMM16_X1_HW0_LAST_TLS_GD 87 /* X1 pipe last hword 0 GD off */
++#define R_TILEGX_IMM16_X0_HW1_LAST_TLS_GD 88 /* X0 pipe last hword 1 GD off */
++#define R_TILEGX_IMM16_X1_HW1_LAST_TLS_GD 89 /* X1 pipe last hword 1 GD off */
++/* Relocs 90-91 are currently not defined.  */
++#define R_TILEGX_IMM16_X0_HW0_TLS_IE 92	/* X0 pipe hword 0 TLS IE offset */
++#define R_TILEGX_IMM16_X1_HW0_TLS_IE 93	/* X1 pipe hword 0 TLS IE offset */
++/* Relocs 94-99 are currently not defined.  */
++#define R_TILEGX_IMM16_X0_HW0_LAST_TLS_IE 100 /* X0 pipe last hword 0 IE off */
++#define R_TILEGX_IMM16_X1_HW0_LAST_TLS_IE 101 /* X1 pipe last hword 0 IE off */
++#define R_TILEGX_IMM16_X0_HW1_LAST_TLS_IE 102 /* X0 pipe last hword 1 IE off */
++#define R_TILEGX_IMM16_X1_HW1_LAST_TLS_IE 103 /* X1 pipe last hword 1 IE off */
++/* Relocs 104-105 are currently not defined.  */
++#define R_TILEGX_TLS_DTPMOD64	106	/* 64-bit ID of symbol's module */
++#define R_TILEGX_TLS_DTPOFF64	107	/* 64-bit offset in TLS block */
++#define R_TILEGX_TLS_TPOFF64	108	/* 64-bit offset in static TLS block */
++#define R_TILEGX_TLS_DTPMOD32	109	/* 32-bit ID of symbol's module */
++#define R_TILEGX_TLS_DTPOFF32	110	/* 32-bit offset in TLS block */
++#define R_TILEGX_TLS_TPOFF32	111	/* 32-bit offset in static TLS block */
++#define R_TILEGX_TLS_GD_CALL	112	/* "jal" for TLS GD */
++#define R_TILEGX_IMM8_X0_TLS_GD_ADD 113	/* X0 pipe "addi" for TLS GD */
++#define R_TILEGX_IMM8_X1_TLS_GD_ADD 114	/* X1 pipe "addi" for TLS GD */
++#define R_TILEGX_IMM8_Y0_TLS_GD_ADD 115	/* Y0 pipe "addi" for TLS GD */
++#define R_TILEGX_IMM8_Y1_TLS_GD_ADD 116	/* Y1 pipe "addi" for TLS GD */
++#define R_TILEGX_TLS_IE_LOAD	117	/* "ld_tls" for TLS IE */
++#define R_TILEGX_IMM8_X0_TLS_ADD 118	/* X0 pipe "addi" for TLS GD/IE */
++#define R_TILEGX_IMM8_X1_TLS_ADD 119	/* X1 pipe "addi" for TLS GD/IE */
++#define R_TILEGX_IMM8_Y0_TLS_ADD 120	/* Y0 pipe "addi" for TLS GD/IE */
++#define R_TILEGX_IMM8_Y1_TLS_ADD 121	/* Y1 pipe "addi" for TLS GD/IE */
++
++#define R_TILEGX_GNU_VTINHERIT	128	/* GNU C++ vtable hierarchy */
++#define R_TILEGX_GNU_VTENTRY	129	/* GNU C++ vtable member usage */
++
++#define R_TILEGX_NUM		130
++
++#endif	/* elf.h */
+--- a/scripts/mod/mk_elfconfig.c
++++ b/scripts/mod/mk_elfconfig.c
+@@ -2,7 +2,11 @@
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
++#ifndef __APPLE__
+ #include <elf.h>
++#else
++#include "elf.h"
++#endif
+ 
+ int
+ main(int argc, char **argv)
+--- a/scripts/mod/modpost.h
++++ b/scripts/mod/modpost.h
+@@ -10,7 +10,11 @@
+ #include <sys/mman.h>
+ #include <fcntl.h>
+ #include <unistd.h>
++#if !(defined(__APPLE__) || defined(__CYGWIN__))
+ #include <elf.h>
++#else
++#include "elf.h"
++#endif
+ #include "../../include/linux/module_symbol.h"
+ 
+ #include <list_types.h>
diff --git a/6.12/target/linux/generic/hack-6.12/211-darwin-uuid-typedef-clash.patch b/6.12/target/linux/generic/hack-6.12/211-darwin-uuid-typedef-clash.patch
new file mode 100644
index 00000000..c0e0b24e
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/211-darwin-uuid-typedef-clash.patch
@@ -0,0 +1,22 @@
+From e44fc2af1ddc452b6659d08c16973d65c73b7d0a Mon Sep 17 00:00:00 2001
+From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+Date: Wed, 5 Feb 2020 18:36:43 +0000
+Subject: [PATCH] file2alias: build on macos
+
+Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+---
+ scripts/mod/file2alias.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/scripts/mod/file2alias.c
++++ b/scripts/mod/file2alias.c
+@@ -35,6 +35,9 @@ typedef uint32_t	__u32;
+ typedef uint16_t	__u16;
+ typedef unsigned char	__u8;
+ 
++#ifdef __APPLE__
++#define uuid_t compat_uuid_t
++#endif
+ /* UUID types for backward compatibility, don't use in new code */
+ typedef struct {
+ 	__u8 b[16];
diff --git a/6.12/target/linux/generic/hack-6.12/214-spidev_h_portability.patch b/6.12/target/linux/generic/hack-6.12/214-spidev_h_portability.patch
new file mode 100644
index 00000000..db754a29
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/214-spidev_h_portability.patch
@@ -0,0 +1,24 @@
+From be9be95ff10e16a5b4ad36f903978d0cc5747024 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 7 Jul 2017 17:04:08 +0200
+Subject: kernel: fix linux/spi/spidev.h portability issues with musl
+
+Felix will try to get this define included into musl
+
+lede-commit: 795e7cf60de19e7a076a46874fab7bb88b43bbff
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ include/uapi/linux/spi/spidev.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/uapi/linux/spi/spidev.h
++++ b/include/uapi/linux/spi/spidev.h
+@@ -93,7 +93,7 @@ struct spi_ioc_transfer {
+ 
+ /* not all platforms use <asm-generic/ioctl.h> or _IOC_TYPECHECK() ... */
+ #define SPI_MSGSIZE(N) \
+-	((((N)*(sizeof (struct spi_ioc_transfer))) < (1 << _IOC_SIZEBITS)) \
++	((((N)*(sizeof (struct spi_ioc_transfer))) < (1 << 13)) \
+ 		? ((N)*(sizeof (struct spi_ioc_transfer))) : 0)
+ #define SPI_IOC_MESSAGE(N) _IOW(SPI_IOC_MAGIC, 0, char[SPI_MSGSIZE(N)])
+ 
diff --git a/6.12/target/linux/generic/hack-6.12/230-openwrt_lzma_options.patch b/6.12/target/linux/generic/hack-6.12/230-openwrt_lzma_options.patch
new file mode 100644
index 00000000..20f2b29b
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/230-openwrt_lzma_options.patch
@@ -0,0 +1,38 @@
+From b3d00b452467f621317953d9e4c6f9ae8dcfd271 Mon Sep 17 00:00:00 2001
+From: Imre Kaloz <kaloz@openwrt.org>
+Date: Fri, 7 Jul 2017 17:06:55 +0200
+Subject: use the openwrt lzma options for now
+
+lede-commit: 548de949f392049420a6a1feeef118b30ab8ea8c
+Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
+---
+ lib/decompress.c              |  1 +
+ scripts/Makefile.lib          |  2 +-
+ usr/gen_initramfs_list.sh | 10 +++++-----
+ 3 files changed, 7 insertions(+), 6 deletions(-)
+
+--- a/lib/decompress.c
++++ b/lib/decompress.c
+@@ -53,6 +53,7 @@ static const struct compress_format comp
+ 	{ {0x1f, 0x9e}, "gzip", gunzip },
+ 	{ {0x42, 0x5a}, "bzip2", bunzip2 },
+ 	{ {0x5d, 0x00}, "lzma", unlzma },
++	{ {0x6d, 0x00}, "lzma-openwrt", unlzma },
+ 	{ {0xfd, 0x37}, "xz", unxz },
+ 	{ {0x89, 0x4c}, "lzo", unlzo },
+ 	{ {0x02, 0x21}, "lz4", unlz4 },
+--- a/scripts/Makefile.lib
++++ b/scripts/Makefile.lib
+@@ -359,10 +359,10 @@ quiet_cmd_bzip2_with_size = BZIP2   $@
+ # ---------------------------------------------------------------------------
+ 
+ quiet_cmd_lzma = LZMA    $@
+-      cmd_lzma = cat $(real-prereqs) | $(LZMA) -9 > $@
++      cmd_lzma = cat $(real-prereqs) | $(LZMA) e -d20 -lc1 -lp2 -pb2 -eos -si -so > $@
+ 
+ quiet_cmd_lzma_with_size = LZMA    $@
+-      cmd_lzma_with_size = { cat $(real-prereqs) | $(LZMA) -9; $(size_append); } > $@
++      cmd_lzma_with_size = { cat $(real-prereqs) | $(LZMA) e -d20 -lc1 -lp2 -pb2 -eos -si -so; $(size_append); } > $@
+ 
+ quiet_cmd_lzo = LZO     $@
+       cmd_lzo = cat $(real-prereqs) | $(KLZOP) -9 > $@
diff --git a/6.12/target/linux/generic/hack-6.12/250-netfilter_depends.patch b/6.12/target/linux/generic/hack-6.12/250-netfilter_depends.patch
new file mode 100644
index 00000000..43faa995
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/250-netfilter_depends.patch
@@ -0,0 +1,27 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: hack: net: remove bogus netfilter dependencies
+
+lede-commit: 589d2a377dee27d206fc3725325309cf649e4df6
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ net/netfilter/Kconfig | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -259,7 +259,6 @@ config NF_CONNTRACK_FTP
+ 
+ config NF_CONNTRACK_H323
+ 	tristate "H.323 protocol support"
+-	depends on IPV6 || IPV6=n
+ 	depends on NETFILTER_ADVANCED
+ 	help
+ 	  H.323 is a VoIP signalling protocol from ITU-T. As one of the most
+@@ -1120,7 +1119,6 @@ config NETFILTER_XT_TARGET_SECMARK
+ 
+ config NETFILTER_XT_TARGET_TCPMSS
+ 	tristate '"TCPMSS" target support'
+-	depends on IPV6 || IPV6=n
+ 	default m if NETFILTER_ADVANCED=n
+ 	help
+ 	  This option adds a `TCPMSS' target, which allows you to alter the
diff --git a/6.12/target/linux/generic/hack-6.12/251-kconfig.patch b/6.12/target/linux/generic/hack-6.12/251-kconfig.patch
new file mode 100644
index 00000000..dd73e794
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/251-kconfig.patch
@@ -0,0 +1,157 @@
+From da3c50704f14132f4adf80d48e9a4cd5d46e54c9 Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Fri, 7 Jul 2017 17:09:21 +0200
+Subject: kconfig: owrt specifc dependencies
+
+Signed-off-by: John Crispin <john@phrozen.org>
+---
+ crypto/Kconfig        | 10 +++++-----
+ drivers/bcma/Kconfig  |  1 +
+ drivers/ssb/Kconfig   |  3 ++-
+ lib/Kconfig           |  8 ++++----
+ net/netfilter/Kconfig |  2 +-
+ net/wireless/Kconfig  | 17 ++++++++++-------
+ sound/core/Kconfig    |  4 ++--
+ 7 files changed, 25 insertions(+), 20 deletions(-)
+
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -55,7 +55,7 @@ config CRYPTO_FIPS_VERSION
+ 	  By default the KERNELRELEASE value is used.
+ 
+ config CRYPTO_ALGAPI
+-	tristate
++	tristate "ALGAPI"
+ 	select CRYPTO_ALGAPI2
+ 	help
+ 	  This option provides the API for cryptographic algorithms.
+@@ -64,7 +64,7 @@ config CRYPTO_ALGAPI2
+ 	tristate
+ 
+ config CRYPTO_AEAD
+-	tristate
++	tristate "AEAD"
+ 	select CRYPTO_AEAD2
+ 	select CRYPTO_ALGAPI
+ 
+@@ -82,7 +82,7 @@ config CRYPTO_SIG2
+ 	select CRYPTO_ALGAPI2
+ 
+ config CRYPTO_SKCIPHER
+-	tristate
++	tristate "SKCIPHER"
+ 	select CRYPTO_SKCIPHER2
+ 	select CRYPTO_ALGAPI
+ 	select CRYPTO_ECB
+@@ -92,7 +92,7 @@ config CRYPTO_SKCIPHER2
+ 	select CRYPTO_ALGAPI2
+ 
+ config CRYPTO_HASH
+-	tristate
++	tristate "HASH"
+ 	select CRYPTO_HASH2
+ 	select CRYPTO_ALGAPI
+ 
+@@ -101,7 +101,7 @@ config CRYPTO_HASH2
+ 	select CRYPTO_ALGAPI2
+ 
+ config CRYPTO_RNG
+-	tristate
++	tristate "RNG"
+ 	select CRYPTO_RNG2
+ 	select CRYPTO_ALGAPI
+ 
+--- a/drivers/bcma/Kconfig
++++ b/drivers/bcma/Kconfig
+@@ -16,6 +16,7 @@ if BCMA
+ # Support for Block-I/O. SELECT this from the driver that needs it.
+ config BCMA_BLOCKIO
+ 	bool
++	default y
+ 
+ config BCMA_HOST_PCI_POSSIBLE
+ 	bool
+--- a/drivers/ssb/Kconfig
++++ b/drivers/ssb/Kconfig
+@@ -29,6 +29,7 @@ config SSB_SPROM
+ config SSB_BLOCKIO
+ 	bool
+ 	depends on SSB
++	default y
+ 
+ config SSB_PCIHOST_POSSIBLE
+ 	bool
+@@ -49,7 +50,7 @@ config SSB_PCIHOST
+ config SSB_B43_PCI_BRIDGE
+ 	bool
+ 	depends on SSB_PCIHOST
+-	default n
++	default y
+ 
+ config SSB_PCMCIAHOST_POSSIBLE
+ 	bool
+--- a/lib/Kconfig
++++ b/lib/Kconfig
+@@ -457,16 +457,16 @@ config BCH_CONST_T
+ # Textsearch support is select'ed if needed
+ #
+ config TEXTSEARCH
+-	bool
++	bool "Textsearch support"
+ 
+ config TEXTSEARCH_KMP
+-	tristate
++	tristate "Textsearch KMP"
+ 
+ config TEXTSEARCH_BM
+-	tristate
++	tristate "Textsearch BM"
+ 
+ config TEXTSEARCH_FSM
+-	tristate
++	tristate "Textsearch FSM"
+ 
+ config BTREE
+ 	bool
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -22,7 +22,7 @@ config NETFILTER_SKIP_EGRESS
+ 	def_bool NETFILTER_EGRESS && (NET_CLS_ACT || IFB)
+ 
+ config NETFILTER_NETLINK
+-	tristate
++	tristate "Netfilter NFNETLINK interface"
+ 
+ config NETFILTER_FAMILY_BRIDGE
+ 	bool
+--- a/sound/core/Kconfig
++++ b/sound/core/Kconfig
+@@ -17,7 +17,7 @@ config SND_DMAENGINE_PCM
+ 	tristate
+ 
+ config SND_HWDEP
+-	tristate
++	tristate "Sound hardware support"
+ 
+ config SND_SEQ_DEVICE
+ 	tristate
+@@ -57,7 +57,7 @@ config SND_CORE_TEST
+ 
+ 
+ config SND_COMPRESS_OFFLOAD
+-	tristate
++	tristate "Compression offloading support"
+ 
+ config SND_JACK
+ 	bool
+--- a/net/Kconfig
++++ b/net/Kconfig
+@@ -484,7 +484,7 @@ config NET_DEVLINK
+ 	default n
+ 
+ config PAGE_POOL
+-	bool
++	bool "Page pool support"
+ 
+ config PAGE_POOL_STATS
+ 	default n
diff --git a/6.12/target/linux/generic/hack-6.12/253-ksmbd-config.patch b/6.12/target/linux/generic/hack-6.12/253-ksmbd-config.patch
new file mode 100644
index 00000000..30fe9b43
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/253-ksmbd-config.patch
@@ -0,0 +1,32 @@
+From dcd966fa7ca63f38cf7147e1184d13d66e2ca340 Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Wed, 13 Jul 2022 13:33:30 +0200
+Subject: [PATCH] Kconfig: add tristate for OID and ASNI string
+
+---
+ init/Kconfig | 2 +-
+ lib/Kconfig  | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -2054,7 +2054,7 @@ config PADATA
+ 	bool
+ 
+ config ASN1
+-	tristate
++	tristate "ASN1"
+ 	help
+ 	  Build a simple ASN.1 grammar compiler that produces a bytecode output
+ 	  that can be interpreted by the ASN.1 stream decoder and used to
+--- a/lib/Kconfig
++++ b/lib/Kconfig
+@@ -642,7 +642,7 @@ config LIBFDT
+ 	bool
+ 
+ config OID_REGISTRY
+-	tristate
++	tristate "OID"
+ 	help
+ 	  Enable fast lookup object identifier registry.
+ 
diff --git a/6.12/target/linux/generic/hack-6.12/259-regmap_dynamic.patch b/6.12/target/linux/generic/hack-6.12/259-regmap_dynamic.patch
new file mode 100644
index 00000000..e7614d68
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/259-regmap_dynamic.patch
@@ -0,0 +1,156 @@
+From 811d9e2268a62b830cfe93cd8bc929afcb8b198b Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 15 Jul 2017 21:12:38 +0200
+Subject: kernel: move regmap bloat out of the kernel image if it is only being used in modules
+
+lede-commit: 96f39119815028073583e4fca3a9c5fe9141e998
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ drivers/base/regmap/Kconfig  | 15 ++++++++++-----
+ drivers/base/regmap/Makefile | 12 ++++++++----
+ drivers/base/regmap/regmap.c |  3 +++
+ include/linux/regmap.h       |  2 +-
+ 4 files changed, 22 insertions(+), 10 deletions(-)
+
+--- a/drivers/base/regmap/Kconfig
++++ b/drivers/base/regmap/Kconfig
+@@ -4,8 +4,7 @@
+ # subsystems should select the appropriate symbols.
+ 
+ config REGMAP
+-	bool
+-	default y if (REGMAP_I2C || REGMAP_SPI || REGMAP_SPMI || REGMAP_W1 || REGMAP_AC97 || REGMAP_MMIO || REGMAP_IRQ || REGMAP_SOUNDWIRE || REGMAP_SOUNDWIRE_MBQ || REGMAP_SCCB || REGMAP_I3C || REGMAP_SPI_AVMM || REGMAP_MDIO || REGMAP_FSI)
++	tristate
+ 	select IRQ_DOMAIN if REGMAP_IRQ
+ 	select MDIO_BUS if REGMAP_MDIO
+ 	help
+@@ -19,7 +18,7 @@ config REGMAP
+ 
+ config REGMAP_KUNIT
+ 	tristate "KUnit tests for regmap"
+-	depends on KUNIT && REGMAP
++	depends on KUNIT
+ 	default KUNIT_ALL_TESTS
+ 	select REGMAP_RAM
+ 
+@@ -34,60 +33,76 @@ config REGMAP_BUILD
+ 	  normally enabled.
+ 
+ config REGMAP_AC97
++	select REGMAP
+ 	tristate
+ 
+ config REGMAP_I2C
++	select REGMAP
+ 	tristate
+ 	depends on I2C
+ 
+ config REGMAP_SLIMBUS
++	select REGMAP
+ 	tristate
+ 	depends on SLIMBUS
+ 
+ config REGMAP_SPI
++	select REGMAP
+ 	tristate
+ 	depends on SPI
+ 
+ config REGMAP_SPMI
++	select REGMAP
+ 	tristate
+ 	depends on SPMI
+ 
+ config REGMAP_W1
++	select REGMAP
+ 	tristate
+ 	depends on W1
+ 
+ config REGMAP_MDIO
++	select REGMAP
+ 	tristate
+ 
+ config REGMAP_MMIO
++	select REGMAP
+ 	tristate
+ 
+ config REGMAP_IRQ
++	select REGMAP
+ 	bool
+ 
+ config REGMAP_RAM
++	select REGMAP
+ 	tristate
+ 
+ config REGMAP_SOUNDWIRE
++	select REGMAP
+ 	tristate
+ 	depends on SOUNDWIRE
+ 
+ config REGMAP_SOUNDWIRE_MBQ
++	select REGMAP
+ 	tristate
+ 	depends on SOUNDWIRE
+ 
+ config REGMAP_SCCB
++	select REGMAP
+ 	tristate
+ 	depends on I2C
+ 
+ config REGMAP_I3C
++	select REGMAP
+ 	tristate
+ 	depends on I3C
+ 
+ config REGMAP_SPI_AVMM
++	select REGMAP
+ 	tristate
+ 	depends on SPI
+ 
+ config REGMAP_FSI
++	select REGMAP
+ 	tristate
+ 	depends on FSI
+--- a/drivers/base/regmap/Makefile
++++ b/drivers/base/regmap/Makefile
+@@ -2,9 +2,11 @@
+ # For include/trace/define_trace.h to include trace.h
+ CFLAGS_regmap.o := -I$(src)
+ 
+-obj-$(CONFIG_REGMAP) += regmap.o regcache.o
+-obj-$(CONFIG_REGMAP) += regcache-rbtree.o regcache-flat.o regcache-maple.o
+-obj-$(CONFIG_DEBUG_FS) += regmap-debugfs.o
++regmap-core-objs = regmap.o regcache.o regcache-rbtree.o regcache-flat.o regcache-maple.o
++ifdef CONFIG_DEBUG_FS
++regmap-core-objs += regmap-debugfs.o
++endif
++obj-$(CONFIG_REGMAP) += regmap-core.o
+ obj-$(CONFIG_REGMAP_KUNIT) += regmap-kunit.o
+ obj-$(CONFIG_REGMAP_AC97) += regmap-ac97.o
+ obj-$(CONFIG_REGMAP_I2C) += regmap-i2c.o
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -9,6 +9,7 @@
+ #include <linux/device.h>
+ #include <linux/slab.h>
+ #include <linux/export.h>
++#include <linux/module.h>
+ #include <linux/mutex.h>
+ #include <linux/err.h>
+ #include <linux/property.h>
+@@ -3519,3 +3520,5 @@ static int __init regmap_initcall(void)
+ 	return 0;
+ }
+ postcore_initcall(regmap_initcall);
++
++MODULE_LICENSE("GPL");
+--- a/include/linux/regmap.h
++++ b/include/linux/regmap.h
+@@ -197,7 +197,7 @@ struct reg_sequence {
+ 	__ret ?: __tmp; \
+ })
+ 
+-#ifdef CONFIG_REGMAP
++#if IS_REACHABLE(CONFIG_REGMAP)
+ 
+ enum regmap_endian {
+ 	/* Unspecified -> 0 -> Backwards compatible default */
diff --git a/6.12/target/linux/generic/hack-6.12/260-crypto_test_dependencies.patch b/6.12/target/linux/generic/hack-6.12/260-crypto_test_dependencies.patch
new file mode 100644
index 00000000..ce900a87
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/260-crypto_test_dependencies.patch
@@ -0,0 +1,54 @@
+From fd1799b0bf5efa46dd3e6dfbbf3955564807e508 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 7 Jul 2017 17:12:51 +0200
+Subject: kernel: prevent cryptomgr from pulling in useless extra dependencies for tests that are not run
+
+Reduces kernel size after LZMA by about 5k on MIPS
+
+lede-commit: 044c316167e076479a344c59905e5b435b84a77f
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ crypto/Kconfig   | 13 ++++++-------
+ crypto/algboss.c |  4 ++++
+ 2 files changed, 10 insertions(+), 7 deletions(-)
+
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -149,15 +149,15 @@ config CRYPTO_MANAGER
+ 	  cbc(aes).
+ 
+ config CRYPTO_MANAGER2
+-	def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y)
+-	select CRYPTO_ACOMP2
+-	select CRYPTO_AEAD2
+-	select CRYPTO_AKCIPHER2
+-	select CRYPTO_SIG2
+-	select CRYPTO_HASH2
+-	select CRYPTO_KPP2
+-	select CRYPTO_RNG2
+-	select CRYPTO_SKCIPHER2
++	def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y && !CRYPTO_MANAGER_DISABLE_TESTS)
++	select CRYPTO_ACOMP2 if !CRYPTO_MANAGER_DISABLE_TESTS
++	select CRYPTO_AEAD2 if !CRYPTO_MANAGER_DISABLE_TESTS
++	select CRYPTO_AKCIPHER2 if !CRYPTO_MANAGER_DISABLE_TESTS
++	select CRYPTO_SIG2 if !CRYPTO_MANAGER_DISABLE_TESTS
++	select CRYPTO_HASH2 if !CRYPTO_MANAGER_DISABLE_TESTS
++	select CRYPTO_KPP2 if !CRYPTO_MANAGER_DISABLE_TESTS
++	select CRYPTO_RNG2 if !CRYPTO_MANAGER_DISABLE_TESTS
++	select CRYPTO_SKCIPHER2 if !CRYPTO_MANAGER_DISABLE_TESTS
+ 
+ config CRYPTO_USER
+ 	tristate "Userspace cryptographic algorithm configuration"
+--- a/crypto/algboss.c
++++ b/crypto/algboss.c
+@@ -203,6 +203,10 @@ static int cryptomgr_schedule_test(struc
+ 	memcpy(param->alg, alg->cra_name, sizeof(param->alg));
+ 	param->type = alg->cra_flags;
+ 
++#ifdef CONFIG_CRYPTO_MANAGER_DISABLE_TESTS
++	param->type |= CRYPTO_ALG_TESTED;
++#endif
++
+ 	thread = kthread_run(cryptomgr_test, param, "cryptomgr_test");
+ 	if (IS_ERR(thread))
+ 		goto err_free_param;
diff --git a/6.12/target/linux/generic/hack-6.12/261-lib-arc4-unhide.patch b/6.12/target/linux/generic/hack-6.12/261-lib-arc4-unhide.patch
new file mode 100644
index 00000000..f1e1ad4c
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/261-lib-arc4-unhide.patch
@@ -0,0 +1,24 @@
+From 241e5d3f7b0dd3c01f8c7fa83cbc9a3882286d53 Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Wed, 13 Jul 2022 13:35:18 +0200
+Subject: [PATCH] lib/crypto: add tristate string for ARC4
+
+This makes it possible to select CONFIG_CRYPTO_LIB_ARC4 directly. We 
+need this to be able to compile this into the kernel and make use of it 
+from backports.
+
+---
+ lib/crypto/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/lib/crypto/Kconfig
++++ b/lib/crypto/Kconfig
+@@ -20,7 +20,7 @@ config CRYPTO_LIB_AESGCM
+ 	select CRYPTO_LIB_UTILS
+ 
+ config CRYPTO_LIB_ARC4
+-	tristate
++	tristate "ARC4 cipher library"
+ 
+ config CRYPTO_LIB_GF128MUL
+ 	tristate
diff --git a/6.12/target/linux/generic/hack-6.12/280-rfkill-stubs.patch b/6.12/target/linux/generic/hack-6.12/280-rfkill-stubs.patch
new file mode 100644
index 00000000..ff6638f7
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/280-rfkill-stubs.patch
@@ -0,0 +1,84 @@
+From 236c1acdfef5958010ac9814a9872e0a46fd78ee Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Fri, 7 Jul 2017 17:13:44 +0200
+Subject: rfkill: add fake rfkill support
+
+allow building of modules depending on RFKILL even if RFKILL is not enabled.
+
+Signed-off-by: John Crispin <john@phrozen.org>
+---
+ include/linux/rfkill.h |  2 +-
+ net/Makefile           |  2 +-
+ net/rfkill/Kconfig     | 14 +++++++++-----
+ net/rfkill/Makefile    |  2 +-
+ 4 files changed, 12 insertions(+), 8 deletions(-)
+
+--- a/include/linux/rfkill.h
++++ b/include/linux/rfkill.h
+@@ -64,7 +64,7 @@ struct rfkill_ops {
+ 	int	(*set_block)(void *data, bool blocked);
+ };
+ 
+-#if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
++#if defined(CONFIG_RFKILL_FULL) || defined(CONFIG_RFKILL_FULL_MODULE)
+ /**
+  * rfkill_alloc - Allocate rfkill structure
+  * @name: name of the struct -- the string is not copied internally
+--- a/net/Makefile
++++ b/net/Makefile
+@@ -51,7 +51,7 @@ obj-$(CONFIG_TIPC)		+= tipc/
+ obj-$(CONFIG_NETLABEL)		+= netlabel/
+ obj-$(CONFIG_IUCV)		+= iucv/
+ obj-$(CONFIG_SMC)		+= smc/
+-obj-$(CONFIG_RFKILL)		+= rfkill/
++obj-$(CONFIG_RFKILL_FULL)	+= rfkill/
+ obj-$(CONFIG_NET_9P)		+= 9p/
+ obj-$(CONFIG_CAIF)		+= caif/
+ obj-$(CONFIG_DCB)		+= dcb/
+--- a/net/rfkill/Kconfig
++++ b/net/rfkill/Kconfig
+@@ -2,7 +2,11 @@
+ #
+ # RF switch subsystem configuration
+ #
+-menuconfig RFKILL
++config RFKILL
++	bool
++	default y
++
++menuconfig RFKILL_FULL
+ 	tristate "RF switch subsystem support"
+ 	help
+ 	  Say Y here if you want to have control over RF switches
+@@ -14,19 +18,19 @@ menuconfig RFKILL
+ # LED trigger support
+ config RFKILL_LEDS
+ 	bool
+-	depends on RFKILL
++	depends on RFKILL_FULL
+ 	depends on LEDS_TRIGGERS = y || RFKILL = LEDS_TRIGGERS
+ 	default y
+ 
+ config RFKILL_INPUT
+ 	bool "RF switch input support" if EXPERT
+-	depends on RFKILL
++	depends on RFKILL_FULL
+ 	depends on INPUT = y || RFKILL = INPUT
+ 	default y if !EXPERT
+ 
+ config RFKILL_GPIO
+ 	tristate "GPIO RFKILL driver"
+-	depends on RFKILL
++	depends on RFKILL_FULL
+ 	depends on GPIOLIB || COMPILE_TEST
+ 	default n
+ 	help
+--- a/net/rfkill/Makefile
++++ b/net/rfkill/Makefile
+@@ -5,5 +5,5 @@
+ 
+ rfkill-y			+= core.o
+ rfkill-$(CONFIG_RFKILL_INPUT)	+= input.o
+-obj-$(CONFIG_RFKILL)		+= rfkill.o
++obj-$(CONFIG_RFKILL_FULL)	+= rfkill.o
+ obj-$(CONFIG_RFKILL_GPIO)	+= rfkill-gpio.o
diff --git a/6.12/target/linux/generic/hack-6.12/300-MIPS-r4k_cache-use-more-efficient-cache-blast.patch b/6.12/target/linux/generic/hack-6.12/300-MIPS-r4k_cache-use-more-efficient-cache-blast.patch
new file mode 100644
index 00000000..6ee98ebf
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/300-MIPS-r4k_cache-use-more-efficient-cache-blast.patch
@@ -0,0 +1,64 @@
+From: Ben Menchaca <ben.menchaca@qca.qualcomm.com>
+Date: Fri, 7 Jun 2013 18:35:22 -0500
+Subject: MIPS: r4k_cache: use more efficient cache blast
+
+Optimize the compiler output for larger cache blast cases that are
+common for DMA-based networking.
+
+Signed-off-by: Ben Menchaca <ben.menchaca@qca.qualcomm.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+--- a/arch/mips/include/asm/r4kcache.h
++++ b/arch/mips/include/asm/r4kcache.h
+@@ -290,14 +290,46 @@ static inline void prot##extra##blast_##
+ 						    unsigned long end)	\
+ {									\
+ 	unsigned long lsize = cpu_##desc##_line_size();			\
++	unsigned long lsize_2 = lsize * 2;				\
++	unsigned long lsize_3 = lsize * 3;				\
++	unsigned long lsize_4 = lsize * 4;				\
++	unsigned long lsize_5 = lsize * 5;				\
++	unsigned long lsize_6 = lsize * 6;				\
++	unsigned long lsize_7 = lsize * 7;				\
++	unsigned long lsize_8 = lsize * 8;				\
+ 	unsigned long addr = start & ~(lsize - 1);			\
+-	unsigned long aend = (end - 1) & ~(lsize - 1);			\
++	unsigned long aend = (end + lsize - 1) & ~(lsize - 1);		\
++	int lines = (aend - addr) / lsize;				\
+ 									\
+-	while (1) {							\
++	while (lines >= 8) {						\
++		prot##cache_op(hitop, addr);				\
++		prot##cache_op(hitop, addr + lsize);			\
++		prot##cache_op(hitop, addr + lsize_2);			\
++		prot##cache_op(hitop, addr + lsize_3);			\
++		prot##cache_op(hitop, addr + lsize_4);			\
++		prot##cache_op(hitop, addr + lsize_5);			\
++		prot##cache_op(hitop, addr + lsize_6);			\
++		prot##cache_op(hitop, addr + lsize_7);			\
++		addr += lsize_8;					\
++		lines -= 8;						\
++	}								\
++									\
++	if (lines & 0x4) {						\
++		prot##cache_op(hitop, addr);				\
++		prot##cache_op(hitop, addr + lsize);			\
++		prot##cache_op(hitop, addr + lsize_2);			\
++		prot##cache_op(hitop, addr + lsize_3);			\
++		addr += lsize_4;					\
++	}								\
++									\
++	if (lines & 0x2) {						\
++		prot##cache_op(hitop, addr);				\
++		prot##cache_op(hitop, addr + lsize);			\
++		addr += lsize_2;					\
++	}								\
++									\
++	if (lines & 0x1) {						\
+ 		prot##cache_op(hitop, addr);				\
+-		if (addr == aend)					\
+-			break;						\
+-		addr += lsize;						\
+ 	}								\
+ }
+ 
diff --git a/6.12/target/linux/generic/hack-6.12/402-mtd-blktrans-call-add-disks-after-mtd-device.patch b/6.12/target/linux/generic/hack-6.12/402-mtd-blktrans-call-add-disks-after-mtd-device.patch
new file mode 100644
index 00000000..5ccb6bc7
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/402-mtd-blktrans-call-add-disks-after-mtd-device.patch
@@ -0,0 +1,112 @@
+From 0bccc3722bdd88e8ae995e77ef9f7b77ee4cbdee Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Wed, 7 Apr 2021 22:45:54 +0100
+Subject: [PATCH 2/2] mtd: blktrans: call add disks after mtd device
+To: linux-mtd@lists.infradead.org
+Cc: Vignesh Raghavendra <vigneshr@ti.com>,
+    Richard Weinberger <richard@nod.at>,
+    Miquel Raynal <miquel.raynal@bootlin.com>,
+    David Woodhouse <dwmw2@infradead.org>
+
+Calling device_add_disk while holding mtd_table_mutex leads
+to deadlock in case part_bits!=0 as block partition parsers
+will try to open the newly created disks, trying to acquire
+mutex once again.
+Move device_add_disk to additional function called after
+add partitions of an MTD device have been added and locks
+have been released.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/mtd/mtd_blkdevs.c    | 33 ++++++++++++++++++++++++++-------
+ drivers/mtd/mtdcore.c        |  3 +++
+ include/linux/mtd/blktrans.h |  1 +
+ 3 files changed, 30 insertions(+), 7 deletions(-)
+
+--- a/drivers/mtd/mtd_blkdevs.c
++++ b/drivers/mtd/mtd_blkdevs.c
+@@ -379,19 +379,8 @@ int add_mtd_blktrans_dev(struct mtd_blkt
+ 	if (new->readonly)
+ 		set_disk_ro(gd, 1);
+ 
+-	ret = device_add_disk(&new->mtd->dev, gd, NULL);
+-	if (ret)
+-		goto out_cleanup_disk;
+-
+-	if (new->disk_attributes) {
+-		ret = sysfs_create_group(&disk_to_dev(gd)->kobj,
+-					new->disk_attributes);
+-		WARN_ON(ret);
+-	}
+ 	return 0;
+ 
+-out_cleanup_disk:
+-	put_disk(new->disk);
+ out_free_tag_set:
+ 	blk_mq_free_tag_set(new->tag_set);
+ out_kfree_tag_set:
+@@ -401,6 +390,35 @@ out_list_del:
+ 	return ret;
+ }
+ 
++void register_mtd_blktrans_devs(void)
++{
++	struct mtd_blktrans_ops *tr;
++	struct mtd_blktrans_dev *dev, *next;
++	int ret;
++
++	list_for_each_entry(tr, &blktrans_majors, list) {
++		list_for_each_entry_safe(dev, next, &tr->devs, list) {
++			if (disk_live(dev->disk))
++				continue;
++
++			ret = device_add_disk(&dev->mtd->dev, dev->disk, NULL);
++			if (ret)
++				goto out_cleanup_disk;
++
++			if (dev->disk_attributes) {
++				ret = sysfs_create_group(&disk_to_dev(dev->disk)->kobj,
++							dev->disk_attributes);
++				WARN_ON(ret);
++			}
++		}
++	}
++
++	return;
++
++out_cleanup_disk:
++	put_disk(dev->disk);
++}
++
+ int del_mtd_blktrans_dev(struct mtd_blktrans_dev *old)
+ {
+ 	unsigned long flags;
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -34,6 +34,7 @@
+ 
+ #include <linux/mtd/mtd.h>
+ #include <linux/mtd/partitions.h>
++#include <linux/mtd/blktrans.h>
+ 
+ #include "mtdcore.h"
+ 
+@@ -1132,6 +1133,8 @@ int mtd_device_parse_register(struct mtd
+ 		register_reboot_notifier(&mtd->reboot_notifier);
+ 	}
+ 
++	register_mtd_blktrans_devs();
++
+ out:
+ 	if (ret) {
+ 		nvmem_unregister(mtd->otp_user_nvmem);
+--- a/include/linux/mtd/blktrans.h
++++ b/include/linux/mtd/blktrans.h
+@@ -76,6 +76,7 @@ extern int deregister_mtd_blktrans(struc
+ extern int add_mtd_blktrans_dev(struct mtd_blktrans_dev *dev);
+ extern int del_mtd_blktrans_dev(struct mtd_blktrans_dev *dev);
+ extern int mtd_blktrans_cease_background(struct mtd_blktrans_dev *dev);
++extern void register_mtd_blktrans_devs(void);
+ 
+ /**
+  * module_mtd_blktrans() - Helper macro for registering a mtd blktrans driver
diff --git a/6.12/target/linux/generic/hack-6.12/420-mtd-support-OpenWrt-s-MTD_ROOTFS_ROOT_DEV.patch b/6.12/target/linux/generic/hack-6.12/420-mtd-support-OpenWrt-s-MTD_ROOTFS_ROOT_DEV.patch
new file mode 100644
index 00000000..52965418
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/420-mtd-support-OpenWrt-s-MTD_ROOTFS_ROOT_DEV.patch
@@ -0,0 +1,24 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Mon, 7 Nov 2022 23:48:24 +0100
+Subject: [PATCH] mtd: support OpenWrt's MTD_ROOTFS_ROOT_DEV
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This allows setting ROOT_DEV to MTD partition named "rootfs".
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -803,7 +803,8 @@ int add_mtd_device(struct mtd_info *mtd)
+ 
+ 	mutex_unlock(&mtd_table_mutex);
+ 
+-	if (of_property_read_bool(mtd_get_of_node(mtd), "linux,rootfs")) {
++	if (of_property_read_bool(mtd_get_of_node(mtd), "linux,rootfs") ||
++	    (IS_ENABLED(CONFIG_MTD_ROOTFS_ROOT_DEV) && !strcmp(mtd->name, "rootfs") && ROOT_DEV == 0)) {
+ 		if (IS_BUILTIN(CONFIG_MTD)) {
+ 			pr_info("mtd: setting mtd%d (%s) as root device\n", mtd->index, mtd->name);
+ 			ROOT_DEV = MKDEV(MTD_BLOCK_MAJOR, mtd->index);
diff --git a/6.12/target/linux/generic/hack-6.12/421-drivers-mtd-parsers-add-nvmem-support-to-cmdlinepart.patch b/6.12/target/linux/generic/hack-6.12/421-drivers-mtd-parsers-add-nvmem-support-to-cmdlinepart.patch
new file mode 100644
index 00000000..190fecc1
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/421-drivers-mtd-parsers-add-nvmem-support-to-cmdlinepart.patch
@@ -0,0 +1,120 @@
+From 6fa9e3678eb002246df1280322b6a024853950a5 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Mon, 11 Oct 2021 00:53:14 +0200
+Subject: [PATCH] drivers: mtd: parsers: add nvmem support to cmdlinepart
+
+Assuming cmdlinepart is only one level deep partition scheme and that
+static partition are also defined in DTS, we can assign an of_node for
+partition declared from bootargs. cmdlinepart have priority than
+fiexed-partition parser so in this specific case the parser doesn't
+assign an of_node. Fix this by searching a defined of_node using a
+similar fixed_partition parser and if a partition is found with the same
+label, check that it has the same offset and size and return the DT
+of_node to correctly use NVMEM cells.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+---
+ drivers/mtd/parsers/cmdlinepart.c | 71 +++++++++++++++++++++++++++++++
+ 1 file changed, 71 insertions(+)
+
+--- a/drivers/mtd/parsers/cmdlinepart.c
++++ b/drivers/mtd/parsers/cmdlinepart.c
+@@ -43,6 +43,7 @@
+ #include <linux/mtd/partitions.h>
+ #include <linux/module.h>
+ #include <linux/err.h>
++#include <linux/of.h>
+ 
+ /* special size referring to all the remaining space in a partition */
+ #define SIZE_REMAINING ULLONG_MAX
+@@ -315,6 +316,68 @@ static int mtdpart_setup_real(char *s)
+ 	return 0;
+ }
+ 
++static int search_fixed_partition(struct mtd_info *master,
++				  struct mtd_partition *target_part,
++				  struct mtd_partition *fixed_part)
++{
++	struct device_node *mtd_node;
++	struct device_node *ofpart_node;
++	struct device_node *pp;
++	struct mtd_partition part;
++	const char *partname;
++
++	mtd_node = mtd_get_of_node(master);
++	if (!mtd_node)
++		return -EINVAL;
++
++	ofpart_node = of_get_child_by_name(mtd_node, "partitions");
++
++	for_each_child_of_node(ofpart_node,  pp) {
++		const __be32 *reg;
++		int len;
++		int a_cells, s_cells;
++
++		reg = of_get_property(pp, "reg", &len);
++		if (!reg) {
++			pr_debug("%s: ofpart partition %pOF (%pOF) missing reg property.\n",
++				 master->name, pp,
++				 mtd_node);
++			continue;
++		}
++
++		a_cells = of_n_addr_cells(pp);
++		s_cells = of_n_size_cells(pp);
++		if (len / 4 != a_cells + s_cells) {
++			pr_debug("%s: ofpart partition %pOF (%pOF) error parsing reg property.\n",
++				 master->name, pp,
++				 mtd_node);
++			continue;
++		}
++
++		part.offset = of_read_number(reg, a_cells);
++		part.size = of_read_number(reg + a_cells, s_cells);
++		part.of_node = pp;
++
++		partname = of_get_property(pp, "label", &len);
++		if (!partname)
++			partname = of_get_property(pp, "name", &len);
++		part.name = partname;
++
++		if (!strncmp(target_part->name, part.name, len)) {
++			if (part.offset != target_part->offset)
++				return -EINVAL;
++
++			if (part.size != target_part->size)
++				return -EINVAL;
++
++			memcpy(fixed_part, &part, sizeof(struct mtd_partition));
++			return 0;
++		}
++	}
++
++	return -EINVAL;
++}
++
+ /*
+  * Main function to be called from the MTD mapping driver/device to
+  * obtain the partitioning information. At this point the command line
+@@ -330,6 +393,7 @@ static int parse_cmdline_partitions(stru
+ 	int i, err;
+ 	struct cmdline_mtd_partition *part;
+ 	const char *mtd_id = master->name;
++	struct mtd_partition fixed_part;
+ 
+ 	/* parse command line */
+ 	if (!cmdline_parsed) {
+@@ -374,6 +438,13 @@ static int parse_cmdline_partitions(stru
+ 				sizeof(*part->parts) * (part->num_parts - i));
+ 			i--;
+ 		}
++
++		err = search_fixed_partition(master, &part->parts[i], &fixed_part);
++		if (!err) {
++			part->parts[i].of_node = fixed_part.of_node;
++			pr_info("Found partition defined in DT for %s. Assigning OF node to support nvmem.",
++				part->parts[i].name);
++		}
+ 	}
+ 
+ 	*pparts = kmemdup(part->parts, sizeof(*part->parts) * part->num_parts,
diff --git a/6.12/target/linux/generic/hack-6.12/430-mtk-bmt-support.patch b/6.12/target/linux/generic/hack-6.12/430-mtk-bmt-support.patch
new file mode 100644
index 00000000..1e69ee64
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/430-mtk-bmt-support.patch
@@ -0,0 +1,33 @@
+From ac84397efb3b3868c71c10ad7521161773228a17 Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Wed, 13 Jul 2022 13:41:44 +0200
+Subject: [PATCH] mtd/nand: add MediaTek NAND bad block managment table
+
+---
+ drivers/mtd/nand/Kconfig  | 4 ++++
+ drivers/mtd/nand/Makefile | 1 +
+ 2 files changed, 5 insertions(+)
+
+--- a/drivers/mtd/nand/Kconfig
++++ b/drivers/mtd/nand/Kconfig
+@@ -46,6 +46,10 @@ config MTD_NAND_ECC_SW_BCH
+ 	  ECC codes. They are used with NAND devices requiring more than 1 bit
+ 	  of error correction.
+ 
++config MTD_NAND_MTK_BMT
++	bool "Support MediaTek NAND Bad-block Management Table"
++	default n
++
+ config MTD_NAND_ECC_MXIC
+ 	bool "Macronix external hardware ECC engine"
+ 	depends on HAS_IOMEM
+--- a/drivers/mtd/nand/Makefile
++++ b/drivers/mtd/nand/Makefile
+@@ -3,6 +3,7 @@
+ nandcore-objs := core.o bbt.o
+ obj-$(CONFIG_MTD_NAND_CORE) += nandcore.o
+ obj-$(CONFIG_MTD_NAND_ECC_MEDIATEK) += ecc-mtk.o
++obj-$(CONFIG_MTD_NAND_MTK_BMT)	+= mtk_bmt.o mtk_bmt_v2.o mtk_bmt_bbt.o mtk_bmt_nmbm.o
+ 
+ obj-y	+= onenand/
+ obj-y	+= raw/
diff --git a/6.12/target/linux/generic/hack-6.12/600-net-enable-fraglist-GRO-by-default.patch b/6.12/target/linux/generic/hack-6.12/600-net-enable-fraglist-GRO-by-default.patch
new file mode 100644
index 00000000..feed2cd2
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/600-net-enable-fraglist-GRO-by-default.patch
@@ -0,0 +1,24 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 23 Apr 2024 12:35:21 +0200
+Subject: [PATCH] net: enable fraglist GRO by default
+
+This can significantly improve performance for packet forwarding/bridging
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/linux/netdev_features.h
++++ b/include/linux/netdev_features.h
+@@ -235,10 +235,10 @@ static inline int find_next_netdev_featu
+ #define NETIF_F_UPPER_DISABLES	NETIF_F_LRO
+ 
+ /* changeable features with no special hardware requirements */
+-#define NETIF_F_SOFT_FEATURES	(NETIF_F_GSO | NETIF_F_GRO)
++#define NETIF_F_SOFT_FEATURES	(NETIF_F_GSO | NETIF_F_GRO | NETIF_F_GRO_FRAGLIST)
+ 
+ /* Changeable features with no special hardware requirements that defaults to off. */
+-#define NETIF_F_SOFT_FEATURES_OFF	(NETIF_F_GRO_FRAGLIST | NETIF_F_GRO_UDP_FWD)
++#define NETIF_F_SOFT_FEATURES_OFF	(NETIF_F_GRO_UDP_FWD)
+ 
+ #define NETIF_F_VLAN_FEATURES	(NETIF_F_HW_VLAN_CTAG_FILTER | \
+ 				 NETIF_F_HW_VLAN_CTAG_RX | \
diff --git a/6.12/target/linux/generic/hack-6.12/601-netfilter-export-udp_get_timeouts-function.patch b/6.12/target/linux/generic/hack-6.12/601-netfilter-export-udp_get_timeouts-function.patch
new file mode 100644
index 00000000..d741cb7c
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/601-netfilter-export-udp_get_timeouts-function.patch
@@ -0,0 +1,38 @@
+From e38488fd0a8a11b4bae4ccad9a7a8cfcf9eb5ab7 Mon Sep 17 00:00:00 2001
+From: Murat Sezgin <msezgin@codeaurora.org>
+Date: Mon, 6 Apr 2020 11:08:09 -0700
+Subject: [PATCH] netfilter: export udp_get_timeouts function
+
+This function is required for acceleration support.
+
+Signed-off-by: Murat Sezgin <msezgin@codeaurora.org>
+Change-Id: Ibca4f402735764e7e6fb3ce2678e670753c6ef9c
+---
+ include/net/netfilter/nf_conntrack_timeout.h | 1 +
+ net/netfilter/nf_conntrack_proto_udp.c       | 3 ++-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+--- a/include/net/netfilter/nf_conntrack_timeout.h
++++ b/include/net/netfilter/nf_conntrack_timeout.h
+@@ -107,5 +107,6 @@ struct nf_ct_timeout_hooks {
+ 
+ extern const struct nf_ct_timeout_hooks __rcu *nf_ct_timeout_hook;
+ #endif
++extern unsigned int *udp_get_timeouts(struct net *net);
+ 
+ #endif /* _NF_CONNTRACK_TIMEOUT_H */
+--- a/net/netfilter/nf_conntrack_proto_udp.c
++++ b/net/netfilter/nf_conntrack_proto_udp.c
+@@ -29,10 +29,11 @@ static const unsigned int udp_timeouts[U
+ 	[UDP_CT_REPLIED]	= 120*HZ,
+ };
+ 
+-static unsigned int *udp_get_timeouts(struct net *net)
++unsigned int *udp_get_timeouts(struct net *net)
+ {
+ 	return nf_udp_pernet(net)->timeouts;
+ }
++EXPORT_SYMBOL(udp_get_timeouts);
+ 
+ static void udp_error_log(const struct sk_buff *skb,
+ 			  const struct nf_hook_state *state,
diff --git a/6.12/target/linux/generic/hack-6.12/645-netfilter-connmark-introduce-set-dscpmark.patch b/6.12/target/linux/generic/hack-6.12/645-netfilter-connmark-introduce-set-dscpmark.patch
new file mode 100644
index 00000000..bb802857
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/645-netfilter-connmark-introduce-set-dscpmark.patch
@@ -0,0 +1,231 @@
+From eda40b8c8c82e0f2789d6bc8bf63846dce2e8f32 Mon Sep 17 00:00:00 2001
+From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+Date: Sat, 23 Mar 2019 09:29:49 +0000
+Subject: [PATCH] netfilter: connmark: introduce set-dscpmark
+
+set-dscpmark is a method of storing the DSCP of an ip packet into
+conntrack mark.  In combination with a suitable tc filter action
+(act_ctinfo) DSCP values are able to be stored in the mark on egress and
+restored on ingress across links that otherwise alter or bleach DSCP.
+
+This is useful for qdiscs such as CAKE which are able to shape according
+to policies based on DSCP.
+
+Ingress classification is traditionally a challenging task since
+iptables rules haven't yet run and tc filter/eBPF programs are pre-NAT
+lookups, hence are unable to see internal IPv4 addresses as used on the
+typical home masquerading gateway.
+
+x_tables CONNMARK set-dscpmark target solves the problem of storing the
+DSCP to the conntrack mark in a way suitable for the new act_ctinfo tc
+action to restore.
+
+The set-dscpmark option accepts 2 parameters, a 32bit 'dscpmask' and a
+32bit 'statemask'.  The dscp mask must be 6 contiguous bits and
+represents the area where the DSCP will be stored in the connmark.  The
+state mask is a minimum 1 bit length mask that must not overlap with the
+dscpmask.  It represents a flag which is set when the DSCP has been
+stored in the conntrack mark. This is useful to implement a 'one shot'
+iptables based classification where the 'complicated' iptables rules are
+only run once to classify the connection on initial (egress) packet and
+subsequent packets are all marked/restored with the same DSCP.  A state
+mask of zero disables the setting of a status bit/s.
+
+example syntax with a suitably modified iptables user space application:
+
+iptables -A QOS_MARK_eth0 -t mangle -j CONNMARK --set-dscpmark 0xfc000000/0x01000000
+
+Would store the DSCP in the top 6 bits of the 32bit mark field, and use
+the LSB of the top byte as the 'DSCP has been stored' marker.
+
+|----0xFC----conntrack mark----000000---|
+| Bits 31-26 | bit 25 | bit24 |~~~ Bit 0|
+| DSCP       | unused | flag  |unused   |
+|-----------------------0x01---000000---|
+      ^                   ^
+      |                   |
+      ---|             Conditional flag
+         |             set this when dscp
+|-ip diffserv-|        stored in mark
+| 6 bits      |
+|-------------|
+
+an identically configured tc action to restore looks like:
+
+tc filter show dev eth0 ingress
+filter parent ffff: protocol all pref 10 u32 chain 0
+filter parent ffff: protocol all pref 10 u32 chain 0 fh 800: ht divisor 1
+filter parent ffff: protocol all pref 10 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1: not_in_hw
+  match 00000000/00000000 at 0
+	action order 1: ctinfo zone 0 pipe
+	 index 2 ref 1 bind 1 dscp 0xfc000000/0x1000000
+
+	action order 2: mirred (Egress Redirect to device ifb4eth0) stolen
+	index 1 ref 1 bind 1
+
+|----0xFC----conntrack mark----000000---|
+| Bits 31-26 | bit 25 | bit24 |~~~ Bit 0|
+| DSCP       | unused | flag  |unused   |
+|-----------------------0x01---000000---|
+      |                   |
+      |                   |
+      ---|             Conditional flag
+         v             only restore if set
+|-ip diffserv-|
+| 6 bits      |
+|-------------|
+
+Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+---
+ include/uapi/linux/netfilter/xt_connmark.h | 10 ++++
+ net/netfilter/xt_connmark.c                | 55 ++++++++++++++++++----
+ 2 files changed, 57 insertions(+), 8 deletions(-)
+
+--- a/include/uapi/linux/netfilter/xt_connmark.h
++++ b/include/uapi/linux/netfilter/xt_connmark.h
+@@ -15,6 +15,11 @@ enum {
+ };
+ 
+ enum {
++	XT_CONNMARK_VALUE =	(1 << 0),
++	XT_CONNMARK_DSCP = 	(1 << 1)
++};
++
++enum {
+ 	D_SHIFT_LEFT = 0,
+ 	D_SHIFT_RIGHT,
+ };
+@@ -29,6 +34,11 @@ struct xt_connmark_tginfo2 {
+ 	__u8 shift_dir, shift_bits, mode;
+ };
+ 
++struct xt_connmark_tginfo3 {
++	__u32 ctmark, ctmask, nfmask;
++	__u8 shift_dir, shift_bits, mode, func;
++};
++
+ struct xt_connmark_mtinfo1 {
+ 	__u32 mark, mask;
+ 	__u8 invert;
+--- a/net/netfilter/xt_connmark.c
++++ b/net/netfilter/xt_connmark.c
+@@ -24,13 +24,13 @@ MODULE_ALIAS("ipt_connmark");
+ MODULE_ALIAS("ip6t_connmark");
+ 
+ static unsigned int
+-connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo2 *info)
++connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo3 *info)
+ {
+ 	enum ip_conntrack_info ctinfo;
+ 	u_int32_t new_targetmark;
+ 	struct nf_conn *ct;
+ 	u_int32_t newmark;
+-	u_int32_t oldmark;
++	u_int8_t dscp;
+ 
+ 	ct = nf_ct_get(skb, &ctinfo);
+ 	if (ct == NULL)
+@@ -38,13 +38,24 @@ connmark_tg_shift(struct sk_buff *skb, c
+ 
+ 	switch (info->mode) {
+ 	case XT_CONNMARK_SET:
+-		oldmark = READ_ONCE(ct->mark);
+-		newmark = (oldmark & ~info->ctmask) ^ info->ctmark;
+-		if (info->shift_dir == D_SHIFT_RIGHT)
+-			newmark >>= info->shift_bits;
+-		else
+-			newmark <<= info->shift_bits;
++		newmark = READ_ONCE(ct->mark);
++		if (info->func & XT_CONNMARK_VALUE) {
++			newmark = (newmark & ~info->ctmask) ^ info->ctmark;
++			if (info->shift_dir == D_SHIFT_RIGHT)
++				newmark >>= info->shift_bits;
++			else
++				newmark <<= info->shift_bits;
++		} else if (info->func & XT_CONNMARK_DSCP) {
++			if (skb->protocol == htons(ETH_P_IP))
++				dscp = ipv4_get_dsfield(ip_hdr(skb)) >> 2;
++			else if (skb->protocol == htons(ETH_P_IPV6))
++				dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> 2;
++			else	/* protocol doesn't have diffserv */
++				break;
+ 
++			newmark = (newmark & ~info->ctmark) |
++				  (info->ctmask | (dscp << info->shift_bits));
++		}
+ 		if (READ_ONCE(ct->mark) != newmark) {
+ 			WRITE_ONCE(ct->mark, newmark);
+ 			nf_conntrack_event_cache(IPCT_MARK, ct);
+@@ -83,20 +94,36 @@ static unsigned int
+ connmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
+ {
+ 	const struct xt_connmark_tginfo1 *info = par->targinfo;
+-	const struct xt_connmark_tginfo2 info2 = {
++	const struct xt_connmark_tginfo3 info3 = {
+ 		.ctmark	= info->ctmark,
+ 		.ctmask	= info->ctmask,
+ 		.nfmask	= info->nfmask,
+ 		.mode	= info->mode,
++		.func	= XT_CONNMARK_VALUE
+ 	};
+ 
+-	return connmark_tg_shift(skb, &info2);
++	return connmark_tg_shift(skb, &info3);
+ }
+ 
+ static unsigned int
+ connmark_tg_v2(struct sk_buff *skb, const struct xt_action_param *par)
+ {
+ 	const struct xt_connmark_tginfo2 *info = par->targinfo;
++	const struct xt_connmark_tginfo3 info3 = {
++		.ctmark	= info->ctmark,
++		.ctmask	= info->ctmask,
++		.nfmask	= info->nfmask,
++		.mode	= info->mode,
++		.func	= XT_CONNMARK_VALUE
++	};
++
++	return connmark_tg_shift(skb, &info3);
++}
++
++static unsigned int
++connmark_tg_v3(struct sk_buff *skb, const struct xt_action_param *par)
++{
++	const struct xt_connmark_tginfo3 *info = par->targinfo;
+ 
+ 	return connmark_tg_shift(skb, info);
+ }
+@@ -168,6 +195,16 @@ static struct xt_target connmark_tg_reg[
+ 		.destroy        = connmark_tg_destroy,
+ 		.me             = THIS_MODULE,
+ 	},
++	{
++		.name           = "CONNMARK",
++		.revision       = 3,
++		.family         = NFPROTO_IPV4,
++		.checkentry     = connmark_tg_check,
++		.target         = connmark_tg_v3,
++		.targetsize     = sizeof(struct xt_connmark_tginfo3),
++		.destroy        = connmark_tg_destroy,
++		.me             = THIS_MODULE,
++	},
+ #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+ 	{
+ 		.name           = "CONNMARK",
+@@ -189,6 +226,16 @@ static struct xt_target connmark_tg_reg[
+ 		.destroy        = connmark_tg_destroy,
+ 		.me             = THIS_MODULE,
+ 	},
++	{
++		.name           = "CONNMARK",
++		.revision       = 3,
++		.family         = NFPROTO_IPV6,
++		.checkentry     = connmark_tg_check,
++		.target         = connmark_tg_v3,
++		.targetsize     = sizeof(struct xt_connmark_tginfo3),
++		.destroy        = connmark_tg_destroy,
++		.me             = THIS_MODULE,
++	},
+ #endif
+ };
+ 
diff --git a/6.12/target/linux/generic/hack-6.12/650-netfilter-add-xt_FLOWOFFLOAD-target.patch b/6.12/target/linux/generic/hack-6.12/650-netfilter-add-xt_FLOWOFFLOAD-target.patch
new file mode 100644
index 00000000..53093daa
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/650-netfilter-add-xt_FLOWOFFLOAD-target.patch
@@ -0,0 +1,812 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 20 Feb 2018 15:56:02 +0100
+Subject: [PATCH] netfilter: add xt_FLOWOFFLOAD target
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ create mode 100644 net/netfilter/xt_OFFLOAD.c
+
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -729,7 +729,6 @@ config NF_FLOW_TABLE
+ 	tristate "Netfilter flow table module"
+ 	depends on NETFILTER_INGRESS
+ 	depends on NF_CONNTRACK
+-	depends on NF_TABLES
+ 	help
+ 	  This option adds the flow table core infrastructure.
+ 
+@@ -1025,6 +1024,15 @@ config NETFILTER_XT_TARGET_NOTRACK
+ 	depends on NETFILTER_ADVANCED
+ 	select NETFILTER_XT_TARGET_CT
+ 
++config NETFILTER_XT_TARGET_FLOWOFFLOAD
++	tristate '"FLOWOFFLOAD" target support'
++	depends on NF_FLOW_TABLE
++	depends on NETFILTER_INGRESS
++	help
++	  This option adds a `FLOWOFFLOAD' target, which uses the nf_flow_offload
++	  module to speed up processing of packets by bypassing the usual
++	  netfilter chains
++
+ config NETFILTER_XT_TARGET_RATEEST
+ 	tristate '"RATEEST" target support'
+ 	depends on NETFILTER_ADVANCED
+--- a/net/netfilter/Makefile
++++ b/net/netfilter/Makefile
+@@ -168,6 +168,7 @@ obj-$(CONFIG_NETFILTER_XT_TARGET_CLASSIF
+ obj-$(CONFIG_NETFILTER_XT_TARGET_CONNSECMARK) += xt_CONNSECMARK.o
+ obj-$(CONFIG_NETFILTER_XT_TARGET_CT) += xt_CT.o
+ obj-$(CONFIG_NETFILTER_XT_TARGET_DSCP) += xt_DSCP.o
++obj-$(CONFIG_NETFILTER_XT_TARGET_FLOWOFFLOAD) += xt_FLOWOFFLOAD.o
+ obj-$(CONFIG_NETFILTER_XT_TARGET_HL) += xt_HL.o
+ obj-$(CONFIG_NETFILTER_XT_TARGET_HMARK) += xt_HMARK.o
+ obj-$(CONFIG_NETFILTER_XT_TARGET_LED) += xt_LED.o
+--- /dev/null
++++ b/net/netfilter/xt_FLOWOFFLOAD.c
+@@ -0,0 +1,703 @@
++/*
++ * Copyright (C) 2018-2021 Felix Fietkau <nbd@nbd.name>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++#include <linux/module.h>
++#include <linux/init.h>
++#include <linux/netfilter.h>
++#include <linux/netfilter/xt_FLOWOFFLOAD.h>
++#include <linux/if_vlan.h>
++#include <net/ip.h>
++#include <net/netfilter/nf_conntrack.h>
++#include <net/netfilter/nf_conntrack_extend.h>
++#include <net/netfilter/nf_conntrack_helper.h>
++#include <net/netfilter/nf_flow_table.h>
++
++struct xt_flowoffload_hook {
++	struct hlist_node list;
++	struct nf_hook_ops ops;
++	struct net *net;
++	bool registered;
++	bool used;
++};
++
++struct xt_flowoffload_table {
++	struct nf_flowtable ft;
++	struct hlist_head hooks;
++	struct delayed_work work;
++};
++
++struct nf_forward_info {
++	const struct net_device *indev;
++	const struct net_device *outdev;
++	const struct net_device *hw_outdev;
++	struct id {
++		__u16	id;
++		__be16	proto;
++	} encap[NF_FLOW_TABLE_ENCAP_MAX];
++	u8 num_encaps;
++	u8 ingress_vlans;
++	u8 h_source[ETH_ALEN];
++	u8 h_dest[ETH_ALEN];
++	enum flow_offload_xmit_type xmit_type;
++};
++
++static DEFINE_SPINLOCK(hooks_lock);
++
++struct xt_flowoffload_table flowtable[2];
++
++static unsigned int
++xt_flowoffload_net_hook(void *priv, struct sk_buff *skb,
++			const struct nf_hook_state *state)
++{
++	struct vlan_ethhdr *veth;
++	__be16 proto;
++
++	switch (skb->protocol) {
++	case htons(ETH_P_8021Q):
++		veth = (struct vlan_ethhdr *)skb_mac_header(skb);
++		proto = veth->h_vlan_encapsulated_proto;
++		break;
++	case htons(ETH_P_PPP_SES):
++		if (!nf_flow_pppoe_proto(skb, &proto))
++			return NF_ACCEPT;
++		break;
++	default:
++		proto = skb->protocol;
++		break;
++	}
++
++	switch (proto) {
++	case htons(ETH_P_IP):
++		return nf_flow_offload_ip_hook(priv, skb, state);
++	case htons(ETH_P_IPV6):
++		return nf_flow_offload_ipv6_hook(priv, skb, state);
++	}
++
++	return NF_ACCEPT;
++}
++
++static int
++xt_flowoffload_create_hook(struct xt_flowoffload_table *table,
++			   struct net_device *dev)
++{
++	struct xt_flowoffload_hook *hook;
++	struct nf_hook_ops *ops;
++
++	hook = kzalloc(sizeof(*hook), GFP_ATOMIC);
++	if (!hook)
++		return -ENOMEM;
++
++	ops = &hook->ops;
++	ops->pf = NFPROTO_NETDEV;
++	ops->hooknum = NF_NETDEV_INGRESS;
++	ops->priority = 10;
++	ops->priv = &table->ft;
++	ops->hook = xt_flowoffload_net_hook;
++	ops->dev = dev;
++
++	hlist_add_head(&hook->list, &table->hooks);
++	mod_delayed_work(system_power_efficient_wq, &table->work, 0);
++
++	return 0;
++}
++
++static struct xt_flowoffload_hook *
++flow_offload_lookup_hook(struct xt_flowoffload_table *table,
++			 struct net_device *dev)
++{
++	struct xt_flowoffload_hook *hook;
++
++	hlist_for_each_entry(hook, &table->hooks, list) {
++		if (hook->ops.dev == dev)
++			return hook;
++	}
++
++	return NULL;
++}
++
++static void
++xt_flowoffload_check_device(struct xt_flowoffload_table *table,
++			    struct net_device *dev)
++{
++	struct xt_flowoffload_hook *hook;
++
++	if (!dev)
++		return;
++
++	spin_lock_bh(&hooks_lock);
++	hook = flow_offload_lookup_hook(table, dev);
++	if (hook)
++		hook->used = true;
++	else
++		xt_flowoffload_create_hook(table, dev);
++	spin_unlock_bh(&hooks_lock);
++}
++
++static void
++xt_flowoffload_register_hooks(struct xt_flowoffload_table *table)
++{
++	struct xt_flowoffload_hook *hook;
++
++restart:
++	hlist_for_each_entry(hook, &table->hooks, list) {
++		if (hook->registered)
++			continue;
++
++		hook->registered = true;
++		hook->net = dev_net(hook->ops.dev);
++		spin_unlock_bh(&hooks_lock);
++		nf_register_net_hook(hook->net, &hook->ops);
++		if (table->ft.flags & NF_FLOWTABLE_HW_OFFLOAD)
++			table->ft.type->setup(&table->ft, hook->ops.dev,
++					      FLOW_BLOCK_BIND);
++		spin_lock_bh(&hooks_lock);
++		goto restart;
++	}
++
++}
++
++static bool
++xt_flowoffload_cleanup_hooks(struct xt_flowoffload_table *table)
++{
++	struct xt_flowoffload_hook *hook;
++	bool active = false;
++
++restart:
++	spin_lock_bh(&hooks_lock);
++	hlist_for_each_entry(hook, &table->hooks, list) {
++		if (hook->used || !hook->registered) {
++			active = true;
++			continue;
++		}
++
++		hlist_del(&hook->list);
++		spin_unlock_bh(&hooks_lock);
++		if (table->ft.flags & NF_FLOWTABLE_HW_OFFLOAD)
++			table->ft.type->setup(&table->ft, hook->ops.dev,
++					      FLOW_BLOCK_UNBIND);
++		nf_unregister_net_hook(hook->net, &hook->ops);
++		kfree(hook);
++		goto restart;
++	}
++	spin_unlock_bh(&hooks_lock);
++
++	return active;
++}
++
++static void
++xt_flowoffload_check_hook(struct nf_flowtable *flowtable,
++			  struct flow_offload *flow, void *data)
++{
++	struct xt_flowoffload_table *table;
++	struct flow_offload_tuple *tuple0 = &flow->tuplehash[0].tuple;
++	struct flow_offload_tuple *tuple1 = &flow->tuplehash[1].tuple;
++	struct xt_flowoffload_hook *hook;
++
++	table = container_of(flowtable, struct xt_flowoffload_table, ft);
++
++	spin_lock_bh(&hooks_lock);
++	hlist_for_each_entry(hook, &table->hooks, list) {
++		if (hook->ops.dev->ifindex != tuple0->iifidx &&
++		    hook->ops.dev->ifindex != tuple1->iifidx)
++			continue;
++
++		hook->used = true;
++	}
++	spin_unlock_bh(&hooks_lock);
++}
++
++static void
++xt_flowoffload_hook_work(struct work_struct *work)
++{
++	struct xt_flowoffload_table *table;
++	struct xt_flowoffload_hook *hook;
++	int err;
++
++	table = container_of(work, struct xt_flowoffload_table, work.work);
++
++	spin_lock_bh(&hooks_lock);
++	xt_flowoffload_register_hooks(table);
++	hlist_for_each_entry(hook, &table->hooks, list)
++		hook->used = false;
++	spin_unlock_bh(&hooks_lock);
++
++	err = nf_flow_table_iterate(&table->ft, xt_flowoffload_check_hook,
++				    NULL);
++	if (err && err != -EAGAIN)
++		goto out;
++
++	if (!xt_flowoffload_cleanup_hooks(table))
++		return;
++
++out:
++	queue_delayed_work(system_power_efficient_wq, &table->work, HZ);
++}
++
++static bool
++xt_flowoffload_skip(struct sk_buff *skb, int family)
++{
++	if (skb_sec_path(skb))
++		return true;
++
++	if (family == NFPROTO_IPV4) {
++		const struct ip_options *opt = &(IPCB(skb)->opt);
++
++		if (unlikely(opt->optlen))
++			return true;
++	}
++
++	return false;
++}
++
++static enum flow_offload_xmit_type nf_xmit_type(struct dst_entry *dst)
++{
++	if (dst_xfrm(dst))
++		return FLOW_OFFLOAD_XMIT_XFRM;
++
++	return FLOW_OFFLOAD_XMIT_NEIGH;
++}
++
++static void nf_default_forward_path(struct nf_flow_route *route,
++				    struct dst_entry *dst_cache,
++				    enum ip_conntrack_dir dir,
++				    struct net_device **dev)
++{
++	dev[!dir] = dst_cache->dev;
++	route->tuple[!dir].in.ifindex	= dst_cache->dev->ifindex;
++	route->tuple[dir].dst		= dst_cache;
++	route->tuple[dir].xmit_type	= nf_xmit_type(dst_cache);
++}
++
++static bool nf_is_valid_ether_device(const struct net_device *dev)
++{
++	if (!dev || (dev->flags & IFF_LOOPBACK) || dev->type != ARPHRD_ETHER ||
++	    dev->addr_len != ETH_ALEN || !is_valid_ether_addr(dev->dev_addr))
++		return false;
++
++	return true;
++}
++
++static void nf_dev_path_info(const struct net_device_path_stack *stack,
++			     struct nf_forward_info *info,
++			     unsigned char *ha)
++{
++	const struct net_device_path *path;
++	int i;
++
++	memcpy(info->h_dest, ha, ETH_ALEN);
++
++	for (i = 0; i < stack->num_paths; i++) {
++		path = &stack->path[i];
++		switch (path->type) {
++		case DEV_PATH_ETHERNET:
++		case DEV_PATH_DSA:
++		case DEV_PATH_VLAN:
++		case DEV_PATH_PPPOE:
++			info->indev = path->dev;
++			if (is_zero_ether_addr(info->h_source))
++				memcpy(info->h_source, path->dev->dev_addr, ETH_ALEN);
++
++			if (path->type == DEV_PATH_ETHERNET)
++				break;
++			if (path->type == DEV_PATH_DSA) {
++				i = stack->num_paths;
++				break;
++			}
++
++			/* DEV_PATH_VLAN and DEV_PATH_PPPOE */
++			if (info->num_encaps >= NF_FLOW_TABLE_ENCAP_MAX) {
++				info->indev = NULL;
++				break;
++			}
++			if (!info->outdev)
++				info->outdev = path->dev;
++			info->encap[info->num_encaps].id = path->encap.id;
++			info->encap[info->num_encaps].proto = path->encap.proto;
++			info->num_encaps++;
++			if (path->type == DEV_PATH_PPPOE)
++				memcpy(info->h_dest, path->encap.h_dest, ETH_ALEN);
++			break;
++		case DEV_PATH_BRIDGE:
++			if (is_zero_ether_addr(info->h_source))
++				memcpy(info->h_source, path->dev->dev_addr, ETH_ALEN);
++
++			switch (path->bridge.vlan_mode) {
++			case DEV_PATH_BR_VLAN_UNTAG_HW:
++				info->ingress_vlans |= BIT(info->num_encaps - 1);
++				break;
++			case DEV_PATH_BR_VLAN_TAG:
++				info->encap[info->num_encaps].id = path->bridge.vlan_id;
++				info->encap[info->num_encaps].proto = path->bridge.vlan_proto;
++				info->num_encaps++;
++				break;
++			case DEV_PATH_BR_VLAN_UNTAG:
++				info->num_encaps--;
++				break;
++			case DEV_PATH_BR_VLAN_KEEP:
++				break;
++			}
++			break;
++		default:
++			info->indev = NULL;
++			break;
++		}
++	}
++	if (!info->outdev)
++		info->outdev = info->indev;
++
++	info->hw_outdev = info->indev;
++
++	if (nf_is_valid_ether_device(info->indev))
++		info->xmit_type = FLOW_OFFLOAD_XMIT_DIRECT;
++}
++
++static int nf_dev_fill_forward_path(const struct nf_flow_route *route,
++				     const struct dst_entry *dst_cache,
++				     const struct nf_conn *ct,
++				     enum ip_conntrack_dir dir, u8 *ha,
++				     struct net_device_path_stack *stack)
++{
++	const void *daddr = &ct->tuplehash[!dir].tuple.src.u3;
++	struct net_device *dev = dst_cache->dev;
++	struct neighbour *n;
++	u8 nud_state;
++
++	if (!nf_is_valid_ether_device(dev))
++		goto out;
++
++	n = dst_neigh_lookup(dst_cache, daddr);
++	if (!n)
++		return -1;
++
++	read_lock_bh(&n->lock);
++	nud_state = n->nud_state;
++	ether_addr_copy(ha, n->ha);
++	read_unlock_bh(&n->lock);
++	neigh_release(n);
++
++	if (!(nud_state & NUD_VALID))
++		return -1;
++
++out:
++	return dev_fill_forward_path(dev, ha, stack);
++}
++
++static void nf_dev_forward_path(struct nf_flow_route *route,
++				const struct nf_conn *ct,
++				enum ip_conntrack_dir dir,
++				struct net_device **devs)
++{
++	const struct dst_entry *dst = route->tuple[dir].dst;
++	struct net_device_path_stack stack;
++	struct nf_forward_info info = {};
++	unsigned char ha[ETH_ALEN];
++	int i;
++
++	if (nf_dev_fill_forward_path(route, dst, ct, dir, ha, &stack) >= 0)
++		nf_dev_path_info(&stack, &info, ha);
++
++	devs[!dir] = (struct net_device *)info.indev;
++	if (!info.indev)
++		return;
++
++	route->tuple[!dir].in.ifindex = info.indev->ifindex;
++	for (i = 0; i < info.num_encaps; i++) {
++		route->tuple[!dir].in.encap[i].id = info.encap[i].id;
++		route->tuple[!dir].in.encap[i].proto = info.encap[i].proto;
++	}
++	route->tuple[!dir].in.num_encaps = info.num_encaps;
++	route->tuple[!dir].in.ingress_vlans = info.ingress_vlans;
++
++	if (info.xmit_type == FLOW_OFFLOAD_XMIT_DIRECT) {
++		memcpy(route->tuple[dir].out.h_source, info.h_source, ETH_ALEN);
++		memcpy(route->tuple[dir].out.h_dest, info.h_dest, ETH_ALEN);
++		route->tuple[dir].out.ifindex = info.outdev->ifindex;
++		route->tuple[dir].out.hw_ifindex = info.hw_outdev->ifindex;
++		route->tuple[dir].xmit_type = info.xmit_type;
++	}
++}
++
++static int
++xt_flowoffload_route(struct sk_buff *skb, const struct nf_conn *ct,
++		     const struct xt_action_param *par,
++		     struct nf_flow_route *route, enum ip_conntrack_dir dir,
++		     struct net_device **devs)
++{
++	struct dst_entry *this_dst = skb_dst(skb);
++	struct dst_entry *other_dst = NULL;
++	struct flowi fl;
++
++	memset(&fl, 0, sizeof(fl));
++	switch (xt_family(par)) {
++	case NFPROTO_IPV4:
++		fl.u.ip4.daddr = ct->tuplehash[dir].tuple.src.u3.ip;
++		fl.u.ip4.flowi4_oif = xt_in(par)->ifindex;
++		break;
++	case NFPROTO_IPV6:
++		fl.u.ip6.saddr = ct->tuplehash[!dir].tuple.dst.u3.in6;
++		fl.u.ip6.daddr = ct->tuplehash[dir].tuple.src.u3.in6;
++		fl.u.ip6.flowi6_oif = xt_in(par)->ifindex;
++		break;
++	}
++
++	if (!dst_hold_safe(this_dst))
++		return -ENOENT;
++
++	nf_route(xt_net(par), &other_dst, &fl, false, xt_family(par));
++	if (!other_dst) {
++		dst_release(this_dst);
++		return -ENOENT;
++	}
++
++	nf_default_forward_path(route, this_dst, dir, devs);
++	nf_default_forward_path(route, other_dst, !dir, devs);
++
++	if (route->tuple[dir].xmit_type	== FLOW_OFFLOAD_XMIT_NEIGH &&
++	    route->tuple[!dir].xmit_type == FLOW_OFFLOAD_XMIT_NEIGH) {
++		nf_dev_forward_path(route, ct, dir, devs);
++		nf_dev_forward_path(route, ct, !dir, devs);
++	}
++
++	return 0;
++}
++
++static unsigned int
++flowoffload_tg(struct sk_buff *skb, const struct xt_action_param *par)
++{
++	struct xt_flowoffload_table *table;
++	const struct xt_flowoffload_target_info *info = par->targinfo;
++	struct tcphdr _tcph, *tcph = NULL;
++	enum ip_conntrack_info ctinfo;
++	enum ip_conntrack_dir dir;
++	struct nf_flow_route route = {};
++	struct flow_offload *flow = NULL;
++	struct net_device *devs[2] = {};
++	struct nf_conn *ct;
++	struct net *net;
++
++	if (xt_flowoffload_skip(skb, xt_family(par)))
++		return XT_CONTINUE;
++
++	ct = nf_ct_get(skb, &ctinfo);
++	if (ct == NULL)
++		return XT_CONTINUE;
++
++	switch (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum) {
++	case IPPROTO_TCP:
++		if (ct->proto.tcp.state != TCP_CONNTRACK_ESTABLISHED)
++			return XT_CONTINUE;
++
++		tcph = skb_header_pointer(skb, par->thoff,
++					  sizeof(_tcph), &_tcph);
++		if (unlikely(!tcph || tcph->fin || tcph->rst))
++			return XT_CONTINUE;
++		break;
++	case IPPROTO_UDP:
++		break;
++	default:
++		return XT_CONTINUE;
++	}
++
++	if (nf_ct_ext_exist(ct, NF_CT_EXT_HELPER) ||
++	    ct->status & (IPS_SEQ_ADJUST | IPS_NAT_CLASH))
++		return XT_CONTINUE;
++
++	if (!nf_ct_is_confirmed(ct))
++		return XT_CONTINUE;
++
++	dir = CTINFO2DIR(ctinfo);
++
++	devs[dir] = xt_out(par);
++	devs[!dir] = xt_in(par);
++
++	if (!devs[dir] || !devs[!dir])
++		return XT_CONTINUE;
++
++	if (test_and_set_bit(IPS_OFFLOAD_BIT, &ct->status))
++		return XT_CONTINUE;
++
++	if (xt_flowoffload_route(skb, ct, par, &route, dir, devs) < 0)
++		goto err_flow_route;
++
++	flow = flow_offload_alloc(ct);
++	if (!flow)
++		goto err_flow_alloc;
++
++	flow_offload_route_init(flow, &route);
++
++	if (tcph) {
++		ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
++		ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
++	}
++
++	table = &flowtable[!!(info->flags & XT_FLOWOFFLOAD_HW)];
++
++	net = read_pnet(&table->ft.net);
++	if (!net)
++		write_pnet(&table->ft.net, xt_net(par));
++
++	__set_bit(NF_FLOW_HW_BIDIRECTIONAL, &flow->flags);
++	if (flow_offload_add(&table->ft, flow) < 0)
++		goto err_flow_add;
++
++	xt_flowoffload_check_device(table, devs[0]);
++	xt_flowoffload_check_device(table, devs[1]);
++
++	return XT_CONTINUE;
++
++err_flow_add:
++	flow_offload_free(flow);
++err_flow_alloc:
++	dst_release(route.tuple[dir].dst);
++	dst_release(route.tuple[!dir].dst);
++err_flow_route:
++	clear_bit(IPS_OFFLOAD_BIT, &ct->status);
++
++	return XT_CONTINUE;
++}
++
++static int flowoffload_chk(const struct xt_tgchk_param *par)
++{
++	struct xt_flowoffload_target_info *info = par->targinfo;
++
++	if (info->flags & ~XT_FLOWOFFLOAD_MASK)
++		return -EINVAL;
++
++	return 0;
++}
++
++static struct xt_target offload_tg_reg __read_mostly = {
++	.family		= NFPROTO_UNSPEC,
++	.name		= "FLOWOFFLOAD",
++	.revision	= 0,
++	.targetsize	= sizeof(struct xt_flowoffload_target_info),
++	.usersize	= sizeof(struct xt_flowoffload_target_info),
++	.checkentry	= flowoffload_chk,
++	.target		= flowoffload_tg,
++	.me		= THIS_MODULE,
++};
++
++static int flow_offload_netdev_event(struct notifier_block *this,
++				     unsigned long event, void *ptr)
++{
++	struct xt_flowoffload_hook *hook0, *hook1;
++	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
++
++	if (event != NETDEV_UNREGISTER)
++		return NOTIFY_DONE;
++
++	spin_lock_bh(&hooks_lock);
++	hook0 = flow_offload_lookup_hook(&flowtable[0], dev);
++	if (hook0)
++		hlist_del(&hook0->list);
++
++	hook1 = flow_offload_lookup_hook(&flowtable[1], dev);
++	if (hook1)
++		hlist_del(&hook1->list);
++	spin_unlock_bh(&hooks_lock);
++
++	if (hook0) {
++		nf_unregister_net_hook(hook0->net, &hook0->ops);
++		kfree(hook0);
++	}
++
++	if (hook1) {
++		nf_unregister_net_hook(hook1->net, &hook1->ops);
++		kfree(hook1);
++	}
++
++	nf_flow_table_cleanup(dev);
++
++	return NOTIFY_DONE;
++}
++
++static struct notifier_block flow_offload_netdev_notifier = {
++	.notifier_call	= flow_offload_netdev_event,
++};
++
++static int nf_flow_rule_route_inet(struct net *net,
++				   struct flow_offload *flow,
++				   enum flow_offload_tuple_dir dir,
++				   struct nf_flow_rule *flow_rule)
++{
++	const struct flow_offload_tuple *flow_tuple = &flow->tuplehash[dir].tuple;
++	int err;
++
++	switch (flow_tuple->l3proto) {
++	case NFPROTO_IPV4:
++		err = nf_flow_rule_route_ipv4(net, flow, dir, flow_rule);
++		break;
++	case NFPROTO_IPV6:
++		err = nf_flow_rule_route_ipv6(net, flow, dir, flow_rule);
++		break;
++	default:
++		err = -1;
++		break;
++	}
++
++	return err;
++}
++
++static struct nf_flowtable_type flowtable_inet = {
++	.family		= NFPROTO_INET,
++	.init		= nf_flow_table_init,
++	.setup		= nf_flow_table_offload_setup,
++	.action		= nf_flow_rule_route_inet,
++	.free		= nf_flow_table_free,
++	.hook		= xt_flowoffload_net_hook,
++	.owner		= THIS_MODULE,
++};
++
++static int init_flowtable(struct xt_flowoffload_table *tbl)
++{
++	INIT_DELAYED_WORK(&tbl->work, xt_flowoffload_hook_work);
++	tbl->ft.type = &flowtable_inet;
++	tbl->ft.flags = NF_FLOWTABLE_COUNTER;
++
++	return nf_flow_table_init(&tbl->ft);
++}
++
++static int __init xt_flowoffload_tg_init(void)
++{
++	int ret;
++
++	register_netdevice_notifier(&flow_offload_netdev_notifier);
++
++	ret = init_flowtable(&flowtable[0]);
++	if (ret)
++		return ret;
++
++	ret = init_flowtable(&flowtable[1]);
++	if (ret)
++		goto cleanup;
++
++	flowtable[1].ft.flags |= NF_FLOWTABLE_HW_OFFLOAD;
++
++	ret = xt_register_target(&offload_tg_reg);
++	if (ret)
++		goto cleanup2;
++
++	return 0;
++
++cleanup2:
++	nf_flow_table_free(&flowtable[1].ft);
++cleanup:
++	nf_flow_table_free(&flowtable[0].ft);
++	return ret;
++}
++
++static void __exit xt_flowoffload_tg_exit(void)
++{
++	xt_unregister_target(&offload_tg_reg);
++	unregister_netdevice_notifier(&flow_offload_netdev_notifier);
++	nf_flow_table_free(&flowtable[0].ft);
++	nf_flow_table_free(&flowtable[1].ft);
++}
++
++MODULE_LICENSE("GPL");
++module_init(xt_flowoffload_tg_init);
++module_exit(xt_flowoffload_tg_exit);
+--- a/net/netfilter/nf_flow_table_core.c
++++ b/net/netfilter/nf_flow_table_core.c
+@@ -7,7 +7,6 @@
+ #include <linux/netdevice.h>
+ #include <net/ip.h>
+ #include <net/ip6_route.h>
+-#include <net/netfilter/nf_tables.h>
+ #include <net/netfilter/nf_flow_table.h>
+ #include <net/netfilter/nf_conntrack.h>
+ #include <net/netfilter/nf_conntrack_core.h>
+@@ -373,8 +372,7 @@ flow_offload_lookup(struct nf_flowtable
+ }
+ EXPORT_SYMBOL_GPL(flow_offload_lookup);
+ 
+-static int
+-nf_flow_table_iterate(struct nf_flowtable *flow_table,
++int nf_flow_table_iterate(struct nf_flowtable *flow_table,
+ 		      void (*iter)(struct nf_flowtable *flowtable,
+ 				   struct flow_offload *flow, void *data),
+ 		      void *data)
+@@ -435,6 +433,7 @@ static void nf_flow_offload_gc_step(stru
+ 		nf_flow_offload_stats(flow_table, flow);
+ 	}
+ }
++EXPORT_SYMBOL_GPL(nf_flow_table_iterate);
+ 
+ void nf_flow_table_gc_run(struct nf_flowtable *flow_table)
+ {
+--- /dev/null
++++ b/include/uapi/linux/netfilter/xt_FLOWOFFLOAD.h
+@@ -0,0 +1,17 @@
++/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
++#ifndef _XT_FLOWOFFLOAD_H
++#define _XT_FLOWOFFLOAD_H
++
++#include <linux/types.h>
++
++enum {
++	XT_FLOWOFFLOAD_HW	= 1 << 0,
++
++	XT_FLOWOFFLOAD_MASK	= XT_FLOWOFFLOAD_HW
++};
++
++struct xt_flowoffload_target_info {
++	__u32 flags;
++};
++
++#endif /* _XT_FLOWOFFLOAD_H */
+--- a/include/net/netfilter/nf_flow_table.h
++++ b/include/net/netfilter/nf_flow_table.h
+@@ -294,6 +294,11 @@ void nf_flow_table_free(struct nf_flowta
+ 
+ void flow_offload_teardown(struct flow_offload *flow);
+ 
++int nf_flow_table_iterate(struct nf_flowtable *flow_table,
++                      void (*iter)(struct nf_flowtable *flowtable,
++                                   struct flow_offload *flow, void *data),
++                      void *data);
++
+ void nf_flow_snat_port(const struct flow_offload *flow,
+ 		       struct sk_buff *skb, unsigned int thoff,
+ 		       u8 protocol, enum flow_offload_tuple_dir dir);
diff --git a/6.12/target/linux/generic/hack-6.12/651-wireless_mesh_header.patch b/6.12/target/linux/generic/hack-6.12/651-wireless_mesh_header.patch
new file mode 100644
index 00000000..d3f85ea1
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/651-wireless_mesh_header.patch
@@ -0,0 +1,24 @@
+From 6d3bc769657b0ee7c7506dad9911111c4226a7ea Mon Sep 17 00:00:00 2001
+From: Imre Kaloz <kaloz@openwrt.org>
+Date: Fri, 7 Jul 2017 17:21:05 +0200
+Subject: mac80211: increase wireless mesh header size
+
+lede-commit 3d4466cfd8f75f717efdb1f96fdde3c70d865fc1
+Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
+---
+ include/linux/netdevice.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -159,8 +159,8 @@ static inline bool dev_xmit_complete(int
+ 
+ #if defined(CONFIG_HYPERV_NET)
+ # define LL_MAX_HEADER 128
+-#elif defined(CONFIG_WLAN) || IS_ENABLED(CONFIG_AX25)
+-# if defined(CONFIG_MAC80211_MESH)
++#elif defined(CONFIG_WLAN) || IS_ENABLED(CONFIG_AX25) || 1
++# if defined(CONFIG_MAC80211_MESH) || 1
+ #  define LL_MAX_HEADER 128
+ # else
+ #  define LL_MAX_HEADER 96
diff --git a/6.12/target/linux/generic/hack-6.12/660-fq_codel_defaults.patch b/6.12/target/linux/generic/hack-6.12/660-fq_codel_defaults.patch
new file mode 100644
index 00000000..c48d72a4
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/660-fq_codel_defaults.patch
@@ -0,0 +1,27 @@
+From a6ccb238939b25851474a279b20367fd24a0e816 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 7 Jul 2017 17:21:53 +0200
+Subject:  hack: net: fq_codel: tune defaults for small devices
+
+Assume that x86_64 devices always have a big memory and do not need this 
+optimization compared to devices with only 32 MB or 64 MB RAM.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ net/sched/sch_fq_codel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sched/sch_fq_codel.c
++++ b/net/sched/sch_fq_codel.c
+@@ -480,7 +480,11 @@ static int fq_codel_init(struct Qdisc *s
+ 
+ 	sch->limit = 10*1024;
+ 	q->flows_cnt = 1024;
++#ifdef CONFIG_X86_64
+ 	q->memory_limit = 32 << 20; /* 32 MBytes */
++#else
++	q->memory_limit = 4 << 20; /* 4 MBytes */
++#endif
+ 	q->drop_batch_size = 64;
+ 	q->quantum = psched_mtu(qdisc_dev(sch));
+ 	INIT_LIST_HEAD(&q->new_flows);
diff --git a/6.12/target/linux/generic/hack-6.12/661-kernel-ct-size-the-hashtable-more-adequately.patch b/6.12/target/linux/generic/hack-6.12/661-kernel-ct-size-the-hashtable-more-adequately.patch
new file mode 100644
index 00000000..e06e5850
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/661-kernel-ct-size-the-hashtable-more-adequately.patch
@@ -0,0 +1,25 @@
+From 804fbb3f2ec9283f7b778e057a68bfff440a0be6 Mon Sep 17 00:00:00 2001
+From: Rui Salvaterra <rsalvaterra@gmail.com>
+Date: Wed, 30 Mar 2022 22:51:55 +0100
+Subject: [PATCH] kernel: ct: size the hashtable more adequately
+
+To set the default size of the connection tracking hash table, a divider of
+16384 becomes inadequate for a router handling lots of connections. Divide by
+2048 instead, making the default size scale better with the available RAM.
+
+Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
+---
+ net/netfilter/nf_conntrack_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -2631,7 +2631,7 @@ int nf_conntrack_init_start(void)
+ 
+ 	if (!nf_conntrack_htable_size) {
+ 		nf_conntrack_htable_size
+-			= (((nr_pages << PAGE_SHIFT) / 16384)
++			= (((nr_pages << PAGE_SHIFT) / 2048)
+ 			   / sizeof(struct hlist_head));
+ 		if (BITS_PER_LONG >= 64 &&
+ 		    nr_pages > (4 * (1024 * 1024 * 1024 / PAGE_SIZE)))
diff --git a/6.12/target/linux/generic/hack-6.12/700-swconfig_switch_drivers.patch b/6.12/target/linux/generic/hack-6.12/700-swconfig_switch_drivers.patch
new file mode 100644
index 00000000..4591a42f
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/700-swconfig_switch_drivers.patch
@@ -0,0 +1,131 @@
+From 36e516290611e613aa92996cb4339561452695b4 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 7 Jul 2017 17:24:23 +0200
+Subject: net: swconfig: adds openwrt switch layer
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ drivers/net/phy/Kconfig   | 83 +++++++++++++++++++++++++++++++++++++++++++++++
+ drivers/net/phy/Makefile  | 15 +++++++++
+ include/uapi/linux/Kbuild |  1 +
+ 3 files changed, 99 insertions(+)
+
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -77,6 +77,80 @@ config SFP
+ 	depends on HWMON || HWMON=n
+ 	select MDIO_I2C
+ 
++comment "Switch configuration API + drivers"
++
++config SWCONFIG
++	tristate "Switch configuration API"
++	help
++	  Switch configuration API using netlink. This allows
++	  you to configure the VLAN features of certain switches.
++
++config SWCONFIG_LEDS
++	bool "Switch LED trigger support"
++	depends on (SWCONFIG && LEDS_TRIGGERS)
++
++config ADM6996_PHY
++	tristate "Driver for ADM6996 switches"
++	select SWCONFIG
++	help
++	  Currently supports the ADM6996FC and ADM6996M switches.
++	  Support for FC is very limited.
++
++config AR8216_PHY
++	tristate "Driver for Atheros AR8216/8327 switches"
++	select SWCONFIG
++	select ETHERNET_PACKET_MANGLE
++
++config AR8216_PHY_LEDS
++	bool "Atheros AR8216 switch LED support"
++	depends on (AR8216_PHY && LEDS_CLASS)
++
++source "drivers/net/phy/b53/Kconfig"
++
++config IP17XX_PHY
++	tristate "Driver for IC+ IP17xx switches"
++	select SWCONFIG
++
++config PSB6970_PHY
++	tristate "Lantiq XWAY Tantos (PSB6970) Ethernet switch"
++	select SWCONFIG
++
++config RTL8306_PHY
++	tristate "Driver for Realtek RTL8306S switches"
++	select SWCONFIG
++
++config RTL8366_SMI
++	tristate "Driver for the RTL8366 SMI interface"
++	depends on GPIOLIB
++	help
++	  This module implements the SMI interface protocol which is used
++	  by some RTL8366 ethernet switch devices via the generic GPIO API.
++
++if RTL8366_SMI
++
++config RTL8366_SMI_DEBUG_FS
++	bool "RTL8366 SMI interface debugfs support"
++        depends on DEBUG_FS
++        default n
++
++config RTL8366S_PHY
++	tristate "Driver for the Realtek RTL8366S switch"
++	select SWCONFIG
++
++config RTL8366RB_PHY
++	tristate "Driver for the Realtek RTL8366RB switch"
++	select SWCONFIG
++
++config RTL8367_PHY
++	tristate "Driver for the Realtek RTL8367R/M switches"
++	select SWCONFIG
++
++config RTL8367B_PHY
++	tristate "Driver fot the Realtek RTL8367R-VB switch"
++	select SWCONFIG
++
++endif # RTL8366_SMI
++
+ comment "MII PHY device drivers"
+ 
+ config AIR_EN8811H_PHY
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -27,6 +27,21 @@ libphy-$(CONFIG_OPEN_ALLIANCE_HELPERS) +
+ obj-$(CONFIG_PHYLINK)		+= phylink.o
+ obj-$(CONFIG_PHYLIB)		+= libphy.o
+ 
++obj-$(CONFIG_SWCONFIG)		+= swconfig.o
++obj-$(CONFIG_ADM6996_PHY)	+= adm6996.o
++obj-$(CONFIG_AR8216_PHY)	+= ar8xxx.o
++ar8xxx-y			+= ar8216.o
++ar8xxx-y			+= ar8327.o
++obj-$(CONFIG_SWCONFIG_B53)	+= b53/
++obj-$(CONFIG_IP17XX_PHY)	+= ip17xx.o
++obj-$(CONFIG_PSB6970_PHY)	+= psb6970.o
++obj-$(CONFIG_RTL8306_PHY)	+= rtl8306.o
++obj-$(CONFIG_RTL8366_SMI)	+= rtl8366_smi.o
++obj-$(CONFIG_RTL8366S_PHY)	+= rtl8366s.o
++obj-$(CONFIG_RTL8366RB_PHY)	+= rtl8366rb.o
++obj-$(CONFIG_RTL8367_PHY)	+= rtl8367.o
++obj-$(CONFIG_RTL8367B_PHY)	+= rtl8367b.o
++
+ obj-$(CONFIG_NETWORK_PHY_TIMESTAMPING) += mii_timestamper.o
+ 
+ obj-$(CONFIG_SFP)		+= sfp.o
+--- a/include/linux/platform_data/b53.h
++++ b/include/linux/platform_data/b53.h
+@@ -29,6 +29,9 @@ struct b53_platform_data {
+ 	u32 chip_id;
+ 	u16 enabled_ports;
+ 
++	/* allow to specify an ethX alias */
++	const char *alias;
++
+ 	/* only used by MMAP'd driver */
+ 	unsigned big_endian:1;
+ 	void __iomem *regs;
diff --git a/6.12/target/linux/generic/hack-6.12/711-net-dsa-mv88e6xxx-disable-ATU-violation.patch b/6.12/target/linux/generic/hack-6.12/711-net-dsa-mv88e6xxx-disable-ATU-violation.patch
new file mode 100644
index 00000000..604adff3
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/711-net-dsa-mv88e6xxx-disable-ATU-violation.patch
@@ -0,0 +1,21 @@
+From ebd924d773223593142d417c41d4ee6fa16f1805 Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Wed, 13 Jul 2022 13:45:56 +0200
+Subject: [PATCH] net/dsa/mv88e6xxx: disable ATU violation
+
+---
+ drivers/net/dsa/mv88e6xxx/chip.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -3541,6 +3541,9 @@ static int mv88e6xxx_setup_port(struct m
+ 	else
+ 		reg = 1 << port;
+ 
++	/* Disable ATU member violation interrupt */
++	reg |= MV88E6XXX_PORT_ASSOC_VECTOR_IGNORE_WRONG;
++
+ 	err = mv88e6xxx_port_write(chip, port, MV88E6XXX_PORT_ASSOC_VECTOR,
+ 				   reg);
+ 	if (err)
diff --git a/6.12/target/linux/generic/hack-6.12/722-net-phy-aquantia-enable-AQR112-and-AQR412.patch b/6.12/target/linux/generic/hack-6.12/722-net-phy-aquantia-enable-AQR112-and-AQR412.patch
new file mode 100644
index 00000000..2d7edc9e
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/722-net-phy-aquantia-enable-AQR112-and-AQR412.patch
@@ -0,0 +1,117 @@
+From 5f62951fba63a9f9cfff564209426bdea5fcc371 Mon Sep 17 00:00:00 2001
+From: Alex Marginean <alexandru.marginean@nxp.com>
+Date: Tue, 27 Aug 2019 15:16:56 +0300
+Subject: [PATCH] drivers: net: phy: aquantia: enable AQR112 and AQR412
+
+Adds support for AQR112 and AQR412 which is mostly based on existing code
+with the addition of code configuring the protocol on system side.
+This allows changing the system side protocol without having to deploy a
+different firmware on the PHY.
+
+Signed-off-by: Alex Marginean <alexandru.marginean@nxp.com>
+---
+ drivers/net/phy/aquantia/aquantia_main.c | 88 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 88 insertions(+)
+
+--- a/drivers/net/phy/aquantia/aquantia_main.c
++++ b/drivers/net/phy/aquantia/aquantia_main.c
+@@ -97,6 +97,29 @@
+ #define AQR107_OP_IN_PROG_SLEEP		1000
+ #define AQR107_OP_IN_PROG_TIMEOUT	100000
+ 
++/* registers in MDIO_MMD_VEND1 region */
++#define AQUANTIA_VND1_GLOBAL_SC			0x000
++#define  AQUANTIA_VND1_GLOBAL_SC_LP		BIT(0xb)
++
++/* global start rate, the protocol associated with this speed is used by default
++ * on SI.
++ */
++#define AQUANTIA_VND1_GSTART_RATE		0x31a
++#define  AQUANTIA_VND1_GSTART_RATE_OFF		0
++#define  AQUANTIA_VND1_GSTART_RATE_100M		1
++#define  AQUANTIA_VND1_GSTART_RATE_1G		2
++#define  AQUANTIA_VND1_GSTART_RATE_10G		3
++#define  AQUANTIA_VND1_GSTART_RATE_2_5G		4
++#define  AQUANTIA_VND1_GSTART_RATE_5G		5
++
++/* SYSCFG registers for 100M, 1G, 2.5G, 5G, 10G */
++#define AQUANTIA_VND1_GSYSCFG_BASE		0x31b
++#define AQUANTIA_VND1_GSYSCFG_100M		0
++#define AQUANTIA_VND1_GSYSCFG_1G		1
++#define AQUANTIA_VND1_GSYSCFG_2_5G		2
++#define AQUANTIA_VND1_GSYSCFG_5G		3
++#define AQUANTIA_VND1_GSYSCFG_10G		4
++
+ static int aqr107_get_sset_count(struct phy_device *phydev)
+ {
+ 	return AQR107_SGMII_STAT_SZ;
+@@ -203,6 +226,51 @@ static int aqr_config_aneg(struct phy_de
+ 	return genphy_c45_check_and_restart_aneg(phydev, changed);
+ }
+ 
++static struct {
++	u16 syscfg;
++	int cnt;
++	u16 start_rate;
++} aquantia_syscfg[PHY_INTERFACE_MODE_MAX] = {
++	[PHY_INTERFACE_MODE_SGMII] =      {0x04b, AQUANTIA_VND1_GSYSCFG_1G,
++					   AQUANTIA_VND1_GSTART_RATE_1G},
++	[PHY_INTERFACE_MODE_2500BASEX] = {0x144, AQUANTIA_VND1_GSYSCFG_2_5G,
++					   AQUANTIA_VND1_GSTART_RATE_2_5G},
++	[PHY_INTERFACE_MODE_XGMII] =      {0x100, AQUANTIA_VND1_GSYSCFG_10G,
++					   AQUANTIA_VND1_GSTART_RATE_10G},
++	[PHY_INTERFACE_MODE_USXGMII] =    {0x080, AQUANTIA_VND1_GSYSCFG_10G,
++					   AQUANTIA_VND1_GSTART_RATE_10G},
++};
++
++/* Sets up protocol on system side before calling aqr_config_aneg */
++static int aqr_config_aneg_set_prot(struct phy_device *phydev)
++{
++	int if_type = phydev->interface;
++	int i;
++
++	if (!aquantia_syscfg[if_type].cnt)
++		return 0;
++
++	/* set PHY in low power mode so we can configure protocols */
++	phy_write_mmd(phydev, MDIO_MMD_VEND1, AQUANTIA_VND1_GLOBAL_SC,
++		      AQUANTIA_VND1_GLOBAL_SC_LP);
++	mdelay(10);
++
++	/* set the default rate to enable the SI link */
++	phy_write_mmd(phydev, MDIO_MMD_VEND1, AQUANTIA_VND1_GSTART_RATE,
++		      aquantia_syscfg[if_type].start_rate);
++
++	for (i = 0; i <= aquantia_syscfg[if_type].cnt; i++)
++		phy_write_mmd(phydev, MDIO_MMD_VEND1,
++			      AQUANTIA_VND1_GSYSCFG_BASE + i,
++			      aquantia_syscfg[if_type].syscfg);
++
++	/* wake PHY back up */
++	phy_write_mmd(phydev, MDIO_MMD_VEND1, AQUANTIA_VND1_GLOBAL_SC, 0);
++	mdelay(10);
++
++	return aqr_config_aneg(phydev);
++}
++
+ static int aqr_config_intr(struct phy_device *phydev)
+ {
+ 	bool en = phydev->interrupts == PHY_INTERRUPT_ENABLED;
+@@ -972,7 +1040,7 @@ static struct phy_driver aqr_driver[] =
+ 	PHY_ID_MATCH_MODEL(PHY_ID_AQR112),
+ 	.name		= "Aquantia AQR112",
+ 	.probe		= aqr107_probe,
+-	.config_aneg    = aqr_config_aneg,
++	.config_aneg    = aqr_config_aneg_set_prot,
+ 	.config_intr	= aqr_config_intr,
+ 	.handle_interrupt = aqr_handle_interrupt,
+ 	.get_tunable    = aqr107_get_tunable,
+@@ -995,7 +1063,7 @@ static struct phy_driver aqr_driver[] =
+ 	PHY_ID_MATCH_MODEL(PHY_ID_AQR412),
+ 	.name		= "Aquantia AQR412",
+ 	.probe		= aqr107_probe,
+-	.config_aneg    = aqr_config_aneg,
++	.config_aneg    = aqr_config_aneg_set_prot,
+ 	.config_intr	= aqr_config_intr,
+ 	.handle_interrupt = aqr_handle_interrupt,
+ 	.get_tunable    = aqr107_get_tunable,
diff --git a/6.12/target/linux/generic/hack-6.12/723-net-phy-aquantia-fix-system-side-protocol-mi.patch b/6.12/target/linux/generic/hack-6.12/723-net-phy-aquantia-fix-system-side-protocol-mi.patch
new file mode 100644
index 00000000..eaeb3b6a
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/723-net-phy-aquantia-fix-system-side-protocol-mi.patch
@@ -0,0 +1,34 @@
+From 5f008cb22f60da4e10375f22266c1a4e20b1252e Mon Sep 17 00:00:00 2001
+From: Alex Marginean <alexandru.marginean@nxp.com>
+Date: Fri, 20 Sep 2019 18:22:52 +0300
+Subject: [PATCH] drivers: net: phy: aquantia: fix system side protocol
+ misconfiguration
+
+Do not set up protocols for speeds that are not supported by FW.  Enabling
+these protocols leads to link issues on system side.
+
+Signed-off-by: Alex Marginean <alexandru.marginean@nxp.com>
+---
+ drivers/net/phy/aquantia/aquantia_main.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/phy/aquantia/aquantia_main.c
++++ b/drivers/net/phy/aquantia/aquantia_main.c
+@@ -259,10 +259,16 @@ static int aqr_config_aneg_set_prot(stru
+ 	phy_write_mmd(phydev, MDIO_MMD_VEND1, AQUANTIA_VND1_GSTART_RATE,
+ 		      aquantia_syscfg[if_type].start_rate);
+ 
+-	for (i = 0; i <= aquantia_syscfg[if_type].cnt; i++)
++	for (i = 0; i <= aquantia_syscfg[if_type].cnt; i++) {
++		u16 reg = phy_read_mmd(phydev, MDIO_MMD_VEND1,
++				       AQUANTIA_VND1_GSYSCFG_BASE + i);
++		if (!reg)
++			continue;
++
+ 		phy_write_mmd(phydev, MDIO_MMD_VEND1,
+ 			      AQUANTIA_VND1_GSYSCFG_BASE + i,
+ 			      aquantia_syscfg[if_type].syscfg);
++	}
+ 
+ 	/* wake PHY back up */
+ 	phy_write_mmd(phydev, MDIO_MMD_VEND1, AQUANTIA_VND1_GLOBAL_SC, 0);
diff --git a/6.12/target/linux/generic/hack-6.12/725-net-phy-aquantia-add-PHY_IDs-for-AQR112-variants.patch b/6.12/target/linux/generic/hack-6.12/725-net-phy-aquantia-add-PHY_IDs-for-AQR112-variants.patch
new file mode 100644
index 00000000..7443ad2f
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/725-net-phy-aquantia-add-PHY_IDs-for-AQR112-variants.patch
@@ -0,0 +1,63 @@
+From 3b92ee7b7899b6beffb2b484c58326e36612a873 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Thu, 23 Dec 2021 14:52:56 +0000
+Subject: [PATCH] net: phy: aquantia: add PHY_ID for AQR112R
+
+As advised by Ian Chang this PHY is used in Puzzle devices.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/aquantia/aquantia_main.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/net/phy/aquantia/aquantia_main.c
++++ b/drivers/net/phy/aquantia/aquantia_main.c
+@@ -32,6 +32,8 @@
+ #define PHY_ID_AQR114C	0x31c31c22
+ #define PHY_ID_AQR115C	0x31c31c33
+ #define PHY_ID_AQR813	0x31c31cb2
++#define PHY_ID_AQR112C	0x03a1b790
++#define PHY_ID_AQR112R	0x31c31d12
+ 
+ #define MDIO_PHYXS_VEND_IF_STATUS		0xe812
+ #define MDIO_PHYXS_VEND_IF_STATUS_TYPE_MASK	GENMASK(7, 3)
+@@ -1205,6 +1207,30 @@ static struct phy_driver aqr_driver[] =
+ 	.led_hw_control_get = aqr_phy_led_hw_control_get,
+ 	.led_polarity_set = aqr_phy_led_polarity_set,
+ },
++{
++	PHY_ID_MATCH_MODEL(PHY_ID_AQR112C),
++	.name		= "Aquantia AQR112C",
++	.probe		= aqr107_probe,
++	.config_aneg	= aqr_config_aneg_set_prot,
++	.config_intr	= aqr_config_intr,
++	.handle_interrupt = aqr_handle_interrupt,
++	.read_status	= aqr107_read_status,
++	.get_sset_count	= aqr107_get_sset_count,
++	.get_strings	= aqr107_get_strings,
++	.get_stats	= aqr107_get_stats,
++},
++{
++	PHY_ID_MATCH_MODEL(PHY_ID_AQR112R),
++	.name		= "Aquantia AQR112R",
++	.probe		= aqr107_probe,
++	.config_aneg	= aqr_config_aneg_set_prot,
++	.config_intr	= aqr_config_intr,
++	.handle_interrupt = aqr_handle_interrupt,
++	.read_status	= aqr107_read_status,
++	.get_sset_count	= aqr107_get_sset_count,
++	.get_strings	= aqr107_get_strings,
++	.get_stats	= aqr107_get_stats,
++},
+ };
+ 
+ module_phy_driver(aqr_driver);
+@@ -1226,6 +1252,8 @@ static struct mdio_device_id __maybe_unu
+ 	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR114C) },
+ 	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR115C) },
+ 	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR813) },
++	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR112C) },
++	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR112R) },
+ 	{ }
+ };
+ 
diff --git a/6.12/target/linux/generic/hack-6.12/750-net-pcs-mtk-lynxi-workaround-2500BaseX-no-an.patch b/6.12/target/linux/generic/hack-6.12/750-net-pcs-mtk-lynxi-workaround-2500BaseX-no-an.patch
new file mode 100644
index 00000000..30a502a2
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/750-net-pcs-mtk-lynxi-workaround-2500BaseX-no-an.patch
@@ -0,0 +1,64 @@
+From 880d1311335120f64447ca9d11933872d734e19a Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 27 Mar 2023 18:41:54 +0100
+Subject: [PATCH] generic: pcs-mtk-lynxi: add hack to use 2500Base-X without AN
+
+Using 2500Base-T SFP modules e.g. on the BananaPi R3 requires manually
+disabling auto-negotiation, e.g. using ethtool. While a proper fix
+using SFP quirks is being discussed upstream, bring a work-around to
+restore user experience to what it was before the switch to the
+dedicated SGMII PCS driver.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+
+--- a/drivers/net/pcs/pcs-mtk-lynxi.c
++++ b/drivers/net/pcs/pcs-mtk-lynxi.c
+@@ -114,14 +114,23 @@ static void mtk_pcs_lynxi_get_state(stru
+ 				    struct phylink_link_state *state)
+ {
+ 	struct mtk_pcs_lynxi *mpcs = pcs_to_mtk_pcs_lynxi(pcs);
+-	unsigned int bm, adv;
++	unsigned int bm, bmsr, adv;
+ 
+ 	/* Read the BMSR and LPA */
+ 	regmap_read(mpcs->regmap, SGMSYS_PCS_CONTROL_1, &bm);
+-	regmap_read(mpcs->regmap, SGMSYS_PCS_ADVERTISE, &adv);
++	bmsr = FIELD_GET(SGMII_BMSR, bm);
++
++	if (state->interface == PHY_INTERFACE_MODE_2500BASEX) {
++		state->link = !!(bmsr & BMSR_LSTATUS);
++		state->an_complete = !!(bmsr & BMSR_ANEGCOMPLETE);
++		state->speed = SPEED_2500;
++		state->duplex = DUPLEX_FULL;
++
++		return;
++	}
+ 
+-	phylink_mii_c22_pcs_decode_state(state, FIELD_GET(SGMII_BMSR, bm),
+-					 FIELD_GET(SGMII_LPA, adv));
++	regmap_read(mpcs->regmap, SGMSYS_PCS_ADVERTISE, &adv);
++	phylink_mii_c22_pcs_decode_state(state, bmsr, FIELD_GET(SGMII_LPA, adv));
+ }
+ 
+ static void mtk_sgmii_reset(struct mtk_pcs_lynxi *mpcs)
+@@ -142,7 +151,7 @@ static int mtk_pcs_lynxi_config(struct p
+ {
+ 	struct mtk_pcs_lynxi *mpcs = pcs_to_mtk_pcs_lynxi(pcs);
+ 	bool mode_changed = false, changed;
+-	unsigned int rgc3, sgm_mode, bmcr;
++	unsigned int rgc3, sgm_mode, bmcr = 0;
+ 	int advertise, link_timer;
+ 
+ 	advertise = phylink_mii_c22_pcs_encode_advertisement(interface,
+@@ -165,9 +174,8 @@ static int mtk_pcs_lynxi_config(struct p
+ 	if (neg_mode == PHYLINK_PCS_NEG_INBAND_ENABLED) {
+ 		if (interface == PHY_INTERFACE_MODE_SGMII)
+ 			sgm_mode |= SGMII_SPEED_DUPLEX_AN;
+-		bmcr = BMCR_ANENABLE;
+-	} else {
+-		bmcr = 0;
++		if (interface != PHY_INTERFACE_MODE_2500BASEX)
++			bmcr = BMCR_ANENABLE;
+ 	}
+ 
+ 	if (mpcs->interface != interface) {
diff --git a/6.12/target/linux/generic/hack-6.12/760-net-usb-r8152-add-LED-configuration-from-OF.patch b/6.12/target/linux/generic/hack-6.12/760-net-usb-r8152-add-LED-configuration-from-OF.patch
new file mode 100644
index 00000000..ca2c6993
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/760-net-usb-r8152-add-LED-configuration-from-OF.patch
@@ -0,0 +1,74 @@
+From 82985725e071f2a5735052f18e109a32aeac3a0b Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Sun, 26 Jul 2020 02:38:31 +0200
+Subject: [PATCH] net: usb: r8152: add LED configuration from OF
+
+This adds the ability to configure the LED configuration register using
+OF. This way, the correct value for board specific LED configuration can
+be determined.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ drivers/net/usb/r8152.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -12,6 +12,7 @@
+ #include <linux/ethtool.h>
+ #include <linux/phy.h>
+ #include <linux/usb.h>
++#include <linux/of.h>
+ #include <linux/crc32.h>
+ #include <linux/if_vlan.h>
+ #include <linux/uaccess.h>
+@@ -7046,6 +7047,22 @@ static void rtl_tally_reset(struct r8152
+ 	ocp_write_word(tp, MCU_TYPE_PLA, PLA_RSTTALLY, ocp_data);
+ }
+ 
++static int r8152_led_configuration(struct r8152 *tp)
++{
++	u32 led_data;
++	int ret;
++
++	ret = of_property_read_u32(tp->udev->dev.of_node, "realtek,led-data",
++								&led_data);
++
++	if (ret)
++		return ret;
++
++	ocp_write_word(tp, MCU_TYPE_PLA, PLA_LEDSEL, led_data);
++
++	return 0;
++}
++
+ static void r8152b_init(struct r8152 *tp)
+ {
+ 	u32 ocp_data;
+@@ -7087,6 +7104,8 @@ static void r8152b_init(struct r8152 *tp
+ 	ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_USB_CTRL);
+ 	ocp_data &= ~(RX_AGG_DISABLE | RX_ZERO_EN);
+ 	ocp_write_word(tp, MCU_TYPE_USB, USB_USB_CTRL, ocp_data);
++
++	r8152_led_configuration(tp);
+ }
+ 
+ static void r8153_init(struct r8152 *tp)
+@@ -7227,6 +7246,8 @@ static void r8153_init(struct r8152 *tp)
+ 		tp->coalesce = COALESCE_SLOW;
+ 		break;
+ 	}
++
++	r8152_led_configuration(tp);
+ }
+ 
+ static void r8153b_init(struct r8152 *tp)
+@@ -7309,6 +7330,8 @@ static void r8153b_init(struct r8152 *tp
+ 	rtl_tally_reset(tp);
+ 
+ 	tp->coalesce = 15000;	/* 15 us */
++
++	r8152_led_configuration(tp);
+ }
+ 
+ static void r8153c_init(struct r8152 *tp)
diff --git a/6.12/target/linux/generic/hack-6.12/761-dt-bindings-net-add-RTL8152-binding-documentation.patch b/6.12/target/linux/generic/hack-6.12/761-dt-bindings-net-add-RTL8152-binding-documentation.patch
new file mode 100644
index 00000000..be262b99
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/761-dt-bindings-net-add-RTL8152-binding-documentation.patch
@@ -0,0 +1,54 @@
+From 3ee05f4aa64fc86af3be5bc176ba5808de9260a7 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Sun, 26 Jul 2020 15:30:33 +0200
+Subject: [PATCH] dt-bindings: net: add RTL8152 binding documentation
+
+Add binding documentation for the Realtek RTL8152 / RTL8153 USB ethernet
+adapters.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ .../bindings/net/realtek,rtl8152.yaml         | 36 +++++++++++++++++++
+ 1 file changed, 36 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/net/realtek,rtl8152.yaml
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/net/realtek,rtl8152.yaml
+@@ -0,0 +1,36 @@
++# SPDX-License-Identifier: GPL-2.0
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/net/realtek,rtl8152.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Realtek RTL8152/RTL8153 series USB ethernet
++
++maintainers:
++  - David Bauer <mail@david-bauer.net>
++
++properties:
++  compatible:
++    oneOf:
++      - items:
++          - enum:
++              - realtek,rtl8152
++              - realtek,rtl8153
++
++  reg:
++    description: The device number on the USB bus
++
++  realtek,led-data:
++    description: Value to be written to the LED configuration register.
++
++required:
++  - compatible
++  - reg
++
++examples:
++  - |
++    usb-eth@2 {
++      compatible = "realtek,rtl8153";
++      reg = <2>;
++      realtek,led-data = <0x87>;
++    };
+\ No newline at end of file
diff --git a/6.12/target/linux/generic/hack-6.12/765-mxl-gpy-control-LED-reg-from-DT.patch b/6.12/target/linux/generic/hack-6.12/765-mxl-gpy-control-LED-reg-from-DT.patch
new file mode 100644
index 00000000..36fdc684
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/765-mxl-gpy-control-LED-reg-from-DT.patch
@@ -0,0 +1,74 @@
+From 94b90966095f3fa625897e8f53d215882f6e19b3 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Sat, 11 Mar 2023 17:00:01 +0100
+Subject: [PATCH] mxl-gpy: control LED reg from DT
+
+Add dynamic configuration for the LED control registers on MXL PHYs.
+
+This patch has been tested with MaxLinear GPY211C. It is unlikely to be
+accepted upstream, as upstream plans on integrating their own framework
+for handling these LEDs.
+
+For the time being, use this hack to configure PHY driven device-LEDs to
+show the correct state.
+
+A possible alternative might be to expose the LEDs using the kernel LED
+framework and bind it to the netdevice. This might also be upstreamable,
+although it is a considerable extra amount of work.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ drivers/net/phy/mxl-gpy.c | 37 ++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 36 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/phy/mxl-gpy.c
++++ b/drivers/net/phy/mxl-gpy.c
+@@ -10,6 +10,7 @@
+ #include <linux/bitfield.h>
+ #include <linux/hwmon.h>
+ #include <linux/mutex.h>
++#include <linux/of.h>
+ #include <linux/phy.h>
+ #include <linux/polynomial.h>
+ #include <linux/property.h>
+@@ -293,10 +294,39 @@ out:
+ 	return ret;
+ }
+ 
++static int gpy_led_write(struct phy_device *phydev)
++{
++	struct device_node *node = phydev->mdio.dev.of_node;
++	u32 led_regs[GPY_MAX_LEDS];
++	int i, ret;
++	u16 val = 0xff00;
++
++	if (!IS_ENABLED(CONFIG_OF_MDIO))
++		return 0;
++
++	if (of_property_read_u32_array(node, "mxl,led-config", led_regs, GPY_MAX_LEDS))
++		return 0;
++
++	if (of_property_read_bool(node, "mxl,led-drive-vdd"))
++		val &= 0x0fff;
++
++	/* Enable LED function handling on all ports*/
++	phy_write(phydev, PHY_LED, val);
++
++	/* Write LED register values */
++	for (i = 0; i < GPY_MAX_LEDS; i++) {
++		ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, VSPEC1_LED(i), (u16)led_regs[i]);
++		if (ret < 0)
++			return ret;
++	}
++
++	return 0;
++}
++
+ static int gpy_config_init(struct phy_device *phydev)
+ {
+ 	/* Nothing to configure. Configuration Requirement Placeholder */
+-	return 0;
++	return gpy_led_write(phydev);
+ }
+ 
+ static int gpy21x_config_init(struct phy_device *phydev)
diff --git a/6.12/target/linux/generic/hack-6.12/766-net-phy-mediatek-ge-add-LED-configuration-interface.patch b/6.12/target/linux/generic/hack-6.12/766-net-phy-mediatek-ge-add-LED-configuration-interface.patch
new file mode 100644
index 00000000..95134083
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/766-net-phy-mediatek-ge-add-LED-configuration-interface.patch
@@ -0,0 +1,72 @@
+From cc225d163b5a4f7a0d1968298bf7927306646a47 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Fri, 28 Apr 2023 01:53:01 +0200
+Subject: [PATCH] net: phy: mediatek-ge: add LED configuration interface
+
+This adds a small hack similar to the one used for ar8xxx switches to
+read a reg:value map for configuring the LED configuration registers.
+
+This allows OpenWrt to write device-specific LED action as well as blink
+configurations. It is unlikely to be accepted upstream, as upstream
+plans on integrating their own framework for handling these LEDs.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ drivers/net/phy/mediatek-ge.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+--- a/drivers/net/phy/mediatek-ge.c
++++ b/drivers/net/phy/mediatek-ge.c
+@@ -1,4 +1,5 @@
+ // SPDX-License-Identifier: GPL-2.0+
++#include <linux/of.h>
+ #include <linux/bitfield.h>
+ #include <linux/module.h>
+ #include <linux/phy.h>
+@@ -50,6 +51,36 @@ static int mt7530_phy_config_init(struct
+ 	return 0;
+ }
+ 
++static int mt7530_led_config_of(struct phy_device *phydev)
++{
++	struct device_node *np = phydev->mdio.dev.of_node;
++	const __be32 *paddr;
++	int len;
++	int i;
++
++	paddr = of_get_property(np, "mediatek,led-config", &len);
++	if (!paddr)
++		return 0;
++
++	if (len < (2 * sizeof(*paddr)))
++		return -EINVAL;
++
++	len /= sizeof(*paddr);
++
++	phydev_warn(phydev, "Configure LED registers (num=%d)\n", len);
++	for (i = 0; i < len - 1; i += 2) {
++		u32 reg;
++		u32 val;
++
++		reg = be32_to_cpup(paddr + i);
++		val = be32_to_cpup(paddr + i + 1);
++
++		phy_write_mmd(phydev, MDIO_MMD_VEND2, reg, val);
++	}
++
++	return 0;
++}
++
+ static int mt7531_phy_config_init(struct phy_device *phydev)
+ {
+ 	mtk_gephy_config_init(phydev);
+@@ -62,6 +93,9 @@ static int mt7531_phy_config_init(struct
+ 	phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x13, 0x404);
+ 	phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x14, 0x404);
+ 
++	/* LED Config*/
++	mt7530_led_config_of(phydev);
++
+ 	return 0;
+ }
+ 
diff --git a/6.12/target/linux/generic/hack-6.12/773-bgmac-add-srab-switch.patch b/6.12/target/linux/generic/hack-6.12/773-bgmac-add-srab-switch.patch
new file mode 100644
index 00000000..633cacd1
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/773-bgmac-add-srab-switch.patch
@@ -0,0 +1,98 @@
+From 3cb240533ab787899dc7f17aa7d6c5b4810e2e58 Mon Sep 17 00:00:00 2001
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Fri, 7 Jul 2017 17:26:01 +0200
+Subject: bcm53xx: bgmac: use srab switch driver
+
+use the srab switch driver on these SoCs.
+
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+---
+ drivers/net/ethernet/broadcom/bgmac-bcma.c |  1 +
+ drivers/net/ethernet/broadcom/bgmac.c      | 24 ++++++++++++++++++++++++
+ drivers/net/ethernet/broadcom/bgmac.h      |  4 ++++
+ 3 files changed, 29 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/bgmac-bcma.c
++++ b/drivers/net/ethernet/broadcom/bgmac-bcma.c
+@@ -280,6 +280,7 @@ static int bgmac_probe(struct bcma_devic
+ 		bgmac->feature_flags |= BGMAC_FEAT_CLKCTLST;
+ 		bgmac->feature_flags |= BGMAC_FEAT_NO_RESET;
+ 		bgmac->feature_flags |= BGMAC_FEAT_FORCE_SPEED_2500;
++		bgmac->feature_flags |= BGMAC_FEAT_SRAB;
+ 		break;
+ 	default:
+ 		bgmac->feature_flags |= BGMAC_FEAT_CLKCTLST;
+--- a/drivers/net/ethernet/broadcom/bgmac.c
++++ b/drivers/net/ethernet/broadcom/bgmac.c
+@@ -12,6 +12,7 @@
+ #include <linux/bcma/bcma.h>
+ #include <linux/etherdevice.h>
+ #include <linux/interrupt.h>
++#include <linux/platform_data/b53.h>
+ #include <linux/bcm47xx_nvram.h>
+ #include <linux/phy.h>
+ #include <linux/phy_fixed.h>
+@@ -1408,6 +1409,17 @@ static const struct ethtool_ops bgmac_et
+ 	.set_link_ksettings     = phy_ethtool_set_link_ksettings,
+ };
+ 
++static struct b53_platform_data bgmac_b53_pdata = {
++};
++
++static struct platform_device bgmac_b53_dev = {
++	.name		= "b53-srab-switch",
++	.id		= -1,
++	.dev		= {
++		.platform_data = &bgmac_b53_pdata,
++	},
++};
++
+ /**************************************************
+  * MII
+  **************************************************/
+@@ -1546,6 +1558,14 @@ int bgmac_enet_probe(struct bgmac *bgmac
+ 
+ 	bgmac->in_init = false;
+ 
++	if ((bgmac->feature_flags & BGMAC_FEAT_SRAB) && !bgmac_b53_pdata.regs) {
++		bgmac_b53_pdata.regs = ioremap(0x18007000, 0x1000);
++
++		err = platform_device_register(&bgmac_b53_dev);
++		if (!err)
++			bgmac->b53_device = &bgmac_b53_dev;
++	}
++
+ 	err = register_netdev(bgmac->net_dev);
+ 	if (err) {
+ 		dev_err(bgmac->dev, "Cannot register net device\n");
+@@ -1568,6 +1588,10 @@ EXPORT_SYMBOL_GPL(bgmac_enet_probe);
+ 
+ void bgmac_enet_remove(struct bgmac *bgmac)
+ {
++	if (bgmac->b53_device)
++		platform_device_unregister(&bgmac_b53_dev);
++	bgmac->b53_device = NULL;
++
+ 	unregister_netdev(bgmac->net_dev);
+ 	phy_disconnect(bgmac->net_dev->phydev);
+ 	netif_napi_del(&bgmac->napi);
+--- a/drivers/net/ethernet/broadcom/bgmac.h
++++ b/drivers/net/ethernet/broadcom/bgmac.h
+@@ -388,6 +388,7 @@
+ #define BGMAC_FEAT_CC4_IF_SW_TYPE_RGMII	BIT(18)
+ #define BGMAC_FEAT_CC7_IF_TYPE_RGMII	BIT(19)
+ #define BGMAC_FEAT_IDM_MASK		BIT(20)
++#define BGMAC_FEAT_SRAB			BIT(21)
+ 
+ struct bgmac_slot_info {
+ 	union {
+@@ -495,6 +496,9 @@ struct bgmac {
+ 	void (*cmn_maskset32)(struct bgmac *bgmac, u16 offset, u32 mask,
+ 			      u32 set);
+ 	int (*phy_connect)(struct bgmac *bgmac);
++
++	/* platform device for associated switch */
++	struct platform_device *b53_device;
+ };
+ 
+ struct bgmac *bgmac_alloc(struct device *dev);
diff --git a/6.12/target/linux/generic/hack-6.12/780-usb-net-MeigLink_modem_support.patch b/6.12/target/linux/generic/hack-6.12/780-usb-net-MeigLink_modem_support.patch
new file mode 100644
index 00000000..dee4c3a6
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/780-usb-net-MeigLink_modem_support.patch
@@ -0,0 +1,70 @@
+From f81700b6bb2eda3756247bce472d8eaf6f466f61 Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Wed, 13 Jul 2022 13:49:26 +0200
+Subject: [PATCH] net/usb/qmi_wwan: add MeigLink modem support
+
+---
+ drivers/net/usb/qmi_wwan.c  | 1 +
+ drivers/usb/serial/option.c | 7 +++++++
+ 2 files changed, 8 insertions(+)
+
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1076,6 +1076,11 @@ static const struct usb_device_id produc
+ 		USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x581d, USB_CLASS_VENDOR_SPEC, 1, 7),
+ 		.driver_info = (unsigned long)&qmi_wwan_info,
+ 	},
++	{	/* Meiglink SGM828 */
++		USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d49, USB_CLASS_VENDOR_SPEC, 0x10, 0x05),
++		.driver_info = (unsigned long)&qmi_wwan_info,
++	},
++
+ 	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0122)},	/* Quectel RG650V */
+ 	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0125)},	/* Quectel EC25, EC20 R2.0  Mini PCIe */
+ 	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0306)},	/* Quectel EP06/EG06/EM06 */
+@@ -1083,6 +1088,7 @@ static const struct usb_device_id produc
+ 	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0620)},	/* Quectel EM160R-GL */
+ 	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0800)},	/* Quectel RM500Q-GL */
+ 	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0801)},	/* Quectel RM520N */
++	{QMI_MATCH_FF_FF_FF(0x05c6, 0xf601)},	/* MeigLink SLM750 */
+ 
+ 	/* 3. Combined interface devices matching on interface number */
+ 	{QMI_FIXED_INTF(0x0408, 0xea42, 4)},	/* Yota / Megafon M100-1 */
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -247,6 +247,11 @@ static void option_instat_callback(struc
+ #define UBLOX_PRODUCT_R410M			0x90b2
+ /* These Yuga products use Qualcomm's vendor ID */
+ #define YUGA_PRODUCT_CLM920_NC5			0x9625
++/* These MeigLink products use Qualcomm's vendor ID */
++#define MEIGLINK_PRODUCT_SLM750			0xf601
++
++#define MEIGLINK_VENDOR_ID			0x2dee
++#define MEIGLINK_PRODUCT_SLM828			0x4d49
+ 
+ #define QUECTEL_VENDOR_ID			0x2c7c
+ /* These Quectel products use Quectel's vendor ID */
+@@ -1160,6 +1165,11 @@ static const struct usb_device_id option
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000), /* SIMCom SIM5218 */
+ 	  .driver_info = NCTRL(0) | NCTRL(1) | NCTRL(2) | NCTRL(3) | RSVD(4) },
++	/* MeiG */
++	{ USB_DEVICE_AND_INTERFACE_INFO(MEIGLINK_VENDOR_ID, MEIGLINK_PRODUCT_SLM828, USB_CLASS_VENDOR_SPEC, 0x10, 0x01) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(MEIGLINK_VENDOR_ID, MEIGLINK_PRODUCT_SLM828, USB_CLASS_VENDOR_SPEC, 0x10, 0x02) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(MEIGLINK_VENDOR_ID, MEIGLINK_PRODUCT_SLM828, USB_CLASS_VENDOR_SPEC, 0x10, 0x03) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(MEIGLINK_VENDOR_ID, MEIGLINK_PRODUCT_SLM828, USB_CLASS_VENDOR_SPEC, 0x10, 0x04) },
+ 	/* Quectel products using Qualcomm vendor ID */
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)},
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20),
+@@ -1201,6 +1211,11 @@ static const struct usb_device_id option
+ 	  .driver_info = ZLP },
+ 	{ USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96),
+ 	  .driver_info = RSVD(4) },
++	/* Meiglink products using Qualcomm vendor ID */
++	// Works OK. In case of some issues check macros that are used by Quectel Products
++	{ USB_DEVICE_AND_INTERFACE_INFO(QUALCOMM_VENDOR_ID, MEIGLINK_PRODUCT_SLM750, 0xff, 0xff, 0xff),
++	  .driver_info = NUMEP2 },
++	{ USB_DEVICE_AND_INTERFACE_INFO(QUALCOMM_VENDOR_ID, MEIGLINK_PRODUCT_SLM750, 0xff, 0, 0) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff),
+ 	  .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) },
diff --git a/6.12/target/linux/generic/hack-6.12/781-usb-net-rndis-support-asr.patch b/6.12/target/linux/generic/hack-6.12/781-usb-net-rndis-support-asr.patch
new file mode 100644
index 00000000..47339b6c
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/781-usb-net-rndis-support-asr.patch
@@ -0,0 +1,69 @@
+From 9fabf60187f1fa19e6f6bb5441587d485bd534b0 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Tue, 9 Apr 2024 17:06:38 +0100
+Subject: [PATCH] rndis_host: add a bunch of USB IDs
+
+Add a bunch of USB IDs found in various places online to the
+RNDIS USB network driver.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/usb/rndis_host.c | 40 ++++++++++++++++++++++
+ 1 file changed, 40 insertions(+)
+
+--- a/drivers/net/usb/rndis_host.c
++++ b/drivers/net/usb/rndis_host.c
+@@ -630,6 +630,16 @@ static const struct driver_info	zte_rndi
+ 	.tx_fixup =	rndis_tx_fixup,
+ };
+ 
++static const struct driver_info asr_rndis_info = {
++	.description =	"Asr RNDIS device",
++	.flags =	FLAG_WWAN | FLAG_POINTTOPOINT | FLAG_FRAMING_RN | FLAG_NO_SETINT | FLAG_NOARP,
++	.bind =		rndis_bind,
++	.unbind =	rndis_unbind,
++	.status =	rndis_status,
++	.rx_fixup =	rndis_rx_fixup,
++	.tx_fixup =	rndis_tx_fixup,
++};
++
+ /*-------------------------------------------------------------------------*/
+ 
+ static const struct usb_device_id	products [] = {
+@@ -666,6 +676,36 @@ static const struct usb_device_id	produc
+ 	USB_INTERFACE_INFO(USB_CLASS_WIRELESS_CONTROLLER, 1, 3),
+ 	.driver_info = (unsigned long) &rndis_info,
+ }, {
++	/* Quectel EG060V rndis device */
++	USB_DEVICE_AND_INTERFACE_INFO(0x2c7c, 0x6004,
++				      USB_CLASS_WIRELESS_CONTROLLER, 1, 3),
++	.driver_info = (unsigned long) &asr_rndis_info,
++}, {
++	/* Quectel EC200A rndis device */
++	USB_DEVICE_AND_INTERFACE_INFO(0x2c7c, 0x6005,
++				      USB_CLASS_WIRELESS_CONTROLLER, 1, 3),
++	.driver_info = (unsigned long) &asr_rndis_info,
++}, {
++	/* Quectel EC200T rndis device */
++	USB_DEVICE_AND_INTERFACE_INFO(0x2c7c, 0x6026,
++				      USB_CLASS_WIRELESS_CONTROLLER, 1, 3),
++	.driver_info = (unsigned long) &asr_rndis_info,
++}, {
++	/* Simcom A7906E rndis device */
++	USB_DEVICE_AND_INTERFACE_INFO(0x1e0e, 0x9011,
++				      USB_CLASS_WIRELESS_CONTROLLER, 1, 3),
++	.driver_info = (unsigned long) &asr_rndis_info,
++}, {
++	/* Meig SLM770A */
++	USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d57,
++				      USB_CLASS_WIRELESS_CONTROLLER, 1, 3),
++	.driver_info = (unsigned long) &asr_rndis_info,
++}, {
++	/* Meig SLM828 */
++	USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d49,
++				      USB_CLASS_WIRELESS_CONTROLLER, 1, 3),
++	.driver_info = (unsigned long) &asr_rndis_info,
++}, {
+ 	/* Novatel Verizon USB730L */
+ 	USB_INTERFACE_INFO(USB_CLASS_MISC, 4, 1),
+ 	.driver_info = (unsigned long) &rndis_info,
diff --git a/6.12/target/linux/generic/hack-6.12/800-GPIO-add-named-gpio-exports.patch b/6.12/target/linux/generic/hack-6.12/800-GPIO-add-named-gpio-exports.patch
new file mode 100644
index 00000000..a68b2fe8
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/800-GPIO-add-named-gpio-exports.patch
@@ -0,0 +1,172 @@
+From cc809a441d8f2924f785eb863dfa6aef47a25b0b Mon Sep 17 00:00:00 2001
+From: John Crispin <blogic@openwrt.org>
+Date: Tue, 12 Aug 2014 20:49:27 +0200
+Subject: [PATCH 30/36] GPIO: add named gpio exports
+
+Signed-off-by: John Crispin <blogic@openwrt.org>
+--- a/drivers/gpio/gpiolib-of.c
++++ b/drivers/gpio/gpiolib-of.c
+@@ -21,6 +21,8 @@
+ 
+ #include <linux/gpio/consumer.h>
+ #include <linux/gpio/machine.h>
++#include <linux/init.h>
++#include <linux/platform_device.h>
+ 
+ #include "gpiolib.h"
+ #include "gpiolib-of.h"
+@@ -1187,3 +1189,73 @@ void of_gpiochip_remove(struct gpio_chip
+ {
+ 	of_node_put(dev_of_node(&chip->gpiodev->dev));
+ }
++
++#ifdef CONFIG_GPIO_SYSFS
++
++static struct of_device_id gpio_export_ids[] = {
++	{ .compatible = "gpio-export" },
++	{ /* sentinel */ }
++};
++
++static int of_gpio_export_probe(struct platform_device *pdev)
++{
++	struct device_node *np = pdev->dev.of_node;
++	struct device_node *cnp;
++	u32 val;
++	int nb = 0;
++
++	for_each_child_of_node(np, cnp) {
++		const char *name = NULL;
++		int gpio;
++		bool dmc;
++		int max_gpio = 1;
++		int i;
++
++		of_property_read_string(cnp, "gpio-export,name", &name);
++
++		if (!name)
++			max_gpio = of_gpio_named_count(cnp, "gpios");
++
++		for (i = 0; i < max_gpio; i++) {
++			struct gpio_desc *desc;
++			unsigned flags = 0;
++			enum of_gpio_flags of_flags;
++
++			desc = of_get_named_gpiod_flags(cnp, "gpios", i, &of_flags);
++			if (IS_ERR(desc))
++				return PTR_ERR(desc);
++			gpio = desc_to_gpio(desc);
++
++			if (of_flags & OF_GPIO_ACTIVE_LOW)
++				flags |= GPIOF_ACTIVE_LOW;
++
++			if (!of_property_read_u32(cnp, "gpio-export,output", &val))
++				flags |= val ? GPIOF_OUT_INIT_HIGH : GPIOF_OUT_INIT_LOW;
++			else
++				flags |= GPIOF_IN;
++
++			if (devm_gpio_request_one(&pdev->dev, gpio, flags, name ? name : of_node_full_name(np)))
++				continue;
++
++			dmc = of_property_read_bool(cnp, "gpio-export,direction_may_change");
++			gpio_export_with_name(gpio_to_desc(gpio), dmc, name);
++			nb++;
++		}
++	}
++
++	dev_info(&pdev->dev, "%d gpio(s) exported\n", nb);
++
++	return 0;
++}
++
++static struct platform_driver gpio_export_driver = {
++	.driver		= {
++		.name		= "gpio-export",
++		.of_match_table	= of_match_ptr(gpio_export_ids),
++	},
++	.probe		= of_gpio_export_probe,
++};
++
++module_platform_driver(gpio_export_driver);
++
++#endif
+--- a/include/linux/gpio/consumer.h
++++ b/include/linux/gpio/consumer.h
+@@ -628,7 +628,10 @@ static inline int devm_acpi_dev_add_driv
+ 
+ #if IS_ENABLED(CONFIG_GPIOLIB) && IS_ENABLED(CONFIG_GPIO_SYSFS)
+ 
++int __gpiod_export(struct gpio_desc *desc, bool direction_may_change, const char *name);
+ int gpiod_export(struct gpio_desc *desc, bool direction_may_change);
++int gpio_export_with_name(struct gpio_desc *desc, bool direction_may_change,
++			  const char *name);
+ int gpiod_export_link(struct device *dev, const char *name,
+ 		      struct gpio_desc *desc);
+ void gpiod_unexport(struct gpio_desc *desc);
+@@ -637,11 +640,25 @@ void gpiod_unexport(struct gpio_desc *de
+ 
+ #include <asm/errno.h>
+ 
++static inline int __gpiod_export(struct gpio_desc *desc,
++			       bool direction_may_change,
++			       const char *name)
++{
++	return -ENOSYS;
++}
++
+ static inline int gpiod_export(struct gpio_desc *desc,
+ 			       bool direction_may_change)
+ {
+ 	return -ENOSYS;
+ }
++
++static inline int gpio_export_with_name(struct gpio_desc *desc,
++					bool direction_may_change,
++					const char *name)
++{
++	return -ENOSYS;
++}
+ 
+ static inline int gpiod_export_link(struct device *dev, const char *name,
+ 				    struct gpio_desc *desc)
+--- a/drivers/gpio/gpiolib-sysfs.c
++++ b/drivers/gpio/gpiolib-sysfs.c
+@@ -571,7 +571,7 @@ static struct class gpio_class = {
+  * Returns:
+  * 0 on success, or negative errno on failure.
+  */
+-int gpiod_export(struct gpio_desc *desc, bool direction_may_change)
++int __gpiod_export(struct gpio_desc *desc, bool direction_may_change, const char *name)
+ {
+ 	const char *ioname = NULL;
+ 	struct gpio_device *gdev;
+@@ -629,6 +629,8 @@ int gpiod_export(struct gpio_desc *desc,
+ 	offset = gpio_chip_hwgpio(desc);
+ 	if (guard.gc->names && guard.gc->names[offset])
+ 		ioname = guard.gc->names[offset];
++	if (name)
++		ioname = name;
+ 
+ 	dev = device_create_with_groups(&gpio_class, &gdev->dev,
+ 					MKDEV(0, 0), data, gpio_groups,
+@@ -650,8 +652,21 @@ err_unlock:
+ 	gpiod_dbg(desc, "%s: status %d\n", __func__, status);
+ 	return status;
+ }
++EXPORT_SYMBOL_GPL(__gpiod_export);
++
++int gpiod_export(struct gpio_desc *desc, bool direction_may_change)
++{
++	return __gpiod_export(desc, direction_may_change, NULL);
++}
+ EXPORT_SYMBOL_GPL(gpiod_export);
+ 
++int gpio_export_with_name(struct gpio_desc *desc, bool direction_may_change,
++			  const char *name)
++{
++	return __gpiod_export(desc, direction_may_change, name);
++}
++EXPORT_SYMBOL_GPL(gpio_export_with_name);
++
+ static int match_export(struct device *dev, const void *desc)
+ {
+ 	struct gpiod_data *data = dev_get_drvdata(dev);
diff --git a/6.12/target/linux/generic/hack-6.12/810-bcma-ssb-fallback-sprom.patch b/6.12/target/linux/generic/hack-6.12/810-bcma-ssb-fallback-sprom.patch
new file mode 100644
index 00000000..08085d95
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/810-bcma-ssb-fallback-sprom.patch
@@ -0,0 +1,182 @@
+From e4d708702e6c98f2111e33201a264d6788564cb2 Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Fri, 12 May 2023 11:08:43 +0200
+Subject: [PATCH] ssb_sprom: add generic kernel support for Broadcom  Fallback SPROMs
+
+---
+ drivers/bcma/Kconfig        |  4 ++++
+ drivers/bcma/Makefile       |  1 +
+ drivers/bcma/bcma_private.h |  1 +
+ drivers/bcma/main.c         |  8 ++++++++
+ drivers/bcma/sprom.c        | 23 ++++++++++++++---------
+ drivers/ssb/Kconfig         |  5 +++++
+ drivers/ssb/Makefile        |  1 +
+ drivers/ssb/main.c          |  8 ++++++++
+ drivers/ssb/sprom.c         | 12 +++++++++++-
+ drivers/ssb/ssb_private.h   |  2 +-
+ 10 files changed, 54 insertions(+), 11 deletions(-)
+
+--- a/drivers/bcma/Kconfig
++++ b/drivers/bcma/Kconfig
+@@ -18,6 +18,10 @@ config BCMA_BLOCKIO
+ 	bool
+ 	default y
+ 
++config BCMA_FALLBACK_SPROM
++	bool
++	default y
++
+ config BCMA_HOST_PCI_POSSIBLE
+ 	bool
+ 	depends on PCI = y
+--- a/drivers/bcma/Makefile
++++ b/drivers/bcma/Makefile
+@@ -11,6 +11,7 @@ bcma-$(CONFIG_BCMA_DRIVER_PCI_HOSTMODE)
+ bcma-$(CONFIG_BCMA_DRIVER_MIPS)		+= driver_mips.o
+ bcma-$(CONFIG_BCMA_DRIVER_GMAC_CMN)	+= driver_gmac_cmn.o
+ bcma-$(CONFIG_BCMA_DRIVER_GPIO)		+= driver_gpio.o
++bcma-$(CONFIG_BCMA_FALLBACK_SPROM)	+= fallback-sprom.o
+ bcma-$(CONFIG_BCMA_HOST_PCI)		+= host_pci.o
+ bcma-$(CONFIG_BCMA_HOST_SOC)		+= host_soc.o
+ obj-$(CONFIG_BCMA)			+= bcma.o
+--- a/drivers/bcma/bcma_private.h
++++ b/drivers/bcma/bcma_private.h
+@@ -8,6 +8,7 @@
+ 
+ #include <linux/bcma/bcma.h>
+ #include <linux/delay.h>
++#include "fallback-sprom.h"
+ 
+ #define bcma_err(bus, fmt, ...) \
+ 	dev_err((bus)->dev, "bus%d: " fmt, (bus)->num, ##__VA_ARGS__)
+--- a/drivers/bcma/main.c
++++ b/drivers/bcma/main.c
+@@ -671,6 +671,14 @@ static int __init bcma_modinit(void)
+ {
+ 	int err;
+ 
++#ifdef CONFIG_BCMA_FALLBACK_SPROM
++	err = bcma_fbs_register();
++	if (err) {
++		pr_err("Fallback SPROM initialization failed\n");
++		err = 0;
++	}
++#endif /* CONFIG_BCMA_FALLBACK_SPROM */
++
+ 	err = bcma_init_bus_register();
+ 	if (err)
+ 		return err;
+--- a/drivers/bcma/sprom.c
++++ b/drivers/bcma/sprom.c
+@@ -51,21 +51,26 @@ static int bcma_fill_sprom_with_fallback
+ {
+ 	int err;
+ 
+-	if (!get_fallback_sprom) {
++	if (get_fallback_sprom)
++		err = get_fallback_sprom(bus, out);
++
++#ifdef CONFIG_BCMA_FALLBACK_SPROM
++	if (!get_fallback_sprom || err)
++		err = bcma_get_fallback_sprom(bus, out);
++#else
++	if (!get_fallback_sprom)
+ 		err = -ENOENT;
+-		goto fail;
+-	}
++#endif /* CONFIG_BCMA_FALLBACK_SPROM */
+ 
+-	err = get_fallback_sprom(bus, out);
+-	if (err)
+-		goto fail;
++	if (err) {
++		bcma_warn(bus, "Using fallback SPROM failed (err %d)\n", err);
++		return err;
++	}
+ 
+ 	bcma_debug(bus, "Using SPROM revision %d provided by platform.\n",
+ 		   bus->sprom.revision);
++
+ 	return 0;
+-fail:
+-	bcma_warn(bus, "Using fallback SPROM failed (err %d)\n", err);
+-	return err;
+ }
+ 
+ /**************************************************
+--- a/drivers/ssb/Kconfig
++++ b/drivers/ssb/Kconfig
+@@ -25,6 +25,11 @@ if SSB
+ config SSB_SPROM
+ 	bool
+ 
++config SSB_FALLBACK_SPROM
++	bool
++	depends on SSB_PCIHOST
++	default y
++
+ # Support for Block-I/O. SELECT this from the driver that needs it.
+ config SSB_BLOCKIO
+ 	bool
+--- a/drivers/ssb/Makefile
++++ b/drivers/ssb/Makefile
+@@ -2,6 +2,7 @@
+ # core
+ ssb-y					+= main.o scan.o
+ ssb-$(CONFIG_SSB_EMBEDDED)		+= embedded.o
++ssb-$(CONFIG_SSB_FALLBACK_SPROM)	+= fallback-sprom.o
+ ssb-$(CONFIG_SSB_SPROM)			+= sprom.o
+ 
+ # host support
+--- a/drivers/ssb/main.c
++++ b/drivers/ssb/main.c
+@@ -1289,6 +1289,14 @@ static int __init ssb_modinit(void)
+ {
+ 	int err;
+ 
++#ifdef CONFIG_SSB_FALLBACK_SPROM
++	err = ssb_fbs_register();
++	if (err) {
++		pr_err("Fallback SPROM initialization failed\n");
++		err = 0;
++	}
++#endif /* CONFIG_SSB_FALLBACK_SPROM */
++
+ 	/* See the comment at the ssb_is_early_boot definition */
+ 	ssb_is_early_boot = 0;
+ 	err = bus_register(&ssb_bustype);
+--- a/drivers/ssb/sprom.c
++++ b/drivers/ssb/sprom.c
+@@ -180,10 +180,20 @@ int ssb_arch_register_fallback_sprom(int
+ 
+ int ssb_fill_sprom_with_fallback(struct ssb_bus *bus, struct ssb_sprom *out)
+ {
++	int err;
++
++	if (get_fallback_sprom)
++		err = get_fallback_sprom(bus, out);
++
++#ifdef CONFIG_SSB_FALLBACK_SPROM
++	if (!get_fallback_sprom || err)
++		err = ssb_get_fallback_sprom(bus, out);
++#else
+ 	if (!get_fallback_sprom)
+ 		return -ENOENT;
++#endif /* CONFIG_SSB_FALLBACK_SPROM */
+ 
+-	return get_fallback_sprom(bus, out);
++	return err;
+ }
+ 
+ /* https://bcm-v4.sipsolutions.net/802.11/IsSpromAvailable */
+--- a/drivers/ssb/ssb_private.h
++++ b/drivers/ssb/ssb_private.h
+@@ -8,7 +8,7 @@
+ #include <linux/ssb/ssb.h>
+ #include <linux/types.h>
+ #include <linux/bcm47xx_wdt.h>
+-
++#include "fallback-sprom.h"
+ 
+ /* pci.c */
+ #ifdef CONFIG_SSB_PCIHOST
diff --git a/6.12/target/linux/generic/hack-6.12/901-debloat_sock_diag.patch b/6.12/target/linux/generic/hack-6.12/901-debloat_sock_diag.patch
new file mode 100644
index 00000000..440651c2
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/901-debloat_sock_diag.patch
@@ -0,0 +1,181 @@
+From 3b6115d6b57a263bdc8c9b1df273bd4a7955eead Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 8 Jul 2017 08:16:31 +0200
+Subject: debloat: add some debloat patches, strip down procfs and make O_DIRECT support optional, saves ~15K after lzma on MIPS
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ net/Kconfig         | 3 +++
+ net/core/Makefile   | 3 ++-
+ net/core/sock.c     | 2 ++
+ net/ipv4/Kconfig    | 1 +
+ net/netlink/Kconfig | 1 +
+ net/packet/Kconfig  | 1 +
+ net/unix/Kconfig    | 1 +
+ 7 files changed, 11 insertions(+), 1 deletion(-)
+
+--- a/net/Kconfig
++++ b/net/Kconfig
+@@ -132,6 +132,9 @@ source "net/mptcp/Kconfig"
+ 
+ endif # if INET
+ 
++config SOCK_DIAG
++	bool
++
+ config NETWORK_SECMARK
+ 	bool "Security Marking"
+ 	help
+--- a/net/core/Makefile
++++ b/net/core/Makefile
+@@ -11,12 +11,13 @@ obj-$(CONFIG_SYSCTL) += sysctl_net_core.
+ 
+ obj-y		     += dev.o dev_addr_lists.o dst.o netevent.o \
+ 			neighbour.o rtnetlink.o utils.o link_watch.o filter.o \
+-			sock_diag.o dev_ioctl.o tso.o sock_reuseport.o \
++			dev_ioctl.o tso.o sock_reuseport.o \
+ 			fib_notifier.o xdp.o flow_offload.o gro.o \
+ 			netdev-genl.o netdev-genl-gen.o gso.o
+ 
+ obj-$(CONFIG_NETDEV_ADDR_LIST_TEST) += dev_addr_lists_test.o
+ 
++obj-$(CONFIG_SOCK_DIAG) += sock_diag.o
+ obj-y += net-sysfs.o
+ obj-y += hotdata.o
+ obj-y += netdev_rx_queue.o
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -118,6 +118,7 @@
+ #include <linux/mroute.h>
+ #include <linux/mroute6.h>
+ #include <linux/icmpv6.h>
++#include <linux/cookie.h>
+ 
+ #include <linux/uaccess.h>
+ 
+@@ -152,6 +153,7 @@
+ 
+ static DEFINE_MUTEX(proto_list_mutex);
+ static LIST_HEAD(proto_list);
++DEFINE_COOKIE(sock_cookie);
+ 
+ static void sock_def_write_space_wfree(struct sock *sk);
+ static void sock_def_write_space(struct sock *sk);
+@@ -587,6 +589,21 @@ discard_and_relse:
+ }
+ EXPORT_SYMBOL(__sk_receive_skb);
+ 
++u64 __sock_gen_cookie(struct sock *sk)
++{
++	u64 res = atomic64_read(&sk->sk_cookie);
++
++	if (!res) {
++		u64 new = gen_cookie_next(&sock_cookie);
++
++		atomic64_cmpxchg(&sk->sk_cookie, res, new);
++
++		/* Another thread might have changed sk_cookie before us. */
++		res = atomic64_read(&sk->sk_cookie);
++	}
++	return res;
++}
++
+ INDIRECT_CALLABLE_DECLARE(struct dst_entry *ip6_dst_check(struct dst_entry *,
+ 							  u32));
+ INDIRECT_CALLABLE_DECLARE(struct dst_entry *ipv4_dst_check(struct dst_entry *,
+@@ -2318,9 +2335,11 @@ static void __sk_free(struct sock *sk)
+ 	if (likely(sk->sk_net_refcnt))
+ 		sock_inuse_add(sock_net(sk), -1);
+ 
++#ifdef CONFIG_SOCK_DIAG
+ 	if (unlikely(sk->sk_net_refcnt && sock_diag_has_destroy_listeners(sk)))
+ 		sock_diag_broadcast_destroy(sk);
+ 	else
++#endif
+ 		sk_destruct(sk);
+ }
+ 
+--- a/net/core/sock_diag.c
++++ b/net/core/sock_diag.c
+@@ -12,7 +12,6 @@
+ #include <linux/tcp.h>
+ #include <linux/workqueue.h>
+ #include <linux/nospec.h>
+-#include <linux/cookie.h>
+ #include <linux/inet_diag.h>
+ #include <linux/sock_diag.h>
+ 
+@@ -22,23 +21,6 @@ static const struct sock_diag_inet_compa
+ 
+ static struct workqueue_struct *broadcast_wq;
+ 
+-DEFINE_COOKIE(sock_cookie);
+-
+-u64 __sock_gen_cookie(struct sock *sk)
+-{
+-	u64 res = atomic64_read(&sk->sk_cookie);
+-
+-	if (!res) {
+-		u64 new = gen_cookie_next(&sock_cookie);
+-
+-		atomic64_cmpxchg(&sk->sk_cookie, res, new);
+-
+-		/* Another thread might have changed sk_cookie before us. */
+-		res = atomic64_read(&sk->sk_cookie);
+-	}
+-	return res;
+-}
+-
+ int sock_diag_check_cookie(struct sock *sk, const __u32 *cookie)
+ {
+ 	u64 res;
+--- a/net/ipv4/Kconfig
++++ b/net/ipv4/Kconfig
+@@ -423,6 +423,7 @@ config INET_TUNNEL
+ 
+ config INET_DIAG
+ 	tristate "INET: socket monitoring interface"
++	select SOCK_DIAG
+ 	default y
+ 	help
+ 	  Support for INET (TCP, DCCP, etc) socket monitoring interface used by
+--- a/net/netlink/Kconfig
++++ b/net/netlink/Kconfig
+@@ -5,6 +5,7 @@
+ 
+ config NETLINK_DIAG
+ 	tristate "NETLINK: socket monitoring interface"
++	select SOCK_DIAG
+ 	default n
+ 	help
+ 	  Support for NETLINK socket monitoring interface used by the ss tool.
+--- a/net/packet/Kconfig
++++ b/net/packet/Kconfig
+@@ -19,6 +19,7 @@ config PACKET
+ config PACKET_DIAG
+ 	tristate "Packet: sockets monitoring interface"
+ 	depends on PACKET
++	select SOCK_DIAG
+ 	default n
+ 	help
+ 	  Support for PF_PACKET sockets monitoring interface used by the ss tool.
+--- a/net/unix/Kconfig
++++ b/net/unix/Kconfig
+@@ -24,6 +24,7 @@ config	AF_UNIX_OOB
+ config UNIX_DIAG
+ 	tristate "UNIX: socket monitoring interface"
+ 	depends on UNIX
++	select SOCK_DIAG
+ 	default n
+ 	help
+ 	  Support for UNIX socket monitoring interface used by the ss tool.
+--- a/net/xdp/Kconfig
++++ b/net/xdp/Kconfig
+@@ -10,6 +10,7 @@ config XDP_SOCKETS
+ config XDP_SOCKETS_DIAG
+ 	tristate "XDP sockets: monitoring interface"
+ 	depends on XDP_SOCKETS
++	select SOCK_DIAG
+ 	default n
+ 	help
+ 	  Support for PF_XDP sockets monitoring interface used by the ss tool.
diff --git a/6.12/target/linux/generic/hack-6.12/902-debloat_proc.patch b/6.12/target/linux/generic/hack-6.12/902-debloat_proc.patch
new file mode 100644
index 00000000..f1eae513
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/902-debloat_proc.patch
@@ -0,0 +1,419 @@
+From 9e3f1d0805b2d919904dd9a4ff0d956314cc3cba Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 8 Jul 2017 08:20:09 +0200
+Subject: debloat: procfs
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ fs/locks.c               |  2 ++
+ fs/proc/Kconfig          |  5 +++++
+ fs/proc/consoles.c       |  3 +++
+ fs/proc/proc_tty.c       | 11 ++++++++++-
+ include/net/snmp.h       | 18 +++++++++++++++++-
+ ipc/msg.c                |  3 +++
+ ipc/sem.c                |  2 ++
+ ipc/shm.c                |  2 ++
+ ipc/util.c               |  3 +++
+ kernel/exec_domain.c     |  2 ++
+ kernel/irq/proc.c        |  9 +++++++++
+ kernel/time/timer_list.c |  2 ++
+ mm/vmalloc.c             |  2 ++
+ mm/vmstat.c              |  8 +++++---
+ net/8021q/vlanproc.c     |  6 ++++++
+ net/core/net-procfs.c    | 18 ++++++++++++------
+ net/core/sock.c          |  2 ++
+ net/ipv4/fib_trie.c      | 18 ++++++++++++------
+ net/ipv4/proc.c          |  3 +++
+ net/ipv4/route.c         |  3 +++
+ 20 files changed, 105 insertions(+), 17 deletions(-)
+
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -2971,6 +2971,8 @@ static const struct seq_operations locks
+ 
+ static int __init proc_locks_init(void)
+ {
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return 0;
+ 	proc_create_seq_private("locks", 0, NULL, &locks_seq_operations,
+ 			sizeof(struct locks_iterator), NULL);
+ 	return 0;
+--- a/fs/proc/Kconfig
++++ b/fs/proc/Kconfig
+@@ -101,6 +101,11 @@ config PROC_CHILDREN
+ 	  Say Y if you are running any user-space software which takes benefit from
+ 	  this interface. For example, rkt is such a piece of software.
+ 
++config PROC_STRIPPED
++	default n
++	depends on EXPERT
++	bool "Strip non-essential /proc functionality to reduce code size"
++
+ config PROC_PID_ARCH_STATUS
+ 	def_bool n
+ 	depends on PROC_FS
+--- a/fs/proc/consoles.c
++++ b/fs/proc/consoles.c
+@@ -110,6 +110,9 @@ static const struct seq_operations conso
+ 
+ static int __init proc_consoles_init(void)
+ {
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return 0;
++
+ 	proc_create_seq("consoles", 0, NULL, &consoles_op);
+ 	return 0;
+ }
+--- a/fs/proc/proc_tty.c
++++ b/fs/proc/proc_tty.c
+@@ -131,7 +131,10 @@ static const struct seq_operations tty_d
+ void proc_tty_register_driver(struct tty_driver *driver)
+ {
+ 	struct proc_dir_entry *ent;
+-		
++
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return;
++
+ 	if (!driver->driver_name || driver->proc_entry ||
+ 	    !driver->ops->proc_show)
+ 		return;
+@@ -148,6 +151,9 @@ void proc_tty_unregister_driver(struct t
+ {
+ 	struct proc_dir_entry *ent;
+ 
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return;
++
+ 	ent = driver->proc_entry;
+ 	if (!ent)
+ 		return;
+@@ -162,6 +168,9 @@ void proc_tty_unregister_driver(struct t
+  */
+ void __init proc_tty_init(void)
+ {
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return;
++
+ 	if (!proc_mkdir("tty", NULL))
+ 		return;
+ 	proc_mkdir("tty/ldisc", NULL);	/* Preserved: it's userspace visible */
+--- a/include/net/snmp.h
++++ b/include/net/snmp.h
+@@ -124,6 +124,21 @@ struct linux_tls_mib {
+ #define DECLARE_SNMP_STAT(type, name)	\
+ 	extern __typeof__(type) __percpu *name
+ 
++#ifdef CONFIG_PROC_STRIPPED
++#define __SNMP_STATS_DUMMY(mib)	\
++	do { (void) mib->mibs[0]; } while(0)
++
++#define __SNMP_INC_STATS(mib, field) __SNMP_STATS_DUMMY(mib)
++#define SNMP_INC_STATS_ATOMIC_LONG(mib, field) __SNMP_STATS_DUMMY(mib)
++#define SNMP_INC_STATS(mib, field) __SNMP_STATS_DUMMY(mib)
++#define SNMP_DEC_STATS(mib, field) __SNMP_STATS_DUMMY(mib)
++#define __SNMP_ADD_STATS(mib, field, addend) __SNMP_STATS_DUMMY(mib)
++#define SNMP_ADD_STATS(mib, field, addend) __SNMP_STATS_DUMMY(mib)
++#define SNMP_UPD_PO_STATS(mib, basefield, addend) __SNMP_STATS_DUMMY(mib)
++#define __SNMP_UPD_PO_STATS(mib, basefield, addend) __SNMP_STATS_DUMMY(mib)
++
++#else
++
+ #define __SNMP_INC_STATS(mib, field)	\
+ 			__this_cpu_inc(mib->mibs[field])
+ 
+@@ -154,8 +169,9 @@ struct linux_tls_mib {
+ 		__this_cpu_add(ptr[basefield##OCTETS], addend);	\
+ 	} while (0)
+ 
++#endif
+ 
+-#if BITS_PER_LONG==32
++#if (BITS_PER_LONG==32) && !defined(CONFIG_PROC_STRIPPED)
+ 
+ #define __SNMP_ADD_STATS64(mib, field, addend) 				\
+ 	do {								\
+--- a/ipc/msg.c
++++ b/ipc/msg.c
+@@ -1370,6 +1370,9 @@ void __init msg_init(void)
+ {
+ 	msg_init_ns(&init_ipc_ns);
+ 
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return;
++
+ 	ipc_init_proc_interface("sysvipc/msg",
+ 				"       key      msqid perms      cbytes       qnum lspid lrpid   uid   gid  cuid  cgid      stime      rtime      ctime\n",
+ 				IPC_MSG_IDS, sysvipc_msg_proc_show);
+--- a/ipc/sem.c
++++ b/ipc/sem.c
+@@ -268,6 +268,8 @@ void sem_exit_ns(struct ipc_namespace *n
+ void __init sem_init(void)
+ {
+ 	sem_init_ns(&init_ipc_ns);
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return;
+ 	ipc_init_proc_interface("sysvipc/sem",
+ 				"       key      semid perms      nsems   uid   gid  cuid  cgid      otime      ctime\n",
+ 				IPC_SEM_IDS, sysvipc_sem_proc_show);
+--- a/ipc/shm.c
++++ b/ipc/shm.c
+@@ -155,6 +155,8 @@ pure_initcall(ipc_ns_init);
+ 
+ void __init shm_init(void)
+ {
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return;
+ 	ipc_init_proc_interface("sysvipc/shm",
+ #if BITS_PER_LONG <= 32
+ 				"       key      shmid perms       size  cpid  lpid nattch   uid   gid  cuid  cgid      atime      dtime      ctime        rss       swap\n",
+--- a/ipc/util.c
++++ b/ipc/util.c
+@@ -141,6 +141,9 @@ void __init ipc_init_proc_interface(cons
+ 	struct proc_dir_entry *pde;
+ 	struct ipc_proc_iface *iface;
+ 
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return;
++
+ 	iface = kmalloc(sizeof(*iface), GFP_KERNEL);
+ 	if (!iface)
+ 		return;
+--- a/kernel/exec_domain.c
++++ b/kernel/exec_domain.c
+@@ -29,6 +29,8 @@ static int execdomains_proc_show(struct
+ 
+ static int __init proc_execdomains_init(void)
+ {
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return 0;
+ 	proc_create_single("execdomains", 0, NULL, execdomains_proc_show);
+ 	return 0;
+ }
+--- a/kernel/irq/proc.c
++++ b/kernel/irq/proc.c
+@@ -339,6 +339,9 @@ void register_irq_proc(unsigned int irq,
+ 	void __maybe_unused *irqp = (void *)(unsigned long) irq;
+ 	char name [MAX_NAMELEN];
+ 
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED) && !IS_ENABLED(CONFIG_SMP))
++		return;
++
+ 	if (!root_irq_dir || (desc->irq_data.chip == &no_irq_chip))
+ 		return;
+ 
+@@ -397,6 +400,9 @@ void unregister_irq_proc(unsigned int ir
+ {
+ 	char name [MAX_NAMELEN];
+ 
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED) && !IS_ENABLED(CONFIG_SMP))
++		return;
++
+ 	if (!root_irq_dir || !desc->dir)
+ 		return;
+ #ifdef CONFIG_SMP
+@@ -435,6 +441,9 @@ void init_irq_proc(void)
+ 	unsigned int irq;
+ 	struct irq_desc *desc;
+ 
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED) && !IS_ENABLED(CONFIG_SMP))
++		return;
++
+ 	/* create /proc/irq */
+ 	root_irq_dir = proc_mkdir("irq", NULL);
+ 	if (!root_irq_dir)
+--- a/kernel/time/timer_list.c
++++ b/kernel/time/timer_list.c
+@@ -354,6 +354,8 @@ static int __init init_timer_list_procfs
+ {
+ 	struct proc_dir_entry *pe;
+ 
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return 0;
+ 	pe = proc_create_seq_private("timer_list", 0400, NULL, &timer_list_sops,
+ 			sizeof(struct timer_list_iter), NULL);
+ 	if (!pe)
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -5032,6 +5032,8 @@ static int __init proc_vmalloc_init(void
+ {
+ 	void *priv_data = NULL;
+ 
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return 0;
+ 	if (IS_ENABLED(CONFIG_NUMA))
+ 		priv_data = kmalloc(nr_node_ids * sizeof(unsigned int), GFP_KERNEL);
+ 
+--- a/mm/vmstat.c
++++ b/mm/vmstat.c
+@@ -2195,10 +2195,12 @@ void __init init_mm_internals(void)
+ 	start_shepherd_timer();
+ #endif
+ #ifdef CONFIG_PROC_FS
+-	proc_create_seq("buddyinfo", 0444, NULL, &fragmentation_op);
+-	proc_create_seq("pagetypeinfo", 0400, NULL, &pagetypeinfo_op);
++	if (!IS_ENABLED(CONFIG_PROC_STRIPPED)) {
++		proc_create_seq("buddyinfo", 0444, NULL, &fragmentation_op);
++		proc_create_seq("pagetypeinfo", 0400, NULL, &pagetypeinfo_op);
++		proc_create_seq("zoneinfo", 0444, NULL, &zoneinfo_op);
++	}
+ 	proc_create_seq("vmstat", 0444, NULL, &vmstat_op);
+-	proc_create_seq("zoneinfo", 0444, NULL, &zoneinfo_op);
+ #endif
+ }
+ 
+--- a/net/8021q/vlanproc.c
++++ b/net/8021q/vlanproc.c
+@@ -93,6 +93,9 @@ void vlan_proc_cleanup(struct net *net)
+ {
+ 	struct vlan_net *vn = net_generic(net, vlan_net_id);
+ 
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return;
++
+ 	if (vn->proc_vlan_conf)
+ 		remove_proc_entry(name_conf, vn->proc_vlan_dir);
+ 
+@@ -112,6 +115,9 @@ int __net_init vlan_proc_init(struct net
+ {
+ 	struct vlan_net *vn = net_generic(net, vlan_net_id);
+ 
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return 0;
++
+ 	vn->proc_vlan_dir = proc_net_mkdir(net, name_root, net->proc_net);
+ 	if (!vn->proc_vlan_dir)
+ 		goto err;
+--- a/net/core/net-procfs.c
++++ b/net/core/net-procfs.c
+@@ -295,10 +295,12 @@ static int __net_init dev_proc_net_init(
+ 	if (!proc_create_net("dev", 0444, net->proc_net, &dev_seq_ops,
+ 			sizeof(struct seq_net_private)))
+ 		goto out;
+-	if (!proc_create_seq("softnet_stat", 0444, net->proc_net,
++	if (!IS_ENABLED(CONFIG_PROC_STRIPPED) &&
++			!proc_create_seq("softnet_stat", 0444, net->proc_net,
+ 			 &softnet_seq_ops))
+ 		goto out_dev;
+-	if (!proc_create_net("ptype", 0444, net->proc_net, &ptype_seq_ops,
++	if (!IS_ENABLED(CONFIG_PROC_STRIPPED) &&
++			!proc_create_net("ptype", 0444, net->proc_net, &ptype_seq_ops,
+ 			sizeof(struct seq_net_private)))
+ 		goto out_softnet;
+ 
+@@ -308,9 +310,11 @@ static int __net_init dev_proc_net_init(
+ out:
+ 	return rc;
+ out_ptype:
+-	remove_proc_entry("ptype", net->proc_net);
++	if (!IS_ENABLED(CONFIG_PROC_STRIPPED))
++		remove_proc_entry("ptype", net->proc_net);
+ out_softnet:
+-	remove_proc_entry("softnet_stat", net->proc_net);
++	if (!IS_ENABLED(CONFIG_PROC_STRIPPED))
++		remove_proc_entry("softnet_stat", net->proc_net);
+ out_dev:
+ 	remove_proc_entry("dev", net->proc_net);
+ 	goto out;
+@@ -320,8 +324,10 @@ static void __net_exit dev_proc_net_exit
+ {
+ 	wext_proc_exit(net);
+ 
+-	remove_proc_entry("ptype", net->proc_net);
+-	remove_proc_entry("softnet_stat", net->proc_net);
++	if (!IS_ENABLED(CONFIG_PROC_STRIPPED)) {
++		remove_proc_entry("ptype", net->proc_net);
++		remove_proc_entry("softnet_stat", net->proc_net);
++	}
+ 	remove_proc_entry("dev", net->proc_net);
+ }
+ 
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -4248,6 +4248,8 @@ static __net_initdata struct pernet_oper
+ 
+ static int __init proto_init(void)
+ {
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return 0;
+ 	return register_pernet_subsys(&proto_net_ops);
+ }
+ 
+--- a/net/ipv4/fib_trie.c
++++ b/net/ipv4/fib_trie.c
+@@ -3037,11 +3037,13 @@ static const struct seq_operations fib_r
+ 
+ int __net_init fib_proc_init(struct net *net)
+ {
+-	if (!proc_create_net("fib_trie", 0444, net->proc_net, &fib_trie_seq_ops,
++	if (!IS_ENABLED(CONFIG_PROC_STRIPPED) &&
++			!proc_create_net("fib_trie", 0444, net->proc_net, &fib_trie_seq_ops,
+ 			sizeof(struct fib_trie_iter)))
+ 		goto out1;
+ 
+-	if (!proc_create_net_single("fib_triestat", 0444, net->proc_net,
++	if (!IS_ENABLED(CONFIG_PROC_STRIPPED) &&
++			!proc_create_net_single("fib_triestat", 0444, net->proc_net,
+ 			fib_triestat_seq_show, NULL))
+ 		goto out2;
+ 
+@@ -3052,17 +3054,21 @@ int __net_init fib_proc_init(struct net
+ 	return 0;
+ 
+ out3:
+-	remove_proc_entry("fib_triestat", net->proc_net);
++	if (!IS_ENABLED(CONFIG_PROC_STRIPPED))
++		remove_proc_entry("fib_triestat", net->proc_net);
+ out2:
+-	remove_proc_entry("fib_trie", net->proc_net);
++	if (!IS_ENABLED(CONFIG_PROC_STRIPPED))
++		remove_proc_entry("fib_trie", net->proc_net);
+ out1:
+ 	return -ENOMEM;
+ }
+ 
+ void __net_exit fib_proc_exit(struct net *net)
+ {
+-	remove_proc_entry("fib_trie", net->proc_net);
+-	remove_proc_entry("fib_triestat", net->proc_net);
++	if (!IS_ENABLED(CONFIG_PROC_STRIPPED)) {
++		remove_proc_entry("fib_trie", net->proc_net);
++		remove_proc_entry("fib_triestat", net->proc_net);
++	}
+ 	remove_proc_entry("route", net->proc_net);
+ }
+ 
+--- a/net/ipv4/proc.c
++++ b/net/ipv4/proc.c
+@@ -563,5 +563,8 @@ static __net_initdata struct pernet_oper
+ 
+ int __init ip_misc_proc_init(void)
+ {
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return 0;
++
+ 	return register_pernet_subsys(&ip_proc_ops);
+ }
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -378,6 +378,9 @@ static struct pernet_operations ip_rt_pr
+ 
+ static int __init ip_rt_proc_init(void)
+ {
++	if (IS_ENABLED(CONFIG_PROC_STRIPPED))
++		return 0;
++
+ 	return register_pernet_subsys(&ip_rt_proc_ops);
+ }
+ 
+--- a/net/ipv4/inet_timewait_sock.c
++++ b/net/ipv4/inet_timewait_sock.c
+@@ -296,7 +296,7 @@ void __inet_twsk_schedule(struct inet_ti
+ 	 */
+ 
+ 	if (!rearm) {
+-		bool kill = timeo <= 4*HZ;
++		bool __maybe_unused  kill = timeo <= 4*HZ;
+ 
+ 		__NET_INC_STATS(twsk_net(tw), kill ? LINUX_MIB_TIMEWAITKILLED :
+ 						     LINUX_MIB_TIMEWAITED);
diff --git a/6.12/target/linux/generic/hack-6.12/904-debloat_dma_buf.patch b/6.12/target/linux/generic/hack-6.12/904-debloat_dma_buf.patch
new file mode 100644
index 00000000..96c870de
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/904-debloat_dma_buf.patch
@@ -0,0 +1,93 @@
+From e3692cb2fcd5ba1244512a0f43b8118f65f1c375 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 8 Jul 2017 08:20:43 +0200
+Subject: debloat: dmabuf
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ drivers/base/Kconfig      |  2 +-
+ drivers/dma-buf/Makefile  | 10 +++++++---
+ drivers/dma-buf/dma-buf.c |  4 +++-
+ kernel/sched/core.c       |  1 +
+ 4 files changed, 12 insertions(+), 5 deletions(-)
+
+--- a/drivers/base/Kconfig
++++ b/drivers/base/Kconfig
+@@ -198,7 +198,7 @@ config SOC_BUS
+ source "drivers/base/regmap/Kconfig"
+ 
+ config DMA_SHARED_BUFFER
+-	bool
++	tristate
+ 	default n
+ 	select IRQ_WORK
+ 	help
+--- a/drivers/dma-buf/heaps/Makefile
++++ b/drivers/dma-buf/heaps/Makefile
+@@ -1,3 +1,3 @@
+ # SPDX-License-Identifier: GPL-2.0
+-obj-$(CONFIG_DMABUF_HEAPS_SYSTEM)	+= system_heap.o
+-obj-$(CONFIG_DMABUF_HEAPS_CMA)		+= cma_heap.o
++dma-buf-objs-$(CONFIG_DMABUF_HEAPS_SYSTEM)	+= system_heap.o
++dma-buf-objs-$(CONFIG_DMABUF_HEAPS_CMA)		+= cma_heap.o
+--- a/drivers/dma-buf/Makefile
++++ b/drivers/dma-buf/Makefile
+@@ -1,12 +1,14 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+-obj-y := dma-buf.o dma-fence.o dma-fence-array.o dma-fence-chain.o \
++obj-$(CONFIG_DMA_SHARED_BUFFER) := dma-shared-buffer.o
++
++dma-buf-objs-y := dma-buf.o dma-fence.o dma-fence-array.o dma-fence-chain.o \
+ 	 dma-fence-unwrap.o dma-resv.o
+-obj-$(CONFIG_DMABUF_HEAPS)	+= dma-heap.o
+-obj-$(CONFIG_DMABUF_HEAPS)	+= heaps/
+-obj-$(CONFIG_SYNC_FILE)		+= sync_file.o
+-obj-$(CONFIG_SW_SYNC)		+= sw_sync.o sync_debug.o
+-obj-$(CONFIG_UDMABUF)		+= udmabuf.o
+-obj-$(CONFIG_DMABUF_SYSFS_STATS) += dma-buf-sysfs-stats.o
++dma-buf-objs-$(CONFIG_DMABUF_HEAPS)	+= dma-heap.o
++obj-$(CONFIG_DMABUF_HEAPS)		+= heaps/
++dma-buf-objs-$(CONFIG_SYNC_FILE)	+= sync_file.o
++dma-buf-objs-$(CONFIG_SW_SYNC)		+= sw_sync.o sync_debug.o
++dma-buf-objs-$(CONFIG_UDMABUF)		+= udmabuf.o
++dma-buf-objs-$(CONFIG_DMABUF_SYSFS_STATS) += dma-buf-sysfs-stats.o
+ 
+ dmabuf_selftests-y := \
+ 	selftest.o \
+@@ -15,4 +17,6 @@ dmabuf_selftests-y := \
+ 	st-dma-fence-unwrap.o \
+ 	st-dma-resv.o
+ 
+-obj-$(CONFIG_DMABUF_SELFTESTS)	+= dmabuf_selftests.o
++dma-buf-objs-$(CONFIG_DMABUF_SELFTESTS)	+= dmabuf_selftests.o
++
++dma-shared-buffer-objs :=  $(dma-buf-objs-y)
+--- a/drivers/dma-buf/dma-buf.c
++++ b/drivers/dma-buf/dma-buf.c
+@@ -1743,4 +1743,5 @@ static void __exit dma_buf_deinit(void)
+ 	kern_unmount(dma_buf_mnt);
+ 	dma_buf_uninit_sysfs_statistics();
+ }
+-__exitcall(dma_buf_deinit);
++module_exit(dma_buf_deinit);
++MODULE_LICENSE("GPL");
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -4419,6 +4419,7 @@ int wake_up_state(struct task_struct *p,
+ {
+ 	return try_to_wake_up(p, state, 0);
+ }
++EXPORT_SYMBOL_GPL(wake_up_state);
+ 
+ /*
+  * Perform scheduler related setup for a newly forked process p.
+--- a/fs/d_path.c
++++ b/fs/d_path.c
+@@ -314,6 +314,7 @@ char *dynamic_dname(char *buffer, int bu
+ 	buffer += buflen - sz;
+ 	return memcpy(buffer, temp, sz);
+ }
++EXPORT_SYMBOL_GPL(dynamic_dname);
+ 
+ char *simple_dname(struct dentry *dentry, char *buffer, int buflen)
+ {
diff --git a/6.12/target/linux/generic/hack-6.12/910-kobject_uevent.patch b/6.12/target/linux/generic/hack-6.12/910-kobject_uevent.patch
new file mode 100644
index 00000000..24e6d240
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/910-kobject_uevent.patch
@@ -0,0 +1,41 @@
+From 0d37e6edc09c99e683dd91ca0e83bbc0df8477b3 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 16 Jul 2017 16:56:10 +0200
+Subject: lib: add uevent_next_seqnum()
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ include/linux/kobject.h |  5 +++++
+ lib/kobject_uevent.c    | 37 +++++++++++++++++++++++++++++++++++++
+ 2 files changed, 42 insertions(+)
+
+--- a/include/linux/kobject.h
++++ b/include/linux/kobject.h
+@@ -219,4 +219,6 @@ int kobject_synth_uevent(struct kobject
+ __printf(2, 3)
+ int add_uevent_var(struct kobj_uevent_env *env, const char *format, ...);
+ 
++u64 uevent_next_seqnum(void);
++
+ #endif /* _KOBJECT_H_ */
+--- a/lib/kobject_uevent.c
++++ b/lib/kobject_uevent.c
+@@ -178,6 +178,18 @@ out:
+ 	return r;
+ }
+ 
++u64 uevent_next_seqnum(void)
++{
++	u64 seq;
++
++	mutex_lock(&uevent_sock_mutex);
++	seq = atomic64_inc_return(&uevent_seqnum);
++	mutex_unlock(&uevent_sock_mutex);
++
++	return seq;
++}
++EXPORT_SYMBOL_GPL(uevent_next_seqnum);
++
+ /**
+  * kobject_synth_uevent - send synthetic uevent with arguments
+  *
diff --git a/6.12/target/linux/generic/hack-6.12/911-kobject_add_broadcast_uevent.patch b/6.12/target/linux/generic/hack-6.12/911-kobject_add_broadcast_uevent.patch
new file mode 100644
index 00000000..39f948a1
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/911-kobject_add_broadcast_uevent.patch
@@ -0,0 +1,76 @@
+From 0d37e6edc09c99e683dd91ca0e83bbc0df8477b3 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 16 Jul 2017 16:56:10 +0200
+Subject: lib: add broadcast_uevent()
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ include/linux/kobject.h |  5 +++++
+ lib/kobject_uevent.c    | 37 +++++++++++++++++++++++++++++++++++++
+ 2 files changed, 42 insertions(+)
+
+--- a/include/linux/kobject.h
++++ b/include/linux/kobject.h
+@@ -32,6 +32,8 @@
+ #define UEVENT_NUM_ENVP			64	/* number of env pointers */
+ #define UEVENT_BUFFER_SIZE		2048	/* buffer for the variables */
+ 
++struct sk_buff;
++
+ #ifdef CONFIG_UEVENT_HELPER
+ /* path to the userspace helper executed on an event */
+ extern char uevent_helper[];
+@@ -221,4 +223,7 @@ int add_uevent_var(struct kobj_uevent_en
+ 
+ u64 uevent_next_seqnum(void);
+ 
++int broadcast_uevent(struct sk_buff *skb, __u32 pid, __u32 group,
++		     gfp_t allocation);
++
+ #endif /* _KOBJECT_H_ */
+--- a/lib/kobject_uevent.c
++++ b/lib/kobject_uevent.c
+@@ -705,6 +705,43 @@ int add_uevent_var(struct kobj_uevent_en
+ EXPORT_SYMBOL_GPL(add_uevent_var);
+ 
+ #if defined(CONFIG_NET)
++int broadcast_uevent(struct sk_buff *skb, __u32 pid, __u32 group,
++		     gfp_t allocation)
++{
++	struct uevent_sock *ue_sk;
++	int err = 0;
++
++	/* send netlink message */
++	mutex_lock(&uevent_sock_mutex);
++	list_for_each_entry(ue_sk, &uevent_sock_list, list) {
++		struct sock *uevent_sock = ue_sk->sk;
++		struct sk_buff *skb2;
++
++		skb2 = skb_clone(skb, allocation);
++		if (!skb2)
++			break;
++
++		err = netlink_broadcast(uevent_sock, skb2, pid, group,
++					allocation);
++		if (err)
++			break;
++	}
++	mutex_unlock(&uevent_sock_mutex);
++
++	kfree_skb(skb);
++	return err;
++}
++#else
++int broadcast_uevent(struct sk_buff *skb, __u32 pid, __u32 group,
++		     gfp_t allocation)
++{
++	kfree_skb(skb);
++	return 0;
++}
++#endif
++EXPORT_SYMBOL_GPL(broadcast_uevent);
++
++#if defined(CONFIG_NET)
+ static int uevent_net_broadcast(struct sock *usk, struct sk_buff *skb,
+ 				struct netlink_ext_ack *extack)
+ {
diff --git a/6.12/target/linux/generic/hack-6.12/920-device_tree_cmdline.patch b/6.12/target/linux/generic/hack-6.12/920-device_tree_cmdline.patch
new file mode 100644
index 00000000..41403cf9
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/920-device_tree_cmdline.patch
@@ -0,0 +1,21 @@
+From e08bcbbaa52fcc41f02743fd2e62a33255ce52da Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Wed, 13 Jul 2022 13:52:28 +0200
+Subject: [PATCH] of/ftd: add device tree cmdline
+
+---
+ drivers/of/fdt.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -1052,6 +1052,9 @@ int __init early_init_dt_scan_chosen(cha
+ 	p = of_get_flat_dt_prop(node, "bootargs", &l);
+ 	if (p != NULL && l > 0)
+ 		strscpy(cmdline, p, min(l, COMMAND_LINE_SIZE));
++	p = of_get_flat_dt_prop(node, "bootargs-append", &l);
++	if (p != NULL && l > 0)
++		strlcat(cmdline, p, min_t(int, strlen(cmdline) + (int)l, COMMAND_LINE_SIZE));
+ 
+ handle_cmdline:
+ 	/*
diff --git a/6.12/target/linux/generic/hack-6.12/930-Revert-Revert-Revert-driver-core-Set-fw_devlink-on-b.patch b/6.12/target/linux/generic/hack-6.12/930-Revert-Revert-Revert-driver-core-Set-fw_devlink-on-b.patch
new file mode 100644
index 00000000..a7c8a8ef
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/930-Revert-Revert-Revert-driver-core-Set-fw_devlink-on-b.patch
@@ -0,0 +1,30 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 19 Jul 2022 06:17:48 +0200
+Subject: [PATCH] Revert "Revert "Revert "driver core: Set fw_devlink=on by
+ default"""
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This reverts commit ea718c699055c8566eb64432388a04974c43b2ea.
+
+With of_platform_populate() called for MTD partitions that commit breaks
+probing devices which reference MTD in device tree.
+
+Link: https://lore.kernel.org/all/696cb2da-20b9-b3dd-46d9-de4bf91a1506@gmail.com/T/#u
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+ drivers/base/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -1653,7 +1653,7 @@ static void device_links_purge(struct de
+ #define FW_DEVLINK_FLAGS_RPM		(FW_DEVLINK_FLAGS_ON | \
+ 					 DL_FLAG_PM_RUNTIME)
+ 
+-static u32 fw_devlink_flags = FW_DEVLINK_FLAGS_RPM;
++static u32 fw_devlink_flags = FW_DEVLINK_FLAGS_PERMISSIVE;
+ static int __init fw_devlink_setup(char *arg)
+ {
+ 	if (!arg)
diff --git a/6.12/target/linux/generic/hack-6.12/931-fix-compilation-warnings.patch b/6.12/target/linux/generic/hack-6.12/931-fix-compilation-warnings.patch
new file mode 100644
index 00000000..3ad92830
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/931-fix-compilation-warnings.patch
@@ -0,0 +1,34 @@
+--- a/include/linux/irq.h
++++ b/include/linux/irq.h
+@@ -1267,6 +1267,9 @@ static inline u32 irq_reg_readl(struct i
+ 		return readl(gc->reg_base + reg_offset);
+ }
+ 
++int get_c0_perfcount_int(void);
++unsigned int get_c0_compare_int(void);
++
+ struct irq_matrix;
+ struct irq_matrix *irq_alloc_matrix(unsigned int matrix_bits,
+ 				    unsigned int alloc_start,
+--- a/arch/mips/include/asm/switch_to.h
++++ b/arch/mips/include/asm/switch_to.h
+@@ -111,7 +111,7 @@ do {									\
+ 	__mips_mt_fpaff_switch_to(prev);				\
+ 	lose_fpu_inatomic(1, prev);					\
+ 	if (tsk_used_math(next))					\
+-		__sanitize_fcr31(next);					\
++		{ __sanitize_fcr31(next); }				\
+ 	if (cpu_has_dsp) {						\
+ 		__save_dsp(prev);					\
+ 		__restore_dsp(next);					\
+--- a/include/linux/cpumask.h
++++ b/include/linux/cpumask.h
+@@ -836,7 +836,7 @@ void cpumask_shift_left(struct cpumask *
+ static __always_inline
+ void cpumask_copy(struct cpumask *dstp, const struct cpumask *srcp)
+ {
+-	bitmap_copy(cpumask_bits(dstp), cpumask_bits(srcp), large_cpumask_bits);
++	bitmap_copy(cpumask_bits(dstp), cpumask_bits(srcp), MIN(large_cpumask_bits, sizeof(cpumask_var_t) * BITS_PER_BYTE));
+ }
+ 
+ /**
diff --git a/6.12/target/linux/generic/hack-6.12/932-fix-undefined-references.patch b/6.12/target/linux/generic/hack-6.12/932-fix-undefined-references.patch
new file mode 100644
index 00000000..ef6ffcd7
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/932-fix-undefined-references.patch
@@ -0,0 +1,13 @@
+--- a/kernel/vmcore_info.c
++++ b/kernel/vmcore_info.c
+@@ -214,8 +214,10 @@ static int __init crash_save_vmcoreinfo_
+ #ifdef CONFIG_KALLSYMS
+ 	VMCOREINFO_SYMBOL(kallsyms_names);
+ 	VMCOREINFO_SYMBOL(kallsyms_num_syms);
++#ifndef CONFIG_KALLSYMS_UNCOMPRESSED
+ 	VMCOREINFO_SYMBOL(kallsyms_token_table);
+ 	VMCOREINFO_SYMBOL(kallsyms_token_index);
++#endif
+ 	VMCOREINFO_SYMBOL(kallsyms_offsets);
+ 	VMCOREINFO_SYMBOL(kallsyms_relative_base);
+ #endif /* CONFIG_KALLSYMS */
diff --git a/6.12/target/linux/generic/hack-6.12/982-add-bcm-fullcone-support.patch b/6.12/target/linux/generic/hack-6.12/982-add-bcm-fullcone-support.patch
new file mode 100644
index 00000000..446f6bba
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/982-add-bcm-fullcone-support.patch
@@ -0,0 +1,235 @@
+--- a/net/netfilter/nf_nat_masquerade.c
++++ b/net/netfilter/nf_nat_masquerade.c
+@@ -8,6 +8,9 @@
+ #include <linux/netfilter_ipv6.h>
+ 
+ #include <net/netfilter/nf_nat_masquerade.h>
++#include <net/netfilter/nf_conntrack_zones.h>
++#include <net/netfilter/nf_conntrack_helper.h>
++#include <net/netfilter/nf_conntrack_core.h>
+ 
+ struct masq_dev_work {
+ 	struct work_struct work;
+@@ -24,6 +27,129 @@ static DEFINE_MUTEX(masq_mutex);
+ static unsigned int masq_refcnt __read_mostly;
+ static atomic_t masq_worker_count __read_mostly;
+ 
++static void bcm_nat_expect(struct nf_conn *ct,
++                          struct nf_conntrack_expect *exp)
++{
++       struct nf_nat_range2 range;
++
++       /* This must be a fresh one. */
++       BUG_ON(ct->status & IPS_NAT_DONE_MASK);
++
++       /* Change src to where new ct comes from */
++       range.flags = NF_NAT_RANGE_MAP_IPS;
++       range.min_addr = range.max_addr =
++               ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3;
++       nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
++
++       /* For DST manip, map port here to where it's expected. */
++       range.flags = (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED);
++       range.min_proto = range.max_proto = exp->saved_proto;
++       range.min_addr = range.max_addr = exp->saved_addr;
++       nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST);
++}
++
++/****************************************************************************/
++static int bcm_nat_help(struct sk_buff *skb, unsigned int protoff,
++                       struct nf_conn *ct, enum ip_conntrack_info ctinfo)
++{
++       int dir = CTINFO2DIR(ctinfo);
++       struct nf_conn_help *help = nfct_help(ct);
++       struct nf_conntrack_expect *exp;
++
++       if (dir != IP_CT_DIR_ORIGINAL ||
++           help->expecting[NF_CT_EXPECT_CLASS_DEFAULT])
++               return NF_ACCEPT;
++
++       pr_debug("bcm_nat: packet[%d bytes] ", skb->len);
++       nf_ct_dump_tuple(&ct->tuplehash[dir].tuple);
++       pr_debug("reply: ");
++       nf_ct_dump_tuple(&ct->tuplehash[!dir].tuple);
++
++       /* Create expect */
++       if ((exp = nf_ct_expect_alloc(ct)) == NULL)
++               return NF_ACCEPT;
++
++       nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, AF_INET, NULL,
++                         &ct->tuplehash[!dir].tuple.dst.u3, IPPROTO_UDP,
++                         NULL, &ct->tuplehash[!dir].tuple.dst.u.udp.port);
++       exp->flags = NF_CT_EXPECT_PERMANENT;
++       exp->saved_addr = ct->tuplehash[dir].tuple.src.u3;
++       exp->saved_proto.udp.port = ct->tuplehash[dir].tuple.src.u.udp.port;
++       exp->dir = !dir;
++       exp->expectfn = bcm_nat_expect;
++
++       /* Setup expect */
++       nf_ct_expect_related(exp, 0);
++       nf_ct_expect_put(exp);
++       pr_debug("bcm_nat: expect setup\n");
++
++       return NF_ACCEPT;
++}
++
++/****************************************************************************/
++static struct nf_conntrack_expect_policy bcm_nat_exp_policy __read_mostly = {
++       .max_expected   = 1000,
++       .timeout        = 240,
++};
++
++/****************************************************************************/
++static struct nf_conntrack_helper nf_conntrack_helper_bcm_nat __read_mostly = {
++       .name = "BCM-NAT",
++       .me = THIS_MODULE,
++       .tuple.src.l3num = AF_INET,
++       .tuple.dst.protonum = IPPROTO_UDP,
++       .expect_policy = &bcm_nat_exp_policy,
++       .expect_class_max = 1,
++       .help = bcm_nat_help,
++};
++
++/****************************************************************************/
++static inline int find_exp(__be32 ip, __be16 port, struct nf_conn *ct)
++{
++       struct nf_conntrack_tuple tuple;
++       struct nf_conntrack_expect *i = NULL;
++
++
++       memset(&tuple, 0, sizeof(tuple));
++       tuple.src.l3num = AF_INET;
++       tuple.dst.protonum = IPPROTO_UDP;
++       tuple.dst.u3.ip = ip;
++       tuple.dst.u.udp.port = port;
++
++       rcu_read_lock();
++       i = __nf_ct_expect_find(nf_ct_net(ct), nf_ct_zone(ct), &tuple);
++       rcu_read_unlock();
++
++       return i != NULL;
++}
++
++/****************************************************************************/
++static inline struct nf_conntrack_expect *find_fullcone_exp(struct nf_conn *ct)
++{
++       struct nf_conntrack_tuple * tp =
++               &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
++       struct nf_conntrack_expect * exp = NULL;
++       struct nf_conntrack_expect * i;
++       unsigned int h;
++
++       rcu_read_lock();
++       for (h = 0; h < nf_ct_expect_hsize; h++) {
++               hlist_for_each_entry_rcu(i, &nf_ct_expect_hash[h], hnode) {
++                       if (nf_inet_addr_cmp(&i->saved_addr, &tp->src.u3) &&
++                           i->saved_proto.all == tp->src.u.all &&
++                           i->tuple.dst.protonum == tp->dst.protonum &&
++                           i->tuple.src.u3.ip == 0 &&
++                           i->tuple.src.u.udp.port == 0) {
++                               exp = i;
++                               break;
++                       }
++               }
++       }
++       rcu_read_unlock();
++
++       return exp;
++}
++
+ unsigned int
+ nf_nat_masquerade_ipv4(struct sk_buff *skb, unsigned int hooknum,
+ 		       const struct nf_nat_range2 *range,
+@@ -61,6 +187,72 @@ nf_nat_masquerade_ipv4(struct sk_buff *s
+ 	if (nat)
+ 		nat->masq_index = out->ifindex;
+ 
++/* RFC 4787 - 4.2.2.  Port Parity
++   i.e., an even port will be mapped to an even port, and an odd port will be mapped to an odd port.
++*/
++#define CHECK_PORT_PARITY(a, b) ((a%2)==(b%2))
++       if (range->min_addr.ip != 0 /* nat_mode == full cone */
++           && (nfct_help(ct) == NULL || nfct_help(ct)->helper == NULL)
++           && nf_ct_protonum(ct) == IPPROTO_UDP) {
++               unsigned int ret;
++               u_int16_t minport;
++               u_int16_t maxport;
++               struct nf_conntrack_expect *exp;
++
++               pr_debug("bcm_nat: need full cone NAT\n");
++
++               /* Choose port */
++               spin_lock_bh(&nf_conntrack_expect_lock);
++               /* Look for existing expectation */
++               exp = find_fullcone_exp(ct);
++               if (exp) {
++                       minport = maxport = exp->tuple.dst.u.udp.port;
++                       pr_debug("bcm_nat: existing mapped port = %hu\n",
++                                ntohs(minport));
++               } else { /* no previous expect */
++                       u_int16_t newport, tmpport, orgport;
++
++                       minport = range->min_proto.all == 0? 
++                               ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.
++                               u.udp.port : range->min_proto.all;
++                       maxport = range->max_proto.all == 0? 
++                               htons(65535) : range->max_proto.all;
++                        orgport = ntohs(minport);
++                       for (newport = ntohs(minport),tmpport = ntohs(maxport); 
++                            newport <= tmpport; newport++) {
++                               if (CHECK_PORT_PARITY(orgport, newport) && !find_exp(newsrc, htons(newport), ct)) {
++                                        pr_debug("bcm_nat: new mapped port = "
++                                                "%hu\n", newport);
++                                       minport = maxport = htons(newport);
++                                       break;
++                               }
++                       }
++               }
++               spin_unlock_bh(&nf_conntrack_expect_lock);
++
++
++       memset(&newrange.min_addr, 0, sizeof(newrange.min_addr));
++       memset(&newrange.max_addr, 0, sizeof(newrange.max_addr));
++
++               newrange.flags = range->flags | NF_NAT_RANGE_MAP_IPS |
++                       NF_NAT_RANGE_PROTO_SPECIFIED;
++               newrange.max_addr.ip = newrange.min_addr.ip = newsrc;
++               newrange.min_proto.udp.port = newrange.max_proto.udp.port = minport;
++
++               /* Set ct helper */
++               ret = nf_nat_setup_info(ct, &newrange, NF_NAT_MANIP_SRC);
++               if (ret == NF_ACCEPT) {
++                       struct nf_conn_help *help = nfct_help(ct);
++                       if (help == NULL)
++                               help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
++                       if (help != NULL) {
++                               help->helper = &nf_conntrack_helper_bcm_nat;
++                               pr_debug("bcm_nat: helper set\n");
++                       }
++               }
++               return ret;
++       }
++
+ 	/* Transfer from original range. */
+ 	memset(&newrange.min_addr, 0, sizeof(newrange.min_addr));
+ 	memset(&newrange.max_addr, 0, sizeof(newrange.max_addr));
+@@ -352,6 +544,7 @@ EXPORT_SYMBOL_GPL(nf_nat_masquerade_inet
+ 
+ void nf_nat_masquerade_inet_unregister_notifiers(void)
+ {
++       nf_conntrack_helper_unregister(&nf_conntrack_helper_bcm_nat);
+ 	mutex_lock(&masq_mutex);
+ 	/* check if the notifiers still have clients */
+ 	if (--masq_refcnt > 0)
+--- a/net/netfilter/xt_MASQUERADE.c
++++ b/net/netfilter/xt_MASQUERADE.c
+@@ -42,6 +42,9 @@ masquerade_tg(struct sk_buff *skb, const
+ 	range.min_proto = mr->range[0].min;
+ 	range.max_proto = mr->range[0].max;
+ 
++       range.min_addr.ip = mr->range[0].min_ip;
++       range.max_addr.ip = mr->range[0].max_ip;
++
+ 	return nf_nat_masquerade_ipv4(skb, xt_hooknum(par), &range,
+ 				      xt_out(par));
+ }
diff --git a/6.12/target/linux/generic/hack-6.12/997-BBRv3.patch b/6.12/target/linux/generic/hack-6.12/997-BBRv3.patch
new file mode 100644
index 00000000..7bc59241
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/997-BBRv3.patch
@@ -0,0 +1,4051 @@
+From 2343b8617207cb536de6a7165188c681263f3407 Mon Sep 17 00:00:00 2001
+From: Neal Cardwell <ncardwell@google.com>
+Date: Tue, 11 Jun 2019 12:26:55 -0400
+Subject: [PATCH 01/19] net-tcp_bbr: broaden app-limited rate sample detection
+
+This commit is a bug fix for the Linux TCP app-limited
+(application-limited) logic that is used for collecting rate
+(bandwidth) samples.
+
+Previously the app-limited logic only looked for "bubbles" of
+silence in between application writes, by checking at the start
+of each sendmsg. But "bubbles" of silence can also happen before
+retransmits: e.g. bubbles can happen between an application write
+and a retransmit, or between two retransmits.
+
+Retransmits are triggered by ACKs or timers. So this commit checks
+for bubbles of app-limited silence upon ACKs or timers.
+
+Why does this commit check for app-limited state at the start of
+ACKs and timer handling? Because at that point we know whether
+inflight was fully using the cwnd.  During processing the ACK or
+timer event we often change the cwnd; after changing the cwnd we
+can't know whether inflight was fully using the old cwnd.
+
+Origin-9xx-SHA1: 3fe9b53291e018407780fb8c356adb5666722cbc
+Change-Id: I37221506f5166877c2b110753d39bb0757985e68
+Signed-off-by: Alexandre Frade <kernel@xanmod.org>
+---
+ net/ipv4/tcp_input.c | 1 +
+ net/ipv4/tcp_timer.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -3934,6 +3934,7 @@ static int tcp_ack(struct sock *sk, cons
+ 
+ 	prior_fack = tcp_is_sack(tp) ? tcp_highest_sack_seq(tp) : tp->snd_una;
+ 	rs.prior_in_flight = tcp_packets_in_flight(tp);
++	tcp_rate_check_app_limited(sk);
+ 
+ 	/* ts_recent update must be made after we are sure that the packet
+ 	 * is in window.
+--- a/net/ipv4/tcp_timer.c
++++ b/net/ipv4/tcp_timer.c
+@@ -689,6 +689,7 @@ void tcp_write_timer_handler(struct sock
+ 		return;
+ 	}
+ 
++	tcp_rate_check_app_limited(sk);
+ 	tcp_mstamp_refresh(tcp_sk(sk));
+ 	event = icsk->icsk_pending;
+ 
+From c7683b8a74098c5f48c61d8d578dd15929c24843 Mon Sep 17 00:00:00 2001
+From: Neal Cardwell <ncardwell@google.com>
+Date: Sun, 24 Jun 2018 21:55:59 -0400
+Subject: [PATCH 02/19] net-tcp_bbr: v2: shrink delivered_mstamp,
+ first_tx_mstamp to u32 to free up 8 bytes
+
+Free up some space for tracking inflight and losses for each
+bw sample, in upcoming commits.
+
+These timestamps are in microseconds, and are now stored in 32
+bits. So they can only hold time intervals up to roughly 2^12 = 4096
+seconds.  But Linux TCP RTT and RTO tracking has the same 32-bit
+microsecond implementation approach and resulting deployment
+limitations. So this is not introducing a new limit. And these should
+not be a limitation for the foreseeable future.
+
+Effort: net-tcp_bbr
+Origin-9xx-SHA1: 238a7e6b5d51625fef1ce7769826a7b21b02ae55
+Change-Id: I3b779603797263b52a61ad57c565eb91fe42680c
+Signed-off-by: Alexandre Frade <kernel@xanmod.org>
+---
+ include/net/tcp.h   | 9 +++++++--
+ net/ipv4/tcp_rate.c | 7 ++++---
+ 2 files changed, 11 insertions(+), 5 deletions(-)
+
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -884,6 +884,11 @@ static inline u32 tcp_stamp_us_delta(u64
+ 	return max_t(s64, t1 - t0, 0);
+ }
+ 
++static inline u32 tcp_stamp32_us_delta(u32 t1, u32 t0)
++{
++	return max_t(s32, t1 - t0, 0);
++}
++
+ /* provide the departure time in us unit */
+ static inline u64 tcp_skb_timestamp_us(const struct sk_buff *skb)
+ {
+@@ -973,9 +978,9 @@ struct tcp_skb_cb {
+ 			/* pkts S/ACKed so far upon tx of skb, incl retrans: */
+ 			__u32 delivered;
+ 			/* start of send pipeline phase */
+-			u64 first_tx_mstamp;
++			u32 first_tx_mstamp;
+ 			/* when we reached the "delivered" count */
+-			u64 delivered_mstamp;
++			u32 delivered_mstamp;
+ 		} tx;   /* only used for outgoing skbs */
+ 		union {
+ 			struct inet_skb_parm	h4;
+--- a/net/ipv4/tcp_rate.c
++++ b/net/ipv4/tcp_rate.c
+@@ -101,8 +101,9 @@ void tcp_rate_skb_delivered(struct sock
+ 		/* Record send time of most recently ACKed packet: */
+ 		tp->first_tx_mstamp  = tx_tstamp;
+ 		/* Find the duration of the "send phase" of this window: */
+-		rs->interval_us = tcp_stamp_us_delta(tp->first_tx_mstamp,
+-						     scb->tx.first_tx_mstamp);
++		rs->interval_us      = tcp_stamp32_us_delta(
++						tp->first_tx_mstamp,
++						scb->tx.first_tx_mstamp);
+ 
+ 	}
+ 	/* Mark off the skb delivered once it's sacked to avoid being
+@@ -155,7 +156,7 @@ void tcp_rate_gen(struct sock *sk, u32 d
+ 	 * longer phase.
+ 	 */
+ 	snd_us = rs->interval_us;				/* send phase */
+-	ack_us = tcp_stamp_us_delta(tp->tcp_mstamp,
++	ack_us = tcp_stamp32_us_delta(tp->tcp_mstamp,
+ 				    rs->prior_mstamp); /* ack phase */
+ 	rs->interval_us = max(snd_us, ack_us);
+ 
+From a128e1c2f3d98794c7341f357628d1e7f737da23 Mon Sep 17 00:00:00 2001
+From: Neal Cardwell <ncardwell@google.com>
+Date: Sat, 5 Aug 2017 11:49:50 -0400
+Subject: [PATCH 03/19] net-tcp_bbr: v2: snapshot packets in flight at transmit
+ time and pass in rate_sample
+
+CC algorithms may want to snapshot the number of packets in flight at
+transmit time and pass in rate_sample, to understand the relationship
+between inflight and losses or ECN signals, to try to find the highest
+inflight value that has acceptable levels of loss/ECN marking.
+
+We split out the code to set an skb's tx.in_flight field into its own
+function, so that this code can be used for the TCP_REPAIR "fake send"
+code path that inserts skbs into the rtx queue without sending them.
+
+Effort: net-tcp_bbr
+Origin-9xx-SHA1: b3eb4f2d20efab4ca001f32c9294739036c493ea
+Origin-9xx-SHA1: e880fc907d06ea7354333f60f712748ebce9497b
+Origin-9xx-SHA1: 330f825a08a6fe92cef74d799cc468864c479f63
+Change-Id: I7314047d0ff14dd261a04b1969a46dc658c8836a
+Signed-off-by: Alexandre Frade <kernel@xanmod.org>
+---
+ include/net/tcp.h     |  6 ++++++
+ net/ipv4/tcp_output.c |  1 +
+ net/ipv4/tcp_rate.c   | 20 ++++++++++++++++++++
+ 3 files changed, 27 insertions(+)
+
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -981,6 +981,10 @@ struct tcp_skb_cb {
+ 			u32 first_tx_mstamp;
+ 			/* when we reached the "delivered" count */
+ 			u32 delivered_mstamp;
++#define TCPCB_IN_FLIGHT_BITS 20
++#define TCPCB_IN_FLIGHT_MAX ((1U << TCPCB_IN_FLIGHT_BITS) - 1)
++			u32 in_flight:20,   /* packets in flight at transmit */
++			    unused2:12;
+ 		} tx;   /* only used for outgoing skbs */
+ 		union {
+ 			struct inet_skb_parm	h4;
+@@ -1136,6 +1140,7 @@ struct rate_sample {
+ 	u64  prior_mstamp; /* starting timestamp for interval */
+ 	u32  prior_delivered;	/* tp->delivered at "prior_mstamp" */
+ 	u32  prior_delivered_ce;/* tp->delivered_ce at "prior_mstamp" */
++	u32 tx_in_flight;	/* packets in flight at starting timestamp */
+ 	s32  delivered;		/* number of packets delivered over interval */
+ 	s32  delivered_ce;	/* number of packets delivered w/ CE marks*/
+ 	long interval_us;	/* time for tp->delivered to incr "delivered" */
+@@ -1258,6 +1263,7 @@ static inline void tcp_ca_event(struct s
+ void tcp_set_ca_state(struct sock *sk, const u8 ca_state);
+ 
+ /* From tcp_rate.c */
++void tcp_set_tx_in_flight(struct sock *sk, struct sk_buff *skb);
+ void tcp_rate_skb_sent(struct sock *sk, struct sk_buff *skb);
+ void tcp_rate_skb_delivered(struct sock *sk, struct sk_buff *skb,
+ 			    struct rate_sample *rs);
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2767,6 +2767,7 @@ static bool tcp_write_xmit(struct sock *
+ 			skb_set_delivery_time(skb, tp->tcp_wstamp_ns, SKB_CLOCK_MONOTONIC);
+ 			list_move_tail(&skb->tcp_tsorted_anchor, &tp->tsorted_sent_queue);
+ 			tcp_init_tso_segs(skb, mss_now);
++			tcp_set_tx_in_flight(sk, skb);
+ 			goto repair; /* Skip network transmission */
+ 		}
+ 
+--- a/net/ipv4/tcp_rate.c
++++ b/net/ipv4/tcp_rate.c
+@@ -34,6 +34,24 @@
+  * ready to send in the write queue.
+  */
+ 
++void tcp_set_tx_in_flight(struct sock *sk, struct sk_buff *skb)
++{
++	struct tcp_sock *tp = tcp_sk(sk);
++	u32 in_flight;
++
++	/* Check, sanitize, and record packets in flight after skb was sent. */
++	in_flight = tcp_packets_in_flight(tp) + tcp_skb_pcount(skb);
++	if (WARN_ONCE(in_flight > TCPCB_IN_FLIGHT_MAX,
++		      "insane in_flight %u cc %s mss %u "
++		      "cwnd %u pif %u %u %u %u\n",
++		      in_flight, inet_csk(sk)->icsk_ca_ops->name,
++		      tp->mss_cache, tp->snd_cwnd,
++		      tp->packets_out, tp->retrans_out,
++		      tp->sacked_out, tp->lost_out))
++		in_flight = TCPCB_IN_FLIGHT_MAX;
++	TCP_SKB_CB(skb)->tx.in_flight = in_flight;
++}
++
+ /* Snapshot the current delivery information in the skb, to generate
+  * a rate sample later when the skb is (s)acked in tcp_rate_skb_delivered().
+  */
+@@ -67,6 +85,7 @@ void tcp_rate_skb_sent(struct sock *sk,
+ 	TCP_SKB_CB(skb)->tx.delivered		= tp->delivered;
+ 	TCP_SKB_CB(skb)->tx.delivered_ce	= tp->delivered_ce;
+ 	TCP_SKB_CB(skb)->tx.is_app_limited	= tp->app_limited ? 1 : 0;
++	tcp_set_tx_in_flight(sk, skb);
+ }
+ 
+ /* When an skb is sacked or acked, we fill in the rate sample with the (prior)
+@@ -96,6 +115,7 @@ void tcp_rate_skb_delivered(struct sock
+ 		rs->prior_mstamp     = scb->tx.delivered_mstamp;
+ 		rs->is_app_limited   = scb->tx.is_app_limited;
+ 		rs->is_retrans	     = scb->sacked & TCPCB_RETRANS;
++		rs->tx_in_flight     = scb->tx.in_flight;
+ 		rs->last_end_seq     = scb->end_seq;
+ 
+ 		/* Record send time of most recently ACKed packet: */
+From 4a30ce7df55db785e1002dbd9d87f807fe14568a Mon Sep 17 00:00:00 2001
+From: Neal Cardwell <ncardwell@google.com>
+Date: Thu, 12 Oct 2017 23:44:27 -0400
+Subject: [PATCH 04/19] net-tcp_bbr: v2: count packets lost over TCP rate
+ sampling interval
+
+For understanding the relationship between inflight and packet loss
+signals, to try to find the highest inflight value that has acceptable
+levels of packet losses.
+
+Effort: net-tcp_bbr
+Origin-9xx-SHA1: 4527e26b2bd7756a88b5b9ef1ada3da33dd609ab
+Change-Id: I594c2500868d9c530770e7ddd68ffc87c57f4fd5
+Signed-off-by: Alexandre Frade <kernel@xanmod.org>
+---
+ include/net/tcp.h   | 5 ++++-
+ net/ipv4/tcp_rate.c | 3 +++
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -985,6 +985,7 @@ struct tcp_skb_cb {
+ #define TCPCB_IN_FLIGHT_MAX ((1U << TCPCB_IN_FLIGHT_BITS) - 1)
+ 			u32 in_flight:20,   /* packets in flight at transmit */
+ 			    unused2:12;
++			u32 lost;	/* packets lost so far upon tx of skb */
+ 		} tx;   /* only used for outgoing skbs */
+ 		union {
+ 			struct inet_skb_parm	h4;
+@@ -1138,11 +1139,13 @@ struct ack_sample {
+  */
+ struct rate_sample {
+ 	u64  prior_mstamp; /* starting timestamp for interval */
++	u32  prior_lost;	/* tp->lost at "prior_mstamp" */
+ 	u32  prior_delivered;	/* tp->delivered at "prior_mstamp" */
+ 	u32  prior_delivered_ce;/* tp->delivered_ce at "prior_mstamp" */
+ 	u32 tx_in_flight;	/* packets in flight at starting timestamp */
++	s32  lost;		/* number of packets lost over interval */
+ 	s32  delivered;		/* number of packets delivered over interval */
+-	s32  delivered_ce;	/* number of packets delivered w/ CE marks*/
++	s32  delivered_ce;	/* packets delivered w/ CE mark over interval */
+ 	long interval_us;	/* time for tp->delivered to incr "delivered" */
+ 	u32 snd_interval_us;	/* snd interval for delivered packets */
+ 	u32 rcv_interval_us;	/* rcv interval for delivered packets */
+--- a/net/ipv4/tcp_rate.c
++++ b/net/ipv4/tcp_rate.c
+@@ -84,6 +84,7 @@ void tcp_rate_skb_sent(struct sock *sk,
+ 	TCP_SKB_CB(skb)->tx.delivered_mstamp	= tp->delivered_mstamp;
+ 	TCP_SKB_CB(skb)->tx.delivered		= tp->delivered;
+ 	TCP_SKB_CB(skb)->tx.delivered_ce	= tp->delivered_ce;
++	TCP_SKB_CB(skb)->tx.lost		= tp->lost;
+ 	TCP_SKB_CB(skb)->tx.is_app_limited	= tp->app_limited ? 1 : 0;
+ 	tcp_set_tx_in_flight(sk, skb);
+ }
+@@ -110,6 +111,7 @@ void tcp_rate_skb_delivered(struct sock
+ 	if (!rs->prior_delivered ||
+ 	    tcp_skb_sent_after(tx_tstamp, tp->first_tx_mstamp,
+ 			       scb->end_seq, rs->last_end_seq)) {
++		rs->prior_lost	     = scb->tx.lost;
+ 		rs->prior_delivered_ce  = scb->tx.delivered_ce;
+ 		rs->prior_delivered  = scb->tx.delivered;
+ 		rs->prior_mstamp     = scb->tx.delivered_mstamp;
+@@ -165,6 +167,7 @@ void tcp_rate_gen(struct sock *sk, u32 d
+ 		return;
+ 	}
+ 	rs->delivered   = tp->delivered - rs->prior_delivered;
++	rs->lost        = tp->lost - rs->prior_lost;
+ 
+ 	rs->delivered_ce = tp->delivered_ce - rs->prior_delivered_ce;
+ 	/* delivered_ce occupies less than 32 bits in the skb control block */
+From 27fa5566204ef20bb34b2e5b68a7f6807afce447 Mon Sep 17 00:00:00 2001
+From: Neal Cardwell <ncardwell@google.com>
+Date: Mon, 19 Nov 2018 13:48:36 -0500
+Subject: [PATCH 05/19] net-tcp_bbr: v2: export FLAG_ECE in rate_sample.is_ece
+
+For understanding the relationship between inflight and ECN signals,
+to try to find the highest inflight value that has acceptable levels
+ECN marking.
+
+Effort: net-tcp_bbr
+Origin-9xx-SHA1: 3eba998f2898541406c2666781182200934965a8
+Change-Id: I3a964e04cee83e11649a54507043d2dfe769a3b3
+Signed-off-by: Alexandre Frade <kernel@xanmod.org>
+---
+ include/net/tcp.h    | 1 +
+ net/ipv4/tcp_input.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1157,6 +1157,7 @@ struct rate_sample {
+ 	bool is_app_limited;	/* is sample from packet with bubble in pipe? */
+ 	bool is_retrans;	/* is sample from retransmission? */
+ 	bool is_ack_delayed;	/* is this (likely) a delayed ACK? */
++	bool is_ece;		/* did this ACK have ECN marked? */
+ };
+ 
+ struct tcp_congestion_ops {
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -4033,6 +4033,7 @@ static int tcp_ack(struct sock *sk, cons
+ 	delivered = tcp_newly_delivered(sk, delivered, flag);
+ 	lost = tp->lost - lost;			/* freshly marked lost */
+ 	rs.is_ack_delayed = !!(flag & FLAG_ACK_MAYBE_DELAYED);
++	rs.is_ece = !!(flag & FLAG_ECE);
+ 	tcp_rate_gen(sk, delivered, lost, is_sack_reneg, sack_state.rate);
+ 	tcp_cong_control(sk, ack, delivered, flag, sack_state.rate);
+ 	tcp_xmit_recovery(sk, rexmit);
+From c083bc8abfefbee48922f6ff7976020abc71253f Mon Sep 17 00:00:00 2001
+From: Neal Cardwell <ncardwell@google.com>
+Date: Tue, 7 Aug 2018 21:52:06 -0400
+Subject: [PATCH 06/19] net-tcp_bbr: v2: introduce ca_ops->skb_marked_lost() CC
+ module callback API
+
+For connections experiencing reordering, RACK can mark packets lost
+long after we receive the SACKs/ACKs hinting that the packets were
+actually lost.
+
+This means that CC modules cannot easily learn the volume of inflight
+data at which packet loss happens by looking at the current inflight
+or even the packets in flight when the most recently SACKed packet was
+sent. To learn this, CC modules need to know how many packets were in
+flight at the time lost packets were sent. This new callback, combined
+with TCP_SKB_CB(skb)->tx.in_flight, allows them to learn this.
+
+This also provides a consistent callback that is invoked whether
+packets are marked lost upon ACK processing, using the RACK reordering
+timer, or at RTO time.
+
+Effort: net-tcp_bbr
+Origin-9xx-SHA1: afcbebe3374e4632ac6714d39e4dc8a8455956f4
+Change-Id: I54826ab53df636be537e5d3c618a46145d12d51a
+Signed-off-by: Alexandre Frade <kernel@xanmod.org>
+---
+ include/net/tcp.h    | 3 +++
+ net/ipv4/tcp_input.c | 5 +++++
+ 2 files changed, 8 insertions(+)
+
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1184,6 +1184,9 @@ struct tcp_congestion_ops {
+ 	/* override sysctl_tcp_min_tso_segs */
+ 	u32 (*min_tso_segs)(struct sock *sk);
+ 
++	/* react to a specific lost skb (optional) */
++	void (*skb_marked_lost)(struct sock *sk, const struct sk_buff *skb);
++
+ 	/* call when packets are delivered to update cwnd and pacing rate,
+ 	 * after all the ca_state processing. (optional)
+ 	 */
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -1120,7 +1120,12 @@ static void tcp_verify_retransmit_hint(s
+  */
+ static void tcp_notify_skb_loss_event(struct tcp_sock *tp, const struct sk_buff *skb)
+ {
++	struct sock *sk = (struct sock *)tp;
++	const struct tcp_congestion_ops *ca_ops = inet_csk(sk)->icsk_ca_ops;
++
+ 	tp->lost += tcp_skb_pcount(skb);
++	if (ca_ops->skb_marked_lost)
++		ca_ops->skb_marked_lost(sk, skb);
+ }
+ 
+ void tcp_mark_skb_lost(struct sock *sk, struct sk_buff *skb)
+From 74522518932db459e21108dede9f1354cc2bb6b8 Mon Sep 17 00:00:00 2001
+From: Neal Cardwell <ncardwell@google.com>
+Date: Wed, 1 May 2019 20:16:33 -0400
+Subject: [PATCH 07/19] net-tcp_bbr: v2: adjust skb tx.in_flight upon merge in
+ tcp_shifted_skb()
+
+When tcp_shifted_skb() updates state as adjacent SACKed skbs are
+coalesced, previously the tx.in_flight was not adjusted, so we could
+get contradictory state where the skb's recorded pcount was bigger
+than the tx.in_flight (the number of segments that were in_flight
+after sending the skb).
+
+Normally have a SACKed skb with contradictory pcount/tx.in_flight
+would not matter. However, with SACK reneging, the SACKed bit is
+removed, and an skb once again becomes eligible for retransmitting,
+fragmenting, SACKing, etc. Packetdrill testing verified the following
+sequence is possible in a kernel that does not have this commit:
+
+ - skb N is SACKed
+ - skb N+1 is SACKed and combined with skb N using tcp_shifted_skb()
+   - tcp_shifted_skb() will increase the pcount of prev,
+     but leave tx.in_flight as-is
+   - so prev skb can have pcount > tx.in_flight
+ - RTO, tcp_timeout_mark_lost(), detect reneg,
+   remove "SACKed" bit, mark skb N as lost
+   - find pcount of skb N is greater than its tx.in_flight
+
+I suspect this issue iw what caused the bbr2_inflight_hi_from_lost_skb():
+  WARN_ON_ONCE(inflight_prev < 0)
+to fire in production machines using bbr2.
+
+Effort: net-tcp_bbr
+Origin-9xx-SHA1: 1a3e997e613d2dcf32b947992882854ebe873715
+Change-Id: I1b0b75c27519953430c7db51c6f358f104c7af55
+Signed-off-by: Alexandre Frade <kernel@xanmod.org>
+---
+ net/ipv4/tcp_input.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -1506,6 +1506,17 @@ static bool tcp_shifted_skb(struct sock
+ 	WARN_ON_ONCE(tcp_skb_pcount(skb) < pcount);
+ 	tcp_skb_pcount_add(skb, -pcount);
+ 
++	/* Adjust tx.in_flight as pcount is shifted from skb to prev. */
++	if (WARN_ONCE(TCP_SKB_CB(skb)->tx.in_flight < pcount,
++		      "prev in_flight: %u skb in_flight: %u pcount: %u",
++		      TCP_SKB_CB(prev)->tx.in_flight,
++		      TCP_SKB_CB(skb)->tx.in_flight,
++		      pcount))
++		TCP_SKB_CB(skb)->tx.in_flight = 0;
++	else
++		TCP_SKB_CB(skb)->tx.in_flight -= pcount;
++	TCP_SKB_CB(prev)->tx.in_flight += pcount;
++
+ 	/* When we're adding to gso_segs == 1, gso_size will be zero,
+ 	 * in theory this shouldn't be necessary but as long as DSACK
+ 	 * code can come after this skb later on it's better to keep
+From f64cb2d65d9412d32ae5e5261d2bd1ca650f8e8c Mon Sep 17 00:00:00 2001
+From: Neal Cardwell <ncardwell@google.com>
+Date: Wed, 1 May 2019 20:16:25 -0400
+Subject: [PATCH 08/19] net-tcp_bbr: v2: adjust skb tx.in_flight upon split in
+ tcp_fragment()
+
+When we fragment an skb that has already been sent, we need to update
+the tx.in_flight for the first skb in the resulting pair ("buff").
+
+Because we were not updating the tx.in_flight, the tx.in_flight value
+was inconsistent with the pcount of the "buff" skb (tx.in_flight would
+be too high). That meant that if the "buff" skb was lost, then
+bbr2_inflight_hi_from_lost_skb() would calculate an inflight_hi value
+that is too high. This could result in longer queues and higher packet
+loss.
+
+Packetdrill testing verified that without this commit, when the second
+half of an skb is SACKed and then later the first half of that skb is
+marked lost, the calculated inflight_hi was incorrect.
+
+Effort: net-tcp_bbr
+Origin-9xx-SHA1: 385f1ddc610798fab2837f9f372857438b25f874
+Origin-9xx-SHA1: a0eb099690af net-tcp_bbr: v2: fix tcp_fragment() tx.in_flight recomputation [prod feb 8 2021; use as a fixup]
+Origin-9xx-SHA1: 885503228153ff0c9114e net-tcp_bbr: v2: introduce tcp_skb_tx_in_flight_is_suspicious() helper for warnings
+Change-Id: I617f8cab4e9be7a0b8e8d30b047bf8645393354d
+Signed-off-by: Alexandre Frade <kernel@xanmod.org>
+---
+ include/net/tcp.h     | 15 +++++++++++++++
+ net/ipv4/tcp_output.c | 26 +++++++++++++++++++++++++-
+ 2 files changed, 40 insertions(+), 1 deletion(-)
+
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1283,6 +1283,21 @@ static inline bool tcp_skb_sent_after(u6
+ 	return t1 > t2 || (t1 == t2 && after(seq1, seq2));
+ }
+ 
++/* If a retransmit failed due to local qdisc congestion or other local issues,
++ * then we may have called tcp_set_skb_tso_segs() to increase the number of
++ * segments in the skb without increasing the tx.in_flight. In all other cases,
++ * the tx.in_flight should be at least as big as the pcount of the sk_buff.  We
++ * do not have the state to know whether a retransmit failed due to local qdisc
++ * congestion or other local issues, so to avoid spurious warnings we consider
++ * that any skb marked lost may have suffered that fate.
++ */
++static inline bool tcp_skb_tx_in_flight_is_suspicious(u32 skb_pcount,
++						      u32 skb_sacked_flags,
++						      u32 tx_in_flight)
++{
++	return (skb_pcount > tx_in_flight) && !(skb_sacked_flags & TCPCB_LOST);
++}
++
+ /* These functions determine how the current flow behaves in respect of SACK
+  * handling. SACK is negotiated with the peer, and therefore it can vary
+  * between different flows.
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1601,7 +1601,7 @@ int tcp_fragment(struct sock *sk, enum t
+ {
+ 	struct tcp_sock *tp = tcp_sk(sk);
+ 	struct sk_buff *buff;
+-	int old_factor;
++	int old_factor, inflight_prev;
+ 	long limit;
+ 	int nlen;
+ 	u8 flags;
+@@ -1676,6 +1676,30 @@ int tcp_fragment(struct sock *sk, enum t
+ 
+ 		if (diff)
+ 			tcp_adjust_pcount(sk, skb, diff);
++
++		inflight_prev = TCP_SKB_CB(skb)->tx.in_flight - old_factor;
++		if (inflight_prev < 0) {
++			WARN_ONCE(tcp_skb_tx_in_flight_is_suspicious(
++					  old_factor,
++					  TCP_SKB_CB(skb)->sacked,
++					  TCP_SKB_CB(skb)->tx.in_flight),
++				  "inconsistent: tx.in_flight: %u "
++				  "old_factor: %d mss: %u sacked: %u "
++				  "1st pcount: %d 2nd pcount: %d "
++				  "1st len: %u 2nd len: %u ",
++				  TCP_SKB_CB(skb)->tx.in_flight, old_factor,
++				  mss_now, TCP_SKB_CB(skb)->sacked,
++				  tcp_skb_pcount(skb), tcp_skb_pcount(buff),
++				  skb->len, buff->len);
++			inflight_prev = 0;
++		}
++		/* Set 1st tx.in_flight as if 1st were sent by itself: */
++		TCP_SKB_CB(skb)->tx.in_flight = inflight_prev +
++						 tcp_skb_pcount(skb);
++		/* Set 2nd tx.in_flight with new 1st and 2nd pcounts: */
++		TCP_SKB_CB(buff)->tx.in_flight = inflight_prev +
++						 tcp_skb_pcount(skb) +
++						 tcp_skb_pcount(buff);
+ 	}
+ 
+ 	/* Link BUFF into the send queue. */
+From d39a6429c0ec67f51478737f7a13f6295ca8b3c0 Mon Sep 17 00:00:00 2001
+From: Yousuk Seung <ysseung@google.com>
+Date: Wed, 23 May 2018 17:55:54 -0700
+Subject: [PATCH 09/19] net-tcp: add new ca opts flag TCP_CONG_WANTS_CE_EVENTS
+
+Add a a new ca opts flag TCP_CONG_WANTS_CE_EVENTS that allows a
+congestion control module to receive CE events.
+
+Currently congestion control modules have to set the TCP_CONG_NEEDS_ECN
+bit in opts flag to receive CE events but this may incur changes in ECN
+behavior elsewhere. This patch adds a new bit TCP_CONG_WANTS_CE_EVENTS
+that allows congestion control modules to receive CE events
+independently of TCP_CONG_NEEDS_ECN.
+
+Effort: net-tcp
+Origin-9xx-SHA1: 9f7e14716cde760bc6c67ef8ef7e1ee48501d95b
+Change-Id: I2255506985242f376d910c6fd37daabaf4744f24
+Signed-off-by: Alexandre Frade <kernel@xanmod.org>
+---
+ include/net/tcp.h    | 14 +++++++++++++-
+ net/ipv4/tcp_input.c |  4 ++--
+ 2 files changed, 15 insertions(+), 3 deletions(-)
+
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1119,7 +1119,11 @@ enum tcp_ca_ack_event_flags {
+ #define TCP_CONG_NON_RESTRICTED 0x1
+ /* Requires ECN/ECT set on all packets */
+ #define TCP_CONG_NEEDS_ECN	0x2
+-#define TCP_CONG_MASK	(TCP_CONG_NON_RESTRICTED | TCP_CONG_NEEDS_ECN)
++/* Wants notification of CE events (CA_EVENT_ECN_IS_CE, CA_EVENT_ECN_NO_CE). */
++#define TCP_CONG_WANTS_CE_EVENTS	0x4
++#define TCP_CONG_MASK	(TCP_CONG_NON_RESTRICTED | \
++			 TCP_CONG_NEEDS_ECN | \
++			 TCP_CONG_WANTS_CE_EVENTS)
+ 
+ union tcp_cc_info;
+ 
+@@ -1251,6 +1255,14 @@ static inline char *tcp_ca_get_name_by_k
+ }
+ #endif
+ 
++static inline bool tcp_ca_wants_ce_events(const struct sock *sk)
++{
++	const struct inet_connection_sock *icsk = inet_csk(sk);
++
++	return icsk->icsk_ca_ops->flags & (TCP_CONG_NEEDS_ECN |
++					   TCP_CONG_WANTS_CE_EVENTS);
++}
++
+ static inline bool tcp_ca_needs_ecn(const struct sock *sk)
+ {
+ 	const struct inet_connection_sock *icsk = inet_csk(sk);
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -370,7 +370,7 @@ static void __tcp_ecn_check_ce(struct so
+ 			tcp_enter_quickack_mode(sk, 2);
+ 		break;
+ 	case INET_ECN_CE:
+-		if (tcp_ca_needs_ecn(sk))
++		if (tcp_ca_wants_ce_events(sk))
+ 			tcp_ca_event(sk, CA_EVENT_ECN_IS_CE);
+ 
+ 		if (!(tp->ecn_flags & TCP_ECN_DEMAND_CWR)) {
+@@ -381,7 +381,7 @@ static void __tcp_ecn_check_ce(struct so
+ 		tp->ecn_flags |= TCP_ECN_SEEN;
+ 		break;
+ 	default:
+-		if (tcp_ca_needs_ecn(sk))
++		if (tcp_ca_wants_ce_events(sk))
+ 			tcp_ca_event(sk, CA_EVENT_ECN_NO_CE);
+ 		tp->ecn_flags |= TCP_ECN_SEEN;
+ 		break;
+From 8b64cdb009d7624b4a233a89e510e3a92fee9e71 Mon Sep 17 00:00:00 2001
+From: Neal Cardwell <ncardwell@google.com>
+Date: Fri, 27 Sep 2019 17:10:26 -0400
+Subject: [PATCH 10/19] net-tcp: re-generalize TSO sizing in TCP CC module API
+
+Reorganize the API for CC modules so that the CC module once again
+gets complete control of the TSO sizing decision. This is how the API
+was set up around 2016 and the initial BBRv1 upstreaming. Later Eric
+Dumazet simplified it. But with wider testing it now seems that to
+avoid CPU regressions BBR needs to have a different TSO sizing
+function.
+
+This is necessary to handle cases where there are many flows
+bottlenecked on the sender host's NIC, in which case BBR's pacing rate
+is much lower than CUBIC/Reno/DCTCP's. Why does this happen? Because
+BBR's pacing rate adapts to the low bandwidth share each flow sees. By
+contrast, CUBIC/Reno/DCTCP see no loss or ECN, so they grow a very
+large cwnd, and thus large pacing rate and large TSO burst size.
+
+Change-Id: Ic8ccfdbe4010ee8d4bf6a6334c48a2fceb2171ea
+Signed-off-by: Alexandre Frade <kernel@xanmod.org>
+---
+ include/net/tcp.h     |  4 ++--
+ net/ipv4/tcp_bbr.c    | 37 ++++++++++++++++++++++++++-----------
+ net/ipv4/tcp_output.c | 11 +++++------
+ 3 files changed, 33 insertions(+), 19 deletions(-)
+
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1185,8 +1185,8 @@ struct tcp_congestion_ops {
+ 	/* hook for packet ack accounting (optional) */
+ 	void (*pkts_acked)(struct sock *sk, const struct ack_sample *sample);
+ 
+-	/* override sysctl_tcp_min_tso_segs */
+-	u32 (*min_tso_segs)(struct sock *sk);
++	/* pick target number of segments per TSO/GSO skb (optional): */
++	u32 (*tso_segs)(struct sock *sk, unsigned int mss_now);
+ 
+ 	/* react to a specific lost skb (optional) */
+ 	void (*skb_marked_lost)(struct sock *sk, const struct sk_buff *skb);
+--- a/net/ipv4/tcp_bbr.c
++++ b/net/ipv4/tcp_bbr.c
+@@ -301,20 +301,35 @@ __bpf_kfunc static u32 bbr_min_tso_segs(
+ 	return READ_ONCE(sk->sk_pacing_rate) < (bbr_min_tso_rate >> 3) ? 1 : 2;
+ }
+ 
++/* Return the number of segments BBR would like in a TSO/GSO skb, given
++ * a particular max gso size as a constraint.
++ */
++static u32 bbr_tso_segs_generic(struct sock *sk, unsigned int mss_now,
++				u32 gso_max_size)
++{
++	u32 segs;
++	u64 bytes;
++
++	/* Budget a TSO/GSO burst size allowance based on bw (pacing_rate). */
++	bytes = READ_ONCE(sk->sk_pacing_rate) >> READ_ONCE(sk->sk_pacing_shift);
++
++	bytes = min_t(u32, bytes, gso_max_size - 1 - MAX_TCP_HEADER);
++	segs = max_t(u32, bytes / mss_now, bbr_min_tso_segs(sk));
++	return segs;
++}
++
++/* Custom tcp_tso_autosize() for BBR, used at transmit time to cap skb size. */
++static u32  bbr_tso_segs(struct sock *sk, unsigned int mss_now)
++{
++	return bbr_tso_segs_generic(sk, mss_now, sk->sk_gso_max_size);
++}
++
++/* Like bbr_tso_segs(), using mss_cache, ignoring driver's sk_gso_max_size. */
+ static u32 bbr_tso_segs_goal(struct sock *sk)
+ {
+ 	struct tcp_sock *tp = tcp_sk(sk);
+-	u32 segs, bytes;
+-
+-	/* Sort of tcp_tso_autosize() but ignoring
+-	 * driver provided sk_gso_max_size.
+-	 */
+-	bytes = min_t(unsigned long,
+-		      READ_ONCE(sk->sk_pacing_rate) >> READ_ONCE(sk->sk_pacing_shift),
+-		      GSO_LEGACY_MAX_SIZE - 1 - MAX_TCP_HEADER);
+-	segs = max_t(u32, bytes / tp->mss_cache, bbr_min_tso_segs(sk));
+ 
+-	return min(segs, 0x7FU);
++	return bbr_tso_segs_generic(sk, tp->mss_cache, GSO_MAX_SIZE);
+ }
+ 
+ /* Save "last known good" cwnd so we can restore it after losses or PROBE_RTT */
+@@ -1150,7 +1165,7 @@ static struct tcp_congestion_ops tcp_bbr
+ 	.undo_cwnd	= bbr_undo_cwnd,
+ 	.cwnd_event	= bbr_cwnd_event,
+ 	.ssthresh	= bbr_ssthresh,
+-	.min_tso_segs	= bbr_min_tso_segs,
++	.tso_segs	= bbr_tso_segs,
+ 	.get_info	= bbr_get_info,
+ 	.set_state	= bbr_set_state,
+ };
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2057,13 +2057,12 @@ static u32 tcp_tso_autosize(const struct
+ static u32 tcp_tso_segs(struct sock *sk, unsigned int mss_now)
+ {
+ 	const struct tcp_congestion_ops *ca_ops = inet_csk(sk)->icsk_ca_ops;
+-	u32 min_tso, tso_segs;
++	u32 tso_segs;
+ 
+-	min_tso = ca_ops->min_tso_segs ?
+-			ca_ops->min_tso_segs(sk) :
+-			READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs);
+-
+-	tso_segs = tcp_tso_autosize(sk, mss_now, min_tso);
++	tso_segs = ca_ops->tso_segs ?
++		ca_ops->tso_segs(sk, mss_now) :
++		tcp_tso_autosize(sk, mss_now,
++				 sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs);
+ 	return min_t(u32, tso_segs, sk->sk_gso_max_segs);
+ }
+ 
+From 0ff8136eeca5fb038fdef3d8342838785df28685 Mon Sep 17 00:00:00 2001
+From: Neal Cardwell <ncardwell@google.com>
+Date: Sun, 7 Jan 2024 21:11:26 -0300
+Subject: [PATCH 11/19] net-tcp: add fast_ack_mode=1: skip rwin check in
+ tcp_fast_ack_mode__tcp_ack_snd_check()
+
+Add logic for an experimental TCP connection behavior, enabled with
+tp->fast_ack_mode = 1, which disables checking the receive window
+before sending an ack in __tcp_ack_snd_check(). If this behavior is
+enabled, the data receiver sends an ACK if the amount of data is >
+RCV.MSS.
+
+Change-Id: Iaa0a0fd7108221f883137a79d5bfa724f1b096d4
+Signed-off-by: Alexandre Frade <kernel@xanmod.org>
+---
+ include/linux/tcp.h  | 3 ++-
+ net/ipv4/tcp.c       | 1 +
+ net/ipv4/tcp_cong.c  | 1 +
+ net/ipv4/tcp_input.c | 5 +++--
+ 4 files changed, 7 insertions(+), 3 deletions(-)
+
+--- a/include/linux/tcp.h
++++ b/include/linux/tcp.h
+@@ -369,7 +369,8 @@ struct tcp_sock {
+ 	u8	compressed_ack;
+ 	u8	dup_ack_counter:2,
+ 		tlp_retrans:1,	/* TLP is a retransmission */
+-		unused:5;
++		fast_ack_mode:2, /* which fast ack mode ? */
++		unused:3;
+ 	u8	thin_lto    : 1,/* Use linear timeouts for thin streams */
+ 		fastopen_connect:1, /* FASTOPEN_CONNECT sockopt */
+ 		fastopen_no_cookie:1, /* Allow send/recv SYN+data without a cookie */
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -3123,6 +3123,7 @@ int tcp_disconnect(struct sock *sk, int
+ 	tp->rx_opt.dsack = 0;
+ 	tp->rx_opt.num_sacks = 0;
+ 	tp->rcv_ooopack = 0;
++	tp->fast_ack_mode = 0;
+ 
+ 
+ 	/* Clean up fastopen related fields */
+--- a/net/ipv4/tcp_cong.c
++++ b/net/ipv4/tcp_cong.c
+@@ -237,6 +237,7 @@ void tcp_init_congestion_control(struct
+ 	struct inet_connection_sock *icsk = inet_csk(sk);
+ 
+ 	tcp_sk(sk)->prior_ssthresh = 0;
++	tcp_sk(sk)->fast_ack_mode = 0;
+ 	if (icsk->icsk_ca_ops->init)
+ 		icsk->icsk_ca_ops->init(sk);
+ 	if (tcp_ca_needs_ecn(sk))
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -5736,13 +5736,14 @@ static void __tcp_ack_snd_check(struct s
+ 
+ 	    /* More than one full frame received... */
+ 	if (((tp->rcv_nxt - tp->rcv_wup) > inet_csk(sk)->icsk_ack.rcv_mss &&
++	     (tp->fast_ack_mode == 1 ||
+ 	     /* ... and right edge of window advances far enough.
+ 	      * (tcp_recvmsg() will send ACK otherwise).
+ 	      * If application uses SO_RCVLOWAT, we want send ack now if
+ 	      * we have not received enough bytes to satisfy the condition.
+ 	      */
+-	    (tp->rcv_nxt - tp->copied_seq < sk->sk_rcvlowat ||
+-	     __tcp_select_window(sk) >= tp->rcv_wnd)) ||
++	      (tp->rcv_nxt - tp->copied_seq < sk->sk_rcvlowat ||
++	       __tcp_select_window(sk) >= tp->rcv_wnd))) ||
+ 	    /* We ACK each frame or... */
+ 	    tcp_in_quickack_mode(sk) ||
+ 	    /* Protocol state mandates a one-time immediate ACK */
+From 399c324888acd78cd0cac5407e2dc27bb2225ba0 Mon Sep 17 00:00:00 2001
+From: Jianfeng Wang <jfwang@google.com>
+Date: Fri, 19 Jun 2020 17:33:45 +0000
+Subject: [PATCH 12/19] net-tcp_bbr: v2: record app-limited status of
+ TLP-repaired flight
+
+When sending a TLP retransmit, record whether the outstanding flight
+of data is application limited. This is important for congestion
+control modules that want to respond to losses repaired by TLP
+retransmits. This is important because the following scenarios convey
+very different information:
+ (1) a packet loss with a small number of packets in flight;
+ (2) a packet loss with the maximum amount of data in flight allowed
+     by the CC module;
+
+Effort: net-tcp_bbr
+Change-Id: Ic8ae567caa4e4bfd5fd82c3d4be12a5d9171655e
+Signed-off-by: Alexandre Frade <kernel@xanmod.org>
+---
+ include/linux/tcp.h   | 3 ++-
+ net/ipv4/tcp_output.c | 1 +
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+--- a/include/linux/tcp.h
++++ b/include/linux/tcp.h
+@@ -370,7 +370,8 @@ struct tcp_sock {
+ 	u8	dup_ack_counter:2,
+ 		tlp_retrans:1,	/* TLP is a retransmission */
+ 		fast_ack_mode:2, /* which fast ack mode ? */
+-		unused:3;
++		tlp_orig_data_app_limited:1, /* app-limited before TLP rtx? */
++		unused:2;
+ 	u8	thin_lto    : 1,/* Use linear timeouts for thin streams */
+ 		fastopen_connect:1, /* FASTOPEN_CONNECT sockopt */
+ 		fastopen_no_cookie:1, /* Allow send/recv SYN+data without a cookie */
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -3005,6 +3005,7 @@ void tcp_send_loss_probe(struct sock *sk
+ 	if (WARN_ON(!skb || !tcp_skb_pcount(skb)))
+ 		goto rearm_timer;
+ 
++	tp->tlp_orig_data_app_limited = TCP_SKB_CB(skb)->tx.is_app_limited;
+ 	if (__tcp_retransmit_skb(sk, skb, 1))
+ 		goto rearm_timer;
+ 
+From 43e59a05c78564807876ae8529c71b261e8cceff Mon Sep 17 00:00:00 2001
+From: Jianfeng Wang <jfwang@google.com>
+Date: Tue, 16 Jun 2020 17:41:19 +0000
+Subject: [PATCH 13/19] net-tcp_bbr: v2: inform CC module of losses repaired by
+ TLP probe
+
+Before this commit, when there is a packet loss that creates a sequence
+hole that is filled by a TLP loss probe, then tcp_process_tlp_ack()
+only informs the congestion control (CC) module via a back-to-back entry
+and exit of CWR. But some congestion control modules (e.g. BBR) do not
+respond to CWR events.
+
+This commit adds a new CA event with which the core TCP stack notifies
+the CC module when a loss is repaired by a TLP. This will allow CC
+modules that do not use the CWR mechanism to have a custom handler for
+such TLP recoveries.
+
+Effort: net-tcp_bbr
+Change-Id: Ieba72332b401b329bff5a641d2b2043a3fb8f632
+Signed-off-by: Alexandre Frade <kernel@xanmod.org>
+---
+ include/net/tcp.h    | 1 +
+ net/ipv4/tcp_input.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1097,6 +1097,7 @@ enum tcp_ca_event {
+ 	CA_EVENT_LOSS,		/* loss timeout */
+ 	CA_EVENT_ECN_NO_CE,	/* ECT set, but not CE marked */
+ 	CA_EVENT_ECN_IS_CE,	/* received CE marked IP packet */
++	CA_EVENT_TLP_RECOVERY,	/* a lost segment was repaired by TLP probe */
+ };
+ 
+ /* Information about inbound ACK, passed to cong_ops->in_ack_event() */
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -3832,6 +3832,7 @@ static void tcp_process_tlp_ack(struct s
+ 		/* ACK advances: there was a loss, so reduce cwnd. Reset
+ 		 * tlp_high_seq in tcp_init_cwnd_reduction()
+ 		 */
++		tcp_ca_event(sk, CA_EVENT_TLP_RECOVERY);
+ 		tcp_init_cwnd_reduction(sk);
+ 		tcp_set_ca_state(sk, TCP_CA_CWR);
+ 		tcp_end_cwnd_reduction(sk);
+From e8c17561fd4afb5966cb8e434375c26dd80e876b Mon Sep 17 00:00:00 2001
+From: Neal Cardwell <ncardwell@google.com>
+Date: Mon, 21 Sep 2020 14:46:26 -0400
+Subject: [PATCH 14/19] net-tcp_bbr: v2: introduce is_acking_tlp_retrans_seq
+ into rate_sample
+
+Introduce is_acking_tlp_retrans_seq into rate_sample. This bool will
+export to the CC module the knowledge of whether the current ACK
+matched a TLP retransmit.
+
+Note that when this bool is true, we cannot yet tell (in general) whether
+this ACK is for the original or the TLP retransmit.
+
+Effort: net-tcp_bbr
+Change-Id: I2e6494332167e75efcbdc99bd5c119034e9c39b4
+Signed-off-by: Alexandre Frade <kernel@xanmod.org>
+---
+ include/net/tcp.h    |  1 +
+ net/ipv4/tcp_input.c | 12 +++++++++---
+ 2 files changed, 10 insertions(+), 3 deletions(-)
+
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1161,6 +1161,7 @@ struct rate_sample {
+ 	u32  last_end_seq;	/* end_seq of most recently ACKed packet */
+ 	bool is_app_limited;	/* is sample from packet with bubble in pipe? */
+ 	bool is_retrans;	/* is sample from retransmission? */
++	bool is_acking_tlp_retrans_seq;  /* ACKed a TLP retransmit sequence? */
+ 	bool is_ack_delayed;	/* is this (likely) a delayed ACK? */
+ 	bool is_ece;		/* did this ACK have ECN marked? */
+ };
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -3815,7 +3815,8 @@ static void tcp_replace_ts_recent(struct
+ /* This routine deals with acks during a TLP episode and ends an episode by
+  * resetting tlp_high_seq. Ref: TLP algorithm in draft-ietf-tcpm-rack
+  */
+-static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag)
++static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag,
++				struct rate_sample *rs)
+ {
+ 	struct tcp_sock *tp = tcp_sk(sk);
+ 
+@@ -3843,6 +3844,11 @@ static void tcp_process_tlp_ack(struct s
+ 			     FLAG_NOT_DUP | FLAG_DATA_SACKED))) {
+ 		/* Pure dupack: original and TLP probe arrived; no loss */
+ 		tp->tlp_high_seq = 0;
++	} else {
++		/* This ACK matches a TLP retransmit. We cannot yet tell if
++		 * this ACK is for the original or the TLP retransmit.
++		 */
++		rs->is_acking_tlp_retrans_seq = 1;
+ 	}
+ }
+ 
+@@ -4026,7 +4032,7 @@ static int tcp_ack(struct sock *sk, cons
+ 	tcp_rack_update_reo_wnd(sk, &rs);
+ 
+ 	if (tp->tlp_high_seq)
+-		tcp_process_tlp_ack(sk, ack, flag);
++		tcp_process_tlp_ack(sk, ack, flag, &rs);
+ 
+ 	if (tcp_ack_is_dubious(sk, flag)) {
+ 		if (!(flag & (FLAG_SND_UNA_ADVANCED |
+@@ -4070,7 +4076,7 @@ no_queue:
+ 	tcp_ack_probe(sk);
+ 
+ 	if (tp->tlp_high_seq)
+-		tcp_process_tlp_ack(sk, ack, flag);
++		tcp_process_tlp_ack(sk, ack, flag, &rs);
+ 	return 1;
+ 
+ old_ack:
+From 55d8a135e42feec3aa24d2aac411fb658374532f Mon Sep 17 00:00:00 2001
+From: David Morley <morleyd@google.com>
+Date: Fri, 14 Jul 2023 11:07:56 -0400
+Subject: [PATCH 15/19] tcp: introduce per-route feature RTAX_FEATURE_ECN_LOW
+
+Define and implement a new per-route feature, RTAX_FEATURE_ECN_LOW.
+
+This feature indicates that the given destination network is a
+low-latency ECN environment, meaning both that ECN CE marks are
+applied by the network using a low-latency marking threshold and also
+that TCP endpoints provide precise per-data-segment ECN feedback in
+ACKs (where the ACK ECE flag echoes the received CE status of all
+newly-acknowledged data segments). This feature indication can be used
+by congestion control algorithms to decide how to interpret ECN
+signals over the given destination network.
+
+This feature is appropriate for datacenter-style ECN marking, such as
+the ECN marking approach expected by DCTCP or BBR congestion control
+modules.
+
+Signed-off-by: David Morley <morleyd@google.com>
+Signed-off-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: Yuchung Cheng <ycheng@google.com>
+Tested-by: David Morley <morleyd@google.com>
+Change-Id: I6bc06e9c6cb426fbae7243fc71c9a8c18175f5d3
+Signed-off-by: Alexandre Frade <kernel@xanmod.org>
+---
+ include/net/tcp.h              | 10 ++++++++++
+ include/uapi/linux/rtnetlink.h |  4 +++-
+ net/ipv4/tcp_minisocks.c       |  2 ++
+ net/ipv4/tcp_output.c          |  6 ++++--
+ 4 files changed, 19 insertions(+), 3 deletions(-)
+
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -375,6 +375,7 @@ static inline void tcp_dec_quickack_mode
+ #define	TCP_ECN_QUEUE_CWR	2
+ #define	TCP_ECN_DEMAND_CWR	4
+ #define	TCP_ECN_SEEN		8
++#define	TCP_ECN_LOW		16
+ 
+ enum tcp_tw_status {
+ 	TCP_TW_SUCCESS = 0,
+@@ -777,6 +778,15 @@ static inline void tcp_fast_path_check(s
+ 		tcp_fast_path_on(tp);
+ }
+ 
++static inline void tcp_set_ecn_low_from_dst(struct sock *sk,
++					    const struct dst_entry *dst)
++{
++	struct tcp_sock *tp = tcp_sk(sk);
++
++	if (dst_feature(dst, RTAX_FEATURE_ECN_LOW))
++		tp->ecn_flags |= TCP_ECN_LOW;
++}
++
+ u32 tcp_delack_max(const struct sock *sk);
+ 
+ /* Compute the actual rto_min value */
+--- a/include/uapi/linux/rtnetlink.h
++++ b/include/uapi/linux/rtnetlink.h
+@@ -507,12 +507,14 @@ enum {
+ #define RTAX_FEATURE_TIMESTAMP		(1 << 2) /* unused */
+ #define RTAX_FEATURE_ALLFRAG		(1 << 3) /* unused */
+ #define RTAX_FEATURE_TCP_USEC_TS	(1 << 4)
++#define RTAX_FEATURE_ECN_LOW		(1 << 5)
+ 
+ #define RTAX_FEATURE_MASK	(RTAX_FEATURE_ECN |		\
+ 				 RTAX_FEATURE_SACK |		\
+ 				 RTAX_FEATURE_TIMESTAMP |	\
+ 				 RTAX_FEATURE_ALLFRAG |		\
+-				 RTAX_FEATURE_TCP_USEC_TS)
++				 RTAX_FEATURE_TCP_USEC_TS |	\
++				 RTAX_FEATURE_ECN_LOW)
+ 
+ struct rta_session {
+ 	__u8	proto;
+--- a/net/ipv4/tcp_minisocks.c
++++ b/net/ipv4/tcp_minisocks.c
+@@ -459,6 +459,8 @@ void tcp_ca_openreq_child(struct sock *s
+ 	u32 ca_key = dst_metric(dst, RTAX_CC_ALGO);
+ 	bool ca_got_dst = false;
+ 
++	tcp_set_ecn_low_from_dst(sk, dst);
++
+ 	if (ca_key != TCP_CA_UNSPEC) {
+ 		const struct tcp_congestion_ops *ca;
+ 
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -336,10 +336,9 @@ static void tcp_ecn_send_syn(struct sock
+ 	bool bpf_needs_ecn = tcp_bpf_ca_needs_ecn(sk);
+ 	bool use_ecn = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_ecn) == 1 ||
+ 		tcp_ca_needs_ecn(sk) || bpf_needs_ecn;
++	const struct dst_entry *dst = __sk_dst_get(sk);
+ 
+ 	if (!use_ecn) {
+-		const struct dst_entry *dst = __sk_dst_get(sk);
+-
+ 		if (dst && dst_feature(dst, RTAX_FEATURE_ECN))
+ 			use_ecn = true;
+ 	}
+@@ -351,6 +350,9 @@ static void tcp_ecn_send_syn(struct sock
+ 		tp->ecn_flags = TCP_ECN_OK;
+ 		if (tcp_ca_needs_ecn(sk) || bpf_needs_ecn)
+ 			INET_ECN_xmit(sk);
++
++		if (dst)
++			tcp_set_ecn_low_from_dst(sk, dst);
+ 	}
+ }
+ 
+From c0643f854de456c761c18b009af7537a74506724 Mon Sep 17 00:00:00 2001
+From: Neal Cardwell <ncardwell@google.com>
+Date: Tue, 11 Jun 2019 12:54:22 -0400
+Subject: [PATCH 16/19] net-tcp_bbr: v3: update TCP "bbr" congestion control
+ module to BBRv3
+
+BBR v3 is an enhacement to the BBR v1 algorithm. It's designed to aim for lower
+queues, lower loss, and better Reno/CUBIC coexistence than BBR v1.
+
+BBR v3 maintains the core of BBR v1: an explicit model of the network
+path that is two-dimensional, adapting to estimate the (a) maximum
+available bandwidth and (b) maximum safe volume of data a flow can
+keep in-flight in the network. It maintains the estimated BDP as a
+core guide for estimating an appropriate level of in-flight data.
+
+BBR v3 makes several key enhancements:
+
+o Its bandwidth-probing time scale is adapted, within bounds, to allow improved
+coexistence with Reno and CUBIC. The bandwidth-probing time scale is (a)
+extended dynamically based on estimated BDP to improve coexistence with
+Reno/CUBIC; (b) bounded by an interactive wall-clock time-scale to be more
+scalable and responsive than Reno and CUBIC.
+
+o Rather than being largely agnostic to loss and ECN marks, it explicitly uses
+loss and (DCTCP-style) ECN signals to maintain its model.
+
+o It aims for lower losses than v1 by adjusting its model to attempt to stay
+within loss rate and ECN mark rate bounds (loss_thresh and ecn_thresh,
+respectively).
+
+o It adapts to loss/ECN signals even when the application is running out of
+data ("application-limited"), in case the "application-limited" flow is also
+"network-limited" (the bw and/or inflight available to this flow is lower than
+previously estimated when the flow ran out of data).
+
+o It has a three-part model: the model explicit three tracks operating points,
+where an operating point is a tuple: (bandwidth, inflight). The three operating
+points are:
+
+  o latest:        the latest measurement from the current round trip
+  o upper bound:   robust, optimistic, long-term upper bound
+  o lower bound:   robust, conservative, short-term lower bound
+
+These are stored in the following state variables:
+
+  o latest:  bw_latest, inflight_latest
+  o lo:      bw_lo,     inflight_lo
+  o hi:      bw_hi[2],  inflight_hi
+
+To gain intuition about the meaning of the three operating points, it
+may help to consider the analogs in CUBIC, which has a somewhat
+analogous three-part model used by its probing state machine:
+
+  BBR param     CUBIC param
+  -----------   -------------
+  latest     ~  cwnd
+  lo         ~  ssthresh
+  hi         ~  last_max_cwnd
+
+The analogy is only a loose one, though, since the BBR operating
+points are calculated differently, and are 2-dimensional (bw,inflight)
+rather than CUBIC's one-dimensional notion of operating point
+(inflight).
+
+o It uses the three-part model to adapt the magnitude of its bandwidth
+to match the estimated space available in the buffer, rather than (as
+in BBR v1) assuming that it was always acceptable to place 0.25*BDP in
+the bottleneck buffer when probing (commodity datacenter switches
+commonly do not have that much buffer for WAN flows). When BBR v3
+estimates it hit a buffer limit during probing, its bandwidth probing
+then starts gently in case little space is still available in the
+buffer, and the accelerates, slowly at first and then rapidly if it
+can grow inflight without seeing congestion signals. In such cases,
+probing is bounded by inflight_hi + inflight_probe, where
+inflight_probe grows as: [0, 1, 2, 4, 8, 16,...]. This allows BBR to
+keep losses low and bounded if a bottleneck remains congested, while
+rapidly/scalably utilizing free bandwidth when it becomes available.
+
+o It has a slightly revised state machine, to achieve the goals above.
+    BBR_BW_PROBE_UP:    pushes up inflight to probe for bw/vol
+    BBR_BW_PROBE_DOWN:  drain excess inflight from the queue
+    BBR_BW_PROBE_CRUISE: use pipe, w/ headroom in queue/pipe
+    BBR_BW_PROBE_REFILL: try refill the pipe again to 100%, leaving queue empty
+
+o The estimated BDP: BBR v3 continues to maintain an estimate of the
+path's two-way propagation delay, by tracking a windowed min_rtt, and
+coordinating (on an as-ndeeded basis) to try to expose the two-way
+propagation delay by draining the bottleneck queue.
+
+BBR v3 continues to use its min_rtt and (currently-applicable) bandwidth
+estimate to estimate the current bandwidth-delay product. The estimated BDP
+still provides one important guideline for bounding inflight data. However,
+because any min-filtered RTT and max-filtered bw inherently tend to both
+overestimate, the estimated BDP is often too high; in this case loss or ECN
+marks can ensue, in which case BBR v3 adjusts inflight_hi and inflight_lo to
+adapt its sending rate and inflight down to match the available capacity of the
+path.
+
+o Space: Note that ICSK_CA_PRIV_SIZE increased. This is because BBR v3
+requires more space. Note that much of the space is due to support for
+per-socket parameterization and debugging in this release for research
+and debugging. With that state removed, the full "struct bbr" is 140
+bytes, or 144 with padding. This is an increase of 40 bytes over the
+existing ca_priv space.
+
+o Code: BBR v3 reuses many pieces from BBR v1. But it omits the following
+  significant pieces:
+
+  o "packet conservation" (bbr_set_cwnd_to_recover_or_restore(),
+    bbr_can_grow_inflight())
+  o long-term bandwidth estimator ("policer mode")
+
+  The code layout tries to keep BBR v3 code near the bottom of the
+  file, so that v1-applicable code in the top does not accidentally
+  refer to v3 code.
+
+o Docs:
+  See the following docs for more details and diagrams decsribing the BBR v3
+  algorithm:
+    https://datatracker.ietf.org/meeting/104/materials/slides-104-iccrg-an-update-on-bbr-00
+    https://datatracker.ietf.org/meeting/102/materials/slides-102-iccrg-an-update-on-bbr-work-at-google-00
+
+o Internal notes:
+  For this upstream rebase, Neal started from:
+    git show fed518041ac6:net/ipv4/tcp_bbr.c > net/ipv4/tcp_bbr.c
+  then removed dev instrumentation (dynamic get/set for parameters)
+  and code that was only used by BBRv1
+
+Effort: net-tcp_bbr
+Origin-9xx-SHA1: 2c84098e60bed6d67dde23cd7538c51dee273102
+Change-Id: I125cf26ba2a7a686f2fa5e87f4c2afceb65f7a05
+Signed-off-by: Alexandre Frade <kernel@xanmod.org>
+---
+ include/net/inet_connection_sock.h |    4 +-
+ include/net/tcp.h                  |    2 +-
+ include/uapi/linux/inet_diag.h     |   23 +
+ net/ipv4/Kconfig                   |   21 +-
+ net/ipv4/tcp_bbr.c                 | 2214 +++++++++++++++++++++-------
+ 5 files changed, 1740 insertions(+), 524 deletions(-)
+
+--- a/include/net/inet_connection_sock.h
++++ b/include/net/inet_connection_sock.h
+@@ -137,8 +137,8 @@ struct inet_connection_sock {
+ 	u32			  icsk_probes_tstamp;
+ 	u32			  icsk_user_timeout;
+ 
+-	u64			  icsk_ca_priv[104 / sizeof(u64)];
+-#define ICSK_CA_PRIV_SIZE	  sizeof_field(struct inet_connection_sock, icsk_ca_priv)
++#define ICSK_CA_PRIV_SIZE      (144)
++	u64			  icsk_ca_priv[ICSK_CA_PRIV_SIZE / sizeof(u64)];
+ };
+ 
+ #define ICSK_TIME_RETRANS	1	/* Retransmit timer */
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -2473,7 +2473,7 @@ struct tcp_plb_state {
+ 	u8	consec_cong_rounds:5, /* consecutive congested rounds */
+ 		unused:3;
+ 	u32	pause_until; /* jiffies32 when PLB can resume rerouting */
+-};
++} __attribute__ ((__packed__));
+ 
+ static inline void tcp_plb_init(const struct sock *sk,
+ 				struct tcp_plb_state *plb)
+--- a/include/uapi/linux/inet_diag.h
++++ b/include/uapi/linux/inet_diag.h
+@@ -229,6 +229,29 @@ struct tcp_bbr_info {
+ 	__u32	bbr_min_rtt;		/* min-filtered RTT in uSec */
+ 	__u32	bbr_pacing_gain;	/* pacing gain shifted left 8 bits */
+ 	__u32	bbr_cwnd_gain;		/* cwnd gain shifted left 8 bits */
++	__u32	bbr_bw_hi_lsb;		/* lower 32 bits of bw_hi */
++	__u32	bbr_bw_hi_msb;		/* upper 32 bits of bw_hi */
++	__u32	bbr_bw_lo_lsb;		/* lower 32 bits of bw_lo */
++	__u32	bbr_bw_lo_msb;		/* upper 32 bits of bw_lo */
++	__u8	bbr_mode;		/* current bbr_mode in state machine */
++	__u8	bbr_phase;		/* current state machine phase */
++	__u8	unused1;		/* alignment padding; not used yet */
++	__u8	bbr_version;		/* BBR algorithm version */
++	__u32	bbr_inflight_lo;	/* lower short-term data volume bound */
++	__u32	bbr_inflight_hi;	/* higher long-term data volume bound */
++	__u32	bbr_extra_acked;	/* max excess packets ACKed in epoch */
++};
++
++/* TCP BBR congestion control bbr_phase as reported in netlink/ss stats. */
++enum tcp_bbr_phase {
++	BBR_PHASE_INVALID		= 0,
++	BBR_PHASE_STARTUP		= 1,
++	BBR_PHASE_DRAIN			= 2,
++	BBR_PHASE_PROBE_RTT		= 3,
++	BBR_PHASE_PROBE_BW_UP		= 4,
++	BBR_PHASE_PROBE_BW_DOWN		= 5,
++	BBR_PHASE_PROBE_BW_CRUISE	= 6,
++	BBR_PHASE_PROBE_BW_REFILL	= 7,
+ };
+ 
+ union tcp_cc_info {
+--- a/net/ipv4/Kconfig
++++ b/net/ipv4/Kconfig
+@@ -668,15 +668,18 @@ config TCP_CONG_BBR
+ 	default n
+ 	help
+ 
+-	  BBR (Bottleneck Bandwidth and RTT) TCP congestion control aims to
+-	  maximize network utilization and minimize queues. It builds an explicit
+-	  model of the bottleneck delivery rate and path round-trip propagation
+-	  delay. It tolerates packet loss and delay unrelated to congestion. It
+-	  can operate over LAN, WAN, cellular, wifi, or cable modem links. It can
+-	  coexist with flows that use loss-based congestion control, and can
+-	  operate with shallow buffers, deep buffers, bufferbloat, policers, or
+-	  AQM schemes that do not provide a delay signal. It requires the fq
+-	  ("Fair Queue") pacing packet scheduler.
++	  BBR (Bottleneck Bandwidth and RTT) TCP congestion control is a
++	  model-based congestion control algorithm that aims to maximize
++	  network utilization, keep queues and retransmit rates low, and to be
++	  able to coexist with Reno/CUBIC in common scenarios. It builds an
++	  explicit model of the network path.  It tolerates a targeted degree
++	  of random packet loss and delay. It can operate over LAN, WAN,
++	  cellular, wifi, or cable modem links, and can use shallow-threshold
++	  ECN signals. It can coexist to some degree with flows that use
++	  loss-based congestion control, and can operate with shallow buffers,
++	  deep buffers, bufferbloat, policers, or AQM schemes that do not
++	  provide a delay signal. It requires pacing, using either TCP internal
++	  pacing or the fq ("Fair Queue") pacing packet scheduler.
+ 
+ choice
+ 	prompt "Default TCP congestion control"
+--- a/net/ipv4/tcp_bbr.c
++++ b/net/ipv4/tcp_bbr.c
+@@ -1,18 +1,19 @@
+-/* Bottleneck Bandwidth and RTT (BBR) congestion control
++/* BBR (Bottleneck Bandwidth and RTT) congestion control
+  *
+- * BBR congestion control computes the sending rate based on the delivery
+- * rate (throughput) estimated from ACKs. In a nutshell:
++ * BBR is a model-based congestion control algorithm that aims for low queues,
++ * low loss, and (bounded) Reno/CUBIC coexistence. To maintain a model of the
++ * network path, it uses measurements of bandwidth and RTT, as well as (if they
++ * occur) packet loss and/or shallow-threshold ECN signals. Note that although
++ * it can use ECN or loss signals explicitly, it does not require either; it
++ * can bound its in-flight data based on its estimate of the BDP.
+  *
+- *   On each ACK, update our model of the network path:
+- *      bottleneck_bandwidth = windowed_max(delivered / elapsed, 10 round trips)
+- *      min_rtt = windowed_min(rtt, 10 seconds)
+- *   pacing_rate = pacing_gain * bottleneck_bandwidth
+- *   cwnd = max(cwnd_gain * bottleneck_bandwidth * min_rtt, 4)
+- *
+- * The core algorithm does not react directly to packet losses or delays,
+- * although BBR may adjust the size of next send per ACK when loss is
+- * observed, or adjust the sending rate if it estimates there is a
+- * traffic policer, in order to keep the drop rate reasonable.
++ * The model has both higher and lower bounds for the operating range:
++ *   lo: bw_lo, inflight_lo: conservative short-term lower bound
++ *   hi: bw_hi, inflight_hi: robust long-term upper bound
++ * The bandwidth-probing time scale is (a) extended dynamically based on
++ * estimated BDP to improve coexistence with Reno/CUBIC; (b) bounded by
++ * an interactive wall-clock time-scale to be more scalable and responsive
++ * than Reno and CUBIC.
+  *
+  * Here is a state transition diagram for BBR:
+  *
+@@ -65,6 +66,13 @@
+ #include <linux/random.h>
+ #include <linux/win_minmax.h>
+ 
++#include <trace/events/tcp.h>
++#include "tcp_dctcp.h"
++
++#define BBR_VERSION		3
++
++#define bbr_param(sk,name)	(bbr_ ## name)
++
+ /* Scale factor for rate in pkt/uSec unit to avoid truncation in bandwidth
+  * estimation. The rate unit ~= (1500 bytes / 1 usec / 2^24) ~= 715 bps.
+  * This handles bandwidths from 0.06pps (715bps) to 256Mpps (3Tbps) in a u32.
+@@ -85,36 +93,41 @@ enum bbr_mode {
+ 	BBR_PROBE_RTT,	/* cut inflight to min to probe min_rtt */
+ };
+ 
++/* How does the incoming ACK stream relate to our bandwidth probing? */
++enum bbr_ack_phase {
++	BBR_ACKS_INIT,		  /* not probing; not getting probe feedback */
++	BBR_ACKS_REFILLING,	  /* sending at est. bw to fill pipe */
++	BBR_ACKS_PROBE_STARTING,  /* inflight rising to probe bw */
++	BBR_ACKS_PROBE_FEEDBACK,  /* getting feedback from bw probing */
++	BBR_ACKS_PROBE_STOPPING,  /* stopped probing; still getting feedback */
++};
++
+ /* BBR congestion control block */
+ struct bbr {
+ 	u32	min_rtt_us;	        /* min RTT in min_rtt_win_sec window */
+ 	u32	min_rtt_stamp;	        /* timestamp of min_rtt_us */
+ 	u32	probe_rtt_done_stamp;   /* end time for BBR_PROBE_RTT mode */
+-	struct minmax bw;	/* Max recent delivery rate in pkts/uS << 24 */
+-	u32	rtt_cnt;	    /* count of packet-timed rounds elapsed */
++	u32	probe_rtt_min_us;	/* min RTT in probe_rtt_win_ms win */
++	u32	probe_rtt_min_stamp;	/* timestamp of probe_rtt_min_us*/
+ 	u32     next_rtt_delivered; /* scb->tx.delivered at end of round */
+ 	u64	cycle_mstamp;	     /* time of this cycle phase start */
+-	u32     mode:3,		     /* current bbr_mode in state machine */
++	u32     mode:2,		     /* current bbr_mode in state machine */
+ 		prev_ca_state:3,     /* CA state on previous ACK */
+-		packet_conservation:1,  /* use packet conservation? */
+ 		round_start:1,	     /* start of packet-timed tx->ack round? */
++		ce_state:1,          /* If most recent data has CE bit set */
++		bw_probe_up_rounds:5,   /* cwnd-limited rounds in PROBE_UP */
++		try_fast_path:1,	/* can we take fast path? */
+ 		idle_restart:1,	     /* restarting after idle? */
+ 		probe_rtt_round_done:1,  /* a BBR_PROBE_RTT round at 4 pkts? */
+-		unused:13,
+-		lt_is_sampling:1,    /* taking long-term ("LT") samples now? */
+-		lt_rtt_cnt:7,	     /* round trips in long-term interval */
+-		lt_use_bw:1;	     /* use lt_bw as our bw estimate? */
+-	u32	lt_bw;		     /* LT est delivery rate in pkts/uS << 24 */
+-	u32	lt_last_delivered;   /* LT intvl start: tp->delivered */
+-	u32	lt_last_stamp;	     /* LT intvl start: tp->delivered_mstamp */
+-	u32	lt_last_lost;	     /* LT intvl start: tp->lost */
++		init_cwnd:7,         /* initial cwnd */
++		unused_1:10;
+ 	u32	pacing_gain:10,	/* current gain for setting pacing rate */
+ 		cwnd_gain:10,	/* current gain for setting cwnd */
+ 		full_bw_reached:1,   /* reached full bw in Startup? */
+ 		full_bw_cnt:2,	/* number of rounds without large bw gains */
+-		cycle_idx:3,	/* current index in pacing_gain cycle array */
++		cycle_idx:2,	/* current index in pacing_gain cycle array */
+ 		has_seen_rtt:1, /* have we seen an RTT sample yet? */
+-		unused_b:5;
++		unused_2:6;
+ 	u32	prior_cwnd;	/* prior cwnd upon entering loss recovery */
+ 	u32	full_bw;	/* recent bw, to estimate if pipe is full */
+ 
+@@ -124,19 +137,67 @@ struct bbr {
+ 	u32	ack_epoch_acked:20,	/* packets (S)ACKed in sampling epoch */
+ 		extra_acked_win_rtts:5,	/* age of extra_acked, in round trips */
+ 		extra_acked_win_idx:1,	/* current index in extra_acked array */
+-		unused_c:6;
++	/* BBR v3 state: */
++		full_bw_now:1,		/* recently reached full bw plateau? */
++		startup_ecn_rounds:2,	/* consecutive hi ECN STARTUP rounds */
++		loss_in_cycle:1,	/* packet loss in this cycle? */
++		ecn_in_cycle:1,		/* ECN in this cycle? */
++		unused_3:1;
++	u32	loss_round_delivered; /* scb->tx.delivered ending loss round */
++	u32	undo_bw_lo;	     /* bw_lo before latest losses */
++	u32	undo_inflight_lo;    /* inflight_lo before latest losses */
++	u32	undo_inflight_hi;    /* inflight_hi before latest losses */
++	u32	bw_latest;	 /* max delivered bw in last round trip */
++	u32	bw_lo;		 /* lower bound on sending bandwidth */
++	u32	bw_hi[2];	 /* max recent measured bw sample */
++	u32	inflight_latest; /* max delivered data in last round trip */
++	u32	inflight_lo;	 /* lower bound of inflight data range */
++	u32	inflight_hi;	 /* upper bound of inflight data range */
++	u32	bw_probe_up_cnt; /* packets delivered per inflight_hi incr */
++	u32	bw_probe_up_acks;  /* packets (S)ACKed since inflight_hi incr */
++	u32	probe_wait_us;	 /* PROBE_DOWN until next clock-driven probe */
++	u32	prior_rcv_nxt;	/* tp->rcv_nxt when CE state last changed */
++	u32	ecn_eligible:1,	/* sender can use ECN (RTT, handshake)? */
++		ecn_alpha:9,	/* EWMA delivered_ce/delivered; 0..256 */
++		bw_probe_samples:1,    /* rate samples reflect bw probing? */
++		prev_probe_too_high:1, /* did last PROBE_UP go too high? */
++		stopped_risky_probe:1, /* last PROBE_UP stopped due to risk? */
++		rounds_since_probe:8,  /* packet-timed rounds since probed bw */
++		loss_round_start:1,    /* loss_round_delivered round trip? */
++		loss_in_round:1,       /* loss marked in this round trip? */
++		ecn_in_round:1,	       /* ECN marked in this round trip? */
++		ack_phase:3,	       /* bbr_ack_phase: meaning of ACKs */
++		loss_events_in_round:4,/* losses in STARTUP round */
++		initialized:1;	       /* has bbr_init() been called? */
++	u32	alpha_last_delivered;	 /* tp->delivered    at alpha update */
++	u32	alpha_last_delivered_ce; /* tp->delivered_ce at alpha update */
++
++	u8	unused_4;		/* to preserve alignment */
++	struct tcp_plb_state plb;
+ };
+ 
+-#define CYCLE_LEN	8	/* number of phases in a pacing gain cycle */
++struct bbr_context {
++	u32 sample_bw;
++};
+ 
+-/* Window length of bw filter (in rounds): */
+-static const int bbr_bw_rtts = CYCLE_LEN + 2;
+ /* Window length of min_rtt filter (in sec): */
+ static const u32 bbr_min_rtt_win_sec = 10;
+ /* Minimum time (in ms) spent at bbr_cwnd_min_target in BBR_PROBE_RTT mode: */
+ static const u32 bbr_probe_rtt_mode_ms = 200;
+-/* Skip TSO below the following bandwidth (bits/sec): */
+-static const int bbr_min_tso_rate = 1200000;
++/* Window length of probe_rtt_min_us filter (in ms), and consequently the
++ * typical interval between PROBE_RTT mode entries. The default is 5000ms.
++ * Note that bbr_probe_rtt_win_ms must be <= bbr_min_rtt_win_sec * MSEC_PER_SEC
++ */
++static const u32 bbr_probe_rtt_win_ms = 5000;
++/* Proportion of cwnd to estimated BDP in PROBE_RTT, in units of BBR_UNIT: */
++static const u32 bbr_probe_rtt_cwnd_gain = BBR_UNIT * 1 / 2;
++
++/* Use min_rtt to help adapt TSO burst size, with smaller min_rtt resulting
++ * in bigger TSO bursts. We cut the RTT-based allowance in half
++ * for every 2^9 usec (aka 512 us) of RTT, so that the RTT-based allowance
++ * is below 1500 bytes after 6 * ~500 usec = 3ms.
++ */
++static const u32 bbr_tso_rtt_shift = 9;
+ 
+ /* Pace at ~1% below estimated bw, on average, to reduce queue at bottleneck.
+  * In order to help drive the network toward lower queues and low latency while
+@@ -146,13 +207,15 @@ static const int bbr_min_tso_rate = 1200
+  */
+ static const int bbr_pacing_margin_percent = 1;
+ 
+-/* We use a high_gain value of 2/ln(2) because it's the smallest pacing gain
++/* We use a startup_pacing_gain of 4*ln(2) because it's the smallest value
+  * that will allow a smoothly increasing pacing rate that will double each RTT
+  * and send the same number of packets per RTT that an un-paced, slow-starting
+  * Reno or CUBIC flow would:
+  */
+-static const int bbr_high_gain  = BBR_UNIT * 2885 / 1000 + 1;
+-/* The pacing gain of 1/high_gain in BBR_DRAIN is calculated to typically drain
++static const int bbr_startup_pacing_gain = BBR_UNIT * 277 / 100 + 1;
++/* The gain for deriving startup cwnd: */
++static const int bbr_startup_cwnd_gain = BBR_UNIT * 2;
++/* The pacing gain in BBR_DRAIN is calculated to typically drain
+  * the queue created in BBR_STARTUP in a single round:
+  */
+ static const int bbr_drain_gain = BBR_UNIT * 1000 / 2885;
+@@ -160,13 +223,17 @@ static const int bbr_drain_gain = BBR_UN
+ static const int bbr_cwnd_gain  = BBR_UNIT * 2;
+ /* The pacing_gain values for the PROBE_BW gain cycle, to discover/share bw: */
+ static const int bbr_pacing_gain[] = {
+-	BBR_UNIT * 5 / 4,	/* probe for more available bw */
+-	BBR_UNIT * 3 / 4,	/* drain queue and/or yield bw to other flows */
+-	BBR_UNIT, BBR_UNIT, BBR_UNIT,	/* cruise at 1.0*bw to utilize pipe, */
+-	BBR_UNIT, BBR_UNIT, BBR_UNIT	/* without creating excess queue... */
++	BBR_UNIT * 5 / 4,	/* UP: probe for more available bw */
++	BBR_UNIT * 91 / 100,	/* DOWN: drain queue and/or yield bw */
++	BBR_UNIT,		/* CRUISE: try to use pipe w/ some headroom */
++	BBR_UNIT,		/* REFILL: refill pipe to estimated 100% */
++};
++enum bbr_pacing_gain_phase {
++	BBR_BW_PROBE_UP		= 0,  /* push up inflight to probe for bw/vol */
++	BBR_BW_PROBE_DOWN	= 1,  /* drain excess inflight from the queue */
++	BBR_BW_PROBE_CRUISE	= 2,  /* use pipe, w/ headroom in queue/pipe */
++	BBR_BW_PROBE_REFILL	= 3,  /* v2: refill the pipe again to 100% */
+ };
+-/* Randomize the starting gain cycling phase over N phases: */
+-static const u32 bbr_cycle_rand = 7;
+ 
+ /* Try to keep at least this many packets in flight, if things go smoothly. For
+  * smooth functioning, a sliding window protocol ACKing every other packet
+@@ -174,24 +241,12 @@ static const u32 bbr_cycle_rand = 7;
+  */
+ static const u32 bbr_cwnd_min_target = 4;
+ 
+-/* To estimate if BBR_STARTUP mode (i.e. high_gain) has filled pipe... */
++/* To estimate if BBR_STARTUP or BBR_BW_PROBE_UP has filled pipe... */
+ /* If bw has increased significantly (1.25x), there may be more bw available: */
+ static const u32 bbr_full_bw_thresh = BBR_UNIT * 5 / 4;
+ /* But after 3 rounds w/o significant bw growth, estimate pipe is full: */
+ static const u32 bbr_full_bw_cnt = 3;
+ 
+-/* "long-term" ("LT") bandwidth estimator parameters... */
+-/* The minimum number of rounds in an LT bw sampling interval: */
+-static const u32 bbr_lt_intvl_min_rtts = 4;
+-/* If lost/delivered ratio > 20%, interval is "lossy" and we may be policed: */
+-static const u32 bbr_lt_loss_thresh = 50;
+-/* If 2 intervals have a bw ratio <= 1/8, their bw is "consistent": */
+-static const u32 bbr_lt_bw_ratio = BBR_UNIT / 8;
+-/* If 2 intervals have a bw diff <= 4 Kbit/sec their bw is "consistent": */
+-static const u32 bbr_lt_bw_diff = 4000 / 8;
+-/* If we estimate we're policed, use lt_bw for this many round trips: */
+-static const u32 bbr_lt_bw_max_rtts = 48;
+-
+ /* Gain factor for adding extra_acked to target cwnd: */
+ static const int bbr_extra_acked_gain = BBR_UNIT;
+ /* Window length of extra_acked window. */
+@@ -201,8 +256,121 @@ static const u32 bbr_ack_epoch_acked_res
+ /* Time period for clamping cwnd increment due to ack aggregation */
+ static const u32 bbr_extra_acked_max_us = 100 * 1000;
+ 
++/* Flags to control BBR ECN-related behavior... */
++
++/* Ensure ACKs only ACK packets with consistent ECN CE status? */
++static const bool bbr_precise_ece_ack = true;
++
++/* Max RTT (in usec) at which to use sender-side ECN logic.
++ * Disabled when 0 (ECN allowed at any RTT).
++ */
++static const u32 bbr_ecn_max_rtt_us = 5000;
++
++/* On losses, scale down inflight and pacing rate by beta scaled by BBR_SCALE.
++ * No loss response when 0.
++ */
++static const u32 bbr_beta = BBR_UNIT * 30 / 100;
++
++/* Gain factor for ECN mark ratio samples, scaled by BBR_SCALE (1/16 = 6.25%) */
++static const u32 bbr_ecn_alpha_gain = BBR_UNIT * 1 / 16;
++
++/* The initial value for ecn_alpha; 1.0 allows a flow to respond quickly
++ * to congestion if the bottleneck is congested when the flow starts up.
++ */
++static const u32 bbr_ecn_alpha_init = BBR_UNIT;
++
++/* On ECN, cut inflight_lo to (1 - ecn_factor * ecn_alpha) scaled by BBR_SCALE.
++ * No ECN based bounding when 0.
++ */
++static const u32 bbr_ecn_factor = BBR_UNIT * 1 / 3;	 /* 1/3 = 33% */
++
++/* Estimate bw probing has gone too far if CE ratio exceeds this threshold.
++ * Scaled by BBR_SCALE. Disabled when 0.
++ */
++static const u32 bbr_ecn_thresh = BBR_UNIT * 1 / 2;  /* 1/2 = 50% */
++
++/* If non-zero, if in a cycle with no losses but some ECN marks, after ECN
++ * clears then make the first round's increment to inflight_hi the following
++ * fraction of inflight_hi.
++ */
++static const u32 bbr_ecn_reprobe_gain = BBR_UNIT * 1 / 2;
++
++/* Estimate bw probing has gone too far if loss rate exceeds this level. */
++static const u32 bbr_loss_thresh = BBR_UNIT * 2 / 100;  /* 2% loss */
++
++/* Slow down for a packet loss recovered by TLP? */
++static const bool bbr_loss_probe_recovery = true;
++
++/* Exit STARTUP if number of loss marking events in a Recovery round is >= N,
++ * and loss rate is higher than bbr_loss_thresh.
++ * Disabled if 0.
++ */
++static const u32 bbr_full_loss_cnt = 6;
++
++/* Exit STARTUP if number of round trips with ECN mark rate above ecn_thresh
++ * meets this count.
++ */
++static const u32 bbr_full_ecn_cnt = 2;
++
++/* Fraction of unutilized headroom to try to leave in path upon high loss. */
++static const u32 bbr_inflight_headroom = BBR_UNIT * 15 / 100;
++
++/* How much do we increase cwnd_gain when probing for bandwidth in
++ * BBR_BW_PROBE_UP? This specifies the increment in units of
++ * BBR_UNIT/4. The default is 1, meaning 0.25.
++ * The min value is 0 (meaning 0.0); max is 3 (meaning 0.75).
++ */
++static const u32 bbr_bw_probe_cwnd_gain = 1;
++
++/* Max number of packet-timed rounds to wait before probing for bandwidth.  If
++ * we want to tolerate 1% random loss per round, and not have this cut our
++ * inflight too much, we must probe for bw periodically on roughly this scale.
++ * If low, limits Reno/CUBIC coexistence; if high, limits loss tolerance.
++ * We aim to be fair with Reno/CUBIC up to a BDP of at least:
++ *  BDP = 25Mbps * .030sec /(1514bytes) = 61.9 packets
++ */
++static const u32 bbr_bw_probe_max_rounds = 63;
++
++/* Max amount of randomness to inject in round counting for Reno-coexistence.
++ */
++static const u32 bbr_bw_probe_rand_rounds = 2;
++
++/* Use BBR-native probe time scale starting at this many usec.
++ * We aim to be fair with Reno/CUBIC up to an inter-loss time epoch of at least:
++ *  BDP*RTT = 25Mbps * .030sec /(1514bytes) * 0.030sec = 1.9 secs
++ */
++static const u32 bbr_bw_probe_base_us = 2 * USEC_PER_SEC;  /* 2 secs */
++
++/* Use BBR-native probes spread over this many usec: */
++static const u32 bbr_bw_probe_rand_us = 1 * USEC_PER_SEC;  /* 1 secs */
++
++/* Use fast path if app-limited, no loss/ECN, and target cwnd was reached? */
++static const bool bbr_fast_path = true;
++
++/* Use fast ack mode? */
++static const bool bbr_fast_ack_mode = true;
++
++static u32 bbr_max_bw(const struct sock *sk);
++static u32 bbr_bw(const struct sock *sk);
++static void bbr_exit_probe_rtt(struct sock *sk);
++static void bbr_reset_congestion_signals(struct sock *sk);
++static void bbr_run_loss_probe_recovery(struct sock *sk);
++
+ static void bbr_check_probe_rtt_done(struct sock *sk);
+ 
++/* This connection can use ECN if both endpoints have signaled ECN support in
++ * the handshake and the per-route settings indicated this is a
++ * shallow-threshold ECN environment, meaning both:
++ *  (a) ECN CE marks indicate low-latency/shallow-threshold congestion, and
++ *  (b) TCP endpoints provide precise ACKs that only ACK data segments
++ *      with consistent ECN CE status
++ */
++static bool bbr_can_use_ecn(const struct sock *sk)
++{
++	return (tcp_sk(sk)->ecn_flags & TCP_ECN_OK) &&
++	       (tcp_sk(sk)->ecn_flags & TCP_ECN_LOW);
++}
++
+ /* Do we estimate that STARTUP filled the pipe? */
+ static bool bbr_full_bw_reached(const struct sock *sk)
+ {
+@@ -214,17 +382,17 @@ static bool bbr_full_bw_reached(const st
+ /* Return the windowed max recent bandwidth sample, in pkts/uS << BW_SCALE. */
+ static u32 bbr_max_bw(const struct sock *sk)
+ {
+-	struct bbr *bbr = inet_csk_ca(sk);
++	const struct bbr *bbr = inet_csk_ca(sk);
+ 
+-	return minmax_get(&bbr->bw);
++	return max(bbr->bw_hi[0], bbr->bw_hi[1]);
+ }
+ 
+ /* Return the estimated bandwidth of the path, in pkts/uS << BW_SCALE. */
+ static u32 bbr_bw(const struct sock *sk)
+ {
+-	struct bbr *bbr = inet_csk_ca(sk);
++	const struct bbr *bbr = inet_csk_ca(sk);
+ 
+-	return bbr->lt_use_bw ? bbr->lt_bw : bbr_max_bw(sk);
++	return min(bbr_max_bw(sk), bbr->bw_lo);
+ }
+ 
+ /* Return maximum extra acked in past k-2k round trips,
+@@ -241,15 +409,23 @@ static u16 bbr_extra_acked(const struct
+  * The order here is chosen carefully to avoid overflow of u64. This should
+  * work for input rates of up to 2.9Tbit/sec and gain of 2.89x.
+  */
+-static u64 bbr_rate_bytes_per_sec(struct sock *sk, u64 rate, int gain)
++static u64 bbr_rate_bytes_per_sec(struct sock *sk, u64 rate, int gain,
++				  int margin)
+ {
+ 	unsigned int mss = tcp_sk(sk)->mss_cache;
+ 
+ 	rate *= mss;
+ 	rate *= gain;
+ 	rate >>= BBR_SCALE;
+-	rate *= USEC_PER_SEC / 100 * (100 - bbr_pacing_margin_percent);
+-	return rate >> BW_SCALE;
++	rate *= USEC_PER_SEC / 100 * (100 - margin);
++	rate >>= BW_SCALE;
++	rate = max(rate, 1ULL);
++	return rate;
++}
++
++static u64 bbr_bw_bytes_per_sec(struct sock *sk, u64 rate)
++{
++	return bbr_rate_bytes_per_sec(sk, rate, BBR_UNIT, 0);
+ }
+ 
+ /* Convert a BBR bw and gain factor to a pacing rate in bytes per second. */
+@@ -257,12 +433,13 @@ static unsigned long bbr_bw_to_pacing_ra
+ {
+ 	u64 rate = bw;
+ 
+-	rate = bbr_rate_bytes_per_sec(sk, rate, gain);
++	rate = bbr_rate_bytes_per_sec(sk, rate, gain,
++				      bbr_pacing_margin_percent);
+ 	rate = min_t(u64, rate, READ_ONCE(sk->sk_max_pacing_rate));
+ 	return rate;
+ }
+ 
+-/* Initialize pacing rate to: high_gain * init_cwnd / RTT. */
++/* Initialize pacing rate to: startup_pacing_gain * init_cwnd / RTT. */
+ static void bbr_init_pacing_rate_from_rtt(struct sock *sk)
+ {
+ 	struct tcp_sock *tp = tcp_sk(sk);
+@@ -279,7 +456,7 @@ static void bbr_init_pacing_rate_from_rt
+ 	bw = (u64)tcp_snd_cwnd(tp) * BW_UNIT;
+ 	do_div(bw, rtt_us);
+ 	WRITE_ONCE(sk->sk_pacing_rate,
+-		   bbr_bw_to_pacing_rate(sk, bw, bbr_high_gain));
++		   bbr_bw_to_pacing_rate(sk, bw, bbr_param(sk, startup_pacing_gain)));
+ }
+ 
+ /* Pace using current bw estimate and a gain factor. */
+@@ -295,31 +472,38 @@ static void bbr_set_pacing_rate(struct s
+ 		WRITE_ONCE(sk->sk_pacing_rate, rate);
+ }
+ 
+-/* override sysctl_tcp_min_tso_segs */
+-__bpf_kfunc static u32 bbr_min_tso_segs(struct sock *sk)
+-{
+-	return READ_ONCE(sk->sk_pacing_rate) < (bbr_min_tso_rate >> 3) ? 1 : 2;
+-}
+-
+-/* Return the number of segments BBR would like in a TSO/GSO skb, given
+- * a particular max gso size as a constraint.
++/* Return the number of segments BBR would like in a TSO/GSO skb, given a
++ * particular max gso size as a constraint. TODO: make this simpler and more
++ * consistent by switching bbr to just call tcp_tso_autosize().
+  */
+ static u32 bbr_tso_segs_generic(struct sock *sk, unsigned int mss_now,
+ 				u32 gso_max_size)
+ {
+-	u32 segs;
++	struct bbr *bbr = inet_csk_ca(sk);
++	u32 segs, r;
+ 	u64 bytes;
+ 
+ 	/* Budget a TSO/GSO burst size allowance based on bw (pacing_rate). */
+ 	bytes = READ_ONCE(sk->sk_pacing_rate) >> READ_ONCE(sk->sk_pacing_shift);
+ 
++	/* Budget a TSO/GSO burst size allowance based on min_rtt. For every
++	 * K = 2^tso_rtt_shift microseconds of min_rtt, halve the burst.
++	 * The min_rtt-based burst allowance is: 64 KBytes / 2^(min_rtt/K)
++	 */
++	if (bbr_param(sk, tso_rtt_shift)) {
++		r = bbr->min_rtt_us >> bbr_param(sk, tso_rtt_shift);
++		if (r < BITS_PER_TYPE(u32))   /* prevent undefined behavior */
++			bytes += GSO_LEGACY_MAX_SIZE >> r;
++	}
++
+ 	bytes = min_t(u32, bytes, gso_max_size - 1 - MAX_TCP_HEADER);
+-	segs = max_t(u32, bytes / mss_now, bbr_min_tso_segs(sk));
++	segs = max_t(u32, div_u64(bytes, mss_now),
++		     sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs);
+ 	return segs;
+ }
+ 
+ /* Custom tcp_tso_autosize() for BBR, used at transmit time to cap skb size. */
+-static u32  bbr_tso_segs(struct sock *sk, unsigned int mss_now)
++__bpf_kfunc static u32 bbr_tso_segs(struct sock *sk, unsigned int mss_now)
+ {
+ 	return bbr_tso_segs_generic(sk, mss_now, sk->sk_gso_max_size);
+ }
+@@ -329,7 +513,7 @@ static u32 bbr_tso_segs_goal(struct sock
+ {
+ 	struct tcp_sock *tp = tcp_sk(sk);
+ 
+-	return bbr_tso_segs_generic(sk, tp->mss_cache, GSO_MAX_SIZE);
++	return bbr_tso_segs_generic(sk, tp->mss_cache, GSO_LEGACY_MAX_SIZE);
+ }
+ 
+ /* Save "last known good" cwnd so we can restore it after losses or PROBE_RTT */
+@@ -349,7 +533,9 @@ __bpf_kfunc static void bbr_cwnd_event(s
+ 	struct tcp_sock *tp = tcp_sk(sk);
+ 	struct bbr *bbr = inet_csk_ca(sk);
+ 
+-	if (event == CA_EVENT_TX_START && tp->app_limited) {
++	if (event == CA_EVENT_TX_START) {
++		if (!tp->app_limited)
++			return;
+ 		bbr->idle_restart = 1;
+ 		bbr->ack_epoch_mstamp = tp->tcp_mstamp;
+ 		bbr->ack_epoch_acked = 0;
+@@ -360,6 +546,16 @@ __bpf_kfunc static void bbr_cwnd_event(s
+ 			bbr_set_pacing_rate(sk, bbr_bw(sk), BBR_UNIT);
+ 		else if (bbr->mode == BBR_PROBE_RTT)
+ 			bbr_check_probe_rtt_done(sk);
++	} else if ((event == CA_EVENT_ECN_IS_CE ||
++		    event == CA_EVENT_ECN_NO_CE) &&
++		   bbr_can_use_ecn(sk) &&
++		   bbr_param(sk, precise_ece_ack)) {
++		u32 state = bbr->ce_state;
++		dctcp_ece_ack_update(sk, event, &bbr->prior_rcv_nxt, &state);
++		bbr->ce_state = state;
++	} else if (event == CA_EVENT_TLP_RECOVERY &&
++		   bbr_param(sk, loss_probe_recovery)) {
++		bbr_run_loss_probe_recovery(sk);
+ 	}
+ }
+ 
+@@ -382,10 +578,10 @@ static u32 bbr_bdp(struct sock *sk, u32
+ 	 * default. This should only happen when the connection is not using TCP
+ 	 * timestamps and has retransmitted all of the SYN/SYNACK/data packets
+ 	 * ACKed so far. In this case, an RTO can cut cwnd to 1, in which
+-	 * case we need to slow-start up toward something safe: TCP_INIT_CWND.
++	 * case we need to slow-start up toward something safe: initial cwnd.
+ 	 */
+ 	if (unlikely(bbr->min_rtt_us == ~0U))	 /* no valid RTT samples yet? */
+-		return TCP_INIT_CWND;  /* be safe: cap at default initial cwnd*/
++		return bbr->init_cwnd;  /* be safe: cap at initial cwnd */
+ 
+ 	w = (u64)bw * bbr->min_rtt_us;
+ 
+@@ -402,23 +598,23 @@ static u32 bbr_bdp(struct sock *sk, u32
+  *   - one skb in sending host Qdisc,
+  *   - one skb in sending host TSO/GSO engine
+  *   - one skb being received by receiver host LRO/GRO/delayed-ACK engine
+- * Don't worry, at low rates (bbr_min_tso_rate) this won't bloat cwnd because
+- * in such cases tso_segs_goal is 1. The minimum cwnd is 4 packets,
++ * Don't worry, at low rates this won't bloat cwnd because
++ * in such cases tso_segs_goal is small. The minimum cwnd is 4 packets,
+  * which allows 2 outstanding 2-packet sequences, to try to keep pipe
+  * full even with ACK-every-other-packet delayed ACKs.
+  */
+ static u32 bbr_quantization_budget(struct sock *sk, u32 cwnd)
+ {
+ 	struct bbr *bbr = inet_csk_ca(sk);
++	u32 tso_segs_goal;
+ 
+-	/* Allow enough full-sized skbs in flight to utilize end systems. */
+-	cwnd += 3 * bbr_tso_segs_goal(sk);
+-
+-	/* Reduce delayed ACKs by rounding up cwnd to the next even number. */
+-	cwnd = (cwnd + 1) & ~1U;
++	tso_segs_goal = 3 * bbr_tso_segs_goal(sk);
+ 
++	/* Allow enough full-sized skbs in flight to utilize end systems. */
++	cwnd = max_t(u32, cwnd, tso_segs_goal);
++	cwnd = max_t(u32, cwnd, bbr_param(sk, cwnd_min_target));
+ 	/* Ensure gain cycling gets inflight above BDP even for small BDPs. */
+-	if (bbr->mode == BBR_PROBE_BW && bbr->cycle_idx == 0)
++	if (bbr->mode == BBR_PROBE_BW && bbr->cycle_idx == BBR_BW_PROBE_UP)
+ 		cwnd += 2;
+ 
+ 	return cwnd;
+@@ -473,10 +669,10 @@ static u32 bbr_ack_aggregation_cwnd(stru
+ {
+ 	u32 max_aggr_cwnd, aggr_cwnd = 0;
+ 
+-	if (bbr_extra_acked_gain && bbr_full_bw_reached(sk)) {
++	if (bbr_param(sk, extra_acked_gain)) {
+ 		max_aggr_cwnd = ((u64)bbr_bw(sk) * bbr_extra_acked_max_us)
+ 				/ BW_UNIT;
+-		aggr_cwnd = (bbr_extra_acked_gain * bbr_extra_acked(sk))
++		aggr_cwnd = (bbr_param(sk, extra_acked_gain) * bbr_extra_acked(sk))
+ 			     >> BBR_SCALE;
+ 		aggr_cwnd = min(aggr_cwnd, max_aggr_cwnd);
+ 	}
+@@ -484,66 +680,27 @@ static u32 bbr_ack_aggregation_cwnd(stru
+ 	return aggr_cwnd;
+ }
+ 
+-/* An optimization in BBR to reduce losses: On the first round of recovery, we
+- * follow the packet conservation principle: send P packets per P packets acked.
+- * After that, we slow-start and send at most 2*P packets per P packets acked.
+- * After recovery finishes, or upon undo, we restore the cwnd we had when
+- * recovery started (capped by the target cwnd based on estimated BDP).
+- *
+- * TODO(ycheng/ncardwell): implement a rate-based approach.
+- */
+-static bool bbr_set_cwnd_to_recover_or_restore(
+-	struct sock *sk, const struct rate_sample *rs, u32 acked, u32 *new_cwnd)
++/* Returns the cwnd for PROBE_RTT mode. */
++static u32 bbr_probe_rtt_cwnd(struct sock *sk)
+ {
+-	struct tcp_sock *tp = tcp_sk(sk);
+-	struct bbr *bbr = inet_csk_ca(sk);
+-	u8 prev_state = bbr->prev_ca_state, state = inet_csk(sk)->icsk_ca_state;
+-	u32 cwnd = tcp_snd_cwnd(tp);
+-
+-	/* An ACK for P pkts should release at most 2*P packets. We do this
+-	 * in two steps. First, here we deduct the number of lost packets.
+-	 * Then, in bbr_set_cwnd() we slow start up toward the target cwnd.
+-	 */
+-	if (rs->losses > 0)
+-		cwnd = max_t(s32, cwnd - rs->losses, 1);
+-
+-	if (state == TCP_CA_Recovery && prev_state != TCP_CA_Recovery) {
+-		/* Starting 1st round of Recovery, so do packet conservation. */
+-		bbr->packet_conservation = 1;
+-		bbr->next_rtt_delivered = tp->delivered;  /* start round now */
+-		/* Cut unused cwnd from app behavior, TSQ, or TSO deferral: */
+-		cwnd = tcp_packets_in_flight(tp) + acked;
+-	} else if (prev_state >= TCP_CA_Recovery && state < TCP_CA_Recovery) {
+-		/* Exiting loss recovery; restore cwnd saved before recovery. */
+-		cwnd = max(cwnd, bbr->prior_cwnd);
+-		bbr->packet_conservation = 0;
+-	}
+-	bbr->prev_ca_state = state;
+-
+-	if (bbr->packet_conservation) {
+-		*new_cwnd = max(cwnd, tcp_packets_in_flight(tp) + acked);
+-		return true;	/* yes, using packet conservation */
+-	}
+-	*new_cwnd = cwnd;
+-	return false;
++	return max_t(u32, bbr_param(sk, cwnd_min_target),
++		     bbr_bdp(sk, bbr_bw(sk), bbr_param(sk, probe_rtt_cwnd_gain)));
+ }
+ 
+ /* Slow-start up toward target cwnd (if bw estimate is growing, or packet loss
+  * has drawn us down below target), or snap down to target if we're above it.
+  */
+ static void bbr_set_cwnd(struct sock *sk, const struct rate_sample *rs,
+-			 u32 acked, u32 bw, int gain)
++			 u32 acked, u32 bw, int gain, u32 cwnd,
++			 struct bbr_context *ctx)
+ {
+ 	struct tcp_sock *tp = tcp_sk(sk);
+ 	struct bbr *bbr = inet_csk_ca(sk);
+-	u32 cwnd = tcp_snd_cwnd(tp), target_cwnd = 0;
++	u32 target_cwnd = 0;
+ 
+ 	if (!acked)
+ 		goto done;  /* no packet fully ACKed; just apply caps */
+ 
+-	if (bbr_set_cwnd_to_recover_or_restore(sk, rs, acked, &cwnd))
+-		goto done;
+-
+ 	target_cwnd = bbr_bdp(sk, bw, gain);
+ 
+ 	/* Increment the cwnd to account for excess ACKed data that seems
+@@ -552,74 +709,26 @@ static void bbr_set_cwnd(struct sock *sk
+ 	target_cwnd += bbr_ack_aggregation_cwnd(sk);
+ 	target_cwnd = bbr_quantization_budget(sk, target_cwnd);
+ 
+-	/* If we're below target cwnd, slow start cwnd toward target cwnd. */
+-	if (bbr_full_bw_reached(sk))  /* only cut cwnd if we filled the pipe */
+-		cwnd = min(cwnd + acked, target_cwnd);
+-	else if (cwnd < target_cwnd || tp->delivered < TCP_INIT_CWND)
+-		cwnd = cwnd + acked;
+-	cwnd = max(cwnd, bbr_cwnd_min_target);
++	/* Update cwnd and enable fast path if cwnd reaches target_cwnd. */
++	bbr->try_fast_path = 0;
++	if (bbr_full_bw_reached(sk)) { /* only cut cwnd if we filled the pipe */
++		cwnd += acked;
++		if (cwnd >= target_cwnd) {
++			cwnd = target_cwnd;
++			bbr->try_fast_path = 1;
++		}
++	} else if (cwnd < target_cwnd || cwnd  < 2 * bbr->init_cwnd) {
++		cwnd += acked;
++	} else {
++		bbr->try_fast_path = 1;
++	}
+ 
++	cwnd = max_t(u32, cwnd, bbr_param(sk, cwnd_min_target));
+ done:
+-	tcp_snd_cwnd_set(tp, min(cwnd, tp->snd_cwnd_clamp));	/* apply global cap */
++	tcp_snd_cwnd_set(tp, min(cwnd, tp->snd_cwnd_clamp));  /* global cap */
+ 	if (bbr->mode == BBR_PROBE_RTT)  /* drain queue, refresh min_rtt */
+-		tcp_snd_cwnd_set(tp, min(tcp_snd_cwnd(tp), bbr_cwnd_min_target));
+-}
+-
+-/* End cycle phase if it's time and/or we hit the phase's in-flight target. */
+-static bool bbr_is_next_cycle_phase(struct sock *sk,
+-				    const struct rate_sample *rs)
+-{
+-	struct tcp_sock *tp = tcp_sk(sk);
+-	struct bbr *bbr = inet_csk_ca(sk);
+-	bool is_full_length =
+-		tcp_stamp_us_delta(tp->delivered_mstamp, bbr->cycle_mstamp) >
+-		bbr->min_rtt_us;
+-	u32 inflight, bw;
+-
+-	/* The pacing_gain of 1.0 paces at the estimated bw to try to fully
+-	 * use the pipe without increasing the queue.
+-	 */
+-	if (bbr->pacing_gain == BBR_UNIT)
+-		return is_full_length;		/* just use wall clock time */
+-
+-	inflight = bbr_packets_in_net_at_edt(sk, rs->prior_in_flight);
+-	bw = bbr_max_bw(sk);
+-
+-	/* A pacing_gain > 1.0 probes for bw by trying to raise inflight to at
+-	 * least pacing_gain*BDP; this may take more than min_rtt if min_rtt is
+-	 * small (e.g. on a LAN). We do not persist if packets are lost, since
+-	 * a path with small buffers may not hold that much.
+-	 */
+-	if (bbr->pacing_gain > BBR_UNIT)
+-		return is_full_length &&
+-			(rs->losses ||  /* perhaps pacing_gain*BDP won't fit */
+-			 inflight >= bbr_inflight(sk, bw, bbr->pacing_gain));
+-
+-	/* A pacing_gain < 1.0 tries to drain extra queue we added if bw
+-	 * probing didn't find more bw. If inflight falls to match BDP then we
+-	 * estimate queue is drained; persisting would underutilize the pipe.
+-	 */
+-	return is_full_length ||
+-		inflight <= bbr_inflight(sk, bw, BBR_UNIT);
+-}
+-
+-static void bbr_advance_cycle_phase(struct sock *sk)
+-{
+-	struct tcp_sock *tp = tcp_sk(sk);
+-	struct bbr *bbr = inet_csk_ca(sk);
+-
+-	bbr->cycle_idx = (bbr->cycle_idx + 1) & (CYCLE_LEN - 1);
+-	bbr->cycle_mstamp = tp->delivered_mstamp;
+-}
+-
+-/* Gain cycling: cycle pacing gain to converge to fair share of available bw. */
+-static void bbr_update_cycle_phase(struct sock *sk,
+-				   const struct rate_sample *rs)
+-{
+-	struct bbr *bbr = inet_csk_ca(sk);
+-
+-	if (bbr->mode == BBR_PROBE_BW && bbr_is_next_cycle_phase(sk, rs))
+-		bbr_advance_cycle_phase(sk);
++		tcp_snd_cwnd_set(tp, min_t(u32, tcp_snd_cwnd(tp),
++					   bbr_probe_rtt_cwnd(sk)));
+ }
+ 
+ static void bbr_reset_startup_mode(struct sock *sk)
+@@ -629,191 +738,49 @@ static void bbr_reset_startup_mode(struc
+ 	bbr->mode = BBR_STARTUP;
+ }
+ 
+-static void bbr_reset_probe_bw_mode(struct sock *sk)
+-{
+-	struct bbr *bbr = inet_csk_ca(sk);
+-
+-	bbr->mode = BBR_PROBE_BW;
+-	bbr->cycle_idx = CYCLE_LEN - 1 - get_random_u32_below(bbr_cycle_rand);
+-	bbr_advance_cycle_phase(sk);	/* flip to next phase of gain cycle */
+-}
+-
+-static void bbr_reset_mode(struct sock *sk)
+-{
+-	if (!bbr_full_bw_reached(sk))
+-		bbr_reset_startup_mode(sk);
+-	else
+-		bbr_reset_probe_bw_mode(sk);
+-}
+-
+-/* Start a new long-term sampling interval. */
+-static void bbr_reset_lt_bw_sampling_interval(struct sock *sk)
+-{
+-	struct tcp_sock *tp = tcp_sk(sk);
+-	struct bbr *bbr = inet_csk_ca(sk);
+-
+-	bbr->lt_last_stamp = div_u64(tp->delivered_mstamp, USEC_PER_MSEC);
+-	bbr->lt_last_delivered = tp->delivered;
+-	bbr->lt_last_lost = tp->lost;
+-	bbr->lt_rtt_cnt = 0;
+-}
+-
+-/* Completely reset long-term bandwidth sampling. */
+-static void bbr_reset_lt_bw_sampling(struct sock *sk)
+-{
+-	struct bbr *bbr = inet_csk_ca(sk);
+-
+-	bbr->lt_bw = 0;
+-	bbr->lt_use_bw = 0;
+-	bbr->lt_is_sampling = false;
+-	bbr_reset_lt_bw_sampling_interval(sk);
+-}
+-
+-/* Long-term bw sampling interval is done. Estimate whether we're policed. */
+-static void bbr_lt_bw_interval_done(struct sock *sk, u32 bw)
+-{
+-	struct bbr *bbr = inet_csk_ca(sk);
+-	u32 diff;
+-
+-	if (bbr->lt_bw) {  /* do we have bw from a previous interval? */
+-		/* Is new bw close to the lt_bw from the previous interval? */
+-		diff = abs(bw - bbr->lt_bw);
+-		if ((diff * BBR_UNIT <= bbr_lt_bw_ratio * bbr->lt_bw) ||
+-		    (bbr_rate_bytes_per_sec(sk, diff, BBR_UNIT) <=
+-		     bbr_lt_bw_diff)) {
+-			/* All criteria are met; estimate we're policed. */
+-			bbr->lt_bw = (bw + bbr->lt_bw) >> 1;  /* avg 2 intvls */
+-			bbr->lt_use_bw = 1;
+-			bbr->pacing_gain = BBR_UNIT;  /* try to avoid drops */
+-			bbr->lt_rtt_cnt = 0;
+-			return;
+-		}
+-	}
+-	bbr->lt_bw = bw;
+-	bbr_reset_lt_bw_sampling_interval(sk);
+-}
+-
+-/* Token-bucket traffic policers are common (see "An Internet-Wide Analysis of
+- * Traffic Policing", SIGCOMM 2016). BBR detects token-bucket policers and
+- * explicitly models their policed rate, to reduce unnecessary losses. We
+- * estimate that we're policed if we see 2 consecutive sampling intervals with
+- * consistent throughput and high packet loss. If we think we're being policed,
+- * set lt_bw to the "long-term" average delivery rate from those 2 intervals.
++/* See if we have reached next round trip. Upon start of the new round,
++ * returns packets delivered since previous round start plus this ACK.
+  */
+-static void bbr_lt_bw_sampling(struct sock *sk, const struct rate_sample *rs)
++static u32 bbr_update_round_start(struct sock *sk,
++		const struct rate_sample *rs, struct bbr_context *ctx)
+ {
+ 	struct tcp_sock *tp = tcp_sk(sk);
+ 	struct bbr *bbr = inet_csk_ca(sk);
+-	u32 lost, delivered;
+-	u64 bw;
+-	u32 t;
+-
+-	if (bbr->lt_use_bw) {	/* already using long-term rate, lt_bw? */
+-		if (bbr->mode == BBR_PROBE_BW && bbr->round_start &&
+-		    ++bbr->lt_rtt_cnt >= bbr_lt_bw_max_rtts) {
+-			bbr_reset_lt_bw_sampling(sk);    /* stop using lt_bw */
+-			bbr_reset_probe_bw_mode(sk);  /* restart gain cycling */
+-		}
+-		return;
+-	}
+-
+-	/* Wait for the first loss before sampling, to let the policer exhaust
+-	 * its tokens and estimate the steady-state rate allowed by the policer.
+-	 * Starting samples earlier includes bursts that over-estimate the bw.
+-	 */
+-	if (!bbr->lt_is_sampling) {
+-		if (!rs->losses)
+-			return;
+-		bbr_reset_lt_bw_sampling_interval(sk);
+-		bbr->lt_is_sampling = true;
+-	}
+-
+-	/* To avoid underestimates, reset sampling if we run out of data. */
+-	if (rs->is_app_limited) {
+-		bbr_reset_lt_bw_sampling(sk);
+-		return;
+-	}
+-
+-	if (bbr->round_start)
+-		bbr->lt_rtt_cnt++;	/* count round trips in this interval */
+-	if (bbr->lt_rtt_cnt < bbr_lt_intvl_min_rtts)
+-		return;		/* sampling interval needs to be longer */
+-	if (bbr->lt_rtt_cnt > 4 * bbr_lt_intvl_min_rtts) {
+-		bbr_reset_lt_bw_sampling(sk);  /* interval is too long */
+-		return;
+-	}
+-
+-	/* End sampling interval when a packet is lost, so we estimate the
+-	 * policer tokens were exhausted. Stopping the sampling before the
+-	 * tokens are exhausted under-estimates the policed rate.
+-	 */
+-	if (!rs->losses)
+-		return;
+-
+-	/* Calculate packets lost and delivered in sampling interval. */
+-	lost = tp->lost - bbr->lt_last_lost;
+-	delivered = tp->delivered - bbr->lt_last_delivered;
+-	/* Is loss rate (lost/delivered) >= lt_loss_thresh? If not, wait. */
+-	if (!delivered || (lost << BBR_SCALE) < bbr_lt_loss_thresh * delivered)
+-		return;
+-
+-	/* Find average delivery rate in this sampling interval. */
+-	t = div_u64(tp->delivered_mstamp, USEC_PER_MSEC) - bbr->lt_last_stamp;
+-	if ((s32)t < 1)
+-		return;		/* interval is less than one ms, so wait */
+-	/* Check if can multiply without overflow */
+-	if (t >= ~0U / USEC_PER_MSEC) {
+-		bbr_reset_lt_bw_sampling(sk);  /* interval too long; reset */
+-		return;
+-	}
+-	t *= USEC_PER_MSEC;
+-	bw = (u64)delivered * BW_UNIT;
+-	do_div(bw, t);
+-	bbr_lt_bw_interval_done(sk, bw);
+-}
+-
+-/* Estimate the bandwidth based on how fast packets are delivered */
+-static void bbr_update_bw(struct sock *sk, const struct rate_sample *rs)
+-{
+-	struct tcp_sock *tp = tcp_sk(sk);
+-	struct bbr *bbr = inet_csk_ca(sk);
+-	u64 bw;
++	u32 round_delivered = 0;
+ 
+ 	bbr->round_start = 0;
+-	if (rs->delivered < 0 || rs->interval_us <= 0)
+-		return; /* Not a valid observation */
+ 
+ 	/* See if we've reached the next RTT */
+-	if (!before(rs->prior_delivered, bbr->next_rtt_delivered)) {
++	if (rs->interval_us > 0 &&
++	    !before(rs->prior_delivered, bbr->next_rtt_delivered)) {
++		round_delivered = tp->delivered - bbr->next_rtt_delivered;
+ 		bbr->next_rtt_delivered = tp->delivered;
+-		bbr->rtt_cnt++;
+ 		bbr->round_start = 1;
+-		bbr->packet_conservation = 0;
+ 	}
++	return round_delivered;
++}
+ 
+-	bbr_lt_bw_sampling(sk, rs);
++/* Calculate the bandwidth based on how fast packets are delivered */
++static void bbr_calculate_bw_sample(struct sock *sk,
++			const struct rate_sample *rs, struct bbr_context *ctx)
++{
++	u64 bw = 0;
+ 
+ 	/* Divide delivered by the interval to find a (lower bound) bottleneck
+ 	 * bandwidth sample. Delivered is in packets and interval_us in uS and
+ 	 * ratio will be <<1 for most connections. So delivered is first scaled.
++	 * Round up to allow growth at low rates, even with integer division.
+ 	 */
+-	bw = div64_long((u64)rs->delivered * BW_UNIT, rs->interval_us);
++	if (rs->interval_us > 0) {
++		if (WARN_ONCE(rs->delivered < 0,
++			      "negative delivered: %d interval_us: %ld\n",
++			      rs->delivered, rs->interval_us))
++			return;
+ 
+-	/* If this sample is application-limited, it is likely to have a very
+-	 * low delivered count that represents application behavior rather than
+-	 * the available network rate. Such a sample could drag down estimated
+-	 * bw, causing needless slow-down. Thus, to continue to send at the
+-	 * last measured network rate, we filter out app-limited samples unless
+-	 * they describe the path bw at least as well as our bw model.
+-	 *
+-	 * So the goal during app-limited phase is to proceed with the best
+-	 * network rate no matter how long. We automatically leave this
+-	 * phase when app writes faster than the network can deliver :)
+-	 */
+-	if (!rs->is_app_limited || bw >= bbr_max_bw(sk)) {
+-		/* Incorporate new sample into our max bw filter. */
+-		minmax_running_max(&bbr->bw, bbr_bw_rtts, bbr->rtt_cnt, bw);
++		bw = DIV_ROUND_UP_ULL((u64)rs->delivered * BW_UNIT, rs->interval_us);
+ 	}
++
++	ctx->sample_bw = bw;
+ }
+ 
+ /* Estimates the windowed max degree of ack aggregation.
+@@ -827,7 +794,7 @@ static void bbr_update_bw(struct sock *s
+  *
+  * Max extra_acked is clamped by cwnd and bw * bbr_extra_acked_max_us (100 ms).
+  * Max filter is an approximate sliding window of 5-10 (packet timed) round
+- * trips.
++ * trips for non-startup phase, and 1-2 round trips for startup.
+  */
+ static void bbr_update_ack_aggregation(struct sock *sk,
+ 				       const struct rate_sample *rs)
+@@ -835,15 +802,19 @@ static void bbr_update_ack_aggregation(s
+ 	u32 epoch_us, expected_acked, extra_acked;
+ 	struct bbr *bbr = inet_csk_ca(sk);
+ 	struct tcp_sock *tp = tcp_sk(sk);
++	u32 extra_acked_win_rtts_thresh = bbr_param(sk, extra_acked_win_rtts);
+ 
+-	if (!bbr_extra_acked_gain || rs->acked_sacked <= 0 ||
++	if (!bbr_param(sk, extra_acked_gain) || rs->acked_sacked <= 0 ||
+ 	    rs->delivered < 0 || rs->interval_us <= 0)
+ 		return;
+ 
+ 	if (bbr->round_start) {
+ 		bbr->extra_acked_win_rtts = min(0x1F,
+ 						bbr->extra_acked_win_rtts + 1);
+-		if (bbr->extra_acked_win_rtts >= bbr_extra_acked_win_rtts) {
++		if (!bbr_full_bw_reached(sk))
++			extra_acked_win_rtts_thresh = 1;
++		if (bbr->extra_acked_win_rtts >=
++		    extra_acked_win_rtts_thresh) {
+ 			bbr->extra_acked_win_rtts = 0;
+ 			bbr->extra_acked_win_idx = bbr->extra_acked_win_idx ?
+ 						   0 : 1;
+@@ -877,49 +848,6 @@ static void bbr_update_ack_aggregation(s
+ 		bbr->extra_acked[bbr->extra_acked_win_idx] = extra_acked;
+ }
+ 
+-/* Estimate when the pipe is full, using the change in delivery rate: BBR
+- * estimates that STARTUP filled the pipe if the estimated bw hasn't changed by
+- * at least bbr_full_bw_thresh (25%) after bbr_full_bw_cnt (3) non-app-limited
+- * rounds. Why 3 rounds: 1: rwin autotuning grows the rwin, 2: we fill the
+- * higher rwin, 3: we get higher delivery rate samples. Or transient
+- * cross-traffic or radio noise can go away. CUBIC Hystart shares a similar
+- * design goal, but uses delay and inter-ACK spacing instead of bandwidth.
+- */
+-static void bbr_check_full_bw_reached(struct sock *sk,
+-				      const struct rate_sample *rs)
+-{
+-	struct bbr *bbr = inet_csk_ca(sk);
+-	u32 bw_thresh;
+-
+-	if (bbr_full_bw_reached(sk) || !bbr->round_start || rs->is_app_limited)
+-		return;
+-
+-	bw_thresh = (u64)bbr->full_bw * bbr_full_bw_thresh >> BBR_SCALE;
+-	if (bbr_max_bw(sk) >= bw_thresh) {
+-		bbr->full_bw = bbr_max_bw(sk);
+-		bbr->full_bw_cnt = 0;
+-		return;
+-	}
+-	++bbr->full_bw_cnt;
+-	bbr->full_bw_reached = bbr->full_bw_cnt >= bbr_full_bw_cnt;
+-}
+-
+-/* If pipe is probably full, drain the queue and then enter steady-state. */
+-static void bbr_check_drain(struct sock *sk, const struct rate_sample *rs)
+-{
+-	struct bbr *bbr = inet_csk_ca(sk);
+-
+-	if (bbr->mode == BBR_STARTUP && bbr_full_bw_reached(sk)) {
+-		bbr->mode = BBR_DRAIN;	/* drain queue we created */
+-		tcp_sk(sk)->snd_ssthresh =
+-				bbr_inflight(sk, bbr_max_bw(sk), BBR_UNIT);
+-	}	/* fall through to check if in-flight is already small: */
+-	if (bbr->mode == BBR_DRAIN &&
+-	    bbr_packets_in_net_at_edt(sk, tcp_packets_in_flight(tcp_sk(sk))) <=
+-	    bbr_inflight(sk, bbr_max_bw(sk), BBR_UNIT))
+-		bbr_reset_probe_bw_mode(sk);  /* we estimate queue is drained */
+-}
+-
+ static void bbr_check_probe_rtt_done(struct sock *sk)
+ {
+ 	struct tcp_sock *tp = tcp_sk(sk);
+@@ -929,9 +857,9 @@ static void bbr_check_probe_rtt_done(str
+ 	      after(tcp_jiffies32, bbr->probe_rtt_done_stamp)))
+ 		return;
+ 
+-	bbr->min_rtt_stamp = tcp_jiffies32;  /* wait a while until PROBE_RTT */
++	bbr->probe_rtt_min_stamp = tcp_jiffies32; /* schedule next PROBE_RTT */
+ 	tcp_snd_cwnd_set(tp, max(tcp_snd_cwnd(tp), bbr->prior_cwnd));
+-	bbr_reset_mode(sk);
++	bbr_exit_probe_rtt(sk);
+ }
+ 
+ /* The goal of PROBE_RTT mode is to have BBR flows cooperatively and
+@@ -957,23 +885,35 @@ static void bbr_update_min_rtt(struct so
+ {
+ 	struct tcp_sock *tp = tcp_sk(sk);
+ 	struct bbr *bbr = inet_csk_ca(sk);
+-	bool filter_expired;
++	bool probe_rtt_expired, min_rtt_expired;
++	u32 expire;
+ 
+-	/* Track min RTT seen in the min_rtt_win_sec filter window: */
+-	filter_expired = after(tcp_jiffies32,
+-			       bbr->min_rtt_stamp + bbr_min_rtt_win_sec * HZ);
++	/* Track min RTT in probe_rtt_win_ms to time next PROBE_RTT state. */
++	expire = bbr->probe_rtt_min_stamp +
++		 msecs_to_jiffies(bbr_param(sk, probe_rtt_win_ms));
++	probe_rtt_expired = after(tcp_jiffies32, expire);
+ 	if (rs->rtt_us >= 0 &&
+-	    (rs->rtt_us < bbr->min_rtt_us ||
+-	     (filter_expired && !rs->is_ack_delayed))) {
+-		bbr->min_rtt_us = rs->rtt_us;
+-		bbr->min_rtt_stamp = tcp_jiffies32;
++	    (rs->rtt_us < bbr->probe_rtt_min_us ||
++	     (probe_rtt_expired && !rs->is_ack_delayed))) {
++		bbr->probe_rtt_min_us = rs->rtt_us;
++		bbr->probe_rtt_min_stamp = tcp_jiffies32;
++	}
++	/* Track min RTT seen in the min_rtt_win_sec filter window: */
++	expire = bbr->min_rtt_stamp + bbr_param(sk, min_rtt_win_sec) * HZ;
++	min_rtt_expired = after(tcp_jiffies32, expire);
++	if (bbr->probe_rtt_min_us <= bbr->min_rtt_us ||
++	    min_rtt_expired) {
++		bbr->min_rtt_us = bbr->probe_rtt_min_us;
++		bbr->min_rtt_stamp = bbr->probe_rtt_min_stamp;
+ 	}
+ 
+-	if (bbr_probe_rtt_mode_ms > 0 && filter_expired &&
++	if (bbr_param(sk, probe_rtt_mode_ms) > 0 && probe_rtt_expired &&
+ 	    !bbr->idle_restart && bbr->mode != BBR_PROBE_RTT) {
+ 		bbr->mode = BBR_PROBE_RTT;  /* dip, drain queue */
+ 		bbr_save_cwnd(sk);  /* note cwnd so we can restore it */
+ 		bbr->probe_rtt_done_stamp = 0;
++		bbr->ack_phase = BBR_ACKS_PROBE_STOPPING;
++		bbr->next_rtt_delivered = tp->delivered;
+ 	}
+ 
+ 	if (bbr->mode == BBR_PROBE_RTT) {
+@@ -982,9 +922,9 @@ static void bbr_update_min_rtt(struct so
+ 			(tp->delivered + tcp_packets_in_flight(tp)) ? : 1;
+ 		/* Maintain min packets in flight for max(200 ms, 1 round). */
+ 		if (!bbr->probe_rtt_done_stamp &&
+-		    tcp_packets_in_flight(tp) <= bbr_cwnd_min_target) {
++		    tcp_packets_in_flight(tp) <= bbr_probe_rtt_cwnd(sk)) {
+ 			bbr->probe_rtt_done_stamp = tcp_jiffies32 +
+-				msecs_to_jiffies(bbr_probe_rtt_mode_ms);
++				msecs_to_jiffies(bbr_param(sk, probe_rtt_mode_ms));
+ 			bbr->probe_rtt_round_done = 0;
+ 			bbr->next_rtt_delivered = tp->delivered;
+ 		} else if (bbr->probe_rtt_done_stamp) {
+@@ -1005,18 +945,20 @@ static void bbr_update_gains(struct sock
+ 
+ 	switch (bbr->mode) {
+ 	case BBR_STARTUP:
+-		bbr->pacing_gain = bbr_high_gain;
+-		bbr->cwnd_gain	 = bbr_high_gain;
++		bbr->pacing_gain = bbr_param(sk, startup_pacing_gain);
++		bbr->cwnd_gain	 = bbr_param(sk, startup_cwnd_gain);
+ 		break;
+ 	case BBR_DRAIN:
+-		bbr->pacing_gain = bbr_drain_gain;	/* slow, to drain */
+-		bbr->cwnd_gain	 = bbr_high_gain;	/* keep cwnd */
++		bbr->pacing_gain = bbr_param(sk, drain_gain);  /* slow, to drain */
++		bbr->cwnd_gain	 = bbr_param(sk, startup_cwnd_gain);  /* keep cwnd */
+ 		break;
+ 	case BBR_PROBE_BW:
+-		bbr->pacing_gain = (bbr->lt_use_bw ?
+-				    BBR_UNIT :
+-				    bbr_pacing_gain[bbr->cycle_idx]);
+-		bbr->cwnd_gain	 = bbr_cwnd_gain;
++		bbr->pacing_gain = bbr_pacing_gain[bbr->cycle_idx];
++		bbr->cwnd_gain	 = bbr_param(sk, cwnd_gain);
++		if (bbr_param(sk, bw_probe_cwnd_gain) &&
++		    bbr->cycle_idx == BBR_BW_PROBE_UP)
++			bbr->cwnd_gain +=
++				BBR_UNIT * bbr_param(sk, bw_probe_cwnd_gain) / 4;
+ 		break;
+ 	case BBR_PROBE_RTT:
+ 		bbr->pacing_gain = BBR_UNIT;
+@@ -1028,27 +970,1108 @@ static void bbr_update_gains(struct sock
+ 	}
+ }
+ 
+-static void bbr_update_model(struct sock *sk, const struct rate_sample *rs)
++__bpf_kfunc static u32 bbr_sndbuf_expand(struct sock *sk)
++{
++	/* Provision 3 * cwnd since BBR may slow-start even during recovery. */
++	return 3;
++}
++
++/* Incorporate a new bw sample into the current window of our max filter. */
++static void bbr_take_max_bw_sample(struct sock *sk, u32 bw)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++
++	bbr->bw_hi[1] = max(bw, bbr->bw_hi[1]);
++}
++
++/* Keep max of last 1-2 cycles. Each PROBE_BW cycle, flip filter window. */
++static void bbr_advance_max_bw_filter(struct sock *sk)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++
++	if (!bbr->bw_hi[1])
++		return;  /* no samples in this window; remember old window */
++	bbr->bw_hi[0] = bbr->bw_hi[1];
++	bbr->bw_hi[1] = 0;
++}
++
++/* Reset the estimator for reaching full bandwidth based on bw plateau. */
++static void bbr_reset_full_bw(struct sock *sk)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++
++	bbr->full_bw = 0;
++	bbr->full_bw_cnt = 0;
++	bbr->full_bw_now = 0;
++}
++
++/* How much do we want in flight? Our BDP, unless congestion cut cwnd. */
++static u32 bbr_target_inflight(struct sock *sk)
++{
++	u32 bdp = bbr_inflight(sk, bbr_bw(sk), BBR_UNIT);
++
++	return min(bdp, tcp_sk(sk)->snd_cwnd);
++}
++
++static bool bbr_is_probing_bandwidth(struct sock *sk)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++
++	return (bbr->mode == BBR_STARTUP) ||
++		(bbr->mode == BBR_PROBE_BW &&
++		 (bbr->cycle_idx == BBR_BW_PROBE_REFILL ||
++		  bbr->cycle_idx == BBR_BW_PROBE_UP));
++}
++
++/* Has the given amount of time elapsed since we marked the phase start? */
++static bool bbr_has_elapsed_in_phase(const struct sock *sk, u32 interval_us)
++{
++	const struct tcp_sock *tp = tcp_sk(sk);
++	const struct bbr *bbr = inet_csk_ca(sk);
++
++	return tcp_stamp_us_delta(tp->tcp_mstamp,
++				  bbr->cycle_mstamp + interval_us) > 0;
++}
++
++static void bbr_handle_queue_too_high_in_startup(struct sock *sk)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++	u32 bdp;  /* estimated BDP in packets, with quantization budget */
++
++	bbr->full_bw_reached = 1;
++
++	bdp = bbr_inflight(sk, bbr_max_bw(sk), BBR_UNIT);
++	bbr->inflight_hi = max(bdp, bbr->inflight_latest);
++}
++
++/* Exit STARTUP upon N consecutive rounds with ECN mark rate > ecn_thresh. */
++static void bbr_check_ecn_too_high_in_startup(struct sock *sk, u32 ce_ratio)
+ {
+-	bbr_update_bw(sk, rs);
++	struct bbr *bbr = inet_csk_ca(sk);
++
++	if (bbr_full_bw_reached(sk) || !bbr->ecn_eligible ||
++	    !bbr_param(sk, full_ecn_cnt) || !bbr_param(sk, ecn_thresh))
++		return;
++
++	if (ce_ratio >= bbr_param(sk, ecn_thresh))
++		bbr->startup_ecn_rounds++;
++	else
++		bbr->startup_ecn_rounds = 0;
++
++	if (bbr->startup_ecn_rounds >= bbr_param(sk, full_ecn_cnt)) {
++		bbr_handle_queue_too_high_in_startup(sk);
++		return;
++	}
++}
++
++/* Updates ecn_alpha and returns ce_ratio. -1 if not available. */
++static int bbr_update_ecn_alpha(struct sock *sk)
++{
++	struct tcp_sock *tp = tcp_sk(sk);
++	struct net *net = sock_net(sk);
++	struct bbr *bbr = inet_csk_ca(sk);
++	s32 delivered, delivered_ce;
++	u64 alpha, ce_ratio;
++	u32 gain;
++	bool want_ecn_alpha;
++
++	/* See if we should use ECN sender logic for this connection. */
++	if (!bbr->ecn_eligible && bbr_can_use_ecn(sk) &&
++	    bbr_param(sk, ecn_factor) &&
++	    (bbr->min_rtt_us <= bbr_ecn_max_rtt_us ||
++	     !bbr_ecn_max_rtt_us))
++		bbr->ecn_eligible = 1;
++
++	/* Skip updating alpha only if not ECN-eligible and PLB is disabled. */
++	want_ecn_alpha = (bbr->ecn_eligible ||
++			  (bbr_can_use_ecn(sk) &&
++			   READ_ONCE(net->ipv4.sysctl_tcp_plb_enabled)));
++	if (!want_ecn_alpha)
++		return -1;
++
++	delivered = tp->delivered - bbr->alpha_last_delivered;
++	delivered_ce = tp->delivered_ce - bbr->alpha_last_delivered_ce;
++
++	if (delivered == 0 ||		/* avoid divide by zero */
++	    WARN_ON_ONCE(delivered < 0 || delivered_ce < 0))  /* backwards? */
++		return -1;
++
++	BUILD_BUG_ON(BBR_SCALE != TCP_PLB_SCALE);
++	ce_ratio = (u64)delivered_ce << BBR_SCALE;
++	do_div(ce_ratio, delivered);
++
++	gain = bbr_param(sk, ecn_alpha_gain);
++	alpha = ((BBR_UNIT - gain) * bbr->ecn_alpha) >> BBR_SCALE;
++	alpha += (gain * ce_ratio) >> BBR_SCALE;
++	bbr->ecn_alpha = min_t(u32, alpha, BBR_UNIT);
++
++	bbr->alpha_last_delivered = tp->delivered;
++	bbr->alpha_last_delivered_ce = tp->delivered_ce;
++
++	bbr_check_ecn_too_high_in_startup(sk, ce_ratio);
++	return (int)ce_ratio;
++}
++
++/* Protective Load Balancing (PLB). PLB rehashes outgoing data (to a new IPv6
++ * flow label) if it encounters sustained congestion in the form of ECN marks.
++ */
++static void bbr_plb(struct sock *sk, const struct rate_sample *rs, int ce_ratio)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++
++	if (bbr->round_start && ce_ratio >= 0)
++		tcp_plb_update_state(sk, &bbr->plb, ce_ratio);
++
++	tcp_plb_check_rehash(sk, &bbr->plb);
++}
++
++/* Each round trip of BBR_BW_PROBE_UP, double volume of probing data. */
++static void bbr_raise_inflight_hi_slope(struct sock *sk)
++{
++	struct tcp_sock *tp = tcp_sk(sk);
++	struct bbr *bbr = inet_csk_ca(sk);
++	u32 growth_this_round, cnt;
++
++	/* Calculate "slope": packets S/Acked per inflight_hi increment. */
++	growth_this_round = 1 << bbr->bw_probe_up_rounds;
++	bbr->bw_probe_up_rounds = min(bbr->bw_probe_up_rounds + 1, 30);
++	cnt = tcp_snd_cwnd(tp) / growth_this_round;
++	cnt = max(cnt, 1U);
++	bbr->bw_probe_up_cnt = cnt;
++}
++
++/* In BBR_BW_PROBE_UP, not seeing high loss/ECN/queue, so raise inflight_hi. */
++static void bbr_probe_inflight_hi_upward(struct sock *sk,
++					  const struct rate_sample *rs)
++{
++	struct tcp_sock *tp = tcp_sk(sk);
++	struct bbr *bbr = inet_csk_ca(sk);
++	u32 delta;
++
++	if (!tp->is_cwnd_limited || tcp_snd_cwnd(tp) < bbr->inflight_hi)
++		return;  /* not fully using inflight_hi, so don't grow it */
++
++	/* For each bw_probe_up_cnt packets ACKed, increase inflight_hi by 1. */
++	bbr->bw_probe_up_acks += rs->acked_sacked;
++	if (bbr->bw_probe_up_acks >=  bbr->bw_probe_up_cnt) {
++		delta = bbr->bw_probe_up_acks / bbr->bw_probe_up_cnt;
++		bbr->bw_probe_up_acks -= delta * bbr->bw_probe_up_cnt;
++		bbr->inflight_hi += delta;
++		bbr->try_fast_path = 0;  /* Need to update cwnd */
++	}
++
++	if (bbr->round_start)
++		bbr_raise_inflight_hi_slope(sk);
++}
++
++/* Does loss/ECN rate for this sample say inflight is "too high"?
++ * This is used by both the bbr_check_loss_too_high_in_startup() function,
++ * which can be used in either v1 or v2, and the PROBE_UP phase of v2, which
++ * uses it to notice when loss/ECN rates suggest inflight is too high.
++ */
++static bool bbr_is_inflight_too_high(const struct sock *sk,
++				      const struct rate_sample *rs)
++{
++	const struct bbr *bbr = inet_csk_ca(sk);
++	u32 loss_thresh, ecn_thresh;
++
++	if (rs->lost > 0 && rs->tx_in_flight) {
++		loss_thresh = (u64)rs->tx_in_flight * bbr_param(sk, loss_thresh) >>
++				BBR_SCALE;
++		if (rs->lost > loss_thresh) {
++			return true;
++		}
++	}
++
++	if (rs->delivered_ce > 0 && rs->delivered > 0 &&
++	    bbr->ecn_eligible && bbr_param(sk, ecn_thresh)) {
++		ecn_thresh = (u64)rs->delivered * bbr_param(sk, ecn_thresh) >>
++				BBR_SCALE;
++		if (rs->delivered_ce > ecn_thresh) {
++			return true;
++		}
++	}
++
++	return false;
++}
++
++/* Calculate the tx_in_flight level that corresponded to excessive loss.
++ * We find "lost_prefix" segs of the skb where loss rate went too high,
++ * by solving for "lost_prefix" in the following equation:
++ *   lost                     /  inflight                     >= loss_thresh
++ *  (lost_prev + lost_prefix) / (inflight_prev + lost_prefix) >= loss_thresh
++ * Then we take that equation, convert it to fixed point, and
++ * round up to the nearest packet.
++ */
++static u32 bbr_inflight_hi_from_lost_skb(const struct sock *sk,
++					  const struct rate_sample *rs,
++					  const struct sk_buff *skb)
++{
++	const struct tcp_sock *tp = tcp_sk(sk);
++	u32 loss_thresh  = bbr_param(sk, loss_thresh);
++	u32 pcount, divisor, inflight_hi;
++	s32 inflight_prev, lost_prev;
++	u64 loss_budget, lost_prefix;
++
++	pcount = tcp_skb_pcount(skb);
++
++	/* How much data was in flight before this skb? */
++	inflight_prev = rs->tx_in_flight - pcount;
++	if (inflight_prev < 0) {
++		WARN_ONCE(tcp_skb_tx_in_flight_is_suspicious(
++				  pcount,
++				  TCP_SKB_CB(skb)->sacked,
++				  rs->tx_in_flight),
++			  "tx_in_flight: %u pcount: %u reneg: %u",
++			  rs->tx_in_flight, pcount, tcp_sk(sk)->is_sack_reneg);
++		return ~0U;
++	}
++
++	/* How much inflight data was marked lost before this skb? */
++	lost_prev = rs->lost - pcount;
++	if (WARN_ONCE(lost_prev < 0,
++		      "cwnd: %u ca: %d out: %u lost: %u pif: %u "
++		      "tx_in_flight: %u tx.lost: %u tp->lost: %u rs->lost: %d "
++		      "lost_prev: %d pcount: %d seq: %u end_seq: %u reneg: %u",
++		      tcp_snd_cwnd(tp), inet_csk(sk)->icsk_ca_state,
++		      tp->packets_out, tp->lost_out, tcp_packets_in_flight(tp),
++		      rs->tx_in_flight, TCP_SKB_CB(skb)->tx.lost, tp->lost,
++		      rs->lost, lost_prev, pcount,
++		      TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
++		      tp->is_sack_reneg))
++		return ~0U;
++
++	/* At what prefix of this lost skb did losss rate exceed loss_thresh? */
++	loss_budget = (u64)inflight_prev * loss_thresh + BBR_UNIT - 1;
++	loss_budget >>= BBR_SCALE;
++	if (lost_prev >= loss_budget) {
++		lost_prefix = 0;   /* previous losses crossed loss_thresh */
++	} else {
++		lost_prefix = loss_budget - lost_prev;
++		lost_prefix <<= BBR_SCALE;
++		divisor = BBR_UNIT - loss_thresh;
++		if (WARN_ON_ONCE(!divisor))  /* loss_thresh is 8 bits */
++			return ~0U;
++		do_div(lost_prefix, divisor);
++	}
++
++	inflight_hi = inflight_prev + lost_prefix;
++	return inflight_hi;
++}
++
++/* If loss/ECN rates during probing indicated we may have overfilled a
++ * buffer, return an operating point that tries to leave unutilized headroom in
++ * the path for other flows, for fairness convergence and lower RTTs and loss.
++ */
++static u32 bbr_inflight_with_headroom(const struct sock *sk)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++	u32 headroom, headroom_fraction;
++
++	if (bbr->inflight_hi == ~0U)
++		return ~0U;
++
++	headroom_fraction = bbr_param(sk, inflight_headroom);
++	headroom = ((u64)bbr->inflight_hi * headroom_fraction) >> BBR_SCALE;
++	headroom = max(headroom, 1U);
++	return max_t(s32, bbr->inflight_hi - headroom,
++		     bbr_param(sk, cwnd_min_target));
++}
++
++/* Bound cwnd to a sensible level, based on our current probing state
++ * machine phase and model of a good inflight level (inflight_lo, inflight_hi).
++ */
++static void bbr_bound_cwnd_for_inflight_model(struct sock *sk)
++{
++	struct tcp_sock *tp = tcp_sk(sk);
++	struct bbr *bbr = inet_csk_ca(sk);
++	u32 cap;
++
++	/* tcp_rcv_synsent_state_process() currently calls tcp_ack()
++	 * and thus cong_control() without first initializing us(!).
++	 */
++	if (!bbr->initialized)
++		return;
++
++	cap = ~0U;
++	if (bbr->mode == BBR_PROBE_BW &&
++	    bbr->cycle_idx != BBR_BW_PROBE_CRUISE) {
++		/* Probe to see if more packets fit in the path. */
++		cap = bbr->inflight_hi;
++	} else {
++		if (bbr->mode == BBR_PROBE_RTT ||
++		    (bbr->mode == BBR_PROBE_BW &&
++		     bbr->cycle_idx == BBR_BW_PROBE_CRUISE))
++			cap = bbr_inflight_with_headroom(sk);
++	}
++	/* Adapt to any loss/ECN since our last bw probe. */
++	cap = min(cap, bbr->inflight_lo);
++
++	cap = max_t(u32, cap, bbr_param(sk, cwnd_min_target));
++	tcp_snd_cwnd_set(tp, min(cap, tcp_snd_cwnd(tp)));
++}
++
++/* How should we multiplicatively cut bw or inflight limits based on ECN? */
++static u32 bbr_ecn_cut(struct sock *sk)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++
++	return BBR_UNIT -
++		((bbr->ecn_alpha * bbr_param(sk, ecn_factor)) >> BBR_SCALE);
++}
++
++/* Init lower bounds if have not inited yet. */
++static void bbr_init_lower_bounds(struct sock *sk, bool init_bw)
++{
++	struct tcp_sock *tp = tcp_sk(sk);
++	struct bbr *bbr = inet_csk_ca(sk);
++
++	if (init_bw && bbr->bw_lo == ~0U)
++		bbr->bw_lo = bbr_max_bw(sk);
++	if (bbr->inflight_lo == ~0U)
++		bbr->inflight_lo = tcp_snd_cwnd(tp);
++}
++
++/* Reduce bw and inflight to (1 - beta). */
++static void bbr_loss_lower_bounds(struct sock *sk, u32 *bw, u32 *inflight)
++{
++	struct bbr* bbr = inet_csk_ca(sk);
++	u32 loss_cut = BBR_UNIT - bbr_param(sk, beta);
++
++	*bw = max_t(u32, bbr->bw_latest,
++		    (u64)bbr->bw_lo * loss_cut >> BBR_SCALE);
++	*inflight = max_t(u32, bbr->inflight_latest,
++			  (u64)bbr->inflight_lo * loss_cut >> BBR_SCALE);
++}
++
++/* Reduce inflight to (1 - alpha*ecn_factor). */
++static void bbr_ecn_lower_bounds(struct sock *sk, u32 *inflight)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++	u32 ecn_cut = bbr_ecn_cut(sk);
++
++	*inflight = (u64)bbr->inflight_lo * ecn_cut >> BBR_SCALE;
++}
++
++/* Estimate a short-term lower bound on the capacity available now, based
++ * on measurements of the current delivery process and recent history. When we
++ * are seeing loss/ECN at times when we are not probing bw, then conservatively
++ * move toward flow balance by multiplicatively cutting our short-term
++ * estimated safe rate and volume of data (bw_lo and inflight_lo). We use a
++ * multiplicative decrease in order to converge to a lower capacity in time
++ * logarithmic in the magnitude of the decrease.
++ *
++ * However, we do not cut our short-term estimates lower than the current rate
++ * and volume of delivered data from this round trip, since from the current
++ * delivery process we can estimate the measured capacity available now.
++ *
++ * Anything faster than that approach would knowingly risk high loss, which can
++ * cause low bw for Reno/CUBIC and high loss recovery latency for
++ * request/response flows using any congestion control.
++ */
++static void bbr_adapt_lower_bounds(struct sock *sk,
++				    const struct rate_sample *rs)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++	u32 ecn_inflight_lo = ~0U;
++
++	/* We only use lower-bound estimates when not probing bw.
++	 * When probing we need to push inflight higher to probe bw.
++	 */
++	if (bbr_is_probing_bandwidth(sk))
++		return;
++
++	/* ECN response. */
++	if (bbr->ecn_in_round && bbr_param(sk, ecn_factor)) {
++		bbr_init_lower_bounds(sk, false);
++		bbr_ecn_lower_bounds(sk, &ecn_inflight_lo);
++	}
++
++	/* Loss response. */
++	if (bbr->loss_in_round) {
++		bbr_init_lower_bounds(sk, true);
++		bbr_loss_lower_bounds(sk, &bbr->bw_lo, &bbr->inflight_lo);
++	}
++
++	/* Adjust to the lower of the levels implied by loss/ECN. */
++	bbr->inflight_lo = min(bbr->inflight_lo, ecn_inflight_lo);
++	bbr->bw_lo = max(1U, bbr->bw_lo);
++}
++
++/* Reset any short-term lower-bound adaptation to congestion, so that we can
++ * push our inflight up.
++ */
++static void bbr_reset_lower_bounds(struct sock *sk)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++
++	bbr->bw_lo = ~0U;
++	bbr->inflight_lo = ~0U;
++}
++
++/* After bw probing (STARTUP/PROBE_UP), reset signals before entering a state
++ * machine phase where we adapt our lower bound based on congestion signals.
++ */
++static void bbr_reset_congestion_signals(struct sock *sk)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++
++	bbr->loss_in_round = 0;
++	bbr->ecn_in_round = 0;
++	bbr->loss_in_cycle = 0;
++	bbr->ecn_in_cycle = 0;
++	bbr->bw_latest = 0;
++	bbr->inflight_latest = 0;
++}
++
++static void bbr_exit_loss_recovery(struct sock *sk)
++{
++	struct tcp_sock *tp = tcp_sk(sk);
++	struct bbr *bbr = inet_csk_ca(sk);
++
++	tcp_snd_cwnd_set(tp, max(tcp_snd_cwnd(tp), bbr->prior_cwnd));
++	bbr->try_fast_path = 0; /* bound cwnd using latest model */
++}
++
++/* Update rate and volume of delivered data from latest round trip. */
++static void bbr_update_latest_delivery_signals(
++	struct sock *sk, const struct rate_sample *rs, struct bbr_context *ctx)
++{
++	struct tcp_sock *tp = tcp_sk(sk);
++	struct bbr *bbr = inet_csk_ca(sk);
++
++	bbr->loss_round_start = 0;
++	if (rs->interval_us <= 0 || !rs->acked_sacked)
++		return; /* Not a valid observation */
++
++	bbr->bw_latest       = max_t(u32, bbr->bw_latest,       ctx->sample_bw);
++	bbr->inflight_latest = max_t(u32, bbr->inflight_latest, rs->delivered);
++
++	if (!before(rs->prior_delivered, bbr->loss_round_delivered)) {
++		bbr->loss_round_delivered = tp->delivered;
++		bbr->loss_round_start = 1;  /* mark start of new round trip */
++	}
++}
++
++/* Once per round, reset filter for latest rate and volume of delivered data. */
++static void bbr_advance_latest_delivery_signals(
++	struct sock *sk, const struct rate_sample *rs, struct bbr_context *ctx)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++
++	/* If ACK matches a TLP retransmit, persist the filter. If we detect
++	 * that a TLP retransmit plugged a tail loss, we'll want to remember
++	 * how much data the path delivered before the tail loss.
++	 */
++	if (bbr->loss_round_start && !rs->is_acking_tlp_retrans_seq) {
++		bbr->bw_latest = ctx->sample_bw;
++		bbr->inflight_latest = rs->delivered;
++	}
++}
++
++/* Update (most of) our congestion signals: track the recent rate and volume of
++ * delivered data, presence of loss, and EWMA degree of ECN marking.
++ */
++static void bbr_update_congestion_signals(
++	struct sock *sk, const struct rate_sample *rs, struct bbr_context *ctx)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++	u64 bw;
++
++	if (rs->interval_us <= 0 || !rs->acked_sacked)
++		return; /* Not a valid observation */
++	bw = ctx->sample_bw;
++
++	if (!rs->is_app_limited || bw >= bbr_max_bw(sk))
++		bbr_take_max_bw_sample(sk, bw);
++
++	bbr->loss_in_round |= (rs->losses > 0);
++
++	if (!bbr->loss_round_start)
++		return;		/* skip the per-round-trip updates */
++	/* Now do per-round-trip updates. */
++	bbr_adapt_lower_bounds(sk, rs);
++
++	bbr->loss_in_round = 0;
++	bbr->ecn_in_round  = 0;
++}
++
++/* Bandwidth probing can cause loss. To help coexistence with loss-based
++ * congestion control we spread out our probing in a Reno-conscious way. Due to
++ * the shape of the Reno sawtooth, the time required between loss epochs for an
++ * idealized Reno flow is a number of round trips that is the BDP of that
++ * flow. We count packet-timed round trips directly, since measured RTT can
++ * vary widely, and Reno is driven by packet-timed round trips.
++ */
++static bool bbr_is_reno_coexistence_probe_time(struct sock *sk)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++	u32 rounds;
++
++	/* Random loss can shave some small percentage off of our inflight
++	 * in each round. To survive this, flows need robust periodic probes.
++	 */
++	rounds = min_t(u32, bbr_param(sk, bw_probe_max_rounds), bbr_target_inflight(sk));
++	return bbr->rounds_since_probe >= rounds;
++}
++
++/* How long do we want to wait before probing for bandwidth (and risking
++ * loss)? We randomize the wait, for better mixing and fairness convergence.
++ *
++ * We bound the Reno-coexistence inter-bw-probe time to be 62-63 round trips.
++ * This is calculated to allow fairness with a 25Mbps, 30ms Reno flow,
++ * (eg 4K video to a broadband user):
++ *   BDP = 25Mbps * .030sec /(1514bytes) = 61.9 packets
++ *
++ * We bound the BBR-native inter-bw-probe wall clock time to be:
++ *  (a) higher than 2 sec: to try to avoid causing loss for a long enough time
++ *      to allow Reno at 30ms to get 4K video bw, the inter-bw-probe time must
++ *      be at least: 25Mbps * .030sec / (1514bytes) * 0.030sec = 1.9secs
++ *  (b) lower than 3 sec: to ensure flows can start probing in a reasonable
++ *      amount of time to discover unutilized bw on human-scale interactive
++ *      time-scales (e.g. perhaps traffic from a web page download that we
++ *      were competing with is now complete).
++ */
++static void bbr_pick_probe_wait(struct sock *sk)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++
++	/* Decide the random round-trip bound for wait until probe: */
++	bbr->rounds_since_probe =
++		get_random_u32_below(bbr_param(sk, bw_probe_rand_rounds));
++	/* Decide the random wall clock bound for wait until probe: */
++	bbr->probe_wait_us = bbr_param(sk, bw_probe_base_us) +
++			     get_random_u32_below(bbr_param(sk, bw_probe_rand_us));
++}
++
++static void bbr_set_cycle_idx(struct sock *sk, int cycle_idx)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++
++	bbr->cycle_idx = cycle_idx;
++	/* New phase, so need to update cwnd and pacing rate. */
++	bbr->try_fast_path = 0;
++}
++
++/* Send at estimated bw to fill the pipe, but not queue. We need this phase
++ * before PROBE_UP, because as soon as we send faster than the available bw
++ * we will start building a queue, and if the buffer is shallow we can cause
++ * loss. If we do not fill the pipe before we cause this loss, our bw_hi and
++ * inflight_hi estimates will underestimate.
++ */
++static void bbr_start_bw_probe_refill(struct sock *sk, u32 bw_probe_up_rounds)
++{
++	struct tcp_sock *tp = tcp_sk(sk);
++	struct bbr *bbr = inet_csk_ca(sk);
++
++	bbr_reset_lower_bounds(sk);
++	bbr->bw_probe_up_rounds = bw_probe_up_rounds;
++	bbr->bw_probe_up_acks = 0;
++	bbr->stopped_risky_probe = 0;
++	bbr->ack_phase = BBR_ACKS_REFILLING;
++	bbr->next_rtt_delivered = tp->delivered;
++	bbr_set_cycle_idx(sk, BBR_BW_PROBE_REFILL);
++}
++
++/* Now probe max deliverable data rate and volume. */
++static void bbr_start_bw_probe_up(struct sock *sk, struct bbr_context *ctx)
++{
++	struct tcp_sock *tp = tcp_sk(sk);
++	struct bbr *bbr = inet_csk_ca(sk);
++
++	bbr->ack_phase = BBR_ACKS_PROBE_STARTING;
++	bbr->next_rtt_delivered = tp->delivered;
++	bbr->cycle_mstamp = tp->tcp_mstamp;
++	bbr_reset_full_bw(sk);
++	bbr->full_bw = ctx->sample_bw;
++	bbr_set_cycle_idx(sk, BBR_BW_PROBE_UP);
++	bbr_raise_inflight_hi_slope(sk);
++}
++
++/* Start a new PROBE_BW probing cycle of some wall clock length. Pick a wall
++ * clock time at which to probe beyond an inflight that we think to be
++ * safe. This will knowingly risk packet loss, so we want to do this rarely, to
++ * keep packet loss rates low. Also start a round-trip counter, to probe faster
++ * if we estimate a Reno flow at our BDP would probe faster.
++ */
++static void bbr_start_bw_probe_down(struct sock *sk)
++{
++	struct tcp_sock *tp = tcp_sk(sk);
++	struct bbr *bbr = inet_csk_ca(sk);
++
++	bbr_reset_congestion_signals(sk);
++	bbr->bw_probe_up_cnt = ~0U;     /* not growing inflight_hi any more */
++	bbr_pick_probe_wait(sk);
++	bbr->cycle_mstamp = tp->tcp_mstamp;		/* start wall clock */
++	bbr->ack_phase = BBR_ACKS_PROBE_STOPPING;
++	bbr->next_rtt_delivered = tp->delivered;
++	bbr_set_cycle_idx(sk, BBR_BW_PROBE_DOWN);
++}
++
++/* Cruise: maintain what we estimate to be a neutral, conservative
++ * operating point, without attempting to probe up for bandwidth or down for
++ * RTT, and only reducing inflight in response to loss/ECN signals.
++ */
++static void bbr_start_bw_probe_cruise(struct sock *sk)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++
++	if (bbr->inflight_lo != ~0U)
++		bbr->inflight_lo = min(bbr->inflight_lo, bbr->inflight_hi);
++
++	bbr_set_cycle_idx(sk, BBR_BW_PROBE_CRUISE);
++}
++
++/* Loss and/or ECN rate is too high while probing.
++ * Adapt (once per bw probe) by cutting inflight_hi and then restarting cycle.
++ */
++static void bbr_handle_inflight_too_high(struct sock *sk,
++					  const struct rate_sample *rs)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++	const u32 beta = bbr_param(sk, beta);
++
++	bbr->prev_probe_too_high = 1;
++	bbr->bw_probe_samples = 0;  /* only react once per probe */
++	/* If we are app-limited then we are not robustly
++	 * probing the max volume of inflight data we think
++	 * might be safe (analogous to how app-limited bw
++	 * samples are not known to be robustly probing bw).
++	 */
++	if (!rs->is_app_limited) {
++		bbr->inflight_hi = max_t(u32, rs->tx_in_flight,
++					 (u64)bbr_target_inflight(sk) *
++					 (BBR_UNIT - beta) >> BBR_SCALE);
++	}
++	if (bbr->mode == BBR_PROBE_BW && bbr->cycle_idx == BBR_BW_PROBE_UP)
++		bbr_start_bw_probe_down(sk);
++}
++
++/* If we're seeing bw and loss samples reflecting our bw probing, adapt
++ * using the signals we see. If loss or ECN mark rate gets too high, then adapt
++ * inflight_hi downward. If we're able to push inflight higher without such
++ * signals, push higher: adapt inflight_hi upward.
++ */
++static bool bbr_adapt_upper_bounds(struct sock *sk,
++				    const struct rate_sample *rs,
++				    struct bbr_context *ctx)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++
++	/* Track when we'll see bw/loss samples resulting from our bw probes. */
++	if (bbr->ack_phase == BBR_ACKS_PROBE_STARTING && bbr->round_start)
++		bbr->ack_phase = BBR_ACKS_PROBE_FEEDBACK;
++	if (bbr->ack_phase == BBR_ACKS_PROBE_STOPPING && bbr->round_start) {
++		/* End of samples from bw probing phase. */
++		bbr->bw_probe_samples = 0;
++		bbr->ack_phase = BBR_ACKS_INIT;
++		/* At this point in the cycle, our current bw sample is also
++		 * our best recent chance at finding the highest available bw
++		 * for this flow. So now is the best time to forget the bw
++		 * samples from the previous cycle, by advancing the window.
++		 */
++		if (bbr->mode == BBR_PROBE_BW && !rs->is_app_limited)
++			bbr_advance_max_bw_filter(sk);
++		/* If we had an inflight_hi, then probed and pushed inflight all
++		 * the way up to hit that inflight_hi without seeing any
++		 * high loss/ECN in all the resulting ACKs from that probing,
++		 * then probe up again, this time letting inflight persist at
++		 * inflight_hi for a round trip, then accelerating beyond.
++		 */
++		if (bbr->mode == BBR_PROBE_BW &&
++		    bbr->stopped_risky_probe && !bbr->prev_probe_too_high) {
++			bbr_start_bw_probe_refill(sk, 0);
++			return true;  /* yes, decided state transition */
++		}
++	}
++	if (bbr_is_inflight_too_high(sk, rs)) {
++		if (bbr->bw_probe_samples)  /*  sample is from bw probing? */
++			bbr_handle_inflight_too_high(sk, rs);
++	} else {
++		/* Loss/ECN rate is declared safe. Adjust upper bound upward. */
++
++		if (bbr->inflight_hi == ~0U)
++			return false;   /* no excess queue signals yet */
++
++		/* To be resilient to random loss, we must raise bw/inflight_hi
++		 * if we observe in any phase that a higher level is safe.
++		 */
++		if (rs->tx_in_flight > bbr->inflight_hi) {
++			bbr->inflight_hi = rs->tx_in_flight;
++		}
++
++		if (bbr->mode == BBR_PROBE_BW &&
++		    bbr->cycle_idx == BBR_BW_PROBE_UP)
++			bbr_probe_inflight_hi_upward(sk, rs);
++	}
++
++	return false;
++}
++
++/* Check if it's time to probe for bandwidth now, and if so, kick it off. */
++static bool bbr_check_time_to_probe_bw(struct sock *sk,
++					const struct rate_sample *rs)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++	u32 n;
++
++	/* If we seem to be at an operating point where we are not seeing loss
++	 * but we are seeing ECN marks, then when the ECN marks cease we reprobe
++	 * quickly (in case cross-traffic has ceased and freed up bw).
++	 */
++	if (bbr_param(sk, ecn_reprobe_gain) && bbr->ecn_eligible &&
++	    bbr->ecn_in_cycle && !bbr->loss_in_cycle &&
++	    inet_csk(sk)->icsk_ca_state == TCP_CA_Open) {
++		/* Calculate n so that when bbr_raise_inflight_hi_slope()
++		 * computes growth_this_round as 2^n it will be roughly the
++		 * desired volume of data (inflight_hi*ecn_reprobe_gain).
++		 */
++		n = ilog2((((u64)bbr->inflight_hi *
++			    bbr_param(sk, ecn_reprobe_gain)) >> BBR_SCALE));
++		bbr_start_bw_probe_refill(sk, n);
++		return true;
++	}
++
++	if (bbr_has_elapsed_in_phase(sk, bbr->probe_wait_us) ||
++	    bbr_is_reno_coexistence_probe_time(sk)) {
++		bbr_start_bw_probe_refill(sk, 0);
++		return true;
++	}
++	return false;
++}
++
++/* Is it time to transition from PROBE_DOWN to PROBE_CRUISE? */
++static bool bbr_check_time_to_cruise(struct sock *sk, u32 inflight, u32 bw)
++{
++	/* Always need to pull inflight down to leave headroom in queue. */
++	if (inflight > bbr_inflight_with_headroom(sk))
++		return false;
++
++	return inflight <= bbr_inflight(sk, bw, BBR_UNIT);
++}
++
++/* PROBE_BW state machine: cruise, refill, probe for bw, or drain? */
++static void bbr_update_cycle_phase(struct sock *sk,
++				    const struct rate_sample *rs,
++				    struct bbr_context *ctx)
++{
++	struct tcp_sock *tp = tcp_sk(sk);
++	struct bbr *bbr = inet_csk_ca(sk);
++	bool is_bw_probe_done = false;
++	u32 inflight, bw;
++
++	if (!bbr_full_bw_reached(sk))
++		return;
++
++	/* In DRAIN, PROBE_BW, or PROBE_RTT, adjust upper bounds. */
++	if (bbr_adapt_upper_bounds(sk, rs, ctx))
++		return;		/* already decided state transition */
++
++	if (bbr->mode != BBR_PROBE_BW)
++		return;
++
++	inflight = bbr_packets_in_net_at_edt(sk, rs->prior_in_flight);
++	bw = bbr_max_bw(sk);
++
++	switch (bbr->cycle_idx) {
++	/* First we spend most of our time cruising with a pacing_gain of 1.0,
++	 * which paces at the estimated bw, to try to fully use the pipe
++	 * without building queue. If we encounter loss/ECN marks, we adapt
++	 * by slowing down.
++	 */
++	case BBR_BW_PROBE_CRUISE:
++		if (bbr_check_time_to_probe_bw(sk, rs))
++			return;		/* already decided state transition */
++		break;
++
++	/* After cruising, when it's time to probe, we first "refill": we send
++	 * at the estimated bw to fill the pipe, before probing higher and
++	 * knowingly risking overflowing the bottleneck buffer (causing loss).
++	 */
++	case BBR_BW_PROBE_REFILL:
++		if (bbr->round_start) {
++			/* After one full round trip of sending in REFILL, we
++			 * start to see bw samples reflecting our REFILL, which
++			 * may be putting too much data in flight.
++			 */
++			bbr->bw_probe_samples = 1;
++			bbr_start_bw_probe_up(sk, ctx);
++		}
++		break;
++
++	/* After we refill the pipe, we probe by using a pacing_gain > 1.0, to
++	 * probe for bw. If we have not seen loss/ECN, we try to raise inflight
++	 * to at least pacing_gain*BDP; note that this may take more than
++	 * min_rtt if min_rtt is small (e.g. on a LAN).
++	 *
++	 * We terminate PROBE_UP bandwidth probing upon any of the following:
++	 *
++	 * (1) We've pushed inflight up to hit the inflight_hi target set in the
++	 *     most recent previous bw probe phase. Thus we want to start
++	 *     draining the queue immediately because it's very likely the most
++	 *     recently sent packets will fill the queue and cause drops.
++	 * (2) If inflight_hi has not limited bandwidth growth recently, and
++	 *     yet delivered bandwidth has not increased much recently
++	 *     (bbr->full_bw_now).
++	 * (3) Loss filter says loss rate is "too high".
++	 * (4) ECN filter says ECN mark rate is "too high".
++	 *
++	 * (1) (2) checked here, (3) (4) checked in bbr_is_inflight_too_high()
++	 */
++	case BBR_BW_PROBE_UP:
++		if (bbr->prev_probe_too_high &&
++		    inflight >= bbr->inflight_hi) {
++			bbr->stopped_risky_probe = 1;
++			is_bw_probe_done = true;
++		} else {
++			if (tp->is_cwnd_limited &&
++			    tcp_snd_cwnd(tp) >= bbr->inflight_hi) {
++				/* inflight_hi is limiting bw growth */
++				bbr_reset_full_bw(sk);
++				bbr->full_bw = ctx->sample_bw;
++			} else if (bbr->full_bw_now) {
++				/* Plateau in estimated bw. Pipe looks full. */
++				is_bw_probe_done = true;
++			}
++		}
++		if (is_bw_probe_done) {
++			bbr->prev_probe_too_high = 0;  /* no loss/ECN (yet) */
++			bbr_start_bw_probe_down(sk);  /* restart w/ down */
++		}
++		break;
++
++	/* After probing in PROBE_UP, we have usually accumulated some data in
++	 * the bottleneck buffer (if bw probing didn't find more bw). We next
++	 * enter PROBE_DOWN to try to drain any excess data from the queue. To
++	 * do this, we use a pacing_gain < 1.0. We hold this pacing gain until
++	 * our inflight is less then that target cruising point, which is the
++	 * minimum of (a) the amount needed to leave headroom, and (b) the
++	 * estimated BDP. Once inflight falls to match the target, we estimate
++	 * the queue is drained; persisting would underutilize the pipe.
++	 */
++	case BBR_BW_PROBE_DOWN:
++		if (bbr_check_time_to_probe_bw(sk, rs))
++			return;		/* already decided state transition */
++		if (bbr_check_time_to_cruise(sk, inflight, bw))
++			bbr_start_bw_probe_cruise(sk);
++		break;
++
++	default:
++		WARN_ONCE(1, "BBR invalid cycle index %u\n", bbr->cycle_idx);
++	}
++}
++
++/* Exiting PROBE_RTT, so return to bandwidth probing in STARTUP or PROBE_BW. */
++static void bbr_exit_probe_rtt(struct sock *sk)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++
++	bbr_reset_lower_bounds(sk);
++	if (bbr_full_bw_reached(sk)) {
++		bbr->mode = BBR_PROBE_BW;
++		/* Raising inflight after PROBE_RTT may cause loss, so reset
++		 * the PROBE_BW clock and schedule the next bandwidth probe for
++		 * a friendly and randomized future point in time.
++		 */
++		bbr_start_bw_probe_down(sk);
++		/* Since we are exiting PROBE_RTT, we know inflight is
++		 * below our estimated BDP, so it is reasonable to cruise.
++		 */
++		bbr_start_bw_probe_cruise(sk);
++	} else {
++		bbr->mode = BBR_STARTUP;
++	}
++}
++
++/* Exit STARTUP based on loss rate > 1% and loss gaps in round >= N. Wait until
++ * the end of the round in recovery to get a good estimate of how many packets
++ * have been lost, and how many we need to drain with a low pacing rate.
++ */
++static void bbr_check_loss_too_high_in_startup(struct sock *sk,
++						const struct rate_sample *rs)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++
++	if (bbr_full_bw_reached(sk))
++		return;
++
++	/* For STARTUP exit, check the loss rate at the end of each round trip
++	 * of Recovery episodes in STARTUP. We check the loss rate at the end
++	 * of the round trip to filter out noisy/low loss and have a better
++	 * sense of inflight (extent of loss), so we can drain more accurately.
++	 */
++	if (rs->losses && bbr->loss_events_in_round < 0xf)
++		bbr->loss_events_in_round++;  /* update saturating counter */
++	if (bbr_param(sk, full_loss_cnt) && bbr->loss_round_start &&
++	    inet_csk(sk)->icsk_ca_state == TCP_CA_Recovery &&
++	    bbr->loss_events_in_round >= bbr_param(sk, full_loss_cnt) &&
++	    bbr_is_inflight_too_high(sk, rs)) {
++		bbr_handle_queue_too_high_in_startup(sk);
++		return;
++	}
++	if (bbr->loss_round_start)
++		bbr->loss_events_in_round = 0;
++}
++
++/* Estimate when the pipe is full, using the change in delivery rate: BBR
++ * estimates bw probing filled the pipe if the estimated bw hasn't changed by
++ * at least bbr_full_bw_thresh (25%) after bbr_full_bw_cnt (3) non-app-limited
++ * rounds. Why 3 rounds: 1: rwin autotuning grows the rwin, 2: we fill the
++ * higher rwin, 3: we get higher delivery rate samples. Or transient
++ * cross-traffic or radio noise can go away. CUBIC Hystart shares a similar
++ * design goal, but uses delay and inter-ACK spacing instead of bandwidth.
++ */
++static void bbr_check_full_bw_reached(struct sock *sk,
++				       const struct rate_sample *rs,
++				       struct bbr_context *ctx)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++	u32 bw_thresh, full_cnt, thresh;
++
++	if (bbr->full_bw_now || rs->is_app_limited)
++		return;
++
++	thresh = bbr_param(sk, full_bw_thresh);
++	full_cnt = bbr_param(sk, full_bw_cnt);
++	bw_thresh = (u64)bbr->full_bw * thresh >> BBR_SCALE;
++	if (ctx->sample_bw >= bw_thresh) {
++		bbr_reset_full_bw(sk);
++		bbr->full_bw = ctx->sample_bw;
++		return;
++	}
++	if (!bbr->round_start)
++		return;
++	++bbr->full_bw_cnt;
++	bbr->full_bw_now = bbr->full_bw_cnt >= full_cnt;
++	bbr->full_bw_reached |= bbr->full_bw_now;
++}
++
++/* If pipe is probably full, drain the queue and then enter steady-state. */
++static void bbr_check_drain(struct sock *sk, const struct rate_sample *rs,
++			    struct bbr_context *ctx)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++
++	if (bbr->mode == BBR_STARTUP && bbr_full_bw_reached(sk)) {
++		bbr->mode = BBR_DRAIN;	/* drain queue we created */
++		/* Set ssthresh to export purely for monitoring, to signal
++		 * completion of initial STARTUP by setting to a non-
++		 * TCP_INFINITE_SSTHRESH value (ssthresh is not used by BBR).
++		 */
++		tcp_sk(sk)->snd_ssthresh =
++				bbr_inflight(sk, bbr_max_bw(sk), BBR_UNIT);
++		bbr_reset_congestion_signals(sk);
++	}	/* fall through to check if in-flight is already small: */
++	if (bbr->mode == BBR_DRAIN &&
++	    bbr_packets_in_net_at_edt(sk, tcp_packets_in_flight(tcp_sk(sk))) <=
++	    bbr_inflight(sk, bbr_max_bw(sk), BBR_UNIT)) {
++		bbr->mode = BBR_PROBE_BW;
++		bbr_start_bw_probe_down(sk);
++	}
++}
++
++static void bbr_update_model(struct sock *sk, const struct rate_sample *rs,
++			      struct bbr_context *ctx)
++{
++	bbr_update_congestion_signals(sk, rs, ctx);
+ 	bbr_update_ack_aggregation(sk, rs);
+-	bbr_update_cycle_phase(sk, rs);
+-	bbr_check_full_bw_reached(sk, rs);
+-	bbr_check_drain(sk, rs);
++	bbr_check_loss_too_high_in_startup(sk, rs);
++	bbr_check_full_bw_reached(sk, rs, ctx);
++	bbr_check_drain(sk, rs, ctx);
++	bbr_update_cycle_phase(sk, rs, ctx);
+ 	bbr_update_min_rtt(sk, rs);
+-	bbr_update_gains(sk);
++}
++
++/* Fast path for app-limited case.
++ *
++ * On each ack, we execute bbr state machine, which primarily consists of:
++ * 1) update model based on new rate sample, and
++ * 2) update control based on updated model or state change.
++ *
++ * There are certain workload/scenarios, e.g. app-limited case, where
++ * either we can skip updating model or we can skip update of both model
++ * as well as control. This provides signifcant softirq cpu savings for
++ * processing incoming acks.
++ *
++ * In case of app-limited, if there is no congestion (loss/ecn) and
++ * if observed bw sample is less than current estimated bw, then we can
++ * skip some of the computation in bbr state processing:
++ *
++ * - if there is no rtt/mode/phase change: In this case, since all the
++ *   parameters of the network model are constant, we can skip model
++ *   as well control update.
++ *
++ * - else we can skip rest of the model update. But we still need to
++ *   update the control to account for the new rtt/mode/phase.
++ *
++ * Returns whether we can take fast path or not.
++ */
++static bool bbr_run_fast_path(struct sock *sk, bool *update_model,
++		const struct rate_sample *rs, struct bbr_context *ctx)
++{
++	struct bbr *bbr = inet_csk_ca(sk);
++	u32 prev_min_rtt_us, prev_mode;
++
++	if (bbr_param(sk, fast_path) && bbr->try_fast_path &&
++	    rs->is_app_limited && ctx->sample_bw < bbr_max_bw(sk) &&
++	    !bbr->loss_in_round && !bbr->ecn_in_round ) {
++		prev_mode = bbr->mode;
++		prev_min_rtt_us = bbr->min_rtt_us;
++		bbr_check_drain(sk, rs, ctx);
++		bbr_update_cycle_phase(sk, rs, ctx);
++		bbr_update_min_rtt(sk, rs);
++
++		if (bbr->mode == prev_mode &&
++		    bbr->min_rtt_us == prev_min_rtt_us &&
++		    bbr->try_fast_path) {
++			return true;
++		}
++
++		/* Skip model update, but control still needs to be updated */
++		*update_model = false;
++	}
++	return false;
+ }
+ 
+ __bpf_kfunc static void bbr_main(struct sock *sk, u32 ack, int flag, const struct rate_sample *rs)
+ {
++	struct tcp_sock *tp = tcp_sk(sk);
+ 	struct bbr *bbr = inet_csk_ca(sk);
+-	u32 bw;
++	struct bbr_context ctx = { 0 };
++	bool update_model = true;
++	u32 bw, round_delivered;
++	int ce_ratio = -1;
++
++	round_delivered = bbr_update_round_start(sk, rs, &ctx);
++	if (bbr->round_start) {
++		bbr->rounds_since_probe =
++			min_t(s32, bbr->rounds_since_probe + 1, 0xFF);
++		ce_ratio = bbr_update_ecn_alpha(sk);
++	}
++	bbr_plb(sk, rs, ce_ratio);
++
++	bbr->ecn_in_round  |= (bbr->ecn_eligible && rs->is_ece);
++	bbr_calculate_bw_sample(sk, rs, &ctx);
++	bbr_update_latest_delivery_signals(sk, rs, &ctx);
+ 
+-	bbr_update_model(sk, rs);
++	if (bbr_run_fast_path(sk, &update_model, rs, &ctx))
++		goto out;
+ 
++	if (update_model)
++		bbr_update_model(sk, rs, &ctx);
++
++	bbr_update_gains(sk);
+ 	bw = bbr_bw(sk);
+ 	bbr_set_pacing_rate(sk, bw, bbr->pacing_gain);
+-	bbr_set_cwnd(sk, rs, rs->acked_sacked, bw, bbr->cwnd_gain);
++	bbr_set_cwnd(sk, rs, rs->acked_sacked, bw, bbr->cwnd_gain,
++		     tcp_snd_cwnd(tp), &ctx);
++	bbr_bound_cwnd_for_inflight_model(sk);
++
++out:
++	bbr_advance_latest_delivery_signals(sk, rs, &ctx);
++	bbr->prev_ca_state = inet_csk(sk)->icsk_ca_state;
++	bbr->loss_in_cycle |= rs->lost > 0;
++	bbr->ecn_in_cycle  |= rs->delivered_ce > 0;
+ }
+ 
+ __bpf_kfunc static void bbr_init(struct sock *sk)
+@@ -1056,20 +2079,21 @@ __bpf_kfunc static void bbr_init(struct
+ 	struct tcp_sock *tp = tcp_sk(sk);
+ 	struct bbr *bbr = inet_csk_ca(sk);
+ 
+-	bbr->prior_cwnd = 0;
++	bbr->initialized = 1;
++
++	bbr->init_cwnd = min(0x7FU, tcp_snd_cwnd(tp));
++	bbr->prior_cwnd = tp->prior_cwnd;
+ 	tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
+-	bbr->rtt_cnt = 0;
+ 	bbr->next_rtt_delivered = tp->delivered;
+ 	bbr->prev_ca_state = TCP_CA_Open;
+-	bbr->packet_conservation = 0;
+ 
+ 	bbr->probe_rtt_done_stamp = 0;
+ 	bbr->probe_rtt_round_done = 0;
++	bbr->probe_rtt_min_us = tcp_min_rtt(tp);
++	bbr->probe_rtt_min_stamp = tcp_jiffies32;
+ 	bbr->min_rtt_us = tcp_min_rtt(tp);
+ 	bbr->min_rtt_stamp = tcp_jiffies32;
+ 
+-	minmax_reset(&bbr->bw, bbr->rtt_cnt, 0);  /* init max bw to 0 */
+-
+ 	bbr->has_seen_rtt = 0;
+ 	bbr_init_pacing_rate_from_rtt(sk);
+ 
+@@ -1080,7 +2104,7 @@ __bpf_kfunc static void bbr_init(struct
+ 	bbr->full_bw_cnt = 0;
+ 	bbr->cycle_mstamp = 0;
+ 	bbr->cycle_idx = 0;
+-	bbr_reset_lt_bw_sampling(sk);
++
+ 	bbr_reset_startup_mode(sk);
+ 
+ 	bbr->ack_epoch_mstamp = tp->tcp_mstamp;
+@@ -1090,78 +2114,236 @@ __bpf_kfunc static void bbr_init(struct
+ 	bbr->extra_acked[0] = 0;
+ 	bbr->extra_acked[1] = 0;
+ 
++	bbr->ce_state = 0;
++	bbr->prior_rcv_nxt = tp->rcv_nxt;
++	bbr->try_fast_path = 0;
++
+ 	cmpxchg(&sk->sk_pacing_status, SK_PACING_NONE, SK_PACING_NEEDED);
++
++	/* Start sampling ECN mark rate after first full flight is ACKed: */
++	bbr->loss_round_delivered = tp->delivered + 1;
++	bbr->loss_round_start = 0;
++	bbr->undo_bw_lo = 0;
++	bbr->undo_inflight_lo = 0;
++	bbr->undo_inflight_hi = 0;
++	bbr->loss_events_in_round = 0;
++	bbr->startup_ecn_rounds = 0;
++	bbr_reset_congestion_signals(sk);
++	bbr->bw_lo = ~0U;
++	bbr->bw_hi[0] = 0;
++	bbr->bw_hi[1] = 0;
++	bbr->inflight_lo = ~0U;
++	bbr->inflight_hi = ~0U;
++	bbr_reset_full_bw(sk);
++	bbr->bw_probe_up_cnt = ~0U;
++	bbr->bw_probe_up_acks = 0;
++	bbr->bw_probe_up_rounds = 0;
++	bbr->probe_wait_us = 0;
++	bbr->stopped_risky_probe = 0;
++	bbr->ack_phase = BBR_ACKS_INIT;
++	bbr->rounds_since_probe = 0;
++	bbr->bw_probe_samples = 0;
++	bbr->prev_probe_too_high = 0;
++	bbr->ecn_eligible = 0;
++	bbr->ecn_alpha = bbr_param(sk, ecn_alpha_init);
++	bbr->alpha_last_delivered = 0;
++	bbr->alpha_last_delivered_ce = 0;
++	bbr->plb.pause_until = 0;
++
++	tp->fast_ack_mode = bbr_fast_ack_mode ? 1 : 0;
+ }
+ 
+-__bpf_kfunc static u32 bbr_sndbuf_expand(struct sock *sk)
++/* BBR marks the current round trip as a loss round. */
++static void bbr_note_loss(struct sock *sk)
+ {
+-	/* Provision 3 * cwnd since BBR may slow-start even during recovery. */
+-	return 3;
++	struct tcp_sock *tp = tcp_sk(sk);
++	struct bbr *bbr = inet_csk_ca(sk);
++
++	/* Capture "current" data over the full round trip of loss, to
++	 * have a better chance of observing the full capacity of the path.
++	 */
++	if (!bbr->loss_in_round)  /* first loss in this round trip? */
++		bbr->loss_round_delivered = tp->delivered;  /* set round trip */
++	bbr->loss_in_round = 1;
++	bbr->loss_in_cycle = 1;
+ }
+ 
+-/* In theory BBR does not need to undo the cwnd since it does not
+- * always reduce cwnd on losses (see bbr_main()). Keep it for now.
+- */
++/* Core TCP stack informs us that the given skb was just marked lost. */
++__bpf_kfunc static void bbr_skb_marked_lost(struct sock *sk,
++					    const struct sk_buff *skb)
++{
++	struct tcp_sock *tp = tcp_sk(sk);
++	struct bbr *bbr = inet_csk_ca(sk);
++	struct tcp_skb_cb *scb = TCP_SKB_CB(skb);
++	struct rate_sample rs = {};
++
++	bbr_note_loss(sk);
++
++	if (!bbr->bw_probe_samples)
++		return;  /* not an skb sent while probing for bandwidth */
++	if (unlikely(!scb->tx.delivered_mstamp))
++		return;  /* skb was SACKed, reneged, marked lost; ignore it */
++	/* We are probing for bandwidth. Construct a rate sample that
++	 * estimates what happened in the flight leading up to this lost skb,
++	 * then see if the loss rate went too high, and if so at which packet.
++	 */
++	rs.tx_in_flight = scb->tx.in_flight;
++	rs.lost = tp->lost - scb->tx.lost;
++	rs.is_app_limited = scb->tx.is_app_limited;
++	if (bbr_is_inflight_too_high(sk, &rs)) {
++		rs.tx_in_flight = bbr_inflight_hi_from_lost_skb(sk, &rs, skb);
++		bbr_handle_inflight_too_high(sk, &rs);
++	}
++}
++
++static void bbr_run_loss_probe_recovery(struct sock *sk)
++{
++	struct tcp_sock *tp = tcp_sk(sk);
++	struct bbr *bbr = inet_csk_ca(sk);
++	struct rate_sample rs = {0};
++
++	bbr_note_loss(sk);
++
++	if (!bbr->bw_probe_samples)
++		return;  /* not sent while probing for bandwidth */
++	/* We are probing for bandwidth. Construct a rate sample that
++	 * estimates what happened in the flight leading up to this
++	 * loss, then see if the loss rate went too high.
++	 */
++	rs.lost = 1;	/* TLP probe repaired loss of a single segment */
++	rs.tx_in_flight = bbr->inflight_latest + rs.lost;
++	rs.is_app_limited = tp->tlp_orig_data_app_limited;
++	if (bbr_is_inflight_too_high(sk, &rs))
++		bbr_handle_inflight_too_high(sk, &rs);
++}
++
++/* Revert short-term model if current loss recovery event was spurious. */
+ __bpf_kfunc static u32 bbr_undo_cwnd(struct sock *sk)
+ {
+ 	struct bbr *bbr = inet_csk_ca(sk);
+ 
+-	bbr->full_bw = 0;   /* spurious slow-down; reset full pipe detection */
+-	bbr->full_bw_cnt = 0;
+-	bbr_reset_lt_bw_sampling(sk);
+-	return tcp_snd_cwnd(tcp_sk(sk));
++	bbr_reset_full_bw(sk); /* spurious slow-down; reset full bw detector */
++	bbr->loss_in_round = 0;
++
++	/* Revert to cwnd and other state saved before loss episode. */
++	bbr->bw_lo = max(bbr->bw_lo, bbr->undo_bw_lo);
++	bbr->inflight_lo = max(bbr->inflight_lo, bbr->undo_inflight_lo);
++	bbr->inflight_hi = max(bbr->inflight_hi, bbr->undo_inflight_hi);
++	bbr->try_fast_path = 0;  /* take slow path to set proper cwnd, pacing */
++	return bbr->prior_cwnd;
+ }
+ 
+-/* Entering loss recovery, so save cwnd for when we exit or undo recovery. */
++/* Entering loss recovery, so save state for when we undo recovery. */
+ __bpf_kfunc static u32 bbr_ssthresh(struct sock *sk)
+ {
++	struct bbr *bbr = inet_csk_ca(sk);
++
+ 	bbr_save_cwnd(sk);
++	/* For undo, save state that adapts based on loss signal. */
++	bbr->undo_bw_lo		= bbr->bw_lo;
++	bbr->undo_inflight_lo	= bbr->inflight_lo;
++	bbr->undo_inflight_hi	= bbr->inflight_hi;
+ 	return tcp_sk(sk)->snd_ssthresh;
+ }
+ 
++static enum tcp_bbr_phase bbr_get_phase(struct bbr *bbr)
++{
++	switch (bbr->mode) {
++	case BBR_STARTUP:
++		return BBR_PHASE_STARTUP;
++	case BBR_DRAIN:
++		return BBR_PHASE_DRAIN;
++	case BBR_PROBE_BW:
++		break;
++	case BBR_PROBE_RTT:
++		return BBR_PHASE_PROBE_RTT;
++	default:
++		return BBR_PHASE_INVALID;
++	}
++	switch (bbr->cycle_idx) {
++	case BBR_BW_PROBE_UP:
++		return BBR_PHASE_PROBE_BW_UP;
++	case BBR_BW_PROBE_DOWN:
++		return BBR_PHASE_PROBE_BW_DOWN;
++	case BBR_BW_PROBE_CRUISE:
++		return BBR_PHASE_PROBE_BW_CRUISE;
++	case BBR_BW_PROBE_REFILL:
++		return BBR_PHASE_PROBE_BW_REFILL;
++	default:
++		return BBR_PHASE_INVALID;
++	}
++}
++
+ static size_t bbr_get_info(struct sock *sk, u32 ext, int *attr,
+-			   union tcp_cc_info *info)
++			    union tcp_cc_info *info)
+ {
+ 	if (ext & (1 << (INET_DIAG_BBRINFO - 1)) ||
+ 	    ext & (1 << (INET_DIAG_VEGASINFO - 1))) {
+-		struct tcp_sock *tp = tcp_sk(sk);
+ 		struct bbr *bbr = inet_csk_ca(sk);
+-		u64 bw = bbr_bw(sk);
+-
+-		bw = bw * tp->mss_cache * USEC_PER_SEC >> BW_SCALE;
+-		memset(&info->bbr, 0, sizeof(info->bbr));
+-		info->bbr.bbr_bw_lo		= (u32)bw;
+-		info->bbr.bbr_bw_hi		= (u32)(bw >> 32);
+-		info->bbr.bbr_min_rtt		= bbr->min_rtt_us;
+-		info->bbr.bbr_pacing_gain	= bbr->pacing_gain;
+-		info->bbr.bbr_cwnd_gain		= bbr->cwnd_gain;
++		u64 bw = bbr_bw_bytes_per_sec(sk, bbr_bw(sk));
++		u64 bw_hi = bbr_bw_bytes_per_sec(sk, bbr_max_bw(sk));
++		u64 bw_lo = bbr->bw_lo == ~0U ?
++			~0ULL : bbr_bw_bytes_per_sec(sk, bbr->bw_lo);
++		struct tcp_bbr_info *bbr_info = &info->bbr;
++
++		memset(bbr_info, 0, sizeof(*bbr_info));
++		bbr_info->bbr_bw_lo		= (u32)bw;
++		bbr_info->bbr_bw_hi		= (u32)(bw >> 32);
++		bbr_info->bbr_min_rtt		= bbr->min_rtt_us;
++		bbr_info->bbr_pacing_gain	= bbr->pacing_gain;
++		bbr_info->bbr_cwnd_gain		= bbr->cwnd_gain;
++		bbr_info->bbr_bw_hi_lsb		= (u32)bw_hi;
++		bbr_info->bbr_bw_hi_msb		= (u32)(bw_hi >> 32);
++		bbr_info->bbr_bw_lo_lsb		= (u32)bw_lo;
++		bbr_info->bbr_bw_lo_msb		= (u32)(bw_lo >> 32);
++		bbr_info->bbr_mode		= bbr->mode;
++		bbr_info->bbr_phase		= (__u8)bbr_get_phase(bbr);
++		bbr_info->bbr_version		= (__u8)BBR_VERSION;
++		bbr_info->bbr_inflight_lo	= bbr->inflight_lo;
++		bbr_info->bbr_inflight_hi	= bbr->inflight_hi;
++		bbr_info->bbr_extra_acked	= bbr_extra_acked(sk);
+ 		*attr = INET_DIAG_BBRINFO;
+-		return sizeof(info->bbr);
++		return sizeof(*bbr_info);
+ 	}
+ 	return 0;
+ }
+ 
+ __bpf_kfunc static void bbr_set_state(struct sock *sk, u8 new_state)
+ {
++	struct tcp_sock *tp = tcp_sk(sk);
+ 	struct bbr *bbr = inet_csk_ca(sk);
+ 
+ 	if (new_state == TCP_CA_Loss) {
+-		struct rate_sample rs = { .losses = 1 };
+ 
+ 		bbr->prev_ca_state = TCP_CA_Loss;
+-		bbr->full_bw = 0;
+-		bbr->round_start = 1;	/* treat RTO like end of a round */
+-		bbr_lt_bw_sampling(sk, &rs);
++		tcp_plb_update_state_upon_rto(sk, &bbr->plb);
++		/* The tcp_write_timeout() call to sk_rethink_txhash() likely
++		 * repathed this flow, so re-learn the min network RTT on the
++		 * new path:
++		 */
++		bbr_reset_full_bw(sk);
++		if (!bbr_is_probing_bandwidth(sk) && bbr->inflight_lo == ~0U) {
++			/* bbr_adapt_lower_bounds() needs cwnd before
++			 * we suffered an RTO, to update inflight_lo:
++			 */
++			bbr->inflight_lo =
++				max(tcp_snd_cwnd(tp), bbr->prior_cwnd);
++		}
++	} else if (bbr->prev_ca_state == TCP_CA_Loss &&
++		   new_state != TCP_CA_Loss) {
++		bbr_exit_loss_recovery(sk);
+ 	}
+ }
+ 
++
+ static struct tcp_congestion_ops tcp_bbr_cong_ops __read_mostly = {
+-	.flags		= TCP_CONG_NON_RESTRICTED,
++	.flags		= TCP_CONG_NON_RESTRICTED | TCP_CONG_WANTS_CE_EVENTS,
+ 	.name		= "bbr",
+ 	.owner		= THIS_MODULE,
+ 	.init		= bbr_init,
+ 	.cong_control	= bbr_main,
+ 	.sndbuf_expand	= bbr_sndbuf_expand,
++	.skb_marked_lost = bbr_skb_marked_lost,
+ 	.undo_cwnd	= bbr_undo_cwnd,
+ 	.cwnd_event	= bbr_cwnd_event,
+ 	.ssthresh	= bbr_ssthresh,
+@@ -1174,10 +2356,11 @@ BTF_KFUNCS_START(tcp_bbr_check_kfunc_ids
+ BTF_ID_FLAGS(func, bbr_init)
+ BTF_ID_FLAGS(func, bbr_main)
+ BTF_ID_FLAGS(func, bbr_sndbuf_expand)
++BTF_ID_FLAGS(func, bbr_skb_marked_lost)
+ BTF_ID_FLAGS(func, bbr_undo_cwnd)
+ BTF_ID_FLAGS(func, bbr_cwnd_event)
+ BTF_ID_FLAGS(func, bbr_ssthresh)
+-BTF_ID_FLAGS(func, bbr_min_tso_segs)
++BTF_ID_FLAGS(func, bbr_tso_segs)
+ BTF_ID_FLAGS(func, bbr_set_state)
+ BTF_KFUNCS_END(tcp_bbr_check_kfunc_ids)
+ 
+@@ -1210,5 +2393,12 @@ MODULE_AUTHOR("Van Jacobson <vanj@google
+ MODULE_AUTHOR("Neal Cardwell <ncardwell@google.com>");
+ MODULE_AUTHOR("Yuchung Cheng <ycheng@google.com>");
+ MODULE_AUTHOR("Soheil Hassas Yeganeh <soheil@google.com>");
++MODULE_AUTHOR("Priyaranjan Jha <priyarjha@google.com>");
++MODULE_AUTHOR("Yousuk Seung <ysseung@google.com>");
++MODULE_AUTHOR("Kevin Yang <yyd@google.com>");
++MODULE_AUTHOR("Arjun Roy <arjunroy@google.com>");
++MODULE_AUTHOR("David Morley <morleyd@google.com>");
++
+ MODULE_LICENSE("Dual BSD/GPL");
+ MODULE_DESCRIPTION("TCP BBR (Bottleneck Bandwidth and RTT)");
++MODULE_VERSION(__stringify(BBR_VERSION));
+From 34211656d13a329fe2adbf7d9932c805338062b7 Mon Sep 17 00:00:00 2001
+From: Adithya Abraham Philip <abrahamphilip@google.com>
+Date: Fri, 11 Jun 2021 21:56:10 +0000
+Subject: [PATCH 17/19] net-tcp_bbr: v3: ensure ECN-enabled BBR flows set ECT
+ on retransmits
+
+Adds a new flag TCP_ECN_ECT_PERMANENT that is used by CCAs to
+indicate that retransmitted packets and pure ACKs must have the
+ECT bit set. This is necessary for BBR, which when using
+ECN expects ECT to be set even on retransmitted packets and ACKs.
+
+Previous to this addition of TCP_ECN_ECT_PERMANENT, CCAs which can use
+ECN but don't "need" it did not have a way to indicate that ECT should
+be set on retransmissions/ACKs.
+
+Signed-off-by: Adithya Abraham Philip <abrahamphilip@google.com>
+Signed-off-by: Neal Cardwell <ncardwell@google.com>
+Change-Id: I8b048eaab35e136fe6501ef6cd89fd9faa15e6d2
+Signed-off-by: Alexandre Frade <kernel@xanmod.org>
+---
+ include/net/tcp.h     | 1 +
+ net/ipv4/tcp_bbr.c    | 3 +++
+ net/ipv4/tcp_output.c | 3 ++-
+ 3 files changed, 6 insertions(+), 1 deletion(-)
+
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -376,6 +376,7 @@ static inline void tcp_dec_quickack_mode
+ #define	TCP_ECN_DEMAND_CWR	4
+ #define	TCP_ECN_SEEN		8
+ #define	TCP_ECN_LOW		16
++#define	TCP_ECN_ECT_PERMANENT	32
+ 
+ enum tcp_tw_status {
+ 	TCP_TW_SUCCESS = 0,
+--- a/net/ipv4/tcp_bbr.c
++++ b/net/ipv4/tcp_bbr.c
+@@ -2151,6 +2151,9 @@ __bpf_kfunc static void bbr_init(struct
+ 	bbr->plb.pause_until = 0;
+ 
+ 	tp->fast_ack_mode = bbr_fast_ack_mode ? 1 : 0;
++
++	if (bbr_can_use_ecn(sk))
++		tp->ecn_flags |= TCP_ECN_ECT_PERMANENT;
+ }
+ 
+ /* BBR marks the current round trip as a loss round. */
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -390,7 +390,8 @@ static void tcp_ecn_send(struct sock *sk
+ 				th->cwr = 1;
+ 				skb_shinfo(skb)->gso_type |= SKB_GSO_TCP_ECN;
+ 			}
+-		} else if (!tcp_ca_needs_ecn(sk)) {
++		} else if (!(tp->ecn_flags & TCP_ECN_ECT_PERMANENT) &&
++			!tcp_ca_needs_ecn(sk)) {
+ 			/* ACK or retransmitted segment: clear ECT|CE */
+ 			INET_ECN_dontxmit(sk);
+ 		}
+From 9d940cabd1eed8cdfa009d1530255578a1acd43c Mon Sep 17 00:00:00 2001
+From: Neal Cardwell <ncardwell@google.com>
+Date: Sun, 23 Jul 2023 23:25:34 -0400
+Subject: [PATCH 18/19] tcp: export TCPI_OPT_ECN_LOW in tcp_info tcpi_options
+ field
+
+Analogous to other important ECN information, export TCPI_OPT_ECN_LOW
+in tcp_info tcpi_options field.
+
+Signed-off-by: Neal Cardwell <ncardwell@google.com>
+Change-Id: I08d8d8c7e8780e6e37df54038ee50301ac5a0320
+Signed-off-by: Alexandre Frade <kernel@xanmod.org>
+---
+ include/uapi/linux/tcp.h | 1 +
+ net/ipv4/tcp.c           | 2 ++
+ 2 files changed, 3 insertions(+)
+
+--- a/include/uapi/linux/tcp.h
++++ b/include/uapi/linux/tcp.h
+@@ -178,6 +178,7 @@ enum tcp_fastopen_client_fail {
+ #define TCPI_OPT_ECN_SEEN	16 /* we received at least one packet with ECT */
+ #define TCPI_OPT_SYN_DATA	32 /* SYN-ACK acked data in SYN sent or rcvd */
+ #define TCPI_OPT_USEC_TS	64 /* usec timestamps */
++#define TCPI_OPT_ECN_LOW	128 /* Low-latency ECN configured at init */
+ 
+ /*
+  * Sender's congestion state indicating normal or abnormal situations
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -3850,6 +3850,8 @@ void tcp_get_info(struct sock *sk, struc
+ 		info->tcpi_options |= TCPI_OPT_ECN;
+ 	if (tp->ecn_flags & TCP_ECN_SEEN)
+ 		info->tcpi_options |= TCPI_OPT_ECN_SEEN;
++	if (tp->ecn_flags & TCP_ECN_LOW)
++		info->tcpi_options |= TCPI_OPT_ECN_LOW;
+ 	if (tp->syn_data_acked)
+ 		info->tcpi_options |= TCPI_OPT_SYN_DATA;
+ 	if (tp->tcp_usec_ts)
+From 98a0fa5ab307df750c73790f9db0ce883af26982 Mon Sep 17 00:00:00 2001
+From: Oleksandr Natalenko <oleksandr@natalenko.name>
+Date: Mon, 22 Jan 2024 20:21:40 +0100
+Subject: [PATCH 19/19] x86/cfi,bpf: Add tso_segs and skb_marked_lost to
+ bpf_struct_ops CFI
+
+---
+ net/ipv4/bpf_tcp_ca.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/bpf_tcp_ca.c
++++ b/net/ipv4/bpf_tcp_ca.c
+@@ -305,11 +305,15 @@ static void bpf_tcp_ca_pkts_acked(struct
+ {
+ }
+ 
+-static u32 bpf_tcp_ca_min_tso_segs(struct sock *sk)
++static u32 bpf_tcp_ca_tso_segs(struct sock *sk, unsigned int mss_now)
+ {
+ 	return 0;
+ }
+ 
++static void bpf_tcp_ca_skb_marked_lost(struct sock *sk, const struct sk_buff *skb)
++{
++}
++
+ static void bpf_tcp_ca_cong_control(struct sock *sk, u32 ack, int flag,
+ 				    const struct rate_sample *rs)
+ {
+@@ -340,7 +344,8 @@ static struct tcp_congestion_ops __bpf_o
+ 	.cwnd_event = bpf_tcp_ca_cwnd_event,
+ 	.in_ack_event = bpf_tcp_ca_in_ack_event,
+ 	.pkts_acked = bpf_tcp_ca_pkts_acked,
+-	.min_tso_segs = bpf_tcp_ca_min_tso_segs,
++	.tso_segs = bpf_tcp_ca_tso_segs,
++	.skb_marked_lost = bpf_tcp_ca_skb_marked_lost,
+ 	.cong_control = bpf_tcp_ca_cong_control,
+ 	.undo_cwnd = bpf_tcp_ca_undo_cwnd,
+ 	.sndbuf_expand = bpf_tcp_ca_sndbuf_expand,
diff --git a/6.12/target/linux/generic/hack-6.12/998-LRNG.patch b/6.12/target/linux/generic/hack-6.12/998-LRNG.patch
new file mode 100644
index 00000000..3fe1db6a
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/998-LRNG.patch
@@ -0,0 +1,14106 @@
+From a736ccf49716dde80660d93f32358b455662d1e1 Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Tue, 25 Apr 2023 22:22:44 +0200
+Subject: [PATCH 01/25] LRNG: Entropy Source and DRNG Manager
+
+The kernel crypto API contains deterministic random number generators
+(DRNG) which a caller must seed and reseed. The task of seeding a DRNG
+is a non-trivial task requiring the consideration of a significant
+number of aspects. The Entropy Source and DRNG Manager (ESDM) fills
+that gap to transparently seed and reseed DRNGs. A user of the ESDM
+obtains random numbers from an appropriately seeded and initialized
+DRNG. Further, the ESDM controls various entropy sources guaranteeing
+that they are properly initialized and managed.
+
+The ESDM consists of two main parts:
+
+- The entropy source (ES) manager implemented in lrng_es_mgr.c
+  controls the available entropy sources including pulling appropritate
+  amount of data from them for the DRNG manager.
+
+- The DRNG manager provided with lrng_drng_mgr.c controls the DRNG(s)
+  and ensures proper seeding and reseeding.
+
+The entropy source manager controls the entropy sources registered in
+the lrng_es array. The entropy sources provide a function pointer data
+structure that is used to obtain the services from it.
+
+The ES manager triggers the initial seeding of the DRNGs during boot
+time in three stages:
+
+1. The DRNG is seeded from the entropy sources if all entropy sources
+   collectively have at least 32 bits of entropy available. The goal
+   of this step is to ensure that the DRNG receive some initial entropy
+   as early as possible.
+
+2. The DRNG is reseeded from the entropy sources if all entropy sources
+   collectively have at least 128 bits of entropy available.
+
+3. The DRNG is reseeded from the entropy sources if all entropy sources
+   collectively have at least 256 bits of entropy available.
+
+At the time of the reseeding steps, the DRNG requests as much entropy as
+is available in order to skip certain steps and reach the seeding level
+of 256 bits. This may imply that one or more of the aforementioned steps
+are skipped.
+
+In all listed steps, the DRNG is (re)seeded with a number of random bytes
+from the entropy pool that is at most the amount of entropy present in
+the entropy pool. This means that for example when the entropy pool
+contains 128 or more bits of entropy, the DRNG is seeded with that amount
+of entropy as well.
+
+Entropy sources (ES) inform the ES manager when new entropy has been
+collected using the lrng_es_add_entropy() function. That function
+schedules a DRNG (re)seed with the DRNG manager. When the DRNG manager
+requests entropy data, the function lrng_fill_seed_buffer fills the seed
+buffer by iterating through all available ES. The output of all entropy
+sources is concatenated with each other. Further, the seed buffer
+contains the amount of entropy each entropy credits its data. Finally a
+time stamp is added.
+
+The ES trigger such (re)seeding events only as long as not all DRNGs
+are fully seeded with 256 bits of entropy. Once that seeding level is
+reached, the triggers are not further processed.
+
+The DRNG manager initializes the initial DRNG instance during late stage
+of the kernel boot process before user space is triggered. The DRNG is
+seeded at the following occasions:
+
+- when the DRNG is initialized, the available amount of entropy is used,
+
+- during boot time until the DRNG is fully initialized, the reaching of
+  the aforementioned seeding steps of 32/128/256 bits of entropy trigger
+  a reseed of the DRNG.
+
+- at runtime after the elapse of 600 seconds since the last seeding,
+  the DRNG reseeding flag is raised
+
+- at runtime when more than 2^20 generate operations were performed by
+  the given DRNG since last reseeding, the reseeding flag is raised
+
+Raising the reseeding flag implies that the DRNG is seeded in process
+context the next time a caller requests random numbers.
+
+At runtime, the DRNG manager requires at least 128 bits of entropy from
+the entropy sources (or 256 bits when the FIPS mode is active to be
+SP800-90C compliant). It may be possible that the entropy sources may
+not deliver that amount. The DRNG is reseeded with the available amount
+of entropy and continues to operate. Yet, when after 2^30 generate
+requests since the last seeding with 128 bits (or 256 bits in FIPS mode)
+the DRNG cannot be seeded with 128 bits (or 256 bits), the DRNG becomes
+unseeded which means it will not produce random numbers until it is
+fully reseeded again.
+
+To support the DRNG manager, a DRNG implementation is provided with
+lrng_drng_kcapi.c. It uses the kernel crypto API RNG framework and
+allows the specification of the used DRNG with the kernel command line
+option of lrng_drng_kcapi.drng_name. If no reference is given, the
+default is the SP800-90A DRBG. In case the chosen DRNG requires the seed
+to have a certain length, a hash is used bring the entropy buffer into
+the proper size.
+
+In addition, the DRNG manager controls the message digest implementation
+offered to entropy sources when they want to perform a conditioning
+operation. As entropy sources may require the conditioning operation at
+any time, the default is a SHA-256 software hash implementation that
+neither sleeps nor does it need any memory allocation operation.
+Therefore, this hash is available even for the earliest kernel
+operations.
+
+The initial drop of the ESDM includes the entropy source of the
+"auxiliary" pool. This entropy source must always be present. It is an
+entropy pool that is based on the state of a message digest. Every
+insertion of data is a hash update operation. In order to obtain data, a
+hash final operation is performed. The purpose of this auxiliary pool is
+twofold:
+
+- Provide a general interface to inject an arbitrary amount of data from
+  any external source. When providing such data, the caller may specify
+  the amount of entropy it contains.
+
+- The auxiliary pool also provides the backtracking resistance for all
+  entropy sources. Once a seed buffer is filled from all entropy sources
+  it is re-inserted into the auxiliary pool at the same time it is used
+  for seeding the DRNG. Naturally, the insertion of the seed buffer into
+  the auxiliary pool is not credited with any entropy.
+
+If enabled during compile time with the boot option of
+fips=1, the entropy source oversampling is activated. The oversampling
+pulls 128 more bits of entropy than originally requested. This implies
+that when 256 bits of entropy are requested for a (re)seed of a DRNG,
+the ES are queried for 384 bits. This oversampling complies with
+SP800-90C.
+
+This patch set contains a number of header files for subsequent
+additions, but with the current Kconfig settings, these additional
+settings will be folded to noops.
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+---
+ drivers/char/Kconfig                          |    2 +
+ drivers/char/Makefile                         |    2 +
+ drivers/char/lrng/Kconfig                     | 1017 +++++++++++++++++
+ drivers/char/lrng/Makefile                    |   11 +
+ drivers/char/lrng/lrng_definitions.h          |  163 +++
+ drivers/char/lrng/lrng_drng_atomic.h          |   23 +
+ drivers/char/lrng/lrng_drng_chacha20.c        |  195 ++++
+ drivers/char/lrng/lrng_drng_chacha20.h        |   42 +
+ drivers/char/lrng/lrng_drng_drbg.h            |   13 +
+ drivers/char/lrng/lrng_drng_kcapi.h           |   13 +
+ drivers/char/lrng/lrng_drng_mgr.c             |  742 ++++++++++++
+ drivers/char/lrng/lrng_drng_mgr.h             |   86 ++
+ drivers/char/lrng/lrng_es_aux.c               |  335 ++++++
+ drivers/char/lrng/lrng_es_aux.h               |   44 +
+ drivers/char/lrng/lrng_es_cpu.h               |   17 +
+ drivers/char/lrng/lrng_es_irq.h               |   24 +
+ drivers/char/lrng/lrng_es_jent.h              |   17 +
+ drivers/char/lrng/lrng_es_krng.h              |   17 +
+ drivers/char/lrng/lrng_es_mgr.c               |  506 ++++++++
+ drivers/char/lrng/lrng_es_mgr.h               |   56 +
+ drivers/char/lrng/lrng_es_mgr_cb.h            |   87 ++
+ drivers/char/lrng/lrng_es_sched.h             |   20 +
+ drivers/char/lrng/lrng_es_timer_common.h      |   83 ++
+ drivers/char/lrng/lrng_interface_dev_common.h |   51 +
+ .../char/lrng/lrng_interface_random_kernel.h  |   17 +
+ drivers/char/lrng/lrng_numa.h                 |   11 +
+ drivers/char/lrng/lrng_sha.h                  |   14 +
+ drivers/char/lrng/lrng_sha1.c                 |   88 ++
+ drivers/char/lrng/lrng_sha256.c               |   72 ++
+ drivers/char/lrng/lrng_sysctl.h               |   15 +
+ include/linux/lrng.h                          |  251 ++++
+ 31 files changed, 4034 insertions(+)
+ create mode 100644 drivers/char/lrng/Kconfig
+ create mode 100644 drivers/char/lrng/Makefile
+ create mode 100644 drivers/char/lrng/lrng_definitions.h
+ create mode 100644 drivers/char/lrng/lrng_drng_atomic.h
+ create mode 100644 drivers/char/lrng/lrng_drng_chacha20.c
+ create mode 100644 drivers/char/lrng/lrng_drng_chacha20.h
+ create mode 100644 drivers/char/lrng/lrng_drng_drbg.h
+ create mode 100644 drivers/char/lrng/lrng_drng_kcapi.h
+ create mode 100644 drivers/char/lrng/lrng_drng_mgr.c
+ create mode 100644 drivers/char/lrng/lrng_drng_mgr.h
+ create mode 100644 drivers/char/lrng/lrng_es_aux.c
+ create mode 100644 drivers/char/lrng/lrng_es_aux.h
+ create mode 100644 drivers/char/lrng/lrng_es_cpu.h
+ create mode 100644 drivers/char/lrng/lrng_es_irq.h
+ create mode 100644 drivers/char/lrng/lrng_es_jent.h
+ create mode 100644 drivers/char/lrng/lrng_es_krng.h
+ create mode 100644 drivers/char/lrng/lrng_es_mgr.c
+ create mode 100644 drivers/char/lrng/lrng_es_mgr.h
+ create mode 100644 drivers/char/lrng/lrng_es_mgr_cb.h
+ create mode 100644 drivers/char/lrng/lrng_es_sched.h
+ create mode 100644 drivers/char/lrng/lrng_es_timer_common.h
+ create mode 100644 drivers/char/lrng/lrng_interface_dev_common.h
+ create mode 100644 drivers/char/lrng/lrng_interface_random_kernel.h
+ create mode 100644 drivers/char/lrng/lrng_numa.h
+ create mode 100644 drivers/char/lrng/lrng_sha.h
+ create mode 100644 drivers/char/lrng/lrng_sha1.c
+ create mode 100644 drivers/char/lrng/lrng_sha256.c
+ create mode 100644 drivers/char/lrng/lrng_sysctl.h
+ create mode 100644 include/linux/lrng.h
+
+--- a/drivers/char/Kconfig
++++ b/drivers/char/Kconfig
+@@ -422,4 +422,6 @@ config ADI
+ 	  and SSM (Silicon Secured Memory).  Intended consumers of this
+ 	  driver include crash and makedumpfile.
+ 
++source "drivers/char/lrng/Kconfig"
++
+ endmenu
+--- a/drivers/char/Makefile
++++ b/drivers/char/Makefile
+@@ -43,3 +43,5 @@ obj-$(CONFIG_PS3_FLASH)		+= ps3flash.o
+ obj-$(CONFIG_XILLYBUS_CLASS)	+= xillybus/
+ obj-$(CONFIG_POWERNV_OP_PANEL)	+= powernv-op-panel.o
+ obj-$(CONFIG_ADI)		+= adi.o
++
++obj-$(CONFIG_LRNG)		+= lrng/
+--- /dev/null
++++ b/drivers/char/lrng/Kconfig
+@@ -0,0 +1,1017 @@
++# SPDX-License-Identifier: GPL-2.0
++#
++# Linux Random Number Generator configuration
++#
++
++config RANDOM_DEFAULT_IMPL
++	bool "Kernel RNG Default Implementation"
++	default y
++	help
++	  The default random number generator as provided with
++	  drivers/char/random.c is selected with this option.
++
++config LRNG_AUTO_SELECTED
++	bool
++	default y if !RANDOM_DEFAULT_IMPL
++	default n if RANDOM_DEFAULT_IMPL
++	select LRNG
++
++config LRNG
++	bool "Linux Random Number Generator"
++	default n
++	select CRYPTO_LIB_SHA256 if CRYPTO
++	help
++	  The Linux Random Number Generator (LRNG) generates entropy
++	  from different entropy sources. Each entropy source can
++	  be enabled and configured independently. The interrupt
++	  entropy source can be configured to be SP800-90B compliant.
++	  The entire LRNG can be configured to be SP800-90C compliant.
++	  Runtime-switchable cryptographic support is available.
++	  The LRNG delivers significant entropy during boot.
++
++	  The LRNG also provides compliance to SP800-90A/B/C.
++
++menu "Linux Random Number Generator Configuration"
++	depends on LRNG
++
++if LRNG
++
++config LRNG_SHA256
++	bool
++	default y if CRYPTO_LIB_SHA256
++
++config LRNG_SHA1
++	bool
++	default y if !CRYPTO_LIB_SHA256
++
++config LRNG_COMMON_DEV_IF
++	bool
++
++config LRNG_DRNG_ATOMIC
++	bool
++	select LRNG_DRNG_CHACHA20
++
++config LRNG_SYSCTL
++	bool
++	depends on SYSCTL
++
++config LRNG_RANDOM_IF
++	bool
++	default n if RANDOM_DEFAULT_IMPL
++	default y if !RANDOM_DEFAULT_IMPL
++	select LRNG_COMMON_DEV_IF
++	select LRNG_DRNG_ATOMIC
++	select LRNG_SYSCTL
++
++menu "Specific DRNG seeding strategies"
++
++config LRNG_AIS2031_NTG1_SEEDING_STRATEGY
++	bool "AIS 20/31 NTG.1 seeding strategy"
++	default n
++	help
++	  When enabling this option, two entropy sources must
++	  deliver 220 bits of entropy each to consider a DRNG
++	  as fully seeded. Any two entropy sources can be used
++	  to fulfill this requirement. If specific entropy sources
++	  shall not be capable of contributing to this seeding
++	  strategy, the respective entropy source must be configured
++	  to provide less than 220 bits of entropy.
++
++	  The strategy is consistent with the requirements for
++	  NTG.1 compliance in German AIS 20/31 draft from 2022
++	  and is only enforced with lrng_es_mgr.ntg1=1.
++
++	  Compliance with German AIS 20/31 from 2011 is always
++	  present when using /dev/random with the flag O_SYNC or
++	  getrandom(2) with GRND_RANDOM.
++
++	  If unsure, say N.
++
++endmenu # "Specific DRNG seeding strategies"
++
++# menu "LRNG Interfaces"
++#
++# config LRNG_KCAPI_IF
++# 	tristate "Interface with Kernel Crypto API"
++# 	depends on CRYPTO_RNG
++# 	help
++# 	  The LRNG can be registered with the kernel crypto API's
++# 	  random number generator framework. This offers a random
++# 	  number generator with the name "lrng" and a priority that
++# 	  is intended to be higher than the existing RNG
++# 	  implementations.
++#
++# config LRNG_HWRAND_IF
++# 	tristate "Interface with Hardware Random Number Generator Framework"
++# 	depends on HW_RANDOM
++# 	select LRNG_DRNG_ATOMIC
++# 	help
++# 	  The LRNG can be registered with the hardware random number
++# 	  generator framework. This offers a random number generator
++# 	  with the name "lrng" that is accessible via the framework.
++# 	  For example it allows pulling data from the LRNG via the
++# 	  /dev/hwrng file.
++#
++# config LRNG_DEV_IF
++# 	bool "Character device file interface"
++# 	select LRNG_COMMON_DEV_IF
++# 	help
++# 	  The LRNG can create a character device file that operates
++# 	  identically to /dev/random including IOCTL, read and write
++# 	  operations.
++#
++# endmenu # "LRNG Interfaces"
++
++# menu "Entropy Source Configuration"
++#
++# config LRNG_RUNTIME_ES_CONFIG
++# 	bool "Enable runtime configuration of entropy sources"
++# 	help
++# 	  When enabling this option, the LRNG provides the mechanism
++# 	  allowing to alter the entropy rate of each entropy source
++# 	  during boot time and runtime.
++#
++# 	  Each entropy source allows its entropy rate changed with
++# 	  a kernel command line option. When not providing any
++# 	  option, the default specified during kernel compilation
++# 	  is applied.
++#
++# comment "Common Timer-based Entropy Source Configuration"
++#
++# config LRNG_IRQ_DFLT_TIMER_ES
++# 	bool
++#
++# config LRNG_SCHED_DFLT_TIMER_ES
++# 	bool
++#
++# config LRNG_TIMER_COMMON
++# 	bool
++#
++# choice
++# 	prompt "Default Timer-based Entropy Source"
++# 	default LRNG_IRQ_DFLT_TIMER_ES
++# 	depends on LRNG_TIMER_COMMON
++# 	help
++# 	  Select the timer-based entropy source that is credited
++# 	  with entropy. The other timer-based entropy sources may
++# 	  be operational and provide data, but are credited with no
++# 	  entropy.
++#
++# 	config LRNG_IRQ_DFLT_TIMER_ES
++# 	bool "Interrupt Entropy Source"
++# 	depends on LRNG_IRQ
++# 	help
++# 	  The interrupt entropy source is selected as a timer-based
++# 	  entropy source to provide entropy.
++#
++# 	config LRNG_SCHED_DFLT_TIMER_ES
++# 	bool "Scheduler Entropy Source"
++# 	depends on LRNG_SCHED
++# 	help
++# 	  The scheduler entropy source is selected as timer-based
++# 	  entropy source to provide entropy.
++# endchoice
++#
++# choice
++# 	prompt "LRNG Entropy Collection Pool Size"
++# 	default LRNG_COLLECTION_SIZE_1024
++# 	depends on LRNG_TIMER_COMMON
++# 	help
++# 	  Select the size of the LRNG entropy collection pool
++# 	  storing data for the interrupt as well as the scheduler
++# 	  entropy sources without performing a compression
++# 	  operation. The larger the collection size is, the faster
++# 	  the average interrupt handling will be. The collection
++# 	  size represents the number of bytes of the per-CPU memory
++# 	  used to batch up entropy event data.
++#
++# 	  The default value is good for regular operations. Choose
++# 	  larger sizes for servers that have no memory limitations.
++# 	  If runtime memory is precious, choose a smaller size.
++#
++# 	  The collection size is unrelated to the entropy rate
++# 	  or the amount of entropy the LRNG can process.
++#
++# 	config LRNG_COLLECTION_SIZE_32
++# 	depends on LRNG_CONTINUOUS_COMPRESSION_ENABLED
++# 	depends on !LRNG_SWITCHABLE_CONTINUOUS_COMPRESSION
++# 	depends on !CRYPTO_FIPS
++# 		bool "32 interrupt events"
++#
++# 	config LRNG_COLLECTION_SIZE_256
++# 	depends on !CRYPTO_FIPS
++# 		bool "256 interrupt events"
++#
++# 	config LRNG_COLLECTION_SIZE_512
++# 		bool "512 interrupt events"
++#
++# 	config LRNG_COLLECTION_SIZE_1024
++# 		bool "1024 interrupt events (default)"
++#
++# 	config LRNG_COLLECTION_SIZE_2048
++# 		bool "2048 interrupt events"
++#
++# 	config LRNG_COLLECTION_SIZE_4096
++# 		bool "4096 interrupt events"
++#
++# 	config LRNG_COLLECTION_SIZE_8192
++# 		bool "8192 interrupt events"
++#
++# endchoice
++#
++# config LRNG_COLLECTION_SIZE
++# 	int
++# 	default 32 if LRNG_COLLECTION_SIZE_32
++# 	default 256 if LRNG_COLLECTION_SIZE_256
++# 	default 512 if LRNG_COLLECTION_SIZE_512
++# 	default 1024 if LRNG_COLLECTION_SIZE_1024
++# 	default 2048 if LRNG_COLLECTION_SIZE_2048
++# 	default 4096 if LRNG_COLLECTION_SIZE_4096
++# 	default 8192 if LRNG_COLLECTION_SIZE_8192
++#
++# config LRNG_HEALTH_TESTS
++# 	bool "Enable internal entropy source online health tests"
++# 	depends on LRNG_TIMER_COMMON
++# 	help
++# 	  The online health tests applied to the interrupt entropy
++# 	  source and to the scheduler entropy source to validate
++# 	  the noise source at runtime for fatal errors. These tests
++# 	  include SP800-90B compliant tests which are invoked if
++# 	  the system is booted with fips=1. In case of fatal errors
++# 	  during active SP800-90B tests, the issue is logged and
++# 	  the noise data is discarded. These tests are required for
++# 	  full compliance of the interrupt entropy source with
++# 	  SP800-90B.
++#
++# 	  If both, the scheduler and the interrupt entropy sources,
++# 	  are enabled, the health tests for both are applied
++# 	  independent of each other.
++#
++# 	  If unsure, say Y.
++#
++# config LRNG_RCT_BROKEN
++# 	bool "SP800-90B RCT with dangerous low cutoff value"
++# 	depends on LRNG_HEALTH_TESTS
++# 	depends on BROKEN
++# 	default n
++# 	help
++# 	  This option enables a dangerously low SP800-90B repetitive
++# 	  count test (RCT) cutoff value which makes it very likely
++# 	  that the RCT is triggered to raise a self test failure.
++#
++# 	  This option is ONLY intended for developers wanting to
++# 	  test the effectiveness of the SP800-90B RCT health test.
++#
++# 	  If unsure, say N.
++#
++# config LRNG_APT_BROKEN
++# 	bool "SP800-90B APT with dangerous low cutoff value"
++# 	depends on LRNG_HEALTH_TESTS
++# 	depends on BROKEN
++# 	default n
++# 	help
++# 	  This option enables a dangerously low SP800-90B adaptive
++# 	  proportion test (APT) cutoff value which makes it very
++# 	  likely that the APT is triggered to raise a self test
++# 	  failure.
++#
++# 	  This option is ONLY intended for developers wanting to
++# 	  test the effectiveness of the SP800-90B APT health test.
++#
++# 	  If unsure, say N.
++#
++# Default taken from SP800-90B sec 4.4.1 - significance level 2^-30
++# config LRNG_RCT_CUTOFF
++# 	int
++# 	default 31 if !LRNG_RCT_BROKEN
++# 	default 1 if LRNG_RCT_BROKEN
++#
++# Default taken from SP800-90B sec 4.4.1 - significance level 2^-80
++# config LRNG_RCT_CUTOFF_PERMANENT
++# 	int
++# 	default 81 if !LRNG_RCT_BROKEN
++# 	default 2 if LRNG_RCT_BROKEN
++#
++# Default taken from SP800-90B sec 4.4.2 - significance level 2^-30
++# config LRNG_APT_CUTOFF
++# 	int
++# 	default 325 if !LRNG_APT_BROKEN
++# 	default 32 if LRNG_APT_BROKEN
++#
++# Default taken from SP800-90B sec 4.4.2 - significance level 2^-80
++# config LRNG_APT_CUTOFF_PERMANENT
++# 	int
++# 	default 371 if !LRNG_APT_BROKEN
++# 	default 33 if LRNG_APT_BROKEN
++#
++# comment "Interrupt Entropy Source"
++#
++# config LRNG_IRQ
++# 	bool "Enable Interrupt Entropy Source as LRNG Seed Source"
++# 	default y
++# 	depends on !RANDOM_DEFAULT_IMPL
++# 	select LRNG_TIMER_COMMON
++# 	help
++# 	  The LRNG models an entropy source based on the timing of the
++# 	  occurrence of interrupts. Enable this option to enable this
++# 	  IRQ entropy source.
++#
++# 	  The IRQ entropy source is triggered every time an interrupt
++# 	  arrives and thus causes the interrupt handler to execute
++# 	  slightly longer. Disabling the IRQ entropy source implies
++# 	  that the performance penalty on the interrupt handler added
++# 	  by the LRNG is eliminated. Yet, this entropy source is
++# 	  considered to be an internal entropy source of the LRNG.
++# 	  Thus, only disable it if you ensured that other entropy
++# 	  sources are available that supply the LRNG with entropy.
++#
++# 	  If you disable the IRQ entropy source, you MUST ensure
++# 	  one or more entropy sources collectively have the
++# 	  capability to deliver sufficient entropy with one invocation
++# 	  at a rate compliant to the security strength of the DRNG
++# 	  (usually 256 bits of entropy). In addition, if those
++# 	  entropy sources do not deliver sufficient entropy during
++# 	  first request, the reseed must be triggered from user
++# 	  space or kernel space when sufficient entropy is considered
++# 	  to be present.
++#
++# 	  If unsure, say Y.
++#
++# choice
++# 	prompt "Continuous entropy compression boot time setting"
++# 	default LRNG_CONTINUOUS_COMPRESSION_ENABLED
++# 	depends on LRNG_IRQ
++# 	help
++# 	  Select the default behavior of the interrupt entropy source
++# 	  continuous compression operation.
++#
++# 	  The LRNG IRQ ES collects entropy data during each interrupt.
++# 	  For performance reasons, a amount of entropy data defined by
++# 	  the LRNG entropy collection pool size is concatenated into
++# 	  an array. When that array is filled up, a hash is calculated
++# 	  to compress the entropy. That hash is calculated in
++# 	  interrupt context.
++#
++# 	  In case such hash calculation in interrupt context is deemed
++# 	  too time-consuming, the continuous compression operation
++# 	  can be disabled. If disabled, the collection of entropy will
++# 	  not trigger a hash compression operation in interrupt context.
++# 	  The compression happens only when the DRNG is reseeded which is
++# 	  in process context. This implies that old entropy data
++# 	  collected after the last DRNG-reseed is overwritten with newer
++# 	  entropy data once the collection pool is full instead of
++# 	  retaining its entropy with the compression operation.
++#
++# 	config LRNG_CONTINUOUS_COMPRESSION_ENABLED
++# 		bool "Enable continuous compression (default)"
++#
++# 	config LRNG_CONTINUOUS_COMPRESSION_DISABLED
++# 		bool "Disable continuous compression"
++#
++# endchoice
++#
++# config LRNG_ENABLE_CONTINUOUS_COMPRESSION
++# 	bool
++# 	default y if LRNG_CONTINUOUS_COMPRESSION_ENABLED
++# 	default n if LRNG_CONTINUOUS_COMPRESSION_DISABLED
++#
++# config LRNG_SWITCHABLE_CONTINUOUS_COMPRESSION
++# 	bool "Runtime-switchable continuous entropy compression"
++# 	depends on LRNG_IRQ
++# 	help
++# 	  Per default, the interrupt entropy source continuous
++# 	  compression operation behavior is hard-wired into the kernel.
++# 	  Enable this option to allow it to be configurable at boot time.
++#
++# 	  To modify the default behavior of the continuous
++# 	  compression operation, use the kernel command line option
++# 	  of lrng_sw_noise.lrng_pcpu_continuous_compression.
++#
++# 	  If unsure, say N.
++#
++# config LRNG_IRQ_ENTROPY_RATE
++# 	int "Interrupt Entropy Source Entropy Rate"
++# 	depends on LRNG_IRQ
++# 	range 256 4294967295 if LRNG_IRQ_DFLT_TIMER_ES
++# 	range 4294967295 4294967295 if !LRNG_IRQ_DFLT_TIMER_ES
++# 	default 256 if LRNG_IRQ_DFLT_TIMER_ES
++# 	default 4294967295 if !LRNG_IRQ_DFLT_TIMER_ES
++# 	help
++# 	  The LRNG will collect the configured number of interrupts to
++# 	  obtain 256 bits of entropy. This value can be set to any between
++# 	  256 and 4294967295. The LRNG guarantees that this value is not
++# 	  lower than 256. This lower limit implies that one interrupt event
++# 	  is credited with one bit of entropy. This value is subject to the
++# 	  increase by the oversampling factor, if no high-resolution timer
++# 	  is found.
++#
++# 	  In order to effectively disable the interrupt entropy source,
++# 	  the option has to be set to 4294967295. In this case, the
++# 	  interrupt entropy source will still deliver data but without
++# 	  being credited with entropy.
++#
++# comment "Jitter RNG Entropy Source"
++#
++# config LRNG_JENT
++# 	bool "Enable Jitter RNG as LRNG Seed Source"
++# 	depends on CRYPTO
++# 	select CRYPTO_JITTERENTROPY
++# 	help
++# 	  The LRNG may use the Jitter RNG as entropy source. Enabling
++# 	  this option enables the use of the Jitter RNG. Its default
++# 	  entropy level is 16 bits of entropy per 256 data bits delivered
++# 	  by the Jitter RNG. This entropy level can be changed at boot
++# 	  time or at runtime with the lrng_base.jitterrng configuration
++# 	  variable.
++#
++#choice
++#	prompt "Jitter RNG Async Block Number"
++#	default LRNG_JENT_ENTROPY_BLOCKS_NO_128
++#	depends on LRNG_JENT
++#	help
++#	  Select the number of Jitter RNG entropy blocks the asynchronous
++#	  collection operation will fill. A caller for Jitter RNG entropy
++#	  will be given data from the pre-filled blocks if available to
++#	  prevent the Jitter RNG from utilizing the CPU too much in a
++#	  possible hot code path.
++#
++#	  The number specifies the number of 256/384 bit blocks that will
++#	  be held in memory and asynchronously filled with Jitter RNG data.
++#
++#	  The asynchronous entropy collection can also be disabled at
++#	  kernel startup time when setting the command line option of
++#	  lrng_es_jent.jent_async_enabled=0. Also, setting this option at
++#	  runtime is allowed via the corresponding SysFS interface. This
++#	  option is only available with the options SysFS and
++#	  CONFIG_LRNG_RUNTIME_ES_CONFIG enabled.
++#
++#	config LRNG_JENT_ENTROPY_BLOCKS_DISABLED
++#		bool "Async collection disabled"
++#
++#	# Any block number is allowed, provided it is a power of 2 and
++#	# equal or larger than 4 (4 is due to the division in
++#	# lrng_jent_async_get when deciding to wake up the monitor).
++#	config LRNG_JENT_ENTROPY_BLOCKS_NO_32
++#		bool "32 blocks"
++#
++#	config LRNG_JENT_ENTROPY_BLOCKS_NO_64
++#		bool "64 blocks"
++#
++#	config LRNG_JENT_ENTROPY_BLOCKS_NO_128
++#		bool "128 blocks (default)"
++#
++#	config LRNG_JENT_ENTROPY_BLOCKS_NO_256
++#		bool "256 blocks"
++#
++#	config LRNG_JENT_ENTROPY_BLOCKS_NO_512
++#		bool "512 blocks"
++#
++#	config LRNG_JENT_ENTROPY_BLOCKS_NO_1024
++#		bool "1024 blocks"
++#
++#endchoice
++#
++#config LRNG_JENT_ENTROPY_BLOCKS
++#	int
++#	default 0 if LRNG_JENT_ENTROPY_BLOCKS_DISABLED
++#	default 32 if LRNG_JENT_ENTROPY_BLOCKS_NO_32
++#	default 64 if LRNG_JENT_ENTROPY_BLOCKS_NO_64
++#	default 128 if LRNG_JENT_ENTROPY_BLOCKS_NO_128
++#	default 256 if LRNG_JENT_ENTROPY_BLOCKS_NO_256
++#	default 512 if LRNG_JENT_ENTROPY_BLOCKS_NO_512
++#	default 1024 if LRNG_JENT_ENTROPY_BLOCKS_NO_1024
++#
++# config LRNG_JENT_ENTROPY_RATE
++# 	int "Jitter RNG Entropy Source Entropy Rate"
++# 	depends on LRNG_JENT
++# 	range 0 256
++# 	default 16
++# 	help
++# 	  The option defines the amount of entropy the LRNG applies to 256
++# 	  bits of data obtained from the Jitter RNG entropy source. The
++# 	  LRNG enforces the limit that this value must be in the range
++# 	  between 0 and 256.
++#
++# 	  When configuring this value to 0, the Jitter RNG entropy source
++# 	  will provide 256 bits of data without being credited to contain
++# 	  entropy.
++#
++# comment "CPU Entropy Source"
++#
++# config LRNG_CPU
++# 	bool "Enable CPU Entropy Source as LRNG Seed Source"
++# 	default y
++# 	help
++# 	  Current CPUs commonly contain entropy sources which can be
++# 	  used to seed the LRNG. For example, the Intel RDSEED
++# 	  instruction, or the POWER DARN instruction will be sourced
++# 	  to seed the LRNG if this option is enabled.
++#
++# 	  Note, if this option is enabled and the underlying CPU
++# 	  does not offer such entropy source, the LRNG will automatically
++# 	  detect this and ignore the hardware.
++#
++# config LRNG_CPU_FULL_ENT_MULTIPLIER
++# 	int
++# 	default 1 if !LRNG_TEST_CPU_ES_COMPRESSION
++# 	default 123 if LRNG_TEST_CPU_ES_COMPRESSION
++#
++# config LRNG_CPU_ENTROPY_RATE
++# 	int "CPU Entropy Source Entropy Rate"
++# 	depends on LRNG_CPU
++# 	range 0 256
++# 	default 8
++# 	help
++# 	  The option defines the amount of entropy the LRNG applies to 256
++# 	  bits of data obtained from the CPU entropy source. The LRNG
++# 	  enforces the limit that this value must be in the range between
++# 	  0 and 256.
++#
++# 	  When configuring this value to 0, the CPU entropy source will
++# 	  provide 256 bits of data without being credited to contain
++# 	  entropy.
++#
++# 	  Note, this option is overwritten when the option
++# 	  CONFIG_RANDOM_TRUST_CPU is set.
++#
++# comment "Scheduler Entropy Source"
++#
++# config LRNG_SCHED
++# 	bool "Enable Scheduer Entropy Source as LRNG Seed Source"
++# 	select LRNG_TIMER_COMMON
++# 	help
++# 	  The LRNG models an entropy source based on the timing of the
++# 	  occurrence of scheduler-triggered context switches. Enable
++# 	  this option to enable this scheduler entropy source.
++#
++# 	  The scheduler entropy source is triggered every time a
++# 	  context switch is triggered thus causes the scheduler to
++# 	  execute slightly longer. Disabling the scheduler entropy
++# 	  source implies that the performance penalty on the scheduler
++# 	  added by the LRNG is eliminated. Yet, this entropy source is
++# 	  considered to be an internal entropy source of the LRNG.
++# 	  Thus, only disable it if you ensured that other entropy
++# 	  sources are available that supply the LRNG with entropy.
++#
++# 	  If you disable the scheduler entropy source, you MUST
++# 	  ensure one or more entropy sources collectively have the
++# 	  capability to deliver sufficient entropy with one invocation
++# 	  at a rate compliant to the security strength of the DRNG
++# 	  (usually 256 bits of entropy). In addition, if those
++# 	  entropy sources do not deliver sufficient entropy during
++# 	  first request, the reseed must be triggered from user
++# 	  space or kernel space when sufficient entropy is considered
++# 	  to be present.
++#
++# 	  If unsure, say Y.
++#
++# config LRNG_SCHED_ENTROPY_RATE
++# 	int "Scheduler Entropy Source Entropy Rate"
++# 	depends on LRNG_SCHED
++# 	range 256 4294967295 if LRNG_SCHED_DFLT_TIMER_ES
++# 	range 4294967295 4294967295 if !LRNG_SCHED_DFLT_TIMER_ES
++# 	default 256 if LRNG_SCHED_DFLT_TIMER_ES
++# 	default 4294967295 if !LRNG_SCHED_DFLT_TIMER_ES
++# 	help
++# 	  The LRNG will collect the configured number of context switches
++# 	  triggered by the scheduler to obtain 256 bits of entropy. This
++# 	  value can be set to any between 256 and 4294967295. The LRNG
++# 	  guarantees that this value is not lower than 256. This lower
++# 	  limit implies that one interrupt event is credited with one bit
++# 	  of entropy. This value is subject to the increase by the
++# 	  oversampling factor, if no high-resolution timer is found.
++#
++# 	  In order to effectively disable the scheduler entropy source,
++# 	  the option has to be set to 4294967295. In this case, the
++# 	  scheduler entropy source will still deliver data but without
++# 	  being credited with entropy.
++#
++# comment "Kernel RNG Entropy Source"
++#
++# config LRNG_KERNEL_RNG
++# 	bool "Enable Kernel RNG as LRNG Seed Source"
++# 	depends on RANDOM_DEFAULT_IMPL
++# 	help
++# 	  The LRNG may use the kernel RNG (random.c) as entropy
++# 	  source.
++#
++# config LRNG_KERNEL_RNG_ENTROPY_RATE
++# 	int "Kernel RNG Entropy Source Entropy Rate"
++# 	depends on LRNG_KERNEL_RNG
++# 	range 0 256
++# 	default 256
++# 	help
++# 	  The option defines the amount of entropy the LRNG applies to 256
++# 	  bits of data obtained from the kernel RNG entropy source. The
++# 	  LRNG enforces the limit that this value must be in the range
++# 	  between 0 and 256.
++#
++# 	  When configuring this value to 0, the kernel RNG entropy source
++# 	  will provide 256 bits of data without being credited to contain
++# 	  entropy.
++#
++# 	  Note: This value is set to 0 automatically when booting the
++# 	  kernel in FIPS mode (with fips=1 kernel command line option).
++# 	  This is due to the fact that random.c is not SP800-90B
++# 	  compliant.
++#
++# endmenu # "Entropy Source Configuration"
++
++config LRNG_DRNG_CHACHA20
++	tristate
++
++# config LRNG_DRBG
++# 	tristate
++# 	depends on CRYPTO
++# 	select CRYPTO_DRBG_MENU
++#
++# config LRNG_DRNG_KCAPI
++# 	tristate
++# 	depends on CRYPTO
++# 	select CRYPTO_RNG
++#
++# config LRNG_SWITCH
++# 	bool
++#
++# menuconfig LRNG_SWITCH_HASH
++# 	bool "Support conditioning hash runtime switching"
++# 	select LRNG_SWITCH
++# 	help
++# 	  The LRNG uses a default message digest. With this
++# 	  configuration option other message digests can be selected
++# 	  and loaded at runtime.
++#
++# if LRNG_SWITCH_HASH
++#
++# config LRNG_HASH_KCAPI
++# 	tristate "Kernel crypto API hashing support for LRNG"
++# 	select CRYPTO_HASH
++# 	select CRYPTO_SHA512
++# 	help
++# 	  Enable the kernel crypto API support for entropy compression
++# 	  and conditioning functions.
++#
++# endif # LRNG_SWITCH_HASH
++#
++# menuconfig LRNG_SWITCH_DRNG
++# 	bool "Support DRNG runtime switching"
++# 	select LRNG_SWITCH
++# 	help
++# 	  The LRNG uses a default DRNG With this configuration
++# 	  option other DRNGs or message digests can be selected and
++# 	  loaded at runtime.
++#
++# if LRNG_SWITCH_DRNG
++#
++# config LRNG_SWITCH_DRNG_CHACHA20
++# 	tristate "ChaCha20-based DRNG support for LRNG"
++# 	depends on !LRNG_DFLT_DRNG_CHACHA20
++# 	select LRNG_DRNG_CHACHA20
++# 	help
++# 	  Enable the ChaCha20-based DRNG. This DRNG implementation
++# 	  does not depend on the kernel crypto API presence.
++#
++# config LRNG_SWITCH_DRBG
++# 	tristate "SP800-90A support for the LRNG"
++# 	depends on !LRNG_DFLT_DRNG_DRBG
++# 	select LRNG_DRBG
++# 	help
++# 	  Enable the SP800-90A DRBG support for the LRNG. Once the
++# 	  module is loaded, output from /dev/random, /dev/urandom,
++# 	  getrandom(2), or get_random_bytes_full is provided by a DRBG.
++#
++# config LRNG_SWITCH_DRNG_KCAPI
++# 	tristate "Kernel Crypto API support for the LRNG"
++# 	depends on !LRNG_DFLT_DRNG_KCAPI
++#	depends on !LRNG_SWITCH_DRBG
++# 	select LRNG_DRNG_KCAPI
++# 	help
++# 	  Enable the support for generic pseudo-random number
++# 	  generators offered by the kernel crypto API with the
++# 	  LRNG. Once the module is loaded, output from /dev/random,
++# 	  /dev/urandom, getrandom(2), or get_random_bytes is
++# 	  provided by the selected kernel crypto API RNG.
++#
++# endif # LRNG_SWITCH_DRNG
++
++choice
++	prompt "LRNG Default DRNG"
++	default LRNG_DFLT_DRNG_CHACHA20
++	help
++	  Select the default deterministic random number generator
++	  that is used by the LRNG. When enabling the switchable
++	  cryptographic mechanism support, this DRNG can be
++	  replaced at runtime.
++
++	config LRNG_DFLT_DRNG_CHACHA20
++		bool "ChaCha20-based DRNG"
++		select LRNG_DRNG_CHACHA20
++
++# 	config LRNG_DFLT_DRNG_DRBG
++# 		depends on RANDOM_DEFAULT_IMPL
++# 		bool "SP800-90A DRBG"
++# 		select LRNG_DRBG
++#
++# 	config LRNG_DFLT_DRNG_KCAPI
++# 		depends on RANDOM_DEFAULT_IMPL
++# 		bool "Kernel Crypto API DRNG"
++# 		select LRNG_DRNG_KCAPI
++endchoice
++
++# menuconfig LRNG_TESTING_MENU
++# 	bool "LRNG testing interfaces"
++# 	depends on DEBUG_FS
++# 	help
++# 	  Enable one or more of the following test interfaces.
++#
++# 	  If unsure, say N.
++#
++# if LRNG_TESTING_MENU
++#
++# config LRNG_TESTING
++# 	bool
++#
++# config LRNG_TESTING_RECORDING
++# 	bool
++#
++# comment "Interrupt Entropy Source Test Interfaces"
++#
++# config LRNG_RAW_HIRES_ENTROPY
++# 	bool "Interface to obtain raw unprocessed IRQ noise source data"
++# 	default y
++# 	depends on LRNG_IRQ
++# 	select LRNG_TESTING
++# 	select LRNG_TESTING_RECORDING
++# 	help
++# 	  The test interface allows a privileged process to capture
++# 	  the raw unconditioned high resolution time stamp noise that
++# 	  is collected by the LRNG for statistical analysis. Extracted
++# 	  noise data is not used to seed the LRNG.
++#
++# 	  The raw noise data can be obtained using the lrng_raw_hires
++# 	  debugfs file. Using the option lrng_testing.boot_raw_hires_test=1
++# 	  the raw noise of the first 1000 entropy events since boot
++# 	  can be sampled.
++#
++# config LRNG_RAW_JIFFIES_ENTROPY
++# 	bool "Entropy test interface to Jiffies of IRQ noise source"
++# 	depends on LRNG_IRQ
++# 	select LRNG_TESTING
++# 	select LRNG_TESTING_RECORDING
++# 	help
++# 	  The test interface allows a privileged process to capture
++# 	  the raw unconditioned Jiffies that is collected by
++# 	  the LRNG for statistical analysis. This data is used for
++# 	  seeding the LRNG if a high-resolution time stamp is not
++# 	  available. If a high-resolution time stamp is detected,
++# 	  the Jiffies value is not collected by the LRNG and no
++# 	  data is provided via the test interface. Extracted noise
++# 	  data is not used to seed the random number generator.
++#
++# 	  The raw noise data can be obtained using the lrng_raw_jiffies
++# 	  debugfs file. Using the option lrng_testing.boot_raw_jiffies_test=1
++# 	  the raw noise of the first 1000 entropy events since boot
++# 	  can be sampled.
++#
++# config LRNG_RAW_IRQ_ENTROPY
++# 	bool "Entropy test interface to IRQ number noise source"
++# 	depends on LRNG_IRQ
++# 	select LRNG_TESTING
++# 	select LRNG_TESTING_RECORDING
++# 	help
++# 	  The test interface allows a privileged process to capture
++# 	  the raw unconditioned interrupt number that is collected by
++# 	  the LRNG for statistical analysis. Extracted noise data is
++# 	  not used to seed the random number generator.
++#
++# 	  The raw noise data can be obtained using the lrng_raw_irq
++# 	  debugfs file. Using the option lrng_testing.boot_raw_irq_test=1
++# 	  the raw noise of the first 1000 entropy events since boot
++# 	  can be sampled.
++#
++# config LRNG_RAW_RETIP_ENTROPY
++# 	bool "Entropy test interface to RETIP value of IRQ noise source"
++# 	depends on LRNG_IRQ
++# 	select LRNG_TESTING
++# 	select LRNG_TESTING_RECORDING
++# 	help
++# 	  The test interface allows a privileged process to capture
++# 	  the raw unconditioned return instruction pointer value
++# 	  that is collected by the LRNG for statistical analysis.
++# 	  Extracted noise data is not used to seed the random number
++# 	  generator.
++#
++# 	  The raw noise data can be obtained using the lrng_raw_retip
++# 	  debugfs file. Using the option lrng_testing.boot_raw_retip_test=1
++# 	  the raw noise of the first 1000 entropy events since boot
++# 	  can be sampled.
++#
++# config LRNG_RAW_REGS_ENTROPY
++# 	bool "Entropy test interface to IRQ register value noise source"
++# 	depends on LRNG_IRQ
++# 	select LRNG_TESTING
++# 	select LRNG_TESTING_RECORDING
++# 	help
++# 	  The test interface allows a privileged process to capture
++# 	  the raw unconditioned interrupt register value that is
++# 	  collected by the LRNG for statistical analysis. Extracted noise
++# 	  data is not used to seed the random number generator.
++#
++# 	  The raw noise data can be obtained using the lrng_raw_regs
++# 	  debugfs file. Using the option lrng_testing.boot_raw_regs_test=1
++# 	  the raw noise of the first 1000 entropy events since boot
++# 	  can be sampled.
++#
++# config LRNG_RAW_ARRAY
++# 	bool "Test interface to LRNG raw entropy IRQ storage array"
++# 	depends on LRNG_IRQ
++# 	select LRNG_TESTING
++# 	select LRNG_TESTING_RECORDING
++# 	help
++# 	  The test interface allows a privileged process to capture
++# 	  the raw noise data that is collected by the LRNG
++# 	  in the per-CPU array for statistical analysis. The purpose
++# 	  of this interface is to verify that the array handling code
++# 	  truly only concatenates data and provides the same entropy
++# 	  rate as the raw unconditioned noise source when assessing
++# 	  the collected data byte-wise.
++#
++# 	  The data can be obtained using the lrng_raw_array debugfs
++# 	  file. Using the option lrng_testing.boot_raw_array=1
++# 	  the raw noise of the first 1000 entropy events since boot
++# 	  can be sampled.
++#
++# config LRNG_IRQ_PERF
++# 	bool "LRNG interrupt entropy source performance monitor"
++# 	depends on LRNG_IRQ
++# 	select LRNG_TESTING
++# 	select LRNG_TESTING_RECORDING
++# 	help
++# 	  With this option, the performance monitor of the LRNG
++# 	  interrupt handling code is enabled. The file provides
++# 	  the execution time of the interrupt handler in
++# 	  cycles.
++#
++# 	  The interrupt performance data can be obtained using
++# 	  the lrng_irq_perf debugfs file. Using the option
++# 	  lrng_testing.boot_irq_perf=1 the performance data of
++# 	  the first 1000 entropy events since boot can be sampled.
++#
++# comment "Scheduler Entropy Source Test Interfaces"
++#
++# config LRNG_RAW_SCHED_HIRES_ENTROPY
++# 	bool "Interface to obtain raw unprocessed scheduler noise source data"
++# 	depends on LRNG_SCHED
++# 	select LRNG_TESTING
++# 	select LRNG_TESTING_RECORDING
++# 	help
++# 	  The test interface allows a privileged process to capture
++# 	  the raw unconditioned high resolution time stamp noise that
++# 	  is collected by the LRNG for the Scheduler-based noise source
++# 	  for statistical analysis. Extracted  noise data is not used to
++# 	  seed the LRNG.
++#
++# 	  The raw noise data can be obtained using the lrng_raw_sched_hires
++# 	  debugfs file. Using the option
++# 	  lrng_testing.boot_raw_sched_hires_test=1 the raw noise of the
++# 	  first 1000 entropy events since boot can be sampled.
++#
++# config LRNG_RAW_SCHED_PID_ENTROPY
++# 	bool "Entropy test interface to PID value"
++# 	depends on LRNG_SCHED
++# 	select LRNG_TESTING
++# 	select LRNG_TESTING_RECORDING
++# 	help
++# 	  The test interface allows a privileged process to capture
++# 	  the raw unconditioned PID value that is collected by the
++# 	  LRNG for statistical analysis. Extracted noise
++# 	  data is not used to seed the random number generator.
++#
++# 	  The raw noise data can be obtained using the
++# 	  lrng_raw_sched_pid debugfs file. Using the option
++# 	  lrng_testing.boot_raw_sched_pid_test=1
++# 	  the raw noise of the first 1000 entropy events since boot
++# 	  can be sampled.
++#
++# config LRNG_RAW_SCHED_START_TIME_ENTROPY
++# 	bool "Entropy test interface to task start time value"
++# 	depends on LRNG_SCHED
++# 	select LRNG_TESTING
++# 	select LRNG_TESTING_RECORDING
++# 	help
++# 	  The test interface allows a privileged process to capture
++# 	  the raw unconditioned task start time value that is collected
++# 	  by the LRNG for statistical analysis. Extracted noise
++# 	  data is not used to seed the random number generator.
++#
++# 	  The raw noise data can be obtained using the
++# 	  lrng_raw_sched_starttime debugfs file. Using the option
++# 	  lrng_testing.boot_raw_sched_starttime_test=1
++# 	  the raw noise of the first 1000 entropy events since boot
++# 	  can be sampled.
++#
++#
++# config LRNG_RAW_SCHED_NVCSW_ENTROPY
++# 	bool "Entropy test interface to task context switch numbers"
++# 	depends on LRNG_SCHED
++# 	select LRNG_TESTING
++# 	select LRNG_TESTING_RECORDING
++# 	help
++# 	  The test interface allows a privileged process to capture
++# 	  the raw unconditioned task numbers of context switches that
++# 	  are collected by the LRNG for statistical analysis. Extracted
++# 	  noise data is not used to seed the random number generator.
++#
++# 	  The raw noise data can be obtained using the
++# 	  lrng_raw_sched_nvcsw debugfs file. Using the option
++# 	  lrng_testing.boot_raw_sched_nvcsw_test=1
++# 	  the raw noise of the first 1000 entropy events since boot
++# 	  can be sampled.
++#
++# config LRNG_SCHED_PERF
++# 	bool "LRNG scheduler entropy source performance monitor"
++# 	depends on LRNG_SCHED
++# 	select LRNG_TESTING
++# 	select LRNG_TESTING_RECORDING
++# 	help
++# 	  With this option, the performance monitor of the LRNG
++# 	  scheduler event handling code is enabled. The file provides
++# 	  the execution time of the interrupt handler in cycles.
++#
++# 	  The scheduler performance data can be obtained using
++# 	  the lrng_sched_perf debugfs file. Using the option
++# 	  lrng_testing.boot_sched_perf=1 the performance data of
++# 	  the first 1000 entropy events since boot can be sampled.
++#
++# comment "Auxiliary Test Interfaces"
++#
++# config LRNG_ACVT_HASH
++# 	bool "Enable LRNG ACVT Hash interface"
++# 	select LRNG_TESTING
++# 	help
++# 	  With this option, the LRNG built-in hash function used for
++# 	  auxiliary pool management and prior to switching the
++# 	  cryptographic backends is made available for ACVT. The
++# 	  interface allows writing of the data to be hashed
++# 	  into the interface. The read operation triggers the hash
++# 	  operation to generate message digest.
++#
++# 	  The ACVT interface is available with the lrng_acvt_hash
++# 	  debugfs file.
++#
++# config LRNG_RUNTIME_MAX_WO_RESEED_CONFIG
++# 	bool "Enable runtime configuration of max reseed threshold"
++# 	help
++# 	  When enabling this option, the LRNG provides an interface
++# 	  allowing the setting of the maximum number of DRNG generate
++# 	  operations without a reseed that has full entropy. The
++# 	  interface is lrng_drng.max_wo_reseed.
++#
++#config LRNG_RUNTIME_FORCE_SEEDING_DISABLE
++#	bool "Enable runtime configuration of force seeding"
++#	help
++#	  When enabling this option, the LRNG provides an interface
++#	  allowing the disabling of the force seeding when the DRNG
++#	  is not fully seeded but entropy is available.
++#
++# config LRNG_TEST_CPU_ES_COMPRESSION
++# 	bool "Force CPU ES compression operation"
++# 	help
++# 	  When enabling this option, the CPU ES compression operation
++# 	  is forced by setting an arbitrary value > 1 for the data
++# 	  multiplier even when the CPU ES would deliver full entropy.
++# 	  This allows testing of the compression operation. It
++# 	  therefore forces to pull more data from the CPU ES
++# 	  than what may be required.
++#
++# endif #LRNG_TESTING_MENU
++#
++# config LRNG_SELFTEST
++# 	bool "Enable power-on and on-demand self-tests"
++# 	help
++# 	  The power-on self-tests are executed during boot time
++# 	  covering the ChaCha20 DRNG, the hash operation used for
++# 	  processing the entropy pools and the auxiliary pool, and
++# 	  the time stamp management of the LRNG.
++#
++# 	  The on-demand self-tests are triggered by writing any
++# 	  value into the SysFS file selftest_status. At the same
++# 	  time, when reading this file, the test status is
++# 	  returned. A zero indicates that all tests were executed
++# 	  successfully.
++#
++# 	  If unsure, say Y.
++#
++# if LRNG_SELFTEST
++#
++# config LRNG_SELFTEST_PANIC
++# 	bool "Panic the kernel upon self-test failure"
++# 	help
++# 	  If the option is enabled, the kernel is terminated if an
++# 	  LRNG power-on self-test failure is detected.
++#
++# endif # LRNG_SELFTEST
++
++endif # LRNG
++
++endmenu # LRNG
+--- /dev/null
++++ b/drivers/char/lrng/Makefile
+@@ -0,0 +1,11 @@
++# SPDX-License-Identifier: GPL-2.0
++#
++# Makefile for the Entropy Source and DRNG Manager.
++#
++
++obj-y					+= lrng_es_mgr.o lrng_drng_mgr.o \
++					   lrng_es_aux.o
++obj-$(CONFIG_LRNG_SHA256)		+= lrng_sha256.o
++obj-$(CONFIG_LRNG_SHA1)			+= lrng_sha1.o
++
++obj-$(CONFIG_LRNG_DRNG_CHACHA20)	+= lrng_drng_chacha20.o
+--- /dev/null
++++ b/drivers/char/lrng/lrng_definitions.h
+@@ -0,0 +1,163 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause */
++/*
++ * Copyright (C) 2022 - 2023, Stephan Mueller <smueller@chronox.de>
++ */
++
++#ifndef _LRNG_DEFINITIONS_H
++#define _LRNG_DEFINITIONS_H
++
++#include <crypto/sha1.h>
++#include <crypto/sha2.h>
++#include <linux/slab.h>
++
++/*************************** General LRNG parameter ***************************/
++
++/*
++ * Specific settings for different use cases
++ */
++#ifdef CONFIG_CRYPTO_FIPS
++# define LRNG_OVERSAMPLE_ES_BITS	64
++# define LRNG_SEED_BUFFER_INIT_ADD_BITS	128
++#else /* CONFIG_CRYPTO_FIPS */
++# define LRNG_OVERSAMPLE_ES_BITS	0
++# define LRNG_SEED_BUFFER_INIT_ADD_BITS	0
++#endif /* CONFIG_CRYPTO_FIPS */
++
++/* Security strength of LRNG -- this must match DRNG security strength */
++#define LRNG_DRNG_SECURITY_STRENGTH_BYTES 32
++#define LRNG_DRNG_SECURITY_STRENGTH_BITS (LRNG_DRNG_SECURITY_STRENGTH_BYTES * 8)
++#define LRNG_DRNG_INIT_SEED_SIZE_BITS \
++	(LRNG_DRNG_SECURITY_STRENGTH_BITS + LRNG_SEED_BUFFER_INIT_ADD_BITS)
++#define LRNG_DRNG_INIT_SEED_SIZE_BYTES (LRNG_DRNG_INIT_SEED_SIZE_BITS >> 3)
++
++/*
++ * SP800-90A defines a maximum request size of 1<<16 bytes. The given value is
++ * considered a safer margin.
++ *
++ * This value is allowed to be changed.
++ */
++#define LRNG_DRNG_MAX_REQSIZE		(1<<12)
++
++/*
++ * SP800-90A defines a maximum number of requests between reseeds of 2^48.
++ * The given value is considered a much safer margin, balancing requests for
++ * frequent reseeds with the need to conserve entropy. This value MUST NOT be
++ * larger than INT_MAX because it is used in an atomic_t.
++ *
++ * This value is allowed to be changed.
++ */
++#define LRNG_DRNG_RESEED_THRESH		(1<<20)
++
++/*
++ * Maximum DRNG generation operations without reseed having full entropy
++ * This value defines the absolute maximum value of DRNG generation operations
++ * without a reseed holding full entropy. LRNG_DRNG_RESEED_THRESH is the
++ * threshold when a new reseed is attempted. But it is possible that this fails
++ * to deliver full entropy. In this case the DRNG will continue to provide data
++ * even though it was not reseeded with full entropy. To avoid in the extreme
++ * case that no reseed is performed for too long, this threshold is enforced.
++ * If that absolute low value is reached, the LRNG is marked as not operational.
++ *
++ * This value is allowed to be changed.
++ */
++#define LRNG_DRNG_MAX_WITHOUT_RESEED	(1<<30)
++
++/*
++ * Min required seed entropy is 128 bits covering the minimum entropy
++ * requirement of SP800-131A and the German BSI's TR02102.
++ *
++ * This value is allowed to be changed.
++ */
++#define LRNG_FULL_SEED_ENTROPY_BITS	LRNG_DRNG_SECURITY_STRENGTH_BITS
++#define LRNG_MIN_SEED_ENTROPY_BITS	128
++#define LRNG_INIT_ENTROPY_BITS		32
++
++/* AIS20/31: NTG.1.4 minimum entropy rate for one entropy source*/
++#define LRNG_AIS2031_NPTRNG_MIN_ENTROPY	220
++
++/*
++ * Wakeup value
++ *
++ * This value is allowed to be changed but must not be larger than the
++ * digest size of the hash operation used update the aux_pool.
++ */
++#ifdef CONFIG_LRNG_SHA256
++# define LRNG_ATOMIC_DIGEST_SIZE	SHA256_DIGEST_SIZE
++#else
++# define LRNG_ATOMIC_DIGEST_SIZE	SHA1_DIGEST_SIZE
++#endif
++#define LRNG_WRITE_WAKEUP_ENTROPY	LRNG_ATOMIC_DIGEST_SIZE
++
++/*
++ * If the switching support is configured, we must provide support up to
++ * the largest digest size. Without switching support, we know it is only
++ * the built-in digest size.
++ */
++#ifdef CONFIG_LRNG_SWITCH
++# define LRNG_MAX_DIGESTSIZE		64
++#else
++# define LRNG_MAX_DIGESTSIZE		LRNG_ATOMIC_DIGEST_SIZE
++#endif
++
++/*
++ * Oversampling factor of timer-based events to obtain
++ * LRNG_DRNG_SECURITY_STRENGTH_BYTES. This factor is used when a
++ * high-resolution time stamp is not available. In this case, jiffies and
++ * register contents are used to fill the entropy pool. These noise sources
++ * are much less entropic than the high-resolution timer. The entropy content
++ * is the entropy content assumed with LRNG_[IRQ|SCHED]_ENTROPY_BITS divided by
++ * LRNG_ES_OVERSAMPLING_FACTOR.
++ *
++ * This value is allowed to be changed.
++ */
++#define LRNG_ES_OVERSAMPLING_FACTOR	10
++
++/* Alignmask that is intended to be identical to CRYPTO_MINALIGN */
++#define LRNG_KCAPI_ALIGN		ARCH_KMALLOC_MINALIGN
++
++/*
++ * This definition must provide a buffer that is equal to SHASH_DESC_ON_STACK
++ * as it will be casted into a struct shash_desc.
++ */
++#define LRNG_POOL_SIZE	(sizeof(struct shash_desc) + HASH_MAX_DESCSIZE)
++
++/*
++ * Identification of a permanent health falure.
++ *
++ * Allow the given number of back-to-back health failures until incuring a
++ * permanent health failure. The chosen value implies an alpha of 2^-60
++ * considering that the alpha of one health failure is 2^-30
++ */
++#define LRNG_PERMANENT_HEALTH_FAILURES	2
++
++/****************************** Helper code ***********************************/
++
++static inline u32 lrng_fast_noise_entropylevel(u32 ent_bits, u32 requested_bits)
++{
++	/* Obtain entropy statement */
++	ent_bits = ent_bits * requested_bits / LRNG_DRNG_SECURITY_STRENGTH_BITS;
++	/* Cap entropy to buffer size in bits */
++	ent_bits = min_t(u32, ent_bits, requested_bits);
++	return ent_bits;
++}
++
++/* Convert entropy in bits into nr. of events with the same entropy content. */
++static inline u32 lrng_entropy_to_data(u32 entropy_bits, u32 entropy_rate)
++{
++	return ((entropy_bits * entropy_rate) /
++		LRNG_DRNG_SECURITY_STRENGTH_BITS);
++}
++
++/* Convert number of events into entropy value. */
++static inline u32 lrng_data_to_entropy(u32 num, u32 entropy_rate)
++{
++	return ((num * LRNG_DRNG_SECURITY_STRENGTH_BITS) /
++		entropy_rate);
++}
++
++static inline u32 atomic_read_u32(atomic_t *v)
++{
++	return (u32)atomic_read(v);
++}
++
++#endif /* _LRNG_DEFINITIONS_H */
+--- /dev/null
++++ b/drivers/char/lrng/lrng_drng_atomic.h
+@@ -0,0 +1,23 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause */
++/*
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#ifndef _LRNG_DRNG_ATOMIC_H
++#define _LRNG_DRNG_ATOMIC_H
++
++#include "lrng_drng_mgr.h"
++
++#ifdef CONFIG_LRNG_DRNG_ATOMIC
++void lrng_drng_atomic_reset(void);
++void lrng_drng_atomic_seed_drng(struct lrng_drng *drng);
++void lrng_drng_atomic_force_reseed(void);
++struct lrng_drng *lrng_get_atomic(void);
++#else /* CONFIG_LRNG_DRNG_ATOMIC */
++static inline void lrng_drng_atomic_reset(void) { }
++static inline void lrng_drng_atomic_seed_drng(struct lrng_drng *drng) { }
++static inline void lrng_drng_atomic_force_reseed(void) { }
++static inline struct lrng_drng *lrng_get_atomic(void) { return NULL; }
++#endif /* CONFIG_LRNG_DRNG_ATOMIC */
++
++#endif /* _LRNG_DRNG_ATOMIC_H */
+--- /dev/null
++++ b/drivers/char/lrng/lrng_drng_chacha20.c
+@@ -0,0 +1,195 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * Backend for the LRNG providing the cryptographic primitives using
++ * ChaCha20 cipher implementations.
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <crypto/chacha.h>
++#include <linux/lrng.h>
++#include <linux/random.h>
++#include <linux/slab.h>
++
++#include "lrng_drng_chacha20.h"
++
++/******************************* ChaCha20 DRNG *******************************/
++
++#define CHACHA_BLOCK_WORDS	(CHACHA_BLOCK_SIZE / sizeof(u32))
++
++/*
++ * Update of the ChaCha20 state by either using an unused buffer part or by
++ * generating one ChaCha20 block which is half of the state of the ChaCha20.
++ * The block is XORed into the key part of the state. This shall ensure
++ * backtracking resistance as well as a proper mix of the ChaCha20 state once
++ * the key is injected.
++ */
++static void lrng_chacha20_update(struct chacha20_state *chacha20_state,
++				 __le32 *buf, u32 used_words)
++{
++	struct chacha20_block *chacha20 = &chacha20_state->block;
++	u32 i;
++	__le32 tmp[CHACHA_BLOCK_WORDS];
++
++	BUILD_BUG_ON(sizeof(struct chacha20_block) != CHACHA_BLOCK_SIZE);
++	BUILD_BUG_ON(CHACHA_BLOCK_SIZE != 2 * CHACHA_KEY_SIZE);
++
++	if (used_words > CHACHA_KEY_SIZE_WORDS) {
++		chacha20_block(&chacha20->constants[0], (u8 *)tmp);
++		for (i = 0; i < CHACHA_KEY_SIZE_WORDS; i++)
++			chacha20->key.u[i] ^= le32_to_cpu(tmp[i]);
++		memzero_explicit(tmp, sizeof(tmp));
++	} else {
++		for (i = 0; i < CHACHA_KEY_SIZE_WORDS; i++)
++			chacha20->key.u[i] ^= le32_to_cpu(buf[i + used_words]);
++	}
++
++	/* Deterministic increment of nonce as required in RFC 7539 chapter 4 */
++	chacha20->nonce[0]++;
++	if (chacha20->nonce[0] == 0) {
++		chacha20->nonce[1]++;
++		if (chacha20->nonce[1] == 0)
++			chacha20->nonce[2]++;
++	}
++
++	/* Leave counter untouched as it is start value is undefined in RFC */
++}
++
++/*
++ * Seed the ChaCha20 DRNG by injecting the input data into the key part of
++ * the ChaCha20 state. If the input data is longer than the ChaCha20 key size,
++ * perform a ChaCha20 operation after processing of key size input data.
++ * This operation shall spread out the entropy into the ChaCha20 state before
++ * new entropy is injected into the key part.
++ */
++static int lrng_cc20_drng_seed_helper(void *drng, const u8 *inbuf, u32 inbuflen)
++{
++	struct chacha20_state *chacha20_state = (struct chacha20_state *)drng;
++	struct chacha20_block *chacha20 = &chacha20_state->block;
++
++	while (inbuflen) {
++		u32 i, todo = min_t(u32, inbuflen, CHACHA_KEY_SIZE);
++
++		for (i = 0; i < todo; i++)
++			chacha20->key.b[i] ^= inbuf[i];
++
++		/* Break potential dependencies between the inbuf key blocks */
++		lrng_chacha20_update(chacha20_state, NULL,
++				     CHACHA_BLOCK_WORDS);
++		inbuf += todo;
++		inbuflen -= todo;
++	}
++
++	return 0;
++}
++
++/*
++ * Chacha20 DRNG generation of random numbers: the stream output of ChaCha20
++ * is the random number. After the completion of the generation of the
++ * stream, the entire ChaCha20 state is updated.
++ *
++ * Note, as the ChaCha20 implements a 32 bit counter, we must ensure
++ * that this function is only invoked for at most 2^32 - 1 ChaCha20 blocks
++ * before a reseed or an update happens. This is ensured by the variable
++ * outbuflen which is a 32 bit integer defining the number of bytes to be
++ * generated by the ChaCha20 DRNG. At the end of this function, an update
++ * operation is invoked which implies that the 32 bit counter will never be
++ * overflown in this implementation.
++ */
++static int lrng_cc20_drng_generate_helper(void *drng, u8 *outbuf, u32 outbuflen)
++{
++	struct chacha20_state *chacha20_state = (struct chacha20_state *)drng;
++	struct chacha20_block *chacha20 = &chacha20_state->block;
++	__le32 aligned_buf[CHACHA_BLOCK_WORDS];
++	u32 ret = outbuflen, used = CHACHA_BLOCK_WORDS;
++	int zeroize_buf = 0;
++
++	while (outbuflen >= CHACHA_BLOCK_SIZE) {
++		chacha20_block(&chacha20->constants[0], outbuf);
++		outbuf += CHACHA_BLOCK_SIZE;
++		outbuflen -= CHACHA_BLOCK_SIZE;
++	}
++
++	if (outbuflen) {
++		chacha20_block(&chacha20->constants[0], (u8 *)aligned_buf);
++		memcpy(outbuf, aligned_buf, outbuflen);
++		used = ((outbuflen + sizeof(aligned_buf[0]) - 1) /
++			sizeof(aligned_buf[0]));
++		zeroize_buf = 1;
++	}
++
++	lrng_chacha20_update(chacha20_state, aligned_buf, used);
++
++	if (zeroize_buf)
++		memzero_explicit(aligned_buf, sizeof(aligned_buf));
++
++	return ret;
++}
++
++/*
++ * Allocation of the DRNG state
++ */
++static void *lrng_cc20_drng_alloc(u32 sec_strength)
++{
++	struct chacha20_state *state = NULL;
++
++	if (sec_strength > CHACHA_KEY_SIZE) {
++		pr_err("Security strength of ChaCha20 DRNG (%u bits) lower than requested by LRNG (%u bits)\n",
++			CHACHA_KEY_SIZE * 8, sec_strength * 8);
++		return ERR_PTR(-EINVAL);
++	}
++	if (sec_strength < CHACHA_KEY_SIZE)
++		pr_warn("Security strength of ChaCha20 DRNG (%u bits) higher than requested by LRNG (%u bits)\n",
++			CHACHA_KEY_SIZE * 8, sec_strength * 8);
++
++	state = kmalloc(sizeof(struct chacha20_state), GFP_KERNEL);
++	if (!state)
++		return ERR_PTR(-ENOMEM);
++	pr_debug("memory for ChaCha20 core allocated\n");
++
++	lrng_cc20_init_rfc7539(&state->block);
++
++	return state;
++}
++
++static void lrng_cc20_drng_dealloc(void *drng)
++{
++	struct chacha20_state *chacha20_state = (struct chacha20_state *)drng;
++
++	pr_debug("ChaCha20 core zeroized and freed\n");
++	kfree_sensitive(chacha20_state);
++}
++
++static const char *lrng_cc20_drng_name(void)
++{
++	return "ChaCha20 DRNG";
++}
++
++const struct lrng_drng_cb lrng_cc20_drng_cb = {
++	.drng_name	= lrng_cc20_drng_name,
++	.drng_alloc	= lrng_cc20_drng_alloc,
++	.drng_dealloc	= lrng_cc20_drng_dealloc,
++	.drng_seed	= lrng_cc20_drng_seed_helper,
++	.drng_generate	= lrng_cc20_drng_generate_helper,
++};
++
++#if !defined(CONFIG_LRNG_DFLT_DRNG_CHACHA20) && \
++    !defined(CONFIG_LRNG_DRNG_ATOMIC)
++static int __init lrng_cc20_drng_init(void)
++{
++	return lrng_set_drng_cb(&lrng_cc20_drng_cb);
++}
++
++static void __exit lrng_cc20_drng_exit(void)
++{
++	lrng_set_drng_cb(NULL);
++}
++
++late_initcall(lrng_cc20_drng_init);
++module_exit(lrng_cc20_drng_exit);
++MODULE_LICENSE("Dual BSD/GPL");
++MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>");
++MODULE_DESCRIPTION("Entropy Source and DRNG Manager - ChaCha20-based DRNG backend");
++#endif /* CONFIG_LRNG_DFLT_DRNG_CHACHA20 */
+--- /dev/null
++++ b/drivers/char/lrng/lrng_drng_chacha20.h
+@@ -0,0 +1,42 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause */
++/*
++ * LRNG ChaCha20 definitions
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#ifndef _LRNG_CHACHA20_H
++#define _LRNG_CHACHA20_H
++
++#include <crypto/chacha.h>
++
++/* State according to RFC 7539 section 2.3 */
++struct chacha20_block {
++	u32 constants[4];
++	union {
++#define CHACHA_KEY_SIZE_WORDS (CHACHA_KEY_SIZE / sizeof(u32))
++		u32 u[CHACHA_KEY_SIZE_WORDS];
++		u8  b[CHACHA_KEY_SIZE];
++	} key;
++	u32 counter;
++	u32 nonce[3];
++};
++
++struct chacha20_state {
++	struct chacha20_block block;
++};
++
++static inline void lrng_cc20_init_rfc7539(struct chacha20_block *chacha20)
++{
++	chacha_init_consts(chacha20->constants);
++}
++
++#define LRNG_CC20_INIT_RFC7539(x) \
++	x.constants[0] = 0x61707865, \
++	x.constants[1] = 0x3320646e, \
++	x.constants[2] = 0x79622d32, \
++	x.constants[3] = 0x6b206574,
++
++extern const struct lrng_drng_cb lrng_cc20_drng_cb;
++
++#endif /* _LRNG_CHACHA20_H */
+--- /dev/null
++++ b/drivers/char/lrng/lrng_drng_drbg.h
+@@ -0,0 +1,13 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause */
++/*
++ * LRNG SP800-90A definitions
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#ifndef _LRNG_DRBG_H
++#define _LRNG_DRBG_H
++
++extern const struct lrng_drng_cb lrng_drbg_cb;
++
++#endif /* _LRNG_DRBG_H */
+--- /dev/null
++++ b/drivers/char/lrng/lrng_drng_kcapi.h
+@@ -0,0 +1,13 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause */
++/*
++ * LRNG kernel crypto API DRNG definition
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#ifndef _LRNG_KCAPI_DRNG_H
++#define _LRNG_KCAPI_DRNG_H
++
++extern const struct lrng_drng_cb lrng_kcapi_drng_cb;
++
++#endif /* _LRNG_KCAPI_DRNG_H */
+--- /dev/null
++++ b/drivers/char/lrng/lrng_drng_mgr.c
+@@ -0,0 +1,742 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * LRNG DRNG management
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/lrng.h>
++#include <linux/fips.h>
++#include <linux/module.h>
++#include <linux/sched.h>
++#include <linux/wait.h>
++
++#include "lrng_drng_atomic.h"
++#include "lrng_drng_chacha20.h"
++#include "lrng_drng_drbg.h"
++#include "lrng_drng_kcapi.h"
++#include "lrng_drng_mgr.h"
++#include "lrng_es_aux.h"
++#include "lrng_es_mgr.h"
++#include "lrng_interface_random_kernel.h"
++#include "lrng_numa.h"
++#include "lrng_sha.h"
++
++/*
++ * Maximum number of seconds between DRNG reseed intervals of the DRNG. Note,
++ * this is enforced with the next request of random numbers from the
++ * DRNG. Setting this value to zero implies a reseeding attempt before every
++ * generated random number.
++ */
++int lrng_drng_reseed_max_time = 600;
++
++/*
++ * Is LRNG for general-purpose use (i.e. is at least the lrng_drng_init
++ * fully allocated)?
++ */
++static atomic_t lrng_avail = ATOMIC_INIT(0);
++
++/* Guard protecting all crypto callback update operation of all DRNGs. */
++DEFINE_MUTEX(lrng_crypto_cb_update);
++
++/*
++ * Default hash callback that provides the crypto primitive right from the
++ * kernel start. It must not perform any memory allocation operation, but
++ * simply perform the hash calculation.
++ */
++const struct lrng_hash_cb *lrng_default_hash_cb = &lrng_sha_hash_cb;
++
++/*
++ * Default DRNG callback that provides the crypto primitive which is
++ * allocated either during late kernel boot stage. So, it is permissible for
++ * the callback to perform memory allocation operations.
++ */
++const struct lrng_drng_cb *lrng_default_drng_cb =
++#if defined(CONFIG_LRNG_DFLT_DRNG_CHACHA20)
++	&lrng_cc20_drng_cb;
++#elif defined(CONFIG_LRNG_DFLT_DRNG_DRBG)
++	&lrng_drbg_cb;
++#elif defined(CONFIG_LRNG_DFLT_DRNG_KCAPI)
++	&lrng_kcapi_drng_cb;
++#else
++#error "Unknown default DRNG selected"
++#endif
++
++/* DRNG for non-atomic use cases */
++static struct lrng_drng lrng_drng_init = {
++	LRNG_DRNG_STATE_INIT(lrng_drng_init, NULL, NULL, NULL,
++			     &lrng_sha_hash_cb),
++	.lock = __MUTEX_INITIALIZER(lrng_drng_init.lock),
++};
++
++/* Prediction-resistance DRNG: only deliver as much data as received entropy */
++static struct lrng_drng lrng_drng_pr = {
++	LRNG_DRNG_STATE_INIT(lrng_drng_pr, NULL, NULL, NULL,
++			     &lrng_sha_hash_cb),
++	.lock = __MUTEX_INITIALIZER(lrng_drng_pr.lock),
++};
++
++static u32 max_wo_reseed = LRNG_DRNG_MAX_WITHOUT_RESEED;
++#ifdef CONFIG_LRNG_RUNTIME_MAX_WO_RESEED_CONFIG
++module_param(max_wo_reseed, uint, 0444);
++MODULE_PARM_DESC(max_wo_reseed,
++		 "Maximum number of DRNG generate operation without full reseed\n");
++#endif
++
++static bool force_seeding = true;
++#ifdef CONFIG_LRNG_RUNTIME_FORCE_SEEDING_DISABLE
++module_param(force_seeding, bool, 0444);
++MODULE_PARM_DESC(force_seeding,
++		 "Allow disabling of the forced seeding when insufficient entropy is available\n");
++#endif
++
++/* Wait queue to wait until the LRNG is initialized - can freely be used */
++DECLARE_WAIT_QUEUE_HEAD(lrng_init_wait);
++
++/********************************** Helper ************************************/
++
++bool lrng_get_available(void)
++{
++	return likely(atomic_read(&lrng_avail));
++}
++
++struct lrng_drng *lrng_drng_init_instance(void)
++{
++	return &lrng_drng_init;
++}
++
++struct lrng_drng *lrng_drng_pr_instance(void)
++{
++	return &lrng_drng_pr;
++}
++
++struct lrng_drng *lrng_drng_node_instance(void)
++{
++	struct lrng_drng **lrng_drng = lrng_drng_instances();
++	int node = numa_node_id();
++
++	if (lrng_drng && lrng_drng[node])
++		return lrng_drng[node];
++
++	return lrng_drng_init_instance();
++}
++
++void lrng_drng_reset(struct lrng_drng *drng)
++{
++	/* Ensure reseed during next call */
++	atomic_set(&drng->requests, 1);
++	atomic_set(&drng->requests_since_fully_seeded, 0);
++	drng->last_seeded = jiffies;
++	drng->fully_seeded = false;
++	/* Do not set force, as this flag is used for the emergency reseeding */
++	drng->force_reseed = false;
++	pr_debug("reset DRNG\n");
++}
++
++/* Initialize the DRNG, except the mutex lock */
++int lrng_drng_alloc_common(struct lrng_drng *drng,
++			   const struct lrng_drng_cb *drng_cb)
++{
++	if (!drng || !drng_cb)
++		return -EINVAL;
++	if (!IS_ERR_OR_NULL(drng->drng))
++		return 0;
++
++	drng->drng_cb = drng_cb;
++	drng->drng = drng_cb->drng_alloc(LRNG_DRNG_SECURITY_STRENGTH_BYTES);
++	if (IS_ERR(drng->drng))
++		return -PTR_ERR(drng->drng);
++
++	lrng_drng_reset(drng);
++	return 0;
++}
++
++/* Initialize the default DRNG during boot and perform its seeding */
++int lrng_drng_initalize(void)
++{
++	int ret;
++
++	if (lrng_get_available())
++		return 0;
++
++	/* Catch programming error */
++	WARN_ON(lrng_drng_init.hash_cb != lrng_default_hash_cb);
++
++	mutex_lock(&lrng_drng_init.lock);
++	if (lrng_get_available()) {
++		mutex_unlock(&lrng_drng_init.lock);
++		return 0;
++	}
++
++	/* Initialize the PR DRNG inside init lock as it guards lrng_avail. */
++	mutex_lock(&lrng_drng_pr.lock);
++	ret = lrng_drng_alloc_common(&lrng_drng_pr, lrng_default_drng_cb);
++	mutex_unlock(&lrng_drng_pr.lock);
++
++	if (!ret) {
++		ret = lrng_drng_alloc_common(&lrng_drng_init,
++					     lrng_default_drng_cb);
++		if (!ret)
++			atomic_set(&lrng_avail, 1);
++	}
++	mutex_unlock(&lrng_drng_init.lock);
++	if (ret)
++		return ret;
++
++	pr_debug("LRNG for general use is available\n");
++
++	/* Seed the DRNG with any entropy available */
++	if (lrng_pool_trylock()) {
++		pr_info("Initial DRNG initialized triggering first seeding\n");
++		lrng_drng_seed_work(NULL);
++	} else {
++		pr_info("Initial DRNG initialized without seeding\n");
++	}
++
++	return 0;
++}
++
++static int __init lrng_drng_make_available(void)
++{
++	return lrng_drng_initalize();
++}
++late_initcall(lrng_drng_make_available);
++
++bool lrng_sp80090c_compliant(void)
++{
++	/* SP800-90C compliant oversampling is only requested in FIPS mode */
++	return fips_enabled;
++}
++
++/************************* Random Number Generation ***************************/
++
++/* Inject a data buffer into the DRNG - caller must hold its lock */
++void lrng_drng_inject(struct lrng_drng *drng, const u8 *inbuf, u32 inbuflen,
++		      bool fully_seeded, const char *drng_type)
++{
++	BUILD_BUG_ON(LRNG_DRNG_RESEED_THRESH > INT_MAX);
++	pr_debug("seeding %s DRNG with %u bytes\n", drng_type, inbuflen);
++	if (drng->drng_cb->drng_seed(drng->drng, inbuf, inbuflen) < 0) {
++		pr_warn("seeding of %s DRNG failed\n", drng_type);
++		drng->force_reseed = true;
++	} else {
++		int gc = LRNG_DRNG_RESEED_THRESH - atomic_read(&drng->requests);
++
++		pr_debug("%s DRNG stats since last seeding: %lu secs; generate calls: %d\n",
++			 drng_type,
++			 (time_after(jiffies, drng->last_seeded) ?
++			  (jiffies - drng->last_seeded) : 0) / HZ, gc);
++
++		/* Count the numbers of generate ops since last fully seeded */
++		if (fully_seeded)
++			atomic_set(&drng->requests_since_fully_seeded, 0);
++		else
++			atomic_add(gc, &drng->requests_since_fully_seeded);
++
++		drng->last_seeded = jiffies;
++		atomic_set(&drng->requests, LRNG_DRNG_RESEED_THRESH);
++		drng->force_reseed = false;
++
++		if (!drng->fully_seeded) {
++			drng->fully_seeded = fully_seeded;
++			if (drng->fully_seeded)
++				pr_debug("%s DRNG fully seeded\n", drng_type);
++		}
++	}
++}
++
++/*
++ * Perform the seeding of the DRNG with data from entropy source.
++ * The function returns the entropy injected into the DRNG in bits.
++ */
++static u32 lrng_drng_seed_es_nolock(struct lrng_drng *drng, bool init_ops,
++				    const char *drng_type)
++{
++	struct entropy_buf seedbuf __aligned(LRNG_KCAPI_ALIGN),
++			   collected_seedbuf;
++	u32 collected_entropy = 0;
++	unsigned int i, num_es_delivered = 0;
++	bool forced = drng->force_reseed;
++
++	for_each_lrng_es(i)
++		collected_seedbuf.e_bits[i] = 0;
++
++	do {
++		/* Count the number of ES which delivered entropy */
++		num_es_delivered = 0;
++
++		if (collected_entropy)
++			pr_debug("Force fully seeding level for %s DRNG by repeatedly pull entropy from available entropy sources\n",
++				 drng_type);
++
++		lrng_fill_seed_buffer(&seedbuf,
++			lrng_get_seed_entropy_osr(drng->fully_seeded),
++				      forced && !drng->fully_seeded);
++
++		collected_entropy += lrng_entropy_rate_eb(&seedbuf);
++
++		/* Sum iterations up. */
++		for_each_lrng_es(i) {
++			collected_seedbuf.e_bits[i] += seedbuf.e_bits[i];
++			num_es_delivered += !!seedbuf.e_bits[i];
++		}
++
++		lrng_drng_inject(drng, (u8 *)&seedbuf, sizeof(seedbuf),
++				 lrng_fully_seeded(drng->fully_seeded,
++						   collected_entropy,
++						   &collected_seedbuf),
++				 drng_type);
++
++		/*
++		 * Set the seeding state of the LRNG
++		 *
++		 * Do not call lrng_init_ops(seedbuf) here as the atomic DRNG
++		 * does not serve common users.
++		 */
++		if (init_ops)
++			lrng_init_ops(&collected_seedbuf);
++
++	/*
++	 * Emergency reseeding: If we reached the min seed threshold now
++	 * multiple times but never reached fully seeded level and we collect
++	 * entropy, keep doing it until we reached fully seeded level for
++	 * at least one DRNG. This operation is not continued if the
++	 * ES do not deliver entropy such that we cannot reach the fully seeded
++	 * level.
++	 *
++	 * The emergency reseeding implies that the consecutively injected
++	 * entropy can be added up. This is applicable due to the fact that
++	 * the entire operation is atomic which means that the DRNG is not
++	 * producing data while this is ongoing.
++	 */
++	} while (force_seeding && forced && !drng->fully_seeded &&
++		 num_es_delivered >= (lrng_ntg1_2022_compliant() ? 2 : 1));
++
++	memzero_explicit(&seedbuf, sizeof(seedbuf));
++
++	return collected_entropy;
++}
++
++static void lrng_drng_seed_es(struct lrng_drng *drng)
++{
++	mutex_lock(&drng->lock);
++	lrng_drng_seed_es_nolock(drng, true, "regular");
++	mutex_unlock(&drng->lock);
++}
++
++static void lrng_drng_seed(struct lrng_drng *drng)
++{
++	BUILD_BUG_ON(LRNG_MIN_SEED_ENTROPY_BITS >
++		     LRNG_DRNG_SECURITY_STRENGTH_BITS);
++
++	/* (Re-)Seed DRNG */
++	lrng_drng_seed_es(drng);
++	/* (Re-)Seed atomic DRNG from regular DRNG */
++	lrng_drng_atomic_seed_drng(drng);
++}
++
++static void lrng_drng_seed_work_one(struct lrng_drng *drng, u32 node)
++{
++	pr_debug("reseed triggered by system events for DRNG on NUMA node %d\n",
++		 node);
++	lrng_drng_seed(drng);
++	if (drng->fully_seeded) {
++		/* Prevent reseed storm */
++		drng->last_seeded += node * 100 * HZ;
++	}
++}
++
++/*
++ * DRNG reseed trigger: Kernel thread handler triggered by the schedule_work()
++ */
++static void __lrng_drng_seed_work(bool force)
++{
++	struct lrng_drng **lrng_drng;
++	u32 node;
++
++	/*
++	 * If the DRNG is not yet initialized, let us try to seed the atomic
++	 * DRNG.
++	 */
++	if (!lrng_get_available()) {
++		struct lrng_drng *atomic;
++		unsigned long flags;
++
++		if (wq_has_sleeper(&lrng_init_wait)) {
++			lrng_init_ops(NULL);
++			return;
++		}
++		atomic = lrng_get_atomic();
++		if (!atomic || atomic->fully_seeded)
++			return;
++
++		atomic->force_reseed |= force;
++		spin_lock_irqsave(&atomic->spin_lock, flags);
++		lrng_drng_seed_es_nolock(atomic, false, "atomic");
++		spin_unlock_irqrestore(&atomic->spin_lock, flags);
++
++		return;
++	}
++
++	lrng_drng = lrng_drng_instances();
++	if (lrng_drng) {
++		for_each_online_node(node) {
++			struct lrng_drng *drng = lrng_drng[node];
++
++			if (drng && !drng->fully_seeded) {
++				drng->force_reseed |= force;
++				lrng_drng_seed_work_one(drng, node);
++				return;
++			}
++		}
++	} else {
++		if (!lrng_drng_init.fully_seeded) {
++			lrng_drng_init.force_reseed |= force;
++			lrng_drng_seed_work_one(&lrng_drng_init, 0);
++			return;
++		}
++	}
++
++	if (!lrng_drng_pr.fully_seeded) {
++		lrng_drng_pr.force_reseed |= force;
++		lrng_drng_seed_work_one(&lrng_drng_pr, 0);
++		return;
++	}
++
++	lrng_pool_all_numa_nodes_seeded(true);
++}
++
++void lrng_drng_seed_work(struct work_struct *dummy)
++{
++	__lrng_drng_seed_work(false);
++
++	/* Allow the seeding operation to be called again */
++	lrng_pool_unlock();
++}
++
++/* Force all DRNGs to reseed before next generation */
++void lrng_drng_force_reseed(void)
++{
++	struct lrng_drng **lrng_drng = lrng_drng_instances();
++	u32 node;
++
++	/*
++	 * If the initial DRNG is over the reseed threshold, allow a forced
++	 * reseed only for the initial DRNG as this is the fallback for all. It
++	 * must be kept seeded before all others to keep the LRNG operational.
++	 */
++	if (!lrng_drng ||
++	    (atomic_read_u32(&lrng_drng_init.requests_since_fully_seeded) >
++	     LRNG_DRNG_RESEED_THRESH)) {
++		lrng_drng_init.force_reseed = lrng_drng_init.fully_seeded;
++		pr_debug("force reseed of initial DRNG\n");
++		return;
++	}
++	for_each_online_node(node) {
++		struct lrng_drng *drng = lrng_drng[node];
++
++		if (!drng)
++			continue;
++
++		drng->force_reseed = drng->fully_seeded;
++		pr_debug("force reseed of DRNG on node %u\n", node);
++	}
++	lrng_drng_atomic_force_reseed();
++}
++EXPORT_SYMBOL(lrng_drng_force_reseed);
++
++static bool lrng_drng_must_reseed(struct lrng_drng *drng)
++{
++	return (atomic_dec_and_test(&drng->requests) ||
++		drng->force_reseed ||
++		time_after(jiffies,
++			   drng->last_seeded + lrng_drng_reseed_max_time * HZ));
++}
++
++/*
++ * lrng_drng_get() - Get random data out of the DRNG which is reseeded
++ * frequently.
++ *
++ * @drng: DRNG instance
++ * @outbuf: buffer for storing random data
++ * @outbuflen: length of outbuf
++ *
++ * Return:
++ * * < 0 in error case (DRNG generation or update failed)
++ * * >=0 returning the returned number of bytes
++ */
++int lrng_drng_get(struct lrng_drng *drng, u8 *outbuf, u32 outbuflen)
++{
++	u32 processed = 0;
++	bool pr = (drng == &lrng_drng_pr) ? true : false;
++
++	if (!outbuf || !outbuflen)
++		return 0;
++
++	if (!lrng_get_available())
++		return -EOPNOTSUPP;
++
++	outbuflen = min_t(size_t, outbuflen, INT_MAX);
++
++	/* If DRNG operated without proper reseed for too long, block LRNG */
++	BUILD_BUG_ON(LRNG_DRNG_MAX_WITHOUT_RESEED < LRNG_DRNG_RESEED_THRESH);
++	if (atomic_read_u32(&drng->requests_since_fully_seeded) > max_wo_reseed)
++		lrng_unset_fully_seeded(drng);
++
++	while (outbuflen) {
++		u32 todo = min_t(u32, outbuflen, LRNG_DRNG_MAX_REQSIZE);
++		int ret;
++
++		/* In normal operation, check whether to reseed */
++		if (!pr && lrng_drng_must_reseed(drng)) {
++			if (!lrng_pool_trylock()) {
++				drng->force_reseed = true;
++			} else {
++				lrng_drng_seed(drng);
++				lrng_pool_unlock();
++			}
++		}
++
++		mutex_lock(&drng->lock);
++
++		if (pr) {
++			/* If async reseed did not deliver entropy, try now */
++			if (!drng->fully_seeded) {
++				u32 coll_ent_bits;
++
++				/* If we cannot get the pool lock, try again. */
++				if (!lrng_pool_trylock()) {
++					mutex_unlock(&drng->lock);
++					continue;
++				}
++
++				coll_ent_bits = lrng_drng_seed_es_nolock(
++							drng, true, "regular");
++
++				lrng_pool_unlock();
++
++				/* If no new entropy was received, stop now. */
++				if (!coll_ent_bits) {
++					mutex_unlock(&drng->lock);
++					goto out;
++				}
++
++				/* Produce no more data than received entropy */
++				todo = min_t(u32, todo, coll_ent_bits >> 3);
++			}
++
++			/* Do not produce more than DRNG security strength */
++			todo = min_t(u32, todo, lrng_security_strength() >> 3);
++		}
++		ret = drng->drng_cb->drng_generate(drng->drng,
++						   outbuf + processed, todo);
++
++		mutex_unlock(&drng->lock);
++		if (ret <= 0) {
++			pr_warn("getting random data from DRNG failed (%d)\n",
++				ret);
++			return -EFAULT;
++		}
++		processed += ret;
++		outbuflen -= ret;
++
++		if (pr) {
++			/* Force the async reseed for PR DRNG */
++			lrng_unset_fully_seeded(drng);
++			if (outbuflen)
++				cond_resched();
++		}
++	}
++
++out:
++	return processed;
++}
++
++int lrng_drng_get_sleep(u8 *outbuf, u32 outbuflen, bool pr)
++{
++	struct lrng_drng **lrng_drng = lrng_drng_instances();
++	struct lrng_drng *drng = &lrng_drng_init;
++	int ret, node = numa_node_id();
++
++	might_sleep();
++
++	if (pr)
++		drng = &lrng_drng_pr;
++	else if (lrng_drng && lrng_drng[node] && lrng_drng[node]->fully_seeded)
++		drng = lrng_drng[node];
++
++	ret = lrng_drng_initalize();
++	if (ret)
++		return ret;
++
++	return lrng_drng_get(drng, outbuf, outbuflen);
++}
++
++/* Reset LRNG such that all existing entropy is gone */
++static void _lrng_reset(struct work_struct *work)
++{
++	struct lrng_drng **lrng_drng = lrng_drng_instances();
++
++	if (!lrng_drng) {
++		mutex_lock(&lrng_drng_init.lock);
++		lrng_drng_reset(&lrng_drng_init);
++		mutex_unlock(&lrng_drng_init.lock);
++	} else {
++		u32 node;
++
++		for_each_online_node(node) {
++			struct lrng_drng *drng = lrng_drng[node];
++
++			if (!drng)
++				continue;
++			mutex_lock(&drng->lock);
++			lrng_drng_reset(drng);
++			mutex_unlock(&drng->lock);
++		}
++	}
++
++	mutex_lock(&lrng_drng_pr.lock);
++	lrng_drng_reset(&lrng_drng_pr);
++	mutex_unlock(&lrng_drng_pr.lock);
++
++	lrng_drng_atomic_reset();
++	lrng_set_entropy_thresh(LRNG_INIT_ENTROPY_BITS);
++
++	lrng_reset_state();
++}
++
++static DECLARE_WORK(lrng_reset_work, _lrng_reset);
++
++void lrng_reset(void)
++{
++	schedule_work(&lrng_reset_work);
++}
++
++/******************* Generic LRNG kernel output interfaces ********************/
++
++void lrng_force_fully_seeded(void)
++{
++	if (lrng_pool_all_numa_nodes_seeded_get())
++		return;
++
++	lrng_pool_lock();
++	__lrng_drng_seed_work(true);
++	lrng_pool_unlock();
++}
++
++static int lrng_drng_sleep_while_not_all_nodes_seeded(unsigned int nonblock)
++{
++	lrng_force_fully_seeded();
++	if (lrng_pool_all_numa_nodes_seeded_get())
++		return 0;
++	if (nonblock)
++		return -EAGAIN;
++	wait_event_interruptible(lrng_init_wait,
++				 lrng_pool_all_numa_nodes_seeded_get());
++	return 0;
++}
++
++int lrng_drng_sleep_while_nonoperational(int nonblock)
++{
++	lrng_force_fully_seeded();
++	if (likely(lrng_state_operational()))
++		return 0;
++	if (nonblock)
++		return -EAGAIN;
++	return wait_event_interruptible(lrng_init_wait,
++					lrng_state_operational());
++}
++
++int lrng_drng_sleep_while_non_min_seeded(void)
++{
++	lrng_force_fully_seeded();
++	if (likely(lrng_state_min_seeded()))
++		return 0;
++	return wait_event_interruptible(lrng_init_wait,
++					lrng_state_min_seeded());
++}
++
++ssize_t lrng_get_seed(u64 *buf, size_t nbytes, unsigned int flags)
++{
++	struct entropy_buf *eb = (struct entropy_buf *)(buf + 2);
++	u64 buflen = sizeof(struct entropy_buf) + 2 * sizeof(u64);
++	u64 collected_bits = 0;
++	int ret;
++
++	/* Ensure buffer is aligned as required */
++	BUILD_BUG_ON(sizeof(buflen) > LRNG_KCAPI_ALIGN);
++	if (nbytes < sizeof(buflen))
++		return -EINVAL;
++
++	/* Write buffer size into first word */
++	buf[0] = buflen;
++	if (nbytes < buflen)
++		return -EMSGSIZE;
++
++	ret = lrng_drng_sleep_while_not_all_nodes_seeded(
++		flags & LRNG_GET_SEED_NONBLOCK);
++	if (ret)
++		return ret;
++
++	/* Try to get the pool lock and sleep on it to get it. */
++	lrng_pool_lock();
++
++	/* If an LRNG DRNG becomes unseeded, give this DRNG precedence. */
++	if (!lrng_pool_all_numa_nodes_seeded_get()) {
++		lrng_pool_unlock();
++		return 0;
++	}
++
++	/*
++	 * Try to get seed data - a rarely used busyloop is cheaper than a wait
++	 * queue that is constantly woken up by the hot code path of
++	 * lrng_init_ops.
++	 */
++	for (;;) {
++		lrng_fill_seed_buffer(eb,
++			lrng_get_seed_entropy_osr(flags &
++						  LRNG_GET_SEED_FULLY_SEEDED),
++						  false);
++		collected_bits = lrng_entropy_rate_eb(eb);
++
++		/* Break the collection loop if we got entropy, ... */
++		if (collected_bits ||
++		    /* ... a DRNG becomes unseeded, give DRNG precedence, ... */
++		    !lrng_pool_all_numa_nodes_seeded_get() ||
++		    /* ... if the caller does not want a blocking behavior. */
++		    (flags & LRNG_GET_SEED_NONBLOCK))
++			break;
++
++		schedule();
++	}
++
++	lrng_pool_unlock();
++
++	/* Write collected entropy size into second word */
++	buf[1] = collected_bits;
++
++	return (ssize_t)buflen;
++}
++
++void lrng_get_random_bytes_full(void *buf, int nbytes)
++{
++	lrng_drng_sleep_while_nonoperational(0);
++	lrng_drng_get_sleep((u8 *)buf, (u32)nbytes, false);
++}
++EXPORT_SYMBOL(lrng_get_random_bytes_full);
++
++void lrng_get_random_bytes_min(void *buf, int nbytes)
++{
++	lrng_drng_sleep_while_non_min_seeded();
++	lrng_drng_get_sleep((u8 *)buf, (u32)nbytes, false);
++}
++EXPORT_SYMBOL(lrng_get_random_bytes_min);
++
++int lrng_get_random_bytes_pr(void *buf, int nbytes)
++{
++	lrng_drng_sleep_while_nonoperational(0);
++	return lrng_drng_get_sleep((u8 *)buf, (u32)nbytes, true);
++}
++EXPORT_SYMBOL(lrng_get_random_bytes_pr);
+--- /dev/null
++++ b/drivers/char/lrng/lrng_drng_mgr.h
+@@ -0,0 +1,86 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause */
++/*
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#ifndef _LRNG_DRNG_H
++#define _LRNG_DRNG_H
++
++#include <linux/mutex.h>
++#include <linux/spinlock.h>
++#include <linux/workqueue.h>
++
++#include "lrng_definitions.h"
++
++extern struct wait_queue_head lrng_init_wait;
++extern int lrng_drng_reseed_max_time;
++extern struct mutex lrng_crypto_cb_update;
++extern const struct lrng_drng_cb *lrng_default_drng_cb;
++extern const struct lrng_hash_cb *lrng_default_hash_cb;
++
++/* DRNG state handle */
++struct lrng_drng {
++	void *drng;				/* DRNG handle */
++	void *hash;				/* Hash handle */
++	const struct lrng_drng_cb *drng_cb;	/* DRNG callbacks */
++	const struct lrng_hash_cb *hash_cb;	/* Hash callbacks */
++	atomic_t requests;			/* Number of DRNG requests */
++	atomic_t requests_since_fully_seeded;	/* Number DRNG requests since
++						 * last fully seeded
++						 */
++	unsigned long last_seeded;		/* Last time it was seeded */
++	bool fully_seeded;			/* Is DRNG fully seeded? */
++	bool force_reseed;			/* Force a reseed */
++
++	rwlock_t hash_lock;			/* Lock hash_cb replacement */
++	/* Lock write operations on DRNG state, DRNG replacement of drng_cb */
++	struct mutex lock;			/* Non-atomic DRNG operation */
++	spinlock_t spin_lock;			/* Atomic DRNG operation */
++};
++
++#define LRNG_DRNG_STATE_INIT(x, d, h, d_cb, h_cb) \
++	.drng				= d, \
++	.hash				= h, \
++	.drng_cb			= d_cb, \
++	.hash_cb			= h_cb, \
++	.requests			= ATOMIC_INIT(LRNG_DRNG_RESEED_THRESH),\
++	.requests_since_fully_seeded	= ATOMIC_INIT(0), \
++	.last_seeded			= 0, \
++	.fully_seeded			= false, \
++	.force_reseed			= true, \
++	.hash_lock			= __RW_LOCK_UNLOCKED(x.hash_lock)
++
++struct lrng_drng *lrng_drng_init_instance(void);
++struct lrng_drng *lrng_drng_pr_instance(void);
++struct lrng_drng *lrng_drng_node_instance(void);
++
++void lrng_reset(void);
++int lrng_drng_alloc_common(struct lrng_drng *drng,
++			   const struct lrng_drng_cb *crypto_cb);
++int lrng_drng_initalize(void);
++bool lrng_sp80090c_compliant(void);
++bool lrng_get_available(void);
++void lrng_drng_reset(struct lrng_drng *drng);
++void lrng_drng_inject(struct lrng_drng *drng, const u8 *inbuf, u32 inbuflen,
++		      bool fully_seeded, const char *drng_type);
++int lrng_drng_get(struct lrng_drng *drng, u8 *outbuf, u32 outbuflen);
++int lrng_drng_sleep_while_nonoperational(int nonblock);
++int lrng_drng_sleep_while_non_min_seeded(void);
++int lrng_drng_get_sleep(u8 *outbuf, u32 outbuflen, bool pr);
++void lrng_drng_seed_work(struct work_struct *dummy);
++void lrng_drng_force_reseed(void);
++void lrng_force_fully_seeded(void);
++
++static inline u32 lrng_compress_osr(void)
++{
++	return lrng_sp80090c_compliant() ? LRNG_OVERSAMPLE_ES_BITS : 0;
++}
++
++static inline u32 lrng_reduce_by_osr(u32 entropy_bits)
++{
++	u32 osr_bits = lrng_compress_osr();
++
++	return (entropy_bits >= osr_bits) ? (entropy_bits - osr_bits) : 0;
++}
++
++#endif /* _LRNG_DRNG_H */
+--- /dev/null
++++ b/drivers/char/lrng/lrng_es_aux.c
+@@ -0,0 +1,335 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * LRNG Slow Entropy Source: Auxiliary entropy pool
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/lrng.h>
++
++#include "lrng_es_aux.h"
++#include "lrng_es_mgr.h"
++#include "lrng_sysctl.h"
++
++/*
++ * This is the auxiliary pool
++ *
++ * The aux pool array is aligned to 8 bytes to comfort the kernel crypto API
++ * cipher implementations of the hash functions used to read the pool: for some
++ * accelerated implementations, we need an alignment to avoid a realignment
++ * which involves memcpy(). The alignment to 8 bytes should satisfy all crypto
++ * implementations.
++ */
++struct lrng_pool {
++	u8 aux_pool[LRNG_POOL_SIZE];	/* Aux pool: digest state */
++	atomic_t aux_entropy_bits;
++	atomic_t digestsize;		/* Digest size of used hash */
++	bool initialized;		/* Aux pool initialized? */
++
++	/* Serialize read of entropy pool and update of aux pool */
++	spinlock_t lock;
++};
++
++static struct lrng_pool lrng_pool __aligned(LRNG_KCAPI_ALIGN) = {
++	.aux_entropy_bits	= ATOMIC_INIT(0),
++	.digestsize		= ATOMIC_INIT(LRNG_ATOMIC_DIGEST_SIZE),
++	.initialized		= false,
++	.lock			= __SPIN_LOCK_UNLOCKED(lrng_pool.lock)
++};
++
++/********************************** Helper ***********************************/
++
++/* Entropy in bits present in aux pool */
++static u32 lrng_aux_avail_entropy(u32 __unused)
++{
++	/* Cap available entropy with max entropy */
++	u32 avail_bits = min_t(u32, lrng_get_digestsize(),
++			       atomic_read_u32(&lrng_pool.aux_entropy_bits));
++
++	/* Consider oversampling rate due to aux pool conditioning */
++	return lrng_reduce_by_osr(avail_bits);
++}
++
++/* Set the digest size of the used hash in bytes */
++static void lrng_set_digestsize(u32 digestsize)
++{
++	struct lrng_pool *pool = &lrng_pool;
++	u32 ent_bits = atomic_xchg_relaxed(&pool->aux_entropy_bits, 0),
++	    old_digestsize = lrng_get_digestsize();
++
++	atomic_set(&lrng_pool.digestsize, digestsize);
++
++	/*
++	 * Update the write wakeup threshold which must not be larger
++	 * than the digest size of the current conditioning hash.
++	 */
++	digestsize = lrng_reduce_by_osr(digestsize << 3);
++	lrng_sysctl_update_max_write_thresh(digestsize);
++	lrng_write_wakeup_bits = digestsize;
++
++	/*
++	 * In case the new digest is larger than the old one, cap the available
++	 * entropy to the old message digest used to process the existing data.
++	 */
++	ent_bits = min_t(u32, ent_bits, old_digestsize);
++	atomic_add(ent_bits, &pool->aux_entropy_bits);
++}
++
++static int __init lrng_init_wakeup_bits(void)
++{
++	u32 digestsize = lrng_reduce_by_osr(lrng_get_digestsize());
++
++	lrng_sysctl_update_max_write_thresh(digestsize);
++	lrng_write_wakeup_bits = digestsize;
++	return 0;
++}
++core_initcall(lrng_init_wakeup_bits);
++
++/* Obtain the digest size provided by the used hash in bits */
++u32 lrng_get_digestsize(void)
++{
++	return atomic_read_u32(&lrng_pool.digestsize) << 3;
++}
++
++/* Set entropy content in user-space controllable aux pool */
++void lrng_pool_set_entropy(u32 entropy_bits)
++{
++	atomic_set(&lrng_pool.aux_entropy_bits, entropy_bits);
++}
++
++static void lrng_aux_reset(void)
++{
++	lrng_pool_set_entropy(0);
++}
++
++/*
++ * Replace old with new hash for auxiliary pool handling
++ *
++ * Assumption: the caller must guarantee that the new_cb is available during the
++ * entire operation (e.g. it must hold the write lock against pointer updating).
++ */
++static int
++lrng_aux_switch_hash(struct lrng_drng *drng, int __unused,
++		     const struct lrng_hash_cb *new_cb, void *new_hash,
++		     const struct lrng_hash_cb *old_cb)
++{
++	struct lrng_drng *init_drng = lrng_drng_init_instance();
++	struct lrng_pool *pool = &lrng_pool;
++	struct shash_desc *shash = (struct shash_desc *)pool->aux_pool;
++	u8 digest[LRNG_MAX_DIGESTSIZE];
++	int ret;
++
++	if (!IS_ENABLED(CONFIG_LRNG_SWITCH))
++		return -EOPNOTSUPP;
++
++	if (unlikely(!pool->initialized))
++		return 0;
++
++	/* We only switch if the processed DRNG is the initial DRNG. */
++	if (init_drng != drng)
++		return 0;
++
++	/* Get the aux pool hash with old digest ... */
++	ret = old_cb->hash_final(shash, digest) ?:
++	      /* ... re-initialize the hash with the new digest ... */
++	      new_cb->hash_init(shash, new_hash) ?:
++	      /*
++	       * ... feed the old hash into the new state. We may feed
++	       * uninitialized memory into the new state, but this is
++	       * considered no issue and even good as we have some more
++	       * uncertainty here.
++	       */
++	      new_cb->hash_update(shash, digest, sizeof(digest));
++	if (!ret) {
++		lrng_set_digestsize(new_cb->hash_digestsize(new_hash));
++		pr_debug("Re-initialize aux entropy pool with hash %s\n",
++			 new_cb->hash_name());
++	}
++
++	memzero_explicit(digest, sizeof(digest));
++	return ret;
++}
++
++/* Insert data into auxiliary pool by using the hash update function. */
++static int
++lrng_aux_pool_insert_locked(const u8 *inbuf, u32 inbuflen, u32 entropy_bits)
++{
++	struct lrng_pool *pool = &lrng_pool;
++	struct shash_desc *shash = (struct shash_desc *)pool->aux_pool;
++	struct lrng_drng *drng = lrng_drng_init_instance();
++	const struct lrng_hash_cb *hash_cb;
++	unsigned long flags;
++	void *hash;
++	int ret;
++
++	entropy_bits = min_t(u32, entropy_bits, inbuflen << 3);
++
++	read_lock_irqsave(&drng->hash_lock, flags);
++	hash_cb = drng->hash_cb;
++	hash = drng->hash;
++
++	if (unlikely(!pool->initialized)) {
++		ret = hash_cb->hash_init(shash, hash);
++		if (ret)
++			goto out;
++		pool->initialized = true;
++	}
++
++	ret = hash_cb->hash_update(shash, inbuf, inbuflen);
++	if (ret)
++		goto out;
++
++	/*
++	 * Cap the available entropy to the hash output size compliant to
++	 * SP800-90B section 3.1.5.1 table 1.
++	 */
++	entropy_bits += atomic_read_u32(&pool->aux_entropy_bits);
++	atomic_set(&pool->aux_entropy_bits,
++		   min_t(u32, entropy_bits,
++			 hash_cb->hash_digestsize(hash) << 3));
++
++out:
++	read_unlock_irqrestore(&drng->hash_lock, flags);
++	return ret;
++}
++
++int lrng_pool_insert_aux(const u8 *inbuf, u32 inbuflen, u32 entropy_bits)
++{
++	struct lrng_pool *pool = &lrng_pool;
++	unsigned long flags;
++	int ret;
++
++	spin_lock_irqsave(&pool->lock, flags);
++	ret = lrng_aux_pool_insert_locked(inbuf, inbuflen, entropy_bits);
++	spin_unlock_irqrestore(&pool->lock, flags);
++
++	lrng_es_add_entropy();
++
++	return ret;
++}
++EXPORT_SYMBOL(lrng_pool_insert_aux);
++
++/************************* Get data from entropy pool *************************/
++
++/*
++ * Get auxiliary entropy pool and its entropy content for seed buffer.
++ * Caller must hold lrng_pool.pool->lock.
++ * @outbuf: buffer to store data in with size requested_bits
++ * @requested_bits: Requested amount of entropy
++ * @return: amount of entropy in outbuf in bits.
++ */
++static u32 lrng_aux_get_pool(u8 *outbuf, u32 requested_bits)
++{
++	struct lrng_pool *pool = &lrng_pool;
++	struct shash_desc *shash = (struct shash_desc *)pool->aux_pool;
++	struct lrng_drng *drng = lrng_drng_init_instance();
++	const struct lrng_hash_cb *hash_cb;
++	unsigned long flags;
++	void *hash;
++	u32 collected_ent_bits, returned_ent_bits, unused_bits = 0,
++	    digestsize, digestsize_bits, requested_bits_osr;
++	u8 aux_output[LRNG_MAX_DIGESTSIZE];
++
++	if (unlikely(!pool->initialized))
++		return 0;
++
++	read_lock_irqsave(&drng->hash_lock, flags);
++
++	hash_cb = drng->hash_cb;
++	hash = drng->hash;
++	digestsize = hash_cb->hash_digestsize(hash);
++	digestsize_bits = digestsize << 3;
++
++	/* Cap to maximum entropy that can ever be generated with given hash */
++	lrng_cap_requested(digestsize_bits, requested_bits);
++
++	/* Ensure that no more than the size of aux_pool can be requested */
++	requested_bits = min_t(u32, requested_bits, (LRNG_MAX_DIGESTSIZE << 3));
++	requested_bits_osr = requested_bits + lrng_compress_osr();
++
++	/* Cap entropy with entropy counter from aux pool and the used digest */
++	collected_ent_bits = min_t(u32, digestsize_bits,
++			       atomic_xchg_relaxed(&pool->aux_entropy_bits, 0));
++
++	/* We collected too much entropy and put the overflow back */
++	if (collected_ent_bits > requested_bits_osr) {
++		/* Amount of bits we collected too much */
++		unused_bits = collected_ent_bits - requested_bits_osr;
++		/* Put entropy back */
++		atomic_add(unused_bits, &pool->aux_entropy_bits);
++		/* Fix collected entropy */
++		collected_ent_bits = requested_bits_osr;
++	}
++
++	/* Apply oversampling: discount requested oversampling rate */
++	returned_ent_bits = lrng_reduce_by_osr(collected_ent_bits);
++
++	pr_debug("obtained %u bits by collecting %u bits of entropy from aux pool, %u bits of entropy remaining\n",
++		 returned_ent_bits, collected_ent_bits, unused_bits);
++
++	/* Get the digest for the aux pool to be returned to the caller ... */
++	if (hash_cb->hash_final(shash, aux_output) ||
++	    /*
++	     * ... and re-initialize the aux state. Do not add the aux pool
++	     * digest for backward secrecy as it will be added with the
++	     * insertion of the complete seed buffer after it has been filled.
++	     */
++	    hash_cb->hash_init(shash, hash)) {
++		returned_ent_bits = 0;
++	} else {
++		/*
++		 * Do not truncate the output size exactly to collected_ent_bits
++		 * as the aux pool may contain data that is not credited with
++		 * entropy, but we want to use them to stir the DRNG state.
++		 */
++		memcpy(outbuf, aux_output, requested_bits >> 3);
++	}
++
++	read_unlock_irqrestore(&drng->hash_lock, flags);
++	memzero_explicit(aux_output, digestsize);
++	return returned_ent_bits;
++}
++
++static void lrng_aux_get_backtrack(struct entropy_buf *eb, u32 requested_bits,
++				   bool __unused)
++{
++	struct lrng_pool *pool = &lrng_pool;
++	unsigned long flags;
++
++	/* Ensure aux pool extraction and backtracking op are atomic */
++	spin_lock_irqsave(&pool->lock, flags);
++
++	eb->e_bits[lrng_ext_es_aux] = lrng_aux_get_pool(eb->e[lrng_ext_es_aux],
++							requested_bits);
++
++	/* Mix the extracted data back into pool for backtracking resistance */
++	if (lrng_aux_pool_insert_locked((u8 *)eb,
++					sizeof(struct entropy_buf), 0))
++		pr_warn("Backtracking resistance operation failed\n");
++
++	spin_unlock_irqrestore(&pool->lock, flags);
++}
++
++static void lrng_aux_es_state(unsigned char *buf, size_t buflen)
++{
++	const struct lrng_drng *lrng_drng_init = lrng_drng_init_instance();
++
++	/* Assume the lrng_drng_init lock is taken by caller */
++	snprintf(buf, buflen,
++		 " Hash for operating entropy pool: %s\n"
++		 " Available entropy: %u\n",
++		 lrng_drng_init->hash_cb->hash_name(),
++		 lrng_aux_avail_entropy(0));
++}
++
++struct lrng_es_cb lrng_es_aux = {
++	.name			= "Auxiliary",
++	.get_ent		= lrng_aux_get_backtrack,
++	.curr_entropy		= lrng_aux_avail_entropy,
++	.max_entropy		= lrng_get_digestsize,
++	.state			= lrng_aux_es_state,
++	.reset			= lrng_aux_reset,
++	.switch_hash		= lrng_aux_switch_hash,
++};
+--- /dev/null
++++ b/drivers/char/lrng/lrng_es_aux.h
+@@ -0,0 +1,44 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause */
++/*
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#ifndef _LRNG_ES_AUX_H
++#define _LRNG_ES_AUX_H
++
++#include "lrng_drng_mgr.h"
++#include "lrng_es_mgr_cb.h"
++
++u32 lrng_get_digestsize(void);
++void lrng_pool_set_entropy(u32 entropy_bits);
++int lrng_pool_insert_aux(const u8 *inbuf, u32 inbuflen, u32 entropy_bits);
++
++extern struct lrng_es_cb lrng_es_aux;
++
++/****************************** Helper code ***********************************/
++
++/* Obtain the security strength of the LRNG in bits */
++static inline u32 lrng_security_strength(void)
++{
++	/*
++	 * We use a hash to read the entropy in the entropy pool. According to
++	 * SP800-90B table 1, the entropy can be at most the digest size.
++	 * Considering this together with the last sentence in section 3.1.5.1.2
++	 * the security strength of a (approved) hash is equal to its output
++	 * size. On the other hand the entropy cannot be larger than the
++	 * security strength of the used DRBG.
++	 */
++	return min_t(u32, LRNG_FULL_SEED_ENTROPY_BITS, lrng_get_digestsize());
++}
++
++static inline u32 lrng_get_seed_entropy_osr(bool fully_seeded)
++{
++	u32 requested_bits = lrng_security_strength();
++
++	/* Apply oversampling during initialization according to SP800-90C */
++	if (lrng_sp80090c_compliant() && !fully_seeded)
++		requested_bits += LRNG_SEED_BUFFER_INIT_ADD_BITS;
++	return requested_bits;
++}
++
++#endif /* _LRNG_ES_AUX_H */
+--- /dev/null
++++ b/drivers/char/lrng/lrng_es_cpu.h
+@@ -0,0 +1,17 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause */
++/*
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#ifndef _LRNG_ES_CPU_H
++#define _LRNG_ES_CPU_H
++
++#include "lrng_es_mgr_cb.h"
++
++#ifdef CONFIG_LRNG_CPU
++
++extern struct lrng_es_cb lrng_es_cpu;
++
++#endif /* CONFIG_LRNG_CPU */
++
++#endif /* _LRNG_ES_CPU_H */
+--- /dev/null
++++ b/drivers/char/lrng/lrng_es_irq.h
+@@ -0,0 +1,24 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause */
++/*
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#ifndef _LRNG_ES_IRQ_H
++#define _LRNG_ES_IRQ_H
++
++#include <linux/lrng.h>
++
++#include "lrng_es_mgr_cb.h"
++
++#ifdef CONFIG_LRNG_IRQ
++void lrng_irq_es_init(bool highres_timer);
++void lrng_irq_array_add_u32(u32 data);
++
++extern struct lrng_es_cb lrng_es_irq;
++
++#else /* CONFIG_LRNG_IRQ */
++static inline void lrng_irq_es_init(bool highres_timer) { }
++static inline void lrng_irq_array_add_u32(u32 data) { }
++#endif /* CONFIG_LRNG_IRQ */
++
++#endif /* _LRNG_ES_IRQ_H */
+--- /dev/null
++++ b/drivers/char/lrng/lrng_es_jent.h
+@@ -0,0 +1,17 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause */
++/*
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#ifndef _LRNG_ES_JENT_H
++#define _LRNG_ES_JENT_H
++
++#include "lrng_es_mgr_cb.h"
++
++#ifdef CONFIG_LRNG_JENT
++
++extern struct lrng_es_cb lrng_es_jent;
++
++#endif /* CONFIG_LRNG_JENT */
++
++#endif /* _LRNG_ES_JENT_H */
+--- /dev/null
++++ b/drivers/char/lrng/lrng_es_krng.h
+@@ -0,0 +1,17 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause */
++/*
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#ifndef _LRNG_ES_RANDOM_H
++#define _LRNG_ES_RANDOM_H
++
++#include "lrng_es_mgr_cb.h"
++
++#ifdef CONFIG_LRNG_KERNEL_RNG
++
++extern struct lrng_es_cb lrng_es_krng;
++
++#endif /* CONFIG_LRNG_KERNEL_RNG */
++
++#endif /* _LRNG_ES_RANDOM_H */
+--- /dev/null
++++ b/drivers/char/lrng/lrng_es_mgr.c
+@@ -0,0 +1,506 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * LRNG Entropy sources management
++ *
++ * Copyright (C) 2022 - 2023, Stephan Mueller <smueller@chronox.de>
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/module.h>
++#include <linux/random.h>
++#include <linux/utsname.h>
++#include <linux/workqueue.h>
++#include <asm/archrandom.h>
++
++#include "lrng_drng_atomic.h"
++#include "lrng_drng_mgr.h"
++#include "lrng_es_aux.h"
++#include "lrng_es_cpu.h"
++#include "lrng_es_irq.h"
++#include "lrng_es_jent.h"
++#include "lrng_es_krng.h"
++#include "lrng_es_mgr.h"
++#include "lrng_es_sched.h"
++#include "lrng_interface_dev_common.h"
++#include "lrng_interface_random_kernel.h"
++
++struct lrng_state {
++	bool can_invalidate;		/* Can invalidate batched entropy? */
++	bool perform_seedwork;		/* Can seed work be performed? */
++	bool lrng_operational;		/* Is DRNG operational? */
++	bool lrng_fully_seeded;		/* Is DRNG fully seeded? */
++	bool lrng_min_seeded;		/* Is DRNG minimally seeded? */
++	bool all_online_numa_node_seeded;/* All NUMA DRNGs seeded? */
++
++	/*
++	 * To ensure that external entropy providers cannot dominate the
++	 * internal noise sources but yet cannot be dominated by internal
++	 * noise sources, the following booleans are intended to allow
++	 * external to provide seed once when a DRNG reseed occurs. This
++	 * triggering of external noise source is performed even when the
++	 * entropy pool has sufficient entropy.
++	 */
++
++	atomic_t boot_entropy_thresh;	/* Reseed threshold */
++	struct mutex reseed_in_progress;	/* Flag for on executing reseed */
++	struct work_struct lrng_seed_work;	/* (re)seed work queue */
++};
++
++static struct lrng_state lrng_state = {
++	false, false, false, false, false, false,
++	.boot_entropy_thresh	= ATOMIC_INIT(LRNG_INIT_ENTROPY_BITS),
++	.reseed_in_progress	=
++		__MUTEX_INITIALIZER(lrng_state.reseed_in_progress),
++};
++
++/*
++ * If the entropy count falls under this number of bits, then we
++ * should wake up processes which are selecting or polling on write
++ * access to /dev/random.
++ */
++u32 lrng_write_wakeup_bits = (LRNG_WRITE_WAKEUP_ENTROPY << 3);
++
++/*
++ * The entries must be in the same order as defined by enum lrng_internal_es and
++ * enum lrng_external_es
++ */
++struct lrng_es_cb *lrng_es[] = {
++#ifdef CONFIG_LRNG_IRQ
++	&lrng_es_irq,
++#endif
++#ifdef CONFIG_LRNG_SCHED
++	&lrng_es_sched,
++#endif
++#ifdef CONFIG_LRNG_JENT
++	&lrng_es_jent,
++#endif
++#ifdef CONFIG_LRNG_CPU
++	&lrng_es_cpu,
++#endif
++#ifdef CONFIG_LRNG_KERNEL_RNG
++	&lrng_es_krng,
++#endif
++	&lrng_es_aux
++};
++
++static bool ntg1 = false;
++#ifdef CONFIG_LRNG_AIS2031_NTG1_SEEDING_STRATEGY
++module_param(ntg1, bool, 0444);
++MODULE_PARM_DESC(ntg1, "Enable AIS20/31 NTG.1 compliant seeding strategy\n");
++#endif
++
++/* Only panic the kernel on permanent health failure if this variable is true */
++static bool lrng_panic_on_permanent_health_failure = false;
++module_param(lrng_panic_on_permanent_health_failure, bool, 0444);
++MODULE_PARM_DESC(lrng_panic_on_permanent_health_failure, "Panic on reaching permanent health failure - only required if LRNG is part of a FIPS 140-3 module\n");
++
++/********************************** Helper ***********************************/
++
++bool lrng_enforce_panic_on_permanent_health_failure(void)
++{
++	return lrng_panic_on_permanent_health_failure;
++}
++
++bool lrng_ntg1_2022_compliant(void)
++{
++	/* Implies use of /dev/random w/ O_SYNC / getrandom w/ GRND_RANDOM */
++	return ntg1;
++}
++
++void lrng_debug_report_seedlevel(const char *name)
++{
++#ifdef CONFIG_WARN_ALL_UNSEEDED_RANDOM
++	static void *previous = NULL;
++	void *caller = (void *) _RET_IP_;
++	struct lrng_drng *atomic = lrng_get_atomic();
++
++	if (READ_ONCE(previous) == caller)
++		return;
++
++	if (atomic && !atomic->fully_seeded)
++		pr_notice("%pS %s called without reaching minimally seeded level (available entropy %u)\n",
++			  caller, name, lrng_avail_entropy());
++
++	WRITE_ONCE(previous, caller);
++#endif
++}
++
++/*
++ * Reading of the LRNG pool is only allowed by one caller. The reading is
++ * only performed to (re)seed DRNGs. Thus, if this "lock" is already taken,
++ * the reseeding operation is in progress. The caller is not intended to wait
++ * but continue with its other operation.
++ */
++int lrng_pool_trylock(void)
++{
++	return mutex_trylock(&lrng_state.reseed_in_progress);
++}
++
++void lrng_pool_lock(void)
++{
++	mutex_lock(&lrng_state.reseed_in_progress);
++}
++
++void lrng_pool_unlock(void)
++{
++	mutex_unlock(&lrng_state.reseed_in_progress);
++}
++
++/* Set new entropy threshold for reseeding during boot */
++void lrng_set_entropy_thresh(u32 new_entropy_bits)
++{
++	atomic_set(&lrng_state.boot_entropy_thresh, new_entropy_bits);
++}
++
++/*
++ * Reset LRNG state - the entropy counters are reset, but the data that may
++ * or may not have entropy remains in the pools as this data will not hurt.
++ */
++void lrng_reset_state(void)
++{
++	u32 i;
++
++	for_each_lrng_es(i) {
++		if (lrng_es[i]->reset)
++			lrng_es[i]->reset();
++	}
++	lrng_state.lrng_operational = false;
++	lrng_state.lrng_fully_seeded = false;
++	lrng_state.lrng_min_seeded = false;
++	lrng_state.all_online_numa_node_seeded = false;
++	pr_debug("reset LRNG\n");
++}
++
++/* Set flag that all DRNGs are fully seeded */
++void lrng_pool_all_numa_nodes_seeded(bool set)
++{
++	lrng_state.all_online_numa_node_seeded = set;
++	if (set)
++		wake_up_all(&lrng_init_wait);
++}
++
++bool lrng_pool_all_numa_nodes_seeded_get(void)
++{
++	return lrng_state.all_online_numa_node_seeded;
++}
++
++/* Return boolean whether LRNG reached minimally seed level */
++bool lrng_state_min_seeded(void)
++{
++	return lrng_state.lrng_min_seeded;
++}
++
++/* Return boolean whether LRNG reached fully seed level */
++bool lrng_state_fully_seeded(void)
++{
++	return lrng_state.lrng_fully_seeded;
++}
++
++/* Return boolean whether LRNG is considered fully operational */
++bool lrng_state_operational(void)
++{
++	return lrng_state.lrng_operational;
++}
++
++static void lrng_init_wakeup(void)
++{
++	wake_up_all(&lrng_init_wait);
++	lrng_init_wakeup_dev();
++	lrng_kick_random_ready();
++}
++
++static u32 lrng_avail_entropy_thresh(void)
++{
++	u32 ent_thresh = lrng_security_strength();
++
++	/*
++	 * Apply oversampling during initialization according to SP800-90C as
++	 * we request a larger buffer from the ES.
++	 */
++	if (lrng_sp80090c_compliant() &&
++	    !lrng_state.all_online_numa_node_seeded)
++		ent_thresh += LRNG_SEED_BUFFER_INIT_ADD_BITS;
++
++	return ent_thresh;
++}
++
++bool lrng_fully_seeded(bool fully_seeded, u32 collected_entropy,
++		       struct entropy_buf *eb)
++{
++	/* AIS20/31 NTG.1: two entropy sources with each delivering 220 bits */
++	if (ntg1) {
++		u32 i, result = 0, ent_thresh = lrng_avail_entropy_thresh();
++
++		for_each_lrng_es(i) {
++			result += (eb ? eb->e_bits[i] :
++					lrng_es[i]->curr_entropy(ent_thresh)) >=
++				  LRNG_AIS2031_NPTRNG_MIN_ENTROPY;
++		}
++
++		return (result >= 2);
++	}
++
++	return (collected_entropy >= lrng_get_seed_entropy_osr(fully_seeded));
++}
++
++u32 lrng_entropy_rate_eb(struct entropy_buf *eb)
++{
++	u32 i, collected_entropy = 0;
++
++	for_each_lrng_es(i)
++		collected_entropy += eb->e_bits[i];
++
++	return collected_entropy;
++}
++
++/* Mark one DRNG as not fully seeded */
++void lrng_unset_fully_seeded(struct lrng_drng *drng)
++{
++	drng->fully_seeded = false;
++	lrng_pool_all_numa_nodes_seeded(false);
++
++	/*
++	 * The init DRNG instance must always be fully seeded as this instance
++	 * is the fall-back if any of the per-NUMA node DRNG instances is
++	 * insufficiently seeded. Thus, we mark the entire LRNG as
++	 * non-operational if the initial DRNG becomes not fully seeded.
++	 */
++	if (drng == lrng_drng_init_instance() && lrng_state_operational()) {
++		pr_debug("LRNG set to non-operational\n");
++		lrng_state.lrng_operational = false;
++		lrng_state.lrng_fully_seeded = false;
++
++		/* If sufficient entropy is available, reseed now. */
++		lrng_es_add_entropy();
++	}
++}
++
++/* Policy to enable LRNG operational mode */
++static void lrng_set_operational(void)
++{
++	/*
++	 * LRNG is operational if the initial DRNG is fully seeded. This state
++	 * can only occur if either the external entropy sources provided
++	 * sufficient entropy, or the SP800-90B startup test completed for
++	 * the internal ES to supply also entropy data.
++	 */
++	if (lrng_state.lrng_fully_seeded) {
++		lrng_state.lrng_operational = true;
++		lrng_init_wakeup();
++		pr_info("LRNG fully operational\n");
++	}
++}
++
++/* Available entropy in the entire LRNG considering all entropy sources */
++u32 lrng_avail_entropy(void)
++{
++	u32 i, ent = 0, ent_thresh = lrng_avail_entropy_thresh();
++
++	BUILD_BUG_ON(ARRAY_SIZE(lrng_es) != lrng_ext_es_last);
++	for_each_lrng_es(i)
++		ent += lrng_es[i]->curr_entropy(ent_thresh);
++	return ent;
++}
++
++u32 lrng_avail_entropy_aux(void)
++{
++	u32 ent_thresh = lrng_avail_entropy_thresh();
++
++	return lrng_es[lrng_ext_es_aux]->curr_entropy(ent_thresh);
++}
++
++/*
++ * lrng_init_ops() - Set seed stages of LRNG
++ *
++ * Set the slow noise source reseed trigger threshold. The initial threshold
++ * is set to the minimum data size that can be read from the pool: a word. Upon
++ * reaching this value, the next seed threshold of 128 bits is set followed
++ * by 256 bits.
++ *
++ * @eb: buffer containing the size of entropy currently injected into DRNG - if
++ *	NULL, the function obtains the available entropy from the ES.
++ */
++void lrng_init_ops(struct entropy_buf *eb)
++{
++	struct lrng_state *state = &lrng_state;
++	u32 i, requested_bits, seed_bits = 0;
++
++	if (state->lrng_operational)
++		return;
++
++	requested_bits = ntg1 ?
++		/* Approximation so that two ES should deliver 220 bits each */
++		(lrng_avail_entropy() + LRNG_AIS2031_NPTRNG_MIN_ENTROPY) :
++		/* Apply SP800-90C oversampling if applicable */
++		lrng_get_seed_entropy_osr(state->all_online_numa_node_seeded);
++
++	if (eb) {
++		seed_bits = lrng_entropy_rate_eb(eb);
++	} else {
++		u32 ent_thresh = lrng_avail_entropy_thresh();
++
++		for_each_lrng_es(i)
++			seed_bits += lrng_es[i]->curr_entropy(ent_thresh);
++	}
++
++	/* DRNG is seeded with full security strength */
++	if (state->lrng_fully_seeded) {
++		lrng_set_operational();
++		lrng_set_entropy_thresh(requested_bits);
++	} else if (lrng_fully_seeded(state->all_online_numa_node_seeded,
++				     seed_bits, eb)) {
++		if (state->can_invalidate)
++			invalidate_batched_entropy();
++
++		state->lrng_fully_seeded = true;
++		lrng_set_operational();
++		state->lrng_min_seeded = true;
++		pr_info("LRNG fully seeded with %u bits of entropy\n",
++			seed_bits);
++		lrng_set_entropy_thresh(requested_bits);
++	} else if (!state->lrng_min_seeded) {
++
++		/* DRNG is seeded with at least 128 bits of entropy */
++		if (seed_bits >= LRNG_MIN_SEED_ENTROPY_BITS) {
++			if (state->can_invalidate)
++				invalidate_batched_entropy();
++
++			state->lrng_min_seeded = true;
++			pr_info("LRNG minimally seeded with %u bits of entropy\n",
++				seed_bits);
++			lrng_set_entropy_thresh(requested_bits);
++			lrng_init_wakeup();
++
++		/* DRNG is seeded with at least LRNG_INIT_ENTROPY_BITS bits */
++		} else if (seed_bits >= LRNG_INIT_ENTROPY_BITS) {
++			pr_info("LRNG initial entropy level %u bits of entropy\n",
++				seed_bits);
++			lrng_set_entropy_thresh(LRNG_MIN_SEED_ENTROPY_BITS);
++		}
++	}
++}
++
++void __init lrng_rand_initialize_early(void)
++{
++	struct seed {
++		unsigned long data[((LRNG_MAX_DIGESTSIZE +
++				     sizeof(unsigned long) - 1) /
++				    sizeof(unsigned long))];
++		struct new_utsname utsname;
++	} seed __aligned(LRNG_KCAPI_ALIGN);
++	size_t longs = 0;
++	unsigned int i;
++
++	for (i = 0; i < ARRAY_SIZE(seed.data); i += longs) {
++		longs = arch_get_random_seed_longs(seed.data + i,
++						   ARRAY_SIZE(seed.data) - i);
++		if (longs)
++			continue;
++		longs = arch_get_random_longs(seed.data + i,
++					      ARRAY_SIZE(seed.data) - i);
++		if (longs)
++			continue;
++		longs = 1;
++	}
++	memcpy(&seed.utsname, init_utsname(), sizeof(*(init_utsname())));
++
++	lrng_pool_insert_aux((u8 *)&seed, sizeof(seed), 0);
++	memzero_explicit(&seed, sizeof(seed));
++
++	lrng_force_fully_seeded();
++}
++
++void __init lrng_rand_initialize(void)
++{
++	unsigned long entropy = random_get_entropy();
++	ktime_t time = ktime_get_real();
++
++	lrng_pool_insert_aux((u8 *)&entropy, sizeof(entropy), 0);
++	lrng_pool_insert_aux((u8 *)&time, sizeof(time), 0);
++
++	/* Initialize the seed work queue */
++	INIT_WORK(&lrng_state.lrng_seed_work, lrng_drng_seed_work);
++	lrng_state.perform_seedwork = true;
++
++	invalidate_batched_entropy();
++
++	lrng_state.can_invalidate = true;
++}
++
++#ifndef CONFIG_LRNG_RANDOM_IF
++static int __init lrng_rand_initialize_call(void)
++{
++	lrng_rand_initialize_early();
++	lrng_rand_initialize();
++	return 0;
++}
++
++early_initcall(lrng_rand_initialize_call);
++#endif
++
++/* Interface requesting a reseed of the DRNG */
++void lrng_es_add_entropy(void)
++{
++	/*
++	 * Once all DRNGs are fully seeded, the system-triggered arrival of
++	 * entropy will not cause any reseeding any more.
++	 */
++	if (likely(lrng_state.all_online_numa_node_seeded))
++		return;
++
++	/* Only trigger the DRNG reseed if we have collected entropy. */
++	if (lrng_avail_entropy() <
++	    atomic_read_u32(&lrng_state.boot_entropy_thresh))
++		return;
++
++	/* Ensure that the seeding only occurs once at any given time. */
++	if (!lrng_pool_trylock())
++		return;
++
++	/* Seed the DRNG with any available noise. */
++	if (lrng_state.perform_seedwork)
++		schedule_work(&lrng_state.lrng_seed_work);
++	else
++		lrng_drng_seed_work(NULL);
++}
++
++/* Fill the seed buffer with data from the noise sources */
++void lrng_fill_seed_buffer(struct entropy_buf *eb, u32 requested_bits,
++			   bool force)
++{
++	struct lrng_state *state = &lrng_state;
++	u32 i, req_ent = lrng_sp80090c_compliant() ?
++			  lrng_security_strength() : LRNG_MIN_SEED_ENTROPY_BITS;
++
++	/* Guarantee that requested bits is a multiple of bytes */
++	BUILD_BUG_ON(LRNG_DRNG_SECURITY_STRENGTH_BITS % 8);
++
++	/* always reseed the DRNG with the current time stamp */
++	eb->now = random_get_entropy();
++
++	/*
++	 * Require at least 128 bits of entropy for any reseed. If the LRNG is
++	 * operated SP800-90C compliant we want to comply with SP800-90A section
++	 * 9.2 mandating that DRNG is reseeded with the security strength.
++	 */
++	if (!force &&
++	    state->lrng_fully_seeded && (lrng_avail_entropy() < req_ent)) {
++		for_each_lrng_es(i)
++			eb->e_bits[i] = 0;
++
++		goto wakeup;
++	}
++
++	/* Concatenate the output of the entropy sources. */
++	for_each_lrng_es(i) {
++		lrng_es[i]->get_ent(eb, requested_bits,
++				    state->lrng_fully_seeded);
++	}
++
++	/* allow external entropy provider to provide seed */
++	lrng_state_exseed_allow_all();
++
++wakeup:
++	lrng_writer_wakeup();
++}
+--- /dev/null
++++ b/drivers/char/lrng/lrng_es_mgr.h
+@@ -0,0 +1,56 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause */
++/*
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#ifndef _LRNG_ES_MGR_H
++#define _LRNG_ES_MGR_H
++
++#include "lrng_es_mgr_cb.h"
++
++/*************************** General LRNG parameter ***************************/
++
++#define LRNG_DRNG_BLOCKSIZE 64		/* Maximum of DRNG block sizes */
++
++/* Helper to concatenate a macro with an integer type */
++#define LRNG_PASTER(x, y) x ## y
++#define LRNG_UINT32_C(x) LRNG_PASTER(x, U)
++
++/************************* Entropy sources management *************************/
++
++extern struct lrng_es_cb *lrng_es[];
++
++#define for_each_lrng_es(ctr)		\
++	for ((ctr) = 0; (ctr) < lrng_ext_es_last; (ctr)++)
++
++bool lrng_enforce_panic_on_permanent_health_failure(void);
++bool lrng_ntg1_2022_compliant(void);
++bool lrng_pool_all_numa_nodes_seeded_get(void);
++bool lrng_state_min_seeded(void);
++void lrng_debug_report_seedlevel(const char *name);
++void lrng_rand_initialize_early(void);
++void lrng_rand_initialize(void);
++bool lrng_state_operational(void);
++
++extern u32 lrng_write_wakeup_bits;
++void lrng_set_entropy_thresh(u32 new);
++u32 lrng_avail_entropy(void);
++u32 lrng_avail_entropy_aux(void);
++void lrng_reset_state(void);
++
++bool lrng_state_fully_seeded(void);
++
++int lrng_pool_trylock(void);
++void lrng_pool_lock(void);
++void lrng_pool_unlock(void);
++void lrng_pool_all_numa_nodes_seeded(bool set);
++
++bool lrng_fully_seeded(bool fully_seeded, u32 collected_entropy,
++		       struct entropy_buf *eb);
++u32 lrng_entropy_rate_eb(struct entropy_buf *eb);
++void lrng_unset_fully_seeded(struct lrng_drng *drng);
++void lrng_fill_seed_buffer(struct entropy_buf *eb, u32 requested_bits,
++			   bool force);
++void lrng_init_ops(struct entropy_buf *eb);
++
++#endif /* _LRNG_ES_MGR_H */
+--- /dev/null
++++ b/drivers/char/lrng/lrng_es_mgr_cb.h
+@@ -0,0 +1,87 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause */
++/*
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ *
++ * Definition of an entropy source.
++ */
++
++#ifndef _LRNG_ES_MGR_CB_H
++#define _LRNG_ES_MGR_CB_H
++
++#include <linux/lrng.h>
++
++#include "lrng_definitions.h"
++#include "lrng_drng_mgr.h"
++
++enum lrng_internal_es {
++#ifdef CONFIG_LRNG_IRQ
++	lrng_int_es_irq,			/* IRQ-based entropy source */
++#endif
++#ifdef CONFIG_LRNG_SCHED
++	lrng_int_es_sched,			/* Scheduler entropy source */
++#endif
++	lrng_int_es_last,			/* MUST be the last entry */
++};
++
++enum lrng_external_es {
++	lrng_ext_link = lrng_int_es_last - 1,	/* Link entry */
++#ifdef CONFIG_LRNG_JENT
++	lrng_ext_es_jitter,			/* Jitter RNG */
++#endif
++#ifdef CONFIG_LRNG_CPU
++	lrng_ext_es_cpu,			/* CPU-based, e.g. RDSEED */
++#endif
++#ifdef CONFIG_LRNG_KERNEL_RNG
++	lrng_ext_es_krng,			/* random.c */
++#endif
++	lrng_ext_es_aux,			/* MUST BE LAST ES! */
++	lrng_ext_es_last			/* MUST be the last entry */
++};
++
++struct entropy_buf {
++	u8 e[lrng_ext_es_last][LRNG_DRNG_INIT_SEED_SIZE_BYTES];
++	u32 now, e_bits[lrng_ext_es_last];
++};
++
++/*
++ * struct lrng_es_cb - callback defining an entropy source
++ * @name: Name of the entropy source.
++ * @get_ent: Fetch entropy into the entropy_buf. The ES shall only deliver
++ *	     data if its internal initialization is complete, including any
++ *	     SP800-90B startup testing or similar.
++ * @curr_entropy: Return amount of currently available entropy.
++ * @max_entropy: Maximum amount of entropy the entropy source is able to
++ *		 maintain.
++ * @state: Buffer with human-readable ES state.
++ * @reset: Reset entropy source (drop all entropy and reinitialize).
++ *	   This callback may be NULL.
++ * @switch_hash: callback to switch from an old hash callback definition to
++ *		 a new one. This callback may be NULL.
++ */
++struct lrng_es_cb {
++	const char *name;
++	void (*get_ent)(struct entropy_buf *eb, u32 requested_bits,
++			bool fully_seeded);
++	u32 (*curr_entropy)(u32 requested_bits);
++	u32 (*max_entropy)(void);
++	void (*state)(unsigned char *buf, size_t buflen);
++	void (*reset)(void);
++	int (*switch_hash)(struct lrng_drng *drng, int node,
++			   const struct lrng_hash_cb *new_cb, void *new_hash,
++			   const struct lrng_hash_cb *old_cb);
++};
++
++/* Allow entropy sources to tell the ES manager that new entropy is there */
++void lrng_es_add_entropy(void);
++
++/* Cap to maximum entropy that can ever be generated with given hash */
++#define lrng_cap_requested(__digestsize_bits, __requested_bits)		\
++	do {								\
++		if (__digestsize_bits < __requested_bits) {		\
++			pr_debug("Cannot satisfy requested entropy %u due to insufficient hash size %u\n",\
++				 __requested_bits, __digestsize_bits);	\
++			__requested_bits = __digestsize_bits;		\
++		}							\
++	} while (0)
++
++#endif /* _LRNG_ES_MGR_CB_H */
+--- /dev/null
++++ b/drivers/char/lrng/lrng_es_sched.h
+@@ -0,0 +1,20 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause */
++/*
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#ifndef _LRNG_ES_SCHED_H
++#define _LRNG_ES_SCHED_H
++
++#include "lrng_es_mgr_cb.h"
++
++#ifdef CONFIG_LRNG_SCHED
++void lrng_sched_es_init(bool highres_timer);
++
++extern struct lrng_es_cb lrng_es_sched;
++
++#else /* CONFIG_LRNG_SCHED */
++static inline void lrng_sched_es_init(bool highres_timer) { }
++#endif /* CONFIG_LRNG_SCHED */
++
++#endif /* _LRNG_ES_SCHED_H */
+--- /dev/null
++++ b/drivers/char/lrng/lrng_es_timer_common.h
+@@ -0,0 +1,83 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause */
++/*
++ * LRNG Slow Noise Source: Time stamp array handling
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#ifndef _LRNG_ES_TIMER_COMMON_H
++#define _LRNG_ES_TIMER_COMMON_H
++
++bool lrng_gcd_tested(void);
++void lrng_gcd_set(u32 running_gcd);
++u32 lrng_gcd_get(void);
++u32 lrng_gcd_analyze(u32 *history, size_t nelem);
++void lrng_gcd_add_value(u32 time);
++bool lrng_highres_timer(void);
++
++/*
++ * To limit the impact on the interrupt handling, the LRNG concatenates
++ * entropic LSB parts of the time stamps in a per-CPU array and only
++ * injects them into the entropy pool when the array is full.
++ */
++
++/* Store multiple integers in one u32 */
++#define LRNG_DATA_SLOTSIZE_BITS		(8)
++#define LRNG_DATA_SLOTSIZE_MASK		((1 << LRNG_DATA_SLOTSIZE_BITS) - 1)
++#define LRNG_DATA_ARRAY_MEMBER_BITS	(4 << 3) /* ((sizeof(u32)) << 3) */
++#define LRNG_DATA_SLOTS_PER_UINT	(LRNG_DATA_ARRAY_MEMBER_BITS / \
++					 LRNG_DATA_SLOTSIZE_BITS)
++
++/*
++ * Number of time values to store in the array - in small environments
++ * only one atomic_t variable per CPU is used.
++ */
++#define LRNG_DATA_NUM_VALUES		(CONFIG_LRNG_COLLECTION_SIZE)
++/* Mask of LSB of time stamp to store */
++#define LRNG_DATA_WORD_MASK		(LRNG_DATA_NUM_VALUES - 1)
++
++#define LRNG_DATA_SLOTS_MASK		(LRNG_DATA_SLOTS_PER_UINT - 1)
++#define LRNG_DATA_ARRAY_SIZE		(LRNG_DATA_NUM_VALUES /	\
++					 LRNG_DATA_SLOTS_PER_UINT)
++
++/* Starting bit index of slot */
++static inline unsigned int lrng_data_slot2bitindex(unsigned int slot)
++{
++	return (LRNG_DATA_SLOTSIZE_BITS * slot);
++}
++
++/* Convert index into the array index */
++static inline unsigned int lrng_data_idx2array(unsigned int idx)
++{
++	return idx / LRNG_DATA_SLOTS_PER_UINT;
++}
++
++/* Convert index into the slot of a given array index */
++static inline unsigned int lrng_data_idx2slot(unsigned int idx)
++{
++	return idx & LRNG_DATA_SLOTS_MASK;
++}
++
++/* Convert value into slot value */
++static inline unsigned int lrng_data_slot_val(unsigned int val,
++					      unsigned int slot)
++{
++	return val << lrng_data_slot2bitindex(slot);
++}
++
++/*
++ * Return the pointers for the previous and current units to inject a u32 into.
++ * Also return the mask which the u32 word is to be processed.
++ */
++static inline void lrng_data_split_u32(u32 *ptr, u32 *pre_ptr, u32 *mask)
++{
++	/* ptr to previous unit */
++	*pre_ptr = (*ptr - LRNG_DATA_SLOTS_PER_UINT) & LRNG_DATA_WORD_MASK;
++	*ptr &= LRNG_DATA_WORD_MASK;
++
++	/* mask to split data into the two parts for the two units */
++	*mask = ((1 << (*pre_ptr & (LRNG_DATA_SLOTS_PER_UINT - 1)) *
++			LRNG_DATA_SLOTSIZE_BITS)) - 1;
++}
++
++#endif /* _LRNG_ES_TIMER_COMMON_H */
+--- /dev/null
++++ b/drivers/char/lrng/lrng_interface_dev_common.h
+@@ -0,0 +1,51 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause */
++/*
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#ifndef _LRNG_INTERFACE_DEV_COMMON_H
++#define _LRNG_INTERFACE_DEV_COMMON_H
++
++#include <linux/poll.h>
++#include <linux/wait.h>
++
++/******************* Upstream functions hooked into the LRNG ******************/
++enum lrng_external_noise_source {
++	lrng_noise_source_hw,
++	lrng_noise_source_user
++};
++
++#ifdef CONFIG_LRNG_COMMON_DEV_IF
++void lrng_writer_wakeup(void);
++void lrng_init_wakeup_dev(void);
++void lrng_state_exseed_set(enum lrng_external_noise_source source, bool type);
++void lrng_state_exseed_allow_all(void);
++#else /* CONFIG_LRNG_COMMON_DEV_IF */
++static inline void lrng_writer_wakeup(void) { }
++static inline void lrng_init_wakeup_dev(void) { }
++static inline void
++lrng_state_exseed_set(enum lrng_external_noise_source source, bool type) { }
++static inline void lrng_state_exseed_allow_all(void) { }
++#endif /* CONFIG_LRNG_COMMON_DEV_IF */
++
++/****** Downstream service functions to actual interface implementations ******/
++
++bool lrng_state_exseed_allow(enum lrng_external_noise_source source);
++int lrng_fasync(int fd, struct file *filp, int on);
++long lrng_ioctl(struct file *f, unsigned int cmd, unsigned long arg);
++ssize_t lrng_drng_write(struct file *file, const char __user *buffer,
++			size_t count, loff_t *ppos);
++ssize_t lrng_drng_write_common(const char __user *buffer, size_t count,
++			       u32 entropy_bits);
++__poll_t lrng_random_poll(struct file *file, poll_table *wait);
++ssize_t lrng_read_common_block(int nonblock, int pr,
++			       char __user *buf, size_t nbytes);
++ssize_t lrng_drng_read_block(struct file *file, char __user *buf, size_t nbytes,
++			     loff_t *ppos);
++ssize_t lrng_read_seed(char __user *buf, size_t nbytes, unsigned int flags);
++ssize_t lrng_read_common(char __user *buf, size_t nbytes, bool pr);
++bool lrng_need_entropy(void);
++
++extern struct wait_queue_head lrng_write_wait;
++
++#endif /* _LRNG_INTERFACE_DEV_COMMON_H */
+--- /dev/null
++++ b/drivers/char/lrng/lrng_interface_random_kernel.h
+@@ -0,0 +1,17 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause */
++/*
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#ifndef _LRNG_INTERFACE_RANDOM_H
++#define _LRNG_INTERFACE_RANDOM_H
++
++#ifdef CONFIG_LRNG_RANDOM_IF
++void invalidate_batched_entropy(void);
++void lrng_kick_random_ready(void);
++#else /* CONFIG_LRNG_RANDOM_IF */
++static inline void invalidate_batched_entropy(void) { }
++static inline void lrng_kick_random_ready(void) { }
++#endif /* CONFIG_LRNG_RANDOM_IF */
++
++#endif /* _LRNG_INTERFACE_RANDOM_H */
+--- /dev/null
++++ b/drivers/char/lrng/lrng_numa.h
+@@ -0,0 +1,11 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause */
++/*
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#ifndef _LRNG_NUMA_H
++#define _LRNG_NUMA_H
++
++static inline struct lrng_drng **lrng_drng_instances(void) { return NULL; }
++
++#endif /* _LRNG_NUMA_H */
+--- /dev/null
++++ b/drivers/char/lrng/lrng_sha.h
+@@ -0,0 +1,14 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause */
++/*
++ * LRNG SHA definition usable in atomic contexts right from the start of the
++ * kernel.
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#ifndef _LRNG_SHA_H
++#define _LRNG_SHA_H
++
++extern const struct lrng_hash_cb lrng_sha_hash_cb;
++
++#endif /* _LRNG_SHA_H */
+--- /dev/null
++++ b/drivers/char/lrng/lrng_sha1.c
+@@ -0,0 +1,88 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * Backend for the LRNG providing the SHA-1 implementation that can be used
++ * without the kernel crypto API available including during early boot and in
++ * atomic contexts.
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/lrng.h>
++#include <crypto/sha1.h>
++#include <crypto/sha1_base.h>
++
++#include "lrng_sha.h"
++
++/*
++ * If the SHA-256 support is not compiled, we fall back to SHA-1 that is always
++ * compiled and present in the kernel.
++ */
++static u32 lrng_sha1_hash_digestsize(void *hash)
++{
++	return SHA1_DIGEST_SIZE;
++}
++
++static void lrng_sha1_block_fn(struct sha1_state *sctx, const u8 *src,
++			       int blocks)
++{
++	u32 temp[SHA1_WORKSPACE_WORDS];
++
++	while (blocks--) {
++		sha1_transform(sctx->state, src, temp);
++		src += SHA1_BLOCK_SIZE;
++	}
++	memzero_explicit(temp, sizeof(temp));
++}
++
++static int lrng_sha1_hash_init(struct shash_desc *shash, void *hash)
++{
++	/*
++	 * We do not need a TFM - we only need sufficient space for
++	 * struct sha1_state on the stack.
++	 */
++	sha1_base_init(shash);
++	return 0;
++}
++
++static int lrng_sha1_hash_update(struct shash_desc *shash,
++				 const u8 *inbuf, u32 inbuflen)
++{
++	return sha1_base_do_update(shash, inbuf, inbuflen, lrng_sha1_block_fn);
++}
++
++static int lrng_sha1_hash_final(struct shash_desc *shash, u8 *digest)
++{
++	return sha1_base_do_finalize(shash, lrng_sha1_block_fn) ?:
++	       sha1_base_finish(shash, digest);
++}
++
++static const char *lrng_sha1_hash_name(void)
++{
++	return "SHA-1";
++}
++
++static void lrng_sha1_hash_desc_zero(struct shash_desc *shash)
++{
++	memzero_explicit(shash_desc_ctx(shash), sizeof(struct sha1_state));
++}
++
++static void *lrng_sha1_hash_alloc(void)
++{
++	pr_info("Hash %s allocated\n", lrng_sha1_hash_name());
++	return NULL;
++}
++
++static void lrng_sha1_hash_dealloc(void *hash) { }
++
++const struct lrng_hash_cb lrng_sha_hash_cb = {
++	.hash_name		= lrng_sha1_hash_name,
++	.hash_alloc		= lrng_sha1_hash_alloc,
++	.hash_dealloc		= lrng_sha1_hash_dealloc,
++	.hash_digestsize	= lrng_sha1_hash_digestsize,
++	.hash_init		= lrng_sha1_hash_init,
++	.hash_update		= lrng_sha1_hash_update,
++	.hash_final		= lrng_sha1_hash_final,
++	.hash_desc_zero		= lrng_sha1_hash_desc_zero,
++};
+--- /dev/null
++++ b/drivers/char/lrng/lrng_sha256.c
+@@ -0,0 +1,72 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * Backend for the LRNG providing the SHA-256 implementation that can be used
++ * without the kernel crypto API available including during early boot and in
++ * atomic contexts.
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/lrng.h>
++#include <crypto/sha2.h>
++
++#include "lrng_sha.h"
++
++static u32 lrng_sha256_hash_digestsize(void *hash)
++{
++	return SHA256_DIGEST_SIZE;
++}
++
++static int lrng_sha256_hash_init(struct shash_desc *shash, void *hash)
++{
++	/*
++	 * We do not need a TFM - we only need sufficient space for
++	 * struct sha256_state on the stack.
++	 */
++	sha256_init(shash_desc_ctx(shash));
++	return 0;
++}
++
++static int lrng_sha256_hash_update(struct shash_desc *shash,
++				   const u8 *inbuf, u32 inbuflen)
++{
++	sha256_update(shash_desc_ctx(shash), inbuf, inbuflen);
++	return 0;
++}
++
++static int lrng_sha256_hash_final(struct shash_desc *shash, u8 *digest)
++{
++	sha256_final(shash_desc_ctx(shash), digest);
++	return 0;
++}
++
++static const char *lrng_sha256_hash_name(void)
++{
++	return "SHA-256";
++}
++
++static void lrng_sha256_hash_desc_zero(struct shash_desc *shash)
++{
++	memzero_explicit(shash_desc_ctx(shash), sizeof(struct sha256_state));
++}
++
++static void *lrng_sha256_hash_alloc(void)
++{
++	pr_info("Hash %s allocated\n", lrng_sha256_hash_name());
++	return NULL;
++}
++
++static void lrng_sha256_hash_dealloc(void *hash) { }
++
++const struct lrng_hash_cb lrng_sha_hash_cb = {
++	.hash_name		= lrng_sha256_hash_name,
++	.hash_alloc		= lrng_sha256_hash_alloc,
++	.hash_dealloc		= lrng_sha256_hash_dealloc,
++	.hash_digestsize	= lrng_sha256_hash_digestsize,
++	.hash_init		= lrng_sha256_hash_init,
++	.hash_update		= lrng_sha256_hash_update,
++	.hash_final		= lrng_sha256_hash_final,
++	.hash_desc_zero		= lrng_sha256_hash_desc_zero,
++};
+--- /dev/null
++++ b/drivers/char/lrng/lrng_sysctl.h
+@@ -0,0 +1,15 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause */
++/*
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#ifndef _LRNG_SYSCTL_H
++#define _LRNG_SYSCTL_H
++
++#ifdef CONFIG_LRNG_SYSCTL
++void lrng_sysctl_update_max_write_thresh(u32 new_digestsize);
++#else
++static inline void lrng_sysctl_update_max_write_thresh(u32 new_digestsize) { }
++#endif
++
++#endif /* _LRNG_SYSCTL_H */
+--- /dev/null
++++ b/include/linux/lrng.h
+@@ -0,0 +1,251 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause */
++/*
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#ifndef _LRNG_H
++#define _LRNG_H
++
++#include <crypto/hash.h>
++#include <linux/errno.h>
++#include <linux/sched.h>
++#include <linux/types.h>
++
++/*
++ * struct lrng_drng_cb - cryptographic callback functions defining a DRNG
++ * @drng_name		Name of DRNG
++ * @drng_alloc:		Allocate DRNG -- the provided integer should be used for
++ *			sanity checks.
++ *			return: allocated data structure or PTR_ERR on error
++ * @drng_dealloc:	Deallocate DRNG
++ * @drng_seed:		Seed the DRNG with data of arbitrary length drng: is
++ *			pointer to data structure allocated with drng_alloc
++ *			return: >= 0 on success, < 0 on error
++ * @drng_generate:	Generate random numbers from the DRNG with arbitrary
++ *			length
++ */
++struct lrng_drng_cb {
++	const char *(*drng_name)(void);
++	void *(*drng_alloc)(u32 sec_strength);
++	void (*drng_dealloc)(void *drng);
++	int (*drng_seed)(void *drng, const u8 *inbuf, u32 inbuflen);
++	int (*drng_generate)(void *drng, u8 *outbuf, u32 outbuflen);
++};
++
++/*
++ * struct lrng_hash_cb - cryptographic callback functions defining a hash
++ * @hash_name		Name of Hash used for reading entropy pool arbitrary
++ *			length
++ * @hash_alloc:		Allocate the hash for reading the entropy pool
++ *			return: allocated data structure (NULL is success too)
++ *				or ERR_PTR on error
++ * @hash_dealloc:	Deallocate Hash
++ * @hash_digestsize:	Return the digestsize for the used hash to read out
++ *			entropy pool
++ *			hash: is pointer to data structure allocated with
++ *			      hash_alloc
++ *			return: size of digest of hash in bytes
++ * @hash_init:		Initialize hash
++ *			hash: is pointer to data structure allocated with
++ *			      hash_alloc
++ *			return: 0 on success, < 0 on error
++ * @hash_update:	Update hash operation
++ *			hash: is pointer to data structure allocated with
++ *			      hash_alloc
++ *			return: 0 on success, < 0 on error
++ * @hash_final		Final hash operation
++ *			hash: is pointer to data structure allocated with
++ *			      hash_alloc
++ *			return: 0 on success, < 0 on error
++ * @hash_desc_zero	Zeroization of hash state buffer
++ *
++ * Assumptions:
++ *
++ * 1. Hash operation will not sleep
++ * 2. The hash' volatile state information is provided with *shash by caller.
++ */
++struct lrng_hash_cb {
++	const char *(*hash_name)(void);
++	void *(*hash_alloc)(void);
++	void (*hash_dealloc)(void *hash);
++	u32 (*hash_digestsize)(void *hash);
++	int (*hash_init)(struct shash_desc *shash, void *hash);
++	int (*hash_update)(struct shash_desc *shash, const u8 *inbuf,
++			   u32 inbuflen);
++	int (*hash_final)(struct shash_desc *shash, u8 *digest);
++	void (*hash_desc_zero)(struct shash_desc *shash);
++};
++
++/* Register cryptographic backend */
++#ifdef CONFIG_LRNG_SWITCH
++int lrng_set_drng_cb(const struct lrng_drng_cb *cb);
++int lrng_set_hash_cb(const struct lrng_hash_cb *cb);
++#else	/* CONFIG_LRNG_SWITCH */
++static inline int
++lrng_set_drng_cb(const struct lrng_drng_cb *cb) { return -EOPNOTSUPP; }
++static inline int
++lrng_set_hash_cb(const struct lrng_hash_cb *cb) { return -EOPNOTSUPP; }
++#endif	/* CONFIG_LRNG_SWITCH */
++
++/* Callback to feed events to the scheduler entropy source */
++#ifdef CONFIG_LRNG_SCHED
++extern void add_sched_randomness(const struct task_struct *p, int cpu);
++#else
++static inline void
++add_sched_randomness(const struct task_struct *p, int cpu) { }
++#endif
++
++/*
++ * lrng_get_random_bytes() - Provider of cryptographic strong random numbers
++ * for kernel-internal usage.
++ *
++ * This function is appropriate for in-kernel use cases operating in atomic
++ * contexts. It will always use the ChaCha20 DRNG and it may be the case that
++ * it is not fully seeded when being used.
++ *
++ * @buf: buffer to store the random bytes
++ * @nbytes: size of the buffer
++ */
++#ifdef CONFIG_LRNG_DRNG_ATOMIC
++void lrng_get_random_bytes(void *buf, int nbytes);
++#endif
++
++/*
++ * lrng_get_random_bytes_full() - Provider of cryptographic strong
++ * random numbers for kernel-internal usage from a fully initialized LRNG.
++ *
++ * This function will always return random numbers from a fully seeded and
++ * fully initialized LRNG.
++ *
++ * This function is appropriate only for non-atomic use cases as this
++ * function may sleep. It provides access to the full functionality of LRNG
++ * including the switchable DRNG support, that may support other DRNGs such
++ * as the SP800-90A DRBG.
++ *
++ * @buf: buffer to store the random bytes
++ * @nbytes: size of the buffer
++ */
++#ifdef CONFIG_LRNG
++void lrng_get_random_bytes_full(void *buf, int nbytes);
++#endif
++
++/*
++ * lrng_get_random_bytes_min() - Provider of cryptographic strong
++ * random numbers for kernel-internal usage from at least a minimally seeded
++ * LRNG, which is not necessarily fully initialized yet (e.g. SP800-90C
++ * oversampling applied in FIPS mode is not applied yet).
++ *
++ * This function is appropriate only for non-atomic use cases as this
++ * function may sleep. It provides access to the full functionality of LRNG
++ * including the switchable DRNG support, that may support other DRNGs such
++ * as the SP800-90A DRBG.
++ *
++ * @buf: buffer to store the random bytes
++ * @nbytes: size of the buffer
++ */
++#ifdef CONFIG_LRNG
++void lrng_get_random_bytes_min(void *buf, int nbytes);
++#endif
++
++/*
++ * lrng_get_random_bytes_pr() - Provider of cryptographic strong
++ * random numbers for kernel-internal usage from a fully initialized LRNG and
++ * requiring a reseed from the entropy sources before.
++ *
++ * This function will always return random numbers from a fully seeded and
++ * fully initialized LRNG.
++ *
++ * This function is appropriate only for non-atomic use cases as this
++ * function may sleep. It provides access to the full functionality of LRNG
++ * including the switchable DRNG support, that may support other DRNGs such
++ * as the SP800-90A DRBG.
++ *
++ * This call only returns no more data than entropy was pulled from the
++ * entropy sources. Thus, it is likely that this call returns less data
++ * than requested by the caller. Also, the caller MUST be prepared that this
++ * call returns 0 bytes, i.e. it did not generate data.
++ *
++ * @buf: buffer to store the random bytes
++ * @nbytes: size of the buffer
++ *
++ * @return: positive number indicates amount of generated bytes, < 0 on error
++ */
++#ifdef CONFIG_LRNG
++int lrng_get_random_bytes_pr(void *buf, int nbytes);
++#endif
++
++/*
++ * lrng_get_seed() - Fill buffer with data from entropy sources
++ *
++ * This call allows accessing the entropy sources directly and fill the buffer
++ * with data from all available entropy sources. This filled buffer is
++ * identical to the temporary seed buffer used by the LRNG to seed its DRNGs.
++ *
++ * The call is to allows users to seed their DRNG directly from the entropy
++ * sources in case the caller does not want to use the LRNG's DRNGs. This
++ * buffer can be directly used to seed the caller's DRNG from.
++ *
++ * The call blocks as long as one LRNG DRNG is not yet fully seeded. If
++ * LRNG_GET_SEED_NONBLOCK is specified, it does not block in this case, but
++ * returns with an error.
++ *
++ * Considering SP800-90C, there is a differentiation between the seeding
++ * requirements during instantiating a DRNG and at runtime of the DRNG. When
++ * specifying LRNG_GET_SEED_FULLY_SEEDED the caller indicates the DRNG was
++ * already fully seeded and the regular amount of entropy is requested.
++ * Otherwise, the LRNG will obtain the entropy rate required for initial
++ * seeding. The following minimum entropy rates will be obtained:
++ *
++ * * FIPS mode:
++ *	* Initial seeding: 384 bits of entropy
++ *	* Runtime seeding: 256 bits of entropy
++ * * Non-FIPS mode:
++ *	* 128 bits of entropy in any case
++ *
++ * Albeit these are minimum entropy rates, the LRNG tries to request the
++ * given amount of entropy from each entropy source individually. If the
++ * minimum amount of entropy cannot be obtained collectively by all entropy
++ * sources, the LRNG will not fill the buffer.
++ *
++ * The return data in buf is structurally equivalent to the following
++ * definition:
++ *
++ * struct {
++ *	u64 seedlen;
++ *	u64 entropy_rate;
++ *	struct entropy_buf seed;
++ * } __attribute((__packed__));
++ *
++ * As struct entropy_buf is not known outsize of the LRNG, the LRNG fills
++ * seedlen first with the size of struct entropy_buf. If the caller-provided
++ * buffer buf is smaller than u64, then -EINVAL is returned
++ * and buf is not touched. If it is u64 or larger but smaller
++ * than the size of the structure above, -EMSGSIZE is returned and seedlen
++ * is filled with the size of the buffer. Finally, if buf is large
++ * enough to hold all data, it is filled with the seed data and the seedlen
++ * is set to sizeof(struct entropy_buf). The entropy rate is returned with
++ * the variable entropy_rate and provides the value in bits.
++ *
++ * The seed buffer is the data that should be handed to the caller's DRNG as
++ * seed data.
++ *
++ * @buf [out] Buffer to be filled with data from the entropy sources - note, the
++ *	      buffer is marked as u64 to ensure it is aligned to 64 bits.
++ * @nbytes [in] Size of the buffer allocated by the caller - this value
++ *		provides size of @param buf in bytes.
++ * @flags [in] Flags field to adjust the behavior
++ *
++ * @return -EINVAL or -EMSGSIZE indicating the buffer is too small, -EAGAIN when
++ *	   the call would block, but NONBLOCK is specified, > 0 the size of
++ *	   the filled buffer.
++ */
++#ifdef CONFIG_LRNG
++enum lrng_get_seed_flags {
++	LRNG_GET_SEED_NONBLOCK = 0x0001, /**< Do not block the call */
++	LRNG_GET_SEED_FULLY_SEEDED = 0x0002, /**< DRNG is fully seeded */
++};
++
++ssize_t lrng_get_seed(u64 *buf, size_t nbytes, unsigned int flags);
++#endif
++
++#endif /* _LRNG_H */
+From c214eec976715ae46ed8e6eee5a2147c8fd155eb Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Sun, 15 May 2022 15:40:46 +0200
+Subject: [PATCH 02/25] LRNG - allocate one DRNG instance per NUMA node
+
+In order to improve NUMA-locality when serving getrandom(2) requests,
+allocate one DRNG instance per node.
+
+The DRNG instance that is present right from the start of the kernel is
+reused as the first per-NUMA-node DRNG. For all remaining online NUMA
+nodes a new DRNG instance is allocated.
+
+During boot time, the multiple DRNG instances are seeded sequentially.
+With this, the first DRNG instance (referenced as the initial DRNG
+in the code) is completely seeded with 256 bits of entropy before the
+next DRNG instance is completely seeded.
+
+When random numbers are requested, the NUMA-node-local DRNG is checked
+whether it has been already fully seeded. If this is not the case, the
+initial DRNG is used to serve the request.
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+---
+ drivers/char/lrng/Makefile    |   2 +
+ drivers/char/lrng/lrng_numa.c | 124 ++++++++++++++++++++++++++++++++++
+ drivers/char/lrng/lrng_numa.h |   4 ++
+ drivers/char/lrng/lrng_proc.h |  11 +++
+ 4 files changed, 141 insertions(+)
+ create mode 100644 drivers/char/lrng/lrng_numa.c
+ create mode 100644 drivers/char/lrng/lrng_proc.h
+
+--- a/drivers/char/lrng/Makefile
++++ b/drivers/char/lrng/Makefile
+@@ -8,4 +8,6 @@ obj-y					+= lrng_es_mgr.o lrng_drng_mgr
+ obj-$(CONFIG_LRNG_SHA256)		+= lrng_sha256.o
+ obj-$(CONFIG_LRNG_SHA1)			+= lrng_sha1.o
+ 
++obj-$(CONFIG_NUMA)			+= lrng_numa.o
++
+ obj-$(CONFIG_LRNG_DRNG_CHACHA20)	+= lrng_drng_chacha20.o
+--- /dev/null
++++ b/drivers/char/lrng/lrng_numa.c
+@@ -0,0 +1,124 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * LRNG NUMA support
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/lrng.h>
++#include <linux/slab.h>
++
++#include "lrng_drng_mgr.h"
++#include "lrng_es_irq.h"
++#include "lrng_es_mgr.h"
++#include "lrng_numa.h"
++#include "lrng_proc.h"
++
++static struct lrng_drng **lrng_drng __read_mostly = NULL;
++
++struct lrng_drng **lrng_drng_instances(void)
++{
++	/* counterpart to cmpxchg_release in _lrng_drngs_numa_alloc */
++	return READ_ONCE(lrng_drng);
++}
++
++/* Allocate the data structures for the per-NUMA node DRNGs */
++static void _lrng_drngs_numa_alloc(struct work_struct *work)
++{
++	struct lrng_drng **drngs;
++	struct lrng_drng *lrng_drng_init = lrng_drng_init_instance();
++	u32 node;
++	bool init_drng_used = false;
++
++	mutex_lock(&lrng_crypto_cb_update);
++
++	/* per-NUMA-node DRNGs are already present */
++	if (lrng_drng)
++		goto unlock;
++
++	/* Make sure the initial DRNG is initialized and its drng_cb is set */
++	if (lrng_drng_initalize())
++		goto err;
++
++	drngs = kcalloc(nr_node_ids, sizeof(void *), GFP_KERNEL|__GFP_NOFAIL);
++	for_each_online_node(node) {
++		struct lrng_drng *drng;
++
++		if (!init_drng_used) {
++			drngs[node] = lrng_drng_init;
++			init_drng_used = true;
++			continue;
++		}
++
++		drng = kmalloc_node(sizeof(struct lrng_drng),
++				    GFP_KERNEL|__GFP_NOFAIL, node);
++		memset(drng, 0, sizeof(lrng_drng));
++
++		if (lrng_drng_alloc_common(drng, lrng_drng_init->drng_cb)) {
++			kfree(drng);
++			goto err;
++		}
++
++		drng->hash_cb = lrng_drng_init->hash_cb;
++		drng->hash = lrng_drng_init->hash_cb->hash_alloc();
++		if (IS_ERR(drng->hash)) {
++			lrng_drng_init->drng_cb->drng_dealloc(drng->drng);
++			kfree(drng);
++			goto err;
++		}
++
++		mutex_init(&drng->lock);
++		rwlock_init(&drng->hash_lock);
++
++		/*
++		 * No reseeding of NUMA DRNGs from previous DRNGs as this
++		 * would complicate the code. Let it simply reseed.
++		 */
++		drngs[node] = drng;
++
++		lrng_pool_inc_numa_node();
++		pr_info("DRNG and entropy pool read hash for NUMA node %d allocated\n",
++			node);
++	}
++
++	/* counterpart to READ_ONCE in lrng_drng_instances */
++	if (!cmpxchg_release(&lrng_drng, NULL, drngs)) {
++		lrng_pool_all_numa_nodes_seeded(false);
++		goto unlock;
++	}
++
++err:
++	for_each_online_node(node) {
++		struct lrng_drng *drng = drngs[node];
++
++		if (drng == lrng_drng_init)
++			continue;
++
++		if (drng) {
++			drng->hash_cb->hash_dealloc(drng->hash);
++			drng->drng_cb->drng_dealloc(drng->drng);
++			kfree(drng);
++		}
++	}
++	kfree(drngs);
++
++unlock:
++	mutex_unlock(&lrng_crypto_cb_update);
++}
++
++static DECLARE_WORK(lrng_drngs_numa_alloc_work, _lrng_drngs_numa_alloc);
++
++static void lrng_drngs_numa_alloc(void)
++{
++	schedule_work(&lrng_drngs_numa_alloc_work);
++}
++
++static int __init lrng_numa_init(void)
++{
++	lrng_drngs_numa_alloc();
++	return 0;
++}
++
++late_initcall(lrng_numa_init);
+--- a/drivers/char/lrng/lrng_numa.h
++++ b/drivers/char/lrng/lrng_numa.h
+@@ -6,6 +6,10 @@
+ #ifndef _LRNG_NUMA_H
+ #define _LRNG_NUMA_H
+ 
++#ifdef CONFIG_NUMA
++struct lrng_drng **lrng_drng_instances(void);
++#else	/* CONFIG_NUMA */
+ static inline struct lrng_drng **lrng_drng_instances(void) { return NULL; }
++#endif /* CONFIG_NUMA */
+ 
+ #endif /* _LRNG_NUMA_H */
+--- /dev/null
++++ b/drivers/char/lrng/lrng_proc.h
+@@ -0,0 +1,11 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause */
++/*
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#ifndef _LRNG_PROC_H
++#define _LRNG_PROC_H
++
++static inline void lrng_pool_inc_numa_node(void) { }
++
++#endif /* _LRNG_PROC_H */
+From b97aca849edc371e2586ab0a2f12908910cfa500 Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Sun, 18 Dec 2022 21:12:42 +0100
+Subject: [PATCH 03/25] LRNG - /proc interface
+
+The patch adds the file lrng_type which provides details about
+the LRNG:
+
+- the name of the DRNG that produces the random numbers for /dev/random,
+/dev/urandom, getrandom(2)
+
+- the hash used to produce random numbers from the entropy pool
+
+- the number of secondary DRNG instances
+
+- indicator whether the LRNG operates SP800-90B compliant
+
+- indicator whether a high-resolution timer is identified - only with a
+high-resolution timer the interrupt noise source will deliver sufficient
+entropy
+
+- indicator whether the LRNG has been minimally seeded (i.e. is the
+secondary DRNG seeded with at least 128 bits of entropy)
+
+- indicator whether the LRNG has been fully seeded (i.e. is the
+secondary DRNG seeded with at least 256 bits of entropy)
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+---
+ drivers/char/lrng/Makefile    |  1 +
+ drivers/char/lrng/lrng_proc.c | 74 +++++++++++++++++++++++++++++++++++
+ drivers/char/lrng/lrng_proc.h |  4 ++
+ 3 files changed, 79 insertions(+)
+ create mode 100644 drivers/char/lrng/lrng_proc.c
+
+--- a/drivers/char/lrng/Makefile
++++ b/drivers/char/lrng/Makefile
+@@ -8,6 +8,7 @@ obj-y					+= lrng_es_mgr.o lrng_drng_mgr
+ obj-$(CONFIG_LRNG_SHA256)		+= lrng_sha256.o
+ obj-$(CONFIG_LRNG_SHA1)			+= lrng_sha1.o
+ 
++obj-$(CONFIG_SYSCTL)			+= lrng_proc.o
+ obj-$(CONFIG_NUMA)			+= lrng_numa.o
+ 
+ obj-$(CONFIG_LRNG_DRNG_CHACHA20)	+= lrng_drng_chacha20.o
+--- /dev/null
++++ b/drivers/char/lrng/lrng_proc.c
+@@ -0,0 +1,74 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * LRNG proc interfaces
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#include <linux/lrng.h>
++#include <linux/module.h>
++#include <linux/proc_fs.h>
++#include <linux/seq_file.h>
++
++#include "lrng_drng_mgr.h"
++#include "lrng_es_aux.h"
++#include "lrng_es_mgr.h"
++#include "lrng_proc.h"
++
++/* Number of online DRNGs */
++static u32 numa_drngs = 1;
++
++void lrng_pool_inc_numa_node(void)
++{
++	numa_drngs++;
++}
++
++static int lrng_proc_type_show(struct seq_file *m, void *v)
++{
++	struct lrng_drng *lrng_drng_init = lrng_drng_init_instance();
++	unsigned char buf[270];
++	u32 i;
++
++	mutex_lock(&lrng_drng_init->lock);
++	snprintf(buf, sizeof(buf),
++		 "DRNG name: %s\n"
++		 "LRNG security strength in bits: %d\n"
++		 "Number of DRNG instances: %u\n"
++		 "Standards compliance: %sNTG.1 (2011%s)\n"
++		 "LRNG minimally seeded: %s\n"
++		 "LRNG fully seeded: %s\n"
++		 "LRNG entropy level: %u\n",
++		 lrng_drng_init->drng_cb->drng_name(),
++		 lrng_security_strength(),
++		 numa_drngs,
++		 lrng_sp80090c_compliant() ? "SP800-90C, " : "",
++		 lrng_ntg1_2022_compliant() ? " / 2022" : "",
++		 lrng_state_min_seeded() ? "true" : "false",
++		 lrng_state_fully_seeded() ? "true" : "false",
++		 lrng_avail_entropy());
++	seq_write(m, buf, strlen(buf));
++
++	for_each_lrng_es(i) {
++		snprintf(buf, sizeof(buf),
++			 "Entropy Source %u properties:\n"
++			 " Name: %s\n",
++			 i, lrng_es[i]->name);
++		seq_write(m, buf, strlen(buf));
++
++		buf[0] = '\0';
++		lrng_es[i]->state(buf, sizeof(buf));
++		seq_write(m, buf, strlen(buf));
++	}
++
++	mutex_unlock(&lrng_drng_init->lock);
++
++	return 0;
++}
++
++static int __init lrng_proc_type_init(void)
++{
++	proc_create_single("lrng_type", 0444, NULL, &lrng_proc_type_show);
++	return 0;
++}
++
++module_init(lrng_proc_type_init);
+--- a/drivers/char/lrng/lrng_proc.h
++++ b/drivers/char/lrng/lrng_proc.h
+@@ -6,6 +6,10 @@
+ #ifndef _LRNG_PROC_H
+ #define _LRNG_PROC_H
+ 
++#ifdef CONFIG_SYSCTL
++void lrng_pool_inc_numa_node(void);
++#else
+ static inline void lrng_pool_inc_numa_node(void) { }
++#endif
+ 
+ #endif /* _LRNG_PROC_H */
+From 074dffdaefb5398b95a733f38aa58c973f918e20 Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Mon, 20 Feb 2023 22:02:06 +0100
+Subject: [PATCH 04/25] LRNG - add switchable DRNG support
+
+The DRNG switch support allows replacing the DRNG mechanism of the
+LRNG. The switching support rests on the interface definition of
+include/linux/lrng.h. A new DRNG is implemented by filling in the
+interface defined in this header file.
+
+In addition to the DRNG, the extension also has to provide a hash
+implementation that is used to hash the entropy pool for random number
+extraction.
+
+Note: It is permissible to implement a DRNG whose operations may sleep.
+However, the hash function must not sleep.
+
+The switchable DRNG support allows replacing the DRNG at runtime.
+However, only one DRNG extension is allowed to be loaded at any given
+time. Before replacing it with another DRNG implementation, the possibly
+existing DRNG extension must be unloaded.
+
+The switchable DRNG extension activates the new DRNG during load time.
+It is expected, however, that such a DRNG switch would be done only once
+by an administrator to load the intended DRNG implementation.
+
+It is permissible to compile DRNG extensions either as kernel modules or
+statically. The initialization of the DRNG extension should be performed
+with a late_initcall to ensure the extension is available when user
+space starts but after all other initialization completed.
+The initialization is performed by registering the function call data
+structure with the lrng_set_drng_cb function. In order to unload the
+DRNG extension, lrng_set_drng_cb must be invoked with the NULL
+parameter.
+
+The DRNG extension should always provide a security strength that is at
+least as strong as LRNG_DRNG_SECURITY_STRENGTH_BITS.
+
+The hash extension must not sleep and must not maintain a separate
+state.
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+---
+ drivers/char/lrng/Kconfig       |   8 +-
+ drivers/char/lrng/Makefile      |   1 +
+ drivers/char/lrng/lrng_switch.c | 286 ++++++++++++++++++++++++++++++++
+ 3 files changed, 291 insertions(+), 4 deletions(-)
+ create mode 100644 drivers/char/lrng/lrng_switch.c
+
+--- a/drivers/char/lrng/Kconfig
++++ b/drivers/char/lrng/Kconfig
+@@ -629,10 +629,10 @@ config LRNG_DRNG_CHACHA20
+ # 	tristate
+ # 	depends on CRYPTO
+ # 	select CRYPTO_RNG
+-#
+-# config LRNG_SWITCH
+-# 	bool
+-#
++
++config LRNG_SWITCH
++	bool
++
+ # menuconfig LRNG_SWITCH_HASH
+ # 	bool "Support conditioning hash runtime switching"
+ # 	select LRNG_SWITCH
+--- a/drivers/char/lrng/Makefile
++++ b/drivers/char/lrng/Makefile
+@@ -11,4 +11,5 @@ obj-$(CONFIG_LRNG_SHA1)			+= lrng_sha1.o
+ obj-$(CONFIG_SYSCTL)			+= lrng_proc.o
+ obj-$(CONFIG_NUMA)			+= lrng_numa.o
+ 
++obj-$(CONFIG_LRNG_SWITCH)		+= lrng_switch.o
+ obj-$(CONFIG_LRNG_DRNG_CHACHA20)	+= lrng_drng_chacha20.o
+--- /dev/null
++++ b/drivers/char/lrng/lrng_switch.c
+@@ -0,0 +1,286 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * LRNG DRNG switching support
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/lrng.h>
++
++#include "lrng_es_aux.h"
++#include "lrng_es_mgr.h"
++#include "lrng_interface_dev_common.h"
++#include "lrng_numa.h"
++
++static int __maybe_unused
++lrng_hash_switch(struct lrng_drng *drng_store, const void *cb, int node)
++{
++	const struct lrng_hash_cb *new_cb = (const struct lrng_hash_cb *)cb;
++	const struct lrng_hash_cb *old_cb = drng_store->hash_cb;
++	unsigned long flags;
++	u32 i;
++	void *new_hash, *old_hash;
++	int ret;
++
++	if (node == -1)
++		return 0;
++
++	new_hash = new_cb->hash_alloc();
++	old_hash = drng_store->hash;
++
++	if (IS_ERR(new_hash)) {
++		pr_warn("could not allocate new LRNG pool hash (%ld)\n",
++			PTR_ERR(new_hash));
++		return PTR_ERR(new_hash);
++	}
++
++	if (new_cb->hash_digestsize(new_hash) > LRNG_MAX_DIGESTSIZE) {
++		pr_warn("digest size of newly requested hash too large\n");
++		new_cb->hash_dealloc(new_hash);
++		return -EINVAL;
++	}
++
++	write_lock_irqsave(&drng_store->hash_lock, flags);
++
++	/* Trigger the switch for each entropy source */
++	for_each_lrng_es(i) {
++		if (!lrng_es[i]->switch_hash)
++			continue;
++		ret = lrng_es[i]->switch_hash(drng_store, node, new_cb,
++					      new_hash, old_cb);
++		if (ret) {
++			u32 j;
++
++			/* Revert all already executed operations */
++			for (j = 0; j < i; j++) {
++				if (!lrng_es[j]->switch_hash)
++					continue;
++				WARN_ON(lrng_es[j]->switch_hash(drng_store,
++								node, old_cb,
++								old_hash,
++								new_cb));
++			}
++			goto err;
++		}
++	}
++
++	drng_store->hash = new_hash;
++	drng_store->hash_cb = new_cb;
++	old_cb->hash_dealloc(old_hash);
++	pr_info("Conditioning function allocated for DRNG for NUMA node %d\n",
++		node);
++
++err:
++	write_unlock_irqrestore(&drng_store->hash_lock, flags);
++	return ret;
++}
++
++static int __maybe_unused
++lrng_drng_switch(struct lrng_drng *drng_store, const void *cb, int node)
++{
++	const struct lrng_drng_cb *new_cb = (const struct lrng_drng_cb *)cb;
++	const struct lrng_drng_cb *old_cb = drng_store->drng_cb;
++	int ret;
++	u8 seed[LRNG_DRNG_SECURITY_STRENGTH_BYTES];
++	void *new_drng = new_cb->drng_alloc(LRNG_DRNG_SECURITY_STRENGTH_BYTES);
++	void *old_drng = drng_store->drng;
++	u32 current_security_strength;
++	bool reset_drng = !lrng_get_available();
++
++	if (IS_ERR(new_drng)) {
++		pr_warn("could not allocate new DRNG for NUMA node %d (%ld)\n",
++			node, PTR_ERR(new_drng));
++		return PTR_ERR(new_drng);
++	}
++
++	current_security_strength = lrng_security_strength();
++	mutex_lock(&drng_store->lock);
++
++	/*
++	 * Pull from existing DRNG to seed new DRNG regardless of seed status
++	 * of old DRNG -- the entropy state for the DRNG is left unchanged which
++	 * implies that als the new DRNG is reseeded when deemed necessary. This
++	 * seeding of the new DRNG shall only ensure that the new DRNG has the
++	 * same entropy as the old DRNG.
++	 */
++	ret = old_cb->drng_generate(old_drng, seed, sizeof(seed));
++	mutex_unlock(&drng_store->lock);
++
++	if (ret < 0) {
++		reset_drng = true;
++		pr_warn("getting random data from DRNG failed for NUMA node %d (%d)\n",
++			node, ret);
++	} else {
++		/* seed new DRNG with data */
++		ret = new_cb->drng_seed(new_drng, seed, ret);
++		memzero_explicit(seed, sizeof(seed));
++		if (ret < 0) {
++			reset_drng = true;
++			pr_warn("seeding of new DRNG failed for NUMA node %d (%d)\n",
++				node, ret);
++		} else {
++			pr_debug("seeded new DRNG of NUMA node %d instance from old DRNG instance\n",
++				 node);
++		}
++	}
++
++	mutex_lock(&drng_store->lock);
++
++	if (reset_drng)
++		lrng_drng_reset(drng_store);
++
++	drng_store->drng = new_drng;
++	drng_store->drng_cb = new_cb;
++
++	/* Reseed if previous LRNG security strength was insufficient */
++	if (current_security_strength < lrng_security_strength())
++		drng_store->force_reseed = true;
++
++	/* Force oversampling seeding as we initialize DRNG */
++	if (IS_ENABLED(CONFIG_CRYPTO_FIPS))
++		lrng_unset_fully_seeded(drng_store);
++
++	if (lrng_state_min_seeded())
++		lrng_set_entropy_thresh(lrng_get_seed_entropy_osr(
++						drng_store->fully_seeded));
++
++	old_cb->drng_dealloc(old_drng);
++
++	pr_info("DRNG of NUMA node %d switched\n", node);
++
++	mutex_unlock(&drng_store->lock);
++	return ret;
++}
++
++/*
++ * Switch the existing DRNG and hash instances with new using the new crypto
++ * callbacks. The caller must hold the lrng_crypto_cb_update lock.
++ */
++static int lrng_switch(const void *cb,
++		       int (*switcher)(struct lrng_drng *drng_store,
++				       const void *cb, int node))
++{
++	struct lrng_drng **lrng_drng = lrng_drng_instances();
++	struct lrng_drng *lrng_drng_init = lrng_drng_init_instance();
++	struct lrng_drng *lrng_drng_pr = lrng_drng_pr_instance();
++	int ret = 0;
++
++	if (lrng_drng) {
++		u32 node;
++
++		for_each_online_node(node) {
++			if (lrng_drng[node])
++				ret |= switcher(lrng_drng[node], cb, node);
++		}
++	} else {
++		ret |= switcher(lrng_drng_init, cb, 0);
++	}
++
++	ret |= switcher(lrng_drng_pr, cb, -1);
++
++	return ret;
++}
++
++/*
++ * lrng_set_drng_cb - Register new cryptographic callback functions for DRNG
++ * The registering implies that all old DRNG states are replaced with new
++ * DRNG states.
++ *
++ * drng_cb: Callback functions to be registered -- if NULL, use the default
++ *	    callbacks defined at compile time.
++ *
++ * Return:
++ * * 0 on success
++ * * < 0 on error
++ */
++int lrng_set_drng_cb(const struct lrng_drng_cb *drng_cb)
++{
++	struct lrng_drng *lrng_drng_init = lrng_drng_init_instance();
++	int ret;
++
++	if (!IS_ENABLED(CONFIG_LRNG_SWITCH_DRNG))
++		return -EOPNOTSUPP;
++
++	if (!drng_cb)
++		drng_cb = lrng_default_drng_cb;
++
++	mutex_lock(&lrng_crypto_cb_update);
++
++	/*
++	 * If a callback other than the default is set, allow it only to be
++	 * set back to the default callback. This ensures that multiple
++	 * different callbacks can be registered at the same time. If a
++	 * callback different from the current callback and the default
++	 * callback shall be set, the current callback must be deregistered
++	 * (e.g. the kernel module providing it must be unloaded) and the new
++	 * implementation can be registered.
++	 */
++	if ((drng_cb != lrng_default_drng_cb) &&
++	    (lrng_drng_init->drng_cb != lrng_default_drng_cb)) {
++		pr_warn("disallow setting new DRNG callbacks, unload the old callbacks first!\n");
++		ret = -EINVAL;
++		goto out;
++	}
++
++	ret = lrng_switch(drng_cb, lrng_drng_switch);
++	/* The switch may imply new entropy due to larger DRNG sec strength. */
++	if (!ret)
++		lrng_es_add_entropy();
++
++out:
++	mutex_unlock(&lrng_crypto_cb_update);
++	return ret;
++}
++EXPORT_SYMBOL(lrng_set_drng_cb);
++
++/*
++ * lrng_set_hash_cb - Register new cryptographic callback functions for hash
++ * The registering implies that all old hash states are replaced with new
++ * hash states.
++ *
++ * @hash_cb: Callback functions to be registered -- if NULL, use the default
++ *	     callbacks defined at compile time.
++ *
++ * Return:
++ * * 0 on success
++ * * < 0 on error
++ */
++int lrng_set_hash_cb(const struct lrng_hash_cb *hash_cb)
++{
++	struct lrng_drng *lrng_drng_init = lrng_drng_init_instance();
++	int ret;
++
++	if (!IS_ENABLED(CONFIG_LRNG_SWITCH_HASH))
++		return -EOPNOTSUPP;
++
++	if (!hash_cb)
++		hash_cb = lrng_default_hash_cb;
++
++	mutex_lock(&lrng_crypto_cb_update);
++
++	/* Comment from lrng_set_drng_cb applies. */
++	if ((hash_cb != lrng_default_hash_cb) &&
++	    (lrng_drng_init->hash_cb != lrng_default_hash_cb)) {
++		pr_warn("disallow setting new hash callbacks, unload the old callbacks first!\n");
++		ret = -EINVAL;
++		goto out;
++	}
++
++	ret = lrng_switch(hash_cb, lrng_hash_switch);
++	/*
++	 * The switch may imply new entropy due to larger digest size. But
++	 * it may also offer more room in the aux pool which means we ping
++	 * any waiting entropy providers.
++	 */
++	if (!ret) {
++		lrng_es_add_entropy();
++		lrng_writer_wakeup();
++	}
++
++out:
++	mutex_unlock(&lrng_crypto_cb_update);
++	return ret;
++}
++EXPORT_SYMBOL(lrng_set_hash_cb);
+From 6db232ea9ebcca23650d15e3606a8f4d48c09ca1 Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Sun, 15 May 2022 16:01:44 +0200
+Subject: [PATCH 05/25] LRNG - add common generic hash support
+
+The LRNG switchable DRNG support also allows the replacement of the hash
+implementation used as conditioning component. The common generic hash
+support code provides the required callbacks using the synchronous hash
+implementations of the kernel crypto API.
+
+All synchronous hash implementations supported by the kernel crypto API
+can be used as part of the LRNG with this generic support.
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+---
+ drivers/char/lrng/Kconfig           |  40 ++++----
+ drivers/char/lrng/Makefile          |   1 +
+ drivers/char/lrng/lrng_hash_kcapi.c | 140 ++++++++++++++++++++++++++++
+ 3 files changed, 161 insertions(+), 20 deletions(-)
+ create mode 100644 drivers/char/lrng/lrng_hash_kcapi.c
+
+--- a/drivers/char/lrng/Kconfig
++++ b/drivers/char/lrng/Kconfig
+@@ -633,26 +633,26 @@ config LRNG_DRNG_CHACHA20
+ config LRNG_SWITCH
+ 	bool
+ 
+-# menuconfig LRNG_SWITCH_HASH
+-# 	bool "Support conditioning hash runtime switching"
+-# 	select LRNG_SWITCH
+-# 	help
+-# 	  The LRNG uses a default message digest. With this
+-# 	  configuration option other message digests can be selected
+-# 	  and loaded at runtime.
+-#
+-# if LRNG_SWITCH_HASH
+-#
+-# config LRNG_HASH_KCAPI
+-# 	tristate "Kernel crypto API hashing support for LRNG"
+-# 	select CRYPTO_HASH
+-# 	select CRYPTO_SHA512
+-# 	help
+-# 	  Enable the kernel crypto API support for entropy compression
+-# 	  and conditioning functions.
+-#
+-# endif # LRNG_SWITCH_HASH
+-#
++menuconfig LRNG_SWITCH_HASH
++	bool "Support conditioning hash runtime switching"
++	select LRNG_SWITCH
++	help
++	  The LRNG uses a default message digest. With this
++	  configuration option other message digests can be selected
++	  and loaded at runtime.
++
++if LRNG_SWITCH_HASH
++
++config LRNG_HASH_KCAPI
++	tristate "Kernel crypto API hashing support for LRNG"
++	select CRYPTO_HASH
++	select CRYPTO_SHA512
++	help
++	  Enable the kernel crypto API support for entropy compression
++	  and conditioning functions.
++
++endif # LRNG_SWITCH_HASH
++
+ # menuconfig LRNG_SWITCH_DRNG
+ # 	bool "Support DRNG runtime switching"
+ # 	select LRNG_SWITCH
+--- a/drivers/char/lrng/Makefile
++++ b/drivers/char/lrng/Makefile
+@@ -12,4 +12,5 @@ obj-$(CONFIG_SYSCTL)			+= lrng_proc.o
+ obj-$(CONFIG_NUMA)			+= lrng_numa.o
+ 
+ obj-$(CONFIG_LRNG_SWITCH)		+= lrng_switch.o
++obj-$(CONFIG_LRNG_HASH_KCAPI)		+= lrng_hash_kcapi.o
+ obj-$(CONFIG_LRNG_DRNG_CHACHA20)	+= lrng_drng_chacha20.o
+--- /dev/null
++++ b/drivers/char/lrng/lrng_hash_kcapi.c
+@@ -0,0 +1,140 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * Backend for providing the hash primitive using the kernel crypto API.
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/lrng.h>
++#include <crypto/hash.h>
++#include <linux/module.h>
++
++
++static char *lrng_hash_name = "sha512";
++
++/* The parameter must be r/o in sysfs as otherwise races appear. */
++module_param(lrng_hash_name, charp, 0444);
++MODULE_PARM_DESC(lrng_hash_name, "Kernel crypto API hash name");
++
++struct lrng_hash_info {
++	struct crypto_shash *tfm;
++};
++
++static const char *lrng_kcapi_hash_name(void)
++{
++	return lrng_hash_name;
++}
++
++static void _lrng_kcapi_hash_free(struct lrng_hash_info *lrng_hash)
++{
++	struct crypto_shash *tfm = lrng_hash->tfm;
++
++	crypto_free_shash(tfm);
++	kfree(lrng_hash);
++}
++
++static void *lrng_kcapi_hash_alloc(const char *name)
++{
++	struct lrng_hash_info *lrng_hash;
++	struct crypto_shash *tfm;
++	int ret;
++
++	if (!name) {
++		pr_err("Hash name missing\n");
++		return ERR_PTR(-EINVAL);
++	}
++
++	tfm = crypto_alloc_shash(name, 0, 0);
++	if (IS_ERR(tfm)) {
++		pr_err("could not allocate hash %s\n", name);
++		return ERR_CAST(tfm);
++	}
++
++	ret = sizeof(struct lrng_hash_info);
++	lrng_hash = kmalloc(ret, GFP_KERNEL);
++	if (!lrng_hash) {
++		crypto_free_shash(tfm);
++		return ERR_PTR(-ENOMEM);
++	}
++
++	lrng_hash->tfm = tfm;
++
++	pr_info("Hash %s allocated\n", name);
++
++	return lrng_hash;
++}
++
++static void *lrng_kcapi_hash_name_alloc(void)
++{
++	return lrng_kcapi_hash_alloc(lrng_kcapi_hash_name());
++}
++
++static u32 lrng_kcapi_hash_digestsize(void *hash)
++{
++	struct lrng_hash_info *lrng_hash = (struct lrng_hash_info *)hash;
++	struct crypto_shash *tfm = lrng_hash->tfm;
++
++	return crypto_shash_digestsize(tfm);
++}
++
++static void lrng_kcapi_hash_dealloc(void *hash)
++{
++	struct lrng_hash_info *lrng_hash = (struct lrng_hash_info *)hash;
++
++	_lrng_kcapi_hash_free(lrng_hash);
++	pr_info("Hash deallocated\n");
++}
++
++static int lrng_kcapi_hash_init(struct shash_desc *shash, void *hash)
++{
++	struct lrng_hash_info *lrng_hash = (struct lrng_hash_info *)hash;
++	struct crypto_shash *tfm = lrng_hash->tfm;
++
++	shash->tfm = tfm;
++	return crypto_shash_init(shash);
++}
++
++static int lrng_kcapi_hash_update(struct shash_desc *shash, const u8 *inbuf,
++			   u32 inbuflen)
++{
++	return crypto_shash_update(shash, inbuf, inbuflen);
++}
++
++static int lrng_kcapi_hash_final(struct shash_desc *shash, u8 *digest)
++{
++	return crypto_shash_final(shash, digest);
++}
++
++static void lrng_kcapi_hash_zero(struct shash_desc *shash)
++{
++	shash_desc_zero(shash);
++}
++
++static const struct lrng_hash_cb lrng_kcapi_hash_cb = {
++	.hash_name		= lrng_kcapi_hash_name,
++	.hash_alloc		= lrng_kcapi_hash_name_alloc,
++	.hash_dealloc		= lrng_kcapi_hash_dealloc,
++	.hash_digestsize	= lrng_kcapi_hash_digestsize,
++	.hash_init		= lrng_kcapi_hash_init,
++	.hash_update		= lrng_kcapi_hash_update,
++	.hash_final		= lrng_kcapi_hash_final,
++	.hash_desc_zero		= lrng_kcapi_hash_zero,
++};
++
++static int __init lrng_kcapi_init(void)
++{
++	return lrng_set_hash_cb(&lrng_kcapi_hash_cb);
++}
++
++static void __exit lrng_kcapi_exit(void)
++{
++	lrng_set_hash_cb(NULL);
++}
++
++late_initcall(lrng_kcapi_init);
++module_exit(lrng_kcapi_exit);
++MODULE_LICENSE("Dual BSD/GPL");
++MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>");
++MODULE_DESCRIPTION("Entropy Source and DRNG Manager - Kernel crypto API hash backend");
+From b59bd03bfd2776058531dc6f9573a0e0a46a23d2 Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Thu, 21 Mar 2024 14:17:33 +0100
+Subject: [PATCH 06/25] crypto: DRBG - externalize DRBG functions for LRNG
+
+This patch allows several DRBG functions to be called by the LRNG kernel
+code paths outside the drbg.c file.
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+---
+ crypto/drbg.c         | 16 ++++++++++------
+ include/crypto/drbg.h |  7 +++++++
+ 2 files changed, 17 insertions(+), 6 deletions(-)
+
+--- a/crypto/drbg.c
++++ b/crypto/drbg.c
+@@ -115,7 +115,7 @@
+  * HMAC-SHA512 / SHA256 / AES 256 over other ciphers. Thus, the
+  * favored DRBGs are the latest entries in this array.
+  */
+-static const struct drbg_core drbg_cores[] = {
++const struct drbg_core drbg_cores[] = {
+ #ifdef CONFIG_CRYPTO_DRBG_CTR
+ 	{
+ 		.flags = DRBG_CTR | DRBG_STRENGTH128,
+@@ -180,6 +180,7 @@ static const struct drbg_core drbg_cores
+ 	},
+ #endif /* CONFIG_CRYPTO_DRBG_HMAC */
+ };
++EXPORT_SYMBOL(drbg_cores);
+ 
+ static int drbg_uninstantiate(struct drbg_state *drbg);
+ 
+@@ -195,7 +196,7 @@ static int drbg_uninstantiate(struct drb
+  * Return: normalized strength in *bytes* value or 32 as default
+  *	   to counter programming errors
+  */
+-static inline unsigned short drbg_sec_strength(drbg_flag_t flags)
++unsigned short drbg_sec_strength(drbg_flag_t flags)
+ {
+ 	switch (flags & DRBG_STRENGTH_MASK) {
+ 	case DRBG_STRENGTH128:
+@@ -208,6 +209,7 @@ static inline unsigned short drbg_sec_st
+ 		return 32;
+ 	}
+ }
++EXPORT_SYMBOL(drbg_sec_strength);
+ 
+ /*
+  * FIPS 140-2 continuous self test for the noise source
+@@ -1236,7 +1238,7 @@ out:
+ }
+ 
+ /* Free all substructures in a DRBG state without the DRBG state structure */
+-static inline void drbg_dealloc_state(struct drbg_state *drbg)
++void drbg_dealloc_state(struct drbg_state *drbg)
+ {
+ 	if (!drbg)
+ 		return;
+@@ -1257,12 +1259,13 @@ static inline void drbg_dealloc_state(st
+ 		drbg->fips_primed = false;
+ 	}
+ }
++EXPORT_SYMBOL(drbg_dealloc_state);
+ 
+ /*
+  * Allocate all sub-structures for a DRBG state.
+  * The DRBG state structure must already be allocated.
+  */
+-static inline int drbg_alloc_state(struct drbg_state *drbg)
++int drbg_alloc_state(struct drbg_state *drbg)
+ {
+ 	int ret = -ENOMEM;
+ 	unsigned int sb_size = 0;
+@@ -1343,6 +1346,7 @@ err:
+ 	drbg_dealloc_state(drbg);
+ 	return ret;
+ }
++EXPORT_SYMBOL(drbg_alloc_state);
+ 
+ /*************************************************************************
+  * DRBG interface functions
+@@ -1877,8 +1881,7 @@ out:
+  *
+  * return: flags
+  */
+-static inline void drbg_convert_tfm_core(const char *cra_driver_name,
+-					 int *coreref, bool *pr)
++void drbg_convert_tfm_core(const char *cra_driver_name, int *coreref, bool *pr)
+ {
+ 	int i = 0;
+ 	size_t start = 0;
+@@ -1905,6 +1908,7 @@ static inline void drbg_convert_tfm_core
+ 		}
+ 	}
+ }
++EXPORT_SYMBOL(drbg_convert_tfm_core);
+ 
+ static int drbg_kcapi_init(struct crypto_tfm *tfm)
+ {
+--- a/include/crypto/drbg.h
++++ b/include/crypto/drbg.h
+@@ -283,4 +283,11 @@ enum drbg_prefixes {
+ 	DRBG_PREFIX3
+ };
+ 
++extern int drbg_alloc_state(struct drbg_state *drbg);
++extern void drbg_dealloc_state(struct drbg_state *drbg);
++extern void drbg_convert_tfm_core(const char *cra_driver_name, int *coreref,
++				  bool *pr);
++extern const struct drbg_core drbg_cores[];
++extern unsigned short drbg_sec_strength(drbg_flag_t flags);
++
+ #endif /* _DRBG_H */
+From ed6c12a2aeac7927392151adcbf947c3c0865988 Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Sun, 28 Jul 2024 21:39:01 +0200
+Subject: [PATCH 07/25] LRNG - add SP800-90A DRBG extension
+
+Using the LRNG switchable DRNG support, the SP800-90A DRBG extension is
+implemented.
+
+The DRBG uses the kernel crypto API DRBG implementation. In addition, it
+uses the kernel crypto API SHASH support to provide the hashing
+operation.
+
+The DRBG supports the choice of either a CTR DRBG using AES-256, HMAC
+DRBG with SHA-512 core or Hash DRBG with SHA-512 core. The used core can
+be selected with the module parameter lrng_drbg_type. The default is the
+CTR DRBG.
+
+When compiling the DRBG extension statically, the DRBG is loaded at
+late_initcall stage which implies that with the start of user space, the
+user space interfaces of getrandom(2), /dev/random and /dev/urandom
+provide random data produced by an SP800-90A DRBG.
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+---
+ drivers/char/lrng/Kconfig          |  78 +++++------
+ drivers/char/lrng/Makefile         |   1 +
+ drivers/char/lrng/lrng_drng_drbg.c | 215 +++++++++++++++++++++++++++++
+ 3 files changed, 255 insertions(+), 39 deletions(-)
+ create mode 100644 drivers/char/lrng/lrng_drng_drbg.c
+
+--- a/drivers/char/lrng/Kconfig
++++ b/drivers/char/lrng/Kconfig
+@@ -620,11 +620,11 @@ endmenu # "Specific DRNG seeding strateg
+ config LRNG_DRNG_CHACHA20
+ 	tristate
+ 
+-# config LRNG_DRBG
+-# 	tristate
+-# 	depends on CRYPTO
+-# 	select CRYPTO_DRBG_MENU
+-#
++config LRNG_DRBG
++	tristate
++	depends on CRYPTO
++	select CRYPTO_DRBG_MENU
++
+ # config LRNG_DRNG_KCAPI
+ # 	tristate
+ # 	depends on CRYPTO
+@@ -653,33 +653,33 @@ config LRNG_HASH_KCAPI
+ 
+ endif # LRNG_SWITCH_HASH
+ 
+-# menuconfig LRNG_SWITCH_DRNG
+-# 	bool "Support DRNG runtime switching"
+-# 	select LRNG_SWITCH
+-# 	help
+-# 	  The LRNG uses a default DRNG With this configuration
+-# 	  option other DRNGs or message digests can be selected and
+-# 	  loaded at runtime.
+-#
+-# if LRNG_SWITCH_DRNG
+-#
+-# config LRNG_SWITCH_DRNG_CHACHA20
+-# 	tristate "ChaCha20-based DRNG support for LRNG"
+-# 	depends on !LRNG_DFLT_DRNG_CHACHA20
+-# 	select LRNG_DRNG_CHACHA20
+-# 	help
+-# 	  Enable the ChaCha20-based DRNG. This DRNG implementation
+-# 	  does not depend on the kernel crypto API presence.
+-#
+-# config LRNG_SWITCH_DRBG
+-# 	tristate "SP800-90A support for the LRNG"
+-# 	depends on !LRNG_DFLT_DRNG_DRBG
+-# 	select LRNG_DRBG
+-# 	help
+-# 	  Enable the SP800-90A DRBG support for the LRNG. Once the
+-# 	  module is loaded, output from /dev/random, /dev/urandom,
+-# 	  getrandom(2), or get_random_bytes_full is provided by a DRBG.
+-#
++menuconfig LRNG_SWITCH_DRNG
++	bool "Support DRNG runtime switching"
++	select LRNG_SWITCH
++	help
++	  The LRNG uses a default DRNG With this configuration
++	  option other DRNGs or message digests can be selected and
++	  loaded at runtime.
++
++if LRNG_SWITCH_DRNG
++
++config LRNG_SWITCH_DRNG_CHACHA20
++	tristate "ChaCha20-based DRNG support for LRNG"
++	depends on !LRNG_DFLT_DRNG_CHACHA20
++	select LRNG_DRNG_CHACHA20
++	help
++	  Enable the ChaCha20-based DRNG. This DRNG implementation
++	  does not depend on the kernel crypto API presence.
++
++config LRNG_SWITCH_DRBG
++	tristate "SP800-90A support for the LRNG"
++	depends on !LRNG_DFLT_DRNG_DRBG
++	select LRNG_DRBG
++	help
++	  Enable the SP800-90A DRBG support for the LRNG. Once the
++	  module is loaded, output from /dev/random, /dev/urandom,
++	  getrandom(2), or get_random_bytes_full is provided by a DRBG.
++
+ # config LRNG_SWITCH_DRNG_KCAPI
+ # 	tristate "Kernel Crypto API support for the LRNG"
+ # 	depends on !LRNG_DFLT_DRNG_KCAPI
+@@ -691,8 +691,8 @@ endif # LRNG_SWITCH_HASH
+ # 	  LRNG. Once the module is loaded, output from /dev/random,
+ # 	  /dev/urandom, getrandom(2), or get_random_bytes is
+ # 	  provided by the selected kernel crypto API RNG.
+-#
+-# endif # LRNG_SWITCH_DRNG
++
++endif # LRNG_SWITCH_DRNG
+ 
+ choice
+ 	prompt "LRNG Default DRNG"
+@@ -707,11 +707,11 @@ choice
+ 		bool "ChaCha20-based DRNG"
+ 		select LRNG_DRNG_CHACHA20
+ 
+-# 	config LRNG_DFLT_DRNG_DRBG
+-# 		depends on RANDOM_DEFAULT_IMPL
+-# 		bool "SP800-90A DRBG"
+-# 		select LRNG_DRBG
+-#
++	config LRNG_DFLT_DRNG_DRBG
++		depends on RANDOM_DEFAULT_IMPL
++		bool "SP800-90A DRBG"
++		select LRNG_DRBG
++
+ # 	config LRNG_DFLT_DRNG_KCAPI
+ # 		depends on RANDOM_DEFAULT_IMPL
+ # 		bool "Kernel Crypto API DRNG"
+--- a/drivers/char/lrng/Makefile
++++ b/drivers/char/lrng/Makefile
+@@ -14,3 +14,4 @@ obj-$(CONFIG_NUMA)			+= lrng_numa.o
+ obj-$(CONFIG_LRNG_SWITCH)		+= lrng_switch.o
+ obj-$(CONFIG_LRNG_HASH_KCAPI)		+= lrng_hash_kcapi.o
+ obj-$(CONFIG_LRNG_DRNG_CHACHA20)	+= lrng_drng_chacha20.o
++obj-$(CONFIG_LRNG_DRBG)			+= lrng_drng_drbg.o
+--- /dev/null
++++ b/drivers/char/lrng/lrng_drng_drbg.c
+@@ -0,0 +1,215 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * Backend for the LRNG providing the cryptographic primitives using the
++ * kernel crypto API and its DRBG.
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <crypto/drbg.h>
++#include <linux/init.h>
++#include <linux/lrng.h>
++#include <linux/module.h>
++
++#include "lrng_drng_drbg.h"
++
++/*
++ * Define a DRBG plus a hash / MAC used to extract data from the entropy pool.
++ * For LRNG_HASH_NAME you can use a hash or a MAC (HMAC or CMAC) of your choice
++ * (Note, you should use the suggested selections below -- using SHA-1 or MD5
++ * is not wise). The idea is that the used cipher primitive can be selected to
++ * be the same as used for the DRBG. I.e. the LRNG only uses one cipher
++ * primitive using the same cipher implementation with the options offered in
++ * the following. This means, if the CTR DRBG is selected and AES-NI is present,
++ * both the CTR DRBG and the selected cmac(aes) use AES-NI.
++ *
++ * The security strengths of the DRBGs are all 256 bits according to
++ * SP800-57 section 5.6.1.
++ *
++ * This definition is allowed to be changed.
++ */
++#ifdef CONFIG_CRYPTO_DRBG_CTR
++static unsigned int lrng_drbg_type = 0;
++#elif defined CONFIG_CRYPTO_DRBG_HMAC
++static unsigned int lrng_drbg_type = 1;
++#elif defined CONFIG_CRYPTO_DRBG_HASH
++static unsigned int lrng_drbg_type = 2;
++#else
++#error "Unknown DRBG in use"
++#endif
++
++/* The parameter must be r/o in sysfs as otherwise races appear. */
++module_param(lrng_drbg_type, uint, 0444);
++MODULE_PARM_DESC(lrng_drbg_type, "DRBG type used for LRNG (0->CTR_DRBG, 1->HMAC_DRBG, 2->Hash_DRBG)");
++
++struct lrng_drbg {
++	const char* hash_name;
++	const char* drbg_core;
++};
++
++static const struct lrng_drbg lrng_drbg_types[] = {
++	{
++		/* CTR_DRBG with AES-256 using derivation function */
++		.drbg_core = "drbg_nopr_ctr_aes256",
++	}, {
++		/* HMAC_DRBG with SHA-512 */
++		.drbg_core = "drbg_nopr_hmac_sha512",
++	}, {
++		/* Hash_DRBG with SHA-512 using derivation function */
++		.drbg_core = "drbg_nopr_sha512"
++	}
++};
++
++static int lrng_drbg_drng_seed_helper(void* drng, const u8* inbuf, u32 inbuflen)
++{
++	struct drbg_state* drbg = (struct drbg_state*)drng;
++	LIST_HEAD(seedlist);
++	struct drbg_string data;
++	int ret;
++
++	drbg_string_fill(&data, inbuf, inbuflen);
++	list_add_tail(&data.list, &seedlist);
++	ret = drbg->d_ops->update(drbg, &seedlist, drbg->seeded);
++
++	if (ret >= 0)
++		drbg->seeded = DRBG_SEED_STATE_FULL;
++
++	return ret;
++}
++
++static int lrng_drbg_drng_generate_helper(void* drng, u8* outbuf, u32 outbuflen)
++{
++	struct drbg_state* drbg = (struct drbg_state*)drng;
++
++	return drbg->d_ops->generate(drbg, outbuf, outbuflen, NULL);
++}
++
++static void* lrng_drbg_drng_alloc(u32 sec_strength)
++{
++	struct drbg_state* drbg;
++	int coreref = -1;
++	bool pr = false;
++	int ret;
++
++	drbg_convert_tfm_core(lrng_drbg_types[lrng_drbg_type].drbg_core,
++			      &coreref, &pr);
++	if (coreref < 0)
++		return ERR_PTR(-EFAULT);
++
++	drbg = kzalloc(sizeof(struct drbg_state), GFP_KERNEL);
++	if (!drbg)
++		return ERR_PTR(-ENOMEM);
++
++	drbg->core = &drbg_cores[coreref];
++	drbg->seeded = DRBG_SEED_STATE_UNSEEDED;
++	ret = drbg_alloc_state(drbg);
++	if (ret)
++		goto err;
++
++	if (sec_strength > drbg_sec_strength(drbg->core->flags)) {
++		pr_err("Security strength of DRBG (%u bits) lower than requested by LRNG (%u bits)\n",
++		       drbg_sec_strength(drbg->core->flags) * 8,
++		       sec_strength * 8);
++		goto dealloc;
++	}
++
++	if (sec_strength < drbg_sec_strength(drbg->core->flags))
++		pr_warn("Security strength of DRBG (%u bits) higher than requested by LRNG (%u bits)\n",
++			drbg_sec_strength(drbg->core->flags) * 8,
++			sec_strength * 8);
++
++	pr_info("DRBG with %s core allocated\n", drbg->core->backend_cra_name);
++
++	return drbg;
++
++	dealloc:
++	if (drbg->d_ops)
++		drbg->d_ops->crypto_fini(drbg);
++	drbg_dealloc_state(drbg);
++	err:
++	kfree(drbg);
++	return ERR_PTR(-EINVAL);
++}
++
++static void lrng_drbg_drng_dealloc(void* drng)
++{
++	struct drbg_state* drbg = (struct drbg_state*)drng;
++
++	if (drbg && drbg->d_ops)
++		drbg->d_ops->crypto_fini(drbg);
++	drbg_dealloc_state(drbg);
++	kfree_sensitive(drbg);
++	pr_info("DRBG deallocated\n");
++}
++
++static const char* lrng_drbg_name(void)
++{
++	return lrng_drbg_types[lrng_drbg_type].drbg_core;
++}
++
++const struct lrng_drng_cb lrng_drbg_cb = {
++	.drng_name = lrng_drbg_name,
++	.drng_alloc = lrng_drbg_drng_alloc,
++	.drng_dealloc = lrng_drbg_drng_dealloc,
++	.drng_seed = lrng_drbg_drng_seed_helper,
++	.drng_generate = lrng_drbg_drng_generate_helper,
++};
++
++static int __init lrng_drbg_selftest(void)
++{
++	struct crypto_rng *drbg;
++
++	/* Allocate the DRBG once to trigger the kernel crypto API self test */
++	drbg = crypto_alloc_rng(lrng_drbg_types[lrng_drbg_type].drbg_core, 0,
++				0);
++	if (IS_ERR(drbg)) {
++		pr_err("could not allocate DRBG and trigger self-test: %ld\n",
++		       PTR_ERR(drbg));
++		return PTR_ERR(drbg);
++	}
++	crypto_free_rng(drbg);
++
++	return 0;
++}
++
++#ifndef CONFIG_LRNG_DFLT_DRNG_DRBG
++static int __init lrng_drbg_init(void)
++{
++	int ret = lrng_drbg_selftest();
++
++	if (ret)
++		return ret;
++
++	if (lrng_drbg_type >= ARRAY_SIZE(lrng_drbg_types)) {
++		pr_err("lrng_drbg_type parameter too large (given %u - max: %lu)",
++		       lrng_drbg_type,
++	 (unsigned long)ARRAY_SIZE(lrng_drbg_types) - 1);
++		return -EAGAIN;
++	}
++	return lrng_set_drng_cb(&lrng_drbg_cb);
++}
++
++static void __exit lrng_drbg_exit(void)
++{
++	lrng_set_drng_cb(NULL);
++}
++
++late_initcall(lrng_drbg_init);
++module_exit(lrng_drbg_exit);
++MODULE_LICENSE("Dual BSD/GPL");
++MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>");
++MODULE_DESCRIPTION("Entropy Source and DRNG Manager - SP800-90A DRBG backend");
++#else
++
++/*
++ * Note, this call may result in the use of the DRBG before the self-test is
++ * run. However, that usage is not relevant to any FIPS-140 consideration as
++ * the data is used for non-cryptographic purposes. The call below guarantees
++ * that the self-tests are run before user space is started and thus callers
++ * with needs to comply with FIPS-140 appear.
++ */
++late_initcall(lrng_drbg_selftest);
++
++#endif /* CONFIG_LRNG_DFLT_DRNG_DRBG */
+From abd4e08622156956150d80bf4e8cd4b4c31113ef Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Mon, 20 Feb 2023 22:23:59 +0100
+Subject: [PATCH 08/25] LRNG - add kernel crypto API PRNG extension
+
+Add runtime-pluggable support for all PRNGs that are accessible via
+the kernel crypto API, including hardware PRNGs. The PRNG is selected
+with the module parameter drng_name where the name must be one that the
+kernel crypto API can resolve into an RNG.
+
+This allows using of the kernel crypto API PRNG implementations that
+provide an interface to hardware PRNGs. Using this extension,
+the LRNG uses the hardware PRNGs to generate random numbers. An
+example is the S390 CPACF support providing such a PRNG.
+
+The hash is provided by a kernel crypto API SHASH whose digest size
+complies with the seedsize of the PRNG.
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+---
+ drivers/char/lrng/Kconfig           |  38 ++---
+ drivers/char/lrng/Makefile          |   1 +
+ drivers/char/lrng/lrng_drng_kcapi.c | 208 ++++++++++++++++++++++++++++
+ 3 files changed, 228 insertions(+), 19 deletions(-)
+ create mode 100644 drivers/char/lrng/lrng_drng_kcapi.c
+
+--- a/drivers/char/lrng/Kconfig
++++ b/drivers/char/lrng/Kconfig
+@@ -625,10 +625,10 @@ config LRNG_DRBG
+ 	depends on CRYPTO
+ 	select CRYPTO_DRBG_MENU
+ 
+-# config LRNG_DRNG_KCAPI
+-# 	tristate
+-# 	depends on CRYPTO
+-# 	select CRYPTO_RNG
++config LRNG_DRNG_KCAPI
++	tristate
++	depends on CRYPTO
++	select CRYPTO_RNG
+ 
+ config LRNG_SWITCH
+ 	bool
+@@ -680,17 +680,17 @@ config LRNG_SWITCH_DRBG
+ 	  module is loaded, output from /dev/random, /dev/urandom,
+ 	  getrandom(2), or get_random_bytes_full is provided by a DRBG.
+ 
+-# config LRNG_SWITCH_DRNG_KCAPI
+-# 	tristate "Kernel Crypto API support for the LRNG"
+-# 	depends on !LRNG_DFLT_DRNG_KCAPI
+-#	depends on !LRNG_SWITCH_DRBG
+-# 	select LRNG_DRNG_KCAPI
+-# 	help
+-# 	  Enable the support for generic pseudo-random number
+-# 	  generators offered by the kernel crypto API with the
+-# 	  LRNG. Once the module is loaded, output from /dev/random,
+-# 	  /dev/urandom, getrandom(2), or get_random_bytes is
+-# 	  provided by the selected kernel crypto API RNG.
++config LRNG_SWITCH_DRNG_KCAPI
++	tristate "Kernel Crypto API support for the LRNG"
++	depends on !LRNG_DFLT_DRNG_KCAPI
++	depends on !LRNG_SWITCH_DRBG
++	select LRNG_DRNG_KCAPI
++	help
++	  Enable the support for generic pseudo-random number
++	  generators offered by the kernel crypto API with the
++	  LRNG. Once the module is loaded, output from /dev/random,
++	  /dev/urandom, getrandom(2), or get_random_bytes is
++	  provided by the selected kernel crypto API RNG.
+ 
+ endif # LRNG_SWITCH_DRNG
+ 
+@@ -712,10 +712,10 @@ choice
+ 		bool "SP800-90A DRBG"
+ 		select LRNG_DRBG
+ 
+-# 	config LRNG_DFLT_DRNG_KCAPI
+-# 		depends on RANDOM_DEFAULT_IMPL
+-# 		bool "Kernel Crypto API DRNG"
+-# 		select LRNG_DRNG_KCAPI
++	config LRNG_DFLT_DRNG_KCAPI
++		depends on RANDOM_DEFAULT_IMPL
++		bool "Kernel Crypto API DRNG"
++		select LRNG_DRNG_KCAPI
+ endchoice
+ 
+ # menuconfig LRNG_TESTING_MENU
+--- a/drivers/char/lrng/Makefile
++++ b/drivers/char/lrng/Makefile
+@@ -15,3 +15,4 @@ obj-$(CONFIG_LRNG_SWITCH)		+= lrng_switc
+ obj-$(CONFIG_LRNG_HASH_KCAPI)		+= lrng_hash_kcapi.o
+ obj-$(CONFIG_LRNG_DRNG_CHACHA20)	+= lrng_drng_chacha20.o
+ obj-$(CONFIG_LRNG_DRBG)			+= lrng_drng_drbg.o
++obj-$(CONFIG_LRNG_DRNG_KCAPI)		+= lrng_drng_kcapi.o
+--- /dev/null
++++ b/drivers/char/lrng/lrng_drng_kcapi.c
+@@ -0,0 +1,208 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * Backend for the LRNG providing the cryptographic primitives using the
++ * kernel crypto API.
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/lrng.h>
++#include <crypto/hash.h>
++#include <crypto/rng.h>
++#include <linux/init.h>
++#include <linux/module.h>
++
++#include "lrng_drng_kcapi.h"
++
++static char *drng_name = NULL;
++module_param(drng_name, charp, 0444);
++MODULE_PARM_DESC(drng_name, "Kernel crypto API name of DRNG");
++
++static char *seed_hash = NULL;
++module_param(seed_hash, charp, 0444);
++MODULE_PARM_DESC(seed_hash,
++		 "Kernel crypto API name of hash with output size equal to seedsize of DRNG to bring seed string to the size required by the DRNG");
++
++struct lrng_drng_info {
++	struct crypto_rng *kcapi_rng;
++	struct crypto_shash *hash_tfm;
++};
++
++static int lrng_kcapi_drng_seed_helper(void *drng, const u8 *inbuf,
++				       u32 inbuflen)
++{
++	struct lrng_drng_info *lrng_drng_info = (struct lrng_drng_info *)drng;
++	struct crypto_rng *kcapi_rng = lrng_drng_info->kcapi_rng;
++	struct crypto_shash *hash_tfm = lrng_drng_info->hash_tfm;
++	SHASH_DESC_ON_STACK(shash, hash_tfm);
++	u32 digestsize;
++	u8 digest[HASH_MAX_DIGESTSIZE] __aligned(8);
++	int ret;
++
++	if (!hash_tfm)
++		return crypto_rng_reset(kcapi_rng, inbuf, inbuflen);
++
++	shash->tfm = hash_tfm;
++	digestsize = crypto_shash_digestsize(hash_tfm);
++
++	ret = crypto_shash_digest(shash, inbuf, inbuflen, digest);
++	shash_desc_zero(shash);
++	if (ret)
++		return ret;
++
++	ret = crypto_rng_reset(kcapi_rng, digest, digestsize);
++	if (ret)
++		return ret;
++
++	memzero_explicit(digest, digestsize);
++	return 0;
++}
++
++static int lrng_kcapi_drng_generate_helper(void *drng, u8 *outbuf,
++					   u32 outbuflen)
++{
++	struct lrng_drng_info *lrng_drng_info = (struct lrng_drng_info *)drng;
++	struct crypto_rng *kcapi_rng = lrng_drng_info->kcapi_rng;
++	int ret = crypto_rng_get_bytes(kcapi_rng, outbuf, outbuflen);
++
++	if (ret < 0)
++		return ret;
++
++	return outbuflen;
++}
++
++static void *lrng_kcapi_drng_alloc(u32 sec_strength)
++{
++	struct lrng_drng_info *lrng_drng_info;
++	struct crypto_rng *kcapi_rng;
++	u32 time = random_get_entropy();
++	int seedsize, rv;
++	void *ret =  ERR_PTR(-ENOMEM);
++
++	if (!drng_name) {
++		pr_err("DRNG name missing\n");
++		return ERR_PTR(-EINVAL);
++	}
++
++	if (!memcmp(drng_name, "stdrng", 6) ||
++	    !memcmp(drng_name, "lrng", 4) ||
++	    !memcmp(drng_name, "drbg", 4) ||
++	    !memcmp(drng_name, "jitterentropy_rng", 17)) {
++		pr_err("Refusing to load the requested random number generator\n");
++		return ERR_PTR(-EINVAL);
++	}
++
++	lrng_drng_info = kzalloc(sizeof(*lrng_drng_info), GFP_KERNEL);
++	if (!lrng_drng_info)
++		return ERR_PTR(-ENOMEM);
++
++	kcapi_rng = crypto_alloc_rng(drng_name, 0, 0);
++	if (IS_ERR(kcapi_rng)) {
++		pr_err("DRNG %s cannot be allocated\n", drng_name);
++		ret = ERR_CAST(kcapi_rng);
++		goto free;
++	}
++
++	lrng_drng_info->kcapi_rng = kcapi_rng;
++
++	seedsize = crypto_rng_seedsize(kcapi_rng);
++	if (seedsize) {
++		struct crypto_shash *hash_tfm;
++
++		if (!seed_hash) {
++			switch (seedsize) {
++			case 32:
++				seed_hash = "sha256";
++				break;
++			case 48:
++				seed_hash = "sha384";
++				break;
++			case 64:
++				seed_hash = "sha512";
++				break;
++			default:
++				pr_err("Seed size %d cannot be processed\n",
++				       seedsize);
++				goto dealloc;
++			}
++		}
++
++		hash_tfm = crypto_alloc_shash(seed_hash, 0, 0);
++		if (IS_ERR(hash_tfm)) {
++			ret = ERR_CAST(hash_tfm);
++			goto dealloc;
++		}
++
++		if (seedsize != crypto_shash_digestsize(hash_tfm)) {
++			pr_err("Seed hash output size not equal to DRNG seed size\n");
++			crypto_free_shash(hash_tfm);
++			ret = ERR_PTR(-EINVAL);
++			goto dealloc;
++		}
++
++		lrng_drng_info->hash_tfm = hash_tfm;
++
++		pr_info("Seed hash %s allocated\n", seed_hash);
++	}
++
++	rv = lrng_kcapi_drng_seed_helper(lrng_drng_info, (u8 *)(&time),
++					 sizeof(time));
++	if (rv) {
++		ret = ERR_PTR(rv);
++		goto dealloc;
++	}
++
++	pr_info("Kernel crypto API DRNG %s allocated\n", drng_name);
++
++	return lrng_drng_info;
++
++dealloc:
++	crypto_free_rng(kcapi_rng);
++free:
++	kfree(lrng_drng_info);
++	return ret;
++}
++
++static void lrng_kcapi_drng_dealloc(void *drng)
++{
++	struct lrng_drng_info *lrng_drng_info = (struct lrng_drng_info *)drng;
++	struct crypto_rng *kcapi_rng = lrng_drng_info->kcapi_rng;
++
++	crypto_free_rng(kcapi_rng);
++	if (lrng_drng_info->hash_tfm)
++		crypto_free_shash(lrng_drng_info->hash_tfm);
++	kfree(lrng_drng_info);
++	pr_info("DRNG %s deallocated\n", drng_name);
++}
++
++static const char *lrng_kcapi_drng_name(void)
++{
++	return drng_name;
++}
++
++const struct lrng_drng_cb lrng_kcapi_drng_cb = {
++	.drng_name	= lrng_kcapi_drng_name,
++	.drng_alloc	= lrng_kcapi_drng_alloc,
++	.drng_dealloc	= lrng_kcapi_drng_dealloc,
++	.drng_seed	= lrng_kcapi_drng_seed_helper,
++	.drng_generate	= lrng_kcapi_drng_generate_helper,
++};
++
++#ifndef CONFIG_LRNG_DFLT_DRNG_KCAPI
++static int __init lrng_kcapi_init(void)
++{
++	return lrng_set_drng_cb(&lrng_kcapi_drng_cb);
++}
++static void __exit lrng_kcapi_exit(void)
++{
++	lrng_set_drng_cb(NULL);
++}
++
++late_initcall(lrng_kcapi_init);
++module_exit(lrng_kcapi_exit);
++MODULE_LICENSE("Dual BSD/GPL");
++MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>");
++MODULE_DESCRIPTION("Entropy Source and DRNG Manager - kernel crypto API DRNG backend");
++#endif /* CONFIG_LRNG_DFLT_DRNG_KCAPI */
+From 44fd5618cd312625394fc2cd0861b2ab44068148 Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Mon, 20 Feb 2023 22:05:24 +0100
+Subject: [PATCH 09/25] LRNG - add atomic DRNG implementation
+
+The atomic DRNG implementation supports the in-kernel use cases which
+request random numbers in atomic contexts. It uses the ChaCha20 DRNG
+which is a code base that does not sleep and it provides an interface to
+callers that does not sleep. This code will only be compiled when the
+LRNG enables the in-kernel drop-in replacement APIs for the existing
+random.c code base.
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+---
+ drivers/char/lrng/Makefile           |   1 +
+ drivers/char/lrng/lrng_drng_atomic.c | 130 +++++++++++++++++++++++++++
+ 2 files changed, 131 insertions(+)
+ create mode 100644 drivers/char/lrng/lrng_drng_atomic.c
+
+--- a/drivers/char/lrng/Makefile
++++ b/drivers/char/lrng/Makefile
+@@ -16,3 +16,4 @@ obj-$(CONFIG_LRNG_HASH_KCAPI)		+= lrng_h
+ obj-$(CONFIG_LRNG_DRNG_CHACHA20)	+= lrng_drng_chacha20.o
+ obj-$(CONFIG_LRNG_DRBG)			+= lrng_drng_drbg.o
+ obj-$(CONFIG_LRNG_DRNG_KCAPI)		+= lrng_drng_kcapi.o
++obj-$(CONFIG_LRNG_DRNG_ATOMIC)		+= lrng_drng_atomic.o
+--- /dev/null
++++ b/drivers/char/lrng/lrng_drng_atomic.c
+@@ -0,0 +1,130 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * LRNG DRNG for atomic contexts
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/lrng.h>
++
++#include "lrng_drng_atomic.h"
++#include "lrng_drng_chacha20.h"
++#include "lrng_es_aux.h"
++#include "lrng_es_mgr.h"
++#include "lrng_sha.h"
++
++static struct chacha20_state chacha20_atomic = {
++	LRNG_CC20_INIT_RFC7539(.block)
++};
++
++/*
++ * DRNG usable in atomic context. This DRNG will always use the ChaCha20
++ * DRNG. It will never benefit from a DRNG switch like the "regular" DRNG. If
++ * there was no DRNG switch, the atomic DRNG is identical to the "regular" DRNG.
++ *
++ * The reason for having this is due to the fact that DRNGs other than
++ * the ChaCha20 DRNG may sleep.
++ */
++static struct lrng_drng lrng_drng_atomic = {
++	LRNG_DRNG_STATE_INIT(lrng_drng_atomic,
++			     &chacha20_atomic, NULL,
++			     &lrng_cc20_drng_cb, &lrng_sha_hash_cb),
++	.spin_lock	= __SPIN_LOCK_UNLOCKED(lrng_drng_atomic.spin_lock)
++};
++
++struct lrng_drng *lrng_get_atomic(void)
++{
++	return &lrng_drng_atomic;
++}
++
++void lrng_drng_atomic_reset(void)
++{
++	unsigned long flags;
++
++	spin_lock_irqsave(&lrng_drng_atomic.spin_lock, flags);
++	lrng_drng_reset(&lrng_drng_atomic);
++	spin_unlock_irqrestore(&lrng_drng_atomic.spin_lock, flags);
++}
++
++void lrng_drng_atomic_force_reseed(void)
++{
++	lrng_drng_atomic.force_reseed = lrng_drng_atomic.fully_seeded;
++}
++
++static bool lrng_drng_atomic_must_reseed(struct lrng_drng *drng)
++{
++	return (!drng->fully_seeded ||
++		atomic_read(&lrng_drng_atomic.requests) == 0 ||
++		drng->force_reseed ||
++		time_after(jiffies,
++			   drng->last_seeded + lrng_drng_reseed_max_time * HZ));
++}
++
++void lrng_drng_atomic_seed_drng(struct lrng_drng *regular_drng)
++{
++	u8 seedbuf[LRNG_DRNG_SECURITY_STRENGTH_BYTES]
++						__aligned(LRNG_KCAPI_ALIGN);
++	int ret;
++
++	if (!lrng_drng_atomic_must_reseed(&lrng_drng_atomic))
++		return;
++
++	/*
++	 * Reseed atomic DRNG another DRNG "regular" while this regular DRNG
++	 * is reseeded. Therefore, this code operates in non-atomic context and
++	 * thus can use the lrng_drng_get function to get random numbers from
++	 * the just freshly seeded DRNG.
++	 */
++	ret = lrng_drng_get(regular_drng, seedbuf, sizeof(seedbuf));
++
++	if (ret < 0) {
++		pr_warn("Error generating random numbers for atomic DRNG: %d\n",
++			ret);
++	} else {
++		unsigned long flags;
++
++		spin_lock_irqsave(&lrng_drng_atomic.spin_lock, flags);
++		lrng_drng_inject(&lrng_drng_atomic, seedbuf, ret,
++				 regular_drng->fully_seeded, "atomic");
++		spin_unlock_irqrestore(&lrng_drng_atomic.spin_lock, flags);
++	}
++	memzero_explicit(&seedbuf, sizeof(seedbuf));
++}
++
++static void lrng_drng_atomic_get(u8 *outbuf, u32 outbuflen)
++{
++	struct lrng_drng *drng = &lrng_drng_atomic;
++	unsigned long flags;
++
++	if (!outbuf || !outbuflen)
++		return;
++
++	outbuflen = min_t(size_t, outbuflen, INT_MAX);
++
++	while (outbuflen) {
++		u32 todo = min_t(u32, outbuflen, LRNG_DRNG_MAX_REQSIZE);
++		int ret;
++
++		atomic_dec(&drng->requests);
++
++		spin_lock_irqsave(&drng->spin_lock, flags);
++		ret = drng->drng_cb->drng_generate(drng->drng, outbuf, todo);
++		spin_unlock_irqrestore(&drng->spin_lock, flags);
++		if (ret <= 0) {
++			pr_warn("getting random data from DRNG failed (%d)\n",
++				ret);
++			return;
++		}
++		outbuflen -= ret;
++		outbuf += ret;
++	}
++}
++
++void lrng_get_random_bytes(void *buf, int nbytes)
++{
++	lrng_drng_atomic_get((u8 *)buf, (u32)nbytes);
++	lrng_debug_report_seedlevel("lrng_get_random_bytes");
++}
++EXPORT_SYMBOL(lrng_get_random_bytes);
+From 23fcb6113f576df31763a698e8326c8d3bab57a6 Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Sun, 15 May 2022 16:21:44 +0200
+Subject: [PATCH 10/25] LRNG - add common timer-based entropy source code
+
+The code shared for timer-based entropy sources offers the following
+support:
+
+* It calculates the greatest common divisor (GCD) during startup time.
+  This allows diving the time stamp by this divisor to eliminate static
+  low-order bits. With the GCD only timer bits that move are considered
+  by the entropy sources.
+
+* It contains the detector code base to identify the presence of a
+  high-resolution timer.
+
+This code is only compiled when an entropy source is present that
+is based on high-resolution time stamps
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+---
+ drivers/char/lrng/Kconfig                |   6 +-
+ drivers/char/lrng/Makefile               |   2 +
+ drivers/char/lrng/lrng_es_timer_common.c | 144 +++++++++++++++++++++++
+ 3 files changed, 149 insertions(+), 3 deletions(-)
+ create mode 100644 drivers/char/lrng/lrng_es_timer_common.c
+
+--- a/drivers/char/lrng/Kconfig
++++ b/drivers/char/lrng/Kconfig
+@@ -144,9 +144,9 @@ endmenu # "Specific DRNG seeding strateg
+ # config LRNG_SCHED_DFLT_TIMER_ES
+ # 	bool
+ #
+-# config LRNG_TIMER_COMMON
+-# 	bool
+-#
++config LRNG_TIMER_COMMON
++	bool
++
+ # choice
+ # 	prompt "Default Timer-based Entropy Source"
+ # 	default LRNG_IRQ_DFLT_TIMER_ES
+--- a/drivers/char/lrng/Makefile
++++ b/drivers/char/lrng/Makefile
+@@ -17,3 +17,5 @@ obj-$(CONFIG_LRNG_DRNG_CHACHA20)	+= lrng
+ obj-$(CONFIG_LRNG_DRBG)			+= lrng_drng_drbg.o
+ obj-$(CONFIG_LRNG_DRNG_KCAPI)		+= lrng_drng_kcapi.o
+ obj-$(CONFIG_LRNG_DRNG_ATOMIC)		+= lrng_drng_atomic.o
++
++obj-$(CONFIG_LRNG_TIMER_COMMON)		+= lrng_es_timer_common.o
+--- /dev/null
++++ b/drivers/char/lrng/lrng_es_timer_common.c
+@@ -0,0 +1,144 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * LRNG Slow Entropy Source: Interrupt data collection
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/gcd.h>
++#include <linux/module.h>
++
++#include "lrng_es_irq.h"
++#include "lrng_es_sched.h"
++#include "lrng_es_timer_common.h"
++#include "lrng_health.h"
++
++/* Is high-resolution timer present? */
++static bool lrng_highres_timer_val = false;
++
++/* Number of time stamps analyzed to calculate a GCD */
++#define LRNG_GCD_WINDOW_SIZE	100
++static u32 lrng_gcd_history[LRNG_GCD_WINDOW_SIZE];
++static atomic_t lrng_gcd_history_ptr = ATOMIC_INIT(-1);
++
++/* The common divisor for all timestamps */
++static u32 lrng_gcd_timer = 0;
++
++bool lrng_gcd_tested(void)
++{
++	return (lrng_gcd_timer != 0);
++}
++
++u32 lrng_gcd_get(void)
++{
++	return lrng_gcd_timer;
++}
++
++/* Set the GCD for use in IRQ ES - if 0, the GCD calculation is restarted. */
++void lrng_gcd_set(u32 running_gcd)
++{
++	lrng_gcd_timer = running_gcd;
++	/* Ensure that update to global variable lrng_gcd_timer is visible */
++	mb();
++}
++
++static void lrng_gcd_set_check(u32 running_gcd)
++{
++	if (!lrng_gcd_tested()) {
++		lrng_gcd_set(running_gcd);
++		pr_debug("Setting GCD to %u\n", running_gcd);
++	}
++}
++
++u32 lrng_gcd_analyze(u32 *history, size_t nelem)
++{
++	u32 running_gcd = 0;
++	size_t i;
++
++	/* Now perform the analysis on the accumulated time data. */
++	for (i = 0; i < nelem; i++) {
++		/*
++		 * NOTE: this would be the place to add more analysis on the
++		 * appropriateness of the timer like checking the presence
++		 * of sufficient variations in the timer.
++		 */
++
++		/*
++		 * This calculates the gcd of all the time values. that is
++		 * gcd(time_1, time_2, ..., time_nelem)
++		 *
++		 * Some timers increment by a fixed (non-1) amount each step.
++		 * This code checks for such increments, and allows the library
++		 * to output the number of such changes have occurred.
++		 */
++		running_gcd = (u32)gcd(history[i], running_gcd);
++
++		/* Zeroize data */
++		history[i] = 0;
++	}
++
++	return running_gcd;
++}
++
++void lrng_gcd_add_value(u32 time)
++{
++	u32 ptr = (u32)atomic_inc_return_relaxed(&lrng_gcd_history_ptr);
++
++	if (ptr < LRNG_GCD_WINDOW_SIZE) {
++		lrng_gcd_history[ptr] = time;
++	} else if (ptr == LRNG_GCD_WINDOW_SIZE) {
++		u32 gcd = lrng_gcd_analyze(lrng_gcd_history,
++					   LRNG_GCD_WINDOW_SIZE);
++
++		if (!gcd)
++			gcd = 1;
++
++		/*
++		 * Ensure that we have variations in the time stamp below the
++		 * given value. This is just a safety measure to prevent the GCD
++		 * becoming too large.
++		 */
++		if (gcd >= 1000) {
++			pr_warn("calculated GCD is larger than expected: %u\n",
++				gcd);
++			gcd = 1000;
++		}
++
++		/*  Adjust all deltas by the observed (small) common factor. */
++		lrng_gcd_set_check(gcd);
++		atomic_set(&lrng_gcd_history_ptr, 0);
++	}
++}
++
++/* Return boolean whether LRNG identified presence of high-resolution timer */
++bool lrng_highres_timer(void)
++{
++	return lrng_highres_timer_val;
++}
++
++static int __init lrng_init_time_source(void)
++{
++	if ((random_get_entropy() & LRNG_DATA_SLOTSIZE_MASK) ||
++	    (random_get_entropy() & LRNG_DATA_SLOTSIZE_MASK)) {
++		/*
++		 * As the highres timer is identified here, previous interrupts
++		 * obtained during boot time are treated like a lowres-timer
++		 * would have been present.
++		 */
++		lrng_highres_timer_val = true;
++	} else {
++		lrng_health_disable();
++		lrng_highres_timer_val = false;
++	}
++
++	lrng_irq_es_init(lrng_highres_timer_val);
++	lrng_sched_es_init(lrng_highres_timer_val);
++
++	/* Ensure that changes to global variables are visible */
++	mb();
++
++	return 0;
++}
++core_initcall(lrng_init_time_source);
+From 7d4187b3588c7c0216ac82634493c30c1d5f28c7 Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Tue, 25 Apr 2023 23:03:39 +0200
+Subject: [PATCH 11/25] LRNG - add interrupt entropy source
+
+The interrupt entropy source (ES) consumes the events triggered by the
+kernel invoked with the add_interrupt_randomness. Its main goal is:
+
+- to be extremely fast in the interrupt handler - This is guaranteed by
+  only concatenating the least significant bits of a time stamp into
+  CPU-local entropy pools. Thus, the operation is quasi-lockless. Also,
+  the concatenation is a very trivial operation. Finally, by discarding
+  the high-order bits, attacker-observable timing values are discarded.
+
+- to use only cryptographic primitives for compression.
+
+The IRQ entropy pool collects noise data from interrupt timing.
+Any data received by the LRNG from the interrupt noise sources is
+inserted into a per-CPU entropy pool using a hash operation that can
+be changed during runtime. Per default, SHA-256 is used.
+
+ (a) When an interrupt occurs, the 8 least significant bits of the
+ high-resolution time stamp divided by the greatest common divisor (GCD)
+ is mixed into the per-CPU entropy pool. This time stamp is credited with
+ heuristically implied entropy.
+
+ (b) HID event data like the key stroke or the mouse coordinates are
+ mixed into the per-CPU entropy pool. This data is not credited with
+ entropy by the LRNG.
+
+To speed up the interrupt handling code of the LRNG, the time stamp
+collected for an interrupt event is divided by the greatest common
+divisor to eliminate fixed low bits and then truncated to the 8 least
+significant bits. 1024 truncated time stamps are concatenated and then
+jointly inserted into the per-CPU entropy pool. During boot time,
+until the fully seeded stage is reached, each time stamp with its
+32 least significant bits is are concatenated. When 1024/32 = 32 such
+events are received, they are injected into the per-CPU entropy pool.
+
+The IRQ ES is only enabled if the existing random number generator
+(random.c) is not compiled.
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+---
+ drivers/char/lrng/Kconfig       | 386 ++++++++---------
+ drivers/char/lrng/Makefile      |   1 +
+ drivers/char/lrng/lrng_es_irq.c | 730 ++++++++++++++++++++++++++++++++
+ 3 files changed, 924 insertions(+), 193 deletions(-)
+ create mode 100644 drivers/char/lrng/lrng_es_irq.c
+
+--- a/drivers/char/lrng/Kconfig
++++ b/drivers/char/lrng/Kconfig
+@@ -122,8 +122,8 @@ endmenu # "Specific DRNG seeding strateg
+ #
+ # endmenu # "LRNG Interfaces"
+ 
+-# menu "Entropy Source Configuration"
+-#
++menu "Entropy Source Configuration"
++
+ # config LRNG_RUNTIME_ES_CONFIG
+ # 	bool "Enable runtime configuration of entropy sources"
+ # 	help
+@@ -135,100 +135,100 @@ endmenu # "Specific DRNG seeding strateg
+ # 	  a kernel command line option. When not providing any
+ # 	  option, the default specified during kernel compilation
+ # 	  is applied.
+-#
+-# comment "Common Timer-based Entropy Source Configuration"
+-#
+-# config LRNG_IRQ_DFLT_TIMER_ES
+-# 	bool
+-#
++
++comment "Common Timer-based Entropy Source Configuration"
++
++config LRNG_IRQ_DFLT_TIMER_ES
++	bool
++
+ # config LRNG_SCHED_DFLT_TIMER_ES
+ # 	bool
+ #
+ config LRNG_TIMER_COMMON
+ 	bool
+ 
+-# choice
+-# 	prompt "Default Timer-based Entropy Source"
+-# 	default LRNG_IRQ_DFLT_TIMER_ES
+-# 	depends on LRNG_TIMER_COMMON
+-# 	help
+-# 	  Select the timer-based entropy source that is credited
+-# 	  with entropy. The other timer-based entropy sources may
+-# 	  be operational and provide data, but are credited with no
+-# 	  entropy.
+-#
+-# 	config LRNG_IRQ_DFLT_TIMER_ES
+-# 	bool "Interrupt Entropy Source"
+-# 	depends on LRNG_IRQ
+-# 	help
+-# 	  The interrupt entropy source is selected as a timer-based
+-# 	  entropy source to provide entropy.
+-#
++choice
++	prompt "Default Timer-based Entropy Source"
++	default LRNG_IRQ_DFLT_TIMER_ES
++	depends on LRNG_TIMER_COMMON
++	help
++	  Select the timer-based entropy source that is credited
++	  with entropy. The other timer-based entropy sources may
++	  be operational and provide data, but are credited with no
++	  entropy.
++
++	config LRNG_IRQ_DFLT_TIMER_ES
++	bool "Interrupt Entropy Source"
++	depends on LRNG_IRQ
++	help
++	  The interrupt entropy source is selected as a timer-based
++	  entropy source to provide entropy.
++
+ # 	config LRNG_SCHED_DFLT_TIMER_ES
+ # 	bool "Scheduler Entropy Source"
+ # 	depends on LRNG_SCHED
+ # 	help
+ # 	  The scheduler entropy source is selected as timer-based
+ # 	  entropy source to provide entropy.
+-# endchoice
+-#
+-# choice
+-# 	prompt "LRNG Entropy Collection Pool Size"
+-# 	default LRNG_COLLECTION_SIZE_1024
+-# 	depends on LRNG_TIMER_COMMON
+-# 	help
+-# 	  Select the size of the LRNG entropy collection pool
+-# 	  storing data for the interrupt as well as the scheduler
+-# 	  entropy sources without performing a compression
+-# 	  operation. The larger the collection size is, the faster
+-# 	  the average interrupt handling will be. The collection
+-# 	  size represents the number of bytes of the per-CPU memory
+-# 	  used to batch up entropy event data.
+-#
+-# 	  The default value is good for regular operations. Choose
+-# 	  larger sizes for servers that have no memory limitations.
+-# 	  If runtime memory is precious, choose a smaller size.
+-#
+-# 	  The collection size is unrelated to the entropy rate
+-# 	  or the amount of entropy the LRNG can process.
+-#
+-# 	config LRNG_COLLECTION_SIZE_32
+-# 	depends on LRNG_CONTINUOUS_COMPRESSION_ENABLED
+-# 	depends on !LRNG_SWITCHABLE_CONTINUOUS_COMPRESSION
+-# 	depends on !CRYPTO_FIPS
+-# 		bool "32 interrupt events"
+-#
+-# 	config LRNG_COLLECTION_SIZE_256
+-# 	depends on !CRYPTO_FIPS
+-# 		bool "256 interrupt events"
+-#
+-# 	config LRNG_COLLECTION_SIZE_512
+-# 		bool "512 interrupt events"
+-#
+-# 	config LRNG_COLLECTION_SIZE_1024
+-# 		bool "1024 interrupt events (default)"
+-#
+-# 	config LRNG_COLLECTION_SIZE_2048
+-# 		bool "2048 interrupt events"
+-#
+-# 	config LRNG_COLLECTION_SIZE_4096
+-# 		bool "4096 interrupt events"
+-#
+-# 	config LRNG_COLLECTION_SIZE_8192
+-# 		bool "8192 interrupt events"
+-#
+-# endchoice
+-#
+-# config LRNG_COLLECTION_SIZE
+-# 	int
+-# 	default 32 if LRNG_COLLECTION_SIZE_32
+-# 	default 256 if LRNG_COLLECTION_SIZE_256
+-# 	default 512 if LRNG_COLLECTION_SIZE_512
+-# 	default 1024 if LRNG_COLLECTION_SIZE_1024
+-# 	default 2048 if LRNG_COLLECTION_SIZE_2048
+-# 	default 4096 if LRNG_COLLECTION_SIZE_4096
+-# 	default 8192 if LRNG_COLLECTION_SIZE_8192
+-#
++endchoice
++
++choice
++	prompt "LRNG Entropy Collection Pool Size"
++	default LRNG_COLLECTION_SIZE_1024
++	depends on LRNG_TIMER_COMMON
++	help
++	  Select the size of the LRNG entropy collection pool
++	  storing data for the interrupt as well as the scheduler
++	  entropy sources without performing a compression
++	  operation. The larger the collection size is, the faster
++	  the average interrupt handling will be. The collection
++	  size represents the number of bytes of the per-CPU memory
++	  used to batch up entropy event data.
++
++	  The default value is good for regular operations. Choose
++	  larger sizes for servers that have no memory limitations.
++	  If runtime memory is precious, choose a smaller size.
++
++	  The collection size is unrelated to the entropy rate
++	  or the amount of entropy the LRNG can process.
++
++	config LRNG_COLLECTION_SIZE_32
++	depends on LRNG_CONTINUOUS_COMPRESSION_ENABLED
++	depends on !LRNG_SWITCHABLE_CONTINUOUS_COMPRESSION
++	depends on !CRYPTO_FIPS
++		bool "32 interrupt events"
++
++	config LRNG_COLLECTION_SIZE_256
++	depends on !CRYPTO_FIPS
++		bool "256 interrupt events"
++
++	config LRNG_COLLECTION_SIZE_512
++		bool "512 interrupt events"
++
++	config LRNG_COLLECTION_SIZE_1024
++		bool "1024 interrupt events (default)"
++
++	config LRNG_COLLECTION_SIZE_2048
++		bool "2048 interrupt events"
++
++	config LRNG_COLLECTION_SIZE_4096
++		bool "4096 interrupt events"
++
++	config LRNG_COLLECTION_SIZE_8192
++		bool "8192 interrupt events"
++
++endchoice
++
++config LRNG_COLLECTION_SIZE
++	int
++	default 32 if LRNG_COLLECTION_SIZE_32
++	default 256 if LRNG_COLLECTION_SIZE_256
++	default 512 if LRNG_COLLECTION_SIZE_512
++	default 1024 if LRNG_COLLECTION_SIZE_1024
++	default 2048 if LRNG_COLLECTION_SIZE_2048
++	default 4096 if LRNG_COLLECTION_SIZE_4096
++	default 8192 if LRNG_COLLECTION_SIZE_8192
++
+ # config LRNG_HEALTH_TESTS
+ # 	bool "Enable internal entropy source online health tests"
+ # 	depends on LRNG_TIMER_COMMON
+@@ -303,113 +303,113 @@ config LRNG_TIMER_COMMON
+ # 	int
+ # 	default 371 if !LRNG_APT_BROKEN
+ # 	default 33 if LRNG_APT_BROKEN
+-#
+-# comment "Interrupt Entropy Source"
+-#
+-# config LRNG_IRQ
+-# 	bool "Enable Interrupt Entropy Source as LRNG Seed Source"
+-# 	default y
+-# 	depends on !RANDOM_DEFAULT_IMPL
+-# 	select LRNG_TIMER_COMMON
+-# 	help
+-# 	  The LRNG models an entropy source based on the timing of the
+-# 	  occurrence of interrupts. Enable this option to enable this
+-# 	  IRQ entropy source.
+-#
+-# 	  The IRQ entropy source is triggered every time an interrupt
+-# 	  arrives and thus causes the interrupt handler to execute
+-# 	  slightly longer. Disabling the IRQ entropy source implies
+-# 	  that the performance penalty on the interrupt handler added
+-# 	  by the LRNG is eliminated. Yet, this entropy source is
+-# 	  considered to be an internal entropy source of the LRNG.
+-# 	  Thus, only disable it if you ensured that other entropy
+-# 	  sources are available that supply the LRNG with entropy.
+-#
+-# 	  If you disable the IRQ entropy source, you MUST ensure
+-# 	  one or more entropy sources collectively have the
+-# 	  capability to deliver sufficient entropy with one invocation
+-# 	  at a rate compliant to the security strength of the DRNG
+-# 	  (usually 256 bits of entropy). In addition, if those
+-# 	  entropy sources do not deliver sufficient entropy during
+-# 	  first request, the reseed must be triggered from user
+-# 	  space or kernel space when sufficient entropy is considered
+-# 	  to be present.
+-#
+-# 	  If unsure, say Y.
+-#
+-# choice
+-# 	prompt "Continuous entropy compression boot time setting"
+-# 	default LRNG_CONTINUOUS_COMPRESSION_ENABLED
+-# 	depends on LRNG_IRQ
+-# 	help
+-# 	  Select the default behavior of the interrupt entropy source
+-# 	  continuous compression operation.
+-#
+-# 	  The LRNG IRQ ES collects entropy data during each interrupt.
+-# 	  For performance reasons, a amount of entropy data defined by
+-# 	  the LRNG entropy collection pool size is concatenated into
+-# 	  an array. When that array is filled up, a hash is calculated
+-# 	  to compress the entropy. That hash is calculated in
+-# 	  interrupt context.
+-#
+-# 	  In case such hash calculation in interrupt context is deemed
+-# 	  too time-consuming, the continuous compression operation
+-# 	  can be disabled. If disabled, the collection of entropy will
+-# 	  not trigger a hash compression operation in interrupt context.
+-# 	  The compression happens only when the DRNG is reseeded which is
+-# 	  in process context. This implies that old entropy data
+-# 	  collected after the last DRNG-reseed is overwritten with newer
+-# 	  entropy data once the collection pool is full instead of
+-# 	  retaining its entropy with the compression operation.
+-#
+-# 	config LRNG_CONTINUOUS_COMPRESSION_ENABLED
+-# 		bool "Enable continuous compression (default)"
+-#
+-# 	config LRNG_CONTINUOUS_COMPRESSION_DISABLED
+-# 		bool "Disable continuous compression"
+-#
+-# endchoice
+-#
+-# config LRNG_ENABLE_CONTINUOUS_COMPRESSION
+-# 	bool
+-# 	default y if LRNG_CONTINUOUS_COMPRESSION_ENABLED
+-# 	default n if LRNG_CONTINUOUS_COMPRESSION_DISABLED
+-#
+-# config LRNG_SWITCHABLE_CONTINUOUS_COMPRESSION
+-# 	bool "Runtime-switchable continuous entropy compression"
+-# 	depends on LRNG_IRQ
+-# 	help
+-# 	  Per default, the interrupt entropy source continuous
+-# 	  compression operation behavior is hard-wired into the kernel.
+-# 	  Enable this option to allow it to be configurable at boot time.
+-#
+-# 	  To modify the default behavior of the continuous
+-# 	  compression operation, use the kernel command line option
+-# 	  of lrng_sw_noise.lrng_pcpu_continuous_compression.
+-#
+-# 	  If unsure, say N.
+-#
+-# config LRNG_IRQ_ENTROPY_RATE
+-# 	int "Interrupt Entropy Source Entropy Rate"
+-# 	depends on LRNG_IRQ
+-# 	range 256 4294967295 if LRNG_IRQ_DFLT_TIMER_ES
+-# 	range 4294967295 4294967295 if !LRNG_IRQ_DFLT_TIMER_ES
+-# 	default 256 if LRNG_IRQ_DFLT_TIMER_ES
+-# 	default 4294967295 if !LRNG_IRQ_DFLT_TIMER_ES
+-# 	help
+-# 	  The LRNG will collect the configured number of interrupts to
+-# 	  obtain 256 bits of entropy. This value can be set to any between
+-# 	  256 and 4294967295. The LRNG guarantees that this value is not
+-# 	  lower than 256. This lower limit implies that one interrupt event
+-# 	  is credited with one bit of entropy. This value is subject to the
+-# 	  increase by the oversampling factor, if no high-resolution timer
+-# 	  is found.
+-#
+-# 	  In order to effectively disable the interrupt entropy source,
+-# 	  the option has to be set to 4294967295. In this case, the
+-# 	  interrupt entropy source will still deliver data but without
+-# 	  being credited with entropy.
+-#
++
++comment "Interrupt Entropy Source"
++
++config LRNG_IRQ
++	bool "Enable Interrupt Entropy Source as LRNG Seed Source"
++	default y
++	depends on !RANDOM_DEFAULT_IMPL
++	select LRNG_TIMER_COMMON
++	help
++	  The LRNG models an entropy source based on the timing of the
++	  occurrence of interrupts. Enable this option to enable this
++	  IRQ entropy source.
++
++	  The IRQ entropy source is triggered every time an interrupt
++	  arrives and thus causes the interrupt handler to execute
++	  slightly longer. Disabling the IRQ entropy source implies
++	  that the performance penalty on the interrupt handler added
++	  by the LRNG is eliminated. Yet, this entropy source is
++	  considered to be an internal entropy source of the LRNG.
++	  Thus, only disable it if you ensured that other entropy
++	  sources are available that supply the LRNG with entropy.
++
++	  If you disable the IRQ entropy source, you MUST ensure
++	  one or more entropy sources collectively have the
++	  capability to deliver sufficient entropy with one invocation
++	  at a rate compliant to the security strength of the DRNG
++	  (usually 256 bits of entropy). In addition, if those
++	  entropy sources do not deliver sufficient entropy during
++	  first request, the reseed must be triggered from user
++	  space or kernel space when sufficient entropy is considered
++	  to be present.
++
++	  If unsure, say Y.
++
++choice
++	prompt "Continuous entropy compression boot time setting"
++	default LRNG_CONTINUOUS_COMPRESSION_ENABLED
++	depends on LRNG_IRQ
++	help
++	  Select the default behavior of the interrupt entropy source
++	  continuous compression operation.
++
++	  The LRNG IRQ ES collects entropy data during each interrupt.
++	  For performance reasons, a amount of entropy data defined by
++	  the LRNG entropy collection pool size is concatenated into
++	  an array. When that array is filled up, a hash is calculated
++	  to compress the entropy. That hash is calculated in
++	  interrupt context.
++
++	  In case such hash calculation in interrupt context is deemed
++	  too time-consuming, the continuous compression operation
++	  can be disabled. If disabled, the collection of entropy will
++	  not trigger a hash compression operation in interrupt context.
++	  The compression happens only when the DRNG is reseeded which is
++	  in process context. This implies that old entropy data
++	  collected after the last DRNG-reseed is overwritten with newer
++	  entropy data once the collection pool is full instead of
++	  retaining its entropy with the compression operation.
++
++	config LRNG_CONTINUOUS_COMPRESSION_ENABLED
++		bool "Enable continuous compression (default)"
++
++	config LRNG_CONTINUOUS_COMPRESSION_DISABLED
++		bool "Disable continuous compression"
++
++endchoice
++
++config LRNG_ENABLE_CONTINUOUS_COMPRESSION
++	bool
++	default y if LRNG_CONTINUOUS_COMPRESSION_ENABLED
++	default n if LRNG_CONTINUOUS_COMPRESSION_DISABLED
++
++config LRNG_SWITCHABLE_CONTINUOUS_COMPRESSION
++	bool "Runtime-switchable continuous entropy compression"
++	depends on LRNG_IRQ
++	help
++	  Per default, the interrupt entropy source continuous
++	  compression operation behavior is hard-wired into the kernel.
++	  Enable this option to allow it to be configurable at boot time.
++
++	  To modify the default behavior of the continuous
++	  compression operation, use the kernel command line option
++	  of lrng_sw_noise.lrng_pcpu_continuous_compression.
++
++	  If unsure, say N.
++
++config LRNG_IRQ_ENTROPY_RATE
++	int "Interrupt Entropy Source Entropy Rate"
++	depends on LRNG_IRQ
++	range 256 4294967295 if LRNG_IRQ_DFLT_TIMER_ES
++	range 4294967295 4294967295 if !LRNG_IRQ_DFLT_TIMER_ES
++	default 256 if LRNG_IRQ_DFLT_TIMER_ES
++	default 4294967295 if !LRNG_IRQ_DFLT_TIMER_ES
++	help
++	  The LRNG will collect the configured number of interrupts to
++	  obtain 256 bits of entropy. This value can be set to any between
++	  256 and 4294967295. The LRNG guarantees that this value is not
++	  lower than 256. This lower limit implies that one interrupt event
++	  is credited with one bit of entropy. This value is subject to the
++	  increase by the oversampling factor, if no high-resolution timer
++	  is found.
++
++	  In order to effectively disable the interrupt entropy source,
++	  the option has to be set to 4294967295. In this case, the
++	  interrupt entropy source will still deliver data but without
++	  being credited with entropy.
++
+ # comment "Jitter RNG Entropy Source"
+ #
+ # config LRNG_JENT
+@@ -614,8 +614,8 @@ config LRNG_TIMER_COMMON
+ # 	  kernel in FIPS mode (with fips=1 kernel command line option).
+ # 	  This is due to the fact that random.c is not SP800-90B
+ # 	  compliant.
+-#
+-# endmenu # "Entropy Source Configuration"
++
++endmenu # "Entropy Source Configuration"
+ 
+ config LRNG_DRNG_CHACHA20
+ 	tristate
+--- a/drivers/char/lrng/Makefile
++++ b/drivers/char/lrng/Makefile
+@@ -19,3 +19,4 @@ obj-$(CONFIG_LRNG_DRNG_KCAPI)		+= lrng_d
+ obj-$(CONFIG_LRNG_DRNG_ATOMIC)		+= lrng_drng_atomic.o
+ 
+ obj-$(CONFIG_LRNG_TIMER_COMMON)		+= lrng_es_timer_common.o
++obj-$(CONFIG_LRNG_IRQ)			+= lrng_es_irq.o
+--- /dev/null
++++ b/drivers/char/lrng/lrng_es_irq.c
+@@ -0,0 +1,730 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * LRNG Slow Entropy Source: Interrupt data collection
++ *
++ * Copyright (C) 2022 - 2023, Stephan Mueller <smueller@chronox.de>
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <asm/irq_regs.h>
++#include <asm/ptrace.h>
++#include <crypto/hash.h>
++#include <linux/gcd.h>
++#include <linux/module.h>
++#include <linux/random.h>
++
++#include "lrng_es_aux.h"
++#include "lrng_es_irq.h"
++#include "lrng_es_timer_common.h"
++#include "lrng_health.h"
++#include "lrng_numa.h"
++#include "lrng_testing.h"
++
++/*
++ * Number of interrupts to be recorded to assume that DRNG security strength
++ * bits of entropy are received.
++ * Note: a value below the DRNG security strength should not be defined as this
++ *	 may imply the DRNG can never be fully seeded in case other noise
++ *	 sources are unavailable.
++ */
++#define LRNG_IRQ_ENTROPY_BITS LRNG_UINT32_C(CONFIG_LRNG_IRQ_ENTROPY_RATE)
++
++
++/* Number of interrupts required for LRNG_DRNG_SECURITY_STRENGTH_BITS entropy */
++static u32 lrng_irq_entropy_bits = LRNG_IRQ_ENTROPY_BITS;
++
++static u32 irq_entropy __read_mostly = LRNG_IRQ_ENTROPY_BITS;
++#ifdef CONFIG_LRNG_RUNTIME_ES_CONFIG
++module_param(irq_entropy, uint, 0444);
++MODULE_PARM_DESC(irq_entropy,
++		 "How many interrupts must be collected for obtaining 256 bits of entropy\n");
++#endif
++
++/* Per-CPU array holding concatenated IRQ entropy events */
++static DEFINE_PER_CPU(u32 [LRNG_DATA_ARRAY_SIZE], lrng_irq_array)
++						__aligned(LRNG_KCAPI_ALIGN);
++static DEFINE_PER_CPU(u32, lrng_irq_array_ptr) = 0;
++static DEFINE_PER_CPU(atomic_t, lrng_irq_array_irqs) = ATOMIC_INIT(0);
++
++/*
++ * The entropy collection is performed by executing the following steps:
++ * 1. fill up the per-CPU array holding the time stamps
++ * 2. once the per-CPU array is full, a compression of the data into
++ *    the entropy pool is performed - this happens in interrupt context
++ *
++ * If step 2 is not desired in interrupt context, the following boolean
++ * needs to be set to false. This implies that old entropy data in the
++ * per-CPU array collected since the last DRNG reseed is overwritten with
++ * new entropy data instead of retaining the entropy with the compression
++ * operation.
++ *
++ * Impact on entropy:
++ *
++ * If continuous compression is enabled, the maximum entropy that is collected
++ * per CPU between DRNG reseeds is equal to the digest size of the used hash.
++ *
++ * If continuous compression is disabled, the maximum number of entropy events
++ * that can be collected per CPU is equal to LRNG_DATA_ARRAY_SIZE. This amount
++ * of events is converted into an entropy statement which then represents the
++ * maximum amount of entropy collectible per CPU between DRNG reseeds.
++ */
++static bool lrng_irq_continuous_compression __read_mostly =
++			IS_ENABLED(CONFIG_LRNG_ENABLE_CONTINUOUS_COMPRESSION);
++
++#ifdef CONFIG_LRNG_SWITCHABLE_CONTINUOUS_COMPRESSION
++module_param(lrng_irq_continuous_compression, bool, 0444);
++MODULE_PARM_DESC(lrng_irq_continuous_compression,
++		 "Perform entropy compression if per-CPU entropy data array is full\n");
++#endif
++
++/*
++ * Per-CPU entropy pool with compressed entropy event
++ *
++ * The per-CPU entropy pool is defined as the hash state. New data is simply
++ * inserted into the entropy pool by performing a hash update operation.
++ * To read the entropy pool, a hash final must be invoked. However, before
++ * the entropy pool is released again after a hash final, the hash init must
++ * be performed.
++ */
++static DEFINE_PER_CPU(u8 [LRNG_POOL_SIZE], lrng_irq_pool)
++						__aligned(LRNG_KCAPI_ALIGN);
++/*
++ * Lock to allow other CPUs to read the pool - as this is only done during
++ * reseed which is infrequent, this lock is hardly contended.
++ */
++static DEFINE_PER_CPU(spinlock_t, lrng_irq_lock);
++static DEFINE_PER_CPU(bool, lrng_irq_lock_init) = false;
++
++static bool lrng_irq_pool_online(int cpu)
++{
++	return per_cpu(lrng_irq_lock_init, cpu);
++}
++
++static void __init lrng_irq_check_compression_state(void)
++{
++	/* One pool must hold sufficient entropy for disabled compression */
++	if (!lrng_irq_continuous_compression) {
++		u32 max_ent = min_t(u32, lrng_get_digestsize(),
++				    lrng_data_to_entropy(LRNG_DATA_NUM_VALUES,
++							lrng_irq_entropy_bits));
++		if (max_ent < lrng_security_strength()) {
++			pr_warn("Force continuous compression operation to ensure LRNG can hold enough entropy\n");
++			lrng_irq_continuous_compression = true;
++		}
++	}
++}
++
++void __init lrng_irq_es_init(bool highres_timer)
++{
++	/* Set a minimum number of interrupts that must be collected */
++	irq_entropy = max_t(u32, LRNG_IRQ_ENTROPY_BITS, irq_entropy);
++
++	if (highres_timer) {
++		lrng_irq_entropy_bits = irq_entropy;
++	} else {
++		u32 new_entropy = irq_entropy * LRNG_ES_OVERSAMPLING_FACTOR;
++
++		lrng_irq_entropy_bits = (irq_entropy < new_entropy) ?
++					 new_entropy : irq_entropy;
++		pr_warn("operating without high-resolution timer and applying IRQ oversampling factor %u\n",
++			LRNG_ES_OVERSAMPLING_FACTOR);
++	}
++
++	lrng_irq_check_compression_state();
++}
++
++/*
++ * Reset all per-CPU pools - reset entropy estimator but leave the pool data
++ * that may or may not have entropy unchanged.
++ */
++static void lrng_irq_reset(void)
++{
++	int cpu;
++
++	/* Trigger GCD calculation anew. */
++	lrng_gcd_set(0);
++
++	for_each_online_cpu(cpu)
++		atomic_set(per_cpu_ptr(&lrng_irq_array_irqs, cpu), 0);
++}
++
++static u32 lrng_irq_avail_pool_size(void)
++{
++	u32 max_size = 0, max_pool = lrng_get_digestsize();
++	int cpu;
++
++	if (!lrng_irq_continuous_compression)
++		max_pool = min_t(u32, max_pool, LRNG_DATA_NUM_VALUES);
++
++	for_each_online_cpu(cpu) {
++		if (lrng_irq_pool_online(cpu))
++			max_size += max_pool;
++	}
++
++	return max_size;
++}
++
++/* Return entropy of unused IRQs present in all per-CPU pools. */
++static u32 lrng_irq_avail_entropy(u32 __unused)
++{
++	u32 digestsize_irqs, irq = 0;
++	int cpu;
++
++	/* Only deliver entropy when SP800-90B self test is completed */
++	if (!lrng_sp80090b_startup_complete_es(lrng_int_es_irq))
++		return 0;
++
++	/* Obtain the cap of maximum numbers of IRQs we count */
++	digestsize_irqs = lrng_entropy_to_data(lrng_get_digestsize(),
++					       lrng_irq_entropy_bits);
++	if (!lrng_irq_continuous_compression) {
++		/* Cap to max. number of IRQs the array can hold */
++		digestsize_irqs = min_t(u32, digestsize_irqs,
++					LRNG_DATA_NUM_VALUES);
++	}
++
++	for_each_online_cpu(cpu) {
++		if (!lrng_irq_pool_online(cpu))
++			continue;
++		irq += min_t(u32, digestsize_irqs,
++			     atomic_read_u32(per_cpu_ptr(&lrng_irq_array_irqs,
++							 cpu)));
++	}
++
++	/* Consider oversampling rate */
++	return lrng_reduce_by_osr(lrng_data_to_entropy(irq,
++						       lrng_irq_entropy_bits));
++}
++
++/*
++ * Trigger a switch of the hash implementation for the per-CPU pool.
++ *
++ * For each per-CPU pool, obtain the message digest with the old hash
++ * implementation, initialize the per-CPU pool again with the new hash
++ * implementation and inject the message digest into the new state.
++ *
++ * Assumption: the caller must guarantee that the new_cb is available during the
++ * entire operation (e.g. it must hold the lock against pointer updating).
++ */
++static int
++lrng_irq_switch_hash(struct lrng_drng *drng, int node,
++		     const struct lrng_hash_cb *new_cb, void *new_hash,
++		     const struct lrng_hash_cb *old_cb)
++{
++	u8 digest[LRNG_MAX_DIGESTSIZE];
++	u32 digestsize_irqs, found_irqs;
++	int ret = 0, cpu;
++
++	if (!IS_ENABLED(CONFIG_LRNG_SWITCH))
++		return -EOPNOTSUPP;
++
++	for_each_online_cpu(cpu) {
++		struct shash_desc *pcpu_shash;
++
++		/*
++		 * Only switch the per-CPU pools for the current node because
++		 * the hash_cb only applies NUMA-node-wide.
++		 */
++		if (cpu_to_node(cpu) != node || !lrng_irq_pool_online(cpu))
++			continue;
++
++		pcpu_shash = (struct shash_desc *)per_cpu_ptr(lrng_irq_pool,
++							      cpu);
++
++		digestsize_irqs = old_cb->hash_digestsize(pcpu_shash);
++		digestsize_irqs = lrng_entropy_to_data(digestsize_irqs << 3,
++						       lrng_irq_entropy_bits);
++
++		if (pcpu_shash->tfm == new_hash)
++			continue;
++
++		/* Get the per-CPU pool hash with old digest ... */
++		ret = old_cb->hash_final(pcpu_shash, digest) ?:
++		      /* ... re-initialize the hash with the new digest ... */
++		      new_cb->hash_init(pcpu_shash, new_hash) ?:
++		      /*
++		       * ... feed the old hash into the new state. We may feed
++		       * uninitialized memory into the new state, but this is
++		       * considered no issue and even good as we have some more
++		       * uncertainty here.
++		       */
++		      new_cb->hash_update(pcpu_shash, digest, sizeof(digest));
++		if (ret)
++			goto out;
++
++		/*
++		 * In case the new digest is larger than the old one, cap
++		 * the available entropy to the old message digest used to
++		 * process the existing data.
++		 */
++		found_irqs = atomic_xchg_relaxed(
++				per_cpu_ptr(&lrng_irq_array_irqs, cpu), 0);
++		found_irqs = min_t(u32, found_irqs, digestsize_irqs);
++		atomic_add_return_relaxed(found_irqs,
++				per_cpu_ptr(&lrng_irq_array_irqs, cpu));
++
++		pr_debug("Re-initialize per-CPU interrupt entropy pool for CPU %d on NUMA node %d with hash %s\n",
++			 cpu, node, new_cb->hash_name());
++	}
++
++out:
++	memzero_explicit(digest, sizeof(digest));
++	return ret;
++}
++
++/*
++ * When reading the per-CPU message digest, make sure we use the crypto
++ * callbacks defined for the NUMA node the per-CPU pool is defined for because
++ * the LRNG crypto switch support is only atomic per NUMA node.
++ */
++static u32
++lrng_irq_pool_hash_one(const struct lrng_hash_cb *pcpu_hash_cb,
++		       void *pcpu_hash, int cpu, u8 *digest, u32 *digestsize)
++{
++	struct shash_desc *pcpu_shash =
++		(struct shash_desc *)per_cpu_ptr(lrng_irq_pool, cpu);
++	spinlock_t *lock = per_cpu_ptr(&lrng_irq_lock, cpu);
++	unsigned long flags;
++	u32 digestsize_irqs, found_irqs;
++
++	/* Lock guarding against reading / writing to per-CPU pool */
++	spin_lock_irqsave(lock, flags);
++
++	*digestsize = pcpu_hash_cb->hash_digestsize(pcpu_hash);
++	digestsize_irqs = lrng_entropy_to_data(*digestsize << 3,
++					       lrng_irq_entropy_bits);
++
++	/* Obtain entropy statement like for the entropy pool */
++	found_irqs = atomic_xchg_relaxed(
++				per_cpu_ptr(&lrng_irq_array_irqs, cpu), 0);
++	/* Cap to maximum amount of data we can hold in hash */
++	found_irqs = min_t(u32, found_irqs, digestsize_irqs);
++
++	/* Cap to maximum amount of data we can hold in array */
++	if (!lrng_irq_continuous_compression)
++		found_irqs = min_t(u32, found_irqs, LRNG_DATA_NUM_VALUES);
++
++	/* Store all not-yet compressed data in data array into hash, ... */
++	if (pcpu_hash_cb->hash_update(pcpu_shash,
++				(u8 *)per_cpu_ptr(lrng_irq_array, cpu),
++				LRNG_DATA_ARRAY_SIZE * sizeof(u32)) ?:
++	    /* ... get the per-CPU pool digest, ... */
++	    pcpu_hash_cb->hash_final(pcpu_shash, digest) ?:
++	    /* ... re-initialize the hash, ... */
++	    pcpu_hash_cb->hash_init(pcpu_shash, pcpu_hash) ?:
++	    /* ... feed the old hash into the new state. */
++	    pcpu_hash_cb->hash_update(pcpu_shash, digest, *digestsize))
++		found_irqs = 0;
++
++	spin_unlock_irqrestore(lock, flags);
++	return found_irqs;
++}
++
++/*
++ * Hash all per-CPU pools and return the digest to be used as seed data for
++ * seeding a DRNG. The caller must guarantee backtracking resistance.
++ * The function will only copy as much data as entropy is available into the
++ * caller-provided output buffer.
++ *
++ * This function handles the translation from the number of received interrupts
++ * into an entropy statement. The conversion depends on LRNG_IRQ_ENTROPY_BITS
++ * which defines how many interrupts must be received to obtain 256 bits of
++ * entropy. With this value, the function lrng_data_to_entropy converts a given
++ * data size (received interrupts, requested amount of data, etc.) into an
++ * entropy statement. lrng_entropy_to_data does the reverse.
++ *
++ * @eb: entropy buffer to store entropy
++ * @requested_bits: Requested amount of entropy
++ * @fully_seeded: indicator whether LRNG is fully seeded
++ */
++static void lrng_irq_pool_hash(struct entropy_buf *eb, u32 requested_bits,
++			       bool fully_seeded)
++{
++	SHASH_DESC_ON_STACK(shash, NULL);
++	const struct lrng_hash_cb *hash_cb;
++	struct lrng_drng **lrng_drng = lrng_drng_instances();
++	struct lrng_drng *drng = lrng_drng_init_instance();
++	u8 digest[LRNG_MAX_DIGESTSIZE];
++	unsigned long flags, flags2;
++	u32 found_irqs, collected_irqs = 0, collected_ent_bits, requested_irqs,
++	    returned_ent_bits;
++	int ret, cpu;
++	void *hash;
++
++	/* Only deliver entropy when SP800-90B self test is completed */
++	if (!lrng_sp80090b_startup_complete_es(lrng_int_es_irq)) {
++		eb->e_bits[lrng_int_es_irq] = 0;
++		return;
++	}
++
++	/* Lock guarding replacement of per-NUMA hash */
++	read_lock_irqsave(&drng->hash_lock, flags);
++
++	hash_cb = drng->hash_cb;
++	hash = drng->hash;
++
++	/* The hash state of filled with all per-CPU pool hashes. */
++	ret = hash_cb->hash_init(shash, hash);
++	if (ret)
++		goto err;
++
++	/* Cap to maximum entropy that can ever be generated with given hash */
++	lrng_cap_requested(hash_cb->hash_digestsize(hash) << 3, requested_bits);
++	requested_irqs = lrng_entropy_to_data(requested_bits +
++					      lrng_compress_osr(),
++					      lrng_irq_entropy_bits);
++
++	/*
++	 * Harvest entropy from each per-CPU hash state - even though we may
++	 * have collected sufficient entropy, we will hash all per-CPU pools.
++	 */
++	for_each_online_cpu(cpu) {
++		struct lrng_drng *pcpu_drng = drng;
++		u32 digestsize, pcpu_unused_irqs = 0;
++		int node = cpu_to_node(cpu);
++
++		/* If pool is not online, then no entropy is present. */
++		if (!lrng_irq_pool_online(cpu))
++			continue;
++
++		if (lrng_drng && lrng_drng[node])
++			pcpu_drng = lrng_drng[node];
++
++		if (pcpu_drng == drng) {
++			found_irqs = lrng_irq_pool_hash_one(hash_cb, hash,
++							    cpu, digest,
++							    &digestsize);
++		} else {
++			read_lock_irqsave(&pcpu_drng->hash_lock, flags2);
++			found_irqs =
++				lrng_irq_pool_hash_one(pcpu_drng->hash_cb,
++						       pcpu_drng->hash, cpu,
++						       digest, &digestsize);
++			read_unlock_irqrestore(&pcpu_drng->hash_lock, flags2);
++		}
++
++		/* Inject the digest into the state of all per-CPU pools */
++		ret = hash_cb->hash_update(shash, digest, digestsize);
++		if (ret)
++			goto err;
++
++		collected_irqs += found_irqs;
++		if (collected_irqs > requested_irqs) {
++			pcpu_unused_irqs = collected_irqs - requested_irqs;
++			atomic_add_return_relaxed(pcpu_unused_irqs,
++				per_cpu_ptr(&lrng_irq_array_irqs, cpu));
++			collected_irqs = requested_irqs;
++		}
++		pr_debug("%u interrupts used from entropy pool of CPU %d, %u interrupts remain unused\n",
++			 found_irqs - pcpu_unused_irqs, cpu, pcpu_unused_irqs);
++	}
++
++	ret = hash_cb->hash_final(shash, digest);
++	if (ret)
++		goto err;
++
++	collected_ent_bits = lrng_data_to_entropy(collected_irqs,
++						  lrng_irq_entropy_bits);
++	/* Apply oversampling: discount requested oversampling rate */
++	returned_ent_bits = lrng_reduce_by_osr(collected_ent_bits);
++
++	pr_debug("obtained %u bits by collecting %u bits of entropy from entropy pool noise source\n",
++		 returned_ent_bits, collected_ent_bits);
++
++	/*
++	 * Truncate to available entropy as implicitly allowed by SP800-90B
++	 * section 3.1.5.1.1 table 1 which awards truncated hashes full
++	 * entropy.
++	 *
++	 * During boot time, we read requested_bits data with
++	 * returned_ent_bits entropy. In case our conservative entropy
++	 * estimate underestimates the available entropy we can transport as
++	 * much available entropy as possible.
++	 */
++	memcpy(eb->e[lrng_int_es_irq], digest,
++	       fully_seeded ? returned_ent_bits >> 3 : requested_bits >> 3);
++	eb->e_bits[lrng_int_es_irq] = returned_ent_bits;
++
++out:
++	hash_cb->hash_desc_zero(shash);
++	read_unlock_irqrestore(&drng->hash_lock, flags);
++	memzero_explicit(digest, sizeof(digest));
++	return;
++
++err:
++	eb->e_bits[lrng_int_es_irq] = 0;
++	goto out;
++}
++
++/* Compress the lrng_irq_array array into lrng_irq_pool */
++static void lrng_irq_array_compress(void)
++{
++	struct shash_desc *shash =
++			(struct shash_desc *)this_cpu_ptr(lrng_irq_pool);
++	struct lrng_drng *drng = lrng_drng_node_instance();
++	const struct lrng_hash_cb *hash_cb;
++	spinlock_t *lock = this_cpu_ptr(&lrng_irq_lock);
++	unsigned long flags, flags2;
++	void *hash;
++	bool init = false;
++
++	read_lock_irqsave(&drng->hash_lock, flags);
++	hash_cb = drng->hash_cb;
++	hash = drng->hash;
++
++	if (unlikely(!this_cpu_read(lrng_irq_lock_init))) {
++		init = true;
++		spin_lock_init(lock);
++		this_cpu_write(lrng_irq_lock_init, true);
++		pr_debug("Initializing per-CPU entropy pool for CPU %d on NUMA node %d with hash %s\n",
++			 raw_smp_processor_id(), numa_node_id(),
++			 hash_cb->hash_name());
++	}
++
++	spin_lock_irqsave(lock, flags2);
++
++	if (unlikely(init) && hash_cb->hash_init(shash, hash)) {
++		this_cpu_write(lrng_irq_lock_init, false);
++		pr_warn("Initialization of hash failed\n");
++	} else if (lrng_irq_continuous_compression) {
++		/* Add entire per-CPU data array content into entropy pool. */
++		if (hash_cb->hash_update(shash,
++					(u8 *)this_cpu_ptr(lrng_irq_array),
++					LRNG_DATA_ARRAY_SIZE * sizeof(u32)))
++			pr_warn_ratelimited("Hashing of entropy data failed\n");
++	}
++
++	spin_unlock_irqrestore(lock, flags2);
++	read_unlock_irqrestore(&drng->hash_lock, flags);
++}
++
++/* Compress data array into hash */
++static void lrng_irq_array_to_hash(u32 ptr)
++{
++	u32 *array = this_cpu_ptr(lrng_irq_array);
++
++	/*
++	 * During boot time the hash operation is triggered more often than
++	 * during regular operation.
++	 */
++	if (unlikely(!lrng_state_fully_seeded())) {
++		if ((ptr & 31) && (ptr < LRNG_DATA_WORD_MASK))
++			return;
++	} else if (ptr < LRNG_DATA_WORD_MASK) {
++		return;
++	}
++
++	if (lrng_raw_array_entropy_store(*array)) {
++		u32 i;
++
++		/*
++		 * If we fed even a part of the array to external analysis, we
++		 * mark that the entire array and the per-CPU pool to have no
++		 * entropy. This is due to the non-IID property of the data as
++		 * we do not fully know whether the existing dependencies
++		 * diminish the entropy beyond to what we expect it has.
++		 */
++		atomic_set(this_cpu_ptr(&lrng_irq_array_irqs), 0);
++
++		for (i = 1; i < LRNG_DATA_ARRAY_SIZE; i++)
++			lrng_raw_array_entropy_store(*(array + i));
++	} else {
++		lrng_irq_array_compress();
++		/* Ping pool handler about received entropy */
++		if (lrng_sp80090b_startup_complete_es(lrng_int_es_irq))
++			lrng_es_add_entropy();
++	}
++}
++
++/*
++ * Concatenate full 32 bit word at the end of time array even when current
++ * ptr is not aligned to sizeof(data).
++ */
++static void _lrng_irq_array_add_u32(u32 data)
++{
++	/* Increment pointer by number of slots taken for input value */
++	u32 pre_ptr, mask, ptr = this_cpu_add_return(lrng_irq_array_ptr,
++						     LRNG_DATA_SLOTS_PER_UINT);
++	unsigned int pre_array;
++
++	/*
++	 * This function injects a unit into the array - guarantee that
++	 * array unit size is equal to data type of input data.
++	 */
++	BUILD_BUG_ON(LRNG_DATA_ARRAY_MEMBER_BITS != (sizeof(data) << 3));
++
++	/*
++	 * The following logic requires at least two units holding
++	 * the data as otherwise the pointer would immediately wrap when
++	 * injection an u32 word.
++	 */
++	BUILD_BUG_ON(LRNG_DATA_NUM_VALUES <= LRNG_DATA_SLOTS_PER_UINT);
++
++	lrng_data_split_u32(&ptr, &pre_ptr, &mask);
++
++	/* MSB of data go into previous unit */
++	pre_array = lrng_data_idx2array(pre_ptr);
++	/* zeroization of slot to ensure the following OR adds the data */
++	this_cpu_and(lrng_irq_array[pre_array], ~(0xffffffff & ~mask));
++	this_cpu_or(lrng_irq_array[pre_array], data & ~mask);
++
++	/* Invoke compression as we just filled data array completely */
++	if (unlikely(pre_ptr > ptr))
++		lrng_irq_array_to_hash(LRNG_DATA_WORD_MASK);
++
++	/* LSB of data go into current unit */
++	this_cpu_write(lrng_irq_array[lrng_data_idx2array(ptr)],
++		       data & mask);
++
++	if (likely(pre_ptr <= ptr))
++		lrng_irq_array_to_hash(ptr);
++}
++
++/* Concatenate a 32-bit word at the end of the per-CPU array */
++void lrng_irq_array_add_u32(u32 data)
++{
++	/*
++	 * Disregard entropy-less data without continuous compression to
++	 * avoid it overwriting data with entropy when array ptr wraps.
++	 */
++	if (lrng_irq_continuous_compression)
++		_lrng_irq_array_add_u32(data);
++}
++
++/* Concatenate data of max LRNG_DATA_SLOTSIZE_MASK at the end of time array */
++static void lrng_irq_array_add_slot(u32 data)
++{
++	/* Get slot */
++	u32 ptr = this_cpu_inc_return(lrng_irq_array_ptr) &
++							LRNG_DATA_WORD_MASK;
++	unsigned int array = lrng_data_idx2array(ptr);
++	unsigned int slot = lrng_data_idx2slot(ptr);
++
++	BUILD_BUG_ON(LRNG_DATA_ARRAY_MEMBER_BITS % LRNG_DATA_SLOTSIZE_BITS);
++	/* Ensure consistency of values */
++	BUILD_BUG_ON(LRNG_DATA_ARRAY_MEMBER_BITS !=
++		     sizeof(lrng_irq_array[0]) << 3);
++
++	/* zeroization of slot to ensure the following OR adds the data */
++	this_cpu_and(lrng_irq_array[array],
++		     ~(lrng_data_slot_val(0xffffffff & LRNG_DATA_SLOTSIZE_MASK,
++					  slot)));
++	/* Store data into slot */
++	this_cpu_or(lrng_irq_array[array], lrng_data_slot_val(data, slot));
++
++	lrng_irq_array_to_hash(ptr);
++}
++
++static void
++lrng_time_process_common(u32 time, void(*add_time)(u32 data))
++{
++	enum lrng_health_res health_test;
++
++	if (lrng_raw_hires_entropy_store(time))
++		return;
++
++	health_test = lrng_health_test(time, lrng_int_es_irq);
++	if (health_test > lrng_health_fail_use)
++		return;
++
++	if (health_test == lrng_health_pass)
++		atomic_inc_return(this_cpu_ptr(&lrng_irq_array_irqs));
++
++	add_time(time);
++}
++
++/*
++ * Batching up of entropy in per-CPU array before injecting into entropy pool.
++ */
++static void lrng_time_process(void)
++{
++	u32 now_time = random_get_entropy();
++
++	if (unlikely(!lrng_gcd_tested())) {
++		/* When GCD is unknown, we process the full time stamp */
++		lrng_time_process_common(now_time, _lrng_irq_array_add_u32);
++		lrng_gcd_add_value(now_time);
++	} else {
++		/* GCD is known and applied */
++		lrng_time_process_common((now_time / lrng_gcd_get()) &
++					 LRNG_DATA_SLOTSIZE_MASK,
++					 lrng_irq_array_add_slot);
++	}
++
++	lrng_perf_time(now_time);
++}
++
++/* Hot code path - Callback for interrupt handler */
++void add_interrupt_randomness(int irq)
++{
++	if (lrng_highres_timer()) {
++		lrng_time_process();
++	} else {
++		struct pt_regs *regs = get_irq_regs();
++		static atomic_t reg_idx = ATOMIC_INIT(0);
++		u64 ip;
++		u32 tmp;
++
++		if (regs) {
++			u32 *ptr = (u32 *)regs;
++			int reg_ptr = atomic_add_return_relaxed(1, &reg_idx);
++			size_t n = (sizeof(struct pt_regs) / sizeof(u32));
++
++			ip = instruction_pointer(regs);
++			tmp = *(ptr + (reg_ptr % n));
++			tmp = lrng_raw_regs_entropy_store(tmp) ? 0 : tmp;
++			_lrng_irq_array_add_u32(tmp);
++		} else {
++			ip = _RET_IP_;
++		}
++
++		lrng_time_process();
++
++		/*
++		 * The XOR operation combining the different values is not
++		 * considered to destroy entropy since the entirety of all
++		 * processed values delivers the entropy (and not each
++		 * value separately of the other values).
++		 */
++		tmp = lrng_raw_jiffies_entropy_store(jiffies) ? 0 : jiffies;
++		tmp ^= lrng_raw_irq_entropy_store(irq) ? 0 : irq;
++		tmp ^= lrng_raw_retip_entropy_store(ip) ? 0 : ip;
++		tmp ^= ip >> 32;
++		_lrng_irq_array_add_u32(tmp);
++	}
++}
++EXPORT_SYMBOL(add_interrupt_randomness);
++
++static void lrng_irq_es_state(unsigned char *buf, size_t buflen)
++{
++	const struct lrng_drng *lrng_drng_init = lrng_drng_init_instance();
++
++	/* Assume the lrng_drng_init lock is taken by caller */
++	snprintf(buf, buflen,
++		 " Hash for operating entropy pool: %s\n"
++		 " Available entropy: %u\n"
++		 " per-CPU interrupt collection size: %u\n"
++		 " Standards compliance: %s\n"
++		 " High-resolution timer: %s\n"
++		 " Continuous compression: %s\n"
++		 " Health test passed: %s\n",
++		 lrng_drng_init->hash_cb->hash_name(),
++		 lrng_irq_avail_entropy(0),
++		 LRNG_DATA_NUM_VALUES,
++		 lrng_sp80090b_compliant(lrng_int_es_irq) ? "SP800-90B " : "",
++		 lrng_highres_timer() ? "true" : "false",
++		 lrng_irq_continuous_compression ? "true" : "false",
++		 lrng_sp80090b_startup_complete_es(lrng_int_es_irq) ? "true" :
++								      "false");
++}
++
++struct lrng_es_cb lrng_es_irq = {
++	.name			= "IRQ",
++	.get_ent		= lrng_irq_pool_hash,
++	.curr_entropy		= lrng_irq_avail_entropy,
++	.max_entropy		= lrng_irq_avail_pool_size,
++	.state			= lrng_irq_es_state,
++	.reset			= lrng_irq_reset,
++	.switch_hash		= lrng_irq_switch_hash,
++};
+From 3f214277bf0fc706f883719b5f56a25955487e9c Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Sun, 15 May 2022 16:39:02 +0200
+Subject: [PATCH 12/25] scheduler - add entropy sampling hook
+
+The scheduler can be used as a source of entropy. This requires the
+presence of a hook that invokes the entropy source implementation.
+
+When the scheduler-based entropy source is not compiled, the hook is
+folded into a noop which does not affect the scheduler in any way.
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+---
+ kernel/sched/core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -7,6 +7,7 @@
+  *  Copyright (C) 1991-2002  Linus Torvalds
+  *  Copyright (C) 1998-2024  Ingo Molnar, Red Hat
+  */
++#include <linux/lrng.h>
+ #include <linux/highmem.h>
+ #include <linux/hrtimer_api.h>
+ #include <linux/ktime_api.h>
+@@ -3515,6 +3516,8 @@ ttwu_stat(struct task_struct *p, int cpu
+ {
+ 	struct rq *rq;
+ 
++	add_sched_randomness(p, cpu);
++
+ 	if (!schedstat_enabled())
+ 		return;
+ 
+From c83a2b55d00ccf38e9034664245a286ce5792be7 Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Wed, 22 Feb 2023 07:05:59 +0100
+Subject: [PATCH 13/25] LRNG - add scheduler-based entropy source
+
+The scheduler-based entropy source (ES) consumes the events triggered by
+the kernel invoked with the add_sched_randomness. Its main goal is:
+
+- to be extremely fast in the scheduler context - This is guaranteed by
+  only concatenating the least significant bits of a time stamp into
+  CPU-local entropy pools. Thus, the operation is quasi-lockless. Also,
+  the concatenation is a very trivial operation. Finally, by discarding
+  the high-order bits, attacker-observable timing values are discarded.
+
+- to use only cryptographic primitives for compression.
+
+The scheduler entropy pool collects noise data from context-switch
+timing. Any data received by the LRNG from the interrupt noise sources
+is inserted into a per-CPU entropy pool using a concatenation operation.
+The following processing concept is applied
+
+ (a) When an interrupt occurs, the 8 least significant bits of the
+ high-resolution time stamp divided by the greatest common divisor (GCD)
+ is mixed into the per-CPU entropy pool. This time stamp is credited with
+ heuristically implied entropy.
+
+ (b) Only in process context when a reseed of the DRNG is requested,
+ the compression of the entropy pool data is performed using a hash.
+ When the entropy pool is full (i.e. sufficient scheduling event data
+ is received and yet no compression is performed), the oldest entropy
+ pool entries are overwritten with the current entry. Thus, the entropy
+ pool acts as a ring buffer.
+
+To speed up the scheduling operation code of the LRNG, the time stamp
+collected for an interrupt event is divided by the greatest common
+divisor to eliminate fixed low bits and then truncated to the 8 least
+significant bits. 1024 truncated time stamps are concatenated and then
+jointly inserted into the per-CPU entropy pool. During boot time,
+until the fully seeded stage is reached, each time stamp with its
+32 least significant bits is are concatenated. When 1024/32 = 32 such
+events are received, they are injected into the per-CPU entropy pool.
+
+Considering the possibility that IRQ events cause at the same time
+scheduling events (e.g. the IRQ tasklet is executed), only one of those
+two entropy sources can ever be configured to deliver entropy. The
+respective other ES may deliver data, but never increases the entropy
+estimator of the LRNG.
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+---
+ drivers/char/lrng/Kconfig         | 122 +++----
+ drivers/char/lrng/Makefile        |   1 +
+ drivers/char/lrng/lrng_es_sched.c | 566 ++++++++++++++++++++++++++++++
+ drivers/char/lrng/lrng_health.h   |  42 +++
+ drivers/char/lrng/lrng_testing.h  |  85 +++++
+ 5 files changed, 755 insertions(+), 61 deletions(-)
+ create mode 100644 drivers/char/lrng/lrng_es_sched.c
+ create mode 100644 drivers/char/lrng/lrng_health.h
+ create mode 100644 drivers/char/lrng/lrng_testing.h
+
+--- a/drivers/char/lrng/Kconfig
++++ b/drivers/char/lrng/Kconfig
+@@ -141,9 +141,9 @@ comment "Common Timer-based Entropy Sour
+ config LRNG_IRQ_DFLT_TIMER_ES
+ 	bool
+ 
+-# config LRNG_SCHED_DFLT_TIMER_ES
+-# 	bool
+-#
++config LRNG_SCHED_DFLT_TIMER_ES
++	bool
++
+ config LRNG_TIMER_COMMON
+ 	bool
+ 
+@@ -164,12 +164,12 @@ choice
+ 	  The interrupt entropy source is selected as a timer-based
+ 	  entropy source to provide entropy.
+ 
+-# 	config LRNG_SCHED_DFLT_TIMER_ES
+-# 	bool "Scheduler Entropy Source"
+-# 	depends on LRNG_SCHED
+-# 	help
+-# 	  The scheduler entropy source is selected as timer-based
+-# 	  entropy source to provide entropy.
++	config LRNG_SCHED_DFLT_TIMER_ES
++	bool "Scheduler Entropy Source"
++	depends on LRNG_SCHED
++	help
++	  The scheduler entropy source is selected as timer-based
++	  entropy source to provide entropy.
+ endchoice
+ 
+ choice
+@@ -534,58 +534,58 @@ config LRNG_IRQ_ENTROPY_RATE
+ # 	  Note, this option is overwritten when the option
+ # 	  CONFIG_RANDOM_TRUST_CPU is set.
+ #
+-# comment "Scheduler Entropy Source"
+-#
+-# config LRNG_SCHED
+-# 	bool "Enable Scheduer Entropy Source as LRNG Seed Source"
+-# 	select LRNG_TIMER_COMMON
+-# 	help
+-# 	  The LRNG models an entropy source based on the timing of the
+-# 	  occurrence of scheduler-triggered context switches. Enable
+-# 	  this option to enable this scheduler entropy source.
+-#
+-# 	  The scheduler entropy source is triggered every time a
+-# 	  context switch is triggered thus causes the scheduler to
+-# 	  execute slightly longer. Disabling the scheduler entropy
+-# 	  source implies that the performance penalty on the scheduler
+-# 	  added by the LRNG is eliminated. Yet, this entropy source is
+-# 	  considered to be an internal entropy source of the LRNG.
+-# 	  Thus, only disable it if you ensured that other entropy
+-# 	  sources are available that supply the LRNG with entropy.
+-#
+-# 	  If you disable the scheduler entropy source, you MUST
+-# 	  ensure one or more entropy sources collectively have the
+-# 	  capability to deliver sufficient entropy with one invocation
+-# 	  at a rate compliant to the security strength of the DRNG
+-# 	  (usually 256 bits of entropy). In addition, if those
+-# 	  entropy sources do not deliver sufficient entropy during
+-# 	  first request, the reseed must be triggered from user
+-# 	  space or kernel space when sufficient entropy is considered
+-# 	  to be present.
+-#
+-# 	  If unsure, say Y.
+-#
+-# config LRNG_SCHED_ENTROPY_RATE
+-# 	int "Scheduler Entropy Source Entropy Rate"
+-# 	depends on LRNG_SCHED
+-# 	range 256 4294967295 if LRNG_SCHED_DFLT_TIMER_ES
+-# 	range 4294967295 4294967295 if !LRNG_SCHED_DFLT_TIMER_ES
+-# 	default 256 if LRNG_SCHED_DFLT_TIMER_ES
+-# 	default 4294967295 if !LRNG_SCHED_DFLT_TIMER_ES
+-# 	help
+-# 	  The LRNG will collect the configured number of context switches
+-# 	  triggered by the scheduler to obtain 256 bits of entropy. This
+-# 	  value can be set to any between 256 and 4294967295. The LRNG
+-# 	  guarantees that this value is not lower than 256. This lower
+-# 	  limit implies that one interrupt event is credited with one bit
+-# 	  of entropy. This value is subject to the increase by the
+-# 	  oversampling factor, if no high-resolution timer is found.
+-#
+-# 	  In order to effectively disable the scheduler entropy source,
+-# 	  the option has to be set to 4294967295. In this case, the
+-# 	  scheduler entropy source will still deliver data but without
+-# 	  being credited with entropy.
+-#
++comment "Scheduler Entropy Source"
++
++config LRNG_SCHED
++	bool "Enable Scheduer Entropy Source as LRNG Seed Source"
++	select LRNG_TIMER_COMMON
++	help
++	  The LRNG models an entropy source based on the timing of the
++	  occurrence of scheduler-triggered context switches. Enable
++	  this option to enable this scheduler entropy source.
++
++	  The scheduler entropy source is triggered every time a
++	  context switch is triggered thus causes the scheduler to
++	  execute slightly longer. Disabling the scheduler entropy
++	  source implies that the performance penalty on the scheduler
++	  added by the LRNG is eliminated. Yet, this entropy source is
++	  considered to be an internal entropy source of the LRNG.
++	  Thus, only disable it if you ensured that other entropy
++	  sources are available that supply the LRNG with entropy.
++
++	  If you disable the scheduler entropy source, you MUST
++	  ensure one or more entropy sources collectively have the
++	  capability to deliver sufficient entropy with one invocation
++	  at a rate compliant to the security strength of the DRNG
++	  (usually 256 bits of entropy). In addition, if those
++	  entropy sources do not deliver sufficient entropy during
++	  first request, the reseed must be triggered from user
++	  space or kernel space when sufficient entropy is considered
++	  to be present.
++
++	  If unsure, say Y.
++
++config LRNG_SCHED_ENTROPY_RATE
++	int "Scheduler Entropy Source Entropy Rate"
++	depends on LRNG_SCHED
++	range 256 4294967295 if LRNG_SCHED_DFLT_TIMER_ES
++	range 4294967295 4294967295 if !LRNG_SCHED_DFLT_TIMER_ES
++	default 256 if LRNG_SCHED_DFLT_TIMER_ES
++	default 4294967295 if !LRNG_SCHED_DFLT_TIMER_ES
++	help
++	  The LRNG will collect the configured number of context switches
++	  triggered by the scheduler to obtain 256 bits of entropy. This
++	  value can be set to any between 256 and 4294967295. The LRNG
++	  guarantees that this value is not lower than 256. This lower
++	  limit implies that one interrupt event is credited with one bit
++	  of entropy. This value is subject to the increase by the
++	  oversampling factor, if no high-resolution timer is found.
++
++	  In order to effectively disable the scheduler entropy source,
++	  the option has to be set to 4294967295. In this case, the
++	  scheduler entropy source will still deliver data but without
++	  being credited with entropy.
++
+ # comment "Kernel RNG Entropy Source"
+ #
+ # config LRNG_KERNEL_RNG
+--- a/drivers/char/lrng/Makefile
++++ b/drivers/char/lrng/Makefile
+@@ -20,3 +20,4 @@ obj-$(CONFIG_LRNG_DRNG_ATOMIC)		+= lrng_
+ 
+ obj-$(CONFIG_LRNG_TIMER_COMMON)		+= lrng_es_timer_common.o
+ obj-$(CONFIG_LRNG_IRQ)			+= lrng_es_irq.o
++obj-$(CONFIG_LRNG_SCHED)		+= lrng_es_sched.o
+--- /dev/null
++++ b/drivers/char/lrng/lrng_es_sched.c
+@@ -0,0 +1,566 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * LRNG Slow Entropy Source: Scheduler-based data collection
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <asm/irq_regs.h>
++#include <asm/ptrace.h>
++#include <linux/lrng.h>
++#include <crypto/hash.h>
++#include <linux/module.h>
++#include <linux/random.h>
++
++#include "lrng_es_aux.h"
++#include "lrng_es_sched.h"
++#include "lrng_es_timer_common.h"
++#include "lrng_health.h"
++#include "lrng_numa.h"
++#include "lrng_testing.h"
++
++/*
++ * Number of scheduler-based context switches to be recorded to assume that
++ * DRNG security strength bits of entropy are received.
++ * Note: a value below the DRNG security strength should not be defined as this
++ *	 may imply the DRNG can never be fully seeded in case other noise
++ *	 sources are unavailable.
++ */
++#define LRNG_SCHED_ENTROPY_BITS	\
++	LRNG_UINT32_C(CONFIG_LRNG_SCHED_ENTROPY_RATE)
++
++/* Number of events required for LRNG_DRNG_SECURITY_STRENGTH_BITS entropy */
++static u32 lrng_sched_entropy_bits = LRNG_SCHED_ENTROPY_BITS;
++
++static u32 sched_entropy __read_mostly = LRNG_SCHED_ENTROPY_BITS;
++#ifdef CONFIG_LRNG_RUNTIME_ES_CONFIG
++module_param(sched_entropy, uint, 0444);
++MODULE_PARM_DESC(sched_entropy,
++		 "How many scheduler-based context switches must be collected for obtaining 256 bits of entropy\n");
++#endif
++
++/* Per-CPU array holding concatenated entropy events */
++static DEFINE_PER_CPU(u32 [LRNG_DATA_ARRAY_SIZE], lrng_sched_array)
++						__aligned(LRNG_KCAPI_ALIGN);
++static DEFINE_PER_CPU(u32, lrng_sched_array_ptr) = 0;
++static DEFINE_PER_CPU(atomic_t, lrng_sched_array_events) = ATOMIC_INIT(0);
++
++/*
++ * Per-CPU entropy pool with compressed entropy event
++ *
++ * The per-CPU entropy pool is defined as the hash state. New data is simply
++ * inserted into the entropy pool by performing a hash update operation.
++ * To read the entropy pool, a hash final must be invoked. However, before
++ * the entropy pool is released again after a hash final, the hash init must
++ * be performed.
++ */
++static DEFINE_PER_CPU(u8 [LRNG_POOL_SIZE], lrng_sched_pool)
++						__aligned(LRNG_KCAPI_ALIGN);
++/*
++ * Lock to allow other CPUs to read the pool - as this is only done during
++ * reseed which is infrequent, this lock is hardly contended.
++ */
++static DEFINE_PER_CPU(spinlock_t, lrng_sched_lock);
++static DEFINE_PER_CPU(bool, lrng_sched_lock_init) = false;
++
++static bool lrng_sched_pool_online(int cpu)
++{
++	return per_cpu(lrng_sched_lock_init, cpu);
++}
++
++static void __init lrng_sched_check_compression_state(void)
++{
++	/* One pool should hold sufficient entropy for disabled compression */
++	u32 max_ent = min_t(u32, lrng_get_digestsize(),
++			    lrng_data_to_entropy(LRNG_DATA_NUM_VALUES,
++						 lrng_sched_entropy_bits));
++	if (max_ent < lrng_security_strength()) {
++		pr_devel("Scheduler entropy source will never provide %u bits of entropy required for fully seeding the DRNG all by itself\n",
++			lrng_security_strength());
++	}
++}
++
++void __init lrng_sched_es_init(bool highres_timer)
++{
++	/* Set a minimum number of scheduler events that must be collected */
++	sched_entropy = max_t(u32, LRNG_SCHED_ENTROPY_BITS, sched_entropy);
++
++	if (highres_timer) {
++		lrng_sched_entropy_bits = sched_entropy;
++	} else {
++		u32 new_entropy = sched_entropy * LRNG_ES_OVERSAMPLING_FACTOR;
++
++		lrng_sched_entropy_bits = (sched_entropy < new_entropy) ?
++					  new_entropy : sched_entropy;
++		pr_warn("operating without high-resolution timer and applying oversampling factor %u\n",
++			LRNG_ES_OVERSAMPLING_FACTOR);
++	}
++
++	lrng_sched_check_compression_state();
++}
++
++static u32 lrng_sched_avail_pool_size(void)
++{
++	u32 max_pool = lrng_get_digestsize(),
++	    max_size = min_t(u32, max_pool, LRNG_DATA_NUM_VALUES);
++	int cpu;
++
++	for_each_online_cpu(cpu)
++		max_size += max_pool;
++
++	return max_size;
++}
++
++/* Return entropy of unused scheduler events present in all per-CPU pools. */
++static u32 lrng_sched_avail_entropy(u32 __unused)
++{
++	u32 digestsize_events, events = 0;
++	int cpu;
++
++	/* Only deliver entropy when SP800-90B self test is completed */
++	if (!lrng_sp80090b_startup_complete_es(lrng_int_es_sched))
++		return 0;
++
++	/* Obtain the cap of maximum numbers of scheduler events we count */
++	digestsize_events = lrng_entropy_to_data(lrng_get_digestsize(),
++						 lrng_sched_entropy_bits);
++	/* Cap to max. number of scheduler events the array can hold */
++	digestsize_events = min_t(u32, digestsize_events, LRNG_DATA_NUM_VALUES);
++
++	for_each_online_cpu(cpu) {
++		events += min_t(u32, digestsize_events,
++			atomic_read_u32(per_cpu_ptr(&lrng_sched_array_events,
++					cpu)));
++	}
++
++	/* Consider oversampling rate */
++	return lrng_reduce_by_osr(
++			lrng_data_to_entropy(events, lrng_sched_entropy_bits));
++}
++
++/*
++ * Reset all per-CPU pools - reset entropy estimator but leave the pool data
++ * that may or may not have entropy unchanged.
++ */
++static void lrng_sched_reset(void)
++{
++	int cpu;
++
++	/* Trigger GCD calculation anew. */
++	lrng_gcd_set(0);
++
++	for_each_online_cpu(cpu)
++		atomic_set(per_cpu_ptr(&lrng_sched_array_events, cpu), 0);
++}
++
++/*
++ * Trigger a switch of the hash implementation for the per-CPU pool.
++ *
++ * For each per-CPU pool, obtain the message digest with the old hash
++ * implementation, initialize the per-CPU pool again with the new hash
++ * implementation and inject the message digest into the new state.
++ *
++ * Assumption: the caller must guarantee that the new_cb is available during the
++ * entire operation (e.g. it must hold the lock against pointer updating).
++ */
++static int
++lrng_sched_switch_hash(struct lrng_drng *drng, int node,
++		       const struct lrng_hash_cb *new_cb, void *new_hash,
++		       const struct lrng_hash_cb *old_cb)
++{
++	u8 digest[LRNG_MAX_DIGESTSIZE];
++	u32 digestsize_events, found_events;
++	int ret = 0, cpu;
++
++	if (!IS_ENABLED(CONFIG_LRNG_SWITCH))
++		return -EOPNOTSUPP;
++
++	for_each_online_cpu(cpu) {
++		struct shash_desc *pcpu_shash;
++
++		/*
++		 * Only switch the per-CPU pools for the current node because
++		 * the hash_cb only applies NUMA-node-wide.
++		 */
++		if (cpu_to_node(cpu) != node || !lrng_sched_pool_online(cpu))
++			continue;
++
++		pcpu_shash = (struct shash_desc *)per_cpu_ptr(lrng_sched_pool,
++							      cpu);
++
++		digestsize_events = old_cb->hash_digestsize(pcpu_shash);
++		digestsize_events = lrng_entropy_to_data(digestsize_events << 3,
++						       lrng_sched_entropy_bits);
++
++		if (pcpu_shash->tfm == new_hash)
++			continue;
++
++		/* Get the per-CPU pool hash with old digest ... */
++		ret = old_cb->hash_final(pcpu_shash, digest) ?:
++		      /* ... re-initialize the hash with the new digest ... */
++		      new_cb->hash_init(pcpu_shash, new_hash) ?:
++		      /*
++		       * ... feed the old hash into the new state. We may feed
++		       * uninitialized memory into the new state, but this is
++		       * considered no issue and even good as we have some more
++		       * uncertainty here.
++		       */
++		      new_cb->hash_update(pcpu_shash, digest, sizeof(digest));
++		if (ret)
++			goto out;
++
++		/*
++		 * In case the new digest is larger than the old one, cap
++		 * the available entropy to the old message digest used to
++		 * process the existing data.
++		 */
++		found_events = atomic_xchg_relaxed(
++				per_cpu_ptr(&lrng_sched_array_events, cpu), 0);
++		found_events = min_t(u32, found_events, digestsize_events);
++		atomic_add_return_relaxed(found_events,
++				per_cpu_ptr(&lrng_sched_array_events, cpu));
++
++		pr_debug("Re-initialize per-CPU scheduler entropy pool for CPU %d on NUMA node %d with hash %s\n",
++			 cpu, node, new_cb->hash_name());
++	}
++
++out:
++	memzero_explicit(digest, sizeof(digest));
++	return ret;
++}
++
++static u32
++lrng_sched_pool_hash_one(const struct lrng_hash_cb *pcpu_hash_cb,
++			 void *pcpu_hash, int cpu, u8 *digest, u32 *digestsize)
++{
++	struct shash_desc *pcpu_shash =
++		(struct shash_desc *)per_cpu_ptr(lrng_sched_pool, cpu);
++	spinlock_t *lock = per_cpu_ptr(&lrng_sched_lock, cpu);
++	unsigned long flags;
++	u32 digestsize_events, found_events;
++
++	if (unlikely(!per_cpu(lrng_sched_lock_init, cpu))) {
++		if (pcpu_hash_cb->hash_init(pcpu_shash, pcpu_hash)) {
++			pr_warn("Initialization of hash failed\n");
++			return 0;
++		}
++		spin_lock_init(lock);
++		per_cpu(lrng_sched_lock_init, cpu) = true;
++		pr_debug("Initializing per-CPU scheduler entropy pool for CPU %d with hash %s\n",
++			 raw_smp_processor_id(), pcpu_hash_cb->hash_name());
++	}
++
++	/* Lock guarding against reading / writing to per-CPU pool */
++	spin_lock_irqsave(lock, flags);
++
++	*digestsize = pcpu_hash_cb->hash_digestsize(pcpu_hash);
++	digestsize_events = lrng_entropy_to_data(*digestsize << 3,
++						 lrng_sched_entropy_bits);
++
++	/* Obtain entropy statement like for the entropy pool */
++	found_events = atomic_xchg_relaxed(
++				per_cpu_ptr(&lrng_sched_array_events, cpu), 0);
++	/* Cap to maximum amount of data we can hold in hash */
++	found_events = min_t(u32, found_events, digestsize_events);
++
++	/* Cap to maximum amount of data we can hold in array */
++	found_events = min_t(u32, found_events, LRNG_DATA_NUM_VALUES);
++
++	/* Store all not-yet compressed data in data array into hash, ... */
++	if (pcpu_hash_cb->hash_update(pcpu_shash,
++				(u8 *)per_cpu_ptr(lrng_sched_array, cpu),
++				LRNG_DATA_ARRAY_SIZE * sizeof(u32)) ?:
++	    /* ... get the per-CPU pool digest, ... */
++	    pcpu_hash_cb->hash_final(pcpu_shash, digest) ?:
++	    /* ... re-initialize the hash, ... */
++	    pcpu_hash_cb->hash_init(pcpu_shash, pcpu_hash) ?:
++	    /* ... feed the old hash into the new state. */
++	    pcpu_hash_cb->hash_update(pcpu_shash, digest, *digestsize))
++		found_events = 0;
++
++	spin_unlock_irqrestore(lock, flags);
++	return found_events;
++}
++
++/*
++ * Hash all per-CPU arrays and return the digest to be used as seed data for
++ * seeding a DRNG. The caller must guarantee backtracking resistance.
++ * The function will only copy as much data as entropy is available into the
++ * caller-provided output buffer.
++ *
++ * This function handles the translation from the number of received scheduler
++ * events into an entropy statement. The conversion depends on
++ * LRNG_SCHED_ENTROPY_BITS which defines how many scheduler events must be
++ * received to obtain 256 bits of entropy. With this value, the function
++ * lrng_data_to_entropy converts a given data size (received scheduler events,
++ * requested amount of data, etc.) into an entropy statement.
++ * lrng_entropy_to_data does the reverse.
++ *
++ * @eb: entropy buffer to store entropy
++ * @requested_bits: Requested amount of entropy
++ * @fully_seeded: indicator whether LRNG is fully seeded
++ */
++static void lrng_sched_pool_hash(struct entropy_buf *eb, u32 requested_bits,
++				 bool fully_seeded)
++{
++	SHASH_DESC_ON_STACK(shash, NULL);
++	const struct lrng_hash_cb *hash_cb;
++	struct lrng_drng **lrng_drng = lrng_drng_instances();
++	struct lrng_drng *drng = lrng_drng_init_instance();
++	u8 digest[LRNG_MAX_DIGESTSIZE];
++	unsigned long flags, flags2;
++	u32 found_events, collected_events = 0, collected_ent_bits,
++	    requested_events, returned_ent_bits;
++	int ret, cpu;
++	void *hash;
++
++	/* Only deliver entropy when SP800-90B self test is completed */
++	if (!lrng_sp80090b_startup_complete_es(lrng_int_es_sched)) {
++		eb->e_bits[lrng_int_es_sched] = 0;
++		return;
++	}
++
++	/* Lock guarding replacement of per-NUMA hash */
++	read_lock_irqsave(&drng->hash_lock, flags);
++
++	hash_cb = drng->hash_cb;
++	hash = drng->hash;
++
++	/* The hash state of filled with all per-CPU pool hashes. */
++	ret = hash_cb->hash_init(shash, hash);
++	if (ret)
++		goto err;
++
++	/* Cap to maximum entropy that can ever be generated with given hash */
++	lrng_cap_requested(hash_cb->hash_digestsize(hash) << 3, requested_bits);
++	requested_events = lrng_entropy_to_data(requested_bits +
++						lrng_compress_osr(),
++						lrng_sched_entropy_bits);
++
++	/*
++	 * Harvest entropy from each per-CPU hash state - even though we may
++	 * have collected sufficient entropy, we will hash all per-CPU pools.
++	 */
++	for_each_online_cpu(cpu) {
++		struct lrng_drng *pcpu_drng = drng;
++		u32 digestsize, unused_events = 0;
++		int node = cpu_to_node(cpu);
++
++		if (lrng_drng && lrng_drng[node])
++			pcpu_drng = lrng_drng[node];
++
++		if (pcpu_drng == drng) {
++			found_events = lrng_sched_pool_hash_one(hash_cb, hash,
++								cpu, digest,
++								&digestsize);
++		} else {
++			read_lock_irqsave(&pcpu_drng->hash_lock, flags2);
++			found_events =
++				lrng_sched_pool_hash_one(pcpu_drng->hash_cb,
++							 pcpu_drng->hash, cpu,
++							 digest, &digestsize);
++			read_unlock_irqrestore(&pcpu_drng->hash_lock, flags2);
++		}
++
++		/* Store all not-yet compressed data in data array into hash */
++		ret = hash_cb->hash_update(shash, digest, digestsize);
++		if (ret)
++			goto err;
++
++		collected_events += found_events;
++		if (collected_events > requested_events) {
++			unused_events = collected_events - requested_events;
++			atomic_add_return_relaxed(unused_events,
++				per_cpu_ptr(&lrng_sched_array_events, cpu));
++			collected_events = requested_events;
++		}
++		pr_debug("%u scheduler-based events used from entropy array of CPU %d, %u scheduler-based events remain unused\n",
++			 found_events - unused_events, cpu, unused_events);
++	}
++
++	ret = hash_cb->hash_final(shash, digest);
++	if (ret)
++		goto err;
++
++	collected_ent_bits = lrng_data_to_entropy(collected_events,
++						  lrng_sched_entropy_bits);
++	/* Apply oversampling: discount requested oversampling rate */
++	returned_ent_bits = lrng_reduce_by_osr(collected_ent_bits);
++
++	pr_debug("obtained %u bits by collecting %u bits of entropy from scheduler-based noise source\n",
++		 returned_ent_bits, collected_ent_bits);
++
++	/*
++	 * Truncate to available entropy as implicitly allowed by SP800-90B
++	 * section 3.1.5.1.1 table 1 which awards truncated hashes full
++	 * entropy.
++	 *
++	 * During boot time, we read requested_bits data with
++	 * returned_ent_bits entropy. In case our conservative entropy
++	 * estimate underestimates the available entropy we can transport as
++	 * much available entropy as possible.
++	 */
++	memcpy(eb->e[lrng_int_es_sched], digest,
++	       fully_seeded ? returned_ent_bits >> 3 : requested_bits >> 3);
++	eb->e_bits[lrng_int_es_sched] = returned_ent_bits;
++
++out:
++	hash_cb->hash_desc_zero(shash);
++	read_unlock_irqrestore(&drng->hash_lock, flags);
++	memzero_explicit(digest, sizeof(digest));
++	return;
++
++err:
++	eb->e_bits[lrng_int_es_sched] = 0;
++	goto out;
++}
++
++/*
++ * Concatenate full 32 bit word at the end of time array even when current
++ * ptr is not aligned to sizeof(data).
++ */
++static void lrng_sched_array_add_u32(u32 data)
++{
++	/* Increment pointer by number of slots taken for input value */
++	u32 pre_ptr, mask, ptr = this_cpu_add_return(lrng_sched_array_ptr,
++						     LRNG_DATA_SLOTS_PER_UINT);
++	unsigned int pre_array;
++
++	lrng_data_split_u32(&ptr, &pre_ptr, &mask);
++
++	/* MSB of data go into previous unit */
++	pre_array = lrng_data_idx2array(pre_ptr);
++	/* zeroization of slot to ensure the following OR adds the data */
++	this_cpu_and(lrng_sched_array[pre_array], ~(0xffffffff & ~mask));
++	this_cpu_or(lrng_sched_array[pre_array], data & ~mask);
++
++	/*
++	 * Continuous compression is not allowed for scheduler noise source,
++	 * so do not call lrng_sched_array_to_hash here.
++	 */
++
++	/* LSB of data go into current unit */
++	this_cpu_write(lrng_sched_array[lrng_data_idx2array(ptr)],
++		       data & mask);
++}
++
++/* Concatenate data of max LRNG_DATA_SLOTSIZE_MASK at the end of time array */
++static void lrng_sched_array_add_slot(u32 data)
++{
++	/* Get slot */
++	u32 ptr = this_cpu_inc_return(lrng_sched_array_ptr) &
++							LRNG_DATA_WORD_MASK;
++	unsigned int array = lrng_data_idx2array(ptr);
++	unsigned int slot = lrng_data_idx2slot(ptr);
++
++	/* zeroization of slot to ensure the following OR adds the data */
++	this_cpu_and(lrng_sched_array[array],
++		     ~(lrng_data_slot_val(0xffffffff & LRNG_DATA_SLOTSIZE_MASK,
++					  slot)));
++	/* Store data into slot */
++	this_cpu_or(lrng_sched_array[array], lrng_data_slot_val(data, slot));
++
++	/*
++	 * Continuous compression is not allowed for scheduler noise source,
++	 * so do not call lrng_sched_array_to_hash here.
++	 */
++}
++
++static void
++lrng_time_process_common(u32 time, void(*add_time)(u32 data))
++{
++	enum lrng_health_res health_test;
++
++	if (lrng_raw_sched_hires_entropy_store(time))
++		return;
++
++	health_test = lrng_health_test(time, lrng_int_es_sched);
++	if (health_test > lrng_health_fail_use)
++		return;
++
++	if (health_test == lrng_health_pass)
++		atomic_inc_return(this_cpu_ptr(&lrng_sched_array_events));
++
++	add_time(time);
++
++	/*
++	 * We cannot call lrng_es_add_entropy() as this would call a schedule
++	 * operation that is not permissible in scheduler context.
++	 * As the scheduler ES provides a high bandwidth of entropy, we assume
++	 * that other reseed triggers happen to pick up the scheduler ES
++	 * entropy in due time.
++	 */
++}
++
++/* Batching up of entropy in per-CPU array */
++static void lrng_sched_time_process(void)
++{
++	u32 now_time = random_get_entropy();
++
++	if (unlikely(!lrng_gcd_tested())) {
++		/* When GCD is unknown, we process the full time stamp */
++		lrng_time_process_common(now_time, lrng_sched_array_add_u32);
++		lrng_gcd_add_value(now_time);
++	} else {
++		/* GCD is known and applied */
++		lrng_time_process_common((now_time / lrng_gcd_get()) &
++					 LRNG_DATA_SLOTSIZE_MASK,
++					 lrng_sched_array_add_slot);
++	}
++
++	lrng_sched_perf_time(now_time);
++}
++
++void add_sched_randomness(const struct task_struct *p, int cpu)
++{
++	if (lrng_highres_timer()) {
++		lrng_sched_time_process();
++	} else {
++		u32 tmp = cpu;
++
++		tmp ^= lrng_raw_sched_pid_entropy_store(p->pid) ?
++							0 : (u32)p->pid;
++		tmp ^= lrng_raw_sched_starttime_entropy_store(p->start_time) ?
++							0 : (u32)p->start_time;
++		tmp ^= lrng_raw_sched_nvcsw_entropy_store(p->nvcsw) ?
++							0 : (u32)p->nvcsw;
++
++		lrng_sched_time_process();
++		lrng_sched_array_add_u32(tmp);
++	}
++}
++EXPORT_SYMBOL(add_sched_randomness);
++
++static void lrng_sched_es_state(unsigned char *buf, size_t buflen)
++{
++	const struct lrng_drng *lrng_drng_init = lrng_drng_init_instance();
++
++	/* Assume the lrng_drng_init lock is taken by caller */
++	snprintf(buf, buflen,
++		 " Hash for operating entropy pool: %s\n"
++		 " Available entropy: %u\n"
++		 " per-CPU scheduler event collection size: %u\n"
++		 " Standards compliance: %s\n"
++		 " High-resolution timer: %s\n"
++		 " Health test passed: %s\n",
++		 lrng_drng_init->hash_cb->hash_name(),
++		 lrng_sched_avail_entropy(0),
++		 LRNG_DATA_NUM_VALUES,
++		 lrng_sp80090b_compliant(lrng_int_es_sched) ? "SP800-90B " : "",
++		 lrng_highres_timer() ? "true" : "false",
++		 lrng_sp80090b_startup_complete_es(lrng_int_es_sched) ?
++								      "true" :
++								      "false");
++}
++
++struct lrng_es_cb lrng_es_sched = {
++	.name			= "Scheduler",
++	.get_ent		= lrng_sched_pool_hash,
++	.curr_entropy		= lrng_sched_avail_entropy,
++	.max_entropy		= lrng_sched_avail_pool_size,
++	.state			= lrng_sched_es_state,
++	.reset			= lrng_sched_reset,
++	.switch_hash		= lrng_sched_switch_hash,
++};
+--- /dev/null
++++ b/drivers/char/lrng/lrng_health.h
+@@ -0,0 +1,42 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause */
++/*
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#ifndef _LRNG_HEALTH_H
++#define _LRNG_HEALTH_H
++
++#include "lrng_es_mgr.h"
++
++enum lrng_health_res {
++	lrng_health_pass,		/* Health test passes on time stamp */
++	lrng_health_fail_use,		/* Time stamp unhealthy, but mix in */
++	lrng_health_fail_drop		/* Time stamp unhealthy, drop it */
++};
++
++#ifdef CONFIG_LRNG_HEALTH_TESTS
++bool lrng_sp80090b_startup_complete_es(enum lrng_internal_es es);
++bool lrng_sp80090b_compliant(enum lrng_internal_es es);
++
++enum lrng_health_res lrng_health_test(u32 now_time, enum lrng_internal_es es);
++void lrng_health_disable(void);
++#else	/* CONFIG_LRNG_HEALTH_TESTS */
++static inline bool lrng_sp80090b_startup_complete_es(enum lrng_internal_es es)
++{
++	return true;
++}
++
++static inline bool lrng_sp80090b_compliant(enum lrng_internal_es es)
++{
++	return false;
++}
++
++static inline enum lrng_health_res
++lrng_health_test(u32 now_time, enum lrng_internal_es es)
++{
++	return lrng_health_pass;
++}
++static inline void lrng_health_disable(void) { }
++#endif	/* CONFIG_LRNG_HEALTH_TESTS */
++
++#endif /* _LRNG_HEALTH_H */
+--- /dev/null
++++ b/drivers/char/lrng/lrng_testing.h
+@@ -0,0 +1,85 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause */
++/*
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#ifndef _LRNG_TESTING_H
++#define _LRNG_TESTING_H
++
++#ifdef CONFIG_LRNG_RAW_HIRES_ENTROPY
++bool lrng_raw_hires_entropy_store(u32 value);
++#else	/* CONFIG_LRNG_RAW_HIRES_ENTROPY */
++static inline bool lrng_raw_hires_entropy_store(u32 value) { return false; }
++#endif	/* CONFIG_LRNG_RAW_HIRES_ENTROPY */
++
++#ifdef CONFIG_LRNG_RAW_JIFFIES_ENTROPY
++bool lrng_raw_jiffies_entropy_store(u32 value);
++#else	/* CONFIG_LRNG_RAW_JIFFIES_ENTROPY */
++static inline bool lrng_raw_jiffies_entropy_store(u32 value) { return false; }
++#endif	/* CONFIG_LRNG_RAW_JIFFIES_ENTROPY */
++
++#ifdef CONFIG_LRNG_RAW_IRQ_ENTROPY
++bool lrng_raw_irq_entropy_store(u32 value);
++#else	/* CONFIG_LRNG_RAW_IRQ_ENTROPY */
++static inline bool lrng_raw_irq_entropy_store(u32 value) { return false; }
++#endif	/* CONFIG_LRNG_RAW_IRQ_ENTROPY */
++
++#ifdef CONFIG_LRNG_RAW_RETIP_ENTROPY
++bool lrng_raw_retip_entropy_store(u32 value);
++#else	/* CONFIG_LRNG_RAW_RETIP_ENTROPY */
++static inline bool lrng_raw_retip_entropy_store(u32 value) { return false; }
++#endif	/* CONFIG_LRNG_RAW_RETIP_ENTROPY */
++
++#ifdef CONFIG_LRNG_RAW_REGS_ENTROPY
++bool lrng_raw_regs_entropy_store(u32 value);
++#else	/* CONFIG_LRNG_RAW_REGS_ENTROPY */
++static inline bool lrng_raw_regs_entropy_store(u32 value) { return false; }
++#endif	/* CONFIG_LRNG_RAW_REGS_ENTROPY */
++
++#ifdef CONFIG_LRNG_RAW_ARRAY
++bool lrng_raw_array_entropy_store(u32 value);
++#else	/* CONFIG_LRNG_RAW_ARRAY */
++static inline bool lrng_raw_array_entropy_store(u32 value) { return false; }
++#endif	/* CONFIG_LRNG_RAW_ARRAY */
++
++#ifdef CONFIG_LRNG_IRQ_PERF
++bool lrng_perf_time(u32 start);
++#else /* CONFIG_LRNG_IRQ_PERF */
++static inline bool lrng_perf_time(u32 start) { return false; }
++#endif /*CONFIG_LRNG_IRQ_PERF */
++
++#ifdef CONFIG_LRNG_RAW_SCHED_HIRES_ENTROPY
++bool lrng_raw_sched_hires_entropy_store(u32 value);
++#else	/* CONFIG_LRNG_RAW_SCHED_HIRES_ENTROPY */
++static inline bool
++lrng_raw_sched_hires_entropy_store(u32 value) { return false; }
++#endif	/* CONFIG_LRNG_RAW_SCHED_HIRES_ENTROPY */
++
++#ifdef CONFIG_LRNG_RAW_SCHED_PID_ENTROPY
++bool lrng_raw_sched_pid_entropy_store(u32 value);
++#else	/* CONFIG_LRNG_RAW_SCHED_PID_ENTROPY */
++static inline bool
++lrng_raw_sched_pid_entropy_store(u32 value) { return false; }
++#endif	/* CONFIG_LRNG_RAW_SCHED_PID_ENTROPY */
++
++#ifdef CONFIG_LRNG_RAW_SCHED_START_TIME_ENTROPY
++bool lrng_raw_sched_starttime_entropy_store(u32 value);
++#else	/* CONFIG_LRNG_RAW_SCHED_START_TIME_ENTROPY */
++static inline bool
++lrng_raw_sched_starttime_entropy_store(u32 value) { return false; }
++#endif	/* CONFIG_LRNG_RAW_SCHED_START_TIME_ENTROPY */
++
++#ifdef CONFIG_LRNG_RAW_SCHED_NVCSW_ENTROPY
++bool lrng_raw_sched_nvcsw_entropy_store(u32 value);
++#else	/* CONFIG_LRNG_RAW_SCHED_NVCSW_ENTROPY */
++static inline bool
++lrng_raw_sched_nvcsw_entropy_store(u32 value) { return false; }
++#endif	/* CONFIG_LRNG_RAW_SCHED_NVCSW_ENTROPY */
++
++#ifdef CONFIG_LRNG_SCHED_PERF
++bool lrng_sched_perf_time(u32 start);
++#else /* CONFIG_LRNG_SCHED_PERF */
++static inline bool lrng_sched_perf_time(u32 start) { return false; }
++#endif /*CONFIG_LRNG_SCHED_PERF */
++
++#endif /* _LRNG_TESTING_H */
+From 77e3f8edebcba3cc3b60b654fa0ef12e73f4e378 Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Tue, 25 Apr 2023 23:13:30 +0200
+Subject: [PATCH 14/25] LRNG - add SP800-90B compliant health tests
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Implement health tests for LRNG's internal entropy sources as mandated
+by SP-800-90B. These internal entropy sources (scheduler and IRQ ES)
+both rest on high-resolution time stamps as their noise source. The patch
+contains the following health tests which are independently enabled and
+applied for the mentioned entropy sources.:
+
+- stuck test: The stuck test calculates the first, second and third
+  discrete derivative of the time stamp to be processed by the hash
+  for the per-CPU entropy pool. Only if all three values are non-zero,
+  the received time delta is considered to be non-stuck.
+
+- SP800-90B Repetition Count Test (RCT): The LRNG uses an enhanced
+  version of the RCT specified in SP800-90B section 4.4.1. Instead of
+  counting identical back-to-back values, the input to the RCT is the
+  counting of the stuck values during the processing of received
+  interrupt events. The RCT is applied with alpha=2^-30 compliant to
+  the recommendation of FIPS 140-2 IG 9.8. During the counting operation,
+  the LRNG always calculates the RCT cut-off value of C. If that value
+  exceeds the allowed cut-off value, the LRNG will trigger the health
+  test failure discussed below. An error is logged to the kernel log
+  that such RCT failure occurred. This test is only applied and
+  enforced in FIPS mode, i.e. when the kernel compiled with
+  CONFIG_CONFIG_FIPS is started with fips=1.
+
+- SP800-90B Adaptive Proportion Test (APT): The LRNG implements the
+  APT as defined in SP800-90B section 4.4.2. The applied significance
+  level again is alpha=2^-30 compliant to the recommendation of FIPS
+  140-2 IG 9.8.
+
+The aforementioned health tests are applied to the first 1,024 time stamps
+obtained from interrupt events. In case one error is identified for either
+the RCT, or the APT, the collected entropy is invalidated and the
+SP800-90B startup health test is restarted.
+
+As long as the SP800-90B startup health test is not completed, all LRNG
+random number output interfaces that may block will block and not generate
+any data. This implies that only those potentially blocking interfaces are
+defined to provide random numbers that are seeded with the interrupt noise
+source being SP800-90B compliant. All other output interfaces will not be
+affected by the SP800-90B startup test and thus are not considered
+SP800-90B compliant.
+
+At runtime, the SP800-90B APT and RCT are applied to each time stamp
+generated for a received interrupt. When either the APT and RCT indicates
+a noise source failure, the LRNG is reset to a state it has immediately
+after boot:
+
+- all entropy counters are set to zero
+
+- the SP800-90B startup tests are re-performed which implies that
+getrandom(2) would block again until new entropy was collected
+
+To summarize, the following rules apply:
+
+• SP800-90B compliant output interfaces
+
+  - /dev/random
+
+  - getrandom(2) system call
+
+  -  get_random_bytes kernel-internal interface when being triggered by
+     the callback registered with add_random_ready_callback
+
+• SP800-90B non-compliant output interfaces
+
+  - /dev/urandom
+
+  - get_random_bytes kernel-internal interface called directly
+
+  - randomize_page kernel-internal interface
+
+  - get_random_u32 and get_random_u64 kernel-internal interfaces
+
+  - get_random_u32_wait, get_random_u64_wait, get_random_int_wait, and
+    get_random_long_wait kernel-internal interfaces
+
+If either the RCT, or the APT health test fails irrespective whether
+during initialization or runtime, the following actions occur:
+
+  1. The entropy of the entire entropy pool is invalidated.
+
+  2. All DRNGs are reset which imply that they are treated as being
+     not seeded and require a reseed during next invocation.
+
+  3. The SP800-90B startup health test are initiated with all
+     implications of the startup tests. That implies that from that point
+     on, new events must be observed and its entropy must be inserted into
+     the entropy pool before random numbers are calculated from the
+     entropy pool.
+
+Further details on the SP800-90B compliance and the availability of all
+test tools required to perform all tests mandated by SP800-90B are
+provided at [1].
+
+The entire health testing code is compile-time configurable.
+
+The patch provides a CONFIG_BROKEN configuration of the APT / RCT cutoff
+values which have a high likelihood to trigger the health test failure.
+The BROKEN APT cutoff is set to the exact mean of the expected value if
+the time stamps are equally distributed (512 time stamps divided by 16
+possible values due to using the 4 LSB of the time stamp). The BROKEN
+RCT cutoff value is set to 1 which is likely to be triggered during
+regular operation.
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+---
+ drivers/char/lrng/Kconfig       | 140 +++++-----
+ drivers/char/lrng/Makefile      |   2 +
+ drivers/char/lrng/lrng_health.c | 447 ++++++++++++++++++++++++++++++++
+ 3 files changed, 519 insertions(+), 70 deletions(-)
+ create mode 100644 drivers/char/lrng/lrng_health.c
+
+--- a/drivers/char/lrng/Kconfig
++++ b/drivers/char/lrng/Kconfig
+@@ -229,80 +229,80 @@ config LRNG_COLLECTION_SIZE
+ 	default 4096 if LRNG_COLLECTION_SIZE_4096
+ 	default 8192 if LRNG_COLLECTION_SIZE_8192
+ 
+-# config LRNG_HEALTH_TESTS
+-# 	bool "Enable internal entropy source online health tests"
+-# 	depends on LRNG_TIMER_COMMON
+-# 	help
+-# 	  The online health tests applied to the interrupt entropy
+-# 	  source and to the scheduler entropy source to validate
+-# 	  the noise source at runtime for fatal errors. These tests
+-# 	  include SP800-90B compliant tests which are invoked if
+-# 	  the system is booted with fips=1. In case of fatal errors
+-# 	  during active SP800-90B tests, the issue is logged and
+-# 	  the noise data is discarded. These tests are required for
+-# 	  full compliance of the interrupt entropy source with
+-# 	  SP800-90B.
+-#
+-# 	  If both, the scheduler and the interrupt entropy sources,
+-# 	  are enabled, the health tests for both are applied
+-# 	  independent of each other.
+-#
+-# 	  If unsure, say Y.
+-#
+-# config LRNG_RCT_BROKEN
+-# 	bool "SP800-90B RCT with dangerous low cutoff value"
+-# 	depends on LRNG_HEALTH_TESTS
+-# 	depends on BROKEN
+-# 	default n
+-# 	help
+-# 	  This option enables a dangerously low SP800-90B repetitive
+-# 	  count test (RCT) cutoff value which makes it very likely
+-# 	  that the RCT is triggered to raise a self test failure.
+-#
+-# 	  This option is ONLY intended for developers wanting to
+-# 	  test the effectiveness of the SP800-90B RCT health test.
+-#
+-# 	  If unsure, say N.
+-#
+-# config LRNG_APT_BROKEN
+-# 	bool "SP800-90B APT with dangerous low cutoff value"
+-# 	depends on LRNG_HEALTH_TESTS
+-# 	depends on BROKEN
+-# 	default n
+-# 	help
+-# 	  This option enables a dangerously low SP800-90B adaptive
+-# 	  proportion test (APT) cutoff value which makes it very
+-# 	  likely that the APT is triggered to raise a self test
+-# 	  failure.
+-#
+-# 	  This option is ONLY intended for developers wanting to
+-# 	  test the effectiveness of the SP800-90B APT health test.
+-#
+-# 	  If unsure, say N.
+-#
++config LRNG_HEALTH_TESTS
++	bool "Enable internal entropy source online health tests"
++	depends on LRNG_TIMER_COMMON
++	help
++	  The online health tests applied to the interrupt entropy
++	  source and to the scheduler entropy source to validate
++	  the noise source at runtime for fatal errors. These tests
++	  include SP800-90B compliant tests which are invoked if
++	  the system is booted with fips=1. In case of fatal errors
++	  during active SP800-90B tests, the issue is logged and
++	  the noise data is discarded. These tests are required for
++	  full compliance of the interrupt entropy source with
++	  SP800-90B.
++
++	  If both, the scheduler and the interrupt entropy sources,
++	  are enabled, the health tests for both are applied
++	  independent of each other.
++
++	  If unsure, say Y.
++
++config LRNG_RCT_BROKEN
++	bool "SP800-90B RCT with dangerous low cutoff value"
++	depends on LRNG_HEALTH_TESTS
++	depends on BROKEN
++	default n
++	help
++	  This option enables a dangerously low SP800-90B repetitive
++	  count test (RCT) cutoff value which makes it very likely
++	  that the RCT is triggered to raise a self test failure.
++
++	  This option is ONLY intended for developers wanting to
++	  test the effectiveness of the SP800-90B RCT health test.
++
++	  If unsure, say N.
++
++config LRNG_APT_BROKEN
++	bool "SP800-90B APT with dangerous low cutoff value"
++	depends on LRNG_HEALTH_TESTS
++	depends on BROKEN
++	default n
++	help
++	  This option enables a dangerously low SP800-90B adaptive
++	  proportion test (APT) cutoff value which makes it very
++	  likely that the APT is triggered to raise a self test
++	  failure.
++
++	  This option is ONLY intended for developers wanting to
++	  test the effectiveness of the SP800-90B APT health test.
++
++	  If unsure, say N.
++
+ # Default taken from SP800-90B sec 4.4.1 - significance level 2^-30
+-# config LRNG_RCT_CUTOFF
+-# 	int
+-# 	default 31 if !LRNG_RCT_BROKEN
+-# 	default 1 if LRNG_RCT_BROKEN
+-#
++config LRNG_RCT_CUTOFF
++	int
++	default 31 if !LRNG_RCT_BROKEN
++	default 1 if LRNG_RCT_BROKEN
++
+ # Default taken from SP800-90B sec 4.4.1 - significance level 2^-80
+-# config LRNG_RCT_CUTOFF_PERMANENT
+-# 	int
+-# 	default 81 if !LRNG_RCT_BROKEN
+-# 	default 2 if LRNG_RCT_BROKEN
+-#
++config LRNG_RCT_CUTOFF_PERMANENT
++	int
++	default 81 if !LRNG_RCT_BROKEN
++	default 2 if LRNG_RCT_BROKEN
++
+ # Default taken from SP800-90B sec 4.4.2 - significance level 2^-30
+-# config LRNG_APT_CUTOFF
+-# 	int
+-# 	default 325 if !LRNG_APT_BROKEN
+-# 	default 32 if LRNG_APT_BROKEN
+-#
++config LRNG_APT_CUTOFF
++	int
++	default 325 if !LRNG_APT_BROKEN
++	default 32 if LRNG_APT_BROKEN
++
+ # Default taken from SP800-90B sec 4.4.2 - significance level 2^-80
+-# config LRNG_APT_CUTOFF_PERMANENT
+-# 	int
+-# 	default 371 if !LRNG_APT_BROKEN
+-# 	default 33 if LRNG_APT_BROKEN
++config LRNG_APT_CUTOFF_PERMANENT
++	int
++	default 371 if !LRNG_APT_BROKEN
++	default 33 if LRNG_APT_BROKEN
+ 
+ comment "Interrupt Entropy Source"
+ 
+--- a/drivers/char/lrng/Makefile
++++ b/drivers/char/lrng/Makefile
+@@ -21,3 +21,5 @@ obj-$(CONFIG_LRNG_DRNG_ATOMIC)		+= lrng_
+ obj-$(CONFIG_LRNG_TIMER_COMMON)		+= lrng_es_timer_common.o
+ obj-$(CONFIG_LRNG_IRQ)			+= lrng_es_irq.o
+ obj-$(CONFIG_LRNG_SCHED)		+= lrng_es_sched.o
++
++obj-$(CONFIG_LRNG_HEALTH_TESTS)		+= lrng_health.o
+--- /dev/null
++++ b/drivers/char/lrng/lrng_health.c
+@@ -0,0 +1,447 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * Entropy Source and DRNG Manager (LRNG) Health Testing
++ *
++ * Copyright (C) 2022 - 2023, Stephan Mueller <smueller@chronox.de>
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/fips.h>
++#include <linux/module.h>
++
++#include "lrng_definitions.h"
++#include "lrng_es_mgr.h"
++#include "lrng_health.h"
++
++/* Stuck Test */
++struct lrng_stuck_test {
++	u32 last_time;		/* Stuck test: time of previous IRQ */
++	u32 last_delta;		/* Stuck test: delta of previous IRQ */
++	u32 last_delta2;	/* Stuck test: 2. time derivation of prev IRQ */
++};
++
++/* Repetition Count Test */
++struct lrng_rct {
++	atomic_t rct_count;	/* Number of stuck values */
++};
++
++/* Adaptive Proportion Test */
++struct lrng_apt {
++	/* Data window size */
++#define LRNG_APT_WINDOW_SIZE	512
++	/* LSB of time stamp to process */
++#define LRNG_APT_LSB		16
++#define LRNG_APT_WORD_MASK	(LRNG_APT_LSB - 1)
++	atomic_t apt_count;		/* APT counter */
++	atomic_t apt_base;		/* APT base reference */
++
++	atomic_t apt_trigger;
++	bool apt_base_set;	/* Is APT base set? */
++};
++
++/* Health data collected for one entropy source */
++struct lrng_health_es_state {
++	struct lrng_rct rct;
++	struct lrng_apt apt;
++
++	/* SP800-90B startup health tests */
++#define LRNG_SP80090B_STARTUP_SAMPLES  1024
++#define LRNG_SP80090B_STARTUP_BLOCKS   ((LRNG_SP80090B_STARTUP_SAMPLES + \
++					 LRNG_APT_WINDOW_SIZE - 1) /    \
++					LRNG_APT_WINDOW_SIZE)
++	bool sp80090b_startup_done;
++	atomic_t sp80090b_startup_blocks;
++};
++
++#define LRNG_HEALTH_ES_INIT(x) \
++	x.rct.rct_count = ATOMIC_INIT(0), \
++	x.apt.apt_count = ATOMIC_INIT(0), \
++	x.apt.apt_base = ATOMIC_INIT(-1), \
++	x.apt.apt_trigger = ATOMIC_INIT(LRNG_APT_WINDOW_SIZE), \
++	x.apt.apt_base_set = false, \
++	x.sp80090b_startup_blocks = ATOMIC_INIT(LRNG_SP80090B_STARTUP_BLOCKS), \
++	x.sp80090b_startup_done = false,
++
++/* The health test code must operate lock-less */
++struct lrng_health {
++	bool health_test_enabled;
++	struct lrng_health_es_state es_state[lrng_int_es_last];
++};
++
++static struct lrng_health lrng_health = {
++	.health_test_enabled = true,
++
++#ifdef CONFIG_LRNG_IRQ
++	LRNG_HEALTH_ES_INIT(.es_state[lrng_int_es_irq])
++#endif
++#ifdef CONFIG_LRNG_SCHED
++	LRNG_HEALTH_ES_INIT(.es_state[lrng_int_es_sched])
++#endif
++};
++
++static DEFINE_PER_CPU(struct lrng_stuck_test[lrng_int_es_last],
++		      lrng_stuck_test_array);
++
++static bool lrng_sp80090b_health_requested(void)
++{
++	/* Health tests are only requested in FIPS mode */
++	return fips_enabled;
++}
++
++static bool lrng_sp80090b_health_enabled(void)
++{
++	struct lrng_health *health = &lrng_health;
++
++	return lrng_sp80090b_health_requested() && health->health_test_enabled;
++}
++
++/***************************************************************************
++ * SP800-90B Compliance
++ *
++ * If the Linux-RNG is booted into FIPS mode, the following interfaces
++ * provide an SP800-90B compliant noise source:
++ *
++ * * /dev/random
++ * * getrandom(2)
++ * * get_random_bytes_full
++ *
++ * All other interfaces, including /dev/urandom or get_random_bytes without
++ * the add_random_ready_callback cannot claim to use an SP800-90B compliant
++ * noise source.
++ ***************************************************************************/
++
++/*
++ * Perform SP800-90B startup testing
++ */
++static void lrng_sp80090b_startup(struct lrng_health *health,
++				  enum lrng_internal_es es)
++{
++	struct lrng_health_es_state *es_state = &health->es_state[es];
++
++	if (!es_state->sp80090b_startup_done &&
++	    atomic_dec_and_test(&es_state->sp80090b_startup_blocks)) {
++		es_state->sp80090b_startup_done = true;
++		pr_info("SP800-90B startup health tests for internal entropy source %u completed\n",
++			es);
++		lrng_drng_force_reseed();
++
++		/*
++		 * We cannot call lrng_es_add_entropy() as this may cause a
++		 * schedule operation while in scheduler context for the
++		 * scheduler ES.
++		 */
++	}
++}
++
++/*
++ * Handle failure of SP800-90B startup testing
++ */
++static void lrng_sp80090b_startup_failure(struct lrng_health *health,
++					  enum lrng_internal_es es)
++{
++	struct lrng_health_es_state *es_state = &health->es_state[es];
++
++
++	/* Reset of LRNG and its entropy - NOTE: we are in atomic context */
++	lrng_reset();
++
++	/*
++	 * Reset the SP800-90B startup test.
++	 *
++	 * NOTE SP800-90B section 4.3 bullet 4 does not specify what
++	 * exactly is to be done in case of failure! Thus, we do what
++	 * makes sense, i.e. restarting the health test and thus gating
++	 * the output function of /dev/random and getrandom(2).
++	 */
++	atomic_set(&es_state->sp80090b_startup_blocks,
++		   LRNG_SP80090B_STARTUP_BLOCKS);
++}
++
++/*
++ * Handle failure of SP800-90B runtime testing
++ */
++static void lrng_sp80090b_runtime_failure(struct lrng_health *health,
++					  enum lrng_internal_es es)
++{
++	struct lrng_health_es_state *es_state = &health->es_state[es];
++
++	lrng_sp80090b_startup_failure(health, es);
++	es_state->sp80090b_startup_done = false;
++}
++
++static void lrng_rct_reset(struct lrng_rct *rct);
++static void lrng_apt_reset(struct lrng_apt *apt, unsigned int time_masked);
++static void lrng_apt_restart(struct lrng_apt *apt);
++static void lrng_sp80090b_permanent_failure(struct lrng_health *health,
++					    enum lrng_internal_es es)
++{
++	struct lrng_health_es_state *es_state = &health->es_state[es];
++	struct lrng_apt *apt = &es_state->apt;
++	struct lrng_rct *rct = &es_state->rct;
++
++	if (lrng_enforce_panic_on_permanent_health_failure()) {
++		panic("SP800-90B permanent health test failure for internal entropy source %u\n",
++		      es);
++	}
++
++	pr_err("SP800-90B permanent health test failure for internal entropy source %u - invalidating all existing entropy and initiate SP800-90B startup\n",
++	       es);
++	lrng_sp80090b_runtime_failure(health, es);
++
++	lrng_rct_reset(rct);
++	lrng_apt_reset(apt, 0);
++	lrng_apt_restart(apt);
++}
++
++static void lrng_sp80090b_failure(struct lrng_health *health,
++				  enum lrng_internal_es es)
++{
++	struct lrng_health_es_state *es_state = &health->es_state[es];
++
++	if (es_state->sp80090b_startup_done) {
++		pr_warn("SP800-90B runtime health test failure for internal entropy source %u - invalidating all existing entropy and initiate SP800-90B startup\n", es);
++		lrng_sp80090b_runtime_failure(health, es);
++	} else {
++		pr_warn("SP800-90B startup test failure for internal entropy source %u - resetting\n", es);
++		lrng_sp80090b_startup_failure(health, es);
++	}
++}
++
++bool lrng_sp80090b_startup_complete_es(enum lrng_internal_es es)
++{
++	struct lrng_health *health = &lrng_health;
++	struct lrng_health_es_state *es_state = &health->es_state[es];
++
++	if (!lrng_sp80090b_health_enabled())
++		return true;
++
++	return es_state->sp80090b_startup_done;
++}
++
++bool lrng_sp80090b_compliant(enum lrng_internal_es es)
++{
++	struct lrng_health *health = &lrng_health;
++	struct lrng_health_es_state *es_state = &health->es_state[es];
++
++	return lrng_sp80090b_health_enabled() &&
++	       es_state->sp80090b_startup_done;
++}
++
++/***************************************************************************
++ * Adaptive Proportion Test
++ *
++ * This test complies with SP800-90B section 4.4.2.
++ ***************************************************************************/
++
++/*
++ * Reset the APT counter
++ *
++ * @health [in] Reference to health state
++ */
++static void lrng_apt_reset(struct lrng_apt *apt, unsigned int time_masked)
++{
++	/* Reset APT */
++	atomic_set(&apt->apt_count, 0);
++	atomic_set(&apt->apt_base, time_masked);
++}
++
++static void lrng_apt_restart(struct lrng_apt *apt)
++{
++	atomic_set(&apt->apt_trigger, LRNG_APT_WINDOW_SIZE);
++}
++
++/*
++ * Insert a new entropy event into APT
++ *
++ * This function does is void as it does not decide about the fate of a time
++ * stamp. An APT failure can only happen at the same time of a stuck test
++ * failure. Thus, the stuck failure will already decide how the time stamp
++ * is handled.
++ *
++ * @health [in] Reference to health state
++ * @now_time [in] Time stamp to process
++ */
++static void lrng_apt_insert(struct lrng_health *health,
++			    unsigned int now_time, enum lrng_internal_es es)
++{
++	struct lrng_health_es_state *es_state = &health->es_state[es];
++	struct lrng_apt *apt = &es_state->apt;
++
++	if (!lrng_sp80090b_health_requested())
++		return;
++
++	now_time &= LRNG_APT_WORD_MASK;
++
++	/* Initialization of APT */
++	if (!apt->apt_base_set) {
++		atomic_set(&apt->apt_base, now_time);
++		apt->apt_base_set = true;
++		return;
++	}
++
++	if (now_time == (unsigned int)atomic_read(&apt->apt_base)) {
++		u32 apt_val = (u32)atomic_inc_return_relaxed(&apt->apt_count);
++
++		if (apt_val >= CONFIG_LRNG_APT_CUTOFF_PERMANENT)
++			lrng_sp80090b_permanent_failure(health, es);
++		else if (apt_val >= CONFIG_LRNG_APT_CUTOFF)
++			lrng_sp80090b_failure(health, es);
++	}
++
++	if (atomic_dec_and_test(&apt->apt_trigger)) {
++		lrng_apt_restart(apt);
++		lrng_apt_reset(apt, now_time);
++		lrng_sp80090b_startup(health, es);
++	}
++}
++
++/***************************************************************************
++ * Repetition Count Test
++ *
++ * The LRNG uses an enhanced version of the Repetition Count Test
++ * (RCT) specified in SP800-90B section 4.4.1. Instead of counting identical
++ * back-to-back values, the input to the RCT is the counting of the stuck
++ * values while filling the entropy pool.
++ *
++ * The RCT is applied with an alpha of 2^-30 compliant to FIPS 140-2 IG 9.8.
++ *
++ * During the counting operation, the LRNG always calculates the RCT
++ * cut-off value of C. If that value exceeds the allowed cut-off value,
++ * the LRNG will invalidate all entropy for the entropy pool which implies
++ * that no data can be extracted from the entropy pool unless new entropy
++ * is received.
++ ***************************************************************************/
++
++static void lrng_rct_reset(struct lrng_rct *rct)
++{
++	/* Reset RCT */
++	atomic_set(&rct->rct_count, 0);
++}
++
++/*
++ * Hot code path - Insert data for Repetition Count Test
++ *
++ * @health: Reference to health information
++ * @stuck: Decision of stuck test
++ */
++static void lrng_rct(struct lrng_health *health, enum lrng_internal_es es,
++		     int stuck)
++{
++	struct lrng_health_es_state *es_state = &health->es_state[es];
++	struct lrng_rct *rct = &es_state->rct;
++
++	if (!lrng_sp80090b_health_requested())
++		return;
++
++	if (stuck) {
++		u32 rct_count = atomic_add_return_relaxed(1, &rct->rct_count);
++
++		/*
++		 * The cutoff value is based on the following consideration:
++		 * alpha = 2^-30 as recommended in FIPS 140-2 IG 9.8.
++		 * In addition, we imply an entropy value H of 1 bit as this
++		 * is the minimum entropy required to provide full entropy.
++		 *
++		 * Note, rct_count (which equals to value B in the
++		 * pseudo code of SP800-90B section 4.4.1) starts with zero.
++		 * Hence we need to subtract one from the cutoff value as
++		 * calculated following SP800-90B.
++		 */
++		if (rct_count >= CONFIG_LRNG_RCT_CUTOFF_PERMANENT)
++			lrng_sp80090b_permanent_failure(health, es);
++		else if (rct_count >= CONFIG_LRNG_RCT_CUTOFF)
++			lrng_sp80090b_failure(health, es);
++	} else {
++		lrng_rct_reset(rct);
++	}
++}
++
++/***************************************************************************
++ * Stuck Test
++ *
++ * Checking the:
++ *      1st derivative of the event occurrence (time delta)
++ *      2nd derivative of the event occurrence (delta of time deltas)
++ *      3rd derivative of the event occurrence (delta of delta of time deltas)
++ *
++ * All values must always be non-zero. The stuck test is only valid disabled if
++ * high-resolution time stamps are identified after initialization.
++ ***************************************************************************/
++
++static u32 lrng_delta(u32 prev, u32 next)
++{
++	/*
++	 * Note that this (unsigned) subtraction does yield the correct value
++	 * in the wraparound-case, i.e. when next < prev.
++	 */
++	return (next - prev);
++}
++
++/*
++ * Hot code path
++ *
++ * @health: Reference to health information
++ * @now: Event time
++ * @return: 0 event occurrence not stuck (good time stamp)
++ *	    != 0 event occurrence stuck (reject time stamp)
++ */
++static int lrng_irq_stuck(enum lrng_internal_es es, u32 now_time)
++{
++	struct lrng_stuck_test *stuck = this_cpu_ptr(lrng_stuck_test_array);
++	u32 delta = lrng_delta(stuck[es].last_time, now_time);
++	u32 delta2 = lrng_delta(stuck[es].last_delta, delta);
++	u32 delta3 = lrng_delta(stuck[es].last_delta2, delta2);
++
++	stuck[es].last_time = now_time;
++	stuck[es].last_delta = delta;
++	stuck[es].last_delta2 = delta2;
++
++	if (!delta || !delta2 || !delta3)
++		return 1;
++
++	return 0;
++}
++
++/***************************************************************************
++ * Health test interfaces
++ ***************************************************************************/
++
++/*
++ * Disable all health tests
++ */
++void lrng_health_disable(void)
++{
++	struct lrng_health *health = &lrng_health;
++
++	health->health_test_enabled = false;
++
++	if (lrng_sp80090b_health_requested())
++		pr_warn("SP800-90B compliance requested but the Linux RNG is NOT SP800-90B compliant\n");
++}
++
++/*
++ * Hot code path - Perform health test on time stamp received from an event
++ *
++ * @now_time Time stamp
++ */
++enum lrng_health_res lrng_health_test(u32 now_time, enum lrng_internal_es es)
++{
++	struct lrng_health *health = &lrng_health;
++	int stuck;
++
++	if (!health->health_test_enabled)
++		return lrng_health_pass;
++
++	lrng_apt_insert(health, now_time, es);
++
++	stuck = lrng_irq_stuck(es, now_time);
++	lrng_rct(health, es, stuck);
++	if (stuck) {
++		/* SP800-90B disallows using a failing health test time stamp */
++		return lrng_sp80090b_health_requested() ?
++			lrng_health_fail_drop : lrng_health_fail_use;
++	}
++
++	return lrng_health_pass;
++}
+From 92148eed7179e55a0f9d5cbedf42b814502e222a Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Mon, 20 Feb 2023 22:07:27 +0100
+Subject: [PATCH 15/25] LRNG - add random.c entropy source support
+
+The random.c implementation can be used as an entropy source by the
+LRNG. This support can be enabled at compile time.
+
+The entropy rate can be set at compile time which is only applied:
+
+- once the random.c considers itself fully seeded, and
+
+- the kernel does not operate in FIPS mode (i.e. fips=1 is not set at
+  the kernel command line)
+
+If one of these properties is not set, the ES will obtain data, but will
+credit it with zero bits of entropy. For the first bullet, it is clear
+why it will have zero bits of entropy. But for the second property, this
+is set because the random.c is not operating SP800-90B compliant and
+thus must be treated to not deliver any entropy in FIPS mode.
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+---
+ drivers/char/lrng/Kconfig        |  56 ++++++++---------
+ drivers/char/lrng/Makefile       |   1 +
+ drivers/char/lrng/lrng_es_krng.c | 100 +++++++++++++++++++++++++++++++
+ 3 files changed, 129 insertions(+), 28 deletions(-)
+ create mode 100644 drivers/char/lrng/lrng_es_krng.c
+
+--- a/drivers/char/lrng/Kconfig
++++ b/drivers/char/lrng/Kconfig
+@@ -586,34 +586,34 @@ config LRNG_SCHED_ENTROPY_RATE
+ 	  scheduler entropy source will still deliver data but without
+ 	  being credited with entropy.
+ 
+-# comment "Kernel RNG Entropy Source"
+-#
+-# config LRNG_KERNEL_RNG
+-# 	bool "Enable Kernel RNG as LRNG Seed Source"
+-# 	depends on RANDOM_DEFAULT_IMPL
+-# 	help
+-# 	  The LRNG may use the kernel RNG (random.c) as entropy
+-# 	  source.
+-#
+-# config LRNG_KERNEL_RNG_ENTROPY_RATE
+-# 	int "Kernel RNG Entropy Source Entropy Rate"
+-# 	depends on LRNG_KERNEL_RNG
+-# 	range 0 256
+-# 	default 256
+-# 	help
+-# 	  The option defines the amount of entropy the LRNG applies to 256
+-# 	  bits of data obtained from the kernel RNG entropy source. The
+-# 	  LRNG enforces the limit that this value must be in the range
+-# 	  between 0 and 256.
+-#
+-# 	  When configuring this value to 0, the kernel RNG entropy source
+-# 	  will provide 256 bits of data without being credited to contain
+-# 	  entropy.
+-#
+-# 	  Note: This value is set to 0 automatically when booting the
+-# 	  kernel in FIPS mode (with fips=1 kernel command line option).
+-# 	  This is due to the fact that random.c is not SP800-90B
+-# 	  compliant.
++comment "Kernel RNG Entropy Source"
++
++config LRNG_KERNEL_RNG
++	bool "Enable Kernel RNG as LRNG Seed Source"
++	depends on RANDOM_DEFAULT_IMPL
++	help
++	  The LRNG may use the kernel RNG (random.c) as entropy
++	  source.
++
++config LRNG_KERNEL_RNG_ENTROPY_RATE
++	int "Kernel RNG Entropy Source Entropy Rate"
++	depends on LRNG_KERNEL_RNG
++	range 0 256
++	default 256
++	help
++	  The option defines the amount of entropy the LRNG applies to 256
++	  bits of data obtained from the kernel RNG entropy source. The
++	  LRNG enforces the limit that this value must be in the range
++	  between 0 and 256.
++
++	  When configuring this value to 0, the kernel RNG entropy source
++	  will provide 256 bits of data without being credited to contain
++	  entropy.
++
++	  Note: This value is set to 0 automatically when booting the
++	  kernel in FIPS mode (with fips=1 kernel command line option).
++	  This is due to the fact that random.c is not SP800-90B
++	  compliant.
+ 
+ endmenu # "Entropy Source Configuration"
+ 
+--- a/drivers/char/lrng/Makefile
++++ b/drivers/char/lrng/Makefile
+@@ -20,6 +20,7 @@ obj-$(CONFIG_LRNG_DRNG_ATOMIC)		+= lrng_
+ 
+ obj-$(CONFIG_LRNG_TIMER_COMMON)		+= lrng_es_timer_common.o
+ obj-$(CONFIG_LRNG_IRQ)			+= lrng_es_irq.o
++obj-$(CONFIG_LRNG_KERNEL_RNG)		+= lrng_es_krng.o
+ obj-$(CONFIG_LRNG_SCHED)		+= lrng_es_sched.o
+ 
+ obj-$(CONFIG_LRNG_HEALTH_TESTS)		+= lrng_health.o
+--- /dev/null
++++ b/drivers/char/lrng/lrng_es_krng.c
+@@ -0,0 +1,100 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * LRNG Fast Entropy Source: Linux kernel RNG (random.c)
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/fips.h>
++#include <linux/module.h>
++#include <linux/random.h>
++#include <linux/types.h>
++
++#include "lrng_es_aux.h"
++#include "lrng_es_krng.h"
++
++static u32 krng_entropy = CONFIG_LRNG_KERNEL_RNG_ENTROPY_RATE;
++#ifdef CONFIG_LRNG_RUNTIME_ES_CONFIG
++module_param(krng_entropy, uint, 0644);
++MODULE_PARM_DESC(krng_entropy, "Entropy in bits of 256 data bits from the kernel RNG noise source");
++#endif
++
++static atomic_t lrng_krng_initial_rate = ATOMIC_INIT(0);
++
++static u32 lrng_krng_fips_entropylevel(u32 entropylevel)
++{
++	return fips_enabled ? 0 : entropylevel;
++}
++
++static int lrng_krng_adjust_entropy(void)
++{
++	u32 entropylevel;
++
++	krng_entropy = atomic_read_u32(&lrng_krng_initial_rate);
++
++	entropylevel = lrng_krng_fips_entropylevel(krng_entropy);
++	pr_debug("Kernel RNG is fully seeded, setting entropy rate to %u bits of entropy\n",
++		 entropylevel);
++	lrng_drng_force_reseed();
++	if (entropylevel)
++		lrng_es_add_entropy();
++	return 0;
++}
++
++static u32 lrng_krng_entropylevel(u32 requested_bits)
++{
++	static bool init = false;
++
++	if (unlikely(!init) && rng_is_initialized()) {
++		init = true;
++		lrng_krng_adjust_entropy();
++	}
++
++	return lrng_fast_noise_entropylevel(
++		lrng_krng_fips_entropylevel(krng_entropy), requested_bits);
++}
++
++static u32 lrng_krng_poolsize(void)
++{
++	return lrng_krng_entropylevel(lrng_security_strength());
++}
++
++/*
++ * lrng_krng_get() - Get kernel RNG entropy
++ *
++ * @eb: entropy buffer to store entropy
++ * @requested_bits: requested entropy in bits
++ */
++static void lrng_krng_get(struct entropy_buf *eb, u32 requested_bits,
++			  bool __unused)
++{
++	u32 ent_bits = lrng_krng_entropylevel(requested_bits);
++
++	get_random_bytes(eb->e[lrng_ext_es_krng], requested_bits >> 3);
++
++	pr_debug("obtained %u bits of entropy from kernel RNG noise source\n",
++		 ent_bits);
++
++	eb->e_bits[lrng_ext_es_krng] = ent_bits;
++}
++
++static void lrng_krng_es_state(unsigned char *buf, size_t buflen)
++{
++	snprintf(buf, buflen,
++		 " Available entropy: %u\n"
++		 " Entropy Rate per 256 data bits: %u\n",
++		 lrng_krng_poolsize(),
++		 lrng_krng_entropylevel(256));
++}
++
++struct lrng_es_cb lrng_es_krng = {
++	.name			= "KernelRNG",
++	.get_ent		= lrng_krng_get,
++	.curr_entropy		= lrng_krng_entropylevel,
++	.max_entropy		= lrng_krng_poolsize,
++	.state			= lrng_krng_es_state,
++	.reset			= NULL,
++	.switch_hash		= NULL,
++};
+From 67d7584f291dc9e3fb5a59645fce2fc8cadf3e38 Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Mon, 20 Feb 2023 22:08:23 +0100
+Subject: [PATCH 16/25] LRNG - CPU entropy source
+
+Certain CPUs provide instructions giving access to an entropy source
+(e.g. RDSEED on Intel/AMD, DARN on POWER, etc.). The LRNG can utilize
+the entropy source to seed its DRNG from.
+
+Some CPU entropy sources (e.g. POWER DARN, RISC-V) are defined to
+deliver data that does not contain full entropy. In this case, the CPU
+is sampled for as much data as needed to obtain the required amount of
+entropy. In this case, a compression operation using the set message
+digest is applied.
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+---
+ drivers/char/lrng/Kconfig       |  76 ++++-----
+ drivers/char/lrng/Makefile      |   1 +
+ drivers/char/lrng/lrng_es_cpu.c | 281 ++++++++++++++++++++++++++++++++
+ 3 files changed, 320 insertions(+), 38 deletions(-)
+ create mode 100644 drivers/char/lrng/lrng_es_cpu.c
+
+--- a/drivers/char/lrng/Kconfig
++++ b/drivers/char/lrng/Kconfig
+@@ -496,44 +496,44 @@ config LRNG_IRQ_ENTROPY_RATE
+ # 	  will provide 256 bits of data without being credited to contain
+ # 	  entropy.
+ #
+-# comment "CPU Entropy Source"
+-#
+-# config LRNG_CPU
+-# 	bool "Enable CPU Entropy Source as LRNG Seed Source"
+-# 	default y
+-# 	help
+-# 	  Current CPUs commonly contain entropy sources which can be
+-# 	  used to seed the LRNG. For example, the Intel RDSEED
+-# 	  instruction, or the POWER DARN instruction will be sourced
+-# 	  to seed the LRNG if this option is enabled.
+-#
+-# 	  Note, if this option is enabled and the underlying CPU
+-# 	  does not offer such entropy source, the LRNG will automatically
+-# 	  detect this and ignore the hardware.
+-#
+-# config LRNG_CPU_FULL_ENT_MULTIPLIER
+-# 	int
+-# 	default 1 if !LRNG_TEST_CPU_ES_COMPRESSION
+-# 	default 123 if LRNG_TEST_CPU_ES_COMPRESSION
+-#
+-# config LRNG_CPU_ENTROPY_RATE
+-# 	int "CPU Entropy Source Entropy Rate"
+-# 	depends on LRNG_CPU
+-# 	range 0 256
+-# 	default 8
+-# 	help
+-# 	  The option defines the amount of entropy the LRNG applies to 256
+-# 	  bits of data obtained from the CPU entropy source. The LRNG
+-# 	  enforces the limit that this value must be in the range between
+-# 	  0 and 256.
+-#
+-# 	  When configuring this value to 0, the CPU entropy source will
+-# 	  provide 256 bits of data without being credited to contain
+-# 	  entropy.
+-#
+-# 	  Note, this option is overwritten when the option
+-# 	  CONFIG_RANDOM_TRUST_CPU is set.
+-#
++comment "CPU Entropy Source"
++
++config LRNG_CPU
++	bool "Enable CPU Entropy Source as LRNG Seed Source"
++	default y
++	help
++	  Current CPUs commonly contain entropy sources which can be
++	  used to seed the LRNG. For example, the Intel RDSEED
++	  instruction, or the POWER DARN instruction will be sourced
++	  to seed the LRNG if this option is enabled.
++
++	  Note, if this option is enabled and the underlying CPU
++	  does not offer such entropy source, the LRNG will automatically
++	  detect this and ignore the hardware.
++
++config LRNG_CPU_FULL_ENT_MULTIPLIER
++	int
++	default 1 if !LRNG_TEST_CPU_ES_COMPRESSION
++	default 123 if LRNG_TEST_CPU_ES_COMPRESSION
++
++config LRNG_CPU_ENTROPY_RATE
++	int "CPU Entropy Source Entropy Rate"
++	depends on LRNG_CPU
++	range 0 256
++	default 8
++	help
++	  The option defines the amount of entropy the LRNG applies to 256
++	  bits of data obtained from the CPU entropy source. The LRNG
++	  enforces the limit that this value must be in the range between
++	  0 and 256.
++
++	  When configuring this value to 0, the CPU entropy source will
++	  provide 256 bits of data without being credited to contain
++	  entropy.
++
++	  Note, this option is overwritten when the option
++	  CONFIG_RANDOM_TRUST_CPU is set.
++
+ comment "Scheduler Entropy Source"
+ 
+ config LRNG_SCHED
+--- a/drivers/char/lrng/Makefile
++++ b/drivers/char/lrng/Makefile
+@@ -22,5 +22,6 @@ obj-$(CONFIG_LRNG_TIMER_COMMON)		+= lrng
+ obj-$(CONFIG_LRNG_IRQ)			+= lrng_es_irq.o
+ obj-$(CONFIG_LRNG_KERNEL_RNG)		+= lrng_es_krng.o
+ obj-$(CONFIG_LRNG_SCHED)		+= lrng_es_sched.o
++obj-$(CONFIG_LRNG_CPU)			+= lrng_es_cpu.o
+ 
+ obj-$(CONFIG_LRNG_HEALTH_TESTS)		+= lrng_health.o
+--- /dev/null
++++ b/drivers/char/lrng/lrng_es_cpu.c
+@@ -0,0 +1,281 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * LRNG Fast Entropy Source: CPU-based entropy source
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/lrng.h>
++#include <crypto/hash.h>
++#include <linux/module.h>
++#include <linux/random.h>
++#include <asm/archrandom.h>
++
++#include "lrng_definitions.h"
++#include "lrng_es_aux.h"
++#include "lrng_es_cpu.h"
++
++/*
++ * Estimated entropy of data is a 32th of LRNG_DRNG_SECURITY_STRENGTH_BITS.
++ * As we have no ability to review the implementation of those noise sources,
++ * it is prudent to have a conservative estimate here.
++ */
++#define LRNG_ARCHRANDOM_DEFAULT_STRENGTH CONFIG_LRNG_CPU_ENTROPY_RATE
++#define LRNG_ARCHRANDOM_TRUST_CPU_STRENGTH LRNG_DRNG_SECURITY_STRENGTH_BITS
++#ifdef CONFIG_RANDOM_TRUST_CPU
++static u32 cpu_entropy = LRNG_ARCHRANDOM_TRUST_CPU_STRENGTH;
++#else
++static u32 cpu_entropy = LRNG_ARCHRANDOM_DEFAULT_STRENGTH;
++#endif
++#ifdef CONFIG_LRNG_RUNTIME_ES_CONFIG
++module_param(cpu_entropy, uint, 0644);
++MODULE_PARM_DESC(cpu_entropy, "Entropy in bits of 256 data bits from CPU noise source (e.g. RDSEED)");
++#endif
++
++static int __init lrng_parse_trust_cpu(char *arg)
++{
++	int ret;
++	bool trust_cpu = false;
++
++	ret = kstrtobool(arg, &trust_cpu);
++	if (ret)
++		return ret;
++
++	if (trust_cpu)
++		cpu_entropy = LRNG_ARCHRANDOM_TRUST_CPU_STRENGTH;
++	else
++		cpu_entropy = LRNG_ARCHRANDOM_DEFAULT_STRENGTH;
++
++	lrng_force_fully_seeded();
++
++	return 0;
++}
++early_param("random.trust_cpu", lrng_parse_trust_cpu);
++
++static u32 lrng_cpu_entropylevel(u32 requested_bits)
++{
++	return lrng_fast_noise_entropylevel(cpu_entropy, requested_bits);
++}
++
++static u32 lrng_cpu_poolsize(void)
++{
++	return lrng_cpu_entropylevel(lrng_security_strength());
++}
++
++static u32 lrng_get_cpu_data(u8 *outbuf, u32 requested_bits)
++{
++	size_t longs = 0;
++	u32 i,  req = requested_bits >> 3;
++
++	/* operate on full blocks */
++	BUILD_BUG_ON(LRNG_DRNG_SECURITY_STRENGTH_BYTES % sizeof(unsigned long));
++	BUILD_BUG_ON(LRNG_SEED_BUFFER_INIT_ADD_BITS % sizeof(unsigned long));
++	/* ensure we have aligned buffers */
++	BUILD_BUG_ON(LRNG_KCAPI_ALIGN % sizeof(unsigned long));
++
++	for (i = 0; i < req; i += longs) {
++		longs = arch_get_random_seed_longs(
++			(unsigned long *)(outbuf + i), req - i);
++		if (longs)
++			continue;
++		longs = arch_get_random_longs((unsigned long *)(outbuf + i),
++					      req - i);
++		if (!longs) {
++			cpu_entropy = 0;
++			return 0;
++		}
++	}
++
++	return requested_bits;
++}
++
++static u32 lrng_get_cpu_data_compress(u8 *outbuf, u32 requested_bits,
++				      u32 data_multiplier)
++{
++	SHASH_DESC_ON_STACK(shash, NULL);
++	const struct lrng_hash_cb *hash_cb;
++	struct lrng_drng *drng = lrng_drng_node_instance();
++	unsigned long flags;
++	u32 ent_bits = 0, i, partial_bits = 0, digestsize, digestsize_bits,
++	    full_bits;
++	void *hash;
++
++	read_lock_irqsave(&drng->hash_lock, flags);
++	hash_cb = drng->hash_cb;
++	hash = drng->hash;
++
++	digestsize = hash_cb->hash_digestsize(hash);
++	digestsize_bits = digestsize << 3;
++	/* Cap to maximum entropy that can ever be generated with given hash */
++	lrng_cap_requested(digestsize_bits, requested_bits);
++	full_bits = requested_bits * data_multiplier;
++
++	/* Calculate oversampling for SP800-90C */
++	if (lrng_sp80090c_compliant()) {
++		/* Complete amount of bits to be pulled */
++		full_bits += LRNG_OVERSAMPLE_ES_BITS * data_multiplier;
++		/* Full blocks that will be pulled */
++		data_multiplier = full_bits / requested_bits;
++		/* Partial block in bits to be pulled */
++		partial_bits = full_bits - (data_multiplier * requested_bits);
++	}
++
++	if (hash_cb->hash_init(shash, hash))
++		goto out;
++
++	/* Hash all data from the CPU entropy source */
++	for (i = 0; i < data_multiplier; i++) {
++		ent_bits = lrng_get_cpu_data(outbuf, requested_bits);
++		if (!ent_bits)
++			goto out;
++
++		if (hash_cb->hash_update(shash, outbuf, ent_bits >> 3))
++			goto err;
++	}
++
++	/* Hash partial block, if applicable */
++	ent_bits = lrng_get_cpu_data(outbuf, partial_bits);
++	if (ent_bits &&
++	    hash_cb->hash_update(shash, outbuf, ent_bits >> 3))
++		goto err;
++
++	pr_debug("pulled %u bits from CPU RNG entropy source\n", full_bits);
++	ent_bits = requested_bits;
++
++	/* Generate the compressed data to be returned to the caller */
++	if (requested_bits < digestsize_bits) {
++		u8 digest[LRNG_MAX_DIGESTSIZE];
++
++		if (hash_cb->hash_final(shash, digest))
++			goto err;
++
++		/* Truncate output data to requested size */
++		memcpy(outbuf, digest, requested_bits >> 3);
++		memzero_explicit(digest, digestsize);
++	} else {
++		if (hash_cb->hash_final(shash, outbuf))
++			goto err;
++	}
++
++out:
++	hash_cb->hash_desc_zero(shash);
++	read_unlock_irqrestore(&drng->hash_lock, flags);
++	return ent_bits;
++
++err:
++	ent_bits = 0;
++	goto out;
++}
++
++/*
++ * If CPU entropy source requires does not return full entropy, return the
++ * multiplier of how much data shall be sampled from it.
++ */
++static u32 lrng_cpu_multiplier(void)
++{
++	static u32 data_multiplier = 0;
++	unsigned long v;
++
++	if (data_multiplier > 0)
++		return data_multiplier;
++
++	if (IS_ENABLED(CONFIG_X86) && !arch_get_random_seed_longs(&v, 1)) {
++		/*
++		 * Intel SPEC: pulling 512 blocks from RDRAND ensures
++		 * one reseed making it logically equivalent to RDSEED.
++		 */
++		data_multiplier = 512;
++	} else if (IS_ENABLED(CONFIG_PPC)) {
++		/*
++		 * PowerISA defines DARN to deliver at least 0.5 bits of
++		 * entropy per data bit.
++		 */
++		data_multiplier = 2;
++	} else if (IS_ENABLED(CONFIG_RISCV)) {
++		/*
++		 * riscv-crypto-spec-scalar-1.0.0-rc6.pdf section 4.2 defines
++		 * this requirement.
++		 */
++		data_multiplier = 2;
++	} else {
++		/* CPU provides full entropy */
++		data_multiplier = CONFIG_LRNG_CPU_FULL_ENT_MULTIPLIER;
++	}
++	return data_multiplier;
++}
++
++static int
++lrng_cpu_switch_hash(struct lrng_drng *drng, int node,
++		     const struct lrng_hash_cb *new_cb, void *new_hash,
++		     const struct lrng_hash_cb *old_cb)
++{
++	u32 digestsize, multiplier;
++
++	if (!IS_ENABLED(CONFIG_LRNG_SWITCH))
++		return -EOPNOTSUPP;
++
++	digestsize = lrng_get_digestsize();
++	multiplier = lrng_cpu_multiplier();
++
++	/*
++	 * It would be security violation if the new digestsize is smaller than
++	 * the set CPU entropy rate.
++	 */
++	WARN_ON(multiplier > 1 && digestsize < cpu_entropy);
++	cpu_entropy = min_t(u32, digestsize, cpu_entropy);
++	return 0;
++}
++
++/*
++ * lrng_get_arch() - Get CPU entropy source entropy
++ *
++ * @eb: entropy buffer to store entropy
++ * @requested_bits: requested entropy in bits
++ */
++static void lrng_cpu_get(struct entropy_buf *eb, u32 requested_bits,
++			 bool __unused)
++{
++	u32 ent_bits, data_multiplier = lrng_cpu_multiplier();
++
++	if (data_multiplier <= 1) {
++		ent_bits = lrng_get_cpu_data(eb->e[lrng_ext_es_cpu],
++					     requested_bits);
++	} else {
++		ent_bits = lrng_get_cpu_data_compress(eb->e[lrng_ext_es_cpu],
++						      requested_bits,
++						      data_multiplier);
++	}
++
++	ent_bits = lrng_cpu_entropylevel(ent_bits);
++	pr_debug("obtained %u bits of entropy from CPU RNG entropy source\n",
++		 ent_bits);
++	eb->e_bits[lrng_ext_es_cpu] = ent_bits;
++}
++
++static void lrng_cpu_es_state(unsigned char *buf, size_t buflen)
++{
++	const struct lrng_drng *lrng_drng_init = lrng_drng_init_instance();
++	u32 data_multiplier = lrng_cpu_multiplier();
++
++	/* Assume the lrng_drng_init lock is taken by caller */
++	snprintf(buf, buflen,
++		 " Hash for compressing data: %s\n"
++		 " Available entropy: %u\n"
++		 " Data multiplier: %u\n",
++		 (data_multiplier <= 1) ?
++			"N/A" : lrng_drng_init->hash_cb->hash_name(),
++		 lrng_cpu_poolsize(),
++		 data_multiplier);
++}
++
++struct lrng_es_cb lrng_es_cpu = {
++	.name			= "CPU",
++	.get_ent		= lrng_cpu_get,
++	.curr_entropy		= lrng_cpu_entropylevel,
++	.max_entropy		= lrng_cpu_poolsize,
++	.state			= lrng_cpu_es_state,
++	.reset			= NULL,
++	.switch_hash		= lrng_cpu_switch_hash,
++};
+From a9b4e46d8253ca9e63fcf1fed126c407a1e4f73c Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Sun, 27 Aug 2023 17:11:37 +0200
+Subject: [PATCH 17/25] LRNG - add Jitter RNG fast noise source
+
+The Jitter RNG fast noise source implemented as part of the kernel
+crypto API is queried for 256 bits of entropy at the time the seed
+buffer managed by the LRNG is about to be filled.
+
+The default entropy rate is set to 16 bits of entropy per 256 bits of
+data. In FIPS mode, the ratio is set to 256 bits of entropy per 256 bits
+of data considering that the Jitter RNG passed the NIST ENT validation
+to claim full entropy.
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+---
+ drivers/char/lrng/Kconfig        | 172 +++++++--------
+ drivers/char/lrng/Makefile       |   1 +
+ drivers/char/lrng/lrng_es_jent.c | 358 +++++++++++++++++++++++++++++++
+ 3 files changed, 445 insertions(+), 86 deletions(-)
+ create mode 100644 drivers/char/lrng/lrng_es_jent.c
+
+--- a/drivers/char/lrng/Kconfig
++++ b/drivers/char/lrng/Kconfig
+@@ -410,92 +410,92 @@ config LRNG_IRQ_ENTROPY_RATE
+ 	  interrupt entropy source will still deliver data but without
+ 	  being credited with entropy.
+ 
+-# comment "Jitter RNG Entropy Source"
+-#
+-# config LRNG_JENT
+-# 	bool "Enable Jitter RNG as LRNG Seed Source"
+-# 	depends on CRYPTO
+-# 	select CRYPTO_JITTERENTROPY
+-# 	help
+-# 	  The LRNG may use the Jitter RNG as entropy source. Enabling
+-# 	  this option enables the use of the Jitter RNG. Its default
+-# 	  entropy level is 16 bits of entropy per 256 data bits delivered
+-# 	  by the Jitter RNG. This entropy level can be changed at boot
+-# 	  time or at runtime with the lrng_base.jitterrng configuration
+-# 	  variable.
+-#
+-#choice
+-#	prompt "Jitter RNG Async Block Number"
+-#	default LRNG_JENT_ENTROPY_BLOCKS_NO_128
+-#	depends on LRNG_JENT
+-#	help
+-#	  Select the number of Jitter RNG entropy blocks the asynchronous
+-#	  collection operation will fill. A caller for Jitter RNG entropy
+-#	  will be given data from the pre-filled blocks if available to
+-#	  prevent the Jitter RNG from utilizing the CPU too much in a
+-#	  possible hot code path.
+-#
+-#	  The number specifies the number of 256/384 bit blocks that will
+-#	  be held in memory and asynchronously filled with Jitter RNG data.
+-#
+-#	  The asynchronous entropy collection can also be disabled at
+-#	  kernel startup time when setting the command line option of
+-#	  lrng_es_jent.jent_async_enabled=0. Also, setting this option at
+-#	  runtime is allowed via the corresponding SysFS interface. This
+-#	  option is only available with the options SysFS and
+-#	  CONFIG_LRNG_RUNTIME_ES_CONFIG enabled.
+-#
+-#	config LRNG_JENT_ENTROPY_BLOCKS_DISABLED
+-#		bool "Async collection disabled"
+-#
+-#	# Any block number is allowed, provided it is a power of 2 and
+-#	# equal or larger than 4 (4 is due to the division in
+-#	# lrng_jent_async_get when deciding to wake up the monitor).
+-#	config LRNG_JENT_ENTROPY_BLOCKS_NO_32
+-#		bool "32 blocks"
+-#
+-#	config LRNG_JENT_ENTROPY_BLOCKS_NO_64
+-#		bool "64 blocks"
+-#
+-#	config LRNG_JENT_ENTROPY_BLOCKS_NO_128
+-#		bool "128 blocks (default)"
+-#
+-#	config LRNG_JENT_ENTROPY_BLOCKS_NO_256
+-#		bool "256 blocks"
+-#
+-#	config LRNG_JENT_ENTROPY_BLOCKS_NO_512
+-#		bool "512 blocks"
+-#
+-#	config LRNG_JENT_ENTROPY_BLOCKS_NO_1024
+-#		bool "1024 blocks"
+-#
+-#endchoice
+-#
+-#config LRNG_JENT_ENTROPY_BLOCKS
+-#	int
+-#	default 0 if LRNG_JENT_ENTROPY_BLOCKS_DISABLED
+-#	default 32 if LRNG_JENT_ENTROPY_BLOCKS_NO_32
+-#	default 64 if LRNG_JENT_ENTROPY_BLOCKS_NO_64
+-#	default 128 if LRNG_JENT_ENTROPY_BLOCKS_NO_128
+-#	default 256 if LRNG_JENT_ENTROPY_BLOCKS_NO_256
+-#	default 512 if LRNG_JENT_ENTROPY_BLOCKS_NO_512
+-#	default 1024 if LRNG_JENT_ENTROPY_BLOCKS_NO_1024
+-#
+-# config LRNG_JENT_ENTROPY_RATE
+-# 	int "Jitter RNG Entropy Source Entropy Rate"
+-# 	depends on LRNG_JENT
+-# 	range 0 256
+-# 	default 16
+-# 	help
+-# 	  The option defines the amount of entropy the LRNG applies to 256
+-# 	  bits of data obtained from the Jitter RNG entropy source. The
+-# 	  LRNG enforces the limit that this value must be in the range
+-# 	  between 0 and 256.
+-#
+-# 	  When configuring this value to 0, the Jitter RNG entropy source
+-# 	  will provide 256 bits of data without being credited to contain
+-# 	  entropy.
+-#
++comment "Jitter RNG Entropy Source"
++
++config LRNG_JENT
++	bool "Enable Jitter RNG as LRNG Seed Source"
++	depends on CRYPTO
++	select CRYPTO_JITTERENTROPY
++	help
++	  The LRNG may use the Jitter RNG as entropy source. Enabling
++	  this option enables the use of the Jitter RNG. Its default
++	  entropy level is 16 bits of entropy per 256 data bits delivered
++	  by the Jitter RNG. This entropy level can be changed at boot
++	  time or at runtime with the lrng_base.jitterrng configuration
++	  variable.
++
++choice
++	prompt "Jitter RNG Async Block Number"
++	default LRNG_JENT_ENTROPY_BLOCKS_NO_128
++	depends on LRNG_JENT
++	help
++	  Select the number of Jitter RNG entropy blocks the asynchronous
++	  collection operation will fill. A caller for Jitter RNG entropy
++	  will be given data from the pre-filled blocks if available to
++	  prevent the Jitter RNG from utilizing the CPU too much in a
++	  possible hot code path.
++
++	  The number specifies the number of 256/384 bit blocks that will
++	  be held in memory and asynchronously filled with Jitter RNG data.
++
++	  The asynchronous entropy collection can also be disabled at
++	  kernel startup time when setting the command line option of
++	  lrng_es_jent.jent_async_enabled=0. Also, setting this option at
++	  runtime is allowed via the corresponding SysFS interface. This
++	  option is only available with the options SysFS and
++	  CONFIG_LRNG_RUNTIME_ES_CONFIG enabled.
++
++	config LRNG_JENT_ENTROPY_BLOCKS_DISABLED
++		bool "Async collection disabled"
++
++	# Any block number is allowed, provided it is a power of 2 and
++	# equal or larger than 4 (4 is due to the division in
++	# lrng_jent_async_get when deciding to wake up the monitor).
++	config LRNG_JENT_ENTROPY_BLOCKS_NO_32
++		bool "32 blocks"
++
++	config LRNG_JENT_ENTROPY_BLOCKS_NO_64
++		bool "64 blocks"
++
++	config LRNG_JENT_ENTROPY_BLOCKS_NO_128
++		bool "128 blocks (default)"
++
++	config LRNG_JENT_ENTROPY_BLOCKS_NO_256
++		bool "256 blocks"
++
++	config LRNG_JENT_ENTROPY_BLOCKS_NO_512
++		bool "512 blocks"
++
++	config LRNG_JENT_ENTROPY_BLOCKS_NO_1024
++		bool "1024 blocks"
++
++endchoice
++
++config LRNG_JENT_ENTROPY_BLOCKS
++	int
++	default 0 if LRNG_JENT_ENTROPY_BLOCKS_DISABLED
++	default 32 if LRNG_JENT_ENTROPY_BLOCKS_NO_32
++	default 64 if LRNG_JENT_ENTROPY_BLOCKS_NO_64
++	default 128 if LRNG_JENT_ENTROPY_BLOCKS_NO_128
++	default 256 if LRNG_JENT_ENTROPY_BLOCKS_NO_256
++	default 512 if LRNG_JENT_ENTROPY_BLOCKS_NO_512
++	default 1024 if LRNG_JENT_ENTROPY_BLOCKS_NO_1024
++
++config LRNG_JENT_ENTROPY_RATE
++	int "Jitter RNG Entropy Source Entropy Rate"
++	depends on LRNG_JENT
++	range 0 256
++	default 16
++	help
++	  The option defines the amount of entropy the LRNG applies to 256
++	  bits of data obtained from the Jitter RNG entropy source. The
++	  LRNG enforces the limit that this value must be in the range
++	  between 0 and 256.
++
++	  When configuring this value to 0, the Jitter RNG entropy source
++	  will provide 256 bits of data without being credited to contain
++	  entropy.
++
+ comment "CPU Entropy Source"
+ 
+ config LRNG_CPU
+--- a/drivers/char/lrng/Makefile
++++ b/drivers/char/lrng/Makefile
+@@ -23,5 +23,6 @@ obj-$(CONFIG_LRNG_IRQ)			+= lrng_es_irq.
+ obj-$(CONFIG_LRNG_KERNEL_RNG)		+= lrng_es_krng.o
+ obj-$(CONFIG_LRNG_SCHED)		+= lrng_es_sched.o
+ obj-$(CONFIG_LRNG_CPU)			+= lrng_es_cpu.o
++obj-$(CONFIG_LRNG_JENT)			+= lrng_es_jent.o
+ 
+ obj-$(CONFIG_LRNG_HEALTH_TESTS)		+= lrng_health.o
+--- /dev/null
++++ b/drivers/char/lrng/lrng_es_jent.c
+@@ -0,0 +1,358 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * LRNG Fast Entropy Source: Jitter RNG
++ *
++ * Copyright (C) 2022 - 2023, Stephan Mueller <smueller@chronox.de>
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <crypto/rng.h>
++#include <linux/fips.h>
++#include <linux/kthread.h>
++#include <linux/module.h>
++#include <linux/types.h>
++
++#include "lrng_definitions.h"
++#include "lrng_es_aux.h"
++#include "lrng_es_jent.h"
++#include "lrng_es_mgr.h"
++
++/*
++ * Estimated entropy of data is a 16th of LRNG_DRNG_SECURITY_STRENGTH_BITS.
++ * Albeit a full entropy assessment is provided for the noise source indicating
++ * that it provides high entropy rates and considering that it deactivates
++ * when it detects insufficient hardware, the chosen under estimation of
++ * entropy is considered to be acceptable to all reviewers.
++ */
++static u32 jent_entropy = CONFIG_LRNG_JENT_ENTROPY_RATE;
++#ifdef CONFIG_LRNG_RUNTIME_ES_CONFIG
++module_param(jent_entropy, uint, 0644);
++MODULE_PARM_DESC(jent_entropy,
++		 "Entropy in bits of 256 data bits from Jitter RNG noise source");
++#endif
++
++static bool lrng_jent_initialized = false;
++static struct crypto_rng *jent;
++
++#if (CONFIG_LRNG_JENT_ENTROPY_BLOCKS != 0)
++
++/* Entropy buffer filled by Jitter RNG thread - must be power of 2 */
++#define LRNG_JENT_ENTROPY_BLOCKS_MASK (CONFIG_LRNG_JENT_ENTROPY_BLOCKS - 1)
++
++struct jent_entropy_es {
++	uint8_t e[LRNG_DRNG_INIT_SEED_SIZE_BYTES];
++	uint32_t e_bits;
++};
++
++/* Buffer that is filled with Jitter RNG data by a thread. */
++static struct jent_entropy_es
++	lrng_jent_async[CONFIG_LRNG_JENT_ENTROPY_BLOCKS] __aligned(sizeof(u64));
++
++/* State of each Jitter RNG buffer entry to ensure atomic access. */
++enum lrng_jent_async_state {
++	buffer_empty,
++	buffer_filling,
++	buffer_filled,
++	buffer_reading,
++};
++static atomic_t lrng_jent_async_set[CONFIG_LRNG_JENT_ENTROPY_BLOCKS];
++
++/* Jitter RNG buffer work handler. */
++static struct work_struct lrng_jent_async_work;
++
++/* Is the asynchronous operation enabled? */
++static bool lrng_es_jent_async_enabled = true;
++
++#else /* CONFIG_LRNG_JENT_ENTROPY_BLOCKS */
++
++/* The asynchronous operation is disabled by compile time option. */
++static bool lrng_es_jent_async_enabled = false;
++
++#endif /* CONFIG_LRNG_JENT_ENTROPY_BLOCKS */
++
++static u32 lrng_jent_entropylevel(u32 requested_bits)
++{
++	return lrng_fast_noise_entropylevel(lrng_jent_initialized ?
++					    jent_entropy : 0, requested_bits);
++}
++
++static u32 lrng_jent_poolsize(void)
++{
++	return lrng_jent_entropylevel(lrng_security_strength());
++}
++
++static void __lrng_jent_get(u8 *e, u32 *e_bits, u32 requested_bits)
++{
++	int ret;
++	u32 ent_bits = lrng_jent_entropylevel(requested_bits);
++	unsigned long flags;
++	static DEFINE_SPINLOCK(lrng_jent_lock);
++
++	if (!lrng_jent_initialized)
++		goto err;
++
++	spin_lock_irqsave(&lrng_jent_lock, flags);
++	ret = crypto_rng_get_bytes(jent, e, requested_bits >> 3);
++	spin_unlock_irqrestore(&lrng_jent_lock, flags);
++
++	if (ret) {
++		pr_debug("Jitter RNG failed with %d\n", ret);
++		goto err;
++	}
++
++	pr_debug("obtained %u bits of entropy from Jitter RNG noise source\n",
++		 ent_bits);
++
++	*e_bits = ent_bits;
++	return;
++
++err:
++	*e_bits = 0;
++}
++
++/*
++ * lrng_get_jent() - Get Jitter RNG entropy
++ *
++ * @eb: entropy buffer to store entropy
++ * @requested_bits: requested entropy in bits
++ */
++static void lrng_jent_get(struct entropy_buf *eb, u32 requested_bits,
++			  bool __unused)
++{
++	__lrng_jent_get(eb->e[lrng_ext_es_jitter],
++			&eb->e_bits[lrng_ext_es_jitter], requested_bits);
++}
++
++#if (CONFIG_LRNG_JENT_ENTROPY_BLOCKS != 0)
++
++/* Fill the Jitter RNG buffer with random data. */
++static void lrng_jent_async_monitor(struct work_struct *__unused)
++{
++	unsigned int i, requested_bits = lrng_get_seed_entropy_osr(true);
++
++	pr_debug("Jitter RNG block filling started\n");
++
++	for (i = 0; i < CONFIG_LRNG_JENT_ENTROPY_BLOCKS; i++) {
++		/* Ensure atomic access to the Jitter RNG buffer slot. */
++		if (atomic_cmpxchg(&lrng_jent_async_set[i],
++				   buffer_empty, buffer_filling) !=
++		    buffer_empty)
++			continue;
++
++		/*
++		 * Always gather entropy data including
++		 * potential oversampling factor.
++		 */
++		__lrng_jent_get(lrng_jent_async[i].e,
++				&lrng_jent_async[i].e_bits, requested_bits);
++
++		atomic_set(&lrng_jent_async_set[i], buffer_filled);
++
++		pr_debug("Jitter RNG ES monitor: filled slot %u with %u bits of entropy\n",
++			 i, requested_bits);
++
++		schedule();
++	}
++
++	pr_debug("Jitter RNG block filling completed\n");
++}
++
++static void lrng_jent_async_monitor_schedule(void)
++{
++	if (lrng_es_jent_async_enabled)
++		schedule_work(&lrng_jent_async_work);
++}
++
++static void lrng_jent_async_fini(void)
++{
++	/* Reset state */
++	memzero_explicit(lrng_jent_async, sizeof(lrng_jent_async));
++}
++
++/* Get Jitter RNG data from the buffer */
++static void lrng_jent_async_get(struct entropy_buf *eb, uint32_t requested_bits,
++				bool __unused)
++{
++	static atomic_t idx = ATOMIC_INIT(-1);
++	unsigned int slot;
++
++	(void)requested_bits;
++
++	if (!lrng_jent_initialized) {
++		eb->e_bits[lrng_ext_es_jitter] = 0;
++		return;
++	}
++
++	/* CONFIG_LRNG_JENT_ENTROPY_BLOCKS must be a power of 2 */
++	BUILD_BUG_ON((CONFIG_LRNG_JENT_ENTROPY_BLOCKS &
++		      LRNG_JENT_ENTROPY_BLOCKS_MASK) != 0);
++
++	slot = ((unsigned int)atomic_inc_return(&idx)) &
++		LRNG_JENT_ENTROPY_BLOCKS_MASK;
++
++	/* Ensure atomic access to the Jitter RNG buffer slot. */
++	if (atomic_cmpxchg(&lrng_jent_async_set[slot],
++			   buffer_filled, buffer_reading) != buffer_filled) {
++		pr_debug("Jitter RNG ES monitor: buffer slot %u exhausted\n",
++			 slot);
++		lrng_jent_get(eb, requested_bits, __unused);
++		lrng_jent_async_monitor_schedule();
++		return;
++	}
++
++	pr_debug("Jitter RNG ES monitor: used slot %u\n", slot);
++	memcpy(eb->e[lrng_ext_es_jitter], lrng_jent_async[slot].e,
++	       LRNG_DRNG_INIT_SEED_SIZE_BYTES);
++	eb->e_bits[lrng_ext_es_jitter] = lrng_jent_async[slot].e_bits;
++
++	pr_debug("obtained %u bits of entropy from Jitter RNG noise source\n",
++		 eb->e_bits[lrng_ext_es_jitter]);
++
++	memzero_explicit(&lrng_jent_async[slot],
++			 sizeof(struct jent_entropy_es));
++
++	atomic_set(&lrng_jent_async_set[slot], buffer_empty);
++
++	/* Ensure division in the following check works */
++	BUILD_BUG_ON(CONFIG_LRNG_JENT_ENTROPY_BLOCKS < 4);
++	if (!(slot % (CONFIG_LRNG_JENT_ENTROPY_BLOCKS / 4)) && slot)
++		lrng_jent_async_monitor_schedule();
++}
++
++static void lrng_jent_get_check(struct entropy_buf *eb,
++				uint32_t requested_bits, bool __unused)
++{
++	if (lrng_es_jent_async_enabled &&
++	    (requested_bits == lrng_get_seed_entropy_osr(true))) {
++		lrng_jent_async_get(eb, requested_bits, __unused);
++	} else {
++		lrng_jent_get(eb, requested_bits, __unused);
++	}
++}
++
++static void lrng_jent_async_init(void)
++{
++	unsigned int i;
++
++	if (!lrng_es_jent_async_enabled)
++		return;
++
++	for (i = 0; i < CONFIG_LRNG_JENT_ENTROPY_BLOCKS; i++)
++		atomic_set(&lrng_jent_async_set[i], buffer_empty);
++}
++
++static void lrng_jent_async_init_complete(void)
++{
++	lrng_jent_async_init();
++	INIT_WORK(&lrng_jent_async_work, lrng_jent_async_monitor);
++}
++
++#if (defined(CONFIG_SYSFS) && defined(CONFIG_LRNG_RUNTIME_ES_CONFIG))
++/* Initialize or deinitialize the Jitter RNG async collection */
++static int lrng_jent_async_sysfs_set(const char *val,
++				     const struct kernel_param *kp)
++{
++	static const char val_dflt[] = "1";
++	int ret;
++	bool setting;
++
++	if (!val)
++		val = val_dflt;
++
++	ret = kstrtobool(val, &setting);
++	if (ret)
++		return ret;
++
++	if (setting) {
++		if (!lrng_es_jent_async_enabled) {
++			lrng_es_jent_async_enabled = 1;
++			lrng_jent_async_init();
++			pr_devel("Jitter RNG async data collection enabled\n");
++			lrng_jent_async_monitor_schedule();
++		}
++	} else {
++		if (lrng_es_jent_async_enabled) {
++			lrng_es_jent_async_enabled = 0;
++			lrng_jent_async_fini();
++			pr_devel("Jitter RNG async data collection disabled\n");
++		}
++	}
++
++	return 0;
++}
++
++static const struct kernel_param_ops lrng_jent_async_sysfs = {
++	.set = lrng_jent_async_sysfs_set,
++	.get = param_get_bool,
++};
++module_param_cb(jent_async_enabled, &lrng_jent_async_sysfs,
++		&lrng_es_jent_async_enabled, 0644);
++MODULE_PARM_DESC(lrng_es_jent_async_enabled,
++		 "Enable Jitter RNG entropy buffer asynchronous collection");
++#endif /* CONFIG_SYSFS && CONFIG_LRNG_RUNTIME_ES_CONFIG */
++
++#else /* CONFIG_LRNG_JENT_ENTROPY_BLOCKS */
++
++static void lrng_jent_get_check(struct entropy_buf *eb,
++				uint32_t requested_bits, bool __unused)
++{
++	lrng_jent_get(eb, requested_bits, __unused);
++}
++
++static inline void __init lrng_jent_async_init_complete(void) { }
++
++#endif /* CONFIG_LRNG_JENT_ENTROPY_BLOCKS */
++
++static void lrng_jent_es_state(unsigned char *buf, size_t buflen)
++{
++	snprintf(buf, buflen,
++		 " Available entropy: %u\n"
++		 " Enabled: %s\n"
++		 " Jitter RNG async collection %s\n",
++		 lrng_jent_poolsize(),
++		 lrng_jent_initialized ? "true" : "false",
++		 lrng_es_jent_async_enabled ? "true" : "false");
++}
++
++static int __init lrng_jent_initialize(void)
++{
++	jent = crypto_alloc_rng("jitterentropy_rng", 0, 0);
++	if (IS_ERR(jent)) {
++		pr_err("Cannot allocate Jitter RNG\n");
++		return PTR_ERR(jent);
++	}
++
++	lrng_jent_async_init_complete();
++
++	lrng_jent_initialized = true;
++	pr_debug("Jitter RNG working on current system\n");
++
++	/*
++	 * In FIPS mode, the Jitter RNG is defined to have full of entropy
++	 * unless a different value has been specified at the command line
++	 * (i.e. the user overrides the default), and the default value is
++	 * larger than zero (if it is zero, it is assumed that an RBG2(P) or
++	 * RBG2(NP) construction is attempted that intends to exclude the
++	 * Jitter RNG).
++	 */
++	if (fips_enabled && CONFIG_LRNG_JENT_ENTROPY_RATE > 0 &&
++	    jent_entropy == CONFIG_LRNG_JENT_ENTROPY_RATE)
++		jent_entropy = LRNG_DRNG_SECURITY_STRENGTH_BITS;
++
++	if (jent_entropy)
++		lrng_force_fully_seeded();
++
++	return 0;
++}
++device_initcall(lrng_jent_initialize);
++
++struct lrng_es_cb lrng_es_jent = {
++	.name			= "JitterRNG",
++	.get_ent		= lrng_jent_get_check,
++	.curr_entropy		= lrng_jent_entropylevel,
++	.max_entropy		= lrng_jent_poolsize,
++	.state			= lrng_jent_es_state,
++	.reset			= NULL,
++	.switch_hash		= NULL,
++};
+From 718c21ecd7a9ac35fbdf28d2dcd2310634c669ef Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Sun, 15 May 2022 17:56:56 +0200
+Subject: [PATCH 18/25] LRNG - add option to enable runtime entropy rate
+ configuration
+
+The entropy rate for the different entropy sources is configured at
+compile time. Enabling the option CONFIG_LRNG_RUNTIME_ES_CONFIG allows
+the entropy sources' entropy rate to be adjusted at runtime or boot
+time. The different options are:
+
+- IRQ ES: lrng_es_irq.irq_entropy
+
+- Scheduler ES: lrng_es_sched.sched_entropy
+
+- CPU ES: lrng_es_cpu.cpu_entropy
+
+- Kernel ES: lrng_es_krng.krng_entropy
+
+- Jitter RNG ES: lrng_es_jent.jent_entropy
+
+The values to be specified there must apply the rationale given for the
+different CONFIG_LRNG_*_ENTROPY_RATE kernel configuration options.
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+---
+ drivers/char/lrng/Kconfig | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+--- a/drivers/char/lrng/Kconfig
++++ b/drivers/char/lrng/Kconfig
+@@ -124,17 +124,17 @@ endmenu # "Specific DRNG seeding strateg
+ 
+ menu "Entropy Source Configuration"
+ 
+-# config LRNG_RUNTIME_ES_CONFIG
+-# 	bool "Enable runtime configuration of entropy sources"
+-# 	help
+-# 	  When enabling this option, the LRNG provides the mechanism
+-# 	  allowing to alter the entropy rate of each entropy source
+-# 	  during boot time and runtime.
+-#
+-# 	  Each entropy source allows its entropy rate changed with
+-# 	  a kernel command line option. When not providing any
+-# 	  option, the default specified during kernel compilation
+-# 	  is applied.
++config LRNG_RUNTIME_ES_CONFIG
++	bool "Enable runtime configuration of entropy sources"
++	help
++	  When enabling this option, the LRNG provides the mechanism
++	  allowing to alter the entropy rate of each entropy source
++	  during boot time and runtime.
++
++	  Each entropy source allows its entropy rate changed with
++	  a kernel command line option. When not providing any
++	  option, the default specified during kernel compilation
++	  is applied.
+ 
+ comment "Common Timer-based Entropy Source Configuration"
+ 
+From 78cb1213ad35895b6d0d1a1ff49224f0c123e86c Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Sun, 18 Dec 2022 21:22:36 +0100
+Subject: [PATCH 19/25] LRNG - add interface for gathering of raw entropy
+
+The test interface allows a privileged process to capture the raw
+unconditioned noise that is collected by the LRNG for statistical
+analysis. Such testing allows the analysis how much entropy
+the interrupt noise source provides on a given platform.
+Extracted noise data is not used to seed the LRNG. This
+is a test interface and not appropriate for production systems.
+Yet, the interface is considered to be sufficiently secured for
+production systems.
+
+The raw entropy collection is provided for the internal entropy sources
+under full control of the LRNG: the IRQ ES and the scheduler-based ES.
+The test interfaces are only enabled for the given ES if the ES is
+enabled itself.
+
+Access to the data is given through the lrng_raw debugfs file. The
+data buffer should be multiples of sizeof(u32) to fill the entire
+buffer. Using the option lrng_testing.boot_test=1 the raw noise of
+the first 1000 entropy events since boot can be sampled.
+
+This test interface allows generating the data required for
+analysis whether the LRNG is in compliance with SP800-90B
+sections 3.1.3 and 3.1.4.
+
+In addition, the test interface allows gathering of the concatenated raw
+entropy data to verify that the concatenation works appropriately.
+This includes sampling of the following raw IRQ data:
+
+* high-resolution time stamp obtained for an IRQ event
+
+* Jiffies
+
+* IRQ number
+
+* return instruction pointer
+
+* interrupt register state
+
+* array logic batching the high-resolution time stamp
+
+* a performance monitor of the IRQ ES
+
+The sampling of the following scheduler-based ES data is possible:
+
+* high-resolution time stamp obtained for a context switch event
+
+* the PID of the process scheduled to
+
+* the process' start time value
+
+* the process' context switch numbers value
+
+* a performance monitor of the scheduler-based ES
+
+Also, a testing interface to support ACVT of the hash implementation
+is provided. The reason why only hash testing is supported (as
+opposed to also provide testing for the DRNG) is the fact that the
+LRNG software hash implementation contains glue code that may
+warrant testing in addition to the testing of the software ciphers
+via the kernel crypto API. Also, for testing the CTR-DRBG, the
+underlying AES implementation would need to be tested. However,
+such AES test interface cannot be provided by the LRNG as it has no
+means to access the AES operation.
+
+If a test interface is not compiled, its code is a noop which has no
+impact on the performance.
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+---
+ drivers/char/lrng/Kconfig        | 534 +++++++++---------
+ drivers/char/lrng/Makefile       |   1 +
+ drivers/char/lrng/lrng_testing.c | 901 +++++++++++++++++++++++++++++++
+ 3 files changed, 1169 insertions(+), 267 deletions(-)
+ create mode 100644 drivers/char/lrng/lrng_testing.c
+
+--- a/drivers/char/lrng/Kconfig
++++ b/drivers/char/lrng/Kconfig
+@@ -718,273 +718,273 @@ choice
+ 		select LRNG_DRNG_KCAPI
+ endchoice
+ 
+-# menuconfig LRNG_TESTING_MENU
+-# 	bool "LRNG testing interfaces"
+-# 	depends on DEBUG_FS
+-# 	help
+-# 	  Enable one or more of the following test interfaces.
+-#
+-# 	  If unsure, say N.
+-#
+-# if LRNG_TESTING_MENU
+-#
+-# config LRNG_TESTING
+-# 	bool
+-#
+-# config LRNG_TESTING_RECORDING
+-# 	bool
+-#
+-# comment "Interrupt Entropy Source Test Interfaces"
+-#
+-# config LRNG_RAW_HIRES_ENTROPY
+-# 	bool "Interface to obtain raw unprocessed IRQ noise source data"
+-# 	default y
+-# 	depends on LRNG_IRQ
+-# 	select LRNG_TESTING
+-# 	select LRNG_TESTING_RECORDING
+-# 	help
+-# 	  The test interface allows a privileged process to capture
+-# 	  the raw unconditioned high resolution time stamp noise that
+-# 	  is collected by the LRNG for statistical analysis. Extracted
+-# 	  noise data is not used to seed the LRNG.
+-#
+-# 	  The raw noise data can be obtained using the lrng_raw_hires
+-# 	  debugfs file. Using the option lrng_testing.boot_raw_hires_test=1
+-# 	  the raw noise of the first 1000 entropy events since boot
+-# 	  can be sampled.
+-#
+-# config LRNG_RAW_JIFFIES_ENTROPY
+-# 	bool "Entropy test interface to Jiffies of IRQ noise source"
+-# 	depends on LRNG_IRQ
+-# 	select LRNG_TESTING
+-# 	select LRNG_TESTING_RECORDING
+-# 	help
+-# 	  The test interface allows a privileged process to capture
+-# 	  the raw unconditioned Jiffies that is collected by
+-# 	  the LRNG for statistical analysis. This data is used for
+-# 	  seeding the LRNG if a high-resolution time stamp is not
+-# 	  available. If a high-resolution time stamp is detected,
+-# 	  the Jiffies value is not collected by the LRNG and no
+-# 	  data is provided via the test interface. Extracted noise
+-# 	  data is not used to seed the random number generator.
+-#
+-# 	  The raw noise data can be obtained using the lrng_raw_jiffies
+-# 	  debugfs file. Using the option lrng_testing.boot_raw_jiffies_test=1
+-# 	  the raw noise of the first 1000 entropy events since boot
+-# 	  can be sampled.
+-#
+-# config LRNG_RAW_IRQ_ENTROPY
+-# 	bool "Entropy test interface to IRQ number noise source"
+-# 	depends on LRNG_IRQ
+-# 	select LRNG_TESTING
+-# 	select LRNG_TESTING_RECORDING
+-# 	help
+-# 	  The test interface allows a privileged process to capture
+-# 	  the raw unconditioned interrupt number that is collected by
+-# 	  the LRNG for statistical analysis. Extracted noise data is
+-# 	  not used to seed the random number generator.
+-#
+-# 	  The raw noise data can be obtained using the lrng_raw_irq
+-# 	  debugfs file. Using the option lrng_testing.boot_raw_irq_test=1
+-# 	  the raw noise of the first 1000 entropy events since boot
+-# 	  can be sampled.
+-#
+-# config LRNG_RAW_RETIP_ENTROPY
+-# 	bool "Entropy test interface to RETIP value of IRQ noise source"
+-# 	depends on LRNG_IRQ
+-# 	select LRNG_TESTING
+-# 	select LRNG_TESTING_RECORDING
+-# 	help
+-# 	  The test interface allows a privileged process to capture
+-# 	  the raw unconditioned return instruction pointer value
+-# 	  that is collected by the LRNG for statistical analysis.
+-# 	  Extracted noise data is not used to seed the random number
+-# 	  generator.
+-#
+-# 	  The raw noise data can be obtained using the lrng_raw_retip
+-# 	  debugfs file. Using the option lrng_testing.boot_raw_retip_test=1
+-# 	  the raw noise of the first 1000 entropy events since boot
+-# 	  can be sampled.
+-#
+-# config LRNG_RAW_REGS_ENTROPY
+-# 	bool "Entropy test interface to IRQ register value noise source"
+-# 	depends on LRNG_IRQ
+-# 	select LRNG_TESTING
+-# 	select LRNG_TESTING_RECORDING
+-# 	help
+-# 	  The test interface allows a privileged process to capture
+-# 	  the raw unconditioned interrupt register value that is
+-# 	  collected by the LRNG for statistical analysis. Extracted noise
+-# 	  data is not used to seed the random number generator.
+-#
+-# 	  The raw noise data can be obtained using the lrng_raw_regs
+-# 	  debugfs file. Using the option lrng_testing.boot_raw_regs_test=1
+-# 	  the raw noise of the first 1000 entropy events since boot
+-# 	  can be sampled.
+-#
+-# config LRNG_RAW_ARRAY
+-# 	bool "Test interface to LRNG raw entropy IRQ storage array"
+-# 	depends on LRNG_IRQ
+-# 	select LRNG_TESTING
+-# 	select LRNG_TESTING_RECORDING
+-# 	help
+-# 	  The test interface allows a privileged process to capture
+-# 	  the raw noise data that is collected by the LRNG
+-# 	  in the per-CPU array for statistical analysis. The purpose
+-# 	  of this interface is to verify that the array handling code
+-# 	  truly only concatenates data and provides the same entropy
+-# 	  rate as the raw unconditioned noise source when assessing
+-# 	  the collected data byte-wise.
+-#
+-# 	  The data can be obtained using the lrng_raw_array debugfs
+-# 	  file. Using the option lrng_testing.boot_raw_array=1
+-# 	  the raw noise of the first 1000 entropy events since boot
+-# 	  can be sampled.
+-#
+-# config LRNG_IRQ_PERF
+-# 	bool "LRNG interrupt entropy source performance monitor"
+-# 	depends on LRNG_IRQ
+-# 	select LRNG_TESTING
+-# 	select LRNG_TESTING_RECORDING
+-# 	help
+-# 	  With this option, the performance monitor of the LRNG
+-# 	  interrupt handling code is enabled. The file provides
+-# 	  the execution time of the interrupt handler in
+-# 	  cycles.
+-#
+-# 	  The interrupt performance data can be obtained using
+-# 	  the lrng_irq_perf debugfs file. Using the option
+-# 	  lrng_testing.boot_irq_perf=1 the performance data of
+-# 	  the first 1000 entropy events since boot can be sampled.
+-#
+-# comment "Scheduler Entropy Source Test Interfaces"
+-#
+-# config LRNG_RAW_SCHED_HIRES_ENTROPY
+-# 	bool "Interface to obtain raw unprocessed scheduler noise source data"
+-# 	depends on LRNG_SCHED
+-# 	select LRNG_TESTING
+-# 	select LRNG_TESTING_RECORDING
+-# 	help
+-# 	  The test interface allows a privileged process to capture
+-# 	  the raw unconditioned high resolution time stamp noise that
+-# 	  is collected by the LRNG for the Scheduler-based noise source
+-# 	  for statistical analysis. Extracted  noise data is not used to
+-# 	  seed the LRNG.
+-#
+-# 	  The raw noise data can be obtained using the lrng_raw_sched_hires
+-# 	  debugfs file. Using the option
+-# 	  lrng_testing.boot_raw_sched_hires_test=1 the raw noise of the
+-# 	  first 1000 entropy events since boot can be sampled.
+-#
+-# config LRNG_RAW_SCHED_PID_ENTROPY
+-# 	bool "Entropy test interface to PID value"
+-# 	depends on LRNG_SCHED
+-# 	select LRNG_TESTING
+-# 	select LRNG_TESTING_RECORDING
+-# 	help
+-# 	  The test interface allows a privileged process to capture
+-# 	  the raw unconditioned PID value that is collected by the
+-# 	  LRNG for statistical analysis. Extracted noise
+-# 	  data is not used to seed the random number generator.
+-#
+-# 	  The raw noise data can be obtained using the
+-# 	  lrng_raw_sched_pid debugfs file. Using the option
+-# 	  lrng_testing.boot_raw_sched_pid_test=1
+-# 	  the raw noise of the first 1000 entropy events since boot
+-# 	  can be sampled.
+-#
+-# config LRNG_RAW_SCHED_START_TIME_ENTROPY
+-# 	bool "Entropy test interface to task start time value"
+-# 	depends on LRNG_SCHED
+-# 	select LRNG_TESTING
+-# 	select LRNG_TESTING_RECORDING
+-# 	help
+-# 	  The test interface allows a privileged process to capture
+-# 	  the raw unconditioned task start time value that is collected
+-# 	  by the LRNG for statistical analysis. Extracted noise
+-# 	  data is not used to seed the random number generator.
+-#
+-# 	  The raw noise data can be obtained using the
+-# 	  lrng_raw_sched_starttime debugfs file. Using the option
+-# 	  lrng_testing.boot_raw_sched_starttime_test=1
+-# 	  the raw noise of the first 1000 entropy events since boot
+-# 	  can be sampled.
+-#
+-#
+-# config LRNG_RAW_SCHED_NVCSW_ENTROPY
+-# 	bool "Entropy test interface to task context switch numbers"
+-# 	depends on LRNG_SCHED
+-# 	select LRNG_TESTING
+-# 	select LRNG_TESTING_RECORDING
+-# 	help
+-# 	  The test interface allows a privileged process to capture
+-# 	  the raw unconditioned task numbers of context switches that
+-# 	  are collected by the LRNG for statistical analysis. Extracted
+-# 	  noise data is not used to seed the random number generator.
+-#
+-# 	  The raw noise data can be obtained using the
+-# 	  lrng_raw_sched_nvcsw debugfs file. Using the option
+-# 	  lrng_testing.boot_raw_sched_nvcsw_test=1
+-# 	  the raw noise of the first 1000 entropy events since boot
+-# 	  can be sampled.
+-#
+-# config LRNG_SCHED_PERF
+-# 	bool "LRNG scheduler entropy source performance monitor"
+-# 	depends on LRNG_SCHED
+-# 	select LRNG_TESTING
+-# 	select LRNG_TESTING_RECORDING
+-# 	help
+-# 	  With this option, the performance monitor of the LRNG
+-# 	  scheduler event handling code is enabled. The file provides
+-# 	  the execution time of the interrupt handler in cycles.
+-#
+-# 	  The scheduler performance data can be obtained using
+-# 	  the lrng_sched_perf debugfs file. Using the option
+-# 	  lrng_testing.boot_sched_perf=1 the performance data of
+-# 	  the first 1000 entropy events since boot can be sampled.
+-#
+-# comment "Auxiliary Test Interfaces"
+-#
+-# config LRNG_ACVT_HASH
+-# 	bool "Enable LRNG ACVT Hash interface"
+-# 	select LRNG_TESTING
+-# 	help
+-# 	  With this option, the LRNG built-in hash function used for
+-# 	  auxiliary pool management and prior to switching the
+-# 	  cryptographic backends is made available for ACVT. The
+-# 	  interface allows writing of the data to be hashed
+-# 	  into the interface. The read operation triggers the hash
+-# 	  operation to generate message digest.
+-#
+-# 	  The ACVT interface is available with the lrng_acvt_hash
+-# 	  debugfs file.
+-#
+-# config LRNG_RUNTIME_MAX_WO_RESEED_CONFIG
+-# 	bool "Enable runtime configuration of max reseed threshold"
+-# 	help
+-# 	  When enabling this option, the LRNG provides an interface
+-# 	  allowing the setting of the maximum number of DRNG generate
+-# 	  operations without a reseed that has full entropy. The
+-# 	  interface is lrng_drng.max_wo_reseed.
+-#
+-#config LRNG_RUNTIME_FORCE_SEEDING_DISABLE
+-#	bool "Enable runtime configuration of force seeding"
+-#	help
+-#	  When enabling this option, the LRNG provides an interface
+-#	  allowing the disabling of the force seeding when the DRNG
+-#	  is not fully seeded but entropy is available.
+-#
+-# config LRNG_TEST_CPU_ES_COMPRESSION
+-# 	bool "Force CPU ES compression operation"
+-# 	help
+-# 	  When enabling this option, the CPU ES compression operation
+-# 	  is forced by setting an arbitrary value > 1 for the data
+-# 	  multiplier even when the CPU ES would deliver full entropy.
+-# 	  This allows testing of the compression operation. It
+-# 	  therefore forces to pull more data from the CPU ES
+-# 	  than what may be required.
+-#
+-# endif #LRNG_TESTING_MENU
++menuconfig LRNG_TESTING_MENU
++	bool "LRNG testing interfaces"
++	depends on DEBUG_FS
++	help
++	  Enable one or more of the following test interfaces.
++
++	  If unsure, say N.
++
++if LRNG_TESTING_MENU
++
++config LRNG_TESTING
++	bool
++
++config LRNG_TESTING_RECORDING
++	bool
++
++comment "Interrupt Entropy Source Test Interfaces"
++
++config LRNG_RAW_HIRES_ENTROPY
++	bool "Interface to obtain raw unprocessed IRQ noise source data"
++	default y
++	depends on LRNG_IRQ
++	select LRNG_TESTING
++	select LRNG_TESTING_RECORDING
++	help
++	  The test interface allows a privileged process to capture
++	  the raw unconditioned high resolution time stamp noise that
++	  is collected by the LRNG for statistical analysis. Extracted
++	  noise data is not used to seed the LRNG.
++
++	  The raw noise data can be obtained using the lrng_raw_hires
++	  debugfs file. Using the option lrng_testing.boot_raw_hires_test=1
++	  the raw noise of the first 1000 entropy events since boot
++	  can be sampled.
++
++config LRNG_RAW_JIFFIES_ENTROPY
++	bool "Entropy test interface to Jiffies of IRQ noise source"
++	depends on LRNG_IRQ
++	select LRNG_TESTING
++	select LRNG_TESTING_RECORDING
++	help
++	  The test interface allows a privileged process to capture
++	  the raw unconditioned Jiffies that is collected by
++	  the LRNG for statistical analysis. This data is used for
++	  seeding the LRNG if a high-resolution time stamp is not
++	  available. If a high-resolution time stamp is detected,
++	  the Jiffies value is not collected by the LRNG and no
++	  data is provided via the test interface. Extracted noise
++	  data is not used to seed the random number generator.
++
++	  The raw noise data can be obtained using the lrng_raw_jiffies
++	  debugfs file. Using the option lrng_testing.boot_raw_jiffies_test=1
++	  the raw noise of the first 1000 entropy events since boot
++	  can be sampled.
++
++config LRNG_RAW_IRQ_ENTROPY
++	bool "Entropy test interface to IRQ number noise source"
++	depends on LRNG_IRQ
++	select LRNG_TESTING
++	select LRNG_TESTING_RECORDING
++	help
++	  The test interface allows a privileged process to capture
++	  the raw unconditioned interrupt number that is collected by
++	  the LRNG for statistical analysis. Extracted noise data is
++	  not used to seed the random number generator.
++
++	  The raw noise data can be obtained using the lrng_raw_irq
++	  debugfs file. Using the option lrng_testing.boot_raw_irq_test=1
++	  the raw noise of the first 1000 entropy events since boot
++	  can be sampled.
++
++config LRNG_RAW_RETIP_ENTROPY
++	bool "Entropy test interface to RETIP value of IRQ noise source"
++	depends on LRNG_IRQ
++	select LRNG_TESTING
++	select LRNG_TESTING_RECORDING
++	help
++	  The test interface allows a privileged process to capture
++	  the raw unconditioned return instruction pointer value
++	  that is collected by the LRNG for statistical analysis.
++	  Extracted noise data is not used to seed the random number
++	  generator.
++
++	  The raw noise data can be obtained using the lrng_raw_retip
++	  debugfs file. Using the option lrng_testing.boot_raw_retip_test=1
++	  the raw noise of the first 1000 entropy events since boot
++	  can be sampled.
++
++config LRNG_RAW_REGS_ENTROPY
++	bool "Entropy test interface to IRQ register value noise source"
++	depends on LRNG_IRQ
++	select LRNG_TESTING
++	select LRNG_TESTING_RECORDING
++	help
++	  The test interface allows a privileged process to capture
++	  the raw unconditioned interrupt register value that is
++	  collected by the LRNG for statistical analysis. Extracted noise
++	  data is not used to seed the random number generator.
++
++	  The raw noise data can be obtained using the lrng_raw_regs
++	  debugfs file. Using the option lrng_testing.boot_raw_regs_test=1
++	  the raw noise of the first 1000 entropy events since boot
++	  can be sampled.
++
++config LRNG_RAW_ARRAY
++	bool "Test interface to LRNG raw entropy IRQ storage array"
++	depends on LRNG_IRQ
++	select LRNG_TESTING
++	select LRNG_TESTING_RECORDING
++	help
++	  The test interface allows a privileged process to capture
++	  the raw noise data that is collected by the LRNG
++	  in the per-CPU array for statistical analysis. The purpose
++	  of this interface is to verify that the array handling code
++	  truly only concatenates data and provides the same entropy
++	  rate as the raw unconditioned noise source when assessing
++	  the collected data byte-wise.
++
++	  The data can be obtained using the lrng_raw_array debugfs
++	  file. Using the option lrng_testing.boot_raw_array=1
++	  the raw noise of the first 1000 entropy events since boot
++	  can be sampled.
++
++config LRNG_IRQ_PERF
++	bool "LRNG interrupt entropy source performance monitor"
++	depends on LRNG_IRQ
++	select LRNG_TESTING
++	select LRNG_TESTING_RECORDING
++	help
++	  With this option, the performance monitor of the LRNG
++	  interrupt handling code is enabled. The file provides
++	  the execution time of the interrupt handler in
++	  cycles.
++
++	  The interrupt performance data can be obtained using
++	  the lrng_irq_perf debugfs file. Using the option
++	  lrng_testing.boot_irq_perf=1 the performance data of
++	  the first 1000 entropy events since boot can be sampled.
++
++comment "Scheduler Entropy Source Test Interfaces"
++
++config LRNG_RAW_SCHED_HIRES_ENTROPY
++	bool "Interface to obtain raw unprocessed scheduler noise source data"
++	depends on LRNG_SCHED
++	select LRNG_TESTING
++	select LRNG_TESTING_RECORDING
++	help
++	  The test interface allows a privileged process to capture
++	  the raw unconditioned high resolution time stamp noise that
++	  is collected by the LRNG for the Scheduler-based noise source
++	  for statistical analysis. Extracted  noise data is not used to
++	  seed the LRNG.
++
++	  The raw noise data can be obtained using the lrng_raw_sched_hires
++	  debugfs file. Using the option
++	  lrng_testing.boot_raw_sched_hires_test=1 the raw noise of the
++	  first 1000 entropy events since boot can be sampled.
++
++config LRNG_RAW_SCHED_PID_ENTROPY
++	bool "Entropy test interface to PID value"
++	depends on LRNG_SCHED
++	select LRNG_TESTING
++	select LRNG_TESTING_RECORDING
++	help
++	  The test interface allows a privileged process to capture
++	  the raw unconditioned PID value that is collected by the
++	  LRNG for statistical analysis. Extracted noise
++	  data is not used to seed the random number generator.
++
++	  The raw noise data can be obtained using the
++	  lrng_raw_sched_pid debugfs file. Using the option
++	  lrng_testing.boot_raw_sched_pid_test=1
++	  the raw noise of the first 1000 entropy events since boot
++	  can be sampled.
++
++config LRNG_RAW_SCHED_START_TIME_ENTROPY
++	bool "Entropy test interface to task start time value"
++	depends on LRNG_SCHED
++	select LRNG_TESTING
++	select LRNG_TESTING_RECORDING
++	help
++	  The test interface allows a privileged process to capture
++	  the raw unconditioned task start time value that is collected
++	  by the LRNG for statistical analysis. Extracted noise
++	  data is not used to seed the random number generator.
++
++	  The raw noise data can be obtained using the
++	  lrng_raw_sched_starttime debugfs file. Using the option
++	  lrng_testing.boot_raw_sched_starttime_test=1
++	  the raw noise of the first 1000 entropy events since boot
++	  can be sampled.
++
++
++config LRNG_RAW_SCHED_NVCSW_ENTROPY
++	bool "Entropy test interface to task context switch numbers"
++	depends on LRNG_SCHED
++	select LRNG_TESTING
++	select LRNG_TESTING_RECORDING
++	help
++	  The test interface allows a privileged process to capture
++	  the raw unconditioned task numbers of context switches that
++	  are collected by the LRNG for statistical analysis. Extracted
++	  noise data is not used to seed the random number generator.
++
++	  The raw noise data can be obtained using the
++	  lrng_raw_sched_nvcsw debugfs file. Using the option
++	  lrng_testing.boot_raw_sched_nvcsw_test=1
++	  the raw noise of the first 1000 entropy events since boot
++	  can be sampled.
++
++config LRNG_SCHED_PERF
++	bool "LRNG scheduler entropy source performance monitor"
++	depends on LRNG_SCHED
++	select LRNG_TESTING
++	select LRNG_TESTING_RECORDING
++	help
++	  With this option, the performance monitor of the LRNG
++	  scheduler event handling code is enabled. The file provides
++	  the execution time of the interrupt handler in cycles.
++
++	  The scheduler performance data can be obtained using
++	  the lrng_sched_perf debugfs file. Using the option
++	  lrng_testing.boot_sched_perf=1 the performance data of
++	  the first 1000 entropy events since boot can be sampled.
++
++comment "Auxiliary Test Interfaces"
++
++config LRNG_ACVT_HASH
++	bool "Enable LRNG ACVT Hash interface"
++	select LRNG_TESTING
++	help
++	  With this option, the LRNG built-in hash function used for
++	  auxiliary pool management and prior to switching the
++	  cryptographic backends is made available for ACVT. The
++	  interface allows writing of the data to be hashed
++	  into the interface. The read operation triggers the hash
++	  operation to generate message digest.
++
++	  The ACVT interface is available with the lrng_acvt_hash
++	  debugfs file.
++
++config LRNG_RUNTIME_MAX_WO_RESEED_CONFIG
++	bool "Enable runtime configuration of max reseed threshold"
++	help
++	  When enabling this option, the LRNG provides an interface
++	  allowing the setting of the maximum number of DRNG generate
++	  operations without a reseed that has full entropy. The
++	  interface is lrng_drng.max_wo_reseed.
++
++config LRNG_RUNTIME_FORCE_SEEDING_DISABLE
++	bool "Enable runtime configuration of force seeding"
++	help
++	  When enabling this option, the LRNG provides an interface
++	  allowing the disabling of the force seeding when the DRNG
++	  is not fully seeded but entropy is available.
++
++config LRNG_TEST_CPU_ES_COMPRESSION
++	bool "Force CPU ES compression operation"
++	help
++	  When enabling this option, the CPU ES compression operation
++	  is forced by setting an arbitrary value > 1 for the data
++	  multiplier even when the CPU ES would deliver full entropy.
++	  This allows testing of the compression operation. It
++	  therefore forces to pull more data from the CPU ES
++	  than what may be required.
++
++endif #LRNG_TESTING_MENU
+ #
+ # config LRNG_SELFTEST
+ # 	bool "Enable power-on and on-demand self-tests"
+--- a/drivers/char/lrng/Makefile
++++ b/drivers/char/lrng/Makefile
+@@ -26,3 +26,4 @@ obj-$(CONFIG_LRNG_CPU)			+= lrng_es_cpu.
+ obj-$(CONFIG_LRNG_JENT)			+= lrng_es_jent.o
+ 
+ obj-$(CONFIG_LRNG_HEALTH_TESTS)		+= lrng_health.o
++obj-$(CONFIG_LRNG_TESTING)		+= lrng_testing.o
+--- /dev/null
++++ b/drivers/char/lrng/lrng_testing.c
+@@ -0,0 +1,901 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * LRNG testing interfaces to obtain raw entropy
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/lrng.h>
++#include <linux/atomic.h>
++#include <linux/bug.h>
++#include <linux/debugfs.h>
++#include <linux/module.h>
++#include <linux/sched.h>
++#include <linux/sched/signal.h>
++#include <linux/slab.h>
++#include <linux/string.h>
++#include <linux/types.h>
++#include <linux/uaccess.h>
++#include <linux/workqueue.h>
++#include <asm/errno.h>
++
++#include "lrng_definitions.h"
++#include "lrng_drng_chacha20.h"
++#include "lrng_sha.h"
++#include "lrng_testing.h"
++
++#if defined(CONFIG_LRNG_RAW_SCHED_HIRES_ENTROPY) ||		\
++    defined(CONFIG_LRNG_RAW_SCHED_PID_ENTROPY) ||		\
++    defined(CONFIG_LRNG_RAW_SCHED_START_TIME_ENTROPY) ||	\
++    defined(CONFIG_LRNG_RAW_SCHED_NVCSW_ENTROPY) ||		\
++    defined(CONFIG_LRNG_SCHED_PERF)
++#define LRNG_TESTING_USE_BUSYLOOP
++#endif
++
++#ifdef CONFIG_LRNG_TESTING_RECORDING
++
++#define LRNG_TESTING_RINGBUFFER_SIZE	1024
++#define LRNG_TESTING_RINGBUFFER_MASK	(LRNG_TESTING_RINGBUFFER_SIZE - 1)
++
++struct lrng_testing {
++	u32 lrng_testing_rb[LRNG_TESTING_RINGBUFFER_SIZE];
++	u32 rb_reader;
++	atomic_t rb_writer;
++	atomic_t lrng_testing_enabled;
++	spinlock_t lock;
++	wait_queue_head_t read_wait;
++};
++
++/*************************** Generic Data Handling ****************************/
++
++/*
++ * boot variable:
++ * 0 ==> No boot test, gathering of runtime data allowed
++ * 1 ==> Boot test enabled and ready for collecting data, gathering runtime
++ *	 data is disabled
++ * 2 ==> Boot test completed and disabled, gathering of runtime data is
++ *	 disabled
++ */
++
++static void lrng_testing_reset(struct lrng_testing *data)
++{
++	unsigned long flags;
++
++	spin_lock_irqsave(&data->lock, flags);
++	data->rb_reader = 0;
++	atomic_set(&data->rb_writer, 0);
++	spin_unlock_irqrestore(&data->lock, flags);
++}
++
++static void lrng_testing_init(struct lrng_testing *data, u32 boot)
++{
++	/*
++	 * The boot time testing implies we have a running test. If the
++	 * caller wants to clear it, he has to unset the boot_test flag
++	 * at runtime via sysfs to enable regular runtime testing
++	 */
++	if (boot)
++		return;
++
++	lrng_testing_reset(data);
++	atomic_set(&data->lrng_testing_enabled, 1);
++	pr_warn("Enabling data collection\n");
++}
++
++static void lrng_testing_fini(struct lrng_testing *data, u32 boot)
++{
++	/* If we have boot data, we do not reset yet to allow data to be read */
++	if (boot)
++		return;
++
++	atomic_set(&data->lrng_testing_enabled, 0);
++	lrng_testing_reset(data);
++	pr_warn("Disabling data collection\n");
++}
++
++static bool lrng_testing_store(struct lrng_testing *data, u32 value,
++			       u32 *boot)
++{
++	unsigned long flags;
++
++	if (!atomic_read(&data->lrng_testing_enabled) && (*boot != 1))
++		return false;
++
++	spin_lock_irqsave(&data->lock, flags);
++
++	/*
++	 * Disable entropy testing for boot time testing after ring buffer
++	 * is filled.
++	 */
++	if (*boot) {
++		if (((u32)atomic_read(&data->rb_writer)) >
++		    LRNG_TESTING_RINGBUFFER_SIZE) {
++			*boot = 2;
++			pr_warn_once("One time data collection test disabled\n");
++			spin_unlock_irqrestore(&data->lock, flags);
++			return false;
++		}
++
++		if (atomic_read(&data->rb_writer) == 1)
++			pr_warn("One time data collection test enabled\n");
++	}
++
++	data->lrng_testing_rb[((u32)atomic_read(&data->rb_writer)) &
++			      LRNG_TESTING_RINGBUFFER_MASK] = value;
++	atomic_inc(&data->rb_writer);
++
++	spin_unlock_irqrestore(&data->lock, flags);
++
++#ifndef LRNG_TESTING_USE_BUSYLOOP
++	if (wq_has_sleeper(&data->read_wait))
++		wake_up_interruptible(&data->read_wait);
++#endif
++
++	return true;
++}
++
++static bool lrng_testing_have_data(struct lrng_testing *data)
++{
++	return ((((u32)atomic_read(&data->rb_writer)) &
++		 LRNG_TESTING_RINGBUFFER_MASK) !=
++		 (data->rb_reader & LRNG_TESTING_RINGBUFFER_MASK));
++}
++
++static int lrng_testing_reader(struct lrng_testing *data, u32 *boot,
++			       u8 *outbuf, u32 outbuflen)
++{
++	unsigned long flags;
++	int collected_data = 0;
++
++	lrng_testing_init(data, *boot);
++
++	while (outbuflen) {
++		u32 writer = (u32)atomic_read(&data->rb_writer);
++
++		spin_lock_irqsave(&data->lock, flags);
++
++		/* We have no data or reached the writer. */
++		if (!writer || (writer == data->rb_reader)) {
++
++			spin_unlock_irqrestore(&data->lock, flags);
++
++			/*
++			 * Now we gathered all boot data, enable regular data
++			 * collection.
++			 */
++			if (*boot) {
++				*boot = 0;
++				goto out;
++			}
++
++#ifdef LRNG_TESTING_USE_BUSYLOOP
++			while (!lrng_testing_have_data(data))
++				;
++#else
++			wait_event_interruptible(data->read_wait,
++						 lrng_testing_have_data(data));
++#endif
++			if (signal_pending(current)) {
++				collected_data = -ERESTARTSYS;
++				goto out;
++			}
++
++			continue;
++		}
++
++		/* We copy out word-wise */
++		if (outbuflen < sizeof(u32)) {
++			spin_unlock_irqrestore(&data->lock, flags);
++			goto out;
++		}
++
++		memcpy(outbuf, &data->lrng_testing_rb[data->rb_reader],
++		       sizeof(u32));
++		data->rb_reader++;
++
++		spin_unlock_irqrestore(&data->lock, flags);
++
++		outbuf += sizeof(u32);
++		outbuflen -= sizeof(u32);
++		collected_data += sizeof(u32);
++	}
++
++out:
++	lrng_testing_fini(data, *boot);
++	return collected_data;
++}
++
++static int lrng_testing_extract_user(struct file *file, char __user *buf,
++				     size_t nbytes, loff_t *ppos,
++				     int (*reader)(u8 *outbuf, u32 outbuflen))
++{
++	u8 *tmp, *tmp_aligned;
++	int ret = 0, large_request = (nbytes > 256);
++
++	if (!nbytes)
++		return 0;
++
++	/*
++	 * The intention of this interface is for collecting at least
++	 * 1000 samples due to the SP800-90B requirements. So, we make no
++	 * effort in avoiding allocating more memory that actually needed
++	 * by the user. Hence, we allocate sufficient memory to always hold
++	 * that amount of data.
++	 */
++	tmp = kmalloc(LRNG_TESTING_RINGBUFFER_SIZE + sizeof(u32), GFP_KERNEL);
++	if (!tmp)
++		return -ENOMEM;
++
++	tmp_aligned = PTR_ALIGN(tmp, sizeof(u32));
++
++	while (nbytes) {
++		int i;
++
++		if (large_request && need_resched()) {
++			if (signal_pending(current)) {
++				if (ret == 0)
++					ret = -ERESTARTSYS;
++				break;
++			}
++			schedule();
++		}
++
++		i = min_t(int, nbytes, LRNG_TESTING_RINGBUFFER_SIZE);
++		i = reader(tmp_aligned, i);
++		if (i <= 0) {
++			if (i < 0)
++				ret = i;
++			break;
++		}
++		if (copy_to_user(buf, tmp_aligned, i)) {
++			ret = -EFAULT;
++			break;
++		}
++
++		nbytes -= i;
++		buf += i;
++		ret += i;
++	}
++
++	kfree_sensitive(tmp);
++
++	if (ret > 0)
++		*ppos += ret;
++
++	return ret;
++}
++
++#endif /* CONFIG_LRNG_TESTING_RECORDING */
++
++/************* Raw High-Resolution IRQ Timer Entropy Data Handling ************/
++
++#ifdef CONFIG_LRNG_RAW_HIRES_ENTROPY
++
++static u32 boot_raw_hires_test = 0;
++module_param(boot_raw_hires_test, uint, 0644);
++MODULE_PARM_DESC(boot_raw_hires_test, "Enable gathering boot time high resolution timer entropy of the first IRQ entropy events");
++
++static struct lrng_testing lrng_raw_hires = {
++	.rb_reader = 0,
++	.rb_writer = ATOMIC_INIT(0),
++	.lock      = __SPIN_LOCK_UNLOCKED(lrng_raw_hires.lock),
++	.read_wait = __WAIT_QUEUE_HEAD_INITIALIZER(lrng_raw_hires.read_wait)
++};
++
++bool lrng_raw_hires_entropy_store(u32 value)
++{
++	return lrng_testing_store(&lrng_raw_hires, value, &boot_raw_hires_test);
++}
++
++static int lrng_raw_hires_entropy_reader(u8 *outbuf, u32 outbuflen)
++{
++	return lrng_testing_reader(&lrng_raw_hires, &boot_raw_hires_test,
++				   outbuf, outbuflen);
++}
++
++static ssize_t lrng_raw_hires_read(struct file *file, char __user *to,
++				   size_t count, loff_t *ppos)
++{
++	return lrng_testing_extract_user(file, to, count, ppos,
++					 lrng_raw_hires_entropy_reader);
++}
++
++static const struct file_operations lrng_raw_hires_fops = {
++	.owner = THIS_MODULE,
++	.read = lrng_raw_hires_read,
++};
++
++#endif /* CONFIG_LRNG_RAW_HIRES_ENTROPY */
++
++/********************* Raw Jiffies Entropy Data Handling **********************/
++
++#ifdef CONFIG_LRNG_RAW_JIFFIES_ENTROPY
++
++static u32 boot_raw_jiffies_test = 0;
++module_param(boot_raw_jiffies_test, uint, 0644);
++MODULE_PARM_DESC(boot_raw_jiffies_test, "Enable gathering boot time high resolution timer entropy of the first entropy events");
++
++static struct lrng_testing lrng_raw_jiffies = {
++	.rb_reader = 0,
++	.rb_writer = ATOMIC_INIT(0),
++	.lock      = __SPIN_LOCK_UNLOCKED(lrng_raw_jiffies.lock),
++	.read_wait = __WAIT_QUEUE_HEAD_INITIALIZER(lrng_raw_jiffies.read_wait)
++};
++
++bool lrng_raw_jiffies_entropy_store(u32 value)
++{
++	return lrng_testing_store(&lrng_raw_jiffies, value,
++				  &boot_raw_jiffies_test);
++}
++
++static int lrng_raw_jiffies_entropy_reader(u8 *outbuf, u32 outbuflen)
++{
++	return lrng_testing_reader(&lrng_raw_jiffies, &boot_raw_jiffies_test,
++				   outbuf, outbuflen);
++}
++
++static ssize_t lrng_raw_jiffies_read(struct file *file, char __user *to,
++				   size_t count, loff_t *ppos)
++{
++	return lrng_testing_extract_user(file, to, count, ppos,
++					 lrng_raw_jiffies_entropy_reader);
++}
++
++static const struct file_operations lrng_raw_jiffies_fops = {
++	.owner = THIS_MODULE,
++	.read = lrng_raw_jiffies_read,
++};
++
++#endif /* CONFIG_LRNG_RAW_JIFFIES_ENTROPY */
++
++/************************** Raw IRQ Data Handling ****************************/
++
++#ifdef CONFIG_LRNG_RAW_IRQ_ENTROPY
++
++static u32 boot_raw_irq_test = 0;
++module_param(boot_raw_irq_test, uint, 0644);
++MODULE_PARM_DESC(boot_raw_irq_test, "Enable gathering boot time entropy of the first IRQ entropy events");
++
++static struct lrng_testing lrng_raw_irq = {
++	.rb_reader = 0,
++	.rb_writer = ATOMIC_INIT(0),
++	.lock      = __SPIN_LOCK_UNLOCKED(lrng_raw_irq.lock),
++	.read_wait = __WAIT_QUEUE_HEAD_INITIALIZER(lrng_raw_irq.read_wait)
++};
++
++bool lrng_raw_irq_entropy_store(u32 value)
++{
++	return lrng_testing_store(&lrng_raw_irq, value, &boot_raw_irq_test);
++}
++
++static int lrng_raw_irq_entropy_reader(u8 *outbuf, u32 outbuflen)
++{
++	return lrng_testing_reader(&lrng_raw_irq, &boot_raw_irq_test, outbuf,
++				   outbuflen);
++}
++
++static ssize_t lrng_raw_irq_read(struct file *file, char __user *to,
++				 size_t count, loff_t *ppos)
++{
++	return lrng_testing_extract_user(file, to, count, ppos,
++					 lrng_raw_irq_entropy_reader);
++}
++
++static const struct file_operations lrng_raw_irq_fops = {
++	.owner = THIS_MODULE,
++	.read = lrng_raw_irq_read,
++};
++
++#endif /* CONFIG_LRNG_RAW_IRQ_ENTROPY */
++
++/************************ Raw _RET_IP_ Data Handling **************************/
++
++#ifdef CONFIG_LRNG_RAW_RETIP_ENTROPY
++
++static u32 boot_raw_retip_test = 0;
++module_param(boot_raw_retip_test, uint, 0644);
++MODULE_PARM_DESC(boot_raw_retip_test, "Enable gathering boot time entropy of the first return instruction pointer entropy events");
++
++static struct lrng_testing lrng_raw_retip = {
++	.rb_reader = 0,
++	.rb_writer = ATOMIC_INIT(0),
++	.lock      = __SPIN_LOCK_UNLOCKED(lrng_raw_retip.lock),
++	.read_wait = __WAIT_QUEUE_HEAD_INITIALIZER(lrng_raw_retip.read_wait)
++};
++
++bool lrng_raw_retip_entropy_store(u32 value)
++{
++	return lrng_testing_store(&lrng_raw_retip, value, &boot_raw_retip_test);
++}
++
++static int lrng_raw_retip_entropy_reader(u8 *outbuf, u32 outbuflen)
++{
++	return lrng_testing_reader(&lrng_raw_retip, &boot_raw_retip_test,
++				   outbuf, outbuflen);
++}
++
++static ssize_t lrng_raw_retip_read(struct file *file, char __user *to,
++				   size_t count, loff_t *ppos)
++{
++	return lrng_testing_extract_user(file, to, count, ppos,
++					 lrng_raw_retip_entropy_reader);
++}
++
++static const struct file_operations lrng_raw_retip_fops = {
++	.owner = THIS_MODULE,
++	.read = lrng_raw_retip_read,
++};
++
++#endif /* CONFIG_LRNG_RAW_RETIP_ENTROPY */
++
++/********************** Raw IRQ register Data Handling ************************/
++
++#ifdef CONFIG_LRNG_RAW_REGS_ENTROPY
++
++static u32 boot_raw_regs_test = 0;
++module_param(boot_raw_regs_test, uint, 0644);
++MODULE_PARM_DESC(boot_raw_regs_test, "Enable gathering boot time entropy of the first interrupt register entropy events");
++
++static struct lrng_testing lrng_raw_regs = {
++	.rb_reader = 0,
++	.rb_writer = ATOMIC_INIT(0),
++	.lock      = __SPIN_LOCK_UNLOCKED(lrng_raw_regs.lock),
++	.read_wait = __WAIT_QUEUE_HEAD_INITIALIZER(lrng_raw_regs.read_wait)
++};
++
++bool lrng_raw_regs_entropy_store(u32 value)
++{
++	return lrng_testing_store(&lrng_raw_regs, value, &boot_raw_regs_test);
++}
++
++static int lrng_raw_regs_entropy_reader(u8 *outbuf, u32 outbuflen)
++{
++	return lrng_testing_reader(&lrng_raw_regs, &boot_raw_regs_test,
++				   outbuf, outbuflen);
++}
++
++static ssize_t lrng_raw_regs_read(struct file *file, char __user *to,
++				  size_t count, loff_t *ppos)
++{
++	return lrng_testing_extract_user(file, to, count, ppos,
++					 lrng_raw_regs_entropy_reader);
++}
++
++static const struct file_operations lrng_raw_regs_fops = {
++	.owner = THIS_MODULE,
++	.read = lrng_raw_regs_read,
++};
++
++#endif /* CONFIG_LRNG_RAW_REGS_ENTROPY */
++
++/********************** Raw Entropy Array Data Handling ***********************/
++
++#ifdef CONFIG_LRNG_RAW_ARRAY
++
++static u32 boot_raw_array = 0;
++module_param(boot_raw_array, uint, 0644);
++MODULE_PARM_DESC(boot_raw_array, "Enable gathering boot time raw noise array data of the first entropy events");
++
++static struct lrng_testing lrng_raw_array = {
++	.rb_reader = 0,
++	.rb_writer = ATOMIC_INIT(0),
++	.lock      = __SPIN_LOCK_UNLOCKED(lrng_raw_array.lock),
++	.read_wait = __WAIT_QUEUE_HEAD_INITIALIZER(lrng_raw_array.read_wait)
++};
++
++bool lrng_raw_array_entropy_store(u32 value)
++{
++	return lrng_testing_store(&lrng_raw_array, value, &boot_raw_array);
++}
++
++static int lrng_raw_array_entropy_reader(u8 *outbuf, u32 outbuflen)
++{
++	return lrng_testing_reader(&lrng_raw_array, &boot_raw_array, outbuf,
++				   outbuflen);
++}
++
++static ssize_t lrng_raw_array_read(struct file *file, char __user *to,
++				   size_t count, loff_t *ppos)
++{
++	return lrng_testing_extract_user(file, to, count, ppos,
++					 lrng_raw_array_entropy_reader);
++}
++
++static const struct file_operations lrng_raw_array_fops = {
++	.owner = THIS_MODULE,
++	.read = lrng_raw_array_read,
++};
++
++#endif /* CONFIG_LRNG_RAW_ARRAY */
++
++/******************** Interrupt Performance Data Handling *********************/
++
++#ifdef CONFIG_LRNG_IRQ_PERF
++
++static u32 boot_irq_perf = 0;
++module_param(boot_irq_perf, uint, 0644);
++MODULE_PARM_DESC(boot_irq_perf, "Enable gathering interrupt entropy source performance data");
++
++static struct lrng_testing lrng_irq_perf = {
++	.rb_reader = 0,
++	.rb_writer = ATOMIC_INIT(0),
++	.lock      = __SPIN_LOCK_UNLOCKED(lrng_irq_perf.lock),
++	.read_wait = __WAIT_QUEUE_HEAD_INITIALIZER(lrng_irq_perf.read_wait)
++};
++
++bool lrng_perf_time(u32 start)
++{
++	return lrng_testing_store(&lrng_irq_perf, random_get_entropy() - start,
++				  &boot_irq_perf);
++}
++
++static int lrng_irq_perf_reader(u8 *outbuf, u32 outbuflen)
++{
++	return lrng_testing_reader(&lrng_irq_perf, &boot_irq_perf, outbuf,
++				   outbuflen);
++}
++
++static ssize_t lrng_irq_perf_read(struct file *file, char __user *to,
++				  size_t count, loff_t *ppos)
++{
++	return lrng_testing_extract_user(file, to, count, ppos,
++					 lrng_irq_perf_reader);
++}
++
++static const struct file_operations lrng_irq_perf_fops = {
++	.owner = THIS_MODULE,
++	.read = lrng_irq_perf_read,
++};
++
++#endif /* CONFIG_LRNG_IRQ_PERF */
++
++/****** Raw High-Resolution Scheduler-based Timer Entropy Data Handling *******/
++
++#ifdef CONFIG_LRNG_RAW_SCHED_HIRES_ENTROPY
++
++static u32 boot_raw_sched_hires_test = 0;
++module_param(boot_raw_sched_hires_test, uint, 0644);
++MODULE_PARM_DESC(boot_raw_sched_hires_test, "Enable gathering boot time high resolution timer entropy of the first Scheduler-based entropy events");
++
++static struct lrng_testing lrng_raw_sched_hires = {
++	.rb_reader = 0,
++	.rb_writer = ATOMIC_INIT(0),
++	.lock      = __SPIN_LOCK_UNLOCKED(lrng_raw_sched_hires.lock),
++	.read_wait =
++		__WAIT_QUEUE_HEAD_INITIALIZER(lrng_raw_sched_hires.read_wait)
++};
++
++bool lrng_raw_sched_hires_entropy_store(u32 value)
++{
++	return lrng_testing_store(&lrng_raw_sched_hires, value,
++				  &boot_raw_sched_hires_test);
++}
++
++static int lrng_raw_sched_hires_entropy_reader(u8 *outbuf, u32 outbuflen)
++{
++	return lrng_testing_reader(&lrng_raw_sched_hires,
++				   &boot_raw_sched_hires_test,
++				   outbuf, outbuflen);
++}
++
++static ssize_t lrng_raw_sched_hires_read(struct file *file, char __user *to,
++					 size_t count, loff_t *ppos)
++{
++	return lrng_testing_extract_user(file, to, count, ppos,
++					 lrng_raw_sched_hires_entropy_reader);
++}
++
++static const struct file_operations lrng_raw_sched_hires_fops = {
++	.owner = THIS_MODULE,
++	.read = lrng_raw_sched_hires_read,
++};
++
++#endif /* CONFIG_LRNG_RAW_SCHED_HIRES_ENTROPY */
++
++/******************** Interrupt Performance Data Handling *********************/
++
++#ifdef CONFIG_LRNG_SCHED_PERF
++
++static u32 boot_sched_perf = 0;
++module_param(boot_sched_perf, uint, 0644);
++MODULE_PARM_DESC(boot_sched_perf, "Enable gathering scheduler-based entropy source performance data");
++
++static struct lrng_testing lrng_sched_perf = {
++	.rb_reader = 0,
++	.rb_writer = ATOMIC_INIT(0),
++	.lock      = __SPIN_LOCK_UNLOCKED(lrng_sched_perf.lock),
++	.read_wait = __WAIT_QUEUE_HEAD_INITIALIZER(lrng_sched_perf.read_wait)
++};
++
++bool lrng_sched_perf_time(u32 start)
++{
++	return lrng_testing_store(&lrng_sched_perf, random_get_entropy() - start,
++				  &boot_sched_perf);
++}
++
++static int lrng_sched_perf_reader(u8 *outbuf, u32 outbuflen)
++{
++	return lrng_testing_reader(&lrng_sched_perf, &boot_sched_perf, outbuf,
++				   outbuflen);
++}
++
++static ssize_t lrng_sched_perf_read(struct file *file, char __user *to,
++				    size_t count, loff_t *ppos)
++{
++	return lrng_testing_extract_user(file, to, count, ppos,
++					 lrng_sched_perf_reader);
++}
++
++static const struct file_operations lrng_sched_perf_fops = {
++	.owner = THIS_MODULE,
++	.read = lrng_sched_perf_read,
++};
++
++#endif /* CONFIG_LRNG_SCHED_PERF */
++
++/*************** Raw Scheduler task_struct->pid Data Handling *****************/
++
++#ifdef CONFIG_LRNG_RAW_SCHED_PID_ENTROPY
++
++static u32 boot_raw_sched_pid_test = 0;
++module_param(boot_raw_sched_pid_test, uint, 0644);
++MODULE_PARM_DESC(boot_raw_sched_pid_test, "Enable gathering boot time entropy of the first PIDs collected by the scheduler entropy source");
++
++static struct lrng_testing lrng_raw_sched_pid = {
++	.rb_reader = 0,
++	.rb_writer = ATOMIC_INIT(0),
++	.lock      = __SPIN_LOCK_UNLOCKED(lrng_raw_sched_pid.lock),
++	.read_wait = __WAIT_QUEUE_HEAD_INITIALIZER(lrng_raw_sched_pid.read_wait)
++};
++
++bool lrng_raw_sched_pid_entropy_store(u32 value)
++{
++	return lrng_testing_store(&lrng_raw_sched_pid, value,
++				  &boot_raw_sched_pid_test);
++}
++
++static int lrng_raw_sched_pid_entropy_reader(u8 *outbuf, u32 outbuflen)
++{
++	return lrng_testing_reader(&lrng_raw_sched_pid,
++				   &boot_raw_sched_pid_test, outbuf, outbuflen);
++}
++
++static ssize_t lrng_raw_sched_pid_read(struct file *file, char __user *to,
++				       size_t count, loff_t *ppos)
++{
++	return lrng_testing_extract_user(file, to, count, ppos,
++					 lrng_raw_sched_pid_entropy_reader);
++}
++
++static const struct file_operations lrng_raw_sched_pid_fops = {
++	.owner = THIS_MODULE,
++	.read = lrng_raw_sched_pid_read,
++};
++
++#endif /* CONFIG_LRNG_RAW_SCHED_PID_ENTROPY */
++
++
++/*********** Raw Scheduler task_struct->start_time Data Handling **************/
++
++#ifdef CONFIG_LRNG_RAW_SCHED_START_TIME_ENTROPY
++
++static u32 boot_raw_sched_starttime_test = 0;
++module_param(boot_raw_sched_starttime_test, uint, 0644);
++MODULE_PARM_DESC(boot_raw_sched_starttime_test, "Enable gathering boot time entropy of the first task start times collected by the scheduler entropy source");
++
++static struct lrng_testing lrng_raw_sched_starttime = {
++	.rb_reader = 0,
++	.rb_writer = ATOMIC_INIT(0),
++	.lock      = __SPIN_LOCK_UNLOCKED(lrng_raw_sched_starttime.lock),
++	.read_wait = __WAIT_QUEUE_HEAD_INITIALIZER(lrng_raw_sched_starttime.read_wait)
++};
++
++bool lrng_raw_sched_starttime_entropy_store(u32 value)
++{
++	return lrng_testing_store(&lrng_raw_sched_starttime, value,
++				  &boot_raw_sched_starttime_test);
++}
++
++static int lrng_raw_sched_starttime_entropy_reader(u8 *outbuf, u32 outbuflen)
++{
++	return lrng_testing_reader(&lrng_raw_sched_starttime,
++				   &boot_raw_sched_starttime_test, outbuf, outbuflen);
++}
++
++static ssize_t lrng_raw_sched_starttime_read(struct file *file, char __user *to,
++				       size_t count, loff_t *ppos)
++{
++	return lrng_testing_extract_user(file, to, count, ppos,
++					 lrng_raw_sched_starttime_entropy_reader);
++}
++
++static const struct file_operations lrng_raw_sched_starttime_fops = {
++	.owner = THIS_MODULE,
++	.read = lrng_raw_sched_starttime_read,
++};
++
++#endif /* CONFIG_LRNG_RAW_SCHED_START_TIME_ENTROPY */
++
++/************** Raw Scheduler task_struct->nvcsw Data Handling ****************/
++
++#ifdef CONFIG_LRNG_RAW_SCHED_NVCSW_ENTROPY
++
++static u32 boot_raw_sched_nvcsw_test = 0;
++module_param(boot_raw_sched_nvcsw_test, uint, 0644);
++MODULE_PARM_DESC(boot_raw_sched_nvcsw_test, "Enable gathering boot time entropy of the first task context switch numbers collected by the scheduler entropy source");
++
++static struct lrng_testing lrng_raw_sched_nvcsw = {
++	.rb_reader = 0,
++	.rb_writer = ATOMIC_INIT(0),
++	.lock      = __SPIN_LOCK_UNLOCKED(lrng_raw_sched_nvcsw.lock),
++	.read_wait = __WAIT_QUEUE_HEAD_INITIALIZER(lrng_raw_sched_nvcsw.read_wait)
++};
++
++bool lrng_raw_sched_nvcsw_entropy_store(u32 value)
++{
++	return lrng_testing_store(&lrng_raw_sched_nvcsw, value,
++				  &boot_raw_sched_nvcsw_test);
++}
++
++static int lrng_raw_sched_nvcsw_entropy_reader(u8 *outbuf, u32 outbuflen)
++{
++	return lrng_testing_reader(&lrng_raw_sched_nvcsw,
++				   &boot_raw_sched_nvcsw_test, outbuf, outbuflen);
++}
++
++static ssize_t lrng_raw_sched_nvcsw_read(struct file *file, char __user *to,
++				       size_t count, loff_t *ppos)
++{
++	return lrng_testing_extract_user(file, to, count, ppos,
++					 lrng_raw_sched_nvcsw_entropy_reader);
++}
++
++static const struct file_operations lrng_raw_sched_nvcsw_fops = {
++	.owner = THIS_MODULE,
++	.read = lrng_raw_sched_nvcsw_read,
++};
++
++#endif /* CONFIG_LRNG_RAW_SCHED_NVCSW_ENTROPY */
++
++/*********************************** ACVT ************************************/
++
++#ifdef CONFIG_LRNG_ACVT_HASH
++
++/* maximum amount of data to be hashed as defined by ACVP */
++#define LRNG_ACVT_MAX_SHA_MSG	(65536 >> 3)
++
++/*
++ * As we use static variables to store the data, it is clear that the
++ * test interface is only able to handle single threaded testing. This is
++ * considered to be sufficient for testing. If multi-threaded use of the
++ * ACVT test interface would be performed, the caller would get garbage
++ * but the kernel operation is unaffected by this.
++ */
++static u8 lrng_acvt_hash_data[LRNG_ACVT_MAX_SHA_MSG]
++						__aligned(LRNG_KCAPI_ALIGN);
++static atomic_t lrng_acvt_hash_data_size = ATOMIC_INIT(0);
++static u8 lrng_acvt_hash_digest[LRNG_ATOMIC_DIGEST_SIZE];
++
++static ssize_t lrng_acvt_hash_write(struct file *file, const char __user *buf,
++				    size_t nbytes, loff_t *ppos)
++{
++	if (nbytes > LRNG_ACVT_MAX_SHA_MSG)
++		return -EINVAL;
++
++	atomic_set(&lrng_acvt_hash_data_size, (int)nbytes);
++
++	return simple_write_to_buffer(lrng_acvt_hash_data,
++				      LRNG_ACVT_MAX_SHA_MSG, ppos, buf, nbytes);
++}
++
++static ssize_t lrng_acvt_hash_read(struct file *file, char __user *to,
++				   size_t count, loff_t *ppos)
++{
++	SHASH_DESC_ON_STACK(shash, NULL);
++	const struct lrng_hash_cb *hash_cb = &lrng_sha_hash_cb;
++	ssize_t ret;
++
++	if (count > LRNG_ATOMIC_DIGEST_SIZE)
++		return -EINVAL;
++
++	ret = hash_cb->hash_init(shash, NULL) ?:
++	      hash_cb->hash_update(shash, lrng_acvt_hash_data,
++				atomic_read_u32(&lrng_acvt_hash_data_size)) ?:
++	      hash_cb->hash_final(shash, lrng_acvt_hash_digest);
++	if (ret)
++		return ret;
++
++	return simple_read_from_buffer(to, count, ppos, lrng_acvt_hash_digest,
++				       sizeof(lrng_acvt_hash_digest));
++}
++
++static const struct file_operations lrng_acvt_hash_fops = {
++	.owner = THIS_MODULE,
++	.open = simple_open,
++	.llseek = default_llseek,
++	.read = lrng_acvt_hash_read,
++	.write = lrng_acvt_hash_write,
++};
++
++#endif /* CONFIG_LRNG_ACVT_DRNG */
++
++/**************************************************************************
++ * Debugfs interface
++ **************************************************************************/
++
++static int __init lrng_raw_init(void)
++{
++	struct dentry *lrng_raw_debugfs_root;
++
++	lrng_raw_debugfs_root = debugfs_create_dir(KBUILD_MODNAME, NULL);
++
++#ifdef CONFIG_LRNG_RAW_HIRES_ENTROPY
++	debugfs_create_file_unsafe("lrng_raw_hires", 0400,
++				   lrng_raw_debugfs_root, NULL,
++				   &lrng_raw_hires_fops);
++#endif
++#ifdef CONFIG_LRNG_RAW_JIFFIES_ENTROPY
++	debugfs_create_file_unsafe("lrng_raw_jiffies", 0400,
++				   lrng_raw_debugfs_root, NULL,
++				   &lrng_raw_jiffies_fops);
++#endif
++#ifdef CONFIG_LRNG_RAW_IRQ_ENTROPY
++	debugfs_create_file_unsafe("lrng_raw_irq", 0400, lrng_raw_debugfs_root,
++				   NULL, &lrng_raw_irq_fops);
++#endif
++#ifdef CONFIG_LRNG_RAW_RETIP_ENTROPY
++	debugfs_create_file_unsafe("lrng_raw_retip", 0400,
++				   lrng_raw_debugfs_root, NULL,
++				   &lrng_raw_retip_fops);
++#endif
++#ifdef CONFIG_LRNG_RAW_REGS_ENTROPY
++	debugfs_create_file_unsafe("lrng_raw_regs", 0400,
++				   lrng_raw_debugfs_root, NULL,
++				   &lrng_raw_regs_fops);
++#endif
++#ifdef CONFIG_LRNG_RAW_ARRAY
++	debugfs_create_file_unsafe("lrng_raw_array", 0400,
++				   lrng_raw_debugfs_root, NULL,
++				   &lrng_raw_array_fops);
++#endif
++#ifdef CONFIG_LRNG_IRQ_PERF
++	debugfs_create_file_unsafe("lrng_irq_perf", 0400, lrng_raw_debugfs_root,
++				   NULL, &lrng_irq_perf_fops);
++#endif
++#ifdef CONFIG_LRNG_RAW_SCHED_HIRES_ENTROPY
++	debugfs_create_file_unsafe("lrng_raw_sched_hires", 0400,
++				   lrng_raw_debugfs_root,
++				   NULL, &lrng_raw_sched_hires_fops);
++#endif
++#ifdef CONFIG_LRNG_RAW_SCHED_PID_ENTROPY
++	debugfs_create_file_unsafe("lrng_raw_sched_pid", 0400,
++				   lrng_raw_debugfs_root, NULL,
++				   &lrng_raw_sched_pid_fops);
++#endif
++#ifdef CONFIG_LRNG_RAW_SCHED_START_TIME_ENTROPY
++	debugfs_create_file_unsafe("lrng_raw_sched_starttime", 0400,
++				   lrng_raw_debugfs_root, NULL,
++				   &lrng_raw_sched_starttime_fops);
++#endif
++#ifdef CONFIG_LRNG_RAW_SCHED_NVCSW_ENTROPY
++	debugfs_create_file_unsafe("lrng_raw_sched_nvcsw", 0400,
++				   lrng_raw_debugfs_root, NULL,
++				   &lrng_raw_sched_nvcsw_fops);
++#endif
++#ifdef CONFIG_LRNG_SCHED_PERF
++	debugfs_create_file_unsafe("lrng_sched_perf", 0400,
++				   lrng_raw_debugfs_root, NULL,
++				   &lrng_sched_perf_fops);
++#endif
++#ifdef CONFIG_LRNG_ACVT_HASH
++	debugfs_create_file_unsafe("lrng_acvt_hash", 0600,
++				   lrng_raw_debugfs_root, NULL,
++				   &lrng_acvt_hash_fops);
++#endif
++
++	return 0;
++}
++
++module_init(lrng_raw_init);
+From 6c02564f6cdabbb5a463e0b10438d61a055e93d9 Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Sun, 15 May 2022 18:13:56 +0200
+Subject: [PATCH 20/25] LRNG - add power-on and runtime self-tests
+
+Parts of the LRNG are already covered by self-tests, including:
+
+* Self-test of SP800-90A DRBG provided by the Linux kernel crypto API.
+
+* Self-test of the PRNG provided by the Linux kernel crypto API.
+
+* Raw noise source data testing including SP800-90B compliant
+  tests when enabling CONFIG_LRNG_HEALTH_TESTS
+
+This patch adds the self-tests for the remaining critical functions of
+the LRNG that are essential to maintain entropy and provide
+cryptographic strong random numbers. The following self-tests are
+implemented:
+
+* Self-test of the time array maintenance. This test verifies whether
+the time stamp array management to store multiple values in one integer
+implements a concatenation of the data.
+
+* Self-test of the software hash implementation ensures that this
+function operates compliant to the FIPS 180-4 specification. The
+self-test performs a hash operation of a zeroized per-CPU data array.
+
+* Self-test of the ChaCha20 DRNG is based on the self-tests that are
+already present and implemented with the stand-alone user space
+ChaCha20 DRNG implementation available at [1]. The self-tests cover
+different use cases of the DRNG seeded with known seed data.
+
+The status of the LRNG self-tests is provided with the selftest_status
+SysFS file. If the file contains a zero, the self-tests passed. The
+value 0xffffffff means that the self-tests were not executed. Any other
+value indicates a self-test failure.
+
+The self-test may be compiled to panic the system if the self-test
+fails.
+
+All self-tests operate on private state data structures. This implies
+that none of the self-tests have any impact on the regular LRNG
+operations. This allows the self-tests to be repeated at runtime by
+writing anything into the selftest_status SysFS file.
+
+[1] https://www.chronox.de/chacha20.html
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+---
+ drivers/char/lrng/Kconfig         |  52 ++--
+ drivers/char/lrng/Makefile        |   1 +
+ drivers/char/lrng/lrng_selftest.c | 397 ++++++++++++++++++++++++++++++
+ 3 files changed, 424 insertions(+), 26 deletions(-)
+ create mode 100644 drivers/char/lrng/lrng_selftest.c
+
+--- a/drivers/char/lrng/Kconfig
++++ b/drivers/char/lrng/Kconfig
+@@ -985,32 +985,32 @@ config LRNG_TEST_CPU_ES_COMPRESSION
+ 	  than what may be required.
+ 
+ endif #LRNG_TESTING_MENU
+-#
+-# config LRNG_SELFTEST
+-# 	bool "Enable power-on and on-demand self-tests"
+-# 	help
+-# 	  The power-on self-tests are executed during boot time
+-# 	  covering the ChaCha20 DRNG, the hash operation used for
+-# 	  processing the entropy pools and the auxiliary pool, and
+-# 	  the time stamp management of the LRNG.
+-#
+-# 	  The on-demand self-tests are triggered by writing any
+-# 	  value into the SysFS file selftest_status. At the same
+-# 	  time, when reading this file, the test status is
+-# 	  returned. A zero indicates that all tests were executed
+-# 	  successfully.
+-#
+-# 	  If unsure, say Y.
+-#
+-# if LRNG_SELFTEST
+-#
+-# config LRNG_SELFTEST_PANIC
+-# 	bool "Panic the kernel upon self-test failure"
+-# 	help
+-# 	  If the option is enabled, the kernel is terminated if an
+-# 	  LRNG power-on self-test failure is detected.
+-#
+-# endif # LRNG_SELFTEST
++
++config LRNG_SELFTEST
++	bool "Enable power-on and on-demand self-tests"
++	help
++	  The power-on self-tests are executed during boot time
++	  covering the ChaCha20 DRNG, the hash operation used for
++	  processing the entropy pools and the auxiliary pool, and
++	  the time stamp management of the LRNG.
++
++	  The on-demand self-tests are triggered by writing any
++	  value into the SysFS file selftest_status. At the same
++	  time, when reading this file, the test status is
++	  returned. A zero indicates that all tests were executed
++	  successfully.
++
++	  If unsure, say Y.
++
++if LRNG_SELFTEST
++
++config LRNG_SELFTEST_PANIC
++	bool "Panic the kernel upon self-test failure"
++	help
++	  If the option is enabled, the kernel is terminated if an
++	  LRNG power-on self-test failure is detected.
++
++endif # LRNG_SELFTEST
+ 
+ endif # LRNG
+ 
+--- a/drivers/char/lrng/Makefile
++++ b/drivers/char/lrng/Makefile
+@@ -27,3 +27,4 @@ obj-$(CONFIG_LRNG_JENT)			+= lrng_es_jen
+ 
+ obj-$(CONFIG_LRNG_HEALTH_TESTS)		+= lrng_health.o
+ obj-$(CONFIG_LRNG_TESTING)		+= lrng_testing.o
++obj-$(CONFIG_LRNG_SELFTEST)		+= lrng_selftest.o
+--- /dev/null
++++ b/drivers/char/lrng/lrng_selftest.c
+@@ -0,0 +1,397 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * LRNG power-on and on-demand self-test
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++/*
++ * In addition to the self-tests below, the following LRNG components
++ * are covered with self-tests during regular operation:
++ *
++ * * power-on self-test: SP800-90A DRBG provided by the Linux kernel crypto API
++ * * power-on self-test: PRNG provided by the Linux kernel crypto API
++ * * runtime test: Raw noise source data testing including SP800-90B compliant
++ *		   tests when enabling CONFIG_LRNG_HEALTH_TESTS
++ *
++ * Additional developer tests present with LRNG code:
++ * * SP800-90B APT and RCT test enforcement validation when enabling
++ *   CONFIG_LRNG_APT_BROKEN or CONFIG_LRNG_RCT_BROKEN.
++ * * Collection of raw entropy from the interrupt noise source when enabling
++ *   CONFIG_LRNG_TESTING and pulling the data from the kernel with the provided
++ *   interface.
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/lrng.h>
++#include <linux/module.h>
++#include <linux/slab.h>
++
++#include "lrng_drng_chacha20.h"
++#include "lrng_sha.h"
++
++#define LRNG_SELFTEST_PASSED		0
++#define LRNG_SEFLTEST_ERROR_TIME	(1 << 0)
++#define LRNG_SEFLTEST_ERROR_CHACHA20	(1 << 1)
++#define LRNG_SEFLTEST_ERROR_HASH	(1 << 2)
++#define LRNG_SEFLTEST_ERROR_GCD		(1 << 3)
++#define LRNG_SELFTEST_NOT_EXECUTED	0xffffffff
++
++#ifdef CONFIG_LRNG_TIMER_COMMON
++
++#include "lrng_es_timer_common.h"
++
++static u32 lrng_data_selftest_ptr = 0;
++static u32 lrng_data_selftest[LRNG_DATA_ARRAY_SIZE];
++
++static void lrng_data_process_selftest_insert(u32 time)
++{
++	u32 ptr = lrng_data_selftest_ptr++ & LRNG_DATA_WORD_MASK;
++	unsigned int array = lrng_data_idx2array(ptr);
++	unsigned int slot = lrng_data_idx2slot(ptr);
++
++	/* zeroization of slot to ensure the following OR adds the data */
++	lrng_data_selftest[array] &=
++		~(lrng_data_slot_val(0xffffffff & LRNG_DATA_SLOTSIZE_MASK,
++				     slot));
++	lrng_data_selftest[array] |=
++		lrng_data_slot_val(time & LRNG_DATA_SLOTSIZE_MASK, slot);
++}
++
++static void lrng_data_process_selftest_u32(u32 data)
++{
++	u32 pre_ptr, ptr, mask;
++	unsigned int pre_array;
++
++	/* Increment pointer by number of slots taken for input value */
++	lrng_data_selftest_ptr += LRNG_DATA_SLOTS_PER_UINT;
++
++	/* ptr to current unit */
++	ptr = lrng_data_selftest_ptr;
++
++	lrng_data_split_u32(&ptr, &pre_ptr, &mask);
++
++	/* MSB of data go into previous unit */
++	pre_array = lrng_data_idx2array(pre_ptr);
++	/* zeroization of slot to ensure the following OR adds the data */
++	lrng_data_selftest[pre_array] &= ~(0xffffffff & ~mask);
++	lrng_data_selftest[pre_array] |= data & ~mask;
++
++	/* LSB of data go into current unit */
++	lrng_data_selftest[lrng_data_idx2array(ptr)] = data & mask;
++}
++
++static unsigned int lrng_data_process_selftest(void)
++{
++	u32 time;
++	u32 idx_zero_compare = (0 << 0) | (1 << 8) | (2 << 16) | (3 << 24);
++	u32 idx_one_compare  = (4 << 0) | (5 << 8) | (6 << 16) | (7 << 24);
++	u32 idx_last_compare =
++		(((LRNG_DATA_NUM_VALUES - 4) & LRNG_DATA_SLOTSIZE_MASK) << 0)  |
++		(((LRNG_DATA_NUM_VALUES - 3) & LRNG_DATA_SLOTSIZE_MASK) << 8)  |
++		(((LRNG_DATA_NUM_VALUES - 2) & LRNG_DATA_SLOTSIZE_MASK) << 16) |
++		(((LRNG_DATA_NUM_VALUES - 1) & LRNG_DATA_SLOTSIZE_MASK) << 24);
++
++	(void)idx_one_compare;
++
++	/* "poison" the array to verify the operation of the zeroization */
++	lrng_data_selftest[0] = 0xffffffff;
++	lrng_data_selftest[1] = 0xffffffff;
++
++	lrng_data_process_selftest_insert(0);
++	/*
++	 * Note, when using lrng_data_process_u32() on unaligned ptr,
++	 * the first slots will go into next word, and the last slots go
++	 * into the previous word.
++	 */
++	lrng_data_process_selftest_u32((4 << 0) | (1 << 8) | (2 << 16) |
++				       (3 << 24));
++	lrng_data_process_selftest_insert(5);
++	lrng_data_process_selftest_insert(6);
++	lrng_data_process_selftest_insert(7);
++
++	if ((lrng_data_selftest[0] != idx_zero_compare) ||
++	    (lrng_data_selftest[1] != idx_one_compare))
++		goto err;
++
++	/* Reset for next test */
++	lrng_data_selftest[0] = 0;
++	lrng_data_selftest[1] = 0;
++	lrng_data_selftest_ptr = 0;
++
++	for (time = 0; time < LRNG_DATA_NUM_VALUES; time++)
++		lrng_data_process_selftest_insert(time);
++
++	if ((lrng_data_selftest[0] != idx_zero_compare) ||
++	    (lrng_data_selftest[1] != idx_one_compare)  ||
++	    (lrng_data_selftest[LRNG_DATA_ARRAY_SIZE - 1] != idx_last_compare))
++		goto err;
++
++	return LRNG_SELFTEST_PASSED;
++
++err:
++	pr_err("LRNG data array self-test FAILED\n");
++	return LRNG_SEFLTEST_ERROR_TIME;
++}
++
++static unsigned int lrng_gcd_selftest(void)
++{
++	u32 history[10];
++	unsigned int i;
++
++#define LRNG_GCD_SELFTEST 3
++	for (i = 0; i < ARRAY_SIZE(history); i++)
++		history[i] = i * LRNG_GCD_SELFTEST;
++
++	if (lrng_gcd_analyze(history, ARRAY_SIZE(history)) == LRNG_GCD_SELFTEST)
++		return LRNG_SELFTEST_PASSED;
++
++	pr_err("LRNG GCD self-test FAILED\n");
++	return LRNG_SEFLTEST_ERROR_GCD;
++}
++
++#else /* CONFIG_LRNG_TIMER_COMMON */
++
++static unsigned int lrng_data_process_selftest(void)
++{
++	return LRNG_SELFTEST_PASSED;
++}
++
++static unsigned int lrng_gcd_selftest(void)
++{
++	return LRNG_SELFTEST_PASSED;
++}
++
++#endif /* CONFIG_LRNG_TIMER_COMMON */
++
++/* The test vectors are taken from crypto/testmgr.h */
++static unsigned int lrng_hash_selftest(void)
++{
++	SHASH_DESC_ON_STACK(shash, NULL);
++	const struct lrng_hash_cb *hash_cb = &lrng_sha_hash_cb;
++	static const u8 lrng_hash_selftest_result[] =
++#ifdef CONFIG_CRYPTO_LIB_SHA256
++		{ 0xba, 0x78, 0x16, 0xbf, 0x8f, 0x01, 0xcf, 0xea,
++		  0x41, 0x41, 0x40, 0xde, 0x5d, 0xae, 0x22, 0x23,
++		  0xb0, 0x03, 0x61, 0xa3, 0x96, 0x17, 0x7a, 0x9c,
++		  0xb4, 0x10, 0xff, 0x61, 0xf2, 0x00, 0x15, 0xad };
++#else /* CONFIG_CRYPTO_LIB_SHA256 */
++		{ 0xa9, 0x99, 0x3e, 0x36, 0x47, 0x06, 0x81, 0x6a, 0xba, 0x3e,
++		  0x25, 0x71, 0x78, 0x50, 0xc2, 0x6c, 0x9c, 0xd0, 0xd8, 0x9d };
++#endif /* CONFIG_CRYPTO_LIB_SHA256 */
++	static const u8 hash_input[] = { 0x61, 0x62, 0x63 }; /* "abc" */
++	u8 digest[sizeof(lrng_hash_selftest_result)] __aligned(sizeof(u32));
++
++	if (sizeof(digest) != hash_cb->hash_digestsize(NULL))
++		return LRNG_SEFLTEST_ERROR_HASH;
++
++	if (!hash_cb->hash_init(shash, NULL) &&
++	    !hash_cb->hash_update(shash, hash_input,
++					 sizeof(hash_input)) &&
++	    !hash_cb->hash_final(shash, digest) &&
++	    !memcmp(digest, lrng_hash_selftest_result, sizeof(digest)))
++		return 0;
++
++	pr_err("LRNG %s Hash self-test FAILED\n", hash_cb->hash_name());
++	return LRNG_SEFLTEST_ERROR_HASH;
++}
++
++#ifdef CONFIG_LRNG_DRNG_CHACHA20
++
++static void lrng_selftest_bswap32(u32 *ptr, u32 words)
++{
++	u32 i;
++
++	/* Byte-swap data which is an LE representation */
++	for (i = 0; i < words; i++) {
++		__le32 *p = (__le32 *)ptr;
++
++		*p = cpu_to_le32(*ptr);
++		ptr++;
++	}
++}
++
++/*
++ * The test vectors were generated using the ChaCha20 DRNG from
++ * https://www.chronox.de/chacha20.html
++ */
++static unsigned int lrng_chacha20_drng_selftest(void)
++{
++	const struct lrng_drng_cb *drng_cb = &lrng_cc20_drng_cb;
++	u8 seed[CHACHA_KEY_SIZE * 2] = {
++		0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
++		0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
++		0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
++		0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
++		0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
++		0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
++		0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
++		0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
++	};
++	struct chacha20_block chacha20;
++	int ret;
++	u8 outbuf[CHACHA_KEY_SIZE * 2] __aligned(sizeof(u32));
++
++	/*
++	 * Expected result when ChaCha20 DRNG state is zero:
++	 *	* constants are set to "expand 32-byte k"
++	 *	* remaining state is 0
++	 * and pulling one half ChaCha20 DRNG block.
++	 */
++	static const u8 expected_halfblock[CHACHA_KEY_SIZE] = {
++		0x76, 0xb8, 0xe0, 0xad, 0xa0, 0xf1, 0x3d, 0x90,
++		0x40, 0x5d, 0x6a, 0xe5, 0x53, 0x86, 0xbd, 0x28,
++		0xbd, 0xd2, 0x19, 0xb8, 0xa0, 0x8d, 0xed, 0x1a,
++		0xa8, 0x36, 0xef, 0xcc, 0x8b, 0x77, 0x0d, 0xc7 };
++
++	/*
++	 * Expected result when ChaCha20 DRNG state is zero:
++	 *	* constants are set to "expand 32-byte k"
++	 *	* remaining state is 0
++	 * followed by a reseed with two keyblocks
++	 *	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
++	 *	0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
++	 *	0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
++	 *	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
++	 *	0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
++	 *	0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
++	 *	0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
++	 *	0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f
++	 * and pulling one ChaCha20 DRNG block.
++	 */
++	static const u8 expected_oneblock[CHACHA_KEY_SIZE * 2] = {
++		0xe3, 0xb0, 0x8a, 0xcc, 0x34, 0xc3, 0x17, 0x0e,
++		0xc3, 0xd8, 0xc3, 0x40, 0xe7, 0x73, 0xe9, 0x0d,
++		0xd1, 0x62, 0xa3, 0x5d, 0x7d, 0xf2, 0xf1, 0x4a,
++		0x24, 0x42, 0xb7, 0x1e, 0xb0, 0x05, 0x17, 0x07,
++		0xb9, 0x35, 0x10, 0x69, 0x8b, 0x46, 0xfb, 0x51,
++		0xe9, 0x91, 0x3f, 0x46, 0xf2, 0x4d, 0xea, 0xd0,
++		0x81, 0xc1, 0x1b, 0xa9, 0x5d, 0x52, 0x91, 0x5f,
++		0xcd, 0xdc, 0xc6, 0xd6, 0xc3, 0x7c, 0x50, 0x23 };
++
++	/*
++	 * Expected result when ChaCha20 DRNG state is zero:
++	 *	* constants are set to "expand 32-byte k"
++	 *	* remaining state is 0
++	 * followed by a reseed with one key block plus one byte
++	 *	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
++	 *	0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
++	 *	0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
++	 *	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
++	 *	0x20
++	 * and pulling less than one ChaCha20 DRNG block.
++	 */
++	static const u8 expected_block_nonalinged[CHACHA_KEY_SIZE + 4] = {
++		0x9c, 0xfc, 0x5e, 0x31, 0x21, 0x62, 0x11, 0x85,
++		0xd3, 0x77, 0xd3, 0x69, 0x0f, 0xa8, 0x16, 0x55,
++		0xb4, 0x4c, 0xf6, 0x52, 0xf3, 0xa8, 0x37, 0x99,
++		0x38, 0x76, 0xa0, 0x66, 0xec, 0xbb, 0xce, 0xa9,
++		0x9c, 0x95, 0xa1, 0xfd };
++
++	BUILD_BUG_ON(sizeof(seed) % sizeof(u32));
++
++	memset(&chacha20, 0, sizeof(chacha20));
++	lrng_cc20_init_rfc7539(&chacha20);
++	lrng_selftest_bswap32((u32 *)seed, sizeof(seed) / sizeof(u32));
++
++	/* Generate with zero state */
++	ret = drng_cb->drng_generate(&chacha20, outbuf,
++				     sizeof(expected_halfblock));
++	if (ret != sizeof(expected_halfblock))
++		goto err;
++	if (memcmp(outbuf, expected_halfblock, sizeof(expected_halfblock)))
++		goto err;
++
++	/* Clear state of DRNG */
++	memset(&chacha20.key.u[0], 0, 48);
++
++	/* Reseed with 2 key blocks */
++	ret = drng_cb->drng_seed(&chacha20, seed, sizeof(expected_oneblock));
++	if (ret < 0)
++		goto err;
++	ret = drng_cb->drng_generate(&chacha20, outbuf,
++				     sizeof(expected_oneblock));
++	if (ret != sizeof(expected_oneblock))
++		goto err;
++	if (memcmp(outbuf, expected_oneblock, sizeof(expected_oneblock)))
++		goto err;
++
++	/* Clear state of DRNG */
++	memset(&chacha20.key.u[0], 0, 48);
++
++	/* Reseed with 1 key block and one byte */
++	ret = drng_cb->drng_seed(&chacha20, seed,
++				 sizeof(expected_block_nonalinged));
++	if (ret < 0)
++		goto err;
++	ret = drng_cb->drng_generate(&chacha20, outbuf,
++				     sizeof(expected_block_nonalinged));
++	if (ret != sizeof(expected_block_nonalinged))
++		goto err;
++	if (memcmp(outbuf, expected_block_nonalinged,
++		   sizeof(expected_block_nonalinged)))
++		goto err;
++
++	return LRNG_SELFTEST_PASSED;
++
++err:
++	pr_err("LRNG ChaCha20 DRNG self-test FAILED\n");
++	return LRNG_SEFLTEST_ERROR_CHACHA20;
++}
++
++#else /* CONFIG_LRNG_DRNG_CHACHA20 */
++
++static unsigned int lrng_chacha20_drng_selftest(void)
++{
++	return LRNG_SELFTEST_PASSED;
++}
++
++#endif /* CONFIG_LRNG_DRNG_CHACHA20 */
++
++static unsigned int lrng_selftest_status = LRNG_SELFTEST_NOT_EXECUTED;
++
++static int lrng_selftest(void)
++{
++	unsigned int ret = lrng_data_process_selftest();
++
++	ret |= lrng_chacha20_drng_selftest();
++	ret |= lrng_hash_selftest();
++	ret |= lrng_gcd_selftest();
++
++	if (ret) {
++		if (IS_ENABLED(CONFIG_LRNG_SELFTEST_PANIC))
++			panic("LRNG self-tests failed: %u\n", ret);
++	} else {
++		pr_info("LRNG self-tests passed\n");
++	}
++
++	lrng_selftest_status = ret;
++
++	if (lrng_selftest_status)
++		return -EFAULT;
++	return 0;
++}
++
++#ifdef CONFIG_SYSFS
++/* Re-perform self-test when any value is written to the sysfs file. */
++static int lrng_selftest_sysfs_set(const char *val,
++				   const struct kernel_param *kp)
++{
++	return lrng_selftest();
++}
++
++static const struct kernel_param_ops lrng_selftest_sysfs = {
++	.set = lrng_selftest_sysfs_set,
++	.get = param_get_uint,
++};
++module_param_cb(selftest_status, &lrng_selftest_sysfs, &lrng_selftest_status,
++		0644);
++#endif	/* CONFIG_SYSFS */
++
++static int __init lrng_selftest_init(void)
++{
++	return lrng_selftest();
++}
++
++module_init(lrng_selftest_init);
+From 6a5b2149c0ba1f6a04ae69368e5fbed2b38bff96 Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Sun, 31 Jul 2022 22:34:51 +0200
+Subject: [PATCH 21/25] LRNG - sysctls and /proc interface
+
+The LRNG sysctl interface provides the same controls as the existing
+/dev/random implementation. These sysctls behave identically and are
+implemented identically. The goal is to allow a possible merge of the
+existing /dev/random implementation with this implementation which
+implies that this patch tries have a very close similarity. Yet, all
+sysctls are documented at [1].
+
+The sysctl implementation is only enabled if the existing random.c file
+is not compiled.
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+---
+ drivers/char/lrng/Makefile      |   1 +
+ drivers/char/lrng/lrng_sysctl.c | 139 ++++++++++++++++++++++++++++++++
+ 2 files changed, 140 insertions(+)
+ create mode 100644 drivers/char/lrng/lrng_sysctl.c
+
+--- a/drivers/char/lrng/Makefile
++++ b/drivers/char/lrng/Makefile
+@@ -9,6 +9,7 @@ obj-$(CONFIG_LRNG_SHA256)		+= lrng_sha25
+ obj-$(CONFIG_LRNG_SHA1)			+= lrng_sha1.o
+ 
+ obj-$(CONFIG_SYSCTL)			+= lrng_proc.o
++obj-$(CONFIG_LRNG_SYSCTL)		+= lrng_sysctl.o
+ obj-$(CONFIG_NUMA)			+= lrng_numa.o
+ 
+ obj-$(CONFIG_LRNG_SWITCH)		+= lrng_switch.o
+--- /dev/null
++++ b/drivers/char/lrng/lrng_sysctl.c
+@@ -0,0 +1,139 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * LRNG sysctl interfaces
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#include <linux/lrng.h>
++#include <linux/proc_fs.h>
++#include <linux/sysctl.h>
++#include <linux/uuid.h>
++
++#include "lrng_drng_mgr.h"
++#include "lrng_es_mgr.h"
++#include "lrng_sysctl.h"
++
++/*
++ * This function is used to return both the bootid UUID, and random
++ * UUID.  The difference is in whether table->data is NULL; if it is,
++ * then a new UUID is generated and returned to the user.
++ *
++ * If the user accesses this via the proc interface, the UUID will be
++ * returned as an ASCII string in the standard UUID format; if via the
++ * sysctl system call, as 16 bytes of binary data.
++ */
++static int lrng_sysctl_do_uuid(const struct ctl_table *table, int write,
++			       void *buffer, size_t *lenp, loff_t *ppos)
++{
++	struct ctl_table fake_table;
++	unsigned char buf[64], tmp_uuid[16], *uuid;
++
++	uuid = table->data;
++	if (!uuid) {
++		uuid = tmp_uuid;
++		generate_random_uuid(uuid);
++	} else {
++		static DEFINE_SPINLOCK(bootid_spinlock);
++
++		spin_lock(&bootid_spinlock);
++		if (!uuid[8])
++			generate_random_uuid(uuid);
++		spin_unlock(&bootid_spinlock);
++	}
++
++	sprintf(buf, "%pU", uuid);
++
++	fake_table.data = buf;
++	fake_table.maxlen = sizeof(buf);
++
++	return proc_dostring(&fake_table, write, buffer, lenp, ppos);
++}
++
++static int lrng_sysctl_do_entropy(const struct ctl_table *table, int write,
++				void *buffer, size_t *lenp, loff_t *ppos)
++{
++	struct ctl_table fake_table;
++	int entropy_count = lrng_avail_entropy_aux();
++
++	fake_table.data = &entropy_count;
++	fake_table.maxlen = sizeof(entropy_count);
++
++	return proc_dointvec(&fake_table, write, buffer, lenp, ppos);
++}
++
++static int lrng_sysctl_do_poolsize(const struct ctl_table *table, int write,
++				   void *buffer, size_t *lenp, loff_t *ppos)
++{
++	struct ctl_table fake_table;
++	u32 entropy_count = lrng_es[lrng_ext_es_aux]->max_entropy();
++
++	fake_table.data = &entropy_count;
++	fake_table.maxlen = sizeof(entropy_count);
++
++	return proc_dointvec(&fake_table, write, buffer, lenp, ppos);
++}
++
++static int lrng_min_write_thresh;
++static int lrng_max_write_thresh = (LRNG_WRITE_WAKEUP_ENTROPY << 3);
++static char lrng_sysctl_bootid[16];
++static int lrng_drng_reseed_max_min;
++
++void lrng_sysctl_update_max_write_thresh(u32 new_digestsize)
++{
++	lrng_max_write_thresh = (int)new_digestsize;
++	/* Ensure that changes to the global variable are visible */
++	mb();
++}
++
++static struct ctl_table random_table[] = {
++	{
++		.procname	= "poolsize",
++		.maxlen		= sizeof(int),
++		.mode		= 0444,
++		.proc_handler	= lrng_sysctl_do_poolsize,
++	},
++	{
++		.procname	= "entropy_avail",
++		.maxlen		= sizeof(int),
++		.mode		= 0444,
++		.proc_handler	= lrng_sysctl_do_entropy,
++	},
++	{
++		.procname	= "write_wakeup_threshold",
++		.data		= &lrng_write_wakeup_bits,
++		.maxlen		= sizeof(int),
++		.mode		= 0644,
++		.proc_handler	= proc_dointvec_minmax,
++		.extra1		= &lrng_min_write_thresh,
++		.extra2		= &lrng_max_write_thresh,
++	},
++	{
++		.procname	= "boot_id",
++		.data		= &lrng_sysctl_bootid,
++		.maxlen		= 16,
++		.mode		= 0444,
++		.proc_handler	= lrng_sysctl_do_uuid,
++	},
++	{
++		.procname	= "uuid",
++		.maxlen		= 16,
++		.mode		= 0444,
++		.proc_handler	= lrng_sysctl_do_uuid,
++	},
++	{
++		.procname       = "urandom_min_reseed_secs",
++		.data           = &lrng_drng_reseed_max_time,
++		.maxlen         = sizeof(int),
++		.mode           = 0644,
++		.proc_handler   = proc_dointvec,
++		.extra1		= &lrng_drng_reseed_max_min,
++	},
++};
++
++static int __init random_sysctls_init(void)
++{
++	register_sysctl_init("kernel/random", random_table);
++	return 0;
++}
++device_initcall(random_sysctls_init);
+From fa6f7a3d77638110f79d1972668afc4b15254ffa Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Mon, 20 Feb 2023 22:12:04 +0100
+Subject: [PATCH 22/25] LRMG - add drop-in replacement random(4) API
+
+The LRNG is intended to be a full replacement of the existing random.c.
+This also includes the providing of a full API and ABI compliant drop-in
+replacement of all APIs offered by random.c.
+
+These LRNG interfaces are compiled when the random.c is not compiled
+any more.
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+---
+ drivers/char/Makefile                         |   3 +-
+ drivers/char/lrng/Makefile                    |   5 +
+ drivers/char/lrng/lrng_interface_aux.c        | 210 ++++++++++++
+ drivers/char/lrng/lrng_interface_dev_common.c | 315 ++++++++++++++++++
+ .../char/lrng/lrng_interface_random_kernel.c  | 248 ++++++++++++++
+ .../char/lrng/lrng_interface_random_user.c    | 104 ++++++
+ 6 files changed, 884 insertions(+), 1 deletion(-)
+ create mode 100644 drivers/char/lrng/lrng_interface_aux.c
+ create mode 100644 drivers/char/lrng/lrng_interface_dev_common.c
+ create mode 100644 drivers/char/lrng/lrng_interface_random_kernel.c
+ create mode 100644 drivers/char/lrng/lrng_interface_random_user.c
+
+--- a/drivers/char/Makefile
++++ b/drivers/char/Makefile
+@@ -3,7 +3,8 @@
+ # Makefile for the kernel character device drivers.
+ #
+ 
+-obj-y				+= mem.o random.o
++obj-y				+= mem.o
++obj-$(CONFIG_RANDOM_DEFAULT_IMPL) += random.o
+ obj-$(CONFIG_TTY_PRINTK)	+= ttyprintk.o
+ obj-y				+= misc.o
+ obj-$(CONFIG_ATARI_DSP56K)	+= dsp56k.o
+--- a/drivers/char/lrng/Makefile
++++ b/drivers/char/lrng/Makefile
+@@ -29,3 +29,8 @@ obj-$(CONFIG_LRNG_JENT)			+= lrng_es_jen
+ obj-$(CONFIG_LRNG_HEALTH_TESTS)		+= lrng_health.o
+ obj-$(CONFIG_LRNG_TESTING)		+= lrng_testing.o
+ obj-$(CONFIG_LRNG_SELFTEST)		+= lrng_selftest.o
++
++obj-$(CONFIG_LRNG_COMMON_DEV_IF)	+= lrng_interface_dev_common.o
++obj-$(CONFIG_LRNG_RANDOM_IF)		+= lrng_interface_random_user.o \
++					   lrng_interface_random_kernel.o \
++					   lrng_interface_aux.o
+--- /dev/null
++++ b/drivers/char/lrng/lrng_interface_aux.c
+@@ -0,0 +1,210 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * LRNG auxiliary interfaces
++ *
++ * Copyright (C) 2022 Stephan Mueller <smueller@chronox.de>
++ * Copyright (C) 2017 Jason A. Donenfeld <Jason@zx2c4.com>. All
++ * Rights Reserved.
++ * Copyright (C) 2016 Jason Cooper <jason@lakedaemon.net>
++ */
++
++#include <linux/lrng.h>
++#include <linux/mm.h>
++#include <linux/random.h>
++
++#include "lrng_es_mgr.h"
++#include "lrng_interface_random_kernel.h"
++
++/*
++ * Fill a buffer with random numbers and tokenize it to provide random numbers
++ * to callers in fixed chunks. This approach is provided to be consistent with
++ * the Linux kernel interface requirements. Yet, this approach violate the
++ * backtracking resistance of the random number generator. Thus, the provided
++ * random numbers are not considered to be as strong as those requested directly
++ * from the LRNG.
++ */
++struct batched_entropy {
++	union {
++		u64 entropy_u64[LRNG_DRNG_BLOCKSIZE / sizeof(u64)];
++		u32 entropy_u32[LRNG_DRNG_BLOCKSIZE / sizeof(u32)];
++		u16 entropy_u16[LRNG_DRNG_BLOCKSIZE / sizeof(u16)];
++		u8 entropy_u8[LRNG_DRNG_BLOCKSIZE / sizeof(u8)];
++	};
++	unsigned int position;
++	spinlock_t batch_lock;
++};
++
++/*
++ * Get a random word for internal kernel use only. The quality of the random
++ * number is as good as /dev/urandom, but there is no backtrack protection,
++ * with the goal of being quite fast and not depleting entropy.
++ */
++static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u64) = {
++	.batch_lock	= __SPIN_LOCK_UNLOCKED(batched_entropy_u64.lock),
++};
++
++u64 get_random_u64(void)
++{
++	u64 ret;
++	unsigned long flags;
++	struct batched_entropy *batch;
++
++	lrng_debug_report_seedlevel("get_random_u64");
++
++	batch = raw_cpu_ptr(&batched_entropy_u64);
++	spin_lock_irqsave(&batch->batch_lock, flags);
++	if (batch->position % ARRAY_SIZE(batch->entropy_u64) == 0) {
++		lrng_get_random_bytes(batch->entropy_u64, LRNG_DRNG_BLOCKSIZE);
++		batch->position = 0;
++	}
++	ret = batch->entropy_u64[batch->position++];
++	spin_unlock_irqrestore(&batch->batch_lock, flags);
++	return ret;
++}
++EXPORT_SYMBOL(get_random_u64);
++
++static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u32) = {
++	.batch_lock	= __SPIN_LOCK_UNLOCKED(batched_entropy_u32.lock),
++};
++
++u32 get_random_u32(void)
++{
++	u32 ret;
++	unsigned long flags;
++	struct batched_entropy *batch;
++
++	lrng_debug_report_seedlevel("get_random_u32");
++
++	batch = raw_cpu_ptr(&batched_entropy_u32);
++	spin_lock_irqsave(&batch->batch_lock, flags);
++	if (batch->position % ARRAY_SIZE(batch->entropy_u32) == 0) {
++		lrng_get_random_bytes(batch->entropy_u32, LRNG_DRNG_BLOCKSIZE);
++		batch->position = 0;
++	}
++	ret = batch->entropy_u32[batch->position++];
++	spin_unlock_irqrestore(&batch->batch_lock, flags);
++	return ret;
++}
++EXPORT_SYMBOL(get_random_u32);
++
++static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u16) = {
++	.batch_lock	= __SPIN_LOCK_UNLOCKED(batched_entropy_u16.lock),
++};
++
++u16 get_random_u16(void)
++{
++	u16 ret;
++	unsigned long flags;
++	struct batched_entropy *batch;
++
++	lrng_debug_report_seedlevel("get_random_u16");
++
++	batch = raw_cpu_ptr(&batched_entropy_u16);
++	spin_lock_irqsave(&batch->batch_lock, flags);
++	if (batch->position % ARRAY_SIZE(batch->entropy_u16) == 0) {
++		lrng_get_random_bytes(batch->entropy_u16, LRNG_DRNG_BLOCKSIZE);
++		batch->position = 0;
++	}
++	ret = batch->entropy_u16[batch->position++];
++	spin_unlock_irqrestore(&batch->batch_lock, flags);
++	return ret;
++}
++EXPORT_SYMBOL(get_random_u16);
++
++static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u8) = {
++	.batch_lock	= __SPIN_LOCK_UNLOCKED(batched_entropy_u8.lock),
++};
++
++u8 get_random_u8(void)
++{
++	u8 ret;
++	unsigned long flags;
++	struct batched_entropy *batch;
++
++	lrng_debug_report_seedlevel("get_random_u8");
++
++	batch = raw_cpu_ptr(&batched_entropy_u8);
++	spin_lock_irqsave(&batch->batch_lock, flags);
++	if (batch->position % ARRAY_SIZE(batch->entropy_u8) == 0) {
++		lrng_get_random_bytes(batch->entropy_u8, LRNG_DRNG_BLOCKSIZE);
++		batch->position = 0;
++	}
++	ret = batch->entropy_u8[batch->position++];
++	spin_unlock_irqrestore(&batch->batch_lock, flags);
++	return ret;
++}
++EXPORT_SYMBOL(get_random_u8);
++
++/* Taken directly from random.c */
++u32 __get_random_u32_below(u32 ceil)
++{
++	u64 mult = (u64)ceil * get_random_u32();
++
++	if (unlikely((u32)mult < ceil)) {
++		u32 bound = -ceil % ceil;
++		while (unlikely((u32)mult < bound))
++			mult = (u64)ceil * get_random_u32();
++	}
++	return mult >> 32;
++}
++EXPORT_SYMBOL(__get_random_u32_below);
++
++#ifdef CONFIG_SMP
++/*
++ * This function is called when the CPU is coming up, with entry
++ * CPUHP_RANDOM_PREPARE, which comes before CPUHP_WORKQUEUE_PREP.
++ */
++int random_prepare_cpu(unsigned int cpu)
++{
++	/*
++	 * When the cpu comes back online, immediately invalidate all batches,
++	 * so that we serve fresh randomness.
++	 */
++	per_cpu_ptr(&batched_entropy_u8, cpu)->position = 0;
++	per_cpu_ptr(&batched_entropy_u16, cpu)->position = 0;
++	per_cpu_ptr(&batched_entropy_u32, cpu)->position = 0;
++	per_cpu_ptr(&batched_entropy_u64, cpu)->position = 0;
++	return 0;
++}
++
++int random_online_cpu(unsigned int cpu)
++{
++	return 0;
++}
++#endif
++
++/*
++ * It's important to invalidate all potential batched entropy that might
++ * be stored before the crng is initialized, which we can do lazily by
++ * simply resetting the counter to zero so that it's re-extracted on the
++ * next usage.
++ */
++void invalidate_batched_entropy(void)
++{
++	int cpu;
++	unsigned long flags;
++
++	for_each_possible_cpu(cpu) {
++		struct batched_entropy *batched_entropy;
++
++		batched_entropy = per_cpu_ptr(&batched_entropy_u8, cpu);
++		spin_lock_irqsave(&batched_entropy->batch_lock, flags);
++		batched_entropy->position = 0;
++		spin_unlock_irqrestore(&batched_entropy->batch_lock, flags);
++
++		batched_entropy = per_cpu_ptr(&batched_entropy_u16, cpu);
++		spin_lock_irqsave(&batched_entropy->batch_lock, flags);
++		batched_entropy->position = 0;
++		spin_unlock_irqrestore(&batched_entropy->batch_lock, flags);
++
++		batched_entropy = per_cpu_ptr(&batched_entropy_u32, cpu);
++		spin_lock_irqsave(&batched_entropy->batch_lock, flags);
++		batched_entropy->position = 0;
++		spin_unlock_irqrestore(&batched_entropy->batch_lock, flags);
++
++		batched_entropy = per_cpu_ptr(&batched_entropy_u64, cpu);
++		spin_lock(&batched_entropy->batch_lock);
++		batched_entropy->position = 0;
++		spin_unlock_irqrestore(&batched_entropy->batch_lock, flags);
++	}
++}
+--- /dev/null
++++ b/drivers/char/lrng/lrng_interface_dev_common.c
+@@ -0,0 +1,315 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * LRNG User and kernel space interfaces
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/random.h>
++#include <linux/slab.h>
++
++#include "lrng_drng_mgr.h"
++#include "lrng_es_aux.h"
++#include "lrng_es_mgr.h"
++#include "lrng_interface_dev_common.h"
++
++DECLARE_WAIT_QUEUE_HEAD(lrng_write_wait);
++static struct fasync_struct *fasync;
++
++static bool lrng_seed_hw = true;	/* Allow HW to provide seed */
++static bool lrng_seed_user = true;	/* Allow user space to provide seed */
++
++/********************************** Helper ***********************************/
++
++static u32 lrng_get_aux_ent(void)
++{
++	return lrng_es[lrng_ext_es_aux]->curr_entropy(0);
++}
++
++/* Is the DRNG seed level too low? */
++bool lrng_need_entropy(void)
++{
++	return (lrng_get_aux_ent() < lrng_write_wakeup_bits);
++}
++
++void lrng_writer_wakeup(void)
++{
++	if (lrng_need_entropy() && wq_has_sleeper(&lrng_write_wait)) {
++		wake_up_interruptible(&lrng_write_wait);
++		kill_fasync(&fasync, SIGIO, POLL_OUT);
++	}
++}
++
++void lrng_init_wakeup_dev(void)
++{
++	kill_fasync(&fasync, SIGIO, POLL_IN);
++}
++
++/* External entropy provider is allowed to provide seed data */
++bool lrng_state_exseed_allow(enum lrng_external_noise_source source)
++{
++	if (source == lrng_noise_source_hw)
++		return lrng_seed_hw;
++	return lrng_seed_user;
++}
++
++/* Enable / disable external entropy provider to furnish seed */
++void lrng_state_exseed_set(enum lrng_external_noise_source source, bool type)
++{
++	/*
++	 * If the LRNG is not yet operational, allow all entropy sources
++	 * to deliver data unconditionally to get fully seeded asap.
++	 */
++	if (!lrng_state_operational())
++		return;
++
++	if (source == lrng_noise_source_hw)
++		lrng_seed_hw = type;
++	else
++		lrng_seed_user = type;
++}
++
++void lrng_state_exseed_allow_all(void)
++{
++	lrng_state_exseed_set(lrng_noise_source_hw, true);
++	lrng_state_exseed_set(lrng_noise_source_user, true);
++}
++
++/************************ LRNG user output interfaces *************************/
++
++ssize_t lrng_read_seed(char __user *buf, size_t nbytes, unsigned int flags)
++{
++	ssize_t ret = 0;
++	u64 t[(sizeof(struct entropy_buf) + 3 * sizeof(u64) - 1) / sizeof(u64)];
++
++	memset(t, 0, sizeof(t));
++	ret = lrng_get_seed(t, min_t(size_t, nbytes, sizeof(t)), flags);
++	if (ret == -EMSGSIZE && copy_to_user(buf, t, sizeof(u64)))
++		ret = -EFAULT;
++	else if (ret > 0 && copy_to_user(buf, t, ret))
++		ret = -EFAULT;
++
++	memzero_explicit(t, sizeof(t));
++
++	return ret;
++}
++
++ssize_t lrng_read_common(char __user *buf, size_t nbytes, bool pr)
++{
++	ssize_t ret = 0;
++	u8 tmpbuf[LRNG_DRNG_BLOCKSIZE] __aligned(LRNG_KCAPI_ALIGN);
++	u8 *tmp_large = NULL, *tmp = tmpbuf;
++	u32 tmplen = sizeof(tmpbuf);
++
++	if (nbytes == 0)
++		return 0;
++
++	/*
++	 * Satisfy large read requests -- as the common case are smaller
++	 * request sizes, such as 16 or 32 bytes, avoid a kmalloc overhead for
++	 * those by using the stack variable of tmpbuf.
++	 */
++	if (!IS_ENABLED(CONFIG_BASE_SMALL) && (nbytes > sizeof(tmpbuf))) {
++		tmplen = min_t(u32, nbytes, LRNG_DRNG_MAX_REQSIZE);
++		tmp_large = kmalloc(tmplen + LRNG_KCAPI_ALIGN, GFP_KERNEL);
++		if (!tmp_large)
++			tmplen = sizeof(tmpbuf);
++		else
++			tmp = PTR_ALIGN(tmp_large, LRNG_KCAPI_ALIGN);
++	}
++
++	while (nbytes) {
++		u32 todo = min_t(u32, nbytes, tmplen);
++		int rc = 0;
++
++		/* Reschedule if we received a large request. */
++		if ((tmp_large) && need_resched()) {
++			if (signal_pending(current)) {
++				if (ret == 0)
++					ret = -ERESTARTSYS;
++				break;
++			}
++			schedule();
++		}
++
++		rc = lrng_drng_get_sleep(tmp, todo, pr);
++		if (rc <= 0) {
++			if (rc < 0)
++				ret = rc;
++			break;
++		}
++		if (copy_to_user(buf, tmp, rc)) {
++			ret = -EFAULT;
++			break;
++		}
++
++		nbytes -= rc;
++		buf += rc;
++		ret += rc;
++	}
++
++	/* Wipe data just returned from memory */
++	if (tmp_large)
++		kfree_sensitive(tmp_large);
++	else
++		memzero_explicit(tmpbuf, sizeof(tmpbuf));
++
++	return ret;
++}
++
++ssize_t lrng_read_common_block(int nonblock, int pr,
++			       char __user *buf, size_t nbytes)
++{
++	int ret;
++
++	if (nbytes == 0)
++		return 0;
++
++	ret = lrng_drng_sleep_while_nonoperational(nonblock);
++	if (ret)
++		return ret;
++
++	return lrng_read_common(buf, nbytes, !!pr);
++}
++
++ssize_t lrng_drng_read_block(struct file *file, char __user *buf, size_t nbytes,
++			     loff_t *ppos)
++{
++	return lrng_read_common_block(file->f_flags & O_NONBLOCK,
++				      file->f_flags & O_SYNC, buf, nbytes);
++}
++
++__poll_t lrng_random_poll(struct file *file, poll_table *wait)
++{
++	__poll_t mask;
++
++	poll_wait(file, &lrng_init_wait, wait);
++	poll_wait(file, &lrng_write_wait, wait);
++	mask = 0;
++	if (lrng_state_operational())
++		mask |= EPOLLIN | EPOLLRDNORM;
++	if (lrng_need_entropy() ||
++	    lrng_state_exseed_allow(lrng_noise_source_user)) {
++		lrng_state_exseed_set(lrng_noise_source_user, false);
++		mask |= EPOLLOUT | EPOLLWRNORM;
++	}
++	return mask;
++}
++
++ssize_t lrng_drng_write_common(const char __user *buffer, size_t count,
++			       u32 entropy_bits)
++{
++	ssize_t ret = 0;
++	u8 buf[64] __aligned(LRNG_KCAPI_ALIGN);
++	const char __user *p = buffer;
++	u32 orig_entropy_bits = entropy_bits;
++
++	if (!lrng_get_available()) {
++		ret = lrng_drng_initalize();
++		if (!ret)
++			return ret;
++	}
++
++	count = min_t(size_t, count, INT_MAX);
++	while (count > 0) {
++		size_t bytes = min_t(size_t, count, sizeof(buf));
++		u32 ent = min_t(u32, bytes<<3, entropy_bits);
++
++		if (copy_from_user(&buf, p, bytes))
++			return -EFAULT;
++		/* Inject data into entropy pool */
++		lrng_pool_insert_aux(buf, bytes, ent);
++
++		count -= bytes;
++		p += bytes;
++		ret += bytes;
++		entropy_bits -= ent;
++
++		cond_resched();
++	}
++
++	/* Force reseed of DRNG during next data request. */
++	if (!orig_entropy_bits)
++		lrng_drng_force_reseed();
++
++	return ret;
++}
++
++ssize_t lrng_drng_write(struct file *file, const char __user *buffer,
++			size_t count, loff_t *ppos)
++{
++	return lrng_drng_write_common(buffer, count, 0);
++}
++
++long lrng_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
++{
++	u32 digestsize_bits;
++	int size, ent_count_bits, ret;
++	int __user *p = (int __user *)arg;
++
++	switch (cmd) {
++	case RNDGETENTCNT:
++		ent_count_bits = lrng_avail_entropy_aux();
++		if (put_user(ent_count_bits, p))
++			return -EFAULT;
++		return 0;
++	case RNDADDTOENTCNT:
++		if (!capable(CAP_SYS_ADMIN))
++			return -EPERM;
++		if (get_user(ent_count_bits, p))
++			return -EFAULT;
++		ent_count_bits = (int)lrng_get_aux_ent() + ent_count_bits;
++		if (ent_count_bits < 0)
++			ent_count_bits = 0;
++		digestsize_bits = lrng_get_digestsize();
++		if (ent_count_bits > digestsize_bits)
++			ent_count_bits = digestsize_bits;
++		lrng_pool_set_entropy(ent_count_bits);
++		return 0;
++	case RNDADDENTROPY:
++		if (!capable(CAP_SYS_ADMIN))
++			return -EPERM;
++		if (get_user(ent_count_bits, p++))
++			return -EFAULT;
++		if (ent_count_bits < 0)
++			return -EINVAL;
++		if (get_user(size, p++))
++			return -EFAULT;
++		if (size < 0)
++			return -EINVAL;
++		/* there cannot be more entropy than data */
++		ent_count_bits = min(ent_count_bits, size<<3);
++		ret = lrng_drng_write_common((const char __user *)p, size,
++					     ent_count_bits);
++		return (ret < 0) ? ret : 0;
++	case RNDZAPENTCNT:
++	case RNDCLEARPOOL:
++		/* Clear the entropy pool counter. */
++		if (!capable(CAP_SYS_ADMIN))
++			return -EPERM;
++		lrng_pool_set_entropy(0);
++		return 0;
++	case RNDRESEEDCRNG:
++		/*
++		 * We leave the capability check here since it is present
++		 * in the upstream's RNG implementation. Yet, user space
++		 * can trigger a reseed as easy as writing into /dev/random
++		 * or /dev/urandom where no privilege is needed.
++		 */
++		if (!capable(CAP_SYS_ADMIN))
++			return -EPERM;
++		/* Force a reseed of all DRNGs */
++		lrng_drng_force_reseed();
++		return 0;
++	default:
++		return -EINVAL;
++	}
++}
++EXPORT_SYMBOL(lrng_ioctl);
++
++int lrng_fasync(int fd, struct file *filp, int on)
++{
++	return fasync_helper(fd, filp, on, &fasync);
++}
+--- /dev/null
++++ b/drivers/char/lrng/lrng_interface_random_kernel.c
+@@ -0,0 +1,248 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * LRNG Kernel space interfaces API/ABI compliant to linux/random.h
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/blkdev.h>
++#include <linux/hw_random.h>
++#include <linux/kthread.h>
++#include <linux/lrng.h>
++#include <linux/random.h>
++
++#include "lrng_es_aux.h"
++#include "lrng_es_irq.h"
++#include "lrng_es_mgr.h"
++#include "lrng_interface_dev_common.h"
++#include "lrng_interface_random_kernel.h"
++
++static ATOMIC_NOTIFIER_HEAD(random_ready_notifier);
++
++/********************************** Helper ***********************************/
++
++static bool lrng_trust_bootloader __initdata =
++	IS_ENABLED(CONFIG_RANDOM_TRUST_BOOTLOADER);
++
++static int __init lrng_parse_trust_bootloader(char *arg)
++{
++	return kstrtobool(arg, &lrng_trust_bootloader);
++}
++early_param("random.trust_bootloader", lrng_parse_trust_bootloader);
++
++void __init random_init_early(const char *command_line)
++{
++	lrng_rand_initialize_early();
++	lrng_pool_insert_aux(command_line, strlen(command_line), 0);
++}
++
++void __init random_init(void)
++{
++	lrng_rand_initialize();
++}
++
++/*
++ * Add a callback function that will be invoked when the LRNG is initialised,
++ * or immediately if it already has been. Only use this is you are absolutely
++ * sure it is required. Most users should instead be able to test
++ * `rng_is_initialized()` on demand, or make use of `get_random_bytes_wait()`.
++ */
++int __cold execute_with_initialized_rng(struct notifier_block *nb)
++{
++	unsigned long flags;
++	int ret = 0;
++
++	spin_lock_irqsave(&random_ready_notifier.lock, flags);
++	if (rng_is_initialized())
++		nb->notifier_call(nb, 0, NULL);
++	else
++		ret = raw_notifier_chain_register(
++			(struct raw_notifier_head *)&random_ready_notifier.head,
++			nb);
++	spin_unlock_irqrestore(&random_ready_notifier.lock, flags);
++	return ret;
++}
++
++void lrng_kick_random_ready(void)
++{
++	atomic_notifier_call_chain(&random_ready_notifier, 0, NULL);
++}
++
++/************************ LRNG kernel input interfaces ************************/
++
++/*
++ * add_hwgenerator_randomness() - Interface for in-kernel drivers of true
++ * hardware RNGs.
++ *
++ * Those devices may produce endless random bits and will be throttled
++ * when our pool is full.
++ *
++ * @buffer: buffer holding the entropic data from HW noise sources to be used to
++ *	    insert into entropy pool.
++ * @count: length of buffer
++ * @entropy_bits: amount of entropy in buffer (value is in bits)
++ */
++void add_hwgenerator_randomness(const void *buffer, size_t count,
++				size_t entropy_bits, bool sleep_after)
++{
++	/*
++	 * Suspend writing if we are fully loaded with entropy or if caller
++	 * did not provide any entropy. We'll be woken up again once below
++	 * lrng_write_wakeup_thresh, or when the calling thread is about to
++	 * terminate.
++	 */
++	wait_event_interruptible(lrng_write_wait,
++				(lrng_need_entropy() && entropy_bits) ||
++				lrng_state_exseed_allow(lrng_noise_source_hw) ||
++				!sleep_after ||
++				kthread_should_stop());
++	lrng_state_exseed_set(lrng_noise_source_hw, false);
++	lrng_pool_insert_aux(buffer, count, entropy_bits);
++}
++EXPORT_SYMBOL_GPL(add_hwgenerator_randomness);
++
++/*
++ * add_bootloader_randomness() - Handle random seed passed by bootloader.
++ *
++ * If the seed is trustworthy, it would be regarded as hardware RNGs. Otherwise
++ * it would be regarded as device data.
++ * The decision is controlled by CONFIG_RANDOM_TRUST_BOOTLOADER.
++ *
++ * @buf: buffer holding the entropic data from HW noise sources to be used to
++ *	 insert into entropy pool.
++ * @size: length of buffer
++ */
++void __init add_bootloader_randomness(const void *buf, size_t size)
++{
++	lrng_pool_insert_aux(buf, size, lrng_trust_bootloader ? size * 8 : 0);
++}
++
++/*
++ * Callback for HID layer -- use the HID event values to stir the entropy pool
++ */
++void add_input_randomness(unsigned int type, unsigned int code,
++			  unsigned int value)
++{
++	static unsigned char last_value;
++
++	/* ignore autorepeat and the like */
++	if (value == last_value)
++		return;
++
++	last_value = value;
++
++	lrng_irq_array_add_u32((type << 4) ^ code ^ (code >> 4) ^ value);
++}
++EXPORT_SYMBOL_GPL(add_input_randomness);
++
++/*
++ * add_device_randomness() - Add device- or boot-specific data to the entropy
++ * pool to help initialize it.
++ *
++ * None of this adds any entropy; it is meant to avoid the problem of
++ * the entropy pool having similar initial state across largely
++ * identical devices.
++ *
++ * @buf: buffer holding the entropic data from HW noise sources to be used to
++ *	 insert into entropy pool.
++ * @size: length of buffer
++ */
++void add_device_randomness(const void *buf, size_t size)
++{
++	lrng_pool_insert_aux((u8 *)buf, size, 0);
++}
++EXPORT_SYMBOL(add_device_randomness);
++
++#ifdef CONFIG_BLOCK
++void rand_initialize_disk(struct gendisk *disk) { }
++void add_disk_randomness(struct gendisk *disk) { }
++EXPORT_SYMBOL(add_disk_randomness);
++#endif
++
++#ifndef CONFIG_LRNG_IRQ
++void add_interrupt_randomness(int irq) { }
++EXPORT_SYMBOL(add_interrupt_randomness);
++#endif
++
++#if IS_ENABLED(CONFIG_VMGENID)
++static BLOCKING_NOTIFIER_HEAD(lrng_vmfork_chain);
++
++/*
++ * Handle a new unique VM ID, which is unique, not secret, so we
++ * don't credit it, but we do immediately force a reseed after so
++ * that it's used by the crng posthaste.
++ */
++void add_vmfork_randomness(const void *unique_vm_id, size_t size)
++{
++	add_device_randomness(unique_vm_id, size);
++	if (lrng_state_operational())
++		lrng_drng_force_reseed();
++	blocking_notifier_call_chain(&lrng_vmfork_chain, 0, NULL);
++}
++#if IS_MODULE(CONFIG_VMGENID)
++EXPORT_SYMBOL_GPL(add_vmfork_randomness);
++#endif
++
++int register_random_vmfork_notifier(struct notifier_block *nb)
++{
++	return blocking_notifier_chain_register(&lrng_vmfork_chain, nb);
++}
++EXPORT_SYMBOL_GPL(register_random_vmfork_notifier);
++
++int unregister_random_vmfork_notifier(struct notifier_block *nb)
++{
++	return blocking_notifier_chain_unregister(&lrng_vmfork_chain, nb);
++}
++EXPORT_SYMBOL_GPL(unregister_random_vmfork_notifier);
++#endif
++
++/*********************** LRNG kernel output interfaces ************************/
++
++/*
++ * get_random_bytes() - Provider of cryptographic strong random numbers for
++ * kernel-internal usage.
++ *
++ * This function is appropriate for all in-kernel use cases. However,
++ * it will always use the ChaCha20 DRNG.
++ *
++ * @buf: buffer to store the random bytes
++ * @nbytes: size of the buffer
++ */
++void get_random_bytes(void *buf, size_t nbytes)
++{
++	lrng_get_random_bytes(buf, nbytes);
++}
++EXPORT_SYMBOL(get_random_bytes);
++
++/*
++ * wait_for_random_bytes() - Wait for the LRNG to be seeded and thus
++ * guaranteed to supply cryptographically secure random numbers.
++ *
++ * This applies to: the /dev/urandom device, the get_random_bytes function,
++ * and the get_random_{u32,u64,int,long} family of functions. Using any of
++ * these functions without first calling this function forfeits the guarantee
++ * of security.
++ *
++ * Return:
++ * * 0 if the LRNG has been seeded.
++ * * -ERESTARTSYS if the function was interrupted by a signal.
++ */
++int wait_for_random_bytes(void)
++{
++	return lrng_drng_sleep_while_non_min_seeded();
++}
++EXPORT_SYMBOL(wait_for_random_bytes);
++
++/*
++ * Returns whether or not the LRNG has been seeded.
++ *
++ * Returns: true if the urandom pool has been seeded.
++ *          false if the urandom pool has not been seeded.
++ */
++bool rng_is_initialized(void)
++{
++	return lrng_state_operational();
++}
++EXPORT_SYMBOL(rng_is_initialized);
+--- /dev/null
++++ b/drivers/char/lrng/lrng_interface_random_user.c
+@@ -0,0 +1,104 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * LRNG Common user space interfaces compliant to random(4), random(7) and
++ * getrandom(2) man pages.
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/random.h>
++#include <linux/syscalls.h>
++
++#include "lrng_es_mgr.h"
++#include "lrng_interface_dev_common.h"
++
++static ssize_t lrng_drng_read(struct file *file, char __user *buf,
++			      size_t nbytes, loff_t *ppos)
++{
++	if (!lrng_state_min_seeded())
++		pr_notice_ratelimited("%s - use of insufficiently seeded DRNG (%zu bytes read)\n",
++				      current->comm, nbytes);
++	else if (!lrng_state_operational())
++		pr_debug_ratelimited("%s - use of not fully seeded DRNG (%zu bytes read)\n",
++				     current->comm, nbytes);
++
++	return lrng_read_common(buf, nbytes, false);
++}
++
++const struct file_operations random_fops = {
++	.read  = lrng_drng_read_block,
++	.write = lrng_drng_write,
++	.poll  = lrng_random_poll,
++	.unlocked_ioctl = lrng_ioctl,
++	.compat_ioctl = compat_ptr_ioctl,
++	.fasync = lrng_fasync,
++	.llseek = noop_llseek,
++};
++
++const struct file_operations urandom_fops = {
++	.read  = lrng_drng_read,
++	.write = lrng_drng_write,
++	.unlocked_ioctl = lrng_ioctl,
++	.compat_ioctl = compat_ptr_ioctl,
++	.fasync = lrng_fasync,
++	.llseek = noop_llseek,
++};
++
++/*
++ * GRND_SEED
++ *
++ * This flag requests to provide the data directly from the entropy sources.
++ *
++ * The behavior of the call is exactly as outlined for the function
++ * lrng_get_seed in lrng.h.
++ */
++#define GRND_SEED		0x0010
++
++/*
++ * GRND_FULLY_SEEDED
++ *
++ * This flag indicates whether the caller wants to reseed a DRNG that is already
++ * fully seeded. See esdm_get_seed in lrng.h for details.
++ */
++#define GRND_FULLY_SEEDED	0x0020
++
++SYSCALL_DEFINE3(getrandom, char __user *, buf, size_t, count,
++		unsigned int, flags)
++{
++	if (flags & ~(GRND_NONBLOCK|GRND_RANDOM|GRND_INSECURE|
++		      GRND_SEED|GRND_FULLY_SEEDED))
++		return -EINVAL;
++
++	/*
++	 * Requesting insecure and blocking randomness at the same time makes
++	 * no sense.
++	 */
++	if ((flags &
++	     (GRND_INSECURE|GRND_RANDOM)) == (GRND_INSECURE|GRND_RANDOM))
++		return -EINVAL;
++	if ((flags &
++	     (GRND_INSECURE|GRND_SEED)) == (GRND_INSECURE|GRND_SEED))
++		return -EINVAL;
++	if ((flags &
++	     (GRND_RANDOM|GRND_SEED)) == (GRND_RANDOM|GRND_SEED))
++		return -EINVAL;
++
++	if (count > INT_MAX)
++		count = INT_MAX;
++
++	if (flags & GRND_INSECURE) {
++		return lrng_drng_read(NULL, buf, count, NULL);
++	} else if (flags & GRND_SEED) {
++		unsigned int seed_flags = (flags & GRND_NONBLOCK) ?
++					  LRNG_GET_SEED_NONBLOCK : 0;
++
++		seed_flags |= (flags & GRND_FULLY_SEEDED) ?
++			      LRNG_GET_SEED_FULLY_SEEDED : 0;
++		return lrng_read_seed(buf, count, seed_flags);
++	}
++
++	return lrng_read_common_block(flags & GRND_NONBLOCK,
++				      flags & GRND_RANDOM, buf, count);
++}
+From 021ba8b87e270abdb892ae853fc863cb7e258265 Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Sun, 9 Oct 2022 10:22:39 +0200
+Subject: [PATCH 23/25] LRNG - add kernel crypto API interface
+
+The LRNG can be registered with the kernel crypto API's random number
+generator framework. This offers a random number generator with the name
+"lrng" and a priority that is intended to be higher than the existing
+RNG implementations.
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+---
+ drivers/char/lrng/Kconfig                |  26 ++---
+ drivers/char/lrng/Makefile               |   1 +
+ drivers/char/lrng/lrng_interface_kcapi.c | 129 +++++++++++++++++++++++
+ 3 files changed, 143 insertions(+), 13 deletions(-)
+ create mode 100644 drivers/char/lrng/lrng_interface_kcapi.c
+
+--- a/drivers/char/lrng/Kconfig
++++ b/drivers/char/lrng/Kconfig
+@@ -89,18 +89,18 @@ config LRNG_AIS2031_NTG1_SEEDING_STRATEG
+ 
+ endmenu # "Specific DRNG seeding strategies"
+ 
+-# menu "LRNG Interfaces"
+-#
+-# config LRNG_KCAPI_IF
+-# 	tristate "Interface with Kernel Crypto API"
+-# 	depends on CRYPTO_RNG
+-# 	help
+-# 	  The LRNG can be registered with the kernel crypto API's
+-# 	  random number generator framework. This offers a random
+-# 	  number generator with the name "lrng" and a priority that
+-# 	  is intended to be higher than the existing RNG
+-# 	  implementations.
+-#
++menu "LRNG Interfaces"
++
++config LRNG_KCAPI_IF
++	tristate "Interface with Kernel Crypto API"
++	depends on CRYPTO_RNG
++	help
++	  The LRNG can be registered with the kernel crypto API's
++	  random number generator framework. This offers a random
++	  number generator with the name "lrng" and a priority that
++	  is intended to be higher than the existing RNG
++	  implementations.
++
+ # config LRNG_HWRAND_IF
+ # 	tristate "Interface with Hardware Random Number Generator Framework"
+ # 	depends on HW_RANDOM
+@@ -120,7 +120,7 @@ endmenu # "Specific DRNG seeding strateg
+ # 	  identically to /dev/random including IOCTL, read and write
+ # 	  operations.
+ #
+-# endmenu # "LRNG Interfaces"
++endmenu # "LRNG Interfaces"
+ 
+ menu "Entropy Source Configuration"
+ 
+--- a/drivers/char/lrng/Makefile
++++ b/drivers/char/lrng/Makefile
+@@ -34,3 +34,4 @@ obj-$(CONFIG_LRNG_COMMON_DEV_IF)	+= lrng
+ obj-$(CONFIG_LRNG_RANDOM_IF)		+= lrng_interface_random_user.o \
+ 					   lrng_interface_random_kernel.o \
+ 					   lrng_interface_aux.o
++obj-$(CONFIG_LRNG_KCAPI_IF)		+= lrng_interface_kcapi.o
+--- /dev/null
++++ b/drivers/char/lrng/lrng_interface_kcapi.c
+@@ -0,0 +1,129 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * LRNG interface with the RNG framework of the kernel crypto API
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#include <linux/lrng.h>
++#include <linux/module.h>
++#include <crypto/internal/rng.h>
++
++#include "lrng_drng_mgr.h"
++#include "lrng_es_aux.h"
++
++static int lrng_kcapi_if_init(struct crypto_tfm *tfm)
++{
++	return 0;
++}
++
++static void lrng_kcapi_if_cleanup(struct crypto_tfm *tfm) { }
++
++static int lrng_kcapi_if_reseed(const u8 *src, unsigned int slen)
++{
++	int ret;
++
++	if (!slen)
++		return 0;
++
++	/* Insert caller-provided data without crediting entropy */
++	ret = lrng_pool_insert_aux((u8 *)src, slen, 0);
++	if (ret)
++		return ret;
++
++	/* Make sure the new data is immediately available to DRNG */
++	lrng_drng_force_reseed();
++
++	return 0;
++}
++
++static int lrng_kcapi_if_random(struct crypto_rng *tfm,
++				const u8 *src, unsigned int slen,
++				u8 *rdata, unsigned int dlen)
++{
++	int ret = lrng_kcapi_if_reseed(src, slen);
++
++	if (!ret)
++		lrng_get_random_bytes_full(rdata, dlen);
++
++	return ret;
++}
++
++static int lrng_kcapi_if_reset(struct crypto_rng *tfm,
++			       const u8 *seed, unsigned int slen)
++{
++	return lrng_kcapi_if_reseed(seed, slen);
++}
++
++static struct rng_alg lrng_alg = {
++	.generate		= lrng_kcapi_if_random,
++	.seed			= lrng_kcapi_if_reset,
++	.seedsize		= 0,
++	.base			= {
++		.cra_name               = "stdrng",
++		.cra_driver_name        = "lrng",
++		.cra_priority           = 500,
++		.cra_ctxsize            = 0,
++		.cra_module             = THIS_MODULE,
++		.cra_init               = lrng_kcapi_if_init,
++		.cra_exit               = lrng_kcapi_if_cleanup,
++
++	}
++};
++
++#ifdef CONFIG_LRNG_DRNG_ATOMIC
++static int lrng_kcapi_if_random_atomic(struct crypto_rng *tfm,
++				       const u8 *src, unsigned int slen,
++				       u8 *rdata, unsigned int dlen)
++{
++	int ret = lrng_kcapi_if_reseed(src, slen);
++
++	if (!ret)
++		lrng_get_random_bytes(rdata, dlen);
++
++	return ret;
++}
++
++static struct rng_alg lrng_alg_atomic = {
++	.generate		= lrng_kcapi_if_random_atomic,
++	.seed			= lrng_kcapi_if_reset,
++	.seedsize		= 0,
++	.base			= {
++		.cra_name               = "lrng_atomic",
++		.cra_driver_name        = "lrng_atomic",
++		.cra_priority           = 100,
++		.cra_ctxsize            = 0,
++		.cra_module             = THIS_MODULE,
++		.cra_init               = lrng_kcapi_if_init,
++		.cra_exit               = lrng_kcapi_if_cleanup,
++
++	}
++};
++#endif /* CONFIG_LRNG_DRNG_ATOMIC */
++
++static int __init lrng_kcapi_if_mod_init(void)
++{
++	return
++#ifdef CONFIG_LRNG_DRNG_ATOMIC
++	       crypto_register_rng(&lrng_alg_atomic) ?:
++#endif
++	       crypto_register_rng(&lrng_alg);
++}
++
++static void __exit lrng_kcapi_if_mod_exit(void)
++{
++	crypto_unregister_rng(&lrng_alg);
++#ifdef CONFIG_LRNG_DRNG_ATOMIC
++	crypto_unregister_rng(&lrng_alg_atomic);
++#endif
++}
++
++module_init(lrng_kcapi_if_mod_init);
++module_exit(lrng_kcapi_if_mod_exit);
++
++MODULE_LICENSE("Dual BSD/GPL");
++MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>");
++MODULE_DESCRIPTION("Entropy Source and DRNG Manager kernel crypto API RNG framework interface");
++MODULE_ALIAS_CRYPTO("lrng");
++MODULE_ALIAS_CRYPTO("lrng_atomic");
++MODULE_ALIAS_CRYPTO("stdrng");
+From 7697fe0de6bdc7a8e0a4c722dbf6dec24ffe53d5 Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Sun, 15 May 2022 18:39:30 +0200
+Subject: [PATCH 24/25] LRNG - add /dev/lrng device file support
+
+The LRNG can create a character device file that operates identically
+to /dev/random including IOCTL, read and write operations.
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+---
+ drivers/char/lrng/Kconfig              | 18 ++++++-------
+ drivers/char/lrng/Makefile             |  1 +
+ drivers/char/lrng/lrng_interface_dev.c | 35 ++++++++++++++++++++++++++
+ 3 files changed, 45 insertions(+), 9 deletions(-)
+ create mode 100644 drivers/char/lrng/lrng_interface_dev.c
+
+--- a/drivers/char/lrng/Kconfig
++++ b/drivers/char/lrng/Kconfig
+@@ -111,15 +111,15 @@ config LRNG_KCAPI_IF
+ # 	  with the name "lrng" that is accessible via the framework.
+ # 	  For example it allows pulling data from the LRNG via the
+ # 	  /dev/hwrng file.
+-#
+-# config LRNG_DEV_IF
+-# 	bool "Character device file interface"
+-# 	select LRNG_COMMON_DEV_IF
+-# 	help
+-# 	  The LRNG can create a character device file that operates
+-# 	  identically to /dev/random including IOCTL, read and write
+-# 	  operations.
+-#
++
++config LRNG_DEV_IF
++	bool "Character device file interface"
++	select LRNG_COMMON_DEV_IF
++	help
++	  The LRNG can create a character device file that operates
++	  identically to /dev/random including IOCTL, read and write
++	  operations.
++
+ endmenu # "LRNG Interfaces"
+ 
+ menu "Entropy Source Configuration"
+--- a/drivers/char/lrng/Makefile
++++ b/drivers/char/lrng/Makefile
+@@ -35,3 +35,4 @@ obj-$(CONFIG_LRNG_RANDOM_IF)		+= lrng_in
+ 					   lrng_interface_random_kernel.o \
+ 					   lrng_interface_aux.o
+ obj-$(CONFIG_LRNG_KCAPI_IF)		+= lrng_interface_kcapi.o
++obj-$(CONFIG_LRNG_DEV_IF)		+= lrng_interface_dev.o
+--- /dev/null
++++ b/drivers/char/lrng/lrng_interface_dev.c
+@@ -0,0 +1,35 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * LRNG user space device file interface
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#include <linux/miscdevice.h>
++#include <linux/module.h>
++
++#include "lrng_interface_dev_common.h"
++
++static const struct file_operations lrng_fops = {
++	.read  = lrng_drng_read_block,
++	.write = lrng_drng_write,
++	.poll  = lrng_random_poll,
++	.unlocked_ioctl = lrng_ioctl,
++	.compat_ioctl = compat_ptr_ioctl,
++	.fasync = lrng_fasync,
++	.llseek = noop_llseek,
++};
++
++static struct miscdevice lrng_miscdev = {
++	.minor          = MISC_DYNAMIC_MINOR,
++	.name           = "lrng",
++	.nodename       = "lrng",
++	.fops           = &lrng_fops,
++	.mode		= 0666
++};
++
++static int __init lrng_dev_if_mod_init(void)
++{
++	return misc_register(&lrng_miscdev);
++}
++device_initcall(lrng_dev_if_mod_init);
+From 243b20ab41748e898abcf298b0cb836f04391afd Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Sun, 15 May 2022 18:43:30 +0200
+Subject: [PATCH 25/25] LRNG - add hwrand framework interface
+
+The LRNG can be registered with the hardware random number generator
+framework. This offers a random number generator with the name "lrng"
+that is accessible via the framework. For example it allows pulling
+data from the LRNG via the /dev/hwrng file.
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+---
+ drivers/char/lrng/Kconfig                 | 20 +++----
+ drivers/char/lrng/Makefile                |  1 +
+ drivers/char/lrng/lrng_interface_hwrand.c | 68 +++++++++++++++++++++++
+ 3 files changed, 79 insertions(+), 10 deletions(-)
+ create mode 100644 drivers/char/lrng/lrng_interface_hwrand.c
+
+--- a/drivers/char/lrng/Kconfig
++++ b/drivers/char/lrng/Kconfig
+@@ -101,16 +101,16 @@ config LRNG_KCAPI_IF
+ 	  is intended to be higher than the existing RNG
+ 	  implementations.
+ 
+-# config LRNG_HWRAND_IF
+-# 	tristate "Interface with Hardware Random Number Generator Framework"
+-# 	depends on HW_RANDOM
+-# 	select LRNG_DRNG_ATOMIC
+-# 	help
+-# 	  The LRNG can be registered with the hardware random number
+-# 	  generator framework. This offers a random number generator
+-# 	  with the name "lrng" that is accessible via the framework.
+-# 	  For example it allows pulling data from the LRNG via the
+-# 	  /dev/hwrng file.
++config LRNG_HWRAND_IF
++	tristate "Interface with Hardware Random Number Generator Framework"
++	depends on HW_RANDOM
++	select LRNG_DRNG_ATOMIC
++	help
++	  The LRNG can be registered with the hardware random number
++	  generator framework. This offers a random number generator
++	  with the name "lrng" that is accessible via the framework.
++	  For example it allows pulling data from the LRNG via the
++	  /dev/hwrng file.
+ 
+ config LRNG_DEV_IF
+ 	bool "Character device file interface"
+--- a/drivers/char/lrng/Makefile
++++ b/drivers/char/lrng/Makefile
+@@ -36,3 +36,4 @@ obj-$(CONFIG_LRNG_RANDOM_IF)		+= lrng_in
+ 					   lrng_interface_aux.o
+ obj-$(CONFIG_LRNG_KCAPI_IF)		+= lrng_interface_kcapi.o
+ obj-$(CONFIG_LRNG_DEV_IF)		+= lrng_interface_dev.o
++obj-$(CONFIG_LRNG_HWRAND_IF)		+= lrng_interface_hwrand.o
+--- /dev/null
++++ b/drivers/char/lrng/lrng_interface_hwrand.c
+@@ -0,0 +1,68 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
++/*
++ * LRNG interface with the HW-Random framework
++ *
++ * Copyright (C) 2022, Stephan Mueller <smueller@chronox.de>
++ */
++
++#include <linux/lrng.h>
++#include <linux/hw_random.h>
++#include <linux/module.h>
++
++static int lrng_hwrand_if_random(struct hwrng *rng, void *buf, size_t max,
++				 bool wait)
++{
++	/*
++	 * lrng_get_random_bytes_full not called as we cannot block.
++	 *
++	 * Note: We should either adjust .quality below depending on
++	 * rng_is_initialized() or block here, but neither is not supported by
++	 * the hw_rand framework.
++	 */
++	lrng_get_random_bytes(buf, max);
++	return (int)max;
++}
++
++static struct hwrng lrng_hwrand = {
++	.name		= "lrng",
++	.init		= NULL,
++	.cleanup	= NULL,
++	.read		= lrng_hwrand_if_random,
++
++	/*
++	 * We set .quality only in case the LRNG does not provide the common
++	 * interfaces or does not use the legacy RNG as entropy source. This
++	 * shall avoid that the LRNG automatically spawns the hw_rand
++	 * framework's hwrng kernel thread to feed data into
++	 * add_hwgenerator_randomness. When the LRNG implements the common
++	 * interfaces, this function feeds the data directly into the LRNG.
++	 * If the LRNG uses the legacy RNG as entropy source,
++	 * add_hwgenerator_randomness is implemented by the legacy RNG, but
++	 * still eventually feeds the data into the LRNG. We should avoid such
++	 * circular loops.
++	 *
++	 * We can specify full entropy here, because the LRNG is designed
++	 * to provide full entropy.
++	 */
++#if !defined(CONFIG_LRNG_RANDOM_IF) && \
++    !defined(CONFIG_LRNG_KERNEL_RNG)
++	.quality	= 1024,
++#endif
++};
++
++static int __init lrng_hwrand_if_mod_init(void)
++{
++	return hwrng_register(&lrng_hwrand);
++}
++
++static void __exit lrng_hwrand_if_mod_exit(void)
++{
++	hwrng_unregister(&lrng_hwrand);
++}
++
++module_init(lrng_hwrand_if_mod_init);
++module_exit(lrng_hwrand_if_mod_exit);
++
++MODULE_LICENSE("Dual BSD/GPL");
++MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>");
++MODULE_DESCRIPTION("Entropy Source and DRNG Manager HW-Random Interface");
diff --git a/6.12/target/linux/generic/hack-6.12/998-ndpi-hook.patch b/6.12/target/linux/generic/hack-6.12/998-ndpi-hook.patch
new file mode 100644
index 00000000..1c8679ba
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/998-ndpi-hook.patch
@@ -0,0 +1,81 @@
+diff -urpN linux-6.1.38.old/include/net/netfilter/nf_conntrack.h linux-6.1.38/include/net/netfilter/nf_conntrack.h
+--- linux-6.1.38.old/include/net/netfilter/nf_conntrack.h	2023-07-05 23:27:38.000000000 +0600
++++ linux-6.1.38/include/net/netfilter/nf_conntrack.h	2023-07-14 12:34:56.663750711 +0600
+@@ -362,6 +362,11 @@ static inline struct nf_conntrack_net *n
+ 	return net_generic(net, nf_conntrack_net_id);
+ }
+ 
++#ifdef CONFIG_NF_CONNTRACK_DESTROY_HOOK
++void register_nf_ct_destroy_hook(void (*hook)(struct nf_conn *));
++void unregister_nf_ct_destroy_hook(void);
++#endif
++
+ #define NF_CT_STAT_INC(net, count)	  __this_cpu_inc((net)->ct.stat->count)
+ #define NF_CT_STAT_INC_ATOMIC(net, count) this_cpu_inc((net)->ct.stat->count)
+ #define NF_CT_STAT_ADD_ATOMIC(net, count, v) this_cpu_add((net)->ct.stat->count, (v))
+diff -urpN linux-6.1.38.old/net/netfilter/Kconfig linux-6.1.38/net/netfilter/Kconfig
+--- linux-6.1.38.old/net/netfilter/Kconfig	2023-07-05 23:27:38.000000000 +0600
++++ linux-6.1.38/net/netfilter/Kconfig	2023-07-14 12:34:11.966879899 +0600
+@@ -76,11 +76,15 @@ config NETFILTER_NETLINK_OSF
+ 	  If this option is enabled, the kernel will include support
+ 	  for passive OS fingerprint via NFNETLINK.
+ 
++config NF_CONNTRACK_DESTROY_HOOK
++	bool
++
+ config NF_CONNTRACK
+ 	tristate "Netfilter connection tracking support"
+ 	default m if NETFILTER_ADVANCED=n
+ 	select NF_DEFRAG_IPV4
+ 	select NF_DEFRAG_IPV6 if IPV6 != n
++	select NF_CONNTRACK_DESTROY_HOOK
+ 	help
+ 	  Connection tracking keeps a record of what packets have passed
+ 	  through your machine, in order to figure out how they are related
+diff -urpN linux-6.1.38.old/net/netfilter/nf_conntrack_core.c linux-6.1.38/net/netfilter/nf_conntrack_core.c
+--- linux-6.1.38.old/net/netfilter/nf_conntrack_core.c	2023-07-05 23:27:38.000000000 +0600
++++ linux-6.1.38/net/netfilter/nf_conntrack_core.c	2023-07-14 12:33:45.580092713 +0600
+@@ -582,9 +582,30 @@ static void destroy_gre_conntrack(struct
+ #endif
+ }
+ 
++#ifdef CONFIG_NF_CONNTRACK_DESTROY_HOOK
++
++static void (*nf_ct_destroy_hook)(struct nf_conn *) __rcu __read_mostly = NULL;
++
++void register_nf_ct_destroy_hook(void (*hook)(struct nf_conn *))
++{
++	rcu_assign_pointer(nf_ct_destroy_hook, hook);
++}
++EXPORT_SYMBOL(register_nf_ct_destroy_hook);
++
++void unregister_nf_ct_destroy_hook(void)
++{
++	rcu_assign_pointer(nf_ct_destroy_hook, NULL);
++}
++
++EXPORT_SYMBOL(unregister_nf_ct_destroy_hook);
++#endif
++
+ void nf_ct_destroy(struct nf_conntrack *nfct)
+ {
+ 	struct nf_conn *ct = (struct nf_conn *)nfct;
++#ifdef CONFIG_NF_CONNTRACK_DESTROY_HOOK
++	void (*hook)(struct nf_conn *);
++#endif
+ 
+ 	pr_debug("%s(%p)\n", __func__, ct);
+ 	WARN_ON(refcount_read(&nfct->use) != 0);
+@@ -594,6 +615,12 @@ void nf_ct_destroy(struct nf_conntrack *
+ 		return;
+ 	}
+ 
++#ifdef CONFIG_NF_CONNTRACK_DESTROY_HOOK
++	hook = rcu_dereference(nf_ct_destroy_hook);
++	if (hook)
++		hook(ct);
++#endif
++
+ 	if (unlikely(nf_ct_protonum(ct) == IPPROTO_GRE))
+ 		destroy_gre_conntrack(ct);
+ 
diff --git a/6.12/target/linux/generic/hack-6.12/999-mptcp-next.patch b/6.12/target/linux/generic/hack-6.12/999-mptcp-next.patch
new file mode 100644
index 00000000..4853ce7b
--- /dev/null
+++ b/6.12/target/linux/generic/hack-6.12/999-mptcp-next.patch
@@ -0,0 +1,2043 @@
+From 29913eae8451264716a71485652e9230508cfde6 Mon Sep 17 00:00:00 2001
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Mon, 16 Sep 2024 05:52:07 +0000
+Subject: [PATCH 08/28] mptcp: pm: send ACK on non stale subflows
+
+If the subflow is considered as "staled", it is better to avoid it to
+send an ACK carrying an ADD_ADDR or RM_ADDR. Another subflow, if any,
+will then be selected.
+
+Reviewed-by: Mat Martineau <martineau@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+---
+ net/mptcp/pm_netlink.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c
+index 64fe0e7d87d7..fe34297ea6dc 100644
+--- a/net/mptcp/pm_netlink.c
++++ b/net/mptcp/pm_netlink.c
+@@ -781,7 +781,7 @@ bool mptcp_pm_nl_is_init_remote_addr(struct mptcp_sock *msk,
+ 
+ void mptcp_pm_nl_addr_send_ack(struct mptcp_sock *msk)
+ {
+-	struct mptcp_subflow_context *subflow;
++	struct mptcp_subflow_context *subflow, *alt = NULL;
+ 
+ 	msk_owned_by_me(msk);
+ 	lockdep_assert_held(&msk->pm.lock);
+@@ -792,10 +792,18 @@ void mptcp_pm_nl_addr_send_ack(struct mptcp_sock *msk)
+ 
+ 	mptcp_for_each_subflow(msk, subflow) {
+ 		if (__mptcp_subflow_active(subflow)) {
+-			mptcp_pm_send_ack(msk, subflow, false, false);
+-			break;
++			if (!subflow->stale) {
++				mptcp_pm_send_ack(msk, subflow, false, false);
++				return;
++			}
++
++			if (!alt)
++				alt = subflow;
+ 		}
+ 	}
++
++	if (alt)
++		mptcp_pm_send_ack(msk, alt, false, false);
+ }
+ 
+ int mptcp_pm_nl_mp_prio_send_ack(struct mptcp_sock *msk,
+-- 
+2.46.0
+
+From 2ef0370d529d8d17e63fb196ba097b684535b5c4 Mon Sep 17 00:00:00 2001
+From: Geliang Tang <tanggeliang@kylinos.cn>
+Date: Mon, 16 Sep 2024 05:52:09 +0000
+Subject: [PATCH 10/28] mptcp: implement mptcp_pm_connection_closed
+
+The MPTCP path manager event handler mptcp_pm_connection_closed
+interface has been added in the commit 1b1c7a0ef7f3 ("mptcp: Add path
+manager interface") but it was an empty function from then on.
+
+With such name, it sounds good to invoke mptcp_event with the
+MPTCP_EVENT_CLOSED event type from it. It also removes a bit of
+duplicated code.
+
+Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
+Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+---
+ net/mptcp/pm.c       | 3 +++
+ net/mptcp/protocol.c | 6 ++----
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c
+index 620264c75dc2..16c336c51940 100644
+--- a/net/mptcp/pm.c
++++ b/net/mptcp/pm.c
+@@ -154,6 +154,9 @@ void mptcp_pm_fully_established(struct mptcp_sock *msk, const struct sock *ssk)
+ void mptcp_pm_connection_closed(struct mptcp_sock *msk)
+ {
+ 	pr_debug("msk=%p\n", msk);
++
++	if (msk->token)
++		mptcp_event(MPTCP_EVENT_CLOSED, msk, NULL, GFP_KERNEL);
+ }
+ 
+ void mptcp_pm_subflow_established(struct mptcp_sock *msk)
+diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
+index 833fb28d8936..7cc8d81ee605 100644
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -3121,8 +3121,7 @@ bool __mptcp_close(struct sock *sk, long timeout)
+ 
+ 	sock_hold(sk);
+ 	pr_debug("msk=%p state=%d\n", sk, sk->sk_state);
+-	if (msk->token)
+-		mptcp_event(MPTCP_EVENT_CLOSED, msk, NULL, GFP_KERNEL);
++	mptcp_pm_connection_closed(msk);
+ 
+ 	if (sk->sk_state == TCP_CLOSE) {
+ 		__mptcp_destroy_sock(sk);
+@@ -3188,8 +3187,7 @@ static int mptcp_disconnect(struct sock *sk, int flags)
+ 	mptcp_stop_rtx_timer(sk);
+ 	mptcp_stop_tout_timer(sk);
+ 
+-	if (msk->token)
+-		mptcp_event(MPTCP_EVENT_CLOSED, msk, NULL, GFP_KERNEL);
++	mptcp_pm_connection_closed(msk);
+ 
+ 	/* msk->subflow is still intact, the following will not free the first
+ 	 * subflow
+-- 
+2.46.0
+
+From cc4cbde1802daaac692d1bc6f15fd470c51f987b Mon Sep 17 00:00:00 2001
+From: Geliang Tang <tanggeliang@kylinos.cn>
+Date: Mon, 16 Sep 2024 05:52:12 +0000
+Subject: [PATCH 13/28] mptcp: add sched_data helpers
+
+Add a new helper mptcp_sched_data_set_contexts() to set the subflow
+pointers array in struct mptcp_sched_data. Add a new helper
+mptcp_subflow_ctx_by_pos() to get the given pos subflow from the
+contexts array in struct mptcp_sched_data. They will be invoked by
+the BPF schedulers to export the subflow pointers to the BPF contexts.
+
+Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
+Reviewed-by: Mat Martineau <martineau@kernel.org>
+---
+ net/mptcp/bpf.c      | 14 ++++++++++++++
+ net/mptcp/protocol.h |  2 ++
+ net/mptcp/sched.c    | 22 ++++++++++++++++++++++
+ 3 files changed, 38 insertions(+)
+
+diff --git a/net/mptcp/bpf.c b/net/mptcp/bpf.c
+index 8a16672b94e2..c3d62535eb0c 100644
+--- a/net/mptcp/bpf.c
++++ b/net/mptcp/bpf.c
+@@ -29,6 +29,20 @@ static const struct btf_kfunc_id_set bpf_mptcp_fmodret_set = {
+ 	.set   = &bpf_mptcp_fmodret_ids,
+ };
+ 
++__diag_push();
++__diag_ignore_all("-Wmissing-prototypes",
++		  "kfuncs which will be used in BPF programs");
++
++__bpf_kfunc struct mptcp_subflow_context *
++bpf_mptcp_subflow_ctx_by_pos(const struct mptcp_sched_data *data, unsigned int pos)
++{
++	if (pos >= MPTCP_SUBFLOWS_MAX)
++		return NULL;
++	return data->contexts[pos];
++}
++
++__diag_pop();
++
+ static int __init bpf_mptcp_kfunc_init(void)
+ {
+ 	return register_btf_fmodret_id_set(&bpf_mptcp_fmodret_set);
+diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
+index bbbf200b0c94..a1d06e7e3544 100644
+--- a/net/mptcp/protocol.h
++++ b/net/mptcp/protocol.h
+@@ -719,6 +719,8 @@ void __mptcp_subflow_send_ack(struct sock *ssk);
+ void mptcp_subflow_reset(struct sock *ssk);
+ void mptcp_subflow_queue_clean(struct sock *sk, struct sock *ssk);
+ void mptcp_sock_graft(struct sock *sk, struct socket *parent);
++struct mptcp_subflow_context *
++bpf_mptcp_subflow_ctx_by_pos(const struct mptcp_sched_data *data, unsigned int pos);
+ struct sock *__mptcp_nmpc_sk(struct mptcp_sock *msk);
+ bool __mptcp_close(struct sock *sk, long timeout);
+ void mptcp_cancel_work(struct sock *sk);
+diff --git a/net/mptcp/sched.c b/net/mptcp/sched.c
+index 78ed508ebc1b..5257bc6c8cd6 100644
+--- a/net/mptcp/sched.c
++++ b/net/mptcp/sched.c
+@@ -143,6 +143,26 @@ void mptcp_subflow_set_scheduled(struct mptcp_subflow_context *subflow,
+ 	WRITE_ONCE(subflow->scheduled, scheduled);
+ }
+ 
++static void mptcp_sched_data_set_contexts(const struct mptcp_sock *msk,
++					  struct mptcp_sched_data *data)
++{
++	struct mptcp_subflow_context *subflow;
++	int i = 0;
++
++	mptcp_for_each_subflow(msk, subflow) {
++		if (i == MPTCP_SUBFLOWS_MAX) {
++			pr_warn_once("too many subflows");
++			break;
++		}
++		mptcp_subflow_set_scheduled(subflow, false);
++		data->contexts[i++] = subflow;
++	}
++	data->subflows = i;
++
++	for (; i < MPTCP_SUBFLOWS_MAX; i++)
++		data->contexts[i] = NULL;
++}
++
+ int mptcp_sched_get_send(struct mptcp_sock *msk)
+ {
+ 	struct mptcp_subflow_context *subflow;
+@@ -169,6 +189,7 @@ int mptcp_sched_get_send(struct mptcp_sock *msk)
+ 	data.reinject = false;
+ 	if (msk->sched == &mptcp_sched_default || !msk->sched)
+ 		return mptcp_sched_default_get_subflow(msk, &data);
++	mptcp_sched_data_set_contexts(msk, &data);
+ 	return msk->sched->get_subflow(msk, &data);
+ }
+ 
+@@ -191,5 +212,6 @@ int mptcp_sched_get_retrans(struct mptcp_sock *msk)
+ 	data.reinject = true;
+ 	if (msk->sched == &mptcp_sched_default || !msk->sched)
+ 		return mptcp_sched_default_get_subflow(msk, &data);
++	mptcp_sched_data_set_contexts(msk, &data);
+ 	return msk->sched->get_subflow(msk, &data);
+ }
+-- 
+2.46.0
+
+From a6f63a6b7b8076b59098b684577327a32bf0f5a8 Mon Sep 17 00:00:00 2001
+From: Geliang Tang <tanggeliang@kylinos.cn>
+Date: Mon, 16 Sep 2024 05:52:13 +0000
+Subject: [PATCH 14/28] bpf: Add bpf_mptcp_sched_ops
+
+This patch implements a new struct bpf_struct_ops: bpf_mptcp_sched_ops.
+Register and unregister the bpf scheduler in .reg and .unreg.
+
+Add write access for the scheduled flag of struct mptcp_subflow_context
+in .btf_struct_access.
+
+This MPTCP BPF scheduler implementation is similar to BPF TCP CC. And
+net/ipv4/bpf_tcp_ca.c is a frame of reference for this patch.
+
+Acked-by: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: Mat Martineau <martineau@kernel.org>
+Co-developed-by: Matthieu Baerts <matttbe@kernel.org>
+Signed-off-by: Matthieu Baerts <matttbe@kernel.org>
+Co-developed-by: Gregory Detal <gregory.detal@gmail.com>
+Signed-off-by: Gregory Detal <gregory.detal@gmail.com>
+Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
+---
+ net/mptcp/bpf.c | 181 +++++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 180 insertions(+), 1 deletion(-)
+
+diff --git a/net/mptcp/bpf.c b/net/mptcp/bpf.c
+index c3d62535eb0c..89b69ab1cf8e 100644
+--- a/net/mptcp/bpf.c
++++ b/net/mptcp/bpf.c
+@@ -10,8 +10,180 @@
+ #define pr_fmt(fmt) "MPTCP: " fmt
+ 
+ #include <linux/bpf.h>
++#include <linux/bpf_verifier.h>
++#include <linux/btf.h>
++#include <linux/btf_ids.h>
++#include <net/bpf_sk_storage.h>
+ #include "protocol.h"
+ 
++#ifdef CONFIG_BPF_JIT
++static struct bpf_struct_ops bpf_mptcp_sched_ops;
++static const struct btf_type *mptcp_sock_type, *mptcp_subflow_type __read_mostly;
++static u32 mptcp_sock_id, mptcp_subflow_id;
++
++static const struct bpf_func_proto *
++bpf_mptcp_sched_get_func_proto(enum bpf_func_id func_id,
++			       const struct bpf_prog *prog)
++{
++	switch (func_id) {
++	case BPF_FUNC_sk_storage_get:
++		return &bpf_sk_storage_get_proto;
++	case BPF_FUNC_sk_storage_delete:
++		return &bpf_sk_storage_delete_proto;
++	case BPF_FUNC_skc_to_tcp6_sock:
++		return &bpf_skc_to_tcp6_sock_proto;
++	case BPF_FUNC_skc_to_tcp_sock:
++		return &bpf_skc_to_tcp_sock_proto;
++	default:
++		return bpf_base_func_proto(func_id, prog);
++	}
++}
++
++static int bpf_mptcp_sched_btf_struct_access(struct bpf_verifier_log *log,
++					     const struct bpf_reg_state *reg,
++					     int off, int size)
++{
++	const struct btf_type *t;
++	size_t end;
++
++	t = btf_type_by_id(reg->btf, reg->btf_id);
++
++	if (t == mptcp_sock_type) {
++		switch (off) {
++		case offsetof(struct mptcp_sock, snd_burst):
++			end = offsetofend(struct mptcp_sock, snd_burst);
++			break;
++		default:
++			bpf_log(log, "no write support to mptcp_sock at off %d\n",
++				off);
++			return -EACCES;
++		}
++	} else if (t == mptcp_subflow_type) {
++		switch (off) {
++		case offsetof(struct mptcp_subflow_context, avg_pacing_rate):
++			end = offsetofend(struct mptcp_subflow_context, avg_pacing_rate);
++			break;
++		default:
++			bpf_log(log, "no write support to mptcp_subflow_context at off %d\n",
++				off);
++			return -EACCES;
++		}
++	} else {
++		bpf_log(log, "only access to mptcp sock or subflow is supported\n");
++		return -EACCES;
++	}
++
++	if (off + size > end) {
++		bpf_log(log, "access beyond %s at off %u size %u ended at %zu",
++			t == mptcp_sock_type ? "mptcp_sock" : "mptcp_subflow_context",
++			off, size, end);
++		return -EACCES;
++	}
++
++	return NOT_INIT;
++}
++
++static const struct bpf_verifier_ops bpf_mptcp_sched_verifier_ops = {
++	.get_func_proto		= bpf_mptcp_sched_get_func_proto,
++	.is_valid_access	= bpf_tracing_btf_ctx_access,
++	.btf_struct_access	= bpf_mptcp_sched_btf_struct_access,
++};
++
++static int bpf_mptcp_sched_reg(void *kdata, struct bpf_link *link)
++{
++	return mptcp_register_scheduler(kdata);
++}
++
++static void bpf_mptcp_sched_unreg(void *kdata, struct bpf_link *link)
++{
++	mptcp_unregister_scheduler(kdata);
++}
++
++static int bpf_mptcp_sched_check_member(const struct btf_type *t,
++					const struct btf_member *member,
++					const struct bpf_prog *prog)
++{
++	return 0;
++}
++
++static int bpf_mptcp_sched_init_member(const struct btf_type *t,
++				       const struct btf_member *member,
++				       void *kdata, const void *udata)
++{
++	const struct mptcp_sched_ops *usched;
++	struct mptcp_sched_ops *sched;
++	u32 moff;
++
++	usched = (const struct mptcp_sched_ops *)udata;
++	sched = (struct mptcp_sched_ops *)kdata;
++
++	moff = __btf_member_bit_offset(t, member) / 8;
++	switch (moff) {
++	case offsetof(struct mptcp_sched_ops, name):
++		if (bpf_obj_name_cpy(sched->name, usched->name,
++				     sizeof(sched->name)) <= 0)
++			return -EINVAL;
++		if (mptcp_sched_find(usched->name))
++			return -EEXIST;
++		return 1;
++	}
++
++	return 0;
++}
++
++static int bpf_mptcp_sched_init(struct btf *btf)
++{
++	s32 type_id;
++
++	type_id = btf_find_by_name_kind(btf, "mptcp_sock",
++					BTF_KIND_STRUCT);
++	if (type_id < 0)
++		return -EINVAL;
++	mptcp_sock_id = type_id;
++	mptcp_sock_type = btf_type_by_id(btf, mptcp_sock_id);
++
++	type_id = btf_find_by_name_kind(btf, "mptcp_subflow_context",
++					BTF_KIND_STRUCT);
++	if (type_id < 0)
++		return -EINVAL;
++	mptcp_subflow_id = type_id;
++	mptcp_subflow_type = btf_type_by_id(btf, mptcp_subflow_id);
++
++	return 0;
++}
++
++static int __bpf_mptcp_sched_get_subflow(struct mptcp_sock *msk,
++					 struct mptcp_sched_data *data)
++{
++	return 0;
++}
++
++static void __bpf_mptcp_sched_init(struct mptcp_sock *msk)
++{
++}
++
++static void __bpf_mptcp_sched_release(struct mptcp_sock *msk)
++{
++}
++
++static struct mptcp_sched_ops __bpf_mptcp_sched_ops = {
++	.get_subflow	= __bpf_mptcp_sched_get_subflow,
++	.init		= __bpf_mptcp_sched_init,
++	.release	= __bpf_mptcp_sched_release,
++};
++
++static struct bpf_struct_ops bpf_mptcp_sched_ops = {
++	.verifier_ops	= &bpf_mptcp_sched_verifier_ops,
++	.reg		= bpf_mptcp_sched_reg,
++	.unreg		= bpf_mptcp_sched_unreg,
++	.check_member	= bpf_mptcp_sched_check_member,
++	.init_member	= bpf_mptcp_sched_init_member,
++	.init		= bpf_mptcp_sched_init,
++	.name		= "mptcp_sched_ops",
++	.cfi_stubs	= &__bpf_mptcp_sched_ops,
++};
++#endif /* CONFIG_BPF_JIT */
++
+ struct mptcp_sock *bpf_mptcp_sock_from_subflow(struct sock *sk)
+ {
+ 	if (sk && sk_fullsock(sk) && sk->sk_protocol == IPPROTO_TCP && sk_is_mptcp(sk))
+@@ -45,6 +217,13 @@ __diag_pop();
+ 
+ static int __init bpf_mptcp_kfunc_init(void)
+ {
+-	return register_btf_fmodret_id_set(&bpf_mptcp_fmodret_set);
++	int ret;
++
++	ret = register_btf_fmodret_id_set(&bpf_mptcp_fmodret_set);
++#ifdef CONFIG_BPF_JIT
++	ret = ret ?: register_bpf_struct_ops(&bpf_mptcp_sched_ops, mptcp_sched_ops);
++#endif
++
++	return ret;
+ }
+ late_initcall(bpf_mptcp_kfunc_init);
+-- 
+2.46.0
+
+From 6e68551820459adac18dd50d189e8bb56f70b5aa Mon Sep 17 00:00:00 2001
+From: Geliang Tang <tanggeliang@kylinos.cn>
+Date: Mon, 16 Sep 2024 05:52:14 +0000
+Subject: [PATCH 15/28] bpf: Add bpf_mptcp_sched_kfunc_set
+
+This patch adds a new struct btf_kfunc_id_set for MPTCP scheduler. Add
+mptcp_subflow_set_scheduled() and mptcp_sched_data_set_contexts() helpers
+into this id_set, and register it in bpf_mptcp_kfunc_init() to make sure
+these helpers can be accessed from the BPF context.
+
+Reviewed-by: Mat Martineau <martineau@kernel.org>
+Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
+---
+ net/mptcp/bpf.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/net/mptcp/bpf.c b/net/mptcp/bpf.c
+index 89b69ab1cf8e..2c0fb9bddb9d 100644
+--- a/net/mptcp/bpf.c
++++ b/net/mptcp/bpf.c
+@@ -215,11 +215,23 @@ bpf_mptcp_subflow_ctx_by_pos(const struct mptcp_sched_data *data, unsigned int p
+ 
+ __diag_pop();
+ 
++BTF_KFUNCS_START(bpf_mptcp_sched_kfunc_ids)
++BTF_ID_FLAGS(func, mptcp_subflow_set_scheduled)
++BTF_ID_FLAGS(func, bpf_mptcp_subflow_ctx_by_pos)
++BTF_KFUNCS_END(bpf_mptcp_sched_kfunc_ids)
++
++static const struct btf_kfunc_id_set bpf_mptcp_sched_kfunc_set = {
++	.owner	= THIS_MODULE,
++	.set	= &bpf_mptcp_sched_kfunc_ids,
++};
++
+ static int __init bpf_mptcp_kfunc_init(void)
+ {
+ 	int ret;
+ 
+ 	ret = register_btf_fmodret_id_set(&bpf_mptcp_fmodret_set);
++	ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_STRUCT_OPS,
++					       &bpf_mptcp_sched_kfunc_set);
+ #ifdef CONFIG_BPF_JIT
+ 	ret = ret ?: register_bpf_struct_ops(&bpf_mptcp_sched_ops, mptcp_sched_ops);
+ #endif
+-- 
+2.46.0
+
+From 53d163b4553529381a7a50e06eabe7b1e70d27d0 Mon Sep 17 00:00:00 2001
+From: Nicolas Rybowski <nicolas.rybowski@tessares.net>
+Date: Mon, 16 Sep 2024 05:52:15 +0000
+Subject: [PATCH 16/28] selftests/bpf: Add mptcp subflow example
+
+Move Nicolas' patch into bpf selftests directory. This example adds a
+different mark (SO_MARK) on each subflow, and changes the TCP CC only on
+the first subflow.
+
+From the userspace, an application can do a setsockopt() on an MPTCP
+socket, and typically the same value will be propagated to all subflows
+(paths). If someone wants to have different values per subflow, the
+recommended way is to use BPF. So it is good to add such example here,
+and make sure there is no regressions.
+
+This example shows how it is possible to:
+
+    Identify the parent msk of an MPTCP subflow.
+    Put different sockopt for each subflow of a same MPTCP connection.
+
+Here especially, two different behaviours are implemented:
+
+    A socket mark (SOL_SOCKET SO_MARK) is put on each subflow of a same
+    MPTCP connection. The order of creation of the current subflow defines
+    its mark. The TCP CC algorithm of the very first subflow of an MPTCP
+    connection is set to "reno".
+
+This is just to show it is possible to identify an MPTCP connection, and
+set socket options, from different SOL levels, per subflow. It is easy
+to verify with 'ss' that these modifications have been applied
+correctly. That's what the next patch is going to do.
+
+Nicolas' code comes from:
+
+    commit 4d120186e4d6 ("bpf:examples: update mptcp_set_mark_kern.c")
+
+from the MPTCP repo https://github.com/multipath-tcp/mptcp_net-next (the
+"scripts" branch), and it has been adapted by Geliang.
+
+Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/76
+Co-developed-by: Geliang Tang <tanggeliang@kylinos.cn>
+Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
+Signed-off-by: Nicolas Rybowski <nicolas.rybowski@tessares.net>
+Reviewed-by: Mat Martineau <martineau@kernel.org>
+---
+ .../selftests/bpf/progs/mptcp_subflow.c       | 59 +++++++++++++++++++
+ 1 file changed, 59 insertions(+)
+ create mode 100644 tools/testing/selftests/bpf/progs/mptcp_subflow.c
+
+diff --git a/tools/testing/selftests/bpf/progs/mptcp_subflow.c b/tools/testing/selftests/bpf/progs/mptcp_subflow.c
+new file mode 100644
+index 000000000000..2e28f4a215b5
+--- /dev/null
++++ b/tools/testing/selftests/bpf/progs/mptcp_subflow.c
+@@ -0,0 +1,59 @@
++// SPDX-License-Identifier: GPL-2.0
++/* Copyright (c) 2020, Tessares SA. */
++/* Copyright (c) 2024, Kylin Software */
++
++/* vmlinux.h, bpf_helpers.h and other 'define' */
++#include "bpf_tracing_net.h"
++
++char _license[] SEC("license") = "GPL";
++
++char cc[TCP_CA_NAME_MAX] = "reno";
++
++/* Associate a subflow counter to each token */
++struct {
++	__uint(type, BPF_MAP_TYPE_HASH);
++	__uint(key_size, sizeof(__u32));
++	__uint(value_size, sizeof(__u32));
++	__uint(max_entries, 100);
++} mptcp_sf SEC(".maps");
++
++SEC("sockops")
++int mptcp_subflow(struct bpf_sock_ops *skops)
++{
++	__u32 init = 1, key, mark, *cnt;
++	struct mptcp_sock *msk;
++	struct bpf_sock *sk;
++	int err;
++
++	if (skops->op != BPF_SOCK_OPS_TCP_CONNECT_CB)
++		return 1;
++
++	sk = skops->sk;
++	if (!sk)
++		return 1;
++
++	msk = bpf_skc_to_mptcp_sock(sk);
++	if (!msk)
++		return 1;
++
++	key = msk->token;
++	cnt = bpf_map_lookup_elem(&mptcp_sf, &key);
++	if (cnt) {
++		/* A new subflow is added to an existing MPTCP connection */
++		__sync_fetch_and_add(cnt, 1);
++		mark = *cnt;
++	} else {
++		/* A new MPTCP connection is just initiated and this is its primary subflow */
++		bpf_map_update_elem(&mptcp_sf, &key, &init, BPF_ANY);
++		mark = init;
++	}
++
++	/* Set the mark of the subflow's socket based on appearance order */
++	err = bpf_setsockopt(skops, SOL_SOCKET, SO_MARK, &mark, sizeof(mark));
++	if (err < 0)
++		return 1;
++	if (mark == 2)
++		err = bpf_setsockopt(skops, SOL_TCP, TCP_CONGESTION, cc, TCP_CA_NAME_MAX);
++
++	return 1;
++}
+-- 
+2.46.0
+
+From 6cda8081edf4e3ac7f8ed4353c666db7a09446a8 Mon Sep 17 00:00:00 2001
+From: Geliang Tang <tanggeliang@kylinos.cn>
+Date: Mon, 16 Sep 2024 05:52:16 +0000
+Subject: [PATCH 17/28] selftests/bpf: Add getsockopt to inspect mptcp subflow
+
+This patch adds a "cgroup/getsockopt" way to inspect the subflows of an
+mptcp socket. That will be used by the next commit to verify the socket
+options set on each subflow.
+
+This extra "cgroup/getsockopt" prog walks the msk->conn_list and use
+bpf_core_cast to cast a pointer for readonly. It allows to inspect all
+the fields of a structure.
+
+mptcp_subflow_tcp_sock(), mptcp_for_each_stubflow() and other helpers
+related to list_entry have been added into a new progs/mptcp_bpf.h file.
+
+Suggested-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
+Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+---
+ MAINTAINERS                                   |  2 +-
+ tools/testing/selftests/bpf/progs/mptcp_bpf.h | 42 +++++++++++
+ .../selftests/bpf/progs/mptcp_subflow.c       | 69 +++++++++++++++++++
+ 3 files changed, 112 insertions(+), 1 deletion(-)
+ create mode 100644 tools/testing/selftests/bpf/progs/mptcp_bpf.h
+
+diff --git a/MAINTAINERS b/MAINTAINERS
+index 77fcd6f802a5..93d705098220 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -16097,7 +16097,7 @@ F:	include/net/mptcp.h
+ F:	include/trace/events/mptcp.h
+ F:	include/uapi/linux/mptcp*.h
+ F:	net/mptcp/
+-F:	tools/testing/selftests/bpf/*/*mptcp*.c
++F:	tools/testing/selftests/bpf/*/*mptcp*.[ch]
+ F:	tools/testing/selftests/net/mptcp/
+ 
+ NETWORKING [TCP]
+diff --git a/tools/testing/selftests/bpf/progs/mptcp_bpf.h b/tools/testing/selftests/bpf/progs/mptcp_bpf.h
+new file mode 100644
+index 000000000000..179b74c1205f
+--- /dev/null
++++ b/tools/testing/selftests/bpf/progs/mptcp_bpf.h
+@@ -0,0 +1,42 @@
++/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */
++#ifndef __MPTCP_BPF_H__
++#define __MPTCP_BPF_H__
++
++#include "bpf_experimental.h"
++
++/* list helpers from include/linux/list.h */
++static inline int list_is_head(const struct list_head *list,
++			       const struct list_head *head)
++{
++	return list == head;
++}
++
++#define list_entry(ptr, type, member)					\
++	container_of(ptr, type, member)
++
++#define list_first_entry(ptr, type, member)				\
++	list_entry((ptr)->next, type, member)
++
++#define list_next_entry(pos, member)					\
++	list_entry((pos)->member.next, typeof(*(pos)), member)
++
++#define list_entry_is_head(pos, head, member)				\
++	list_is_head(&pos->member, (head))
++
++/* small difference: 'cond_break' has been added in the conditions */
++#define list_for_each_entry(pos, head, member)				\
++	for (pos = list_first_entry(head, typeof(*pos), member);	\
++	     cond_break, !list_entry_is_head(pos, head, member);	\
++	     pos = list_next_entry(pos, member))
++
++/* mptcp helpers from protocol.h */
++#define mptcp_for_each_subflow(__msk, __subflow)			\
++	list_for_each_entry(__subflow, &((__msk)->conn_list), node)
++
++static __always_inline struct sock *
++mptcp_subflow_tcp_sock(const struct mptcp_subflow_context *subflow)
++{
++	return subflow->tcp_sock;
++}
++
++#endif
+diff --git a/tools/testing/selftests/bpf/progs/mptcp_subflow.c b/tools/testing/selftests/bpf/progs/mptcp_subflow.c
+index 2e28f4a215b5..70302477e326 100644
+--- a/tools/testing/selftests/bpf/progs/mptcp_subflow.c
++++ b/tools/testing/selftests/bpf/progs/mptcp_subflow.c
+@@ -4,10 +4,12 @@
+ 
+ /* vmlinux.h, bpf_helpers.h and other 'define' */
+ #include "bpf_tracing_net.h"
++#include "mptcp_bpf.h"
+ 
+ char _license[] SEC("license") = "GPL";
+ 
+ char cc[TCP_CA_NAME_MAX] = "reno";
++int pid;
+ 
+ /* Associate a subflow counter to each token */
+ struct {
+@@ -57,3 +59,70 @@ int mptcp_subflow(struct bpf_sock_ops *skops)
+ 
+ 	return 1;
+ }
++
++static int _check_getsockopt_subflow_mark(struct mptcp_sock *msk, struct bpf_sockopt *ctx)
++{
++	struct mptcp_subflow_context *subflow;
++	int i = 0;
++
++	mptcp_for_each_subflow(msk, subflow) {
++		struct sock *ssk;
++
++		ssk = mptcp_subflow_tcp_sock(bpf_core_cast(subflow,
++							   struct mptcp_subflow_context));
++
++		if (ssk->sk_mark != ++i) {
++			ctx->retval = -2;
++			break;
++		}
++	}
++
++	return 1;
++}
++
++static int _check_getsockopt_subflow_cc(struct mptcp_sock *msk, struct bpf_sockopt *ctx)
++{
++	struct mptcp_subflow_context *subflow;
++
++	mptcp_for_each_subflow(msk, subflow) {
++		struct inet_connection_sock *icsk;
++		struct sock *ssk;
++
++		ssk = mptcp_subflow_tcp_sock(bpf_core_cast(subflow,
++							   struct mptcp_subflow_context));
++		icsk = bpf_core_cast(ssk, struct inet_connection_sock);
++
++		if (ssk->sk_mark == 2 &&
++		    __builtin_memcmp(icsk->icsk_ca_ops->name, cc, TCP_CA_NAME_MAX)) {
++			ctx->retval = -2;
++			break;
++		}
++	}
++
++	return 1;
++}
++
++SEC("cgroup/getsockopt")
++int _getsockopt_subflow(struct bpf_sockopt *ctx)
++{
++	struct bpf_sock *sk = ctx->sk;
++	struct mptcp_sock *msk;
++
++	if (bpf_get_current_pid_tgid() >> 32 != pid)
++		return 1;
++
++	if (!sk || sk->protocol != IPPROTO_MPTCP ||
++	    (!(ctx->level == SOL_SOCKET && ctx->optname == SO_MARK) &&
++	     !(ctx->level == SOL_TCP && ctx->optname == TCP_CONGESTION)))
++		return 1;
++
++	msk = bpf_core_cast(sk, struct mptcp_sock);
++	if (msk->pm.subflows != 1) {
++		ctx->retval = -1;
++		return 1;
++	}
++
++	if (ctx->optname == SO_MARK)
++		return _check_getsockopt_subflow_mark(msk, ctx);
++	return _check_getsockopt_subflow_cc(msk, ctx);
++}
+-- 
+2.46.0
+
+From 88c9717cb6d32d931aabf69eee0d7fea30118466 Mon Sep 17 00:00:00 2001
+From: Geliang Tang <tanggeliang@kylinos.cn>
+Date: Mon, 16 Sep 2024 05:52:17 +0000
+Subject: [PATCH 18/28] selftests/bpf: Add mptcp subflow subtest
+
+This patch adds a subtest named test_subflow to load and verify the newly
+added mptcp subflow example in test_mptcp. Add a helper endpoint_init()
+to add a new subflow endpoint. Add another helper ss_search() to verify the
+fwmark and congestion values set by mptcp_subflow prog using setsockopts.
+
+Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/76
+Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
+Reviewed-by: Mat Martineau <martineau@kernel.org>
+---
+ .../testing/selftests/bpf/prog_tests/mptcp.c  | 127 ++++++++++++++++++
+ 1 file changed, 127 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/mptcp.c b/tools/testing/selftests/bpf/prog_tests/mptcp.c
+index d2ca32fa3b21..c76a0d8c8f93 100644
+--- a/tools/testing/selftests/bpf/prog_tests/mptcp.c
++++ b/tools/testing/selftests/bpf/prog_tests/mptcp.c
+@@ -5,12 +5,17 @@
+ #include <linux/const.h>
+ #include <netinet/in.h>
+ #include <test_progs.h>
++#include <unistd.h>
+ #include "cgroup_helpers.h"
+ #include "network_helpers.h"
+ #include "mptcp_sock.skel.h"
+ #include "mptcpify.skel.h"
++#include "mptcp_subflow.skel.h"
+ 
+ #define NS_TEST "mptcp_ns"
++#define ADDR_1	"10.0.1.1"
++#define ADDR_2	"10.0.1.2"
++#define PORT_1	10001
+ 
+ #ifndef IPPROTO_MPTCP
+ #define IPPROTO_MPTCP 262
+@@ -335,10 +340,132 @@ static void test_mptcpify(void)
+ 	close(cgroup_fd);
+ }
+ 
++static int endpoint_init(char *flags)
++{
++	SYS(fail, "ip -net %s link add veth1 type veth peer name veth2", NS_TEST);
++	SYS(fail, "ip -net %s addr add %s/24 dev veth1", NS_TEST, ADDR_1);
++	SYS(fail, "ip -net %s link set dev veth1 up", NS_TEST);
++	SYS(fail, "ip -net %s addr add %s/24 dev veth2", NS_TEST, ADDR_2);
++	SYS(fail, "ip -net %s link set dev veth2 up", NS_TEST);
++	if (SYS_NOFAIL("ip -net %s mptcp endpoint add %s %s", NS_TEST, ADDR_2, flags)) {
++		printf("'ip mptcp' not supported, skip this test.\n");
++		test__skip();
++		goto fail;
++	}
++
++	return 0;
++fail:
++	return -1;
++}
++
++static void wait_for_new_subflows(int fd)
++{
++	socklen_t len;
++	u8 subflows;
++	int err, i;
++
++	len = sizeof(subflows);
++	/* Wait max 1 sec for new subflows to be created */
++	for (i = 0; i < 10; i++) {
++		err = getsockopt(fd, SOL_MPTCP, MPTCP_INFO, &subflows, &len);
++		if (!err && subflows > 0)
++			break;
++
++		usleep(100000); /* 0.1s */
++	}
++}
++
++static void run_subflow(void)
++{
++	int server_fd, client_fd, err;
++	char new[TCP_CA_NAME_MAX];
++	char cc[TCP_CA_NAME_MAX];
++	unsigned int mark;
++	socklen_t len;
++
++	server_fd = start_mptcp_server(AF_INET, ADDR_1, PORT_1, 0);
++	if (!ASSERT_OK_FD(server_fd, "start_mptcp_server"))
++		return;
++
++	client_fd = connect_to_fd(server_fd, 0);
++	if (!ASSERT_OK_FD(client_fd, "connect_to_fd"))
++		goto close_server;
++
++	send_byte(client_fd);
++	wait_for_new_subflows(client_fd);
++
++	len = sizeof(mark);
++	err = getsockopt(client_fd, SOL_SOCKET, SO_MARK, &mark, &len);
++	if (ASSERT_OK(err, "getsockopt(client_fd, SO_MARK)"))
++		ASSERT_EQ(mark, 0, "mark");
++
++	len = sizeof(new);
++	err = getsockopt(client_fd, SOL_TCP, TCP_CONGESTION, new, &len);
++	if (ASSERT_OK(err, "getsockopt(client_fd, TCP_CONGESTION)")) {
++		get_msk_ca_name(cc);
++		ASSERT_STREQ(new, cc, "cc");
++	}
++
++	close(client_fd);
++close_server:
++	close(server_fd);
++}
++
++static void test_subflow(void)
++{
++	int cgroup_fd, prog_fd, err;
++	struct mptcp_subflow *skel;
++	struct nstoken *nstoken;
++	struct bpf_link *link;
++
++	cgroup_fd = test__join_cgroup("/mptcp_subflow");
++	if (!ASSERT_OK_FD(cgroup_fd, "join_cgroup: mptcp_subflow"))
++		return;
++
++	skel = mptcp_subflow__open_and_load();
++	if (!ASSERT_OK_PTR(skel, "skel_open_load: mptcp_subflow"))
++		goto close_cgroup;
++
++	skel->bss->pid = getpid();
++
++	err = mptcp_subflow__attach(skel);
++	if (!ASSERT_OK(err, "skel_attach: mptcp_subflow"))
++		goto skel_destroy;
++
++	prog_fd = bpf_program__fd(skel->progs.mptcp_subflow);
++	err = bpf_prog_attach(prog_fd, cgroup_fd, BPF_CGROUP_SOCK_OPS, 0);
++	if (!ASSERT_OK(err, "prog_attach"))
++		goto skel_destroy;
++
++	nstoken = create_netns();
++	if (!ASSERT_OK_PTR(nstoken, "create_netns: mptcp_subflow"))
++		goto skel_destroy;
++
++	if (endpoint_init("subflow") < 0)
++		goto close_netns;
++
++	link = bpf_program__attach_cgroup(skel->progs._getsockopt_subflow,
++					  cgroup_fd);
++	if (!ASSERT_OK_PTR(link, "getsockopt prog"))
++		goto close_netns;
++
++	run_subflow();
++
++	bpf_link__destroy(link);
++close_netns:
++	cleanup_netns(nstoken);
++skel_destroy:
++	mptcp_subflow__destroy(skel);
++close_cgroup:
++	close(cgroup_fd);
++}
++
+ void test_mptcp(void)
+ {
+ 	if (test__start_subtest("base"))
+ 		test_base();
+ 	if (test__start_subtest("mptcpify"))
+ 		test_mptcpify();
++	if (test__start_subtest("subflow"))
++		test_subflow();
+ }
+-- 
+2.46.0
+
+From e80fa7af7531ac183afe0d2ccd248faab335892b Mon Sep 17 00:00:00 2001
+From: Geliang Tang <tanggeliang@kylinos.cn>
+Date: Mon, 16 Sep 2024 05:52:18 +0000
+Subject: [PATCH 19/28] selftests/bpf: Add bpf scheduler test
+
+This patch extends the MPTCP test base to support MPTCP packet scheduler
+tests. Add a new test to use the default in-kernel scheduler.
+
+In the new helper sched_init(), add two veth net devices to simulate the
+multiple addresses case. Use 'ip mptcp endpoint' command to add the new
+endpoint ADDR_2 to PM netlink. Use sysctl to set net.mptcp.scheduler to
+use the given sched.
+
+Invoke start_mptcp_server() to start the server on ADDR_1, and invoke
+connect_to_fd() to connect with the server from the client. Then invoke
+send_data() to send data.
+
+Some code in send_data() is from prog_tests/bpf_tcp_ca.c.
+
+Add time metrics for BPF tests to compare the performance of each
+schedulers. Run prog_tests with '-v' option can print out the running
+time of each test.
+
+Use the new helper has_bytes_sent() to check the bytes_sent filed of 'ss'
+output after send_data() to make sure no data has been sent on ADDR_2.
+All data has been sent on the first subflow.
+
+Invoke the new helper sched_cleanup() to set back net.mptcp.scheduler to
+default, flush all mptcp endpoints, and delete the veth net devices.
+
+Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
+Reviewed-by: Mat Martineau <martineau@kernel.org>
+---
+ .../testing/selftests/bpf/prog_tests/mptcp.c  | 92 +++++++++++++++++++
+ 1 file changed, 92 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/mptcp.c b/tools/testing/selftests/bpf/prog_tests/mptcp.c
+index c76a0d8c8f93..aff6986f84ac 100644
+--- a/tools/testing/selftests/bpf/prog_tests/mptcp.c
++++ b/tools/testing/selftests/bpf/prog_tests/mptcp.c
+@@ -16,6 +16,8 @@
+ #define ADDR_1	"10.0.1.1"
+ #define ADDR_2	"10.0.1.2"
+ #define PORT_1	10001
++#define WITH_DATA	true
++#define WITHOUT_DATA	false
+ 
+ #ifndef IPPROTO_MPTCP
+ #define IPPROTO_MPTCP 262
+@@ -38,6 +40,9 @@
+ #define TCP_CA_NAME_MAX	16
+ #endif
+ 
++static const unsigned int total_bytes = 10 * 1024 * 1024;
++static int duration;
++
+ struct __mptcp_info {
+ 	__u8	mptcpi_subflows;
+ 	__u8	mptcpi_add_addr_signal;
+@@ -460,6 +465,91 @@ static void test_subflow(void)
+ 	close(cgroup_fd);
+ }
+ 
++static struct nstoken *sched_init(char *flags, char *sched)
++{
++	struct nstoken *nstoken;
++
++	nstoken = create_netns();
++	if (!ASSERT_OK_PTR(nstoken, "create_netns"))
++		return NULL;
++
++	if (endpoint_init("subflow") < 0)
++		goto fail;
++
++	SYS(fail, "ip netns exec %s sysctl -qw net.mptcp.scheduler=%s", NS_TEST, sched);
++
++	return nstoken;
++fail:
++	cleanup_netns(nstoken);
++	return NULL;
++}
++
++static int ss_search(char *src, char *dst, char *port, char *keyword)
++{
++	return SYS_NOFAIL("ip netns exec %s ss -enita src %s dst %s %s %d | grep -q '%s'",
++			  NS_TEST, src, dst, port, PORT_1, keyword);
++}
++
++static int has_bytes_sent(char *dst)
++{
++	return ss_search(ADDR_1, dst, "sport", "bytes_sent:");
++}
++
++static void send_data_and_verify(char *sched, bool addr1, bool addr2)
++{
++	struct timespec start, end;
++	int server_fd, client_fd;
++	unsigned int delta_ms;
++
++	server_fd = start_mptcp_server(AF_INET, ADDR_1, PORT_1, 0);
++	if (!ASSERT_OK_FD(server_fd, "start_mptcp_server"))
++		return;
++
++	client_fd = connect_to_fd(server_fd, 0);
++	if (!ASSERT_OK_FD(client_fd, "connect_to_fd"))
++		goto fail;
++
++	if (clock_gettime(CLOCK_MONOTONIC, &start) < 0)
++		goto fail;
++
++	if (!ASSERT_OK(send_recv_data(server_fd, client_fd, total_bytes),
++		       "send_recv_data"))
++		goto fail;
++
++	if (clock_gettime(CLOCK_MONOTONIC, &end) < 0)
++		goto fail;
++
++	delta_ms = (end.tv_sec - start.tv_sec) * 1000 + (end.tv_nsec - start.tv_nsec) / 1000000;
++	printf("%s: %u ms\n", sched, delta_ms);
++
++	if (addr1)
++		CHECK(has_bytes_sent(ADDR_1), sched, "should have bytes_sent on addr1\n");
++	else
++		CHECK(!has_bytes_sent(ADDR_1), sched, "shouldn't have bytes_sent on addr1\n");
++	if (addr2)
++		CHECK(has_bytes_sent(ADDR_2), sched, "should have bytes_sent on addr2\n");
++	else
++		CHECK(!has_bytes_sent(ADDR_2), sched, "shouldn't have bytes_sent on addr2\n");
++
++	close(client_fd);
++fail:
++	close(server_fd);
++}
++
++static void test_default(void)
++{
++	struct nstoken *nstoken;
++
++	nstoken = sched_init("subflow", "default");
++	if (!nstoken)
++		goto fail;
++
++	send_data_and_verify("default", WITH_DATA, WITH_DATA);
++
++fail:
++	cleanup_netns(nstoken);
++}
++
+ void test_mptcp(void)
+ {
+ 	if (test__start_subtest("base"))
+@@ -468,4 +558,6 @@ void test_mptcp(void)
+ 		test_mptcpify();
+ 	if (test__start_subtest("subflow"))
+ 		test_subflow();
++	if (test__start_subtest("default"))
++		test_default();
+ }
+-- 
+2.46.0
+
+From 98a4df409f3862b6bb7b5f246752b05e3ccc55af Mon Sep 17 00:00:00 2001
+From: Geliang Tang <tanggeliang@kylinos.cn>
+Date: Mon, 16 Sep 2024 05:52:19 +0000
+Subject: [PATCH 20/28] selftests/bpf: Add bpf_first scheduler & test
+
+This patch implements the simplest MPTCP scheduler, named bpf_first,
+which always picks the first subflow to send data. It's a sample of
+MPTCP BPF scheduler implementations.
+
+This patch defines MPTCP_SCHED_TEST macro, a template for all scheduler
+tests. Every scheduler is identified by argument name, and use sysctl
+to set net.mptcp.scheduler as "bpf_name" to use this sched. Add two
+veth net devices to simulate the multiple addresses case. Use 'ip mptcp
+endpoint' command to add the new endpoint ADDR2 to PM netlink. Arguments
+addr1/add2 means whether the data has been sent on the first/second
+subflow or not. Send data and check bytes_sent of 'ss' output after it
+using send_data_and_verify().
+
+Using MPTCP_SCHED_TEST macro to add a new test for this bpf_first
+scheduler, the arguments "1 0" means data has been only sent on the
+first subflow ADDR1. Run this test by RUN_MPTCP_TEST macro.
+
+Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
+Acked-by: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: Mat Martineau <martineau@kernel.org>
+Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+---
+ .../testing/selftests/bpf/prog_tests/mptcp.c  | 44 +++++++++++++++++++
+ tools/testing/selftests/bpf/progs/mptcp_bpf.h |  7 +++
+ .../selftests/bpf/progs/mptcp_bpf_first.c     | 33 ++++++++++++++
+ 3 files changed, 84 insertions(+)
+ create mode 100644 tools/testing/selftests/bpf/progs/mptcp_bpf_first.c
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/mptcp.c b/tools/testing/selftests/bpf/prog_tests/mptcp.c
+index aff6986f84ac..ee3fab606855 100644
+--- a/tools/testing/selftests/bpf/prog_tests/mptcp.c
++++ b/tools/testing/selftests/bpf/prog_tests/mptcp.c
+@@ -11,6 +11,7 @@
+ #include "mptcp_sock.skel.h"
+ #include "mptcpify.skel.h"
+ #include "mptcp_subflow.skel.h"
++#include "mptcp_bpf_first.skel.h"
+ 
+ #define NS_TEST "mptcp_ns"
+ #define ADDR_1	"10.0.1.1"
+@@ -39,6 +40,7 @@
+ #ifndef TCP_CA_NAME_MAX
+ #define TCP_CA_NAME_MAX	16
+ #endif
++#define MPTCP_SCHED_NAME_MAX	16
+ 
+ static const unsigned int total_bytes = 10 * 1024 * 1024;
+ static int duration;
+@@ -550,6 +552,46 @@ static void test_default(void)
+ 	cleanup_netns(nstoken);
+ }
+ 
++static void test_bpf_sched(struct bpf_object *obj, char *sched,
++			   bool addr1, bool addr2)
++{
++	char bpf_sched[MPTCP_SCHED_NAME_MAX] = "bpf_";
++	struct nstoken *nstoken;
++	struct bpf_link *link;
++	struct bpf_map *map;
++
++	if (!ASSERT_LT(strlen(bpf_sched) + strlen(sched),
++		       MPTCP_SCHED_NAME_MAX, "Scheduler name too long"))
++		return;
++
++	map = bpf_object__find_map_by_name(obj, sched);
++	link = bpf_map__attach_struct_ops(map);
++	if (CHECK(!link, sched, "attach_struct_ops: %d\n", errno))
++		return;
++
++	nstoken = sched_init("subflow", strcat(bpf_sched, sched));
++	if (!nstoken)
++		goto fail;
++
++	send_data_and_verify(sched, addr1, addr2);
++
++fail:
++	cleanup_netns(nstoken);
++	bpf_link__destroy(link);
++}
++
++static void test_first(void)
++{
++	struct mptcp_bpf_first *skel;
++
++	skel = mptcp_bpf_first__open_and_load();
++	if (!ASSERT_OK_PTR(skel, "open_and_load: first"))
++		return;
++
++	test_bpf_sched(skel->obj, "first", WITH_DATA, WITHOUT_DATA);
++	mptcp_bpf_first__destroy(skel);
++}
++
+ void test_mptcp(void)
+ {
+ 	if (test__start_subtest("base"))
+@@ -560,4 +602,6 @@ void test_mptcp(void)
+ 		test_subflow();
+ 	if (test__start_subtest("default"))
+ 		test_default();
++	if (test__start_subtest("first"))
++		test_first();
+ }
+diff --git a/tools/testing/selftests/bpf/progs/mptcp_bpf.h b/tools/testing/selftests/bpf/progs/mptcp_bpf.h
+index 179b74c1205f..95449963c1d3 100644
+--- a/tools/testing/selftests/bpf/progs/mptcp_bpf.h
++++ b/tools/testing/selftests/bpf/progs/mptcp_bpf.h
+@@ -39,4 +39,11 @@ mptcp_subflow_tcp_sock(const struct mptcp_subflow_context *subflow)
+ 	return subflow->tcp_sock;
+ }
+ 
++/* ksym */
++extern void mptcp_subflow_set_scheduled(struct mptcp_subflow_context *subflow,
++					bool scheduled) __ksym;
++
++extern struct mptcp_subflow_context *
++bpf_mptcp_subflow_ctx_by_pos(const struct mptcp_sched_data *data, unsigned int pos) __ksym;
++
+ #endif
+diff --git a/tools/testing/selftests/bpf/progs/mptcp_bpf_first.c b/tools/testing/selftests/bpf/progs/mptcp_bpf_first.c
+new file mode 100644
+index 000000000000..d57399b407a7
+--- /dev/null
++++ b/tools/testing/selftests/bpf/progs/mptcp_bpf_first.c
+@@ -0,0 +1,33 @@
++// SPDX-License-Identifier: GPL-2.0
++/* Copyright (c) 2022, SUSE. */
++
++#include "mptcp_bpf.h"
++#include <bpf/bpf_tracing.h>
++
++char _license[] SEC("license") = "GPL";
++
++SEC("struct_ops")
++void BPF_PROG(mptcp_sched_first_init, struct mptcp_sock *msk)
++{
++}
++
++SEC("struct_ops")
++void BPF_PROG(mptcp_sched_first_release, struct mptcp_sock *msk)
++{
++}
++
++SEC("struct_ops")
++int BPF_PROG(bpf_first_get_subflow, struct mptcp_sock *msk,
++	     struct mptcp_sched_data *data)
++{
++	mptcp_subflow_set_scheduled(bpf_mptcp_subflow_ctx_by_pos(data, 0), true);
++	return 0;
++}
++
++SEC(".struct_ops")
++struct mptcp_sched_ops first = {
++	.init		= (void *)mptcp_sched_first_init,
++	.release	= (void *)mptcp_sched_first_release,
++	.get_subflow	= (void *)bpf_first_get_subflow,
++	.name		= "bpf_first",
++};
+-- 
+2.46.0
+
+From 156161b367e8fea9b012e0d2da4b816670bd3a3f Mon Sep 17 00:00:00 2001
+From: Geliang Tang <tanggeliang@kylinos.cn>
+Date: Mon, 16 Sep 2024 05:52:20 +0000
+Subject: [PATCH 21/28] selftests/bpf: Add bpf_bkup scheduler & test
+
+This patch implements the backup flag test scheduler, named bpf_bkup,
+which picks the first non-backup subflow to send data.
+
+Using MPTCP_SCHED_TEST macro to add a new test for this bpf_bkup
+scheduler, the arguments "1 0" means data has been only sent on the
+first subflow ADDR1. Run this test by RUN_MPTCP_TEST macro.
+
+Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
+Reviewed-by: Mat Martineau <martineau@kernel.org>
+Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+---
+ .../testing/selftests/bpf/prog_tests/mptcp.c  | 15 ++++++
+ tools/testing/selftests/bpf/progs/mptcp_bpf.h |  3 ++
+ .../selftests/bpf/progs/mptcp_bpf_bkup.c      | 52 +++++++++++++++++++
+ 3 files changed, 70 insertions(+)
+ create mode 100644 tools/testing/selftests/bpf/progs/mptcp_bpf_bkup.c
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/mptcp.c b/tools/testing/selftests/bpf/prog_tests/mptcp.c
+index ee3fab606855..4a760efc2ede 100644
+--- a/tools/testing/selftests/bpf/prog_tests/mptcp.c
++++ b/tools/testing/selftests/bpf/prog_tests/mptcp.c
+@@ -12,6 +12,7 @@
+ #include "mptcpify.skel.h"
+ #include "mptcp_subflow.skel.h"
+ #include "mptcp_bpf_first.skel.h"
++#include "mptcp_bpf_bkup.skel.h"
+ 
+ #define NS_TEST "mptcp_ns"
+ #define ADDR_1	"10.0.1.1"
+@@ -592,6 +593,18 @@ static void test_first(void)
+ 	mptcp_bpf_first__destroy(skel);
+ }
+ 
++static void test_bkup(void)
++{
++	struct mptcp_bpf_bkup *skel;
++
++	skel = mptcp_bpf_bkup__open_and_load();
++	if (!ASSERT_OK_PTR(skel, "open_and_load: bkup"))
++		return;
++
++	test_bpf_sched(skel->obj, "bkup", WITH_DATA, WITHOUT_DATA);
++	mptcp_bpf_bkup__destroy(skel);
++}
++
+ void test_mptcp(void)
+ {
+ 	if (test__start_subtest("base"))
+@@ -604,4 +617,6 @@ void test_mptcp(void)
+ 		test_default();
+ 	if (test__start_subtest("first"))
+ 		test_first();
++	if (test__start_subtest("bkup"))
++		test_bkup();
+ }
+diff --git a/tools/testing/selftests/bpf/progs/mptcp_bpf.h b/tools/testing/selftests/bpf/progs/mptcp_bpf.h
+index 95449963c1d3..928a1e5ad8db 100644
+--- a/tools/testing/selftests/bpf/progs/mptcp_bpf.h
++++ b/tools/testing/selftests/bpf/progs/mptcp_bpf.h
+@@ -4,6 +4,9 @@
+ 
+ #include "bpf_experimental.h"
+ 
++/* mptcp helpers from include/net/mptcp.h */
++#define MPTCP_SUBFLOWS_MAX 8
++
+ /* list helpers from include/linux/list.h */
+ static inline int list_is_head(const struct list_head *list,
+ 			       const struct list_head *head)
+diff --git a/tools/testing/selftests/bpf/progs/mptcp_bpf_bkup.c b/tools/testing/selftests/bpf/progs/mptcp_bpf_bkup.c
+new file mode 100644
+index 000000000000..296f0318d843
+--- /dev/null
++++ b/tools/testing/selftests/bpf/progs/mptcp_bpf_bkup.c
+@@ -0,0 +1,52 @@
++// SPDX-License-Identifier: GPL-2.0
++/* Copyright (c) 2022, SUSE. */
++
++#include "mptcp_bpf.h"
++#include <bpf/bpf_tracing.h>
++
++char _license[] SEC("license") = "GPL";
++
++SEC("struct_ops")
++void BPF_PROG(mptcp_sched_bkup_init, struct mptcp_sock *msk)
++{
++}
++
++SEC("struct_ops")
++void BPF_PROG(mptcp_sched_bkup_release, struct mptcp_sock *msk)
++{
++}
++
++SEC("struct_ops")
++int BPF_PROG(bpf_bkup_get_subflow, struct mptcp_sock *msk,
++	     struct mptcp_sched_data *data)
++{
++	int nr = -1;
++
++	for (int i = 0; i < data->subflows && i < MPTCP_SUBFLOWS_MAX; i++) {
++		struct mptcp_subflow_context *subflow;
++
++		subflow = bpf_mptcp_subflow_ctx_by_pos(data, i);
++		if (!subflow)
++			break;
++
++		if (!BPF_CORE_READ_BITFIELD_PROBED(subflow, backup) ||
++		    !BPF_CORE_READ_BITFIELD_PROBED(subflow, request_bkup)) {
++			nr = i;
++			break;
++		}
++	}
++
++	if (nr != -1) {
++		mptcp_subflow_set_scheduled(bpf_mptcp_subflow_ctx_by_pos(data, nr), true);
++		return -1;
++	}
++	return 0;
++}
++
++SEC(".struct_ops")
++struct mptcp_sched_ops bkup = {
++	.init		= (void *)mptcp_sched_bkup_init,
++	.release	= (void *)mptcp_sched_bkup_release,
++	.get_subflow	= (void *)bpf_bkup_get_subflow,
++	.name		= "bpf_bkup",
++};
+-- 
+2.46.0
+
+From 23be357908c466769030c111270c4438cac3e0f3 Mon Sep 17 00:00:00 2001
+From: Geliang Tang <tanggeliang@kylinos.cn>
+Date: Mon, 16 Sep 2024 05:52:21 +0000
+Subject: [PATCH 22/28] selftests/bpf: Add bpf_rr scheduler & test
+
+This patch implements the round-robin BPF MPTCP scheduler, named bpf_rr,
+which always picks the next available subflow to send data. If no such
+next subflow available, picks the first one.
+
+Using MPTCP_SCHED_TEST macro to add a new test for this bpf_rr
+scheduler, the arguments "1 1" means data has been sent on both net
+devices. Run this test by RUN_MPTCP_TEST macro.
+
+Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
+Reviewed-by: Mat Martineau <martineau@kernel.org>
+Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+---
+ .../testing/selftests/bpf/prog_tests/mptcp.c  | 15 ++++
+ .../selftests/bpf/progs/mptcp_bpf_rr.c        | 78 +++++++++++++++++++
+ 2 files changed, 93 insertions(+)
+ create mode 100644 tools/testing/selftests/bpf/progs/mptcp_bpf_rr.c
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/mptcp.c b/tools/testing/selftests/bpf/prog_tests/mptcp.c
+index 4a760efc2ede..d4e07c24806c 100644
+--- a/tools/testing/selftests/bpf/prog_tests/mptcp.c
++++ b/tools/testing/selftests/bpf/prog_tests/mptcp.c
+@@ -13,6 +13,7 @@
+ #include "mptcp_subflow.skel.h"
+ #include "mptcp_bpf_first.skel.h"
+ #include "mptcp_bpf_bkup.skel.h"
++#include "mptcp_bpf_rr.skel.h"
+ 
+ #define NS_TEST "mptcp_ns"
+ #define ADDR_1	"10.0.1.1"
+@@ -605,6 +606,18 @@ static void test_bkup(void)
+ 	mptcp_bpf_bkup__destroy(skel);
+ }
+ 
++static void test_rr(void)
++{
++	struct mptcp_bpf_rr *skel;
++
++	skel = mptcp_bpf_rr__open_and_load();
++	if (!ASSERT_OK_PTR(skel, "open_and_load: rr"))
++		return;
++
++	test_bpf_sched(skel->obj, "rr", WITH_DATA, WITH_DATA);
++	mptcp_bpf_rr__destroy(skel);
++}
++
+ void test_mptcp(void)
+ {
+ 	if (test__start_subtest("base"))
+@@ -619,4 +632,6 @@ void test_mptcp(void)
+ 		test_first();
+ 	if (test__start_subtest("bkup"))
+ 		test_bkup();
++	if (test__start_subtest("rr"))
++		test_rr();
+ }
+diff --git a/tools/testing/selftests/bpf/progs/mptcp_bpf_rr.c b/tools/testing/selftests/bpf/progs/mptcp_bpf_rr.c
+new file mode 100644
+index 000000000000..638ea6aa63b7
+--- /dev/null
++++ b/tools/testing/selftests/bpf/progs/mptcp_bpf_rr.c
+@@ -0,0 +1,78 @@
++// SPDX-License-Identifier: GPL-2.0
++/* Copyright (c) 2022, SUSE. */
++
++#include "mptcp_bpf.h"
++#include <bpf/bpf_tracing.h>
++
++char _license[] SEC("license") = "GPL";
++
++struct mptcp_rr_storage {
++	struct sock *last_snd;
++};
++
++struct {
++	__uint(type, BPF_MAP_TYPE_SK_STORAGE);
++	__uint(map_flags, BPF_F_NO_PREALLOC);
++	__type(key, int);
++	__type(value, struct mptcp_rr_storage);
++} mptcp_rr_map SEC(".maps");
++
++SEC("struct_ops")
++void BPF_PROG(mptcp_sched_rr_init, struct mptcp_sock *msk)
++{
++	bpf_sk_storage_get(&mptcp_rr_map, msk, 0,
++			   BPF_LOCAL_STORAGE_GET_F_CREATE);
++}
++
++SEC("struct_ops")
++void BPF_PROG(mptcp_sched_rr_release, struct mptcp_sock *msk)
++{
++	bpf_sk_storage_delete(&mptcp_rr_map, msk);
++}
++
++SEC("struct_ops")
++int BPF_PROG(bpf_rr_get_subflow, struct mptcp_sock *msk,
++	     struct mptcp_sched_data *data)
++{
++	struct mptcp_subflow_context *subflow;
++	struct mptcp_rr_storage *ptr;
++	struct sock *last_snd = NULL;
++	int nr = 0;
++
++	ptr = bpf_sk_storage_get(&mptcp_rr_map, msk, 0,
++				 BPF_LOCAL_STORAGE_GET_F_CREATE);
++	if (!ptr)
++		return -1;
++
++	last_snd = ptr->last_snd;
++
++	for (int i = 0; i < data->subflows && i < MPTCP_SUBFLOWS_MAX; i++) {
++		subflow = bpf_mptcp_subflow_ctx_by_pos(data, i);
++		if (!last_snd || !subflow)
++			break;
++
++		if (mptcp_subflow_tcp_sock(subflow) == last_snd) {
++			if (i + 1 == MPTCP_SUBFLOWS_MAX ||
++			    !bpf_mptcp_subflow_ctx_by_pos(data, i + 1))
++				break;
++
++			nr = i + 1;
++			break;
++		}
++	}
++
++	subflow = bpf_mptcp_subflow_ctx_by_pos(data, nr);
++	if (!subflow)
++		return -1;
++	mptcp_subflow_set_scheduled(subflow, true);
++	ptr->last_snd = mptcp_subflow_tcp_sock(subflow);
++	return 0;
++}
++
++SEC(".struct_ops")
++struct mptcp_sched_ops rr = {
++	.init		= (void *)mptcp_sched_rr_init,
++	.release	= (void *)mptcp_sched_rr_release,
++	.get_subflow	= (void *)bpf_rr_get_subflow,
++	.name		= "bpf_rr",
++};
+-- 
+2.46.0
+
+From 24f9dc216230966e8e7301d7ac82af04d8583566 Mon Sep 17 00:00:00 2001
+From: Geliang Tang <tanggeliang@kylinos.cn>
+Date: Mon, 16 Sep 2024 05:52:22 +0000
+Subject: [PATCH 23/28] selftests/bpf: Add bpf_red scheduler & test
+
+This patch implements the redundant BPF MPTCP scheduler, named bpf_red,
+which sends all packets redundantly on all available subflows.
+
+Using MPTCP_SCHED_TEST macro to add a new test for this bpf_red
+scheduler, the arguments "1 1" means data has been sent on both
+net devices. Run this test by RUN_MPTCP_TEST macro.
+
+Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
+Reviewed-by: Mat Martineau <martineau@kernel.org>
+Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+---
+ .../testing/selftests/bpf/prog_tests/mptcp.c  | 15 +++++++
+ .../selftests/bpf/progs/mptcp_bpf_red.c       | 39 +++++++++++++++++++
+ 2 files changed, 54 insertions(+)
+ create mode 100644 tools/testing/selftests/bpf/progs/mptcp_bpf_red.c
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/mptcp.c b/tools/testing/selftests/bpf/prog_tests/mptcp.c
+index d4e07c24806c..ede2d1ff9f6b 100644
+--- a/tools/testing/selftests/bpf/prog_tests/mptcp.c
++++ b/tools/testing/selftests/bpf/prog_tests/mptcp.c
+@@ -14,6 +14,7 @@
+ #include "mptcp_bpf_first.skel.h"
+ #include "mptcp_bpf_bkup.skel.h"
+ #include "mptcp_bpf_rr.skel.h"
++#include "mptcp_bpf_red.skel.h"
+ 
+ #define NS_TEST "mptcp_ns"
+ #define ADDR_1	"10.0.1.1"
+@@ -618,6 +619,18 @@ static void test_rr(void)
+ 	mptcp_bpf_rr__destroy(skel);
+ }
+ 
++static void test_red(void)
++{
++	struct mptcp_bpf_red *skel;
++
++	skel = mptcp_bpf_red__open_and_load();
++	if (!ASSERT_OK_PTR(skel, "open_and_load: red"))
++		return;
++
++	test_bpf_sched(skel->obj, "red", WITH_DATA, WITH_DATA);
++	mptcp_bpf_red__destroy(skel);
++}
++
+ void test_mptcp(void)
+ {
+ 	if (test__start_subtest("base"))
+@@ -634,4 +647,6 @@ void test_mptcp(void)
+ 		test_bkup();
+ 	if (test__start_subtest("rr"))
+ 		test_rr();
++	if (test__start_subtest("red"))
++		test_red();
+ }
+diff --git a/tools/testing/selftests/bpf/progs/mptcp_bpf_red.c b/tools/testing/selftests/bpf/progs/mptcp_bpf_red.c
+new file mode 100644
+index 000000000000..cc0aab732fc4
+--- /dev/null
++++ b/tools/testing/selftests/bpf/progs/mptcp_bpf_red.c
+@@ -0,0 +1,39 @@
++// SPDX-License-Identifier: GPL-2.0
++/* Copyright (c) 2022, SUSE. */
++
++#include "mptcp_bpf.h"
++#include <bpf/bpf_tracing.h>
++
++char _license[] SEC("license") = "GPL";
++
++SEC("struct_ops")
++void BPF_PROG(mptcp_sched_red_init, struct mptcp_sock *msk)
++{
++}
++
++SEC("struct_ops")
++void BPF_PROG(mptcp_sched_red_release, struct mptcp_sock *msk)
++{
++}
++
++SEC("struct_ops")
++int BPF_PROG(bpf_red_get_subflow, struct mptcp_sock *msk,
++	     struct mptcp_sched_data *data)
++{
++	for (int i = 0; i < data->subflows && i < MPTCP_SUBFLOWS_MAX; i++) {
++		if (!bpf_mptcp_subflow_ctx_by_pos(data, i))
++			break;
++
++		mptcp_subflow_set_scheduled(bpf_mptcp_subflow_ctx_by_pos(data, i), true);
++	}
++
++	return 0;
++}
++
++SEC(".struct_ops")
++struct mptcp_sched_ops red = {
++	.init		= (void *)mptcp_sched_red_init,
++	.release	= (void *)mptcp_sched_red_release,
++	.get_subflow	= (void *)bpf_red_get_subflow,
++	.name		= "bpf_red",
++};
+-- 
+2.46.0
+
+From de732279a1cfc454c4d355a7dc31bfc2766383e0 Mon Sep 17 00:00:00 2001
+From: Geliang Tang <tanggeliang@kylinos.cn>
+Date: Mon, 16 Sep 2024 05:52:23 +0000
+Subject: [PATCH 24/28] bpf: Export more bpf_burst related functions
+
+sk_stream_memory_free() and tcp_rtx_and_write_queues_empty() are needed
+to export into the BPF context for bpf_burst scheduler. But these two
+functions are inline ones. So this patch added two wrappers for them,
+and export the wrappers in the BPF context.
+
+Add more bpf_burst related functions into bpf_mptcp_sched_kfunc_set to make
+sure these helpers can be accessed from the BPF context.
+
+Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
+Reviewed-by: Mat Martineau <martineau@kernel.org>
+---
+ net/mptcp/bpf.c      | 11 +++++++++++
+ net/mptcp/protocol.c |  4 ++--
+ net/mptcp/protocol.h |  3 +++
+ 3 files changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/net/mptcp/bpf.c b/net/mptcp/bpf.c
+index 2c0fb9bddb9d..6414824402e6 100644
+--- a/net/mptcp/bpf.c
++++ b/net/mptcp/bpf.c
+@@ -213,11 +213,22 @@ bpf_mptcp_subflow_ctx_by_pos(const struct mptcp_sched_data *data, unsigned int p
+ 	return data->contexts[pos];
+ }
+ 
++__bpf_kfunc bool bpf_mptcp_subflow_queues_empty(struct sock *sk)
++{
++	return tcp_rtx_queue_empty(sk);
++}
++
+ __diag_pop();
+ 
+ BTF_KFUNCS_START(bpf_mptcp_sched_kfunc_ids)
+ BTF_ID_FLAGS(func, mptcp_subflow_set_scheduled)
+ BTF_ID_FLAGS(func, bpf_mptcp_subflow_ctx_by_pos)
++BTF_ID_FLAGS(func, mptcp_subflow_active)
++BTF_ID_FLAGS(func, mptcp_set_timeout)
++BTF_ID_FLAGS(func, mptcp_wnd_end)
++BTF_ID_FLAGS(func, tcp_stream_memory_free)
++BTF_ID_FLAGS(func, bpf_mptcp_subflow_queues_empty)
++BTF_ID_FLAGS(func, mptcp_pm_subflow_chk_stale)
+ BTF_KFUNCS_END(bpf_mptcp_sched_kfunc_ids)
+ 
+ static const struct btf_kfunc_id_set bpf_mptcp_sched_kfunc_set = {
+diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
+index 7cc8d81ee605..3b837765c84b 100644
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -50,7 +50,7 @@ DEFINE_PER_CPU(struct mptcp_delegated_action, mptcp_delegated_actions);
+ static struct net_device mptcp_napi_dev;
+ 
+ /* Returns end sequence number of the receiver's advertised window */
+-static u64 mptcp_wnd_end(const struct mptcp_sock *msk)
++u64 mptcp_wnd_end(const struct mptcp_sock *msk)
+ {
+ 	return READ_ONCE(msk->wnd_end);
+ }
+@@ -489,7 +489,7 @@ static long mptcp_timeout_from_subflow(const struct mptcp_subflow_context *subfl
+ 	       inet_csk(ssk)->icsk_timeout - jiffies : 0;
+ }
+ 
+-static void mptcp_set_timeout(struct sock *sk)
++void mptcp_set_timeout(struct sock *sk)
+ {
+ 	struct mptcp_subflow_context *subflow;
+ 	long tout = 0;
+diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
+index a1d06e7e3544..c3942416fa3a 100644
+--- a/net/mptcp/protocol.h
++++ b/net/mptcp/protocol.h
+@@ -719,6 +719,9 @@ void __mptcp_subflow_send_ack(struct sock *ssk);
+ void mptcp_subflow_reset(struct sock *ssk);
+ void mptcp_subflow_queue_clean(struct sock *sk, struct sock *ssk);
+ void mptcp_sock_graft(struct sock *sk, struct socket *parent);
++u64 mptcp_wnd_end(const struct mptcp_sock *msk);
++void mptcp_set_timeout(struct sock *sk);
++bool bpf_mptcp_subflow_queues_empty(struct sock *sk);
+ struct mptcp_subflow_context *
+ bpf_mptcp_subflow_ctx_by_pos(const struct mptcp_sched_data *data, unsigned int pos);
+ struct sock *__mptcp_nmpc_sk(struct mptcp_sock *msk);
+-- 
+2.46.0
+
+From 9f1d0166bff9923c5889a0db70e189f147efee50 Mon Sep 17 00:00:00 2001
+From: Geliang Tang <tanggeliang@kylinos.cn>
+Date: Mon, 16 Sep 2024 05:52:24 +0000
+Subject: [PATCH 25/28] selftests/bpf: Add bpf_burst scheduler & test
+
+This patch implements the burst BPF MPTCP scheduler, named bpf_burst,
+which is the default scheduler in protocol.c. bpf_burst_get_send() uses
+the same logic as mptcp_subflow_get_send() and bpf_burst_get_retrans
+uses the same logic as mptcp_subflow_get_retrans().
+
+Using MPTCP_SCHED_TEST macro to add a new test for this bpf_burst
+scheduler, the arguments "1 1" means data has been sent on both net
+devices. Run this test by RUN_MPTCP_TEST macro.
+
+Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
+Reviewed-by: Mat Martineau <martineau@kernel.org>
+Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+---
+ .../testing/selftests/bpf/prog_tests/mptcp.c  |  15 ++
+ .../selftests/bpf/progs/mptcp_bpf_burst.c     | 207 ++++++++++++++++++
+ 2 files changed, 222 insertions(+)
+ create mode 100644 tools/testing/selftests/bpf/progs/mptcp_bpf_burst.c
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/mptcp.c b/tools/testing/selftests/bpf/prog_tests/mptcp.c
+index ede2d1ff9f6b..a3e68bc6afa3 100644
+--- a/tools/testing/selftests/bpf/prog_tests/mptcp.c
++++ b/tools/testing/selftests/bpf/prog_tests/mptcp.c
+@@ -15,6 +15,7 @@
+ #include "mptcp_bpf_bkup.skel.h"
+ #include "mptcp_bpf_rr.skel.h"
+ #include "mptcp_bpf_red.skel.h"
++#include "mptcp_bpf_burst.skel.h"
+ 
+ #define NS_TEST "mptcp_ns"
+ #define ADDR_1	"10.0.1.1"
+@@ -631,6 +632,18 @@ static void test_red(void)
+ 	mptcp_bpf_red__destroy(skel);
+ }
+ 
++static void test_burst(void)
++{
++	struct mptcp_bpf_burst *skel;
++
++	skel = mptcp_bpf_burst__open_and_load();
++	if (!ASSERT_OK_PTR(skel, "open_and_load: burst"))
++		return;
++
++	test_bpf_sched(skel->obj, "burst", WITH_DATA, WITH_DATA);
++	mptcp_bpf_burst__destroy(skel);
++}
++
+ void test_mptcp(void)
+ {
+ 	if (test__start_subtest("base"))
+@@ -649,4 +662,6 @@ void test_mptcp(void)
+ 		test_rr();
+ 	if (test__start_subtest("red"))
+ 		test_red();
++	if (test__start_subtest("burst"))
++		test_burst();
+ }
+diff --git a/tools/testing/selftests/bpf/progs/mptcp_bpf_burst.c b/tools/testing/selftests/bpf/progs/mptcp_bpf_burst.c
+new file mode 100644
+index 000000000000..eb21119aa8f7
+--- /dev/null
++++ b/tools/testing/selftests/bpf/progs/mptcp_bpf_burst.c
+@@ -0,0 +1,207 @@
++// SPDX-License-Identifier: GPL-2.0
++/* Copyright (c) 2023, SUSE. */
++
++#include "mptcp_bpf.h"
++#include <bpf/bpf_tracing.h>
++#include <limits.h>
++
++char _license[] SEC("license") = "GPL";
++
++#define MPTCP_SEND_BURST_SIZE	65428
++
++#define min(a, b) ((a) < (b) ? (a) : (b))
++
++struct bpf_subflow_send_info {
++	__u8 subflow_id;
++	__u64 linger_time;
++};
++
++extern bool mptcp_subflow_active(struct mptcp_subflow_context *subflow) __ksym;
++extern void mptcp_set_timeout(struct sock *sk) __ksym;
++extern __u64 mptcp_wnd_end(const struct mptcp_sock *msk) __ksym;
++extern bool tcp_stream_memory_free(const struct sock *sk, int wake) __ksym;
++extern bool bpf_mptcp_subflow_queues_empty(struct sock *sk) __ksym;
++extern void mptcp_pm_subflow_chk_stale(const struct mptcp_sock *msk, struct sock *ssk) __ksym;
++
++#define SSK_MODE_ACTIVE	0
++#define SSK_MODE_BACKUP	1
++#define SSK_MODE_MAX	2
++
++static __always_inline __u64 div_u64(__u64 dividend, __u32 divisor)
++{
++	return dividend / divisor;
++}
++
++static __always_inline bool tcp_write_queue_empty(struct sock *sk)
++{
++	const struct tcp_sock *tp = bpf_skc_to_tcp_sock(sk);
++
++	return tp ? tp->write_seq == tp->snd_nxt : true;
++}
++
++static __always_inline bool tcp_rtx_and_write_queues_empty(struct sock *sk)
++{
++	return bpf_mptcp_subflow_queues_empty(sk) && tcp_write_queue_empty(sk);
++}
++
++static __always_inline bool __sk_stream_memory_free(const struct sock *sk, int wake)
++{
++	if (sk->sk_wmem_queued >= sk->sk_sndbuf)
++		return false;
++
++	return tcp_stream_memory_free(sk, wake);
++}
++
++static __always_inline bool sk_stream_memory_free(const struct sock *sk)
++{
++	return __sk_stream_memory_free(sk, 0);
++}
++
++SEC("struct_ops")
++void BPF_PROG(mptcp_sched_burst_init, struct mptcp_sock *msk)
++{
++}
++
++SEC("struct_ops")
++void BPF_PROG(mptcp_sched_burst_release, struct mptcp_sock *msk)
++{
++}
++
++static int bpf_burst_get_send(struct mptcp_sock *msk,
++			      struct mptcp_sched_data *data)
++{
++	struct bpf_subflow_send_info send_info[SSK_MODE_MAX];
++	struct mptcp_subflow_context *subflow;
++	struct sock *sk = (struct sock *)msk;
++	__u32 pace, burst, wmem;
++	int i, nr_active = 0;
++	__u64 linger_time;
++	struct sock *ssk;
++
++	/* pick the subflow with the lower wmem/wspace ratio */
++	for (i = 0; i < SSK_MODE_MAX; ++i) {
++		send_info[i].subflow_id = MPTCP_SUBFLOWS_MAX;
++		send_info[i].linger_time = -1;
++	}
++
++	for (i = 0; i < data->subflows && i < MPTCP_SUBFLOWS_MAX; i++) {
++		bool backup;
++
++		subflow = bpf_mptcp_subflow_ctx_by_pos(data, i);
++		if (!subflow)
++			break;
++
++		backup = subflow->backup || subflow->request_bkup;
++
++		ssk = mptcp_subflow_tcp_sock(subflow);
++		if (!mptcp_subflow_active(subflow))
++			continue;
++
++		nr_active += !backup;
++		pace = subflow->avg_pacing_rate;
++		if (!pace) {
++			/* init pacing rate from socket */
++			subflow->avg_pacing_rate = ssk->sk_pacing_rate;
++			pace = subflow->avg_pacing_rate;
++			if (!pace)
++				continue;
++		}
++
++		linger_time = div_u64((__u64)ssk->sk_wmem_queued << 32, pace);
++		if (linger_time < send_info[backup].linger_time) {
++			send_info[backup].subflow_id = i;
++			send_info[backup].linger_time = linger_time;
++		}
++	}
++	mptcp_set_timeout(sk);
++
++	/* pick the best backup if no other subflow is active */
++	if (!nr_active)
++		send_info[SSK_MODE_ACTIVE].subflow_id = send_info[SSK_MODE_BACKUP].subflow_id;
++
++	subflow = bpf_mptcp_subflow_ctx_by_pos(data, send_info[SSK_MODE_ACTIVE].subflow_id);
++	if (!subflow)
++		return -1;
++	ssk = mptcp_subflow_tcp_sock(subflow);
++	if (!ssk || !sk_stream_memory_free(ssk))
++		return -1;
++
++	burst = min(MPTCP_SEND_BURST_SIZE, mptcp_wnd_end(msk) - msk->snd_nxt);
++	wmem = ssk->sk_wmem_queued;
++	if (!burst)
++		goto out;
++
++	subflow->avg_pacing_rate = div_u64((__u64)subflow->avg_pacing_rate * wmem +
++					   ssk->sk_pacing_rate * burst,
++					   burst + wmem);
++	msk->snd_burst = burst;
++
++out:
++	mptcp_subflow_set_scheduled(subflow, true);
++	return 0;
++}
++
++static int bpf_burst_get_retrans(struct mptcp_sock *msk,
++				 struct mptcp_sched_data *data)
++{
++	int backup = MPTCP_SUBFLOWS_MAX, pick = MPTCP_SUBFLOWS_MAX, subflow_id;
++	struct mptcp_subflow_context *subflow;
++	int min_stale_count = INT_MAX;
++	struct sock *ssk;
++
++	for (int i = 0; i < data->subflows && i < MPTCP_SUBFLOWS_MAX; i++) {
++		subflow = bpf_mptcp_subflow_ctx_by_pos(data, i);
++		if (!subflow)
++			break;
++
++		if (!mptcp_subflow_active(subflow))
++			continue;
++
++		ssk = mptcp_subflow_tcp_sock(subflow);
++		/* still data outstanding at TCP level? skip this */
++		if (!tcp_rtx_and_write_queues_empty(ssk)) {
++			mptcp_pm_subflow_chk_stale(msk, ssk);
++			min_stale_count = min(min_stale_count, subflow->stale_count);
++			continue;
++		}
++
++		if (subflow->backup || subflow->request_bkup) {
++			if (backup == MPTCP_SUBFLOWS_MAX)
++				backup = i;
++			continue;
++		}
++
++		if (pick == MPTCP_SUBFLOWS_MAX)
++			pick = i;
++	}
++
++	if (pick < MPTCP_SUBFLOWS_MAX) {
++		subflow_id = pick;
++		goto out;
++	}
++	subflow_id = min_stale_count > 1 ? backup : MPTCP_SUBFLOWS_MAX;
++
++out:
++	subflow = bpf_mptcp_subflow_ctx_by_pos(data, subflow_id);
++	if (!subflow)
++		return -1;
++	mptcp_subflow_set_scheduled(subflow, true);
++	return 0;
++}
++
++SEC("struct_ops")
++int BPF_PROG(bpf_burst_get_subflow, struct mptcp_sock *msk,
++	     struct mptcp_sched_data *data)
++{
++	if (data->reinject)
++		return bpf_burst_get_retrans(msk, data);
++	return bpf_burst_get_send(msk, data);
++}
++
++SEC(".struct_ops")
++struct mptcp_sched_ops burst = {
++	.init		= (void *)mptcp_sched_burst_init,
++	.release	= (void *)mptcp_sched_burst_release,
++	.get_subflow	= (void *)bpf_burst_get_subflow,
++	.name		= "bpf_burst",
++};
+-- 
+2.46.0
+
diff --git a/6.12/target/linux/generic/pending-6.12/100-compiler.h-only-include-asm-rwonce.h-for-kernel-code.patch b/6.12/target/linux/generic/pending-6.12/100-compiler.h-only-include-asm-rwonce.h-for-kernel-code.patch
new file mode 100644
index 00000000..e28c106d
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/100-compiler.h-only-include-asm-rwonce.h-for-kernel-code.patch
@@ -0,0 +1,29 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 22 Oct 2020 22:00:03 +0200
+Subject: [PATCH] compiler.h: only include asm/rwonce.h for kernel code
+
+This header file is not in uapi, which makes any user space code that includes
+linux/compiler.h to fail with the error 'asm/rwonce.h: No such file or directory'
+
+Fixes: e506ea451254 ("compiler.h: Split {READ,WRITE}_ONCE definitions out into rwonce.h")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -214,6 +214,8 @@ void ftrace_likely_update(struct ftrace_
+ 	__v;								\
+ })
+ 
++#include <asm/rwonce.h>
++
+ #endif /* __KERNEL__ */
+ 
+ /**
+@@ -329,6 +331,4 @@ static inline void *offset_to_ptr(const
+  */
+ #define prevent_tail_call_optimization()	mb()
+ 
+-#include <asm/rwonce.h>
+-
+ #endif /* __LINUX_COMPILER_H */
diff --git a/6.12/target/linux/generic/pending-6.12/102-MIPS-only-process-negative-stack-offsets-on-stack-tr.patch b/6.12/target/linux/generic/pending-6.12/102-MIPS-only-process-negative-stack-offsets-on-stack-tr.patch
new file mode 100644
index 00000000..d79d03de
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/102-MIPS-only-process-negative-stack-offsets-on-stack-tr.patch
@@ -0,0 +1,57 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 18 Apr 2018 10:50:05 +0200
+Subject: [PATCH] MIPS: only process negative stack offsets on stack traces
+
+Fixes endless back traces in cases where the compiler emits a stack
+pointer increase in a branch delay slot (probably for some form of
+function return).
+
+[    3.475442] BUG: MAX_STACK_TRACE_ENTRIES too low!
+[    3.480070] turning off the locking correctness validator.
+[    3.485521] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.14.34 #0
+[    3.491475] Stack : 00000000 00000000 00000000 00000000 80e0fce2 00000034 00000000 00000000
+[    3.499764]         87c3838c 80696377 8061047c 00000000 00000001 00000001 87c2d850 6534689f
+[    3.508059]         00000000 00000000 80e10000 00000000 00000000 000000cf 0000000f 00000000
+[    3.516353]         00000000 806a0000 00076891 00000000 00000000 00000000 ffffffff 00000000
+[    3.524648]         806c0000 00000004 80e10000 806a0000 00000003 80690000 00000000 80700000
+[    3.532942]         ...
+[    3.535362] Call Trace:
+[    3.537818] [<80010a48>] show_stack+0x58/0x100
+[    3.542207] [<804c2f78>] dump_stack+0xe8/0x170
+[    3.546613] [<80079f90>] save_trace+0xf0/0x110
+[    3.551010] [<8007b1ec>] mark_lock+0x33c/0x78c
+[    3.555413] [<8007bf48>] __lock_acquire+0x2ac/0x1a08
+[    3.560337] [<8007de60>] lock_acquire+0x64/0x8c
+[    3.564846] [<804e1570>] _raw_spin_lock_irqsave+0x54/0x78
+[    3.570186] [<801b618c>] kernfs_notify+0x94/0xac
+[    3.574770] [<801b7b10>] sysfs_notify+0x74/0xa0
+[    3.579257] [<801b618c>] kernfs_notify+0x94/0xac
+[    3.583839] [<801b7b10>] sysfs_notify+0x74/0xa0
+[    3.588329] [<801b618c>] kernfs_notify+0x94/0xac
+[    3.592911] [<801b7b10>] sysfs_notify+0x74/0xa0
+[    3.597401] [<801b618c>] kernfs_notify+0x94/0xac
+[    3.601983] [<801b7b10>] sysfs_notify+0x74/0xa0
+[    3.606473] [<801b618c>] kernfs_notify+0x94/0xac
+[    3.611055] [<801b7b10>] sysfs_notify+0x74/0xa0
+[    3.615545] [<801b618c>] kernfs_notify+0x94/0xac
+[    3.620125] [<801b7b10>] sysfs_notify+0x74/0xa0
+[    3.624619] [<801b618c>] kernfs_notify+0x94/0xac
+[    3.629197] [<801b7b10>] sysfs_notify+0x74/0xa0
+[    3.633691] [<801b618c>] kernfs_notify+0x94/0xac
+[    3.638269] [<801b7b10>] sysfs_notify+0x74/0xa0
+[    3.642763] [<801b618c>] kernfs_notify+0x94/0xac
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/arch/mips/kernel/process.c
++++ b/arch/mips/kernel/process.c
+@@ -395,6 +395,8 @@ static inline int is_sp_move_ins(union m
+ 
+ 	if (ip->i_format.opcode == addiu_op ||
+ 	    ip->i_format.opcode == daddiu_op) {
++		if (ip->i_format.simmediate > 0)
++			return 0;
+ 		*frame_size = -ip->i_format.simmediate;
+ 		return 1;
+ 	}
diff --git a/6.12/target/linux/generic/pending-6.12/103-kbuild-export-SUBARCH.patch b/6.12/target/linux/generic/pending-6.12/103-kbuild-export-SUBARCH.patch
new file mode 100644
index 00000000..da67f254
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/103-kbuild-export-SUBARCH.patch
@@ -0,0 +1,21 @@
+From 173019b66dcc9d68ad9333aa744dad1e369b5aa8 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 9 Jul 2017 00:26:53 +0200
+Subject: [PATCH 34/34] kernel: add compile fix for linux 4.9 on x86
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/Makefile
++++ b/Makefile
+@@ -583,7 +583,7 @@ endif
+ # Allows the usage of unstable features in stable compilers.
+ export RUSTC_BOOTSTRAP := 1
+ 
+-export ARCH SRCARCH CONFIG_SHELL BASH HOSTCC KBUILD_HOSTCFLAGS CROSS_COMPILE LD CC HOSTPKG_CONFIG
++export ARCH SRCARCH SUBARCH CONFIG_SHELL BASH HOSTCC KBUILD_HOSTCFLAGS CROSS_COMPILE LD CC HOSTPKG_CONFIG
+ export RUSTC RUSTDOC RUSTFMT RUSTC_OR_CLIPPY_QUIET RUSTC_OR_CLIPPY BINDGEN
+ export HOSTRUSTC KBUILD_HOSTRUSTFLAGS
+ export CPP AR NM STRIP OBJCOPY OBJDUMP READELF PAHOLE RESOLVE_BTFIDS LEX YACC AWK INSTALLKERNEL
diff --git a/6.12/target/linux/generic/pending-6.12/111-watchdog-max63xx_wdt-Add-support-for-specifying-WDI-.patch b/6.12/target/linux/generic/pending-6.12/111-watchdog-max63xx_wdt-Add-support-for-specifying-WDI-.patch
new file mode 100644
index 00000000..9dd90eec
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/111-watchdog-max63xx_wdt-Add-support-for-specifying-WDI-.patch
@@ -0,0 +1,75 @@
+From bd1b9f66d5134e518419f4c4dacf1884c1616983 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
+Date: Thu, 28 Apr 2022 11:13:23 +0200
+Subject: [PATCH] watchdog: max63xx_wdt: Add support for specifying WDI logic
+ via GPIO
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+On some boards is WDI logic of max6370 chip connected via GPIO.
+So extend max63xx_wdt driver to allow specifying WDI logic via GPIO.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+---
+ drivers/watchdog/max63xx_wdt.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+--- a/drivers/watchdog/max63xx_wdt.c
++++ b/drivers/watchdog/max63xx_wdt.c
+@@ -24,6 +24,7 @@
+ #include <linux/io.h>
+ #include <linux/slab.h>
+ #include <linux/property.h>
++#include <linux/gpio/consumer.h>
+ 
+ #define DEFAULT_HEARTBEAT 60
+ #define MAX_HEARTBEAT     60
+@@ -50,6 +51,9 @@ struct max63xx_wdt {
+ 	void __iomem *base;
+ 	spinlock_t lock;
+ 
++	/* GPIOs */
++	struct gpio_desc *gpio_wdi;
++
+ 	/* WDI and WSET bits write access routines */
+ 	void (*ping)(struct max63xx_wdt *wdt);
+ 	void (*set)(struct max63xx_wdt *wdt, u8 set);
+@@ -155,6 +159,17 @@ static const struct watchdog_info max63x
+ 	.identity = "max63xx Watchdog",
+ };
+ 
++static void max63xx_gpio_ping(struct max63xx_wdt *wdt)
++{
++	spin_lock(&wdt->lock);
++
++	gpiod_set_value(wdt->gpio_wdi, 1);
++	udelay(1);
++	gpiod_set_value(wdt->gpio_wdi, 0);
++
++	spin_unlock(&wdt->lock);
++}
++
+ static void max63xx_mmap_ping(struct max63xx_wdt *wdt)
+ {
+ 	u8 val;
+@@ -222,10 +237,19 @@ static int max63xx_wdt_probe(struct plat
+ 		return -EINVAL;
+ 	}
+ 
++	wdt->gpio_wdi = devm_gpiod_get(dev, NULL, GPIOD_FLAGS_BIT_DIR_OUT);
++	if (IS_ERR(wdt->gpio_wdi) && PTR_ERR(wdt->gpio_wdi) != -ENOENT)
++		return dev_err_probe(dev, PTR_ERR(wdt->gpio_wdi),
++				     "unable to request gpio: %ld\n",
++				     PTR_ERR(wdt->gpio_wdi));
++
+ 	err = max63xx_mmap_init(pdev, wdt);
+ 	if (err)
+ 		return err;
+ 
++	if (!IS_ERR(wdt->gpio_wdi))
++		wdt->ping = max63xx_gpio_ping;
++
+ 	platform_set_drvdata(pdev, &wdt->wdd);
+ 	watchdog_set_drvdata(&wdt->wdd, wdt);
+ 
diff --git a/6.12/target/linux/generic/pending-6.12/140-jffs2-use-.rename2-and-add-RENAME_WHITEOUT-support.patch b/6.12/target/linux/generic/pending-6.12/140-jffs2-use-.rename2-and-add-RENAME_WHITEOUT-support.patch
new file mode 100644
index 00000000..b5cc52dc
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/140-jffs2-use-.rename2-and-add-RENAME_WHITEOUT-support.patch
@@ -0,0 +1,81 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: jffs2: use .rename2 and add RENAME_WHITEOUT support
+
+It is required for renames on overlayfs
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/fs/jffs2/dir.c
++++ b/fs/jffs2/dir.c
+@@ -620,8 +620,8 @@ static int jffs2_rmdir (struct inode *di
+ 	return ret;
+ }
+ 
+-static int jffs2_mknod (struct mnt_idmap *idmap, struct inode *dir_i,
+-		        struct dentry *dentry, umode_t mode, dev_t rdev)
++static int __jffs2_mknod (struct mnt_idmap *idmap, struct inode *dir_i,
++		          struct dentry *dentry, umode_t mode, dev_t rdev, bool whiteout)
+ {
+ 	struct jffs2_inode_info *f, *dir_f;
+ 	struct jffs2_sb_info *c;
+@@ -761,7 +761,11 @@ static int jffs2_mknod (struct mnt_idmap
+ 	mutex_unlock(&dir_f->sem);
+ 	jffs2_complete_reservation(c);
+ 
+-	d_instantiate_new(dentry, inode);
++	if (!whiteout)
++		d_instantiate_new(dentry, inode);
++	else
++		unlock_new_inode(inode);
++
+ 	return 0;
+ 
+  fail:
+@@ -769,6 +773,19 @@ static int jffs2_mknod (struct mnt_idmap
+ 	return ret;
+ }
+ 
++static int jffs2_mknod (struct mnt_idmap *idmap, struct inode *dir_i,
++			struct dentry *dentry, umode_t mode, dev_t rdev)
++{
++	return __jffs2_mknod(idmap, dir_i, dentry, mode, rdev, false);
++}
++
++static int jffs2_whiteout (struct mnt_idmap *idmap, struct inode *old_dir,
++			   struct dentry *old_dentry)
++{
++	return __jffs2_mknod(idmap, old_dir, old_dentry, S_IFCHR | WHITEOUT_MODE,
++			     WHITEOUT_DEV, true);
++}
++
+ static int jffs2_rename (struct mnt_idmap *idmap,
+ 			 struct inode *old_dir_i, struct dentry *old_dentry,
+ 			 struct inode *new_dir_i, struct dentry *new_dentry,
+@@ -780,7 +797,7 @@ static int jffs2_rename (struct mnt_idma
+ 	uint8_t type;
+ 	uint32_t now;
+ 
+-	if (flags & ~RENAME_NOREPLACE)
++	if (flags & ~(RENAME_NOREPLACE|RENAME_WHITEOUT))
+ 		return -EINVAL;
+ 
+ 	/* The VFS will check for us and prevent trying to rename a
+@@ -846,9 +863,14 @@ static int jffs2_rename (struct mnt_idma
+ 	if (d_is_dir(old_dentry) && !victim_f)
+ 		inc_nlink(new_dir_i);
+ 
+-	/* Unlink the original */
+-	ret = jffs2_do_unlink(c, JFFS2_INODE_INFO(old_dir_i),
+-			      old_dentry->d_name.name, old_dentry->d_name.len, NULL, now);
++	if (flags & RENAME_WHITEOUT)
++		/* Replace with whiteout */
++		ret = jffs2_whiteout(idmap, old_dir_i, old_dentry);
++	else
++		/* Unlink the original */
++		ret = jffs2_do_unlink(c, JFFS2_INODE_INFO(old_dir_i),
++				      old_dentry->d_name.name,
++				      old_dentry->d_name.len, NULL, now);
+ 
+ 	/* We don't touch inode->i_nlink */
+ 
diff --git a/6.12/target/linux/generic/pending-6.12/141-jffs2-add-RENAME_EXCHANGE-support.patch b/6.12/target/linux/generic/pending-6.12/141-jffs2-add-RENAME_EXCHANGE-support.patch
new file mode 100644
index 00000000..44ba3bd9
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/141-jffs2-add-RENAME_EXCHANGE-support.patch
@@ -0,0 +1,73 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: jffs2: add RENAME_EXCHANGE support
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/fs/jffs2/dir.c
++++ b/fs/jffs2/dir.c
+@@ -794,18 +794,31 @@ static int jffs2_rename (struct mnt_idma
+ 	int ret;
+ 	struct jffs2_sb_info *c = JFFS2_SB_INFO(old_dir_i->i_sb);
+ 	struct jffs2_inode_info *victim_f = NULL;
++	struct inode *fst_inode = d_inode(old_dentry);
++	struct inode *snd_inode = d_inode(new_dentry);
+ 	uint8_t type;
+ 	uint32_t now;
+ 
+-	if (flags & ~(RENAME_NOREPLACE|RENAME_WHITEOUT))
++	if (flags & ~(RENAME_NOREPLACE|RENAME_WHITEOUT|RENAME_EXCHANGE))
+ 		return -EINVAL;
+ 
++	if ((flags & RENAME_EXCHANGE) && (old_dir_i != new_dir_i)) {
++		if (S_ISDIR(fst_inode->i_mode) && !S_ISDIR(snd_inode->i_mode)) {
++			inc_nlink(new_dir_i);
++			drop_nlink(old_dir_i);
++		}
++		else if (!S_ISDIR(fst_inode->i_mode) && S_ISDIR(snd_inode->i_mode)) {
++			drop_nlink(new_dir_i);
++			inc_nlink(old_dir_i);
++		}
++	}
++
+ 	/* The VFS will check for us and prevent trying to rename a
+ 	 * file over a directory and vice versa, but if it's a directory,
+ 	 * the VFS can't check whether the victim is empty. The filesystem
+ 	 * needs to do that for itself.
+ 	 */
+-	if (d_really_is_positive(new_dentry)) {
++	if (d_really_is_positive(new_dentry) && !(flags & RENAME_EXCHANGE)) {
+ 		victim_f = JFFS2_INODE_INFO(d_inode(new_dentry));
+ 		if (d_is_dir(new_dentry)) {
+ 			struct jffs2_full_dirent *fd;
+@@ -840,7 +853,7 @@ static int jffs2_rename (struct mnt_idma
+ 	if (ret)
+ 		return ret;
+ 
+-	if (victim_f) {
++	if (victim_f && !(flags & RENAME_EXCHANGE)) {
+ 		/* There was a victim. Kill it off nicely */
+ 		if (d_is_dir(new_dentry))
+ 			clear_nlink(d_inode(new_dentry));
+@@ -866,6 +879,12 @@ static int jffs2_rename (struct mnt_idma
+ 	if (flags & RENAME_WHITEOUT)
+ 		/* Replace with whiteout */
+ 		ret = jffs2_whiteout(idmap, old_dir_i, old_dentry);
++	else if (flags & RENAME_EXCHANGE)
++		/* Replace the original */
++		ret = jffs2_do_link(c, JFFS2_INODE_INFO(old_dir_i),
++				    d_inode(new_dentry)->i_ino, type,
++				    old_dentry->d_name.name, old_dentry->d_name.len,
++				    now);
+ 	else
+ 		/* Unlink the original */
+ 		ret = jffs2_do_unlink(c, JFFS2_INODE_INFO(old_dir_i),
+@@ -898,7 +917,7 @@ static int jffs2_rename (struct mnt_idma
+ 		return ret;
+ 	}
+ 
+-	if (d_is_dir(old_dentry))
++	if (d_is_dir(old_dentry) && !(flags & RENAME_EXCHANGE))
+ 		drop_nlink(old_dir_i);
+ 
+ 	inode_set_mtime_to_ts(old_dir_i,
diff --git a/6.12/target/linux/generic/pending-6.12/142-jffs2-add-splice-ops.patch b/6.12/target/linux/generic/pending-6.12/142-jffs2-add-splice-ops.patch
new file mode 100644
index 00000000..ea57158c
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/142-jffs2-add-splice-ops.patch
@@ -0,0 +1,20 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: jffs2: add splice ops
+
+Add splice_read using generic_file_splice_read.
+Add splice_write using iter_file_splice_write
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/fs/jffs2/file.c
++++ b/fs/jffs2/file.c
+@@ -53,6 +53,8 @@ const struct file_operations jffs2_file_
+ 	.open =		generic_file_open,
+  	.read_iter =	generic_file_read_iter,
+  	.write_iter =	generic_file_write_iter,
++	.splice_read =	filemap_splice_read,
++	.splice_write =	iter_file_splice_write,
+ 	.unlocked_ioctl=jffs2_ioctl,
+ 	.mmap =		generic_file_readonly_mmap,
+ 	.fsync =	jffs2_fsync,
diff --git a/6.12/target/linux/generic/pending-6.12/150-bridge_allow_receiption_on_disabled_port.patch b/6.12/target/linux/generic/pending-6.12/150-bridge_allow_receiption_on_disabled_port.patch
new file mode 100644
index 00000000..d8fd9cdf
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/150-bridge_allow_receiption_on_disabled_port.patch
@@ -0,0 +1,45 @@
+From: Stephen Hemminger <stephen@networkplumber.org>
+Subject: bridge: allow receiption on disabled port
+
+When an ethernet device is enslaved to a bridge, and the bridge STP
+detects loss of carrier (or operational state down), then normally
+packet receiption is blocked.
+
+This breaks control applications like WPA which maybe expecting to
+receive packets to negotiate to bring link up. The bridge needs to
+block forwarding packets from these disabled ports, but there is no
+hard requirement to not allow local packet delivery.
+
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+
+--- a/net/bridge/br_input.c
++++ b/net/bridge/br_input.c
+@@ -244,6 +244,9 @@ static void __br_handle_local_finish(str
+ /* note: already called with rcu_read_lock */
+ static int br_handle_local_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
+ {
++	struct net_bridge_port *p = br_port_get_rcu(skb->dev);
++
++	if (p->state != BR_STATE_DISABLED)
+ 	__br_handle_local_finish(skb);
+ 
+ 	/* return 1 to signal the okfn() was called so it's ok to use the skb */
+@@ -415,6 +418,17 @@ forward:
+ 		goto defer_stp_filtering;
+ 
+ 	switch (p->state) {
++	case BR_STATE_DISABLED:
++		if (ether_addr_equal(p->br->dev->dev_addr, dest))
++			skb->pkt_type = PACKET_HOST;
++
++		if (NF_HOOK(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING,
++			dev_net(skb->dev), NULL, skb, skb->dev, NULL,
++			br_handle_local_finish) == 1) {
++			return RX_HANDLER_PASS;
++		}
++		break;
++
+ 	case BR_STATE_FORWARDING:
+ 	case BR_STATE_LEARNING:
+ defer_stp_filtering:
diff --git a/6.12/target/linux/generic/pending-6.12/151-net-bridge-do-not-send-arp-replies-if-src-and-target.patch b/6.12/target/linux/generic/pending-6.12/151-net-bridge-do-not-send-arp-replies-if-src-and-target.patch
new file mode 100644
index 00000000..3abeacaf
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/151-net-bridge-do-not-send-arp-replies-if-src-and-target.patch
@@ -0,0 +1,37 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 4 Jan 2024 15:21:21 +0100
+Subject: [PATCH] net: bridge: do not send arp replies if src and target hw
+ addr is the same
+
+There are broken devices in the wild that handle duplicate IP address
+detection by sending out ARP requests for the IP that they received from a
+DHCP server and refuse the address if they get a reply.
+When proxyarp is enabled, they would go into a loop of requesting an address
+and then NAKing it again.
+
+Link: https://github.com/openwrt/openwrt/issues/14309
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/bridge/br_arp_nd_proxy.c
++++ b/net/bridge/br_arp_nd_proxy.c
+@@ -204,7 +204,10 @@ void br_do_proxy_suppress_arp(struct sk_
+ 			if ((p && (p->flags & BR_PROXYARP)) ||
+ 			    (f->dst && (f->dst->flags & BR_PROXYARP_WIFI)) ||
+ 			    br_is_neigh_suppress_enabled(f->dst, vid)) {
+-				if (!vid)
++				replied = true;
++				if (!memcmp(n->ha, sha, dev->addr_len))
++					replied = false;
++				else if (!vid)
+ 					br_arp_send(br, p, skb->dev, sip, tip,
+ 						    sha, n->ha, sha, 0, 0);
+ 				else
+@@ -212,7 +215,6 @@ void br_do_proxy_suppress_arp(struct sk_
+ 						    sha, n->ha, sha,
+ 						    skb->vlan_proto,
+ 						    skb_vlan_tag_get(skb));
+-				replied = true;
+ 			}
+ 
+ 			/* If we have replied or as long as we know the
diff --git a/6.12/target/linux/generic/pending-6.12/190-rtc-rs5c372-support_alarms_up_to_1_week.patch b/6.12/target/linux/generic/pending-6.12/190-rtc-rs5c372-support_alarms_up_to_1_week.patch
new file mode 100644
index 00000000..2f5c2228
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/190-rtc-rs5c372-support_alarms_up_to_1_week.patch
@@ -0,0 +1,94 @@
+From: Daniel González Cabanelas <dgcbueu@gmail.com>
+Subject: [PATCH 1/2] rtc: rs5c372: support alarms up to 1 week
+
+The Ricoh R2221x, R2223x, RS5C372, RV5C387A chips can handle 1 week
+alarms.
+
+Read the "wday" alarm register and convert it to a date to support up 1
+week in our driver.
+
+Signed-off-by: Daniel González Cabanelas <dgcbueu@gmail.com>
+---
+ drivers/rtc/rtc-rs5c372.c | 48 ++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 42 insertions(+), 6 deletions(-)
+
+--- a/drivers/rtc/rtc-rs5c372.c
++++ b/drivers/rtc/rtc-rs5c372.c
+@@ -399,7 +399,9 @@ static int rs5c_read_alarm(struct device
+ {
+ 	struct i2c_client	*client = to_i2c_client(dev);
+ 	struct rs5c372		*rs5c = i2c_get_clientdata(client);
+-	int			status;
++	int			status, wday_offs;
++	struct rtc_time 	rtc;
++	unsigned long 		alarm_secs;
+ 
+ 	status = rs5c_get_regs(rs5c);
+ 	if (status < 0)
+@@ -409,6 +411,30 @@ static int rs5c_read_alarm(struct device
+ 	t->time.tm_sec = 0;
+ 	t->time.tm_min = bcd2bin(rs5c->regs[RS5C_REG_ALARM_A_MIN] & 0x7f);
+ 	t->time.tm_hour = rs5c_reg2hr(rs5c, rs5c->regs[RS5C_REG_ALARM_A_HOURS]);
++	t->time.tm_wday = ffs(rs5c->regs[RS5C_REG_ALARM_A_WDAY] & 0x7f) - 1;
++
++	/* determine the day, month and year based on alarm wday, taking as a
++	 * reference the current time from the rtc
++	 */
++	status = rs5c372_rtc_read_time(dev, &rtc);
++	if (status < 0)
++		return status;
++
++	wday_offs = t->time.tm_wday - rtc.tm_wday;
++	alarm_secs = mktime64(rtc.tm_year + 1900,
++			      rtc.tm_mon + 1,
++			      rtc.tm_mday + wday_offs,
++			      t->time.tm_hour,
++			      t->time.tm_min,
++			      t->time.tm_sec);
++
++	if (wday_offs < 0 || (wday_offs == 0 &&
++			      (t->time.tm_hour < rtc.tm_hour ||
++			       (t->time.tm_hour == rtc.tm_hour &&
++				t->time.tm_min <= rtc.tm_min))))
++		alarm_secs += 7 * 86400;
++
++	rtc_time64_to_tm(alarm_secs, &t->time);
+ 
+ 	/* ... and status */
+ 	t->enabled = !!(rs5c->regs[RS5C_REG_CTRL1] & RS5C_CTRL1_AALE);
+@@ -423,12 +449,20 @@ static int rs5c_set_alarm(struct device
+ 	struct rs5c372		*rs5c = i2c_get_clientdata(client);
+ 	int			status, addr, i;
+ 	unsigned char		buf[3];
++	struct rtc_time 	rtc_tm;
++	unsigned long 		rtc_secs, alarm_secs;
+ 
+-	/* only handle up to 24 hours in the future, like RTC_ALM_SET */
+-	if (t->time.tm_mday != -1
+-			|| t->time.tm_mon != -1
+-			|| t->time.tm_year != -1)
++	/* chip only can handle alarms up to one week in the future*/
++	status = rs5c372_rtc_read_time(dev, &rtc_tm);
++	if (status)
++		return status;
++	rtc_secs = rtc_tm_to_time64(&rtc_tm);
++	alarm_secs = rtc_tm_to_time64(&t->time);
++	if (alarm_secs >= rtc_secs + 7 * 86400) {
++		dev_err(dev, "%s: alarm maximum is one week in the future (%d)\n",
++			__func__, status);
+ 		return -EINVAL;
++	}
+ 
+ 	/* REVISIT: round up tm_sec */
+ 
+@@ -449,7 +483,9 @@ static int rs5c_set_alarm(struct device
+ 	/* set alarm */
+ 	buf[0] = bin2bcd(t->time.tm_min);
+ 	buf[1] = rs5c_hr2reg(rs5c, t->time.tm_hour);
+-	buf[2] = 0x7f;	/* any/all days */
++	/* each bit is the day of the week, 0x7f means all days */
++	buf[2] = (t->time.tm_wday >= 0 && t->time.tm_wday < 7) ?
++		  BIT(t->time.tm_wday) : 0x7f;
+ 
+ 	for (i = 0; i < sizeof(buf); i++) {
+ 		addr = RS5C_ADDR(RS5C_REG_ALARM_A_MIN + i);
diff --git a/6.12/target/linux/generic/pending-6.12/191-rtc-rs5c372-let_the_alarm_to_be_used_as_wakeup_source.patch b/6.12/target/linux/generic/pending-6.12/191-rtc-rs5c372-let_the_alarm_to_be_used_as_wakeup_source.patch
new file mode 100644
index 00000000..a29c548b
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/191-rtc-rs5c372-let_the_alarm_to_be_used_as_wakeup_source.patch
@@ -0,0 +1,71 @@
+From: Daniel González Cabanelas <dgcbueu@gmail.com>
+Subject: [PATCH 2/2] rtc: rs5c372: let the alarm to be used as wakeup source
+
+Currently there is no use for the interrupts on the rs5c372 RTC and the
+wakealarm isn't enabled. There are some devices like NASes which use this
+RTC to wake up from the power off state when the INTR pin is activated by
+the alarm clock.
+
+Enable the alarm and let to be used as a wakeup source.
+
+Tested on a Buffalo LS421DE NAS.
+
+Signed-off-by: Daniel González Cabanelas <dgcbueu@gmail.com>
+---
+ drivers/rtc/rtc-rs5c372.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/drivers/rtc/rtc-rs5c372.c
++++ b/drivers/rtc/rtc-rs5c372.c
+@@ -832,6 +832,7 @@ static int rs5c372_probe(struct i2c_clie
+ 	int err = 0;
+ 	int smbus_mode = 0;
+ 	struct rs5c372 *rs5c372;
++	bool rs5c372_can_wakeup_device = false;
+ 
+ 	dev_dbg(&client->dev, "%s\n", __func__);
+ 
+@@ -868,6 +869,12 @@ static int rs5c372_probe(struct i2c_clie
+ 		rs5c372->type = id->driver_data;
+ 	}
+ 
++#ifdef CONFIG_OF
++	if(of_property_read_bool(client->dev.of_node,
++					      "wakeup-source"))
++		rs5c372_can_wakeup_device = true;
++#endif
++
+ 	/* we read registers 0x0f then 0x00-0x0f; skip the first one */
+ 	rs5c372->regs = &rs5c372->buf[1];
+ 	rs5c372->smbus = smbus_mode;
+@@ -901,6 +908,8 @@ static int rs5c372_probe(struct i2c_clie
+ 		goto exit;
+ 	}
+ 
++	rs5c372->has_irq = 1;
++
+ 	/* if the oscillator lost power and no other software (like
+ 	 * the bootloader) set it up, do it here.
+ 	 *
+@@ -927,6 +936,10 @@ static int rs5c372_probe(struct i2c_clie
+ 			);
+ 
+ 	/* REVISIT use client->irq to register alarm irq ... */
++	if (rs5c372_can_wakeup_device) {
++		device_init_wakeup(&client->dev, true);
++	}
++
+ 	rs5c372->rtc = devm_rtc_device_register(&client->dev,
+ 					rs5c372_driver.driver.name,
+ 					&rs5c372_rtc_ops, THIS_MODULE);
+@@ -940,6 +953,10 @@ static int rs5c372_probe(struct i2c_clie
+ 	if (err)
+ 		goto exit;
+ 
++	/* the rs5c372 alarm only supports a minute accuracy */
++	set_bit(RTC_FEATURE_ALARM_RES_MINUTE, rs5c372->rtc->features);
++	clear_bit(RTC_FEATURE_UPDATE_INTERRUPT, rs5c372->rtc->features);
++
+ 	return 0;
+ 
+ exit:
diff --git a/6.12/target/linux/generic/pending-6.12/203-kallsyms_uncompressed.patch b/6.12/target/linux/generic/pending-6.12/203-kallsyms_uncompressed.patch
new file mode 100644
index 00000000..fcb18817
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/203-kallsyms_uncompressed.patch
@@ -0,0 +1,165 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: kernel: add a config option for keeping the kallsyms table uncompressed, saving ~9kb kernel size after lzma on ar71xx
+
+[john@phrozen.org: added to my upstream queue 30.12.2016]
+lede-commit: e0e3509b5ce2ccf93d4d67ea907613f5f7ec2eed
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ init/Kconfig            | 11 +++++++++++
+ kernel/kallsyms.c       |  8 ++++++++
+ scripts/kallsyms.c      | 12 ++++++++++++
+ scripts/link-vmlinux.sh |  4 ++++
+ 4 files changed, 35 insertions(+)
+
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1525,6 +1525,17 @@ config SYSCTL_ARCH_UNALIGN_ALLOW
+ 	  the unaligned access emulation.
+ 	  see arch/parisc/kernel/unaligned.c for reference
+ 
++config KALLSYMS_UNCOMPRESSED
++	bool "Keep kallsyms uncompressed"
++	depends on KALLSYMS
++	help
++		Normally kallsyms contains compressed symbols (using a token table),
++		reducing the uncompressed kernel image size. Keeping the symbol table
++		uncompressed significantly improves the size of this part in compressed
++		kernel images.
++
++		Say N unless you need compressed kernel images to be small.
++
+ config HAVE_PCSPKR_PLATFORM
+ 	bool
+ 
+--- a/kernel/kallsyms.c
++++ b/kernel/kallsyms.c
+@@ -69,6 +69,11 @@ static unsigned int kallsyms_expand_symb
+ 	 * For every byte on the compressed symbol data, copy the table
+ 	 * entry for that byte.
+ 	 */
++#ifdef CONFIG_KALLSYMS_UNCOMPRESSED
++	memcpy(result, data + 1, len - 1);
++	result += len - 1;
++	len = 0;
++#endif
+ 	while (len) {
+ 		tptr = &kallsyms_token_table[kallsyms_token_index[*data]];
+ 		data++;
+@@ -101,6 +106,9 @@ tail:
+  */
+ static char kallsyms_get_symbol_type(unsigned int off)
+ {
++#ifdef CONFIG_KALLSYMS_UNCOMPRESSED
++	return kallsyms_names[off + 1];
++#endif
+ 	/*
+ 	 * Get just the first code, look it up in the token table,
+ 	 * and return the first char from this token.
+--- a/scripts/kallsyms.c
++++ b/scripts/kallsyms.c
+@@ -62,6 +62,7 @@ static struct addr_range percpu_range =
+ static struct sym_entry **table;
+ static unsigned int table_size, table_cnt;
+ static int all_symbols;
++static int uncompressed;
+ static int absolute_percpu;
+ 
+ static int token_profit[0x10000];
+@@ -412,12 +413,14 @@ static void write_src(void)
+ 		for (k = 0; k < table[i]->len; k++)
+ 			printf(", 0x%02x", table[i]->sym[k]);
+ 
+-		/*
+-		 * Now that we wrote out the compressed symbol name, restore the
+-		 * original name and print it in the comment.
+-		 */
+-		expand_symbol(table[i]->sym, table[i]->len, buf);
+-		strcpy((char *)table[i]->sym, buf);
++		if (!uncompressed) {
++			/*
++			 * Now that we wrote out the compressed symbol name, restore the
++			 * original name and print it in the comment.
++			 */
++			expand_symbol(table[i]->sym, table[i]->len, buf);
++			strcpy((char *)table[i]->sym, buf);
++		}
+ 		printf("\t/* %s */\n", table[i]->sym);
+ 	}
+ 	printf("\n");
+@@ -429,20 +432,22 @@ static void write_src(void)
+ 
+ 	free(markers);
+ 
+-	output_label("kallsyms_token_table");
+-	off = 0;
+-	for (i = 0; i < 256; i++) {
+-		best_idx[i] = off;
+-		expand_symbol(best_table[i], best_table_len[i], buf);
+-		printf("\t.asciz\t\"%s\"\n", buf);
+-		off += strlen(buf) + 1;
++	if (!uncompressed) {
++		output_label("kallsyms_token_table");
++		off = 0;
++		for (i = 0; i < 256; i++) {
++			best_idx[i] = off;
++			expand_symbol(best_table[i], best_table_len[i], buf);
++			printf("\t.asciz\t\"%s\"\n", buf);
++			off += strlen(buf) + 1;
++		}
++		printf("\n");
++
++		output_label("kallsyms_token_index");
++		for (i = 0; i < 256; i++)
++			printf("\t.short\t%d\n", best_idx[i]);
++		printf("\n");
+ 	}
+-	printf("\n");
+-
+-	output_label("kallsyms_token_index");
+-	for (i = 0; i < 256; i++)
+-		printf("\t.short\t%d\n", best_idx[i]);
+-	printf("\n");
+ 
+ 	output_label("kallsyms_offsets");
+ 
+@@ -532,6 +537,9 @@ static unsigned char *find_token(unsigne
+ {
+ 	int i;
+ 
++	if (uncompressed)
++		return NULL;
++
+ 	for (i = 0; i < len - 1; i++) {
+ 		if (str[i] == token[0] && str[i+1] == token[1])
+ 			return &str[i];
+@@ -604,6 +612,9 @@ static void optimize_result(void)
+ {
+ 	int i, best;
+ 
++	if (uncompressed)
++		return;
++
+ 	/* using the '\0' symbol last allows compress_symbols to use standard
+ 	 * fast string functions */
+ 	for (i = 255; i >= 0; i--) {
+@@ -763,6 +774,7 @@ int main(int argc, char **argv)
+ 		static const struct option long_options[] = {
+ 			{"all-symbols",     no_argument, &all_symbols,     1},
+ 			{"absolute-percpu", no_argument, &absolute_percpu, 1},
++			{"uncompressed",   no_argument, &uncompressed,   1},
+ 			{},
+ 		};
+ 
+--- a/scripts/link-vmlinux.sh
++++ b/scripts/link-vmlinux.sh
+@@ -144,6 +144,10 @@ kallsyms()
+ 		kallsymopt="${kallsymopt} --absolute-percpu"
+ 	fi
+ 
++	if is_enabled CONFIG_KALLSYMS_UNCOMPRESSED; then
++		kallsymopt="${kallsymopt} --uncompressed"
++	fi
++
+ 	info KSYMS "${2}.S"
+ 	scripts/kallsyms ${kallsymopt} "${1}" > "${2}.S"
+ 
diff --git a/6.12/target/linux/generic/pending-6.12/205-backtrace_module_info.patch b/6.12/target/linux/generic/pending-6.12/205-backtrace_module_info.patch
new file mode 100644
index 00000000..52d6f5c8
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/205-backtrace_module_info.patch
@@ -0,0 +1,41 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: kernel: when KALLSYMS is disabled, print module address + size for matching backtrace entries
+
+[john@phrozen.org: felix will add this to his upstream queue]
+
+lede-commit 53827cdc824556cda910b23ce5030c363b8f1461
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ lib/vsprintf.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+--- a/lib/vsprintf.c
++++ b/lib/vsprintf.c
+@@ -983,8 +983,10 @@ char *symbol_string(char *buf, char *end
+ 		    struct printf_spec spec, const char *fmt)
+ {
+ 	unsigned long value;
+-#ifdef CONFIG_KALLSYMS
+ 	char sym[KSYM_SYMBOL_LEN];
++#ifndef CONFIG_KALLSYMS
++	struct module *mod;
++	int len;
+ #endif
+ 
+ 	if (fmt[1] == 'R')
+@@ -1005,8 +1007,14 @@ char *symbol_string(char *buf, char *end
+ 
+ 	return string_nocheck(buf, end, sym, spec);
+ #else
+-	return special_hex_number(buf, end, value, sizeof(void *));
++	len = snprintf(sym, sizeof(sym), "0x%lx", value);
++	mod = __module_address(value);
++	if (mod)
++		snprintf(sym + len, sizeof(sym) - len, " [%s@%p+0x%x]",
++			 mod->name, mod->mem[MOD_TEXT].base,
++			 mod->mem[MOD_TEXT].size);
+ #endif
++	return string(buf, end, sym, spec);
+ }
+ 
+ static const struct printf_spec default_str_spec = {
diff --git a/6.12/target/linux/generic/pending-6.12/240-remove-unsane-filenames-from-deps_initramfs-list.patch b/6.12/target/linux/generic/pending-6.12/240-remove-unsane-filenames-from-deps_initramfs-list.patch
new file mode 100644
index 00000000..9e78284e
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/240-remove-unsane-filenames-from-deps_initramfs-list.patch
@@ -0,0 +1,30 @@
+From: Gabor Juhos <juhosg@openwrt.org>
+Subject: usr: sanitize deps_initramfs list
+
+If any filename in the intramfs dependency
+list contains a colon, that causes a kernel
+build error like this:
+
+/devel/openwrt/build_dir/linux-ar71xx_generic/linux-3.6.6/usr/Makefile:58: *** multiple target patterns.  Stop.
+make[5]: *** [usr] Error 2
+
+Fix it by removing such filenames from the
+deps_initramfs list.
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ usr/Makefile | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/usr/Makefile
++++ b/usr/Makefile
+@@ -56,6 +56,8 @@ hostprogs := gen_init_cpio
+ # The dependency list is generated by gen_initramfs.sh -l
+ -include $(obj)/.initramfs_data.cpio.d
+ 
++deps_initramfs := $(foreach v,$(deps_initramfs),$(if $(findstring :,$(v)),,$(v)))
++
+ # do not try to update files included in initramfs
+ $(deps_initramfs): ;
+ 
diff --git a/6.12/target/linux/generic/pending-6.12/270-platform-mikrotik-build-bits.patch b/6.12/target/linux/generic/pending-6.12/270-platform-mikrotik-build-bits.patch
new file mode 100644
index 00000000..772d9fee
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/270-platform-mikrotik-build-bits.patch
@@ -0,0 +1,31 @@
+From c2deb5ef01a0ef09088832744cbace9e239a6ee0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Thibaut=20VAR=C3=88NE?= <hacks@slashdirt.org>
+Date: Sat, 28 Mar 2020 12:11:50 +0100
+Subject: [PATCH] generic: platform/mikrotik build bits (5.4)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This patch adds platform/mikrotik kernel build bits
+
+Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
+---
+ drivers/platform/Kconfig  | 2 ++
+ drivers/platform/Makefile | 1 +
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/platform/Kconfig
++++ b/drivers/platform/Kconfig
+@@ -18,3 +18,5 @@ source "drivers/platform/surface/Kconfig
+ source "drivers/platform/x86/Kconfig"
+ 
+ source "drivers/platform/arm64/Kconfig"
++
++source "drivers/platform/mikrotik/Kconfig"
+--- a/drivers/platform/Makefile
++++ b/drivers/platform/Makefile
+@@ -13,3 +13,4 @@ obj-$(CONFIG_CHROME_PLATFORMS)	+= chrome
+ obj-$(CONFIG_CZNIC_PLATFORMS)	+= cznic/
+ obj-$(CONFIG_SURFACE_PLATFORMS)	+= surface/
+ obj-$(CONFIG_ARM64_PLATFORM_DEVICES)	+= arm64/
++obj-$(CONFIG_MIKROTIK)		+= mikrotik/
diff --git a/6.12/target/linux/generic/pending-6.12/300-mips_expose_boot_raw.patch b/6.12/target/linux/generic/pending-6.12/300-mips_expose_boot_raw.patch
new file mode 100644
index 00000000..a4e0daa9
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/300-mips_expose_boot_raw.patch
@@ -0,0 +1,40 @@
+From: Mark Miller <mark@mirell.org>
+Subject: mips: expose CONFIG_BOOT_RAW
+
+This exposes the CONFIG_BOOT_RAW symbol in Kconfig. This is needed on
+certain Broadcom chipsets running CFE in order to load the kernel.
+
+Signed-off-by: Mark Miller <mark@mirell.org>
+Acked-by: Rob Landley <rob@landley.net>
+---
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -1055,9 +1055,6 @@ config FW_ARC
+ config ARCH_MAY_HAVE_PC_FDC
+ 	bool
+ 
+-config BOOT_RAW
+-	bool
+-
+ config CEVT_BCM1480
+ 	bool
+ 
+@@ -2991,6 +2988,18 @@ choice
+ 		bool "Extend builtin kernel arguments with bootloader arguments"
+ endchoice
+ 
++config BOOT_RAW
++	bool "Enable the kernel to be executed from the load address"
++	default n
++	help
++	 Allow the kernel to be executed from the load address for
++	 bootloaders which cannot read the ELF format. This places
++	 a jump to start_kernel at the load address.
++
++	 If unsure, say N.
++
++
++
+ endmenu
+ 
+ config LOCKDEP_SUPPORT
diff --git a/6.12/target/linux/generic/pending-6.12/301-MIPS-Add-barriers-between-dcache-icache-flushes.patch b/6.12/target/linux/generic/pending-6.12/301-MIPS-Add-barriers-between-dcache-icache-flushes.patch
new file mode 100644
index 00000000..b3cb5f0c
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/301-MIPS-Add-barriers-between-dcache-icache-flushes.patch
@@ -0,0 +1,71 @@
+From e6e6ef4275978823ec3a84133fc91f4ffbef5c84 Mon Sep 17 00:00:00 2001
+From: Paul Burton <paul.burton@imgtec.com>
+Date: Mon, 22 Feb 2016 18:09:44 +0000
+Subject: [PATCH] MIPS: Add barriers between dcache & icache flushes
+
+Index-based cache operations may be arbitrarily reordered by out of
+order CPUs. Thus code which writes back the dcache & then invalidates
+the icache using indexed cache ops must include a barrier between
+operating on the 2 caches in order to prevent the scenario in which:
+
+  - icache invalidation occurs.
+
+  - icache fetch occurs, due to speculation.
+
+  - dcache writeback occurs.
+
+If the above were allowed to happen then the icache would contain stale
+data. Forcing the dcache writeback to complete before the icache
+invalidation avoids this.
+
+Signed-off-by: Paul Burton <paul.burton@imgtec.com>
+Cc: James Hogan <james.hogan@imgtec.com>
+---
+ arch/mips/mm/c-r4k.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -403,6 +403,7 @@ static inline void local_r4k___flush_cac
+ 
+ 	default:
+ 		r4k_blast_dcache();
++		mb(); /* cache instructions may be reordered */
+ 		r4k_blast_icache();
+ 		break;
+ 	}
+@@ -483,8 +484,10 @@ static inline void local_r4k_flush_cache
+ 	if (cpu_has_dc_aliases || (exec && !cpu_has_ic_fills_f_dc))
+ 		r4k_blast_dcache();
+ 	/* If executable, blast stale lines from icache */
+-	if (exec)
++	if (exec) {
++		mb(); /* cache instructions may be reordered */
+ 		r4k_blast_icache();
++	}
+ }
+ 
+ static void r4k_flush_cache_range(struct vm_area_struct *vma,
+@@ -586,8 +589,13 @@ static inline void local_r4k_flush_cache
+ 	if (cpu_has_dc_aliases || (exec && !cpu_has_ic_fills_f_dc)) {
+ 		vaddr ? r4k_blast_dcache_page(addr) :
+ 			r4k_blast_dcache_user_page(addr);
+-		if (exec && !cpu_icache_snoops_remote_store)
++		if (exec)
++			mb(); /* cache instructions may be reordered */
++
++		if (exec && !cpu_icache_snoops_remote_store) {
+ 			r4k_blast_scache_page(addr);
++			mb(); /* cache instructions may be reordered */
++		}
+ 	}
+ 	if (exec) {
+ 		if (vaddr && cpu_has_vtag_icache && mm == current->active_mm) {
+@@ -654,6 +662,7 @@ static inline void __local_r4k_flush_ica
+ 			else
+ 				blast_dcache_range(start, end);
+ 		}
++		mb(); /* cache instructions may be reordered */
+ 	}
+ 
+ 	if (type == R4K_INDEX ||
diff --git a/6.12/target/linux/generic/pending-6.12/302-mips_no_branch_likely.patch b/6.12/target/linux/generic/pending-6.12/302-mips_no_branch_likely.patch
new file mode 100644
index 00000000..669aa814
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/302-mips_no_branch_likely.patch
@@ -0,0 +1,22 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: mips: use -mno-branch-likely for kernel and userspace
+
+saves ~11k kernel size after lzma and ~12k squashfs size in the
+
+lede-commit: 41a039f46450ffae9483d6216422098669da2900
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ arch/mips/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/mips/Makefile
++++ b/arch/mips/Makefile
+@@ -94,7 +94,7 @@ all-$(CONFIG_SYS_SUPPORTS_ZBOOT)+= vmlin
+ # machines may also.  Since BFD is incredibly buggy with respect to
+ # crossformat linking we rely on the elf2ecoff tool for format conversion.
+ #
+-cflags-y			+= -G 0 -mno-abicalls -fno-pic -pipe
++cflags-y			+= -G 0 -mno-abicalls -fno-pic -pipe -mno-branch-likely
+ cflags-y			+= -msoft-float -Wa,-msoft-float
+ LDFLAGS_vmlinux			+= -G 0 -static -n -nostdlib
+ KBUILD_AFLAGS_MODULE		+= -mlong-calls
diff --git a/6.12/target/linux/generic/pending-6.12/308-mips32r2_tune.patch b/6.12/target/linux/generic/pending-6.12/308-mips32r2_tune.patch
new file mode 100644
index 00000000..b9bd6104
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/308-mips32r2_tune.patch
@@ -0,0 +1,22 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: kernel: add -mtune=34kc to MIPS CFLAGS when building for mips32r2
+
+This provides a good tradeoff across at least 24Kc-74Kc, while also
+producing smaller code.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ arch/mips/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/mips/Makefile
++++ b/arch/mips/Makefile
+@@ -153,7 +153,7 @@ cflags-$(CONFIG_CPU_R4300)	+= $(call cc-
+ cflags-$(CONFIG_CPU_R4X00)	+= $(call cc-option,-march=r4600,-march=mips3) -Wa,--trap
+ cflags-$(CONFIG_CPU_TX49XX)	+= $(call cc-option,-march=r4600,-march=mips3) -Wa,--trap
+ cflags-$(CONFIG_CPU_MIPS32_R1)	+= -march=mips32 -Wa,--trap
+-cflags-$(CONFIG_CPU_MIPS32_R2)	+= -march=mips32r2 -Wa,--trap
++cflags-$(CONFIG_CPU_MIPS32_R2)	+= -march=mips32r2 -mtune=34kc -Wa,--trap
+ cflags-$(CONFIG_CPU_MIPS32_R5)	+= -march=mips32r5 -Wa,--trap -modd-spreg
+ cflags-$(CONFIG_CPU_MIPS32_R6)	+= -march=mips32r6 -Wa,--trap -modd-spreg
+ cflags-$(CONFIG_CPU_MIPS64_R1)	+= -march=mips64 -Wa,--trap
diff --git a/6.12/target/linux/generic/pending-6.12/310-arm_module_unresolved_weak_sym.patch b/6.12/target/linux/generic/pending-6.12/310-arm_module_unresolved_weak_sym.patch
new file mode 100644
index 00000000..c654f6ba
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/310-arm_module_unresolved_weak_sym.patch
@@ -0,0 +1,22 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: fix errors in unresolved weak symbols on arm
+
+lede-commit: 570699d4838a907c3ef9f2819bf19eb72997b32f
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ arch/arm/kernel/module.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/arm/kernel/module.c
++++ b/arch/arm/kernel/module.c
+@@ -112,6 +112,10 @@ apply_relocate(Elf32_Shdr *sechdrs, cons
+ 			return -ENOEXEC;
+ 		}
+ 
++		if ((IS_ERR_VALUE(sym->st_value) || !sym->st_value) &&
++		    ELF_ST_BIND(sym->st_info) == STB_WEAK)
++			continue;
++
+ 		loc = dstsec->sh_addr + rel->r_offset;
+ 
+ 		switch (ELF32_R_TYPE(rel->r_info)) {
diff --git a/6.12/target/linux/generic/pending-6.12/330-MIPS-kexec-Accept-command-line-parameters-from-users.patch b/6.12/target/linux/generic/pending-6.12/330-MIPS-kexec-Accept-command-line-parameters-from-users.patch
new file mode 100644
index 00000000..a8c6b7a5
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/330-MIPS-kexec-Accept-command-line-parameters-from-users.patch
@@ -0,0 +1,282 @@
+From: Yousong Zhou <yszhou4tech@gmail.com>
+Subject: MIPS: kexec: Accept command line parameters from userspace.
+
+Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
+---
+ arch/mips/kernel/machine_kexec.c   |  153 +++++++++++++++++++++++++++++++-----
+ arch/mips/kernel/machine_kexec.h   |   20 +++++
+ arch/mips/kernel/relocate_kernel.S |   21 +++--
+ 3 files changed, 167 insertions(+), 27 deletions(-)
+ create mode 100644 arch/mips/kernel/machine_kexec.h
+
+--- a/arch/mips/kernel/machine_kexec.c
++++ b/arch/mips/kernel/machine_kexec.c
+@@ -10,14 +10,11 @@
+ #include <linux/libfdt.h>
+ #include <linux/reboot.h>
+ 
++#include <asm/bootinfo.h>
+ #include <asm/cacheflush.h>
+ #include <asm/page.h>
+-
+-extern const unsigned char relocate_new_kernel[];
+-extern const size_t relocate_new_kernel_size;
+-
+-extern unsigned long kexec_start_address;
+-extern unsigned long kexec_indirection_page;
++#include <linux/uaccess.h>
++#include "machine_kexec.h"
+ 
+ static unsigned long reboot_code_buffer;
+ 
+@@ -31,6 +28,101 @@ void (*_crash_smp_send_stop)(void) = NUL
+ void (*_machine_kexec_shutdown)(void) = NULL;
+ void (*_machine_crash_shutdown)(struct pt_regs *regs) = NULL;
+ 
++static void machine_kexec_print_args(void)
++{
++	unsigned long argc = (int)kexec_args[0];
++	int i;
++
++	pr_info("kexec_args[0] (argc): %lu\n", argc);
++	pr_info("kexec_args[1] (argv): %p\n", (void *)kexec_args[1]);
++	pr_info("kexec_args[2] (env ): %p\n", (void *)kexec_args[2]);
++	pr_info("kexec_args[3] (desc): %p\n", (void *)kexec_args[3]);
++
++	for (i = 0; i < argc; i++) {
++		pr_info("kexec_argv[%d] = %p, %s\n",
++				i, kexec_argv[i], kexec_argv[i]);
++	}
++}
++
++static void machine_kexec_init_argv(struct kimage *image)
++{
++	void __user *buf = NULL;
++	size_t bufsz;
++	size_t size;
++	int i;
++
++	bufsz = 0;
++	for (i = 0; i < image->nr_segments; i++) {
++		struct kexec_segment *seg;
++
++		seg = &image->segment[i];
++		if (seg->bufsz < 6)
++			continue;
++
++		if (strncmp((char *) seg->buf, "kexec ", 6))
++			continue;
++
++		buf = seg->buf;
++		bufsz = seg->bufsz;
++		break;
++	}
++
++	if (!buf)
++		return;
++
++	size = KEXEC_COMMAND_LINE_SIZE;
++	size = min(size, bufsz);
++	if (size < bufsz)
++		pr_warn("kexec command line truncated to %zd bytes\n", size);
++
++	/* Copy to kernel space */
++	if (copy_from_user(kexec_argv_buf, buf, size))
++		pr_warn("kexec command line copy to kernel space failed\n");
++
++	kexec_argv_buf[size - 1] = 0;
++}
++
++static void machine_kexec_parse_argv(struct kimage *image)
++{
++	char *reboot_code_buffer;
++	int reloc_delta;
++	char *ptr;
++	int argc;
++	int i;
++
++	ptr = kexec_argv_buf;
++	argc = 0;
++
++	/*
++	 * convert command line string to array of parameters
++	 * (as bootloader does).
++	 */
++	while (ptr && *ptr && (KEXEC_MAX_ARGC > argc)) {
++		if (*ptr == ' ') {
++			*ptr++ = '\0';
++			continue;
++		}
++
++		kexec_argv[argc++] = ptr;
++		ptr = strchr(ptr, ' ');
++	}
++
++	if (!argc)
++		return;
++
++	kexec_args[0] = argc;
++	kexec_args[1] = (unsigned long)kexec_argv;
++	kexec_args[2] = 0;
++	kexec_args[3] = 0;
++
++	reboot_code_buffer = page_address(image->control_code_page);
++	reloc_delta = reboot_code_buffer - (char *)kexec_relocate_new_kernel;
++
++	kexec_args[1] += reloc_delta;
++	for (i = 0; i < argc; i++)
++		kexec_argv[i] += reloc_delta;
++}
++
+ static void kexec_image_info(const struct kimage *kimage)
+ {
+ 	unsigned long i;
+@@ -100,6 +192,18 @@ machine_kexec_prepare(struct kimage *kim
+ #endif
+ 
+ 	kexec_image_info(kimage);
++	/*
++	 * Whenever arguments passed from kexec-tools, Init the arguments as
++	 * the original ones to try avoiding booting failure.
++	 */
++
++	kexec_args[0] = fw_arg0;
++	kexec_args[1] = fw_arg1;
++	kexec_args[2] = fw_arg2;
++	kexec_args[3] = fw_arg3;
++
++	machine_kexec_init_argv(kimage);
++	machine_kexec_parse_argv(kimage);
+ 
+ 	if (_machine_kexec_prepare)
+ 		return _machine_kexec_prepare(kimage);
+@@ -162,7 +266,7 @@ machine_crash_shutdown(struct pt_regs *r
+ void kexec_nonboot_cpu_jump(void)
+ {
+ 	local_flush_icache_range((unsigned long)relocated_kexec_smp_wait,
+-				 reboot_code_buffer + relocate_new_kernel_size);
++				 reboot_code_buffer + KEXEC_RELOCATE_NEW_KERNEL_SIZE);
+ 
+ 	relocated_kexec_smp_wait(NULL);
+ }
+@@ -200,7 +304,7 @@ void kexec_reboot(void)
+ 	 * machine_kexec() CPU.
+ 	 */
+ 	local_flush_icache_range(reboot_code_buffer,
+-				 reboot_code_buffer + relocate_new_kernel_size);
++				 reboot_code_buffer + KEXEC_RELOCATE_NEW_KERNEL_SIZE);
+ 
+ 	do_kexec = (void *)reboot_code_buffer;
+ 	do_kexec();
+@@ -213,10 +317,12 @@ machine_kexec(struct kimage *image)
+ 	unsigned long *ptr;
+ 
+ 	reboot_code_buffer =
+-	  (unsigned long)page_address(image->control_code_page);
++		(unsigned long)page_address(image->control_code_page);
++	pr_info("reboot_code_buffer = %p\n", (void *)reboot_code_buffer);
+ 
+ 	kexec_start_address =
+ 		(unsigned long) phys_to_virt(image->start);
++	pr_info("kexec_start_address = %p\n", (void *)kexec_start_address);
+ 
+ 	if (image->type == KEXEC_TYPE_DEFAULT) {
+ 		kexec_indirection_page =
+@@ -224,9 +330,19 @@ machine_kexec(struct kimage *image)
+ 	} else {
+ 		kexec_indirection_page = (unsigned long)&image->head;
+ 	}
++	pr_info("kexec_indirection_page = %p\n", (void *)kexec_indirection_page);
+ 
+-	memcpy((void*)reboot_code_buffer, relocate_new_kernel,
+-	       relocate_new_kernel_size);
++	pr_info("Where is memcpy: %p\n", memcpy);
++	pr_info("kexec_relocate_new_kernel = %p, kexec_relocate_new_kernel_end = %p\n",
++		(void *)kexec_relocate_new_kernel, &kexec_relocate_new_kernel_end);
++	pr_info("Copy %lu bytes from %p to %p\n", KEXEC_RELOCATE_NEW_KERNEL_SIZE,
++		(void *)kexec_relocate_new_kernel, (void *)reboot_code_buffer);
++	memcpy((void*)reboot_code_buffer, kexec_relocate_new_kernel,
++	       KEXEC_RELOCATE_NEW_KERNEL_SIZE);
++
++	pr_info("Before _print_args().\n");
++	machine_kexec_print_args();
++	pr_info("Before eval loop.\n");
+ 
+ 	/*
+ 	 * The generic kexec code builds a page list with physical
+@@ -257,7 +373,7 @@ machine_kexec(struct kimage *image)
+ #ifdef CONFIG_SMP
+ 	/* All secondary cpus now may jump to kexec_wait cycle */
+ 	relocated_kexec_smp_wait = reboot_code_buffer +
+-		(void *)(kexec_smp_wait - relocate_new_kernel);
++		(void *)(kexec_smp_wait - kexec_relocate_new_kernel);
+ 	smp_wmb();
+ 	atomic_set(&kexec_ready_to_reboot, 1);
+ #endif
+--- /dev/null
++++ b/arch/mips/kernel/machine_kexec.h
+@@ -0,0 +1,20 @@
++#ifndef _MACHINE_KEXEC_H
++#define _MACHINE_KEXEC_H
++
++#ifndef __ASSEMBLY__
++extern const unsigned char kexec_relocate_new_kernel[];
++extern unsigned long kexec_relocate_new_kernel_end;
++extern unsigned long kexec_start_address;
++extern unsigned long kexec_indirection_page;
++
++extern char kexec_argv_buf[];
++extern char *kexec_argv[];
++
++#define KEXEC_RELOCATE_NEW_KERNEL_SIZE	((unsigned long)&kexec_relocate_new_kernel_end - (unsigned long)kexec_relocate_new_kernel)
++#endif /* !__ASSEMBLY__ */
++
++#define KEXEC_COMMAND_LINE_SIZE		256
++#define KEXEC_ARGV_SIZE			(KEXEC_COMMAND_LINE_SIZE / 16)
++#define KEXEC_MAX_ARGC			(KEXEC_ARGV_SIZE / sizeof(long))
++
++#endif
+--- a/arch/mips/kernel/relocate_kernel.S
++++ b/arch/mips/kernel/relocate_kernel.S
+@@ -10,10 +10,11 @@
+ #include <asm/mipsregs.h>
+ #include <asm/stackframe.h>
+ #include <asm/addrspace.h>
++#include "machine_kexec.h"
+ 
+ #include <kernel-entry-init.h>
+ 
+-LEAF(relocate_new_kernel)
++LEAF(kexec_relocate_new_kernel)
+ 	PTR_L a0,	arg0
+ 	PTR_L a1,	arg1
+ 	PTR_L a2,	arg2
+@@ -97,7 +98,7 @@ done:
+ #endif
+ 	/* jump to kexec_start_address */
+ 	j		s1
+-	END(relocate_new_kernel)
++	END(kexec_relocate_new_kernel)
+ 
+ #ifdef CONFIG_SMP
+ /*
+@@ -176,8 +177,15 @@ EXPORT(kexec_indirection_page)
+ 	PTR_WD		0
+ 	.size		kexec_indirection_page, PTRSIZE
+ 
+-relocate_new_kernel_end:
++kexec_argv_buf:
++	EXPORT(kexec_argv_buf)
++	.skip		KEXEC_COMMAND_LINE_SIZE
++	.size		kexec_argv_buf, KEXEC_COMMAND_LINE_SIZE
++
++kexec_argv:
++	EXPORT(kexec_argv)
++	.skip		KEXEC_ARGV_SIZE
++	.size		kexec_argv, KEXEC_ARGV_SIZE
+ 
+-EXPORT(relocate_new_kernel_size)
+-	PTR_WD		relocate_new_kernel_end - relocate_new_kernel
+-	.size		relocate_new_kernel_size, PTRSIZE
++kexec_relocate_new_kernel_end:
++	EXPORT(kexec_relocate_new_kernel_end)
diff --git a/6.12/target/linux/generic/pending-6.12/332-arc-add-OWRTDTB-section.patch b/6.12/target/linux/generic/pending-6.12/332-arc-add-OWRTDTB-section.patch
new file mode 100644
index 00000000..5b943f37
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/332-arc-add-OWRTDTB-section.patch
@@ -0,0 +1,84 @@
+From bb0c3b0175240bf152fd7c644821a0cf9f77c37c Mon Sep 17 00:00:00 2001
+From: Evgeniy Didin <Evgeniy.Didin@synopsys.com>
+Date: Fri, 15 Mar 2019 18:53:38 +0300
+Subject: [PATCH] arc add OWRTDTB section
+
+This change allows OpenWRT to patch resulting kernel binary with
+external .dtb.
+
+That allows us to re-use exactky the same vmlinux on different boards
+given its ARC core configurations match (at least cache line sizes etc).
+
+""patch-dtb" searches for ASCII "OWRTDTB:" strign and copies external
+.dtb right after it, keeping the string in place.
+
+Signed-off-by: Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
+Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
+Signed-off-by: Evgeniy Didin <Evgeniy.Didin@synopsys.com>
+---
+ arch/arc/kernel/head.S        | 10 ++++++++++
+ arch/arc/kernel/setup.c       |  4 +++-
+ arch/arc/kernel/vmlinux.lds.S | 13 +++++++++++++
+ 3 files changed, 26 insertions(+), 1 deletion(-)
+
+--- a/arch/arc/kernel/head.S
++++ b/arch/arc/kernel/head.S
+@@ -88,6 +88,16 @@
+ 	DSP_EARLY_INIT
+ .endm
+ 
++	; Here "patch-dtb" will embed external .dtb
++	; Note "patch-dtb" searches for ASCII "OWRTDTB:" string
++	; and pastes .dtb right after it, hense the string precedes
++	; __image_dtb symbol.
++	.section .owrt, "aw",@progbits
++	.ascii  "OWRTDTB:"
++ENTRY(__image_dtb)
++	.fill   0x4000
++END(__image_dtb)
++
+ 	.section .init.text, "ax",@progbits
+ 
+ ;----------------------------------------------------------------
+--- a/arch/arc/kernel/setup.c
++++ b/arch/arc/kernel/setup.c
+@@ -450,6 +450,8 @@ static inline bool uboot_arg_invalid(uns
+ /* We always pass 0 as magic from U-boot */
+ #define UBOOT_MAGIC_VALUE	0
+ 
++extern struct boot_param_header __image_dtb;
++
+ void __init handle_uboot_args(void)
+ {
+ 	bool use_embedded_dtb = true;
+@@ -488,7 +490,7 @@ void __init handle_uboot_args(void)
+ ignore_uboot_args:
+ 
+ 	if (use_embedded_dtb) {
+-		machine_desc = setup_machine_fdt(__dtb_start);
++		machine_desc = setup_machine_fdt(&__image_dtb);
+ 		if (!machine_desc)
+ 			panic("Embedded DT invalid\n");
+ 	}
+--- a/arch/arc/kernel/vmlinux.lds.S
++++ b/arch/arc/kernel/vmlinux.lds.S
+@@ -27,6 +27,19 @@ SECTIONS
+ 
+ 	. = CONFIG_LINUX_LINK_BASE;
+ 
++	/*
++	* In OpenWRT we want to patch built binary embedding .dtb of choice.
++	* This is implemented with "patch-dtb" utility which searches for
++	* "OWRTDTB:" string in first 16k of image and if it is found
++	* copies .dtb right after mentioned string.
++	*
++	* Note: "OWRTDTB:" won't be overwritten with .dtb, .dtb will follow it.
++	*/
++	.owrt : {
++		*(.owrt)
++	. = ALIGN(PAGE_SIZE);
++	}
++
+ 	_int_vec_base_lds = .;
+ 	.vector : {
+ 		*(.vector)
diff --git a/6.12/target/linux/generic/pending-6.12/333-arc-enable-unaligned-access-in-kernel-mode.patch b/6.12/target/linux/generic/pending-6.12/333-arc-enable-unaligned-access-in-kernel-mode.patch
new file mode 100644
index 00000000..2c9808de
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/333-arc-enable-unaligned-access-in-kernel-mode.patch
@@ -0,0 +1,24 @@
+From: Alexey Brodkin <abrodkin@synopsys.com>
+Subject: arc: enable unaligned access in kernel mode
+
+This enables misaligned access handling even in kernel mode.
+Some wireless drivers (ath9k-htc and mt7601u) use misaligned accesses
+here and there and to cope with that without fixing stuff in the drivers
+we're just gracefully handling it on ARC.
+
+Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
+---
+ arch/arc/kernel/unaligned.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arc/kernel/unaligned.c
++++ b/arch/arc/kernel/unaligned.c
+@@ -203,7 +203,7 @@ int misaligned_fixup(unsigned long addre
+ 	char buf[TASK_COMM_LEN];
+ 
+ 	/* handle user mode only and only if enabled by sysadmin */
+-	if (!user_mode(regs) || !unaligned_enabled)
++	if (!unaligned_enabled)
+ 		return 1;
+ 
+ 	if (no_unaligned_warning) {
diff --git a/6.12/target/linux/generic/pending-6.12/342-powerpc-Enable-kernel-XZ-compression-option-on-PPC_8.patch b/6.12/target/linux/generic/pending-6.12/342-powerpc-Enable-kernel-XZ-compression-option-on-PPC_8.patch
new file mode 100644
index 00000000..c812a08b
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/342-powerpc-Enable-kernel-XZ-compression-option-on-PPC_8.patch
@@ -0,0 +1,25 @@
+From 66770a004afe10df11d3902e16eaa0c2c39436bb Mon Sep 17 00:00:00 2001
+From: Pawel Dembicki <paweldembicki@gmail.com>
+Date: Fri, 24 May 2019 17:56:19 +0200
+Subject: [PATCH] powerpc: Enable kernel XZ compression option on PPC_85xx
+
+Enable kernel XZ compression option on PPC_85xx. Tested with
+simpleImage on TP-Link TL-WDR4900 (Freescale P1014 processor).
+
+Suggested-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
+---
+ arch/powerpc/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/Kconfig
++++ b/arch/powerpc/Kconfig
+@@ -254,7 +254,7 @@ config PPC
+ 	select HAVE_KERNEL_GZIP
+ 	select HAVE_KERNEL_LZMA			if DEFAULT_UIMAGE
+ 	select HAVE_KERNEL_LZO			if DEFAULT_UIMAGE
+-	select HAVE_KERNEL_XZ			if PPC_BOOK3S || 44x
++	select HAVE_KERNEL_XZ			if PPC_BOOK3S || 44x || PPC_85xx
+ 	select HAVE_KPROBES
+ 	select HAVE_KPROBES_ON_FTRACE
+ 	select HAVE_KRETPROBES
diff --git a/6.12/target/linux/generic/pending-6.12/350-mips-kernel-fix-detect_memory_region-function.patch b/6.12/target/linux/generic/pending-6.12/350-mips-kernel-fix-detect_memory_region-function.patch
new file mode 100644
index 00000000..a99eed47
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/350-mips-kernel-fix-detect_memory_region-function.patch
@@ -0,0 +1,74 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Wed, 13 Mar 2024 20:28:37 +0800
+Subject: [PATCH] mips: kernel: fix detect_memory_region() function
+
+1. Do not use memcmp() on unallocated memory, as the new introduced
+   fortify dynamic object size check[1] will report unexpected result.
+2. Use a fixed pattern instead of a random function pointer as the
+   magic value.
+3. Flip magic value and double check it.
+4. Enable this feature only for 32-bit CPUs. Currently, only ath79 and
+   ralink CPUs are using it.
+
+[1] 439a1bcac648 ("fortify: Use __builtin_dynamic_object_size() when available")
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ arch/mips/include/asm/bootinfo.h |  2 ++
+ arch/mips/kernel/setup.c         | 17 ++++++++++++-----
+ 2 files changed, 14 insertions(+), 5 deletions(-)
+
+--- a/arch/mips/include/asm/bootinfo.h
++++ b/arch/mips/include/asm/bootinfo.h
+@@ -93,7 +93,9 @@ const char *get_system_type(void);
+ 
+ extern unsigned long mips_machtype;
+ 
++#ifndef CONFIG_64BIT
+ extern void detect_memory_region(phys_addr_t start, phys_addr_t sz_min,  phys_addr_t sz_max);
++#endif
+ 
+ extern void prom_init(void);
+ extern void prom_free_prom_memory(void);
+--- a/arch/mips/kernel/setup.c
++++ b/arch/mips/kernel/setup.c
+@@ -86,21 +86,27 @@ static struct resource bss_resource = {
+ unsigned long __kaslr_offset __ro_after_init;
+ EXPORT_SYMBOL(__kaslr_offset);
+ 
+-static void *detect_magic __initdata = detect_memory_region;
+-
+ #ifdef CONFIG_MIPS_AUTO_PFN_OFFSET
+ unsigned long ARCH_PFN_OFFSET;
+ EXPORT_SYMBOL(ARCH_PFN_OFFSET);
+ #endif
+ 
++#ifndef CONFIG_64BIT
++static u32 detect_magic __initdata;
++#define MIPS_MEM_TEST_PATTERN		0xaa5555aa
++
+ void __init detect_memory_region(phys_addr_t start, phys_addr_t sz_min, phys_addr_t sz_max)
+ {
+-	void *dm = &detect_magic;
++	void *dm = (void *)KSEG1ADDR(&detect_magic);
+ 	phys_addr_t size;
+ 
+ 	for (size = sz_min; size < sz_max; size <<= 1) {
+-		if (!memcmp(dm, dm + size, sizeof(detect_magic)))
+-			break;
++		__raw_writel(MIPS_MEM_TEST_PATTERN, dm);
++		if (__raw_readl(dm) == __raw_readl(dm + size)) {
++			__raw_writel(~MIPS_MEM_TEST_PATTERN, dm);
++			if (__raw_readl(dm) == __raw_readl(dm + size))
++				break;
++		}
+ 	}
+ 
+ 	pr_debug("Memory: %lluMB of RAM detected at 0x%llx (min: %lluMB, max: %lluMB)\n",
+@@ -111,6 +117,7 @@ void __init detect_memory_region(phys_ad
+ 
+ 	memblock_add(start, size);
+ }
++#endif /* CONFIG_64BIT */
+ 
+ /*
+  * Manage initrd
diff --git a/6.12/target/linux/generic/pending-6.12/400-mtd-mtdsplit-support.patch b/6.12/target/linux/generic/pending-6.12/400-mtd-mtdsplit-support.patch
new file mode 100644
index 00000000..838f9ac9
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/400-mtd-mtdsplit-support.patch
@@ -0,0 +1,328 @@
+From 39717277d5c87bdb183cf2f258957b44ba99b4df Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Wed, 13 Jul 2022 11:47:35 +0200
+Subject: [PATCH] mtd: mtdsplit support
+
+---
+ drivers/mtd/Kconfig            |  19 ++++
+ drivers/mtd/Makefile           |   2 +
+ drivers/mtd/mtdpart.c          | 169 ++++++++++++++++++++++++++++-----
+ include/linux/mtd/mtd.h        |  25 +++++
+ include/linux/mtd/partitions.h |   7 ++
+ 5 files changed, 197 insertions(+), 25 deletions(-)
+
+--- a/drivers/mtd/Kconfig
++++ b/drivers/mtd/Kconfig
+@@ -12,6 +12,25 @@ menuconfig MTD
+ 
+ if MTD
+ 
++menu "OpenWrt specific MTD options"
++
++config MTD_ROOTFS_ROOT_DEV
++	bool "Automatically set 'rootfs' partition to be root filesystem"
++	default y
++
++config MTD_SPLIT_FIRMWARE
++	bool "Automatically split firmware partition for kernel+rootfs"
++	default y
++
++config MTD_SPLIT_FIRMWARE_NAME
++	string "Firmware partition name"
++	depends on MTD_SPLIT_FIRMWARE
++	default "firmware"
++
++source "drivers/mtd/mtdsplit/Kconfig"
++
++endmenu
++
+ config MTD_TESTS
+ 	tristate "MTD tests support (DANGEROUS)"
+ 	depends on m
+--- a/drivers/mtd/Makefile
++++ b/drivers/mtd/Makefile
+@@ -9,6 +9,8 @@ mtd-y				:= mtdcore.o mtdsuper.o mtdconc
+ 
+ obj-y				+= parsers/
+ 
++obj-$(CONFIG_MTD_SPLIT)		+= mtdsplit/
++
+ # 'Users' - code which presents functionality to userspace.
+ obj-$(CONFIG_MTD_BLKDEVS)	+= mtd_blkdevs.o
+ obj-$(CONFIG_MTD_BLOCK)		+= mtdblock.o
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -15,11 +15,13 @@
+ #include <linux/kmod.h>
+ #include <linux/mtd/mtd.h>
+ #include <linux/mtd/partitions.h>
++#include <linux/magic.h>
+ #include <linux/err.h>
+ #include <linux/of.h>
+ #include <linux/of_platform.h>
+ 
+ #include "mtdcore.h"
++#include "mtdsplit/mtdsplit.h"
+ 
+ /*
+  * MTD methods which simply translate the effective address and pass through
+@@ -242,6 +244,147 @@ static int mtd_add_partition_attrs(struc
+ 	return ret;
+ }
+ 
++static DEFINE_SPINLOCK(part_parser_lock);
++static LIST_HEAD(part_parsers);
++
++static struct mtd_part_parser *mtd_part_parser_get(const char *name)
++{
++	struct mtd_part_parser *p, *ret = NULL;
++
++	spin_lock(&part_parser_lock);
++
++	list_for_each_entry(p, &part_parsers, list)
++		if (!strcmp(p->name, name) && try_module_get(p->owner)) {
++			ret = p;
++			break;
++		}
++
++	spin_unlock(&part_parser_lock);
++
++	return ret;
++}
++
++static inline void mtd_part_parser_put(const struct mtd_part_parser *p)
++{
++	module_put(p->owner);
++}
++
++static struct mtd_part_parser *
++get_partition_parser_by_type(enum mtd_parser_type type,
++			     struct mtd_part_parser *start)
++{
++	struct mtd_part_parser *p, *ret = NULL;
++
++	spin_lock(&part_parser_lock);
++
++	p = list_prepare_entry(start, &part_parsers, list);
++	if (start)
++		mtd_part_parser_put(start);
++
++	list_for_each_entry_continue(p, &part_parsers, list) {
++		if (p->type == type && try_module_get(p->owner)) {
++			ret = p;
++			break;
++		}
++	}
++
++	spin_unlock(&part_parser_lock);
++
++	return ret;
++}
++
++static int parse_mtd_partitions_by_type(struct mtd_info *master,
++					enum mtd_parser_type type,
++					const struct mtd_partition **pparts,
++					struct mtd_part_parser_data *data)
++{
++	struct mtd_part_parser *prev = NULL;
++	int ret = 0;
++
++	while (1) {
++		struct mtd_part_parser *parser;
++
++		parser = get_partition_parser_by_type(type, prev);
++		if (!parser)
++			break;
++
++		ret = (*parser->parse_fn)(master, pparts, data);
++
++		if (ret > 0) {
++			mtd_part_parser_put(parser);
++			printk(KERN_NOTICE
++			       "%d %s partitions found on MTD device %s\n",
++			       ret, parser->name, master->name);
++			break;
++		}
++
++		prev = parser;
++	}
++
++	return ret;
++}
++
++static int
++run_parsers_by_type(struct mtd_info *child, enum mtd_parser_type type)
++{
++	struct mtd_partition *parts;
++	int nr_parts;
++	int i;
++
++	nr_parts = parse_mtd_partitions_by_type(child, type, (const struct mtd_partition **)&parts,
++						NULL);
++	if (nr_parts <= 0)
++		return nr_parts;
++
++	if (WARN_ON(!parts))
++		return 0;
++
++	for (i = 0; i < nr_parts; i++) {
++		/* adjust partition offsets */
++		parts[i].offset += child->part.offset;
++
++		mtd_add_partition(child->parent,
++				  parts[i].name,
++				  parts[i].offset,
++				  parts[i].size);
++	}
++
++	kfree(parts);
++
++	return nr_parts;
++}
++
++#ifdef CONFIG_MTD_SPLIT_FIRMWARE_NAME
++#define SPLIT_FIRMWARE_NAME	CONFIG_MTD_SPLIT_FIRMWARE_NAME
++#else
++#define SPLIT_FIRMWARE_NAME	"unused"
++#endif
++
++static void split_firmware(struct mtd_info *master, struct mtd_info *part)
++{
++	run_parsers_by_type(part, MTD_PARSER_TYPE_FIRMWARE);
++}
++
++static void mtd_partition_split(struct mtd_info *master, struct mtd_info *part)
++{
++	static int rootfs_found = 0;
++
++	if (rootfs_found)
++		return;
++
++	if (of_find_property(mtd_get_of_node(part), "linux,rootfs", NULL) ||
++	    !strcmp(part->name, "rootfs")) {
++		run_parsers_by_type(part, MTD_PARSER_TYPE_ROOTFS);
++
++		rootfs_found = 1;
++	}
++
++	if (IS_ENABLED(CONFIG_MTD_SPLIT_FIRMWARE) &&
++	    !strcmp(part->name, SPLIT_FIRMWARE_NAME) &&
++	    !of_find_property(mtd_get_of_node(part), "compatible", NULL))
++		split_firmware(master, part);
++}
++
+ int mtd_add_partition(struct mtd_info *parent, const char *name,
+ 		      long long offset, long long length)
+ {
+@@ -280,6 +423,7 @@ int mtd_add_partition(struct mtd_info *p
+ 	if (ret)
+ 		goto err_remove_part;
+ 
++	mtd_partition_split(parent, child);
+ 	mtd_add_partition_attrs(child);
+ 
+ 	return 0;
+@@ -423,6 +567,7 @@ int add_mtd_partitions(struct mtd_info *
+ 			goto err_del_partitions;
+ 		}
+ 
++		mtd_partition_split(master, child);
+ 		mtd_add_partition_attrs(child);
+ 
+ 		/* Look for subpartitions */
+@@ -443,31 +588,6 @@ err_del_partitions:
+ 	return ret;
+ }
+ 
+-static DEFINE_SPINLOCK(part_parser_lock);
+-static LIST_HEAD(part_parsers);
+-
+-static struct mtd_part_parser *mtd_part_parser_get(const char *name)
+-{
+-	struct mtd_part_parser *p, *ret = NULL;
+-
+-	spin_lock(&part_parser_lock);
+-
+-	list_for_each_entry(p, &part_parsers, list)
+-		if (!strcmp(p->name, name) && try_module_get(p->owner)) {
+-			ret = p;
+-			break;
+-		}
+-
+-	spin_unlock(&part_parser_lock);
+-
+-	return ret;
+-}
+-
+-static inline void mtd_part_parser_put(const struct mtd_part_parser *p)
+-{
+-	module_put(p->owner);
+-}
+-
+ /*
+  * Many partition parsers just expected the core to kfree() all their data in
+  * one chunk. Do that by default.
+--- a/include/linux/mtd/mtd.h
++++ b/include/linux/mtd/mtd.h
+@@ -615,6 +615,24 @@ static inline void mtd_align_erase_req(s
+ 		req->len += mtd->erasesize - mod;
+ }
+ 
++static inline uint64_t mtd_roundup_to_eb(uint64_t sz, struct mtd_info *mtd)
++{
++	if (mtd_mod_by_eb(sz, mtd) == 0)
++		return sz;
++
++	/* Round up to next erase block */
++	return (mtd_div_by_eb(sz, mtd) + 1) * mtd->erasesize;
++}
++
++static inline uint64_t mtd_rounddown_to_eb(uint64_t sz, struct mtd_info *mtd)
++{
++	if (mtd_mod_by_eb(sz, mtd) == 0)
++		return sz;
++
++	/* Round down to the start of the current erase block */
++	return (mtd_div_by_eb(sz, mtd)) * mtd->erasesize;
++}
++
+ static inline uint32_t mtd_div_by_ws(uint64_t sz, struct mtd_info *mtd)
+ {
+ 	if (mtd->writesize_shift)
+@@ -688,6 +706,13 @@ extern struct mtd_info *of_get_mtd_devic
+ extern struct mtd_info *get_mtd_device_nm(const char *name);
+ extern void put_mtd_device(struct mtd_info *mtd);
+ 
++static inline uint64_t mtdpart_get_offset(const struct mtd_info *mtd)
++{
++	if (!mtd_is_partition(mtd))
++		return 0;
++
++	return mtd->part.offset;
++}
+ 
+ struct mtd_notifier {
+ 	void (*add)(struct mtd_info *mtd);
+--- a/include/linux/mtd/partitions.h
++++ b/include/linux/mtd/partitions.h
+@@ -75,6 +75,12 @@ struct mtd_part_parser_data {
+  * Functions dealing with the various ways of partitioning the space
+  */
+ 
++enum mtd_parser_type {
++	MTD_PARSER_TYPE_DEVICE = 0,
++	MTD_PARSER_TYPE_ROOTFS,
++	MTD_PARSER_TYPE_FIRMWARE,
++};
++
+ struct mtd_part_parser {
+ 	struct list_head list;
+ 	struct module *owner;
+@@ -83,6 +89,7 @@ struct mtd_part_parser {
+ 	int (*parse_fn)(struct mtd_info *, const struct mtd_partition **,
+ 			struct mtd_part_parser_data *);
+ 	void (*cleanup)(const struct mtd_partition *pparts, int nr_parts);
++	enum mtd_parser_type type;
+ };
+ 
+ /* Container for passing around a set of parsed partitions */
diff --git a/6.12/target/linux/generic/pending-6.12/401-mtd-don-t-register-NVMEM-devices-for-partitions-with.patch b/6.12/target/linux/generic/pending-6.12/401-mtd-don-t-register-NVMEM-devices-for-partitions-with.patch
new file mode 100644
index 00000000..119f1da6
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/401-mtd-don-t-register-NVMEM-devices-for-partitions-with.patch
@@ -0,0 +1,48 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 31 Oct 2023 15:51:01 +0100
+Subject: [PATCH] mtd: don't register NVMEM devices for partitions with custom
+ drivers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This fixes issue exposed by upstream commit f4cf4e5db331 ("Revert
+"nvmem: add new config option"").
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+ drivers/mtd/mtdcore.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -549,6 +549,29 @@ static int mtd_nvmem_add(struct mtd_info
+ 	struct device_node *node = mtd_get_of_node(mtd);
+ 	struct nvmem_config config = {};
+ 
++	/*
++	 * Do NOT register NVMEM device for any partition that is meant to be
++	 * handled by a U-Boot env driver. That would result in associating two
++	 * different NVMEM devices with the same OF node.
++	 *
++	 * An example of unwanted behaviour of above (forwardtrace):
++	 * of_get_mac_addr_nvmem()
++	 * of_nvmem_cell_get()
++	 * __nvmem_device_get()
++	 *
++	 * We can't have __nvmem_device_get() return "mtdX" NVMEM device instead
++	 * of U-Boot env NVMEM device. That would result in failing to find
++	 * NVMEM cell.
++	 *
++	 * This issue seems to affect U-Boot env case only and will go away with
++	 * switch to NVMEM layouts.
++	 */
++	if (of_device_is_compatible(node, "u-boot,env") ||
++	    of_device_is_compatible(node, "u-boot,env-redundant-bool") ||
++	    of_device_is_compatible(node, "u-boot,env-redundant-count") ||
++	    of_device_is_compatible(node, "brcm,env"))
++		return 0;
++
+ 	config.id = NVMEM_DEVID_NONE;
+ 	config.dev = &mtd->dev;
+ 	config.name = dev_name(&mtd->dev);
diff --git a/6.12/target/linux/generic/pending-6.12/402-mtd-spi-nor-write-support-for-minor-aligned-partitions.patch b/6.12/target/linux/generic/pending-6.12/402-mtd-spi-nor-write-support-for-minor-aligned-partitions.patch
new file mode 100644
index 00000000..e8ad2043
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/402-mtd-spi-nor-write-support-for-minor-aligned-partitions.patch
@@ -0,0 +1,245 @@
+From acacdac272927ae1d96e0bca51eb82899671eaea Mon Sep 17 00:00:00 2001
+From: John Thomson <git@johnthomson.fastmail.com.au>
+Date: Fri, 25 Dec 2020 18:50:08 +1000
+Subject: [PATCH] mtd: spi-nor: write support for minor aligned partitions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Do not prevent writing to mtd partitions where a partition boundary sits
+on a minor erasesize boundary.
+This addresses a FIXME that has been present since the start of the
+linux git history:
+/* Doesn't start on a boundary of major erase size */
+/* FIXME: Let it be writable if it is on a boundary of
+ * _minor_ erase size though */
+
+Allow a uniform erase region spi-nor device to be configured
+to use the non-uniform erase regions code path for an erase with:
+CONFIG_MTD_SPI_NOR_USE_VARIABLE_ERASE=y
+
+On supporting hardware (SECT_4K: majority of current SPI-NOR device)
+provide the facility for an erase to use the least number
+of SPI-NOR operations, as well as access to 4K erase without
+requiring CONFIG_MTD_SPI_NOR_USE_4K_SECTORS
+
+Introduce erasesize_minor to the mtd struct,
+the smallest erasesize supported by the device
+
+On existing devices, this is useful where write support is wanted
+for data on a 4K partition, such as some u-boot-env partitions,
+or RouterBoot soft_config, while still netting the performance
+benefits of using 64K sectors
+
+Performance:
+time mtd erase firmware
+OpenWrt 5.10 ramips MT7621 w25q128jv 0xfc0000 partition length
+
+Without this patch
+MTD_SPI_NOR_USE_4K_SECTORS=y	|n
+real    2m 11.66s		|0m 50.86s
+user    0m 0.00s		|0m 0.00s
+sys     1m 56.20s		|0m 50.80s
+
+With this patch
+MTD_SPI_NOR_USE_VARIABLE_ERASE=n|y		|4K_SECTORS=y
+real    0m 51.68s		|0m 50.85s	|2m 12.89s
+user    0m 0.00s		|0m 0.00s	|0m 0.01s
+sys     0m 46.94s		|0m 50.38s	|2m 12.46s
+
+Signed-off-by: John Thomson <git@johnthomson.fastmail.com.au>
+Signed-off-by: Thibaut VARÈNE <hacks+kernel@slashdirt.org>
+
+---
+
+checkpatch does not like the printk(KERN_WARNING
+these should be changed separately beforehand?
+
+Changes v1 -> v2:
+Added mtdcore sysfs for erasesize_minor
+Removed finding minor erasesize for variable erase regions device,
+as untested and no responses regarding it.
+Moved IF_ENABLED for SPINOR variable erase to guard setting
+erasesize_minor in spi-nor/core.c
+Removed setting erasesize to minor where partition boundaries require
+minor erase to be writable
+Simplified minor boundary check by relying on minor being a factor of
+major
+
+Changes RFC -> v1:
+Fix uninitialized variable smatch warning
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+---
+ drivers/mtd/mtdcore.c       | 10 ++++++++++
+ drivers/mtd/mtdpart.c       | 35 +++++++++++++++++++++++++----------
+ drivers/mtd/spi-nor/Kconfig | 10 ++++++++++
+ drivers/mtd/spi-nor/core.c  | 11 +++++++++--
+ include/linux/mtd/mtd.h     |  2 ++
+ 5 files changed, 56 insertions(+), 12 deletions(-)
+
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -199,6 +199,15 @@ static ssize_t mtd_erasesize_show(struct
+ }
+ MTD_DEVICE_ATTR_RO(erasesize);
+ 
++static ssize_t mtd_erasesize_minor_show(struct device *dev,
++		struct device_attribute *attr, char *buf)
++{
++	struct mtd_info *mtd = dev_get_drvdata(dev);
++
++	return sysfs_emit(buf, "%lu\n", (unsigned long)mtd->erasesize_minor);
++}
++MTD_DEVICE_ATTR_RO(erasesize_minor);
++
+ static ssize_t mtd_writesize_show(struct device *dev,
+ 		struct device_attribute *attr, char *buf)
+ {
+@@ -344,6 +353,7 @@ static struct attribute *mtd_attrs[] = {
+ 	&dev_attr_flags.attr,
+ 	&dev_attr_size.attr,
+ 	&dev_attr_erasesize.attr,
++	&dev_attr_erasesize_minor.attr,
+ 	&dev_attr_writesize.attr,
+ 	&dev_attr_subpagesize.attr,
+ 	&dev_attr_oobsize.attr,
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -47,6 +47,7 @@ static struct mtd_info *allocate_partiti
+ 	struct mtd_info *master = mtd_get_master(parent);
+ 	int wr_alignment = (parent->flags & MTD_NO_ERASE) ?
+ 			   master->writesize : master->erasesize;
++	int wr_alignment_minor = 0;
+ 	u64 parent_size = mtd_is_partition(parent) ?
+ 			  parent->part.size : parent->size;
+ 	struct mtd_info *child;
+@@ -171,6 +172,7 @@ static struct mtd_info *allocate_partiti
+ 	} else {
+ 		/* Single erase size */
+ 		child->erasesize = master->erasesize;
++		child->erasesize_minor = master->erasesize_minor;
+ 	}
+ 
+ 	/*
+@@ -178,26 +180,39 @@ static struct mtd_info *allocate_partiti
+ 	 * exposes several regions with different erasesize. Adjust
+ 	 * wr_alignment accordingly.
+ 	 */
+-	if (!(child->flags & MTD_NO_ERASE))
++	if (!(child->flags & MTD_NO_ERASE)) {
+ 		wr_alignment = child->erasesize;
++		wr_alignment_minor = child->erasesize_minor;
++	}
+ 
+ 	tmp = mtd_get_master_ofs(child, 0);
+ 	remainder = do_div(tmp, wr_alignment);
+ 	if ((child->flags & MTD_WRITEABLE) && remainder) {
+-		/* Doesn't start on a boundary of major erase size */
+-		/* FIXME: Let it be writable if it is on a boundary of
+-		 * _minor_ erase size though */
+-		child->flags &= ~MTD_WRITEABLE;
+-		printk(KERN_WARNING"mtd: partition \"%s\" doesn't start on an erase/write block boundary -- force read-only\n",
+-			part->name);
++		if (wr_alignment_minor) {
++			/* rely on minor being a factor of major erasesize */
++			tmp = remainder;
++			remainder = do_div(tmp, wr_alignment_minor);
++		}
++		if (remainder) {
++			child->flags &= ~MTD_WRITEABLE;
++			printk(KERN_WARNING"mtd: partition \"%s\" doesn't start on an erase/write block boundary -- force read-only\n",
++				part->name);
++		}
+ 	}
+ 
+ 	tmp = mtd_get_master_ofs(child, 0) + child->part.size;
+ 	remainder = do_div(tmp, wr_alignment);
+ 	if ((child->flags & MTD_WRITEABLE) && remainder) {
+-		child->flags &= ~MTD_WRITEABLE;
+-		printk(KERN_WARNING"mtd: partition \"%s\" doesn't end on an erase/write block -- force read-only\n",
+-			part->name);
++		if (wr_alignment_minor) {
++			tmp = remainder;
++			remainder = do_div(tmp, wr_alignment_minor);
++		}
++
++		if (remainder) {
++			child->flags &= ~MTD_WRITEABLE;
++			printk(KERN_WARNING"mtd: partition \"%s\" doesn't end on an erase/write block -- force read-only\n",
++				part->name);
++		}
+ 	}
+ 
+ 	child->size = child->part.size;
+--- a/drivers/mtd/spi-nor/Kconfig
++++ b/drivers/mtd/spi-nor/Kconfig
+@@ -10,6 +10,16 @@ menuconfig MTD_SPI_NOR
+ 
+ if MTD_SPI_NOR
+ 
++config MTD_SPI_NOR_USE_VARIABLE_ERASE
++	bool "Disable uniform_erase to allow use of all hardware supported erasesizes"
++	depends on !MTD_SPI_NOR_USE_4K_SECTORS
++	default n
++	help
++	  Allow mixed use of all hardware supported erasesizes,
++	  by forcing spi_nor to use the multiple eraseregions code path.
++	  For example: A 68K erase will use one 64K erase, and one 4K erase
++	  on supporting hardware.
++
+ config MTD_SPI_NOR_USE_4K_SECTORS
+ 	bool "Use small 4096 B erase sectors"
+ 	default y
+--- a/drivers/mtd/spi-nor/core.c
++++ b/drivers/mtd/spi-nor/core.c
+@@ -1158,6 +1158,8 @@ static u8 spi_nor_convert_3to4_erase(u8
+ 
+ static bool spi_nor_has_uniform_erase(const struct spi_nor *nor)
+ {
++	if (IS_ENABLED(CONFIG_MTD_SPI_NOR_USE_VARIABLE_ERASE))
++		return false;
+ 	return !!nor->params->erase_map.uniform_region.erase_mask;
+ }
+ 
+@@ -2516,6 +2518,7 @@ static int spi_nor_select_erase(struct s
+ {
+ 	struct spi_nor_erase_map *map = &nor->params->erase_map;
+ 	const struct spi_nor_erase_type *erase = NULL;
++	const struct spi_nor_erase_type *erase_minor = NULL;
+ 	struct mtd_info *mtd = &nor->mtd;
+ 	int i;
+ 
+@@ -2542,8 +2545,9 @@ static int spi_nor_select_erase(struct s
+ 	 */
+ 	for (i = SNOR_ERASE_TYPE_MAX - 1; i >= 0; i--) {
+ 		if (map->erase_type[i].size) {
+-			erase = &map->erase_type[i];
+-			break;
++			if (!erase)
++				erase = &map->erase_type[i];
++			erase_minor = &map->erase_type[i];
+ 		}
+ 	}
+ 
+@@ -2551,6 +2555,9 @@ static int spi_nor_select_erase(struct s
+ 		return -EINVAL;
+ 
+ 	mtd->erasesize = erase->size;
++	if (IS_ENABLED(CONFIG_MTD_SPI_NOR_USE_VARIABLE_ERASE) &&
++			erase_minor && erase_minor->size < erase->size)
++		mtd->erasesize_minor = erase_minor->size;
+ 	return 0;
+ }
+ 
+--- a/include/linux/mtd/mtd.h
++++ b/include/linux/mtd/mtd.h
+@@ -245,6 +245,8 @@ struct mtd_info {
+ 	 * information below if they desire
+ 	 */
+ 	uint32_t erasesize;
++	/* "Minor" (smallest) erase size supported by the whole device */
++	uint32_t erasesize_minor;
+ 	/* Minimal writable flash unit size. In case of NOR flash it is 1 (even
+ 	 * though individual bits can be cleared), in case of NAND flash it is
+ 	 * one NAND page (or half, or one-fourths of it), in case of ECC-ed NOR
diff --git a/6.12/target/linux/generic/pending-6.12/420-mtd-redboot_space.patch b/6.12/target/linux/generic/pending-6.12/420-mtd-redboot_space.patch
new file mode 100644
index 00000000..5518ea71
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/420-mtd-redboot_space.patch
@@ -0,0 +1,41 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: add patch for including unpartitioned space in the rootfs partition for redboot devices (if applicable)
+
+[john@phrozen.org: used by ixp and others]
+
+lede-commit: 394918851f84e4d00fa16eb900e7700e95091f00
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ drivers/mtd/redboot.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+--- a/drivers/mtd/parsers/redboot.c
++++ b/drivers/mtd/parsers/redboot.c
+@@ -278,14 +278,21 @@ nogood:
+ #endif
+ 		names += strlen(names) + 1;
+ 
+-#ifdef CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED
+ 		if (fl->next && fl->img->flash_base + fl->img->size + master->erasesize <= fl->next->img->flash_base) {
+-			i++;
+-			parts[i].offset = parts[i - 1].size + parts[i - 1].offset;
+-			parts[i].size = fl->next->img->flash_base - parts[i].offset;
+-			parts[i].name = nullname;
+-		}
++			if (!strcmp(parts[i].name, "rootfs")) {
++				parts[i].size = fl->next->img->flash_base;
++				parts[i].size &= ~(master->erasesize - 1);
++				parts[i].size -= parts[i].offset;
++#ifdef CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED
++				nrparts--;
++			} else {
++				i++;
++				parts[i].offset = parts[i-1].size + parts[i-1].offset;
++				parts[i].size = fl->next->img->flash_base - parts[i].offset;
++				parts[i].name = nullname;
+ #endif
++			}
++		}
+ 		tmp_fl = fl;
+ 		fl = fl->next;
+ 		kfree(tmp_fl);
diff --git a/6.12/target/linux/generic/pending-6.12/430-mtd-add-myloader-partition-parser.patch b/6.12/target/linux/generic/pending-6.12/430-mtd-add-myloader-partition-parser.patch
new file mode 100644
index 00000000..8ce11235
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/430-mtd-add-myloader-partition-parser.patch
@@ -0,0 +1,229 @@
+From: Florian Fainelli <f.fainelli@gmail.com>
+Subject: Add myloader partition table parser
+
+[john@phozen.org: shoud be upstreamable]
+
+lede-commit: d8bf22859b51faa09d22c056fe221a45d2f7a3b8
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+[adjust for kernel 5.4, add myloader.c to patch]
+Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
+
+--- a/drivers/mtd/parsers/Kconfig
++++ b/drivers/mtd/parsers/Kconfig
+@@ -62,6 +62,22 @@ config MTD_CMDLINE_PARTS
+ 
+ 	  If unsure, say 'N'.
+ 
++config MTD_MYLOADER_PARTS
++	tristate "MyLoader partition parsing"
++	depends on ADM5120 || ATH79
++	help
++	  MyLoader is a bootloader which allows the user to define partitions
++	  in flash devices, by putting a table in the second erase block
++	  on the device, similar to a partition table. This table gives the
++	  offsets and lengths of the user defined partitions.
++
++	  If you need code which can detect and parse these tables, and
++	  register MTD 'partitions' corresponding to each image detected,
++	  enable this option.
++
++	  You will still need the parsing functions to be called by the driver
++	  for your particular device. It won't happen automatically.
++
+ config MTD_OF_PARTS
+ 	tristate "OpenFirmware (device tree) partitioning parser"
+ 	default y
+--- a/drivers/mtd/parsers/Makefile
++++ b/drivers/mtd/parsers/Makefile
+@@ -3,6 +3,7 @@ obj-$(CONFIG_MTD_BCM47XX_PARTS)		+= bcm4
+ obj-$(CONFIG_MTD_BCM63XX_PARTS)		+= bcm63xxpart.o
+ obj-$(CONFIG_MTD_BRCM_U_BOOT)		+= brcm_u-boot.o
+ obj-$(CONFIG_MTD_CMDLINE_PARTS)		+= cmdlinepart.o
++obj-$(CONFIG_MTD_MYLOADER_PARTS)		+= myloader.o
+ obj-$(CONFIG_MTD_OF_PARTS)		+= ofpart.o
+ ofpart-y				+= ofpart_core.o
+ ofpart-$(CONFIG_MTD_OF_PARTS_BCM4908)	+= ofpart_bcm4908.o
+--- /dev/null
++++ b/drivers/mtd/parsers/myloader.c
+@@ -0,0 +1,181 @@
++/*
++ *  Parse MyLoader-style flash partition tables and produce a Linux partition
++ *  array to match.
++ *
++ *  Copyright (C) 2007-2009 Gabor Juhos <juhosg@openwrt.org>
++ *
++ *  This file was based on drivers/mtd/redboot.c
++ *  Author: Red Hat, Inc. - David Woodhouse <dwmw2@cambridge.redhat.com>
++ *
++ *  This program is free software; you can redistribute it and/or modify it
++ *  under the terms of the GNU General Public License version 2 as published
++ *  by the Free Software Foundation.
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/version.h>
++#include <linux/slab.h>
++#include <linux/init.h>
++#include <linux/vmalloc.h>
++#include <linux/mtd/mtd.h>
++#include <linux/mtd/partitions.h>
++#include <linux/byteorder/generic.h>
++#include <linux/myloader.h>
++
++#define BLOCK_LEN_MIN		0x10000
++#define PART_NAME_LEN		32
++
++struct part_data {
++	struct mylo_partition_table	tab;
++	char names[MYLO_MAX_PARTITIONS][PART_NAME_LEN];
++};
++
++static int myloader_parse_partitions(struct mtd_info *master,
++				     const struct mtd_partition **pparts,
++				     struct mtd_part_parser_data *data)
++{
++	struct part_data *buf;
++	struct mylo_partition_table *tab;
++	struct mylo_partition *part;
++	struct mtd_partition *mtd_parts;
++	struct mtd_partition *mtd_part;
++	int num_parts;
++	int ret, i;
++	size_t retlen;
++	char *names;
++	unsigned long offset;
++	unsigned long blocklen;
++
++	buf = vmalloc(sizeof(*buf));
++	if (!buf) {
++		return -ENOMEM;
++		goto out;
++	}
++	tab = &buf->tab;
++
++	blocklen = master->erasesize;
++	if (blocklen < BLOCK_LEN_MIN)
++		blocklen = BLOCK_LEN_MIN;
++
++	offset = blocklen;
++
++	/* Find the partition table */
++	for (i = 0; i < 4; i++, offset += blocklen) {
++		printk(KERN_DEBUG "%s: searching for MyLoader partition table"
++				" at offset 0x%lx\n", master->name, offset);
++
++		ret = mtd_read(master, offset, sizeof(*buf), &retlen,
++			       (void *)buf);
++		if (ret)
++			goto out_free_buf;
++
++		if (retlen != sizeof(*buf)) {
++			ret = -EIO;
++			goto out_free_buf;
++		}
++
++		/* Check for Partition Table magic number */
++		if (tab->magic == le32_to_cpu(MYLO_MAGIC_PARTITIONS))
++			break;
++
++	}
++
++	if (tab->magic != le32_to_cpu(MYLO_MAGIC_PARTITIONS)) {
++		printk(KERN_DEBUG "%s: no MyLoader partition table found\n",
++			master->name);
++		ret = 0;
++		goto out_free_buf;
++	}
++
++	/* The MyLoader and the Partition Table is always present */
++	num_parts = 2;
++
++	/* Detect number of used partitions */
++	for (i = 0; i < MYLO_MAX_PARTITIONS; i++) {
++		part = &tab->partitions[i];
++
++		if (le16_to_cpu(part->type) == PARTITION_TYPE_FREE)
++			continue;
++
++		num_parts++;
++	}
++
++	mtd_parts = kzalloc((num_parts * sizeof(*mtd_part) +
++				num_parts * PART_NAME_LEN), GFP_KERNEL);
++
++	if (!mtd_parts) {
++		ret = -ENOMEM;
++		goto out_free_buf;
++	}
++
++	mtd_part = mtd_parts;
++	names = (char *)&mtd_parts[num_parts];
++
++	strncpy(names, "myloader", PART_NAME_LEN);
++	mtd_part->name = names;
++	mtd_part->offset = 0;
++	mtd_part->size = offset;
++	mtd_part->mask_flags = MTD_WRITEABLE;
++	mtd_part++;
++	names += PART_NAME_LEN;
++
++	strncpy(names, "partition_table", PART_NAME_LEN);
++	mtd_part->name = names;
++	mtd_part->offset = offset;
++	mtd_part->size = blocklen;
++	mtd_part->mask_flags = MTD_WRITEABLE;
++	mtd_part++;
++	names += PART_NAME_LEN;
++
++	for (i = 0; i < MYLO_MAX_PARTITIONS; i++) {
++		part = &tab->partitions[i];
++
++		if (le16_to_cpu(part->type) == PARTITION_TYPE_FREE)
++			continue;
++
++		if ((buf->names[i][0]) && (buf->names[i][0] != '\xff'))
++			strncpy(names, buf->names[i], PART_NAME_LEN);
++		else
++			snprintf(names, PART_NAME_LEN, "partition%d", i);
++
++		mtd_part->offset = le32_to_cpu(part->addr);
++		mtd_part->size = le32_to_cpu(part->size);
++		mtd_part->name = names;
++		mtd_part++;
++		names += PART_NAME_LEN;
++	}
++
++	*pparts = mtd_parts;
++	ret = num_parts;
++
++ out_free_buf:
++	vfree(buf);
++ out:
++	return ret;
++}
++
++static struct mtd_part_parser myloader_mtd_parser = {
++	.owner		= THIS_MODULE,
++	.parse_fn	= myloader_parse_partitions,
++	.name		= "MyLoader",
++};
++
++static int __init myloader_mtd_parser_init(void)
++{
++	register_mtd_parser(&myloader_mtd_parser);
++
++	return 0;
++}
++
++static void __exit myloader_mtd_parser_exit(void)
++{
++	deregister_mtd_parser(&myloader_mtd_parser);
++}
++
++module_init(myloader_mtd_parser_init);
++module_exit(myloader_mtd_parser_exit);
++
++MODULE_AUTHOR("Gabor Juhos <juhosg@openwrt.org>");
++MODULE_DESCRIPTION("Parsing code for MyLoader partition tables");
++MODULE_LICENSE("GPL v2");
diff --git a/6.12/target/linux/generic/pending-6.12/431-mtd-bcm47xxpart-check-for-bad-blocks-when-calculatin.patch b/6.12/target/linux/generic/pending-6.12/431-mtd-bcm47xxpart-check-for-bad-blocks-when-calculatin.patch
new file mode 100644
index 00000000..bcea45d0
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/431-mtd-bcm47xxpart-check-for-bad-blocks-when-calculatin.patch
@@ -0,0 +1,68 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Subject: [PATCH] mtd: bcm47xxpart: check for bad blocks when calculating offsets
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+---
+
+--- a/drivers/mtd/parsers/parser_trx.c
++++ b/drivers/mtd/parsers/parser_trx.c
+@@ -25,6 +25,33 @@ struct trx_header {
+ 	uint32_t offset[3];
+ } __packed;
+ 
++/*
++ * Calculate real end offset (address) for a given amount of data. It checks
++ * all blocks skipping bad ones.
++ */
++static size_t parser_trx_real_offset(struct mtd_info *mtd, size_t bytes)
++{
++	size_t real_offset = 0;
++
++	if (mtd_block_isbad(mtd, real_offset))
++		pr_warn("Base offset shouldn't be at bad block");
++
++	while (bytes >= mtd->erasesize) {
++		bytes -= mtd->erasesize;
++		real_offset += mtd->erasesize;
++		while (mtd_block_isbad(mtd, real_offset)) {
++			real_offset += mtd->erasesize;
++
++			if (real_offset >= mtd->size)
++				return real_offset - mtd->erasesize;
++		}
++	}
++
++	real_offset += bytes;
++
++	return real_offset;
++}
++
+ static const char *parser_trx_data_part_name(struct mtd_info *master,
+ 					     size_t offset)
+ {
+@@ -86,21 +113,21 @@ static int parser_trx_parse(struct mtd_i
+ 	if (trx.offset[2]) {
+ 		part = &parts[curr_part++];
+ 		part->name = "loader";
+-		part->offset = trx.offset[i];
++		part->offset = parser_trx_real_offset(mtd, trx.offset[i]);
+ 		i++;
+ 	}
+ 
+ 	if (trx.offset[i]) {
+ 		part = &parts[curr_part++];
+ 		part->name = "linux";
+-		part->offset = trx.offset[i];
++		part->offset = parser_trx_real_offset(mtd, trx.offset[i]);
+ 		i++;
+ 	}
+ 
+ 	if (trx.offset[i]) {
+ 		part = &parts[curr_part++];
+-		part->name = parser_trx_data_part_name(mtd, trx.offset[i]);
+-		part->offset = trx.offset[i];
++		part->offset = parser_trx_real_offset(mtd, trx.offset[i]);
++		part->name = parser_trx_data_part_name(mtd, part->offset);
+ 		i++;
+ 	}
+ 
diff --git a/6.12/target/linux/generic/pending-6.12/432-mtd-bcm47xxpart-detect-T_Meter-partition.patch b/6.12/target/linux/generic/pending-6.12/432-mtd-bcm47xxpart-detect-T_Meter-partition.patch
new file mode 100644
index 00000000..852654d9
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/432-mtd-bcm47xxpart-detect-T_Meter-partition.patch
@@ -0,0 +1,37 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Subject: mtd: bcm47xxpart: detect T_Meter partition
+
+It can be found on many Netgear devices. It consists of many 0x30 blocks
+starting with 4D 54.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+---
+ drivers/mtd/bcm47xxpart.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/mtd/parsers/bcm47xxpart.c
++++ b/drivers/mtd/parsers/bcm47xxpart.c
+@@ -35,6 +35,7 @@
+ #define NVRAM_HEADER			0x48534C46	/* FLSH */
+ #define POT_MAGIC1			0x54544f50	/* POTT */
+ #define POT_MAGIC2			0x504f		/* OP */
++#define T_METER_MAGIC			0x4D540000	/* MT */
+ #define ML_MAGIC1			0x39685a42
+ #define ML_MAGIC2			0x26594131
+ #define TRX_MAGIC			0x30524448
+@@ -178,6 +179,15 @@ static int bcm47xxpart_parse(struct mtd_
+ 					     MTD_WRITEABLE);
+ 			continue;
+ 		}
++
++		/* T_Meter */
++		if ((le32_to_cpu(buf[0x000 / 4]) & 0xFFFF0000) == T_METER_MAGIC &&
++		    (le32_to_cpu(buf[0x030 / 4]) & 0xFFFF0000) == T_METER_MAGIC &&
++		    (le32_to_cpu(buf[0x060 / 4]) & 0xFFFF0000) == T_METER_MAGIC) {
++			bcm47xxpart_add_part(&parts[curr_part++], "T_Meter", offset,
++					     MTD_WRITEABLE);
++			continue;
++		}
+ 
+ 		/* TRX */
+ 		if (buf[0x000 / 4] == TRX_MAGIC) {
diff --git a/6.12/target/linux/generic/pending-6.12/435-mtd-add-routerbootpart-parser-config.patch b/6.12/target/linux/generic/pending-6.12/435-mtd-add-routerbootpart-parser-config.patch
new file mode 100644
index 00000000..d516e1dc
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/435-mtd-add-routerbootpart-parser-config.patch
@@ -0,0 +1,38 @@
+From 4437e01fb6bca63fccdba5d6c44888b0935885c2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Thibaut=20VAR=C3=88NE?= <hacks@slashdirt.org>
+Date: Tue, 24 Mar 2020 11:45:07 +0100
+Subject: [PATCH] generic: routerboot partition build bits (5.4)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This patch adds routerbootpart kernel build bits
+
+Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
+---
+ drivers/mtd/parsers/Kconfig  | 9 +++++++++
+ drivers/mtd/parsers/Makefile | 1 +
+ 2 files changed, 10 insertions(+)
+
+--- a/drivers/mtd/parsers/Kconfig
++++ b/drivers/mtd/parsers/Kconfig
+@@ -231,3 +231,12 @@ config MTD_SERCOMM_PARTS
+ 	  partition map. This partition table contains real partition
+ 	  offsets, which may differ from device to device depending on the
+ 	  number and location of bad blocks on NAND.
++
++config MTD_ROUTERBOOT_PARTS
++	tristate "RouterBoot flash partition parser"
++	depends on MTD && OF
++	help
++	 MikroTik RouterBoot is implemented as a multi segment system on the
++	 flash, some of which are fixed and some of which are located at
++	 variable offsets. This parser handles both cases via properly
++	 formatted DTS.
+--- a/drivers/mtd/parsers/Makefile
++++ b/drivers/mtd/parsers/Makefile
+@@ -16,3 +16,4 @@ obj-$(CONFIG_MTD_SERCOMM_PARTS)		+= scpa
+ obj-$(CONFIG_MTD_SHARPSL_PARTS)		+= sharpslpart.o
+ obj-$(CONFIG_MTD_REDBOOT_PARTS)		+= redboot.o
+ obj-$(CONFIG_MTD_QCOMSMEM_PARTS)	+= qcomsmempart.o
++obj-$(CONFIG_MTD_ROUTERBOOT_PARTS)		+= routerbootpart.o
diff --git a/6.12/target/linux/generic/pending-6.12/450-dt-bindings-block-add-basic-bindings-for-block-devic.patch b/6.12/target/linux/generic/pending-6.12/450-dt-bindings-block-add-basic-bindings-for-block-devic.patch
new file mode 100644
index 00000000..9089ce64
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/450-dt-bindings-block-add-basic-bindings-for-block-devic.patch
@@ -0,0 +1,120 @@
+From 3245921a87154bdfbe7a55d743ea62dd559a8fb0 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Thu, 30 May 2024 03:13:09 +0100
+Subject: [PATCH 1/9] dt-bindings: block: add basic bindings for block devices
+
+Add bindings for block devices which are used to allow referencing
+nvmem bits on them.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ .../bindings/block/block-device.yaml          | 22 ++++++++
+ .../devicetree/bindings/block/partition.yaml  | 51 +++++++++++++++++++
+ .../devicetree/bindings/block/partitions.yaml | 20 ++++++++
+ 3 files changed, 93 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/block/block-device.yaml
+ create mode 100644 Documentation/devicetree/bindings/block/partition.yaml
+ create mode 100644 Documentation/devicetree/bindings/block/partitions.yaml
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/block/block-device.yaml
+@@ -0,0 +1,22 @@
++# SPDX-License-Identifier: GPL-2.0-only OR BSD-2-Clause
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/block/block-device.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: block storage device
++
++description: |
++  This binding is generic and describes a block-oriented storage device.
++
++maintainers:
++  - Daniel Golle <daniel@makrotopia.org>
++
++properties:
++  partitions:
++    $ref: /schemas/block/partitions.yaml
++
++  nvmem-layout:
++    $ref: /schemas/nvmem/layouts/nvmem-layout.yaml#
++
++unevaluatedProperties: false
+--- /dev/null
++++ b/Documentation/devicetree/bindings/block/partition.yaml
+@@ -0,0 +1,51 @@
++# SPDX-License-Identifier: GPL-2.0-only OR BSD-2-Clause
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/block/partition.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Partition on a block device
++
++description: |
++  This binding describes a partition on a block device.
++  Partitions may be matched by a combination of partition number, name,
++  and UUID.
++
++maintainers:
++  - Daniel Golle <daniel@makrotopia.org>
++
++properties:
++  $nodename:
++    pattern: '^block-partition-.+$'
++
++  partnum:
++    $ref: /schemas/types.yaml#/definitions/uint32
++    description:
++      Matches partition by number if present.
++
++  partname:
++    $ref: /schemas/types.yaml#/definitions/string
++    description:
++      Matches partition by PARTNAME if present.
++
++  partuuid:
++    $ref: /schemas/types.yaml#/definitions/string
++    description:
++      Matches partition by PARTUUID if present.
++
++  nvmem-layout:
++    $ref: /schemas/nvmem/layouts/nvmem-layout.yaml#
++    description:
++      This container may reference an NVMEM layout parser.
++
++anyOf:
++  - required:
++      - partnum
++
++  - required:
++      - partname
++
++  - required:
++      - partuuid
++
++unevaluatedProperties: false
+--- /dev/null
++++ b/Documentation/devicetree/bindings/block/partitions.yaml
+@@ -0,0 +1,20 @@
++# SPDX-License-Identifier: GPL-2.0-only OR BSD-2-Clause
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/block/partitions.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Partitions on block devices
++
++description: |
++  This binding is generic and describes the content of the partitions container
++  node.
++
++maintainers:
++  - Daniel Golle <daniel@makrotopia.org>
++
++patternProperties:
++  "^block-partition-.+$":
++    $ref: partition.yaml
++
++unevaluatedProperties: false
diff --git a/6.12/target/linux/generic/pending-6.12/451-block-partitions-populate-fwnode.patch b/6.12/target/linux/generic/pending-6.12/451-block-partitions-populate-fwnode.patch
new file mode 100644
index 00000000..dbc66da8
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/451-block-partitions-populate-fwnode.patch
@@ -0,0 +1,135 @@
+From patchwork Tue Jul 30 19:25:59 2024
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 13747816
+Date: Tue, 30 Jul 2024 20:25:59 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: Rob Herring <robh@kernel.org>, Krzysztof Kozlowski <krzk+dt@kernel.org>,
+ Conor Dooley <conor+dt@kernel.org>, Jens Axboe <axboe@kernel.dk>,
+ Daniel Golle <daniel@makrotopia.org>, Christian Brauner <brauner@kernel.org>,
+ Al Viro <viro@zeniv.linux.org.uk>, Li Lingfeng <lilingfeng3@huawei.com>,
+ Ming Lei <ming.lei@redhat.com>, Christian Heusel <christian@heusel.eu>,
+	=?utf-8?b?UmFmYcWCIE1pxYJlY2tp?= <rafal@milecki.pl>,
+ Felix Fietkau <nbd@nbd.name>, John Crispin <john@phrozen.org>,
+ Chad Monroe <chad.monroe@adtran.com>, Yangyu Chen <cyy@cyyself.name>,
+ Tianling Shen <cnsztl@immortalwrt.org>, Chuanhong Guo <gch981213@gmail.com>,
+ Chen Minqiang <ptpt52@gmail.com>, devicetree@vger.kernel.org,
+ linux-kernel@vger.kernel.org, linux-block@vger.kernel.org
+Subject: [PATCH v5 2/4] block: partitions: populate fwnode
+Message-ID: 
+ <3051ac090ad3b3e2f5adb6b67c923261ead729a5.1722365899.git.daniel@makrotopia.org>
+References: <cover.1722365899.git.daniel@makrotopia.org>
+Precedence: bulk
+X-Mailing-List: linux-block@vger.kernel.org
+List-Id: <linux-block.vger.kernel.org>
+List-Subscribe: <mailto:linux-block+subscribe@vger.kernel.org>
+List-Unsubscribe: <mailto:linux-block+unsubscribe@vger.kernel.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1722365899.git.daniel@makrotopia.org>
+
+Assign matching firmware nodes to block partitions in order to allow
+them to be referenced e.g. as NVMEM providers.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ block/partitions/core.c | 72 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 72 insertions(+)
+
+--- a/block/partitions/core.c
++++ b/block/partitions/core.c
+@@ -10,6 +10,8 @@
+ #include <linux/ctype.h>
+ #include <linux/vmalloc.h>
+ #include <linux/raid/detect.h>
++#include <linux/property.h>
++
+ #include "check.h"
+ 
+ static int (*const check_part[])(struct parsed_partitions *) = {
+@@ -284,6 +286,74 @@ static ssize_t whole_disk_show(struct de
+ }
+ static const DEVICE_ATTR(whole_disk, 0444, whole_disk_show, NULL);
+ 
++static bool part_meta_match(const char *attr, const char *member, size_t length)
++{
++	/* check if length of attr exceeds specified maximum length */
++	if (strnlen(attr, length) == length)
++		return false;
++
++	/* return true if strings match */
++	return !strncmp(attr, member, length);
++}
++
++static struct fwnode_handle *find_partition_fwnode(struct block_device *bdev)
++{
++	struct fwnode_handle *fw_parts, *fw_part;
++	struct device *ddev = disk_to_dev(bdev->bd_disk);
++	const char *partname, *uuid;
++	u32 partno;
++	bool got_uuid, got_partname, got_partno;
++
++	fw_parts = device_get_named_child_node(ddev, "partitions");
++	if (!fw_parts)
++		return NULL;
++
++	fwnode_for_each_child_node(fw_parts, fw_part) {
++		got_uuid = false;
++		got_partname = false;
++		got_partno = false;
++		/*
++		 * In case 'uuid' is defined in the partitions firmware node
++		 * require partition meta info being present and the specified
++		 * uuid to match.
++		 */
++		got_uuid = !fwnode_property_read_string(fw_part, "uuid", &uuid);
++		if (got_uuid && (!bdev->bd_meta_info ||
++				 !part_meta_match(uuid, bdev->bd_meta_info->uuid,
++						  PARTITION_META_INFO_UUIDLTH)))
++			continue;
++
++		/*
++		 * In case 'partname' is defined in the partitions firmware node
++		 * require partition meta info being present and the specified
++		 * volname to match.
++		 */
++		got_partname = !fwnode_property_read_string(fw_part, "partname",
++							    &partname);
++		if (got_partname && (!bdev->bd_meta_info ||
++				     !part_meta_match(partname,
++						      bdev->bd_meta_info->volname,
++						      PARTITION_META_INFO_VOLNAMELTH)))
++			continue;
++
++		/*
++		 * In case 'partno' is defined in the partitions firmware node
++		 * the specified partno needs to match.
++		 */
++		got_partno = !fwnode_property_read_u32(fw_part, "partno", &partno);
++		if (got_partno && (atomic_read(&bdev->__bd_flags) & BD_PARTNO) != partno)
++			continue;
++
++		/* Skip if no matching criteria is present in firmware node */
++		if (!got_uuid && !got_partname && !got_partno)
++			continue;
++
++		return fw_part;
++	}
++
++	return NULL;
++}
++
+ /*
+  * Must be called either with open_mutex held, before a disk can be opened or
+  * after all disk users are gone.
+@@ -358,6 +428,8 @@ static struct block_device *add_partitio
+ 			goto out_put;
+ 	}
+ 
++	device_set_node(pdev, find_partition_fwnode(bdev));
++
+ 	/* delay uevent until 'holders' subdir is created */
+ 	dev_set_uevent_suppress(pdev, 1);
+ 	err = device_add(pdev);
diff --git a/6.12/target/linux/generic/pending-6.12/452-block-add-support-for-notifications.patch b/6.12/target/linux/generic/pending-6.12/452-block-add-support-for-notifications.patch
new file mode 100644
index 00000000..9bf2367c
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/452-block-add-support-for-notifications.patch
@@ -0,0 +1,174 @@
+From patchwork Tue Jul 30 19:26:42 2024
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 13747817
+Date: Tue, 30 Jul 2024 20:26:42 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: Rob Herring <robh@kernel.org>, Krzysztof Kozlowski <krzk+dt@kernel.org>,
+ Conor Dooley <conor+dt@kernel.org>, Jens Axboe <axboe@kernel.dk>,
+ Daniel Golle <daniel@makrotopia.org>, Christian Brauner <brauner@kernel.org>,
+ Al Viro <viro@zeniv.linux.org.uk>, Li Lingfeng <lilingfeng3@huawei.com>,
+ Ming Lei <ming.lei@redhat.com>, Christian Heusel <christian@heusel.eu>,
+	=?utf-8?b?UmFmYcWCIE1pxYJlY2tp?= <rafal@milecki.pl>,
+ Felix Fietkau <nbd@nbd.name>, John Crispin <john@phrozen.org>,
+ Chad Monroe <chad.monroe@adtran.com>, Yangyu Chen <cyy@cyyself.name>,
+ Tianling Shen <cnsztl@immortalwrt.org>, Chuanhong Guo <gch981213@gmail.com>,
+ Chen Minqiang <ptpt52@gmail.com>, devicetree@vger.kernel.org,
+ linux-kernel@vger.kernel.org, linux-block@vger.kernel.org
+Subject: [PATCH v5 3/4] block: add support for notifications
+Message-ID: 
+ <ca0022886e8f211a323a716653a1396a3bc91653.1722365899.git.daniel@makrotopia.org>
+References: <cover.1722365899.git.daniel@makrotopia.org>
+Precedence: bulk
+X-Mailing-List: linux-block@vger.kernel.org
+List-Id: <linux-block.vger.kernel.org>
+List-Subscribe: <mailto:linux-block+subscribe@vger.kernel.org>
+List-Unsubscribe: <mailto:linux-block+unsubscribe@vger.kernel.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1722365899.git.daniel@makrotopia.org>
+
+Add notifier block to notify other subsystems about the addition or
+removal of block devices.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ block/Kconfig          |  6 +++
+ block/Makefile         |  1 +
+ block/blk-notify.c     | 87 ++++++++++++++++++++++++++++++++++++++++++
+ include/linux/blkdev.h | 11 ++++++
+ 4 files changed, 105 insertions(+)
+ create mode 100644 block/blk-notify.c
+
+--- a/block/Kconfig
++++ b/block/Kconfig
+@@ -209,6 +209,12 @@ config BLK_INLINE_ENCRYPTION_FALLBACK
+ 	  by falling back to the kernel crypto API when inline
+ 	  encryption hardware is not present.
+ 
++config BLOCK_NOTIFIERS
++	bool "Enable support for notifications in block layer"
++	help
++	  Enable this option to provide notifiers for other subsystems
++	  upon addition or removal of block devices.
++
+ source "block/partitions/Kconfig"
+ 
+ config BLK_MQ_PCI
+--- a/block/Makefile
++++ b/block/Makefile
+@@ -38,3 +38,4 @@ obj-$(CONFIG_BLK_INLINE_ENCRYPTION)	+= b
+ 					   blk-crypto-sysfs.o
+ obj-$(CONFIG_BLK_INLINE_ENCRYPTION_FALLBACK)	+= blk-crypto-fallback.o
+ obj-$(CONFIG_BLOCK_HOLDER_DEPRECATED)	+= holder.o
++obj-$(CONFIG_BLOCK_NOTIFIERS) += blk-notify.o
+--- /dev/null
++++ b/block/blk-notify.c
+@@ -0,0 +1,87 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * Notifiers for addition and removal of block devices
++ *
++ * Copyright (c) 2024 Daniel Golle <daniel@makrotopia.org>
++ */
++
++#include <linux/list.h>
++#include <linux/mutex.h>
++#include <linux/notifier.h>
++
++#include "blk.h"
++
++struct blk_device_list {
++	struct device *dev;
++	struct list_head list;
++};
++
++static RAW_NOTIFIER_HEAD(blk_notifier_list);
++static DEFINE_MUTEX(blk_notifier_lock);
++static LIST_HEAD(blk_devices);
++
++void blk_register_notify(struct notifier_block *nb)
++{
++	struct blk_device_list *existing_blkdev;
++
++	mutex_lock(&blk_notifier_lock);
++	raw_notifier_chain_register(&blk_notifier_list, nb);
++
++	list_for_each_entry(existing_blkdev, &blk_devices, list)
++		nb->notifier_call(nb, BLK_DEVICE_ADD, existing_blkdev->dev);
++
++	mutex_unlock(&blk_notifier_lock);
++}
++EXPORT_SYMBOL_GPL(blk_register_notify);
++
++void blk_unregister_notify(struct notifier_block *nb)
++{
++	mutex_lock(&blk_notifier_lock);
++	raw_notifier_chain_unregister(&blk_notifier_list, nb);
++	mutex_unlock(&blk_notifier_lock);
++}
++EXPORT_SYMBOL_GPL(blk_unregister_notify);
++
++static int blk_call_notifier_add(struct device *dev)
++{
++	struct blk_device_list *new_blkdev;
++
++	new_blkdev = kmalloc(sizeof(*new_blkdev), GFP_KERNEL);
++	if (!new_blkdev)
++		return -ENOMEM;
++
++	new_blkdev->dev = dev;
++	mutex_lock(&blk_notifier_lock);
++	list_add_tail(&new_blkdev->list, &blk_devices);
++	raw_notifier_call_chain(&blk_notifier_list, BLK_DEVICE_ADD, dev);
++	mutex_unlock(&blk_notifier_lock);
++	return 0;
++}
++
++static void blk_call_notifier_remove(struct device *dev)
++{
++	struct blk_device_list *old_blkdev, *tmp;
++
++	mutex_lock(&blk_notifier_lock);
++	list_for_each_entry_safe(old_blkdev, tmp, &blk_devices, list) {
++		if (old_blkdev->dev != dev)
++			continue;
++
++		list_del(&old_blkdev->list);
++		kfree(old_blkdev);
++	}
++	raw_notifier_call_chain(&blk_notifier_list, BLK_DEVICE_REMOVE, dev);
++	mutex_unlock(&blk_notifier_lock);
++}
++
++static struct class_interface blk_notifications_bus_interface __refdata = {
++	.class = &block_class,
++	.add_dev = &blk_call_notifier_add,
++	.remove_dev = &blk_call_notifier_remove,
++};
++
++static int __init blk_notifications_init(void)
++{
++	return class_interface_register(&blk_notifications_bus_interface);
++}
++device_initcall(blk_notifications_init);
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -1690,4 +1690,15 @@ static inline bool bdev_can_atomic_write
+ 
+ #define DEFINE_IO_COMP_BATCH(name)	struct io_comp_batch name = { }
+ 
++
++#define BLK_DEVICE_ADD		1
++#define BLK_DEVICE_REMOVE	2
++#if defined(CONFIG_BLOCK_NOTIFIERS)
++void blk_register_notify(struct notifier_block *nb);
++void blk_unregister_notify(struct notifier_block *nb);
++#else
++static inline void blk_register_notify(struct notifier_block *nb) { };
++static inline void blk_unregister_notify(struct notifier_block *nb) { };
++#endif
++
+ #endif /* _LINUX_BLKDEV_H */
diff --git a/6.12/target/linux/generic/pending-6.12/453-block-add-new-genhd-flag-GENHD_FL_NVMEM.patch b/6.12/target/linux/generic/pending-6.12/453-block-add-new-genhd-flag-GENHD_FL_NVMEM.patch
new file mode 100644
index 00000000..36dc9e6a
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/453-block-add-new-genhd-flag-GENHD_FL_NVMEM.patch
@@ -0,0 +1,56 @@
+From patchwork Tue Jul 30 19:27:07 2024
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 13747818
+Date: Tue, 30 Jul 2024 20:27:07 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: Rob Herring <robh@kernel.org>, Krzysztof Kozlowski <krzk+dt@kernel.org>,
+ Conor Dooley <conor+dt@kernel.org>, Jens Axboe <axboe@kernel.dk>,
+ Daniel Golle <daniel@makrotopia.org>, Christian Brauner <brauner@kernel.org>,
+ Al Viro <viro@zeniv.linux.org.uk>, Li Lingfeng <lilingfeng3@huawei.com>,
+ Ming Lei <ming.lei@redhat.com>, Christian Heusel <christian@heusel.eu>,
+	=?utf-8?b?UmFmYcWCIE1pxYJlY2tp?= <rafal@milecki.pl>,
+ Felix Fietkau <nbd@nbd.name>, John Crispin <john@phrozen.org>,
+ Chad Monroe <chad.monroe@adtran.com>, Yangyu Chen <cyy@cyyself.name>,
+ Tianling Shen <cnsztl@immortalwrt.org>, Chuanhong Guo <gch981213@gmail.com>,
+ Chen Minqiang <ptpt52@gmail.com>, devicetree@vger.kernel.org,
+ linux-kernel@vger.kernel.org, linux-block@vger.kernel.org
+Subject: [PATCH v5 4/4] block: add new genhd flag GENHD_FL_NVMEM
+Message-ID: 
+ <311ea569c23ce14e2896cd3b069dc494c58c49c2.1722365899.git.daniel@makrotopia.org>
+References: <cover.1722365899.git.daniel@makrotopia.org>
+Precedence: bulk
+X-Mailing-List: linux-block@vger.kernel.org
+List-Id: <linux-block.vger.kernel.org>
+List-Subscribe: <mailto:linux-block+subscribe@vger.kernel.org>
+List-Unsubscribe: <mailto:linux-block+unsubscribe@vger.kernel.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1722365899.git.daniel@makrotopia.org>
+
+Add new flag to destinguish block devices which may act as an NVMEM
+provider.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ include/linux/blkdev.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -82,11 +82,13 @@ struct partition_meta_info {
+  * ``GENHD_FL_NO_PART``: partition support is disabled.  The kernel will not
+  * scan for partitions from add_disk, and users can't add partitions manually.
+  *
++ * ``GENHD_FL_NVMEM``: the block device should be considered as NVMEM provider.
+  */
+ enum {
+ 	GENHD_FL_REMOVABLE			= 1 << 0,
+ 	GENHD_FL_HIDDEN				= 1 << 1,
+ 	GENHD_FL_NO_PART			= 1 << 2,
++	GENHD_FL_NVMEM				= 1 << 3,
+ };
+ 
+ enum {
diff --git a/6.12/target/linux/generic/pending-6.12/455-dt-bindings-mmc-mmc-card-add-block-device-nodes.patch b/6.12/target/linux/generic/pending-6.12/455-dt-bindings-mmc-mmc-card-add-block-device-nodes.patch
new file mode 100644
index 00000000..74e6c821
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/455-dt-bindings-mmc-mmc-card-add-block-device-nodes.patch
@@ -0,0 +1,74 @@
+From f7ec19b34d1b7e934a58ceb102369bbd30b2631d Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Thu, 30 May 2024 03:15:11 +0100
+Subject: [PATCH 6/9] dt-bindings: mmc: mmc-card: add block device nodes
+
+Add nodes representing the block devices exposed by an MMC device
+including an example involving nvmem-cells.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ .../devicetree/bindings/mmc/mmc-card.yaml     | 45 +++++++++++++++++++
+ 1 file changed, 45 insertions(+)
+
+--- a/Documentation/devicetree/bindings/mmc/mmc-card.yaml
++++ b/Documentation/devicetree/bindings/mmc/mmc-card.yaml
+@@ -26,6 +26,18 @@ properties:
+       Use this to indicate that the mmc-card has a broken hpi
+       implementation, and that hpi should not be used.
+ 
++  block:
++    $ref: /schemas/block/block-device.yaml#
++    description:
++      Represents the block storage provided by an SD card or the
++      main hardware partition of an eMMC.
++
++patternProperties:
++  '^boot[0-9]+':
++    $ref: /schemas/block/block-device.yaml#
++    description:
++      Represents a boot hardware partition on an eMMC.
++
+ required:
+   - compatible
+   - reg
+@@ -42,6 +54,39 @@ examples:
+             compatible = "mmc-card";
+             reg = <0>;
+             broken-hpi;
++
++            block {
++                partitions {
++                    cal_data: block-partition-rf {
++                        partnum = <3>;
++                        partname = "rf";
++
++                        nvmem-layout {
++                            compatible = "fixed-layout";
++                            #address-cells = <1>;
++                            #size-cells = <1>;
++
++                            eeprom@0 {
++                                reg = <0x0 0x1000>;
++                            };
++                        };
++                    };
++                };
++            };
++
++            boot1 {
++                nvmem-layout {
++                    compatible = "fixed-layout";
++                    #address-cells = <1>;
++                    #size-cells = <1>;
++
++                    macaddr: macaddr@a {
++                        compatible = "mac-base";
++                        reg = <0xa 0x6>;
++                        #nvmem-cell-cells = <1>;
++                    };
++                };
++            };
+         };
+     };
+ 
diff --git a/6.12/target/linux/generic/pending-6.12/456-mmc-core-set-card-fwnode_handle.patch b/6.12/target/linux/generic/pending-6.12/456-mmc-core-set-card-fwnode_handle.patch
new file mode 100644
index 00000000..85438df6
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/456-mmc-core-set-card-fwnode_handle.patch
@@ -0,0 +1,23 @@
+From 043c4f88476cc0f29c9bf82a8a516f58d848e1cd Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Thu, 30 May 2024 03:15:25 +0100
+Subject: [PATCH 7/9] mmc: core: set card fwnode_handle
+
+Set fwnode in case it isn't set yet and of_node is present.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/mmc/core/bus.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/mmc/core/bus.c
++++ b/drivers/mmc/core/bus.c
+@@ -368,6 +368,8 @@ int mmc_add_card(struct mmc_card *card)
+ 
+ 	mmc_add_card_debugfs(card);
+ 	card->dev.of_node = mmc_of_find_child_device(card->host, 0);
++	if (card->dev.of_node && !card->dev.fwnode)
++		card->dev.fwnode = &card->dev.of_node->fwnode;
+ 
+ 	device_enable_async_suspend(&card->dev);
+ 
diff --git a/6.12/target/linux/generic/pending-6.12/457-mmc-block-set-fwnode-of-disk-devices.patch b/6.12/target/linux/generic/pending-6.12/457-mmc-block-set-fwnode-of-disk-devices.patch
new file mode 100644
index 00000000..e37d15b1
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/457-mmc-block-set-fwnode-of-disk-devices.patch
@@ -0,0 +1,27 @@
+From ef3e38fec26901b71975d7e810a2df6b8bd54a8e Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Thu, 30 May 2024 03:15:36 +0100
+Subject: [PATCH 8/9] mmc: block: set fwnode of disk devices
+
+Set fwnode of disk devices to 'block', 'boot0' and 'boot1' subnodes of
+the mmc-card. This is done in preparation for having the eMMC act as
+NVMEM provider.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/mmc/core/block.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -2678,6 +2678,10 @@ static struct mmc_blk_data *mmc_blk_allo
+ 	if (area_type == MMC_BLK_DATA_AREA_MAIN)
+ 		dev_set_drvdata(&card->dev, md);
+ 	disk_fwnode = mmc_blk_get_partitions_node(parent, subname);
++	if (!disk_fwnode)
++		disk_fwnode = device_get_named_child_node(subname ? md->parent->parent :
++							  md->parent,
++							  subname ? subname : "block");
+ 	ret = add_disk_fwnode(md->parent, md->disk, mmc_disk_attr_groups,
+ 			      disk_fwnode);
+ 	if (ret)
diff --git a/6.12/target/linux/generic/pending-6.12/458-mmc-block-set-GENHD_FL_NVMEM.patch b/6.12/target/linux/generic/pending-6.12/458-mmc-block-set-GENHD_FL_NVMEM.patch
new file mode 100644
index 00000000..7ef0d019
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/458-mmc-block-set-GENHD_FL_NVMEM.patch
@@ -0,0 +1,22 @@
+From 7903b50441000365a6fe5badb39735889f562252 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Thu, 30 May 2024 03:15:46 +0100
+Subject: [PATCH 9/9] mmc: block: set GENHD_FL_NVMEM
+
+Set flag to consider MMC block devices as NVMEM providers.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/mmc/core/block.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -2644,6 +2644,7 @@ static struct mmc_blk_data *mmc_blk_allo
+ 	md->disk->major	= MMC_BLOCK_MAJOR;
+ 	md->disk->minors = perdev_minors;
+ 	md->disk->first_minor = devidx * perdev_minors;
++	md->disk->flags = GENHD_FL_NVMEM;
+ 	md->disk->fops = &mmc_bdops;
+ 	md->disk->private_data = md;
+ 	md->parent = parent;
diff --git a/6.12/target/linux/generic/pending-6.12/460-mtd-cfi_cmdset_0002-no-erase_suspend.patch b/6.12/target/linux/generic/pending-6.12/460-mtd-cfi_cmdset_0002-no-erase_suspend.patch
new file mode 100644
index 00000000..2435133f
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/460-mtd-cfi_cmdset_0002-no-erase_suspend.patch
@@ -0,0 +1,25 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: kernel: disable cfi cmdset 0002 erase suspend
+
+on some platforms, erase suspend leads to data corruption and lockups when write
+ops collide with erase ops. this has been observed on the buffalo wzr-hp-g300nh.
+rather than play whack-a-mole with a hard to reproduce issue on a variety of devices,
+simply disable erase suspend, as it will usually not produce any useful gain on
+the small filesystems used on embedded hardware.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ drivers/mtd/chips/cfi_cmdset_0002.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/chips/cfi_cmdset_0002.c
++++ b/drivers/mtd/chips/cfi_cmdset_0002.c
+@@ -906,7 +906,7 @@ static int get_chip(struct map_info *map
+ 		return 0;
+ 
+ 	case FL_ERASING:
+-		if (!cfip || !(cfip->EraseSuspend & (0x1|0x2)) ||
++		if (1 /* no suspend */ || !cfip || !(cfip->EraseSuspend & (0x1|0x2)) ||
+ 		    !(mode == FL_READY || mode == FL_POINT ||
+ 		    (mode == FL_WRITING && (cfip->EraseSuspend & 0x2))))
+ 			goto sleep;
diff --git a/6.12/target/linux/generic/pending-6.12/461-mtd-cfi_cmdset_0002-add-buffer-write-cmd-timeout.patch b/6.12/target/linux/generic/pending-6.12/461-mtd-cfi_cmdset_0002-add-buffer-write-cmd-timeout.patch
new file mode 100644
index 00000000..059d9673
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/461-mtd-cfi_cmdset_0002-add-buffer-write-cmd-timeout.patch
@@ -0,0 +1,17 @@
+From: George Kashperko <george@znau.edu.ua>
+Subject: Issue map read after Write Buffer Load command to ensure chip is ready to receive data.
+
+Signed-off-by: George Kashperko <george@znau.edu.ua>
+---
+ drivers/mtd/chips/cfi_cmdset_0002.c |    1 +
+ 1 file changed, 1 insertion(+)
+--- a/drivers/mtd/chips/cfi_cmdset_0002.c
++++ b/drivers/mtd/chips/cfi_cmdset_0002.c
+@@ -2050,6 +2050,7 @@ static int __xipram do_write_buffer(stru
+ 
+ 	/* Write Buffer Load */
+ 	map_write(map, CMD(0x25), cmd_adr);
++	(void) map_read(map, cmd_adr);
+ 
+ 	chip->state = FL_WRITING_TO_BUFFER;
+ 
diff --git a/6.12/target/linux/generic/pending-6.12/465-m25p80-mx-disable-software-protection.patch b/6.12/target/linux/generic/pending-6.12/465-m25p80-mx-disable-software-protection.patch
new file mode 100644
index 00000000..5667e273
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/465-m25p80-mx-disable-software-protection.patch
@@ -0,0 +1,18 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: Disable software protection bits for Macronix flashes.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ drivers/mtd/spi-nor/spi-nor.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mtd/spi-nor/macronix.c
++++ b/drivers/mtd/spi-nor/macronix.c
+@@ -194,6 +194,7 @@ static int macronix_nor_late_init(struct
+ {
+ 	if (!nor->params->set_4byte_addr_mode)
+ 		nor->params->set_4byte_addr_mode = spi_nor_set_4byte_addr_mode_en4b_ex4b;
++	nor->flags |= SNOR_F_HAS_LOCK;
+ 
+ 	return 0;
+ }
diff --git a/6.12/target/linux/generic/pending-6.12/476-mtd-spi-nor-add-eon-en25q128.patch b/6.12/target/linux/generic/pending-6.12/476-mtd-spi-nor-add-eon-en25q128.patch
new file mode 100644
index 00000000..afc5e489
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/476-mtd-spi-nor-add-eon-en25q128.patch
@@ -0,0 +1,22 @@
+From: Piotr Dymacz <pepe2k@gmail.com>
+Subject: kernel/mtd: add support for EON EN25Q128
+
+Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
+---
+ drivers/mtd/spi-nor/spi-nor.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mtd/spi-nor/eon.c
++++ b/drivers/mtd/spi-nor/eon.c
+@@ -18,6 +18,11 @@ static const struct flash_info eon_nor_p
+ 		.name = "en25p64",
+ 		.size = SZ_8M,
+ 	}, {
++		.id = SNOR_ID(0x1c, 0x30, 0x18),
++		.name = "en25q128",
++		.size = SZ_16M,
++		.no_sfdp_flags = SECT_4K,
++	}, {
+ 		.id = SNOR_ID(0x1c, 0x30, 0x14),
+ 		.name = "en25q80a",
+ 		.size = SZ_1M,
diff --git a/6.12/target/linux/generic/pending-6.12/477-mtd-spi-nor-add-eon-en25qx128a.patch b/6.12/target/linux/generic/pending-6.12/477-mtd-spi-nor-add-eon-en25qx128a.patch
new file mode 100644
index 00000000..4dd229bd
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/477-mtd-spi-nor-add-eon-en25qx128a.patch
@@ -0,0 +1,24 @@
+From: Christian Marangi <ansuelsmth@gmail.com>
+Subject: kernel/mtd: add support for EON EN25QX128A
+
+Add support for EON EN25QX128A with no flags as it does
+support SFDP parsing.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/mtd/spi-nor/spi-nor.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mtd/spi-nor/eon.c
++++ b/drivers/mtd/spi-nor/eon.c
+@@ -23,6 +23,10 @@ static const struct flash_info eon_nor_p
+ 		.size = SZ_16M,
+ 		.no_sfdp_flags = SECT_4K,
+ 	}, {
++		.id = SNOR_ID(0x1c, 0x71, 0x18),
++		.name = "en25qx128a",
++		.size = SZ_16M,
++	}, {
+ 		.id = SNOR_ID(0x1c, 0x30, 0x14),
+ 		.name = "en25q80a",
+ 		.size = SZ_1M,
diff --git a/6.12/target/linux/generic/pending-6.12/479-mtd-spi-nor-add-xtx-xt25f128b.patch b/6.12/target/linux/generic/pending-6.12/479-mtd-spi-nor-add-xtx-xt25f128b.patch
new file mode 100644
index 00000000..be8bafa7
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/479-mtd-spi-nor-add-xtx-xt25f128b.patch
@@ -0,0 +1,84 @@
+From patchwork Thu Feb  6 17:19:41 2020
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 1234465
+Date: Thu, 6 Feb 2020 19:19:41 +0200
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-mtd@lists.infradead.org
+Subject: [PATCH v2] mtd: spi-nor: Add support for xt25f128b chip
+Message-ID: <20200206171941.GA2398@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+List-Subscribe: <http://lists.infradead.org/mailman/listinfo/linux-mtd>,
+ <mailto:linux-mtd-request@lists.infradead.org?subject=subscribe>
+Cc: Eitan Cohen <eitan@neot-semadar.com>, Piotr Dymacz <pepe2k@gmail.com>,
+ Tudor Ambarus <tudor.ambarus@microchip.com>
+Sender: "linux-mtd" <linux-mtd-bounces@lists.infradead.org>
+Errors-To: linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org
+
+Add XT25F128B made by XTX Technology (Shenzhen) Limited.
+This chip supports dual and quad read and uniform 4K-byte erase.
+Verified on Teltonika RUT955 which comes with XT25F128B in recent
+versions of the device.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ drivers/mtd/spi-nor/spi-nor.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/mtd/spi-nor/Makefile
++++ b/drivers/mtd/spi-nor/Makefile
+@@ -14,6 +14,7 @@ spi-nor-objs			+= spansion.o
+ spi-nor-objs			+= sst.o
+ spi-nor-objs			+= winbond.o
+ spi-nor-objs			+= xmc.o
++spi-nor-objs			+= xtx.o
+ spi-nor-$(CONFIG_DEBUG_FS)	+= debugfs.o
+ obj-$(CONFIG_MTD_SPI_NOR)	+= spi-nor.o
+ 
+--- /dev/null
++++ b/drivers/mtd/spi-nor/xtx.c
+@@ -0,0 +1,20 @@
++// SPDX-License-Identifier: GPL-2.0
++#include <linux/mtd/spi-nor.h>
++
++#include "core.h"
++
++static const struct flash_info xtx_parts[] = {
++	/* XTX Technology (Shenzhen) Limited */
++	{
++		.id = SNOR_ID(0x0B, 0x40, 0x18),
++		.name = "xt25f128b",
++		.size = SZ_16M,
++		.no_sfdp_flags = SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ,
++	},
++};
++
++const struct spi_nor_manufacturer spi_nor_xtx = {
++	.name = "xtx",
++	.parts = xtx_parts,
++	.nparts = ARRAY_SIZE(xtx_parts),
++};
+--- a/drivers/mtd/spi-nor/core.c
++++ b/drivers/mtd/spi-nor/core.c
+@@ -1979,6 +1979,7 @@ static const struct spi_nor_manufacturer
+ 	&spi_nor_sst,
+ 	&spi_nor_winbond,
+ 	&spi_nor_xmc,
++	&spi_nor_xtx,
+ };
+ 
+ static const struct flash_info spi_nor_generic_flash = {
+--- a/drivers/mtd/spi-nor/core.h
++++ b/drivers/mtd/spi-nor/core.h
+@@ -593,6 +593,7 @@ extern const struct spi_nor_manufacturer
+ extern const struct spi_nor_manufacturer spi_nor_sst;
+ extern const struct spi_nor_manufacturer spi_nor_winbond;
+ extern const struct spi_nor_manufacturer spi_nor_xmc;
++extern const struct spi_nor_manufacturer spi_nor_xtx;
+ 
+ extern const struct attribute_group *spi_nor_sysfs_groups[];
+ 
diff --git a/6.12/target/linux/generic/pending-6.12/481-mtd-spi-nor-add-support-for-Gigadevice-GD25D05.patch b/6.12/target/linux/generic/pending-6.12/481-mtd-spi-nor-add-support-for-Gigadevice-GD25D05.patch
new file mode 100644
index 00000000..c4caf732
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/481-mtd-spi-nor-add-support-for-Gigadevice-GD25D05.patch
@@ -0,0 +1,25 @@
+From d68b4aa22e8c625685bfad642dd7337948dc0ad1 Mon Sep 17 00:00:00 2001
+From: Koen Vandeputte <koen.vandeputte@ncentric.com>
+Date: Mon, 6 Jan 2020 13:07:56 +0100
+Subject: [PATCH] mtd: spi-nor: add support for Gigadevice GD25D05
+
+Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
+---
+ drivers/mtd/spi-nor/spi-nor.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/mtd/spi-nor/gigadevice.c
++++ b/drivers/mtd/spi-nor/gigadevice.c
+@@ -35,6 +35,12 @@ static const struct spi_nor_fixups gd25q
+ 
+ static const struct flash_info gigadevice_nor_parts[] = {
+ 	{
++		.id = SNOR_ID(0xc8, 0x40, 0x10),
++		.name = "gd25q05",
++		.size = SZ_64K,
++		.flags = SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB,
++		.no_sfdp_flags = SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ,
++	}, {
+ 		.id = SNOR_ID(0xc8, 0x40, 0x15),
+ 		.name = "gd25q16",
+ 		.size = SZ_2M,
diff --git a/6.12/target/linux/generic/pending-6.12/482-mtd-spi-nor-add-gd25q512.patch b/6.12/target/linux/generic/pending-6.12/482-mtd-spi-nor-add-gd25q512.patch
new file mode 100644
index 00000000..2b34d145
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/482-mtd-spi-nor-add-gd25q512.patch
@@ -0,0 +1,25 @@
+From f8943df3beb0d3f9754bb35320c3a378727175a8 Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Thu, 14 Jul 2022 08:38:07 +0200
+Subject: [PATCH] spi-nor/gigadevic: add gd25q512
+
+---
+ drivers/mtd/spi-nor/gigadevice.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/mtd/spi-nor/gigadevice.c
++++ b/drivers/mtd/spi-nor/gigadevice.c
+@@ -71,6 +71,13 @@ static const struct flash_info gigadevic
+ 		.fixups = &gd25q256_fixups,
+ 		.fixup_flags = SPI_NOR_4B_OPCODES,
+ 	}, {
++		.id = SNOR_ID(0xc8, 0x40, 0x20),
++		.name = "gd25q512",
++		.size = SZ_64M,
++		.flags = SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB,
++		.no_sfdp_flags = SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ,
++		.fixup_flags = SPI_NOR_4B_OPCODES,
++	}, {
+ 		.id = SNOR_ID(0xc8, 0x60, 0x16),
+ 		.name = "gd25lq32",
+ 		.size = SZ_4M,
diff --git a/6.12/target/linux/generic/pending-6.12/484-mtd-spi-nor-add-esmt-f25l16pa.patch b/6.12/target/linux/generic/pending-6.12/484-mtd-spi-nor-add-esmt-f25l16pa.patch
new file mode 100644
index 00000000..1e296eed
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/484-mtd-spi-nor-add-esmt-f25l16pa.patch
@@ -0,0 +1,27 @@
+From 87363cc0e522de3294ea6ae10fb468d2a8d6fb2f Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Wed, 13 Jul 2022 12:17:21 +0200
+Subject: [PATCH] spi-nor/esmt.c: add esmt f25l16pa
+
+This fixes support for Dongwon T&I DW02-412H which uses F25L16PA(2S)
+flash.
+
+---
+ drivers/mtd/spi-nor/esmt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/mtd/spi-nor/esmt.c
++++ b/drivers/mtd/spi-nor/esmt.c
+@@ -10,6 +10,12 @@
+ 
+ static const struct flash_info esmt_nor_parts[] = {
+ 	{
++		.id = SNOR_ID(0x8c, 0x21, 0x15),
++		.name = "f25l16pa-2s",
++		.size = SZ_2M,
++		.flags = SPI_NOR_HAS_LOCK,
++		.no_sfdp_flags = SECT_4K,
++	}, {
+ 		.id = SNOR_ID(0x8c, 0x20, 0x16),
+ 		.name = "f25l32pa",
+ 		.size = SZ_4M,
diff --git a/6.12/target/linux/generic/pending-6.12/485-mtd-spi-nor-add-xmc-xm25qh128c.patch b/6.12/target/linux/generic/pending-6.12/485-mtd-spi-nor-add-xmc-xm25qh128c.patch
new file mode 100644
index 00000000..886d7558
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/485-mtd-spi-nor-add-xmc-xm25qh128c.patch
@@ -0,0 +1,27 @@
+From f6b33d850f7f12555df2fa0e3349b33427bf5890 Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Wed, 13 Jul 2022 12:19:01 +0200
+Subject: [PATCH] spi-nor/xmc.c: add xm25qh128c
+
+The XMC XM25QH128C is a 16MB SPI NOR chip. The patch is verified on
+Ruijie RG-EW3200GX PRO.
+Datasheet available at https://www.xmcwh.com/uploads/435/XM25QH128C.pdf
+
+---
+ drivers/mtd/spi-nor/xmc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/mtd/spi-nor/xmc.c
++++ b/drivers/mtd/spi-nor/xmc.c
+@@ -19,6 +19,11 @@ static const struct flash_info xmc_nor_p
+ 		.name = "XM25QH128A",
+ 		.size = SZ_16M,
+ 		.no_sfdp_flags = SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ,
++	}, {
++		.id = SNOR_ID(0x20, 0x40, 0x18),
++		.name = "XM25QH128C",
++		.size = SZ_16M,
++		.no_sfdp_flags = SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ,
+ 	},
+ };
+ 
diff --git a/6.12/target/linux/generic/pending-6.12/487-mtd-spinand-Add-support-for-Etron-EM73D044VCx.patch b/6.12/target/linux/generic/pending-6.12/487-mtd-spinand-Add-support-for-Etron-EM73D044VCx.patch
new file mode 100644
index 00000000..0eb45822
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/487-mtd-spinand-Add-support-for-Etron-EM73D044VCx.patch
@@ -0,0 +1,170 @@
+From f32085fc0b87049491b07e198d924d738a1a2834 Mon Sep 17 00:00:00 2001
+From: Daniel Danzberger <daniel@dd-wrt.com>
+Date: Wed, 3 Aug 2022 17:31:03 +0200
+Subject: [PATCH] mtd: spinand: Add support for Etron EM73D044VCx
+
+Airoha is a new ARM platform based on Cortex-A53 which has recently been
+merged into linux-next.
+
+Due to BootROM limitations on this platform, the Cortex-A53 can't run in
+Aarch64 mode and code must be compiled for 32-Bit ARM.
+
+This support is based mostly on those linux-next commits backported
+for kernel 5.15.
+
+Patches:
+1 - platform support = linux-next
+2 - clock driver = linux-next
+3 - gpio driver = linux-next
+4 - linux,usable-memory-range dts support = linux-next
+5 - mtd spinand driver
+6 - spi driver
+7 - pci driver (kconfig only, uses mediatek PCI) = linux-next
+
+Still missing:
+- Ethernet driver
+- Sysupgrade support
+
+A.t.m there exists one subtarget EN7523 with only one evaluation
+board.
+
+The initramfs can be run with the following commands from u-boot:
+-
+u-boot> setenv bootfile \
+	openwrt-airoha-airoha_en7523-evb-initramfs-kernel.bin
+u-boot> tftpboot
+u-boot> bootm 0x81800000
+-
+
+Submitted-by: Daniel Danzberger <daniel@dd-wrt.com>
+
+--- a/drivers/mtd/nand/spi/Makefile
++++ b/drivers/mtd/nand/spi/Makefile
+@@ -1,4 +1,4 @@
+ # SPDX-License-Identifier: GPL-2.0
+-spinand-objs := core.o alliancememory.o ato.o esmt.o foresee.o gigadevice.o macronix.o
+-spinand-objs += micron.o paragon.o toshiba.o winbond.o xtx.o
++spinand-objs := core.o alliancememory.o ato.o esmt.o etron.o foresee.o gigadevice.o
++spinand-objs += macronix.o micron.o paragon.o toshiba.o winbond.o xtx.o
+ obj-$(CONFIG_MTD_SPI_NAND) += spinand.o
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -1112,6 +1112,7 @@ static const struct spinand_manufacturer
+ 	&alliancememory_spinand_manufacturer,
+ 	&ato_spinand_manufacturer,
+ 	&esmt_c8_spinand_manufacturer,
++	&etron_spinand_manufacturer,
+ 	&foresee_spinand_manufacturer,
+ 	&gigadevice_spinand_manufacturer,
+ 	&macronix_spinand_manufacturer,
+--- /dev/null
++++ b/drivers/mtd/nand/spi/etron.c
+@@ -0,0 +1,98 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include <linux/device.h>
++#include <linux/kernel.h>
++#include <linux/mtd/spinand.h>
++
++#define SPINAND_MFR_ETRON			0xd5
++
++
++static SPINAND_OP_VARIANTS(read_cache_variants,
++		SPINAND_PAGE_READ_FROM_CACHE_QUADIO_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_X4_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_DUALIO_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_X2_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_OP(true, 0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_OP(false, 0, 1, NULL, 0));
++
++static SPINAND_OP_VARIANTS(write_cache_variants,
++		SPINAND_PROG_LOAD_X4(true, 0, NULL, 0),
++		SPINAND_PROG_LOAD(true, 0, NULL, 0));
++
++static SPINAND_OP_VARIANTS(update_cache_variants,
++		SPINAND_PROG_LOAD_X4(false, 0, NULL, 0),
++		SPINAND_PROG_LOAD(false, 0, NULL, 0));
++
++static int etron_ooblayout_ecc(struct mtd_info *mtd, int section,
++					struct mtd_oob_region *oobregion)
++{
++	if (section)
++		return -ERANGE;
++
++	oobregion->offset = 72;
++	oobregion->length = 56;
++
++	return 0;
++}
++
++static int etron_ooblayout_free(struct mtd_info *mtd, int section,
++			   struct mtd_oob_region *oobregion)
++{
++	if (section)
++		return -ERANGE;
++
++	oobregion->offset = 1;
++	oobregion->length = 71;
++
++	return 0;
++}
++
++static int etron_ecc_get_status(struct spinand_device *spinand, u8 status)
++{
++	switch (status & STATUS_ECC_MASK) {
++	case STATUS_ECC_NO_BITFLIPS:
++		return 0;
++
++	case STATUS_ECC_HAS_BITFLIPS:
++		/* Between 1-7 bitflips were corrected */
++		return 7;
++
++	case STATUS_ECC_MASK:
++		/* Maximum bitflips were corrected */
++		return 8;
++
++	case STATUS_ECC_UNCOR_ERROR:
++		return -EBADMSG;
++	}
++
++	return -EINVAL;
++}
++
++static const struct mtd_ooblayout_ops etron_ooblayout = {
++	.ecc = etron_ooblayout_ecc,
++	.free = etron_ooblayout_free,
++};
++
++static const struct spinand_info etron_spinand_table[] = {
++	SPINAND_INFO("EM73D044VCx",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_ADDR, 0x1f),
++		     // bpc, pagesize, oobsize, pagesperblock, bperlun, maxbadplun, ppl, lpt, #t
++		     NAND_MEMORG(1, 2048, 128, 64, 2048, 40, 1, 1, 1),
++		     NAND_ECCREQ(8, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&etron_ooblayout, etron_ecc_get_status)),
++};
++
++static const struct spinand_manufacturer_ops etron_spinand_manuf_ops = {
++};
++
++const struct spinand_manufacturer etron_spinand_manufacturer = {
++	.id = SPINAND_MFR_ETRON,
++	.name = "Etron",
++	.chips = etron_spinand_table,
++	.nchips = ARRAY_SIZE(etron_spinand_table),
++	.ops = &etron_spinand_manuf_ops,
++};
+--- a/include/linux/mtd/spinand.h
++++ b/include/linux/mtd/spinand.h
+@@ -263,6 +263,7 @@ struct spinand_manufacturer {
+ extern const struct spinand_manufacturer alliancememory_spinand_manufacturer;
+ extern const struct spinand_manufacturer ato_spinand_manufacturer;
+ extern const struct spinand_manufacturer esmt_c8_spinand_manufacturer;
++extern const struct spinand_manufacturer etron_spinand_manufacturer;
+ extern const struct spinand_manufacturer foresee_spinand_manufacturer;
+ extern const struct spinand_manufacturer gigadevice_spinand_manufacturer;
+ extern const struct spinand_manufacturer macronix_spinand_manufacturer;
diff --git a/6.12/target/linux/generic/pending-6.12/488-mtd-spi-nor-add-xmc-xm25qh64c.patch b/6.12/target/linux/generic/pending-6.12/488-mtd-spi-nor-add-xmc-xm25qh64c.patch
new file mode 100644
index 00000000..6e65c55b
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/488-mtd-spi-nor-add-xmc-xm25qh64c.patch
@@ -0,0 +1,25 @@
+From: Joe Mullally <jwmullally@gmail.com>
+Subject: mtd/spi-nor/xmc: add support for XMC XM25QH64C
+
+The XMC XM25QH64C is a 8MB SPI NOR chip. The patch is verified on TL-WPA8631P v3.
+Datasheet available at https://www.xmcwh.com/uploads/442/XM25QH64C.pdf
+
+Signed-off-by: Joe Mullally <jwmullally@gmail.com>
+---
+ drivers/mtd/spi-nor/xmc.c                             | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/mtd/spi-nor/xmc.c
++++ b/drivers/mtd/spi-nor/xmc.c
+@@ -15,6 +15,11 @@ static const struct flash_info xmc_nor_p
+ 		.size = SZ_8M,
+ 		.no_sfdp_flags = SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ,
+ 	}, {
++		.id = SNOR_ID(0x20, 0x40, 0x17),
++		.name = "XM25QH64C",
++		.size = SZ_8M,
++		.no_sfdp_flags = SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ,
++	}, {
+ 		.id = SNOR_ID(0x20, 0x70, 0x18),
+ 		.name = "XM25QH128A",
+ 		.size = SZ_16M,
diff --git a/6.12/target/linux/generic/pending-6.12/490-ubi-auto-attach-mtd-device-named-ubi-or-data-on-boot.patch b/6.12/target/linux/generic/pending-6.12/490-ubi-auto-attach-mtd-device-named-ubi-or-data-on-boot.patch
new file mode 100644
index 00000000..27b86111
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/490-ubi-auto-attach-mtd-device-named-ubi-or-data-on-boot.patch
@@ -0,0 +1,104 @@
+From: Daniel Golle <daniel@makrotopia.org>
+Subject: ubi: auto-attach mtd device named "ubi" or "data" on boot
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/mtd/ubi/build.c | 36 ++++++++++++++++++++++++++++++++++++
+ 1 file changed, 36 insertions(+)
+
+--- a/drivers/mtd/ubi/build.c
++++ b/drivers/mtd/ubi/build.c
+@@ -1263,6 +1263,80 @@ static struct mtd_notifier ubi_mtd_notif
+ 	.remove = ubi_notify_remove,
+ };
+ 
++
++/*
++ * This function tries attaching mtd partitions named either "ubi" or "data"
++ * during boot.
++ */
++static void __init ubi_auto_attach(void)
++{
++	int err;
++	struct mtd_info *mtd;
++	struct device_node *np;
++	loff_t offset = 0;
++	size_t len;
++	char magic[4];
++
++	/* try attaching mtd device named "ubi" or "data" */
++	mtd = open_mtd_device("ubi");
++	if (IS_ERR(mtd))
++		mtd = open_mtd_device("data");
++
++	if (IS_ERR(mtd))
++		return;
++
++	/* skip "linux,ubi" mtd as it has already been attached */
++	np = mtd_get_of_node(mtd);
++	if (of_device_is_compatible(np, "linux,ubi"))
++		goto cleanup;
++
++	/* get the first not bad block */
++	if (mtd_can_have_bb(mtd))
++		while (mtd_block_isbad(mtd, offset)) {
++			offset += mtd->erasesize;
++
++			if (offset > mtd->size) {
++				pr_err("UBI error: Failed to find a non-bad "
++				       "block on mtd%d\n", mtd->index);
++				goto cleanup;
++			}
++		}
++
++	/* check if the read from flash was successful */
++	err = mtd_read(mtd, offset, 4, &len, (void *) magic);
++	if ((err && !mtd_is_bitflip(err)) || len != 4) {
++		pr_err("UBI error: unable to read from mtd%d\n", mtd->index);
++		goto cleanup;
++	}
++
++	/* check for a valid ubi magic */
++	if (strncmp(magic, "UBI#", 4)) {
++		pr_err("UBI error: no valid UBI magic found inside mtd%d\n", mtd->index);
++		goto cleanup;
++	}
++
++	/* don't auto-add media types where UBI doesn't makes sense */
++	if (mtd->type != MTD_NANDFLASH &&
++	    mtd->type != MTD_NORFLASH &&
++	    mtd->type != MTD_DATAFLASH &&
++	    mtd->type != MTD_MLCNANDFLASH)
++		goto cleanup;
++
++	mutex_lock(&ubi_devices_mutex);
++	pr_notice("UBI: auto-attach mtd%d\n", mtd->index);
++	err = ubi_attach_mtd_dev(mtd, UBI_DEV_NUM_AUTO, 0, 0, false, false);
++	mutex_unlock(&ubi_devices_mutex);
++	if (err < 0) {
++		pr_err("UBI error: cannot attach mtd%d\n", mtd->index);
++		goto cleanup;
++	}
++
++	return;
++
++cleanup:
++	put_mtd_device(mtd);
++}
++
+ static int __init ubi_init_attach(void)
+ {
+ 	int err, i, k;
+@@ -1314,6 +1388,12 @@ static int __init ubi_init_attach(void)
+ 		}
+ 	}
+ 
++	/* auto-attach mtd devices only if built-in to the kernel and no ubi.mtd
++	 * parameter was given */
++	if (IS_ENABLED(CONFIG_MTD_ROOTFS_ROOT_DEV) &&
++	    !ubi_is_module() && !mtd_devs)
++		ubi_auto_attach();
++
+ 	return 0;
+ 
+ out_detach:
diff --git a/6.12/target/linux/generic/pending-6.12/491-ubi-auto-create-ubiblock-device-for-rootfs.patch b/6.12/target/linux/generic/pending-6.12/491-ubi-auto-create-ubiblock-device-for-rootfs.patch
new file mode 100644
index 00000000..44c3bf36
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/491-ubi-auto-create-ubiblock-device-for-rootfs.patch
@@ -0,0 +1,77 @@
+From: Daniel Golle <daniel@makrotopia.org>
+Subject: ubi: auto-create ubiblock device for rootfs
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/mtd/ubi/block.c | 42 ++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 42 insertions(+)
+
+--- a/drivers/mtd/ubi/block.c
++++ b/drivers/mtd/ubi/block.c
+@@ -575,10 +575,47 @@ match_volume_desc(struct ubi_volume_info
+ 	return true;
+ }
+ 
++#define UBIFS_NODE_MAGIC  0x06101831
++static inline int ubi_vol_is_ubifs(struct ubi_volume_desc *desc)
++{
++	int ret;
++	uint32_t magic_of, magic;
++	ret = ubi_read(desc, 0, (char *)&magic_of, 0, 4);
++	if (ret)
++		return 0;
++	magic = le32_to_cpu(magic_of);
++	return magic == UBIFS_NODE_MAGIC;
++}
++
++static void ubiblock_create_auto_rootfs(struct ubi_volume_info *vi)
++{
++	int ret, is_ubifs;
++	struct ubi_volume_desc *desc;
++
++	if (strcmp(vi->name, "rootfs") &&
++	    strcmp(vi->name, "fit"))
++		return;
++
++	desc = ubi_open_volume(vi->ubi_num, vi->vol_id, UBI_READONLY);
++	if (IS_ERR(desc))
++		return;
++
++	is_ubifs = ubi_vol_is_ubifs(desc);
++	ubi_close_volume(desc);
++	if (is_ubifs)
++		return;
++
++	ret = ubiblock_create(vi);
++	if (ret)
++		pr_err("UBI error: block: can't add '%s' volume, err=%d\n",
++			vi->name, ret);
++}
++
+ static void
+ ubiblock_create_from_param(struct ubi_volume_info *vi)
+ {
+ 	int i, ret = 0;
++	bool got_param = false;
+ 	struct ubiblock_param *p;
+ 
+ 	/*
+@@ -591,6 +628,7 @@ ubiblock_create_from_param(struct ubi_vo
+ 		if (!match_volume_desc(vi, p->name, p->ubi_num, p->vol_id))
+ 			continue;
+ 
++		got_param = true;
+ 		ret = ubiblock_create(vi);
+ 		if (ret) {
+ 			pr_err(
+@@ -599,6 +637,10 @@ ubiblock_create_from_param(struct ubi_vo
+ 		}
+ 		break;
+ 	}
++
++	/* auto-attach "rootfs" volume if existing and non-ubifs */
++	if (!got_param && IS_ENABLED(CONFIG_MTD_ROOTFS_ROOT_DEV))
++		ubiblock_create_auto_rootfs(vi);
+ }
+ 
+ static int ubiblock_notify(struct notifier_block *nb,
diff --git a/6.12/target/linux/generic/pending-6.12/492-try-auto-mounting-ubi0-rootfs-in-init-do_mounts.c.patch b/6.12/target/linux/generic/pending-6.12/492-try-auto-mounting-ubi0-rootfs-in-init-do_mounts.c.patch
new file mode 100644
index 00000000..7a4c6334
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/492-try-auto-mounting-ubi0-rootfs-in-init-do_mounts.c.patch
@@ -0,0 +1,54 @@
+From: Daniel Golle <daniel@makrotopia.org>
+Subject: try auto-mounting ubi0:rootfs in init/do_mounts.c
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ init/do_mounts.c | 26 +++++++++++++++++++++++++-
+ 1 file changed, 25 insertions(+), 1 deletion(-)
+
+--- a/init/do_mounts.c
++++ b/init/do_mounts.c
+@@ -250,7 +250,30 @@ retry:
+ out:
+ 	put_page(page);
+ }
+- 
++
++#ifdef CONFIG_MTD_ROOTFS_ROOT_DEV
++static int __init mount_ubi_rootfs(void)
++{
++	int flags = MS_SILENT;
++	int err, tried = 0;
++
++	while (tried < 2) {
++		err = do_mount_root("ubi0:rootfs", "ubifs", flags, \
++					root_mount_data);
++		switch (err) {
++			case -EACCES:
++				flags |= MS_RDONLY;
++				tried++;
++				break;
++			default:
++				return err;
++		}
++	}
++
++	return -EINVAL;
++}
++#endif
++
+ #ifdef CONFIG_ROOT_NFS
+ 
+ #define NFSROOT_TIMEOUT_MIN	5
+@@ -387,6 +410,11 @@ static inline void mount_block_root(char
+ 
+ void __init mount_root(char *root_device_name)
+ {
++#ifdef CONFIG_MTD_ROOTFS_ROOT_DEV
++	if (!mount_ubi_rootfs())
++		return;
++#endif
++
+ 	switch (ROOT_DEV) {
+ 	case Root_NFS:
+ 		mount_nfs_root();
diff --git a/6.12/target/linux/generic/pending-6.12/493-ubi-set-ROOT_DEV-to-ubiblock-rootfs-if-unset.patch b/6.12/target/linux/generic/pending-6.12/493-ubi-set-ROOT_DEV-to-ubiblock-rootfs-if-unset.patch
new file mode 100644
index 00000000..4007c8a8
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/493-ubi-set-ROOT_DEV-to-ubiblock-rootfs-if-unset.patch
@@ -0,0 +1,34 @@
+From: Daniel Golle <daniel@makrotopia.org>
+Subject: ubi: set ROOT_DEV to ubiblock "rootfs" if unset
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/mtd/ubi/block.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/mtd/ubi/block.c
++++ b/drivers/mtd/ubi/block.c
+@@ -41,6 +41,7 @@
+ #include <linux/scatterlist.h>
+ #include <linux/idr.h>
+ #include <asm/div64.h>
++#include <linux/root_dev.h>
+ 
+ #include "ubi-media.h"
+ #include "ubi.h"
+@@ -431,6 +432,15 @@ int ubiblock_create(struct ubi_volume_in
+ 	dev_info(disk_to_dev(dev->gd), "created from ubi%d:%d(%s)",
+ 		 dev->ubi_num, dev->vol_id, vi->name);
+ 	mutex_unlock(&devices_mutex);
++
++	if (!strcmp(vi->name, "rootfs") &&
++	    IS_ENABLED(CONFIG_MTD_ROOTFS_ROOT_DEV) &&
++	    ROOT_DEV == 0) {
++		pr_notice("ubiblock: device ubiblock%d_%d (%s) set to be root filesystem\n",
++			  dev->ubi_num, dev->vol_id, vi->name);
++		ROOT_DEV = MKDEV(gd->major, gd->first_minor);
++	}
++
+ 	return 0;
+ 
+ out_remove_minor:
diff --git a/6.12/target/linux/generic/pending-6.12/494-mtd-ubi-add-EOF-marker-support.patch b/6.12/target/linux/generic/pending-6.12/494-mtd-ubi-add-EOF-marker-support.patch
new file mode 100644
index 00000000..41343175
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/494-mtd-ubi-add-EOF-marker-support.patch
@@ -0,0 +1,60 @@
+From: Gabor Juhos <juhosg@openwrt.org>
+Subject: mtd: add EOF marker support to the UBI layer
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/mtd/ubi/attach.c | 25 ++++++++++++++++++++++---
+ drivers/mtd/ubi/ubi.h    |  1 +
+ 2 files changed, 23 insertions(+), 3 deletions(-)
+
+--- a/drivers/mtd/ubi/attach.c
++++ b/drivers/mtd/ubi/attach.c
+@@ -926,6 +926,13 @@ static bool vol_ignored(int vol_id)
+ #endif
+ }
+ 
++static bool ec_hdr_has_eof(struct ubi_ec_hdr *ech)
++{
++	return ech->padding1[0] == 'E' &&
++	       ech->padding1[1] == 'O' &&
++	       ech->padding1[2] == 'F';
++}
++
+ /**
+  * scan_peb - scan and process UBI headers of a PEB.
+  * @ubi: UBI device description object
+@@ -958,9 +965,21 @@ static int scan_peb(struct ubi_device *u
+ 		return 0;
+ 	}
+ 
+-	err = ubi_io_read_ec_hdr(ubi, pnum, ech, 0);
+-	if (err < 0)
+-		return err;
++	if (!ai->eof_found) {
++		err = ubi_io_read_ec_hdr(ubi, pnum, ech, 0);
++		if (err < 0)
++			return err;
++
++		if (ec_hdr_has_eof(ech)) {
++			pr_notice("UBI: EOF marker found, PEBs from %d will be erased\n",
++				pnum);
++			ai->eof_found = true;
++		}
++	}
++
++	if (ai->eof_found)
++		err = UBI_IO_FF_BITFLIPS;
++
+ 	switch (err) {
+ 	case 0:
+ 		break;
+--- a/drivers/mtd/ubi/ubi.h
++++ b/drivers/mtd/ubi/ubi.h
+@@ -778,6 +778,7 @@ struct ubi_attach_info {
+ 	int mean_ec;
+ 	uint64_t ec_sum;
+ 	int ec_count;
++	bool eof_found;
+ 	struct kmem_cache *aeb_slab_cache;
+ 	struct ubi_ec_hdr *ech;
+ 	struct ubi_vid_io_buf *vidb;
diff --git a/6.12/target/linux/generic/pending-6.12/496-dt-bindings-add-bindings-for-mtd-concat-devices.patch b/6.12/target/linux/generic/pending-6.12/496-dt-bindings-add-bindings-for-mtd-concat-devices.patch
new file mode 100644
index 00000000..01f3b9ec
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/496-dt-bindings-add-bindings-for-mtd-concat-devices.patch
@@ -0,0 +1,52 @@
+From 5734c6669fba7ddb5ef491ccff7159d15dba0b59 Mon Sep 17 00:00:00 2001
+From: Bernhard Frauendienst <kernel@nospam.obeliks.de>
+Date: Wed, 5 Sep 2018 01:32:51 +0200
+Subject: [PATCH 496/497] dt-bindings: add bindings for mtd-concat devices
+
+Document virtual mtd-concat device bindings.
+
+Signed-off-by: Bernhard Frauendienst <kernel@nospam.obeliks.de>
+---
+ .../devicetree/bindings/mtd/mtd-concat.txt    | 36 +++++++++++++++++++
+ 1 file changed, 36 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/mtd/mtd-concat.txt
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/mtd/mtd-concat.txt
+@@ -0,0 +1,36 @@
++Virtual MTD concat device
++
++Requires properties:
++- devices: list of phandles to mtd nodes that should be concatenated
++
++Example:
++
++&spi {
++	flash0: flash@0 {
++		...
++	};
++	flash1: flash@1 {
++		...
++	};
++};
++
++flash {
++	compatible = "mtd-concat";
++
++	devices = <&flash0 &flash1>;
++
++	partitions {
++		compatible = "fixed-partitions";
++
++		partition@0 {
++			label = "boot";
++			reg = <0x0000000 0x0040000>;
++			read-only;
++		};
++
++		partition@40000 {
++			label = "firmware";
++			reg = <0x0040000 0x1fc0000>;
++		};
++	}
++}
diff --git a/6.12/target/linux/generic/pending-6.12/497-mtd-mtdconcat-add-dt-driver-for-concat-devices.patch b/6.12/target/linux/generic/pending-6.12/497-mtd-mtdconcat-add-dt-driver-for-concat-devices.patch
new file mode 100644
index 00000000..3d5f5768
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/497-mtd-mtdconcat-add-dt-driver-for-concat-devices.patch
@@ -0,0 +1,215 @@
+From e53f712d8eac71f54399b61038ccf87d2cee99d7 Mon Sep 17 00:00:00 2001
+From: Bernhard Frauendienst <kernel@nospam.obeliks.de>
+Date: Sat, 25 Aug 2018 12:35:22 +0200
+Subject: [PATCH 497/497] mtd: mtdconcat: add dt driver for concat devices
+
+Some mtd drivers like physmap variants have support for concatenating
+multiple mtd devices, but there is no generic way to define such a
+concat device from within the device tree.
+
+This is useful for some SoC boards that use multiple flash chips as
+memory banks of a single mtd device, with partitions spanning chip
+borders.
+
+This commit adds a driver for creating virtual mtd-concat devices. They
+must have a compatible = "mtd-concat" line, and define a list of devices
+to concat in the 'devices' property, for example:
+
+flash {
+  compatible = "mtd-concat";
+
+  devices = <&flash0 &flash1>;
+
+  partitions {
+    ...
+  };
+};
+
+The driver is added to the very end of the mtd Makefile to increase the
+likelyhood of all child devices already being loaded at the time of
+probing, preventing unnecessary deferred probes.
+
+Signed-off-by: Bernhard Frauendienst <kernel@nospam.obeliks.de>
+---
+ drivers/mtd/Kconfig                 |   2 +
+ drivers/mtd/Makefile                |   3 +
+ drivers/mtd/composite/Kconfig       |  12 +++
+ drivers/mtd/composite/Makefile      |   6 ++
+ drivers/mtd/composite/virt_concat.c | 128 ++++++++++++++++++++++++++++
+ 5 files changed, 151 insertions(+)
+ create mode 100644 drivers/mtd/composite/Kconfig
+ create mode 100644 drivers/mtd/composite/Makefile
+ create mode 100644 drivers/mtd/composite/virt_concat.c
+
+--- a/drivers/mtd/Kconfig
++++ b/drivers/mtd/Kconfig
+@@ -241,4 +241,6 @@ source "drivers/mtd/ubi/Kconfig"
+ 
+ source "drivers/mtd/hyperbus/Kconfig"
+ 
++source "drivers/mtd/composite/Kconfig"
++
+ endif # MTD
+--- a/drivers/mtd/Makefile
++++ b/drivers/mtd/Makefile
+@@ -33,3 +33,6 @@ obj-y		+= chips/ lpddr/ maps/ devices/ n
+ obj-$(CONFIG_MTD_SPI_NOR)	+= spi-nor/
+ obj-$(CONFIG_MTD_UBI)		+= ubi/
+ obj-$(CONFIG_MTD_HYPERBUS)	+= hyperbus/
++
++# Composite drivers must be loaded last
++obj-y				+= composite/
+--- /dev/null
++++ b/drivers/mtd/composite/Kconfig
+@@ -0,0 +1,12 @@
++menu "Composite MTD device drivers"
++	depends on MTD!=n
++
++config MTD_VIRT_CONCAT
++	tristate "Virtual concat MTD device"
++	help
++	  This driver allows creation of a virtual MTD concat device, which
++	  concatenates multiple underlying MTD devices to a single device.
++	  This is required by some SoC boards where multiple memory banks are
++	  used as one device with partitions spanning across device boundaries.
++
++endmenu
+--- /dev/null
++++ b/drivers/mtd/composite/Makefile
+@@ -0,0 +1,6 @@
++# SPDX-License-Identifier: GPL-2.0
++#
++# linux/drivers/mtd/composite/Makefile
++#
++
++obj-$(CONFIG_MTD_VIRT_CONCAT)   += virt_concat.o
+--- /dev/null
++++ b/drivers/mtd/composite/virt_concat.c
+@@ -0,0 +1,127 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Virtual concat MTD device driver
++ *
++ * Copyright (C) 2018 Bernhard Frauendienst
++ * Author: Bernhard Frauendienst, kernel@nospam.obeliks.de
++ */
++
++#include <linux/platform_device.h>
++#include <linux/module.h>
++#include <linux/device.h>
++#include <linux/mtd/concat.h>
++#include <linux/mtd/mtd.h>
++#include <linux/mtd/partitions.h>
++#include <linux/of.h>
++#include <linux/of_platform.h>
++#include <linux/slab.h>
++
++/*
++ * struct of_virt_concat - platform device driver data.
++ * @cmtd the final mtd_concat device
++ * @num_devices the number of devices in @devices
++ * @devices points to an array of devices already loaded
++ */
++struct of_virt_concat {
++	struct mtd_info	*cmtd;
++	int num_devices;
++	struct mtd_info	**devices;
++};
++
++static void virt_concat_remove(struct platform_device *pdev)
++{
++	struct of_virt_concat *info;
++	int i;
++
++	info = platform_get_drvdata(pdev);
++	if (!info)
++		return;
++
++	// unset data for when this is called after a probe error
++	platform_set_drvdata(pdev, NULL);
++
++	if (info->cmtd) {
++		mtd_device_unregister(info->cmtd);
++		mtd_concat_destroy(info->cmtd);
++	}
++
++	if (info->devices) {
++		for (i = 0; i < info->num_devices; i++)
++			put_mtd_device(info->devices[i]);
++	}
++}
++
++static int virt_concat_probe(struct platform_device *pdev)
++{
++	struct device_node *node = pdev->dev.of_node;
++	struct of_phandle_iterator it;
++	struct of_virt_concat *info;
++	struct mtd_info *mtd;
++	int err = 0, count;
++
++	count = of_count_phandle_with_args(node, "devices", NULL);
++	if (count <= 0)
++		return -EINVAL;
++
++	info = devm_kzalloc(&pdev->dev, sizeof(*info), GFP_KERNEL);
++	if (!info)
++		return -ENOMEM;
++	info->devices = devm_kcalloc(&pdev->dev, count,
++				     sizeof(*(info->devices)), GFP_KERNEL);
++	if (!info->devices) {
++		err = -ENOMEM;
++		goto err_remove;
++	}
++
++	platform_set_drvdata(pdev, info);
++
++	of_for_each_phandle(&it, err, node, "devices", NULL, 0) {
++		mtd = of_get_mtd_device_by_node(it.node);
++		if (IS_ERR(mtd)) {
++			of_node_put(it.node);
++			err = -EPROBE_DEFER;
++			goto err_remove;
++		}
++
++		info->devices[info->num_devices++] = mtd;
++	}
++
++	info->cmtd = mtd_concat_create(info->devices, info->num_devices,
++				       dev_name(&pdev->dev));
++	if (!info->cmtd) {
++		err = -ENXIO;
++		goto err_remove;
++	}
++
++	info->cmtd->dev.parent = &pdev->dev;
++	mtd_set_of_node(info->cmtd, node);
++	mtd_device_register(info->cmtd, NULL, 0);
++
++	return 0;
++
++err_remove:
++	virt_concat_remove(pdev);
++
++	return err;
++}
++
++static const struct of_device_id virt_concat_of_match[] = {
++	{ .compatible = "mtd-concat", },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, virt_concat_of_match);
++
++static struct platform_driver virt_concat_driver = {
++	.probe = virt_concat_probe,
++	.remove = virt_concat_remove,
++	.driver	 = {
++		.name   = "virt-mtdconcat",
++		.of_match_table = virt_concat_of_match,
++	},
++};
++
++module_platform_driver(virt_concat_driver);
++
++MODULE_LICENSE("GPL v2");
++MODULE_AUTHOR("Bernhard Frauendienst <kernel@nospam.obeliks.de>");
++MODULE_DESCRIPTION("Virtual concat MTD device driver");
diff --git a/6.12/target/linux/generic/pending-6.12/498-mtd-spi-nor-locking-support-for-MX25L6405D.patch b/6.12/target/linux/generic/pending-6.12/498-mtd-spi-nor-locking-support-for-MX25L6405D.patch
new file mode 100644
index 00000000..0cf5b02d
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/498-mtd-spi-nor-locking-support-for-MX25L6405D.patch
@@ -0,0 +1,32 @@
+From 8bf2ce6ea4ee840b70f55a27f80e1cd308051b13 Mon Sep 17 00:00:00 2001
+From: Nick Hainke <vincent@systemli.org>
+Date: Mon, 27 Dec 2021 00:38:13 +0100
+Subject: [PATCH 1/2] mtd: spi-nor: locking support for MX25L6405D
+
+Macronix MX25L6405D supports locking with four block-protection bits.
+Currently, the driver only sets three bits.  If the bootloader does not
+sustain the flash chip in an unlocked state, the flash might be
+non-writeable. Add the corresponding flag to enable locking support with
+four bits in the status register.
+
+Tested on Nanostation M2 XM.
+
+Similar to commit 7ea40b54e83b ("mtd: spi-nor: enable locking support for
+MX25L12805D")
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+Signed-off-by: Nick Hainke <vincent@systemli.org>
+---
+ drivers/mtd/spi-nor/macronix.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/spi-nor/macronix.c
++++ b/drivers/mtd/spi-nor/macronix.c
+@@ -66,6 +66,7 @@ static const struct flash_info macronix_
+ 		.id = SNOR_ID(0xc2, 0x20, 0x17),
+ 		.name = "mx25l6405d",
+ 		.size = SZ_8M,
++		.flags = SPI_NOR_HAS_LOCK | SPI_NOR_4BIT_BP,
+ 		.no_sfdp_flags = SECT_4K,
+ 	}, {
+ 		.id = SNOR_ID(0xc2, 0x20, 0x18),
diff --git a/6.12/target/linux/generic/pending-6.12/499-mtd-spi-nor-disable-16-bit-sr-for-macronix.patch b/6.12/target/linux/generic/pending-6.12/499-mtd-spi-nor-disable-16-bit-sr-for-macronix.patch
new file mode 100644
index 00000000..5e20ef32
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/499-mtd-spi-nor-disable-16-bit-sr-for-macronix.patch
@@ -0,0 +1,30 @@
+From 245224608b5368c10407da07557e546743d3c489 Mon Sep 17 00:00:00 2001
+From: Nick Hainke <vincent@systemli.org>
+Date: Mon, 27 Dec 2021 09:33:13 +0100
+Subject: [PATCH 2/2] mtd: spi-nor: disable 16-bit-sr for macronix
+
+Macronix flash chips seem to consist of only one status register.
+These chips will not work with the "16-bit Write Status (01h) Command".
+Disable SNOR_F_HAS_16BIT_SR for all Macronix chips.
+
+Tested with MX25L6405D.
+
+Fixes: 39d1e3340c73 ("mtd: spi-nor: Fix clearing of QE bit on
+lock()/unlock()")
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+Signed-off-by: Nick Hainke <vincent@systemli.org>
+---
+ drivers/mtd/spi-nor/macronix.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mtd/spi-nor/macronix.c
++++ b/drivers/mtd/spi-nor/macronix.c
+@@ -195,6 +195,7 @@ static int macronix_nor_late_init(struct
+ {
+ 	if (!nor->params->set_4byte_addr_mode)
+ 		nor->params->set_4byte_addr_mode = spi_nor_set_4byte_addr_mode_en4b_ex4b;
++	nor->flags &= ~SNOR_F_HAS_16BIT_SR;
+ 	nor->flags |= SNOR_F_HAS_LOCK;
+ 
+ 	return 0;
diff --git a/6.12/target/linux/generic/pending-6.12/500-fs_cdrom_dependencies.patch b/6.12/target/linux/generic/pending-6.12/500-fs_cdrom_dependencies.patch
new file mode 100644
index 00000000..7c143584
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/500-fs_cdrom_dependencies.patch
@@ -0,0 +1,52 @@
+From af7b91bcecce0eae24e90acd35d96ecee73e1407 Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Wed, 13 Jul 2022 12:21:15 +0200
+Subject: [PATCH] fs: add cdrom dependency
+
+---
+ fs/hfs/Kconfig     | 1 +
+ fs/hfsplus/Kconfig | 1 +
+ fs/isofs/Kconfig   | 1 +
+ fs/udf/Kconfig     | 1 +
+ 4 files changed, 4 insertions(+)
+
+--- a/fs/hfs/Kconfig
++++ b/fs/hfs/Kconfig
+@@ -2,6 +2,7 @@
+ config HFS_FS
+ 	tristate "Apple Macintosh file system support"
+ 	depends on BLOCK
++	select CDROM
+ 	select BUFFER_HEAD
+ 	select NLS
+ 	select LEGACY_DIRECT_IO
+--- a/fs/hfsplus/Kconfig
++++ b/fs/hfsplus/Kconfig
+@@ -2,6 +2,7 @@
+ config HFSPLUS_FS
+ 	tristate "Apple Extended HFS file system support"
+ 	depends on BLOCK
++	select CDROM
+ 	select BUFFER_HEAD
+ 	select NLS
+ 	select NLS_UTF8
+--- a/fs/isofs/Kconfig
++++ b/fs/isofs/Kconfig
+@@ -1,6 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+ config ISO9660_FS
+ 	tristate "ISO 9660 CDROM file system support"
++	select CDROM
+ 	select BUFFER_HEAD
+ 	help
+ 	  This is the standard file system used on CD-ROMs.  It was previously
+--- a/fs/udf/Kconfig
++++ b/fs/udf/Kconfig
+@@ -1,6 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+ config UDF_FS
+ 	tristate "UDF file system support"
++	select CDROM
+ 	select BUFFER_HEAD
+ 	select CRC_ITU_T
+ 	select NLS
diff --git a/6.12/target/linux/generic/pending-6.12/511-init-bypass-device-lookup-for-dev-fit-rootfs.patch b/6.12/target/linux/generic/pending-6.12/511-init-bypass-device-lookup-for-dev-fit-rootfs.patch
new file mode 100644
index 00000000..b3d8d7dd
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/511-init-bypass-device-lookup-for-dev-fit-rootfs.patch
@@ -0,0 +1,25 @@
+From 5ede3f8aed9a1a579bf7304142600d1f3500add9 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 12 Jun 2023 03:58:42 +0100
+Subject: [PATCH 2/2] init: bypass device lookup for /dev/fit* rootfs
+
+Allow 'rootwait' as /dev/fit* can show up late if the underlaying
+device is probed late.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ init/do_mounts.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/init/do_mounts.c
++++ b/init/do_mounts.c
+@@ -465,7 +465,8 @@ static dev_t __init parse_root_device(ch
+ 	int error;
+ 	dev_t dev;
+ 
+-	if (!strncmp(root_device_name, "mtd", 3) ||
++	if (!strncmp(root_device_name, "fit", 3) ||
++	    !strncmp(root_device_name, "mtd", 3) ||
+ 	    !strncmp(root_device_name, "ubi", 3))
+ 		return Root_Generic;
+ 	if (strcmp(root_device_name, "/dev/nfs") == 0)
diff --git a/6.12/target/linux/generic/pending-6.12/530-jffs2_make_lzma_available.patch b/6.12/target/linux/generic/pending-6.12/530-jffs2_make_lzma_available.patch
new file mode 100644
index 00000000..213e6f1f
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/530-jffs2_make_lzma_available.patch
@@ -0,0 +1,5190 @@
+From: Alexandros C. Couloumbis <alex@ozo.com>
+Subject: fs: add jffs2/lzma support (not activated by default yet)
+
+lede-commit: c2c88d315fa0e881f8b19da07b62859b915b11b2
+Signed-off-by: Alexandros C. Couloumbis <alex@ozo.com>
+---
+ fs/jffs2/Kconfig             |    9 +
+ fs/jffs2/Makefile            |    3 +
+ fs/jffs2/compr.c             |    6 +
+ fs/jffs2/compr.h             |   10 +-
+ fs/jffs2/compr_lzma.c        |  128 +++
+ fs/jffs2/super.c             |   33 +-
+ include/linux/lzma.h         |   62 ++
+ include/linux/lzma/LzFind.h  |  115 +++
+ include/linux/lzma/LzHash.h  |   54 +
+ include/linux/lzma/LzmaDec.h |  231 +++++
+ include/linux/lzma/LzmaEnc.h |   80 ++
+ include/linux/lzma/Types.h   |  226 +++++
+ include/uapi/linux/jffs2.h   |    1 +
+ lib/Kconfig                  |    6 +
+ lib/Makefile                 |   12 +
+ lib/lzma/LzFind.c            |  761 ++++++++++++++
+ lib/lzma/LzmaDec.c           |  999 +++++++++++++++++++
+ lib/lzma/LzmaEnc.c           | 2271 ++++++++++++++++++++++++++++++++++++++++++
+ lib/lzma/Makefile            |    7 +
+ 19 files changed, 5008 insertions(+), 6 deletions(-)
+ create mode 100644 fs/jffs2/compr_lzma.c
+ create mode 100644 include/linux/lzma.h
+ create mode 100644 include/linux/lzma/LzFind.h
+ create mode 100644 include/linux/lzma/LzHash.h
+ create mode 100644 include/linux/lzma/LzmaDec.h
+ create mode 100644 include/linux/lzma/LzmaEnc.h
+ create mode 100644 include/linux/lzma/Types.h
+ create mode 100644 lib/lzma/LzFind.c
+ create mode 100644 lib/lzma/LzmaDec.c
+ create mode 100644 lib/lzma/LzmaEnc.c
+ create mode 100644 lib/lzma/Makefile
+
+--- a/fs/jffs2/Kconfig
++++ b/fs/jffs2/Kconfig
+@@ -136,6 +136,15 @@ config JFFS2_LZO
+ 	  This feature was added in July, 2007. Say 'N' if you need
+ 	  compatibility with older bootloaders or kernels.
+ 
++config JFFS2_LZMA
++	bool "JFFS2 LZMA compression support" if JFFS2_COMPRESSION_OPTIONS
++	select LZMA_COMPRESS
++	select LZMA_DECOMPRESS
++	depends on JFFS2_FS
++	default n
++	help
++	  JFFS2 wrapper to the LZMA C SDK
++
+ config JFFS2_RTIME
+ 	bool "JFFS2 RTIME compression support" if JFFS2_COMPRESSION_OPTIONS
+ 	depends on JFFS2_FS
+--- a/fs/jffs2/Makefile
++++ b/fs/jffs2/Makefile
+@@ -19,4 +19,7 @@ jffs2-$(CONFIG_JFFS2_RUBIN)	+= compr_rub
+ jffs2-$(CONFIG_JFFS2_RTIME)	+= compr_rtime.o
+ jffs2-$(CONFIG_JFFS2_ZLIB)	+= compr_zlib.o
+ jffs2-$(CONFIG_JFFS2_LZO)	+= compr_lzo.o
++jffs2-$(CONFIG_JFFS2_LZMA)	+= compr_lzma.o
+ jffs2-$(CONFIG_JFFS2_SUMMARY)   += summary.o
++
++CFLAGS_compr_lzma.o += -Iinclude/linux -Ilib/lzma
+--- a/fs/jffs2/compr.c
++++ b/fs/jffs2/compr.c
+@@ -381,6 +381,9 @@ int __init jffs2_compressors_init(void)
+ 	ret = jffs2_lzo_init();
+ 	if (ret)
+ 		goto exit_dynrubin;
++	ret = jffs2_lzma_init();
++	if (ret)
++		goto exit_lzo;
+ 
+ 
+ /* Setting default compression mode */
+@@ -402,6 +405,8 @@ int __init jffs2_compressors_init(void)
+ #endif
+ 	return 0;
+ 
++exit_lzo:
++	jffs2_lzo_exit();
+ exit_dynrubin:
+ 	jffs2_dynrubin_exit();
+ exit_runinmips:
+@@ -417,6 +422,7 @@ exit:
+ int jffs2_compressors_exit(void)
+ {
+ /* Unregistering compressors */
++	jffs2_lzma_exit();
+ 	jffs2_lzo_exit();
+ 	jffs2_dynrubin_exit();
+ 	jffs2_rubinmips_exit();
+--- a/fs/jffs2/compr.h
++++ b/fs/jffs2/compr.h
+@@ -29,9 +29,9 @@
+ #define JFFS2_DYNRUBIN_PRIORITY  20
+ #define JFFS2_LZARI_PRIORITY     30
+ #define JFFS2_RTIME_PRIORITY     50
+-#define JFFS2_ZLIB_PRIORITY      60
+-#define JFFS2_LZO_PRIORITY       80
+-
++#define JFFS2_LZMA_PRIORITY      70
++#define JFFS2_ZLIB_PRIORITY      80
++#define JFFS2_LZO_PRIORITY       90
+ 
+ #define JFFS2_RUBINMIPS_DISABLED /* RUBINs will be used only */
+ #define JFFS2_DYNRUBIN_DISABLED  /*	   for decompression */
+@@ -115,5 +115,12 @@ extern void jffs2_lzo_exit(void);
+ static inline int jffs2_lzo_init(void) { return 0; }
+ static inline void jffs2_lzo_exit(void) {}
+ #endif
++#ifdef CONFIG_JFFS2_LZMA
++extern int jffs2_lzma_init(void);
++extern void jffs2_lzma_exit(void);
++#else
++static inline int jffs2_lzma_init(void) { return 0; }
++static inline void jffs2_lzma_exit(void) {}
++#endif
+ 
+ #endif /* __JFFS2_COMPR_H__ */
+--- /dev/null
++++ b/fs/jffs2/compr_lzma.c
+@@ -0,0 +1,128 @@
++/*
++ * JFFS2 -- Journalling Flash File System, Version 2.
++ *
++ * For licensing information, see the file 'LICENCE' in this directory.
++ *
++ * JFFS2 wrapper to the LZMA C SDK
++ *
++ */
++
++#include <linux/lzma.h>
++#include "compr.h"
++
++#ifdef __KERNEL__
++	static DEFINE_MUTEX(deflate_mutex);
++#endif
++
++CLzmaEncHandle *p;
++Byte propsEncoded[LZMA_PROPS_SIZE];
++SizeT propsSize = sizeof(propsEncoded);
++
++STATIC void lzma_free_workspace(void)
++{
++	LzmaEnc_Destroy(p, &lzma_alloc, &lzma_alloc);
++}
++
++STATIC int INIT lzma_alloc_workspace(CLzmaEncProps *props)
++{
++	if ((p = (CLzmaEncHandle *)LzmaEnc_Create(&lzma_alloc)) == NULL)
++	{
++		PRINT_ERROR("Failed to allocate lzma deflate workspace\n");
++		return -ENOMEM;
++	}
++
++	if (LzmaEnc_SetProps(p, props) != SZ_OK)
++	{
++		lzma_free_workspace();
++		return -1;
++	}
++
++	if (LzmaEnc_WriteProperties(p, propsEncoded, &propsSize) != SZ_OK)
++	{
++		lzma_free_workspace();
++		return -1;
++	}
++
++	return 0;
++}
++
++STATIC int jffs2_lzma_compress(unsigned char *data_in, unsigned char *cpage_out,
++			      uint32_t *sourcelen, uint32_t *dstlen)
++{
++	SizeT compress_size = (SizeT)(*dstlen);
++	int ret;
++
++	#ifdef __KERNEL__
++		mutex_lock(&deflate_mutex);
++	#endif
++
++	ret = LzmaEnc_MemEncode(p, cpage_out, &compress_size, data_in, *sourcelen,
++		0, NULL, &lzma_alloc, &lzma_alloc);
++
++	#ifdef __KERNEL__
++		mutex_unlock(&deflate_mutex);
++	#endif
++
++	if (ret != SZ_OK)
++		return -1;
++
++	*dstlen = (uint32_t)compress_size;
++
++	return 0;
++}
++
++STATIC int jffs2_lzma_decompress(unsigned char *data_in, unsigned char *cpage_out,
++				 uint32_t srclen, uint32_t destlen)
++{
++	int ret;
++	SizeT dl = (SizeT)destlen;
++	SizeT sl = (SizeT)srclen;
++	ELzmaStatus status;
++
++	ret = LzmaDecode(cpage_out, &dl, data_in, &sl, propsEncoded,
++		propsSize, LZMA_FINISH_ANY, &status, &lzma_alloc);
++
++	if (ret != SZ_OK || status == LZMA_STATUS_NOT_FINISHED || dl != (SizeT)destlen)
++		return -1;
++
++	return 0;
++}
++
++static struct jffs2_compressor jffs2_lzma_comp = {
++	.priority = JFFS2_LZMA_PRIORITY,
++	.name = "lzma",
++	.compr = JFFS2_COMPR_LZMA,
++	.compress = &jffs2_lzma_compress,
++	.decompress = &jffs2_lzma_decompress,
++	.disabled = 0,
++};
++
++int INIT jffs2_lzma_init(void)
++{
++	int ret;
++	CLzmaEncProps props;
++	LzmaEncProps_Init(&props);
++
++	props.dictSize = LZMA_BEST_DICT(0x2000);
++	props.level = LZMA_BEST_LEVEL;
++	props.lc = LZMA_BEST_LC;
++	props.lp = LZMA_BEST_LP;
++	props.pb = LZMA_BEST_PB;
++	props.fb = LZMA_BEST_FB;
++
++	ret = lzma_alloc_workspace(&props);
++	if (ret < 0)
++		return ret;
++
++	ret = jffs2_register_compressor(&jffs2_lzma_comp);
++	if (ret)
++		lzma_free_workspace();
++
++	return ret;
++}
++
++void jffs2_lzma_exit(void)
++{
++	jffs2_unregister_compressor(&jffs2_lzma_comp);
++	lzma_free_workspace();
++}
+--- a/fs/jffs2/super.c
++++ b/fs/jffs2/super.c
+@@ -376,14 +376,41 @@ static int __init init_jffs2_fs(void)
+ 	BUILD_BUG_ON(sizeof(struct jffs2_raw_inode) != 68);
+ 	BUILD_BUG_ON(sizeof(struct jffs2_raw_summary) != 32);
+ 
+-	pr_info("version 2.2."
++	pr_info("version 2.2"
+ #ifdef CONFIG_JFFS2_FS_WRITEBUFFER
+ 	       " (NAND)"
+ #endif
+ #ifdef CONFIG_JFFS2_SUMMARY
+-	       " (SUMMARY) "
++	       " (SUMMARY)"
+ #endif
+-	       " © 2001-2006 Red Hat, Inc.\n");
++#ifdef CONFIG_JFFS2_ZLIB
++	       " (ZLIB)"
++#endif
++#ifdef CONFIG_JFFS2_LZO
++	       " (LZO)"
++#endif
++#ifdef CONFIG_JFFS2_LZMA
++	       " (LZMA)"
++#endif
++#ifdef CONFIG_JFFS2_RTIME
++	       " (RTIME)"
++#endif
++#ifdef CONFIG_JFFS2_RUBIN
++	       " (RUBIN)"
++#endif
++#ifdef  CONFIG_JFFS2_CMODE_NONE
++	       " (CMODE_NONE)"
++#endif
++#ifdef CONFIG_JFFS2_CMODE_PRIORITY
++	       " (CMODE_PRIORITY)"
++#endif
++#ifdef CONFIG_JFFS2_CMODE_SIZE
++	       " (CMODE_SIZE)"
++#endif
++#ifdef CONFIG_JFFS2_CMODE_FAVOURLZO
++	       " (CMODE_FAVOURLZO)"
++#endif
++	       " (c) 2001-2006 Red Hat, Inc.\n");
+ 
+ 	jffs2_inode_cachep = kmem_cache_create("jffs2_i",
+ 					     sizeof(struct jffs2_inode_info),
+--- /dev/null
++++ b/include/linux/lzma.h
+@@ -0,0 +1,62 @@
++#ifndef __LZMA_H__
++#define __LZMA_H__
++
++#ifdef __KERNEL__
++	#include <linux/kernel.h>
++	#include <linux/sched.h>
++	#include <linux/slab.h>
++	#include <linux/vmalloc.h>
++	#include <linux/init.h>
++	#define LZMA_MALLOC vmalloc
++	#define LZMA_FREE vfree
++	#define PRINT_ERROR(msg) printk(KERN_WARNING #msg)
++	#define INIT __init
++	#define STATIC static
++#else
++	#include <stdint.h>
++	#include <stdlib.h>
++	#include <stdio.h>
++	#include <unistd.h>
++	#include <string.h>
++	#include <asm/types.h>
++	#include <errno.h>
++	#include <linux/jffs2.h>
++	#ifndef PAGE_SIZE
++		extern int page_size;
++		#define PAGE_SIZE page_size
++	#endif
++	#define LZMA_MALLOC malloc
++	#define LZMA_FREE free
++	#define PRINT_ERROR(msg) fprintf(stderr, msg)
++	#define INIT
++	#define STATIC
++#endif
++
++#include "lzma/LzmaDec.h"
++#include "lzma/LzmaEnc.h"
++
++#define LZMA_BEST_LEVEL (9)
++#define LZMA_BEST_LC    (0)
++#define LZMA_BEST_LP    (0)
++#define LZMA_BEST_PB    (0)
++#define LZMA_BEST_FB  (273)
++
++#define LZMA_BEST_DICT(n) (((int)((n) / 2)) * 2)
++
++static void *p_lzma_malloc(void *p, size_t size)
++{
++	if (size == 0)
++		return NULL;
++
++	return LZMA_MALLOC(size);
++}
++
++static void p_lzma_free(void *p, void *address)
++{
++	if (address != NULL)
++		LZMA_FREE(address);
++}
++
++static ISzAlloc lzma_alloc = { .Alloc = p_lzma_malloc, .Free = p_lzma_free };
++
++#endif
+--- /dev/null
++++ b/include/linux/lzma/LzFind.h
+@@ -0,0 +1,115 @@
++/* LzFind.h -- Match finder for LZ algorithms
++2009-04-22 : Igor Pavlov : Public domain */
++
++#ifndef __LZ_FIND_H
++#define __LZ_FIND_H
++
++#include "Types.h"
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++typedef UInt32 CLzRef;
++
++typedef struct _CMatchFinder
++{
++  Byte *buffer;
++  UInt32 pos;
++  UInt32 posLimit;
++  UInt32 streamPos;
++  UInt32 lenLimit;
++
++  UInt32 cyclicBufferPos;
++  UInt32 cyclicBufferSize; /* it must be = (historySize + 1) */
++
++  UInt32 matchMaxLen;
++  CLzRef *hash;
++  CLzRef *son;
++  UInt32 hashMask;
++  UInt32 cutValue;
++
++  Byte *bufferBase;
++  ISeqInStream *stream;
++  int streamEndWasReached;
++
++  UInt32 blockSize;
++  UInt32 keepSizeBefore;
++  UInt32 keepSizeAfter;
++
++  UInt32 numHashBytes;
++  int directInput;
++  size_t directInputRem;
++  int btMode;
++  int bigHash;
++  UInt32 historySize;
++  UInt32 fixedHashSize;
++  UInt32 hashSizeSum;
++  UInt32 numSons;
++  SRes result;
++  UInt32 crc[256];
++} CMatchFinder;
++
++#define Inline_MatchFinder_GetPointerToCurrentPos(p) ((p)->buffer)
++#define Inline_MatchFinder_GetIndexByte(p, index) ((p)->buffer[(Int32)(index)])
++
++#define Inline_MatchFinder_GetNumAvailableBytes(p) ((p)->streamPos - (p)->pos)
++
++int MatchFinder_NeedMove(CMatchFinder *p);
++Byte *MatchFinder_GetPointerToCurrentPos(CMatchFinder *p);
++void MatchFinder_MoveBlock(CMatchFinder *p);
++void MatchFinder_ReadIfRequired(CMatchFinder *p);
++
++void MatchFinder_Construct(CMatchFinder *p);
++
++/* Conditions:
++     historySize <= 3 GB
++     keepAddBufferBefore + matchMaxLen + keepAddBufferAfter < 511MB
++*/
++int MatchFinder_Create(CMatchFinder *p, UInt32 historySize,
++    UInt32 keepAddBufferBefore, UInt32 matchMaxLen, UInt32 keepAddBufferAfter,
++    ISzAlloc *alloc);
++void MatchFinder_Free(CMatchFinder *p, ISzAlloc *alloc);
++void MatchFinder_Normalize3(UInt32 subValue, CLzRef *items, UInt32 numItems);
++void MatchFinder_ReduceOffsets(CMatchFinder *p, UInt32 subValue);
++
++UInt32 * GetMatchesSpec1(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *buffer, CLzRef *son,
++    UInt32 _cyclicBufferPos, UInt32 _cyclicBufferSize, UInt32 _cutValue,
++    UInt32 *distances, UInt32 maxLen);
++
++/*
++Conditions:
++  Mf_GetNumAvailableBytes_Func must be called before each Mf_GetMatchLen_Func.
++  Mf_GetPointerToCurrentPos_Func's result must be used only before any other function
++*/
++
++typedef void (*Mf_Init_Func)(void *object);
++typedef Byte (*Mf_GetIndexByte_Func)(void *object, Int32 index);
++typedef UInt32 (*Mf_GetNumAvailableBytes_Func)(void *object);
++typedef const Byte * (*Mf_GetPointerToCurrentPos_Func)(void *object);
++typedef UInt32 (*Mf_GetMatches_Func)(void *object, UInt32 *distances);
++typedef void (*Mf_Skip_Func)(void *object, UInt32);
++
++typedef struct _IMatchFinder
++{
++  Mf_Init_Func Init;
++  Mf_GetIndexByte_Func GetIndexByte;
++  Mf_GetNumAvailableBytes_Func GetNumAvailableBytes;
++  Mf_GetPointerToCurrentPos_Func GetPointerToCurrentPos;
++  Mf_GetMatches_Func GetMatches;
++  Mf_Skip_Func Skip;
++} IMatchFinder;
++
++void MatchFinder_CreateVTable(CMatchFinder *p, IMatchFinder *vTable);
++
++void MatchFinder_Init(CMatchFinder *p);
++UInt32 Bt3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances);
++UInt32 Hc3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances);
++void Bt3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num);
++void Hc3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num);
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif
+--- /dev/null
++++ b/include/linux/lzma/LzHash.h
+@@ -0,0 +1,54 @@
++/* LzHash.h -- HASH functions for LZ algorithms
++2009-02-07 : Igor Pavlov : Public domain */
++
++#ifndef __LZ_HASH_H
++#define __LZ_HASH_H
++
++#define kHash2Size (1 << 10)
++#define kHash3Size (1 << 16)
++#define kHash4Size (1 << 20)
++
++#define kFix3HashSize (kHash2Size)
++#define kFix4HashSize (kHash2Size + kHash3Size)
++#define kFix5HashSize (kHash2Size + kHash3Size + kHash4Size)
++
++#define HASH2_CALC hashValue = cur[0] | ((UInt32)cur[1] << 8);
++
++#define HASH3_CALC { \
++  UInt32 temp = p->crc[cur[0]] ^ cur[1]; \
++  hash2Value = temp & (kHash2Size - 1); \
++  hashValue = (temp ^ ((UInt32)cur[2] << 8)) & p->hashMask; }
++
++#define HASH4_CALC { \
++  UInt32 temp = p->crc[cur[0]] ^ cur[1]; \
++  hash2Value = temp & (kHash2Size - 1); \
++  hash3Value = (temp ^ ((UInt32)cur[2] << 8)) & (kHash3Size - 1); \
++  hashValue = (temp ^ ((UInt32)cur[2] << 8) ^ (p->crc[cur[3]] << 5)) & p->hashMask; }
++
++#define HASH5_CALC { \
++  UInt32 temp = p->crc[cur[0]] ^ cur[1]; \
++  hash2Value = temp & (kHash2Size - 1); \
++  hash3Value = (temp ^ ((UInt32)cur[2] << 8)) & (kHash3Size - 1); \
++  hash4Value = (temp ^ ((UInt32)cur[2] << 8) ^ (p->crc[cur[3]] << 5)); \
++  hashValue = (hash4Value ^ (p->crc[cur[4]] << 3)) & p->hashMask; \
++  hash4Value &= (kHash4Size - 1); }
++
++/* #define HASH_ZIP_CALC hashValue = ((cur[0] | ((UInt32)cur[1] << 8)) ^ p->crc[cur[2]]) & 0xFFFF; */
++#define HASH_ZIP_CALC hashValue = ((cur[2] | ((UInt32)cur[0] << 8)) ^ p->crc[cur[1]]) & 0xFFFF;
++
++
++#define MT_HASH2_CALC \
++  hash2Value = (p->crc[cur[0]] ^ cur[1]) & (kHash2Size - 1);
++
++#define MT_HASH3_CALC { \
++  UInt32 temp = p->crc[cur[0]] ^ cur[1]; \
++  hash2Value = temp & (kHash2Size - 1); \
++  hash3Value = (temp ^ ((UInt32)cur[2] << 8)) & (kHash3Size - 1); }
++
++#define MT_HASH4_CALC { \
++  UInt32 temp = p->crc[cur[0]] ^ cur[1]; \
++  hash2Value = temp & (kHash2Size - 1); \
++  hash3Value = (temp ^ ((UInt32)cur[2] << 8)) & (kHash3Size - 1); \
++  hash4Value = (temp ^ ((UInt32)cur[2] << 8) ^ (p->crc[cur[3]] << 5)) & (kHash4Size - 1); }
++
++#endif
+--- /dev/null
++++ b/include/linux/lzma/LzmaDec.h
+@@ -0,0 +1,231 @@
++/* LzmaDec.h -- LZMA Decoder
++2009-02-07 : Igor Pavlov : Public domain */
++
++#ifndef __LZMA_DEC_H
++#define __LZMA_DEC_H
++
++#include "Types.h"
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++/* #define _LZMA_PROB32 */
++/* _LZMA_PROB32 can increase the speed on some CPUs,
++   but memory usage for CLzmaDec::probs will be doubled in that case */
++
++#ifdef _LZMA_PROB32
++#define CLzmaProb UInt32
++#else
++#define CLzmaProb UInt16
++#endif
++
++
++/* ---------- LZMA Properties ---------- */
++
++#define LZMA_PROPS_SIZE 5
++
++typedef struct _CLzmaProps
++{
++  unsigned lc, lp, pb;
++  UInt32 dicSize;
++} CLzmaProps;
++
++/* LzmaProps_Decode - decodes properties
++Returns:
++  SZ_OK
++  SZ_ERROR_UNSUPPORTED - Unsupported properties
++*/
++
++SRes LzmaProps_Decode(CLzmaProps *p, const Byte *data, unsigned size);
++
++
++/* ---------- LZMA Decoder state ---------- */
++
++/* LZMA_REQUIRED_INPUT_MAX = number of required input bytes for worst case.
++   Num bits = log2((2^11 / 31) ^ 22) + 26 < 134 + 26 = 160; */
++
++#define LZMA_REQUIRED_INPUT_MAX 20
++
++typedef struct
++{
++  CLzmaProps prop;
++  CLzmaProb *probs;
++  Byte *dic;
++  const Byte *buf;
++  UInt32 range, code;
++  SizeT dicPos;
++  SizeT dicBufSize;
++  UInt32 processedPos;
++  UInt32 checkDicSize;
++  unsigned state;
++  UInt32 reps[4];
++  unsigned remainLen;
++  int needFlush;
++  int needInitState;
++  UInt32 numProbs;
++  unsigned tempBufSize;
++  Byte tempBuf[LZMA_REQUIRED_INPUT_MAX];
++} CLzmaDec;
++
++#define LzmaDec_Construct(p) { (p)->dic = 0; (p)->probs = 0; }
++
++void LzmaDec_Init(CLzmaDec *p);
++
++/* There are two types of LZMA streams:
++     0) Stream with end mark. That end mark adds about 6 bytes to compressed size.
++     1) Stream without end mark. You must know exact uncompressed size to decompress such stream. */
++
++typedef enum
++{
++  LZMA_FINISH_ANY,   /* finish at any point */
++  LZMA_FINISH_END    /* block must be finished at the end */
++} ELzmaFinishMode;
++
++/* ELzmaFinishMode has meaning only if the decoding reaches output limit !!!
++
++   You must use LZMA_FINISH_END, when you know that current output buffer
++   covers last bytes of block. In other cases you must use LZMA_FINISH_ANY.
++
++   If LZMA decoder sees end marker before reaching output limit, it returns SZ_OK,
++   and output value of destLen will be less than output buffer size limit.
++   You can check status result also.
++
++   You can use multiple checks to test data integrity after full decompression:
++     1) Check Result and "status" variable.
++     2) Check that output(destLen) = uncompressedSize, if you know real uncompressedSize.
++     3) Check that output(srcLen) = compressedSize, if you know real compressedSize.
++        You must use correct finish mode in that case. */
++
++typedef enum
++{
++  LZMA_STATUS_NOT_SPECIFIED,               /* use main error code instead */
++  LZMA_STATUS_FINISHED_WITH_MARK,          /* stream was finished with end mark. */
++  LZMA_STATUS_NOT_FINISHED,                /* stream was not finished */
++  LZMA_STATUS_NEEDS_MORE_INPUT,            /* you must provide more input bytes */
++  LZMA_STATUS_MAYBE_FINISHED_WITHOUT_MARK  /* there is probability that stream was finished without end mark */
++} ELzmaStatus;
++
++/* ELzmaStatus is used only as output value for function call */
++
++
++/* ---------- Interfaces ---------- */
++
++/* There are 3 levels of interfaces:
++     1) Dictionary Interface
++     2) Buffer Interface
++     3) One Call Interface
++   You can select any of these interfaces, but don't mix functions from different
++   groups for same object. */
++
++
++/* There are two variants to allocate state for Dictionary Interface:
++     1) LzmaDec_Allocate / LzmaDec_Free
++     2) LzmaDec_AllocateProbs / LzmaDec_FreeProbs
++   You can use variant 2, if you set dictionary buffer manually.
++   For Buffer Interface you must always use variant 1.
++
++LzmaDec_Allocate* can return:
++  SZ_OK
++  SZ_ERROR_MEM         - Memory allocation error
++  SZ_ERROR_UNSUPPORTED - Unsupported properties
++*/
++
++SRes LzmaDec_AllocateProbs(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc);
++void LzmaDec_FreeProbs(CLzmaDec *p, ISzAlloc *alloc);
++
++SRes LzmaDec_Allocate(CLzmaDec *state, const Byte *prop, unsigned propsSize, ISzAlloc *alloc);
++void LzmaDec_Free(CLzmaDec *state, ISzAlloc *alloc);
++
++/* ---------- Dictionary Interface ---------- */
++
++/* You can use it, if you want to eliminate the overhead for data copying from
++   dictionary to some other external buffer.
++   You must work with CLzmaDec variables directly in this interface.
++
++   STEPS:
++     LzmaDec_Constr()
++     LzmaDec_Allocate()
++     for (each new stream)
++     {
++       LzmaDec_Init()
++       while (it needs more decompression)
++       {
++         LzmaDec_DecodeToDic()
++         use data from CLzmaDec::dic and update CLzmaDec::dicPos
++       }
++     }
++     LzmaDec_Free()
++*/
++
++/* LzmaDec_DecodeToDic
++
++   The decoding to internal dictionary buffer (CLzmaDec::dic).
++   You must manually update CLzmaDec::dicPos, if it reaches CLzmaDec::dicBufSize !!!
++
++finishMode:
++  It has meaning only if the decoding reaches output limit (dicLimit).
++  LZMA_FINISH_ANY - Decode just dicLimit bytes.
++  LZMA_FINISH_END - Stream must be finished after dicLimit.
++
++Returns:
++  SZ_OK
++    status:
++      LZMA_STATUS_FINISHED_WITH_MARK
++      LZMA_STATUS_NOT_FINISHED
++      LZMA_STATUS_NEEDS_MORE_INPUT
++      LZMA_STATUS_MAYBE_FINISHED_WITHOUT_MARK
++  SZ_ERROR_DATA - Data error
++*/
++
++SRes LzmaDec_DecodeToDic(CLzmaDec *p, SizeT dicLimit,
++    const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status);
++
++
++/* ---------- Buffer Interface ---------- */
++
++/* It's zlib-like interface.
++   See LzmaDec_DecodeToDic description for information about STEPS and return results,
++   but you must use LzmaDec_DecodeToBuf instead of LzmaDec_DecodeToDic and you don't need
++   to work with CLzmaDec variables manually.
++
++finishMode:
++  It has meaning only if the decoding reaches output limit (*destLen).
++  LZMA_FINISH_ANY - Decode just destLen bytes.
++  LZMA_FINISH_END - Stream must be finished after (*destLen).
++*/
++
++SRes LzmaDec_DecodeToBuf(CLzmaDec *p, Byte *dest, SizeT *destLen,
++    const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status);
++
++
++/* ---------- One Call Interface ---------- */
++
++/* LzmaDecode
++
++finishMode:
++  It has meaning only if the decoding reaches output limit (*destLen).
++  LZMA_FINISH_ANY - Decode just destLen bytes.
++  LZMA_FINISH_END - Stream must be finished after (*destLen).
++
++Returns:
++  SZ_OK
++    status:
++      LZMA_STATUS_FINISHED_WITH_MARK
++      LZMA_STATUS_NOT_FINISHED
++      LZMA_STATUS_MAYBE_FINISHED_WITHOUT_MARK
++  SZ_ERROR_DATA - Data error
++  SZ_ERROR_MEM  - Memory allocation error
++  SZ_ERROR_UNSUPPORTED - Unsupported properties
++  SZ_ERROR_INPUT_EOF - It needs more bytes in input buffer (src).
++*/
++
++SRes LzmaDecode(Byte *dest, SizeT *destLen, const Byte *src, SizeT *srcLen,
++    const Byte *propData, unsigned propSize, ELzmaFinishMode finishMode,
++    ELzmaStatus *status, ISzAlloc *alloc);
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif
+--- /dev/null
++++ b/include/linux/lzma/LzmaEnc.h
+@@ -0,0 +1,80 @@
++/*  LzmaEnc.h -- LZMA Encoder
++2009-02-07 : Igor Pavlov : Public domain */
++
++#ifndef __LZMA_ENC_H
++#define __LZMA_ENC_H
++
++#include "Types.h"
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++#define LZMA_PROPS_SIZE 5
++
++typedef struct _CLzmaEncProps
++{
++  int level;       /*  0 <= level <= 9 */
++  UInt32 dictSize; /* (1 << 12) <= dictSize <= (1 << 27) for 32-bit version
++                      (1 << 12) <= dictSize <= (1 << 30) for 64-bit version
++                       default = (1 << 24) */
++  int lc;          /* 0 <= lc <= 8, default = 3 */
++  int lp;          /* 0 <= lp <= 4, default = 0 */
++  int pb;          /* 0 <= pb <= 4, default = 2 */
++  int algo;        /* 0 - fast, 1 - normal, default = 1 */
++  int fb;          /* 5 <= fb <= 273, default = 32 */
++  int btMode;      /* 0 - hashChain Mode, 1 - binTree mode - normal, default = 1 */
++  int numHashBytes; /* 2, 3 or 4, default = 4 */
++  UInt32 mc;        /* 1 <= mc <= (1 << 30), default = 32 */
++  unsigned writeEndMark;  /* 0 - do not write EOPM, 1 - write EOPM, default = 0 */
++  int numThreads;  /* 1 or 2, default = 2 */
++} CLzmaEncProps;
++
++void LzmaEncProps_Init(CLzmaEncProps *p);
++void LzmaEncProps_Normalize(CLzmaEncProps *p);
++UInt32 LzmaEncProps_GetDictSize(const CLzmaEncProps *props2);
++
++
++/* ---------- CLzmaEncHandle Interface ---------- */
++
++/* LzmaEnc_* functions can return the following exit codes:
++Returns:
++  SZ_OK           - OK
++  SZ_ERROR_MEM    - Memory allocation error
++  SZ_ERROR_PARAM  - Incorrect paramater in props
++  SZ_ERROR_WRITE  - Write callback error.
++  SZ_ERROR_PROGRESS - some break from progress callback
++  SZ_ERROR_THREAD - errors in multithreading functions (only for Mt version)
++*/
++
++typedef void * CLzmaEncHandle;
++
++CLzmaEncHandle LzmaEnc_Create(ISzAlloc *alloc);
++void LzmaEnc_Destroy(CLzmaEncHandle p, ISzAlloc *alloc, ISzAlloc *allocBig);
++SRes LzmaEnc_SetProps(CLzmaEncHandle p, const CLzmaEncProps *props);
++SRes LzmaEnc_WriteProperties(CLzmaEncHandle p, Byte *properties, SizeT *size);
++SRes LzmaEnc_Encode(CLzmaEncHandle p, ISeqOutStream *outStream, ISeqInStream *inStream,
++    ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig);
++SRes LzmaEnc_MemEncode(CLzmaEncHandle p, Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
++    int writeEndMark, ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig);
++
++/* ---------- One Call Interface ---------- */
++
++/* LzmaEncode
++Return code:
++  SZ_OK               - OK
++  SZ_ERROR_MEM        - Memory allocation error
++  SZ_ERROR_PARAM      - Incorrect paramater
++  SZ_ERROR_OUTPUT_EOF - output buffer overflow
++  SZ_ERROR_THREAD     - errors in multithreading functions (only for Mt version)
++*/
++
++SRes LzmaEncode(Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
++    const CLzmaEncProps *props, Byte *propsEncoded, SizeT *propsSize, int writeEndMark,
++    ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig);
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif
+--- /dev/null
++++ b/include/linux/lzma/Types.h
+@@ -0,0 +1,226 @@
++/* Types.h -- Basic types
++2009-11-23 : Igor Pavlov : Public domain */
++
++#ifndef __7Z_TYPES_H
++#define __7Z_TYPES_H
++
++#include <stddef.h>
++
++#ifdef _WIN32
++#include <windows.h>
++#endif
++
++#ifndef EXTERN_C_BEGIN
++#ifdef __cplusplus
++#define EXTERN_C_BEGIN extern "C" {
++#define EXTERN_C_END }
++#else
++#define EXTERN_C_BEGIN
++#define EXTERN_C_END
++#endif
++#endif
++
++EXTERN_C_BEGIN
++
++#define SZ_OK 0
++
++#define SZ_ERROR_DATA 1
++#define SZ_ERROR_MEM 2
++#define SZ_ERROR_CRC 3
++#define SZ_ERROR_UNSUPPORTED 4
++#define SZ_ERROR_PARAM 5
++#define SZ_ERROR_INPUT_EOF 6
++#define SZ_ERROR_OUTPUT_EOF 7
++#define SZ_ERROR_READ 8
++#define SZ_ERROR_WRITE 9
++#define SZ_ERROR_PROGRESS 10
++#define SZ_ERROR_FAIL 11
++#define SZ_ERROR_THREAD 12
++
++#define SZ_ERROR_ARCHIVE 16
++#define SZ_ERROR_NO_ARCHIVE 17
++
++typedef int SRes;
++
++#ifdef _WIN32
++typedef DWORD WRes;
++#else
++typedef int WRes;
++#endif
++
++#ifndef RINOK
++#define RINOK(x) { int __result__ = (x); if (__result__ != 0) return __result__; }
++#endif
++
++typedef unsigned char Byte;
++typedef short Int16;
++typedef unsigned short UInt16;
++
++#ifdef _LZMA_UINT32_IS_ULONG
++typedef long Int32;
++typedef unsigned long UInt32;
++#else
++typedef int Int32;
++typedef unsigned int UInt32;
++#endif
++
++#ifdef _SZ_NO_INT_64
++
++/* define _SZ_NO_INT_64, if your compiler doesn't support 64-bit integers.
++   NOTES: Some code will work incorrectly in that case! */
++
++typedef long Int64;
++typedef unsigned long UInt64;
++
++#else
++
++#if defined(_MSC_VER) || defined(__BORLANDC__)
++typedef __int64 Int64;
++typedef unsigned __int64 UInt64;
++#else
++typedef long long int Int64;
++typedef unsigned long long int UInt64;
++#endif
++
++#endif
++
++#ifdef _LZMA_NO_SYSTEM_SIZE_T
++typedef UInt32 SizeT;
++#else
++typedef size_t SizeT;
++#endif
++
++typedef int Bool;
++#define True 1
++#define False 0
++
++
++#ifdef _WIN32
++#define MY_STD_CALL __stdcall
++#else
++#define MY_STD_CALL
++#endif
++
++#ifdef _MSC_VER
++
++#if _MSC_VER >= 1300
++#define MY_NO_INLINE __declspec(noinline)
++#else
++#define MY_NO_INLINE
++#endif
++
++#define MY_CDECL __cdecl
++#define MY_FAST_CALL __fastcall
++
++#else
++
++#define MY_CDECL
++#define MY_FAST_CALL
++
++#endif
++
++
++/* The following interfaces use first parameter as pointer to structure */
++
++typedef struct
++{
++  SRes (*Read)(void *p, void *buf, size_t *size);
++    /* if (input(*size) != 0 && output(*size) == 0) means end_of_stream.
++       (output(*size) < input(*size)) is allowed */
++} ISeqInStream;
++
++/* it can return SZ_ERROR_INPUT_EOF */
++SRes SeqInStream_Read(ISeqInStream *stream, void *buf, size_t size);
++SRes SeqInStream_Read2(ISeqInStream *stream, void *buf, size_t size, SRes errorType);
++SRes SeqInStream_ReadByte(ISeqInStream *stream, Byte *buf);
++
++typedef struct
++{
++  size_t (*Write)(void *p, const void *buf, size_t size);
++    /* Returns: result - the number of actually written bytes.
++       (result < size) means error */
++} ISeqOutStream;
++
++typedef enum
++{
++  SZ_SEEK_SET = 0,
++  SZ_SEEK_CUR = 1,
++  SZ_SEEK_END = 2
++} ESzSeek;
++
++typedef struct
++{
++  SRes (*Read)(void *p, void *buf, size_t *size);  /* same as ISeqInStream::Read */
++  SRes (*Seek)(void *p, Int64 *pos, ESzSeek origin);
++} ISeekInStream;
++
++typedef struct
++{
++  SRes (*Look)(void *p, void **buf, size_t *size);
++    /* if (input(*size) != 0 && output(*size) == 0) means end_of_stream.
++       (output(*size) > input(*size)) is not allowed
++       (output(*size) < input(*size)) is allowed */
++  SRes (*Skip)(void *p, size_t offset);
++    /* offset must be <= output(*size) of Look */
++
++  SRes (*Read)(void *p, void *buf, size_t *size);
++    /* reads directly (without buffer). It's same as ISeqInStream::Read */
++  SRes (*Seek)(void *p, Int64 *pos, ESzSeek origin);
++} ILookInStream;
++
++SRes LookInStream_LookRead(ILookInStream *stream, void *buf, size_t *size);
++SRes LookInStream_SeekTo(ILookInStream *stream, UInt64 offset);
++
++/* reads via ILookInStream::Read */
++SRes LookInStream_Read2(ILookInStream *stream, void *buf, size_t size, SRes errorType);
++SRes LookInStream_Read(ILookInStream *stream, void *buf, size_t size);
++
++#define LookToRead_BUF_SIZE (1 << 14)
++
++typedef struct
++{
++  ILookInStream s;
++  ISeekInStream *realStream;
++  size_t pos;
++  size_t size;
++  Byte buf[LookToRead_BUF_SIZE];
++} CLookToRead;
++
++void LookToRead_CreateVTable(CLookToRead *p, int lookahead);
++void LookToRead_Init(CLookToRead *p);
++
++typedef struct
++{
++  ISeqInStream s;
++  ILookInStream *realStream;
++} CSecToLook;
++
++void SecToLook_CreateVTable(CSecToLook *p);
++
++typedef struct
++{
++  ISeqInStream s;
++  ILookInStream *realStream;
++} CSecToRead;
++
++void SecToRead_CreateVTable(CSecToRead *p);
++
++typedef struct
++{
++  SRes (*Progress)(void *p, UInt64 inSize, UInt64 outSize);
++    /* Returns: result. (result != SZ_OK) means break.
++       Value (UInt64)(Int64)-1 for size means unknown value. */
++} ICompressProgress;
++
++typedef struct
++{
++  void *(*Alloc)(void *p, size_t size);
++  void (*Free)(void *p, void *address); /* address can be 0 */
++} ISzAlloc;
++
++#define IAlloc_Alloc(p, size) (p)->Alloc((p), size)
++#define IAlloc_Free(p, a) (p)->Free((p), a)
++
++EXTERN_C_END
++
++#endif
+--- a/include/uapi/linux/jffs2.h
++++ b/include/uapi/linux/jffs2.h
+@@ -46,6 +46,7 @@
+ #define JFFS2_COMPR_DYNRUBIN	0x05
+ #define JFFS2_COMPR_ZLIB	0x06
+ #define JFFS2_COMPR_LZO		0x07
++#define JFFS2_COMPR_LZMA	0x08
+ /* Compatibility flags. */
+ #define JFFS2_COMPAT_MASK 0xc000      /* What do to if an unknown nodetype is found */
+ #define JFFS2_NODE_ACCURATE 0x2000
+--- a/lib/Kconfig
++++ b/lib/Kconfig
+@@ -353,6 +353,12 @@ config ZSTD_DECOMPRESS
+ 
+ source "lib/xz/Kconfig"
+ 
++config LZMA_COMPRESS
++    tristate
++
++config LZMA_DECOMPRESS
++    tristate
++
+ #
+ # These all provide a common interface (hence the apparent duplication with
+ # ZLIB_INFLATE; DECOMPRESS_GZIP is just a wrapper.)
+--- a/lib/Makefile
++++ b/lib/Makefile
+@@ -126,6 +126,16 @@ CFLAGS_kobject.o += -DDEBUG
+ CFLAGS_kobject_uevent.o += -DDEBUG
+ endif
+ 
++ifdef CONFIG_JFFS2_ZLIB
++  CONFIG_ZLIB_INFLATE:=y
++  CONFIG_ZLIB_DEFLATE:=y
++endif
++
++ifdef CONFIG_JFFS2_LZMA
++  CONFIG_LZMA_DECOMPRESS:=y
++  CONFIG_LZMA_COMPRESS:=y
++endif
++
+ obj-$(CONFIG_DEBUG_INFO_REDUCED) += debug_info.o
+ CFLAGS_debug_info.o += $(call cc-option, -femit-struct-debug-detailed=any)
+ 
+@@ -185,6 +195,8 @@ obj-$(CONFIG_ZSTD_COMPRESS) += zstd/
+ obj-$(CONFIG_ZSTD_DECOMPRESS) += zstd/
+ obj-$(CONFIG_XZ_DEC) += xz/
+ obj-$(CONFIG_RAID6_PQ) += raid6/
++obj-$(CONFIG_LZMA_COMPRESS) += lzma/
++obj-$(CONFIG_LZMA_DECOMPRESS) += lzma/
+ 
+ lib-$(CONFIG_DECOMPRESS_GZIP) += decompress_inflate.o
+ lib-$(CONFIG_DECOMPRESS_BZIP2) += decompress_bunzip2.o
+--- /dev/null
++++ b/lib/lzma/LzFind.c
+@@ -0,0 +1,761 @@
++/* LzFind.c -- Match finder for LZ algorithms
++2009-04-22 : Igor Pavlov : Public domain */
++
++#include <string.h>
++
++#include "LzFind.h"
++#include "LzHash.h"
++
++#define kEmptyHashValue 0
++#define kMaxValForNormalize ((UInt32)0xFFFFFFFF)
++#define kNormalizeStepMin (1 << 10) /* it must be power of 2 */
++#define kNormalizeMask (~(kNormalizeStepMin - 1))
++#define kMaxHistorySize ((UInt32)3 << 30)
++
++#define kStartMaxLen 3
++
++static void LzInWindow_Free(CMatchFinder *p, ISzAlloc *alloc)
++{
++  if (!p->directInput)
++  {
++    alloc->Free(alloc, p->bufferBase);
++    p->bufferBase = 0;
++  }
++}
++
++/* keepSizeBefore + keepSizeAfter + keepSizeReserv must be < 4G) */
++
++static int LzInWindow_Create(CMatchFinder *p, UInt32 keepSizeReserv, ISzAlloc *alloc)
++{
++  UInt32 blockSize = p->keepSizeBefore + p->keepSizeAfter + keepSizeReserv;
++  if (p->directInput)
++  {
++    p->blockSize = blockSize;
++    return 1;
++  }
++  if (p->bufferBase == 0 || p->blockSize != blockSize)
++  {
++    LzInWindow_Free(p, alloc);
++    p->blockSize = blockSize;
++    p->bufferBase = (Byte *)alloc->Alloc(alloc, (size_t)blockSize);
++  }
++  return (p->bufferBase != 0);
++}
++
++Byte *MatchFinder_GetPointerToCurrentPos(CMatchFinder *p) { return p->buffer; }
++static Byte MatchFinder_GetIndexByte(CMatchFinder *p, Int32 index) { return p->buffer[index]; }
++
++static UInt32 MatchFinder_GetNumAvailableBytes(CMatchFinder *p) { return p->streamPos - p->pos; }
++
++void MatchFinder_ReduceOffsets(CMatchFinder *p, UInt32 subValue)
++{
++  p->posLimit -= subValue;
++  p->pos -= subValue;
++  p->streamPos -= subValue;
++}
++
++static void MatchFinder_ReadBlock(CMatchFinder *p)
++{
++  if (p->streamEndWasReached || p->result != SZ_OK)
++    return;
++  if (p->directInput)
++  {
++    UInt32 curSize = 0xFFFFFFFF - p->streamPos;
++    if (curSize > p->directInputRem)
++      curSize = (UInt32)p->directInputRem;
++    p->directInputRem -= curSize;
++    p->streamPos += curSize;
++    if (p->directInputRem == 0)
++      p->streamEndWasReached = 1;
++    return;
++  }
++  for (;;)
++  {
++    Byte *dest = p->buffer + (p->streamPos - p->pos);
++    size_t size = (p->bufferBase + p->blockSize - dest);
++    if (size == 0)
++      return;
++    p->result = p->stream->Read(p->stream, dest, &size);
++    if (p->result != SZ_OK)
++      return;
++    if (size == 0)
++    {
++      p->streamEndWasReached = 1;
++      return;
++    }
++    p->streamPos += (UInt32)size;
++    if (p->streamPos - p->pos > p->keepSizeAfter)
++      return;
++  }
++}
++
++void MatchFinder_MoveBlock(CMatchFinder *p)
++{
++  memmove(p->bufferBase,
++    p->buffer - p->keepSizeBefore,
++    (size_t)(p->streamPos - p->pos + p->keepSizeBefore));
++  p->buffer = p->bufferBase + p->keepSizeBefore;
++}
++
++int MatchFinder_NeedMove(CMatchFinder *p)
++{
++  if (p->directInput)
++    return 0;
++  /* if (p->streamEndWasReached) return 0; */
++  return ((size_t)(p->bufferBase + p->blockSize - p->buffer) <= p->keepSizeAfter);
++}
++
++void MatchFinder_ReadIfRequired(CMatchFinder *p)
++{
++  if (p->streamEndWasReached)
++    return;
++  if (p->keepSizeAfter >= p->streamPos - p->pos)
++    MatchFinder_ReadBlock(p);
++}
++
++static void MatchFinder_CheckAndMoveAndRead(CMatchFinder *p)
++{
++  if (MatchFinder_NeedMove(p))
++    MatchFinder_MoveBlock(p);
++  MatchFinder_ReadBlock(p);
++}
++
++static void MatchFinder_SetDefaultSettings(CMatchFinder *p)
++{
++  p->cutValue = 32;
++  p->btMode = 1;
++  p->numHashBytes = 4;
++  p->bigHash = 0;
++}
++
++#define kCrcPoly 0xEDB88320
++
++void MatchFinder_Construct(CMatchFinder *p)
++{
++  UInt32 i;
++  p->bufferBase = 0;
++  p->directInput = 0;
++  p->hash = 0;
++  MatchFinder_SetDefaultSettings(p);
++
++  for (i = 0; i < 256; i++)
++  {
++    UInt32 r = i;
++    int j;
++    for (j = 0; j < 8; j++)
++      r = (r >> 1) ^ (kCrcPoly & ~((r & 1) - 1));
++    p->crc[i] = r;
++  }
++}
++
++static void MatchFinder_FreeThisClassMemory(CMatchFinder *p, ISzAlloc *alloc)
++{
++  alloc->Free(alloc, p->hash);
++  p->hash = 0;
++}
++
++void MatchFinder_Free(CMatchFinder *p, ISzAlloc *alloc)
++{
++  MatchFinder_FreeThisClassMemory(p, alloc);
++  LzInWindow_Free(p, alloc);
++}
++
++static CLzRef* AllocRefs(UInt32 num, ISzAlloc *alloc)
++{
++  size_t sizeInBytes = (size_t)num * sizeof(CLzRef);
++  if (sizeInBytes / sizeof(CLzRef) != num)
++    return 0;
++  return (CLzRef *)alloc->Alloc(alloc, sizeInBytes);
++}
++
++int MatchFinder_Create(CMatchFinder *p, UInt32 historySize,
++    UInt32 keepAddBufferBefore, UInt32 matchMaxLen, UInt32 keepAddBufferAfter,
++    ISzAlloc *alloc)
++{
++  UInt32 sizeReserv;
++  if (historySize > kMaxHistorySize)
++  {
++    MatchFinder_Free(p, alloc);
++    return 0;
++  }
++  sizeReserv = historySize >> 1;
++  if (historySize > ((UInt32)2 << 30))
++    sizeReserv = historySize >> 2;
++  sizeReserv += (keepAddBufferBefore + matchMaxLen + keepAddBufferAfter) / 2 + (1 << 19);
++
++  p->keepSizeBefore = historySize + keepAddBufferBefore + 1;
++  p->keepSizeAfter = matchMaxLen + keepAddBufferAfter;
++  /* we need one additional byte, since we use MoveBlock after pos++ and before dictionary using */
++  if (LzInWindow_Create(p, sizeReserv, alloc))
++  {
++    UInt32 newCyclicBufferSize = historySize + 1;
++    UInt32 hs;
++    p->matchMaxLen = matchMaxLen;
++    {
++      p->fixedHashSize = 0;
++      if (p->numHashBytes == 2)
++        hs = (1 << 16) - 1;
++      else
++      {
++        hs = historySize - 1;
++        hs |= (hs >> 1);
++        hs |= (hs >> 2);
++        hs |= (hs >> 4);
++        hs |= (hs >> 8);
++        hs >>= 1;
++        hs |= 0xFFFF; /* don't change it! It's required for Deflate */
++        if (hs > (1 << 24))
++        {
++          if (p->numHashBytes == 3)
++            hs = (1 << 24) - 1;
++          else
++            hs >>= 1;
++        }
++      }
++      p->hashMask = hs;
++      hs++;
++      if (p->numHashBytes > 2) p->fixedHashSize += kHash2Size;
++      if (p->numHashBytes > 3) p->fixedHashSize += kHash3Size;
++      if (p->numHashBytes > 4) p->fixedHashSize += kHash4Size;
++      hs += p->fixedHashSize;
++    }
++
++    {
++      UInt32 prevSize = p->hashSizeSum + p->numSons;
++      UInt32 newSize;
++      p->historySize = historySize;
++      p->hashSizeSum = hs;
++      p->cyclicBufferSize = newCyclicBufferSize;
++      p->numSons = (p->btMode ? newCyclicBufferSize * 2 : newCyclicBufferSize);
++      newSize = p->hashSizeSum + p->numSons;
++      if (p->hash != 0 && prevSize == newSize)
++        return 1;
++      MatchFinder_FreeThisClassMemory(p, alloc);
++      p->hash = AllocRefs(newSize, alloc);
++      if (p->hash != 0)
++      {
++        p->son = p->hash + p->hashSizeSum;
++        return 1;
++      }
++    }
++  }
++  MatchFinder_Free(p, alloc);
++  return 0;
++}
++
++static void MatchFinder_SetLimits(CMatchFinder *p)
++{
++  UInt32 limit = kMaxValForNormalize - p->pos;
++  UInt32 limit2 = p->cyclicBufferSize - p->cyclicBufferPos;
++  if (limit2 < limit)
++    limit = limit2;
++  limit2 = p->streamPos - p->pos;
++  if (limit2 <= p->keepSizeAfter)
++  {
++    if (limit2 > 0)
++      limit2 = 1;
++  }
++  else
++    limit2 -= p->keepSizeAfter;
++  if (limit2 < limit)
++    limit = limit2;
++  {
++    UInt32 lenLimit = p->streamPos - p->pos;
++    if (lenLimit > p->matchMaxLen)
++      lenLimit = p->matchMaxLen;
++    p->lenLimit = lenLimit;
++  }
++  p->posLimit = p->pos + limit;
++}
++
++void MatchFinder_Init(CMatchFinder *p)
++{
++  UInt32 i;
++  for (i = 0; i < p->hashSizeSum; i++)
++    p->hash[i] = kEmptyHashValue;
++  p->cyclicBufferPos = 0;
++  p->buffer = p->bufferBase;
++  p->pos = p->streamPos = p->cyclicBufferSize;
++  p->result = SZ_OK;
++  p->streamEndWasReached = 0;
++  MatchFinder_ReadBlock(p);
++  MatchFinder_SetLimits(p);
++}
++
++static UInt32 MatchFinder_GetSubValue(CMatchFinder *p)
++{
++  return (p->pos - p->historySize - 1) & kNormalizeMask;
++}
++
++void MatchFinder_Normalize3(UInt32 subValue, CLzRef *items, UInt32 numItems)
++{
++  UInt32 i;
++  for (i = 0; i < numItems; i++)
++  {
++    UInt32 value = items[i];
++    if (value <= subValue)
++      value = kEmptyHashValue;
++    else
++      value -= subValue;
++    items[i] = value;
++  }
++}
++
++static void MatchFinder_Normalize(CMatchFinder *p)
++{
++  UInt32 subValue = MatchFinder_GetSubValue(p);
++  MatchFinder_Normalize3(subValue, p->hash, p->hashSizeSum + p->numSons);
++  MatchFinder_ReduceOffsets(p, subValue);
++}
++
++static void MatchFinder_CheckLimits(CMatchFinder *p)
++{
++  if (p->pos == kMaxValForNormalize)
++    MatchFinder_Normalize(p);
++  if (!p->streamEndWasReached && p->keepSizeAfter == p->streamPos - p->pos)
++    MatchFinder_CheckAndMoveAndRead(p);
++  if (p->cyclicBufferPos == p->cyclicBufferSize)
++    p->cyclicBufferPos = 0;
++  MatchFinder_SetLimits(p);
++}
++
++static UInt32 * Hc_GetMatchesSpec(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *cur, CLzRef *son,
++    UInt32 _cyclicBufferPos, UInt32 _cyclicBufferSize, UInt32 cutValue,
++    UInt32 *distances, UInt32 maxLen)
++{
++  son[_cyclicBufferPos] = curMatch;
++  for (;;)
++  {
++    UInt32 delta = pos - curMatch;
++    if (cutValue-- == 0 || delta >= _cyclicBufferSize)
++      return distances;
++    {
++      const Byte *pb = cur - delta;
++      curMatch = son[_cyclicBufferPos - delta + ((delta > _cyclicBufferPos) ? _cyclicBufferSize : 0)];
++      if (pb[maxLen] == cur[maxLen] && *pb == *cur)
++      {
++        UInt32 len = 0;
++        while (++len != lenLimit)
++          if (pb[len] != cur[len])
++            break;
++        if (maxLen < len)
++        {
++          *distances++ = maxLen = len;
++          *distances++ = delta - 1;
++          if (len == lenLimit)
++            return distances;
++        }
++      }
++    }
++  }
++}
++
++UInt32 * GetMatchesSpec1(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *cur, CLzRef *son,
++    UInt32 _cyclicBufferPos, UInt32 _cyclicBufferSize, UInt32 cutValue,
++    UInt32 *distances, UInt32 maxLen)
++{
++  CLzRef *ptr0 = son + (_cyclicBufferPos << 1) + 1;
++  CLzRef *ptr1 = son + (_cyclicBufferPos << 1);
++  UInt32 len0 = 0, len1 = 0;
++  for (;;)
++  {
++    UInt32 delta = pos - curMatch;
++    if (cutValue-- == 0 || delta >= _cyclicBufferSize)
++    {
++      *ptr0 = *ptr1 = kEmptyHashValue;
++      return distances;
++    }
++    {
++      CLzRef *pair = son + ((_cyclicBufferPos - delta + ((delta > _cyclicBufferPos) ? _cyclicBufferSize : 0)) << 1);
++      const Byte *pb = cur - delta;
++      UInt32 len = (len0 < len1 ? len0 : len1);
++      if (pb[len] == cur[len])
++      {
++        if (++len != lenLimit && pb[len] == cur[len])
++          while (++len != lenLimit)
++            if (pb[len] != cur[len])
++              break;
++        if (maxLen < len)
++        {
++          *distances++ = maxLen = len;
++          *distances++ = delta - 1;
++          if (len == lenLimit)
++          {
++            *ptr1 = pair[0];
++            *ptr0 = pair[1];
++            return distances;
++          }
++        }
++      }
++      if (pb[len] < cur[len])
++      {
++        *ptr1 = curMatch;
++        ptr1 = pair + 1;
++        curMatch = *ptr1;
++        len1 = len;
++      }
++      else
++      {
++        *ptr0 = curMatch;
++        ptr0 = pair;
++        curMatch = *ptr0;
++        len0 = len;
++      }
++    }
++  }
++}
++
++static void SkipMatchesSpec(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *cur, CLzRef *son,
++    UInt32 _cyclicBufferPos, UInt32 _cyclicBufferSize, UInt32 cutValue)
++{
++  CLzRef *ptr0 = son + (_cyclicBufferPos << 1) + 1;
++  CLzRef *ptr1 = son + (_cyclicBufferPos << 1);
++  UInt32 len0 = 0, len1 = 0;
++  for (;;)
++  {
++    UInt32 delta = pos - curMatch;
++    if (cutValue-- == 0 || delta >= _cyclicBufferSize)
++    {
++      *ptr0 = *ptr1 = kEmptyHashValue;
++      return;
++    }
++    {
++      CLzRef *pair = son + ((_cyclicBufferPos - delta + ((delta > _cyclicBufferPos) ? _cyclicBufferSize : 0)) << 1);
++      const Byte *pb = cur - delta;
++      UInt32 len = (len0 < len1 ? len0 : len1);
++      if (pb[len] == cur[len])
++      {
++        while (++len != lenLimit)
++          if (pb[len] != cur[len])
++            break;
++        {
++          if (len == lenLimit)
++          {
++            *ptr1 = pair[0];
++            *ptr0 = pair[1];
++            return;
++          }
++        }
++      }
++      if (pb[len] < cur[len])
++      {
++        *ptr1 = curMatch;
++        ptr1 = pair + 1;
++        curMatch = *ptr1;
++        len1 = len;
++      }
++      else
++      {
++        *ptr0 = curMatch;
++        ptr0 = pair;
++        curMatch = *ptr0;
++        len0 = len;
++      }
++    }
++  }
++}
++
++#define MOVE_POS \
++  ++p->cyclicBufferPos; \
++  p->buffer++; \
++  if (++p->pos == p->posLimit) MatchFinder_CheckLimits(p);
++
++#define MOVE_POS_RET MOVE_POS return offset;
++
++static void MatchFinder_MovePos(CMatchFinder *p) { MOVE_POS; }
++
++#define GET_MATCHES_HEADER2(minLen, ret_op) \
++  UInt32 lenLimit; UInt32 hashValue; const Byte *cur; UInt32 curMatch; \
++  lenLimit = p->lenLimit; { if (lenLimit < minLen) { MatchFinder_MovePos(p); ret_op; }} \
++  cur = p->buffer;
++
++#define GET_MATCHES_HEADER(minLen) GET_MATCHES_HEADER2(minLen, return 0)
++#define SKIP_HEADER(minLen)        GET_MATCHES_HEADER2(minLen, continue)
++
++#define MF_PARAMS(p) p->pos, p->buffer, p->son, p->cyclicBufferPos, p->cyclicBufferSize, p->cutValue
++
++#define GET_MATCHES_FOOTER(offset, maxLen) \
++  offset = (UInt32)(GetMatchesSpec1(lenLimit, curMatch, MF_PARAMS(p), \
++  distances + offset, maxLen) - distances); MOVE_POS_RET;
++
++#define SKIP_FOOTER \
++  SkipMatchesSpec(lenLimit, curMatch, MF_PARAMS(p)); MOVE_POS;
++
++static UInt32 Bt2_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++{
++  UInt32 offset;
++  GET_MATCHES_HEADER(2)
++  HASH2_CALC;
++  curMatch = p->hash[hashValue];
++  p->hash[hashValue] = p->pos;
++  offset = 0;
++  GET_MATCHES_FOOTER(offset, 1)
++}
++
++UInt32 Bt3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++{
++  UInt32 offset;
++  GET_MATCHES_HEADER(3)
++  HASH_ZIP_CALC;
++  curMatch = p->hash[hashValue];
++  p->hash[hashValue] = p->pos;
++  offset = 0;
++  GET_MATCHES_FOOTER(offset, 2)
++}
++
++static UInt32 Bt3_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++{
++  UInt32 hash2Value, delta2, maxLen, offset;
++  GET_MATCHES_HEADER(3)
++
++  HASH3_CALC;
++
++  delta2 = p->pos - p->hash[hash2Value];
++  curMatch = p->hash[kFix3HashSize + hashValue];
++
++  p->hash[hash2Value] =
++  p->hash[kFix3HashSize + hashValue] = p->pos;
++
++
++  maxLen = 2;
++  offset = 0;
++  if (delta2 < p->cyclicBufferSize && *(cur - delta2) == *cur)
++  {
++    for (; maxLen != lenLimit; maxLen++)
++      if (cur[(ptrdiff_t)maxLen - delta2] != cur[maxLen])
++        break;
++    distances[0] = maxLen;
++    distances[1] = delta2 - 1;
++    offset = 2;
++    if (maxLen == lenLimit)
++    {
++      SkipMatchesSpec(lenLimit, curMatch, MF_PARAMS(p));
++      MOVE_POS_RET;
++    }
++  }
++  GET_MATCHES_FOOTER(offset, maxLen)
++}
++
++static UInt32 Bt4_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++{
++  UInt32 hash2Value, hash3Value, delta2, delta3, maxLen, offset;
++  GET_MATCHES_HEADER(4)
++
++  HASH4_CALC;
++
++  delta2 = p->pos - p->hash[                hash2Value];
++  delta3 = p->pos - p->hash[kFix3HashSize + hash3Value];
++  curMatch = p->hash[kFix4HashSize + hashValue];
++
++  p->hash[                hash2Value] =
++  p->hash[kFix3HashSize + hash3Value] =
++  p->hash[kFix4HashSize + hashValue] = p->pos;
++
++  maxLen = 1;
++  offset = 0;
++  if (delta2 < p->cyclicBufferSize && *(cur - delta2) == *cur)
++  {
++    distances[0] = maxLen = 2;
++    distances[1] = delta2 - 1;
++    offset = 2;
++  }
++  if (delta2 != delta3 && delta3 < p->cyclicBufferSize && *(cur - delta3) == *cur)
++  {
++    maxLen = 3;
++    distances[offset + 1] = delta3 - 1;
++    offset += 2;
++    delta2 = delta3;
++  }
++  if (offset != 0)
++  {
++    for (; maxLen != lenLimit; maxLen++)
++      if (cur[(ptrdiff_t)maxLen - delta2] != cur[maxLen])
++        break;
++    distances[offset - 2] = maxLen;
++    if (maxLen == lenLimit)
++    {
++      SkipMatchesSpec(lenLimit, curMatch, MF_PARAMS(p));
++      MOVE_POS_RET;
++    }
++  }
++  if (maxLen < 3)
++    maxLen = 3;
++  GET_MATCHES_FOOTER(offset, maxLen)
++}
++
++static UInt32 Hc4_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++{
++  UInt32 hash2Value, hash3Value, delta2, delta3, maxLen, offset;
++  GET_MATCHES_HEADER(4)
++
++  HASH4_CALC;
++
++  delta2 = p->pos - p->hash[                hash2Value];
++  delta3 = p->pos - p->hash[kFix3HashSize + hash3Value];
++  curMatch = p->hash[kFix4HashSize + hashValue];
++
++  p->hash[                hash2Value] =
++  p->hash[kFix3HashSize + hash3Value] =
++  p->hash[kFix4HashSize + hashValue] = p->pos;
++
++  maxLen = 1;
++  offset = 0;
++  if (delta2 < p->cyclicBufferSize && *(cur - delta2) == *cur)
++  {
++    distances[0] = maxLen = 2;
++    distances[1] = delta2 - 1;
++    offset = 2;
++  }
++  if (delta2 != delta3 && delta3 < p->cyclicBufferSize && *(cur - delta3) == *cur)
++  {
++    maxLen = 3;
++    distances[offset + 1] = delta3 - 1;
++    offset += 2;
++    delta2 = delta3;
++  }
++  if (offset != 0)
++  {
++    for (; maxLen != lenLimit; maxLen++)
++      if (cur[(ptrdiff_t)maxLen - delta2] != cur[maxLen])
++        break;
++    distances[offset - 2] = maxLen;
++    if (maxLen == lenLimit)
++    {
++      p->son[p->cyclicBufferPos] = curMatch;
++      MOVE_POS_RET;
++    }
++  }
++  if (maxLen < 3)
++    maxLen = 3;
++  offset = (UInt32)(Hc_GetMatchesSpec(lenLimit, curMatch, MF_PARAMS(p),
++    distances + offset, maxLen) - (distances));
++  MOVE_POS_RET
++}
++
++UInt32 Hc3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++{
++  UInt32 offset;
++  GET_MATCHES_HEADER(3)
++  HASH_ZIP_CALC;
++  curMatch = p->hash[hashValue];
++  p->hash[hashValue] = p->pos;
++  offset = (UInt32)(Hc_GetMatchesSpec(lenLimit, curMatch, MF_PARAMS(p),
++    distances, 2) - (distances));
++  MOVE_POS_RET
++}
++
++static void Bt2_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++{
++  do
++  {
++    SKIP_HEADER(2)
++    HASH2_CALC;
++    curMatch = p->hash[hashValue];
++    p->hash[hashValue] = p->pos;
++    SKIP_FOOTER
++  }
++  while (--num != 0);
++}
++
++void Bt3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++{
++  do
++  {
++    SKIP_HEADER(3)
++    HASH_ZIP_CALC;
++    curMatch = p->hash[hashValue];
++    p->hash[hashValue] = p->pos;
++    SKIP_FOOTER
++  }
++  while (--num != 0);
++}
++
++static void Bt3_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++{
++  do
++  {
++    UInt32 hash2Value;
++    SKIP_HEADER(3)
++    HASH3_CALC;
++    curMatch = p->hash[kFix3HashSize + hashValue];
++    p->hash[hash2Value] =
++    p->hash[kFix3HashSize + hashValue] = p->pos;
++    SKIP_FOOTER
++  }
++  while (--num != 0);
++}
++
++static void Bt4_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++{
++  do
++  {
++    UInt32 hash2Value, hash3Value;
++    SKIP_HEADER(4)
++    HASH4_CALC;
++    curMatch = p->hash[kFix4HashSize + hashValue];
++    p->hash[                hash2Value] =
++    p->hash[kFix3HashSize + hash3Value] = p->pos;
++    p->hash[kFix4HashSize + hashValue] = p->pos;
++    SKIP_FOOTER
++  }
++  while (--num != 0);
++}
++
++static void Hc4_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++{
++  do
++  {
++    UInt32 hash2Value, hash3Value;
++    SKIP_HEADER(4)
++    HASH4_CALC;
++    curMatch = p->hash[kFix4HashSize + hashValue];
++    p->hash[                hash2Value] =
++    p->hash[kFix3HashSize + hash3Value] =
++    p->hash[kFix4HashSize + hashValue] = p->pos;
++    p->son[p->cyclicBufferPos] = curMatch;
++    MOVE_POS
++  }
++  while (--num != 0);
++}
++
++void Hc3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++{
++  do
++  {
++    SKIP_HEADER(3)
++    HASH_ZIP_CALC;
++    curMatch = p->hash[hashValue];
++    p->hash[hashValue] = p->pos;
++    p->son[p->cyclicBufferPos] = curMatch;
++    MOVE_POS
++  }
++  while (--num != 0);
++}
++
++void MatchFinder_CreateVTable(CMatchFinder *p, IMatchFinder *vTable)
++{
++  vTable->Init = (Mf_Init_Func)MatchFinder_Init;
++  vTable->GetIndexByte = (Mf_GetIndexByte_Func)MatchFinder_GetIndexByte;
++  vTable->GetNumAvailableBytes = (Mf_GetNumAvailableBytes_Func)MatchFinder_GetNumAvailableBytes;
++  vTable->GetPointerToCurrentPos = (Mf_GetPointerToCurrentPos_Func)MatchFinder_GetPointerToCurrentPos;
++  if (!p->btMode)
++  {
++    vTable->GetMatches = (Mf_GetMatches_Func)Hc4_MatchFinder_GetMatches;
++    vTable->Skip = (Mf_Skip_Func)Hc4_MatchFinder_Skip;
++  }
++  else if (p->numHashBytes == 2)
++  {
++    vTable->GetMatches = (Mf_GetMatches_Func)Bt2_MatchFinder_GetMatches;
++    vTable->Skip = (Mf_Skip_Func)Bt2_MatchFinder_Skip;
++  }
++  else if (p->numHashBytes == 3)
++  {
++    vTable->GetMatches = (Mf_GetMatches_Func)Bt3_MatchFinder_GetMatches;
++    vTable->Skip = (Mf_Skip_Func)Bt3_MatchFinder_Skip;
++  }
++  else
++  {
++    vTable->GetMatches = (Mf_GetMatches_Func)Bt4_MatchFinder_GetMatches;
++    vTable->Skip = (Mf_Skip_Func)Bt4_MatchFinder_Skip;
++  }
++}
+--- /dev/null
++++ b/lib/lzma/LzmaDec.c
+@@ -0,0 +1,999 @@
++/* LzmaDec.c -- LZMA Decoder
++2009-09-20 : Igor Pavlov : Public domain */
++
++#include "LzmaDec.h"
++
++#include <string.h>
++
++#define kNumTopBits 24
++#define kTopValue ((UInt32)1 << kNumTopBits)
++
++#define kNumBitModelTotalBits 11
++#define kBitModelTotal (1 << kNumBitModelTotalBits)
++#define kNumMoveBits 5
++
++#define RC_INIT_SIZE 5
++
++#define NORMALIZE if (range < kTopValue) { range <<= 8; code = (code << 8) | (*buf++); }
++
++#define IF_BIT_0(p) ttt = *(p); NORMALIZE; bound = (range >> kNumBitModelTotalBits) * ttt; if (code < bound)
++#define UPDATE_0(p) range = bound; *(p) = (CLzmaProb)(ttt + ((kBitModelTotal - ttt) >> kNumMoveBits));
++#define UPDATE_1(p) range -= bound; code -= bound; *(p) = (CLzmaProb)(ttt - (ttt >> kNumMoveBits));
++#define GET_BIT2(p, i, A0, A1) IF_BIT_0(p) \
++  { UPDATE_0(p); i = (i + i); A0; } else \
++  { UPDATE_1(p); i = (i + i) + 1; A1; }
++#define GET_BIT(p, i) GET_BIT2(p, i, ; , ;)
++
++#define TREE_GET_BIT(probs, i) { GET_BIT((probs + i), i); }
++#define TREE_DECODE(probs, limit, i) \
++  { i = 1; do { TREE_GET_BIT(probs, i); } while (i < limit); i -= limit; }
++
++/* #define _LZMA_SIZE_OPT */
++
++#ifdef _LZMA_SIZE_OPT
++#define TREE_6_DECODE(probs, i) TREE_DECODE(probs, (1 << 6), i)
++#else
++#define TREE_6_DECODE(probs, i) \
++  { i = 1; \
++  TREE_GET_BIT(probs, i); \
++  TREE_GET_BIT(probs, i); \
++  TREE_GET_BIT(probs, i); \
++  TREE_GET_BIT(probs, i); \
++  TREE_GET_BIT(probs, i); \
++  TREE_GET_BIT(probs, i); \
++  i -= 0x40; }
++#endif
++
++#define NORMALIZE_CHECK if (range < kTopValue) { if (buf >= bufLimit) return DUMMY_ERROR; range <<= 8; code = (code << 8) | (*buf++); }
++
++#define IF_BIT_0_CHECK(p) ttt = *(p); NORMALIZE_CHECK; bound = (range >> kNumBitModelTotalBits) * ttt; if (code < bound)
++#define UPDATE_0_CHECK range = bound;
++#define UPDATE_1_CHECK range -= bound; code -= bound;
++#define GET_BIT2_CHECK(p, i, A0, A1) IF_BIT_0_CHECK(p) \
++  { UPDATE_0_CHECK; i = (i + i); A0; } else \
++  { UPDATE_1_CHECK; i = (i + i) + 1; A1; }
++#define GET_BIT_CHECK(p, i) GET_BIT2_CHECK(p, i, ; , ;)
++#define TREE_DECODE_CHECK(probs, limit, i) \
++  { i = 1; do { GET_BIT_CHECK(probs + i, i) } while (i < limit); i -= limit; }
++
++
++#define kNumPosBitsMax 4
++#define kNumPosStatesMax (1 << kNumPosBitsMax)
++
++#define kLenNumLowBits 3
++#define kLenNumLowSymbols (1 << kLenNumLowBits)
++#define kLenNumMidBits 3
++#define kLenNumMidSymbols (1 << kLenNumMidBits)
++#define kLenNumHighBits 8
++#define kLenNumHighSymbols (1 << kLenNumHighBits)
++
++#define LenChoice 0
++#define LenChoice2 (LenChoice + 1)
++#define LenLow (LenChoice2 + 1)
++#define LenMid (LenLow + (kNumPosStatesMax << kLenNumLowBits))
++#define LenHigh (LenMid + (kNumPosStatesMax << kLenNumMidBits))
++#define kNumLenProbs (LenHigh + kLenNumHighSymbols)
++
++
++#define kNumStates 12
++#define kNumLitStates 7
++
++#define kStartPosModelIndex 4
++#define kEndPosModelIndex 14
++#define kNumFullDistances (1 << (kEndPosModelIndex >> 1))
++
++#define kNumPosSlotBits 6
++#define kNumLenToPosStates 4
++
++#define kNumAlignBits 4
++#define kAlignTableSize (1 << kNumAlignBits)
++
++#define kMatchMinLen 2
++#define kMatchSpecLenStart (kMatchMinLen + kLenNumLowSymbols + kLenNumMidSymbols + kLenNumHighSymbols)
++
++#define IsMatch 0
++#define IsRep (IsMatch + (kNumStates << kNumPosBitsMax))
++#define IsRepG0 (IsRep + kNumStates)
++#define IsRepG1 (IsRepG0 + kNumStates)
++#define IsRepG2 (IsRepG1 + kNumStates)
++#define IsRep0Long (IsRepG2 + kNumStates)
++#define PosSlot (IsRep0Long + (kNumStates << kNumPosBitsMax))
++#define SpecPos (PosSlot + (kNumLenToPosStates << kNumPosSlotBits))
++#define Align (SpecPos + kNumFullDistances - kEndPosModelIndex)
++#define LenCoder (Align + kAlignTableSize)
++#define RepLenCoder (LenCoder + kNumLenProbs)
++#define Literal (RepLenCoder + kNumLenProbs)
++
++#define LZMA_BASE_SIZE 1846
++#define LZMA_LIT_SIZE 768
++
++#define LzmaProps_GetNumProbs(p) ((UInt32)LZMA_BASE_SIZE + (LZMA_LIT_SIZE << ((p)->lc + (p)->lp)))
++
++#if Literal != LZMA_BASE_SIZE
++StopCompilingDueBUG
++#endif
++
++#define LZMA_DIC_MIN (1 << 12)
++
++/* First LZMA-symbol is always decoded.
++And it decodes new LZMA-symbols while (buf < bufLimit), but "buf" is without last normalization
++Out:
++  Result:
++    SZ_OK - OK
++    SZ_ERROR_DATA - Error
++  p->remainLen:
++    < kMatchSpecLenStart : normal remain
++    = kMatchSpecLenStart : finished
++    = kMatchSpecLenStart + 1 : Flush marker
++    = kMatchSpecLenStart + 2 : State Init Marker
++*/
++
++static int MY_FAST_CALL LzmaDec_DecodeReal(CLzmaDec *p, SizeT limit, const Byte *bufLimit)
++{
++  CLzmaProb *probs = p->probs;
++
++  unsigned state = p->state;
++  UInt32 rep0 = p->reps[0], rep1 = p->reps[1], rep2 = p->reps[2], rep3 = p->reps[3];
++  unsigned pbMask = ((unsigned)1 << (p->prop.pb)) - 1;
++  unsigned lpMask = ((unsigned)1 << (p->prop.lp)) - 1;
++  unsigned lc = p->prop.lc;
++
++  Byte *dic = p->dic;
++  SizeT dicBufSize = p->dicBufSize;
++  SizeT dicPos = p->dicPos;
++
++  UInt32 processedPos = p->processedPos;
++  UInt32 checkDicSize = p->checkDicSize;
++  unsigned len = 0;
++
++  const Byte *buf = p->buf;
++  UInt32 range = p->range;
++  UInt32 code = p->code;
++
++  do
++  {
++    CLzmaProb *prob;
++    UInt32 bound;
++    unsigned ttt;
++    unsigned posState = processedPos & pbMask;
++
++    prob = probs + IsMatch + (state << kNumPosBitsMax) + posState;
++    IF_BIT_0(prob)
++    {
++      unsigned symbol;
++      UPDATE_0(prob);
++      prob = probs + Literal;
++      if (checkDicSize != 0 || processedPos != 0)
++        prob += (LZMA_LIT_SIZE * (((processedPos & lpMask) << lc) +
++        (dic[(dicPos == 0 ? dicBufSize : dicPos) - 1] >> (8 - lc))));
++
++      if (state < kNumLitStates)
++      {
++        state -= (state < 4) ? state : 3;
++        symbol = 1;
++        do { GET_BIT(prob + symbol, symbol) } while (symbol < 0x100);
++      }
++      else
++      {
++        unsigned matchByte = p->dic[(dicPos - rep0) + ((dicPos < rep0) ? dicBufSize : 0)];
++        unsigned offs = 0x100;
++        state -= (state < 10) ? 3 : 6;
++        symbol = 1;
++        do
++        {
++          unsigned bit;
++          CLzmaProb *probLit;
++          matchByte <<= 1;
++          bit = (matchByte & offs);
++          probLit = prob + offs + bit + symbol;
++          GET_BIT2(probLit, symbol, offs &= ~bit, offs &= bit)
++        }
++        while (symbol < 0x100);
++      }
++      dic[dicPos++] = (Byte)symbol;
++      processedPos++;
++      continue;
++    }
++    else
++    {
++      UPDATE_1(prob);
++      prob = probs + IsRep + state;
++      IF_BIT_0(prob)
++      {
++        UPDATE_0(prob);
++        state += kNumStates;
++        prob = probs + LenCoder;
++      }
++      else
++      {
++        UPDATE_1(prob);
++        if (checkDicSize == 0 && processedPos == 0)
++          return SZ_ERROR_DATA;
++        prob = probs + IsRepG0 + state;
++        IF_BIT_0(prob)
++        {
++          UPDATE_0(prob);
++          prob = probs + IsRep0Long + (state << kNumPosBitsMax) + posState;
++          IF_BIT_0(prob)
++          {
++            UPDATE_0(prob);
++            dic[dicPos] = dic[(dicPos - rep0) + ((dicPos < rep0) ? dicBufSize : 0)];
++            dicPos++;
++            processedPos++;
++            state = state < kNumLitStates ? 9 : 11;
++            continue;
++          }
++          UPDATE_1(prob);
++        }
++        else
++        {
++          UInt32 distance;
++          UPDATE_1(prob);
++          prob = probs + IsRepG1 + state;
++          IF_BIT_0(prob)
++          {
++            UPDATE_0(prob);
++            distance = rep1;
++          }
++          else
++          {
++            UPDATE_1(prob);
++            prob = probs + IsRepG2 + state;
++            IF_BIT_0(prob)
++            {
++              UPDATE_0(prob);
++              distance = rep2;
++            }
++            else
++            {
++              UPDATE_1(prob);
++              distance = rep3;
++              rep3 = rep2;
++            }
++            rep2 = rep1;
++          }
++          rep1 = rep0;
++          rep0 = distance;
++        }
++        state = state < kNumLitStates ? 8 : 11;
++        prob = probs + RepLenCoder;
++      }
++      {
++        unsigned limit, offset;
++        CLzmaProb *probLen = prob + LenChoice;
++        IF_BIT_0(probLen)
++        {
++          UPDATE_0(probLen);
++          probLen = prob + LenLow + (posState << kLenNumLowBits);
++          offset = 0;
++          limit = (1 << kLenNumLowBits);
++        }
++        else
++        {
++          UPDATE_1(probLen);
++          probLen = prob + LenChoice2;
++          IF_BIT_0(probLen)
++          {
++            UPDATE_0(probLen);
++            probLen = prob + LenMid + (posState << kLenNumMidBits);
++            offset = kLenNumLowSymbols;
++            limit = (1 << kLenNumMidBits);
++          }
++          else
++          {
++            UPDATE_1(probLen);
++            probLen = prob + LenHigh;
++            offset = kLenNumLowSymbols + kLenNumMidSymbols;
++            limit = (1 << kLenNumHighBits);
++          }
++        }
++        TREE_DECODE(probLen, limit, len);
++        len += offset;
++      }
++
++      if (state >= kNumStates)
++      {
++        UInt32 distance;
++        prob = probs + PosSlot +
++            ((len < kNumLenToPosStates ? len : kNumLenToPosStates - 1) << kNumPosSlotBits);
++        TREE_6_DECODE(prob, distance);
++        if (distance >= kStartPosModelIndex)
++        {
++          unsigned posSlot = (unsigned)distance;
++          int numDirectBits = (int)(((distance >> 1) - 1));
++          distance = (2 | (distance & 1));
++          if (posSlot < kEndPosModelIndex)
++          {
++            distance <<= numDirectBits;
++            prob = probs + SpecPos + distance - posSlot - 1;
++            {
++              UInt32 mask = 1;
++              unsigned i = 1;
++              do
++              {
++                GET_BIT2(prob + i, i, ; , distance |= mask);
++                mask <<= 1;
++              }
++              while (--numDirectBits != 0);
++            }
++          }
++          else
++          {
++            numDirectBits -= kNumAlignBits;
++            do
++            {
++              NORMALIZE
++              range >>= 1;
++
++              {
++                UInt32 t;
++                code -= range;
++                t = (0 - ((UInt32)code >> 31)); /* (UInt32)((Int32)code >> 31) */
++                distance = (distance << 1) + (t + 1);
++                code += range & t;
++              }
++              /*
++              distance <<= 1;
++              if (code >= range)
++              {
++                code -= range;
++                distance |= 1;
++              }
++              */
++            }
++            while (--numDirectBits != 0);
++            prob = probs + Align;
++            distance <<= kNumAlignBits;
++            {
++              unsigned i = 1;
++              GET_BIT2(prob + i, i, ; , distance |= 1);
++              GET_BIT2(prob + i, i, ; , distance |= 2);
++              GET_BIT2(prob + i, i, ; , distance |= 4);
++              GET_BIT2(prob + i, i, ; , distance |= 8);
++            }
++            if (distance == (UInt32)0xFFFFFFFF)
++            {
++              len += kMatchSpecLenStart;
++              state -= kNumStates;
++              break;
++            }
++          }
++        }
++        rep3 = rep2;
++        rep2 = rep1;
++        rep1 = rep0;
++        rep0 = distance + 1;
++        if (checkDicSize == 0)
++        {
++          if (distance >= processedPos)
++            return SZ_ERROR_DATA;
++        }
++        else if (distance >= checkDicSize)
++          return SZ_ERROR_DATA;
++        state = (state < kNumStates + kNumLitStates) ? kNumLitStates : kNumLitStates + 3;
++      }
++
++      len += kMatchMinLen;
++
++      if (limit == dicPos)
++        return SZ_ERROR_DATA;
++      {
++        SizeT rem = limit - dicPos;
++        unsigned curLen = ((rem < len) ? (unsigned)rem : len);
++        SizeT pos = (dicPos - rep0) + ((dicPos < rep0) ? dicBufSize : 0);
++
++        processedPos += curLen;
++
++        len -= curLen;
++        if (pos + curLen <= dicBufSize)
++        {
++          Byte *dest = dic + dicPos;
++          ptrdiff_t src = (ptrdiff_t)pos - (ptrdiff_t)dicPos;
++          const Byte *lim = dest + curLen;
++          dicPos += curLen;
++          do
++            *(dest) = (Byte)*(dest + src);
++          while (++dest != lim);
++        }
++        else
++        {
++          do
++          {
++            dic[dicPos++] = dic[pos];
++            if (++pos == dicBufSize)
++              pos = 0;
++          }
++          while (--curLen != 0);
++        }
++      }
++    }
++  }
++  while (dicPos < limit && buf < bufLimit);
++  NORMALIZE;
++  p->buf = buf;
++  p->range = range;
++  p->code = code;
++  p->remainLen = len;
++  p->dicPos = dicPos;
++  p->processedPos = processedPos;
++  p->reps[0] = rep0;
++  p->reps[1] = rep1;
++  p->reps[2] = rep2;
++  p->reps[3] = rep3;
++  p->state = state;
++
++  return SZ_OK;
++}
++
++static void MY_FAST_CALL LzmaDec_WriteRem(CLzmaDec *p, SizeT limit)
++{
++  if (p->remainLen != 0 && p->remainLen < kMatchSpecLenStart)
++  {
++    Byte *dic = p->dic;
++    SizeT dicPos = p->dicPos;
++    SizeT dicBufSize = p->dicBufSize;
++    unsigned len = p->remainLen;
++    UInt32 rep0 = p->reps[0];
++    if (limit - dicPos < len)
++      len = (unsigned)(limit - dicPos);
++
++    if (p->checkDicSize == 0 && p->prop.dicSize - p->processedPos <= len)
++      p->checkDicSize = p->prop.dicSize;
++
++    p->processedPos += len;
++    p->remainLen -= len;
++    while (len-- != 0)
++    {
++      dic[dicPos] = dic[(dicPos - rep0) + ((dicPos < rep0) ? dicBufSize : 0)];
++      dicPos++;
++    }
++    p->dicPos = dicPos;
++  }
++}
++
++static int MY_FAST_CALL LzmaDec_DecodeReal2(CLzmaDec *p, SizeT limit, const Byte *bufLimit)
++{
++  do
++  {
++    SizeT limit2 = limit;
++    if (p->checkDicSize == 0)
++    {
++      UInt32 rem = p->prop.dicSize - p->processedPos;
++      if (limit - p->dicPos > rem)
++        limit2 = p->dicPos + rem;
++    }
++    RINOK(LzmaDec_DecodeReal(p, limit2, bufLimit));
++    if (p->processedPos >= p->prop.dicSize)
++      p->checkDicSize = p->prop.dicSize;
++    LzmaDec_WriteRem(p, limit);
++  }
++  while (p->dicPos < limit && p->buf < bufLimit && p->remainLen < kMatchSpecLenStart);
++
++  if (p->remainLen > kMatchSpecLenStart)
++  {
++    p->remainLen = kMatchSpecLenStart;
++  }
++  return 0;
++}
++
++typedef enum
++{
++  DUMMY_ERROR, /* unexpected end of input stream */
++  DUMMY_LIT,
++  DUMMY_MATCH,
++  DUMMY_REP
++} ELzmaDummy;
++
++static ELzmaDummy LzmaDec_TryDummy(const CLzmaDec *p, const Byte *buf, SizeT inSize)
++{
++  UInt32 range = p->range;
++  UInt32 code = p->code;
++  const Byte *bufLimit = buf + inSize;
++  CLzmaProb *probs = p->probs;
++  unsigned state = p->state;
++  ELzmaDummy res;
++
++  {
++    CLzmaProb *prob;
++    UInt32 bound;
++    unsigned ttt;
++    unsigned posState = (p->processedPos) & ((1 << p->prop.pb) - 1);
++
++    prob = probs + IsMatch + (state << kNumPosBitsMax) + posState;
++    IF_BIT_0_CHECK(prob)
++    {
++      UPDATE_0_CHECK
++
++      /* if (bufLimit - buf >= 7) return DUMMY_LIT; */
++
++      prob = probs + Literal;
++      if (p->checkDicSize != 0 || p->processedPos != 0)
++        prob += (LZMA_LIT_SIZE *
++          ((((p->processedPos) & ((1 << (p->prop.lp)) - 1)) << p->prop.lc) +
++          (p->dic[(p->dicPos == 0 ? p->dicBufSize : p->dicPos) - 1] >> (8 - p->prop.lc))));
++
++      if (state < kNumLitStates)
++      {
++        unsigned symbol = 1;
++        do { GET_BIT_CHECK(prob + symbol, symbol) } while (symbol < 0x100);
++      }
++      else
++      {
++        unsigned matchByte = p->dic[p->dicPos - p->reps[0] +
++            ((p->dicPos < p->reps[0]) ? p->dicBufSize : 0)];
++        unsigned offs = 0x100;
++        unsigned symbol = 1;
++        do
++        {
++          unsigned bit;
++          CLzmaProb *probLit;
++          matchByte <<= 1;
++          bit = (matchByte & offs);
++          probLit = prob + offs + bit + symbol;
++          GET_BIT2_CHECK(probLit, symbol, offs &= ~bit, offs &= bit)
++        }
++        while (symbol < 0x100);
++      }
++      res = DUMMY_LIT;
++    }
++    else
++    {
++      unsigned len;
++      UPDATE_1_CHECK;
++
++      prob = probs + IsRep + state;
++      IF_BIT_0_CHECK(prob)
++      {
++        UPDATE_0_CHECK;
++        state = 0;
++        prob = probs + LenCoder;
++        res = DUMMY_MATCH;
++      }
++      else
++      {
++        UPDATE_1_CHECK;
++        res = DUMMY_REP;
++        prob = probs + IsRepG0 + state;
++        IF_BIT_0_CHECK(prob)
++        {
++          UPDATE_0_CHECK;
++          prob = probs + IsRep0Long + (state << kNumPosBitsMax) + posState;
++          IF_BIT_0_CHECK(prob)
++          {
++            UPDATE_0_CHECK;
++            NORMALIZE_CHECK;
++            return DUMMY_REP;
++          }
++          else
++          {
++            UPDATE_1_CHECK;
++          }
++        }
++        else
++        {
++          UPDATE_1_CHECK;
++          prob = probs + IsRepG1 + state;
++          IF_BIT_0_CHECK(prob)
++          {
++            UPDATE_0_CHECK;
++          }
++          else
++          {
++            UPDATE_1_CHECK;
++            prob = probs + IsRepG2 + state;
++            IF_BIT_0_CHECK(prob)
++            {
++              UPDATE_0_CHECK;
++            }
++            else
++            {
++              UPDATE_1_CHECK;
++            }
++          }
++        }
++        state = kNumStates;
++        prob = probs + RepLenCoder;
++      }
++      {
++        unsigned limit, offset;
++        CLzmaProb *probLen = prob + LenChoice;
++        IF_BIT_0_CHECK(probLen)
++        {
++          UPDATE_0_CHECK;
++          probLen = prob + LenLow + (posState << kLenNumLowBits);
++          offset = 0;
++          limit = 1 << kLenNumLowBits;
++        }
++        else
++        {
++          UPDATE_1_CHECK;
++          probLen = prob + LenChoice2;
++          IF_BIT_0_CHECK(probLen)
++          {
++            UPDATE_0_CHECK;
++            probLen = prob + LenMid + (posState << kLenNumMidBits);
++            offset = kLenNumLowSymbols;
++            limit = 1 << kLenNumMidBits;
++          }
++          else
++          {
++            UPDATE_1_CHECK;
++            probLen = prob + LenHigh;
++            offset = kLenNumLowSymbols + kLenNumMidSymbols;
++            limit = 1 << kLenNumHighBits;
++          }
++        }
++        TREE_DECODE_CHECK(probLen, limit, len);
++        len += offset;
++      }
++
++      if (state < 4)
++      {
++        unsigned posSlot;
++        prob = probs + PosSlot +
++            ((len < kNumLenToPosStates ? len : kNumLenToPosStates - 1) <<
++            kNumPosSlotBits);
++        TREE_DECODE_CHECK(prob, 1 << kNumPosSlotBits, posSlot);
++        if (posSlot >= kStartPosModelIndex)
++        {
++          int numDirectBits = ((posSlot >> 1) - 1);
++
++          /* if (bufLimit - buf >= 8) return DUMMY_MATCH; */
++
++          if (posSlot < kEndPosModelIndex)
++          {
++            prob = probs + SpecPos + ((2 | (posSlot & 1)) << numDirectBits) - posSlot - 1;
++          }
++          else
++          {
++            numDirectBits -= kNumAlignBits;
++            do
++            {
++              NORMALIZE_CHECK
++              range >>= 1;
++              code -= range & (((code - range) >> 31) - 1);
++              /* if (code >= range) code -= range; */
++            }
++            while (--numDirectBits != 0);
++            prob = probs + Align;
++            numDirectBits = kNumAlignBits;
++          }
++          {
++            unsigned i = 1;
++            do
++            {
++              GET_BIT_CHECK(prob + i, i);
++            }
++            while (--numDirectBits != 0);
++          }
++        }
++      }
++    }
++  }
++  NORMALIZE_CHECK;
++  return res;
++}
++
++
++static void LzmaDec_InitRc(CLzmaDec *p, const Byte *data)
++{
++  p->code = ((UInt32)data[1] << 24) | ((UInt32)data[2] << 16) | ((UInt32)data[3] << 8) | ((UInt32)data[4]);
++  p->range = 0xFFFFFFFF;
++  p->needFlush = 0;
++}
++
++static void LzmaDec_InitDicAndState(CLzmaDec *p, Bool initDic, Bool initState)
++{
++  p->needFlush = 1;
++  p->remainLen = 0;
++  p->tempBufSize = 0;
++
++  if (initDic)
++  {
++    p->processedPos = 0;
++    p->checkDicSize = 0;
++    p->needInitState = 1;
++  }
++  if (initState)
++    p->needInitState = 1;
++}
++
++void LzmaDec_Init(CLzmaDec *p)
++{
++  p->dicPos = 0;
++  LzmaDec_InitDicAndState(p, True, True);
++}
++
++static void LzmaDec_InitStateReal(CLzmaDec *p)
++{
++  UInt32 numProbs = Literal + ((UInt32)LZMA_LIT_SIZE << (p->prop.lc + p->prop.lp));
++  UInt32 i;
++  CLzmaProb *probs = p->probs;
++  for (i = 0; i < numProbs; i++)
++    probs[i] = kBitModelTotal >> 1;
++  p->reps[0] = p->reps[1] = p->reps[2] = p->reps[3] = 1;
++  p->state = 0;
++  p->needInitState = 0;
++}
++
++SRes LzmaDec_DecodeToDic(CLzmaDec *p, SizeT dicLimit, const Byte *src, SizeT *srcLen,
++    ELzmaFinishMode finishMode, ELzmaStatus *status)
++{
++  SizeT inSize = *srcLen;
++  (*srcLen) = 0;
++  LzmaDec_WriteRem(p, dicLimit);
++
++  *status = LZMA_STATUS_NOT_SPECIFIED;
++
++  while (p->remainLen != kMatchSpecLenStart)
++  {
++      int checkEndMarkNow;
++
++      if (p->needFlush != 0)
++      {
++        for (; inSize > 0 && p->tempBufSize < RC_INIT_SIZE; (*srcLen)++, inSize--)
++          p->tempBuf[p->tempBufSize++] = *src++;
++        if (p->tempBufSize < RC_INIT_SIZE)
++        {
++          *status = LZMA_STATUS_NEEDS_MORE_INPUT;
++          return SZ_OK;
++        }
++        if (p->tempBuf[0] != 0)
++          return SZ_ERROR_DATA;
++
++        LzmaDec_InitRc(p, p->tempBuf);
++        p->tempBufSize = 0;
++      }
++
++      checkEndMarkNow = 0;
++      if (p->dicPos >= dicLimit)
++      {
++        if (p->remainLen == 0 && p->code == 0)
++        {
++          *status = LZMA_STATUS_MAYBE_FINISHED_WITHOUT_MARK;
++          return SZ_OK;
++        }
++        if (finishMode == LZMA_FINISH_ANY)
++        {
++          *status = LZMA_STATUS_NOT_FINISHED;
++          return SZ_OK;
++        }
++        if (p->remainLen != 0)
++        {
++          *status = LZMA_STATUS_NOT_FINISHED;
++          return SZ_ERROR_DATA;
++        }
++        checkEndMarkNow = 1;
++      }
++
++      if (p->needInitState)
++        LzmaDec_InitStateReal(p);
++
++      if (p->tempBufSize == 0)
++      {
++        SizeT processed;
++        const Byte *bufLimit;
++        if (inSize < LZMA_REQUIRED_INPUT_MAX || checkEndMarkNow)
++        {
++          int dummyRes = LzmaDec_TryDummy(p, src, inSize);
++          if (dummyRes == DUMMY_ERROR)
++          {
++            memcpy(p->tempBuf, src, inSize);
++            p->tempBufSize = (unsigned)inSize;
++            (*srcLen) += inSize;
++            *status = LZMA_STATUS_NEEDS_MORE_INPUT;
++            return SZ_OK;
++          }
++          if (checkEndMarkNow && dummyRes != DUMMY_MATCH)
++          {
++            *status = LZMA_STATUS_NOT_FINISHED;
++            return SZ_ERROR_DATA;
++          }
++          bufLimit = src;
++        }
++        else
++          bufLimit = src + inSize - LZMA_REQUIRED_INPUT_MAX;
++        p->buf = src;
++        if (LzmaDec_DecodeReal2(p, dicLimit, bufLimit) != 0)
++          return SZ_ERROR_DATA;
++        processed = (SizeT)(p->buf - src);
++        (*srcLen) += processed;
++        src += processed;
++        inSize -= processed;
++      }
++      else
++      {
++        unsigned rem = p->tempBufSize, lookAhead = 0;
++        while (rem < LZMA_REQUIRED_INPUT_MAX && lookAhead < inSize)
++          p->tempBuf[rem++] = src[lookAhead++];
++        p->tempBufSize = rem;
++        if (rem < LZMA_REQUIRED_INPUT_MAX || checkEndMarkNow)
++        {
++          int dummyRes = LzmaDec_TryDummy(p, p->tempBuf, rem);
++          if (dummyRes == DUMMY_ERROR)
++          {
++            (*srcLen) += lookAhead;
++            *status = LZMA_STATUS_NEEDS_MORE_INPUT;
++            return SZ_OK;
++          }
++          if (checkEndMarkNow && dummyRes != DUMMY_MATCH)
++          {
++            *status = LZMA_STATUS_NOT_FINISHED;
++            return SZ_ERROR_DATA;
++          }
++        }
++        p->buf = p->tempBuf;
++        if (LzmaDec_DecodeReal2(p, dicLimit, p->buf) != 0)
++          return SZ_ERROR_DATA;
++        lookAhead -= (rem - (unsigned)(p->buf - p->tempBuf));
++        (*srcLen) += lookAhead;
++        src += lookAhead;
++        inSize -= lookAhead;
++        p->tempBufSize = 0;
++      }
++  }
++  if (p->code == 0)
++    *status = LZMA_STATUS_FINISHED_WITH_MARK;
++  return (p->code == 0) ? SZ_OK : SZ_ERROR_DATA;
++}
++
++SRes LzmaDec_DecodeToBuf(CLzmaDec *p, Byte *dest, SizeT *destLen, const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status)
++{
++  SizeT outSize = *destLen;
++  SizeT inSize = *srcLen;
++  *srcLen = *destLen = 0;
++  for (;;)
++  {
++    SizeT inSizeCur = inSize, outSizeCur, dicPos;
++    ELzmaFinishMode curFinishMode;
++    SRes res;
++    if (p->dicPos == p->dicBufSize)
++      p->dicPos = 0;
++    dicPos = p->dicPos;
++    if (outSize > p->dicBufSize - dicPos)
++    {
++      outSizeCur = p->dicBufSize;
++      curFinishMode = LZMA_FINISH_ANY;
++    }
++    else
++    {
++      outSizeCur = dicPos + outSize;
++      curFinishMode = finishMode;
++    }
++
++    res = LzmaDec_DecodeToDic(p, outSizeCur, src, &inSizeCur, curFinishMode, status);
++    src += inSizeCur;
++    inSize -= inSizeCur;
++    *srcLen += inSizeCur;
++    outSizeCur = p->dicPos - dicPos;
++    memcpy(dest, p->dic + dicPos, outSizeCur);
++    dest += outSizeCur;
++    outSize -= outSizeCur;
++    *destLen += outSizeCur;
++    if (res != 0)
++      return res;
++    if (outSizeCur == 0 || outSize == 0)
++      return SZ_OK;
++  }
++}
++
++void LzmaDec_FreeProbs(CLzmaDec *p, ISzAlloc *alloc)
++{
++  alloc->Free(alloc, p->probs);
++  p->probs = 0;
++}
++
++static void LzmaDec_FreeDict(CLzmaDec *p, ISzAlloc *alloc)
++{
++  alloc->Free(alloc, p->dic);
++  p->dic = 0;
++}
++
++void LzmaDec_Free(CLzmaDec *p, ISzAlloc *alloc)
++{
++  LzmaDec_FreeProbs(p, alloc);
++  LzmaDec_FreeDict(p, alloc);
++}
++
++SRes LzmaProps_Decode(CLzmaProps *p, const Byte *data, unsigned size)
++{
++  UInt32 dicSize;
++  Byte d;
++
++  if (size < LZMA_PROPS_SIZE)
++    return SZ_ERROR_UNSUPPORTED;
++  else
++    dicSize = data[1] | ((UInt32)data[2] << 8) | ((UInt32)data[3] << 16) | ((UInt32)data[4] << 24);
++
++  if (dicSize < LZMA_DIC_MIN)
++    dicSize = LZMA_DIC_MIN;
++  p->dicSize = dicSize;
++
++  d = data[0];
++  if (d >= (9 * 5 * 5))
++    return SZ_ERROR_UNSUPPORTED;
++
++  p->lc = d % 9;
++  d /= 9;
++  p->pb = d / 5;
++  p->lp = d % 5;
++
++  return SZ_OK;
++}
++
++static SRes LzmaDec_AllocateProbs2(CLzmaDec *p, const CLzmaProps *propNew, ISzAlloc *alloc)
++{
++  UInt32 numProbs = LzmaProps_GetNumProbs(propNew);
++  if (p->probs == 0 || numProbs != p->numProbs)
++  {
++    LzmaDec_FreeProbs(p, alloc);
++    p->probs = (CLzmaProb *)alloc->Alloc(alloc, numProbs * sizeof(CLzmaProb));
++    p->numProbs = numProbs;
++    if (p->probs == 0)
++      return SZ_ERROR_MEM;
++  }
++  return SZ_OK;
++}
++
++SRes LzmaDec_AllocateProbs(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc)
++{
++  CLzmaProps propNew;
++  RINOK(LzmaProps_Decode(&propNew, props, propsSize));
++  RINOK(LzmaDec_AllocateProbs2(p, &propNew, alloc));
++  p->prop = propNew;
++  return SZ_OK;
++}
++
++SRes LzmaDec_Allocate(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc)
++{
++  CLzmaProps propNew;
++  SizeT dicBufSize;
++  RINOK(LzmaProps_Decode(&propNew, props, propsSize));
++  RINOK(LzmaDec_AllocateProbs2(p, &propNew, alloc));
++  dicBufSize = propNew.dicSize;
++  if (p->dic == 0 || dicBufSize != p->dicBufSize)
++  {
++    LzmaDec_FreeDict(p, alloc);
++    p->dic = (Byte *)alloc->Alloc(alloc, dicBufSize);
++    if (p->dic == 0)
++    {
++      LzmaDec_FreeProbs(p, alloc);
++      return SZ_ERROR_MEM;
++    }
++  }
++  p->dicBufSize = dicBufSize;
++  p->prop = propNew;
++  return SZ_OK;
++}
++
++SRes LzmaDecode(Byte *dest, SizeT *destLen, const Byte *src, SizeT *srcLen,
++    const Byte *propData, unsigned propSize, ELzmaFinishMode finishMode,
++    ELzmaStatus *status, ISzAlloc *alloc)
++{
++  CLzmaDec p;
++  SRes res;
++  SizeT inSize = *srcLen;
++  SizeT outSize = *destLen;
++  *srcLen = *destLen = 0;
++  if (inSize < RC_INIT_SIZE)
++    return SZ_ERROR_INPUT_EOF;
++
++  LzmaDec_Construct(&p);
++  res = LzmaDec_AllocateProbs(&p, propData, propSize, alloc);
++  if (res != 0)
++    return res;
++  p.dic = dest;
++  p.dicBufSize = outSize;
++
++  LzmaDec_Init(&p);
++
++  *srcLen = inSize;
++  res = LzmaDec_DecodeToDic(&p, outSize, src, srcLen, finishMode, status);
++
++  if (res == SZ_OK && *status == LZMA_STATUS_NEEDS_MORE_INPUT)
++    res = SZ_ERROR_INPUT_EOF;
++
++  (*destLen) = p.dicPos;
++  LzmaDec_FreeProbs(&p, alloc);
++  return res;
++}
+--- /dev/null
++++ b/lib/lzma/LzmaEnc.c
+@@ -0,0 +1,2271 @@
++/* LzmaEnc.c -- LZMA Encoder
++2009-11-24 : Igor Pavlov : Public domain */
++
++#include <string.h>
++
++/* #define SHOW_STAT */
++/* #define SHOW_STAT2 */
++
++#if defined(SHOW_STAT) || defined(SHOW_STAT2)
++#include <stdio.h>
++#endif
++
++#include "LzmaEnc.h"
++
++/* disable MT */
++#define _7ZIP_ST
++
++#include "LzFind.h"
++#ifndef _7ZIP_ST
++#include "LzFindMt.h"
++#endif
++
++#ifdef SHOW_STAT
++static int ttt = 0;
++#endif
++
++#define kBlockSizeMax ((1 << LZMA_NUM_BLOCK_SIZE_BITS) - 1)
++
++#define kBlockSize (9 << 10)
++#define kUnpackBlockSize (1 << 18)
++#define kMatchArraySize (1 << 21)
++#define kMatchRecordMaxSize ((LZMA_MATCH_LEN_MAX * 2 + 3) * LZMA_MATCH_LEN_MAX)
++
++#define kNumMaxDirectBits (31)
++
++#define kNumTopBits 24
++#define kTopValue ((UInt32)1 << kNumTopBits)
++
++#define kNumBitModelTotalBits 11
++#define kBitModelTotal (1 << kNumBitModelTotalBits)
++#define kNumMoveBits 5
++#define kProbInitValue (kBitModelTotal >> 1)
++
++#define kNumMoveReducingBits 4
++#define kNumBitPriceShiftBits 4
++#define kBitPrice (1 << kNumBitPriceShiftBits)
++
++void LzmaEncProps_Init(CLzmaEncProps *p)
++{
++  p->level = 5;
++  p->dictSize = p->mc = 0;
++  p->lc = p->lp = p->pb = p->algo = p->fb = p->btMode = p->numHashBytes = p->numThreads = -1;
++  p->writeEndMark = 0;
++}
++
++void LzmaEncProps_Normalize(CLzmaEncProps *p)
++{
++  int level = p->level;
++  if (level < 0) level = 5;
++  p->level = level;
++  if (p->dictSize == 0) p->dictSize = (level <= 5 ? (1 << (level * 2 + 14)) : (level == 6 ? (1 << 25) : (1 << 26)));
++  if (p->lc < 0) p->lc = 3;
++  if (p->lp < 0) p->lp = 0;
++  if (p->pb < 0) p->pb = 2;
++  if (p->algo < 0) p->algo = (level < 5 ? 0 : 1);
++  if (p->fb < 0) p->fb = (level < 7 ? 32 : 64);
++  if (p->btMode < 0) p->btMode = (p->algo == 0 ? 0 : 1);
++  if (p->numHashBytes < 0) p->numHashBytes = 4;
++  if (p->mc == 0)  p->mc = (16 + (p->fb >> 1)) >> (p->btMode ? 0 : 1);
++  if (p->numThreads < 0)
++    p->numThreads =
++      #ifndef _7ZIP_ST
++      ((p->btMode && p->algo) ? 2 : 1);
++      #else
++      1;
++      #endif
++}
++
++UInt32 LzmaEncProps_GetDictSize(const CLzmaEncProps *props2)
++{
++  CLzmaEncProps props = *props2;
++  LzmaEncProps_Normalize(&props);
++  return props.dictSize;
++}
++
++/* #define LZMA_LOG_BSR */
++/* Define it for Intel's CPU */
++
++
++#ifdef LZMA_LOG_BSR
++
++#define kDicLogSizeMaxCompress 30
++
++#define BSR2_RET(pos, res) { unsigned long i; _BitScanReverse(&i, (pos)); res = (i + i) + ((pos >> (i - 1)) & 1); }
++
++UInt32 GetPosSlot1(UInt32 pos)
++{
++  UInt32 res;
++  BSR2_RET(pos, res);
++  return res;
++}
++#define GetPosSlot2(pos, res) { BSR2_RET(pos, res); }
++#define GetPosSlot(pos, res) { if (pos < 2) res = pos; else BSR2_RET(pos, res); }
++
++#else
++
++#define kNumLogBits (9 + (int)sizeof(size_t) / 2)
++#define kDicLogSizeMaxCompress ((kNumLogBits - 1) * 2 + 7)
++
++static void LzmaEnc_FastPosInit(Byte *g_FastPos)
++{
++  int c = 2, slotFast;
++  g_FastPos[0] = 0;
++  g_FastPos[1] = 1;
++
++  for (slotFast = 2; slotFast < kNumLogBits * 2; slotFast++)
++  {
++    UInt32 k = (1 << ((slotFast >> 1) - 1));
++    UInt32 j;
++    for (j = 0; j < k; j++, c++)
++      g_FastPos[c] = (Byte)slotFast;
++  }
++}
++
++#define BSR2_RET(pos, res) { UInt32 i = 6 + ((kNumLogBits - 1) & \
++  (0 - (((((UInt32)1 << (kNumLogBits + 6)) - 1) - pos) >> 31))); \
++  res = p->g_FastPos[pos >> i] + (i * 2); }
++/*
++#define BSR2_RET(pos, res) { res = (pos < (1 << (kNumLogBits + 6))) ? \
++  p->g_FastPos[pos >> 6] + 12 : \
++  p->g_FastPos[pos >> (6 + kNumLogBits - 1)] + (6 + (kNumLogBits - 1)) * 2; }
++*/
++
++#define GetPosSlot1(pos) p->g_FastPos[pos]
++#define GetPosSlot2(pos, res) { BSR2_RET(pos, res); }
++#define GetPosSlot(pos, res) { if (pos < kNumFullDistances) res = p->g_FastPos[pos]; else BSR2_RET(pos, res); }
++
++#endif
++
++
++#define LZMA_NUM_REPS 4
++
++typedef unsigned CState;
++
++typedef struct
++{
++  UInt32 price;
++
++  CState state;
++  int prev1IsChar;
++  int prev2;
++
++  UInt32 posPrev2;
++  UInt32 backPrev2;
++
++  UInt32 posPrev;
++  UInt32 backPrev;
++  UInt32 backs[LZMA_NUM_REPS];
++} COptimal;
++
++#define kNumOpts (1 << 12)
++
++#define kNumLenToPosStates 4
++#define kNumPosSlotBits 6
++#define kDicLogSizeMin 0
++#define kDicLogSizeMax 32
++#define kDistTableSizeMax (kDicLogSizeMax * 2)
++
++
++#define kNumAlignBits 4
++#define kAlignTableSize (1 << kNumAlignBits)
++#define kAlignMask (kAlignTableSize - 1)
++
++#define kStartPosModelIndex 4
++#define kEndPosModelIndex 14
++#define kNumPosModels (kEndPosModelIndex - kStartPosModelIndex)
++
++#define kNumFullDistances (1 << (kEndPosModelIndex >> 1))
++
++#ifdef _LZMA_PROB32
++#define CLzmaProb UInt32
++#else
++#define CLzmaProb UInt16
++#endif
++
++#define LZMA_PB_MAX 4
++#define LZMA_LC_MAX 8
++#define LZMA_LP_MAX 4
++
++#define LZMA_NUM_PB_STATES_MAX (1 << LZMA_PB_MAX)
++
++
++#define kLenNumLowBits 3
++#define kLenNumLowSymbols (1 << kLenNumLowBits)
++#define kLenNumMidBits 3
++#define kLenNumMidSymbols (1 << kLenNumMidBits)
++#define kLenNumHighBits 8
++#define kLenNumHighSymbols (1 << kLenNumHighBits)
++
++#define kLenNumSymbolsTotal (kLenNumLowSymbols + kLenNumMidSymbols + kLenNumHighSymbols)
++
++#define LZMA_MATCH_LEN_MIN 2
++#define LZMA_MATCH_LEN_MAX (LZMA_MATCH_LEN_MIN + kLenNumSymbolsTotal - 1)
++
++#define kNumStates 12
++
++typedef struct
++{
++  CLzmaProb choice;
++  CLzmaProb choice2;
++  CLzmaProb low[LZMA_NUM_PB_STATES_MAX << kLenNumLowBits];
++  CLzmaProb mid[LZMA_NUM_PB_STATES_MAX << kLenNumMidBits];
++  CLzmaProb high[kLenNumHighSymbols];
++} CLenEnc;
++
++typedef struct
++{
++  CLenEnc p;
++  UInt32 prices[LZMA_NUM_PB_STATES_MAX][kLenNumSymbolsTotal];
++  UInt32 tableSize;
++  UInt32 counters[LZMA_NUM_PB_STATES_MAX];
++} CLenPriceEnc;
++
++typedef struct
++{
++  UInt32 range;
++  Byte cache;
++  UInt64 low;
++  UInt64 cacheSize;
++  Byte *buf;
++  Byte *bufLim;
++  Byte *bufBase;
++  ISeqOutStream *outStream;
++  UInt64 processed;
++  SRes res;
++} CRangeEnc;
++
++typedef struct
++{
++  CLzmaProb *litProbs;
++
++  CLzmaProb isMatch[kNumStates][LZMA_NUM_PB_STATES_MAX];
++  CLzmaProb isRep[kNumStates];
++  CLzmaProb isRepG0[kNumStates];
++  CLzmaProb isRepG1[kNumStates];
++  CLzmaProb isRepG2[kNumStates];
++  CLzmaProb isRep0Long[kNumStates][LZMA_NUM_PB_STATES_MAX];
++
++  CLzmaProb posSlotEncoder[kNumLenToPosStates][1 << kNumPosSlotBits];
++  CLzmaProb posEncoders[kNumFullDistances - kEndPosModelIndex];
++  CLzmaProb posAlignEncoder[1 << kNumAlignBits];
++
++  CLenPriceEnc lenEnc;
++  CLenPriceEnc repLenEnc;
++
++  UInt32 reps[LZMA_NUM_REPS];
++  UInt32 state;
++} CSaveState;
++
++typedef struct
++{
++  IMatchFinder matchFinder;
++  void *matchFinderObj;
++
++  #ifndef _7ZIP_ST
++  Bool mtMode;
++  CMatchFinderMt matchFinderMt;
++  #endif
++
++  CMatchFinder matchFinderBase;
++
++  #ifndef _7ZIP_ST
++  Byte pad[128];
++  #endif
++
++  UInt32 optimumEndIndex;
++  UInt32 optimumCurrentIndex;
++
++  UInt32 longestMatchLength;
++  UInt32 numPairs;
++  UInt32 numAvail;
++  COptimal opt[kNumOpts];
++
++  #ifndef LZMA_LOG_BSR
++  Byte g_FastPos[1 << kNumLogBits];
++  #endif
++
++  UInt32 ProbPrices[kBitModelTotal >> kNumMoveReducingBits];
++  UInt32 matches[LZMA_MATCH_LEN_MAX * 2 + 2 + 1];
++  UInt32 numFastBytes;
++  UInt32 additionalOffset;
++  UInt32 reps[LZMA_NUM_REPS];
++  UInt32 state;
++
++  UInt32 posSlotPrices[kNumLenToPosStates][kDistTableSizeMax];
++  UInt32 distancesPrices[kNumLenToPosStates][kNumFullDistances];
++  UInt32 alignPrices[kAlignTableSize];
++  UInt32 alignPriceCount;
++
++  UInt32 distTableSize;
++
++  unsigned lc, lp, pb;
++  unsigned lpMask, pbMask;
++
++  CLzmaProb *litProbs;
++
++  CLzmaProb isMatch[kNumStates][LZMA_NUM_PB_STATES_MAX];
++  CLzmaProb isRep[kNumStates];
++  CLzmaProb isRepG0[kNumStates];
++  CLzmaProb isRepG1[kNumStates];
++  CLzmaProb isRepG2[kNumStates];
++  CLzmaProb isRep0Long[kNumStates][LZMA_NUM_PB_STATES_MAX];
++
++  CLzmaProb posSlotEncoder[kNumLenToPosStates][1 << kNumPosSlotBits];
++  CLzmaProb posEncoders[kNumFullDistances - kEndPosModelIndex];
++  CLzmaProb posAlignEncoder[1 << kNumAlignBits];
++
++  CLenPriceEnc lenEnc;
++  CLenPriceEnc repLenEnc;
++
++  unsigned lclp;
++
++  Bool fastMode;
++
++  CRangeEnc rc;
++
++  Bool writeEndMark;
++  UInt64 nowPos64;
++  UInt32 matchPriceCount;
++  Bool finished;
++  Bool multiThread;
++
++  SRes result;
++  UInt32 dictSize;
++  UInt32 matchFinderCycles;
++
++  int needInit;
++
++  CSaveState saveState;
++} CLzmaEnc;
++
++/*void LzmaEnc_SaveState(CLzmaEncHandle pp)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  CSaveState *dest = &p->saveState;
++  int i;
++  dest->lenEnc = p->lenEnc;
++  dest->repLenEnc = p->repLenEnc;
++  dest->state = p->state;
++
++  for (i = 0; i < kNumStates; i++)
++  {
++    memcpy(dest->isMatch[i], p->isMatch[i], sizeof(p->isMatch[i]));
++    memcpy(dest->isRep0Long[i], p->isRep0Long[i], sizeof(p->isRep0Long[i]));
++  }
++  for (i = 0; i < kNumLenToPosStates; i++)
++    memcpy(dest->posSlotEncoder[i], p->posSlotEncoder[i], sizeof(p->posSlotEncoder[i]));
++  memcpy(dest->isRep, p->isRep, sizeof(p->isRep));
++  memcpy(dest->isRepG0, p->isRepG0, sizeof(p->isRepG0));
++  memcpy(dest->isRepG1, p->isRepG1, sizeof(p->isRepG1));
++  memcpy(dest->isRepG2, p->isRepG2, sizeof(p->isRepG2));
++  memcpy(dest->posEncoders, p->posEncoders, sizeof(p->posEncoders));
++  memcpy(dest->posAlignEncoder, p->posAlignEncoder, sizeof(p->posAlignEncoder));
++  memcpy(dest->reps, p->reps, sizeof(p->reps));
++  memcpy(dest->litProbs, p->litProbs, (0x300 << p->lclp) * sizeof(CLzmaProb));
++}*/
++
++/*void LzmaEnc_RestoreState(CLzmaEncHandle pp)
++{
++  CLzmaEnc *dest = (CLzmaEnc *)pp;
++  const CSaveState *p = &dest->saveState;
++  int i;
++  dest->lenEnc = p->lenEnc;
++  dest->repLenEnc = p->repLenEnc;
++  dest->state = p->state;
++
++  for (i = 0; i < kNumStates; i++)
++  {
++    memcpy(dest->isMatch[i], p->isMatch[i], sizeof(p->isMatch[i]));
++    memcpy(dest->isRep0Long[i], p->isRep0Long[i], sizeof(p->isRep0Long[i]));
++  }
++  for (i = 0; i < kNumLenToPosStates; i++)
++    memcpy(dest->posSlotEncoder[i], p->posSlotEncoder[i], sizeof(p->posSlotEncoder[i]));
++  memcpy(dest->isRep, p->isRep, sizeof(p->isRep));
++  memcpy(dest->isRepG0, p->isRepG0, sizeof(p->isRepG0));
++  memcpy(dest->isRepG1, p->isRepG1, sizeof(p->isRepG1));
++  memcpy(dest->isRepG2, p->isRepG2, sizeof(p->isRepG2));
++  memcpy(dest->posEncoders, p->posEncoders, sizeof(p->posEncoders));
++  memcpy(dest->posAlignEncoder, p->posAlignEncoder, sizeof(p->posAlignEncoder));
++  memcpy(dest->reps, p->reps, sizeof(p->reps));
++  memcpy(dest->litProbs, p->litProbs, (0x300 << dest->lclp) * sizeof(CLzmaProb));
++}*/
++
++SRes LzmaEnc_SetProps(CLzmaEncHandle pp, const CLzmaEncProps *props2)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  CLzmaEncProps props = *props2;
++  LzmaEncProps_Normalize(&props);
++
++  if (props.lc > LZMA_LC_MAX || props.lp > LZMA_LP_MAX || props.pb > LZMA_PB_MAX ||
++      props.dictSize > (1 << kDicLogSizeMaxCompress) || props.dictSize > (1 << 30))
++    return SZ_ERROR_PARAM;
++  p->dictSize = props.dictSize;
++  p->matchFinderCycles = props.mc;
++  {
++    unsigned fb = props.fb;
++    if (fb < 5)
++      fb = 5;
++    if (fb > LZMA_MATCH_LEN_MAX)
++      fb = LZMA_MATCH_LEN_MAX;
++    p->numFastBytes = fb;
++  }
++  p->lc = props.lc;
++  p->lp = props.lp;
++  p->pb = props.pb;
++  p->fastMode = (props.algo == 0);
++  p->matchFinderBase.btMode = props.btMode;
++  {
++    UInt32 numHashBytes = 4;
++    if (props.btMode)
++    {
++      if (props.numHashBytes < 2)
++        numHashBytes = 2;
++      else if (props.numHashBytes < 4)
++        numHashBytes = props.numHashBytes;
++    }
++    p->matchFinderBase.numHashBytes = numHashBytes;
++  }
++
++  p->matchFinderBase.cutValue = props.mc;
++
++  p->writeEndMark = props.writeEndMark;
++
++  #ifndef _7ZIP_ST
++  /*
++  if (newMultiThread != _multiThread)
++  {
++    ReleaseMatchFinder();
++    _multiThread = newMultiThread;
++  }
++  */
++  p->multiThread = (props.numThreads > 1);
++  #endif
++
++  return SZ_OK;
++}
++
++static const int kLiteralNextStates[kNumStates] = {0, 0, 0, 0, 1, 2, 3, 4,  5,  6,   4, 5};
++static const int kMatchNextStates[kNumStates]   = {7, 7, 7, 7, 7, 7, 7, 10, 10, 10, 10, 10};
++static const int kRepNextStates[kNumStates]     = {8, 8, 8, 8, 8, 8, 8, 11, 11, 11, 11, 11};
++static const int kShortRepNextStates[kNumStates]= {9, 9, 9, 9, 9, 9, 9, 11, 11, 11, 11, 11};
++
++#define IsCharState(s) ((s) < 7)
++
++#define GetLenToPosState(len) (((len) < kNumLenToPosStates + 1) ? (len) - 2 : kNumLenToPosStates - 1)
++
++#define kInfinityPrice (1 << 30)
++
++static void RangeEnc_Construct(CRangeEnc *p)
++{
++  p->outStream = 0;
++  p->bufBase = 0;
++}
++
++#define RangeEnc_GetProcessed(p) ((p)->processed + ((p)->buf - (p)->bufBase) + (p)->cacheSize)
++
++#define RC_BUF_SIZE (1 << 16)
++static int RangeEnc_Alloc(CRangeEnc *p, ISzAlloc *alloc)
++{
++  if (p->bufBase == 0)
++  {
++    p->bufBase = (Byte *)alloc->Alloc(alloc, RC_BUF_SIZE);
++    if (p->bufBase == 0)
++      return 0;
++    p->bufLim = p->bufBase + RC_BUF_SIZE;
++  }
++  return 1;
++}
++
++static void RangeEnc_Free(CRangeEnc *p, ISzAlloc *alloc)
++{
++  alloc->Free(alloc, p->bufBase);
++  p->bufBase = 0;
++}
++
++static void RangeEnc_Init(CRangeEnc *p)
++{
++  /* Stream.Init(); */
++  p->low = 0;
++  p->range = 0xFFFFFFFF;
++  p->cacheSize = 1;
++  p->cache = 0;
++
++  p->buf = p->bufBase;
++
++  p->processed = 0;
++  p->res = SZ_OK;
++}
++
++static void RangeEnc_FlushStream(CRangeEnc *p)
++{
++  size_t num;
++  if (p->res != SZ_OK)
++    return;
++  num = p->buf - p->bufBase;
++  if (num != p->outStream->Write(p->outStream, p->bufBase, num))
++    p->res = SZ_ERROR_WRITE;
++  p->processed += num;
++  p->buf = p->bufBase;
++}
++
++static void MY_FAST_CALL RangeEnc_ShiftLow(CRangeEnc *p)
++{
++  if ((UInt32)p->low < (UInt32)0xFF000000 || (int)(p->low >> 32) != 0)
++  {
++    Byte temp = p->cache;
++    do
++    {
++      Byte *buf = p->buf;
++      *buf++ = (Byte)(temp + (Byte)(p->low >> 32));
++      p->buf = buf;
++      if (buf == p->bufLim)
++        RangeEnc_FlushStream(p);
++      temp = 0xFF;
++    }
++    while (--p->cacheSize != 0);
++    p->cache = (Byte)((UInt32)p->low >> 24);
++  }
++  p->cacheSize++;
++  p->low = (UInt32)p->low << 8;
++}
++
++static void RangeEnc_FlushData(CRangeEnc *p)
++{
++  int i;
++  for (i = 0; i < 5; i++)
++    RangeEnc_ShiftLow(p);
++}
++
++static void RangeEnc_EncodeDirectBits(CRangeEnc *p, UInt32 value, int numBits)
++{
++  do
++  {
++    p->range >>= 1;
++    p->low += p->range & (0 - ((value >> --numBits) & 1));
++    if (p->range < kTopValue)
++    {
++      p->range <<= 8;
++      RangeEnc_ShiftLow(p);
++    }
++  }
++  while (numBits != 0);
++}
++
++static void RangeEnc_EncodeBit(CRangeEnc *p, CLzmaProb *prob, UInt32 symbol)
++{
++  UInt32 ttt = *prob;
++  UInt32 newBound = (p->range >> kNumBitModelTotalBits) * ttt;
++  if (symbol == 0)
++  {
++    p->range = newBound;
++    ttt += (kBitModelTotal - ttt) >> kNumMoveBits;
++  }
++  else
++  {
++    p->low += newBound;
++    p->range -= newBound;
++    ttt -= ttt >> kNumMoveBits;
++  }
++  *prob = (CLzmaProb)ttt;
++  if (p->range < kTopValue)
++  {
++    p->range <<= 8;
++    RangeEnc_ShiftLow(p);
++  }
++}
++
++static void LitEnc_Encode(CRangeEnc *p, CLzmaProb *probs, UInt32 symbol)
++{
++  symbol |= 0x100;
++  do
++  {
++    RangeEnc_EncodeBit(p, probs + (symbol >> 8), (symbol >> 7) & 1);
++    symbol <<= 1;
++  }
++  while (symbol < 0x10000);
++}
++
++static void LitEnc_EncodeMatched(CRangeEnc *p, CLzmaProb *probs, UInt32 symbol, UInt32 matchByte)
++{
++  UInt32 offs = 0x100;
++  symbol |= 0x100;
++  do
++  {
++    matchByte <<= 1;
++    RangeEnc_EncodeBit(p, probs + (offs + (matchByte & offs) + (symbol >> 8)), (symbol >> 7) & 1);
++    symbol <<= 1;
++    offs &= ~(matchByte ^ symbol);
++  }
++  while (symbol < 0x10000);
++}
++
++static void LzmaEnc_InitPriceTables(UInt32 *ProbPrices)
++{
++  UInt32 i;
++  for (i = (1 << kNumMoveReducingBits) / 2; i < kBitModelTotal; i += (1 << kNumMoveReducingBits))
++  {
++    const int kCyclesBits = kNumBitPriceShiftBits;
++    UInt32 w = i;
++    UInt32 bitCount = 0;
++    int j;
++    for (j = 0; j < kCyclesBits; j++)
++    {
++      w = w * w;
++      bitCount <<= 1;
++      while (w >= ((UInt32)1 << 16))
++      {
++        w >>= 1;
++        bitCount++;
++      }
++    }
++    ProbPrices[i >> kNumMoveReducingBits] = ((kNumBitModelTotalBits << kCyclesBits) - 15 - bitCount);
++  }
++}
++
++
++#define GET_PRICE(prob, symbol) \
++  p->ProbPrices[((prob) ^ (((-(int)(symbol))) & (kBitModelTotal - 1))) >> kNumMoveReducingBits];
++
++#define GET_PRICEa(prob, symbol) \
++  ProbPrices[((prob) ^ ((-((int)(symbol))) & (kBitModelTotal - 1))) >> kNumMoveReducingBits];
++
++#define GET_PRICE_0(prob) p->ProbPrices[(prob) >> kNumMoveReducingBits]
++#define GET_PRICE_1(prob) p->ProbPrices[((prob) ^ (kBitModelTotal - 1)) >> kNumMoveReducingBits]
++
++#define GET_PRICE_0a(prob) ProbPrices[(prob) >> kNumMoveReducingBits]
++#define GET_PRICE_1a(prob) ProbPrices[((prob) ^ (kBitModelTotal - 1)) >> kNumMoveReducingBits]
++
++static UInt32 LitEnc_GetPrice(const CLzmaProb *probs, UInt32 symbol, UInt32 *ProbPrices)
++{
++  UInt32 price = 0;
++  symbol |= 0x100;
++  do
++  {
++    price += GET_PRICEa(probs[symbol >> 8], (symbol >> 7) & 1);
++    symbol <<= 1;
++  }
++  while (symbol < 0x10000);
++  return price;
++}
++
++static UInt32 LitEnc_GetPriceMatched(const CLzmaProb *probs, UInt32 symbol, UInt32 matchByte, UInt32 *ProbPrices)
++{
++  UInt32 price = 0;
++  UInt32 offs = 0x100;
++  symbol |= 0x100;
++  do
++  {
++    matchByte <<= 1;
++    price += GET_PRICEa(probs[offs + (matchByte & offs) + (symbol >> 8)], (symbol >> 7) & 1);
++    symbol <<= 1;
++    offs &= ~(matchByte ^ symbol);
++  }
++  while (symbol < 0x10000);
++  return price;
++}
++
++
++static void RcTree_Encode(CRangeEnc *rc, CLzmaProb *probs, int numBitLevels, UInt32 symbol)
++{
++  UInt32 m = 1;
++  int i;
++  for (i = numBitLevels; i != 0;)
++  {
++    UInt32 bit;
++    i--;
++    bit = (symbol >> i) & 1;
++    RangeEnc_EncodeBit(rc, probs + m, bit);
++    m = (m << 1) | bit;
++  }
++}
++
++static void RcTree_ReverseEncode(CRangeEnc *rc, CLzmaProb *probs, int numBitLevels, UInt32 symbol)
++{
++  UInt32 m = 1;
++  int i;
++  for (i = 0; i < numBitLevels; i++)
++  {
++    UInt32 bit = symbol & 1;
++    RangeEnc_EncodeBit(rc, probs + m, bit);
++    m = (m << 1) | bit;
++    symbol >>= 1;
++  }
++}
++
++static UInt32 RcTree_GetPrice(const CLzmaProb *probs, int numBitLevels, UInt32 symbol, UInt32 *ProbPrices)
++{
++  UInt32 price = 0;
++  symbol |= (1 << numBitLevels);
++  while (symbol != 1)
++  {
++    price += GET_PRICEa(probs[symbol >> 1], symbol & 1);
++    symbol >>= 1;
++  }
++  return price;
++}
++
++static UInt32 RcTree_ReverseGetPrice(const CLzmaProb *probs, int numBitLevels, UInt32 symbol, UInt32 *ProbPrices)
++{
++  UInt32 price = 0;
++  UInt32 m = 1;
++  int i;
++  for (i = numBitLevels; i != 0; i--)
++  {
++    UInt32 bit = symbol & 1;
++    symbol >>= 1;
++    price += GET_PRICEa(probs[m], bit);
++    m = (m << 1) | bit;
++  }
++  return price;
++}
++
++
++static void LenEnc_Init(CLenEnc *p)
++{
++  unsigned i;
++  p->choice = p->choice2 = kProbInitValue;
++  for (i = 0; i < (LZMA_NUM_PB_STATES_MAX << kLenNumLowBits); i++)
++    p->low[i] = kProbInitValue;
++  for (i = 0; i < (LZMA_NUM_PB_STATES_MAX << kLenNumMidBits); i++)
++    p->mid[i] = kProbInitValue;
++  for (i = 0; i < kLenNumHighSymbols; i++)
++    p->high[i] = kProbInitValue;
++}
++
++static void LenEnc_Encode(CLenEnc *p, CRangeEnc *rc, UInt32 symbol, UInt32 posState)
++{
++  if (symbol < kLenNumLowSymbols)
++  {
++    RangeEnc_EncodeBit(rc, &p->choice, 0);
++    RcTree_Encode(rc, p->low + (posState << kLenNumLowBits), kLenNumLowBits, symbol);
++  }
++  else
++  {
++    RangeEnc_EncodeBit(rc, &p->choice, 1);
++    if (symbol < kLenNumLowSymbols + kLenNumMidSymbols)
++    {
++      RangeEnc_EncodeBit(rc, &p->choice2, 0);
++      RcTree_Encode(rc, p->mid + (posState << kLenNumMidBits), kLenNumMidBits, symbol - kLenNumLowSymbols);
++    }
++    else
++    {
++      RangeEnc_EncodeBit(rc, &p->choice2, 1);
++      RcTree_Encode(rc, p->high, kLenNumHighBits, symbol - kLenNumLowSymbols - kLenNumMidSymbols);
++    }
++  }
++}
++
++static void LenEnc_SetPrices(CLenEnc *p, UInt32 posState, UInt32 numSymbols, UInt32 *prices, UInt32 *ProbPrices)
++{
++  UInt32 a0 = GET_PRICE_0a(p->choice);
++  UInt32 a1 = GET_PRICE_1a(p->choice);
++  UInt32 b0 = a1 + GET_PRICE_0a(p->choice2);
++  UInt32 b1 = a1 + GET_PRICE_1a(p->choice2);
++  UInt32 i = 0;
++  for (i = 0; i < kLenNumLowSymbols; i++)
++  {
++    if (i >= numSymbols)
++      return;
++    prices[i] = a0 + RcTree_GetPrice(p->low + (posState << kLenNumLowBits), kLenNumLowBits, i, ProbPrices);
++  }
++  for (; i < kLenNumLowSymbols + kLenNumMidSymbols; i++)
++  {
++    if (i >= numSymbols)
++      return;
++    prices[i] = b0 + RcTree_GetPrice(p->mid + (posState << kLenNumMidBits), kLenNumMidBits, i - kLenNumLowSymbols, ProbPrices);
++  }
++  for (; i < numSymbols; i++)
++    prices[i] = b1 + RcTree_GetPrice(p->high, kLenNumHighBits, i - kLenNumLowSymbols - kLenNumMidSymbols, ProbPrices);
++}
++
++static void MY_FAST_CALL LenPriceEnc_UpdateTable(CLenPriceEnc *p, UInt32 posState, UInt32 *ProbPrices)
++{
++  LenEnc_SetPrices(&p->p, posState, p->tableSize, p->prices[posState], ProbPrices);
++  p->counters[posState] = p->tableSize;
++}
++
++static void LenPriceEnc_UpdateTables(CLenPriceEnc *p, UInt32 numPosStates, UInt32 *ProbPrices)
++{
++  UInt32 posState;
++  for (posState = 0; posState < numPosStates; posState++)
++    LenPriceEnc_UpdateTable(p, posState, ProbPrices);
++}
++
++static void LenEnc_Encode2(CLenPriceEnc *p, CRangeEnc *rc, UInt32 symbol, UInt32 posState, Bool updatePrice, UInt32 *ProbPrices)
++{
++  LenEnc_Encode(&p->p, rc, symbol, posState);
++  if (updatePrice)
++    if (--p->counters[posState] == 0)
++      LenPriceEnc_UpdateTable(p, posState, ProbPrices);
++}
++
++
++
++
++static void MovePos(CLzmaEnc *p, UInt32 num)
++{
++  #ifdef SHOW_STAT
++  ttt += num;
++  printf("\n MovePos %d", num);
++  #endif
++  if (num != 0)
++  {
++    p->additionalOffset += num;
++    p->matchFinder.Skip(p->matchFinderObj, num);
++  }
++}
++
++static UInt32 ReadMatchDistances(CLzmaEnc *p, UInt32 *numDistancePairsRes)
++{
++  UInt32 lenRes = 0, numPairs;
++  p->numAvail = p->matchFinder.GetNumAvailableBytes(p->matchFinderObj);
++  numPairs = p->matchFinder.GetMatches(p->matchFinderObj, p->matches);
++  #ifdef SHOW_STAT
++  printf("\n i = %d numPairs = %d    ", ttt, numPairs / 2);
++  ttt++;
++  {
++    UInt32 i;
++    for (i = 0; i < numPairs; i += 2)
++      printf("%2d %6d   | ", p->matches[i], p->matches[i + 1]);
++  }
++  #endif
++  if (numPairs > 0)
++  {
++    lenRes = p->matches[numPairs - 2];
++    if (lenRes == p->numFastBytes)
++    {
++      const Byte *pby = p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - 1;
++      UInt32 distance = p->matches[numPairs - 1] + 1;
++      UInt32 numAvail = p->numAvail;
++      if (numAvail > LZMA_MATCH_LEN_MAX)
++        numAvail = LZMA_MATCH_LEN_MAX;
++      {
++        const Byte *pby2 = pby - distance;
++        for (; lenRes < numAvail && pby[lenRes] == pby2[lenRes]; lenRes++);
++      }
++    }
++  }
++  p->additionalOffset++;
++  *numDistancePairsRes = numPairs;
++  return lenRes;
++}
++
++
++#define MakeAsChar(p) (p)->backPrev = (UInt32)(-1); (p)->prev1IsChar = False;
++#define MakeAsShortRep(p) (p)->backPrev = 0; (p)->prev1IsChar = False;
++#define IsShortRep(p) ((p)->backPrev == 0)
++
++static UInt32 GetRepLen1Price(CLzmaEnc *p, UInt32 state, UInt32 posState)
++{
++  return
++    GET_PRICE_0(p->isRepG0[state]) +
++    GET_PRICE_0(p->isRep0Long[state][posState]);
++}
++
++static UInt32 GetPureRepPrice(CLzmaEnc *p, UInt32 repIndex, UInt32 state, UInt32 posState)
++{
++  UInt32 price;
++  if (repIndex == 0)
++  {
++    price = GET_PRICE_0(p->isRepG0[state]);
++    price += GET_PRICE_1(p->isRep0Long[state][posState]);
++  }
++  else
++  {
++    price = GET_PRICE_1(p->isRepG0[state]);
++    if (repIndex == 1)
++      price += GET_PRICE_0(p->isRepG1[state]);
++    else
++    {
++      price += GET_PRICE_1(p->isRepG1[state]);
++      price += GET_PRICE(p->isRepG2[state], repIndex - 2);
++    }
++  }
++  return price;
++}
++
++static UInt32 GetRepPrice(CLzmaEnc *p, UInt32 repIndex, UInt32 len, UInt32 state, UInt32 posState)
++{
++  return p->repLenEnc.prices[posState][len - LZMA_MATCH_LEN_MIN] +
++    GetPureRepPrice(p, repIndex, state, posState);
++}
++
++static UInt32 Backward(CLzmaEnc *p, UInt32 *backRes, UInt32 cur)
++{
++  UInt32 posMem = p->opt[cur].posPrev;
++  UInt32 backMem = p->opt[cur].backPrev;
++  p->optimumEndIndex = cur;
++  do
++  {
++    if (p->opt[cur].prev1IsChar)
++    {
++      MakeAsChar(&p->opt[posMem])
++      p->opt[posMem].posPrev = posMem - 1;
++      if (p->opt[cur].prev2)
++      {
++        p->opt[posMem - 1].prev1IsChar = False;
++        p->opt[posMem - 1].posPrev = p->opt[cur].posPrev2;
++        p->opt[posMem - 1].backPrev = p->opt[cur].backPrev2;
++      }
++    }
++    {
++      UInt32 posPrev = posMem;
++      UInt32 backCur = backMem;
++
++      backMem = p->opt[posPrev].backPrev;
++      posMem = p->opt[posPrev].posPrev;
++
++      p->opt[posPrev].backPrev = backCur;
++      p->opt[posPrev].posPrev = cur;
++      cur = posPrev;
++    }
++  }
++  while (cur != 0);
++  *backRes = p->opt[0].backPrev;
++  p->optimumCurrentIndex  = p->opt[0].posPrev;
++  return p->optimumCurrentIndex;
++}
++
++#define LIT_PROBS(pos, prevByte) (p->litProbs + ((((pos) & p->lpMask) << p->lc) + ((prevByte) >> (8 - p->lc))) * 0x300)
++
++static UInt32 GetOptimum(CLzmaEnc *p, UInt32 position, UInt32 *backRes)
++{
++  UInt32 numAvail, mainLen, numPairs, repMaxIndex, i, posState, lenEnd, len, cur;
++  UInt32 matchPrice, repMatchPrice, normalMatchPrice;
++  UInt32 reps[LZMA_NUM_REPS], repLens[LZMA_NUM_REPS];
++  UInt32 *matches;
++  const Byte *data;
++  Byte curByte, matchByte;
++  if (p->optimumEndIndex != p->optimumCurrentIndex)
++  {
++    const COptimal *opt = &p->opt[p->optimumCurrentIndex];
++    UInt32 lenRes = opt->posPrev - p->optimumCurrentIndex;
++    *backRes = opt->backPrev;
++    p->optimumCurrentIndex = opt->posPrev;
++    return lenRes;
++  }
++  p->optimumCurrentIndex = p->optimumEndIndex = 0;
++
++  if (p->additionalOffset == 0)
++    mainLen = ReadMatchDistances(p, &numPairs);
++  else
++  {
++    mainLen = p->longestMatchLength;
++    numPairs = p->numPairs;
++  }
++
++  numAvail = p->numAvail;
++  if (numAvail < 2)
++  {
++    *backRes = (UInt32)(-1);
++    return 1;
++  }
++  if (numAvail > LZMA_MATCH_LEN_MAX)
++    numAvail = LZMA_MATCH_LEN_MAX;
++
++  data = p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - 1;
++  repMaxIndex = 0;
++  for (i = 0; i < LZMA_NUM_REPS; i++)
++  {
++    UInt32 lenTest;
++    const Byte *data2;
++    reps[i] = p->reps[i];
++    data2 = data - (reps[i] + 1);
++    if (data[0] != data2[0] || data[1] != data2[1])
++    {
++      repLens[i] = 0;
++      continue;
++    }
++    for (lenTest = 2; lenTest < numAvail && data[lenTest] == data2[lenTest]; lenTest++);
++    repLens[i] = lenTest;
++    if (lenTest > repLens[repMaxIndex])
++      repMaxIndex = i;
++  }
++  if (repLens[repMaxIndex] >= p->numFastBytes)
++  {
++    UInt32 lenRes;
++    *backRes = repMaxIndex;
++    lenRes = repLens[repMaxIndex];
++    MovePos(p, lenRes - 1);
++    return lenRes;
++  }
++
++  matches = p->matches;
++  if (mainLen >= p->numFastBytes)
++  {
++    *backRes = matches[numPairs - 1] + LZMA_NUM_REPS;
++    MovePos(p, mainLen - 1);
++    return mainLen;
++  }
++  curByte = *data;
++  matchByte = *(data - (reps[0] + 1));
++
++  if (mainLen < 2 && curByte != matchByte && repLens[repMaxIndex] < 2)
++  {
++    *backRes = (UInt32)-1;
++    return 1;
++  }
++
++  p->opt[0].state = (CState)p->state;
++
++  posState = (position & p->pbMask);
++
++  {
++    const CLzmaProb *probs = LIT_PROBS(position, *(data - 1));
++    p->opt[1].price = GET_PRICE_0(p->isMatch[p->state][posState]) +
++        (!IsCharState(p->state) ?
++          LitEnc_GetPriceMatched(probs, curByte, matchByte, p->ProbPrices) :
++          LitEnc_GetPrice(probs, curByte, p->ProbPrices));
++  }
++
++  MakeAsChar(&p->opt[1]);
++
++  matchPrice = GET_PRICE_1(p->isMatch[p->state][posState]);
++  repMatchPrice = matchPrice + GET_PRICE_1(p->isRep[p->state]);
++
++  if (matchByte == curByte)
++  {
++    UInt32 shortRepPrice = repMatchPrice + GetRepLen1Price(p, p->state, posState);
++    if (shortRepPrice < p->opt[1].price)
++    {
++      p->opt[1].price = shortRepPrice;
++      MakeAsShortRep(&p->opt[1]);
++    }
++  }
++  lenEnd = ((mainLen >= repLens[repMaxIndex]) ? mainLen : repLens[repMaxIndex]);
++
++  if (lenEnd < 2)
++  {
++    *backRes = p->opt[1].backPrev;
++    return 1;
++  }
++
++  p->opt[1].posPrev = 0;
++  for (i = 0; i < LZMA_NUM_REPS; i++)
++    p->opt[0].backs[i] = reps[i];
++
++  len = lenEnd;
++  do
++    p->opt[len--].price = kInfinityPrice;
++  while (len >= 2);
++
++  for (i = 0; i < LZMA_NUM_REPS; i++)
++  {
++    UInt32 repLen = repLens[i];
++    UInt32 price;
++    if (repLen < 2)
++      continue;
++    price = repMatchPrice + GetPureRepPrice(p, i, p->state, posState);
++    do
++    {
++      UInt32 curAndLenPrice = price + p->repLenEnc.prices[posState][repLen - 2];
++      COptimal *opt = &p->opt[repLen];
++      if (curAndLenPrice < opt->price)
++      {
++        opt->price = curAndLenPrice;
++        opt->posPrev = 0;
++        opt->backPrev = i;
++        opt->prev1IsChar = False;
++      }
++    }
++    while (--repLen >= 2);
++  }
++
++  normalMatchPrice = matchPrice + GET_PRICE_0(p->isRep[p->state]);
++
++  len = ((repLens[0] >= 2) ? repLens[0] + 1 : 2);
++  if (len <= mainLen)
++  {
++    UInt32 offs = 0;
++    while (len > matches[offs])
++      offs += 2;
++    for (; ; len++)
++    {
++      COptimal *opt;
++      UInt32 distance = matches[offs + 1];
++
++      UInt32 curAndLenPrice = normalMatchPrice + p->lenEnc.prices[posState][len - LZMA_MATCH_LEN_MIN];
++      UInt32 lenToPosState = GetLenToPosState(len);
++      if (distance < kNumFullDistances)
++        curAndLenPrice += p->distancesPrices[lenToPosState][distance];
++      else
++      {
++        UInt32 slot;
++        GetPosSlot2(distance, slot);
++        curAndLenPrice += p->alignPrices[distance & kAlignMask] + p->posSlotPrices[lenToPosState][slot];
++      }
++      opt = &p->opt[len];
++      if (curAndLenPrice < opt->price)
++      {
++        opt->price = curAndLenPrice;
++        opt->posPrev = 0;
++        opt->backPrev = distance + LZMA_NUM_REPS;
++        opt->prev1IsChar = False;
++      }
++      if (len == matches[offs])
++      {
++        offs += 2;
++        if (offs == numPairs)
++          break;
++      }
++    }
++  }
++
++  cur = 0;
++
++    #ifdef SHOW_STAT2
++    if (position >= 0)
++    {
++      unsigned i;
++      printf("\n pos = %4X", position);
++      for (i = cur; i <= lenEnd; i++)
++      printf("\nprice[%4X] = %d", position - cur + i, p->opt[i].price);
++    }
++    #endif
++
++  for (;;)
++  {
++    UInt32 numAvailFull, newLen, numPairs, posPrev, state, posState, startLen;
++    UInt32 curPrice, curAnd1Price, matchPrice, repMatchPrice;
++    Bool nextIsChar;
++    Byte curByte, matchByte;
++    const Byte *data;
++    COptimal *curOpt;
++    COptimal *nextOpt;
++
++    cur++;
++    if (cur == lenEnd)
++      return Backward(p, backRes, cur);
++
++    newLen = ReadMatchDistances(p, &numPairs);
++    if (newLen >= p->numFastBytes)
++    {
++      p->numPairs = numPairs;
++      p->longestMatchLength = newLen;
++      return Backward(p, backRes, cur);
++    }
++    position++;
++    curOpt = &p->opt[cur];
++    posPrev = curOpt->posPrev;
++    if (curOpt->prev1IsChar)
++    {
++      posPrev--;
++      if (curOpt->prev2)
++      {
++        state = p->opt[curOpt->posPrev2].state;
++        if (curOpt->backPrev2 < LZMA_NUM_REPS)
++          state = kRepNextStates[state];
++        else
++          state = kMatchNextStates[state];
++      }
++      else
++        state = p->opt[posPrev].state;
++      state = kLiteralNextStates[state];
++    }
++    else
++      state = p->opt[posPrev].state;
++    if (posPrev == cur - 1)
++    {
++      if (IsShortRep(curOpt))
++        state = kShortRepNextStates[state];
++      else
++        state = kLiteralNextStates[state];
++    }
++    else
++    {
++      UInt32 pos;
++      const COptimal *prevOpt;
++      if (curOpt->prev1IsChar && curOpt->prev2)
++      {
++        posPrev = curOpt->posPrev2;
++        pos = curOpt->backPrev2;
++        state = kRepNextStates[state];
++      }
++      else
++      {
++        pos = curOpt->backPrev;
++        if (pos < LZMA_NUM_REPS)
++          state = kRepNextStates[state];
++        else
++          state = kMatchNextStates[state];
++      }
++      prevOpt = &p->opt[posPrev];
++      if (pos < LZMA_NUM_REPS)
++      {
++        UInt32 i;
++        reps[0] = prevOpt->backs[pos];
++        for (i = 1; i <= pos; i++)
++          reps[i] = prevOpt->backs[i - 1];
++        for (; i < LZMA_NUM_REPS; i++)
++          reps[i] = prevOpt->backs[i];
++      }
++      else
++      {
++        UInt32 i;
++        reps[0] = (pos - LZMA_NUM_REPS);
++        for (i = 1; i < LZMA_NUM_REPS; i++)
++          reps[i] = prevOpt->backs[i - 1];
++      }
++    }
++    curOpt->state = (CState)state;
++
++    curOpt->backs[0] = reps[0];
++    curOpt->backs[1] = reps[1];
++    curOpt->backs[2] = reps[2];
++    curOpt->backs[3] = reps[3];
++
++    curPrice = curOpt->price;
++    nextIsChar = False;
++    data = p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - 1;
++    curByte = *data;
++    matchByte = *(data - (reps[0] + 1));
++
++    posState = (position & p->pbMask);
++
++    curAnd1Price = curPrice + GET_PRICE_0(p->isMatch[state][posState]);
++    {
++      const CLzmaProb *probs = LIT_PROBS(position, *(data - 1));
++      curAnd1Price +=
++        (!IsCharState(state) ?
++          LitEnc_GetPriceMatched(probs, curByte, matchByte, p->ProbPrices) :
++          LitEnc_GetPrice(probs, curByte, p->ProbPrices));
++    }
++
++    nextOpt = &p->opt[cur + 1];
++
++    if (curAnd1Price < nextOpt->price)
++    {
++      nextOpt->price = curAnd1Price;
++      nextOpt->posPrev = cur;
++      MakeAsChar(nextOpt);
++      nextIsChar = True;
++    }
++
++    matchPrice = curPrice + GET_PRICE_1(p->isMatch[state][posState]);
++    repMatchPrice = matchPrice + GET_PRICE_1(p->isRep[state]);
++
++    if (matchByte == curByte && !(nextOpt->posPrev < cur && nextOpt->backPrev == 0))
++    {
++      UInt32 shortRepPrice = repMatchPrice + GetRepLen1Price(p, state, posState);
++      if (shortRepPrice <= nextOpt->price)
++      {
++        nextOpt->price = shortRepPrice;
++        nextOpt->posPrev = cur;
++        MakeAsShortRep(nextOpt);
++        nextIsChar = True;
++      }
++    }
++    numAvailFull = p->numAvail;
++    {
++      UInt32 temp = kNumOpts - 1 - cur;
++      if (temp < numAvailFull)
++        numAvailFull = temp;
++    }
++
++    if (numAvailFull < 2)
++      continue;
++    numAvail = (numAvailFull <= p->numFastBytes ? numAvailFull : p->numFastBytes);
++
++    if (!nextIsChar && matchByte != curByte) /* speed optimization */
++    {
++      /* try Literal + rep0 */
++      UInt32 temp;
++      UInt32 lenTest2;
++      const Byte *data2 = data - (reps[0] + 1);
++      UInt32 limit = p->numFastBytes + 1;
++      if (limit > numAvailFull)
++        limit = numAvailFull;
++
++      for (temp = 1; temp < limit && data[temp] == data2[temp]; temp++);
++      lenTest2 = temp - 1;
++      if (lenTest2 >= 2)
++      {
++        UInt32 state2 = kLiteralNextStates[state];
++        UInt32 posStateNext = (position + 1) & p->pbMask;
++        UInt32 nextRepMatchPrice = curAnd1Price +
++            GET_PRICE_1(p->isMatch[state2][posStateNext]) +
++            GET_PRICE_1(p->isRep[state2]);
++        /* for (; lenTest2 >= 2; lenTest2--) */
++        {
++          UInt32 curAndLenPrice;
++          COptimal *opt;
++          UInt32 offset = cur + 1 + lenTest2;
++          while (lenEnd < offset)
++            p->opt[++lenEnd].price = kInfinityPrice;
++          curAndLenPrice = nextRepMatchPrice + GetRepPrice(p, 0, lenTest2, state2, posStateNext);
++          opt = &p->opt[offset];
++          if (curAndLenPrice < opt->price)
++          {
++            opt->price = curAndLenPrice;
++            opt->posPrev = cur + 1;
++            opt->backPrev = 0;
++            opt->prev1IsChar = True;
++            opt->prev2 = False;
++          }
++        }
++      }
++    }
++
++    startLen = 2; /* speed optimization */
++    {
++    UInt32 repIndex;
++    for (repIndex = 0; repIndex < LZMA_NUM_REPS; repIndex++)
++    {
++      UInt32 lenTest;
++      UInt32 lenTestTemp;
++      UInt32 price;
++      const Byte *data2 = data - (reps[repIndex] + 1);
++      if (data[0] != data2[0] || data[1] != data2[1])
++        continue;
++      for (lenTest = 2; lenTest < numAvail && data[lenTest] == data2[lenTest]; lenTest++);
++      while (lenEnd < cur + lenTest)
++        p->opt[++lenEnd].price = kInfinityPrice;
++      lenTestTemp = lenTest;
++      price = repMatchPrice + GetPureRepPrice(p, repIndex, state, posState);
++      do
++      {
++        UInt32 curAndLenPrice = price + p->repLenEnc.prices[posState][lenTest - 2];
++        COptimal *opt = &p->opt[cur + lenTest];
++        if (curAndLenPrice < opt->price)
++        {
++          opt->price = curAndLenPrice;
++          opt->posPrev = cur;
++          opt->backPrev = repIndex;
++          opt->prev1IsChar = False;
++        }
++      }
++      while (--lenTest >= 2);
++      lenTest = lenTestTemp;
++
++      if (repIndex == 0)
++        startLen = lenTest + 1;
++
++      /* if (_maxMode) */
++        {
++          UInt32 lenTest2 = lenTest + 1;
++          UInt32 limit = lenTest2 + p->numFastBytes;
++          UInt32 nextRepMatchPrice;
++          if (limit > numAvailFull)
++            limit = numAvailFull;
++          for (; lenTest2 < limit && data[lenTest2] == data2[lenTest2]; lenTest2++);
++          lenTest2 -= lenTest + 1;
++          if (lenTest2 >= 2)
++          {
++            UInt32 state2 = kRepNextStates[state];
++            UInt32 posStateNext = (position + lenTest) & p->pbMask;
++            UInt32 curAndLenCharPrice =
++                price + p->repLenEnc.prices[posState][lenTest - 2] +
++                GET_PRICE_0(p->isMatch[state2][posStateNext]) +
++                LitEnc_GetPriceMatched(LIT_PROBS(position + lenTest, data[lenTest - 1]),
++                    data[lenTest], data2[lenTest], p->ProbPrices);
++            state2 = kLiteralNextStates[state2];
++            posStateNext = (position + lenTest + 1) & p->pbMask;
++            nextRepMatchPrice = curAndLenCharPrice +
++                GET_PRICE_1(p->isMatch[state2][posStateNext]) +
++                GET_PRICE_1(p->isRep[state2]);
++
++            /* for (; lenTest2 >= 2; lenTest2--) */
++            {
++              UInt32 curAndLenPrice;
++              COptimal *opt;
++              UInt32 offset = cur + lenTest + 1 + lenTest2;
++              while (lenEnd < offset)
++                p->opt[++lenEnd].price = kInfinityPrice;
++              curAndLenPrice = nextRepMatchPrice + GetRepPrice(p, 0, lenTest2, state2, posStateNext);
++              opt = &p->opt[offset];
++              if (curAndLenPrice < opt->price)
++              {
++                opt->price = curAndLenPrice;
++                opt->posPrev = cur + lenTest + 1;
++                opt->backPrev = 0;
++                opt->prev1IsChar = True;
++                opt->prev2 = True;
++                opt->posPrev2 = cur;
++                opt->backPrev2 = repIndex;
++              }
++            }
++          }
++        }
++    }
++    }
++    /* for (UInt32 lenTest = 2; lenTest <= newLen; lenTest++) */
++    if (newLen > numAvail)
++    {
++      newLen = numAvail;
++      for (numPairs = 0; newLen > matches[numPairs]; numPairs += 2);
++      matches[numPairs] = newLen;
++      numPairs += 2;
++    }
++    if (newLen >= startLen)
++    {
++      UInt32 normalMatchPrice = matchPrice + GET_PRICE_0(p->isRep[state]);
++      UInt32 offs, curBack, posSlot;
++      UInt32 lenTest;
++      while (lenEnd < cur + newLen)
++        p->opt[++lenEnd].price = kInfinityPrice;
++
++      offs = 0;
++      while (startLen > matches[offs])
++        offs += 2;
++      curBack = matches[offs + 1];
++      GetPosSlot2(curBack, posSlot);
++      for (lenTest = /*2*/ startLen; ; lenTest++)
++      {
++        UInt32 curAndLenPrice = normalMatchPrice + p->lenEnc.prices[posState][lenTest - LZMA_MATCH_LEN_MIN];
++        UInt32 lenToPosState = GetLenToPosState(lenTest);
++        COptimal *opt;
++        if (curBack < kNumFullDistances)
++          curAndLenPrice += p->distancesPrices[lenToPosState][curBack];
++        else
++          curAndLenPrice += p->posSlotPrices[lenToPosState][posSlot] + p->alignPrices[curBack & kAlignMask];
++
++        opt = &p->opt[cur + lenTest];
++        if (curAndLenPrice < opt->price)
++        {
++          opt->price = curAndLenPrice;
++          opt->posPrev = cur;
++          opt->backPrev = curBack + LZMA_NUM_REPS;
++          opt->prev1IsChar = False;
++        }
++
++        if (/*_maxMode && */lenTest == matches[offs])
++        {
++          /* Try Match + Literal + Rep0 */
++          const Byte *data2 = data - (curBack + 1);
++          UInt32 lenTest2 = lenTest + 1;
++          UInt32 limit = lenTest2 + p->numFastBytes;
++          UInt32 nextRepMatchPrice;
++          if (limit > numAvailFull)
++            limit = numAvailFull;
++          for (; lenTest2 < limit && data[lenTest2] == data2[lenTest2]; lenTest2++);
++          lenTest2 -= lenTest + 1;
++          if (lenTest2 >= 2)
++          {
++            UInt32 state2 = kMatchNextStates[state];
++            UInt32 posStateNext = (position + lenTest) & p->pbMask;
++            UInt32 curAndLenCharPrice = curAndLenPrice +
++                GET_PRICE_0(p->isMatch[state2][posStateNext]) +
++                LitEnc_GetPriceMatched(LIT_PROBS(position + lenTest, data[lenTest - 1]),
++                    data[lenTest], data2[lenTest], p->ProbPrices);
++            state2 = kLiteralNextStates[state2];
++            posStateNext = (posStateNext + 1) & p->pbMask;
++            nextRepMatchPrice = curAndLenCharPrice +
++                GET_PRICE_1(p->isMatch[state2][posStateNext]) +
++                GET_PRICE_1(p->isRep[state2]);
++
++            /* for (; lenTest2 >= 2; lenTest2--) */
++            {
++              UInt32 offset = cur + lenTest + 1 + lenTest2;
++              UInt32 curAndLenPrice;
++              COptimal *opt;
++              while (lenEnd < offset)
++                p->opt[++lenEnd].price = kInfinityPrice;
++              curAndLenPrice = nextRepMatchPrice + GetRepPrice(p, 0, lenTest2, state2, posStateNext);
++              opt = &p->opt[offset];
++              if (curAndLenPrice < opt->price)
++              {
++                opt->price = curAndLenPrice;
++                opt->posPrev = cur + lenTest + 1;
++                opt->backPrev = 0;
++                opt->prev1IsChar = True;
++                opt->prev2 = True;
++                opt->posPrev2 = cur;
++                opt->backPrev2 = curBack + LZMA_NUM_REPS;
++              }
++            }
++          }
++          offs += 2;
++          if (offs == numPairs)
++            break;
++          curBack = matches[offs + 1];
++          if (curBack >= kNumFullDistances)
++            GetPosSlot2(curBack, posSlot);
++        }
++      }
++    }
++  }
++}
++
++#define ChangePair(smallDist, bigDist) (((bigDist) >> 7) > (smallDist))
++
++static UInt32 GetOptimumFast(CLzmaEnc *p, UInt32 *backRes)
++{
++  UInt32 numAvail, mainLen, mainDist, numPairs, repIndex, repLen, i;
++  const Byte *data;
++  const UInt32 *matches;
++
++  if (p->additionalOffset == 0)
++    mainLen = ReadMatchDistances(p, &numPairs);
++  else
++  {
++    mainLen = p->longestMatchLength;
++    numPairs = p->numPairs;
++  }
++
++  numAvail = p->numAvail;
++  *backRes = (UInt32)-1;
++  if (numAvail < 2)
++    return 1;
++  if (numAvail > LZMA_MATCH_LEN_MAX)
++    numAvail = LZMA_MATCH_LEN_MAX;
++  data = p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - 1;
++
++  repLen = repIndex = 0;
++  for (i = 0; i < LZMA_NUM_REPS; i++)
++  {
++    UInt32 len;
++    const Byte *data2 = data - (p->reps[i] + 1);
++    if (data[0] != data2[0] || data[1] != data2[1])
++      continue;
++    for (len = 2; len < numAvail && data[len] == data2[len]; len++);
++    if (len >= p->numFastBytes)
++    {
++      *backRes = i;
++      MovePos(p, len - 1);
++      return len;
++    }
++    if (len > repLen)
++    {
++      repIndex = i;
++      repLen = len;
++    }
++  }
++
++  matches = p->matches;
++  if (mainLen >= p->numFastBytes)
++  {
++    *backRes = matches[numPairs - 1] + LZMA_NUM_REPS;
++    MovePos(p, mainLen - 1);
++    return mainLen;
++  }
++
++  mainDist = 0; /* for GCC */
++  if (mainLen >= 2)
++  {
++    mainDist = matches[numPairs - 1];
++    while (numPairs > 2 && mainLen == matches[numPairs - 4] + 1)
++    {
++      if (!ChangePair(matches[numPairs - 3], mainDist))
++        break;
++      numPairs -= 2;
++      mainLen = matches[numPairs - 2];
++      mainDist = matches[numPairs - 1];
++    }
++    if (mainLen == 2 && mainDist >= 0x80)
++      mainLen = 1;
++  }
++
++  if (repLen >= 2 && (
++        (repLen + 1 >= mainLen) ||
++        (repLen + 2 >= mainLen && mainDist >= (1 << 9)) ||
++        (repLen + 3 >= mainLen && mainDist >= (1 << 15))))
++  {
++    *backRes = repIndex;
++    MovePos(p, repLen - 1);
++    return repLen;
++  }
++
++  if (mainLen < 2 || numAvail <= 2)
++    return 1;
++
++  p->longestMatchLength = ReadMatchDistances(p, &p->numPairs);
++  if (p->longestMatchLength >= 2)
++  {
++    UInt32 newDistance = matches[p->numPairs - 1];
++    if ((p->longestMatchLength >= mainLen && newDistance < mainDist) ||
++        (p->longestMatchLength == mainLen + 1 && !ChangePair(mainDist, newDistance)) ||
++        (p->longestMatchLength > mainLen + 1) ||
++        (p->longestMatchLength + 1 >= mainLen && mainLen >= 3 && ChangePair(newDistance, mainDist)))
++      return 1;
++  }
++
++  data = p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - 1;
++  for (i = 0; i < LZMA_NUM_REPS; i++)
++  {
++    UInt32 len, limit;
++    const Byte *data2 = data - (p->reps[i] + 1);
++    if (data[0] != data2[0] || data[1] != data2[1])
++      continue;
++    limit = mainLen - 1;
++    for (len = 2; len < limit && data[len] == data2[len]; len++);
++    if (len >= limit)
++      return 1;
++  }
++  *backRes = mainDist + LZMA_NUM_REPS;
++  MovePos(p, mainLen - 2);
++  return mainLen;
++}
++
++static void WriteEndMarker(CLzmaEnc *p, UInt32 posState)
++{
++  UInt32 len;
++  RangeEnc_EncodeBit(&p->rc, &p->isMatch[p->state][posState], 1);
++  RangeEnc_EncodeBit(&p->rc, &p->isRep[p->state], 0);
++  p->state = kMatchNextStates[p->state];
++  len = LZMA_MATCH_LEN_MIN;
++  LenEnc_Encode2(&p->lenEnc, &p->rc, len - LZMA_MATCH_LEN_MIN, posState, !p->fastMode, p->ProbPrices);
++  RcTree_Encode(&p->rc, p->posSlotEncoder[GetLenToPosState(len)], kNumPosSlotBits, (1 << kNumPosSlotBits) - 1);
++  RangeEnc_EncodeDirectBits(&p->rc, (((UInt32)1 << 30) - 1) >> kNumAlignBits, 30 - kNumAlignBits);
++  RcTree_ReverseEncode(&p->rc, p->posAlignEncoder, kNumAlignBits, kAlignMask);
++}
++
++static SRes CheckErrors(CLzmaEnc *p)
++{
++  if (p->result != SZ_OK)
++    return p->result;
++  if (p->rc.res != SZ_OK)
++    p->result = SZ_ERROR_WRITE;
++  if (p->matchFinderBase.result != SZ_OK)
++    p->result = SZ_ERROR_READ;
++  if (p->result != SZ_OK)
++    p->finished = True;
++  return p->result;
++}
++
++static SRes Flush(CLzmaEnc *p, UInt32 nowPos)
++{
++  /* ReleaseMFStream(); */
++  p->finished = True;
++  if (p->writeEndMark)
++    WriteEndMarker(p, nowPos & p->pbMask);
++  RangeEnc_FlushData(&p->rc);
++  RangeEnc_FlushStream(&p->rc);
++  return CheckErrors(p);
++}
++
++static void FillAlignPrices(CLzmaEnc *p)
++{
++  UInt32 i;
++  for (i = 0; i < kAlignTableSize; i++)
++    p->alignPrices[i] = RcTree_ReverseGetPrice(p->posAlignEncoder, kNumAlignBits, i, p->ProbPrices);
++  p->alignPriceCount = 0;
++}
++
++static void FillDistancesPrices(CLzmaEnc *p)
++{
++  UInt32 tempPrices[kNumFullDistances];
++  UInt32 i, lenToPosState;
++  for (i = kStartPosModelIndex; i < kNumFullDistances; i++)
++  {
++    UInt32 posSlot = GetPosSlot1(i);
++    UInt32 footerBits = ((posSlot >> 1) - 1);
++    UInt32 base = ((2 | (posSlot & 1)) << footerBits);
++    tempPrices[i] = RcTree_ReverseGetPrice(p->posEncoders + base - posSlot - 1, footerBits, i - base, p->ProbPrices);
++  }
++
++  for (lenToPosState = 0; lenToPosState < kNumLenToPosStates; lenToPosState++)
++  {
++    UInt32 posSlot;
++    const CLzmaProb *encoder = p->posSlotEncoder[lenToPosState];
++    UInt32 *posSlotPrices = p->posSlotPrices[lenToPosState];
++    for (posSlot = 0; posSlot < p->distTableSize; posSlot++)
++      posSlotPrices[posSlot] = RcTree_GetPrice(encoder, kNumPosSlotBits, posSlot, p->ProbPrices);
++    for (posSlot = kEndPosModelIndex; posSlot < p->distTableSize; posSlot++)
++      posSlotPrices[posSlot] += ((((posSlot >> 1) - 1) - kNumAlignBits) << kNumBitPriceShiftBits);
++
++    {
++      UInt32 *distancesPrices = p->distancesPrices[lenToPosState];
++      UInt32 i;
++      for (i = 0; i < kStartPosModelIndex; i++)
++        distancesPrices[i] = posSlotPrices[i];
++      for (; i < kNumFullDistances; i++)
++        distancesPrices[i] = posSlotPrices[GetPosSlot1(i)] + tempPrices[i];
++    }
++  }
++  p->matchPriceCount = 0;
++}
++
++static void LzmaEnc_Construct(CLzmaEnc *p)
++{
++  RangeEnc_Construct(&p->rc);
++  MatchFinder_Construct(&p->matchFinderBase);
++  #ifndef _7ZIP_ST
++  MatchFinderMt_Construct(&p->matchFinderMt);
++  p->matchFinderMt.MatchFinder = &p->matchFinderBase;
++  #endif
++
++  {
++    CLzmaEncProps props;
++    LzmaEncProps_Init(&props);
++    LzmaEnc_SetProps(p, &props);
++  }
++
++  #ifndef LZMA_LOG_BSR
++  LzmaEnc_FastPosInit(p->g_FastPos);
++  #endif
++
++  LzmaEnc_InitPriceTables(p->ProbPrices);
++  p->litProbs = 0;
++  p->saveState.litProbs = 0;
++}
++
++CLzmaEncHandle LzmaEnc_Create(ISzAlloc *alloc)
++{
++  void *p;
++  p = alloc->Alloc(alloc, sizeof(CLzmaEnc));
++  if (p != 0)
++    LzmaEnc_Construct((CLzmaEnc *)p);
++  return p;
++}
++
++static void LzmaEnc_FreeLits(CLzmaEnc *p, ISzAlloc *alloc)
++{
++  alloc->Free(alloc, p->litProbs);
++  alloc->Free(alloc, p->saveState.litProbs);
++  p->litProbs = 0;
++  p->saveState.litProbs = 0;
++}
++
++static void LzmaEnc_Destruct(CLzmaEnc *p, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  #ifndef _7ZIP_ST
++  MatchFinderMt_Destruct(&p->matchFinderMt, allocBig);
++  #endif
++  MatchFinder_Free(&p->matchFinderBase, allocBig);
++  LzmaEnc_FreeLits(p, alloc);
++  RangeEnc_Free(&p->rc, alloc);
++}
++
++void LzmaEnc_Destroy(CLzmaEncHandle p, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  LzmaEnc_Destruct((CLzmaEnc *)p, alloc, allocBig);
++  alloc->Free(alloc, p);
++}
++
++static SRes LzmaEnc_CodeOneBlock(CLzmaEnc *p, Bool useLimits, UInt32 maxPackSize, UInt32 maxUnpackSize)
++{
++  UInt32 nowPos32, startPos32;
++  if (p->needInit)
++  {
++    p->matchFinder.Init(p->matchFinderObj);
++    p->needInit = 0;
++  }
++
++  if (p->finished)
++    return p->result;
++  RINOK(CheckErrors(p));
++
++  nowPos32 = (UInt32)p->nowPos64;
++  startPos32 = nowPos32;
++
++  if (p->nowPos64 == 0)
++  {
++    UInt32 numPairs;
++    Byte curByte;
++    if (p->matchFinder.GetNumAvailableBytes(p->matchFinderObj) == 0)
++      return Flush(p, nowPos32);
++    ReadMatchDistances(p, &numPairs);
++    RangeEnc_EncodeBit(&p->rc, &p->isMatch[p->state][0], 0);
++    p->state = kLiteralNextStates[p->state];
++    curByte = p->matchFinder.GetIndexByte(p->matchFinderObj, 0 - p->additionalOffset);
++    LitEnc_Encode(&p->rc, p->litProbs, curByte);
++    p->additionalOffset--;
++    nowPos32++;
++  }
++
++  if (p->matchFinder.GetNumAvailableBytes(p->matchFinderObj) != 0)
++  for (;;)
++  {
++    UInt32 pos, len, posState;
++
++    if (p->fastMode)
++      len = GetOptimumFast(p, &pos);
++    else
++      len = GetOptimum(p, nowPos32, &pos);
++
++    #ifdef SHOW_STAT2
++    printf("\n pos = %4X,   len = %d   pos = %d", nowPos32, len, pos);
++    #endif
++
++    posState = nowPos32 & p->pbMask;
++    if (len == 1 && pos == (UInt32)-1)
++    {
++      Byte curByte;
++      CLzmaProb *probs;
++      const Byte *data;
++
++      RangeEnc_EncodeBit(&p->rc, &p->isMatch[p->state][posState], 0);
++      data = p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - p->additionalOffset;
++      curByte = *data;
++      probs = LIT_PROBS(nowPos32, *(data - 1));
++      if (IsCharState(p->state))
++        LitEnc_Encode(&p->rc, probs, curByte);
++      else
++        LitEnc_EncodeMatched(&p->rc, probs, curByte, *(data - p->reps[0] - 1));
++      p->state = kLiteralNextStates[p->state];
++    }
++    else
++    {
++      RangeEnc_EncodeBit(&p->rc, &p->isMatch[p->state][posState], 1);
++      if (pos < LZMA_NUM_REPS)
++      {
++        RangeEnc_EncodeBit(&p->rc, &p->isRep[p->state], 1);
++        if (pos == 0)
++        {
++          RangeEnc_EncodeBit(&p->rc, &p->isRepG0[p->state], 0);
++          RangeEnc_EncodeBit(&p->rc, &p->isRep0Long[p->state][posState], ((len == 1) ? 0 : 1));
++        }
++        else
++        {
++          UInt32 distance = p->reps[pos];
++          RangeEnc_EncodeBit(&p->rc, &p->isRepG0[p->state], 1);
++          if (pos == 1)
++            RangeEnc_EncodeBit(&p->rc, &p->isRepG1[p->state], 0);
++          else
++          {
++            RangeEnc_EncodeBit(&p->rc, &p->isRepG1[p->state], 1);
++            RangeEnc_EncodeBit(&p->rc, &p->isRepG2[p->state], pos - 2);
++            if (pos == 3)
++              p->reps[3] = p->reps[2];
++            p->reps[2] = p->reps[1];
++          }
++          p->reps[1] = p->reps[0];
++          p->reps[0] = distance;
++        }
++        if (len == 1)
++          p->state = kShortRepNextStates[p->state];
++        else
++        {
++          LenEnc_Encode2(&p->repLenEnc, &p->rc, len - LZMA_MATCH_LEN_MIN, posState, !p->fastMode, p->ProbPrices);
++          p->state = kRepNextStates[p->state];
++        }
++      }
++      else
++      {
++        UInt32 posSlot;
++        RangeEnc_EncodeBit(&p->rc, &p->isRep[p->state], 0);
++        p->state = kMatchNextStates[p->state];
++        LenEnc_Encode2(&p->lenEnc, &p->rc, len - LZMA_MATCH_LEN_MIN, posState, !p->fastMode, p->ProbPrices);
++        pos -= LZMA_NUM_REPS;
++        GetPosSlot(pos, posSlot);
++        RcTree_Encode(&p->rc, p->posSlotEncoder[GetLenToPosState(len)], kNumPosSlotBits, posSlot);
++
++        if (posSlot >= kStartPosModelIndex)
++        {
++          UInt32 footerBits = ((posSlot >> 1) - 1);
++          UInt32 base = ((2 | (posSlot & 1)) << footerBits);
++          UInt32 posReduced = pos - base;
++
++          if (posSlot < kEndPosModelIndex)
++            RcTree_ReverseEncode(&p->rc, p->posEncoders + base - posSlot - 1, footerBits, posReduced);
++          else
++          {
++            RangeEnc_EncodeDirectBits(&p->rc, posReduced >> kNumAlignBits, footerBits - kNumAlignBits);
++            RcTree_ReverseEncode(&p->rc, p->posAlignEncoder, kNumAlignBits, posReduced & kAlignMask);
++            p->alignPriceCount++;
++          }
++        }
++        p->reps[3] = p->reps[2];
++        p->reps[2] = p->reps[1];
++        p->reps[1] = p->reps[0];
++        p->reps[0] = pos;
++        p->matchPriceCount++;
++      }
++    }
++    p->additionalOffset -= len;
++    nowPos32 += len;
++    if (p->additionalOffset == 0)
++    {
++      UInt32 processed;
++      if (!p->fastMode)
++      {
++        if (p->matchPriceCount >= (1 << 7))
++          FillDistancesPrices(p);
++        if (p->alignPriceCount >= kAlignTableSize)
++          FillAlignPrices(p);
++      }
++      if (p->matchFinder.GetNumAvailableBytes(p->matchFinderObj) == 0)
++        break;
++      processed = nowPos32 - startPos32;
++      if (useLimits)
++      {
++        if (processed + kNumOpts + 300 >= maxUnpackSize ||
++            RangeEnc_GetProcessed(&p->rc) + kNumOpts * 2 >= maxPackSize)
++          break;
++      }
++      else if (processed >= (1 << 15))
++      {
++        p->nowPos64 += nowPos32 - startPos32;
++        return CheckErrors(p);
++      }
++    }
++  }
++  p->nowPos64 += nowPos32 - startPos32;
++  return Flush(p, nowPos32);
++}
++
++#define kBigHashDicLimit ((UInt32)1 << 24)
++
++static SRes LzmaEnc_Alloc(CLzmaEnc *p, UInt32 keepWindowSize, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  UInt32 beforeSize = kNumOpts;
++  Bool btMode;
++  if (!RangeEnc_Alloc(&p->rc, alloc))
++    return SZ_ERROR_MEM;
++  btMode = (p->matchFinderBase.btMode != 0);
++  #ifndef _7ZIP_ST
++  p->mtMode = (p->multiThread && !p->fastMode && btMode);
++  #endif
++
++  {
++    unsigned lclp = p->lc + p->lp;
++    if (p->litProbs == 0 || p->saveState.litProbs == 0 || p->lclp != lclp)
++    {
++      LzmaEnc_FreeLits(p, alloc);
++      p->litProbs = (CLzmaProb *)alloc->Alloc(alloc, (0x300 << lclp) * sizeof(CLzmaProb));
++      p->saveState.litProbs = (CLzmaProb *)alloc->Alloc(alloc, (0x300 << lclp) * sizeof(CLzmaProb));
++      if (p->litProbs == 0 || p->saveState.litProbs == 0)
++      {
++        LzmaEnc_FreeLits(p, alloc);
++        return SZ_ERROR_MEM;
++      }
++      p->lclp = lclp;
++    }
++  }
++
++  p->matchFinderBase.bigHash = (p->dictSize > kBigHashDicLimit);
++
++  if (beforeSize + p->dictSize < keepWindowSize)
++    beforeSize = keepWindowSize - p->dictSize;
++
++  #ifndef _7ZIP_ST
++  if (p->mtMode)
++  {
++    RINOK(MatchFinderMt_Create(&p->matchFinderMt, p->dictSize, beforeSize, p->numFastBytes, LZMA_MATCH_LEN_MAX, allocBig));
++    p->matchFinderObj = &p->matchFinderMt;
++    MatchFinderMt_CreateVTable(&p->matchFinderMt, &p->matchFinder);
++  }
++  else
++  #endif
++  {
++    if (!MatchFinder_Create(&p->matchFinderBase, p->dictSize, beforeSize, p->numFastBytes, LZMA_MATCH_LEN_MAX, allocBig))
++      return SZ_ERROR_MEM;
++    p->matchFinderObj = &p->matchFinderBase;
++    MatchFinder_CreateVTable(&p->matchFinderBase, &p->matchFinder);
++  }
++  return SZ_OK;
++}
++
++static void LzmaEnc_Init(CLzmaEnc *p)
++{
++  UInt32 i;
++  p->state = 0;
++  for (i = 0 ; i < LZMA_NUM_REPS; i++)
++    p->reps[i] = 0;
++
++  RangeEnc_Init(&p->rc);
++
++
++  for (i = 0; i < kNumStates; i++)
++  {
++    UInt32 j;
++    for (j = 0; j < LZMA_NUM_PB_STATES_MAX; j++)
++    {
++      p->isMatch[i][j] = kProbInitValue;
++      p->isRep0Long[i][j] = kProbInitValue;
++    }
++    p->isRep[i] = kProbInitValue;
++    p->isRepG0[i] = kProbInitValue;
++    p->isRepG1[i] = kProbInitValue;
++    p->isRepG2[i] = kProbInitValue;
++  }
++
++  {
++    UInt32 num = 0x300 << (p->lp + p->lc);
++    for (i = 0; i < num; i++)
++      p->litProbs[i] = kProbInitValue;
++  }
++
++  {
++    for (i = 0; i < kNumLenToPosStates; i++)
++    {
++      CLzmaProb *probs = p->posSlotEncoder[i];
++      UInt32 j;
++      for (j = 0; j < (1 << kNumPosSlotBits); j++)
++        probs[j] = kProbInitValue;
++    }
++  }
++  {
++    for (i = 0; i < kNumFullDistances - kEndPosModelIndex; i++)
++      p->posEncoders[i] = kProbInitValue;
++  }
++
++  LenEnc_Init(&p->lenEnc.p);
++  LenEnc_Init(&p->repLenEnc.p);
++
++  for (i = 0; i < (1 << kNumAlignBits); i++)
++    p->posAlignEncoder[i] = kProbInitValue;
++
++  p->optimumEndIndex = 0;
++  p->optimumCurrentIndex = 0;
++  p->additionalOffset = 0;
++
++  p->pbMask = (1 << p->pb) - 1;
++  p->lpMask = (1 << p->lp) - 1;
++}
++
++static void LzmaEnc_InitPrices(CLzmaEnc *p)
++{
++  if (!p->fastMode)
++  {
++    FillDistancesPrices(p);
++    FillAlignPrices(p);
++  }
++
++  p->lenEnc.tableSize =
++  p->repLenEnc.tableSize =
++      p->numFastBytes + 1 - LZMA_MATCH_LEN_MIN;
++  LenPriceEnc_UpdateTables(&p->lenEnc, 1 << p->pb, p->ProbPrices);
++  LenPriceEnc_UpdateTables(&p->repLenEnc, 1 << p->pb, p->ProbPrices);
++}
++
++static SRes LzmaEnc_AllocAndInit(CLzmaEnc *p, UInt32 keepWindowSize, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  UInt32 i;
++  for (i = 0; i < (UInt32)kDicLogSizeMaxCompress; i++)
++    if (p->dictSize <= ((UInt32)1 << i))
++      break;
++  p->distTableSize = i * 2;
++
++  p->finished = False;
++  p->result = SZ_OK;
++  RINOK(LzmaEnc_Alloc(p, keepWindowSize, alloc, allocBig));
++  LzmaEnc_Init(p);
++  LzmaEnc_InitPrices(p);
++  p->nowPos64 = 0;
++  return SZ_OK;
++}
++
++static SRes LzmaEnc_Prepare(CLzmaEncHandle pp, ISeqOutStream *outStream, ISeqInStream *inStream,
++    ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  p->matchFinderBase.stream = inStream;
++  p->needInit = 1;
++  p->rc.outStream = outStream;
++  return LzmaEnc_AllocAndInit(p, 0, alloc, allocBig);
++}
++
++/*SRes LzmaEnc_PrepareForLzma2(CLzmaEncHandle pp,
++    ISeqInStream *inStream, UInt32 keepWindowSize,
++    ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  p->matchFinderBase.stream = inStream;
++  p->needInit = 1;
++  return LzmaEnc_AllocAndInit(p, keepWindowSize, alloc, allocBig);
++}*/
++
++static void LzmaEnc_SetInputBuf(CLzmaEnc *p, const Byte *src, SizeT srcLen)
++{
++  p->matchFinderBase.directInput = 1;
++  p->matchFinderBase.bufferBase = (Byte *)src;
++  p->matchFinderBase.directInputRem = srcLen;
++}
++
++static SRes LzmaEnc_MemPrepare(CLzmaEncHandle pp, const Byte *src, SizeT srcLen,
++    UInt32 keepWindowSize, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  LzmaEnc_SetInputBuf(p, src, srcLen);
++  p->needInit = 1;
++
++  return LzmaEnc_AllocAndInit(p, keepWindowSize, alloc, allocBig);
++}
++
++static void LzmaEnc_Finish(CLzmaEncHandle pp)
++{
++  #ifndef _7ZIP_ST
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  if (p->mtMode)
++    MatchFinderMt_ReleaseStream(&p->matchFinderMt);
++  #else
++  pp = pp;
++  #endif
++}
++
++typedef struct
++{
++  ISeqOutStream funcTable;
++  Byte *data;
++  SizeT rem;
++  Bool overflow;
++} CSeqOutStreamBuf;
++
++static size_t MyWrite(void *pp, const void *data, size_t size)
++{
++  CSeqOutStreamBuf *p = (CSeqOutStreamBuf *)pp;
++  if (p->rem < size)
++  {
++    size = p->rem;
++    p->overflow = True;
++  }
++  memcpy(p->data, data, size);
++  p->rem -= size;
++  p->data += size;
++  return size;
++}
++
++
++/*UInt32 LzmaEnc_GetNumAvailableBytes(CLzmaEncHandle pp)
++{
++  const CLzmaEnc *p = (CLzmaEnc *)pp;
++  return p->matchFinder.GetNumAvailableBytes(p->matchFinderObj);
++}*/
++
++/*const Byte *LzmaEnc_GetCurBuf(CLzmaEncHandle pp)
++{
++  const CLzmaEnc *p = (CLzmaEnc *)pp;
++  return p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - p->additionalOffset;
++}*/
++
++/* SRes LzmaEnc_CodeOneMemBlock(CLzmaEncHandle pp, Bool reInit,
++    Byte *dest, size_t *destLen, UInt32 desiredPackSize, UInt32 *unpackSize)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  UInt64 nowPos64;
++  SRes res;
++  CSeqOutStreamBuf outStream;
++
++  outStream.funcTable.Write = MyWrite;
++  outStream.data = dest;
++  outStream.rem = *destLen;
++  outStream.overflow = False;
++
++  p->writeEndMark = False;
++  p->finished = False;
++  p->result = SZ_OK;
++
++  if (reInit)
++    LzmaEnc_Init(p);
++  LzmaEnc_InitPrices(p);
++  nowPos64 = p->nowPos64;
++  RangeEnc_Init(&p->rc);
++  p->rc.outStream = &outStream.funcTable;
++
++  res = LzmaEnc_CodeOneBlock(p, True, desiredPackSize, *unpackSize);
++
++  *unpackSize = (UInt32)(p->nowPos64 - nowPos64);
++  *destLen -= outStream.rem;
++  if (outStream.overflow)
++    return SZ_ERROR_OUTPUT_EOF;
++
++  return res;
++}*/
++
++static SRes LzmaEnc_Encode2(CLzmaEnc *p, ICompressProgress *progress)
++{
++  SRes res = SZ_OK;
++
++  #ifndef _7ZIP_ST
++  Byte allocaDummy[0x300];
++  int i = 0;
++  for (i = 0; i < 16; i++)
++    allocaDummy[i] = (Byte)i;
++  #endif
++
++  for (;;)
++  {
++    res = LzmaEnc_CodeOneBlock(p, False, 0, 0);
++    if (res != SZ_OK || p->finished != 0)
++      break;
++    if (progress != 0)
++    {
++      res = progress->Progress(progress, p->nowPos64, RangeEnc_GetProcessed(&p->rc));
++      if (res != SZ_OK)
++      {
++        res = SZ_ERROR_PROGRESS;
++        break;
++      }
++    }
++  }
++  LzmaEnc_Finish(p);
++  return res;
++}
++
++SRes LzmaEnc_Encode(CLzmaEncHandle pp, ISeqOutStream *outStream, ISeqInStream *inStream, ICompressProgress *progress,
++    ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  RINOK(LzmaEnc_Prepare(pp, outStream, inStream, alloc, allocBig));
++  return LzmaEnc_Encode2((CLzmaEnc *)pp, progress);
++}
++
++SRes LzmaEnc_WriteProperties(CLzmaEncHandle pp, Byte *props, SizeT *size)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  int i;
++  UInt32 dictSize = p->dictSize;
++  if (*size < LZMA_PROPS_SIZE)
++    return SZ_ERROR_PARAM;
++  *size = LZMA_PROPS_SIZE;
++  props[0] = (Byte)((p->pb * 5 + p->lp) * 9 + p->lc);
++
++  for (i = 11; i <= 30; i++)
++  {
++    if (dictSize <= ((UInt32)2 << i))
++    {
++      dictSize = (2 << i);
++      break;
++    }
++    if (dictSize <= ((UInt32)3 << i))
++    {
++      dictSize = (3 << i);
++      break;
++    }
++  }
++
++  for (i = 0; i < 4; i++)
++    props[1 + i] = (Byte)(dictSize >> (8 * i));
++  return SZ_OK;
++}
++
++SRes LzmaEnc_MemEncode(CLzmaEncHandle pp, Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
++    int writeEndMark, ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  SRes res;
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++
++  CSeqOutStreamBuf outStream;
++
++  LzmaEnc_SetInputBuf(p, src, srcLen);
++
++  outStream.funcTable.Write = MyWrite;
++  outStream.data = dest;
++  outStream.rem = *destLen;
++  outStream.overflow = False;
++
++  p->writeEndMark = writeEndMark;
++
++  p->rc.outStream = &outStream.funcTable;
++  res = LzmaEnc_MemPrepare(pp, src, srcLen, 0, alloc, allocBig);
++  if (res == SZ_OK)
++    res = LzmaEnc_Encode2(p, progress);
++
++  *destLen -= outStream.rem;
++  if (outStream.overflow)
++    return SZ_ERROR_OUTPUT_EOF;
++  return res;
++}
++
++SRes LzmaEncode(Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
++    const CLzmaEncProps *props, Byte *propsEncoded, SizeT *propsSize, int writeEndMark,
++    ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  CLzmaEnc *p = (CLzmaEnc *)LzmaEnc_Create(alloc);
++  SRes res;
++  if (p == 0)
++    return SZ_ERROR_MEM;
++
++  res = LzmaEnc_SetProps(p, props);
++  if (res == SZ_OK)
++  {
++    res = LzmaEnc_WriteProperties(p, propsEncoded, propsSize);
++    if (res == SZ_OK)
++      res = LzmaEnc_MemEncode(p, dest, destLen, src, srcLen,
++          writeEndMark, progress, alloc, allocBig);
++  }
++
++  LzmaEnc_Destroy(p, alloc, allocBig);
++  return res;
++}
+--- /dev/null
++++ b/lib/lzma/Makefile
+@@ -0,0 +1,7 @@
++lzma_compress-objs := LzFind.o LzmaEnc.o
++lzma_decompress-objs := LzmaDec.o
++
++obj-$(CONFIG_LZMA_COMPRESS) += lzma_compress.o
++obj-$(CONFIG_LZMA_DECOMPRESS) += lzma_decompress.o
++
++EXTRA_CFLAGS += -Iinclude/linux -Iinclude/linux/lzma -include types.h
diff --git a/6.12/target/linux/generic/pending-6.12/532-jffs2_eofdetect.patch b/6.12/target/linux/generic/pending-6.12/532-jffs2_eofdetect.patch
new file mode 100644
index 00000000..744fbd0e
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/532-jffs2_eofdetect.patch
@@ -0,0 +1,65 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: fs: jffs2: EOF marker
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ fs/jffs2/build.c | 10 ++++++++++
+ fs/jffs2/scan.c  | 21 +++++++++++++++++++--
+ 2 files changed, 29 insertions(+), 2 deletions(-)
+
+--- a/fs/jffs2/build.c
++++ b/fs/jffs2/build.c
+@@ -117,6 +117,16 @@ static int jffs2_build_filesystem(struct
+ 	dbg_fsbuild("scanned flash completely\n");
+ 	jffs2_dbg_dump_block_lists_nolock(c);
+ 
++	if (c->flags & (1 << 7)) {
++		printk("%s(): unlocking the mtd device... ", __func__);
++		mtd_unlock(c->mtd, 0, c->mtd->size);
++		printk("done.\n");
++
++		printk("%s(): erasing all blocks after the end marker... ", __func__);
++		jffs2_erase_pending_blocks(c, -1);
++		printk("done.\n");
++	}
++
+ 	dbg_fsbuild("pass 1 starting\n");
+ 	c->flags |= JFFS2_SB_FLAG_BUILDING;
+ 	/* Now scan the directory tree, increasing nlink according to every dirent found. */
+--- a/fs/jffs2/scan.c
++++ b/fs/jffs2/scan.c
+@@ -148,8 +148,14 @@ int jffs2_scan_medium(struct jffs2_sb_in
+ 		/* reset summary info for next eraseblock scan */
+ 		jffs2_sum_reset_collected(s);
+ 
+-		ret = jffs2_scan_eraseblock(c, jeb, buf_size?flashbuf:(flashbuf+jeb->offset),
+-						buf_size, s);
++		if (c->flags & (1 << 7)) {
++			if (mtd_block_isbad(c->mtd, jeb->offset))
++				ret = BLK_STATE_BADBLOCK;
++			else
++				ret = BLK_STATE_ALLFF;
++		} else
++			ret = jffs2_scan_eraseblock(c, jeb, buf_size?flashbuf:(flashbuf+jeb->offset),
++							buf_size, s);
+ 
+ 		if (ret < 0)
+ 			goto out;
+@@ -567,6 +573,17 @@ full_scan:
+ 			return err;
+ 	}
+ 
++	if ((buf[0] == 0xde) &&
++		(buf[1] == 0xad) &&
++		(buf[2] == 0xc0) &&
++		(buf[3] == 0xde)) {
++		/* end of filesystem. erase everything after this point */
++		printk("%s(): End of filesystem marker found at 0x%x\n", __func__, jeb->offset);
++		c->flags |= (1 << 7);
++
++		return BLK_STATE_ALLFF;
++	}
++
+ 	/* We temporarily use 'ofs' as a pointer into the buffer/jeb */
+ 	ofs = 0;
+ 	max_ofs = EMPTY_SCAN_SIZE(c->sector_size);
diff --git a/6.12/target/linux/generic/pending-6.12/600-netfilter_conntrack_flush.patch b/6.12/target/linux/generic/pending-6.12/600-netfilter_conntrack_flush.patch
new file mode 100644
index 00000000..52e97e46
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/600-netfilter_conntrack_flush.patch
@@ -0,0 +1,90 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: netfilter: add support for flushing conntrack via /proc
+
+lede-commit 8193bbe59a74d34d6a26d4a8cb857b1952905314
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ net/netfilter/nf_conntrack_standalone.c | 59 ++++++++++++++++++++++++++++++++-
+ 1 file changed, 58 insertions(+), 1 deletion(-)
+
+--- a/net/netfilter/nf_conntrack_standalone.c
++++ b/net/netfilter/nf_conntrack_standalone.c
+@@ -9,6 +9,7 @@
+ #include <linux/percpu.h>
+ #include <linux/netdevice.h>
+ #include <linux/security.h>
++#include <linux/inet.h>
+ #include <net/net_namespace.h>
+ #ifdef CONFIG_SYSCTL
+ #include <linux/sysctl.h>
+@@ -458,6 +459,58 @@ static int ct_cpu_seq_show(struct seq_fi
+ 	return 0;
+ }
+ 
++struct kill_request {
++	u16 family;
++	union nf_inet_addr addr;
++};
++
++static int kill_matching(struct nf_conn *i, void *data)
++{
++	struct kill_request *kr = data;
++	struct nf_conntrack_tuple *t1 = &i->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
++	struct nf_conntrack_tuple *t2 = &i->tuplehash[IP_CT_DIR_REPLY].tuple;
++
++	if (!kr->family)
++		return 1;
++
++	if (t1->src.l3num != kr->family)
++		return 0;
++
++	return (nf_inet_addr_cmp(&kr->addr, &t1->src.u3) ||
++	        nf_inet_addr_cmp(&kr->addr, &t1->dst.u3) ||
++	        nf_inet_addr_cmp(&kr->addr, &t2->src.u3) ||
++	        nf_inet_addr_cmp(&kr->addr, &t2->dst.u3));
++}
++
++static int ct_file_write(struct file *file, char *buf, size_t count)
++{
++	struct seq_file *seq = file->private_data;
++	struct nf_ct_iter_data iter_data;
++	struct kill_request kr = { };
++
++	if (count == 0)
++		return 0;
++
++	if (count >= INET6_ADDRSTRLEN)
++		count = INET6_ADDRSTRLEN - 1;
++
++	if (strnchr(buf, count, ':')) {
++		kr.family = AF_INET6;
++		if (!in6_pton(buf, count, (void *)&kr.addr, '\n', NULL))
++			return -EINVAL;
++	} else if (strnchr(buf, count, '.')) {
++		kr.family = AF_INET;
++		if (!in4_pton(buf, count, (void *)&kr.addr, '\n', NULL))
++			return -EINVAL;
++	}
++
++	iter_data.net = seq_file_net(seq);
++	iter_data.data = &kr;
++	nf_ct_iterate_cleanup_net(kill_matching, &iter_data);
++
++	return 0;
++}
++
+ static const struct seq_operations ct_cpu_seq_ops = {
+ 	.start	= ct_cpu_seq_start,
+ 	.next	= ct_cpu_seq_next,
+@@ -471,8 +524,9 @@ static int nf_conntrack_standalone_init_
+ 	kuid_t root_uid;
+ 	kgid_t root_gid;
+ 
+-	pde = proc_create_net("nf_conntrack", 0440, net->proc_net, &ct_seq_ops,
+-			sizeof(struct ct_iter_state));
++	pde = proc_create_net_data_write("nf_conntrack", 0440, net->proc_net,
++					 &ct_seq_ops, &ct_file_write,
++					 sizeof(struct ct_iter_state), NULL);
+ 	if (!pde)
+ 		goto out_nf_conntrack;
+ 
diff --git a/6.12/target/linux/generic/pending-6.12/610-netfilter_match_bypass_default_checks.patch b/6.12/target/linux/generic/pending-6.12/610-netfilter_match_bypass_default_checks.patch
new file mode 100644
index 00000000..fd22200a
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/610-netfilter_match_bypass_default_checks.patch
@@ -0,0 +1,110 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: kernel: add a new version of my netfilter speedup patches for linux 2.6.39 and 3.0
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ include/uapi/linux/netfilter_ipv4/ip_tables.h |  1 +
+ net/ipv4/netfilter/ip_tables.c                | 37 +++++++++++++++++++++++++++
+ 2 files changed, 38 insertions(+)
+
+--- a/include/uapi/linux/netfilter_ipv4/ip_tables.h
++++ b/include/uapi/linux/netfilter_ipv4/ip_tables.h
+@@ -89,6 +89,7 @@ struct ipt_ip {
+ #define IPT_F_FRAG		0x01	/* Set if rule is a fragment rule */
+ #define IPT_F_GOTO		0x02	/* Set if jump is a goto */
+ #define IPT_F_MASK		0x03	/* All possible flag bits mask. */
++#define IPT_F_NO_DEF_MATCH	0x80	/* Internal: no default match rules present */
+ 
+ /* Values for "inv" field in struct ipt_ip. */
+ #define IPT_INV_VIA_IN		0x01	/* Invert the sense of IN IFACE. */
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -48,6 +48,9 @@ ip_packet_match(const struct iphdr *ip,
+ {
+ 	unsigned long ret;
+ 
++	if (ipinfo->flags & IPT_F_NO_DEF_MATCH)
++		return true;
++
+ 	if (NF_INVF(ipinfo, IPT_INV_SRCIP,
+ 		    (ip->saddr & ipinfo->smsk.s_addr) != ipinfo->src.s_addr) ||
+ 	    NF_INVF(ipinfo, IPT_INV_DSTIP,
+@@ -78,6 +81,29 @@ ip_packet_match(const struct iphdr *ip,
+ 	return true;
+ }
+ 
++static void
++ip_checkdefault(struct ipt_ip *ip)
++{
++	static const char iface_mask[IFNAMSIZ] = {};
++
++	if (ip->invflags || ip->flags & IPT_F_FRAG)
++		return;
++
++	if (memcmp(ip->iniface_mask, iface_mask, IFNAMSIZ) != 0)
++		return;
++
++	if (memcmp(ip->outiface_mask, iface_mask, IFNAMSIZ) != 0)
++		return;
++
++	if (ip->smsk.s_addr || ip->dmsk.s_addr)
++		return;
++
++	if (ip->proto)
++		return;
++
++	ip->flags |= IPT_F_NO_DEF_MATCH;
++}
++
+ static bool
+ ip_checkentry(const struct ipt_ip *ip)
+ {
+@@ -523,6 +549,8 @@ find_check_entry(struct ipt_entry *e, st
+ 	struct xt_mtchk_param mtpar;
+ 	struct xt_entry_match *ematch;
+ 
++	ip_checkdefault(&e->ip);
++
+ 	if (!xt_percpu_counter_alloc(alloc_state, &e->counters))
+ 		return -ENOMEM;
+ 
+@@ -817,6 +845,7 @@ copy_entries_to_user(unsigned int total_
+ 	const struct xt_table_info *private = table->private;
+ 	int ret = 0;
+ 	const void *loc_cpu_entry;
++	u8 flags;
+ 
+ 	counters = alloc_counters(table);
+ 	if (IS_ERR(counters))
+@@ -844,6 +873,14 @@ copy_entries_to_user(unsigned int total_
+ 			goto free_counters;
+ 		}
+ 
++		flags = e->ip.flags & IPT_F_MASK;
++		if (copy_to_user(userptr + off
++				 + offsetof(struct ipt_entry, ip.flags),
++				 &flags, sizeof(flags)) != 0) {
++			ret = -EFAULT;
++			goto free_counters;
++		}
++
+ 		for (i = sizeof(struct ipt_entry);
+ 		     i < e->target_offset;
+ 		     i += m->u.match_size) {
+@@ -1225,12 +1262,15 @@ compat_copy_entry_to_user(struct ipt_ent
+ 	compat_uint_t origsize;
+ 	const struct xt_entry_match *ematch;
+ 	int ret = 0;
++	u8 flags = e->ip.flags & IPT_F_MASK;
+ 
+ 	origsize = *size;
+ 	ce = *dstptr;
+ 	if (copy_to_user(ce, e, sizeof(struct ipt_entry)) != 0 ||
+ 	    copy_to_user(&ce->counters, &counters[i],
+-	    sizeof(counters[i])) != 0)
++	    sizeof(counters[i])) != 0 ||
++	    copy_to_user(&ce->ip.flags, &flags,
++	    sizeof(flags)) != 0)
+ 		return -EFAULT;
+ 
+ 	*dstptr += sizeof(struct compat_ipt_entry);
diff --git a/6.12/target/linux/generic/pending-6.12/611-netfilter_match_bypass_default_table.patch b/6.12/target/linux/generic/pending-6.12/611-netfilter_match_bypass_default_table.patch
new file mode 100644
index 00000000..9f0efe4e
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/611-netfilter_match_bypass_default_table.patch
@@ -0,0 +1,106 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: netfilter: match bypass default table
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ net/ipv4/netfilter/ip_tables.c | 79 +++++++++++++++++++++++++++++++-----------
+ 1 file changed, 58 insertions(+), 21 deletions(-)
+
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -244,6 +244,33 @@ struct ipt_entry *ipt_next_entry(const s
+ 	return (void *)entry + entry->next_offset;
+ }
+ 
++static bool
++ipt_handle_default_rule(struct ipt_entry *e, unsigned int *verdict)
++{
++	struct xt_entry_target *t;
++	struct xt_standard_target *st;
++
++	if (e->target_offset != sizeof(struct ipt_entry))
++		return false;
++
++	if (!(e->ip.flags & IPT_F_NO_DEF_MATCH))
++		return false;
++
++	t = ipt_get_target(e);
++	if (t->u.kernel.target->target)
++		return false;
++
++	st = (struct xt_standard_target *) t;
++	if (st->verdict == XT_RETURN)
++		return false;
++
++	if (st->verdict >= 0)
++		return false;
++
++	*verdict = (unsigned)(-st->verdict) - 1;
++	return true;
++}
++
+ /* Returns one of the generic firewall policies, like NF_ACCEPT. */
+ unsigned int
+ ipt_do_table(void *priv,
+@@ -265,27 +292,28 @@ ipt_do_table(void *priv,
+ 	unsigned int addend;
+ 
+ 	/* Initialization */
++	WARN_ON(!(table->valid_hooks & (1 << hook)));
++	local_bh_disable();
++	private = READ_ONCE(table->private); /* Address dependency. */
++	cpu        = smp_processor_id();
++	table_base = private->entries;
++
++	e = get_entry(table_base, private->hook_entry[hook]);
++	if (ipt_handle_default_rule(e, &verdict)) {
++		struct xt_counters *counter;
++
++		counter = xt_get_this_cpu_counter(&e->counters);
++		ADD_COUNTER(*counter, skb->len, 1);
++		local_bh_enable();
++		return verdict;
++	}
++
+ 	stackidx = 0;
+ 	ip = ip_hdr(skb);
+ 	indev = state->in ? state->in->name : nulldevname;
+ 	outdev = state->out ? state->out->name : nulldevname;
+-	/* We handle fragments by dealing with the first fragment as
+-	 * if it was a normal packet.  All other fragments are treated
+-	 * normally, except that they will NEVER match rules that ask
+-	 * things we don't know, ie. tcp syn flag or ports).  If the
+-	 * rule is also a fragment-specific rule, non-fragments won't
+-	 * match it. */
+-	acpar.fragoff = ntohs(ip->frag_off) & IP_OFFSET;
+-	acpar.thoff   = ip_hdrlen(skb);
+-	acpar.hotdrop = false;
+-	acpar.state   = state;
+ 
+-	WARN_ON(!(table->valid_hooks & (1 << hook)));
+-	local_bh_disable();
+ 	addend = xt_write_recseq_begin();
+-	private = READ_ONCE(table->private); /* Address dependency. */
+-	cpu        = smp_processor_id();
+-	table_base = private->entries;
+ 	jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
+ 
+ 	/* Switch to alternate jumpstack if we're being invoked via TEE.
+@@ -298,7 +326,16 @@ ipt_do_table(void *priv,
+ 	if (static_key_false(&xt_tee_enabled))
+ 		jumpstack += private->stacksize * __this_cpu_read(nf_skb_duplicated);
+ 
+-	e = get_entry(table_base, private->hook_entry[hook]);
++	/* We handle fragments by dealing with the first fragment as
++	 * if it was a normal packet.  All other fragments are treated
++	 * normally, except that they will NEVER match rules that ask
++	 * things we don't know, ie. tcp syn flag or ports).  If the
++	 * rule is also a fragment-specific rule, non-fragments won't
++	 * match it. */
++	acpar.fragoff = ntohs(ip->frag_off) & IP_OFFSET;
++	acpar.thoff   = ip_hdrlen(skb);
++	acpar.hotdrop = false;
++	acpar.state   = state;
+ 
+ 	do {
+ 		const struct xt_entry_target *t;
diff --git a/6.12/target/linux/generic/pending-6.12/612-netfilter_match_reduce_memory_access.patch b/6.12/target/linux/generic/pending-6.12/612-netfilter_match_reduce_memory_access.patch
new file mode 100644
index 00000000..7f291fc0
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/612-netfilter_match_reduce_memory_access.patch
@@ -0,0 +1,22 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: netfilter: reduce match memory access
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ net/ipv4/netfilter/ip_tables.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -51,9 +51,9 @@ ip_packet_match(const struct iphdr *ip,
+ 	if (ipinfo->flags & IPT_F_NO_DEF_MATCH)
+ 		return true;
+ 
+-	if (NF_INVF(ipinfo, IPT_INV_SRCIP,
++	if (NF_INVF(ipinfo, IPT_INV_SRCIP, ipinfo->smsk.s_addr &&
+ 		    (ip->saddr & ipinfo->smsk.s_addr) != ipinfo->src.s_addr) ||
+-	    NF_INVF(ipinfo, IPT_INV_DSTIP,
++	    NF_INVF(ipinfo, IPT_INV_DSTIP, ipinfo->dmsk.s_addr &&
+ 		    (ip->daddr & ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr))
+ 		return false;
+ 
diff --git a/6.12/target/linux/generic/pending-6.12/620-net_sched-codel-do-not-defer-queue-length-update.patch b/6.12/target/linux/generic/pending-6.12/620-net_sched-codel-do-not-defer-queue-length-update.patch
new file mode 100644
index 00000000..ec7a617a
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/620-net_sched-codel-do-not-defer-queue-length-update.patch
@@ -0,0 +1,86 @@
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Date: Mon, 21 Aug 2017 11:14:14 +0300
+Subject: [PATCH] net_sched/codel: do not defer queue length update
+
+When codel wants to drop last packet in ->dequeue() it cannot call
+qdisc_tree_reduce_backlog() right away - it will notify parent qdisc
+about zero qlen and HTB/HFSC will deactivate class. The same class will
+be deactivated second time by caller of ->dequeue(). Currently codel and
+fq_codel defer update. This triggers warning in HFSC when it's qlen != 0
+but there is no active classes.
+
+This patch update parent queue length immediately: just temporary increase
+qlen around qdisc_tree_reduce_backlog() to prevent first class deactivation
+if we have skb to return.
+
+This might open another problem in HFSC - now operation peek could fail and
+deactivate parent class.
+
+Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=109581
+---
+
+--- a/net/sched/sch_codel.c
++++ b/net/sched/sch_codel.c
+@@ -65,11 +65,17 @@ static struct sk_buff *codel_qdisc_deque
+ 			    &q->stats, qdisc_pkt_len, codel_get_enqueue_time,
+ 			    drop_func, dequeue_func);
+ 
+-	/* We cant call qdisc_tree_reduce_backlog() if our qlen is 0,
+-	 * or HTB crashes. Defer it for next round.
++	/* If our qlen is 0 qdisc_tree_reduce_backlog() will deactivate
++	 * parent class, dequeue in parent qdisc will do the same if we
++	 * return skb. Temporary increment qlen if we have skb.
+ 	 */
+-	if (q->stats.drop_count && sch->q.qlen) {
+-		qdisc_tree_reduce_backlog(sch, q->stats.drop_count, q->stats.drop_len);
++	if (q->stats.drop_count) {
++		if (skb)
++			sch->q.qlen++;
++		qdisc_tree_reduce_backlog(sch, q->stats.drop_count,
++					  q->stats.drop_len);
++		if (skb)
++			sch->q.qlen--;
+ 		q->stats.drop_count = 0;
+ 		q->stats.drop_len = 0;
+ 	}
+--- a/net/sched/sch_fq_codel.c
++++ b/net/sched/sch_fq_codel.c
+@@ -304,6 +304,21 @@ begin:
+ 			    &flow->cvars, &q->cstats, qdisc_pkt_len,
+ 			    codel_get_enqueue_time, drop_func, dequeue_func);
+ 
++	/* If our qlen is 0 qdisc_tree_reduce_backlog() will deactivate
++	 * parent class, dequeue in parent qdisc will do the same if we
++	 * return skb. Temporary increment qlen if we have skb.
++	 */
++	if (q->cstats.drop_count) {
++		if (skb)
++			sch->q.qlen++;
++		qdisc_tree_reduce_backlog(sch, q->cstats.drop_count,
++					  q->cstats.drop_len);
++		if (skb)
++			sch->q.qlen--;
++		q->cstats.drop_count = 0;
++		q->cstats.drop_len = 0;
++	}
++
+ 	if (!skb) {
+ 		/* force a pass through old_flows to prevent starvation */
+ 		if ((head == &q->new_flows) && !list_empty(&q->old_flows))
+@@ -314,15 +329,6 @@ begin:
+ 	}
+ 	qdisc_bstats_update(sch, skb);
+ 	flow->deficit -= qdisc_pkt_len(skb);
+-	/* We cant call qdisc_tree_reduce_backlog() if our qlen is 0,
+-	 * or HTB crashes. Defer it for next round.
+-	 */
+-	if (q->cstats.drop_count && sch->q.qlen) {
+-		qdisc_tree_reduce_backlog(sch, q->cstats.drop_count,
+-					  q->cstats.drop_len);
+-		q->cstats.drop_count = 0;
+-		q->cstats.drop_len = 0;
+-	}
+ 	return skb;
+ }
+ 
diff --git a/6.12/target/linux/generic/pending-6.12/630-packet_socket_type.patch b/6.12/target/linux/generic/pending-6.12/630-packet_socket_type.patch
new file mode 100644
index 00000000..fff421bd
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/630-packet_socket_type.patch
@@ -0,0 +1,138 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: net: add an optimization for dealing with raw sockets
+
+lede-commit: 4898039703d7315f0f3431c860123338ec3be0f6
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ include/uapi/linux/if_packet.h |  3 +++
+ net/packet/af_packet.c         | 34 +++++++++++++++++++++++++++-------
+ net/packet/internal.h          |  1 +
+ 3 files changed, 31 insertions(+), 7 deletions(-)
+
+--- a/include/uapi/linux/if_packet.h
++++ b/include/uapi/linux/if_packet.h
+@@ -33,6 +33,8 @@ struct sockaddr_ll {
+ #define PACKET_KERNEL		7		/* To kernel space	*/
+ /* Unused, PACKET_FASTROUTE and PACKET_LOOPBACK are invisible to user space */
+ #define PACKET_FASTROUTE	6		/* Fastrouted frame	*/
++#define PACKET_MASK_ANY		0xffffffff	/* mask for packet type bits */
++
+ 
+ /* Packet socket options */
+ 
+@@ -60,6 +62,7 @@ struct sockaddr_ll {
+ #define PACKET_FANOUT_DATA		22
+ #define PACKET_IGNORE_OUTGOING		23
+ #define PACKET_VNET_HDR_SZ		24
++#define PACKET_RECV_TYPE		25
+ 
+ #define PACKET_FANOUT_HASH		0
+ #define PACKET_FANOUT_LB		1
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1911,6 +1911,7 @@ static int packet_rcv_spkt(struct sk_buf
+ {
+ 	struct sock *sk;
+ 	struct sockaddr_pkt *spkt;
++	struct packet_sock *po;
+ 
+ 	/*
+ 	 *	When we registered the protocol we saved the socket in the data
+@@ -1918,6 +1919,7 @@ static int packet_rcv_spkt(struct sk_buf
+ 	 */
+ 
+ 	sk = pt->af_packet_priv;
++	po = pkt_sk(sk);
+ 
+ 	/*
+ 	 *	Yank back the headers [hope the device set this
+@@ -1930,7 +1932,7 @@ static int packet_rcv_spkt(struct sk_buf
+ 	 *	so that this procedure is noop.
+ 	 */
+ 
+-	if (skb->pkt_type == PACKET_LOOPBACK)
++	if (!(po->pkt_type & (1 << skb->pkt_type)))
+ 		goto out;
+ 
+ 	if (!net_eq(dev_net(dev), sock_net(sk)))
+@@ -2175,12 +2177,12 @@ static int packet_rcv(struct sk_buff *sk
+ 	int skb_len = skb->len;
+ 	unsigned int snaplen, res;
+ 
+-	if (skb->pkt_type == PACKET_LOOPBACK)
+-		goto drop;
+-
+ 	sk = pt->af_packet_priv;
+ 	po = pkt_sk(sk);
+ 
++	if (!(po->pkt_type & (1 << skb->pkt_type)))
++		goto drop;
++
+ 	if (!net_eq(dev_net(dev), sock_net(sk)))
+ 		goto drop;
+ 
+@@ -2304,12 +2306,12 @@ static int tpacket_rcv(struct sk_buff *s
+ 	BUILD_BUG_ON(TPACKET_ALIGN(sizeof(*h.h2)) != 32);
+ 	BUILD_BUG_ON(TPACKET_ALIGN(sizeof(*h.h3)) != 48);
+ 
+-	if (skb->pkt_type == PACKET_LOOPBACK)
+-		goto drop;
+-
+ 	sk = pt->af_packet_priv;
+ 	po = pkt_sk(sk);
+ 
++	if (!(po->pkt_type & (1 << skb->pkt_type)))
++		goto drop;
++
+ 	if (!net_eq(dev_net(dev), sock_net(sk)))
+ 		goto drop;
+ 
+@@ -3430,6 +3432,7 @@ static int packet_create(struct net *net
+ 	mutex_init(&po->pg_vec_lock);
+ 	po->rollover = NULL;
+ 	po->prot_hook.func = packet_rcv;
++	po->pkt_type = PACKET_MASK_ANY & ~(1 << PACKET_LOOPBACK);
+ 
+ 	if (sock->type == SOCK_PACKET)
+ 		po->prot_hook.func = packet_rcv_spkt;
+@@ -4097,6 +4100,16 @@ packet_setsockopt(struct socket *sock, i
+ 		packet_sock_flag_set(po, PACKET_SOCK_QDISC_BYPASS, val);
+ 		return 0;
+ 	}
++	case PACKET_RECV_TYPE:
++	{
++		unsigned int val;
++		if (optlen != sizeof(val))
++			return -EINVAL;
++		if (copy_from_sockptr(&val, optval, sizeof(val)))
++			return -EFAULT;
++		po->pkt_type = val & ~BIT(PACKET_LOOPBACK);
++		return 0;
++	}
+ 	default:
+ 		return -ENOPROTOOPT;
+ 	}
+@@ -4159,6 +4172,13 @@ static int packet_getsockopt(struct sock
+ 	case PACKET_COPY_THRESH:
+ 		val = READ_ONCE(pkt_sk(sk)->copy_thresh);
+ 		break;
++	case PACKET_RECV_TYPE:
++		if (len > sizeof(unsigned int))
++			len = sizeof(unsigned int);
++		val = po->pkt_type;
++
++		data = &val;
++		break;
+ 	case PACKET_VERSION:
+ 		val = po->tp_version;
+ 		break;
+--- a/net/packet/internal.h
++++ b/net/packet/internal.h
+@@ -131,6 +131,7 @@ struct packet_sock {
+ 	struct net_device __rcu	*cached_dev;
+ 	struct packet_type	prot_hook ____cacheline_aligned_in_smp;
+ 	atomic_t		tp_drops ____cacheline_aligned_in_smp;
++	unsigned int		pkt_type;
+ };
+ 
+ #define pkt_sk(ptr) container_of_const(ptr, struct packet_sock, sk)
diff --git a/6.12/target/linux/generic/pending-6.12/640-net-bridge-fix-switchdev-host-mdb-entry-updates.patch b/6.12/target/linux/generic/pending-6.12/640-net-bridge-fix-switchdev-host-mdb-entry-updates.patch
new file mode 100644
index 00000000..cf55c6a3
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/640-net-bridge-fix-switchdev-host-mdb-entry-updates.patch
@@ -0,0 +1,42 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 22 Aug 2024 18:02:17 +0200
+Subject: [PATCH] net: bridge: fix switchdev host mdb entry updates
+
+When a mdb entry is removed, the bridge switchdev code can issue a
+switchdev_port_obj_del call for a port that was not offloaded.
+
+This leads to an imbalance in switchdev_port_obj_add/del calls, since
+br_switchdev_mdb_replay has not been called for the port before.
+
+This can lead to potential multicast forwarding issues and messages such as:
+mt7915e 0000:01:00.0 wl1-ap0: Failed to del Host Multicast Database entry
+	(object id=3) with error: -ENOENT (-2).
+
+Fix this issue by checking the port offload status when iterating over
+lower devs.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/bridge/br_switchdev.c
++++ b/net/bridge/br_switchdev.c
+@@ -568,10 +568,18 @@ static void br_switchdev_host_mdb(struct
+ 				  struct net_bridge_mdb_entry *mp, int type)
+ {
+ 	struct net_device *lower_dev;
++	struct net_bridge_port *port;
+ 	struct list_head *iter;
+ 
+-	netdev_for_each_lower_dev(dev, lower_dev, iter)
++	rcu_read_lock();
++	netdev_for_each_lower_dev(dev, lower_dev, iter) {
++		port = br_port_get_rcu(lower_dev);
++		if (!port || !port->offload_count)
++			continue;
++
+ 		br_switchdev_host_mdb_one(dev, lower_dev, mp, type);
++	}
++	rcu_read_unlock();
+ }
+ 
+ static int
diff --git a/6.12/target/linux/generic/pending-6.12/641-net-bridge-switchdev-Don-t-drop-packets-between-port.patch b/6.12/target/linux/generic/pending-6.12/641-net-bridge-switchdev-Don-t-drop-packets-between-port.patch
new file mode 100644
index 00000000..1c4ec61b
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/641-net-bridge-switchdev-Don-t-drop-packets-between-port.patch
@@ -0,0 +1,38 @@
+From: "Leon M. Busch-George" <leon@georgemail.eu>
+Date: Sun, 20 Oct 2024 18:20:14 +0200
+Subject: [PATCH] net: bridge: switchdev: Don't drop packets between ports with
+ no hwdom
+
+nbp_switchdev_allowed_egress uses hwdom to determine whether or not a
+packet has already been forwarded to a hardware domain. For
+net_bridge_ports that aren't set up to use forward offloading, hwdom is
+set to 0. When both ingress and egress port have no hwdom,
+'cb->src_hwdom != p->hwdom' indicates that the packet is already known in
+the target domain - which it isn't - and the packet is wrongly dropped.
+
+The error was found on a bridge containing a wifi device and a VLAN
+tagging device (e.g. eth0.12). With VLAN filtering, this shouldn't happen.
+
+This patch adds a check for p->hwdom != 0 before comparing hardware
+domains to restore forwarding between ports with hwdom = 0.
+
+fwd_hwdoms are only set for ports with offloading enabled, which also
+implies a valid hwdom, so the check '!test_bit(p->hwdom, &cb->fwd_hwdoms)'
+doesn't fail in this way (yet - fingers crossed..) and it is left in place.
+
+Co-developed-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
+---
+
+--- a/net/bridge/br_switchdev.c
++++ b/net/bridge/br_switchdev.c
+@@ -67,7 +67,7 @@ bool nbp_switchdev_allowed_egress(const
+ 	struct br_input_skb_cb *cb = BR_INPUT_SKB_CB(skb);
+ 
+ 	return !test_bit(p->hwdom, &cb->fwd_hwdoms) &&
+-		(!skb->offload_fwd_mark || cb->src_hwdom != p->hwdom);
++		(!skb->offload_fwd_mark || !p->hwdom || cb->src_hwdom != p->hwdom);
+ }
+ 
+ /* Flags that can be offloaded to hardware */
diff --git a/6.12/target/linux/generic/pending-6.12/655-increase_skb_pad.patch b/6.12/target/linux/generic/pending-6.12/655-increase_skb_pad.patch
new file mode 100644
index 00000000..6fa33582
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/655-increase_skb_pad.patch
@@ -0,0 +1,20 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: kernel: add a few patches for avoiding unnecessary skb reallocations - significantly improves ethernet<->wireless performance
+
+lede-commit: 6f89cffc9add6939d44a6b54cf9a5e77849aa7fd
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ include/linux/skbuff.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -3180,7 +3180,7 @@ static inline int pskb_network_may_pull(
+  * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
+  */
+ #ifndef NET_SKB_PAD
+-#define NET_SKB_PAD	max(32, L1_CACHE_BYTES)
++#define NET_SKB_PAD	max(64, L1_CACHE_BYTES)
+ #endif
+ 
+ int ___pskb_trim(struct sk_buff *skb, unsigned int len);
diff --git a/6.12/target/linux/generic/pending-6.12/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch b/6.12/target/linux/generic/pending-6.12/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
new file mode 100644
index 00000000..f0e8a63a
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
@@ -0,0 +1,511 @@
+From: Steven Barth <steven@midlink.org>
+Subject: Add support for MAP-E FMRs (mesh mode)
+
+MAP-E FMRs (draft-ietf-softwire-map-10) are rules for IPv4-communication
+between MAP CEs (mesh mode) without the need to forward such data to a
+border relay. This is similar to how 6rd works but for IPv4 over IPv6.
+
+Signed-off-by: Steven Barth <cyrus@openwrt.org>
+---
+ include/net/ip6_tunnel.h       |  13 ++
+ include/uapi/linux/if_tunnel.h |  13 ++
+ net/ipv6/ip6_tunnel.c          | 276 +++++++++++++++++++++++++++++++++++++++--
+ 3 files changed, 291 insertions(+), 11 deletions(-)
+
+--- a/include/net/ip6_tunnel.h
++++ b/include/net/ip6_tunnel.h
+@@ -18,6 +18,18 @@
+ /* determine capability on a per-packet basis */
+ #define IP6_TNL_F_CAP_PER_PACKET 0x40000
+ 
++/* IPv6 tunnel FMR */
++struct __ip6_tnl_fmr {
++	struct __ip6_tnl_fmr *next; /* next fmr in list */
++	struct in6_addr ip6_prefix;
++	struct in_addr ip4_prefix;
++
++	__u8 ip6_prefix_len;
++	__u8 ip4_prefix_len;
++	__u8 ea_len;
++	__u8 offset;
++};
++
+ struct __ip6_tnl_parm {
+ 	char name[IFNAMSIZ];	/* name of tunnel device */
+ 	int link;		/* ifindex of underlying L2 interface */
+@@ -29,6 +41,7 @@ struct __ip6_tnl_parm {
+ 	__u32 flags;		/* tunnel flags */
+ 	struct in6_addr laddr;	/* local tunnel end-point address */
+ 	struct in6_addr raddr;	/* remote tunnel end-point address */
++	struct __ip6_tnl_fmr *fmrs;	/* FMRs */
+ 
+ 	IP_TUNNEL_DECLARE_FLAGS(i_flags);
+ 	IP_TUNNEL_DECLARE_FLAGS(o_flags);
+--- a/include/uapi/linux/if_tunnel.h
++++ b/include/uapi/linux/if_tunnel.h
+@@ -77,10 +77,23 @@ enum {
+ 	IFLA_IPTUN_ENCAP_DPORT,
+ 	IFLA_IPTUN_COLLECT_METADATA,
+ 	IFLA_IPTUN_FWMARK,
++	IFLA_IPTUN_FMRS,
+ 	__IFLA_IPTUN_MAX,
+ };
+ #define IFLA_IPTUN_MAX	(__IFLA_IPTUN_MAX - 1)
+ 
++enum {
++	IFLA_IPTUN_FMR_UNSPEC,
++	IFLA_IPTUN_FMR_IP6_PREFIX,
++	IFLA_IPTUN_FMR_IP4_PREFIX,
++	IFLA_IPTUN_FMR_IP6_PREFIX_LEN,
++	IFLA_IPTUN_FMR_IP4_PREFIX_LEN,
++	IFLA_IPTUN_FMR_EA_LEN,
++	IFLA_IPTUN_FMR_OFFSET,
++	__IFLA_IPTUN_FMR_MAX,
++};
++#define IFLA_IPTUN_FMR_MAX (__IFLA_IPTUN_FMR_MAX - 1)
++
+ enum tunnel_encap_types {
+ 	TUNNEL_ENCAP_NONE,
+ 	TUNNEL_ENCAP_FOU,
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -11,6 +11,9 @@
+  *      linux/net/ipv6/sit.c and linux/net/ipv4/ipip.c
+  *
+  *      RFC 2473
++ *
++ *      Changes:
++ *      Steven Barth <cyrus@openwrt.org>:           MAP-E FMR support
+  */
+ 
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+@@ -68,9 +71,9 @@ static bool log_ecn_error = true;
+ module_param(log_ecn_error, bool, 0644);
+ MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN");
+ 
+-static u32 HASH(const struct in6_addr *addr1, const struct in6_addr *addr2)
++static u32 HASH(const struct in6_addr *addr)
+ {
+-	u32 hash = ipv6_addr_hash(addr1) ^ ipv6_addr_hash(addr2);
++	u32 hash = ipv6_addr_hash(addr);
+ 
+ 	return hash_32(hash, IP6_TUNNEL_HASH_SIZE_SHIFT);
+ }
+@@ -115,17 +118,33 @@ static struct ip6_tnl *
+ ip6_tnl_lookup(struct net *net, int link,
+ 	       const struct in6_addr *remote, const struct in6_addr *local)
+ {
+-	unsigned int hash = HASH(remote, local);
++	unsigned int hash = HASH(local);
+ 	struct ip6_tnl *t, *cand = NULL;
+ 	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
+ 	struct in6_addr any;
+ 
+ 	for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
+ 		if (!ipv6_addr_equal(local, &t->parms.laddr) ||
+-		    !ipv6_addr_equal(remote, &t->parms.raddr) ||
+ 		    !(t->dev->flags & IFF_UP))
+ 			continue;
+ 
++		if (!ipv6_addr_equal(remote, &t->parms.raddr)) {
++			struct __ip6_tnl_fmr *fmr;
++			bool found = false;
++
++			for (fmr = t->parms.fmrs; fmr; fmr = fmr->next) {
++				if (!ipv6_prefix_equal(remote, &fmr->ip6_prefix,
++						       fmr->ip6_prefix_len))
++					continue;
++
++				found = true;
++				break;
++			}
++
++			if (!found)
++				continue;
++		}
++
+ 		if (link == t->parms.link)
+ 			return t;
+ 		else
+@@ -133,7 +152,7 @@ ip6_tnl_lookup(struct net *net, int link
+ 	}
+ 
+ 	memset(&any, 0, sizeof(any));
+-	hash = HASH(&any, local);
++	hash = HASH(local);
+ 	for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
+ 		if (!ipv6_addr_equal(local, &t->parms.laddr) ||
+ 		    !ipv6_addr_any(&t->parms.raddr) ||
+@@ -146,7 +165,7 @@ ip6_tnl_lookup(struct net *net, int link
+ 			cand = t;
+ 	}
+ 
+-	hash = HASH(remote, &any);
++	hash = HASH(&any);
+ 	for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
+ 		if (!ipv6_addr_equal(remote, &t->parms.raddr) ||
+ 		    !ipv6_addr_any(&t->parms.laddr) ||
+@@ -195,7 +214,7 @@ ip6_tnl_bucket(struct ip6_tnl_net *ip6n,
+ 
+ 	if (!ipv6_addr_any(remote) || !ipv6_addr_any(local)) {
+ 		prio = 1;
+-		h = HASH(remote, local);
++		h = HASH(local);
+ 	}
+ 	return &ip6n->tnls[prio][h];
+ }
+@@ -376,6 +395,12 @@ ip6_tnl_dev_uninit(struct net_device *de
+ 	struct net *net = t->net;
+ 	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
+ 
++	while (t->parms.fmrs) {
++		struct __ip6_tnl_fmr *next = t->parms.fmrs->next;
++		kfree(t->parms.fmrs);
++		t->parms.fmrs = next;
++	}
++
+ 	if (dev == ip6n->fb_tnl_dev)
+ 		RCU_INIT_POINTER(ip6n->tnls_wc[0], NULL);
+ 	else
+@@ -790,6 +815,107 @@ int ip6_tnl_rcv_ctl(struct ip6_tnl *t,
+ }
+ EXPORT_SYMBOL_GPL(ip6_tnl_rcv_ctl);
+ 
++/**
++ * ip4ip6_fmr_calc - calculate target / source IPv6-address based on FMR
++ *   @dest: destination IPv6 address buffer
++ *   @skb: received socket buffer
++ *   @fmr: MAP FMR
++ *   @xmit: Calculate for xmit or rcv
++ **/
++static void ip4ip6_fmr_calc(struct in6_addr *dest,
++		const struct iphdr *iph, const uint8_t *end,
++		const struct __ip6_tnl_fmr *fmr, bool xmit)
++{
++	int psidlen = fmr->ea_len - (32 - fmr->ip4_prefix_len);
++	u8 *portp = NULL;
++	bool use_dest_addr;
++	const struct iphdr *dsth = iph;
++
++	if ((u8*)dsth >= end)
++		return;
++
++	/* find significant IP header */
++	if (iph->protocol == IPPROTO_ICMP) {
++		struct icmphdr *ih = (struct icmphdr*)(((u8*)dsth) + dsth->ihl * 4);
++		if (ih && ((u8*)&ih[1]) <= end && (
++			ih->type == ICMP_DEST_UNREACH ||
++			ih->type == ICMP_SOURCE_QUENCH ||
++			ih->type == ICMP_TIME_EXCEEDED ||
++			ih->type == ICMP_PARAMETERPROB ||
++			ih->type == ICMP_REDIRECT))
++				dsth = (const struct iphdr*)&ih[1];
++	}
++
++	/* in xmit-path use dest port by default and source port only if
++		this is an ICMP reply to something else; vice versa in rcv-path */
++	use_dest_addr = (xmit && dsth == iph) || (!xmit && dsth != iph);
++
++	/* get dst port */
++	if (((u8*)&dsth[1]) <= end && (
++		dsth->protocol == IPPROTO_UDP ||
++		dsth->protocol == IPPROTO_TCP ||
++		dsth->protocol == IPPROTO_SCTP ||
++		dsth->protocol == IPPROTO_DCCP)) {
++			/* for UDP, TCP, SCTP and DCCP source and dest port
++			follow IPv4 header directly */
++			portp = ((u8*)dsth) + dsth->ihl * 4;
++
++			if (use_dest_addr)
++				portp += sizeof(u16);
++	} else if (iph->protocol == IPPROTO_ICMP) {
++		struct icmphdr *ih = (struct icmphdr*)(((u8*)dsth) + dsth->ihl * 4);
++
++		/* use icmp identifier as port */
++		if (((u8*)&ih) <= end && (
++		    (use_dest_addr && (
++		    ih->type == ICMP_ECHOREPLY ||
++			ih->type == ICMP_TIMESTAMPREPLY ||
++			ih->type == ICMP_INFO_REPLY ||
++			ih->type == ICMP_ADDRESSREPLY)) ||
++			(!use_dest_addr && (
++			ih->type == ICMP_ECHO ||
++			ih->type == ICMP_TIMESTAMP ||
++			ih->type == ICMP_INFO_REQUEST ||
++			ih->type == ICMP_ADDRESS)
++			)))
++				portp = (u8*)&ih->un.echo.id;
++	}
++
++	if ((portp && &portp[2] <= end) || psidlen == 0) {
++		int frombyte = fmr->ip6_prefix_len / 8;
++		int fromrem = fmr->ip6_prefix_len % 8;
++		int bytes = sizeof(struct in6_addr) - frombyte;
++		const u32 *addr = (use_dest_addr) ? &iph->daddr : &iph->saddr;
++		u64 eabits = ((u64)ntohl(*addr)) << (32 + fmr->ip4_prefix_len);
++		u64 t = 0;
++
++		/* extract PSID from port and add it to eabits */
++		u16 psidbits = 0;
++		if (psidlen > 0) {
++			psidbits = ((u16)portp[0]) << 8 | ((u16)portp[1]);
++			psidbits >>= 16 - psidlen - fmr->offset;
++			psidbits = (u16)(psidbits << (16 - psidlen));
++			eabits |= ((u64)psidbits) << (48 - (fmr->ea_len - psidlen));
++		}
++
++		/* rewrite destination address */
++		*dest = fmr->ip6_prefix;
++		memcpy(&dest->s6_addr[10], addr, sizeof(*addr));
++		dest->s6_addr16[7] = htons(psidbits >> (16 - psidlen));
++
++		if (bytes > sizeof(u64))
++			bytes = sizeof(u64);
++
++		/* insert eabits */
++		memcpy(&t, &dest->s6_addr[frombyte], bytes);
++		t = be64_to_cpu(t) & ~(((((u64)1) << fmr->ea_len) - 1)
++			<< (64 - fmr->ea_len - fromrem));
++		t = cpu_to_be64(t | (eabits >> fromrem));
++		memcpy(&dest->s6_addr[frombyte], &t, bytes);
++	}
++}
++
++
+ static int __ip6_tnl_rcv(struct ip6_tnl *tunnel, struct sk_buff *skb,
+ 			 const struct tnl_ptk_info *tpi,
+ 			 struct metadata_dst *tun_dst,
+@@ -855,6 +981,27 @@ static int __ip6_tnl_rcv(struct ip6_tnl
+ 
+ 	memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
+ 
++	if (tpi->proto == htons(ETH_P_IP) && tunnel->parms.fmrs &&
++		!ipv6_addr_equal(&ipv6h->saddr, &tunnel->parms.raddr)) {
++			/* Packet didn't come from BR, so lookup FMR */
++			struct __ip6_tnl_fmr *fmr;
++			struct in6_addr expected = tunnel->parms.raddr;
++			for (fmr = tunnel->parms.fmrs; fmr; fmr = fmr->next)
++				if (ipv6_prefix_equal(&ipv6h->saddr,
++					&fmr->ip6_prefix, fmr->ip6_prefix_len))
++						break;
++
++			/* Check that IPv6 matches IPv4 source to prevent spoofing */
++			if (fmr)
++				ip4ip6_fmr_calc(&expected, ip_hdr(skb),
++						skb_tail_pointer(skb), fmr, false);
++
++			if (!ipv6_addr_equal(&ipv6h->saddr, &expected)) {
++				rcu_read_unlock();
++				goto drop;
++			}
++	}
++
+ 	__skb_tunnel_rx(skb, tunnel->dev, tunnel->net);
+ 
+ 	err = dscp_ecn_decapsulate(tunnel, ipv6h, skb);
+@@ -1004,6 +1151,7 @@ static void init_tel_txopt(struct ipv6_t
+ 	opt->ops.opt_nflen = 8;
+ }
+ 
++
+ /**
+  * ip6_tnl_addr_conflict - compare packet addresses to tunnel's own
+  *   @t: the outgoing tunnel device
+@@ -1294,6 +1442,7 @@ ipxip6_tnl_xmit(struct sk_buff *skb, str
+ 		u8 protocol)
+ {
+ 	struct ip6_tnl *t = netdev_priv(dev);
++	struct __ip6_tnl_fmr *fmr;
+ 	struct ipv6hdr *ipv6h;
+ 	const struct iphdr  *iph;
+ 	int encap_limit = -1;
+@@ -1393,6 +1542,18 @@ ipxip6_tnl_xmit(struct sk_buff *skb, str
+ 	fl6.flowi6_uid = sock_net_uid(dev_net(dev), NULL);
+ 	dsfield = INET_ECN_encapsulate(dsfield, orig_dsfield);
+ 
++	/* try to find matching FMR */
++	for (fmr = t->parms.fmrs; fmr; fmr = fmr->next) {
++		unsigned mshift = 32 - fmr->ip4_prefix_len;
++		if (ntohl(fmr->ip4_prefix.s_addr) >> mshift ==
++				ntohl(ip_hdr(skb)->daddr) >> mshift)
++			break;
++	}
++
++	/* change dstaddr according to FMR */
++	if (fmr)
++		ip4ip6_fmr_calc(&fl6.daddr, ip_hdr(skb), skb_tail_pointer(skb), fmr, true);
++
+ 	if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6))
+ 		return -1;
+ 
+@@ -1546,6 +1707,14 @@ ip6_tnl_change(struct ip6_tnl *t, const
+ 	t->parms.link = p->link;
+ 	t->parms.proto = p->proto;
+ 	t->parms.fwmark = p->fwmark;
++
++	while (t->parms.fmrs) {
++		struct __ip6_tnl_fmr *next = t->parms.fmrs->next;
++		kfree(t->parms.fmrs);
++		t->parms.fmrs = next;
++	}
++	t->parms.fmrs = p->fmrs;
++
+ 	dst_cache_reset(&t->dst_cache);
+ 	ip6_tnl_link_config(t);
+ }
+@@ -1580,6 +1749,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_
+ 	p->flowinfo = u->flowinfo;
+ 	p->link = u->link;
+ 	p->proto = u->proto;
++	p->fmrs = NULL;
+ 	memcpy(p->name, u->name, sizeof(u->name));
+ }
+ 
+@@ -1963,6 +2133,15 @@ static int ip6_tnl_validate(struct nlatt
+ 	return 0;
+ }
+ 
++static const struct nla_policy ip6_tnl_fmr_policy[IFLA_IPTUN_FMR_MAX + 1] = {
++	[IFLA_IPTUN_FMR_IP6_PREFIX] = { .len = sizeof(struct in6_addr) },
++	[IFLA_IPTUN_FMR_IP4_PREFIX] = { .len = sizeof(struct in_addr) },
++	[IFLA_IPTUN_FMR_IP6_PREFIX_LEN] = { .type = NLA_U8 },
++	[IFLA_IPTUN_FMR_IP4_PREFIX_LEN] = { .type = NLA_U8 },
++	[IFLA_IPTUN_FMR_EA_LEN] = { .type = NLA_U8 },
++	[IFLA_IPTUN_FMR_OFFSET] = { .type = NLA_U8 }
++};
++
+ static void ip6_tnl_netlink_parms(struct nlattr *data[],
+ 				  struct __ip6_tnl_parm *parms)
+ {
+@@ -2000,6 +2179,46 @@ static void ip6_tnl_netlink_parms(struct
+ 
+ 	if (data[IFLA_IPTUN_FWMARK])
+ 		parms->fwmark = nla_get_u32(data[IFLA_IPTUN_FWMARK]);
++
++	if (data[IFLA_IPTUN_FMRS]) {
++		unsigned rem;
++		struct nlattr *fmr;
++		nla_for_each_nested(fmr, data[IFLA_IPTUN_FMRS], rem) {
++			struct nlattr *fmrd[IFLA_IPTUN_FMR_MAX + 1], *c;
++			struct __ip6_tnl_fmr *nfmr;
++
++			nla_parse_nested(fmrd, IFLA_IPTUN_FMR_MAX,
++				fmr, ip6_tnl_fmr_policy, NULL);
++
++			if (!(nfmr = kzalloc(sizeof(*nfmr), GFP_KERNEL)))
++				continue;
++
++			nfmr->offset = 6;
++
++			if ((c = fmrd[IFLA_IPTUN_FMR_IP6_PREFIX]))
++				nla_memcpy(&nfmr->ip6_prefix, fmrd[IFLA_IPTUN_FMR_IP6_PREFIX],
++					sizeof(nfmr->ip6_prefix));
++
++			if ((c = fmrd[IFLA_IPTUN_FMR_IP4_PREFIX]))
++				nla_memcpy(&nfmr->ip4_prefix, fmrd[IFLA_IPTUN_FMR_IP4_PREFIX],
++					sizeof(nfmr->ip4_prefix));
++
++			if ((c = fmrd[IFLA_IPTUN_FMR_IP6_PREFIX_LEN]))
++				nfmr->ip6_prefix_len = nla_get_u8(c);
++
++			if ((c = fmrd[IFLA_IPTUN_FMR_IP4_PREFIX_LEN]))
++				nfmr->ip4_prefix_len = nla_get_u8(c);
++
++			if ((c = fmrd[IFLA_IPTUN_FMR_EA_LEN]))
++				nfmr->ea_len = nla_get_u8(c);
++
++			if ((c = fmrd[IFLA_IPTUN_FMR_OFFSET]))
++				nfmr->offset = nla_get_u8(c);
++
++			nfmr->next = parms->fmrs;
++			parms->fmrs = nfmr;
++		}
++	}
+ }
+ 
+ static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev,
+@@ -2083,6 +2302,12 @@ static void ip6_tnl_dellink(struct net_d
+ 
+ static size_t ip6_tnl_get_size(const struct net_device *dev)
+ {
++	const struct ip6_tnl *t = netdev_priv(dev);
++	struct __ip6_tnl_fmr *c;
++	int fmrs = 0;
++	for (c = t->parms.fmrs; c; c = c->next)
++		++fmrs;
++
+ 	return
+ 		/* IFLA_IPTUN_LINK */
+ 		nla_total_size(4) +
+@@ -2112,6 +2337,24 @@ static size_t ip6_tnl_get_size(const str
+ 		nla_total_size(0) +
+ 		/* IFLA_IPTUN_FWMARK */
+ 		nla_total_size(4) +
++		/* IFLA_IPTUN_FMRS */
++		nla_total_size(0) +
++		(
++			/* nest */
++			nla_total_size(0) +
++			/* IFLA_IPTUN_FMR_IP6_PREFIX */
++			nla_total_size(sizeof(struct in6_addr)) +
++			/* IFLA_IPTUN_FMR_IP4_PREFIX */
++			nla_total_size(sizeof(struct in_addr)) +
++			/* IFLA_IPTUN_FMR_EA_LEN */
++			nla_total_size(1) +
++			/* IFLA_IPTUN_FMR_IP6_PREFIX_LEN */
++			nla_total_size(1) +
++			/* IFLA_IPTUN_FMR_IP4_PREFIX_LEN */
++			nla_total_size(1) +
++			/* IFLA_IPTUN_FMR_OFFSET */
++			nla_total_size(1)
++		) * fmrs +
+ 		0;
+ }
+ 
+@@ -2119,6 +2362,9 @@ static int ip6_tnl_fill_info(struct sk_b
+ {
+ 	struct ip6_tnl *tunnel = netdev_priv(dev);
+ 	struct __ip6_tnl_parm *parm = &tunnel->parms;
++	struct __ip6_tnl_fmr *c;
++	int fmrcnt = 0;
++	struct nlattr *fmrs;
+ 
+ 	if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) ||
+ 	    nla_put_in6_addr(skb, IFLA_IPTUN_LOCAL, &parm->laddr) ||
+@@ -2128,9 +2374,27 @@ static int ip6_tnl_fill_info(struct sk_b
+ 	    nla_put_be32(skb, IFLA_IPTUN_FLOWINFO, parm->flowinfo) ||
+ 	    nla_put_u32(skb, IFLA_IPTUN_FLAGS, parm->flags) ||
+ 	    nla_put_u8(skb, IFLA_IPTUN_PROTO, parm->proto) ||
+-	    nla_put_u32(skb, IFLA_IPTUN_FWMARK, parm->fwmark))
++	    nla_put_u32(skb, IFLA_IPTUN_FWMARK, parm->fwmark) ||
++	    !(fmrs = nla_nest_start(skb, IFLA_IPTUN_FMRS)))
+ 		goto nla_put_failure;
+ 
++	for (c = parm->fmrs; c; c = c->next) {
++		struct nlattr *fmr = nla_nest_start(skb, ++fmrcnt);
++		if (!fmr ||
++			nla_put(skb, IFLA_IPTUN_FMR_IP6_PREFIX,
++				sizeof(c->ip6_prefix), &c->ip6_prefix) ||
++			nla_put(skb, IFLA_IPTUN_FMR_IP4_PREFIX,
++				sizeof(c->ip4_prefix), &c->ip4_prefix) ||
++			nla_put_u8(skb, IFLA_IPTUN_FMR_IP6_PREFIX_LEN, c->ip6_prefix_len) ||
++			nla_put_u8(skb, IFLA_IPTUN_FMR_IP4_PREFIX_LEN, c->ip4_prefix_len) ||
++			nla_put_u8(skb, IFLA_IPTUN_FMR_EA_LEN, c->ea_len) ||
++			nla_put_u8(skb, IFLA_IPTUN_FMR_OFFSET, c->offset))
++				goto nla_put_failure;
++
++		nla_nest_end(skb, fmr);
++	}
++	nla_nest_end(skb, fmrs);
++
+ 	if (nla_put_u16(skb, IFLA_IPTUN_ENCAP_TYPE, tunnel->encap.type) ||
+ 	    nla_put_be16(skb, IFLA_IPTUN_ENCAP_SPORT, tunnel->encap.sport) ||
+ 	    nla_put_be16(skb, IFLA_IPTUN_ENCAP_DPORT, tunnel->encap.dport) ||
+@@ -2170,6 +2434,7 @@ static const struct nla_policy ip6_tnl_p
+ 	[IFLA_IPTUN_ENCAP_DPORT]	= { .type = NLA_U16 },
+ 	[IFLA_IPTUN_COLLECT_METADATA]	= { .type = NLA_FLAG },
+ 	[IFLA_IPTUN_FWMARK]		= { .type = NLA_U32 },
++	[IFLA_IPTUN_FMRS]		= { .type = NLA_NESTED },
+ };
+ 
+ static struct rtnl_link_ops ip6_link_ops __read_mostly = {
diff --git a/6.12/target/linux/generic/pending-6.12/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch b/6.12/target/linux/generic/pending-6.12/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
new file mode 100644
index 00000000..52c3f5c8
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
@@ -0,0 +1,263 @@
+From: Jonas Gorski <jogo@openwrt.org>
+Subject: ipv6: allow rejecting with "source address failed policy"
+
+RFC6204 L-14 requires rejecting traffic from invalid addresses with
+ICMPv6 Destination Unreachable, Code 5 (Source address failed ingress/
+egress policy) on the LAN side, so add an appropriate rule for that.
+
+Signed-off-by: Jonas Gorski <jogo@openwrt.org>
+---
+ include/net/netns/ipv6.h       |  1 +
+ include/uapi/linux/fib_rules.h |  4 +++
+ include/uapi/linux/rtnetlink.h |  1 +
+ net/ipv4/fib_semantics.c       |  4 +++
+ net/ipv4/fib_trie.c            |  1 +
+ net/ipv4/ipmr.c                |  1 +
+ net/ipv6/fib6_rules.c          |  4 +++
+ net/ipv6/ip6mr.c               |  2 ++
+ net/ipv6/route.c               | 58 +++++++++++++++++++++++++++++++++++++++++-
+ 9 files changed, 75 insertions(+), 1 deletion(-)
+
+--- a/include/net/netns/ipv6.h
++++ b/include/net/netns/ipv6.h
+@@ -86,6 +86,7 @@ struct netns_ipv6 {
+ 	unsigned int		fib6_routes_require_src;
+ #endif
+ 	struct rt6_info         *ip6_prohibit_entry;
++	struct rt6_info		*ip6_policy_failed_entry;
+ 	struct rt6_info         *ip6_blk_hole_entry;
+ 	struct fib6_table       *fib6_local_tbl;
+ 	struct fib_rules_ops    *fib6_rules_ops;
+--- a/include/uapi/linux/fib_rules.h
++++ b/include/uapi/linux/fib_rules.h
+@@ -83,6 +83,10 @@ enum {
+ 	FR_ACT_BLACKHOLE,	/* Drop without notification */
+ 	FR_ACT_UNREACHABLE,	/* Drop with ENETUNREACH */
+ 	FR_ACT_PROHIBIT,	/* Drop with EACCES */
++	FR_ACT_RES9,
++	FR_ACT_RES10,
++	FR_ACT_RES11,
++	FR_ACT_POLICY_FAILED,	/* Drop with EACCES */
+ 	__FR_ACT_MAX,
+ };
+ 
+--- a/include/uapi/linux/rtnetlink.h
++++ b/include/uapi/linux/rtnetlink.h
+@@ -265,6 +265,7 @@ enum {
+ 	RTN_THROW,		/* Not in this table		*/
+ 	RTN_NAT,		/* Translate this address	*/
+ 	RTN_XRESOLVE,		/* Use external resolver	*/
++	RTN_POLICY_FAILED,	/* Failed ingress/egress policy */
+ 	__RTN_MAX
+ };
+ 
+--- a/net/ipv4/fib_semantics.c
++++ b/net/ipv4/fib_semantics.c
+@@ -145,6 +145,10 @@ const struct fib_prop fib_props[RTN_MAX
+ 		.error	= -EINVAL,
+ 		.scope	= RT_SCOPE_NOWHERE,
+ 	},
++	[RTN_POLICY_FAILED] = {
++		.error	= -EACCES,
++		.scope	= RT_SCOPE_UNIVERSE,
++	},
+ };
+ 
+ static void rt_fibinfo_free(struct rtable __rcu **rtp)
+--- a/net/ipv4/fib_trie.c
++++ b/net/ipv4/fib_trie.c
+@@ -2784,6 +2784,7 @@ static const char *const rtn_type_names[
+ 	[RTN_THROW] = "THROW",
+ 	[RTN_NAT] = "NAT",
+ 	[RTN_XRESOLVE] = "XRESOLVE",
++	[RTN_POLICY_FAILED] = "POLICY_FAILED",
+ };
+ 
+ static inline const char *rtn_type(char *buf, size_t len, unsigned int t)
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -191,6 +191,7 @@ static int ipmr_rule_action(struct fib_r
+ 	case FR_ACT_UNREACHABLE:
+ 		return -ENETUNREACH;
+ 	case FR_ACT_PROHIBIT:
++	case FR_ACT_POLICY_FAILED:
+ 		return -EACCES;
+ 	case FR_ACT_BLACKHOLE:
+ 	default:
+--- a/net/ipv6/fib6_rules.c
++++ b/net/ipv6/fib6_rules.c
+@@ -222,6 +222,10 @@ static int __fib6_rule_action(struct fib
+ 		err = -EACCES;
+ 		rt = net->ipv6.ip6_prohibit_entry;
+ 		goto discard_pkt;
++	case FR_ACT_POLICY_FAILED:
++		err = -EACCES;
++		rt = net->ipv6.ip6_policy_failed_entry;
++		goto discard_pkt;
+ 	}
+ 
+ 	tb_id = fib_rule_get_table(rule, arg);
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -180,6 +180,8 @@ static int ip6mr_rule_action(struct fib_
+ 		return -ENETUNREACH;
+ 	case FR_ACT_PROHIBIT:
+ 		return -EACCES;
++	case FR_ACT_POLICY_FAILED:
++		return -EACCES;
+ 	case FR_ACT_BLACKHOLE:
+ 	default:
+ 		return -EINVAL;
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -98,6 +98,8 @@ static int		ip6_pkt_discard(struct sk_bu
+ static int		ip6_pkt_discard_out(struct net *net, struct sock *sk, struct sk_buff *skb);
+ static int		ip6_pkt_prohibit(struct sk_buff *skb);
+ static int		ip6_pkt_prohibit_out(struct net *net, struct sock *sk, struct sk_buff *skb);
++static int		ip6_pkt_policy_failed(struct sk_buff *skb);
++static int		ip6_pkt_policy_failed_out(struct net *net, struct sock *sk, struct sk_buff *skb);
+ static void		ip6_link_failure(struct sk_buff *skb);
+ static void		ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
+ 					   struct sk_buff *skb, u32 mtu,
+@@ -316,6 +318,18 @@ static const struct rt6_info ip6_prohibi
+ 	.rt6i_flags	= (RTF_REJECT | RTF_NONEXTHOP),
+ };
+ 
++static const struct rt6_info ip6_policy_failed_entry_template = {
++	.dst = {
++		.__rcuref	= RCUREF_INIT(1),
++		.__use		= 1,
++		.obsolete	= DST_OBSOLETE_FORCE_CHK,
++		.error		= -EACCES,
++		.input		= ip6_pkt_policy_failed,
++		.output		= ip6_pkt_policy_failed_out,
++	},
++	.rt6i_flags	= (RTF_REJECT | RTF_NONEXTHOP),
++};
++
+ static const struct rt6_info ip6_blk_hole_entry_template = {
+ 	.dst = {
+ 		.__rcuref	= RCUREF_INIT(1),
+@@ -1051,6 +1065,7 @@ static const int fib6_prop[RTN_MAX + 1]
+ 	[RTN_BLACKHOLE]	= -EINVAL,
+ 	[RTN_UNREACHABLE] = -EHOSTUNREACH,
+ 	[RTN_PROHIBIT]	= -EACCES,
++	[RTN_POLICY_FAILED] = -EACCES,
+ 	[RTN_THROW]	= -EAGAIN,
+ 	[RTN_NAT]	= -EINVAL,
+ 	[RTN_XRESOLVE]	= -EINVAL,
+@@ -1086,6 +1101,10 @@ static void ip6_rt_init_dst_reject(struc
+ 		rt->dst.output = ip6_pkt_prohibit_out;
+ 		rt->dst.input = ip6_pkt_prohibit;
+ 		break;
++	case RTN_POLICY_FAILED:
++		rt->dst.output = ip6_pkt_policy_failed_out;
++		rt->dst.input = ip6_pkt_policy_failed;
++		break;
+ 	case RTN_THROW:
+ 	case RTN_UNREACHABLE:
+ 	default:
+@@ -4555,6 +4574,17 @@ static int ip6_pkt_prohibit_out(struct n
+ 	return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_OUTNOROUTES);
+ }
+ 
++static int ip6_pkt_policy_failed(struct sk_buff *skb)
++{
++	return ip6_pkt_drop(skb, ICMPV6_POLICY_FAIL, IPSTATS_MIB_INNOROUTES);
++}
++
++static int ip6_pkt_policy_failed_out(struct net *net, struct sock *sk, struct sk_buff *skb)
++{
++	skb->dev = skb_dst(skb)->dev;
++	return ip6_pkt_drop(skb, ICMPV6_POLICY_FAIL, IPSTATS_MIB_OUTNOROUTES);
++}
++
+ /*
+  *	Allocate a dst for local (unicast / anycast) address.
+  */
+@@ -5046,7 +5076,8 @@ static int rtm_to_fib6_config(struct sk_
+ 	if (rtm->rtm_type == RTN_UNREACHABLE ||
+ 	    rtm->rtm_type == RTN_BLACKHOLE ||
+ 	    rtm->rtm_type == RTN_PROHIBIT ||
+-	    rtm->rtm_type == RTN_THROW)
++	    rtm->rtm_type == RTN_THROW ||
++	    rtm->rtm_type == RTN_POLICY_FAILED)
+ 		cfg->fc_flags |= RTF_REJECT;
+ 
+ 	if (rtm->rtm_type == RTN_LOCAL)
+@@ -6306,6 +6337,8 @@ static int ip6_route_dev_notify(struct n
+ #ifdef CONFIG_IPV6_MULTIPLE_TABLES
+ 		net->ipv6.ip6_prohibit_entry->dst.dev = dev;
+ 		net->ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(dev);
++		net->ipv6.ip6_policy_failed_entry->dst.dev = dev;
++		net->ipv6.ip6_policy_failed_entry->rt6i_idev = in6_dev_get(dev);
+ 		net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
+ 		net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
+ #endif
+@@ -6317,6 +6350,7 @@ static int ip6_route_dev_notify(struct n
+ 		in6_dev_put_clear(&net->ipv6.ip6_null_entry->rt6i_idev);
+ #ifdef CONFIG_IPV6_MULTIPLE_TABLES
+ 		in6_dev_put_clear(&net->ipv6.ip6_prohibit_entry->rt6i_idev);
++		in6_dev_put_clear(&net->ipv6.ip6_policy_failed_entry->rt6i_idev);
+ 		in6_dev_put_clear(&net->ipv6.ip6_blk_hole_entry->rt6i_idev);
+ #endif
+ 	}
+@@ -6512,6 +6546,8 @@ static int __net_init ip6_route_net_init
+ 
+ #ifdef CONFIG_IPV6_MULTIPLE_TABLES
+ 	net->ipv6.fib6_has_custom_rules = false;
++
++
+ 	net->ipv6.ip6_prohibit_entry = kmemdup(&ip6_prohibit_entry_template,
+ 					       sizeof(*net->ipv6.ip6_prohibit_entry),
+ 					       GFP_KERNEL);
+@@ -6522,11 +6558,21 @@ static int __net_init ip6_route_net_init
+ 			 ip6_template_metrics, true);
+ 	INIT_LIST_HEAD(&net->ipv6.ip6_prohibit_entry->dst.rt_uncached);
+ 
++	net->ipv6.ip6_policy_failed_entry =
++				kmemdup(&ip6_policy_failed_entry_template,
++				sizeof(*net->ipv6.ip6_policy_failed_entry), GFP_KERNEL);
++	if (!net->ipv6.ip6_policy_failed_entry)
++		goto out_ip6_prohibit_entry;
++	net->ipv6.ip6_policy_failed_entry->dst.ops = &net->ipv6.ip6_dst_ops;
++	dst_init_metrics(&net->ipv6.ip6_policy_failed_entry->dst,
++			 ip6_template_metrics, true);
++	INIT_LIST_HEAD(&net->ipv6.ip6_policy_failed_entry->dst.rt_uncached);
++
+ 	net->ipv6.ip6_blk_hole_entry = kmemdup(&ip6_blk_hole_entry_template,
+ 					       sizeof(*net->ipv6.ip6_blk_hole_entry),
+ 					       GFP_KERNEL);
+ 	if (!net->ipv6.ip6_blk_hole_entry)
+-		goto out_ip6_prohibit_entry;
++		goto out_ip6_policy_failed_entry;
+ 	net->ipv6.ip6_blk_hole_entry->dst.ops = &net->ipv6.ip6_dst_ops;
+ 	dst_init_metrics(&net->ipv6.ip6_blk_hole_entry->dst,
+ 			 ip6_template_metrics, true);
+@@ -6553,6 +6599,8 @@ out:
+ 	return ret;
+ 
+ #ifdef CONFIG_IPV6_MULTIPLE_TABLES
++out_ip6_policy_failed_entry:
++	kfree(net->ipv6.ip6_policy_failed_entry);
+ out_ip6_prohibit_entry:
+ 	kfree(net->ipv6.ip6_prohibit_entry);
+ out_ip6_null_entry:
+@@ -6572,6 +6620,7 @@ static void __net_exit ip6_route_net_exi
+ 	kfree(net->ipv6.ip6_null_entry);
+ #ifdef CONFIG_IPV6_MULTIPLE_TABLES
+ 	kfree(net->ipv6.ip6_prohibit_entry);
++	kfree(net->ipv6.ip6_policy_failed_entry);
+ 	kfree(net->ipv6.ip6_blk_hole_entry);
+ #endif
+ 	dst_entries_destroy(&net->ipv6.ip6_dst_ops);
+@@ -6655,6 +6704,9 @@ void __init ip6_route_init_special_entri
+ 	init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
+ 	init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
+ 	init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
++	init_net.ipv6.ip6_policy_failed_entry->dst.dev = init_net.loopback_dev;
++	init_net.ipv6.ip6_policy_failed_entry->rt6i_idev =
++		in6_dev_get(init_net.loopback_dev);
+   #endif
+ }
+ 
diff --git a/6.12/target/linux/generic/pending-6.12/671-net-provide-defines-for-_POLICY_FAILED-until-all-cod.patch b/6.12/target/linux/generic/pending-6.12/671-net-provide-defines-for-_POLICY_FAILED-until-all-cod.patch
new file mode 100644
index 00000000..7057d364
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/671-net-provide-defines-for-_POLICY_FAILED-until-all-cod.patch
@@ -0,0 +1,50 @@
+From: Jonas Gorski <jogo@openwrt.org>
+Subject: net: provide defines for _POLICY_FAILED until all code is updated
+
+Upstream introduced ICMPV6_POLICY_FAIL for code 5 of destination
+unreachable, conflicting with our name.
+
+Add appropriate defines to allow our code to build with the new
+name until we have updated our local patches for older kernels
+and userspace packages.
+
+Signed-off-by: Jonas Gorski <jogo@openwrt.org>
+---
+ include/uapi/linux/fib_rules.h | 2 ++
+ include/uapi/linux/icmpv6.h    | 2 ++
+ include/uapi/linux/rtnetlink.h | 2 ++
+ 3 files changed, 6 insertions(+)
+
+--- a/include/uapi/linux/fib_rules.h
++++ b/include/uapi/linux/fib_rules.h
+@@ -90,6 +90,8 @@ enum {
+ 	__FR_ACT_MAX,
+ };
+ 
++#define FR_ACT_FAILED_POLICY FR_ACT_POLICY_FAILED
++
+ #define FR_ACT_MAX (__FR_ACT_MAX - 1)
+ 
+ #endif
+--- a/include/uapi/linux/icmpv6.h
++++ b/include/uapi/linux/icmpv6.h
+@@ -127,6 +127,8 @@ struct icmp6hdr {
+ #define ICMPV6_POLICY_FAIL		5
+ #define ICMPV6_REJECT_ROUTE		6
+ 
++#define ICMPV6_FAILED_POLICY		ICMPV6_POLICY_FAIL
++
+ /*
+  *	Codes for Time Exceeded
+  */
+--- a/include/uapi/linux/rtnetlink.h
++++ b/include/uapi/linux/rtnetlink.h
+@@ -269,6 +269,8 @@ enum {
+ 	__RTN_MAX
+ };
+ 
++#define RTN_FAILED_POLICY RTN_POLICY_FAILED
++
+ #define RTN_MAX (__RTN_MAX - 1)
+ 
+ 
diff --git a/6.12/target/linux/generic/pending-6.12/681-net-remove-NETIF_F_GSO_FRAGLIST-from-NETIF_F_GSO_SOF.patch b/6.12/target/linux/generic/pending-6.12/681-net-remove-NETIF_F_GSO_FRAGLIST-from-NETIF_F_GSO_SOF.patch
new file mode 100644
index 00000000..ad30c5af
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/681-net-remove-NETIF_F_GSO_FRAGLIST-from-NETIF_F_GSO_SOF.patch
@@ -0,0 +1,129 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 15 Aug 2024 21:15:13 +0200
+Subject: [PATCH] net: remove NETIF_F_GSO_FRAGLIST from NETIF_F_GSO_SOFTWARE
+
+Several drivers set NETIF_F_GSO_SOFTWARE, but mangle fraglist GRO packets
+in a way that they can't be properly segmented anymore.
+In order to properly deal with this, remove fraglist GSO from
+NETIF_F_GSO_SOFTWARE and switch to NETIF_F_GSO_SOFTWARE_ALL (which includes
+fraglist GSO) in places where it's safe to add.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/dummy.c
++++ b/drivers/net/dummy.c
+@@ -111,7 +111,7 @@ static void dummy_setup(struct net_devic
+ 	dev->priv_flags |= IFF_LIVE_ADDR_CHANGE | IFF_NO_QUEUE;
+ 	dev->lltx = true;
+ 	dev->features	|= NETIF_F_SG | NETIF_F_FRAGLIST;
+-	dev->features	|= NETIF_F_GSO_SOFTWARE;
++	dev->features	|= NETIF_F_GSO_SOFTWARE_ALL;
+ 	dev->features	|= NETIF_F_HW_CSUM | NETIF_F_HIGHDMA;
+ 	dev->features	|= NETIF_F_GSO_ENCAP_ALL;
+ 	dev->hw_features |= dev->features;
+--- a/drivers/net/loopback.c
++++ b/drivers/net/loopback.c
+@@ -174,7 +174,7 @@ static void gen_lo_setup(struct net_devi
+ 	dev->lltx		= true;
+ 	dev->netns_local	= true;
+ 	netif_keep_dst(dev);
+-	dev->hw_features	= NETIF_F_GSO_SOFTWARE;
++	dev->hw_features	= NETIF_F_GSO_SOFTWARE_ALL;
+ 	dev->features		= NETIF_F_SG | NETIF_F_FRAGLIST
+ 		| NETIF_F_GSO_SOFTWARE
+ 		| NETIF_F_HW_CSUM
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -897,7 +897,7 @@ static int macvlan_hwtstamp_set(struct n
+ static struct lock_class_key macvlan_netdev_addr_lock_key;
+ 
+ #define ALWAYS_ON_OFFLOADS \
+-	(NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_GSO_SOFTWARE | \
++	(NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_GSO_SOFTWARE_ALL | \
+ 	 NETIF_F_GSO_ROBUST | NETIF_F_GSO_ENCAP_ALL)
+ 
+ #define ALWAYS_ON_FEATURES ALWAYS_ON_OFFLOADS
+--- a/include/linux/netdev_features.h
++++ b/include/linux/netdev_features.h
+@@ -211,13 +211,14 @@ static inline int find_next_netdev_featu
+ 
+ /* List of features with software fallbacks. */
+ #define NETIF_F_GSO_SOFTWARE	(NETIF_F_ALL_TSO | NETIF_F_GSO_SCTP |	     \
+-				 NETIF_F_GSO_UDP_L4 | NETIF_F_GSO_FRAGLIST)
++				 NETIF_F_GSO_UDP_L4)
++#define NETIF_F_GSO_SOFTWARE_ALL (NETIF_F_GSO_SOFTWARE | NETIF_F_GSO_FRAGLIST)
+ 
+ /*
+  * If one device supports one of these features, then enable them
+  * for all in netdev_increment_features.
+  */
+-#define NETIF_F_ONE_FOR_ALL	(NETIF_F_GSO_SOFTWARE | NETIF_F_GSO_ROBUST | \
++#define NETIF_F_ONE_FOR_ALL	(NETIF_F_GSO_SOFTWARE_ALL | NETIF_F_GSO_ROBUST | \
+ 				 NETIF_F_SG | NETIF_F_HIGHDMA |		\
+ 				 NETIF_F_FRAGLIST | NETIF_F_VLAN_CHALLENGED)
+ 
+--- a/net/8021q/vlan.h
++++ b/net/8021q/vlan.h
+@@ -108,7 +108,7 @@ static inline netdev_features_t vlan_tnl
+ 	netdev_features_t ret;
+ 
+ 	ret = real_dev->hw_enc_features &
+-	      (NETIF_F_CSUM_MASK | NETIF_F_GSO_SOFTWARE |
++	      (NETIF_F_CSUM_MASK | NETIF_F_GSO_SOFTWARE_ALL |
+ 	       NETIF_F_GSO_ENCAP_ALL);
+ 
+ 	if ((ret & NETIF_F_GSO_ENCAP_ALL) && (ret & NETIF_F_CSUM_MASK))
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -561,7 +561,7 @@ static int vlan_dev_init(struct net_devi
+ 		dev->state |= (1 << __LINK_STATE_NOCARRIER);
+ 
+ 	dev->hw_features = NETIF_F_HW_CSUM | NETIF_F_SG |
+-			   NETIF_F_FRAGLIST | NETIF_F_GSO_SOFTWARE |
++			   NETIF_F_FRAGLIST | NETIF_F_GSO_SOFTWARE_ALL |
+ 			   NETIF_F_GSO_ENCAP_ALL |
+ 			   NETIF_F_HIGHDMA | NETIF_F_SCTP_CRC |
+ 			   NETIF_F_FCOE_CRC | NETIF_F_FSO;
+@@ -657,7 +657,7 @@ static netdev_features_t vlan_dev_fix_fe
+ 	if (lower_features & (NETIF_F_IP_CSUM|NETIF_F_IPV6_CSUM))
+ 		lower_features |= NETIF_F_HW_CSUM;
+ 	features = netdev_intersect_features(features, lower_features);
+-	features |= old_features & (NETIF_F_SOFT_FEATURES | NETIF_F_GSO_SOFTWARE);
++	features |= old_features & (NETIF_F_SOFT_FEATURES | NETIF_F_GSO_SOFTWARE_ALL);
+ 
+ 	return features;
+ }
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2528,7 +2528,7 @@ void sk_setup_caps(struct sock *sk, stru
+ 	if (sk_is_tcp(sk))
+ 		sk->sk_route_caps |= NETIF_F_GSO;
+ 	if (sk->sk_route_caps & NETIF_F_GSO)
+-		sk->sk_route_caps |= NETIF_F_GSO_SOFTWARE;
++		sk->sk_route_caps |= NETIF_F_GSO_SOFTWARE_ALL;
+ 	if (unlikely(sk->sk_gso_disabled))
+ 		sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
+ 	if (sk_can_gso(sk)) {
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -2010,7 +2010,7 @@ void ieee80211_color_collision_detection
+ /* interface handling */
+ #define MAC80211_SUPPORTED_FEATURES_TX	(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | \
+ 					 NETIF_F_HW_CSUM | NETIF_F_SG | \
+-					 NETIF_F_HIGHDMA | NETIF_F_GSO_SOFTWARE | \
++					 NETIF_F_HIGHDMA | NETIF_F_GSO_SOFTWARE_ALL | \
+ 					 NETIF_F_HW_TC)
+ #define MAC80211_SUPPORTED_FEATURES_RX	(NETIF_F_RXCSUM)
+ #define MAC80211_SUPPORTED_FEATURES	(MAC80211_SUPPORTED_FEATURES_TX | \
+--- a/net/openvswitch/vport-internal_dev.c
++++ b/net/openvswitch/vport-internal_dev.c
+@@ -109,7 +109,7 @@ static void do_setup(struct net_device *
+ 	netdev->rtnl_link_ops = &internal_dev_link_ops;
+ 
+ 	netdev->features = NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA |
+-			   NETIF_F_HW_CSUM | NETIF_F_GSO_SOFTWARE |
++			   NETIF_F_HW_CSUM | NETIF_F_GSO_SOFTWARE_ALL |
+ 			   NETIF_F_GSO_ENCAP_ALL;
+ 
+ 	netdev->vlan_features = netdev->features;
diff --git a/6.12/target/linux/generic/pending-6.12/683-of_net-add-mac-address-to-of-tree.patch b/6.12/target/linux/generic/pending-6.12/683-of_net-add-mac-address-to-of-tree.patch
new file mode 100644
index 00000000..0fb02dbb
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/683-of_net-add-mac-address-to-of-tree.patch
@@ -0,0 +1,75 @@
+From 8585756342caa6d27008d1ad0c18023e4211a40a Mon Sep 17 00:00:00 2001
+From: OpenWrt community <openwrt-devel@lists.openwrt.org>
+Date: Wed, 13 Jul 2022 12:22:48 +0200
+Subject: [PATCH] of/of_net: write back netdev MAC-address to device-tree
+
+The label-mac logic relies on the mac-address property of a netdev
+devices of-node. However, the mac address can also be stored as a
+different property or read from e.g. an mtd device.
+
+Create this node when reading a mac-address from OF if it does not
+already exist and copy the mac-address used for the device to this
+property. This way, the MAC address can be accessed using procfs.
+
+---
+ net/core/of_net.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+--- a/net/core/of_net.c
++++ b/net/core/of_net.c
+@@ -97,6 +97,27 @@ int of_get_mac_address_nvmem(struct devi
+ }
+ EXPORT_SYMBOL(of_get_mac_address_nvmem);
+ 
++static int of_add_mac_address(struct device_node *np, u8* addr)
++{
++	struct property *prop;
++
++	prop = kzalloc(sizeof(*prop), GFP_KERNEL);
++	if (!prop)
++		return -ENOMEM;
++
++	prop->name = "mac-address";
++	prop->length = ETH_ALEN;
++	prop->value = kmemdup(addr, ETH_ALEN, GFP_KERNEL);
++	if (!prop->value || of_update_property(np, prop))
++		goto free;
++
++	return 0;
++free:
++	kfree(prop->value);
++	kfree(prop);
++	return -ENOMEM;
++}
++
+ /**
+  * of_get_mac_address()
+  * @np:		Caller's Device Node
+@@ -132,17 +153,23 @@ int of_get_mac_address(struct device_nod
+ 
+ 	ret = of_get_mac_addr(np, "mac-address", addr);
+ 	if (!ret)
+-		return 0;
++		goto found;
+ 
+ 	ret = of_get_mac_addr(np, "local-mac-address", addr);
+ 	if (!ret)
+-		return 0;
++		goto found;
+ 
+ 	ret = of_get_mac_addr(np, "address", addr);
+ 	if (!ret)
+-		return 0;
++		goto found;
+ 
+-	return of_get_mac_address_nvmem(np, addr);
++	ret = of_get_mac_address_nvmem(np, addr);
++	if (ret)
++		return ret;
++
++found:
++	ret = of_add_mac_address(np, addr);
++	return ret;
+ }
+ EXPORT_SYMBOL(of_get_mac_address);
+ 
diff --git a/6.12/target/linux/generic/pending-6.12/700-netfilter-nft_flow_offload-handle-netdevice-events-f.patch b/6.12/target/linux/generic/pending-6.12/700-netfilter-nft_flow_offload-handle-netdevice-events-f.patch
new file mode 100644
index 00000000..f769bc0a
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/700-netfilter-nft_flow_offload-handle-netdevice-events-f.patch
@@ -0,0 +1,110 @@
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Thu, 25 Jan 2018 12:58:55 +0100
+Subject: [PATCH] netfilter: nft_flow_offload: handle netdevice events from
+ nf_flow_table
+
+Move the code that deals with device events to the core.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+
+--- a/net/netfilter/nf_flow_table_core.c
++++ b/net/netfilter/nf_flow_table_core.c
+@@ -658,6 +658,23 @@ static struct pernet_operations nf_flow_
+ 	.exit_batch = nf_flow_table_pernet_exit,
+ };
+ 
++static int nf_flow_table_netdev_event(struct notifier_block *this,
++				      unsigned long event, void *ptr)
++{
++	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
++
++	if (event != NETDEV_DOWN)
++		return NOTIFY_DONE;
++
++	nf_flow_table_cleanup(dev);
++
++	return NOTIFY_DONE;
++}
++
++static struct notifier_block flow_offload_netdev_notifier = {
++	.notifier_call	= nf_flow_table_netdev_event,
++};
++
+ static int __init nf_flow_table_module_init(void)
+ {
+ 	int ret;
+@@ -674,9 +691,14 @@ static int __init nf_flow_table_module_i
+ 	if (ret)
+ 		goto out_bpf;
+ 
++	ret = register_netdevice_notifier(&flow_offload_netdev_notifier);
++	if (ret)
++		goto out_offload_init;
++
+ 	return 0;
+ 
+ out_bpf:
++out_offload_init:
+ 	nf_flow_table_offload_exit();
+ out_offload:
+ 	unregister_pernet_subsys(&nf_flow_table_net_ops);
+@@ -685,6 +707,7 @@ out_offload:
+ 
+ static void __exit nf_flow_table_module_exit(void)
+ {
++	unregister_netdevice_notifier(&flow_offload_netdev_notifier);
+ 	nf_flow_table_offload_exit();
+ 	unregister_pernet_subsys(&nf_flow_table_net_ops);
+ }
+--- a/net/netfilter/nft_flow_offload.c
++++ b/net/netfilter/nft_flow_offload.c
+@@ -481,47 +481,14 @@ static struct nft_expr_type nft_flow_off
+ 	.owner		= THIS_MODULE,
+ };
+ 
+-static int flow_offload_netdev_event(struct notifier_block *this,
+-				     unsigned long event, void *ptr)
+-{
+-	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+-
+-	if (event != NETDEV_DOWN)
+-		return NOTIFY_DONE;
+-
+-	nf_flow_table_cleanup(dev);
+-
+-	return NOTIFY_DONE;
+-}
+-
+-static struct notifier_block flow_offload_netdev_notifier = {
+-	.notifier_call	= flow_offload_netdev_event,
+-};
+-
+ static int __init nft_flow_offload_module_init(void)
+ {
+-	int err;
+-
+-	err = register_netdevice_notifier(&flow_offload_netdev_notifier);
+-	if (err)
+-		goto err;
+-
+-	err = nft_register_expr(&nft_flow_offload_type);
+-	if (err < 0)
+-		goto register_expr;
+-
+-	return 0;
+-
+-register_expr:
+-	unregister_netdevice_notifier(&flow_offload_netdev_notifier);
+-err:
+-	return err;
++	return nft_register_expr(&nft_flow_offload_type);
+ }
+ 
+ static void __exit nft_flow_offload_module_exit(void)
+ {
+ 	nft_unregister_expr(&nft_flow_offload_type);
+-	unregister_netdevice_notifier(&flow_offload_netdev_notifier);
+ }
+ 
+ module_init(nft_flow_offload_module_init);
diff --git a/6.12/target/linux/generic/pending-6.12/701-netfilter-nf_tables-ignore-EOPNOTSUPP-on-flowtable-d.patch b/6.12/target/linux/generic/pending-6.12/701-netfilter-nf_tables-ignore-EOPNOTSUPP-on-flowtable-d.patch
new file mode 100644
index 00000000..a6d07f54
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/701-netfilter-nf_tables-ignore-EOPNOTSUPP-on-flowtable-d.patch
@@ -0,0 +1,29 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 31 Aug 2023 21:48:38 +0200
+Subject: [PATCH] netfilter: nf_tables: ignore -EOPNOTSUPP on flowtable device
+ offload setup
+
+On many embedded devices, it is common to configure flowtable offloading for
+a mix of different devices, some of which have hardware offload support and
+some of which don't.
+The current code limits the ability of user space to properly set up such a
+configuration by only allowing adding devices with hardware offload support to
+a offload-enabled flowtable.
+Given that offload-enabled flowtables also imply fallback to pure software
+offloading, this limitation makes little sense.
+Fix it by not bailing out when the offload setup returns -EOPNOTSUPP
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -8615,7 +8615,7 @@ static int nft_register_flowtable_net_ho
+ 		err = flowtable->data.type->setup(&flowtable->data,
+ 						  hook->ops.dev,
+ 						  FLOW_BLOCK_BIND);
+-		if (err < 0)
++		if (err < 0 && err != -EOPNOTSUPP)
+ 			goto err_unregister_net_hooks;
+ 
+ 		err = nf_register_net_hook(net, &hook->ops);
diff --git a/6.12/target/linux/generic/pending-6.12/702-net-ethernet-mtk_eth_soc-enable-threaded-NAPI.patch b/6.12/target/linux/generic/pending-6.12/702-net-ethernet-mtk_eth_soc-enable-threaded-NAPI.patch
new file mode 100644
index 00000000..a45d5f7c
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/702-net-ethernet-mtk_eth_soc-enable-threaded-NAPI.patch
@@ -0,0 +1,21 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 21 Mar 2022 20:39:59 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: enable threaded NAPI
+
+This can improve performance under load by ensuring that NAPI processing is
+not pinned on CPU 0.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -5041,6 +5041,8 @@ static int mtk_probe(struct platform_dev
+ 		dev_err(eth->dev, "failed to allocated dummy device\n");
+ 		goto err_unreg_netdev;
+ 	}
++	eth->dummy_dev->threaded = 1;
++	strcpy(eth->dummy_dev->name, "mtk_eth");
+ 	netif_napi_add(eth->dummy_dev, &eth->tx_napi, mtk_napi_tx);
+ 	netif_napi_add(eth->dummy_dev, &eth->rx_napi, mtk_napi_rx);
+ 
diff --git a/6.12/target/linux/generic/pending-6.12/703-phy-add-detach-callback-to-struct-phy_driver.patch b/6.12/target/linux/generic/pending-6.12/703-phy-add-detach-callback-to-struct-phy_driver.patch
new file mode 100644
index 00000000..c35f0c83
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/703-phy-add-detach-callback-to-struct-phy_driver.patch
@@ -0,0 +1,38 @@
+From: Gabor Juhos <juhosg@openwrt.org>
+Subject: generic: add detach callback to struct phy_driver
+
+lede-commit: fe61fc2d7d0b3fb348b502f68f98243b3ddf5867
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/net/phy/phy_device.c | 3 +++
+ include/linux/phy.h          | 6 ++++++
+ 2 files changed, 9 insertions(+)
+
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -1986,6 +1986,9 @@ void phy_detach(struct phy_device *phyde
+ 	if (phydev->devlink)
+ 		device_link_del(phydev->devlink);
+ 
++	if (phydev->drv && phydev->drv->detach)
++		phydev->drv->detach(phydev);
++
+ 	if (phydev->sysfs_links) {
+ 		if (dev)
+ 			sysfs_remove_link(&dev->dev.kobj, "phydev");
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -999,6 +999,12 @@ struct phy_driver {
+ 	/** @handle_interrupt: Override default interrupt handling */
+ 	irqreturn_t (*handle_interrupt)(struct phy_device *phydev);
+ 
++	/*
++	 * Called before an ethernet device is detached
++	 * from the PHY.
++	 */
++	void (*detach)(struct phy_device *phydev);
++
+ 	/** @remove: Clears up any memory if needed */
+ 	void (*remove)(struct phy_device *phydev);
+ 
diff --git a/6.12/target/linux/generic/pending-6.12/705-net-dsa-tag_mtk-add-padding-for-tx-packets.patch b/6.12/target/linux/generic/pending-6.12/705-net-dsa-tag_mtk-add-padding-for-tx-packets.patch
new file mode 100644
index 00000000..f7e4e777
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/705-net-dsa-tag_mtk-add-padding-for-tx-packets.patch
@@ -0,0 +1,28 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 6 May 2022 21:38:42 +0200
+Subject: [PATCH] net: dsa: tag_mtk: add padding for tx packets
+
+Padding for transmitted packets needs to account for the special tag.
+With not enough padding, garbage bytes are inserted by the switch at the
+end of small packets.
+
+Fixes: 5cd8985a1909 ("net-next: dsa: add Mediatek tag RX/TX handler")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/dsa/tag_mtk.c
++++ b/net/dsa/tag_mtk.c
+@@ -29,6 +29,13 @@ static struct sk_buff *mtk_tag_xmit(stru
+ 
+ 	skb_set_queue_mapping(skb, dp->index);
+ 
++	/* The Ethernet switch we are interfaced with needs packets to be at
++	 * least 64 bytes (including FCS) otherwise their padding might be
++	 * corrupted. With tags enabled, we need to make sure that packets are
++	 * at least 68 bytes (including FCS and tag).
++	 */
++	eth_skb_pad(skb);
++
+ 	/* Build the special tag after the MAC Source Address. If VLAN header
+ 	 * is present, it's required that VLAN header and special tag is
+ 	 * being combined. Only in this way we can allow the switch can parse
diff --git a/6.12/target/linux/generic/pending-6.12/706-net-phy-populate-host_interfaces-when-attaching-PHY.patch b/6.12/target/linux/generic/pending-6.12/706-net-phy-populate-host_interfaces-when-attaching-PHY.patch
new file mode 100644
index 00000000..6b2b0168
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/706-net-phy-populate-host_interfaces-when-attaching-PHY.patch
@@ -0,0 +1,57 @@
+From 4e432e530db0056450fbc4a3cee793f16adc39a7 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Tue, 8 Oct 2024 23:58:41 +0100
+Subject: [PATCH] net: phy: populate host_interfaces when attaching PHY
+
+Use bitmask of interfaces supported by the MAC for the PHY to choose
+from if the declared interface mode is among those using a single pair
+of SerDes lanes.
+This will allow 2500Base-T PHYs to switch to SGMII on most hosts, which
+results in half-duplex being supported in case the MAC supports them.
+Without this change, 2500Base-T PHYs will always operate in 2500Base-X
+mode with rate-matching, which is not only wasteful in terms of energy
+consumption, but also limits the supported interface modes to
+full-duplex only.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/phylink.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -2086,7 +2086,7 @@ int phylink_fwnode_phy_connect(struct ph
+ {
+ 	struct fwnode_handle *phy_fwnode;
+ 	struct phy_device *phy_dev;
+-	int ret;
++	int i, ret;
+ 
+ 	/* Fixed links and 802.3z are handled without needing a PHY */
+ 	if (pl->cfg_link_an_mode == MLO_AN_FIXED ||
+@@ -2116,6 +2116,25 @@ int phylink_fwnode_phy_connect(struct ph
+ 	if (pl->config->mac_requires_rxc)
+ 		flags |= PHY_F_RXC_ALWAYS_ON;
+ 
++	/* Assume single-lane SerDes interface modes share the same
++	 * lanes and allow the PHY to switch to slower also supported modes
++	 */
++	for (i = ARRAY_SIZE(phylink_sfp_interface_preference) - 1; i >= 0; i--) {
++		/* skip unsupported modes */
++		if (!test_bit(phylink_sfp_interface_preference[i], pl->config->supported_interfaces))
++			continue;
++
++		__set_bit(phylink_sfp_interface_preference[i], phy_dev->host_interfaces);
++
++		/* skip all faster modes */
++		if (phylink_sfp_interface_preference[i] == pl->link_interface)
++			break;
++	}
++
++	if (test_bit(pl->link_interface, phylink_sfp_interfaces))
++		phy_interface_and(phy_dev->host_interfaces, phylink_sfp_interfaces,
++				  pl->config->supported_interfaces);
++
+ 	ret = phy_attach_direct(pl->netdev, phy_dev, flags,
+ 				pl->link_interface);
+ 	phy_device_free(phy_dev);
diff --git a/6.12/target/linux/generic/pending-6.12/710-bridge-add-knob-for-filtering-rx-tx-BPDU-pack.patch b/6.12/target/linux/generic/pending-6.12/710-bridge-add-knob-for-filtering-rx-tx-BPDU-pack.patch
new file mode 100644
index 00000000..a7fb6c34
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/710-bridge-add-knob-for-filtering-rx-tx-BPDU-pack.patch
@@ -0,0 +1,174 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 27 Aug 2021 12:22:32 +0200
+Subject: [PATCH] bridge: add knob for filtering rx/tx BPDU packets on a port
+
+Some devices (e.g. wireless APs) can't have devices behind them be part of
+a bridge topology with redundant links, due to address limitations.
+Additionally, broadcast traffic on these devices is somewhat expensive, due to
+the low data rate and wakeups of clients in powersave mode.
+This knob can be used to ensure that BPDU packets are never sent or forwarded
+to/from these devices
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/linux/if_bridge.h
++++ b/include/linux/if_bridge.h
+@@ -61,6 +61,7 @@ struct br_ip_list {
+ #define BR_PORT_LOCKED		BIT(21)
+ #define BR_PORT_MAB		BIT(22)
+ #define BR_NEIGH_VLAN_SUPPRESS	BIT(23)
++#define BR_BPDU_FILTER		BIT(24)
+ 
+ #define BR_DEFAULT_AGEING_TIME	(300 * HZ)
+ 
+--- a/net/bridge/br_forward.c
++++ b/net/bridge/br_forward.c
+@@ -201,6 +201,7 @@ void br_flood(struct net_bridge *br, str
+ 	      enum br_pkt_type pkt_type, bool local_rcv, bool local_orig,
+ 	      u16 vid)
+ {
++	const unsigned char *dest = eth_hdr(skb)->h_dest;
+ 	struct net_bridge_port *prev = NULL;
+ 	struct net_bridge_port *p;
+ 
+@@ -218,6 +219,10 @@ void br_flood(struct net_bridge *br, str
+ 		case BR_PKT_MULTICAST:
+ 			if (!(p->flags & BR_MCAST_FLOOD) && skb->dev != br->dev)
+ 				continue;
++			if ((p->flags & BR_BPDU_FILTER) &&
++			    unlikely(is_link_local_ether_addr(dest) &&
++				     dest[5] == 0))
++				continue;
+ 			break;
+ 		case BR_PKT_BROADCAST:
+ 			if (!(p->flags & BR_BCAST_FLOOD) && skb->dev != br->dev)
+--- a/net/bridge/br_input.c
++++ b/net/bridge/br_input.c
+@@ -367,6 +367,8 @@ static rx_handler_result_t br_handle_fra
+ 		fwd_mask |= p->group_fwd_mask;
+ 		switch (dest[5]) {
+ 		case 0x00:	/* Bridge Group Address */
++			if (p->flags & BR_BPDU_FILTER)
++				goto drop;
+ 			/* If STP is turned off,
+ 			   then must forward to keep loop detection */
+ 			if (p->br->stp_enabled == BR_NO_STP ||
+--- a/net/bridge/br_sysfs_if.c
++++ b/net/bridge/br_sysfs_if.c
+@@ -240,6 +240,7 @@ BRPORT_ATTR_FLAG(multicast_flood, BR_MCA
+ BRPORT_ATTR_FLAG(broadcast_flood, BR_BCAST_FLOOD);
+ BRPORT_ATTR_FLAG(neigh_suppress, BR_NEIGH_SUPPRESS);
+ BRPORT_ATTR_FLAG(isolated, BR_ISOLATED);
++BRPORT_ATTR_FLAG(bpdu_filter, BR_BPDU_FILTER);
+ 
+ #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
+ static ssize_t show_multicast_router(struct net_bridge_port *p, char *buf)
+@@ -292,6 +293,7 @@ static const struct brport_attribute *br
+ 	&brport_attr_group_fwd_mask,
+ 	&brport_attr_neigh_suppress,
+ 	&brport_attr_isolated,
++	&brport_attr_bpdu_filter,
+ 	&brport_attr_backup_port,
+ 	NULL
+ };
+--- a/net/bridge/br_stp_bpdu.c
++++ b/net/bridge/br_stp_bpdu.c
+@@ -80,7 +80,8 @@ void br_send_config_bpdu(struct net_brid
+ {
+ 	unsigned char buf[35];
+ 
+-	if (p->br->stp_enabled != BR_KERNEL_STP)
++	if (p->br->stp_enabled != BR_KERNEL_STP ||
++	    (p->flags & BR_BPDU_FILTER))
+ 		return;
+ 
+ 	buf[0] = 0;
+@@ -127,7 +128,8 @@ void br_send_tcn_bpdu(struct net_bridge_
+ {
+ 	unsigned char buf[4];
+ 
+-	if (p->br->stp_enabled != BR_KERNEL_STP)
++	if (p->br->stp_enabled != BR_KERNEL_STP ||
++	    (p->flags & BR_BPDU_FILTER))
+ 		return;
+ 
+ 	buf[0] = 0;
+@@ -172,6 +174,9 @@ void br_stp_rcv(const struct stp_proto *
+ 	if (!(br->dev->flags & IFF_UP))
+ 		goto out;
+ 
++	if (p->flags & BR_BPDU_FILTER)
++		goto out;
++
+ 	if (p->state == BR_STATE_DISABLED)
+ 		goto out;
+ 
+--- a/include/uapi/linux/if_link.h
++++ b/include/uapi/linux/if_link.h
+@@ -1094,6 +1094,7 @@ enum {
+ 	IFLA_BRPORT_MCAST_MAX_GROUPS,
+ 	IFLA_BRPORT_NEIGH_VLAN_SUPPRESS,
+ 	IFLA_BRPORT_BACKUP_NHID,
++	IFLA_BRPORT_BPDU_FILTER,
+ 	__IFLA_BRPORT_MAX
+ };
+ #define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1)
+--- a/net/bridge/br_netlink.c
++++ b/net/bridge/br_netlink.c
+@@ -190,6 +190,7 @@ static inline size_t br_port_info_size(v
+ 		+ nla_total_size(1)	/* IFLA_BRPORT_LOCKED */
+ 		+ nla_total_size(1)	/* IFLA_BRPORT_MAB */
+ 		+ nla_total_size(1)	/* IFLA_BRPORT_NEIGH_VLAN_SUPPRESS */
++		+ nla_total_size(1)	/* IFLA_BRPORT_BPDU_FILTER */
+ 		+ nla_total_size(sizeof(struct ifla_bridge_id))	/* IFLA_BRPORT_ROOT_ID */
+ 		+ nla_total_size(sizeof(struct ifla_bridge_id))	/* IFLA_BRPORT_BRIDGE_ID */
+ 		+ nla_total_size(sizeof(u16))	/* IFLA_BRPORT_DESIGNATED_PORT */
+@@ -282,7 +283,8 @@ static int br_port_fill_attrs(struct sk_
+ 	    nla_put_u8(skb, IFLA_BRPORT_LOCKED, !!(p->flags & BR_PORT_LOCKED)) ||
+ 	    nla_put_u8(skb, IFLA_BRPORT_MAB, !!(p->flags & BR_PORT_MAB)) ||
+ 	    nla_put_u8(skb, IFLA_BRPORT_NEIGH_VLAN_SUPPRESS,
+-		       !!(p->flags & BR_NEIGH_VLAN_SUPPRESS)))
++		       !!(p->flags & BR_NEIGH_VLAN_SUPPRESS)) ||
++	    nla_put_u8(skb, IFLA_BRPORT_BPDU_FILTER, !!(p->flags & BR_BPDU_FILTER)))
+ 		return -EMSGSIZE;
+ 
+ 	timerval = br_timer_value(&p->message_age_timer);
+@@ -902,6 +904,7 @@ static const struct nla_policy br_port_p
+ 	[IFLA_BRPORT_MCAST_MAX_GROUPS] = { .type = NLA_U32 },
+ 	[IFLA_BRPORT_NEIGH_VLAN_SUPPRESS] = NLA_POLICY_MAX(NLA_U8, 1),
+ 	[IFLA_BRPORT_BACKUP_NHID] = { .type = NLA_U32 },
++	[IFLA_BRPORT_BPDU_FILTER] = { .type = NLA_U8 },
+ };
+ 
+ /* Change the state of the port and notify spanning tree */
+@@ -970,6 +973,7 @@ static int br_setport(struct net_bridge_
+ 	br_set_port_flag(p, tb, IFLA_BRPORT_MAB, BR_PORT_MAB);
+ 	br_set_port_flag(p, tb, IFLA_BRPORT_NEIGH_VLAN_SUPPRESS,
+ 			 BR_NEIGH_VLAN_SUPPRESS);
++	br_set_port_flag(p, tb, IFLA_BRPORT_BPDU_FILTER, BR_BPDU_FILTER);
+ 
+ 	if ((p->flags & BR_PORT_MAB) &&
+ 	    (!(p->flags & BR_PORT_LOCKED) || !(p->flags & BR_LEARNING))) {
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -62,7 +62,7 @@
+ #include "dev.h"
+ 
+ #define RTNL_MAX_TYPE		50
+-#define RTNL_SLAVE_MAX_TYPE	44
++#define RTNL_SLAVE_MAX_TYPE	45
+ 
+ struct rtnl_link {
+ 	rtnl_doit_func		doit;
+@@ -5009,7 +5009,9 @@ int ndo_dflt_bridge_getlink(struct sk_bu
+ 	    brport_nla_put_flag(skb, flags, mask,
+ 				IFLA_BRPORT_MCAST_FLOOD, BR_MCAST_FLOOD) ||
+ 	    brport_nla_put_flag(skb, flags, mask,
+-				IFLA_BRPORT_BCAST_FLOOD, BR_BCAST_FLOOD)) {
++				IFLA_BRPORT_BCAST_FLOOD, BR_BCAST_FLOOD) ||
++	    brport_nla_put_flag(skb, flags, mask,
++				IFLA_BRPORT_BPDU_FILTER, BR_BPDU_FILTER)) {
+ 		nla_nest_cancel(skb, protinfo);
+ 		goto nla_put_failure;
+ 	}
diff --git a/6.12/target/linux/generic/pending-6.12/711-01-net-dsa-qca8k-implement-lag_fdb_add-del-ops.patch b/6.12/target/linux/generic/pending-6.12/711-01-net-dsa-qca8k-implement-lag_fdb_add-del-ops.patch
new file mode 100644
index 00000000..0e891590
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/711-01-net-dsa-qca8k-implement-lag_fdb_add-del-ops.patch
@@ -0,0 +1,86 @@
+From 3b4329230db8750bea7a56ef07f07cbbf5fc6c5a Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Tue, 4 Jul 2023 22:50:12 +0200
+Subject: [PATCH 19/20] net: dsa: qca8k: implement lag_fdb_add/del ops
+
+Implement lag_fdb_add/del ops to correctly support using LAG interface.
+Qca8k switch supports declaring fdb entry for link aggregation by simply
+setting the DES_PORT bits to all the LAG member.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c   |  2 ++
+ drivers/net/dsa/qca/qca8k-common.c | 48 ++++++++++++++++++++++++++++++
+ drivers/net/dsa/qca/qca8k.h        |  6 ++++
+ 3 files changed, 56 insertions(+)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -2031,6 +2031,8 @@ static const struct dsa_switch_ops qca8k
+ 	.port_fdb_add		= qca8k_port_fdb_add,
+ 	.port_fdb_del		= qca8k_port_fdb_del,
+ 	.port_fdb_dump		= qca8k_port_fdb_dump,
++	.lag_fdb_add		= qca8k_lag_fdb_add,
++	.lag_fdb_del		= qca8k_lag_fdb_del,
+ 	.port_mdb_add		= qca8k_port_mdb_add,
+ 	.port_mdb_del		= qca8k_port_mdb_del,
+ 	.port_mirror_add	= qca8k_port_mirror_add,
+--- a/drivers/net/dsa/qca/qca8k-common.c
++++ b/drivers/net/dsa/qca/qca8k-common.c
+@@ -1234,6 +1234,42 @@ int qca8k_port_lag_leave(struct dsa_swit
+ 	return qca8k_lag_refresh_portmap(ds, port, lag, true);
+ }
+ 
++int qca8k_lag_fdb_add(struct dsa_switch *ds, struct dsa_lag lag,
++		      const unsigned char *addr, u16 vid,
++		      struct dsa_db db)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++	struct dsa_port *dp;
++	u16 port_mask = 0;
++
++	/* Set the vid to the port vlan id if no vid is set */
++	if (!vid)
++		vid = QCA8K_PORT_VID_DEF;
++
++	dsa_lag_foreach_port(dp, ds->dst, &lag)
++		port_mask |= BIT(dp->index);
++
++	return qca8k_port_fdb_insert(priv, addr, port_mask, vid);
++}
++
++int qca8k_lag_fdb_del(struct dsa_switch *ds, struct dsa_lag lag,
++		      const unsigned char *addr, u16 vid,
++		      struct dsa_db db)
++{
++	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
++	struct dsa_port *dp;
++	u16 port_mask = 0;
++
++	/* Set the vid to the port vlan id if no vid is set */
++	if (!vid)
++		vid = QCA8K_PORT_VID_DEF;
++
++	dsa_lag_foreach_port(dp, ds->dst, &lag)
++	port_mask |= BIT(dp->index);
++
++	return qca8k_fdb_del(priv, addr, port_mask, vid);
++}
++
+ int qca8k_read_switch_id(struct qca8k_priv *priv)
+ {
+ 	u32 val;
+--- a/drivers/net/dsa/qca/qca8k.h
++++ b/drivers/net/dsa/qca/qca8k.h
+@@ -592,5 +592,11 @@ int qca8k_port_lag_join(struct dsa_switc
+ 			struct netlink_ext_ack *extack);
+ int qca8k_port_lag_leave(struct dsa_switch *ds, int port,
+ 			 struct dsa_lag lag);
++int qca8k_lag_fdb_add(struct dsa_switch *ds, struct dsa_lag lag,
++		      const unsigned char *addr, u16 vid,
++		      struct dsa_db db);
++int qca8k_lag_fdb_del(struct dsa_switch *ds, struct dsa_lag lag,
++		      const unsigned char *addr, u16 vid,
++		      struct dsa_db db);
+ 
+ #endif /* __QCA8K_H */
diff --git a/6.12/target/linux/generic/pending-6.12/711-02-net-dsa-qca8k-enable-flooding-to-both-CPU-port.patch b/6.12/target/linux/generic/pending-6.12/711-02-net-dsa-qca8k-enable-flooding-to-both-CPU-port.patch
new file mode 100644
index 00000000..d10bbcf8
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/711-02-net-dsa-qca8k-enable-flooding-to-both-CPU-port.patch
@@ -0,0 +1,37 @@
+From b954d61d9ecfa64450fc178586719dc2a95b92a7 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Tue, 20 Jun 2023 21:48:24 +0200
+Subject: [PATCH 3/4] net: dsa: qca8k: enable flooding to both CPU port
+
+To permit a multi-CPU setup, flood all unknown frames to all CPU ports.
+Each CPU port should have correct LOOKUP MEMBER configuration to
+prevent receiving duplicate packets from user ports.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -1913,15 +1913,12 @@ qca8k_setup(struct dsa_switch *ds)
+ 		}
+ 	}
+ 
+-	/* Forward all unknown frames to CPU port for Linux processing
+-	 * Notice that in multi-cpu config only one port should be set
+-	 * for igmp, unknown, multicast and broadcast packet
+-	 */
++	/* Forward all unknown frames to CPU port for Linux processing */
+ 	ret = qca8k_write(priv, QCA8K_REG_GLOBAL_FW_CTRL1,
+-			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_IGMP_DP_MASK, BIT(cpu_port)) |
+-			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_BC_DP_MASK, BIT(cpu_port)) |
+-			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_MC_DP_MASK, BIT(cpu_port)) |
+-			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_UC_DP_MASK, BIT(cpu_port)));
++			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_IGMP_DP_MASK, dsa_cpu_ports(ds)) |
++			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_BC_DP_MASK, dsa_cpu_ports(ds)) |
++			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_MC_DP_MASK, dsa_cpu_ports(ds)) |
++			  FIELD_PREP(QCA8K_GLOBAL_FW_CTRL1_UC_DP_MASK, dsa_cpu_ports(ds)));
+ 	if (ret)
+ 		return ret;
+ 
diff --git a/6.12/target/linux/generic/pending-6.12/711-03-net-dsa-qca8k-add-support-for-port_change_master.patch b/6.12/target/linux/generic/pending-6.12/711-03-net-dsa-qca8k-add-support-for-port_change_master.patch
new file mode 100644
index 00000000..25c6ae3f
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/711-03-net-dsa-qca8k-add-support-for-port_change_master.patch
@@ -0,0 +1,158 @@
+From b2d6ebf2f92f8695c83fa6979f4ab579c588df76 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Tue, 20 Jun 2023 07:57:38 +0200
+Subject: [PATCH 4/4] net: dsa: qca8k: add support for port_change_master
+
+Add support for port_change_master to permit assigning an alternative
+CPU port if the switch have both CPU port connected or create a LAG on
+both CPU port and assign the LAG as DSA master.
+
+On port change master request, we check if the master is a LAG.
+With LAG we compose the cpu_port_mask with the CPU port in the LAG, if
+master is a simple dsa_port, we derive the index.
+
+Finally we apply the new cpu_port_mask to the LOOKUP MEMBER to permit
+the port to receive packet by the new CPU port setup for the port and we
+refresh the CPU ports LOOKUP MEMBER configuration to reflect the new
+user port state.
+
+port_lag_join/leave is updated to refresh the user ports if we detect
+that the LAG is a DSA master and we have user port using it as a master.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c | 116 ++++++++++++++++++++++++++++++-
+ 1 file changed, 114 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -1750,6 +1750,117 @@ qca8k_get_tag_protocol(struct dsa_switch
+ 	return DSA_TAG_PROTO_QCA;
+ }
+ 
++static int qca8k_port_change_master(struct dsa_switch *ds, int port,
++				    struct net_device *master,
++				    struct netlink_ext_ack *extack)
++{
++	struct dsa_switch_tree *dst = ds->dst;
++	struct qca8k_priv *priv = ds->priv;
++	u8 cpu_port_mask = 0;
++	struct dsa_port *dp;
++	u32 val;
++	int ret;
++
++	/* With LAG of CPU port, compose the mask for port LOOKUP MEMBER */
++	if (netif_is_lag_master(master)) {
++		struct dsa_lag *lag;
++		int id;
++
++		id = dsa_lag_id(dst, master);
++		lag = dsa_lag_by_id(dst, id);
++
++		dsa_lag_foreach_port(dp, dst, lag)
++			if (dsa_port_is_cpu(dp))
++				cpu_port_mask |= BIT(dp->index);
++	} else {
++		dp = master->dsa_ptr;
++		cpu_port_mask |= BIT(dp->index);
++	}
++
++	/* Connect port to new cpu port */
++	ret = regmap_read(priv->regmap, QCA8K_PORT_LOOKUP_CTRL(port), &val);
++	if (ret)
++		return ret;
++
++	/* Reset connected CPU port in port LOOKUP MEMBER */
++	val &=  ~dsa_cpu_ports(ds);
++	/* Assign the new CPU port in port LOOKUP MEMBER */
++	val |= cpu_port_mask;
++
++	ret = regmap_update_bits(priv->regmap, QCA8K_PORT_LOOKUP_CTRL(port),
++				 QCA8K_PORT_LOOKUP_MEMBER,
++				 val);
++	if (ret)
++		return ret;
++
++	/* Refresh CPU port LOOKUP MEMBER with new port */
++	dsa_tree_for_each_cpu_port(dp, ds->dst) {
++		u32 reg = QCA8K_PORT_LOOKUP_CTRL(dp->index);
++
++		/* If CPU port in mask assign port, else remove port */
++		if (BIT(dp->index) & cpu_port_mask)
++			ret = regmap_set_bits(priv->regmap, reg, BIT(port));
++		else
++			ret = regmap_clear_bits(priv->regmap, reg, BIT(port));
++
++		if (ret)
++			return ret;
++	}
++
++	return 0;
++}
++
++static int qca8k_port_lag_refresh_user_ports(struct dsa_switch *ds,
++					     struct dsa_lag lag)
++{
++	struct net_device *lag_dev = lag.dev;
++	struct dsa_port *dp;
++	int ret;
++
++	/* Ignore if LAG is not a DSA master */
++	if (!netif_is_lag_master(lag_dev))
++		return 0;
++
++	dsa_switch_for_each_user_port(dp, ds) {
++		/* Skip if assigned master is not the LAG */
++		if (dsa_port_to_conduit(dp) != lag_dev)
++			continue;
++
++		ret = qca8k_port_change_master(ds, dp->index,
++					       lag_dev, NULL);
++		if (ret)
++			return ret;
++	}
++
++	return 0;
++}
++
++static int qca8xxx_port_lag_join(struct dsa_switch *ds, int port,
++				 struct dsa_lag lag,
++				 struct netdev_lag_upper_info *info,
++				 struct netlink_ext_ack *extack)
++{
++	int ret;
++
++	ret = qca8k_port_lag_join(ds, port, lag, info, extack);
++	if (ret)
++		return ret;
++
++	return qca8k_port_lag_refresh_user_ports(ds, lag);
++}
++
++static int qca8xxx_port_lag_leave(struct dsa_switch *ds, int port,
++				  struct dsa_lag lag)
++{
++	int ret;
++
++	ret = qca8k_port_lag_leave(ds, port, lag);
++	if (ret)
++		return ret;
++
++	return qca8k_port_lag_refresh_user_ports(ds, lag);
++}
++
+ static void
+ qca8k_conduit_change(struct dsa_switch *ds, const struct net_device *conduit,
+ 		     bool operational)
+@@ -2039,8 +2150,9 @@ static const struct dsa_switch_ops qca8k
+ 	.port_vlan_del		= qca8k_port_vlan_del,
+ 	.phylink_get_caps	= qca8k_phylink_get_caps,
+ 	.get_phy_flags		= qca8k_get_phy_flags,
+-	.port_lag_join		= qca8k_port_lag_join,
+-	.port_lag_leave		= qca8k_port_lag_leave,
++	.port_lag_join		= qca8xxx_port_lag_join,
++	.port_lag_leave		= qca8xxx_port_lag_leave,
++	.port_change_conduit	= qca8k_port_change_master,
+ 	.conduit_state_change	= qca8k_conduit_change,
+ 	.connect_tag_protocol	= qca8k_connect_tag_protocol,
+ };
diff --git a/6.12/target/linux/generic/pending-6.12/712-net-dsa-qca8k-enable-assisted-learning-on-CPU-port.patch b/6.12/target/linux/generic/pending-6.12/712-net-dsa-qca8k-enable-assisted-learning-on-CPU-port.patch
new file mode 100644
index 00000000..03cf2db6
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/712-net-dsa-qca8k-enable-assisted-learning-on-CPU-port.patch
@@ -0,0 +1,57 @@
+From 0f6599167c126ce32c85d4f8a1f3d1775a268572 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Fri, 6 Oct 2023 12:44:00 +0200
+Subject: [PATCH] net: dsa: qca8k: enable assisted learning on CPU port
+
+Enable assisted learning on CPU port.
+
+It has been verified that there is a problem in packet roaming
+from one BSS to another in the same security settings from one
+physical R7800 to another physical R7800 where they are in the
+same L2 broadcast domain backhauled/linked together via one
+of the ethernet ports.
+DHCP will fail to complete and traffic cannot flow for around 300
+seconds.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -2022,6 +2022,12 @@ qca8k_setup(struct dsa_switch *ds)
+ 			dev_err(priv->dev, "failed enabling QCA header mode on port %d", dp->index);
+ 			return ret;
+ 		}
++
++		/* Disable learning by default on all ports */
++		ret = regmap_clear_bits(priv->regmap, QCA8K_PORT_LOOKUP_CTRL(dp->index),
++								QCA8K_PORT_LOOKUP_LEARN);
++		if (ret)
++			return ret;
+ 	}
+ 
+ 	/* Forward all unknown frames to CPU port for Linux processing */
+@@ -2051,11 +2057,6 @@ qca8k_setup(struct dsa_switch *ds)
+ 		if (ret)
+ 			return ret;
+ 
+-		ret = regmap_clear_bits(priv->regmap, QCA8K_PORT_LOOKUP_CTRL(port),
+-					QCA8K_PORT_LOOKUP_LEARN);
+-		if (ret)
+-			return ret;
+-
+ 		/* For port based vlans to work we need to set the
+ 		 * default egress vid
+ 		 */
+@@ -2107,6 +2108,9 @@ qca8k_setup(struct dsa_switch *ds)
+ 	/* Set max number of LAGs supported */
+ 	ds->num_lag_ids = QCA8K_NUM_LAGS;
+ 
++	/* HW learn on CPU port is limited and require manual setting */
++	ds->assisted_learning_on_cpu_port = true;
++
+ 	return 0;
+ }
+ 
diff --git a/6.12/target/linux/generic/pending-6.12/720-01-net-phy-realtek-use-genphy_soft_reset-for-2.5G-PHYs.patch b/6.12/target/linux/generic/pending-6.12/720-01-net-phy-realtek-use-genphy_soft_reset-for-2.5G-PHYs.patch
new file mode 100644
index 00000000..24885e36
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/720-01-net-phy-realtek-use-genphy_soft_reset-for-2.5G-PHYs.patch
@@ -0,0 +1,81 @@
+From 85cd45580f5e3b26068cccb7d6173f200e754dc0 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sun, 2 Apr 2023 23:56:16 +0100
+Subject: [PATCH 1/2] net: phy: realtek: use genphy_soft_reset for 2.5G PHYs
+
+Some vendor bootloaders do weird things with those PHYs which result in
+link modes being reported wrongly. Start from a clean sheet by resetting
+the PHY.
+
+Reported-by: Yevhen Kolomeiko <jarvis2709@gmail.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/realtek/realtek_main.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -1430,6 +1430,7 @@ static struct phy_driver realtek_drvs[]
+ 	}, {
+ 		.name		= "RTL8226 2.5Gbps PHY",
+ 		.match_phy_device = rtl8226_match_phy_device,
++		.soft_reset     = genphy_soft_reset,
+ 		.get_features	= rtl822x_get_features,
+ 		.config_aneg	= rtl822x_config_aneg,
+ 		.read_status	= rtl822x_read_status,
+@@ -1440,6 +1441,7 @@ static struct phy_driver realtek_drvs[]
+ 	}, {
+ 		.match_phy_device = rtl8221b_match_phy_device,
+ 		.name		= "RTL8226B_RTL8221B 2.5Gbps PHY",
++		.soft_reset     = genphy_soft_reset,
+ 		.get_features	= rtl822x_get_features,
+ 		.config_aneg	= rtl822x_config_aneg,
+ 		.config_init    = rtl822xb_config_init,
+@@ -1452,6 +1454,7 @@ static struct phy_driver realtek_drvs[]
+ 	}, {
+ 		PHY_ID_MATCH_EXACT(0x001cc838),
+ 		.name           = "RTL8226-CG 2.5Gbps PHY",
++		.soft_reset     = genphy_soft_reset,
+ 		.get_features   = rtl822x_get_features,
+ 		.config_aneg    = rtl822x_config_aneg,
+ 		.read_status    = rtl822x_read_status,
+@@ -1462,6 +1465,7 @@ static struct phy_driver realtek_drvs[]
+ 	}, {
+ 		PHY_ID_MATCH_EXACT(0x001cc848),
+ 		.name           = "RTL8226B-CG_RTL8221B-CG 2.5Gbps PHY",
++		.soft_reset     = genphy_soft_reset,
+ 		.get_features   = rtl822x_get_features,
+ 		.config_aneg    = rtl822x_config_aneg,
+ 		.config_init    = rtl822xb_config_init,
+@@ -1474,6 +1478,7 @@ static struct phy_driver realtek_drvs[]
+ 	}, {
+ 		.match_phy_device = rtl8221b_vb_cg_c22_match_phy_device,
+ 		.name           = "RTL8221B-VB-CG 2.5Gbps PHY (C22)",
++		.soft_reset     = genphy_soft_reset,
+ 		.probe		= rtl822x_probe,
+ 		.get_features   = rtl822x_get_features,
+ 		.config_aneg    = rtl822x_config_aneg,
+@@ -1487,6 +1492,7 @@ static struct phy_driver realtek_drvs[]
+ 	}, {
+ 		.match_phy_device = rtl8221b_vb_cg_c45_match_phy_device,
+ 		.name           = "RTL8221B-VB-CG 2.5Gbps PHY (C45)",
++		.soft_reset     = genphy_soft_reset,
+ 		.probe		= rtl822x_probe,
+ 		.config_init    = rtl822xb_config_init,
+ 		.get_rate_matching = rtl822xb_get_rate_matching,
+@@ -1498,6 +1504,7 @@ static struct phy_driver realtek_drvs[]
+ 	}, {
+ 		.match_phy_device = rtl8221b_vn_cg_c22_match_phy_device,
+ 		.name           = "RTL8221B-VM-CG 2.5Gbps PHY (C22)",
++		.soft_reset     = genphy_soft_reset,
+ 		.probe		= rtl822x_probe,
+ 		.get_features   = rtl822x_get_features,
+ 		.config_aneg    = rtl822x_config_aneg,
+@@ -1511,6 +1518,7 @@ static struct phy_driver realtek_drvs[]
+ 	}, {
+ 		.match_phy_device = rtl8221b_vn_cg_c45_match_phy_device,
+ 		.name           = "RTL8221B-VN-CG 2.5Gbps PHY (C45)",
++		.soft_reset     = genphy_soft_reset,
+ 		.probe		= rtl822x_probe,
+ 		.config_init    = rtl822xb_config_init,
+ 		.get_rate_matching = rtl822xb_get_rate_matching,
diff --git a/6.12/target/linux/generic/pending-6.12/720-02-net-phy-realtek-disable-SGMII-in-band-AN-for-2-5G-PHYs.patch b/6.12/target/linux/generic/pending-6.12/720-02-net-phy-realtek-disable-SGMII-in-band-AN-for-2-5G-PHYs.patch
new file mode 100644
index 00000000..edc03b55
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/720-02-net-phy-realtek-disable-SGMII-in-band-AN-for-2-5G-PHYs.patch
@@ -0,0 +1,63 @@
+From d54ef6aea00e7a6ace439baade6ad0aa38ee4b04 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 3 Apr 2023 01:21:57 +0300
+Subject: [PATCH 287/326] net: phy: realtek: disable SGMII in-band AN for 2.5G
+ PHYs
+
+MAC drivers don't use SGMII in-band autonegotiation unless told to do so
+in device tree using 'managed = "in-band-status"'. When using MDIO to
+access a PHY, in-band-status is unneeded as we have link-status via
+MDIO. Switch off SGMII in-band autonegotiation using magic values.
+
+Reported-by: Chen Minqiang <ptpt52@gmail.com>
+Reported-by: Chukun Pan <amadeus@jmu.edu.cn>
+Reported-by: Yevhen Kolomeiko <jarvis2709@gmail.com>
+Tested-by: Yevhen Kolomeiko <jarvis2709@gmail.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/realtek/realtek_main.c | 27 +++++++++++++++++++++++++--
+ 1 file changed, 25 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -834,8 +834,8 @@ static int rtl822x_probe(struct phy_devi
+ static int rtl822xb_config_init(struct phy_device *phydev)
+ {
+ 	bool has_2500, has_sgmii;
++	int ret, val;
+ 	u16 mode;
+-	int ret;
+ 
+ 	has_2500 = test_bit(PHY_INTERFACE_MODE_2500BASEX,
+ 			    phydev->host_interfaces) ||
+@@ -885,7 +885,29 @@ static int rtl822xb_config_init(struct p
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	return phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x6f11, 0x8020);
++	ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x6f11, 0x8020);
++	if (ret < 0)
++		return ret;
++
++	/* Disable SGMII AN */
++	ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x7588, 0x2);
++	if (ret < 0)
++		return ret;
++
++	ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x7589, 0x71d0);
++	if (ret < 0)
++		return ret;
++
++	ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x7587, 0x3);
++	if (ret < 0)
++		return ret;
++
++	ret = phy_read_mmd_poll_timeout(phydev, MDIO_MMD_VEND1, 0x7587,
++					val, !(val & BIT(0)), 500, 100000, false);
++	if (ret < 0)
++		return ret;
++
++	return 0;
+ }
+ 
+ static int rtl822xb_get_rate_matching(struct phy_device *phydev,
diff --git a/6.12/target/linux/generic/pending-6.12/720-03-net-phy-realtek-make-sure-paged-read-is-protected-by.patch b/6.12/target/linux/generic/pending-6.12/720-03-net-phy-realtek-make-sure-paged-read-is-protected-by.patch
new file mode 100644
index 00000000..d5f80d1c
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/720-03-net-phy-realtek-make-sure-paged-read-is-protected-by.patch
@@ -0,0 +1,35 @@
+From 4dd2cc9b91ecb25f278a2c55e07e6455e9000e6b Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sat, 22 Apr 2023 01:21:14 +0100
+Subject: [PATCH] net: phy: realtek: make sure paged read is protected by mutex
+
+As we cannot rely on phy_read_paged function before the PHY is
+identified, the paged read in rtlgen_supports_2_5gbps needs to be open
+coded as it is being called by the match_phy_device function, ie. before
+.read_page and .write_page have been populated.
+
+Make sure it is also protected by the MDIO bus mutex and use
+rtl821x_write_page instead of 3 individually locked MDIO bus operations.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/realtek/realtek_main.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -1111,9 +1111,11 @@ static bool rtlgen_supports_2_5gbps(stru
+ {
+ 	int val;
+ 
+-	phy_write(phydev, RTL821x_PAGE_SELECT, 0xa61);
+-	val = phy_read(phydev, 0x13);
+-	phy_write(phydev, RTL821x_PAGE_SELECT, 0);
++	mutex_lock(&phydev->mdio.bus->mdio_lock);
++	rtl821x_write_page(phydev, 0xa61);
++	val = __phy_read(phydev, 0x13);
++	rtl821x_write_page(phydev, 0);
++	mutex_unlock(&phydev->mdio.bus->mdio_lock);
+ 
+ 	return val >= 0 && val & MDIO_PMA_SPEED_2_5G;
+ }
diff --git a/6.12/target/linux/generic/pending-6.12/720-04-net-phy-realtek-setup-aldps.patch b/6.12/target/linux/generic/pending-6.12/720-04-net-phy-realtek-setup-aldps.patch
new file mode 100644
index 00000000..23b3ca89
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/720-04-net-phy-realtek-setup-aldps.patch
@@ -0,0 +1,42 @@
+From 9155098547fb1172d4fa536f3f6bc9d42f59d08c Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sat, 22 Apr 2023 03:26:01 +0100
+Subject: [PATCH] net: phy: realtek: setup ALDPS on RTL822x
+
+Setup Link Down Power Saving Mode according the DTS property
+just like for RTL821x 1GE PHYs.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/realtek/realtek_main.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -82,6 +82,10 @@
+ 
+ #define RTL822X_VND2_GANLPAR				0xa414
+ 
++#define RTL8221B_PHYCR1				0xa430
++#define RTL8221B_PHYCR1_ALDPS_EN		BIT(2)
++#define RTL8221B_PHYCR1_ALDPS_XTAL_OFF_EN	BIT(12)
++
+ #define RTL8366RB_POWER_SAVE			0x15
+ #define RTL8366RB_POWER_SAVE_ON			BIT(12)
+ 
+@@ -889,6 +893,15 @@ static int rtl822xb_config_init(struct p
+ 	if (ret < 0)
+ 		return ret;
+ 
++	if (of_property_read_bool(phydev->mdio.dev.of_node, "realtek,aldps-enable"))
++		ret = phy_set_bits_mmd(phydev, MDIO_MMD_VEND1, RTL8221B_PHYCR1,
++				 RTL8221B_PHYCR1_ALDPS_EN | RTL8221B_PHYCR1_ALDPS_XTAL_OFF_EN);
++	else
++		ret = phy_clear_bits_mmd(phydev, MDIO_MMD_VEND1, RTL8221B_PHYCR1,
++				   RTL8221B_PHYCR1_ALDPS_EN | RTL8221B_PHYCR1_ALDPS_XTAL_OFF_EN);
++	if (ret < 0)
++		return ret;
++
+ 	/* Disable SGMII AN */
+ 	ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x7588, 0x2);
+ 	if (ret < 0)
diff --git a/6.12/target/linux/generic/pending-6.12/720-05-net-phy-realtek-detect-early-version-of-RTL8221B.patch b/6.12/target/linux/generic/pending-6.12/720-05-net-phy-realtek-detect-early-version-of-RTL8221B.patch
new file mode 100644
index 00000000..d7fbf3a2
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/720-05-net-phy-realtek-detect-early-version-of-RTL8221B.patch
@@ -0,0 +1,52 @@
+From 0de82310d2b32e78ff79d42c08b1122a6ede3778 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sun, 30 Apr 2023 00:15:41 +0100
+Subject: [PATCH] net: phy: realtek: detect early version of RTL8221B
+
+Early versions (?) of the RTL8221B PHY cannot be identified in a regular
+Clause-45 bus scan as the PHY doesn't report the implemented MMDs
+correctly but returns 0 instead.
+Implement custom identify function using the PKGID instead of iterating
+over the implemented MMDs.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+[forward-port by @namiltd]
+Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -1166,10 +1166,32 @@ static int rtl8226_match_phy_device(stru
+ static int rtlgen_is_c45_match(struct phy_device *phydev, unsigned int id,
+ 			       bool is_c45)
+ {
+-	if (phydev->is_c45)
+-		return is_c45 && (id == phydev->c45_ids.device_ids[1]);
+-	else
++	if (phydev->is_c45) {
++		u32 rid;
++
++		if (!is_c45)
++			return 0;
++
++		rid = phydev->c45_ids.device_ids[1];
++		if ((rid == 0xffffffff) && phydev->mdio.bus->read_c45) {
++			int val;
++
++			val = phy_read_mmd(phydev, MDIO_MMD_PMAPMD, MDIO_PKGID1);
++			if (val < 0)
++				return 0;
++
++			rid = val << 16;
++			val = phy_read_mmd(phydev, MDIO_MMD_PMAPMD, MDIO_PKGID2);
++			if (val < 0)
++				return 0;
++
++			rid |= val;
++		}
++
++		return (id == rid);
++	} else {
+ 		return !is_c45 && (id == phydev->phy_id);
++	}
+ }
+ 
+ static int rtl8221b_match_phy_device(struct phy_device *phydev)
diff --git a/6.12/target/linux/generic/pending-6.12/720-06-net-phy-realtek-support-interrupt-of-RTL8221B.patch b/6.12/target/linux/generic/pending-6.12/720-06-net-phy-realtek-support-interrupt-of-RTL8221B.patch
new file mode 100644
index 00000000..45ca5413
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/720-06-net-phy-realtek-support-interrupt-of-RTL8221B.patch
@@ -0,0 +1,102 @@
+From d7943c31d57c11e1a517aa3ce2006fca44866870 Mon Sep 17 00:00:00 2001
+From: Jianhui Zhao <zhaojh329@gmail.com>
+Date: Sun, 24 Sep 2023 22:15:00 +0800
+Subject: [PATCH] net: phy: realtek: add interrupt support for RTL8221B
+
+This commit introduces interrupt support for RTL8221B.
+
+Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
+---
+ drivers/net/phy/realtek/realtek_main.c | 47 +++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 47 insertions(+)
+
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -1377,6 +1377,51 @@ static irqreturn_t rtl9000a_handle_inter
+ 	return IRQ_HANDLED;
+ }
+ 
++static int rtl8221b_ack_interrupt(struct phy_device *phydev)
++{
++	int err;
++
++	err = phy_read_mmd(phydev, MDIO_MMD_VEND2, 0xa4d4);
++
++	return (err < 0) ? err : 0;
++}
++
++static int rtl8221b_config_intr(struct phy_device *phydev)
++{
++	int err;
++
++	if (phydev->interrupts == PHY_INTERRUPT_ENABLED) {
++		err = rtl8221b_ack_interrupt(phydev);
++		if (err)
++			return err;
++
++		err = phy_write_mmd(phydev, MDIO_MMD_VEND2, 0xa4d2, 0x7ff);
++	} else {
++		err = phy_write_mmd(phydev, MDIO_MMD_VEND2, 0xa4d2, 0x0);
++		if (err)
++			return err;
++
++		err = rtl8221b_ack_interrupt(phydev);
++	}
++
++	return err;
++}
++
++static irqreturn_t rtl8221b_handle_interrupt(struct phy_device *phydev)
++{
++	int err;
++
++	err = rtl8221b_ack_interrupt(phydev);
++	if (err) {
++		phy_error(phydev);
++		return IRQ_NONE;
++	}
++
++	phy_trigger_machine(phydev);
++
++	return IRQ_HANDLED;
++}
++
+ static struct phy_driver realtek_drvs[] = {
+ 	{
+ 		PHY_ID_MATCH_EXACT(0x00008201),
+@@ -1537,6 +1582,8 @@ static struct phy_driver realtek_drvs[]
+ 	}, {
+ 		.match_phy_device = rtl8221b_vb_cg_c22_match_phy_device,
+ 		.name           = "RTL8221B-VB-CG 2.5Gbps PHY (C22)",
++		.config_intr	= rtl8221b_config_intr,
++		.handle_interrupt = rtl8221b_handle_interrupt,
+ 		.soft_reset     = genphy_soft_reset,
+ 		.probe		= rtl822x_probe,
+ 		.get_features   = rtl822x_get_features,
+@@ -1551,6 +1598,8 @@ static struct phy_driver realtek_drvs[]
+ 	}, {
+ 		.match_phy_device = rtl8221b_vb_cg_c45_match_phy_device,
+ 		.name           = "RTL8221B-VB-CG 2.5Gbps PHY (C45)",
++		.config_intr	= rtl8221b_config_intr,
++		.handle_interrupt = rtl8221b_handle_interrupt,
+ 		.soft_reset     = genphy_soft_reset,
+ 		.probe		= rtl822x_probe,
+ 		.config_init    = rtl822xb_config_init,
+@@ -1563,6 +1612,8 @@ static struct phy_driver realtek_drvs[]
+ 	}, {
+ 		.match_phy_device = rtl8221b_vn_cg_c22_match_phy_device,
+ 		.name           = "RTL8221B-VM-CG 2.5Gbps PHY (C22)",
++		.config_intr	= rtl8221b_config_intr,
++		.handle_interrupt = rtl8221b_handle_interrupt,
+ 		.soft_reset     = genphy_soft_reset,
+ 		.probe		= rtl822x_probe,
+ 		.get_features   = rtl822x_get_features,
+@@ -1577,6 +1628,8 @@ static struct phy_driver realtek_drvs[]
+ 	}, {
+ 		.match_phy_device = rtl8221b_vn_cg_c45_match_phy_device,
+ 		.name           = "RTL8221B-VN-CG 2.5Gbps PHY (C45)",
++		.config_intr	= rtl8221b_config_intr,
++		.handle_interrupt = rtl8221b_handle_interrupt,
+ 		.soft_reset     = genphy_soft_reset,
+ 		.probe		= rtl822x_probe,
+ 		.config_init    = rtl822xb_config_init,
diff --git a/6.12/target/linux/generic/pending-6.12/720-07-net-phy-realtek-mark-existing-MMDs-as-present.patch b/6.12/target/linux/generic/pending-6.12/720-07-net-phy-realtek-mark-existing-MMDs-as-present.patch
new file mode 100644
index 00000000..555e5905
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/720-07-net-phy-realtek-mark-existing-MMDs-as-present.patch
@@ -0,0 +1,27 @@
+From 1addfb042a9d27788a0fb2c2935045b56fd8560e Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Thu, 23 Jan 2025 03:25:29 +0000
+Subject: [PATCH] net: phy: realtek: mark existing MMDs as present
+
+When using Clause-45 mode to access RealTek RTL8221B 2.5G PHYs some
+versions of the PHY fail to report the MMDs present on the PHY.
+Mark MMDs PMAPMD, PCS and AN which are always existing according to
+the datasheet as present to fix that.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/realtek/realtek_main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -1043,6 +1043,9 @@ static int rtl822x_c45_get_features(stru
+ 	linkmode_set_bit(ETHTOOL_LINK_MODE_TP_BIT,
+ 			 phydev->supported);
+ 
++	phydev->c45_ids.mmds_present |= MDIO_DEVS_PMAPMD | MDIO_DEVS_PCS |
++				        MDIO_DEVS_AN;
++
+ 	return genphy_c45_pma_read_abilities(phydev);
+ }
+ 
diff --git a/6.12/target/linux/generic/pending-6.12/720-08-net-phy-realtek-work-around-broken-serdes.patch b/6.12/target/linux/generic/pending-6.12/720-08-net-phy-realtek-work-around-broken-serdes.patch
new file mode 100644
index 00000000..e356a0a6
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/720-08-net-phy-realtek-work-around-broken-serdes.patch
@@ -0,0 +1,58 @@
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Thu, 30 Jan 2025 05:33:12 +0000
+Subject: [PATCH] net: phy: realtek: work around broken SerDes
+
+For still unknown reasons the SerDes init sequence may sometimes
+time out because a self-clearing bit never clears, indicating the
+PHY has entered an unrecoverable error state.
+
+Work-around the issue by triggering a hardware reset and retry the
+setup sequence while warning the user that this has happened.
+This is really more of a work-around than a fix, and should be
+replaced by a better actual fix in future (hopefully).
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -923,6 +923,22 @@ static int rtl822xb_config_init(struct p
+ 	return 0;
+ }
+ 
++static int rtl822xb_config_init_war(struct phy_device *phydev)
++{
++	int ret;
++
++	ret = rtl822xb_config_init(phydev);
++
++	if (ret == -ETIMEDOUT) {
++		phydev_warn(phydev, "SerDes setup timed out, retrying\n");
++		phy_device_reset(phydev, 1);
++		phy_device_reset(phydev, 0);
++		ret = rtl822xb_config_init(phydev);
++	}
++
++	return ret;
++}
++
+ static int rtl822xb_get_rate_matching(struct phy_device *phydev,
+ 				      phy_interface_t iface)
+ {
+@@ -1605,7 +1621,7 @@ static struct phy_driver realtek_drvs[]
+ 		.handle_interrupt = rtl8221b_handle_interrupt,
+ 		.soft_reset     = genphy_soft_reset,
+ 		.probe		= rtl822x_probe,
+-		.config_init    = rtl822xb_config_init,
++		.config_init    = rtl822xb_config_init_war,
+ 		.get_rate_matching = rtl822xb_get_rate_matching,
+ 		.get_features   = rtl822x_c45_get_features,
+ 		.config_aneg    = rtl822x_c45_config_aneg,
+@@ -1635,7 +1651,7 @@ static struct phy_driver realtek_drvs[]
+ 		.handle_interrupt = rtl8221b_handle_interrupt,
+ 		.soft_reset     = genphy_soft_reset,
+ 		.probe		= rtl822x_probe,
+-		.config_init    = rtl822xb_config_init,
++		.config_init    = rtl822xb_config_init_war,
+ 		.get_rate_matching = rtl822xb_get_rate_matching,
+ 		.get_features   = rtl822x_c45_get_features,
+ 		.config_aneg    = rtl822x_c45_config_aneg,
diff --git a/6.12/target/linux/generic/pending-6.12/720-09-net-phy-realtek-disable-MDIO-broadcast.patch b/6.12/target/linux/generic/pending-6.12/720-09-net-phy-realtek-disable-MDIO-broadcast.patch
new file mode 100644
index 00000000..b2d26a87
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/720-09-net-phy-realtek-disable-MDIO-broadcast.patch
@@ -0,0 +1,27 @@
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Thu, 30 Jan 2025 05:38:31 +0000
+Subject: [PATCH] net: phy: realtek: disable MDIO broadcast
+
+RealTek's PHYs by default also listen on MDIO address 0 which is defined
+as broadcast address. This can lead to problems if there is an actual PHY
+(such as MT7981 built-in PHY) present at this address, as accessing that
+PHY may then confuse the RealTek PHY.
+
+Disabled listening on the MDIO broadcast address to avoid such problems.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -849,6 +849,11 @@ static int rtl822xb_config_init(struct p
+ 			     phydev->host_interfaces) ||
+ 		    phydev->interface == PHY_INTERFACE_MODE_SGMII;
+ 
++	/* disable listening on MDIO broadcast address (0) */
++	ret = phy_clear_bits_mmd(phydev, MDIO_MMD_VEND2, 0xa430, BIT(13));
++	if (ret < 0)
++		return ret;
++
+ 	/* fill in possible interfaces */
+ 	__assign_bit(PHY_INTERFACE_MODE_2500BASEX, phydev->possible_interfaces,
+ 		     has_2500);
diff --git a/6.12/target/linux/generic/pending-6.12/730-net-ethernet-mtk_eth_soc-reset-all-TX-queues-on-DMA-.patch b/6.12/target/linux/generic/pending-6.12/730-net-ethernet-mtk_eth_soc-reset-all-TX-queues-on-DMA-.patch
new file mode 100644
index 00000000..67d0ab45
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/730-net-ethernet-mtk_eth_soc-reset-all-TX-queues-on-DMA-.patch
@@ -0,0 +1,49 @@
+From 7d41a5a8e9c91cc6bb011dd953570738583dd091 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Wed, 18 Sep 2024 02:01:01 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: reset all TX queues on DMA free
+
+The purpose of resetting the TX queue is to reset the
+byte and packet count as well as to clear the software
+flow control XOFF bit.
+
+MediaTek developers pointed out that netdev_reset_queue would only
+resets queue 0 of the network device.
+Queues that are not reset may cause unexpected issues.
+
+Packets may stop being sent after reset and "transmit timeout" log may
+be displayed.
+
+Import fix from MediaTek's SDK to resolve this issue.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -3135,11 +3135,19 @@ static int mtk_dma_init(struct mtk_eth *
+ static void mtk_dma_free(struct mtk_eth *eth)
+ {
+ 	const struct mtk_soc_data *soc = eth->soc;
+-	int i;
++	int i, j, txqs = 1;
++
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_QDMA))
++		txqs = MTK_QDMA_NUM_QUEUES;
++
++	for (i = 0; i < MTK_MAX_DEVS; i++) {
++		if (!eth->netdev[i])
++			continue;
++
++		for (j = 0; j < txqs; j++)
++			netdev_tx_reset_queue(netdev_get_tx_queue(eth->netdev[i], j));
++	}
+ 
+-	for (i = 0; i < MTK_MAX_DEVS; i++)
+-		if (eth->netdev[i])
+-			netdev_reset_queue(eth->netdev[i]);
+ 	if (!MTK_HAS_CAPS(soc->caps, MTK_SRAM) && eth->scratch_ring) {
+ 		dma_free_coherent(eth->dma_dev,
+ 				  MTK_QDMA_RING_SIZE * soc->tx.desc_size,
diff --git a/6.12/target/linux/generic/pending-6.12/731-net-permit-ieee80211_ptr-even-with-no-CFG82111-suppo.patch b/6.12/target/linux/generic/pending-6.12/731-net-permit-ieee80211_ptr-even-with-no-CFG82111-suppo.patch
new file mode 100644
index 00000000..bf9131b2
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/731-net-permit-ieee80211_ptr-even-with-no-CFG82111-suppo.patch
@@ -0,0 +1,59 @@
+From 686c603f67ae87bf21a61b5e4b1564443f41c3ee Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 20 Oct 2022 03:34:43 +0200
+Subject: [PATCH] net: permit ieee80211_ptr even with no CFG82111 support
+
+Introduce a new flag CONFIG_CFG80211_HEADERS to compile in ieee80211_ptr
+even if CFG80211 support is not compiled in. This is needed for the
+backports project and for any downstream wireless driver that loads in
+the kernel dynamically.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ include/linux/netdevice.h       | 2 +-
+ net/batman-adv/hard-interface.c | 2 +-
+ net/wireless/Kconfig            | 4 ++++
+ 3 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -2224,7 +2224,7 @@ struct net_device {
+ #if IS_ENABLED(CONFIG_AX25)
+ 	void			*ax25_ptr;
+ #endif
+-#if IS_ENABLED(CONFIG_CFG80211)
++#if IS_ENABLED(CONFIG_CFG80211_HEADERS)
+ 	struct wireless_dev	*ieee80211_ptr;
+ #endif
+ #if IS_ENABLED(CONFIG_IEEE802154) || IS_ENABLED(CONFIG_6LOWPAN)
+--- a/net/batman-adv/hard-interface.c
++++ b/net/batman-adv/hard-interface.c
+@@ -309,7 +309,7 @@ static bool batadv_is_cfg80211_netdev(st
+ 	if (!net_device)
+ 		return false;
+ 
+-#if IS_ENABLED(CONFIG_CFG80211)
++#if IS_ENABLED(CONFIG_CFG80211_HEADERS)
+ 	/* cfg80211 drivers have to set ieee80211_ptr */
+ 	if (net_device->ieee80211_ptr)
+ 		return true;
+--- a/net/wireless/Kconfig
++++ b/net/wireless/Kconfig
+@@ -26,6 +26,7 @@ config CFG80211
+ 	# using a different algorithm, though right now they shouldn't
+ 	# (this is here rather than below to allow it to be a module)
+ 	select CRYPTO_SHA256 if CFG80211_USE_KERNEL_REGDB_KEYS
++	select CFG80211_HEADERS
+ 	help
+ 	  cfg80211 is the Linux wireless LAN (802.11) configuration API.
+ 	  Enable this if you have a wireless device.
+@@ -36,6 +37,9 @@ config CFG80211
+ 
+ 	  When built as a module it will be called cfg80211.
+ 
++config CFG80211_HEADERS
++	bool "cfg80211 - headers support"
++
+ if CFG80211
+ 
+ config NL80211_TESTMODE
diff --git a/6.12/target/linux/generic/pending-6.12/732-00-net-ethernet-mtk_eth_soc-compile-out-netsys-v2-code-.patch b/6.12/target/linux/generic/pending-6.12/732-00-net-ethernet-mtk_eth_soc-compile-out-netsys-v2-code-.patch
new file mode 100644
index 00000000..8d028852
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/732-00-net-ethernet-mtk_eth_soc-compile-out-netsys-v2-code-.patch
@@ -0,0 +1,44 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 27 Oct 2022 23:39:52 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: compile out netsys v2 code
+ on mt7621
+
+Avoid some branches in the hot path on low-end devices with limited CPU power,
+and reduce code size
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -1322,6 +1322,22 @@ struct mtk_mac {
+ /* the struct describing the SoC. these are declared in the soc_xyz.c files */
+ extern const struct of_device_id of_mtk_match[];
+ 
++#ifdef CONFIG_SOC_MT7621
++static inline bool mtk_is_netsys_v1(struct mtk_eth *eth)
++{
++	return true;
++}
++
++static inline bool mtk_is_netsys_v2_or_greater(struct mtk_eth *eth)
++{
++	return false;
++}
++
++static inline bool mtk_is_netsys_v3_or_greater(struct mtk_eth *eth)
++{
++	return false;
++}
++#else
+ static inline bool mtk_is_netsys_v1(struct mtk_eth *eth)
+ {
+ 	return eth->soc->version == 1;
+@@ -1336,6 +1352,7 @@ static inline bool mtk_is_netsys_v3_or_g
+ {
+ 	return eth->soc->version > 2;
+ }
++#endif
+ 
+ static inline struct mtk_foe_entry *
+ mtk_foe_get_entry(struct mtk_ppe *ppe, u16 hash)
diff --git a/6.12/target/linux/generic/pending-6.12/732-01-net-ethernet-mtk_eth_soc-work-around-issue-with-send.patch b/6.12/target/linux/generic/pending-6.12/732-01-net-ethernet-mtk_eth_soc-work-around-issue-with-send.patch
new file mode 100644
index 00000000..53187934
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/732-01-net-ethernet-mtk_eth_soc-work-around-issue-with-send.patch
@@ -0,0 +1,102 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 3 Nov 2022 12:38:49 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: work around issue with sending
+ small fragments
+
+When lots of frames are sent with a number of very small fragments, an
+internal FIFO can overflow, causing the DMA engine to lock up lock up and
+transmit attempts time out.
+
+Fix this on MT7986 by increasing the reserved FIFO space.
+Fix this on older chips by detecting the presence of small fragments and use
+skb_gso_segment + skb_linearize to deal with them.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -26,6 +26,7 @@
+ #include <linux/bitfield.h>
+ #include <net/dsa.h>
+ #include <net/dst_metadata.h>
++#include <net/gso.h>
+ #include <net/page_pool/helpers.h>
+ 
+ #include "mtk_eth_soc.h"
+@@ -1596,12 +1597,28 @@ static void mtk_wake_queue(struct mtk_et
+ 	}
+ }
+ 
++static bool mtk_skb_has_small_frag(struct sk_buff *skb)
++{
++	int min_size = 16;
++	int i;
++
++	if (skb_headlen(skb) < min_size)
++		return true;
++
++	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
++		if (skb_frag_size(&skb_shinfo(skb)->frags[i]) < min_size)
++			return true;
++
++	return false;
++}
++
+ static netdev_tx_t mtk_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ 	struct mtk_mac *mac = netdev_priv(dev);
+ 	struct mtk_eth *eth = mac->hw;
+ 	struct mtk_tx_ring *ring = &eth->tx_ring;
+ 	struct net_device_stats *stats = &dev->stats;
++	struct sk_buff *segs, *next;
+ 	bool gso = false;
+ 	int tx_num;
+ 
+@@ -1623,6 +1640,18 @@ static netdev_tx_t mtk_start_xmit(struct
+ 		return NETDEV_TX_BUSY;
+ 	}
+ 
++	if (mtk_is_netsys_v1(eth) &&
++	    skb_is_gso(skb) && mtk_skb_has_small_frag(skb)) {
++		segs = skb_gso_segment(skb, dev->features & ~NETIF_F_ALL_TSO);
++		if (IS_ERR(segs))
++			goto drop;
++
++		if (segs) {
++			consume_skb(skb);
++			skb = segs;
++		}
++	}
++
+ 	/* TSO: fill MSS info in tcp checksum field */
+ 	if (skb_is_gso(skb)) {
+ 		if (skb_cow_head(skb, 0)) {
+@@ -1638,8 +1667,14 @@ static netdev_tx_t mtk_start_xmit(struct
+ 		}
+ 	}
+ 
+-	if (mtk_tx_map(skb, dev, tx_num, ring, gso) < 0)
+-		goto drop;
++	skb_list_walk_safe(skb, skb, next) {
++		if ((mtk_is_netsys_v1(eth) &&
++		     mtk_skb_has_small_frag(skb) && skb_linearize(skb)) ||
++		    mtk_tx_map(skb, dev, tx_num, ring, gso) < 0) {
++				stats->tx_dropped++;
++				dev_kfree_skb_any(skb);
++		}
++	}
+ 
+ 	if (unlikely(atomic_read(&ring->free_count) <= ring->thresh))
+ 		netif_tx_stop_all_queues(dev);
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -270,7 +270,7 @@
+ #define MTK_CHK_DDONE_EN	BIT(28)
+ #define MTK_DMAD_WR_WDONE	BIT(26)
+ #define MTK_WCOMP_EN		BIT(24)
+-#define MTK_RESV_BUF		(0x40 << 16)
++#define MTK_RESV_BUF		(0x80 << 16)
+ #define MTK_MUTLI_CNT		(0x4 << 12)
+ #define MTK_LEAKY_BUCKET_EN	BIT(11)
+ 
diff --git a/6.12/target/linux/generic/pending-6.12/732-02-net-ethernet-mtk_eth_soc-set-NETIF_F_ALL_TSO.patch b/6.12/target/linux/generic/pending-6.12/732-02-net-ethernet-mtk_eth_soc-set-NETIF_F_ALL_TSO.patch
new file mode 100644
index 00000000..bd7a1b96
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/732-02-net-ethernet-mtk_eth_soc-set-NETIF_F_ALL_TSO.patch
@@ -0,0 +1,21 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 28 Oct 2022 12:54:48 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: set NETIF_F_ALL_TSO
+
+Significantly improves performance by avoiding unnecessary segmentation
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -49,8 +49,7 @@
+ #define MTK_HW_FEATURES		(NETIF_F_IP_CSUM | \
+ 				 NETIF_F_RXCSUM | \
+ 				 NETIF_F_HW_VLAN_CTAG_TX | \
+-				 NETIF_F_SG | NETIF_F_TSO | \
+-				 NETIF_F_TSO6 | \
++				 NETIF_F_SG | NETIF_F_ALL_TSO | \
+ 				 NETIF_F_IPV6_CSUM |\
+ 				 NETIF_F_HW_TC)
+ #define MTK_HW_FEATURES_MT7628	(NETIF_F_SG | NETIF_F_RXCSUM)
diff --git a/6.12/target/linux/generic/pending-6.12/733-01-net-ethernet-mtk_eth_soc-use-napi_build_skb.patch b/6.12/target/linux/generic/pending-6.12/733-01-net-ethernet-mtk_eth_soc-use-napi_build_skb.patch
new file mode 100644
index 00000000..82ba768f
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/733-01-net-ethernet-mtk_eth_soc-use-napi_build_skb.patch
@@ -0,0 +1,30 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 20 May 2024 14:29:58 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: use napi_build_skb()
+
+The napi_build_skb() can reuse the skb in skb cache per CPU or
+can allocate skbs in bulk, which helps improve the performance.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -2140,7 +2140,7 @@ static int mtk_poll_rx(struct napi_struc
+ 			if (ret != XDP_PASS)
+ 				goto skip_rx;
+ 
+-			skb = build_skb(data, PAGE_SIZE);
++			skb = napi_build_skb(data, PAGE_SIZE);
+ 			if (unlikely(!skb)) {
+ 				page_pool_put_full_page(ring->page_pool,
+ 							page, true);
+@@ -2178,7 +2178,7 @@ static int mtk_poll_rx(struct napi_struc
+ 			dma_unmap_single(eth->dma_dev, ((u64)trxd.rxd1 | addr64),
+ 					 ring->buf_size, DMA_FROM_DEVICE);
+ 
+-			skb = build_skb(data, ring->frag_size);
++			skb = napi_build_skb(data, ring->frag_size);
+ 			if (unlikely(!skb)) {
+ 				netdev->stats.rx_dropped++;
+ 				skb_free_frag(data);
diff --git a/6.12/target/linux/generic/pending-6.12/734-net-ethernet-mediatek-enlarge-DMA-reserve-buffer.patch b/6.12/target/linux/generic/pending-6.12/734-net-ethernet-mediatek-enlarge-DMA-reserve-buffer.patch
new file mode 100644
index 00000000..d786b462
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/734-net-ethernet-mediatek-enlarge-DMA-reserve-buffer.patch
@@ -0,0 +1,44 @@
+From: Chad Monroe <chad@monroe.io>
+Date: Mon, 16 Sep 2024 19:29:03 -0700
+Subject: [PATCH] net: ethernet: mediatek: increase QDMA RESV_BUF size
+
+Increase QDMA RESV_BUF from 2K to 3K for netsys v2 to match Mediatek SDK[1].
+This helps reduce the possibility of Ethernet transmit timeouts.
+
+[1]: https://git01.mediatek.com/plugins/gitiles/openwrt/feeds/mtk-openwrt-feeds/+/19d8456c3051e5f6dabf42fa770916a2126ea4bf
+
+Signed-off-by: Chad Monroe <chad@monroe.io>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c |    6 ++++--
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h |    1 +
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -271,6 +271,7 @@
+ #define MTK_WCOMP_EN		BIT(24)
+ #define MTK_RESV_BUF		(0x80 << 16)
+ #define MTK_MUTLI_CNT		(0x4 << 12)
++#define MTK_RESV_BUF_MASK	(0xff << 16)
+ #define MTK_LEAKY_BUCKET_EN	BIT(11)
+ 
+ /* QDMA Flow Control Register */
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -3309,12 +3309,14 @@ static int mtk_start_dma(struct mtk_eth
+ 		       MTK_TX_BT_32DWORDS | MTK_NDP_CO_PRO |
+ 		       MTK_RX_2B_OFFSET | MTK_TX_WB_DDONE;
+ 
+-		if (mtk_is_netsys_v2_or_greater(eth))
++		if (mtk_is_netsys_v2_or_greater(eth)) {
++			val &= ~MTK_RESV_BUF_MASK;
+ 			val |= MTK_MUTLI_CNT | MTK_RESV_BUF |
+ 			       MTK_WCOMP_EN | MTK_DMAD_WR_WDONE |
+ 			       MTK_CHK_DDONE_EN | MTK_LEAKY_BUCKET_EN;
+-		else
++		} else {
+ 			val |= MTK_RX_BT_32DWORDS;
++		}
+ 		mtk_w32(eth, val, reg_map->qdma.glo_cfg);
+ 
+ 		mtk_w32(eth,
diff --git a/6.12/target/linux/generic/pending-6.12/737-net-ethernet-mtk_eth_soc-add-paths-and-SerDes-modes-.patch b/6.12/target/linux/generic/pending-6.12/737-net-ethernet-mtk_eth_soc-add-paths-and-SerDes-modes-.patch
new file mode 100644
index 00000000..e580962d
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/737-net-ethernet-mtk_eth_soc-add-paths-and-SerDes-modes-.patch
@@ -0,0 +1,903 @@
+From d5e337e7aecc2e1cc9e96768062610adb95f8f72 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Tue, 12 Dec 2023 03:51:14 +0000
+Subject: [PATCH] net: ethernet: mtk_eth_soc: add paths and SerDes modes for
+ MT7988
+
+MT7988 comes with a built-in 2.5G PHY as well as SerDes lanes to
+connect external PHYs or transceivers in USXGMII, 10GBase-R, 5GBase-R,
+2500Base-X, 1000Base-X and Cisco SGMII interface modes.
+
+Implement support for configuring for the new paths to SerDes interfaces
+and the internal 2.5G PHY.
+
+Add USXGMII PCS driver for 10GBase-R, 5GBase-R and USXGMII mode, and
+setup the new PHYA on MT7988 to access the also still existing old
+LynxI PCS for 1000Base-X, 2500Base-X and Cisco SGMII PCS interface
+modes.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_path.c | 122 +++++++-
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c  | 292 +++++++++++++++++--
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h  | 107 ++++++-
+ 3 files changed, 470 insertions(+), 51 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_path.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_path.c
+@@ -31,10 +31,20 @@ static const char *mtk_eth_path_name(u64
+ 		return "gmac2_rgmii";
+ 	case MTK_ETH_PATH_GMAC2_SGMII:
+ 		return "gmac2_sgmii";
++	case MTK_ETH_PATH_GMAC2_2P5GPHY:
++		return "gmac2_2p5gphy";
+ 	case MTK_ETH_PATH_GMAC2_GEPHY:
+ 		return "gmac2_gephy";
++	case MTK_ETH_PATH_GMAC3_SGMII:
++		return "gmac3_sgmii";
+ 	case MTK_ETH_PATH_GDM1_ESW:
+ 		return "gdm1_esw";
++	case MTK_ETH_PATH_GMAC1_USXGMII:
++		return "gmac1_usxgmii";
++	case MTK_ETH_PATH_GMAC2_USXGMII:
++		return "gmac2_usxgmii";
++	case MTK_ETH_PATH_GMAC3_USXGMII:
++		return "gmac3_usxgmii";
+ 	default:
+ 		return "unknown path";
+ 	}
+@@ -127,6 +137,27 @@ static int set_mux_u3_gmac2_to_qphy(stru
+ 	return 0;
+ }
+ 
++static int set_mux_gmac2_to_2p5gphy(struct mtk_eth *eth, u64 path)
++{
++	int ret;
++
++	if (path == MTK_ETH_PATH_GMAC2_2P5GPHY) {
++		ret = regmap_clear_bits(eth->ethsys, ETHSYS_SYSCFG0, SYSCFG0_SGMII_GMAC2_V2);
++		if (ret)
++			return ret;
++
++		/* Setup mux to 2p5g PHY */
++		ret = regmap_clear_bits(eth->infra, TOP_MISC_NETSYS_PCS_MUX, MUX_G2_USXGMII_SEL);
++		if (ret)
++			return ret;
++
++		dev_dbg(eth->dev, "path %s in %s updated\n",
++			mtk_eth_path_name(path), __func__);
++	}
++
++	return 0;
++}
++
+ static int set_mux_gmac1_gmac2_to_sgmii_rgmii(struct mtk_eth *eth, u64 path)
+ {
+ 	unsigned int val = 0;
+@@ -165,7 +196,48 @@ static int set_mux_gmac1_gmac2_to_sgmii_
+ 	return 0;
+ }
+ 
+-static int set_mux_gmac12_to_gephy_sgmii(struct mtk_eth *eth, u64 path)
++static int set_mux_gmac123_to_usxgmii(struct mtk_eth *eth, u64 path)
++{
++	unsigned int val = 0;
++	bool updated = true;
++	int mac_id = 0;
++
++	/* Disable SYSCFG1 SGMII */
++	regmap_read(eth->ethsys, ETHSYS_SYSCFG0, &val);
++
++	switch (path) {
++	case MTK_ETH_PATH_GMAC1_USXGMII:
++		val &= ~(u32)SYSCFG0_SGMII_GMAC1_V2;
++		mac_id = MTK_GMAC1_ID;
++		break;
++	case MTK_ETH_PATH_GMAC2_USXGMII:
++		val &= ~(u32)SYSCFG0_SGMII_GMAC2_V2;
++		mac_id = MTK_GMAC2_ID;
++		break;
++	case MTK_ETH_PATH_GMAC3_USXGMII:
++		val &= ~(u32)SYSCFG0_SGMII_GMAC3_V2;
++		mac_id = MTK_GMAC3_ID;
++		break;
++	default:
++		updated = false;
++	};
++
++	if (updated) {
++		regmap_update_bits(eth->ethsys, ETHSYS_SYSCFG0,
++				   SYSCFG0_SGMII_MASK, val);
++
++		if (mac_id == MTK_GMAC2_ID)
++			regmap_set_bits(eth->infra, TOP_MISC_NETSYS_PCS_MUX,
++					MUX_G2_USXGMII_SEL);
++	}
++
++	dev_dbg(eth->dev, "path %s in %s updated = %d\n",
++		mtk_eth_path_name(path), __func__, updated);
++
++	return 0;
++}
++
++static int set_mux_gmac123_to_gephy_sgmii(struct mtk_eth *eth, u64 path)
+ {
+ 	unsigned int val = 0;
+ 	bool updated = true;
+@@ -182,6 +254,9 @@ static int set_mux_gmac12_to_gephy_sgmii
+ 	case MTK_ETH_PATH_GMAC2_SGMII:
+ 		val |= SYSCFG0_SGMII_GMAC2_V2;
+ 		break;
++	case MTK_ETH_PATH_GMAC3_SGMII:
++		val |= SYSCFG0_SGMII_GMAC3_V2;
++		break;
+ 	default:
+ 		updated = false;
+ 	}
+@@ -210,13 +285,25 @@ static const struct mtk_eth_muxc mtk_eth
+ 		.cap_bit = MTK_ETH_MUX_U3_GMAC2_TO_QPHY,
+ 		.set_path = set_mux_u3_gmac2_to_qphy,
+ 	}, {
++		.name = "mux_gmac2_to_2p5gphy",
++		.cap_bit = MTK_ETH_MUX_GMAC2_TO_2P5GPHY,
++		.set_path = set_mux_gmac2_to_2p5gphy,
++	}, {
+ 		.name = "mux_gmac1_gmac2_to_sgmii_rgmii",
+ 		.cap_bit = MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII,
+ 		.set_path = set_mux_gmac1_gmac2_to_sgmii_rgmii,
+ 	}, {
+ 		.name = "mux_gmac12_to_gephy_sgmii",
+ 		.cap_bit = MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII,
+-		.set_path = set_mux_gmac12_to_gephy_sgmii,
++		.set_path = set_mux_gmac123_to_gephy_sgmii,
++	}, {
++		.name = "mux_gmac123_to_gephy_sgmii",
++		.cap_bit = MTK_ETH_MUX_GMAC123_TO_GEPHY_SGMII,
++		.set_path = set_mux_gmac123_to_gephy_sgmii,
++	}, {
++		.name = "mux_gmac123_to_usxgmii",
++		.cap_bit = MTK_ETH_MUX_GMAC123_TO_USXGMII,
++		.set_path = set_mux_gmac123_to_usxgmii,
+ 	},
+ };
+ 
+@@ -249,12 +336,39 @@ out:
+ 	return err;
+ }
+ 
++int mtk_gmac_usxgmii_path_setup(struct mtk_eth *eth, int mac_id)
++{
++	u64 path;
++
++	path = (mac_id == MTK_GMAC1_ID) ?  MTK_ETH_PATH_GMAC1_USXGMII :
++	       (mac_id == MTK_GMAC2_ID) ?  MTK_ETH_PATH_GMAC2_USXGMII :
++					   MTK_ETH_PATH_GMAC3_USXGMII;
++
++	/* Setup proper MUXes along the path */
++	return mtk_eth_mux_setup(eth, path);
++}
++
+ int mtk_gmac_sgmii_path_setup(struct mtk_eth *eth, int mac_id)
+ {
+ 	u64 path;
+ 
+-	path = (mac_id == 0) ?  MTK_ETH_PATH_GMAC1_SGMII :
+-				MTK_ETH_PATH_GMAC2_SGMII;
++	path = (mac_id == MTK_GMAC1_ID) ? MTK_ETH_PATH_GMAC1_SGMII :
++	       (mac_id == MTK_GMAC2_ID) ? MTK_ETH_PATH_GMAC2_SGMII :
++					  MTK_ETH_PATH_GMAC3_SGMII;
++
++	/* Setup proper MUXes along the path */
++	return mtk_eth_mux_setup(eth, path);
++}
++
++int mtk_gmac_2p5gphy_path_setup(struct mtk_eth *eth, int mac_id)
++{
++	u64 path = 0;
++
++	if (mac_id == MTK_GMAC2_ID)
++		path = MTK_ETH_PATH_GMAC2_2P5GPHY;
++
++	if (!path)
++		return -EINVAL;
+ 
+ 	/* Setup proper MUXes along the path */
+ 	return mtk_eth_mux_setup(eth, path);
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -22,6 +22,8 @@
+ #include <linux/pinctrl/devinfo.h>
+ #include <linux/phylink.h>
+ #include <linux/pcs/pcs-mtk-lynxi.h>
++#include <linux/pcs/pcs-mtk-usxgmii.h>
++#include <linux/phy/phy.h>
+ #include <linux/jhash.h>
+ #include <linux/bitfield.h>
+ #include <net/dsa.h>
+@@ -270,12 +272,8 @@ static const char * const mtk_clks_sourc
+ 	"ethwarp_wocpu2",
+ 	"ethwarp_wocpu1",
+ 	"ethwarp_wocpu0",
+-	"top_usxgmii0_sel",
+-	"top_usxgmii1_sel",
+ 	"top_sgm0_sel",
+ 	"top_sgm1_sel",
+-	"top_xfi_phy0_xtal_sel",
+-	"top_xfi_phy1_xtal_sel",
+ 	"top_eth_gmii_sel",
+ 	"top_eth_refck_50m_sel",
+ 	"top_eth_sys_200m_sel",
+@@ -518,6 +516,30 @@ static void mtk_setup_bridge_switch(stru
+ 		MTK_GSW_CFG);
+ }
+ 
++static bool mtk_check_gmac23_idle(struct mtk_mac *mac)
++{
++	u32 mac_fsm, gdm_fsm;
++
++	mac_fsm = mtk_r32(mac->hw, MTK_MAC_FSM(mac->id));
++
++	switch (mac->id) {
++	case MTK_GMAC2_ID:
++		gdm_fsm = mtk_r32(mac->hw, MTK_FE_GDM2_FSM);
++		break;
++	case MTK_GMAC3_ID:
++		gdm_fsm = mtk_r32(mac->hw, MTK_FE_GDM3_FSM);
++		break;
++	default:
++		return true;
++	};
++
++	if ((mac_fsm & 0xFFFF0000) == 0x01010000 &&
++	    (gdm_fsm & 0xFFFF0000) == 0x00000000)
++		return true;
++
++	return false;
++}
++
+ static struct phylink_pcs *mtk_mac_select_pcs(struct phylink_config *config,
+ 					      phy_interface_t interface)
+ {
+@@ -526,6 +548,21 @@ static struct phylink_pcs *mtk_mac_selec
+ 	struct mtk_eth *eth = mac->hw;
+ 	unsigned int sid;
+ 
++	if (mtk_is_netsys_v3_or_greater(eth)) {
++		switch (interface) {
++		case PHY_INTERFACE_MODE_1000BASEX:
++		case PHY_INTERFACE_MODE_2500BASEX:
++		case PHY_INTERFACE_MODE_SGMII:
++			return mac->sgmii_pcs;
++		case PHY_INTERFACE_MODE_5GBASER:
++		case PHY_INTERFACE_MODE_10GBASER:
++		case PHY_INTERFACE_MODE_USXGMII:
++			return mac->usxgmii_pcs;
++		default:
++			return NULL;
++		}
++	}
++
+ 	if (interface == PHY_INTERFACE_MODE_SGMII ||
+ 	    phy_interface_mode_is_8023z(interface)) {
+ 		sid = (MTK_HAS_CAPS(eth->soc->caps, MTK_SHARED_SGMII)) ?
+@@ -577,7 +614,22 @@ static void mtk_mac_config(struct phylin
+ 					goto init_err;
+ 			}
+ 			break;
++		case PHY_INTERFACE_MODE_USXGMII:
++		case PHY_INTERFACE_MODE_10GBASER:
++		case PHY_INTERFACE_MODE_5GBASER:
++			if (MTK_HAS_CAPS(eth->soc->caps, MTK_USXGMII)) {
++				err = mtk_gmac_usxgmii_path_setup(eth, mac->id);
++				if (err)
++					goto init_err;
++			}
++			break;
+ 		case PHY_INTERFACE_MODE_INTERNAL:
++			if (mac->id == MTK_GMAC2_ID &&
++			    MTK_HAS_CAPS(eth->soc->caps, MTK_2P5GPHY)) {
++				err = mtk_gmac_2p5gphy_path_setup(eth, mac->id);
++				if (err)
++					goto init_err;
++			}
+ 			break;
+ 		default:
+ 			goto err_phy;
+@@ -624,8 +676,6 @@ static void mtk_mac_config(struct phylin
+ 		val &= ~SYSCFG0_GE_MODE(SYSCFG0_GE_MASK, mac->id);
+ 		val |= SYSCFG0_GE_MODE(ge_mode, mac->id);
+ 		regmap_write(eth->ethsys, ETHSYS_SYSCFG0, val);
+-
+-		mac->interface = state->interface;
+ 	}
+ 
+ 	/* SGMII */
+@@ -642,21 +692,40 @@ static void mtk_mac_config(struct phylin
+ 
+ 		/* Save the syscfg0 value for mac_finish */
+ 		mac->syscfg0 = val;
+-	} else if (phylink_autoneg_inband(mode)) {
++	} else if (state->interface != PHY_INTERFACE_MODE_USXGMII &&
++		   state->interface != PHY_INTERFACE_MODE_10GBASER &&
++		   state->interface != PHY_INTERFACE_MODE_5GBASER &&
++		   phylink_autoneg_inband(mode)) {
+ 		dev_err(eth->dev,
+-			"In-band mode not supported in non SGMII mode!\n");
++			"In-band mode not supported in non-SerDes modes!\n");
+ 		return;
+ 	}
+ 
+ 	/* Setup gmac */
+-	if (mtk_is_netsys_v3_or_greater(eth) &&
+-	    mac->interface == PHY_INTERFACE_MODE_INTERNAL) {
+-		mtk_w32(mac->hw, MTK_GDMA_XGDM_SEL, MTK_GDMA_EG_CTRL(mac->id));
+-		mtk_w32(mac->hw, MAC_MCR_FORCE_LINK_DOWN, MTK_MAC_MCR(mac->id));
++	if (mtk_is_netsys_v3_or_greater(eth)) {
++		if (mtk_interface_mode_is_xgmii(state->interface)) {
++			mtk_w32(mac->hw, MTK_GDMA_XGDM_SEL, MTK_GDMA_EG_CTRL(mac->id));
++			mtk_w32(mac->hw, MAC_MCR_FORCE_LINK_DOWN, MTK_MAC_MCR(mac->id));
++
++			if (mac->id == MTK_GMAC1_ID)
++				mtk_setup_bridge_switch(eth);
++		} else {
++			mtk_w32(eth, 0, MTK_GDMA_EG_CTRL(mac->id));
+ 
+-		mtk_setup_bridge_switch(eth);
++			/* FIXME: In current hardware design, we have to reset FE
++			 * when swtiching XGDM to GDM. Therefore, here trigger an SER
++			 * to let GDM go back to the initial state.
++			 */
++			if ((mtk_interface_mode_is_xgmii(mac->interface) ||
++			     mac->interface == PHY_INTERFACE_MODE_NA) &&
++			    !mtk_check_gmac23_idle(mac) &&
++			    !test_bit(MTK_RESETTING, &eth->state))
++				schedule_work(&eth->pending_work);
++		}
+ 	}
+ 
++	mac->interface = state->interface;
++
+ 	return;
+ 
+ err_phy:
+@@ -669,6 +738,18 @@ init_err:
+ 		mac->id, phy_modes(state->interface), err);
+ }
+ 
++static int mtk_mac_prepare(struct phylink_config *config, unsigned int mode,
++			   phy_interface_t interface)
++{
++	struct mtk_mac *mac = container_of(config, struct mtk_mac,
++					   phylink_config);
++
++	if (mac->pextp && mac->interface != interface)
++		phy_reset(mac->pextp);
++
++	return 0;
++}
++
+ static int mtk_mac_finish(struct phylink_config *config, unsigned int mode,
+ 			  phy_interface_t interface)
+ {
+@@ -677,6 +758,10 @@ static int mtk_mac_finish(struct phylink
+ 	struct mtk_eth *eth = mac->hw;
+ 	u32 mcr_cur, mcr_new;
+ 
++	/* Setup PMA/PMD */
++	if (mac->pextp)
++		phy_set_mode_ext(mac->pextp, PHY_MODE_ETHERNET, interface);
++
+ 	/* Enable SGMII */
+ 	if (interface == PHY_INTERFACE_MODE_SGMII ||
+ 	    phy_interface_mode_is_8023z(interface))
+@@ -701,10 +786,14 @@ static void mtk_mac_link_down(struct phy
+ {
+ 	struct mtk_mac *mac = container_of(config, struct mtk_mac,
+ 					   phylink_config);
+-	u32 mcr = mtk_r32(mac->hw, MTK_MAC_MCR(mac->id));
+ 
+-	mcr &= ~(MAC_MCR_TX_EN | MAC_MCR_RX_EN | MAC_MCR_FORCE_LINK);
+-	mtk_w32(mac->hw, mcr, MTK_MAC_MCR(mac->id));
++	if (!mtk_interface_mode_is_xgmii(interface)) {
++		mtk_m32(mac->hw, MAC_MCR_TX_EN | MAC_MCR_RX_EN | MAC_MCR_FORCE_LINK, 0, MTK_MAC_MCR(mac->id));
++		if (mtk_is_netsys_v3_or_greater(mac->hw))
++			mtk_m32(mac->hw, MTK_XGMAC_FORCE_LINK(mac->id), 0, MTK_XGMAC_STS(mac->id));
++	} else if (mtk_is_netsys_v3_or_greater(mac->hw) && mac->id != MTK_GMAC1_ID) {
++		mtk_m32(mac->hw, XMAC_MCR_TRX_DISABLE, XMAC_MCR_TRX_DISABLE, MTK_XMAC_MCR(mac->id));
++	}
+ }
+ 
+ static void mtk_set_queue_speed(struct mtk_eth *eth, unsigned int idx,
+@@ -776,13 +865,11 @@ static void mtk_set_queue_speed(struct m
+ 	mtk_w32(eth, val, soc->reg_map->qdma.qtx_sch + ofs);
+ }
+ 
+-static void mtk_mac_link_up(struct phylink_config *config,
+-			    struct phy_device *phy,
+-			    unsigned int mode, phy_interface_t interface,
+-			    int speed, int duplex, bool tx_pause, bool rx_pause)
++static void mtk_gdm_mac_link_up(struct mtk_mac *mac,
++				struct phy_device *phy,
++				unsigned int mode, phy_interface_t interface,
++				int speed, int duplex, bool tx_pause, bool rx_pause)
+ {
+-	struct mtk_mac *mac = container_of(config, struct mtk_mac,
+-					   phylink_config);
+ 	u32 mcr;
+ 
+ 	mcr = mtk_r32(mac->hw, MTK_MAC_MCR(mac->id));
+@@ -816,9 +903,63 @@ static void mtk_mac_link_up(struct phyli
+ 	mtk_w32(mac->hw, mcr, MTK_MAC_MCR(mac->id));
+ }
+ 
++static void mtk_xgdm_mac_link_up(struct mtk_mac *mac,
++				 struct phy_device *phy,
++				 unsigned int mode, phy_interface_t interface,
++				 int speed, int duplex, bool tx_pause, bool rx_pause)
++{
++	u32 mcr, force_link = 0;
++
++	if (mac->id == MTK_GMAC1_ID)
++		return;
++
++	/* Eliminate the interference(before link-up) caused by PHY noise */
++	mtk_m32(mac->hw, XMAC_LOGIC_RST, 0, MTK_XMAC_LOGIC_RST(mac->id));
++	mdelay(20);
++	mtk_m32(mac->hw, XMAC_GLB_CNTCLR, XMAC_GLB_CNTCLR, MTK_XMAC_CNT_CTRL(mac->id));
++
++	if (mac->interface == PHY_INTERFACE_MODE_INTERNAL || mac->id == MTK_GMAC3_ID)
++		force_link = MTK_XGMAC_FORCE_LINK(mac->id);
++
++	mtk_m32(mac->hw, MTK_XGMAC_FORCE_LINK(mac->id), force_link, MTK_XGMAC_STS(mac->id));
++
++	mcr = mtk_r32(mac->hw, MTK_XMAC_MCR(mac->id));
++	mcr &= ~(XMAC_MCR_FORCE_TX_FC | XMAC_MCR_FORCE_RX_FC | XMAC_MCR_TRX_DISABLE);
++	/* Configure pause modes -
++	 * phylink will avoid these for half duplex
++	 */
++	if (tx_pause)
++		mcr |= XMAC_MCR_FORCE_TX_FC;
++	if (rx_pause)
++		mcr |= XMAC_MCR_FORCE_RX_FC;
++
++	mtk_w32(mac->hw, mcr, MTK_XMAC_MCR(mac->id));
++}
++
++static void mtk_mac_link_up(struct phylink_config *config,
++			    struct phy_device *phy,
++			    unsigned int mode, phy_interface_t interface,
++			    int speed, int duplex, bool tx_pause, bool rx_pause)
++{
++	struct mtk_mac *mac = container_of(config, struct mtk_mac,
++					   phylink_config);
++
++	if (mtk_is_netsys_v3_or_greater(mac->hw) && mtk_interface_mode_is_xgmii(interface))
++		mtk_xgdm_mac_link_up(mac, phy, mode, interface, speed, duplex,
++				     tx_pause, rx_pause);
++	else
++		mtk_gdm_mac_link_up(mac, phy, mode, interface, speed, duplex,
++				    tx_pause, rx_pause);
++
++	/* Repeat pextp setup to tune link */
++	if (mac->pextp)
++		phy_set_mode_ext(mac->pextp, PHY_MODE_ETHERNET, interface);
++}
++
+ static const struct phylink_mac_ops mtk_phylink_ops = {
+ 	.mac_select_pcs = mtk_mac_select_pcs,
+ 	.mac_config = mtk_mac_config,
++	.mac_prepare = mtk_mac_prepare,
+ 	.mac_finish = mtk_mac_finish,
+ 	.mac_link_down = mtk_mac_link_down,
+ 	.mac_link_up = mtk_mac_link_up,
+@@ -3417,6 +3558,9 @@ static int mtk_open(struct net_device *d
+ 
+ 	ppe_num = eth->soc->ppe_num;
+ 
++	if (mac->pextp)
++		phy_power_on(mac->pextp);
++
+ 	err = phylink_of_phy_connect(mac->phylink, mac->of_node, 0);
+ 	if (err) {
+ 		netdev_err(dev, "%s: could not attach PHY: %d\n", __func__,
+@@ -3567,6 +3711,9 @@ static int mtk_stop(struct net_device *d
+ 	for (i = 0; i < ARRAY_SIZE(eth->ppe); i++)
+ 		mtk_ppe_stop(eth->ppe[i]);
+ 
++	if (mac->pextp)
++		phy_power_off(mac->pextp);
++
+ 	return 0;
+ }
+ 
+@@ -4580,6 +4727,7 @@ static const struct net_device_ops mtk_n
+ static int mtk_add_mac(struct mtk_eth *eth, struct device_node *np)
+ {
+ 	const __be32 *_id = of_get_property(np, "reg", NULL);
++	struct device_node *pcs_np;
+ 	phy_interface_t phy_mode;
+ 	struct phylink *phylink;
+ 	struct mtk_mac *mac;
+@@ -4616,16 +4764,41 @@ static int mtk_add_mac(struct mtk_eth *e
+ 	mac->id = id;
+ 	mac->hw = eth;
+ 	mac->of_node = np;
++	pcs_np = of_parse_phandle(mac->of_node, "pcs-handle", 0);
++	if (pcs_np) {
++		mac->sgmii_pcs = mtk_pcs_lynxi_get(eth->dev, pcs_np);
++		if (IS_ERR(mac->sgmii_pcs)) {
++			if (PTR_ERR(mac->sgmii_pcs) == -EPROBE_DEFER)
++				return -EPROBE_DEFER;
+ 
+-	err = of_get_ethdev_address(mac->of_node, eth->netdev[id]);
+-	if (err == -EPROBE_DEFER)
+-		return err;
++			dev_err(eth->dev, "cannot select SGMII PCS, error %ld\n",
++				PTR_ERR(mac->sgmii_pcs));
++			return PTR_ERR(mac->sgmii_pcs);
++		}
++	}
+ 
+-	if (err) {
+-		/* If the mac address is invalid, use random mac address */
+-		eth_hw_addr_random(eth->netdev[id]);
+-		dev_err(eth->dev, "generated random MAC address %pM\n",
+-			eth->netdev[id]->dev_addr);
++	pcs_np = of_parse_phandle(mac->of_node, "pcs-handle", 1);
++	if (pcs_np) {
++		mac->usxgmii_pcs = mtk_usxgmii_pcs_get(eth->dev, pcs_np);
++		if (IS_ERR(mac->usxgmii_pcs)) {
++			if (PTR_ERR(mac->usxgmii_pcs) == -EPROBE_DEFER)
++				return -EPROBE_DEFER;
++
++			dev_err(eth->dev, "cannot select USXGMII PCS, error %ld\n",
++				PTR_ERR(mac->usxgmii_pcs));
++			return PTR_ERR(mac->usxgmii_pcs);
++		}
++	}
++
++	if (mtk_is_netsys_v3_or_greater(eth) && (mac->sgmii_pcs || mac->usxgmii_pcs)) {
++		mac->pextp = devm_of_phy_get(eth->dev, mac->of_node, NULL);
++		if (IS_ERR(mac->pextp)) {
++			if (PTR_ERR(mac->pextp) != -EPROBE_DEFER)
++				dev_err(eth->dev, "cannot get PHY, error %ld\n",
++					PTR_ERR(mac->pextp));
++
++			return PTR_ERR(mac->pextp);
++		}
+ 	}
+ 
+ 	memset(mac->hwlro_ip, 0, sizeof(mac->hwlro_ip));
+@@ -4708,8 +4881,21 @@ static int mtk_add_mac(struct mtk_eth *e
+ 		phy_interface_zero(mac->phylink_config.supported_interfaces);
+ 		__set_bit(PHY_INTERFACE_MODE_INTERNAL,
+ 			  mac->phylink_config.supported_interfaces);
++	} else if (MTK_HAS_CAPS(mac->hw->soc->caps, MTK_USXGMII)) {
++		mac->phylink_config.mac_capabilities |= MAC_5000FD | MAC_10000FD;
++		__set_bit(PHY_INTERFACE_MODE_5GBASER,
++			  mac->phylink_config.supported_interfaces);
++		__set_bit(PHY_INTERFACE_MODE_10GBASER,
++			  mac->phylink_config.supported_interfaces);
++		__set_bit(PHY_INTERFACE_MODE_USXGMII,
++			  mac->phylink_config.supported_interfaces);
+ 	}
+ 
++	if (MTK_HAS_CAPS(mac->hw->soc->caps, MTK_2P5GPHY) &&
++	    id == MTK_GMAC2_ID)
++		__set_bit(PHY_INTERFACE_MODE_INTERNAL,
++			  mac->phylink_config.supported_interfaces);
++
+ 	phylink = phylink_create(&mac->phylink_config,
+ 				 of_fwnode_handle(mac->of_node),
+ 				 phy_mode, &mtk_phylink_ops);
+@@ -4760,6 +4946,26 @@ free_netdev:
+ 	return err;
+ }
+ 
++static int mtk_mac_assign_address(struct mtk_eth *eth, int i, bool test_defer_only)
++{
++	int err = of_get_ethdev_address(eth->mac[i]->of_node, eth->netdev[i]);
++
++	if (err == -EPROBE_DEFER)
++		return err;
++
++	if (test_defer_only)
++		return 0;
++
++	if (err) {
++		/* If the mac address is invalid, use random mac address */
++		eth_hw_addr_random(eth->netdev[i]);
++		dev_err(eth->dev, "generated random MAC address %pM\n",
++			eth->netdev[i]);
++	}
++
++	return 0;
++}
++
+ void mtk_eth_set_dma_device(struct mtk_eth *eth, struct device *dma_dev)
+ {
+ 	struct net_device *dev, *tmp;
+@@ -4906,7 +5112,8 @@ static int mtk_probe(struct platform_dev
+ 			regmap_write(cci, 0, 3);
+ 	}
+ 
+-	if (MTK_HAS_CAPS(eth->soc->caps, MTK_SGMII)) {
++	if (MTK_HAS_CAPS(eth->soc->caps, MTK_SGMII) &&
++	    !mtk_is_netsys_v3_or_greater(eth)) {
+ 		err = mtk_sgmii_init(eth);
+ 
+ 		if (err)
+@@ -5017,6 +5224,24 @@ static int mtk_probe(struct platform_dev
+ 		}
+ 	}
+ 
++	for (i = 0; i < MTK_MAX_DEVS; i++) {
++		if (!eth->netdev[i])
++			continue;
++
++		err = mtk_mac_assign_address(eth, i, true);
++		if (err)
++			goto err_deinit_hw;
++	}
++
++	for (i = 0; i < MTK_MAX_DEVS; i++) {
++		if (!eth->netdev[i])
++			continue;
++
++		err = mtk_mac_assign_address(eth, i, false);
++		if (err)
++			goto err_deinit_hw;
++	}
++
+ 	if (MTK_HAS_CAPS(eth->soc->caps, MTK_SHARED_INT)) {
+ 		err = devm_request_irq(eth->dev, eth->irq[0],
+ 				       mtk_handle_irq, 0,
+@@ -5127,6 +5352,11 @@ static void mtk_remove(struct platform_d
+ 		mtk_stop(eth->netdev[i]);
+ 		mac = netdev_priv(eth->netdev[i]);
+ 		phylink_disconnect_phy(mac->phylink);
++		if (mac->sgmii_pcs)
++			mtk_pcs_lynxi_put(mac->sgmii_pcs);
++
++		if (mac->usxgmii_pcs)
++			mtk_usxgmii_pcs_put(mac->usxgmii_pcs);
+ 	}
+ 
+ 	mtk_wed_exit();
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -15,6 +15,7 @@
+ #include <linux/u64_stats_sync.h>
+ #include <linux/refcount.h>
+ #include <linux/phylink.h>
++#include <linux/reset.h>
+ #include <linux/rhashtable.h>
+ #include <linux/dim.h>
+ #include <linux/bitfield.h>
+@@ -505,6 +506,21 @@
+ #define INTF_MODE_RGMII_1000    (TRGMII_MODE | TRGMII_CENTRAL_ALIGNED)
+ #define INTF_MODE_RGMII_10_100  0
+ 
++/* XFI Mac control registers */
++#define MTK_XMAC_BASE(x)	(0x12000 + (((x) - 1) * 0x1000))
++#define MTK_XMAC_MCR(x)		(MTK_XMAC_BASE(x))
++#define XMAC_MCR_TRX_DISABLE	0xf
++#define XMAC_MCR_FORCE_TX_FC	BIT(5)
++#define XMAC_MCR_FORCE_RX_FC	BIT(4)
++
++/* XFI Mac logic reset registers */
++#define MTK_XMAC_LOGIC_RST(x)	(MTK_XMAC_BASE(x) + 0x10)
++#define XMAC_LOGIC_RST		BIT(0)
++
++/* XFI Mac count global control */
++#define MTK_XMAC_CNT_CTRL(x)	(MTK_XMAC_BASE(x) + 0x100)
++#define XMAC_GLB_CNTCLR		BIT(0)
++
+ /* GPIO port control registers for GMAC 2*/
+ #define GPIO_OD33_CTRL8		0x4c0
+ #define GPIO_BIAS_CTRL		0xed0
+@@ -530,6 +546,7 @@
+ #define SYSCFG0_SGMII_GMAC2    ((3 << 8) & SYSCFG0_SGMII_MASK)
+ #define SYSCFG0_SGMII_GMAC1_V2 BIT(9)
+ #define SYSCFG0_SGMII_GMAC2_V2 BIT(8)
++#define SYSCFG0_SGMII_GMAC3_V2 BIT(7)
+ 
+ 
+ /* ethernet subsystem clock register */
+@@ -568,6 +585,11 @@
+ #define GEPHY_MAC_SEL          BIT(1)
+ 
+ /* Top misc registers */
++#define TOP_MISC_NETSYS_PCS_MUX	0x84
++#define NETSYS_PCS_MUX_MASK	GENMASK(1, 0)
++#define	MUX_G2_USXGMII_SEL	BIT(1)
++#define MUX_HSGMII1_G1_SEL	BIT(0)
++
+ #define USB_PHY_SWITCH_REG	0x218
+ #define QPHY_SEL_MASK		GENMASK(1, 0)
+ #define SGMII_QPHY_SEL		0x2
+@@ -592,6 +614,8 @@
+ #define MT7628_SDM_RBCNT	(MT7628_SDM_OFFSET + 0x10c)
+ #define MT7628_SDM_CS_ERR	(MT7628_SDM_OFFSET + 0x110)
+ 
++/* Debug Purpose Register */
++#define MTK_PSE_FQFC_CFG	0x100
+ #define MTK_FE_CDM1_FSM		0x220
+ #define MTK_FE_CDM2_FSM		0x224
+ #define MTK_FE_CDM3_FSM		0x238
+@@ -600,6 +624,11 @@
+ #define MTK_FE_CDM6_FSM		0x328
+ #define MTK_FE_GDM1_FSM		0x228
+ #define MTK_FE_GDM2_FSM		0x22C
++#define MTK_FE_GDM3_FSM		0x23C
++#define MTK_FE_PSE_FREE		0x240
++#define MTK_FE_DROP_FQ		0x244
++#define MTK_FE_DROP_FC		0x248
++#define MTK_FE_DROP_PPE		0x24C
+ 
+ #define MTK_MAC_FSM(x)		(0x1010C + ((x) * 0x100))
+ 
+@@ -932,6 +961,8 @@ enum mkt_eth_capabilities {
+ 	MTK_RGMII_BIT = 0,
+ 	MTK_TRGMII_BIT,
+ 	MTK_SGMII_BIT,
++	MTK_USXGMII_BIT,
++	MTK_2P5GPHY_BIT,
+ 	MTK_ESW_BIT,
+ 	MTK_GEPHY_BIT,
+ 	MTK_MUX_BIT,
+@@ -952,8 +983,11 @@ enum mkt_eth_capabilities {
+ 	MTK_ETH_MUX_GDM1_TO_GMAC1_ESW_BIT,
+ 	MTK_ETH_MUX_GMAC2_GMAC0_TO_GEPHY_BIT,
+ 	MTK_ETH_MUX_U3_GMAC2_TO_QPHY_BIT,
++	MTK_ETH_MUX_GMAC2_TO_2P5GPHY_BIT,
+ 	MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII_BIT,
+ 	MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII_BIT,
++	MTK_ETH_MUX_GMAC123_TO_GEPHY_SGMII_BIT,
++	MTK_ETH_MUX_GMAC123_TO_USXGMII_BIT,
+ 
+ 	/* PATH BITS */
+ 	MTK_ETH_PATH_GMAC1_RGMII_BIT,
+@@ -961,14 +995,21 @@ enum mkt_eth_capabilities {
+ 	MTK_ETH_PATH_GMAC1_SGMII_BIT,
+ 	MTK_ETH_PATH_GMAC2_RGMII_BIT,
+ 	MTK_ETH_PATH_GMAC2_SGMII_BIT,
++	MTK_ETH_PATH_GMAC2_2P5GPHY_BIT,
+ 	MTK_ETH_PATH_GMAC2_GEPHY_BIT,
++	MTK_ETH_PATH_GMAC3_SGMII_BIT,
+ 	MTK_ETH_PATH_GDM1_ESW_BIT,
++	MTK_ETH_PATH_GMAC1_USXGMII_BIT,
++	MTK_ETH_PATH_GMAC2_USXGMII_BIT,
++	MTK_ETH_PATH_GMAC3_USXGMII_BIT,
+ };
+ 
+ /* Supported hardware group on SoCs */
+ #define MTK_RGMII		BIT_ULL(MTK_RGMII_BIT)
+ #define MTK_TRGMII		BIT_ULL(MTK_TRGMII_BIT)
+ #define MTK_SGMII		BIT_ULL(MTK_SGMII_BIT)
++#define MTK_USXGMII		BIT_ULL(MTK_USXGMII_BIT)
++#define MTK_2P5GPHY		BIT_ULL(MTK_2P5GPHY_BIT)
+ #define MTK_ESW			BIT_ULL(MTK_ESW_BIT)
+ #define MTK_GEPHY		BIT_ULL(MTK_GEPHY_BIT)
+ #define MTK_MUX			BIT_ULL(MTK_MUX_BIT)
+@@ -991,10 +1032,16 @@ enum mkt_eth_capabilities {
+ 	BIT_ULL(MTK_ETH_MUX_GMAC2_GMAC0_TO_GEPHY_BIT)
+ #define MTK_ETH_MUX_U3_GMAC2_TO_QPHY		\
+ 	BIT_ULL(MTK_ETH_MUX_U3_GMAC2_TO_QPHY_BIT)
++#define MTK_ETH_MUX_GMAC2_TO_2P5GPHY		\
++	BIT_ULL(MTK_ETH_MUX_GMAC2_TO_2P5GPHY_BIT)
+ #define MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII	\
+ 	BIT_ULL(MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII_BIT)
+ #define MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII	\
+ 	BIT_ULL(MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII_BIT)
++#define MTK_ETH_MUX_GMAC123_TO_GEPHY_SGMII	\
++	BIT_ULL(MTK_ETH_MUX_GMAC123_TO_GEPHY_SGMII_BIT)
++#define MTK_ETH_MUX_GMAC123_TO_USXGMII	\
++	BIT_ULL(MTK_ETH_MUX_GMAC123_TO_USXGMII_BIT)
+ 
+ /* Supported path present on SoCs */
+ #define MTK_ETH_PATH_GMAC1_RGMII	BIT_ULL(MTK_ETH_PATH_GMAC1_RGMII_BIT)
+@@ -1002,8 +1049,13 @@ enum mkt_eth_capabilities {
+ #define MTK_ETH_PATH_GMAC1_SGMII	BIT_ULL(MTK_ETH_PATH_GMAC1_SGMII_BIT)
+ #define MTK_ETH_PATH_GMAC2_RGMII	BIT_ULL(MTK_ETH_PATH_GMAC2_RGMII_BIT)
+ #define MTK_ETH_PATH_GMAC2_SGMII	BIT_ULL(MTK_ETH_PATH_GMAC2_SGMII_BIT)
++#define MTK_ETH_PATH_GMAC2_2P5GPHY	BIT_ULL(MTK_ETH_PATH_GMAC2_2P5GPHY_BIT)
+ #define MTK_ETH_PATH_GMAC2_GEPHY	BIT_ULL(MTK_ETH_PATH_GMAC2_GEPHY_BIT)
++#define MTK_ETH_PATH_GMAC3_SGMII	BIT_ULL(MTK_ETH_PATH_GMAC3_SGMII_BIT)
+ #define MTK_ETH_PATH_GDM1_ESW		BIT_ULL(MTK_ETH_PATH_GDM1_ESW_BIT)
++#define MTK_ETH_PATH_GMAC1_USXGMII	BIT_ULL(MTK_ETH_PATH_GMAC1_USXGMII_BIT)
++#define MTK_ETH_PATH_GMAC2_USXGMII	BIT_ULL(MTK_ETH_PATH_GMAC2_USXGMII_BIT)
++#define MTK_ETH_PATH_GMAC3_USXGMII	BIT_ULL(MTK_ETH_PATH_GMAC3_USXGMII_BIT)
+ 
+ #define MTK_GMAC1_RGMII		(MTK_ETH_PATH_GMAC1_RGMII | MTK_RGMII)
+ #define MTK_GMAC1_TRGMII	(MTK_ETH_PATH_GMAC1_TRGMII | MTK_TRGMII)
+@@ -1011,7 +1063,12 @@ enum mkt_eth_capabilities {
+ #define MTK_GMAC2_RGMII		(MTK_ETH_PATH_GMAC2_RGMII | MTK_RGMII)
+ #define MTK_GMAC2_SGMII		(MTK_ETH_PATH_GMAC2_SGMII | MTK_SGMII)
+ #define MTK_GMAC2_GEPHY		(MTK_ETH_PATH_GMAC2_GEPHY | MTK_GEPHY)
++#define MTK_GMAC2_2P5GPHY	(MTK_ETH_PATH_GMAC2_2P5GPHY | MTK_2P5GPHY)
++#define MTK_GMAC3_SGMII		(MTK_ETH_PATH_GMAC3_SGMII | MTK_SGMII)
+ #define MTK_GDM1_ESW		(MTK_ETH_PATH_GDM1_ESW | MTK_ESW)
++#define MTK_GMAC1_USXGMII	(MTK_ETH_PATH_GMAC1_USXGMII | MTK_USXGMII)
++#define MTK_GMAC2_USXGMII	(MTK_ETH_PATH_GMAC2_USXGMII | MTK_USXGMII)
++#define MTK_GMAC3_USXGMII	(MTK_ETH_PATH_GMAC3_USXGMII | MTK_USXGMII)
+ 
+ /* MUXes present on SoCs */
+ /* 0: GDM1 -> GMAC1, 1: GDM1 -> ESW */
+@@ -1030,10 +1087,20 @@ enum mkt_eth_capabilities {
+ 	(MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII | MTK_MUX | \
+ 	MTK_SHARED_SGMII)
+ 
++/* 2: GMAC2 -> XGMII */
++#define MTK_MUX_GMAC2_TO_2P5GPHY      \
++	(MTK_ETH_MUX_GMAC2_TO_2P5GPHY | MTK_MUX | MTK_INFRA)
++
+ /* 0: GMACx -> GEPHY, 1: GMACx -> SGMII where x is 1 or 2 */
+ #define MTK_MUX_GMAC12_TO_GEPHY_SGMII   \
+ 	(MTK_ETH_MUX_GMAC12_TO_GEPHY_SGMII | MTK_MUX)
+ 
++#define MTK_MUX_GMAC123_TO_GEPHY_SGMII   \
++	(MTK_ETH_MUX_GMAC123_TO_GEPHY_SGMII | MTK_MUX)
++
++#define MTK_MUX_GMAC123_TO_USXGMII   \
++	(MTK_ETH_MUX_GMAC123_TO_USXGMII | MTK_MUX | MTK_INFRA)
++
+ #define MTK_HAS_CAPS(caps, _x)		(((caps) & (_x)) == (_x))
+ 
+ #define MT7621_CAPS  (MTK_GMAC1_RGMII | MTK_GMAC1_TRGMII | \
+@@ -1065,8 +1132,12 @@ enum mkt_eth_capabilities {
+ 		      MTK_MUX_GMAC12_TO_GEPHY_SGMII | MTK_QDMA | \
+ 		      MTK_RSTCTRL_PPE1 | MTK_SRAM)
+ 
+-#define MT7988_CAPS  (MTK_36BIT_DMA | MTK_GDM1_ESW | MTK_QDMA | \
+-		      MTK_RSTCTRL_PPE1 | MTK_RSTCTRL_PPE2 | MTK_SRAM)
++#define MT7988_CAPS  (MTK_36BIT_DMA | MTK_GDM1_ESW | MTK_GMAC1_SGMII | \
++		      MTK_GMAC2_2P5GPHY | MTK_GMAC2_SGMII | MTK_GMAC2_USXGMII | \
++		      MTK_GMAC3_SGMII | MTK_GMAC3_USXGMII | \
++		      MTK_MUX_GMAC123_TO_GEPHY_SGMII | \
++		      MTK_MUX_GMAC123_TO_USXGMII | MTK_MUX_GMAC2_TO_2P5GPHY | \
++		      MTK_QDMA | MTK_RSTCTRL_PPE1 | MTK_RSTCTRL_PPE2 | MTK_SRAM)
+ 
+ struct mtk_tx_dma_desc_info {
+ 	dma_addr_t	addr;
+@@ -1311,6 +1382,9 @@ struct mtk_mac {
+ 	struct device_node		*of_node;
+ 	struct phylink			*phylink;
+ 	struct phylink_config		phylink_config;
++	struct phylink_pcs		*sgmii_pcs;
++	struct phylink_pcs		*usxgmii_pcs;
++	struct phy			*pextp;
+ 	struct mtk_eth			*hw;
+ 	struct mtk_hw_stats		*hw_stats;
+ 	__be32				hwlro_ip[MTK_MAX_LRO_IP_CNT];
+@@ -1434,6 +1508,19 @@ static inline u32 mtk_get_ib2_multicast_
+ 	return MTK_FOE_IB2_MULTICAST;
+ }
+ 
++static inline bool mtk_interface_mode_is_xgmii(phy_interface_t interface)
++{
++	switch (interface) {
++	case PHY_INTERFACE_MODE_INTERNAL:
++	case PHY_INTERFACE_MODE_USXGMII:
++	case PHY_INTERFACE_MODE_10GBASER:
++	case PHY_INTERFACE_MODE_5GBASER:
++		return true;
++	default:
++		return false;
++	}
++}
++
+ /* read the hardware status register */
+ void mtk_stats_update_mac(struct mtk_mac *mac);
+ 
+@@ -1442,8 +1529,10 @@ u32 mtk_r32(struct mtk_eth *eth, unsigne
+ u32 mtk_m32(struct mtk_eth *eth, u32 mask, u32 set, unsigned int reg);
+ 
+ int mtk_gmac_sgmii_path_setup(struct mtk_eth *eth, int mac_id);
++int mtk_gmac_2p5gphy_path_setup(struct mtk_eth *eth, int mac_id);
+ int mtk_gmac_gephy_path_setup(struct mtk_eth *eth, int mac_id);
+ int mtk_gmac_rgmii_path_setup(struct mtk_eth *eth, int mac_id);
++int mtk_gmac_usxgmii_path_setup(struct mtk_eth *eth, int mac_id);
+ 
+ int mtk_eth_offload_init(struct mtk_eth *eth, u8 id);
+ int mtk_eth_setup_tc(struct net_device *dev, enum tc_setup_type type,
diff --git a/6.12/target/linux/generic/pending-6.12/738-01-net-ethernet-mtk_eth_soc-reduce-rx-ring-size-for-older.patch b/6.12/target/linux/generic/pending-6.12/738-01-net-ethernet-mtk_eth_soc-reduce-rx-ring-size-for-older.patch
new file mode 100644
index 00000000..7b88e3e6
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/738-01-net-ethernet-mtk_eth_soc-reduce-rx-ring-size-for-older.patch
@@ -0,0 +1,104 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: [PATCH net-next 3/4] net: ethernet: mtk_eth_soc: reduce rx ring size for older chipsets
+Date: Tue, 15 Oct 2024 13:09:37 +0200
+
+Commit c57e55819443 ("net: ethernet: mtk_eth_soc: handle dma buffer
+size soc specific") resolved some tx timeout issues by bumping FQ and
+tx ring sizes from 512 to 2048 entries (the value used in the MediaTek
+SDK), however it also changed the rx ring size for all chipsets in the
+same way.
+
+Based on a few tests, it seems that a symmetric rx/tx ring size of 2048
+really only makes sense on MT7988, which is capable of 10G ethernet links.
+
+Older chipsets are typically deployed in systems that are more memory
+constrained and don't actually need the larger rings to handle received
+packets.
+
+In order to reduce wasted memory set the ring size based on the SoC to
+the following values:
+- 2048 on MT7988
+- 1024 on MT7986
+- 512 (previous value) on everything else, except:
+- 256 on RT5350 (the oldest supported chipset)
+
+Fixes: c57e55819443 ("net: ethernet: mtk_eth_soc: handle dma buffer size soc specific")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -5387,7 +5387,7 @@ static const struct mtk_soc_data mt2701_
+ 		.desc_size = sizeof(struct mtk_rx_dma),
+ 		.irq_done_mask = MTK_RX_DONE_INT,
+ 		.dma_l4_valid = RX_DMA_L4_VALID,
+-		.dma_size = MTK_DMA_SIZE(2K),
++		.dma_size = MTK_DMA_SIZE(512),
+ 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
+ 		.dma_len_offset = 16,
+ 	},
+@@ -5415,7 +5415,7 @@ static const struct mtk_soc_data mt7621_
+ 		.desc_size = sizeof(struct mtk_rx_dma),
+ 		.irq_done_mask = MTK_RX_DONE_INT,
+ 		.dma_l4_valid = RX_DMA_L4_VALID,
+-		.dma_size = MTK_DMA_SIZE(2K),
++		.dma_size = MTK_DMA_SIZE(512),
+ 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
+ 		.dma_len_offset = 16,
+ 	},
+@@ -5445,7 +5445,7 @@ static const struct mtk_soc_data mt7622_
+ 		.desc_size = sizeof(struct mtk_rx_dma),
+ 		.irq_done_mask = MTK_RX_DONE_INT,
+ 		.dma_l4_valid = RX_DMA_L4_VALID,
+-		.dma_size = MTK_DMA_SIZE(2K),
++		.dma_size = MTK_DMA_SIZE(512),
+ 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
+ 		.dma_len_offset = 16,
+ 	},
+@@ -5474,7 +5474,7 @@ static const struct mtk_soc_data mt7623_
+ 		.desc_size = sizeof(struct mtk_rx_dma),
+ 		.irq_done_mask = MTK_RX_DONE_INT,
+ 		.dma_l4_valid = RX_DMA_L4_VALID,
+-		.dma_size = MTK_DMA_SIZE(2K),
++		.dma_size = MTK_DMA_SIZE(512),
+ 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
+ 		.dma_len_offset = 16,
+ 	},
+@@ -5500,7 +5500,7 @@ static const struct mtk_soc_data mt7629_
+ 		.desc_size = sizeof(struct mtk_rx_dma),
+ 		.irq_done_mask = MTK_RX_DONE_INT,
+ 		.dma_l4_valid = RX_DMA_L4_VALID,
+-		.dma_size = MTK_DMA_SIZE(2K),
++		.dma_size = MTK_DMA_SIZE(512),
+ 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
+ 		.dma_len_offset = 16,
+ 	},
+@@ -5532,7 +5532,7 @@ static const struct mtk_soc_data mt7981_
+ 		.dma_l4_valid = RX_DMA_L4_VALID_V2,
+ 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
+ 		.dma_len_offset = 16,
+-		.dma_size = MTK_DMA_SIZE(2K),
++		.dma_size = MTK_DMA_SIZE(512),
+ 	},
+ };
+ 
+@@ -5562,7 +5562,7 @@ static const struct mtk_soc_data mt7986_
+ 		.dma_l4_valid = RX_DMA_L4_VALID_V2,
+ 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
+ 		.dma_len_offset = 16,
+-		.dma_size = MTK_DMA_SIZE(2K),
++		.dma_size = MTK_DMA_SIZE(1K),
+ 	},
+ };
+ 
+@@ -5615,7 +5615,7 @@ static const struct mtk_soc_data rt5350_
+ 		.dma_l4_valid = RX_DMA_L4_VALID_PDMA,
+ 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
+ 		.dma_len_offset = 16,
+-		.dma_size = MTK_DMA_SIZE(2K),
++		.dma_size = MTK_DMA_SIZE(256),
+ 	},
+ };
+ 
diff --git a/6.12/target/linux/generic/pending-6.12/738-02-net-ethernet-mtk_eth_soc-do-not-enable-page-pool-sta.patch b/6.12/target/linux/generic/pending-6.12/738-02-net-ethernet-mtk_eth_soc-do-not-enable-page-pool-sta.patch
new file mode 100644
index 00000000..190cea8f
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/738-02-net-ethernet-mtk_eth_soc-do-not-enable-page-pool-sta.patch
@@ -0,0 +1,43 @@
+From: Danila Romanov <pervokur@gmail.com>
+Date: Wed, 22 Jan 2025 06:48:45 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: do not enable page pool stats by
+ default
+
+There is no reason for it to be enabled by default.
+Align mtk_eth_soc driver to mt76 driver.
+
+This option incurs additional CPU cost in allocation and recycle paths
+and additional memory cost to store the statistics.
+
+Signed-off-by: Danila Romanov <pervokur@gmail.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/Kconfig
++++ b/drivers/net/ethernet/mediatek/Kconfig
+@@ -26,7 +26,6 @@ config NET_MEDIATEK_SOC
+ 	select PHYLINK
+ 	select DIMLIB
+ 	select PAGE_POOL
+-	select PAGE_POOL_STATS
+ 	select PCS_MTK_LYNXI
+ 	select REGMAP_MMIO
+ 	help
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -4552,6 +4552,7 @@ static int mtk_get_sset_count(struct net
+ 
+ static void mtk_ethtool_pp_stats(struct mtk_eth *eth, u64 *data)
+ {
++#ifdef CONFIG_PAGE_POOL_STATS
+ 	struct page_pool_stats stats = {};
+ 	int i;
+ 
+@@ -4564,6 +4565,7 @@ static void mtk_ethtool_pp_stats(struct
+ 		page_pool_get_stats(ring->page_pool, &stats);
+ 	}
+ 	page_pool_ethtool_stats_get(data, &stats);
++#endif
+ }
+ 
+ static void mtk_get_ethtool_stats(struct net_device *dev,
diff --git a/6.12/target/linux/generic/pending-6.12/739-01-dt-bindings-phy-mediatek-xfi-tphy-add-new-bindings.patch b/6.12/target/linux/generic/pending-6.12/739-01-dt-bindings-phy-mediatek-xfi-tphy-add-new-bindings.patch
new file mode 100644
index 00000000..1f1c40b1
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/739-01-dt-bindings-phy-mediatek-xfi-tphy-add-new-bindings.patch
@@ -0,0 +1,136 @@
+From patchwork Thu Feb  1 21:52:20 2024
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 13541842
+Date: Thu, 1 Feb 2024 21:52:20 +0000
+From: Daniel Golle <daniel@makrotopia.org>
+To: Bc-bocun Chen <bc-bocun.chen@mediatek.com>,
+	Steven Liu <steven.liu@mediatek.com>,
+	John Crispin <john@phrozen.org>,
+	Chunfeng Yun <chunfeng.yun@mediatek.com>,
+	Vinod Koul <vkoul@kernel.org>,
+	Kishon Vijay Abraham I <kishon@kernel.org>,
+	Rob Herring <robh@kernel.org>,
+	Krzysztof Kozlowski <krzysztof.kozlowski+dt@linaro.org>,
+	Conor Dooley <conor+dt@kernel.org>,
+	Daniel Golle <daniel@makrotopia.org>,
+	Qingfang Deng <dqfext@gmail.com>,
+	SkyLake Huang <SkyLake.Huang@mediatek.com>,
+	Matthias Brugger <matthias.bgg@gmail.com>,
+	AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>,
+	Philipp Zabel <p.zabel@pengutronix.de>,
+	linux-arm-kernel@lists.infradead.org,
+	linux-mediatek@lists.infradead.org, linux-phy@lists.infradead.org,
+	devicetree@vger.kernel.org, linux-kernel@vger.kernel.org,
+	netdev@vger.kernel.org
+Subject: [PATCH 1/2] dt-bindings: phy: mediatek,xfi-tphy: add new bindings
+Message-ID: 
+ <702afb0c1246d95c90b22e57105304028bdd3083.1706823233.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+List-Id: Linux Phy Mailing list <linux-phy.lists.infradead.org>
+
+Add bindings for the MediaTek XFI T-PHY Ethernet SerDes PHY found in the
+MediaTek MT7988 SoC which can operate at various interfaces modes:
+
+via USXGMII PCS:
+ * USXGMII
+ * 10GBase-R
+ * 5GBase-R
+
+via LynxI SGMII PCS:
+ * 2500Base-X
+ * 1000Base-X
+ * Cisco SGMII (MAC side)
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ .../bindings/phy/mediatek,xfi-tphy.yaml       | 80 +++++++++++++++++++
+ 1 file changed, 80 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/phy/mediatek,xfi-tphy.yaml
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/phy/mediatek,xfi-tphy.yaml
+@@ -0,0 +1,80 @@
++# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/phy/mediatek,xfi-tphy.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: MediaTek XFI T-PHY
++
++maintainers:
++  - Daniel Golle <daniel@makrotopia.org>
++
++description:
++  The MediaTek XFI SerDes T-PHY provides the physical SerDes lanes
++  used by the (10G/5G) USXGMII PCS and (1G/2.5G) LynxI PCS found in
++  MediaTek's 10G-capabale SoCs.
++
++properties:
++  $nodename:
++    pattern: "^phy@[0-9a-f]+$"
++
++  compatible:
++    const: mediatek,mt7988-xfi-tphy
++
++  reg:
++    maxItems: 1
++
++  clocks:
++    items:
++      - description: XFI PHY clock
++      - description: XFI register clock
++
++  clock-names:
++    items:
++      - const: xfipll
++      - const: topxtal
++
++  resets:
++    items:
++      - description: PEXTP reset
++
++  mediatek,usxgmii-performance-errata:
++    $ref: /schemas/types.yaml#/definitions/flag
++    description:
++      One instance of the T-PHY on MT7988 suffers from a performance
++      problem in 10GBase-R mode which needs a work-around in the driver.
++      The work-around is enabled using this flag.
++
++  "#phy-cells":
++    const: 0
++
++required:
++  - compatible
++  - reg
++  - clocks
++  - clock-names
++  - resets
++  - "#phy-cells"
++
++additionalProperties: false
++
++examples:
++  - |
++    #include <dt-bindings/clock/mediatek,mt7988-clk.h>
++    soc {
++      #address-cells = <2>;
++      #size-cells = <2>;
++
++      phy@11f20000 {
++        compatible = "mediatek,mt7988-xfi-tphy";
++        reg = <0 0x11f20000 0 0x10000>;
++        clocks = <&xfi_pll CLK_XFIPLL_PLL_EN>,
++                 <&topckgen CLK_TOP_XFI_PHY_0_XTAL_SEL>;
++        clock-names = "xfipll", "topxtal";
++        resets = <&watchdog 14>;
++        mediatek,usxgmii-performance-errata;
++        #phy-cells = <0>;
++      };
++    };
++
++...
diff --git a/6.12/target/linux/generic/pending-6.12/739-03-net-pcs-pcs-mtk-lynxi-add-platform-driver-for-MT7988.patch b/6.12/target/linux/generic/pending-6.12/739-03-net-pcs-pcs-mtk-lynxi-add-platform-driver-for-MT7988.patch
new file mode 100644
index 00000000..68b4a99c
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/739-03-net-pcs-pcs-mtk-lynxi-add-platform-driver-for-MT7988.patch
@@ -0,0 +1,369 @@
+From 4b1a2716299c0e96a698044aebf3f80513509ae7 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Tue, 12 Dec 2023 03:47:18 +0000
+Subject: [PATCH 3/5] net: pcs: pcs-mtk-lynxi: add platform driver for MT7988
+
+Introduce a proper platform MFD driver for the LynxI (H)SGMII PCS which
+is going to initially be used for the MT7988 SoC.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/pcs/pcs-mtk-lynxi.c   | 227 ++++++++++++++++++++++++++++--
+ include/linux/pcs/pcs-mtk-lynxi.h |  11 ++
+ 2 files changed, 227 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/pcs/pcs-mtk-lynxi.c
++++ b/drivers/net/pcs/pcs-mtk-lynxi.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ // Copyright (c) 2018-2019 MediaTek Inc.
+-/* A library for MediaTek SGMII circuit
++/* A library and platform driver for the MediaTek LynxI SGMII circuit
+  *
+  * Author: Sean Wang <sean.wang@mediatek.com>
+  * Author: Alexander Couzens <lynxis@fe80.eu>
+@@ -8,11 +8,17 @@
+  *
+  */
+ 
++#include <linux/clk.h>
+ #include <linux/mdio.h>
++#include <linux/mfd/syscon.h>
++#include <linux/mutex.h>
+ #include <linux/of.h>
++#include <linux/of_platform.h>
+ #include <linux/pcs/pcs-mtk-lynxi.h>
+ #include <linux/phylink.h>
++#include <linux/platform_device.h>
+ #include <linux/regmap.h>
++#include <linux/reset.h>
+ 
+ /* SGMII subsystem config registers */
+ /* BMCR (low 16) BMSR (high 16) */
+@@ -65,6 +71,8 @@
+ #define SGMII_PN_SWAP_MASK		GENMASK(1, 0)
+ #define SGMII_PN_SWAP_TX_RX		(BIT(0) | BIT(1))
+ 
++#define MTK_NETSYS_V3_AMA_RGC3		0x128
++
+ /* struct mtk_pcs_lynxi -  This structure holds each sgmii regmap andassociated
+  *                         data
+  * @regmap:                The register map pointing at the range used to setup
+@@ -74,15 +82,29 @@
+  * @interface:             Currently configured interface mode
+  * @pcs:                   Phylink PCS structure
+  * @flags:                 Flags indicating hardware properties
++ * @rstc:                  Reset controller
++ * @sgmii_sel:             SGMII Register Clock
++ * @sgmii_rx:              SGMII RX Clock
++ * @sgmii_tx:              SGMII TX Clock
++ * @node:                  List node
+  */
+ struct mtk_pcs_lynxi {
+ 	struct regmap		*regmap;
++	struct device		*dev;
+ 	u32			ana_rgc3;
+ 	phy_interface_t		interface;
+ 	struct			phylink_pcs pcs;
+ 	u32			flags;
++	struct reset_control	*rstc;
++	struct clk		*sgmii_sel;
++	struct clk		*sgmii_rx;
++	struct clk		*sgmii_tx;
++	struct list_head	node;
+ };
+ 
++static LIST_HEAD(mtk_pcs_lynxi_instances);
++static DEFINE_MUTEX(instance_mutex);
++
+ static struct mtk_pcs_lynxi *pcs_to_mtk_pcs_lynxi(struct phylink_pcs *pcs)
+ {
+ 	return container_of(pcs, struct mtk_pcs_lynxi, pcs);
+@@ -102,6 +124,17 @@ static void mtk_pcs_lynxi_get_state(stru
+ 					 FIELD_GET(SGMII_LPA, adv));
+ }
+ 
++static void mtk_sgmii_reset(struct mtk_pcs_lynxi *mpcs)
++{
++	if (!mpcs->rstc)
++		return;
++
++	reset_control_assert(mpcs->rstc);
++	udelay(100);
++	reset_control_deassert(mpcs->rstc);
++	mdelay(1);
++}
++
+ static int mtk_pcs_lynxi_config(struct phylink_pcs *pcs, unsigned int neg_mode,
+ 				phy_interface_t interface,
+ 				const unsigned long *advertising,
+@@ -147,6 +180,7 @@ static int mtk_pcs_lynxi_config(struct p
+ 				SGMII_PHYA_PWD);
+ 
+ 		/* Reset SGMII PCS state */
++		mtk_sgmii_reset(mpcs);
+ 		regmap_set_bits(mpcs->regmap, SGMSYS_RESERVED_0,
+ 				SGMII_SW_RESET);
+ 
+@@ -233,10 +267,29 @@ static void mtk_pcs_lynxi_link_up(struct
+ 	}
+ }
+ 
++static int mtk_pcs_lynxi_enable(struct phylink_pcs *pcs)
++{
++	struct mtk_pcs_lynxi *mpcs = pcs_to_mtk_pcs_lynxi(pcs);
++
++	if (mpcs->sgmii_tx && mpcs->sgmii_rx) {
++		clk_prepare_enable(mpcs->sgmii_rx);
++		clk_prepare_enable(mpcs->sgmii_tx);
++	}
++
++	return 0;
++}
++
+ static void mtk_pcs_lynxi_disable(struct phylink_pcs *pcs)
+ {
+ 	struct mtk_pcs_lynxi *mpcs = pcs_to_mtk_pcs_lynxi(pcs);
+ 
++	regmap_set_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, SGMII_PHYA_PWD);
++
++	if (mpcs->sgmii_tx && mpcs->sgmii_rx) {
++		clk_disable_unprepare(mpcs->sgmii_tx);
++		clk_disable_unprepare(mpcs->sgmii_rx);
++	}
++
+ 	mpcs->interface = PHY_INTERFACE_MODE_NA;
+ }
+ 
+@@ -246,11 +299,12 @@ static const struct phylink_pcs_ops mtk_
+ 	.pcs_an_restart = mtk_pcs_lynxi_restart_an,
+ 	.pcs_link_up = mtk_pcs_lynxi_link_up,
+ 	.pcs_disable = mtk_pcs_lynxi_disable,
++	.pcs_enable = mtk_pcs_lynxi_enable,
+ };
+ 
+-struct phylink_pcs *mtk_pcs_lynxi_create(struct device *dev,
+-					 struct regmap *regmap, u32 ana_rgc3,
+-					 u32 flags)
++static struct phylink_pcs *mtk_pcs_lynxi_init(struct device *dev, struct regmap *regmap,
++					      u32 ana_rgc3, u32 flags,
++					      struct mtk_pcs_lynxi *prealloc)
+ {
+ 	struct mtk_pcs_lynxi *mpcs;
+ 	u32 id, ver;
+@@ -258,29 +312,33 @@ struct phylink_pcs *mtk_pcs_lynxi_create
+ 
+ 	ret = regmap_read(regmap, SGMSYS_PCS_DEVICE_ID, &id);
+ 	if (ret < 0)
+-		return NULL;
++		return ERR_PTR(ret);
+ 
+ 	if (id != SGMII_LYNXI_DEV_ID) {
+ 		dev_err(dev, "unknown PCS device id %08x\n", id);
+-		return NULL;
++		return ERR_PTR(-ENODEV);
+ 	}
+ 
+ 	ret = regmap_read(regmap, SGMSYS_PCS_SCRATCH, &ver);
+ 	if (ret < 0)
+-		return NULL;
++		return ERR_PTR(ret);
+ 
+ 	ver = FIELD_GET(SGMII_DEV_VERSION, ver);
+ 	if (ver != 0x1) {
+ 		dev_err(dev, "unknown PCS device version %04x\n", ver);
+-		return NULL;
++		return ERR_PTR(-ENODEV);
+ 	}
+ 
+ 	dev_dbg(dev, "MediaTek LynxI SGMII PCS (id 0x%08x, ver 0x%04x)\n", id,
+ 		ver);
+ 
+-	mpcs = kzalloc(sizeof(*mpcs), GFP_KERNEL);
+-	if (!mpcs)
+-		return NULL;
++	if (prealloc) {
++		mpcs = prealloc;
++	} else {
++		mpcs = kzalloc(sizeof(*mpcs), GFP_KERNEL);
++		if (!mpcs)
++			return ERR_PTR(-ENOMEM);
++	};
+ 
+ 	mpcs->ana_rgc3 = ana_rgc3;
+ 	mpcs->regmap = regmap;
+@@ -291,6 +349,13 @@ struct phylink_pcs *mtk_pcs_lynxi_create
+ 	mpcs->interface = PHY_INTERFACE_MODE_NA;
+ 
+ 	return &mpcs->pcs;
++};
++
++struct phylink_pcs *mtk_pcs_lynxi_create(struct device *dev,
++					 struct regmap *regmap, u32 ana_rgc3,
++					 u32 flags)
++{
++	return mtk_pcs_lynxi_init(dev, regmap, ana_rgc3, flags, NULL);
+ }
+ EXPORT_SYMBOL(mtk_pcs_lynxi_create);
+ 
+@@ -303,5 +368,142 @@ void mtk_pcs_lynxi_destroy(struct phylin
+ }
+ EXPORT_SYMBOL(mtk_pcs_lynxi_destroy);
+ 
++static int mtk_pcs_lynxi_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct device_node *np = dev->of_node;
++	struct mtk_pcs_lynxi *mpcs;
++	struct phylink_pcs *pcs;
++	struct regmap *regmap;
++	u32 flags = 0;
++
++	mpcs = devm_kzalloc(dev, sizeof(*mpcs), GFP_KERNEL);
++	if (!mpcs)
++		return -ENOMEM;
++
++	mpcs->dev = dev;
++	regmap = syscon_node_to_regmap(np->parent);
++	if (IS_ERR(regmap))
++		return PTR_ERR(regmap);
++
++	if (of_property_read_bool(np->parent, "mediatek,pnswap"))
++		flags |= MTK_SGMII_FLAG_PN_SWAP;
++
++	mpcs->rstc = of_reset_control_get_shared(np->parent, NULL);
++	if (IS_ERR(mpcs->rstc))
++		return PTR_ERR(mpcs->rstc);
++
++	reset_control_deassert(mpcs->rstc);
++	mpcs->sgmii_sel = devm_clk_get_enabled(dev, "sgmii_sel");
++	if (IS_ERR(mpcs->sgmii_sel))
++		return PTR_ERR(mpcs->sgmii_sel);
++
++	mpcs->sgmii_rx = devm_clk_get(dev, "sgmii_rx");
++	if (IS_ERR(mpcs->sgmii_rx))
++		return PTR_ERR(mpcs->sgmii_rx);
++
++	mpcs->sgmii_tx = devm_clk_get(dev, "sgmii_tx");
++	if (IS_ERR(mpcs->sgmii_tx))
++		return PTR_ERR(mpcs->sgmii_tx);
++
++	pcs = mtk_pcs_lynxi_init(dev, regmap, (uintptr_t)of_device_get_match_data(dev),
++				 flags, mpcs);
++	if (IS_ERR(pcs))
++		return PTR_ERR(pcs);
++
++	regmap_set_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, SGMII_PHYA_PWD);
++
++	platform_set_drvdata(pdev, mpcs);
++
++	mutex_lock(&instance_mutex);
++	list_add_tail(&mpcs->node, &mtk_pcs_lynxi_instances);
++	mutex_unlock(&instance_mutex);
++
++	return 0;
++}
++
++static void mtk_pcs_lynxi_remove(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct mtk_pcs_lynxi *cur, *tmp;
++
++	mutex_lock(&instance_mutex);
++	list_for_each_entry_safe(cur, tmp, &mtk_pcs_lynxi_instances, node)
++		if (cur->dev == dev) {
++			list_del(&cur->node);
++			kfree(cur);
++			break;
++		}
++	mutex_unlock(&instance_mutex);
++}
++
++static const struct of_device_id mtk_pcs_lynxi_of_match[] = {
++	{ .compatible = "mediatek,mt7988-sgmii", .data = (void *)MTK_NETSYS_V3_AMA_RGC3 },
++	{ /* sentinel */ },
++};
++MODULE_DEVICE_TABLE(of, mtk_pcs_lynxi_of_match);
++
++struct phylink_pcs *mtk_pcs_lynxi_get(struct device *dev, struct device_node *np)
++{
++	struct platform_device *pdev;
++	struct mtk_pcs_lynxi *mpcs;
++
++	if (!np)
++		return NULL;
++
++	if (!of_device_is_available(np))
++		return ERR_PTR(-ENODEV);
++
++	if (!of_match_node(mtk_pcs_lynxi_of_match, np))
++		return ERR_PTR(-EINVAL);
++
++	pdev = of_find_device_by_node(np);
++	if (!pdev || !platform_get_drvdata(pdev)) {
++		if (pdev)
++			put_device(&pdev->dev);
++		return ERR_PTR(-EPROBE_DEFER);
++	}
++
++	mpcs = platform_get_drvdata(pdev);
++	device_link_add(dev, mpcs->dev, DL_FLAG_AUTOREMOVE_CONSUMER);
++
++	return &mpcs->pcs;
++}
++EXPORT_SYMBOL(mtk_pcs_lynxi_get);
++
++void mtk_pcs_lynxi_put(struct phylink_pcs *pcs)
++{
++	struct mtk_pcs_lynxi *cur, *mpcs = NULL;
++
++	if (!pcs)
++		return;
++
++	mutex_lock(&instance_mutex);
++	list_for_each_entry(cur, &mtk_pcs_lynxi_instances, node)
++		if (pcs == &cur->pcs) {
++			mpcs = cur;
++			break;
++		}
++	mutex_unlock(&instance_mutex);
++
++	if (WARN_ON(!mpcs))
++		return;
++
++	put_device(mpcs->dev);
++}
++EXPORT_SYMBOL(mtk_pcs_lynxi_put);
++
++static struct platform_driver mtk_pcs_lynxi_driver = {
++	.driver = {
++		.name			= "mtk-pcs-lynxi",
++		.suppress_bind_attrs	= true,
++		.of_match_table		= mtk_pcs_lynxi_of_match,
++	},
++	.probe = mtk_pcs_lynxi_probe,
++	.remove = mtk_pcs_lynxi_remove,
++};
++module_platform_driver(mtk_pcs_lynxi_driver);
++
++MODULE_AUTHOR("Daniel Golle <daniel@makrotopia.org>");
+ MODULE_DESCRIPTION("MediaTek SGMII library for LynxI");
+ MODULE_LICENSE("GPL");
+--- a/include/linux/pcs/pcs-mtk-lynxi.h
++++ b/include/linux/pcs/pcs-mtk-lynxi.h
+@@ -10,4 +10,15 @@ struct phylink_pcs *mtk_pcs_lynxi_create
+ 					 struct regmap *regmap,
+ 					 u32 ana_rgc3, u32 flags);
+ void mtk_pcs_lynxi_destroy(struct phylink_pcs *pcs);
++
++#if IS_ENABLED(CONFIG_PCS_MTK_LYNXI)
++struct phylink_pcs *mtk_pcs_lynxi_get(struct device *dev, struct device_node *np);
++void mtk_pcs_lynxi_put(struct phylink_pcs *pcs);
++#else
++static inline struct phylink_pcs *mtk_pcs_lynxi_get(struct device *dev, struct device_node *np)
++{
++	return NULL;
++}
++static inline void mtk_pcs_lynxi_put(struct phylink_pcs *pcs) { }
++#endif /* IS_ENABLED(CONFIG_PCS_MTK_LYNXI) */
+ #endif
diff --git a/6.12/target/linux/generic/pending-6.12/739-04-dt-bindings-net-pcs-add-bindings-for-MediaTek-USXGMI.patch b/6.12/target/linux/generic/pending-6.12/739-04-dt-bindings-net-pcs-add-bindings-for-MediaTek-USXGMI.patch
new file mode 100644
index 00000000..215bd2ca
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/739-04-dt-bindings-net-pcs-add-bindings-for-MediaTek-USXGMI.patch
@@ -0,0 +1,81 @@
+From 7d88d79c0f65b27a92754d7547f7af098b3de67b Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Tue, 12 Dec 2023 03:47:31 +0000
+Subject: [PATCH 4/5] dt-bindings: net: pcs: add bindings for MediaTek USXGMII
+ PCS
+
+MediaTek's USXGMII can be found in the MT7988 SoC. We need to access
+it in order to configure and monitor the Ethernet SerDes link in
+USXGMII, 10GBase-R and 5GBase-R mode. By including a wrapped
+legacy 1000Base-X/2500Base-X/Cisco SGMII LynxI PCS as well, those
+interface modes are also available.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ .../bindings/net/pcs/mediatek,usxgmii.yaml    | 60 +++++++++++++++++++
+ 1 file changed, 60 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/net/pcs/mediatek,usxgmii.yaml
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/net/pcs/mediatek,usxgmii.yaml
+@@ -0,0 +1,60 @@
++# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/net/pcs/mediatek,usxgmii.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: MediaTek USXGMII PCS
++
++maintainers:
++  - Daniel Golle <daniel@makrotopia.org>
++
++description:
++  The MediaTek USXGMII PCS provides physical link control and status
++  for USXGMII, 10GBase-R and 5GBase-R links on the SerDes interfaces
++  provided by the PEXTP PHY.
++  In order to also support legacy 2500Base-X, 1000Base-X and Cisco
++  SGMII an existing mediatek,*-sgmiisys LynxI PCS is wrapped to
++  provide those interfaces modes on the same SerDes interfaces shared
++  with the USXGMII PCS.
++
++properties:
++  $nodename:
++    pattern: "^pcs@[0-9a-f]+$"
++
++  compatible:
++    const: mediatek,mt7988-usxgmiisys
++
++  reg:
++    maxItems: 1
++
++  clocks:
++    items:
++      - description: USXGMII top-level clock
++
++  resets:
++    items:
++      - description: XFI reset
++
++required:
++  - compatible
++  - reg
++  - clocks
++  - resets
++
++additionalProperties: false
++
++examples:
++  - |
++    #include <dt-bindings/clock/mediatek,mt7988-clk.h>
++    #define MT7988_TOPRGU_XFI0_GRST 12
++    soc {
++      #address-cells = <2>;
++      #size-cells = <2>;
++        usxgmiisys0: pcs@10080000 {
++          compatible = "mediatek,mt7988-usxgmiisys";
++          reg = <0 0x10080000 0 0x1000>;
++          clocks = <&topckgen CLK_TOP_USXGMII_SBUS_0_SEL>;
++          resets = <&watchdog MT7988_TOPRGU_XFI0_GRST>;
++        };
++    };
diff --git a/6.12/target/linux/generic/pending-6.12/739-05-net-pcs-add-driver-for-MediaTek-USXGMII-PCS.patch b/6.12/target/linux/generic/pending-6.12/739-05-net-pcs-add-driver-for-MediaTek-USXGMII-PCS.patch
new file mode 100644
index 00000000..3178ef19
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/739-05-net-pcs-add-driver-for-MediaTek-USXGMII-PCS.patch
@@ -0,0 +1,545 @@
+From dde0e95fff92e9f5009f3bea75278e0e34a48822 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Tue, 12 Dec 2023 03:47:47 +0000
+Subject: [PATCH 5/5] net: pcs: add driver for MediaTek USXGMII PCS
+
+Add driver for USXGMII PCS found in the MediaTek MT7988 SoC and supporting
+USXGMII, 10GBase-R and 5GBase-R interface modes.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ MAINTAINERS                         |   2 +
+ drivers/net/pcs/Kconfig             |  11 +
+ drivers/net/pcs/Makefile            |   1 +
+ drivers/net/pcs/pcs-mtk-usxgmii.c   | 456 ++++++++++++++++++++++++++++
+ include/linux/pcs/pcs-mtk-usxgmii.h |  27 ++
+ 5 files changed, 497 insertions(+)
+ create mode 100644 drivers/net/pcs/pcs-mtk-usxgmii.c
+ create mode 100644 include/linux/pcs/pcs-mtk-usxgmii.h
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -14419,7 +14419,9 @@ M:	Daniel Golle <daniel@makrotopia.org>
+ L:	netdev@vger.kernel.org
+ S:	Maintained
+ F:	drivers/net/pcs/pcs-mtk-lynxi.c
++F:	drivers/net/pcs/pcs-mtk-usxgmii.c
+ F:	include/linux/pcs/pcs-mtk-lynxi.h
++F:	include/linux/pcs/pcs-mtk-usxgmii.h
+ 
+ MEDIATEK ETHERNET PHY DRIVERS
+ M:	Daniel Golle <daniel@makrotopia.org>
+--- a/drivers/net/pcs/Kconfig
++++ b/drivers/net/pcs/Kconfig
+@@ -25,6 +25,17 @@ config PCS_MTK_LYNXI
+ 	  This module provides helpers to phylink for managing the LynxI PCS
+ 	  which is part of MediaTek's SoC and Ethernet switch ICs.
+ 
++config PCS_MTK_USXGMII
++	tristate "MediaTek USXGMII PCS"
++	select PCS_MTK_LYNXI
++	select PHY_MTK_PEXTP
++	select PHYLINK
++	help
++	  This module provides a driver for MediaTek's USXGMII PCS supporting
++	  10GBase-R, 5GBase-R and USXGMII interface modes.
++	  1000Base-X, 2500Base-X and Cisco SGMII are supported on the same
++	  differential pairs via an embedded LynxI PHY.
++
+ config PCS_RZN1_MIIC
+ 	tristate "Renesas RZ/N1 MII converter"
+ 	depends on OF && (ARCH_RZN1 || COMPILE_TEST)
+--- a/drivers/net/pcs/Makefile
++++ b/drivers/net/pcs/Makefile
+@@ -8,3 +8,4 @@ obj-$(CONFIG_PCS_XPCS)		+= pcs_xpcs.o
+ obj-$(CONFIG_PCS_LYNX)		+= pcs-lynx.o
+ obj-$(CONFIG_PCS_MTK_LYNXI)	+= pcs-mtk-lynxi.o
+ obj-$(CONFIG_PCS_RZN1_MIIC)	+= pcs-rzn1-miic.o
++obj-$(CONFIG_PCS_MTK_USXGMII)	+= pcs-mtk-usxgmii.o
+--- /dev/null
++++ b/drivers/net/pcs/pcs-mtk-usxgmii.c
+@@ -0,0 +1,454 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (c) 2023 MediaTek Inc.
++ * Author: Henry Yen <henry.yen@mediatek.com>
++ *         Daniel Golle <daniel@makrotopia.org>
++ */
++
++#include <linux/clk.h>
++#include <linux/io.h>
++#include <linux/mfd/syscon.h>
++#include <linux/mdio.h>
++#include <linux/mutex.h>
++#include <linux/of.h>
++#include <linux/of_platform.h>
++#include <linux/reset.h>
++#include <linux/pcs/pcs-mtk-usxgmii.h>
++#include <linux/platform_device.h>
++
++/* USXGMII subsystem config registers */
++/* Register to control speed */
++#define RG_PHY_TOP_SPEED_CTRL1			0x80c
++#define USXGMII_RATE_UPDATE_MODE		BIT(31)
++#define USXGMII_MAC_CK_GATED			BIT(29)
++#define USXGMII_IF_FORCE_EN			BIT(28)
++#define USXGMII_RATE_ADAPT_MODE			GENMASK(10, 8)
++#define USXGMII_RATE_ADAPT_MODE_X1		0
++#define USXGMII_RATE_ADAPT_MODE_X2		1
++#define USXGMII_RATE_ADAPT_MODE_X4		2
++#define USXGMII_RATE_ADAPT_MODE_X10		3
++#define USXGMII_RATE_ADAPT_MODE_X100		4
++#define USXGMII_RATE_ADAPT_MODE_X5		5
++#define USXGMII_RATE_ADAPT_MODE_X50		6
++#define USXGMII_XFI_RX_MODE			GENMASK(6, 4)
++#define USXGMII_XFI_TX_MODE			GENMASK(2, 0)
++#define USXGMII_XFI_MODE_10G			0
++#define USXGMII_XFI_MODE_5G			1
++#define USXGMII_XFI_MODE_2P5G			3
++
++/* Register to control PCS AN */
++#define RG_PCS_AN_CTRL0				0x810
++#define USXGMII_AN_RESTART			BIT(31)
++#define USXGMII_AN_SYNC_CNT			GENMASK(30, 11)
++#define USXGMII_AN_ENABLE			BIT(0)
++
++#define RG_PCS_AN_CTRL2				0x818
++#define USXGMII_LINK_TIMER_IDLE_DETECT		GENMASK(29, 20)
++#define USXGMII_LINK_TIMER_COMP_ACK_DETECT	GENMASK(19, 10)
++#define USXGMII_LINK_TIMER_AN_RESTART		GENMASK(9, 0)
++
++/* Register to read PCS AN status */
++#define RG_PCS_AN_STS0				0x81c
++#define USXGMII_LPA				GENMASK(15, 0)
++#define USXGMII_LPA_LATCH			BIT(31)
++
++/* Register to read PCS link status */
++#define RG_PCS_RX_STATUS0			0x904
++#define RG_PCS_RX_STATUS_UPDATE			BIT(16)
++#define RG_PCS_RX_LINK_STATUS			BIT(2)
++
++/* struct mtk_usxgmii_pcs - This structure holds each usxgmii PCS
++ * @pcs:		Phylink PCS structure
++ * @dev:		Pointer to device structure
++ * @base:		IO memory to access PCS hardware
++ * @clk:		Pointer to USXGMII clk
++ * @reset:		Pointer to USXGMII reset control
++ * @interface:		Currently selected interface mode
++ * @neg_mode:		Currently used phylink neg_mode
++ * @node:		List node
++ */
++struct mtk_usxgmii_pcs {
++	struct phylink_pcs		pcs;
++	struct device			*dev;
++	void __iomem			*base;
++	struct clk			*clk;
++	struct reset_control		*reset;
++	phy_interface_t			interface;
++	unsigned int			neg_mode;
++	struct list_head		node;
++};
++
++static LIST_HEAD(mtk_usxgmii_pcs_instances);
++static DEFINE_MUTEX(instance_mutex);
++
++static u32 mtk_r32(struct mtk_usxgmii_pcs *mpcs, unsigned int reg)
++{
++	return ioread32(mpcs->base + reg);
++}
++
++static void mtk_m32(struct mtk_usxgmii_pcs *mpcs, unsigned int reg, u32 mask, u32 set)
++{
++	u32 val;
++
++	val = ioread32(mpcs->base + reg);
++	val &= ~mask;
++	val |= set;
++	iowrite32(val, mpcs->base + reg);
++}
++
++static struct mtk_usxgmii_pcs *pcs_to_mtk_usxgmii_pcs(struct phylink_pcs *pcs)
++{
++	return container_of(pcs, struct mtk_usxgmii_pcs, pcs);
++}
++
++static void mtk_usxgmii_reset(struct mtk_usxgmii_pcs *mpcs)
++{
++	reset_control_assert(mpcs->reset);
++	udelay(100);
++	reset_control_deassert(mpcs->reset);
++
++	mdelay(10);
++}
++
++static int mtk_usxgmii_pcs_config(struct phylink_pcs *pcs, unsigned int neg_mode,
++				  phy_interface_t interface,
++				  const unsigned long *advertising,
++				  bool permit_pause_to_mac)
++{
++	struct mtk_usxgmii_pcs *mpcs = pcs_to_mtk_usxgmii_pcs(pcs);
++	unsigned int an_ctrl = 0, link_timer = 0, xfi_mode = 0, adapt_mode = 0;
++	bool mode_changed = false;
++
++	if (interface == PHY_INTERFACE_MODE_USXGMII) {
++		an_ctrl = FIELD_PREP(USXGMII_AN_SYNC_CNT, 0x1FF) | USXGMII_AN_ENABLE;
++		link_timer = FIELD_PREP(USXGMII_LINK_TIMER_IDLE_DETECT, 0x7B) |
++			     FIELD_PREP(USXGMII_LINK_TIMER_COMP_ACK_DETECT, 0x7B) |
++			     FIELD_PREP(USXGMII_LINK_TIMER_AN_RESTART, 0x7B);
++		xfi_mode = FIELD_PREP(USXGMII_XFI_RX_MODE, USXGMII_XFI_MODE_10G) |
++			   FIELD_PREP(USXGMII_XFI_TX_MODE, USXGMII_XFI_MODE_10G);
++	} else if (interface == PHY_INTERFACE_MODE_10GBASER) {
++		an_ctrl = FIELD_PREP(USXGMII_AN_SYNC_CNT, 0x1FF);
++		link_timer = FIELD_PREP(USXGMII_LINK_TIMER_IDLE_DETECT, 0x7B) |
++			     FIELD_PREP(USXGMII_LINK_TIMER_COMP_ACK_DETECT, 0x7B) |
++			     FIELD_PREP(USXGMII_LINK_TIMER_AN_RESTART, 0x7B);
++		xfi_mode = FIELD_PREP(USXGMII_XFI_RX_MODE, USXGMII_XFI_MODE_10G) |
++			   FIELD_PREP(USXGMII_XFI_TX_MODE, USXGMII_XFI_MODE_10G);
++		adapt_mode = USXGMII_RATE_UPDATE_MODE;
++	} else if (interface == PHY_INTERFACE_MODE_5GBASER) {
++		an_ctrl = FIELD_PREP(USXGMII_AN_SYNC_CNT, 0xFF);
++		link_timer = FIELD_PREP(USXGMII_LINK_TIMER_IDLE_DETECT, 0x3D) |
++			     FIELD_PREP(USXGMII_LINK_TIMER_COMP_ACK_DETECT, 0x3D) |
++			     FIELD_PREP(USXGMII_LINK_TIMER_AN_RESTART, 0x3D);
++		xfi_mode = FIELD_PREP(USXGMII_XFI_RX_MODE, USXGMII_XFI_MODE_5G) |
++			   FIELD_PREP(USXGMII_XFI_TX_MODE, USXGMII_XFI_MODE_5G);
++		adapt_mode = USXGMII_RATE_UPDATE_MODE;
++	} else {
++		return -EINVAL;
++	}
++
++	adapt_mode |= FIELD_PREP(USXGMII_RATE_ADAPT_MODE, USXGMII_RATE_ADAPT_MODE_X1);
++
++	if (mpcs->interface != interface) {
++		mpcs->interface = interface;
++		mode_changed = true;
++	}
++
++	mtk_usxgmii_reset(mpcs);
++
++	/* Setup USXGMII AN ctrl */
++	mtk_m32(mpcs, RG_PCS_AN_CTRL0,
++		USXGMII_AN_SYNC_CNT | USXGMII_AN_ENABLE,
++		an_ctrl);
++
++	mtk_m32(mpcs, RG_PCS_AN_CTRL2,
++		USXGMII_LINK_TIMER_IDLE_DETECT |
++		USXGMII_LINK_TIMER_COMP_ACK_DETECT |
++		USXGMII_LINK_TIMER_AN_RESTART,
++		link_timer);
++
++	mpcs->neg_mode = neg_mode;
++
++	/* Gated MAC CK */
++	mtk_m32(mpcs, RG_PHY_TOP_SPEED_CTRL1,
++		USXGMII_MAC_CK_GATED, USXGMII_MAC_CK_GATED);
++
++	/* Enable interface force mode */
++	mtk_m32(mpcs, RG_PHY_TOP_SPEED_CTRL1,
++		USXGMII_IF_FORCE_EN, USXGMII_IF_FORCE_EN);
++
++	/* Setup USXGMII adapt mode */
++	mtk_m32(mpcs, RG_PHY_TOP_SPEED_CTRL1,
++		USXGMII_RATE_UPDATE_MODE | USXGMII_RATE_ADAPT_MODE,
++		adapt_mode);
++
++	/* Setup USXGMII speed */
++	mtk_m32(mpcs, RG_PHY_TOP_SPEED_CTRL1,
++		USXGMII_XFI_RX_MODE | USXGMII_XFI_TX_MODE,
++		xfi_mode);
++
++	usleep_range(1, 10);
++
++	/* Un-gated MAC CK */
++	mtk_m32(mpcs, RG_PHY_TOP_SPEED_CTRL1, USXGMII_MAC_CK_GATED, 0);
++
++	usleep_range(1, 10);
++
++	/* Disable interface force mode for the AN mode */
++	if (an_ctrl & USXGMII_AN_ENABLE)
++		mtk_m32(mpcs, RG_PHY_TOP_SPEED_CTRL1, USXGMII_IF_FORCE_EN, 0);
++
++	return mode_changed;
++}
++
++static void mtk_usxgmii_pcs_get_fixed_speed(struct mtk_usxgmii_pcs *mpcs,
++					    struct phylink_link_state *state)
++{
++	u32 val = mtk_r32(mpcs, RG_PHY_TOP_SPEED_CTRL1);
++	int speed;
++
++	/* Calculate speed from interface speed and rate adapt mode */
++	switch (FIELD_GET(USXGMII_XFI_RX_MODE, val)) {
++	case USXGMII_XFI_MODE_10G:
++		speed = 10000;
++		break;
++	case USXGMII_XFI_MODE_5G:
++		speed = 5000;
++		break;
++	case USXGMII_XFI_MODE_2P5G:
++		speed = 2500;
++		break;
++	default:
++		state->speed = SPEED_UNKNOWN;
++		return;
++	}
++
++	switch (FIELD_GET(USXGMII_RATE_ADAPT_MODE, val)) {
++	case USXGMII_RATE_ADAPT_MODE_X100:
++		speed /= 100;
++		break;
++	case USXGMII_RATE_ADAPT_MODE_X50:
++		speed /= 50;
++		break;
++	case USXGMII_RATE_ADAPT_MODE_X10:
++		speed /= 10;
++		break;
++	case USXGMII_RATE_ADAPT_MODE_X5:
++		speed /= 5;
++		break;
++	case USXGMII_RATE_ADAPT_MODE_X4:
++		speed /= 4;
++		break;
++	case USXGMII_RATE_ADAPT_MODE_X2:
++		speed /= 2;
++		break;
++	case USXGMII_RATE_ADAPT_MODE_X1:
++		break;
++	default:
++		state->speed = SPEED_UNKNOWN;
++		return;
++	}
++
++	state->speed = speed;
++	state->duplex = DUPLEX_FULL;
++}
++
++static void mtk_usxgmii_pcs_get_an_state(struct mtk_usxgmii_pcs *mpcs,
++					 struct phylink_link_state *state)
++{
++	u16 lpa;
++
++	/* Refresh LPA by toggling LPA_LATCH */
++	mtk_m32(mpcs, RG_PCS_AN_STS0, USXGMII_LPA_LATCH, USXGMII_LPA_LATCH);
++	ndelay(1020);
++	mtk_m32(mpcs, RG_PCS_AN_STS0, USXGMII_LPA_LATCH, 0);
++	ndelay(1020);
++	lpa = FIELD_GET(USXGMII_LPA, mtk_r32(mpcs, RG_PCS_AN_STS0));
++
++	phylink_decode_usxgmii_word(state, lpa);
++}
++
++static void mtk_usxgmii_pcs_get_state(struct phylink_pcs *pcs,
++				      struct phylink_link_state *state)
++{
++	struct mtk_usxgmii_pcs *mpcs = pcs_to_mtk_usxgmii_pcs(pcs);
++
++	/* Refresh USXGMII link status by toggling RG_PCS_AN_STATUS_UPDATE */
++	mtk_m32(mpcs, RG_PCS_RX_STATUS0, RG_PCS_RX_STATUS_UPDATE,
++		RG_PCS_RX_STATUS_UPDATE);
++	ndelay(1020);
++	mtk_m32(mpcs, RG_PCS_RX_STATUS0, RG_PCS_RX_STATUS_UPDATE, 0);
++	ndelay(1020);
++
++	/* Read USXGMII link status */
++	state->link = FIELD_GET(RG_PCS_RX_LINK_STATUS,
++				mtk_r32(mpcs, RG_PCS_RX_STATUS0));
++
++	/* Continuously repeat re-configuration sequence until link comes up */
++	if (!state->link) {
++		mtk_usxgmii_pcs_config(pcs, mpcs->neg_mode,
++				       state->interface, NULL, false);
++		return;
++	}
++
++	if (FIELD_GET(USXGMII_AN_ENABLE, mtk_r32(mpcs, RG_PCS_AN_CTRL0)))
++		mtk_usxgmii_pcs_get_an_state(mpcs, state);
++	else
++		mtk_usxgmii_pcs_get_fixed_speed(mpcs, state);
++}
++
++static void mtk_usxgmii_pcs_restart_an(struct phylink_pcs *pcs)
++{
++	struct mtk_usxgmii_pcs *mpcs = pcs_to_mtk_usxgmii_pcs(pcs);
++
++	mtk_m32(mpcs, RG_PCS_AN_CTRL0, USXGMII_AN_RESTART, USXGMII_AN_RESTART);
++}
++
++static void mtk_usxgmii_pcs_link_up(struct phylink_pcs *pcs, unsigned int neg_mode,
++				    phy_interface_t interface,
++				    int speed, int duplex)
++{
++	/* Reconfiguring USXGMII to ensure the quality of the RX signal
++	 * after the line side link up.
++	 */
++	mtk_usxgmii_pcs_config(pcs, neg_mode, interface, NULL, false);
++}
++
++static void mtk_usxgmii_pcs_disable(struct phylink_pcs *pcs)
++{
++	struct mtk_usxgmii_pcs *mpcs = pcs_to_mtk_usxgmii_pcs(pcs);
++
++	mpcs->interface = PHY_INTERFACE_MODE_NA;
++	mpcs->neg_mode = -1;
++}
++
++static const struct phylink_pcs_ops mtk_usxgmii_pcs_ops = {
++	.pcs_config = mtk_usxgmii_pcs_config,
++	.pcs_get_state = mtk_usxgmii_pcs_get_state,
++	.pcs_an_restart = mtk_usxgmii_pcs_restart_an,
++	.pcs_link_up = mtk_usxgmii_pcs_link_up,
++	.pcs_disable = mtk_usxgmii_pcs_disable,
++};
++
++static int mtk_usxgmii_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct mtk_usxgmii_pcs *mpcs;
++
++	mpcs = devm_kzalloc(dev, sizeof(*mpcs), GFP_KERNEL);
++	if (!mpcs)
++		return -ENOMEM;
++
++	mpcs->base = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(mpcs->base))
++		return PTR_ERR(mpcs->base);
++
++	mpcs->dev = dev;
++	mpcs->pcs.ops = &mtk_usxgmii_pcs_ops;
++	mpcs->pcs.poll = true;
++	mpcs->pcs.neg_mode = true;
++	mpcs->interface = PHY_INTERFACE_MODE_NA;
++	mpcs->neg_mode = -1;
++
++	mpcs->clk = devm_clk_get_enabled(mpcs->dev, NULL);
++	if (IS_ERR(mpcs->clk))
++		return PTR_ERR(mpcs->clk);
++
++	mpcs->reset = devm_reset_control_get_shared(dev, NULL);
++	if (IS_ERR(mpcs->reset))
++		return PTR_ERR(mpcs->reset);
++
++	reset_control_deassert(mpcs->reset);
++
++	platform_set_drvdata(pdev, mpcs);
++
++	mutex_lock(&instance_mutex);
++	list_add_tail(&mpcs->node, &mtk_usxgmii_pcs_instances);
++	mutex_unlock(&instance_mutex);
++
++	return 0;
++}
++
++static void mtk_usxgmii_remove(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct mtk_usxgmii_pcs *cur, *tmp;
++
++	mutex_lock(&instance_mutex);
++	list_for_each_entry_safe(cur, tmp, &mtk_usxgmii_pcs_instances, node)
++		if (cur->dev == dev) {
++			list_del(&cur->node);
++			break;
++		}
++	mutex_unlock(&instance_mutex);
++}
++
++static const struct of_device_id mtk_usxgmii_of_mtable[] = {
++	{ .compatible = "mediatek,mt7988-usxgmiisys" },
++	{ /* sentinel */ },
++};
++MODULE_DEVICE_TABLE(of, mtk_usxgmii_of_mtable);
++
++struct phylink_pcs *mtk_usxgmii_pcs_get(struct device *dev, struct device_node *np)
++{
++	struct platform_device *pdev;
++	struct mtk_usxgmii_pcs *mpcs;
++
++	if (!np)
++		return NULL;
++
++	if (!of_device_is_available(np))
++		return ERR_PTR(-ENODEV);
++
++	if (!of_match_node(mtk_usxgmii_of_mtable, np))
++		return ERR_PTR(-EINVAL);
++
++	pdev = of_find_device_by_node(np);
++	if (!pdev || !platform_get_drvdata(pdev)) {
++		if (pdev)
++			put_device(&pdev->dev);
++		return ERR_PTR(-EPROBE_DEFER);
++	}
++
++	mpcs = platform_get_drvdata(pdev);
++	device_link_add(dev, mpcs->dev, DL_FLAG_AUTOREMOVE_CONSUMER);
++
++	return &mpcs->pcs;
++}
++EXPORT_SYMBOL(mtk_usxgmii_pcs_get);
++
++void mtk_usxgmii_pcs_put(struct phylink_pcs *pcs)
++{
++	struct mtk_usxgmii_pcs *cur, *mpcs = NULL;
++
++	if (!pcs)
++		return;
++
++	mutex_lock(&instance_mutex);
++	list_for_each_entry(cur, &mtk_usxgmii_pcs_instances, node)
++		if (pcs == &cur->pcs) {
++			mpcs = cur;
++			break;
++		}
++	mutex_unlock(&instance_mutex);
++
++	if (WARN_ON(!mpcs))
++		return;
++
++	put_device(mpcs->dev);
++}
++EXPORT_SYMBOL(mtk_usxgmii_pcs_put);
++
++static struct platform_driver mtk_usxgmii_driver = {
++	.driver = {
++		.name			= "mtk_usxgmii",
++		.suppress_bind_attrs	= true,
++		.of_match_table		= mtk_usxgmii_of_mtable,
++	},
++	.probe = mtk_usxgmii_probe,
++	.remove = mtk_usxgmii_remove,
++};
++module_platform_driver(mtk_usxgmii_driver);
++
++MODULE_LICENSE("GPL");
++MODULE_DESCRIPTION("MediaTek USXGMII PCS driver");
++MODULE_AUTHOR("Daniel Golle <daniel@makrotopia.org>");
+--- /dev/null
++++ b/include/linux/pcs/pcs-mtk-usxgmii.h
+@@ -0,0 +1,27 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef __LINUX_PCS_MTK_USXGMII_H
++#define __LINUX_PCS_MTK_USXGMII_H
++
++#include <linux/phylink.h>
++
++/**
++ * mtk_usxgmii_select_pcs() - Get MediaTek PCS instance
++ * @np:		Pointer to device node indentifying a MediaTek USXGMII PCS
++ * @mode:	Ethernet PHY interface mode
++ *
++ * Return PCS identified by a device node and the PHY interface mode in use
++ *
++ * Return:	Pointer to phylink PCS instance of NULL
++ */
++#if IS_ENABLED(CONFIG_PCS_MTK_USXGMII)
++struct phylink_pcs *mtk_usxgmii_pcs_get(struct device *dev, struct device_node *np);
++void mtk_usxgmii_pcs_put(struct phylink_pcs *pcs);
++#else
++static inline struct phylink_pcs *mtk_usxgmii_pcs_get(struct device *dev, struct device_node *np)
++{
++	return NULL;
++}
++static inline void mtk_usxgmii_pcs_put(struct phylink_pcs *pcs) { }
++#endif /* IS_ENABLED(CONFIG_PCS_MTK_USXGMII) */
++
++#endif /* __LINUX_PCS_MTK_USXGMII_H */
diff --git a/6.12/target/linux/generic/pending-6.12/740-net-phy-motorcomm-Add-missing-include.patch b/6.12/target/linux/generic/pending-6.12/740-net-phy-motorcomm-Add-missing-include.patch
new file mode 100644
index 00000000..2a1f908c
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/740-net-phy-motorcomm-Add-missing-include.patch
@@ -0,0 +1,22 @@
+From 6f291aa7da199c6486cc229b055dcbcd5cee7a21 Mon Sep 17 00:00:00 2001
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Sun, 21 May 2023 22:24:56 +0200
+Subject: [PATCH] net: phy: motorcomm: Add missing include
+
+Directly include linux/bitfield.h which provides FIELD_PREP.
+
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+---
+ drivers/net/phy/motorcomm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/phy/motorcomm.c
++++ b/drivers/net/phy/motorcomm.c
+@@ -6,6 +6,7 @@
+  * Author: Frank <Frank.Sae@motor-comm.com>
+  */
+ 
++#include <linux/bitfield.h>
+ #include <linux/etherdevice.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
diff --git a/6.12/target/linux/generic/pending-6.12/741-net-phy-broadcom-update-dependency-condition.patch b/6.12/target/linux/generic/pending-6.12/741-net-phy-broadcom-update-dependency-condition.patch
new file mode 100644
index 00000000..f5621e34
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/741-net-phy-broadcom-update-dependency-condition.patch
@@ -0,0 +1,35 @@
+From 1be3688b3eaa7ea2d9e19bd29ae6a6a51c121a0b Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Sat, 16 Nov 2024 22:36:15 +0100
+Subject: [PATCH] net: phy: broadcom: update dependency condition
+
+The broadcom PHY driver only has to depend upon PTP_1588_CLOCK_OPTIONAL
+if NETWORK_PHY_TIMESTAMPING is enabled. The PTP functionality is stubbed
+in this case.
+
+Reflect this circumstance in the dependence condition. This allows to
+build the driver as a built-in module even if PTP is built as a module.
+
+This is required to include the broadcom PHY module regardless of the
+built-setting of the PTP subsystem. On ath79 (and probably more)
+targets with Broadcom PHY, Gigabit operation is currently broken as the
+PHY driver is only built as a module in case all kernel-packages are
+built. Due to this circumstance, affected devices fall back to using the
+generic PHY driver.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ drivers/net/phy/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -139,7 +139,7 @@ config BROADCOM_PHY
+ 	tristate "Broadcom 54XX PHYs"
+ 	select BCM_NET_PHYLIB
+ 	select BCM_NET_PHYPTP if NETWORK_PHY_TIMESTAMPING
+-	depends on PTP_1588_CLOCK_OPTIONAL
++	depends on NETWORK_PHY_TIMESTAMPING=n || PTP_1588_CLOCK_OPTIONAL
+ 	help
+ 	  Currently supports the BCM5411, BCM5421, BCM5461, BCM54616S, BCM5464,
+ 	  BCM5481, BCM54810 and BCM5482 PHYs.
diff --git a/6.12/target/linux/generic/pending-6.12/742-net-phy-air_en8811h-reset-netdev-rules-when-LED-is-s.patch b/6.12/target/linux/generic/pending-6.12/742-net-phy-air_en8811h-reset-netdev-rules-when-LED-is-s.patch
new file mode 100644
index 00000000..82349e75
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/742-net-phy-air_en8811h-reset-netdev-rules-when-LED-is-s.patch
@@ -0,0 +1,45 @@
+From 9be9a00adfac8118b6d685e71696f83187308c66 Mon Sep 17 00:00:00 2001
+Message-ID: <9be9a00adfac8118b6d685e71696f83187308c66.1715125851.git.daniel@makrotopia.org>
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Tue, 7 May 2024 22:43:30 +0100
+Subject: [PATCH net] net: phy: air_en8811h: reset netdev rules when LED is set
+ manually
+To: Andrew Lunn <andrew@lunn.ch>,
+    Heiner Kallweit <hkallweit1@gmail.com>,
+    Russell King <linux@armlinux.org.uk>,
+    David S. Miller <davem@davemloft.net>,
+    Eric Dumazet <edumazet@google.com>,
+    Jakub Kicinski <kuba@kernel.org>,
+    Paolo Abeni <pabeni@redhat.com>,
+    SkyLake Huang <skylake.huang@mediatek.com>,
+    Eric Woudstra <ericwouds@gmail.com>,
+    netdev@vger.kernel.org,
+    linux-kernel@vger.kernel.org
+
+Setting LED_OFF via the brightness_set should deactivate hw control,
+so make sure netdev trigger rules also get cleared in that case.
+
+Fixes: 71e79430117d ("net: phy: air_en8811h: Add the Airoha EN8811H PHY driver")
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+This is basically a stop-gap measure until unified LED handling has
+been implemented accross all MediaTek and Airoha PHYs.
+See also
+https://patchwork.kernel.org/project/netdevbpf/patch/20240425023325.15586-3-SkyLake.Huang@mediatek.com/
+
+ drivers/net/phy/air_en8811h.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/phy/air_en8811h.c
++++ b/drivers/net/phy/air_en8811h.c
+@@ -548,6 +548,10 @@ static int air_hw_led_on_set(struct phy_
+ 	if (!on)
+ 		priv->led[index].rules = 0;
+ 
++	/* clear netdev trigger rules in case LED_OFF has been set */
++	if (!on)
++		priv->led[index].rules = 0;
++
+ 	if (changed)
+ 		return phy_modify_mmd(phydev, MDIO_MMD_VEND2,
+ 				      AIR_PHY_LED_ON(index),
diff --git a/6.12/target/linux/generic/pending-6.12/780-ARM-kirkwood-add-missing-linux-if_ether.h-for-ETH_AL.patch b/6.12/target/linux/generic/pending-6.12/780-ARM-kirkwood-add-missing-linux-if_ether.h-for-ETH_AL.patch
new file mode 100644
index 00000000..39ba7160
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/780-ARM-kirkwood-add-missing-linux-if_ether.h-for-ETH_AL.patch
@@ -0,0 +1,61 @@
+From patchwork Thu Aug  5 22:23:30 2021
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12422209
+Date: Thu, 5 Aug 2021 23:23:30 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-arm-kernel@lists.infradead.org, netdev@vger.kernel.org,
+ linux-kernel@vger.kernel.org
+Cc: "David S. Miller" <davem@davemloft.net>, Andrew Lunn <andrew@lunn.ch>,
+ Michael Walle <michael@walle.cc>
+Subject: [PATCH] ARM: kirkwood: add missing <linux/if_ether.h> for ETH_ALEN
+Message-ID: <YQxk4jrbm31NM1US@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+X-BeenThere: linux-arm-kernel@lists.infradead.org
+X-Mailman-Version: 2.1.34
+Precedence: list
+List-Id: <linux-arm-kernel.lists.infradead.org>
+List-Archive: <http://lists.infradead.org/pipermail/linux-arm-kernel/>
+Sender: "linux-arm-kernel" <linux-arm-kernel-bounces@lists.infradead.org>
+
+After commit 83216e3988cd1 ("of: net: pass the dst buffer to
+of_get_mac_address()") build fails for kirkwood as ETH_ALEN is not
+defined.
+
+arch/arm/mach-mvebu/kirkwood.c: In function 'kirkwood_dt_eth_fixup':
+arch/arm/mach-mvebu/kirkwood.c:87:13: error: 'ETH_ALEN' undeclared (first use in this function); did you mean 'ESTALE'?
+   u8 tmpmac[ETH_ALEN];
+             ^~~~~~~~
+             ESTALE
+arch/arm/mach-mvebu/kirkwood.c:87:13: note: each undeclared identifier is reported only once for each function it appears in
+arch/arm/mach-mvebu/kirkwood.c:87:6: warning: unused variable 'tmpmac' [-Wunused-variable]
+   u8 tmpmac[ETH_ALEN];
+      ^~~~~~
+make[5]: *** [scripts/Makefile.build:262: arch/arm/mach-mvebu/kirkwood.o] Error 1
+make[5]: *** Waiting for unfinished jobs....
+
+Add missing #include <linux/if_ether.h> to fix this.
+
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Andrew Lunn <andrew@lunn.ch>
+Cc: Michael Walle <michael@walle.cc>
+Reported-by: https://buildbot.openwrt.org/master/images/#/builders/56/builds/220/steps/44/logs/stdio
+Fixes: 83216e3988cd1 ("of: net: pass the dst buffer to of_get_mac_address()")
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ arch/arm/mach-mvebu/kirkwood.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/mach-mvebu/kirkwood.c
++++ b/arch/arm/mach-mvebu/kirkwood.c
+@@ -11,6 +11,7 @@
+ #include <linux/kernel.h>
+ #include <linux/init.h>
+ #include <linux/mbus.h>
++#include <linux/if_ether.h>
+ #include <linux/of.h>
+ #include <linux/of_address.h>
+ #include <linux/of_net.h>
diff --git a/6.12/target/linux/generic/pending-6.12/790-bus-mhi-core-add-SBL-state-callback.patch b/6.12/target/linux/generic/pending-6.12/790-bus-mhi-core-add-SBL-state-callback.patch
new file mode 100644
index 00000000..fe0f260a
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/790-bus-mhi-core-add-SBL-state-callback.patch
@@ -0,0 +1,48 @@
+From 5f7c5e1c0d7a79be144e5efc1f24728ddd7fc25c Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Sat, 5 Nov 2022 20:02:56 +0100
+Subject: [PATCH 1/2] bus: mhi: core: add SBL state callback
+
+Add support for SBL state callback in MHI core.
+
+It is required for ath11k MHI devices in order to be able to set QRTR
+instance ID in the SBL state so that QRTR instance ID-s dont conflict in
+case of multiple PCI/MHI cards or AHB + PCI/MHI card.
+Setting QRTR instance ID is only possible in SBL state and there is
+currently no way to ensure that we are in that state, so provide a
+callback that the controller can trigger off.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ drivers/bus/mhi/host/main.c | 1 +
+ include/linux/mhi.h         | 2 ++
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/bus/mhi/host/main.c
++++ b/drivers/bus/mhi/host/main.c
+@@ -906,6 +906,7 @@ int mhi_process_ctrl_ev_ring(struct mhi_
+ 			switch (event) {
+ 			case MHI_EE_SBL:
+ 				st = DEV_ST_TRANSITION_SBL;
++				mhi_cntrl->status_cb(mhi_cntrl, MHI_CB_EE_SBL_MODE);
+ 				break;
+ 			case MHI_EE_WFW:
+ 			case MHI_EE_AMSS:
+--- a/include/linux/mhi.h
++++ b/include/linux/mhi.h
+@@ -34,6 +34,7 @@ struct mhi_buf_info;
+  * @MHI_CB_SYS_ERROR: MHI device entered error state (may recover)
+  * @MHI_CB_FATAL_ERROR: MHI device entered fatal error state
+  * @MHI_CB_BW_REQ: Received a bandwidth switch request from device
++ * @MHI_CB_EE_SBL_MODE: MHI device entered SBL mode
+  */
+ enum mhi_callback {
+ 	MHI_CB_IDLE,
+@@ -45,6 +46,7 @@ enum mhi_callback {
+ 	MHI_CB_SYS_ERROR,
+ 	MHI_CB_FATAL_ERROR,
+ 	MHI_CB_BW_REQ,
++	MHI_CB_EE_SBL_MODE,
+ };
+ 
+ /**
diff --git a/6.12/target/linux/generic/pending-6.12/791-tg3-Fix-DMA-allocations-on-57766-devices.patch b/6.12/target/linux/generic/pending-6.12/791-tg3-Fix-DMA-allocations-on-57766-devices.patch
new file mode 100644
index 00000000..e65cc274
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/791-tg3-Fix-DMA-allocations-on-57766-devices.patch
@@ -0,0 +1,31 @@
+From f992b15965177e2f280fb6f41f292214f9a6f8d5 Mon Sep 17 00:00:00 2001
+From: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Date: Tue, 10 Dec 2024 03:28:31 -0800
+Subject: [PATCH] tg3: Fix DMA allocations on 57766 devices
+
+The coherent DMA mask of 31b may not be accepted if
+the DMA mask is configured to use higher memories of
+64b. Set the DMA mask also to lower 32b for 57766
+devices.
+
+Fixes: 614f4d166eee ("tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets")
+Reported-By: Rui Salvaterra <rsalvaterra@gmail.com>
+Signed-off-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+---
+ drivers/net/ethernet/broadcom/tg3.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -17801,8 +17801,10 @@ static int tg3_init_one(struct pci_dev *
+ 	} else
+ 		persist_dma_mask = dma_mask = DMA_BIT_MASK(64);
+ 
+-	if (tg3_asic_rev(tp) == ASIC_REV_57766)
++	if (tg3_asic_rev(tp) == ASIC_REV_57766) {
++		dma_mask = DMA_BIT_MASK(32);
+ 		persist_dma_mask = DMA_BIT_MASK(31);
++	}
+ 
+ 	/* Configure DMA attributes. */
+ 	if (dma_mask > DMA_BIT_MASK(32)) {
diff --git a/6.12/target/linux/generic/pending-6.12/800-bcma-get-SoC-device-struct-copy-its-DMA-params-to-th.patch b/6.12/target/linux/generic/pending-6.12/800-bcma-get-SoC-device-struct-copy-its-DMA-params-to-th.patch
new file mode 100644
index 00000000..4a9c188d
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/800-bcma-get-SoC-device-struct-copy-its-DMA-params-to-th.patch
@@ -0,0 +1,73 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Subject: [PATCH] bcma: get SoC device struct & copy its DMA params to the
+ subdevices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+For bus devices to be fully usable it's required to set their DMA
+parameters.
+
+For years it has been missing and remained unnoticed because of
+mips_dma_alloc_coherent() silently handling the empty coherent_dma_mask.
+Kernel 4.19 came with a lot of DMA changes and caused a regression on
+the bcm47xx. Starting with the commit f8c55dc6e828 ("MIPS: use generic
+dma noncoherent ops for simple noncoherent platforms") DMA coherent
+allocations just fail. Example:
+[    1.114914] bgmac_bcma bcma0:2: Allocation of TX ring 0x200 failed
+[    1.121215] bgmac_bcma bcma0:2: Unable to alloc memory for DMA
+[    1.127626] bgmac_bcma: probe of bcma0:2 failed with error -12
+[    1.133838] bgmac_bcma: Broadcom 47xx GBit MAC driver loaded
+
+This change fixes above regression in addition to the MIPS bcm47xx
+commit 321c46b91550 ("MIPS: BCM47XX: Setup struct device for the SoC").
+
+It also fixes another *old* GPIO regression caused by a parent pointing
+to the NULL:
+[    0.157054] missing gpiochip .dev parent pointer
+[    0.157287] bcma: bus0: Error registering GPIO driver: -22
+introduced by the commit 74f4e0cc6108 ("bcma: switch GPIO portions to
+use GPIOLIB_IRQCHIP").
+
+Fixes: f8c55dc6e828 ("MIPS: use generic dma noncoherent ops for simple noncoherent platforms")
+Fixes: 74f4e0cc6108 ("bcma: switch GPIO portions to use GPIOLIB_IRQCHIP")
+Cc: linux-mips@linux-mips.org
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+
+--- a/drivers/bcma/host_soc.c
++++ b/drivers/bcma/host_soc.c
+@@ -191,6 +191,8 @@ int __init bcma_host_soc_init(struct bcm
+ 	struct bcma_bus *bus = &soc->bus;
+ 	int err;
+ 
++	bus->dev = soc->dev;
++
+ 	/* Scan bus and initialize it */
+ 	err = bcma_bus_early_register(bus);
+ 	if (err)
+--- a/drivers/bcma/main.c
++++ b/drivers/bcma/main.c
+@@ -237,13 +237,17 @@ EXPORT_SYMBOL(bcma_core_irq);
+ 
+ void bcma_prepare_core(struct bcma_bus *bus, struct bcma_device *core)
+ {
+-	device_initialize(&core->dev);
++	struct device *dev = &core->dev;
++
++	device_initialize(dev);
+ 	core->dev.release = bcma_release_core_dev;
+ 	core->dev.bus = &bcma_bus_type;
+-	dev_set_name(&core->dev, "bcma%d:%d", bus->num, core->core_index);
++	dev_set_name(dev, "bcma%d:%d", bus->num, core->core_index);
+ 	core->dev.parent = bus->dev;
+-	if (bus->dev)
++	if (bus->dev) {
+ 		bcma_of_fill_device(bus->dev, core);
++		dma_coerce_mask_and_coherent(dev, bus->dev->coherent_dma_mask);
++	}
+ 
+ 	switch (bus->hosttype) {
+ 	case BCMA_HOSTTYPE_PCI:
diff --git a/6.12/target/linux/generic/pending-6.12/801-gpio-gpio-cascade-add-generic-GPIO-cascade.patch b/6.12/target/linux/generic/pending-6.12/801-gpio-gpio-cascade-add-generic-GPIO-cascade.patch
new file mode 100644
index 00000000..e3b37eec
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/801-gpio-gpio-cascade-add-generic-GPIO-cascade.patch
@@ -0,0 +1,217 @@
+From fc23ea48ba52c24f201fe5ca0132ee1a3de5a70a Mon Sep 17 00:00:00 2001
+From: Mauri Sandberg <maukka@ext.kapsi.fi>
+Date: Thu, 25 Mar 2021 11:48:05 +0200
+Subject: [PATCH 2/2] gpio: gpio-cascade: add generic GPIO cascade
+
+Adds support for building cascades of GPIO lines. That is, it allows
+setups when there is one upstream line and multiple cascaded lines, out
+of which one can be chosen at a time. The status of the upstream line
+can be conveyed to the selected cascaded line or, vice versa, the status
+of the cascaded line can be conveyed to the upstream line.
+
+A multiplexer is being used to select, which cascaded GPIO line is being
+used at any given time.
+
+At the moment only input direction is supported. In future it should be
+possible to add support for output direction, too.
+
+Signed-off-by: Mauri Sandberg <maukka@ext.kapsi.fi>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+---
+v7 -> v8:
+ - rearrange members in struct gpio_cascade
+ - cosmetic changes in file header and in one function declaration
+ - added Reviewed-by tags by Linus and Andy
+v6 -> v7:
+ - In Kconfig add info about module name
+ - adhere to new convention that allows lines longer than 80 chars
+ - use dev_probe_err with upstream gpio line too
+ - refactor for cleaner exit of probe function.
+v5 -> v6:
+ - In Kconfig, remove dependency to OF_GPIO and select only MULTIPLEXER
+ - refactor code preferring one-liners
+ - clean up prints, removing them from success-path.
+ - don't explicitly set gpio_chip.of_node as it's done in the GPIO library
+ - use devm_gpiochip_add_data instead of gpiochip_add
+v4 -> v5:
+ - renamed gpio-mux-input -> gpio-cascade. refactored code accordingly
+   here and there and changed to use new bindings and compatible string
+   - ambigious and vague 'pin' was rename to 'upstream_line'
+ - dropped Tested-by and Reviewed-by due to changes in bindings
+ - dropped Reported-by suggested by an automatic bot as it was not really
+   appropriate to begin with
+ - functionally it's the same as v4
+v3 -> v4:
+ - Changed author email
+ - Included Tested-by and Reviewed-by from Drew
+v2 -> v3:
+ - use managed device resources
+ - update Kconfig description
+v1 -> v2:
+ - removed .owner from platform_driver as per test bot's instruction
+ - added MODULE_AUTHOR, MODULE_DESCRIPTION, MODULE_LICENSE
+ - added gpio_mux_input_get_direction as it's recommended for all chips
+ - removed because this is input only chip: gpio_mux_input_set_value
+ - removed because they are not needed for input/output only chips:
+     gpio_mux_input_direction_input
+     gpio_mux_input_direction_output
+ - fixed typo in an error message
+ - added info message about successful registration
+ - removed can_sleep flag as this does not sleep while getting GPIO value
+   like I2C or SPI do
+ - Updated description in Kconfig
+---
+ drivers/gpio/Kconfig        |  15 +++++
+ drivers/gpio/Makefile       |   1 +
+ drivers/gpio/gpio-cascade.c | 117 ++++++++++++++++++++++++++++++++++++
+ 3 files changed, 133 insertions(+)
+ create mode 100644 drivers/gpio/gpio-cascade.c
+
+--- a/drivers/gpio/Kconfig
++++ b/drivers/gpio/Kconfig
+@@ -1929,4 +1929,19 @@ config GPIO_VIRTUSER
+ 
+ endmenu
+ 
++comment "Other GPIO expanders"
++
++config GPIO_CASCADE
++	tristate "General GPIO cascade"
++	select MULTIPLEXER
++	help
++	  Say yes here to enable support for generic GPIO cascade.
++
++	  This allows building one-to-many cascades of GPIO lines using
++	  different types of multiplexers readily available. At the
++	  moment only input lines are supported.
++
++	  To build the driver as a module choose 'm' and the resulting module
++	  will be called 'gpio-cascade'.
++
+ endif
+--- a/drivers/gpio/Makefile
++++ b/drivers/gpio/Makefile
+@@ -45,6 +45,7 @@ obj-$(CONFIG_GPIO_BD9571MWV)		+= gpio-bd
+ obj-$(CONFIG_GPIO_BRCMSTB)		+= gpio-brcmstb.o
+ obj-$(CONFIG_GPIO_BT8XX)		+= gpio-bt8xx.o
+ obj-$(CONFIG_GPIO_CADENCE)		+= gpio-cadence.o
++obj-$(CONFIG_GPIO_CASCADE)		+= gpio-cascade.o
+ obj-$(CONFIG_GPIO_CLPS711X)		+= gpio-clps711x.o
+ obj-$(CONFIG_GPIO_SNPS_CREG)		+= gpio-creg-snps.o
+ obj-$(CONFIG_GPIO_CROS_EC)		+= gpio-cros-ec.o
+--- /dev/null
++++ b/drivers/gpio/gpio-cascade.c
+@@ -0,0 +1,112 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ *  A generic GPIO cascade driver
++ *
++ *  Copyright (C) 2021 Mauri Sandberg <maukka@ext.kapsi.fi>
++ *
++ * This allows building cascades of GPIO lines in a manner illustrated
++ * below:
++ *
++ *                 /|---- Cascaded GPIO line 0
++ *  Upstream      | |---- Cascaded GPIO line 1
++ *  GPIO line ----+ | .
++ *                | | .
++ *                 \|---- Cascaded GPIO line n
++ *
++ * A multiplexer is being used to select, which cascaded line is being
++ * addressed at any given time.
++ *
++ * At the moment only input mode is supported due to lack of means for
++ * testing output functionality. At least theoretically output should be
++ * possible with open drain constructions.
++ */
++
++#include <linux/module.h>
++#include <linux/slab.h>
++#include <linux/platform_device.h>
++#include <linux/mux/consumer.h>
++
++#include <linux/gpio/consumer.h>
++#include <linux/gpio/driver.h>
++
++struct gpio_cascade {
++	struct gpio_chip	gpio_chip;
++	struct device		*parent;
++	struct mux_control	*mux_control;
++	struct gpio_desc	*upstream_line;
++};
++
++static int gpio_cascade_get_direction(struct gpio_chip *gc, unsigned int offset)
++{
++	return GPIO_LINE_DIRECTION_IN;
++}
++
++static int gpio_cascade_get_value(struct gpio_chip *gc, unsigned int offset)
++{
++	struct gpio_cascade *cas = gpiochip_get_data(gc);
++	int ret;
++
++	ret = mux_control_select(cas->mux_control, offset);
++	if (ret)
++		return ret;
++
++	ret = gpiod_get_value(cas->upstream_line);
++	mux_control_deselect(cas->mux_control);
++	return ret;
++}
++
++static int gpio_cascade_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct gpio_cascade *cas;
++	struct mux_control *mc;
++	struct gpio_desc *upstream;
++	struct gpio_chip *gc;
++
++	cas = devm_kzalloc(dev, sizeof(*cas), GFP_KERNEL);
++	if (!cas)
++		return -ENOMEM;
++
++	mc = devm_mux_control_get(dev, NULL);
++	if (IS_ERR(mc))
++		return dev_err_probe(dev, PTR_ERR(mc), "unable to get mux-control\n");
++
++	cas->mux_control = mc;
++	upstream = devm_gpiod_get(dev, "upstream",  GPIOD_IN);
++	if (IS_ERR(upstream))
++		return dev_err_probe(dev, PTR_ERR(upstream), "unable to claim upstream GPIO line\n");
++
++	cas->upstream_line = upstream;
++	cas->parent = dev;
++
++	gc = &cas->gpio_chip;
++	gc->get = gpio_cascade_get_value;
++	gc->get_direction = gpio_cascade_get_direction;
++	gc->base = -1;
++	gc->ngpio = mux_control_states(mc);
++	gc->label = dev_name(cas->parent);
++	gc->parent = cas->parent;
++	gc->owner = THIS_MODULE;
++
++	platform_set_drvdata(pdev, cas);
++	return devm_gpiochip_add_data(dev, &cas->gpio_chip, cas);
++}
++
++static const struct of_device_id gpio_cascade_id[] = {
++	{ .compatible = "gpio-cascade" },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, gpio_cascade_id);
++
++static struct platform_driver gpio_cascade_driver = {
++	.driver	= {
++		.name		= "gpio-cascade",
++		.of_match_table = gpio_cascade_id,
++	},
++	.probe	= gpio_cascade_probe,
++};
++module_platform_driver(gpio_cascade_driver);
++
++MODULE_AUTHOR("Mauri Sandberg <maukka@ext.kapsi.fi>");
++MODULE_DESCRIPTION("Generic GPIO cascade");
++MODULE_LICENSE("GPL");
diff --git a/6.12/target/linux/generic/pending-6.12/802-OPP-Provide-old-opp-to-config_clks-on-_set_opp.patch b/6.12/target/linux/generic/pending-6.12/802-OPP-Provide-old-opp-to-config_clks-on-_set_opp.patch
new file mode 100644
index 00000000..395fba2b
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/802-OPP-Provide-old-opp-to-config_clks-on-_set_opp.patch
@@ -0,0 +1,108 @@
+From fd59b838dd90452f61a17dc9e5ff175205003068 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 15 Sep 2022 18:49:43 +0200
+Subject: [PATCH] OPP: Provide old opp to config_clks on _set_opp
+
+With the target opp, also pass the old opp to config_clks function.
+This can be useful when a driver needs to take decision on what fequency
+to set based on what is the current frequency without using a
+clk_get_freq call.
+Update the only user of custom config_clks (tegra30 devfreq driver) to
+this new implementation.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/devfreq/tegra30-devfreq.c |  5 +++--
+ drivers/opp/core.c                | 11 ++++++-----
+ include/linux/pm_opp.h            | 11 ++++++-----
+ 3 files changed, 15 insertions(+), 12 deletions(-)
+
+--- a/drivers/devfreq/tegra30-devfreq.c
++++ b/drivers/devfreq/tegra30-devfreq.c
+@@ -823,8 +823,9 @@ static int devm_tegra_devfreq_init_hw(st
+ 
+ static int tegra_devfreq_config_clks_nop(struct device *dev,
+ 					 struct opp_table *opp_table,
+-					 struct dev_pm_opp *opp, void *data,
+-					 bool scaling_down)
++					 struct dev_pm_opp *old_opp,
++					 struct dev_pm_opp *opp,
++					 void *data, bool scaling_down)
+ {
+ 	/* We want to skip clk configuration via dev_pm_opp_set_opp() */
+ 	return 0;
+--- a/drivers/opp/core.c
++++ b/drivers/opp/core.c
+@@ -942,7 +942,8 @@ static int _set_opp_voltage(struct devic
+ 
+ static int
+ _opp_config_clk_single(struct device *dev, struct opp_table *opp_table,
+-		       struct dev_pm_opp *opp, void *data, bool scaling_down)
++		       struct dev_pm_opp *old_opp, struct dev_pm_opp *opp,
++		       void *data, bool scaling_down)
+ {
+ 	unsigned long *target = data;
+ 	unsigned long freq;
+@@ -974,8 +975,8 @@ _opp_config_clk_single(struct device *de
+  * the order in which they are present in the array while scaling up.
+  */
+ int dev_pm_opp_config_clks_simple(struct device *dev,
+-		struct opp_table *opp_table, struct dev_pm_opp *opp, void *data,
+-		bool scaling_down)
++		struct opp_table *opp_table, struct dev_pm_opp *old_opp,
++		struct dev_pm_opp *opp, void *data, bool scaling_down)
+ {
+ 	int ret, i;
+ 
+@@ -1242,7 +1243,7 @@ static int _set_opp(struct device *dev,
+ 	}
+ 
+ 	if (opp_table->config_clks) {
+-		ret = opp_table->config_clks(dev, opp_table, opp, clk_data, scaling_down);
++		ret = opp_table->config_clks(dev, opp_table, old_opp, opp, clk_data, scaling_down);
+ 		if (ret)
+ 			return ret;
+ 	}
+@@ -1321,7 +1322,7 @@ int dev_pm_opp_set_rate(struct device *d
+ 		 * equivalent to a clk_set_rate()
+ 		 */
+ 		if (!_get_opp_count(opp_table)) {
+-			ret = opp_table->config_clks(dev, opp_table, NULL,
++			ret = opp_table->config_clks(dev, opp_table, NULL, NULL,
+ 						     &target_freq, false);
+ 			goto put_opp_table;
+ 		}
+--- a/include/linux/pm_opp.h
++++ b/include/linux/pm_opp.h
+@@ -50,7 +50,8 @@ typedef int (*config_regulators_t)(struc
+ 			struct dev_pm_opp *old_opp, struct dev_pm_opp *new_opp,
+ 			struct regulator **regulators, unsigned int count);
+ 
+-typedef int (*config_clks_t)(struct device *dev, struct opp_table *opp_table,
++typedef int (*config_clks_t)(struct device *dev,
++			struct opp_table *opp_table, struct dev_pm_opp *old_opp,
+ 			struct dev_pm_opp *opp, void *data, bool scaling_down);
+ 
+ /**
+@@ -184,8 +185,8 @@ int dev_pm_opp_set_config(struct device
+ int devm_pm_opp_set_config(struct device *dev, struct dev_pm_opp_config *config);
+ void dev_pm_opp_clear_config(int token);
+ int dev_pm_opp_config_clks_simple(struct device *dev,
+-		struct opp_table *opp_table, struct dev_pm_opp *opp, void *data,
+-		bool scaling_down);
++		struct opp_table *opp_table, struct dev_pm_opp *old_opp,
++		struct dev_pm_opp *opp, void *data, bool scaling_down);
+ 
+ struct dev_pm_opp *dev_pm_opp_xlate_required_opp(struct opp_table *src_table, struct opp_table *dst_table, struct dev_pm_opp *src_opp);
+ int dev_pm_opp_xlate_performance_state(struct opp_table *src_table, struct opp_table *dst_table, unsigned int pstate);
+@@ -395,8 +396,8 @@ static inline int devm_pm_opp_set_config
+ static inline void dev_pm_opp_clear_config(int token) {}
+ 
+ static inline int dev_pm_opp_config_clks_simple(struct device *dev,
+-		struct opp_table *opp_table, struct dev_pm_opp *opp, void *data,
+-		bool scaling_down)
++		struct opp_table *opp_table, struct dev_pm_opp *old_opp,
++		struct dev_pm_opp *opp, void *data, bool scaling_down)
+ {
+ 	return -EOPNOTSUPP;
+ }
diff --git a/6.12/target/linux/generic/pending-6.12/802-nvmem-u-boot-env-align-endianness-of-crc32-values.patch b/6.12/target/linux/generic/pending-6.12/802-nvmem-u-boot-env-align-endianness-of-crc32-values.patch
new file mode 100644
index 00000000..29fe668f
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/802-nvmem-u-boot-env-align-endianness-of-crc32-values.patch
@@ -0,0 +1,45 @@
+From 0e71cac033bb7689c4dfa2e6814191337ef770f5 Mon Sep 17 00:00:00 2001
+From: INAGAKI Hiroshi <musashino.open@gmail.com>
+Date: Thu, 13 Oct 2022 00:51:33 +0900
+Subject: [PATCH] nvmem: layouts: u-boot-env: align endianness of crc32 values
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This patch fixes crc32 error on Big-Endianness system by conversion of
+calculated crc32 value.
+
+Little-Endianness system:
+
+  obtained crc32: Little
+calculated crc32: Little
+
+Big-Endianness system:
+
+  obtained crc32: Little
+calculated crc32: Big
+
+log (APRESIA ApresiaLightGS120GT-SS, RTL8382M, Big-Endianness):
+
+[    8.570000] u_boot_env 18001200.spi:flash@0:partitions:partition@c0000: Invalid calculated CRC32: 0x88cd6f09 (expected: 0x096fcd88)
+[    8.580000] u_boot_env: probe of 18001200.spi:flash@0:partitions:partition@c0000 failed with error -22
+
+Fixes: f955dc1445069 ("nvmem: add driver handling U-Boot environment variables")
+
+Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
+Acked-by: Rafał Miłecki <rafal@milecki.pl>
+Tested-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+---
+
+--- a/drivers/nvmem/layouts/u-boot-env.c
++++ b/drivers/nvmem/layouts/u-boot-env.c
+@@ -148,7 +148,7 @@ int u_boot_env_parse(struct device *dev,
+ 	crc32_data_len = dev_size - crc32_data_offset;
+ 	data_len = dev_size - data_offset;
+ 
+-	calc = crc32(~0, buf + crc32_data_offset, crc32_data_len) ^ ~0L;
++	calc = le32_to_cpu((__le32)crc32(~0, buf + crc32_data_offset, crc32_data_len) ^ ~0L);
+ 	if (calc != crc32) {
+ 		dev_err(dev, "Invalid calculated CRC32: 0x%08x (expected: 0x%08x)\n", calc, crc32);
+ 		err = -EINVAL;
diff --git a/6.12/target/linux/generic/pending-6.12/804-nvmem-core-support-mac-base-fixed-layout-cells.patch b/6.12/target/linux/generic/pending-6.12/804-nvmem-core-support-mac-base-fixed-layout-cells.patch
new file mode 100644
index 00000000..446099a2
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/804-nvmem-core-support-mac-base-fixed-layout-cells.patch
@@ -0,0 +1,124 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 13 Jul 2023 18:29:19 +0200
+Subject: [PATCH] nvmem: core: support "mac-base" fixed layout cells
+
+Fixed layout binding allows specifying "mac-base" NVMEM cells. It's used
+for base MAC address (that can be used for calculating relative
+addresses). It can be stored in a raw binary format or as an ASCII
+string.
+---
+
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -2,6 +2,7 @@
+ menuconfig NVMEM
+ 	bool "NVMEM Support"
+ 	imply NVMEM_LAYOUTS
++	select GENERIC_NET_UTILS
+ 	help
+ 	  Support for NVMEM(Non Volatile Memory) devices like EEPROM, EFUSES...
+ 
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -7,9 +7,12 @@
+  */
+ 
+ #include <linux/device.h>
++#include <linux/ctype.h>
++#include <linux/etherdevice.h>
+ #include <linux/export.h>
+ #include <linux/fs.h>
+ #include <linux/idr.h>
++#include <linux/if_ether.h>
+ #include <linux/init.h>
+ #include <linux/kref.h>
+ #include <linux/module.h>
+@@ -797,6 +800,62 @@ static int nvmem_validate_keepouts(struc
+ 	return 0;
+ }
+ 
++static int nvmem_mac_base_raw_read(void *context, const char *id, int index, unsigned int offset,
++				   void *buf, size_t bytes)
++{
++	if (WARN_ON(bytes != ETH_ALEN))
++		return -EINVAL;
++
++	if (index)
++		eth_addr_add(buf, index);
++
++	return 0;
++}
++
++static int nvmem_mac_base_ascii_read(void *context, const char *id, int index, unsigned int offset,
++				     void *buf, size_t bytes)
++{
++	u8 mac[ETH_ALEN];
++
++	if (WARN_ON(bytes != 3 * ETH_ALEN - 1))
++		return -EINVAL;
++
++	if (!mac_pton(buf, mac))
++		return -EINVAL;
++
++	if (index)
++		eth_addr_add(mac, index);
++
++	ether_addr_copy(buf, mac);
++
++	return 0;
++}
++
++static int nvmem_mac_base_hex_read(void *context, const char *id, int index, unsigned int offset,
++				   void *buf, size_t bytes)
++{
++	u8 mac[ETH_ALEN], *hexstr;
++	int i;
++
++	if (WARN_ON(bytes != 2 * ETH_ALEN))
++		return -EINVAL;
++
++	hexstr = (u8 *)buf;
++	for (i = 0; i < ETH_ALEN; i++) {
++		if (!isxdigit(hexstr[i * 2]) || !isxdigit(hexstr[i * 2 + 1]))
++			return -EINVAL;
++
++		mac[i] = (hex_to_bin(hexstr[i * 2]) << 4) | hex_to_bin(hexstr[i * 2 + 1]);
++	}
++
++	if (index)
++		eth_addr_add(mac, index);
++
++	ether_addr_copy(buf, mac);
++
++	return 0;
++}
++
+ static int nvmem_add_cells_from_dt(struct nvmem_device *nvmem, struct device_node *np)
+ {
+ 	struct device *dev = &nvmem->dev;
+@@ -836,6 +895,25 @@ static int nvmem_add_cells_from_dt(struc
+ 		if (nvmem->fixup_dt_cell_info)
+ 			nvmem->fixup_dt_cell_info(nvmem, &info);
+ 
++		if (of_device_is_compatible(np, "fixed-layout")) {
++			if (of_device_is_compatible(child, "mac-base")) {
++				if (info.bytes == ETH_ALEN) {
++					info.raw_len = info.bytes;
++					info.bytes = ETH_ALEN;
++					info.read_post_process = nvmem_mac_base_raw_read;
++				} else if (info.bytes == 2 * ETH_ALEN) {
++					info.raw_len = info.bytes;
++					info.bytes = ETH_ALEN;
++					info.read_post_process = nvmem_mac_base_hex_read;
++				} else if (info.bytes == 3 * ETH_ALEN - 1) {
++					info.raw_len = info.bytes;
++					info.bytes = ETH_ALEN;
++					info.read_post_process = nvmem_mac_base_ascii_read;
++				}
++
++			}
++		}
++
+ 		ret = nvmem_add_one_cell(nvmem, &info);
+ 		kfree(info.name);
+ 		if (ret) {
diff --git a/6.12/target/linux/generic/pending-6.12/809-01-nvmem-core-generalize-mac-base-cells-handling.patch b/6.12/target/linux/generic/pending-6.12/809-01-nvmem-core-generalize-mac-base-cells-handling.patch
new file mode 100644
index 00000000..139a925c
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/809-01-nvmem-core-generalize-mac-base-cells-handling.patch
@@ -0,0 +1,248 @@
+From fd0e523037439520813db7c57df5bd37cdf40f7e Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 3 Feb 2025 00:10:18 +0100
+Subject: [PATCH 1/2] nvmem: core: generalize "mac-base" cells handling
+
+Generalize support of "mac-base" nvmem cells and provide a GPL symbol to
+permit also other NVMEM layout driver to parse mac-base cells.
+
+It's VERY COMMON for some specially formatted NVMEM to expose a mac
+address in ASCII format or HEX format hence prevent code duplication by
+exposing a common helper.
+
+Such helper will change the nvmem_info_cell and apply the correct post
+process function to correctly parse the mac address.
+
+Since the API requires OF and is only related to layout, move the
+function in layouts.c to correctly handle non-OF NVMEM.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/nvmem/core.c           | 79 +--------------------------------
+ drivers/nvmem/layouts.c        | 80 ++++++++++++++++++++++++++++++++++
+ include/linux/nvmem-provider.h |  4 ++
+ 3 files changed, 86 insertions(+), 77 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -7,12 +7,9 @@
+  */
+ 
+ #include <linux/device.h>
+-#include <linux/ctype.h>
+-#include <linux/etherdevice.h>
+ #include <linux/export.h>
+ #include <linux/fs.h>
+ #include <linux/idr.h>
+-#include <linux/if_ether.h>
+ #include <linux/init.h>
+ #include <linux/kref.h>
+ #include <linux/module.h>
+@@ -800,62 +797,6 @@ static int nvmem_validate_keepouts(struc
+ 	return 0;
+ }
+ 
+-static int nvmem_mac_base_raw_read(void *context, const char *id, int index, unsigned int offset,
+-				   void *buf, size_t bytes)
+-{
+-	if (WARN_ON(bytes != ETH_ALEN))
+-		return -EINVAL;
+-
+-	if (index)
+-		eth_addr_add(buf, index);
+-
+-	return 0;
+-}
+-
+-static int nvmem_mac_base_ascii_read(void *context, const char *id, int index, unsigned int offset,
+-				     void *buf, size_t bytes)
+-{
+-	u8 mac[ETH_ALEN];
+-
+-	if (WARN_ON(bytes != 3 * ETH_ALEN - 1))
+-		return -EINVAL;
+-
+-	if (!mac_pton(buf, mac))
+-		return -EINVAL;
+-
+-	if (index)
+-		eth_addr_add(mac, index);
+-
+-	ether_addr_copy(buf, mac);
+-
+-	return 0;
+-}
+-
+-static int nvmem_mac_base_hex_read(void *context, const char *id, int index, unsigned int offset,
+-				   void *buf, size_t bytes)
+-{
+-	u8 mac[ETH_ALEN], *hexstr;
+-	int i;
+-
+-	if (WARN_ON(bytes != 2 * ETH_ALEN))
+-		return -EINVAL;
+-
+-	hexstr = (u8 *)buf;
+-	for (i = 0; i < ETH_ALEN; i++) {
+-		if (!isxdigit(hexstr[i * 2]) || !isxdigit(hexstr[i * 2 + 1]))
+-			return -EINVAL;
+-
+-		mac[i] = (hex_to_bin(hexstr[i * 2]) << 4) | hex_to_bin(hexstr[i * 2 + 1]);
+-	}
+-
+-	if (index)
+-		eth_addr_add(mac, index);
+-
+-	ether_addr_copy(buf, mac);
+-
+-	return 0;
+-}
+-
+ static int nvmem_add_cells_from_dt(struct nvmem_device *nvmem, struct device_node *np)
+ {
+ 	struct device *dev = &nvmem->dev;
+@@ -895,24 +836,8 @@ static int nvmem_add_cells_from_dt(struc
+ 		if (nvmem->fixup_dt_cell_info)
+ 			nvmem->fixup_dt_cell_info(nvmem, &info);
+ 
+-		if (of_device_is_compatible(np, "fixed-layout")) {
+-			if (of_device_is_compatible(child, "mac-base")) {
+-				if (info.bytes == ETH_ALEN) {
+-					info.raw_len = info.bytes;
+-					info.bytes = ETH_ALEN;
+-					info.read_post_process = nvmem_mac_base_raw_read;
+-				} else if (info.bytes == 2 * ETH_ALEN) {
+-					info.raw_len = info.bytes;
+-					info.bytes = ETH_ALEN;
+-					info.read_post_process = nvmem_mac_base_hex_read;
+-				} else if (info.bytes == 3 * ETH_ALEN - 1) {
+-					info.raw_len = info.bytes;
+-					info.bytes = ETH_ALEN;
+-					info.read_post_process = nvmem_mac_base_ascii_read;
+-				}
+-
+-			}
+-		}
++		if (of_device_is_compatible(np, "fixed-layout"))
++			nvmem_layout_parse_mac_base(&info);
+ 
+ 		ret = nvmem_add_one_cell(nvmem, &info);
+ 		kfree(info.name);
+--- a/drivers/nvmem/layouts.c
++++ b/drivers/nvmem/layouts.c
+@@ -6,8 +6,11 @@
+  * Author: Miquel Raynal <miquel.raynal@bootlin.com
+  */
+ 
++#include <linux/ctype.h>
+ #include <linux/device.h>
+ #include <linux/dma-mapping.h>
++#include <linux/etherdevice.h>
++#include <linux/if_ether.h>
+ #include <linux/nvmem-consumer.h>
+ #include <linux/nvmem-provider.h>
+ #include <linux/of.h>
+@@ -21,6 +24,83 @@
+ #define to_nvmem_layout_device(_dev) \
+ 	container_of((_dev), struct nvmem_layout, dev)
+ 
++static int nvmem_mac_base_raw_read(void *context, const char *id, int index, unsigned int offset,
++				   void *buf, size_t bytes)
++{
++	if (WARN_ON(bytes != ETH_ALEN))
++		return -EINVAL;
++
++	if (index)
++		eth_addr_add(buf, index);
++
++	return 0;
++}
++
++static int nvmem_mac_base_ascii_read(void *context, const char *id, int index, unsigned int offset,
++				     void *buf, size_t bytes)
++{
++	u8 mac[ETH_ALEN];
++
++	if (WARN_ON(bytes != 3 * ETH_ALEN - 1))
++		return -EINVAL;
++
++	if (!mac_pton(buf, mac))
++		return -EINVAL;
++
++	if (index)
++		eth_addr_add(mac, index);
++
++	ether_addr_copy(buf, mac);
++
++	return 0;
++}
++
++static int nvmem_mac_base_hex_read(void *context, const char *id, int index, unsigned int offset,
++				   void *buf, size_t bytes)
++{
++	u8 mac[ETH_ALEN], *hexstr;
++	int i;
++
++	if (WARN_ON(bytes != 2 * ETH_ALEN))
++		return -EINVAL;
++
++	hexstr = (u8 *)buf;
++	for (i = 0; i < ETH_ALEN; i++) {
++		if (!isxdigit(hexstr[i * 2]) || !isxdigit(hexstr[i * 2 + 1]))
++			return -EINVAL;
++
++		mac[i] = (hex_to_bin(hexstr[i * 2]) << 4) | hex_to_bin(hexstr[i * 2 + 1]);
++	}
++
++	if (index)
++		eth_addr_add(mac, index);
++
++	ether_addr_copy(buf, mac);
++
++	return 0;
++}
++
++void nvmem_layout_parse_mac_base(struct nvmem_cell_info *info)
++{
++	if (!of_device_is_compatible(info->np, "mac-base"))
++		return;
++
++	if (info->bytes == ETH_ALEN) {
++		info->raw_len = info->bytes;
++		info->bytes = ETH_ALEN;
++		info->read_post_process = nvmem_mac_base_raw_read;
++	} else if (info->bytes == 2 * ETH_ALEN) {
++		info->raw_len = info->bytes;
++		info->bytes = ETH_ALEN;
++		info->read_post_process = nvmem_mac_base_hex_read;
++	} else if (info->bytes == 3 * ETH_ALEN - 1) {
++		info->raw_len = info->bytes;
++		info->bytes = ETH_ALEN;
++		info->read_post_process = nvmem_mac_base_ascii_read;
++	}
++}
++EXPORT_SYMBOL_GPL(nvmem_layout_parse_mac_base);
++
+ static int nvmem_layout_bus_match(struct device *dev, const struct device_driver *drv)
+ {
+ 	return of_driver_match_device(dev, drv);
+--- a/include/linux/nvmem-provider.h
++++ b/include/linux/nvmem-provider.h
+@@ -242,6 +242,8 @@ static inline void nvmem_layout_unregist
+ 
+ #if IS_ENABLED(CONFIG_NVMEM) && IS_ENABLED(CONFIG_OF)
+ 
++void nvmem_layout_parse_mac_base(struct nvmem_cell_info *info);
++
+ /**
+  * of_nvmem_layout_get_container() - Get OF node of layout container
+  *
+@@ -254,6 +256,8 @@ struct device_node *of_nvmem_layout_get_
+ 
+ #else  /* CONFIG_NVMEM && CONFIG_OF */
+ 
++static inline void nvmem_layout_parse_mac_base(struct nvmem_cell_info *info) {}
++
+ static inline struct device_node *of_nvmem_layout_get_container(struct nvmem_device *nvmem)
+ {
+ 	return NULL;
diff --git a/6.12/target/linux/generic/pending-6.12/809-02-nvmem-layouts-add-support-for-ascii-env-driver.patch b/6.12/target/linux/generic/pending-6.12/809-02-nvmem-layouts-add-support-for-ascii-env-driver.patch
new file mode 100644
index 00000000..0906e0f7
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/809-02-nvmem-layouts-add-support-for-ascii-env-driver.patch
@@ -0,0 +1,204 @@
+From 38287e8ec5c0281377fc70f11f20bcd9986a05f5 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 3 Feb 2025 00:36:12 +0100
+Subject: [PATCH 2/2] nvmem: layouts: add support for ascii-env driver
+
+Add support for simple ASCII envirorment driver for NVMEM layouts.
+
+It's very common for devices to store simple text file format in
+partition for environment varibles. The most common pattern is variable
+name, a delimiter and variable value all separated by a new line
+character (\n).
+
+This driver adds support for exporting such data and expose NVMEM cells
+so they can be referenced by other drivers. This driver also supports
+parsing mac-base NVMEM cells to parse ASCII or HEX mac address.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/nvmem/layouts/Kconfig     |  13 +++
+ drivers/nvmem/layouts/Makefile    |   1 +
+ drivers/nvmem/layouts/ascii-env.c | 140 ++++++++++++++++++++++++++++++
+ 3 files changed, 154 insertions(+)
+ create mode 100644 drivers/nvmem/layouts/ascii-env.c
+
+--- a/drivers/nvmem/layouts/Kconfig
++++ b/drivers/nvmem/layouts/Kconfig
+@@ -37,6 +37,19 @@ config NVMEM_LAYOUT_U_BOOT_ENV
+ 
+ 	  If unsure, say N.
+ 
++config NVMEM_LAYOUT_ASCII_ENV
++	tristate "ASCII environment variables layout"
++	help
++	  It's very common for devices to store simple text file format in
++	  partition for environment varibles. The most common pattern is variable
++	  name, a delimiter and variable value all separated by a new line
++	  character (\n).
++	  This driver adds support for exporting such data and expose NVMEM cells
++	  so they can be referenced by other drivers. This driver also supports
++	  parsing mac-base NVMEM cells to parse ASCII or HEX mac address.
++
++	  If unsure, say N.
++
+ endmenu
+ 
+ endif
+--- a/drivers/nvmem/layouts/Makefile
++++ b/drivers/nvmem/layouts/Makefile
+@@ -6,3 +6,4 @@
+ obj-$(CONFIG_NVMEM_LAYOUT_SL28_VPD) += sl28vpd.o
+ obj-$(CONFIG_NVMEM_LAYOUT_ONIE_TLV) += onie-tlv.o
+ obj-$(CONFIG_NVMEM_LAYOUT_U_BOOT_ENV) += u-boot-env.o
++obj-$(CONFIG_NVMEM_LAYOUT_ASCII_ENV) += ascii-env.o
+--- /dev/null
++++ b/drivers/nvmem/layouts/ascii-env.c
+@@ -0,0 +1,148 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * Copyright (C) 2024 Christian Marangi <ansuelsmth@gmail.com>
++ *
++ * This borrow some parse logic from u-boot-env.
++ */
++#include <linux/nvmem-consumer.h>
++#include <linux/nvmem-provider.h>
++#include <linux/of.h>
++#include <linux/slab.h>
++
++struct ascii_env_match_data {
++	const char delim;
++};
++
++/*
++ * Parse a buffer as an ASCII text with name delimiter value and each pattern separated
++ * with a new line char '\n'
++ * Example: (delimiter '=')
++ *   name=value\nname2=value2\n
++ *   2 Cell:
++ *   - name: value
++ *   - name2: value2
++ */
++static int ascii_env_parse_cells(struct device *dev, struct nvmem_device *nvmem, uint8_t *buf,
++				 size_t data_len, const char delim)
++{
++	char *var, *value, *eq, *lf;
++	char *data = buf;
++
++	/*
++	 * Warning the inner loop take care of replacing '\n'
++	 * with '\0', hence we can use strlen on value.
++	 */
++	for (var = data; var < data + data_len && *var;
++	     var = value + strlen(value) + 1) {
++		struct nvmem_cell_info info = {};
++		struct device_node *child;
++		const char *label;
++
++		eq = strchr(var, delim);
++		if (!eq)
++			break;
++		*eq = '\0';
++		value = eq + 1;
++
++		/* Replace '\n' with '\0' to use strlen for value */
++		lf = strchr(value, '\n');
++		if (!lf)
++			break;
++		*lf = '\0';
++
++		info.name = devm_kstrdup(dev, var, GFP_KERNEL);
++		if (!info.name)
++			return -ENOMEM;
++		info.offset = value - data;
++		info.bytes = strlen(value);
++		info.np = of_get_child_by_name(dev->of_node, info.name);
++		for_each_child_of_node(dev->of_node, child) {
++			if (!of_property_read_string(child, "label", &label) &&
++			    !strncmp(info.name, label, info.bytes))
++			    	info.np = child;
++			else if (of_node_name_eq(child, info.name))
++				info.np = child;
++		}
++
++		nvmem_layout_parse_mac_base(&info);
++
++		nvmem_add_one_cell(nvmem, &info);
++	}
++
++	return 0;
++}
++
++static int ascii_env_add_cells(struct nvmem_layout *layout)
++{
++	struct nvmem_device *nvmem = layout->nvmem;
++	const struct ascii_env_match_data *data;
++	struct device *dev = &layout->dev;
++	size_t dev_size;
++	uint8_t *buf;
++	int bytes;
++	int ret;
++
++	/* Get the delimiter for name value pattern */
++	data = device_get_match_data(dev);
++
++	dev_size = nvmem_dev_size(nvmem);
++
++	buf = kzalloc(dev_size, GFP_KERNEL);
++	if (!buf) {
++		ret = -ENOMEM;
++		goto err_out;
++	}
++
++	bytes = nvmem_device_read(nvmem, 0, dev_size, buf);
++	if (bytes < 0) {
++		ret = bytes;
++		goto err_kfree;
++	} else if (bytes != dev_size) {
++		ret = -EIO;
++		goto err_kfree;
++	}
++
++	buf[dev_size - 1] = '\0';
++	ret = ascii_env_parse_cells(dev, nvmem, buf, dev_size, data->delim);
++
++err_kfree:
++	kfree(buf);
++err_out:
++	return ret;
++}
++
++static int ascii_env_probe(struct nvmem_layout *layout)
++{
++	layout->add_cells = ascii_env_add_cells;
++
++	return nvmem_layout_register(layout);
++}
++
++static void ascii_env_remove(struct nvmem_layout *layout)
++{
++	nvmem_layout_unregister(layout);
++}
++
++static const struct ascii_env_match_data ascii_env_eq = {
++	.delim = '=',
++};
++
++static const struct of_device_id ascii_env_of_match_table[] = {
++	{ .compatible = "ascii-eq-delim-env", .data = &ascii_env_eq, },
++	{},
++};
++
++static struct nvmem_layout_driver ascii_env_layout = {
++	.driver = {
++		.name = "ascii-env-layout",
++		.of_match_table = ascii_env_of_match_table,
++	},
++	.probe = ascii_env_probe,
++	.remove = ascii_env_remove,
++};
++module_nvmem_layout_driver(ascii_env_layout);
++
++MODULE_AUTHOR("Christian Marangi <ansuelsmth@gmail.com>");
++MODULE_LICENSE("GPL");
++MODULE_DEVICE_TABLE(of, ascii_env_of_match_table);
++MODULE_DESCRIPTION("NVMEM layout driver for ASCII environment variables");
diff --git a/6.12/target/linux/generic/pending-6.12/810-pci_disable_common_quirks.patch b/6.12/target/linux/generic/pending-6.12/810-pci_disable_common_quirks.patch
new file mode 100644
index 00000000..55934833
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/810-pci_disable_common_quirks.patch
@@ -0,0 +1,62 @@
+From: Gabor Juhos <juhosg@openwrt.org>
+Subject: debloat: add kernel config option to disabling common PCI quirks
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/pci/Kconfig  | 6 ++++++
+ drivers/pci/quirks.c | 6 ++++++
+ 2 files changed, 12 insertions(+)
+
+--- a/drivers/pci/Kconfig
++++ b/drivers/pci/Kconfig
+@@ -118,6 +118,13 @@ config XEN_PCIDEV_FRONTEND
+ 	  The PCI device frontend driver allows the kernel to import arbitrary
+ 	  PCI devices from a PCI backend to support PCI driver domains.
+ 
++config PCI_DISABLE_COMMON_QUIRKS
++	bool "PCI disable common quirks"
++	depends on PCI
++	help
++	  If you don't know what to do here, say N.
++
++
+ config PCI_ATS
+ 	bool
+ 
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -313,6 +313,7 @@ static void quirk_mmio_always_on(struct
+ DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_ANY_ID, PCI_ANY_ID,
+ 				PCI_CLASS_BRIDGE_HOST, 8, quirk_mmio_always_on);
+ 
++#ifndef CONFIG_PCI_DISABLE_COMMON_QUIRKS
+ /*
+  * The Mellanox Tavor device gives false positive parity errors.  Disable
+  * parity error reporting.
+@@ -3508,6 +3509,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x65f9, quirk_intel_mc_errata);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x65fa, quirk_intel_mc_errata);
+ 
++#endif /* !CONFIG_PCI_DISABLE_COMMON_QUIRKS */
++
+ /*
+  * Ivytown NTB BAR sizes are misreported by the hardware due to an erratum.
+  * To work around this, query the size it should be configured to by the
+@@ -3533,6 +3536,8 @@ static void quirk_intel_ntb(struct pci_d
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x0e08, quirk_intel_ntb);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x0e0d, quirk_intel_ntb);
+ 
++#ifndef CONFIG_PCI_DISABLE_COMMON_QUIRKS
++
+ /*
+  * Some BIOS implementations leave the Intel GPU interrupts enabled, even
+  * though no one is handling them (e.g., if the i915 driver is never
+@@ -3571,6 +3576,8 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_IN
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x010a, disable_igfx_irq);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0152, disable_igfx_irq);
+ 
++#endif /* !CONFIG_PCI_DISABLE_COMMON_QUIRKS */
++
+ /*
+  * PCI devices which are on Intel chips can skip the 10ms delay
+  * before entering D3 mode.
diff --git a/6.12/target/linux/generic/pending-6.12/834-ledtrig-libata.patch b/6.12/target/linux/generic/pending-6.12/834-ledtrig-libata.patch
new file mode 100644
index 00000000..256de1f3
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/834-ledtrig-libata.patch
@@ -0,0 +1,145 @@
+From: Daniel Golle <daniel@makrotopia.org>
+Subject: libata: add ledtrig support
+
+This adds a LED trigger for each ATA port indicating disk activity.
+
+As this is needed only on specific platforms (NAS SoCs and such),
+these platforms should define ARCH_WANTS_LIBATA_LEDS if there
+are boards with LED(s) intended to indicate ATA disk activity and
+need the OS to take care of that.
+In that way, if not selected, LED trigger support not will be
+included in libata-core and both, codepaths and structures remain
+untouched.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/ata/Kconfig       | 16 ++++++++++++++++
+ drivers/ata/libata-core.c | 41 +++++++++++++++++++++++++++++++++++++++++
+ include/linux/libata.h    |  9 +++++++++
+ 3 files changed, 66 insertions(+)
+
+--- a/drivers/ata/Kconfig
++++ b/drivers/ata/Kconfig
+@@ -67,6 +67,22 @@ config ATA_FORCE
+ 
+ 	  If unsure, say Y.
+ 
++config ARCH_WANT_LIBATA_LEDS
++	bool
++
++config ATA_LEDS
++	bool "support ATA port LED triggers"
++	depends on ARCH_WANT_LIBATA_LEDS
++	select NEW_LEDS
++	select LEDS_CLASS
++	select LEDS_TRIGGERS
++	default y
++	help
++	  This option adds a LED trigger for each registered ATA port.
++	  It is used to drive disk activity leds connected via GPIO.
++
++	  If unsure, say N.
++
+ config ATA_ACPI
+ 	bool "ATA ACPI Support"
+ 	depends on ACPI
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -672,6 +672,17 @@ static inline void ata_set_tf_cdl(struct
+ 	qc->flags |= ATA_QCFLAG_HAS_CDL | ATA_QCFLAG_RESULT_TF;
+ }
+ 
++#ifdef CONFIG_ATA_LEDS
++#define LIBATA_BLINK_DELAY 20 /* ms */
++static inline void ata_led_act(struct ata_port *ap)
++{
++	if (unlikely(!ap->ledtrig))
++		return;
++
++	led_trigger_blink_oneshot(ap->ledtrig, LIBATA_BLINK_DELAY, LIBATA_BLINK_DELAY, 0);
++}
++#endif
++
+ /**
+  *	ata_build_rw_tf - Build ATA taskfile for given read/write request
+  *	@qc: Metadata associated with the taskfile to build
+@@ -4728,6 +4739,9 @@ void __ata_qc_complete(struct ata_queued
+ 		link->active_tag = ATA_TAG_POISON;
+ 		ap->nr_active_links--;
+ 	}
++#ifdef CONFIG_ATA_LEDS
++	ata_led_act(ap);
++#endif
+ 
+ 	/* clear exclusive status */
+ 	if (unlikely(qc->flags & ATA_QCFLAG_CLEAR_EXCL &&
+@@ -5450,6 +5464,9 @@ struct ata_port *ata_port_alloc(struct a
+ 	ap->stats.unhandled_irq = 1;
+ 	ap->stats.idle_irq = 1;
+ #endif
++#ifdef CONFIG_ATA_LEDS
++	ap->ledtrig = kzalloc(sizeof(struct led_trigger), GFP_KERNEL);
++#endif
+ 	ata_sff_port_init(ap);
+ 
+ 	return ap;
+@@ -5464,6 +5481,12 @@ void ata_port_free(struct ata_port *ap)
+ 	kfree(ap->pmp_link);
+ 	kfree(ap->slave_link);
+ 	ida_free(&ata_ida, ap->print_id);
++#ifdef CONFIG_ATA_LEDS
++	if (ap->ledtrig) {
++		led_trigger_unregister(ap->ledtrig);
++		kfree(ap->ledtrig);
++	};
++#endif
+ 	kfree(ap);
+ }
+ EXPORT_SYMBOL_GPL(ata_port_free);
+@@ -5868,7 +5891,23 @@ int ata_host_register(struct ata_host *h
+ 		WARN_ON(1);
+ 		return -EINVAL;
+ 	}
++#ifdef CONFIG_ATA_LEDS
++	for (i = 0; i < host->n_ports; i++) {
++		if (unlikely(!host->ports[i]->ledtrig))
++			continue;
+ 
++		snprintf(host->ports[i]->ledtrig_name,
++			sizeof(host->ports[i]->ledtrig_name), "ata%u",
++			host->ports[i]->print_id);
++
++		host->ports[i]->ledtrig->name = host->ports[i]->ledtrig_name;
++
++		if (led_trigger_register(host->ports[i]->ledtrig)) {
++			kfree(host->ports[i]->ledtrig);
++			host->ports[i]->ledtrig = NULL;
++		}
++	}
++#endif
+ 	/* Create associated sysfs transport objects  */
+ 	for (i = 0; i < host->n_ports; i++) {
+ 		rc = ata_tport_add(host->dev,host->ports[i]);
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -23,6 +23,9 @@
+ #include <linux/cdrom.h>
+ #include <linux/sched.h>
+ #include <linux/async.h>
++#ifdef CONFIG_ATA_LEDS
++#include <linux/leds.h>
++#endif
+ 
+ /*
+  * Define if arch has non-standard setup.  This is a _PCI_ standard
+@@ -726,6 +729,10 @@ struct ata_device {
+ 	union acpi_object	*gtf_cache;
+ 	unsigned int		gtf_filter;
+ #endif
++#ifdef CONFIG_ATA_LEDS
++	struct led_trigger	*ledtrig;
++	char			ledtrig_name[8];
++#endif
+ #ifdef CONFIG_SATA_ZPODD
+ 	void			*zpodd;
+ #endif
diff --git a/6.12/target/linux/generic/pending-6.12/840-hwrng-bcm2835-set-quality-to-1000.patch b/6.12/target/linux/generic/pending-6.12/840-hwrng-bcm2835-set-quality-to-1000.patch
new file mode 100644
index 00000000..3172ad5a
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/840-hwrng-bcm2835-set-quality-to-1000.patch
@@ -0,0 +1,26 @@
+From d6988cf1d16faac56899918bb2b1be8d85155e3f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Sat, 20 Feb 2021 18:36:38 +0100
+Subject: [PATCH] hwrng: bcm2835: set quality to 1000
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This allows devices without a high precission timer to reduce boot from >100s
+to <30s.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ drivers/char/hw_random/bcm2835-rng.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/char/hw_random/bcm2835-rng.c
++++ b/drivers/char/hw_random/bcm2835-rng.c
+@@ -169,6 +169,7 @@ static int bcm2835_rng_probe(struct plat
+ 	priv->rng.init = bcm2835_rng_init;
+ 	priv->rng.read = bcm2835_rng_read;
+ 	priv->rng.cleanup = bcm2835_rng_cleanup;
++	priv->rng.quality = 1000;
+ 
+ 	if (dev_of_node(dev)) {
+ 		rng_id = of_match_node(bcm2835_rng_of_match, dev->of_node);
diff --git a/6.12/target/linux/generic/pending-6.12/850-0023-PCI-aardvark-Make-main-irq_chip-structure-a-static-d.patch b/6.12/target/linux/generic/pending-6.12/850-0023-PCI-aardvark-Make-main-irq_chip-structure-a-static-d.patch
new file mode 100644
index 00000000..6a90959f
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/850-0023-PCI-aardvark-Make-main-irq_chip-structure-a-static-d.patch
@@ -0,0 +1,102 @@
+From 663b9f99bb35dbc0c7b685f71ee3668a60d31320 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Marek=20Beh=C3=BAn?= <kabel@kernel.org>
+Date: Mon, 10 Jan 2022 02:02:00 +0100
+Subject: [PATCH] PCI: aardvark: Make main irq_chip structure a static driver
+ structure
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Marc Zyngier says [1] that we should use struct irq_chip as a global
+static struct in the driver. Even though the structure currently
+contains a dynamic member (parent_device), Marc says [2] that he plans
+to kill it and make the structure completely static.
+
+We have already converted others irq_chip structures in this driver in
+this way, but we omitted this one because the .name member is
+dynamically created from device's name, and the name is displayed in
+sysfs, so changing it would break sysfs ABI.
+
+The rationale for changing the name (to "advk-INT") in spite of sysfs
+ABI, and thus allowing to convert to a static structure, is that after
+the other changes we made in this series, the IRQ chip is basically
+something different: it no logner generates ERR and PME interrupts (they
+are generated by emulated bridge's rp_irq_chip).
+
+[1] https://lore.kernel.org/linux-pci/877dbcvngf.wl-maz@kernel.org/
+[2] https://lore.kernel.org/linux-pci/874k6gvkhz.wl-maz@kernel.org/
+
+Signed-off-by: Marek Behún <kabel@kernel.org>
+---
+ drivers/pci/controller/pci-aardvark.c | 25 +++++++------------------
+ 1 file changed, 7 insertions(+), 18 deletions(-)
+
+--- a/drivers/pci/controller/pci-aardvark.c
++++ b/drivers/pci/controller/pci-aardvark.c
+@@ -276,7 +276,6 @@ struct advk_pcie {
+ 	u8 wins_count;
+ 	struct irq_domain *rp_irq_domain;
+ 	struct irq_domain *irq_domain;
+-	struct irq_chip irq_chip;
+ 	raw_spinlock_t irq_lock;
+ 	struct irq_domain *msi_domain;
+ 	struct irq_domain *msi_inner_domain;
+@@ -1418,14 +1417,19 @@ static void advk_pcie_irq_unmask(struct
+ 	raw_spin_unlock_irqrestore(&pcie->irq_lock, flags);
+ }
+ 
++static struct irq_chip advk_irq_chip = {
++	.name		= "advk-INT",
++	.irq_mask	= advk_pcie_irq_mask,
++	.irq_unmask	= advk_pcie_irq_unmask,
++};
++
+ static int advk_pcie_irq_map(struct irq_domain *h,
+ 			     unsigned int virq, irq_hw_number_t hwirq)
+ {
+ 	struct advk_pcie *pcie = h->host_data;
+ 
+ 	irq_set_status_flags(virq, IRQ_LEVEL);
+-	irq_set_chip_and_handler(virq, &pcie->irq_chip,
+-				 handle_level_irq);
++	irq_set_chip_and_handler(virq, &advk_irq_chip, handle_level_irq);
+ 	irq_set_chip_data(virq, pcie);
+ 
+ 	return 0;
+@@ -1485,7 +1489,6 @@ static int advk_pcie_init_irq_domain(str
+ 	struct device *dev = &pcie->pdev->dev;
+ 	struct device_node *node = dev->of_node;
+ 	struct device_node *pcie_intc_node;
+-	struct irq_chip *irq_chip;
+ 	int ret = 0;
+ 
+ 	raw_spin_lock_init(&pcie->irq_lock);
+@@ -1496,28 +1499,14 @@ static int advk_pcie_init_irq_domain(str
+ 		return -ENODEV;
+ 	}
+ 
+-	irq_chip = &pcie->irq_chip;
+-
+-	irq_chip->name = devm_kasprintf(dev, GFP_KERNEL, "%s-irq",
+-					dev_name(dev));
+-	if (!irq_chip->name) {
+-		ret = -ENOMEM;
+-		goto out_put_node;
+-	}
+-
+-	irq_chip->irq_mask = advk_pcie_irq_mask;
+-	irq_chip->irq_unmask = advk_pcie_irq_unmask;
+-
+ 	pcie->irq_domain =
+ 		irq_domain_add_linear(pcie_intc_node, PCI_NUM_INTX,
+ 				      &advk_pcie_irq_domain_ops, pcie);
+ 	if (!pcie->irq_domain) {
+ 		dev_err(dev, "Failed to get a INTx IRQ domain\n");
+ 		ret = -ENOMEM;
+-		goto out_put_node;
+ 	}
+ 
+-out_put_node:
+ 	of_node_put(pcie_intc_node);
+ 	return ret;
+ }
diff --git a/6.12/target/linux/generic/pending-6.12/870-ARM-dts-nxp-imx7d-pico-add-cpu-supply-nodes.patch b/6.12/target/linux/generic/pending-6.12/870-ARM-dts-nxp-imx7d-pico-add-cpu-supply-nodes.patch
new file mode 100644
index 00000000..844a8c14
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/870-ARM-dts-nxp-imx7d-pico-add-cpu-supply-nodes.patch
@@ -0,0 +1,43 @@
+From d0562705bcd4cb9849156f095b2af0ec1bb53b56 Mon Sep 17 00:00:00 2001
+From: Lech Perczak <lech.perczak@gmail.com>
+Date: Fri, 17 Nov 2023 21:33:04 +0100
+Subject: [PATCH] ARM: dts: nxp: imx7d-pico: add cpu-supply nodes
+
+The PICO-IMX7D SoM has the usual power supply configuration using
+output sw1a of PF3000 PMIC, which was defined in downstream derivative
+of linux-imx (see link) in the sources for "Android Things" devkit.
+It is required to support CPU frequency scaling.
+
+Map the respective "cpu-supply" nodes of each core to sw1a of the PMIC.
+
+Enabling them causes cpufreq-dt, and imx-thermal drivers to probe
+successfully, and CPU frequency scaling to function.
+
+Link: https://android.googlesource.com/platform/hardware/bsp/kernel/nxp/imx-v4.1/+/o-iot-preview-5/arch/arm/boot/dts/imx7d-pico.dtsi#849
+
+Cc: Fabio Estevam <festevam@gmail.com>
+Cc: Shawn Guo <shawnguo@kernel.org>
+Cc: Sascha Hauer <s.hauer@pengutronix.de>
+
+Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
+---
+ arch/arm/boot/dts/imx7d-pico.dtsi | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/arch/arm/boot/dts/nxp/imx/imx7d-pico.dtsi
++++ b/arch/arm/boot/dts/nxp/imx/imx7d-pico.dtsi
+@@ -116,6 +116,14 @@
+ 	cpu-supply = <&sw1a_reg>;
+ };
+ 
++&cpu0 {
++	cpu-supply = <&sw1a_reg>;
++};
++
++&cpu1 {
++	cpu-supply = <&sw1a_reg>;
++};
++
+ &ecspi3 {
+ 	cs-gpios = <&gpio4 11 GPIO_ACTIVE_LOW>;
+ 	pinctrl-names = "default";
diff --git a/6.12/target/linux/generic/pending-6.12/890-usb-serial-add-support-for-CH348.patch b/6.12/target/linux/generic/pending-6.12/890-usb-serial-add-support-for-CH348.patch
new file mode 100644
index 00000000..028ecf41
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/890-usb-serial-add-support-for-CH348.patch
@@ -0,0 +1,783 @@
+From df1357358eec062241bddd2995e7ef0ce86cf45a Mon Sep 17 00:00:00 2001
+X-Patchwork-Submitter: Corentin Labbe <clabbe@baylibre.com>
+X-Patchwork-Id: 13656881
+Message-Id: <20240507131522.3546113-2-clabbe@baylibre.com>
+X-Mailer: git-send-email 2.25.1
+In-Reply-To: <20240507131522.3546113-1-clabbe@baylibre.com>
+References: <20240507131522.3546113-1-clabbe@baylibre.com>
+Precedence: bulk
+X-Mailing-List: linux-usb@vger.kernel.org
+List-Id: <linux-usb.vger.kernel.org>
+From: Corentin Labbe <clabbe@baylibre.com>
+Date: Tue, 7 May 2024 13:15:22 +0000
+Subject: [PATCH v7] usb: serial: add support for CH348
+
+The CH348 is an USB octo port serial adapter.
+The device multiplexes all 8 ports in the same pair of Bulk endpoints.
+Since there is no public datasheet, unfortunately it remains some magic values
+
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Tested-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+---
+ drivers/usb/serial/Kconfig  |   9 +
+ drivers/usb/serial/Makefile |   1 +
+ drivers/usb/serial/ch348.c  | 725 ++++++++++++++++++++++++++++++++++++
+ 3 files changed, 735 insertions(+)
+ create mode 100644 drivers/usb/serial/ch348.c
+
+--- a/drivers/usb/serial/Kconfig
++++ b/drivers/usb/serial/Kconfig
+@@ -112,6 +112,15 @@ config USB_SERIAL_CH341
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called ch341.
+ 
++config USB_SERIAL_CH348
++	tristate "USB Winchiphead CH348 Octo Port Serial Driver"
++	help
++	  Say Y here if you want to use a Winchiphead CH348 octo port
++	  USB to serial adapter.
++
++	  To compile this driver as a module, choose M here: the
++	  module will be called ch348.
++
+ config USB_SERIAL_WHITEHEAT
+ 	tristate "USB ConnectTech WhiteHEAT Serial Driver"
+ 	select USB_EZUSB_FX2
+--- a/drivers/usb/serial/Makefile
++++ b/drivers/usb/serial/Makefile
+@@ -15,6 +15,7 @@ obj-$(CONFIG_USB_SERIAL_AIRCABLE)		+= ai
+ obj-$(CONFIG_USB_SERIAL_ARK3116)		+= ark3116.o
+ obj-$(CONFIG_USB_SERIAL_BELKIN)			+= belkin_sa.o
+ obj-$(CONFIG_USB_SERIAL_CH341)			+= ch341.o
++obj-$(CONFIG_USB_SERIAL_CH348)			+= ch348.o
+ obj-$(CONFIG_USB_SERIAL_CP210X)			+= cp210x.o
+ obj-$(CONFIG_USB_SERIAL_CYBERJACK)		+= cyberjack.o
+ obj-$(CONFIG_USB_SERIAL_CYPRESS_M8)		+= cypress_m8.o
+--- /dev/null
++++ b/drivers/usb/serial/ch348.c
+@@ -0,0 +1,725 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * USB serial driver for USB to Octal UARTs chip ch348.
++ *
++ * Copyright (C) 2022 Corentin Labbe <clabbe@baylibre.com>
++ * With the help of Neil Armstrong <neil.armstrong@linaro.org>
++ * and the help of Martin Blumenstingl <martin.blumenstingl@googlemail.com>
++ */
++
++#include <linux/completion.h>
++#include <linux/errno.h>
++#include <linux/init.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/mutex.h>
++#include <linux/overflow.h>
++#include <linux/serial.h>
++#include <linux/slab.h>
++#include <linux/tty.h>
++#include <linux/tty_driver.h>
++#include <linux/tty_flip.h>
++#include <linux/usb.h>
++#include <linux/usb/serial.h>
++
++#define CH348_CMD_TIMEOUT   2000
++
++#define CH348_CTO_D	0x01
++#define CH348_CTO_R	0x02
++
++#define CH348_CTI_C	0x10
++#define CH348_CTI_DSR	0x20
++#define CH348_CTI_R	0x40
++#define CH348_CTI_DCD	0x80
++
++#define CH348_LO	0x02
++#define CH348_LP	0x04
++#define CH348_LF	0x08
++#define CH348_LB	0x10
++
++#define CMD_W_R		0xC0
++#define CMD_W_BR	0x80
++
++#define CMD_WB_E	0x90
++#define CMD_RB_E	0xC0
++
++#define M_NOR		0x00
++#define M_HF		0x03
++
++#define R_MOD		0x97
++#define R_IO_D		0x98
++#define R_IO_O		0x99
++#define R_IO_I		0x9b
++#define R_TM_O		0x9c
++#define R_INIT		0xa1
++
++#define R_C1		0x01
++#define R_C2		0x02
++#define R_C4		0x04
++#define R_C5		0x06
++
++#define R_II_B1		0x06
++#define R_II_B2		0x02
++#define R_II_B3		0x00
++
++#define CMD_VER		0x96
++
++#define CH348_RX_PORT_CHUNK_LENGTH	32
++#define CH348_RX_PORT_MAX_LENGTH	30
++
++struct ch348_rxbuf {
++	u8 port;
++	u8 length;
++	u8 data[CH348_RX_PORT_MAX_LENGTH];
++} __packed;
++
++struct ch348_txbuf {
++	u8 port;
++	__le16 length;
++	u8 data[];
++} __packed;
++
++#define CH348_TX_HDRSIZE offsetof(struct ch348_txbuf, data)
++
++struct ch348_initbuf {
++	u8 cmd;
++	u8 reg;
++	u8 port;
++	__be32 baudrate;
++	u8 format;
++	u8 paritytype;
++	u8 databits;
++	u8 rate;
++	u8 unknown;
++} __packed;
++
++#define CH348_MAXPORT 8
++
++/*
++ * The CH348 multiplexes rx & tx into a pair of Bulk USB endpoints for
++ * the 8 serial ports, and another pair of Bulk USB endpoints to
++ * set port settings and receive port status events.
++ *
++ * The USB serial cores ties every Bulk endpoints pairs to each ports,
++ * but in our case it will set port 0 with the rx/tx endpoints
++ * and port 1 with the setup/status endpoints.
++ *
++ * To still take advantage of the generic code, we (re-)initialize
++ * the USB serial port structure with the correct USB endpoint
++ * for read and write, and write proper process_read_urb()
++ * and prepare_write_buffer() to correctly (de-)multiplex data.
++ * Also we use a custom write() implementation to wait until the buffer
++ * has been fully transmitted to prevent TX buffer overruns.
++ */
++
++/*
++ * struct ch348_port - per-port information
++ * @uartmode:		UART port current mode
++ * @write_completion:	completion event when the TX buffer has been written out
++ */
++struct ch348_port {
++	u8 uartmode;
++	struct completion write_completion;
++};
++
++/*
++ * struct ch348 - main container for all this driver information
++ * @udev:		pointer to the CH348 USB device
++ * @ports:		List of per-port information
++ * @serial:		pointer to the serial structure
++ * @write_lock:		protect against concurrent writes so we don't lose data
++ * @cmd_ep:		endpoint number for configure operations
++ * @status_urb:		URB for status
++ * @status_buffer:	buffer used by status_urb
++ */
++struct ch348 {
++	struct usb_device *udev;
++	struct ch348_port ports[CH348_MAXPORT];
++	struct usb_serial *serial;
++
++	struct mutex write_lock;
++
++	int cmd_ep;
++
++	struct urb *status_urb;
++	u8 status_buffer[];
++};
++
++struct ch348_magic {
++	u8 action;
++	u8 reg;
++	u8 control;
++} __packed;
++
++struct ch348_status_entry {
++	u8 portnum:4;
++	u8 unused:4;
++	u8 reg_iir;
++	union {
++		u8 lsr_signal;
++		u8 modem_signal;
++		u8 init_data[10];
++	};
++} __packed;
++
++static void ch348_process_status_urb(struct urb *urb)
++{
++	struct ch348_status_entry *status_entry;
++	struct ch348 *ch348 = urb->context;
++	int ret, status = urb->status;
++	struct usb_serial_port *port;
++	unsigned int i, status_len;
++
++	switch (status) {
++	case 0:
++		/* success */
++		break;
++	case -ECONNRESET:
++	case -ENOENT:
++	case -ESHUTDOWN:
++		/* this urb is terminated, clean up */
++		dev_dbg(&urb->dev->dev, "%s - urb shutting down with status: %d\n",
++			__func__, status);
++		return;
++	default:
++		dev_err(&urb->dev->dev, "%s - nonzero urb status received: %d\n",
++			__func__, status);
++		goto exit;
++	}
++
++	if (urb->actual_length < 3) {
++		dev_warn(&ch348->udev->dev,
++			 "Received too short status buffer with %u bytes\n",
++			 urb->actual_length);
++		goto exit;
++	}
++
++	for (i = 0; i < urb->actual_length;) {
++		status_entry = urb->transfer_buffer + i;
++
++		if (status_entry->portnum >= CH348_MAXPORT) {
++			dev_warn(&ch348->udev->dev,
++				 "Invalid port %d in status entry\n",
++				 status_entry->portnum);
++			break;
++		}
++
++		port = ch348->serial->port[status_entry->portnum];
++		status_len = 3;
++
++		if (!status_entry->reg_iir) {
++			dev_dbg(&port->dev, "Ignoring status with zero reg_iir\n");
++		} else if (status_entry->reg_iir == R_INIT) {
++			status_len = 12;
++		} else if ((status_entry->reg_iir & 0x0f) == R_II_B1) {
++			if (status_entry->lsr_signal & CH348_LO)
++				port->icount.overrun++;
++			if (status_entry->lsr_signal & CH348_LP)
++				port->icount.parity++;
++			if (status_entry->lsr_signal & CH348_LF)
++				port->icount.frame++;
++			if (status_entry->lsr_signal & CH348_LF)
++				port->icount.brk++;
++		} else if ((status_entry->reg_iir & 0x0f) == R_II_B2) {
++			complete_all(&ch348->ports[status_entry->portnum].write_completion);
++		} else {
++			dev_warn(&port->dev,
++				 "Unsupported status with reg_iir 0x%02x\n",
++				 status_entry->reg_iir);
++		}
++
++		usb_serial_debug_data(&port->dev, __func__, status_len,
++				      urb->transfer_buffer + i);
++
++		i += status_len;
++	}
++
++exit:
++	ret = usb_submit_urb(urb, GFP_ATOMIC);
++	if (ret)
++		dev_err(&urb->dev->dev, "%s - usb_submit_urb failed; %d\n",
++			__func__, ret);
++}
++
++/*
++ * Some values came from vendor tree, and we have no meaning for them, this
++ * function simply use them.
++ */
++static int ch348_do_magic(struct ch348 *ch348, int portnum, u8 action, u8 reg, u8 control)
++{
++	struct ch348_magic *buffer;
++	int ret, len;
++
++	buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);
++	if (!buffer)
++		return -ENOMEM;
++
++	if (portnum < 4)
++		reg += 0x10 * portnum;
++	else
++		reg += 0x10 * (portnum - 4) + 0x08;
++
++	buffer->action = action;
++	buffer->reg = reg;
++	buffer->control = control;
++
++	ret = usb_bulk_msg(ch348->udev, ch348->cmd_ep, buffer, 3, &len,
++			   CH348_CMD_TIMEOUT);
++	if (ret)
++		dev_err(&ch348->udev->dev, "Failed to write magic err=%d\n", ret);
++
++	kfree(buffer);
++
++	return ret;
++}
++
++static int ch348_configure(struct ch348 *ch348, int portnum)
++{
++	int ret;
++
++	ret = ch348_do_magic(ch348, portnum, CMD_W_R, R_C2, 0x87);
++	if (ret)
++		return ret;
++
++	return ch348_do_magic(ch348, portnum, CMD_W_R, R_C4, 0x08);
++}
++
++static void ch348_process_read_urb(struct urb *urb)
++{
++	struct usb_serial_port *port = urb->context;
++	struct ch348 *ch348 = usb_get_serial_data(port->serial);
++	unsigned int portnum, usblen, i;
++	struct ch348_rxbuf *rxb;
++
++	if (urb->actual_length < 2) {
++		dev_dbg(&ch348->udev->dev, "Empty rx buffer\n");
++		return;
++	}
++
++	for (i = 0; i < urb->actual_length; i += CH348_RX_PORT_CHUNK_LENGTH) {
++		rxb = urb->transfer_buffer + i;
++		portnum = rxb->port;
++		if (portnum >= CH348_MAXPORT) {
++			dev_dbg(&ch348->udev->dev, "Invalid port %d\n", portnum);
++			break;
++		}
++
++		port = ch348->serial->port[portnum];
++
++		usblen = rxb->length;
++		if (usblen > CH348_RX_PORT_MAX_LENGTH) {
++			dev_dbg(&port->dev, "Invalid length %d for port %d\n",
++				usblen, portnum);
++			break;
++		}
++
++		tty_insert_flip_string(&port->port, rxb->data, usblen);
++		tty_flip_buffer_push(&port->port);
++		port->icount.rx += usblen;
++		usb_serial_debug_data(&port->dev, __func__, usblen, rxb->data);
++	}
++}
++
++static int ch348_prepare_write_buffer(struct usb_serial_port *port, void *dest, size_t size)
++{
++	struct ch348_txbuf *rxt = dest;
++	int count;
++
++	count = kfifo_out_locked(&port->write_fifo, rxt->data,
++				 size - CH348_TX_HDRSIZE, &port->lock);
++
++	rxt->port = port->port_number;
++	rxt->length = cpu_to_le16(count);
++
++	return count + CH348_TX_HDRSIZE;
++}
++
++static int ch348_write(struct tty_struct *tty, struct usb_serial_port *port,
++		       const unsigned char *buf, int count)
++{
++	struct ch348 *ch348 = usb_get_serial_data(port->serial);
++	struct ch348_port *ch348_port = &ch348->ports[port->port_number];
++	int ret, max_tx_size;
++
++	if (tty_get_baud_rate(tty) < 9600 && count >= 128)
++		/*
++		 * Writing larger buffers can take longer than the hardware
++		 * allows before discarding the write buffer. Limit the
++		 * transfer size in such cases.
++		 * These values have been found by empirical testing.
++		 */
++		max_tx_size = 128;
++	else
++		/*
++		* Only ingest as many bytes as we can transfer with one URB at
++		* a time. Once an URB has been written we need to wait for the
++		* R_II_B2 status event before we are allowed to send more data.
++		* If we ingest more data then usb_serial_generic_write() will
++		* internally try to process as much data as possible with any
++		* number of URBs without giving us the chance to wait in
++		* between transfers.
++		*/
++		max_tx_size = port->bulk_out_size - CH348_TX_HDRSIZE;
++
++	reinit_completion(&ch348_port->write_completion);
++
++	mutex_lock(&ch348->write_lock);
++
++	/*
++	 * For any (remaining) bytes that we did not transfer TTY core will
++	 * call us again, with the buffer and count adjusted to the remaining
++	 * data.
++	 */
++	ret = usb_serial_generic_write(tty, port, buf, min(count, max_tx_size));
++
++	mutex_unlock(&ch348->write_lock);
++
++	if (ret <= 0)
++		return ret;
++
++	if (!wait_for_completion_interruptible_timeout(&ch348_port->write_completion,
++						       msecs_to_jiffies(CH348_CMD_TIMEOUT))) {
++		dev_err_console(port, "Failed to wait for TX buffer flush\n");
++		return -ETIMEDOUT;
++	}
++
++	return ret;
++}
++
++static int ch348_set_uartmode(struct ch348 *ch348, int portnum, u8 mode)
++{
++	int ret;
++
++	if (ch348->ports[portnum].uartmode == M_NOR && mode == M_HF) {
++		ret = ch348_do_magic(ch348, portnum, CMD_W_BR, R_C4, 0x51);
++		if (ret)
++			return ret;
++		ch348->ports[portnum].uartmode = M_HF;
++	}
++
++	if (ch348->ports[portnum].uartmode == M_HF && mode == M_NOR) {
++		ret = ch348_do_magic(ch348, portnum, CMD_W_BR, R_C4, 0x50);
++		if (ret)
++			return ret;
++		ch348->ports[portnum].uartmode = M_NOR;
++	}
++	return 0;
++}
++
++static void ch348_set_termios(struct tty_struct *tty, struct usb_serial_port *port,
++			      const struct ktermios *termios_old)
++{
++	struct ch348 *ch348 = usb_get_serial_data(port->serial);
++	struct ktermios *termios = &tty->termios;
++	int ret, portnum = port->port_number;
++	struct ch348_initbuf *buffer;
++	speed_t	baudrate;
++	u8 format;
++
++	if (termios_old && !tty_termios_hw_change(&tty->termios, termios_old))
++		return;
++
++	buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);
++	if (!buffer) {
++		if (termios_old)
++			tty->termios = *termios_old;
++		return;
++	}
++
++	/*
++	 * The datasheet states that only baud rates in range of 1200..6000000
++	 * are supported. Tests however show that even baud rates as low as 50
++	 * and as high as 12000000 are working in practice.
++	 */
++	baudrate = clamp(tty_get_baud_rate(tty), 50, 12000000);
++
++	format = termios->c_cflag & CSTOPB ? 2 : 1;
++
++	buffer->paritytype = 0;
++	if (termios->c_cflag & PARENB) {
++		if (termios->c_cflag & PARODD)
++			buffer->paritytype += 1;
++		else
++			buffer->paritytype += 2;
++		if  (termios->c_cflag & CMSPAR)
++			buffer->paritytype += 2;
++	}
++
++	switch (C_CSIZE(tty)) {
++	case CS5:
++		buffer->databits = 5;
++		break;
++	case CS6:
++		buffer->databits = 6;
++		break;
++	case CS7:
++		buffer->databits = 7;
++		break;
++	case CS8:
++	default:
++		buffer->databits = 8;
++		break;
++	}
++	buffer->cmd = CMD_WB_E | (portnum & 0x0F);
++	buffer->reg = R_INIT;
++	buffer->port = portnum;
++	buffer->baudrate = cpu_to_be32(baudrate);
++
++	if (format == 2)
++		buffer->format = 0x02;
++	else if (format == 1)
++		buffer->format = 0x00;
++
++	buffer->rate = max_t(speed_t, 5, (10000 * 15 / baudrate) + 1);
++
++	ret = usb_bulk_msg(ch348->udev, ch348->cmd_ep, buffer,
++			   sizeof(*buffer), NULL, CH348_CMD_TIMEOUT);
++	if (ret < 0) {
++		dev_err(&ch348->udev->dev, "Failed to change line settings: err=%d\n",
++			ret);
++		goto out;
++	}
++
++	ret = ch348_do_magic(ch348, portnum, CMD_W_R, R_C1, 0x0F);
++	if (ret < 0)
++		goto out;
++
++	if (C_CRTSCTS(tty))
++		ret = ch348_set_uartmode(ch348, portnum, M_HF);
++	else
++		ret = ch348_set_uartmode(ch348, portnum, M_NOR);
++
++out:
++	kfree(buffer);
++}
++
++static int ch348_open(struct tty_struct *tty, struct usb_serial_port *port)
++{
++	struct ch348 *ch348 = usb_get_serial_data(port->serial);
++	int ret;
++
++	if (tty)
++		ch348_set_termios(tty, port, NULL);
++
++	ret = ch348_configure(ch348, port->port_number);
++	if (ret) {
++		dev_err(&ch348->udev->dev, "Fail to configure err=%d\n", ret);
++		return ret;
++	}
++
++	return usb_serial_generic_open(tty, port);
++}
++
++static int ch348_attach(struct usb_serial *serial)
++{
++	struct usb_endpoint_descriptor *epcmd, *epstatus;
++	struct usb_serial_port *port0 = serial->port[1];
++	struct usb_device *usb_dev = serial->dev;
++	int status_buffer_size, i, ret;
++	struct usb_interface *intf;
++	struct ch348 *ch348;
++
++	intf = usb_ifnum_to_if(usb_dev, 0);
++	epstatus = &intf->cur_altsetting->endpoint[2].desc;
++	epcmd = &intf->cur_altsetting->endpoint[3].desc;
++
++	status_buffer_size = usb_endpoint_maxp(epstatus);
++
++	ch348 = kzalloc(struct_size(ch348, status_buffer, status_buffer_size),
++			GFP_KERNEL);
++	if (!ch348)
++		return -ENOMEM;
++
++	usb_set_serial_data(serial, ch348);
++
++	ch348->udev = serial->dev;
++	ch348->serial = serial;
++	mutex_init(&ch348->write_lock);
++
++	for (i = 0; i < CH348_MAXPORT; i++)
++		init_completion(&ch348->ports[i].write_completion);
++
++	ch348->status_urb = usb_alloc_urb(0, GFP_KERNEL);
++	if (!ch348->status_urb) {
++		ret = -ENOMEM;
++		goto err_free_ch348;
++	}
++
++	usb_fill_bulk_urb(ch348->status_urb, ch348->udev,
++			  usb_rcvbulkpipe(ch348->udev, epstatus->bEndpointAddress),
++			  ch348->status_buffer, status_buffer_size,
++			  ch348_process_status_urb, ch348);
++
++	ret = usb_submit_urb(ch348->status_urb, GFP_KERNEL);
++	if (ret) {
++		dev_err(&ch348->udev->dev,
++			"%s - failed to submit status/interrupt urb %i\n",
++			__func__, ret);
++		goto err_free_status_urb;
++	}
++
++	ret = usb_serial_generic_submit_read_urbs(port0, GFP_KERNEL);
++	if (ret)
++		goto err_kill_status_urb;
++
++	ch348->cmd_ep = usb_sndbulkpipe(usb_dev, epcmd->bEndpointAddress);
++
++	return 0;
++
++err_kill_status_urb:
++	usb_kill_urb(ch348->status_urb);
++err_free_status_urb:
++	usb_free_urb(ch348->status_urb);
++err_free_ch348:
++	kfree(ch348);
++	return ret;
++}
++
++static void ch348_release(struct usb_serial *serial)
++{
++	struct ch348 *ch348 = usb_get_serial_data(serial);
++
++	usb_kill_urb(ch348->status_urb);
++	usb_free_urb(ch348->status_urb);
++
++	kfree(ch348);
++}
++
++static void ch348_print_version(struct usb_serial *serial)
++{
++	u8 *version_buf;
++	int ret;
++
++	version_buf = kzalloc(4, GFP_KERNEL);
++	if (!version_buf)
++		return;
++
++	ret = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
++			      CMD_VER,
++			      USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
++			      0, 0, version_buf, 4, CH348_CMD_TIMEOUT);
++	if (ret < 0)
++		dev_dbg(&serial->dev->dev, "Failed to read CMD_VER: %d\n", ret);
++	else
++		dev_info(&serial->dev->dev, "Found WCH CH348%s\n",
++			 (version_buf[1] & 0x80) ? "Q" : "L");
++
++	kfree(version_buf);
++}
++
++static int ch348_probe(struct usb_serial *serial, const struct usb_device_id *id)
++{
++	struct usb_endpoint_descriptor *epread, *epwrite, *epstatus, *epcmd;
++	struct usb_device *usb_dev = serial->dev;
++	struct usb_interface *intf;
++	int ret;
++
++	intf = usb_ifnum_to_if(usb_dev, 0);
++
++	ret = usb_find_common_endpoints(intf->cur_altsetting, &epread, &epwrite,
++					NULL, NULL);
++	if (ret) {
++		dev_err(&serial->dev->dev, "Failed to find basic endpoints ret=%d\n", ret);
++		return ret;
++	}
++
++	epstatus = &intf->cur_altsetting->endpoint[2].desc;
++	if (!usb_endpoint_is_bulk_in(epstatus)) {
++		dev_err(&serial->dev->dev, "Missing second bulk in (STATUS/INT)\n");
++		return -ENODEV;
++	}
++
++	epcmd = &intf->cur_altsetting->endpoint[3].desc;
++	if (!usb_endpoint_is_bulk_out(epcmd)) {
++		dev_err(&serial->dev->dev, "Missing second bulk out (CMD)\n");
++		return -ENODEV;
++	}
++
++	ch348_print_version(serial);
++
++	return 0;
++}
++
++static int ch348_calc_num_ports(struct usb_serial *serial,
++				struct usb_serial_endpoints *epds)
++{
++	int i;
++
++	for (i = 1; i < CH348_MAXPORT; ++i) {
++		epds->bulk_out[i] = epds->bulk_out[0];
++		epds->bulk_in[i] = epds->bulk_in[0];
++	}
++
++	epds->num_bulk_out = CH348_MAXPORT;
++	epds->num_bulk_in = CH348_MAXPORT;
++
++	return CH348_MAXPORT;
++}
++
++static int ch348_suspend(struct usb_serial *serial, pm_message_t message)
++{
++	struct ch348 *ch348 = usb_get_serial_data(serial);
++
++	usb_kill_urb(ch348->status_urb);
++
++	return 0;
++}
++
++static int ch348_resume(struct usb_serial *serial)
++{
++	struct ch348 *ch348 = usb_get_serial_data(serial);
++	int ret;
++
++	ret = usb_submit_urb(ch348->status_urb, GFP_KERNEL);
++	if (ret) {
++		dev_err(&ch348->udev->dev,
++			"%s - failed to submit status/interrupt urb %i\n",
++			__func__, ret);
++		return ret;
++	}
++
++	ret = usb_serial_generic_resume(serial);
++	if (ret)
++		usb_kill_urb(ch348->status_urb);
++
++	return ret;
++}
++
++static const struct usb_device_id ch348_ids[] = {
++	{ USB_DEVICE(0x1a86, 0x55d9), },
++	{ /* sentinel */ }
++};
++
++MODULE_DEVICE_TABLE(usb, ch348_ids);
++
++static struct usb_serial_driver ch348_device = {
++	.driver = {
++		.owner = THIS_MODULE,
++		.name = "ch348",
++	},
++	.id_table =		ch348_ids,
++	.num_ports =		CH348_MAXPORT,
++	.num_bulk_in =		1,
++	.num_bulk_out =		1,
++	.open =			ch348_open,
++	.set_termios =		ch348_set_termios,
++	.process_read_urb =	ch348_process_read_urb,
++	.prepare_write_buffer =	ch348_prepare_write_buffer,
++	.write =		ch348_write,
++	.probe =		ch348_probe,
++	.calc_num_ports =	ch348_calc_num_ports,
++	.attach =		ch348_attach,
++	.release =		ch348_release,
++	.suspend =		ch348_suspend,
++	.resume =		ch348_resume,
++};
++
++static struct usb_serial_driver * const serial_drivers[] = {
++	&ch348_device, NULL
++};
++
++module_usb_serial_driver(serial_drivers, ch348_ids);
++
++MODULE_AUTHOR("Corentin Labbe <clabbe@baylibre.com>");
++MODULE_DESCRIPTION("USB CH348 Octo port serial converter driver");
++MODULE_LICENSE("GPL");
diff --git a/6.12/target/linux/generic/pending-6.12/891-dt-bindings-leds-Add-LED1202-LED-Controller.patch b/6.12/target/linux/generic/pending-6.12/891-dt-bindings-leds-Add-LED1202-LED-Controller.patch
new file mode 100644
index 00000000..16425608
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/891-dt-bindings-leds-Add-LED1202-LED-Controller.patch
@@ -0,0 +1,181 @@
+From: Vicentiu Galanopulo <vicentiu.galanopulo@remote-tech.co.uk>
+To: Pavel Machek <pavel@ucw.cz>, Lee Jones <lee@kernel.org>,
+	Rob Herring <robh@kernel.org>,
+	Krzysztof Kozlowski <krzk+dt@kernel.org>,
+	Conor Dooley <conor+dt@kernel.org>,
+	Jonathan Corbet <corbet@lwn.net>,
+	Vicentiu Galanopulo <vicentiu.galanopulo@remote-tech.co.uk>,
+	linux-leds@vger.kernel.org, devicetree@vger.kernel.org,
+	linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org
+Cc: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Subject: [PATCH v11 2/3] dt-bindings: leds: Add LED1202 LED Controller
+Date: Wed, 18 Dec 2024 18:33:58 +0000	[thread overview]
+Message-ID: <20241218183401.41687-3-vicentiu.galanopulo@remote-tech.co.uk> (raw)
+In-Reply-To: <20241218183401.41687-1-vicentiu.galanopulo@remote-tech.co.uk>
+
+The LED1202 is a 12-channel low quiescent current LED driver with:
+  * Supply range from 2.6 V to 5 V
+  * 20 mA current capability per channel
+  * 1.8 V compatible I2C control interface
+  * 8-bit analog dimming individual control
+  * 12-bit local PWM resolution
+  * 8 programmable patterns
+
+If the led node is present in the controller then the channel is
+set to active.
+
+Signed-off-by: Vicentiu Galanopulo <vicentiu.galanopulo@remote-tech.co.uk>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+---
+    v1: https://lore.kernel.org/lkml/ZnCnnQfwuRueCIQ0@admins-Air/T/
+    v2: https://lore.kernel.org/all/ZniNdGgKyUMV-hjq@admins-Air/T/
+    v3: https://lore.kernel.org/all/ZniNdGgKyUMV-hjq@admins-Air/T/
+    
+    Changes in v4:
+      - remove label property, use devm_led_classdev_register_ext instead
+    Changes in v3:
+      - remove active property
+    Changes in v2:
+      - renamed label to remove color from it
+      - add color property for each node
+      - add function and function-enumerator property for each node
+
+ .../devicetree/bindings/leds/st,led1202.yaml  | 132 ++++++++++++++++++
+ 1 file changed, 132 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/leds/st,led1202.yaml
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/leds/st,led1202.yaml
+@@ -0,0 +1,132 @@
++# SPDX-License-Identifier: GPL-2.0-only OR BSD-2-Clause
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/leds/st,led1202.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: ST LED1202 LED controllers
++
++maintainers:
++  - Vicentiu Galanopulo <vicentiu.galanopulo@remote-tech.co.uk>
++
++description: |
++  The LED1202 is a 12-channel low quiescent current LED controller
++  programmable via I2C; The output current can be adjusted separately
++  for each channel by 8-bit analog and 12-bit digital dimming control.
++  Datasheet available at
++  https://www.st.com/en/power-management/led1202.html
++
++properties:
++  compatible:
++    const: st,led1202
++
++  reg:
++    maxItems: 1
++
++  "#address-cells":
++    const: 1
++
++  "#size-cells":
++    const: 0
++
++patternProperties:
++  "^led@[0-9a-f]$":
++    type: object
++    $ref: common.yaml#
++    unevaluatedProperties: false
++
++    properties:
++      reg:
++        minimum: 0
++        maximum: 11
++
++    required:
++      - reg
++
++required:
++  - compatible
++  - reg
++  - "#address-cells"
++  - "#size-cells"
++
++additionalProperties: false
++
++examples:
++  - |
++    #include <dt-bindings/leds/common.h>
++
++    i2c {
++        #address-cells = <1>;
++        #size-cells = <0>;
++
++        led-controller@58 {
++            compatible = "st,led1202";
++            reg = <0x58>;
++            #address-cells = <1>;
++            #size-cells = <0>;
++
++            led@0 {
++                reg = <0x0>;
++                function = LED_FUNCTION_STATUS;
++                color = <LED_COLOR_ID_RED>;
++                function-enumerator = <1>;
++            };
++
++            led@1 {
++                reg = <0x1>;
++                function = LED_FUNCTION_STATUS;
++                color = <LED_COLOR_ID_GREEN>;
++                function-enumerator = <2>;
++            };
++
++            led@2 {
++                reg = <0x2>;
++                function = LED_FUNCTION_STATUS;
++                color = <LED_COLOR_ID_BLUE>;
++                function-enumerator = <3>;
++            };
++
++            led@3 {
++                reg = <0x3>;
++                function = LED_FUNCTION_STATUS;
++                color = <LED_COLOR_ID_RED>;
++                function-enumerator = <4>;
++            };
++
++            led@4 {
++                reg = <0x4>;
++                function = LED_FUNCTION_STATUS;
++                color = <LED_COLOR_ID_GREEN>;
++                function-enumerator = <5>;
++            };
++
++            led@5 {
++                reg = <0x5>;
++                function = LED_FUNCTION_STATUS;
++                color = <LED_COLOR_ID_BLUE>;
++                function-enumerator = <6>;
++            };
++
++            led@6 {
++                reg = <0x6>;
++                function = LED_FUNCTION_STATUS;
++                color = <LED_COLOR_ID_RED>;
++                function-enumerator = <7>;
++            };
++
++            led@7 {
++                reg = <0x7>;
++                function = LED_FUNCTION_STATUS;
++                color = <LED_COLOR_ID_GREEN>;
++                function-enumerator = <8>;
++            };
++
++            led@8 {
++                reg = <0x8>;
++                function = LED_FUNCTION_STATUS;
++                color = <LED_COLOR_ID_BLUE>;
++                function-enumerator = <9>;
++            };
++        };
++    };
++...
diff --git a/6.12/target/linux/generic/pending-6.12/892-leds-Add-LED1202-I2C-driver.patch b/6.12/target/linux/generic/pending-6.12/892-leds-Add-LED1202-I2C-driver.patch
new file mode 100644
index 00000000..089f0921
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/892-leds-Add-LED1202-I2C-driver.patch
@@ -0,0 +1,513 @@
+From: Vicentiu Galanopulo <vicentiu.galanopulo@remote-tech.co.uk>
+To: Pavel Machek <pavel@ucw.cz>, Lee Jones <lee@kernel.org>,
+	Rob Herring <robh@kernel.org>,
+	Krzysztof Kozlowski <krzk+dt@kernel.org>,
+	Conor Dooley <conor+dt@kernel.org>,
+	Jonathan Corbet <corbet@lwn.net>,
+	Vicentiu Galanopulo <vicentiu.galanopulo@remote-tech.co.uk>,
+	linux-leds@vger.kernel.org, devicetree@vger.kernel.org,
+	linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org
+Subject: [PATCH v11 3/3] leds: Add LED1202 I2C driver
+Date: Wed, 18 Dec 2024 18:33:59 +0000	[thread overview]
+Message-ID: <20241218183401.41687-4-vicentiu.galanopulo@remote-tech.co.uk> (raw)
+In-Reply-To: <20241218183401.41687-1-vicentiu.galanopulo@remote-tech.co.uk>
+
+The output current can be adjusted separately for each channel by 8-bit
+analog (current sink input) and 12-bit digital (PWM) dimming control. The
+LED1202 implements 12 low-side current generators with independent dimming
+control.
+Internal volatile memory allows the user to store up to 8 different patterns,
+each pattern is a particular output configuration in terms of PWM
+duty-cycle (on 4096 steps). Analog dimming (on 256 steps) is per channel but
+common to all patterns. Each device tree LED node will have a corresponding
+entry in /sys/class/leds with the label name. The brightness property
+corresponds to the per channel analog dimming, while the patterns[1-8] to the
+PWM dimming control.
+
+Signed-off-by: Vicentiu Galanopulo <vicentiu.galanopulo@remote-tech.co.uk>
+---
+    Changes in v10:
+      - update description help in Kconfig
+      - move st1202_led and st1202_chip into one line, declaration and definition
+    Changes in v9:
+      - log errors directly in st1202_write_reg and st1202_read_reg
+      - use mutex guards instead of lock/unlock
+      - remove i2c_set_clientdata
+    Changes in v7:
+      - fix st1202_brightness_get() error: uninitialized symbol 'value'
+    Changes in v6:
+      - fix build error
+    Changes in v5:
+      - remove unused macros
+      - switch to using devm_led_classdev_register_ext (struct st1202_led update)
+      - add prescalar_to_milliseconds (convert [22..5660]ms to [0..255] reg value)
+      - remove register range check in dt_init (range protected by yaml)
+      - address all review comments in v4
+    Changes in v4:
+      - Remove attributes/extended attributes implementation
+      - Use /sys/class/leds/<led>/hw_pattern (Pavel suggestion)
+      - Implement review findings of Christophe JAILLET
+    Changes in v3:
+      - Rename all ll1202 to st1202, including driver file name
+      - Convert all magic numbers to defines
+      - Refactor the show/store callbacks as per Lee's and Thomas's review
+      - Remove ll1202_get_channel and use dev_ext_attributes instead
+      - Log all error values for all the functions
+      - Use sysfs_emit for show callbacks
+    Changes in v2:
+      - Fix build error for device_attribute modes
+
+ drivers/leds/Kconfig       |  10 +
+ drivers/leds/Makefile      |   1 +
+ drivers/leds/leds-st1202.c | 416 +++++++++++++++++++++++++++++++++++++
+ 3 files changed, 427 insertions(+)
+ create mode 100644 drivers/leds/leds-st1202.c
+
+--- a/drivers/leds/Kconfig
++++ b/drivers/leds/Kconfig
+@@ -931,6 +931,16 @@ config LEDS_LM36274
+ 	  Say Y to enable the LM36274 LED driver for TI LMU devices.
+ 	  This supports the LED device LM36274.
+ 
++config LEDS_ST1202
++	tristate "LED Support for STMicroelectronics LED1202 I2C chips"
++	depends on LEDS_CLASS
++	depends on I2C
++	depends on OF
++	select LEDS_TRIGGERS
++	help
++	  Say Y to enable support for LEDs connected to LED1202
++	  LED driver chips accessed via the I2C bus.
++
+ config LEDS_TPS6105X
+ 	tristate "LED support for TI TPS6105X"
+ 	depends on LEDS_CLASS
+--- a/drivers/leds/Makefile
++++ b/drivers/leds/Makefile
+@@ -82,6 +82,7 @@ obj-$(CONFIG_LEDS_PWM)			+= leds-pwm.o
+ obj-$(CONFIG_LEDS_REGULATOR)		+= leds-regulator.o
+ obj-$(CONFIG_LEDS_SC27XX_BLTC)		+= leds-sc27xx-bltc.o
+ obj-$(CONFIG_LEDS_SUN50I_A100)		+= leds-sun50i-a100.o
++obj-$(CONFIG_LEDS_ST1202)		+= leds-st1202.o
+ obj-$(CONFIG_LEDS_SUNFIRE)		+= leds-sunfire.o
+ obj-$(CONFIG_LEDS_SYSCON)		+= leds-syscon.o
+ obj-$(CONFIG_LEDS_TCA6507)		+= leds-tca6507.o
+--- /dev/null
++++ b/drivers/leds/leds-st1202.c
+@@ -0,0 +1,416 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * LED driver for STMicroelectronics LED1202 chip
++ *
++ * Copyright (C) 2024 Remote-Tech Ltd. UK
++ */
++
++#include <linux/cleanup.h>
++#include <linux/ctype.h>
++#include <linux/delay.h>
++#include <linux/err.h>
++#include <linux/gpio.h>
++#include <linux/i2c.h>
++#include <linux/leds.h>
++#include <linux/module.h>
++#include <linux/slab.h>
++#include <linux/string.h>
++
++#define ST1202_CHAN_DISABLE_ALL            0x00
++#define ST1202_CHAN_ENABLE_HIGH            0x03
++#define ST1202_CHAN_ENABLE_LOW             0x02
++#define ST1202_CONFIG_REG                  0x04
++/* PATS: Pattern sequence feature enable */
++#define ST1202_CONFIG_REG_PATS             BIT(7)
++/* PATSR: Pattern sequence runs (self-clear when sequence is finished) */
++#define ST1202_CONFIG_REG_PATSR            BIT(6)
++#define ST1202_CONFIG_REG_SHFT             BIT(3)
++#define ST1202_DEV_ENABLE                  0x01
++#define ST1202_DEV_ENABLE_ON               BIT(0)
++#define ST1202_DEV_ENABLE_RESET            BIT(7)
++#define ST1202_DEVICE_ID                   0x00
++#define ST1202_ILED_REG0                   0x09
++#define ST1202_MAX_LEDS                    12
++#define ST1202_MAX_PATTERNS                8
++#define ST1202_MILLIS_PATTERN_DUR_MAX      5660
++#define ST1202_MILLIS_PATTERN_DUR_MIN      22
++#define ST1202_PATTERN_DUR                 0x16
++#define ST1202_PATTERN_PWM                 0x1E
++#define ST1202_PATTERN_REP                 0x15
++
++struct st1202_led {
++	struct fwnode_handle *fwnode;
++	struct led_classdev led_cdev;
++	struct st1202_chip *chip;
++	bool is_active;
++	int led_num;
++};
++
++struct st1202_chip {
++	struct i2c_client *client;
++	struct mutex lock;
++	struct st1202_led leds[ST1202_MAX_LEDS];
++};
++
++static struct st1202_led *cdev_to_st1202_led(struct led_classdev *cdev)
++{
++	return container_of(cdev, struct st1202_led, led_cdev);
++}
++
++static int st1202_read_reg(struct st1202_chip *chip, int reg, uint8_t *val)
++{
++	struct device *dev = &chip->client->dev;
++	int ret;
++
++	ret = i2c_smbus_read_byte_data(chip->client, reg);
++	if (ret < 0) {
++		dev_err(dev, "Failed to read register [0x%x]: %d\n", reg, ret);
++		return ret;
++	}
++
++	*val = (uint8_t)ret;
++	return 0;
++}
++
++static int st1202_write_reg(struct st1202_chip *chip, int reg, uint8_t val)
++{
++	struct device *dev = &chip->client->dev;
++	int ret;
++
++	ret = i2c_smbus_write_byte_data(chip->client, reg, val);
++	if (ret != 0)
++		dev_err(dev, "Failed to write %d to register [0x%x]: %d\n", val, reg, ret);
++
++	return ret;
++}
++
++static uint8_t st1202_prescalar_to_miliseconds(unsigned int value)
++{
++	return value / ST1202_MILLIS_PATTERN_DUR_MIN - 1;
++}
++
++static int st1202_pwm_pattern_write(struct st1202_chip *chip, int led_num,
++				int pattern, unsigned int value)
++{
++	u8 value_l, value_h;
++	int ret;
++
++	value_l = (u8)value;
++	value_h = (u8)(value >> 8);
++
++	/*
++	 *  Datasheet: Register address low = 1Eh + 2*(xh) + 18h*(yh),
++	 *  where x is the channel number (led number) in hexadecimal (x = 00h .. 0Bh)
++	 *  and y is the pattern number in hexadecimal (y = 00h .. 07h)
++	 */
++	ret = st1202_write_reg(chip, (ST1202_PATTERN_PWM + (led_num * 2) + 0x18 * pattern),
++				value_l);
++	if (ret != 0)
++		return ret;
++
++	/*
++	 * Datasheet: Register address high = 1Eh + 01h + 2(xh) +18h*(yh),
++	 * where x is the channel number in hexadecimal (x = 00h .. 0Bh)
++	 * and y is the pattern number in hexadecimal (y = 00h .. 07h)
++	 */
++	ret = st1202_write_reg(chip, (ST1202_PATTERN_PWM + 0x1 + (led_num * 2) + 0x18 * pattern),
++				value_h);
++	if (ret != 0)
++		return ret;
++
++	return 0;
++}
++
++static int st1202_duration_pattern_write(struct st1202_chip *chip, int pattern,
++					unsigned int value)
++{
++	return st1202_write_reg(chip, (ST1202_PATTERN_DUR + pattern),
++				st1202_prescalar_to_miliseconds(value));
++}
++
++static void st1202_brightness_set(struct led_classdev *led_cdev,
++				enum led_brightness value)
++{
++	struct st1202_led *led = cdev_to_st1202_led(led_cdev);
++	struct st1202_chip *chip = led->chip;
++
++	guard(mutex)(&chip->lock);
++
++	st1202_write_reg(chip, ST1202_ILED_REG0 + led->led_num, value);
++}
++
++static enum led_brightness st1202_brightness_get(struct led_classdev *led_cdev)
++{
++	struct st1202_led *led = cdev_to_st1202_led(led_cdev);
++	struct st1202_chip *chip = led->chip;
++	u8 value = 0;
++
++	guard(mutex)(&chip->lock);
++
++	st1202_read_reg(chip, ST1202_ILED_REG0 + led->led_num, &value);
++
++	return value;
++}
++
++static int st1202_channel_set(struct st1202_chip *chip, int led_num, bool active)
++{
++	u8 chan_low, chan_high;
++	int ret;
++
++	guard(mutex)(&chip->lock);
++
++	if (led_num <= 7) {
++		ret = st1202_read_reg(chip, ST1202_CHAN_ENABLE_LOW, &chan_low);
++		if (ret < 0)
++			return ret;
++
++		chan_low = active ? chan_low | BIT(led_num) : chan_low & ~BIT(led_num);
++
++		ret = st1202_write_reg(chip, ST1202_CHAN_ENABLE_LOW, chan_low);
++		if (ret < 0)
++			return ret;
++
++	} else {
++		ret = st1202_read_reg(chip, ST1202_CHAN_ENABLE_HIGH, &chan_high);
++		if (ret < 0)
++			return ret;
++
++		chan_high = active ? chan_high | (BIT(led_num) >> 8) :
++					chan_high & ~(BIT(led_num) >> 8);
++
++		ret = st1202_write_reg(chip, ST1202_CHAN_ENABLE_HIGH, chan_high);
++		if (ret < 0)
++			return ret;
++	}
++
++	return 0;
++}
++
++static int st1202_led_set(struct led_classdev *ldev, enum led_brightness value)
++{
++	struct st1202_led *led = cdev_to_st1202_led(ldev);
++	struct st1202_chip *chip = led->chip;
++
++	return st1202_channel_set(chip, led->led_num, value == LED_OFF ? false : true);
++}
++
++static int st1202_led_pattern_clear(struct led_classdev *ldev)
++{
++	struct st1202_led *led = cdev_to_st1202_led(ldev);
++	struct st1202_chip *chip = led->chip;
++	int ret;
++
++	guard(mutex)(&chip->lock);
++
++	for (int patt = 0; patt < ST1202_MAX_PATTERNS; patt++) {
++		ret = st1202_pwm_pattern_write(chip, led->led_num, patt, LED_OFF);
++		if (ret != 0)
++			return ret;
++
++		ret = st1202_duration_pattern_write(chip, patt, ST1202_MILLIS_PATTERN_DUR_MIN);
++		if (ret != 0)
++			return ret;
++	}
++
++	return 0;
++}
++
++static int st1202_led_pattern_set(struct led_classdev *ldev,
++				struct led_pattern *pattern,
++				u32 len, int repeat)
++{
++	struct st1202_led *led = cdev_to_st1202_led(ldev);
++	struct st1202_chip *chip = led->chip;
++	int ret;
++
++	if (len > ST1202_MAX_PATTERNS)
++		return -EINVAL;
++
++	guard(mutex)(&chip->lock);
++
++	for (int patt = 0; patt < len; patt++) {
++		if (pattern[patt].delta_t < ST1202_MILLIS_PATTERN_DUR_MIN ||
++				pattern[patt].delta_t > ST1202_MILLIS_PATTERN_DUR_MAX)
++			return -EINVAL;
++
++		ret = st1202_pwm_pattern_write(chip, led->led_num, patt, pattern[patt].brightness);
++		if (ret != 0)
++			return ret;
++
++		ret = st1202_duration_pattern_write(chip, patt, pattern[patt].delta_t);
++		if (ret != 0)
++			return ret;
++	}
++
++	ret = st1202_write_reg(chip, ST1202_PATTERN_REP, repeat);
++	if (ret != 0)
++		return ret;
++
++	ret = st1202_write_reg(chip, ST1202_CONFIG_REG, (ST1202_CONFIG_REG_PATSR |
++							ST1202_CONFIG_REG_PATS | ST1202_CONFIG_REG_SHFT));
++	if (ret != 0)
++		return ret;
++
++	return 0;
++}
++
++static int st1202_dt_init(struct st1202_chip *chip)
++{
++	struct device *dev = &chip->client->dev;
++	struct st1202_led *led;
++	int err, reg;
++
++	for_each_available_child_of_node_scoped(dev_of_node(dev), child) {
++		struct led_init_data init_data = {};
++
++		err = of_property_read_u32(child, "reg", &reg);
++		if (err)
++			return dev_err_probe(dev, err, "Invalid register\n");
++
++		led = &chip->leds[reg];
++		led->is_active = true;
++		led->fwnode = of_fwnode_handle(child);
++
++		led->led_cdev.max_brightness = U8_MAX;
++		led->led_cdev.brightness_set_blocking = st1202_led_set;
++		led->led_cdev.pattern_set = st1202_led_pattern_set;
++		led->led_cdev.pattern_clear = st1202_led_pattern_clear;
++		led->led_cdev.default_trigger = "pattern";
++
++		init_data.fwnode = led->fwnode;
++		init_data.devicename = "st1202";
++		init_data.default_label = ":";
++
++		err = devm_led_classdev_register_ext(dev, &led->led_cdev, &init_data);
++		if (err < 0)
++			return dev_err_probe(dev, err, "Failed to register LED class device\n");
++
++		led->led_cdev.brightness_set = st1202_brightness_set;
++		led->led_cdev.brightness_get = st1202_brightness_get;
++	}
++
++	return 0;
++}
++
++static int st1202_setup(struct st1202_chip *chip)
++{
++	int ret;
++
++	guard(mutex)(&chip->lock);
++
++	/*
++	 * Once the supply voltage is applied, the LED1202 executes some internal checks,
++	 * afterwords it stops the oscillator and puts the internal LDO in quiescent mode.
++	 * To start the device, EN bit must be set inside the “Device Enable” register at
++	 * address 01h. As soon as EN is set, the LED1202 loads the adjustment parameters
++	 * from the internal non-volatile memory and performs an auto-calibration procedure
++	 * in order to increase the output current precision.
++	 * Such initialization lasts about 6.5 ms.
++	 */
++
++	/* Reset the chip during setup */
++	ret = st1202_write_reg(chip, ST1202_DEV_ENABLE, ST1202_DEV_ENABLE_RESET);
++	if (ret < 0)
++		return ret;
++
++	/* Enable phase-shift delay feature */
++	ret = st1202_write_reg(chip, ST1202_CONFIG_REG, ST1202_CONFIG_REG_SHFT);
++	if (ret < 0)
++		return ret;
++
++	/* Enable the device */
++	ret = st1202_write_reg(chip, ST1202_DEV_ENABLE, ST1202_DEV_ENABLE_ON);
++	if (ret < 0)
++		return ret;
++
++	/* Duration of initialization */
++	usleep_range(6500, 10000);
++
++	/* Deactivate all LEDS (channels) and activate only the ones found in Device Tree */
++	ret = st1202_write_reg(chip, ST1202_CHAN_ENABLE_LOW, ST1202_CHAN_DISABLE_ALL);
++	if (ret < 0)
++		return ret;
++
++	ret = st1202_write_reg(chip, ST1202_CHAN_ENABLE_HIGH, ST1202_CHAN_DISABLE_ALL);
++	if (ret < 0)
++		return ret;
++
++	ret = st1202_write_reg(chip, ST1202_CONFIG_REG,
++				ST1202_CONFIG_REG_PATS | ST1202_CONFIG_REG_PATSR);
++	if (ret < 0)
++		return ret;
++
++	return 0;
++}
++
++static int st1202_probe(struct i2c_client *client)
++{
++	struct st1202_chip *chip;
++	struct st1202_led *led;
++	int ret;
++
++	if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_BYTE_DATA))
++		return dev_err_probe(&client->dev, -EIO, "SMBUS Byte Data not Supported\n");
++
++	chip = devm_kzalloc(&client->dev, sizeof(*chip), GFP_KERNEL);
++	if (!chip)
++		return -ENOMEM;
++
++	devm_mutex_init(&client->dev, &chip->lock);
++	chip->client = client;
++
++	ret = st1202_dt_init(chip);
++	if (ret < 0)
++		return ret;
++
++	ret = st1202_setup(chip);
++	if (ret < 0)
++		return ret;
++
++	for (int i = 0; i < ST1202_MAX_LEDS; i++) {
++		led = &chip->leds[i];
++		led->chip = chip;
++		led->led_num = i;
++
++		if (!led->is_active)
++			continue;
++
++		ret = st1202_channel_set(led->chip, led->led_num, true);
++		if (ret < 0)
++			return dev_err_probe(&client->dev, ret,
++					"Failed to activate LED channel\n");
++
++		ret = st1202_led_pattern_clear(&led->led_cdev);
++		if (ret < 0)
++			return dev_err_probe(&client->dev, ret,
++					"Failed to clear LED pattern\n");
++	}
++
++	return 0;
++}
++
++static const struct i2c_device_id st1202_id[] = {
++	{ "st1202-i2c" },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(i2c, st1202_id);
++
++static const struct of_device_id st1202_dt_ids[] = {
++	{ .compatible = "st,led1202" },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, st1202_dt_ids);
++
++static struct i2c_driver st1202_driver = {
++	.driver = {
++		.name = "leds-st1202",
++		.of_match_table = of_match_ptr(st1202_dt_ids),
++	},
++	.probe = st1202_probe,
++	.id_table = st1202_id,
++};
++module_i2c_driver(st1202_driver);
++
++MODULE_AUTHOR("Remote Tech LTD");
++MODULE_DESCRIPTION("STMicroelectronics LED1202 : 12-channel constant current LED driver");
++MODULE_LICENSE("GPL");
diff --git a/6.12/target/linux/generic/pending-6.12/893-leds_st1202-Fix-NULL-pointer-access-error.patch b/6.12/target/linux/generic/pending-6.12/893-leds_st1202-Fix-NULL-pointer-access-error.patch
new file mode 100644
index 00000000..d763c5df
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/893-leds_st1202-Fix-NULL-pointer-access-error.patch
@@ -0,0 +1,70 @@
+From e3da313ebcace17f1227566fe1b0d0c3883061f9 Mon Sep 17 00:00:00 2001
+From: Manuel Fombuena <fombuena@outlook.com>
+Date: Fri, 17 Jan 2025 12:31:49 +0000
+Subject: [PATCH 1/5] leds: leds-st1202: fix NULL pointer access on race
+ condition
+
+st1202_dt_init() calls devm_led_classdev_register_ext() before the
+internal data structures are properly setup, so the leds become visible
+to user space while being partially initialized, leading to a window
+where trying to access them causes a NULL pointer access.
+
+This change moves devm_led_classdev_register_ext() to the last thing to
+happen during initialization to eliminate it.
+
+Signed-off-by: Manuel Fombuena <fombuena@outlook.com>
+---
+ drivers/leds/leds-st1202.c | 21 ++++++++++-----------
+ 1 file changed, 10 insertions(+), 11 deletions(-)
+
+--- a/drivers/leds/leds-st1202.c
++++ b/drivers/leds/leds-st1202.c
+@@ -261,8 +261,6 @@ static int st1202_dt_init(struct st1202_
+ 	int err, reg;
+ 
+ 	for_each_available_child_of_node_scoped(dev_of_node(dev), child) {
+-		struct led_init_data init_data = {};
+-
+ 		err = of_property_read_u32(child, "reg", &reg);
+ 		if (err)
+ 			return dev_err_probe(dev, err, "Invalid register\n");
+@@ -276,15 +274,6 @@ static int st1202_dt_init(struct st1202_
+ 		led->led_cdev.pattern_set = st1202_led_pattern_set;
+ 		led->led_cdev.pattern_clear = st1202_led_pattern_clear;
+ 		led->led_cdev.default_trigger = "pattern";
+-
+-		init_data.fwnode = led->fwnode;
+-		init_data.devicename = "st1202";
+-		init_data.default_label = ":";
+-
+-		err = devm_led_classdev_register_ext(dev, &led->led_cdev, &init_data);
+-		if (err < 0)
+-			return dev_err_probe(dev, err, "Failed to register LED class device\n");
+-
+ 		led->led_cdev.brightness_set = st1202_brightness_set;
+ 		led->led_cdev.brightness_get = st1202_brightness_get;
+ 	}
+@@ -368,6 +357,7 @@ static int st1202_probe(struct i2c_clien
+ 		return ret;
+ 
+ 	for (int i = 0; i < ST1202_MAX_LEDS; i++) {
++		struct led_init_data init_data = {};
+ 		led = &chip->leds[i];
+ 		led->chip = chip;
+ 		led->led_num = i;
+@@ -384,6 +374,15 @@ static int st1202_probe(struct i2c_clien
+ 		if (ret < 0)
+ 			return dev_err_probe(&client->dev, ret,
+ 					"Failed to clear LED pattern\n");
++
++		init_data.fwnode = led->fwnode;
++		init_data.devicename = "st1202";
++		init_data.default_label = ":";
++
++		ret = devm_led_classdev_register_ext(&client->dev, &led->led_cdev, &init_data);
++		if (ret < 0)
++			return dev_err_probe(&client->dev, ret,
++					"Failed to register LED class device\n");
+ 	}
+ 
+ 	return 0;
diff --git a/6.12/target/linux/generic/pending-6.12/900-net-ag71xx-fix-qca9530-and-qca9550-mdio-probe.patch b/6.12/target/linux/generic/pending-6.12/900-net-ag71xx-fix-qca9530-and-qca9550-mdio-probe.patch
new file mode 100644
index 00000000..c0e318e8
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/900-net-ag71xx-fix-qca9530-and-qca9550-mdio-probe.patch
@@ -0,0 +1,25 @@
+From 440415703692af4548e836832ef0434e87fbc357 Mon Sep 17 00:00:00 2001
+From: Oskari Lemmela <oskari@lemmela.net>
+Date: Sat, 13 Jul 2024 18:56:59 +0300
+Subject: [PATCH] net: ag71xx: fix qca9530 and qca9550 mdio probe
+
+Newer QCA9530 and QCA9550 devices should use same div table as AR933X.
+
+Fixes: d51b6ce441d3 ("net: ethernet: add ag71xx driver")
+Signed-off-by: Oskari Lemmela <oskari@lemmela.net>
+---
+ drivers/net/ethernet/atheros/ag71xx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/atheros/ag71xx.c
++++ b/drivers/net/ethernet/atheros/ag71xx.c
+@@ -641,7 +641,8 @@ static int ag71xx_mdio_get_divider(struc
+ 	if (!ref_clock)
+ 		return -EINVAL;
+ 
+-	if (ag71xx_is(ag, AR9330) || ag71xx_is(ag, AR9340)) {
++	if (ag71xx_is(ag, AR9330) || ag71xx_is(ag, AR9340) ||
++	    ag71xx_is(ag, QCA9530) || ag71xx_is(ag, QCA9550)) {
+ 		table = ar933x_mdio_div_table;
+ 		ndivs = ARRAY_SIZE(ar933x_mdio_div_table);
+ 	} else if (ag71xx_is(ag, AR7240)) {
diff --git a/6.12/target/linux/generic/pending-6.12/920-mangle_bootargs.patch b/6.12/target/linux/generic/pending-6.12/920-mangle_bootargs.patch
new file mode 100644
index 00000000..b299a67b
--- /dev/null
+++ b/6.12/target/linux/generic/pending-6.12/920-mangle_bootargs.patch
@@ -0,0 +1,71 @@
+From: Imre Kaloz <kaloz@openwrt.org>
+Subject: init: add CONFIG_MANGLE_BOOTARGS and disable it by default
+
+Enabling this option renames the bootloader supplied root=
+and rootfstype= variables, which might have to be know but
+would break the automatisms OpenWrt uses.
+
+Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
+---
+ init/Kconfig |  9 +++++++++
+ init/main.c  | 24 ++++++++++++++++++++++++
+ 2 files changed, 33 insertions(+)
+
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1879,6 +1879,15 @@ config ARCH_HAS_MEMBARRIER_CALLBACKS
+ config ARCH_HAS_MEMBARRIER_SYNC_CORE
+ 	bool
+ 
++config MANGLE_BOOTARGS
++	bool "Rename offending bootargs"
++	depends on EXPERT
++	help
++	  Sometimes the bootloader passed bogus root= and rootfstype=
++	  parameters to the kernel, and while you want to ignore them,
++	  you need to know the values f.e. to support dual firmware
++	  layouts on the flash.
++
+ config HAVE_PERF_EVENTS
+ 	bool
+ 	help
+--- a/init/main.c
++++ b/init/main.c
+@@ -621,6 +621,29 @@ static inline void setup_nr_cpu_ids(void
+ static inline void smp_prepare_cpus(unsigned int maxcpus) { }
+ #endif
+ 
++#ifdef CONFIG_MANGLE_BOOTARGS
++static void __init mangle_bootargs(char *command_line)
++{
++	char *rootdev;
++	char *rootfs;
++
++	rootdev = strstr(command_line, "root=/dev/mtdblock");
++
++	if (rootdev)
++		strncpy(rootdev, "mangled_rootblock=", 18);
++
++	rootfs = strstr(command_line, "rootfstype");
++
++	if (rootfs)
++		strncpy(rootfs, "mangled_fs", 10);
++
++}
++#else
++static void __init mangle_bootargs(char *command_line)
++{
++}
++#endif
++
+ /*
+  * We need to store the untouched command line for future reference.
+  * We also need to store the touched command line since the parameter
+@@ -927,6 +950,7 @@ void start_kernel(void)
+ 	jump_label_init();
+ 	static_call_init();
+ 	early_security_init();
++	mangle_bootargs(command_line);
+ 	setup_boot_config();
+ 	setup_command_line(command_line);
+ 	setup_nr_cpu_ids();
diff --git a/6.12/target/linux/mediatek/dts/mt7981b-zbt-z8102ax-128m.dts b/6.12/target/linux/mediatek/dts/mt7981b-zbt-z8102ax-128m.dts
new file mode 100644
index 00000000..b272ec0e
--- /dev/null
+++ b/6.12/target/linux/mediatek/dts/mt7981b-zbt-z8102ax-128m.dts
@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT 
+
+#include "mt7981b-zbt-z8102ax.dtsi"
+
+/ {
+	model = "ZBT Z8102AX 128M";
+	compatible = "z8102ax-128m", "z8102ax", "mediatek,mt7981";
+};
+
+&nand_rootfs {
+	reg = <0x0580000 0x7220000>;
+};
+
diff --git a/6.12/target/linux/mediatek/dts/mt7981b-zbt-z8102ax-64m.dts b/6.12/target/linux/mediatek/dts/mt7981b-zbt-z8102ax-64m.dts
new file mode 100644
index 00000000..80533529
--- /dev/null
+++ b/6.12/target/linux/mediatek/dts/mt7981b-zbt-z8102ax-64m.dts
@@ -0,0 +1,14 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT 
+
+#include "mt7981b-zbt-z8102ax.dtsi"
+
+/ {
+	model = "ZBT Z8102AX 64M";
+	compatible = "z8102ax-64m", "z8102ax", "mediatek,mt7981";
+};
+
+
+&nand_rootfs {
+	reg = <0x0580000 0x4000000>;
+};
+
diff --git a/6.12/target/linux/mediatek/dts/mt7981b-zbt-z8102ax.dtsi b/6.12/target/linux/mediatek/dts/mt7981b-zbt-z8102ax.dtsi
new file mode 100644
index 00000000..75dd2b27
--- /dev/null
+++ b/6.12/target/linux/mediatek/dts/mt7981b-zbt-z8102ax.dtsi
@@ -0,0 +1,339 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT 
+
+/dts-v1/;
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+#include "mt7981.dtsi"
+
+/ {
+	model = "ZBT Z8102AX";
+	compatible = "z8102ax", "mediatek,mt7981", "zbtlink,zbt-z8102ax";
+
+	aliases {
+		serial0 = &uart0;
+		led-boot = &led_status_green;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_green;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs = "earlycon=uart8250,mmio32,0x11002000 console=ttyS0,115200n8 loglevel=8";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+		};
+		
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_red: red {
+			label = "red:status";
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+		};
+
+		led_status_green: green {
+			label = "green:status";
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+		};
+		
+		led_status_blue: blue {
+			label = "blue:status";
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+		};
+		
+		led_status_modem1: modem1 {
+			label = "modem1:status";
+			gpios = <&pio 8 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_USB;
+			function-enumerator = <0>;
+		};
+		
+		led_status_modem2: modem2 {
+			label = "modem2:status";
+			gpios = <&pio 13 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_USB;
+			function-enumerator = <1>;
+		};
+	};
+
+	watchdog {
+		compatible = "linux,wdt-gpio";
+		gpios = <&pio 2 GPIO_ACTIVE_HIGH>;
+		hw_algo = "toggle";
+		hw_margin_ms = <1000>;
+	};
+
+	gpio-export {
+		compatible = "gpio-export";
+		#size-cells = <0>;
+
+		pcie {
+			gpio-export,name = "pcie_power";
+			gpio-export,output = <1>;
+			gpios = <&pio 3 GPIO_ACTIVE_HIGH>;
+		};
+
+		modem1 {
+			gpio-export,name = "modem1";
+			gpio-export,output = <1>;
+			gpios = <&pio 4 GPIO_ACTIVE_HIGH>;
+		};
+
+		modem2 {
+			gpio-export,name = "modem2";
+			gpio-export,output = <1>;
+			gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
+		};
+
+		sim1 {
+			gpio-export,name = "sim1";
+			gpio-export,output = <1>;
+			gpios = <&pio 6 GPIO_ACTIVE_HIGH>;
+		};
+
+		sim2 {
+			gpio-export,name = "sim2";
+			gpio-export,output = <1>;
+			gpios = <&pio 7 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_factory_004>;
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+	
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "gmii";
+		phy-handle = <&int_gbe_phy>;
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_factory_02a>;
+	};
+};
+
+&mdio_bus {
+	switch: switch@0 {
+		compatible = "mediatek,mt7531";
+		reg = <31>;
+		reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		interrupt-parent = <&pio>;
+		interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "okay";
+
+	spi_nand@0 {
+		compatible = "spi-nand";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0>;
+
+		spi-max-frequency = <52000000>;
+		spi-tx-buswidth = <4>;
+		spi-rx-buswidth = <4>;
+
+		mediatek,nmbm;
+		mediatek,bmt-max-ratio = <1>;
+		mediatek,bmt-max-reserved-blocks = <64>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "bl2";
+				reg = <0x0000000 0x0100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x0100000 0x0080000>;
+			};
+
+			factory: partition@180000 {
+				label = "Factory";
+				reg = <0x0180000 0x0200000>;
+				read-only;
+			};
+
+			partition@380000 {
+				label = "FIP";
+				reg = <0x0380000 0x0200000>;
+				read-only;
+			};
+
+			nand_rootfs: partition@580000 {
+				label = "ubi";
+			};
+		};
+	};
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "lan1";
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_factory_004>;
+		};
+
+		port@1 {
+			reg = <1>;
+			label = "lan2";
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_factory_004>;
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan3";
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_factory_004>;
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan4";
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_factory_004>;
+		};
+
+		port@6 {
+			reg = <6>;
+			label = "cpu";
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&pio {
+	gpio-line-names = 
+			"wps",
+			"reset",
+			"watchdog",
+			"pcie",
+			"modem1",
+			"modem2",
+			"sim1",
+			"sim2",
+			"modem1_status",
+			"red_status",
+			"green_status",
+			"blue_status",
+			"",
+			"",
+			"modem2_status";
+
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <8>;
+			mediatek,pull-up-adv = <0>; /* bias-disable */
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <8>;
+			mediatek,pull-up-adv = <0>; /* bias-disable */
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&xhci {
+	status = "okay";
+};
+
+&wifi {
+	status = "okay";
+	mediatek,mtd-eeprom = <&factory 0x0>;
+};
+
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_004: macaddr@004 {
+		reg = <0x004 0x6>;
+	};
+	macaddr_factory_02a: macaddr@02a {
+		reg = <0x02a 0x6>;
+	};
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7981-rfb-mxl-2p5g-phy-eth1.dtso b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7981-rfb-mxl-2p5g-phy-eth1.dtso
new file mode 100644
index 00000000..4d0e5c04
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7981-rfb-mxl-2p5g-phy-eth1.dtso
@@ -0,0 +1,32 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR MIT) */
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	compatible = "mediatek,mt7981-rfb", "mediatek,mt7981";
+
+	fragment@0 {
+		target = <&gmac1>;
+		__overlay__ {
+			phy-mode = "2500base-x";
+			phy-handle = <&phy5>;
+		};
+	};
+
+	fragment@1 {
+		target = <&mdio_bus>;
+		__overlay__ {
+			reset-gpios = <&pio 14 GPIO_ACTIVE_LOW>;
+			reset-delay-us = <600>;
+			reset-post-delay-us = <20000>;
+
+			phy5: ethernet-phy@5 {
+				reg = <5>;
+				compatible = "ethernet-phy-ieee802.3-c45";
+				phy-mode = "2500base-x";
+			};
+		};
+	};
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7981-rfb-mxl-2p5g-phy-swp5.dtso b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7981-rfb-mxl-2p5g-phy-swp5.dtso
new file mode 100644
index 00000000..710e6c0b
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7981-rfb-mxl-2p5g-phy-swp5.dtso
@@ -0,0 +1,33 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR MIT) */
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	compatible = "mediatek,mt7981-rfb", "mediatek,mt7981";
+
+	fragment@0 {
+		target = <&sw_p5>;
+		__overlay__ {
+			phy-mode = "2500base-x";
+			phy-handle = <&phy5>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&mdio_bus>;
+		__overlay__ {
+			reset-gpios = <&pio 14 GPIO_ACTIVE_LOW>;
+			reset-delay-us = <600>;
+			reset-post-delay-us = <20000>;
+
+			phy5: ethernet-phy@5 {
+				reg = <5>;
+				compatible = "ethernet-phy-ieee802.3-c45";
+				phy-mode = "2500base-x";
+			};
+		};
+	};
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7981-rfb-spim-nand.dtso b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7981-rfb-spim-nand.dtso
new file mode 100644
index 00000000..ab53f96c
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7981-rfb-spim-nand.dtso
@@ -0,0 +1,78 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR MIT) */
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "mediatek,mt7981-rfb", "mediatek,mt7981";
+
+	fragment@0 {
+		target = <&chosen>;
+		rootdisk-spim-nand = <&ubi_rootdisk>;
+	};
+
+	fragment@1 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			spi_nand: spi_nand@0 {
+				#address-cells = <1>;
+				#size-cells = <1>;
+				compatible = "spi-nand";
+				reg = <1>;
+				spi-max-frequency = <10000000>;
+				spi-tx-bus-width = <4>;
+				spi-rx-bus-width = <4>;
+
+				partitions {
+					compatible = "fixed-partitions";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					partition@0 {
+						label = "BL2";
+						reg = <0x00000 0x0100000>;
+						read-only;
+					};
+
+					partition@100000 {
+						label = "u-boot-env";
+						reg = <0x0100000 0x0080000>;
+					};
+
+					factory: partition@180000 {
+						label = "Factory";
+						reg = <0x180000 0x0200000>;
+					};
+
+					partition@380000 {
+						label = "FIP";
+						reg = <0x380000 0x0200000>;
+					};
+
+					partition@580000 {
+						label = "ubi";
+						reg = <0x580000 0x4000000>;
+						compatible = "linux,ubi";
+
+						volumes {
+							ubi_rootdisk: ubi-volume-fit {
+								volname = "fit";
+							};
+						};
+					};
+				};
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&wifi>;
+		__overlay__ {
+			mediatek,mtd-eeprom = <&factory 0x0>;
+			status = "okay";
+		};
+	};
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7981-rfb.dts b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7981-rfb.dts
new file mode 100644
index 00000000..791b5611
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7981-rfb.dts
@@ -0,0 +1,189 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2022 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+/dts-v1/;
+#include "mt7981.dtsi"
+
+/ {
+	model = "MediaTek MT7981 RFB";
+	compatible = "mediatek,mt7981-rfb", "mediatek,mt7981";
+
+	aliases {
+		serial0 = &uart0;
+	};
+
+	chosen: chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs-append = " root=/dev/fit0 rootwait";
+	};
+
+	memory {
+		reg = <0 0x40000000 0 0x20000000>;
+	};
+
+	reg_3p3v: regulator-3p3v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-3.3V";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reg_5v: regulator-5v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-5V";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 0 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "gmii";
+		phy-handle = <&int_gbe_phy>;
+	};
+};
+
+&mdio_bus {
+	switch: switch@1f {
+		compatible = "mediatek,mt7531";
+		reg = <31>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		interrupt-parent = <&pio>;
+		interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
+		reset-gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&crypto {
+	status = "okay";
+};
+
+&pio {
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
+		};
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
+		};
+	};
+
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	cs-gpios = <0>, <0>;
+	#address-cells = <1>;
+	#size-cells = <0>;
+	status = "disabled";
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "lan1";
+		};
+
+		port@1 {
+			reg = <1>;
+			label = "lan2";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan3";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan4";
+		};
+
+		sw_p5: port@5 {
+			reg = <5>;
+			label = "lan5";
+			status = "disabled";
+		};
+
+		port@6 {
+			reg = <6>;
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&xhci {
+	vusb33-supply = <&reg_3p3v>;
+	vbus-supply = <&reg_5v>;
+	status = "okay";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7981.dtsi b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7981.dtsi
new file mode 100644
index 00000000..012c6e4e
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7981.dtsi
@@ -0,0 +1,822 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (c) 2020 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ * Author: Jianhui Zhao <zhaojh329@gmail.com>
+ */
+
+#include <dt-bindings/interrupt-controller/irq.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/phy/phy.h>
+#include <dt-bindings/clock/mediatek,mt7981-clk.h>
+#include <dt-bindings/reset/mt7986-resets.h>
+#include <dt-bindings/pinctrl/mt65xx.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/input/linux-event-codes.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/mux/mux.h>
+
+/ {
+	compatible = "mediatek,mt7981";
+	interrupt-parent = <&gic>;
+	#address-cells = <2>;
+	#size-cells = <2>;
+
+	cpus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		cpu@0 {
+			compatible = "arm,cortex-a53";
+			reg = <0x0>;
+			device_type = "cpu";
+			enable-method = "psci";
+		};
+
+		cpu@1 {
+			compatible = "arm,cortex-a53";
+			reg = <0x1>;
+			device_type = "cpu";
+			enable-method = "psci";
+		};
+	};
+
+	ice: ice_debug {
+		compatible = "mediatek,mt7981-ice_debug", "mediatek,mt2701-ice_debug";
+		clocks = <&infracfg CLK_INFRA_DBG_CK>;
+		clock-names = "ice_dbg";
+	};
+
+	clk40m: oscillator-40m {
+		compatible = "fixed-clock";
+		clock-frequency = <40000000>;
+		clock-output-names = "clkxtal";
+		#clock-cells = <0>;
+	};
+
+	psci {
+		compatible = "arm,psci-0.2";
+		method = "smc";
+	};
+
+	fan: pwm-fan {
+		compatible = "pwm-fan";
+		/* cooling level (0, 1, 2, 3, 4, 5, 6, 7) : (0%/25%/37.5%/50%/62.5%/75%/87.5%/100% duty) */
+		cooling-levels = <0 63 95 127 159 191 223 255>;
+		#cooling-cells = <2>;
+		status = "disabled";
+	};
+
+	reg_3p3v: regulator-3p3v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-3.3V";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reserved-memory {
+		ranges;
+		#address-cells = <2>;
+		#size-cells = <2>;
+
+		/* 64 KiB reserved for ramoops/pstore */
+		ramoops@42ff0000 {
+			compatible = "ramoops";
+			reg = <0 0x42ff0000 0 0x10000>;
+			record-size = <0x1000>;
+		};
+
+		/* 192 KiB reserved for ARM Trusted Firmware (BL31) */
+		secmon_reserved: secmon@43000000 {
+			reg = <0 0x43000000 0 0x30000>;
+			no-map;
+		};
+
+		wmcpu_emi: wmcpu-reserved@47c80000 {
+			reg = <0 0x47c80000 0 0x100000>;
+			no-map;
+		};
+
+		wo_emi0: wo-emi@47d80000 {
+			reg = <0 0x47d80000 0 0x40000>;
+			no-map;
+		};
+
+		wo_data: wo-data@47dc0000 {
+			reg = <0 0x47dc0000 0 0x240000>;
+			no-map;
+		};
+	};
+
+	soc {
+		compatible = "simple-bus";
+		ranges;
+		#address-cells = <2>;
+		#size-cells = <2>;
+
+		gic: interrupt-controller@c000000 {
+			compatible = "arm,gic-v3";
+			reg = <0 0x0c000000 0 0x40000>,  /* GICD */
+			      <0 0x0c080000 0 0x200000>; /* GICR */
+			interrupt-parent = <&gic>;
+			interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-controller;
+			#interrupt-cells = <3>;
+		};
+
+		consys: consys@10000000 {
+			compatible = "mediatek,mt7981-consys";
+			reg = <0 0x10000000 0 0x8600000>;
+			memory-region = <&wmcpu_emi>;
+		};
+
+		infracfg: clock-controller@10001000 {
+			compatible = "mediatek,mt7981-infracfg", "syscon";
+			reg = <0 0x10001000 0 0x1000>;
+			#clock-cells = <1>;
+		};
+
+		wed_pcie: wed_pcie@10003000 {
+			compatible = "mediatek,wed_pcie";
+			reg = <0 0x10003000 0 0x10>;
+		};
+
+		topckgen: clock-controller@1001b000 {
+			compatible = "mediatek,mt7981-topckgen", "syscon";
+			reg = <0 0x1001b000 0 0x1000>;
+			#clock-cells = <1>;
+		};
+
+		watchdog: watchdog@1001c000 {
+			compatible = "mediatek,mt7986-wdt",
+				     "mediatek,mt6589-wdt";
+			reg = <0 0x1001c000 0 0x1000>;
+			interrupts = <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH>;
+			#reset-cells = <1>;
+			status = "disabled";
+		};
+
+		apmixedsys: clock-controller@1001e000 {
+			compatible = "mediatek,mt7981-apmixedsys", "syscon";
+			reg = <0 0x1001e000 0 0x1000>;
+			#clock-cells = <1>;
+		};
+
+		pwm: pwm@10048000 {
+			compatible = "mediatek,mt7981-pwm";
+			reg = <0 0x10048000 0 0x1000>;
+			clocks = <&infracfg CLK_INFRA_PWM_STA>,
+				 <&infracfg CLK_INFRA_PWM_HCK>,
+				 <&infracfg CLK_INFRA_PWM1_CK>,
+				 <&infracfg CLK_INFRA_PWM2_CK>,
+				 <&infracfg CLK_INFRA_PWM3_CK>;
+			clock-names = "top", "main", "pwm1", "pwm2", "pwm3";
+			#pwm-cells = <2>;
+		};
+
+		sgmiisys0: syscon@10060000 {
+			compatible = "mediatek,mt7981-sgmiisys_0", "syscon";
+			reg = <0 0x10060000 0 0x1000>;
+			mediatek,pnswap;
+			#clock-cells = <1>;
+		};
+
+		sgmiisys1: syscon@10070000 {
+			compatible = "mediatek,mt7981-sgmiisys_1", "syscon";
+			reg = <0 0x10070000 0 0x1000>;
+			#clock-cells = <1>;
+		};
+
+		crypto: crypto@10320000 {
+			compatible = "inside-secure,safexcel-eip97";
+			reg = <0 0x10320000 0 0x40000>;
+			interrupts = <GIC_SPI 116 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 118 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 119 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "ring0", "ring1", "ring2", "ring3";
+			clocks = <&topckgen CLK_TOP_EIP97B>;
+			clock-names = "top_eip97_ck";
+			assigned-clocks = <&topckgen CLK_TOP_EIP97B_SEL>;
+			assigned-clock-parents = <&topckgen CLK_TOP_CB_NET1_D5>;
+		};
+
+		uart0: serial@11002000 {
+			compatible = "mediatek,mt6577-uart";
+			reg = <0 0x11002000 0 0x400>;
+			interrupts = <GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&infracfg CLK_INFRA_UART0_SEL>,
+				 <&infracfg CLK_INFRA_UART0_CK>;
+			clock-names = "baud", "bus";
+			assigned-clocks = <&topckgen CLK_TOP_UART_SEL>,
+					  <&infracfg CLK_INFRA_UART0_SEL>;
+			assigned-clock-parents = <&topckgen CLK_TOP_CB_CKSQ_40M>,
+						 <&topckgen CLK_TOP_UART_SEL>;
+			pinctrl-0 = <&uart0_pins>;
+			pinctrl-names = "default";
+			status = "disabled";
+		};
+
+		uart1: serial@11003000 {
+			compatible = "mediatek,mt6577-uart";
+			reg = <0 0x11003000 0 0x400>;
+			interrupts = <GIC_SPI 124 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&infracfg CLK_INFRA_UART1_SEL>,
+				 <&infracfg CLK_INFRA_UART1_CK>;
+			clock-names = "baud", "bus";
+			assigned-clocks = <&topckgen CLK_TOP_UART_SEL>,
+					  <&infracfg CLK_INFRA_UART1_SEL>;
+			assigned-clock-parents = <&topckgen CLK_TOP_CB_CKSQ_40M>,
+						 <&topckgen CLK_TOP_UART_SEL>;
+			status = "disabled";
+		};
+
+		uart2: serial@11004000 {
+			compatible = "mediatek,mt6577-uart";
+			reg = <0 0x11004000 0 0x400>;
+			interrupts = <GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&infracfg CLK_INFRA_UART2_SEL>,
+				 <&infracfg CLK_INFRA_UART2_CK>;
+			clock-names = "baud", "bus";
+			assigned-clocks = <&topckgen CLK_TOP_UART_SEL>,
+					  <&infracfg CLK_INFRA_UART2_SEL>;
+			assigned-clock-parents = <&topckgen CLK_TOP_CB_CKSQ_40M>,
+						 <&topckgen CLK_TOP_UART_SEL>;
+			status = "disabled";
+		};
+
+		snand: snfi@11005000 {
+			compatible = "mediatek,mt7986-snand";
+			reg = <0 0x11005000 0 0x1000>, <0 0x11006000 0 0x1000>;
+			reg-names = "nfi", "ecc";
+			interrupts = <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&infracfg CLK_INFRA_SPINFI1_CK>,
+				 <&infracfg CLK_INFRA_NFI1_CK>,
+				 <&infracfg CLK_INFRA_NFI_HCK_CK>;
+			clock-names = "pad_clk", "nfi_clk", "nfi_hclk";
+			assigned-clocks = <&topckgen CLK_TOP_SPINFI_SEL>,
+					  <&topckgen CLK_TOP_NFI1X_SEL>;
+			assigned-clock-parents = <&topckgen CLK_TOP_CB_M_D8>,
+						 <&topckgen CLK_TOP_CB_M_D8>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		i2c0: i2c@11007000 {
+			compatible = "mediatek,mt7981-i2c";
+			reg = <0 0x11007000 0 0x1000>,
+			      <0 0x10217080 0 0x80>;
+			interrupts = <GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>;
+			clock-div = <1>;
+			clocks = <&infracfg CLK_INFRA_I2C0_CK>,
+				 <&infracfg CLK_INFRA_AP_DMA_CK>,
+				 <&infracfg CLK_INFRA_I2C_MCK_CK>,
+				 <&infracfg CLK_INFRA_I2C_PCK_CK>;
+			clock-names = "main", "dma", "arb", "pmic";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		spi2: spi@11009000 {
+			compatible = "mediatek,mt7986-spi-ipm", "mediatek,spi-ipm";
+			reg = <0 0x11009000 0 0x100>;
+			interrupts = <GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&topckgen CLK_TOP_CB_M_D2>,
+				 <&topckgen CLK_TOP_SPI_SEL>,
+				 <&infracfg CLK_INFRA_SPI2_CK>,
+				 <&infracfg CLK_INFRA_SPI2_HCK_CK>;
+			clock-names = "parent-clk", "sel-clk", "spi-clk", "hclk";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		spi0: spi@1100a000 {
+			compatible = "mediatek,mt7986-spi-ipm", "mediatek,spi-ipm";
+			reg = <0 0x1100a000 0 0x100>;
+			interrupts = <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&topckgen CLK_TOP_CB_M_D2>,
+				 <&topckgen CLK_TOP_SPI_SEL>,
+				 <&infracfg CLK_INFRA_SPI0_CK>,
+				 <&infracfg CLK_INFRA_SPI0_HCK_CK>;
+			clock-names = "parent-clk", "sel-clk", "spi-clk", "hclk";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		spi1: spi@1100b000 {
+			compatible = "mediatek,mt7986-spi-ipm", "mediatek,spi-ipm";
+			reg = <0 0x1100b000 0 0x100>;
+			interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&topckgen CLK_TOP_CB_M_D2>,
+				 <&topckgen CLK_TOP_SPIM_MST_SEL>,
+				 <&infracfg CLK_INFRA_SPI1_CK>,
+				 <&infracfg CLK_INFRA_SPI1_HCK_CK>;
+			clock-names = "parent-clk", "sel-clk", "spi-clk", "hclk";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		thermal: thermal@1100c800 {
+			compatible = "mediatek,mt7981-thermal", "mediatek,mt7986-thermal";
+			reg = <0 0x1100c800 0 0x800>;
+			interrupts = <GIC_SPI 138 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&infracfg CLK_INFRA_THERM_CK>,
+				 <&infracfg CLK_INFRA_ADC_26M_CK>;
+			clock-names = "therm", "auxadc";
+			nvmem-cells = <&thermal_calibration>;
+			nvmem-cell-names = "calibration-data";
+			#thermal-sensor-cells = <1>;
+			mediatek,auxadc = <&auxadc>;
+			mediatek,apmixedsys = <&apmixedsys>;
+		};
+
+		auxadc: adc@1100d000 {
+			compatible = "mediatek,mt7981-auxadc",
+				     "mediatek,mt7986-auxadc",
+				     "mediatek,mt7622-auxadc";
+			reg = <0 0x1100d000 0 0x1000>;
+			clocks = <&infracfg CLK_INFRA_ADC_26M_CK>,
+				 <&infracfg CLK_INFRA_ADC_FRC_CK>;
+			clock-names = "main", "32k";
+			#io-channel-cells = <1>;
+		};
+
+		xhci: usb@11200000 {
+			compatible = "mediatek,mt7986-xhci",
+				     "mediatek,mtk-xhci";
+			reg = <0 0x11200000 0 0x2e00>,
+			      <0 0x11203e00 0 0x0100>;
+			reg-names = "mac", "ippc";
+			interrupts = <GIC_SPI 173 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&infracfg CLK_INFRA_IUSB_SYS_CK>,
+				 <&infracfg CLK_INFRA_IUSB_CK>,
+				 <&infracfg CLK_INFRA_IUSB_133_CK>,
+				 <&infracfg CLK_INFRA_IUSB_66M_CK>,
+				 <&topckgen CLK_TOP_U2U3_XHCI_SEL>;
+			clock-names = "sys_ck",
+				      "ref_ck",
+				      "mcu_ck",
+				      "dma_ck",
+				      "xhci_ck";
+			phys = <&u2port0 PHY_TYPE_USB2>,
+			       <&u3port0 PHY_TYPE_USB3>;
+			vusb33-supply = <&reg_3p3v>;
+			status = "disabled";
+		};
+
+		afe: audio-controller@11210000 {
+			compatible = "mediatek,mt79xx-audio";
+			reg = <0 0x11210000 0 0x9000>;
+			interrupts = <GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&infracfg CLK_INFRA_AUD_BUS_CK>,
+				 <&infracfg CLK_INFRA_AUD_26M_CK>,
+				 <&infracfg CLK_INFRA_AUD_L_CK>,
+				 <&infracfg CLK_INFRA_AUD_AUD_CK>,
+				 <&infracfg CLK_INFRA_AUD_EG2_CK>,
+				 <&topckgen CLK_TOP_AUD_SEL>;
+			clock-names = "aud_bus_ck",
+				      "aud_26m_ck",
+				      "aud_l_ck",
+				      "aud_aud_ck",
+				      "aud_eg2_ck",
+				      "aud_sel";
+			assigned-clocks = <&topckgen CLK_TOP_AUD_SEL>,
+					  <&topckgen CLK_TOP_A1SYS_SEL>,
+					  <&topckgen CLK_TOP_AUD_L_SEL>,
+					  <&topckgen CLK_TOP_A_TUNER_SEL>;
+			assigned-clock-parents = <&topckgen CLK_TOP_CB_APLL2_196M>,
+						 <&topckgen CLK_TOP_APLL2_D4>,
+						 <&topckgen CLK_TOP_CB_APLL2_196M>,
+						 <&topckgen CLK_TOP_APLL2_D4>;
+			status = "disabled";
+		};
+
+		mmc0: mmc@11230000 {
+			compatible = "mediatek,mt7986-mmc", "mediatek,mt7981-mmc";
+			reg = <0 0x11230000 0 0x1000>, <0 0x11c20000 0 0x1000>;
+			interrupts = <GIC_SPI 143 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&infracfg CLK_INFRA_MSDC_CK>,
+				 <&infracfg CLK_INFRA_MSDC_HCK_CK>,
+				 <&infracfg CLK_INFRA_MSDC_66M_CK>,
+				 <&infracfg CLK_INFRA_MSDC_133M_CK>;
+			assigned-clocks = <&topckgen CLK_TOP_EMMC_208M_SEL>,
+					  <&topckgen CLK_TOP_EMMC_400M_SEL>;
+			assigned-clock-parents = <&topckgen CLK_TOP_CB_M_D2>,
+						 <&topckgen CLK_TOP_CB_NET2_D2>;
+			clock-names = "source", "hclk", "axi_cg", "ahb_cg";
+			status = "disabled";
+		};
+
+		pcie: pcie@11280000 {
+			compatible = "mediatek,mt7981-pcie",
+				     "mediatek,mt8192-pcie";
+			reg = <0 0x11280000 0 0x4000>;
+			reg-names = "pcie-mac";
+			ranges = <0x82000000 0 0x20000000
+				  0x0 0x20000000 0 0x10000000>;
+			device_type = "pci";
+			interrupts = <GIC_SPI 168 IRQ_TYPE_LEVEL_HIGH>;
+			bus-range = <0x00 0xff>;
+			clocks = <&infracfg CLK_INFRA_IPCIE_CK>,
+				 <&infracfg CLK_INFRA_IPCIE_PIPE_CK>,
+				 <&infracfg CLK_INFRA_IPCIER_CK>,
+				 <&infracfg CLK_INFRA_IPCIEB_CK>;
+			phys = <&u3port0 PHY_TYPE_PCIE>;
+			phy-names = "pcie-phy";
+			interrupt-map-mask = <0 0 0 7>;
+			interrupt-map = <0 0 0 1 &pcie_intc 0>,
+					<0 0 0 2 &pcie_intc 1>,
+					<0 0 0 3 &pcie_intc 2>,
+					<0 0 0 4 &pcie_intc 3>;
+			#interrupt-cells = <1>;
+			#address-cells = <3>;
+			#size-cells = <2>;
+			status = "disabled";
+
+			pcie_intc: interrupt-controller {
+				interrupt-controller;
+				#interrupt-cells = <1>;
+				#address-cells = <0>;
+			};
+		};
+
+		pio: pinctrl@11d00000 {
+			compatible = "mediatek,mt7981-pinctrl";
+			reg = <0 0x11d00000 0 0x1000>,
+			      <0 0x11c00000 0 0x1000>,
+			      <0 0x11c10000 0 0x1000>,
+			      <0 0x11d20000 0 0x1000>,
+			      <0 0x11e00000 0 0x1000>,
+			      <0 0x11e20000 0 0x1000>,
+			      <0 0x11f00000 0 0x1000>,
+			      <0 0x11f10000 0 0x1000>,
+			      <0 0x1000b000 0 0x1000>;
+			reg-names = "gpio", "iocfg_rt", "iocfg_rm",
+				    "iocfg_rb", "iocfg_lb", "iocfg_bl",
+				    "iocfg_tm", "iocfg_tl", "eint";
+			gpio-controller;
+			#gpio-cells = <2>;
+			gpio-ranges = <&pio 0 0 56>;
+			interrupt-controller;
+			interrupts = <GIC_SPI 225 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-parent = <&gic>;
+			#interrupt-cells = <2>;
+
+			mdio_pins: mdc-mdio-pins {
+				mux {
+					function = "eth";
+					groups = "smi_mdc_mdio";
+				};
+			};
+
+			uart0_pins: uart0-pins {
+				mux {
+					function = "uart";
+					groups = "uart0";
+				};
+			};
+
+			wifi_dbdc_pins: wifi-dbdc-pins {
+				mux {
+					function = "eth";
+					groups = "wf0_mode1";
+				};
+
+				conf {
+					pins = "WF_HB1", "WF_HB2", "WF_HB3", "WF_HB4",
+					       "WF_HB0", "WF_HB0_B", "WF_HB5", "WF_HB6",
+					       "WF_HB7", "WF_HB8", "WF_HB9", "WF_HB10",
+					       "WF_TOP_CLK", "WF_TOP_DATA", "WF_XO_REQ",
+					       "WF_CBA_RESETB", "WF_DIG_RESETB";
+					drive-strength = <4>;
+				};
+			};
+
+			gbe_led0_pins: gbe-led0-pins {
+				mux {
+					function = "led";
+					groups = "gbe_led0";
+				};
+			};
+
+			gbe_led1_pins: gbe-led1-pins {
+				mux {
+					function = "led";
+					groups = "gbe_led1";
+				};
+			};
+		};
+
+		topmisc: topmisc@11d10000 {
+			compatible = "mediatek,mt7981-topmisc", "syscon";
+			reg = <0 0x11d10000 0 0x10000>;
+			#clock-cells = <1>;
+		};
+
+		usb_phy: usb-phy@11e10000 {
+			compatible = "mediatek,mt7981",
+				     "mediatek,generic-tphy-v2";
+			ranges = <0 0 0x11e10000 0x1700>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			status = "disabled";
+
+			u2port0: usb-phy@0 {
+				reg = <0x0 0x700>;
+				clocks = <&topckgen CLK_TOP_USB_FRMCNT_SEL>;
+				clock-names = "ref";
+				#phy-cells = <1>;
+			};
+
+			u3port0: usb-phy@700 {
+				reg = <0x700 0x900>;
+				clocks = <&topckgen CLK_TOP_USB3_PHY_SEL>;
+				clock-names = "ref";
+				#phy-cells = <1>;
+				mediatek,syscon-type = <&topmisc 0x218 0>;
+				status = "okay";
+			};
+		};
+
+		efuse: efuse@11f20000 {
+			compatible = "mediatek,mt7981-efuse",
+				     "mediatek,efuse";
+			reg = <0 0x11f20000 0 0x1000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			status = "okay";
+
+			thermal_calibration: thermal-calib@274 {
+				reg = <0x274 0xc>;
+			};
+
+			phy_calibration: phy-calib@8dc {
+				reg = <0x8dc 0x10>;
+			};
+
+			comb_rx_imp_p0: usb3-rx-imp@8c8 {
+				reg = <0x8c8 1>;
+				bits = <0 5>;
+			};
+
+			comb_tx_imp_p0: usb3-tx-imp@8c8 {
+				reg = <0x8c8 2>;
+				bits = <5 5>;
+			};
+
+			comb_intr_p0: usb3-intr@8c9 {
+				reg = <0x8c9 1>;
+				bits = <2 6>;
+			};
+		};
+
+		ethsys: clock-controller@15000000 {
+			compatible = "mediatek,mt7981-ethsys",
+				     "syscon";
+			reg = <0 0x15000000 0 0x1000>;
+			#clock-cells = <1>;
+			#reset-cells = <1>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+		};
+
+		wed: wed@15010000 {
+			compatible = "mediatek,mt7981-wed",
+				     "mediatek,mt7986-wed",
+				     "syscon";
+			reg = <0 0x15010000 0 0x1000>;
+			interrupt-parent = <&gic>;
+			interrupts = <GIC_SPI 205 IRQ_TYPE_LEVEL_HIGH>;
+			memory-region = <&wo_emi0>, <&wo_data>;
+			memory-region-names = "wo-emi", "wo-data";
+			mediatek,wo-ccif = <&wo_ccif0>;
+			mediatek,wo-ilm = <&wo_ilm0>;
+			mediatek,wo-dlm = <&wo_dlm0>;
+			mediatek,wo-cpuboot = <&wo_cpuboot>;
+		};
+
+		eth: ethernet@15100000 {
+			compatible = "mediatek,mt7981-eth";
+			reg = <0 0x15100000 0 0x80000>;
+			interrupts = <GIC_SPI 196 IRQ_TYPE_LEVEL_HIGH>,
+					<GIC_SPI 197 IRQ_TYPE_LEVEL_HIGH>,
+					<GIC_SPI 198 IRQ_TYPE_LEVEL_HIGH>,
+					<GIC_SPI 199 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&ethsys CLK_ETH_FE_EN>,
+				<&ethsys CLK_ETH_GP2_EN>,
+				<&ethsys CLK_ETH_GP1_EN>,
+				<&ethsys CLK_ETH_WOCPU0_EN>,
+				<&sgmiisys0 CLK_SGM0_TX_EN>,
+				<&sgmiisys0 CLK_SGM0_RX_EN>,
+				<&sgmiisys0 CLK_SGM0_CK0_EN>,
+				<&sgmiisys0 CLK_SGM0_CDR_CK0_EN>,
+				<&sgmiisys1 CLK_SGM1_TX_EN>,
+				<&sgmiisys1 CLK_SGM1_RX_EN>,
+				<&sgmiisys1 CLK_SGM1_CK1_EN>,
+				<&sgmiisys1 CLK_SGM1_CDR_CK1_EN>,
+				<&topckgen CLK_TOP_SGM_REG>,
+				<&topckgen CLK_TOP_NETSYS_SEL>,
+				<&topckgen CLK_TOP_NETSYS_500M_SEL>;
+			clock-names = "fe", "gp2", "gp1", "wocpu0",
+						"sgmii_tx250m", "sgmii_rx250m",
+						"sgmii_cdr_ref", "sgmii_cdr_fb",
+						"sgmii2_tx250m", "sgmii2_rx250m",
+						"sgmii2_cdr_ref", "sgmii2_cdr_fb",
+						"sgmii_ck", "netsys0", "netsys1";
+			assigned-clocks = <&topckgen CLK_TOP_NETSYS_2X_SEL>,
+					  <&topckgen CLK_TOP_SGM_325M_SEL>;
+			assigned-clock-parents = <&topckgen CLK_TOP_CB_NET2_800M>,
+						 <&topckgen CLK_TOP_CB_SGM_325M>;
+			mediatek,ethsys = <&ethsys>;
+			mediatek,sgmiisys = <&sgmiisys0>, <&sgmiisys1>;
+			mediatek,infracfg = <&topmisc>;
+			mediatek,wed = <&wed>;
+			#reset-cells = <1>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+
+			mdio_bus: mdio-bus {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				int_gbe_phy: ethernet-phy@0 {
+					compatible = "ethernet-phy-ieee802.3-c22";
+					reg = <0>;
+					phy-mode = "gmii";
+					phy-is-integrated;
+					nvmem-cells = <&phy_calibration>;
+					nvmem-cell-names = "phy-cal-data";
+
+					leds {
+						#address-cells = <1>;
+						#size-cells = <0>;
+
+						int_gbe_phy_led0: int-gbe-phy-led0@0 {
+							reg = <0>;
+							function = LED_FUNCTION_LAN;
+							status = "disabled";
+						};
+
+						int_gbe_phy_led1: int-gbe-phy-led1@1 {
+							reg = <1>;
+							function = LED_FUNCTION_LAN;
+							status = "disabled";
+						};
+					};
+				};
+			};
+		};
+
+		wdma: wdma@15104800 {
+			compatible = "mediatek,wed-wdma";
+			reg = <0 0x15104800 0 0x400>,
+			      <0 0x15104c00 0 0x400>;
+		};
+
+		wo_cpuboot: syscon@15194000 {
+			compatible = "mediatek,mt7986-wo-cpuboot", "syscon";
+			reg = <0 0x15194000 0 0x1000>;
+		};
+
+		ap2woccif: ap2woccif@151a5000 {
+			compatible = "mediatek,ap2woccif";
+			reg = <0 0x151a5000 0 0x1000>,
+			      <0 0x151ad000 0 0x1000>;
+			interrupt-parent = <&gic>;
+			interrupts = <GIC_SPI 211 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 212 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		wo_ccif0: syscon@151a5000 {
+			compatible = "mediatek,mt7986-wo-ccif", "syscon";
+			reg = <0 0x151a5000 0 0x1000>;
+			interrupt-parent = <&gic>;
+			interrupts = <GIC_SPI 211 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		wo_ilm0: syscon@151e0000 {
+			compatible = "mediatek,mt7986-wo-ilm", "syscon";
+			reg = <0 0x151e0000 0 0x8000>;
+		};
+
+		wo_dlm0: syscon@151e8000 {
+			compatible = "mediatek,mt7986-wo-dlm", "syscon";
+			reg = <0 0x151e8000 0 0x2000>;
+		};
+
+		wifi: wifi@18000000 {
+			compatible = "mediatek,mt7981-wmac";
+			reg = <0 0x18000000 0 0x1000000>,
+			      <0 0x10003000 0 0x1000>,
+			      <0 0x11d10000 0 0x1000>;
+			resets = <&watchdog MT7986_TOPRGU_CONSYS_SW_RST>;
+			reset-names = "consys";
+			pinctrl-0 = <&wifi_dbdc_pins>;
+			pinctrl-names = "dbdc";
+			clocks = <&topckgen CLK_TOP_NETSYS_MCU_SEL>,
+				 <&topckgen CLK_TOP_AP2CNN_HOST_SEL>;
+			clock-names = "mcu", "ap2conn";
+			interrupts = <GIC_SPI 213 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 214 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 215 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 216 IRQ_TYPE_LEVEL_HIGH>;
+			memory-region = <&wmcpu_emi>;
+			status = "disabled";
+		};
+	};
+
+	thermal-zones {
+		cpu_thermal: cpu-thermal {
+			polling-delay-passive = <1000>;
+			polling-delay = <1000>;
+			thermal-sensors = <&thermal 0>;
+
+			trips {
+				cpu_trip_active_highest: active-highest {
+					temperature = <70000>;
+					hysteresis = <2000>;
+					type = "active";
+				};
+
+				cpu_trip_active_high: active-high {
+					temperature = <60000>;
+					hysteresis = <2000>;
+					type = "active";
+				};
+
+				cpu_trip_active_med: active-med {
+					temperature = <50000>;
+					hysteresis = <2000>;
+					type = "active";
+				};
+
+				cpu_trip_active_low: active-low {
+					temperature = <45000>;
+					hysteresis = <2000>;
+					type = "active";
+				};
+
+				cpu_trip_active_lowest: active-lowest {
+					temperature = <40000>;
+					hysteresis = <2000>;
+					type = "active";
+				};
+			};
+
+			cooling-maps {
+				cpu-active-highest {
+					/* active: set fan to cooling level 7 */
+					cooling-device = <&fan 7 7>;
+					trip = <&cpu_trip_active_highest>;
+				};
+
+				cpu-active-high {
+					/* active: set fan to cooling level 5 */
+					cooling-device = <&fan 5 5>;
+					trip = <&cpu_trip_active_high>;
+				};
+
+				cpu-active-med {
+					/* active: set fan to cooling level 3 */
+					cooling-device = <&fan 3 3>;
+					trip = <&cpu_trip_active_med>;
+				};
+
+				cpu-active-low {
+					/* active: set fan to cooling level 2 */
+					cooling-device = <&fan 2 2>;
+					trip = <&cpu_trip_active_low>;
+				};
+
+				cpu-active-lowest {
+					/* active: set fan to cooling level 1 */
+					cooling-device = <&fan 1 1>;
+					trip = <&cpu_trip_active_lowest>;
+				};
+			};
+		};
+	};
+
+	timer {
+		compatible = "arm,armv8-timer";
+		interrupt-parent = <&gic>;
+		clock-frequency = <13000000>;
+		interrupts = <GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>;
+
+	};
+
+	trng {
+		compatible = "mediatek,mt7981-rng";
+	};
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7986a-rfb-spim-nand.dts b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7986a-rfb-spim-nand.dts
new file mode 100644
index 00000000..ce007099
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7986a-rfb-spim-nand.dts
@@ -0,0 +1,52 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR MIT) */
+
+#include "mt7986a-rfb.dtsi"
+
+/ {
+	compatible = "mediatek,mt7986a-rfb-snand";
+};
+
+&spi0 {
+	status = "okay";
+
+	spi_nand: spi_nand@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "spi-nand";
+		reg = <1>;
+		spi-max-frequency = <10000000>;
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			partition@0 {
+				label = "BL2";
+				reg = <0x00000 0x0100000>;
+				read-only;
+			};
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x0100000 0x0080000>;
+			};
+			factory: partition@180000 {
+				label = "Factory";
+				reg = <0x180000 0x0200000>;
+			};
+			partition@380000 {
+				label = "FIP";
+				reg = <0x380000 0x0200000>;
+			};
+			partition@580000 {
+				label = "ubi";
+				reg = <0x580000 0x4000000>;
+			};
+		};
+	};
+};
+
+&wifi {
+	mediatek,mtd-eeprom = <&factory 0>;
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7986a-rfb-spim-nor.dts b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7986a-rfb-spim-nor.dts
new file mode 100644
index 00000000..ea148315
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7986a-rfb-spim-nor.dts
@@ -0,0 +1,51 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR MIT) */
+
+#include "mt7986a-rfb.dtsi"
+
+/ {
+	compatible = "mediatek,mt7986a-rfb-snor";
+};
+
+&spi0 {
+	status = "okay";
+
+	spi_nor: spi_nor@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <52000000>;
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@00000 {
+				label = "BL2";
+				reg = <0x00000 0x0040000>;
+			};
+			partition@40000 {
+				label = "u-boot-env";
+				reg = <0x40000 0x0010000>;
+			};
+			factory: partition@50000 {
+				label = "Factory";
+				reg = <0x50000 0x00B0000>;
+			};
+			partition@100000 {
+				label = "FIP";
+				reg = <0x100000 0x0080000>;
+			};
+			partition@180000 {
+				label = "firmware";
+				reg = <0x180000 0xE00000>;
+			};
+		};
+	};
+};
+
+&wifi {
+	mediatek,mtd-eeprom = <&factory 0>;
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7986a-rfb.dtsi b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7986a-rfb.dtsi
new file mode 100644
index 00000000..26d560bd
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7986a-rfb.dtsi
@@ -0,0 +1,389 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2021 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+/dts-v1/;
+#include "mt7986a.dtsi"
+
+/ {
+	model = "MediaTek MT7986a RFB";
+	compatible = "mediatek,mt7986a-rfb";
+
+	aliases {
+		serial0 = &uart0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	memory {
+		reg = <0 0x40000000 0 0x40000000>;
+	};
+
+	reg_1p8v: regulator-1p8v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-1.8V";
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <1800000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reg_3p3v: regulator-3p3v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-3.3V";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reg_5v: regulator-5v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-5V";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "2500base-x";
+	};
+
+	mdio: mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+};
+
+&wifi {
+	status = "okay";
+	pinctrl-names = "default", "dbdc";
+	pinctrl-0 = <&wf_2g_5g_pins>;
+	pinctrl-1 = <&wf_dbdc_pins>;
+};
+
+&mdio {
+	phy5: phy@5 {
+		compatible = "ethernet-phy-id67c9.de0a";
+		reg = <5>;
+
+		reset-gpios = <&pio 6 1>;
+		reset-deassert-us = <20000>;
+	};
+
+	phy6: phy@6 {
+		compatible = "ethernet-phy-id67c9.de0a";
+		reg = <6>;
+	};
+
+	switch: switch@1f {
+		compatible = "mediatek,mt7531";
+		reg = <31>;
+		reset-gpios = <&pio 5 0>;
+	};
+};
+
+&crypto {
+	status = "okay";
+};
+
+&mmc0 {
+	pinctrl-names = "default", "state_uhs";
+	pinctrl-0 = <&mmc0_pins_default>;
+	pinctrl-1 = <&mmc0_pins_uhs>;
+	bus-width = <8>;
+	max-frequency = <200000000>;
+	cap-mmc-highspeed;
+	mmc-hs200-1_8v;
+	mmc-hs400-1_8v;
+	hs400-ds-delay = <0x14014>;
+	vmmc-supply = <&reg_3p3v>;
+	vqmmc-supply = <&reg_1p8v>;
+	non-removable;
+	no-sd;
+	no-sdio;
+	status = "okay";
+};
+
+&pcie {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie_pins>;
+	status = "okay";
+};
+
+&pcie_phy {
+	status = "okay";
+};
+
+&pio {
+	mmc0_pins_default: mmc0-pins {
+		mux {
+			function = "emmc";
+			groups = "emmc_51";
+		};
+		conf-cmd-dat {
+			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
+			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
+			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
+			input-enable;
+			drive-strength = <4>;
+			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
+		};
+		conf-clk {
+			pins = "EMMC_CK";
+			drive-strength = <6>;
+			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
+		};
+		conf-ds {
+			pins = "EMMC_DSL";
+			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
+		};
+		conf-rst {
+			pins = "EMMC_RSTB";
+			drive-strength = <4>;
+			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
+		};
+	};
+
+	mmc0_pins_uhs: mmc0-uhs-pins {
+		mux {
+			function = "emmc";
+			groups = "emmc_51";
+		};
+		conf-cmd-dat {
+			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
+			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
+			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
+			input-enable;
+			drive-strength = <4>;
+			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
+		};
+		conf-clk {
+			pins = "EMMC_CK";
+			drive-strength = <6>;
+			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
+		};
+		conf-ds {
+			pins = "EMMC_DSL";
+			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
+		};
+		conf-rst {
+			pins = "EMMC_RSTB";
+			drive-strength = <4>;
+			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
+		};
+	};
+
+	pcie_pins: pcie-pins {
+		mux {
+			function = "pcie";
+			groups = "pcie_clk", "pcie_wake", "pcie_pereset";
+		};
+	};
+
+	spic_pins_g2: spic-pins-29-to-32 {
+		mux {
+			function = "spi";
+			groups = "spi1_2";
+		};
+	};
+
+	spi_flash_pins: spi-flash-pins-33-to-38 {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+		conf-pu {
+			pins = "SPI2_CS", "SPI2_HOLD", "SPI2_WP";
+			drive-strength = <8>;
+			mediatek,pull-up-adv = <0>;	/* bias-disable */
+		};
+		conf-pd {
+			pins = "SPI2_CLK", "SPI2_MOSI", "SPI2_MISO";
+			drive-strength = <8>;
+			mediatek,pull-down-adv = <0>;	/* bias-disable */
+		};
+	};
+
+	uart1_pins: uart1-pins {
+		mux {
+			function = "uart";
+			groups = "uart1";
+		};
+	};
+
+	uart2_pins: uart2-pins {
+		mux {
+			function = "uart";
+			groups = "uart2";
+		};
+	};
+
+	wf_2g_5g_pins: wf_2g_5g-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_2g", "wf_5g";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+			       "WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <4>;
+		};
+	};
+
+	wf_dbdc_pins: wf_dbdc-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_dbdc";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+			       "WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <4>;
+		};
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi_flash_pins>;
+	cs-gpios = <0>, <0>;
+	#address-cells = <1>;
+	#size-cells = <0>;
+	status = "disabled";
+};
+
+&spi1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spic_pins_g2>;
+	status = "okay";
+
+	proslic_spi: proslic_spi@0 {
+		compatible = "silabs,proslic_spi";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+		spi-cpha = <1>;
+		spi-cpol = <1>;
+		channel_count = <1>;
+		debug_level = <4>;       /* 1 = TRC, 2 = DBG, 4 = ERR */
+		reset_gpio = <&pio 7 0>;
+		ig,enable-spi = <1>;     /* 1: Enable, 0: Disable */
+	};
+};
+
+&gmac1 {
+	phy-mode = "2500base-x";
+	phy-connection-type = "2500base-x";
+	phy-handle = <&phy6>;
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "lan1";
+		};
+
+		port@1 {
+			reg = <1>;
+			label = "lan2";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan3";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan4";
+		};
+
+		port@4 {
+			reg = <4>;
+			label = "wan";
+		};
+
+		port@5 {
+			reg = <5>;
+			label = "lan6";
+
+			phy-mode = "2500base-x";
+			phy-handle = <&phy5>;
+		};
+
+		port@6 {
+			reg = <6>;
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&ssusb {
+	vusb33-supply = <&reg_3p3v>;
+	vbus-supply = <&reg_5v>;
+	status = "okay";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&uart1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart1_pins>;
+	status = "okay";
+};
+
+&uart2 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart2_pins>;
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-bananapi-bpi-r4-emmc.dtso b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-bananapi-bpi-r4-emmc.dtso
new file mode 100644
index 00000000..cd266d6b
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-bananapi-bpi-r4-emmc.dtso
@@ -0,0 +1,62 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2021 MediaTek Inc.
+ * Author: Frank Wunderlich <frank-w@public-files.de>
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "bananapi,bpi-r4", "mediatek,mt7988a";
+
+	fragment@0 {
+		target-path = "/soc/mmc@11230000";
+		__overlay__ {
+			pinctrl-names = "default", "state_uhs";
+			pinctrl-0 = <&mmc0_pins_emmc_51>;
+			pinctrl-1 = <&mmc0_pins_emmc_51>;
+			bus-width = <8>;
+			max-frequency = <200000000>;
+			cap-mmc-highspeed;
+			mmc-hs200-1_8v;
+			mmc-hs400-1_8v;
+			hs400-ds-delay = <0x12814>;
+			vqmmc-supply = <&reg_1p8v>;
+			vmmc-supply = <&reg_3p3v>;
+			non-removable;
+			no-sd;
+			no-sdio;
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			card@0 {
+				compatible = "mmc-card";
+				reg = <0>;
+
+				block {
+					compatible = "block-device";
+					partitions {
+						block-partition-env {
+							partname = "ubootenv";
+							nvmem-layout {
+								compatible = "u-boot,env";
+							};
+						};
+						emmc_rootfs: block-partition-production {
+							partname = "production";
+						};
+					};
+				};
+			};
+		};
+	};
+
+	fragment@2 {
+		target-path = "/chosen";
+		__overlay__ {
+			rootdisk-emmc = <&emmc_rootfs>;
+		};
+	};
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-bananapi-bpi-r4-poe.dts b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-bananapi-bpi-r4-poe.dts
new file mode 100644
index 00000000..efcf0ec3
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-bananapi-bpi-r4-poe.dts
@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2022 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+#include "mt7988a-bananapi-bpi-r4.dtsi"
+
+/ {
+	model = "Bananapi BPI-R4 2.5GE PoE";
+	compatible = "bananapi,bpi-r4-poe",
+		     "mediatek,mt7988a";
+};
+
+&gmac1 {
+	phy-mode = "internal";
+	phy-connection-type = "internal";
+	phy = <&int_2p5g_phy>;
+	status = "okay";
+};
+
+&int_2p5g_phy {
+	pinctrl-names = "i2p5gbe-led";
+	pinctrl-0 = <&i2p5gbe_led0_pins>;
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-bananapi-bpi-r4-rtc.dtso b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-bananapi-bpi-r4-rtc.dtso
new file mode 100644
index 00000000..39910b8c
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-bananapi-bpi-r4-rtc.dtso
@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2023
+ * Author: Daniel Golle <daniel@makrotopia.org>
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "bananapi,bpi-r4", "mediatek,mt7988a";
+
+	fragment@0 {
+		target = <&pcf8563>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-bananapi-bpi-r4-sd.dtso b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-bananapi-bpi-r4-sd.dtso
new file mode 100644
index 00000000..c2ab424e
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-bananapi-bpi-r4-sd.dtso
@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2023 MediaTek Inc.
+ * Author: Frank Wunderlich <frank-w@public-files.de>
+ */
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	compatible = "bananapi,bpi-r4", "mediatek,mt7988a";
+
+	fragment@1 {
+		target-path = "/soc/mmc@11230000";
+		__overlay__ {
+			pinctrl-names = "default", "state_uhs";
+			pinctrl-0 = <&mmc0_pins_sdcard>;
+			pinctrl-1 = <&mmc0_pins_sdcard>;
+			cd-gpios = <&pio 12 GPIO_ACTIVE_LOW>;
+			bus-width = <4>;
+			max-frequency = <52000000>;
+			cap-sd-highspeed;
+			vmmc-supply = <&reg_3p3v>;
+			vqmmc-supply = <&reg_3p3v>;
+			no-mmc;
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			card@0 {
+				compatible = "mmc-card";
+				reg = <0>;
+
+				block {
+					compatible = "block-device";
+					partitions {
+						block-partition-env {
+							partname = "ubootenv";
+							nvmem-layout {
+								compatible = "u-boot,env";
+							};
+						};
+						sd_rootfs: block-partition-production {
+							partname = "production";
+						};
+					};
+				};
+			};
+		};
+	};
+
+	fragment@2 {
+		target-path = "/chosen";
+		__overlay__ {
+			rootdisk-sd = <&sd_rootfs>;
+		};
+	};
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-bananapi-bpi-r4-wifi-mt7996a.dtso b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-bananapi-bpi-r4-wifi-mt7996a.dtso
new file mode 100644
index 00000000..baba44e5
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-bananapi-bpi-r4-wifi-mt7996a.dtso
@@ -0,0 +1,99 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	compatible = "bananapi,bpi-r4", "mediatek,mt7988a";
+
+	fragment@0 {
+		target-path = "/";
+		__overlay__ {
+			wifi_12v: regulator-wifi-12v {
+				compatible = "regulator-fixed";
+				regulator-name = "wifi";
+				regulator-min-microvolt = <12000000>;
+				regulator-max-microvolt = <12000000>;
+				gpios = <&pio 4 GPIO_ACTIVE_HIGH>;
+				enable-active-high;
+				regulator-always-on;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c_wifi>;
+		__overlay__ {
+			// 5G WIFI MAC Address EEPROM
+			wifi_eeprom@51 {
+				compatible = "atmel,24c02";
+				reg = <0x51>;
+				address-bits = <8>;
+				page-size = <8>;
+				size = <256>;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					macaddr_5g: macaddr@0 {
+						reg = <0x0 0x6>;
+					};
+				};
+			};
+
+			// 6G WIFI MAC Address EEPROM
+			wifi_eeprom@52 {
+				compatible = "atmel,24c02";
+				reg = <0x52>;
+				address-bits = <8>;
+				page-size = <8>;
+				size = <256>;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					macaddr_6g: macaddr@0 {
+						reg = <0x0 0x6>;
+					};
+				};
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&pcie0>;
+		__overlay__ {
+			pcie@0,0 {
+				reg = <0x0000 0 0 0 0>;
+
+				wifi@0,0 {
+					compatible = "mediatek,mt76";
+					reg = <0x0000 0 0 0 0>;
+					nvmem-cell-names = "mac-address";
+					nvmem-cells = <&macaddr_5g>;
+				};
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&pcie1>;
+		__overlay__ {
+			pcie@0,0 {
+				reg = <0x0000 0 0 0 0>;
+
+				wifi@0,0 {
+					compatible = "mediatek,mt76";
+					reg = <0x0000 0 0 0 0>;
+					nvmem-cell-names = "mac-address";
+					nvmem-cells = <&macaddr_6g>;
+				};
+			};
+		};
+	};
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-bananapi-bpi-r4.dts b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-bananapi-bpi-r4.dts
new file mode 100644
index 00000000..d2c223b4
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-bananapi-bpi-r4.dts
@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2022 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+#include "mt7988a-bananapi-bpi-r4.dtsi"
+
+/ {
+	model = "Bananapi BPI-R4";
+	compatible = "bananapi,bpi-r4",
+		     "mediatek,mt7988a";
+
+	/* SFP2 cage (LAN) */
+	sfp2: sfp2 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c_sfp2>;
+		los-gpios = <&pio 2 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpios = <&pio 83 GPIO_ACTIVE_LOW>;
+		tx-disable-gpios = <&pio 0 GPIO_ACTIVE_HIGH>;
+		tx-fault-gpios = <&pio 1 GPIO_ACTIVE_HIGH>;
+		rate-select0-gpios = <&pio 3 GPIO_ACTIVE_LOW>;
+		maximum-power-milliwatt = <3000>;
+	};
+};
+
+&gmac1 {
+	sfp = <&sfp2>;
+	managed = "in-band-status";
+	phy-mode = "usxgmii";
+	status = "okay";
+};
+
+&pca9545 {
+	i2c_sfp2: i2c@2 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <2>;
+	};
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-bananapi-bpi-r4.dtsi b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-bananapi-bpi-r4.dtsi
new file mode 100644
index 00000000..14c615b6
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-bananapi-bpi-r4.dtsi
@@ -0,0 +1,393 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2022 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+/dts-v1/;
+#include "mt7988a.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/regulator/richtek,rt5190a-regulator.h>
+
+/ {
+	model = "Bananapi BPI-R4";
+	compatible = "bananapi,bpi-r4",
+		     "mediatek,mt7988a";
+
+	aliases {
+		ethernet0 = &gmac0;
+		ethernet1 = &gmac1;
+		led-boot = &led_green;
+		led-failsafe = &led_green;
+		led-running = &led_green;
+		led-upgrade = &led_green;
+		serial0 = &uart0;
+	};
+
+	chosen {
+		stdout-path = &uart0;
+		bootargs = "console=ttyS0,115200n1 loglevel=8 pci=pcie_bus_perf ubi.block=0,fit root=/dev/fit0 rootwait";
+		rootdisk-spim-nand = <&ubi_rootfs>;
+	};
+
+	memory {
+		reg = <0x00 0x40000000 0x00 0x10000000>;
+	};
+
+	/* SFP1 cage (WAN) */
+	sfp1: sfp1 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c_sfp1>;
+		los-gpios = <&pio 54 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpios = <&pio 82 GPIO_ACTIVE_LOW>;
+		tx-disable-gpios = <&pio 70 GPIO_ACTIVE_HIGH>;
+		tx-fault-gpios = <&pio 69 GPIO_ACTIVE_HIGH>;
+		rate-select0-gpios = <&pio 21 GPIO_ACTIVE_LOW>;
+		maximum-power-milliwatt = <3000>;
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		wps {
+			label = "WPS";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 14 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		led_green: led-green {
+			function = LED_FUNCTION_STATUS;
+			color = <LED_COLOR_ID_GREEN>;
+			gpios = <&pio 79 GPIO_ACTIVE_HIGH>;
+			default-state = "on";
+		};
+
+		led_blue: led-blue {
+			function = LED_FUNCTION_WPS;
+			color = <LED_COLOR_ID_BLUE>;
+			gpios = <&pio 63 GPIO_ACTIVE_HIGH>;
+			default-state = "off";
+		};
+	};
+};
+
+&eth {
+	status = "okay";
+};
+
+&gmac0 {
+	status = "okay";
+};
+
+&gmac2 {
+	sfp = <&sfp1>;
+	managed = "in-band-status";
+	phy-mode = "usxgmii";
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&gsw_phy0 {
+	pinctrl-names = "gbe-led";
+	pinctrl-0 = <&gbe0_led0_pins>;
+};
+
+&gsw_port0 {
+	label = "wan";
+};
+
+&gsw_phy0_led0 {
+	status = "okay";
+	color = <LED_COLOR_ID_GREEN>;
+};
+
+&gsw_phy1 {
+	pinctrl-names = "gbe-led";
+	pinctrl-0 = <&gbe1_led0_pins>;
+};
+
+&gsw_phy1_led0 {
+	status = "okay";
+	color = <LED_COLOR_ID_GREEN>;
+};
+
+&gsw_phy2 {
+	pinctrl-names = "gbe-led";
+	pinctrl-0 = <&gbe2_led0_pins>;
+};
+
+&gsw_phy2_led0 {
+	status = "okay";
+	color = <LED_COLOR_ID_GREEN>;
+};
+
+&gsw_phy3 {
+	pinctrl-names = "gbe-led";
+	pinctrl-0 = <&gbe3_led0_pins>;
+};
+
+&gsw_phy3_led0 {
+	status = "okay";
+	color = <LED_COLOR_ID_GREEN>;
+};
+
+&cpu0 {
+	proc-supply = <&rt5190_buck3>;
+};
+
+&cpu1 {
+	proc-supply = <&rt5190_buck3>;
+};
+
+&cpu2 {
+	proc-supply = <&rt5190_buck3>;
+};
+
+&cpu3 {
+	proc-supply = <&rt5190_buck3>;
+};
+
+&cci {
+	proc-supply = <&rt5190_buck3>;
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c0_pins>;
+	status = "okay";
+
+	rt5190a_64: rt5190a@64 {
+		compatible = "richtek,rt5190a";
+		reg = <0x64>;
+		vin2-supply = <&rt5190_buck1>;
+		vin3-supply = <&rt5190_buck1>;
+		vin4-supply = <&rt5190_buck1>;
+
+		regulators {
+			rt5190_buck1: buck1 {
+				regulator-name = "rt5190a-buck1";
+				regulator-min-microvolt = <5090000>;
+				regulator-max-microvolt = <5090000>;
+				regulator-allowed-modes =
+				<RT5190A_OPMODE_AUTO RT5190A_OPMODE_FPWM>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			buck2 {
+				regulator-name = "vcore";
+				regulator-min-microvolt = <600000>;
+				regulator-max-microvolt = <1400000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			rt5190_buck3: buck3 {
+				regulator-name = "vproc";
+				regulator-min-microvolt = <600000>;
+				regulator-max-microvolt = <1400000>;
+				regulator-boot-on;
+			};
+			buck4 {
+				regulator-name = "rt5190a-buck4";
+				regulator-min-microvolt = <850000>;
+				regulator-max-microvolt = <850000>;
+				regulator-allowed-modes =
+				<RT5190A_OPMODE_AUTO RT5190A_OPMODE_FPWM>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			ldo {
+				regulator-name = "rt5190a-ldo";
+				regulator-min-microvolt = <1200000>;
+				regulator-max-microvolt = <1200000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+		};
+	};
+};
+
+&i2c2 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c2_1_pins>;
+	status = "okay";
+
+	pca9545: i2c-switch@70 {
+		reg = <0x70>;
+		compatible = "nxp,pca9545";
+		reset-gpios = <&pio 5 GPIO_ACTIVE_LOW>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		i2c_rtc: i2c@0 { //eeprom,rtc,ngff
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <0>;
+
+			eeprom@50 {
+				compatible = "atmel,24c02";
+				reg = <0x50>;
+				address-bits = <8>;
+				page-size = <8>;
+				size = <256>;
+			};
+
+			eeprom@57 {
+				compatible = "atmel,24c02";
+				reg = <0x57>;
+				address-bits = <8>;
+				page-size = <8>;
+				size = <256>;
+			};
+
+			pcf8563: rtc@51 {
+				compatible = "nxp,pcf8563";
+				reg = <0x51>;
+				status = "disabled";
+			};
+		};
+
+		i2c_sfp1: i2c@1 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <1>;
+		};
+
+		i2c_wifi: i2c@3 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <3>;
+		};
+	};
+};
+
+/* mPCIe SIM2 */
+&pcie0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie0_pins>;
+	status = "okay";
+};
+
+/* mPCIe SIM3 */
+&pcie1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie1_pins>;
+	status = "okay";
+};
+
+/* M.2 key-B SIM1 */
+&pcie2 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie2_pins>;
+	status = "okay";
+};
+
+/* M.2 key-M SSD */
+&pcie3 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie3_pins>;
+	status = "okay";
+};
+
+&pwm {
+	status = "okay";
+};
+
+&fan {
+	pwms = <&pwm 0 50000>;
+	status = "okay";
+};
+
+&ssusb1 {
+	status = "okay";
+};
+
+&tphy {
+	status = "okay";
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "okay";
+
+	spi_nand: spi_nand@0 {
+		compatible = "spi-nand";
+		reg = <0>;
+		spi-max-frequency = <52000000>;
+		spi-tx-buswidth = <4>;
+		spi-rx-buswidth = <4>;
+	};
+};
+
+&spi_nand {
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			label = "bl2";
+			reg = <0x0 0x200000>;
+			read-only;
+		};
+
+		partition@200000 {
+			label = "ubi";
+			reg = <0x200000 0x7e00000>;
+			compatible = "linux,ubi";
+
+			volumes {
+				ubi-volume-ubootenv {
+					volname = "ubootenv";
+					nvmem-layout {
+						compatible = "u-boot,env-redundant-bool-layout";
+					};
+				};
+
+				ubi-volume-ubootenv2 {
+					volname = "ubootenv2";
+					nvmem-layout {
+						compatible = "u-boot,env-redundant-bool-layout";
+					};
+				};
+
+				ubi_rootfs: ubi-volume-fit {
+					volname = "fit";
+				};
+			};
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&uart1 {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart1_2_lite_pins>;
+};
+
+&uart2 {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart2_3_pins>;
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&xphy {
+	status = "okay";
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-emmc.dtso b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-emmc.dtso
new file mode 100644
index 00000000..3f8ac2ae
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-emmc.dtso
@@ -0,0 +1,33 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2021 MediaTek Inc.
+ * Author: Frank Wunderlich <frank-w@public-files.de>
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "mediatek,mt7988a-rfb", "mediatek,mt7988a";
+
+	fragment@0 {
+		target = <&mmc0>;
+		__overlay__ {
+			pinctrl-names = "default", "state_uhs";
+			pinctrl-0 = <&mmc0_pins_emmc_51>;
+			pinctrl-1 = <&mmc0_pins_emmc_51>;
+			bus-width = <8>;
+			max-frequency = <200000000>;
+			cap-mmc-highspeed;
+			mmc-hs200-1_8v;
+			mmc-hs400-1_8v;
+			hs400-ds-delay = <0x12814>;
+			vqmmc-supply = <&reg_1p8v>;
+			vmmc-supply = <&reg_3p3v>;
+			non-removable;
+			no-sd;
+			no-sdio;
+			status = "okay";
+		};
+	};
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-eth1-aqr.dtso b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-eth1-aqr.dtso
new file mode 100644
index 00000000..c471b9ed
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-eth1-aqr.dtso
@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2022 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	compatible = "mediatek,mt7988a-rfb", "mediatek,mt7988a";
+
+	fragment@0 {
+		target = <&mdio_bus>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			/* external Aquantia AQR113C */
+			phy0: ethernet-phy@0 {
+				reg = <0>;
+				compatible = "ethernet-phy-ieee802.3-c45";
+				firmware-name = "AQR-G4_v5.7.0-AQR_EVB_Generic_X3410_StdCfg_MDISwap_USX_ID46316_VER2140.cld";
+				reset-gpios = <&pio 72 GPIO_ACTIVE_LOW>;
+				reset-assert-us = <100000>;
+				reset-deassert-us = <221000>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&gmac1>;
+		__overlay__ {
+			phy-mode = "usxgmii";
+			phy-connection-type = "usxgmii";
+			phy = <&phy0>;
+			status = "okay";
+		};
+	};
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-eth1-i2p5g-phy.dtso b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-eth1-i2p5g-phy.dtso
new file mode 100644
index 00000000..86ab7566
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-eth1-i2p5g-phy.dtso
@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2022 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "mediatek,mt7988a-rfb", "mediatek,mt7988a";
+
+	fragment@0 {
+		target = <&gmac1>;
+		__overlay__ {
+			phy-mode = "internal";
+			phy-connection-type = "internal";
+			phy = <&int_2p5g_phy>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&int_2p5g_phy>;
+		__overlay__ {
+			pinctrl-names = "i2p5gbe-led";
+			pinctrl-0 = <&i2p5gbe_led0_pins>;
+		};
+	};
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-eth1-mxl.dtso b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-eth1-mxl.dtso
new file mode 100644
index 00000000..34a23bbd
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-eth1-mxl.dtso
@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2022 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	compatible = "mediatek,mt7988a-rfb", "mediatek,mt7988a";
+
+	fragment@0 {
+		target = <&mdio_bus>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			/* external Maxlinear GPY211C */
+			phy13: ethernet-phy@13 {
+				reg = <13>;
+				compatible = "ethernet-phy-ieee802.3-c45";
+				phy-mode = "2500base-x";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&gmac1>;
+		__overlay__ {
+			phy-mode = "2500base-x";
+			phy-connection-type = "2500base-x";
+			phy = <&phy13>;
+			status = "okay";
+		};
+	};
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-eth1-sfp.dtso b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-eth1-sfp.dtso
new file mode 100644
index 00000000..ba40a119
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-eth1-sfp.dtso
@@ -0,0 +1,47 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2022 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	compatible = "mediatek,mt7988a-rfb", "mediatek,mt7988a";
+
+	fragment@0 {
+		target = <&i2c2>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&i2c2_0_pins>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target-path = "/";
+		__overlay__ {
+			sfp_esp1: sfp@1 {
+				compatible = "sff,sfp";
+				i2c-bus = <&i2c2>;
+				mod-def0-gpios = <&pio 82 GPIO_ACTIVE_LOW>;
+				los-gpios = <&pio 81 GPIO_ACTIVE_HIGH>;
+				tx-disable-gpios = <&pio 36 GPIO_ACTIVE_HIGH>;
+				maximum-power-milliwatt = <3000>;
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&gmac1>;
+		__overlay__ {
+			phy-mode = "10gbase-r";
+			managed = "in-band-status";
+			sfp = <&sfp_esp1>;
+			status = "okay";
+		};
+	};
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-eth2-aqr.dtso b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-eth2-aqr.dtso
new file mode 100644
index 00000000..1490f055
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-eth2-aqr.dtso
@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2022 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	compatible = "mediatek,mt7988a-rfb", "mediatek,mt7988a";
+
+	fragment@0 {
+		target = <&mdio_bus>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			/* external Aquantia AQR113C */
+			phy8: ethernet-phy@8 {
+				reg = <8>;
+				compatible = "ethernet-phy-ieee802.3-c45";
+				firmware-name = "AQR-G4_v5.7.0-AQR_EVB_Generic_X3410_StdCfg_MDISwap_USX_ID46316_VER2140.cld";
+				reset-gpios = <&pio 71 GPIO_ACTIVE_LOW>;
+				reset-assert-us = <100000>;
+				reset-deassert-us = <221000>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&gmac2>;
+		__overlay__ {
+			phy-mode = "usxgmii";
+			phy-connection-type = "usxgmii";
+			phy = <&phy8>;
+			status = "okay";
+		};
+	};
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-eth2-mxl.dtso b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-eth2-mxl.dtso
new file mode 100644
index 00000000..19e0b279
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-eth2-mxl.dtso
@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2022 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	compatible = "mediatek,mt7988a-rfb", "mediatek,mt7988a";
+
+	fragment@0 {
+		target = <&mdio_bus>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			/* external Maxlinear GPY211C */
+			phy5: ethernet-phy@5 {
+				reg = <5>;
+				compatible = "ethernet-phy-ieee802.3-c45";
+				phy-mode = "2500base-x";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&gmac2>;
+		__overlay__ {
+			phy-mode = "2500base-x";
+			phy-connection-type = "2500base-x";
+			phy = <&phy5>;
+			status = "okay";
+		};
+	};
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-eth2-sfp.dtso b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-eth2-sfp.dtso
new file mode 100644
index 00000000..b9aabd27
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-eth2-sfp.dtso
@@ -0,0 +1,47 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2022 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	compatible = "mediatek,mt7988a-rfb", "mediatek,mt7988a";
+
+	fragment@0 {
+		target = <&i2c1>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&i2c1_sfp_pins>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target-path = "/";
+		__overlay__ {
+			sfp_esp0: sfp@0 {
+				compatible = "sff,sfp";
+				i2c-bus = <&i2c1>;
+				mod-def0-gpios = <&pio 35 GPIO_ACTIVE_LOW>;
+				los-gpios = <&pio 33 GPIO_ACTIVE_HIGH>;
+				tx-disable-gpios = <&pio 29 GPIO_ACTIVE_HIGH>;
+				maximum-power-milliwatt = <3000>;
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&gmac2>;
+		__overlay__ {
+			phy-mode = "10gbase-r";
+			managed = "in-band-status";
+			sfp = <&sfp_esp0>;
+			status = "okay";
+		};
+	};
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-sd.dtso b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-sd.dtso
new file mode 100644
index 00000000..04472cc1
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-sd.dtso
@@ -0,0 +1,31 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2023 MediaTek Inc.
+ * Author: Frank Wunderlich <frank-w@public-files.de>
+ */
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	compatible = "mediatek,mt7988a-rfb", "mediatek,mt7988a";
+
+	fragment@1 {
+		target-path = <&mmc0>;
+		__overlay__ {
+			pinctrl-names = "default", "state_uhs";
+			pinctrl-0 = <&mmc0_pins_sdcard>;
+			pinctrl-1 = <&mmc0_pins_sdcard>;
+			cd-gpios = <&pio 69 GPIO_ACTIVE_LOW>;
+			bus-width = <4>;
+			max-frequency = <52000000>;
+			cap-sd-highspeed;
+			vmmc-supply = <&reg_3p3v>;
+			vqmmc-supply = <&reg_3p3v>;
+			no-mmc;
+			status = "okay";
+		};
+	};
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-snfi-nand.dtso b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-snfi-nand.dtso
new file mode 100644
index 00000000..86b0042f
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-snfi-nand.dtso
@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2022 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "mediatek,mt7988a-rfb", "mediatek,mt7988a";
+
+	fragment@0 {
+		target = <&snand>;
+		__overlay__ {
+			status = "okay";
+
+			flash@0 {
+				compatible = "spi-nand";
+				reg = <0>;
+				spi-max-frequency = <52000000>;
+				spi-tx-bus-width = <4>;
+				spi-rx-bus-width = <4>;
+				mediatek,nmbm;
+				mediatek,bmt-max-ratio = <1>;
+				mediatek,bmt-max-reserved-blocks = <64>;
+
+				partitions {
+					compatible = "fixed-partitions";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					partition@0 {
+						label = "BL2";
+						reg = <0x00000 0x0100000>;
+						read-only;
+					};
+
+					partition@100000 {
+						label = "u-boot-env";
+						reg = <0x0100000 0x0080000>;
+					};
+
+					partition@180000 {
+						label = "Factory";
+						reg = <0x180000 0x0400000>;
+					};
+
+					partition@580000 {
+						label = "FIP";
+						reg = <0x580000 0x0200000>;
+					};
+
+					partition@780000 {
+						label = "ubi";
+						reg = <0x780000 0x7080000>;
+					};
+				};
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&bch>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-spim-nand-factory.dtso b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-spim-nand-factory.dtso
new file mode 100644
index 00000000..3fe75aca
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-spim-nand-factory.dtso
@@ -0,0 +1,82 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "mediatek,mt7988a-rfb", "mediatek,mt7988a";
+
+	fragment@0 {
+		target = <&ubi_part>;
+
+		__overlay__ {
+			volumes {
+				ubi_factory: ubi-volume-factory {
+					volname = "factory";
+
+					nvmem-layout {
+						compatible = "fixed-layout";
+						#address-cells = <1>;
+						#size-cells = <1>;
+
+						eeprom_wmac: eeprom@0 {
+							reg = <0x0 0x1e00>;
+						};
+
+						gmac2_mac: eeprom@fffee {
+							reg = <0xfffee 0x6>;
+						};
+
+						gmac1_mac: eeprom@ffff4 {
+							reg = <0xffff4 0x6>;
+						};
+
+						gmac0_mac: eeprom@ffffa {
+							reg = <0xffffa 0x6>;
+						};
+					};
+				};
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&pcie0>;
+		__overlay__ {
+			pcie@0,0 {
+				reg = <0x0000 0 0 0 0>;
+
+				wifi@0,0 {
+					compatible = "mediatek,mt76";
+					reg = <0x0000 0 0 0 0>;
+					nvmem-cell-names = "eeprom";
+					nvmem-cells = <&eeprom_wmac>;
+				};
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&gmac0>;
+		__overlay__ {
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&gmac0_mac>;
+		};
+	};
+
+	fragment@3 {
+		target = <&gmac1>;
+		__overlay__ {
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&gmac1_mac>;
+		};
+	};
+
+	fragment@4 {
+		target = <&gmac2>;
+		__overlay__ {
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&gmac2_mac>;
+		};
+	};
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-spim-nand.dtso b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-spim-nand.dtso
new file mode 100644
index 00000000..b5a67c72
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-spim-nand.dtso
@@ -0,0 +1,75 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2022 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "mediatek,mt7988a-rfb", "mediatek,mt7988a";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&spi0_flash_pins>;
+			status = "okay";
+
+			flash@0 {
+				compatible = "spi-nand";
+				reg = <0>;
+				spi-max-frequency = <52000000>;
+				spi-tx-bus-width = <4>;
+				spi-rx-bus-width = <4>;
+
+				partitions {
+					compatible = "fixed-partitions";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					partition@0 {
+						label = "BL2";
+						reg = <0x00000 0x0200000>;
+						read-only;
+					};
+
+					ubi_part: partition@200000 {
+						label = "ubi";
+						reg = <0x0200000 0x7e00000>;
+						compatible = "linux,ubi";
+
+						volumes {
+							ubi-volume-ubootenv {
+								volname = "ubootenv";
+								nvmem-layout {
+									compatible = "u-boot,env-redundant-bool-layout";
+								};
+							};
+
+							ubi-volume-ubootenv2 {
+								volname = "ubootenv2";
+								nvmem-layout {
+									compatible = "u-boot,env-redundant-bool-layout";
+								};
+							};
+
+							ubi_root: ubi-volume-fit {
+								volname = "fit";
+							};
+
+						};
+					};
+				};
+			};
+		};
+	};
+
+	fragment@1 {
+		target-path = "/chosen";
+		__overlay__ {
+			rootdisk-spim-nand = <&ubi_root>;
+		};
+	};
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-spim-nor.dtso b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-spim-nor.dtso
new file mode 100644
index 00000000..33bd57b3
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb-spim-nor.dtso
@@ -0,0 +1,59 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2022 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "mediatek,mt7988a-rfb", "mediatek,mt7988a";
+
+	fragment@0 {
+		target = <&spi2>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&spi2_flash_pins>;
+			status = "okay";
+
+			flash@0 {
+				#address-cells = <1>;
+				#size-cells = <1>;
+				compatible = "jedec,spi-nor";
+				spi-cal-enable;
+				spi-cal-mode = "read-data";
+				spi-cal-datalen = <7>;
+				spi-cal-data = /bits/ 8 <
+					0x53 0x46 0x5F 0x42 0x4F 0x4F 0x54>; /* SF_BOOT */
+				spi-cal-addrlen = <1>;
+				spi-cal-addr = /bits/ 32 <0x0>;
+				reg = <0>;
+				spi-max-frequency = <52000000>;
+				spi-tx-bus-width = <4>;
+				spi-rx-bus-width = <4>;
+
+				partition@00000 {
+					label = "BL2";
+					reg = <0x00000 0x0040000>;
+				};
+				partition@40000 {
+					label = "u-boot-env";
+					reg = <0x40000 0x0010000>;
+				};
+				partition@50000 {
+					label = "Factory";
+					reg = <0x50000 0x0200000>;
+				};
+				partition@250000 {
+					label = "FIP";
+					reg = <0x250000 0x0080000>;
+				};
+				partition@2D0000 {
+					label = "firmware";
+					reg = <0x2D0000 0x1D30000>;
+				};
+			};
+		};
+	};
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb.dts b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb.dts
new file mode 100644
index 00000000..5012e7a4
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a-rfb.dts
@@ -0,0 +1,200 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2022 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+/dts-v1/;
+#include "mt7988a.dtsi"
+#include <dt-bindings/pinctrl/mt65xx.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/regulator/richtek,rt5190a-regulator.h>
+
+/ {
+	model = "MediaTek MT7988A Reference Board";
+	compatible = "mediatek,mt7988a-rfb",
+		     "mediatek,mt7988a";
+
+	chosen {
+		bootargs = "console=ttyS0,115200n1 loglevel=8  \
+			    earlycon=uart8250,mmio32,0x11000000 \
+			    pci=pcie_bus_perf";
+	};
+
+	memory {
+		reg = <0 0x40000000 0 0x40000000>;
+	};
+};
+
+&eth {
+	pinctrl-0 = <&mdio0_pins>;
+	pinctrl-names = "default";
+};
+
+&gmac0 {
+	status = "okay";
+};
+
+&cpu0 {
+	proc-supply = <&rt5190_buck3>;
+};
+
+&cpu1 {
+	proc-supply = <&rt5190_buck3>;
+};
+
+&cpu2 {
+	proc-supply = <&rt5190_buck3>;
+};
+
+&cpu3 {
+	proc-supply = <&rt5190_buck3>;
+};
+
+&cci {
+	proc-supply = <&rt5190_buck3>;
+};
+
+&eth {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&gsw_phy0 {
+	pinctrl-names = "gbe-led";
+	pinctrl-0 = <&gbe0_led0_pins>;
+};
+
+&gsw_phy0_led0 {
+	status = "okay";
+	color = <LED_COLOR_ID_GREEN>;
+};
+
+&gsw_phy1 {
+	pinctrl-names = "gbe-led";
+	pinctrl-0 = <&gbe1_led0_pins>;
+};
+
+&gsw_phy1_led0 {
+	status = "okay";
+	color = <LED_COLOR_ID_GREEN>;
+};
+
+&gsw_phy2 {
+	pinctrl-names = "gbe-led";
+	pinctrl-0 = <&gbe2_led0_pins>;
+};
+
+&gsw_phy2_led0 {
+	status = "okay";
+	color = <LED_COLOR_ID_GREEN>;
+};
+
+&gsw_phy3 {
+	pinctrl-names = "gbe-led";
+	pinctrl-0 = <&gbe3_led0_pins>;
+};
+
+&gsw_phy3_led0 {
+	status = "okay";
+	color = <LED_COLOR_ID_GREEN>;
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c0_pins>;
+	status = "okay";
+
+	rt5190a_64: rt5190a@64 {
+		compatible = "richtek,rt5190a";
+		reg = <0x64>;
+		/*interrupts-extended = <&gpio26 0 IRQ_TYPE_LEVEL_LOW>;*/
+		vin2-supply = <&rt5190_buck1>;
+		vin3-supply = <&rt5190_buck1>;
+		vin4-supply = <&rt5190_buck1>;
+
+		regulators {
+			rt5190_buck1: buck1 {
+				regulator-name = "rt5190a-buck1";
+				regulator-min-microvolt = <5090000>;
+				regulator-max-microvolt = <5090000>;
+				regulator-allowed-modes =
+				<RT5190A_OPMODE_AUTO RT5190A_OPMODE_FPWM>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			buck2 {
+				regulator-name = "vcore";
+				regulator-min-microvolt = <600000>;
+				regulator-max-microvolt = <1400000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			rt5190_buck3: buck3 {
+				regulator-name = "vproc";
+				regulator-min-microvolt = <600000>;
+				regulator-max-microvolt = <1400000>;
+				regulator-boot-on;
+			};
+			buck4 {
+				regulator-name = "rt5190a-buck4";
+				regulator-min-microvolt = <850000>;
+				regulator-max-microvolt = <850000>;
+				regulator-allowed-modes =
+				<RT5190A_OPMODE_AUTO RT5190A_OPMODE_FPWM>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			ldo {
+				regulator-name = "rt5190a-ldo";
+				regulator-min-microvolt = <1200000>;
+				regulator-max-microvolt = <1200000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+		};
+	};
+};
+
+&pcie0 {
+	status = "okay";
+};
+
+&pcie1 {
+	status = "okay";
+};
+
+&pcie2 {
+	status = "disabled";
+};
+
+&pcie3 {
+	status = "okay";
+};
+
+&ssusb0 {
+	status = "okay";
+};
+
+&ssusb1 {
+	status = "okay";
+};
+
+&tphy {
+	status = "okay";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&xphy {
+	status = "okay";
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a.dtsi b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a.dtsi
new file mode 100644
index 00000000..6a15dcff
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/arch/arm64/boot/dts/mediatek/mt7988a.dtsi
@@ -0,0 +1,1594 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2023 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+#include <dt-bindings/clock/mediatek,mt7988-clk.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/interrupt-controller/irq.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/phy/phy.h>
+#include <dt-bindings/pinctrl/mt65xx.h>
+#include <dt-bindings/reset/mediatek,mt7988-resets.h>
+#include <dt-bindings/thermal/thermal.h>
+
+/* TOPRGU resets */
+#define MT7988_TOPRGU_SGMII0_GRST		1
+#define MT7988_TOPRGU_SGMII1_GRST		2
+#define MT7988_TOPRGU_XFI0_GRST			12
+#define MT7988_TOPRGU_XFI1_GRST			13
+#define MT7988_TOPRGU_XFI_PEXTP0_GRST		14
+#define MT7988_TOPRGU_XFI_PEXTP1_GRST		15
+#define MT7988_TOPRGU_XFI_PLL_GRST		16
+
+/ {
+	compatible = "mediatek,mt7988a";
+	interrupt-parent = <&gic>;
+	#address-cells = <2>;
+	#size-cells = <2>;
+
+	cci: cci {
+		compatible = "mediatek,mt7988-cci",
+			     "mediatek,mt8183-cci";
+		clocks = <&mcusys CLK_MCU_BUS_DIV_SEL>,
+			 <&topckgen CLK_TOP_XTAL>;
+		clock-names = "cci", "intermediate";
+		operating-points-v2 = <&cci_opp>;
+	};
+
+	cpus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		cpu0: cpu@0 {
+			compatible = "arm,cortex-a73";
+			reg = <0x0>;
+			device_type = "cpu";
+			enable-method = "psci";
+			clocks = <&mcusys CLK_MCU_ARM_DIV_SEL>,
+				 <&topckgen CLK_TOP_XTAL>;
+			clock-names = "cpu", "intermediate";
+			operating-points-v2 = <&cluster0_opp>;
+			mediatek,cci = <&cci>;
+		};
+
+		cpu1: cpu@1 {
+			compatible = "arm,cortex-a73";
+			reg = <0x1>;
+			device_type = "cpu";
+			enable-method = "psci";
+			clocks = <&mcusys CLK_MCU_ARM_DIV_SEL>,
+				 <&topckgen CLK_TOP_XTAL>;
+			clock-names = "cpu", "intermediate";
+			operating-points-v2 = <&cluster0_opp>;
+			mediatek,cci = <&cci>;
+		};
+
+		cpu2: cpu@2 {
+			compatible = "arm,cortex-a73";
+			reg = <0x2>;
+			device_type = "cpu";
+			enable-method = "psci";
+			clocks = <&mcusys CLK_MCU_ARM_DIV_SEL>,
+				 <&topckgen CLK_TOP_XTAL>;
+			clock-names = "cpu", "intermediate";
+			operating-points-v2 = <&cluster0_opp>;
+			mediatek,cci = <&cci>;
+		};
+
+		cpu3: cpu@3 {
+			compatible = "arm,cortex-a73";
+			reg = <0x3>;
+			device_type = "cpu";
+			enable-method = "psci";
+			clocks = <&mcusys CLK_MCU_ARM_DIV_SEL>,
+				 <&topckgen CLK_TOP_XTAL>;
+			clock-names = "cpu", "intermediate";
+			operating-points-v2 = <&cluster0_opp>;
+			mediatek,cci = <&cci>;
+		};
+
+		cluster0_opp: opp_table0 {
+			compatible = "operating-points-v2";
+			opp-shared;
+
+			opp00 {
+				opp-hz = /bits/ 64 <800000000>;
+				opp-microvolt = <850000>;
+			};
+
+			opp01 {
+				opp-hz = /bits/ 64 <1100000000>;
+				opp-microvolt = <850000>;
+			};
+
+			opp02 {
+				opp-hz = /bits/ 64 <1500000000>;
+				opp-microvolt = <850000>;
+			};
+
+			opp03 {
+				opp-hz = /bits/ 64 <1800000000>;
+				opp-microvolt = <900000>;
+			};
+		};
+	};
+
+	cci_opp: opp_table_cci {
+		compatible = "operating-points-v2";
+		opp-shared;
+
+		opp00 {
+			opp-hz = /bits/ 64 <480000000>;
+			opp-microvolt = <850000>;
+		};
+
+		opp01 {
+			opp-hz = /bits/ 64 <660000000>;
+			opp-microvolt = <850000>;
+		};
+
+		opp02 {
+			opp-hz = /bits/ 64 <900000000>;
+			opp-microvolt = <850000>;
+		};
+
+		opp03 {
+			opp-hz = /bits/ 64 <1080000000>;
+			opp-microvolt = <900000>;
+		};
+	};
+
+	clk40m: oscillator@0 {
+		compatible = "fixed-clock";
+		clock-frequency = <40000000>;
+		#clock-cells = <0>;
+		clock-output-names = "clkxtal";
+	};
+
+	fan: pwm-fan {
+		compatible = "pwm-fan";
+		/* cooling level (0, 1, 2, 3) : (0% duty, 30% duty, 50% duty, 100% duty) */
+		cooling-levels = <0 80 128 255>;
+		#cooling-cells = <2>;
+		#thermal-sensor-cells = <1>;
+		status = "disabled";
+	};
+
+	pmu {
+		compatible = "arm,cortex-a73-pmu";
+		interrupt-parent = <&gic>;
+		interrupts = <GIC_PPI 7 IRQ_TYPE_LEVEL_LOW>;
+	};
+
+	psci {
+		compatible = "arm,psci-0.2";
+		method = "smc";
+	};
+
+	reg_1p8v: regulator-1p8v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-1.8V";
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <1800000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reg_3p3v: regulator-3p3v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-3.3V";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reserved-memory {
+		ranges;
+		#address-cells = <2>;
+		#size-cells = <2>;
+
+		/* 320 KiB reserved for ARM Trusted Firmware (BL31 and BL32) */
+		secmon_reserved: secmon@43000000 {
+			reg = <0 0x43000000 0 0x50000>;
+			no-map;
+		};
+	};
+
+	soc {
+		compatible = "simple-bus";
+		ranges;
+		#address-cells = <2>;
+		#size-cells = <2>;
+
+		gic: interrupt-controller@c000000 {
+			compatible = "arm,gic-v3";
+			reg = <0 0x0c000000 0 0x40000>,  /* GICD */
+			      <0 0x0c080000 0 0x200000>, /* GICR */
+			      <0 0x0c400000 0 0x2000>,   /* GICC */
+			      <0 0x0c410000 0 0x1000>,   /* GICH */
+			      <0 0x0c420000 0 0x2000>;   /* GICV */
+			interrupt-parent = <&gic>;
+			interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-controller;
+			#interrupt-cells = <3>;
+		};
+
+		phyfw: phy-firmware@f000000 {
+			compatible = "mediatek,2p5gphy-fw";
+			reg = <0 0x0f100000 0 0x20000>,
+			      <0 0x0f0f0018 0 0x20>;
+		};
+
+		infracfg: infracfg@10001000 {
+			compatible = "mediatek,mt7988-infracfg", "syscon";
+			reg = <0 0x10001000 0 0x1000>;
+			#clock-cells = <1>;
+			#reset-cells = <1>;
+		};
+
+		topckgen: topckgen@1001b000 {
+			compatible = "mediatek,mt7988-topckgen", "syscon";
+			reg = <0 0x1001b000 0 0x1000>;
+			#clock-cells = <1>;
+		};
+
+		watchdog: watchdog@1001c000 {
+			compatible = "mediatek,mt7988-wdt",
+				     "mediatek,mt6589-wdt",
+				     "syscon";
+			reg = <0 0x1001c000 0 0x1000>;
+			interrupts = <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH>;
+			#reset-cells = <1>;
+		};
+
+		apmixedsys: apmixedsys@1001e000 {
+			compatible = "mediatek,mt7988-apmixedsys";
+			reg = <0 0x1001e000 0 0x1000>;
+			#clock-cells = <1>;
+		};
+
+		pio: pinctrl@1001f000 {
+			compatible = "mediatek,mt7988-pinctrl", "syscon";
+			reg = <0 0x1001f000 0 0x1000>,
+			      <0 0x11c10000 0 0x1000>,
+			      <0 0x11d00000 0 0x1000>,
+			      <0 0x11d20000 0 0x1000>,
+			      <0 0x11e00000 0 0x1000>,
+			      <0 0x11f00000 0 0x1000>,
+			      <0 0x1000b000 0 0x1000>;
+			reg-names = "gpio_base", "iocfg_tr_base",
+				    "iocfg_br_base", "iocfg_rb_base",
+				    "iocfg_lb_base", "iocfg_tl_base", "eint";
+			gpio-controller;
+			#gpio-cells = <2>;
+			gpio-ranges = <&pio 0 0 84>;
+			interrupt-controller;
+			interrupts = <GIC_SPI 225 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-parent = <&gic>;
+			#interrupt-cells = <2>;
+
+			mdio0_pins: mdio0-pins {
+				mux {
+					function = "eth";
+					groups = "mdc_mdio0";
+				};
+
+				conf {
+					groups = "mdc_mdio0";
+					drive-strength = <MTK_DRIVE_8mA>;
+				};
+			};
+
+			i2c0_pins: i2c0-pins-g0 {
+				mux {
+					function = "i2c";
+					groups = "i2c0_1";
+				};
+			};
+
+			i2c1_pins: i2c1-pins-g0 {
+				mux {
+					function = "i2c";
+					groups = "i2c1_0";
+				};
+			};
+
+			i2c1_sfp_pins: i2c1-sfp-pins-g0 {
+				mux {
+					function = "i2c";
+					groups = "i2c1_sfp";
+				};
+			};
+
+			i2c2_pins: i2c2-pins {
+				mux {
+					function = "i2c";
+					groups = "i2c2";
+				};
+			};
+
+			i2c2_0_pins: i2c2-pins-g0 {
+				mux {
+					function = "i2c";
+					groups = "i2c2_0";
+				};
+			};
+
+			i2c2_1_pins: i2c2-pins-g1 {
+				mux {
+					function = "i2c";
+					groups = "i2c2_1";
+				};
+			};
+
+			gbe0_led0_pins: gbe0-led0-pins {
+				mux {
+					function = "led";
+					groups = "gbe0_led0";
+				};
+			};
+
+			gbe1_led0_pins: gbe1-led0-pins {
+				mux {
+					function = "led";
+					groups = "gbe1_led0";
+				};
+			};
+
+			gbe2_led0_pins: gbe2-led0-pins {
+				mux {
+					function = "led";
+					groups = "gbe2_led0";
+				};
+			};
+
+			gbe3_led0_pins: gbe3-led0-pins {
+				mux {
+					function = "led";
+					groups = "gbe3_led0";
+				};
+			};
+
+			gbe0_led1_pins: gbe0-led1-pins {
+				mux {
+					function = "led";
+					groups = "gbe0_led1";
+				};
+			};
+
+			gbe1_led1_pins: gbe1-led1-pins {
+				mux {
+					function = "led";
+					groups = "gbe1_led1";
+				};
+			};
+
+			gbe2_led1_pins: gbe2-led1-pins {
+				mux {
+					function = "led";
+					groups = "gbe2_led1";
+				};
+			};
+
+			gbe3_led1_pins: gbe3-led1-pins {
+				mux {
+					function = "led";
+					groups = "gbe3_led1";
+				};
+			};
+
+			i2p5gbe_led0_pins: 2p5gbe-led0-pins {
+				mux {
+					function = "led";
+					groups = "2p5gbe_led0";
+				};
+			};
+
+			i2p5gbe_led1_pins: 2p5gbe-led1-pins {
+				mux {
+					function = "led";
+					groups = "2p5gbe_led1";
+				};
+			};
+
+			mmc0_pins_emmc_45: mmc0-pins-emmc-45 {
+				mux {
+					function = "flash";
+					groups = "emmc_45";
+				};
+			};
+
+			mmc0_pins_emmc_51: mmc0-pins-emmc-51 {
+				mux {
+					function = "flash";
+					groups = "emmc_51";
+				};
+			};
+
+			mmc0_pins_sdcard: mmc0-pins-sdcard {
+				mux {
+					function = "flash";
+					groups = "sdcard";
+				};
+			};
+
+			uart0_pins: uart0-pins {
+				mux {
+					function = "uart";
+					groups =  "uart0";
+				};
+			};
+
+			uart1_0_pins: uart1-0-pins {
+				mux {
+					function = "uart";
+					groups =  "uart1_0";
+				};
+			};
+
+			uart1_1_pins: uart1-1-pins {
+				mux {
+					function = "uart";
+					groups =  "uart1_1";
+				};
+			};
+
+			uart1_2_pins: uart1-2-pins {
+				mux {
+					function = "uart";
+					groups =  "uart1_2";
+				};
+			};
+
+			uart1_2_lite_pins: uart1-2-lite-pins {
+				mux {
+					function = "uart";
+					groups =  "uart1_2_lite";
+				};
+			};
+
+			uart2_pins: uart2-pins {
+				mux {
+					function = "uart";
+					groups =  "uart2";
+				};
+			};
+
+			uart2_0_pins: uart2-0-pins {
+				mux {
+					function = "uart";
+					groups =  "uart2_0";
+				};
+			};
+
+			uart2_1_pins: uart2-1-pins {
+				mux {
+					function = "uart";
+					groups =  "uart2_1";
+				};
+			};
+
+			uart2_2_pins: uart2-2-pins {
+				mux {
+					function = "uart";
+					groups =  "uart2_2";
+				};
+			};
+
+			uart2_3_pins: uart2-3-pins {
+				mux {
+					function = "uart";
+					groups =  "uart2_3";
+				};
+			};
+
+			snfi_pins: snfi-pins {
+				mux {
+					function = "flash";
+					groups = "snfi";
+				};
+			};
+
+			spi0_pins: spi0-pins {
+				mux {
+					function = "spi";
+					groups = "spi0";
+				};
+			};
+
+			spi0_flash_pins: spi0-flash-pins {
+				mux {
+					function = "spi";
+					groups = "spi0", "spi0_wp_hold";
+				};
+			};
+
+			spi1_pins: spi1-pins {
+				mux {
+					function = "spi";
+					groups = "spi1";
+				};
+			};
+
+			spi2_pins: spi2-pins {
+				mux {
+					function = "spi";
+					groups = "spi2";
+				};
+			};
+
+			spi2_flash_pins: spi2-flash-pins {
+				mux {
+					function = "spi";
+					groups = "spi2", "spi2_wp_hold";
+				};
+			};
+
+			pcie0_pins: pcie0-pins {
+				mux {
+					function = "pcie";
+					groups = "pcie_2l_0_pereset", "pcie_clk_req_n0_0",
+						 "pcie_wake_n0_0";
+				};
+			};
+
+			pcie1_pins: pcie1-pins {
+				mux {
+					function = "pcie";
+					groups = "pcie_2l_1_pereset", "pcie_clk_req_n1",
+						 "pcie_wake_n1_0";
+				};
+			};
+
+			pcie2_pins: pcie2-pins {
+				mux {
+					function = "pcie";
+					groups = "pcie_1l_0_pereset", "pcie_clk_req_n2_0",
+						 "pcie_wake_n2_0";
+				};
+			};
+
+			pcie3_pins: pcie3-pins {
+				mux {
+					function = "pcie";
+					groups = "pcie_1l_1_pereset", "pcie_clk_req_n3",
+						 "pcie_wake_n3_0";
+				};
+			};
+		};
+
+		pwm: pwm@10048000 {
+			compatible = "mediatek,mt7988-pwm";
+			reg = <0 0x10048000 0 0x1000>;
+			#pwm-cells = <2>;
+			clocks = <&infracfg CLK_INFRA_66M_PWM_BCK>,
+				 <&infracfg CLK_INFRA_66M_PWM_HCK>,
+				 <&infracfg CLK_INFRA_66M_PWM_CK1>,
+				 <&infracfg CLK_INFRA_66M_PWM_CK2>,
+				 <&infracfg CLK_INFRA_66M_PWM_CK3>,
+				 <&infracfg CLK_INFRA_66M_PWM_CK4>,
+				 <&infracfg CLK_INFRA_66M_PWM_CK5>,
+				 <&infracfg CLK_INFRA_66M_PWM_CK6>,
+				 <&infracfg CLK_INFRA_66M_PWM_CK7>,
+				 <&infracfg CLK_INFRA_66M_PWM_CK8>;
+			clock-names = "top", "main", "pwm1", "pwm2", "pwm3",
+				      "pwm4","pwm5","pwm6","pwm7","pwm8";
+			status = "disabled";
+		};
+
+		sgmiisys0: syscon@10060000 {
+			compatible = "mediatek,mt7988-sgmiisys",
+				     "mediatek,mt7988-sgmiisys0",
+				     "syscon",
+				     "simple-mfd";
+			reg = <0 0x10060000 0 0x1000>;
+			resets = <&watchdog MT7988_TOPRGU_SGMII0_GRST>;
+			#clock-cells = <1>;
+
+			sgmiipcs0: pcs {
+				compatible = "mediatek,mt7988-sgmii";
+				clocks = <&topckgen CLK_TOP_SGM_0_SEL>,
+					 <&sgmiisys0 CLK_SGM0_TX_EN>,
+					 <&sgmiisys0 CLK_SGM0_RX_EN>;
+				clock-names = "sgmii_sel", "sgmii_tx", "sgmii_rx";
+			};
+		};
+
+		sgmiisys1: syscon@10070000 {
+			compatible = "mediatek,mt7988-sgmiisys",
+				     "mediatek,mt7988-sgmiisys1",
+				     "syscon",
+				     "simple-mfd";
+			reg = <0 0x10070000 0 0x1000>;
+			resets = <&watchdog MT7988_TOPRGU_SGMII1_GRST>;
+			#clock-cells = <1>;
+
+			sgmiipcs1: pcs {
+				compatible = "mediatek,mt7988-sgmii";
+				clocks = <&topckgen CLK_TOP_SGM_1_SEL>,
+					 <&sgmiisys1 CLK_SGM1_TX_EN>,
+					 <&sgmiisys1 CLK_SGM1_RX_EN>;
+				clock-names = "sgmii_sel", "sgmii_tx", "sgmii_rx";
+			};
+		};
+
+		usxgmiisys0: pcs@10080000 {
+			compatible = "mediatek,mt7988-usxgmiisys";
+			reg = <0 0x10080000 0 0x1000>;
+			resets = <&watchdog MT7988_TOPRGU_XFI0_GRST>;
+			clocks = <&topckgen CLK_TOP_USXGMII_SBUS_0_SEL>;
+		};
+
+		usxgmiisys1: pcs@10081000 {
+			compatible = "mediatek,mt7988-usxgmiisys";
+			reg = <0 0x10081000 0 0x1000>;
+			resets = <&watchdog MT7988_TOPRGU_XFI1_GRST>;
+			clocks = <&topckgen CLK_TOP_USXGMII_SBUS_1_SEL>;
+		};
+
+		mcusys: mcusys@100e0000 {
+			compatible = "mediatek,mt7988-mcusys", "syscon";
+			reg = <0 0x100e0000 0 0x1000>;
+			#clock-cells = <1>;
+		};
+
+		uart0: serial@11000000 {
+			compatible = "mediatek,mt7986-uart",
+				     "mediatek,mt6577-uart";
+			reg = <0 0x11000000 0 0x100>;
+			interrupts = <GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>;
+			/*
+			 * 8250-mtk driver don't control "baud" clock since commit
+			 * e32a83c70cf9 (kernel v5.7), but both "baud" and "bus" clocks
+			 * still need to be passed to the driver to prevent probe fail
+			 */
+			clocks = <&topckgen CLK_TOP_UART_SEL>,
+				 <&infracfg CLK_INFRA_52M_UART0_CK>;
+			clock-names = "baud", "bus";
+			assigned-clocks = <&topckgen CLK_TOP_UART_SEL>,
+					  <&infracfg CLK_INFRA_MUX_UART0_SEL>;
+			assigned-clock-parents = <&topckgen CLK_TOP_XTAL>,
+						 <&topckgen CLK_TOP_UART_SEL>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&uart0_pins>;
+			status = "disabled";
+		};
+
+		uart1: serial@11000100 {
+			compatible = "mediatek,mt7986-uart",
+				     "mediatek,mt6577-uart";
+			reg = <0 0x11000100 0 0x100>;
+			interrupts = <GIC_SPI 124 IRQ_TYPE_LEVEL_HIGH>;
+			/*
+			 * 8250-mtk driver don't control "baud" clock since commit
+			 * e32a83c70cf9 (kernel v5.7), but both "baud" and "bus" clocks
+			 * still need to be passed to the driver to prevent probe fail
+			 */
+			clocks = <&topckgen CLK_TOP_UART_SEL>,
+				 <&infracfg CLK_INFRA_52M_UART1_CK>;
+			clock-names = "baud", "bus";
+			assigned-clocks = <&topckgen CLK_TOP_UART_SEL>,
+					  <&infracfg CLK_INFRA_MUX_UART1_SEL>;
+			assigned-clock-parents = <&topckgen CLK_TOP_XTAL>,
+						 <&topckgen CLK_TOP_UART_SEL>;
+			status = "disabled";
+		};
+
+		uart2: serial@11000200 {
+			compatible = "mediatek,mt7986-uart",
+				     "mediatek,mt6577-uart";
+			reg = <0 0x11000200 0 0x100>;
+			interrupts = <GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>;
+			/*
+			 * 8250-mtk driver don't control "baud" clock since commit
+			 * e32a83c70cf9 (kernel v5.7), but both "baud" and "bus" clocks
+			 * still need to be passed to the driver to prevent probe fail
+			 */
+			clocks = <&topckgen CLK_TOP_UART_SEL>,
+				 <&infracfg CLK_INFRA_52M_UART2_CK>;
+			clock-names = "baud", "bus";
+			assigned-clocks = <&topckgen CLK_TOP_UART_SEL>,
+					  <&infracfg CLK_INFRA_MUX_UART2_SEL>;
+			assigned-clock-parents = <&topckgen CLK_TOP_XTAL>,
+						 <&topckgen CLK_TOP_UART_SEL>;
+			status = "disabled";
+		};
+
+		snand: spi@11001000 {
+			compatible = "mediatek,mt7986-snand";
+			reg = <0 0x11001000 0 0x1000>;
+			interrupts = <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&infracfg CLK_INFRA_SPINFI>,
+				 <&infracfg CLK_INFRA_NFI>;
+			clock-names = "pad_clk", "nfi_clk";
+			assigned-clocks = <&topckgen CLK_TOP_SPINFI_SEL>,
+					  <&topckgen CLK_TOP_NFI1X_SEL>;
+			assigned-clock-parents = <&topckgen CLK_TOP_MPLL_D8>,
+						 <&topckgen CLK_TOP_MPLL_D8>;
+			nand-ecc-engine = <&bch>;
+			mediatek,quad-spi;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&snfi_pins>;
+			status = "disabled";
+		};
+
+		bch: ecc@11002000 {
+			compatible = "mediatek,mt7686-ecc";
+			reg = <0 0x11002000 0 0x1000>;
+			interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&topckgen CLK_TOP_NFI1X_SEL>;
+			clock-names = "nfiecc_clk";
+			status = "disabled";
+		};
+
+		i2c0: i2c@11003000 {
+			compatible = "mediatek,mt7988-i2c",
+				     "mediatek,mt7981-i2c";
+			reg = <0 0x11003000 0 0x1000>,
+			      <0 0x10217080 0 0x80>;
+			interrupts = <GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>;
+			clock-div = <1>;
+			clocks = <&infracfg CLK_INFRA_I2C_BCK>,
+				 <&infracfg CLK_INFRA_66M_AP_DMA_BCK>;
+			clock-names = "main", "dma";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		i2c1: i2c@11004000 {
+			compatible = "mediatek,mt7988-i2c",
+				     "mediatek,mt7981-i2c";
+			reg = <0 0x11004000 0 0x1000>,
+			      <0 0x10217100 0 0x80>;
+			interrupts = <GIC_SPI 144 IRQ_TYPE_LEVEL_HIGH>;
+			clock-div = <1>;
+			clocks = <&infracfg CLK_INFRA_I2C_BCK>,
+				 <&infracfg CLK_INFRA_66M_AP_DMA_BCK>;
+			clock-names = "main", "dma";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		i2c2: i2c@11005000 {
+			compatible = "mediatek,mt7988-i2c",
+				"mediatek,mt7981-i2c";
+			reg = <0 0x11005000 0 0x1000>,
+			      <0 0x10217180 0 0x80>;
+			interrupts = <GIC_SPI 145 IRQ_TYPE_LEVEL_HIGH>;
+			clock-div = <1>;
+			clocks = <&infracfg CLK_INFRA_I2C_BCK>,
+				 <&infracfg CLK_INFRA_66M_AP_DMA_BCK>;
+			clock-names = "main", "dma";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		spi0: spi@11007000 {
+			compatible = "mediatek,ipm-spi-quad", "mediatek,spi-ipm";
+			reg = <0 0x11007000 0 0x100>;
+			interrupts = <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&topckgen CLK_TOP_MPLL_D2>,
+				 <&topckgen CLK_TOP_SPI_SEL>,
+				 <&infracfg CLK_INFRA_104M_SPI0>,
+				 <&infracfg CLK_INFRA_66M_SPI0_HCK>;
+			clock-names = "parent-clk", "sel-clk", "spi-clk",
+				      "spi-hclk";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		spi1: spi@11008000 {
+			compatible = "mediatek,ipm-spi-single", "mediatek,spi-ipm";
+			reg = <0 0x11008000 0 0x100>;
+			interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&topckgen CLK_TOP_MPLL_D2>,
+				 <&topckgen CLK_TOP_SPI_SEL>,
+				 <&infracfg CLK_INFRA_104M_SPI1>,
+				 <&infracfg CLK_INFRA_66M_SPI1_HCK>;
+			clock-names = "parent-clk", "sel-clk", "spi-clk",
+				      "spi-hclk";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&spi1_pins>;
+			status = "disabled";
+		};
+
+		spi2: spi@11009000 {
+			compatible = "mediatek,ipm-spi-quad", "mediatek,spi-ipm";
+			reg = <0 0x11009000 0 0x100>;
+			interrupts = <GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&topckgen CLK_TOP_MPLL_D2>,
+				 <&topckgen CLK_TOP_SPI_SEL>,
+				 <&infracfg CLK_INFRA_104M_SPI2_BCK>,
+				 <&infracfg CLK_INFRA_66M_SPI2_HCK>;
+			clock-names = "parent-clk", "sel-clk", "spi-clk",
+				      "spi-hclk";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		lvts: lvts@1100a000 {
+			compatible = "mediatek,mt7988-lvts-ap";
+			reg = <0 0x1100a000 0 0x1000>;
+			clocks = <&infracfg CLK_INFRA_26M_THERM_SYSTEM>;
+			clock-names = "lvts_clk";
+			interrupts = <GIC_SPI 138 IRQ_TYPE_LEVEL_HIGH>;
+			resets = <&infracfg MT7988_INFRA_RST1_THERM_CTRL_SWRST>;
+			nvmem-cells = <&lvts_calibration>;
+			nvmem-cell-names = "lvts-calib-data-1";
+			#thermal-sensor-cells = <1>;
+		};
+
+		ssusb0: usb@11190000 {
+			compatible = "mediatek,mt7988-xhci",
+				     "mediatek,mtk-xhci";
+			reg = <0 0x11190000 0 0x2e00>,
+			      <0 0x11193e00 0 0x0100>;
+			reg-names = "mac", "ippc";
+			interrupts = <GIC_SPI 173 IRQ_TYPE_LEVEL_HIGH>;
+			phys = <&xphyu2port0 PHY_TYPE_USB2>,
+			       <&xphyu3port0 PHY_TYPE_USB3>;
+			clocks = <&infracfg CLK_INFRA_USB_SYS>,
+				 <&infracfg CLK_INFRA_USB_XHCI>,
+				 <&infracfg CLK_INFRA_USB_REF>,
+				 <&infracfg CLK_INFRA_66M_USB_HCK>,
+				 <&infracfg CLK_INFRA_133M_USB_HCK>;
+			clock-names = "sys_ck",
+				      "xhci_ck",
+				      "ref_ck",
+				      "mcu_ck",
+				      "dma_ck";
+			#address-cells = <2>;
+			#size-cells = <2>;
+			mediatek,p0_speed_fixup;
+			status = "disabled";
+		};
+
+		ssusb1: usb@11200000 {
+			compatible = "mediatek,mt7988-xhci",
+				     "mediatek,mtk-xhci";
+			reg = <0 0x11200000 0 0x2e00>,
+			      <0 0x11203e00 0 0x0100>;
+			reg-names = "mac", "ippc";
+			interrupts = <GIC_SPI 172 IRQ_TYPE_LEVEL_HIGH>;
+			phys = <&tphyu2port0 PHY_TYPE_USB2>,
+			       <&tphyu3port0 PHY_TYPE_USB3>;
+			clocks = <&infracfg CLK_INFRA_USB_SYS_CK_P1>,
+				 <&infracfg CLK_INFRA_USB_XHCI_CK_P1>,
+				 <&infracfg CLK_INFRA_USB_CK_P1>,
+				 <&infracfg CLK_INFRA_66M_USB_HCK_CK_P1>,
+				 <&infracfg CLK_INFRA_133M_USB_HCK_CK_P1>;
+			clock-names = "sys_ck",
+				      "xhci_ck",
+				      "ref_ck",
+				      "mcu_ck",
+				      "dma_ck";
+			#address-cells = <2>;
+			#size-cells = <2>;
+			status = "disabled";
+		};
+
+		afe: audio-controller@11210000 {
+			compatible = "mediatek,mt79xx-audio";
+			reg = <0 0x11210000 0 0x9000>;
+			interrupts = <GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&infracfg CLK_INFRA_66M_AUD_SLV_BCK>,
+				 <&infracfg CLK_INFRA_AUD_26M>,
+				 <&infracfg CLK_INFRA_AUD_L>,
+				 <&infracfg CLK_INFRA_AUD_AUD>,
+				 <&infracfg CLK_INFRA_AUD_EG2>,
+				 <&topckgen CLK_TOP_AUD_SEL>,
+				 <&topckgen CLK_TOP_AUD_I2S_M>;
+			clock-names = "aud_bus_ck",
+				      "aud_26m_ck",
+				      "aud_l_ck",
+				      "aud_aud_ck",
+				      "aud_eg2_ck",
+				      "aud_sel",
+				      "aud_i2s_m";
+			assigned-clocks = <&topckgen CLK_TOP_AUD_SEL>,
+					  <&topckgen CLK_TOP_A1SYS_SEL>,
+					  <&topckgen CLK_TOP_AUD_L_SEL>,
+					  <&topckgen CLK_TOP_A_TUNER_SEL>;
+			assigned-clock-parents = <&apmixedsys CLK_APMIXED_APLL2>,
+						 <&topckgen CLK_TOP_APLL2_D4>,
+						 <&apmixedsys CLK_APMIXED_APLL2>,
+						 <&topckgen CLK_TOP_APLL2_D4>;
+			status = "disabled";
+		};
+
+		mmc0: mmc@11230000 {
+			compatible = "mediatek,mt7986-mmc",
+				     "mediatek,mt7981-mmc";
+			reg = <0 0x11230000 0 0x1000>,
+			      <0 0x11D60000 0 0x1000>;
+			interrupts = <GIC_SPI 143 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&infracfg CLK_INFRA_MSDC400>,
+				 <&infracfg CLK_INFRA_MSDC2_HCK>,
+				 <&infracfg CLK_INFRA_66M_MSDC_0_HCK>,
+				 <&infracfg CLK_INFRA_133M_MSDC_0_HCK>;
+			assigned-clocks = <&topckgen CLK_TOP_EMMC_250M_SEL>,
+					  <&topckgen CLK_TOP_EMMC_400M_SEL>;
+			assigned-clock-parents = <&topckgen CLK_TOP_NET1PLL_D5_D2>,
+						 <&apmixedsys CLK_APMIXED_MSDCPLL>;
+			clock-names = "source",
+				      "hclk",
+				      "axi_cg",
+				      "ahb_cg";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		pcie2: pcie@11280000 {
+			compatible = "mediatek,mt7988-pcie",
+				     "mediatek,mt7986-pcie",
+				     "mediatek,mt8192-pcie";
+			reg = <0 0x11280000 0 0x2000>;
+			reg-names = "pcie-mac";
+			ranges = <0x81000000 0x00 0x20000000 0x00
+				  0x20000000 0x00 0x00200000>,
+				 <0x82000000 0x00 0x20200000 0x00
+				  0x20200000 0x00 0x07e00000>;
+			device_type = "pci";
+			linux,pci-domain = <3>;
+			interrupts = <GIC_SPI 170 IRQ_TYPE_LEVEL_HIGH>;
+			bus-range = <0x00 0xff>;
+			clocks = <&infracfg CLK_INFRA_PCIE_PIPE_P2>,
+				 <&infracfg CLK_INFRA_PCIE_GFMUX_TL_P2>,
+				 <&infracfg CLK_INFRA_PCIE_PERI_26M_CK_P2>,
+				 <&infracfg CLK_INFRA_133M_PCIE_CK_P2>,
+				 <&topckgen CLK_TOP_PEXTP_P2_SEL>;
+			clock-names = "pl_250m", "tl_26m", "peri_26m",
+				      "top_133m", "pextp_clk";
+			pinctrl-names = "default";
+			pinctrl-0 = <&pcie2_pins>;
+			phys = <&xphyu3port0 PHY_TYPE_PCIE>;
+			phy-names = "pcie-phy";
+			#interrupt-cells = <1>;
+			interrupt-map-mask = <0 0 0 0x7>;
+			interrupt-map = <0 0 0 1 &pcie_intc2 0>,
+					<0 0 0 2 &pcie_intc2 1>,
+					<0 0 0 3 &pcie_intc2 2>,
+					<0 0 0 4 &pcie_intc2 3>;
+			#address-cells = <3>;
+			#size-cells = <2>;
+			status = "disabled";
+
+			pcie_intc2: interrupt-controller {
+				#address-cells = <0>;
+				#interrupt-cells = <1>;
+				interrupt-controller;
+			};
+		};
+
+		pcie3: pcie@11290000 {
+			compatible = "mediatek,mt7988-pcie",
+				     "mediatek,mt7986-pcie",
+				     "mediatek,mt8192-pcie";
+			reg = <0 0x11290000 0 0x2000>;
+			reg-names = "pcie-mac";
+			ranges = <0x81000000 0x00 0x28000000 0x00
+				  0x28000000 0x00 0x00200000>,
+				 <0x82000000 0x00 0x28200000 0x00
+				  0x28200000 0x00 0x07e00000>;
+			device_type = "pci";
+			linux,pci-domain = <2>;
+			interrupts = <GIC_SPI 171 IRQ_TYPE_LEVEL_HIGH>;
+			bus-range = <0x00 0xff>;
+			clocks = <&infracfg CLK_INFRA_PCIE_PIPE_P3>,
+				 <&infracfg CLK_INFRA_PCIE_GFMUX_TL_P3>,
+				 <&infracfg CLK_INFRA_PCIE_PERI_26M_CK_P3>,
+				 <&infracfg CLK_INFRA_133M_PCIE_CK_P3>,
+				 <&topckgen CLK_TOP_PEXTP_P3_SEL>;
+			clock-names = "pl_250m", "tl_26m", "peri_26m",
+				      "top_133m", "pextp_clk";
+			pinctrl-names = "default";
+			pinctrl-0 = <&pcie3_pins>;
+			#interrupt-cells = <1>;
+			interrupt-map-mask = <0 0 0 0x7>;
+			interrupt-map = <0 0 0 1 &pcie_intc3 0>,
+					<0 0 0 2 &pcie_intc3 1>,
+					<0 0 0 3 &pcie_intc3 2>,
+					<0 0 0 4 &pcie_intc3 3>;
+			#address-cells = <3>;
+			#size-cells = <2>;
+			status = "disabled";
+
+			pcie_intc3: interrupt-controller {
+				#address-cells = <0>;
+				#interrupt-cells = <1>;
+				interrupt-controller;
+			};
+		};
+
+		pcie0: pcie@11300000 {
+			compatible = "mediatek,mt7988-pcie",
+				     "mediatek,mt7986-pcie",
+				     "mediatek,mt8192-pcie";
+			reg = <0 0x11300000 0 0x2000>;
+			reg-names = "pcie-mac";
+			ranges = <0x81000000 0x00 0x30000000 0x00
+				  0x30000000 0x00 0x00200000>,
+				 <0x82000000 0x00 0x30200000 0x00
+				  0x30200000 0x00 0x07e00000>;
+			device_type = "pci";
+			linux,pci-domain = <0>;
+			interrupts = <GIC_SPI 168 IRQ_TYPE_LEVEL_HIGH>;
+			bus-range = <0x00 0xff>;
+			clocks = <&infracfg CLK_INFRA_PCIE_PIPE_P0>,
+				 <&infracfg CLK_INFRA_PCIE_GFMUX_TL_P0>,
+				 <&infracfg CLK_INFRA_PCIE_PERI_26M_CK_P0>,
+				 <&infracfg CLK_INFRA_133M_PCIE_CK_P0>,
+				 <&topckgen CLK_TOP_PEXTP_P0_SEL>;
+			clock-names = "pl_250m", "tl_26m", "peri_26m",
+				      "top_133m", "pextp_clk";
+			pinctrl-names = "default";
+			pinctrl-0 = <&pcie0_pins>;
+			#interrupt-cells = <1>;
+			interrupt-map-mask = <0 0 0 0x7>;
+			interrupt-map = <0 0 0 1 &pcie_intc0 0>,
+					<0 0 0 2 &pcie_intc0 1>,
+					<0 0 0 3 &pcie_intc0 2>,
+					<0 0 0 4 &pcie_intc0 3>;
+			#address-cells = <3>;
+			#size-cells = <2>;
+			status = "disabled";
+
+			pcie_intc0: interrupt-controller {
+				#address-cells = <0>;
+				#interrupt-cells = <1>;
+				interrupt-controller;
+			};
+		};
+
+		pcie1: pcie@11310000 {
+			compatible = "mediatek,mt7988-pcie",
+				     "mediatek,mt7986-pcie",
+				     "mediatek,mt8192-pcie";
+			reg = <0 0x11310000 0 0x2000>;
+			reg-names = "pcie-mac";
+			ranges = <0x81000000 0x00 0x38000000 0x00
+				  0x38000000 0x00 0x00200000>,
+				 <0x82000000 0x00 0x38200000 0x00
+				  0x38200000 0x00 0x07e00000>;
+			device_type = "pci";
+			linux,pci-domain = <1>;
+			interrupts = <GIC_SPI 169 IRQ_TYPE_LEVEL_HIGH>;
+			bus-range = <0x00 0xff>;
+			clocks = <&infracfg CLK_INFRA_PCIE_PIPE_P1>,
+				 <&infracfg CLK_INFRA_PCIE_GFMUX_TL_P1>,
+				 <&infracfg CLK_INFRA_PCIE_PERI_26M_CK_P1>,
+				 <&infracfg CLK_INFRA_133M_PCIE_CK_P1>,
+				 <&topckgen CLK_TOP_PEXTP_P1_SEL>;
+			clock-names = "pl_250m", "tl_26m", "peri_26m",
+				      "top_133m", "pextp_clk";
+			pinctrl-names = "default";
+			pinctrl-0 = <&pcie1_pins>;
+			#interrupt-cells = <1>;
+			interrupt-map-mask = <0 0 0 0x7>;
+			interrupt-map = <0 0 0 1 &pcie_intc1 0>,
+					<0 0 0 2 &pcie_intc1 1>,
+					<0 0 0 3 &pcie_intc1 2>,
+					<0 0 0 4 &pcie_intc1 3>;
+			#address-cells = <3>;
+			#size-cells = <2>;
+			status = "disabled";
+
+			pcie_intc1: interrupt-controller {
+				#address-cells = <0>;
+				#interrupt-cells = <1>;
+				interrupt-controller;
+			};
+		};
+
+		tphy: tphy@11c50000 {
+			compatible = "mediatek,mt7988",
+				     "mediatek,generic-tphy-v2";
+			ranges;
+			#address-cells = <2>;
+			#size-cells = <2>;
+			status = "disabled";
+
+			tphyu2port0: usb-phy@11c50000 {
+				reg = <0 0x11c50000 0 0x700>;
+				clocks = <&infracfg CLK_INFRA_USB_UTMI_CK_P1>;
+				clock-names = "ref";
+				#phy-cells = <1>;
+			};
+
+			tphyu3port0: usb-phy@11c50700 {
+				reg = <0 0x11c50700 0 0x900>;
+				clocks = <&infracfg CLK_INFRA_USB_PIPE_CK_P1>;
+				clock-names = "ref";
+				#phy-cells = <1>;
+				mediatek,usb3-pll-ssc-delta;
+				mediatek,usb3-pll-ssc-delta1;
+			};
+		};
+
+		topmisc: topmisc@11d10000 {
+			compatible = "mediatek,mt7988-topmisc", "syscon",
+				     "mediatek,mt7988-power-controller";
+			reg = <0 0x11d10000 0 0x10000>;
+			#clock-cells = <1>;
+			#power-domain-cells = <1>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+		};
+
+		xphy: xphy@11e10000 {
+			compatible = "mediatek,mt7988",
+				     "mediatek,xsphy";
+			ranges;
+			#address-cells = <2>;
+			#size-cells = <2>;
+			status = "disabled";
+
+			xphyu2port0: usb-phy@11e10000 {
+				reg = <0 0x11e10000 0 0x400>;
+				clocks = <&infracfg CLK_INFRA_USB_UTMI>;
+				clock-names = "ref";
+				#phy-cells = <1>;
+			};
+
+			xphyu3port0: usb-phy@11e13000 {
+				reg = <0 0x11e13400 0 0x500>;
+				clocks = <&infracfg CLK_INFRA_USB_PIPE>;
+				clock-names = "ref";
+				#phy-cells = <1>;
+				mediatek,syscon-type = <&topmisc 0x218 0>;
+			};
+		};
+
+		xfi_tphy0: phy@11f20000 {
+			compatible = "mediatek,mt7988-xfi-tphy";
+			reg = <0 0x11f20000 0 0x10000>;
+			resets = <&watchdog MT7988_TOPRGU_XFI_PEXTP0_GRST>;
+			clocks = <&xfi_pll CLK_XFIPLL_PLL_EN>, <&topckgen CLK_TOP_XFI_PHY_0_XTAL_SEL>;
+			clock-names = "xfipll", "topxtal";
+			mediatek,usxgmii-performance-errata;
+			#phy-cells = <0>;
+		};
+
+		xfi_tphy1: phy@11f30000 {
+			compatible = "mediatek,mt7988-xfi-tphy";
+			reg = <0 0x11f30000 0 0x10000>;
+			resets = <&watchdog MT7988_TOPRGU_XFI_PEXTP1_GRST>;
+			clocks = <&xfi_pll CLK_XFIPLL_PLL_EN>, <&topckgen CLK_TOP_XFI_PHY_1_XTAL_SEL>;
+			clock-names = "xfipll", "topxtal";
+			#phy-cells = <0>;
+		};
+
+		xfi_pll: clock-controller@11f40000 {
+			compatible = "mediatek,mt7988-xfi-pll";
+			reg = <0 0x11f40000 0 0x1000>;
+			resets = <&watchdog MT7988_TOPRGU_XFI_PLL_GRST>;
+			#clock-cells = <1>;
+		};
+
+		efuse: efuse@11f50000 {
+			compatible = "mediatek,efuse";
+			reg = <0 0x11f50000 0 0x1000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			lvts_calibration: calib@918 {
+				reg = <0x918 0x28>;
+			};
+
+			phy_calibration_p0: calib@940 {
+				reg = <0x940 0x10>;
+			};
+
+			phy_calibration_p1: calib@954 {
+				reg = <0x954 0x10>;
+			};
+
+			phy_calibration_p2: calib@968 {
+				reg = <0x968 0x10>;
+			};
+
+			phy_calibration_p3: calib@97c {
+				reg = <0x97c 0x10>;
+			};
+
+			cpufreq_calibration: calib@278 {
+				reg = <0x278 0x1>;
+			};
+		};
+
+		ethsys: syscon@15000000 {
+			compatible = "mediatek,mt7988-ethsys", "syscon";
+			reg = <0 0x15000000 0 0x1000>;
+			#clock-cells = <1>;
+			#reset-cells = <1>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+		};
+
+		switch: switch@15020000 {
+			compatible = "mediatek,mt7988-switch";
+			reg = <0 0x15020000 0 0x8000>;
+			interrupt-controller;
+			#interrupt-cells = <1>;
+			interrupt-parent = <&gic>;
+			interrupts = <GIC_SPI 209 IRQ_TYPE_LEVEL_HIGH>;
+			resets = <&ethwarp MT7988_ETHWARP_RST_SWITCH>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				gsw_port0: port@0 {
+					reg = <0>;
+					label = "lan0";
+					phy-mode = "internal";
+					phy-handle = <&gsw_phy0>;
+				};
+
+				gsw_port1: port@1 {
+					reg = <1>;
+					label = "lan1";
+					phy-mode = "internal";
+					phy-handle = <&gsw_phy1>;
+				};
+
+				gsw_port2: port@2 {
+					reg = <2>;
+					label = "lan2";
+					phy-mode = "internal";
+					phy-handle = <&gsw_phy2>;
+				};
+
+				gsw_port3: port@3 {
+					reg = <3>;
+					label = "lan3";
+					phy-mode = "internal";
+					phy-handle = <&gsw_phy3>;
+				};
+
+				port@6 {
+					reg = <6>;
+					ethernet = <&gmac0>;
+					phy-mode = "internal";
+
+					fixed-link {
+						speed = <10000>;
+						full-duplex;
+						pause;
+					};
+				};
+			};
+
+			mdio {
+				#address-cells = <1>;
+				#size-cells = <0>;
+				mediatek,pio = <&pio>;
+
+				gsw_phy0: ethernet-phy@0 {
+					compatible = "ethernet-phy-ieee802.3-c22";
+					reg = <0>;
+					interrupts = <0>;
+					phy-mode = "internal";
+					nvmem-cells = <&phy_calibration_p0>;
+					nvmem-cell-names = "phy-cal-data";
+
+					leds {
+						#address-cells = <1>;
+						#size-cells = <0>;
+
+						gsw_phy0_led0: gsw-phy0-led0@0 {
+							reg = <0>;
+							function = LED_FUNCTION_LAN;
+							status = "disabled";
+						};
+
+						gsw_phy0_led1: gsw-phy0-led1@1 {
+							reg = <1>;
+							function = LED_FUNCTION_LAN;
+							status = "disabled";
+						};
+					};
+				};
+
+				gsw_phy1: ethernet-phy@1 {
+					compatible = "ethernet-phy-ieee802.3-c22";
+					reg = <1>;
+					interrupts = <1>;
+					phy-mode = "internal";
+					nvmem-cells = <&phy_calibration_p1>;
+					nvmem-cell-names = "phy-cal-data";
+
+					leds {
+						#address-cells = <1>;
+						#size-cells = <0>;
+
+						gsw_phy1_led0: gsw-phy1-led0@0 {
+							reg = <0>;
+							function = LED_FUNCTION_LAN;
+							status = "disabled";
+						};
+
+						gsw_phy1_led1: gsw-phy1-led1@1 {
+							reg = <1>;
+							function = LED_FUNCTION_LAN;
+							status = "disabled";
+						};
+					};
+				};
+
+				gsw_phy2: ethernet-phy@2 {
+					compatible = "ethernet-phy-ieee802.3-c22";
+					reg = <2>;
+					interrupts = <2>;
+					phy-mode = "internal";
+					nvmem-cells = <&phy_calibration_p2>;
+					nvmem-cell-names = "phy-cal-data";
+
+					leds {
+						#address-cells = <1>;
+						#size-cells = <0>;
+
+						gsw_phy2_led0: gsw-phy2-led0@0 {
+							reg = <0>;
+							function = LED_FUNCTION_LAN;
+							status = "disabled";
+						};
+
+						gsw_phy2_led1: gsw-phy2-led1@1 {
+							reg = <1>;
+							function = LED_FUNCTION_LAN;
+							status = "disabled";
+						};
+					};
+				};
+
+				gsw_phy3: ethernet-phy@3 {
+					compatible = "ethernet-phy-ieee802.3-c22";
+					reg = <3>;
+					interrupts = <3>;
+					phy-mode = "internal";
+					nvmem-cells = <&phy_calibration_p3>;
+					nvmem-cell-names = "phy-cal-data";
+
+					leds {
+						#address-cells = <1>;
+						#size-cells = <0>;
+
+						gsw_phy3_led0: gsw-phy3-led0@0 {
+							reg = <0>;
+							function = LED_FUNCTION_LAN;
+							status = "disabled";
+						};
+
+						gsw_phy3_led1: gsw-phy3-led1@1 {
+							reg = <1>;
+							function = LED_FUNCTION_LAN;
+							status = "disabled";
+						};
+					};
+				};
+			};
+		};
+
+		ethwarp: clock-controller@15031000 {
+			compatible = "mediatek,mt7988-ethwarp";
+			reg = <0 0x15031000 0 0x1000>;
+			#clock-cells = <1>;
+			#reset-cells = <1>;
+		};
+
+		eth: ethernet@15100000 {
+			compatible = "mediatek,mt7988-eth";
+			reg = <0 0x15100000 0 0x80000>,
+			      <0 0x15400000 0 0x380000>;
+			interrupts = <GIC_SPI 196 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 197 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 198 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 199 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&ethsys CLK_ETHDMA_XGP1_EN>,
+				 <&ethsys CLK_ETHDMA_XGP2_EN>,
+				 <&ethsys CLK_ETHDMA_XGP3_EN>,
+				 <&ethsys CLK_ETHDMA_FE_EN>,
+				 <&ethsys CLK_ETHDMA_GP2_EN>,
+				 <&ethsys CLK_ETHDMA_GP1_EN>,
+				 <&ethsys CLK_ETHDMA_GP3_EN>,
+				 <&ethsys CLK_ETHDMA_ESW_EN>,
+				 <&ethsys CLK_ETHDMA_CRYPT0_EN>,
+				 <&ethwarp CLK_ETHWARP_WOCPU2_EN>,
+				 <&ethwarp CLK_ETHWARP_WOCPU1_EN>,
+				 <&ethwarp CLK_ETHWARP_WOCPU0_EN>,
+				 <&topckgen CLK_TOP_ETH_GMII_SEL>,
+				 <&topckgen CLK_TOP_ETH_REFCK_50M_SEL>,
+				 <&topckgen CLK_TOP_ETH_SYS_200M_SEL>,
+				 <&topckgen CLK_TOP_ETH_SYS_SEL>,
+				 <&topckgen CLK_TOP_ETH_XGMII_SEL>,
+				 <&topckgen CLK_TOP_ETH_MII_SEL>,
+				 <&topckgen CLK_TOP_NETSYS_SEL>,
+				 <&topckgen CLK_TOP_NETSYS_500M_SEL>,
+				 <&topckgen CLK_TOP_NETSYS_PAO_2X_SEL>,
+				 <&topckgen CLK_TOP_NETSYS_SYNC_250M_SEL>,
+				 <&topckgen CLK_TOP_NETSYS_PPEFB_250M_SEL>,
+				 <&topckgen CLK_TOP_NETSYS_WARP_SEL>;
+			clock-names = "xgp1", "xgp2", "xgp3", "fe", "gp2", "gp1",
+				      "gp3", "esw", "crypto",
+				      "ethwarp_wocpu2", "ethwarp_wocpu1",
+				      "ethwarp_wocpu0", "top_eth_gmii_sel",
+				      "top_eth_refck_50m_sel", "top_eth_sys_200m_sel",
+				      "top_eth_sys_sel", "top_eth_xgmii_sel",
+				      "top_eth_mii_sel", "top_netsys_sel",
+				      "top_netsys_500m_sel", "top_netsys_pao_2x_sel",
+				      "top_netsys_sync_250m_sel",
+				      "top_netsys_ppefb_250m_sel",
+				      "top_netsys_warp_sel";
+			assigned-clocks = <&topckgen CLK_TOP_NETSYS_2X_SEL>,
+					  <&topckgen CLK_TOP_NETSYS_GSW_SEL>,
+					  <&topckgen CLK_TOP_USXGMII_SBUS_0_SEL>,
+					  <&topckgen CLK_TOP_USXGMII_SBUS_1_SEL>,
+					  <&topckgen CLK_TOP_SGM_0_SEL>,
+					  <&topckgen CLK_TOP_SGM_1_SEL>;
+			assigned-clock-parents = <&apmixedsys CLK_APMIXED_NET2PLL>,
+						 <&topckgen CLK_TOP_NET1PLL_D4>,
+						 <&topckgen CLK_TOP_NET1PLL_D8_D4>,
+						 <&topckgen CLK_TOP_NET1PLL_D8_D4>,
+						 <&apmixedsys CLK_APMIXED_SGMPLL>,
+						 <&apmixedsys CLK_APMIXED_SGMPLL>;
+			mediatek,ethsys = <&ethsys>;
+			mediatek,infracfg = <&topmisc>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			gmac0: mac@0 {
+				compatible = "mediatek,eth-mac";
+				reg = <0>;
+				phy-mode = "internal";
+				status = "disabled";
+
+				fixed-link {
+					speed = <10000>;
+					full-duplex;
+					pause;
+				};
+			};
+
+			gmac1: mac@1 {
+				compatible = "mediatek,eth-mac";
+				reg = <1>;
+				status = "disabled";
+				pcs-handle = <&sgmiipcs1>, <&usxgmiisys1>;
+				phys = <&xfi_tphy1>;
+			};
+
+			gmac2: mac@2 {
+				compatible = "mediatek,eth-mac";
+				reg = <2>;
+				status = "disabled";
+				pcs-handle = <&sgmiipcs0>, <&usxgmiisys0>;
+				phys = <&xfi_tphy0>;
+			};
+
+			mdio_bus: mdio-bus {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				/* internal 2.5G PHY */
+				int_2p5g_phy: ethernet-phy@15 {
+					compatible = "ethernet-phy-ieee802.3-c45";
+					reg = <15>;
+					phy-mode = "internal";
+
+					leds {
+						#address-cells = <1>;
+						#size-cells = <0>;
+
+						i2p5gbe_led0: i2p5gbe-led0@0 {
+							reg = <0>;
+							function = LED_FUNCTION_LAN;
+							status = "disabled";
+						};
+
+						i2p5gbe_led1: i2p5gbe-led1@1 {
+							reg = <1>;
+							function = LED_FUNCTION_LAN;
+							status = "disabled";
+						};
+					};
+				};
+			};
+		};
+
+		crypto: crypto@15600000 {
+			compatible = "inside-secure,safexcel-eip197b";
+			reg = <0 0x15600000 0 0x180000>;
+			interrupts = <GIC_SPI 214 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 215 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 216 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 217 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "ring0", "ring1", "ring2", "ring3";
+			status = "okay";
+		};
+	};
+
+	thermal-zones {
+		cpu_thermal: cpu-thermal {
+			polling-delay-passive = <1000>;
+			polling-delay = <1000>;
+			thermal-sensors = <&lvts 0>;
+
+			trips {
+				cpu_trip_crit: crit {
+					temperature = <125000>;
+					hysteresis = <2000>;
+					type = "critical";
+				};
+
+				cpu_trip_hot: hot {
+					temperature = <120000>;
+					hysteresis = <2000>;
+					type = "hot";
+				};
+
+				cpu_trip_active_high: active-high {
+					temperature = <115000>;
+					hysteresis = <2000>;
+					type = "active";
+				};
+
+				cpu_trip_active_med: active-med {
+					temperature = <85000>;
+					hysteresis = <2000>;
+					type = "active";
+				};
+
+				cpu_trip_active_low: active-low {
+					temperature = <40000>;
+					hysteresis = <2000>;
+					type = "active";
+				};
+			};
+
+			cooling-maps {
+				cpu-active-high {
+				/* active: set fan to cooling level 2 */
+					cooling-device = <&fan 3 3>;
+					trip = <&cpu_trip_active_high>;
+				};
+
+				cpu-active-low {
+				/* active: set fan to cooling level 1 */
+					cooling-device = <&fan 2 2>;
+					trip = <&cpu_trip_active_med>;
+				};
+
+				cpu-passive {
+				/* passive: set fan to cooling level 0 */
+					cooling-device = <&fan 1 1>;
+					trip = <&cpu_trip_active_low>;
+				};
+			};
+		};
+	};
+
+	timer {
+		compatible = "arm,armv8-timer";
+		interrupt-parent = <&gic>;
+		interrupts = <GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>;
+	};
+};
diff --git a/6.12/target/linux/mediatek/files-6.12/drivers/pinctrl/mediatek/pinctrl-mt7988.c b/6.12/target/linux/mediatek/files-6.12/drivers/pinctrl/mediatek/pinctrl-mt7988.c
new file mode 100644
index 00000000..f08263c7
--- /dev/null
+++ b/6.12/target/linux/mediatek/files-6.12/drivers/pinctrl/mediatek/pinctrl-mt7988.c
@@ -0,0 +1,1516 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * The MT7988 driver based on Linux generic pinctrl binding.
+ *
+ * Copyright (C) 2020 MediaTek Inc.
+ * Author: Sam Shih <sam.shih@mediatek.com>
+ */
+
+#include "pinctrl-moore.h"
+
+enum MT7988_PINCTRL_REG_PAGE {
+	GPIO_BASE,
+	IOCFG_TR_BASE,
+	IOCFG_BR_BASE,
+	IOCFG_RB_BASE,
+	IOCFG_LB_BASE,
+	IOCFG_TL_BASE,
+};
+
+#define MT7988_PIN(_number, _name) MTK_PIN(_number, _name, 0, _number, DRV_GRP4)
+
+#define PIN_FIELD_BASE(_s_pin, _e_pin, _i_base, _s_addr, _x_addrs, _s_bit,     \
+		       _x_bits)                                                \
+	PIN_FIELD_CALC(_s_pin, _e_pin, _i_base, _s_addr, _x_addrs, _s_bit,     \
+		       _x_bits, 32, 0)
+
+#define PINS_FIELD_BASE(_s_pin, _e_pin, _i_base, _s_addr, _x_addrs, _s_bit,    \
+			_x_bits)                                               \
+	PIN_FIELD_CALC(_s_pin, _e_pin, _i_base, _s_addr, _x_addrs, _s_bit,     \
+		       _x_bits, 32, 1)
+
+static const struct mtk_pin_field_calc mt7988_pin_mode_range[] = {
+	PIN_FIELD(0, 83, 0x300, 0x10, 0, 4),
+};
+
+static const struct mtk_pin_field_calc mt7988_pin_dir_range[] = {
+	PIN_FIELD(0, 83, 0x0, 0x10, 0, 1),
+};
+
+static const struct mtk_pin_field_calc mt7988_pin_di_range[] = {
+	PIN_FIELD(0, 83, 0x200, 0x10, 0, 1),
+};
+
+static const struct mtk_pin_field_calc mt7988_pin_do_range[] = {
+	PIN_FIELD(0, 83, 0x100, 0x10, 0, 1),
+};
+
+static const struct mtk_pin_field_calc mt7988_pin_ies_range[] = {
+	PIN_FIELD_BASE(0, 0, 5, 0x30, 0x10, 13, 1),
+	PIN_FIELD_BASE(1, 1, 5, 0x30, 0x10, 14, 1),
+	PIN_FIELD_BASE(2, 2, 5, 0x30, 0x10, 11, 1),
+	PIN_FIELD_BASE(3, 3, 5, 0x30, 0x10, 12, 1),
+	PIN_FIELD_BASE(4, 4, 5, 0x30, 0x10, 0, 1),
+	PIN_FIELD_BASE(5, 5, 5, 0x30, 0x10, 9, 1),
+	PIN_FIELD_BASE(6, 6, 5, 0x30, 0x10, 10, 1),
+
+	PIN_FIELD_BASE(7, 7, 4, 0x30, 0x10, 8, 1),
+	PIN_FIELD_BASE(8, 8, 4, 0x30, 0x10, 6, 1),
+	PIN_FIELD_BASE(9, 9, 4, 0x30, 0x10, 5, 1),
+	PIN_FIELD_BASE(10, 10, 4, 0x30, 0x10, 3, 1),
+
+	PIN_FIELD_BASE(11, 11, 1, 0x40, 0x10, 0, 1),
+	PIN_FIELD_BASE(12, 12, 1, 0x40, 0x10, 21, 1),
+	PIN_FIELD_BASE(13, 13, 1, 0x40, 0x10, 1, 1),
+	PIN_FIELD_BASE(14, 14, 1, 0x40, 0x10, 2, 1),
+
+	PIN_FIELD_BASE(15, 15, 5, 0x30, 0x10, 7, 1),
+	PIN_FIELD_BASE(16, 16, 5, 0x30, 0x10, 8, 1),
+	PIN_FIELD_BASE(17, 17, 5, 0x30, 0x10, 3, 1),
+	PIN_FIELD_BASE(18, 18, 5, 0x30, 0x10, 4, 1),
+
+	PIN_FIELD_BASE(19, 19, 4, 0x30, 0x10, 7, 1),
+	PIN_FIELD_BASE(20, 20, 4, 0x30, 0x10, 4, 1),
+
+	PIN_FIELD_BASE(21, 21, 3, 0x50, 0x10, 17, 1),
+	PIN_FIELD_BASE(22, 22, 3, 0x50, 0x10, 23, 1),
+	PIN_FIELD_BASE(23, 23, 3, 0x50, 0x10, 20, 1),
+	PIN_FIELD_BASE(24, 24, 3, 0x50, 0x10, 19, 1),
+	PIN_FIELD_BASE(25, 25, 3, 0x50, 0x10, 21, 1),
+	PIN_FIELD_BASE(26, 26, 3, 0x50, 0x10, 22, 1),
+	PIN_FIELD_BASE(27, 27, 3, 0x50, 0x10, 18, 1),
+	PIN_FIELD_BASE(28, 28, 3, 0x50, 0x10, 25, 1),
+	PIN_FIELD_BASE(29, 29, 3, 0x50, 0x10, 26, 1),
+	PIN_FIELD_BASE(30, 30, 3, 0x50, 0x10, 27, 1),
+	PIN_FIELD_BASE(31, 31, 3, 0x50, 0x10, 24, 1),
+	PIN_FIELD_BASE(32, 32, 3, 0x50, 0x10, 28, 1),
+	PIN_FIELD_BASE(33, 33, 3, 0x60, 0x10, 0, 1),
+	PIN_FIELD_BASE(34, 34, 3, 0x50, 0x10, 31, 1),
+	PIN_FIELD_BASE(35, 35, 3, 0x50, 0x10, 29, 1),
+	PIN_FIELD_BASE(36, 36, 3, 0x50, 0x10, 30, 1),
+	PIN_FIELD_BASE(37, 37, 3, 0x60, 0x10, 1, 1),
+	PIN_FIELD_BASE(38, 38, 3, 0x50, 0x10, 11, 1),
+	PIN_FIELD_BASE(39, 39, 3, 0x50, 0x10, 10, 1),
+	PIN_FIELD_BASE(40, 40, 3, 0x50, 0x10, 0, 1),
+	PIN_FIELD_BASE(41, 41, 3, 0x50, 0x10, 1, 1),
+	PIN_FIELD_BASE(42, 42, 3, 0x50, 0x10, 9, 1),
+	PIN_FIELD_BASE(43, 43, 3, 0x50, 0x10, 8, 1),
+	PIN_FIELD_BASE(44, 44, 3, 0x50, 0x10, 7, 1),
+	PIN_FIELD_BASE(45, 45, 3, 0x50, 0x10, 6, 1),
+	PIN_FIELD_BASE(46, 46, 3, 0x50, 0x10, 5, 1),
+	PIN_FIELD_BASE(47, 47, 3, 0x50, 0x10, 4, 1),
+	PIN_FIELD_BASE(48, 48, 3, 0x50, 0x10, 3, 1),
+	PIN_FIELD_BASE(49, 49, 3, 0x50, 0x10, 2, 1),
+	PIN_FIELD_BASE(50, 50, 3, 0x50, 0x10, 15, 1),
+	PIN_FIELD_BASE(51, 51, 3, 0x50, 0x10, 12, 1),
+	PIN_FIELD_BASE(52, 52, 3, 0x50, 0x10, 13, 1),
+	PIN_FIELD_BASE(53, 53, 3, 0x50, 0x10, 14, 1),
+	PIN_FIELD_BASE(54, 54, 3, 0x50, 0x10, 16, 1),
+
+	PIN_FIELD_BASE(55, 55, 1, 0x40, 0x10, 14, 1),
+	PIN_FIELD_BASE(56, 56, 1, 0x40, 0x10, 15, 1),
+	PIN_FIELD_BASE(57, 57, 1, 0x40, 0x10, 13, 1),
+	PIN_FIELD_BASE(58, 58, 1, 0x40, 0x10, 4, 1),
+	PIN_FIELD_BASE(59, 59, 1, 0x40, 0x10, 5, 1),
+	PIN_FIELD_BASE(60, 60, 1, 0x40, 0x10, 6, 1),
+	PIN_FIELD_BASE(61, 61, 1, 0x40, 0x10, 3, 1),
+	PIN_FIELD_BASE(62, 62, 1, 0x40, 0x10, 7, 1),
+	PIN_FIELD_BASE(63, 63, 1, 0x40, 0x10, 20, 1),
+	PIN_FIELD_BASE(64, 64, 1, 0x40, 0x10, 8, 1),
+	PIN_FIELD_BASE(65, 65, 1, 0x40, 0x10, 9, 1),
+	PIN_FIELD_BASE(66, 66, 1, 0x40, 0x10, 10, 1),
+	PIN_FIELD_BASE(67, 67, 1, 0x40, 0x10, 11, 1),
+	PIN_FIELD_BASE(68, 68, 1, 0x40, 0x10, 12, 1),
+
+	PIN_FIELD_BASE(69, 69, 5, 0x30, 0x10, 1, 1),
+	PIN_FIELD_BASE(70, 70, 5, 0x30, 0x10, 2, 1),
+	PIN_FIELD_BASE(71, 71, 5, 0x30, 0x10, 5, 1),
+	PIN_FIELD_BASE(72, 72, 5, 0x30, 0x10, 6, 1),
+
+	PIN_FIELD_BASE(73, 73, 4, 0x30, 0x10, 10, 1),
+	PIN_FIELD_BASE(74, 74, 4, 0x30, 0x10, 1, 1),
+	PIN_FIELD_BASE(75, 75, 4, 0x30, 0x10, 11, 1),
+	PIN_FIELD_BASE(76, 76, 4, 0x30, 0x10, 9, 1),
+	PIN_FIELD_BASE(77, 77, 4, 0x30, 0x10, 2, 1),
+	PIN_FIELD_BASE(78, 78, 4, 0x30, 0x10, 0, 1),
+	PIN_FIELD_BASE(79, 79, 4, 0x30, 0x10, 12, 1),
+
+	PIN_FIELD_BASE(80, 80, 1, 0x40, 0x10, 18, 1),
+	PIN_FIELD_BASE(81, 81, 1, 0x40, 0x10, 19, 1),
+	PIN_FIELD_BASE(82, 82, 1, 0x40, 0x10, 16, 1),
+	PIN_FIELD_BASE(83, 83, 1, 0x40, 0x10, 17, 1),
+};
+
+static const struct mtk_pin_field_calc mt7988_pin_smt_range[] = {
+	PIN_FIELD_BASE(0, 0, 5, 0xc0, 0x10, 13, 1),
+	PIN_FIELD_BASE(1, 1, 5, 0xc0, 0x10, 14, 1),
+	PIN_FIELD_BASE(2, 2, 5, 0xc0, 0x10, 11, 1),
+	PIN_FIELD_BASE(3, 3, 5, 0xc0, 0x10, 12, 1),
+	PIN_FIELD_BASE(4, 4, 5, 0xc0, 0x10, 0, 1),
+	PIN_FIELD_BASE(5, 5, 5, 0xc0, 0x10, 9, 1),
+	PIN_FIELD_BASE(6, 6, 5, 0xc0, 0x10, 10, 1),
+
+	PIN_FIELD_BASE(7, 7, 4, 0xb0, 0x10, 8, 1),
+	PIN_FIELD_BASE(8, 8, 4, 0xb0, 0x10, 6, 1),
+	PIN_FIELD_BASE(9, 9, 4, 0xb0, 0x10, 5, 1),
+	PIN_FIELD_BASE(10, 10, 4, 0xb0, 0x10, 3, 1),
+
+	PIN_FIELD_BASE(11, 11, 1, 0xe0, 0x10, 0, 1),
+	PIN_FIELD_BASE(12, 12, 1, 0xe0, 0x10, 21, 1),
+	PIN_FIELD_BASE(13, 13, 1, 0xe0, 0x10, 1, 1),
+	PIN_FIELD_BASE(14, 14, 1, 0xe0, 0x10, 2, 1),
+
+	PIN_FIELD_BASE(15, 15, 5, 0xc0, 0x10, 7, 1),
+	PIN_FIELD_BASE(16, 16, 5, 0xc0, 0x10, 8, 1),
+	PIN_FIELD_BASE(17, 17, 5, 0xc0, 0x10, 3, 1),
+	PIN_FIELD_BASE(18, 18, 5, 0xc0, 0x10, 4, 1),
+
+	PIN_FIELD_BASE(19, 19, 4, 0xb0, 0x10, 7, 1),
+	PIN_FIELD_BASE(20, 20, 4, 0xb0, 0x10, 4, 1),
+
+	PIN_FIELD_BASE(21, 21, 3, 0x140, 0x10, 17, 1),
+	PIN_FIELD_BASE(22, 22, 3, 0x140, 0x10, 23, 1),
+	PIN_FIELD_BASE(23, 23, 3, 0x140, 0x10, 20, 1),
+	PIN_FIELD_BASE(24, 24, 3, 0x140, 0x10, 19, 1),
+	PIN_FIELD_BASE(25, 25, 3, 0x140, 0x10, 21, 1),
+	PIN_FIELD_BASE(26, 26, 3, 0x140, 0x10, 22, 1),
+	PIN_FIELD_BASE(27, 27, 3, 0x140, 0x10, 18, 1),
+	PIN_FIELD_BASE(28, 28, 3, 0x140, 0x10, 25, 1),
+	PIN_FIELD_BASE(29, 29, 3, 0x140, 0x10, 26, 1),
+	PIN_FIELD_BASE(30, 30, 3, 0x140, 0x10, 27, 1),
+	PIN_FIELD_BASE(31, 31, 3, 0x140, 0x10, 24, 1),
+	PIN_FIELD_BASE(32, 32, 3, 0x140, 0x10, 28, 1),
+	PIN_FIELD_BASE(33, 33, 3, 0x150, 0x10, 0, 1),
+	PIN_FIELD_BASE(34, 34, 3, 0x140, 0x10, 31, 1),
+	PIN_FIELD_BASE(35, 35, 3, 0x140, 0x10, 29, 1),
+	PIN_FIELD_BASE(36, 36, 3, 0x140, 0x10, 30, 1),
+	PIN_FIELD_BASE(37, 37, 3, 0x150, 0x10, 1, 1),
+	PIN_FIELD_BASE(38, 38, 3, 0x140, 0x10, 11, 1),
+	PIN_FIELD_BASE(39, 39, 3, 0x140, 0x10, 10, 1),
+	PIN_FIELD_BASE(40, 40, 3, 0x140, 0x10, 0, 1),
+	PIN_FIELD_BASE(41, 41, 3, 0x140, 0x10, 1, 1),
+	PIN_FIELD_BASE(42, 42, 3, 0x140, 0x10, 9, 1),
+	PIN_FIELD_BASE(43, 43, 3, 0x140, 0x10, 8, 1),
+	PIN_FIELD_BASE(44, 44, 3, 0x140, 0x10, 7, 1),
+	PIN_FIELD_BASE(45, 45, 3, 0x140, 0x10, 6, 1),
+	PIN_FIELD_BASE(46, 46, 3, 0x140, 0x10, 5, 1),
+	PIN_FIELD_BASE(47, 47, 3, 0x140, 0x10, 4, 1),
+	PIN_FIELD_BASE(48, 48, 3, 0x140, 0x10, 3, 1),
+	PIN_FIELD_BASE(49, 49, 3, 0x140, 0x10, 2, 1),
+	PIN_FIELD_BASE(50, 50, 3, 0x140, 0x10, 15, 1),
+	PIN_FIELD_BASE(51, 51, 3, 0x140, 0x10, 12, 1),
+	PIN_FIELD_BASE(52, 52, 3, 0x140, 0x10, 13, 1),
+	PIN_FIELD_BASE(53, 53, 3, 0x140, 0x10, 14, 1),
+	PIN_FIELD_BASE(54, 54, 3, 0x140, 0x10, 16, 1),
+
+	PIN_FIELD_BASE(55, 55, 1, 0xe0, 0x10, 14, 1),
+	PIN_FIELD_BASE(56, 56, 1, 0xe0, 0x10, 15, 1),
+	PIN_FIELD_BASE(57, 57, 1, 0xe0, 0x10, 13, 1),
+	PIN_FIELD_BASE(58, 58, 1, 0xe0, 0x10, 4, 1),
+	PIN_FIELD_BASE(59, 59, 1, 0xe0, 0x10, 5, 1),
+	PIN_FIELD_BASE(60, 60, 1, 0xe0, 0x10, 6, 1),
+	PIN_FIELD_BASE(61, 61, 1, 0xe0, 0x10, 3, 1),
+	PIN_FIELD_BASE(62, 62, 1, 0xe0, 0x10, 7, 1),
+	PIN_FIELD_BASE(63, 63, 1, 0xe0, 0x10, 20, 1),
+	PIN_FIELD_BASE(64, 64, 1, 0xe0, 0x10, 8, 1),
+	PIN_FIELD_BASE(65, 65, 1, 0xe0, 0x10, 9, 1),
+	PIN_FIELD_BASE(66, 66, 1, 0xe0, 0x10, 10, 1),
+	PIN_FIELD_BASE(67, 67, 1, 0xe0, 0x10, 11, 1),
+	PIN_FIELD_BASE(68, 68, 1, 0xe0, 0x10, 12, 1),
+
+	PIN_FIELD_BASE(69, 69, 5, 0xc0, 0x10, 1, 1),
+	PIN_FIELD_BASE(70, 70, 5, 0xc0, 0x10, 2, 1),
+	PIN_FIELD_BASE(71, 71, 5, 0xc0, 0x10, 5, 1),
+	PIN_FIELD_BASE(72, 72, 5, 0xc0, 0x10, 6, 1),
+
+	PIN_FIELD_BASE(73, 73, 4, 0xb0, 0x10, 10, 1),
+	PIN_FIELD_BASE(74, 74, 4, 0xb0, 0x10, 1, 1),
+	PIN_FIELD_BASE(75, 75, 4, 0xb0, 0x10, 11, 1),
+	PIN_FIELD_BASE(76, 76, 4, 0xb0, 0x10, 9, 1),
+	PIN_FIELD_BASE(77, 77, 4, 0xb0, 0x10, 2, 1),
+	PIN_FIELD_BASE(78, 78, 4, 0xb0, 0x10, 0, 1),
+	PIN_FIELD_BASE(79, 79, 4, 0xb0, 0x10, 12, 1),
+
+	PIN_FIELD_BASE(80, 80, 1, 0xe0, 0x10, 18, 1),
+	PIN_FIELD_BASE(81, 81, 1, 0xe0, 0x10, 19, 1),
+	PIN_FIELD_BASE(82, 82, 1, 0xe0, 0x10, 16, 1),
+	PIN_FIELD_BASE(83, 83, 1, 0xe0, 0x10, 17, 1),
+};
+
+static const struct mtk_pin_field_calc mt7988_pin_pu_range[] = {
+	PIN_FIELD_BASE(7, 7, 4, 0x60, 0x10, 5, 1),
+	PIN_FIELD_BASE(8, 8, 4, 0x60, 0x10, 4, 1),
+	PIN_FIELD_BASE(9, 9, 4, 0x60, 0x10, 3, 1),
+	PIN_FIELD_BASE(10, 10, 4, 0x60, 0x10, 2, 1),
+
+	PIN_FIELD_BASE(13, 13, 1, 0x70, 0x10, 0, 1),
+	PIN_FIELD_BASE(14, 14, 1, 0x70, 0x10, 1, 1),
+	PIN_FIELD_BASE(63, 63, 1, 0x70, 0x10, 2, 1),
+
+	PIN_FIELD_BASE(75, 75, 4, 0x60, 0x10, 7, 1),
+	PIN_FIELD_BASE(76, 76, 4, 0x60, 0x10, 6, 1),
+	PIN_FIELD_BASE(77, 77, 4, 0x60, 0x10, 1, 1),
+	PIN_FIELD_BASE(78, 78, 4, 0x60, 0x10, 0, 1),
+	PIN_FIELD_BASE(79, 79, 4, 0x60, 0x10, 8, 1),
+};
+
+static const struct mtk_pin_field_calc mt7988_pin_pd_range[] = {
+	PIN_FIELD_BASE(7, 7, 4, 0x40, 0x10, 5, 1),
+	PIN_FIELD_BASE(8, 8, 4, 0x40, 0x10, 4, 1),
+	PIN_FIELD_BASE(9, 9, 4, 0x40, 0x10, 3, 1),
+	PIN_FIELD_BASE(10, 10, 4, 0x40, 0x10, 2, 1),
+
+	PIN_FIELD_BASE(13, 13, 1, 0x50, 0x10, 0, 1),
+	PIN_FIELD_BASE(14, 14, 1, 0x50, 0x10, 1, 1),
+
+	PIN_FIELD_BASE(15, 15, 5, 0x40, 0x10, 4, 1),
+	PIN_FIELD_BASE(16, 16, 5, 0x40, 0x10, 5, 1),
+	PIN_FIELD_BASE(17, 17, 5, 0x40, 0x10, 0, 1),
+	PIN_FIELD_BASE(18, 18, 5, 0x40, 0x10, 1, 1),
+
+	PIN_FIELD_BASE(63, 63, 1, 0x50, 0x10, 2, 1),
+	PIN_FIELD_BASE(71, 71, 5, 0x40, 0x10, 2, 1),
+	PIN_FIELD_BASE(72, 72, 5, 0x40, 0x10, 3, 1),
+
+	PIN_FIELD_BASE(75, 75, 4, 0x40, 0x10, 7, 1),
+	PIN_FIELD_BASE(76, 76, 4, 0x40, 0x10, 6, 1),
+	PIN_FIELD_BASE(77, 77, 4, 0x40, 0x10, 1, 1),
+	PIN_FIELD_BASE(78, 78, 4, 0x40, 0x10, 0, 1),
+	PIN_FIELD_BASE(79, 79, 4, 0x40, 0x10, 8, 1),
+};
+
+static const struct mtk_pin_field_calc mt7988_pin_drv_range[] = {
+	PIN_FIELD_BASE(0, 0, 5, 0x00, 0x10, 21, 3),
+	PIN_FIELD_BASE(1, 1, 5, 0x00, 0x10, 24, 3),
+	PIN_FIELD_BASE(2, 2, 5, 0x00, 0x10, 15, 3),
+	PIN_FIELD_BASE(3, 3, 5, 0x00, 0x10, 18, 3),
+	PIN_FIELD_BASE(4, 4, 5, 0x00, 0x10, 0, 3),
+	PIN_FIELD_BASE(5, 5, 5, 0x00, 0x10, 9, 3),
+	PIN_FIELD_BASE(6, 6, 5, 0x00, 0x10, 12, 3),
+
+	PIN_FIELD_BASE(7, 7, 4, 0x00, 0x10, 24, 3),
+	PIN_FIELD_BASE(8, 8, 4, 0x00, 0x10, 28, 3),
+	PIN_FIELD_BASE(9, 9, 4, 0x00, 0x10, 15, 3),
+	PIN_FIELD_BASE(10, 10, 4, 0x00, 0x10, 9, 3),
+
+	PIN_FIELD_BASE(11, 11, 1, 0x00, 0x10, 0, 3),
+	PIN_FIELD_BASE(12, 12, 1, 0x20, 0x10, 3, 3),
+	PIN_FIELD_BASE(13, 13, 1, 0x00, 0x10, 3, 3),
+	PIN_FIELD_BASE(14, 14, 1, 0x00, 0x10, 6, 3),
+
+	PIN_FIELD_BASE(19, 19, 4, 0x00, 0x10, 21, 3),
+	PIN_FIELD_BASE(20, 20, 4, 0x00, 0x10, 12, 3),
+
+	PIN_FIELD_BASE(21, 21, 3, 0x10, 0x10, 21, 3),
+	PIN_FIELD_BASE(22, 22, 3, 0x20, 0x10, 9, 3),
+	PIN_FIELD_BASE(23, 23, 3, 0x20, 0x10, 0, 3),
+	PIN_FIELD_BASE(24, 24, 3, 0x10, 0x10, 27, 3),
+	PIN_FIELD_BASE(25, 25, 3, 0x20, 0x10, 3, 3),
+	PIN_FIELD_BASE(26, 26, 3, 0x20, 0x10, 6, 3),
+	PIN_FIELD_BASE(27, 27, 3, 0x10, 0x10, 24, 3),
+	PIN_FIELD_BASE(28, 28, 3, 0x20, 0x10, 15, 3),
+	PIN_FIELD_BASE(29, 29, 3, 0x20, 0x10, 18, 3),
+	PIN_FIELD_BASE(30, 30, 3, 0x20, 0x10, 21, 3),
+	PIN_FIELD_BASE(31, 31, 3, 0x20, 0x10, 12, 3),
+	PIN_FIELD_BASE(32, 32, 3, 0x20, 0x10, 24, 3),
+	PIN_FIELD_BASE(33, 33, 3, 0x30, 0x10, 6, 3),
+	PIN_FIELD_BASE(34, 34, 3, 0x30, 0x10, 3, 3),
+	PIN_FIELD_BASE(35, 35, 3, 0x20, 0x10, 27, 3),
+	PIN_FIELD_BASE(36, 36, 3, 0x30, 0x10, 0, 3),
+	PIN_FIELD_BASE(37, 37, 3, 0x30, 0x10, 9, 3),
+	PIN_FIELD_BASE(38, 38, 3, 0x10, 0x10, 3, 3),
+	PIN_FIELD_BASE(39, 39, 3, 0x10, 0x10, 0, 3),
+	PIN_FIELD_BASE(40, 40, 3, 0x00, 0x10, 0, 3),
+	PIN_FIELD_BASE(41, 41, 3, 0x00, 0x10, 3, 3),
+	PIN_FIELD_BASE(42, 42, 3, 0x00, 0x10, 27, 3),
+	PIN_FIELD_BASE(43, 43, 3, 0x00, 0x10, 24, 3),
+	PIN_FIELD_BASE(44, 44, 3, 0x00, 0x10, 21, 3),
+	PIN_FIELD_BASE(45, 45, 3, 0x00, 0x10, 18, 3),
+	PIN_FIELD_BASE(46, 46, 3, 0x00, 0x10, 15, 3),
+	PIN_FIELD_BASE(47, 47, 3, 0x00, 0x10, 12, 3),
+	PIN_FIELD_BASE(48, 48, 3, 0x00, 0x10, 9, 3),
+	PIN_FIELD_BASE(49, 49, 3, 0x00, 0x10, 6, 3),
+	PIN_FIELD_BASE(50, 50, 3, 0x10, 0x10, 15, 3),
+	PIN_FIELD_BASE(51, 51, 3, 0x10, 0x10, 6, 3),
+	PIN_FIELD_BASE(52, 52, 3, 0x10, 0x10, 9, 3),
+	PIN_FIELD_BASE(53, 53, 3, 0x10, 0x10, 12, 3),
+	PIN_FIELD_BASE(54, 54, 3, 0x10, 0x10, 18, 3),
+
+	PIN_FIELD_BASE(55, 55, 1, 0x10, 0x10, 12, 3),
+	PIN_FIELD_BASE(56, 56, 1, 0x10, 0x10, 15, 3),
+	PIN_FIELD_BASE(57, 57, 1, 0x10, 0x10, 9, 3),
+	PIN_FIELD_BASE(58, 58, 1, 0x00, 0x10, 12, 3),
+	PIN_FIELD_BASE(59, 59, 1, 0x00, 0x10, 15, 3),
+	PIN_FIELD_BASE(60, 60, 1, 0x00, 0x10, 18, 3),
+	PIN_FIELD_BASE(61, 61, 1, 0x00, 0x10, 9, 3),
+	PIN_FIELD_BASE(62, 62, 1, 0x00, 0x10, 21, 3),
+	PIN_FIELD_BASE(63, 63, 1, 0x20, 0x10, 0, 3),
+	PIN_FIELD_BASE(64, 64, 1, 0x00, 0x10, 24, 3),
+	PIN_FIELD_BASE(65, 65, 1, 0x00, 0x10, 27, 3),
+	PIN_FIELD_BASE(66, 66, 1, 0x10, 0x10, 0, 3),
+	PIN_FIELD_BASE(67, 67, 1, 0x10, 0x10, 3, 3),
+	PIN_FIELD_BASE(68, 68, 1, 0x10, 0x10, 6, 3),
+
+	PIN_FIELD_BASE(69, 69, 5, 0x00, 0x10, 3, 3),
+	PIN_FIELD_BASE(70, 70, 5, 0x00, 0x10, 6, 3),
+
+	PIN_FIELD_BASE(73, 73, 4, 0x10, 0x10, 0, 3),
+	PIN_FIELD_BASE(74, 74, 4, 0x00, 0x10, 3, 3),
+	PIN_FIELD_BASE(75, 75, 4, 0x10, 0x10, 3, 3),
+	PIN_FIELD_BASE(76, 76, 4, 0x00, 0x10, 27, 3),
+	PIN_FIELD_BASE(77, 77, 4, 0x00, 0x10, 6, 3),
+	PIN_FIELD_BASE(78, 78, 4, 0x00, 0x10, 0, 3),
+	PIN_FIELD_BASE(79, 79, 4, 0x10, 0x10, 6, 3),
+
+	PIN_FIELD_BASE(80, 80, 1, 0x10, 0x10, 24, 3),
+	PIN_FIELD_BASE(81, 81, 1, 0x10, 0x10, 27, 3),
+	PIN_FIELD_BASE(82, 82, 1, 0x10, 0x10, 18, 3),
+	PIN_FIELD_BASE(83, 83, 1, 0x10, 0x10, 21, 3),
+};
+
+static const struct mtk_pin_field_calc mt7988_pin_pupd_range[] = {
+	PIN_FIELD_BASE(0, 0, 5, 0x50, 0x10, 7, 1),
+	PIN_FIELD_BASE(1, 1, 5, 0x50, 0x10, 8, 1),
+	PIN_FIELD_BASE(2, 2, 5, 0x50, 0x10, 5, 1),
+	PIN_FIELD_BASE(3, 3, 5, 0x50, 0x10, 6, 1),
+	PIN_FIELD_BASE(4, 4, 5, 0x50, 0x10, 0, 1),
+	PIN_FIELD_BASE(5, 5, 5, 0x50, 0x10, 3, 1),
+	PIN_FIELD_BASE(6, 6, 5, 0x50, 0x10, 4, 1),
+
+	PIN_FIELD_BASE(11, 11, 1, 0x60, 0x10, 0, 1),
+	PIN_FIELD_BASE(12, 12, 1, 0x60, 0x10, 18, 1),
+
+	PIN_FIELD_BASE(19, 19, 4, 0x50, 0x10, 2, 1),
+	PIN_FIELD_BASE(20, 20, 4, 0x50, 0x10, 1, 1),
+
+	PIN_FIELD_BASE(21, 21, 3, 0x70, 0x10, 17, 1),
+	PIN_FIELD_BASE(22, 22, 3, 0x70, 0x10, 23, 1),
+	PIN_FIELD_BASE(23, 23, 3, 0x70, 0x10, 20, 1),
+	PIN_FIELD_BASE(24, 24, 3, 0x70, 0x10, 19, 1),
+	PIN_FIELD_BASE(25, 25, 3, 0x70, 0x10, 21, 1),
+	PIN_FIELD_BASE(26, 26, 3, 0x70, 0x10, 22, 1),
+	PIN_FIELD_BASE(27, 27, 3, 0x70, 0x10, 18, 1),
+	PIN_FIELD_BASE(28, 28, 3, 0x70, 0x10, 25, 1),
+	PIN_FIELD_BASE(29, 29, 3, 0x70, 0x10, 26, 1),
+	PIN_FIELD_BASE(30, 30, 3, 0x70, 0x10, 27, 1),
+	PIN_FIELD_BASE(31, 31, 3, 0x70, 0x10, 24, 1),
+	PIN_FIELD_BASE(32, 32, 3, 0x70, 0x10, 28, 1),
+	PIN_FIELD_BASE(33, 33, 3, 0x80, 0x10, 0, 1),
+	PIN_FIELD_BASE(34, 34, 3, 0x70, 0x10, 31, 1),
+	PIN_FIELD_BASE(35, 35, 3, 0x70, 0x10, 29, 1),
+	PIN_FIELD_BASE(36, 36, 3, 0x70, 0x10, 30, 1),
+	PIN_FIELD_BASE(37, 37, 3, 0x80, 0x10, 1, 1),
+	PIN_FIELD_BASE(38, 38, 3, 0x70, 0x10, 11, 1),
+	PIN_FIELD_BASE(39, 39, 3, 0x70, 0x10, 10, 1),
+	PIN_FIELD_BASE(40, 40, 3, 0x70, 0x10, 0, 1),
+	PIN_FIELD_BASE(41, 41, 3, 0x70, 0x10, 1, 1),
+	PIN_FIELD_BASE(42, 42, 3, 0x70, 0x10, 9, 1),
+	PIN_FIELD_BASE(43, 43, 3, 0x70, 0x10, 8, 1),
+	PIN_FIELD_BASE(44, 44, 3, 0x70, 0x10, 7, 1),
+	PIN_FIELD_BASE(45, 45, 3, 0x70, 0x10, 6, 1),
+	PIN_FIELD_BASE(46, 46, 3, 0x70, 0x10, 5, 1),
+	PIN_FIELD_BASE(47, 47, 3, 0x70, 0x10, 4, 1),
+	PIN_FIELD_BASE(48, 48, 3, 0x70, 0x10, 3, 1),
+	PIN_FIELD_BASE(49, 49, 3, 0x70, 0x10, 2, 1),
+	PIN_FIELD_BASE(50, 50, 3, 0x70, 0x10, 15, 1),
+	PIN_FIELD_BASE(51, 51, 3, 0x70, 0x10, 12, 1),
+	PIN_FIELD_BASE(52, 52, 3, 0x70, 0x10, 13, 1),
+	PIN_FIELD_BASE(53, 53, 3, 0x70, 0x10, 14, 1),
+	PIN_FIELD_BASE(54, 54, 3, 0x70, 0x10, 16, 1),
+
+	PIN_FIELD_BASE(55, 55, 1, 0x60, 0x10, 12, 1),
+	PIN_FIELD_BASE(56, 56, 1, 0x60, 0x10, 13, 1),
+	PIN_FIELD_BASE(57, 57, 1, 0x60, 0x10, 11, 1),
+	PIN_FIELD_BASE(58, 58, 1, 0x60, 0x10, 2, 1),
+	PIN_FIELD_BASE(59, 59, 1, 0x60, 0x10, 3, 1),
+	PIN_FIELD_BASE(60, 60, 1, 0x60, 0x10, 4, 1),
+	PIN_FIELD_BASE(61, 61, 1, 0x60, 0x10, 1, 1),
+	PIN_FIELD_BASE(62, 62, 1, 0x60, 0x10, 5, 1),
+	PIN_FIELD_BASE(64, 64, 1, 0x60, 0x10, 6, 1),
+	PIN_FIELD_BASE(65, 65, 1, 0x60, 0x10, 7, 1),
+	PIN_FIELD_BASE(66, 66, 1, 0x60, 0x10, 8, 1),
+	PIN_FIELD_BASE(67, 67, 1, 0x60, 0x10, 9, 1),
+	PIN_FIELD_BASE(68, 68, 1, 0x60, 0x10, 10, 1),
+
+	PIN_FIELD_BASE(69, 69, 5, 0x50, 0x10, 1, 1),
+	PIN_FIELD_BASE(70, 70, 5, 0x50, 0x10, 2, 1),
+
+	PIN_FIELD_BASE(73, 73, 4, 0x50, 0x10, 3, 1),
+	PIN_FIELD_BASE(74, 74, 4, 0x50, 0x10, 0, 1),
+
+	PIN_FIELD_BASE(80, 80, 1, 0x60, 0x10, 16, 1),
+	PIN_FIELD_BASE(81, 81, 1, 0x60, 0x10, 17, 1),
+	PIN_FIELD_BASE(82, 82, 1, 0x60, 0x10, 14, 1),
+	PIN_FIELD_BASE(83, 83, 1, 0x60, 0x10, 15, 1),
+};
+
+static const struct mtk_pin_field_calc mt7988_pin_r0_range[] = {
+	PIN_FIELD_BASE(0, 0, 5, 0x60, 0x10, 7, 1),
+	PIN_FIELD_BASE(1, 1, 5, 0x60, 0x10, 8, 1),
+	PIN_FIELD_BASE(2, 2, 5, 0x60, 0x10, 5, 1),
+	PIN_FIELD_BASE(3, 3, 5, 0x60, 0x10, 6, 1),
+	PIN_FIELD_BASE(4, 4, 5, 0x60, 0x10, 0, 1),
+	PIN_FIELD_BASE(5, 5, 5, 0x60, 0x10, 3, 1),
+	PIN_FIELD_BASE(6, 6, 5, 0x60, 0x10, 4, 1),
+
+	PIN_FIELD_BASE(11, 11, 1, 0x80, 0x10, 0, 1),
+	PIN_FIELD_BASE(12, 12, 1, 0x80, 0x10, 18, 1),
+
+	PIN_FIELD_BASE(19, 19, 4, 0x70, 0x10, 2, 1),
+	PIN_FIELD_BASE(20, 20, 4, 0x70, 0x10, 1, 1),
+
+	PIN_FIELD_BASE(21, 21, 3, 0x90, 0x10, 17, 1),
+	PIN_FIELD_BASE(22, 22, 3, 0x90, 0x10, 23, 1),
+	PIN_FIELD_BASE(23, 23, 3, 0x90, 0x10, 20, 1),
+	PIN_FIELD_BASE(24, 24, 3, 0x90, 0x10, 19, 1),
+	PIN_FIELD_BASE(25, 25, 3, 0x90, 0x10, 21, 1),
+	PIN_FIELD_BASE(26, 26, 3, 0x90, 0x10, 22, 1),
+	PIN_FIELD_BASE(27, 27, 3, 0x90, 0x10, 18, 1),
+	PIN_FIELD_BASE(28, 28, 3, 0x90, 0x10, 25, 1),
+	PIN_FIELD_BASE(29, 29, 3, 0x90, 0x10, 26, 1),
+	PIN_FIELD_BASE(30, 30, 3, 0x90, 0x10, 27, 1),
+	PIN_FIELD_BASE(31, 31, 3, 0x90, 0x10, 24, 1),
+	PIN_FIELD_BASE(32, 32, 3, 0x90, 0x10, 28, 1),
+	PIN_FIELD_BASE(33, 33, 3, 0xa0, 0x10, 0, 1),
+	PIN_FIELD_BASE(34, 34, 3, 0x90, 0x10, 31, 1),
+	PIN_FIELD_BASE(35, 35, 3, 0x90, 0x10, 29, 1),
+	PIN_FIELD_BASE(36, 36, 3, 0x90, 0x10, 30, 1),
+	PIN_FIELD_BASE(37, 37, 3, 0xa0, 0x10, 1, 1),
+	PIN_FIELD_BASE(38, 38, 3, 0x90, 0x10, 11, 1),
+	PIN_FIELD_BASE(39, 39, 3, 0x90, 0x10, 10, 1),
+	PIN_FIELD_BASE(40, 40, 3, 0x90, 0x10, 0, 1),
+	PIN_FIELD_BASE(41, 41, 3, 0x90, 0x10, 1, 1),
+	PIN_FIELD_BASE(42, 42, 3, 0x90, 0x10, 9, 1),
+	PIN_FIELD_BASE(43, 43, 3, 0x90, 0x10, 8, 1),
+	PIN_FIELD_BASE(44, 44, 3, 0x90, 0x10, 7, 1),
+	PIN_FIELD_BASE(45, 45, 3, 0x90, 0x10, 6, 1),
+	PIN_FIELD_BASE(46, 46, 3, 0x90, 0x10, 5, 1),
+	PIN_FIELD_BASE(47, 47, 3, 0x90, 0x10, 4, 1),
+	PIN_FIELD_BASE(48, 48, 3, 0x90, 0x10, 3, 1),
+	PIN_FIELD_BASE(49, 49, 3, 0x90, 0x10, 2, 1),
+	PIN_FIELD_BASE(50, 50, 3, 0x90, 0x10, 15, 1),
+	PIN_FIELD_BASE(51, 51, 3, 0x90, 0x10, 12, 1),
+	PIN_FIELD_BASE(52, 52, 3, 0x90, 0x10, 13, 1),
+	PIN_FIELD_BASE(53, 53, 3, 0x90, 0x10, 14, 1),
+	PIN_FIELD_BASE(54, 54, 3, 0x90, 0x10, 16, 1),
+
+	PIN_FIELD_BASE(55, 55, 1, 0x80, 0x10, 12, 1),
+	PIN_FIELD_BASE(56, 56, 1, 0x80, 0x10, 13, 1),
+	PIN_FIELD_BASE(57, 57, 1, 0x80, 0x10, 11, 1),
+	PIN_FIELD_BASE(58, 58, 1, 0x80, 0x10, 2, 1),
+	PIN_FIELD_BASE(59, 59, 1, 0x80, 0x10, 3, 1),
+	PIN_FIELD_BASE(60, 60, 1, 0x80, 0x10, 4, 1),
+	PIN_FIELD_BASE(61, 61, 1, 0x80, 0x10, 1, 1),
+	PIN_FIELD_BASE(62, 62, 1, 0x80, 0x10, 5, 1),
+	PIN_FIELD_BASE(64, 64, 1, 0x80, 0x10, 6, 1),
+	PIN_FIELD_BASE(65, 65, 1, 0x80, 0x10, 7, 1),
+	PIN_FIELD_BASE(66, 66, 1, 0x80, 0x10, 8, 1),
+	PIN_FIELD_BASE(67, 67, 1, 0x80, 0x10, 9, 1),
+	PIN_FIELD_BASE(68, 68, 1, 0x80, 0x10, 10, 1),
+
+	PIN_FIELD_BASE(69, 69, 5, 0x60, 0x10, 1, 1),
+	PIN_FIELD_BASE(70, 70, 5, 0x60, 0x10, 2, 1),
+
+	PIN_FIELD_BASE(73, 73, 4, 0x70, 0x10, 3, 1),
+	PIN_FIELD_BASE(74, 74, 4, 0x70, 0x10, 0, 1),
+
+	PIN_FIELD_BASE(80, 80, 1, 0x80, 0x10, 16, 1),
+	PIN_FIELD_BASE(81, 81, 1, 0x80, 0x10, 17, 1),
+	PIN_FIELD_BASE(82, 82, 1, 0x80, 0x10, 14, 1),
+	PIN_FIELD_BASE(83, 83, 1, 0x80, 0x10, 15, 1),
+};
+
+static const struct mtk_pin_field_calc mt7988_pin_r1_range[] = {
+	PIN_FIELD_BASE(0, 0, 5, 0x70, 0x10, 7, 1),
+	PIN_FIELD_BASE(1, 1, 5, 0x70, 0x10, 8, 1),
+	PIN_FIELD_BASE(2, 2, 5, 0x70, 0x10, 5, 1),
+	PIN_FIELD_BASE(3, 3, 5, 0x70, 0x10, 6, 1),
+	PIN_FIELD_BASE(4, 4, 5, 0x70, 0x10, 0, 1),
+	PIN_FIELD_BASE(5, 5, 5, 0x70, 0x10, 3, 1),
+	PIN_FIELD_BASE(6, 6, 5, 0x70, 0x10, 4, 1),
+
+	PIN_FIELD_BASE(11, 11, 1, 0x90, 0x10, 0, 1),
+	PIN_FIELD_BASE(12, 12, 1, 0x90, 0x10, 18, 1),
+
+	PIN_FIELD_BASE(19, 19, 4, 0x80, 0x10, 2, 1),
+	PIN_FIELD_BASE(20, 20, 4, 0x80, 0x10, 1, 1),
+
+	PIN_FIELD_BASE(21, 21, 3, 0xb0, 0x10, 17, 1),
+	PIN_FIELD_BASE(22, 22, 3, 0xb0, 0x10, 23, 1),
+	PIN_FIELD_BASE(23, 23, 3, 0xb0, 0x10, 20, 1),
+	PIN_FIELD_BASE(24, 24, 3, 0xb0, 0x10, 19, 1),
+	PIN_FIELD_BASE(25, 25, 3, 0xb0, 0x10, 21, 1),
+	PIN_FIELD_BASE(26, 26, 3, 0xb0, 0x10, 22, 1),
+	PIN_FIELD_BASE(27, 27, 3, 0xb0, 0x10, 18, 1),
+	PIN_FIELD_BASE(28, 28, 3, 0xb0, 0x10, 25, 1),
+	PIN_FIELD_BASE(29, 29, 3, 0xb0, 0x10, 26, 1),
+	PIN_FIELD_BASE(30, 30, 3, 0xb0, 0x10, 27, 1),
+	PIN_FIELD_BASE(31, 31, 3, 0xb0, 0x10, 24, 1),
+	PIN_FIELD_BASE(32, 32, 3, 0xb0, 0x10, 28, 1),
+	PIN_FIELD_BASE(33, 33, 3, 0xc0, 0x10, 0, 1),
+	PIN_FIELD_BASE(34, 34, 3, 0xb0, 0x10, 31, 1),
+	PIN_FIELD_BASE(35, 35, 3, 0xb0, 0x10, 29, 1),
+	PIN_FIELD_BASE(36, 36, 3, 0xb0, 0x10, 30, 1),
+	PIN_FIELD_BASE(37, 37, 3, 0xc0, 0x10, 1, 1),
+	PIN_FIELD_BASE(38, 38, 3, 0xb0, 0x10, 11, 1),
+	PIN_FIELD_BASE(39, 39, 3, 0xb0, 0x10, 10, 1),
+	PIN_FIELD_BASE(40, 40, 3, 0xb0, 0x10, 0, 1),
+	PIN_FIELD_BASE(41, 41, 3, 0xb0, 0x10, 1, 1),
+	PIN_FIELD_BASE(42, 42, 3, 0xb0, 0x10, 9, 1),
+	PIN_FIELD_BASE(43, 43, 3, 0xb0, 0x10, 8, 1),
+	PIN_FIELD_BASE(44, 44, 3, 0xb0, 0x10, 7, 1),
+	PIN_FIELD_BASE(45, 45, 3, 0xb0, 0x10, 6, 1),
+	PIN_FIELD_BASE(46, 46, 3, 0xb0, 0x10, 5, 1),
+	PIN_FIELD_BASE(47, 47, 3, 0xb0, 0x10, 4, 1),
+	PIN_FIELD_BASE(48, 48, 3, 0xb0, 0x10, 3, 1),
+	PIN_FIELD_BASE(49, 49, 3, 0xb0, 0x10, 2, 1),
+	PIN_FIELD_BASE(50, 50, 3, 0xb0, 0x10, 15, 1),
+	PIN_FIELD_BASE(51, 51, 3, 0xb0, 0x10, 12, 1),
+	PIN_FIELD_BASE(52, 52, 3, 0xb0, 0x10, 13, 1),
+	PIN_FIELD_BASE(53, 53, 3, 0xb0, 0x10, 14, 1),
+	PIN_FIELD_BASE(54, 54, 3, 0xb0, 0x10, 16, 1),
+
+	PIN_FIELD_BASE(55, 55, 1, 0x90, 0x10, 12, 1),
+	PIN_FIELD_BASE(56, 56, 1, 0x90, 0x10, 13, 1),
+	PIN_FIELD_BASE(57, 57, 1, 0x90, 0x10, 11, 1),
+	PIN_FIELD_BASE(58, 58, 1, 0x90, 0x10, 2, 1),
+	PIN_FIELD_BASE(59, 59, 1, 0x90, 0x10, 3, 1),
+	PIN_FIELD_BASE(60, 60, 1, 0x90, 0x10, 4, 1),
+	PIN_FIELD_BASE(61, 61, 1, 0x90, 0x10, 1, 1),
+	PIN_FIELD_BASE(62, 62, 1, 0x90, 0x10, 5, 1),
+	PIN_FIELD_BASE(64, 64, 1, 0x90, 0x10, 6, 1),
+	PIN_FIELD_BASE(65, 65, 1, 0x90, 0x10, 7, 1),
+	PIN_FIELD_BASE(66, 66, 1, 0x90, 0x10, 8, 1),
+	PIN_FIELD_BASE(67, 67, 1, 0x90, 0x10, 9, 1),
+	PIN_FIELD_BASE(68, 68, 1, 0x90, 0x10, 10, 1),
+
+	PIN_FIELD_BASE(69, 69, 5, 0x70, 0x10, 1, 1),
+	PIN_FIELD_BASE(70, 70, 5, 0x70, 0x10, 2, 1),
+
+	PIN_FIELD_BASE(73, 73, 4, 0x80, 0x10, 3, 1),
+	PIN_FIELD_BASE(74, 74, 4, 0x80, 0x10, 0, 1),
+
+	PIN_FIELD_BASE(80, 80, 1, 0x90, 0x10, 16, 1),
+	PIN_FIELD_BASE(81, 81, 1, 0x90, 0x10, 17, 1),
+	PIN_FIELD_BASE(82, 82, 1, 0x90, 0x10, 14, 1),
+	PIN_FIELD_BASE(83, 83, 1, 0x90, 0x10, 15, 1),
+};
+
+static const unsigned int mt7988_pull_type[] = {
+	MTK_PULL_PUPD_R1R0_TYPE,/*0*/ MTK_PULL_PUPD_R1R0_TYPE,/*1*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*2*/ MTK_PULL_PUPD_R1R0_TYPE,/*3*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*4*/ MTK_PULL_PUPD_R1R0_TYPE,/*5*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*6*/ MTK_PULL_PU_PD_TYPE,    /*7*/
+	MTK_PULL_PU_PD_TYPE,    /*8*/ MTK_PULL_PU_PD_TYPE,    /*9*/
+	MTK_PULL_PU_PD_TYPE,    /*10*/ MTK_PULL_PUPD_R1R0_TYPE,/*11*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*12*/ MTK_PULL_PU_PD_TYPE,    /*13*/
+	MTK_PULL_PU_PD_TYPE,    /*14*/ MTK_PULL_PD_TYPE,       /*15*/
+	MTK_PULL_PD_TYPE,       /*16*/ MTK_PULL_PD_TYPE,       /*17*/
+	MTK_PULL_PD_TYPE,       /*18*/ MTK_PULL_PUPD_R1R0_TYPE,/*19*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*20*/ MTK_PULL_PUPD_R1R0_TYPE,/*21*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*22*/ MTK_PULL_PUPD_R1R0_TYPE,/*23*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*24*/ MTK_PULL_PUPD_R1R0_TYPE,/*25*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*26*/ MTK_PULL_PUPD_R1R0_TYPE,/*27*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*28*/ MTK_PULL_PUPD_R1R0_TYPE,/*29*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*30*/ MTK_PULL_PUPD_R1R0_TYPE,/*31*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*32*/ MTK_PULL_PUPD_R1R0_TYPE,/*33*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*34*/ MTK_PULL_PUPD_R1R0_TYPE,/*35*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*36*/ MTK_PULL_PUPD_R1R0_TYPE,/*37*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*38*/ MTK_PULL_PUPD_R1R0_TYPE,/*39*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*40*/ MTK_PULL_PUPD_R1R0_TYPE,/*41*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*42*/ MTK_PULL_PUPD_R1R0_TYPE,/*43*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*44*/ MTK_PULL_PUPD_R1R0_TYPE,/*45*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*46*/ MTK_PULL_PUPD_R1R0_TYPE,/*47*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*48*/ MTK_PULL_PUPD_R1R0_TYPE,/*49*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*50*/ MTK_PULL_PUPD_R1R0_TYPE,/*51*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*52*/ MTK_PULL_PUPD_R1R0_TYPE,/*53*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*54*/ MTK_PULL_PUPD_R1R0_TYPE,/*55*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*56*/ MTK_PULL_PUPD_R1R0_TYPE,/*57*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*58*/ MTK_PULL_PUPD_R1R0_TYPE,/*59*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*60*/ MTK_PULL_PUPD_R1R0_TYPE,/*61*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*62*/ MTK_PULL_PU_PD_TYPE,    /*63*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*64*/ MTK_PULL_PUPD_R1R0_TYPE,/*65*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*66*/ MTK_PULL_PUPD_R1R0_TYPE,/*67*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*68*/ MTK_PULL_PUPD_R1R0_TYPE,/*69*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*70*/ MTK_PULL_PD_TYPE,       /*71*/
+	MTK_PULL_PD_TYPE,       /*72*/ MTK_PULL_PUPD_R1R0_TYPE,/*73*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*74*/ MTK_PULL_PU_PD_TYPE,    /*75*/
+	MTK_PULL_PU_PD_TYPE,    /*76*/ MTK_PULL_PU_PD_TYPE,    /*77*/
+	MTK_PULL_PU_PD_TYPE,    /*78*/ MTK_PULL_PU_PD_TYPE,    /*79*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*80*/ MTK_PULL_PUPD_R1R0_TYPE,/*81*/
+	MTK_PULL_PUPD_R1R0_TYPE,/*82*/ MTK_PULL_PUPD_R1R0_TYPE,/*83*/
+};
+
+static const struct mtk_pin_reg_calc mt7988_reg_cals[] = {
+	[PINCTRL_PIN_REG_MODE] = MTK_RANGE(mt7988_pin_mode_range),
+	[PINCTRL_PIN_REG_DIR] = MTK_RANGE(mt7988_pin_dir_range),
+	[PINCTRL_PIN_REG_DI] = MTK_RANGE(mt7988_pin_di_range),
+	[PINCTRL_PIN_REG_DO] = MTK_RANGE(mt7988_pin_do_range),
+	[PINCTRL_PIN_REG_SMT] = MTK_RANGE(mt7988_pin_smt_range),
+	[PINCTRL_PIN_REG_IES] = MTK_RANGE(mt7988_pin_ies_range),
+	[PINCTRL_PIN_REG_PU] = MTK_RANGE(mt7988_pin_pu_range),
+	[PINCTRL_PIN_REG_PD] = MTK_RANGE(mt7988_pin_pd_range),
+	[PINCTRL_PIN_REG_DRV] = MTK_RANGE(mt7988_pin_drv_range),
+	[PINCTRL_PIN_REG_PUPD] = MTK_RANGE(mt7988_pin_pupd_range),
+	[PINCTRL_PIN_REG_R0] = MTK_RANGE(mt7988_pin_r0_range),
+	[PINCTRL_PIN_REG_R1] = MTK_RANGE(mt7988_pin_r1_range),
+};
+
+static const struct mtk_pin_desc mt7988_pins[] = {
+	MT7988_PIN(0, "UART2_RXD"),
+	MT7988_PIN(1, "UART2_TXD"),
+	MT7988_PIN(2, "UART2_CTS"),
+	MT7988_PIN(3, "UART2_RTS"),
+	MT7988_PIN(4, "GPIO_A"),
+	MT7988_PIN(5, "SMI_0_MDC"),
+	MT7988_PIN(6, "SMI_0_MDIO"),
+	MT7988_PIN(7, "PCIE30_2L_0_WAKE_N"),
+	MT7988_PIN(8, "PCIE30_2L_0_CLKREQ_N"),
+	MT7988_PIN(9, "PCIE30_1L_1_WAKE_N"),
+	MT7988_PIN(10, "PCIE30_1L_1_CLKREQ_N"),
+	MT7988_PIN(11, "GPIO_P"),
+	MT7988_PIN(12, "WATCHDOG"),
+	MT7988_PIN(13, "GPIO_RESET"),
+	MT7988_PIN(14, "GPIO_WPS"),
+	MT7988_PIN(15, "PMIC_I2C_SCL"),
+	MT7988_PIN(16, "PMIC_I2C_SDA"),
+	MT7988_PIN(17, "I2C_1_SCL"),
+	MT7988_PIN(18, "I2C_1_SDA"),
+	MT7988_PIN(19, "PCIE30_2L_0_PRESET_N"),
+	MT7988_PIN(20, "PCIE30_1L_1_PRESET_N"),
+	MT7988_PIN(21, "PWMD1"),
+	MT7988_PIN(22, "SPI0_WP"),
+	MT7988_PIN(23, "SPI0_HOLD"),
+	MT7988_PIN(24, "SPI0_CSB"),
+	MT7988_PIN(25, "SPI0_MISO"),
+	MT7988_PIN(26, "SPI0_MOSI"),
+	MT7988_PIN(27, "SPI0_CLK"),
+	MT7988_PIN(28, "SPI1_CSB"),
+	MT7988_PIN(29, "SPI1_MISO"),
+	MT7988_PIN(30, "SPI1_MOSI"),
+	MT7988_PIN(31, "SPI1_CLK"),
+	MT7988_PIN(32, "SPI2_CLK"),
+	MT7988_PIN(33, "SPI2_MOSI"),
+	MT7988_PIN(34, "SPI2_MISO"),
+	MT7988_PIN(35, "SPI2_CSB"),
+	MT7988_PIN(36, "SPI2_HOLD"),
+	MT7988_PIN(37, "SPI2_WP"),
+	MT7988_PIN(38, "EMMC_RSTB"),
+	MT7988_PIN(39, "EMMC_DSL"),
+	MT7988_PIN(40, "EMMC_CK"),
+	MT7988_PIN(41, "EMMC_CMD"),
+	MT7988_PIN(42, "EMMC_DATA_7"),
+	MT7988_PIN(43, "EMMC_DATA_6"),
+	MT7988_PIN(44, "EMMC_DATA_5"),
+	MT7988_PIN(45, "EMMC_DATA_4"),
+	MT7988_PIN(46, "EMMC_DATA_3"),
+	MT7988_PIN(47, "EMMC_DATA_2"),
+	MT7988_PIN(48, "EMMC_DATA_1"),
+	MT7988_PIN(49, "EMMC_DATA_0"),
+	MT7988_PIN(50, "PCM_FS_I2S_LRCK"),
+	MT7988_PIN(51, "PCM_CLK_I2S_BCLK"),
+	MT7988_PIN(52, "PCM_DRX_I2S_DIN"),
+	MT7988_PIN(53, "PCM_DTX_I2S_DOUT"),
+	MT7988_PIN(54, "PCM_MCK_I2S_MCLK"),
+	MT7988_PIN(55, "UART0_RXD"),
+	MT7988_PIN(56, "UART0_TXD"),
+	MT7988_PIN(57, "PWMD0"),
+	MT7988_PIN(58, "JTAG_JTDI"),
+	MT7988_PIN(59, "JTAG_JTDO"),
+	MT7988_PIN(60, "JTAG_JTMS"),
+	MT7988_PIN(61, "JTAG_JTCLK"),
+	MT7988_PIN(62, "JTAG_JTRST_N"),
+	MT7988_PIN(63, "USB_DRV_VBUS_P1"),
+	MT7988_PIN(64, "LED_A"),
+	MT7988_PIN(65, "LED_B"),
+	MT7988_PIN(66, "LED_C"),
+	MT7988_PIN(67, "LED_D"),
+	MT7988_PIN(68, "LED_E"),
+	MT7988_PIN(69, "GPIO_B"),
+	MT7988_PIN(70, "GPIO_C"),
+	MT7988_PIN(71, "I2C_2_SCL"),
+	MT7988_PIN(72, "I2C_2_SDA"),
+	MT7988_PIN(73, "PCIE30_2L_1_PRESET_N"),
+	MT7988_PIN(74, "PCIE30_1L_0_PRESET_N"),
+	MT7988_PIN(75, "PCIE30_2L_1_WAKE_N"),
+	MT7988_PIN(76, "PCIE30_2L_1_CLKREQ_N"),
+	MT7988_PIN(77, "PCIE30_1L_0_WAKE_N"),
+	MT7988_PIN(78, "PCIE30_1L_0_CLKREQ_N"),
+	MT7988_PIN(79, "USB_DRV_VBUS_P0"),
+	MT7988_PIN(80, "UART1_RXD"),
+	MT7988_PIN(81, "UART1_TXD"),
+	MT7988_PIN(82, "UART1_CTS"),
+	MT7988_PIN(83, "UART1_RTS"),
+};
+
+/* jtag */
+static int mt7988_tops_jtag0_0_pins[] = { 0, 1, 2, 3, 4 };
+static int mt7988_tops_jtag0_0_funcs[] = { 2, 2, 2, 2, 2 };
+
+static int mt7988_wo0_jtag_pins[] = { 50, 51, 52, 53, 54 };
+static int mt7988_wo0_jtag_funcs[] = { 3, 3, 3, 3, 3 };
+
+static int mt7988_wo1_jtag_pins[] = { 50, 51, 52, 53, 54 };
+static int mt7988_wo1_jtag_funcs[] = { 4, 4, 4, 4, 4 };
+
+static int mt7988_wo2_jtag_pins[] = { 50, 51, 52, 53, 54 };
+static int mt7988_wo2_jtag_funcs[] = { 5, 5, 5, 5, 5 };
+
+static int mt7988_jtag_pins[] = { 58, 59, 60, 61, 62 };
+static int mt7988_jtag_funcs[] = { 1, 1, 1, 1, 1 };
+
+static int mt7988_tops_jtag0_1_pins[] = { 58, 59, 60, 61, 62 };
+static int mt7988_tops_jtag0_1_funcs[] = { 4, 4, 4, 4, 4 };
+
+/* int_usxgmii */
+static int mt7988_int_usxgmii_pins[] = { 2, 3 };
+static int mt7988_int_usxgmii_funcs[] = { 3, 3 };
+
+/* pwm */
+static int mt7988_pwm0_pins[] = { 57 };
+static int mt7988_pwm0_funcs[] = { 1 };
+
+static int mt7988_pwm1_pins[] = { 21 };
+static int mt7988_pwm1_funcs[] = { 1 };
+
+static int mt7988_pwm2_pins[] = { 80 };
+static int mt7988_pwm2_funcs[] = { 2 };
+
+static int mt7988_pwm3_pins[] = { 81 };
+static int mt7988_pwm3_funcs[] = { 2 };
+
+static int mt7988_pwm4_pins[] = { 82 };
+static int mt7988_pwm4_funcs[] = { 2 };
+
+static int mt7988_pwm5_pins[] = { 83 };
+static int mt7988_pwm5_funcs[] = { 2 };
+
+static int mt7988_pwm6_pins[] = { 69 };
+static int mt7988_pwm6_funcs[] = { 3 };
+
+static int mt7988_pwm7_pins[] = { 70 };
+static int mt7988_pwm7_funcs[] = { 3 };
+
+/* dfd */
+static int mt7988_dfd_pins[] = { 0, 1, 2, 3, 4 };
+static int mt7988_dfd_funcs[] = { 4, 4, 4, 4, 4 };
+
+/* i2c */
+static int mt7988_xfi_phy0_i2c0_pins[] = { 0, 1 };
+static int mt7988_xfi_phy0_i2c0_funcs[] = { 5, 5 };
+
+static int mt7988_xfi_phy1_i2c0_pins[] = { 0, 1 };
+static int mt7988_xfi_phy1_i2c0_funcs[] = { 6, 6 };
+
+static int mt7988_xfi_phy_pll_i2c0_pins[] = { 3, 4 };
+static int mt7988_xfi_phy_pll_i2c0_funcs[] = { 5, 5 };
+
+static int mt7988_xfi_phy_pll_i2c1_pins[] = { 3, 4 };
+static int mt7988_xfi_phy_pll_i2c1_funcs[] = { 6, 6 };
+
+static int mt7988_i2c0_0_pins[] = { 5, 6 };
+static int mt7988_i2c0_0_funcs[] = { 2, 2 };
+
+static int mt7988_i2c1_sfp_pins[] = { 5, 6 };
+static int mt7988_i2c1_sfp_funcs[] = { 4, 4 };
+
+static int mt7988_xfi_pextp_phy0_i2c_pins[] = { 5, 6 };
+static int mt7988_xfi_pextp_phy0_i2c_funcs[] = { 5, 5 };
+
+static int mt7988_xfi_pextp_phy1_i2c_pins[] = { 5, 6 };
+static int mt7988_xfi_pextp_phy1_i2c_funcs[] = { 6, 6 };
+
+static int mt7988_i2c0_1_pins[] = { 15, 16 };
+static int mt7988_i2c0_1_funcs[] = { 1, 1 };
+
+static int mt7988_u30_phy_i2c0_pins[] = { 15, 16 };
+static int mt7988_u30_phy_i2c0_funcs[] = { 2, 2 };
+
+static int mt7988_u32_phy_i2c0_pins[] = { 15, 16 };
+static int mt7988_u32_phy_i2c0_funcs[] = { 3, 3 };
+
+static int mt7988_xfi_phy0_i2c1_pins[] = { 15, 16 };
+static int mt7988_xfi_phy0_i2c1_funcs[] = { 5, 5 };
+
+static int mt7988_xfi_phy1_i2c1_pins[] = { 15, 16 };
+static int mt7988_xfi_phy1_i2c1_funcs[] = { 6, 6 };
+
+static int mt7988_xfi_phy_pll_i2c2_pins[] = { 15, 16 };
+static int mt7988_xfi_phy_pll_i2c2_funcs[] = { 7, 7 };
+
+static int mt7988_i2c1_0_pins[] = { 17, 18 };
+static int mt7988_i2c1_0_funcs[] = { 1, 1 };
+
+static int mt7988_u30_phy_i2c1_pins[] = { 17, 18 };
+static int mt7988_u30_phy_i2c1_funcs[] = { 2, 2 };
+
+static int mt7988_u32_phy_i2c1_pins[] = { 17, 18 };
+static int mt7988_u32_phy_i2c1_funcs[] = { 3, 3 };
+
+static int mt7988_xfi_phy_pll_i2c3_pins[] = { 17, 18 };
+static int mt7988_xfi_phy_pll_i2c3_funcs[] = { 4, 4 };
+
+static int mt7988_sgmii0_i2c_pins[] = { 17, 18 };
+static int mt7988_sgmii0_i2c_funcs[] = { 5, 5 };
+
+static int mt7988_sgmii1_i2c_pins[] = { 17, 18 };
+static int mt7988_sgmii1_i2c_funcs[] = { 6, 6 };
+
+static int mt7988_i2c1_2_pins[] = { 69, 70 };
+static int mt7988_i2c1_2_funcs[] = { 2, 2 };
+
+static int mt7988_i2c2_0_pins[] = { 69, 70 };
+static int mt7988_i2c2_0_funcs[] = { 4, 4 };
+
+static int mt7988_i2c2_1_pins[] = { 71, 72 };
+static int mt7988_i2c2_1_funcs[] = { 1, 1 };
+
+/* eth */
+static int mt7988_mdc_mdio0_pins[] = { 5, 6 };
+static int mt7988_mdc_mdio0_funcs[] = { 1, 1 };
+
+static int mt7988_2p5g_ext_mdio_pins[] = { 28, 29 };
+static int mt7988_2p5g_ext_mdio_funcs[] = { 6, 6 };
+
+static int mt7988_gbe_ext_mdio_pins[] = { 30, 31 };
+static int mt7988_gbe_ext_mdio_funcs[] = { 6, 6 };
+
+static int mt7988_mdc_mdio1_pins[] = { 69, 70 };
+static int mt7988_mdc_mdio1_funcs[] = { 1, 1 };
+
+/* pcie */
+static int mt7988_pcie_wake_n0_0_pins[] = { 7 };
+static int mt7988_pcie_wake_n0_0_funcs[] = { 1 };
+
+static int mt7988_pcie_clk_req_n0_0_pins[] = { 8 };
+static int mt7988_pcie_clk_req_n0_0_funcs[] = { 1 };
+
+static int mt7988_pcie_wake_n3_0_pins[] = { 9 };
+static int mt7988_pcie_wake_n3_0_funcs[] = { 1 };
+
+static int mt7988_pcie_clk_req_n3_pins[] = { 10 };
+static int mt7988_pcie_clk_req_n3_funcs[] = { 1 };
+
+static int mt7988_pcie_clk_req_n0_1_pins[] = { 10 };
+static int mt7988_pcie_clk_req_n0_1_funcs[] = { 2 };
+
+static int mt7988_pcie_p0_phy_i2c_pins[] = { 7, 8 };
+static int mt7988_pcie_p0_phy_i2c_funcs[] = { 3, 3 };
+
+static int mt7988_pcie_p1_phy_i2c_pins[] = { 7, 8 };
+static int mt7988_pcie_p1_phy_i2c_funcs[] = { 4, 4 };
+
+static int mt7988_pcie_p3_phy_i2c_pins[] = { 9, 10 };
+static int mt7988_pcie_p3_phy_i2c_funcs[] = { 4, 4 };
+
+static int mt7988_pcie_p2_phy_i2c_pins[] = { 7, 8 };
+static int mt7988_pcie_p2_phy_i2c_funcs[] = { 5, 5 };
+
+static int mt7988_ckm_phy_i2c_pins[] = { 9, 10 };
+static int mt7988_ckm_phy_i2c_funcs[] = { 5, 5 };
+
+static int mt7988_pcie_wake_n0_1_pins[] = { 13 };
+static int mt7988_pcie_wake_n0_1_funcs[] = { 2 };
+
+static int mt7988_pcie_wake_n3_1_pins[] = { 14 };
+static int mt7988_pcie_wake_n3_1_funcs[] = { 2 };
+
+static int mt7988_pcie_2l_0_pereset_pins[] = { 19 };
+static int mt7988_pcie_2l_0_pereset_funcs[] = { 1 };
+
+static int mt7988_pcie_1l_1_pereset_pins[] = { 20 };
+static int mt7988_pcie_1l_1_pereset_funcs[] = { 1 };
+
+static int mt7988_pcie_clk_req_n2_1_pins[] = { 63 };
+static int mt7988_pcie_clk_req_n2_1_funcs[] = { 2 };
+
+static int mt7988_pcie_2l_1_pereset_pins[] = { 73 };
+static int mt7988_pcie_2l_1_pereset_funcs[] = { 1 };
+
+static int mt7988_pcie_1l_0_pereset_pins[] = { 74 };
+static int mt7988_pcie_1l_0_pereset_funcs[] = { 1 };
+
+static int mt7988_pcie_wake_n1_0_pins[] = { 75 };
+static int mt7988_pcie_wake_n1_0_funcs[] = { 1 };
+
+static int mt7988_pcie_clk_req_n1_pins[] = { 76 };
+static int mt7988_pcie_clk_req_n1_funcs[] = { 1 };
+
+static int mt7988_pcie_wake_n2_0_pins[] = { 77 };
+static int mt7988_pcie_wake_n2_0_funcs[] = { 1 };
+
+static int mt7988_pcie_clk_req_n2_0_pins[] = { 78 };
+static int mt7988_pcie_clk_req_n2_0_funcs[] = { 1 };
+
+static int mt7988_pcie_wake_n2_1_pins[] = { 79 };
+static int mt7988_pcie_wake_n2_1_funcs[] = { 2 };
+
+/* pmic */
+static int mt7988_pmic_pins[] = { 11 };
+static int mt7988_pmic_funcs[] = { 1 };
+
+/* watchdog */
+static int mt7988_watchdog_pins[] = { 12 };
+static int mt7988_watchdog_funcs[] = { 1 };
+
+/* spi */
+static int mt7988_spi0_wp_hold_pins[] = { 22, 23 };
+static int mt7988_spi0_wp_hold_funcs[] = { 1, 1 };
+
+static int mt7988_spi0_pins[] = { 24, 25, 26, 27 };
+static int mt7988_spi0_funcs[] = { 1, 1, 1, 1 };
+
+static int mt7988_spi1_pins[] = { 28, 29, 30, 31 };
+static int mt7988_spi1_funcs[] = { 1, 1, 1, 1 };
+
+static int mt7988_spi2_pins[] = { 32, 33, 34, 35 };
+static int mt7988_spi2_funcs[] = { 1, 1, 1, 1 };
+
+static int mt7988_spi2_wp_hold_pins[] = { 36, 37 };
+static int mt7988_spi2_wp_hold_funcs[] = { 1, 1 };
+
+/* flash */
+static int mt7988_snfi_pins[] = { 22, 23, 24, 25, 26, 27 };
+static int mt7988_snfi_funcs[] = { 2, 2, 2, 2, 2, 2 };
+
+static int mt7988_emmc_45_pins[] = {
+	21, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37
+};
+static int mt7988_emmc_45_funcs[] = { 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5 };
+
+static int mt7988_sdcard_pins[] = { 32, 33, 34, 35, 36, 37 };
+static int mt7988_sdcard_funcs[] = { 5, 5, 5, 5, 5, 5 };
+
+static int mt7988_emmc_51_pins[] = { 38, 39, 40, 41, 42, 43,
+				     44, 45, 46, 47, 48, 49 };
+static int mt7988_emmc_51_funcs[] = { 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1 };
+
+/* uart */
+static int mt7988_uart2_pins[] = { 0, 1, 2, 3 };
+static int mt7988_uart2_funcs[] = { 1, 1, 1, 1 };
+
+static int mt7988_tops_uart0_0_pins[] = { 22, 23 };
+static int mt7988_tops_uart0_0_funcs[] = { 3, 3 };
+
+static int mt7988_uart2_0_pins[] = { 28, 29, 30, 31 };
+static int mt7988_uart2_0_funcs[] = { 2, 2, 2, 2 };
+
+static int mt7988_uart1_0_pins[] = { 32, 33, 34, 35 };
+static int mt7988_uart1_0_funcs[] = { 2, 2, 2, 2 };
+
+static int mt7988_uart2_1_pins[] = { 32, 33, 34, 35 };
+static int mt7988_uart2_1_funcs[] = { 3, 3, 3, 3 };
+
+static int mt7988_net_wo0_uart_txd_0_pins[] = { 28 };
+static int mt7988_net_wo0_uart_txd_0_funcs[] = { 3 };
+
+static int mt7988_net_wo1_uart_txd_0_pins[] = { 29 };
+static int mt7988_net_wo1_uart_txd_0_funcs[] = { 3 };
+
+static int mt7988_net_wo2_uart_txd_0_pins[] = { 30 };
+static int mt7988_net_wo2_uart_txd_0_funcs[] = { 3 };
+
+static int mt7988_tops_uart1_0_pins[] = { 28, 29 };
+static int mt7988_tops_uart1_0_funcs[] = { 4, 4 };
+
+static int mt7988_tops_uart0_1_pins[] = { 30, 31 };
+static int mt7988_tops_uart0_1_funcs[] = { 4, 4 };
+
+static int mt7988_tops_uart1_1_pins[] = { 36, 37 };
+static int mt7988_tops_uart1_1_funcs[] = { 3, 3 };
+
+static int mt7988_uart0_pins[] = { 55, 56 };
+static int mt7988_uart0_funcs[] = { 1, 1 };
+
+static int mt7988_tops_uart0_2_pins[] = { 55, 56 };
+static int mt7988_tops_uart0_2_funcs[] = { 2, 2 };
+
+static int mt7988_uart2_2_pins[] = { 50, 51, 52, 53 };
+static int mt7988_uart2_2_funcs[] = { 2, 2, 2, 2 };
+
+static int mt7988_uart1_1_pins[] = { 58, 59, 60, 61 };
+static int mt7988_uart1_1_funcs[] = { 2, 2, 2, 2 };
+
+static int mt7988_uart2_3_pins[] = { 58, 59, 60, 61 };
+static int mt7988_uart2_3_funcs[] = { 3, 3, 3, 3 };
+
+static int mt7988_uart1_2_pins[] = { 80, 81, 82, 83 };
+static int mt7988_uart1_2_funcs[] = { 1, 1, 1, 1 };
+
+static int mt7988_uart1_2_lite_pins[] = { 80, 81 };
+static int mt7988_uart1_2_lite_funcs[] = { 1, 1 };
+
+static int mt7988_tops_uart1_2_pins[] = { 80, 81 };
+static int mt7988_tops_uart1_2_funcs[] = { 4, 4, };
+
+static int mt7988_net_wo0_uart_txd_1_pins[] = { 80 };
+static int mt7988_net_wo0_uart_txd_1_funcs[] = { 3 };
+
+static int mt7988_net_wo1_uart_txd_1_pins[] = { 81 };
+static int mt7988_net_wo1_uart_txd_1_funcs[] = { 3 };
+
+static int mt7988_net_wo2_uart_txd_1_pins[] = { 82 };
+static int mt7988_net_wo2_uart_txd_1_funcs[] = { 3 };
+
+/* udi */
+static int mt7988_udi_pins[] = { 32, 33, 34, 35, 36 };
+static int mt7988_udi_funcs[] = { 4, 4, 4, 4, 4 };
+
+/* i2s */
+static int mt7988_i2s_pins[] = { 50, 51, 52, 53, 54 };
+static int mt7988_i2s_funcs[] = { 1, 1, 1, 1, 1 };
+
+/* pcm */
+static int mt7988_pcm_pins[] = { 50, 51, 52, 53 };
+static int mt7988_pcm_funcs[] = { 1, 1, 1, 1 };
+
+/* led */
+static int mt7988_gbe0_led1_pins[] = { 58 };
+static int mt7988_gbe0_led1_funcs[] = { 6 };
+static int mt7988_gbe1_led1_pins[] = { 59 };
+static int mt7988_gbe1_led1_funcs[] = { 6 };
+static int mt7988_gbe2_led1_pins[] = { 60 };
+static int mt7988_gbe2_led1_funcs[] = { 6 };
+static int mt7988_gbe3_led1_pins[] = { 61 };
+static int mt7988_gbe3_led1_funcs[] = { 6 };
+
+static int mt7988_2p5gbe_led1_pins[] = { 62 };
+static int mt7988_2p5gbe_led1_funcs[] = { 6 };
+
+static int mt7988_gbe0_led0_pins[] = { 64 };
+static int mt7988_gbe0_led0_funcs[] = { 1 };
+static int mt7988_gbe1_led0_pins[] = { 65 };
+static int mt7988_gbe1_led0_funcs[] = { 1 };
+static int mt7988_gbe2_led0_pins[] = { 66 };
+static int mt7988_gbe2_led0_funcs[] = { 1 };
+static int mt7988_gbe3_led0_pins[] = { 67 };
+static int mt7988_gbe3_led0_funcs[] = { 1 };
+
+static int mt7988_2p5gbe_led0_pins[] = { 68 };
+static int mt7988_2p5gbe_led0_funcs[] = { 1 };
+
+/* usb */
+static int mt7988_drv_vbus_p1_pins[] = { 63 };
+static int mt7988_drv_vbus_p1_funcs[] = { 1 };
+
+static int mt7988_drv_vbus_pins[] = { 79 };
+static int mt7988_drv_vbus_funcs[] = { 1 };
+
+static const struct group_desc mt7988_groups[] = {
+	/*  @GPIO(0,1,2,3): uart2 */
+	PINCTRL_PIN_GROUP("uart2", mt7988_uart2),
+	/*  @GPIO(0,1,2,3,4): tops_jtag0_0 */
+	PINCTRL_PIN_GROUP("tops_jtag0_0", mt7988_tops_jtag0_0),
+	/*  @GPIO(2,3): int_usxgmii */
+	PINCTRL_PIN_GROUP("int_usxgmii", mt7988_int_usxgmii),
+	/*  @GPIO(0,1,2,3,4): dfd */
+	PINCTRL_PIN_GROUP("dfd", mt7988_dfd),
+	/*  @GPIO(0,1): xfi_phy0_i2c0 */
+	PINCTRL_PIN_GROUP("xfi_phy0_i2c0", mt7988_xfi_phy0_i2c0),
+	/*  @GPIO(0,1): xfi_phy1_i2c0 */
+	PINCTRL_PIN_GROUP("xfi_phy1_i2c0", mt7988_xfi_phy1_i2c0),
+	/*  @GPIO(3,4): xfi_phy_pll_i2c0 */
+	PINCTRL_PIN_GROUP("xfi_phy_pll_i2c0", mt7988_xfi_phy_pll_i2c0),
+	/*  @GPIO(3,4): xfi_phy_pll_i2c1 */
+	PINCTRL_PIN_GROUP("xfi_phy_pll_i2c1", mt7988_xfi_phy_pll_i2c1),
+	/*  @GPIO(5,6) i2c0_0 */
+	PINCTRL_PIN_GROUP("i2c0_0", mt7988_i2c0_0),
+	/*  @GPIO(5,6) i2c1_sfp */
+	PINCTRL_PIN_GROUP("i2c1_sfp", mt7988_i2c1_sfp),
+	/*  @GPIO(5,6) xfi_pextp_phy0_i2c */
+	PINCTRL_PIN_GROUP("xfi_pextp_phy0_i2c", mt7988_xfi_pextp_phy0_i2c),
+	/*  @GPIO(5,6) xfi_pextp_phy1_i2c */
+	PINCTRL_PIN_GROUP("xfi_pextp_phy1_i2c", mt7988_xfi_pextp_phy1_i2c),
+	/*  @GPIO(5,6) mdc_mdio0 */
+	PINCTRL_PIN_GROUP("mdc_mdio0", mt7988_mdc_mdio0),
+	/*  @GPIO(7): pcie_wake_n0_0 */
+	PINCTRL_PIN_GROUP("pcie_wake_n0_0", mt7988_pcie_wake_n0_0),
+	/*  @GPIO(8): pcie_clk_req_n0_0 */
+	PINCTRL_PIN_GROUP("pcie_clk_req_n0_0", mt7988_pcie_clk_req_n0_0),
+	/*  @GPIO(9): pcie_wake_n3_0 */
+	PINCTRL_PIN_GROUP("pcie_wake_n3_0", mt7988_pcie_wake_n3_0),
+	/*  @GPIO(10): pcie_clk_req_n3 */
+	PINCTRL_PIN_GROUP("pcie_clk_req_n3", mt7988_pcie_clk_req_n3),
+	/*  @GPIO(10): pcie_clk_req_n0_1 */
+	PINCTRL_PIN_GROUP("pcie_clk_req_n0_1", mt7988_pcie_clk_req_n0_1),
+	/*  @GPIO(7,8) pcie_p0_phy_i2c */
+	PINCTRL_PIN_GROUP("pcie_p0_phy_i2c", mt7988_pcie_p0_phy_i2c),
+	/*  @GPIO(7,8) pcie_p1_phy_i2c */
+	PINCTRL_PIN_GROUP("pcie_p1_phy_i2c", mt7988_pcie_p1_phy_i2c),
+	/*  @GPIO(7,8) pcie_p2_phy_i2c */
+	PINCTRL_PIN_GROUP("pcie_p2_phy_i2c", mt7988_pcie_p2_phy_i2c),
+	/*  @GPIO(9,10) pcie_p3_phy_i2c */
+	PINCTRL_PIN_GROUP("pcie_p3_phy_i2c", mt7988_pcie_p3_phy_i2c),
+	/*  @GPIO(9,10) ckm_phy_i2c */
+	PINCTRL_PIN_GROUP("ckm_phy_i2c", mt7988_ckm_phy_i2c),
+	/*  @GPIO(11): pmic */
+	PINCTRL_PIN_GROUP("pcie_pmic", mt7988_pmic),
+	/*  @GPIO(12): watchdog */
+	PINCTRL_PIN_GROUP("watchdog", mt7988_watchdog),
+	/*  @GPIO(13): pcie_wake_n0_1 */
+	PINCTRL_PIN_GROUP("pcie_wake_n0_1", mt7988_pcie_wake_n0_1),
+	/*  @GPIO(14): pcie_wake_n3_1 */
+	PINCTRL_PIN_GROUP("pcie_wake_n3_1", mt7988_pcie_wake_n3_1),
+	/*  @GPIO(15,16) i2c0_1 */
+	PINCTRL_PIN_GROUP("i2c0_1", mt7988_i2c0_1),
+	/*  @GPIO(15,16) u30_phy_i2c0 */
+	PINCTRL_PIN_GROUP("u30_phy_i2c0", mt7988_u30_phy_i2c0),
+	/*  @GPIO(15,16) u32_phy_i2c0 */
+	PINCTRL_PIN_GROUP("u32_phy_i2c0", mt7988_u32_phy_i2c0),
+	/*  @GPIO(15,16) xfi_phy0_i2c1 */
+	PINCTRL_PIN_GROUP("xfi_phy0_i2c1", mt7988_xfi_phy0_i2c1),
+	/*  @GPIO(15,16) xfi_phy1_i2c1 */
+	PINCTRL_PIN_GROUP("xfi_phy1_i2c1", mt7988_xfi_phy1_i2c1),
+	/*  @GPIO(15,16) xfi_phy_pll_i2c2 */
+	PINCTRL_PIN_GROUP("xfi_phy_pll_i2c2", mt7988_xfi_phy_pll_i2c2),
+	/*  @GPIO(17,18) i2c1_0 */
+	PINCTRL_PIN_GROUP("i2c1_0", mt7988_i2c1_0),
+	/*  @GPIO(17,18) u30_phy_i2c1 */
+	PINCTRL_PIN_GROUP("u30_phy_i2c1", mt7988_u30_phy_i2c1),
+	/*  @GPIO(17,18) u32_phy_i2c1 */
+	PINCTRL_PIN_GROUP("u32_phy_i2c1", mt7988_u32_phy_i2c1),
+	/*  @GPIO(17,18) xfi_phy_pll_i2c3 */
+	PINCTRL_PIN_GROUP("xfi_phy_pll_i2c3", mt7988_xfi_phy_pll_i2c3),
+	/*  @GPIO(17,18) sgmii0_i2c */
+	PINCTRL_PIN_GROUP("sgmii0_i2c", mt7988_sgmii0_i2c),
+	/*  @GPIO(17,18) sgmii1_i2c */
+	PINCTRL_PIN_GROUP("sgmii1_i2c", mt7988_sgmii1_i2c),
+	/*  @GPIO(19): pcie_2l_0_pereset */
+	PINCTRL_PIN_GROUP("pcie_2l_0_pereset", mt7988_pcie_2l_0_pereset),
+	/*  @GPIO(20): pcie_1l_1_pereset */
+	PINCTRL_PIN_GROUP("pcie_1l_1_pereset", mt7988_pcie_1l_1_pereset),
+	/*  @GPIO(21): pwm1 */
+	PINCTRL_PIN_GROUP("pwm1", mt7988_pwm1),
+	/*  @GPIO(22,23) spi0_wp_hold */
+	PINCTRL_PIN_GROUP("spi0_wp_hold", mt7988_spi0_wp_hold),
+	/*  @GPIO(24,25,26,27) spi0 */
+	PINCTRL_PIN_GROUP("spi0", mt7988_spi0),
+	/*  @GPIO(28,29,30,31) spi1 */
+	PINCTRL_PIN_GROUP("spi1", mt7988_spi1),
+	/*  @GPIO(32,33,34,35) spi2 */
+	PINCTRL_PIN_GROUP("spi2", mt7988_spi2),
+	/*  @GPIO(36,37) spi2_wp_hold */
+	PINCTRL_PIN_GROUP("spi2_wp_hold", mt7988_spi2_wp_hold),
+	/*  @GPIO(22,23,24,25,26,27) snfi */
+	PINCTRL_PIN_GROUP("snfi", mt7988_snfi),
+	/*  @GPIO(22,23) tops_uart0_0 */
+	PINCTRL_PIN_GROUP("tops_uart0_0", mt7988_tops_uart0_0),
+	/*  @GPIO(28,29,30,31) uart2_0 */
+	PINCTRL_PIN_GROUP("uart2_0", mt7988_uart2_0),
+	/*  @GPIO(32,33,34,35) uart1_0 */
+	PINCTRL_PIN_GROUP("uart1_0", mt7988_uart1_0),
+	/*  @GPIO(32,33,34,35) uart2_1 */
+	PINCTRL_PIN_GROUP("uart2_1", mt7988_uart2_1),
+	/*  @GPIO(28) net_wo0_uart_txd_0 */
+	PINCTRL_PIN_GROUP("net_wo0_uart_txd_0", mt7988_net_wo0_uart_txd_0),
+	/*  @GPIO(29) net_wo1_uart_txd_0 */
+	PINCTRL_PIN_GROUP("net_wo1_uart_txd_0", mt7988_net_wo1_uart_txd_0),
+	/*  @GPIO(30) net_wo2_uart_txd_0 */
+	PINCTRL_PIN_GROUP("net_wo2_uart_txd_0", mt7988_net_wo2_uart_txd_0),
+	/*  @GPIO(28,29) tops_uart1_0 */
+	PINCTRL_PIN_GROUP("tops_uart0_0", mt7988_tops_uart1_0),
+	/*  @GPIO(30,31) tops_uart0_1 */
+	PINCTRL_PIN_GROUP("tops_uart0_1", mt7988_tops_uart0_1),
+	/*  @GPIO(36,37) tops_uart1_1 */
+	PINCTRL_PIN_GROUP("tops_uart1_1", mt7988_tops_uart1_1),
+	/*  @GPIO(32,33,34,35,36) udi */
+	PINCTRL_PIN_GROUP("udi", mt7988_udi),
+	/*  @GPIO(21,28,29,30,31,32,33,34,35,36,37) emmc_45 */
+	PINCTRL_PIN_GROUP("emmc_45", mt7988_emmc_45),
+	/*  @GPIO(32,33,34,35,36,37) sdcard */
+	PINCTRL_PIN_GROUP("sdcard", mt7988_sdcard),
+	/*  @GPIO(38,39,40,41,42,43,44,45,46,47,48,49) emmc_51 */
+	PINCTRL_PIN_GROUP("emmc_51", mt7988_emmc_51),
+	/*  @GPIO(28,29) 2p5g_ext_mdio */
+	PINCTRL_PIN_GROUP("2p5g_ext_mdio", mt7988_2p5g_ext_mdio),
+	/*  @GPIO(30,31) gbe_ext_mdio */
+	PINCTRL_PIN_GROUP("gbe_ext_mdio", mt7988_gbe_ext_mdio),
+	/*  @GPIO(50,51,52,53,54) i2s */
+	PINCTRL_PIN_GROUP("i2s", mt7988_i2s),
+	/*  @GPIO(50,51,52,53) pcm */
+	PINCTRL_PIN_GROUP("pcm", mt7988_pcm),
+	/*  @GPIO(55,56) uart0 */
+	PINCTRL_PIN_GROUP("uart0", mt7988_uart0),
+	/*  @GPIO(55,56) tops_uart0_2 */
+	PINCTRL_PIN_GROUP("tops_uart0_2", mt7988_tops_uart0_2),
+	/*  @GPIO(50,51,52,53) uart2_2 */
+	PINCTRL_PIN_GROUP("uart2_2", mt7988_uart2_2),
+	/*  @GPIO(50,51,52,53,54) wo0_jtag */
+	PINCTRL_PIN_GROUP("wo0_jtag", mt7988_wo0_jtag),
+	/*  @GPIO(50,51,52,53,54) wo1-wo1_jtag */
+	PINCTRL_PIN_GROUP("wo1_jtag", mt7988_wo1_jtag),
+	/*  @GPIO(50,51,52,53,54) wo2_jtag */
+	PINCTRL_PIN_GROUP("wo2_jtag", mt7988_wo2_jtag),
+	/*  @GPIO(57) pwm0 */
+	PINCTRL_PIN_GROUP("pwm0", mt7988_pwm0),
+	/*  @GPIO(58,59,60,61,62) jtag */
+	PINCTRL_PIN_GROUP("jtag", mt7988_jtag),
+	/*  @GPIO(58,59,60,61,62) tops_jtag0_1 */
+	PINCTRL_PIN_GROUP("tops_jtag0_1", mt7988_tops_jtag0_1),
+	/*  @GPIO(58,59,60,61) uart2_3 */
+	PINCTRL_PIN_GROUP("uart2_3", mt7988_uart2_3),
+	/*  @GPIO(58,59,60,61) uart1_1 */
+	PINCTRL_PIN_GROUP("uart1_1", mt7988_uart1_1),
+	/*  @GPIO(58,59,60,61) gbe_led1 */
+	PINCTRL_PIN_GROUP("gbe0_led1", mt7988_gbe0_led1),
+	PINCTRL_PIN_GROUP("gbe1_led1", mt7988_gbe1_led1),
+	PINCTRL_PIN_GROUP("gbe2_led1", mt7988_gbe2_led1),
+	PINCTRL_PIN_GROUP("gbe3_led1", mt7988_gbe3_led1),
+	/*  @GPIO(62) 2p5gbe_led1 */
+	PINCTRL_PIN_GROUP("2p5gbe_led1", mt7988_2p5gbe_led1),
+	/*  @GPIO(64,65,66,67) gbe_led0 */
+	PINCTRL_PIN_GROUP("gbe0_led0", mt7988_gbe0_led0),
+	PINCTRL_PIN_GROUP("gbe1_led0", mt7988_gbe1_led0),
+	PINCTRL_PIN_GROUP("gbe2_led0", mt7988_gbe2_led0),
+	PINCTRL_PIN_GROUP("gbe3_led0", mt7988_gbe3_led0),
+	/*  @GPIO(68) 2p5gbe_led0 */
+	PINCTRL_PIN_GROUP("2p5gbe_led0", mt7988_2p5gbe_led0),
+	/*  @GPIO(63) drv_vbus_p1 */
+	PINCTRL_PIN_GROUP("drv_vbus_p1", mt7988_drv_vbus_p1),
+	/*  @GPIO(63) pcie_clk_req_n2_1 */
+	PINCTRL_PIN_GROUP("pcie_clk_req_n2_1", mt7988_pcie_clk_req_n2_1),
+	/*  @GPIO(69, 70) mdc_mdio1 */
+	PINCTRL_PIN_GROUP("mdc_mdio1", mt7988_mdc_mdio1),
+	/*  @GPIO(69, 70) i2c1_2 */
+	PINCTRL_PIN_GROUP("i2c1_2", mt7988_i2c1_2),
+	/*  @GPIO(69) pwm6 */
+	PINCTRL_PIN_GROUP("pwm6", mt7988_pwm6),
+	/*  @GPIO(70) pwm7 */
+	PINCTRL_PIN_GROUP("pwm7", mt7988_pwm7),
+	/*  @GPIO(69,70) i2c2_0 */
+	PINCTRL_PIN_GROUP("i2c2_0", mt7988_i2c2_0),
+	/*  @GPIO(71,72) i2c2_1 */
+	PINCTRL_PIN_GROUP("i2c2_1", mt7988_i2c2_1),
+	/*  @GPIO(73) pcie_2l_1_pereset */
+	PINCTRL_PIN_GROUP("pcie_2l_1_pereset", mt7988_pcie_2l_1_pereset),
+	/*  @GPIO(74) pcie_1l_0_pereset */
+	PINCTRL_PIN_GROUP("pcie_1l_0_pereset", mt7988_pcie_1l_0_pereset),
+	/*  @GPIO(75) pcie_wake_n1_0 */
+	PINCTRL_PIN_GROUP("pcie_wake_n1_0", mt7988_pcie_wake_n1_0),
+	/*  @GPIO(76) pcie_clk_req_n1 */
+	PINCTRL_PIN_GROUP("pcie_clk_req_n1", mt7988_pcie_clk_req_n1),
+	/*  @GPIO(77) pcie_wake_n2_0 */
+	PINCTRL_PIN_GROUP("pcie_wake_n2_0", mt7988_pcie_wake_n2_0),
+	/*  @GPIO(78) pcie_clk_req_n2_0 */
+	PINCTRL_PIN_GROUP("pcie_clk_req_n2_0", mt7988_pcie_clk_req_n2_0),
+	/*  @GPIO(79) drv_vbus */
+	PINCTRL_PIN_GROUP("drv_vbus", mt7988_drv_vbus),
+	/*  @GPIO(79) pcie_wake_n2_1 */
+	PINCTRL_PIN_GROUP("pcie_wake_n2_1", mt7988_pcie_wake_n2_1),
+	/*  @GPIO(80,81,82,83) uart1_2 */
+	PINCTRL_PIN_GROUP("uart1_2", mt7988_uart1_2),
+	/*  @GPIO(80,81) uart1_2_lite */
+	PINCTRL_PIN_GROUP("uart1_2_lite", mt7988_uart1_2_lite),
+	/*  @GPIO(80) pwm2 */
+	PINCTRL_PIN_GROUP("pwm2", mt7988_pwm2),
+	/*  @GPIO(81) pwm3 */
+	PINCTRL_PIN_GROUP("pwm3", mt7988_pwm3),
+	/*  @GPIO(82) pwm4 */
+	PINCTRL_PIN_GROUP("pwm4", mt7988_pwm4),
+	/*  @GPIO(83) pwm5 */
+	PINCTRL_PIN_GROUP("pwm5", mt7988_pwm5),
+	/*  @GPIO(80) net_wo0_uart_txd_0 */
+	PINCTRL_PIN_GROUP("net_wo0_uart_txd_0", mt7988_net_wo0_uart_txd_0),
+	/*  @GPIO(81) net_wo1_uart_txd_0 */
+	PINCTRL_PIN_GROUP("net_wo1_uart_txd_0", mt7988_net_wo1_uart_txd_0),
+	/*  @GPIO(82) net_wo2_uart_txd_0 */
+	PINCTRL_PIN_GROUP("net_wo2_uart_txd_0", mt7988_net_wo2_uart_txd_0),
+	/*  @GPIO(80,81) tops_uart1_2 */
+	PINCTRL_PIN_GROUP("tops_uart1_2", mt7988_tops_uart1_2),
+	/*  @GPIO(80) net_wo0_uart_txd_1 */
+	PINCTRL_PIN_GROUP("net_wo0_uart_txd_1", mt7988_net_wo0_uart_txd_1),
+	/*  @GPIO(81) net_wo1_uart_txd_1 */
+	PINCTRL_PIN_GROUP("net_wo1_uart_txd_1", mt7988_net_wo1_uart_txd_1),
+	/*  @GPIO(82) net_wo2_uart_txd_1 */
+	PINCTRL_PIN_GROUP("net_wo2_uart_txd_1", mt7988_net_wo2_uart_txd_1),
+};
+
+/* Joint those groups owning the same capability in user point of view which
+ * allows that people tend to use through the device tree.
+ */
+static const char * const mt7988_jtag_groups[] = {
+	"tops_jtag0_0", "wo0_jtag", "wo1_jtag",
+	"wo2_jtag",	"jtag",	    "tops_jtag0_1",
+};
+static const char * const mt7988_int_usxgmii_groups[] = {
+	"int_usxgmii",
+};
+static const char * const mt7988_pwm_groups[] = {
+	"pwm0", "pwm1", "pwm2", "pwm3", "pwm4",	"pwm5",	"pwm6", "pwm7"
+};
+static const char * const mt7988_dfd_groups[] = {
+	"dfd",
+};
+static const char * const mt7988_i2c_groups[] = {
+	"xfi_phy0_i2c0",
+	"xfi_phy1_i2c0",
+	"xfi_phy_pll_i2c0",
+	"xfi_phy_pll_i2c1",
+	"i2c0_0",
+	"i2c1_sfp",
+	"xfi_pextp_phy0_i2c",
+	"xfi_pextp_phy1_i2c",
+	"i2c0_1",
+	"u30_phy_i2c0",
+	"u32_phy_i2c0",
+	"xfi_phy0_i2c1",
+	"xfi_phy1_i2c1",
+	"xfi_phy_pll_i2c2",
+	"i2c1_0",
+	"u30_phy_i2c1",
+	"u32_phy_i2c1",
+	"xfi_phy_pll_i2c3",
+	"sgmii0_i2c",
+	"sgmii1_i2c",
+	"i2c1_2",
+	"i2c2_0",
+	"i2c2_1",
+};
+static const char * const mt7988_ethernet_groups[] = {
+	"mdc_mdio0",
+	"2p5g_ext_mdio",
+	"gbe_ext_mdio",
+	"mdc_mdio1",
+};
+static const char * const mt7988_pcie_groups[] = {
+	"pcie_wake_n0_0",    "pcie_clk_req_n0_0", "pcie_wake_n3_0",
+	"pcie_clk_req_n3",   "pcie_p0_phy_i2c",	  "pcie_p1_phy_i2c",
+	"pcie_p3_phy_i2c",   "pcie_p2_phy_i2c",	  "ckm_phy_i2c",
+	"pcie_wake_n0_1",    "pcie_wake_n3_1",	  "pcie_2l_0_pereset",
+	"pcie_1l_1_pereset", "pcie_clk_req_n2_1", "pcie_2l_1_pereset",
+	"pcie_1l_0_pereset", "pcie_wake_n1_0",	  "pcie_clk_req_n1",
+	"pcie_wake_n2_0",    "pcie_clk_req_n2_0", "pcie_wake_n2_1",
+	"pcie_clk_req_n0_1"
+};
+static const char * const mt7988_pmic_groups[] = {
+	"pmic",
+};
+static const char * const mt7988_wdt_groups[] = {
+	"watchdog",
+};
+static const char * const mt7988_spi_groups[] = {
+	"spi0", "spi0_wp_hold", "spi1", "spi2", "spi2_wp_hold",
+};
+static const char * const mt7988_flash_groups[] = { "emmc_45", "sdcard", "snfi",
+						    "emmc_51" };
+static const char * const mt7988_uart_groups[] = {
+	"uart2",
+	"tops_uart0_0",
+	"uart2_0",
+	"uart1_0",
+	"uart2_1",
+	"net_wo0_uart_txd_0",
+	"net_wo1_uart_txd_0",
+	"net_wo2_uart_txd_0",
+	"tops_uart1_0",
+	"ops_uart0_1",
+	"ops_uart1_1",
+	"uart0",
+	"tops_uart0_2",
+	"uart1_1",
+	"uart2_3",
+	"uart1_2",
+	"uart1_2_lite",
+	"tops_uart1_2",
+	"net_wo0_uart_txd_1",
+	"net_wo1_uart_txd_1",
+	"net_wo2_uart_txd_1",
+};
+static const char * const mt7988_udi_groups[] = {
+	"udi",
+};
+static const char * const mt7988_audio_groups[] = {
+	"i2s", "pcm",
+};
+static const char * const mt7988_led_groups[] = {
+	"gbe0_led1", "gbe1_led1", "gbe2_led1", "gbe3_led1", "2p5gbe_led1",
+	"gbe0_led0", "gbe1_led0", "gbe2_led0", "gbe3_led0", "2p5gbe_led0",
+	"wf5g_led0",   "wf5g_led1",
+};
+static const char * const mt7988_usb_groups[] = {
+	"drv_vbus",
+	"drv_vbus_p1",
+};
+
+static const struct function_desc mt7988_functions[] = {
+	PINCTRL_PIN_FUNCTION("audio", mt7988_audio),
+	PINCTRL_PIN_FUNCTION("jtag", mt7988_jtag),
+	PINCTRL_PIN_FUNCTION("int_usxgmii", mt7988_int_usxgmii),
+	PINCTRL_PIN_FUNCTION("pwm", mt7988_pwm),
+	PINCTRL_PIN_FUNCTION("dfd", mt7988_dfd),
+	PINCTRL_PIN_FUNCTION("i2c", mt7988_i2c),
+	PINCTRL_PIN_FUNCTION("eth", mt7988_ethernet),
+	PINCTRL_PIN_FUNCTION("pcie", mt7988_pcie),
+	PINCTRL_PIN_FUNCTION("pmic", mt7988_pmic),
+	PINCTRL_PIN_FUNCTION("watchdog", mt7988_wdt),
+	PINCTRL_PIN_FUNCTION("spi", mt7988_spi),
+	PINCTRL_PIN_FUNCTION("flash", mt7988_flash),
+	PINCTRL_PIN_FUNCTION("uart", mt7988_uart),
+	PINCTRL_PIN_FUNCTION("udi", mt7988_udi),
+	PINCTRL_PIN_FUNCTION("usb", mt7988_usb),
+	PINCTRL_PIN_FUNCTION("led", mt7988_led),
+};
+
+static const struct mtk_eint_hw mt7988_eint_hw = {
+	.port_mask = 7,
+	.ports = 7,
+	.ap_num = ARRAY_SIZE(mt7988_pins),
+	.db_cnt = 16,
+};
+
+static const char * const mt7988_pinctrl_register_base_names[] = {
+	"gpio_base",	 "iocfg_tr_base", "iocfg_br_base",
+	"iocfg_rb_base", "iocfg_lb_base", "iocfg_tl_base",
+};
+
+static struct mtk_pin_soc mt7988_data = {
+	.reg_cal = mt7988_reg_cals,
+	.pins = mt7988_pins,
+	.npins = ARRAY_SIZE(mt7988_pins),
+	.grps = mt7988_groups,
+	.ngrps = ARRAY_SIZE(mt7988_groups),
+	.funcs = mt7988_functions,
+	.nfuncs = ARRAY_SIZE(mt7988_functions),
+	.eint_hw = &mt7988_eint_hw,
+	.gpio_m = 0,
+	.ies_present = false,
+	.base_names = mt7988_pinctrl_register_base_names,
+	.nbase_names = ARRAY_SIZE(mt7988_pinctrl_register_base_names),
+	.bias_disable_set = mtk_pinconf_bias_disable_set,
+	.bias_disable_get = mtk_pinconf_bias_disable_get,
+	.bias_set = mtk_pinconf_bias_set,
+	.bias_get = mtk_pinconf_bias_get,
+	.pull_type = mt7988_pull_type,
+	.bias_set_combo = mtk_pinconf_bias_set_combo,
+	.bias_get_combo = mtk_pinconf_bias_get_combo,
+	.drive_set = mtk_pinconf_drive_set_rev1,
+	.drive_get = mtk_pinconf_drive_get_rev1,
+	.adv_pull_get = mtk_pinconf_adv_pull_get,
+	.adv_pull_set = mtk_pinconf_adv_pull_set,
+};
+
+static const struct of_device_id mt7988_pinctrl_of_match[] = {
+	{
+		.compatible = "mediatek,mt7988-pinctrl",
+	},
+	{}
+};
+
+static int mt7988_pinctrl_probe(struct platform_device *pdev)
+{
+	return mtk_moore_pinctrl_probe(pdev, &mt7988_data);
+}
+
+static struct platform_driver mt7988_pinctrl_driver = {
+	.driver = {
+		.name = "mt7988-pinctrl",
+		.of_match_table = mt7988_pinctrl_of_match,
+	},
+	.probe = mt7988_pinctrl_probe,
+};
+
+static int __init mt7988_pinctrl_init(void)
+{
+	return platform_driver_register(&mt7988_pinctrl_driver);
+}
+arch_initcall(mt7988_pinctrl_init);
diff --git a/6.12/target/linux/mediatek/filogic/base-files/etc/board.d/01_leds b/6.12/target/linux/mediatek/filogic/base-files/etc/board.d/01_leds
new file mode 100644
index 00000000..3a4aaa30
--- /dev/null
+++ b/6.12/target/linux/mediatek/filogic/base-files/etc/board.d/01_leds
@@ -0,0 +1,41 @@
+. /lib/functions/leds.sh
+. /lib/functions/uci-defaults.sh
+
+board=$(board_name)
+
+board_config_update
+
+case $board in
+cudy,wr3000-v1)
+	ucidef_set_led_netdev "wan" "wan" "blue:wan" "wan"
+	;;
+mercusys,mr90x-v1)
+	ucidef_set_led_netdev "lan0" "lan0" "green:lan0" "lan0" "link tx rx"
+	ucidef_set_led_netdev "lan1" "lan2" "green:lan1" "lan1" "link tx rx"
+	ucidef_set_led_netdev "lan2" "lan2" "green:lan2" "lan2" "link tx rx"
+	ucidef_set_led_netdev "wan" "wan" "green:wan" "eth1" "link tx rx"
+	;;
+netgear,wax220)
+	ucidef_set_led_netdev "eth0" "LAN" "green:lan" "eth0"
+	ucidef_set_led_netdev "wlan2g" "WLAN2G" "blue:wlan2g" "phy0-ap0"
+	ucidef_set_led_netdev "wlan5g" "WLAN5G" "blue:wlan5g" "phy1-ap0"
+	;;
+xiaomi,mi-router-wr30u-112m-nmbm|\
+xiaomi,mi-router-wr30u-stock|\
+xiaomi,mi-router-wr30u-ubootmod)
+	ucidef_set_led_netdev "wan" "wan" "blue:network" "wan"
+	;;
+xiaomi,redmi-router-ax6000-stock|\
+xiaomi,redmi-router-ax6000-ubootmod)
+	ucidef_set_led_netdev "wan" "wan" "rgb:network" "wan"
+	;;
+z8102ax-128m|\
+z8102ax-64m)
+	ucidef_set_led_netdev "modem1" "modem1" "modem1:status" "wwan0"
+	ucidef_set_led_netdev "modem2" "modem2" "modem2:status" "wwan1"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/6.12/target/linux/mediatek/filogic/base-files/etc/board.d/02_network b/6.12/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
new file mode 100644
index 00000000..985b51ac
--- /dev/null
+++ b/6.12/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
@@ -0,0 +1,201 @@
+
+. /lib/functions.sh
+. /lib/functions/uci-defaults.sh
+. /lib/functions/system.sh
+
+mediatek_setup_interfaces()
+{
+	local board="$1"
+
+	case $board in
+	acelink,ew-7886cax)
+		ucidef_set_interface_lan "eth0" "dhcp"
+		;;
+	abt,asr3000|\
+	cmcc,rax3000m|\
+	h3c,magic-nx30-pro|\
+	nokia,ea0326gmp|\
+	zbtlink,zbt-z8103ax)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3" eth1
+		;;
+	acer,predator-w6)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 game" eth1
+		;;
+	asus,rt-ax59u|\
+	cetron,ct3003|\
+	confiabits,mt7981|\
+	cudy,wr3000-v1|\
+	jcg,q30-pro|\
+	qihoo,360t7|\
+	routerich,ax3000)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3" wan
+		;;
+	asus,tuf-ax4200|\
+	jdcloud,re-cp-03|\
+	mediatek,mt7981-rfb|\
+	netcore,n60|\
+	ruijie,rg-x60-pro|\
+	unielec,u7981-01*|\
+	zbtlink,zbt-z8102ax|\
+	z8102ax-128m|\
+	z8102ax-64m)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" eth1
+		;;
+	asus,tuf-ax6000)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4 lan5" eth1
+		;;
+	bananapi,bpi-r3)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4 sfp2" "eth1 wan"
+		;;
+	bananapi,bpi-r3-mini|\
+	edgecore,eap111)
+		ucidef_set_interfaces_lan_wan eth0 eth1
+		;;
+	bananapi,bpi-r4|\
+	bananapi,bpi-r4-poe)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 eth1" "wan eth2"
+		;;
+	comfast,cf-e393ax)
+		ucidef_set_interfaces_lan_wan "lan1" eth1
+		;;
+	cudy,m3000-v1|\
+	cudy,tr3000-v1|\
+	glinet,gl-mt2500|\
+	glinet,gl-mt3000|\
+	glinet,gl-x3000|\
+	glinet,gl-xe3000|\
+	openembed,som7981|\
+	openwrt,one)
+		ucidef_set_interfaces_lan_wan eth1 eth0
+		;;
+	dlink,aquila-pro-ai-m30-a1)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" internet
+		;;
+	glinet,gl-mt6000|\
+	tplink,tl-xdr4288|\
+	tplink,tl-xdr6088|\
+	tplink,tl-xtr8488)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4 lan5" eth1
+		;;
+	mediatek,mt7986a-rfb)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4 lan6" "eth1 wan"
+		;;
+	mediatek,mt7986b-rfb)
+		ucidef_set_interfaces_lan_wan "lan0 lan1 lan2 lan3" eth1
+		;;
+	mediatek,mt7988a-rfb)
+		ucidef_set_interfaces_lan_wan "lan0 lan1 lan2 lan3 eth2" eth1
+		;;
+	mercusys,mr90x-v1)
+		ucidef_set_interfaces_lan_wan "lan0 lan1 lan2" eth1
+		;;
+	cudy,ap3000outdoor-v1|\
+	cudy,re3000-v1|\
+	netgear,wax220|\
+	ubnt,unifi-6-plus|\
+	zyxel,nwa50ax-pro)
+		ucidef_set_interface_lan "eth0"
+		;;
+	smartrg,sdg-8622|\
+	smartrg,sdg-8632|\
+	yuncore,ax835)
+		ucidef_set_interfaces_lan_wan lan wan
+		;;
+	tplink,tl-xdr6086|\
+	wavlink,wl-wn586x3)
+		ucidef_set_interfaces_lan_wan "lan1 lan2" eth1
+		;;
+	tplink,re6000xd)
+		ucidef_set_interface_lan "lan1 lan2 eth1"
+		;;
+	xiaomi,mi-router-ax3000t|\
+	xiaomi,mi-router-ax3000t-ubootmod|\
+	xiaomi,mi-router-wr30u-stock|\
+	xiaomi,mi-router-wr30u-ubootmod|\
+	xiaomi,redmi-router-ax6000-stock|\
+	xiaomi,redmi-router-ax6000-ubootmod)
+		ucidef_set_interfaces_lan_wan "lan2 lan3 lan4" wan
+		;;
+	zyxel,ex5601-t0-stock|\
+	zyxel,ex5601-t0-ubootmod)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" eth1
+		;;
+	*)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" wan
+		;;
+	esac
+}
+
+mediatek_setup_macs()
+{
+	local board="$1"
+	local lan_mac=""
+	local wan_mac=""
+	local label_mac=""
+
+	case $board in
+	bananapi,bpi-r3|\
+	bananapi,bpi-r3-mini|\
+	bananapi,bpi-r4)
+		wan_mac=$(macaddr_add $(cat /sys/class/net/eth0/address) 1)
+		;;
+	h3c,magic-nx30-pro)
+		wan_mac=$(mtd_get_mac_ascii pdt_data_1 ethaddr)
+		lan_mac=$(macaddr_add "$wan_mac" 1)
+		label_mac=$wan_mac
+		;;
+	mercusys,mr90x-v1|\
+	tplink,re6000xd)
+		label_mac=$(get_mac_binary "/tmp/tp_data/default-mac" 0)
+		lan_mac=$label_mac
+		;;
+	netgear,wax220)
+		lan_mac=$(mtd_get_mac_ascii u-boot-env mac)
+		label_mac=$lan_mac
+		;;
+	qihoo,360t7)
+		lan_mac=$(mtd_get_mac_ascii factory lanMac)
+		wan_mac=$(macaddr_add "$lan_mac" 1)
+		label_mac=$wan_mac
+		;;
+	ruijie,rg-x60-pro)
+		label_mac=$(mtd_get_mac_ascii product_info ethaddr)
+		wan_mac=$label_mac
+		lan_mac=$(macaddr_add "$label_mac" 1)
+		;;
+	smartrg,sdg-8612|\
+	smartrg,sdg-8614|\
+	smartrg,sdg-8622|\
+	smartrg,sdg-8632|\
+	smartrg,sdg-8733|\
+	smartrg,sdg-8734)
+		label_mac=$(mmc_get_mac_ascii mfginfo MFG_MAC)
+		wan_mac=$label_mac
+		lan_mac=$(macaddr_add "$label_mac" 1)
+		;;
+	xiaomi,mi-router-ax3000t|\
+	xiaomi,mi-router-ax3000t-ubootmod|\
+	xiaomi,mi-router-wr30u-stock|\
+	xiaomi,mi-router-wr30u-ubootmod|\
+	xiaomi,redmi-router-ax6000-stock|\
+	xiaomi,redmi-router-ax6000-ubootmod)
+		wan_mac=$(mtd_get_mac_ascii Bdata ethaddr_wan)
+		label_mac=$wan_mac
+		;;
+	yuncore,ax835)
+		label_mac=$(mtd_get_mac_binary "Factory" 0x4)
+		;;
+	esac
+
+	[ -n "$lan_mac" ] && ucidef_set_interface_macaddr "lan" $lan_mac
+	[ -n "$wan_mac" ] && ucidef_set_interface_macaddr "wan" $wan_mac
+	[ -n "$label_mac" ] && ucidef_set_label_macaddr $label_mac
+}
+
+board_config_update
+board=$(board_name)
+mediatek_setup_interfaces $board
+mediatek_setup_macs $board
+board_config_flush
+
+exit 0
diff --git a/6.12/target/linux/mediatek/filogic/base-files/etc/board.d/03_gpio_switches b/6.12/target/linux/mediatek/filogic/base-files/etc/board.d/03_gpio_switches
new file mode 100644
index 00000000..51f1e4ba
--- /dev/null
+++ b/6.12/target/linux/mediatek/filogic/base-files/etc/board.d/03_gpio_switches
@@ -0,0 +1,27 @@
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+board=$(board_name)
+
+case "$board" in
+zbtlink,zbt-z8102ax)
+	ucidef_add_gpio_switch "5g1" "Power 1st modem" "5g1" "1"
+	ucidef_add_gpio_switch "5g2" "Power 2nd modem" "5g2" "1"
+	ucidef_add_gpio_switch "pcie" "Power PCIe port" "pcie" "1"
+	ucidef_add_gpio_switch "sim1" "SIM 1" "sim1" "0"
+	ucidef_add_gpio_switch "sim2" "SIM 2" "sim2" "0"
+	;;
+z8102ax-64m|\
+z8102ax-128m)
+	ucidef_add_gpio_switch "modem1" "Power 1st modem" "modem1" "1"
+	ucidef_add_gpio_switch "modem2" "Power 2nd modem" "modem2" "1"
+	ucidef_add_gpio_switch "pcie" "Power PCIe port" "pcie" "1"
+	ucidef_add_gpio_switch "sim1" "SIM 1" "sim1" "0"
+	ucidef_add_gpio_switch "sim2" "SIM 2" "sim2" "0"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/6.12/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac b/6.12/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
new file mode 100644
index 00000000..512f5370
--- /dev/null
+++ b/6.12/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
@@ -0,0 +1,133 @@
+[ "$ACTION" == "add" ] || exit 0
+
+PHYNBR=${DEVPATH##*/phy}
+
+[ -n $PHYNBR ] || exit 0
+
+. /lib/functions.sh
+. /lib/functions/system.sh
+
+board=$(board_name)
+
+case "$board" in
+	acer,predator-w6)
+		key_path="/var/qcidata/data"
+		[ "$PHYNBR" = "0" ] && cat $key_path/2gMAC > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && cat $key_path/6gMAC > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "2" ] && cat $key_path/5gMAC > /sys${DEVPATH}/macaddress
+		;;
+	asus,rt-ax59u)
+		CI_UBIPART="UBI_DEV"
+		addr=$(mtd_get_mac_binary_ubi "Factory" 0x4)
+		# Originally, phy1 is phy0 mac with LA and 28th bits set. However, this would conflict
+		# addresses on multiple VIFs with the other radio when bit 28 is already set.
+		# Set LA and 28 bits and increment mac-address instead.
+		[ "$PHYNBR" = "1" ] && \
+			macaddr_setbit_la $(macaddr_setbit $(macaddr_add $addr 1) 28) > \
+			/sys${DEVPATH}/macaddress
+		;;
+	asus,tuf-ax4200|\
+	asus,tuf-ax6000)
+		CI_UBIPART="UBI_DEV"
+		addr=$(mtd_get_mac_binary_ubi "Factory" 0x4)
+		# Originally, phy0 is phy1 mac with LA bit set. However, this would conflict
+		# addresses on multiple VIFs with the other radio. Set LA bit and increment
+		# mac-address instead.
+		[ "$PHYNBR" = "0" ] && macaddr_setbit_la $(macaddr_add $addr 1) > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && echo "$addr" > /sys${DEVPATH}/macaddress
+		;;
+	bananapi,bpi-r3)
+		addr=$(cat /sys/class/net/eth0/address)
+		[ "$PHYNBR" = "0" ] && macaddr_add $addr 2 > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && macaddr_add $addr 3 > /sys${DEVPATH}/macaddress
+		;;
+	cetron,ct3003)
+		addr=$(mtd_get_mac_binary "art" 0)
+		[ "$PHYNBR" = "0" ] && macaddr_add $addr 1 > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && macaddr_setbit_la $(macaddr_add $addr 2) > /sys${DEVPATH}/macaddress
+		;;
+	cmcc,rax3000m)
+		case "$(cmdline_get_var root)" in
+		/dev/mmc*)
+			addr=$(mmc_get_mac_binary factory 0xa)
+			;;
+		*)
+			addr=$(mtd_get_mac_binary factory 0xa)
+			;;
+		esac
+		[ "$PHYNBR" = "1" ] && echo "$addr" > /sys${DEVPATH}/macaddress
+		;;
+	cudy,wr3000-v1)
+		addr=$(mtd_get_mac_binary bdinfo 0xde00)
+		# Originally, phy0 is phy1 mac with LA bit set. However, this would conflict
+		# addresses on multiple VIFs with the other radio. Set LA bit and increment
+		# mac-address instead.
+		[ "$PHYNBR" = "0" ] && echo "$addr" > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && macaddr_setbit_la $(macaddr_add $addr 1) > /sys${DEVPATH}/macaddress
+		;;
+	glinet,gl-mt6000)
+		addr=$(mmc_get_mac_binary factory 0x04)
+		[ "$PHYNBR" = "0" ] && echo "$addr" > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && macaddr_add $addr 1 > /sys${DEVPATH}/macaddress
+		;;
+	h3c,magic-nx30-pro)
+		addr=$(mtd_get_mac_ascii pdt_data_1 ethaddr)
+		[ "$PHYNBR" = "0" ] && macaddr_add $addr 2 > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && macaddr_add $addr 3 > /sys${DEVPATH}/macaddress
+		;;
+	jcg,q30-pro)
+		# Originally, phy1 is phy0 mac with LA bit set. However, this would conflict
+		# addresses on multiple VIFs with the other radio. Use label mac to set LA bit.
+		[ "$PHYNBR" = "1" ] && macaddr_setbit_la $(get_mac_label) > /sys${DEVPATH}/macaddress
+		;;
+	mercusys,mr90x-v1)
+		addr=$(get_mac_binary "/tmp/tp_data/default-mac" 0)
+		[ "$PHYNBR" = "0" ] && echo "$addr" > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && macaddr_add $addr -1 > /sys${DEVPATH}/macaddress
+		;;
+	netgear,wax220)
+		hw_mac_addr=$(mtd_get_mac_ascii u-boot-env mac)
+		[ "$PHYNBR" = "0" ] && macaddr_add $hw_mac_addr 2 > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && macaddr_add $hw_mac_addr 3 > /sys${DEVPATH}/macaddress
+		;;
+	qihoo,360t7)
+		addr=$(mtd_get_mac_ascii factory lanMac)
+		[ "$PHYNBR" = "0" ] && macaddr_add $addr 2 > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && macaddr_add $addr 3 > /sys${DEVPATH}/macaddress
+		;;
+	smartrg,sdg-8612|\
+	smartrg,sdg-8614|\
+	smartrg,sdg-8622|\
+	smartrg,sdg-8632)
+		addr=$(mmc_get_mac_ascii mfginfo MFG_MAC)
+		[ "$PHYNBR" = "0" ] && macaddr_add $addr 2 > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && macaddr_add $addr 3 > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "2" ] && macaddr_add $addr 4 > /sys${DEVPATH}/macaddress
+		;;
+	tplink,tl-xdr4288|\
+	tplink,tl-xdr6086|\
+	tplink,tl-xdr6088)
+		[ "$PHYNBR" = "0" ] && get_mac_label > /sys${DEVPATH}/macaddress
+		;;
+	ubnt,unifi-6-plus)
+		addr=$(mtd_get_mac_binary EEPROM 0x6)
+		[ "$PHYNBR" = "0" ] && echo "$addr" > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && macaddr_add $addr 1 > /sys${DEVPATH}/macaddress
+		;;
+	routerich,ax3000|\
+	zbtlink,zbt-z8102ax|\
+	z8102ax-128m|\
+	z8102ax-64m|\
+	zbtlink,zbt-z8103ax|\
+	zyxel,ex5601-t0|\
+	zyxel,ex5601-t0-ubootmod)
+		addr=$(mtd_get_mac_binary "Factory" 0x4)
+		[ "$PHYNBR" = "0" ] && macaddr_add $addr 1 > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && macaddr_add $addr 2 > /sys${DEVPATH}/macaddress
+		;;
+	zyxel,nwa50ax-pro)
+		hw_mac_addr="$(mtd_get_mac_binary mrd 0x1fff8)"
+		[ "$PHYNBR" = "0" ] && macaddr_add $hw_mac_addr 1 > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && macaddr_add $hw_mac_addr 2 > /sys${DEVPATH}/macaddress
+		;;
+esac
diff --git a/6.6/target/linux/mediatek/filogic/config-6.6 b/6.12/target/linux/mediatek/filogic/config-6.12
similarity index 88%
rename from 6.6/target/linux/mediatek/filogic/config-6.6
rename to 6.12/target/linux/mediatek/filogic/config-6.12
index b5a81548..0f4a7b75 100644
--- a/6.6/target/linux/mediatek/filogic/config-6.6
+++ b/6.12/target/linux/mediatek/filogic/config-6.12
@@ -1,18 +1,18 @@
 CONFIG_64BIT=y
 # CONFIG_AHCI_MTK is not set
-CONFIG_AQUANTIA_PHY=y
+CONFIG_AIROHA_EN8801SC_PHY=y
 CONFIG_ARCH_BINFMT_ELF_EXTRA_PHDRS=y
 CONFIG_ARCH_CORRECT_STACKTRACE_ON_KRETPROBE=y
+CONFIG_ARCH_DEFAULT_KEXEC_IMAGE_VERIFY_SIG=y
 CONFIG_ARCH_DMA_ADDR_T_64BIT=y
+CONFIG_ARCH_FORCE_MAX_ORDER=10
 CONFIG_ARCH_KEEP_MEMBLOCK=y
-# CONFIG_ARCH_MA35 is not set
 CONFIG_ARCH_MEDIATEK=y
 CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
 CONFIG_ARCH_MMAP_RND_BITS=18
 CONFIG_ARCH_MMAP_RND_BITS_MAX=24
 CONFIG_ARCH_MMAP_RND_BITS_MIN=18
 CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=11
-CONFIG_ARCH_NR_GPIO=0
 CONFIG_ARCH_PROC_KCORE_TEXT=y
 CONFIG_ARCH_SPARSEMEM_ENABLE=y
 CONFIG_ARCH_STACKWALK=y
@@ -22,8 +22,6 @@ CONFIG_ARCH_WANTS_THP_SWAP=y
 CONFIG_ARM64=y
 CONFIG_ARM64_4K_PAGES=y
 CONFIG_ARM64_ERRATUM_843419=y
-# CONFIG_ARM64_ERRATUM_2645198 is not set
-# CONFIG_ARM64_ERRATUM_2966298 is not set
 CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
 CONFIG_ARM64_PAGE_SHIFT=12
 CONFIG_ARM64_PA_BITS=48
@@ -34,6 +32,7 @@ CONFIG_ARM64_VA_BITS_39=y
 CONFIG_ARM_AMBA=y
 CONFIG_ARM_ARCH_TIMER=y
 CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
+# CONFIG_ARM_CORESIGHT_PMU_ARCH_SYSTEM_PMU is not set
 CONFIG_ARM_GIC=y
 CONFIG_ARM_GIC_V2M=y
 CONFIG_ARM_GIC_V3=y
@@ -41,26 +40,27 @@ CONFIG_ARM_GIC_V3_ITS=y
 CONFIG_ARM_GIC_V3_ITS_PCI=y
 CONFIG_ARM_MEDIATEK_CPUFREQ=y
 CONFIG_ARM_PMU=y
+CONFIG_ARM_PMUV3=y
 CONFIG_ARM_PSCI_FW=y
+# CONFIG_ARM_SMMU_V3_PMU is not set
 CONFIG_ATA=y
 CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_BLK_MQ_PCI=y
 CONFIG_BLK_PM=y
+CONFIG_BLOCK_NOTIFIERS=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_BSD_PROCESS_ACCT_V3=y
-# CONFIG_BT_NXPUART is not set
+CONFIG_BUFFER_HEAD=y
+CONFIG_BUILTIN_RETURN_ADDRESS_STRIPS_PAC=y
 CONFIG_CC_HAVE_SHADOW_CALL_STACK=y
 CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLKSRC_MMIO=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_CMDLINE_OVERRIDE=y
 CONFIG_COMMON_CLK=y
 CONFIG_COMMON_CLK_MEDIATEK=y
-CONFIG_COMMON_CLK_MEDIATEK_FHCTL=y
 # CONFIG_COMMON_CLK_MT2712 is not set
 # CONFIG_COMMON_CLK_MT6779 is not set
 # CONFIG_COMMON_CLK_MT6795 is not set
@@ -74,19 +74,15 @@ CONFIG_COMMON_CLK_MT7988=y
 # CONFIG_COMMON_CLK_MT8173 is not set
 # CONFIG_COMMON_CLK_MT8183 is not set
 # CONFIG_COMMON_CLK_MT8186 is not set
-# CONFIG_COMMON_CLK_MT8188 is not set
 # CONFIG_COMMON_CLK_MT8195 is not set
 # CONFIG_COMMON_CLK_MT8365 is not set
 # CONFIG_COMMON_CLK_MT8516 is not set
-# CONFIG_COMMON_CLK_RK808 is not set
 CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
 # CONFIG_COMPAT_32BIT_TIME is not set
 CONFIG_CONFIGFS_FS=y
 CONFIG_CONSOLE_LOGLEVEL_DEFAULT=15
 CONFIG_CONTEXT_TRACKING=y
 CONFIG_CONTEXT_TRACKING_IDLE=y
-# CONFIG_CPUFREQ_DT is not set
-# CONFIG_CPUFREQ_DT_PLATDEV is not set
 CONFIG_CPU_FREQ=y
 # CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
 CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE=y
@@ -103,6 +99,7 @@ CONFIG_CPU_LITTLE_ENDIAN=y
 CONFIG_CPU_RMAP=y
 CONFIG_CPU_THERMAL=y
 CONFIG_CRC16=y
+CONFIG_CRC_CCITT=y
 CONFIG_CRYPTO_AES_ARM64=y
 CONFIG_CRYPTO_AES_ARM64_CE=y
 CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
@@ -123,6 +120,7 @@ CONFIG_CRYPTO_HASH_INFO=y
 CONFIG_CRYPTO_HMAC=y
 CONFIG_CRYPTO_JITTERENTROPY=y
 CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_GF128MUL=y
 CONFIG_CRYPTO_LIB_SHA1=y
 CONFIG_CRYPTO_LIB_SHA256=y
 CONFIG_CRYPTO_LIB_UTILS=y
@@ -135,6 +133,10 @@ CONFIG_CRYPTO_SHA256_ARM64=y
 CONFIG_CRYPTO_SHA2_ARM64_CE=y
 CONFIG_CRYPTO_SHA3=y
 CONFIG_CRYPTO_SHA512=y
+CONFIG_CRYPTO_SM4=y
+CONFIG_CRYPTO_SM4_ARM64_CE_BLK=y
+CONFIG_CRYPTO_SM4_ARM64_CE_CCM=y
+CONFIG_CRYPTO_SM4_ARM64_CE_GCM=y
 CONFIG_CRYPTO_ZSTD=y
 CONFIG_DCACHE_WORD_ACCESS=y
 CONFIG_DEBUG_INFO=y
@@ -142,6 +144,7 @@ CONFIG_DEBUG_MISC=y
 CONFIG_DIMLIB=y
 CONFIG_DMADEVICES=y
 CONFIG_DMATEST=y
+CONFIG_DMA_BOUNCE_UNALIGNED_KMALLOC=y
 CONFIG_DMA_DIRECT_REMAP=y
 CONFIG_DMA_ENGINE=y
 CONFIG_DMA_ENGINE_RAID=y
@@ -153,17 +156,18 @@ CONFIG_EINT_MTK=y
 CONFIG_EXCLUSIVE_SYSTEM_RAM=y
 CONFIG_EXT4_FS=y
 CONFIG_F2FS_FS=y
-CONFIG_FIT_PARTITION=y
 CONFIG_FIXED_PHY=y
 CONFIG_FIX_EARLYCON_MEM=y
 CONFIG_FRAME_POINTER=y
 CONFIG_FS_IOMAP=y
 CONFIG_FS_MBCACHE=y
+CONFIG_FUNCTION_ALIGNMENT=4
+CONFIG_FUNCTION_ALIGNMENT_4B=y
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC11_NO_ARRAY_BOUNDS=y
-CONFIG_GCC_SUPPORTS_DYNAMIC_FTRACE_WITH_REGS=y
+CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y
+CONFIG_GCC_SUPPORTS_DYNAMIC_FTRACE_WITH_ARGS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ARCH_TOPOLOGY=y
 CONFIG_GENERIC_BUG=y
@@ -182,7 +186,6 @@ CONFIG_GENERIC_IRQ_SHOW=y
 CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
 CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y
 CONFIG_GENERIC_MSI_IRQ=y
-CONFIG_GENERIC_MSI_IRQ_DOMAIN=y
 CONFIG_GENERIC_PCI_IOMAP=y
 CONFIG_GENERIC_PHY=y
 CONFIG_GENERIC_PINCONF=y
@@ -195,11 +198,13 @@ CONFIG_GENERIC_STRNLEN_USER=y
 CONFIG_GENERIC_TIME_VSYSCALL=y
 CONFIG_GLOB=y
 CONFIG_GPIO_CDEV=y
-CONFIG_GPIO_HISI=y
+CONFIG_GPIO_WATCHDOG=y
+CONFIG_GPIO_WATCHDOG_ARCH_INITCALL=y
 CONFIG_GRO_CELLS=y
 CONFIG_HARDIRQS_SW_RESEND=y
 CONFIG_HAS_DMA=y
 CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT=y
 CONFIG_HAS_IOPORT_MAP=y
 CONFIG_HWMON=y
 CONFIG_HW_RANDOM=y
@@ -207,12 +212,10 @@ CONFIG_HW_RANDOM_MTK=y
 CONFIG_I2C=y
 CONFIG_I2C_BOARDINFO=y
 CONFIG_I2C_CHARDEV=y
-# CONFIG_I2C_HISI is not set
 CONFIG_I2C_MT65XX=y
 CONFIG_ICPLUS_PHY=y
 CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
 CONFIG_INITRAMFS_SOURCE=""
-# CONFIG_INPUT_RK805_PWRKEY is not set
 CONFIG_IRQCHIP=y
 CONFIG_IRQ_DOMAIN=y
 CONFIG_IRQ_DOMAIN_HIERARCHY=y
@@ -221,7 +224,9 @@ CONFIG_IRQ_TIME_ACCOUNTING=y
 CONFIG_IRQ_WORK=y
 CONFIG_JBD2=y
 CONFIG_JUMP_LABEL=y
-# CONFIG_KEYBOARD_MT6779 is not set
+CONFIG_LEDS_PWM=y
+CONFIG_LEDS_SMARTRG_LED=y
+CONFIG_LEDS_TRIGGER_PATTERN=y
 CONFIG_LIBFDT=y
 CONFIG_LOCK_DEBUGGING_SUPPORT=y
 CONFIG_LOCK_SPIN_ON_OWNER=y
@@ -232,20 +237,19 @@ CONFIG_MAXLINEAR_GPHY=y
 CONFIG_MDIO_BUS=y
 CONFIG_MDIO_DEVICE=y
 CONFIG_MDIO_DEVRES=y
-CONFIG_MEDIATEK_2P5G_PHY=y
+CONFIG_MEDIATEK_2P5GE_PHY=y
 CONFIG_MEDIATEK_GE_PHY=y
 CONFIG_MEDIATEK_GE_SOC_PHY=y
 CONFIG_MEDIATEK_WATCHDOG=y
-CONFIG_MEMFD_CREATE=y
 CONFIG_MESSAGE_LOGLEVEL_DEFAULT=7
 CONFIG_MFD_SYSCON=y
-CONFIG_MFD_RK8XX_I2C=y
-CONFIG_MFD_RK8XX_SPI=y
 CONFIG_MIGRATION=y
+# CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY is not set
 CONFIG_MMC=y
 CONFIG_MMC_BLOCK=y
 CONFIG_MMC_CQHCI=y
 CONFIG_MMC_MTK=y
+CONFIG_MMU_LAZY_TLB_REFCOUNT=y
 CONFIG_MODULES_TREE_LOOKUP=y
 CONFIG_MODULES_USE_ELF_RELA=y
 CONFIG_MTD_NAND_CORE=y
@@ -264,14 +268,18 @@ CONFIG_MTD_UBI=y
 CONFIG_MTD_UBI_BEB_LIMIT=20
 CONFIG_MTD_UBI_BLOCK=y
 CONFIG_MTD_UBI_FASTMAP=y
+CONFIG_MTD_UBI_NVMEM=y
 CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_MTD_VIRT_CONCAT=y
 # CONFIG_MTK_CMDQ is not set
+CONFIG_MTK_CPUX_TIMER=y
 # CONFIG_MTK_CQDMA is not set
 CONFIG_MTK_HSDMA=y
 CONFIG_MTK_INFRACFG=y
 CONFIG_MTK_LVTS_THERMAL=y
-# CONFIG_MTK_LVTS_THERMAL_DEBUGFS is not set
+CONFIG_MTK_LVTS_THERMAL_DEBUGFS=y
 CONFIG_MTK_PMIC_WRAP=y
+CONFIG_MTK_REGULATOR_COUPLER=y
 CONFIG_MTK_SCPSYS=y
 CONFIG_MTK_SCPSYS_PM_DOMAINS=y
 CONFIG_MTK_SOC_THERMAL=y
@@ -284,24 +292,27 @@ CONFIG_NEED_DMA_MAP_STATE=y
 CONFIG_NEED_SG_DMA_LENGTH=y
 CONFIG_NET_DEVLINK=y
 CONFIG_NET_DSA=y
-# CONFIG_NET_DSA_MSCC_OCELOT_EXT is not set
 CONFIG_NET_DSA_MT7530=y
 CONFIG_NET_DSA_MT7530_MDIO=y
 CONFIG_NET_DSA_MT7530_MMIO=y
 CONFIG_NET_DSA_TAG_MTK=y
-CONFIG_NET_DSA_TAG_NONE=y
+CONFIG_NET_EGRESS=y
 CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_INGRESS=y
 CONFIG_NET_MEDIATEK_SOC=y
-CONFIG_NET_MEDIATEK_SOC_USXGMII=y
 CONFIG_NET_MEDIATEK_SOC_WED=y
 CONFIG_NET_SELFTESTS=y
 CONFIG_NET_SWITCHDEV=y
 CONFIG_NET_VENDOR_MEDIATEK=y
+CONFIG_NET_XGRESS=y
 CONFIG_NLS=y
 CONFIG_NO_HZ_COMMON=y
 CONFIG_NO_HZ_IDLE=y
 CONFIG_NR_CPUS=4
 CONFIG_NVMEM=y
+CONFIG_NVMEM_BLOCK=y
+CONFIG_NVMEM_LAYOUTS=y
+CONFIG_NVMEM_LAYOUT_ADTRAN=y
 CONFIG_NVMEM_MTK_EFUSE=y
 CONFIG_NVMEM_SYSFS=y
 CONFIG_OF=y
@@ -320,6 +331,7 @@ CONFIG_PAGE_POOL=y
 CONFIG_PAGE_POOL_STATS=y
 CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
 CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
+CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y
 CONFIG_PARTITION_PERCPU=y
 CONFIG_PCI=y
 CONFIG_PCIEAER=y
@@ -335,11 +347,11 @@ CONFIG_PCIE_PME=y
 CONFIG_PCI_DEBUG=y
 CONFIG_PCI_DOMAINS=y
 CONFIG_PCI_DOMAINS_GENERIC=y
-# CONFIG_PCI_DYNAMIC_OF_NODES is not set
 CONFIG_PCI_MSI=y
-CONFIG_PCI_MSI_IRQ_DOMAIN=y
 CONFIG_PCS_MTK_LYNXI=y
+CONFIG_PCS_MTK_USXGMII=y
 CONFIG_PERF_EVENTS=y
+CONFIG_PER_VMA_LOCK=y
 CONFIG_PGTABLE_LEVELS=3
 CONFIG_PHYLIB=y
 CONFIG_PHYLIB_LEDS=y
@@ -349,6 +361,7 @@ CONFIG_PHYS_ADDR_T_64BIT=y
 # CONFIG_PHY_MTK_PCIE is not set
 CONFIG_PHY_MTK_TPHY=y
 # CONFIG_PHY_MTK_UFS is not set
+CONFIG_PHY_MTK_XFI_TPHY=y
 CONFIG_PHY_MTK_XSPHY=y
 CONFIG_PINCTRL=y
 # CONFIG_PINCTRL_MT2712 is not set
@@ -366,7 +379,6 @@ CONFIG_PINCTRL_MT7988=y
 # CONFIG_PINCTRL_MT8516 is not set
 CONFIG_PINCTRL_MTK_MOORE=y
 CONFIG_PINCTRL_MTK_V2=y
-# CONFIG_PINCTRL_RK805 is not set
 # CONFIG_PINCTRL_SINGLE is not set
 CONFIG_PM=y
 CONFIG_PM_CLK=y
@@ -382,10 +394,7 @@ CONFIG_PREEMPT_NONE_BUILD=y
 CONFIG_PRINTK_TIME=y
 CONFIG_PSTORE=y
 CONFIG_PSTORE_COMPRESS=y
-CONFIG_PSTORE_COMPRESS_DEFAULT="deflate"
 CONFIG_PSTORE_CONSOLE=y
-CONFIG_PSTORE_DEFLATE_COMPRESS=y
-CONFIG_PSTORE_DEFLATE_COMPRESS_DEFAULT=y
 CONFIG_PSTORE_PMSG=y
 CONFIG_PSTORE_RAM=y
 CONFIG_PTP_1588_CLOCK_OPTIONAL=y
@@ -409,18 +418,16 @@ CONFIG_REGMAP_MMIO=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
 CONFIG_REGULATOR_MT6380=y
-# CONFIG_REGULATOR_RK808 is not set
 CONFIG_REGULATOR_RT5190A=y
 CONFIG_RESET_CONTROLLER=y
 CONFIG_RESET_TI_SYSCON=y
 CONFIG_RFS_ACCEL=y
-# CONFIG_ROCKCHIP_ERRATUM_3588001 is not set
 CONFIG_RODATA_FULL_DEFAULT_ENABLED=y
 CONFIG_RPS=y
 CONFIG_RTC_CLASS=y
-# CONFIG_RTC_DRV_RK808 is not set
 CONFIG_RTC_DRV_MT7622=y
 CONFIG_RTC_I2C_AND_SPI=y
+CONFIG_RTL8261N_PHY=y
 # CONFIG_RTL8367S_GSW is not set
 CONFIG_RWSEM_SPIN_ON_OWNER=y
 CONFIG_SCHED_MC=y
@@ -433,13 +440,11 @@ CONFIG_SERIAL_8250_NR_UARTS=3
 CONFIG_SERIAL_8250_RUNTIME_UARTS=3
 CONFIG_SERIAL_DEV_BUS=y
 CONFIG_SERIAL_DEV_CTRL_TTYPORT=y
-# CONFIG_SERIAL_EARLYCON_SEMIHOST is not set
 CONFIG_SERIAL_MCTRL_GPIO=y
 CONFIG_SERIAL_OF_PLATFORM=y
 CONFIG_SGL_ALLOC=y
 CONFIG_SG_POOL=y
 CONFIG_SMP=y
-# CONFIG_SPI_SN_F_OSPI is not set
 CONFIG_SOCK_RX_QUEUE_MAPPING=y
 CONFIG_SOFTIRQ_ON_OWN_STACK=y
 CONFIG_SPARSEMEM=y
@@ -454,9 +459,7 @@ CONFIG_SPI_MEM=y
 CONFIG_SPI_MT65XX=y
 # CONFIG_SPI_MTK_NOR is not set
 CONFIG_SPI_MTK_SNFI=y
-# CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU is not set
-CONFIG_SQUASHFS_DECOMP_SINGLE=y
-CONFIG_SRCU=y
+CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU=y
 CONFIG_SWIOTLB=y
 CONFIG_SWPHY=y
 CONFIG_SYSCTL_EXCEPTION_TRACE=y
@@ -479,6 +482,7 @@ CONFIG_TREE_RCU=y
 CONFIG_TREE_SRCU=y
 CONFIG_UBIFS_FS=y
 # CONFIG_UCLAMP_TASK is not set
+CONFIG_UIMAGE_FIT_BLK=y
 # CONFIG_UNMAP_KERNEL_AT_EL0 is not set
 CONFIG_USB_SUPPORT=y
 CONFIG_VMAP_STACK=y
@@ -497,5 +501,5 @@ CONFIG_ZONE_DMA32=y
 CONFIG_ZSTD_COMMON=y
 CONFIG_ZSTD_COMPRESS=y
 CONFIG_ZSTD_DECOMPRESS=y
-# CONFIG_MTD_SPLIT_SEIL_FW is not set
-CONFIG_MEDIATEK_2P5GE_PHY=y
+CONFIG_ARM64_PLATFORM_DEVICES=y
+CONFIG_MTK_SOCINFO=y
diff --git a/6.12/target/linux/mediatek/filogic/target.mk b/6.12/target/linux/mediatek/filogic/target.mk
new file mode 100644
index 00000000..9198eb0a
--- /dev/null
+++ b/6.12/target/linux/mediatek/filogic/target.mk
@@ -0,0 +1,11 @@
+ARCH:=aarch64
+SUBTARGET:=filogic
+BOARDNAME:=Filogic 8x0 (MT798x)
+CPU_TYPE:=cortex-a53
+DEFAULT_PACKAGES += kmod-phy-aquantia kmod-crypto-hw-safexcel wpad-basic-mbedtls uboot-envtools
+KERNELNAME:=Image dtbs
+DEFAULT_PROFILE:=openwrt_one
+
+define Target/Description
+	Build firmware images for MediaTek Filogic ARM based boards.
+endef
diff --git a/6.12/target/linux/mediatek/image/filogic.mk b/6.12/target/linux/mediatek/image/filogic.mk
new file mode 100644
index 00000000..ee1afcdf
--- /dev/null
+++ b/6.12/target/linux/mediatek/image/filogic.mk
@@ -0,0 +1,1582 @@
+DTS_DIR := $(DTS_DIR)/mediatek
+
+define Image/Prepare
+	# For UBI we want only one extra block
+	rm -f $(KDIR)/ubi_mark
+	echo -ne '\xde\xad\xc0\xde' > $(KDIR)/ubi_mark
+endef
+
+define Build/mt7981-bl2
+	cat $(STAGING_DIR_IMAGE)/mt7981-$1-bl2.img >> $@
+endef
+
+define Build/mt7981-bl31-uboot
+	cat $(STAGING_DIR_IMAGE)/mt7981_$1-u-boot.fip >> $@
+endef
+
+define Build/mt7986-bl2
+	cat $(STAGING_DIR_IMAGE)/mt7986-$1-bl2.img >> $@
+endef
+
+define Build/mt7986-bl31-uboot
+	cat $(STAGING_DIR_IMAGE)/mt7986_$1-u-boot.fip >> $@
+endef
+
+define Build/mt7988-bl2
+	cat $(STAGING_DIR_IMAGE)/mt7988-$1-bl2.img >> $@
+endef
+
+define Build/mt7988-bl31-uboot
+	cat $(STAGING_DIR_IMAGE)/mt7988_$1-u-boot.fip >> $@
+endef
+
+define Build/mt798x-gpt
+	cp $@ $@.tmp 2>/dev/null || true
+	ptgen -g -o $@.tmp -a 1 -l 1024 \
+		$(if $(findstring sdmmc,$1), \
+			-H \
+			-t 0x83	-N bl2		-r	-p 4079k@17k \
+		) \
+			-t 0x83	-N ubootenv	-r	-p 512k@4M \
+			-t 0x83	-N factory	-r	-p 2M@4608k \
+			-t 0xef	-N fip		-r	-p 4M@6656k \
+				-N recovery	-r	-p 32M@12M \
+		$(if $(findstring sdmmc,$1), \
+				-N install	-r	-p 20M@44M \
+			-t 0x2e -N production		-p $(CONFIG_TARGET_ROOTFS_PARTSIZE)M@64M \
+		) \
+		$(if $(findstring emmc,$1), \
+			-t 0x2e -N production		-p $(CONFIG_TARGET_ROOTFS_PARTSIZE)M@64M \
+		)
+	cat $@.tmp >> $@
+	rm $@.tmp
+endef
+
+metadata_gl_json = \
+	'{ $(if $(IMAGE_METADATA),$(IMAGE_METADATA)$(comma)) \
+		"metadata_version": "1.1", \
+		"compat_version": "$(call json_quote,$(compat_version))", \
+		$(if $(DEVICE_COMPAT_MESSAGE),"compat_message": "$(call json_quote,$(DEVICE_COMPAT_MESSAGE))"$(comma)) \
+		$(if $(filter-out 1.0,$(compat_version)),"new_supported_devices": \
+			[$(call metadata_devices,$(SUPPORTED_DEVICES))]$(comma) \
+			"supported_devices": ["$(call json_quote,$(legacy_supported_message))"]$(comma)) \
+		$(if $(filter 1.0,$(compat_version)),"supported_devices":[$(call metadata_devices,$(SUPPORTED_DEVICES))]$(comma)) \
+		"version": { \
+			"release": "$(call json_quote,$(VERSION_NUMBER))", \
+			"date": "$(shell TZ='Asia/Chongqing' date '+%Y%m%d%H%M%S')", \
+			"dist": "$(call json_quote,$(VERSION_DIST))", \
+			"version": "$(call json_quote,$(VERSION_NUMBER))", \
+			"revision": "$(call json_quote,$(REVISION))", \
+			"target": "$(call json_quote,$(TARGETID))", \
+			"board": "$(call json_quote,$(if $(BOARD_NAME),$(BOARD_NAME),$(DEVICE_NAME)))" \
+		} \
+	}'
+
+define Build/append-gl-metadata
+	$(if $(SUPPORTED_DEVICES),-echo $(call metadata_gl_json,$(SUPPORTED_DEVICES)) | fwtool -I - $@)
+	sha256sum "$@" | cut -d" " -f1 > "$@.sha256sum"
+	[ ! -s "$(BUILD_KEY)" -o ! -s "$(BUILD_KEY).ucert" -o ! -s "$@" ] || { \
+		cp "$(BUILD_KEY).ucert" "$@.ucert" ;\
+		usign -S -m "$@" -s "$(BUILD_KEY)" -x "$@.sig" ;\
+		ucert -A -c "$@.ucert" -x "$@.sig" ;\
+		fwtool -S "$@.ucert" "$@" ;\
+	}
+endef
+
+define Build/append-openwrt-one-eeprom
+	dd if=$(STAGING_DIR_IMAGE)/mt7981_eeprom_mt7976_dbdc.bin >> $@
+endef
+
+define Build/zyxel-nwa-fit-filogic
+	$(TOPDIR)/scripts/mkits-zyxel-fit-filogic.sh \
+		$@.its $@ "80 e1 ff ff ff ff ff ff ff ff"
+	PATH=$(LINUX_DIR)/scripts/dtc:$(PATH) mkimage -f $@.its $@.new
+	@mv $@.new $@
+endef
+
+define Build/cetron-header
+	$(eval magic=$(word 1,$(1)))
+	$(eval model=$(word 2,$(1)))
+	( \
+		dd if=/dev/zero bs=856 count=1 2>/dev/null; \
+		printf "$(model)," | dd bs=128 count=1 conv=sync 2>/dev/null; \
+		md5sum $@ | cut -f1 -d" " | dd bs=32 count=1 2>/dev/null; \
+		printf "$(magic)" | dd bs=4 count=1 conv=sync 2>/dev/null; \
+		cat $@; \
+	) > $@.tmp
+	fw_crc=$$(gzip -c $@.tmp | tail -c 8 | od -An -N4 -tx4 --endian little | tr -d ' \n'); \
+	printf "$$(echo $$fw_crc | sed 's/../\\x&/g')" | cat - $@.tmp > $@
+	rm $@.tmp
+endef
+
+define Device/abt_asr3000
+  DEVICE_VENDOR := ABT
+  DEVICE_MODEL := ASR3000
+  DEVICE_DTS := mt7981b-abt-asr3000
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_IN_UBI := 1
+  UBOOTENV_IN_UBI := 1
+  IMAGES := sysupgrade.itb
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+        fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.itb := append-kernel | \
+        fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | append-metadata
+  ARTIFACTS := preloader.bin bl31-uboot.fip
+  ARTIFACT/preloader.bin := mt7981-bl2 spim-nand-ddr3
+  ARTIFACT/bl31-uboot.fip := mt7981-bl31-uboot abt_asr3000
+endef
+TARGET_DEVICES += abt_asr3000
+
+define Device/acelink_ew-7886cax
+  DEVICE_VENDOR := Acelink
+  DEVICE_MODEL := EW-7886CAX
+  DEVICE_DTS := mt7986a-acelink-ew-7886cax
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 65536k
+  KERNEL_IN_UBI := 1
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-ubi | check-size $$$$(IMAGE_SIZE)
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += acelink_ew-7886cax
+
+define Device/acer_predator-w6
+  DEVICE_VENDOR := Acer
+  DEVICE_MODEL := Predator W6
+  DEVICE_DTS := mt7986a-acer-predator-w6
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTS_LOADADDR := 0x47000000
+  DEVICE_PACKAGES := kmod-usb3 kmod-mt7915e kmod-mt7916-firmware kmod-mt7986-firmware mt7986-wo-firmware e2fsprogs f2fsck mkf2fs
+  IMAGES := sysupgrade.bin
+  KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += acer_predator-w6
+
+define Device/adtran_smartrg
+  DEVICE_VENDOR := Adtran
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := e2fsprogs f2fsck mkf2fs kmod-hwmon-pwmfan
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+
+define Device/smartrg_sdg-8612
+$(call Device/adtran_smartrg)
+  DEVICE_MODEL := SDG-8612
+  DEVICE_DTS := mt7986a-smartrg-SDG-8612
+  DEVICE_PACKAGES += kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware
+endef
+TARGET_DEVICES += smartrg_sdg-8612
+
+define Device/smartrg_sdg-8614
+$(call Device/adtran_smartrg)
+  DEVICE_MODEL := SDG-8614
+  DEVICE_DTS := mt7986a-smartrg-SDG-8614
+  DEVICE_PACKAGES += kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware
+endef
+TARGET_DEVICES += smartrg_sdg-8614
+
+define Device/smartrg_sdg-8622
+$(call Device/adtran_smartrg)
+  DEVICE_MODEL := SDG-8622
+  DEVICE_DTS := mt7986a-smartrg-SDG-8622
+  DEVICE_PACKAGES += kmod-mt7915e kmod-mt7915-firmware kmod-mt7986-firmware mt7986-wo-firmware
+endef
+TARGET_DEVICES += smartrg_sdg-8622
+
+define Device/smartrg_sdg-8632
+$(call Device/adtran_smartrg)
+  DEVICE_MODEL := SDG-8632
+  DEVICE_DTS := mt7986a-smartrg-SDG-8632
+  DEVICE_PACKAGES += kmod-mt7915e kmod-mt7915-firmware kmod-mt7986-firmware mt7986-wo-firmware
+endef
+TARGET_DEVICES += smartrg_sdg-8632
+
+define Device/smartrg_sdg-8733
+$(call Device/adtran_smartrg)
+  DEVICE_MODEL := SDG-8733
+  DEVICE_DTS := mt7988a-smartrg-SDG-8733
+  DEVICE_PACKAGES += kmod-mt7996-firmware kmod-phy-aquantia kmod-usb3 mt7988-wo-firmware
+endef
+TARGET_DEVICES += smartrg_sdg-8733
+
+define Device/smartrg_sdg-8733a
+$(call Device/adtran_smartrg)
+  DEVICE_MODEL := SDG-8733A
+  DEVICE_DTS := mt7988d-smartrg-SDG-8733A
+  DEVICE_PACKAGES += mt7988-2p5g-phy-firmware kmod-mt7996-233-firmware kmod-phy-aquantia mt7988-wo-firmware
+endef
+TARGET_DEVICES += smartrg_sdg-8733a
+
+define Device/smartrg_sdg-8734
+$(call Device/adtran_smartrg)
+  DEVICE_MODEL := SDG-8734
+  DEVICE_DTS := mt7988a-smartrg-SDG-8734
+  DEVICE_PACKAGES += kmod-mt7996-firmware kmod-phy-aquantia kmod-sfp kmod-usb3 mt7988-wo-firmware
+endef
+TARGET_DEVICES += smartrg_sdg-8734
+
+define Device/asus_rt-ax59u
+  DEVICE_VENDOR := ASUS
+  DEVICE_MODEL := RT-AX59U
+  DEVICE_DTS := mt7986a-asus-rt-ax59u
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-usb3 kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += asus_rt-ax59u
+
+define Device/asus_tuf-ax4200
+  DEVICE_VENDOR := ASUS
+  DEVICE_MODEL := TUF-AX4200
+  DEVICE_DTS := mt7986a-asus-tuf-ax4200
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTS_LOADADDR := 0x47000000
+  DEVICE_PACKAGES := kmod-usb3 kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware
+  IMAGES := sysupgrade.bin
+  KERNEL := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += asus_tuf-ax4200
+
+define Device/arcadyan_mozart
+  DEVICE_VENDOR := Arcadyan
+  DEVICE_MODEL := Mozart
+  DEVICE_DTS := mt7988a-arcadyan-mozart
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTC_FLAGS := --pad 4096
+  DEVICE_DTS_LOADADDR := 0x45f00000
+  DEVICE_PACKAGES := kmod-hwmon-pwmfan e2fsprogs f2fsck mkf2fs kmod-mt7996-firmware
+  KERNEL_LOADADDR := 0x46000000
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+        fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  KERNEL_INITRAMFS_SUFFIX := .itb
+  IMAGE_SIZE := $$(shell expr 64 + $$(CONFIG_TARGET_ROOTFS_PARTSIZE))m
+  IMAGES := sysupgrade.itb
+  IMAGE/sysupgrade.itb := append-kernel | fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-with-rootfs | pad-rootfs | append-metadata
+  ARTIFACTS := emmc-preloader.bin emmc-bl31-uboot.fip emmc-gpt.bin
+  ARTIFACT/emmc-gpt.bin := mt798x-gpt emmc
+  ARTIFACT/emmc-preloader.bin	:= mt7988-bl2 emmc-comb
+  ARTIFACT/emmc-bl31-uboot.fip	:= mt7988-bl31-uboot arcadyan_mozart
+  SUPPORTED_DEVICES += arcadyan,mozart
+endef
+TARGET_DEVICES += arcadyan_mozart
+
+define Device/asus_tuf-ax6000
+  DEVICE_VENDOR := ASUS
+  DEVICE_MODEL := TUF-AX6000
+  DEVICE_DTS := mt7986a-asus-tuf-ax6000
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTS_LOADADDR := 0x47000000
+  DEVICE_PACKAGES := kmod-usb3 kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware
+  IMAGES := sysupgrade.bin
+  KERNEL := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += asus_tuf-ax6000
+
+define Device/bananapi_bpi-r3
+  DEVICE_VENDOR := Bananapi
+  DEVICE_MODEL := BPi-R3
+  DEVICE_DTS := mt7986a-bananapi-bpi-r3
+  DEVICE_DTS_CONFIG := config-mt7986a-bananapi-bpi-r3
+  DEVICE_DTS_OVERLAY:= mt7986a-bananapi-bpi-r3-emmc mt7986a-bananapi-bpi-r3-nand \
+		       mt7986a-bananapi-bpi-r3-nor mt7986a-bananapi-bpi-r3-sd \
+		       mt7986a-bananapi-bpi-r3-respeaker-2mics
+  DEVICE_DTS_DIR := $(DTS_DIR)/
+  DEVICE_DTS_LOADADDR := 0x43f00000
+  DEVICE_PACKAGES := kmod-hwmon-pwmfan kmod-thermal kmod-i2c-gpio kmod-mt7915e kmod-mt7986-firmware kmod-sfp kmod-usb3 \
+		     e2fsprogs f2fsck mkf2fs mt7986-wo-firmware
+  IMAGES := sysupgrade.itb
+  KERNEL_LOADADDR := 0x44000000
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  ARTIFACTS := \
+	       emmc-preloader.bin emmc-bl31-uboot.fip \
+	       nor-preloader.bin nor-bl31-uboot.fip \
+	       sdcard.img.gz \
+	       snand-preloader.bin snand-bl31-uboot.fip
+  ARTIFACT/emmc-preloader.bin	:= mt7986-bl2 emmc-ddr4
+  ARTIFACT/emmc-bl31-uboot.fip	:= mt7986-bl31-uboot bananapi_bpi-r3-emmc
+  ARTIFACT/nor-preloader.bin	:= mt7986-bl2 nor-ddr4
+  ARTIFACT/nor-bl31-uboot.fip	:= mt7986-bl31-uboot bananapi_bpi-r3-nor
+  ARTIFACT/snand-preloader.bin	:= mt7986-bl2 spim-nand-ubi-ddr4
+  ARTIFACT/snand-bl31-uboot.fip	:= mt7986-bl31-uboot bananapi_bpi-r3-snand
+  ARTIFACT/sdcard.img.gz	:= mt798x-gpt sdmmc |\
+				   pad-to 17k | mt7986-bl2 sdmmc-ddr4 |\
+				   pad-to 6656k | mt7986-bl31-uboot bananapi_bpi-r3-sdmmc |\
+				$(if $(CONFIG_TARGET_ROOTFS_INITRAMFS),\
+				   pad-to 12M | append-image-stage initramfs-recovery.itb | check-size 44m |\
+				) \
+				   pad-to 44M | mt7986-bl2 spim-nand-ubi-ddr4 |\
+				   pad-to 45M | mt7986-bl31-uboot bananapi_bpi-r3-snand |\
+				   pad-to 49M | mt7986-bl2 nor-ddr4 |\
+				   pad-to 50M | mt7986-bl31-uboot bananapi_bpi-r3-nor |\
+				   pad-to 51M | mt7986-bl2 emmc-ddr4 |\
+				   pad-to 52M | mt7986-bl31-uboot bananapi_bpi-r3-emmc |\
+				   pad-to 56M | mt798x-gpt emmc |\
+				$(if $(CONFIG_TARGET_ROOTFS_SQUASHFS),\
+				   pad-to 64M | append-image squashfs-sysupgrade.itb |\
+				) \
+				  gzip
+#ifeq ($(DUMP),)
+#  IMAGE_SIZE := $$(shell expr 64 + $$(CONFIG_TARGET_ROOTFS_PARTSIZE))m
+#endif
+  KERNEL			:= kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.itb := append-kernel | fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | pad-rootfs | append-metadata
+  DEVICE_DTC_FLAGS := --pad 4096
+  DEVICE_COMPAT_VERSION := 1.2
+  DEVICE_COMPAT_MESSAGE := SPI-NAND flash layout changes require bootloader update
+endef
+TARGET_DEVICES += bananapi_bpi-r3
+
+define Device/bananapi_bpi-r3-mini
+  DEVICE_VENDOR := Bananapi
+  DEVICE_MODEL := BPi-R3 Mini
+  DEVICE_DTS := mt7986a-bananapi-bpi-r3-mini
+  DEVICE_DTS_CONFIG := config-mt7986a-bananapi-bpi-r3-mini
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTS_LOADADDR := 0x43f00000
+  DEVICE_PACKAGES := kmod-hwmon-pwmfan kmod-thermal kmod-mt7915e kmod-mt7986-firmware kmod-phy-airoha-en8811h \
+		     kmod-usb3 e2fsprogs f2fsck mkf2fs mt7986-wo-firmware
+  KERNEL_LOADADDR := 0x44000000
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+    fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_IN_UBI := 1
+  UBOOTENV_IN_UBI := 1
+  IMAGES := snand-factory.bin sysupgrade.itb
+#ifeq ($(DUMP),)
+#  IMAGE_SIZE := $$(shell expr 64 + $$(CONFIG_TARGET_ROOTFS_PARTSIZE))m
+#endif
+  IMAGE/sysupgrade.itb := append-kernel | \
+    fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | \
+    pad-rootfs | append-metadata
+  ARTIFACTS := \
+       emmc-gpt.bin emmc-preloader.bin emmc-bl31-uboot.fip \
+       snand-factory.bin snand-preloader.bin snand-bl31-uboot.fip
+  ARTIFACT/emmc-gpt.bin := mt798x-gpt emmc
+  ARTIFACT/emmc-preloader.bin := mt7986-bl2 emmc-ddr4
+  ARTIFACT/emmc-bl31-uboot.fip := mt7986-bl31-uboot bananapi_bpi-r3-mini-emmc
+  ARTIFACT/snand-factory.bin := mt7986-bl2 spim-nand-ubi-ddr4 | pad-to 256k | \
+				mt7986-bl2 spim-nand-ubi-ddr4 | pad-to 512k | \
+				mt7986-bl2 spim-nand-ubi-ddr4 | pad-to 768k | \
+				mt7986-bl2 spim-nand-ubi-ddr4 | pad-to 2048k | \
+				ubinize-image fit squashfs-sysupgrade.itb
+  ARTIFACT/snand-preloader.bin := mt7986-bl2 spim-nand-ubi-ddr4
+  ARTIFACT/snand-bl31-uboot.fip := mt7986-bl31-uboot bananapi_bpi-r3-mini-snand
+  UBINIZE_PARTS := fip=:$(STAGING_DIR_IMAGE)/mt7986_bananapi_bpi-r3-mini-snand-u-boot.fip
+ifneq ($(CONFIG_PACKAGE_airoha-en8811h-firmware),)
+  UBINIZE_PARTS += en8811h-fw=:$(STAGING_DIR_IMAGE)/EthMD32.bin
+endif
+endef
+TARGET_DEVICES += bananapi_bpi-r3-mini
+
+define Device/bananapi_bpi-r4-common
+  DEVICE_VENDOR := Bananapi
+  DEVICE_DTS_DIR := $(DTS_DIR)/
+  DEVICE_DTS_LOADADDR := 0x45f00000
+  DEVICE_DTS_OVERLAY:= mt7988a-bananapi-bpi-r4-emmc mt7988a-bananapi-bpi-r4-rtc mt7988a-bananapi-bpi-r4-sd mt7988a-bananapi-bpi-r4-wifi-mt7996a
+  DEVICE_DTC_FLAGS := --pad 4096
+  DEVICE_PACKAGES := kmod-hwmon-pwmfan kmod-thermal kmod-i2c-mux-pca954x kmod-eeprom-at24 kmod-mt7996-firmware kmod-mt7996-233-firmware \
+		     kmod-rtc-pcf8563 kmod-sfp kmod-usb3 e2fsprogs f2fsck mkf2fs mt7988-wo-firmware
+  IMAGES := sysupgrade.itb
+  KERNEL_LOADADDR := 0x46000000
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  ARTIFACTS := \
+	       emmc-preloader.bin emmc-bl31-uboot.fip \
+	       sdcard.img.gz \
+	       snand-preloader.bin snand-bl31-uboot.fip
+  ARTIFACT/emmc-preloader.bin	:= mt7988-bl2 emmc-comb
+  ARTIFACT/emmc-bl31-uboot.fip	:= mt7988-bl31-uboot $$(DEVICE_NAME)-emmc
+  ARTIFACT/snand-preloader.bin	:= mt7988-bl2 spim-nand-ubi-comb
+  ARTIFACT/snand-bl31-uboot.fip	:= mt7988-bl31-uboot $$(DEVICE_NAME)-snand
+  ARTIFACT/sdcard.img.gz	:= mt798x-gpt sdmmc |\
+				   pad-to 17k | mt7988-bl2 sdmmc-comb |\
+				   pad-to 6656k | mt7988-bl31-uboot $$(DEVICE_NAME)-sdmmc |\
+				$(if $(CONFIG_TARGET_ROOTFS_INITRAMFS),\
+				   pad-to 12M | append-image-stage initramfs-recovery.itb | check-size 44m |\
+				) \
+				   pad-to 44M | mt7988-bl2 spim-nand-ubi-comb |\
+				   pad-to 45M | mt7988-bl31-uboot $$(DEVICE_NAME)-snand |\
+				   pad-to 51M | mt7988-bl2 emmc-comb |\
+				   pad-to 52M | mt7988-bl31-uboot $$(DEVICE_NAME)-emmc |\
+				   pad-to 56M | mt798x-gpt emmc |\
+				$(if $(CONFIG_TARGET_ROOTFS_SQUASHFS),\
+				   pad-to 64M | append-image squashfs-sysupgrade.itb |\
+				) \
+				  gzip
+#  IMAGE_SIZE := $$(shell expr 64 + $$(CONFIG_TARGET_ROOTFS_PARTSIZE))m
+  KERNEL			:= kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.itb := append-kernel | fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-with-rootfs | pad-rootfs | append-metadata
+endef
+
+define Device/bananapi_bpi-r4
+  DEVICE_MODEL := BPi-R4
+  DEVICE_DTS := mt7988a-bananapi-bpi-r4
+  DEVICE_DTS_CONFIG := config-mt7988a-bananapi-bpi-r4
+  $(call Device/bananapi_bpi-r4-common)
+endef
+TARGET_DEVICES += bananapi_bpi-r4
+
+define Device/bananapi_bpi-r4-poe
+  DEVICE_MODEL := BPi-R4 2.5GE
+  DEVICE_DTS := mt7988a-bananapi-bpi-r4-poe
+  DEVICE_DTS_CONFIG := config-mt7988a-bananapi-bpi-r4-poe
+  $(call Device/bananapi_bpi-r4-common)
+  DEVICE_PACKAGES += mt7988-2p5g-phy-firmware
+endef
+TARGET_DEVICES += bananapi_bpi-r4-poe
+
+define Device/cetron_ct3003
+  DEVICE_VENDOR := Cetron
+  DEVICE_MODEL := CT3003
+  DEVICE_DTS := mt7981b-cetron-ct3003
+  DEVICE_DTS_DIR := ../dts
+  SUPPORTED_DEVICES += mediatek,mt7981-spim-snand-rfb
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_IN_UBI := 1
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  IMAGES += factory.bin
+  IMAGE/factory.bin := $$(IMAGE/sysupgrade.bin) | cetron-header rd30 CT3003
+endef
+TARGET_DEVICES += cetron_ct3003
+
+define Device/cmcc_rax3000m
+  DEVICE_VENDOR := CMCC
+  DEVICE_MODEL := RAX3000M
+  DEVICE_DTS := mt7981b-cmcc-rax3000m
+  DEVICE_DTS_OVERLAY := mt7981b-cmcc-rax3000m-emmc mt7981b-cmcc-rax3000m-nand
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTC_FLAGS := --pad 4096
+  DEVICE_DTS_LOADADDR := 0x43f00000
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware kmod-usb3 \
+	e2fsprogs f2fsck mkf2fs
+  KERNEL_LOADADDR := 0x44000000
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  KERNEL_IN_UBI := 1
+  UBOOTENV_IN_UBI := 1
+  IMAGES := sysupgrade.itb
+  IMAGE_SIZE := $$(shell expr 64 + $$(CONFIG_TARGET_ROOTFS_PARTSIZE))m
+  IMAGE/sysupgrade.itb := append-kernel | \
+	 fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | \
+	 pad-rootfs | append-metadata
+  ARTIFACTS := \
+	emmc-gpt.bin emmc-preloader.bin emmc-bl31-uboot.fip \
+	nand-preloader.bin nand-bl31-uboot.fip
+  ARTIFACT/emmc-gpt.bin := mt798x-gpt emmc
+  ARTIFACT/emmc-preloader.bin := mt7981-bl2 emmc-ddr4
+  ARTIFACT/emmc-bl31-uboot.fip := mt7981-bl31-uboot cmcc_rax3000m-emmc
+  ARTIFACT/nand-preloader.bin := mt7981-bl2 spim-nand-ddr4
+  ARTIFACT/nand-bl31-uboot.fip := mt7981-bl31-uboot cmcc_rax3000m-nand
+endef
+TARGET_DEVICES += cmcc_rax3000m
+
+define Device/comfast_cf-e393ax
+  DEVICE_VENDOR := COMFAST
+  DEVICE_MODEL := CF-E393AX
+  DEVICE_DTS := mt7981a-comfast-cf-e393ax
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTC_FLAGS := --pad 4096
+  DEVICE_DTS_LOADADDR := 0x43f00000
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+  KERNEL_LOADADDR := 0x44000000
+  KERNEL = kernel-bin | lzma | \
+       fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL_INITRAMFS = kernel-bin | lzma | \
+       fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 65536k
+  KERNEL_IN_UBI := 1
+  IMAGES := sysupgrade.bin factory.bin
+  IMAGE/factory.bin := append-ubi | check-size $$$$(IMAGE_SIZE)
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += comfast_cf-e393ax
+
+define Device/confiabits_mt7981
+  DEVICE_VENDOR := Confiabits
+  DEVICE_MODEL := MT7981
+  DEVICE_DTS := mt7981b-confiabits-mt7981
+  DEVICE_DTS_DIR := ../dts
+  SUPPORTED_DEVICES += mediatek,mt7981-spim-snand-2500wan-gmac2-rfb
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 65536k
+  KERNEL_IN_UBI := 1
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  DEVICE_PACKAGES := kmod-usb3 kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+endef
+TARGET_DEVICES += confiabits_mt7981
+
+define Device/cudy_ap3000outdoor-v1
+  DEVICE_VENDOR := Cudy
+  DEVICE_MODEL := AP3000 Outdoor
+  DEVICE_VARIANT := v1
+  DEVICE_DTS := mt7981b-cudy-ap3000outdoor-v1
+  DEVICE_DTS_DIR := ../dts
+  SUPPORTED_DEVICES += R51
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 65536k
+  KERNEL_IN_UBI := 1
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+endef
+TARGET_DEVICES += cudy_ap3000outdoor-v1
+
+define Device/cudy_m3000-v1
+  DEVICE_VENDOR := Cudy
+  DEVICE_MODEL := M3000
+  DEVICE_VARIANT := v1
+  DEVICE_DTS := mt7981b-cudy-m3000-v1
+  DEVICE_DTS_DIR := ../dts
+  SUPPORTED_DEVICES += R37
+  DEVICE_DTS_LOADADDR := 0x44000000
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 65536k
+  KERNEL_IN_UBI := 1
+  KERNEL := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGES := sysupgrade.bin
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+endef
+TARGET_DEVICES += cudy_m3000-v1
+
+define Device/cudy_re3000-v1
+  DEVICE_VENDOR := Cudy
+  DEVICE_MODEL := RE3000
+  DEVICE_VARIANT := v1
+  DEVICE_DTS := mt7981b-cudy-re3000-v1
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTS_LOADADDR := 0x47000000
+  IMAGES := sysupgrade.bin
+  IMAGE_SIZE := 15424k
+  SUPPORTED_DEVICES += R36
+  KERNEL := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.bin := append-kernel | pad-to 128k | append-rootfs | pad-rootfs | check-size | append-metadata
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+endef
+TARGET_DEVICES += cudy_re3000-v1
+
+define Device/cudy_tr3000-v1
+  DEVICE_VENDOR := Cudy
+  DEVICE_MODEL := TR3000
+  DEVICE_VARIANT := v1
+  DEVICE_DTS := mt7981b-cudy-tr3000-v1
+  DEVICE_DTS_DIR := ../dts
+  SUPPORTED_DEVICES += R47
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 65536k
+  KERNEL_IN_UBI := 1
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  DEVICE_PACKAGES := kmod-usb3 kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+endef
+TARGET_DEVICES += cudy_tr3000-v1
+
+define Device/cudy_wr3000-v1
+  DEVICE_VENDOR := Cudy
+  DEVICE_MODEL := WR3000
+  DEVICE_VARIANT := v1
+  DEVICE_DTS := mt7981b-cudy-wr3000-v1
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTS_LOADADDR := 0x47000000
+  IMAGES := sysupgrade.bin
+  IMAGE_SIZE := 15424k
+  SUPPORTED_DEVICES += R31
+  KERNEL := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.bin := append-kernel | pad-to 128k | append-rootfs | pad-rootfs | check-size | append-metadata
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+endef
+TARGET_DEVICES += cudy_wr3000-v1
+
+define Device/dlink_aquila-pro-ai-m30-a1
+  DEVICE_VENDOR := D-Link
+  DEVICE_MODEL := AQUILA PRO AI M30
+  DEVICE_VARIANT := A1
+  DEVICE_DTS := mt7981b-dlink-aquila-pro-ai-m30-a1
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-leds-gca230718 kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+  KERNEL_IN_UBI := 1
+  IMAGES += recovery.bin
+  IMAGE_SIZE := 51200k
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  IMAGE/recovery.bin := sysupgrade-tar | pad-to $$(IMAGE_SIZE) | dlink-ai-recovery-header DLK6E6110001 \x6A\x28\xEE\x0B \x00\x00\x2C\x00 \x00\x00\x20\x03 \x61\x6E
+endef
+TARGET_DEVICES += dlink_aquila-pro-ai-m30-a1
+
+define Device/edgecore_eap111
+  DEVICE_VENDOR := Edgecore
+  DEVICE_MODEL := EAP111
+  DEVICE_DTS := mt7981a-edgecore-eap111
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTS_LOADADDR := 0x47000000
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  UBINIZE_OPTS := -E 5
+  KERNEL_IN_UBI := 1
+  IMAGE_SIZE := 65536k
+  IMAGES := sysupgrade.bin factory.bin
+  IMAGE/factory.bin := append-ubi | check-size $$$$(IMAGE_SIZE)
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+endef
+TARGET_DEVICES += edgecore_eap111
+
+define Device/glinet_gl-mt2500
+  DEVICE_VENDOR := GL.iNet
+  DEVICE_MODEL := GL-MT2500
+  DEVICE_DTS := mt7981b-glinet-gl-mt2500
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTS_LOADADDR := 0x47000000
+  DEVICE_PACKAGES := -wpad-basic-mbedtls e2fsprogs f2fsck mkf2fs kmod-usb3
+  SUPPORTED_DEVICES += glinet,mt2500-emmc
+  IMAGES := sysupgrade.bin
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-gl-metadata
+endef
+TARGET_DEVICES += glinet_gl-mt2500
+
+define Device/glinet_gl-mt3000
+  DEVICE_VENDOR := GL.iNet
+  DEVICE_MODEL := GL-MT3000
+  DEVICE_DTS := mt7981b-glinet-gl-mt3000
+  DEVICE_DTS_DIR := ../dts
+  SUPPORTED_DEVICES += glinet,mt3000-snand
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware kmod-hwmon-pwmfan kmod-usb3
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 246272k
+  KERNEL_IN_UBI := 1
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-gl-metadata
+endef
+TARGET_DEVICES += glinet_gl-mt3000
+
+define Device/glinet_gl-mt6000
+  DEVICE_VENDOR := GL.iNet
+  DEVICE_MODEL := GL-MT6000
+  DEVICE_DTS := mt7986a-glinet-gl-mt6000
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := e2fsprogs f2fsck mkf2fs kmod-usb3 kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-kernel | pad-to 32M | append-rootfs
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-gl-metadata
+  ARTIFACTS := preloader.bin bl31-uboot.fip
+  ARTIFACT/preloader.bin := mt7986-bl2 emmc-ddr4
+  ARTIFACT/bl31-uboot.fip := mt7986-bl31-uboot glinet_gl-mt6000
+endef
+TARGET_DEVICES += glinet_gl-mt6000
+
+define Device/glinet_gl-x3000-xe3000-common
+  DEVICE_VENDOR := GL.iNet
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware mkf2fs \
+    kmod-fs-f2fs kmod-hwmon-pwmfan kmod-usb3 kmod-usb-serial-option \
+    kmod-usb-storage kmod-usb-net-qmi-wwan uqmi
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-kernel | pad-to 32M | append-rootfs
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  ARTIFACTS := preloader.bin bl31-uboot.fip
+  ARTIFACT/preloader.bin := mt7981-bl2 emmc-ddr4
+endef
+
+define Device/glinet_gl-x3000
+  DEVICE_MODEL := GL-X3000
+  DEVICE_DTS := mt7981a-glinet-gl-x3000
+  SUPPORTED_DEVICES := glinet,gl-x3000
+  $(call Device/glinet_gl-x3000-xe3000-common)
+  ARTIFACT/bl31-uboot.fip := mt7981-bl31-uboot glinet_gl-x3000
+endef
+TARGET_DEVICES += glinet_gl-x3000
+
+define Device/glinet_gl-xe3000
+  DEVICE_MODEL := GL-XE3000
+  DEVICE_DTS := mt7981a-glinet-gl-xe3000
+  SUPPORTED_DEVICES := glinet,gl-xe3000
+  $(call Device/glinet_gl-x3000-xe3000-common)
+  ARTIFACT/bl31-uboot.fip := mt7981-bl31-uboot glinet_gl-xe3000
+endef
+TARGET_DEVICES += glinet_gl-xe3000
+
+define Device/h3c_magic-nx30-pro
+  DEVICE_VENDOR := H3C
+  DEVICE_MODEL := Magic NX30 Pro
+  DEVICE_DTS := mt7981b-h3c-magic-nx30-pro
+  DEVICE_DTS_DIR := ../dts
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_IN_UBI := 1
+  UBOOTENV_IN_UBI := 1
+  IMAGE_SIZE := 65536k
+  IMAGES := sysupgrade.itb
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+        fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.itb := append-kernel | \
+        fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | append-metadata
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+  ARTIFACTS := preloader.bin bl31-uboot.fip
+  ARTIFACT/preloader.bin := mt7981-bl2 spim-nand-ddr3
+  ARTIFACT/bl31-uboot.fip := mt7981-bl31-uboot h3c_magic-nx30-pro
+endef
+TARGET_DEVICES += h3c_magic-nx30-pro
+
+define Device/jcg_q30-pro
+  DEVICE_VENDOR := JCG
+  DEVICE_MODEL := Q30 PRO
+  DEVICE_DTS := mt7981b-jcg-q30-pro
+  DEVICE_DTS_DIR := ../dts
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_IN_UBI := 1
+  UBOOTENV_IN_UBI := 1
+  IMAGES := sysupgrade.itb
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+        fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.itb := append-kernel | \
+        fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | append-metadata
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+  ARTIFACTS := preloader.bin bl31-uboot.fip
+  ARTIFACT/preloader.bin := mt7981-bl2 spim-nand-ddr3
+  ARTIFACT/bl31-uboot.fip := mt7981-bl31-uboot jcg_q30-pro
+endef
+TARGET_DEVICES += jcg_q30-pro
+
+define Device/jdcloud_re-cp-03
+  DEVICE_VENDOR := JDCloud
+  DEVICE_MODEL := RE-CP-03
+  DEVICE_DTS := mt7986a-jdcloud-re-cp-03
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTC_FLAGS := --pad 4096
+  DEVICE_DTS_LOADADDR := 0x43f00000
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware \
+	e2fsprogs f2fsck mkf2fs
+  KERNEL_LOADADDR := 0x44000000
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  IMAGES := sysupgrade.itb
+  IMAGE_SIZE := $$(shell expr 64 + $$(CONFIG_TARGET_ROOTFS_PARTSIZE))m
+  IMAGE/sysupgrade.itb := append-kernel | \
+	fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | \
+	pad-rootfs | append-metadata
+  ARTIFACTS :=gpt.bin preloader.bin bl31-uboot.fip
+  ARTIFACT/gpt.bin := mt798x-gpt emmc
+  ARTIFACT/preloader.bin := mt7986-bl2 emmc-ddr4
+  ARTIFACT/bl31-uboot.fip := mt7986-bl31-uboot jdcloud_re-cp-03
+endef
+TARGET_DEVICES += jdcloud_re-cp-03
+
+define Device/mediatek_mt7981-rfb
+  DEVICE_VENDOR := MediaTek
+  DEVICE_MODEL := MT7981 rfb
+  DEVICE_DTS := mt7981-rfb
+  DEVICE_DTS_OVERLAY:= \
+	mt7981-rfb-spim-nand \
+	mt7981-rfb-mxl-2p5g-phy-eth1 \
+	mt7981-rfb-mxl-2p5g-phy-swp5
+  DEVICE_DTS_DIR := $(DTS_DIR)/
+  DEVICE_DTC_FLAGS := --pad 4096
+  DEVICE_DTS_LOADADDR := 0x43f00000
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware kmod-usb3 e2fsprogs f2fsck mkf2fs mt7981-wo-firmware
+  KERNEL_LOADADDR := 0x44000000
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  KERNEL_INITRAMFS_SUFFIX := .itb
+  KERNEL_IN_UBI := 1
+  UBOOTENV_IN_UBI := 1
+  IMAGES := sysupgrade.itb
+  IMAGE_SIZE := $$(shell expr 64 + $$(CONFIG_TARGET_ROOTFS_PARTSIZE))m
+  IMAGE/sysupgrade.itb := append-kernel | fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-with-rootfs | pad-rootfs | append-metadata
+  ARTIFACTS := \
+	emmc-preloader.bin emmc-bl31-uboot.fip \
+	nor-preloader.bin nor-bl31-uboot.fip \
+	sdcard.img.gz \
+	snfi-nand-preloader.bin snfi-nand-bl31-uboot.fip \
+	spim-nand-preloader.bin spim-nand-bl31-uboot.fip
+  ARTIFACT/emmc-preloader.bin		:= mt7981-bl2 emmc-ddr3
+  ARTIFACT/emmc-bl31-uboot.fip		:= mt7981-bl31-uboot rfb-emmc
+  ARTIFACT/nor-preloader.bin		:= mt7981-bl2 nor-ddr3
+  ARTIFACT/nor-bl31-uboot.fip		:= mt7981-bl31-uboot rfb-emmc
+  ARTIFACT/snfi-nand-preloader.bin	:= mt7981-bl2 snand-ddr3
+  ARTIFACT/snfi-nand-bl31-uboot.fip	:= mt7981-bl31-uboot rfb-snfi
+  ARTIFACT/spim-nand-preloader.bin	:= mt7981-bl2 spim-nand-ddr3
+  ARTIFACT/spim-nand-bl31-uboot.fip	:= mt7981-bl31-uboot rfb-spim-nand
+  ARTIFACT/sdcard.img.gz	:= mt798x-gpt sdmmc |\
+				   pad-to 17k | mt7981-bl2 sdmmc-ddr3 |\
+				   pad-to 6656k | mt7981-bl31-uboot rfb-sd |\
+				$(if $(CONFIG_TARGET_ROOTFS_INITRAMFS),\
+				   pad-to 12M | append-image-stage initramfs.itb | check-size 44m |\
+				) \
+				   pad-to 44M | mt7981-bl2 spim-nand-ddr3 |\
+				   pad-to 45M | mt7981-bl31-uboot rfb-spim-nand |\
+				   pad-to 49M | mt7981-bl2 nor-ddr3 |\
+				   pad-to 50M | mt7981-bl31-uboot rfb-nor |\
+				   pad-to 51M | mt7981-bl2 snand-ddr3 |\
+				   pad-to 53M | mt7981-bl31-uboot rfb-snfi |\
+				$(if $(CONFIG_TARGET_ROOTFS_SQUASHFS),\
+				   pad-to 64M | append-image squashfs-sysupgrade.itb | check-size |\
+				) \
+				  gzip
+endef
+TARGET_DEVICES += mediatek_mt7981-rfb
+
+define Device/mediatek_mt7986a-rfb-nand
+  DEVICE_VENDOR := MediaTek
+  DEVICE_MODEL := MT7986 rfba AP (NAND)
+  DEVICE_DTS := mt7986a-rfb-spim-nand
+  DEVICE_DTS_DIR := $(DTS_DIR)/
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware
+  SUPPORTED_DEVICES := mediatek,mt7986a-rfb-snand
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 65536k
+  KERNEL_IN_UBI := 1
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-ubi | check-size $$$$(IMAGE_SIZE)
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  KERNEL = kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL_INITRAMFS = kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd
+endef
+TARGET_DEVICES += mediatek_mt7986a-rfb-nand
+
+define Device/mediatek_mt7986b-rfb
+  DEVICE_VENDOR := MediaTek
+  DEVICE_MODEL := MTK7986 rfbb AP
+  DEVICE_DTS := mt7986b-rfb
+  DEVICE_DTS_DIR := $(DTS_DIR)/
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware
+  SUPPORTED_DEVICES := mediatek,mt7986b-rfb
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 65536k
+  KERNEL_IN_UBI := 1
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-ubi | check-size $$$$(IMAGE_SIZE)
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += mediatek_mt7986b-rfb
+
+define Device/mediatek_mt7988a-rfb
+  DEVICE_VENDOR := MediaTek
+  DEVICE_MODEL := MT7988A rfb
+  DEVICE_DTS := mt7988a-rfb
+  DEVICE_DTS_OVERLAY:= \
+	mt7988a-rfb-emmc \
+	mt7988a-rfb-sd \
+	mt7988a-rfb-snfi-nand \
+	mt7988a-rfb-spim-nand \
+	mt7988a-rfb-spim-nand-factory \
+	mt7988a-rfb-spim-nor \
+	mt7988a-rfb-eth1-aqr \
+	mt7988a-rfb-eth1-i2p5g-phy \
+	mt7988a-rfb-eth1-mxl \
+	mt7988a-rfb-eth1-sfp \
+	mt7988a-rfb-eth2-aqr \
+	mt7988a-rfb-eth2-mxl \
+	mt7988a-rfb-eth2-sfp
+  DEVICE_DTS_DIR := $(DTS_DIR)/
+  DEVICE_DTC_FLAGS := --pad 4096
+  DEVICE_DTS_LOADADDR := 0x45f00000
+  DEVICE_PACKAGES := mt7988-2p5g-phy-firmware kmod-sfp
+  KERNEL_LOADADDR := 0x46000000
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  KERNEL_INITRAMFS_SUFFIX := .itb
+  KERNEL_IN_UBI := 1
+  IMAGE_SIZE := $$(shell expr 64 + $$(CONFIG_TARGET_ROOTFS_PARTSIZE))m
+  IMAGES := sysupgrade.itb
+  IMAGE/sysupgrade.itb := append-kernel | fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-with-rootfs | pad-rootfs | append-metadata
+  ARTIFACTS := \
+	       emmc-gpt.bin emmc-preloader.bin emmc-bl31-uboot.fip \
+	       nor-preloader.bin nor-bl31-uboot.fip \
+	       sdcard.img.gz \
+	       snand-preloader.bin snand-bl31-uboot.fip
+  ARTIFACT/emmc-gpt.bin		:= mt798x-gpt emmc
+  ARTIFACT/emmc-preloader.bin	:= mt7988-bl2 emmc-comb
+  ARTIFACT/emmc-bl31-uboot.fip	:= mt7988-bl31-uboot rfb-emmc
+  ARTIFACT/nor-preloader.bin	:= mt7988-bl2 nor-comb
+  ARTIFACT/nor-bl31-uboot.fip	:= mt7988-bl31-uboot rfb-nor
+  ARTIFACT/snand-preloader.bin	:= mt7988-bl2 spim-nand-ubi-comb
+  ARTIFACT/snand-bl31-uboot.fip	:= mt7988-bl31-uboot rfb-snand
+  ARTIFACT/sdcard.img.gz	:= mt798x-gpt sdmmc |\
+				   pad-to 17k | mt7988-bl2 sdmmc-comb |\
+				   pad-to 6656k | mt7988-bl31-uboot rfb-sd |\
+				$(if $(CONFIG_TARGET_ROOTFS_INITRAMFS),\
+				   pad-to 12M | append-image-stage initramfs.itb | check-size 44m |\
+				) \
+				   pad-to 44M | mt7988-bl2 spim-nand-comb |\
+				   pad-to 45M | mt7988-bl31-uboot rfb-snand |\
+				   pad-to 51M | mt7988-bl2 nor-comb |\
+				   pad-to 51M | mt7988-bl31-uboot rfb-nor |\
+				   pad-to 55M | mt7988-bl2 emmc-comb |\
+				   pad-to 56M | mt7988-bl31-uboot rfb-emmc |\
+				   pad-to 62M | mt798x-gpt emmc |\
+				$(if $(CONFIG_TARGET_ROOTFS_SQUASHFS),\
+				   pad-to 64M | append-image squashfs-sysupgrade.itb | check-size |\
+				) \
+				  gzip
+endef
+TARGET_DEVICES += mediatek_mt7988a-rfb
+
+define Device/mercusys_mr90x-v1
+  DEVICE_VENDOR := MERCUSYS
+  DEVICE_MODEL := MR90X v1
+  DEVICE_DTS := mt7986b-mercusys-mr90x-v1
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 51200k
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += mercusys_mr90x-v1
+
+define Device/netcore_n60
+  DEVICE_VENDOR := Netcore
+  DEVICE_MODEL := N60
+  DEVICE_DTS := mt7986a-netcore-n60
+  DEVICE_DTS_DIR := ../dts
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_IN_UBI := 1
+  UBOOTENV_IN_UBI := 1
+  IMAGES := sysupgrade.itb
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+        fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.itb := append-kernel | \
+        fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | append-metadata
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware
+  ARTIFACTS := preloader.bin bl31-uboot.fip
+  ARTIFACT/preloader.bin := mt7986-bl2 spim-nand-ddr3
+  ARTIFACT/bl31-uboot.fip := mt7986-bl31-uboot netcore_n60
+endef
+TARGET_DEVICES += netcore_n60
+
+define Device/netgear_wax220
+  DEVICE_VENDOR := NETGEAR
+  DEVICE_MODEL := WAX220
+  DEVICE_DTS := mt7986b-netgear-wax220
+  DEVICE_DTS_DIR := ../dts
+  NETGEAR_ENC_MODEL := WAX220
+  NETGEAR_ENC_REGION := US
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  IMAGE_SIZE := 32768k
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  IMAGES += factory.img
+  # Padding to 10M seems to be required by OEM web interface
+  IMAGE/factory.img := sysupgrade-tar | \
+	  pad-to 10M | check-size | netgear-encrypted-factory
+endef
+TARGET_DEVICES += netgear_wax220
+
+define Device/nokia_ea0326gmp
+  DEVICE_VENDOR := Nokia
+  DEVICE_MODEL := EA0326GMP
+  DEVICE_DTS := mt7981b-nokia-ea0326gmp
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_IN_UBI := 1
+  UBOOTENV_IN_UBI := 1
+  IMAGES := sysupgrade.itb
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+        fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.itb := append-kernel | \
+        fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | append-metadata
+  ARTIFACTS := preloader.bin bl31-uboot.fip
+  ARTIFACT/preloader.bin := mt7981-bl2 spim-nand-ddr3
+  ARTIFACT/bl31-uboot.fip := mt7981-bl31-uboot nokia_ea0326gmp
+endef
+TARGET_DEVICES += nokia_ea0326gmp
+
+define Device/openembed_som7981
+  DEVICE_VENDOR := OpenEmbed
+  DEVICE_MODEL := SOM7981
+  DEVICE_DTS := mt7981b-openembed-som7981
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware kmod-usb3
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 244224k
+  KERNEL_IN_UBI := 1
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-ubi | check-size $$$$(IMAGE_SIZE)
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += openembed_som7981
+
+define Device/openwrt_one
+  DEVICE_VENDOR := OpenWrt
+  DEVICE_MODEL := One
+  DEVICE_DTS := mt7981b-openwrt-one
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTC_FLAGS := --pad 4096
+  DEVICE_DTS_LOADADDR := 0x43f00000
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware kmod-rtc-pcf8563 kmod-usb3 kmod-nvme kmod-phy-airoha-en8811h
+  KERNEL_LOADADDR := 0x44000000
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  KERNEL_INITRAMFS_SUFFIX := .itb
+  KERNEL_IN_UBI := 1
+  UBOOTENV_IN_UBI := 1
+  IMAGES := sysupgrade.itb
+  IMAGE_SIZE := $$(shell expr 64 + $$(CONFIG_TARGET_ROOTFS_PARTSIZE))m
+  IMAGE/sysupgrade.itb := append-kernel | fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-with-rootfs | pad-rootfs | append-metadata
+  ARTIFACTS := \
+	nor-preloader.bin nor-bl31-uboot.fip \
+	snand-preloader.bin snand-bl31-uboot.fip \
+	factory.ubi snand-factory.bin nor-factory.bin
+  ARTIFACT/nor-preloader.bin		:= mt7981-bl2 nor-ddr4
+  ARTIFACT/nor-bl31-uboot.fip		:= mt7981-bl31-uboot openwrt_one-nor
+  ARTIFACT/snand-preloader.bin		:= mt7981-bl2 spim-nand-ubi-ddr4
+  ARTIFACT/snand-bl31-uboot.fip		:= mt7981-bl31-uboot openwrt_one-snand
+  ARTIFACT/factory.ubi			:= ubinize-image fit squashfs-sysupgrade.itb
+  ARTIFACT/snand-factory.bin		:= mt7981-bl2 spim-nand-ubi-ddr4 | pad-to 256k | \
+					   mt7981-bl2 spim-nand-ubi-ddr4 | pad-to 512k | \
+					   mt7981-bl2 spim-nand-ubi-ddr4 | pad-to 768k | \
+					   mt7981-bl2 spim-nand-ubi-ddr4 | pad-to 1024k | \
+					   ubinize-image fit squashfs-sysupgrade.itb
+  ARTIFACT/nor-factory.bin		:= mt7981-bl2 nor-ddr4 | pad-to 256k | \
+					   append-openwrt-one-eeprom | pad-to 1024k | \
+					   mt7981-bl31-uboot openwrt_one-nor | pad-to 512k | \
+					   append-image-stage initramfs.itb
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  UBINIZE_PARTS := fip=:$(STAGING_DIR_IMAGE)/mt7981_openwrt_one-snand-u-boot.fip \
+		   $(if $(IB),recovery=:$(STAGING_DIR_IMAGE)/mediatek-filogic-openwrt_one-initramfs.itb,\
+			      recovery=:$(KDIR)/tmp/$$(KERNEL_INITRAMFS_IMAGE)) \
+		   $(if $(wildcard $(TOPDIR)/openwrt-mediatek-filogic-openwrt_one-calibration.itb), calibration=:$(TOPDIR)/openwrt-mediatek-filogic-openwrt_one-calibration.itb)
+endef
+TARGET_DEVICES += openwrt_one
+
+define Device/qihoo_360t7
+  DEVICE_VENDOR := Qihoo
+  DEVICE_MODEL := 360T7
+  DEVICE_DTS := mt7981b-qihoo-360t7
+  DEVICE_DTS_DIR := ../dts
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_IN_UBI := 1
+  UBOOTENV_IN_UBI := 1
+  IMAGES := sysupgrade.itb
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+        fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.itb := append-kernel | \
+        fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | append-metadata
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+  ARTIFACTS := preloader.bin bl31-uboot.fip
+  ARTIFACT/preloader.bin := mt7981-bl2 spim-nand-ddr3
+  ARTIFACT/bl31-uboot.fip := mt7981-bl31-uboot qihoo_360t7
+endef
+TARGET_DEVICES += qihoo_360t7
+
+define Device/routerich_ax3000
+  DEVICE_VENDOR := Routerich
+  DEVICE_MODEL := AX3000
+  DEVICE_DTS := mt7981b-routerich-ax3000
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware kmod-usb3
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  SUPPORTED_DEVICES += mediatek,mt7981-spim-snand-rfb
+endef
+TARGET_DEVICES += routerich_ax3000
+
+define Device/ruijie_rg-x60-pro
+  DEVICE_VENDOR := Ruijie
+  DEVICE_MODEL := RG-X60 Pro
+  DEVICE_DTS := mt7986a-ruijie-rg-x60-pro
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += ruijie_rg-x60-pro
+
+define Device/tplink_re6000xd
+  DEVICE_VENDOR := TP-Link
+  DEVICE_MODEL := RE6000XD
+  DEVICE_DTS := mt7986b-tplink-re6000xd
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 51200k
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += tplink_re6000xd
+
+define Device/tplink_tl-xdr-common
+  DEVICE_VENDOR := TP-Link
+  DEVICE_DTS_DIR := ../dts
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_IN_UBI := 1
+  UBOOTENV_IN_UBI := 1
+  IMAGES := sysupgrade.itb
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+        fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.itb := append-kernel | \
+        fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-with-rootfs | append-metadata
+  DEVICE_PACKAGES := fitblk kmod-usb3 kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware
+  ARTIFACTS := preloader.bin bl31-uboot.fip
+  ARTIFACT/preloader.bin := mt7986-bl2 spim-nand-ddr3
+endef
+
+define Device/tplink_tl-xdr4288
+  DEVICE_MODEL := TL-XDR4288
+  DEVICE_DTS := mt7986a-tplink-tl-xdr4288
+  ARTIFACT/bl31-uboot.fip := mt7986-bl31-uboot tplink_tl-xdr4288
+  $(call Device/tplink_tl-xdr-common)
+endef
+TARGET_DEVICES += tplink_tl-xdr4288
+
+define Device/tplink_tl-xdr6086
+  DEVICE_MODEL := TL-XDR6086
+  DEVICE_DTS := mt7986a-tplink-tl-xdr6086
+  ARTIFACT/bl31-uboot.fip := mt7986-bl31-uboot tplink_tl-xdr6086
+  $(call Device/tplink_tl-xdr-common)
+endef
+TARGET_DEVICES += tplink_tl-xdr6086
+
+define Device/tplink_tl-xdr6088
+  DEVICE_MODEL := TL-XDR6088
+  DEVICE_DTS := mt7986a-tplink-tl-xdr6088
+  ARTIFACT/bl31-uboot.fip := mt7986-bl31-uboot tplink_tl-xdr6088
+  $(call Device/tplink_tl-xdr-common)
+endef
+TARGET_DEVICES += tplink_tl-xdr6088
+
+define Device/tplink_tl-xtr8488
+  DEVICE_MODEL := TL-XTR8488
+  DEVICE_DTS := mt7986a-tplink-tl-xtr8488
+  $(call Device/tplink_tl-xdr-common)
+  DEVICE_PACKAGES += kmod-mt7915-firmware
+  ARTIFACT/preloader.bin := mt7986-bl2 spim-nand-ddr4
+  ARTIFACT/bl31-uboot.fip := mt7986-bl31-uboot tplink_tl-xtr8488
+endef
+TARGET_DEVICES += tplink_tl-xtr8488
+
+define Device/ubnt_unifi-6-plus
+  DEVICE_VENDOR := Ubiquiti
+  DEVICE_MODEL := UniFi U6+
+  DEVICE_DTS := mt7981a-ubnt-unifi-6-plus
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware e2fsprogs f2fsck mkf2fs fdisk partx-utils
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += ubnt_unifi-6-plus
+
+define Device/unielec_u7981-01
+  DEVICE_VENDOR := Unielec
+  DEVICE_MODEL := U7981-01
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware kmod-usb3 e2fsprogs f2fsck mkf2fs fdisk partx-utils
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+
+define Device/unielec_u7981-01-emmc
+  DEVICE_DTS := mt7981b-unielec-u7981-01-emmc
+  DEVICE_VARIANT := (EMMC)
+  $(call Device/unielec_u7981-01)
+endef
+TARGET_DEVICES += unielec_u7981-01-emmc
+
+define Device/unielec_u7981-01-nand
+  DEVICE_DTS := mt7981b-unielec-u7981-01-nand
+  DEVICE_VARIANT := (NAND)
+  $(call Device/unielec_u7981-01)
+endef
+TARGET_DEVICES += unielec_u7981-01-nand
+
+define Device/wavlink_wl-wn586x3
+  DEVICE_VENDOR := WAVLINK
+  DEVICE_MODEL := WL-WN586X3
+  DEVICE_DTS := mt7981b-wavlink-wl-wn586x3
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTS_LOADADDR := 0x47000000
+  IMAGE_SIZE := 15424k
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+endef
+TARGET_DEVICES += wavlink_wl-wn586x3
+
+define Device/xiaomi_mi-router-ax3000t
+  DEVICE_VENDOR := Xiaomi
+  DEVICE_MODEL := Mi Router AX3000T
+  DEVICE_DTS := mt7981b-xiaomi-mi-router-ax3000t
+  DEVICE_DTS_DIR := ../dts
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+  ARTIFACTS := initramfs-factory.ubi
+  ARTIFACT/initramfs-factory.ubi := append-image-stage initramfs-kernel.bin | ubinize-kernel
+endif
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += xiaomi_mi-router-ax3000t
+
+define Device/xiaomi_mi-router-ax3000t-ubootmod
+  DEVICE_VENDOR := Xiaomi
+  DEVICE_MODEL := Mi Router AX3000T (OpenWrt U-Boot layout)
+  DEVICE_DTS := mt7981b-xiaomi-mi-router-ax3000t-ubootmod
+  DEVICE_DTS_DIR := ../dts
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+  KERNEL_IN_UBI := 1
+  UBOOTENV_IN_UBI := 1
+  IMAGES := sysupgrade.itb
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+        fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.itb := append-kernel | \
+        fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | append-metadata
+  ARTIFACTS := preloader.bin bl31-uboot.fip
+  ARTIFACT/preloader.bin := mt7981-bl2 spim-nand-ddr3
+  ARTIFACT/bl31-uboot.fip := mt7981-bl31-uboot xiaomi_mi-router-ax3000t
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+  ARTIFACTS += initramfs-factory.ubi
+  ARTIFACT/initramfs-factory.ubi := append-image-stage initramfs-recovery.itb | ubinize-kernel
+endif
+endef
+TARGET_DEVICES += xiaomi_mi-router-ax3000t-ubootmod
+
+define Device/xiaomi_mi-router-wr30u-stock
+  DEVICE_VENDOR := Xiaomi
+  DEVICE_MODEL := Mi Router WR30U (stock layout)
+  DEVICE_DTS := mt7981b-xiaomi-mi-router-wr30u-stock
+  DEVICE_DTS_DIR := ../dts
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+  ARTIFACTS := initramfs-factory.ubi
+  ARTIFACT/initramfs-factory.ubi := append-image-stage initramfs-kernel.bin | ubinize-kernel
+endif
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += xiaomi_mi-router-wr30u-stock
+
+define Device/xiaomi_mi-router-wr30u-ubootmod
+  DEVICE_VENDOR := Xiaomi
+  DEVICE_MODEL := Mi Router WR30U (OpenWrt U-Boot layout)
+  DEVICE_DTS := mt7981b-xiaomi-mi-router-wr30u-ubootmod
+  DEVICE_DTS_DIR := ../dts
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+  KERNEL_IN_UBI := 1
+  UBOOTENV_IN_UBI := 1
+  IMAGES := sysupgrade.itb
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+        fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.itb := append-kernel | \
+        fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | append-metadata
+  ARTIFACTS := preloader.bin bl31-uboot.fip
+  ARTIFACT/preloader.bin := mt7981-bl2 spim-nand-ddr3
+  ARTIFACT/bl31-uboot.fip := mt7981-bl31-uboot xiaomi_mi-router-wr30u
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+  ARTIFACTS += initramfs-factory.ubi
+  ARTIFACT/initramfs-factory.ubi := append-image-stage initramfs-recovery.itb | ubinize-kernel
+endif
+endef
+TARGET_DEVICES += xiaomi_mi-router-wr30u-ubootmod
+
+define Device/xiaomi_redmi-router-ax6000-stock
+  DEVICE_VENDOR := Xiaomi
+  DEVICE_MODEL := Redmi Router AX6000 (stock layout)
+  DEVICE_DTS := mt7986a-xiaomi-redmi-router-ax6000-stock
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-leds-ws2812b kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+  ARTIFACTS := initramfs-factory.ubi
+  ARTIFACT/initramfs-factory.ubi := append-image-stage initramfs-kernel.bin | ubinize-kernel
+endif
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += xiaomi_redmi-router-ax6000-stock
+
+define Device/xiaomi_redmi-router-ax6000-ubootmod
+  DEVICE_VENDOR := Xiaomi
+  DEVICE_MODEL := Redmi Router AX6000 (OpenWrt U-Boot layout)
+  DEVICE_DTS := mt7986a-xiaomi-redmi-router-ax6000-ubootmod
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-leds-ws2812b kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  IMAGES := sysupgrade.itb
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_IN_UBI := 1
+  UBOOTENV_IN_UBI := 1
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+        fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.itb := append-kernel | \
+        fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | append-metadata
+  ARTIFACTS := preloader.bin bl31-uboot.fip
+  ARTIFACT/preloader.bin := mt7986-bl2 spim-nand-ddr4
+  ARTIFACT/bl31-uboot.fip := mt7986-bl31-uboot xiaomi_redmi-router-ax6000
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+  ARTIFACTS += initramfs-factory.ubi
+  ARTIFACT/initramfs-factory.ubi := append-image-stage initramfs-recovery.itb | ubinize-kernel
+endif
+endef
+TARGET_DEVICES += xiaomi_redmi-router-ax6000-ubootmod
+
+define Device/yuncore_ax835
+  DEVICE_VENDOR := YunCore
+  DEVICE_MODEL := AX835
+  DEVICE_DTS := mt7981b-yuncore-ax835
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTS_LOADADDR := 0x47000000
+  IMAGES := sysupgrade.bin
+  IMAGE_SIZE := 14336k
+  SUPPORTED_DEVICES += mediatek,mt7981-spim-nor-rfb
+  KERNEL := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.bin := append-kernel | pad-to 128k | append-rootfs | pad-rootfs | check-size | append-metadata
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+endef
+TARGET_DEVICES += yuncore_ax835
+
+define Device/zbtlink_zbt-z8102ax
+  DEVICE_VENDOR := Zbtlink
+  DEVICE_MODEL := ZBT-Z8102AX
+  DEVICE_DTS := mt7981b-zbtlink-zbt-z8102ax
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware kmod-usb3 kmod-usb-net-qmi-wwan kmod-usb-serial-option
+  KERNEL_IN_UBI := 1
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 65536k
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-ubi | check-size $$(IMAGE_SIZE)
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += zbtlink_zbt-z8102ax
+
+define Device/zbtlink_zbt-z8103ax
+  DEVICE_VENDOR := Zbtlink
+  DEVICE_MODEL := ZBT-Z8103AX
+  DEVICE_DTS := mt7981b-zbtlink-zbt-z8103ax
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+  KERNEL_IN_UBI := 1
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 65536k
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-ubi | check-size $$(IMAGE_SIZE)
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += zbtlink_zbt-z8103ax
+
+define Device/zyxel_ex5601-t0-stock
+  DEVICE_VENDOR := Zyxel
+  DEVICE_MODEL := EX5601-T0
+  DEVICE_VARIANT := (stock layout)
+  DEVICE_DTS := mt7986a-zyxel-ex5601-t0-stock
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware kmod-usb3
+  SUPPORTED_DEVICES := mediatek,mt7986a-rfb-snand
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 256k
+  PAGESIZE := 4096
+  IMAGE_SIZE := 65536k
+  KERNEL_IN_UBI := 1
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-ubi | check-size $$$$(IMAGE_SIZE)
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  KERNEL = kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL_INITRAMFS = kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd
+endef
+TARGET_DEVICES += zyxel_ex5601-t0-stock
+
+define Device/zyxel_ex5601-t0-ubootmod
+  DEVICE_VENDOR := Zyxel
+  DEVICE_MODEL := EX5601-T0
+  DEVICE_VARIANT := (OpenWrt U-Boot layout)
+  DEVICE_DTS := mt7986a-zyxel-ex5601-t0-ubootmod
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware kmod-usb3
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  IMAGES := sysupgrade.itb
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 256k
+  PAGESIZE := 4096
+  KERNEL_IN_UBI := 1
+  UBOOTENV_IN_UBI := 1
+  KERNEL := kernel-bin | lzma
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+        fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd
+  IMAGE/sysupgrade.itb := append-kernel | \
+        fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | append-metadata
+  ARTIFACTS := preloader.bin bl31-uboot.fip
+  ARTIFACT/preloader.bin := mt7986-bl2 spim-nand-4k-ddr4
+  ARTIFACT/bl31-uboot.fip := mt7986-bl31-uboot zyxel_ex5601-t0
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+  ARTIFACTS += initramfs-factory.ubi
+  ARTIFACT/initramfs-factory.ubi := append-image-stage initramfs-recovery.itb | ubinize-kernel
+endif
+endef
+TARGET_DEVICES += zyxel_ex5601-t0-ubootmod
+
+define Device/zyxel_ex5700-telenor
+  DEVICE_VENDOR := Zyxel
+  DEVICE_MODEL := EX5700 (Telenor)
+  DEVICE_DTS := mt7986a-zyxel-ex5700-telenor
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-ubootenv-nvram kmod-usb3 kmod-mt7915e kmod-mt7916-firmware kmod-mt7986-firmware mt7986-wo-firmware
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 65536k
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += zyxel_ex5700-telenor
+
+define Device/zyxel_nwa50ax-pro
+  DEVICE_VENDOR := Zyxel
+  DEVICE_MODEL := NWA50AX Pro
+  DEVICE_DTS := mt7981b-zyxel-nwa50ax-pro
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware zyxel-bootconfig
+  DEVICE_DTS_LOADADDR := 0x44000000
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 51200k
+  KERNEL_IN_UBI := 1
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-ubi | check-size $$$$(IMAGE_SIZE) | zyxel-nwa-fit-filogic
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += zyxel_nwa50ax-pro
+
+define Device/z8102ax
+  DEVICE_VENDOR := ZBT
+  DEVICE_MODEL := Z8102AX
+#  DEVICE_DTS := mt7981b-zbt-z8102ax
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+  KERNEL_IN_UBI := 1
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+  ARTIFACTS := initramfs-factory.ubi
+  ARTIFACT/initramfs-factory.ubi := append-image-stage initramfs-kernel.bin | ubinize-kernel
+endif
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+
+define Device/z8102ax-64m
+  $(call Device/z8102ax)
+  DEVICE_VARIANT := 64 NAND
+  DEVICE_DTS := mt7981b-zbt-z8102ax-64m
+  IMAGE_SIZE := 65536k
+endef
+TARGET_DEVICES += z8102ax-64m
+
+define Device/z8102ax-128m
+  $(call Device/z8102ax)
+  DEVICE_VARIANT := 128 NAND
+  DEVICE_DTS := mt7981b-zbt-z8102ax-128m
+  IMAGE_SIZE := 131072k
+endef
+TARGET_DEVICES += z8102ax-128m
diff --git a/6.12/target/linux/mediatek/patches-6.12/100-dts-update-mt7622-rfb1.patch b/6.12/target/linux/mediatek/patches-6.12/100-dts-update-mt7622-rfb1.patch
new file mode 100644
index 00000000..18bcdf02
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/100-dts-update-mt7622-rfb1.patch
@@ -0,0 +1,107 @@
+--- a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
+@@ -1,7 +1,6 @@
+ /*
+- * Copyright (c) 2017 MediaTek Inc.
+- * Author: Ming Huang <ming.huang@mediatek.com>
+- *	   Sean Wang <sean.wang@mediatek.com>
++ * Copyright (c) 2018 MediaTek Inc.
++ * Author: Ryder Lee <ryder.lee@mediatek.com>
+  *
+  * SPDX-License-Identifier: (GPL-2.0 OR MIT)
+  */
+@@ -24,7 +23,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
+-		bootargs = "earlycon=uart8250,mmio32,0x11002000 swiotlb=512";
++		bootargs = "earlycon=uart8250,mmio32,0x11002000 console=ttyS0,115200n1 swiotlb=512";
+ 	};
+ 
+ 	cpus {
+@@ -45,18 +44,18 @@
+ 		key-factory {
+ 			label = "factory";
+ 			linux,code = <BTN_0>;
+-			gpios = <&pio 0 0>;
++			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+ 		};
+ 
+ 		key-wps {
+ 			label = "wps";
+ 			linux,code = <KEY_WPS_BUTTON>;
+-			gpios = <&pio 102 0>;
++			gpios = <&pio 102 GPIO_ACTIVE_LOW>;
+ 		};
+ 	};
+ 
+ 	memory@40000000 {
+-		reg = <0 0x40000000 0 0x20000000>;
++		reg = <0 0x40000000 0 0x40000000>;
+ 		device_type = "memory";
+ 	};
+ 
+@@ -133,22 +132,22 @@
+ 
+ 				port@0 {
+ 					reg = <0>;
+-					label = "lan0";
++					label = "lan1";
+ 				};
+ 
+ 				port@1 {
+ 					reg = <1>;
+-					label = "lan1";
++					label = "lan2";
+ 				};
+ 
+ 				port@2 {
+ 					reg = <2>;
+-					label = "lan2";
++					label = "lan3";
+ 				};
+ 
+ 				port@3 {
+ 					reg = <3>;
+-					label = "lan3";
++					label = "lan4";
+ 				};
+ 
+ 				port@4 {
+@@ -240,7 +239,22 @@
+ 	status = "okay";
+ };
+ 
++&pcie1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pcie1_pins>;
++	status = "okay";
++};
++
+ &pio {
++	/* Attention: GPIO 90 is used to switch between PCIe@1,0 and
++	 * SATA functions. i.e. output-high: PCIe, output-low: SATA
++	 */
++	asm_sel {
++		gpio-hog;
++		gpios = <90 GPIO_ACTIVE_HIGH>;
++		output-high;
++	};
++
+ 	/* eMMC is shared pin with parallel NAND */
+ 	emmc_pins_default: emmc-pins-default {
+ 		mux {
+@@ -517,11 +531,11 @@
+ };
+ 
+ &sata {
+-	status = "okay";
++	status = "disabled";
+ };
+ 
+ &sata_phy {
+-	status = "okay";
++	status = "disabled";
+ };
+ 
+ &spi0 {
diff --git a/6.12/target/linux/mediatek/patches-6.12/101-dts-update-mt7629-rfb.patch b/6.12/target/linux/mediatek/patches-6.12/101-dts-update-mt7629-rfb.patch
new file mode 100644
index 00000000..166d97ab
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/101-dts-update-mt7629-rfb.patch
@@ -0,0 +1,60 @@
+--- a/arch/arm/boot/dts/mediatek/mt7629-rfb.dts
++++ b/arch/arm/boot/dts/mediatek/mt7629-rfb.dts
+@@ -18,6 +18,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
++		bootargs = "earlycon=uart8250,mmio32,0x11002000 console=ttyS0,115200n8";
+ 	};
+ 
+ 	gpio-keys {
+@@ -70,6 +71,10 @@
+ 		compatible = "mediatek,eth-mac";
+ 		reg = <0>;
+ 		phy-mode = "2500base-x";
++
++		nvmem-cells = <&macaddr_factory_2a>;
++		nvmem-cell-names = "mac-address";
++
+ 		fixed-link {
+ 			speed = <2500>;
+ 			full-duplex;
+@@ -82,6 +87,9 @@
+ 		reg = <1>;
+ 		phy-mode = "gmii";
+ 		phy-handle = <&phy0>;
++
++		nvmem-cells = <&macaddr_factory_24>;
++		nvmem-cell-names = "mac-address";
+ 	};
+ 
+ 	mdio: mdio-bus {
+@@ -133,8 +141,9 @@
+ 			};
+ 
+ 			partition@b0000 {
+-				label = "kernel";
++				label = "firmware";
+ 				reg = <0xb0000 0xb50000>;
++				compatible = "denx,fit";
+ 			};
+ 		};
+ 	};
+@@ -273,3 +282,17 @@
+ 	pinctrl-0 = <&watchdog_pins>;
+ 	status = "okay";
+ };
++
++&factory {
++	compatible = "nvmem-cells";
++	#address-cells = <1>;
++	#size-cells = <1>;
++
++	macaddr_factory_24: macaddr@24 {
++		reg = <0x24 0x6>;
++	};
++
++	macaddr_factory_2a: macaddr@2a {
++		reg = <0x2a 0x6>;
++	};
++};
diff --git a/6.12/target/linux/mediatek/patches-6.12/103-mt7623-enable-arch-timer.patch b/6.12/target/linux/mediatek/patches-6.12/103-mt7623-enable-arch-timer.patch
new file mode 100644
index 00000000..04df7b92
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/103-mt7623-enable-arch-timer.patch
@@ -0,0 +1,20 @@
+From d6a596012150960f0f3a214d31bbac4b607dbd1e Mon Sep 17 00:00:00 2001
+From: Chuanhong Guo <gch981213@gmail.com>
+Date: Fri, 29 Apr 2022 10:40:56 +0800
+Subject: [PATCH] arm: mediatek: select arch timer for mt7623
+
+Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
+---
+ arch/arm/mach-mediatek/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/mach-mediatek/Kconfig
++++ b/arch/arm/mach-mediatek/Kconfig
+@@ -26,6 +26,7 @@ config MACH_MT6592
+ config MACH_MT7623
+ 	bool "MediaTek MT7623 SoCs support"
+ 	default ARCH_MEDIATEK
++	select HAVE_ARM_ARCH_TIMER
+ 
+ config MACH_MT7629
+ 	bool "MediaTek MT7629 SoCs support"
diff --git a/6.12/target/linux/mediatek/patches-6.12/104-mt7622-add-snor-irq.patch b/6.12/target/linux/mediatek/patches-6.12/104-mt7622-add-snor-irq.patch
new file mode 100644
index 00000000..d15d989e
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/104-mt7622-add-snor-irq.patch
@@ -0,0 +1,10 @@
+--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+@@ -575,6 +575,7 @@
+ 		compatible = "mediatek,mt7622-nor",
+ 			     "mediatek,mt8173-nor";
+ 		reg = <0 0x11014000 0 0xe0>;
++		interrupts = <GIC_SPI 88 IRQ_TYPE_LEVEL_LOW>;
+ 		clocks = <&pericfg CLK_PERI_FLASH_PD>,
+ 			 <&topckgen CLK_TOP_FLASH_SEL>;
+ 		clock-names = "spi", "sf";
diff --git a/6.12/target/linux/mediatek/patches-6.12/105-dts-mt7622-enable-pstore.patch b/6.12/target/linux/mediatek/patches-6.12/105-dts-mt7622-enable-pstore.patch
new file mode 100644
index 00000000..3e36a503
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/105-dts-mt7622-enable-pstore.patch
@@ -0,0 +1,16 @@
+--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+@@ -135,6 +135,13 @@
+ 		#size-cells = <2>;
+ 		ranges;
+ 
++		/* 64 KiB reserved for ramoops/pstore */
++		ramoops@42ff0000 {
++			compatible = "ramoops";
++			reg = <0 0x42ff0000 0 0x10000>;
++			record-size = <0x1000>;
++		};
++
+ 		/* 192 KiB reserved for ARM Trusted Firmware (BL31) */
+ 		secmon_reserved: secmon@43000000 {
+ 			reg = <0 0x43000000 0 0x30000>;
diff --git a/6.12/target/linux/mediatek/patches-6.12/106-dts-mt7622-disable_btif.patch b/6.12/target/linux/mediatek/patches-6.12/106-dts-mt7622-disable_btif.patch
new file mode 100644
index 00000000..ac8594b3
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/106-dts-mt7622-disable_btif.patch
@@ -0,0 +1,26 @@
+--- a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
+@@ -109,10 +109,6 @@
+ 	status = "disabled";
+ };
+ 
+-&btif {
+-	status = "okay";
+-};
+-
+ &cir {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&irrx_pins>;
+--- a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
+@@ -90,10 +90,6 @@
+ 	status = "disabled";
+ };
+ 
+-&btif {
+-	status = "okay";
+-};
+-
+ &cir {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&irrx_pins>;
diff --git a/6.12/target/linux/mediatek/patches-6.12/110-dts-fix-bpi2-console.patch b/6.12/target/linux/mediatek/patches-6.12/110-dts-fix-bpi2-console.patch
new file mode 100644
index 00000000..d96d3b95
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/110-dts-fix-bpi2-console.patch
@@ -0,0 +1,10 @@
+--- a/arch/arm/boot/dts/mediatek/mt7623n-bananapi-bpi-r2.dts
++++ b/arch/arm/boot/dts/mediatek/mt7623n-bananapi-bpi-r2.dts
+@@ -19,6 +19,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial2:115200n8";
++		bootargs = "console=ttyS2,115200n8 console=tty1";
+ 	};
+ 
+ 	connector {
diff --git a/6.12/target/linux/mediatek/patches-6.12/111-dts-fix-bpi64-console.patch b/6.12/target/linux/mediatek/patches-6.12/111-dts-fix-bpi64-console.patch
new file mode 100644
index 00000000..f77f10cb
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/111-dts-fix-bpi64-console.patch
@@ -0,0 +1,11 @@
+--- a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
+@@ -24,7 +24,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
+-		bootargs = "earlycon=uart8250,mmio32,0x11002000 swiotlb=512";
++		bootargs = "earlycon=uart8250,mmio32,0x11002000 console=ttyS0,115200n1 swiotlb=512";
+ 	};
+ 
+ 	cpus {
diff --git a/6.12/target/linux/mediatek/patches-6.12/112-dts-fix-bpi64-lan-names.patch b/6.12/target/linux/mediatek/patches-6.12/112-dts-fix-bpi64-lan-names.patch
new file mode 100644
index 00000000..7f97ef4a
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/112-dts-fix-bpi64-lan-names.patch
@@ -0,0 +1,37 @@
+--- a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
+@@ -20,6 +20,7 @@
+ 
+ 	aliases {
+ 		serial0 = &uart0;
++		ethernet0 = &gmac0;
+ 	};
+ 
+ 	chosen {
+@@ -165,22 +166,22 @@
+ 
+ 				port@1 {
+ 					reg = <1>;
+-					label = "lan0";
++					label = "lan1";
+ 				};
+ 
+ 				port@2 {
+ 					reg = <2>;
+-					label = "lan1";
++					label = "lan2";
+ 				};
+ 
+ 				port@3 {
+ 					reg = <3>;
+-					label = "lan2";
++					label = "lan3";
+ 				};
+ 
+ 				port@4 {
+ 					reg = <4>;
+-					label = "lan3";
++					label = "lan4";
+ 				};
+ 
+ 				port@6 {
diff --git a/6.12/target/linux/mediatek/patches-6.12/113-dts-fix-bpi64-leds-and-buttons.patch b/6.12/target/linux/mediatek/patches-6.12/113-dts-fix-bpi64-leds-and-buttons.patch
new file mode 100644
index 00000000..1cca6f35
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/113-dts-fix-bpi64-leds-and-buttons.patch
@@ -0,0 +1,49 @@
+--- a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
+@@ -21,6 +21,12 @@
+ 	aliases {
+ 		serial0 = &uart0;
+ 		ethernet0 = &gmac0;
++		led-boot = &led_system_green;
++		led-failsafe = &led_system_blue;
++		led-running = &led_system_green;
++		led-upgrade = &led_system_blue;
++		mmc0 = &mmc0;
++		mmc1 = &mmc1;
+ 	};
+ 
+ 	chosen {
+@@ -44,8 +50,8 @@
+ 		compatible = "gpio-keys";
+ 
+ 		factory-key {
+-			label = "factory";
+-			linux,code = <BTN_0>;
++			label = "reset";
++			linux,code = <KEY_RESTART>;
+ 			gpios = <&pio 0 GPIO_ACTIVE_HIGH>;
+ 		};
+ 
+@@ -59,17 +65,17 @@
+ 	leds {
+ 		compatible = "gpio-leds";
+ 
+-		led-0 {
++		led_system_green: led-0 {
+ 			label = "bpi-r64:pio:green";
+ 			color = <LED_COLOR_ID_GREEN>;
+ 			gpios = <&pio 89 GPIO_ACTIVE_HIGH>;
+ 			default-state = "off";
+ 		};
+ 
+-		led-1 {
+-			label = "bpi-r64:pio:red";
+-			color = <LED_COLOR_ID_RED>;
+-			gpios = <&pio 88 GPIO_ACTIVE_HIGH>;
++		led_system_blue: led-1 {
++			label = "bpi-r64:pio:blue";
++			color = <LED_COLOR_ID_BLUE>;
++			gpios = <&pio 85 GPIO_ACTIVE_HIGH>;
+ 			default-state = "off";
+ 		};
+ 	};
diff --git a/6.12/target/linux/mediatek/patches-6.12/114-dts-bpi64-disable-rtc.patch b/6.12/target/linux/mediatek/patches-6.12/114-dts-bpi64-disable-rtc.patch
new file mode 100644
index 00000000..50d30234
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/114-dts-bpi64-disable-rtc.patch
@@ -0,0 +1,13 @@
+--- a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
+@@ -588,6 +588,10 @@
+ 	status = "okay";
+ };
+ 
++&rtc {
++	status = "disabled";
++};
++
+ &sata {
+ 	status = "disabled";
+ };
diff --git a/6.12/target/linux/mediatek/patches-6.12/121-hack-spi-nand-1b-bbm.patch b/6.12/target/linux/mediatek/patches-6.12/121-hack-spi-nand-1b-bbm.patch
new file mode 100644
index 00000000..ff5521c4
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/121-hack-spi-nand-1b-bbm.patch
@@ -0,0 +1,20 @@
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -724,7 +724,7 @@ static int spinand_mtd_write(struct mtd_
+ static bool spinand_isbad(struct nand_device *nand, const struct nand_pos *pos)
+ {
+ 	struct spinand_device *spinand = nand_to_spinand(nand);
+-	u8 marker[2] = { };
++	u8 marker[1] = { };
+ 	struct nand_page_io_req req = {
+ 		.pos = *pos,
+ 		.ooblen = sizeof(marker),
+@@ -735,7 +735,7 @@ static bool spinand_isbad(struct nand_de
+ 
+ 	spinand_select_target(spinand, pos->target);
+ 	spinand_read_page(spinand, &req);
+-	if (marker[0] != 0xff || marker[1] != 0xff)
++	if (marker[0] != 0xff)
+ 		return true;
+ 
+ 	return false;
diff --git a/6.12/target/linux/mediatek/patches-6.12/130-dts-mt7629-add-snand-support.patch b/6.12/target/linux/mediatek/patches-6.12/130-dts-mt7629-add-snand-support.patch
new file mode 100644
index 00000000..c7cd525a
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/130-dts-mt7629-add-snand-support.patch
@@ -0,0 +1,94 @@
+From c813fbe806257c574240770ef716fbee19f7dbfa Mon Sep 17 00:00:00 2001
+From: Xiangsheng Hou <xiangsheng.hou@mediatek.com>
+Date: Thu, 6 Jun 2019 16:29:04 +0800
+Subject: [PATCH] spi: spi-mem: Mediatek: Add SPI Nand support for MT7629
+
+Signed-off-by: Xiangsheng Hou <xiangsheng.hou@mediatek.com>
+---
+ arch/arm/boot/dts/mediatek/mt7629-rfb.dts | 45 ++++++++++++++++++++++++++++++++
+ arch/arm/boot/dts/mediatek/mt7629.dtsi    | 22 ++++++++++++++++
+ 3 files changed, 79 insertions(+)
+
+--- a/arch/arm/boot/dts/mediatek/mt7629.dtsi
++++ b/arch/arm/boot/dts/mediatek/mt7629.dtsi
+@@ -271,6 +271,27 @@
+ 			status = "disabled";
+ 		};
+ 
++		snfi: spi@1100d000 {
++			compatible = "mediatek,mt7629-snand";
++			reg = <0x1100d000 0x1000>;
++			interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_LOW>;
++			clocks = <&pericfg CLK_PERI_NFI_PD>, <&pericfg CLK_PERI_SNFI_PD>;
++			clock-names = "nfi_clk", "pad_clk";
++			nand-ecc-engine = <&bch>;
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "disabled";
++		};
++
++		bch: ecc@1100e000 {
++			compatible = "mediatek,mt7622-ecc";
++			reg = <0x1100e000 0x1000>;
++			interrupts = <GIC_SPI 95 IRQ_TYPE_LEVEL_LOW>;
++			clocks = <&pericfg CLK_PERI_NFIECC_PD>;
++			clock-names = "nfiecc_clk";
++			status = "disabled";
++		};
++
+ 		spi: spi@1100a000 {
+ 			compatible = "mediatek,mt7629-spi",
+ 				     "mediatek,mt7622-spi";
+--- a/arch/arm/boot/dts/mediatek/mt7629-rfb.dts
++++ b/arch/arm/boot/dts/mediatek/mt7629-rfb.dts
+@@ -255,6 +255,50 @@
+ 	};
+ };
+ 
++&bch {
++	status = "okay";
++};
++
++&snfi {
++	pinctrl-names = "default";
++	pinctrl-0 = <&serial_nand_pins>;
++	status = "okay";
++	flash@0 {
++		compatible = "spi-nand";
++		reg = <0>;
++		spi-tx-bus-width = <4>;
++		spi-rx-bus-width = <4>;
++		nand-ecc-engine = <&snfi>;
++
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			partition@0 {
++				label = "Bootloader";
++				reg = <0x00000 0x0100000>;
++				read-only;
++			};
++
++			partition@100000 {
++				label = "Config";
++				reg = <0x100000 0x0040000>;
++			};
++
++			partition@140000 {
++				label = "factory";
++				reg = <0x140000 0x0080000>;
++			};
++
++			partition@1c0000 {
++				label = "firmware";
++				reg = <0x1c0000 0x1000000>;
++			};
++		};
++	};
++};
++
+ &spi {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&spi_pins>;
diff --git a/6.12/target/linux/mediatek/patches-6.12/131-dts-mt7622-add-snand-support.patch b/6.12/target/linux/mediatek/patches-6.12/131-dts-mt7622-add-snand-support.patch
new file mode 100644
index 00000000..d6e0ab1d
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/131-dts-mt7622-add-snand-support.patch
@@ -0,0 +1,68 @@
+--- a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
+@@ -534,6 +534,65 @@
+ 	status = "disabled";
+ };
+ 
++&bch {
++	status = "okay";
++};
++
++&snfi {
++	pinctrl-names = "default";
++	pinctrl-0 = <&serial_nand_pins>;
++	status = "okay";
++	flash@0 {
++		compatible = "spi-nand";
++		reg = <0>;
++		spi-tx-bus-width = <4>;
++		spi-rx-bus-width = <4>;
++		nand-ecc-engine = <&snfi>;
++
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			partition@0 {
++				label = "Preloader";
++				reg = <0x00000 0x0080000>;
++				read-only;
++			};
++
++			partition@80000 {
++				label = "ATF";
++				reg = <0x80000 0x0040000>;
++			};
++
++			partition@c0000 {
++				label = "Bootloader";
++				reg = <0xc0000 0x0080000>;
++			};
++
++			partition@140000 {
++				label = "Config";
++				reg = <0x140000 0x0080000>;
++			};
++
++			partition@1c0000 {
++				label = "Factory";
++				reg = <0x1c0000 0x0100000>;
++			};
++
++			partition@200000 {
++				label = "firmware";
++				reg = <0x2c0000 0x2000000>;
++			};
++
++			partition@2200000 {
++				label = "User_data";
++				reg = <0x22c0000 0x4000000>;
++			};
++		};
++	};
++};
++
+ &spi0 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&spic0_pins>;
diff --git a/6.12/target/linux/mediatek/patches-6.12/140-dts-fix-wmac-support-for-mt7622-rfb1.patch b/6.12/target/linux/mediatek/patches-6.12/140-dts-fix-wmac-support-for-mt7622-rfb1.patch
new file mode 100644
index 00000000..117d5abd
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/140-dts-fix-wmac-support-for-mt7622-rfb1.patch
@@ -0,0 +1,18 @@
+--- a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
+@@ -575,7 +575,7 @@
+ 				reg = <0x140000 0x0080000>;
+ 			};
+ 
+-			partition@1c0000 {
++			factory: partition@1c0000 {
+ 				label = "Factory";
+ 				reg = <0x1c0000 0x0100000>;
+ 			};
+@@ -636,5 +636,6 @@
+ &wmac {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&wmac_pins>;
++	mediatek,mtd-eeprom = <&factory 0x0000>;
+ 	status = "okay";
+ };
diff --git a/6.12/target/linux/mediatek/patches-6.12/150-dts-mt7623-eip97-inside-secure-support.patch b/6.12/target/linux/mediatek/patches-6.12/150-dts-mt7623-eip97-inside-secure-support.patch
new file mode 100644
index 00000000..d54e3ed1
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/150-dts-mt7623-eip97-inside-secure-support.patch
@@ -0,0 +1,24 @@
+--- a/arch/arm/boot/dts/mediatek/mt7623.dtsi
++++ b/arch/arm/boot/dts/mediatek/mt7623.dtsi
+@@ -995,17 +995,15 @@
+ 	};
+ 
+ 	crypto: crypto@1b240000 {
+-		compatible = "mediatek,eip97-crypto";
++		compatible = "inside-secure,safexcel-eip97";
+ 		reg = <0 0x1b240000 0 0x20000>;
+ 		interrupts = <GIC_SPI 82 IRQ_TYPE_LEVEL_LOW>,
+ 			     <GIC_SPI 83 IRQ_TYPE_LEVEL_LOW>,
+ 			     <GIC_SPI 84 IRQ_TYPE_LEVEL_LOW>,
+-			     <GIC_SPI 91 IRQ_TYPE_LEVEL_LOW>,
+-			     <GIC_SPI 97 IRQ_TYPE_LEVEL_LOW>;
++			     <GIC_SPI 91 IRQ_TYPE_LEVEL_LOW>;
++		interrupt-names = "ring0", "ring1", "ring2", "ring3";
+ 		clocks = <&ethsys CLK_ETHSYS_CRYPTO>;
+-		clock-names = "cryp";
+-		power-domains = <&scpsys MT2701_POWER_DOMAIN_ETH>;
+-		status = "disabled";
++		status = "okay";
+ 	};
+ 
+ 	bdpsys: syscon@1c000000 {
diff --git a/6.12/target/linux/mediatek/patches-6.12/160-dts-mt7623-bpi-r2-earlycon.patch b/6.12/target/linux/mediatek/patches-6.12/160-dts-mt7623-bpi-r2-earlycon.patch
new file mode 100644
index 00000000..5e02fb56
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/160-dts-mt7623-bpi-r2-earlycon.patch
@@ -0,0 +1,11 @@
+--- a/arch/arm/boot/dts/mediatek/mt7623n-bananapi-bpi-r2.dts
++++ b/arch/arm/boot/dts/mediatek/mt7623n-bananapi-bpi-r2.dts
+@@ -19,7 +19,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial2:115200n8";
+-		bootargs = "console=ttyS2,115200n8 console=tty1";
++		bootargs = "earlycon=uart8250,mmio32,0x11004000 console=ttyS2,115200n8 console=tty1";
+ 	};
+ 
+ 	connector {
diff --git a/6.12/target/linux/mediatek/patches-6.12/161-dts-mt7623-bpi-r2-mmc-device-order.patch b/6.12/target/linux/mediatek/patches-6.12/161-dts-mt7623-bpi-r2-mmc-device-order.patch
new file mode 100644
index 00000000..4b482199
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/161-dts-mt7623-bpi-r2-mmc-device-order.patch
@@ -0,0 +1,11 @@
+--- a/arch/arm/boot/dts/mediatek/mt7623n-bananapi-bpi-r2.dts
++++ b/arch/arm/boot/dts/mediatek/mt7623n-bananapi-bpi-r2.dts
+@@ -15,6 +15,8 @@
+ 
+ 	aliases {
+ 		serial2 = &uart2;
++		mmc0 = &mmc0;
++		mmc1 = &mmc1;
+ 	};
+ 
+ 	chosen {
diff --git a/6.12/target/linux/mediatek/patches-6.12/162-dts-mt7623-bpi-r2-led-aliases.patch b/6.12/target/linux/mediatek/patches-6.12/162-dts-mt7623-bpi-r2-led-aliases.patch
new file mode 100644
index 00000000..2d02a760
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/162-dts-mt7623-bpi-r2-led-aliases.patch
@@ -0,0 +1,29 @@
+--- a/arch/arm/boot/dts/mediatek/mt7623n-bananapi-bpi-r2.dts
++++ b/arch/arm/boot/dts/mediatek/mt7623n-bananapi-bpi-r2.dts
+@@ -17,6 +17,10 @@
+ 		serial2 = &uart2;
+ 		mmc0 = &mmc0;
+ 		mmc1 = &mmc1;
++		led-boot = &led_system_green;
++		led-failsafe = &led_system_blue;
++		led-running = &led_system_green;
++		led-upgrade = &led_system_blue;
+ 	};
+ 
+ 	chosen {
+@@ -112,13 +116,13 @@
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&led_pins_a>;
+ 
+-		blue {
++		led_system_blue: blue {
+ 			label = "bpi-r2:pio:blue";
+ 			gpios = <&pio 240 GPIO_ACTIVE_LOW>;
+ 			default-state = "off";
+ 		};
+ 
+-		green {
++		led_system_green: green {
+ 			label = "bpi-r2:pio:green";
+ 			gpios = <&pio 241 GPIO_ACTIVE_LOW>;
+ 			default-state = "off";
diff --git a/6.12/target/linux/mediatek/patches-6.12/163-dts-mt7623-bpi-r2-ethernet-alias.patch b/6.12/target/linux/mediatek/patches-6.12/163-dts-mt7623-bpi-r2-ethernet-alias.patch
new file mode 100644
index 00000000..b7e4a8c5
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/163-dts-mt7623-bpi-r2-ethernet-alias.patch
@@ -0,0 +1,10 @@
+--- a/arch/arm/boot/dts/mediatek/mt7623n-bananapi-bpi-r2.dts
++++ b/arch/arm/boot/dts/mediatek/mt7623n-bananapi-bpi-r2.dts
+@@ -15,6 +15,7 @@
+ 
+ 	aliases {
+ 		serial2 = &uart2;
++		ethernet0 = &gmac0;
+ 		mmc0 = &mmc0;
+ 		mmc1 = &mmc1;
+ 		led-boot = &led_system_green;
diff --git a/6.12/target/linux/mediatek/patches-6.12/164-dts-mt7623-bpi-r2-rootdisk-for-fitblk.patch b/6.12/target/linux/mediatek/patches-6.12/164-dts-mt7623-bpi-r2-rootdisk-for-fitblk.patch
new file mode 100644
index 00000000..fac14b4d
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/164-dts-mt7623-bpi-r2-rootdisk-for-fitblk.patch
@@ -0,0 +1,55 @@
+--- a/arch/arm/boot/dts/mediatek/mt7623n-bananapi-bpi-r2.dts
++++ b/arch/arm/boot/dts/mediatek/mt7623n-bananapi-bpi-r2.dts
+@@ -26,7 +26,9 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial2:115200n8";
+-		bootargs = "earlycon=uart8250,mmio32,0x11004000 console=ttyS2,115200n8 console=tty1";
++		bootargs = "root=/dev/fit0 rootwait earlycon=uart8250,mmio32,0x11004000 console=ttyS2,115200n8 console=tty1";
++		rootdisk-emmc = <&emmc_rootdisk>;
++		rootdisk-sd = <&sd_rootdisk>;
+ 	};
+ 
+ 	connector {
+@@ -338,6 +340,20 @@
+ 	vmmc-supply = <&reg_3p3v>;
+ 	vqmmc-supply = <&reg_1p8v>;
+ 	non-removable;
++
++	card@0 {
++		compatible = "mmc-card";
++		reg = <0>;
++
++		block {
++			compatible = "block-device";
++			partitions {
++				emmc_rootdisk: block-partition-fit {
++					partno = <3>;
++				};
++			};
++		};
++	};
+ };
+ 
+ &mmc1 {
+@@ -351,6 +367,20 @@
+ 	cd-gpios = <&pio 261 GPIO_ACTIVE_LOW>;
+ 	vmmc-supply = <&reg_3p3v>;
+ 	vqmmc-supply = <&reg_3p3v>;
++
++	card@0 {
++		compatible = "mmc-card";
++		reg = <0>;
++
++		block {
++			compatible = "block-device";
++			partitions {
++				sd_rootdisk: block-partition-fit {
++					partno = <3>;
++				};
++			};
++		};
++	};
+ };
+ 
+ &mt6323keys {
diff --git a/6.12/target/linux/mediatek/patches-6.12/190-arm64-dts-mediatek-mt7622-fix-GICv2-range.patch b/6.12/target/linux/mediatek/patches-6.12/190-arm64-dts-mediatek-mt7622-fix-GICv2-range.patch
new file mode 100644
index 00000000..bf682314
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/190-arm64-dts-mediatek-mt7622-fix-GICv2-range.patch
@@ -0,0 +1,106 @@
+From patchwork Tue Apr 26 19:51:36 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12827872
+Return-Path: 
+ <linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from bombadil.infradead.org (bombadil.infradead.org
+ [198.137.202.133])
+	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
+	(No client certificate requested)
+	by smtp.lore.kernel.org (Postfix) with ESMTPS id BACF3C433EF
+	for <linux-arm-kernel@archiver.kernel.org>;
+ Tue, 26 Apr 2022 19:53:05 +0000 (UTC)
+DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
+	d=lists.infradead.org; s=bombadil.20210309; h=Sender:
+	Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post:
+	List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:Subject:Cc:To:
+	From:Date:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:
+	Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:
+	List-Owner; bh=OWGSxvlKoyPWz6b629RNINucULo6oOdFssAIiJETWRg=; b=T0HEjee0FX3hlb
+	x5jl7xLK5sKM0pkE2oRgwzthbFlNg8ST1j/2GkgcgT0S2Bi0vRfFxHeu/RKzS9RmiVnKJnPGL8ctg
+	WoBLyO5i+NcmosGoy6MmoOjGTNhj/+3q3Z1jRLBSJ4ySSP22X77YeuJTmVzySPUllQhWvDhjMVCR9
+	QBRmQdc6gCAg3IYGEbWwS2TG+UHveDCeZRWxMzrwI8UPadNCRFROwugmiQ3mdU41lHCTDpnlfuRJh
+	o1igLKfMBLz+D8rFYvDh7FfkcKkY6lNoswA2HKUun1MEzgoyQKmITPnG2maX/BvJJuj/B3ZJShh4k
+	AZHmXoQxq1mrsm2FxfnQ==;
+Received: from localhost ([::1] helo=bombadil.infradead.org)
+	by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux))
+	id 1njRE5-00G05D-9z; Tue, 26 Apr 2022 19:51:57 +0000
+Received: from fudo.makrotopia.org ([2a07:2ec0:3002::71])
+ by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux))
+ id 1njRE1-00G03h-9H; Tue, 26 Apr 2022 19:51:55 +0000
+Received: from local
+ by fudo.makrotopia.org with esmtpsa (TLS1.3:TLS_AES_256_GCM_SHA384:256)
+ (Exim 4.94.2) (envelope-from <daniel@makrotopia.org>)
+ id 1njRDu-0006aF-4F; Tue, 26 Apr 2022 21:51:46 +0200
+Date: Tue, 26 Apr 2022 20:51:36 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: devicetree@vger.kernel.org, linux-mediatek@lists.infradead.org,
+ linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org
+Cc: Rob Herring <robh+dt@kernel.org>,
+ Krzysztof Kozlowski <krzysztof.kozlowski+dt@linaro.org>,
+ Matthias Brugger <matthias.bgg@gmail.com>
+Subject: [PATCH] arm64: dts: mediatek: mt7622: fix GICv2 range
+Message-ID: <YmhNSLgp/yg8Vr1F@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 
+X-CRM114-CacheID: sfid-20220426_125153_359242_EA3D452C 
+X-CRM114-Status: GOOD (  12.45  )
+X-BeenThere: linux-arm-kernel@lists.infradead.org
+X-Mailman-Version: 2.1.34
+Precedence: list
+List-Id: <linux-arm-kernel.lists.infradead.org>
+List-Unsubscribe: 
+ <http://lists.infradead.org/mailman/options/linux-arm-kernel>,
+ <mailto:linux-arm-kernel-request@lists.infradead.org?subject=unsubscribe>
+List-Archive: <http://lists.infradead.org/pipermail/linux-arm-kernel/>
+List-Post: <mailto:linux-arm-kernel@lists.infradead.org>
+List-Help: <mailto:linux-arm-kernel-request@lists.infradead.org?subject=help>
+List-Subscribe: 
+ <http://lists.infradead.org/mailman/listinfo/linux-arm-kernel>,
+ <mailto:linux-arm-kernel-request@lists.infradead.org?subject=subscribe>
+Sender: "linux-arm-kernel" <linux-arm-kernel-bounces@lists.infradead.org>
+Errors-To: 
+ linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org
+
+With the current range specified for the CPU interface there is an
+error message at boot:
+
+GIC: GICv2 detected, but range too small and irqchip.gicv2_force_probe not set
+
+Setting irqchip.gicv2_force_probe=1 in bootargs results in:
+
+GIC: Aliased GICv2 at 0x0000000010320000, trying to find the canonical range over 128kB
+GIC: Adjusting CPU interface base to 0x000000001032f000
+GIC: Using split EOI/Deactivate mode
+
+Using the adjusted CPU interface base and 8K size results in only the
+final line remaining and fully working system as well as /proc/interrupts
+showing additional IPI3,4,5,6:
+
+IPI3:         0          0       CPU stop (for crash dump) interrupts
+IPI4:         0          0       Timer broadcast interrupts
+IPI5:         0          0       IRQ work interrupts
+IPI6:         0          0       CPU wake-up interrupts
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ arch/arm64/boot/dts/mediatek/mt7622.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+@@ -345,7 +345,7 @@
+ 		#interrupt-cells = <3>;
+ 		interrupt-parent = <&gic>;
+ 		reg = <0 0x10310000 0 0x1000>,
+-		      <0 0x10320000 0 0x1000>,
++		      <0 0x1032f000 0 0x2000>,
+ 		      <0 0x10340000 0 0x2000>,
+ 		      <0 0x10360000 0 0x2000>;
+ 	};
diff --git a/6.12/target/linux/mediatek/patches-6.12/193-dts-mt7623-thermal_zone_fix.patch b/6.12/target/linux/mediatek/patches-6.12/193-dts-mt7623-thermal_zone_fix.patch
new file mode 100644
index 00000000..da9ba5f3
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/193-dts-mt7623-thermal_zone_fix.patch
@@ -0,0 +1,48 @@
+From 824d56e753a588fcfd650db1822e34a02a48bb77 Mon Sep 17 00:00:00 2001
+From: Bruno Umuarama <anonimou_eu@hotmail.com>
+Date: Thu, 13 Oct 2022 21:18:21 +0000
+Subject: [PATCH] mediatek: mt7623: fix thermal zone
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Raising the temperatures for passive and active trips. @VA1DER
+proposed at issue 9396 to remove passive trip. This commit relates to
+his suggestion.
+
+Without this patch. the CPU will be throttled all the way down to 98MHz
+if the temperature rises even a degree above the trip point, and it was
+further discovered that if the internal temperature of the device is
+above the first trip point temperature when it boots then it will start
+in a throttled state and even
+$ echo disabled > /sys/class/thermal/thermal_zone0/mode
+will have no effect.
+
+The patch increases the passive trip point and active cooling map. The
+throttling temperature will then be at 77°C and 82°C, which is still a
+low enough temperature for ARM devices to not be in the real danger
+zone, and gives some operational headroom.
+
+Signed-off-by: Bruno Umuarama <anonimou_eu@hotmail.com>
+---
+ arch/arm/boot/dts/mediatek/mt7623.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/mediatek/mt7623.dtsi
++++ b/arch/arm/boot/dts/mediatek/mt7623.dtsi
+@@ -160,13 +160,13 @@
+ 
+ 				trips {
+ 					cpu_passive: cpu-passive {
+-						temperature = <57000>;
++						temperature = <77000>;
+ 						hysteresis = <2000>;
+ 						type = "passive";
+ 					};
+ 
+ 					cpu_active: cpu-active {
+-						temperature = <67000>;
++						temperature = <82000>;
+ 						hysteresis = <2000>;
+ 						type = "active";
+ 					};
diff --git a/6.12/target/linux/mediatek/patches-6.12/194-dts-mt7968a-add-ramoops.patch b/6.12/target/linux/mediatek/patches-6.12/194-dts-mt7968a-add-ramoops.patch
new file mode 100644
index 00000000..161c1e75
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/194-dts-mt7968a-add-ramoops.patch
@@ -0,0 +1,17 @@
+--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+@@ -68,6 +68,14 @@
+ 		#address-cells = <2>;
+ 		#size-cells = <2>;
+ 		ranges;
++
++		/* 64 KiB reserved for ramoops/pstore */
++		ramoops@42ff0000 {
++			compatible = "ramoops";
++			reg = <0 0x42ff0000 0 0x10000>;
++			record-size = <0x1000>;
++		};
++
+ 		/* 192 KiB reserved for ARM Trusted Firmware (BL31) */
+ 		secmon_reserved: secmon@43000000 {
+ 			reg = <0 0x43000000 0 0x30000>;
diff --git a/6.12/target/linux/mediatek/patches-6.12/200-phy-phy-mtk-tphy-Add-hifsys-support.patch b/6.12/target/linux/mediatek/patches-6.12/200-phy-phy-mtk-tphy-Add-hifsys-support.patch
new file mode 100644
index 00000000..e07aa566
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/200-phy-phy-mtk-tphy-Add-hifsys-support.patch
@@ -0,0 +1,66 @@
+From 28f9a5e2a3f5441ab5594669ed82da11e32277a9 Mon Sep 17 00:00:00 2001
+From: Kristian Evensen <kristian.evensen@gmail.com>
+Date: Mon, 30 Apr 2018 14:38:01 +0200
+Subject: [PATCH] phy: phy-mtk-tphy: Add hifsys-support
+
+---
+ drivers/phy/mediatek/phy-mtk-tphy.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+--- a/drivers/phy/mediatek/phy-mtk-tphy.c
++++ b/drivers/phy/mediatek/phy-mtk-tphy.c
+@@ -18,6 +18,8 @@
+ #include <linux/phy/phy.h>
+ #include <linux/platform_device.h>
+ #include <linux/regmap.h>
++#include <linux/mfd/syscon.h>
++#include <linux/regmap.h>
+ 
+ #include "phy-mtk-io.h"
+ 
+@@ -267,6 +269,9 @@
+ 
+ #define USER_BUF_LEN(count) min_t(size_t, 8, (count))
+ 
++#define HIF_SYSCFG1			0x14
++#define HIF_SYSCFG1_PHY2_MASK		(0x3 << 20)
++
+ enum mtk_phy_version {
+ 	MTK_PHY_V1 = 1,
+ 	MTK_PHY_V2,
+@@ -334,6 +339,7 @@ struct mtk_tphy {
+ 	void __iomem *sif_base;	/* only shared sif */
+ 	const struct mtk_phy_pdata *pdata;
+ 	struct mtk_phy_instance **phys;
++	struct regmap *hif;
+ 	int nphys;
+ 	int src_ref_clk; /* MHZ, reference clock for slew rate calibrate */
+ 	int src_coef; /* coefficient for slew rate calibrate */
+@@ -951,6 +957,10 @@ static void pcie_phy_instance_init(struc
+ 	if (tphy->pdata->version != MTK_PHY_V1)
+ 		return;
+ 
++	if (tphy->hif)
++		regmap_update_bits(tphy->hif, HIF_SYSCFG1,
++				   HIF_SYSCFG1_PHY2_MASK, 0);
++
+ 	mtk_phy_update_bits(phya + U3P_U3_PHYA_DA_REG0,
+ 			    P3A_RG_XTAL_EXT_PE1H | P3A_RG_XTAL_EXT_PE2H,
+ 			    FIELD_PREP(P3A_RG_XTAL_EXT_PE1H, 0x2) |
+@@ -1597,6 +1607,16 @@ static int mtk_tphy_probe(struct platfor
+ 					 &tphy->src_coef);
+ 	}
+ 
++	if (of_find_property(np, "mediatek,phy-switch", NULL)) {
++		tphy->hif = syscon_regmap_lookup_by_phandle(np,
++							    "mediatek,phy-switch");
++		if (IS_ERR(tphy->hif)) {
++			dev_err(&pdev->dev,
++				"missing \"mediatek,phy-switch\" phandle\n");
++			return PTR_ERR(tphy->hif);
++		}
++	}
++
+ 	port = 0;
+ 	for_each_child_of_node(np, child_np) {
+ 		struct mtk_phy_instance *instance;
diff --git a/6.12/target/linux/mediatek/patches-6.12/240-pinctrl-mediatek-add-support-for-MT7988-SoC.patch b/6.12/target/linux/mediatek/patches-6.12/240-pinctrl-mediatek-add-support-for-MT7988-SoC.patch
new file mode 100644
index 00000000..c63510b5
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/240-pinctrl-mediatek-add-support-for-MT7988-SoC.patch
@@ -0,0 +1,26 @@
+--- a/drivers/pinctrl/mediatek/Kconfig
++++ b/drivers/pinctrl/mediatek/Kconfig
+@@ -187,6 +187,13 @@ config PINCTRL_MT7986
+ 	default ARM64 && ARCH_MEDIATEK
+ 	select PINCTRL_MTK_MOORE
+ 
++config PINCTRL_MT7988
++	bool "Mediatek MT7988 pin control"
++	depends on OF
++	depends on ARM64 || COMPILE_TEST
++	default ARCH_MEDIATEK
++	select PINCTRL_MTK_MOORE
++
+ config PINCTRL_MT8167
+ 	bool "MediaTek MT8167 pin control"
+ 	depends on OF
+--- a/drivers/pinctrl/mediatek/Makefile
++++ b/drivers/pinctrl/mediatek/Makefile
+@@ -27,6 +27,7 @@ obj-$(CONFIG_PINCTRL_MT7623)		+= pinctrl
+ obj-$(CONFIG_PINCTRL_MT7629)		+= pinctrl-mt7629.o
+ obj-$(CONFIG_PINCTRL_MT7981)		+= pinctrl-mt7981.o
+ obj-$(CONFIG_PINCTRL_MT7986)		+= pinctrl-mt7986.o
++obj-$(CONFIG_PINCTRL_MT7988)		+= pinctrl-mt7988.o
+ obj-$(CONFIG_PINCTRL_MT8167)		+= pinctrl-mt8167.o
+ obj-$(CONFIG_PINCTRL_MT8173)		+= pinctrl-mt8173.o
+ obj-$(CONFIG_PINCTRL_MT8183)		+= pinctrl-mt8183.o
diff --git a/6.12/target/linux/mediatek/patches-6.12/330-snand-mtk-bmt-support.patch b/6.12/target/linux/mediatek/patches-6.12/330-snand-mtk-bmt-support.patch
new file mode 100644
index 00000000..de8e8806
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/330-snand-mtk-bmt-support.patch
@@ -0,0 +1,34 @@
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -19,6 +19,7 @@
+ #include <linux/string.h>
+ #include <linux/spi/spi.h>
+ #include <linux/spi/spi-mem.h>
++#include <linux/mtd/mtk_bmt.h>
+ 
+ static int spinand_read_reg_op(struct spinand_device *spinand, u8 reg, u8 *val)
+ {
+@@ -1346,6 +1347,7 @@ static int spinand_probe(struct spi_mem
+ 	if (ret)
+ 		return ret;
+ 
++	mtk_bmt_attach(mtd);
+ 	ret = mtd_device_register(mtd, NULL, 0);
+ 	if (ret)
+ 		goto err_spinand_cleanup;
+@@ -1353,6 +1355,7 @@ static int spinand_probe(struct spi_mem
+ 	return 0;
+ 
+ err_spinand_cleanup:
++	mtk_bmt_detach(mtd);
+ 	spinand_cleanup(spinand);
+ 
+ 	return ret;
+@@ -1371,6 +1374,7 @@ static int spinand_remove(struct spi_mem
+ 	if (ret)
+ 		return ret;
+ 
++	mtk_bmt_detach(mtd);
+ 	spinand_cleanup(spinand);
+ 
+ 	return 0;
diff --git a/6.12/target/linux/mediatek/patches-6.12/331-mt7622-rfb1-enable-bmt.patch b/6.12/target/linux/mediatek/patches-6.12/331-mt7622-rfb1-enable-bmt.patch
new file mode 100644
index 00000000..3e956701
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/331-mt7622-rfb1-enable-bmt.patch
@@ -0,0 +1,10 @@
+--- a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
+@@ -548,6 +548,7 @@
+ 		spi-tx-bus-width = <4>;
+ 		spi-rx-bus-width = <4>;
+ 		nand-ecc-engine = <&snfi>;
++		mediatek,bmt-v2;
+ 
+ 		partitions {
+ 			compatible = "fixed-partitions";
diff --git a/6.12/target/linux/mediatek/patches-6.12/351-pinctrl-add-mt7988-pd-pulltype-support.patch b/6.12/target/linux/mediatek/patches-6.12/351-pinctrl-add-mt7988-pd-pulltype-support.patch
new file mode 100644
index 00000000..fb65adb0
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/351-pinctrl-add-mt7988-pd-pulltype-support.patch
@@ -0,0 +1,99 @@
+--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
+@@ -601,6 +601,30 @@ out:
+ 	return err;
+ }
+ 
++static int mtk_pinconf_bias_set_pd(struct mtk_pinctrl *hw,
++				const struct mtk_pin_desc *desc,
++				u32 pullup, u32 arg)
++{
++    int err, pd;
++
++	if (arg == MTK_DISABLE)
++		pd = 0;
++	else if ((arg == MTK_ENABLE) && pullup)
++		pd = 0;
++	else if ((arg == MTK_ENABLE) && !pullup)
++		pd = 1;
++	else {
++		err = -EINVAL;
++		goto out;
++	}
++
++	err = mtk_hw_set_value(hw, desc, PINCTRL_PIN_REG_PD, pd);
++
++out:
++	return err;
++
++}
++
+ static int mtk_pinconf_bias_set_pullsel_pullen(struct mtk_pinctrl *hw,
+ 				const struct mtk_pin_desc *desc,
+ 				u32 pullup, u32 arg)
+@@ -758,6 +782,12 @@ int mtk_pinconf_bias_set_combo(struct mt
+ 			return 0;
+ 	}
+ 
++	if (try_all_type & MTK_PULL_PD_TYPE) {
++		err = mtk_pinconf_bias_set_pd(hw, desc, pullup, arg);
++		if (!err)
++			return err;
++    }
++
+ 	if (try_all_type & MTK_PULL_PU_PD_TYPE) {
+ 		err = mtk_pinconf_bias_set_pu_pd(hw, desc, pullup, arg);
+ 		if (!err)
+@@ -878,6 +908,29 @@ out:
+ 	return err;
+ }
+ 
++static int mtk_pinconf_bias_get_pd(struct mtk_pinctrl *hw,
++				const struct mtk_pin_desc *desc,
++				u32 *pullup, u32 *enable)
++{
++	int err, pd;
++
++	err = mtk_hw_get_value(hw, desc, PINCTRL_PIN_REG_PD, &pd);
++	if (err)
++		goto out;
++
++	if (pd == 0) {
++		*pullup = 0;
++		*enable = MTK_DISABLE;
++	} else if (pd == 1) {
++		*pullup = 0;
++		*enable = MTK_ENABLE;
++	} else
++		err = -EINVAL;
++
++out:
++	return err;
++}
++
+ static int mtk_pinconf_bias_get_pullsel_pullen(struct mtk_pinctrl *hw,
+ 				const struct mtk_pin_desc *desc,
+ 				u32 *pullup, u32 *enable)
+@@ -947,6 +1000,12 @@ int mtk_pinconf_bias_get_combo(struct mt
+ 			return 0;
+ 	}
+ 
++	if (try_all_type & MTK_PULL_PD_TYPE) {
++		err = mtk_pinconf_bias_get_pd(hw, desc, pullup, enable);
++		if (!err)
++			return err;
++	}
++
+ 	if (try_all_type & MTK_PULL_PU_PD_TYPE) {
+ 		err = mtk_pinconf_bias_get_pu_pd(hw, desc, pullup, enable);
+ 		if (!err)
+--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.h
++++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.h
+@@ -24,6 +24,7 @@
+  * turned on/off itself. But it can't be selected pull up/down
+  */
+ #define MTK_PULL_RSEL_TYPE		BIT(3)
++#define MTK_PULL_PD_TYPE        BIT(4)
+ /* MTK_PULL_PU_PD_RSEL_TYPE is a type which is controlled by
+  * MTK_PULL_PU_PD_TYPE and MTK_PULL_RSEL_TYPE.
+  */
diff --git a/6.12/target/linux/mediatek/patches-6.12/400-crypto-add-eip97-inside-secure-support.patch b/6.12/target/linux/mediatek/patches-6.12/400-crypto-add-eip97-inside-secure-support.patch
new file mode 100644
index 00000000..5808a934
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/400-crypto-add-eip97-inside-secure-support.patch
@@ -0,0 +1,27 @@
+--- a/drivers/crypto/inside-secure/safexcel.c
++++ b/drivers/crypto/inside-secure/safexcel.c
+@@ -608,6 +608,14 @@ static int safexcel_hw_init(struct safex
+ 		val |= EIP197_MST_CTRL_TX_MAX_CMD(5);
+ 		writel(val, EIP197_HIA_AIC(priv) + EIP197_HIA_MST_CTRL);
+ 	}
++	/*
++	 * Set maximum number of TX commands to 2^4 = 16 for EIP97 HW2.1/HW2.3
++	 */
++	else {
++		val = 0;
++		val |= EIP97_MST_CTRL_TX_MAX_CMD(4);
++		writel(val, EIP197_HIA_AIC(priv) + EIP197_HIA_MST_CTRL);
++	}
+ 
+ 	/* Configure wr/rd cache values */
+ 	writel(EIP197_MST_CTRL_RD_CACHE(RD_CACHE_4BITS) |
+--- a/drivers/crypto/inside-secure/safexcel.h
++++ b/drivers/crypto/inside-secure/safexcel.h
+@@ -315,6 +315,7 @@
+ #define EIP197_MST_CTRL_RD_CACHE(n)		(((n) & 0xf) << 0)
+ #define EIP197_MST_CTRL_WD_CACHE(n)		(((n) & 0xf) << 4)
+ #define EIP197_MST_CTRL_TX_MAX_CMD(n)		(((n) & 0xf) << 20)
++#define EIP97_MST_CTRL_TX_MAX_CMD(n)		(((n) & 0xf) << 4)
+ #define EIP197_MST_CTRL_BYTE_SWAP		BIT(24)
+ #define EIP197_MST_CTRL_NO_BYTE_SWAP		BIT(25)
+ #define EIP197_MST_CTRL_BYTE_SWAP_BITS          GENMASK(25, 24)
diff --git a/6.12/target/linux/mediatek/patches-6.12/401-crypto-fix-eip97-cache-incoherent.patch b/6.12/target/linux/mediatek/patches-6.12/401-crypto-fix-eip97-cache-incoherent.patch
new file mode 100644
index 00000000..bd22b369
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/401-crypto-fix-eip97-cache-incoherent.patch
@@ -0,0 +1,26 @@
+--- a/drivers/crypto/inside-secure/safexcel.h
++++ b/drivers/crypto/inside-secure/safexcel.h
+@@ -743,6 +743,9 @@ struct safexcel_priv_data {
+ /* Priority we use for advertising our algorithms */
+ #define SAFEXCEL_CRA_PRIORITY		300
+ 
++/* System cache line size */
++#define SYSTEM_CACHELINE_SIZE		64
++
+ /* SM3 digest result for zero length message */
+ #define EIP197_SM3_ZEROM_HASH	"\x1A\xB2\x1D\x83\x55\xCF\xA1\x7F" \
+ 				"\x8E\x61\x19\x48\x31\xE8\x1A\x8F" \
+--- a/drivers/crypto/inside-secure/safexcel_hash.c
++++ b/drivers/crypto/inside-secure/safexcel_hash.c
+@@ -55,9 +55,9 @@ struct safexcel_ahash_req {
+ 	u8 block_sz;    /* block size, only set once */
+ 	u8 digest_sz;   /* output digest size, only set once */
+ 	__le32 state[SHA3_512_BLOCK_SIZE /
+-		     sizeof(__le32)] __aligned(sizeof(__le32));
++		     sizeof(__le32)] __aligned(SYSTEM_CACHELINE_SIZE);
+ 
+-	u64 len;
++	u64 len __aligned(SYSTEM_CACHELINE_SIZE);
+ 	u64 processed;
+ 
+ 	u8 cache[HASH_CACHE_SIZE] __aligned(sizeof(u32));
diff --git a/6.12/target/linux/mediatek/patches-6.12/410-bt-mtk-serial-fix.patch b/6.12/target/linux/mediatek/patches-6.12/410-bt-mtk-serial-fix.patch
new file mode 100644
index 00000000..53e92a6d
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/410-bt-mtk-serial-fix.patch
@@ -0,0 +1,33 @@
+--- a/drivers/tty/serial/8250/8250.h
++++ b/drivers/tty/serial/8250/8250.h
+@@ -86,6 +86,7 @@ struct serial8250_config {
+ 					 * STOP PARITY EPAR SPAR WLEN5 WLEN6
+ 					 */
+ #define UART_CAP_NOTEMT	BIT(18)	/* UART without interrupt on TEMT available */
++#define UART_CAP_NMOD	BIT(19)	/* UART doesn't do termios */
+ 
+ #define UART_BUG_QUOT	BIT(0)	/* UART has buggy quot LSB */
+ #define UART_BUG_TXEN	BIT(1)	/* UART has buggy TX IIR status */
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -287,7 +287,7 @@ static const struct serial8250_config ua
+ 		.tx_loadsz	= 16,
+ 		.fcr		= UART_FCR_ENABLE_FIFO |
+ 				  UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT,
+-		.flags		= UART_CAP_FIFO,
++		.flags		= UART_CAP_FIFO | UART_CAP_NMOD,
+ 	},
+ 	[PORT_NPCM] = {
+ 		.name		= "Nuvoton 16550",
+@@ -2774,6 +2774,11 @@ serial8250_do_set_termios(struct uart_po
+ 	unsigned long flags;
+ 	unsigned int baud, quot, frac = 0;
+ 
++	if (up->capabilities & UART_CAP_NMOD) {
++		termios->c_cflag = 0;
++		return;
++	}
++
+ 	if (up->capabilities & UART_CAP_MINI) {
+ 		termios->c_cflag &= ~(CSTOPB | PARENB | PARODD | CMSPAR);
+ 		if ((termios->c_cflag & CSIZE) == CS5 ||
diff --git a/6.12/target/linux/mediatek/patches-6.12/432-drivers-spi-Add-support-for-dynamic-calibration.patch b/6.12/target/linux/mediatek/patches-6.12/432-drivers-spi-Add-support-for-dynamic-calibration.patch
new file mode 100644
index 00000000..5bb07d2f
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/432-drivers-spi-Add-support-for-dynamic-calibration.patch
@@ -0,0 +1,234 @@
+From 2ade0172154e50c8a2bfd8634c6eff943cffea29 Mon Sep 17 00:00:00 2001
+From: "SkyLake.Huang" <skylake.huang@mediatek.com>
+Date: Thu, 23 Jun 2022 18:35:52 +0800
+Subject: [PATCH 2/6] drivers: spi: Add support for dynamic calibration
+
+Signed-off-by: SkyLake.Huang <skylake.huang@mediatek.com>
+---
+ drivers/spi/spi.c       | 137 ++++++++++++++++++++++++++++++++++++++++
+ include/linux/spi/spi.h |  42 ++++++++++++
+ 2 files changed, 179 insertions(+)
+
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -1370,6 +1370,70 @@ static int spi_transfer_wait(struct spi_
+ 	return 0;
+ }
+ 
++int spi_do_calibration(struct spi_controller *ctlr, struct spi_device *spi,
++	int (*cal_read)(void *priv, u32 *addr, int addrlen, u8 *buf, int readlen), void *drv_priv)
++{
++	int datalen = ctlr->cal_rule->datalen;
++	int addrlen = ctlr->cal_rule->addrlen;
++	u8 *buf;
++	int ret;
++	int i;
++	struct list_head *cal_head, *listptr;
++	struct spi_cal_target *target;
++
++	/* Calculate calibration result */
++	int hit_val, total_hit, origin;
++	bool hit;
++
++	/* Make sure we can start calibration */
++	if(!ctlr->cal_target || !ctlr->cal_rule || !ctlr->append_caldata)
++		return 0;
++
++	buf = kzalloc(datalen * sizeof(u8), GFP_KERNEL);
++	if(!buf)
++		return -ENOMEM;
++
++	ret = ctlr->append_caldata(ctlr);
++	if (ret)
++		goto cal_end;
++
++	cal_head = ctlr->cal_target;
++	list_for_each(listptr, cal_head) {
++		target = list_entry(listptr, struct spi_cal_target, list);
++
++		hit = false;
++		hit_val = 0;
++		total_hit = 0;
++		origin = *target->cal_item;
++
++		for(i=target->cal_min; i<=target->cal_max; i+=target->step) {
++			*target->cal_item = i;
++			ret = (*cal_read)(drv_priv, ctlr->cal_rule->addr, addrlen, buf, datalen);
++			if(ret)
++				break;
++			dev_dbg(&spi->dev, "controller cal item value: 0x%x\n", i);
++			if(memcmp(ctlr->cal_rule->match_data, buf, datalen * sizeof(u8)) == 0) {
++				hit = true;
++				hit_val += i;
++				total_hit++;
++				dev_dbg(&spi->dev, "golden data matches data read!\n");
++			}
++		}
++		if(hit) {
++			*target->cal_item = DIV_ROUND_CLOSEST(hit_val, total_hit);
++			dev_info(&spi->dev, "calibration result: 0x%x", *target->cal_item);
++		} else {
++			*target->cal_item = origin;
++			dev_warn(&spi->dev, "calibration failed, fallback to default: 0x%x", origin);
++		}
++	}
++
++cal_end:
++	kfree(buf);
++	return ret? ret: 0;
++}
++EXPORT_SYMBOL_GPL(spi_do_calibration);
++
+ static void _spi_transfer_delay_ns(u32 ns)
+ {
+ 	if (!ns)
+@@ -2215,6 +2279,75 @@ void spi_flush_queue(struct spi_controll
+ /*-------------------------------------------------------------------------*/
+ 
+ #if defined(CONFIG_OF)
++static inline void alloc_cal_data(struct list_head **cal_target,
++	struct spi_cal_rule **cal_rule, bool enable)
++{
++	if(enable) {
++		*cal_target = kmalloc(sizeof(struct list_head), GFP_KERNEL);
++		INIT_LIST_HEAD(*cal_target);
++		*cal_rule = kmalloc(sizeof(struct spi_cal_rule), GFP_KERNEL);
++	} else {
++		kfree(*cal_target);
++		kfree(*cal_rule);
++	}
++}
++
++static int of_spi_parse_cal_dt(struct spi_controller *ctlr, struct spi_device *spi,
++			   struct device_node *nc)
++{
++	u32 value;
++	int rc;
++	const char *cal_mode;
++
++	rc = of_property_read_bool(nc, "spi-cal-enable");
++	if (rc)
++		alloc_cal_data(&ctlr->cal_target, &ctlr->cal_rule, true);
++	else
++		return 0;
++
++	rc = of_property_read_string(nc, "spi-cal-mode", &cal_mode);
++	if(!rc) {
++		if(strcmp("read-data", cal_mode) == 0){
++			ctlr->cal_rule->mode = SPI_CAL_READ_DATA;
++		} else if(strcmp("read-pp", cal_mode) == 0) {
++			ctlr->cal_rule->mode = SPI_CAL_READ_PP;
++			return 0;
++		} else if(strcmp("read-sfdp", cal_mode) == 0){
++			ctlr->cal_rule->mode = SPI_CAL_READ_SFDP;
++			return 0;
++		}
++	} else
++		goto err;
++
++	ctlr->cal_rule->datalen = 0;
++	rc = of_property_read_u32(nc, "spi-cal-datalen", &value);
++	if(!rc && value > 0) {
++		ctlr->cal_rule->datalen = value;
++
++		ctlr->cal_rule->match_data = kzalloc(value * sizeof(u8), GFP_KERNEL);
++		rc = of_property_read_u8_array(nc, "spi-cal-data",
++				ctlr->cal_rule->match_data, value);
++		if(rc)
++			kfree(ctlr->cal_rule->match_data);
++	}
++
++	rc = of_property_read_u32(nc, "spi-cal-addrlen", &value);
++	if(!rc && value > 0) {
++		ctlr->cal_rule->addrlen = value;
++
++		ctlr->cal_rule->addr = kzalloc(value * sizeof(u32), GFP_KERNEL);
++		rc = of_property_read_u32_array(nc, "spi-cal-addr",
++				ctlr->cal_rule->addr, value);
++		if(rc)
++			kfree(ctlr->cal_rule->addr);
++	}
++	return 0;
++
++err:
++	alloc_cal_data(&ctlr->cal_target, &ctlr->cal_rule, false);
++	return 0;
++}
++
+ static void of_spi_parse_dt_cs_delay(struct device_node *nc,
+ 				     struct spi_delay *delay, const char *prop)
+ {
+@@ -2354,6 +2487,10 @@ of_register_spi_device(struct spi_contro
+ 	if (rc)
+ 		goto err_out;
+ 
++	rc = of_spi_parse_cal_dt(ctlr, spi, nc);
++	if (rc)
++		goto err_out;
++
+ 	/* Store a pointer to the node in the device structure */
+ 	of_node_get(nc);
+ 
+--- a/include/linux/spi/spi.h
++++ b/include/linux/spi/spi.h
+@@ -330,4 +330,38 @@ struct spi_driver {
+ 	struct device_driver	driver;
+ };
+ 
++enum {
++	SPI_CAL_READ_DATA = 0,
++	SPI_CAL_READ_PP = 1, /* only for SPI-NAND */
++	SPI_CAL_READ_SFDP = 2, /* only for SPI-NOR */
++};
++
++struct nand_addr {
++	unsigned int lun;
++	unsigned int plane;
++	unsigned int eraseblock;
++	unsigned int page;
++	unsigned int dataoffs;
++};
++
++/**
++ * Read calibration rule from device dts node.
++ * Once calibration result matches the rule, we regard is as success.
++ */
++struct spi_cal_rule {
++	int datalen;
++	u8 *match_data;
++	int addrlen;
++	u32 *addr;
++	int mode;
++};
++
++struct spi_cal_target {
++	u32 *cal_item;
++	int cal_min; /* min of cal_item */
++	int cal_max; /* max of cal_item */
++	int step; /* Increase/decrease cal_item */
++	struct list_head list;
++};
++
+ #define to_spi_driver(__drv)   \
+@@ -727,6 +761,11 @@ struct spi_controller {
+ 	void			*dummy_rx;
+ 	void			*dummy_tx;
+ 
++	/* For calibration */
++	int (*append_caldata)(struct spi_controller *ctlr);
++	struct list_head *cal_target;
++	struct spi_cal_rule *cal_rule;
++
+ 	int (*fw_translate_cs)(struct spi_controller *ctlr, unsigned cs);
+ 
+ 	/*
+@@ -1601,6 +1640,9 @@ spi_register_board_info(struct spi_board
+ 	{ return 0; }
+ #endif
+ 
++extern int spi_do_calibration(struct spi_controller *ctlr,
++	struct spi_device *spi, int (*cal_read)(void *, u32 *, int, u8 *, int), void *drv_priv);
++
+ /*
+  * If you're hotplugging an adapter with devices (parport, USB, etc)
+  * use spi_new_device() to describe each device.  You can also call
diff --git a/6.12/target/linux/mediatek/patches-6.12/433-drivers-spi-mem-Add-spi-calibration-hook.patch b/6.12/target/linux/mediatek/patches-6.12/433-drivers-spi-mem-Add-spi-calibration-hook.patch
new file mode 100644
index 00000000..d9fe480b
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/433-drivers-spi-mem-Add-spi-calibration-hook.patch
@@ -0,0 +1,41 @@
+From 06640a5da2973318c06e516da16a5b579622e7c5 Mon Sep 17 00:00:00 2001
+From: "SkyLake.Huang" <skylake.huang@mediatek.com>
+Date: Thu, 23 Jun 2022 18:37:55 +0800
+Subject: [PATCH 3/6] drivers: spi-mem: Add spi calibration hook
+
+Signed-off-by: SkyLake.Huang <skylake.huang@mediatek.com>
+---
+ drivers/spi/spi-mem.c       | 8 ++++++++
+ include/linux/spi/spi-mem.h | 4 ++++
+ 2 files changed, 12 insertions(+)
+
+--- a/drivers/spi/spi-mem.c
++++ b/drivers/spi/spi-mem.c
+@@ -419,6 +419,14 @@ int spi_mem_exec_op(struct spi_mem *mem,
+ }
+ EXPORT_SYMBOL_GPL(spi_mem_exec_op);
+ 
++int spi_mem_do_calibration(struct spi_mem *mem,
++	int (*cal_read)(void *priv, u32 *addr, int addrlen, u8 *buf, int readlen),
++	void *priv)
++{
++	return spi_do_calibration(mem->spi->controller, mem->spi, cal_read, priv);
++}
++EXPORT_SYMBOL_GPL(spi_mem_do_calibration);
++
+ /**
+  * spi_mem_get_name() - Return the SPI mem device name to be used by the
+  *			upper layer if necessary
+--- a/include/linux/spi/spi-mem.h
++++ b/include/linux/spi/spi-mem.h
+@@ -370,6 +370,10 @@ bool spi_mem_supports_op(struct spi_mem
+ int spi_mem_exec_op(struct spi_mem *mem,
+ 		    const struct spi_mem_op *op);
+ 
++int spi_mem_do_calibration(struct spi_mem *mem,
++			int (*cal_read)(void *, u32 *, int, u8 *, int),
++			void *priv);
++
+ const char *spi_mem_get_name(struct spi_mem *mem);
+ 
+ struct spi_mem_dirmap_desc *
diff --git a/6.12/target/linux/mediatek/patches-6.12/435-drivers-mtd-spinand-Add-calibration-support-for-spin.patch b/6.12/target/linux/mediatek/patches-6.12/435-drivers-mtd-spinand-Add-calibration-support-for-spin.patch
new file mode 100644
index 00000000..bd8e738a
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/435-drivers-mtd-spinand-Add-calibration-support-for-spin.patch
@@ -0,0 +1,81 @@
+From 7670ec4a14891a1a182b98a9c403ffbf6b49e4b1 Mon Sep 17 00:00:00 2001
+From: "SkyLake.Huang" <skylake.huang@mediatek.com>
+Date: Thu, 23 Jun 2022 18:39:56 +0800
+Subject: [PATCH 5/6] drivers: mtd: spinand: Add calibration support for
+ spinand
+
+Signed-off-by: SkyLake.Huang <skylake.huang@mediatek.com>
+---
+ drivers/mtd/nand/spi/core.c | 54 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 54 insertions(+)
+
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -979,6 +979,56 @@ static int spinand_manufacturer_match(st
+ 	return -ENOTSUPP;
+ }
+ 
++int spinand_cal_read(void *priv, u32 *addr, int addrlen, u8 *buf, int readlen) {
++	struct spinand_device *spinand = (struct spinand_device *)priv;
++	struct device *dev = &spinand->spimem->spi->dev;
++	struct spi_mem_op op = SPINAND_PAGE_READ_FROM_CACHE_OP(false, 0, 1, buf, readlen);
++	struct nand_pos pos;
++	struct nand_page_io_req req;
++	u8 status;
++	int ret;
++
++	if(addrlen != sizeof(struct nand_addr)/sizeof(unsigned int)) {
++		dev_err(dev, "Must provide correct addr(length) for spinand calibration\n");
++		return -EINVAL;
++	}
++
++	ret = spinand_reset_op(spinand);
++	if (ret)
++		return ret;
++
++	/* We should store our golden data in first target because
++	 * we can't switch target at this moment.
++	 */
++	pos = (struct nand_pos){
++		.target = 0,
++		.lun = *addr,
++		.plane = *(addr+1),
++		.eraseblock = *(addr+2),
++		.page = *(addr+3),
++	};
++
++	req = (struct nand_page_io_req){
++		.pos = pos,
++		.dataoffs = *(addr+4),
++		.datalen = readlen,
++		.databuf.in = buf,
++		.mode = MTD_OPS_AUTO_OOB,
++	};
++
++	ret = spinand_load_page_op(spinand, &req);
++	if (ret)
++		return ret;
++
++	ret = spinand_wait(spinand, &status);
++	if (ret < 0)
++		return ret;
++
++	ret = spi_mem_exec_op(spinand->spimem, &op);
++
++	return 0;
++}
++
+ static int spinand_id_detect(struct spinand_device *spinand)
+ {
+ 	u8 *id = spinand->id.data;
+@@ -1229,6 +1279,10 @@ static int spinand_init(struct spinand_d
+ 	if (!spinand->scratchbuf)
+ 		return -ENOMEM;
+ 
++	ret = spi_mem_do_calibration(spinand->spimem, spinand_cal_read, spinand);
++	if (ret)
++		dev_err(dev, "Failed to calibrate SPI-NAND (err = %d)\n", ret);
++
+ 	ret = spinand_detect(spinand);
+ 	if (ret)
+ 		goto err_free_bufs;
diff --git a/6.12/target/linux/mediatek/patches-6.12/436-drivers-mtd-spi-nor-Add-calibration-support-for-spi-.patch b/6.12/target/linux/mediatek/patches-6.12/436-drivers-mtd-spi-nor-Add-calibration-support-for-spi-.patch
new file mode 100644
index 00000000..744042ae
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/436-drivers-mtd-spi-nor-Add-calibration-support-for-spi-.patch
@@ -0,0 +1,57 @@
+From f3fe3b15eca7908eaac57f9b8387a5dbc45ec5b2 Mon Sep 17 00:00:00 2001
+From: "SkyLake.Huang" <skylake.huang@mediatek.com>
+Date: Thu, 23 Jun 2022 18:40:59 +0800
+Subject: [PATCH 6/6] drivers: mtd: spi-nor: Add calibration support for
+ spi-nor
+
+Signed-off-by: SkyLake.Huang <skylake.huang@mediatek.com>
+---
+ drivers/mtd/nand/spi/core.c |  5 ++++-
+ drivers/mtd/spi-nor/core.c  | 15 +++++++++++++++
+ 2 files changed, 19 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -1020,7 +1020,10 @@ int spinand_cal_read(void *priv, u32 *ad
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = spinand_wait(spinand, &status);
++	ret = spinand_wait(spinand,
++			   SPINAND_READ_INITIAL_DELAY_US,
++			   SPINAND_READ_POLL_DELAY_US,
++			   &status);
+ 	if (ret < 0)
+ 		return ret;
+ 
+--- a/drivers/mtd/spi-nor/core.c
++++ b/drivers/mtd/spi-nor/core.c
+@@ -3378,6 +3378,18 @@ static const struct flash_info *spi_nor_
+ 	return NULL;
+ }
+ 
++static int spi_nor_cal_read(void *priv, u32 *addr, int addrlen, u8 *buf, int readlen)
++{
++	struct spi_nor *nor = (struct spi_nor *)priv;
++
++	nor->reg_proto = SNOR_PROTO_1_1_1;
++	nor->read_proto = SNOR_PROTO_1_1_1;
++	nor->read_opcode = SPINOR_OP_READ;
++	nor->read_dummy = 0;
++
++	return nor->controller_ops->read(nor, *addr, readlen, buf);
++}
++
+ static const struct flash_info *spi_nor_get_flash_info(struct spi_nor *nor,
+ 						       const char *name)
+ {
+@@ -3506,6 +3518,9 @@ int spi_nor_scan(struct spi_nor *nor, co
+ 	if (ret)
+ 		return ret;
+ 
++	if(nor->spimem)
++		spi_mem_do_calibration(nor->spimem, spi_nor_cal_read, nor);
++
+ 	info = spi_nor_get_flash_info(nor, name);
+ 	if (IS_ERR(info))
+ 		return PTR_ERR(info);
diff --git a/6.12/target/linux/mediatek/patches-6.12/500-gsw-rtl8367s-mt7622-support.patch b/6.12/target/linux/mediatek/patches-6.12/500-gsw-rtl8367s-mt7622-support.patch
new file mode 100644
index 00000000..73f73582
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/500-gsw-rtl8367s-mt7622-support.patch
@@ -0,0 +1,25 @@
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -419,6 +419,12 @@ config ROCKCHIP_PHY
+ 	help
+ 	  Currently supports the integrated Ethernet PHY.
+ 
++config RTL8367S_GSW
++	tristate "rtl8367 Gigabit Switch support for mt7622"
++	depends on NET_VENDOR_MEDIATEK
++	help
++	  This driver supports rtl8367s in mt7622
++
+ config SMSC_PHY
+ 	tristate "SMSC PHYs"
+ 	select CRC16
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -102,6 +102,7 @@ obj-$(CONFIG_QSEMI_PHY)		+= qsemi.o
+ obj-$(CONFIG_REALTEK_PHY)	+= realtek.o
+ obj-$(CONFIG_RENESAS_PHY)	+= uPD60620.o
+ obj-$(CONFIG_ROCKCHIP_PHY)	+= rockchip.o
++obj-$(CONFIG_RTL8367S_GSW)	+= rtk/
+ obj-$(CONFIG_SMSC_PHY)		+= smsc.o
+ obj-$(CONFIG_STE10XP)		+= ste10Xp.o
+ obj-$(CONFIG_TERANETICS_PHY)	+= teranetics.o
diff --git a/6.12/target/linux/mediatek/patches-6.12/601-PCI-mediatek-Assert-PERST-for-100ms-for-power-and-cl.patch b/6.12/target/linux/mediatek/patches-6.12/601-PCI-mediatek-Assert-PERST-for-100ms-for-power-and-cl.patch
new file mode 100644
index 00000000..983fde70
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/601-PCI-mediatek-Assert-PERST-for-100ms-for-power-and-cl.patch
@@ -0,0 +1,34 @@
+From: qizhong cheng <qizhong.cheng@mediatek.com>
+Date: Mon, 27 Dec 2021 21:31:10 +0800
+Subject: [PATCH] PCI: mediatek: Assert PERST# for 100ms for power and clock to
+ stabilize
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Described in PCIe CEM specification sections 2.2 (PERST# Signal) and
+2.2.1 (Initial Power-Up (G3 to S0)). The deassertion of PERST# should
+be delayed 100ms (TPVPERL) for the power and clock to become stable.
+
+Link: https://lore.kernel.org/r/20211227133110.14500-1-qizhong.cheng@mediatek.com
+Signed-off-by: qizhong cheng <qizhong.cheng@mediatek.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Acked-by: Pali Rohár <pali@kernel.org>
+---
+
+--- a/drivers/pci/controller/pcie-mediatek.c
++++ b/drivers/pci/controller/pcie-mediatek.c
+@@ -708,6 +708,13 @@ static int mtk_pcie_startup_port_v2(stru
+ 	 */
+ 	msleep(100);
+ 
++	/*
++	 * Described in PCIe CEM specification sections 2.2 (PERST# Signal) and
++	 * 2.2.1 (Initial Power-Up (G3 to S0)). The deassertion of PERST# should
++	 * be delayed 100ms (TPVPERL) for the power and clock to become stable.
++	 */
++	msleep(100);
++
+ 	/* De-assert PHY, PE, PIPE, MAC and configuration reset	*/
+ 	val = readl(port->base + PCIE_RST_CTRL);
+ 	val |= PCIE_PHY_RSTB | PCIE_PERSTB | PCIE_PIPE_SRSTB |
diff --git a/6.12/target/linux/mediatek/patches-6.12/602-arm64-dts-mediatek-add-mt7622-pcie-slot-node.patch b/6.12/target/linux/mediatek/patches-6.12/602-arm64-dts-mediatek-add-mt7622-pcie-slot-node.patch
new file mode 100644
index 00000000..d58082aa
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/602-arm64-dts-mediatek-add-mt7622-pcie-slot-node.patch
@@ -0,0 +1,28 @@
+--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+@@ -844,6 +844,12 @@
+ 			#address-cells = <0>;
+ 			#interrupt-cells = <1>;
+ 		};
++
++		slot0: pcie@0,0 {
++			reg = <0x0000 0 0 0 0>;
++			#address-cells = <3>;
++			#size-cells = <2>;
++		};
+ 	};
+ 
+ 	pcie1: pcie@1a145000 {
+@@ -882,6 +888,12 @@
+ 			#address-cells = <0>;
+ 			#interrupt-cells = <1>;
+ 		};
++
++		slot1: pcie@1,0 {
++			reg = <0x0800 0 0 0 0>;
++			#address-cells = <3>;
++			#size-cells = <2>;
++		};
+ 	};
+ 
+ 	sata: sata@1a200000 {
diff --git a/6.12/target/linux/mediatek/patches-6.12/610-pcie-mediatek-fix-clearing-interrupt-status.patch b/6.12/target/linux/mediatek/patches-6.12/610-pcie-mediatek-fix-clearing-interrupt-status.patch
new file mode 100644
index 00000000..2a49b227
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/610-pcie-mediatek-fix-clearing-interrupt-status.patch
@@ -0,0 +1,23 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 4 Sep 2020 18:33:27 +0200
+Subject: [PATCH] pcie-mediatek: fix clearing interrupt status
+
+Clearing the status needs to happen after running the handler, otherwise
+we will get an extra spurious interrupt after the cause has been cleared
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/pci/controller/pcie-mediatek.c
++++ b/drivers/pci/controller/pcie-mediatek.c
+@@ -607,9 +607,9 @@ static void mtk_pcie_intr_handler(struct
+ 	if (status & INTX_MASK) {
+ 		for_each_set_bit_from(bit, &status, PCI_NUM_INTX + INTX_SHIFT) {
+ 			/* Clear the INTx */
+-			writel(1 << bit, port->base + PCIE_INT_STATUS);
+ 			generic_handle_domain_irq(port->irq_domain,
+ 						  bit - INTX_SHIFT);
++			writel(1 << bit, port->base + PCIE_INT_STATUS);
+ 		}
+ 	}
+ 
diff --git a/6.12/target/linux/mediatek/patches-6.12/611-pcie-mediatek-gen3-PERST-for-100ms.patch b/6.12/target/linux/mediatek/patches-6.12/611-pcie-mediatek-gen3-PERST-for-100ms.patch
new file mode 100644
index 00000000..32b4237d
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/611-pcie-mediatek-gen3-PERST-for-100ms.patch
@@ -0,0 +1,17 @@
+--- a/drivers/pci/controller/pcie-mediatek-gen3.c
++++ b/drivers/pci/controller/pcie-mediatek-gen3.c
+@@ -375,7 +375,13 @@ static int mtk_pcie_startup_port(struct
+ 	msleep(100);
+ 
+ 	/* De-assert reset signals */
+-	val &= ~(PCIE_MAC_RSTB | PCIE_PHY_RSTB | PCIE_BRG_RSTB | PCIE_PE_RSTB);
++	val &= ~(PCIE_MAC_RSTB | PCIE_PHY_RSTB | PCIE_BRG_RSTB);
++	writel_relaxed(val, pcie->base + PCIE_RST_CTRL_REG);
++
++	msleep(100);
++
++	/* De-assert PERST# signals */
++	val &= ~(PCIE_PE_RSTB);
+ 	writel_relaxed(val, pcie->base + PCIE_RST_CTRL_REG);
+ 
+ 	/* Check if the link is up or not */
diff --git a/6.12/target/linux/mediatek/patches-6.12/710-pci-pcie-mediatek-add-support-for-coherent-DMA.patch b/6.12/target/linux/mediatek/patches-6.12/710-pci-pcie-mediatek-add-support-for-coherent-DMA.patch
new file mode 100644
index 00000000..917a458d
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/710-pci-pcie-mediatek-add-support-for-coherent-DMA.patch
@@ -0,0 +1,91 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 4 Sep 2020 18:42:42 +0200
+Subject: [PATCH] pci: pcie-mediatek: add support for coherent DMA
+
+It improves performance by eliminating the need for a cache flush for DMA on
+attached devices
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+@@ -832,6 +832,9 @@
+ 		bus-range = <0x00 0xff>;
+ 		ranges = <0x82000000 0 0x20000000 0x0 0x20000000 0 0x8000000>;
+ 		status = "disabled";
++		dma-coherent;
++		mediatek,hifsys = <&hifsys>;
++		mediatek,cci-control = <&cci_control2>;
+ 
+ 		#interrupt-cells = <1>;
+ 		interrupt-map-mask = <0 0 0 7>;
+@@ -876,6 +879,9 @@
+ 		bus-range = <0x00 0xff>;
+ 		ranges = <0x82000000 0 0x28000000 0x0 0x28000000 0 0x8000000>;
+ 		status = "disabled";
++		dma-coherent;
++		mediatek,hifsys = <&hifsys>;
++		mediatek,cci-control = <&cci_control2>;
+ 
+ 		#interrupt-cells = <1>;
+ 		interrupt-map-mask = <0 0 0 7>;
+@@ -937,7 +943,7 @@
+ 	};
+ 
+ 	hifsys: clock-controller@1af00000 {
+-		compatible = "mediatek,mt7622-hifsys";
++		compatible = "mediatek,mt7622-hifsys", "syscon";
+ 		reg = <0 0x1af00000 0 0x70>;
+ 		#clock-cells = <1>;
+ 	};
+--- a/drivers/pci/controller/pcie-mediatek.c
++++ b/drivers/pci/controller/pcie-mediatek.c
+@@ -20,6 +20,7 @@
+ #include <linux/of_address.h>
+ #include <linux/of_pci.h>
+ #include <linux/of_platform.h>
++#include <linux/of_address.h>
+ #include <linux/pci.h>
+ #include <linux/phy/phy.h>
+ #include <linux/platform_device.h>
+@@ -139,6 +140,11 @@
+ #define PCIE_LINK_STATUS_V2	0x804
+ #define PCIE_PORT_LINKUP_V2	BIT(10)
+ 
++/* DMA channel mapping */
++#define HIFSYS_DMA_AG_MAP	0x008
++#define HIFSYS_DMA_AG_MAP_PCIE0	BIT(0)
++#define HIFSYS_DMA_AG_MAP_PCIE1	BIT(1)
++
+ struct mtk_pcie_port;
+ 
+ /**
+@@ -1060,6 +1066,27 @@ static int mtk_pcie_setup(struct mtk_pci
+ 	struct mtk_pcie_port *port, *tmp;
+ 	int err, slot;
+ 
++	if (of_dma_is_coherent(node)) {
++		struct regmap *con;
++		u32 mask;
++
++		con = syscon_regmap_lookup_by_phandle(node,
++						      "mediatek,cci-control");
++		/* enable CPU/bus coherency */
++		if (!IS_ERR(con))
++			regmap_write(con, 0, 3);
++
++		con = syscon_regmap_lookup_by_phandle(node,
++						      "mediatek,hifsys");
++		if (IS_ERR(con)) {
++			dev_err(dev, "missing hifsys node\n");
++			return PTR_ERR(con);
++		}
++
++		mask = HIFSYS_DMA_AG_MAP_PCIE0 | HIFSYS_DMA_AG_MAP_PCIE1;
++		regmap_update_bits(con, HIFSYS_DMA_AG_MAP, mask, mask);
++	}
++
+ 	slot = of_get_pci_domain_nr(dev->of_node);
+ 	if (slot < 0) {
+ 		for_each_available_child_of_node(node, child) {
diff --git a/6.12/target/linux/mediatek/patches-6.12/721-dts-mt7622-mediatek-fix-300mhz.patch b/6.12/target/linux/mediatek/patches-6.12/721-dts-mt7622-mediatek-fix-300mhz.patch
new file mode 100644
index 00000000..f9a5fdbd
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/721-dts-mt7622-mediatek-fix-300mhz.patch
@@ -0,0 +1,27 @@
+From: Jip de Beer <gpk6x3591g0l@opayq.com>
+Date: Sun, 9 Jan 2022 13:14:04 +0100
+Subject: [PATCH] mediatek mt7622: fix 300mhz typo in dts
+
+The lowest frequency should be 300MHz, since that is the label
+assigned to the OPP in the mt7622.dtsi device tree, while there is one
+missing zero in the actual value.
+
+To be clear, the lowest frequency should be 300MHz instead of 30MHz.
+
+As mentioned @dangowrt on the OpenWrt forum there is no benefit in
+leaving 30MHz as the lowest frequency.
+
+Signed-off-by: Jip de Beer <gpk6x3591g0l@opayq.com>
+Signed-off-by: Fritz D. Ansel <fdansel@yandex.ru>
+---
+--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+@@ -24,7 +24,7 @@
+ 		compatible = "operating-points-v2";
+ 		opp-shared;
+ 		opp-300000000 {
+-			opp-hz = /bits/ 64 <30000000>;
++			opp-hz = /bits/ 64 <300000000>;
+ 			opp-microvolt = <950000>;
+ 		};
+ 
diff --git a/6.12/target/linux/mediatek/patches-6.12/722-remove-300Hz-to-prevent-freeze.patch b/6.12/target/linux/mediatek/patches-6.12/722-remove-300Hz-to-prevent-freeze.patch
new file mode 100644
index 00000000..52069496
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/722-remove-300Hz-to-prevent-freeze.patch
@@ -0,0 +1,25 @@
+--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+@@ -23,11 +23,17 @@
+ 	cpu_opp_table: opp-table {
+ 		compatible = "operating-points-v2";
+ 		opp-shared;
+-		opp-300000000 {
+-			opp-hz = /bits/ 64 <300000000>;
+-			opp-microvolt = <950000>;
+-		};
+-
++		/* Due to the bug described at the link below, remove the 300 MHz clock to avoid a low
++		 * voltage condition that can cause a hang when rebooting the RT3200/E8450.
++		 *
++		 * https://forum.openwrt.org/t/belkin-rt3200-linksys-e8450-wifi-ax-discussion/94302/1490
++		 *
++		 * opp-300000000 {
++		 *	opp-hz = /bits/ 64 <300000000>;
++		 *	opp-microvolt = <950000>;
++		 * };
++		 *
++		 */
+ 		opp-437500000 {
+ 			opp-hz = /bits/ 64 <437500000>;
+ 			opp-microvolt = <1000000>;
diff --git a/6.12/target/linux/mediatek/patches-6.12/732-net-phy-mxl-gpy-don-t-use-SGMII-AN-if-using-phylink.patch b/6.12/target/linux/mediatek/patches-6.12/732-net-phy-mxl-gpy-don-t-use-SGMII-AN-if-using-phylink.patch
new file mode 100644
index 00000000..99d0a0db
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/732-net-phy-mxl-gpy-don-t-use-SGMII-AN-if-using-phylink.patch
@@ -0,0 +1,63 @@
+From a969b663c866129ed9eb217785a6574fbe826f1d Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Thu, 6 Apr 2023 23:36:50 +0100
+Subject: [PATCH] net: phy: mxl-gpy: don't use SGMII AN if using phylink
+
+MAC drivers using phylink expect SGMII in-band-status to be switched off
+when attached to a PHY. Make sure this is the case also for mxl-gpy which
+keeps SGMII in-band-status in case of SGMII interface mode is used.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/mxl-gpy.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/phy/mxl-gpy.c
++++ b/drivers/net/phy/mxl-gpy.c
+@@ -385,8 +385,11 @@ static bool gpy_2500basex_chk(struct phy
+ 
+ 	phydev->speed = SPEED_2500;
+ 	phydev->interface = PHY_INTERFACE_MODE_2500BASEX;
+-	phy_modify_mmd(phydev, MDIO_MMD_VEND1, VSPEC1_SGMII_CTRL,
+-		       VSPEC1_SGMII_CTRL_ANEN, 0);
++
++	if (!phydev->phylink)
++		phy_modify_mmd(phydev, MDIO_MMD_VEND1, VSPEC1_SGMII_CTRL,
++			       VSPEC1_SGMII_CTRL_ANEN, 0);
++
+ 	return true;
+ }
+ 
+@@ -437,6 +440,14 @@ static int gpy_config_aneg(struct phy_de
+ 	u32 adv;
+ 	int ret;
+ 
++	/* Disable SGMII auto-negotiation if using phylink */
++	if (phydev->phylink) {
++		ret = phy_modify_mmd(phydev, MDIO_MMD_VEND1, VSPEC1_SGMII_CTRL,
++				     VSPEC1_SGMII_CTRL_ANEN, 0);
++		if (ret < 0)
++			return ret;
++	}
++
+ 	if (phydev->autoneg == AUTONEG_DISABLE) {
+ 		/* Configure half duplex with genphy_setup_forced,
+ 		 * because genphy_c45_pma_setup_forced does not support.
+@@ -559,6 +570,8 @@ static int gpy_update_interface(struct p
+ 	switch (phydev->speed) {
+ 	case SPEED_2500:
+ 		phydev->interface = PHY_INTERFACE_MODE_2500BASEX;
++		if (phydev->phylink)
++			break;
+ 		ret = phy_modify_mmd(phydev, MDIO_MMD_VEND1, VSPEC1_SGMII_CTRL,
+ 				     VSPEC1_SGMII_CTRL_ANEN, 0);
+ 		if (ret < 0) {
+@@ -572,7 +585,7 @@ static int gpy_update_interface(struct p
+ 	case SPEED_100:
+ 	case SPEED_10:
+ 		phydev->interface = PHY_INTERFACE_MODE_SGMII;
+-		if (gpy_sgmii_aneg_en(phydev))
++		if (phydev->phylink || gpy_sgmii_aneg_en(phydev))
+ 			break;
+ 		/* Enable and restart SGMII ANEG for 10/100/1000Mbps link speed
+ 		 * if ANEG is disabled (in 2500-BaseX mode).
diff --git a/6.12/target/linux/mediatek/patches-6.12/734-net-phy-add-Airoha-EN8801SC-PHY.patch b/6.12/target/linux/mediatek/patches-6.12/734-net-phy-add-Airoha-EN8801SC-PHY.patch
new file mode 100644
index 00000000..90c030fb
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/734-net-phy-add-Airoha-EN8801SC-PHY.patch
@@ -0,0 +1,38 @@
+From 5314e73cb941b47e6866b49b3b78c25e32d62df8 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robert.marko@sartura.hr>
+Date: Sat, 23 Mar 2024 20:21:14 +0100
+Subject: [PATCH] net: phy: add Airoha EN8801SC PHY
+
+Airoha EN8801SC Gigabit PHY is used on Edgecore EAP111, so include a
+modified version of MTK SDK driver.
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+---
+ drivers/net/phy/Kconfig  | 5 +++++
+ drivers/net/phy/Makefile | 1 +
+ 2 files changed, 6 insertions(+)
+
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -142,6 +142,11 @@ endif # RTL8366_SMI
+ 
+ comment "MII PHY device drivers"
+ 
++config AIROHA_EN8801SC_PHY
++	tristate "Airoha EN8801SC Gigabit PHY"
++	help
++	  Currently supports the Airoha EN8801SC PHY.
++
+ config AIR_EN8811H_PHY
+ 	tristate "Airoha EN8811H 2.5 Gigabit PHY"
+ 	help
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -49,6 +49,7 @@ obj-y				+= $(sfp-obj-y) $(sfp-obj-m)
+ 
+ obj-$(CONFIG_ADIN_PHY)		+= adin.o
+ obj-$(CONFIG_ADIN1100_PHY)	+= adin1100.o
++obj-$(CONFIG_AIROHA_EN8801SC_PHY)   += en8801sc.o
+ obj-$(CONFIG_AIR_EN8811H_PHY)   += air_en8811h.o
+ obj-$(CONFIG_AMD_PHY)		+= amd.o
+ obj-$(CONFIG_AQUANTIA_PHY)	+= aquantia/
diff --git a/6.12/target/linux/mediatek/patches-6.12/862-arm64-dts-mt7986-add-afe.patch b/6.12/target/linux/mediatek/patches-6.12/862-arm64-dts-mt7986-add-afe.patch
new file mode 100644
index 00000000..29de7851
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/862-arm64-dts-mt7986-add-afe.patch
@@ -0,0 +1,40 @@
+From 1c09b694a1e9378931085e77d834a4d9786a5356 Mon Sep 17 00:00:00 2001
+From: Maso Huang <maso.huang@mediatek.com>
+Date: Thu, 7 Sep 2023 10:54:37 +0800
+Subject: [PATCH] arm64: dts: mt7986: add afe
+
+---
+ arch/arm64/boot/dts/mediatek/mt7986a.dtsi     | 23 +++++++++++
+ 1 files changed, 23 insertions(+)
+
+--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+@@ -202,6 +202,28 @@
+ 			#interrupt-cells = <2>;
+ 		};
+ 
++		afe: audio-controller@11210000 {
++			compatible = "mediatek,mt7986-afe";
++			reg = <0 0x11210000 0 0x9000>;
++			interrupts = <GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&infracfg CLK_INFRA_AUD_BUS_CK>,
++				 <&infracfg CLK_INFRA_AUD_26M_CK>,
++				 <&infracfg CLK_INFRA_AUD_L_CK>,
++				 <&infracfg CLK_INFRA_AUD_AUD_CK>,
++				 <&infracfg CLK_INFRA_AUD_EG2_CK>;
++			clock-names = "aud_bus_ck",
++				      "aud_26m_ck",
++				      "aud_l_ck",
++				      "aud_aud_ck",
++				      "aud_eg2_ck";
++			assigned-clocks = <&topckgen CLK_TOP_A1SYS_SEL>,
++					  <&topckgen CLK_TOP_AUD_L_SEL>,
++					  <&topckgen CLK_TOP_A_TUNER_SEL>;
++			assigned-clock-parents = <&topckgen CLK_TOP_APLL2_D4>,
++						 <&apmixedsys CLK_APMIXED_APLL2>,
++						 <&topckgen CLK_TOP_APLL2_D4>;
++		};
++
+ 		pwm: pwm@10048000 {
+ 			compatible = "mediatek,mt7986-pwm";
+ 			reg = <0 0x10048000 0 0x1000>;
diff --git a/6.12/target/linux/mediatek/patches-6.12/863-arm64-dts-mt7986-add-sound-wm8960.patch b/6.12/target/linux/mediatek/patches-6.12/863-arm64-dts-mt7986-add-sound-wm8960.patch
new file mode 100644
index 00000000..15e30dec
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/863-arm64-dts-mt7986-add-sound-wm8960.patch
@@ -0,0 +1,61 @@
+From 1c09b694a1e9378931085e77d834a4d9786a5356 Mon Sep 17 00:00:00 2001
+From: Maso Huang <maso.huang@mediatek.com>
+Date: Thu, 7 Sep 2023 10:54:37 +0800
+Subject: [PATCH] arm64: dts: mt7986: add sound wm8960
+
+---
+ .../dts/mediatek/mt7986a-rfb-spim-nand.dts    | 39 +++++++++++++++++++
+ 1 files changed, 39 insertions(+)
+
+--- a/arch/arm64/boot/dts/mediatek/mt7986a-rfb-spim-nand.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7986a-rfb-spim-nand.dts
+@@ -4,6 +4,35 @@
+ 
+ / {
+ 	compatible = "mediatek,mt7986a-rfb-snand";
++
++	sound_wm8960 {
++		compatible = "mediatek,mt7986-wm8960-sound";
++		audio-routing = "Headphone", "HP_L",
++				"Headphone", "HP_R",
++				"LINPUT1", "AMIC",
++				"RINPUT1", "AMIC";
++
++		status = "okay";
++
++		platform {
++			sound-dai = <&afe>;
++		};
++
++		codec {
++			sound-dai = <&wm8960>;
++		};
++	};
++};
++
++&i2c0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2c_pins>;
++	status = "okay";
++
++	wm8960: wm8960@1a {
++		compatible = "wlf,wm8960";
++		reg = <0x1a>;
++	};
+ };
+ 
+ &spi0 {
+@@ -50,3 +79,13 @@
+ &wifi {
+ 	mediatek,mtd-eeprom = <&factory 0>;
+ };
++
++&pio {
++	i2c_pins: i2c-pins-3-4 {
++		mux {
++			function = "i2c";
++			groups = "i2c";
++		};
++	};
++};
++
diff --git a/6.12/target/linux/mediatek/patches-6.12/864-arm64-dts-mt7986-add-sound-overlay-for-bpi-r3.patch b/6.12/target/linux/mediatek/patches-6.12/864-arm64-dts-mt7986-add-sound-overlay-for-bpi-r3.patch
new file mode 100644
index 00000000..784ae5b6
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/864-arm64-dts-mt7986-add-sound-overlay-for-bpi-r3.patch
@@ -0,0 +1,75 @@
+--- /dev/null
++++ b/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3-respeaker-2mics.dtso
+@@ -0,0 +1,62 @@
++// SPDX-License-Identifier: (GPL-2.0 OR MIT)
++/*
++ * Copyright (C) 2023 MediaTek Inc.
++ * Author: Maso Huang <Maso.Huang@mediatek.com>
++ */
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "bananapi,bpi-r3", "mediatek,mt7986a";
++
++	fragment@0 {
++		target-path = "/";
++		__overlay__ {
++			sound_wm8960 {
++				compatible = "mediatek,mt7986-wm8960-sound";
++				audio-routing = "Headphone", "HP_L",
++					"Headphone", "HP_R",
++					"LINPUT1", "AMIC",
++					"RINPUT1", "AMIC";
++
++				status = "okay";
++
++				platform {
++					sound-dai = <&afe>;
++				};
++
++				codec {
++					sound-dai = <&wm8960>;
++				};
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&i2c0>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&i2c_pins>;
++			clock-frequency = <400000>;
++			status = "okay";
++
++			wm8960: wm8960@1a {
++				compatible = "wlf,wm8960";
++				reg = <0x1a>;
++			};
++		};
++	};
++
++	fragment@2 {
++		target = <&pio>;
++		__overlay__ {
++			i2c_pins: i2c-pins-3-4 {
++				mux {
++					function = "i2c";
++					groups = "i2c";
++				};
++			};
++		};
++	};
++};
+--- a/arch/arm64/boot/dts/mediatek/Makefile
++++ b/arch/arm64/boot/dts/mediatek/Makefile
+@@ -13,6 +13,7 @@ dtb-$(CONFIG_ARCH_MEDIATEK) += mt7986a-b
+ dtb-$(CONFIG_ARCH_MEDIATEK) += mt7986a-bananapi-bpi-r3-nand.dtbo
+ dtb-$(CONFIG_ARCH_MEDIATEK) += mt7986a-bananapi-bpi-r3-nor.dtbo
+ dtb-$(CONFIG_ARCH_MEDIATEK) += mt7986a-bananapi-bpi-r3-sd.dtbo
++dtb-$(CONFIG_ARCH_MEDIATEK) += mt7986a-bananapi-bpi-r3-respeaker-2mics.dtbo
+ dtb-$(CONFIG_ARCH_MEDIATEK) += mt7986a-rfb.dtb
+ dtb-$(CONFIG_ARCH_MEDIATEK) += mt7986b-rfb.dtb
+ dtb-$(CONFIG_ARCH_MEDIATEK) += mt8167-pumpkin.dtb
diff --git a/6.12/target/linux/mediatek/patches-6.12/900-dts-mt7622-bpi-r64-aliases-for-dtoverlay.patch b/6.12/target/linux/mediatek/patches-6.12/900-dts-mt7622-bpi-r64-aliases-for-dtoverlay.patch
new file mode 100644
index 00000000..6dede020
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/900-dts-mt7622-bpi-r64-aliases-for-dtoverlay.patch
@@ -0,0 +1,65 @@
+--- a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
+@@ -312,7 +312,7 @@
+ 	/* Attention: GPIO 90 is used to switch between PCIe@1,0 and
+ 	 * SATA functions. i.e. output-high: PCIe, output-low: SATA
+ 	 */
+-	asm_sel {
++	asmsel: asm_sel {
+ 		gpio-hog;
+ 		gpios = <90 GPIO_ACTIVE_HIGH>;
+ 		output-high;
+--- /dev/null
++++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64-sata.dtso
+@@ -0,0 +1,31 @@
++/* SPDX-License-Identifier: (GPL-2.0-only OR MIT) */
++
++#include <dt-bindings/gpio/gpio.h>
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "bananapi,bpi-r64", "mediatek,mt7622";
++
++	fragment@0 {
++		target = <&asmsel>;
++		__overlay__ {
++			gpios = <90 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	fragment@1 {
++		target = <&sata>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&sata_phy>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++};
+--- /dev/null
++++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64-pcie1.dtso
+@@ -0,0 +1,17 @@
++/* SPDX-License-Identifier: (GPL-2.0-only OR MIT) */
++
++#include <dt-bindings/gpio/gpio.h>
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "bananapi,bpi-r64", "mediatek,mt7622";
++
++	fragment@0 {
++		target = <&asmsel>;
++		__overlay__ {
++			gpios = <90 GPIO_ACTIVE_HIGH>;
++		};
++	};
++};
diff --git a/6.12/target/linux/mediatek/patches-6.12/901-arm-add-cmdline-override.patch b/6.12/target/linux/mediatek/patches-6.12/901-arm-add-cmdline-override.patch
new file mode 100644
index 00000000..421d88a5
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/901-arm-add-cmdline-override.patch
@@ -0,0 +1,54 @@
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -1568,6 +1568,14 @@ config ARM_ATAG_DTB_COMPAT_CMDLINE_EXTEN
+ 
+ endchoice
+ 
++config CMDLINE_OVERRIDE
++	bool "Use alternative cmdline from device tree"
++	help
++	  Some bootloaders may have uneditable bootargs. While CMDLINE_FORCE can
++	  be used, this is not a good option for kernels that are shared across
++	  devices. This setting enables using "chosen/cmdline-override" as the
++	  cmdline if it exists in the device tree.
++
+ config CMDLINE
+ 	string "Default kernel command string"
+ 	default ""
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -1189,6 +1189,17 @@ int __init early_init_dt_scan_chosen(cha
+ 	if (p != NULL && l > 0)
+ 		strlcat(cmdline, p, min_t(int, strlen(cmdline) + (int)l, COMMAND_LINE_SIZE));
+ 
++    /* CONFIG_CMDLINE_OVERRIDE is used to fallback to a different
++     * device tree option of chosen/bootargs-override. This is
++     * helpful on boards where u-boot sets bootargs, and is unable
++     * to be modified.
++     */
++#ifdef CONFIG_CMDLINE_OVERRIDE
++	p = of_get_flat_dt_prop(node, "bootargs-override", &l);
++	if (p != NULL && l > 0)
++		strscpy(cmdline, p, min((int)l, COMMAND_LINE_SIZE));
++#endif
++
+ handle_cmdline:
+ 	/*
+ 	 * CONFIG_CMDLINE is meant to be a default in case nothing else
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -2307,6 +2307,14 @@ config CMDLINE_FORCE
+ 
+ endchoice
+ 
++config CMDLINE_OVERRIDE
++	bool "Use alternative cmdline from device tree"
++	help
++	  Some bootloaders may have uneditable bootargs. While CMDLINE_FORCE can
++	  be used, this is not a good option for kernels that are shared across
++	  devices. This setting enables using "chosen/cmdline-override" as the
++	  cmdline if it exists in the device tree.
++
+ config EFI_STUB
+ 	bool
+ 
diff --git a/6.12/target/linux/mediatek/patches-6.12/910-dts-mt7622-bpi-r64-wifi-eeprom.patch b/6.12/target/linux/mediatek/patches-6.12/910-dts-mt7622-bpi-r64-wifi-eeprom.patch
new file mode 100644
index 00000000..09ce417c
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/910-dts-mt7622-bpi-r64-wifi-eeprom.patch
@@ -0,0 +1,31 @@
+--- a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
+@@ -639,5 +639,28 @@
+ };
+ 
+ &wmac {
++	mediatek,eeprom-data = <0x22760500	0x0		0x0		0x0
++				0x0		0x0		0x0		0x0
++				0x0		0x0		0x0		0x0
++				0x0		0x44000020	0x0		0x10002000
++				0x4400		0x4000000	0x0		0x0
++				0x200000b3	0x40b6c3c3	0x26000000	0x41c42600
++				0x41c4		0x26000000	0xc0c52600	0x0
++				0x0		0x0		0x0		0x0
++				0x0		0x0		0x0		0x0
++				0x0		0x0		0x0		0x0
++				0x0		0x0		0x0		0x0
++				0x0		0x0		0x0		0xc6c6
++				0xc3c3c2c1	0xc300c3	0x818181	0x83c1c182
++				0x83838382	0x0		0x0		0x0
++				0x0		0x0		0x0		0x0
++				0x84002e00	0x90000087	0x8a000000	0x0
++				0x0		0x0		0x0		0x0
++				0x0		0x0		0x0		0x0
++				0xb000009	0x0		0x0		0x0
++				0x0		0x0		0x0		0x0
++				0x0		0x0		0x0		0x0
++				0x0		0x0		0x0		0x7707>;
++
+ 	status = "okay";
+ };
diff --git a/6.12/target/linux/mediatek/patches-6.12/911-dts-mt7622-bpi-r64-add-rootdisk.patch b/6.12/target/linux/mediatek/patches-6.12/911-dts-mt7622-bpi-r64-add-rootdisk.patch
new file mode 100644
index 00000000..a28d2744
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/911-dts-mt7622-bpi-r64-add-rootdisk.patch
@@ -0,0 +1,105 @@
+--- a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
+@@ -32,6 +32,9 @@
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
+ 		bootargs = "earlycon=uart8250,mmio32,0x11002000 console=ttyS0,115200n1 swiotlb=512";
++		rootdisk-emmc = <&emmc_rootfs>;
++		rootdisk-sd = <&sd_rootfs>;
++		rootdisk-snfi = <&ubi_rootfs>;
+ 	};
+ 
+ 	cpus {
+@@ -234,6 +237,26 @@
+ 	assigned-clocks = <&topckgen CLK_TOP_MSDC30_0_SEL>;
+ 	assigned-clock-parents = <&topckgen CLK_TOP_UNIV48M>;
+ 	non-removable;
++
++	card@0 {
++		compatible = "mmc-card";
++		reg = <0>;
++
++		block {
++			compatible = "block-device";
++			partitions {
++				block-partition-env {
++					partname = "ubootenv";
++					nvmem-layout {
++						compatible = "u-boot,env";
++					};
++				};
++				emmc_rootfs: block-partition-production {
++					partname = "production";
++				};
++			};
++		};
++	};
+ };
+ 
+ &mmc1 {
+@@ -249,6 +272,26 @@
+ 	vqmmc-supply = <&reg_3p3v>;
+ 	assigned-clocks = <&topckgen CLK_TOP_MSDC30_1_SEL>;
+ 	assigned-clock-parents = <&topckgen CLK_TOP_UNIV48M>;
++
++	card@0 {
++		compatible = "mmc-card";
++		reg = <0>;
++
++		block {
++			compatible = "block-device";
++			partitions {
++				block-partition-env {
++					partname = "ubootenv";
++					nvmem-layout {
++						compatible = "u-boot,env";
++					};
++				};
++				sd_rootfs: block-partition-production {
++					partname = "production";
++				};
++			};
++		};
++	};
+ };
+ 
+ &nandc {
+@@ -282,15 +325,30 @@
+ 				read-only;
+ 			};
+ 
+-			partition@80000 {
+-				label = "fip";
+-				reg = <0x80000 0x200000>;
+-				read-only;
+-			};
+-
+-			ubi: partition@280000 {
++			ubi: partition@80000 {
+ 				label = "ubi";
+-				reg = <0x280000 0x7d80000>;
++				reg = <0x80000 0x7f80000>;
++				compatible = "linux,ubi";
++
++				volumes {
++					ubi-volume-ubootenv {
++						volname = "ubootenv";
++						nvmem-layout {
++							compatible = "u-boot,env-redundant-bool-layout";
++						};
++					};
++
++					ubi-volume-ubootenv2 {
++						volname = "ubootenv2";
++						nvmem-layout {
++							compatible = "u-boot,env-redundant-bool-layout";
++						};
++					};
++
++					ubi_rootfs: ubi-volume-fit {
++						volname = "fit";
++					};
++				};
+ 			};
+ 		};
+ 	};
diff --git a/6.12/target/linux/mediatek/patches-6.12/930-spi-mt65xx-enable-sel-clk.patch b/6.12/target/linux/mediatek/patches-6.12/930-spi-mt65xx-enable-sel-clk.patch
new file mode 100644
index 00000000..eb25b99e
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/930-spi-mt65xx-enable-sel-clk.patch
@@ -0,0 +1,18 @@
+--- a/drivers/spi/spi-mt65xx.c
++++ b/drivers/spi/spi-mt65xx.c
+@@ -1228,8 +1228,15 @@ static int mtk_spi_probe(struct platform
+ 	if (ret < 0)
+ 		return dev_err_probe(dev, ret, "failed to enable hclk\n");
+ 
++	ret = clk_prepare_enable(mdata->sel_clk);
++	if (ret < 0) {
++		clk_disable_unprepare(mdata->spi_hclk);
++		return dev_err_probe(dev, ret, "failed to enable sel_clk\n");
++	}
++
+ 	ret = clk_prepare_enable(mdata->spi_clk);
+ 	if (ret < 0) {
++		clk_disable_unprepare(mdata->sel_clk);
+ 		clk_disable_unprepare(mdata->spi_hclk);
+ 		return dev_err_probe(dev, ret, "failed to enable spi_clk\n");
+ 	}
diff --git a/6.12/target/linux/mediatek/patches-6.12/940-net-ethernet-mtk_wed-rename-mtk_wed_get_memory_regio.patch b/6.12/target/linux/mediatek/patches-6.12/940-net-ethernet-mtk_wed-rename-mtk_wed_get_memory_regio.patch
new file mode 100644
index 00000000..465f0eaf
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/940-net-ethernet-mtk_wed-rename-mtk_wed_get_memory_regio.patch
@@ -0,0 +1,37 @@
+From 3cf212c4ce6cd72c09bc47f35f539ba0afd4d106 Mon Sep 17 00:00:00 2001
+Message-Id: <3cf212c4ce6cd72c09bc47f35f539ba0afd4d106.1678716918.git.lorenzo@kernel.org>
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sun, 12 Mar 2023 16:40:31 +0100
+Subject: [PATCH net-next 1/2] net: ethernet: mtk_wed: rename
+ mtk_wed_get_memory_region in mtk_wed_get_reserved_memory_region
+
+This is a preliminary patch to move wed ilm/dlm and cpuboot properties in
+dedicated dts nodes.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_wed_mcu.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
+@@ -234,8 +234,8 @@ int mtk_wed_mcu_msg_update(struct mtk_we
+ }
+ 
+ static int
+-mtk_wed_get_memory_region(struct mtk_wed_hw *hw, int index,
+-			  struct mtk_wed_wo_memory_region *region)
++mtk_wed_get_reserved_memory_region(struct mtk_wed_hw *hw, int index,
++				   struct mtk_wed_wo_memory_region *region)
+ {
+ 	struct reserved_mem *rmem;
+ 	struct device_node *np;
+@@ -325,7 +325,7 @@ mtk_wed_mcu_load_firmware(struct mtk_wed
+ 		if (index < 0)
+ 			continue;
+ 
+-		ret = mtk_wed_get_memory_region(wo->hw, index, &mem_region[i]);
++		ret = mtk_wed_get_reserved_memory_region(wo->hw, index, &mem_region[i]);
+ 		if (ret)
+ 			return ret;
+ 	}
diff --git a/6.12/target/linux/mediatek/patches-6.12/941-arm64-dts-mt7986-move-cpuboot-in-a-dedicated-node.patch b/6.12/target/linux/mediatek/patches-6.12/941-arm64-dts-mt7986-move-cpuboot-in-a-dedicated-node.patch
new file mode 100644
index 00000000..73714fbd
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/941-arm64-dts-mt7986-move-cpuboot-in-a-dedicated-node.patch
@@ -0,0 +1,66 @@
+From 247e566e3459481f1fa98733534bfed767e18b42 Mon Sep 17 00:00:00 2001
+Message-Id: <247e566e3459481f1fa98733534bfed767e18b42.1678620342.git.lorenzo@kernel.org>
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 11 Mar 2023 16:32:41 +0100
+Subject: [PATCH net-next] arm64: dts: mt7986: move cpuboot in a dedicated node
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+@@ -121,12 +121,6 @@
+ 			reg = <0 0x151f8000 0 0x2000>;
+ 			no-map;
+ 		};
+-
+-		wo_boot: wo-boot@15194000 {
+-			reg = <0 0x15194000 0 0x1000>;
+-			no-map;
+-		};
+-
+ 	};
+ 
+ 	soc {
+@@ -532,10 +526,11 @@
+ 			interrupt-parent = <&gic>;
+ 			interrupts = <GIC_SPI 205 IRQ_TYPE_LEVEL_HIGH>;
+ 			memory-region = <&wo_emi0>, <&wo_ilm0>, <&wo_dlm0>,
+-					<&wo_data>, <&wo_boot>;
++					<&wo_data>;
+ 			memory-region-names = "wo-emi", "wo-ilm", "wo-dlm",
+-					      "wo-data", "wo-boot";
++					      "wo-data";
+ 			mediatek,wo-ccif = <&wo_ccif0>;
++			mediatek,wo-cpuboot = <&wo_cpuboot>;
+ 		};
+ 
+ 		wed1: wed@15011000 {
+@@ -545,10 +540,11 @@
+ 			interrupt-parent = <&gic>;
+ 			interrupts = <GIC_SPI 206 IRQ_TYPE_LEVEL_HIGH>;
+ 			memory-region = <&wo_emi1>, <&wo_ilm1>, <&wo_dlm1>,
+-					<&wo_data>, <&wo_boot>;
++					<&wo_data>;
+ 			memory-region-names = "wo-emi", "wo-ilm", "wo-dlm",
+-					      "wo-data", "wo-boot";
++					      "wo-data";
+ 			mediatek,wo-ccif = <&wo_ccif1>;
++			mediatek,wo-cpuboot = <&wo_cpuboot>;
+ 		};
+ 
+ 		eth: ethernet@15100000 {
+@@ -606,6 +602,11 @@
+ 			interrupts = <GIC_SPI 212 IRQ_TYPE_LEVEL_HIGH>;
+ 		};
+ 
++		wo_cpuboot: syscon@15194000 {
++			compatible = "mediatek,mt7986-wo-cpuboot", "syscon";
++			reg = <0 0x15194000 0 0x1000>;
++		};
++
+ 		wifi: wifi@18000000 {
+ 			compatible = "mediatek,mt7986-wmac";
+ 			reg = <0 0x18000000 0 0x1000000>,
diff --git a/6.12/target/linux/mediatek/patches-6.12/942-net-ethernet-mtk_wed-move-cpuboot-in-a-dedicated-dts.patch b/6.12/target/linux/mediatek/patches-6.12/942-net-ethernet-mtk_wed-move-cpuboot-in-a-dedicated-dts.patch
new file mode 100644
index 00000000..43014c5d
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/942-net-ethernet-mtk_wed-move-cpuboot-in-a-dedicated-dts.patch
@@ -0,0 +1,103 @@
+From f292d1bf83ec160bef2532b58aa08f5b71041923 Mon Sep 17 00:00:00 2001
+Message-Id: <f292d1bf83ec160bef2532b58aa08f5b71041923.1678716918.git.lorenzo@kernel.org>
+In-Reply-To: <3cf212c4ce6cd72c09bc47f35f539ba0afd4d106.1678716918.git.lorenzo@kernel.org>
+References: <3cf212c4ce6cd72c09bc47f35f539ba0afd4d106.1678716918.git.lorenzo@kernel.org>
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 11 Mar 2023 18:13:04 +0100
+Subject: [PATCH net-next 2/2] net: ethernet: mtk_wed: move cpuboot in a
+ dedicated dts node
+
+Since the cpuboot memory region is not part of the RAM SoC, move cpuboot
+in a deidicated syscon node.
+This patch helps to keep backward-compatibility with older version of
+uboot codebase where we have a limit of 8 reserved-memory dts child
+nodes.
+Keep backward-compatibility with older dts version where cpuboot was
+defined as reserved-memory child node.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_wed_mcu.c | 34 +++++++++++++++++----
+ drivers/net/ethernet/mediatek/mtk_wed_wo.h  |  3 +-
+ 2 files changed, 30 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
+@@ -32,14 +32,25 @@ static struct mtk_wed_wo_memory_region m
+ 	},
+ };
+ 
+-static u32 wo_r32(u32 reg)
++static u32 wo_r32(struct mtk_wed_wo *wo, u32 reg)
+ {
+-	return readl(mem_region[MTK_WED_WO_REGION_BOOT].addr + reg);
++	u32 val;
++
++	if (!wo->boot_regmap)
++		return readl(mem_region[MTK_WED_WO_REGION_BOOT].addr + reg);
++
++	if (regmap_read(wo->boot_regmap, reg, &val))
++		val = ~0;
++
++	return val;
+ }
+ 
+-static void wo_w32(u32 reg, u32 val)
++static void wo_w32(struct mtk_wed_wo *wo, u32 reg, u32 val)
+ {
+-	writel(val, mem_region[MTK_WED_WO_REGION_BOOT].addr + reg);
++	if (wo->boot_regmap)
++		regmap_write(wo->boot_regmap, reg, val);
++	else
++		writel(val, mem_region[MTK_WED_WO_REGION_BOOT].addr + reg);
+ }
+ 
+ static struct sk_buff *
+@@ -317,6 +328,9 @@ mtk_wed_mcu_load_firmware(struct mtk_wed
+ 	u32 val, boot_cr;
+ 	int ret, i;
+ 
++	wo->boot_regmap = syscon_regmap_lookup_by_phandle(wo->hw->node,
++							  "mediatek,wo-cpuboot");
++
+ 	/* load firmware region metadata */
+ 	for (i = 0; i < ARRAY_SIZE(mem_region); i++) {
+ 		int index = of_property_match_string(wo->hw->node,
+@@ -325,6 +339,9 @@ mtk_wed_mcu_load_firmware(struct mtk_wed
+ 		if (index < 0)
+ 			continue;
+ 
++		if (index == MTK_WED_WO_REGION_BOOT && !IS_ERR(wo->boot_regmap))
++			continue;
++
+ 		ret = mtk_wed_get_reserved_memory_region(wo->hw, index, &mem_region[i]);
+ 		if (ret)
+ 			return ret;
+@@ -373,13 +390,13 @@ mtk_wed_mcu_load_firmware(struct mtk_wed
+ 		boot_cr = MTK_WO_MCU_CFG_LS_WA_BOOT_ADDR_ADDR;
+ 	else
+ 		boot_cr = MTK_WO_MCU_CFG_LS_WM_BOOT_ADDR_ADDR;
+-	wo_w32(boot_cr, mem_region[MTK_WED_WO_REGION_EMI].phy_addr >> 16);
++	wo_w32(wo, boot_cr, mem_region[MTK_WED_WO_REGION_EMI].phy_addr >> 16);
+ 	/* wo firmware reset */
+-	wo_w32(MTK_WO_MCU_CFG_LS_WF_MCCR_CLR_ADDR, 0xc00);
++	wo_w32(wo, MTK_WO_MCU_CFG_LS_WF_MCCR_CLR_ADDR, 0xc00);
+ 
+-	val = wo_r32(MTK_WO_MCU_CFG_LS_WF_MCU_CFG_WM_WA_ADDR) |
++	val = wo_r32(wo, MTK_WO_MCU_CFG_LS_WF_MCU_CFG_WM_WA_ADDR) |
+ 	      MTK_WO_MCU_CFG_LS_WF_WM_WA_WM_CPU_RSTB_MASK;
+-	wo_w32(MTK_WO_MCU_CFG_LS_WF_MCU_CFG_WM_WA_ADDR, val);
++	wo_w32(wo, MTK_WO_MCU_CFG_LS_WF_MCU_CFG_WM_WA_ADDR, val);
+ out:
+ 	release_firmware(fw);
+ 
+--- a/drivers/net/ethernet/mediatek/mtk_wed_wo.h
++++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.h
+@@ -231,6 +231,7 @@ struct mtk_wed_wo_queue {
+ struct mtk_wed_wo {
+ 	struct mtk_wed_hw *hw;
+ 
++	struct regmap *boot_regmap;
+ 	struct mtk_wed_wo_queue q_tx;
+ 	struct mtk_wed_wo_queue q_rx;
+ 
diff --git a/6.12/target/linux/mediatek/patches-6.12/943-net-ethernet-mtk_wed-move-ilm-a-dedicated-dts-node.patch b/6.12/target/linux/mediatek/patches-6.12/943-net-ethernet-mtk_wed-move-ilm-a-dedicated-dts-node.patch
new file mode 100644
index 00000000..641c2597
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/943-net-ethernet-mtk_wed-move-ilm-a-dedicated-dts-node.patch
@@ -0,0 +1,86 @@
+From f3565e6c2276411275e707a5442d3f69cc111273 Mon Sep 17 00:00:00 2001
+Message-Id: <f3565e6c2276411275e707a5442d3f69cc111273.1678718888.git.lorenzo@kernel.org>
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sun, 12 Mar 2023 18:51:47 +0100
+Subject: [PATCH net-next 1/3] net: ethernet: mtk_wed: move ilm a dedicated dts
+ node
+
+Since the ilm memory region is not part of the RAM SoC, move ilm in a
+deidicated syscon node.
+This patch helps to keep backward-compatibility with older version of
+uboot codebase where we have a limit of 8 reserved-memory dts child
+nodes.
+Keep backward-compatibility with older dts version where ilm was defined
+as reserved-memory child node.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_wed_mcu.c | 55 ++++++++++++++++++---
+ 1 file changed, 49 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
+@@ -320,6 +320,39 @@ next:
+ }
+ 
+ static int
++mtk_wed_mcu_load_ilm(struct mtk_wed_wo *wo)
++{
++	struct mtk_wed_wo_memory_region *ilm_region;
++	struct resource res;
++	struct device_node *np;
++	int ret;
++
++	np = of_parse_phandle(wo->hw->node, "mediatek,wo-ilm", 0);
++	if (!np)
++		return 0;
++
++	ret = of_address_to_resource(np, 0, &res);
++	of_node_put(np);
++
++	if (ret < 0)
++		return ret;
++
++	ilm_region = &mem_region[MTK_WED_WO_REGION_ILM];
++	ilm_region->phy_addr = res.start;
++	ilm_region->size = resource_size(&res);
++	ilm_region->addr = devm_ioremap(wo->hw->dev, res.start,
++					resource_size(&res));
++
++	if (!IS_ERR(ilm_region->addr))
++		return 0;
++
++	ret = PTR_ERR(ilm_region->addr);
++	ilm_region->addr = NULL;
++
++	return ret;
++}
++
++static int
+ mtk_wed_mcu_load_firmware(struct mtk_wed_wo *wo)
+ {
+ 	const struct mtk_wed_fw_trailer *trailer;
+@@ -328,14 +361,20 @@ mtk_wed_mcu_load_firmware(struct mtk_wed
+ 	u32 val, boot_cr;
+ 	int ret, i;
+ 
++	mtk_wed_mcu_load_ilm(wo);
+ 	wo->boot_regmap = syscon_regmap_lookup_by_phandle(wo->hw->node,
+ 							  "mediatek,wo-cpuboot");
+ 
+ 	/* load firmware region metadata */
+ 	for (i = 0; i < ARRAY_SIZE(mem_region); i++) {
+-		int index = of_property_match_string(wo->hw->node,
+-						     "memory-region-names",
+-						     mem_region[i].name);
++		int index;
++
++		if (mem_region[i].addr)
++			continue;
++
++		index = of_property_match_string(wo->hw->node,
++						 "memory-region-names",
++						 mem_region[i].name);
+ 		if (index < 0)
+ 			continue;
+ 
diff --git a/6.12/target/linux/mediatek/patches-6.12/944-net-ethernet-mtk_wed-move-dlm-a-dedicated-dts-node.patch b/6.12/target/linux/mediatek/patches-6.12/944-net-ethernet-mtk_wed-move-dlm-a-dedicated-dts-node.patch
new file mode 100644
index 00000000..abb6591b
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/944-net-ethernet-mtk_wed-move-dlm-a-dedicated-dts-node.patch
@@ -0,0 +1,57 @@
+From b74ba226be2c45091b93bd49192bdd6d2178729e Mon Sep 17 00:00:00 2001
+Message-Id: <b74ba226be2c45091b93bd49192bdd6d2178729e.1678718888.git.lorenzo@kernel.org>
+In-Reply-To: <f3565e6c2276411275e707a5442d3f69cc111273.1678718888.git.lorenzo@kernel.org>
+References: <f3565e6c2276411275e707a5442d3f69cc111273.1678718888.git.lorenzo@kernel.org>
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Mon, 13 Mar 2023 15:45:16 +0100
+Subject: [PATCH net-next 3/3] net: ethernet: mtk_wed: move dlm a dedicated dts
+ node
+
+Since the dlm memory region is not part of the RAM SoC, move dlm in a
+deidicated syscon node.
+This patch helps to keep backward-compatibility with older version of
+uboot codebase where we have a limit of 8 reserved-memory dts child
+nodes.
+Keep backward-compatibility with older dts version where dlm was defined
+as reserved-memory child node.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_wed.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -1322,6 +1322,24 @@ mtk_wed_rro_alloc(struct mtk_wed_device
+ 	struct device_node *np;
+ 	int index;
+ 
++	np = of_parse_phandle(dev->hw->node, "mediatek,wo-dlm", 0);
++	if (np) {
++		struct resource res;
++		int ret;
++
++		ret = of_address_to_resource(np, 0, &res);
++		of_node_put(np);
++
++		if (ret < 0)
++			return ret;
++
++		dev->rro.miod_phys = res.start;
++		goto out;
++	}
++
++	/* For backward compatibility, we need to check if DLM
++	 * node is defined through reserved memory property.
++	 */
+ 	index = of_property_match_string(dev->hw->node, "memory-region-names",
+ 					 "wo-dlm");
+ 	if (index < 0)
+@@ -1338,6 +1356,7 @@ mtk_wed_rro_alloc(struct mtk_wed_device
+ 		return -ENODEV;
+ 
+ 	dev->rro.miod_phys = rmem->base;
++out:
+ 	dev->rro.fdbk_phys = MTK_WED_MIOD_COUNT + dev->rro.miod_phys;
+ 
+ 	return mtk_wed_rro_ring_alloc(dev, &dev->rro.ring,
diff --git a/6.12/target/linux/mediatek/patches-6.12/945-arm64-dts-mt7986-move-ilm-in-a-dedicated-node.patch b/6.12/target/linux/mediatek/patches-6.12/945-arm64-dts-mt7986-move-ilm-in-a-dedicated-node.patch
new file mode 100644
index 00000000..e2dce9ff
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/945-arm64-dts-mt7986-move-ilm-in-a-dedicated-node.patch
@@ -0,0 +1,83 @@
+From 01561065af5bf1d2a4244896d897e3a1eafbcd46 Mon Sep 17 00:00:00 2001
+Message-Id: <01561065af5bf1d2a4244896d897e3a1eafbcd46.1678717704.git.lorenzo@kernel.org>
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Mon, 13 Mar 2023 15:10:56 +0100
+Subject: [PATCH net-next] arm64: dts: mt7986: move ilm in a dedicated node
+
+Since the ilm memory region is not part of the RAM SoC, move ilm in a
+deidicated syscon node.
+This patch helps to keep backward-compatibility with older version of
+uboot codebase where we have a limit of 8 reserved-memory dts child
+nodes.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 34 +++++++++++------------
+ 1 file changed, 16 insertions(+), 18 deletions(-)
+
+--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+@@ -97,16 +97,6 @@
+ 			no-map;
+ 		};
+ 
+-		wo_ilm0: wo-ilm@151e0000 {
+-			reg = <0 0x151e0000 0 0x8000>;
+-			no-map;
+-		};
+-
+-		wo_ilm1: wo-ilm@151f0000 {
+-			reg = <0 0x151f0000 0 0x8000>;
+-			no-map;
+-		};
+-
+ 		wo_data: wo-data@4fd80000 {
+ 			reg = <0 0x4fd80000 0 0x240000>;
+ 			no-map;
+@@ -525,11 +515,10 @@
+ 			reg = <0 0x15010000 0 0x1000>;
+ 			interrupt-parent = <&gic>;
+ 			interrupts = <GIC_SPI 205 IRQ_TYPE_LEVEL_HIGH>;
+-			memory-region = <&wo_emi0>, <&wo_ilm0>, <&wo_dlm0>,
+-					<&wo_data>;
+-			memory-region-names = "wo-emi", "wo-ilm", "wo-dlm",
+-					      "wo-data";
++			memory-region = <&wo_emi0>, <&wo_dlm0>, <&wo_data>;
++			memory-region-names = "wo-emi", "wo-dlm", "wo-data";
+ 			mediatek,wo-ccif = <&wo_ccif0>;
++			mediatek,wo-ilm = <&wo_ilm0>;
+ 			mediatek,wo-cpuboot = <&wo_cpuboot>;
+ 		};
+ 
+@@ -539,11 +528,10 @@
+ 			reg = <0 0x15011000 0 0x1000>;
+ 			interrupt-parent = <&gic>;
+ 			interrupts = <GIC_SPI 206 IRQ_TYPE_LEVEL_HIGH>;
+-			memory-region = <&wo_emi1>, <&wo_ilm1>, <&wo_dlm1>,
+-					<&wo_data>;
+-			memory-region-names = "wo-emi", "wo-ilm", "wo-dlm",
+-					      "wo-data";
++			memory-region = <&wo_emi1>, <&wo_dlm1>, <&wo_data>;
++			memory-region-names = "wo-emi", "wo-dlm", "wo-data";
+ 			mediatek,wo-ccif = <&wo_ccif1>;
++			mediatek,wo-ilm = <&wo_ilm1>;
+ 			mediatek,wo-cpuboot = <&wo_cpuboot>;
+ 		};
+ 
+@@ -602,6 +590,16 @@
+ 			interrupts = <GIC_SPI 212 IRQ_TYPE_LEVEL_HIGH>;
+ 		};
+ 
++		wo_ilm0: syscon@151e0000 {
++			compatible = "mediatek,mt7986-wo-ilm", "syscon";
++			reg = <0 0x151e0000 0 0x8000>;
++		};
++
++		wo_ilm1: syscon@151f0000 {
++			compatible = "mediatek,mt7986-wo-ilm", "syscon";
++			reg = <0 0x151f0000 0 0x8000>;
++		};
++
+ 		wo_cpuboot: syscon@15194000 {
+ 			compatible = "mediatek,mt7986-wo-cpuboot", "syscon";
+ 			reg = <0 0x15194000 0 0x1000>;
diff --git a/6.12/target/linux/mediatek/patches-6.12/946-arm64-dts-mt7986-move-dlm-in-a-dedicated-node.patch b/6.12/target/linux/mediatek/patches-6.12/946-arm64-dts-mt7986-move-dlm-in-a-dedicated-node.patch
new file mode 100644
index 00000000..a972f235
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/946-arm64-dts-mt7986-move-dlm-in-a-dedicated-node.patch
@@ -0,0 +1,81 @@
+From 9f76be683a8ec498563c294bc1cc279468058302 Mon Sep 17 00:00:00 2001
+Message-Id: <9f76be683a8ec498563c294bc1cc279468058302.1678719283.git.lorenzo@kernel.org>
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Mon, 13 Mar 2023 15:53:30 +0100
+Subject: [PATCH net-next] arm64: dts: mt7986: move dlm in a dedicated node
+
+Since the dlm memory region is not part of the RAM SoC, move dlm in a
+deidicated syscon node.
+This patch helps to keep backward-compatibility with older version of
+uboot codebase where we have a limit of 8 reserved-memory dts child
+nodes.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 30 ++++++++++++-----------
+ 1 file changed, 16 insertions(+), 14 deletions(-)
+
+--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+@@ -101,16 +101,6 @@
+ 			reg = <0 0x4fd80000 0 0x240000>;
+ 			no-map;
+ 		};
+-
+-		wo_dlm0: wo-dlm@151e8000 {
+-			reg = <0 0x151e8000 0 0x2000>;
+-			no-map;
+-		};
+-
+-		wo_dlm1: wo-dlm@151f8000 {
+-			reg = <0 0x151f8000 0 0x2000>;
+-			no-map;
+-		};
+ 	};
+ 
+ 	soc {
+@@ -515,10 +505,11 @@
+ 			reg = <0 0x15010000 0 0x1000>;
+ 			interrupt-parent = <&gic>;
+ 			interrupts = <GIC_SPI 205 IRQ_TYPE_LEVEL_HIGH>;
+-			memory-region = <&wo_emi0>, <&wo_dlm0>, <&wo_data>;
+-			memory-region-names = "wo-emi", "wo-dlm", "wo-data";
++			memory-region = <&wo_emi0>, <&wo_data>;
++			memory-region-names = "wo-emi", "wo-data";
+ 			mediatek,wo-ccif = <&wo_ccif0>;
+ 			mediatek,wo-ilm = <&wo_ilm0>;
++			mediatek,wo-dlm = <&wo_dlm0>;
+ 			mediatek,wo-cpuboot = <&wo_cpuboot>;
+ 		};
+ 
+@@ -528,10 +519,11 @@
+ 			reg = <0 0x15011000 0 0x1000>;
+ 			interrupt-parent = <&gic>;
+ 			interrupts = <GIC_SPI 206 IRQ_TYPE_LEVEL_HIGH>;
+-			memory-region = <&wo_emi1>, <&wo_dlm1>, <&wo_data>;
+-			memory-region-names = "wo-emi", "wo-dlm", "wo-data";
++			memory-region = <&wo_emi1>, <&wo_data>;
++			memory-region-names = "wo-emi", "wo-data";
+ 			mediatek,wo-ccif = <&wo_ccif1>;
+ 			mediatek,wo-ilm = <&wo_ilm1>;
++			mediatek,wo-dlm = <&wo_dlm1>;
+ 			mediatek,wo-cpuboot = <&wo_cpuboot>;
+ 		};
+ 
+@@ -600,6 +592,16 @@
+ 			reg = <0 0x151f0000 0 0x8000>;
+ 		};
+ 
++		wo_dlm0: syscon@151e8000 {
++			compatible = "mediatek,mt7986-wo-dlm", "syscon";
++			reg = <0 0x151e8000 0 0x2000>;
++		};
++
++		wo_dlm1: syscon@151f8000 {
++			compatible = "mediatek,mt7986-wo-dlm", "syscon";
++			reg = <0 0x151f8000 0 0x2000>;
++		};
++
+ 		wo_cpuboot: syscon@15194000 {
+ 			compatible = "mediatek,mt7986-wo-cpuboot", "syscon";
+ 			reg = <0 0x15194000 0 0x1000>;
diff --git a/6.12/target/linux/mediatek/patches-6.12/999-fix-spinand_cal_read.patch b/6.12/target/linux/mediatek/patches-6.12/999-fix-spinand_cal_read.patch
new file mode 100644
index 00000000..d888d8f1
--- /dev/null
+++ b/6.12/target/linux/mediatek/patches-6.12/999-fix-spinand_cal_read.patch
@@ -0,0 +1,9 @@
+--- a/include/linux/mtd/spinand.h	2024-09-27 20:38:51.386171481 +0200
++++ b/include/linux/mtd/spinand.h	2024-09-27 20:39:01.034034861 +0200
+@@ -518,5 +518,5 @@
+ 
+ int spinand_upd_cfg(struct spinand_device *spinand, u8 mask, u8 val);
+ int spinand_select_target(struct spinand_device *spinand, unsigned int target);
+-
++int spinand_cal_read(void *priv, u32 *addr, int addrlen, u8 *buf, int readlen);
+ #endif /* __LINUX_MTD_SPINAND_H */
diff --git a/6.12/target/linux/qualcommax/config-6.12 b/6.12/target/linux/qualcommax/config-6.12
new file mode 100644
index 00000000..097b554f
--- /dev/null
+++ b/6.12/target/linux/qualcommax/config-6.12
@@ -0,0 +1,661 @@
+CONFIG_64BIT=y
+# CONFIG_AMD_QDMA is not set
+CONFIG_ARCH_BINFMT_ELF_EXTRA_PHDRS=y
+CONFIG_ARCH_CORRECT_STACKTRACE_ON_KRETPROBE=y
+CONFIG_ARCH_DEFAULT_KEXEC_IMAGE_VERIFY_SIG=y
+CONFIG_ARCH_DMA_ADDR_T_64BIT=y
+CONFIG_ARCH_FORCE_MAX_ORDER=10
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
+CONFIG_ARCH_MMAP_RND_BITS=18
+CONFIG_ARCH_MMAP_RND_BITS_MAX=24
+CONFIG_ARCH_MMAP_RND_BITS_MIN=18
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=11
+CONFIG_ARCH_PKEY_BITS=3
+CONFIG_ARCH_PROC_KCORE_TEXT=y
+CONFIG_ARCH_QCOM=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_STACKWALK=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARCH_WANTS_EXECMEM_LATE=y
+CONFIG_ARCH_WANTS_NO_INSTR=y
+CONFIG_ARCH_WANTS_THP_SWAP=y
+CONFIG_ARM64=y
+CONFIG_ARM64_4K_PAGES=y
+CONFIG_ARM64_ERRATUM_1165522=y
+CONFIG_ARM64_ERRATUM_1286807=y
+CONFIG_ARM64_ERRATUM_2051678=y
+CONFIG_ARM64_ERRATUM_2054223=y
+CONFIG_ARM64_ERRATUM_2067961=y
+CONFIG_ARM64_ERRATUM_2077057=y
+CONFIG_ARM64_ERRATUM_2658417=y
+CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
+CONFIG_ARM64_PA_BITS=48
+CONFIG_ARM64_PA_BITS_48=y
+# CONFIG_ARM64_PLATFORM_DEVICES is not set
+CONFIG_ARM64_PTR_AUTH=y
+CONFIG_ARM64_PTR_AUTH_KERNEL=y
+CONFIG_ARM64_SVE=y
+CONFIG_ARM64_TAGGED_ADDR_ABI=y
+CONFIG_ARM64_VA_BITS=39
+CONFIG_ARM64_VA_BITS_39=y
+# CONFIG_ARM64_VA_BITS_52 is not set
+CONFIG_ARM64_WORKAROUND_REPEAT_TLBI=y
+CONFIG_ARM64_WORKAROUND_SPECULATIVE_AT=y
+CONFIG_ARM64_WORKAROUND_TSB_FLUSH_FAILURE=y
+CONFIG_ARM_AMBA=y
+CONFIG_ARM_ARCH_TIMER=y
+CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
+CONFIG_ARM_GIC=y
+CONFIG_ARM_GIC_V2M=y
+CONFIG_ARM_GIC_V3=y
+CONFIG_ARM_GIC_V3_ITS=y
+# CONFIG_ARM_MHU_V2 is not set
+# CONFIG_ARM_MHU_V3 is not set
+CONFIG_ARM_PSCI_CPUIDLE=y
+CONFIG_ARM_PSCI_FW=y
+# CONFIG_ARM_QCOM_CPUFREQ_HW is not set
+CONFIG_ARM_QCOM_CPUFREQ_NVMEM=y
+CONFIG_AT803X_PHY=y
+CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y
+CONFIG_AUXILIARY_BUS=y
+# CONFIG_BASE_SMALL is not set
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_MQ_VIRTIO=y
+CONFIG_BLK_PM=y
+CONFIG_BUILTIN_RETURN_ADDRESS_STRIPS_PAC=y
+CONFIG_CAVIUM_TX2_ERRATUM_219=y
+CONFIG_CC_HAVE_SHADOW_CALL_STACK=y
+CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
+# CONFIG_CLK_QCM2290_GPUCC is not set
+# CONFIG_CLK_X1E80100_CAMCC is not set
+# CONFIG_CLK_X1E80100_DISPCC is not set
+# CONFIG_CLK_X1E80100_GCC is not set
+# CONFIG_CLK_X1E80100_GPUCC is not set
+# CONFIG_CLK_X1E80100_TCSRCC is not set
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMMON_CLK_QCOM=y
+CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
+# CONFIG_COMPAT_32BIT_TIME is not set
+# CONFIG_COMPRESSED_INSTALL is not set
+CONFIG_CONTEXT_TRACKING=y
+CONFIG_CONTEXT_TRACKING_IDLE=y
+CONFIG_COREDUMP=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_CPUFREQ_DT_PLATDEV=y
+CONFIG_CPU_FREQ=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL=y
+CONFIG_CPU_FREQ_GOV_ATTR_SET=y
+# CONFIG_CPU_FREQ_GOV_CONSERVATIVE is not set
+# CONFIG_CPU_FREQ_GOV_ONDEMAND is not set
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+# CONFIG_CPU_FREQ_GOV_POWERSAVE is not set
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+# CONFIG_CPU_FREQ_GOV_USERSPACE is not set
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_FREQ_THERMAL=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_IDLE_MULTIPLE_DRIVERS=y
+CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_MITIGATIONS=y
+CONFIG_CPU_PM=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_THERMAL=y
+CONFIG_CRC16=y
+CONFIG_CRC8=y
+CONFIG_CRYPTO_AUTHENC=y
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_DEV_QCE=y
+CONFIG_CRYPTO_DEV_QCE_AEAD=y
+# CONFIG_CRYPTO_DEV_QCE_ENABLE_AEAD is not set
+CONFIG_CRYPTO_DEV_QCE_ENABLE_ALL=y
+# CONFIG_CRYPTO_DEV_QCE_ENABLE_SHA is not set
+# CONFIG_CRYPTO_DEV_QCE_ENABLE_SKCIPHER is not set
+CONFIG_CRYPTO_DEV_QCE_SHA=y
+CONFIG_CRYPTO_DEV_QCE_SKCIPHER=y
+CONFIG_CRYPTO_DEV_QCE_SW_MAX_LEN=512
+CONFIG_CRYPTO_ECB=y
+CONFIG_CRYPTO_HASH_INFO=y
+CONFIG_CRYPTO_HW=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_DES=y
+CONFIG_CRYPTO_LIB_GF128MUL=y
+CONFIG_CRYPTO_LIB_SHA1=y
+CONFIG_CRYPTO_LIB_SHA256=y
+CONFIG_CRYPTO_LIB_UTILS=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_SHA1=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_XTS=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_INFO=y
+CONFIG_DEV_COREDUMP=y
+CONFIG_DMADEVICES=y
+CONFIG_DMA_BOUNCE_UNALIGNED_KMALLOC=y
+CONFIG_DMA_DIRECT_REMAP=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_NEED_SYNC=y
+CONFIG_DMA_OF=y
+CONFIG_DMA_VIRTUAL_CHANNELS=y
+CONFIG_DTC=y
+CONFIG_DT_IDLE_STATES=y
+CONFIG_EDAC_SUPPORT=y
+CONFIG_EXCLUSIVE_SYSTEM_RAM=y
+CONFIG_FIXED_PHY=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FRAME_POINTER=y
+CONFIG_FS_IOMAP=y
+CONFIG_FUJITSU_ERRATUM_010001=y
+CONFIG_FUNCTION_ALIGNMENT=4
+CONFIG_FUNCTION_ALIGNMENT_4B=y
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_FW_LOADER_SYSFS=y
+CONFIG_GCC_SUPPORTS_DYNAMIC_FTRACE_WITH_ARGS=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_ARCH_TOPOLOGY=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_DEVICES=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
+CONFIG_GENERIC_CSUM=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_GENERIC_IOREMAP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y
+CONFIG_GENERIC_MSI_IRQ=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GLOB=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_CDEV=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HWSPINLOCK=y
+CONFIG_HWSPINLOCK_QCOM=y
+CONFIG_I2C=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_CHARDEV=y
+# CONFIG_I2C_DESIGNWARE_CORE is not set
+CONFIG_I2C_HELPER_AUTO=y
+# CONFIG_I2C_QCOM_CCI is not set
+CONFIG_I2C_QUP=y
+# CONFIG_IDPF is not set
+CONFIG_IIO=y
+CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_INTERCONNECT=y
+CONFIG_INTERCONNECT_CLK=y
+# CONFIG_INTERCONNECT_QCOM is not set
+CONFIG_IPQ_APSS_6018=y
+CONFIG_IPQ_APSS_PLL=y
+# CONFIG_IPQ_GCC_4019 is not set
+# CONFIG_IPQ_GCC_5018 is not set
+# CONFIG_IPQ_GCC_5332 is not set
+# CONFIG_IPQ_GCC_6018 is not set
+# CONFIG_IPQ_GCC_8074 is not set
+# CONFIG_IPQ_GCC_9574 is not set
+# CONFIG_IPQ_NSSCC_QCA8K is not set
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FASTEOI_HIERARCHY_HANDLERS=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MSI_LIB=y
+CONFIG_IRQ_WORK=y
+# CONFIG_KEBA_CP500 is not set
+# CONFIG_KPSS_XCC is not set
+# CONFIG_LAN966X_OIC is not set
+# CONFIG_LEDS_KTD202X is not set
+# CONFIG_LEDS_NCP5623 is not set
+CONFIG_LEDS_TLC591XX=y
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_LRU_GEN_WALKS_MMU=y
+# CONFIG_LWQ_TEST is not set
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MAILBOX=y
+# CONFIG_MAILBOX_TEST is not set
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+CONFIG_MDIO_IPQ4019=y
+# CONFIG_MEM_ALLOC_PROFILING is not set
+# CONFIG_MFD_88PM886_PMIC is not set
+# CONFIG_MFD_ADP5585 is not set
+# CONFIG_MFD_CS40L50_I2C is not set
+# CONFIG_MFD_CS40L50_SPI is not set
+# CONFIG_MFD_QCOM_RPM is not set
+# CONFIG_MFD_ROHM_BD96801 is not set
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+# CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY is not set
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_CQHCI=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_IO_ACCESSORS=y
+CONFIG_MMC_SDHCI_MSM=y
+# CONFIG_MMC_SDHCI_PCI is not set
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMU_LAZY_TLB_REFCOUNT=y
+CONFIG_MODULES_USE_ELF_RELA=y
+# CONFIG_MODULE_COMPRESS is not set
+# CONFIG_MSM_GCC_8916 is not set
+# CONFIG_MSM_GCC_8917 is not set
+# CONFIG_MSM_GCC_8939 is not set
+# CONFIG_MSM_GCC_8976 is not set
+# CONFIG_MSM_GCC_8994 is not set
+# CONFIG_MSM_GCC_8996 is not set
+# CONFIG_MSM_GCC_8998 is not set
+# CONFIG_MSM_GPUCC_8998 is not set
+# CONFIG_MSM_MMCC_8996 is not set
+# CONFIG_MSM_MMCC_8998 is not set
+CONFIG_MTD_NAND_CORE=y
+CONFIG_MTD_NAND_ECC=y
+CONFIG_MTD_NAND_ECC_SW_HAMMING=y
+CONFIG_MTD_NAND_QCOM=y
+CONFIG_MTD_QCOMSMEM_PARTS=y
+CONFIG_MTD_RAW_NAND=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_BEB_LIMIT=20
+CONFIG_MTD_UBI_BLOCK=y
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_SG_DMA_LENGTH=y
+# CONFIG_NETKIT is not set
+CONFIG_NET_EGRESS=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_INGRESS=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_SWITCHDEV=y
+# CONFIG_NET_VENDOR_META is not set
+CONFIG_NET_XGRESS=y
+CONFIG_NLS=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NR_CPUS=4
+# CONFIG_NSM is not set
+CONFIG_NVIDIA_CARMEL_CNP_ERRATUM=y
+CONFIG_NVMEM=y
+CONFIG_NVMEM_LAYOUTS=y
+CONFIG_NVMEM_LAYOUT_U_BOOT_ENV=y
+CONFIG_NVMEM_QCOM_QFPROM=y
+# CONFIG_NVMEM_QCOM_SEC_QFPROM is not set
+CONFIG_NVMEM_SYSFS=y
+CONFIG_NVMEM_U_BOOT_ENV=y
+# CONFIG_OCTEON_EP_VF is not set
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_PADATA=y
+CONFIG_PAGE_POOL=y
+CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
+CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
+CONFIG_PARTITION_PERCPU=y
+CONFIG_PCI=y
+CONFIG_PCIEAER=y
+CONFIG_PCIEASPM=y
+CONFIG_PCIEASPM_DEFAULT=y
+# CONFIG_PCIEASPM_PERFORMANCE is not set
+# CONFIG_PCIEASPM_POWERSAVE is not set
+# CONFIG_PCIEASPM_POWER_SUPERSAVE is not set
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCIE_DW=y
+CONFIG_PCIE_DW_HOST=y
+CONFIG_PCIE_PME=y
+CONFIG_PCIE_QCOM=y
+CONFIG_PCIE_QCOM_COMMON=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DOMAINS_GENERIC=y
+CONFIG_PCI_MSI=y
+# CONFIG_PCI_NPEM is not set
+CONFIG_PER_VMA_LOCK=y
+# CONFIG_PFCP is not set
+CONFIG_PGTABLE_LEVELS=3
+CONFIG_PHYLIB=y
+CONFIG_PHYLIB_LEDS=y
+CONFIG_PHYS_ADDR_T_64BIT=y
+# CONFIG_PHY_QCOM_APQ8064_SATA is not set
+# CONFIG_PHY_QCOM_EDP is not set
+# CONFIG_PHY_QCOM_EUSB2_REPEATER is not set
+# CONFIG_PHY_QCOM_IPQ4019_USB is not set
+# CONFIG_PHY_QCOM_IPQ806X_SATA is not set
+# CONFIG_PHY_QCOM_IPQ806X_USB is not set
+# CONFIG_PHY_QCOM_M31_USB is not set
+# CONFIG_PHY_QCOM_PCIE2 is not set
+CONFIG_PHY_QCOM_QMP=y
+CONFIG_PHY_QCOM_QMP_COMBO=y
+CONFIG_PHY_QCOM_QMP_PCIE=y
+CONFIG_PHY_QCOM_QMP_PCIE_8996=y
+CONFIG_PHY_QCOM_QMP_UFS=y
+CONFIG_PHY_QCOM_QMP_USB=y
+# CONFIG_PHY_QCOM_QMP_USB_LEGACY is not set
+CONFIG_PHY_QCOM_QUSB2=y
+# CONFIG_PHY_QCOM_SGMII_ETH is not set
+# CONFIG_PHY_QCOM_SNPS_EUSB2 is not set
+# CONFIG_PHY_QCOM_USB_HS_28NM is not set
+# CONFIG_PHY_QCOM_USB_SNPS_FEMTO_V2 is not set
+# CONFIG_PHY_QCOM_USB_SS is not set
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_AW9523 is not set
+# CONFIG_PINCTRL_IPQ5018 is not set
+# CONFIG_PINCTRL_IPQ5332 is not set
+# CONFIG_PINCTRL_IPQ6018 is not set
+# CONFIG_PINCTRL_IPQ8074 is not set
+# CONFIG_PINCTRL_IPQ9574 is not set
+CONFIG_PINCTRL_MSM=y
+# CONFIG_PINCTRL_MSM8916 is not set
+# CONFIG_PINCTRL_MSM8976 is not set
+# CONFIG_PINCTRL_MSM8994 is not set
+# CONFIG_PINCTRL_MSM8996 is not set
+# CONFIG_PINCTRL_MSM8998 is not set
+# CONFIG_PINCTRL_QCM2290 is not set
+# CONFIG_PINCTRL_QCOM_SSBI_PMIC is not set
+# CONFIG_PINCTRL_QCS404 is not set
+# CONFIG_PINCTRL_QDU1000 is not set
+# CONFIG_PINCTRL_SA8775P is not set
+# CONFIG_PINCTRL_SC7180 is not set
+# CONFIG_PINCTRL_SC8280XP is not set
+# CONFIG_PINCTRL_SDM660 is not set
+# CONFIG_PINCTRL_SDM670 is not set
+# CONFIG_PINCTRL_SDM845 is not set
+# CONFIG_PINCTRL_SDX75 is not set
+# CONFIG_PINCTRL_SM4450 is not set
+# CONFIG_PINCTRL_SM6350 is not set
+# CONFIG_PINCTRL_SM6375 is not set
+# CONFIG_PINCTRL_SM7150 is not set
+# CONFIG_PINCTRL_SM8150 is not set
+# CONFIG_PINCTRL_SM8250 is not set
+# CONFIG_PINCTRL_SM8450 is not set
+# CONFIG_PINCTRL_SM8550 is not set
+# CONFIG_PINCTRL_SM8650 is not set
+# CONFIG_PINCTRL_X1E80100 is not set
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_OPP=y
+CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y
+CONFIG_POWER_RESET=y
+# CONFIG_POWER_RESET_MSM is not set
+# CONFIG_POWER_SEQUENCING is not set
+CONFIG_POWER_SUPPLY=y
+CONFIG_PRINTK_TIME=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_QCA807X_PHY=y
+CONFIG_QCA808X_PHY=y
+# CONFIG_QCM_DISPCC_2290 is not set
+# CONFIG_QCM_GCC_2290 is not set
+# CONFIG_QCOM_A53PLL is not set
+# CONFIG_QCOM_AOSS_QMP is not set
+CONFIG_QCOM_APCS_IPC=y
+# CONFIG_QCOM_APM is not set
+# CONFIG_QCOM_APR is not set
+CONFIG_QCOM_BAM_DMA=y
+# CONFIG_QCOM_CLK_APCC_MSM8996 is not set
+# CONFIG_QCOM_CLK_APCS_MSM8916 is not set
+# CONFIG_QCOM_COMMAND_DB is not set
+# CONFIG_QCOM_CPR is not set
+# CONFIG_QCOM_CPUCP_MBOX is not set
+# CONFIG_QCOM_EBI2 is not set
+# CONFIG_QCOM_FASTRPC is not set
+# CONFIG_QCOM_GENI_SE is not set
+# CONFIG_QCOM_GSBI is not set
+# CONFIG_QCOM_HFPLL is not set
+# CONFIG_QCOM_ICC_BWMON is not set
+# CONFIG_QCOM_IPA is not set
+# CONFIG_QCOM_IPCC is not set
+# CONFIG_QCOM_LLCC is not set
+CONFIG_QCOM_MDT_LOADER=y
+# CONFIG_QCOM_MPM is not set
+CONFIG_QCOM_NET_PHYLIB=y
+# CONFIG_QCOM_OCMEM is not set
+# CONFIG_QCOM_PDC is not set
+CONFIG_QCOM_PIL_INFO=y
+# CONFIG_QCOM_Q6V5_ADSP is not set
+CONFIG_QCOM_Q6V5_COMMON=y
+# CONFIG_QCOM_Q6V5_MSS is not set
+# CONFIG_QCOM_Q6V5_PAS is not set
+CONFIG_QCOM_Q6V5_WCSS=y
+CONFIG_QCOM_QSEECOM=y
+# CONFIG_QCOM_RAMP_CTRL is not set
+# CONFIG_QCOM_RMTFS_MEM is not set
+# CONFIG_QCOM_RPMH is not set
+# CONFIG_QCOM_RPM_MASTER_STATS is not set
+CONFIG_QCOM_RPROC_COMMON=y
+CONFIG_QCOM_SCM=y
+# CONFIG_QCOM_SMD_RPM is not set
+CONFIG_QCOM_SMEM=y
+CONFIG_QCOM_SMEM_STATE=y
+CONFIG_QCOM_SMP2P=y
+# CONFIG_QCOM_SMSM is not set
+CONFIG_QCOM_SOCINFO=y
+# CONFIG_QCOM_SPM is not set
+# CONFIG_QCOM_STATS is not set
+# CONFIG_QCOM_SYSMON is not set
+CONFIG_QCOM_TSENS=y
+CONFIG_QCOM_TZMEM=y
+CONFIG_QCOM_TZMEM_MODE_GENERIC=y
+# CONFIG_QCOM_TZMEM_MODE_SHMBRIDGE is not set
+# CONFIG_QCOM_WCNSS_CTRL is not set
+# CONFIG_QCOM_WCNSS_PIL is not set
+CONFIG_QCOM_WDT=y
+# CONFIG_QCS_GCC_404 is not set
+# CONFIG_QCS_Q6SSTOP_404 is not set
+# CONFIG_QCS_TURING_404 is not set
+# CONFIG_QDU_ECPRICC_1000 is not set
+# CONFIG_QDU_GCC_1000 is not set
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_RANDSTRUCT_NONE=y
+CONFIG_RAS=y
+CONFIG_RATIONAL=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGULATOR=y
+# CONFIG_REGULATOR_CPR3 is not set
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+# CONFIG_REGULATOR_MAX77503 is not set
+# CONFIG_REGULATOR_NETLINK_EVENTS is not set
+CONFIG_REGULATOR_USERSPACE_CONSUMER=y
+# CONFIG_REGULATOR_VQMMC_IPQ4019 is not set
+CONFIG_RELOCATABLE=y
+CONFIG_REMOTEPROC=y
+CONFIG_REMOTEPROC_CDEV=y
+CONFIG_RESET_CONTROLLER=y
+# CONFIG_RESET_GPIO is not set
+# CONFIG_RESET_QCOM_AOSS is not set
+# CONFIG_RESET_QCOM_PDC is not set
+CONFIG_RFS_ACCEL=y
+CONFIG_RODATA_FULL_DEFAULT_ENABLED=y
+# CONFIG_RPMB is not set
+CONFIG_RPMSG=y
+CONFIG_RPMSG_CHAR=y
+# CONFIG_RPMSG_CTRL is not set
+# CONFIG_RPMSG_NS is not set
+CONFIG_RPMSG_QCOM_GLINK=y
+CONFIG_RPMSG_QCOM_GLINK_RPM=y
+CONFIG_RPMSG_QCOM_GLINK_SMEM=y
+CONFIG_RPMSG_QCOM_SMD=y
+# CONFIG_RPMSG_TTY is not set
+CONFIG_RPS=y
+# CONFIG_RTASE is not set
+CONFIG_RTC_CLASS=y
+# CONFIG_RTC_DRV_MAX31335 is not set
+# CONFIG_RTC_DRV_RX8111 is not set
+# CONFIG_RTC_DRV_SD2405AL is not set
+CONFIG_RTC_I2C_AND_SPI=y
+CONFIG_RUSTC_SUPPORTS_ARM64=y
+CONFIG_RWSEM_SPIN_ON_OWNER=y
+# CONFIG_SA_GCC_8775P is not set
+# CONFIG_SA_GPUCC_8775P is not set
+# CONFIG_SCHED_CORE is not set
+CONFIG_SCHED_HW_PRESSURE=y
+CONFIG_SCHED_MC=y
+CONFIG_SCHED_SMT=y
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+# CONFIG_SCSI_LOWLEVEL is not set
+# CONFIG_SCSI_PROC_FS is not set
+# CONFIG_SC_CAMCC_7280 is not set
+# CONFIG_SC_CAMCC_8280XP is not set
+# CONFIG_SC_DISPCC_7180 is not set
+# CONFIG_SC_DISPCC_8280XP is not set
+# CONFIG_SC_GCC_7180 is not set
+# CONFIG_SC_GCC_8280XP is not set
+# CONFIG_SC_GPUCC_7180 is not set
+# CONFIG_SC_LPASSCC_7280 is not set
+# CONFIG_SC_LPASSCC_8280XP is not set
+# CONFIG_SC_LPASS_CORECC_7180 is not set
+# CONFIG_SC_LPASS_CORECC_7280 is not set
+# CONFIG_SC_VIDEOCC_7180 is not set
+# CONFIG_SDM_CAMCC_845 is not set
+# CONFIG_SDM_DISPCC_845 is not set
+# CONFIG_SDM_GCC_660 is not set
+# CONFIG_SDM_GCC_845 is not set
+# CONFIG_SDM_GPUCC_845 is not set
+# CONFIG_SDM_LPASSCC_845 is not set
+# CONFIG_SDM_VIDEOCC_845 is not set
+# CONFIG_SDX_GCC_75 is not set
+CONFIG_SERIAL_8250_FSL=y
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_MSM=y
+CONFIG_SERIAL_MSM_CONSOLE=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SG_POOL=y
+CONFIG_SMP=y
+# CONFIG_SM_CAMCC_4450 is not set
+# CONFIG_SM_CAMCC_6350 is not set
+# CONFIG_SM_CAMCC_7150 is not set
+# CONFIG_SM_CAMCC_8150 is not set
+# CONFIG_SM_CAMCC_8450 is not set
+# CONFIG_SM_CAMCC_8550 is not set
+# CONFIG_SM_CAMCC_8650 is not set
+# CONFIG_SM_GCC_4450 is not set
+# CONFIG_SM_GCC_7150 is not set
+# CONFIG_SM_GCC_8150 is not set
+# CONFIG_SM_GCC_8250 is not set
+# CONFIG_SM_GCC_8450 is not set
+# CONFIG_SM_GCC_8550 is not set
+# CONFIG_SM_GCC_8650 is not set
+# CONFIG_SM_GPUCC_4450 is not set
+# CONFIG_SM_GPUCC_6115 is not set
+# CONFIG_SM_GPUCC_6125 is not set
+# CONFIG_SM_GPUCC_6350 is not set
+# CONFIG_SM_GPUCC_6375 is not set
+# CONFIG_SM_GPUCC_8150 is not set
+# CONFIG_SM_GPUCC_8250 is not set
+# CONFIG_SM_GPUCC_8350 is not set
+# CONFIG_SM_GPUCC_8450 is not set
+# CONFIG_SM_GPUCC_8550 is not set
+# CONFIG_SM_GPUCC_8650 is not set
+# CONFIG_SM_TCSRCC_8550 is not set
+# CONFIG_SM_TCSRCC_8650 is not set
+# CONFIG_SM_VIDEOCC_7150 is not set
+# CONFIG_SM_VIDEOCC_8150 is not set
+# CONFIG_SM_VIDEOCC_8250 is not set
+# CONFIG_SM_VIDEOCC_8350 is not set
+# CONFIG_SM_VIDEOCC_8450 is not set
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOC_BUS=y
+CONFIG_SOFTIRQ_ON_OWN_STACK=y
+CONFIG_SPARSEMEM=y
+CONFIG_SPARSEMEM_EXTREME=y
+CONFIG_SPARSEMEM_VMEMMAP=y
+CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_SPI=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+CONFIG_SPI_QUP=y
+CONFIG_SPLIT_PMD_PTLOCKS=y
+CONFIG_SPLIT_PTE_PTLOCKS=y
+CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU=y
+CONFIG_SWIOTLB=y
+CONFIG_SWPHY=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+# CONFIG_TEHUTI_TN40 is not set
+# CONFIG_TEST_FPU is not set
+# CONFIG_TEST_MULDIV64 is not set
+# CONFIG_TEST_OBJPOOL is not set
+CONFIG_THERMAL=y
+# CONFIG_THERMAL_CORE_TESTING is not set
+# CONFIG_THERMAL_DEBUGFS is not set
+CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
+CONFIG_THERMAL_GOV_STEP_WISE=y
+CONFIG_THERMAL_OF=y
+CONFIG_THREAD_INFO_IN_TASK=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TRACE_IRQFLAGS_NMI_SUPPORT=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_UBIFS_FS=y
+CONFIG_UBIFS_FS_ADVANCED_COMPR=y
+# CONFIG_UCLAMP_TASK is not set
+CONFIG_UNMAP_KERNEL_AT_EL0=y
+CONFIG_USB=y
+CONFIG_USB_COMMON=y
+CONFIG_USB_DEFAULT_AUTHORIZATION_MODE=1
+# CONFIG_USB_ONBOARD_DEV is not set
+CONFIG_USB_SUPPORT=y
+CONFIG_USER_STACKTRACE_SUPPORT=y
+CONFIG_VDSO_GETRANDOM=y
+CONFIG_VIRTIO=y
+CONFIG_VIRTIO_ANCHOR=y
+# CONFIG_VIRTIO_BLK is not set
+# CONFIG_VIRTIO_DEBUG is not set
+# CONFIG_VIRTIO_NET is not set
+CONFIG_VMAP_STACK=y
+CONFIG_WANT_DEV_COREDUMP=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_WATCHDOG_SYSFS=y
+CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZONE_DMA32=y
+CONFIG_ZSTD_COMMON=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/6.12/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq6000-360v6.dts b/6.12/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq6000-360v6.dts
new file mode 100644
index 00000000..07aabe04
--- /dev/null
+++ b/6.12/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq6000-360v6.dts
@@ -0,0 +1,219 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+
+#include "ipq6018-512m.dtsi"
+#include "ipq6018-ess.dtsi"
+#include "ipq6018-cp-cpu.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	model = "Qihoo 360V6";
+	compatible = "qihoo,360v6", "qcom,ipq6018";
+
+	aliases {
+		serial0 = &blsp1_uart3;
+		led-boot = &led_status_red;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_orange;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs-append = " root=/dev/ubiblock0_1";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&tlmm 19 GPIO_ACTIVE_LOW>;
+		};
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&tlmm 68 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_red: red {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&tlmm 71 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_orange: orange {
+			color = <LED_COLOR_ID_ORANGE>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&tlmm 72 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_green: green {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&tlmm 73 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&tlmm {
+	mdio_pins: mdio-pins {
+		mdc {
+			pins = "gpio64";
+			function = "mdc";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+
+		mdio {
+			pins = "gpio65";
+			function = "mdio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+};
+
+&blsp1_uart3 {
+	pinctrl-0 = <&serial_3_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+};
+
+&qpic_bam {
+	status = "okay";
+};
+
+&qpic_nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		nand-ecc-strength = <4>;
+		nand-ecc-step-size = <512>;
+		nand-bus-width = <8>;
+
+		partitions {
+			compatible = "qcom,smem-part";
+		};
+	};
+};
+
+&qusb_phy_0 {
+	status = "okay";
+};
+
+&ssphy_0 {
+	status = "okay";
+};
+
+&usb3 {
+	status = "okay";
+};
+
+&mdio {
+	status = "okay";
+
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+	reset-gpios = <&tlmm 75 GPIO_ACTIVE_LOW>;
+
+	ethernet-phy-package@0 {
+		compatible = "qcom,qca8075-package";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0>;
+
+		qca8075_0: ethernet-phy@0 {
+			compatible = "ethernet-phy-ieee802.3-c22";
+			reg = <0>;
+		};
+
+		qca8075_1: ethernet-phy@1 {
+			compatible = "ethernet-phy-ieee802.3-c22";
+			reg = <1>;
+		};
+
+		qca8075_2: ethernet-phy@2 {
+			compatible = "ethernet-phy-ieee802.3-c22";
+			reg = <2>;
+		};
+
+		qca8075_3: ethernet-phy@3 {
+			compatible = "ethernet-phy-ieee802.3-c22";
+			reg = <3>;
+		};
+	};
+};
+
+&switch {
+	status = "okay";
+
+	switch_lan_bmp = <(ESS_PORT1 | ESS_PORT2 | ESS_PORT3)>;
+	switch_wan_bmp = <ESS_PORT4>;
+	switch_mac_mode = <MAC_MODE_PSGMII>;
+
+	qcom,port_phyinfo {
+		port@1 {
+			port_id = <1>;
+			phy_address = <0>;
+		};
+		port@2 {
+			port_id = <2>;
+			phy_address = <1>;
+		};
+		port@3 {
+			port_id = <3>;
+			phy_address = <2>;
+		};
+		port@4 {
+			port_id = <4>;
+			phy_address = <3>;
+		};
+	};
+};
+
+&edma {
+	status = "okay";
+};
+
+&dp1 {
+	status = "okay";
+	phy-handle = <&qca8075_0>;
+	label = "lan1";
+};
+
+&dp2 {
+	status = "okay";
+	phy-handle = <&qca8075_1>;
+	label = "lan2";
+};
+
+&dp3 {
+	status = "okay";
+	phy-handle = <&qca8075_2>;
+	label = "lan3";
+};
+
+&dp4 {
+	status = "okay";
+	phy-handle = <&qca8075_3>;
+	label = "wan";
+};
+
+&wifi {
+	status = "okay";
+
+	qcom,ath11k-fw-memory-mode = <1>;
+	qcom,ath11k-calibration-variant = "Qihoo-360V6";
+};
diff --git a/6.12/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq6000-mr7350.dts b/6.12/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq6000-mr7350.dts
new file mode 100644
index 00000000..5761c3b5
--- /dev/null
+++ b/6.12/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq6000-mr7350.dts
@@ -0,0 +1,465 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+
+#include "ipq6018.dtsi"
+#include "ipq6018-cp-cpu.dtsi"
+#include "ipq6018-ess.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	model = "Linksys MR7350";
+	compatible = "linksys,mr7350", "qcom,ipq6018";
+
+	aliases {
+		serial0 = &blsp1_uart3;
+		serial1 = &blsp1_uart2;
+		led-boot = &led_system_blue;
+		led-running = &led_system_blue;
+		led-failsafe = &led_system_red;
+		led-upgrade = &led_system_green;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs-append = " root=/dev/ubiblock0_0";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		wps-button {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&tlmm 56 GPIO_ACTIVE_LOW>;
+		};
+
+		reset-button {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&tlmm 57 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		/*lan1-amber {
+			label = "amber:lan1";
+			color = <LED_COLOR_ID_AMBER>;
+			gpios = <&qca8075_0 0 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan1-green {
+			label = "green:lan1";
+			color = <LED_COLOR_ID_GREEN>;
+			gpios = <&qca8075_0 1 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan2-amber {
+			label = "amber:lan2";
+			color = <LED_COLOR_ID_AMBER>;
+			gpios = <&qca8075_1 0 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan2-green {
+			label = "green:lan2";
+			color = <LED_COLOR_ID_GREEN>;
+			gpios = <&qca8075_1 1 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan3-amber {
+			label = "amber:lan3";
+			color = <LED_COLOR_ID_AMBER>;
+			gpios = <&qca8075_2 0 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan3-green {
+			label = "green:lan3";
+			color = <LED_COLOR_ID_GREEN>;
+			gpios = <&qca8075_2 1 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan4-amber {
+			label = "amber:lan4";
+			color = <LED_COLOR_ID_AMBER>;
+			gpios = <&qca8075_3 0 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan4-green {
+			label = "green:lan4";
+			color = <LED_COLOR_ID_GREEN>;
+			gpios = <&qca8075_3 1 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan-amber {
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_WAN;
+			gpios = <&qca8075_4 0 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan-green {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WAN;
+			gpios = <&qca8075_4 1 GPIO_ACTIVE_HIGH>;
+		};*/
+
+		usb {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_USB;
+			gpios = <&tlmm 60 GPIO_ACTIVE_HIGH>;
+			trigger-sources = <&usb3_port1>, <&usb3_port2>;
+			linux,default-trigger = "usbport";
+		};
+	};
+
+	reg_usb_vbus: regulator-usb-vbus {
+		compatible = "regulator-fixed";
+		regulator-name = "usb_vbus";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		gpio = <&tlmm 61 GPIO_ACTIVE_LOW>;
+		regulator-boot-on;
+	};
+
+	output-usb0-power {
+		compatible = "regulator-output";
+		vout-supply = <&reg_usb_vbus>;
+	};
+};
+
+&tlmm {
+	hsuart_pins: hsuart-pins {
+		mux {
+			pins = "gpio69", "gpio70",
+				"gpio71", "gpio72";
+			function = "blsp1_uart";
+			drive-strength = <8>;
+			bias-disable;
+		};
+	};
+
+	i2c_pins: i2c-pins {
+		mux {
+			pins = "gpio42", "gpio43";
+			function = "blsp2_i2c";
+			drive-strength = <8>;
+			bias-pull-down;
+		};
+	};
+
+	mdio_pins: mdio-state {
+		mdc-pins {
+			pins = "gpio64";
+			function = "mdc";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+
+		mdio-pins {
+			pins = "gpio65";
+			function = "mdio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+};
+
+&blsp1_i2c3 {
+	pinctrl-0 = <&i2c_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+
+	led-controller@62 {
+		compatible = "nxp,pca9633";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0x62>;
+
+		led_system_red: led@0 {
+			reg = <0>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+		};
+
+		led_system_green: led@1 {
+			reg = <1>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+		};
+
+		led_system_blue: led@2 {
+			reg = <2>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+		};
+	};
+};
+
+&blsp1_uart2 {
+	pinctrl-0 = <&hsuart_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+};
+
+&blsp1_uart3 {
+	pinctrl-0 = <&serial_3_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+};
+
+&dwc_0 {
+	#address-cells = <1>;
+	#size-cells = <0>;
+
+	usb3_port1: port@1 {
+		reg = <1>;
+		#trigger-source-cells = <0>;
+	};
+
+	usb3_port2: port@2 {
+		reg = <2>;
+		#trigger-source-cells = <0>;
+	};
+};
+
+&qpic_bam {
+	status = "okay";
+};
+
+&qpic_nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		nand-ecc-strength = <4>;
+		nand-ecc-step-size = <512>;
+		nand-bus-width = <8>;
+
+		partitions {
+			compatible = "qcom,smem-part";
+		};
+	};
+};
+
+&qusb_phy_0 {
+	status = "okay";
+};
+
+&ssphy_0 {
+	status = "okay";
+};
+
+&usb3 {
+	vbus-supply = <&reg_usb_vbus>;
+	status = "okay";
+};
+
+&mdio {
+	status = "okay";
+
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+	reset-gpios = <&tlmm 75 GPIO_ACTIVE_LOW>;
+
+	ethernet-phy-package@0 {
+		compatible = "qcom,qca8075-package";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0>;
+
+		qca8075_0: ethernet-phy@0 {
+			compatible = "ethernet-phy-ieee802.3-c22";
+			reg = <0>;
+
+			leds {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				led@0 {
+					reg = <0>;
+					color = <LED_COLOR_ID_ORANGE>;
+					function = LED_FUNCTION_LAN;
+					default-state = "keep";
+				};
+
+				led@1 {
+					reg = <1>;
+					color = <LED_COLOR_ID_GREEN>;
+					function = LED_FUNCTION_LAN;
+					default-state = "keep";
+				};
+			};
+		};
+
+		qca8075_1: ethernet-phy@1 {
+			compatible = "ethernet-phy-ieee802.3-c22";
+			reg = <1>;
+
+			leds {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				led@0 {
+					reg = <0>;
+					color = <LED_COLOR_ID_ORANGE>;
+					function = LED_FUNCTION_LAN;
+					default-state = "keep";
+				};
+
+				led@1 {
+					reg = <1>;
+					color = <LED_COLOR_ID_GREEN>;
+					function = LED_FUNCTION_LAN;
+					default-state = "keep";
+				};
+			};
+		};
+
+		qca8075_2: ethernet-phy@2 {
+			compatible = "ethernet-phy-ieee802.3-c22";
+			reg = <2>;
+
+			leds {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				led@0 {
+					reg = <0>;
+					color = <LED_COLOR_ID_ORANGE>;
+					function = LED_FUNCTION_LAN;
+					default-state = "keep";
+				};
+
+				led@1 {
+					reg = <1>;
+					color = <LED_COLOR_ID_GREEN>;
+					function = LED_FUNCTION_LAN;
+					default-state = "keep";
+				};
+			};
+		};
+
+		qca8075_3: ethernet-phy@3 {
+			compatible = "ethernet-phy-ieee802.3-c22";
+			reg = <3>;
+
+			leds {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				led@0 {
+					reg = <0>;
+					color = <LED_COLOR_ID_ORANGE>;
+					function = LED_FUNCTION_LAN;
+					default-state = "keep";
+				};
+
+				led@1 {
+					reg = <1>;
+					color = <LED_COLOR_ID_GREEN>;
+					function = LED_FUNCTION_LAN;
+					default-state = "keep";
+				};
+			};
+		};
+
+		qca8075_4: ethernet-phy@4 {
+			compatible = "ethernet-phy-ieee802.3-c22";
+			reg = <4>;
+
+			leds {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				led@0 {
+					reg = <0>;
+					color = <LED_COLOR_ID_ORANGE>;
+					function = LED_FUNCTION_WAN;
+					default-state = "keep";
+				};
+
+				led@1 {
+					reg = <1>;
+					color = <LED_COLOR_ID_GREEN>;
+					function = LED_FUNCTION_WAN;
+					default-state = "keep";
+				};
+			};
+		};
+	};
+};
+
+&switch {
+	status = "okay";
+
+	switch_lan_bmp = <(ESS_PORT1 | ESS_PORT2 | ESS_PORT3 | ESS_PORT4)>;
+	switch_wan_bmp = <ESS_PORT5>;
+	switch_mac_mode = <MAC_MODE_PSGMII>;
+
+	qcom,port_phyinfo {
+		port@1 {
+			port_id = <1>;
+			phy_address = <0>;
+		};
+		port@2 {
+			port_id = <2>;
+			phy_address = <1>;
+		};
+		port@3 {
+			port_id = <3>;
+			phy_address = <2>;
+		};
+		port@4 {
+			port_id = <4>;
+			phy_address = <3>;
+		};
+		port@5 {
+			port_id = <5>;
+			phy_address = <4>;
+		};
+	};
+};
+
+&edma {
+	status = "okay";
+};
+
+&dp1 {
+	status = "okay";
+	phy-handle = <&qca8075_0>;
+	label = "lan1";
+};
+
+&dp2 {
+	status = "okay";
+	phy-handle = <&qca8075_1>;
+	label = "lan2";
+};
+
+&dp3 {
+	status = "okay";
+	phy-handle = <&qca8075_2>;
+	label = "lan3";
+};
+
+&dp4 {
+	status = "okay";
+	phy-handle = <&qca8075_3>;
+	label = "lan4";
+};
+
+&dp5 {
+	status = "okay";
+	phy-handle = <&qca8075_4>;
+	label = "wan";
+};
+
+&wifi {
+	status = "okay";
+
+	qcom,ath11k-calibration-variant = "Linksys-MR7350";
+	qcom,ath11k-fw-memory-mode = <1>;
+};
diff --git a/6.12/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq6010-mango-dvk.dts b/6.12/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq6010-mango-dvk.dts
new file mode 100644
index 00000000..f86d2ce6
--- /dev/null
+++ b/6.12/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq6010-mango-dvk.dts
@@ -0,0 +1,364 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+
+#include "ipq6018.dtsi"
+#include "ipq6018-cp-cpu.dtsi"
+#include "ipq6018-ess.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	model = "8devices Mango-DVK";
+	compatible = "8devices,mango-dvk", "qcom,ipq6018";
+
+	aliases {
+		serial0 = &blsp1_uart3;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		wps {
+			label = "wps";
+			gpios = <&tlmm 79 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		wlan5g {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN;
+			function-enumerator = <0>;
+			gpios = <&tlmm 66 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy0radio";
+		};
+
+		wlan2g {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN;
+			function-enumerator = <1>;
+			gpios = <&tlmm 67 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "phy1radio";
+		};
+	};
+};
+
+&tlmm {
+	mdio_pins: mdio-pins {
+		mdc {
+			pins = "gpio64";
+			function = "mdc";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+
+		mdio {
+			pins = "gpio65";
+			function = "mdio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+
+	spi_0_pins: spi-0-pins {
+		pins = "gpio38", "gpio39", "gpio40", "gpio41";
+		function = "blsp0_spi";
+		drive-strength = <8>;
+		bias-pull-down;
+	};
+
+	led_pins: led_pins {
+		leds {
+			pins = "gpio66", "gpio67";
+			function = "gpio";
+			drive-strength = <8>;
+			bias-pull-down;
+		};
+	};
+
+	sd_pins: sd_pins {
+		sd_cd {
+			 pins = "gpio62";
+			 function = "gpio";
+			 drive-strength = <8>;
+			 bias-pull-up;
+		};
+	};
+};
+
+&blsp1_uart3 {
+	pinctrl-0 = <&serial_3_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+};
+
+&blsp1_spi1 {
+	pinctrl-0 = <&spi_0_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+
+	flash@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0>;
+		compatible = "jedec,spi-nor";
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "0:SBL1";
+				reg = <0x00000000 0x000c0000>;
+			};
+
+			partition@c0000 {
+				label = "0:MIBIB";
+				reg = <0x000c0000 0x00010000>;
+			};
+
+			partition@d0000 {
+				label = "0:QSEE";
+				reg = <0x000d0000 0x001a0000>;
+			};
+
+			partition@270000 {
+				label = "0:DEVCFG";
+				reg = <0x00270000 0x00010000>;
+			};
+
+			partition@280000 {
+				label = "0:RPM";
+				reg = <0x00280000 0x00020000>;
+			};
+
+			partition@2a0000 {
+				label = "0:CDT";
+				reg = <0x002a0000 0x00010000>;
+			};
+
+			partition@2b0000 {
+				label = "0:APPSBLENV";
+				reg = <0x002b0000 0x00010000>;
+			};
+
+			partition@2c0000 {
+				label = "0:APPSBL";
+				reg = <0x002c0000 0x000a0000>;
+			};
+
+			partition@360000 {
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+				label = "0:ART";
+				reg = <0x00360000 0x00040000>;
+
+				macaddr_eth0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_eth1: macaddr@6 {
+					reg = <0x6 0x6>;
+				};
+
+				macaddr_eth2: macaddr@c {
+					reg = <0xc 0x6>;
+				};
+			};
+
+			partition@3a0000 {
+				label = "config";
+				reg = <0x003a0000 0x00040000>;
+			};
+
+			partition@3e0000 {
+				label = "data";
+				reg = <0x003e0000 0x00100000>;
+			};
+
+			partition@4e0000 {
+				label = "firmware";
+				compatible = "denx,fit";
+				reg = <0x004e0000 0x1b20000>;
+			};
+		};
+	};
+};
+
+&dp3 {
+	status = "okay";
+
+	phy-handle = <&qca8072_1>;
+	nvmem-cells = <&macaddr_eth1>;
+	nvmem-cell-names = "mac-address";
+	label = "lan2";
+};
+
+&dp4 {
+	status = "okay";
+
+	phy-handle = <&qca8072_0>;
+	nvmem-cells = <&macaddr_eth0>;
+	nvmem-cell-names = "mac-address";
+	label = "lan1";
+};
+
+&dp5 {
+	status = "okay";
+
+	phy-mode = "sgmii";
+	phy-handle = <&qca8081>;
+	nvmem-cells = <&macaddr_eth2>;
+	nvmem-cell-names = "mac-address";
+	label = "wan";
+};
+
+&edma {
+	status = "okay";
+};
+
+&mdio {
+	status = "okay";
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+	reset-gpios = <&tlmm 75 GPIO_ACTIVE_LOW>;
+	reset-delay-us = <10000>;
+	reset-post-delay-us = <50000>;
+
+	ethernet-phy-package@0 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		compatible = "qcom,qca8075-package";
+		reg = <0>;
+
+		qcom,package-mode = "psgmii";
+
+		qca8072_0: ethernet-phy@3 {
+			compatible = "ethernet-phy-ieee802.3-c22";
+			reg = <3>;
+		};
+
+		qca8072_1: ethernet-phy@4 {
+			compatible = "ethernet-phy-ieee802.3-c22";
+			reg = <4>;
+		};
+	};
+
+	qca8081: ethernet-phy@24 {
+		compatible = "ethernet-phy-id004d.d101";
+		reg = <24>;
+		reset-gpios = <&tlmm 77 GPIO_ACTIVE_LOW>;
+		reset-assert-us = <10000>;
+		reset-deassert-us = <50000>;
+	};
+};
+
+&sdhc {
+	pinctrl-0 = <&sd_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+
+	vqmmc-supply = <&ipq6018_l2>;
+	cd-gpios = <&tlmm 62 GPIO_ACTIVE_LOW>;
+};
+
+&switch {
+	status = "okay";
+
+	switch_lan_bmp = <(ESS_PORT3 | ESS_PORT4)>;
+	switch_wan_bmp = <ESS_PORT5>;
+	switch_mac_mode = <MAC_MODE_PSGMII>;
+	switch_mac_mode1 = <MAC_MODE_SGMII_PLUS>;
+	port3_pcs_channel = <4>;
+
+	qcom,port_phyinfo {
+		port@3 {
+			port_id = <3>;
+			phy_address = <4>;
+		};
+		port@4 {
+			port_id = <4>;
+			phy_address = <3>;
+		};
+		port@5 {
+			port_id = <5>;
+			phy_address = <24>;
+			port_mac_sel = "QGMAC_PORT";
+		};
+	};
+};
+
+&qpic_bam {
+	status = "okay";
+};
+
+&qpic_nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+
+		nand-ecc-strength = <4>;
+		nand-ecc-step-size = <512>;
+		nand-bus-width = <8>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "nand_data";
+				reg = <0x0000000 0x10000000>;
+			};
+		};
+	};
+};
+
+&pcie_phy {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+	perst-gpio = <&tlmm 60 GPIO_ACTIVE_LOW>;
+};
+
+&wifi {
+	status = "okay";
+	qcom,ath11k-calibration-variant = "8devices-Mango";
+};
+
+&qusb_phy_1 {
+	status = "okay";
+};
+
+&usb2 {
+	status = "okay";
+};
+
+&qusb_phy_0 {
+	status = "okay";
+};
+
+&ssphy_0 {
+	status = "okay";
+};
+
+&usb3 {
+	status = "okay";
+};
diff --git a/6.12/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq6010-xe3-4.dts b/6.12/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq6010-xe3-4.dts
new file mode 100644
index 00000000..a5eb8063
--- /dev/null
+++ b/6.12/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq6010-xe3-4.dts
@@ -0,0 +1,454 @@
+// SPDX-License-Identifier: (GPL-2.0+)
+
+/dts-v1/;
+
+#include "ipq6018.dtsi"
+#include "ipq6018-fixed-smps.dtsi"
+#include "ipq6018-ess.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	/* Qualcomm Technologies, Inc. IPQ6018/AP-CP01-C3 */
+	model = "Cambium Networks XE3-4";
+	compatible = "cambiumnetworks,xe3-4", "qcom,ipq6018-cp01", "qcom,ipq6018";
+
+	aliases {
+		serial0 = &blsp1_uart3;
+		sdhc2 = &sdhc;
+		ethernet0 = &dp5;
+		ethernet1 = &dp4;
+		label-mac-device = &dp5;
+
+		led-boot = &led_status_amber;
+		led-failsafe = &led_status_amber;
+		led-running = &led_status_white;
+		led-upgrade = &led_status_amber;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs-append = " root=/dev/ubiblock0_1";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&tlmm 19 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		led_status_white: status-white {
+			color = <LED_COLOR_ID_WHITE>;
+			function = LED_FUNCTION_STATUS;
+			gpio = <&tlmm 56 GPIO_ACTIVE_LOW>;
+		};
+
+		led_status_amber: status-amber {
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_STATUS;
+			gpio = <&tlmm 35 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	reg_sd_vmmc: regulator-sdcard-vmmc {
+		compatible = "regulator-fixed";
+		regulator-name = "sdcard-vmmc";
+		regulator-min-microvolt = <2950000>;
+		regulator-max-microvolt = <2950000>;
+
+		startup-delay-us = <200>;
+
+		gpio = <&tlmm 66 GPIO_ACTIVE_HIGH>;
+		enable-active-high;
+
+		pinctrl-names = "default";
+		pinctrl-0 = <&sd_vmmc_en_default>;
+	};
+};
+
+&blsp1_uart3 {
+	pinctrl-0 = <&serial_3_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+};
+
+&blsp1_i2c3 {
+	pinctrl-0 = <&i2c_1_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+};
+
+&tlmm {
+	/* TZ has exclusive control over GPIO20 */
+	gpio-reserved-ranges = <20 1>;
+
+	mdio_pins: mdio-pins {
+		mdc {
+			pins = "gpio64";
+			function = "mdc";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+
+		mdio {
+			pins = "gpio65";
+			function = "mdio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+
+	i2c_1_pins: i2c-1-state {
+		pins = "gpio42", "gpio43";
+		function = "blsp2_i2c";
+		drive-strength = <8>;
+	};
+
+	spi_0_pins: spi-0-state {
+		pins = "gpio38", "gpio39", "gpio40", "gpio41";
+		function = "blsp0_spi";
+		drive-strength = <8>;
+		bias-pull-down;
+	};
+
+	led_pins: led_pins {
+		leds {
+			pins = "gpio35", "gpio37", "gpio50";
+			function = "gpio";
+			drive-strength = <8>;
+			bias-pull-down;
+		};
+	};
+
+	sd_vmmc_en_default: sd-vmmc-en-default-state {
+		pins = "gpio66";
+		function = "gpio";
+		drive-strength = <8>;
+		bias-pull-down;
+	};
+
+	sd_pins: sd-state {
+		pins = "gpio62";
+		function = "gpio";
+		drive-strength = <8>;
+		bias-pull-up;
+	};
+};
+
+&pcie_phy {
+	status = "okay";
+};
+
+&pcie0 {
+	status = "okay";
+	perst-gpio = <&tlmm 60 GPIO_ACTIVE_LOW>;
+
+	bridge@0,0 {
+		reg = <0x00000000 0 0 0 0>;
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges;
+
+		wifi@1,0 {
+			status = "okay";
+
+			/* ath11k has no DT compatible for PCI cards */
+			compatible = "pci17cb,1104";
+			reg = <0x00010000 0 0 0 0>;
+
+			qcom,ath11k-fw-memory-mode = <0>;
+			qcom,ath11k-calibration-variant = "CambiumNetworks-XE34";
+		};
+	};
+};
+
+&sdhc {
+	pinctrl-0 = <&sd_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+
+	cd-gpios = <&tlmm 62 GPIO_ACTIVE_LOW>;
+	vqmmc-supply = <&reg_sd_vmmc>;
+	bus-width = <4>;
+};
+
+&edma {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+
+	switch_lan_bmp = <(ESS_PORT4 | ESS_PORT5)>;
+	switch_mac_mode = <MAC_MODE_PSGMII>;
+	switch_mac_mode2 = <MAC_MODE_SGMII_PLUS>;
+
+	qcom,port_phyinfo {
+		port@4 {
+			port_id = <4>;
+			phy_address = <3>;
+		};
+
+		port@5 {
+			port_id = <5>;
+			phy_address = <24>;
+			port_mac_sel = "QGMAC_PORT";
+		};
+	};
+};
+
+&mdio {
+	status = "okay";
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+	reset-gpios = <&tlmm 75 GPIO_ACTIVE_LOW>;
+	reset-delay-us = <10000>;
+	reset-post-delay-us = <50000>;
+
+	ethernet-phy-package@0 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		compatible = "qcom,qca8075-package";
+		reg = <0>;
+
+		qcom,package-mode = "psgmii";
+
+		qca8072: ethernet-phy@3 {
+			compatible = "ethernet-phy-ieee802.3-c22";
+			reg = <3>;
+		};
+	};
+
+	qca8081: ethernet-phy@24 {
+		compatible = "ethernet-phy-id004d.d101";
+		reg = <24>;
+		reset-gpios = <&tlmm 77 GPIO_ACTIVE_LOW>;
+		reset-assert-us = <10000>;
+		reset-deassert-us = <50000>;
+	};
+};
+
+&dp4 {
+	status = "okay";
+
+	phy-handle = <&qca8072>;
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&eth1addr 0>;
+	label = "lan2";
+};
+
+&dp5 {
+	status = "okay";
+
+	phy-mode = "sgmii";
+	phy-handle = <&qca8081>;
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&ethaddr 0>;
+	label = "lan1";
+};
+
+&blsp1_spi1 {
+	pinctrl-0 = <&spi_0_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+
+	flash@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0>;
+		/*
+		 * U-boot looks for "n25q128a11" node,
+		 * if we don't have it, it will spit out the following warning:
+		 * "ipq: fdt fixup unable to find compatible node".
+		 */
+		linux,modalias = "m25p80", "mx30uf2g18ac", "n25q128a11";
+		compatible = "micron,n25q128a11", "jedec,spi-nor";
+		spi-max-frequency = <50000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "0:SBL1";
+				reg = <0x0 0xc0000>;
+				read-only;
+			};
+
+			partition@c0000 {
+				label = "0:MIBIB";
+				reg = <0xc0000 0x10000>;
+				read-only;
+			};
+
+			partition@d0000 {
+				label = "0:BOOTCONFIG";
+				reg = <0xd0000 0x20000>;
+				read-only;
+			};
+
+			partition@f0000 {
+				label = "0:BOOTCONFIG1";
+				reg = <0xf0000 0x20000>;
+				read-only;
+			};
+
+			partition@110000 {
+				label = "0:QSEE";
+				reg = <0x110000 0x1a0000>;
+				read-only;
+			};
+
+			partition@2b0000 {
+				label = "0:QSEE_1";
+				reg = <0x2b0000 0x1a0000>;
+				read-only;
+			};
+
+			partition@450000 {
+				label = "0:DEVCFG";
+				reg = <0x450000 0x10000>;
+				read-only;
+			};
+
+			partition@460000 {
+				label = "mfginfo";
+				reg = <0x460000 0x10000>;
+				read-only;
+			};
+
+			partition@470000 {
+				label = "0:RPM";
+				reg = <0x470000 0x40000>;
+				read-only;
+			};
+
+			partition@4b0000 {
+				label = "0:RPM_1";
+				reg = <0x4b0000 0x40000>;
+				read-only;
+			};
+
+			partition@4f0000 {
+				label = "0:CDT";
+				reg = <0x4f0000 0x10000>;
+				read-only;
+			};
+
+			partition@500000 {
+				label = "0:CDT_1";
+				reg = <0x500000 0x10000>;
+				read-only;
+			};
+
+			partition@510000 {
+				compatible = "u-boot,env";
+				label = "0:APPSBLENV";
+				reg = <0x510000 0x10000>;
+
+				ethaddr: ethaddr {
+					#nvmem-cell-cells = <0>;
+				};
+
+				eth1addr: eth1addr {
+					#nvmem-cell-cells = <0>;
+				};
+
+				eth2addr: eth2addr {
+					#nvmem-cell-cells = <0>;
+				};
+
+				eth5addr: eth5addr {
+					#nvmem-cell-cells = <0>;
+				};
+			};
+
+			partition@520000 {
+				label = "0:APPSBL";
+				reg = <0x520000 0xa0000>;
+				read-only;
+			};
+
+			partition@5c0000 {
+				label = "0:APPSBL_1";
+				reg = <0x5c0000 0xa0000>;
+				read-only;
+			};
+
+			partition@660000 {
+				label = "0:ART";
+				reg = <0x660000 0x80000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&qpic_bam {
+	status = "okay";
+};
+
+&qpic_nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+
+		nand-ecc-strength = <4>;
+		nand-ecc-step-size = <512>;
+		nand-bus-width = <8>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "rootfs";
+				reg = <0x0 0x6000000>;
+			};
+
+			partition@6000000 {
+				label = "rootfs_1";
+				reg = <0x6000000 0x6000000>;
+			};
+
+			partition@c000000 {
+				label = "NVRAM";
+				reg = <0xc000000 0x3000000>;
+			};
+
+			partition@f000000 {
+				label = "crashLog";
+				reg = <0xf000000 0x1000000>;
+			};
+		};
+	};
+};
+
+&wifi {
+	status = "okay";
+	qcom,ath11k-calibration-variant = "CambiumNetworks-XE34";
+
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&eth2addr>;
+};
+
+&qusb_phy_1 {
+	status = "okay";
+};
+
+&usb2 {
+	status = "okay";
+};
diff --git a/6.12/target/linux/qualcommax/image/ipq60xx.mk b/6.12/target/linux/qualcommax/image/ipq60xx.mk
new file mode 100644
index 00000000..0b7cd413
--- /dev/null
+++ b/6.12/target/linux/qualcommax/image/ipq60xx.mk
@@ -0,0 +1,84 @@
+define Device/8devices_mango-dvk
+	$(call Device/FitImageLzma)
+	DEVICE_VENDOR := 8devices
+	DEVICE_MODEL := Mango-DVK
+	IMAGE_SIZE := 27776k
+	BLOCKSIZE := 64k
+	SOC := ipq6010
+	SUPPORTED_DEVICES += 8devices,mango
+	IMAGE/sysupgrade.bin := append-kernel | pad-to 64k | append-rootfs | pad-rootfs | check-size | append-metadata
+	DEVICE_PACKAGES := ipq-wifi-8devices_mango
+endef
+TARGET_DEVICES += 8devices_mango-dvk
+
+define Device/cambiumnetworks_xe3-4
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := Cambium Networks
+	DEVICE_MODEL := XE3-4
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_DTS_CONFIG := config@cp01-c3-xv3-4
+	SOC := ipq6010
+	DEVICE_PACKAGES := ipq-wifi-cambiumnetworks_xe34 ath11k-firmware-qcn9074 kmod-ath11k-pci
+endef
+TARGET_DEVICES += cambiumnetworks_xe3-4
+
+define Device/linksys_mr7350
+	$(call Device/FitImage)
+	DEVICE_VENDOR := Linksys
+	DEVICE_MODEL := MR7350
+	SOC := ipq6000
+	NAND_SIZE := 256m
+	KERNEL_SIZE := 8192k
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	IMAGE_SIZE := 75776k
+	IMAGES += factory.bin
+	IMAGE/factory.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | \
+		append-ubi | linksys-image type=MR7350
+	DEVICE_PACKAGES := ipq-wifi-linksys_mr7350 \
+		kmod-leds-pca963x kmod-usb-ledtrig-usbport
+endef
+TARGET_DEVICES += linksys_mr7350
+
+define Device/netgear_wax214
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := Netgear
+	DEVICE_MODEL := WAX214
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_DTS_CONFIG := config@cp03-c1
+	SOC := ipq6010
+	DEVICE_PACKAGES := ipq-wifi-netgear_wax214
+endef
+TARGET_DEVICES += netgear_wax214
+
+define Device/qihoo_360v6
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := Qihoo
+	DEVICE_MODEL := 360V6
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	SOC := ipq6000
+	DEVICE_DTS_CONFIG := config@cp03-c1
+	DEVICE_PACKAGES := ipq-wifi-qihoo_360v6
+endef
+TARGET_DEVICES += qihoo_360v6
+
+define Device/yuncore_fap650
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := Yuncore
+	DEVICE_MODEL := FAP650
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_DTS_CONFIG := config@cp03-c1
+	SOC := ipq6018
+	DEVICE_PACKAGES := ipq-wifi-yuncore_fap650
+	IMAGES := factory.ubi factory.ubin sysupgrade.bin
+	IMAGE/factory.ubin := append-ubi | qsdk-ipq-factory-nand
+endef
+TARGET_DEVICES += yuncore_fap650
diff --git a/6.12/target/linux/qualcommax/image/ipq807x.mk b/6.12/target/linux/qualcommax/image/ipq807x.mk
new file mode 100644
index 00000000..ff696340
--- /dev/null
+++ b/6.12/target/linux/qualcommax/image/ipq807x.mk
@@ -0,0 +1,454 @@
+DEVICE_VARS += NETGEAR_BOARD_ID NETGEAR_HW_ID
+
+define Build/asus-fake-ramdisk
+	rm -rf $(KDIR)/tmp/fakerd
+	dd if=/dev/zero bs=32 count=1 > $(KDIR)/tmp/fakerd
+	$(info KERNEL_INITRAMFS is $(KERNEL_INITRAMFS))
+endef
+
+define Build/asus-fake-rootfs
+	$(eval comp=$(word 1,$(1)))
+	$(eval filepath=$(word 2,$(1)))
+	$(eval filecont=$(word 3,$(1)))
+	rm -rf $(KDIR)/tmp/fakefs $(KDIR)/tmp/fakehsqs
+	mkdir -p $(KDIR)/tmp/fakefs/$$(dirname $(filepath))
+	echo '$(filecont)' > $(KDIR)/tmp/fakefs/$(filepath)
+	$(STAGING_DIR_HOST)/bin/mksquashfs4 $(KDIR)/tmp/fakefs $(KDIR)/tmp/fakehsqs -comp $(comp) \
+		-b 4096 -no-exports -no-sparse -no-xattrs -all-root -noappend \
+		$(wordlist 4,$(words $(1)),$(1))
+endef
+
+define Build/asus-trx
+	$(STAGING_DIR_HOST)/bin/asusuimage $(wordlist 1,$(words $(1)),$(1)) -i $@ -o $@.new
+	mv $@.new $@
+endef
+
+define Build/wax6xx-netgear-tar
+	mkdir $@.tmp
+	mv $@ $@.tmp/nand-ipq807x-apps.img
+	md5sum $@.tmp/nand-ipq807x-apps.img | cut -c 1-32 > $@.tmp/nand-ipq807x-apps.md5sum
+	echo $(DEVICE_MODEL) > $@.tmp/metadata.txt
+	echo $(DEVICE_MODEL)"_V9.9.9.9" > $@.tmp/version
+	tar -C $@.tmp/ -cf $@ .
+	rm -rf $@.tmp
+endef
+
+define Device/arcadyan_aw1000
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := Arcadyan
+	DEVICE_MODEL := AW1000
+	BLOCKSIZE := 256k
+	PAGESIZE := 4096
+	DEVICE_DTS_CONFIG := config@hk09
+	SOC := ipq8072
+	DEVICE_PACKAGES := ipq-wifi-arcadyan_aw1000 kmod-spi-gpio \
+		kmod-gpio-nxp-74hc164 kmod-usb-serial-option uqmi
+endef
+TARGET_DEVICES += arcadyan_aw1000
+
+define Device/asus_rt-ax89x
+	DEVICE_VENDOR := Asus
+	DEVICE_MODEL := RT-AX89X
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_DTS_CONFIG := config@hk01
+	SOC := ipq8074
+	DEVICE_PACKAGES := kmod-hwmon-gpiofan ipq-wifi-asus_rt-ax89x
+	KERNEL_NAME := vmlinux
+	KERNEL := kernel-bin | libdeflate-gzip
+	KERNEL_IN_UBI := 1
+	IMAGE/sysupgrade.bin/squashfs := \
+		append-kernel | asus-fake-ramdisk |\
+		multiImage gzip $$(KDIR)/tmp/fakerd $$(KDIR)/image-$$(DEVICE_DTS).dtb |\
+		sysupgrade-tar kernel=$$$$@ | append-metadata
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+	ARTIFACTS := initramfs-factory.trx initramfs-uImage.itb
+	ARTIFACT/initramfs-uImage.itb := \
+		append-image-stage initramfs-kernel.bin | fit gzip $$(KDIR)/image-$$(DEVICE_DTS).dtb
+	ARTIFACT/initramfs-factory.trx := \
+		append-image-stage initramfs-kernel.bin |\
+		asus-fake-rootfs xz /lib/firmware/IPQ8074A/fw_version.txt "fake" -no-compression |\
+		multiImage gzip $$(KDIR)/tmp/fakehsqs $$(KDIR)/image-$$(DEVICE_DTS).dtb |\
+		asus-trx -v 2 -n RT-AX89U -b 388 -e 49000
+endif
+endef
+TARGET_DEVICES += asus_rt-ax89x
+
+define Device/buffalo_wxr-5950ax12
+	$(call Device/FitImage)
+	DEVICE_VENDOR := Buffalo
+	DEVICE_MODEL := WXR-5950AX12
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_DTS_CONFIG := config@hk01
+	SOC := ipq8074
+	DEVICE_PACKAGES := ipq-wifi-buffalo_wxr-5950ax12
+endef
+TARGET_DEVICES += buffalo_wxr-5950ax12
+
+define Device/cmcc_rm2-6
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := CMCC
+	DEVICE_MODEL := RM2-6
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_DTS_CONFIG := config@ac02
+	SOC := ipq8070
+	IMAGES += factory.bin
+	IMAGE/factory.bin := append-ubi | qsdk-ipq-factory-nand
+	DEVICE_PACKAGES := ipq-wifi-cmcc_rm2-6 kmod-hwmon-gpiofan
+endef
+TARGET_DEVICES += cmcc_rm2-6
+
+define Device/compex_wpq873
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := Compex
+	DEVICE_MODEL := WPQ873
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_DTS_CONFIG := config@hk09.wpq873
+	SOC := ipq8072
+	DEVICE_PACKAGES := ipq-wifi-compex_wpq873
+	IMAGE/factory.ubi := append-ubi | qsdk-ipq-factory-nand
+endef
+TARGET_DEVICES += compex_wpq873
+
+define Device/dynalink_dl-wrx36
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := Dynalink
+	DEVICE_MODEL := DL-WRX36
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_DTS_CONFIG := config@rt5010w-d350-rev0
+	SOC := ipq8072
+	DEVICE_PACKAGES := ipq-wifi-dynalink_dl-wrx36
+endef
+TARGET_DEVICES += dynalink_dl-wrx36
+
+define Device/edgecore_eap102
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := Edgecore
+	DEVICE_MODEL := EAP102
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_DTS_CONFIG := config@ac02
+	SOC := ipq8071
+	DEVICE_PACKAGES := ipq-wifi-edgecore_eap102
+	IMAGE/factory.ubi := append-ubi | qsdk-ipq-factory-nand
+endef
+TARGET_DEVICES += edgecore_eap102
+
+define Device/edimax_cax1800
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := Edimax
+	DEVICE_MODEL := CAX1800
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_DTS_CONFIG := config@ac03
+	SOC := ipq8070
+	DEVICE_PACKAGES := ipq-wifi-edimax_cax1800
+endef
+TARGET_DEVICES += edimax_cax1800
+
+define Device/linksys_mx
+	$(call Device/FitImage)
+	DEVICE_VENDOR := Linksys
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	KERNEL_SIZE := 6144k
+	IMAGE_SIZE := 147456k
+	NAND_SIZE := 512m
+	SOC := ipq8072
+	IMAGES += factory.bin
+	IMAGE/factory.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | append-ubi | linksys-image type=$$$$(DEVICE_MODEL)
+	DEVICE_PACKAGES := kmod-leds-pca963x
+endef
+
+define Device/linksys_mx4200v1
+	$(call Device/linksys_mx)
+	DEVICE_MODEL := MX4200
+	DEVICE_VARIANT := v1
+	SOC := ipq8174
+	DEVICE_PACKAGES += ipq-wifi-linksys_mx4200 kmod-bluetooth
+endef
+TARGET_DEVICES += linksys_mx4200v1
+
+define Device/linksys_mx4200v2
+	$(call Device/linksys_mx4200v1)
+	DEVICE_VARIANT := v2
+endef
+TARGET_DEVICES += linksys_mx4200v2
+
+define Device/linksys_mx5300
+	$(call Device/linksys_mx)
+	DEVICE_MODEL := MX5300
+	DEVICE_PACKAGES += kmod-rtc-ds1307 ipq-wifi-linksys_mx5300 \
+		kmod-ath10k-ct ath10k-firmware-qca9984-ct
+endef
+TARGET_DEVICES += linksys_mx5300
+
+define Device/linksys_mx8500
+	$(call Device/linksys_mx)
+	DEVICE_MODEL := MX8500
+	DEVICE_PACKAGES += ipq-wifi-linksys_mx8500 kmod-ath11k-pci \
+		ath11k-firmware-qcn9074 kmod-bluetooth
+endef
+TARGET_DEVICES += linksys_mx8500
+
+define Device/netgear_rax120v2
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := Netgear
+	DEVICE_MODEL := RAX120v2
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_DTS_CONFIG := config@hk01
+	SOC := ipq8074
+	KERNEL_SIZE := 29696k
+	NETGEAR_BOARD_ID := RAX120
+	NETGEAR_HW_ID := 29765589+0+512+1024+4x4+8x8
+	DEVICE_PACKAGES := ipq-wifi-netgear_rax120v2 kmod-spi-gpio \
+		kmod-spi-bitbang kmod-gpio-nxp-74hc164 kmod-hwmon-g762
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+	IMAGES += web-ui-factory.img
+	IMAGE/web-ui-factory.img := append-image initramfs-uImage.itb | \
+		pad-offset $$$$(BLOCKSIZE) 64 | append-uImage-fakehdr filesystem | \
+		netgear-dni
+endif
+	IMAGE/sysupgrade.bin := append-kernel | pad-offset $$$$(BLOCKSIZE) 64 | \
+		append-uImage-fakehdr filesystem | sysupgrade-tar kernel=$$$$@ | \
+		append-metadata
+endef
+TARGET_DEVICES += netgear_rax120v2
+
+define Device/netgear_sxk80
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_PACKAGES += ipq-wifi-netgear_sxk80
+	DEVICE_VENDOR := Netgear
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_DTS_CONFIG := config@hk01
+	SOC := ipq8074
+	KERNEL_SIZE := 6272k
+	NETGEAR_HW_ID := 29766265+0+512+1024+4x4+4x4+4x4
+endef
+
+define Device/netgear_sxr80
+	$(call Device/netgear_sxk80)
+	DEVICE_MODEL := SXR80
+	NETGEAR_BOARD_ID := SXR80
+endef
+TARGET_DEVICES += netgear_sxr80
+
+define Device/netgear_sxs80
+	$(call Device/netgear_sxk80)
+	DEVICE_MODEL := SXS80
+	NETGEAR_BOARD_ID := SXS80
+endef
+TARGET_DEVICES += netgear_sxs80
+
+define Device/netgear_wax218
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := Netgear
+	DEVICE_MODEL := WAX218
+	DEVICE_DTS_CONFIG := config@hk07
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	SOC := ipq8072
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+	ARTIFACTS := web-ui-factory.fit
+	ARTIFACT/web-ui-factory.fit := append-image initramfs-uImage.itb | \
+		ubinize-kernel | qsdk-ipq-factory-nand
+endif
+	DEVICE_PACKAGES := kmod-spi-gpio kmod-spi-bitbang kmod-gpio-nxp-74hc164 \
+		ipq-wifi-netgear_wax218
+endef
+TARGET_DEVICES += netgear_wax218
+
+define Device/netgear_wax620
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := Netgear
+	DEVICE_MODEL := WAX620
+	DEVICE_DTS_CONFIG := config@hk07
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	SOC := ipq8072
+	DEVICE_PACKAGES := kmod-spi-gpio kmod-gpio-nxp-74hc164 \
+		ipq-wifi-netgear_wax620
+endef
+TARGET_DEVICES += netgear_wax620
+
+define Device/netgear_wax630
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := Netgear
+	DEVICE_MODEL := WAX630
+	DEVICE_DTS_CONFIG := config@hk01
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	SOC := ipq8074
+	IMAGES += ui-factory.tar
+	IMAGE/ui-factory.tar := append-ubi | wax6xx-netgear-tar
+	DEVICE_PACKAGES := kmod-spi-gpio ipq-wifi-netgear_wax630
+endef
+TARGET_DEVICES += netgear_wax630
+
+define Device/prpl_haze
+	$(call Device/FitImage)
+	$(call Device/EmmcImage)
+	DEVICE_VENDOR := prpl Foundation
+	DEVICE_MODEL := Haze
+	DEVICE_DTS_CONFIG := config@hk09
+	SOC := ipq8072
+	DEVICE_PACKAGES := ath11k-firmware-qcn9074 ipq-wifi-prpl_haze kmod-ath11k-pci \
+		kmod-fs-f2fs f2fs-tools kmod-leds-lp5562
+endef
+TARGET_DEVICES += prpl_haze
+
+define Device/qnap_301w
+	$(call Device/FitImage)
+	$(call Device/EmmcImage)
+	DEVICE_VENDOR := QNAP
+	DEVICE_MODEL := 301w
+	DEVICE_DTS_CONFIG := config@hk01
+	KERNEL_SIZE := 16384k
+	SOC := ipq8072
+	DEVICE_PACKAGES := kmod-fs-f2fs f2fs-tools ipq-wifi-qnap_301w
+endef
+TARGET_DEVICES += qnap_301w
+
+define Device/redmi_ax6
+	$(call Device/xiaomi_ax3600)
+	DEVICE_VENDOR := Redmi
+	DEVICE_MODEL := AX6
+	DEVICE_PACKAGES := ipq-wifi-redmi_ax6
+endef
+TARGET_DEVICES += redmi_ax6
+
+define Device/spectrum_sax1v1k
+	$(call Device/FitImage)
+	$(call Device/EmmcImage)
+	DEVICE_VENDOR := Spectrum
+	DEVICE_MODEL := SAX1V1K
+	DEVICE_DTS_CONFIG := config@rt5010w-d187-rev6
+	SOC := ipq8072
+	IMAGES := sysupgrade.bin
+	DEVICE_PACKAGES := kmod-fs-f2fs f2fs-tools ipq-wifi-spectrum_sax1v1k
+endef
+TARGET_DEVICES += spectrum_sax1v1k
+
+define Device/tplink_eap660hd-v1
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := TP-Link
+	DEVICE_MODEL := EAP660 HD
+	DEVICE_VARIANT := v1
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	SOC := ipq8072
+	DEVICE_PACKAGES := ipq-wifi-tplink_eap660hd-v1
+	TPLINK_SUPPORT_STRING := SupportList:\r\nEAP660 HD(TP-Link|UN|AX3600-D):1.0\r\n
+endef
+TARGET_DEVICES += tplink_eap660hd-v1
+
+define Device/xiaomi_ax3600
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := Xiaomi
+	DEVICE_MODEL := AX3600
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_DTS_CONFIG := config@ac04
+	SOC := ipq8071
+	KERNEL_SIZE := 36608k
+	DEVICE_PACKAGES := ipq-wifi-xiaomi_ax3600 kmod-ath10k-ct-smallbuffers ath10k-firmware-qca9887-ct
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+	ARTIFACTS := initramfs-factory.ubi
+	ARTIFACT/initramfs-factory.ubi := append-image-stage initramfs-uImage.itb | ubinize-kernel
+endif
+endef
+TARGET_DEVICES += xiaomi_ax3600
+
+define Device/xiaomi_ax9000
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := Xiaomi
+	DEVICE_MODEL := AX9000
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_DTS_CONFIG := config@hk14
+	SOC := ipq8072
+	KERNEL_SIZE := 57344k
+	DEVICE_PACKAGES := ipq-wifi-xiaomi_ax9000 kmod-ath11k-pci ath11k-firmware-qcn9074 \
+		kmod-ath10k-ct ath10k-firmware-qca9887-ct
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+	ARTIFACTS := initramfs-factory.ubi
+	ARTIFACT/initramfs-factory.ubi := append-image-stage initramfs-uImage.itb | ubinize-kernel
+endif
+endef
+TARGET_DEVICES += xiaomi_ax9000
+
+define Device/yuncore_ax880
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := Yuncore
+	DEVICE_MODEL := AX880
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_DTS_CONFIG := config@hk09
+	SOC := ipq8072
+	DEVICE_PACKAGES := ipq-wifi-yuncore_ax880
+	IMAGES += factory.bin
+	IMAGE/factory.bin := append-ubi | qsdk-ipq-factory-nand
+endef
+TARGET_DEVICES += yuncore_ax880
+
+define Device/zbtlink_zbt-z800ax
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := Zbtlink
+	DEVICE_MODEL := ZBT-Z800AX
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_DTS_CONFIG := config@hk09
+	SOC := ipq8072
+	DEVICE_PACKAGES := ipq-wifi-zbtlink_zbt-z800ax
+	IMAGES += factory.bin
+	IMAGE/factory.bin := append-ubi | qsdk-ipq-factory-nand
+endef
+TARGET_DEVICES += zbtlink_zbt-z800ax
+
+define Device/zte_mf269
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := ZTE
+	DEVICE_MODEL := MF269
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_DTS_CONFIG := config@ac04
+	SOC := ipq8071
+	KERNEL_SIZE := 53248k
+	DEVICE_PACKAGES := ipq-wifi-zte_mf269
+endef
+TARGET_DEVICES += zte_mf269
+
+define Device/zyxel_nbg7815
+	$(call Device/FitImage)
+	$(call Device/EmmcImage)
+	DEVICE_VENDOR := ZYXEL
+	DEVICE_MODEL := NBG7815
+	DEVICE_DTS_CONFIG := config@nbg7815
+	SOC := ipq8074
+	DEVICE_PACKAGES := kmod-fs-f2fs f2fs-tools ipq-wifi-zyxel_nbg7815 kmod-ath11k-pci \
+		kmod-bluetooth kmod-hwmon-tmp103
+endef
+TARGET_DEVICES += zyxel_nbg7815
diff --git a/6.12/target/linux/qualcommax/ipq60xx/base-files/etc/board.d/01_leds b/6.12/target/linux/qualcommax/ipq60xx/base-files/etc/board.d/01_leds
new file mode 100644
index 00000000..a9575eb4
--- /dev/null
+++ b/6.12/target/linux/qualcommax/ipq60xx/base-files/etc/board.d/01_leds
@@ -0,0 +1,30 @@
+
+. /lib/functions/leds.sh
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+board=$(board_name)
+
+case "$board" in
+linksys,mr7350)
+	ucidef_set_led_netdev "lan1-port-link" "LAN1-PORT-LINK" "90000.mdio-1:00:green:lan" "lan1" "link_10 link_100 link_1000"
+	ucidef_set_led_netdev "lan1-port-traffic" "LAN1-PORT-TRAFFIC" "90000.mdio-1:00:orange:lan" "lan1" "tx rx link_10 link_100 link_1000"
+	ucidef_set_led_netdev "lan2-port-link" "LAN2-PORT-LINK" "90000.mdio-1:01:green:lan" "lan2" "link_10 link_100 link_1000"
+	ucidef_set_led_netdev "lan2-port-traffic" "LAN2-PORT-TRAFFIC" "90000.mdio-1:01:orange:lan" "lan2" "tx rx link_10 link_100 link_1000"
+	ucidef_set_led_netdev "lan3-port-link" "LAN3-PORT-LINK" "90000.mdio-1:02:green:lan" "lan3" "link_10 link_100 link_1000"
+	ucidef_set_led_netdev "lan3-port-traffic" "LAN3-PORT-TRAFFIC" "90000.mdio-1:02:orange:lan" "lan3" "tx rx link_10 link_100 link_1000"
+	ucidef_set_led_netdev "lan4-port-link" "LAN4-PORT-LINK" "90000.mdio-1:03:green:lan" "lan4" "link_10 link_100 link_1000"
+	ucidef_set_led_netdev "lan4-port-traffic" "LAN4-PORT-TRAFFIC" "90000.mdio-1:03:orange:lan" "lan4" "tx rx link_10 link_100 link_1000"
+	ucidef_set_led_netdev "wan-port-link" "WAN-PORT-LINK" "90000.mdio-1:04:green:wan" "wan" "link_10 link_100 link_1000"
+	ucidef_set_led_netdev "wan-port-traffic" "WAN-PORT-TRAFFIC" "90000.mdio-1:04:orange:wan" "wan" "tx rx link_10 link_100 link_1000"
+	;;
+yuncore,fap650)
+	ucidef_set_led_netdev "wlan5ghz" "WLAN 5GHz LED" "blue:wlan-5ghz" "wlan0" "tx rx"
+	ucidef_set_led_netdev "wlan2ghz" "WLAN 2.4GHz LED" "green:wlan-2ghz" "wlan1" "tx rx"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/6.12/target/linux/qualcommax/ipq60xx/base-files/etc/board.d/02_network b/6.12/target/linux/qualcommax/ipq60xx/base-files/etc/board.d/02_network
new file mode 100644
index 00000000..ecc9e571
--- /dev/null
+++ b/6.12/target/linux/qualcommax/ipq60xx/base-files/etc/board.d/02_network
@@ -0,0 +1,67 @@
+#
+# Copyright (c) 2015 The Linux Foundation. All rights reserved.
+# Copyright (c) 2011-2015 OpenWrt.org
+#
+
+. /lib/functions/uci-defaults.sh
+. /lib/functions/system.sh
+
+ipq60xx_setup_interfaces()
+{
+	local board="$1"
+
+	case "$board" in
+	8devices,mango-dvk)
+		ucidef_set_interfaces_lan_wan "lan1 lan2" "wan"
+		;;
+	cambiumnetworks,xe3-4)
+		ucidef_set_interface_lan "lan1 lan2" "dhcp"
+		;;
+	netgear,wax214)
+		ucidef_set_interfaces_lan_wan "lan"
+		;;
+	qihoo,360v6)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3" "wan"
+		;;
+	linksys,mr7350|\
+	yuncore,fap650)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" "wan"
+		;;
+	*)
+		echo "Unsupported hardware. Network interfaces not initialized"
+		;;
+	esac
+}
+
+ipq60xx_setup_macs()
+{
+	local board="$1"
+	local lan_mac=""
+	local wan_mac=""
+	local label_mac=""
+
+	case $board in
+	linksys,mr7350)
+		label_mac=$(mtd_get_mac_ascii devinfo hw_mac_addr)
+		lan_mac=$label_mac
+		wan_mac=$label_mac
+		;;
+	qihoo,360v6)
+		lan_mac=$(mtd_get_mac_ascii factory lanMac)
+		wan_mac=$(macaddr_add "$lan_mac" 1)
+		label_mac=$lan_mac
+		;;
+	esac
+
+	[ -n "$lan_mac" ] && ucidef_set_interface_macaddr "lan" $lan_mac
+	[ -n "$wan_mac" ] && ucidef_set_interface_macaddr "wan" $wan_mac
+	[ -n "$label_mac" ] && ucidef_set_label_macaddr $label_mac
+}
+
+board_config_update
+board=$(board_name)
+ipq60xx_setup_interfaces $board
+ipq60xx_setup_macs $board
+board_config_flush
+
+exit 0
diff --git a/6.12/target/linux/qualcommax/ipq60xx/base-files/etc/hotplug.d/firmware/11-ath11-caldata b/6.12/target/linux/qualcommax/ipq60xx/base-files/etc/hotplug.d/firmware/11-ath11-caldata
new file mode 100644
index 00000000..a5e843ee
--- /dev/null
+++ b/6.12/target/linux/qualcommax/ipq60xx/base-files/etc/hotplug.d/firmware/11-ath11-caldata
@@ -0,0 +1,44 @@
+#!/bin/sh
+
+[ -e /lib/firmware/$FIRMWARE ] && exit 0
+
+. /lib/functions/caldata.sh
+
+board=$(board_name)
+
+case "$FIRMWARE" in
+"ath11k/IPQ6018/hw1.0/cal-ahb-c000000.wifi.bin")
+	case "$board" in
+	8devices,mango-dvk)
+		caldata_extract "0:ART" 0x1000 0x20000
+		;;
+	cambiumnetworks,xe3-4)
+		caldata_extract "0:ART" 0x1000 0x10000
+		;;
+	linksys,mr7350|\
+	netgear,wax214)
+		caldata_extract "0:art" 0x1000 0x10000
+		;;
+	qihoo,360v6)
+		caldata_extract "0:art" 0x1000 0x10000
+		label_mac=$(mtd_get_mac_ascii factory lanMac)
+		ath11k_patch_mac $(macaddr_add $label_mac 3) 0
+		ath11k_patch_mac $(macaddr_add $label_mac 2) 1
+		ath11k_set_macflag
+		;;
+	yuncore,fap650)
+		caldata_extract "0:art" 0x1000 0x20000
+		;;
+	esac
+	;;
+"ath11k/QCN9074/hw1.0/cal-pci-0000:01:00.0.bin")
+	case "$board" in
+	cambiumnetworks,xe3-4)
+		caldata_extract "0:ART" 0x26800 0x20000
+		;;
+	esac
+	;;
+*)
+	exit 1
+	;;
+esac
diff --git a/6.12/target/linux/qualcommax/ipq60xx/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac b/6.12/target/linux/qualcommax/ipq60xx/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
new file mode 100644
index 00000000..a67cc726
--- /dev/null
+++ b/6.12/target/linux/qualcommax/ipq60xx/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
@@ -0,0 +1,18 @@
+[ "$ACTION" == "add" ] || exit 0
+
+PHYNBR=${DEVPATH##*/phy}
+
+[ -n $PHYNBR ] || exit 0
+
+. /lib/functions.sh
+. /lib/functions/system.sh
+
+board=$(board_name)
+
+case "$board" in
+	linksys,mr7350)
+		addr=$(mtd_get_mac_ascii devinfo hw_mac_addr)
+		[ "$PHYNBR" = "0" ] && macaddr_add $addr 2 > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && macaddr_add $addr 1 > /sys${DEVPATH}/macaddress
+		;;
+esac
diff --git a/6.12/target/linux/qualcommax/ipq60xx/base-files/etc/init.d/bootcount b/6.12/target/linux/qualcommax/ipq60xx/base-files/etc/init.d/bootcount
new file mode 100644
index 00000000..e8ff9012
--- /dev/null
+++ b/6.12/target/linux/qualcommax/ipq60xx/base-files/etc/init.d/bootcount
@@ -0,0 +1,15 @@
+#!/bin/sh /etc/rc.common
+
+START=99
+
+boot() {
+	case $(board_name) in
+	linksys,mr7350)
+		mtd resetbc s_env || true
+	;;
+	yuncore,fap650)
+		fw_setenv owrt_bootcount 0
+	;;
+	esac
+}
+
diff --git a/6.12/target/linux/qualcommax/ipq60xx/base-files/lib/upgrade/platform.sh b/6.12/target/linux/qualcommax/ipq60xx/base-files/lib/upgrade/platform.sh
new file mode 100644
index 00000000..41157071
--- /dev/null
+++ b/6.12/target/linux/qualcommax/ipq60xx/base-files/lib/upgrade/platform.sh
@@ -0,0 +1,74 @@
+PART_NAME=firmware
+REQUIRE_IMAGE_METADATA=1
+
+RAMFS_COPY_BIN='fw_printenv fw_setenv head'
+RAMFS_COPY_DATA='/etc/fw_env.config /var/lock/fw_printenv.lock'
+
+platform_check_image() {
+	return 0;
+}
+
+
+yuncore_fap650_env_setup() {
+	local ubifile=$(board_name)
+	local active=$(fw_printenv -n owrt_slotactive)
+	[ -z "$active" ] && active=$(hexdump -s 0x94 -n 4 -e '4 "%d"' /dev/mtd$(find_mtd_index 0:bootconfig))
+	cat > /tmp/env_tmp << EOF
+owrt_slotactive=${active}
+owrt_bootcount=0
+bootfile=${ubifile}.ubi
+owrt_bootcountcheck=if test \$owrt_bootcount > 4; then run owrt_tftprecover; fi; if test \$owrt_bootcount = 3; then run owrt_slotswap; else echo bootcountcheck successfull; fi
+owrt_bootinc=if test \$owrt_bootcount < 5; then echo save env part; setexpr owrt_bootcount \${owrt_bootcount} + 1 && saveenv; else echo save env skipped; fi; echo current bootcount: \$owrt_bootcount
+bootcmd=run owrt_bootinc && run owrt_bootcountcheck && run owrt_slotselect && run owrt_bootlinux
+owrt_bootlinux=echo booting linux... && ubi part fs && ubi read 0x44000000 kernel && bootm; reset
+owrt_setslot0=setenv bootargs console=ttyMSM0,115200n8 ubi.mtd=rootfs root=mtd:rootfs rootfstype=squashfs rootwait swiotlb=1 && setenv mtdparts mtdparts=nand0:0x3c00000@0(fs)
+owrt_setslot1=setenv bootargs console=ttyMSM0,115200n8 ubi.mtd=rootfs_1 root=mtd:rootfs rootfstype=squashfs rootwait swiotlb=1 && setenv mtdparts mtdparts=nand0:0x3c00000@0x3c00000(fs)
+owrt_slotswap=setexpr owrt_slotactive 1 - \${owrt_slotactive} && saveenv && echo slot swapped. new active slot: \$owrt_slotactive
+owrt_slotselect=setenv mtdids nand0=nand0,nand1=spi0.0; if test \$owrt_slotactive = 0; then run owrt_setslot0; else run owrt_setslot1; fi
+owrt_tftprecover=echo trying to recover firmware with tftp... && sleep 10 && dhcp && flash rootfs && flash rootfs_1 && setenv owrt_bootcount 0 && setenv owrt_slotactive 0 && saveenv && reset
+owrt_env_ver=7
+EOF
+	fw_setenv --script /tmp/env_tmp
+}
+
+platform_do_upgrade() {
+	case "$(board_name)" in
+	cambiumnetworks,xe3-4)
+		fw_setenv bootcount 0
+		nand_do_upgrade "$1"
+		;;
+	linksys,mr7350)
+		boot_part="$(fw_printenv -n boot_part)"
+		if [ "$boot_part" -eq "1" ]; then
+			fw_setenv boot_part 2
+			CI_KERNPART="alt_kernel"
+			CI_UBIPART="alt_rootfs"
+		else
+			fw_setenv boot_part 1
+			CI_UBIPART="rootfs"
+		fi
+		fw_setenv boot_part_ready 3
+		fw_setenv auto_recovery yes
+		nand_do_upgrade "$1"
+		;;
+	netgear,wax214|\
+	qihoo,360v6)
+		nand_do_upgrade "$1"
+		;;
+	yuncore,fap650)
+		[ "$(fw_printenv -n owrt_env_ver 2>/dev/null)" != "7" ] && yuncore_fap650_env_setup
+		local active="$(fw_printenv -n owrt_slotactive 2>/dev/null)"
+		if [ "$active" = "1" ]; then
+			CI_UBIPART="rootfs"
+		else
+			CI_UBIPART="rootfs_1"
+		fi
+		fw_setenv owrt_bootcount 0
+		fw_setenv owrt_slotactive $((1 - active))
+		nand_do_upgrade "$1"
+		;;
+	*)
+		default_do_upgrade "$1"
+		;;
+	esac
+}
diff --git a/6.12/target/linux/qualcommax/ipq60xx/config-default b/6.12/target/linux/qualcommax/ipq60xx/config-default
new file mode 100644
index 00000000..9ce4b042
--- /dev/null
+++ b/6.12/target/linux/qualcommax/ipq60xx/config-default
@@ -0,0 +1,11 @@
+CONFIG_IPQ_GCC_6018=y
+CONFIG_MTD_SPLIT_FIT_FW=y
+CONFIG_PINCTRL_IPQ6018=y
+CONFIG_QCOM_APM=y
+# CONFIG_QCOM_CLK_SMD_RPM is not set
+# CONFIG_QCOM_RPMPD is not set
+CONFIG_QCOM_SMD_RPM=y
+CONFIG_REGULATOR_CPR3=y
+# CONFIG_REGULATOR_CPR3_NPU is not set
+CONFIG_REGULATOR_CPR4_APSS=y
+CONFIG_REGULATOR_QCOM_SMD_RPM=y
diff --git a/6.12/target/linux/qualcommax/ipq807x/config-default b/6.12/target/linux/qualcommax/ipq807x/config-default
new file mode 100644
index 00000000..1fa8d84a
--- /dev/null
+++ b/6.12/target/linux/qualcommax/ipq807x/config-default
@@ -0,0 +1,39 @@
+CONFIG_ARM_PSCI_CPUIDLE_DOMAIN=y
+CONFIG_DT_IDLE_GENPD=y
+CONFIG_GRO_CELLS=y
+CONFIG_IPQ_GCC_8074=y
+CONFIG_MDIO_BITBANG=y
+CONFIG_MDIO_GPIO=y
+# CONFIG_MFD_HI6421_SPMI is not set
+CONFIG_MFD_SPMI_PMIC=y
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_QCA8K=y
+CONFIG_NET_DSA_TAG_QCA=y
+# CONFIG_NVMEM_SPMI_SDAM is not set
+CONFIG_PHYLINK=y
+CONFIG_PINCTRL_IPQ8074=y
+CONFIG_PINCTRL_QCOM_SPMI_PMIC=y
+# CONFIG_PM8916_WATCHDOG is not set
+CONFIG_PM_GENERIC_DOMAINS=y
+CONFIG_PM_GENERIC_DOMAINS_OF=y
+# CONFIG_POWER_RESET_QCOM_PON is not set
+CONFIG_QCA83XX_PHY=y
+CONFIG_QCOM_APM=y
+# CONFIG_QCOM_COINCELL is not set
+CONFIG_QCOM_GDSC=y
+CONFIG_QCOM_SPMI_ADC5=y
+# CONFIG_QCOM_SPMI_RRADC is not set
+CONFIG_QCOM_VADC_COMMON=y
+CONFIG_REGMAP_SPMI=y
+CONFIG_REGULATOR_CPR3=y
+# CONFIG_REGULATOR_CPR3_NPU is not set
+CONFIG_REGULATOR_CPR4_APSS=y
+# CONFIG_REGULATOR_QCOM_LABIBB is not set
+CONFIG_REGULATOR_QCOM_SPMI=y
+# CONFIG_REGULATOR_QCOM_USB_VBUS is not set
+CONFIG_RTC_DRV_PM8XXX=y
+CONFIG_SPMI=y
+# CONFIG_SPMI_HISI3670 is not set
+CONFIG_SPMI_MSM_PMIC_ARB=y
+# CONFIG_SPMI_PMIC_CLKDIV is not set
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0102-arm64-dts-ipq8074-add-reserved-memory-nodes.patch b/6.12/target/linux/qualcommax/patches-6.12/0102-arm64-dts-ipq8074-add-reserved-memory-nodes.patch
new file mode 100644
index 00000000..6d97641f
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0102-arm64-dts-ipq8074-add-reserved-memory-nodes.patch
@@ -0,0 +1,60 @@
+From ad2d07f71739351eeea1d8a120c0918e2c4b265f Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Wed, 22 Dec 2021 12:23:34 +0100
+Subject: [PATCH] arm64: dts: ipq8074: add reserved memory nodes
+
+IPQ8074 has multiple reserved memory ranges, if they are not defined
+then weird things tend to happen, board hangs and resets when PCI or
+WLAN is used etc.
+
+So, to avoid all of that add the reserved memory nodes from the downstream
+5.4 kernel from QCA.
+This is their default layout meant for devices with 1GB of RAM, but
+devices with lower ammounts can override the Q6 node.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 35 +++++++++++++++++++++++++++
+ 1 file changed, 35 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -86,6 +86,16 @@
+ 		#size-cells = <2>;
+ 		ranges;
+ 
++		nss@40000000 {
++			no-map;
++			reg = <0x0 0x40000000 0x0 0x01000000>;
++		};
++
++		tzapp_region: tzapp@4a400000 {
++			no-map;
++			reg = <0x0 0x4a400000 0x0 0x00200000>;
++		};
++
+ 		bootloader@4a600000 {
+ 			reg = <0x0 0x4a600000 0x0 0x400000>;
+ 			no-map;
+@@ -108,6 +118,21 @@
+ 			reg = <0x0 0x4ac00000 0x0 0x400000>;
+ 			no-map;
+ 		};
++
++		q6_region: wcnss@4b000000 {
++			no-map;
++			reg = <0x0 0x4b000000 0x0 0x05f00000>;
++		};
++
++		q6_etr_region: q6_etr_dump@50f00000 {
++			no-map;
++			reg = <0x0 0x50f00000 0x0 0x00100000>;
++		};
++
++		m3_dump_region: m3_dump@51000000 {
++			no-map;
++			reg = <0x0 0x51000000 0x0 0x100000>;
++		};
+ 	};
+ 
+ 	firmware {
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0111-arm64-dts-qcom-ipq8074-use-msi-parent-for-PCIe.patch b/6.12/target/linux/qualcommax/patches-6.12/0111-arm64-dts-qcom-ipq8074-use-msi-parent-for-PCIe.patch
new file mode 100644
index 00000000..c4f41327
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0111-arm64-dts-qcom-ipq8074-use-msi-parent-for-PCIe.patch
@@ -0,0 +1,43 @@
+From fb1f6850be00d8dd8a54017be4c1336e224069ac Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Wed, 16 Nov 2022 22:26:25 +0100
+Subject: [PATCH] arm64: dts: qcom: ipq8074: use msi-parent for PCIe
+
+Instead of hardcoding the IRQ, simply use msi-parent instead.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -761,7 +761,7 @@
+ 			reg = <0x0b000000 0x1000>, <0x0b002000 0x1000>;
+ 			ranges = <0 0xb00a000 0xffd>;
+ 
+-			v2m@0 {
++			gic_v2m0: v2m@0 {
+ 				compatible = "arm,gic-v2m-frame";
+ 				msi-controller;
+ 				reg = <0x0 0xffd>;
+@@ -874,8 +874,7 @@
+ 			ranges = <0x81000000 0x0 0x00000000 0x10200000 0x0 0x10000>,   /* I/O */
+ 				 <0x82000000 0x0 0x10220000 0x10220000 0x0 0xfde0000>; /* MEM */
+ 
+-			interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
+-			interrupt-names = "msi";
++			msi-parent = <&gic_v2m0>;
+ 			#interrupt-cells = <1>;
+ 			interrupt-map-mask = <0 0 0 0x7>;
+ 			interrupt-map = <0 0 0 1 &intc 0 0 142
+@@ -946,8 +945,7 @@
+ 			ranges = <0x81000000 0x0 0x00000000 0x20200000 0x0 0x10000>,   /* I/O */
+ 				 <0x82000000 0x0 0x20220000 0x20220000 0x0 0xfde0000>; /* MEM */
+ 
+-			interrupts = <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>;
+-			interrupt-names = "msi";
++			msi-parent = <&gic_v2m0>;
+ 			#interrupt-cells = <1>;
+ 			interrupt-map-mask = <0 0 0 0x7>;
+ 			interrupt-map = <0 0 0 1 &intc 0 0 75
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0112-remoteproc-qcom-Add-PRNG-proxy-clock.patch b/6.12/target/linux/qualcommax/patches-6.12/0112-remoteproc-qcom-Add-PRNG-proxy-clock.patch
new file mode 100644
index 00000000..ac46f9e7
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0112-remoteproc-qcom-Add-PRNG-proxy-clock.patch
@@ -0,0 +1,155 @@
+From 125681433c8e526356947acf572fe8ca8ad32291 Mon Sep 17 00:00:00 2001
+From: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Date: Sat, 30 Jan 2021 10:50:05 +0530
+Subject: [PATCH] remoteproc: qcom: Add PRNG proxy clock
+
+PRNG clock is needed by the secure PIL, support for the same
+is added in subsequent patches.
+
+Signed-off-by: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Signed-off-by: Sricharan R <sricharan@codeaurora.org>
+Signed-off-by: Nikhil Prakash V <nprakash@codeaurora.org>
+---
+ drivers/remoteproc/qcom_q6v5_wcss.c | 65 +++++++++++++++++++++--------
+ 1 file changed, 47 insertions(+), 18 deletions(-)
+
+--- a/drivers/remoteproc/qcom_q6v5_wcss.c
++++ b/drivers/remoteproc/qcom_q6v5_wcss.c
+@@ -91,19 +91,6 @@ enum {
+ 	WCSS_QCS404,
+ };
+ 
+-struct wcss_data {
+-	const char *firmware_name;
+-	unsigned int crash_reason_smem;
+-	u32 version;
+-	bool aon_reset_required;
+-	bool wcss_q6_reset_required;
+-	const char *ssr_name;
+-	const char *sysmon_name;
+-	int ssctl_id;
+-	const struct rproc_ops *ops;
+-	bool requires_force_stop;
+-};
+-
+ struct q6v5_wcss {
+ 	struct device *dev;
+ 
+@@ -128,6 +115,7 @@ struct q6v5_wcss {
+ 	struct clk *qdsp6ss_xo_cbcr;
+ 	struct clk *qdsp6ss_core_gfmux;
+ 	struct clk *lcc_bcr_sleep;
++	struct clk *prng_clk;
+ 	struct regulator *cx_supply;
+ 	struct qcom_sysmon *sysmon;
+ 
+@@ -152,6 +140,21 @@ struct q6v5_wcss {
+ 	struct qcom_rproc_ssr ssr_subdev;
+ };
+ 
++struct wcss_data {
++	int (*init_clock)(struct q6v5_wcss *wcss);
++	int (*init_regulator)(struct q6v5_wcss *wcss);
++	const char *firmware_name;
++	unsigned int crash_reason_smem;
++	u32 version;
++	bool aon_reset_required;
++	bool wcss_q6_reset_required;
++	const char *ssr_name;
++	const char *sysmon_name;
++	int ssctl_id;
++	const struct rproc_ops *ops;
++	bool requires_force_stop;
++};
++
+ static int q6v5_wcss_reset(struct q6v5_wcss *wcss)
+ {
+ 	int ret;
+@@ -241,6 +244,12 @@ static int q6v5_wcss_start(struct rproc
+ 	struct q6v5_wcss *wcss = rproc->priv;
+ 	int ret;
+ 
++	ret = clk_prepare_enable(wcss->prng_clk);
++	if (ret) {
++		dev_err(wcss->dev, "prng clock enable failed\n");
++		return ret;
++	}
++
+ 	qcom_q6v5_prepare(&wcss->q6v5);
+ 
+ 	/* Release Q6 and WCSS reset */
+@@ -734,6 +743,7 @@ static int q6v5_wcss_stop(struct rproc *
+ 			return ret;
+ 	}
+ 
++	clk_disable_unprepare(wcss->prng_clk);
+ 	qcom_q6v5_unprepare(&wcss->q6v5);
+ 
+ 	return 0;
+@@ -900,7 +910,21 @@ static int q6v5_alloc_memory_region(stru
+ 	return 0;
+ }
+ 
+-static int q6v5_wcss_init_clock(struct q6v5_wcss *wcss)
++static int ipq8074_init_clock(struct q6v5_wcss *wcss)
++{
++	int ret;
++
++	wcss->prng_clk = devm_clk_get(wcss->dev, "prng");
++	if (IS_ERR(wcss->prng_clk)) {
++		ret = PTR_ERR(wcss->prng_clk);
++		if (ret != -EPROBE_DEFER)
++			dev_err(wcss->dev, "Failed to get prng clock\n");
++		return ret;
++	}
++	return 0;
++}
++
++static int qcs404_init_clock(struct q6v5_wcss *wcss)
+ {
+ 	int ret;
+ 
+@@ -990,7 +1014,7 @@ static int q6v5_wcss_init_clock(struct q
+ 	return 0;
+ }
+ 
+-static int q6v5_wcss_init_regulator(struct q6v5_wcss *wcss)
++static int qcs404_init_regulator(struct q6v5_wcss *wcss)
+ {
+ 	wcss->cx_supply = devm_regulator_get(wcss->dev, "cx");
+ 	if (IS_ERR(wcss->cx_supply))
+@@ -1034,12 +1058,14 @@ static int q6v5_wcss_probe(struct platfo
+ 	if (ret)
+ 		return ret;
+ 
+-	if (wcss->version == WCSS_QCS404) {
+-		ret = q6v5_wcss_init_clock(wcss);
++	if (desc->init_clock) {
++		ret = desc->init_clock(wcss);
+ 		if (ret)
+ 			return ret;
++	}
+ 
+-		ret = q6v5_wcss_init_regulator(wcss);
++	if (desc->init_regulator) {
++		ret = desc->init_regulator(wcss);
+ 		if (ret)
+ 			return ret;
+ 	}
+@@ -1081,6 +1107,7 @@ static void q6v5_wcss_remove(struct plat
+ }
+ 
+ static const struct wcss_data wcss_ipq8074_res_init = {
++	.init_clock = ipq8074_init_clock,
+ 	.firmware_name = "IPQ8074/q6_fw.mdt",
+ 	.crash_reason_smem = WCSS_CRASH_REASON,
+ 	.aon_reset_required = true,
+@@ -1090,6 +1117,8 @@ static const struct wcss_data wcss_ipq80
+ };
+ 
+ static const struct wcss_data wcss_qcs404_res_init = {
++	.init_clock = qcs404_init_clock,
++	.init_regulator = qcs404_init_regulator,
+ 	.crash_reason_smem = WCSS_CRASH_REASON,
+ 	.firmware_name = "wcnss.mdt",
+ 	.version = WCSS_QCS404,
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0113-remoteproc-qcom-Add-secure-PIL-support.patch b/6.12/target/linux/qualcommax/patches-6.12/0113-remoteproc-qcom-Add-secure-PIL-support.patch
new file mode 100644
index 00000000..fc35733f
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0113-remoteproc-qcom-Add-secure-PIL-support.patch
@@ -0,0 +1,143 @@
+From 7358d42dfbdfdb5d4f1d0d4c2e5c2bb4143a29b0 Mon Sep 17 00:00:00 2001
+From: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Date: Sat, 30 Jan 2021 10:50:06 +0530
+Subject: [PATCH] remoteproc: qcom: Add secure PIL support
+
+IPQ8074 uses secure PIL. Hence, adding the support for the same.
+
+Signed-off-by: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Signed-off-by: Sricharan R <sricharan@codeaurora.org>
+Signed-off-by: Nikhil Prakash V <nprakash@codeaurora.org>
+---
+ drivers/remoteproc/qcom_q6v5_wcss.c | 43 +++++++++++++++++++++++++++--
+ 1 file changed, 40 insertions(+), 3 deletions(-)
+
+--- a/drivers/remoteproc/qcom_q6v5_wcss.c
++++ b/drivers/remoteproc/qcom_q6v5_wcss.c
+@@ -18,6 +18,7 @@
+ #include <linux/regulator/consumer.h>
+ #include <linux/reset.h>
+ #include <linux/soc/qcom/mdt_loader.h>
++#include <linux/firmware/qcom/qcom_scm.h>
+ #include "qcom_common.h"
+ #include "qcom_pil_info.h"
+ #include "qcom_q6v5.h"
+@@ -86,6 +87,9 @@
+ #define TCSR_WCSS_CLK_ENABLE	0x14
+ 
+ #define MAX_HALT_REG		3
++
++#define WCNSS_PAS_ID		6
++
+ enum {
+ 	WCSS_IPQ8074,
+ 	WCSS_QCS404,
+@@ -134,6 +138,7 @@ struct q6v5_wcss {
+ 	unsigned int crash_reason_smem;
+ 	u32 version;
+ 	bool requires_force_stop;
++	bool need_mem_protection;
+ 
+ 	struct qcom_rproc_glink glink_subdev;
+ 	struct qcom_rproc_pdm pdm_subdev;
+@@ -153,6 +158,7 @@ struct wcss_data {
+ 	int ssctl_id;
+ 	const struct rproc_ops *ops;
+ 	bool requires_force_stop;
++	bool need_mem_protection;
+ };
+ 
+ static int q6v5_wcss_reset(struct q6v5_wcss *wcss)
+@@ -252,6 +258,15 @@ static int q6v5_wcss_start(struct rproc
+ 
+ 	qcom_q6v5_prepare(&wcss->q6v5);
+ 
++	if (wcss->need_mem_protection) {
++		ret = qcom_scm_pas_auth_and_reset(WCNSS_PAS_ID);
++		if (ret) {
++			dev_err(wcss->dev, "wcss_reset failed\n");
++			return ret;
++		}
++		goto wait_for_reset;
++	}
++
+ 	/* Release Q6 and WCSS reset */
+ 	ret = reset_control_deassert(wcss->wcss_reset);
+ 	if (ret) {
+@@ -286,6 +301,7 @@ static int q6v5_wcss_start(struct rproc
+ 	if (ret)
+ 		goto wcss_q6_reset;
+ 
++wait_for_reset:
+ 	ret = qcom_q6v5_wait_for_start(&wcss->q6v5, 5 * HZ);
+ 	if (ret == -ETIMEDOUT)
+ 		dev_err(wcss->dev, "start timed out\n");
+@@ -719,6 +735,15 @@ static int q6v5_wcss_stop(struct rproc *
+ 	struct q6v5_wcss *wcss = rproc->priv;
+ 	int ret;
+ 
++	if (wcss->need_mem_protection) {
++		ret = qcom_scm_pas_shutdown(WCNSS_PAS_ID);
++		if (ret) {
++			dev_err(wcss->dev, "not able to shutdown\n");
++			return ret;
++		}
++		goto pas_done;
++	}
++
+ 	/* WCSS powerdown */
+ 	if (wcss->requires_force_stop) {
+ 		ret = qcom_q6v5_request_stop(&wcss->q6v5, NULL);
+@@ -743,6 +768,7 @@ static int q6v5_wcss_stop(struct rproc *
+ 			return ret;
+ 	}
+ 
++pas_done:
+ 	clk_disable_unprepare(wcss->prng_clk);
+ 	qcom_q6v5_unprepare(&wcss->q6v5);
+ 
+@@ -766,9 +792,15 @@ static int q6v5_wcss_load(struct rproc *
+ 	struct q6v5_wcss *wcss = rproc->priv;
+ 	int ret;
+ 
+-	ret = qcom_mdt_load_no_init(wcss->dev, fw, rproc->firmware,
+-				    0, wcss->mem_region, wcss->mem_phys,
+-				    wcss->mem_size, &wcss->mem_reloc);
++	if (wcss->need_mem_protection)
++		ret = qcom_mdt_load(wcss->dev, fw, rproc->firmware,
++				    WCNSS_PAS_ID, wcss->mem_region,
++				    wcss->mem_phys, wcss->mem_size,
++				    &wcss->mem_reloc);
++	else
++		ret = qcom_mdt_load_no_init(wcss->dev, fw, rproc->firmware,
++					    0, wcss->mem_region, wcss->mem_phys,
++					    wcss->mem_size, &wcss->mem_reloc);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -1036,6 +1068,9 @@ static int q6v5_wcss_probe(struct platfo
+ 	if (!desc)
+ 		return -EINVAL;
+ 
++	if (desc->need_mem_protection && !qcom_scm_is_available())
++		return -EPROBE_DEFER;
++
+ 	rproc = devm_rproc_alloc(&pdev->dev, pdev->name, desc->ops,
+ 				 desc->firmware_name, sizeof(*wcss));
+ 	if (!rproc) {
+@@ -1049,6 +1084,7 @@ static int q6v5_wcss_probe(struct platfo
+ 
+ 	wcss->version = desc->version;
+ 	wcss->requires_force_stop = desc->requires_force_stop;
++	wcss->need_mem_protection = desc->need_mem_protection;
+ 
+ 	ret = q6v5_wcss_init_mmio(wcss, pdev);
+ 	if (ret)
+@@ -1114,6 +1150,7 @@ static const struct wcss_data wcss_ipq80
+ 	.wcss_q6_reset_required = true,
+ 	.ops = &q6v5_wcss_ipq8074_ops,
+ 	.requires_force_stop = true,
++	.need_mem_protection = true,
+ };
+ 
+ static const struct wcss_data wcss_qcs404_res_init = {
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0114-remoteproc-qcom-Add-support-for-split-q6-m3-wlan-fir.patch b/6.12/target/linux/qualcommax/patches-6.12/0114-remoteproc-qcom-Add-support-for-split-q6-m3-wlan-fir.patch
new file mode 100644
index 00000000..be793d65
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0114-remoteproc-qcom-Add-support-for-split-q6-m3-wlan-fir.patch
@@ -0,0 +1,103 @@
+From b422c9d4f048b086ce83f44a7cfcddcce162897f Mon Sep 17 00:00:00 2001
+From: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Date: Sat, 30 Jan 2021 10:50:07 +0530
+Subject: [PATCH] remoteproc: qcom: Add support for split q6 + m3 wlan firmware
+
+IPQ8074 supports split firmware for q6 and m3 as well.
+So add support for loading the m3 firmware before q6.
+Now the drivers works fine for both split and unified
+firmwares.
+
+Signed-off-by: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Signed-off-by: Sricharan R <sricharan@codeaurora.org>
+Signed-off-by: Nikhil Prakash V <nprakash@codeaurora.org>
+---
+ drivers/remoteproc/qcom_q6v5_wcss.c | 33 +++++++++++++++++++++++++----
+ 1 file changed, 29 insertions(+), 4 deletions(-)
+
+--- a/drivers/remoteproc/qcom_q6v5_wcss.c
++++ b/drivers/remoteproc/qcom_q6v5_wcss.c
+@@ -139,6 +139,7 @@ struct q6v5_wcss {
+ 	u32 version;
+ 	bool requires_force_stop;
+ 	bool need_mem_protection;
++	const char *m3_firmware_name;
+ 
+ 	struct qcom_rproc_glink glink_subdev;
+ 	struct qcom_rproc_pdm pdm_subdev;
+@@ -148,7 +149,8 @@ struct q6v5_wcss {
+ struct wcss_data {
+ 	int (*init_clock)(struct q6v5_wcss *wcss);
+ 	int (*init_regulator)(struct q6v5_wcss *wcss);
+-	const char *firmware_name;
++	const char *q6_firmware_name;
++	const char *m3_firmware_name;
+ 	unsigned int crash_reason_smem;
+ 	u32 version;
+ 	bool aon_reset_required;
+@@ -790,8 +792,29 @@ static void *q6v5_wcss_da_to_va(struct r
+ static int q6v5_wcss_load(struct rproc *rproc, const struct firmware *fw)
+ {
+ 	struct q6v5_wcss *wcss = rproc->priv;
++	const struct firmware *m3_fw;
+ 	int ret;
+ 
++	if (wcss->m3_firmware_name) {
++		ret = request_firmware(&m3_fw, wcss->m3_firmware_name,
++				       wcss->dev);
++		if (ret)
++			goto skip_m3;
++
++		ret = qcom_mdt_load_no_init(wcss->dev, m3_fw,
++					    wcss->m3_firmware_name, 0,
++					    wcss->mem_region, wcss->mem_phys,
++					    wcss->mem_size, &wcss->mem_reloc);
++
++		release_firmware(m3_fw);
++
++		if (ret) {
++			dev_err(wcss->dev, "can't load m3_fw.bXX\n");
++			return ret;
++		}
++	}
++
++skip_m3:
+ 	if (wcss->need_mem_protection)
+ 		ret = qcom_mdt_load(wcss->dev, fw, rproc->firmware,
+ 				    WCNSS_PAS_ID, wcss->mem_region,
+@@ -1072,7 +1095,7 @@ static int q6v5_wcss_probe(struct platfo
+ 		return -EPROBE_DEFER;
+ 
+ 	rproc = devm_rproc_alloc(&pdev->dev, pdev->name, desc->ops,
+-				 desc->firmware_name, sizeof(*wcss));
++				 desc->q6_firmware_name, sizeof(*wcss));
+ 	if (!rproc) {
+ 		dev_err(&pdev->dev, "failed to allocate rproc\n");
+ 		return -ENOMEM;
+@@ -1085,6 +1108,7 @@ static int q6v5_wcss_probe(struct platfo
+ 	wcss->version = desc->version;
+ 	wcss->requires_force_stop = desc->requires_force_stop;
+ 	wcss->need_mem_protection = desc->need_mem_protection;
++	wcss->m3_firmware_name = desc->m3_firmware_name;
+ 
+ 	ret = q6v5_wcss_init_mmio(wcss, pdev);
+ 	if (ret)
+@@ -1144,7 +1168,8 @@ static void q6v5_wcss_remove(struct plat
+ 
+ static const struct wcss_data wcss_ipq8074_res_init = {
+ 	.init_clock = ipq8074_init_clock,
+-	.firmware_name = "IPQ8074/q6_fw.mdt",
++	.q6_firmware_name = "IPQ8074/q6_fw.mdt",
++	.m3_firmware_name = "IPQ8074/m3_fw.mdt",
+ 	.crash_reason_smem = WCSS_CRASH_REASON,
+ 	.aon_reset_required = true,
+ 	.wcss_q6_reset_required = true,
+@@ -1157,7 +1182,7 @@ static const struct wcss_data wcss_qcs40
+ 	.init_clock = qcs404_init_clock,
+ 	.init_regulator = qcs404_init_regulator,
+ 	.crash_reason_smem = WCSS_CRASH_REASON,
+-	.firmware_name = "wcnss.mdt",
++	.q6_firmware_name = "wcnss.mdt",
+ 	.version = WCSS_QCS404,
+ 	.aon_reset_required = false,
+ 	.wcss_q6_reset_required = false,
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0115-remoteproc-qcom-Add-ssr-subdevice-identifier.patch b/6.12/target/linux/qualcommax/patches-6.12/0115-remoteproc-qcom-Add-ssr-subdevice-identifier.patch
new file mode 100644
index 00000000..5d6a573c
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0115-remoteproc-qcom-Add-ssr-subdevice-identifier.patch
@@ -0,0 +1,24 @@
+From 3a8f67b4770c817b04794c9a02e3f88f85d86280 Mon Sep 17 00:00:00 2001
+From: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Date: Sat, 30 Jan 2021 10:50:08 +0530
+Subject: [PATCH] remoteproc: qcom: Add ssr subdevice identifier
+
+Add name for ssr subdevice on IPQ8074 SoC.
+
+Signed-off-by: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Signed-off-by: Sricharan R <sricharan@codeaurora.org>
+Signed-off-by: Nikhil Prakash V <nprakash@codeaurora.org>
+---
+ drivers/remoteproc/qcom_q6v5_wcss.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/remoteproc/qcom_q6v5_wcss.c
++++ b/drivers/remoteproc/qcom_q6v5_wcss.c
+@@ -1173,6 +1173,7 @@ static const struct wcss_data wcss_ipq80
+ 	.crash_reason_smem = WCSS_CRASH_REASON,
+ 	.aon_reset_required = true,
+ 	.wcss_q6_reset_required = true,
++	.ssr_name = "q6wcss",
+ 	.ops = &q6v5_wcss_ipq8074_ops,
+ 	.requires_force_stop = true,
+ 	.need_mem_protection = true,
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0116-remoteproc-qcom-Update-regmap-offsets-for-halt-regis.patch b/6.12/target/linux/qualcommax/patches-6.12/0116-remoteproc-qcom-Update-regmap-offsets-for-halt-regis.patch
new file mode 100644
index 00000000..7989dfa5
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0116-remoteproc-qcom-Update-regmap-offsets-for-halt-regis.patch
@@ -0,0 +1,79 @@
+From 8c73af6e8d78c66cfef0f551b00d375ec0b67ff3 Mon Sep 17 00:00:00 2001
+From: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Date: Sat, 30 Jan 2021 10:50:09 +0530
+Subject: [PATCH] remoteproc: qcom: Update regmap offsets for halt register
+
+Fixed issue in reading halt-regs parameter from device-tree.
+
+Signed-off-by: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Signed-off-by: Sricharan R <sricharan@codeaurora.org>
+---
+ drivers/remoteproc/qcom_q6v5_wcss.c | 22 ++++++++++++++--------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+--- a/drivers/remoteproc/qcom_q6v5_wcss.c
++++ b/drivers/remoteproc/qcom_q6v5_wcss.c
+@@ -86,7 +86,7 @@
+ #define TCSR_WCSS_CLK_MASK	0x1F
+ #define TCSR_WCSS_CLK_ENABLE	0x14
+ 
+-#define MAX_HALT_REG		3
++#define MAX_HALT_REG		4
+ 
+ #define WCNSS_PAS_ID		6
+ 
+@@ -155,6 +155,7 @@ struct wcss_data {
+ 	u32 version;
+ 	bool aon_reset_required;
+ 	bool wcss_q6_reset_required;
++	bool bcr_reset_required;
+ 	const char *ssr_name;
+ 	const char *sysmon_name;
+ 	int ssctl_id;
+@@ -876,10 +877,13 @@ static int q6v5_wcss_init_reset(struct q
+ 		}
+ 	}
+ 
+-	wcss->wcss_q6_bcr_reset = devm_reset_control_get_exclusive(dev, "wcss_q6_bcr_reset");
+-	if (IS_ERR(wcss->wcss_q6_bcr_reset)) {
+-		dev_err(wcss->dev, "unable to acquire wcss_q6_bcr_reset\n");
+-		return PTR_ERR(wcss->wcss_q6_bcr_reset);
++	if (desc->bcr_reset_required) {
++		wcss->wcss_q6_bcr_reset = devm_reset_control_get_exclusive(dev,
++									   "wcss_q6_bcr_reset");
++		if (IS_ERR(wcss->wcss_q6_bcr_reset)) {
++			dev_err(wcss->dev, "unable to acquire wcss_q6_bcr_reset\n");
++			return PTR_ERR(wcss->wcss_q6_bcr_reset);
++		}
+ 	}
+ 
+ 	return 0;
+@@ -929,9 +933,9 @@ static int q6v5_wcss_init_mmio(struct q6
+ 		return -EINVAL;
+ 	}
+ 
+-	wcss->halt_q6 = halt_reg[0];
+-	wcss->halt_wcss = halt_reg[1];
+-	wcss->halt_nc = halt_reg[2];
++	wcss->halt_q6 = halt_reg[1];
++	wcss->halt_wcss = halt_reg[2];
++	wcss->halt_nc = halt_reg[3];
+ 
+ 	return 0;
+ }
+@@ -1173,6 +1177,7 @@ static const struct wcss_data wcss_ipq80
+ 	.crash_reason_smem = WCSS_CRASH_REASON,
+ 	.aon_reset_required = true,
+ 	.wcss_q6_reset_required = true,
++	.bcr_reset_required = false,
+ 	.ssr_name = "q6wcss",
+ 	.ops = &q6v5_wcss_ipq8074_ops,
+ 	.requires_force_stop = true,
+@@ -1187,6 +1192,7 @@ static const struct wcss_data wcss_qcs40
+ 	.version = WCSS_QCS404,
+ 	.aon_reset_required = false,
+ 	.wcss_q6_reset_required = false,
++	.bcr_reset_required = true,
+ 	.ssr_name = "mpss",
+ 	.sysmon_name = "wcnss",
+ 	.ssctl_id = 0x12,
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0117-dt-bindings-clock-qcom-Add-reset-for-WCSSAON.patch b/6.12/target/linux/qualcommax/patches-6.12/0117-dt-bindings-clock-qcom-Add-reset-for-WCSSAON.patch
new file mode 100644
index 00000000..fe0e0f9e
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0117-dt-bindings-clock-qcom-Add-reset-for-WCSSAON.patch
@@ -0,0 +1,26 @@
+From ff7c6533ed8c4de58ed6c8aab03ea59c03eb4f31 Mon Sep 17 00:00:00 2001
+From: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Date: Sat, 30 Jan 2021 10:50:10 +0530
+Subject: [PATCH] dt-bindings: clock: qcom: Add reset for WCSSAON
+
+Add binding for WCSSAON reset required for Q6v5 reset on IPQ8074 SoC.
+
+Signed-off-by: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Signed-off-by: Sricharan R <sricharan@codeaurora.org>
+Signed-off-by: Nikhil Prakash V <nprakash@codeaurora.org>
+Acked-by: Rob Herring <robh@kernel.org>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+---
+ include/dt-bindings/clock/qcom,gcc-ipq8074.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/dt-bindings/clock/qcom,gcc-ipq8074.h
++++ b/include/dt-bindings/clock/qcom,gcc-ipq8074.h
+@@ -381,6 +381,7 @@
+ #define GCC_NSSPORT4_RESET			143
+ #define GCC_NSSPORT5_RESET			144
+ #define GCC_NSSPORT6_RESET			145
++#define GCC_WCSSAON_RESET			146
+ 
+ #define USB0_GDSC				0
+ #define USB1_GDSC				1
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0118-clk-qcom-Add-WCSSAON-reset.patch b/6.12/target/linux/qualcommax/patches-6.12/0118-clk-qcom-Add-WCSSAON-reset.patch
new file mode 100644
index 00000000..7938b182
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0118-clk-qcom-Add-WCSSAON-reset.patch
@@ -0,0 +1,25 @@
+From 43d9788f546d24df22d8ba3fcc2497d7ccc198f3 Mon Sep 17 00:00:00 2001
+From: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Date: Sat, 30 Jan 2021 10:50:11 +0530
+Subject: [PATCH] clk: qcom: Add WCSSAON reset
+
+Add WCSSAON reset required for Q6v5 on IPQ8074 SoC.
+
+Signed-off-by: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Signed-off-by: Sricharan R <sricharan@codeaurora.org>
+Signed-off-by: Nikhil Prakash V <nprakash@codeaurora.org>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+---
+ drivers/clk/qcom/gcc-ipq8074.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/clk/qcom/gcc-ipq8074.c
++++ b/drivers/clk/qcom/gcc-ipq8074.c
+@@ -4712,6 +4712,7 @@ static const struct qcom_reset_map gcc_i
+ 	[GCC_NSSPORT4_RESET] = { .reg = 0x68014, .bitmask = BIT(27) | GENMASK(9, 8) },
+ 	[GCC_NSSPORT5_RESET] = { .reg = 0x68014, .bitmask = BIT(28) | GENMASK(11, 10) },
+ 	[GCC_NSSPORT6_RESET] = { .reg = 0x68014, .bitmask = BIT(29) | GENMASK(13, 12) },
++	[GCC_WCSSAON_RESET] = { 0x59010, 0 },
+ };
+ 
+ static struct gdsc *gcc_ipq8074_gdscs[] = {
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0119-remoteproc-wcss-disable-auto-boot-for-IPQ8074.patch b/6.12/target/linux/qualcommax/patches-6.12/0119-remoteproc-wcss-disable-auto-boot-for-IPQ8074.patch
new file mode 100644
index 00000000..ccb78dec
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0119-remoteproc-wcss-disable-auto-boot-for-IPQ8074.patch
@@ -0,0 +1,48 @@
+From 406a332fd1bcc4e18d73cce390f56272fe9111d7 Mon Sep 17 00:00:00 2001
+From: Sivaprakash Murugesan <sivaprak@codeaurora.org>
+Date: Fri, 17 Apr 2020 16:37:10 +0530
+Subject: [PATCH] remoteproc: wcss: disable auto boot for IPQ8074
+
+There is no need for remoteproc to boot automatically, ath11k will trigger
+booting when its probing.
+
+Signed-off-by: Sivaprakash Murugesan <sivaprak@codeaurora.org>
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ drivers/remoteproc/qcom_q6v5_wcss.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/remoteproc/qcom_q6v5_wcss.c
++++ b/drivers/remoteproc/qcom_q6v5_wcss.c
+@@ -162,6 +162,7 @@ struct wcss_data {
+ 	const struct rproc_ops *ops;
+ 	bool requires_force_stop;
+ 	bool need_mem_protection;
++	bool need_auto_boot;
+ };
+ 
+ static int q6v5_wcss_reset(struct q6v5_wcss *wcss)
+@@ -1151,6 +1152,7 @@ static int q6v5_wcss_probe(struct platfo
+ 						      desc->sysmon_name,
+ 						      desc->ssctl_id);
+ 
++	rproc->auto_boot = desc->need_auto_boot;
+ 	ret = rproc_add(rproc);
+ 	if (ret)
+ 		return ret;
+@@ -1182,6 +1184,7 @@ static const struct wcss_data wcss_ipq80
+ 	.ops = &q6v5_wcss_ipq8074_ops,
+ 	.requires_force_stop = true,
+ 	.need_mem_protection = true,
++	.need_auto_boot = false,
+ };
+ 
+ static const struct wcss_data wcss_qcs404_res_init = {
+@@ -1198,6 +1201,7 @@ static const struct wcss_data wcss_qcs40
+ 	.ssctl_id = 0x12,
+ 	.ops = &q6v5_wcss_qcs404_ops,
+ 	.requires_force_stop = false,
++	.need_auto_boot = true,
+ };
+ 
+ static const struct of_device_id q6v5_wcss_of_match[] = {
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0120-arm64-dts-qcom-Enable-Q6v5-WCSS-for-ipq8074-SoC.patch b/6.12/target/linux/qualcommax/patches-6.12/0120-arm64-dts-qcom-Enable-Q6v5-WCSS-for-ipq8074-SoC.patch
new file mode 100644
index 00000000..c712fbdc
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0120-arm64-dts-qcom-Enable-Q6v5-WCSS-for-ipq8074-SoC.patch
@@ -0,0 +1,120 @@
+From 7388400b8bd42f71d040dbf2fdbdcb834fcc0ede Mon Sep 17 00:00:00 2001
+From: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Date: Sat, 30 Jan 2021 10:50:13 +0530
+Subject: [PATCH] arm64: dts: qcom: Enable Q6v5 WCSS for ipq8074 SoC
+
+Enable remoteproc WCSS PIL driver with glink and ssr subdevices.
+Also enables smp2p and mailboxes required for IPC.
+
+Signed-off-by: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Signed-off-by: Sricharan R <sricharan@codeaurora.org>
+Signed-off-by: Nikhil Prakash V <nprakash@codeaurora.org>
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 81 +++++++++++++++++++++++++++
+ 1 file changed, 81 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -142,6 +142,32 @@
+ 		};
+ 	};
+ 
++	wcss: smp2p-wcss {
++		compatible = "qcom,smp2p";
++		qcom,smem = <435>, <428>;
++
++		interrupt-parent = <&intc>;
++		interrupts = <0 322 1>;
++
++		mboxes = <&apcs_glb 9>;
++
++		qcom,local-pid = <0>;
++		qcom,remote-pid = <1>;
++
++		wcss_smp2p_out: master-kernel {
++			qcom,entry-name = "master-kernel";
++			qcom,smp2p-feature-ssr-ack;
++			#qcom,smem-state-cells = <1>;
++		};
++
++		wcss_smp2p_in: slave-kernel {
++			qcom,entry-name = "slave-kernel";
++
++			interrupt-controller;
++			#interrupt-cells = <2>;
++		};
++	};
++
+ 	soc: soc@0 {
+ 		#address-cells = <1>;
+ 		#size-cells = <1>;
+@@ -417,6 +443,11 @@
+ 			reg = <0x01937000 0x21000>;
+ 		};
+ 
++		tcsr_q6: syscon@1945000 {
++			compatible = "syscon";
++			reg = <0x01945000 0xe000>;
++		};
++
+ 		spmi_bus: spmi@200f000 {
+ 			compatible = "qcom,spmi-pmic-arb";
+ 			reg = <0x0200f000 0x001000>,
+@@ -996,6 +1027,56 @@
+ 				ranges;
+ 			};
+ 		};
++
++		q6v5_wcss: q6v5_wcss@cd00000 {
++			compatible = "qcom,ipq8074-wcss-pil";
++			reg = <0x0cd00000 0x4040>,
++			      <0x004ab000 0x20>;
++			reg-names = "qdsp6",
++				    "rmb";
++			qca,auto-restart;
++			qca,extended-intc;
++			interrupts-extended = <&intc 0 325 1>,
++					      <&wcss_smp2p_in 0 0>,
++					      <&wcss_smp2p_in 1 0>,
++					      <&wcss_smp2p_in 2 0>,
++					      <&wcss_smp2p_in 3 0>;
++			interrupt-names = "wdog",
++					  "fatal",
++					  "ready",
++					  "handover",
++					  "stop-ack";
++
++			resets = <&gcc GCC_WCSSAON_RESET>,
++				 <&gcc GCC_WCSS_BCR>,
++				 <&gcc GCC_WCSS_Q6_BCR>;
++
++			reset-names = "wcss_aon_reset",
++				      "wcss_reset",
++				      "wcss_q6_reset";
++
++			clocks = <&gcc GCC_PRNG_AHB_CLK>;
++			clock-names = "prng";
++
++			qcom,halt-regs = <&tcsr_q6 0xa000 0xd000 0x0>;
++
++			qcom,smem-states = <&wcss_smp2p_out 0>,
++					   <&wcss_smp2p_out 1>;
++			qcom,smem-state-names = "shutdown",
++						"stop";
++
++			memory-region = <&q6_region>;
++
++			glink-edge {
++				interrupts = <GIC_SPI 321 IRQ_TYPE_EDGE_RISING>;
++				qcom,remote-pid = <1>;
++				mboxes = <&apcs_glb 8>;
++
++				rpm_requests {
++					qcom,glink-channels = "IPCRTR";
++				};
++			};
++		};
+ 	};
+ 
+ 	timer {
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0121-arm64-dts-ipq8074-Add-WLAN-node.patch b/6.12/target/linux/qualcommax/patches-6.12/0121-arm64-dts-ipq8074-Add-WLAN-node.patch
new file mode 100644
index 00000000..04eb1c54
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0121-arm64-dts-ipq8074-Add-WLAN-node.patch
@@ -0,0 +1,135 @@
+From a67d1901741c162645eda0dbdc3a2c0c2aff5cf4 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Tue, 21 Dec 2021 14:49:36 +0100
+Subject: [PATCH] arm64: dts: ipq8074: Add WLAN node
+
+IPQ8074 has a AHB based Q6v5 802.11ax radios that are supported
+by the ath11k.
+
+Add the required DT node to enable the built-in radios.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 111 ++++++++++++++++++++++++++
+ 1 file changed, 111 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -1077,6 +1077,117 @@
+ 				};
+ 			};
+ 		};
++
++		wifi: wifi@c0000000 {
++			compatible = "qcom,ipq8074-wifi";
++			reg = <0xc000000 0x2000000>;
++
++			interrupts = <GIC_SPI 320 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 319 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 318 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 316 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 315 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 314 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 311 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 310 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 411 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 410 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 40 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 39 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 302 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 301 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 37 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 36 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 296 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 295 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 294 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 293 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 292 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 291 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 290 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 289 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 288 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 239 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 236 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 235 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 234 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 233 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 232 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 231 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 230 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 229 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 228 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 224 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 223 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 203 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 183 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 180 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 179 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 178 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 177 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 176 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 163 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 162 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 160 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 159 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 158 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 157 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 156 IRQ_TYPE_EDGE_RISING>;
++
++			interrupt-names = "misc-pulse1",
++					  "misc-latch",
++					  "sw-exception",
++					  "ce0",
++					  "ce1",
++					  "ce2",
++					  "ce3",
++					  "ce4",
++					  "ce5",
++					  "ce6",
++					  "ce7",
++					  "ce8",
++					  "ce9",
++					  "ce10",
++					  "ce11",
++					  "host2wbm-desc-feed",
++					  "host2reo-re-injection",
++					  "host2reo-command",
++					  "host2rxdma-monitor-ring3",
++					  "host2rxdma-monitor-ring2",
++					  "host2rxdma-monitor-ring1",
++					  "reo2ost-exception",
++					  "wbm2host-rx-release",
++					  "reo2host-status",
++					  "reo2host-destination-ring4",
++					  "reo2host-destination-ring3",
++					  "reo2host-destination-ring2",
++					  "reo2host-destination-ring1",
++					  "rxdma2host-monitor-destination-mac3",
++					  "rxdma2host-monitor-destination-mac2",
++					  "rxdma2host-monitor-destination-mac1",
++					  "ppdu-end-interrupts-mac3",
++					  "ppdu-end-interrupts-mac2",
++					  "ppdu-end-interrupts-mac1",
++					  "rxdma2host-monitor-status-ring-mac3",
++					  "rxdma2host-monitor-status-ring-mac2",
++					  "rxdma2host-monitor-status-ring-mac1",
++					  "host2rxdma-host-buf-ring-mac3",
++					  "host2rxdma-host-buf-ring-mac2",
++					  "host2rxdma-host-buf-ring-mac1",
++					  "rxdma2host-destination-ring-mac3",
++					  "rxdma2host-destination-ring-mac2",
++					  "rxdma2host-destination-ring-mac1",
++					  "host2tcl-input-ring4",
++					  "host2tcl-input-ring3",
++					  "host2tcl-input-ring2",
++					  "host2tcl-input-ring1",
++					  "wbm2host-tx-completions-ring3",
++					  "wbm2host-tx-completions-ring2",
++					  "wbm2host-tx-completions-ring1",
++					  "tcl2host-status-ring";
++			qcom,rproc = <&q6v5_wcss>;
++			status = "disabled";
++		};
+ 	};
+ 
+ 	timer {
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0122-arm64-dts-ipq8074-add-CPU-clock.patch b/6.12/target/linux/qualcommax/patches-6.12/0122-arm64-dts-ipq8074-add-CPU-clock.patch
new file mode 100644
index 00000000..a3c5f344
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0122-arm64-dts-ipq8074-add-CPU-clock.patch
@@ -0,0 +1,59 @@
+From cb3ef99c1553565e1dc0301ccd5c1c0fa2d15c15 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 31 Dec 2021 17:56:14 +0100
+Subject: [PATCH] arm64: dts: ipq8074: add CPU clock
+
+Now that CPU clock is exposed and can be controlled, add the necessary
+properties to the CPU nodes.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -5,6 +5,7 @@
+ 
+ #include <dt-bindings/interrupt-controller/arm-gic.h>
+ #include <dt-bindings/clock/qcom,gcc-ipq8074.h>
++#include <dt-bindings/clock/qcom,apss-ipq.h>
+ 
+ / {
+ 	#address-cells = <2>;
+@@ -38,6 +39,8 @@
+ 			reg = <0x0>;
+ 			next-level-cache = <&L2_0>;
+ 			enable-method = "psci";
++			clocks = <&apcs_glb APCS_ALIAS0_CORE_CLK>;
++			clock-names = "cpu";
+ 		};
+ 
+ 		CPU1: cpu@1 {
+@@ -46,6 +49,8 @@
+ 			enable-method = "psci";
+ 			reg = <0x1>;
+ 			next-level-cache = <&L2_0>;
++			clocks = <&apcs_glb APCS_ALIAS0_CORE_CLK>;
++			clock-names = "cpu";
+ 		};
+ 
+ 		CPU2: cpu@2 {
+@@ -54,6 +59,8 @@
+ 			enable-method = "psci";
+ 			reg = <0x2>;
+ 			next-level-cache = <&L2_0>;
++			clocks = <&apcs_glb APCS_ALIAS0_CORE_CLK>;
++			clock-names = "cpu";
+ 		};
+ 
+ 		CPU3: cpu@3 {
+@@ -62,6 +69,8 @@
+ 			enable-method = "psci";
+ 			reg = <0x3>;
+ 			next-level-cache = <&L2_0>;
++			clocks = <&apcs_glb APCS_ALIAS0_CORE_CLK>;
++			clock-names = "cpu";
+ 		};
+ 
+ 		L2_0: l2-cache {
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0123-arm64-dts-ipq8074-add-cooling-cells-to-CPU-nodes.patch b/6.12/target/linux/qualcommax/patches-6.12/0123-arm64-dts-ipq8074-add-cooling-cells-to-CPU-nodes.patch
new file mode 100644
index 00000000..3520b381
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0123-arm64-dts-ipq8074-add-cooling-cells-to-CPU-nodes.patch
@@ -0,0 +1,48 @@
+From 347ca56e86c99021fad059b9a8ef101245b8507e Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 31 Dec 2021 20:38:06 +0100
+Subject: [PATCH] arm64: dts: ipq8074: add cooling cells to CPU nodes
+
+Since there is CPU Freq support as well as thermal sensor support
+now for the IPQ8074, add cooling cells to CPU nodes so that they can
+be used as cooling devices using CPU Freq.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -41,6 +41,7 @@
+ 			enable-method = "psci";
+ 			clocks = <&apcs_glb APCS_ALIAS0_CORE_CLK>;
+ 			clock-names = "cpu";
++			#cooling-cells = <2>;
+ 		};
+ 
+ 		CPU1: cpu@1 {
+@@ -51,6 +52,7 @@
+ 			next-level-cache = <&L2_0>;
+ 			clocks = <&apcs_glb APCS_ALIAS0_CORE_CLK>;
+ 			clock-names = "cpu";
++			#cooling-cells = <2>;
+ 		};
+ 
+ 		CPU2: cpu@2 {
+@@ -61,6 +63,7 @@
+ 			next-level-cache = <&L2_0>;
+ 			clocks = <&apcs_glb APCS_ALIAS0_CORE_CLK>;
+ 			clock-names = "cpu";
++			#cooling-cells = <2>;
+ 		};
+ 
+ 		CPU3: cpu@3 {
+@@ -71,6 +74,7 @@
+ 			next-level-cache = <&L2_0>;
+ 			clocks = <&apcs_glb APCS_ALIAS0_CORE_CLK>;
+ 			clock-names = "cpu";
++			#cooling-cells = <2>;
+ 		};
+ 
+ 		L2_0: l2-cache {
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0129-arm64-dts-qcom-ipq8074-add-QFPROM-fuses.patch b/6.12/target/linux/qualcommax/patches-6.12/0129-arm64-dts-qcom-ipq8074-add-QFPROM-fuses.patch
new file mode 100644
index 00000000..57091df2
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0129-arm64-dts-qcom-ipq8074-add-QFPROM-fuses.patch
@@ -0,0 +1,121 @@
+From 04d2fc6a551bbd972a6428059b45ce79cb9de9d7 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 6 May 2022 22:38:24 +0200
+Subject: [PATCH] arm64: dts: qcom: ipq8074: add QFPROM fuses
+
+Add the QFPROM node and CPR fuses.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 107 ++++++++++++++++++++++++++
+ 1 file changed, 107 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -328,6 +328,106 @@
+ 			reg = <0x000a4000 0x2000>;
+ 			#address-cells = <1>;
+ 			#size-cells = <1>;
++
++			cpr_efuse_speedbin: speedbin@125 {
++				reg = <0x125 0x1>;
++				bits = <0 3>;
++			};
++
++			cpr_efuse_boost_cfg: boost_cfg@125 {
++				reg = <0x125 0x1>;
++				bits = <3 3>;
++			};
++
++			cpr_efuse_misc_volt_adj: misc_volt_adj@125 {
++				reg = <0x125 0x1>;
++				bits = <3 3>;
++			};
++
++			cpr_efuse_boost_volt: boost_volt@126 {
++				reg = <0x126 0x1>;
++				bits = <6 1>;
++			};
++
++			cpr_efuse_revision: revision@23e {
++				reg = <0x23e 0x1>;
++				bits = <5 3>;
++			};
++
++			cpr_efuse_ro_sel0: rosel0@249 {
++				reg = <0x249 0x1>;
++				bits = <0 4>;
++			};
++
++			cpr_efuse_ro_sel1: rosel1@248 {
++				reg = <0x248 0x1>;
++				bits = <4 4>;
++			};
++
++			cpr_efuse_ro_sel2: rosel2@248 {
++				reg = <0x248 0x2>;
++				bits = <0 4>;
++			};
++
++			cpr_efuse_ro_sel3: rosel3@249 {
++				reg = <0x249 0x1>;
++				bits = <4 4>;
++			};
++
++			cpr_efuse_init_voltage0: ivoltage0@23a {
++				reg = <0x23a 0x1>;
++				bits = <2 6>;
++			};
++
++			cpr_efuse_init_voltage1: ivoltage1@239 {
++				reg = <0x239 0x2>;
++				bits = <4 6>;
++			};
++
++			cpr_efuse_init_voltage2: ivoltage2@238 {
++				reg = <0x238 0x2>;
++				bits = <6 6>;
++			};
++
++			cpr_efuse_init_voltage3: ivoltage3@238 {
++				reg = <0x238 0x1>;
++				bits = <0 6>;
++			};
++
++			cpr_efuse_quot0: quot0@244 {
++				reg = <0x244 0x2>;
++				bits = <0 12>;
++			};
++
++			cpr_efuse_quot1: quot1@242 {
++				reg = <0x242 0x2>;
++				bits = <4 12>;
++			};
++
++			cpr_efuse_quot2: quot2@241 {
++				reg = <0x241 0x2>;
++				bits = <0 12>;
++			};
++
++			cpr_efuse_quot3: quot3@245 {
++				reg = <0x245 0x2>;
++				bits = <4 12>;
++			};
++
++			cpr_efuse_quot0_offset: quot0_offset@23d {
++				reg = <0x23d 0x2>;
++				bits = <6 7>;
++			};
++
++			cpr_efuse_quot1_offset: quot1_offset@23c {
++				reg = <0x23c 0x2>;
++				bits = <7 7>;
++			};
++
++			cpr_efuse_quot2_offset: quot2_offset@23c {
++				reg = <0x23c 0x1>;
++				bits = <0 7>;
++			};
+ 		};
+ 
+ 		prng: rng@e3000 {
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0130-arm64-dts-qcom-ipq8074-add-CPU-OPP-table.patch b/6.12/target/linux/qualcommax/patches-6.12/0130-arm64-dts-qcom-ipq8074-add-CPU-OPP-table.patch
new file mode 100644
index 00000000..a89e50f5
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0130-arm64-dts-qcom-ipq8074-add-CPU-OPP-table.patch
@@ -0,0 +1,102 @@
+From a20c4e8738a00087aa5d53fe5148ed484e23d229 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Sat, 31 Dec 2022 13:56:26 +0100
+Subject: [PATCH] arm64: dts: qcom: ipq8074: add CPU OPP table
+
+Now that there is NVMEM CPUFreq support for IPQ8074, we can add the OPP
+table for SoC.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 52 +++++++++++++++++++++++++++
+ 1 file changed, 52 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -42,6 +42,7 @@
+ 			clocks = <&apcs_glb APCS_ALIAS0_CORE_CLK>;
+ 			clock-names = "cpu";
+ 			#cooling-cells = <2>;
++			operating-points-v2 = <&cpu_opp_table>;
+ 		};
+ 
+ 		CPU1: cpu@1 {
+@@ -53,6 +54,7 @@
+ 			clocks = <&apcs_glb APCS_ALIAS0_CORE_CLK>;
+ 			clock-names = "cpu";
+ 			#cooling-cells = <2>;
++			operating-points-v2 = <&cpu_opp_table>;
+ 		};
+ 
+ 		CPU2: cpu@2 {
+@@ -64,6 +66,7 @@
+ 			clocks = <&apcs_glb APCS_ALIAS0_CORE_CLK>;
+ 			clock-names = "cpu";
+ 			#cooling-cells = <2>;
++			operating-points-v2 = <&cpu_opp_table>;
+ 		};
+ 
+ 		CPU3: cpu@3 {
+@@ -75,6 +78,7 @@
+ 			clocks = <&apcs_glb APCS_ALIAS0_CORE_CLK>;
+ 			clock-names = "cpu";
+ 			#cooling-cells = <2>;
++			operating-points-v2 = <&cpu_opp_table>;
+ 		};
+ 
+ 		L2_0: l2-cache {
+@@ -84,6 +88,54 @@
+ 		};
+ 	};
+ 
++	cpu_opp_table: opp-table {
++		compatible = "operating-points-v2-kryo-cpu";
++		nvmem-cells = <&cpr_efuse_speedbin>;
++		opp-shared;
++
++		opp-1017600000 {
++			opp-hz = /bits/ 64 <1017600000>;
++			opp-microvolt = <1>;
++			opp-supported-hw = <0xf>;
++			clock-latency-ns = <200000>;
++		};
++
++		opp-1382400000 {
++			opp-hz = /bits/ 64 <1382400000>;
++			opp-microvolt = <2>;
++			opp-supported-hw = <0xf>;
++			clock-latency-ns = <200000>;
++		};
++
++		opp-1651200000 {
++			opp-hz = /bits/ 64 <1651200000>;
++			opp-microvolt = <3>;
++			opp-supported-hw = <0x1>;
++			clock-latency-ns = <200000>;
++		};
++
++		opp-1843200000 {
++			opp-hz = /bits/ 64 <1843200000>;
++			opp-microvolt = <4>;
++			opp-supported-hw = <0x1>;
++			clock-latency-ns = <200000>;
++		};
++
++		opp-1920000000 {
++			opp-hz = /bits/ 64 <1920000000>;
++			opp-microvolt = <5>;
++			opp-supported-hw = <0x1>;
++			clock-latency-ns = <200000>;
++		};
++
++		opp-2208000000 {
++			opp-hz = /bits/ 64 <2208000000>;
++			opp-microvolt = <6>;
++			opp-supported-hw = <0x1>;
++			clock-latency-ns = <200000>;
++		};
++	};
++
+ 	pmu {
+ 		compatible = "arm,cortex-a53-pmu";
+ 		interrupts = <GIC_PPI 7 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0136-remoteproc-qcom-wcss-populate-driver-data-for-IPQ601.patch b/6.12/target/linux/qualcommax/patches-6.12/0136-remoteproc-qcom-wcss-populate-driver-data-for-IPQ601.patch
new file mode 100644
index 00000000..b1175d48
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0136-remoteproc-qcom-wcss-populate-driver-data-for-IPQ601.patch
@@ -0,0 +1,61 @@
+From 9dd19a9ae36bc60d58287d0c52e53024d484e64d Mon Sep 17 00:00:00 2001
+From:   Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+Date:   Fri, 29 Jan 2021 22:41:59 +0530
+Subject: [PATCH 2/3] remoteproc: qcom: wcss: populate driver data for IPQ6018
+
+Populate hardcoded param using driver data for IPQ6018 SoCs.
+
+Signed-off-by: Gokul Sriram Palanisamy <gokulsri@codeaurora.org>
+---
+ drivers/remoteproc/qcom_q6v5_wcss.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+--- a/drivers/remoteproc/qcom_q6v5_wcss.c
++++ b/drivers/remoteproc/qcom_q6v5_wcss.c
+@@ -970,7 +970,7 @@ static int q6v5_alloc_memory_region(stru
+ 	return 0;
+ }
+ 
+-static int ipq8074_init_clock(struct q6v5_wcss *wcss)
++static int ipq_init_clock(struct q6v5_wcss *wcss)
+ {
+ 	int ret;
+ 
+@@ -1173,7 +1173,7 @@ static void q6v5_wcss_remove(struct plat
+ }
+ 
+ static const struct wcss_data wcss_ipq8074_res_init = {
+-	.init_clock = ipq8074_init_clock,
++	.init_clock = ipq_init_clock,
+ 	.q6_firmware_name = "IPQ8074/q6_fw.mdt",
+ 	.m3_firmware_name = "IPQ8074/m3_fw.mdt",
+ 	.crash_reason_smem = WCSS_CRASH_REASON,
+@@ -1187,6 +1187,20 @@ static const struct wcss_data wcss_ipq80
+ 	.need_auto_boot = false,
+ };
+ 
++static const struct wcss_data wcss_ipq6018_res_init = {
++	.init_clock = ipq_init_clock,
++	.q6_firmware_name = "IPQ6018/q6_fw.mdt",
++	.m3_firmware_name = "IPQ6018/m3_fw.mdt",
++	.crash_reason_smem = WCSS_CRASH_REASON,
++	.aon_reset_required = true,
++	.wcss_q6_reset_required = true,
++	.bcr_reset_required = false,
++	.ssr_name = "q6wcss",
++	.ops = &q6v5_wcss_ipq8074_ops,
++	.requires_force_stop = true,
++	.need_mem_protection = true,
++};
++
+ static const struct wcss_data wcss_qcs404_res_init = {
+ 	.init_clock = qcs404_init_clock,
+ 	.init_regulator = qcs404_init_regulator,
+@@ -1206,6 +1220,7 @@ static const struct wcss_data wcss_qcs40
+ 
+ static const struct of_device_id q6v5_wcss_of_match[] = {
+ 	{ .compatible = "qcom,ipq8074-wcss-pil", .data = &wcss_ipq8074_res_init },
++	{ .compatible = "qcom,ipq6018-wcss-pil", .data = &wcss_ipq6018_res_init },
+ 	{ .compatible = "qcom,qcs404-wcss-pil", .data = &wcss_qcs404_res_init },
+ 	{ },
+ };
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0139-arm64-dts-qcom-ipq6018-add-LDOA2-regulator.patch b/6.12/target/linux/qualcommax/patches-6.12/0139-arm64-dts-qcom-ipq6018-add-LDOA2-regulator.patch
new file mode 100644
index 00000000..2f774664
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0139-arm64-dts-qcom-ipq6018-add-LDOA2-regulator.patch
@@ -0,0 +1,27 @@
+From d24bc08bfc66f47d6e0a294a080d62893a7696b5 Mon Sep 17 00:00:00 2001
+From: Chukun Pan <amadeus@jmu.edu.cn>
+Date: Thu, 18 Jan 2024 21:30:21 +0800
+Subject: [PATCH] arm64: dts: qcom: ipq6018: add LDOA2 regulator
+
+Add LDOA2 regulator of MP5496 to support SDCC voltage scaling.
+
+Suggested-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
+---
+ arch/arm64/boot/dts/qcom/ipq6018.dtsi | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+@@ -179,6 +179,11 @@
+ 						regulator-max-microvolt = <1062500>;
+ 						regulator-always-on;
+ 					};
++
++					ipq6018_l2: l2 {
++						regulator-min-microvolt = <1800000>;
++						regulator-max-microvolt = <3300000>;
++					};
+ 				};
+ 			};
+ 		};
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0140-arm64-dts-qcom-ipq6018-add-NSS-reserved-memory.patch b/6.12/target/linux/qualcommax/patches-6.12/0140-arm64-dts-qcom-ipq6018-add-NSS-reserved-memory.patch
new file mode 100644
index 00000000..84591c84
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0140-arm64-dts-qcom-ipq6018-add-NSS-reserved-memory.patch
@@ -0,0 +1,27 @@
+From 7e102b1eb2ca3eff7a6f33ebeab17825e6f70956 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Mon, 4 Nov 2024 22:01:24 +0100
+Subject: [PATCH] arm64: dts: qcom: ipq6018: add NSS reserved memory
+
+It seems that despite NSS not being supported in OpenWrt the memory it
+usually uses needs to be reserved anyway for stability reasons.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ arch/arm64/boot/dts/qcom/ipq6018.dtsi | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+@@ -199,6 +199,11 @@
+ 			no-map;
+ 		};
+ 
++		nss_region: memory@40000000 {
++			reg = <0x0 0x40000000 0x0 0x01000000>;
++			no-map;
++		};
++
+ 		bootloader@4a100000 {
+ 			reg = <0x0 0x4a100000 0x0 0x400000>;
+ 			no-map;
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0400-mtd-rawnand-add-support-for-TH58NYG3S0HBAI4.patch b/6.12/target/linux/qualcommax/patches-6.12/0400-mtd-rawnand-add-support-for-TH58NYG3S0HBAI4.patch
new file mode 100644
index 00000000..c7632d47
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0400-mtd-rawnand-add-support-for-TH58NYG3S0HBAI4.patch
@@ -0,0 +1,42 @@
+From 8d8b37d3af2bdccf0a37d2017d876bfc6ce42552 Mon Sep 17 00:00:00 2001
+From: Chukun Pan <amadeus@jmu.edu.cn>
+Date: Fri, 20 Oct 2023 23:18:21 +0800
+Subject: [PATCH 1/1] mtd: rawnand: add support for TH58NYG3S0HBAI4 NAND flash
+
+The Toshiba TH58NYG3S0HBAI4 is detected with 128 byte OOB while the flash
+has 256 bytes OOB. Since it is not an ONFI compliant NAND, the model name
+cannot be read from anywhere, add a static NAND ID entry to correct this.
+
+However, the NAND ID of this flash is inconsistent with the datasheet.
+The actual NAND ID is only 4 ID bytes, the last ID byte is missing.
+
+Datasheet available at (the ID table is on page 50):
+https://europe.kioxia.com/content/dam/kioxia/newidr/productinfo/datasheet/201910/DST_TH58NYG3S0HBAI4-TDE_EN_31565.pdf
+
+Datasheet NAND ID: {0x98, 0xa3, 0x91, 0x26, 0x76}
+Actual NAND ID: {0x98, 0xa3, 0x91, 0x26}
+
+It seems that this flash may be counterfeit, but another Toshiba flash
+also has the same problem. Maybe the driver has a bug, or some Toshiba
+nand flash is like this. Anyway, add a static NAND ID entry with only
+4 ID bytes as a hack to make sure it works.
+
+Tested on Arcadyan AW1000 flashed with OpenWrt.
+
+Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
+---
+ drivers/mtd/nand/raw/nand_ids.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/mtd/nand/raw/nand_ids.c
++++ b/drivers/mtd/nand/raw/nand_ids.c
+@@ -58,6 +58,9 @@ struct nand_flash_dev nand_flash_ids[] =
+ 		{ .id = {0xad, 0xde, 0x14, 0xa7, 0x42, 0x4a} },
+ 		  SZ_16K, SZ_8K, SZ_4M, NAND_NEED_SCRAMBLING, 6, 1664,
+ 		  NAND_ECC_INFO(40, SZ_1K) },
++	{"TH58NYG3S0HBAI4 8G 1.8V 8-bit", /* Last ID bytes missing */
++		{ .id = {0x98, 0xa3, 0x91, 0x26} },
++		  SZ_4K, SZ_1K, SZ_256K, 0, 4, 256, NAND_ECC_INFO(8, SZ_512) },
+ 	{"TH58NVG2S3HBAI4 4G 3.3V 8-bit",
+ 		{ .id = {0x98, 0xdc, 0x91, 0x15, 0x76} },
+ 		  SZ_2K, SZ_512, SZ_128K, 0, 5, 128, NAND_ECC_INFO(8, SZ_512) },
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0900-power-Add-Qualcomm-APM.patch b/6.12/target/linux/qualcommax/patches-6.12/0900-power-Add-Qualcomm-APM.patch
new file mode 100644
index 00000000..8ac12fbe
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0900-power-Add-Qualcomm-APM.patch
@@ -0,0 +1,1046 @@
+From 6c98adf98236b8644b8f5e1aa7af9f1a88ea2766 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Mon, 11 Apr 2022 14:38:08 +0200
+Subject: [PATCH] power: Add Qualcomm APM
+
+Add Qualcomm APM driver, which allows scaling cache and memory fabrics.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ drivers/power/Kconfig          |   1 +
+ drivers/power/Makefile         |   1 +
+ drivers/power/qcom/Kconfig     |   7 +
+ drivers/power/qcom/Makefile    |   1 +
+ drivers/power/qcom/apm.c       | 944 +++++++++++++++++++++++++++++++++
+ include/linux/power/qcom/apm.h |  48 ++
+ 6 files changed, 1002 insertions(+)
+ create mode 100644 drivers/power/qcom/Kconfig
+ create mode 100644 drivers/power/qcom/Makefile
+ create mode 100644 drivers/power/qcom/apm.c
+ create mode 100644 include/linux/power/qcom/apm.h
+
+--- a/drivers/power/Kconfig
++++ b/drivers/power/Kconfig
+@@ -2,3 +2,4 @@
+ source "drivers/power/reset/Kconfig"
+ source "drivers/power/sequencing/Kconfig"
+ source "drivers/power/supply/Kconfig"
++source "drivers/power/qcom/Kconfig"
+--- a/drivers/power/Makefile
++++ b/drivers/power/Makefile
+@@ -2,3 +2,4 @@
+ obj-$(CONFIG_POWER_RESET)	+= reset/
+ obj-$(CONFIG_POWER_SEQUENCING)	+= sequencing/
+ obj-$(CONFIG_POWER_SUPPLY)	+= supply/
++obj-$(CONFIG_QCOM_APM)		+= qcom/
+--- /dev/null
++++ b/drivers/power/qcom/Kconfig
+@@ -0,0 +1,7 @@
++config QCOM_APM
++       bool "Qualcomm Technologies Inc platform specific APM driver"
++       help
++	Platform specific driver to manage the power source of
++	memory arrays. Interfaces with regulator drivers to ensure
++	SRAM Vmin requirements are met across different performance
++	levels.
+--- /dev/null
++++ b/drivers/power/qcom/Makefile
+@@ -0,0 +1 @@
++obj-$(CONFIG_QCOM_APM)		+= apm.o
+--- /dev/null
++++ b/drivers/power/qcom/apm.c
+@@ -0,0 +1,943 @@
++/*
++ * Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#define pr_fmt(fmt) "%s: " fmt, __func__
++
++#include <linux/debugfs.h>
++#include <linux/delay.h>
++#include <linux/of_device.h>
++#include <linux/init.h>
++#include <linux/io.h>
++#include <linux/kernel.h>
++#include <linux/list.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/slab.h>
++#include <linux/string.h>
++#include <linux/power/qcom/apm.h>
++
++/*
++ *        VDD_APCC
++ * =============================================================
++ *       |      VDD_MX                  |                    |
++ *       |    ==========================|=============       |
++ *    ___|___   ___|___    ___|___   ___|___    ___|___   ___|___
++ *   |       | |       |  |       | |       |  |       | |       |
++ *   | APCC  | | MX HS |  | MX HS | | APCC  |  | MX HS | | APCC  |
++ *   |  HS   | |       |  |       | |  HS   |  |       | |  HS   |
++ *   |_______| |_______|  |_______| |_______|  |_______| |_______|
++ *       |_________|          |_________|         |__________|
++ *            |                    |                    |
++ *      ______|_____         ______|_____        _______|_____
++ *     |            |       |            |      |             |
++ *     |            |       |            |      |             |
++ *     |  CPU MEM   |       |   L2 MEM   |      |    L3 MEM   |
++ *     |   Arrays   |       |   Arrays   |      |    Arrays   |
++ *     |            |       |            |      |             |
++ *     |____________|       |____________|      |_____________|
++ *
++ */
++
++/* Register value definitions */
++#define APCS_GFMUXA_SEL_VAL            0x13
++#define APCS_GFMUXA_DESEL_VAL          0x03
++#define MSM_APM_MX_MODE_VAL            0x00
++#define MSM_APM_APCC_MODE_VAL          0x10
++#define MSM_APM_MX_DONE_VAL            0x00
++#define MSM_APM_APCC_DONE_VAL          0x03
++#define MSM_APM_OVERRIDE_SEL_VAL       0xb0
++#define MSM_APM_SEC_CLK_SEL_VAL        0x30
++#define SPM_EVENT_SET_VAL              0x01
++#define SPM_EVENT_CLEAR_VAL            0x00
++
++/* Register bit mask definitions */
++#define MSM_APM_CTL_STS_MASK            0x0f
++
++/* Register offset definitions */
++#define APCC_APM_MODE              0x00000098
++#define APCC_APM_CTL_STS           0x000000a8
++#define APCS_SPARE                 0x00000068
++#define APCS_VERSION               0x00000fd0
++
++#define HMSS_VERSION_1P2           0x10020000
++
++#define MSM_APM_SWITCH_TIMEOUT_US  10
++#define SPM_WAKEUP_DELAY_US        2
++#define SPM_EVENT_NUM              6
++
++#define MSM_APM_DRIVER_NAME        "qcom,msm-apm"
++
++enum {
++	MSM8996_ID,
++	MSM8953_ID,
++	IPQ807x_ID,
++};
++
++struct msm_apm_ctrl_dev {
++	struct list_head	list;
++	struct device		*dev;
++	enum msm_apm_supply	supply;
++	spinlock_t		lock;
++	void __iomem		*reg_base;
++	void __iomem		*apcs_csr_base;
++	void __iomem		**apcs_spm_events_addr;
++	void __iomem		*apc0_pll_ctl_addr;
++	void __iomem		*apc1_pll_ctl_addr;
++	u32			version;
++	struct dentry		*debugfs;
++	u32			msm_id;
++};
++
++#if defined(CONFIG_DEBUG_FS)
++static struct dentry *apm_debugfs_base;
++#endif
++
++static DEFINE_MUTEX(apm_ctrl_list_mutex);
++static LIST_HEAD(apm_ctrl_list);
++
++/*
++ * Get the resources associated with the APM controller from device tree
++ * and remap all I/O addresses that are relevant to this HW revision.
++ */
++static int msm_apm_ctrl_devm_ioremap(struct platform_device *pdev,
++				     struct msm_apm_ctrl_dev *ctrl)
++{
++	struct device *dev = &pdev->dev;
++	struct resource *res;
++	static const char *res_name[SPM_EVENT_NUM] = {
++		"apc0-l2-spm",
++		"apc1-l2-spm",
++		"apc0-cpu0-spm",
++		"apc0-cpu1-spm",
++		"apc1-cpu0-spm",
++		"apc1-cpu1-spm"
++	};
++	int i, ret = 0;
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "pm-apcc-glb");
++	if (!res) {
++		dev_err(dev, "Missing PM APCC Global register physical address");
++		return -EINVAL;
++	}
++	ctrl->reg_base = devm_ioremap(dev, res->start, resource_size(res));
++	if (!ctrl->reg_base) {
++		dev_err(dev, "Failed to map PM APCC Global registers\n");
++		return -ENOMEM;
++	}
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "apcs-csr");
++	if (!res) {
++		dev_err(dev, "Missing APCS CSR physical base address");
++		return -EINVAL;
++	}
++	ctrl->apcs_csr_base = devm_ioremap(dev, res->start, resource_size(res));
++	if (!ctrl->apcs_csr_base) {
++		dev_err(dev, "Failed to map APCS CSR registers\n");
++		return -ENOMEM;
++	}
++
++	ctrl->version = readl_relaxed(ctrl->apcs_csr_base + APCS_VERSION);
++
++	if (ctrl->version >= HMSS_VERSION_1P2)
++		return ret;
++
++	ctrl->apcs_spm_events_addr = devm_kzalloc(&pdev->dev,
++						  SPM_EVENT_NUM
++						  * sizeof(void __iomem *),
++						  GFP_KERNEL);
++	if (!ctrl->apcs_spm_events_addr) {
++		dev_err(dev, "Failed to allocate memory for APCS SPM event registers\n");
++		return -ENOMEM;
++	}
++
++	for (i = 0; i < SPM_EVENT_NUM; i++) {
++		res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
++						   res_name[i]);
++		if (!res) {
++			dev_err(dev, "Missing address for %s\n", res_name[i]);
++			ret = -EINVAL;
++			goto free_events;
++		}
++
++		ctrl->apcs_spm_events_addr[i] = devm_ioremap(dev, res->start,
++						resource_size(res));
++		if (!ctrl->apcs_spm_events_addr[i]) {
++			dev_err(dev, "Failed to map %s\n", res_name[i]);
++			ret = -ENOMEM;
++			goto free_events;
++		}
++
++		dev_dbg(dev, "%s event phys: %pa virt:0x%p\n", res_name[i],
++			&res->start, ctrl->apcs_spm_events_addr[i]);
++	}
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
++					   "apc0-pll-ctl");
++	if (!res) {
++		dev_err(dev, "Missing APC0 PLL CTL physical address\n");
++		ret = -EINVAL;
++		goto free_events;
++	}
++
++	ctrl->apc0_pll_ctl_addr = devm_ioremap(dev,
++					   res->start,
++					   resource_size(res));
++	if (!ctrl->apc0_pll_ctl_addr) {
++		dev_err(dev, "Failed to map APC0 PLL CTL register\n");
++		ret = -ENOMEM;
++		goto free_events;
++	}
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
++					   "apc1-pll-ctl");
++	if (!res) {
++		dev_err(dev, "Missing APC1 PLL CTL physical address\n");
++		ret = -EINVAL;
++		goto free_events;
++	}
++
++	ctrl->apc1_pll_ctl_addr = devm_ioremap(dev,
++					   res->start,
++					   resource_size(res));
++	if (!ctrl->apc1_pll_ctl_addr) {
++		dev_err(dev, "Failed to map APC1 PLL CTL register\n");
++		ret = -ENOMEM;
++		goto free_events;
++	}
++
++	return ret;
++
++free_events:
++	devm_kfree(dev, ctrl->apcs_spm_events_addr);
++	return ret;
++}
++
++/* 8953 register offset definition */
++#define MSM8953_APM_DLY_CNTR	0x2ac
++
++/* Register field shift definitions */
++#define APM_CTL_SEL_SWITCH_DLY_SHIFT	0
++#define APM_CTL_RESUME_CLK_DLY_SHIFT	8
++#define APM_CTL_HALT_CLK_DLY_SHIFT	16
++#define APM_CTL_POST_HALT_DLY_SHIFT	24
++
++/* Register field mask definitions */
++#define APM_CTL_SEL_SWITCH_DLY_MASK	GENMASK(7, 0)
++#define APM_CTL_RESUME_CLK_DLY_MASK	GENMASK(15, 8)
++#define APM_CTL_HALT_CLK_DLY_MASK	GENMASK(23, 16)
++#define APM_CTL_POST_HALT_DLY_MASK	GENMASK(31, 24)
++
++/*
++ * Get the resources associated with the msm8953 APM controller from
++ * device tree, remap all I/O addresses, and program the initial
++ * register configuration required for the 8953 APM controller device.
++ */
++static int msm8953_apm_ctrl_init(struct platform_device *pdev,
++				     struct msm_apm_ctrl_dev *ctrl)
++{
++	struct device *dev = &pdev->dev;
++	struct resource *res;
++	u32 delay_counter, val = 0, regval = 0;
++	int rc = 0;
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "pm-apcc-glb");
++	if (!res) {
++		dev_err(dev, "Missing PM APCC Global register physical address\n");
++		return -ENODEV;
++	}
++	ctrl->reg_base = devm_ioremap(dev, res->start, resource_size(res));
++	if (!ctrl->reg_base) {
++		dev_err(dev, "Failed to map PM APCC Global registers\n");
++		return -ENOMEM;
++	}
++
++	/*
++	 * Initial APM register configuration required before starting
++	 * APM HW controller.
++	 */
++	regval = readl_relaxed(ctrl->reg_base + MSM8953_APM_DLY_CNTR);
++	val = regval;
++
++	if (of_find_property(dev->of_node, "qcom,apm-post-halt-delay", NULL)) {
++		rc = of_property_read_u32(dev->of_node,
++				"qcom,apm-post-halt-delay", &delay_counter);
++		if (rc < 0) {
++			dev_err(dev, "apm-post-halt-delay read failed, rc = %d",
++				rc);
++			return rc;
++		}
++
++		val &= ~APM_CTL_POST_HALT_DLY_MASK;
++		val |= (delay_counter << APM_CTL_POST_HALT_DLY_SHIFT)
++			& APM_CTL_POST_HALT_DLY_MASK;
++	}
++
++	if (of_find_property(dev->of_node, "qcom,apm-halt-clk-delay", NULL)) {
++		rc = of_property_read_u32(dev->of_node,
++				"qcom,apm-halt-clk-delay", &delay_counter);
++		if (rc < 0) {
++			dev_err(dev, "apm-halt-clk-delay read failed, rc = %d",
++				rc);
++			return rc;
++		}
++
++		val &= ~APM_CTL_HALT_CLK_DLY_MASK;
++		val |= (delay_counter << APM_CTL_HALT_CLK_DLY_SHIFT)
++			& APM_CTL_HALT_CLK_DLY_MASK;
++	}
++
++	if (of_find_property(dev->of_node, "qcom,apm-resume-clk-delay", NULL)) {
++		rc = of_property_read_u32(dev->of_node,
++				"qcom,apm-resume-clk-delay", &delay_counter);
++		if (rc < 0) {
++			dev_err(dev, "apm-resume-clk-delay read failed, rc = %d",
++				rc);
++			return rc;
++		}
++
++		val &= ~APM_CTL_RESUME_CLK_DLY_MASK;
++		val |= (delay_counter << APM_CTL_RESUME_CLK_DLY_SHIFT)
++			& APM_CTL_RESUME_CLK_DLY_MASK;
++	}
++
++	if (of_find_property(dev->of_node, "qcom,apm-sel-switch-delay", NULL)) {
++		rc = of_property_read_u32(dev->of_node,
++				"qcom,apm-sel-switch-delay", &delay_counter);
++		if (rc < 0) {
++			dev_err(dev, "apm-sel-switch-delay read failed, rc = %d",
++				rc);
++			return rc;
++		}
++
++		val &= ~APM_CTL_SEL_SWITCH_DLY_MASK;
++		val |= (delay_counter << APM_CTL_SEL_SWITCH_DLY_SHIFT)
++			& APM_CTL_SEL_SWITCH_DLY_MASK;
++	}
++
++	if (val != regval) {
++		writel_relaxed(val, ctrl->reg_base + MSM8953_APM_DLY_CNTR);
++		/* make sure write completes before return */
++		mb();
++	}
++
++	return rc;
++}
++
++static int msm8996_apm_switch_to_mx(struct msm_apm_ctrl_dev *ctrl_dev)
++{
++	int i, timeout = MSM_APM_SWITCH_TIMEOUT_US;
++	u32 regval;
++	int ret = 0;
++	unsigned long flags;
++
++	spin_lock_irqsave(&ctrl_dev->lock, flags);
++
++	/* Perform revision-specific programming steps */
++	if (ctrl_dev->version < HMSS_VERSION_1P2) {
++		/* Clear SPM events */
++		for (i = 0; i < SPM_EVENT_NUM; i++)
++			writel_relaxed(SPM_EVENT_CLEAR_VAL,
++				       ctrl_dev->apcs_spm_events_addr[i]);
++
++		udelay(SPM_WAKEUP_DELAY_US);
++
++		/* Switch APC/CBF to GPLL0 clock */
++		writel_relaxed(APCS_GFMUXA_SEL_VAL,
++			       ctrl_dev->apcs_csr_base + APCS_SPARE);
++		ndelay(200);
++		writel_relaxed(MSM_APM_OVERRIDE_SEL_VAL,
++			       ctrl_dev->apc0_pll_ctl_addr);
++		ndelay(200);
++		writel_relaxed(MSM_APM_OVERRIDE_SEL_VAL,
++			       ctrl_dev->apc1_pll_ctl_addr);
++
++		/* Ensure writes complete before proceeding */
++		mb();
++	}
++
++	/* Switch arrays to MX supply and wait for its completion */
++	writel_relaxed(MSM_APM_MX_MODE_VAL, ctrl_dev->reg_base +
++		       APCC_APM_MODE);
++
++	/* Ensure write above completes before delaying */
++	mb();
++
++	while (timeout > 0) {
++		regval = readl_relaxed(ctrl_dev->reg_base + APCC_APM_CTL_STS);
++		if ((regval & MSM_APM_CTL_STS_MASK) ==
++		    MSM_APM_MX_DONE_VAL)
++			break;
++
++		udelay(1);
++		timeout--;
++	}
++
++	if (timeout == 0) {
++		ret = -ETIMEDOUT;
++		dev_err(ctrl_dev->dev, "APCC to MX APM switch timed out. APCC_APM_CTL_STS=0x%x\n",
++			regval);
++	}
++
++	/* Perform revision-specific programming steps */
++	if (ctrl_dev->version < HMSS_VERSION_1P2) {
++		/* Switch APC/CBF clocks to original source */
++		writel_relaxed(APCS_GFMUXA_DESEL_VAL,
++			       ctrl_dev->apcs_csr_base + APCS_SPARE);
++		ndelay(200);
++		writel_relaxed(MSM_APM_SEC_CLK_SEL_VAL,
++			       ctrl_dev->apc0_pll_ctl_addr);
++		ndelay(200);
++		writel_relaxed(MSM_APM_SEC_CLK_SEL_VAL,
++			       ctrl_dev->apc1_pll_ctl_addr);
++
++		/* Complete clock source switch before SPM event sequence */
++		mb();
++
++		/* Set SPM events */
++		for (i = 0; i < SPM_EVENT_NUM; i++)
++			writel_relaxed(SPM_EVENT_SET_VAL,
++				       ctrl_dev->apcs_spm_events_addr[i]);
++	}
++
++	if (!ret) {
++		ctrl_dev->supply = MSM_APM_SUPPLY_MX;
++		dev_dbg(ctrl_dev->dev, "APM supply switched to MX\n");
++	}
++
++	spin_unlock_irqrestore(&ctrl_dev->lock, flags);
++
++	return ret;
++}
++
++static int msm8996_apm_switch_to_apcc(struct msm_apm_ctrl_dev *ctrl_dev)
++{
++	int i, timeout = MSM_APM_SWITCH_TIMEOUT_US;
++	u32 regval;
++	int ret = 0;
++	unsigned long flags;
++
++	spin_lock_irqsave(&ctrl_dev->lock, flags);
++
++	/* Perform revision-specific programming steps */
++	if (ctrl_dev->version < HMSS_VERSION_1P2) {
++		/* Clear SPM events */
++		for (i = 0; i < SPM_EVENT_NUM; i++)
++			writel_relaxed(SPM_EVENT_CLEAR_VAL,
++				       ctrl_dev->apcs_spm_events_addr[i]);
++
++		udelay(SPM_WAKEUP_DELAY_US);
++
++		/* Switch APC/CBF to GPLL0 clock */
++		writel_relaxed(APCS_GFMUXA_SEL_VAL,
++			       ctrl_dev->apcs_csr_base + APCS_SPARE);
++		ndelay(200);
++		writel_relaxed(MSM_APM_OVERRIDE_SEL_VAL,
++			       ctrl_dev->apc0_pll_ctl_addr);
++		ndelay(200);
++		writel_relaxed(MSM_APM_OVERRIDE_SEL_VAL,
++			       ctrl_dev->apc1_pll_ctl_addr);
++
++		/* Ensure previous writes complete before proceeding */
++		mb();
++	}
++
++	/* Switch arrays to APCC supply and wait for its completion */
++	writel_relaxed(MSM_APM_APCC_MODE_VAL, ctrl_dev->reg_base +
++		       APCC_APM_MODE);
++
++	/* Ensure write above completes before delaying */
++	mb();
++
++	while (timeout > 0) {
++		regval = readl_relaxed(ctrl_dev->reg_base + APCC_APM_CTL_STS);
++		if ((regval & MSM_APM_CTL_STS_MASK) ==
++		    MSM_APM_APCC_DONE_VAL)
++			break;
++
++		udelay(1);
++		timeout--;
++	}
++
++	if (timeout == 0) {
++		ret = -ETIMEDOUT;
++		dev_err(ctrl_dev->dev, "MX to APCC APM switch timed out. APCC_APM_CTL_STS=0x%x\n",
++			regval);
++	}
++
++	/* Perform revision-specific programming steps */
++	if (ctrl_dev->version < HMSS_VERSION_1P2) {
++		/* Set SPM events */
++		for (i = 0; i < SPM_EVENT_NUM; i++)
++			writel_relaxed(SPM_EVENT_SET_VAL,
++				       ctrl_dev->apcs_spm_events_addr[i]);
++
++		/* Complete SPM event sequence before clock source switch */
++		mb();
++
++		/* Switch APC/CBF clocks to original source */
++		writel_relaxed(APCS_GFMUXA_DESEL_VAL,
++			       ctrl_dev->apcs_csr_base + APCS_SPARE);
++		ndelay(200);
++		writel_relaxed(MSM_APM_SEC_CLK_SEL_VAL,
++			       ctrl_dev->apc0_pll_ctl_addr);
++		ndelay(200);
++		writel_relaxed(MSM_APM_SEC_CLK_SEL_VAL,
++			       ctrl_dev->apc1_pll_ctl_addr);
++	}
++
++	if (!ret) {
++		ctrl_dev->supply = MSM_APM_SUPPLY_APCC;
++		dev_dbg(ctrl_dev->dev, "APM supply switched to APCC\n");
++	}
++
++	spin_unlock_irqrestore(&ctrl_dev->lock, flags);
++
++	return ret;
++}
++
++/* 8953 register value definitions */
++#define MSM8953_APM_MX_MODE_VAL            0x00
++#define MSM8953_APM_APCC_MODE_VAL          0x02
++#define MSM8953_APM_MX_DONE_VAL            0x00
++#define MSM8953_APM_APCC_DONE_VAL          0x03
++
++/* 8953 register offset definitions */
++#define MSM8953_APCC_APM_MODE              0x000002a8
++#define MSM8953_APCC_APM_CTL_STS           0x000002b0
++
++/* 8953 constants */
++#define MSM8953_APM_SWITCH_TIMEOUT_US      500
++
++/* Register bit mask definitions */
++#define MSM8953_APM_CTL_STS_MASK           0x1f
++
++static int msm8953_apm_switch_to_mx(struct msm_apm_ctrl_dev *ctrl_dev)
++{
++	int timeout = MSM8953_APM_SWITCH_TIMEOUT_US;
++	u32 regval;
++	int ret = 0;
++	unsigned long flags;
++
++	spin_lock_irqsave(&ctrl_dev->lock, flags);
++
++	/* Switch arrays to MX supply and wait for its completion */
++	writel_relaxed(MSM8953_APM_MX_MODE_VAL, ctrl_dev->reg_base +
++		       MSM8953_APCC_APM_MODE);
++
++	/* Ensure write above completes before delaying */
++	mb();
++
++	while (timeout > 0) {
++		regval = readl_relaxed(ctrl_dev->reg_base +
++					MSM8953_APCC_APM_CTL_STS);
++		if ((regval & MSM8953_APM_CTL_STS_MASK) ==
++				MSM8953_APM_MX_DONE_VAL)
++			break;
++
++		udelay(1);
++		timeout--;
++	}
++
++	if (timeout == 0) {
++		ret = -ETIMEDOUT;
++		dev_err(ctrl_dev->dev, "APCC to MX APM switch timed out. APCC_APM_CTL_STS=0x%x\n",
++			regval);
++	} else {
++		ctrl_dev->supply = MSM_APM_SUPPLY_MX;
++		dev_dbg(ctrl_dev->dev, "APM supply switched to MX\n");
++	}
++
++	spin_unlock_irqrestore(&ctrl_dev->lock, flags);
++
++	return ret;
++}
++
++static int msm8953_apm_switch_to_apcc(struct msm_apm_ctrl_dev *ctrl_dev)
++{
++	int timeout = MSM8953_APM_SWITCH_TIMEOUT_US;
++	u32 regval;
++	int ret = 0;
++	unsigned long flags;
++
++	spin_lock_irqsave(&ctrl_dev->lock, flags);
++
++	/* Switch arrays to APCC supply and wait for its completion */
++	writel_relaxed(MSM8953_APM_APCC_MODE_VAL, ctrl_dev->reg_base +
++		       MSM8953_APCC_APM_MODE);
++
++	/* Ensure write above completes before delaying */
++	mb();
++
++	while (timeout > 0) {
++		regval = readl_relaxed(ctrl_dev->reg_base +
++					MSM8953_APCC_APM_CTL_STS);
++		if ((regval & MSM8953_APM_CTL_STS_MASK) ==
++				MSM8953_APM_APCC_DONE_VAL)
++			break;
++
++		udelay(1);
++		timeout--;
++	}
++
++	if (timeout == 0) {
++		ret = -ETIMEDOUT;
++		dev_err(ctrl_dev->dev, "MX to APCC APM switch timed out. APCC_APM_CTL_STS=0x%x\n",
++			regval);
++	} else {
++		ctrl_dev->supply = MSM_APM_SUPPLY_APCC;
++		dev_dbg(ctrl_dev->dev, "APM supply switched to APCC\n");
++	}
++
++	spin_unlock_irqrestore(&ctrl_dev->lock, flags);
++
++	return ret;
++}
++
++static int msm_apm_switch_to_mx(struct msm_apm_ctrl_dev *ctrl_dev)
++{
++	int ret = 0;
++
++	switch (ctrl_dev->msm_id) {
++	case MSM8996_ID:
++		ret = msm8996_apm_switch_to_mx(ctrl_dev);
++		break;
++	case MSM8953_ID:
++	case IPQ807x_ID:
++		ret = msm8953_apm_switch_to_mx(ctrl_dev);
++		break;
++	}
++
++	return ret;
++}
++
++static int msm_apm_switch_to_apcc(struct msm_apm_ctrl_dev *ctrl_dev)
++{
++	int ret = 0;
++
++	switch (ctrl_dev->msm_id) {
++	case MSM8996_ID:
++		ret = msm8996_apm_switch_to_apcc(ctrl_dev);
++		break;
++	case MSM8953_ID:
++	case IPQ807x_ID:
++		ret = msm8953_apm_switch_to_apcc(ctrl_dev);
++		break;
++	}
++
++	return ret;
++}
++
++/**
++ * msm_apm_get_supply() - Returns the supply that is currently
++ *			powering the memory arrays
++ * @ctrl_dev:                   Pointer to an MSM APM controller device
++ *
++ * Returns the supply currently selected by the APM.
++ */
++int msm_apm_get_supply(struct msm_apm_ctrl_dev *ctrl_dev)
++{
++	return ctrl_dev->supply;
++}
++EXPORT_SYMBOL(msm_apm_get_supply);
++
++/**
++ * msm_apm_set_supply() - Perform the necessary steps to switch the voltage
++ *                        source of the memory arrays to a given supply
++ * @ctrl_dev:                   Pointer to an MSM APM controller device
++ * @supply:                     Power rail to use as supply for the memory
++ *                              arrays
++ *
++ * Returns 0 on success, -ETIMEDOUT on APM switch timeout, or -EPERM if
++ * the supply is not supported.
++ */
++int msm_apm_set_supply(struct msm_apm_ctrl_dev *ctrl_dev,
++		       enum msm_apm_supply supply)
++{
++	int ret;
++
++	switch (supply) {
++	case MSM_APM_SUPPLY_APCC:
++		ret = msm_apm_switch_to_apcc(ctrl_dev);
++		break;
++	case MSM_APM_SUPPLY_MX:
++		ret = msm_apm_switch_to_mx(ctrl_dev);
++		break;
++	default:
++		ret = -EPERM;
++		break;
++	}
++
++	return ret;
++}
++EXPORT_SYMBOL(msm_apm_set_supply);
++
++/**
++ * msm_apm_ctrl_dev_get() - get a handle to the MSM APM controller linked to
++ *                          the device in device tree
++ * @dev:                    Pointer to the device
++ *
++ * The device must specify "qcom,apm-ctrl" property in its device tree
++ * node which points to an MSM APM controller device node.
++ *
++ * Returns an MSM APM controller handle if successful or ERR_PTR on any error.
++ * If the APM controller device hasn't probed yet, ERR_PTR(-EPROBE_DEFER) is
++ * returned.
++ */
++struct msm_apm_ctrl_dev *msm_apm_ctrl_dev_get(struct device *dev)
++{
++	struct msm_apm_ctrl_dev *ctrl_dev = NULL;
++	struct msm_apm_ctrl_dev *dev_found = ERR_PTR(-EPROBE_DEFER);
++	struct device_node *ctrl_node;
++
++	if (!dev || !dev->of_node) {
++		pr_err("Invalid device node\n");
++		return ERR_PTR(-EINVAL);
++	}
++
++	ctrl_node = of_parse_phandle(dev->of_node, "qcom,apm-ctrl", 0);
++	if (!ctrl_node) {
++		pr_err("Could not find qcom,apm-ctrl property in %s\n",
++		       dev->of_node->full_name);
++		return ERR_PTR(-ENXIO);
++	}
++
++	mutex_lock(&apm_ctrl_list_mutex);
++	list_for_each_entry(ctrl_dev, &apm_ctrl_list, list) {
++		if (ctrl_dev->dev && ctrl_dev->dev->of_node == ctrl_node) {
++			dev_found = ctrl_dev;
++			break;
++		}
++	}
++	mutex_unlock(&apm_ctrl_list_mutex);
++
++	of_node_put(ctrl_node);
++	return dev_found;
++}
++EXPORT_SYMBOL(msm_apm_ctrl_dev_get);
++
++#if defined(CONFIG_DEBUG_FS)
++
++static int apm_supply_dbg_open(struct inode *inode, struct file *filep)
++{
++	filep->private_data = inode->i_private;
++
++	return 0;
++}
++
++static ssize_t apm_supply_dbg_read(struct file *filep, char __user *ubuf,
++				   size_t count, loff_t *ppos)
++{
++	struct msm_apm_ctrl_dev *ctrl_dev = filep->private_data;
++	char buf[10];
++	int len;
++
++	if (!ctrl_dev) {
++		pr_err("invalid apm ctrl handle\n");
++		return -ENODEV;
++	}
++
++	if (ctrl_dev->supply == MSM_APM_SUPPLY_APCC)
++		len = snprintf(buf, sizeof(buf), "APCC\n");
++	else if (ctrl_dev->supply == MSM_APM_SUPPLY_MX)
++		len = snprintf(buf, sizeof(buf), "MX\n");
++	else
++		len = snprintf(buf, sizeof(buf), "ERR\n");
++
++	return simple_read_from_buffer(ubuf, count, ppos, buf, len);
++}
++
++static const struct file_operations apm_supply_fops = {
++	.open = apm_supply_dbg_open,
++	.read = apm_supply_dbg_read,
++};
++
++static void apm_debugfs_base_init(void)
++{
++	apm_debugfs_base = debugfs_create_dir("msm-apm", NULL);
++
++	if (IS_ERR_OR_NULL(apm_debugfs_base))
++		pr_err("msm-apm debugfs base directory creation failed\n");
++}
++
++static void apm_debugfs_init(struct msm_apm_ctrl_dev *ctrl_dev)
++{
++	struct dentry *temp;
++
++	if (IS_ERR_OR_NULL(apm_debugfs_base)) {
++		pr_err("Base directory missing, cannot create apm debugfs nodes\n");
++		return;
++	}
++
++	ctrl_dev->debugfs = debugfs_create_dir(dev_name(ctrl_dev->dev),
++					       apm_debugfs_base);
++	if (IS_ERR_OR_NULL(ctrl_dev->debugfs)) {
++		pr_err("%s debugfs directory creation failed\n",
++		       dev_name(ctrl_dev->dev));
++		return;
++	}
++
++	temp = debugfs_create_file("supply", S_IRUGO, ctrl_dev->debugfs,
++				   ctrl_dev, &apm_supply_fops);
++	if (IS_ERR_OR_NULL(temp)) {
++		pr_err("supply mode creation failed\n");
++		return;
++	}
++}
++
++static void apm_debugfs_deinit(struct msm_apm_ctrl_dev *ctrl_dev)
++{
++	if (!IS_ERR_OR_NULL(ctrl_dev->debugfs))
++		debugfs_remove_recursive(ctrl_dev->debugfs);
++}
++
++static void apm_debugfs_base_remove(void)
++{
++	debugfs_remove_recursive(apm_debugfs_base);
++}
++#else
++
++static void apm_debugfs_base_init(void)
++{}
++
++static void apm_debugfs_init(struct msm_apm_ctrl_dev *ctrl_dev)
++{}
++
++static void apm_debugfs_deinit(struct msm_apm_ctrl_dev *ctrl_dev)
++{}
++
++static void apm_debugfs_base_remove(void)
++{}
++
++#endif
++
++static struct of_device_id msm_apm_match_table[] = {
++	{
++		.compatible = "qcom,msm-apm",
++		.data = (void *)(uintptr_t)MSM8996_ID,
++	},
++	{
++		.compatible = "qcom,msm8953-apm",
++		.data = (void *)(uintptr_t)MSM8953_ID,
++	},
++	{
++		.compatible = "qcom,ipq807x-apm",
++		.data = (void *)(uintptr_t)IPQ807x_ID,
++	},
++	{}
++};
++
++static int msm_apm_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct msm_apm_ctrl_dev *ctrl;
++	const struct of_device_id *match;
++	int ret = 0;
++
++	dev_dbg(dev, "probing MSM Array Power Mux driver\n");
++
++	if (!dev->of_node) {
++		dev_err(dev, "Device tree node is missing\n");
++		return -ENODEV;
++	}
++
++	match = of_match_device(msm_apm_match_table, dev);
++	if (!match)
++		return -ENODEV;
++
++	ctrl = devm_kzalloc(dev, sizeof(*ctrl), GFP_KERNEL);
++	if (!ctrl) {
++		dev_err(dev, "MSM APM controller memory allocation failed\n");
++		return -ENOMEM;
++	}
++
++	INIT_LIST_HEAD(&ctrl->list);
++	spin_lock_init(&ctrl->lock);
++	ctrl->dev = dev;
++	ctrl->msm_id = (uintptr_t)match->data;
++	platform_set_drvdata(pdev, ctrl);
++
++	switch (ctrl->msm_id) {
++	case MSM8996_ID:
++		ret = msm_apm_ctrl_devm_ioremap(pdev, ctrl);
++		if (ret) {
++			dev_err(dev, "Failed to add APM controller device\n");
++			return ret;
++		}
++		break;
++	case MSM8953_ID:
++	case IPQ807x_ID:
++		ret = msm8953_apm_ctrl_init(pdev, ctrl);
++		if (ret) {
++			dev_err(dev, "Failed to initialize APM controller device: ret=%d\n",
++				ret);
++			return ret;
++		}
++		break;
++	default:
++		dev_err(dev, "unable to add APM controller device for msm_id:%d\n",
++			ctrl->msm_id);
++		return -ENODEV;
++	}
++
++	apm_debugfs_init(ctrl);
++	mutex_lock(&apm_ctrl_list_mutex);
++	list_add_tail(&ctrl->list, &apm_ctrl_list);
++	mutex_unlock(&apm_ctrl_list_mutex);
++
++	dev_dbg(dev, "MSM Array Power Mux driver probe successful");
++
++	return ret;
++}
++
++static void msm_apm_remove(struct platform_device *pdev)
++{
++	struct msm_apm_ctrl_dev *ctrl_dev;
++
++	ctrl_dev = platform_get_drvdata(pdev);
++	if (ctrl_dev) {
++		mutex_lock(&apm_ctrl_list_mutex);
++		list_del(&ctrl_dev->list);
++		mutex_unlock(&apm_ctrl_list_mutex);
++		apm_debugfs_deinit(ctrl_dev);
++	}
++
++
++}
++
++static struct platform_driver msm_apm_driver = {
++	.driver		= {
++		.name		= MSM_APM_DRIVER_NAME,
++		.of_match_table	= msm_apm_match_table,
++	},
++	.probe		= msm_apm_probe,
++	.remove_new	= msm_apm_remove,
++};
++
++static int __init msm_apm_init(void)
++{
++	apm_debugfs_base_init();
++	return platform_driver_register(&msm_apm_driver);
++}
++
++static void __exit msm_apm_exit(void)
++{
++	platform_driver_unregister(&msm_apm_driver);
++	apm_debugfs_base_remove();
++}
++
++arch_initcall(msm_apm_init);
++module_exit(msm_apm_exit);
++
++MODULE_DESCRIPTION("MSM Array Power Mux driver");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/include/linux/power/qcom/apm.h
+@@ -0,0 +1,48 @@
++/*
++ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#ifndef __LINUX_POWER_QCOM_APM_H__
++#define __LINUX_POWER_QCOM_APM_H__
++
++#include <linux/device.h>
++#include <linux/err.h>
++
++/**
++ * enum msm_apm_supply - supported power rails to supply memory arrays
++ * %MSM_APM_SUPPLY_APCC:	to enable selection of VDD_APCC rail as supply
++ * %MSM_APM_SUPPLY_MX:		to enable selection of VDD_MX rail as supply
++ */
++enum msm_apm_supply {
++	MSM_APM_SUPPLY_APCC,
++	MSM_APM_SUPPLY_MX,
++};
++
++/* Handle used to identify an APM controller device  */
++struct msm_apm_ctrl_dev;
++
++#ifdef CONFIG_QCOM_APM
++struct msm_apm_ctrl_dev *msm_apm_ctrl_dev_get(struct device *dev);
++int msm_apm_set_supply(struct msm_apm_ctrl_dev *ctrl_dev,
++		       enum msm_apm_supply supply);
++int msm_apm_get_supply(struct msm_apm_ctrl_dev *ctrl_dev);
++
++#else
++static inline struct msm_apm_ctrl_dev *msm_apm_ctrl_dev_get(struct device *dev)
++{ return ERR_PTR(-EPERM); }
++static inline int msm_apm_set_supply(struct msm_apm_ctrl_dev *ctrl_dev,
++		       enum msm_apm_supply supply)
++{ return -EPERM; }
++static inline int msm_apm_get_supply(struct msm_apm_ctrl_dev *ctrl_dev)
++{ return -EPERM; }
++#endif
++#endif
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0901-regulator-add-Qualcomm-CPR-regulators.patch b/6.12/target/linux/qualcommax/patches-6.12/0901-regulator-add-Qualcomm-CPR-regulators.patch
new file mode 100644
index 00000000..c56ea324
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0901-regulator-add-Qualcomm-CPR-regulators.patch
@@ -0,0 +1,11686 @@
+From c9df32c057e43e38c8113199e64f7a64f8d341df Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Mon, 11 Apr 2022 14:35:36 +0200
+Subject: [PATCH] regulator: add Qualcomm CPR regulators
+
+Allow building Qualcomm CPR regulators.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ drivers/regulator/Kconfig               |   33 +
+ drivers/regulator/Makefile              |    3 +
+ drivers/regulator/cpr3-npu-regulator.c  |  695 +++
+ drivers/regulator/cpr3-regulator.c      | 5111 +++++++++++++++++++++++
+ drivers/regulator/cpr3-regulator.h      | 1211 ++++++
+ drivers/regulator/cpr3-util.c           | 2750 ++++++++++++
+ drivers/regulator/cpr4-apss-regulator.c | 1819 ++++++++
+ include/soc/qcom/socinfo.h              |  463 ++
+ 8 files changed, 12085 insertions(+)
+ create mode 100644 drivers/regulator/cpr3-npu-regulator.c
+ create mode 100644 drivers/regulator/cpr3-regulator.c
+ create mode 100644 drivers/regulator/cpr3-regulator.h
+ create mode 100644 drivers/regulator/cpr3-util.c
+ create mode 100644 drivers/regulator/cpr4-apss-regulator.c
+ create mode 100644 include/soc/qcom/socinfo.h
+
+--- a/drivers/regulator/Kconfig
++++ b/drivers/regulator/Kconfig
+@@ -1720,4 +1720,37 @@ config REGULATOR_QCOM_LABIBB
+ 	  boost regulator and IBB can be used as a negative boost regulator
+ 	  for LCD display panel.
+ 
++config REGULATOR_CPR3
++	bool "QCOM CPR3 regulator core support"
++	help
++	  This driver supports Core Power Reduction (CPR) version 3 controllers
++	  which are used by some Qualcomm Technologies, Inc. SoCs to
++	  manage important voltage regulators.  CPR3 controllers are capable of
++	  monitoring several ring oscillator sensing loops simultaneously.  The
++	  CPR3 controller informs software when the silicon conditions require
++	  the supply voltage to be increased or decreased.  On certain supply
++	  rails, the CPR3 controller is able to propagate the voltage increase
++	  or decrease requests all the way to the PMIC without software
++	  involvement.
++
++config REGULATOR_CPR3_NPU
++	bool "QCOM CPR3 regulator for NPU"
++	depends on OF && REGULATOR_CPR3
++	help
++	  This driver supports Qualcomm Technologies, Inc. NPU CPR3
++	  regulator Which will always operate in open loop.
++
++config REGULATOR_CPR4_APSS
++	bool "QCOM CPR4 regulator for APSS"
++	depends on OF && REGULATOR_CPR3
++	help
++	  This driver supports Qualcomm Technologies, Inc. APSS application
++	  processor specific features including memory array power mux (APM)
++	  switching, one CPR4 thread which monitor the two APSS clusters that
++	  are both powered by a shared supply, hardware closed-loop auto
++	  voltage stepping, voltage adjustments based on online core count,
++	  voltage adjustments based on temperature readings, and voltage
++	  adjustments for performance boost mode. This driver reads both initial
++	  voltage and CPR target quotient values out of hardware fuses.
++
+ endif
+--- a/drivers/regulator/Makefile
++++ b/drivers/regulator/Makefile
+@@ -121,6 +121,9 @@ obj-$(CONFIG_REGULATOR_QCOM_RPMH) += qco
+ obj-$(CONFIG_REGULATOR_QCOM_SMD_RPM) += qcom_smd-regulator.o
+ obj-$(CONFIG_REGULATOR_QCOM_SPMI) += qcom_spmi-regulator.o
+ obj-$(CONFIG_REGULATOR_QCOM_USB_VBUS) += qcom_usb_vbus-regulator.o
++obj-$(CONFIG_REGULATOR_CPR3) += cpr3-regulator.o cpr3-util.o
++obj-$(CONFIG_REGULATOR_CPR3_NPU) += cpr3-npu-regulator.o
++obj-$(CONFIG_REGULATOR_CPR4_APSS) += cpr4-apss-regulator.o
+ obj-$(CONFIG_REGULATOR_PALMAS) += palmas-regulator.o
+ obj-$(CONFIG_REGULATOR_PCA9450) += pca9450-regulator.o
+ obj-$(CONFIG_REGULATOR_PF8X00) += pf8x00-regulator.o
+--- /dev/null
++++ b/drivers/regulator/cpr3-npu-regulator.c
+@@ -0,0 +1,694 @@
++/*
++ * Copyright (c) 2017, The Linux Foundation. All rights reserved.
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
++ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#include <linux/err.h>
++#include <linux/platform_device.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/of_device.h>
++#include <linux/slab.h>
++#include <linux/thermal.h>
++
++#include "cpr3-regulator.h"
++
++#define IPQ807x_NPU_FUSE_CORNERS		2
++#define IPQ817x_NPU_FUSE_CORNERS		1
++#define IPQ807x_NPU_FUSE_STEP_VOLT		8000
++#define IPQ807x_NPU_VOLTAGE_FUSE_SIZE		6
++#define IPQ807x_NPU_CPR_CLOCK_RATE		19200000
++
++#define IPQ807x_NPU_CPR_TCSR_START		6
++#define IPQ807x_NPU_CPR_TCSR_END		7
++
++#define NPU_TSENS				5
++
++u32 g_valid_npu_fuse_count = IPQ807x_NPU_FUSE_CORNERS;
++/**
++ * struct cpr3_ipq807x_npu_fuses - NPU specific fuse data for IPQ807x
++ * @init_voltage:	Initial (i.e. open-loop) voltage fuse parameter value
++ *			for each fuse corner (raw, not converted to a voltage)
++ * This struct holds the values for all of the fuses read from memory.
++ */
++struct cpr3_ipq807x_npu_fuses {
++	u64	init_voltage[IPQ807x_NPU_FUSE_CORNERS];
++};
++
++/*
++ * Constants which define the name of each fuse corner.
++ */
++enum cpr3_ipq807x_npu_fuse_corner {
++	CPR3_IPQ807x_NPU_FUSE_CORNER_NOM	= 0,
++	CPR3_IPQ807x_NPU_FUSE_CORNER_TURBO	= 1,
++};
++
++static const char * const cpr3_ipq807x_npu_fuse_corner_name[] = {
++	[CPR3_IPQ807x_NPU_FUSE_CORNER_NOM]	= "NOM",
++	[CPR3_IPQ807x_NPU_FUSE_CORNER_TURBO]	= "TURBO",
++};
++
++/*
++ * IPQ807x NPU fuse parameter locations:
++ *
++ * Structs are organized with the following dimensions:
++ *	Outer: 0 to 1 for fuse corners from lowest to highest corner
++ *	Inner: large enough to hold the longest set of parameter segments which
++ *		fully defines a fuse parameter, +1 (for NULL termination).
++ *		Each segment corresponds to a contiguous group of bits from a
++ *		single fuse row.  These segments are concatentated together in
++ *		order to form the full fuse parameter value.  The segments for
++ *		a given parameter may correspond to different fuse rows.
++ */
++static struct cpr3_fuse_param
++ipq807x_npu_init_voltage_param[IPQ807x_NPU_FUSE_CORNERS][2] = {
++	{{73, 22, 27}, {} },
++	{{73, 16, 21}, {} },
++};
++
++/*
++ * Open loop voltage fuse reference voltages in microvolts for IPQ807x
++ */
++static int
++ipq807x_npu_fuse_ref_volt [IPQ807x_NPU_FUSE_CORNERS] = {
++	912000,
++	992000,
++};
++
++/*
++ * IPQ9574 (Few parameters are changed, remaining are same as IPQ807x)
++ */
++#define IPQ9574_NPU_FUSE_CORNERS		2
++#define IPQ9574_NPU_FUSE_STEP_VOLT		10000
++#define IPQ9574_NPU_CPR_CLOCK_RATE		24000000
++
++/*
++ * fues parameters for IPQ9574
++ */
++static struct cpr3_fuse_param
++ipq9574_npu_init_voltage_param[IPQ9574_NPU_FUSE_CORNERS][2] = {
++	{{105, 12, 17}, {} },
++	{{105,  6, 11}, {} },
++};
++
++/*
++ * Open loop voltage fuse reference voltages in microvolts for IPQ9574
++ */
++static int
++ipq9574_npu_fuse_ref_volt [IPQ9574_NPU_FUSE_CORNERS] = {
++	862500,
++	987500,
++};
++
++struct cpr3_controller *g_ctrl;
++
++void cpr3_npu_temp_notify(int sensor, int temp, int low_notif)
++{
++	u32 prev_sensor_state;
++
++	if (sensor != NPU_TSENS)
++		return;
++
++	prev_sensor_state = g_ctrl->cur_sensor_state;
++	if (low_notif)
++		g_ctrl->cur_sensor_state |= BIT(sensor);
++	else
++		g_ctrl->cur_sensor_state &= ~BIT(sensor);
++
++	if (!prev_sensor_state && g_ctrl->cur_sensor_state)
++		cpr3_handle_temp_open_loop_adjustment(g_ctrl, true);
++	else if (prev_sensor_state && !g_ctrl->cur_sensor_state)
++		cpr3_handle_temp_open_loop_adjustment(g_ctrl, false);
++}
++
++/**
++ * cpr3_ipq807x_npu_read_fuse_data() - load NPU specific fuse parameter values
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * This function allocates a cpr3_ipq807x_npu_fuses struct, fills it with
++ * values read out of hardware fuses, and finally copies common fuse values
++ * into the CPR3 regulator struct.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_ipq807x_npu_read_fuse_data(struct cpr3_regulator *vreg)
++{
++	void __iomem *base = vreg->thread->ctrl->fuse_base;
++	struct cpr3_ipq807x_npu_fuses *fuse;
++	int i, rc;
++
++	fuse = devm_kzalloc(vreg->thread->ctrl->dev, sizeof(*fuse), GFP_KERNEL);
++	if (!fuse)
++		return -ENOMEM;
++
++	for (i = 0; i < g_valid_npu_fuse_count; i++) {
++		rc = cpr3_read_fuse_param(base,
++					  vreg->cpr3_regulator_data->init_voltage_param[i],
++					  &fuse->init_voltage[i]);
++		if (rc) {
++			cpr3_err(vreg, "Unable to read fuse-corner %d initial voltage fuse, rc=%d\n",
++				 i, rc);
++			return rc;
++		}
++	}
++
++	vreg->fuse_corner_count	= g_valid_npu_fuse_count;
++	vreg->platform_fuses	= fuse;
++
++	return 0;
++}
++
++/**
++ * cpr3_npu_parse_corner_data() - parse NPU corner data from device tree
++ *		properties of the CPR3 regulator's device node
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_npu_parse_corner_data(struct cpr3_regulator *vreg)
++{
++	int rc;
++
++	rc = cpr3_parse_common_corner_data(vreg);
++	if (rc) {
++		cpr3_err(vreg, "error reading corner data, rc=%d\n", rc);
++		return rc;
++	}
++
++	return rc;
++}
++
++/**
++ * cpr3_ipq807x_npu_calculate_open_loop_voltages() - calculate the open-loop
++ *		voltage for each corner of a CPR3 regulator
++ * @vreg:		Pointer to the CPR3 regulator
++ * @temp_correction:    Temperature based correction
++ *
++ * If open-loop voltage interpolation is allowed in device tree, then
++ * this function calculates the open-loop voltage for a given corner using
++ * linear interpolation.  This interpolation is performed using the processor
++ * frequencies of the lower and higher Fmax corners along with their fused
++ * open-loop voltages.
++ *
++ * If open-loop voltage interpolation is not allowed, then this function uses
++ * the Fmax fused open-loop voltage for all of the corners associated with a
++ * given fuse corner.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_ipq807x_npu_calculate_open_loop_voltages(
++			struct cpr3_regulator *vreg, bool temp_correction)
++{
++	struct cpr3_ipq807x_npu_fuses *fuse = vreg->platform_fuses;
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	int i, j, rc = 0;
++	u64 freq_low, volt_low, freq_high, volt_high;
++	int *fuse_volt;
++	int *fmax_corner;
++
++	fuse_volt = kcalloc(vreg->fuse_corner_count, sizeof(*fuse_volt),
++			    GFP_KERNEL);
++	fmax_corner = kcalloc(vreg->fuse_corner_count, sizeof(*fmax_corner),
++			      GFP_KERNEL);
++	if (!fuse_volt || !fmax_corner) {
++		rc = -ENOMEM;
++		goto done;
++	}
++
++	for (i = 0; i < vreg->fuse_corner_count; i++) {
++		if (ctrl->cpr_global_setting == CPR_DISABLED)
++			fuse_volt[i] = vreg->cpr3_regulator_data->fuse_ref_volt[i];
++		else
++			fuse_volt[i] = cpr3_convert_open_loop_voltage_fuse(
++				vreg->cpr3_regulator_data->fuse_ref_volt[i],
++				vreg->cpr3_regulator_data->fuse_step_volt,
++				fuse->init_voltage[i],
++				IPQ807x_NPU_VOLTAGE_FUSE_SIZE);
++
++		/* Log fused open-loop voltage values for debugging purposes. */
++		cpr3_info(vreg, "fused %8s: open-loop=%7d uV\n",
++			  cpr3_ipq807x_npu_fuse_corner_name[i],
++			  fuse_volt[i]);
++	}
++
++	rc = cpr3_determine_part_type(vreg,
++			fuse_volt[CPR3_IPQ807x_NPU_FUSE_CORNER_TURBO]);
++	if (rc) {
++		cpr3_err(vreg,
++			"fused part type detection failed failed, rc=%d\n", rc);
++		goto done;
++	}
++
++	rc = cpr3_adjust_fused_open_loop_voltages(vreg, fuse_volt);
++	if (rc) {
++		cpr3_err(vreg,
++			"fused open-loop voltage adjustment failed, rc=%d\n",
++			rc);
++		goto done;
++	}
++	if (temp_correction) {
++		rc = cpr3_determine_temp_base_open_loop_correction(vreg,
++								fuse_volt);
++		if (rc) {
++			cpr3_err(vreg,
++				"temp open-loop voltage adj. failed, rc=%d\n",
++				rc);
++			goto done;
++		}
++	}
++
++	for (i = 1; i < vreg->fuse_corner_count; i++) {
++		if (fuse_volt[i] < fuse_volt[i - 1]) {
++			cpr3_info(vreg,
++				"fuse corner %d voltage=%d uV < fuse corner %d \
++				voltage=%d uV; overriding: fuse corner %d \
++				voltage=%d\n",
++				  i, fuse_volt[i], i - 1, fuse_volt[i - 1],
++				  i, fuse_volt[i - 1]);
++			fuse_volt[i] = fuse_volt[i - 1];
++		}
++	}
++
++	/* Determine highest corner mapped to each fuse corner */
++	j = vreg->fuse_corner_count - 1;
++	for (i = vreg->corner_count - 1; i >= 0; i--) {
++		if (vreg->corner[i].cpr_fuse_corner == j) {
++			fmax_corner[j] = i;
++			j--;
++		}
++	}
++
++	if (j >= 0) {
++		cpr3_err(vreg, "invalid fuse corner mapping\n");
++		rc = -EINVAL;
++		goto done;
++	}
++
++	/*
++	 * Interpolation is not possible for corners mapped to the lowest fuse
++	 * corner so use the fuse corner value directly.
++	 */
++	for (i = 0; i <= fmax_corner[0]; i++)
++		vreg->corner[i].open_loop_volt = fuse_volt[0];
++
++	/* Interpolate voltages for the higher fuse corners. */
++	for (i = 1; i < vreg->fuse_corner_count; i++) {
++		freq_low = vreg->corner[fmax_corner[i - 1]].proc_freq;
++		volt_low = fuse_volt[i - 1];
++		freq_high = vreg->corner[fmax_corner[i]].proc_freq;
++		volt_high = fuse_volt[i];
++
++		for (j = fmax_corner[i - 1] + 1; j <= fmax_corner[i]; j++)
++			vreg->corner[j].open_loop_volt = cpr3_interpolate(
++				freq_low, volt_low, freq_high, volt_high,
++				vreg->corner[j].proc_freq);
++	}
++
++done:
++	if (rc == 0) {
++		cpr3_debug(vreg, "unadjusted per-corner open-loop voltages:\n");
++		for (i = 0; i < vreg->corner_count; i++)
++			cpr3_debug(vreg, "open-loop[%2d] = %d uV\n", i,
++				   vreg->corner[i].open_loop_volt);
++
++		rc = cpr3_adjust_open_loop_voltages(vreg);
++		if (rc)
++			cpr3_err(vreg,
++				"open-loop voltage adjustment failed, rc=%d\n",
++				 rc);
++	}
++
++	kfree(fuse_volt);
++	kfree(fmax_corner);
++	return rc;
++}
++
++/**
++ * cpr3_npu_print_settings() - print out NPU CPR configuration settings into
++ *		the kernel log for debugging purposes
++ * @vreg:		Pointer to the CPR3 regulator
++ */
++static void cpr3_npu_print_settings(struct cpr3_regulator *vreg)
++{
++	struct cpr3_corner *corner;
++	int i;
++
++	cpr3_debug(vreg,
++		"Corner: Frequency (Hz), Fuse Corner, Floor (uV), \
++		Open-Loop (uV), Ceiling (uV)\n");
++	for (i = 0; i < vreg->corner_count; i++) {
++		corner = &vreg->corner[i];
++		cpr3_debug(vreg, "%3d: %10u, %2d, %7d, %7d, %7d\n",
++			   i, corner->proc_freq, corner->cpr_fuse_corner,
++			   corner->floor_volt, corner->open_loop_volt,
++			   corner->ceiling_volt);
++	}
++
++	if (vreg->thread->ctrl->apm)
++		cpr3_debug(vreg, "APM threshold = %d uV, APM adjust = %d uV\n",
++			   vreg->thread->ctrl->apm_threshold_volt,
++			   vreg->thread->ctrl->apm_adj_volt);
++}
++
++/**
++ * cpr3_ipq807x_npu_calc_temp_based_ol_voltages() - Calculate the open loop
++ * voltages based on temperature based correction margins
++ * @vreg:               Pointer to the CPR3 regulator
++ */
++
++static int
++cpr3_ipq807x_npu_calc_temp_based_ol_voltages(struct cpr3_regulator *vreg,
++						bool temp_correction)
++{
++	int rc, i;
++
++	rc = cpr3_ipq807x_npu_calculate_open_loop_voltages(vreg,
++							temp_correction);
++	if (rc) {
++		cpr3_err(vreg,
++			"unable to calculate open-loop voltages, rc=%d\n", rc);
++		return rc;
++	}
++
++	rc = cpr3_limit_open_loop_voltages(vreg);
++	if (rc) {
++		cpr3_err(vreg, "unable to limit open-loop voltages, rc=%d\n",
++			 rc);
++		return rc;
++	}
++
++	cpr3_open_loop_voltage_as_ceiling(vreg);
++
++	rc = cpr3_limit_floor_voltages(vreg);
++	if (rc) {
++		cpr3_err(vreg, "unable to limit floor voltages, rc=%d\n", rc);
++		return rc;
++	}
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		if (temp_correction)
++			vreg->corner[i].cold_temp_open_loop_volt =
++				vreg->corner[i].open_loop_volt;
++		else
++			vreg->corner[i].normal_temp_open_loop_volt =
++				vreg->corner[i].open_loop_volt;
++	}
++
++	cpr3_npu_print_settings(vreg);
++
++	return rc;
++}
++
++/**
++ * cpr3_npu_init_thread() - perform steps necessary to initialize the
++ *		configuration data for a CPR3 thread
++ * @thread:		Pointer to the CPR3 thread
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_npu_init_thread(struct cpr3_thread *thread)
++{
++	int rc;
++
++	rc = cpr3_parse_common_thread_data(thread);
++	if (rc) {
++		cpr3_err(thread->ctrl,
++			"thread %u CPR thread data from DT- failed, rc=%d\n",
++			 thread->thread_id, rc);
++		return rc;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_npu_init_regulator() - perform all steps necessary to initialize the
++ *		configuration data for a CPR3 regulator
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_npu_init_regulator(struct cpr3_regulator *vreg)
++{
++	struct cpr3_ipq807x_npu_fuses *fuse;
++	int rc, cold_temp = 0;
++	bool can_adj_cold_temp = cpr3_can_adjust_cold_temp(vreg);
++
++	rc = cpr3_ipq807x_npu_read_fuse_data(vreg);
++	if (rc) {
++		cpr3_err(vreg, "unable to read CPR fuse data, rc=%d\n", rc);
++		return rc;
++	}
++
++	fuse = vreg->platform_fuses;
++
++	rc = cpr3_npu_parse_corner_data(vreg);
++	if (rc) {
++		cpr3_err(vreg,
++			"Cannot read CPR corner data from DT, rc=%d\n", rc);
++		return rc;
++	}
++
++	rc = cpr3_mem_acc_init(vreg);
++	if (rc) {
++		if (rc != -EPROBE_DEFER)
++			cpr3_err(vreg,
++			"Cannot initialize mem-acc regulator settings, rc=%d\n",
++			 rc);
++		return rc;
++	}
++
++	if (can_adj_cold_temp) {
++		rc = cpr3_ipq807x_npu_calc_temp_based_ol_voltages(vreg, true);
++		if (rc) {
++			cpr3_err(vreg,
++			"unable to calculate open-loop voltages, rc=%d\n", rc);
++			return rc;
++		}
++	}
++
++	rc = cpr3_ipq807x_npu_calc_temp_based_ol_voltages(vreg, false);
++	if (rc) {
++		cpr3_err(vreg,
++			"unable to calculate open-loop voltages, rc=%d\n", rc);
++		return rc;
++	}
++
++	if (can_adj_cold_temp) {
++		cpr3_info(vreg,
++		"Normal and Cold condition init done. Default to normal.\n");
++
++		rc = cpr3_get_cold_temp_threshold(vreg, &cold_temp);
++		if (rc) {
++			cpr3_err(vreg,
++			"Get cold temperature threshold failed, rc=%d\n", rc);
++			return rc;
++		}
++		register_low_temp_notif(NPU_TSENS, cold_temp,
++							cpr3_npu_temp_notify);
++	}
++
++	return rc;
++}
++
++/**
++ * cpr3_npu_init_controller() - perform NPU CPR3 controller specific
++ *		initializations
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_npu_init_controller(struct cpr3_controller *ctrl)
++{
++	int rc;
++
++	rc = cpr3_parse_open_loop_common_ctrl_data(ctrl);
++	if (rc) {
++		if (rc != -EPROBE_DEFER)
++			cpr3_err(ctrl, "unable to parse common controller data, rc=%d\n",
++				 rc);
++		return rc;
++	}
++
++	ctrl->ctrl_type = CPR_CTRL_TYPE_CPR3;
++	ctrl->supports_hw_closed_loop = false;
++
++	return 0;
++}
++
++static const struct cpr3_reg_data ipq807x_cpr_npu = {
++	.cpr_valid_fuse_count = IPQ807x_NPU_FUSE_CORNERS,
++	.init_voltage_param = ipq807x_npu_init_voltage_param,
++	.fuse_ref_volt = ipq807x_npu_fuse_ref_volt,
++	.fuse_step_volt = IPQ807x_NPU_FUSE_STEP_VOLT,
++	.cpr_clk_rate = IPQ807x_NPU_CPR_CLOCK_RATE,
++};
++
++static const struct cpr3_reg_data ipq817x_cpr_npu = {
++	.cpr_valid_fuse_count = IPQ817x_NPU_FUSE_CORNERS,
++	.init_voltage_param = ipq807x_npu_init_voltage_param,
++	.fuse_ref_volt = ipq807x_npu_fuse_ref_volt,
++	.fuse_step_volt = IPQ807x_NPU_FUSE_STEP_VOLT,
++	.cpr_clk_rate = IPQ807x_NPU_CPR_CLOCK_RATE,
++};
++
++static const struct cpr3_reg_data ipq9574_cpr_npu = {
++	.cpr_valid_fuse_count = IPQ9574_NPU_FUSE_CORNERS,
++	.init_voltage_param = ipq9574_npu_init_voltage_param,
++	.fuse_ref_volt = ipq9574_npu_fuse_ref_volt,
++	.fuse_step_volt = IPQ9574_NPU_FUSE_STEP_VOLT,
++	.cpr_clk_rate = IPQ9574_NPU_CPR_CLOCK_RATE,
++};
++
++static struct of_device_id cpr3_regulator_match_table[] = {
++	{
++		.compatible = "qcom,cpr3-ipq807x-npu-regulator",
++		.data = &ipq807x_cpr_npu
++	},
++	{
++		.compatible = "qcom,cpr3-ipq817x-npu-regulator",
++		.data = &ipq817x_cpr_npu
++	},
++	{
++		.compatible = "qcom,cpr3-ipq9574-npu-regulator",
++		.data = &ipq9574_cpr_npu
++	},
++	{}
++};
++
++static int cpr3_npu_regulator_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct cpr3_controller *ctrl;
++	int i, rc;
++	const struct of_device_id *match;
++	struct cpr3_reg_data *cpr_data;
++
++	if (!dev->of_node) {
++		dev_err(dev, "Device tree node is missing\n");
++		return -EINVAL;
++	}
++
++	ctrl = devm_kzalloc(dev, sizeof(*ctrl), GFP_KERNEL);
++	if (!ctrl)
++		return -ENOMEM;
++	g_ctrl = ctrl;
++
++	match = of_match_device(cpr3_regulator_match_table, &pdev->dev);
++	if (!match)
++		return -ENODEV;
++
++	cpr_data = (struct cpr3_reg_data *)match->data;
++	g_valid_npu_fuse_count = cpr_data->cpr_valid_fuse_count;
++	dev_info(dev, "NPU CPR valid fuse count: %d\n", g_valid_npu_fuse_count);
++	ctrl->cpr_clock_rate = cpr_data->cpr_clk_rate;
++
++	ctrl->dev = dev;
++	/* Set to false later if anything precludes CPR operation. */
++	ctrl->cpr_allowed_hw = true;
++
++	rc = of_property_read_string(dev->of_node, "qcom,cpr-ctrl-name",
++				     &ctrl->name);
++	if (rc) {
++		cpr3_err(ctrl, "unable to read qcom,cpr-ctrl-name, rc=%d\n",
++			 rc);
++		return rc;
++	}
++
++	rc = cpr3_map_fuse_base(ctrl, pdev);
++	if (rc) {
++		cpr3_err(ctrl, "could not map fuse base address\n");
++		return rc;
++	}
++
++	rc = cpr3_read_tcsr_setting(ctrl, pdev, IPQ807x_NPU_CPR_TCSR_START,
++				    IPQ807x_NPU_CPR_TCSR_END);
++	if (rc) {
++		cpr3_err(ctrl, "could not read CPR tcsr rsetting\n");
++		return rc;
++	}
++
++	rc = cpr3_allocate_threads(ctrl, 0, 0);
++	if (rc) {
++		cpr3_err(ctrl, "failed to allocate CPR thread array, rc=%d\n",
++			 rc);
++		return rc;
++	}
++
++	if (ctrl->thread_count != 1) {
++		cpr3_err(ctrl, "expected 1 thread but found %d\n",
++			 ctrl->thread_count);
++		return -EINVAL;
++	}
++
++	rc = cpr3_npu_init_controller(ctrl);
++	if (rc) {
++		if (rc != -EPROBE_DEFER)
++			cpr3_err(ctrl, "failed to initialize CPR controller parameters, rc=%d\n",
++				 rc);
++		return rc;
++	}
++
++	rc = cpr3_npu_init_thread(&ctrl->thread[0]);
++	if (rc) {
++		cpr3_err(ctrl, "thread initialization failed, rc=%d\n", rc);
++		return rc;
++	}
++
++	for (i = 0; i < ctrl->thread[0].vreg_count; i++) {
++		ctrl->thread[0].vreg[i].cpr3_regulator_data = cpr_data;
++		rc = cpr3_npu_init_regulator(&ctrl->thread[0].vreg[i]);
++		if (rc) {
++			cpr3_err(&ctrl->thread[0].vreg[i], "regulator initialization failed, rc=%d\n",
++				 rc);
++			return rc;
++		}
++	}
++
++	platform_set_drvdata(pdev, ctrl);
++
++	return cpr3_open_loop_regulator_register(pdev, ctrl);
++}
++
++static int cpr3_npu_regulator_remove(struct platform_device *pdev)
++{
++	struct cpr3_controller *ctrl = platform_get_drvdata(pdev);
++
++	return cpr3_open_loop_regulator_unregister(ctrl);
++}
++
++static struct platform_driver cpr3_npu_regulator_driver = {
++	.driver		= {
++		.name		= "qcom,cpr3-npu-regulator",
++		.of_match_table	= cpr3_regulator_match_table,
++	},
++	.probe		= cpr3_npu_regulator_probe,
++	.remove		= cpr3_npu_regulator_remove,
++};
++
++static int cpr3_regulator_init(void)
++{
++	return platform_driver_register(&cpr3_npu_regulator_driver);
++}
++arch_initcall(cpr3_regulator_init);
++
++static void cpr3_regulator_exit(void)
++{
++	platform_driver_unregister(&cpr3_npu_regulator_driver);
++}
++module_exit(cpr3_regulator_exit);
++
++MODULE_DESCRIPTION("QCOM CPR3 NPU regulator driver");
++MODULE_LICENSE("Dual BSD/GPLv2");
++MODULE_ALIAS("platform:npu-ipq807x");
+--- /dev/null
++++ b/drivers/regulator/cpr3-regulator.c
+@@ -0,0 +1,5111 @@
++/*
++ * Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#define pr_fmt(fmt) "%s: " fmt, __func__
++
++#include <linux/bitops.h>
++#include <linux/debugfs.h>
++#include <linux/delay.h>
++#include <linux/err.h>
++#include <linux/init.h>
++#include <linux/interrupt.h>
++#include <linux/io.h>
++#include <linux/kernel.h>
++#include <linux/ktime.h>
++#include <linux/list.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/of_device.h>
++#include <linux/platform_device.h>
++#include <linux/pm_opp.h>
++#include <linux/slab.h>
++#include <linux/sort.h>
++#include <linux/string.h>
++#include <linux/uaccess.h>
++#include <linux/regulator/driver.h>
++#include <linux/regulator/machine.h>
++#include <linux/regulator/of_regulator.h>
++#include <linux/panic_notifier.h>
++
++#include "cpr3-regulator.h"
++
++#define CPR3_REGULATOR_CORNER_INVALID	(-1)
++#define CPR3_RO_MASK			GENMASK(CPR3_RO_COUNT - 1, 0)
++
++/* CPR3 registers */
++#define CPR3_REG_CPR_CTL			0x4
++#define CPR3_CPR_CTL_LOOP_EN_MASK		BIT(0)
++#define CPR3_CPR_CTL_LOOP_ENABLE		BIT(0)
++#define CPR3_CPR_CTL_LOOP_DISABLE		0
++#define CPR3_CPR_CTL_IDLE_CLOCKS_MASK		GENMASK(5, 1)
++#define CPR3_CPR_CTL_IDLE_CLOCKS_SHIFT		1
++#define CPR3_CPR_CTL_COUNT_MODE_MASK		GENMASK(7, 6)
++#define CPR3_CPR_CTL_COUNT_MODE_SHIFT		6
++#define CPR3_CPR_CTL_COUNT_MODE_ALL_AT_ONCE_MIN	0
++#define CPR3_CPR_CTL_COUNT_MODE_ALL_AT_ONCE_MAX	1
++#define CPR3_CPR_CTL_COUNT_MODE_STAGGERED	2
++#define CPR3_CPR_CTL_COUNT_MODE_ALL_AT_ONCE_AGE	3
++#define CPR3_CPR_CTL_COUNT_REPEAT_MASK		GENMASK(31, 9)
++#define CPR3_CPR_CTL_COUNT_REPEAT_SHIFT		9
++
++#define CPR3_REG_CPR_STATUS			0x8
++#define CPR3_CPR_STATUS_BUSY_MASK		BIT(0)
++#define CPR3_CPR_STATUS_AGING_MEASUREMENT_MASK	BIT(1)
++
++/*
++ * This register is not present on controllers that support HW closed-loop
++ * except CPR4 APSS controller.
++ */
++#define CPR3_REG_CPR_TIMER_AUTO_CONT		0xC
++
++#define CPR3_REG_CPR_STEP_QUOT			0x14
++#define CPR3_CPR_STEP_QUOT_MIN_MASK		GENMASK(5, 0)
++#define CPR3_CPR_STEP_QUOT_MIN_SHIFT		0
++#define CPR3_CPR_STEP_QUOT_MAX_MASK		GENMASK(11, 6)
++#define CPR3_CPR_STEP_QUOT_MAX_SHIFT		6
++
++#define CPR3_REG_GCNT(ro)			(0xA0 + 0x4 * (ro))
++
++#define CPR3_REG_SENSOR_BYPASS_WRITE(sensor)	(0xE0 + 0x4 * ((sensor) / 32))
++#define CPR3_REG_SENSOR_BYPASS_WRITE_BANK(bank)	(0xE0 + 0x4 * (bank))
++
++#define CPR3_REG_SENSOR_MASK_WRITE(sensor)	(0x120 + 0x4 * ((sensor) / 32))
++#define CPR3_REG_SENSOR_MASK_WRITE_BANK(bank)	(0x120 + 0x4 * (bank))
++#define CPR3_REG_SENSOR_MASK_READ(sensor)	(0x140 + 0x4 * ((sensor) / 32))
++
++#define CPR3_REG_SENSOR_OWNER(sensor)	(0x200 + 0x4 * (sensor))
++
++#define CPR3_REG_CONT_CMD		0x800
++#define CPR3_CONT_CMD_ACK		0x1
++#define CPR3_CONT_CMD_NACK		0x0
++
++#define CPR3_REG_THRESH(thread)		(0x808 + 0x440 * (thread))
++#define CPR3_THRESH_CONS_DOWN_MASK	GENMASK(3, 0)
++#define CPR3_THRESH_CONS_DOWN_SHIFT	0
++#define CPR3_THRESH_CONS_UP_MASK	GENMASK(7, 4)
++#define CPR3_THRESH_CONS_UP_SHIFT	4
++#define CPR3_THRESH_DOWN_THRESH_MASK	GENMASK(12, 8)
++#define CPR3_THRESH_DOWN_THRESH_SHIFT	8
++#define CPR3_THRESH_UP_THRESH_MASK	GENMASK(17, 13)
++#define CPR3_THRESH_UP_THRESH_SHIFT	13
++
++#define CPR3_REG_RO_MASK(thread)	(0x80C + 0x440 * (thread))
++
++#define CPR3_REG_RESULT0(thread)	(0x810 + 0x440 * (thread))
++#define CPR3_RESULT0_BUSY_MASK		BIT(0)
++#define CPR3_RESULT0_STEP_DN_MASK	BIT(1)
++#define CPR3_RESULT0_STEP_UP_MASK	BIT(2)
++#define CPR3_RESULT0_ERROR_STEPS_MASK	GENMASK(7, 3)
++#define CPR3_RESULT0_ERROR_STEPS_SHIFT	3
++#define CPR3_RESULT0_ERROR_MASK		GENMASK(19, 8)
++#define CPR3_RESULT0_ERROR_SHIFT	8
++#define CPR3_RESULT0_NEGATIVE_MASK	BIT(20)
++
++#define CPR3_REG_RESULT1(thread)	(0x814 + 0x440 * (thread))
++#define CPR3_RESULT1_QUOT_MIN_MASK	GENMASK(11, 0)
++#define CPR3_RESULT1_QUOT_MIN_SHIFT	0
++#define CPR3_RESULT1_QUOT_MAX_MASK	GENMASK(23, 12)
++#define CPR3_RESULT1_QUOT_MAX_SHIFT	12
++#define CPR3_RESULT1_RO_MIN_MASK	GENMASK(27, 24)
++#define CPR3_RESULT1_RO_MIN_SHIFT	24
++#define CPR3_RESULT1_RO_MAX_MASK	GENMASK(31, 28)
++#define CPR3_RESULT1_RO_MAX_SHIFT	28
++
++#define CPR3_REG_RESULT2(thread)		(0x818 + 0x440 * (thread))
++#define CPR3_RESULT2_STEP_QUOT_MIN_MASK		GENMASK(5, 0)
++#define CPR3_RESULT2_STEP_QUOT_MIN_SHIFT	0
++#define CPR3_RESULT2_STEP_QUOT_MAX_MASK		GENMASK(11, 6)
++#define CPR3_RESULT2_STEP_QUOT_MAX_SHIFT	6
++#define CPR3_RESULT2_SENSOR_MIN_MASK		GENMASK(23, 16)
++#define CPR3_RESULT2_SENSOR_MIN_SHIFT		16
++#define CPR3_RESULT2_SENSOR_MAX_MASK		GENMASK(31, 24)
++#define CPR3_RESULT2_SENSOR_MAX_SHIFT		24
++
++#define CPR3_REG_IRQ_EN			0x81C
++#define CPR3_REG_IRQ_CLEAR		0x820
++#define CPR3_REG_IRQ_STATUS		0x824
++#define CPR3_IRQ_UP			BIT(3)
++#define CPR3_IRQ_MID			BIT(2)
++#define CPR3_IRQ_DOWN			BIT(1)
++
++#define CPR3_REG_TARGET_QUOT(thread, ro) \
++					(0x840 + 0x440 * (thread) + 0x4 * (ro))
++
++/* Registers found only on controllers that support HW closed-loop. */
++#define CPR3_REG_PD_THROTTLE		0xE8
++#define CPR3_PD_THROTTLE_DISABLE	0x0
++
++#define CPR3_REG_HW_CLOSED_LOOP		0x3000
++#define CPR3_HW_CLOSED_LOOP_ENABLE	0x0
++#define CPR3_HW_CLOSED_LOOP_DISABLE	0x1
++
++#define CPR3_REG_CPR_TIMER_MID_CONT	0x3004
++#define CPR3_REG_CPR_TIMER_UP_DN_CONT	0x3008
++
++#define CPR3_REG_LAST_MEASUREMENT		0x7F8
++#define CPR3_LAST_MEASUREMENT_THREAD_DN_SHIFT	0
++#define CPR3_LAST_MEASUREMENT_THREAD_UP_SHIFT	4
++#define CPR3_LAST_MEASUREMENT_THREAD_DN(thread) \
++		(BIT(thread) << CPR3_LAST_MEASUREMENT_THREAD_DN_SHIFT)
++#define CPR3_LAST_MEASUREMENT_THREAD_UP(thread) \
++		(BIT(thread) << CPR3_LAST_MEASUREMENT_THREAD_UP_SHIFT)
++#define CPR3_LAST_MEASUREMENT_AGGR_DN		BIT(8)
++#define CPR3_LAST_MEASUREMENT_AGGR_MID		BIT(9)
++#define CPR3_LAST_MEASUREMENT_AGGR_UP		BIT(10)
++#define CPR3_LAST_MEASUREMENT_VALID		BIT(11)
++#define CPR3_LAST_MEASUREMENT_SAW_ERROR		BIT(12)
++#define CPR3_LAST_MEASUREMENT_PD_BYPASS_MASK	GENMASK(23, 16)
++#define CPR3_LAST_MEASUREMENT_PD_BYPASS_SHIFT	16
++
++/* CPR4 controller specific registers and bit definitions */
++#define CPR4_REG_CPR_TIMER_CLAMP			0x10
++#define CPR4_CPR_TIMER_CLAMP_THREAD_AGGREGATION_EN	BIT(27)
++
++#define CPR4_REG_MISC				0x700
++#define CPR4_MISC_MARGIN_TABLE_ROW_SELECT_MASK	GENMASK(23, 20)
++#define CPR4_MISC_MARGIN_TABLE_ROW_SELECT_SHIFT	20
++#define CPR4_MISC_TEMP_SENSOR_ID_START_MASK	GENMASK(27, 24)
++#define CPR4_MISC_TEMP_SENSOR_ID_START_SHIFT	24
++#define CPR4_MISC_TEMP_SENSOR_ID_END_MASK	GENMASK(31, 28)
++#define CPR4_MISC_TEMP_SENSOR_ID_END_SHIFT	28
++
++#define CPR4_REG_SAW_ERROR_STEP_LIMIT		0x7A4
++#define CPR4_SAW_ERROR_STEP_LIMIT_UP_MASK	GENMASK(4, 0)
++#define CPR4_SAW_ERROR_STEP_LIMIT_UP_SHIFT	0
++#define CPR4_SAW_ERROR_STEP_LIMIT_DN_MASK	GENMASK(9, 5)
++#define CPR4_SAW_ERROR_STEP_LIMIT_DN_SHIFT	5
++
++#define CPR4_REG_MARGIN_TEMP_CORE_TIMERS			0x7A8
++#define CPR4_MARGIN_TEMP_CORE_TIMERS_SETTLE_VOLTAGE_COUNT_MASK	GENMASK(28, 18)
++#define CPR4_MARGIN_TEMP_CORE_TIMERS_SETTLE_VOLTAGE_COUNT_SHIFT	18
++
++#define CPR4_REG_MARGIN_TEMP_CORE(core)		(0x7AC + 0x4 * (core))
++#define CPR4_MARGIN_TEMP_CORE_ADJ_MASK		GENMASK(7, 0)
++#define CPR4_MARGIN_TEMP_CORE_ADJ_SHIFT		8
++
++#define CPR4_REG_MARGIN_TEMP_POINT0N1		0x7F0
++#define CPR4_MARGIN_TEMP_POINT0_MASK		GENMASK(11, 0)
++#define CPR4_MARGIN_TEMP_POINT0_SHIFT		0
++#define CPR4_MARGIN_TEMP_POINT1_MASK		GENMASK(23, 12)
++#define CPR4_MARGIN_TEMP_POINT1_SHIFT		12
++#define CPR4_REG_MARGIN_TEMP_POINT2		0x7F4
++#define CPR4_MARGIN_TEMP_POINT2_MASK		GENMASK(11, 0)
++#define CPR4_MARGIN_TEMP_POINT2_SHIFT		0
++
++#define CPR4_REG_MARGIN_ADJ_CTL					0x7F8
++#define CPR4_MARGIN_ADJ_CTL_BOOST_EN				BIT(0)
++#define CPR4_MARGIN_ADJ_CTL_CORE_ADJ_EN				BIT(1)
++#define CPR4_MARGIN_ADJ_CTL_TEMP_ADJ_EN				BIT(2)
++#define CPR4_MARGIN_ADJ_CTL_TIMER_SETTLE_VOLTAGE_EN		BIT(3)
++#define CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_EN_MASK		BIT(4)
++#define CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_ENABLE		BIT(4)
++#define CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_DISABLE		0
++#define CPR4_MARGIN_ADJ_CTL_PER_RO_KV_MARGIN_EN			BIT(7)
++#define CPR4_MARGIN_ADJ_CTL_KV_MARGIN_ADJ_EN			BIT(8)
++#define CPR4_MARGIN_ADJ_CTL_PMIC_STEP_SIZE_MASK			GENMASK(16, 12)
++#define CPR4_MARGIN_ADJ_CTL_PMIC_STEP_SIZE_SHIFT		12
++#define CPR4_MARGIN_ADJ_CTL_INITIAL_TEMP_BAND_MASK		GENMASK(21, 19)
++#define CPR4_MARGIN_ADJ_CTL_INITIAL_TEMP_BAND_SHIFT		19
++#define CPR4_MARGIN_ADJ_CTL_MAX_NUM_CORES_MASK			GENMASK(25, 22)
++#define CPR4_MARGIN_ADJ_CTL_MAX_NUM_CORES_SHIFT			22
++#define CPR4_MARGIN_ADJ_CTL_KV_MARGIN_ADJ_STEP_QUOT_MASK	GENMASK(31, 26)
++#define CPR4_MARGIN_ADJ_CTL_KV_MARGIN_ADJ_STEP_QUOT_SHIFT	26
++
++#define CPR4_REG_CPR_MASK_THREAD(thread)	(0x80C + 0x440 * (thread))
++#define CPR4_CPR_MASK_THREAD_DISABLE_THREAD		BIT(31)
++#define CPR4_CPR_MASK_THREAD_RO_MASK4THREAD_MASK	GENMASK(15, 0)
++
++/*
++ * The amount of time to wait for the CPR controller to become idle when
++ * performing an aging measurement.
++ */
++#define CPR3_AGING_MEASUREMENT_TIMEOUT_NS	5000000
++
++/*
++ * The number of individual aging measurements to perform which are then
++ * averaged together in order to determine the final aging adjustment value.
++ */
++#define CPR3_AGING_MEASUREMENT_ITERATIONS	16
++
++/*
++ * Aging measurements for the aged and unaged ring oscillators take place a few
++ * microseconds apart.  If the vdd-supply voltage fluctuates between the two
++ * measurements, then the difference between them will be incorrect.  The
++ * difference could end up too high or too low.  This constant defines the
++ * number of lowest and highest measurements to ignore when averaging.
++ */
++#define CPR3_AGING_MEASUREMENT_FILTER		3
++
++/*
++ * The number of times to attempt the full aging measurement sequence before
++ * declaring a measurement failure.
++ */
++#define CPR3_AGING_RETRY_COUNT			5
++
++/*
++ * The maximum time to wait in microseconds for a CPR register write to
++ * complete.
++ */
++#define CPR3_REGISTER_WRITE_DELAY_US		200
++
++static DEFINE_MUTEX(cpr3_controller_list_mutex);
++static LIST_HEAD(cpr3_controller_list);
++static struct dentry *cpr3_debugfs_base;
++
++/**
++ * cpr3_read() - read four bytes from the memory address specified
++ * @ctrl:		Pointer to the CPR3 controller
++ * @offset:		Offset in bytes from the CPR3 controller's base address
++ *
++ * Return: memory address value
++ */
++static inline u32 cpr3_read(struct cpr3_controller *ctrl, u32 offset)
++{
++	if (!ctrl->cpr_enabled) {
++		cpr3_err(ctrl, "CPR register reads are not possible when CPR clocks are disabled\n");
++		return 0;
++	}
++
++	return readl_relaxed(ctrl->cpr_ctrl_base + offset);
++}
++
++/**
++ * cpr3_write() - write four bytes to the memory address specified
++ * @ctrl:		Pointer to the CPR3 controller
++ * @offset:		Offset in bytes from the CPR3 controller's base address
++ * @value:		Value to write to the memory address
++ *
++ * Return: none
++ */
++static inline void cpr3_write(struct cpr3_controller *ctrl, u32 offset,
++				u32 value)
++{
++	if (!ctrl->cpr_enabled) {
++		cpr3_err(ctrl, "CPR register writes are not possible when CPR clocks are disabled\n");
++		return;
++	}
++
++	writel_relaxed(value, ctrl->cpr_ctrl_base + offset);
++}
++
++/**
++ * cpr3_masked_write() - perform a read-modify-write sequence so that only
++ *		masked bits are modified
++ * @ctrl:		Pointer to the CPR3 controller
++ * @offset:		Offset in bytes from the CPR3 controller's base address
++ * @mask:		Mask identifying the bits that should be modified
++ * @value:		Value to write to the memory address
++ *
++ * Return: none
++ */
++static inline void cpr3_masked_write(struct cpr3_controller *ctrl, u32 offset,
++				u32 mask, u32 value)
++{
++	u32 reg_val, orig_val;
++
++	if (!ctrl->cpr_enabled) {
++		cpr3_err(ctrl, "CPR register writes are not possible when CPR clocks are disabled\n");
++		return;
++	}
++
++	reg_val = orig_val = readl_relaxed(ctrl->cpr_ctrl_base + offset);
++	reg_val &= ~mask;
++	reg_val |= value & mask;
++
++	if (reg_val != orig_val)
++		writel_relaxed(reg_val, ctrl->cpr_ctrl_base + offset);
++}
++
++/**
++ * cpr3_ctrl_loop_enable() - enable the CPR sensing loop for a given controller
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: none
++ */
++static inline void cpr3_ctrl_loop_enable(struct cpr3_controller *ctrl)
++{
++	if (ctrl->cpr_enabled && !(ctrl->aggr_corner.sdelta
++		&& ctrl->aggr_corner.sdelta->allow_boost))
++		cpr3_masked_write(ctrl, CPR3_REG_CPR_CTL,
++			CPR3_CPR_CTL_LOOP_EN_MASK, CPR3_CPR_CTL_LOOP_ENABLE);
++}
++
++/**
++ * cpr3_ctrl_loop_disable() - disable the CPR sensing loop for a given
++ *		controller
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: none
++ */
++static inline void cpr3_ctrl_loop_disable(struct cpr3_controller *ctrl)
++{
++	if (ctrl->cpr_enabled)
++		cpr3_masked_write(ctrl, CPR3_REG_CPR_CTL,
++			CPR3_CPR_CTL_LOOP_EN_MASK, CPR3_CPR_CTL_LOOP_DISABLE);
++}
++
++/**
++ * cpr3_clock_enable() - prepare and enable all clocks used by this CPR3
++ *		controller
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_clock_enable(struct cpr3_controller *ctrl)
++{
++	int rc;
++
++	rc = clk_prepare_enable(ctrl->bus_clk);
++	if (rc) {
++		cpr3_err(ctrl, "failed to enable bus clock, rc=%d\n", rc);
++		return rc;
++	}
++
++	rc = clk_prepare_enable(ctrl->iface_clk);
++	if (rc) {
++		cpr3_err(ctrl, "failed to enable interface clock, rc=%d\n", rc);
++		clk_disable_unprepare(ctrl->bus_clk);
++		return rc;
++	}
++
++	rc = clk_prepare_enable(ctrl->core_clk);
++	if (rc) {
++		cpr3_err(ctrl, "failed to enable core clock, rc=%d\n", rc);
++		clk_disable_unprepare(ctrl->iface_clk);
++		clk_disable_unprepare(ctrl->bus_clk);
++		return rc;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_clock_disable() - disable and unprepare all clocks used by this CPR3
++ *		controller
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: none
++ */
++static void cpr3_clock_disable(struct cpr3_controller *ctrl)
++{
++	clk_disable_unprepare(ctrl->core_clk);
++	clk_disable_unprepare(ctrl->iface_clk);
++	clk_disable_unprepare(ctrl->bus_clk);
++}
++
++/**
++ * cpr3_ctrl_clear_cpr4_config() - clear the CPR4 register configuration
++ *		programmed for current aggregated corner of a given controller
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static inline int cpr3_ctrl_clear_cpr4_config(struct cpr3_controller *ctrl)
++{
++	struct cpr4_sdelta *aggr_sdelta = ctrl->aggr_corner.sdelta;
++	bool cpr_enabled = ctrl->cpr_enabled;
++	int i, rc = 0;
++
++	if (!aggr_sdelta || !(aggr_sdelta->allow_core_count_adj
++		|| aggr_sdelta->allow_temp_adj || aggr_sdelta->allow_boost))
++		/* cpr4 features are not enabled */
++		return 0;
++
++	/* Ensure that CPR clocks are enabled before writing to registers. */
++	if (!cpr_enabled) {
++		rc = cpr3_clock_enable(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "clock enable failed, rc=%d\n", rc);
++			return rc;
++		}
++		ctrl->cpr_enabled = true;
++	}
++
++	/*
++	 * Clear feature enable configuration made for current
++	 * aggregated corner.
++	 */
++	cpr3_masked_write(ctrl, CPR4_REG_MARGIN_ADJ_CTL,
++		CPR4_MARGIN_ADJ_CTL_MAX_NUM_CORES_MASK
++		| CPR4_MARGIN_ADJ_CTL_CORE_ADJ_EN
++		| CPR4_MARGIN_ADJ_CTL_TEMP_ADJ_EN
++		| CPR4_MARGIN_ADJ_CTL_KV_MARGIN_ADJ_EN
++		| CPR4_MARGIN_ADJ_CTL_BOOST_EN
++		| CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_EN_MASK, 0);
++
++	cpr3_masked_write(ctrl, CPR4_REG_MISC,
++			CPR4_MISC_MARGIN_TABLE_ROW_SELECT_MASK,
++			0 << CPR4_MISC_MARGIN_TABLE_ROW_SELECT_SHIFT);
++
++	for (i = 0; i <= aggr_sdelta->max_core_count; i++) {
++		/* Clear voltage margin adjustments programmed in TEMP_COREi */
++		cpr3_write(ctrl, CPR4_REG_MARGIN_TEMP_CORE(i), 0);
++	}
++
++	/* Turn off CPR clocks if they were off before this function call. */
++	if (!cpr_enabled) {
++		cpr3_clock_disable(ctrl);
++		ctrl->cpr_enabled = false;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_closed_loop_enable() - enable logical CPR closed-loop operation
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_closed_loop_enable(struct cpr3_controller *ctrl)
++{
++	int rc;
++
++	if (!ctrl->cpr_allowed_hw || !ctrl->cpr_allowed_sw) {
++		cpr3_err(ctrl, "cannot enable closed-loop CPR operation because it is disallowed\n");
++		return -EPERM;
++	} else if (ctrl->cpr_enabled) {
++		/* Already enabled */
++		return 0;
++	} else if (ctrl->cpr_suspended) {
++		/*
++		 * CPR must remain disabled as the system is entering suspend.
++		 */
++		return 0;
++	}
++
++	rc = cpr3_clock_enable(ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "unable to enable CPR clocks, rc=%d\n", rc);
++		return rc;
++	}
++
++	ctrl->cpr_enabled = true;
++	cpr3_debug(ctrl, "CPR closed-loop operation enabled\n");
++
++	return 0;
++}
++
++/**
++ * cpr3_closed_loop_disable() - disable logical CPR closed-loop operation
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static inline int cpr3_closed_loop_disable(struct cpr3_controller *ctrl)
++{
++	if (!ctrl->cpr_enabled) {
++		/* Already disabled */
++		return 0;
++	}
++
++	cpr3_clock_disable(ctrl);
++	ctrl->cpr_enabled = false;
++	cpr3_debug(ctrl, "CPR closed-loop operation disabled\n");
++
++	return 0;
++}
++
++/**
++ * cpr3_regulator_get_gcnt() - returns the GCNT register value corresponding
++ *		to the clock rate and sensor time of the CPR3 controller
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: GCNT value
++ */
++static u32 cpr3_regulator_get_gcnt(struct cpr3_controller *ctrl)
++{
++	u64 temp;
++	unsigned int remainder;
++	u32 gcnt;
++
++	temp = (u64)ctrl->cpr_clock_rate * (u64)ctrl->sensor_time;
++	remainder = do_div(temp, 1000000000);
++	if (remainder)
++		temp++;
++	/*
++	 * GCNT == 0 corresponds to a single ref clock measurement interval so
++	 * offset GCNT values by 1.
++	 */
++	gcnt = temp - 1;
++
++	return gcnt;
++}
++
++/**
++ * cpr3_regulator_init_thread() - performs hardware initialization of CPR
++ *		thread registers
++ * @thread:		Pointer to the CPR3 thread
++ *
++ * CPR interface/bus clocks must be enabled before calling this function.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_init_thread(struct cpr3_thread *thread)
++{
++	u32 reg;
++
++	reg = (thread->consecutive_up << CPR3_THRESH_CONS_UP_SHIFT)
++		& CPR3_THRESH_CONS_UP_MASK;
++	reg |= (thread->consecutive_down << CPR3_THRESH_CONS_DOWN_SHIFT)
++		& CPR3_THRESH_CONS_DOWN_MASK;
++	reg |= (thread->up_threshold << CPR3_THRESH_UP_THRESH_SHIFT)
++		& CPR3_THRESH_UP_THRESH_MASK;
++	reg |= (thread->down_threshold << CPR3_THRESH_DOWN_THRESH_SHIFT)
++		& CPR3_THRESH_DOWN_THRESH_MASK;
++
++	cpr3_write(thread->ctrl, CPR3_REG_THRESH(thread->thread_id), reg);
++
++	/*
++	 * Mask all RO's initially so that unused thread doesn't contribute
++	 * to closed-loop voltage.
++	 */
++	cpr3_write(thread->ctrl, CPR3_REG_RO_MASK(thread->thread_id),
++		CPR3_RO_MASK);
++
++	return 0;
++}
++
++/**
++ * cpr4_regulator_init_temp_points() - performs hardware initialization of CPR4
++ *		registers to track tsen temperature data and also specify the
++ *		temperature band range values to apply different voltage margins
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * CPR interface/bus clocks must be enabled before calling this function.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_regulator_init_temp_points(struct cpr3_controller *ctrl)
++{
++	if (!ctrl->allow_temp_adj)
++		return 0;
++
++	cpr3_masked_write(ctrl, CPR4_REG_MISC,
++				CPR4_MISC_TEMP_SENSOR_ID_START_MASK,
++				ctrl->temp_sensor_id_start
++				<< CPR4_MISC_TEMP_SENSOR_ID_START_SHIFT);
++
++	cpr3_masked_write(ctrl, CPR4_REG_MISC,
++				CPR4_MISC_TEMP_SENSOR_ID_END_MASK,
++				ctrl->temp_sensor_id_end
++				<< CPR4_MISC_TEMP_SENSOR_ID_END_SHIFT);
++
++	cpr3_masked_write(ctrl, CPR4_REG_MARGIN_TEMP_POINT2,
++		CPR4_MARGIN_TEMP_POINT2_MASK,
++		(ctrl->temp_band_count == 4 ? ctrl->temp_points[2] : 0x7FF)
++		<< CPR4_MARGIN_TEMP_POINT2_SHIFT);
++
++	cpr3_masked_write(ctrl, CPR4_REG_MARGIN_TEMP_POINT0N1,
++		CPR4_MARGIN_TEMP_POINT1_MASK,
++		(ctrl->temp_band_count >= 3 ? ctrl->temp_points[1] : 0x7FF)
++		<< CPR4_MARGIN_TEMP_POINT1_SHIFT);
++
++	cpr3_masked_write(ctrl, CPR4_REG_MARGIN_TEMP_POINT0N1,
++		CPR4_MARGIN_TEMP_POINT0_MASK,
++		(ctrl->temp_band_count >= 2 ? ctrl->temp_points[0] : 0x7FF)
++		<< CPR4_MARGIN_TEMP_POINT0_SHIFT);
++	return 0;
++}
++
++/**
++ * cpr3_regulator_init_cpr4() - performs hardware initialization at the
++ *		controller and thread level required for CPR4 operation.
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * CPR interface/bus clocks must be enabled before calling this function.
++ * This function allocates sdelta structures and sdelta tables for aggregated
++ * corners of the controller and its threads.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_init_cpr4(struct cpr3_controller *ctrl)
++{
++	struct cpr3_thread *thread;
++	struct cpr3_regulator *vreg;
++	struct cpr4_sdelta *sdelta;
++	int i, j, ctrl_max_core_count, thread_max_core_count, rc = 0;
++	bool ctrl_valid_sdelta, thread_valid_sdelta;
++	u32 pmic_step_size = 1;
++	int thread_id = 0;
++	u64 temp;
++
++	if (ctrl->supports_hw_closed_loop) {
++		if (ctrl->saw_use_unit_mV)
++			pmic_step_size = ctrl->step_volt / 1000;
++		cpr3_masked_write(ctrl, CPR4_REG_MARGIN_ADJ_CTL,
++				  CPR4_MARGIN_ADJ_CTL_PMIC_STEP_SIZE_MASK,
++				  (pmic_step_size
++				  << CPR4_MARGIN_ADJ_CTL_PMIC_STEP_SIZE_SHIFT));
++
++		cpr3_masked_write(ctrl, CPR4_REG_SAW_ERROR_STEP_LIMIT,
++				  CPR4_SAW_ERROR_STEP_LIMIT_DN_MASK,
++				  (ctrl->down_error_step_limit
++					<< CPR4_SAW_ERROR_STEP_LIMIT_DN_SHIFT));
++
++		cpr3_masked_write(ctrl, CPR4_REG_SAW_ERROR_STEP_LIMIT,
++				  CPR4_SAW_ERROR_STEP_LIMIT_UP_MASK,
++				  (ctrl->up_error_step_limit
++					<< CPR4_SAW_ERROR_STEP_LIMIT_UP_SHIFT));
++
++		/*
++		 * Enable thread aggregation regardless of which threads are
++		 * enabled or disabled.
++		 */
++		cpr3_masked_write(ctrl, CPR4_REG_CPR_TIMER_CLAMP,
++				  CPR4_CPR_TIMER_CLAMP_THREAD_AGGREGATION_EN,
++				  CPR4_CPR_TIMER_CLAMP_THREAD_AGGREGATION_EN);
++
++		switch (ctrl->thread_count) {
++		case 0:
++			/* Disable both threads */
++			cpr3_masked_write(ctrl, CPR4_REG_CPR_MASK_THREAD(0),
++				CPR4_CPR_MASK_THREAD_DISABLE_THREAD
++				    | CPR4_CPR_MASK_THREAD_RO_MASK4THREAD_MASK,
++				CPR4_CPR_MASK_THREAD_DISABLE_THREAD
++				    | CPR4_CPR_MASK_THREAD_RO_MASK4THREAD_MASK);
++
++			cpr3_masked_write(ctrl, CPR4_REG_CPR_MASK_THREAD(1),
++				CPR4_CPR_MASK_THREAD_DISABLE_THREAD
++				    | CPR4_CPR_MASK_THREAD_RO_MASK4THREAD_MASK,
++				CPR4_CPR_MASK_THREAD_DISABLE_THREAD
++				    | CPR4_CPR_MASK_THREAD_RO_MASK4THREAD_MASK);
++			break;
++		case 1:
++			/* Disable unused thread */
++			thread_id = ctrl->thread[0].thread_id ? 0 : 1;
++			cpr3_masked_write(ctrl,
++				CPR4_REG_CPR_MASK_THREAD(thread_id),
++				CPR4_CPR_MASK_THREAD_DISABLE_THREAD
++				    | CPR4_CPR_MASK_THREAD_RO_MASK4THREAD_MASK,
++				CPR4_CPR_MASK_THREAD_DISABLE_THREAD
++				    | CPR4_CPR_MASK_THREAD_RO_MASK4THREAD_MASK);
++			break;
++		}
++	}
++
++	if (!ctrl->allow_core_count_adj && !ctrl->allow_temp_adj
++		&& !ctrl->allow_boost) {
++		/*
++		 * Skip below configuration as none of the features
++		 * are enabled.
++		 */
++		return rc;
++	}
++
++	if (ctrl->supports_hw_closed_loop)
++		cpr3_masked_write(ctrl, CPR4_REG_MARGIN_ADJ_CTL,
++				  CPR4_MARGIN_ADJ_CTL_TIMER_SETTLE_VOLTAGE_EN,
++				  CPR4_MARGIN_ADJ_CTL_TIMER_SETTLE_VOLTAGE_EN);
++
++	cpr3_masked_write(ctrl, CPR4_REG_MARGIN_ADJ_CTL,
++			CPR4_MARGIN_ADJ_CTL_KV_MARGIN_ADJ_STEP_QUOT_MASK,
++			ctrl->step_quot_fixed
++			<< CPR4_MARGIN_ADJ_CTL_KV_MARGIN_ADJ_STEP_QUOT_SHIFT);
++
++	cpr3_masked_write(ctrl, CPR4_REG_MARGIN_ADJ_CTL,
++			CPR4_MARGIN_ADJ_CTL_PER_RO_KV_MARGIN_EN,
++			(ctrl->use_dynamic_step_quot
++			? CPR4_MARGIN_ADJ_CTL_PER_RO_KV_MARGIN_EN : 0));
++
++	cpr3_masked_write(ctrl, CPR4_REG_MARGIN_ADJ_CTL,
++			CPR4_MARGIN_ADJ_CTL_INITIAL_TEMP_BAND_MASK,
++			ctrl->initial_temp_band
++			<< CPR4_MARGIN_ADJ_CTL_INITIAL_TEMP_BAND_SHIFT);
++
++	rc = cpr4_regulator_init_temp_points(ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "initialize temp points failed, rc=%d\n", rc);
++		return rc;
++	}
++
++	if (ctrl->voltage_settling_time) {
++		/*
++		 * Configure the settling timer used to account for
++		 * one VDD supply step.
++		 */
++		temp = (u64)ctrl->cpr_clock_rate
++				* (u64)ctrl->voltage_settling_time;
++		do_div(temp, 1000000000);
++		cpr3_masked_write(ctrl, CPR4_REG_MARGIN_TEMP_CORE_TIMERS,
++			CPR4_MARGIN_TEMP_CORE_TIMERS_SETTLE_VOLTAGE_COUNT_MASK,
++			temp
++		    << CPR4_MARGIN_TEMP_CORE_TIMERS_SETTLE_VOLTAGE_COUNT_SHIFT);
++	}
++
++	/*
++	 * Allocate memory for cpr4_sdelta structure and sdelta table for
++	 * controller aggregated corner by finding the maximum core count
++	 * used by any cpr3 regulators.
++	 */
++	ctrl_max_core_count = 1;
++	ctrl_valid_sdelta = false;
++	for (i = 0; i < ctrl->thread_count; i++) {
++		thread = &ctrl->thread[i];
++
++		/*
++		 * Allocate memory for cpr4_sdelta structure and sdelta table
++		 * for thread aggregated corner by finding the maximum core
++		 * count used by any cpr3 regulators of the thread.
++		 */
++		thread_max_core_count = 1;
++		thread_valid_sdelta = false;
++		for (j = 0; j < thread->vreg_count; j++) {
++			vreg = &thread->vreg[j];
++			thread_max_core_count = max(thread_max_core_count,
++							vreg->max_core_count);
++			thread_valid_sdelta |= (vreg->allow_core_count_adj
++							| vreg->allow_temp_adj
++							| vreg->allow_boost);
++		}
++		if (thread_valid_sdelta) {
++			sdelta = devm_kzalloc(ctrl->dev, sizeof(*sdelta),
++					GFP_KERNEL);
++			if (!sdelta)
++				return -ENOMEM;
++
++			sdelta->table = devm_kcalloc(ctrl->dev,
++						thread_max_core_count
++						* ctrl->temp_band_count,
++						sizeof(*sdelta->table),
++						GFP_KERNEL);
++			if (!sdelta->table)
++				return -ENOMEM;
++
++			sdelta->boost_table = devm_kcalloc(ctrl->dev,
++						ctrl->temp_band_count,
++						sizeof(*sdelta->boost_table),
++						GFP_KERNEL);
++			if (!sdelta->boost_table)
++				return -ENOMEM;
++
++			thread->aggr_corner.sdelta = sdelta;
++		}
++
++		ctrl_valid_sdelta |= thread_valid_sdelta;
++		ctrl_max_core_count = max(ctrl_max_core_count,
++						thread_max_core_count);
++	}
++
++	if (ctrl_valid_sdelta) {
++		sdelta = devm_kzalloc(ctrl->dev, sizeof(*sdelta), GFP_KERNEL);
++		if (!sdelta)
++			return -ENOMEM;
++
++		sdelta->table = devm_kcalloc(ctrl->dev, ctrl_max_core_count
++					* ctrl->temp_band_count,
++					sizeof(*sdelta->table), GFP_KERNEL);
++		if (!sdelta->table)
++			return -ENOMEM;
++
++		sdelta->boost_table = devm_kcalloc(ctrl->dev,
++					ctrl->temp_band_count,
++					sizeof(*sdelta->boost_table),
++					GFP_KERNEL);
++		if (!sdelta->boost_table)
++			return -ENOMEM;
++
++		ctrl->aggr_corner.sdelta = sdelta;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_write_temp_core_margin() - programs hardware SDELTA registers with
++ *		the voltage margin adjustments that need to be applied for
++ *		different online core-count and temperature bands.
++ * @ctrl:		Pointer to the CPR3 controller
++ * @addr:		SDELTA register address
++ * @temp_core_adj:	Array of voltage margin values for different temperature
++ *			bands.
++ *
++ * CPR interface/bus clocks must be enabled before calling this function.
++ *
++ * Return: none
++ */
++static void cpr3_write_temp_core_margin(struct cpr3_controller *ctrl,
++				 int addr, int *temp_core_adj)
++{
++	int i, margin_steps;
++	u32 reg = 0;
++
++	for (i = 0; i < ctrl->temp_band_count; i++) {
++		margin_steps = max(min(temp_core_adj[i], 127), -128);
++		reg |= (margin_steps & CPR4_MARGIN_TEMP_CORE_ADJ_MASK) <<
++			(i * CPR4_MARGIN_TEMP_CORE_ADJ_SHIFT);
++	}
++
++	cpr3_write(ctrl, addr, reg);
++	cpr3_debug(ctrl, "sdelta offset=0x%08x, val=0x%08x\n", addr, reg);
++}
++
++/**
++ * cpr3_controller_program_sdelta() - programs hardware SDELTA registers with
++ *		the voltage margin adjustments that need to be applied at
++ *		different online core-count and temperature bands. Also,
++ *		programs hardware register configuration for per-online-core
++ *		and per-temperature based adjustments.
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * CPR interface/bus clocks must be enabled before calling this function.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_controller_program_sdelta(struct cpr3_controller *ctrl)
++{
++	struct cpr3_corner *corner = &ctrl->aggr_corner;
++	struct cpr4_sdelta *sdelta = corner->sdelta;
++	int i, index, max_core_count, rc = 0;
++	bool cpr_enabled = ctrl->cpr_enabled;
++
++	if (!sdelta)
++		/* cpr4_sdelta not defined for current aggregated corner */
++		return 0;
++
++	if (ctrl->supports_hw_closed_loop && ctrl->cpr_enabled) {
++		cpr3_masked_write(ctrl, CPR4_REG_MARGIN_ADJ_CTL,
++			CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_EN_MASK,
++			(ctrl->use_hw_closed_loop && !sdelta->allow_boost)
++			? CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_ENABLE : 0);
++	}
++
++	if (!sdelta->allow_core_count_adj && !sdelta->allow_temp_adj
++		&& !sdelta->allow_boost) {
++		/*
++		 * Per-online-core, per-temperature and voltage boost
++		 * adjustments are disabled for this aggregation corner.
++		 */
++		return 0;
++	}
++
++	/* Ensure that CPR clocks are enabled before writing to registers. */
++	if (!cpr_enabled) {
++		rc = cpr3_clock_enable(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "clock enable failed, rc=%d\n", rc);
++			return rc;
++		}
++		ctrl->cpr_enabled = true;
++	}
++
++	max_core_count = sdelta->max_core_count;
++
++	if (sdelta->allow_core_count_adj || sdelta->allow_temp_adj) {
++		if (sdelta->allow_core_count_adj) {
++			/* Program TEMP_CORE0 to same margins as TEMP_CORE1 */
++			cpr3_write_temp_core_margin(ctrl,
++				CPR4_REG_MARGIN_TEMP_CORE(0),
++				&sdelta->table[0]);
++		}
++
++		for (i = 0; i < max_core_count; i++) {
++			index = i * sdelta->temp_band_count;
++			/*
++			 * Program TEMP_COREi with voltage margin adjustments
++			 * that need to be applied when the number of cores
++			 * becomes i.
++			 */
++			cpr3_write_temp_core_margin(ctrl,
++				CPR4_REG_MARGIN_TEMP_CORE(
++						sdelta->allow_core_count_adj
++						? i + 1 : max_core_count),
++						&sdelta->table[index]);
++		}
++	}
++
++	if (sdelta->allow_boost) {
++		/* Program only boost_num_cores row of SDELTA */
++		cpr3_write_temp_core_margin(ctrl,
++			CPR4_REG_MARGIN_TEMP_CORE(sdelta->boost_num_cores),
++					&sdelta->boost_table[0]);
++	}
++
++	if (!sdelta->allow_core_count_adj && !sdelta->allow_boost) {
++		cpr3_masked_write(ctrl, CPR4_REG_MISC,
++			CPR4_MISC_MARGIN_TABLE_ROW_SELECT_MASK,
++			max_core_count
++			<< CPR4_MISC_MARGIN_TABLE_ROW_SELECT_SHIFT);
++	}
++
++	cpr3_masked_write(ctrl, CPR4_REG_MARGIN_ADJ_CTL,
++		CPR4_MARGIN_ADJ_CTL_MAX_NUM_CORES_MASK
++		| CPR4_MARGIN_ADJ_CTL_CORE_ADJ_EN
++		| CPR4_MARGIN_ADJ_CTL_TEMP_ADJ_EN
++		| CPR4_MARGIN_ADJ_CTL_KV_MARGIN_ADJ_EN
++		| CPR4_MARGIN_ADJ_CTL_BOOST_EN,
++		max_core_count << CPR4_MARGIN_ADJ_CTL_MAX_NUM_CORES_SHIFT
++		| ((sdelta->allow_core_count_adj || sdelta->allow_boost)
++			? CPR4_MARGIN_ADJ_CTL_CORE_ADJ_EN : 0)
++		| ((sdelta->allow_temp_adj && ctrl->supports_hw_closed_loop)
++			? CPR4_MARGIN_ADJ_CTL_TEMP_ADJ_EN : 0)
++		| (((ctrl->use_hw_closed_loop && !sdelta->allow_boost)
++		    || !ctrl->supports_hw_closed_loop)
++			? CPR4_MARGIN_ADJ_CTL_KV_MARGIN_ADJ_EN : 0)
++		| (sdelta->allow_boost
++			?  CPR4_MARGIN_ADJ_CTL_BOOST_EN : 0));
++
++	/*
++	 * Ensure that all previous CPR register writes have completed before
++	 * continuing.
++	 */
++	mb();
++
++	/* Turn off CPR clocks if they were off before this function call. */
++	if (!cpr_enabled) {
++		cpr3_clock_disable(ctrl);
++		ctrl->cpr_enabled = false;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_regulator_init_ctrl() - performs hardware initialization of CPR
++ *		controller registers
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_init_ctrl(struct cpr3_controller *ctrl)
++{
++	int i, j, k, m, rc;
++	u32 ro_used = 0;
++	u32 gcnt, cont_dly, up_down_dly, val;
++	u64 temp;
++	char *mode;
++
++	if (ctrl->core_clk) {
++		rc = clk_set_rate(ctrl->core_clk, ctrl->cpr_clock_rate);
++		if (rc) {
++			cpr3_err(ctrl, "clk_set_rate(core_clk, %u) failed, rc=%d\n",
++				ctrl->cpr_clock_rate, rc);
++			return rc;
++		}
++	}
++
++	rc = cpr3_clock_enable(ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "clock enable failed, rc=%d\n", rc);
++		return rc;
++	}
++	ctrl->cpr_enabled = true;
++
++	/* Find all RO's used by any corner of any regulator. */
++	for (i = 0; i < ctrl->thread_count; i++)
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++)
++			for (k = 0; k < ctrl->thread[i].vreg[j].corner_count;
++			     k++)
++				for (m = 0; m < CPR3_RO_COUNT; m++)
++					if (ctrl->thread[i].vreg[j].corner[k].
++					    target_quot[m])
++						ro_used |= BIT(m);
++
++	/* Configure the GCNT of the RO's that will be used */
++	gcnt = cpr3_regulator_get_gcnt(ctrl);
++	for (i = 0; i < CPR3_RO_COUNT; i++)
++		if (ro_used & BIT(i))
++			cpr3_write(ctrl, CPR3_REG_GCNT(i), gcnt);
++
++	/* Configure the loop delay time */
++	temp = (u64)ctrl->cpr_clock_rate * (u64)ctrl->loop_time;
++	do_div(temp, 1000000000);
++	cont_dly = temp;
++	if (ctrl->supports_hw_closed_loop
++		&& ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3)
++		cpr3_write(ctrl, CPR3_REG_CPR_TIMER_MID_CONT, cont_dly);
++	else
++		cpr3_write(ctrl, CPR3_REG_CPR_TIMER_AUTO_CONT, cont_dly);
++
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3) {
++		temp = (u64)ctrl->cpr_clock_rate *
++				(u64)ctrl->up_down_delay_time;
++		do_div(temp, 1000000000);
++		up_down_dly = temp;
++		if (ctrl->supports_hw_closed_loop)
++			cpr3_write(ctrl, CPR3_REG_CPR_TIMER_UP_DN_CONT,
++				up_down_dly);
++		cpr3_debug(ctrl, "up_down_dly=%u, up_down_delay_time=%u ns\n",
++			up_down_dly, ctrl->up_down_delay_time);
++	}
++
++	cpr3_debug(ctrl, "cpr_clock_rate=%u HZ, sensor_time=%u ns, loop_time=%u ns, gcnt=%u, cont_dly=%u\n",
++		ctrl->cpr_clock_rate, ctrl->sensor_time, ctrl->loop_time,
++		gcnt, cont_dly);
++
++	/* Configure CPR sensor operation */
++	val = (ctrl->idle_clocks << CPR3_CPR_CTL_IDLE_CLOCKS_SHIFT)
++		& CPR3_CPR_CTL_IDLE_CLOCKS_MASK;
++	val |= (ctrl->count_mode << CPR3_CPR_CTL_COUNT_MODE_SHIFT)
++		& CPR3_CPR_CTL_COUNT_MODE_MASK;
++	val |= (ctrl->count_repeat << CPR3_CPR_CTL_COUNT_REPEAT_SHIFT)
++		& CPR3_CPR_CTL_COUNT_REPEAT_MASK;
++	cpr3_write(ctrl, CPR3_REG_CPR_CTL, val);
++
++	cpr3_debug(ctrl, "idle_clocks=%u, count_mode=%u, count_repeat=%u; CPR_CTL=0x%08X\n",
++		ctrl->idle_clocks, ctrl->count_mode, ctrl->count_repeat, val);
++
++	/* Configure CPR default step quotients */
++	val = (ctrl->step_quot_init_min << CPR3_CPR_STEP_QUOT_MIN_SHIFT)
++		& CPR3_CPR_STEP_QUOT_MIN_MASK;
++	val |= (ctrl->step_quot_init_max << CPR3_CPR_STEP_QUOT_MAX_SHIFT)
++		& CPR3_CPR_STEP_QUOT_MAX_MASK;
++	cpr3_write(ctrl, CPR3_REG_CPR_STEP_QUOT, val);
++
++	cpr3_debug(ctrl, "step_quot_min=%u, step_quot_max=%u; STEP_QUOT=0x%08X\n",
++		ctrl->step_quot_init_min, ctrl->step_quot_init_max, val);
++
++	/* Configure the CPR sensor ownership */
++	for (i = 0; i < ctrl->sensor_count; i++)
++		cpr3_write(ctrl, CPR3_REG_SENSOR_OWNER(i),
++			   ctrl->sensor_owner[i]);
++
++	/* Configure per-thread registers */
++	for (i = 0; i < ctrl->thread_count; i++) {
++		rc = cpr3_regulator_init_thread(&ctrl->thread[i]);
++		if (rc) {
++			cpr3_err(ctrl, "CPR thread register initialization failed, rc=%d\n",
++				rc);
++			return rc;
++		}
++	}
++
++	if (ctrl->supports_hw_closed_loop) {
++		if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++			cpr3_masked_write(ctrl, CPR4_REG_MARGIN_ADJ_CTL,
++				CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_EN_MASK,
++				ctrl->use_hw_closed_loop
++				? CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_ENABLE
++				: CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_DISABLE);
++		} else if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3) {
++			cpr3_write(ctrl, CPR3_REG_HW_CLOSED_LOOP,
++				ctrl->use_hw_closed_loop
++				? CPR3_HW_CLOSED_LOOP_ENABLE
++				: CPR3_HW_CLOSED_LOOP_DISABLE);
++
++			cpr3_debug(ctrl, "PD_THROTTLE=0x%08X\n",
++				ctrl->proc_clock_throttle);
++		}
++
++		if ((ctrl->use_hw_closed_loop ||
++		     ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) &&
++		    ctrl->vdd_limit_regulator) {
++			rc = regulator_enable(ctrl->vdd_limit_regulator);
++			if (rc) {
++				cpr3_err(ctrl, "CPR limit regulator enable failed, rc=%d\n",
++					rc);
++				return rc;
++			}
++		}
++	}
++
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++		rc = cpr3_regulator_init_cpr4(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "CPR4-specific controller initialization failed, rc=%d\n",
++				rc);
++			return rc;
++		}
++	}
++
++	/* Ensure that all register writes complete before disabling clocks. */
++	wmb();
++
++	cpr3_clock_disable(ctrl);
++	ctrl->cpr_enabled = false;
++
++	if (!ctrl->cpr_allowed_sw || !ctrl->cpr_allowed_hw)
++		mode = "open-loop";
++	else if (ctrl->supports_hw_closed_loop)
++		mode = ctrl->use_hw_closed_loop
++			? "HW closed-loop" : "SW closed-loop";
++	else
++		mode = "closed-loop";
++
++	cpr3_info(ctrl, "Default CPR mode = %s", mode);
++
++	return 0;
++}
++
++/**
++ * cpr3_regulator_set_target_quot() - configure the target quotient for each
++ *		RO of the CPR3 thread and set the RO mask
++ * @thread:		Pointer to the CPR3 thread
++ *
++ * Return: none
++ */
++static void cpr3_regulator_set_target_quot(struct cpr3_thread *thread)
++{
++	u32 new_quot, last_quot;
++	int i;
++
++	if (thread->aggr_corner.ro_mask == CPR3_RO_MASK
++	    && thread->last_closed_loop_aggr_corner.ro_mask == CPR3_RO_MASK) {
++		/* Avoid writing target quotients since all RO's are masked. */
++		return;
++	} else if (thread->aggr_corner.ro_mask == CPR3_RO_MASK) {
++		cpr3_write(thread->ctrl, CPR3_REG_RO_MASK(thread->thread_id),
++			CPR3_RO_MASK);
++		thread->last_closed_loop_aggr_corner.ro_mask = CPR3_RO_MASK;
++		/*
++		 * Only the RO_MASK register needs to be written since all
++		 * RO's are masked.
++		 */
++		return;
++	} else if (thread->aggr_corner.ro_mask
++			!= thread->last_closed_loop_aggr_corner.ro_mask) {
++		cpr3_write(thread->ctrl, CPR3_REG_RO_MASK(thread->thread_id),
++			thread->aggr_corner.ro_mask);
++	}
++
++	for (i = 0; i < CPR3_RO_COUNT; i++) {
++		new_quot = thread->aggr_corner.target_quot[i];
++		last_quot = thread->last_closed_loop_aggr_corner.target_quot[i];
++		if (new_quot != last_quot)
++			cpr3_write(thread->ctrl,
++				CPR3_REG_TARGET_QUOT(thread->thread_id, i),
++				new_quot);
++	}
++
++	thread->last_closed_loop_aggr_corner = thread->aggr_corner;
++
++	return;
++}
++
++/**
++ * cpr3_update_vreg_closed_loop_volt() - update the last known settled
++ *		closed loop voltage for a CPR3 regulator
++ * @vreg:		Pointer to the CPR3 regulator
++ * @vdd_volt:		Last known settled voltage in microvolts for the
++ *			VDD supply
++ * @reg_last_measurement: Value read from the LAST_MEASUREMENT register
++ *
++ * Return: none
++ */
++static void cpr3_update_vreg_closed_loop_volt(struct cpr3_regulator *vreg,
++				int vdd_volt, u32 reg_last_measurement)
++{
++	bool step_dn, step_up, aggr_step_up, aggr_step_dn, aggr_step_mid;
++	bool valid, pd_valid, saw_error;
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	struct cpr3_corner *corner;
++	u32 id;
++
++	if (vreg->last_closed_loop_corner == CPR3_REGULATOR_CORNER_INVALID)
++		return;
++	else
++		corner = &vreg->corner[vreg->last_closed_loop_corner];
++
++	if (vreg->thread->last_closed_loop_aggr_corner.ro_mask
++	    == CPR3_RO_MASK  || !vreg->aggregated) {
++		return;
++	} else if (!ctrl->cpr_enabled || !ctrl->last_corner_was_closed_loop) {
++		return;
++	} else if (ctrl->thread_count == 1
++		 && vdd_volt >= corner->floor_volt
++		 && vdd_volt <= corner->ceiling_volt) {
++		corner->last_volt = vdd_volt;
++		cpr3_debug(vreg, "last_volt updated: last_volt[%d]=%d, ceiling_volt[%d]=%d, floor_volt[%d]=%d\n",
++			   vreg->last_closed_loop_corner, corner->last_volt,
++			   vreg->last_closed_loop_corner,
++			   corner->ceiling_volt,
++			   vreg->last_closed_loop_corner,
++			   corner->floor_volt);
++		return;
++	} else if (!ctrl->supports_hw_closed_loop) {
++		return;
++	} else if (ctrl->ctrl_type != CPR_CTRL_TYPE_CPR3) {
++		corner->last_volt = vdd_volt;
++		cpr3_debug(vreg, "last_volt updated: last_volt[%d]=%d, ceiling_volt[%d]=%d, floor_volt[%d]=%d\n",
++			   vreg->last_closed_loop_corner, corner->last_volt,
++			   vreg->last_closed_loop_corner,
++			   corner->ceiling_volt,
++			   vreg->last_closed_loop_corner,
++			   corner->floor_volt);
++		return;
++	}
++
++	/* CPR clocks are on and HW closed loop is supported */
++	valid = !!(reg_last_measurement & CPR3_LAST_MEASUREMENT_VALID);
++	if (!valid) {
++		cpr3_debug(vreg, "CPR_LAST_VALID_MEASUREMENT=0x%X valid bit not set\n",
++			   reg_last_measurement);
++		return;
++	}
++
++	id = vreg->thread->thread_id;
++
++	step_dn
++	       = !!(reg_last_measurement & CPR3_LAST_MEASUREMENT_THREAD_DN(id));
++	step_up
++	       = !!(reg_last_measurement & CPR3_LAST_MEASUREMENT_THREAD_UP(id));
++	aggr_step_dn = !!(reg_last_measurement & CPR3_LAST_MEASUREMENT_AGGR_DN);
++	aggr_step_mid
++		= !!(reg_last_measurement & CPR3_LAST_MEASUREMENT_AGGR_MID);
++	aggr_step_up = !!(reg_last_measurement & CPR3_LAST_MEASUREMENT_AGGR_UP);
++	saw_error = !!(reg_last_measurement & CPR3_LAST_MEASUREMENT_SAW_ERROR);
++	pd_valid
++	     = !((((reg_last_measurement & CPR3_LAST_MEASUREMENT_PD_BYPASS_MASK)
++		       >> CPR3_LAST_MEASUREMENT_PD_BYPASS_SHIFT)
++		      & vreg->pd_bypass_mask) == vreg->pd_bypass_mask);
++
++	if (!pd_valid) {
++		cpr3_debug(vreg, "CPR_LAST_VALID_MEASUREMENT=0x%X, all power domains bypassed\n",
++			   reg_last_measurement);
++		return;
++	} else if (step_dn && step_up) {
++		cpr3_err(vreg, "both up and down status bits set, CPR_LAST_VALID_MEASUREMENT=0x%X\n",
++			 reg_last_measurement);
++		return;
++	} else if (aggr_step_dn && step_dn && vdd_volt < corner->last_volt
++		   && vdd_volt >= corner->floor_volt) {
++		corner->last_volt = vdd_volt;
++	} else if (aggr_step_up && step_up && vdd_volt > corner->last_volt
++		   && vdd_volt <= corner->ceiling_volt) {
++		corner->last_volt = vdd_volt;
++	} else if (aggr_step_mid
++		   && vdd_volt >= corner->floor_volt
++		   && vdd_volt <= corner->ceiling_volt) {
++		corner->last_volt = vdd_volt;
++	} else if (saw_error && (vdd_volt == corner->ceiling_volt
++				 || vdd_volt == corner->floor_volt)) {
++		corner->last_volt = vdd_volt;
++	} else {
++		cpr3_debug(vreg, "last_volt not updated: last_volt[%d]=%d, ceiling_volt[%d]=%d, floor_volt[%d]=%d, vdd_volt=%d, CPR_LAST_VALID_MEASUREMENT=0x%X\n",
++			   vreg->last_closed_loop_corner, corner->last_volt,
++			   vreg->last_closed_loop_corner,
++			   corner->ceiling_volt,
++			   vreg->last_closed_loop_corner, corner->floor_volt,
++			   vdd_volt, reg_last_measurement);
++		return;
++	}
++
++	cpr3_debug(vreg, "last_volt updated: last_volt[%d]=%d, ceiling_volt[%d]=%d, floor_volt[%d]=%d, CPR_LAST_VALID_MEASUREMENT=0x%X\n",
++		   vreg->last_closed_loop_corner, corner->last_volt,
++		   vreg->last_closed_loop_corner, corner->ceiling_volt,
++		   vreg->last_closed_loop_corner, corner->floor_volt,
++		   reg_last_measurement);
++}
++
++/**
++ * cpr3_regulator_mem_acc_bhs_used() - determines if mem-acc regulators powered
++ *		through a BHS are associated with the CPR3 controller or any of
++ *		the CPR3 regulators it controls.
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * This function determines if the CPR3 controller or any of its CPR3 regulators
++ * need to manage mem-acc regulators that are currently powered through a BHS
++ * and whose corner selection is based upon a particular voltage threshold.
++ *
++ * Return: true or false
++ */
++static bool cpr3_regulator_mem_acc_bhs_used(struct cpr3_controller *ctrl)
++{
++	struct cpr3_regulator *vreg;
++	int i, j;
++
++	if (!ctrl->mem_acc_threshold_volt)
++		return false;
++
++	if (ctrl->mem_acc_regulator)
++		return true;
++
++	for (i = 0; i < ctrl->thread_count; i++) {
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++			vreg = &ctrl->thread[i].vreg[j];
++
++			if (vreg->mem_acc_regulator)
++				return true;
++		}
++	}
++
++	return false;
++}
++
++/**
++ * cpr3_regulator_config_bhs_mem_acc() - configure the mem-acc regulator
++ *		settings for hardware blocks currently powered through the BHS.
++ * @ctrl:		Pointer to the CPR3 controller
++ * @new_volt:		New voltage in microvolts that VDD supply needs to
++ *			end up at
++ * @last_volt:		Pointer to the last known voltage in microvolts for the
++ *			VDD supply
++ * @aggr_corner:	Pointer to the CPR3 corner which corresponds to the max
++ *			corner aggregated from all CPR3 threads managed by the
++ *			CPR3 controller
++ *
++ * This function programs the mem-acc regulator corners for CPR3 regulators
++ * whose LDO regulators are in bypassed state. The function also handles
++ * CPR3 controllers which utilize mem-acc regulators that operate independently
++ * from the LDO hardware and that must be programmed when the VDD supply
++ * crosses a particular voltage threshold.
++ *
++ * Return: 0 on success, errno on failure. If the VDD supply voltage is
++ * modified, last_volt is updated to reflect the new voltage setpoint.
++ */
++static int cpr3_regulator_config_bhs_mem_acc(struct cpr3_controller *ctrl,
++				     int new_volt, int *last_volt,
++				     struct cpr3_corner *aggr_corner)
++{
++	struct cpr3_regulator *vreg;
++	int i, j, rc, mem_acc_corn, safe_volt;
++	int mem_acc_volt = ctrl->mem_acc_threshold_volt;
++	int ref_volt;
++
++	if (!cpr3_regulator_mem_acc_bhs_used(ctrl))
++		return 0;
++
++	ref_volt = ctrl->use_hw_closed_loop ? aggr_corner->floor_volt :
++		new_volt;
++
++	if (((*last_volt < mem_acc_volt && mem_acc_volt <= ref_volt) ||
++	     (*last_volt >= mem_acc_volt && mem_acc_volt > ref_volt))) {
++		if (ref_volt < *last_volt)
++			safe_volt = max(mem_acc_volt, aggr_corner->last_volt);
++		else
++			safe_volt = max(mem_acc_volt, *last_volt);
++
++		rc = regulator_set_voltage(ctrl->vdd_regulator, safe_volt,
++					   new_volt < *last_volt ?
++					   ctrl->aggr_corner.ceiling_volt :
++					   new_volt);
++		if (rc) {
++			cpr3_err(ctrl, "regulator_set_voltage(vdd) == %d failed, rc=%d\n",
++				 safe_volt, rc);
++			return rc;
++		}
++
++		*last_volt = safe_volt;
++
++		mem_acc_corn = ref_volt < mem_acc_volt ?
++			ctrl->mem_acc_corner_map[CPR3_MEM_ACC_LOW_CORNER] :
++			ctrl->mem_acc_corner_map[CPR3_MEM_ACC_HIGH_CORNER];
++
++		if (ctrl->mem_acc_regulator) {
++			rc = regulator_set_voltage(ctrl->mem_acc_regulator,
++						   mem_acc_corn, mem_acc_corn);
++			if (rc) {
++				cpr3_err(ctrl, "regulator_set_voltage(mem_acc) == %d failed, rc=%d\n",
++					 mem_acc_corn, rc);
++				return rc;
++			}
++		}
++
++		for (i = 0; i < ctrl->thread_count; i++) {
++			for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++				vreg = &ctrl->thread[i].vreg[j];
++
++				if (!vreg->mem_acc_regulator)
++					continue;
++
++				rc = regulator_set_voltage(
++					vreg->mem_acc_regulator, mem_acc_corn,
++					mem_acc_corn);
++				if (rc) {
++					cpr3_err(vreg, "regulator_set_voltage(mem_acc) == %d failed, rc=%d\n",
++						 mem_acc_corn, rc);
++					return rc;
++				}
++			}
++		}
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_regulator_switch_apm_mode() - switch the mode of the APM controller
++ *		associated with a given CPR3 controller
++ * @ctrl:		Pointer to the CPR3 controller
++ * @new_volt:		New voltage in microvolts that VDD supply needs to
++ *			end up at
++ * @last_volt:		Pointer to the last known voltage in microvolts for the
++ *			VDD supply
++ * @aggr_corner:	Pointer to the CPR3 corner which corresponds to the max
++ *			corner aggregated from all CPR3 threads managed by the
++ *			CPR3 controller
++ *
++ * This function requests a switch of the APM mode while guaranteeing
++ * any LDO regulator hardware requirements are satisfied. The function must
++ * be called once it is known a new VDD supply setpoint crosses the APM
++ * voltage threshold.
++ *
++ * Return: 0 on success, errno on failure. If the VDD supply voltage is
++ * modified, last_volt is updated to reflect the new voltage setpoint.
++ */
++static int cpr3_regulator_switch_apm_mode(struct cpr3_controller *ctrl,
++					  int new_volt, int *last_volt,
++					  struct cpr3_corner *aggr_corner)
++{
++	struct regulator *vdd = ctrl->vdd_regulator;
++	int apm_volt = ctrl->apm_threshold_volt;
++	int orig_last_volt = *last_volt;
++	int rc;
++
++	rc = regulator_set_voltage(vdd, apm_volt, apm_volt);
++	if (rc) {
++		cpr3_err(ctrl, "regulator_set_voltage(vdd) == %d failed, rc=%d\n",
++			 apm_volt, rc);
++		return rc;
++	}
++
++	*last_volt = apm_volt;
++
++	rc = msm_apm_set_supply(ctrl->apm, new_volt >= apm_volt
++				? ctrl->apm_high_supply : ctrl->apm_low_supply);
++	if (rc) {
++		cpr3_err(ctrl, "APM switch failed, rc=%d\n", rc);
++		/* Roll back the voltage. */
++		regulator_set_voltage(vdd, orig_last_volt, INT_MAX);
++		*last_volt = orig_last_volt;
++		return rc;
++	}
++	return 0;
++}
++
++/**
++ * cpr3_regulator_config_voltage_crossings() - configure APM and mem-acc
++ *		settings depending upon a new VDD supply setpoint
++ *
++ * @ctrl:		Pointer to the CPR3 controller
++ * @new_volt:		New voltage in microvolts that VDD supply needs to
++ *			end up at
++ * @last_volt:		Pointer to the last known voltage in microvolts for the
++ *			VDD supply
++ * @aggr_corner:	Pointer to the CPR3 corner which corresponds to the max
++ *			corner aggregated from all CPR3 threads managed by the
++ *			CPR3 controller
++ *
++ * This function handles the APM and mem-acc regulator reconfiguration if
++ * the new VDD supply voltage will result in crossing their respective voltage
++ * thresholds.
++ *
++ * Return: 0 on success, errno on failure. If the VDD supply voltage is
++ * modified, last_volt is updated to reflect the new voltage setpoint.
++ */
++static int cpr3_regulator_config_voltage_crossings(struct cpr3_controller *ctrl,
++				   int new_volt, int *last_volt,
++				   struct cpr3_corner *aggr_corner)
++{
++	bool apm_crossing = false, mem_acc_crossing = false;
++	bool mem_acc_bhs_used;
++	int apm_volt = ctrl->apm_threshold_volt;
++	int mem_acc_volt = ctrl->mem_acc_threshold_volt;
++	int ref_volt, rc;
++
++	if (ctrl->apm && apm_volt > 0
++	    && ((*last_volt < apm_volt && apm_volt <= new_volt)
++		|| (*last_volt >= apm_volt && apm_volt > new_volt)))
++		apm_crossing = true;
++
++	mem_acc_bhs_used = cpr3_regulator_mem_acc_bhs_used(ctrl);
++
++	ref_volt = ctrl->use_hw_closed_loop ? aggr_corner->floor_volt :
++		new_volt;
++
++	if (mem_acc_bhs_used &&
++	    (((*last_volt < mem_acc_volt && mem_acc_volt <= ref_volt) ||
++	      (*last_volt >= mem_acc_volt && mem_acc_volt > ref_volt))))
++		mem_acc_crossing = true;
++
++	if (apm_crossing && mem_acc_crossing) {
++		if ((new_volt < *last_volt && apm_volt >= mem_acc_volt) ||
++		    (new_volt >= *last_volt && apm_volt < mem_acc_volt)) {
++			rc = cpr3_regulator_switch_apm_mode(ctrl, new_volt,
++							    last_volt,
++							    aggr_corner);
++			if (rc) {
++				cpr3_err(ctrl, "unable to switch APM mode\n");
++				return rc;
++			}
++
++			rc = cpr3_regulator_config_bhs_mem_acc(ctrl, new_volt,
++						       last_volt, aggr_corner);
++			if (rc) {
++				cpr3_err(ctrl, "unable to configure BHS mem-acc settings\n");
++				return rc;
++			}
++		} else {
++			rc = cpr3_regulator_config_bhs_mem_acc(ctrl, new_volt,
++						       last_volt, aggr_corner);
++			if (rc) {
++				cpr3_err(ctrl, "unable to configure BHS mem-acc settings\n");
++				return rc;
++			}
++
++			rc = cpr3_regulator_switch_apm_mode(ctrl, new_volt,
++							    last_volt,
++							    aggr_corner);
++			if (rc) {
++				cpr3_err(ctrl, "unable to switch APM mode\n");
++				return rc;
++			}
++		}
++	} else if (apm_crossing) {
++		rc = cpr3_regulator_switch_apm_mode(ctrl, new_volt, last_volt,
++						    aggr_corner);
++		if (rc) {
++			cpr3_err(ctrl, "unable to switch APM mode\n");
++			return rc;
++		}
++	} else if (mem_acc_crossing) {
++		rc = cpr3_regulator_config_bhs_mem_acc(ctrl, new_volt,
++						       last_volt, aggr_corner);
++		if (rc) {
++			cpr3_err(ctrl, "unable to configure BHS mem-acc settings\n");
++			return rc;
++		}
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_regulator_config_mem_acc() - configure the corner of the mem-acc
++ *			regulator associated with the CPR3 controller
++ * @ctrl:		Pointer to the CPR3 controller
++ * @aggr_corner:	Pointer to the CPR3 corner which corresponds to the max
++ *			corner aggregated from all CPR3 threads managed by the
++ *			CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_config_mem_acc(struct cpr3_controller *ctrl,
++					 struct cpr3_corner *aggr_corner)
++{
++	int rc;
++
++	if (ctrl->mem_acc_regulator && aggr_corner->mem_acc_volt) {
++		rc = regulator_set_voltage(ctrl->mem_acc_regulator,
++					   aggr_corner->mem_acc_volt,
++					   aggr_corner->mem_acc_volt);
++		if (rc) {
++			cpr3_err(ctrl, "regulator_set_voltage(mem_acc) == %d failed, rc=%d\n",
++				 aggr_corner->mem_acc_volt, rc);
++			return rc;
++		}
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_regulator_scale_vdd_voltage() - scale the CPR controlled VDD supply
++ *		voltage to the new level while satisfying any other hardware
++ *		requirements
++ * @ctrl:		Pointer to the CPR3 controller
++ * @new_volt:		New voltage in microvolts that VDD supply needs to end
++ *			up at
++ * @last_volt:		Last known voltage in microvolts for the VDD supply
++ * @aggr_corner:	Pointer to the CPR3 corner which corresponds to the max
++ *			corner aggregated from all CPR3 threads managed by the
++ *			CPR3 controller
++ *
++ * This function scales the CPR controlled VDD supply voltage from its
++ * current level to the new voltage that is specified.  If the supply is
++ * configured to use the APM and the APM threshold is crossed as a result of
++ * the voltage scaling, then this function also stops at the APM threshold,
++ * switches the APM source, and finally sets the final new voltage.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_scale_vdd_voltage(struct cpr3_controller *ctrl,
++				int new_volt, int last_volt,
++				struct cpr3_corner *aggr_corner)
++{
++	struct regulator *vdd = ctrl->vdd_regulator;
++	int rc;
++
++	if (new_volt < last_volt) {
++			rc = cpr3_regulator_config_mem_acc(ctrl, aggr_corner);
++			if (rc)
++				return rc;
++	} else {
++		/* Increasing VDD voltage */
++		if (ctrl->system_regulator) {
++			rc = regulator_set_voltage(ctrl->system_regulator,
++				aggr_corner->system_volt, INT_MAX);
++			if (rc) {
++				cpr3_err(ctrl, "regulator_set_voltage(system) == %d failed, rc=%d\n",
++					aggr_corner->system_volt, rc);
++				return rc;
++			}
++		}
++	}
++
++	rc = cpr3_regulator_config_voltage_crossings(ctrl, new_volt, &last_volt,
++						     aggr_corner);
++	if (rc) {
++		cpr3_err(ctrl, "unable to handle voltage threshold crossing configurations, rc=%d\n",
++			 rc);
++		return rc;
++	}
++
++	/*
++	 * Subtract a small amount from the min_uV parameter so that the
++	 * set voltage request is not dropped by the framework due to being
++	 * duplicate.  This is needed in order to switch from hardware
++	 * closed-loop to open-loop successfully.
++	 */
++	rc = regulator_set_voltage(vdd, new_volt - (ctrl->cpr_enabled ? 0 : 1),
++				   aggr_corner->ceiling_volt);
++	if (rc) {
++		cpr3_err(ctrl, "regulator_set_voltage(vdd) == %d failed, rc=%d\n",
++			new_volt, rc);
++		return rc;
++	}
++
++	if (new_volt == last_volt && ctrl->supports_hw_closed_loop
++	    && ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++		/*
++		 * CPR4 features enforce voltage reprogramming when the last
++		 * set voltage and new set voltage are same. This way, we can
++		 * ensure that SAW PMIC STATUS register is updated with newly
++		 * programmed voltage.
++		 */
++		rc = regulator_sync_voltage(vdd);
++		if (rc) {
++			cpr3_err(ctrl, "regulator_sync_voltage(vdd) == %d failed, rc=%d\n",
++				new_volt, rc);
++			return rc;
++		}
++	}
++
++	if (new_volt >= last_volt) {
++		rc = cpr3_regulator_config_mem_acc(ctrl, aggr_corner);
++		if (rc)
++			return rc;
++	} else {
++		/* Decreasing VDD voltage */
++		if (ctrl->system_regulator) {
++			rc = regulator_set_voltage(ctrl->system_regulator,
++				aggr_corner->system_volt, INT_MAX);
++			if (rc) {
++				cpr3_err(ctrl, "regulator_set_voltage(system) == %d failed, rc=%d\n",
++					aggr_corner->system_volt, rc);
++				return rc;
++			}
++		}
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_regulator_get_dynamic_floor_volt() - returns the current dynamic floor
++ *		voltage based upon static configurations and the state of all
++ *		power domains during the last CPR measurement
++ * @ctrl:		Pointer to the CPR3 controller
++ * @reg_last_measurement: Value read from the LAST_MEASUREMENT register
++ *
++ * When using HW closed-loop, the dynamic floor voltage is always returned
++ * regardless of the current state of the power domains.
++ *
++ * Return: dynamic floor voltage in microvolts or 0 if dynamic floor is not
++ *         currently required
++ */
++static int cpr3_regulator_get_dynamic_floor_volt(struct cpr3_controller *ctrl,
++		u32 reg_last_measurement)
++{
++	int dynamic_floor_volt = 0;
++	struct cpr3_regulator *vreg;
++	bool valid, pd_valid;
++	u32 bypass_bits;
++	int i, j;
++
++	if (!ctrl->supports_hw_closed_loop)
++		return 0;
++
++	if (likely(!ctrl->use_hw_closed_loop)) {
++		valid = !!(reg_last_measurement & CPR3_LAST_MEASUREMENT_VALID);
++		bypass_bits
++		 = (reg_last_measurement & CPR3_LAST_MEASUREMENT_PD_BYPASS_MASK)
++			>> CPR3_LAST_MEASUREMENT_PD_BYPASS_SHIFT;
++	} else {
++		/*
++		 * Ensure that the dynamic floor voltage is always used for
++		 * HW closed-loop since the conditions below cannot be evaluated
++		 * after each CPR measurement.
++		 */
++		valid = false;
++		bypass_bits = 0;
++	}
++
++	for (i = 0; i < ctrl->thread_count; i++) {
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++			vreg = &ctrl->thread[i].vreg[j];
++
++			if (!vreg->uses_dynamic_floor)
++				continue;
++
++			pd_valid = !((bypass_bits & vreg->pd_bypass_mask)
++					== vreg->pd_bypass_mask);
++
++			if (!valid || !pd_valid)
++				dynamic_floor_volt = max(dynamic_floor_volt,
++					vreg->corner[
++					 vreg->dynamic_floor_corner].last_volt);
++		}
++	}
++
++	return dynamic_floor_volt;
++}
++
++/**
++ * cpr3_regulator_max_sdelta_diff() - returns the maximum voltage difference in
++ *		microvolts that can result from different operating conditions
++ *		for the specified sdelta struct
++ * @sdelta:		Pointer to the sdelta structure
++ * @step_volt:		Step size in microvolts between available set
++ *			points of the VDD supply.
++ *
++ * Return: voltage difference between the highest and lowest adjustments if
++ *	sdelta and sdelta->table are valid, else 0.
++ */
++static int cpr3_regulator_max_sdelta_diff(const struct cpr4_sdelta *sdelta,
++				int step_volt)
++{
++	int i, j, index, sdelta_min = INT_MAX, sdelta_max = INT_MIN;
++
++	if (!sdelta || !sdelta->table)
++		return 0;
++
++	for (i = 0; i < sdelta->max_core_count; i++) {
++		for (j = 0; j < sdelta->temp_band_count; j++) {
++			index = i * sdelta->temp_band_count + j;
++			sdelta_min = min(sdelta_min, sdelta->table[index]);
++			sdelta_max = max(sdelta_max, sdelta->table[index]);
++		}
++	}
++
++	return (sdelta_max - sdelta_min) * step_volt;
++}
++
++/**
++ * cpr3_regulator_aggregate_sdelta() - check open-loop voltages of current
++ *		aggregated corner and current corner of a given regulator
++ *		and adjust the sdelta strucuture data of aggregate corner.
++ * @aggr_corner:	Pointer to accumulated aggregated corner which
++ *			is both an input and an output
++ * @corner:		Pointer to the corner to be aggregated with
++ *			aggr_corner
++ * @step_volt:		Step size in microvolts between available set
++ *			points of the VDD supply.
++ *
++ * Return: none
++ */
++static void cpr3_regulator_aggregate_sdelta(
++				struct cpr3_corner *aggr_corner,
++				const struct cpr3_corner *corner, int step_volt)
++{
++	struct cpr4_sdelta *aggr_sdelta, *sdelta;
++	int aggr_core_count, core_count, temp_band_count;
++	u32 aggr_index, index;
++	int i, j, sdelta_size, cap_steps, adjust_sdelta;
++
++	aggr_sdelta = aggr_corner->sdelta;
++	sdelta = corner->sdelta;
++
++	if (aggr_corner->open_loop_volt < corner->open_loop_volt) {
++		/*
++		 * Found the new dominant regulator as its open-loop requirement
++		 * is higher than previous dominant regulator. Calculate cap
++		 * voltage to limit the SDELTA values to make sure the runtime
++		 * (Core-count/temp) adjustments do not violate other
++		 * regulators' voltage requirements. Use cpr4_sdelta values of
++		 * new dominant regulator.
++		 */
++		aggr_sdelta->cap_volt = min(aggr_sdelta->cap_volt,
++						(corner->open_loop_volt -
++						aggr_corner->open_loop_volt));
++
++		/* Clear old data in the sdelta table */
++		sdelta_size = aggr_sdelta->max_core_count
++					* aggr_sdelta->temp_band_count;
++
++		if (aggr_sdelta->allow_core_count_adj
++			|| aggr_sdelta->allow_temp_adj)
++			memset(aggr_sdelta->table, 0, sdelta_size
++					* sizeof(*aggr_sdelta->table));
++
++		if (sdelta->allow_temp_adj || sdelta->allow_core_count_adj) {
++			/* Copy new data in sdelta table */
++			sdelta_size = sdelta->max_core_count
++						* sdelta->temp_band_count;
++			if (sdelta->table)
++				memcpy(aggr_sdelta->table, sdelta->table,
++					sdelta_size * sizeof(*sdelta->table));
++		}
++
++		if (sdelta->allow_boost) {
++			memcpy(aggr_sdelta->boost_table, sdelta->boost_table,
++				sdelta->temp_band_count
++				* sizeof(*sdelta->boost_table));
++			aggr_sdelta->boost_num_cores = sdelta->boost_num_cores;
++		} else if (aggr_sdelta->allow_boost) {
++			for (i = 0; i < aggr_sdelta->temp_band_count; i++) {
++				adjust_sdelta = (corner->open_loop_volt
++						- aggr_corner->open_loop_volt)
++						/ step_volt;
++				aggr_sdelta->boost_table[i] += adjust_sdelta;
++				aggr_sdelta->boost_table[i]
++					= min(aggr_sdelta->boost_table[i], 0);
++			}
++		}
++
++		aggr_corner->open_loop_volt = corner->open_loop_volt;
++		aggr_sdelta->allow_temp_adj = sdelta->allow_temp_adj;
++		aggr_sdelta->allow_core_count_adj
++					= sdelta->allow_core_count_adj;
++		aggr_sdelta->max_core_count = sdelta->max_core_count;
++		aggr_sdelta->temp_band_count = sdelta->temp_band_count;
++	} else if (aggr_corner->open_loop_volt > corner->open_loop_volt) {
++		/*
++		 * Adjust the cap voltage if the open-loop requirement of new
++		 * regulator is the next highest.
++		 */
++		aggr_sdelta->cap_volt = min(aggr_sdelta->cap_volt,
++						(aggr_corner->open_loop_volt
++						- corner->open_loop_volt));
++
++		if (sdelta->allow_boost) {
++			for (i = 0; i < aggr_sdelta->temp_band_count; i++) {
++				adjust_sdelta = (aggr_corner->open_loop_volt
++						- corner->open_loop_volt)
++						/ step_volt;
++				aggr_sdelta->boost_table[i] =
++					sdelta->boost_table[i] + adjust_sdelta;
++				aggr_sdelta->boost_table[i]
++					= min(aggr_sdelta->boost_table[i], 0);
++			}
++			aggr_sdelta->boost_num_cores = sdelta->boost_num_cores;
++		}
++	} else {
++		/*
++		 * Found another dominant regulator with same open-loop
++		 * requirement. Make cap voltage to '0'. Disable core-count
++		 * adjustments as we couldn't support for both regulators.
++		 * Keep enable temp based adjustments if enabled for both
++		 * regulators and choose mininum margin adjustment values
++		 * between them.
++		 */
++		aggr_sdelta->cap_volt = 0;
++		aggr_sdelta->allow_core_count_adj = false;
++
++		if (aggr_sdelta->allow_temp_adj
++					&& sdelta->allow_temp_adj) {
++			aggr_core_count = aggr_sdelta->max_core_count - 1;
++			core_count = sdelta->max_core_count - 1;
++			temp_band_count = sdelta->temp_band_count;
++			for (j = 0; j < temp_band_count; j++) {
++				aggr_index = aggr_core_count * temp_band_count
++						+ j;
++				index = core_count * temp_band_count + j;
++				aggr_sdelta->table[aggr_index] =
++					min(aggr_sdelta->table[aggr_index],
++						sdelta->table[index]);
++			}
++		} else {
++			aggr_sdelta->allow_temp_adj = false;
++		}
++
++		if (sdelta->allow_boost) {
++			memcpy(aggr_sdelta->boost_table, sdelta->boost_table,
++				sdelta->temp_band_count
++				* sizeof(*sdelta->boost_table));
++			aggr_sdelta->boost_num_cores = sdelta->boost_num_cores;
++		}
++	}
++
++	/* Keep non-dominant clients boost enable state */
++	aggr_sdelta->allow_boost |= sdelta->allow_boost;
++	if (aggr_sdelta->allow_boost)
++		aggr_sdelta->allow_core_count_adj = false;
++
++	if (aggr_sdelta->cap_volt && !(aggr_sdelta->cap_volt == INT_MAX)) {
++		core_count = aggr_sdelta->max_core_count;
++		temp_band_count = aggr_sdelta->temp_band_count;
++		/*
++		 * Convert cap voltage from uV to PMIC steps and use to limit
++		 * sdelta margin adjustments.
++		 */
++		cap_steps = aggr_sdelta->cap_volt / step_volt;
++		for (i = 0; i < core_count; i++)
++			for (j = 0; j < temp_band_count; j++) {
++				index = i * temp_band_count + j;
++				aggr_sdelta->table[index] =
++						min(aggr_sdelta->table[index],
++							cap_steps);
++		}
++	}
++}
++
++/**
++ * cpr3_regulator_aggregate_corners() - aggregate two corners together
++ * @aggr_corner:		Pointer to accumulated aggregated corner which
++ *				is both an input and an output
++ * @corner:			Pointer to the corner to be aggregated with
++ *				aggr_corner
++ * @aggr_quot:			Flag indicating that target quotients should be
++ *				aggregated as well.
++ * @step_volt:			Step size in microvolts between available set
++ *				points of the VDD supply.
++ *
++ * Return: none
++ */
++static void cpr3_regulator_aggregate_corners(struct cpr3_corner *aggr_corner,
++			const struct cpr3_corner *corner, bool aggr_quot,
++			int step_volt)
++{
++	int i;
++
++	aggr_corner->ceiling_volt
++		= max(aggr_corner->ceiling_volt, corner->ceiling_volt);
++	aggr_corner->floor_volt
++		= max(aggr_corner->floor_volt, corner->floor_volt);
++	aggr_corner->last_volt
++		= max(aggr_corner->last_volt, corner->last_volt);
++	aggr_corner->system_volt
++		= max(aggr_corner->system_volt, corner->system_volt);
++	aggr_corner->mem_acc_volt
++		= max(aggr_corner->mem_acc_volt, corner->mem_acc_volt);
++	aggr_corner->irq_en |= corner->irq_en;
++	aggr_corner->use_open_loop |= corner->use_open_loop;
++
++	if (aggr_quot) {
++		aggr_corner->ro_mask &= corner->ro_mask;
++
++		for (i = 0; i < CPR3_RO_COUNT; i++)
++			aggr_corner->target_quot[i]
++				= max(aggr_corner->target_quot[i],
++				      corner->target_quot[i]);
++	}
++
++	if (aggr_corner->sdelta && corner->sdelta
++		&& (aggr_corner->sdelta->table
++		|| aggr_corner->sdelta->boost_table)) {
++		cpr3_regulator_aggregate_sdelta(aggr_corner, corner, step_volt);
++	} else {
++		aggr_corner->open_loop_volt
++			= max(aggr_corner->open_loop_volt,
++				corner->open_loop_volt);
++	}
++}
++
++/**
++ * cpr3_regulator_update_ctrl_state() - update the state of the CPR controller
++ *		to reflect the corners used by all CPR3 regulators as well as
++ *		the CPR operating mode
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * This function aggregates the CPR parameters for all CPR3 regulators
++ * associated with the VDD supply.  Upon success, it sets the aggregated last
++ * known good voltage.
++ *
++ * The VDD supply voltage will not be physically configured unless this
++ * condition is met by at least one of the regulators of the controller:
++ * regulator->vreg_enabled == true &&
++ * regulator->current_corner != CPR3_REGULATOR_CORNER_INVALID
++ *
++ * CPR registers for the controller and each thread are updated as long as
++ * ctrl->cpr_enabled == true.
++ *
++ * Note, CPR3 controller lock must be held by the caller.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int _cpr3_regulator_update_ctrl_state(struct cpr3_controller *ctrl)
++{
++	struct cpr3_corner aggr_corner = {};
++	struct cpr3_thread *thread;
++	struct cpr3_regulator *vreg;
++	struct cpr4_sdelta *sdelta;
++	bool valid = false;
++	bool thread_valid;
++	int i, j, rc, new_volt, vdd_volt, dynamic_floor_volt, last_corner_volt;
++	u32 reg_last_measurement = 0, sdelta_size;
++	int *sdelta_table, *boost_table;
++
++	last_corner_volt = 0;
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++		rc = cpr3_ctrl_clear_cpr4_config(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "failed to clear CPR4 configuration,rc=%d\n",
++				rc);
++			return rc;
++		}
++	}
++
++	cpr3_ctrl_loop_disable(ctrl);
++
++	vdd_volt = regulator_get_voltage(ctrl->vdd_regulator);
++	if (vdd_volt < 0) {
++		cpr3_err(ctrl, "regulator_get_voltage(vdd) failed, rc=%d\n",
++			 vdd_volt);
++		return vdd_volt;
++	}
++
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++		/*
++		 * Save aggregated corner open-loop voltage which was programmed
++		 * during last corner switch which is used when programming new
++		 * aggregated corner open-loop voltage.
++		 */
++		last_corner_volt = ctrl->aggr_corner.open_loop_volt;
++	}
++
++	if (ctrl->cpr_enabled && ctrl->use_hw_closed_loop &&
++		ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3)
++		reg_last_measurement
++			= cpr3_read(ctrl, CPR3_REG_LAST_MEASUREMENT);
++
++	aggr_corner.sdelta = ctrl->aggr_corner.sdelta;
++	if (aggr_corner.sdelta) {
++		sdelta = aggr_corner.sdelta;
++		sdelta_table = sdelta->table;
++		if (sdelta_table) {
++			sdelta_size = sdelta->max_core_count *
++					sdelta->temp_band_count;
++			memset(sdelta_table, 0, sdelta_size
++					* sizeof(*sdelta_table));
++		}
++
++		boost_table = sdelta->boost_table;
++		if (boost_table)
++			memset(boost_table, 0, sdelta->temp_band_count
++					* sizeof(*boost_table));
++
++		memset(sdelta, 0, sizeof(*sdelta));
++		sdelta->table = sdelta_table;
++		sdelta->cap_volt = INT_MAX;
++		sdelta->boost_table = boost_table;
++	}
++
++	/* Aggregate the requests of all threads */
++	for (i = 0; i < ctrl->thread_count; i++) {
++		thread = &ctrl->thread[i];
++		thread_valid = false;
++
++		sdelta = thread->aggr_corner.sdelta;
++		if (sdelta) {
++			sdelta_table = sdelta->table;
++			if (sdelta_table) {
++				sdelta_size = sdelta->max_core_count *
++						sdelta->temp_band_count;
++				memset(sdelta_table, 0, sdelta_size
++						* sizeof(*sdelta_table));
++			}
++
++			boost_table = sdelta->boost_table;
++			if (boost_table)
++				memset(boost_table, 0, sdelta->temp_band_count
++						* sizeof(*boost_table));
++
++			memset(sdelta, 0, sizeof(*sdelta));
++			sdelta->table = sdelta_table;
++			sdelta->cap_volt = INT_MAX;
++			sdelta->boost_table = boost_table;
++		}
++
++		memset(&thread->aggr_corner, 0, sizeof(thread->aggr_corner));
++		thread->aggr_corner.sdelta = sdelta;
++		thread->aggr_corner.ro_mask = CPR3_RO_MASK;
++
++		for (j = 0; j < thread->vreg_count; j++) {
++			vreg = &thread->vreg[j];
++
++			if (ctrl->cpr_enabled && ctrl->use_hw_closed_loop)
++				cpr3_update_vreg_closed_loop_volt(vreg,
++						vdd_volt, reg_last_measurement);
++
++			if (!vreg->vreg_enabled
++			    || vreg->current_corner
++					    == CPR3_REGULATOR_CORNER_INVALID) {
++				/* Cannot participate in aggregation. */
++				vreg->aggregated = false;
++				continue;
++			} else {
++				vreg->aggregated = true;
++				thread_valid = true;
++			}
++
++			cpr3_regulator_aggregate_corners(&thread->aggr_corner,
++					&vreg->corner[vreg->current_corner],
++					true, ctrl->step_volt);
++		}
++
++		valid |= thread_valid;
++
++		if (thread_valid)
++			cpr3_regulator_aggregate_corners(&aggr_corner,
++					&thread->aggr_corner,
++					false, ctrl->step_volt);
++	}
++
++	if (valid && ctrl->cpr_allowed_hw && ctrl->cpr_allowed_sw) {
++		rc = cpr3_closed_loop_enable(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "could not enable CPR, rc=%d\n", rc);
++			return rc;
++		}
++	} else {
++		rc = cpr3_closed_loop_disable(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "could not disable CPR, rc=%d\n", rc);
++			return rc;
++		}
++	}
++
++	/* No threads are enabled with a valid corner so exit. */
++	if (!valid)
++		return 0;
++
++	/*
++	 * When using CPR hardware closed-loop, the voltage may vary anywhere
++	 * between the floor and ceiling voltage without software notification.
++	 * Therefore, it is required that the floor to ceiling range for the
++	 * aggregated corner not intersect the APM threshold voltage.  Adjust
++	 * the floor to ceiling range if this requirement is violated.
++	 *
++	 * The following algorithm is applied in the case that
++	 * floor < threshold <= ceiling:
++	 *	if open_loop >= threshold - adj, then floor = threshold
++	 *	else ceiling = threshold - step
++	 * where adj = an adjustment factor to ensure sufficient voltage margin
++	 * and step = VDD output step size
++	 *
++	 * The open-loop and last known voltages are also bounded by the new
++	 * floor or ceiling value as needed.
++	 */
++	if (ctrl->use_hw_closed_loop
++	    && aggr_corner.ceiling_volt >= ctrl->apm_threshold_volt
++	    && aggr_corner.floor_volt < ctrl->apm_threshold_volt) {
++
++		if (aggr_corner.open_loop_volt
++		    >= ctrl->apm_threshold_volt - ctrl->apm_adj_volt)
++			aggr_corner.floor_volt = ctrl->apm_threshold_volt;
++		else
++			aggr_corner.ceiling_volt
++				= ctrl->apm_threshold_volt - ctrl->step_volt;
++
++		aggr_corner.last_volt
++		    = max(aggr_corner.last_volt, aggr_corner.floor_volt);
++		aggr_corner.last_volt
++		    = min(aggr_corner.last_volt, aggr_corner.ceiling_volt);
++		aggr_corner.open_loop_volt
++		    = max(aggr_corner.open_loop_volt, aggr_corner.floor_volt);
++		aggr_corner.open_loop_volt
++		    = min(aggr_corner.open_loop_volt, aggr_corner.ceiling_volt);
++	}
++
++	if (ctrl->use_hw_closed_loop
++	    && aggr_corner.ceiling_volt >= ctrl->mem_acc_threshold_volt
++	    && aggr_corner.floor_volt < ctrl->mem_acc_threshold_volt) {
++		aggr_corner.floor_volt = ctrl->mem_acc_threshold_volt;
++		aggr_corner.last_volt = max(aggr_corner.last_volt,
++					     aggr_corner.floor_volt);
++		aggr_corner.open_loop_volt = max(aggr_corner.open_loop_volt,
++						  aggr_corner.floor_volt);
++	}
++
++	if (ctrl->use_hw_closed_loop) {
++		dynamic_floor_volt
++			= cpr3_regulator_get_dynamic_floor_volt(ctrl,
++							reg_last_measurement);
++		if (aggr_corner.floor_volt < dynamic_floor_volt) {
++			aggr_corner.floor_volt = dynamic_floor_volt;
++			aggr_corner.last_volt = max(aggr_corner.last_volt,
++							aggr_corner.floor_volt);
++			aggr_corner.open_loop_volt
++				= max(aggr_corner.open_loop_volt,
++					aggr_corner.floor_volt);
++			aggr_corner.ceiling_volt = max(aggr_corner.ceiling_volt,
++							aggr_corner.floor_volt);
++		}
++	}
++
++	if (ctrl->cpr_enabled && ctrl->last_corner_was_closed_loop) {
++		/*
++		 * Always program open-loop voltage for CPR4 controllers which
++		 * support hardware closed-loop.  Storing the last closed loop
++		 * voltage in corner structure can still help with debugging.
++		 */
++		if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3)
++			new_volt = aggr_corner.last_volt;
++		else if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4
++			 && ctrl->supports_hw_closed_loop)
++			new_volt = aggr_corner.open_loop_volt;
++		else
++			new_volt = min(aggr_corner.last_volt +
++			      cpr3_regulator_max_sdelta_diff(aggr_corner.sdelta,
++							     ctrl->step_volt),
++				       aggr_corner.ceiling_volt);
++
++		aggr_corner.last_volt = new_volt;
++	} else {
++		new_volt = aggr_corner.open_loop_volt;
++		aggr_corner.last_volt = aggr_corner.open_loop_volt;
++	}
++
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4
++	    && ctrl->supports_hw_closed_loop) {
++		/*
++		 * Store last aggregated corner open-loop voltage in vdd_volt
++		 * which is used when programming current aggregated corner
++		 * required voltage.
++		 */
++		vdd_volt = last_corner_volt;
++	}
++
++	cpr3_debug(ctrl, "setting new voltage=%d uV\n", new_volt);
++	rc = cpr3_regulator_scale_vdd_voltage(ctrl, new_volt,
++					      vdd_volt, &aggr_corner);
++	if (rc) {
++		cpr3_err(ctrl, "vdd voltage scaling failed, rc=%d\n", rc);
++		return rc;
++	}
++
++	/* Only update registers if CPR is enabled. */
++	if (ctrl->cpr_enabled) {
++		if (ctrl->use_hw_closed_loop) {
++			/* Hardware closed-loop */
++
++			/* Set ceiling and floor limits in hardware */
++			rc = regulator_set_voltage(ctrl->vdd_limit_regulator,
++				aggr_corner.floor_volt,
++				aggr_corner.ceiling_volt);
++			if (rc) {
++				cpr3_err(ctrl, "could not configure HW closed-loop voltage limits, rc=%d\n",
++					rc);
++				return rc;
++			}
++		} else {
++			/* Software closed-loop */
++
++			/*
++			 * Disable UP or DOWN interrupts when at ceiling or
++			 * floor respectively.
++			 */
++			if (new_volt == aggr_corner.floor_volt)
++				aggr_corner.irq_en &= ~CPR3_IRQ_DOWN;
++			if (new_volt == aggr_corner.ceiling_volt)
++				aggr_corner.irq_en &= ~CPR3_IRQ_UP;
++
++			cpr3_write(ctrl, CPR3_REG_IRQ_CLEAR,
++				CPR3_IRQ_UP | CPR3_IRQ_DOWN);
++			cpr3_write(ctrl, CPR3_REG_IRQ_EN, aggr_corner.irq_en);
++		}
++
++		for (i = 0; i < ctrl->thread_count; i++) {
++			cpr3_regulator_set_target_quot(&ctrl->thread[i]);
++
++			for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++				vreg = &ctrl->thread[i].vreg[j];
++
++				if (vreg->vreg_enabled)
++					vreg->last_closed_loop_corner
++						= vreg->current_corner;
++			}
++		}
++
++		if (ctrl->proc_clock_throttle) {
++			if (aggr_corner.ceiling_volt > aggr_corner.floor_volt
++			    && (ctrl->use_hw_closed_loop
++					|| new_volt < aggr_corner.ceiling_volt))
++				cpr3_write(ctrl, CPR3_REG_PD_THROTTLE,
++						ctrl->proc_clock_throttle);
++			else
++				cpr3_write(ctrl, CPR3_REG_PD_THROTTLE,
++						CPR3_PD_THROTTLE_DISABLE);
++		}
++
++		/*
++		 * Ensure that all CPR register writes complete before
++		 * re-enabling CPR loop operation.
++		 */
++		wmb();
++	} else if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4
++		   && ctrl->vdd_limit_regulator) {
++		/* Set ceiling and floor limits in hardware */
++		rc = regulator_set_voltage(ctrl->vdd_limit_regulator,
++			aggr_corner.floor_volt,
++			aggr_corner.ceiling_volt);
++		if (rc) {
++			cpr3_err(ctrl, "could not configure HW closed-loop voltage limits, rc=%d\n",
++				rc);
++			return rc;
++		}
++	}
++
++	ctrl->aggr_corner = aggr_corner;
++
++	if (ctrl->allow_core_count_adj || ctrl->allow_temp_adj
++		|| ctrl->allow_boost) {
++		rc = cpr3_controller_program_sdelta(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "failed to program sdelta, rc=%d\n", rc);
++			return rc;
++		}
++	}
++
++	/*
++	 * Only enable the CPR controller if it is possible to set more than
++	 * one vdd-supply voltage.
++	 */
++	if (aggr_corner.ceiling_volt > aggr_corner.floor_volt &&
++			!aggr_corner.use_open_loop)
++		cpr3_ctrl_loop_enable(ctrl);
++
++	ctrl->last_corner_was_closed_loop = ctrl->cpr_enabled;
++	cpr3_debug(ctrl, "CPR configuration updated\n");
++
++	return 0;
++}
++
++/**
++ * cpr3_regulator_wait_for_idle() - wait for the CPR controller to no longer be
++ *		busy
++ * @ctrl:		Pointer to the CPR3 controller
++ * @max_wait_ns:	Max wait time in nanoseconds
++ *
++ * Return: 0 on success or -ETIMEDOUT if the controller was still busy after
++ *	   the maximum delay time
++ */
++static int cpr3_regulator_wait_for_idle(struct cpr3_controller *ctrl,
++					s64 max_wait_ns)
++{
++	ktime_t start, end;
++	s64 time_ns;
++	u32 reg;
++
++	/*
++	 * Ensure that all previous CPR register writes have completed before
++	 * checking the status register.
++	 */
++	mb();
++
++	start = ktime_get();
++	do {
++		end = ktime_get();
++		time_ns = ktime_to_ns(ktime_sub(end, start));
++		if (time_ns > max_wait_ns) {
++			cpr3_err(ctrl, "CPR controller still busy after %lld us\n",
++				div_s64(time_ns, 1000));
++			return -ETIMEDOUT;
++		}
++		usleep_range(50, 100);
++		reg = cpr3_read(ctrl, CPR3_REG_CPR_STATUS);
++	} while (reg & CPR3_CPR_STATUS_BUSY_MASK);
++
++	return 0;
++}
++
++/**
++ * cmp_int() - int comparison function to be passed into the sort() function
++ *		which leads to ascending sorting
++ * @a:			First int value
++ * @b:			Second int value
++ *
++ * Return: >0 if a > b, 0 if a == b, <0 if a < b
++ */
++static int cmp_int(const void *a, const void *b)
++{
++	return *(int *)a - *(int *)b;
++}
++
++/**
++ * cpr3_regulator_measure_aging() - measure the quotient difference for the
++ *		specified CPR aging sensor
++ * @ctrl:		Pointer to the CPR3 controller
++ * @aging_sensor:	Aging sensor to measure
++ *
++ * Note that vdd-supply must be configured to the aging reference voltage before
++ * calling this function.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_measure_aging(struct cpr3_controller *ctrl,
++				struct cpr3_aging_sensor_info *aging_sensor)
++{
++	u32 mask, reg, result, quot_min, quot_max, sel_min, sel_max;
++	u32 quot_min_scaled, quot_max_scaled;
++	u32 gcnt, gcnt_ref, gcnt0_restore, gcnt1_restore, irq_restore;
++	u32 ro_mask_restore, cont_dly_restore, up_down_dly_restore = 0;
++	int quot_delta, quot_delta_scaled, quot_delta_scaled_sum;
++	int *quot_delta_results;
++	int rc, rc2, i, aging_measurement_count, filtered_count;
++	bool is_aging_measurement;
++
++	quot_delta_results = kcalloc(CPR3_AGING_MEASUREMENT_ITERATIONS,
++			sizeof(*quot_delta_results), GFP_KERNEL);
++	if (!quot_delta_results)
++		return -ENOMEM;
++
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++		rc = cpr3_ctrl_clear_cpr4_config(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "failed to clear CPR4 configuration,rc=%d\n",
++				rc);
++			kfree(quot_delta_results);
++			return rc;
++		}
++	}
++
++	cpr3_ctrl_loop_disable(ctrl);
++
++	/* Enable up, down, and mid CPR interrupts */
++	irq_restore = cpr3_read(ctrl, CPR3_REG_IRQ_EN);
++	cpr3_write(ctrl, CPR3_REG_IRQ_EN,
++			CPR3_IRQ_UP | CPR3_IRQ_DOWN | CPR3_IRQ_MID);
++
++	/* Ensure that the aging sensor is assigned to CPR thread 0 */
++	cpr3_write(ctrl, CPR3_REG_SENSOR_OWNER(aging_sensor->sensor_id), 0);
++
++	/* Switch from HW to SW closed-loop if necessary */
++	if (ctrl->supports_hw_closed_loop) {
++		if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++			cpr3_masked_write(ctrl, CPR4_REG_MARGIN_ADJ_CTL,
++				CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_EN_MASK,
++				CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_DISABLE);
++		} else if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3) {
++			cpr3_write(ctrl, CPR3_REG_HW_CLOSED_LOOP,
++				CPR3_HW_CLOSED_LOOP_DISABLE);
++		}
++	}
++
++	/* Configure the GCNT for RO0 and RO1 that are used for aging */
++	gcnt0_restore = cpr3_read(ctrl, CPR3_REG_GCNT(0));
++	gcnt1_restore = cpr3_read(ctrl, CPR3_REG_GCNT(1));
++	gcnt_ref = cpr3_regulator_get_gcnt(ctrl);
++	gcnt = gcnt_ref * 3 / 2;
++	cpr3_write(ctrl, CPR3_REG_GCNT(0), gcnt);
++	cpr3_write(ctrl, CPR3_REG_GCNT(1), gcnt);
++
++	/* Unmask all RO's */
++	ro_mask_restore = cpr3_read(ctrl, CPR3_REG_RO_MASK(0));
++	cpr3_write(ctrl, CPR3_REG_RO_MASK(0), 0);
++
++	/*
++	 * Mask all sensors except for the one to measure and bypass all
++	 * sensors in collapsible domains.
++	 */
++	for (i = 0; i <= ctrl->sensor_count / 32; i++) {
++		mask = GENMASK(min(31, ctrl->sensor_count - i * 32), 0);
++		if (aging_sensor->sensor_id / 32 >= i
++		    && aging_sensor->sensor_id / 32 < (i + 1))
++			mask &= ~BIT(aging_sensor->sensor_id % 32);
++		cpr3_write(ctrl, CPR3_REG_SENSOR_MASK_WRITE_BANK(i), mask);
++		cpr3_write(ctrl, CPR3_REG_SENSOR_BYPASS_WRITE_BANK(i),
++				aging_sensor->bypass_mask[i]);
++	}
++
++	/* Set CPR loop delays to 0 us */
++	if (ctrl->supports_hw_closed_loop
++		&& ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3) {
++		cont_dly_restore = cpr3_read(ctrl, CPR3_REG_CPR_TIMER_MID_CONT);
++		up_down_dly_restore = cpr3_read(ctrl,
++						CPR3_REG_CPR_TIMER_UP_DN_CONT);
++		cpr3_write(ctrl, CPR3_REG_CPR_TIMER_MID_CONT, 0);
++		cpr3_write(ctrl, CPR3_REG_CPR_TIMER_UP_DN_CONT, 0);
++	} else {
++		cont_dly_restore = cpr3_read(ctrl,
++						CPR3_REG_CPR_TIMER_AUTO_CONT);
++		cpr3_write(ctrl, CPR3_REG_CPR_TIMER_AUTO_CONT, 0);
++	}
++
++	/* Set count mode to all-at-once min with no repeat */
++	cpr3_masked_write(ctrl, CPR3_REG_CPR_CTL,
++		CPR3_CPR_CTL_COUNT_MODE_MASK | CPR3_CPR_CTL_COUNT_REPEAT_MASK,
++		CPR3_CPR_CTL_COUNT_MODE_ALL_AT_ONCE_MIN
++			<< CPR3_CPR_CTL_COUNT_MODE_SHIFT);
++
++	cpr3_ctrl_loop_enable(ctrl);
++
++	rc = cpr3_regulator_wait_for_idle(ctrl,
++					CPR3_AGING_MEASUREMENT_TIMEOUT_NS);
++	if (rc)
++		goto cleanup;
++
++	/* Set count mode to all-at-once aging */
++	cpr3_masked_write(ctrl, CPR3_REG_CPR_CTL, CPR3_CPR_CTL_COUNT_MODE_MASK,
++			CPR3_CPR_CTL_COUNT_MODE_ALL_AT_ONCE_AGE
++				<< CPR3_CPR_CTL_COUNT_MODE_SHIFT);
++
++	aging_measurement_count = 0;
++	for (i = 0; i < CPR3_AGING_MEASUREMENT_ITERATIONS; i++) {
++		/* Send CONT_NACK */
++		cpr3_write(ctrl, CPR3_REG_CONT_CMD, CPR3_CONT_CMD_NACK);
++
++		rc = cpr3_regulator_wait_for_idle(ctrl,
++					CPR3_AGING_MEASUREMENT_TIMEOUT_NS);
++		if (rc)
++			goto cleanup;
++
++		/* Check for PAGE_IS_AGE flag in status register */
++		reg = cpr3_read(ctrl, CPR3_REG_CPR_STATUS);
++		is_aging_measurement
++			= reg & CPR3_CPR_STATUS_AGING_MEASUREMENT_MASK;
++
++		/* Read CPR measurement results */
++		result = cpr3_read(ctrl, CPR3_REG_RESULT1(0));
++		quot_min = (result & CPR3_RESULT1_QUOT_MIN_MASK)
++				>> CPR3_RESULT1_QUOT_MIN_SHIFT;
++		quot_max = (result & CPR3_RESULT1_QUOT_MAX_MASK)
++				>> CPR3_RESULT1_QUOT_MAX_SHIFT;
++		sel_min = (result & CPR3_RESULT1_RO_MIN_MASK)
++				>> CPR3_RESULT1_RO_MIN_SHIFT;
++		sel_max = (result & CPR3_RESULT1_RO_MAX_MASK)
++				>> CPR3_RESULT1_RO_MAX_SHIFT;
++
++		/*
++		 * Scale the quotients so that they are equivalent to the fused
++		 * values.  This accounts for the difference in measurement
++		 * interval times.
++		 */
++		quot_min_scaled = quot_min * (gcnt_ref + 1) / (gcnt + 1);
++		quot_max_scaled = quot_max * (gcnt_ref + 1) / (gcnt + 1);
++
++		if (sel_max == 1) {
++			quot_delta = quot_max - quot_min;
++			quot_delta_scaled = quot_max_scaled - quot_min_scaled;
++		} else {
++			quot_delta = quot_min - quot_max;
++			quot_delta_scaled = quot_min_scaled - quot_max_scaled;
++		}
++
++		if (is_aging_measurement)
++			quot_delta_results[aging_measurement_count++]
++				= quot_delta_scaled;
++
++		cpr3_debug(ctrl, "aging results: page_is_age=%u, sel_min=%u, sel_max=%u, quot_min=%u, quot_max=%u, quot_delta=%d, quot_min_scaled=%u, quot_max_scaled=%u, quot_delta_scaled=%d\n",
++			is_aging_measurement, sel_min, sel_max, quot_min,
++			quot_max, quot_delta, quot_min_scaled, quot_max_scaled,
++			quot_delta_scaled);
++	}
++
++	filtered_count
++		= aging_measurement_count - CPR3_AGING_MEASUREMENT_FILTER * 2;
++	if (filtered_count > 0) {
++		sort(quot_delta_results, aging_measurement_count,
++			sizeof(*quot_delta_results), cmp_int, NULL);
++
++		quot_delta_scaled_sum = 0;
++		for (i = 0; i < filtered_count; i++)
++			quot_delta_scaled_sum
++				+= quot_delta_results[i
++					+ CPR3_AGING_MEASUREMENT_FILTER];
++
++		aging_sensor->measured_quot_diff
++			= quot_delta_scaled_sum / filtered_count;
++		cpr3_info(ctrl, "average quotient delta=%d (count=%d)\n",
++			aging_sensor->measured_quot_diff,
++			filtered_count);
++	} else {
++		cpr3_err(ctrl, "%d aging measurements completed after %d iterations\n",
++			aging_measurement_count,
++			CPR3_AGING_MEASUREMENT_ITERATIONS);
++		rc = -EBUSY;
++	}
++
++cleanup:
++	kfree(quot_delta_results);
++
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++		rc2 = cpr3_ctrl_clear_cpr4_config(ctrl);
++		if (rc2) {
++			cpr3_err(ctrl, "failed to clear CPR4 configuration,rc=%d\n",
++				rc2);
++			rc = rc2;
++		}
++	}
++
++	cpr3_ctrl_loop_disable(ctrl);
++
++	cpr3_write(ctrl, CPR3_REG_IRQ_EN, irq_restore);
++
++	cpr3_write(ctrl, CPR3_REG_RO_MASK(0), ro_mask_restore);
++
++	cpr3_write(ctrl, CPR3_REG_GCNT(0), gcnt0_restore);
++	cpr3_write(ctrl, CPR3_REG_GCNT(1), gcnt1_restore);
++
++	if (ctrl->supports_hw_closed_loop
++		&& ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3) {
++		cpr3_write(ctrl, CPR3_REG_CPR_TIMER_MID_CONT, cont_dly_restore);
++		cpr3_write(ctrl, CPR3_REG_CPR_TIMER_UP_DN_CONT,
++				up_down_dly_restore);
++	} else {
++		cpr3_write(ctrl, CPR3_REG_CPR_TIMER_AUTO_CONT,
++				cont_dly_restore);
++	}
++
++	for (i = 0; i <= ctrl->sensor_count / 32; i++) {
++		cpr3_write(ctrl, CPR3_REG_SENSOR_MASK_WRITE_BANK(i), 0);
++		cpr3_write(ctrl, CPR3_REG_SENSOR_BYPASS_WRITE_BANK(i), 0);
++	}
++
++	cpr3_masked_write(ctrl, CPR3_REG_CPR_CTL,
++		CPR3_CPR_CTL_COUNT_MODE_MASK | CPR3_CPR_CTL_COUNT_REPEAT_MASK,
++		(ctrl->count_mode << CPR3_CPR_CTL_COUNT_MODE_SHIFT)
++		| (ctrl->count_repeat << CPR3_CPR_CTL_COUNT_REPEAT_SHIFT));
++
++	cpr3_write(ctrl, CPR3_REG_SENSOR_OWNER(aging_sensor->sensor_id),
++			ctrl->sensor_owner[aging_sensor->sensor_id]);
++
++	cpr3_write(ctrl, CPR3_REG_IRQ_CLEAR,
++			CPR3_IRQ_UP | CPR3_IRQ_DOWN | CPR3_IRQ_MID);
++
++	if (ctrl->supports_hw_closed_loop) {
++		if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++			cpr3_masked_write(ctrl, CPR4_REG_MARGIN_ADJ_CTL,
++				CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_EN_MASK,
++				ctrl->use_hw_closed_loop
++				? CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_ENABLE
++				: CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_DISABLE);
++		} else if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3) {
++			cpr3_write(ctrl, CPR3_REG_HW_CLOSED_LOOP,
++				ctrl->use_hw_closed_loop
++				? CPR3_HW_CLOSED_LOOP_ENABLE
++				: CPR3_HW_CLOSED_LOOP_DISABLE);
++		}
++	}
++
++	return rc;
++}
++
++/**
++ * cpr3_regulator_readjust_volt_and_quot() - readjust the target quotients as
++ *		well as the floor, ceiling, and open-loop voltages for the
++ *		regulator by removing the old adjustment and adding the new one
++ * @vreg:		Pointer to the CPR3 regulator
++ * @old_adjust_volt:	Old aging adjustment voltage in microvolts
++ * @new_adjust_volt:	New aging adjustment voltage in microvolts
++ *
++ * Also reset the cached closed loop voltage (last_volt) to equal the open-loop
++ * voltage for each corner.
++ *
++ * Return: None
++ */
++static void cpr3_regulator_readjust_volt_and_quot(struct cpr3_regulator *vreg,
++		int old_adjust_volt, int new_adjust_volt)
++{
++	unsigned long long temp;
++	int i, j, old_volt, new_volt, rounded_volt;
++
++	if (!vreg->aging_allowed)
++		return;
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		temp = (unsigned long long)old_adjust_volt
++			* (unsigned long long)vreg->corner[i].aging_derate;
++		do_div(temp, 1000);
++		old_volt = temp;
++
++		temp = (unsigned long long)new_adjust_volt
++			* (unsigned long long)vreg->corner[i].aging_derate;
++		do_div(temp, 1000);
++		new_volt = temp;
++
++		old_volt = min(vreg->aging_max_adjust_volt, old_volt);
++		new_volt = min(vreg->aging_max_adjust_volt, new_volt);
++
++		for (j = 0; j < CPR3_RO_COUNT; j++) {
++			if (vreg->corner[i].target_quot[j] != 0) {
++				vreg->corner[i].target_quot[j]
++					+= cpr3_quot_adjustment(
++						vreg->corner[i].ro_scale[j],
++						new_volt)
++					   - cpr3_quot_adjustment(
++						vreg->corner[i].ro_scale[j],
++						old_volt);
++			}
++		}
++
++		rounded_volt = CPR3_ROUND(new_volt,
++					vreg->thread->ctrl->step_volt);
++
++		if (!vreg->aging_allow_open_loop_adj)
++			rounded_volt = 0;
++
++		vreg->corner[i].ceiling_volt
++			= vreg->corner[i].unaged_ceiling_volt + rounded_volt;
++		vreg->corner[i].ceiling_volt = min(vreg->corner[i].ceiling_volt,
++					      vreg->corner[i].abs_ceiling_volt);
++		vreg->corner[i].floor_volt
++			= vreg->corner[i].unaged_floor_volt + rounded_volt;
++		vreg->corner[i].floor_volt = min(vreg->corner[i].floor_volt,
++						vreg->corner[i].ceiling_volt);
++		vreg->corner[i].open_loop_volt
++			= vreg->corner[i].unaged_open_loop_volt + rounded_volt;
++		vreg->corner[i].open_loop_volt
++			= min(vreg->corner[i].open_loop_volt,
++				vreg->corner[i].ceiling_volt);
++
++		vreg->corner[i].last_volt = vreg->corner[i].open_loop_volt;
++
++		cpr3_debug(vreg, "corner %d: applying %d uV closed-loop and %d uV open-loop voltage margin adjustment\n",
++			i, new_volt, rounded_volt);
++	}
++}
++
++/**
++ * cpr3_regulator_set_aging_ref_adjustment() - adjust target quotients for the
++ *		regulators managed by this CPR controller to account for aging
++ * @ctrl:		Pointer to the CPR3 controller
++ * @ref_adjust_volt:	New aging reference adjustment voltage in microvolts to
++ *			apply to all regulators managed by this CPR controller
++ *
++ * The existing aging adjustment as defined by ctrl->aging_ref_adjust_volt is
++ * first removed and then the adjustment is applied.  Lastly, the value of
++ * ctrl->aging_ref_adjust_volt is updated to ref_adjust_volt.
++ */
++static void cpr3_regulator_set_aging_ref_adjustment(
++		struct cpr3_controller *ctrl, int ref_adjust_volt)
++{
++	struct cpr3_regulator *vreg;
++	int i, j;
++
++	for (i = 0; i < ctrl->thread_count; i++) {
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++			vreg = &ctrl->thread[i].vreg[j];
++			cpr3_regulator_readjust_volt_and_quot(vreg,
++				ctrl->aging_ref_adjust_volt, ref_adjust_volt);
++		}
++	}
++
++	ctrl->aging_ref_adjust_volt = ref_adjust_volt;
++}
++
++/**
++ * cpr3_regulator_aging_adjust() - adjust the target quotients for regulators
++ *		based on the output of CPR aging sensors
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_aging_adjust(struct cpr3_controller *ctrl)
++{
++	struct cpr3_regulator *vreg;
++	struct cpr3_corner restore_aging_corner;
++	struct cpr3_corner *corner;
++	int *restore_current_corner;
++	bool *restore_vreg_enabled;
++	int i, j, id, rc, rc2, vreg_count, aging_volt, max_aging_volt = 0;
++	u32 reg;
++
++	if (!ctrl->aging_required || !ctrl->cpr_enabled
++	    || ctrl->aggr_corner.ceiling_volt == 0
++	    || ctrl->aggr_corner.ceiling_volt > ctrl->aging_ref_volt)
++		return 0;
++
++	for (i = 0, vreg_count = 0; i < ctrl->thread_count; i++) {
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++			vreg = &ctrl->thread[i].vreg[j];
++			vreg_count++;
++
++			if (vreg->aging_allowed && vreg->vreg_enabled
++			    && vreg->current_corner > vreg->aging_corner)
++				return 0;
++		}
++	}
++
++	/* Verify that none of the aging sensors are currently masked. */
++	for (i = 0; i < ctrl->aging_sensor_count; i++) {
++		id = ctrl->aging_sensor[i].sensor_id;
++		reg = cpr3_read(ctrl, CPR3_REG_SENSOR_MASK_READ(id));
++		if (reg & BIT(id % 32))
++			return 0;
++	}
++
++	/*
++	 * Verify that the aging possible register (if specified) has an
++	 * acceptable value.
++	 */
++	if (ctrl->aging_possible_reg) {
++		reg = readl_relaxed(ctrl->aging_possible_reg);
++		reg &= ctrl->aging_possible_mask;
++		if (reg != ctrl->aging_possible_val)
++			return 0;
++	}
++
++	restore_current_corner = kcalloc(vreg_count,
++				sizeof(*restore_current_corner), GFP_KERNEL);
++	restore_vreg_enabled = kcalloc(vreg_count,
++				sizeof(*restore_vreg_enabled), GFP_KERNEL);
++	if (!restore_current_corner || !restore_vreg_enabled) {
++		kfree(restore_current_corner);
++		kfree(restore_vreg_enabled);
++		return -ENOMEM;
++	}
++
++	/* Force all regulators to the aging corner */
++	for (i = 0, vreg_count = 0; i < ctrl->thread_count; i++) {
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++, vreg_count++) {
++			vreg = &ctrl->thread[i].vreg[j];
++
++			restore_current_corner[vreg_count]
++				= vreg->current_corner;
++			restore_vreg_enabled[vreg_count]
++				= vreg->vreg_enabled;
++
++			vreg->current_corner = vreg->aging_corner;
++			vreg->vreg_enabled = true;
++		}
++	}
++
++	/* Force one of the regulators to require the aging reference voltage */
++	vreg = &ctrl->thread[0].vreg[0];
++	corner = &vreg->corner[vreg->current_corner];
++	restore_aging_corner = *corner;
++	corner->ceiling_volt = ctrl->aging_ref_volt;
++	corner->floor_volt = ctrl->aging_ref_volt;
++	corner->open_loop_volt = ctrl->aging_ref_volt;
++	corner->last_volt = ctrl->aging_ref_volt;
++
++	/* Skip last_volt caching */
++	ctrl->last_corner_was_closed_loop = false;
++
++	/* Set the vdd supply voltage to the aging reference voltage */
++	rc = _cpr3_regulator_update_ctrl_state(ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "unable to force vdd-supply to the aging reference voltage=%d uV, rc=%d\n",
++			ctrl->aging_ref_volt, rc);
++		goto cleanup;
++	}
++
++	if (ctrl->aging_vdd_mode) {
++		rc = regulator_set_mode(ctrl->vdd_regulator,
++					ctrl->aging_vdd_mode);
++		if (rc) {
++			cpr3_err(ctrl, "unable to configure vdd-supply for mode=%u, rc=%d\n",
++				ctrl->aging_vdd_mode, rc);
++			goto cleanup;
++		}
++	}
++
++	/* Perform aging measurement on all aging sensors */
++	for (i = 0; i < ctrl->aging_sensor_count; i++) {
++		for (j = 0; j < CPR3_AGING_RETRY_COUNT; j++) {
++			rc = cpr3_regulator_measure_aging(ctrl,
++					&ctrl->aging_sensor[i]);
++			if (!rc)
++				break;
++		}
++
++		if (!rc) {
++			aging_volt =
++				cpr3_voltage_adjustment(
++					ctrl->aging_sensor[i].ro_scale,
++					ctrl->aging_sensor[i].measured_quot_diff
++					- ctrl->aging_sensor[i].init_quot_diff);
++			max_aging_volt = max(max_aging_volt, aging_volt);
++		} else {
++			cpr3_err(ctrl, "CPR aging measurement failed after %d tries, rc=%d\n",
++				j, rc);
++			ctrl->aging_failed = true;
++			ctrl->aging_required = false;
++			goto cleanup;
++		}
++	}
++
++cleanup:
++	vreg = &ctrl->thread[0].vreg[0];
++	vreg->corner[vreg->current_corner] = restore_aging_corner;
++
++	for (i = 0, vreg_count = 0; i < ctrl->thread_count; i++) {
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++, vreg_count++) {
++			vreg = &ctrl->thread[i].vreg[j];
++			vreg->current_corner
++				= restore_current_corner[vreg_count];
++			vreg->vreg_enabled = restore_vreg_enabled[vreg_count];
++		}
++	}
++
++	kfree(restore_current_corner);
++	kfree(restore_vreg_enabled);
++
++	/* Adjust the CPR target quotients according to the aging measurement */
++	if (!rc) {
++		cpr3_regulator_set_aging_ref_adjustment(ctrl, max_aging_volt);
++
++		cpr3_info(ctrl, "aging measurement successful; aging reference adjustment voltage=%d uV\n",
++			ctrl->aging_ref_adjust_volt);
++		ctrl->aging_succeeded = true;
++		ctrl->aging_required = false;
++	}
++
++	if (ctrl->aging_complete_vdd_mode) {
++		rc = regulator_set_mode(ctrl->vdd_regulator,
++					ctrl->aging_complete_vdd_mode);
++		if (rc)
++			cpr3_err(ctrl, "unable to configure vdd-supply for mode=%u, rc=%d\n",
++				ctrl->aging_complete_vdd_mode, rc);
++	}
++
++	/* Skip last_volt caching */
++	ctrl->last_corner_was_closed_loop = false;
++
++	/*
++	 * Restore vdd-supply to the voltage before the aging measurement and
++	 * restore the CPR3 controller hardware state.
++	 */
++	rc2 = _cpr3_regulator_update_ctrl_state(ctrl);
++
++	/* Stop last_volt caching on for the next request */
++	ctrl->last_corner_was_closed_loop = false;
++
++	return rc ? rc : rc2;
++}
++
++/**
++ * cpr3_regulator_update_ctrl_state() - update the state of the CPR controller
++ *		to reflect the corners used by all CPR3 regulators as well as
++ *		the CPR operating mode and perform aging adjustments if needed
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Note, CPR3 controller lock must be held by the caller.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_update_ctrl_state(struct cpr3_controller *ctrl)
++{
++	int rc;
++
++	rc = _cpr3_regulator_update_ctrl_state(ctrl);
++	if (rc)
++		return rc;
++
++	return cpr3_regulator_aging_adjust(ctrl);
++}
++
++/**
++ * cpr3_regulator_set_voltage() - set the voltage corner for the CPR3 regulator
++ *			associated with the regulator device
++ * @rdev:		Regulator device pointer for the cpr3-regulator
++ * @corner:		New voltage corner to set (offset by CPR3_CORNER_OFFSET)
++ * @corner_max:		Maximum voltage corner allowed (offset by
++ *			CPR3_CORNER_OFFSET)
++ * @selector:		Pointer which is filled with the selector value for the
++ *			corner
++ *
++ * This function is passed as a callback function into the regulator ops that
++ * are registered for each cpr3-regulator device.  The VDD voltage will not be
++ * physically configured until both this function and cpr3_regulator_enable()
++ * are called.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_set_voltage(struct regulator_dev *rdev,
++		int corner, int corner_max, unsigned *selector)
++{
++	struct cpr3_regulator *vreg = rdev_get_drvdata(rdev);
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	int rc = 0;
++	int last_corner;
++
++	corner -= CPR3_CORNER_OFFSET;
++	corner_max -= CPR3_CORNER_OFFSET;
++	*selector = corner;
++
++	mutex_lock(&ctrl->lock);
++
++	if (!vreg->vreg_enabled) {
++		vreg->current_corner = corner;
++		cpr3_debug(vreg, "stored corner=%d\n", corner);
++		goto done;
++	} else if (vreg->current_corner == corner) {
++		goto done;
++	}
++
++	last_corner = vreg->current_corner;
++	vreg->current_corner = corner;
++
++	if (vreg->cpr4_regulator_data != NULL)
++		if (vreg->cpr4_regulator_data->mem_acc_funcs != NULL)
++			vreg->cpr4_regulator_data->mem_acc_funcs->set_mem_acc(rdev);
++
++	rc = cpr3_regulator_update_ctrl_state(ctrl);
++	if (rc) {
++		cpr3_err(vreg, "could not update CPR state, rc=%d\n", rc);
++		vreg->current_corner = last_corner;
++	}
++
++	if (vreg->cpr4_regulator_data != NULL)
++		if (vreg->cpr4_regulator_data->mem_acc_funcs != NULL)
++			vreg->cpr4_regulator_data->mem_acc_funcs->clear_mem_acc(rdev);
++
++	cpr3_debug(vreg, "set corner=%d\n", corner);
++done:
++	mutex_unlock(&ctrl->lock);
++
++	return rc;
++}
++
++/**
++ * cpr3_handle_temp_open_loop_adjustment() - voltage based cold temperature
++ *
++ * @rdev:		Regulator device pointer for the cpr3-regulator
++ * @is_cold:		Flag to denote enter/exit cold condition
++ *
++ * This function is adjusts voltage margin based on cold condition
++ *
++ * Return: 0 = success
++ */
++
++int cpr3_handle_temp_open_loop_adjustment(struct cpr3_controller *ctrl,
++								bool is_cold)
++{
++	int i ,j, k, rc;
++	struct cpr3_regulator *vreg;
++
++	mutex_lock(&ctrl->lock);
++	for (i = 0; i < ctrl->thread_count; i++) {
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++			vreg = &ctrl->thread[i].vreg[j];
++			for (k = 0; k < vreg->corner_count; k++) {
++				vreg->corner[k].open_loop_volt = is_cold ?
++				    vreg->corner[k].cold_temp_open_loop_volt :
++				    vreg->corner[k].normal_temp_open_loop_volt;
++			}
++		}
++	}
++	rc = cpr3_regulator_update_ctrl_state(ctrl);
++	mutex_unlock(&ctrl->lock);
++
++	return rc;
++}
++
++/**
++ * cpr3_regulator_get_voltage() - get the voltage corner for the CPR3 regulator
++ *			associated with the regulator device
++ * @rdev:		Regulator device pointer for the cpr3-regulator
++ *
++ * This function is passed as a callback function into the regulator ops that
++ * are registered for each cpr3-regulator device.
++ *
++ * Return: voltage corner value offset by CPR3_CORNER_OFFSET
++ */
++static int cpr3_regulator_get_voltage(struct regulator_dev *rdev)
++{
++	struct cpr3_regulator *vreg = rdev_get_drvdata(rdev);
++
++	if (vreg->current_corner == CPR3_REGULATOR_CORNER_INVALID)
++		return CPR3_CORNER_OFFSET;
++	else
++		return vreg->current_corner + CPR3_CORNER_OFFSET;
++}
++
++/**
++ * cpr3_regulator_list_voltage() - return the voltage corner mapped to the
++ *			specified selector
++ * @rdev:		Regulator device pointer for the cpr3-regulator
++ * @selector:		Regulator selector
++ *
++ * This function is passed as a callback function into the regulator ops that
++ * are registered for each cpr3-regulator device.
++ *
++ * Return: voltage corner value offset by CPR3_CORNER_OFFSET
++ */
++static int cpr3_regulator_list_voltage(struct regulator_dev *rdev,
++		unsigned selector)
++{
++	struct cpr3_regulator *vreg = rdev_get_drvdata(rdev);
++
++	if (selector < vreg->corner_count)
++		return selector + CPR3_CORNER_OFFSET;
++	else
++		return 0;
++}
++
++/**
++ * cpr3_regulator_is_enabled() - return the enable state of the CPR3 regulator
++ * @rdev:		Regulator device pointer for the cpr3-regulator
++ *
++ * This function is passed as a callback function into the regulator ops that
++ * are registered for each cpr3-regulator device.
++ *
++ * Return: true if regulator is enabled, false if regulator is disabled
++ */
++static int cpr3_regulator_is_enabled(struct regulator_dev *rdev)
++{
++	struct cpr3_regulator *vreg = rdev_get_drvdata(rdev);
++
++	return vreg->vreg_enabled;
++}
++
++/**
++ * cpr3_regulator_enable() - enable the CPR3 regulator
++ * @rdev:		Regulator device pointer for the cpr3-regulator
++ *
++ * This function is passed as a callback function into the regulator ops that
++ * are registered for each cpr3-regulator device.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_enable(struct regulator_dev *rdev)
++{
++	struct cpr3_regulator *vreg = rdev_get_drvdata(rdev);
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	int rc = 0;
++
++	if (vreg->vreg_enabled == true)
++		return 0;
++
++	mutex_lock(&ctrl->lock);
++
++	if (ctrl->system_regulator) {
++		rc = regulator_enable(ctrl->system_regulator);
++		if (rc) {
++			cpr3_err(ctrl, "regulator_enable(system) failed, rc=%d\n",
++				rc);
++			goto done;
++		}
++	}
++
++	rc = regulator_enable(ctrl->vdd_regulator);
++	if (rc) {
++		cpr3_err(vreg, "regulator_enable(vdd) failed, rc=%d\n", rc);
++		goto done;
++	}
++
++	vreg->vreg_enabled = true;
++	rc = cpr3_regulator_update_ctrl_state(ctrl);
++	if (rc) {
++		cpr3_err(vreg, "could not update CPR state, rc=%d\n", rc);
++		regulator_disable(ctrl->vdd_regulator);
++		vreg->vreg_enabled = false;
++		goto done;
++	}
++
++	cpr3_debug(vreg, "Enabled\n");
++done:
++	mutex_unlock(&ctrl->lock);
++
++	return rc;
++}
++
++/**
++ * cpr3_regulator_disable() - disable the CPR3 regulator
++ * @rdev:		Regulator device pointer for the cpr3-regulator
++ *
++ * This function is passed as a callback function into the regulator ops that
++ * are registered for each cpr3-regulator device.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_disable(struct regulator_dev *rdev)
++{
++	struct cpr3_regulator *vreg = rdev_get_drvdata(rdev);
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	int rc, rc2;
++
++	if (vreg->vreg_enabled == false)
++		return 0;
++
++	mutex_lock(&ctrl->lock);
++	rc = regulator_disable(ctrl->vdd_regulator);
++	if (rc) {
++		cpr3_err(vreg, "regulator_disable(vdd) failed, rc=%d\n", rc);
++		goto done;
++	}
++
++	vreg->vreg_enabled = false;
++	rc = cpr3_regulator_update_ctrl_state(ctrl);
++	if (rc) {
++		cpr3_err(vreg, "could not update CPR state, rc=%d\n", rc);
++		rc2 = regulator_enable(ctrl->vdd_regulator);
++		vreg->vreg_enabled = true;
++		goto done;
++	}
++
++	if (ctrl->system_regulator) {
++		rc = regulator_disable(ctrl->system_regulator);
++		if (rc) {
++			cpr3_err(ctrl, "regulator_disable(system) failed, rc=%d\n",
++				rc);
++			goto done;
++		}
++	}
++
++	cpr3_debug(vreg, "Disabled\n");
++done:
++	mutex_unlock(&ctrl->lock);
++
++	return rc;
++}
++
++static struct regulator_ops cpr3_regulator_ops = {
++	.enable			= cpr3_regulator_enable,
++	.disable		= cpr3_regulator_disable,
++	.is_enabled		= cpr3_regulator_is_enabled,
++	.set_voltage		= cpr3_regulator_set_voltage,
++	.get_voltage		= cpr3_regulator_get_voltage,
++	.list_voltage		= cpr3_regulator_list_voltage,
++};
++
++/**
++ * cpr3_print_result() - print CPR measurement results to the kernel log for
++ *		debugging purposes
++ * @thread:		Pointer to the CPR3 thread
++ *
++ * Return: None
++ */
++static void cpr3_print_result(struct cpr3_thread *thread)
++{
++	struct cpr3_controller *ctrl = thread->ctrl;
++	u32 result[3], busy, step_dn, step_up, error_steps, error, negative;
++	u32 quot_min, quot_max, ro_min, ro_max, step_quot_min, step_quot_max;
++	u32 sensor_min, sensor_max;
++	char *sign;
++
++	result[0] = cpr3_read(ctrl, CPR3_REG_RESULT0(thread->thread_id));
++	result[1] = cpr3_read(ctrl, CPR3_REG_RESULT1(thread->thread_id));
++	result[2] = cpr3_read(ctrl, CPR3_REG_RESULT2(thread->thread_id));
++
++	busy = !!(result[0] & CPR3_RESULT0_BUSY_MASK);
++	step_dn = !!(result[0] & CPR3_RESULT0_STEP_DN_MASK);
++	step_up = !!(result[0] & CPR3_RESULT0_STEP_UP_MASK);
++	error_steps = (result[0] & CPR3_RESULT0_ERROR_STEPS_MASK)
++			>> CPR3_RESULT0_ERROR_STEPS_SHIFT;
++	error = (result[0] & CPR3_RESULT0_ERROR_MASK)
++			>> CPR3_RESULT0_ERROR_SHIFT;
++	negative = !!(result[0] & CPR3_RESULT0_NEGATIVE_MASK);
++
++	quot_min = (result[1] & CPR3_RESULT1_QUOT_MIN_MASK)
++			>> CPR3_RESULT1_QUOT_MIN_SHIFT;
++	quot_max = (result[1] & CPR3_RESULT1_QUOT_MAX_MASK)
++			>> CPR3_RESULT1_QUOT_MAX_SHIFT;
++	ro_min = (result[1] & CPR3_RESULT1_RO_MIN_MASK)
++			>> CPR3_RESULT1_RO_MIN_SHIFT;
++	ro_max = (result[1] & CPR3_RESULT1_RO_MAX_MASK)
++			>> CPR3_RESULT1_RO_MAX_SHIFT;
++
++	step_quot_min = (result[2] & CPR3_RESULT2_STEP_QUOT_MIN_MASK)
++			>> CPR3_RESULT2_STEP_QUOT_MIN_SHIFT;
++	step_quot_max = (result[2] & CPR3_RESULT2_STEP_QUOT_MAX_MASK)
++			>> CPR3_RESULT2_STEP_QUOT_MAX_SHIFT;
++	sensor_min = (result[2] & CPR3_RESULT2_SENSOR_MIN_MASK)
++			>> CPR3_RESULT2_SENSOR_MIN_SHIFT;
++	sensor_max = (result[2] & CPR3_RESULT2_SENSOR_MAX_MASK)
++			>> CPR3_RESULT2_SENSOR_MAX_SHIFT;
++
++	sign = negative ? "-" : "";
++	cpr3_debug(ctrl, "thread %u: busy=%u, step_dn=%u, step_up=%u, error_steps=%s%u, error=%s%u\n",
++		thread->thread_id, busy, step_dn, step_up, sign, error_steps,
++		sign, error);
++	cpr3_debug(ctrl, "thread %u: quot_min=%u, quot_max=%u, ro_min=%u, ro_max=%u\n",
++		thread->thread_id, quot_min, quot_max, ro_min, ro_max);
++	cpr3_debug(ctrl, "thread %u: step_quot_min=%u, step_quot_max=%u, sensor_min=%u, sensor_max=%u\n",
++		thread->thread_id, step_quot_min, step_quot_max, sensor_min,
++		sensor_max);
++}
++
++/**
++ * cpr3_thread_busy() - returns if the specified CPR3 thread is busy taking
++ *		a measurement
++ * @thread:		Pointer to the CPR3 thread
++ *
++ * Return: CPR3 busy status
++ */
++static bool cpr3_thread_busy(struct cpr3_thread *thread)
++{
++	u32 result;
++
++	result = cpr3_read(thread->ctrl, CPR3_REG_RESULT0(thread->thread_id));
++
++	return !!(result & CPR3_RESULT0_BUSY_MASK);
++}
++
++/**
++ * cpr3_irq_handler() - CPR interrupt handler callback function used for
++ *		software closed-loop operation
++ * @irq:		CPR interrupt number
++ * @data:		Private data corresponding to the CPR3 controller
++ *			pointer
++ *
++ * This function increases or decreases the vdd supply voltage based upon the
++ * CPR controller recommendation.
++ *
++ * Return: IRQ_HANDLED
++ */
++static irqreturn_t cpr3_irq_handler(int irq, void *data)
++{
++	struct cpr3_controller *ctrl = data;
++	struct cpr3_corner *aggr = &ctrl->aggr_corner;
++	u32 cont = CPR3_CONT_CMD_NACK;
++	u32 reg_last_measurement = 0;
++	struct cpr3_regulator *vreg;
++	struct cpr3_corner *corner;
++	unsigned long flags;
++	int i, j, new_volt, last_volt, dynamic_floor_volt, rc;
++	u32 irq_en, status, cpr_status, ctl;
++	bool up, down;
++
++	mutex_lock(&ctrl->lock);
++
++	if (!ctrl->cpr_enabled) {
++		cpr3_debug(ctrl, "CPR interrupt received but CPR is disabled\n");
++		mutex_unlock(&ctrl->lock);
++		return IRQ_HANDLED;
++	} else if (ctrl->use_hw_closed_loop) {
++		cpr3_debug(ctrl, "CPR interrupt received but CPR is using HW closed-loop\n");
++		goto done;
++	}
++
++	/*
++	 * CPR IRQ status checking and CPR controller disabling must happen
++	 * atomically and without invening delay in order to avoid an interrupt
++	 * storm caused by the handler racing with the CPR controller.
++	 */
++	local_irq_save(flags);
++	preempt_disable();
++
++	status = cpr3_read(ctrl, CPR3_REG_IRQ_STATUS);
++	up = status & CPR3_IRQ_UP;
++	down = status & CPR3_IRQ_DOWN;
++
++	if (!up && !down) {
++		/*
++		 * Toggle the CPR controller off and then back on since the
++		 * hardware and software states are out of sync.  This condition
++		 * occurs after an aging measurement completes as the CPR IRQ
++		 * physically triggers during the aging measurement but the
++		 * handler is stuck waiting on the mutex lock.
++		 */
++		cpr3_ctrl_loop_disable(ctrl);
++
++		local_irq_restore(flags);
++		preempt_enable();
++
++		/* Wait for the loop disable write to complete */
++		mb();
++
++		/* Wait for BUSY=1 and LOOP_EN=0 in CPR controller registers. */
++		for (i = 0; i < CPR3_REGISTER_WRITE_DELAY_US / 10; i++) {
++			cpr_status = cpr3_read(ctrl, CPR3_REG_CPR_STATUS);
++			ctl = cpr3_read(ctrl, CPR3_REG_CPR_CTL);
++			if (cpr_status & CPR3_CPR_STATUS_BUSY_MASK
++			    && (ctl & CPR3_CPR_CTL_LOOP_EN_MASK)
++					== CPR3_CPR_CTL_LOOP_DISABLE)
++				break;
++			udelay(10);
++		}
++		if (i == CPR3_REGISTER_WRITE_DELAY_US / 10)
++			cpr3_debug(ctrl, "CPR controller not disabled after %d us\n",
++				CPR3_REGISTER_WRITE_DELAY_US);
++
++		/* Clear interrupt status */
++		cpr3_write(ctrl, CPR3_REG_IRQ_CLEAR,
++			CPR3_IRQ_UP | CPR3_IRQ_DOWN);
++
++		/* Wait for the interrupt clearing write to complete */
++		mb();
++
++		/* Wait for IRQ_STATUS register to be cleared. */
++		for (i = 0; i < CPR3_REGISTER_WRITE_DELAY_US / 10; i++) {
++			status = cpr3_read(ctrl, CPR3_REG_IRQ_STATUS);
++			if (!(status & (CPR3_IRQ_UP | CPR3_IRQ_DOWN)))
++				break;
++			udelay(10);
++		}
++		if (i == CPR3_REGISTER_WRITE_DELAY_US / 10)
++			cpr3_debug(ctrl, "CPR interrupts not cleared after %d us\n",
++				CPR3_REGISTER_WRITE_DELAY_US);
++
++		cpr3_ctrl_loop_enable(ctrl);
++
++		cpr3_debug(ctrl, "CPR interrupt received but no up or down status bit is set\n");
++
++		mutex_unlock(&ctrl->lock);
++		return IRQ_HANDLED;
++	} else if (up && down) {
++		cpr3_debug(ctrl, "both up and down status bits set\n");
++		/* The up flag takes precedence over the down flag. */
++		down = false;
++	}
++
++	if (ctrl->supports_hw_closed_loop)
++		reg_last_measurement
++			= cpr3_read(ctrl, CPR3_REG_LAST_MEASUREMENT);
++	dynamic_floor_volt = cpr3_regulator_get_dynamic_floor_volt(ctrl,
++							reg_last_measurement);
++
++	local_irq_restore(flags);
++	preempt_enable();
++
++	irq_en = aggr->irq_en;
++	last_volt = aggr->last_volt;
++
++	for (i = 0; i < ctrl->thread_count; i++) {
++		if (cpr3_thread_busy(&ctrl->thread[i])) {
++			cpr3_debug(ctrl, "CPR thread %u busy when it should be waiting for SW cont\n",
++				ctrl->thread[i].thread_id);
++			goto done;
++		}
++	}
++
++	new_volt = up ? last_volt + ctrl->step_volt
++		      : last_volt - ctrl->step_volt;
++
++	/* Re-enable UP/DOWN interrupt when its opposite is received. */
++	irq_en |= up ? CPR3_IRQ_DOWN : CPR3_IRQ_UP;
++
++	if (new_volt > aggr->ceiling_volt) {
++		new_volt = aggr->ceiling_volt;
++		irq_en &= ~CPR3_IRQ_UP;
++		cpr3_debug(ctrl, "limiting to ceiling=%d uV\n",
++			aggr->ceiling_volt);
++	} else if (new_volt < aggr->floor_volt) {
++		new_volt = aggr->floor_volt;
++		irq_en &= ~CPR3_IRQ_DOWN;
++		cpr3_debug(ctrl, "limiting to floor=%d uV\n", aggr->floor_volt);
++	}
++
++	if (down && new_volt < dynamic_floor_volt) {
++		/*
++		 * The vdd-supply voltage should not be decreased below the
++		 * dynamic floor voltage.  However, it is not necessary (and
++		 * counter productive) to force the voltage up to this level
++		 * if it happened to be below it since the closed-loop voltage
++		 * must have gotten there in a safe manner while the power
++		 * domains for the CPR3 regulator imposing the dynamic floor
++		 * were not bypassed.
++		 */
++		new_volt = last_volt;
++		irq_en &= ~CPR3_IRQ_DOWN;
++		cpr3_debug(ctrl, "limiting to dynamic floor=%d uV\n",
++			dynamic_floor_volt);
++	}
++
++	for (i = 0; i < ctrl->thread_count; i++)
++		cpr3_print_result(&ctrl->thread[i]);
++
++	cpr3_debug(ctrl, "%s: new_volt=%d uV, last_volt=%d uV\n",
++		up ? "UP" : "DN", new_volt, last_volt);
++
++	if (ctrl->proc_clock_throttle && last_volt == aggr->ceiling_volt
++	    && new_volt < last_volt)
++		cpr3_write(ctrl, CPR3_REG_PD_THROTTLE,
++				ctrl->proc_clock_throttle);
++
++	if (new_volt != last_volt) {
++		rc = cpr3_regulator_scale_vdd_voltage(ctrl, new_volt,
++						      last_volt,
++						      aggr);
++		if (rc) {
++			cpr3_err(ctrl, "scale_vdd() failed to set vdd=%d uV, rc=%d\n",
++				 new_volt, rc);
++			goto done;
++		}
++		cont = CPR3_CONT_CMD_ACK;
++
++		/*
++		 * Update the closed-loop voltage for all regulators managed
++		 * by this CPR controller.
++		 */
++		for (i = 0; i < ctrl->thread_count; i++) {
++			for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++				vreg = &ctrl->thread[i].vreg[j];
++				cpr3_update_vreg_closed_loop_volt(vreg,
++					new_volt, reg_last_measurement);
++			}
++		}
++	}
++
++	if (ctrl->proc_clock_throttle && new_volt == aggr->ceiling_volt)
++		cpr3_write(ctrl, CPR3_REG_PD_THROTTLE,
++				CPR3_PD_THROTTLE_DISABLE);
++
++	corner = &ctrl->thread[0].vreg[0].corner[
++			ctrl->thread[0].vreg[0].current_corner];
++
++	if (irq_en != aggr->irq_en) {
++		aggr->irq_en = irq_en;
++		cpr3_write(ctrl, CPR3_REG_IRQ_EN, irq_en);
++	}
++
++	aggr->last_volt = new_volt;
++
++done:
++	/* Clear interrupt status */
++	cpr3_write(ctrl, CPR3_REG_IRQ_CLEAR, CPR3_IRQ_UP | CPR3_IRQ_DOWN);
++
++	/* ACK or NACK the CPR controller */
++	cpr3_write(ctrl, CPR3_REG_CONT_CMD, cont);
++
++	mutex_unlock(&ctrl->lock);
++	return IRQ_HANDLED;
++}
++
++/**
++ * cpr3_ceiling_irq_handler() - CPR ceiling reached interrupt handler callback
++ *		function used for hardware closed-loop operation
++ * @irq:		CPR ceiling interrupt number
++ * @data:		Private data corresponding to the CPR3 controller
++ *			pointer
++ *
++ * This function disables processor clock throttling and closed-loop operation
++ * when the ceiling voltage is reached.
++ *
++ * Return: IRQ_HANDLED
++ */
++static irqreturn_t cpr3_ceiling_irq_handler(int irq, void *data)
++{
++	struct cpr3_controller *ctrl = data;
++	int volt;
++
++	mutex_lock(&ctrl->lock);
++
++	if (!ctrl->cpr_enabled) {
++		cpr3_debug(ctrl, "CPR ceiling interrupt received but CPR is disabled\n");
++		goto done;
++	} else if (!ctrl->use_hw_closed_loop) {
++		cpr3_debug(ctrl, "CPR ceiling interrupt received but CPR is using SW closed-loop\n");
++		goto done;
++	}
++
++	volt = regulator_get_voltage(ctrl->vdd_regulator);
++	if (volt < 0) {
++		cpr3_err(ctrl, "could not get vdd voltage, rc=%d\n", volt);
++		goto done;
++	} else if (volt != ctrl->aggr_corner.ceiling_volt) {
++		cpr3_debug(ctrl, "CPR ceiling interrupt received but vdd voltage: %d uV != ceiling voltage: %d uV\n",
++			volt, ctrl->aggr_corner.ceiling_volt);
++		goto done;
++	}
++
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3) {
++		/*
++		 * Since the ceiling voltage has been reached, disable processor
++		 * clock throttling as well as CPR closed-loop operation.
++		 */
++		cpr3_write(ctrl, CPR3_REG_PD_THROTTLE,
++				CPR3_PD_THROTTLE_DISABLE);
++		cpr3_ctrl_loop_disable(ctrl);
++		cpr3_debug(ctrl, "CPR closed-loop and throttling disabled\n");
++	}
++
++done:
++	mutex_unlock(&ctrl->lock);
++	return IRQ_HANDLED;
++}
++
++/**
++ * cpr3_regulator_vreg_register() - register a regulator device for a CPR3
++ *		regulator
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * This function initializes all regulator framework related structures and then
++ * calls regulator_register() for the CPR3 regulator.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_vreg_register(struct cpr3_regulator *vreg)
++{
++	struct regulator_config config = {};
++	struct regulator_desc *rdesc;
++	struct regulator_init_data *init_data;
++	int rc;
++
++	init_data = of_get_regulator_init_data(vreg->thread->ctrl->dev,
++						vreg->of_node, &vreg->rdesc);
++	if (!init_data) {
++		cpr3_err(vreg, "regulator init data is missing\n");
++		return -EINVAL;
++	}
++
++	init_data->constraints.input_uV = init_data->constraints.max_uV;
++	rdesc			= &vreg->rdesc;
++	init_data->constraints.valid_ops_mask |=
++		REGULATOR_CHANGE_VOLTAGE | REGULATOR_CHANGE_STATUS;
++	rdesc->ops = &cpr3_regulator_ops;
++
++	rdesc->n_voltages	= vreg->corner_count;
++	rdesc->name		= init_data->constraints.name;
++	rdesc->owner		= THIS_MODULE;
++	rdesc->type		= REGULATOR_VOLTAGE;
++
++	config.dev		= vreg->thread->ctrl->dev;
++	config.driver_data	= vreg;
++	config.init_data	= init_data;
++	config.of_node		= vreg->of_node;
++
++	vreg->rdev = regulator_register(vreg->thread->ctrl->dev, rdesc, &config);
++	if (IS_ERR(vreg->rdev)) {
++		rc = PTR_ERR(vreg->rdev);
++		cpr3_err(vreg, "regulator_register failed, rc=%d\n", rc);
++		return rc;
++	}
++
++	return 0;
++}
++
++static int debugfs_int_set(void *data, u64 val)
++{
++	*(int *)data = val;
++	return 0;
++}
++
++static int debugfs_int_get(void *data, u64 *val)
++{
++	*val = *(int *)data;
++	return 0;
++}
++DEFINE_SIMPLE_ATTRIBUTE(fops_int, debugfs_int_get, debugfs_int_set, "%lld\n");
++DEFINE_SIMPLE_ATTRIBUTE(fops_int_ro, debugfs_int_get, NULL, "%lld\n");
++DEFINE_SIMPLE_ATTRIBUTE(fops_int_wo, NULL, debugfs_int_set, "%lld\n");
++
++/**
++ * debugfs_create_int - create a debugfs file that is used to read and write a
++ *		signed int value
++ * @name:		Pointer to a string containing the name of the file to
++ *			create
++ * @mode:		The permissions that the file should have
++ * @parent:		Pointer to the parent dentry for this file.  This should
++ *			be a directory dentry if set.  If this parameter is
++ *			%NULL, then the file will be created in the root of the
++ *			debugfs filesystem.
++ * @value:		Pointer to the variable that the file should read to and
++ *			write from
++ *
++ * This function creates a file in debugfs with the given name that
++ * contains the value of the variable @value.  If the @mode variable is so
++ * set, it can be read from, and written to.
++ *
++ * This function will return a pointer to a dentry if it succeeds.  This
++ * pointer must be passed to the debugfs_remove() function when the file is
++ * to be removed.  If an error occurs, %NULL will be returned.
++ */
++static struct dentry *debugfs_create_int(const char *name, umode_t mode,
++				struct dentry *parent, int *value)
++{
++	/* if there are no write bits set, make read only */
++	if (!(mode & S_IWUGO))
++		return debugfs_create_file(name, mode, parent, value,
++					   &fops_int_ro);
++	/* if there are no read bits set, make write only */
++	if (!(mode & S_IRUGO))
++		return debugfs_create_file(name, mode, parent, value,
++					   &fops_int_wo);
++
++	return debugfs_create_file(name, mode, parent, value, &fops_int);
++}
++
++static int debugfs_bool_get(void *data, u64 *val)
++{
++	*val = *(bool *)data;
++	return 0;
++}
++DEFINE_SIMPLE_ATTRIBUTE(fops_bool_ro, debugfs_bool_get, NULL, "%lld\n");
++
++/**
++ * struct cpr3_debug_corner_info - data structure used by the
++ *		cpr3_debugfs_create_corner_int function
++ * @vreg:		Pointer to the CPR3 regulator
++ * @index:		Pointer to the corner array index
++ * @member_offset:	Offset in bytes from the beginning of struct cpr3_corner
++ *			to the beginning of the value to be read from
++ * @corner:		Pointer to the CPR3 corner array
++ */
++struct cpr3_debug_corner_info {
++	struct cpr3_regulator	*vreg;
++	int			*index;
++	size_t			member_offset;
++	struct cpr3_corner	*corner;
++};
++
++static int cpr3_debug_corner_int_get(void *data, u64 *val)
++{
++	struct cpr3_debug_corner_info *info = data;
++	struct cpr3_controller *ctrl = info->vreg->thread->ctrl;
++	int i;
++
++	mutex_lock(&ctrl->lock);
++
++	i = *info->index;
++	if (i < 0)
++		i = 0;
++
++	*val = *(int *)((char *)&info->vreg->corner[i] + info->member_offset);
++
++	mutex_unlock(&ctrl->lock);
++
++	return 0;
++}
++DEFINE_SIMPLE_ATTRIBUTE(cpr3_debug_corner_int_fops, cpr3_debug_corner_int_get,
++			NULL, "%lld\n");
++
++/**
++ * cpr3_debugfs_create_corner_int - create a debugfs file that is used to read
++ *		a signed int value out of a CPR3 regulator's corner array
++ * @vreg:		Pointer to the CPR3 regulator
++ * @name:		Pointer to a string containing the name of the file to
++ *			create
++ * @mode:		The permissions that the file should have
++ * @parent:		Pointer to the parent dentry for this file.  This should
++ *			be a directory dentry if set.  If this parameter is
++ *			%NULL, then the file will be created in the root of the
++ *			debugfs filesystem.
++ * @index:		Pointer to the corner array index
++ * @member_offset:	Offset in bytes from the beginning of struct cpr3_corner
++ *			to the beginning of the value to be read from
++ *
++ * This function creates a file in debugfs with the given name that
++ * contains the value of the int type variable vreg->corner[index].member
++ * where member_offset == offsetof(struct cpr3_corner, member).
++ */
++static struct dentry *cpr3_debugfs_create_corner_int(
++		struct cpr3_regulator *vreg, const char *name, umode_t mode,
++		struct dentry *parent, int *index, size_t member_offset)
++{
++	struct cpr3_debug_corner_info *info;
++
++	info = devm_kzalloc(vreg->thread->ctrl->dev, sizeof(*info), GFP_KERNEL);
++	if (!info)
++		return NULL;
++
++	info->vreg = vreg;
++	info->index = index;
++	info->member_offset = member_offset;
++
++	return debugfs_create_file(name, mode, parent, info,
++				   &cpr3_debug_corner_int_fops);
++}
++
++static int cpr3_debug_quot_open(struct inode *inode, struct file *file)
++{
++	struct cpr3_debug_corner_info *info = inode->i_private;
++	struct cpr3_thread *thread = info->vreg->thread;
++	int size, i, pos;
++	u32 *quot;
++	char *buf;
++
++	/*
++	 * Max size:
++	 *  - 10 digits + ' ' or '\n' = 11 bytes per number
++	 *  - terminating '\0'
++	 */
++	size = CPR3_RO_COUNT * 11;
++	buf = kzalloc(size + 1, GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++
++	file->private_data = buf;
++
++	mutex_lock(&thread->ctrl->lock);
++
++	quot = info->corner[*info->index].target_quot;
++
++	for (i = 0, pos = 0; i < CPR3_RO_COUNT; i++)
++		pos += scnprintf(buf + pos, size - pos, "%u%c",
++			quot[i], i < CPR3_RO_COUNT - 1 ? ' ' : '\n');
++
++	mutex_unlock(&thread->ctrl->lock);
++
++	return nonseekable_open(inode, file);
++}
++
++static ssize_t cpr3_debug_quot_read(struct file *file, char __user *buf,
++		size_t len, loff_t *ppos)
++{
++	return simple_read_from_buffer(buf, len, ppos, file->private_data,
++					strlen(file->private_data));
++}
++
++static int cpr3_debug_quot_release(struct inode *inode, struct file *file)
++{
++	kfree(file->private_data);
++
++	return 0;
++}
++
++static const struct file_operations cpr3_debug_quot_fops = {
++	.owner	 = THIS_MODULE,
++	.open	 = cpr3_debug_quot_open,
++	.release = cpr3_debug_quot_release,
++	.read	 = cpr3_debug_quot_read,
++};
++
++/**
++ * cpr3_regulator_debugfs_corner_add() - add debugfs files to expose
++ *		configuration data for the CPR corner
++ * @vreg:		Pointer to the CPR3 regulator
++ * @corner_dir:		Pointer to the parent corner dentry for the new files
++ * @index:		Pointer to the corner array index
++ *
++ * Return: none
++ */
++static void cpr3_regulator_debugfs_corner_add(struct cpr3_regulator *vreg,
++		struct dentry *corner_dir, int *index)
++{
++	struct cpr3_debug_corner_info *info;
++	struct dentry *temp;
++
++	temp = cpr3_debugfs_create_corner_int(vreg, "floor_volt", S_IRUGO,
++		corner_dir, index, offsetof(struct cpr3_corner, floor_volt));
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(vreg, "floor_volt debugfs file creation failed\n");
++		return;
++	}
++
++	temp = cpr3_debugfs_create_corner_int(vreg, "ceiling_volt", S_IRUGO,
++		corner_dir, index, offsetof(struct cpr3_corner, ceiling_volt));
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(vreg, "ceiling_volt debugfs file creation failed\n");
++		return;
++	}
++
++	temp = cpr3_debugfs_create_corner_int(vreg, "open_loop_volt", S_IRUGO,
++		corner_dir, index,
++		offsetof(struct cpr3_corner, open_loop_volt));
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(vreg, "open_loop_volt debugfs file creation failed\n");
++		return;
++	}
++
++	temp = cpr3_debugfs_create_corner_int(vreg, "last_volt", S_IRUGO,
++		corner_dir, index, offsetof(struct cpr3_corner, last_volt));
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(vreg, "last_volt debugfs file creation failed\n");
++		return;
++	}
++
++	info = devm_kzalloc(vreg->thread->ctrl->dev, sizeof(*info), GFP_KERNEL);
++	if (!info)
++		return;
++
++	info->vreg = vreg;
++	info->index = index;
++	info->corner = vreg->corner;
++
++	temp = debugfs_create_file("target_quots", S_IRUGO, corner_dir,
++				info, &cpr3_debug_quot_fops);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(vreg, "target_quots debugfs file creation failed\n");
++		return;
++	}
++}
++
++/**
++ * cpr3_debug_corner_index_set() - debugfs callback used to change the
++ *		value of the CPR3 regulator debug_corner index
++ * @data:		Pointer to private data which is equal to the CPR3
++ *			regulator pointer
++ * @val:		New value for debug_corner
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_debug_corner_index_set(void *data, u64 val)
++{
++	struct cpr3_regulator *vreg = data;
++
++	if (val < CPR3_CORNER_OFFSET || val > vreg->corner_count) {
++		cpr3_err(vreg, "invalid corner index %llu; allowed values: %d-%d\n",
++			val, CPR3_CORNER_OFFSET, vreg->corner_count);
++		return -EINVAL;
++	}
++
++	mutex_lock(&vreg->thread->ctrl->lock);
++	vreg->debug_corner = val - CPR3_CORNER_OFFSET;
++	mutex_unlock(&vreg->thread->ctrl->lock);
++
++	return 0;
++}
++
++/**
++ * cpr3_debug_corner_index_get() - debugfs callback used to retrieve
++ *		the value of the CPR3 regulator debug_corner index
++ * @data:		Pointer to private data which is equal to the CPR3
++ *			regulator pointer
++ * @val:		Output parameter written with the value of
++ *			debug_corner
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_debug_corner_index_get(void *data, u64 *val)
++{
++	struct cpr3_regulator *vreg = data;
++
++	*val = vreg->debug_corner + CPR3_CORNER_OFFSET;
++
++	return 0;
++}
++DEFINE_SIMPLE_ATTRIBUTE(cpr3_debug_corner_index_fops,
++			cpr3_debug_corner_index_get,
++			cpr3_debug_corner_index_set,
++			"%llu\n");
++
++/**
++ * cpr3_debug_current_corner_index_get() - debugfs callback used to retrieve
++ *		the value of the CPR3 regulator current_corner index
++ * @data:		Pointer to private data which is equal to the CPR3
++ *			regulator pointer
++ * @val:		Output parameter written with the value of
++ *			current_corner
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_debug_current_corner_index_get(void *data, u64 *val)
++{
++	struct cpr3_regulator *vreg = data;
++
++	*val = vreg->current_corner + CPR3_CORNER_OFFSET;
++
++	return 0;
++}
++DEFINE_SIMPLE_ATTRIBUTE(cpr3_debug_current_corner_index_fops,
++			cpr3_debug_current_corner_index_get,
++			NULL, "%llu\n");
++
++/**
++ * cpr3_regulator_debugfs_vreg_add() - add debugfs files to expose configuration
++ *		data for the CPR3 regulator
++ * @vreg:		Pointer to the CPR3 regulator
++ * @thread_dir		CPR3 thread debugfs directory handle
++ *
++ * Return: none
++ */
++static void cpr3_regulator_debugfs_vreg_add(struct cpr3_regulator *vreg,
++				struct dentry *thread_dir)
++{
++	struct dentry *temp, *corner_dir, *vreg_dir;
++
++	vreg_dir = debugfs_create_dir(vreg->name, thread_dir);
++	if (IS_ERR_OR_NULL(vreg_dir)) {
++		cpr3_err(vreg, "%s debugfs directory creation failed\n",
++			vreg->name);
++		return;
++	}
++
++	temp = debugfs_create_int("speed_bin_fuse", S_IRUGO, vreg_dir,
++				  &vreg->speed_bin_fuse);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(vreg, "speed_bin_fuse debugfs file creation failed\n");
++		return;
++	}
++
++	temp = debugfs_create_int("cpr_rev_fuse", S_IRUGO, vreg_dir,
++				  &vreg->cpr_rev_fuse);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(vreg, "cpr_rev_fuse debugfs file creation failed\n");
++		return;
++	}
++
++	temp = debugfs_create_int("fuse_combo", S_IRUGO, vreg_dir,
++				  &vreg->fuse_combo);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(vreg, "fuse_combo debugfs file creation failed\n");
++		return;
++	}
++
++	temp = debugfs_create_int("corner_count", S_IRUGO, vreg_dir,
++				  &vreg->corner_count);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(vreg, "corner_count debugfs file creation failed\n");
++		return;
++	}
++
++	corner_dir = debugfs_create_dir("corner", vreg_dir);
++	if (IS_ERR_OR_NULL(corner_dir)) {
++		cpr3_err(vreg, "corner debugfs directory creation failed\n");
++		return;
++	}
++
++	temp = debugfs_create_file("index", S_IRUGO | S_IWUSR, corner_dir,
++				vreg, &cpr3_debug_corner_index_fops);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(vreg, "index debugfs file creation failed\n");
++		return;
++	}
++
++	cpr3_regulator_debugfs_corner_add(vreg, corner_dir,
++					&vreg->debug_corner);
++
++	corner_dir = debugfs_create_dir("current_corner", vreg_dir);
++	if (IS_ERR_OR_NULL(corner_dir)) {
++		cpr3_err(vreg, "current_corner debugfs directory creation failed\n");
++		return;
++	}
++
++	temp = debugfs_create_file("index", S_IRUGO, corner_dir,
++				vreg, &cpr3_debug_current_corner_index_fops);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(vreg, "index debugfs file creation failed\n");
++		return;
++	}
++
++	cpr3_regulator_debugfs_corner_add(vreg, corner_dir,
++					  &vreg->current_corner);
++}
++
++/**
++ * cpr3_regulator_debugfs_thread_add() - add debugfs files to expose
++ *		configuration data for the CPR thread
++ * @thread:		Pointer to the CPR3 thread
++ *
++ * Return: none
++ */
++static void cpr3_regulator_debugfs_thread_add(struct cpr3_thread *thread)
++{
++	struct cpr3_controller *ctrl = thread->ctrl;
++	struct dentry *aggr_dir, *temp, *thread_dir;
++	struct cpr3_debug_corner_info *info;
++	char buf[20];
++	int *index;
++	int i;
++
++	scnprintf(buf, sizeof(buf), "thread%u", thread->thread_id);
++	thread_dir = debugfs_create_dir(buf, thread->ctrl->debugfs);
++	if (IS_ERR_OR_NULL(thread_dir)) {
++		cpr3_err(ctrl, "thread %u %s debugfs directory creation failed\n",
++			thread->thread_id, buf);
++		return;
++	}
++
++	aggr_dir = debugfs_create_dir("max_aggregated_params", thread_dir);
++	if (IS_ERR_OR_NULL(aggr_dir)) {
++		cpr3_err(ctrl, "thread %u max_aggregated_params debugfs directory creation failed\n",
++			thread->thread_id);
++		return;
++	}
++
++	temp = debugfs_create_int("floor_volt", S_IRUGO, aggr_dir,
++				  &thread->aggr_corner.floor_volt);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(ctrl, "thread %u aggr floor_volt debugfs file creation failed\n",
++			thread->thread_id);
++		return;
++	}
++
++	temp = debugfs_create_int("ceiling_volt", S_IRUGO, aggr_dir,
++				  &thread->aggr_corner.ceiling_volt);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(ctrl, "thread %u aggr ceiling_volt debugfs file creation failed\n",
++			thread->thread_id);
++		return;
++	}
++
++	temp = debugfs_create_int("open_loop_volt", S_IRUGO, aggr_dir,
++				  &thread->aggr_corner.open_loop_volt);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(ctrl, "thread %u aggr open_loop_volt debugfs file creation failed\n",
++			thread->thread_id);
++		return;
++	}
++
++	temp = debugfs_create_int("last_volt", S_IRUGO, aggr_dir,
++				  &thread->aggr_corner.last_volt);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(ctrl, "thread %u aggr last_volt debugfs file creation failed\n",
++			thread->thread_id);
++		return;
++	}
++
++	info = devm_kzalloc(thread->ctrl->dev, sizeof(*info), GFP_KERNEL);
++	index = devm_kzalloc(thread->ctrl->dev, sizeof(*index), GFP_KERNEL);
++	if (!info || !index)
++		return;
++	*index = 0;
++	info->vreg = &thread->vreg[0];
++	info->index = index;
++	info->corner = &thread->aggr_corner;
++
++	temp = debugfs_create_file("target_quots", S_IRUGO, aggr_dir,
++				info, &cpr3_debug_quot_fops);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(ctrl, "thread %u target_quots debugfs file creation failed\n",
++			thread->thread_id);
++		return;
++	}
++
++	for (i = 0; i < thread->vreg_count; i++)
++		cpr3_regulator_debugfs_vreg_add(&thread->vreg[i], thread_dir);
++}
++
++/**
++ * cpr3_debug_closed_loop_enable_set() - debugfs callback used to change the
++ *		value of the CPR controller cpr_allowed_sw flag which enables or
++ *		disables closed-loop operation
++ * @data:		Pointer to private data which is equal to the CPR
++ *			controller pointer
++ * @val:		New value for cpr_allowed_sw
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_debug_closed_loop_enable_set(void *data, u64 val)
++{
++	struct cpr3_controller *ctrl = data;
++	bool enable = !!val;
++	int rc;
++
++	mutex_lock(&ctrl->lock);
++
++	if (ctrl->cpr_allowed_sw == enable)
++		goto done;
++
++	if (enable && !ctrl->cpr_allowed_hw) {
++		cpr3_err(ctrl, "CPR closed-loop operation is not allowed\n");
++		goto done;
++	}
++
++	ctrl->cpr_allowed_sw = enable;
++
++	rc = cpr3_regulator_update_ctrl_state(ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "could not change CPR enable state=%u, rc=%d\n",
++			 enable, rc);
++		goto done;
++	}
++
++	if (ctrl->proc_clock_throttle && !ctrl->cpr_enabled) {
++		rc = cpr3_clock_enable(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "clock enable failed, rc=%d\n",
++				 rc);
++			goto done;
++		}
++		ctrl->cpr_enabled = true;
++
++		cpr3_write(ctrl, CPR3_REG_PD_THROTTLE,
++			   CPR3_PD_THROTTLE_DISABLE);
++
++		cpr3_clock_disable(ctrl);
++		ctrl->cpr_enabled = false;
++	}
++
++	cpr3_debug(ctrl, "closed-loop=%s\n", enable ? "enabled" : "disabled");
++done:
++	mutex_unlock(&ctrl->lock);
++	return 0;
++}
++
++/**
++ * cpr3_debug_closed_loop_enable_get() - debugfs callback used to retrieve
++ *		the value of the CPR controller cpr_allowed_sw flag which
++ *		indicates if closed-loop operation is enabled
++ * @data:		Pointer to private data which is equal to the CPR
++ *			controller pointer
++ * @val:		Output parameter written with the value of
++ *			cpr_allowed_sw
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_debug_closed_loop_enable_get(void *data, u64 *val)
++{
++	struct cpr3_controller *ctrl = data;
++
++	*val = ctrl->cpr_allowed_sw;
++
++	return 0;
++}
++DEFINE_SIMPLE_ATTRIBUTE(cpr3_debug_closed_loop_enable_fops,
++			cpr3_debug_closed_loop_enable_get,
++			cpr3_debug_closed_loop_enable_set,
++			"%llu\n");
++
++/**
++ * cpr3_debug_hw_closed_loop_enable_set() - debugfs callback used to change the
++ *		value of the CPR controller use_hw_closed_loop flag which
++ *		switches between software closed-loop and hardware closed-loop
++ *		operation for CPR3 and CPR4 controllers and between open-loop
++ *		and full hardware closed-loop operation for CPRh controllers.
++ * @data:		Pointer to private data which is equal to the CPR
++ *			controller pointer
++ * @val:		New value for use_hw_closed_loop
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_debug_hw_closed_loop_enable_set(void *data, u64 val)
++{
++	struct cpr3_controller *ctrl = data;
++	bool use_hw_closed_loop = !!val;
++	struct cpr3_regulator *vreg;
++	bool cpr_enabled;
++	int i, j, k, rc;
++
++	mutex_lock(&ctrl->lock);
++
++	if (ctrl->use_hw_closed_loop == use_hw_closed_loop)
++		goto done;
++
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++		rc = cpr3_ctrl_clear_cpr4_config(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "failed to clear CPR4 configuration,rc=%d\n",
++				rc);
++			goto done;
++		}
++	}
++
++	cpr3_ctrl_loop_disable(ctrl);
++
++	ctrl->use_hw_closed_loop = use_hw_closed_loop;
++
++	cpr_enabled = ctrl->cpr_enabled;
++
++	/* Ensure that CPR clocks are enabled before writing to registers. */
++	if (!cpr_enabled) {
++		rc = cpr3_clock_enable(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "clock enable failed, rc=%d\n", rc);
++			goto done;
++		}
++		ctrl->cpr_enabled = true;
++	}
++
++	if (ctrl->use_hw_closed_loop)
++		cpr3_write(ctrl, CPR3_REG_IRQ_EN, 0);
++
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++		cpr3_masked_write(ctrl, CPR4_REG_MARGIN_ADJ_CTL,
++			CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_EN_MASK,
++			ctrl->use_hw_closed_loop
++			? CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_ENABLE
++			: CPR4_MARGIN_ADJ_CTL_HW_CLOSED_LOOP_DISABLE);
++	} else if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3) {
++		cpr3_write(ctrl, CPR3_REG_HW_CLOSED_LOOP,
++			ctrl->use_hw_closed_loop
++			? CPR3_HW_CLOSED_LOOP_ENABLE
++			: CPR3_HW_CLOSED_LOOP_DISABLE);
++	}
++
++	/* Turn off CPR clocks if they were off before this function call. */
++	if (!cpr_enabled) {
++		cpr3_clock_disable(ctrl);
++		ctrl->cpr_enabled = false;
++	}
++
++	if (ctrl->use_hw_closed_loop && ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3) {
++		rc = regulator_enable(ctrl->vdd_limit_regulator);
++		if (rc) {
++			cpr3_err(ctrl, "CPR limit regulator enable failed, rc=%d\n",
++				rc);
++			goto done;
++		}
++	} else if (!ctrl->use_hw_closed_loop
++			&& ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3) {
++		rc = regulator_disable(ctrl->vdd_limit_regulator);
++		if (rc) {
++			cpr3_err(ctrl, "CPR limit regulator disable failed, rc=%d\n",
++				rc);
++			goto done;
++		}
++	}
++
++	/*
++	 * Due to APM and mem-acc floor restriction constraints,
++	 * the closed-loop voltage may be different when using
++	 * software closed-loop vs hardware closed-loop.  Therefore,
++	 * reset the cached closed-loop voltage for all corners to the
++	 * corresponding open-loop voltage when switching between
++	 * SW and HW closed-loop mode.
++	 */
++	for (i = 0; i < ctrl->thread_count; i++) {
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++			vreg = &ctrl->thread[i].vreg[j];
++			for (k = 0; k < vreg->corner_count; k++)
++				vreg->corner[k].last_volt
++				= vreg->corner[k].open_loop_volt;
++		}
++	}
++
++	/* Skip last_volt caching */
++	ctrl->last_corner_was_closed_loop = false;
++
++	rc = cpr3_regulator_update_ctrl_state(ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "could not change CPR HW closed-loop enable state=%u, rc=%d\n",
++			 use_hw_closed_loop, rc);
++		goto done;
++	}
++
++	cpr3_debug(ctrl, "CPR mode=%s\n",
++		   use_hw_closed_loop ?
++		   "HW closed-loop" : "SW closed-loop");
++done:
++	mutex_unlock(&ctrl->lock);
++	return 0;
++}
++
++/**
++ * cpr3_debug_hw_closed_loop_enable_get() - debugfs callback used to retrieve
++ *		the value of the CPR controller use_hw_closed_loop flag which
++ *		indicates if hardware closed-loop operation is being used in
++ *		place of software closed-loop operation
++ * @data:		Pointer to private data which is equal to the CPR
++ *			controller pointer
++ * @val:		Output parameter written with the value of
++ *			use_hw_closed_loop
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_debug_hw_closed_loop_enable_get(void *data, u64 *val)
++{
++	struct cpr3_controller *ctrl = data;
++
++	*val = ctrl->use_hw_closed_loop;
++
++	return 0;
++}
++DEFINE_SIMPLE_ATTRIBUTE(cpr3_debug_hw_closed_loop_enable_fops,
++			cpr3_debug_hw_closed_loop_enable_get,
++			cpr3_debug_hw_closed_loop_enable_set,
++			"%llu\n");
++
++/**
++ * cpr3_debug_trigger_aging_measurement_set() - debugfs callback used to trigger
++ *		another CPR measurement
++ * @data:		Pointer to private data which is equal to the CPR
++ *			controller pointer
++ * @val:		Unused
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_debug_trigger_aging_measurement_set(void *data, u64 val)
++{
++	struct cpr3_controller *ctrl = data;
++	int rc;
++
++	mutex_lock(&ctrl->lock);
++
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++		rc = cpr3_ctrl_clear_cpr4_config(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "failed to clear CPR4 configuration,rc=%d\n",
++				rc);
++			goto done;
++		}
++	}
++
++	cpr3_ctrl_loop_disable(ctrl);
++
++	cpr3_regulator_set_aging_ref_adjustment(ctrl, INT_MAX);
++	ctrl->aging_required = true;
++	ctrl->aging_succeeded = false;
++	ctrl->aging_failed = false;
++
++	rc = cpr3_regulator_update_ctrl_state(ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "could not update the CPR controller state, rc=%d\n",
++			rc);
++		goto done;
++	}
++
++done:
++	mutex_unlock(&ctrl->lock);
++	return 0;
++}
++DEFINE_SIMPLE_ATTRIBUTE(cpr3_debug_trigger_aging_measurement_fops,
++			NULL,
++			cpr3_debug_trigger_aging_measurement_set,
++			"%llu\n");
++
++/**
++ * cpr3_regulator_debugfs_ctrl_add() - add debugfs files to expose configuration
++ *		data for the CPR controller
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: none
++ */
++static void cpr3_regulator_debugfs_ctrl_add(struct cpr3_controller *ctrl)
++{
++	struct dentry *temp, *aggr_dir;
++	int i;
++
++	/* Add cpr3-regulator base directory if it isn't present already. */
++	if (cpr3_debugfs_base == NULL) {
++		cpr3_debugfs_base = debugfs_create_dir("cpr3-regulator", NULL);
++		if (IS_ERR_OR_NULL(cpr3_debugfs_base)) {
++			cpr3_err(ctrl, "cpr3-regulator debugfs base directory creation failed\n");
++			cpr3_debugfs_base = NULL;
++			return;
++		}
++	}
++
++	ctrl->debugfs = debugfs_create_dir(ctrl->name, cpr3_debugfs_base);
++	if (IS_ERR_OR_NULL(ctrl->debugfs)) {
++		cpr3_err(ctrl, "cpr3-regulator controller debugfs directory creation failed\n");
++		return;
++	}
++
++	temp = debugfs_create_file("cpr_closed_loop_enable", S_IRUGO | S_IWUSR,
++					ctrl->debugfs, ctrl,
++					&cpr3_debug_closed_loop_enable_fops);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(ctrl, "cpr_closed_loop_enable debugfs file creation failed\n");
++		return;
++	}
++
++	if (ctrl->supports_hw_closed_loop) {
++		temp = debugfs_create_file("use_hw_closed_loop",
++					S_IRUGO | S_IWUSR, ctrl->debugfs, ctrl,
++					&cpr3_debug_hw_closed_loop_enable_fops);
++		if (IS_ERR_OR_NULL(temp)) {
++			cpr3_err(ctrl, "use_hw_closed_loop debugfs file creation failed\n");
++			return;
++		}
++	}
++
++	temp = debugfs_create_int("thread_count", S_IRUGO, ctrl->debugfs,
++				  &ctrl->thread_count);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(ctrl, "thread_count debugfs file creation failed\n");
++		return;
++	}
++
++	if (ctrl->apm) {
++		temp = debugfs_create_int("apm_threshold_volt", S_IRUGO,
++				ctrl->debugfs, &ctrl->apm_threshold_volt);
++		if (IS_ERR_OR_NULL(temp)) {
++			cpr3_err(ctrl, "apm_threshold_volt debugfs file creation failed\n");
++			return;
++		}
++	}
++
++	if (ctrl->aging_required || ctrl->aging_succeeded
++	    || ctrl->aging_failed) {
++		temp = debugfs_create_int("aging_adj_volt", S_IRUGO,
++				ctrl->debugfs, &ctrl->aging_ref_adjust_volt);
++		if (IS_ERR_OR_NULL(temp)) {
++			cpr3_err(ctrl, "aging_adj_volt debugfs file creation failed\n");
++			return;
++		}
++
++		temp = debugfs_create_file("aging_succeeded", S_IRUGO,
++			ctrl->debugfs, &ctrl->aging_succeeded, &fops_bool_ro);
++		if (IS_ERR_OR_NULL(temp)) {
++			cpr3_err(ctrl, "aging_succeeded debugfs file creation failed\n");
++			return;
++		}
++
++		temp = debugfs_create_file("aging_failed", S_IRUGO,
++			ctrl->debugfs, &ctrl->aging_failed, &fops_bool_ro);
++		if (IS_ERR_OR_NULL(temp)) {
++			cpr3_err(ctrl, "aging_failed debugfs file creation failed\n");
++			return;
++		}
++
++		temp = debugfs_create_file("aging_trigger", S_IWUSR,
++			ctrl->debugfs, ctrl,
++			&cpr3_debug_trigger_aging_measurement_fops);
++		if (IS_ERR_OR_NULL(temp)) {
++			cpr3_err(ctrl, "aging_trigger debugfs file creation failed\n");
++			return;
++		}
++	}
++
++	aggr_dir = debugfs_create_dir("max_aggregated_voltages", ctrl->debugfs);
++	if (IS_ERR_OR_NULL(aggr_dir)) {
++		cpr3_err(ctrl, "max_aggregated_voltages debugfs directory creation failed\n");
++		return;
++	}
++
++	temp = debugfs_create_int("floor_volt", S_IRUGO, aggr_dir,
++				  &ctrl->aggr_corner.floor_volt);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(ctrl, "aggr floor_volt debugfs file creation failed\n");
++		return;
++	}
++
++	temp = debugfs_create_int("ceiling_volt", S_IRUGO, aggr_dir,
++				  &ctrl->aggr_corner.ceiling_volt);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(ctrl, "aggr ceiling_volt debugfs file creation failed\n");
++		return;
++	}
++
++	temp = debugfs_create_int("open_loop_volt", S_IRUGO, aggr_dir,
++				  &ctrl->aggr_corner.open_loop_volt);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(ctrl, "aggr open_loop_volt debugfs file creation failed\n");
++		return;
++	}
++
++	temp = debugfs_create_int("last_volt", S_IRUGO, aggr_dir,
++				  &ctrl->aggr_corner.last_volt);
++	if (IS_ERR_OR_NULL(temp)) {
++		cpr3_err(ctrl, "aggr last_volt debugfs file creation failed\n");
++		return;
++	}
++
++	for (i = 0; i < ctrl->thread_count; i++)
++		cpr3_regulator_debugfs_thread_add(&ctrl->thread[i]);
++}
++
++/**
++ * cpr3_regulator_debugfs_ctrl_remove() - remove debugfs files for the CPR
++ *		controller
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Note, this function must be called after the controller has been removed from
++ * cpr3_controller_list and while the cpr3_controller_list_mutex lock is held.
++ *
++ * Return: none
++ */
++static void cpr3_regulator_debugfs_ctrl_remove(struct cpr3_controller *ctrl)
++{
++	if (list_empty(&cpr3_controller_list)) {
++		debugfs_remove_recursive(cpr3_debugfs_base);
++		cpr3_debugfs_base = NULL;
++	} else {
++		debugfs_remove_recursive(ctrl->debugfs);
++	}
++}
++
++/**
++ * cpr3_regulator_init_ctrl_data() - performs initialization of CPR controller
++ *					elements
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_init_ctrl_data(struct cpr3_controller *ctrl)
++{
++	/* Read the initial vdd voltage from hardware. */
++	ctrl->aggr_corner.last_volt
++		= regulator_get_voltage(ctrl->vdd_regulator);
++	if (ctrl->aggr_corner.last_volt < 0) {
++		cpr3_err(ctrl, "regulator_get_voltage(vdd) failed, rc=%d\n",
++				ctrl->aggr_corner.last_volt);
++		return ctrl->aggr_corner.last_volt;
++	}
++	ctrl->aggr_corner.open_loop_volt = ctrl->aggr_corner.last_volt;
++
++	return 0;
++}
++
++/**
++ * cpr3_regulator_init_vreg_data() - performs initialization of common CPR3
++ *		regulator elements and validate aging configurations
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_init_vreg_data(struct cpr3_regulator *vreg)
++{
++	int i, j;
++	bool init_aging;
++
++	vreg->current_corner = CPR3_REGULATOR_CORNER_INVALID;
++	vreg->last_closed_loop_corner = CPR3_REGULATOR_CORNER_INVALID;
++
++	init_aging = vreg->aging_allowed && vreg->thread->ctrl->aging_required;
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		vreg->corner[i].last_volt = vreg->corner[i].open_loop_volt;
++		vreg->corner[i].irq_en = CPR3_IRQ_UP | CPR3_IRQ_DOWN;
++
++		vreg->corner[i].ro_mask = 0;
++		for (j = 0; j < CPR3_RO_COUNT; j++) {
++			if (vreg->corner[i].target_quot[j] == 0)
++				vreg->corner[i].ro_mask |= BIT(j);
++		}
++
++		if (init_aging) {
++			vreg->corner[i].unaged_floor_volt
++				= vreg->corner[i].floor_volt;
++			vreg->corner[i].unaged_ceiling_volt
++				= vreg->corner[i].ceiling_volt;
++			vreg->corner[i].unaged_open_loop_volt
++				= vreg->corner[i].open_loop_volt;
++		}
++
++		if (vreg->aging_allowed) {
++			if (vreg->corner[i].unaged_floor_volt <= 0) {
++				cpr3_err(vreg, "invalid unaged_floor_volt[%d] = %d\n",
++					i, vreg->corner[i].unaged_floor_volt);
++				return -EINVAL;
++			}
++			if (vreg->corner[i].unaged_ceiling_volt <= 0) {
++				cpr3_err(vreg, "invalid unaged_ceiling_volt[%d] = %d\n",
++					i, vreg->corner[i].unaged_ceiling_volt);
++				return -EINVAL;
++			}
++			if (vreg->corner[i].unaged_open_loop_volt <= 0) {
++				cpr3_err(vreg, "invalid unaged_open_loop_volt[%d] = %d\n",
++				      i, vreg->corner[i].unaged_open_loop_volt);
++				return -EINVAL;
++			}
++		}
++	}
++
++	if (vreg->aging_allowed && vreg->corner[vreg->aging_corner].ceiling_volt
++	    > vreg->thread->ctrl->aging_ref_volt) {
++		cpr3_err(vreg, "aging corner %d ceiling voltage = %d > aging ref voltage = %d uV\n",
++			vreg->aging_corner,
++			vreg->corner[vreg->aging_corner].ceiling_volt,
++			vreg->thread->ctrl->aging_ref_volt);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_regulator_suspend() - perform common required CPR3 power down steps
++ *		before the system enters suspend
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_regulator_suspend(struct cpr3_controller *ctrl)
++{
++	int rc;
++
++	mutex_lock(&ctrl->lock);
++
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++		rc = cpr3_ctrl_clear_cpr4_config(ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "failed to clear CPR4 configuration,rc=%d\n",
++				rc);
++			mutex_unlock(&ctrl->lock);
++			return rc;
++		}
++	}
++
++	cpr3_ctrl_loop_disable(ctrl);
++
++	rc = cpr3_closed_loop_disable(ctrl);
++	if (rc)
++		cpr3_err(ctrl, "could not disable CPR, rc=%d\n", rc);
++
++	ctrl->cpr_suspended = true;
++
++	mutex_unlock(&ctrl->lock);
++	return 0;
++}
++
++/**
++ * cpr3_regulator_resume() - perform common required CPR3 power up steps after
++ *		the system resumes from suspend
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_regulator_resume(struct cpr3_controller *ctrl)
++{
++	int rc;
++
++	mutex_lock(&ctrl->lock);
++
++	ctrl->cpr_suspended = false;
++	rc = cpr3_regulator_update_ctrl_state(ctrl);
++	if (rc)
++		cpr3_err(ctrl, "could not enable CPR, rc=%d\n", rc);
++
++	mutex_unlock(&ctrl->lock);
++	return 0;
++}
++
++/**
++ * cpr3_regulator_validate_controller() - verify the data passed in via the
++ *		cpr3_controller data structure
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_regulator_validate_controller(struct cpr3_controller *ctrl)
++{
++	struct cpr3_thread *thread;
++	struct cpr3_regulator *vreg;
++	int i, j, allow_boost_vreg_count = 0;
++
++	if (!ctrl->vdd_regulator) {
++		cpr3_err(ctrl, "vdd regulator missing\n");
++		return -EINVAL;
++	} else if (ctrl->sensor_count <= 0
++		   || ctrl->sensor_count > CPR3_MAX_SENSOR_COUNT) {
++		cpr3_err(ctrl, "invalid CPR sensor count=%d\n",
++			ctrl->sensor_count);
++		return -EINVAL;
++	} else if (!ctrl->sensor_owner) {
++		cpr3_err(ctrl, "CPR sensor ownership table missing\n");
++		return -EINVAL;
++	}
++
++	if (ctrl->aging_required) {
++		for (i = 0; i < ctrl->aging_sensor_count; i++) {
++			if (ctrl->aging_sensor[i].sensor_id
++			    >= ctrl->sensor_count) {
++				cpr3_err(ctrl, "aging_sensor[%d] id=%u is not in the value range 0-%d",
++					i, ctrl->aging_sensor[i].sensor_id,
++					ctrl->sensor_count - 1);
++				return -EINVAL;
++			}
++		}
++	}
++
++	for (i = 0; i < ctrl->thread_count; i++) {
++		thread = &ctrl->thread[i];
++		for (j = 0; j < thread->vreg_count; j++) {
++			vreg = &thread->vreg[j];
++			if (vreg->allow_boost)
++				allow_boost_vreg_count++;
++		}
++	}
++
++	if (allow_boost_vreg_count > 1) {
++		/*
++		 * Boost feature is not allowed to be used for more
++		 * than one CPR3 regulator of a CPR3 controller.
++		 */
++		cpr3_err(ctrl, "Boost feature is enabled for more than one regulator\n");
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_panic_callback() - panic notification callback function. This function
++ *		is invoked when a kernel panic occurs.
++ * @nfb:	Notifier block pointer of CPR3 controller
++ * @event:	Value passed unmodified to notifier function
++ * @data:	Pointer passed unmodified to notifier function
++ *
++ * Return: NOTIFY_OK
++ */
++static int cpr3_panic_callback(struct notifier_block *nfb,
++			unsigned long event, void *data)
++{
++	struct cpr3_controller *ctrl = container_of(nfb,
++				struct cpr3_controller, panic_notifier);
++	struct cpr3_panic_regs_info *regs_info = ctrl->panic_regs_info;
++	struct cpr3_reg_info *reg;
++	int i = 0;
++
++	for (i = 0; i < regs_info->reg_count; i++) {
++		reg = &(regs_info->regs[i]);
++		reg->value = readl_relaxed(reg->virt_addr);
++		pr_err("%s[0x%08x] = 0x%08x\n", reg->name, reg->addr,
++			reg->value);
++	}
++	/*
++	 * Barrier to ensure that the information has been updated in the
++	 * structure.
++	 */
++	mb();
++
++	return NOTIFY_OK;
++}
++
++/**
++ * cpr3_regulator_register() - register the regulators for a CPR3 controller and
++ *		perform CPR hardware initialization
++ * @pdev:		Platform device pointer for the CPR3 controller
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_regulator_register(struct platform_device *pdev,
++			struct cpr3_controller *ctrl)
++{
++	struct device *dev = &pdev->dev;
++	struct resource *res;
++	int i, j, rc;
++
++	if (!dev->of_node) {
++		dev_err(dev, "%s: Device tree node is missing\n", __func__);
++		return -EINVAL;
++	}
++
++	if (!ctrl || !ctrl->name) {
++		dev_err(dev, "%s: CPR controller data is missing\n", __func__);
++		return -EINVAL;
++	}
++
++	rc = cpr3_regulator_validate_controller(ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "controller validation failed, rc=%d\n", rc);
++		return rc;
++	}
++
++	mutex_init(&ctrl->lock);
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "cpr_ctrl");
++	if (!res || !res->start) {
++		cpr3_err(ctrl, "CPR controller address is missing\n");
++		return -ENXIO;
++	}
++	ctrl->cpr_ctrl_base = devm_ioremap(dev, res->start, resource_size(res));
++
++	if (ctrl->aging_possible_mask) {
++		/*
++		 * Aging possible register address is required if an aging
++		 * possible mask has been specified.
++		 */
++		res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
++						"aging_allowed");
++		if (!res || !res->start) {
++			cpr3_err(ctrl, "CPR aging allowed address is missing\n");
++			return -ENXIO;
++		}
++		ctrl->aging_possible_reg = devm_ioremap(dev, res->start,
++							resource_size(res));
++	}
++
++	ctrl->irq = platform_get_irq_byname(pdev, "cpr");
++	if (ctrl->irq < 0) {
++		cpr3_err(ctrl, "missing CPR interrupt\n");
++		return ctrl->irq;
++	}
++
++	if (ctrl->supports_hw_closed_loop) {
++		if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3) {
++			ctrl->ceiling_irq = platform_get_irq_byname(pdev,
++						"ceiling");
++			if (ctrl->ceiling_irq < 0) {
++				cpr3_err(ctrl, "missing ceiling interrupt\n");
++				return ctrl->ceiling_irq;
++			}
++		}
++	}
++
++	rc = cpr3_regulator_init_ctrl_data(ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "CPR controller data initialization failed, rc=%d\n",
++			 rc);
++		return rc;
++	}
++
++	for (i = 0; i < ctrl->thread_count; i++) {
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++			rc = cpr3_regulator_init_vreg_data(
++						&ctrl->thread[i].vreg[j]);
++			if (rc)
++				return rc;
++			cpr3_print_quots(&ctrl->thread[i].vreg[j]);
++		}
++	}
++
++	/*
++	 * Add the maximum possible aging voltage margin until it is possible
++	 * to perform an aging measurement.
++	 */
++	if (ctrl->aging_required)
++		cpr3_regulator_set_aging_ref_adjustment(ctrl, INT_MAX);
++
++	rc = cpr3_regulator_init_ctrl(ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "CPR controller initialization failed, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	/* Register regulator devices for all threads. */
++	for (i = 0; i < ctrl->thread_count; i++) {
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++			rc = cpr3_regulator_vreg_register(
++					&ctrl->thread[i].vreg[j]);
++			if (rc) {
++				cpr3_err(&ctrl->thread[i].vreg[j], "failed to register regulator, rc=%d\n",
++					rc);
++				goto free_regulators;
++			}
++		}
++	}
++
++	rc = devm_request_threaded_irq(dev, ctrl->irq, NULL,
++				       cpr3_irq_handler,
++				       IRQF_ONESHOT |
++				       IRQF_TRIGGER_RISING,
++				       "cpr3", ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "could not request IRQ %d, rc=%d\n",
++			 ctrl->irq, rc);
++		goto free_regulators;
++	}
++
++	if (ctrl->supports_hw_closed_loop &&
++	    ctrl->ctrl_type == CPR_CTRL_TYPE_CPR3) {
++		rc = devm_request_threaded_irq(dev, ctrl->ceiling_irq, NULL,
++			cpr3_ceiling_irq_handler,
++			IRQF_ONESHOT | IRQF_TRIGGER_RISING,
++			"cpr3_ceiling", ctrl);
++		if (rc) {
++			cpr3_err(ctrl, "could not request ceiling IRQ %d, rc=%d\n",
++				ctrl->ceiling_irq, rc);
++			goto free_regulators;
++		}
++	}
++
++	mutex_lock(&cpr3_controller_list_mutex);
++	cpr3_regulator_debugfs_ctrl_add(ctrl);
++	list_add(&ctrl->list, &cpr3_controller_list);
++	mutex_unlock(&cpr3_controller_list_mutex);
++
++	if (ctrl->panic_regs_info) {
++		/* Register panic notification call back */
++		ctrl->panic_notifier.notifier_call = cpr3_panic_callback;
++		atomic_notifier_chain_register(&panic_notifier_list,
++			&ctrl->panic_notifier);
++	}
++
++	return 0;
++
++free_regulators:
++	for (i = 0; i < ctrl->thread_count; i++)
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++)
++			if (!IS_ERR_OR_NULL(ctrl->thread[i].vreg[j].rdev))
++				regulator_unregister(
++					ctrl->thread[i].vreg[j].rdev);
++	return rc;
++}
++
++/**
++ * cpr3_open_loop_regulator_register() - register the regulators for a CPR3
++ *			controller which will always work in Open loop and
++ *			won't support close loop.
++ * @pdev:		Platform device pointer for the CPR3 controller
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_open_loop_regulator_register(struct platform_device *pdev,
++				      struct cpr3_controller *ctrl)
++{
++	struct device *dev = &pdev->dev;
++	struct cpr3_regulator *vreg;
++	int i, j, rc;
++
++	if (!dev->of_node) {
++		dev_err(dev, "%s: Device tree node is missing\n", __func__);
++		return -EINVAL;
++	}
++
++	if (!ctrl || !ctrl->name) {
++		dev_err(dev, "%s: CPR controller data is missing\n", __func__);
++		return -EINVAL;
++	}
++
++	if (!ctrl->vdd_regulator) {
++		cpr3_err(ctrl, "vdd regulator missing\n");
++		return -EINVAL;
++	}
++
++	mutex_init(&ctrl->lock);
++
++	rc = cpr3_regulator_init_ctrl_data(ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "CPR controller data initialization failed, rc=%d\n",
++			 rc);
++		return rc;
++	}
++
++	for (i = 0; i < ctrl->thread_count; i++) {
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++			vreg = &ctrl->thread[i].vreg[j];
++			vreg->corner[i].last_volt =
++				vreg->corner[i].open_loop_volt;
++		}
++	}
++
++	/* Register regulator devices for all threads. */
++	for (i = 0; i < ctrl->thread_count; i++) {
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++) {
++			rc = cpr3_regulator_vreg_register(
++					&ctrl->thread[i].vreg[j]);
++			if (rc) {
++				cpr3_err(&ctrl->thread[i].vreg[j], "failed to register regulator, rc=%d\n",
++					 rc);
++				goto free_regulators;
++			}
++		}
++	}
++
++	mutex_lock(&cpr3_controller_list_mutex);
++	list_add(&ctrl->list, &cpr3_controller_list);
++	mutex_unlock(&cpr3_controller_list_mutex);
++
++	return 0;
++
++free_regulators:
++	for (i = 0; i < ctrl->thread_count; i++)
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++)
++			if (!IS_ERR_OR_NULL(ctrl->thread[i].vreg[j].rdev))
++				regulator_unregister(
++					ctrl->thread[i].vreg[j].rdev);
++	return rc;
++}
++
++/**
++ * cpr3_regulator_unregister() - unregister the regulators for a CPR3 controller
++ *		and perform CPR hardware shutdown
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_regulator_unregister(struct cpr3_controller *ctrl)
++{
++	int i, j, rc = 0;
++
++	mutex_lock(&cpr3_controller_list_mutex);
++	list_del(&ctrl->list);
++	cpr3_regulator_debugfs_ctrl_remove(ctrl);
++	mutex_unlock(&cpr3_controller_list_mutex);
++
++	if (ctrl->ctrl_type == CPR_CTRL_TYPE_CPR4) {
++		rc = cpr3_ctrl_clear_cpr4_config(ctrl);
++		if (rc)
++			cpr3_err(ctrl, "failed to clear CPR4 configuration,rc=%d\n",
++				rc);
++	}
++
++	cpr3_ctrl_loop_disable(ctrl);
++
++	cpr3_closed_loop_disable(ctrl);
++
++	if (ctrl->vdd_limit_regulator) {
++		regulator_disable(ctrl->vdd_limit_regulator);
++	}
++
++	for (i = 0; i < ctrl->thread_count; i++)
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++)
++			regulator_unregister(ctrl->thread[i].vreg[j].rdev);
++
++	if (ctrl->panic_notifier.notifier_call)
++		atomic_notifier_chain_unregister(&panic_notifier_list,
++			&ctrl->panic_notifier);
++
++	return 0;
++}
++
++/**
++ * cpr3_open_loop_regulator_unregister() - unregister the regulators for a CPR3
++ *			open loop controller and perform CPR hardware shutdown
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_open_loop_regulator_unregister(struct cpr3_controller *ctrl)
++{
++	int i, j;
++
++	mutex_lock(&cpr3_controller_list_mutex);
++	list_del(&ctrl->list);
++	mutex_unlock(&cpr3_controller_list_mutex);
++
++	if (ctrl->vdd_limit_regulator) {
++		regulator_disable(ctrl->vdd_limit_regulator);
++	}
++
++	for (i = 0; i < ctrl->thread_count; i++)
++		for (j = 0; j < ctrl->thread[i].vreg_count; j++)
++			regulator_unregister(ctrl->thread[i].vreg[j].rdev);
++
++	if (ctrl->panic_notifier.notifier_call)
++		atomic_notifier_chain_unregister(&panic_notifier_list,
++			&ctrl->panic_notifier);
++
++	return 0;
++}
+--- /dev/null
++++ b/drivers/regulator/cpr3-regulator.h
+@@ -0,0 +1,1211 @@
++/*
++ * Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#ifndef __REGULATOR_CPR3_REGULATOR_H__
++#define __REGULATOR_CPR3_REGULATOR_H__
++
++#include <linux/clk.h>
++#include <linux/mutex.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/types.h>
++#include <linux/power/qcom/apm.h>
++#include <linux/regulator/driver.h>
++
++struct cpr3_controller;
++struct cpr3_thread;
++
++/**
++ * struct cpr3_fuse_param - defines one contiguous segment of a fuse parameter
++ *			    that is contained within a given row.
++ * @row:	Fuse row number
++ * @bit_start:	The first bit within the row of the fuse parameter segment
++ * @bit_end:	The last bit within the row of the fuse parameter segment
++ *
++ * Each fuse row is 64 bits in length.  bit_start and bit_end may take values
++ * from 0 to 63.  bit_start must be less than or equal to bit_end.
++ */
++struct cpr3_fuse_param {
++	unsigned		row;
++	unsigned		bit_start;
++	unsigned		bit_end;
++};
++
++/* Each CPR3 sensor has 16 ring oscillators */
++#define CPR3_RO_COUNT		16
++
++/* The maximum number of sensors that can be present on a single CPR loop. */
++#define CPR3_MAX_SENSOR_COUNT	256
++
++/* This constant is used when allocating array printing buffers. */
++#define MAX_CHARS_PER_INT	10
++
++/**
++ * struct cpr4_sdelta - CPR4 controller specific data structure for the sdelta
++ *			adjustment table which is used to adjust the VDD supply
++ *			voltage automatically based upon the temperature and/or
++ *			the number of online CPU cores.
++ * @allow_core_count_adj: Core count adjustments are allowed.
++ * @allow_temp_adj:	Temperature based adjustments are allowed.
++ * @max_core_count:	Maximum number of cores considered for core count
++ *			adjustment logic.
++ * @temp_band_count:	Number of temperature bands considered for temperature
++ *			based adjustment logic.
++ * @cap_volt:		CAP in uV to apply to SDELTA margins with multiple
++ *			cpr3-regulators defined for single controller.
++ * @table:		SDELTA table with per-online-core and temperature based
++ *			adjustments of size (max_core_count * temp_band_count)
++ *			Outer: core count
++ *			Inner: temperature band
++ *			Each element has units of VDD supply steps. Positive
++ *			values correspond to a reduction in voltage and negative
++ *			value correspond to an increase (this follows the SDELTA
++ *			register semantics).
++ * @allow_boost:	Voltage boost allowed.
++ * @boost_num_cores:	The number of online cores at which the boost voltage
++ *			adjustments will be applied
++ * @boost_table:	SDELTA table with boost voltage adjustments of size
++ *			temp_band_count. Each element has units of VDD supply
++ *			steps. Positive values correspond to a reduction in
++ *			voltage and negative value correspond to an increase
++ *			(this follows the SDELTA register semantics).
++ */
++struct cpr4_sdelta {
++	bool	allow_core_count_adj;
++	bool	allow_temp_adj;
++	int	max_core_count;
++	int	temp_band_count;
++	int	cap_volt;
++	int	*table;
++	bool	allow_boost;
++	int	boost_num_cores;
++	int	*boost_table;
++};
++
++/**
++ * struct cpr3_corner - CPR3 virtual voltage corner data structure
++ * @floor_volt:		CPR closed-loop floor voltage in microvolts
++ * @ceiling_volt:	CPR closed-loop ceiling voltage in microvolts
++ * @open_loop_volt:	CPR open-loop voltage (i.e. initial voltage) in
++ *			microvolts
++ * @last_volt:		Last known settled CPR closed-loop voltage which is used
++ *			when switching to a new corner
++ * @abs_ceiling_volt:	The absolute CPR closed-loop ceiling voltage in
++ *			microvolts.  This is used to limit the ceiling_volt
++ *			value when it is increased as a result of aging
++ *			adjustment.
++ * @unaged_floor_volt:	The CPR closed-loop floor voltage in microvolts before
++ *			any aging adjustment is performed
++ * @unaged_ceiling_volt: The CPR closed-loop ceiling voltage in microvolts
++ *			before any aging adjustment is performed
++ * @unaged_open_loop_volt: The CPR open-loop voltage (i.e. initial voltage) in
++ *			microvolts before any aging adjusment is performed
++ * @system_volt:	The system-supply voltage in microvolts or corners or
++ *			levels
++ * @mem_acc_volt:	The mem-acc-supply voltage in corners
++ * @proc_freq:		Processor frequency in Hertz. For CPR rev. 3 and 4
++ *			conrollers, this field is only used by platform specific
++ *			CPR3 driver for interpolation. For CPRh-compliant
++ *			controllers, this frequency is also utilized by the
++ *			clock driver to determine the corner to CPU clock
++ *			frequency mappings.
++ * @cpr_fuse_corner:	Fused corner index associated with this virtual corner
++ *			(only used by platform specific CPR3 driver for
++ *			mapping purposes)
++ * @target_quot:	Array of target quotient values to use for each ring
++ *			oscillator (RO) for this corner.  A value of 0 should be
++ *			specified as the target quotient for each RO that is
++ *			unused by this corner.
++ * @ro_scale:		Array of CPR ring oscillator (RO) scaling factors.  The
++ *			scaling factor for each RO is defined from RO0 to RO15
++ *			with units of QUOT/V.  A value of 0 may be specified for
++ *			an RO that is unused.
++ * @ro_mask:		Bitmap where each of the 16 LSBs indicate if the
++ *			corresponding ROs should be masked for this corner
++ * @irq_en:		Bitmap of the CPR interrupts to enable for this corner
++ * @aging_derate:	The amount to derate the aging voltage adjustment
++ *			determined for the reference corner in units of uV/mV.
++ *			E.g. a value of 900 would imply that the adjustment for
++ *			this corner should be 90% (900/1000) of that for the
++ *			reference corner.
++ * @use_open_loop:	Boolean indicating that open-loop (i.e CPR disabled) as
++ *			opposed to closed-loop operation must be used for this
++ *			corner on CPRh controllers.
++ * @sdelta:		The CPR4 controller specific data for this corner. This
++ *			field is applicable for CPR4 controllers.
++ *
++ * The value of last_volt is initialized inside of the cpr3_regulator_register()
++ * call with the open_loop_volt value.  It can later be updated to the settled
++ * VDD supply voltage.  The values for unaged_floor_volt, unaged_ceiling_volt,
++ * and unaged_open_loop_volt are initialized inside of cpr3_regulator_register()
++ * if ctrl->aging_required == true.  These three values must be pre-initialized
++ * if cpr3_regulator_register() is called with ctrl->aging_required == false and
++ * ctrl->aging_succeeded == true.
++ *
++ * The values of ro_mask and irq_en are initialized inside of the
++ * cpr3_regulator_register() call.
++ */
++struct cpr3_corner {
++	int			floor_volt;
++	int			ceiling_volt;
++	int			cold_temp_open_loop_volt;
++	int			normal_temp_open_loop_volt;
++	int			open_loop_volt;
++	int			last_volt;
++	int			abs_ceiling_volt;
++	int			unaged_floor_volt;
++	int			unaged_ceiling_volt;
++	int			unaged_open_loop_volt;
++	int			system_volt;
++	int			mem_acc_volt;
++	u32			proc_freq;
++	int			cpr_fuse_corner;
++	u32			target_quot[CPR3_RO_COUNT];
++	u32			ro_scale[CPR3_RO_COUNT];
++	u32			ro_mask;
++	u32			irq_en;
++	int			aging_derate;
++	bool			use_open_loop;
++	struct cpr4_sdelta	*sdelta;
++};
++
++/**
++ * struct cprh_corner_band - CPRh controller specific data structure which
++ *			encapsulates the range of corners and the SDELTA
++ *			adjustment table to be applied to the corners within
++ *			the min and max bounds of the corner band.
++ * @corner:		Corner number which defines the corner band boundary
++ * @sdelta:		The SDELTA adjustment table which contains core-count
++ *			and temp based margin adjustments that are applicable
++ *			to the corner band.
++ */
++struct cprh_corner_band {
++	int			corner;
++	struct cpr4_sdelta	*sdelta;
++};
++
++/**
++ * struct cpr3_fuse_parameters - CPR4 fuse specific data structure which has
++ * 			the required fuse parameters need for Close Loop CPR
++ * @(*apss_ro_sel_param)[2]:       Pointer to RO select fuse details
++ * @(*apss_init_voltage_param)[2]: Pointer to Target voltage fuse details
++ * @(*apss_target_quot_param)[2]:  Pointer to Target quot fuse details
++ * @(*apss_quot_offset_param)[2]:  Pointer to quot offset fuse details
++ * @cpr_fusing_rev_param:          Pointer to CPR revision fuse details
++ * @apss_speed_bin_param:          Pointer to Speed bin fuse details
++ * @cpr_boost_fuse_cfg_param:      Pointer to Boost fuse cfg details
++ * @apss_boost_fuse_volt_param:    Pointer to Boost fuse volt details
++ * @misc_fuse_volt_adj_param:      Pointer to Misc fuse volt fuse details
++ */
++struct cpr3_fuse_parameters {
++	struct cpr3_fuse_param (*apss_ro_sel_param)[2];
++	struct cpr3_fuse_param (*apss_init_voltage_param)[2];
++	struct cpr3_fuse_param (*apss_target_quot_param)[2];
++	struct cpr3_fuse_param (*apss_quot_offset_param)[2];
++	struct cpr3_fuse_param *cpr_fusing_rev_param;
++	struct cpr3_fuse_param *apss_speed_bin_param;
++	struct cpr3_fuse_param *cpr_boost_fuse_cfg_param;
++	struct cpr3_fuse_param *apss_boost_fuse_volt_param;
++	struct cpr3_fuse_param *misc_fuse_volt_adj_param;
++};
++
++struct cpr4_mem_acc_func {
++	void (*set_mem_acc)(struct regulator_dev *);
++	void (*clear_mem_acc)(struct regulator_dev *);
++};
++
++/**
++ * struct cpr4_reg_data - CPR4 regulator specific data structure which is
++ * target specific
++ * @cpr_valid_fuse_count: Number of valid fuse corners
++ * @fuse_ref_volt: 	  Pointer to fuse reference voltage
++ * @fuse_step_volt: 	  CPR step voltage available in fuse
++ * @cpr_clk_rate: 	  CPR clock rate
++ * @boost_fuse_ref_volt:  Boost fuse reference voltage
++ * @boost_ceiling_volt:   Boost ceiling voltage
++ * @boost_floor_volt: 	  Boost floor voltage
++ * @cpr3_fuse_params:     Pointer to CPR fuse parameters
++ * @mem_acc_funcs:        Pointer to MEM ACC set/clear functions
++ **/
++struct cpr4_reg_data {
++	u32 cpr_valid_fuse_count;
++	int *fuse_ref_volt;
++	u32 fuse_step_volt;
++	u32 cpr_clk_rate;
++	int boost_fuse_ref_volt;
++	int boost_ceiling_volt;
++	int boost_floor_volt;
++	struct cpr3_fuse_parameters *cpr3_fuse_params;
++	struct cpr4_mem_acc_func *mem_acc_funcs;
++};
++/**
++ * struct cpr3_reg_data - CPR3 regulator specific data structure which is
++ * target specific
++ * @cpr_valid_fuse_count: Number of valid fuse corners
++ * @(*init_voltage_param)[2]: Pointer to Target voltage fuse details
++ * @fuse_ref_volt: 	  Pointer to fuse reference voltage
++ * @fuse_step_volt: 	  CPR step voltage available in fuse
++ * @cpr_clk_rate: 	  CPR clock rate
++ * @cpr3_fuse_params:     Pointer to CPR fuse parameters
++ **/
++struct cpr3_reg_data {
++	u32 cpr_valid_fuse_count;
++	struct cpr3_fuse_param (*init_voltage_param)[2];
++	int *fuse_ref_volt;
++	u32 fuse_step_volt;
++	u32 cpr_clk_rate;
++};
++
++/**
++ * struct cpr3_regulator - CPR3 logical regulator instance associated with a
++ *			given CPR3 hardware thread
++ * @of_node:		Device node associated with the device tree child node
++ *			of this CPR3 regulator
++ * @thread:		Pointer to the CPR3 thread which manages this CPR3
++ *			regulator
++ * @name:		Unique name for this CPR3 regulator which is filled
++ *			using the device tree regulator-name property
++ * @rdesc:		Regulator description for this CPR3 regulator
++ * @rdev:		Regulator device pointer for the regulator registered
++ *			for this CPR3 regulator
++ * @mem_acc_regulator:	Pointer to the optional mem-acc supply regulator used
++ *			to manage memory circuitry settings based upon CPR3
++ *			regulator output voltage.
++ * @corner:		Array of all corners supported by this CPR3 regulator
++ * @corner_count:	The number of elements in the corner array
++ * @corner_band:	Array of all corner bands supported by CPRh compatible
++ *			controllers
++ * @cpr4_regulator_data Target specific cpr4 regulator data
++ * @cpr3_regulator_data Target specific cpr3 regulator data
++ * @corner_band_count:	The number of elements in the corner band array
++ * @platform_fuses:	Pointer to platform specific CPR fuse data (only used by
++ *			platform specific CPR3 driver)
++ * @speed_bin_fuse:	Value read from the speed bin fuse parameter
++ * @speed_bins_supported: The number of speed bins supported by the device tree
++ *			configuration for this CPR3 regulator
++ * @cpr_rev_fuse:	Value read from the CPR fusing revision fuse parameter
++ * @fuse_combo:		Platform specific enum value identifying the specific
++ *			combination of fuse values found on a given chip
++ * @fuse_combos_supported: The number of fuse combinations supported by the
++ *			device tree configuration for this CPR3 regulator
++ * @fuse_corner_count:	Number of corners defined by fuse parameters
++ * @fuse_corner_map:	Array of length fuse_corner_count which specifies the
++ *			highest corner associated with each fuse corner.  Note
++ *			that each element must correspond to a valid corner
++ *			and that element values must be strictly increasing.
++ *			Also, it is acceptable for the lowest fuse corner to map
++ *			to a corner other than the lowest.  Likewise, it is
++ *			acceptable for the highest fuse corner to map to a
++ *			corner other than the highest.
++ * @fuse_combo_corner_sum: The sum of the corner counts across all fuse combos
++ * @fuse_combo_offset:	The device tree property array offset for the selected
++ *			fuse combo
++ * @speed_bin_corner_sum: The sum of the corner counts across all speed bins
++ *			This may be specified as 0 if per speed bin parsing
++ *			support is not required.
++ * @speed_bin_offset:	The device tree property array offset for the selected
++ *			speed bin
++ * @fuse_combo_corner_band_sum: The sum of the corner band counts across all
++ *			fuse combos
++ * @fuse_combo_corner_band_offset: The device tree property array offset for
++ *			the corner band count corresponding to the selected
++ *			fuse combo
++ * @speed_bin_corner_band_sum: The sum of the corner band counts across all
++ *			speed bins. This may be specified as 0 if per speed bin
++ *			parsing support is not required
++ * @speed_bin_corner_band_offset: The device tree property array offset for the
++ *			corner band count corresponding to the selected speed
++ *			bin
++ * @pd_bypass_mask:	Bit mask of power domains associated with this CPR3
++ *			regulator
++ * @dynamic_floor_corner: Index identifying the voltage corner for the CPR3
++ *			regulator whose last_volt value should be used as the
++ *			global CPR floor voltage if all of the power domains
++ *			associated with this CPR3 regulator are bypassed
++ * @uses_dynamic_floor: Boolean flag indicating that dynamic_floor_corner should
++ *			be utilized for the CPR3 regulator
++ * @current_corner:	Index identifying the currently selected voltage corner
++ *			for the CPR3 regulator or less than 0 if no corner has
++ *			been requested
++ * @last_closed_loop_corner: Index identifying the last voltage corner for the
++ *			CPR3 regulator which was configured when operating in
++ *			CPR closed-loop mode or less than 0 if no corner has
++ *			been requested.  CPR registers are only written to when
++ *			using closed-loop mode.
++ * @aggregated:		Boolean flag indicating that this CPR3 regulator
++ *			participated in the last aggregation event
++ * @debug_corner:	Index identifying voltage corner used for displaying
++ *			corner configuration values in debugfs
++ * @vreg_enabled:	Boolean defining the enable state of the CPR3
++ *			regulator's regulator within the regulator framework.
++ * @aging_allowed:	Boolean defining if CPR aging adjustments are allowed
++ *			for this CPR3 regulator given the fuse combo of the
++ *			device
++ * @aging_allow_open_loop_adj: Boolean defining if the open-loop voltage of each
++ *			corner of this regulator should be adjusted as a result
++ *			of an aging measurement.  This flag can be set to false
++ *			when the open-loop voltage adjustments have been
++ *			specified such that they include the maximum possible
++ *			aging adjustment.  This flag is only used if
++ *			aging_allowed == true.
++ * @aging_corner:	The corner that should be configured for this regulator
++ *			when an aging measurement is performed.
++ * @aging_max_adjust_volt: The maximum aging voltage margin in microvolts that
++ *			may be added to the target quotients of this regulator.
++ *			A value of 0 may be specified if this regulator does not
++ *			require any aging adjustment.
++ * @allow_core_count_adj: Core count adjustments are allowed for this regulator.
++ * @allow_temp_adj:	Temperature based adjustments are allowed for this
++ *			regulator.
++ * @max_core_count:	Maximum number of cores considered for core count
++ *			adjustment logic.
++ * @allow_boost:	Voltage boost allowed for this regulator.
++ *
++ * This structure contains both configuration and runtime state data.  The
++ * elements current_corner, last_closed_loop_corner, aggregated, debug_corner,
++ * and vreg_enabled are state variables.
++ */
++struct cpr3_regulator {
++	struct device_node	*of_node;
++	struct cpr3_thread	*thread;
++	const char		*name;
++	struct regulator_desc	rdesc;
++	struct regulator_dev	*rdev;
++	struct regulator	*mem_acc_regulator;
++	struct cpr3_corner	*corner;
++	int			corner_count;
++	struct cprh_corner_band *corner_band;
++	struct cpr4_reg_data    *cpr4_regulator_data;
++	struct cpr3_reg_data    *cpr3_regulator_data;
++	u32			corner_band_count;
++
++	void			*platform_fuses;
++	int			speed_bin_fuse;
++	int			speed_bins_supported;
++	int			cpr_rev_fuse;
++	int			part_type;
++	int			part_type_supported;
++	int			fuse_combo;
++	int			fuse_combos_supported;
++	int			fuse_corner_count;
++	int			*fuse_corner_map;
++	int			fuse_combo_corner_sum;
++	int			fuse_combo_offset;
++	int			speed_bin_corner_sum;
++	int			speed_bin_offset;
++	int			fuse_combo_corner_band_sum;
++	int			fuse_combo_corner_band_offset;
++	int			speed_bin_corner_band_sum;
++	int			speed_bin_corner_band_offset;
++	u32			pd_bypass_mask;
++	int			dynamic_floor_corner;
++	bool			uses_dynamic_floor;
++
++	int			current_corner;
++	int			last_closed_loop_corner;
++	bool			aggregated;
++	int			debug_corner;
++	bool			vreg_enabled;
++
++	bool			aging_allowed;
++	bool			aging_allow_open_loop_adj;
++	int			aging_corner;
++	int			aging_max_adjust_volt;
++
++	bool			allow_core_count_adj;
++	bool			allow_temp_adj;
++	int			max_core_count;
++	bool			allow_boost;
++};
++
++/**
++ * struct cpr3_thread - CPR3 hardware thread data structure
++ * @thread_id:		Hardware thread ID
++ * @of_node:		Device node associated with the device tree child node
++ *			of this CPR3 thread
++ * @ctrl:		Pointer to the CPR3 controller which manages this thread
++ * @vreg:		Array of CPR3 regulators handled by the CPR3 thread
++ * @vreg_count:		Number of elements in the vreg array
++ * @aggr_corner:	CPR corner containing the in process aggregated voltage
++ *			and target quotient configurations which will be applied
++ * @last_closed_loop_aggr_corner: CPR corner containing the most recent
++ *			configurations which were written into hardware
++ *			registers when operating in closed loop mode (i.e. with
++ *			CPR enabled)
++ * @consecutive_up:	The number of consecutive CPR step up events needed to
++ *			to trigger an up interrupt
++ * @consecutive_down:	The number of consecutive CPR step down events needed to
++ *			to trigger a down interrupt
++ * @up_threshold:	The number CPR error steps required to generate an up
++ *			event
++ * @down_threshold:	The number CPR error steps required to generate a down
++ *			event
++ *
++ * This structure contains both configuration and runtime state data.  The
++ * elements aggr_corner and last_closed_loop_aggr_corner are state variables.
++ */
++struct cpr3_thread {
++	u32			thread_id;
++	struct device_node	*of_node;
++	struct cpr3_controller	*ctrl;
++	struct cpr3_regulator	*vreg;
++	int			vreg_count;
++	struct cpr3_corner	aggr_corner;
++	struct cpr3_corner	last_closed_loop_aggr_corner;
++
++	u32			consecutive_up;
++	u32			consecutive_down;
++	u32			up_threshold;
++	u32			down_threshold;
++};
++
++/* Per CPR controller data */
++/**
++ * enum cpr3_mem_acc_corners - Constants which define the number of mem-acc
++ *		regulator corners available in the mem-acc corner map array.
++ * %CPR3_MEM_ACC_LOW_CORNER:	Index in mem-acc corner map array mapping to the
++ *				mem-acc regulator corner
++ *				to be used for low voltage vdd supply
++ * %CPR3_MEM_ACC_HIGH_CORNER:	Index in mem-acc corner map array mapping to the
++ *				mem-acc regulator corner to be used for high
++ *				voltage vdd supply
++ * %CPR3_MEM_ACC_CORNERS:	Number of elements in the mem-acc corner map
++ *				array
++ */
++enum cpr3_mem_acc_corners {
++	CPR3_MEM_ACC_LOW_CORNER		= 0,
++	CPR3_MEM_ACC_HIGH_CORNER	= 1,
++	CPR3_MEM_ACC_CORNERS		= 2,
++};
++
++/**
++ * enum cpr3_count_mode - CPR3 controller count mode which defines the
++ *		method that CPR sensor data is acquired
++ * %CPR3_COUNT_MODE_ALL_AT_ONCE_MIN:	Capture all CPR sensor readings
++ *					simultaneously and report the minimum
++ *					value seen in successive measurements
++ * %CPR3_COUNT_MODE_ALL_AT_ONCE_MAX:	Capture all CPR sensor readings
++ *					simultaneously and report the maximum
++ *					value seen in successive measurements
++ * %CPR3_COUNT_MODE_STAGGERED:		Read one sensor at a time in a
++ *					sequential fashion
++ * %CPR3_COUNT_MODE_ALL_AT_ONCE_AGE:	Capture all CPR aging sensor readings
++ *					simultaneously.
++ */
++enum cpr3_count_mode {
++	CPR3_COUNT_MODE_ALL_AT_ONCE_MIN	= 0,
++	CPR3_COUNT_MODE_ALL_AT_ONCE_MAX	= 1,
++	CPR3_COUNT_MODE_STAGGERED	= 2,
++	CPR3_COUNT_MODE_ALL_AT_ONCE_AGE	= 3,
++};
++
++/**
++ * enum cpr_controller_type - supported CPR controller hardware types
++ * %CPR_CTRL_TYPE_CPR3:	HW has CPR3 controller
++ * %CPR_CTRL_TYPE_CPR4:	HW has CPR4 controller
++ */
++enum cpr_controller_type {
++	CPR_CTRL_TYPE_CPR3,
++	CPR_CTRL_TYPE_CPR4,
++};
++
++/**
++ * cpr_setting - supported CPR global settings
++ * %CPR_DEFAULT: default mode from dts will be used
++ * %CPR_DISABLED: ceiling voltage will be used for all the corners
++ * %CPR_OPEN_LOOP_EN: CPR will work in OL
++ * %CPR_CLOSED_LOOP_EN: CPR will work in CL, if supported
++ */
++enum cpr_setting {
++	CPR_DEFAULT		= 0,
++	CPR_DISABLED		= 1,
++	CPR_OPEN_LOOP_EN	= 2,
++	CPR_CLOSED_LOOP_EN	= 3,
++};
++
++/**
++ * struct cpr3_aging_sensor_info - CPR3 aging sensor information
++ * @sensor_id		The index of the CPR3 sensor to be used in the aging
++ *			measurement.
++ * @ro_scale		The CPR ring oscillator (RO) scaling factor for the
++ *			aging sensor with units of QUOT/V.
++ * @init_quot_diff:	The fused quotient difference between aged and un-aged
++ *			paths that was measured at manufacturing time.
++ * @measured_quot_diff: The quotient difference measured at runtime.
++ * @bypass_mask:	Bit mask of the CPR sensors that must be bypassed during
++ *			the aging measurement for this sensor
++ *
++ * This structure contains both configuration and runtime state data.  The
++ * element measured_quot_diff is a state variable.
++ */
++struct cpr3_aging_sensor_info {
++	u32			sensor_id;
++	u32			ro_scale;
++	int			init_quot_diff;
++	int			measured_quot_diff;
++	u32			bypass_mask[CPR3_MAX_SENSOR_COUNT / 32];
++};
++
++/**
++ * struct cpr3_reg_info - Register information data structure
++ * @name:	Register name
++ * @addr:	Register physical address
++ * @value:	Register content
++ * @virt_addr:	Register virtual address
++ *
++ * This data structure is used to dump some critical register contents
++ * when the device crashes due to a kernel panic.
++ */
++struct cpr3_reg_info {
++	const char	*name;
++	u32		addr;
++	u32		value;
++	void __iomem	*virt_addr;
++};
++
++/**
++ * struct cpr3_panic_regs_info - Data structure to dump critical register
++ *		contents.
++ * @reg_count:		Number of elements in the regs array
++ * @regs:		Array of critical registers information
++ *
++ * This data structure is used to dump critical register contents when
++ * the device crashes due to a kernel panic.
++ */
++struct cpr3_panic_regs_info {
++	int			reg_count;
++	struct cpr3_reg_info	*regs;
++};
++
++/**
++ * struct cpr3_controller - CPR3 controller data structure
++ * @dev:		Device pointer for the CPR3 controller device
++ * @name:		Unique name for the CPR3 controller
++ * @ctrl_id:		Controller ID corresponding to the VDD supply number
++ *			that this CPR3 controller manages.
++ * @cpr_ctrl_base:	Virtual address of the CPR3 controller base register
++ * @fuse_base:		Virtual address of fuse row 0
++ * @aging_possible_reg:	Virtual address of an optional platform-specific
++ *			register that must be ready to determine if it is
++ *			possible to perform an aging measurement.
++ * @list:		list head used in a global cpr3-regulator list so that
++ *			cpr3-regulator structs can be found easily in RAM dumps
++ * @thread:		Array of CPR3 threads managed by the CPR3 controller
++ * @thread_count:	Number of elements in the thread array
++ * @sensor_owner:	Array of thread IDs indicating which thread owns a given
++ *			CPR sensor
++ * @sensor_count:	The number of CPR sensors found on the CPR loop managed
++ *			by this CPR controller.  Must be equal to the number of
++ *			elements in the sensor_owner array
++ * @soc_revision:	Revision number of the SoC.  This may be unused by
++ *			platforms that do not have different behavior for
++ *			different SoC revisions.
++ * @lock:		Mutex lock used to ensure mutual exclusion between
++ *			all of the threads associated with the controller
++ * @vdd_regulator:	Pointer to the VDD supply regulator which this CPR3
++ *			controller manages
++ * @system_regulator:	Pointer to the optional system-supply regulator upon
++ *			which the VDD supply regulator depends.
++ * @mem_acc_regulator:	Pointer to the optional mem-acc supply regulator used
++ *			to manage memory circuitry settings based upon the
++ *			VDD supply output voltage.
++ * @vdd_limit_regulator: Pointer to the VDD supply limit regulator which is used
++ *			for hardware closed-loop in order specify ceiling and
++ *			floor voltage limits (platform specific)
++ * @system_supply_max_volt: Voltage in microvolts which corresponds to the
++ *			absolute ceiling voltage of the system-supply
++ * @mem_acc_threshold_volt: mem-acc threshold voltage in microvolts
++ * @mem_acc_corner_map: mem-acc regulator corners mapping to low and high
++ *			voltage mem-acc settings for the memories powered by
++ *			this CPR3 controller and its associated CPR3 regulators
++ * @mem_acc_crossover_volt: Voltage in microvolts corresponding to the voltage
++ *			that the VDD supply must be set to while a MEM ACC
++ *			switch is in progress. This element must be initialized
++ *			for CPRh controllers when a MEM ACC threshold voltage is
++ *			defined.
++ * @core_clk:		Pointer to the CPR3 controller core clock
++ * @iface_clk:		Pointer to the CPR3 interface clock (platform specific)
++ * @bus_clk:		Pointer to the CPR3 bus clock (platform specific)
++ * @irq:		CPR interrupt number
++ * @irq_affinity_mask:	The cpumask for the CPUs which the CPR interrupt should
++ *			have affinity for
++ * @cpu_hotplug_notifier: CPU hotplug notifier used to reset IRQ affinity when a
++ *			CPU is brought back online
++ * @ceiling_irq:	Interrupt number for the interrupt that is triggered
++ *			when hardware closed-loop attempts to exceed the ceiling
++ *			voltage
++ * @apm:		Handle to the array power mux (APM)
++ * @apm_threshold_volt:	Voltage in microvolts which defines the threshold
++ *			voltage to determine the APM supply selection for
++ *			each corner
++ * @apm_crossover_volt:	Voltage in microvolts corresponding to the voltage that
++ *			the VDD supply must be set to while an APM switch is in
++ *			progress. This element must be initialized for CPRh
++ *			controllers when an APM threshold voltage is defined
++ * @apm_adj_volt:	Minimum difference between APM threshold voltage and
++ *			open-loop voltage which allows the APM threshold voltage
++ *			to be used as a ceiling
++ * @apm_high_supply:	APM supply to configure if VDD voltage is greater than
++ *			or equal to the APM threshold voltage
++ * @apm_low_supply:	APM supply to configure if the VDD voltage is less than
++ *			the APM threshold voltage
++ * @base_volt:		Minimum voltage in microvolts supported by the VDD
++ *			supply managed by this CPR controller
++ * @corner_switch_delay_time: The delay time in nanoseconds used by the CPR
++ *			controller to wait for voltage settling before
++ *			acknowledging the OSM block after corner changes
++ * @cpr_clock_rate:	CPR reference clock frequency in Hz.
++ * @sensor_time:	The time in nanoseconds that each sensor takes to
++ *			perform a measurement.
++ * @loop_time:		The time in nanoseconds between consecutive CPR
++ *			measurements.
++ * @up_down_delay_time: The time to delay in nanoseconds between consecutive CPR
++ *			measurements when the last measurement recommended
++ *			increasing or decreasing the vdd-supply voltage.
++ *			(platform specific)
++ * @idle_clocks:	Number of CPR reference clock ticks that the CPR
++ *			controller waits in transitional states.
++ * @step_quot_init_min:	The default minimum CPR step quotient value.  The step
++ *			quotient is the number of additional ring oscillator
++ *			ticks observed when increasing one step in vdd-supply
++ *			output voltage.
++ * @step_quot_init_max:	The default maximum CPR step quotient value.
++ * @step_volt:		Step size in microvolts between available set points
++ *			of the VDD supply
++ * @down_error_step_limit: CPR4 hardware closed-loop down error step limit which
++ *			defines the maximum number of VDD supply regulator steps
++ *			that the voltage may be reduced as the result of a
++ *			single CPR measurement.
++ * @up_error_step_limit: CPR4 hardware closed-loop up error step limit which
++ *			defines the maximum number of VDD supply regulator steps
++ *			that the voltage may be increased as the result of a
++ *			single CPR measurement.
++ * @count_mode:		CPR controller count mode
++ * @count_repeat:	Number of times to perform consecutive sensor
++ *			measurements when using all-at-once count modes.
++ * @proc_clock_throttle: Defines the processor clock frequency throttling
++ *			register value to use.  This can be used to reduce the
++ *			clock frequency when a power domain exits a low power
++ *			mode until CPR settles at a new voltage.
++ *			(platform specific)
++ * @cpr_allowed_hw:	Boolean which indicates if closed-loop CPR operation is
++ *			permitted for a given chip based upon hardware fuse
++ *			values
++ * @cpr_allowed_sw:	Boolean which indicates if closed-loop CPR operation is
++ *			permitted based upon software policies
++ * @supports_hw_closed_loop: Boolean which indicates if this CPR3/4 controller
++ *			physically supports hardware closed-loop CPR operation
++ * @use_hw_closed_loop:	Boolean which indicates that this controller will be
++ *			using hardware closed-loop operation in place of
++ *			software closed-loop operation.
++ * @ctrl_type:		CPR controller type
++ * @saw_use_unit_mV:	Boolean which indicates the unit used in SAW PVC
++ *			interface is mV.
++ * @aggr_corner:	CPR corner containing the most recently aggregated
++ *			voltage configurations which are being used currently
++ * @cpr_enabled:	Boolean which indicates that the CPR controller is
++ *			enabled and operating in closed-loop mode.  CPR clocks
++ *			have been prepared and enabled whenever this flag is
++ *			true.
++ * @last_corner_was_closed_loop: Boolean indicating if the last known corners
++ *			were updated during closed loop operation.
++ * @cpr_suspended:	Boolean which indicates that CPR has been temporarily
++ *			disabled while enterring system suspend.
++ * @debugfs:		Pointer to the debugfs directory of this CPR3 controller
++ * @aging_ref_volt:	Reference voltage in microvolts to configure when
++ *			performing CPR aging measurements.
++ * @aging_vdd_mode:	vdd-supply regulator mode to configure before performing
++ *			a CPR aging measurement.  It should be one of
++ *			REGULATOR_MODE_*.
++ * @aging_complete_vdd_mode: vdd-supply regulator mode to configure after
++ *			performing a CPR aging measurement.  It should be one of
++ *			REGULATOR_MODE_*.
++ * @aging_ref_adjust_volt: The reference aging voltage margin in microvolts that
++ *			should be added to the target quotients of the
++ *			regulators managed by this controller after derating.
++ * @aging_required:	Flag which indicates that a CPR aging measurement still
++ *			needs to be performed for this CPR3 controller.
++ * @aging_succeeded:	Flag which indicates that a CPR aging measurement has
++ *			completed successfully.
++ * @aging_failed:	Flag which indicates that a CPR aging measurement has
++ *			failed to complete successfully.
++ * @aging_sensor:	Array of CPR3 aging sensors which are used to perform
++ *			aging measurements at a runtime.
++ * @aging_sensor_count:	Number of elements in the aging_sensor array
++ * @aging_possible_mask: Optional bitmask used to mask off the
++ *			aging_possible_reg register.
++ * @aging_possible_val:	Optional value that the masked aging_possible_reg
++ *			register must have in order for a CPR aging measurement
++ *			to be possible.
++ * @step_quot_fixed:	Fixed step quotient value used for target quotient
++ *			adjustment if use_dynamic_step_quot is not set.
++ *			This parameter is only relevant for CPR4 controllers
++ *			when using the per-online-core or per-temperature
++ *			adjustments.
++ * @initial_temp_band:	Temperature band used for calculation of base-line
++ *			target quotients (fused).
++ * @use_dynamic_step_quot: Boolean value which indicates that margin adjustment
++ *			of target quotient will be based on the step quotient
++ *			calculated dynamically in hardware for each RO.
++ * @allow_core_count_adj: Core count adjustments are allowed for this controller
++ * @allow_temp_adj:	Temperature based adjustments are allowed for
++ *			this controller
++ * @allow_boost:	Voltage boost allowed for this controller.
++ * @temp_band_count:	Number of temperature bands used for temperature based
++ *			adjustment logic
++ * @temp_points:	Array of temperature points in decidegrees Celsius used
++ *			to specify the ranges for selected temperature bands.
++ *			The array must have (temp_band_count - 1) elements
++ *			allocated.
++ * @temp_sensor_id_start: Start ID of temperature sensors used for temperature
++ *			based adjustments.
++ * @temp_sensor_id_end:	End ID of temperature sensors used for temperature
++ *			based adjustments.
++ * @voltage_settling_time: The time in nanoseconds that it takes for the
++ *			VDD supply voltage to settle after being increased or
++ *			decreased by step_volt microvolts which is used when
++ *			SDELTA voltage margin adjustments are applied.
++ * @cpr_global_setting:	Global setting for this CPR controller
++ * @panic_regs_info:	Array of panic registers information which provides the
++ *			list of registers to dump when the device crashes.
++ * @panic_notifier:	Notifier block registered to global panic notifier list.
++ *
++ * This structure contains both configuration and runtime state data.  The
++ * elements cpr_allowed_sw, use_hw_closed_loop, aggr_corner, cpr_enabled,
++ * last_corner_was_closed_loop, cpr_suspended, aging_ref_adjust_volt,
++ * aging_required, aging_succeeded, and aging_failed are state variables.
++ *
++ * The apm* elements do not need to be initialized if the VDD supply managed by
++ * the CPR3 controller does not utilize an APM.
++ *
++ * The elements step_quot_fixed, initial_temp_band, allow_core_count_adj,
++ * allow_temp_adj and temp* need to be initialized for CPR4 controllers which
++ * are using per-online-core or per-temperature adjustments.
++ */
++struct cpr3_controller {
++	struct device		*dev;
++	const char		*name;
++	int			ctrl_id;
++	void __iomem		*cpr_ctrl_base;
++	void __iomem		*fuse_base;
++	void __iomem		*aging_possible_reg;
++	struct list_head	list;
++	struct cpr3_thread	*thread;
++	int			thread_count;
++	u8			*sensor_owner;
++	int			sensor_count;
++	int			soc_revision;
++	struct mutex		lock;
++	struct regulator	*vdd_regulator;
++	struct regulator	*system_regulator;
++	struct regulator	*mem_acc_regulator;
++	struct regulator	*vdd_limit_regulator;
++	int			system_supply_max_volt;
++	int			mem_acc_threshold_volt;
++	int			mem_acc_corner_map[CPR3_MEM_ACC_CORNERS];
++	int			mem_acc_crossover_volt;
++	struct clk		*core_clk;
++	struct clk		*iface_clk;
++	struct clk		*bus_clk;
++	int			irq;
++	struct cpumask		irq_affinity_mask;
++	struct notifier_block	cpu_hotplug_notifier;
++	int			ceiling_irq;
++	struct msm_apm_ctrl_dev *apm;
++	int			apm_threshold_volt;
++	int			apm_crossover_volt;
++	int			apm_adj_volt;
++	enum msm_apm_supply	apm_high_supply;
++	enum msm_apm_supply	apm_low_supply;
++	int			base_volt;
++	u32			corner_switch_delay_time;
++	u32			cpr_clock_rate;
++	u32			sensor_time;
++	u32			loop_time;
++	u32			up_down_delay_time;
++	u32			idle_clocks;
++	u32			step_quot_init_min;
++	u32			step_quot_init_max;
++	int			step_volt;
++	u32			down_error_step_limit;
++	u32			up_error_step_limit;
++	enum cpr3_count_mode	count_mode;
++	u32			count_repeat;
++	u32			proc_clock_throttle;
++	bool			cpr_allowed_hw;
++	bool			cpr_allowed_sw;
++	bool			supports_hw_closed_loop;
++	bool			use_hw_closed_loop;
++	enum cpr_controller_type ctrl_type;
++	bool			saw_use_unit_mV;
++	struct cpr3_corner	aggr_corner;
++	bool			cpr_enabled;
++	bool			last_corner_was_closed_loop;
++	bool			cpr_suspended;
++	struct dentry		*debugfs;
++
++	int			aging_ref_volt;
++	unsigned int		aging_vdd_mode;
++	unsigned int		aging_complete_vdd_mode;
++	int			aging_ref_adjust_volt;
++	bool			aging_required;
++	bool			aging_succeeded;
++	bool			aging_failed;
++	struct cpr3_aging_sensor_info *aging_sensor;
++	int			aging_sensor_count;
++	u32			cur_sensor_state;
++	u32			aging_possible_mask;
++	u32			aging_possible_val;
++
++	u32			step_quot_fixed;
++	u32			initial_temp_band;
++	bool			use_dynamic_step_quot;
++	bool			allow_core_count_adj;
++	bool			allow_temp_adj;
++	bool			allow_boost;
++	int			temp_band_count;
++	int			*temp_points;
++	u32			temp_sensor_id_start;
++	u32			temp_sensor_id_end;
++	u32			voltage_settling_time;
++	enum cpr_setting	cpr_global_setting;
++	struct cpr3_panic_regs_info *panic_regs_info;
++	struct notifier_block	panic_notifier;
++};
++
++/* Used for rounding voltages to the closest physically available set point. */
++#define CPR3_ROUND(n, d) (DIV_ROUND_UP(n, d) * (d))
++
++#define cpr3_err(cpr3_thread, message, ...) \
++	pr_err("%s: " message, (cpr3_thread)->name, ##__VA_ARGS__)
++#define cpr3_info(cpr3_thread, message, ...) \
++	pr_info("%s: " message, (cpr3_thread)->name, ##__VA_ARGS__)
++#define cpr3_debug(cpr3_thread, message, ...) \
++	pr_debug("%s: " message, (cpr3_thread)->name, ##__VA_ARGS__)
++
++/*
++ * Offset subtracted from voltage corner values passed in from the regulator
++ * framework in order to get internal voltage corner values.  This is needed
++ * since the regulator framework treats 0 as an error value at regulator
++ * registration time.
++ */
++#define CPR3_CORNER_OFFSET	1
++
++#ifdef CONFIG_REGULATOR_CPR3
++
++int cpr3_regulator_register(struct platform_device *pdev,
++			struct cpr3_controller *ctrl);
++int cpr3_open_loop_regulator_register(struct platform_device *pdev,
++				      struct cpr3_controller *ctrl);
++int cpr3_regulator_unregister(struct cpr3_controller *ctrl);
++int cpr3_open_loop_regulator_unregister(struct cpr3_controller *ctrl);
++int cpr3_regulator_suspend(struct cpr3_controller *ctrl);
++int cpr3_regulator_resume(struct cpr3_controller *ctrl);
++
++int cpr3_allocate_threads(struct cpr3_controller *ctrl, u32 min_thread_id,
++			u32 max_thread_id);
++int cpr3_map_fuse_base(struct cpr3_controller *ctrl,
++			struct platform_device *pdev);
++int cpr3_read_tcsr_setting(struct cpr3_controller *ctrl,
++			   struct platform_device *pdev, u8 start, u8 end);
++int cpr3_read_fuse_param(void __iomem *fuse_base_addr,
++			const struct cpr3_fuse_param *param, u64 *param_value);
++int cpr3_convert_open_loop_voltage_fuse(int ref_volt, int step_volt, u32 fuse,
++			int fuse_len);
++u64 cpr3_interpolate(u64 x1, u64 y1, u64 x2, u64 y2, u64 x);
++int cpr3_parse_array_property(struct cpr3_regulator *vreg,
++			const char *prop_name, int tuple_size, u32 *out);
++int cpr3_parse_corner_array_property(struct cpr3_regulator *vreg,
++			const char *prop_name, int tuple_size, u32 *out);
++int cpr3_parse_corner_band_array_property(struct cpr3_regulator *vreg,
++			const char *prop_name, int tuple_size, u32 *out);
++int cpr3_parse_common_corner_data(struct cpr3_regulator *vreg);
++int cpr3_parse_thread_u32(struct cpr3_thread *thread, const char *propname,
++			u32 *out_value, u32 value_min, u32 value_max);
++int cpr3_parse_ctrl_u32(struct cpr3_controller *ctrl, const char *propname,
++			u32 *out_value, u32 value_min, u32 value_max);
++int cpr3_parse_common_thread_data(struct cpr3_thread *thread);
++int cpr3_parse_common_ctrl_data(struct cpr3_controller *ctrl);
++int cpr3_parse_open_loop_common_ctrl_data(struct cpr3_controller *ctrl);
++int cpr3_limit_open_loop_voltages(struct cpr3_regulator *vreg);
++void cpr3_open_loop_voltage_as_ceiling(struct cpr3_regulator *vreg);
++int cpr3_limit_floor_voltages(struct cpr3_regulator *vreg);
++void cpr3_print_quots(struct cpr3_regulator *vreg);
++int cpr3_determine_part_type(struct cpr3_regulator *vreg, int fuse_volt);
++int cpr3_determine_temp_base_open_loop_correction(struct cpr3_regulator *vreg,
++			int *fuse_volt);
++int cpr3_adjust_fused_open_loop_voltages(struct cpr3_regulator *vreg,
++			int *fuse_volt);
++int cpr3_adjust_open_loop_voltages(struct cpr3_regulator *vreg);
++int cpr3_quot_adjustment(int ro_scale, int volt_adjust);
++int cpr3_voltage_adjustment(int ro_scale, int quot_adjust);
++int cpr3_parse_closed_loop_voltage_adjustments(struct cpr3_regulator *vreg,
++			u64 *ro_sel, int *volt_adjust,
++			int *volt_adjust_fuse, int *ro_scale);
++int cpr4_parse_core_count_temp_voltage_adj(struct cpr3_regulator *vreg,
++			bool use_corner_band);
++int cpr3_apm_init(struct cpr3_controller *ctrl);
++int cpr3_mem_acc_init(struct cpr3_regulator *vreg);
++void cprh_adjust_voltages_for_apm(struct cpr3_regulator *vreg);
++void cprh_adjust_voltages_for_mem_acc(struct cpr3_regulator *vreg);
++int cpr3_adjust_target_quotients(struct cpr3_regulator *vreg,
++			int *fuse_volt_adjust);
++int cpr3_handle_temp_open_loop_adjustment(struct cpr3_controller *ctrl,
++			bool is_cold);
++int cpr3_get_cold_temp_threshold(struct cpr3_regulator *vreg, int *cold_temp);
++bool cpr3_can_adjust_cold_temp(struct cpr3_regulator *vreg);
++
++#else
++
++static inline int cpr3_regulator_register(struct platform_device *pdev,
++			struct cpr3_controller *ctrl)
++{
++	return -ENXIO;
++}
++
++static inline int
++cpr3_open_loop_regulator_register(struct platform_device *pdev,
++				  struct cpr3_controller *ctrl);
++{
++	return -ENXIO;
++}
++
++static inline int cpr3_regulator_unregister(struct cpr3_controller *ctrl)
++{
++	return -ENXIO;
++}
++
++static inline int
++cpr3_open_loop_regulator_unregister(struct cpr3_controller *ctrl)
++{
++	return -ENXIO;
++}
++
++static inline int cpr3_regulator_suspend(struct cpr3_controller *ctrl)
++{
++	return -ENXIO;
++}
++
++static inline int cpr3_regulator_resume(struct cpr3_controller *ctrl)
++{
++	return -ENXIO;
++}
++
++static inline int cpr3_get_thread_name(struct cpr3_thread *thread,
++			struct device_node *thread_node)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_allocate_threads(struct cpr3_controller *ctrl,
++			u32 min_thread_id, u32 max_thread_id)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_map_fuse_base(struct cpr3_controller *ctrl,
++			struct platform_device *pdev)
++{
++	return -ENXIO;
++}
++
++static inline int cpr3_read_tcsr_setting(struct cpr3_controller *ctrl,
++			   struct platform_device *pdev, u8 start, u8 end)
++{
++	return 0;
++}
++
++static inline int cpr3_read_fuse_param(void __iomem *fuse_base_addr,
++			const struct cpr3_fuse_param *param, u64 *param_value)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_convert_open_loop_voltage_fuse(int ref_volt,
++			int step_volt, u32 fuse, int fuse_len)
++{
++	return -EPERM;
++}
++
++static inline u64 cpr3_interpolate(u64 x1, u64 y1, u64 x2, u64 y2, u64 x)
++{
++	return 0;
++}
++
++static inline int cpr3_parse_array_property(struct cpr3_regulator *vreg,
++			const char *prop_name, int tuple_size, u32 *out)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_parse_corner_array_property(struct cpr3_regulator *vreg,
++			const char *prop_name, int tuple_size, u32 *out)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_parse_corner_band_array_property(
++			struct cpr3_regulator *vreg, const char *prop_name,
++			int tuple_size, u32 *out)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_parse_common_corner_data(struct cpr3_regulator *vreg)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_parse_thread_u32(struct cpr3_thread *thread,
++			const char *propname, u32 *out_value, u32 value_min,
++			u32 value_max)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_parse_ctrl_u32(struct cpr3_controller *ctrl,
++			const char *propname, u32 *out_value, u32 value_min,
++			u32 value_max)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_parse_common_thread_data(struct cpr3_thread *thread)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_parse_common_ctrl_data(struct cpr3_controller *ctrl)
++{
++	return -EPERM;
++}
++
++static inline int
++cpr3_parse_open_loop_common_ctrl_data(struct cpr3_controller *ctrl)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_limit_open_loop_voltages(struct cpr3_regulator *vreg)
++{
++	return -EPERM;
++}
++
++static inline void cpr3_open_loop_voltage_as_ceiling(
++			struct cpr3_regulator *vreg)
++{
++	return;
++}
++
++static inline int cpr3_limit_floor_voltages(struct cpr3_regulator *vreg)
++{
++	return -EPERM;
++}
++
++static inline void cpr3_print_quots(struct cpr3_regulator *vreg)
++{
++	return;
++}
++
++static inline int
++cpr3_determine_part_type(struct cpr3_regulator *vreg, int fuse_volt)
++{
++	return -EPERM;
++}
++
++static inline int
++cpr3_determine_temp_base_open_loop_correction(struct cpr3_regulator *vreg,
++			int *fuse_volt)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_adjust_fused_open_loop_voltages(
++			struct cpr3_regulator *vreg, int *fuse_volt)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_adjust_open_loop_voltages(struct cpr3_regulator *vreg)
++{
++	return -EPERM;
++}
++
++static inline int cpr3_quot_adjustment(int ro_scale, int volt_adjust)
++{
++	return 0;
++}
++
++static inline int cpr3_voltage_adjustment(int ro_scale, int quot_adjust)
++{
++	return 0;
++}
++
++static inline int cpr3_parse_closed_loop_voltage_adjustments(
++			struct cpr3_regulator *vreg, u64 *ro_sel,
++			int *volt_adjust, int *volt_adjust_fuse, int *ro_scale)
++{
++	return 0;
++}
++
++static inline int cpr4_parse_core_count_temp_voltage_adj(
++			struct cpr3_regulator *vreg, bool use_corner_band)
++{
++	return 0;
++}
++
++static inline int cpr3_apm_init(struct cpr3_controller *ctrl)
++{
++	return 0;
++}
++
++static inline int cpr3_mem_acc_init(struct cpr3_regulator *vreg)
++{
++	return 0;
++}
++
++static inline void cprh_adjust_voltages_for_apm(struct cpr3_regulator *vreg)
++{
++}
++
++static inline void cprh_adjust_voltages_for_mem_acc(struct cpr3_regulator *vreg)
++{
++}
++
++static inline int cpr3_adjust_target_quotients(struct cpr3_regulator *vreg,
++			int *fuse_volt_adjust)
++{
++	return 0;
++}
++
++static inline int
++cpr3_handle_temp_open_loop_adjustment(struct cpr3_controller *ctrl,
++			bool is_cold)
++{
++	return 0;
++}
++
++static inline bool
++cpr3_can_adjust_cold_temp(struct cpr3_regulator *vreg)
++{
++	return false;
++}
++
++static inline int
++cpr3_get_cold_temp_threshold(struct cpr3_regulator *vreg, int *cold_temp)
++{
++	return 0;
++}
++#endif /* CONFIG_REGULATOR_CPR3 */
++
++#endif /* __REGULATOR_CPR_REGULATOR_H__ */
+--- /dev/null
++++ b/drivers/regulator/cpr3-util.c
+@@ -0,0 +1,2760 @@
++/*
++ * Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++/*
++ * This file contains utility functions to be used by platform specific CPR3
++ * regulator drivers.
++ */
++
++#define pr_fmt(fmt) "%s: " fmt, __func__
++
++#include <linux/cpumask.h>
++#include <linux/device.h>
++#include <linux/io.h>
++#include <linux/kernel.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/slab.h>
++#include <linux/types.h>
++
++#include "cpr3-regulator.h"
++
++#define BYTES_PER_FUSE_ROW		8
++#define MAX_FUSE_ROW_BIT		63
++
++#define CPR3_CONSECUTIVE_UP_DOWN_MIN	0
++#define CPR3_CONSECUTIVE_UP_DOWN_MAX	15
++#define CPR3_UP_DOWN_THRESHOLD_MIN	0
++#define CPR3_UP_DOWN_THRESHOLD_MAX	31
++#define CPR3_STEP_QUOT_MIN		0
++#define CPR3_STEP_QUOT_MAX		63
++#define CPR3_IDLE_CLOCKS_MIN		0
++#define CPR3_IDLE_CLOCKS_MAX		31
++
++/* This constant has units of uV/mV so 1000 corresponds to 100%. */
++#define CPR3_AGING_DERATE_UNITY		1000
++
++static inline int read_ipq_soc_version_major(void)
++{
++	const int *prop;
++	prop = of_get_property(of_find_node_by_path("/"), "soc_version_major",
++				NULL);
++
++	if (!prop)
++		return -EINVAL;
++
++	return le32_to_cpu(*prop);
++}
++
++/**
++ * cpr3_allocate_regulators() - allocate and initialize CPR3 regulators for a
++ *		given thread based upon device tree data
++ * @thread:		Pointer to the CPR3 thread
++ *
++ * This function allocates the thread->vreg array based upon the number of
++ * device tree regulator subnodes.  It also initializes generic elements of each
++ * regulator struct such as name, of_node, and thread.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_allocate_regulators(struct cpr3_thread *thread)
++{
++	struct device_node *node;
++	int i, rc;
++
++	thread->vreg_count = 0;
++
++	for_each_available_child_of_node(thread->of_node, node) {
++		thread->vreg_count++;
++	}
++
++	thread->vreg = devm_kcalloc(thread->ctrl->dev, thread->vreg_count,
++			sizeof(*thread->vreg), GFP_KERNEL);
++	if (!thread->vreg)
++		return -ENOMEM;
++
++	i = 0;
++	for_each_available_child_of_node(thread->of_node, node) {
++		thread->vreg[i].of_node = node;
++		thread->vreg[i].thread = thread;
++
++		rc = of_property_read_string(node, "regulator-name",
++						&thread->vreg[i].name);
++		if (rc) {
++			dev_err(thread->ctrl->dev, "could not find regulator name, rc=%d\n",
++				rc);
++			return rc;
++		}
++
++		i++;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_allocate_threads() - allocate and initialize CPR3 threads for a given
++ *			     controller based upon device tree data
++ * @ctrl:		Pointer to the CPR3 controller
++ * @min_thread_id:	Minimum allowed hardware thread ID for this controller
++ * @max_thread_id:	Maximum allowed hardware thread ID for this controller
++ *
++ * This function allocates the ctrl->thread array based upon the number of
++ * device tree thread subnodes.  It also initializes generic elements of each
++ * thread struct such as thread_id, of_node, ctrl, and vreg array.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_allocate_threads(struct cpr3_controller *ctrl, u32 min_thread_id,
++			u32 max_thread_id)
++{
++	struct device *dev = ctrl->dev;
++	struct device_node *thread_node;
++	int i, j, rc;
++
++	ctrl->thread_count = 0;
++
++	for_each_available_child_of_node(dev->of_node, thread_node) {
++		ctrl->thread_count++;
++	}
++
++	ctrl->thread = devm_kcalloc(dev, ctrl->thread_count,
++			sizeof(*ctrl->thread), GFP_KERNEL);
++	if (!ctrl->thread)
++		return -ENOMEM;
++
++	i = 0;
++	for_each_available_child_of_node(dev->of_node, thread_node) {
++		ctrl->thread[i].of_node = thread_node;
++		ctrl->thread[i].ctrl = ctrl;
++
++		rc = of_property_read_u32(thread_node, "qcom,cpr-thread-id",
++					  &ctrl->thread[i].thread_id);
++		if (rc) {
++			dev_err(dev, "could not read DT property qcom,cpr-thread-id, rc=%d\n",
++				rc);
++			return rc;
++		}
++
++		if (ctrl->thread[i].thread_id < min_thread_id ||
++				ctrl->thread[i].thread_id > max_thread_id) {
++			dev_err(dev, "invalid thread id = %u; not within [%u, %u]\n",
++				ctrl->thread[i].thread_id, min_thread_id,
++				max_thread_id);
++			return -EINVAL;
++		}
++
++		/* Verify that the thread ID is unique for all child nodes. */
++		for (j = 0; j < i; j++) {
++			if (ctrl->thread[j].thread_id
++					== ctrl->thread[i].thread_id) {
++				dev_err(dev, "duplicate thread id = %u found\n",
++					ctrl->thread[i].thread_id);
++				return -EINVAL;
++			}
++		}
++
++		rc = cpr3_allocate_regulators(&ctrl->thread[i]);
++		if (rc)
++			return rc;
++
++		i++;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_map_fuse_base() - ioremap the base address of the fuse region
++ * @ctrl:	Pointer to the CPR3 controller
++ * @pdev:	Platform device pointer for the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_map_fuse_base(struct cpr3_controller *ctrl,
++			struct platform_device *pdev)
++{
++	struct resource *res;
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "fuse_base");
++	if (!res || !res->start) {
++		dev_err(&pdev->dev, "fuse base address is missing\n");
++		return -ENXIO;
++	}
++
++	ctrl->fuse_base = devm_ioremap(&pdev->dev, res->start,
++						resource_size(res));
++
++	return 0;
++}
++
++/**
++ * cpr3_read_tcsr_setting - reads the CPR setting bits from TCSR register
++ * @ctrl:	Pointer to the CPR3 controller
++ * @pdev:	Platform device pointer for the CPR3 controller
++ * @start:	start bit in TCSR register
++ * @end:	end bit in TCSR register
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_read_tcsr_setting(struct cpr3_controller *ctrl,
++			   struct platform_device *pdev, u8 start, u8 end)
++{
++	struct resource *res;
++	void __iomem *tcsr_reg;
++	u32 val;
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
++					   "cpr_tcsr_reg");
++	if (!res || !res->start)
++		return 0;
++
++	tcsr_reg = ioremap(res->start, resource_size(res));
++	if (!tcsr_reg) {
++		dev_err(&pdev->dev, "tcsr ioremap failed\n");
++		return 0;
++	}
++
++	val = readl_relaxed(tcsr_reg);
++	val &= GENMASK(end, start);
++	val >>= start;
++
++	switch (val) {
++	case 1:
++		ctrl->cpr_global_setting = CPR_DISABLED;
++		break;
++	case 2:
++		ctrl->cpr_global_setting = CPR_OPEN_LOOP_EN;
++		break;
++	case 3:
++		ctrl->cpr_global_setting = CPR_CLOSED_LOOP_EN;
++		break;
++	default:
++		ctrl->cpr_global_setting = CPR_DEFAULT;
++	}
++
++	iounmap(tcsr_reg);
++
++	return 0;
++}
++
++/**
++ * cpr3_read_fuse_param() - reads a CPR3 fuse parameter out of eFuses
++ * @fuse_base_addr:	Virtual memory address of the eFuse base address
++ * @param:		Null terminated array of fuse param segments to read
++ *			from
++ * @param_value:	Output with value read from the eFuses
++ *
++ * This function reads from each of the parameter segments listed in the param
++ * array and concatenates their values together.  Reading stops when an element
++ * is reached which has all 0 struct values.  The total number of bits specified
++ * for the fuse parameter across all segments must be less than or equal to 64.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_read_fuse_param(void __iomem *fuse_base_addr,
++		const struct cpr3_fuse_param *param, u64 *param_value)
++{
++	u64 fuse_val, val;
++	int bits;
++	int bits_total = 0;
++
++	*param_value = 0;
++
++	while (param->row || param->bit_start || param->bit_end) {
++		if (param->bit_start > param->bit_end
++		    || param->bit_end > MAX_FUSE_ROW_BIT) {
++			pr_err("Invalid fuse parameter segment: row=%u, start=%u, end=%u\n",
++				param->row, param->bit_start, param->bit_end);
++			return -EINVAL;
++		}
++
++		bits = param->bit_end - param->bit_start + 1;
++		if (bits_total + bits > 64) {
++			pr_err("Invalid fuse parameter segments; total bits = %d\n",
++				bits_total + bits);
++			return -EINVAL;
++		}
++
++		fuse_val = readq_relaxed(fuse_base_addr
++					 + param->row * BYTES_PER_FUSE_ROW);
++		val = (fuse_val >> param->bit_start) & ((1ULL << bits) - 1);
++		*param_value |= val << bits_total;
++		bits_total += bits;
++
++		param++;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_convert_open_loop_voltage_fuse() - converts an open loop voltage fuse
++ *		value into an absolute voltage with units of microvolts
++ * @ref_volt:		Reference voltage in microvolts
++ * @step_volt:		The step size in microvolts of the fuse LSB
++ * @fuse:		Open loop voltage fuse value
++ * @fuse_len:		The bit length of the fuse value
++ *
++ * The MSB of the fuse parameter corresponds to a sign bit.  If it is set, then
++ * the lower bits correspond to the number of steps to go down from the
++ * reference voltage.  If it is not set, then the lower bits correspond to the
++ * number of steps to go up from the reference voltage.
++ */
++int cpr3_convert_open_loop_voltage_fuse(int ref_volt, int step_volt, u32 fuse,
++					int fuse_len)
++{
++	int sign, steps;
++
++	sign = (fuse & (1 << (fuse_len - 1))) ? -1 : 1;
++	steps = fuse & ((1 << (fuse_len - 1)) - 1);
++
++	return ref_volt + sign * steps * step_volt;
++}
++
++/**
++ * cpr3_interpolate() - performs linear interpolation
++ * @x1		Lower known x value
++ * @y1		Lower known y value
++ * @x2		Upper known x value
++ * @y2		Upper known y value
++ * @x		Intermediate x value
++ *
++ * Returns y where (x, y) falls on the line between (x1, y1) and (x2, y2).
++ * It is required that x1 < x2, y1 <= y2, and x1 <= x <= x2.  If these
++ * conditions are not met, then y2 will be returned.
++ */
++u64 cpr3_interpolate(u64 x1, u64 y1, u64 x2, u64 y2, u64 x)
++{
++	u64 temp;
++
++	if (x1 >= x2 || y1 > y2 || x1 > x || x > x2)
++		return y2;
++
++	temp = (x2 - x) * (y2 - y1);
++	do_div(temp, (u32)(x2 - x1));
++
++	return y2 - temp;
++}
++
++/**
++ * cpr3_parse_array_property() - fill an array from a portion of the values
++ *		specified for a device tree property
++ * @vreg:		Pointer to the CPR3 regulator
++ * @prop_name:		The name of the device tree property to read from
++ * @tuple_size:		The number of elements in each tuple
++ * @out:		Output data array which must be of size tuple_size
++ *
++ * cpr3_parse_common_corner_data() must be called for vreg before this function
++ * is called so that fuse combo and speed bin size elements are initialized.
++ *
++ * Three formats are supported for the device tree property:
++ * 1. Length == tuple_size
++ *	(reading begins at index 0)
++ * 2. Length == tuple_size * vreg->fuse_combos_supported
++ *	(reading begins at index tuple_size * vreg->fuse_combo)
++ * 3. Length == tuple_size * vreg->speed_bins_supported
++ *	(reading begins at index tuple_size * vreg->speed_bin_fuse)
++ *
++ * All other property lengths are treated as errors.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_parse_array_property(struct cpr3_regulator *vreg,
++		const char *prop_name, int tuple_size, u32 *out)
++{
++	struct device_node *node = vreg->of_node;
++	int len = 0;
++	int i, offset, rc;
++
++	if (!of_find_property(node, prop_name, &len)) {
++		cpr3_err(vreg, "property %s is missing\n", prop_name);
++		return -EINVAL;
++	}
++
++	if (len == tuple_size * sizeof(u32)) {
++		offset = 0;
++	} else if (len == tuple_size * vreg->fuse_combos_supported
++				     * sizeof(u32)) {
++		offset = tuple_size * vreg->fuse_combo;
++	} else if (vreg->speed_bins_supported > 0 &&
++		 len == tuple_size * vreg->speed_bins_supported * sizeof(u32)) {
++		offset = tuple_size * vreg->speed_bin_fuse;
++	} else {
++		if (vreg->speed_bins_supported > 0)
++			cpr3_err(vreg, "property %s has invalid length=%d, should be %zu, %zu, or %zu\n",
++				prop_name, len,
++				tuple_size * sizeof(u32),
++				tuple_size * vreg->speed_bins_supported
++					   * sizeof(u32),
++				tuple_size * vreg->fuse_combos_supported
++					   * sizeof(u32));
++		else
++			cpr3_err(vreg, "property %s has invalid length=%d, should be %zu or %zu\n",
++				prop_name, len,
++				tuple_size * sizeof(u32),
++				tuple_size * vreg->fuse_combos_supported
++					   * sizeof(u32));
++		return -EINVAL;
++	}
++
++	for (i = 0; i < tuple_size; i++) {
++		rc = of_property_read_u32_index(node, prop_name, offset + i,
++						&out[i]);
++		if (rc) {
++			cpr3_err(vreg, "error reading property %s, rc=%d\n",
++				prop_name, rc);
++			return rc;
++		}
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_parse_corner_array_property() - fill a per-corner array from a portion
++ *		of the values specified for a device tree property
++ * @vreg:		Pointer to the CPR3 regulator
++ * @prop_name:		The name of the device tree property to read from
++ * @tuple_size:		The number of elements in each per-corner tuple
++ * @out:		Output data array which must be of size:
++ *			tuple_size * vreg->corner_count
++ *
++ * cpr3_parse_common_corner_data() must be called for vreg before this function
++ * is called so that fuse combo and speed bin size elements are initialized.
++ *
++ * Three formats are supported for the device tree property:
++ * 1. Length == tuple_size * vreg->corner_count
++ *	(reading begins at index 0)
++ * 2. Length == tuple_size * vreg->fuse_combo_corner_sum
++ *	(reading begins at index tuple_size * vreg->fuse_combo_offset)
++ * 3. Length == tuple_size * vreg->speed_bin_corner_sum
++ *	(reading begins at index tuple_size * vreg->speed_bin_offset)
++ *
++ * All other property lengths are treated as errors.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_parse_corner_array_property(struct cpr3_regulator *vreg,
++		const char *prop_name, int tuple_size, u32 *out)
++{
++	struct device_node *node = vreg->of_node;
++	int len = 0;
++	int i, offset, rc;
++
++	if (!of_find_property(node, prop_name, &len)) {
++		cpr3_err(vreg, "property %s is missing\n", prop_name);
++		return -EINVAL;
++	}
++
++	if (len == tuple_size * vreg->corner_count * sizeof(u32)) {
++		offset = 0;
++	} else if (len == tuple_size * vreg->fuse_combo_corner_sum
++				     * sizeof(u32)) {
++		offset = tuple_size * vreg->fuse_combo_offset;
++	} else if (vreg->speed_bin_corner_sum > 0 &&
++		 len == tuple_size * vreg->speed_bin_corner_sum * sizeof(u32)) {
++		offset = tuple_size * vreg->speed_bin_offset;
++	} else {
++		if (vreg->speed_bin_corner_sum > 0)
++			cpr3_err(vreg, "property %s has invalid length=%d, should be %zu, %zu, or %zu\n",
++				prop_name, len,
++				tuple_size * vreg->corner_count * sizeof(u32),
++				tuple_size * vreg->speed_bin_corner_sum
++					   * sizeof(u32),
++				tuple_size * vreg->fuse_combo_corner_sum
++					   * sizeof(u32));
++		else
++			cpr3_err(vreg, "property %s has invalid length=%d, should be %zu or %zu\n",
++				prop_name, len,
++				tuple_size * vreg->corner_count * sizeof(u32),
++				tuple_size * vreg->fuse_combo_corner_sum
++					   * sizeof(u32));
++		return -EINVAL;
++	}
++
++	for (i = 0; i < tuple_size * vreg->corner_count; i++) {
++		rc = of_property_read_u32_index(node, prop_name, offset + i,
++						&out[i]);
++		if (rc) {
++			cpr3_err(vreg, "error reading property %s, rc=%d\n",
++				prop_name, rc);
++			return rc;
++		}
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_parse_corner_band_array_property() - fill a per-corner band array
++ *		from a portion of the values specified for a device tree
++ *		property
++ * @vreg:		Pointer to the CPR3 regulator
++ * @prop_name:		The name of the device tree property to read from
++ * @tuple_size:		The number of elements in each per-corner band tuple
++ * @out:		Output data array which must be of size:
++ *			tuple_size * vreg->corner_band_count
++ *
++ * cpr3_parse_common_corner_data() must be called for vreg before this function
++ * is called so that fuse combo and speed bin size elements are initialized.
++ * In addition, corner band fuse combo and speed bin sum and offset elements
++ * must be initialized prior to executing this function.
++ *
++ * Three formats are supported for the device tree property:
++ * 1. Length == tuple_size * vreg->corner_band_count
++ *	(reading begins at index 0)
++ * 2. Length == tuple_size * vreg->fuse_combo_corner_band_sum
++ *	(reading begins at index tuple_size *
++ *		vreg->fuse_combo_corner_band_offset)
++ * 3. Length == tuple_size * vreg->speed_bin_corner_band_sum
++ *	(reading begins at index tuple_size *
++ *		vreg->speed_bin_corner_band_offset)
++ *
++ * All other property lengths are treated as errors.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_parse_corner_band_array_property(struct cpr3_regulator *vreg,
++		const char *prop_name, int tuple_size, u32 *out)
++{
++	struct device_node *node = vreg->of_node;
++	int len = 0;
++	int i, offset, rc;
++
++	if (!of_find_property(node, prop_name, &len)) {
++		cpr3_err(vreg, "property %s is missing\n", prop_name);
++		return -EINVAL;
++	}
++
++	if (len == tuple_size * vreg->corner_band_count * sizeof(u32)) {
++		offset = 0;
++	} else if (len == tuple_size * vreg->fuse_combo_corner_band_sum
++				     * sizeof(u32)) {
++		offset = tuple_size * vreg->fuse_combo_corner_band_offset;
++	} else if (vreg->speed_bin_corner_band_sum > 0 &&
++		 len == tuple_size * vreg->speed_bin_corner_band_sum *
++		   sizeof(u32)) {
++		offset = tuple_size * vreg->speed_bin_corner_band_offset;
++	} else {
++		if (vreg->speed_bin_corner_band_sum > 0)
++			cpr3_err(vreg, "property %s has invalid length=%d, should be %zu, %zu, or %zu\n",
++				prop_name, len,
++				tuple_size * vreg->corner_band_count *
++				 sizeof(u32),
++				tuple_size * vreg->speed_bin_corner_band_sum
++					   * sizeof(u32),
++				tuple_size * vreg->fuse_combo_corner_band_sum
++					   * sizeof(u32));
++		else
++			cpr3_err(vreg, "property %s has invalid length=%d, should be %zu or %zu\n",
++				prop_name, len,
++				tuple_size * vreg->corner_band_count *
++				 sizeof(u32),
++				tuple_size * vreg->fuse_combo_corner_band_sum
++					   * sizeof(u32));
++		return -EINVAL;
++	}
++
++	for (i = 0; i < tuple_size * vreg->corner_band_count; i++) {
++		rc = of_property_read_u32_index(node, prop_name, offset + i,
++						&out[i]);
++		if (rc) {
++			cpr3_err(vreg, "error reading property %s, rc=%d\n",
++				prop_name, rc);
++			return rc;
++		}
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_parse_common_corner_data() - parse common CPR3 properties relating to
++ *		the corners supported by a CPR3 regulator from device tree
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * This function reads, validates, and utilizes the following device tree
++ * properties: qcom,cpr-fuse-corners, qcom,cpr-fuse-combos, qcom,cpr-speed-bins,
++ * qcom,cpr-speed-bin-corners, qcom,cpr-corners, qcom,cpr-voltage-ceiling,
++ * qcom,cpr-voltage-floor, qcom,corner-frequencies,
++ * and qcom,cpr-corner-fmax-map.
++ *
++ * It initializes these CPR3 regulator elements: corner, corner_count,
++ * fuse_combos_supported, fuse_corner_map, and speed_bins_supported.  It
++ * initializes these elements for each corner: ceiling_volt, floor_volt,
++ * proc_freq, and cpr_fuse_corner.
++ *
++ * It requires that the following CPR3 regulator elements be initialized before
++ * being called: fuse_corner_count, fuse_combo, and speed_bin_fuse.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_parse_common_corner_data(struct cpr3_regulator *vreg)
++{
++	struct device_node *node = vreg->of_node;
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	u32 max_fuse_combos, fuse_corners, aging_allowed = 0;
++	u32 max_speed_bins = 0;
++	u32 *combo_corners;
++	u32 *speed_bin_corners;
++	u32 *temp;
++	int i, j, rc;
++
++	rc = of_property_read_u32(node, "qcom,cpr-fuse-corners", &fuse_corners);
++	if (rc) {
++		cpr3_err(vreg, "error reading property qcom,cpr-fuse-corners, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	if (vreg->fuse_corner_count != fuse_corners) {
++		cpr3_err(vreg, "device tree config supports %d fuse corners but the hardware has %d fuse corners\n",
++			fuse_corners, vreg->fuse_corner_count);
++		return -EINVAL;
++	}
++
++	rc = of_property_read_u32(node, "qcom,cpr-fuse-combos",
++				&max_fuse_combos);
++	if (rc) {
++		cpr3_err(vreg, "error reading property qcom,cpr-fuse-combos, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	/*
++	 * Sanity check against arbitrarily large value to avoid excessive
++	 * memory allocation.
++	 */
++	if (max_fuse_combos > 100 || max_fuse_combos == 0) {
++		cpr3_err(vreg, "qcom,cpr-fuse-combos is invalid: %u\n",
++			max_fuse_combos);
++		return -EINVAL;
++	}
++
++	if (vreg->fuse_combo >= max_fuse_combos) {
++		cpr3_err(vreg, "device tree config supports fuse combos 0-%u but the hardware has combo %d\n",
++			max_fuse_combos - 1, vreg->fuse_combo);
++		BUG_ON(1);
++		return -EINVAL;
++	}
++
++	vreg->fuse_combos_supported = max_fuse_combos;
++
++	of_property_read_u32(node, "qcom,cpr-speed-bins", &max_speed_bins);
++
++	/*
++	 * Sanity check against arbitrarily large value to avoid excessive
++	 * memory allocation.
++	 */
++	if (max_speed_bins > 100) {
++		cpr3_err(vreg, "qcom,cpr-speed-bins is invalid: %u\n",
++			max_speed_bins);
++		return -EINVAL;
++	}
++
++	if (max_speed_bins && vreg->speed_bin_fuse >= max_speed_bins) {
++		cpr3_err(vreg, "device tree config supports speed bins 0-%u but the hardware has speed bin %d\n",
++			max_speed_bins - 1, vreg->speed_bin_fuse);
++		BUG();
++		return -EINVAL;
++	}
++
++	vreg->speed_bins_supported = max_speed_bins;
++
++	combo_corners = kcalloc(vreg->fuse_combos_supported,
++				sizeof(*combo_corners), GFP_KERNEL);
++	if (!combo_corners)
++		return -ENOMEM;
++
++	rc = of_property_read_u32_array(node, "qcom,cpr-corners", combo_corners,
++					vreg->fuse_combos_supported);
++	if (rc == -EOVERFLOW) {
++		/* Single value case */
++		rc = of_property_read_u32(node, "qcom,cpr-corners",
++					combo_corners);
++		for (i = 1; i < vreg->fuse_combos_supported; i++)
++			combo_corners[i] = combo_corners[0];
++	}
++	if (rc) {
++		cpr3_err(vreg, "error reading property qcom,cpr-corners, rc=%d\n",
++			rc);
++		kfree(combo_corners);
++		return rc;
++	}
++
++	vreg->fuse_combo_offset = 0;
++	vreg->fuse_combo_corner_sum = 0;
++	for (i = 0; i < vreg->fuse_combos_supported; i++) {
++		vreg->fuse_combo_corner_sum += combo_corners[i];
++		if (i < vreg->fuse_combo)
++			vreg->fuse_combo_offset += combo_corners[i];
++	}
++
++	vreg->corner_count = combo_corners[vreg->fuse_combo];
++
++	kfree(combo_corners);
++
++	vreg->speed_bin_offset = 0;
++	vreg->speed_bin_corner_sum = 0;
++	if (vreg->speed_bins_supported > 0) {
++		speed_bin_corners = kcalloc(vreg->speed_bins_supported,
++					sizeof(*speed_bin_corners), GFP_KERNEL);
++		if (!speed_bin_corners)
++			return -ENOMEM;
++
++		rc = of_property_read_u32_array(node,
++				"qcom,cpr-speed-bin-corners", speed_bin_corners,
++				vreg->speed_bins_supported);
++		if (rc) {
++			cpr3_err(vreg, "error reading property qcom,cpr-speed-bin-corners, rc=%d\n",
++				rc);
++			kfree(speed_bin_corners);
++			return rc;
++		}
++
++		for (i = 0; i < vreg->speed_bins_supported; i++) {
++			vreg->speed_bin_corner_sum += speed_bin_corners[i];
++			if (i < vreg->speed_bin_fuse)
++				vreg->speed_bin_offset += speed_bin_corners[i];
++		}
++
++		if (speed_bin_corners[vreg->speed_bin_fuse]
++		    != vreg->corner_count) {
++			cpr3_err(vreg, "qcom,cpr-corners and qcom,cpr-speed-bin-corners conflict on number of corners: %d vs %u\n",
++				vreg->corner_count,
++				speed_bin_corners[vreg->speed_bin_fuse]);
++			kfree(speed_bin_corners);
++			return -EINVAL;
++		}
++
++		kfree(speed_bin_corners);
++	}
++
++	vreg->corner = devm_kcalloc(ctrl->dev, vreg->corner_count,
++				    sizeof(*vreg->corner), GFP_KERNEL);
++	temp = kcalloc(vreg->corner_count, sizeof(*temp), GFP_KERNEL);
++	if (!vreg->corner || !temp)
++		return -ENOMEM;
++
++	rc = cpr3_parse_corner_array_property(vreg, "qcom,cpr-voltage-ceiling",
++			1, temp);
++	if (rc)
++		goto free_temp;
++	for (i = 0; i < vreg->corner_count; i++) {
++		vreg->corner[i].ceiling_volt
++			= CPR3_ROUND(temp[i], ctrl->step_volt);
++		vreg->corner[i].abs_ceiling_volt = vreg->corner[i].ceiling_volt;
++	}
++
++	rc = cpr3_parse_corner_array_property(vreg, "qcom,cpr-voltage-floor",
++			1, temp);
++	if (rc)
++		goto free_temp;
++	for (i = 0; i < vreg->corner_count; i++)
++		vreg->corner[i].floor_volt
++			= CPR3_ROUND(temp[i], ctrl->step_volt);
++
++	/* Validate ceiling and floor values */
++	for (i = 0; i < vreg->corner_count; i++) {
++		if (vreg->corner[i].floor_volt
++		    > vreg->corner[i].ceiling_volt) {
++			cpr3_err(vreg, "CPR floor[%d]=%d > ceiling[%d]=%d uV\n",
++				i, vreg->corner[i].floor_volt,
++				i, vreg->corner[i].ceiling_volt);
++			rc = -EINVAL;
++			goto free_temp;
++		}
++	}
++
++	/* Load optional system-supply voltages */
++	if (of_find_property(vreg->of_node, "qcom,system-voltage", NULL)) {
++		rc = cpr3_parse_corner_array_property(vreg,
++			"qcom,system-voltage", 1, temp);
++		if (rc)
++			goto free_temp;
++		for (i = 0; i < vreg->corner_count; i++)
++			vreg->corner[i].system_volt = temp[i];
++	}
++
++	rc = cpr3_parse_corner_array_property(vreg, "qcom,corner-frequencies",
++			1, temp);
++	if (rc)
++		goto free_temp;
++	for (i = 0; i < vreg->corner_count; i++)
++		vreg->corner[i].proc_freq = temp[i];
++
++	/* Validate frequencies */
++	for (i = 1; i < vreg->corner_count; i++) {
++		if (vreg->corner[i].proc_freq
++		    < vreg->corner[i - 1].proc_freq) {
++			cpr3_err(vreg, "invalid frequency: freq[%d]=%u < freq[%d]=%u\n",
++				i, vreg->corner[i].proc_freq, i - 1,
++				vreg->corner[i - 1].proc_freq);
++			rc = -EINVAL;
++			goto free_temp;
++		}
++	}
++
++	vreg->fuse_corner_map = devm_kcalloc(ctrl->dev, vreg->fuse_corner_count,
++				    sizeof(*vreg->fuse_corner_map), GFP_KERNEL);
++	if (!vreg->fuse_corner_map) {
++		rc = -ENOMEM;
++		goto free_temp;
++	}
++
++	rc = cpr3_parse_array_property(vreg, "qcom,cpr-corner-fmax-map",
++		vreg->fuse_corner_count, temp);
++	if (rc)
++		goto free_temp;
++	for (i = 0; i < vreg->fuse_corner_count; i++) {
++		vreg->fuse_corner_map[i] = temp[i] - CPR3_CORNER_OFFSET;
++		if (temp[i] < CPR3_CORNER_OFFSET
++		    || temp[i] > vreg->corner_count + CPR3_CORNER_OFFSET) {
++			cpr3_err(vreg, "invalid corner value specified in qcom,cpr-corner-fmax-map: %u\n",
++				temp[i]);
++			rc = -EINVAL;
++			goto free_temp;
++		} else if (i > 0 && temp[i - 1] >= temp[i]) {
++			cpr3_err(vreg, "invalid corner %u less than or equal to previous corner %u\n",
++				temp[i], temp[i - 1]);
++			rc = -EINVAL;
++			goto free_temp;
++		}
++	}
++	if (temp[vreg->fuse_corner_count - 1] != vreg->corner_count)
++		cpr3_debug(vreg, "Note: highest Fmax corner %u in qcom,cpr-corner-fmax-map does not match highest supported corner %d\n",
++			temp[vreg->fuse_corner_count - 1],
++			vreg->corner_count);
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		for (j = 0; j < vreg->fuse_corner_count; j++) {
++			if (i + CPR3_CORNER_OFFSET <= temp[j]) {
++				vreg->corner[i].cpr_fuse_corner = j;
++				break;
++			}
++		}
++		if (j == vreg->fuse_corner_count) {
++			/*
++			 * Handle the case where the highest fuse corner maps
++			 * to a corner below the highest corner.
++			 */
++			vreg->corner[i].cpr_fuse_corner
++				= vreg->fuse_corner_count - 1;
++		}
++	}
++
++	if (of_find_property(vreg->of_node,
++				"qcom,allow-aging-voltage-adjustment", NULL)) {
++		rc = cpr3_parse_array_property(vreg,
++			"qcom,allow-aging-voltage-adjustment",
++			1, &aging_allowed);
++		if (rc)
++			goto free_temp;
++
++		vreg->aging_allowed = aging_allowed;
++	}
++
++	if (of_find_property(vreg->of_node,
++		       "qcom,allow-aging-open-loop-voltage-adjustment", NULL)) {
++		rc = cpr3_parse_array_property(vreg,
++			"qcom,allow-aging-open-loop-voltage-adjustment",
++			1, &aging_allowed);
++		if (rc)
++			goto free_temp;
++
++		vreg->aging_allow_open_loop_adj = aging_allowed;
++	}
++
++	if (vreg->aging_allowed) {
++		if (ctrl->aging_ref_volt <= 0) {
++			cpr3_err(ctrl, "qcom,cpr-aging-ref-voltage must be specified\n");
++			rc = -EINVAL;
++			goto free_temp;
++		}
++
++		rc = cpr3_parse_array_property(vreg,
++			"qcom,cpr-aging-max-voltage-adjustment",
++			1, &vreg->aging_max_adjust_volt);
++		if (rc)
++			goto free_temp;
++
++		rc = cpr3_parse_array_property(vreg,
++			"qcom,cpr-aging-ref-corner", 1, &vreg->aging_corner);
++		if (rc) {
++			goto free_temp;
++		} else if (vreg->aging_corner < CPR3_CORNER_OFFSET
++			   || vreg->aging_corner > vreg->corner_count - 1
++							+ CPR3_CORNER_OFFSET) {
++			cpr3_err(vreg, "aging reference corner=%d not in range [%d, %d]\n",
++				vreg->aging_corner, CPR3_CORNER_OFFSET,
++				vreg->corner_count - 1 + CPR3_CORNER_OFFSET);
++			rc = -EINVAL;
++			goto free_temp;
++		}
++		vreg->aging_corner -= CPR3_CORNER_OFFSET;
++
++		if (of_find_property(vreg->of_node, "qcom,cpr-aging-derate",
++					NULL)) {
++			rc = cpr3_parse_corner_array_property(vreg,
++				"qcom,cpr-aging-derate", 1, temp);
++			if (rc)
++				goto free_temp;
++
++			for (i = 0; i < vreg->corner_count; i++)
++				vreg->corner[i].aging_derate = temp[i];
++		} else {
++			for (i = 0; i < vreg->corner_count; i++)
++				vreg->corner[i].aging_derate
++					= CPR3_AGING_DERATE_UNITY;
++		}
++	}
++
++free_temp:
++	kfree(temp);
++	return rc;
++}
++
++/**
++ * cpr3_parse_thread_u32() - parse the specified property from the CPR3 thread's
++ *		device tree node and verify that it is within the allowed limits
++ * @thread:		Pointer to the CPR3 thread
++ * @propname:		The name of the device tree property to read
++ * @out_value:		The output pointer to fill with the value read
++ * @value_min:		The minimum allowed property value
++ * @value_max:		The maximum allowed property value
++ *
++ * This function prints a verbose error message if the property is missing or
++ * has a value which is not within the specified range.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_parse_thread_u32(struct cpr3_thread *thread, const char *propname,
++		       u32 *out_value, u32 value_min, u32 value_max)
++{
++	int rc;
++
++	rc = of_property_read_u32(thread->of_node, propname, out_value);
++	if (rc) {
++		cpr3_err(thread->ctrl, "thread %u error reading property %s, rc=%d\n",
++			thread->thread_id, propname, rc);
++		return rc;
++	}
++
++	if (*out_value < value_min || *out_value > value_max) {
++		cpr3_err(thread->ctrl, "thread %u %s=%u is invalid; allowed range: [%u, %u]\n",
++			thread->thread_id, propname, *out_value, value_min,
++			value_max);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_parse_ctrl_u32() - parse the specified property from the CPR3
++ *		controller's device tree node and verify that it is within the
++ *		allowed limits
++ * @ctrl:		Pointer to the CPR3 controller
++ * @propname:		The name of the device tree property to read
++ * @out_value:		The output pointer to fill with the value read
++ * @value_min:		The minimum allowed property value
++ * @value_max:		The maximum allowed property value
++ *
++ * This function prints a verbose error message if the property is missing or
++ * has a value which is not within the specified range.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_parse_ctrl_u32(struct cpr3_controller *ctrl, const char *propname,
++		       u32 *out_value, u32 value_min, u32 value_max)
++{
++	int rc;
++
++	rc = of_property_read_u32(ctrl->dev->of_node, propname, out_value);
++	if (rc) {
++		cpr3_err(ctrl, "error reading property %s, rc=%d\n",
++			propname, rc);
++		return rc;
++	}
++
++	if (*out_value < value_min || *out_value > value_max) {
++		cpr3_err(ctrl, "%s=%u is invalid; allowed range: [%u, %u]\n",
++			propname, *out_value, value_min, value_max);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_parse_common_thread_data() - parse common CPR3 thread properties from
++ *		device tree
++ * @thread:		Pointer to the CPR3 thread
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_parse_common_thread_data(struct cpr3_thread *thread)
++{
++	int rc;
++
++	rc = cpr3_parse_thread_u32(thread, "qcom,cpr-consecutive-up",
++			&thread->consecutive_up, CPR3_CONSECUTIVE_UP_DOWN_MIN,
++			CPR3_CONSECUTIVE_UP_DOWN_MAX);
++	if (rc)
++		return rc;
++
++	rc = cpr3_parse_thread_u32(thread, "qcom,cpr-consecutive-down",
++			&thread->consecutive_down, CPR3_CONSECUTIVE_UP_DOWN_MIN,
++			CPR3_CONSECUTIVE_UP_DOWN_MAX);
++	if (rc)
++		return rc;
++
++	rc = cpr3_parse_thread_u32(thread, "qcom,cpr-up-threshold",
++			&thread->up_threshold, CPR3_UP_DOWN_THRESHOLD_MIN,
++			CPR3_UP_DOWN_THRESHOLD_MAX);
++	if (rc)
++		return rc;
++
++	rc = cpr3_parse_thread_u32(thread, "qcom,cpr-down-threshold",
++			&thread->down_threshold, CPR3_UP_DOWN_THRESHOLD_MIN,
++			CPR3_UP_DOWN_THRESHOLD_MAX);
++	if (rc)
++		return rc;
++
++	return rc;
++}
++
++/**
++ * cpr3_parse_irq_affinity() - parse CPR IRQ affinity information
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_parse_irq_affinity(struct cpr3_controller *ctrl)
++{
++	struct device_node *cpu_node;
++	int i, cpu;
++	int len = 0;
++
++	if (!of_find_property(ctrl->dev->of_node, "qcom,cpr-interrupt-affinity",
++				&len)) {
++		/* No IRQ affinity required */
++		return 0;
++	}
++
++	len /= sizeof(u32);
++
++	for (i = 0; i < len; i++) {
++		cpu_node = of_parse_phandle(ctrl->dev->of_node,
++					    "qcom,cpr-interrupt-affinity", i);
++		if (!cpu_node) {
++			cpr3_err(ctrl, "could not find CPU node %d\n", i);
++			return -EINVAL;
++		}
++
++		for_each_possible_cpu(cpu) {
++			if (of_get_cpu_node(cpu, NULL) == cpu_node) {
++				cpumask_set_cpu(cpu, &ctrl->irq_affinity_mask);
++				break;
++			}
++		}
++		of_node_put(cpu_node);
++	}
++
++	return 0;
++}
++
++static int cpr3_panic_notifier_init(struct cpr3_controller *ctrl)
++{
++	struct device_node *node = ctrl->dev->of_node;
++	struct cpr3_panic_regs_info *panic_regs_info;
++	struct cpr3_reg_info *regs;
++	int i, reg_count, len, rc = 0;
++
++	if (!of_find_property(node, "qcom,cpr-panic-reg-addr-list", &len)) {
++		/* panic register address list not specified */
++		return rc;
++	}
++
++	reg_count = len / sizeof(u32);
++	if (!reg_count) {
++		cpr3_err(ctrl, "qcom,cpr-panic-reg-addr-list has invalid len = %d\n",
++			len);
++		return -EINVAL;
++	}
++
++	if (!of_find_property(node, "qcom,cpr-panic-reg-name-list", NULL)) {
++		cpr3_err(ctrl, "property qcom,cpr-panic-reg-name-list not specified\n");
++		return -EINVAL;
++	}
++
++	len = of_property_count_strings(node, "qcom,cpr-panic-reg-name-list");
++	if (reg_count != len) {
++		cpr3_err(ctrl, "qcom,cpr-panic-reg-name-list should have %d strings\n",
++			reg_count);
++		return -EINVAL;
++	}
++
++	panic_regs_info = devm_kzalloc(ctrl->dev, sizeof(*panic_regs_info),
++					GFP_KERNEL);
++	if (!panic_regs_info)
++		return -ENOMEM;
++
++	regs = devm_kcalloc(ctrl->dev, reg_count, sizeof(*regs), GFP_KERNEL);
++	if (!regs)
++		return -ENOMEM;
++
++	for (i = 0; i < reg_count; i++) {
++		rc = of_property_read_string_index(node,
++				"qcom,cpr-panic-reg-name-list", i,
++				&(regs[i].name));
++		if (rc) {
++			cpr3_err(ctrl, "error reading property qcom,cpr-panic-reg-name-list, rc=%d\n",
++				rc);
++			return rc;
++		}
++
++		rc = of_property_read_u32_index(node,
++				"qcom,cpr-panic-reg-addr-list", i,
++				&(regs[i].addr));
++		if (rc) {
++			cpr3_err(ctrl, "error reading property qcom,cpr-panic-reg-addr-list, rc=%d\n",
++				rc);
++			return rc;
++		}
++		regs[i].virt_addr = devm_ioremap(ctrl->dev, regs[i].addr, 0x4);
++		if (!regs[i].virt_addr) {
++			pr_err("Unable to map panic register addr 0x%08x\n",
++				regs[i].addr);
++			return -EINVAL;
++		}
++		regs[i].value = 0xFFFFFFFF;
++	}
++
++	panic_regs_info->reg_count = reg_count;
++	panic_regs_info->regs = regs;
++	ctrl->panic_regs_info = panic_regs_info;
++
++	return rc;
++}
++
++/**
++ * cpr3_parse_common_ctrl_data() - parse common CPR3 controller properties from
++ *		device tree
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_parse_common_ctrl_data(struct cpr3_controller *ctrl)
++{
++	int rc;
++
++	rc = cpr3_parse_ctrl_u32(ctrl, "qcom,cpr-sensor-time",
++			&ctrl->sensor_time, 0, UINT_MAX);
++	if (rc)
++		return rc;
++
++	rc = cpr3_parse_ctrl_u32(ctrl, "qcom,cpr-loop-time",
++			&ctrl->loop_time, 0, UINT_MAX);
++	if (rc)
++		return rc;
++
++	rc = cpr3_parse_ctrl_u32(ctrl, "qcom,cpr-idle-cycles",
++			&ctrl->idle_clocks, CPR3_IDLE_CLOCKS_MIN,
++			CPR3_IDLE_CLOCKS_MAX);
++	if (rc)
++		return rc;
++
++	rc = cpr3_parse_ctrl_u32(ctrl, "qcom,cpr-step-quot-init-min",
++			&ctrl->step_quot_init_min, CPR3_STEP_QUOT_MIN,
++			CPR3_STEP_QUOT_MAX);
++	if (rc)
++		return rc;
++
++	rc = cpr3_parse_ctrl_u32(ctrl, "qcom,cpr-step-quot-init-max",
++			&ctrl->step_quot_init_max, CPR3_STEP_QUOT_MIN,
++			CPR3_STEP_QUOT_MAX);
++	if (rc)
++		return rc;
++
++	rc = of_property_read_u32(ctrl->dev->of_node, "qcom,voltage-step",
++				&ctrl->step_volt);
++	if (rc) {
++		cpr3_err(ctrl, "error reading property qcom,voltage-step, rc=%d\n",
++			rc);
++		return rc;
++	}
++	if (ctrl->step_volt <= 0) {
++		cpr3_err(ctrl, "qcom,voltage-step=%d is invalid\n",
++			ctrl->step_volt);
++		return -EINVAL;
++	}
++
++	rc = cpr3_parse_ctrl_u32(ctrl, "qcom,cpr-count-mode",
++			&ctrl->count_mode, CPR3_COUNT_MODE_ALL_AT_ONCE_MIN,
++			CPR3_COUNT_MODE_STAGGERED);
++	if (rc)
++		return rc;
++
++	/* Count repeat is optional */
++	ctrl->count_repeat = 0;
++	of_property_read_u32(ctrl->dev->of_node, "qcom,cpr-count-repeat",
++			&ctrl->count_repeat);
++
++	ctrl->cpr_allowed_sw =
++		of_property_read_bool(ctrl->dev->of_node, "qcom,cpr-enable") ||
++		ctrl->cpr_global_setting == CPR_CLOSED_LOOP_EN;
++
++	rc = cpr3_parse_irq_affinity(ctrl);
++	if (rc)
++		return rc;
++
++	/* Aging reference voltage is optional */
++	ctrl->aging_ref_volt = 0;
++	of_property_read_u32(ctrl->dev->of_node, "qcom,cpr-aging-ref-voltage",
++			&ctrl->aging_ref_volt);
++
++	/* Aging possible bitmask is optional */
++	ctrl->aging_possible_mask = 0;
++	of_property_read_u32(ctrl->dev->of_node,
++			"qcom,cpr-aging-allowed-reg-mask",
++			&ctrl->aging_possible_mask);
++
++	if (ctrl->aging_possible_mask) {
++		/*
++		 * Aging possible register value required if bitmask is
++		 * specified
++		 */
++		rc = cpr3_parse_ctrl_u32(ctrl,
++				"qcom,cpr-aging-allowed-reg-value",
++				&ctrl->aging_possible_val, 0, UINT_MAX);
++		if (rc)
++			return rc;
++	}
++
++	if (of_find_property(ctrl->dev->of_node, "clock-names", NULL)) {
++		ctrl->core_clk = devm_clk_get(ctrl->dev, "core_clk");
++		if (IS_ERR(ctrl->core_clk)) {
++			rc = PTR_ERR(ctrl->core_clk);
++			if (rc != -EPROBE_DEFER)
++				cpr3_err(ctrl, "unable request core clock, rc=%d\n",
++				rc);
++			return rc;
++		}
++	}
++
++	rc = cpr3_panic_notifier_init(ctrl);
++	if (rc)
++		return rc;
++
++	if (of_find_property(ctrl->dev->of_node, "vdd-supply", NULL)) {
++		ctrl->vdd_regulator = devm_regulator_get(ctrl->dev, "vdd");
++		if (IS_ERR(ctrl->vdd_regulator)) {
++			rc = PTR_ERR(ctrl->vdd_regulator);
++			if (rc != -EPROBE_DEFER)
++				cpr3_err(ctrl, "unable to request vdd regulator, rc=%d\n",
++					 rc);
++			return rc;
++		}
++	} else {
++		cpr3_err(ctrl, "vdd supply is not defined\n");
++		return -ENODEV;
++	}
++
++	ctrl->system_regulator = devm_regulator_get_optional(ctrl->dev,
++								"system");
++	if (IS_ERR(ctrl->system_regulator)) {
++		rc = PTR_ERR(ctrl->system_regulator);
++		if (rc != -EPROBE_DEFER) {
++			rc = 0;
++			ctrl->system_regulator = NULL;
++		} else {
++			return rc;
++		}
++	}
++
++	ctrl->mem_acc_regulator = devm_regulator_get_optional(ctrl->dev,
++							      "mem-acc");
++	if (IS_ERR(ctrl->mem_acc_regulator)) {
++		rc = PTR_ERR(ctrl->mem_acc_regulator);
++		if (rc != -EPROBE_DEFER) {
++			rc = 0;
++			ctrl->mem_acc_regulator = NULL;
++		} else {
++			return rc;
++		}
++	}
++
++	return rc;
++}
++
++/**
++ * cpr3_parse_open_loop_common_ctrl_data() - parse common open loop CPR3
++ *			controller properties from device tree
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_parse_open_loop_common_ctrl_data(struct cpr3_controller *ctrl)
++{
++	int rc;
++
++	rc = of_property_read_u32(ctrl->dev->of_node, "qcom,voltage-step",
++				  &ctrl->step_volt);
++	if (rc) {
++		cpr3_err(ctrl, "error reading property qcom,voltage-step, rc=%d\n",
++			 rc);
++		return rc;
++	}
++
++	if (ctrl->step_volt <= 0) {
++		cpr3_err(ctrl, "qcom,voltage-step=%d is invalid\n",
++			 ctrl->step_volt);
++		return -EINVAL;
++	}
++
++	if (of_find_property(ctrl->dev->of_node, "vdd-supply", NULL)) {
++		ctrl->vdd_regulator = devm_regulator_get(ctrl->dev, "vdd");
++		if (IS_ERR(ctrl->vdd_regulator)) {
++			rc = PTR_ERR(ctrl->vdd_regulator);
++			if (rc != -EPROBE_DEFER)
++				cpr3_err(ctrl, "unable to request vdd regulator, rc=%d\n",
++					 rc);
++			return rc;
++		}
++	} else {
++		cpr3_err(ctrl, "vdd supply is not defined\n");
++		return -ENODEV;
++	}
++
++	ctrl->system_regulator = devm_regulator_get_optional(ctrl->dev,
++								"system");
++	if (IS_ERR(ctrl->system_regulator)) {
++		rc = PTR_ERR(ctrl->system_regulator);
++		if (rc != -EPROBE_DEFER) {
++			rc = 0;
++			ctrl->system_regulator = NULL;
++		} else {
++			return rc;
++		}
++	} else {
++		rc = regulator_enable(ctrl->system_regulator);
++	}
++
++	ctrl->mem_acc_regulator = devm_regulator_get_optional(ctrl->dev,
++							      "mem-acc");
++	if (IS_ERR(ctrl->mem_acc_regulator)) {
++		rc = PTR_ERR(ctrl->mem_acc_regulator);
++		if (rc != -EPROBE_DEFER) {
++			rc = 0;
++			ctrl->mem_acc_regulator = NULL;
++		} else {
++			return rc;
++		}
++	}
++
++	return rc;
++}
++
++/**
++ * cpr3_limit_open_loop_voltages() - modify the open-loop voltage of each corner
++ *				so that it fits within the floor to ceiling
++ *				voltage range of the corner
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * This function clips the open-loop voltage for each corner so that it is
++ * limited to the floor to ceiling range.  It also rounds each open-loop voltage
++ * so that it corresponds to a set point available to the underlying regulator.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_limit_open_loop_voltages(struct cpr3_regulator *vreg)
++{
++	int i, volt;
++
++	cpr3_debug(vreg, "open-loop voltages after trimming and rounding:\n");
++	for (i = 0; i < vreg->corner_count; i++) {
++		volt = CPR3_ROUND(vreg->corner[i].open_loop_volt,
++					vreg->thread->ctrl->step_volt);
++		if (volt < vreg->corner[i].floor_volt)
++			volt = vreg->corner[i].floor_volt;
++		else if (volt > vreg->corner[i].ceiling_volt)
++			volt = vreg->corner[i].ceiling_volt;
++		vreg->corner[i].open_loop_volt = volt;
++		cpr3_debug(vreg, "corner[%2d]: open-loop=%d uV\n", i, volt);
++	}
++
++	return 0;
++}
++
++/**
++ * cpr3_open_loop_voltage_as_ceiling() - configures the ceiling voltage for each
++ *		corner to equal the open-loop voltage if the relevant device
++ *		tree property is found for the CPR3 regulator
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * This function assumes that the the open-loop voltage for each corner has
++ * already been rounded to the nearest allowed set point and that it falls
++ * within the floor to ceiling range.
++ *
++ * Return: none
++ */
++void cpr3_open_loop_voltage_as_ceiling(struct cpr3_regulator *vreg)
++{
++	int i;
++
++	if (!of_property_read_bool(vreg->of_node,
++				"qcom,cpr-scaled-open-loop-voltage-as-ceiling"))
++		return;
++
++	for (i = 0; i < vreg->corner_count; i++)
++		vreg->corner[i].ceiling_volt
++			= vreg->corner[i].open_loop_volt;
++}
++
++/**
++ * cpr3_limit_floor_voltages() - raise the floor voltage of each corner so that
++ *		the optional maximum floor to ceiling voltage range specified in
++ *		device tree is satisfied
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * This function also ensures that the open-loop voltage for each corner falls
++ * within the final floor to ceiling voltage range and that floor voltages
++ * increase monotonically.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_limit_floor_voltages(struct cpr3_regulator *vreg)
++{
++	char *prop = "qcom,cpr-floor-to-ceiling-max-range";
++	int i, floor_new;
++	u32 *floor_range;
++	int rc = 0;
++
++	if (!of_find_property(vreg->of_node, prop, NULL))
++		goto enforce_monotonicity;
++
++	floor_range = kcalloc(vreg->corner_count, sizeof(*floor_range),
++				GFP_KERNEL);
++	if (!floor_range)
++		return -ENOMEM;
++
++	rc = cpr3_parse_corner_array_property(vreg, prop, 1, floor_range);
++	if (rc)
++		goto free_floor_adjust;
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		if ((s32)floor_range[i] >= 0) {
++			floor_new = CPR3_ROUND(vreg->corner[i].ceiling_volt
++							- floor_range[i],
++						vreg->thread->ctrl->step_volt);
++
++			vreg->corner[i].floor_volt = max(floor_new,
++						vreg->corner[i].floor_volt);
++			if (vreg->corner[i].open_loop_volt
++			    < vreg->corner[i].floor_volt)
++				vreg->corner[i].open_loop_volt
++					= vreg->corner[i].floor_volt;
++		}
++	}
++
++free_floor_adjust:
++	kfree(floor_range);
++
++enforce_monotonicity:
++	/* Ensure that floor voltages increase monotonically. */
++	for (i = 1; i < vreg->corner_count; i++) {
++		if (vreg->corner[i].floor_volt
++		    < vreg->corner[i - 1].floor_volt) {
++			cpr3_debug(vreg, "corner %d floor voltage=%d uV < corner %d voltage=%d uV; overriding: corner %d voltage=%d\n",
++				i, vreg->corner[i].floor_volt,
++				i - 1, vreg->corner[i - 1].floor_volt,
++				i, vreg->corner[i - 1].floor_volt);
++			vreg->corner[i].floor_volt
++				= vreg->corner[i - 1].floor_volt;
++
++			if (vreg->corner[i].open_loop_volt
++			    < vreg->corner[i].floor_volt)
++				vreg->corner[i].open_loop_volt
++					= vreg->corner[i].floor_volt;
++			if (vreg->corner[i].ceiling_volt
++			    < vreg->corner[i].floor_volt)
++				vreg->corner[i].ceiling_volt
++					= vreg->corner[i].floor_volt;
++		}
++	}
++
++	return rc;
++}
++
++/**
++ * cpr3_print_quots() - print CPR target quotients into the kernel log for
++ *		debugging purposes
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * Return: none
++ */
++void cpr3_print_quots(struct cpr3_regulator *vreg)
++{
++	int i, j, pos;
++	size_t buflen;
++	char *buf;
++
++	buflen = sizeof(*buf) * CPR3_RO_COUNT * (MAX_CHARS_PER_INT + 2);
++	buf = kzalloc(buflen, GFP_KERNEL);
++	if (!buf)
++		return;
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		for (j = 0, pos = 0; j < CPR3_RO_COUNT; j++)
++			pos += scnprintf(buf + pos, buflen - pos, " %u",
++				vreg->corner[i].target_quot[j]);
++		cpr3_debug(vreg, "target quots[%2d]:%s\n", i, buf);
++	}
++
++	kfree(buf);
++}
++
++/**
++ * cpr3_determine_part_type() - determine the part type (SS/TT/FF).
++ *
++ * qcom,cpr-part-types prop tells the number of part types for which correction
++ * voltages are different. Another prop qcom,cpr-parts-voltage will contain the
++ * open loop fuse voltage which will be compared with this part voltage
++ * and accordingly part type will de determined.
++ *
++ * if qcom,cpr-part-types has value n, then qcom,cpr-parts-voltage will be
++ * array of n - 1 elements which will contain the voltage in increasing order.
++ * This function compares the fused volatge with all these voltage and returns
++ * the first index for which the fused volatge is greater.
++ *
++ * @vreg:		Pointer to the CPR3 regulator
++ * @fuse_volt:		fused open loop voltage which will be compared with
++ *                      qcom,cpr-parts-voltage array
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_determine_part_type(struct cpr3_regulator *vreg, int fuse_volt)
++{
++	int i, rc, len;
++	u32 volt;
++	int soc_version_major;
++	char prop_name[100];
++	const char prop_name_def[] = "qcom,cpr-parts-voltage";
++	const char prop_name_v2[] = "qcom,cpr-parts-voltage-v2";
++
++	soc_version_major = read_ipq_soc_version_major();
++        BUG_ON(soc_version_major <= 0);
++
++	if (of_property_read_u32(vreg->of_node, "qcom,cpr-part-types",
++				  &vreg->part_type_supported))
++		return 0;
++
++	if (soc_version_major > 1)
++		strscpy(prop_name, prop_name_v2, sizeof(prop_name));
++	else
++		strscpy(prop_name, prop_name_def, sizeof(prop_name));
++
++	if (!of_find_property(vreg->of_node, prop_name, &len)) {
++		cpr3_err(vreg, "property %s is missing\n", prop_name);
++		return -EINVAL;
++	}
++
++	if (len != (vreg->part_type_supported - 1) * sizeof(u32)) {
++		cpr3_err(vreg, "wrong len in qcom,cpr-parts-voltage\n");
++		return -EINVAL;
++	}
++
++	for (i = 0; i < vreg->part_type_supported - 1; i++) {
++		rc = of_property_read_u32_index(vreg->of_node,
++					prop_name, i, &volt);
++		if (rc) {
++			cpr3_err(vreg, "error reading property %s, rc=%d\n",
++				 prop_name, rc);
++			return rc;
++		}
++
++		if (fuse_volt < volt)
++			break;
++	}
++
++	vreg->part_type = i;
++	return 0;
++}
++
++int cpr3_determine_temp_base_open_loop_correction(struct cpr3_regulator *vreg,
++		int *fuse_volt)
++{
++	int i, rc, prev_volt;
++	int *volt_adjust;
++	char prop_str[75];
++	int soc_version_major = read_ipq_soc_version_major();
++
++	BUG_ON(soc_version_major <= 0);
++
++	if (vreg->part_type_supported) {
++		if (soc_version_major > 1)
++			snprintf(prop_str, sizeof(prop_str),
++			"qcom,cpr-cold-temp-voltage-adjustment-v2-%d",
++			vreg->part_type);
++		else
++			snprintf(prop_str, sizeof(prop_str),
++			"qcom,cpr-cold-temp-voltage-adjustment-%d",
++			vreg->part_type);
++	} else {
++		strscpy(prop_str, "qcom,cpr-cold-temp-voltage-adjustment",
++			sizeof(prop_str));
++	}
++
++	if (!of_find_property(vreg->of_node, prop_str, NULL)) {
++		/* No adjustment required. */
++		cpr3_info(vreg, "No cold temperature adjustment required.\n");
++		return 0;
++	}
++
++	volt_adjust = kcalloc(vreg->fuse_corner_count, sizeof(*volt_adjust),
++	GFP_KERNEL);
++	if (!volt_adjust)
++		return -ENOMEM;
++
++	rc = cpr3_parse_array_property(vreg, prop_str,
++			vreg->fuse_corner_count, volt_adjust);
++	if (rc) {
++		cpr3_err(vreg, "could not load cold temp voltage adjustments, rc=%d\n",
++			rc);
++		goto done;
++	}
++
++	for (i = 0; i < vreg->fuse_corner_count; i++) {
++		if (volt_adjust[i]) {
++			prev_volt = fuse_volt[i];
++			fuse_volt[i] += volt_adjust[i];
++			cpr3_debug(vreg,
++				"adjusted fuse corner %d open-loop voltage: %d -> %d uV\n",
++				i, prev_volt, fuse_volt[i]);
++		}
++	}
++
++done:
++	kfree(volt_adjust);
++	return rc;
++}
++
++/**
++ * cpr3_can_adjust_cold_temp() - Is cold temperature adjustment available
++ *
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * This function checks the cold temperature threshold is available
++ *
++ * Return: true on cold temperature threshold is available, else false
++ */
++bool cpr3_can_adjust_cold_temp(struct cpr3_regulator *vreg)
++{
++	char prop_str[75];
++	int soc_version_major = read_ipq_soc_version_major();
++
++	BUG_ON(soc_version_major <= 0);
++
++	if (soc_version_major > 1)
++		strscpy(prop_str, "qcom,cpr-cold-temp-threshold-v2",
++			sizeof(prop_str));
++	else
++		strscpy(prop_str, "qcom,cpr-cold-temp-threshold",
++			sizeof(prop_str));
++
++	if (!of_find_property(vreg->of_node, prop_str, NULL)) {
++		/* No adjustment required. */
++		return false;
++	} else
++		return true;
++}
++
++/**
++ * cpr3_get_cold_temp_threshold() - get cold temperature threshold
++ *
++ * @vreg:		Pointer to the CPR3 regulator
++ * @cold_temp:		cold temperature read.
++ *
++ * This function reads the cold temperature threshold below which
++ * cold temperature adjustment margins will be applied.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_get_cold_temp_threshold(struct cpr3_regulator *vreg, int *cold_temp)
++{
++	int rc;
++	u32 temp;
++	char req_prop_str[75], prop_str[75];
++	int soc_version_major = read_ipq_soc_version_major();
++
++	BUG_ON(soc_version_major <= 0);
++
++	if (vreg->part_type_supported) {
++		if (soc_version_major > 1)
++			snprintf(req_prop_str, sizeof(req_prop_str),
++			"qcom,cpr-cold-temp-voltage-adjustment-v2-%d",
++			vreg->part_type);
++		else
++			snprintf(req_prop_str, sizeof(req_prop_str),
++			"qcom,cpr-cold-temp-voltage-adjustment-%d",
++			vreg->part_type);
++	} else {
++		strscpy(req_prop_str, "qcom,cpr-cold-temp-voltage-adjustment",
++			sizeof(req_prop_str));
++	}
++
++	if (soc_version_major > 1)
++		strscpy(prop_str, "qcom,cpr-cold-temp-threshold-v2",
++			sizeof(prop_str));
++	else
++		strscpy(prop_str, "qcom,cpr-cold-temp-threshold",
++			sizeof(prop_str));
++
++	if (!of_find_property(vreg->of_node, req_prop_str, NULL)) {
++		/* No adjustment required. */
++		cpr3_info(vreg, "Cold temperature adjustment not required.\n");
++		return 0;
++	}
++
++	if (!of_find_property(vreg->of_node, prop_str, NULL)) {
++		/* No adjustment required. */
++                cpr3_err(vreg, "Missing %s required for %s\n",
++			prop_str, req_prop_str);
++		return -EINVAL;
++        }
++
++	rc = of_property_read_u32(vreg->of_node, prop_str, &temp);
++	if (rc) {
++		cpr3_err(vreg, "error reading property %s, rc=%d\n",
++			prop_str, rc);
++		return rc;
++	}
++
++	*cold_temp = temp;
++	return 0;
++}
++
++/**
++ * cpr3_adjust_fused_open_loop_voltages() - adjust the fused open-loop voltages
++ *		for each fuse corner according to device tree values
++ * @vreg:		Pointer to the CPR3 regulator
++ * @fuse_volt:		Pointer to an array of the fused open-loop voltage
++ *			values
++ *
++ * Voltage values in fuse_volt are modified in place.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_adjust_fused_open_loop_voltages(struct cpr3_regulator *vreg,
++		int *fuse_volt)
++{
++	int i, rc, prev_volt;
++	int *volt_adjust;
++	char prop_str[75];
++	int soc_version_major = read_ipq_soc_version_major();
++
++	BUG_ON(soc_version_major <= 0);
++
++	if (vreg->part_type_supported) {
++		if (soc_version_major > 1)
++			snprintf(prop_str, sizeof(prop_str),
++			"qcom,cpr-open-loop-voltage-fuse-adjustment-v2-%d",
++			vreg->part_type);
++		else
++		snprintf(prop_str, sizeof(prop_str),
++			 "qcom,cpr-open-loop-voltage-fuse-adjustment-%d",
++			 vreg->part_type);
++	} else {
++		strscpy(prop_str, "qcom,cpr-open-loop-voltage-fuse-adjustment",
++			sizeof(prop_str));
++	}
++
++	if (!of_find_property(vreg->of_node, prop_str, NULL)) {
++		/* No adjustment required. */
++		return 0;
++	}
++
++	volt_adjust = kcalloc(vreg->fuse_corner_count, sizeof(*volt_adjust),
++				GFP_KERNEL);
++	if (!volt_adjust)
++		return -ENOMEM;
++
++	rc = cpr3_parse_array_property(vreg,
++		prop_str, vreg->fuse_corner_count, volt_adjust);
++	if (rc) {
++		cpr3_err(vreg, "could not load open-loop fused voltage adjustments, rc=%d\n",
++			rc);
++		goto done;
++	}
++
++	for (i = 0; i < vreg->fuse_corner_count; i++) {
++		if (volt_adjust[i]) {
++			prev_volt = fuse_volt[i];
++			fuse_volt[i] += volt_adjust[i];
++			cpr3_debug(vreg, "adjusted fuse corner %d open-loop voltage: %d --> %d uV\n",
++				i, prev_volt, fuse_volt[i]);
++		}
++	}
++
++done:
++	kfree(volt_adjust);
++	return rc;
++}
++
++/**
++ * cpr3_adjust_open_loop_voltages() - adjust the open-loop voltages for each
++ *		corner according to device tree values
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_adjust_open_loop_voltages(struct cpr3_regulator *vreg)
++{
++	int i, rc, prev_volt, min_volt;
++	int *volt_adjust, *volt_diff;
++
++	if (!of_find_property(vreg->of_node,
++			"qcom,cpr-open-loop-voltage-adjustment", NULL)) {
++		/* No adjustment required. */
++		return 0;
++	}
++
++	volt_adjust = kcalloc(vreg->corner_count, sizeof(*volt_adjust),
++				GFP_KERNEL);
++	volt_diff = kcalloc(vreg->corner_count, sizeof(*volt_diff), GFP_KERNEL);
++	if (!volt_adjust || !volt_diff) {
++		rc = -ENOMEM;
++		goto done;
++	}
++
++	rc = cpr3_parse_corner_array_property(vreg,
++		"qcom,cpr-open-loop-voltage-adjustment", 1, volt_adjust);
++	if (rc) {
++		cpr3_err(vreg, "could not load open-loop voltage adjustments, rc=%d\n",
++			rc);
++		goto done;
++	}
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		if (volt_adjust[i]) {
++			prev_volt = vreg->corner[i].open_loop_volt;
++			vreg->corner[i].open_loop_volt += volt_adjust[i];
++			cpr3_debug(vreg, "adjusted corner %d open-loop voltage: %d --> %d uV\n",
++				i, prev_volt, vreg->corner[i].open_loop_volt);
++		}
++	}
++
++	if (of_find_property(vreg->of_node,
++			"qcom,cpr-open-loop-voltage-min-diff", NULL)) {
++		rc = cpr3_parse_corner_array_property(vreg,
++			"qcom,cpr-open-loop-voltage-min-diff", 1, volt_diff);
++		if (rc) {
++			cpr3_err(vreg, "could not load minimum open-loop voltage differences, rc=%d\n",
++				rc);
++			goto done;
++		}
++	}
++
++	/*
++	 * Ensure that open-loop voltages increase monotonically with respect
++	 * to configurable minimum allowed differences.
++	 */
++	for (i = 1; i < vreg->corner_count; i++) {
++		min_volt = vreg->corner[i - 1].open_loop_volt + volt_diff[i];
++		if (vreg->corner[i].open_loop_volt < min_volt) {
++			cpr3_debug(vreg, "adjusted corner %d open-loop voltage=%d uV < corner %d voltage=%d uV + min diff=%d uV; overriding: corner %d voltage=%d\n",
++				i, vreg->corner[i].open_loop_volt,
++				i - 1, vreg->corner[i - 1].open_loop_volt,
++				volt_diff[i], i, min_volt);
++			vreg->corner[i].open_loop_volt = min_volt;
++		}
++	}
++
++done:
++	kfree(volt_diff);
++	kfree(volt_adjust);
++	return rc;
++}
++
++/**
++ * cpr3_quot_adjustment() - returns the quotient adjustment value resulting from
++ *		the specified voltage adjustment and RO scaling factor
++ * @ro_scale:		The CPR ring oscillator (RO) scaling factor with units
++ *			of QUOT/V
++ * @volt_adjust:	The amount to adjust the voltage by in units of
++ *			microvolts.  This value may be positive or negative.
++ */
++int cpr3_quot_adjustment(int ro_scale, int volt_adjust)
++{
++	unsigned long long temp;
++	int quot_adjust;
++	int sign = 1;
++
++	if (ro_scale < 0) {
++		sign = -sign;
++		ro_scale = -ro_scale;
++	}
++
++	if (volt_adjust < 0) {
++		sign = -sign;
++		volt_adjust = -volt_adjust;
++	}
++
++	temp = (unsigned long long)ro_scale * (unsigned long long)volt_adjust;
++	do_div(temp, 1000000);
++
++	quot_adjust = temp;
++	quot_adjust *= sign;
++
++	return quot_adjust;
++}
++
++/**
++ * cpr3_voltage_adjustment() - returns the voltage adjustment value resulting
++ *		from the specified quotient adjustment and RO scaling factor
++ * @ro_scale:		The CPR ring oscillator (RO) scaling factor with units
++ *			of QUOT/V
++ * @quot_adjust:	The amount to adjust the quotient by in units of
++ *			QUOT.  This value may be positive or negative.
++ */
++int cpr3_voltage_adjustment(int ro_scale, int quot_adjust)
++{
++	unsigned long long temp;
++	int volt_adjust;
++	int sign = 1;
++
++	if (ro_scale < 0) {
++		sign = -sign;
++		ro_scale = -ro_scale;
++	}
++
++	if (quot_adjust < 0) {
++		sign = -sign;
++		quot_adjust = -quot_adjust;
++	}
++
++	if (ro_scale == 0)
++		return 0;
++
++	temp = (unsigned long long)quot_adjust * 1000000;
++	do_div(temp, ro_scale);
++
++	volt_adjust = temp;
++	volt_adjust *= sign;
++
++	return volt_adjust;
++}
++
++/**
++ * cpr3_parse_closed_loop_voltage_adjustments() - load per-fuse-corner and
++ *		per-corner closed-loop adjustment values from device tree
++ * @vreg:		Pointer to the CPR3 regulator
++ * @ro_sel:		Array of ring oscillator values selected for each
++ *			fuse corner
++ * @volt_adjust:	Pointer to array which will be filled with the
++ *			per-corner closed-loop adjustment voltages
++ * @volt_adjust_fuse:	Pointer to array which will be filled with the
++ *			per-fuse-corner closed-loop adjustment voltages
++ * @ro_scale:		Pointer to array which will be filled with the
++ *			per-fuse-corner RO scaling factor values with units of
++ *			QUOT/V
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_parse_closed_loop_voltage_adjustments(
++			struct cpr3_regulator *vreg, u64 *ro_sel,
++			int *volt_adjust, int *volt_adjust_fuse, int *ro_scale)
++{
++	int i, rc;
++	u32 *ro_all_scale;
++
++	char volt_adj[] = "qcom,cpr-closed-loop-voltage-adjustment";
++	char volt_fuse_adj[] = "qcom,cpr-closed-loop-voltage-fuse-adjustment";
++	char ro_scaling[] = "qcom,cpr-ro-scaling-factor";
++
++	if (!of_find_property(vreg->of_node, volt_adj, NULL)
++	    && !of_find_property(vreg->of_node, volt_fuse_adj, NULL)
++	    && !vreg->aging_allowed) {
++		/* No adjustment required. */
++		return 0;
++	} else if (!of_find_property(vreg->of_node, ro_scaling, NULL)) {
++		cpr3_err(vreg, "Missing %s required for closed-loop voltage adjustment.\n",
++				ro_scaling);
++		return -EINVAL;
++	}
++
++	ro_all_scale = kcalloc(vreg->fuse_corner_count * CPR3_RO_COUNT,
++				sizeof(*ro_all_scale), GFP_KERNEL);
++	if (!ro_all_scale)
++		return -ENOMEM;
++
++	rc = cpr3_parse_array_property(vreg, ro_scaling,
++		vreg->fuse_corner_count * CPR3_RO_COUNT, ro_all_scale);
++	if (rc) {
++		cpr3_err(vreg, "could not load RO scaling factors, rc=%d\n",
++			rc);
++		goto done;
++	}
++
++	for (i = 0; i < vreg->fuse_corner_count; i++)
++		ro_scale[i] = ro_all_scale[i * CPR3_RO_COUNT + ro_sel[i]];
++
++	for (i = 0; i < vreg->corner_count; i++)
++		memcpy(vreg->corner[i].ro_scale,
++		 &ro_all_scale[vreg->corner[i].cpr_fuse_corner * CPR3_RO_COUNT],
++		 sizeof(*ro_all_scale) * CPR3_RO_COUNT);
++
++	if (of_find_property(vreg->of_node, volt_fuse_adj, NULL)) {
++		rc = cpr3_parse_array_property(vreg, volt_fuse_adj,
++			vreg->fuse_corner_count, volt_adjust_fuse);
++		if (rc) {
++			cpr3_err(vreg, "could not load closed-loop fused voltage adjustments, rc=%d\n",
++				rc);
++			goto done;
++		}
++	}
++
++	if (of_find_property(vreg->of_node, volt_adj, NULL)) {
++		rc = cpr3_parse_corner_array_property(vreg, volt_adj,
++			1, volt_adjust);
++		if (rc) {
++			cpr3_err(vreg, "could not load closed-loop voltage adjustments, rc=%d\n",
++				rc);
++			goto done;
++		}
++	}
++
++done:
++	kfree(ro_all_scale);
++	return rc;
++}
++
++/**
++ * cpr3_apm_init() - initialize APM data for a CPR3 controller
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * This function loads memory array power mux (APM) data from device tree
++ * if it is present and requests a handle to the appropriate APM controller
++ * device.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_apm_init(struct cpr3_controller *ctrl)
++{
++	struct device_node *node = ctrl->dev->of_node;
++	int rc;
++
++	if (!of_find_property(node, "qcom,apm-ctrl", NULL)) {
++		/* No APM used */
++		return 0;
++	}
++
++	ctrl->apm = msm_apm_ctrl_dev_get(ctrl->dev);
++	if (IS_ERR(ctrl->apm)) {
++		rc = PTR_ERR(ctrl->apm);
++		if (rc != -EPROBE_DEFER)
++			cpr3_err(ctrl, "APM get failed, rc=%d\n", rc);
++		return rc;
++	}
++
++	rc = of_property_read_u32(node, "qcom,apm-threshold-voltage",
++				&ctrl->apm_threshold_volt);
++	if (rc) {
++		cpr3_err(ctrl, "error reading qcom,apm-threshold-voltage, rc=%d\n",
++			rc);
++		return rc;
++	}
++	ctrl->apm_threshold_volt
++		= CPR3_ROUND(ctrl->apm_threshold_volt, ctrl->step_volt);
++
++	/* No error check since this is an optional property. */
++	of_property_read_u32(node, "qcom,apm-hysteresis-voltage",
++				&ctrl->apm_adj_volt);
++	ctrl->apm_adj_volt = CPR3_ROUND(ctrl->apm_adj_volt, ctrl->step_volt);
++
++	ctrl->apm_high_supply = MSM_APM_SUPPLY_APCC;
++	ctrl->apm_low_supply = MSM_APM_SUPPLY_MX;
++
++	return 0;
++}
++
++/**
++ * cpr3_mem_acc_init() - initialize mem-acc regulator data for
++ *		a CPR3 regulator
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_mem_acc_init(struct cpr3_regulator *vreg)
++{
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	u32 *temp;
++	int i, rc;
++
++	if (!ctrl->mem_acc_regulator) {
++		cpr3_info(ctrl, "not using memory accelerator regulator\n");
++		return 0;
++	}
++
++	temp = kcalloc(vreg->corner_count, sizeof(*temp), GFP_KERNEL);
++	if (!temp)
++		return -ENOMEM;
++
++	rc = cpr3_parse_corner_array_property(vreg, "qcom,mem-acc-voltage",
++					      1, temp);
++	if (rc) {
++		cpr3_err(ctrl, "could not load mem-acc corners, rc=%d\n", rc);
++	} else {
++		for (i = 0; i < vreg->corner_count; i++)
++			vreg->corner[i].mem_acc_volt = temp[i];
++	}
++
++	kfree(temp);
++	return rc;
++}
++
++/**
++ * cpr4_load_core_and_temp_adj() - parse amount of voltage adjustment for
++ *		per-online-core and per-temperature voltage adjustment for a
++ *		given corner or corner band from device tree.
++ * @vreg:	Pointer to the CPR3 regulator
++ * @num:	Corner number or corner band number
++ * @use_corner_band:	Boolean indicating if the CPR3 regulator supports
++ *			adjustments per corner band
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_load_core_and_temp_adj(struct cpr3_regulator *vreg,
++					int num, bool use_corner_band)
++{
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	struct cpr4_sdelta *sdelta;
++	int sdelta_size, i, j, pos, rc = 0;
++	char str[75];
++	size_t buflen;
++	char *buf;
++
++	sdelta = use_corner_band ? vreg->corner_band[num].sdelta :
++		vreg->corner[num].sdelta;
++
++	if (!sdelta->allow_core_count_adj && !sdelta->allow_temp_adj) {
++		/* corner doesn't need sdelta table */
++		sdelta->max_core_count = 0;
++		sdelta->temp_band_count = 0;
++		return rc;
++	}
++
++	sdelta_size = sdelta->max_core_count * sdelta->temp_band_count;
++	if (use_corner_band)
++		snprintf(str, sizeof(str),
++			 "corner_band=%d core_config_count=%d temp_band_count=%d sdelta_size=%d\n",
++			 num, sdelta->max_core_count,
++			 sdelta->temp_band_count, sdelta_size);
++	else
++		snprintf(str, sizeof(str),
++			 "corner=%d core_config_count=%d temp_band_count=%d sdelta_size=%d\n",
++			 num, sdelta->max_core_count,
++			 sdelta->temp_band_count, sdelta_size);
++
++	cpr3_debug(vreg, "%s", str);
++
++	sdelta->table = devm_kcalloc(ctrl->dev, sdelta_size,
++				sizeof(*sdelta->table), GFP_KERNEL);
++	if (!sdelta->table)
++		return -ENOMEM;
++
++	if (use_corner_band)
++		snprintf(str, sizeof(str),
++			 "qcom,cpr-corner-band%d-temp-core-voltage-adjustment",
++			 num + CPR3_CORNER_OFFSET);
++	else
++		snprintf(str, sizeof(str),
++			 "qcom,cpr-corner%d-temp-core-voltage-adjustment",
++			 num + CPR3_CORNER_OFFSET);
++
++	rc = cpr3_parse_array_property(vreg, str, sdelta_size,
++				sdelta->table);
++	if (rc) {
++		cpr3_err(vreg, "could not load %s, rc=%d\n", str, rc);
++		return rc;
++	}
++
++	/*
++	 * Convert sdelta margins from uV to PMIC steps and apply negation to
++	 * follow the SDELTA register semantics.
++	 */
++	for (i = 0; i < sdelta_size; i++)
++		sdelta->table[i] = -(sdelta->table[i] / ctrl->step_volt);
++
++	buflen = sizeof(*buf) * sdelta_size * (MAX_CHARS_PER_INT + 2);
++	buf = kzalloc(buflen, GFP_KERNEL);
++	if (!buf)
++		return rc;
++
++	for (i = 0; i < sdelta->max_core_count; i++) {
++		for (j = 0, pos = 0; j < sdelta->temp_band_count; j++)
++			pos += scnprintf(buf + pos, buflen - pos, " %u",
++			 sdelta->table[i * sdelta->temp_band_count + j]);
++		cpr3_debug(vreg, "sdelta[%d]:%s\n", i, buf);
++	}
++
++	kfree(buf);
++	return rc;
++}
++
++/**
++ * cpr4_parse_core_count_temp_voltage_adj() - parse configuration data for
++ *		per-online-core and per-temperature voltage adjustment for
++ *		a CPR3 regulator from device tree.
++ * @vreg:	Pointer to the CPR3 regulator
++ * @use_corner_band:	Boolean indicating if the CPR3 regulator supports
++ *			adjustments per corner band
++ *
++ * This function supports parsing of per-online-core and per-temperature
++ * adjustments per corner or per corner band. CPR controllers which support
++ * corner bands apply the same adjustments to all corners within a corner band.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr4_parse_core_count_temp_voltage_adj(
++			struct cpr3_regulator *vreg, bool use_corner_band)
++{
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	struct device_node *node = vreg->of_node;
++	struct cpr3_corner *corner;
++	struct cpr4_sdelta *sdelta;
++	int i, sdelta_table_count, rc = 0;
++	int *allow_core_count_adj = NULL, *allow_temp_adj = NULL;
++	char prop_str[75];
++
++	if (of_find_property(node, use_corner_band ?
++			     "qcom,corner-band-allow-temp-adjustment"
++			     : "qcom,corner-allow-temp-adjustment", NULL)) {
++		if (!ctrl->allow_temp_adj) {
++			cpr3_err(ctrl, "Temperature adjustment configurations missing\n");
++			return -EINVAL;
++		}
++
++		vreg->allow_temp_adj = true;
++	}
++
++	if (of_find_property(node, use_corner_band ?
++			     "qcom,corner-band-allow-core-count-adjustment"
++			     : "qcom,corner-allow-core-count-adjustment",
++			     NULL)) {
++		rc = of_property_read_u32(node, "qcom,max-core-count",
++				&vreg->max_core_count);
++		if (rc) {
++			cpr3_err(vreg, "error reading qcom,max-core-count, rc=%d\n",
++				rc);
++			return -EINVAL;
++		}
++
++		vreg->allow_core_count_adj = true;
++		ctrl->allow_core_count_adj = true;
++	}
++
++	if (!vreg->allow_temp_adj && !vreg->allow_core_count_adj) {
++		/*
++		 * Both per-online-core and temperature based adjustments are
++		 * disabled for this regulator.
++		 */
++		return 0;
++	} else if (!vreg->allow_core_count_adj) {
++		/*
++		 * Only per-temperature voltage adjusments are allowed.
++		 * Keep max core count value as 1 to allocate SDELTA.
++		 */
++		vreg->max_core_count = 1;
++	}
++
++	if (vreg->allow_core_count_adj) {
++		allow_core_count_adj = kcalloc(vreg->corner_count,
++					sizeof(*allow_core_count_adj),
++					GFP_KERNEL);
++		if (!allow_core_count_adj)
++			return -ENOMEM;
++
++		snprintf(prop_str, sizeof(prop_str), "%s", use_corner_band ?
++			 "qcom,corner-band-allow-core-count-adjustment" :
++			 "qcom,corner-allow-core-count-adjustment");
++
++		rc = use_corner_band ?
++			cpr3_parse_corner_band_array_property(vreg, prop_str,
++					      1, allow_core_count_adj) :
++			cpr3_parse_corner_array_property(vreg, prop_str,
++						 1, allow_core_count_adj);
++		if (rc) {
++			cpr3_err(vreg, "error reading %s, rc=%d\n", prop_str,
++				 rc);
++			goto done;
++		}
++	}
++
++	if (vreg->allow_temp_adj) {
++		allow_temp_adj = kcalloc(vreg->corner_count,
++					sizeof(*allow_temp_adj), GFP_KERNEL);
++		if (!allow_temp_adj) {
++			rc = -ENOMEM;
++			goto done;
++		}
++
++		snprintf(prop_str, sizeof(prop_str), "%s", use_corner_band ?
++			 "qcom,corner-band-allow-temp-adjustment" :
++			 "qcom,corner-allow-temp-adjustment");
++
++		rc = use_corner_band ?
++			cpr3_parse_corner_band_array_property(vreg, prop_str,
++						      1, allow_temp_adj) :
++			cpr3_parse_corner_array_property(vreg, prop_str,
++						 1, allow_temp_adj);
++		if (rc) {
++			cpr3_err(vreg, "error reading %s, rc=%d\n", prop_str,
++				 rc);
++			goto done;
++		}
++	}
++
++	sdelta_table_count = use_corner_band ? vreg->corner_band_count :
++		vreg->corner_count;
++
++	for (i = 0; i < sdelta_table_count; i++) {
++		sdelta = devm_kzalloc(ctrl->dev, sizeof(*corner->sdelta),
++				      GFP_KERNEL);
++		if (!sdelta) {
++			rc = -ENOMEM;
++			goto done;
++		}
++
++		if (allow_core_count_adj)
++			sdelta->allow_core_count_adj = allow_core_count_adj[i];
++		if (allow_temp_adj)
++			sdelta->allow_temp_adj = allow_temp_adj[i];
++		sdelta->max_core_count = vreg->max_core_count;
++		sdelta->temp_band_count = ctrl->temp_band_count;
++
++		if (use_corner_band)
++			vreg->corner_band[i].sdelta = sdelta;
++		else
++			vreg->corner[i].sdelta = sdelta;
++
++		rc = cpr4_load_core_and_temp_adj(vreg, i, use_corner_band);
++		if (rc) {
++			cpr3_err(vreg, "corner/band %d core and temp adjustment loading failed, rc=%d\n",
++				 i, rc);
++			goto done;
++		}
++	}
++
++done:
++	kfree(allow_core_count_adj);
++	kfree(allow_temp_adj);
++
++	return rc;
++}
++
++/**
++ * cprh_adjust_voltages_for_apm() - adjust per-corner floor and ceiling voltages
++ *		so that they do not overlap the APM threshold voltage.
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * The memory array power mux (APM) must be configured for a specific supply
++ * based upon where the VDD voltage lies with respect to the APM threshold
++ * voltage.  When using CPR hardware closed-loop, the voltage may vary anywhere
++ * between the floor and ceiling voltage without software notification.
++ * Therefore, it is required that the floor to ceiling range for every corner
++ * not intersect the APM threshold voltage.  This function adjusts the floor to
++ * ceiling range for each corner which violates this requirement.
++ *
++ * The following algorithm is applied:
++ *	if floor < threshold <= ceiling:
++ *		if open_loop >= threshold, then floor = threshold - adj
++ *		else ceiling = threshold - step
++ * where:
++ *	adj = APM hysteresis voltage established to minimize the number of
++ *	      corners with artificially increased floor voltages
++ *	step = voltage in microvolts of a single step of the VDD supply
++ *
++ * The open-loop voltage is also bounded by the new floor or ceiling value as
++ * needed.
++ *
++ * Return: none
++ */
++void cprh_adjust_voltages_for_apm(struct cpr3_regulator *vreg)
++{
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	struct cpr3_corner *corner;
++	int i, adj, threshold, prev_ceiling, prev_floor, prev_open_loop;
++
++	if (!ctrl->apm_threshold_volt) {
++		/* APM not being used. */
++		return;
++	}
++
++	ctrl->apm_threshold_volt = CPR3_ROUND(ctrl->apm_threshold_volt,
++						ctrl->step_volt);
++	ctrl->apm_adj_volt = CPR3_ROUND(ctrl->apm_adj_volt, ctrl->step_volt);
++
++	threshold = ctrl->apm_threshold_volt;
++	adj = ctrl->apm_adj_volt;
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		corner = &vreg->corner[i];
++
++		if (threshold <= corner->floor_volt
++		    || threshold > corner->ceiling_volt)
++			continue;
++
++		prev_floor = corner->floor_volt;
++		prev_ceiling = corner->ceiling_volt;
++		prev_open_loop = corner->open_loop_volt;
++
++		if (corner->open_loop_volt >= threshold) {
++			corner->floor_volt = max(corner->floor_volt,
++						 threshold - adj);
++			if (corner->open_loop_volt < corner->floor_volt)
++				corner->open_loop_volt = corner->floor_volt;
++		} else {
++			corner->ceiling_volt = threshold - ctrl->step_volt;
++		}
++
++		if (corner->floor_volt != prev_floor
++		    || corner->ceiling_volt != prev_ceiling
++		    || corner->open_loop_volt != prev_open_loop)
++			cpr3_debug(vreg, "APM threshold=%d, APM adj=%d changed corner %d voltages; prev: floor=%d, ceiling=%d, open-loop=%d; new: floor=%d, ceiling=%d, open-loop=%d\n",
++				threshold, adj, i, prev_floor, prev_ceiling,
++				prev_open_loop, corner->floor_volt,
++				corner->ceiling_volt, corner->open_loop_volt);
++	}
++}
++
++/**
++ * cprh_adjust_voltages_for_mem_acc() - adjust per-corner floor and ceiling
++ *		voltages so that they do not intersect the MEM ACC threshold
++ *		voltage
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * The following algorithm is applied:
++ *	if floor < threshold <= ceiling:
++ *		if open_loop >= threshold, then floor = threshold
++ *		else ceiling = threshold - step
++ * where:
++ *	step = voltage in microvolts of a single step of the VDD supply
++ *
++ * The open-loop voltage is also bounded by the new floor or ceiling value as
++ * needed.
++ *
++ * Return: none
++ */
++void cprh_adjust_voltages_for_mem_acc(struct cpr3_regulator *vreg)
++{
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	struct cpr3_corner *corner;
++	int i, threshold, prev_ceiling, prev_floor, prev_open_loop;
++
++	if (!ctrl->mem_acc_threshold_volt) {
++		/* MEM ACC not being used. */
++		return;
++	}
++
++	ctrl->mem_acc_threshold_volt = CPR3_ROUND(ctrl->mem_acc_threshold_volt,
++						ctrl->step_volt);
++
++	threshold = ctrl->mem_acc_threshold_volt;
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		corner = &vreg->corner[i];
++
++		if (threshold <= corner->floor_volt
++		    || threshold > corner->ceiling_volt)
++			continue;
++
++		prev_floor = corner->floor_volt;
++		prev_ceiling = corner->ceiling_volt;
++		prev_open_loop = corner->open_loop_volt;
++
++		if (corner->open_loop_volt >= threshold) {
++			corner->floor_volt = max(corner->floor_volt, threshold);
++			if (corner->open_loop_volt < corner->floor_volt)
++				corner->open_loop_volt = corner->floor_volt;
++		} else {
++			corner->ceiling_volt = threshold - ctrl->step_volt;
++		}
++
++		if (corner->floor_volt != prev_floor
++		    || corner->ceiling_volt != prev_ceiling
++		    || corner->open_loop_volt != prev_open_loop)
++			cpr3_debug(vreg, "MEM ACC threshold=%d changed corner %d voltages; prev: floor=%d, ceiling=%d, open-loop=%d; new: floor=%d, ceiling=%d, open-loop=%d\n",
++				threshold, i, prev_floor, prev_ceiling,
++				prev_open_loop, corner->floor_volt,
++				corner->ceiling_volt, corner->open_loop_volt);
++	}
++}
++
++/**
++ * cpr3_apply_closed_loop_offset_voltages() - modify the closed-loop voltage
++ *		adjustments by the amounts that are needed for this
++ *		fuse combo
++ * @vreg:		Pointer to the CPR3 regulator
++ * @volt_adjust:	Array of closed-loop voltage adjustment values of length
++ *			vreg->corner_count which is further adjusted based upon
++ *			offset voltage fuse values.
++ * @fuse_volt_adjust:	Fused closed-loop voltage adjustment values of length
++ *			vreg->fuse_corner_count.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr3_apply_closed_loop_offset_voltages(struct cpr3_regulator *vreg,
++			int *volt_adjust, int *fuse_volt_adjust)
++{
++	u32 *corner_map;
++	int rc = 0, i;
++
++	if (!of_find_property(vreg->of_node,
++		"qcom,cpr-fused-closed-loop-voltage-adjustment-map", NULL)) {
++		/* No closed-loop offset required. */
++		return 0;
++	}
++
++	corner_map = kcalloc(vreg->corner_count, sizeof(*corner_map),
++				GFP_KERNEL);
++	if (!corner_map)
++		return -ENOMEM;
++
++	rc = cpr3_parse_corner_array_property(vreg,
++		"qcom,cpr-fused-closed-loop-voltage-adjustment-map",
++		1, corner_map);
++	if (rc)
++		goto done;
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		if (corner_map[i] == 0) {
++			continue;
++		} else if (corner_map[i] > vreg->fuse_corner_count) {
++			cpr3_err(vreg, "corner %d mapped to invalid fuse corner: %u\n",
++				i, corner_map[i]);
++			rc = -EINVAL;
++			goto done;
++		}
++
++		volt_adjust[i] += fuse_volt_adjust[corner_map[i] - 1];
++	}
++
++done:
++	kfree(corner_map);
++	return rc;
++}
++
++/**
++ * cpr3_enforce_inc_quotient_monotonicity() - Ensure that target quotients
++ *		increase monotonically from lower to higher corners
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * Return: 0 on success, errno on failure
++ */
++static void cpr3_enforce_inc_quotient_monotonicity(struct cpr3_regulator *vreg)
++{
++	int i, j;
++
++	for (i = 1; i < vreg->corner_count; i++) {
++		for (j = 0; j < CPR3_RO_COUNT; j++) {
++			if (vreg->corner[i].target_quot[j]
++			    && vreg->corner[i].target_quot[j]
++					< vreg->corner[i - 1].target_quot[j]) {
++				cpr3_debug(vreg, "corner %d RO%u target quot=%u < corner %d RO%u target quot=%u; overriding: corner %d RO%u target quot=%u\n",
++					i, j,
++					vreg->corner[i].target_quot[j],
++					i - 1, j,
++					vreg->corner[i - 1].target_quot[j],
++					i, j,
++					vreg->corner[i - 1].target_quot[j]);
++				vreg->corner[i].target_quot[j]
++					= vreg->corner[i - 1].target_quot[j];
++			}
++		}
++	}
++}
++
++/**
++ * cpr3_enforce_dec_quotient_monotonicity() - Ensure that target quotients
++ *		decrease monotonically from higher to lower corners
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * Return: 0 on success, errno on failure
++ */
++static void cpr3_enforce_dec_quotient_monotonicity(struct cpr3_regulator *vreg)
++{
++	int i, j;
++
++	for (i = vreg->corner_count - 2; i >= 0; i--) {
++		for (j = 0; j < CPR3_RO_COUNT; j++) {
++			if (vreg->corner[i + 1].target_quot[j]
++			    && vreg->corner[i].target_quot[j]
++					> vreg->corner[i + 1].target_quot[j]) {
++				cpr3_debug(vreg, "corner %d RO%u target quot=%u > corner %d RO%u target quot=%u; overriding: corner %d RO%u target quot=%u\n",
++					i, j,
++					vreg->corner[i].target_quot[j],
++					i + 1, j,
++					vreg->corner[i + 1].target_quot[j],
++					i, j,
++					vreg->corner[i + 1].target_quot[j]);
++				vreg->corner[i].target_quot[j]
++					= vreg->corner[i + 1].target_quot[j];
++			}
++		}
++	}
++}
++
++/**
++ * _cpr3_adjust_target_quotients() - adjust the target quotients for each
++ *		corner of the regulator according to input adjustment and
++ *		scaling arrays
++ * @vreg:		Pointer to the CPR3 regulator
++ * @volt_adjust:	Pointer to an array of closed-loop voltage adjustments
++ *			with units of microvolts.  The array must have
++ *			vreg->corner_count number of elements.
++ * @ro_scale:		Pointer to a flattened 2D array of RO scaling factors.
++ *			The array must have an inner dimension of CPR3_RO_COUNT
++ *			and an outer dimension of vreg->corner_count
++ * @label:		Null terminated string providing a label for the type
++ *			of adjustment.
++ *
++ * Return: true if any corners received a positive voltage adjustment (> 0),
++ *	   else false
++ */
++static bool _cpr3_adjust_target_quotients(struct cpr3_regulator *vreg,
++		const int *volt_adjust, const int *ro_scale, const char *label)
++{
++	int i, j, quot_adjust;
++	bool is_increasing = false;
++	u32 prev_quot;
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		for (j = 0; j < CPR3_RO_COUNT; j++) {
++			if (vreg->corner[i].target_quot[j]) {
++				quot_adjust = cpr3_quot_adjustment(
++					ro_scale[i * CPR3_RO_COUNT + j],
++					volt_adjust[i]);
++				if (quot_adjust) {
++					prev_quot = vreg->corner[i].
++							target_quot[j];
++					vreg->corner[i].target_quot[j]
++						+= quot_adjust;
++					cpr3_debug(vreg, "adjusted corner %d RO%d target quot %s: %u --> %u (%d uV)\n",
++						i, j, label, prev_quot,
++						vreg->corner[i].target_quot[j],
++						volt_adjust[i]);
++				}
++			}
++		}
++		if (volt_adjust[i] > 0)
++			is_increasing = true;
++	}
++
++	return is_increasing;
++}
++
++/**
++ * cpr3_adjust_target_quotients() - adjust the target quotients for each
++ *			corner according to device tree values and fuse values
++ * @vreg:		Pointer to the CPR3 regulator
++ * @fuse_volt_adjust:	Fused closed-loop voltage adjustment values of length
++ *			vreg->fuse_corner_count. This parameter could be null
++ *			pointer when no fused adjustments are needed.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int cpr3_adjust_target_quotients(struct cpr3_regulator *vreg,
++			int *fuse_volt_adjust)
++{
++	int i, rc;
++	int *volt_adjust, *ro_scale;
++	bool explicit_adjustment, fused_adjustment, is_increasing;
++
++	explicit_adjustment = of_find_property(vreg->of_node,
++		"qcom,cpr-closed-loop-voltage-adjustment", NULL);
++	fused_adjustment = of_find_property(vreg->of_node,
++		"qcom,cpr-fused-closed-loop-voltage-adjustment-map", NULL);
++
++	if (!explicit_adjustment && !fused_adjustment && !vreg->aging_allowed) {
++		/* No adjustment required. */
++		return 0;
++	} else if (!of_find_property(vreg->of_node,
++			"qcom,cpr-ro-scaling-factor", NULL)) {
++		cpr3_err(vreg, "qcom,cpr-ro-scaling-factor is required for closed-loop voltage adjustment, but is missing\n");
++		return -EINVAL;
++	}
++
++	volt_adjust = kcalloc(vreg->corner_count, sizeof(*volt_adjust),
++				GFP_KERNEL);
++	ro_scale = kcalloc(vreg->corner_count * CPR3_RO_COUNT,
++				sizeof(*ro_scale), GFP_KERNEL);
++	if (!volt_adjust || !ro_scale) {
++		rc = -ENOMEM;
++		goto done;
++	}
++
++	rc = cpr3_parse_corner_array_property(vreg,
++			"qcom,cpr-ro-scaling-factor", CPR3_RO_COUNT, ro_scale);
++	if (rc) {
++		cpr3_err(vreg, "could not load RO scaling factors, rc=%d\n",
++			rc);
++		goto done;
++	}
++
++	for (i = 0; i < vreg->corner_count; i++)
++		memcpy(vreg->corner[i].ro_scale, &ro_scale[i * CPR3_RO_COUNT],
++			sizeof(*ro_scale) * CPR3_RO_COUNT);
++
++	if (explicit_adjustment) {
++		rc = cpr3_parse_corner_array_property(vreg,
++			"qcom,cpr-closed-loop-voltage-adjustment",
++			1, volt_adjust);
++		if (rc) {
++			cpr3_err(vreg, "could not load closed-loop voltage adjustments, rc=%d\n",
++				rc);
++			goto done;
++		}
++
++		_cpr3_adjust_target_quotients(vreg, volt_adjust, ro_scale,
++			"from DT");
++		cpr3_enforce_inc_quotient_monotonicity(vreg);
++	}
++
++	if (fused_adjustment && fuse_volt_adjust) {
++		memset(volt_adjust, 0,
++			sizeof(*volt_adjust) * vreg->corner_count);
++
++		rc = cpr3_apply_closed_loop_offset_voltages(vreg, volt_adjust,
++				fuse_volt_adjust);
++		if (rc) {
++			cpr3_err(vreg, "could not apply fused closed-loop voltage reductions, rc=%d\n",
++				rc);
++			goto done;
++		}
++
++		is_increasing = _cpr3_adjust_target_quotients(vreg, volt_adjust,
++					ro_scale, "from fuse");
++		if (is_increasing)
++			cpr3_enforce_inc_quotient_monotonicity(vreg);
++		else
++			cpr3_enforce_dec_quotient_monotonicity(vreg);
++	}
++
++done:
++	kfree(volt_adjust);
++	kfree(ro_scale);
++	return rc;
++}
+--- /dev/null
++++ b/drivers/regulator/cpr4-apss-regulator.c
+@@ -0,0 +1,1818 @@
++/*
++ * Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#define pr_fmt(fmt) "%s: " fmt, __func__
++
++#include <linux/bitops.h>
++#include <linux/debugfs.h>
++#include <linux/err.h>
++#include <linux/init.h>
++#include <linux/interrupt.h>
++#include <linux/io.h>
++#include <linux/kernel.h>
++#include <linux/list.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/of_device.h>
++#include <linux/platform_device.h>
++#include <linux/pm_opp.h>
++#include <linux/slab.h>
++#include <linux/string.h>
++#include <linux/uaccess.h>
++#include <linux/regulator/driver.h>
++#include <linux/regulator/machine.h>
++#include <linux/regulator/of_regulator.h>
++
++#include "cpr3-regulator.h"
++
++#define IPQ807x_APSS_FUSE_CORNERS	4
++#define IPQ817x_APPS_FUSE_CORNERS	2
++#define IPQ6018_APSS_FUSE_CORNERS 	4
++#define IPQ9574_APSS_FUSE_CORNERS       4
++
++u32 g_valid_fuse_count = IPQ807x_APSS_FUSE_CORNERS;
++
++/**
++ * struct cpr4_ipq807x_apss_fuses - APSS specific fuse data for IPQ807x
++ * @ro_sel:		Ring oscillator select fuse parameter value for each
++ *			fuse corner
++ * @init_voltage:	Initial (i.e. open-loop) voltage fuse parameter value
++ *			for each fuse corner (raw, not converted to a voltage)
++ * @target_quot:	CPR target quotient fuse parameter value for each fuse
++ *			corner
++ * @quot_offset:	CPR target quotient offset fuse parameter value for each
++ *			fuse corner (raw, not unpacked) used for target quotient
++ *			interpolation
++ * @speed_bin:		Application processor speed bin fuse parameter value for
++ *			the given chip
++ * @cpr_fusing_rev:	CPR fusing revision fuse parameter value
++ * @boost_cfg:		CPR boost configuration fuse parameter value
++ * @boost_voltage:	CPR boost voltage fuse parameter value (raw, not
++ *			converted to a voltage)
++ *
++ * This struct holds the values for all of the fuses read from memory.
++ */
++struct cpr4_ipq807x_apss_fuses {
++	u64	ro_sel[IPQ807x_APSS_FUSE_CORNERS];
++	u64	init_voltage[IPQ807x_APSS_FUSE_CORNERS];
++	u64	target_quot[IPQ807x_APSS_FUSE_CORNERS];
++	u64	quot_offset[IPQ807x_APSS_FUSE_CORNERS];
++	u64	speed_bin;
++	u64	cpr_fusing_rev;
++	u64	boost_cfg;
++	u64	boost_voltage;
++	u64	misc;
++};
++
++/*
++ * fuse combo = fusing revision + 8 * (speed bin)
++ * where: fusing revision = 0 - 7 and speed bin = 0 - 7
++ */
++#define CPR4_IPQ807x_APSS_FUSE_COMBO_COUNT	64
++
++/*
++ * Constants which define the name of each fuse corner.
++ */
++enum cpr4_ipq807x_apss_fuse_corner {
++	CPR4_IPQ807x_APSS_FUSE_CORNER_SVS	= 0,
++	CPR4_IPQ807x_APSS_FUSE_CORNER_NOM	= 1,
++	CPR4_IPQ807x_APSS_FUSE_CORNER_TURBO	= 2,
++	CPR4_IPQ807x_APSS_FUSE_CORNER_STURBO	= 3,
++};
++
++static const char * const cpr4_ipq807x_apss_fuse_corner_name[] = {
++	[CPR4_IPQ807x_APSS_FUSE_CORNER_SVS]	= "SVS",
++	[CPR4_IPQ807x_APSS_FUSE_CORNER_NOM]	= "NOM",
++	[CPR4_IPQ807x_APSS_FUSE_CORNER_TURBO]	= "TURBO",
++	[CPR4_IPQ807x_APSS_FUSE_CORNER_STURBO]	= "STURBO",
++};
++
++/*
++ * IPQ807x APSS fuse parameter locations:
++ *
++ * Structs are organized with the following dimensions:
++ *	Outer: 0 to 3 for fuse corners from lowest to highest corner
++ *	Inner: large enough to hold the longest set of parameter segments which
++ *		fully defines a fuse parameter, +1 (for NULL termination).
++ *		Each segment corresponds to a contiguous group of bits from a
++ *		single fuse row.  These segments are concatentated together in
++ *		order to form the full fuse parameter value.  The segments for
++ *		a given parameter may correspond to different fuse rows.
++ */
++static struct cpr3_fuse_param
++ipq807x_apss_ro_sel_param[IPQ807x_APSS_FUSE_CORNERS][2] = {
++	{{73,  8, 11}, {} },
++	{{73,  4,  7}, {} },
++	{{73,  0,  3}, {} },
++	{{73, 12, 15}, {} },
++};
++
++static struct cpr3_fuse_param
++ipq807x_apss_init_voltage_param[IPQ807x_APSS_FUSE_CORNERS][2] = {
++	{{71, 18, 23}, {} },
++	{{71, 12, 17}, {} },
++	{{71,  6, 11}, {} },
++	{{71,  0,  5}, {} },
++};
++
++static struct cpr3_fuse_param
++ipq807x_apss_target_quot_param[IPQ807x_APSS_FUSE_CORNERS][2] = {
++	{{72, 32, 43}, {} },
++	{{72, 20, 31}, {} },
++	{{72,  8, 19}, {} },
++	{{72, 44, 55}, {} },
++};
++
++static struct cpr3_fuse_param
++ipq807x_apss_quot_offset_param[IPQ807x_APSS_FUSE_CORNERS][2] = {
++	{{} },
++	{{71, 46, 52}, {} },
++	{{71, 39, 45}, {} },
++	{{71, 32, 38}, {} },
++};
++
++static struct cpr3_fuse_param ipq807x_cpr_fusing_rev_param[] = {
++	{71, 53, 55},
++	{},
++};
++
++static struct cpr3_fuse_param ipq807x_apss_speed_bin_param[] = {
++	{36, 40, 42},
++	{},
++};
++
++static struct cpr3_fuse_param ipq807x_cpr_boost_fuse_cfg_param[] = {
++	{36, 43, 45},
++	{},
++};
++
++static struct cpr3_fuse_param ipq807x_apss_boost_fuse_volt_param[] = {
++	{71, 0, 5},
++	{},
++};
++
++static struct cpr3_fuse_param ipq807x_misc_fuse_volt_adj_param[] = {
++	{36, 54, 54},
++	{},
++};
++
++static struct cpr3_fuse_parameters ipq807x_fuse_params = {
++	.apss_ro_sel_param = ipq807x_apss_ro_sel_param,
++	.apss_init_voltage_param = ipq807x_apss_init_voltage_param,
++	.apss_target_quot_param = ipq807x_apss_target_quot_param,
++	.apss_quot_offset_param = ipq807x_apss_quot_offset_param,
++	.cpr_fusing_rev_param = ipq807x_cpr_fusing_rev_param,
++	.apss_speed_bin_param = ipq807x_apss_speed_bin_param,
++	.cpr_boost_fuse_cfg_param = ipq807x_cpr_boost_fuse_cfg_param,
++	.apss_boost_fuse_volt_param = ipq807x_apss_boost_fuse_volt_param,
++	.misc_fuse_volt_adj_param = ipq807x_misc_fuse_volt_adj_param
++};
++
++/*
++ * The number of possible values for misc fuse is
++ * 2^(#bits defined for misc fuse)
++ */
++#define IPQ807x_MISC_FUSE_VAL_COUNT		BIT(1)
++
++/*
++ * Open loop voltage fuse reference voltages in microvolts for IPQ807x
++ */
++static int ipq807x_apss_fuse_ref_volt
++	[IPQ807x_APSS_FUSE_CORNERS] = {
++	720000,
++	864000,
++	992000,
++	1064000,
++};
++
++#define IPQ807x_APSS_FUSE_STEP_VOLT		8000
++#define IPQ807x_APSS_VOLTAGE_FUSE_SIZE	6
++#define IPQ807x_APSS_QUOT_OFFSET_SCALE	5
++
++#define IPQ807x_APSS_CPR_SENSOR_COUNT	6
++
++#define IPQ807x_APSS_CPR_CLOCK_RATE		19200000
++
++#define IPQ807x_APSS_MAX_TEMP_POINTS	3
++#define IPQ807x_APSS_TEMP_SENSOR_ID_START	4
++#define IPQ807x_APSS_TEMP_SENSOR_ID_END	13
++/*
++ * Boost voltage fuse reference and ceiling voltages in microvolts for
++ * IPQ807x.
++ */
++#define IPQ807x_APSS_BOOST_FUSE_REF_VOLT	1140000
++#define IPQ807x_APSS_BOOST_CEILING_VOLT	1140000
++#define IPQ807x_APSS_BOOST_FLOOR_VOLT	900000
++#define MAX_BOOST_CONFIG_FUSE_VALUE		8
++
++#define IPQ807x_APSS_CPR_SDELTA_CORE_COUNT	15
++
++#define IPQ807x_APSS_CPR_TCSR_START		8
++#define IPQ807x_APSS_CPR_TCSR_END		9
++
++/*
++ * Array of integer values mapped to each of the boost config fuse values to
++ * indicate boost enable/disable status.
++ */
++static bool boost_fuse[MAX_BOOST_CONFIG_FUSE_VALUE] = {0, 1, 1, 1, 1, 1, 1, 1};
++
++/*
++ * IPQ6018 (Few parameters are changed, remaining are same as IPQ807x)
++ */
++#define IPQ6018_APSS_FUSE_STEP_VOLT		12500
++#define IPQ6018_APSS_CPR_CLOCK_RATE		24000000
++
++static struct cpr3_fuse_param
++ipq6018_apss_ro_sel_param[IPQ6018_APSS_FUSE_CORNERS][2] = {
++	{{75,  8, 11}, {} },
++	{{75,  4,  7}, {} },
++	{{75,  0,  3}, {} },
++	{{75, 12, 15}, {} },
++};
++
++static struct cpr3_fuse_param
++ipq6018_apss_init_voltage_param[IPQ6018_APSS_FUSE_CORNERS][2] = {
++	{{73, 18, 23}, {} },
++	{{73, 12, 17}, {} },
++	{{73,  6, 11}, {} },
++	{{73,  0,  5}, {} },
++};
++
++static struct cpr3_fuse_param
++ipq6018_apss_target_quot_param[IPQ6018_APSS_FUSE_CORNERS][2] = {
++	{{74, 32, 43}, {} },
++	{{74, 20, 31}, {} },
++	{{74,  8, 19}, {} },
++	{{74, 44, 55}, {} },
++};
++
++static struct cpr3_fuse_param
++ipq6018_apss_quot_offset_param[IPQ6018_APSS_FUSE_CORNERS][2] = {
++	{{} },
++	{{73, 48, 55}, {} },
++	{{73, 40, 47}, {} },
++	{{73, 32, 39}, {} },
++};
++
++static struct cpr3_fuse_param ipq6018_cpr_fusing_rev_param[] = {
++	{75, 16, 18},
++	{},
++};
++
++static struct cpr3_fuse_param ipq6018_apss_speed_bin_param[] = {
++	{36, 40, 42},
++	{},
++};
++
++static struct cpr3_fuse_param ipq6018_cpr_boost_fuse_cfg_param[] = {
++	{36, 43, 45},
++	{},
++};
++
++static struct cpr3_fuse_param ipq6018_apss_boost_fuse_volt_param[] = {
++	{73, 0, 5},
++	{},
++};
++
++static struct cpr3_fuse_param ipq6018_misc_fuse_volt_adj_param[] = {
++	{36, 54, 54},
++	{},
++};
++
++static struct cpr3_fuse_parameters ipq6018_fuse_params = {
++	.apss_ro_sel_param = ipq6018_apss_ro_sel_param,
++	.apss_init_voltage_param = ipq6018_apss_init_voltage_param,
++	.apss_target_quot_param = ipq6018_apss_target_quot_param,
++	.apss_quot_offset_param = ipq6018_apss_quot_offset_param,
++	.cpr_fusing_rev_param = ipq6018_cpr_fusing_rev_param,
++	.apss_speed_bin_param = ipq6018_apss_speed_bin_param,
++	.cpr_boost_fuse_cfg_param = ipq6018_cpr_boost_fuse_cfg_param,
++	.apss_boost_fuse_volt_param = ipq6018_apss_boost_fuse_volt_param,
++	.misc_fuse_volt_adj_param = ipq6018_misc_fuse_volt_adj_param
++};
++
++
++/*
++ * Boost voltage fuse reference and ceiling voltages in microvolts for
++ * IPQ6018.
++ */
++#define IPQ6018_APSS_BOOST_FUSE_REF_VOLT	1140000
++#define IPQ6018_APSS_BOOST_CEILING_VOLT	1140000
++#define IPQ6018_APSS_BOOST_FLOOR_VOLT	900000
++
++/*
++ * Open loop voltage fuse reference voltages in microvolts for IPQ807x
++ */
++static int ipq6018_apss_fuse_ref_volt
++	[IPQ6018_APSS_FUSE_CORNERS] = {
++	725000,
++	862500,
++	987500,
++	1062500,
++};
++
++/*
++ * IPQ6018 Memory ACC settings on TCSR
++ *
++ * Turbo_L1: write TCSR_MEM_ACC_SW_OVERRIDE_LEGACY_APC0 0x10
++ *           write TCSR_CUSTOM_VDDAPC0_ACC_1            0x1
++ * Other modes: write TCSR_MEM_ACC_SW_OVERRIDE_LEGACY_APC0 0x0
++ *              write TCSR_CUSTOM_VDDAPC0_ACC_1            0x0
++ *
++ */
++#define IPQ6018_APSS_MEM_ACC_TCSR_COUNT         2
++#define TCSR_MEM_ACC_SW_OVERRIDE_LEGACY_APC0    0x1946178
++#define TCSR_CUSTOM_VDDAPC0_ACC_1               0x1946124
++
++struct mem_acc_tcsr {
++	u32 phy_addr;
++	void __iomem *ioremap_addr;
++	u32 value;
++};
++
++static struct mem_acc_tcsr ipq6018_mem_acc_tcsr[IPQ6018_APSS_MEM_ACC_TCSR_COUNT] = {
++	{TCSR_MEM_ACC_SW_OVERRIDE_LEGACY_APC0, NULL, 0x10},
++	{TCSR_CUSTOM_VDDAPC0_ACC_1, NULL, 0x1},
++};
++
++/*
++ * IPQ9574 (Few parameters are changed, remaining are same as IPQ6018)
++ */
++#define IPQ9574_APSS_FUSE_STEP_VOLT             10000
++
++static struct cpr3_fuse_param
++ipq9574_apss_ro_sel_param[IPQ9574_APSS_FUSE_CORNERS][2] = {
++	{{107, 4, 7}, {} },
++	{{107, 0, 3}, {} },
++	{{106, 4, 7}, {} },
++	{{106, 0, 3}, {} },
++};
++
++static struct cpr3_fuse_param
++ipq9574_apss_init_voltage_param[IPQ9574_APSS_FUSE_CORNERS][2] = {
++	{{104, 24, 29}, {} },
++	{{104, 18, 23}, {} },
++	{{104, 12, 17}, {} },
++	{{104,  6, 11}, {} },
++};
++
++static struct cpr3_fuse_param
++ipq9574_apss_target_quot_param[IPQ9574_APSS_FUSE_CORNERS][2] = {
++	{{106, 32, 43}, {} },
++	{{106, 20, 31}, {} },
++	{{106,  8, 19}, {} },
++	{{106, 44, 55}, {} },
++};
++
++static struct cpr3_fuse_param
++ipq9574_apss_quot_offset_param[IPQ9574_APSS_FUSE_CORNERS][2] = {
++	{{} },
++	{{105, 48, 55}, {} },
++	{{105, 40, 47}, {} },
++	{{105, 32, 39}, {} },
++};
++
++static struct cpr3_fuse_param ipq9574_cpr_fusing_rev_param[] = {
++	{107, 8, 10},
++	{},
++};
++
++static struct cpr3_fuse_param ipq9574_apss_speed_bin_param[] = {
++	{0, 40, 42},
++	{},
++};
++
++static struct cpr3_fuse_param ipq9574_cpr_boost_fuse_cfg_param[] = {
++	{0, 43, 45},
++	{},
++};
++
++static struct cpr3_fuse_param ipq9574_apss_boost_fuse_volt_param[] = {
++	{104, 0, 5},
++	{},
++};
++
++static struct cpr3_fuse_param ipq9574_misc_fuse_volt_adj_param[] = {
++	{0, 54, 54},
++	{},
++};
++
++static struct cpr3_fuse_parameters ipq9574_fuse_params = {
++	.apss_ro_sel_param = ipq9574_apss_ro_sel_param,
++	.apss_init_voltage_param = ipq9574_apss_init_voltage_param,
++	.apss_target_quot_param = ipq9574_apss_target_quot_param,
++	.apss_quot_offset_param = ipq9574_apss_quot_offset_param,
++	.cpr_fusing_rev_param = ipq9574_cpr_fusing_rev_param,
++	.apss_speed_bin_param = ipq9574_apss_speed_bin_param,
++	.cpr_boost_fuse_cfg_param = ipq9574_cpr_boost_fuse_cfg_param,
++	.apss_boost_fuse_volt_param = ipq9574_apss_boost_fuse_volt_param,
++	.misc_fuse_volt_adj_param = ipq9574_misc_fuse_volt_adj_param
++};
++
++/*
++ * Open loop voltage fuse reference voltages in microvolts for IPQ9574
++ */
++static int ipq9574_apss_fuse_ref_volt
++	[IPQ9574_APSS_FUSE_CORNERS] = {
++	725000,
++	862500,
++	987500,
++	1062500,
++};
++
++/**
++ * cpr4_ipq807x_apss_read_fuse_data() - load APSS specific fuse parameter values
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * This function allocates a cpr4_ipq807x_apss_fuses struct, fills it with
++ * values read out of hardware fuses, and finally copies common fuse values
++ * into the CPR3 regulator struct.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_ipq807x_apss_read_fuse_data(struct cpr3_regulator *vreg)
++{
++	void __iomem *base = vreg->thread->ctrl->fuse_base;
++	struct cpr4_ipq807x_apss_fuses *fuse;
++	int i, rc;
++
++	fuse = devm_kzalloc(vreg->thread->ctrl->dev, sizeof(*fuse), GFP_KERNEL);
++	if (!fuse)
++		return -ENOMEM;
++
++	rc = cpr3_read_fuse_param(base, vreg->cpr4_regulator_data->cpr3_fuse_params->apss_speed_bin_param,
++				  &fuse->speed_bin);
++	if (rc) {
++		cpr3_err(vreg, "Unable to read speed bin fuse, rc=%d\n", rc);
++		return rc;
++	}
++	cpr3_info(vreg, "speed bin = %llu\n", fuse->speed_bin);
++
++	rc = cpr3_read_fuse_param(base, vreg->cpr4_regulator_data->cpr3_fuse_params->cpr_fusing_rev_param,
++				  &fuse->cpr_fusing_rev);
++	if (rc) {
++		cpr3_err(vreg, "Unable to read CPR fusing revision fuse, rc=%d\n",
++			rc);
++		return rc;
++	}
++	cpr3_info(vreg, "CPR fusing revision = %llu\n", fuse->cpr_fusing_rev);
++
++	rc = cpr3_read_fuse_param(base, vreg->cpr4_regulator_data->cpr3_fuse_params->misc_fuse_volt_adj_param,
++				  &fuse->misc);
++	if (rc) {
++		cpr3_err(vreg, "Unable to read misc voltage adjustment fuse, rc=%d\n",
++			rc);
++		return rc;
++	}
++	cpr3_info(vreg, "CPR misc fuse value = %llu\n", fuse->misc);
++	if (fuse->misc >= IPQ807x_MISC_FUSE_VAL_COUNT) {
++		cpr3_err(vreg, "CPR misc fuse value = %llu, should be < %lu\n",
++			fuse->misc, IPQ807x_MISC_FUSE_VAL_COUNT);
++		return -EINVAL;
++	}
++
++	for (i = 0; i < g_valid_fuse_count; i++) {
++		rc = cpr3_read_fuse_param(base,
++				vreg->cpr4_regulator_data->cpr3_fuse_params->apss_init_voltage_param[i],
++				&fuse->init_voltage[i]);
++		if (rc) {
++			cpr3_err(vreg, "Unable to read fuse-corner %d initial voltage fuse, rc=%d\n",
++				i, rc);
++			return rc;
++		}
++
++		rc = cpr3_read_fuse_param(base,
++				vreg->cpr4_regulator_data->cpr3_fuse_params->apss_target_quot_param[i],
++				&fuse->target_quot[i]);
++		if (rc) {
++			cpr3_err(vreg, "Unable to read fuse-corner %d target quotient fuse, rc=%d\n",
++				i, rc);
++			return rc;
++		}
++
++		rc = cpr3_read_fuse_param(base,
++				vreg->cpr4_regulator_data->cpr3_fuse_params->apss_ro_sel_param[i],
++				&fuse->ro_sel[i]);
++		if (rc) {
++			cpr3_err(vreg, "Unable to read fuse-corner %d RO select fuse, rc=%d\n",
++				i, rc);
++			return rc;
++		}
++
++		rc = cpr3_read_fuse_param(base,
++				vreg->cpr4_regulator_data->cpr3_fuse_params->apss_quot_offset_param[i],
++				&fuse->quot_offset[i]);
++		if (rc) {
++			cpr3_err(vreg, "Unable to read fuse-corner %d quotient offset fuse, rc=%d\n",
++				i, rc);
++			return rc;
++		}
++	}
++
++	rc = cpr3_read_fuse_param(base, vreg->cpr4_regulator_data->cpr3_fuse_params->cpr_boost_fuse_cfg_param,
++				  &fuse->boost_cfg);
++	if (rc) {
++		cpr3_err(vreg, "Unable to read CPR boost config fuse, rc=%d\n",
++			rc);
++		return rc;
++	}
++	cpr3_info(vreg, "Voltage boost fuse config = %llu boost = %s\n",
++			fuse->boost_cfg, boost_fuse[fuse->boost_cfg]
++			? "enable" : "disable");
++
++	rc = cpr3_read_fuse_param(base,
++				vreg->cpr4_regulator_data->cpr3_fuse_params->apss_boost_fuse_volt_param,
++				&fuse->boost_voltage);
++	if (rc) {
++		cpr3_err(vreg, "failed to read boost fuse voltage, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	vreg->fuse_combo = fuse->cpr_fusing_rev + 8 * fuse->speed_bin;
++	if (vreg->fuse_combo >= CPR4_IPQ807x_APSS_FUSE_COMBO_COUNT) {
++		cpr3_err(vreg, "invalid CPR fuse combo = %d found\n",
++			vreg->fuse_combo);
++		return -EINVAL;
++	}
++
++	vreg->speed_bin_fuse	= fuse->speed_bin;
++	vreg->cpr_rev_fuse	= fuse->cpr_fusing_rev;
++	vreg->fuse_corner_count	= g_valid_fuse_count;
++	vreg->platform_fuses	= fuse;
++
++	return 0;
++}
++
++/**
++ * cpr4_apss_parse_corner_data() - parse APSS corner data from device tree
++ *		properties of the CPR3 regulator's device node
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_apss_parse_corner_data(struct cpr3_regulator *vreg)
++{
++	struct device_node *node = vreg->of_node;
++	struct cpr4_ipq807x_apss_fuses *fuse = vreg->platform_fuses;
++	u32 *temp = NULL;
++	int i, rc;
++
++	rc = cpr3_parse_common_corner_data(vreg);
++	if (rc) {
++		cpr3_err(vreg, "error reading corner data, rc=%d\n", rc);
++		return rc;
++	}
++
++	/* If fuse has incorrect RO Select values and dtsi has "qcom,cpr-ro-sel"
++	 * entry with RO select values other than zero, then dtsi values will
++	 * be used.
++	 */
++	if (of_find_property(node, "qcom,cpr-ro-sel", NULL)) {
++		temp = kcalloc(vreg->fuse_corner_count, sizeof(*temp),
++				GFP_KERNEL);
++		if (!temp)
++			return -ENOMEM;
++
++		rc = cpr3_parse_array_property(vreg, "qcom,cpr-ro-sel",
++				vreg->fuse_corner_count, temp);
++		if (rc)
++			goto done;
++
++		for (i = 0; i < vreg->fuse_corner_count; i++) {
++			if (temp[i] != 0)
++				fuse->ro_sel[i] = temp[i];
++		}
++	}
++done:
++	kfree(temp);
++	return rc;
++}
++
++/**
++ * cpr4_apss_parse_misc_fuse_voltage_adjustments() - fill an array from a
++ *		portion of the voltage adjustments specified based on
++ *		miscellaneous fuse bits.
++ * @vreg:		Pointer to the CPR3 regulator
++ * @volt_adjust:	Voltage adjustment output data array which must be
++ *			of size vreg->corner_count
++ *
++ * cpr3_parse_common_corner_data() must be called for vreg before this function
++ * is called so that speed bin size elements are initialized.
++ *
++ * Two formats are supported for the device tree property:
++ * 1. Length == tuple_list_size * vreg->corner_count
++ *	(reading begins at index 0)
++ * 2. Length == tuple_list_size * vreg->speed_bin_corner_sum
++ *	(reading begins at index tuple_list_size * vreg->speed_bin_offset)
++ *
++ * Here, tuple_list_size is the number of possible values for misc fuse.
++ * All other property lengths are treated as errors.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_apss_parse_misc_fuse_voltage_adjustments(
++	struct cpr3_regulator *vreg, u32 *volt_adjust)
++{
++	struct device_node *node = vreg->of_node;
++	struct cpr4_ipq807x_apss_fuses *fuse = vreg->platform_fuses;
++	int tuple_list_size = IPQ807x_MISC_FUSE_VAL_COUNT;
++	int i, offset, rc, len = 0;
++	const char *prop_name = "qcom,cpr-misc-fuse-voltage-adjustment";
++
++	if (!of_find_property(node, prop_name, &len)) {
++		cpr3_err(vreg, "property %s is missing\n", prop_name);
++		return -EINVAL;
++	}
++
++	if (len == tuple_list_size * vreg->corner_count * sizeof(u32)) {
++		offset = 0;
++	} else if (vreg->speed_bin_corner_sum > 0 &&
++			len == tuple_list_size * vreg->speed_bin_corner_sum
++			* sizeof(u32)) {
++		offset = tuple_list_size * vreg->speed_bin_offset
++			+ fuse->misc * vreg->corner_count;
++	} else {
++		if (vreg->speed_bin_corner_sum > 0)
++			cpr3_err(vreg, "property %s has invalid length=%d, should be %zu or %zu\n",
++				prop_name, len,
++				tuple_list_size * vreg->corner_count
++					* sizeof(u32),
++				tuple_list_size * vreg->speed_bin_corner_sum
++					* sizeof(u32));
++		else
++			cpr3_err(vreg, "property %s has invalid length=%d, should be %zu\n",
++				prop_name, len,
++				tuple_list_size * vreg->corner_count
++				* sizeof(u32));
++		return -EINVAL;
++	}
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		rc = of_property_read_u32_index(node, prop_name, offset + i,
++						&volt_adjust[i]);
++		if (rc) {
++			cpr3_err(vreg, "error reading property %s, rc=%d\n",
++				prop_name, rc);
++			return rc;
++		}
++	}
++
++	return 0;
++}
++
++/**
++ * cpr4_ipq807x_apss_calculate_open_loop_voltages() - calculate the open-loop
++ *		voltage for each corner of a CPR3 regulator
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * If open-loop voltage interpolation is allowed in device tree, then
++ * this function calculates the open-loop voltage for a given corner using
++ * linear interpolation.  This interpolation is performed using the processor
++ * frequencies of the lower and higher Fmax corners along with their fused
++ * open-loop voltages.
++ *
++ * If open-loop voltage interpolation is not allowed, then this function uses
++ * the Fmax fused open-loop voltage for all of the corners associated with a
++ * given fuse corner.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_ipq807x_apss_calculate_open_loop_voltages(
++			struct cpr3_regulator *vreg)
++{
++	struct device_node *node = vreg->of_node;
++	struct cpr4_ipq807x_apss_fuses *fuse = vreg->platform_fuses;
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	int i, j, rc = 0;
++	bool allow_interpolation;
++	u64 freq_low, volt_low, freq_high, volt_high;
++	int *fuse_volt, *misc_adj_volt;
++	int *fmax_corner;
++
++	fuse_volt = kcalloc(vreg->fuse_corner_count, sizeof(*fuse_volt),
++				GFP_KERNEL);
++	fmax_corner = kcalloc(vreg->fuse_corner_count, sizeof(*fmax_corner),
++				GFP_KERNEL);
++	if (!fuse_volt || !fmax_corner) {
++		rc = -ENOMEM;
++		goto done;
++	}
++
++	for (i = 0; i < vreg->fuse_corner_count; i++) {
++		if (ctrl->cpr_global_setting == CPR_DISABLED)
++			fuse_volt[i] = vreg->cpr4_regulator_data->fuse_ref_volt[i];
++		else
++			fuse_volt[i] = cpr3_convert_open_loop_voltage_fuse(
++				vreg->cpr4_regulator_data->fuse_ref_volt[i],
++				vreg->cpr4_regulator_data->fuse_step_volt,
++				fuse->init_voltage[i],
++				IPQ807x_APSS_VOLTAGE_FUSE_SIZE);
++
++		/* Log fused open-loop voltage values for debugging purposes. */
++		cpr3_info(vreg, "fused %8s: open-loop=%7d uV\n",
++			  cpr4_ipq807x_apss_fuse_corner_name[i],
++			  fuse_volt[i]);
++	}
++
++	rc = cpr3_determine_part_type(vreg,
++			  fuse_volt[vreg->fuse_corner_count - 1]);
++	if (rc) {
++		cpr3_err(vreg, "fused part type detection failed failed, rc=%d\n",
++			rc);
++		goto done;
++	}
++
++	rc = cpr3_adjust_fused_open_loop_voltages(vreg, fuse_volt);
++	if (rc) {
++		cpr3_err(vreg, "fused open-loop voltage adjustment failed, rc=%d\n",
++			rc);
++		goto done;
++	}
++
++	allow_interpolation = of_property_read_bool(node,
++				"qcom,allow-voltage-interpolation");
++
++	for (i = 1; i < vreg->fuse_corner_count; i++) {
++		if (fuse_volt[i] < fuse_volt[i - 1]) {
++			cpr3_info(vreg, "fuse corner %d voltage=%d uV < fuse corner %d voltage=%d uV; overriding: fuse corner %d voltage=%d\n",
++				i, fuse_volt[i], i - 1, fuse_volt[i - 1],
++				i, fuse_volt[i - 1]);
++			fuse_volt[i] = fuse_volt[i - 1];
++		}
++	}
++
++	if (!allow_interpolation) {
++		/* Use fused open-loop voltage for lower frequencies. */
++		for (i = 0; i < vreg->corner_count; i++)
++			vreg->corner[i].open_loop_volt
++				= fuse_volt[vreg->corner[i].cpr_fuse_corner];
++		goto done;
++	}
++
++	/* Determine highest corner mapped to each fuse corner */
++	j = vreg->fuse_corner_count - 1;
++	for (i = vreg->corner_count - 1; i >= 0; i--) {
++		if (vreg->corner[i].cpr_fuse_corner == j) {
++			fmax_corner[j] = i;
++			j--;
++		}
++	}
++	if (j >= 0) {
++		cpr3_err(vreg, "invalid fuse corner mapping\n");
++		rc = -EINVAL;
++		goto done;
++	}
++
++	/*
++	 * Interpolation is not possible for corners mapped to the lowest fuse
++	 * corner so use the fuse corner value directly.
++	 */
++	for (i = 0; i <= fmax_corner[0]; i++)
++		vreg->corner[i].open_loop_volt = fuse_volt[0];
++
++	/* Interpolate voltages for the higher fuse corners. */
++	for (i = 1; i < vreg->fuse_corner_count; i++) {
++		freq_low = vreg->corner[fmax_corner[i - 1]].proc_freq;
++		volt_low = fuse_volt[i - 1];
++		freq_high = vreg->corner[fmax_corner[i]].proc_freq;
++		volt_high = fuse_volt[i];
++
++		for (j = fmax_corner[i - 1] + 1; j <= fmax_corner[i]; j++)
++			vreg->corner[j].open_loop_volt = cpr3_interpolate(
++				freq_low, volt_low, freq_high, volt_high,
++				vreg->corner[j].proc_freq);
++	}
++
++done:
++	if (rc == 0) {
++		cpr3_debug(vreg, "unadjusted per-corner open-loop voltages:\n");
++		for (i = 0; i < vreg->corner_count; i++)
++			cpr3_debug(vreg, "open-loop[%2d] = %d uV\n", i,
++				vreg->corner[i].open_loop_volt);
++
++		rc = cpr3_adjust_open_loop_voltages(vreg);
++		if (rc)
++			cpr3_err(vreg, "open-loop voltage adjustment failed, rc=%d\n",
++				rc);
++
++		if (of_find_property(node,
++			"qcom,cpr-misc-fuse-voltage-adjustment",
++			NULL)) {
++			misc_adj_volt = kcalloc(vreg->corner_count,
++					sizeof(*misc_adj_volt), GFP_KERNEL);
++			if (!misc_adj_volt) {
++				rc = -ENOMEM;
++				goto _exit;
++			}
++
++			rc = cpr4_apss_parse_misc_fuse_voltage_adjustments(vreg,
++				misc_adj_volt);
++			if (rc) {
++				cpr3_err(vreg, "qcom,cpr-misc-fuse-voltage-adjustment reading failed, rc=%d\n",
++					rc);
++				kfree(misc_adj_volt);
++				goto _exit;
++			}
++
++			for (i = 0; i < vreg->corner_count; i++)
++				vreg->corner[i].open_loop_volt
++						+= misc_adj_volt[i];
++			kfree(misc_adj_volt);
++		}
++	}
++
++_exit:
++	kfree(fuse_volt);
++	kfree(fmax_corner);
++	return rc;
++}
++
++/**
++ * cpr4_ipq807x_apss_set_no_interpolation_quotients() - use the fused target
++ *		quotient values for lower frequencies.
++ * @vreg:		Pointer to the CPR3 regulator
++ * @volt_adjust:	Pointer to array of per-corner closed-loop adjustment
++ *			voltages
++ * @volt_adjust_fuse:	Pointer to array of per-fuse-corner closed-loop
++ *			adjustment voltages
++ * @ro_scale:		Pointer to array of per-fuse-corner RO scaling factor
++ *			values with units of QUOT/V
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_ipq807x_apss_set_no_interpolation_quotients(
++			struct cpr3_regulator *vreg, int *volt_adjust,
++			int *volt_adjust_fuse, int *ro_scale)
++{
++	struct cpr4_ipq807x_apss_fuses *fuse = vreg->platform_fuses;
++	u32 quot, ro;
++	int quot_adjust;
++	int i, fuse_corner;
++
++	for (i = 0; i < vreg->corner_count; i++) {
++		fuse_corner = vreg->corner[i].cpr_fuse_corner;
++		quot = fuse->target_quot[fuse_corner];
++		quot_adjust = cpr3_quot_adjustment(ro_scale[fuse_corner],
++					   volt_adjust_fuse[fuse_corner] +
++					   volt_adjust[i]);
++		ro = fuse->ro_sel[fuse_corner];
++		vreg->corner[i].target_quot[ro] = quot + quot_adjust;
++		cpr3_debug(vreg, "corner=%d RO=%u target quot=%u\n",
++			  i, ro, quot);
++
++		if (quot_adjust)
++			cpr3_debug(vreg, "adjusted corner %d RO%u target quot: %u --> %u (%d uV)\n",
++				  i, ro, quot, vreg->corner[i].target_quot[ro],
++				  volt_adjust_fuse[fuse_corner] +
++				  volt_adjust[i]);
++	}
++
++	return 0;
++}
++
++/**
++ * cpr4_ipq807x_apss_calculate_target_quotients() - calculate the CPR target
++ *		quotient for each corner of a CPR3 regulator
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * If target quotient interpolation is allowed in device tree, then this
++ * function calculates the target quotient for a given corner using linear
++ * interpolation.  This interpolation is performed using the processor
++ * frequencies of the lower and higher Fmax corners along with the fused
++ * target quotient and quotient offset of the higher Fmax corner.
++ *
++ * If target quotient interpolation is not allowed, then this function uses
++ * the Fmax fused target quotient for all of the corners associated with a
++ * given fuse corner.
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_ipq807x_apss_calculate_target_quotients(
++			struct cpr3_regulator *vreg)
++{
++	struct cpr4_ipq807x_apss_fuses *fuse = vreg->platform_fuses;
++	int rc;
++	bool allow_interpolation;
++	u64 freq_low, freq_high, prev_quot;
++	u64 *quot_low;
++	u64 *quot_high;
++	u32 quot, ro;
++	int i, j, fuse_corner, quot_adjust;
++	int *fmax_corner;
++	int *volt_adjust, *volt_adjust_fuse, *ro_scale;
++	int *voltage_adj_misc;
++
++	/* Log fused quotient values for debugging purposes. */
++	for (i = CPR4_IPQ807x_APSS_FUSE_CORNER_SVS;
++		i < vreg->fuse_corner_count; i++)
++		cpr3_info(vreg, "fused %8s: quot[%2llu]=%4llu, quot_offset[%2llu]=%4llu\n",
++			cpr4_ipq807x_apss_fuse_corner_name[i],
++			fuse->ro_sel[i], fuse->target_quot[i],
++			fuse->ro_sel[i], fuse->quot_offset[i] *
++			IPQ807x_APSS_QUOT_OFFSET_SCALE);
++
++	allow_interpolation = of_property_read_bool(vreg->of_node,
++					"qcom,allow-quotient-interpolation");
++
++	volt_adjust = kcalloc(vreg->corner_count, sizeof(*volt_adjust),
++					GFP_KERNEL);
++	volt_adjust_fuse = kcalloc(vreg->fuse_corner_count,
++					sizeof(*volt_adjust_fuse), GFP_KERNEL);
++	ro_scale = kcalloc(vreg->fuse_corner_count, sizeof(*ro_scale),
++					GFP_KERNEL);
++	fmax_corner = kcalloc(vreg->fuse_corner_count, sizeof(*fmax_corner),
++					GFP_KERNEL);
++	quot_low = kcalloc(vreg->fuse_corner_count, sizeof(*quot_low),
++					GFP_KERNEL);
++	quot_high = kcalloc(vreg->fuse_corner_count, sizeof(*quot_high),
++					GFP_KERNEL);
++	if (!volt_adjust || !volt_adjust_fuse || !ro_scale ||
++	    !fmax_corner || !quot_low || !quot_high) {
++		rc = -ENOMEM;
++		goto done;
++	}
++
++	rc = cpr3_parse_closed_loop_voltage_adjustments(vreg, &fuse->ro_sel[0],
++				volt_adjust, volt_adjust_fuse, ro_scale);
++	if (rc) {
++		cpr3_err(vreg, "could not load closed-loop voltage adjustments, rc=%d\n",
++			rc);
++		goto done;
++	}
++
++	if (of_find_property(vreg->of_node,
++		"qcom,cpr-misc-fuse-voltage-adjustment", NULL)) {
++		voltage_adj_misc = kcalloc(vreg->corner_count,
++				sizeof(*voltage_adj_misc), GFP_KERNEL);
++		if (!voltage_adj_misc) {
++			rc = -ENOMEM;
++			goto done;
++		}
++
++		rc = cpr4_apss_parse_misc_fuse_voltage_adjustments(vreg,
++			voltage_adj_misc);
++		if (rc) {
++			cpr3_err(vreg, "qcom,cpr-misc-fuse-voltage-adjustment reading failed, rc=%d\n",
++				rc);
++			kfree(voltage_adj_misc);
++			goto done;
++		}
++
++		for (i = 0; i < vreg->corner_count; i++)
++			volt_adjust[i] += voltage_adj_misc[i];
++
++		kfree(voltage_adj_misc);
++	}
++
++	if (!allow_interpolation) {
++		/* Use fused target quotients for lower frequencies. */
++		return cpr4_ipq807x_apss_set_no_interpolation_quotients(
++				vreg, volt_adjust, volt_adjust_fuse, ro_scale);
++	}
++
++	/* Determine highest corner mapped to each fuse corner */
++	j = vreg->fuse_corner_count - 1;
++	for (i = vreg->corner_count - 1; i >= 0; i--) {
++		if (vreg->corner[i].cpr_fuse_corner == j) {
++			fmax_corner[j] = i;
++			j--;
++		}
++	}
++	if (j >= 0) {
++		cpr3_err(vreg, "invalid fuse corner mapping\n");
++		rc = -EINVAL;
++		goto done;
++	}
++
++	/*
++	 * Interpolation is not possible for corners mapped to the lowest fuse
++	 * corner so use the fuse corner value directly.
++	 */
++	i = CPR4_IPQ807x_APSS_FUSE_CORNER_SVS;
++	quot_adjust = cpr3_quot_adjustment(ro_scale[i], volt_adjust_fuse[i]);
++	quot = fuse->target_quot[i] + quot_adjust;
++	quot_high[i] = quot_low[i] = quot;
++	ro = fuse->ro_sel[i];
++	if (quot_adjust)
++		cpr3_debug(vreg, "adjusted fuse corner %d RO%u target quot: %llu --> %u (%d uV)\n",
++			i, ro, fuse->target_quot[i], quot, volt_adjust_fuse[i]);
++
++	for (i = 0; i <= fmax_corner[CPR4_IPQ807x_APSS_FUSE_CORNER_SVS];
++		i++)
++		vreg->corner[i].target_quot[ro] = quot;
++
++	for (i = CPR4_IPQ807x_APSS_FUSE_CORNER_NOM;
++	     i < vreg->fuse_corner_count; i++) {
++		quot_high[i] = fuse->target_quot[i];
++		if (fuse->ro_sel[i] == fuse->ro_sel[i - 1])
++			quot_low[i] = quot_high[i - 1];
++		else
++			quot_low[i] = quot_high[i]
++					- fuse->quot_offset[i]
++					  * IPQ807x_APSS_QUOT_OFFSET_SCALE;
++		if (quot_high[i] < quot_low[i]) {
++			cpr3_debug(vreg, "quot_high[%d]=%llu < quot_low[%d]=%llu; overriding: quot_high[%d]=%llu\n",
++				i, quot_high[i], i, quot_low[i],
++				i, quot_low[i]);
++			quot_high[i] = quot_low[i];
++		}
++	}
++
++	/* Perform per-fuse-corner target quotient adjustment */
++	for (i = 1; i < vreg->fuse_corner_count; i++) {
++		quot_adjust = cpr3_quot_adjustment(ro_scale[i],
++						   volt_adjust_fuse[i]);
++		if (quot_adjust) {
++			prev_quot = quot_high[i];
++			quot_high[i] += quot_adjust;
++			cpr3_debug(vreg, "adjusted fuse corner %d RO%llu target quot: %llu --> %llu (%d uV)\n",
++				i, fuse->ro_sel[i], prev_quot, quot_high[i],
++				volt_adjust_fuse[i]);
++		}
++
++		if (fuse->ro_sel[i] == fuse->ro_sel[i - 1])
++			quot_low[i] = quot_high[i - 1];
++		else
++			quot_low[i] += cpr3_quot_adjustment(ro_scale[i],
++						    volt_adjust_fuse[i - 1]);
++
++		if (quot_high[i] < quot_low[i]) {
++			cpr3_debug(vreg, "quot_high[%d]=%llu < quot_low[%d]=%llu after adjustment; overriding: quot_high[%d]=%llu\n",
++				i, quot_high[i], i, quot_low[i],
++				i, quot_low[i]);
++			quot_high[i] = quot_low[i];
++		}
++	}
++
++	/* Interpolate voltages for the higher fuse corners. */
++	for (i = 1; i < vreg->fuse_corner_count; i++) {
++		freq_low = vreg->corner[fmax_corner[i - 1]].proc_freq;
++		freq_high = vreg->corner[fmax_corner[i]].proc_freq;
++
++		ro = fuse->ro_sel[i];
++		for (j = fmax_corner[i - 1] + 1; j <= fmax_corner[i]; j++)
++			vreg->corner[j].target_quot[ro] = cpr3_interpolate(
++				freq_low, quot_low[i], freq_high, quot_high[i],
++				vreg->corner[j].proc_freq);
++	}
++
++	/* Perform per-corner target quotient adjustment */
++	for (i = 0; i < vreg->corner_count; i++) {
++		fuse_corner = vreg->corner[i].cpr_fuse_corner;
++		ro = fuse->ro_sel[fuse_corner];
++		quot_adjust = cpr3_quot_adjustment(ro_scale[fuse_corner],
++						   volt_adjust[i]);
++		if (quot_adjust) {
++			prev_quot = vreg->corner[i].target_quot[ro];
++			vreg->corner[i].target_quot[ro] += quot_adjust;
++			cpr3_debug(vreg, "adjusted corner %d RO%u target quot: %llu --> %u (%d uV)\n",
++				i, ro, prev_quot,
++				vreg->corner[i].target_quot[ro],
++				volt_adjust[i]);
++		}
++	}
++
++	/* Ensure that target quotients increase monotonically */
++	for (i = 1; i < vreg->corner_count; i++) {
++		ro = fuse->ro_sel[vreg->corner[i].cpr_fuse_corner];
++		if (fuse->ro_sel[vreg->corner[i - 1].cpr_fuse_corner] == ro
++		    && vreg->corner[i].target_quot[ro]
++				< vreg->corner[i - 1].target_quot[ro]) {
++			cpr3_debug(vreg, "adjusted corner %d RO%u target quot=%u < adjusted corner %d RO%u target quot=%u; overriding: corner %d RO%u target quot=%u\n",
++				i, ro, vreg->corner[i].target_quot[ro],
++				i - 1, ro, vreg->corner[i - 1].target_quot[ro],
++				i, ro, vreg->corner[i - 1].target_quot[ro]);
++			vreg->corner[i].target_quot[ro]
++				= vreg->corner[i - 1].target_quot[ro];
++		}
++	}
++
++done:
++	kfree(volt_adjust);
++	kfree(volt_adjust_fuse);
++	kfree(ro_scale);
++	kfree(fmax_corner);
++	kfree(quot_low);
++	kfree(quot_high);
++	return rc;
++}
++
++/**
++ * cpr4_apss_print_settings() - print out APSS CPR configuration settings into
++ *		the kernel log for debugging purposes
++ * @vreg:		Pointer to the CPR3 regulator
++ */
++static void cpr4_apss_print_settings(struct cpr3_regulator *vreg)
++{
++	struct cpr3_corner *corner;
++	int i;
++
++	cpr3_debug(vreg, "Corner: Frequency (Hz), Fuse Corner, Floor (uV), Open-Loop (uV), Ceiling (uV)\n");
++	for (i = 0; i < vreg->corner_count; i++) {
++		corner = &vreg->corner[i];
++		cpr3_debug(vreg, "%3d: %10u, %2d, %7d, %7d, %7d\n",
++			i, corner->proc_freq, corner->cpr_fuse_corner,
++			corner->floor_volt, corner->open_loop_volt,
++			corner->ceiling_volt);
++	}
++
++	if (vreg->thread->ctrl->apm)
++		cpr3_debug(vreg, "APM threshold = %d uV, APM adjust = %d uV\n",
++			vreg->thread->ctrl->apm_threshold_volt,
++			vreg->thread->ctrl->apm_adj_volt);
++}
++
++/**
++ * cpr4_apss_init_thread() - perform steps necessary to initialize the
++ *		configuration data for a CPR3 thread
++ * @thread:		Pointer to the CPR3 thread
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_apss_init_thread(struct cpr3_thread *thread)
++{
++	int rc;
++
++	rc = cpr3_parse_common_thread_data(thread);
++	if (rc) {
++		cpr3_err(thread->ctrl, "thread %u unable to read CPR thread data from device tree, rc=%d\n",
++			thread->thread_id, rc);
++		return rc;
++	}
++
++	return 0;
++}
++
++/**
++ * cpr4_apss_parse_temp_adj_properties() - parse temperature based
++ *		adjustment properties from device tree.
++ * @ctrl:	Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_apss_parse_temp_adj_properties(struct cpr3_controller *ctrl)
++{
++	struct device_node *of_node = ctrl->dev->of_node;
++	int rc, i, len, temp_point_count;
++
++	if (!of_find_property(of_node, "qcom,cpr-temp-point-map", &len)) {
++		/*
++		 * Temperature based adjustments are not defined. Single
++		 * temperature band is still valid for per-online-core
++		 * adjustments.
++		 */
++		ctrl->temp_band_count = 1;
++		return 0;
++	}
++
++	temp_point_count = len / sizeof(u32);
++	if (temp_point_count <= 0 ||
++	    temp_point_count > IPQ807x_APSS_MAX_TEMP_POINTS) {
++		cpr3_err(ctrl, "invalid number of temperature points %d > %d (max)\n",
++			 temp_point_count, IPQ807x_APSS_MAX_TEMP_POINTS);
++		return -EINVAL;
++	}
++
++	ctrl->temp_points = devm_kcalloc(ctrl->dev, temp_point_count,
++					sizeof(*ctrl->temp_points), GFP_KERNEL);
++	if (!ctrl->temp_points)
++		return -ENOMEM;
++
++	rc = of_property_read_u32_array(of_node, "qcom,cpr-temp-point-map",
++					ctrl->temp_points, temp_point_count);
++	if (rc) {
++		cpr3_err(ctrl, "error reading property qcom,cpr-temp-point-map, rc=%d\n",
++			 rc);
++		return rc;
++	}
++
++	for (i = 0; i < temp_point_count; i++)
++		cpr3_debug(ctrl, "Temperature Point %d=%d\n", i,
++				   ctrl->temp_points[i]);
++
++	/*
++	 * If t1, t2, and t3 are the temperature points, then the temperature
++	 * bands are: (-inf, t1], (t1, t2], (t2, t3], and (t3, inf).
++	 */
++	ctrl->temp_band_count = temp_point_count + 1;
++	cpr3_debug(ctrl, "Number of temp bands =%d\n", ctrl->temp_band_count);
++
++	rc = of_property_read_u32(of_node, "qcom,cpr-initial-temp-band",
++				  &ctrl->initial_temp_band);
++	if (rc) {
++		cpr3_err(ctrl, "error reading qcom,cpr-initial-temp-band, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	if (ctrl->initial_temp_band >= ctrl->temp_band_count) {
++		cpr3_err(ctrl, "Initial temperature band value %d should be in range [0 - %d]\n",
++			ctrl->initial_temp_band, ctrl->temp_band_count - 1);
++		return -EINVAL;
++	}
++
++	ctrl->temp_sensor_id_start = IPQ807x_APSS_TEMP_SENSOR_ID_START;
++	ctrl->temp_sensor_id_end = IPQ807x_APSS_TEMP_SENSOR_ID_END;
++	ctrl->allow_temp_adj = true;
++	return rc;
++}
++
++/**
++ * cpr4_apss_parse_boost_properties() - parse configuration data for boost
++ *		voltage adjustment for CPR3 regulator from device tree.
++ * @vreg:	Pointer to the CPR3 regulator
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_apss_parse_boost_properties(struct cpr3_regulator *vreg)
++{
++	struct cpr3_controller *ctrl = vreg->thread->ctrl;
++	struct cpr4_ipq807x_apss_fuses *fuse = vreg->platform_fuses;
++	struct cpr3_corner *corner;
++	int i, boost_voltage, final_boost_volt, rc = 0;
++	int *boost_table = NULL, *boost_temp_adj = NULL;
++	int boost_voltage_adjust = 0, boost_num_cores = 0;
++	u32 boost_allowed = 0;
++
++	if (!boost_fuse[fuse->boost_cfg])
++		/* Voltage boost is disabled in fuse */
++		return 0;
++
++	if (of_find_property(vreg->of_node, "qcom,allow-boost", NULL)) {
++		rc = cpr3_parse_array_property(vreg, "qcom,allow-boost", 1,
++				&boost_allowed);
++		if (rc)
++			return rc;
++	}
++
++	if (!boost_allowed) {
++		/* Voltage boost is not enabled for this regulator */
++		return 0;
++	}
++
++	boost_voltage = cpr3_convert_open_loop_voltage_fuse(
++				vreg->cpr4_regulator_data->boost_fuse_ref_volt,
++				vreg->cpr4_regulator_data->fuse_step_volt,
++				fuse->boost_voltage,
++				IPQ807x_APSS_VOLTAGE_FUSE_SIZE);
++
++	/* Log boost voltage value for debugging purposes. */
++	cpr3_info(vreg, "Boost open-loop=%7d uV\n", boost_voltage);
++
++	if (of_find_property(vreg->of_node,
++			"qcom,cpr-boost-voltage-fuse-adjustment", NULL)) {
++		rc = cpr3_parse_array_property(vreg,
++			"qcom,cpr-boost-voltage-fuse-adjustment",
++			1, &boost_voltage_adjust);
++		if (rc) {
++			cpr3_err(vreg, "qcom,cpr-boost-voltage-fuse-adjustment reading failed, rc=%d\n",
++				rc);
++			return rc;
++		}
++
++		boost_voltage += boost_voltage_adjust;
++		/* Log boost voltage value for debugging purposes. */
++		cpr3_info(vreg, "Adjusted boost open-loop=%7d uV\n",
++			boost_voltage);
++	}
++
++	/* Limit boost voltage value between ceiling and floor voltage limits */
++	boost_voltage = min(boost_voltage, vreg->cpr4_regulator_data->boost_ceiling_volt);
++	boost_voltage = max(boost_voltage, vreg->cpr4_regulator_data->boost_floor_volt);
++
++	/*
++	 * The boost feature can only be used for the highest voltage corner.
++	 * Also, keep core-count adjustments disabled when the boost feature
++	 * is enabled.
++	 */
++	corner = &vreg->corner[vreg->corner_count - 1];
++	if (!corner->sdelta) {
++		/*
++		 * If core-count/temp adjustments are not defined, the cpr4
++		 * sdelta for this corner will not be allocated. Allocate it
++		 * here for boost configuration.
++		 */
++		corner->sdelta = devm_kzalloc(ctrl->dev,
++					sizeof(*corner->sdelta), GFP_KERNEL);
++		if (!corner->sdelta)
++			return -ENOMEM;
++	}
++	corner->sdelta->temp_band_count = ctrl->temp_band_count;
++
++	rc = of_property_read_u32(vreg->of_node, "qcom,cpr-num-boost-cores",
++				&boost_num_cores);
++	if (rc) {
++		cpr3_err(vreg, "qcom,cpr-num-boost-cores reading failed, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	if (boost_num_cores <= 0 ||
++	    boost_num_cores > IPQ807x_APSS_CPR_SDELTA_CORE_COUNT) {
++		cpr3_err(vreg, "Invalid boost number of cores = %d\n",
++			boost_num_cores);
++		return -EINVAL;
++	}
++	corner->sdelta->boost_num_cores = boost_num_cores;
++
++	boost_table = devm_kcalloc(ctrl->dev, corner->sdelta->temp_band_count,
++					sizeof(*boost_table), GFP_KERNEL);
++	if (!boost_table)
++		return -ENOMEM;
++
++	if (of_find_property(vreg->of_node,
++				"qcom,cpr-boost-temp-adjustment", NULL)) {
++		boost_temp_adj = kcalloc(corner->sdelta->temp_band_count,
++					sizeof(*boost_temp_adj), GFP_KERNEL);
++		if (!boost_temp_adj)
++			return -ENOMEM;
++
++		rc = cpr3_parse_array_property(vreg,
++				"qcom,cpr-boost-temp-adjustment",
++				corner->sdelta->temp_band_count,
++				boost_temp_adj);
++		if (rc) {
++			cpr3_err(vreg, "qcom,cpr-boost-temp-adjustment reading failed, rc=%d\n",
++				rc);
++			goto done;
++		}
++	}
++
++	for (i = 0; i < corner->sdelta->temp_band_count; i++) {
++		/* Apply static adjustments to boost voltage */
++		final_boost_volt = boost_voltage + (boost_temp_adj == NULL
++						? 0 : boost_temp_adj[i]);
++		/*
++		 * Limit final adjusted boost voltage value between ceiling
++		 * and floor voltage limits
++		 */
++		final_boost_volt = min(final_boost_volt,
++					vreg->cpr4_regulator_data->boost_ceiling_volt);
++		final_boost_volt = max(final_boost_volt,
++					vreg->cpr4_regulator_data->boost_floor_volt);
++
++		boost_table[i] = (corner->open_loop_volt - final_boost_volt)
++					/ ctrl->step_volt;
++		cpr3_debug(vreg, "Adjusted boost voltage margin for temp band %d = %d steps\n",
++			i, boost_table[i]);
++	}
++
++	corner->ceiling_volt = vreg->cpr4_regulator_data->boost_ceiling_volt;
++	corner->sdelta->boost_table = boost_table;
++	corner->sdelta->allow_boost = true;
++	corner->sdelta->allow_core_count_adj = false;
++	vreg->allow_boost = true;
++	ctrl->allow_boost = true;
++done:
++	kfree(boost_temp_adj);
++	return rc;
++}
++
++/**
++ * cpr4_apss_init_regulator() - perform all steps necessary to initialize the
++ *		configuration data for a CPR3 regulator
++ * @vreg:		Pointer to the CPR3 regulator
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_apss_init_regulator(struct cpr3_regulator *vreg)
++{
++	struct cpr4_ipq807x_apss_fuses *fuse;
++	int rc;
++
++	rc = cpr4_ipq807x_apss_read_fuse_data(vreg);
++	if (rc) {
++		cpr3_err(vreg, "unable to read CPR fuse data, rc=%d\n", rc);
++		return rc;
++	}
++
++	fuse = vreg->platform_fuses;
++
++	rc = cpr4_apss_parse_corner_data(vreg);
++	if (rc) {
++		cpr3_err(vreg, "unable to read CPR corner data from device tree, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	rc = cpr3_mem_acc_init(vreg);
++	if (rc) {
++		if (rc != -EPROBE_DEFER)
++			cpr3_err(vreg, "unable to initialize mem-acc regulator settings, rc=%d\n",
++				 rc);
++		return rc;
++	}
++
++	rc = cpr4_ipq807x_apss_calculate_open_loop_voltages(vreg);
++	if (rc) {
++		cpr3_err(vreg, "unable to calculate open-loop voltages, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	rc = cpr3_limit_open_loop_voltages(vreg);
++	if (rc) {
++		cpr3_err(vreg, "unable to limit open-loop voltages, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	cpr3_open_loop_voltage_as_ceiling(vreg);
++
++	rc = cpr3_limit_floor_voltages(vreg);
++	if (rc) {
++		cpr3_err(vreg, "unable to limit floor voltages, rc=%d\n", rc);
++		return rc;
++	}
++
++	rc = cpr4_ipq807x_apss_calculate_target_quotients(vreg);
++	if (rc) {
++		cpr3_err(vreg, "unable to calculate target quotients, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	rc = cpr4_parse_core_count_temp_voltage_adj(vreg, false);
++	if (rc) {
++		cpr3_err(vreg, "unable to parse temperature and core count voltage adjustments, rc=%d\n",
++			 rc);
++		return rc;
++	}
++
++	if (vreg->allow_core_count_adj && (vreg->max_core_count <= 0
++				   || vreg->max_core_count >
++				   IPQ807x_APSS_CPR_SDELTA_CORE_COUNT)) {
++		cpr3_err(vreg, "qcom,max-core-count has invalid value = %d\n",
++			 vreg->max_core_count);
++		return -EINVAL;
++	}
++
++	rc = cpr4_apss_parse_boost_properties(vreg);
++	if (rc) {
++		cpr3_err(vreg, "unable to parse boost adjustments, rc=%d\n",
++			 rc);
++		return rc;
++	}
++
++	cpr4_apss_print_settings(vreg);
++
++	return rc;
++}
++
++/**
++ * cpr4_apss_init_controller() - perform APSS CPR4 controller specific
++ *		initializations
++ * @ctrl:		Pointer to the CPR3 controller
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int cpr4_apss_init_controller(struct cpr3_controller *ctrl)
++{
++	int rc;
++
++	rc = cpr3_parse_common_ctrl_data(ctrl);
++	if (rc) {
++		if (rc != -EPROBE_DEFER)
++			cpr3_err(ctrl, "unable to parse common controller data, rc=%d\n",
++				rc);
++		return rc;
++	}
++
++	rc = of_property_read_u32(ctrl->dev->of_node,
++				  "qcom,cpr-down-error-step-limit",
++				  &ctrl->down_error_step_limit);
++	if (rc) {
++		cpr3_err(ctrl, "error reading qcom,cpr-down-error-step-limit, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	rc = of_property_read_u32(ctrl->dev->of_node,
++				  "qcom,cpr-up-error-step-limit",
++				  &ctrl->up_error_step_limit);
++	if (rc) {
++		cpr3_err(ctrl, "error reading qcom,cpr-up-error-step-limit, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	/*
++	 * Use fixed step quotient if specified otherwise use dynamic
++	 * calculated per RO step quotient
++	 */
++	of_property_read_u32(ctrl->dev->of_node, "qcom,cpr-step-quot-fixed",
++			&ctrl->step_quot_fixed);
++	ctrl->use_dynamic_step_quot = ctrl->step_quot_fixed ? false : true;
++
++	ctrl->saw_use_unit_mV = of_property_read_bool(ctrl->dev->of_node,
++					"qcom,cpr-saw-use-unit-mV");
++
++	of_property_read_u32(ctrl->dev->of_node,
++			"qcom,cpr-voltage-settling-time",
++			&ctrl->voltage_settling_time);
++
++	if (of_find_property(ctrl->dev->of_node, "vdd-limit-supply", NULL)) {
++		ctrl->vdd_limit_regulator =
++			devm_regulator_get(ctrl->dev, "vdd-limit");
++		if (IS_ERR(ctrl->vdd_limit_regulator)) {
++			rc = PTR_ERR(ctrl->vdd_limit_regulator);
++			if (rc != -EPROBE_DEFER)
++				cpr3_err(ctrl, "unable to request vdd-limit regulator, rc=%d\n",
++					 rc);
++			return rc;
++		}
++	}
++
++	rc = cpr3_apm_init(ctrl);
++	if (rc) {
++		if (rc != -EPROBE_DEFER)
++			cpr3_err(ctrl, "unable to initialize APM settings, rc=%d\n",
++				rc);
++		return rc;
++	}
++
++	rc = cpr4_apss_parse_temp_adj_properties(ctrl);
++	if (rc) {
++		cpr3_err(ctrl, "unable to parse temperature adjustment properties, rc=%d\n",
++			 rc);
++		return rc;
++	}
++
++	ctrl->sensor_count = IPQ807x_APSS_CPR_SENSOR_COUNT;
++
++	/*
++	 * APSS only has one thread (0) per controller so the zeroed
++	 * array does not need further modification.
++	 */
++	ctrl->sensor_owner = devm_kcalloc(ctrl->dev, ctrl->sensor_count,
++		sizeof(*ctrl->sensor_owner), GFP_KERNEL);
++	if (!ctrl->sensor_owner)
++		return -ENOMEM;
++
++	ctrl->ctrl_type = CPR_CTRL_TYPE_CPR4;
++	ctrl->supports_hw_closed_loop = false;
++	ctrl->use_hw_closed_loop = of_property_read_bool(ctrl->dev->of_node,
++						"qcom,cpr-hw-closed-loop");
++	return 0;
++}
++
++static int cpr4_apss_regulator_suspend(struct platform_device *pdev,
++				pm_message_t state)
++{
++	struct cpr3_controller *ctrl = platform_get_drvdata(pdev);
++
++	return cpr3_regulator_suspend(ctrl);
++}
++
++static int cpr4_apss_regulator_resume(struct platform_device *pdev)
++{
++	struct cpr3_controller *ctrl = platform_get_drvdata(pdev);
++
++	return cpr3_regulator_resume(ctrl);
++}
++
++static void ipq6018_set_mem_acc(struct regulator_dev *rdev)
++{
++	struct cpr3_regulator *vreg = rdev_get_drvdata(rdev);
++
++	ipq6018_mem_acc_tcsr[0].ioremap_addr =
++		ioremap(ipq6018_mem_acc_tcsr[0].phy_addr, 0x4);
++	ipq6018_mem_acc_tcsr[1].ioremap_addr =
++		ioremap(ipq6018_mem_acc_tcsr[1].phy_addr, 0x4);
++
++	if ((ipq6018_mem_acc_tcsr[0].ioremap_addr != NULL) &&
++			(ipq6018_mem_acc_tcsr[1].ioremap_addr != NULL) &&
++			(vreg->current_corner == (vreg->corner_count - CPR3_CORNER_OFFSET))) {
++
++		writel_relaxed(ipq6018_mem_acc_tcsr[0].value,
++				ipq6018_mem_acc_tcsr[0].ioremap_addr);
++		writel_relaxed(ipq6018_mem_acc_tcsr[1].value,
++				ipq6018_mem_acc_tcsr[1].ioremap_addr);
++	}
++}
++
++static void ipq6018_clr_mem_acc(struct regulator_dev *rdev)
++{
++	struct cpr3_regulator *vreg = rdev_get_drvdata(rdev);
++
++	if ((ipq6018_mem_acc_tcsr[0].ioremap_addr != NULL) &&
++			(ipq6018_mem_acc_tcsr[1].ioremap_addr != NULL) &&
++			(vreg->current_corner != vreg->corner_count - CPR3_CORNER_OFFSET)) {
++		writel_relaxed(0x0, ipq6018_mem_acc_tcsr[0].ioremap_addr);
++		writel_relaxed(0x0, ipq6018_mem_acc_tcsr[1].ioremap_addr);
++	}
++
++	iounmap(ipq6018_mem_acc_tcsr[0].ioremap_addr);
++	iounmap(ipq6018_mem_acc_tcsr[1].ioremap_addr);
++}
++
++static struct cpr4_mem_acc_func ipq6018_mem_acc_funcs = {
++	.set_mem_acc = ipq6018_set_mem_acc,
++	.clear_mem_acc = ipq6018_clr_mem_acc
++};
++
++static const struct cpr4_reg_data ipq807x_cpr_apss = {
++	.cpr_valid_fuse_count = IPQ807x_APSS_FUSE_CORNERS,
++	.fuse_ref_volt = ipq807x_apss_fuse_ref_volt,
++	.fuse_step_volt = IPQ807x_APSS_FUSE_STEP_VOLT,
++	.cpr_clk_rate = IPQ807x_APSS_CPR_CLOCK_RATE,
++	.boost_fuse_ref_volt= IPQ807x_APSS_BOOST_FUSE_REF_VOLT,
++	.boost_ceiling_volt= IPQ807x_APSS_BOOST_CEILING_VOLT,
++	.boost_floor_volt= IPQ807x_APSS_BOOST_FLOOR_VOLT,
++	.cpr3_fuse_params = &ipq807x_fuse_params,
++	.mem_acc_funcs = NULL,
++};
++
++static const struct cpr4_reg_data ipq817x_cpr_apss = {
++	.cpr_valid_fuse_count = IPQ817x_APPS_FUSE_CORNERS,
++	.fuse_ref_volt = ipq807x_apss_fuse_ref_volt,
++	.fuse_step_volt = IPQ807x_APSS_FUSE_STEP_VOLT,
++	.cpr_clk_rate = IPQ807x_APSS_CPR_CLOCK_RATE,
++	.boost_fuse_ref_volt= IPQ807x_APSS_BOOST_FUSE_REF_VOLT,
++	.boost_ceiling_volt= IPQ807x_APSS_BOOST_CEILING_VOLT,
++	.boost_floor_volt= IPQ807x_APSS_BOOST_FLOOR_VOLT,
++	.cpr3_fuse_params = &ipq807x_fuse_params,
++	.mem_acc_funcs = NULL,
++};
++
++static const struct cpr4_reg_data ipq6018_cpr_apss = {
++	.cpr_valid_fuse_count = IPQ6018_APSS_FUSE_CORNERS,
++	.fuse_ref_volt = ipq6018_apss_fuse_ref_volt,
++	.fuse_step_volt = IPQ6018_APSS_FUSE_STEP_VOLT,
++	.cpr_clk_rate = IPQ6018_APSS_CPR_CLOCK_RATE,
++	.boost_fuse_ref_volt = IPQ6018_APSS_BOOST_FUSE_REF_VOLT,
++	.boost_ceiling_volt = IPQ6018_APSS_BOOST_CEILING_VOLT,
++	.boost_floor_volt = IPQ6018_APSS_BOOST_FLOOR_VOLT,
++	.cpr3_fuse_params = &ipq6018_fuse_params,
++	.mem_acc_funcs = &ipq6018_mem_acc_funcs,
++};
++
++static const struct cpr4_reg_data ipq9574_cpr_apss = {
++	.cpr_valid_fuse_count = IPQ9574_APSS_FUSE_CORNERS,
++	.fuse_ref_volt = ipq9574_apss_fuse_ref_volt,
++	.fuse_step_volt = IPQ9574_APSS_FUSE_STEP_VOLT,
++	.cpr_clk_rate = IPQ6018_APSS_CPR_CLOCK_RATE,
++	.boost_fuse_ref_volt = IPQ6018_APSS_BOOST_FUSE_REF_VOLT,
++	.boost_ceiling_volt = IPQ6018_APSS_BOOST_CEILING_VOLT,
++	.boost_floor_volt = IPQ6018_APSS_BOOST_FLOOR_VOLT,
++	.cpr3_fuse_params = &ipq9574_fuse_params,
++	.mem_acc_funcs = NULL,
++};
++
++static struct of_device_id cpr4_regulator_match_table[] = {
++	{
++		.compatible = "qcom,cpr4-ipq807x-apss-regulator",
++		.data = &ipq807x_cpr_apss
++	},
++	{
++		.compatible = "qcom,cpr4-ipq817x-apss-regulator",
++		.data = &ipq817x_cpr_apss
++	},
++	{
++		.compatible = "qcom,cpr4-ipq6018-apss-regulator",
++		.data = &ipq6018_cpr_apss
++	},
++	{
++		.compatible = "qcom,cpr4-ipq9574-apss-regulator",
++		.data = &ipq9574_cpr_apss
++	},
++	{}
++};
++
++static int cpr4_apss_regulator_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct cpr3_controller *ctrl;
++	const struct of_device_id *match;
++	struct cpr4_reg_data *cpr_data;
++	int i, rc;
++
++	if (!dev->of_node) {
++		dev_err(dev, "Device tree node is missing\n");
++		return -EINVAL;
++	}
++
++	ctrl = devm_kzalloc(dev, sizeof(*ctrl), GFP_KERNEL);
++	if (!ctrl)
++		return -ENOMEM;
++
++	match = of_match_device(cpr4_regulator_match_table, &pdev->dev);
++	if (!match)
++		return -ENODEV;
++
++	cpr_data = (struct cpr4_reg_data *)match->data;
++	g_valid_fuse_count = cpr_data->cpr_valid_fuse_count;
++	dev_info(dev, "CPR valid fuse count: %d\n", g_valid_fuse_count);
++	ctrl->cpr_clock_rate = cpr_data->cpr_clk_rate;
++
++	ctrl->dev = dev;
++	/* Set to false later if anything precludes CPR operation. */
++	ctrl->cpr_allowed_hw = true;
++
++	rc = of_property_read_string(dev->of_node, "qcom,cpr-ctrl-name",
++					&ctrl->name);
++	if (rc) {
++		cpr3_err(ctrl, "unable to read qcom,cpr-ctrl-name, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	rc = cpr3_map_fuse_base(ctrl, pdev);
++	if (rc) {
++		cpr3_err(ctrl, "could not map fuse base address\n");
++		return rc;
++	}
++
++	rc = cpr3_read_tcsr_setting(ctrl, pdev, IPQ807x_APSS_CPR_TCSR_START,
++				    IPQ807x_APSS_CPR_TCSR_END);
++	if (rc) {
++		cpr3_err(ctrl, "could not read CPR tcsr setting\n");
++		return rc;
++	}
++
++	rc = cpr3_allocate_threads(ctrl, 0, 0);
++	if (rc) {
++		cpr3_err(ctrl, "failed to allocate CPR thread array, rc=%d\n",
++			rc);
++		return rc;
++	}
++
++	if (ctrl->thread_count != 1) {
++		cpr3_err(ctrl, "expected 1 thread but found %d\n",
++			ctrl->thread_count);
++		return -EINVAL;
++	}
++
++	rc = cpr4_apss_init_controller(ctrl);
++	if (rc) {
++		if (rc != -EPROBE_DEFER)
++			cpr3_err(ctrl, "failed to initialize CPR controller parameters, rc=%d\n",
++				rc);
++		return rc;
++	}
++
++	rc = cpr4_apss_init_thread(&ctrl->thread[0]);
++	if (rc) {
++		cpr3_err(ctrl, "thread initialization failed, rc=%d\n", rc);
++		return rc;
++	}
++
++	for (i = 0; i < ctrl->thread[0].vreg_count; i++) {
++		ctrl->thread[0].vreg[i].cpr4_regulator_data = cpr_data;
++		rc = cpr4_apss_init_regulator(&ctrl->thread[0].vreg[i]);
++		if (rc) {
++			cpr3_err(&ctrl->thread[0].vreg[i], "regulator initialization failed, rc=%d\n",
++				 rc);
++			return rc;
++		}
++	}
++
++	platform_set_drvdata(pdev, ctrl);
++
++	return cpr3_regulator_register(pdev, ctrl);
++}
++
++static void cpr4_apss_regulator_remove(struct platform_device *pdev)
++{
++	struct cpr3_controller *ctrl = platform_get_drvdata(pdev);
++
++	cpr3_regulator_unregister(ctrl);
++}
++
++static struct platform_driver cpr4_apss_regulator_driver = {
++	.driver		= {
++		.name		= "qcom,cpr4-apss-regulator",
++		.of_match_table	= cpr4_regulator_match_table,
++	},
++	.probe		= cpr4_apss_regulator_probe,
++	.remove_new	= cpr4_apss_regulator_remove,
++	.suspend	= cpr4_apss_regulator_suspend,
++	.resume		= cpr4_apss_regulator_resume,
++};
++
++static int cpr4_regulator_init(void)
++{
++	return platform_driver_register(&cpr4_apss_regulator_driver);
++}
++
++static void cpr4_regulator_exit(void)
++{
++	platform_driver_unregister(&cpr4_apss_regulator_driver);
++}
++
++MODULE_DESCRIPTION("CPR4 APSS regulator driver");
++MODULE_LICENSE("GPL v2");
++
++arch_initcall(cpr4_regulator_init);
++module_exit(cpr4_regulator_exit);
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0902-arm64-dts-ipq8074-add-label-to-clocks.patch b/6.12/target/linux/qualcommax/patches-6.12/0902-arm64-dts-ipq8074-add-label-to-clocks.patch
new file mode 100644
index 00000000..9b8b4df1
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0902-arm64-dts-ipq8074-add-label-to-clocks.patch
@@ -0,0 +1,24 @@
+From 6baf7e4abcea6f7ac21eccf072a20078b39d064c Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Wed, 9 Feb 2022 23:13:26 +0100
+Subject: [PATCH] arm64: dts: ipq8074: add label to clocks
+
+Add label to clocks node as that makes it easy to add the NSS fixed
+clocks that are required in their DTSI.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -15,7 +15,7 @@
+ 	compatible = "qcom,ipq8074";
+ 	interrupt-parent = <&intc>;
+ 
+-	clocks {
++	clocks: clocks {
+ 		sleep_clk: sleep_clk {
+ 			compatible = "fixed-clock";
+ 			clock-frequency = <32768>;
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0903-psci-dont-advertise-OSI-support-for-IPQ6018.patch b/6.12/target/linux/qualcommax/patches-6.12/0903-psci-dont-advertise-OSI-support-for-IPQ6018.patch
new file mode 100644
index 00000000..5fcb9009
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0903-psci-dont-advertise-OSI-support-for-IPQ6018.patch
@@ -0,0 +1,40 @@
+From 563db68137475d011b355bfe674d1b7a24778091 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Sat, 8 Oct 2022 22:26:31 +0200
+Subject: [PATCH] psci: dont advertise OSI support for IPQ6018
+
+Some older IPQ60xx SoC series boards ship with TrustZone/QSEE firmware
+older than TZ.WNS.5.1-00084 which will advertise OSI[1] but are broken
+and trying to use OSI will cause the board to hang until WDT kicks in.
+
+So workaround it by checking for SoC compatible and returning false so
+OSI is not used.
+
+[1] https://www.spinics.net/lists/linux-arm-msm/msg79916.html
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ drivers/firmware/psci/psci.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/firmware/psci/psci.c
++++ b/drivers/firmware/psci/psci.c
+@@ -87,6 +87,18 @@ static inline bool psci_has_ext_power_st
+ 
+ bool psci_has_osi_support(void)
+ {
++	/*
++	 * Some older IPQ60xx SoC series boards ship with
++	 * TrustZone/QSEE firmware older than TZ.WNS.5.1-00084
++	 * which will advertise OSI but is broken and trying
++	 * to use OSI will cause the board to hang until WDT
++	 * kicks in.
++	 * So workaround it by checking for SoC compatible
++	 * and returning false so OSI is not used.
++	 */
++	if (of_machine_is_compatible("qcom,ipq6018"))
++		return false;
++
+ 	return psci_cpu_suspend_feature & PSCI_1_0_OS_INITIATED;
+ }
+ 
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0904-clk-qcom-ipq6018-workaround-networking-clock-parenti.patch b/6.12/target/linux/qualcommax/patches-6.12/0904-clk-qcom-ipq6018-workaround-networking-clock-parenti.patch
new file mode 100644
index 00000000..2e7a56f7
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0904-clk-qcom-ipq6018-workaround-networking-clock-parenti.patch
@@ -0,0 +1,109 @@
+From 0c5b5243ad55ae744e790ba90c5ad37a93bd1377 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Tue, 11 Oct 2022 23:38:45 +0200
+Subject: [PATCH] clk: qcom: ipq6018: workaround networking clock parenting
+
+Currently, networking clocks are only looked up by fw_name however,
+these are registered and setup by SSDK and are not available to the
+GCC driver at all, so work around that by providing a global name
+fallback.
+
+While we are here, provide global fallback for bias_pll_cc_clk and
+bias_pll_nss_noc_clk as well as these are fixed clocks also not available
+to the driver.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ drivers/clk/qcom/gcc-ipq6018.c | 39 +++++++++++++++++-----------------
+ 1 file changed, 19 insertions(+), 20 deletions(-)
+
+--- a/drivers/clk/qcom/gcc-ipq6018.c
++++ b/drivers/clk/qcom/gcc-ipq6018.c
+@@ -360,7 +360,7 @@ static const struct freq_tbl ftbl_nss_pp
+ 
+ static const struct clk_parent_data gcc_xo_bias_gpll0_gpll4_nss_ubi32[] = {
+ 	{ .fw_name = "xo" },
+-	{ .fw_name = "bias_pll_cc_clk" },
++	{ .fw_name = "bias_pll_cc_clk", .name = "bias_pll_cc_clk" },
+ 	{ .hw = &gpll0.clkr.hw },
+ 	{ .hw = &gpll4.clkr.hw },
+ 	{ .hw = &nss_crypto_pll.clkr.hw },
+@@ -526,12 +526,12 @@ static const struct freq_tbl ftbl_nss_po
+ static const struct clk_parent_data
+ gcc_xo_uniphy0_rx_tx_uniphy1_rx_tx_ubi32_bias[] = {
+ 	{ .fw_name = "xo" },
+-	{ .fw_name = "uniphy0_gcc_rx_clk" },
+-	{ .fw_name = "uniphy0_gcc_tx_clk" },
+-	{ .fw_name = "uniphy1_gcc_rx_clk" },
+-	{ .fw_name = "uniphy1_gcc_tx_clk" },
++	{ .fw_name = "uniphy0_gcc_rx_clk", .name = "uniphy0_gcc_rx_clk" },
++	{ .fw_name = "uniphy0_gcc_tx_clk", .name = "uniphy0_gcc_tx_clk" },
++	{ .fw_name = "uniphy1_gcc_rx_clk", .name = "uniphy1_gcc_rx_clk" },
++	{ .fw_name = "uniphy1_gcc_tx_clk", .name = "uniphy1_gcc_tx_clk" },
+ 	{ .hw = &ubi32_pll.clkr.hw },
+-	{ .fw_name = "bias_pll_cc_clk" },
++	{ .fw_name = "bias_pll_cc_clk", .name = "bias_pll_cc_clk" },
+ };
+ 
+ static const struct parent_map
+@@ -573,12 +573,12 @@ static const struct freq_tbl ftbl_nss_po
+ static const struct clk_parent_data
+ gcc_xo_uniphy0_tx_rx_uniphy1_tx_rx_ubi32_bias[] = {
+ 	{ .fw_name = "xo" },
+-	{ .fw_name = "uniphy0_gcc_tx_clk" },
+-	{ .fw_name = "uniphy0_gcc_rx_clk" },
+-	{ .fw_name = "uniphy1_gcc_tx_clk" },
+-	{ .fw_name = "uniphy1_gcc_rx_clk" },
++	{ .fw_name = "uniphy0_gcc_tx_clk", .name = "uniphy0_gcc_tx_clk" },
++	{ .fw_name = "uniphy0_gcc_rx_clk", .name = "uniphy0_gcc_rx_clk" },
++	{ .fw_name = "uniphy1_gcc_tx_clk", .name = "uniphy1_gcc_tx_clk" },
++	{ .fw_name = "uniphy1_gcc_rx_clk", .name = "uniphy1_gcc_rx_clk" },
+ 	{ .hw = &ubi32_pll.clkr.hw },
+-	{ .fw_name = "bias_pll_cc_clk" },
++	{ .fw_name = "bias_pll_cc_clk", .name = "bias_pll_cc_clk" },
+ };
+ 
+ static const struct parent_map
+@@ -714,10 +714,10 @@ static const struct freq_tbl ftbl_nss_po
+ 
+ static const struct clk_parent_data gcc_xo_uniphy0_rx_tx_ubi32_bias[] = {
+ 	{ .fw_name = "xo" },
+-	{ .fw_name = "uniphy0_gcc_rx_clk" },
+-	{ .fw_name = "uniphy0_gcc_tx_clk" },
++	{ .fw_name = "uniphy0_gcc_rx_clk", .name = "uniphy0_gcc_rx_clk" },
++	{ .fw_name = "uniphy0_gcc_tx_clk", .name = "uniphy0_gcc_tx_clk" },
+ 	{ .hw = &ubi32_pll.clkr.hw },
+-	{ .fw_name = "bias_pll_cc_clk" },
++	{ .fw_name = "bias_pll_cc_clk", .name = "bias_pll_cc_clk" },
+ };
+ 
+ static const struct parent_map gcc_xo_uniphy0_rx_tx_ubi32_bias_map[] = {
+@@ -750,10 +750,10 @@ static const struct freq_tbl ftbl_nss_po
+ 
+ static const struct clk_parent_data gcc_xo_uniphy0_tx_rx_ubi32_bias[] = {
+ 	{ .fw_name = "xo" },
+-	{ .fw_name = "uniphy0_gcc_tx_clk" },
+-	{ .fw_name = "uniphy0_gcc_rx_clk" },
++	{ .fw_name = "uniphy0_gcc_tx_clk", .name = "uniphy0_gcc_tx_clk" },
++	{ .fw_name = "uniphy0_gcc_rx_clk", .name = "uniphy0_gcc_rx_clk" },
+ 	{ .hw = &ubi32_pll.clkr.hw },
+-	{ .fw_name = "bias_pll_cc_clk" },
++	{ .fw_name = "bias_pll_cc_clk", .name = "bias_pll_cc_clk" },
+ };
+ 
+ static const struct parent_map gcc_xo_uniphy0_tx_rx_ubi32_bias_map[] = {
+@@ -1899,12 +1899,11 @@ static const struct freq_tbl ftbl_ubi32_
+ 	{ }
+ };
+ 
+-static const struct clk_parent_data
+-			gcc_xo_gpll0_gpll2_bias_pll_nss_noc_clk[] = {
++static const struct clk_parent_data gcc_xo_gpll0_gpll2_bias_pll_nss_noc_clk[] = {
+ 	{ .fw_name = "xo" },
+ 	{ .hw = &gpll0.clkr.hw },
+ 	{ .hw = &gpll2.clkr.hw },
+-	{ .fw_name = "bias_pll_nss_noc_clk" },
++	{ .fw_name = "bias_pll_nss_noc_clk", .name = "bias_pll_nss_noc_clk" },
+ };
+ 
+ static const struct parent_map gcc_xo_gpll0_gpll2_bias_pll_nss_noc_clk_map[] = {
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0905-remoteproc-q6v5_wcss-change-ssr-name-for-ipq6018-wif.patch b/6.12/target/linux/qualcommax/patches-6.12/0905-remoteproc-q6v5_wcss-change-ssr-name-for-ipq6018-wif.patch
new file mode 100644
index 00000000..af7f45cc
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0905-remoteproc-q6v5_wcss-change-ssr-name-for-ipq6018-wif.patch
@@ -0,0 +1,41 @@
+From 505f9c8653fc218ca47a153ec58ebc16bef5502f Mon Sep 17 00:00:00 2001
+From: Mantas Pucka <mantas@8devices.com>
+Date: Tue, 16 Jan 2024 10:42:40 +0200
+Subject: [PATCH 16/19] remoteproc: q6v5_wcss: change ssr name for ipq6018 wifi
+ subsystem
+
+On IPQ6018 this string ends up being sent to RPM when remoteproc stops
+(on crash or rmmod ath11k). "q6wcss" is not a valid name (not found by
+`strings` in rpm.mbn), so this causes RPM do 'something' (presumably crash)
+causing a system reboot followed by hang in XBL, with no WDT running.
+Let's change ssr_name to a more sensible 'wcnss', that does not cause such
+issues.
+
+Signed-off-by: Mantas Pucka <mantas@8devices.com>
+---
+ drivers/remoteproc/qcom_q6v5_wcss.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/remoteproc/qcom_q6v5_wcss.c
++++ b/drivers/remoteproc/qcom_q6v5_wcss.c
+@@ -1143,9 +1143,9 @@ static int q6v5_wcss_probe(struct platfo
+ 	if (ret)
+ 		return ret;
+ 
+-	qcom_add_glink_subdev(rproc, &wcss->glink_subdev, "q6wcss");
++	qcom_add_glink_subdev(rproc, &wcss->glink_subdev, desc->ssr_name);
+ 	qcom_add_pdm_subdev(rproc, &wcss->pdm_subdev);
+-	qcom_add_ssr_subdev(rproc, &wcss->ssr_subdev, "q6wcss");
++	qcom_add_ssr_subdev(rproc, &wcss->ssr_subdev, desc->ssr_name);
+ 
+ 	if (desc->ssctl_id)
+ 		wcss->sysmon = qcom_add_sysmon_subdev(rproc,
+@@ -1195,7 +1195,7 @@ static const struct wcss_data wcss_ipq60
+ 	.aon_reset_required = true,
+ 	.wcss_q6_reset_required = true,
+ 	.bcr_reset_required = false,
+-	.ssr_name = "q6wcss",
++	.ssr_name = "wcnss",
+ 	.ops = &q6v5_wcss_ipq8074_ops,
+ 	.requires_force_stop = true,
+ 	.need_mem_protection = true,
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0906-arm64-dts-qcom-ipq6018-add-wifi-node.patch b/6.12/target/linux/qualcommax/patches-6.12/0906-arm64-dts-qcom-ipq6018-add-wifi-node.patch
new file mode 100644
index 00000000..60120359
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0906-arm64-dts-qcom-ipq6018-add-wifi-node.patch
@@ -0,0 +1,120 @@
+From 153c74fc80b9f33ed1a50d7790bf6979fdceb370 Mon Sep 17 00:00:00 2001
+From: Mantas Pucka <mantas@8devices.com>
+Date: Tue, 16 Jan 2024 11:41:06 +0200
+Subject: [PATCH 19/19] arm64: dts: qcom: ipq6018: add wifi node
+
+IPQ6018 has a AHB based Q6v5 802.11ax radios that are supported
+by the ath11k.
+
+Add the required DT node to enable the built-in radios.
+
+Signed-off-by: Mantas Pucka <mantas@8devices.com>
+---
+ arch/arm64/boot/dts/qcom/ipq6018.dtsi | 96 +++++++++++++++++++++++++++++++++++
+ 1 file changed, 96 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+@@ -826,6 +826,102 @@
+ 			};
+ 		};
+ 
++		wifi: wifi@c000000 {
++			compatible = "qcom,ipq6018-wifi";
++			reg = <0x0 0xc000000 0x0 0x1000000>;
++			qcom,rproc = <&q6v5_wcss>;
++			interrupts = <GIC_SPI 320 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 319 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 318 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 317 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 316 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 315 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 314 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 311 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 310 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 411 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 410 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 40 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 39 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 302 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 301 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 37 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 36 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 296 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 295 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 294 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 293 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 292 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 291 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 290 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 289 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 288 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 239 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 236 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 235 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 234 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 233 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 232 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 231 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 230 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 229 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 228 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 224 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 223 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 203 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 183 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 180 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 179 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 178 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 177 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 176 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 163 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 162 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 160 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 159 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 158 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 157 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 156 IRQ_TYPE_EDGE_RISING>;
++			interrupt-names = "misc-pulse1", "misc-latch", "sw-exception",
++					  "watchdog", "ce0", "ce1", "ce2", "ce3", "ce4",
++					  "ce5", "ce6", "ce7", "ce8", "ce9", "ce10",
++					  "ce11", "host2wbm-desc-feed",
++					  "host2reo-re-injection", "host2reo-command",
++					  "host2rxdma-monitor-ring3",
++					  "host2rxdma-monitor-ring2",
++					  "host2rxdma-monitor-ring1",
++					  "reo2ost-exception", "wbm2host-rx-release",
++					  "reo2host-status",
++					  "reo2host-destination-ring4",
++					  "reo2host-destination-ring3",
++					  "reo2host-destination-ring2",
++					  "reo2host-destination-ring1",
++					  "rxdma2host-monitor-destination-mac3",
++					  "rxdma2host-monitor-destination-mac2",
++					  "rxdma2host-monitor-destination-mac1",
++					  "ppdu-end-interrupts-mac3",
++					  "ppdu-end-interrupts-mac2",
++					  "ppdu-end-interrupts-mac1",
++					  "rxdma2host-monitor-status-ring-mac3",
++					  "rxdma2host-monitor-status-ring-mac2",
++					  "rxdma2host-monitor-status-ring-mac1",
++					  "host2rxdma-host-buf-ring-mac3",
++					  "host2rxdma-host-buf-ring-mac2",
++					  "host2rxdma-host-buf-ring-mac1",
++					  "rxdma2host-destination-ring-mac3",
++					  "rxdma2host-destination-ring-mac2",
++					  "rxdma2host-destination-ring-mac1",
++					  "host2tcl-input-ring4",
++					  "host2tcl-input-ring3",
++					  "host2tcl-input-ring2",
++					  "host2tcl-input-ring1",
++					  "wbm2host-tx-completions-ring3",
++					  "wbm2host-tx-completions-ring2",
++					  "wbm2host-tx-completions-ring1",
++					  "tcl2host-status-ring";
++			status = "disabled";
++		};
++
+ 		q6v5_wcss: remoteproc@cd00000 {
+ 			compatible = "qcom,ipq6018-wcss-pil";
+ 			reg = <0x0 0x0cd00000 0x0 0x4040>,
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0907-soc-qcom-fix-smp2p-ack-on-ipq6018.patch b/6.12/target/linux/qualcommax/patches-6.12/0907-soc-qcom-fix-smp2p-ack-on-ipq6018.patch
new file mode 100644
index 00000000..299539d0
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0907-soc-qcom-fix-smp2p-ack-on-ipq6018.patch
@@ -0,0 +1,53 @@
+From d93936f175bd914067df8f63f5fbe6e3b77bb4d2 Mon Sep 17 00:00:00 2001
+From: Mantas Pucka <mantas@8devices.com>
+Date: Tue, 23 May 2023 14:46:28 +0300
+Subject: [PATCH 11/19] soc: qcom: fix smp2p ack on ipq6018
+
+IPQ6018 seem to need different ack mechanism for smp2p messaging. This
+fixes q6v5_wcss remoteproc firmware reloading. Without this first load
+is OK, but subsequent loads would hang and fail to complete.
+
+Signed-off-by: Mantas Pucka <mantas@8devices.com>
+---
+ arch/arm64/boot/dts/qcom/ipq6018.dtsi | 1 +
+ drivers/soc/qcom/smp2p.c              | 6 +++++-
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+@@ -1178,6 +1178,7 @@
+ 
+ 		wcss_smp2p_out: master-kernel {
+ 			qcom,entry-name = "master-kernel";
++			qcom,smp2p-feature-ssr-ack;
+ 			#qcom,smem-state-cells = <1>;
+ 		};
+ 
+--- a/drivers/soc/qcom/smp2p.c
++++ b/drivers/soc/qcom/smp2p.c
+@@ -159,6 +159,8 @@ struct qcom_smp2p {
+ 
+ 	struct list_head inbound;
+ 	struct list_head outbound;
++
++	bool need_ssr_ack;
+ };
+ 
+ #define CREATE_TRACE_POINTS
+@@ -316,7 +318,7 @@ static irqreturn_t qcom_smp2p_intr(int i
+ 		ack_restart = qcom_smp2p_check_ssr(smp2p);
+ 		qcom_smp2p_notify_in(smp2p);
+ 
+-		if (ack_restart)
++		if (ack_restart || smp2p->need_ssr_ack)
+ 			qcom_smp2p_do_ssr_ack(smp2p);
+ 	}
+ 
+@@ -447,6 +449,7 @@ static int qcom_smp2p_outbound_entry(str
+ 
+ 	/* Make the logical entry reference the physical value */
+ 	entry->value = &out->entries[out->valid_entries].value;
++	smp2p->need_ssr_ack = of_property_read_bool(node, "qcom,smp2p-feature-ssr-ack");
+ 
+ 	out->valid_entries++;
+ 
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0908-remoteproc-qcom_q6v5_wcss-add-optional-qdss_at-clock.patch b/6.12/target/linux/qualcommax/patches-6.12/0908-remoteproc-qcom_q6v5_wcss-add-optional-qdss_at-clock.patch
new file mode 100644
index 00000000..ae2e5001
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0908-remoteproc-qcom_q6v5_wcss-add-optional-qdss_at-clock.patch
@@ -0,0 +1,55 @@
+From 87dbcc69a7e3fe6ccddf4fe9bdbf51330f5e4a77 Mon Sep 17 00:00:00 2001
+From: Mantas Pucka <mantas@8devices.com>
+Date: Tue, 23 Jan 2024 11:04:04 +0200
+Subject: [PATCH] remoteproc: qcom_q6v5_wcss: add optional qdss_at clock
+
+IPQ6018 needs QDSS_AT clock enabled when loading wifi. Optionally enable it
+when provided by DT.
+
+Signed-off-by: Mantas Pucka <mantas@8devices.com>
+---
+ drivers/remoteproc/qcom_q6v5_wcss.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+--- a/drivers/remoteproc/qcom_q6v5_wcss.c
++++ b/drivers/remoteproc/qcom_q6v5_wcss.c
+@@ -120,6 +120,7 @@ struct q6v5_wcss {
+ 	struct clk *qdsp6ss_core_gfmux;
+ 	struct clk *lcc_bcr_sleep;
+ 	struct clk *prng_clk;
++	struct clk *qdss_clk;
+ 	struct regulator *cx_supply;
+ 	struct qcom_sysmon *sysmon;
+ 
+@@ -260,6 +261,9 @@ static int q6v5_wcss_start(struct rproc
+ 		return ret;
+ 	}
+ 
++	if (wcss->qdss_clk)
++		clk_prepare_enable(wcss->qdss_clk);
++
+ 	qcom_q6v5_prepare(&wcss->q6v5);
+ 
+ 	if (wcss->need_mem_protection) {
+@@ -773,6 +777,8 @@ static int q6v5_wcss_stop(struct rproc *
+ 	}
+ 
+ pas_done:
++	if (wcss->qdss_clk)
++		clk_disable_unprepare(wcss->qdss_clk);
+ 	clk_disable_unprepare(wcss->prng_clk);
+ 	qcom_q6v5_unprepare(&wcss->q6v5);
+ 
+@@ -981,6 +987,12 @@ static int ipq_init_clock(struct q6v5_wc
+ 			dev_err(wcss->dev, "Failed to get prng clock\n");
+ 		return ret;
+ 	}
++
++	wcss->qdss_clk = devm_clk_get(wcss->dev, "qdss");
++	if (IS_ERR(wcss->qdss_clk)) {
++		wcss->qdss_clk = NULL;
++	}
++
+ 	return 0;
+ }
+ 
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0909-arm64-dts-qcom-ipq6018-assign-QDSS_AT-clock-to-wifi-.patch b/6.12/target/linux/qualcommax/patches-6.12/0909-arm64-dts-qcom-ipq6018-assign-QDSS_AT-clock-to-wifi-.patch
new file mode 100644
index 00000000..38fbf726
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0909-arm64-dts-qcom-ipq6018-assign-QDSS_AT-clock-to-wifi-.patch
@@ -0,0 +1,26 @@
+From 71f30e25d21ae4981ecef6653a4ba7dfeb80db7b Mon Sep 17 00:00:00 2001
+From: Mantas Pucka <mantas@8devices.com>
+Date: Tue, 23 Jan 2024 11:04:57 +0200
+Subject: [PATCH] arm64: dts: qcom: ipq6018: assign QDSS_AT clock to wifi remoteproc
+
+IPQ6018 needs to enable QDSS_AT clock when loading wifi firmware,
+add it to wifi remoteproc clock list.
+
+Signed-off-by: Mantas Pucka <mantas@8devices.com>
+---
+ arch/arm64/boot/dts/qcom/ipq6018.dtsi          | 15 ++++++++-------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+@@ -947,8 +947,8 @@
+ 				      "wcss_reset",
+ 				      "wcss_q6_reset";
+ 
+-			clocks = <&gcc GCC_PRNG_AHB_CLK>;
+-			clock-names = "prng";
++			clocks = <&gcc GCC_PRNG_AHB_CLK>, <&gcc GCC_QDSS_AT_CLK>;
++			clock-names = "prng", "qdss" ;
+ 
+ 			qcom,halt-regs = <&tcsr 0x18000 0x1b000 0xe000>;
+ 
diff --git a/6.12/target/linux/qualcommax/patches-6.12/0910-arm64-dts-qcom-ipq6018-change-voltage-to-perf-levels.patch b/6.12/target/linux/qualcommax/patches-6.12/0910-arm64-dts-qcom-ipq6018-change-voltage-to-perf-levels.patch
new file mode 100644
index 00000000..25fa3136
--- /dev/null
+++ b/6.12/target/linux/qualcommax/patches-6.12/0910-arm64-dts-qcom-ipq6018-change-voltage-to-perf-levels.patch
@@ -0,0 +1,65 @@
+From c67a1814bb1d0df290cf1e3f9c966f04aa41b9b9 Mon Sep 17 00:00:00 2001
+From: Mantas Pucka <mantas@8devices.com>
+Date: Tue, 30 Jan 2024 12:43:56 +0200
+Subject: [PATCH] arm64: dts: qcom: ipq6018: change voltage to perf levels for
+ CPR4 driver
+
+Current CPR4 driver requires opp-microvolt to be an abstract
+performance level instead of actual voltage level.
+
+Signed-off-by: Mantas Pucka <mantas@8devices.com>
+---
+ arch/arm64/boot/dts/qcom/ipq6018.dtsi | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+@@ -107,42 +107,42 @@
+ 
+ 		opp-864000000 {
+ 			opp-hz = /bits/ 64 <864000000>;
+-			opp-microvolt = <725000>;
++			opp-microvolt = <1>;
+ 			opp-supported-hw = <0xf>;
+ 			clock-latency-ns = <200000>;
+ 		};
+ 
+ 		opp-1056000000 {
+ 			opp-hz = /bits/ 64 <1056000000>;
+-			opp-microvolt = <787500>;
++			opp-microvolt = <2>;
+ 			opp-supported-hw = <0xf>;
+ 			clock-latency-ns = <200000>;
+ 		};
+ 
+ 		opp-1320000000 {
+ 			opp-hz = /bits/ 64 <1320000000>;
+-			opp-microvolt = <862500>;
++			opp-microvolt = <3>;
+ 			opp-supported-hw = <0x3>;
+ 			clock-latency-ns = <200000>;
+ 		};
+ 
+ 		opp-1440000000 {
+ 			opp-hz = /bits/ 64 <1440000000>;
+-			opp-microvolt = <925000>;
++			opp-microvolt = <4>;
+ 			opp-supported-hw = <0x3>;
+ 			clock-latency-ns = <200000>;
+ 		};
+ 
+ 		opp-1608000000 {
+ 			opp-hz = /bits/ 64 <1608000000>;
+-			opp-microvolt = <987500>;
++			opp-microvolt = <5>;
+ 			opp-supported-hw = <0x1>;
+ 			clock-latency-ns = <200000>;
+ 		};
+ 
+ 		opp-1800000000 {
+ 			opp-hz = /bits/ 64 <1800000000>;
+-			opp-microvolt = <1062500>;
++			opp-microvolt = <6>;
+ 			opp-supported-hw = <0x1>;
+ 			clock-latency-ns = <200000>;
+ 		};
diff --git a/6.12/target/linux/x86/64/config-6.12 b/6.12/target/linux/x86/64/config-6.12
new file mode 100644
index 00000000..27aae1ed
--- /dev/null
+++ b/6.12/target/linux/x86/64/config-6.12
@@ -0,0 +1,537 @@
+CONFIG_64BIT=y
+CONFIG_ACPI=y
+CONFIG_ACPI_AC=y
+CONFIG_ACPI_BATTERY=y
+# CONFIG_ACPI_BGRT is not set
+CONFIG_ACPI_BUTTON=y
+# CONFIG_ACPI_CMPC is not set
+CONFIG_ACPI_CONTAINER=y
+CONFIG_ACPI_CPPC_LIB=y
+CONFIG_ACPI_CPU_FREQ_PSS=y
+# CONFIG_ACPI_DEBUG is not set
+# CONFIG_ACPI_DEBUGGER is not set
+# CONFIG_ACPI_DOCK is not set
+# CONFIG_ACPI_DPTF is not set
+# CONFIG_ACPI_EC_DEBUGFS is not set
+CONFIG_ACPI_FAN=y
+# CONFIG_ACPI_FPDT is not set
+CONFIG_ACPI_HOTPLUG_CPU=y
+CONFIG_ACPI_HOTPLUG_IOAPIC=y
+# CONFIG_ACPI_I2C_OPREGION is not set
+CONFIG_ACPI_LEGACY_TABLES_LOOKUP=y
+CONFIG_ACPI_LPIT=y
+# CONFIG_ACPI_PCC is not set
+# CONFIG_ACPI_PCI_SLOT is not set
+# CONFIG_ACPI_PFRUT is not set
+CONFIG_ACPI_PRMT=y
+CONFIG_ACPI_PROCESSOR=y
+# CONFIG_ACPI_PROCESSOR_AGGREGATOR is not set
+CONFIG_ACPI_PROCESSOR_CSTATE=y
+CONFIG_ACPI_PROCESSOR_IDLE=y
+CONFIG_ACPI_REV_OVERRIDE_POSSIBLE=y
+# CONFIG_ACPI_SBS is not set
+CONFIG_ACPI_SPCR_TABLE=y
+CONFIG_ACPI_SYSTEM_POWER_STATES_SUPPORT=y
+# CONFIG_ACPI_TAD is not set
+CONFIG_ACPI_THERMAL=y
+CONFIG_ACPI_VIDEO=y
+# CONFIG_ACPI_WMI is not set
+# CONFIG_ACRN_GUEST is not set
+CONFIG_AGP=y
+# CONFIG_AGP_AMD64 is not set
+CONFIG_AGP_INTEL=y
+# CONFIG_AGP_SIS is not set
+# CONFIG_AGP_VIA is not set
+# CONFIG_AMD_HSMP is not set
+# CONFIG_AMD_PMC is not set
+# CONFIG_AMD_PTDMA is not set
+# CONFIG_AMD_SFH_HID is not set
+CONFIG_ARCH_CPUIDLE_HALTPOLL=y
+CONFIG_ARCH_DMA_ADDR_T_64BIT=y
+CONFIG_ARCH_MIGHT_HAVE_ACPI_PDC=y
+CONFIG_ARCH_MMAP_RND_BITS=28
+CONFIG_ARCH_MMAP_RND_BITS_MAX=32
+CONFIG_ARCH_MMAP_RND_BITS_MIN=28
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS=8
+CONFIG_ARCH_NR_GPIO=1024
+CONFIG_ARCH_SPARSEMEM_DEFAULT=y
+CONFIG_ARCH_WANTS_THP_SWAP=y
+# CONFIG_ASUS_TF103C_DOCK is not set
+CONFIG_AUDIT_ARCH=y
+CONFIG_BACKLIGHT_CLASS_DEVICE=y
+CONFIG_BALLOON_COMPACTION=y
+# CONFIG_BARCO_P50_GPIO is not set
+CONFIG_BLK_DEV_BSGLIB=y
+CONFIG_BLK_DEV_BSG_COMMON=y
+CONFIG_BLK_DEV_INTEGRITY=y
+CONFIG_BLK_DEV_INTEGRITY_T10=y
+CONFIG_BLK_DEV_NVME=y
+CONFIG_BLK_DEV_SR=y
+CONFIG_BLK_MQ_VIRTIO=y
+CONFIG_BLK_PM=y
+CONFIG_BLOCK_COMPAT=y
+# CONFIG_BOOTPARAM_HOTPLUG_CPU0 is not set
+CONFIG_BTT=y
+CONFIG_CDROM=y
+CONFIG_COMPAT=y
+CONFIG_COMPAT_BINFMT_ELF=y
+CONFIG_COMPAT_FOR_U64_ALIGNMENT=y
+CONFIG_COMPAT_NETLINK_MESSAGES=y
+CONFIG_CONNECTOR=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL=y
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+# CONFIG_CPU_IDLE_GOV_HALTPOLL is not set
+CONFIG_CPU_RMAP=y
+CONFIG_CRC64=y
+CONFIG_CRC64_ROCKSOFT=y
+CONFIG_CRC_T10DIF=y
+CONFIG_CRYPTO_AES_NI_INTEL=y
+# CONFIG_CRYPTO_BLOWFISH_X86_64 is not set
+# CONFIG_CRYPTO_CAMELLIA_AESNI_AVX2_X86_64 is not set
+# CONFIG_CRYPTO_CAMELLIA_AESNI_AVX_X86_64 is not set
+# CONFIG_CRYPTO_CAMELLIA_X86_64 is not set
+# CONFIG_CRYPTO_CAST5_AVX_X86_64 is not set
+# CONFIG_CRYPTO_CAST6_AVX_X86_64 is not set
+CONFIG_CRYPTO_CRC64_ROCKSOFT=y
+CONFIG_CRYPTO_CRCT10DIF=y
+# CONFIG_CRYPTO_CRCT10DIF_PCLMUL is not set
+CONFIG_CRYPTO_CRYPTD=y
+# CONFIG_CRYPTO_DES3_EDE_X86_64 is not set
+CONFIG_CRYPTO_ECB=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=11
+CONFIG_CRYPTO_LRW=y
+# CONFIG_CRYPTO_NHPOLY1305_AVX2 is not set
+# CONFIG_CRYPTO_NHPOLY1305_SSE2 is not set
+# CONFIG_CRYPTO_SERPENT_AVX2_X86_64 is not set
+# CONFIG_CRYPTO_SERPENT_AVX_X86_64 is not set
+# CONFIG_CRYPTO_SERPENT_SSE2_X86_64 is not set
+# CONFIG_CRYPTO_SHA1_SSSE3 is not set
+# CONFIG_CRYPTO_SHA512_SSSE3 is not set
+CONFIG_CRYPTO_SIMD=y
+# CONFIG_CRYPTO_SM3_AVX_X86_64 is not set
+# CONFIG_CRYPTO_SM4_AESNI_AVX2_X86_64 is not set
+# CONFIG_CRYPTO_SM4_AESNI_AVX_X86_64 is not set
+# CONFIG_CRYPTO_TWOFISH_AVX_X86_64 is not set
+# CONFIG_CRYPTO_TWOFISH_X86_64 is not set
+# CONFIG_CRYPTO_TWOFISH_X86_64_3WAY is not set
+CONFIG_CRYPTO_XTS=y
+# CONFIG_DEBUG_HOTPLUG_CPU0 is not set
+CONFIG_DMA_ACPI=y
+CONFIG_DMA_OPS=y
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_DRM=y
+CONFIG_DRM_BOCHS=y
+CONFIG_DRM_BRIDGE=y
+CONFIG_DRM_BUDDY=y
+CONFIG_DRM_DP_HELPER=y
+CONFIG_DRM_FBDEV_EMULATION=y
+CONFIG_DRM_FBDEV_OVERALLOC=100
+CONFIG_DRM_GEM_SHMEM_HELPER=y
+# CONFIG_DRM_HYPERV is not set
+CONFIG_DRM_I915_CAPTURE_ERROR=y
+CONFIG_DRM_I915_COMPRESS_ERROR=y
+CONFIG_DRM_I915_FORCE_PROBE=""
+CONFIG_DRM_I915_REQUEST_TIMEOUT=20000
+CONFIG_DRM_I915_FENCE_TIMEOUT=10000
+CONFIG_DRM_I915_USERFAULT_AUTOSUSPEND=250
+CONFIG_DRM_I915_HEARTBEAT_INTERVAL=2500
+CONFIG_DRM_I915_PREEMPT_TIMEOUT=640
+CONFIG_DRM_I915_MAX_REQUEST_BUSYWAIT=8000
+CONFIG_DRM_I915_STOP_TIMEOUT=100
+CONFIG_DRM_I915_TIMESLICE_DURATION=1
+CONFIG_DRM_KMS_HELPER=y
+CONFIG_DRM_MIPI_DSI=y
+CONFIG_DRM_NOMODESET=y
+CONFIG_DRM_PANEL=y
+CONFIG_DRM_PANEL_BRIDGE=y
+CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y
+# CONFIG_DRM_SIMPLEDRM is not set
+# CONFIG_DRM_SSD130X is not set
+CONFIG_DRM_TTM=y
+CONFIG_DRM_TTM_HELPER=y
+CONFIG_DRM_VIRTIO_GPU=y
+CONFIG_DRM_VRAM_HELPER=y
+CONFIG_DYNAMIC_FTRACE_WITH_REGS=y
+CONFIG_EFI=y
+CONFIG_EFIVAR_FS=m
+# CONFIG_EFI_BOOTLOADER_CONTROL is not set
+# CONFIG_EFI_CAPSULE_LOADER is not set
+# CONFIG_EFI_CUSTOM_SSDT_OVERLAYS is not set
+# CONFIG_EFI_DISABLE_PCI_DMA is not set
+CONFIG_EFI_EARLYCON=y
+CONFIG_EFI_ESRT=y
+# CONFIG_EFI_FAKE_MEMMAP is not set
+CONFIG_EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER=y
+# CONFIG_EFI_MIXED is not set
+# CONFIG_EFI_PGT_DUMP is not set
+# CONFIG_EFI_RCI2_TABLE is not set
+CONFIG_EFI_RUNTIME_MAP=y
+CONFIG_EFI_RUNTIME_WRAPPERS=y
+CONFIG_EFI_STUB=y
+# CONFIG_EFI_TEST is not set
+# CONFIG_EFI_VARS is not set
+CONFIG_FAILOVER=y
+CONFIG_FB=y
+CONFIG_FB_CFB_COPYAREA=y
+CONFIG_FB_CFB_FILLRECT=y
+CONFIG_FB_CFB_IMAGEBLIT=y
+CONFIG_FB_CMDLINE=y
+CONFIG_FB_DEFERRED_IO=y
+CONFIG_FB_EFI=y
+CONFIG_FB_HYPERV=y
+# CONFIG_FB_INTEL is not set
+CONFIG_FB_MODE_HELPERS=y
+CONFIG_FB_SIMPLE=y
+CONFIG_FB_SYS_COPYAREA=y
+CONFIG_FB_SYS_FILLRECT=y
+CONFIG_FB_SYS_FOPS=y
+CONFIG_FB_SYS_IMAGEBLIT=y
+CONFIG_FB_TILEBLITTING=y
+# CONFIG_FB_VESA is not set
+CONFIG_FONT_8x16=y
+CONFIG_FONT_8x8=y
+CONFIG_FONT_SUPPORT=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y
+CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION=y
+# CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set
+CONFIG_FREEZER=y
+CONFIG_FTRACE=y
+CONFIG_FUSION_SAS=y
+CONFIG_FW_CACHE=y
+CONFIG_GART_IOMMU=y
+CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
+CONFIG_GENERIC_CPU=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_MIGRATION=y
+CONFIG_GENERIC_PENDING_IRQ=y
+CONFIG_GPIOLIB=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_ACPI=y
+# CONFIG_GPIO_CASCADE is not set
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_ICH=y
+CONFIG_GPIO_SCH=y
+# CONFIG_GPIO_SIM is not set
+# CONFIG_GPIO_VIRTIO is not set
+CONFIG_GUEST_PERF_EVENTS=y
+CONFIG_HALTPOLL_CPUIDLE=y
+CONFIG_HARDLOCKUP_CHECK_TIMESTAMP=y
+CONFIG_HDMI=y
+CONFIG_HIBERNATE_CALLBACKS=y
+CONFIG_HID_BATTERY_STRENGTH=y
+CONFIG_HID_GENERIC=y
+CONFIG_HID_HYPERV_MOUSE=y
+CONFIG_HOTPLUG_CPU=y
+CONFIG_HOTPLUG_PCI=y
+CONFIG_HOTPLUG_PCI_ACPI=y
+# CONFIG_HOTPLUG_PCI_ACPI_IBM is not set
+# CONFIG_HOTPLUG_PCI_CPCI is not set
+# CONFIG_HOTPLUG_PCI_PCIE is not set
+# CONFIG_HOTPLUG_PCI_SHPC is not set
+CONFIG_HOTPLUG_SMT=y
+CONFIG_HPET=y
+CONFIG_HPET_MMAP=y
+# CONFIG_HP_ACCEL is not set
+CONFIG_HVC_DRIVER=y
+CONFIG_HVC_IRQ=y
+CONFIG_HVC_XEN=y
+CONFIG_HVC_XEN_FRONTEND=y
+CONFIG_HWMON=y
+CONFIG_HWMON_VID=y
+CONFIG_HW_RANDOM_AMD=y
+CONFIG_HW_RANDOM_INTEL=y
+CONFIG_HW_RANDOM_VIRTIO=y
+CONFIG_HYPERV=y
+CONFIG_HYPERVISOR_GUEST=y
+CONFIG_HYPERV_BALLOON=y
+CONFIG_HYPERV_KEYBOARD=y
+CONFIG_HYPERV_NET=y
+CONFIG_HYPERV_STORAGE=y
+# CONFIG_HYPERV_TESTING is not set
+CONFIG_HYPERV_TIMER=y
+CONFIG_HYPERV_UTILS=y
+# CONFIG_HYPERV_VSOCKETS is not set
+CONFIG_I2C=y
+CONFIG_I2C_ALGOBIT=y
+# CONFIG_I2C_AMD_MP2 is not set
+CONFIG_I2C_BOARDINFO=y
+# CONFIG_I2C_HID_ACPI is not set
+# CONFIG_IA32_EMULATION is not set
+CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
+# CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is not set
+CONFIG_INPUT_XEN_KBDDEV_FRONTEND=y
+CONFIG_INTEL_GTT=y
+# CONFIG_INTEL_IDXD_COMPAT is not set
+CONFIG_INTEL_IDLE=y
+# CONFIG_INTEL_IPS is not set
+# CONFIG_INTEL_MEI_HDCP is not set
+# CONFIG_INTEL_MEI_PXP is not set
+# CONFIG_INTEL_MENLOW is not set
+CONFIG_INTEL_PCH_THERMAL=y
+# CONFIG_INTEL_SAR_INT1092 is not set
+# CONFIG_INTEL_SCU_PLATFORM is not set
+CONFIG_INTEL_SOC_DTS_IOSF_CORE=y
+CONFIG_INTEL_SOC_DTS_THERMAL=y
+# CONFIG_INTEL_SPEED_SELECT_INTERFACE is not set
+# CONFIG_INTEL_TURBO_MAX_3 is not set
+# CONFIG_INTEL_UNCORE_FREQ_CONTROL is not set
+CONFIG_INTERVAL_TREE=y
+# CONFIG_IOMMU_DEBUG is not set
+CONFIG_IOMMU_HELPER=y
+CONFIG_IOSF_MBI=y
+# CONFIG_IOSF_MBI_DEBUG is not set
+# CONFIG_ISCSI_IBFT is not set
+CONFIG_ISO9660_FS=y
+CONFIG_KALLSYMS=y
+CONFIG_KALLSYMS_ABSOLUTE_PERCPU=y
+CONFIG_KCMP=y
+CONFIG_KVM_GUEST=y
+CONFIG_LEDS_GPIO=y
+# CONFIG_LEGACY_VSYSCALL_EMULATE is not set
+CONFIG_LEGACY_VSYSCALL_NONE=y
+# CONFIG_LEGACY_VSYSCALL_XONLY is not set
+CONFIG_LIBNVDIMM=y
+CONFIG_HAVE_LIVEPATCH=y
+CONFIG_LIVEPATCH=y
+CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_LPC_ICH=y
+CONFIG_LPC_SCH=y
+CONFIG_MAILBOX=y
+# CONFIG_MAXSMP is not set
+CONFIG_MEMORY_BALLOON=y
+CONFIG_MEMREGION=y
+# CONFIG_MERAKI_MX100 is not set
+CONFIG_MFD_CORE=y
+# CONFIG_MFD_INTEL_LPSS_ACPI is not set
+# CONFIG_MFD_INTEL_PMC_BXT is not set
+# CONFIG_MFD_SIMPLE_MFD_I2C is not set
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_CQHCI=y
+CONFIG_MMC_RICOH_MMC=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_ACPI=y
+CONFIG_MMC_SDHCI_IO_ACCESSORS=y
+CONFIG_MMC_SDHCI_PCI=y
+# CONFIG_MMC_SDHCI_PLTFM is not set
+# CONFIG_MMC_WBSD is not set
+CONFIG_MMU_NOTIFIER=y
+CONFIG_MODULES_USE_ELF_RELA=y
+# CONFIG_MPSC is not set
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_ND_CLAIM=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NET_FAILOVER=y
+CONFIG_NET_FLOW_LIMIT=y
+# CONFIG_NITRO_ENCLAVES is not set
+CONFIG_NR_CPUS=512
+CONFIG_NR_CPUS_DEFAULT=64
+CONFIG_NR_CPUS_RANGE_BEGIN=2
+CONFIG_NR_CPUS_RANGE_END=512
+CONFIG_NVME_CORE=y
+# CONFIG_NVME_HWMON is not set
+CONFIG_NVME_MULTIPATH=y
+# CONFIG_NVME_VERBOSE_ERRORS is not set
+CONFIG_OUTPUT_FORMAT="elf64-x86-64"
+CONFIG_PADATA=y
+CONFIG_PAGE_REPORTING=y
+# CONFIG_PAGE_TABLE_CHECK is not set
+CONFIG_PAGE_TABLE_ISOLATION=y
+CONFIG_PARAVIRT=y
+CONFIG_PARAVIRT_CLOCK=y
+# CONFIG_PARAVIRT_DEBUG is not set
+CONFIG_PARAVIRT_SPINLOCKS=y
+CONFIG_PARAVIRT_XXL=y
+CONFIG_PATA_AMD=y
+CONFIG_PATA_ATIIXP=y
+CONFIG_PATA_MPIIX=y
+CONFIG_PATA_OLDPIIX=y
+CONFIG_PATA_PLATFORM=y
+CONFIG_PATA_TIMINGS=y
+CONFIG_PATA_VIA=y
+CONFIG_PCC=y
+# CONFIG_PCENGINES_APU2 is not set
+CONFIG_PCIEAER=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCIE_PME=y
+CONFIG_PCI_HYPERV=y
+CONFIG_PCI_HYPERV_INTERFACE=y
+# CONFIG_PCI_MMCONFIG is not set
+CONFIG_PCI_XEN=y
+CONFIG_PGTABLE_LEVELS=4
+CONFIG_PHYSICAL_ALIGN=0x1000000
+CONFIG_PHYS_ADDR_T_64BIT=y
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_ALDERLAKE is not set
+# CONFIG_PINCTRL_BAYTRAIL is not set
+# CONFIG_PINCTRL_BROXTON is not set
+# CONFIG_PINCTRL_CANNONLAKE is not set
+# CONFIG_PINCTRL_CHERRYVIEW is not set
+# CONFIG_PINCTRL_DENVERTON is not set
+# CONFIG_PINCTRL_ELKHARTLAKE is not set
+# CONFIG_PINCTRL_EMMITSBURG is not set
+# CONFIG_PINCTRL_GEMINILAKE is not set
+# CONFIG_PINCTRL_JASPERLAKE is not set
+# CONFIG_PINCTRL_LAKEFIELD is not set
+# CONFIG_PINCTRL_LEWISBURG is not set
+# CONFIG_PINCTRL_LYNXPOINT is not set
+# CONFIG_PINCTRL_SUNRISEPOINT is not set
+# CONFIG_PINCTRL_TIGERLAKE is not set
+CONFIG_PM=y
+# CONFIG_PMIC_OPREGION is not set
+CONFIG_PM_CLK=y
+CONFIG_PM_SLEEP=y
+CONFIG_PM_SLEEP_SMP=y
+CONFIG_PNP=y
+CONFIG_PNPACPI=y
+CONFIG_PNP_DEBUG_MESSAGES=y
+CONFIG_PROC_EVENTS=y
+CONFIG_PVH=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_RAS=y
+CONFIG_RELAY=y
+CONFIG_RELOCATABLE=y
+CONFIG_RESET_ATTACK_MITIGATION=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+CONFIG_RTC_I2C_AND_SPI=y
+CONFIG_RWSEM_SPIN_ON_OWNER=y
+# CONFIG_SAMSUNG_Q10 is not set
+CONFIG_SATA_AHCI=y
+# CONFIG_SCHED_CORE is not set
+CONFIG_SCHED_MC=y
+CONFIG_SCHED_MC_PRIO=y
+CONFIG_SCHED_SMT=y
+CONFIG_SCSI_SAS_ATTRS=y
+CONFIG_SCSI_VIRTIO=y
+# CONFIG_SENSORS_ASUS_EC is not set
+CONFIG_SENSORS_CORETEMP=y
+CONFIG_SENSORS_FAM15H_POWER=y
+CONFIG_SENSORS_I5500=y
+CONFIG_SENSORS_K10TEMP=y
+CONFIG_SENSORS_K8TEMP=y
+# CONFIG_SENSORS_SY7636A is not set
+# CONFIG_SENSORS_TMP464 is not set
+CONFIG_SENSORS_VIA_CPUTEMP=y
+CONFIG_SERIAL_8250_PNP=y
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SMP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SPARSEMEM=y
+CONFIG_SPARSEMEM_EXTREME=y
+# CONFIG_SPARSEMEM_VMEMMAP is not set
+CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
+CONFIG_STACK_VALIDATION=y
+CONFIG_SWIOTLB=y
+CONFIG_SWIOTLB_XEN=y
+CONFIG_SYNC_FILE=y
+# CONFIG_SYSTEM76_ACPI is not set
+CONFIG_SYSVIPC_COMPAT=y
+CONFIG_SYS_HYPERVISOR=y
+CONFIG_THERMAL_GOV_USER_SPACE=y
+CONFIG_THERMAL_HWMON=y
+CONFIG_THERMAL_WRITABLE_TRIPS=y
+# CONFIG_TOSHIBA_BT_RFKILL is not set
+# CONFIG_UACCE is not set
+# CONFIG_UCLAMP_TASK is not set
+CONFIG_UCS2_STRING=y
+# CONFIG_UNWINDER_ORC is not set
+CONFIG_USB_STORAGE=y
+# CONFIG_USB_XEN_HCD is not set
+CONFIG_VIRTIO=y
+CONFIG_VIRTIO_BALLOON=y
+CONFIG_VIRTIO_BLK=y
+CONFIG_VIRTIO_CONSOLE=y
+CONFIG_VIRTIO_DMA_SHARED_BUFFER=y
+CONFIG_VIRTIO_MMIO=y
+CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y
+CONFIG_VIRTIO_NET=y
+CONFIG_VIRTIO_PCI=y
+CONFIG_VIRTIO_PCI_LEGACY=y
+CONFIG_VIRTIO_PCI_LIB=y
+CONFIG_VIRTIO_PCI_LIB_LEGACY=y
+# CONFIG_VIRTIO_PMEM is not set
+# CONFIG_VIRTIO_VSOCKETS is not set
+CONFIG_VIRTIO_VSOCKETS_COMMON=y
+CONFIG_VIRT_DRIVERS=y
+CONFIG_VMAP_PFN=y
+CONFIG_VMAP_STACK=y
+# CONFIG_VMD is not set
+CONFIG_VMGENID=y
+CONFIG_VMWARE_BALLOON=y
+CONFIG_VMWARE_PVSCSI=y
+CONFIG_VMWARE_VMCI=y
+CONFIG_VMWARE_VMCI_VSOCKETS=y
+CONFIG_VMXNET3=y
+CONFIG_VSOCKETS=y
+CONFIG_VSOCKETS_LOOPBACK=y
+CONFIG_VT_CONSOLE_SLEEP=y
+CONFIG_WATCHDOG_CORE=y
+# CONFIG_WIRELESS_HOTKEY is not set
+# CONFIG_X86_5LEVEL is not set
+CONFIG_X86_64=y
+CONFIG_X86_64_SMP=y
+CONFIG_X86_ACPI_CPUFREQ=y
+# CONFIG_X86_ACPI_CPUFREQ_CPB is not set
+CONFIG_X86_AMD_FREQ_SENSITIVITY=y
+# CONFIG_X86_AMD_PLATFORM_DEVICE is not set
+CONFIG_X86_AMD_PSTATE=y
+CONFIG_X86_CPUID=y
+CONFIG_X86_DIRECT_GBPAGES=y
+CONFIG_X86_HV_CALLBACK_VECTOR=y
+CONFIG_X86_INTEL_LPSS=y
+# CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS is not set
+CONFIG_X86_INTEL_PSTATE=y
+CONFIG_X86_KERNEL_IBT=y
+CONFIG_X86_MINIMUM_CPU_FAMILY=64
+# CONFIG_X86_PCC_CPUFREQ is not set
+CONFIG_X86_PKG_TEMP_THERMAL=y
+# CONFIG_X86_PMEM_LEGACY is not set
+CONFIG_X86_PM_TIMER=y
+# CONFIG_X86_POWERNOW_K8 is not set
+CONFIG_X86_SGX=y
+# CONFIG_X86_VSYSCALL_EMULATION is not set
+CONFIG_X86_X2APIC=y
+CONFIG_X86_X32_ABI=y
+CONFIG_XARRAY_MULTI=y
+CONFIG_XEN=y
+CONFIG_XENFS=y
+CONFIG_XEN_512GB=y
+CONFIG_XEN_ACPI=y
+CONFIG_XEN_ACPI_PROCESSOR=y
+CONFIG_XEN_AUTO_XLATE=y
+# CONFIG_XEN_BACKEND is not set
+CONFIG_XEN_BALLOON=y
+CONFIG_XEN_BLKDEV_FRONTEND=y
+CONFIG_XEN_COMPAT_XENFS=y
+CONFIG_XEN_DEBUG_FS=y
+CONFIG_XEN_DEV_EVTCHN=y
+CONFIG_XEN_DOM0=y
+CONFIG_XEN_EFI=y
+CONFIG_XEN_FBDEV_FRONTEND=y
+CONFIG_XEN_GNTDEV=y
+CONFIG_XEN_GRANT_DEV_ALLOC=y
+CONFIG_XEN_HAVE_PVMMU=y
+CONFIG_XEN_HAVE_VPMU=y
+# CONFIG_XEN_MCE_LOG is not set
+CONFIG_XEN_NETDEV_FRONTEND=y
+CONFIG_XEN_PCIDEV_FRONTEND=y
+CONFIG_XEN_PRIVCMD=y
+CONFIG_XEN_PV=y
+CONFIG_XEN_PVH=y
+CONFIG_XEN_PVHVM=y
+CONFIG_XEN_PVHVM_GUEST=y
+CONFIG_XEN_PVHVM_SMP=y
+CONFIG_XEN_PV_DOM0=y
+CONFIG_XEN_PV_SMP=y
+CONFIG_XEN_SAVE_RESTORE=y
+CONFIG_XEN_SCSI_FRONTEND=y
+CONFIG_XEN_SYMS=y
+CONFIG_XEN_SYS_HYPERVISOR=y
+CONFIG_XEN_WDT=y
+CONFIG_XEN_XENBUS_FRONTEND=y
+CONFIG_XPS=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZONE_DMA32=y
diff --git a/6.12/target/linux/x86/config-6.12 b/6.12/target/linux/x86/config-6.12
new file mode 100644
index 00000000..68de9ca0
--- /dev/null
+++ b/6.12/target/linux/x86/config-6.12
@@ -0,0 +1,618 @@
+# CONFIG_60XX_WDT is not set
+# CONFIG_64BIT is not set
+CONFIG_ACPI=y
+CONFIG_ACPI_AC=y
+CONFIG_ACPI_BATTERY=y
+# CONFIG_ACPI_CMPC is not set
+# CONFIG_ACPI_CONTAINER is not set
+CONFIG_ACPI_CPPC_LIB=y
+CONFIG_ACPI_CPU_FREQ_PSS=y
+# CONFIG_ACPI_DEBUG is not set
+# CONFIG_ACPI_DEBUGGER is not set
+# CONFIG_ACPI_DOCK is not set
+# CONFIG_ACPI_DPTF is not set
+# CONFIG_ACPI_EC_DEBUGFS is not set
+CONFIG_ACPI_FAN=y
+# CONFIG_ACPI_FPDT is not set
+CONFIG_ACPI_HOTPLUG_IOAPIC=y
+CONFIG_ACPI_I2C_OPREGION=y
+CONFIG_ACPI_LEGACY_TABLES_LOOKUP=y
+CONFIG_ACPI_LPIT=y
+CONFIG_ACPI_PCC=y
+# CONFIG_ACPI_PCI_SLOT is not set
+# CONFIG_ACPI_PFRUT is not set
+# CONFIG_ACPI_PRMT is not set
+CONFIG_ACPI_PROCESSOR=y
+# CONFIG_ACPI_PROCESSOR_AGGREGATOR is not set
+CONFIG_ACPI_PROCESSOR_CSTATE=y
+CONFIG_ACPI_PROCESSOR_IDLE=y
+CONFIG_ACPI_REV_OVERRIDE_POSSIBLE=y
+# CONFIG_ACPI_SBS is not set
+CONFIG_ACPI_SPCR_TABLE=y
+CONFIG_ACPI_SYSTEM_POWER_STATES_SUPPORT=y
+CONFIG_ACPI_THERMAL=y
+# CONFIG_ACPI_TINY_POWER_BUTTON is not set
+# CONFIG_ACPI_WMI is not set
+# CONFIG_ACQUIRE_WDT is not set
+# CONFIG_ACRN_GUEST is not set
+# CONFIG_ADVANTECH_WDT is not set
+# CONFIG_ALIM1535_WDT is not set
+# CONFIG_AMD_HSMP is not set
+CONFIG_AMD_NB=y
+# CONFIG_AMD_PMC is not set
+# CONFIG_AMD_PTDMA is not set
+# CONFIG_AMD_SFH_HID is not set
+CONFIG_APERTURE_HELPERS=y
+CONFIG_ARCH_CLOCKSOURCE_INIT=y
+CONFIG_ARCH_CORRECT_STACKTRACE_ON_KRETPROBE=y
+CONFIG_ARCH_DMA_ADDR_T_64BIT=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
+CONFIG_ARCH_MIGHT_HAVE_ACPI_PDC=y
+CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
+CONFIG_ARCH_MIGHT_HAVE_PC_SERIO=y
+CONFIG_ARCH_MMAP_RND_BITS=28
+CONFIG_ARCH_MMAP_RND_BITS_MAX=32
+CONFIG_ARCH_MMAP_RND_BITS_MIN=28
+CONFIG_ARCH_NR_GPIO=1024
+CONFIG_ARCH_SPARSEMEM_DEFAULT=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_STACKWALK=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARCH_USES_HIGH_VMA_FLAGS=y
+CONFIG_ARCH_USES_PG_UNCACHED=y
+CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT=y
+CONFIG_ARCH_WANTS_NO_INSTR=y
+CONFIG_ARCH_WANTS_THP_SWAP=y
+# CONFIG_ASUS_TF103C_DOCK is not set
+CONFIG_ATA=y
+CONFIG_ATA_GENERIC=y
+CONFIG_ATA_PIIX=y
+CONFIG_AUDIT_ARCH=y
+CONFIG_BACKLIGHT_CLASS_DEVICE=y
+# CONFIG_BARCO_P50_GPIO is not set
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLOCK_LEGACY_AUTOLOAD=y
+CONFIG_BUILDTIME_MCOUNT_SORT=y
+CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
+CONFIG_CC_NO_ARRAY_BOUNDS=y
+CONFIG_CLKBLD_I8253=y
+CONFIG_CLKEVT_I8253=y
+CONFIG_CLOCKSOURCE_VALIDATE_LAST_CYCLE=y
+CONFIG_CLOCKSOURCE_WATCHDOG=y
+CONFIG_CLOCKSOURCE_WATCHDOG_MAX_SKEW_US=100
+CONFIG_COMMON_CLK=y
+CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_CONTEXT_SWITCH_TRACER=y
+CONFIG_CONTEXT_TRACKING=y
+CONFIG_CONTEXT_TRACKING_IDLE=y
+# CONFIG_CPU5_WDT is not set
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_GOV_ATTR_SET=y
+CONFIG_CPU_FREQ_GOV_COMMON=y
+# CONFIG_CPU_FREQ_GOV_CONSERVATIVE is not set
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+# CONFIG_CPU_FREQ_GOV_POWERSAVE is not set
+# CONFIG_CPU_FREQ_GOV_USERSPACE is not set
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_LADDER=y
+CONFIG_CPU_SUP_AMD=y
+CONFIG_CPU_SUP_CENTAUR=y
+CONFIG_CPU_SUP_HYGON=y
+CONFIG_CPU_SUP_INTEL=y
+CONFIG_CPU_SUP_ZHAOXIN=y
+CONFIG_CRASH_CORE=y
+CONFIG_CRC16=y
+# CONFIG_CRYPTO_BLOWFISH_X86_64 is not set
+# CONFIG_CRYPTO_CAMELLIA_AESNI_AVX2_X86_64 is not set
+# CONFIG_CRYPTO_CAMELLIA_AESNI_AVX_X86_64 is not set
+# CONFIG_CRYPTO_CAMELLIA_X86_64 is not set
+# CONFIG_CRYPTO_CAST5_AVX_X86_64 is not set
+# CONFIG_CRYPTO_CAST6_AVX_X86_64 is not set
+CONFIG_CRYPTO_CRC32=y
+CONFIG_CRYPTO_CRC32C=y
+# CONFIG_CRYPTO_CRC32_PCLMUL is not set
+# CONFIG_CRYPTO_DES3_EDE_X86_64 is not set
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=11
+CONFIG_CRYPTO_LIB_SHA1=y
+CONFIG_CRYPTO_LIB_SHA256=y
+CONFIG_CRYPTO_LIB_UTILS=y
+# CONFIG_CRYPTO_NHPOLY1305_AVX2 is not set
+# CONFIG_CRYPTO_NHPOLY1305_SSE2 is not set
+CONFIG_CRYPTO_RNG2=y
+# CONFIG_CRYPTO_SERPENT_AVX2_X86_64 is not set
+# CONFIG_CRYPTO_SERPENT_AVX_X86_64 is not set
+# CONFIG_CRYPTO_SERPENT_SSE2_X86_64 is not set
+# CONFIG_CRYPTO_SHA1_SSSE3 is not set
+# CONFIG_CRYPTO_SHA512_SSSE3 is not set
+# CONFIG_CRYPTO_SM3_AVX_X86_64 is not set
+# CONFIG_CRYPTO_SM4_AESNI_AVX2_X86_64 is not set
+# CONFIG_CRYPTO_SM4_AESNI_AVX_X86_64 is not set
+# CONFIG_CRYPTO_TWOFISH_AVX_X86_64 is not set
+# CONFIG_CRYPTO_TWOFISH_X86_64 is not set
+# CONFIG_CRYPTO_TWOFISH_X86_64_3WAY is not set
+# CONFIG_CX_ECAT is not set
+CONFIG_DCACHE_WORD_ACCESS=y
+# CONFIG_DEBUG_BOOT_PARAMS is not set
+# CONFIG_DEBUG_ENTRY is not set
+CONFIG_DEBUG_INFO=y
+# CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP is not set
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_DEBUG_MISC=y
+# CONFIG_DEBUG_NMI_SELFTEST is not set
+# CONFIG_DEBUG_TLBFLUSH is not set
+CONFIG_DECOMPRESS_BZIP2=y
+CONFIG_DECOMPRESS_GZIP=y
+CONFIG_DMADEVICES=y
+CONFIG_DMA_ACPI=y
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_DMI=y
+CONFIG_DMIID=y
+CONFIG_DMI_SCAN_MACHINE_NON_EFI_FALLBACK=y
+CONFIG_DMI_SYSFS=y
+CONFIG_DNOTIFY=y
+CONFIG_DRM=y
+CONFIG_DRM_BRIDGE=y
+CONFIG_DRM_NOMODESET=y
+CONFIG_DRM_PANEL=y
+CONFIG_DRM_PANEL_BRIDGE=y
+CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_DYNAMIC_FTRACE=y
+CONFIG_DYNAMIC_FTRACE_WITH_ARGS=y
+CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS=y
+CONFIG_DYNAMIC_FTRACE_WITH_REGS=y
+CONFIG_DYNAMIC_MEMORY_LAYOUT=y
+CONFIG_DYNAMIC_SIGFRAME=y
+CONFIG_EARLY_PRINTK=y
+# CONFIG_EARLY_PRINTK_DBGP is not set
+CONFIG_EDAC_ATOMIC_SCRUB=y
+CONFIG_EDAC=y
+# CONFIG_EDAC_DECODE_MCE is not set
+# CONFIG_EDAC_DEBUG is not set
+CONFIG_EDAC_SUPPORT=y
+CONFIG_EDAC_LEGACY_SYSFS=y
+# CONFIG_EDAC_E7XXX is not set
+CONFIG_EDAC_E752X=y
+CONFIG_EDAC_I82975X=y
+CONFIG_EDAC_I3000=y
+CONFIG_EDAC_I3200=y
+CONFIG_EDAC_IE31200=y
+CONFIG_EDAC_X38=y
+CONFIG_EDAC_I5400=y
+CONFIG_EDAC_I7CORE=y
+CONFIG_EDAC_I5000=y
+CONFIG_EDAC_I5100=y
+CONFIG_EDAC_I7300=y
+# CONFIG_EDAC_I82875P is not set
+# CONFIG_EDAC_I82860 is not set
+CONFIG_EDAC_PND2=y
+# CONFIG_EDAC_R82600 is not set
+# CONFIG_EDAC_AMD76X is not set
+# CONFIG_EDD is not set
+CONFIG_EFI_HANDOVER_PROTOCOL=y
+# CONFIG_EFI_MIXED is not set
+# CONFIG_EISA is not set
+# CONFIG_EUROTECH_WDT is not set
+CONFIG_EVENT_TRACING=y
+CONFIG_EXCLUSIVE_SYSTEM_RAM=y
+CONFIG_EXT4_FS=y
+CONFIG_F2FS_FS=y
+# CONFIG_F71808E_WDT is not set
+CONFIG_FB_CMDLINE=y
+CONFIG_FIRMWARE_MEMMAP=y
+CONFIG_FIX_EARLYCON_MEM=y
+# CONFIG_FPROBE is not set
+CONFIG_FRAME_POINTER=y
+CONFIG_FS_IOMAP=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FTRACE=y
+CONFIG_FTRACE_MCOUNT_RECORD=y
+CONFIG_FTRACE_MCOUNT_USE_CC=y
+# CONFIG_FTRACE_SORT_STARTUP_TEST is not set
+# CONFIG_FTRACE_SYSCALLS is not set
+CONFIG_FUNCTION_GRAPH_TRACER=y
+# CONFIG_FUNCTION_PROFILER is not set
+CONFIG_FUNCTION_TRACER=y
+CONFIG_FUSION=y
+# CONFIG_FUSION_CTL is not set
+# CONFIG_FUSION_LOGGING is not set
+CONFIG_FUSION_MAX_SGE=128
+CONFIG_FUSION_SPI=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_FW_LOADER_SYSFS=y
+# CONFIG_GART_IOMMU is not set
+CONFIG_GCC11_NO_ARRAY_BOUNDS=y
+CONFIG_GCC12_NO_ARRAY_BOUNDS=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_ENTRY=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IRQ_MATRIX_ALLOCATOR=y
+CONFIG_GENERIC_IRQ_RESERVATION_MODE=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_ISA_DMA=y
+CONFIG_GENERIC_MSI_IRQ=y
+CONFIG_GENERIC_MSI_IRQ_DOMAIN=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GENERIC_TRACER=y
+CONFIG_GLOB=y
+CONFIG_GPIO_ACPI=y
+CONFIG_GPIO_CDEV=y
+# CONFIG_HANGCHECK_TIMER is not set
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HARDLOCKUP_CHECK_TIMESTAMP=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HDMI=y
+CONFIG_HID=y
+# CONFIG_HIST_TRIGGERS is not set
+# CONFIG_HPET is not set
+CONFIG_HPET_EMULATE_RTC=y
+CONFIG_HPET_TIMER=y
+# CONFIG_HP_ACCEL is not set
+CONFIG_HWMON=y
+CONFIG_HW_CONSOLE=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_VIA=y
+# CONFIG_HYPERVISOR_GUEST is not set
+CONFIG_HZ_PERIODIC=y
+CONFIG_I2C=y
+CONFIG_I2C_ALGOBIT=y
+# CONFIG_I2C_AMD_MP2 is not set
+CONFIG_I2C_BOARDINFO=y
+# CONFIG_I2C_HID_ACPI is not set
+CONFIG_I8253_LOCK=y
+# CONFIG_IA32_EMULATION is not set
+CONFIG_IA32_FEAT_CTL=y
+# CONFIG_IB700_WDT is not set
+# CONFIG_IBMASR is not set
+# CONFIG_IBM_RTL is not set
+# CONFIG_IE6XX_WDT is not set
+CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_INPUT=y
+CONFIG_INPUT_KEYBOARD=y
+CONFIG_INPUT_VIVALDIFMAP=y
+CONFIG_INSTRUCTION_DECODER=y
+# CONFIG_INTEL_HFI_THERMAL is not set
+# CONFIG_INTEL_IDXD_COMPAT is not set
+# CONFIG_INTEL_IPS is not set
+# CONFIG_INTEL_LDMA is not set
+# CONFIG_INTEL_MENLOW is not set
+# CONFIG_INTEL_PCH_THERMAL is not set
+# CONFIG_INTEL_POWERCLAMP is not set
+# CONFIG_INTEL_SAR_INT1092 is not set
+# CONFIG_INTEL_SCU_PCI is not set
+# CONFIG_INTEL_SCU_PLATFORM is not set
+# CONFIG_INTEL_SOC_DTS_THERMAL is not set
+# CONFIG_INTEL_SPEED_SELECT_INTERFACE is not set
+# CONFIG_INTEL_UNCORE_FREQ_CONTROL is not set
+# CONFIG_INTEL_VSEC is not set
+# CONFIG_IOSF_MBI is not set
+CONFIG_IO_DELAY_0X80=y
+# CONFIG_IO_DELAY_0XED is not set
+# CONFIG_IO_DELAY_NONE is not set
+# CONFIG_IO_DELAY_UDELAY is not set
+CONFIG_IO_URING=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_WORK=y
+CONFIG_ISA_DMA_API=y
+# CONFIG_ISCSI_IBFT is not set
+# CONFIG_IT8712F_WDT is not set
+# CONFIG_IT87_WDT is not set
+# CONFIG_ITCO_WDT is not set
+CONFIG_JBD2=y
+CONFIG_KALLSYMS=y
+CONFIG_KALLSYMS_ALL=y
+CONFIG_KCMP=y
+CONFIG_KEXEC=y
+CONFIG_KEXEC_CORE=y
+CONFIG_KEYBOARD_ATKBD=y
+# CONFIG_LEGACY_VSYSCALL_NONE is not set
+CONFIG_LEGACY_VSYSCALL_XONLY=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+# CONFIG_MACHZ_WDT is not set
+CONFIG_MAILBOX=y
+# CONFIG_MATOM is not set
+# CONFIG_MAXSMP is not set
+# CONFIG_MCORE2 is not set
+CONFIG_MEMFD_CREATE=y
+# CONFIG_MFD_INTEL_LPSS_ACPI is not set
+# CONFIG_MFD_INTEL_LPSS_PCI is not set
+# CONFIG_MFD_INTEL_PMC_BXT is not set
+CONFIG_MICROCODE=y
+CONFIG_MICROCODE_AMD=y
+CONFIG_MICROCODE_INTEL=y
+# CONFIG_MICROCODE_LATE_LOADING is not set
+CONFIG_MIGRATION=y
+# CONFIG_MK8 is not set
+CONFIG_MMCONF_FAM10H=y
+CONFIG_MMU_GATHER_MERGE_VMAS=y
+# CONFIG_MODIFY_LDT_SYSCALL is not set
+CONFIG_MODULES_TREE_LOOKUP=y
+CONFIG_MODULES_USE_ELF_RELA=y
+# CONFIG_MPSC is not set
+# CONFIG_MTD is not set
+CONFIG_MTRR=y
+# CONFIG_MTRR_SANITIZER is not set
+CONFIG_NAMESPACES=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y
+CONFIG_NEED_PER_CPU_KM=y
+CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK=y
+CONFIG_NEED_SG_DMA_LENGTH=y
+# CONFIG_NET_NS is not set
+CONFIG_NET_VENDOR_DAVICOM=y
+CONFIG_NET_VENDOR_FUNGIBLE=y
+CONFIG_NLS=y
+CONFIG_NOP_TRACER=y
+CONFIG_NR_CPUS=1
+CONFIG_NR_CPUS_DEFAULT=1
+CONFIG_NR_CPUS_RANGE_BEGIN=1
+CONFIG_NR_CPUS_RANGE_END=1
+CONFIG_NVRAM=y
+CONFIG_OBJTOOL=y
+# CONFIG_OF is not set
+CONFIG_OUTPUT_FORMAT="elf64-x86-64"
+# CONFIG_P2SB is not set
+CONFIG_PAGE_POOL=y
+CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
+CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
+CONFIG_PAGE_TABLE_ISOLATION=y
+CONFIG_PC104=y
+# CONFIG_PC87413_WDT is not set
+CONFIG_PCC=y
+# CONFIG_PCENGINES_APU2 is not set
+CONFIG_PCI=y
+CONFIG_PCI_ATS=y
+CONFIG_PCI_DIRECT=y
+CONFIG_PCI_DOMAINS=y
+# CONFIG_PCI_HYPERV is not set
+# CONFIG_PCI_HYPERV_INTERFACE is not set
+CONFIG_PCI_IOV=y
+CONFIG_PCI_LABEL=y
+CONFIG_PCI_LOCKLESS_CONFIG=y
+CONFIG_PCI_MMCONFIG=y
+CONFIG_PCI_MSI=y
+CONFIG_PCI_MSI_IRQ_DOMAIN=y
+CONFIG_PCSPKR_PLATFORM=y
+CONFIG_PERF_EVENTS=y
+CONFIG_PERF_EVENTS_AMD_BRS=y
+CONFIG_PERF_EVENTS_AMD_POWER=y
+CONFIG_PERF_EVENTS_AMD_UNCORE=y
+CONFIG_PERF_EVENTS_INTEL_CSTATE=y
+CONFIG_PERF_EVENTS_INTEL_RAPL=y
+CONFIG_PERF_EVENTS_INTEL_UNCORE=y
+CONFIG_PGTABLE_LEVELS=5
+CONFIG_PHYSICAL_ALIGN=0x200000
+CONFIG_PHYSICAL_START=0x1000000
+CONFIG_PHYS_ADDR_T_64BIT=y
+# CONFIG_PHY_INTEL_LGM_EMMC is not set
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_ALDERLAKE is not set
+# CONFIG_PINCTRL_BAYTRAIL is not set
+# CONFIG_PINCTRL_BROXTON is not set
+# CONFIG_PINCTRL_CANNONLAKE is not set
+# CONFIG_PINCTRL_CHERRYVIEW is not set
+# CONFIG_PINCTRL_DENVERTON is not set
+# CONFIG_PINCTRL_ELKHARTLAKE is not set
+# CONFIG_PINCTRL_EMMITSBURG is not set
+# CONFIG_PINCTRL_GEMINILAKE is not set
+# CONFIG_PINCTRL_JASPERLAKE is not set
+# CONFIG_PINCTRL_LAKEFIELD is not set
+# CONFIG_PINCTRL_LEWISBURG is not set
+# CONFIG_PINCTRL_LYNXPOINT is not set
+# CONFIG_PINCTRL_SUNRISEPOINT is not set
+# CONFIG_PINCTRL_TIGERLAKE is not set
+# CONFIG_PMIC_OPREGION is not set
+CONFIG_PNP=y
+CONFIG_PNPACPI=y
+CONFIG_PNP_DEBUG_MESSAGES=y
+CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PREEMPTION=y
+CONFIG_PREEMPT_BUILD=y
+CONFIG_PREEMPT_COUNT=y
+CONFIG_PREEMPT_DYNAMIC=y
+CONFIG_PREEMPT_RCU=y
+# CONFIG_PROCESSOR_SELECT is not set
+CONFIG_PROC_PAGE_MONITOR=y
+CONFIG_PROC_PID_ARCH_STATUS=y
+# CONFIG_PROVIDE_OHCI1394_DMA_INIT is not set
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+# CONFIG_PUNIT_ATOM_DEBUG is not set
+CONFIG_RANDOMIZE_KSTACK_OFFSET=y
+CONFIG_RANDSTRUCT_NONE=y
+CONFIG_RATIONAL=y
+CONFIG_RD_BZIP2=y
+CONFIG_RD_GZIP=y
+# CONFIG_RETHUNK is not set
+CONFIG_RETPOLINE=y
+CONFIG_RING_BUFFER=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_I2C_AND_SPI=y
+CONFIG_RTC_MC146818_LIB=y
+# CONFIG_RV is not set
+# CONFIG_SAMSUNG_Q10 is not set
+CONFIG_SATA_HOST=y
+# CONFIG_SBC_EPX_C3_WATCHDOG is not set
+# CONFIG_SC1200_WDT is not set
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+CONFIG_SCSI_SPI_ATTRS=y
+# CONFIG_SENSORS_ASUS_EC is not set
+CONFIG_SENSORS_FAM15H_POWER=y
+CONFIG_SENSORS_K10TEMP=y
+CONFIG_SERIAL_8250_PCI=y
+CONFIG_SERIAL_8250_PNP=y
+# CONFIG_SERIAL_LANTIQ is not set
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIO=y
+CONFIG_SERIO_I8042=y
+CONFIG_SERIO_LIBPS2=y
+CONFIG_SERIO_SERPORT=y
+CONFIG_SG_POOL=y
+# CONFIG_SIEMENS_SIMATIC_IPC is not set
+CONFIG_SKB_EXTENSIONS=y
+# CONFIG_SMSC37B787_WDT is not set
+# CONFIG_SMSC_SCH311X_WDT is not set
+CONFIG_SOFTIRQ_ON_OWN_STACK=y
+CONFIG_SPARSEMEM=y
+CONFIG_SPARSEMEM_EXTREME=y
+CONFIG_SPARSEMEM_VMEMMAP=y
+CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_SPECULATION_MITIGATIONS=y
+CONFIG_SRCU=y
+CONFIG_STACKTRACE=y
+# CONFIG_STATIC_CALL_SELFTEST is not set
+# CONFIG_STRICT_SIGALTSTACK_SIZE is not set
+CONFIG_SWIOTLB=y
+CONFIG_SYNC_FILE=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+# CONFIG_SYSFB_SIMPLEFB is not set
+# CONFIG_SYSTEM76_ACPI is not set
+# CONFIG_TELCLOCK is not set
+# CONFIG_TEST_FPU is not set
+CONFIG_THERMAL=y
+CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
+CONFIG_THERMAL_GOV_STEP_WISE=y
+CONFIG_THREAD_INFO_IN_TASK=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+# CONFIG_TOSHIBA_BT_RFKILL is not set
+# CONFIG_TQMX86_WDT is not set
+CONFIG_TRACEPOINTS=y
+CONFIG_TRACE_CLOCK=y
+CONFIG_TRACE_IRQFLAGS_NMI_SUPPORT=y
+CONFIG_TRACING=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_UNINLINE_SPIN_UNLOCK=y
+CONFIG_UNWINDER_FRAME_POINTER=y
+# CONFIG_UNWINDER_GUESS is not set
+# CONFIG_UNWINDER_ORC is not set
+CONFIG_UP_LATE_INIT=y
+CONFIG_USB=y
+CONFIG_USB_COMMON=y
+CONFIG_USB_EHCI_HCD=y
+# CONFIG_USB_EHCI_HCD_PLATFORM is not set
+CONFIG_USB_EHCI_PCI=y
+CONFIG_USB_HID=y
+CONFIG_USB_HIDDEV=y
+CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_OHCI_HCD_PCI=y
+# CONFIG_USB_OHCI_HCD_PLATFORM is not set
+CONFIG_USB_PCI=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USB_UHCI_HCD=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_PCI=y
+# CONFIG_USB_XHCI_PLATFORM is not set
+# CONFIG_USER_NS is not set
+CONFIG_USER_STACKTRACE_SUPPORT=y
+CONFIG_VGA_CONSOLE=y
+# CONFIG_VIA_WDT is not set
+# CONFIG_VMD is not set
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+# CONFIG_WAFER_WDT is not set
+# CONFIG_WINMATE_FM07_KEYS is not set
+# CONFIG_WIRELESS_HOTKEY is not set
+CONFIG_X86=y
+CONFIG_X86_5LEVEL=y
+CONFIG_X86_64=y
+CONFIG_X86_ACPI_CPUFREQ=y
+CONFIG_X86_ACPI_CPUFREQ_CPB=y
+CONFIG_X86_AMD_FREQ_SENSITIVITY=y
+CONFIG_X86_AMD_PLATFORM_DEVICE=y
+CONFIG_X86_AMD_PSTATE=y
+CONFIG_X86_AMD_PSTATE_DEFAULT_MODE=3
+# CONFIG_X86_CHECK_BIOS_CORRUPTION is not set
+CONFIG_X86_CMOV=y
+CONFIG_X86_CMPXCHG64=y
+# CONFIG_X86_CPA_STATISTICS is not set
+# CONFIG_X86_CPUID is not set
+# CONFIG_X86_CPU_RESCTRL is not set
+CONFIG_X86_DEBUGCTLMSR=y
+# CONFIG_X86_DEBUG_FPU is not set
+# CONFIG_X86_DECODER_SELFTEST is not set
+CONFIG_X86_DIRECT_GBPAGES=y
+# CONFIG_X86_EXTENDED_PLATFORM is not set
+CONFIG_X86_FEATURE_NAMES=y
+# CONFIG_X86_INTEL_LPSS is not set
+CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS=y
+# CONFIG_X86_INTEL_PSTATE is not set
+# CONFIG_X86_INTEL_TSX_MODE_AUTO is not set
+CONFIG_X86_INTEL_TSX_MODE_OFF=y
+# CONFIG_X86_INTEL_TSX_MODE_ON is not set
+CONFIG_X86_INTERNODE_CACHE_SHIFT=6
+CONFIG_X86_IOPL_IOPERM=y
+CONFIG_X86_IO_APIC=y
+# CONFIG_X86_KERNEL_IBT is not set
+CONFIG_X86_L1_CACHE_SHIFT=6
+CONFIG_X86_LOCAL_APIC=y
+CONFIG_X86_MCE=y
+# CONFIG_X86_MCELOG_LEGACY is not set
+CONFIG_X86_MCE_AMD=y
+# CONFIG_X86_MCE_INJECT is not set
+CONFIG_X86_MCE_INTEL=y
+CONFIG_X86_MCE_THRESHOLD=y
+CONFIG_X86_MINIMUM_CPU_FAMILY=64
+CONFIG_X86_MPPARSE=y
+CONFIG_X86_MSR=y
+# CONFIG_X86_P4_CLOCKMOD is not set
+CONFIG_X86_PAT=y
+# CONFIG_X86_PCC_CPUFREQ is not set
+CONFIG_X86_PLATFORM_DEVICES=y
+# CONFIG_X86_PLATFORM_DRIVERS_DELL is not set
+# CONFIG_X86_PMEM_LEGACY is not set
+CONFIG_X86_PM_TIMER=y
+# CONFIG_X86_POWERNOW_K8 is not set
+CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS=y
+# CONFIG_X86_SPEEDSTEP_CENTRINO is not set
+CONFIG_X86_SUPPORTS_MEMORY_FAILURE=y
+CONFIG_X86_THERMAL_VECTOR=y
+CONFIG_X86_TSC=y
+CONFIG_X86_UMIP=y
+# CONFIG_X86_USER_SHADOW_STACK is not set
+CONFIG_X86_VERBOSE_BOOTUP=y
+CONFIG_X86_VMX_FEATURE_NAMES=y
+CONFIG_X86_VSYSCALL_EMULATION=y
+# CONFIG_X86_X2APIC is not set
+# CONFIG_X86_X32_ABI is not set
+# CONFIG_XEN_DOM0 is not set
+CONFIG_XZ_DEC_BCJ=y
+CONFIG_XZ_DEC_X86=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZONE_DMA32=y
diff --git a/6.12/target/linux/x86/generic/config-6.12 b/6.12/target/linux/x86/generic/config-6.12
new file mode 100644
index 00000000..2556c200
--- /dev/null
+++ b/6.12/target/linux/x86/generic/config-6.12
@@ -0,0 +1,531 @@
+# CONFIG_3C515 is not set
+CONFIG_ACPI=y
+CONFIG_ACPI_AC=y
+CONFIG_ACPI_BATTERY=y
+# CONFIG_ACPI_BGRT is not set
+CONFIG_ACPI_BUTTON=y
+# CONFIG_ACPI_CMPC is not set
+CONFIG_ACPI_CONTAINER=y
+CONFIG_ACPI_CPU_FREQ_PSS=y
+# CONFIG_ACPI_DEBUG is not set
+# CONFIG_ACPI_DEBUGGER is not set
+# CONFIG_ACPI_DOCK is not set
+# CONFIG_ACPI_DPTF is not set
+# CONFIG_ACPI_EC_DEBUGFS is not set
+# CONFIG_ACPI_FAN is not set
+CONFIG_ACPI_HOTPLUG_CPU=y
+CONFIG_ACPI_HOTPLUG_IOAPIC=y
+# CONFIG_ACPI_I2C_OPREGION is not set
+CONFIG_ACPI_LEGACY_TABLES_LOOKUP=y
+# CONFIG_ACPI_PCI_SLOT is not set
+CONFIG_ACPI_PROCESSOR=y
+# CONFIG_ACPI_PROCESSOR_AGGREGATOR is not set
+CONFIG_ACPI_PROCESSOR_CSTATE=y
+CONFIG_ACPI_PROCESSOR_IDLE=y
+CONFIG_ACPI_REV_OVERRIDE_POSSIBLE=y
+# CONFIG_ACPI_SBS is not set
+CONFIG_ACPI_SPCR_TABLE=y
+CONFIG_ACPI_SYSTEM_POWER_STATES_SUPPORT=y
+CONFIG_ACPI_TAD=y
+CONFIG_ACPI_THERMAL=y
+CONFIG_ACPI_VIDEO=y
+# CONFIG_ACPI_WMI is not set
+CONFIG_AGP=y
+# CONFIG_AGP_ALI is not set
+# CONFIG_AGP_AMD is not set
+# CONFIG_AGP_AMD64 is not set
+# CONFIG_AGP_ATI is not set
+# CONFIG_AGP_EFFICEON is not set
+CONFIG_AGP_INTEL=y
+# CONFIG_AGP_NVIDIA is not set
+# CONFIG_AGP_SIS is not set
+# CONFIG_AGP_SWORKS is not set
+# CONFIG_AGP_VIA is not set
+# CONFIG_ALIX is not set
+# CONFIG_AMD_PMC is not set
+# CONFIG_APM is not set
+CONFIG_ARCH_CPUIDLE_HALTPOLL=y
+CONFIG_ARCH_DMA_ADDR_T_64BIT=y
+CONFIG_ARCH_MIGHT_HAVE_ACPI_PDC=y
+CONFIG_ARCH_MMAP_RND_BITS=8
+# CONFIG_ASUS_TF103C_DOCK is not set
+CONFIG_BACKLIGHT_CLASS_DEVICE=y
+CONFIG_BALLOON_COMPACTION=y
+# CONFIG_BARCO_P50_GPIO is not set
+CONFIG_BLK_DEV_SR=y
+CONFIG_BLK_MQ_VIRTIO=y
+CONFIG_BLK_PM=y
+# CONFIG_BOOTPARAM_HOTPLUG_CPU0 is not set
+CONFIG_BTT=y
+CONFIG_CDROM=y
+# CONFIG_COMPAT_VDSO is not set
+CONFIG_CONNECTOR=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL=y
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+# CONFIG_CPU_IDLE_GOV_HALTPOLL is not set
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_RMAP=y
+# CONFIG_CS89x0_ISA is not set
+# CONFIG_DEBUG_HOTPLUG_CPU0 is not set
+CONFIG_DMA_ACPI=y
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_DRM=y
+CONFIG_DRM_BOCHS=y
+CONFIG_DRM_BRIDGE=y
+CONFIG_DRM_BUDDY=y
+CONFIG_DRM_DP_HELPER=y
+CONFIG_DRM_FBDEV_EMULATION=y
+CONFIG_DRM_FBDEV_OVERALLOC=100
+CONFIG_DRM_GEM_SHMEM_HELPER=y
+# CONFIG_DRM_HYPERV is not set
+CONFIG_DRM_I915=y
+CONFIG_DRM_I915_CAPTURE_ERROR=y
+CONFIG_DRM_I915_COMPRESS_ERROR=y
+# CONFIG_DRM_I915_DEBUG is not set
+# CONFIG_DRM_I915_DEBUG_GUC is not set
+# CONFIG_DRM_I915_DEBUG_MMIO is not set
+# CONFIG_DRM_I915_DEBUG_RUNTIME_PM is not set
+# CONFIG_DRM_I915_DEBUG_VBLANK_EVADE is not set
+CONFIG_DRM_I915_FENCE_TIMEOUT=10000
+CONFIG_DRM_I915_FORCE_PROBE=""
+CONFIG_DRM_I915_HEARTBEAT_INTERVAL=2500
+# CONFIG_DRM_I915_LOW_LEVEL_TRACEPOINTS is not set
+CONFIG_DRM_I915_MAX_REQUEST_BUSYWAIT=8000
+CONFIG_DRM_I915_PREEMPT_TIMEOUT=640
+CONFIG_DRM_I915_PXP=y
+# CONFIG_DRM_I915_SELFTEST is not set
+CONFIG_DRM_I915_STOP_TIMEOUT=100
+# CONFIG_DRM_I915_SW_FENCE_CHECK_DAG is not set
+# CONFIG_DRM_I915_SW_FENCE_DEBUG_OBJECTS is not set
+CONFIG_DRM_I915_TIMESLICE_DURATION=1
+CONFIG_DRM_I915_USERFAULT_AUTOSUSPEND=250
+CONFIG_DRM_I915_USERPTR=y
+# CONFIG_DRM_I915_WERROR is not set
+CONFIG_DRM_KMS_HELPER=y
+CONFIG_DRM_MIPI_DSI=y
+CONFIG_DRM_NOMODESET=y
+CONFIG_DRM_PANEL=y
+CONFIG_DRM_PANEL_BRIDGE=y
+CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y
+# CONFIG_DRM_SIMPLEDRM is not set
+# CONFIG_DRM_SSD130X is not set
+CONFIG_DRM_TTM=y
+CONFIG_DRM_TTM_HELPER=y
+CONFIG_DRM_VIRTIO_GPU=y
+CONFIG_DRM_VRAM_HELPER=y
+CONFIG_EFI=y
+CONFIG_EFIVAR_FS=m
+# CONFIG_EFI_BOOTLOADER_CONTROL is not set
+# CONFIG_EFI_CAPSULE_LOADER is not set
+# CONFIG_EFI_CAPSULE_QUIRK_QUARK_CSH is not set
+# CONFIG_EFI_CUSTOM_SSDT_OVERLAYS is not set
+# CONFIG_EFI_DISABLE_PCI_DMA is not set
+CONFIG_EFI_EARLYCON=y
+CONFIG_EFI_ESRT=y
+# CONFIG_EFI_FAKE_MEMMAP is not set
+CONFIG_EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER=y
+# CONFIG_EFI_PGT_DUMP is not set
+# CONFIG_EFI_RCI2_TABLE is not set
+CONFIG_EFI_RUNTIME_MAP=y
+CONFIG_EFI_RUNTIME_WRAPPERS=y
+CONFIG_EFI_STUB=y
+# CONFIG_EFI_TEST is not set
+# CONFIG_EFI_VARS is not set
+# CONFIG_EL3 is not set
+CONFIG_FAILOVER=y
+CONFIG_FB=y
+CONFIG_FB_CFB_COPYAREA=y
+CONFIG_FB_CFB_FILLRECT=y
+CONFIG_FB_CFB_IMAGEBLIT=y
+CONFIG_FB_CMDLINE=y
+CONFIG_FB_DEFERRED_IO=y
+CONFIG_FB_EFI=y
+CONFIG_FB_HYPERV=y
+# CONFIG_FB_I810 is not set
+CONFIG_FB_SIMPLE=y
+CONFIG_FB_SYS_COPYAREA=y
+CONFIG_FB_SYS_FILLRECT=y
+CONFIG_FB_SYS_FOPS=y
+CONFIG_FB_SYS_IMAGEBLIT=y
+# CONFIG_FB_VESA is not set
+CONFIG_FONT_8x16=y
+CONFIG_FONT_8x8=y
+CONFIG_FONT_SUPPORT=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y
+CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION=y
+# CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set
+CONFIG_FREEZER=y
+CONFIG_FW_CACHE=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_MIGRATION=y
+CONFIG_GENERIC_PENDING_IRQ=y
+CONFIG_GENERIC_PINCONF=y
+# CONFIG_GEOS is not set
+CONFIG_GPIOLIB=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_ACPI=y
+CONFIG_GPIO_CASCADE=y
+CONFIG_GPIO_CDEV=y
+# CONFIG_GPIO_SIM is not set
+CONFIG_GPIO_VIRTIO=y
+CONFIG_GUEST_PERF_EVENTS=y
+CONFIG_GUP_GET_PTE_LOW_HIGH=y
+CONFIG_HALTPOLL_CPUIDLE=y
+CONFIG_HDMI=y
+CONFIG_HIBERNATE_CALLBACKS=y
+CONFIG_HID_BATTERY_STRENGTH=y
+CONFIG_HID_GENERIC=y
+CONFIG_HID_HYPERV_MOUSE=y
+# CONFIG_HIGHMEM4G is not set
+CONFIG_HIGHMEM64G=y
+# CONFIG_HIGHPTE is not set
+CONFIG_HOTPLUG_CPU=y
+CONFIG_HOTPLUG_PCI=y
+CONFIG_HOTPLUG_PCI_ACPI=y
+# CONFIG_HOTPLUG_PCI_ACPI_IBM is not set
+# CONFIG_HOTPLUG_PCI_COMPAQ is not set
+# CONFIG_HOTPLUG_PCI_CPCI is not set
+# CONFIG_HOTPLUG_PCI_IBM is not set
+CONFIG_HOTPLUG_PCI_PCIE=y
+# CONFIG_HOTPLUG_PCI_SHPC is not set
+CONFIG_HOTPLUG_SMT=y
+CONFIG_HPET=y
+CONFIG_HPET_MMAP=y
+# CONFIG_HP_ACCEL is not set
+CONFIG_HVC_DRIVER=y
+CONFIG_HVC_IRQ=y
+CONFIG_HVC_XEN=y
+CONFIG_HVC_XEN_FRONTEND=y
+CONFIG_HWMON=y
+CONFIG_HWMON_VID=y
+CONFIG_HW_RANDOM_VIRTIO=y
+CONFIG_HYPERV=y
+CONFIG_HYPERVISOR_GUEST=y
+CONFIG_HYPERV_BALLOON=y
+CONFIG_HYPERV_KEYBOARD=y
+CONFIG_HYPERV_NET=y
+CONFIG_HYPERV_STORAGE=y
+# CONFIG_HYPERV_TESTING is not set
+CONFIG_HYPERV_TIMER=y
+CONFIG_HYPERV_UTILS=y
+CONFIG_I2C=y
+CONFIG_I2C_ALGOBIT=y
+# CONFIG_I2C_AMD_MP2 is not set
+CONFIG_I2C_BOARDINFO=y
+# CONFIG_I2C_HID_ACPI is not set
+# CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is not set
+CONFIG_INPUT_MOUSE=y
+CONFIG_INPUT_MOUSEDEV=y
+CONFIG_INPUT_MOUSEDEV_PSAUX=y
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+CONFIG_INPUT_XEN_KBDDEV_FRONTEND=y
+CONFIG_INTEL_GTT=y
+CONFIG_INTEL_IDLE=y
+# CONFIG_INTEL_IPS is not set
+CONFIG_INTEL_MEI=y
+# CONFIG_INTEL_MEI_HDCP is not set
+CONFIG_INTEL_MEI_ME=y
+CONFIG_INTEL_MEI_PXP=y
+# CONFIG_INTEL_MEI_WDT is not set
+# CONFIG_INTEL_MENLOW is not set
+CONFIG_INTEL_PCH_THERMAL=y
+# CONFIG_INTEL_SAR_INT1092 is not set
+# CONFIG_INTEL_SCU_PLATFORM is not set
+CONFIG_INTEL_SOC_DTS_IOSF_CORE=y
+CONFIG_INTEL_SOC_DTS_THERMAL=y
+CONFIG_INTERVAL_TREE=y
+CONFIG_IOSF_MBI=y
+# CONFIG_IOSF_MBI_DEBUG is not set
+CONFIG_IRQ_BYPASS_MANAGER=y
+CONFIG_ISA=y
+CONFIG_ISAPNP=y
+CONFIG_ISA_BUS_API=y
+# CONFIG_ISCSI_IBFT is not set
+CONFIG_ISO9660_FS=y
+# CONFIG_JOLIET is not set
+CONFIG_KCMP=y
+CONFIG_KVM=y
+CONFIG_KVM_AMD=y
+CONFIG_KVM_ASYNC_PF=y
+CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT=y
+CONFIG_KVM_GUEST=y
+CONFIG_KVM_INTEL=y
+CONFIG_KVM_MMIO=y
+CONFIG_KVM_VFIO=y
+# CONFIG_KVM_XEN is not set
+CONFIG_KVM_XFER_TO_GUEST_WORK=y
+# CONFIG_LANCE is not set
+CONFIG_LIBNVDIMM=y
+CONFIG_LIVEPATCH=y
+CONFIG_LOCK_SPIN_ON_OWNER=y
+# CONFIG_M686 is not set
+# CONFIG_M486SX is not set
+# CONFIG_M486 is not set
+# CONFIG_M586 is not set
+# CONFIG_M586TSC is not set
+# CONFIG_M586MMX is not set
+# CONFIG_M686 is not set
+# CONFIG_MPENTIUMII is not set
+# CONFIG_MPENTIUMIII is not set
+# CONFIG_MPENTIUMM is not set
+CONFIG_MPENTIUM4=y
+# CONFIG_MK6 is not set
+# CONFIG_MK7 is not set
+# CONFIG_MK8 is not set
+# CONFIG_MCRUSOE is not set
+# CONFIG_MEFFICEON is not set
+# CONFIG_MWINCHIPC6 is not set
+# CONFIG_MWINCHIP3D is not set
+# CONFIG_MELAN is not set
+# CONFIG_MGEODEGX1 is not set
+# CONFIG_MGEODE_LX is not set
+# CONFIG_MCYRIXIII is not set
+# CONFIG_MVIAC3_2 is not set
+# CONFIG_MVIAC7 is not set
+# CONFIG_MCORE2 is not set
+# CONFIG_MATOM is not set
+# CONFIG_MDA_CONSOLE is not set
+CONFIG_MEMORY_BALLOON=y
+CONFIG_MEMREGION=y
+CONFIG_MFD_CORE=y
+CONFIG_MFD_INTEL_LPSS=y
+CONFIG_MFD_INTEL_LPSS_ACPI=y
+# CONFIG_MFD_INTEL_PMC_BXT is not set
+# CONFIG_MFD_SIMPLE_MFD_I2C is not set
+# CONFIG_MIXCOMWD is not set
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_CQHCI=y
+CONFIG_MMC_RICOH_MMC=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_IO_ACCESSORS=y
+CONFIG_MMC_SDHCI_PCI=y
+# CONFIG_MMC_SDHCI_PLTFM is not set
+# CONFIG_MMC_WBSD is not set
+CONFIG_MMU_NOTIFIER=y
+# CONFIG_MOUSE_BCM5974 is not set
+# CONFIG_MOUSE_CYAPA is not set
+CONFIG_MOUSE_PS2=y
+CONFIG_MOUSE_PS2_ALPS=y
+# CONFIG_MOUSE_PS2_BYD is not set
+# CONFIG_MOUSE_PS2_CYPRESS is not set
+# CONFIG_MOUSE_PS2_ELANTECH is not set
+CONFIG_MOUSE_PS2_LIFEBOOK=y
+CONFIG_MOUSE_PS2_LOGIPS2PP=y
+CONFIG_MOUSE_PS2_SMBUS=y
+CONFIG_MOUSE_PS2_SYNAPTICS=y
+CONFIG_MOUSE_PS2_SYNAPTICS_SMBUS=y
+# CONFIG_MOUSE_PS2_TOUCHKIT is not set
+CONFIG_MOUSE_PS2_TRACKPOINT=y
+# CONFIG_MOUSE_PS2_VMMOUSE is not set
+# CONFIG_MOUSE_SERIAL is not set
+# CONFIG_MOUSE_VSXXXAA is not set
+CONFIG_MPENTIUM4=y
+CONFIG_MULTIPLEXER=y
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+# CONFIG_MUX_ADG792A is not set
+# CONFIG_MUX_GPIO is not set
+CONFIG_ND_CLAIM=y
+CONFIG_NEED_DMA_MAP_STATE=y
+# CONFIG_NET5501 is not set
+CONFIG_NET_FAILOVER=y
+CONFIG_NET_FLOW_LIMIT=y
+# CONFIG_NOHIGHMEM is not set
+CONFIG_NO_HZ=y
+CONFIG_NR_CPUS=4
+CONFIG_NR_CPUS_DEFAULT=8
+CONFIG_NR_CPUS_RANGE_BEGIN=2
+CONFIG_NR_CPUS_RANGE_END=8
+# CONFIG_NSC_GPIO is not set
+CONFIG_PADATA=y
+CONFIG_PAGE_REPORTING=y
+CONFIG_PAGE_TABLE_ISOLATION=y
+CONFIG_PARAVIRT=y
+CONFIG_PARAVIRT_CLOCK=y
+# CONFIG_PARAVIRT_DEBUG is not set
+CONFIG_PARAVIRT_SPINLOCKS=y
+CONFIG_PATA_AMD=y
+CONFIG_PATA_ATIIXP=y
+CONFIG_PATA_MPIIX=y
+CONFIG_PATA_OLDPIIX=y
+CONFIG_PATA_PLATFORM=y
+CONFIG_PATA_SC1200=y
+CONFIG_PATA_TIMINGS=y
+CONFIG_PATA_VIA=y
+# CONFIG_PC8736x_GPIO is not set
+# CONFIG_PCENGINES_APU2 is not set
+CONFIG_PCIEAER=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCIE_PME=y
+# CONFIG_PCI_GOBIOS is not set
+# CONFIG_PCI_GOMMCONFIG is not set
+# CONFIG_PCI_GODIRECT is not set
+CONFIG_PCI_GOANY=y
+CONFIG_PCI_MMCONFIG=y
+CONFIG_PCI_XEN=y
+# CONFIG_PCWATCHDOG is not set
+CONFIG_PGTABLE_LEVELS=3
+CONFIG_PHYS_ADDR_T_64BIT=y
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_ALDERLAKE is not set
+CONFIG_PINCTRL_BAYTRAIL=y
+CONFIG_PINCTRL_BROXTON=y
+CONFIG_PINCTRL_CANNONLAKE=y
+CONFIG_PINCTRL_CHERRYVIEW=y
+CONFIG_PINCTRL_DENVERTON=y
+# CONFIG_PINCTRL_ELKHARTLAKE is not set
+# CONFIG_PINCTRL_EMMITSBURG is not set
+CONFIG_PINCTRL_GEMINILAKE=y
+CONFIG_PINCTRL_INTEL=y
+# CONFIG_PINCTRL_JASPERLAKE is not set
+# CONFIG_PINCTRL_LAKEFIELD is not set
+# CONFIG_PINCTRL_LEWISBURG is not set
+# CONFIG_PINCTRL_LYNXPOINT is not set
+CONFIG_PINCTRL_SUNRISEPOINT=y
+# CONFIG_PINCTRL_TIGERLAKE is not set
+CONFIG_PM=y
+# CONFIG_PMIC_OPREGION is not set
+CONFIG_PM_CLK=y
+CONFIG_PM_SLEEP=y
+CONFIG_PM_SLEEP_SMP=y
+CONFIG_PNP=y
+CONFIG_PNPACPI=y
+# CONFIG_PNPBIOS is not set
+CONFIG_PNP_DEBUG_MESSAGES=y
+CONFIG_PREEMPT_NOTIFIERS=y
+CONFIG_PROC_EVENTS=y
+CONFIG_PVH=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_RAS=y
+CONFIG_RELAY=y
+CONFIG_RELOCATABLE=y
+CONFIG_RESET_ATTACK_MITIGATION=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+CONFIG_RTC_I2C_AND_SPI=y
+CONFIG_RWSEM_SPIN_ON_OWNER=y
+# CONFIG_SAMSUNG_Q10 is not set
+CONFIG_SATA_AHCI=y
+CONFIG_SATA_VIA=y
+# CONFIG_SBC7240_WDT is not set
+# CONFIG_SBC8360_WDT is not set
+# CONFIG_SCHED_CORE is not set
+CONFIG_SCHED_INFO=y
+CONFIG_SCHED_SMT=y
+# CONFIG_SCSI_FDOMAIN_ISA is not set
+CONFIG_SCSI_VIRTIO=y
+# CONFIG_SCx200 is not set
+# CONFIG_SENSORS_ASUS_EC is not set
+CONFIG_SENSORS_CORETEMP=y
+CONFIG_SENSORS_FAM15H_POWER=y
+CONFIG_SENSORS_I5500=y
+CONFIG_SENSORS_K10TEMP=y
+CONFIG_SENSORS_K8TEMP=y
+# CONFIG_SENSORS_SY7636A is not set
+# CONFIG_SENSORS_TMP464 is not set
+CONFIG_SENSORS_VIA_CPUTEMP=y
+CONFIG_SERIAL_8250_PNP=y
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SMP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SWIOTLB=y
+CONFIG_SYNC_FILE=y
+# CONFIG_SYSTEM76_ACPI is not set
+CONFIG_SYS_HYPERVISOR=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+CONFIG_THERMAL_GOV_USER_SPACE=y
+CONFIG_THERMAL_HWMON=y
+CONFIG_THERMAL_WRITABLE_TRIPS=y
+# CONFIG_TOSHIBA is not set
+# CONFIG_TOSHIBA_BT_RFKILL is not set
+# CONFIG_UCLAMP_TASK is not set
+CONFIG_UCS2_STRING=y
+CONFIG_USB_STORAGE=y
+# CONFIG_USB_XEN_HCD is not set
+CONFIG_USER_RETURN_NOTIFIER=y
+CONFIG_VHOST=y
+CONFIG_VHOST_IOTLB=y
+CONFIG_VHOST_NET=y
+CONFIG_VIRTIO=y
+CONFIG_VIRTIO_BALLOON=y
+CONFIG_VIRTIO_BLK=y
+CONFIG_VIRTIO_CONSOLE=y
+CONFIG_VIRTIO_DMA_SHARED_BUFFER=y
+CONFIG_VIRTIO_INPUT=y
+CONFIG_VIRTIO_MMIO=y
+CONFIG_VIRTIO_NET=y
+CONFIG_VIRTIO_PCI=y
+CONFIG_VIRTIO_PCI_LEGACY=y
+CONFIG_VIRTIO_PCI_LIB=y
+CONFIG_VIRTIO_PCI_LIB_LEGACY=y
+# CONFIG_VIRTIO_PMEM is not set
+CONFIG_VIRTUALIZATION=y
+CONFIG_VMAP_PFN=y
+CONFIG_VT_CONSOLE_SLEEP=y
+CONFIG_WATCHDOG_CORE=y
+# CONFIG_WDT is not set
+# CONFIG_WIRELESS_HOTKEY is not set
+# CONFIG_X86_32_IRIS is not set
+CONFIG_X86_32_SMP=y
+CONFIG_X86_ACPI_CPUFREQ=y
+# CONFIG_X86_ACPI_CPUFREQ_CPB is not set
+CONFIG_X86_AMD_FREQ_SENSITIVITY=y
+# CONFIG_X86_AMD_PLATFORM_DEVICE is not set
+CONFIG_X86_AMD_PSTATE=y
+# CONFIG_X86_ANCIENT_MCE is not set
+# CONFIG_X86_BIGSMP is not set
+# CONFIG_X86_CPUFREQ_NFORCE2 is not set
+CONFIG_X86_CPUID=y
+# CONFIG_X86_E_POWERSAVER is not set
+# CONFIG_X86_GENERIC is not set
+# CONFIG_X86_GX_SUSPMOD is not set
+CONFIG_X86_HV_CALLBACK_VECTOR=y
+CONFIG_X86_INTEL_LPSS=y
+CONFIG_X86_INTEL_PSTATE=y
+CONFIG_X86_INTERNODE_CACHE_SHIFT=7
+CONFIG_X86_L1_CACHE_SHIFT=7
+# CONFIG_X86_LEGACY_VM86 is not set
+# CONFIG_X86_LONGHAUL is not set
+# CONFIG_X86_LONGRUN is not set
+CONFIG_X86_NEED_RELOCS=y
+CONFIG_X86_PAE=y
+# CONFIG_X86_PCC_CPUFREQ is not set
+CONFIG_X86_PKG_TEMP_THERMAL=y
+# CONFIG_X86_PMEM_LEGACY is not set
+CONFIG_X86_PM_TIMER=y
+# CONFIG_X86_POWERNOW_K6 is not set
+# CONFIG_X86_POWERNOW_K7 is not set
+# CONFIG_X86_POWERNOW_K8 is not set
+# CONFIG_X86_REBOOTFIXUPS is not set
+# CONFIG_X86_SPEEDSTEP_ICH is not set
+# CONFIG_X86_SPEEDSTEP_SMI is not set
+CONFIG_XEN=y
+CONFIG_XENFS=y
+CONFIG_XEN_ACPI=y
+CONFIG_XEN_AUTO_XLATE=y
+# CONFIG_XEN_BACKEND is not set
+CONFIG_XEN_BALLOON=y
+CONFIG_XEN_BLKDEV_FRONTEND=y
+CONFIG_XEN_COMPAT_XENFS=y
+CONFIG_XEN_DEBUG_FS=y
+CONFIG_XEN_DEV_EVTCHN=y
+CONFIG_XEN_FBDEV_FRONTEND=y
+CONFIG_XEN_GNTDEV=y
+CONFIG_XEN_GRANT_DEV_ALLOC=y
+CONFIG_XEN_NETDEV_FRONTEND=y
+CONFIG_XEN_PRIVCMD=y
+CONFIG_XEN_PVH=y
+CONFIG_XEN_PVHVM=y
+CONFIG_XEN_PVHVM_GUEST=y
+CONFIG_XEN_PVHVM_SMP=y
+CONFIG_XEN_SAVE_RESTORE=y
+CONFIG_XEN_SCSI_FRONTEND=y
+CONFIG_XEN_SYS_HYPERVISOR=y
+CONFIG_XEN_WDT=y
+CONFIG_XEN_XENBUS_FRONTEND=y
+CONFIG_XPS=y
+CONFIG_ZLIB_DEFLATE=y
diff --git a/6.12/target/linux/x86/geode/config-6.12 b/6.12/target/linux/x86/geode/config-6.12
new file mode 100644
index 00000000..465fd617
--- /dev/null
+++ b/6.12/target/linux/x86/geode/config-6.12
@@ -0,0 +1,150 @@
+# CONFIG_3C515 is not set
+CONFIG_8139CP=y
+CONFIG_8139TOO=y
+CONFIG_8139TOO_8129=y
+CONFIG_8139TOO_PIO=y
+# CONFIG_8139TOO_TUNE_TWISTER is not set
+# CONFIG_8139_OLD_RX_RESET is not set
+CONFIG_ACPI=y
+CONFIG_ACPI_AC=y
+# CONFIG_ACPI_BATTERY is not set
+# CONFIG_ACPI_CMPC is not set
+# CONFIG_ACPI_CONTAINER is not set
+CONFIG_ACPI_CPU_FREQ_PSS=y
+# CONFIG_ACPI_DEBUG is not set
+# CONFIG_ACPI_DEBUGGER is not set
+# CONFIG_ACPI_DOCK is not set
+# CONFIG_ACPI_DPTF is not set
+# CONFIG_ACPI_EC_DEBUGFS is not set
+CONFIG_ACPI_FAN=y
+CONFIG_ACPI_HOTPLUG_IOAPIC=y
+CONFIG_ACPI_I2C_OPREGION=y
+CONFIG_ACPI_LEGACY_TABLES_LOOKUP=y
+# CONFIG_ACPI_PCI_SLOT is not set
+CONFIG_ACPI_PROCESSOR=y
+# CONFIG_ACPI_PROCESSOR_AGGREGATOR is not set
+CONFIG_ACPI_PROCESSOR_CSTATE=y
+CONFIG_ACPI_PROCESSOR_IDLE=y
+CONFIG_ACPI_REV_OVERRIDE_POSSIBLE=y
+# CONFIG_ACPI_SBS is not set
+CONFIG_ACPI_SPCR_TABLE=y
+CONFIG_ACPI_SYSTEM_POWER_STATES_SUPPORT=y
+CONFIG_ACPI_THERMAL=y
+# CONFIG_ACPI_TINY_POWER_BUTTON is not set
+# CONFIG_ACPI_WMI is not set
+CONFIG_ALIX=y
+# CONFIG_AMD_PMC is not set
+CONFIG_ARCH_MIGHT_HAVE_ACPI_PDC=y
+# CONFIG_ASUS_TF103C_DOCK is not set
+# CONFIG_ATA_PIIX is not set
+# CONFIG_BARCO_P50_GPIO is not set
+CONFIG_CS5535_CLOCK_EVENT_SRC=y
+CONFIG_CS5535_MFGPT=y
+CONFIG_CS5535_MFGPT_DEFAULT_IRQ=7
+# CONFIG_CS89x0_ISA is not set
+CONFIG_DMA_ACPI=y
+# CONFIG_EL3 is not set
+CONFIG_GEODE_WDT=y
+CONFIG_GEOS=y
+CONFIG_GPIOLIB=y
+CONFIG_GPIO_ACPI=y
+# CONFIG_GPIO_CASCADE is not set
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_CS5535=y
+# CONFIG_GPIO_SIM is not set
+# CONFIG_HPET is not set
+# CONFIG_HP_ACCEL is not set
+CONFIG_HWMON=y
+CONFIG_I2C=y
+CONFIG_I2C_ALGOBIT=y
+CONFIG_I2C_ALGOPCA=y
+CONFIG_I2C_ALGOPCF=y
+# CONFIG_I2C_AMD_MP2 is not set
+CONFIG_I2C_BOARDINFO=y
+# CONFIG_I2C_HID_ACPI is not set
+# CONFIG_INTEL_IPS is not set
+# CONFIG_INTEL_MENLOW is not set
+# CONFIG_INTEL_SAR_INT1092 is not set
+# CONFIG_INTEL_SCU_PLATFORM is not set
+# CONFIG_INTEL_SOC_DTS_THERMAL is not set
+CONFIG_IOSF_MBI=y
+# CONFIG_IOSF_MBI_DEBUG is not set
+CONFIG_ISA=y
+# CONFIG_ISAPNP is not set
+CONFIG_ISA_BUS_API=y
+# CONFIG_ISCSI_IBFT is not set
+# CONFIG_LANCE is not set
+CONFIG_LEDS_GPIO=y
+# CONFIG_M686 is not set
+# CONFIG_MDA_CONSOLE is not set
+CONFIG_MFD_CORE=y
+CONFIG_MFD_CS5535=y
+# CONFIG_MFD_INTEL_LPSS_ACPI is not set
+# CONFIG_MFD_INTEL_PMC_BXT is not set
+# CONFIG_MFD_SIMPLE_MFD_I2C is not set
+CONFIG_MGEODEGX1=y
+# CONFIG_MIXCOMWD is not set
+CONFIG_NATSEMI=y
+CONFIG_NET5501=y
+CONFIG_NSC_GPIO=y
+CONFIG_PATA_CS5520=y
+CONFIG_PATA_CS5530=y
+CONFIG_PATA_CS5535=y
+CONFIG_PATA_CS5536=y
+CONFIG_PATA_SC1200=y
+CONFIG_PC8736x_GPIO=y
+# CONFIG_PCENGINES_APU2 is not set
+CONFIG_PCI_MMCONFIG=y
+# CONFIG_PCWATCHDOG is not set
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_ALDERLAKE is not set
+# CONFIG_PINCTRL_BAYTRAIL is not set
+# CONFIG_PINCTRL_BROXTON is not set
+# CONFIG_PINCTRL_CANNONLAKE is not set
+# CONFIG_PINCTRL_CHERRYVIEW is not set
+# CONFIG_PINCTRL_DENVERTON is not set
+# CONFIG_PINCTRL_ELKHARTLAKE is not set
+# CONFIG_PINCTRL_EMMITSBURG is not set
+# CONFIG_PINCTRL_GEMINILAKE is not set
+# CONFIG_PINCTRL_JASPERLAKE is not set
+# CONFIG_PINCTRL_LAKEFIELD is not set
+# CONFIG_PINCTRL_LEWISBURG is not set
+# CONFIG_PINCTRL_LYNXPOINT is not set
+# CONFIG_PINCTRL_SUNRISEPOINT is not set
+# CONFIG_PINCTRL_TIGERLAKE is not set
+# CONFIG_PMIC_OPREGION is not set
+CONFIG_PNP=y
+CONFIG_PNPACPI=y
+# CONFIG_PNPBIOS is not set
+CONFIG_PNP_DEBUG_MESSAGES=y
+CONFIG_RTC_I2C_AND_SPI=y
+# CONFIG_SAMSUNG_Q10 is not set
+CONFIG_SC1200_WDT=y
+# CONFIG_SCSI_FDOMAIN_ISA is not set
+CONFIG_SCx200_ACB=y
+CONFIG_SCx200_WDT=y
+# CONFIG_SENSORS_ASUS_EC is not set
+CONFIG_SENSORS_LM90=y
+# CONFIG_SENSORS_SY7636A is not set
+# CONFIG_SENSORS_TMP464 is not set
+CONFIG_SERIAL_8250_PNP=y
+CONFIG_SERIAL_MCTRL_GPIO=y
+# CONFIG_TOSHIBA_BT_RFKILL is not set
+# CONFIG_USB_UHCI_HCD is not set
+CONFIG_VIA_RHINE=y
+CONFIG_VIA_RHINE_MMIO=y
+# CONFIG_WDT is not set
+# CONFIG_WIRELESS_HOTKEY is not set
+# CONFIG_X86_ACPI_CPUFREQ is not set
+CONFIG_X86_ALIGNMENT_16=y
+# CONFIG_X86_AMD_PLATFORM_DEVICE is not set
+CONFIG_X86_AMD_PSTATE=y
+CONFIG_X86_CPUID=y
+# CONFIG_X86_E_POWERSAVER is not set
+CONFIG_X86_INTEL_LPSS=y
+# CONFIG_X86_LONGHAUL is not set
+# CONFIG_X86_MCE is not set
+CONFIG_X86_MINIMUM_CPU_FAMILY=5
+# CONFIG_X86_PCC_CPUFREQ is not set
+CONFIG_X86_PM_TIMER=y
+CONFIG_X86_REBOOTFIXUPS=y
diff --git a/6.12/target/linux/x86/legacy/config-6.12 b/6.12/target/linux/x86/legacy/config-6.12
new file mode 100644
index 00000000..886cb83c
--- /dev/null
+++ b/6.12/target/linux/x86/legacy/config-6.12
@@ -0,0 +1,284 @@
+# CONFIG_3C515 is not set
+CONFIG_ACPI=y
+CONFIG_ACPI_AC=y
+CONFIG_ACPI_BATTERY=y
+CONFIG_ACPI_BUTTON=y
+# CONFIG_ACPI_CMPC is not set
+# CONFIG_ACPI_CONTAINER is not set
+CONFIG_ACPI_CPU_FREQ_PSS=y
+# CONFIG_ACPI_DEBUG is not set
+# CONFIG_ACPI_DEBUGGER is not set
+# CONFIG_ACPI_DOCK is not set
+# CONFIG_ACPI_DPTF is not set
+# CONFIG_ACPI_EC_DEBUGFS is not set
+# CONFIG_ACPI_FAN is not set
+CONFIG_ACPI_HOTPLUG_IOAPIC=y
+# CONFIG_ACPI_I2C_OPREGION is not set
+CONFIG_ACPI_LEGACY_TABLES_LOOKUP=y
+# CONFIG_ACPI_PCI_SLOT is not set
+CONFIG_ACPI_PROCESSOR=y
+# CONFIG_ACPI_PROCESSOR_AGGREGATOR is not set
+CONFIG_ACPI_PROCESSOR_CSTATE=y
+CONFIG_ACPI_PROCESSOR_IDLE=y
+CONFIG_ACPI_REV_OVERRIDE_POSSIBLE=y
+# CONFIG_ACPI_SBS is not set
+CONFIG_ACPI_SPCR_TABLE=y
+CONFIG_ACPI_SYSTEM_POWER_STATES_SUPPORT=y
+CONFIG_ACPI_THERMAL=y
+CONFIG_ACPI_VIDEO=y
+# CONFIG_ACPI_WMI is not set
+CONFIG_AGP=y
+# CONFIG_AGP_ALI is not set
+# CONFIG_AGP_AMD is not set
+# CONFIG_AGP_AMD64 is not set
+# CONFIG_AGP_ATI is not set
+# CONFIG_AGP_EFFICEON is not set
+CONFIG_AGP_INTEL=y
+# CONFIG_AGP_NVIDIA is not set
+# CONFIG_AGP_SIS is not set
+# CONFIG_AGP_SWORKS is not set
+# CONFIG_AGP_VIA is not set
+# CONFIG_ALIX is not set
+# CONFIG_AMD_PMC is not set
+CONFIG_ARCH_MIGHT_HAVE_ACPI_PDC=y
+ARCH_MMAP_RND_BIT=8
+CONFIG_BACKLIGHT_CLASS_DEVICE=y
+CONFIG_BLK_DEV_SR=y
+CONFIG_CDROM=y
+# CONFIG_COMPAT_VDSO is not set
+CONFIG_CPU_IDLE_GOV_MENU=y
+# CONFIG_CS89x0_ISA is not set
+CONFIG_DMA_ACPI=y
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_DRM=y
+CONFIG_DRM_AMDGPU=y
+# CONFIG_DRM_AMD_DC is not set
+CONFIG_DRM_BOCHS=y
+CONFIG_DRM_BRIDGE=y
+CONFIG_DRM_BUDDY=y
+CONFIG_DRM_DP_HELPER=y
+CONFIG_DRM_FBDEV_EMULATION=y
+CONFIG_DRM_FBDEV_OVERALLOC=100
+CONFIG_DRM_I915=y
+CONFIG_DRM_I915_CAPTURE_ERROR=y
+CONFIG_DRM_I915_COMPRESS_ERROR=y
+# CONFIG_DRM_I915_DEBUG is not set
+# CONFIG_DRM_I915_DEBUG_GUC is not set
+# CONFIG_DRM_I915_DEBUG_MMIO is not set
+# CONFIG_DRM_I915_DEBUG_RUNTIME_PM is not set
+# CONFIG_DRM_I915_DEBUG_VBLANK_EVADE is not set
+CONFIG_DRM_I915_FENCE_TIMEOUT=10000
+CONFIG_DRM_I915_FORCE_PROBE=""
+CONFIG_DRM_I915_HEARTBEAT_INTERVAL=2500
+# CONFIG_DRM_I915_LOW_LEVEL_TRACEPOINTS is not set
+CONFIG_DRM_I915_MAX_REQUEST_BUSYWAIT=8000
+CONFIG_DRM_I915_PREEMPT_TIMEOUT=640
+# CONFIG_DRM_I915_SELFTEST is not set
+CONFIG_DRM_I915_STOP_TIMEOUT=100
+# CONFIG_DRM_I915_SW_FENCE_CHECK_DAG is not set
+# CONFIG_DRM_I915_SW_FENCE_DEBUG_OBJECTS is not set
+CONFIG_DRM_I915_TIMESLICE_DURATION=1
+CONFIG_DRM_I915_USERFAULT_AUTOSUSPEND=250
+CONFIG_DRM_I915_USERPTR=y
+# CONFIG_DRM_I915_WERROR is not set
+CONFIG_DRM_KMS_HELPER=y
+CONFIG_DRM_MIPI_DSI=y
+CONFIG_DRM_NOMODESET=y
+CONFIG_DRM_PANEL=y
+CONFIG_DRM_PANEL_BRIDGE=y
+CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y
+CONFIG_DRM_RADEON=y
+CONFIG_DRM_SCHED=y
+# CONFIG_DRM_SIMPLEDRM is not set
+# CONFIG_DRM_SSD130X is not set
+CONFIG_DRM_TTM=y
+CONFIG_DRM_TTM_HELPER=y
+CONFIG_DRM_VRAM_HELPER=y
+# CONFIG_EL3 is not set
+CONFIG_FB=y
+CONFIG_FB_CFB_COPYAREA=y
+CONFIG_FB_CFB_FILLRECT=y
+CONFIG_FB_CFB_IMAGEBLIT=y
+CONFIG_FB_CMDLINE=y
+CONFIG_FB_DEFERRED_IO=y
+# CONFIG_FB_I810 is not set
+CONFIG_FB_SYS_COPYAREA=y
+CONFIG_FB_SYS_FILLRECT=y
+CONFIG_FB_SYS_FOPS=y
+CONFIG_FB_SYS_IMAGEBLIT=y
+# CONFIG_FB_VESA is not set
+CONFIG_FONT_8x16=y
+CONFIG_FONT_8x8=y
+CONFIG_FONT_SUPPORT=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y
+CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION=y
+# CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set
+# CONFIG_GEOS is not set
+CONFIG_HDMI=y
+CONFIG_HID_BATTERY_STRENGTH=y
+# CONFIG_HIGHMEM4G is not set
+# CONFIG_HIGHMEM64G is not set
+CONFIG_HPET=y
+CONFIG_HPET_MMAP=y
+# CONFIG_HP_ACCEL is not set
+CONFIG_HWMON=y
+CONFIG_I2C=y
+CONFIG_I2C_ALGOBIT=y
+# CONFIG_I2C_AMD_MP2 is not set
+CONFIG_I2C_BOARDINFO=y
+# CONFIG_I2C_HID_ACPI is not set
+CONFIG_INPUT_MOUSE=y
+CONFIG_INPUT_MOUSEDEV=y
+CONFIG_INPUT_MOUSEDEV_PSAUX=y
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+CONFIG_INTEL_GTT=y
+CONFIG_INTEL_IDLE=y
+# CONFIG_INTEL_IPS is not set
+# CONFIG_INTEL_MEI_HDCP is not set
+# CONFIG_INTEL_MEI_PXP is not set
+# CONFIG_INTEL_MENLOW is not set
+# CONFIG_INTEL_SAR_INT1092 is not set
+# CONFIG_INTEL_SCU_PLATFORM is not set
+# CONFIG_INTEL_SOC_DTS_THERMAL is not set
+CONFIG_INTERVAL_TREE=y
+CONFIG_IOSF_MBI=y
+# CONFIG_IOSF_MBI_DEBUG is not set
+CONFIG_ISA=y
+CONFIG_ISAPNP=y
+CONFIG_ISA_BUS_API=y
+# CONFIG_ISCSI_IBFT is not set
+CONFIG_ISO9660_FS=y
+# CONFIG_JOLIET is not set
+CONFIG_KCMP=y
+# CONFIG_LANCE is not set
+CONFIG_LIVEPATCH=y
+CONFIG_M586MMX=y
+# CONFIG_M686 is not set
+# CONFIG_M486SX is not set
+# CONFIG_M486 is not set
+# CONFIG_M586 is not set
+# CONFIG_M586TSC is not set
+# CONFIG_M586MMX is not set
+# CONFIG_M686 is not set
+# CONFIG_MPENTIUMII is not set
+# CONFIG_MPENTIUMIII is not set
+# CONFIG_MPENTIUMM is not set
+CONFIG_MPENTIUM4=y
+# CONFIG_MK6 is not set
+# CONFIG_MK7 is not set
+# CONFIG_MK8 is not set
+# CONFIG_MCRUSOE is not set
+# CONFIG_MEFFICEON is not set
+# CONFIG_MWINCHIPC6 is not set
+# CONFIG_MWINCHIP3D is not set
+# CONFIG_MELAN is not set
+# CONFIG_MGEODEGX1 is not set
+# CONFIG_MGEODE_LX is not set
+# CONFIG_MCYRIXIII is not set
+# CONFIG_MVIAC3_2 is not set
+# CONFIG_MVIAC7 is not set
+# CONFIG_MCORE2 is not set
+# CONFIG_MATOM is not set
+# CONFIG_MDA_CONSOLE is not set
+CONFIG_MFD_CORE=y
+CONFIG_MFD_INTEL_LPSS=y
+CONFIG_MFD_INTEL_LPSS_ACPI=y
+# CONFIG_MFD_INTEL_PMC_BXT is not set
+# CONFIG_MFD_SIMPLE_MFD_I2C is not set
+# CONFIG_MIXCOMWD is not set
+CONFIG_MMU_NOTIFIER=y
+# CONFIG_MOUSE_BCM5974 is not set
+# CONFIG_MOUSE_CYAPA is not set
+CONFIG_MOUSE_PS2=y
+CONFIG_MOUSE_PS2_ALPS=y
+# CONFIG_MOUSE_PS2_BYD is not set
+# CONFIG_MOUSE_PS2_CYPRESS is not set
+# CONFIG_MOUSE_PS2_ELANTECH is not set
+CONFIG_MOUSE_PS2_LIFEBOOK=y
+CONFIG_MOUSE_PS2_LOGIPS2PP=y
+CONFIG_MOUSE_PS2_SMBUS=y
+CONFIG_MOUSE_PS2_SYNAPTICS=y
+CONFIG_MOUSE_PS2_SYNAPTICS_SMBUS=y
+# CONFIG_MOUSE_PS2_TOUCHKIT is not set
+CONFIG_MOUSE_PS2_TRACKPOINT=y
+# CONFIG_MOUSE_SERIAL is not set
+# CONFIG_MOUSE_VSXXXAA is not set
+# CONFIG_NET5501 is not set
+CONFIG_NOHIGHMEM=y
+CONFIG_NO_HZ=y
+# CONFIG_NSC_GPIO is not set
+CONFIG_PATA_AMD=y
+CONFIG_PATA_ATIIXP=y
+CONFIG_PATA_LEGACY=y
+CONFIG_PATA_MPIIX=y
+CONFIG_PATA_OLDPIIX=y
+CONFIG_PATA_PLATFORM=y
+CONFIG_PATA_SC1200=y
+CONFIG_PATA_SIS=y
+CONFIG_PATA_TIMINGS=y
+CONFIG_PATA_VIA=y
+# CONFIG_PC8736x_GPIO is not set
+CONFIG_PCIEAER=y
+CONFIG_PCIEPORTBUS=y
+# CONFIG_PCI_GOBIOS is not set
+# CONFIG_PCI_GOMMCONFIG is not set
+# CONFIG_PCI_GODIRECT is not set
+CONFIG_PCI_GOANY=y
+CONFIG_PCI_MMCONFIG=y
+# CONFIG_PCWATCHDOG is not set
+# CONFIG_PMIC_OPREGION is not set
+CONFIG_PNP=y
+CONFIG_PNPACPI=y
+# CONFIG_PNPBIOS is not set
+CONFIG_PNP_DEBUG_MESSAGES=y
+CONFIG_RAS=y
+CONFIG_RELAY=y
+CONFIG_RTC_I2C_AND_SPI=y
+# CONFIG_SAMSUNG_Q10 is not set
+CONFIG_SATA_AHCI=y
+# CONFIG_SCSI_FDOMAIN_ISA is not set
+# CONFIG_SCx200 is not set
+# CONFIG_SBC7240_WDT is not set
+# CONFIG_SBC8360_WDT is not set
+# CONFIG_SENSORS_ASUS_EC is not set
+# CONFIG_SENSORS_SY7636A is not set
+# CONFIG_SENSORS_TMP464 is not set
+CONFIG_SERIAL_8250_PNP=y
+CONFIG_SYNC_FILE=y
+# CONFIG_SYSTEM76_ACPI is not set
+# CONFIG_TOSHIBA is not set
+# CONFIG_TOSHIBA_BT_RFKILL is not set
+CONFIG_USB_STORAGE=y
+CONFIG_VMAP_PFN=y
+# CONFIG_WDT is not set
+# CONFIG_WIRELESS_HOTKEY is not set
+# CONFIG_X86_32_IRIS is not set
+CONFIG_X86_ACPI_CPUFREQ=y
+# CONFIG_X86_ACPI_CPUFREQ_CPB is not set
+CONFIG_X86_ALIGNMENT_16=y
+# CONFIG_X86_AMD_FREQ_SENSITIVITY is not set
+# CONFIG_X86_AMD_PLATFORM_DEVICE is not set
+CONFIG_X86_AMD_PSTATE=y
+# CONFIG_X86_ANCIENT_MCE is not set
+# CONFIG_X86_CPUFREQ_NFORCE2 is not set
+# CONFIG_X86_E_POWERSAVER is not set
+CONFIG_X86_F00F_BUG=y
+CONFIG_X86_GENERIC=y
+# CONFIG_X86_GX_SUSPMOD is not set
+# CONFIG_X86_INTEL_LPSS is not set
+# CONFIG_X86_LEGACY_VM86 is not set
+# CONFIG_X86_LONGHAUL is not set
+# CONFIG_X86_LONGRUN is not set
+CONFIG_X86_MINIMUM_CPU_FAMILY=5
+# CONFIG_X86_PAE is not set
+# CONFIG_X86_PCC_CPUFREQ is not set
+CONFIG_X86_PM_TIMER=y
+# CONFIG_X86_POWERNOW_K6 is not set
+# CONFIG_X86_POWERNOW_K7 is not set
+# CONFIG_X86_POWERNOW_K8 is not set
+# CONFIG_X86_REBOOTFIXUPS is not set
+# CONFIG_X86_SPEEDSTEP_ICH is not set
+# CONFIG_X86_SPEEDSTEP_SMI is not set
+CONFIG_ZLIB_DEFLATE=y
diff --git a/6.12/target/linux/x86/patches-6.12/100-fix_cs5535_clockevt.patch b/6.12/target/linux/x86/patches-6.12/100-fix_cs5535_clockevt.patch
new file mode 100644
index 00000000..d4de2027
--- /dev/null
+++ b/6.12/target/linux/x86/patches-6.12/100-fix_cs5535_clockevt.patch
@@ -0,0 +1,13 @@
+--- a/drivers/clocksource/timer-cs5535.c
++++ b/drivers/clocksource/timer-cs5535.c
+@@ -127,7 +127,9 @@ static irqreturn_t mfgpt_tick(int irq, v
+ 		cs5535_mfgpt_write(cs5535_event_clock, MFGPT_REG_SETUP,
+ 				MFGPT_SETUP_CNTEN | MFGPT_SETUP_CMP2);
+ 
+-	cs5535_clockevent.event_handler(&cs5535_clockevent);
++	if (cs5535_clockevent.event_handler)
++		cs5535_clockevent.event_handler(&cs5535_clockevent);
++
+ 	return IRQ_HANDLED;
+ }
+ 
diff --git a/6.12/target/linux/x86/patches-6.12/103-pcengines_apu6_platform.patch b/6.12/target/linux/x86/patches-6.12/103-pcengines_apu6_platform.patch
new file mode 100644
index 00000000..4e1761b5
--- /dev/null
+++ b/6.12/target/linux/x86/patches-6.12/103-pcengines_apu6_platform.patch
@@ -0,0 +1,275 @@
+From 970d9af9015a387bb81841faf05dcc1a171eb97a Mon Sep 17 00:00:00 2001
+From: Philip Prindeville <philipp@redfish-solutions.com>
+Date: Sun, 1 Jan 2023 15:25:04 -0700
+Subject: [PATCH v3 1/1] x86: Support APU5 in PCEngines platform driver
+To: platform-driver-x86@vger.kernel.org, linux-x86_64@vger.kernel.org
+Cc: Ed Wildgoose <lists@wildgooses.com>, Andres Salomon <dilinger@queued.net>, Andreas Eberlein <foodeas@aeberlein.de>, Paul Spooren <paul@spooren.de>
+
+PCEngines make a number of SBC. APU5 has 5 mpcie slots + MSATA.
+It also has support for 3x LTE modems with 6x SIM slots (pairs with a
+SIM switch device). Each mpcie slot for modems has a reset GPIO
+
+To ensure that the naming is sane between APU2-6 the GPIOS are
+renamed to be modem1-reset, modem2-reset, etc. This is significant
+because the slots that can be reset change between APU2 and APU3/4
+
+GPIO for simswap is moved to the end of the list as it could be dropped
+for APU2 boards (but causes no harm to leave it in, hardware could be
+added to a future rev of the board).
+
+Structure of the GPIOs for APU5 is extremely similar to APU2-4, but
+many lines are moved around and there are simply more
+modems/resets/sim-swap lines to breakout.
+
+Also added APU6, which is essentially APU4 with a different ethernet
+interface and SFP cage on eth0.
+
+Revision history:
+
+v1: originally titled, "apu6: add apu6 variation to apu2 driver family"
+this dealt only with detecting the APUv6, which is otherwise identical
+to the v4 excepting the SFP cage on eth0.
+
+v2: at Ed's request, merged with his previous pull-request titled
+"x86: Support APU5 in PCEngines platform driver", and some cleanup
+to that changeset (including dropping the table "apu5_driver_data"
+which did not have a defined type "struct apu_driver_data"), but got
+mistitled when the Subject of that commit got accidentally dropped.
+
+v3: retitled to match Ed's previous pull-request.
+
+Cc: platform-driver-x86@vger.kernel.org
+Cc: linux-x86_64@vger.kernel.org
+Reviewed-by: Andreas Eberlein <foodeas@aeberlein.de>
+Reviewed-by: Paul Spooren <paul@spooren.de>
+Signed-off-by: Ed Wildgoose <lists@wildgooses.com>
+Sighed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
+---
+ drivers/leds/leds-apu.c                |   2 +-
+ drivers/platform/x86/Kconfig           |   4 +-
+ drivers/platform/x86/pcengines-apuv2.c | 118 ++++++++++++++++++++++---
+ 3 files changed, 107 insertions(+), 17 deletions(-)
+
+--- a/drivers/leds/leds-apu.c
++++ b/drivers/leds/leds-apu.c
+@@ -182,7 +182,7 @@ static int __init apu_led_init(void)
+ 	int err;
+ 
+ 	if (!dmi_check_system(apu_led_dmi_table)) {
+-		pr_err("No PC Engines APUv1 board detected. For APUv2,3 support, enable CONFIG_PCENGINES_APU2\n");
++		pr_err("No PC Engines APUv1 board detected. For APUv2,3,4,5,6 support, enable CONFIG_PCENGINES_APU2\n");
+ 		return -ENODEV;
+ 	}
+ 
+--- a/drivers/platform/x86/Kconfig
++++ b/drivers/platform/x86/Kconfig
+@@ -753,7 +753,7 @@ config XO1_RFKILL
+ 	  laptop.
+ 
+ config PCENGINES_APU2
+-	tristate "PC Engines APUv2/3 front button and LEDs driver"
++	tristate "PC Engines APUv2/3/4/5/6 front button and LEDs driver"
+ 	depends on INPUT && INPUT_KEYBOARD && GPIOLIB
+ 	depends on LEDS_CLASS
+ 	select GPIO_AMD_FCH
+@@ -761,7 +761,7 @@ config PCENGINES_APU2
+ 	select LEDS_GPIO
+ 	help
+ 	  This driver provides support for the front button and LEDs on
+-	  PC Engines APUv2/APUv3 board.
++	  PC Engines APUv2/APUv3/APUv4/APUv5/APUv6 board.
+ 
+ 	  To compile this driver as a module, choose M here: the module
+ 	  will be called pcengines-apuv2.
+--- a/drivers/platform/x86/pcengines-apuv2.c
++++ b/drivers/platform/x86/pcengines-apuv2.c
+@@ -1,10 +1,12 @@
+ // SPDX-License-Identifier: GPL-2.0+
+ 
+ /*
+- * PC-Engines APUv2/APUv3 board platform driver
++ * PC-Engines APUv2-6 board platform driver
+  * for GPIO buttons and LEDs
+  *
+  * Copyright (C) 2018 metux IT consult
++ * Copyright (C) 2022 Ed Wildgoose <lists@wildgooses.com>
++ * Copyright (C) 2022 Philip Prindeville <philipp@redfish-solutions.com>
+  * Author: Enrico Weigelt <info@metux.net>
+  */
+ 
+@@ -22,38 +24,70 @@
+ #include <linux/platform_data/gpio/gpio-amd-fch.h>
+ 
+ /*
+- * NOTE: this driver only supports APUv2/3 - not APUv1, as this one
++ * NOTE: this driver only supports APUv2-6 - not APUv1, as this one
+  * has completely different register layouts.
+  */
+ 
++/*
++ * There are a number of APU variants, with differing features
++ * APU2 has SIM slots 1/2 mapping to mPCIe sockets 1/2
++ * APU3/4 moved SIM slot 1 to mPCIe socket 3, ie logically reversed
++ * However, most APU3/4 have a SIM switch which we default on to reverse
++ * the order and keep physical SIM order matching physical modem order
++ * APU6 is approximately the same as APU4 with different ethernet layout
++ *
++ * APU5 has 3x SIM sockets, all with a SIM switch
++ * several GPIOs are shuffled (see schematic), including MODESW
++ */
++
+ /* Register mappings */
+ #define APU2_GPIO_REG_LED1		AMD_FCH_GPIO_REG_GPIO57
+ #define APU2_GPIO_REG_LED2		AMD_FCH_GPIO_REG_GPIO58
+ #define APU2_GPIO_REG_LED3		AMD_FCH_GPIO_REG_GPIO59_DEVSLP1
+ #define APU2_GPIO_REG_MODESW		AMD_FCH_GPIO_REG_GPIO32_GE1
+ #define APU2_GPIO_REG_SIMSWAP		AMD_FCH_GPIO_REG_GPIO33_GE2
+-#define APU2_GPIO_REG_MPCIE2		AMD_FCH_GPIO_REG_GPIO55_DEVSLP0
+-#define APU2_GPIO_REG_MPCIE3		AMD_FCH_GPIO_REG_GPIO51
++#define APU2_GPIO_REG_RESETM1		AMD_FCH_GPIO_REG_GPIO51
++#define APU2_GPIO_REG_RESETM2		AMD_FCH_GPIO_REG_GPIO55_DEVSLP0
++
++#define APU5_GPIO_REG_MODESW		AMT_FCH_GPIO_REG_GEVT22
++#define APU5_GPIO_REG_SIMSWAP1		AMD_FCH_GPIO_REG_GPIO68
++#define APU5_GPIO_REG_SIMSWAP2		AMD_FCH_GPIO_REG_GPIO32_GE1
++#define APU5_GPIO_REG_SIMSWAP3		AMD_FCH_GPIO_REG_GPIO33_GE2
++#define APU5_GPIO_REG_RESETM1		AMD_FCH_GPIO_REG_GPIO51
++#define APU5_GPIO_REG_RESETM2		AMD_FCH_GPIO_REG_GPIO55_DEVSLP0
++#define APU5_GPIO_REG_RESETM3		AMD_FCH_GPIO_REG_GPIO64
+ 
+ /* Order in which the GPIO lines are defined in the register list */
+ #define APU2_GPIO_LINE_LED1		0
+ #define APU2_GPIO_LINE_LED2		1
+ #define APU2_GPIO_LINE_LED3		2
+ #define APU2_GPIO_LINE_MODESW		3
+-#define APU2_GPIO_LINE_SIMSWAP		4
+-#define APU2_GPIO_LINE_MPCIE2		5
+-#define APU2_GPIO_LINE_MPCIE3		6
++#define APU2_GPIO_LINE_RESETM1		4
++#define APU2_GPIO_LINE_RESETM2		5
++#define APU2_GPIO_LINE_SIMSWAP		6
++
++#define APU5_GPIO_LINE_LED1		0
++#define APU5_GPIO_LINE_LED2		1
++#define APU5_GPIO_LINE_LED3		2
++#define APU5_GPIO_LINE_MODESW		3
++#define APU5_GPIO_LINE_RESETM1		4
++#define APU5_GPIO_LINE_RESETM2		5
++#define APU5_GPIO_LINE_RESETM3		6
++#define APU5_GPIO_LINE_SIMSWAP1		7
++#define APU5_GPIO_LINE_SIMSWAP2		8
++#define APU5_GPIO_LINE_SIMSWAP3		9
++
+ 
+-/* GPIO device */
++/* GPIO device - APU2/3/4/6 */
+ 
+ static int apu2_gpio_regs[] = {
+ 	[APU2_GPIO_LINE_LED1]		= APU2_GPIO_REG_LED1,
+ 	[APU2_GPIO_LINE_LED2]		= APU2_GPIO_REG_LED2,
+ 	[APU2_GPIO_LINE_LED3]		= APU2_GPIO_REG_LED3,
+ 	[APU2_GPIO_LINE_MODESW]		= APU2_GPIO_REG_MODESW,
++	[APU2_GPIO_LINE_RESETM1]	= APU2_GPIO_REG_RESETM1,
++	[APU2_GPIO_LINE_RESETM2]	= APU2_GPIO_REG_RESETM2,
+ 	[APU2_GPIO_LINE_SIMSWAP]	= APU2_GPIO_REG_SIMSWAP,
+-	[APU2_GPIO_LINE_MPCIE2]		= APU2_GPIO_REG_MPCIE2,
+-	[APU2_GPIO_LINE_MPCIE3]		= APU2_GPIO_REG_MPCIE3,
+ };
+ 
+ static const char * const apu2_gpio_names[] = {
+@@ -61,9 +95,9 @@ static const char * const apu2_gpio_name
+ 	[APU2_GPIO_LINE_LED2]		= "front-led2",
+ 	[APU2_GPIO_LINE_LED3]		= "front-led3",
+ 	[APU2_GPIO_LINE_MODESW]		= "front-button",
++	[APU2_GPIO_LINE_RESETM1]	= "modem1-reset",
++	[APU2_GPIO_LINE_RESETM2]	= "modem2-reset",
+ 	[APU2_GPIO_LINE_SIMSWAP]	= "simswap",
+-	[APU2_GPIO_LINE_MPCIE2]		= "mpcie2_reset",
+-	[APU2_GPIO_LINE_MPCIE3]		= "mpcie3_reset",
+ };
+ 
+ static const struct amd_fch_gpio_pdata board_apu2 = {
+@@ -72,6 +106,40 @@ static const struct amd_fch_gpio_pdata b
+ 	.gpio_names	= apu2_gpio_names,
+ };
+ 
++/* GPIO device - APU5 */
++
++static int apu5_gpio_regs[] = {
++	[APU5_GPIO_LINE_LED1]		= APU2_GPIO_REG_LED1,
++	[APU5_GPIO_LINE_LED2]		= APU2_GPIO_REG_LED2,
++	[APU5_GPIO_LINE_LED3]		= APU2_GPIO_REG_LED3,
++	[APU5_GPIO_LINE_MODESW]		= APU5_GPIO_REG_MODESW,
++	[APU5_GPIO_LINE_RESETM1]	= APU5_GPIO_REG_RESETM1,
++	[APU5_GPIO_LINE_RESETM2]	= APU5_GPIO_REG_RESETM2,
++	[APU5_GPIO_LINE_RESETM3]	= APU5_GPIO_REG_RESETM3,
++	[APU5_GPIO_LINE_SIMSWAP1]	= APU5_GPIO_REG_SIMSWAP1,
++	[APU5_GPIO_LINE_SIMSWAP2]	= APU5_GPIO_REG_SIMSWAP2,
++	[APU5_GPIO_LINE_SIMSWAP3]	= APU5_GPIO_REG_SIMSWAP3,
++};
++
++static const char * const apu5_gpio_names[] = {
++	[APU5_GPIO_LINE_LED1]		= "front-led1",
++	[APU5_GPIO_LINE_LED2]		= "front-led2",
++	[APU5_GPIO_LINE_LED3]		= "front-led3",
++	[APU5_GPIO_LINE_MODESW]		= "front-button",
++	[APU5_GPIO_LINE_RESETM1]	= "modem1-reset",
++	[APU5_GPIO_LINE_RESETM2]	= "modem2-reset",
++	[APU5_GPIO_LINE_RESETM3]	= "modem3-reset",
++	[APU5_GPIO_LINE_SIMSWAP1]	= "simswap1",
++	[APU5_GPIO_LINE_SIMSWAP2]	= "simswap2",
++	[APU5_GPIO_LINE_SIMSWAP3]	= "simswap3",
++};
++
++static const struct amd_fch_gpio_pdata board_apu5 = {
++	.gpio_num	= ARRAY_SIZE(apu5_gpio_regs),
++	.gpio_reg	= apu5_gpio_regs,
++	.gpio_names	= apu5_gpio_names,
++};
++
+ /* GPIO LEDs device */
+ 
+ static const struct gpio_led apu2_leds[] = {
+@@ -215,6 +283,24 @@ static const struct dmi_system_id apu_gp
+ 		},
+ 		.driver_data = (void *)&board_apu2,
+ 	},
++	/* APU5 w/ mainline BIOS */
++	{
++		.ident		= "apu5",
++		.matches	= {
++			DMI_MATCH(DMI_SYS_VENDOR, "PC Engines"),
++			DMI_MATCH(DMI_BOARD_NAME, "apu5")
++		},
++		.driver_data	= (void *)&board_apu5,
++	},
++	/* APU6 w/ mainline BIOS */
++	{
++		.ident		= "apu6",
++		.matches	= {
++			DMI_MATCH(DMI_SYS_VENDOR, "PC Engines"),
++			DMI_MATCH(DMI_BOARD_NAME, "apu6")
++		},
++		.driver_data	= (void *)&board_apu2,
++	},
+ 	{}
+ };
+ 
+@@ -249,7 +335,7 @@ static int __init apu_board_init(void)
+ 
+ 	id = dmi_first_match(apu_gpio_dmi_table);
+ 	if (!id) {
+-		pr_err("failed to detect APU board via DMI\n");
++		pr_err("No APU board detected via DMI\n");
+ 		return -ENODEV;
+ 	}
+ 
+@@ -288,7 +374,7 @@ module_init(apu_board_init);
+ module_exit(apu_board_exit);
+ 
+ MODULE_AUTHOR("Enrico Weigelt, metux IT consult <info@metux.net>");
+-MODULE_DESCRIPTION("PC Engines APUv2/APUv3 board GPIO/LEDs/keys driver");
++MODULE_DESCRIPTION("PC Engines APUv2-6 board GPIO/LEDs/keys driver");
+ MODULE_LICENSE("GPL");
+ MODULE_DEVICE_TABLE(dmi, apu_gpio_dmi_table);
+ MODULE_SOFTDEP("pre: platform:" AMD_FCH_GPIO_DRIVER_NAME " platform:leds-gpio platform:gpio_keys_polled");
diff --git a/6.12/toolchain/kernel-headers/Makefile b/6.12/toolchain/kernel-headers/Makefile
new file mode 100644
index 00000000..c1a8710a
--- /dev/null
+++ b/6.12/toolchain/kernel-headers/Makefile
@@ -0,0 +1,113 @@
+# 
+# Copyright (C) 2006-2009 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+include $(TOPDIR)/rules.mk
+
+KERNEL_BUILD_DIR := $(BUILD_DIR_TOOLCHAIN)
+BUILD_DIR := $(KERNEL_BUILD_DIR)
+
+override QUILT:=
+override HOST_QUILT:=
+
+include $(INCLUDE_DIR)/kernel.mk
+
+PKG_NAME:=linux
+PKG_VERSION:=$(LINUX_VERSION)
+PKG_SOURCE:=$(LINUX_SOURCE)
+ifneq ($(call qstrip,$(CONFIG_KERNEL_GIT_CLONE_URI)),)
+  PKG_SOURCE_PROTO:=git
+  PKG_SOURCE_URL:=$(call qstrip,$(CONFIG_KERNEL_GIT_CLONE_URI))
+  PKG_SOURCE_VERSION:=$(call qstrip,$(CONFIG_KERNEL_GIT_REF))
+  PKG_MIRROR_HASH:=$(call qstrip,$(CONFIG_KERNEL_GIT_MIRROR_HASH))
+ifdef CHECK
+  include $(INCLUDE_DIR)/kernel-version.mk
+  PKG_VERSION:=$(LINUX_VERSION)
+else
+  PKG_SOURCE:=$(LINUX_SOURCE)
+endif
+else
+  PKG_SOURCE:=$(LINUX_SOURCE)
+  PKG_SOURCE_URL:=$(LINUX_SITE)
+endif
+HOST_BUILD_DIR:=$(KERNEL_BUILD_DIR)/linux-$(LINUX_VERSION)
+PKG_HASH:=$(LINUX_KERNEL_HASH)
+LINUX_DIR := $(HOST_BUILD_DIR)
+FILES_DIR := 
+PATCH_DIR := ./patches$(if $(wildcard ./patches-$(LINUX_VERSION)),-$(LINUX_VERSION))
+
+include $(INCLUDE_DIR)/toolchain-build.mk
+include $(INCLUDE_DIR)/kernel-defaults.mk
+
+ifeq ($(strip $(BOARD)),uml)
+  LINUX_KARCH:=$(subst x86_64,x86,$(subst i386,x86,$(ARCH)))
+endif
+
+HOST_EXTRACFLAGS=
+
+LINUX_HAS_HEADERS_INSTALL:=y
+
+HOST_KMAKE := $(MAKE) -C $(HOST_BUILD_DIR) \
+	$(KERNEL_MAKE_FLAGS) \
+	CC="$(KERNEL_CC)" \
+	HOSTCFLAGS="$(HOST_CFLAGS)"
+
+define Host/Configure/all
+	mkdir -p $(BUILD_DIR_TOOLCHAIN)/linux-dev
+	$(HOST_KMAKE) \
+		INSTALL_HDR_PATH="$(BUILD_DIR_TOOLCHAIN)/linux-dev/" \
+		headers_install
+endef
+
+# XXX: the following is needed to build lzma-loader
+ifneq ($(CONFIG_mips)$(CONFIG_mipsel),)
+  define Host/Configure/lzma
+	$(CP) \
+		$(HOST_BUILD_DIR)/arch/mips/include/asm/asm.h \
+		$(HOST_BUILD_DIR)/arch/mips/include/asm/regdef.h \
+		$(HOST_BUILD_DIR)/arch/mips/include/asm/asm-eva.h \
+		$(HOST_BUILD_DIR)/arch/mips/include/asm/isa-rev.h \
+		$(BUILD_DIR_TOOLCHAIN)/linux-dev/include/asm/
+  endef
+endif
+
+define Host/Configure/post/mips
+	$(call Host/Configure/lzma)
+endef
+
+define Host/Configure/post/mipsel
+	$(call Host/Configure/lzma)
+endef
+
+define Host/Prepare
+	rm -rf $(BUILD_DIR_TOOLCHAIN)/linux-*
+	$(call Kernel/Prepare/Default)
+	rm -f $(BUILD_DIR_TOOLCHAIN)/linux
+	ln -s linux-$(LINUX_VERSION) $(BUILD_DIR_TOOLCHAIN)/linux
+	$(SED) 's/@expr length/@-expr length/' $(HOST_BUILD_DIR)/Makefile
+endef
+
+define Host/Configure
+	env
+	yes '' | $(HOST_KMAKE) oldconfig
+	$(call Host/Configure/all)
+	$(call Host/Configure/post/$(ARCH))
+endef
+
+define Host/Compile
+endef
+
+define Host/Install
+	$(CP) $(BUILD_DIR_TOOLCHAIN)/linux-dev/* $(TOOLCHAIN_DIR)/
+endef
+
+define Host/Clean
+	rm -rf \
+		$(HOST_BUILD_DIR) \
+		$(BUILD_DIR_TOOLCHAIN)/linux \
+		$(BUILD_DIR_TOOLCHAIN)/linux-dev
+endef
+
+$(eval $(call HostBuild))
diff --git a/6.6/package/libs/mbedtls/Config.in b/6.6/package/libs/mbedtls/Config.in
deleted file mode 100644
index ad0ecb6e..00000000
--- a/6.6/package/libs/mbedtls/Config.in
+++ /dev/null
@@ -1,200 +0,0 @@
-if PACKAGE_libmbedtls
-
-comment "Option details in source code: include/mbedtls/mbedtls_config.h"
-
-comment "Ciphers - unselect old or less-used ciphers to reduce binary size"
-
-config MBEDTLS_AES_C
-	bool "MBEDTLS_AES_C"
-	default y
-
-config MBEDTLS_CAMELLIA_C
-	bool "MBEDTLS_CAMELLIA_C"
-	default n
-
-config MBEDTLS_CCM_C
-	bool "MBEDTLS_CCM_C"
-	default n
-
-config MBEDTLS_CMAC_C
-	bool "MBEDTLS_CMAC_C (old but used by hostapd)"
-	default y
-
-config MBEDTLS_DES_C
-	bool "MBEDTLS_DES_C (old but used by hostapd)"
-	default y
-
-config MBEDTLS_GCM_C
-	bool "MBEDTLS_GCM_C"
-	default y
-
-config MBEDTLS_NIST_KW_C
-	bool "MBEDTLS_NIST_KW_C (old but used by hostapd)"
-	default y
-
-config MBEDTLS_RIPEMD160_C
-	bool "MBEDTLS_RIPEMD160_C"
-	default n
-
-config MBEDTLS_XTEA_C
-	bool "MBEDTLS_XTEA_C"
-	default n
-
-config MBEDTLS_RSA_NO_CRT
-	bool "MBEDTLS_RSA_NO_CRT"
-	default y
-
-config MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
-	bool "MBEDTLS_KEY_EXCHANGE_PSK_ENABLED"
-	default y
-
-config MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
-	bool "MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED"
-	default n
-
-config MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
-	bool "MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED"
-	default y
-
-config MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
-	bool "MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED"
-	default n
-
-config MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
-	bool "MBEDTLS_KEY_EXCHANGE_RSA_ENABLED"
-	default n
-
-config MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
-	bool "MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED"
-	default n
-
-config MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
-	bool "MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED"
-	default y
-
-config MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
-	bool "MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED"
-	default y
-
-config MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
-	bool "MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED"
-	default n
-
-config MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
-	bool "MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED"
-	default n
-
-comment "Curves - unselect old or less-used curves to reduce binary size"
-
-config MBEDTLS_ECP_DP_SECP192R1_ENABLED
-	bool "MBEDTLS_ECP_DP_SECP192R1_ENABLED"
-	default n
-
-config MBEDTLS_ECP_DP_SECP224R1_ENABLED
-	bool "MBEDTLS_ECP_DP_SECP224R1_ENABLED"
-	default n
-
-config MBEDTLS_ECP_DP_SECP256R1_ENABLED
-	bool "MBEDTLS_ECP_DP_SECP256R1_ENABLED"
-	default y
-
-config MBEDTLS_ECP_DP_SECP384R1_ENABLED
-	bool "MBEDTLS_ECP_DP_SECP384R1_ENABLED"
-	default y
-
-config MBEDTLS_ECP_DP_SECP521R1_ENABLED
-	bool "MBEDTLS_ECP_DP_SECP521R1_ENABLED"
-	default y
-
-config MBEDTLS_ECP_DP_SECP192K1_ENABLED
-	bool "MBEDTLS_ECP_DP_SECP192K1_ENABLED"
-	default n
-
-config MBEDTLS_ECP_DP_SECP224K1_ENABLED
-	bool "MBEDTLS_ECP_DP_SECP224K1_ENABLED"
-	default n
-
-config MBEDTLS_ECP_DP_SECP256K1_ENABLED
-	bool "MBEDTLS_ECP_DP_SECP256K1_ENABLED"
-	default y
-
-config MBEDTLS_ECP_DP_BP256R1_ENABLED
-	bool "MBEDTLS_ECP_DP_BP256R1_ENABLED"
-	default n
-
-config MBEDTLS_ECP_DP_BP384R1_ENABLED
-	bool "MBEDTLS_ECP_DP_BP384R1_ENABLED"
-	default n
-
-config MBEDTLS_ECP_DP_BP512R1_ENABLED
-	bool "MBEDTLS_ECP_DP_BP512R1_ENABLED"
-	default n
-
-config MBEDTLS_ECP_DP_CURVE25519_ENABLED
-	bool "MBEDTLS_ECP_DP_CURVE25519_ENABLED"
-	default y
-
-config MBEDTLS_ECP_DP_CURVE448_ENABLED
-	bool "MBEDTLS_ECP_DP_CURVE448_ENABLED"
-	default n
-
-comment "Build Options - unselect features to reduce binary size"
-
-config MBEDTLS_CERTS_C
-	bool "MBEDTLS_CERTS_C"
-	default n
-
-config MBEDTLS_CIPHER_MODE_OFB
-	bool "MBEDTLS_CIPHER_MODE_OFB"
-	default n
-
-config MBEDTLS_CIPHER_MODE_XTS
-	bool "MBEDTLS_CIPHER_MODE_XTS"
-	default n
-
-config MBEDTLS_DEBUG_C
-	bool "MBEDTLS_DEBUG_C"
-	default n
-
-config MBEDTLS_HKDF_C
-	bool "MBEDTLS_HKDF_C"
-	default n
-
-config MBEDTLS_PLATFORM_C
-	bool "MBEDTLS_PLATFORM_C"
-	default n
-
-config MBEDTLS_SELF_TEST
-	bool "MBEDTLS_SELF_TEST"
-	default n
-
-config MBEDTLS_SSL_TRUNCATED_HMAC
-	bool "MBEDTLS_SSL_TRUNCATED_HMAC"
-	default n
-
-config MBEDTLS_THREADING_C
-	bool "MBEDTLS_THREADING_C"
-	default y
-
-config MBEDTLS_THREADING_PTHREAD
-	def_bool MBEDTLS_THREADING_C
-
-config MBEDTLS_VERSION_C
-	bool "MBEDTLS_VERSION_C"
-	default n
-
-config MBEDTLS_VERSION_FEATURES
-	bool "MBEDTLS_VERSION_FEATURES"
-	default n
-
-comment "Build Options"
-
-config MBEDTLS_ENTROPY_FORCE_SHA256
-	bool "MBEDTLS_ENTROPY_FORCE_SHA256"
-	default y
-
-config MBEDTLS_SSL_RENEGOTIATION
-	bool "MBEDTLS_SSL_RENEGOTIATION"
-	default n
-
-endif
diff --git a/6.6/package/libs/mbedtls/Makefile b/6.6/package/libs/mbedtls/Makefile
deleted file mode 100644
index 502bf65f..00000000
--- a/6.6/package/libs/mbedtls/Makefile
+++ /dev/null
@@ -1,164 +0,0 @@
-#
-# Copyright (C) 2011-2015 OpenWrt.org
-#
-# This is free software, licensed under the GNU General Public License v2.
-# See /LICENSE for more information.
-#
-
-include $(TOPDIR)/rules.mk
-
-PKG_NAME:=mbedtls
-PKG_VERSION:=2.28.7
-PKG_RELEASE:=2
-PKG_BUILD_FLAGS:=no-mips16 gc-sections no-lto
-
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://codeload.github.com/ARMmbed/mbedtls/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=1df6073f0cf6a4e1953890bf5e0de2a8c7e6be50d6d6c69fa9fefcb1d14e981a
-
-PKG_LICENSE:=GPL-2.0-or-later
-PKG_LICENSE_FILES:=gpl-2.0.txt
-PKG_CPE_ID:=cpe:/a:arm:mbed_tls
-
-MBEDTLS_BUILD_OPTS_CURVES= \
-  CONFIG_MBEDTLS_ECP_DP_SECP192R1_ENABLED \
-  CONFIG_MBEDTLS_ECP_DP_SECP224R1_ENABLED \
-  CONFIG_MBEDTLS_ECP_DP_SECP256R1_ENABLED \
-  CONFIG_MBEDTLS_ECP_DP_SECP384R1_ENABLED \
-  CONFIG_MBEDTLS_ECP_DP_SECP521R1_ENABLED \
-  CONFIG_MBEDTLS_ECP_DP_SECP192K1_ENABLED \
-  CONFIG_MBEDTLS_ECP_DP_SECP224K1_ENABLED \
-  CONFIG_MBEDTLS_ECP_DP_SECP256K1_ENABLED \
-  CONFIG_MBEDTLS_ECP_DP_BP256R1_ENABLED \
-  CONFIG_MBEDTLS_ECP_DP_BP384R1_ENABLED \
-  CONFIG_MBEDTLS_ECP_DP_BP512R1_ENABLED \
-  CONFIG_MBEDTLS_ECP_DP_CURVE25519_ENABLED \
-  CONFIG_MBEDTLS_ECP_DP_CURVE448_ENABLED
-
-MBEDTLS_BUILD_OPTS_CIPHERS= \
-  CONFIG_MBEDTLS_AES_C \
-  CONFIG_MBEDTLS_CAMELLIA_C \
-  CONFIG_MBEDTLS_CCM_C \
-  CONFIG_MBEDTLS_CMAC_C \
-  CONFIG_MBEDTLS_DES_C \
-  CONFIG_MBEDTLS_GCM_C \
-  CONFIG_MBEDTLS_KEY_EXCHANGE_PSK_ENABLED \
-  CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED \
-  CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED \
-  CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED \
-  CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED \
-  CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED \
-  CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED \
-  CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED \
-  CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED \
-  CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED \
-  CONFIG_MBEDTLS_NIST_KW_C \
-  CONFIG_MBEDTLS_RIPEMD160_C \
-  CONFIG_MBEDTLS_RSA_NO_CRT \
-  CONFIG_MBEDTLS_XTEA_C
-
-MBEDTLS_BUILD_OPTS= \
-  $(MBEDTLS_BUILD_OPTS_CURVES) \
-  $(MBEDTLS_BUILD_OPTS_CIPHERS) \
-  CONFIG_MBEDTLS_CERTS_C \
-  CONFIG_MBEDTLS_CIPHER_MODE_OFB \
-  CONFIG_MBEDTLS_CIPHER_MODE_XTS \
-  CONFIG_MBEDTLS_DEBUG_C \
-  CONFIG_MBEDTLS_ENTROPY_FORCE_SHA256 \
-  CONFIG_MBEDTLS_HKDF_C \
-  CONFIG_MBEDTLS_PLATFORM_C \
-  CONFIG_MBEDTLS_SELF_TEST \
-  CONFIG_MBEDTLS_SSL_RENEGOTIATION \
-  CONFIG_MBEDTLS_SSL_TRUNCATED_HMAC \
-  CONFIG_MBEDTLS_THREADING_C \
-  CONFIG_MBEDTLS_THREADING_PTHREAD \
-  CONFIG_MBEDTLS_VERSION_C \
-  CONFIG_MBEDTLS_VERSION_FEATURES
-
-PKG_CONFIG_DEPENDS := $(MBEDTLS_BUILD_OPTS)
-
-include $(INCLUDE_DIR)/package.mk
-include $(INCLUDE_DIR)/cmake.mk
-
-define Package/mbedtls/Default
-  TITLE:=Embedded SSL
-  URL:=https://tls.mbed.org
-endef
-
-define Package/mbedtls/Default/description
-The aim of the mbedtls project is to provide a quality, open-source
-cryptographic library written in C and targeted at embedded systems.
-endef
-
-define Package/libmbedtls
-$(call Package/mbedtls/Default)
-  SECTION:=libs
-  CATEGORY:=Libraries
-  SUBMENU:=SSL
-  TITLE+= (library)
-  ABI_VERSION:=13
-  MENU:=1
-endef
-
-define Package/libmbedtls/config
-	source "$(SOURCE)/Config.in"
-endef
-
-define Package/mbedtls-util
-$(call Package/mbedtls/Default)
-  SECTION:=utils
-  CATEGORY:=Utilities
-  TITLE+= (utilities)
-  DEPENDS:=+libmbedtls
-endef
-
-define Package/libmbedtls/description
-$(call Package/mbedtls/Default/description)
-This package contains the mbedtls library.
-endef
-
-define Package/mbedtls-util/description
-$(call Package/mbedtls/Default/description)
-This package contains mbedtls helper programs for private key and
-CSR generation (gen_key, cert_req)
-endef
-
-TARGET_CFLAGS := $(filter-out -O%,$(TARGET_CFLAGS))
-
-CMAKE_OPTIONS += \
-	-DCMAKE_POSITION_INDEPENDENT_CODE=ON \
-	-DUSE_SHARED_MBEDTLS_LIBRARY:Bool=ON \
-	-DENABLE_TESTING:Bool=OFF \
-	-DENABLE_PROGRAMS:Bool=ON
-
-define Build/Prepare
-       $(call Build/Prepare/Default)
-
-       $(if $(strip $(foreach opt,$(MBEDTLS_BUILD_OPTS),$($(opt)))),
-	 $(foreach opt,$(MBEDTLS_BUILD_OPTS),
-	 $(PKG_BUILD_DIR)/scripts/config.py \
-	 -f $(PKG_BUILD_DIR)/include/mbedtls/config.h \
-	 $(if $($(opt)),set,unset) $(patsubst CONFIG_%,%,$(opt))),)
-endef
-
-define Build/InstallDev
-	$(INSTALL_DIR) $(1)/usr/include
-	$(CP) $(PKG_INSTALL_DIR)/usr/include/mbedtls $(1)/usr/include/
-	$(INSTALL_DIR) $(1)/usr/lib
-	$(CP) $(PKG_INSTALL_DIR)/usr/lib/lib*.so* $(1)/usr/lib/
-	$(CP) $(PKG_INSTALL_DIR)/usr/lib/lib*.a $(1)/usr/lib/
-endef
-
-define Package/libmbedtls/install
-	$(INSTALL_DIR) $(1)/usr/lib
-	$(CP) $(PKG_INSTALL_DIR)/usr/lib/lib*.so.* $(1)/usr/lib/
-endef
-
-define Package/mbedtls-util/install
-	$(INSTALL_DIR) $(1)/usr/bin
-	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/gen_key $(1)/usr/bin/
-	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/cert_req $(1)/usr/bin/
-endef
-
-$(eval $(call BuildPackage,libmbedtls))
-$(eval $(call BuildPackage,mbedtls-util))
diff --git a/6.6/package/libs/mbedtls/patches/100-x509-crt-verify-SAN-iPAddress.patch b/6.6/package/libs/mbedtls/patches/100-x509-crt-verify-SAN-iPAddress.patch
deleted file mode 100644
index 4ad2e8c7..00000000
--- a/6.6/package/libs/mbedtls/patches/100-x509-crt-verify-SAN-iPAddress.patch
+++ /dev/null
@@ -1,197 +0,0 @@
-From eb9d4fdf1846e688d51d86a9a50f0312aca2af25 Mon Sep 17 00:00:00 2001
-From: Glenn Strauss <gstrauss@gluelogic.com>
-Date: Sun, 23 Oct 2022 19:48:18 -0400
-Subject: [PATCH] x509 crt verify SAN iPAddress
-
-Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
----
- include/mbedtls/x509_crt.h |   2 +-
- library/x509_crt.c         | 126 ++++++++++++++++++++++++++++++-------
- 2 files changed, 103 insertions(+), 25 deletions(-)
-
---- a/include/mbedtls/x509_crt.h
-+++ b/include/mbedtls/x509_crt.h
-@@ -608,7 +608,7 @@ int mbedtls_x509_crt_verify_info(char *b
-  * \param cn       The expected Common Name. This will be checked to be
-  *                 present in the certificate's subjectAltNames extension or,
-  *                 if this extension is absent, as a CN component in its
-- *                 Subject name. Currently only DNS names are supported. This
-+ *                 Subject name. DNS names and IP addresses are supported. This
-  *                 may be \c NULL if the CN need not be verified.
-  * \param flags    The address at which to store the result of the verification.
-  *                 If the verification couldn't be completed, the flag value is
---- a/library/x509_crt.c
-+++ b/library/x509_crt.c
-@@ -57,6 +57,10 @@
- 
- #if defined(MBEDTLS_HAVE_TIME)
- #if defined(_WIN32) && !defined(EFIX64) && !defined(EFI32)
-+#define WIN32_LEAN_AND_MEAN
-+#ifndef _WIN32_WINNT
-+#define _WIN32_WINNT 0x0600
-+#endif
- #include <windows.h>
- #else
- #include <time.h>
-@@ -3002,6 +3006,61 @@ find_parent:
-     }
- }
- 
-+#ifdef _WIN32
-+#ifdef _MSC_VER
-+#pragma comment(lib, "ws2_32.lib")
-+#include <winsock2.h>
-+#include <ws2tcpip.h>
-+#elif (defined(__MINGW32__) || defined(__MINGW64__)) && _WIN32_WINNT >= 0x0600
-+#include <winsock2.h>
-+#include <ws2tcpip.h>
-+#endif
-+#elif defined(__sun)
-+/* Solaris requires -lsocket -lnsl for inet_pton() */
-+#elif defined(__has_include)
-+#if __has_include(<sys/socket.h>)
-+#include <sys/socket.h>
-+#endif
-+#if __has_include(<arpa/inet.h>)
-+#include <arpa/inet.h>
-+#endif
-+#endif
-+
-+/* Use whether or not AF_INET6 is defined to indicate whether or not to use
-+ * the platform inet_pton() or a local implementation (below).  The local
-+ * implementation may be used even in cases where the platform provides
-+ * inet_pton(), e.g. when there are different includes required and/or the
-+ * platform implementation requires dependencies on additional libraries.
-+ * Specifically, Windows requires custom includes and additional link
-+ * dependencies, and Solaris requires additional link dependencies.
-+ * Also, as a coarse heuristic, use the local implementation if the compiler
-+ * does not support __has_include(), or if the definition of AF_INET6 is not
-+ * provided by headers included (or not) via __has_include() above. */
-+#ifndef AF_INET6
-+
-+#define x509_cn_inet_pton(cn, dst) (0)
-+
-+#else
-+
-+static int x509_inet_pton_ipv6(const char *src, void *dst)
-+{
-+    return inet_pton(AF_INET6, src, dst) == 1 ? 0 : -1;
-+}
-+
-+static int x509_inet_pton_ipv4(const char *src, void *dst)
-+{
-+    return inet_pton(AF_INET, src, dst) == 1 ? 0 : -1;
-+}
-+
-+#endif /* AF_INET6 */
-+
-+static size_t x509_cn_inet_pton(const char *cn, void *dst)
-+{
-+    return strchr(cn, ':') == NULL
-+            ? x509_inet_pton_ipv4(cn, dst) == 0 ? 4 : 0
-+            : x509_inet_pton_ipv6(cn, dst) == 0 ? 16 : 0;
-+}
-+
- /*
-  * Check for CN match
-  */
-@@ -3022,24 +3081,51 @@ static int x509_crt_check_cn(const mbedt
-     return -1;
- }
- 
-+static int x509_crt_check_san_ip(const mbedtls_x509_sequence *san,
-+                                 const char *cn, size_t cn_len)
-+{
-+    uint32_t ip[4];
-+    cn_len = x509_cn_inet_pton(cn, ip);
-+    if (cn_len == 0) {
-+        return -1;
-+    }
-+
-+    for (const mbedtls_x509_sequence *cur = san; cur != NULL; cur = cur->next) {
-+        const unsigned char san_type = (unsigned char) cur->buf.tag &
-+                                       MBEDTLS_ASN1_TAG_VALUE_MASK;
-+        if (san_type == MBEDTLS_X509_SAN_IP_ADDRESS &&
-+            cur->buf.len == cn_len && memcmp(cur->buf.p, ip, cn_len) == 0) {
-+            return 0;
-+        }
-+    }
-+
-+    return -1;
-+}
-+
- /*
-  * Check for SAN match, see RFC 5280 Section 4.2.1.6
-  */
--static int x509_crt_check_san(const mbedtls_x509_buf *name,
-+static int x509_crt_check_san(const mbedtls_x509_sequence *san,
-                               const char *cn, size_t cn_len)
- {
--    const unsigned char san_type = (unsigned char) name->tag &
--                                   MBEDTLS_ASN1_TAG_VALUE_MASK;
--
--    /* dNSName */
--    if (san_type == MBEDTLS_X509_SAN_DNS_NAME) {
--        return x509_crt_check_cn(name, cn, cn_len);
-+    int san_ip = 0;
-+    for (const mbedtls_x509_sequence *cur = san; cur != NULL; cur = cur->next) {
-+        switch ((unsigned char) cur->buf.tag & MBEDTLS_ASN1_TAG_VALUE_MASK) {
-+            case MBEDTLS_X509_SAN_DNS_NAME:                /* dNSName */
-+                if (x509_crt_check_cn(&cur->buf, cn, cn_len) == 0) {
-+                    return 0;
-+                }
-+                break;
-+            case MBEDTLS_X509_SAN_IP_ADDRESS:              /* iPAddress */
-+                san_ip = 1;
-+                break;
-+            /* (We may handle other types here later.) */
-+            default: /* Unrecognized type */
-+                break;
-+        }
-     }
- 
--    /* (We may handle other types here later.) */
--
--    /* Unrecognized type */
--    return -1;
-+    return san_ip ? x509_crt_check_san_ip(san, cn, cn_len) : -1;
- }
- 
- /*
-@@ -3050,31 +3136,23 @@ static void x509_crt_verify_name(const m
-                                  uint32_t *flags)
- {
-     const mbedtls_x509_name *name;
--    const mbedtls_x509_sequence *cur;
-     size_t cn_len = strlen(cn);
- 
-     if (crt->ext_types & MBEDTLS_X509_EXT_SUBJECT_ALT_NAME) {
--        for (cur = &crt->subject_alt_names; cur != NULL; cur = cur->next) {
--            if (x509_crt_check_san(&cur->buf, cn, cn_len) == 0) {
--                break;
--            }
--        }
--
--        if (cur == NULL) {
--            *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
-+        if (x509_crt_check_san(&crt->subject_alt_names, cn, cn_len) == 0) {
-+            return;
-         }
-     } else {
-         for (name = &crt->subject; name != NULL; name = name->next) {
-             if (MBEDTLS_OID_CMP(MBEDTLS_OID_AT_CN, &name->oid) == 0 &&
-                 x509_crt_check_cn(&name->val, cn, cn_len) == 0) {
--                break;
-+                return;
-             }
-         }
- 
--        if (name == NULL) {
--            *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
--        }
-     }
-+
-+    *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
- }
- 
- /*
diff --git a/6.6/package/libs/mbedtls/patches/101-remove-test.patch b/6.6/package/libs/mbedtls/patches/101-remove-test.patch
deleted file mode 100644
index e43f8757..00000000
--- a/6.6/package/libs/mbedtls/patches/101-remove-test.patch
+++ /dev/null
@@ -1,15 +0,0 @@
---- a/programs/CMakeLists.txt
-+++ b/programs/CMakeLists.txt
-@@ -1,12 +1,8 @@
- add_subdirectory(aes)
--if (NOT WIN32)
--    add_subdirectory(fuzz)
--endif()
- add_subdirectory(hash)
- add_subdirectory(pkey)
- add_subdirectory(psa)
- add_subdirectory(random)
- add_subdirectory(ssl)
--add_subdirectory(test)
- add_subdirectory(util)
- add_subdirectory(x509)
diff --git a/6.6/target/linux/bcm27xx/image/Makefile b/6.6/target/linux/bcm27xx/image/Makefile
new file mode 100644
index 00000000..3a0ab2c1
--- /dev/null
+++ b/6.6/target/linux/bcm27xx/image/Makefile
@@ -0,0 +1,223 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2012-2019 OpenWrt.org
+# Copyright (C) 2016-2017 LEDE project
+
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/image.mk
+
+FAT32_BLOCK_SIZE=1024
+FAT32_BLOCKS=$(shell echo $$(($(CONFIG_TARGET_KERNEL_PARTSIZE)*1024*1024/$(FAT32_BLOCK_SIZE))))
+
+define Build/Compile
+	$(CP) $(LINUX_DIR)/COPYING $(KDIR)/COPYING.linux
+endef
+
+### Image scripts ###
+define Build/boot-common
+	echo $(IMG_PART_SIGNATURE) > $@-partuuid.txt
+	sed \
+		-e 's#@ROOT@#PARTUUID=$(IMG_PART_SIGNATURE)-02#g' \
+		cmdline.txt > $@-cmdline.txt
+
+	rm -f $@.boot
+	mkfs.fat -n boot -C $@.boot $(FAT32_BLOCKS)
+	mcopy -i $@.boot $(KDIR)/COPYING.linux ::
+	mcopy -i $@.boot $(KDIR)/LICENCE.broadcom ::
+	mcopy -i $@.boot $@-cmdline.txt ::cmdline.txt
+	mcopy -i $@.boot config.txt ::
+	mcopy -i $@.boot distroconfig.txt ::
+	mcopy -i $@.boot $@-partuuid.txt ::partuuid.txt
+	mcopy -i $@.boot $(IMAGE_KERNEL) ::$(KERNEL_IMG)
+	$(foreach dts,$(shell echo $(DEVICE_DTS)),mcopy -i $@.boot $(DTS_DIR)/$(dts).dtb ::;)
+	mmd -i $@.boot ::/overlays
+	mcopy -i $@.boot $(DTS_DIR)/overlays/*.dtbo ::/overlays/
+	mcopy -i $@.boot $(DTS_DIR)/overlays/README ::/overlays/
+endef
+
+define Build/boot-2708
+	mcopy -i $@.boot $(KDIR)/bootcode.bin ::
+	mcopy -i $@.boot $(KDIR)/start.elf ::
+	mcopy -i $@.boot $(KDIR)/start_cd.elf ::
+	mcopy -i $@.boot $(KDIR)/start_x.elf ::
+	mcopy -i $@.boot $(KDIR)/fixup.dat ::
+	mcopy -i $@.boot $(KDIR)/fixup_cd.dat ::
+	mcopy -i $@.boot $(KDIR)/fixup_x.dat ::
+endef
+
+define Build/boot-2711
+	mcopy -i $@.boot $(KDIR)/start4.elf ::
+	mcopy -i $@.boot $(KDIR)/start4cd.elf ::
+	mcopy -i $@.boot $(KDIR)/start4x.elf ::
+	mcopy -i $@.boot $(KDIR)/fixup4.dat ::
+	mcopy -i $@.boot $(KDIR)/fixup4cd.dat ::
+	mcopy -i $@.boot $(KDIR)/fixup4x.dat ::
+endef
+
+define Build/sdcard-img
+	SIGNATURE="$(IMG_PART_SIGNATURE)" \
+	./gen_rpi_sdcard_img.sh $@ $@.boot $(IMAGE_ROOTFS) \
+		$(CONFIG_TARGET_KERNEL_PARTSIZE) $(CONFIG_TARGET_ROOTFS_PARTSIZE)
+endef
+
+### Devices ###
+define Device/Default
+  DEVICE_VENDOR := Raspberry Pi
+  KERNEL := kernel-bin
+  KERNEL_IMG := kernel.img
+  IMAGES := factory.img.gz sysupgrade.img.gz
+  IMAGE/sysupgrade.img.gz := boot-common | boot-2708 | sdcard-img | gzip | append-metadata
+  IMAGE/factory.img.gz := boot-common | boot-2708 | sdcard-img | gzip
+endef
+
+define Device/rpi
+  DEVICE_MODEL := A/A+/B/B+/CM/Zero/ZeroW
+  DEVICE_DTS := \
+	broadcom/bcm2708-rpi-b broadcom/bcm2708-rpi-b-rev1 broadcom/bcm2708-rpi-b-plus \
+	broadcom/bcm2708-rpi-cm \
+	broadcom/bcm2708-rpi-zero broadcom/bcm2708-rpi-zero-w
+  SUPPORTED_DEVICES := \
+	rpi-a rpi-a-plus \
+	rpi-b rpi-b-plus \
+	rpi-cm \
+	rpi-zero rpi-zero-w \
+	raspberrypi,model-a raspberrypi,model-a-plus \
+	raspberrypi,model-b raspberrypi,model-b-plus raspberrypi,model-b-rev2 \
+	raspberrypi,compute-module raspberrypi,compute-module-1 \
+	raspberrypi,model-zero raspberrypi,model-zero-w
+  DEVICE_PACKAGES := \
+	cypress-firmware-43430-sdio \
+	brcmfmac-nvram-43430-sdio \
+	kmod-brcmfmac wpad-basic-mbedtls
+endef
+ifeq ($(SUBTARGET),bcm2708)
+  TARGET_DEVICES += rpi
+endif
+
+define Device/rpi-2
+  DEVICE_MODEL := 2B/2B 1.2
+  DEVICE_VARIANT := (32bit)
+  DEVICE_ALT0_VENDOR := Raspberry Pi
+  DEVICE_ALT0_MODEL := 3A+/3B/3B+/CM3/Zero2/Zero2W
+  DEVICE_ALT0_VARIANT := (32bit)
+  DEVICE_ALT1_VENDOR := Raspberry Pi
+  DEVICE_ALT1_MODEL := 4B/400/CM4
+  DEVICE_ALT1_VARIANT := (32bit)
+  DEVICE_DTS := \
+	broadcom/bcm2709-rpi-2-b broadcom/bcm2710-rpi-2-b \
+	broadcom/bcm2710-rpi-3-b broadcom/bcm2710-rpi-3-b-plus \
+	broadcom/bcm2711-rpi-4-b broadcom/bcm2711-rpi-400 \
+	broadcom/bcm2710-rpi-cm3 broadcom/bcm2711-rpi-cm4 \
+	broadcom/bcm2710-rpi-zero-2 broadcom/bcm2710-rpi-zero-2-w
+  SUPPORTED_DEVICES := \
+	rpi-2-b \
+	rpi-3-a-plus \
+	rpi-3-b rpi-3-b-plus \
+	rpi-4-b rpi-400 \
+	rpi-cm \
+	rpi-zero-2 rpi-zero-2-w \
+	raspberrypi,2-model-b raspberrypi,2-model-b-rev2 \
+	raspberrypi,3-model-a-plus \
+	raspberrypi,3-model-b raspberrypi,3-model-b-plus \
+	raspberrypi,3-compute-module raspberrypi,compute-module-3 \
+	raspberrypi,400 raspberrypi,4-compute-module raspberrypi,4-model-b \
+	raspberrypi,model-zero-2 raspberrypi,model-zero-2-w
+  DEVICE_PACKAGES := \
+	cypress-firmware-43430-sdio \
+	brcmfmac-nvram-43430-sdio \
+	cypress-firmware-43455-sdio \
+	brcmfmac-nvram-43455-sdio \
+	kmod-brcmfmac wpad-basic-mbedtls
+  IMAGE/sysupgrade.img.gz := boot-common | boot-2708 | boot-2711 | sdcard-img | gzip | append-metadata
+  IMAGE/factory.img.gz := boot-common | boot-2708 | boot-2711 | sdcard-img | gzip
+endef
+ifeq ($(SUBTARGET),bcm2709)
+  TARGET_DEVICES += rpi-2
+endif
+
+define Device/rpi-3
+  DEVICE_MODEL := 3A+/3B/3B+/CM3/Zero2/Zero2W
+  DEVICE_VARIANT := (64bit)
+  DEVICE_ALT0_VENDOR := Raspberry Pi
+  DEVICE_ALT0_MODEL := 2B-1.2
+  DEVICE_ALT0_VARIANT := (64bit)
+  KERNEL_IMG := kernel8.img
+  DEVICE_DTS := \
+	broadcom/bcm2710-rpi-2-b \
+	broadcom/bcm2710-rpi-3-b broadcom/bcm2710-rpi-3-b-plus \
+	broadcom/bcm2710-rpi-cm3 \
+	broadcom/bcm2710-rpi-zero-2 broadcom/bcm2710-rpi-zero-2-w
+  SUPPORTED_DEVICES := \
+	rpi-3-a-plus \
+	rpi-3-b rpi-3-b-plus \
+	rpi-zero-2 rpi-zero-2-w \
+	raspberrypi,2-model-b-rev2 \
+	raspberrypi,3-model-a-plus \
+	raspberrypi,3-model-b raspberrypi,3-model-b-plus \
+	raspberrypi,3-compute-module raspberrypi,compute-module-3 \
+	raspberrypi,model-zero-2 raspberrypi,model-zero-2-w
+  DEVICE_PACKAGES := \
+	cypress-firmware-43430-sdio \
+	brcmfmac-nvram-43430-sdio \
+	cypress-firmware-43455-sdio \
+	brcmfmac-nvram-43455-sdio \
+	kmod-brcmfmac wpad-basic-mbedtls
+endef
+ifeq ($(SUBTARGET),bcm2710)
+  TARGET_DEVICES += rpi-3
+endif
+
+define Device/rpi-4
+  DEVICE_MODEL := 4B/400/CM4
+  DEVICE_VARIANT := (64bit)
+  KERNEL_IMG := kernel8.img
+  DEVICE_DTS := \
+	broadcom/bcm2711-rpi-400 \
+	broadcom/bcm2711-rpi-4-b \
+	broadcom/bcm2711-rpi-cm4 \
+	broadcom/bcm2711-rpi-cm4s \
+	broadcom/bcm2711-rpi-cm4-io
+  SUPPORTED_DEVICES := \
+	raspberrypi,400 \
+	raspberrypi,4-compute-module \
+	raspberrypi,4-model-b
+  DEVICE_PACKAGES := \
+	cypress-firmware-43455-sdio \
+	brcmfmac-nvram-43455-sdio \
+	kmod-brcmfmac wpad-basic-mbedtls \
+	kmod-usb-net-lan78xx \
+	kmod-r8169
+  IMAGE/sysupgrade.img.gz := boot-common | boot-2711 | sdcard-img | gzip | append-metadata
+  IMAGE/factory.img.gz := boot-common | boot-2711 | sdcard-img | gzip
+endef
+ifeq ($(SUBTARGET),bcm2711)
+  TARGET_DEVICES += rpi-4
+endif
+
+define Device/rpi-5
+  DEVICE_MODEL := 5/CM5
+  KERNEL_IMG := kernel_2712.img
+  DEVICE_DTS := \
+	broadcom/bcm2712-rpi-500 \
+	broadcom/bcm2712-rpi-5-b \
+	broadcom/bcm2712-rpi-cm5-cm4io \
+	broadcom/bcm2712-rpi-cm5-cm5io \
+	broadcom/bcm2712-rpi-cm5l-cm4io \
+	broadcom/bcm2712-rpi-cm5l-cm5io
+  SUPPORTED_DEVICES := \
+	raspberrypi,500 \
+	raspberrypi,5-compute-module \
+	raspberrypi,5-model-b
+  DEVICE_PACKAGES := \
+	cypress-firmware-43455-sdio \
+	brcmfmac-nvram-43455-sdio \
+	kmod-brcmfmac wpad-basic-mbedtls \
+	kmod-hwmon-pwmfan kmod-thermal
+  IMAGE/sysupgrade.img.gz := boot-common | sdcard-img | gzip | append-metadata
+  IMAGE/factory.img.gz := boot-common | sdcard-img | gzip
+endef
+ifeq ($(SUBTARGET),bcm2712)
+  TARGET_DEVICES += rpi-5
+endif
+
+$(eval $(call BuildImage))
diff --git a/6.6/target/linux/bcm27xx/patches-6.6/999-dts-add-hogs-on-CM5.patch b/6.6/target/linux/bcm27xx/patches-6.6/999-dts-add-hogs-on-CM5.patch
new file mode 100644
index 00000000..835a98ce
--- /dev/null
+++ b/6.6/target/linux/bcm27xx/patches-6.6/999-dts-add-hogs-on-CM5.patch
@@ -0,0 +1,40 @@
+From a4e7897eef1ad4628572a6abfd30291209a0bf43 Mon Sep 17 00:00:00 2001
+From: Richard Oliver <richard.oliver@raspberrypi.com>
+Date: Tue, 25 Feb 2025 15:06:23 +0000
+Subject: [PATCH] dts: Add hogs for RP1 GPIO 46/48 on CM5
+
+On Pi5 5, GPIOs 46/48 are made available on the 'CAM/DISP 1' connector as
+'CD1_IO0_MICCLK'/'CD1_IO1_MICDAT1'. These GPIOs are not connected on
+CM5.
+
+Add hogs for GPIO 46/48 on CM5 to prevent camera drivers from
+inadvertently using them when connected to 'CAM/DISP 1'
+
+Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi
+index 3a2b702fe6a064..0a44cffca71f57 100644
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi
+@@ -734,6 +734,18 @@ spi10_cs_pins: &spi10_cs_gpio1 {};
+ 		function = "vbus1";
+ 		pins = "gpio42", "gpio43";
+ 	};
++
++	micclk1_hog {
++		gpio-hog;
++		gpios = <46 GPIO_ACTIVE_HIGH>;
++		output-high;
++	};
++
++	micdat1_hog {
++		gpio-hog;
++		gpios = <48 GPIO_ACTIVE_HIGH>;
++		output-high;
++	};
+ };
+ 
+ / {
diff --git a/6.6/target/linux/generic/config-6.6 b/6.6/target/linux/generic/config-6.6
index 3166ee00..4c68e1c0 100644
--- a/6.6/target/linux/generic/config-6.6
+++ b/6.6/target/linux/generic/config-6.6
@@ -8274,3 +8274,12 @@ CONFIG_PCP_BATCH_SCALE_MAX=5
 # CONFIG_I40E_DCB is not set
 # CONFIG_QLCNIC_DCB is not set
 # CONFIG_ARM64_ERRATUM_3194386 is not set
+# CONFIG_HID_MCP2200 is not set
+CONFIG_PROC_MEM_ALWAYS_FORCE=y
+# CONFIG_PROC_MEM_FORCE_PTRACE is not set
+# CONFIG_PROC_MEM_NO_FORCE is not set
+# CONFIG_OF_PARTITION is not set
+# CONFIG_NVMEM_LAYOUT_ADTRAN is not set
+# CONFIG_NVMEM_LAYOUT_U_BOOT_ENV is not set
+# CONFIG_RTL8261N_PHY is not set
+# CONFIG_ZRAM_TRACK_ENTRY_ACTIME is not set
diff --git a/6.6/target/linux/mediatek/dts/mt7981b-zbt-z8102ax-eMMC.dts b/6.6/target/linux/mediatek/dts/mt7981b-zbt-z8102ax-eMMC.dts
new file mode 100644
index 00000000..88ec7bca
--- /dev/null
+++ b/6.6/target/linux/mediatek/dts/mt7981b-zbt-z8102ax-eMMC.dts
@@ -0,0 +1,339 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT 
+
+/dts-v1/;
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+#include "mt7981.dtsi"
+
+/ {
+	model = "ZBT Z8102AX (EMMC)";
+	compatible = "z8102ax-emmc", "mediatek,mt7981", "zbtlink,zbt-z8102ax-emmc";
+
+	aliases {
+		serial0 = &uart0;
+		led-boot = &led_status_green;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_green;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs = "earlycon=uart8250,mmio32,0x11002000 console=ttyS0,115200n8 loglevel=8";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+		};
+		
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_red: red {
+			label = "red:status";
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+		};
+
+		led_status_green: green {
+			label = "green:status";
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+		};
+		
+		led_status_blue: blue {
+			label = "blue:status";
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+		};
+		
+		led_status_modem1: modem1 {
+			label = "modem1:status";
+			gpios = <&pio 8 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_USB;
+			function-enumerator = <0>;
+		};
+		
+		led_status_modem2: modem2 {
+			label = "modem2:status";
+			gpios = <&pio 13 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_USB;
+			function-enumerator = <1>;
+		};
+	};
+
+	watchdog {
+		compatible = "linux,wdt-gpio";
+		gpios = <&pio 2 GPIO_ACTIVE_HIGH>;
+		hw_algo = "toggle";
+		hw_margin_ms = <1000>;
+	};
+
+	gpio-export {
+		compatible = "gpio-export";
+		#size-cells = <0>;
+
+		pcie {
+			gpio-export,name = "pcie_power";
+			gpio-export,output = <1>;
+			gpios = <&pio 3 GPIO_ACTIVE_HIGH>;
+		};
+
+		modem1 {
+			gpio-export,name = "modem1";
+			gpio-export,output = <1>;
+			gpios = <&pio 4 GPIO_ACTIVE_HIGH>;
+		};
+
+		modem2 {
+			gpio-export,name = "modem2";
+			gpio-export,output = <1>;
+			gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
+		};
+
+		sim1 {
+			gpio-export,name = "sim1";
+			gpio-export,output = <1>;
+			gpios = <&pio 6 GPIO_ACTIVE_HIGH>;
+		};
+
+		sim2 {
+			gpio-export,name = "sim2";
+			gpio-export,output = <1>;
+			gpios = <&pio 7 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_factory_004>;
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+	
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "gmii";
+		phy-handle = <&int_gbe_phy>;
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_factory_02a>;
+	};
+};
+
+&mdio_bus {
+	switch: switch@0 {
+		compatible = "mediatek,mt7531";
+		reg = <31>;
+		reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		interrupt-parent = <&pio>;
+		interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
+	};
+};
+
+&mmc0 {
+	pinctrl-names = "default", "state_uhs";
+	pinctrl-0 = <&mmc0_pins_default>;
+	pinctrl-1 = <&mmc0_pins_uhs>;
+	bus-width = <8>;
+	max-frequency = <52000000>;
+	cap-mmc-highspeed;
+	vmmc-supply = <&reg_3p3v>;
+	non-removable;
+	status = "okay";
+
+	card@0 {
+		compatible = "mmc-card";
+		reg = <0>;
+
+		block {
+			compatible = "block-device";
+
+			partitions {
+				block-partition-env {
+					partname = "u-boot-env";
+					nvem-layout {
+						compatible = "u-boot, env";
+					};
+				};
+
+				factory: block-partition-factory {
+					partname = "factory";
+
+					nvmem-layout {
+						compatible = "fixed-layout";
+						#address-cells = <1>;
+						#size-cells = <1>;
+					};
+				};
+			};
+		};
+	};
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "lan1";
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_factory_004>;
+		};
+
+		port@1 {
+			reg = <1>;
+			label = "lan2";
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_factory_004>;
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan3";
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_factory_004>;
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan4";
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_factory_004>;
+		};
+
+		port@6 {
+			reg = <6>;
+			label = "cpu";
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&pio {
+	gpio-line-names = 
+			"wps",
+			"reset",
+			"watchdog",
+			"pcie",
+			"modem1",
+			"modem2",
+			"sim1",
+			"sim2",
+			"modem1_status",
+			"red_status",
+			"green_status",
+			"blue_status",
+			"",
+			"",
+			"modem2_status";
+
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <8>;
+			mediatek,pull-up-adv = <0>; /* bias-disable */
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <8>;
+			mediatek,pull-up-adv = <0>; /* bias-disable */
+		};
+	};
+
+	mmc0_pins_default: mmc0-pins-default {
+		mux {
+			function = "flash";
+			groups = "emmc_45";
+		};
+	};
+
+	mmc0_pins_uhs: mmc0-pins-uhs {
+		mux {
+			function = "flash";
+			groups = "emmc_45";
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&xhci {
+	status = "okay";
+};
+
+&wifi {
+	status = "okay";
+	mediatek,mtd-eeprom = <&factory 0x0>;
+};
+
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_004: macaddr@004 {
+		reg = <0x004 0x6>;
+	};
+	macaddr_factory_02a: macaddr@02a {
+		reg = <0x02a 0x6>;
+	};
+};
diff --git a/6.6/target/linux/mediatek/dts/mt7981b-zbt-z8109ax-128m.dts b/6.6/target/linux/mediatek/dts/mt7981b-zbt-z8109ax-128m.dts
new file mode 100644
index 00000000..99549b8a
--- /dev/null
+++ b/6.6/target/linux/mediatek/dts/mt7981b-zbt-z8109ax-128m.dts
@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT 
+
+#include "mt7981b-zbt-z8109ax.dtsi"
+
+/ {
+	model = "ZBT Z8109AX 128M";
+	compatible = "z8109ax-128m", "z8109ax", "mediatek,mt7981";
+};
+
+&nand_rootfs {
+	reg = <0x0580000 0x7E80000>;
+};
+
diff --git a/6.6/target/linux/mediatek/dts/mt7981b-zbt-z8109ax-512m.dts b/6.6/target/linux/mediatek/dts/mt7981b-zbt-z8109ax-512m.dts
new file mode 100644
index 00000000..9df6322f
--- /dev/null
+++ b/6.6/target/linux/mediatek/dts/mt7981b-zbt-z8109ax-512m.dts
@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT 
+
+#include "mt7981b-zbt-z8109ax.dtsi"
+
+/ {
+	model = "ZBT Z8109AX 512M";
+	compatible = "z8109ax-512m", "z8109ax", "mediatek,mt7981";
+};
+
+&nand_rootfs {
+	reg = <0x0580000 0x20000000>;
+};
+
diff --git a/6.6/target/linux/mediatek/dts/mt7981b-zbt-z8109ax.dtsi b/6.6/target/linux/mediatek/dts/mt7981b-zbt-z8109ax.dtsi
new file mode 100644
index 00000000..ff9155ef
--- /dev/null
+++ b/6.6/target/linux/mediatek/dts/mt7981b-zbt-z8109ax.dtsi
@@ -0,0 +1,380 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT 
+
+/dts-v1/;
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+#include "mt7981.dtsi"
+
+/ {
+	model = "ZBT Z8109AX";
+	compatible = "z8109ax", "mediatek,mt7981-spim-snand-rfb", "zbtlink,zbt-z8109ax";
+
+	aliases {
+		serial0 = &uart0;
+		led-boot = &led_status_green;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_green;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs = "earlycon=uart8250,mmio32,0x11002000 console=ttyS0,115200n8 loglevel=8";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+		};
+		
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_red: red {
+			label = "red:status";
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+		};
+
+		led_status_green: green {
+			label = "green:status";
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+		};
+		
+		led_status_blue: blue {
+			label = "blue:status";
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+		};
+		
+		led_status_modem1: modem1 {
+			label = "modem1:status";
+			gpios = <&pio 8 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_USB;
+			function-enumerator = <0>;
+		};
+		
+		led_status_modem2: modem2 {
+			label = "modem2:status";
+			gpios = <&pio 13 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_USB;
+			function-enumerator = <1>;
+		};
+
+		led_status_modem3: modem3 {
+			label = "modem3:status";
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_USB;
+			function-enumerator = <2>;
+		};
+
+		led_status_modem4: modem4 {
+			label = "modem3:status";
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_USB;
+			function-enumerator = <3>;
+		};
+	};
+
+	watchdog {
+		compatible = "linux,wdt-gpio";
+		gpios = <&pio 2 GPIO_ACTIVE_HIGH>;
+		hw_algo = "toggle";
+		hw_margin_ms = <1000>;
+	};
+
+	gpio-export {
+		compatible = "gpio-export";
+		#size-cells = <0>;
+
+		modem1 {
+			gpio-export,name = "modem1";
+			gpio-export,output = <1>;
+			gpios = <&pio 4 GPIO_ACTIVE_HIGH>;
+		};
+
+		modem2 {
+			gpio-export,name = "modem2";
+			gpio-export,output = <1>;
+			gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
+		};
+
+		modem3 {
+			gpio-export,name = "modem3";
+			gpio-export,output = <1>;
+			gpios = <&pio 0 GPIO_ACTIVE_HIGH>;
+		};
+
+		modem4 {
+			gpio-export,name = "modem4";
+			gpio-export,output = <1>;
+			gpios = <&pio 3 GPIO_ACTIVE_HIGH>;
+		};
+
+		sim1 {
+			gpio-export,name = "sim1";
+			gpio-export,output = <1>;
+			gpios = <&pio 6 GPIO_ACTIVE_HIGH>;
+		};
+
+		sim2 {
+			gpio-export,name = "sim2";
+			gpio-export,output = <1>;
+			gpios = <&pio 7 GPIO_ACTIVE_HIGH>;
+		};
+
+		sim3 {
+			gpio-export,name = "sim3";
+			gpio-export,output = <1>;
+			gpios = <&pio 12 GPIO_ACTIVE_HIGH>;
+		};
+
+		sim4 {
+			gpio-export,name = "sim4";
+			gpio-export,output = <1>;
+			gpios = <&pio 14 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_factory_004>;
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+	
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "gmii";
+		phy-handle = <&int_gbe_phy>;
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_factory_02a>;
+	};
+};
+
+&mdio_bus {
+	switch: switch@0 {
+		compatible = "mediatek,mt7531";
+		reg = <31>;
+		reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		interrupt-parent = <&pio>;
+		interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "okay";
+
+	spi_nand@0 {
+		compatible = "spi-nand";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0>;
+
+		spi-max-frequency = <52000000>;
+		spi-tx-buswidth = <4>;
+		spi-rx-buswidth = <4>;
+
+		mediatek,nmbm;
+		mediatek,bmt-max-ratio = <1>;
+		mediatek,bmt-max-reserved-blocks = <64>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "bl2";
+				reg = <0x0000000 0x0100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x0100000 0x0080000>;
+			};
+
+			factory: partition@180000 {
+				label = "Factory";
+				reg = <0x0180000 0x0200000>;
+				read-only;
+			};
+
+			partition@380000 {
+				label = "FIP";
+				reg = <0x0380000 0x0200000>;
+				read-only;
+			};
+
+			nand_rootfs: partition@580000 {
+				label = "ubi";
+			};
+		};
+	};
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "lan1";
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_factory_004>;
+		};
+
+		port@1 {
+			reg = <1>;
+			label = "lan2";
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_factory_004>;
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan3";
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_factory_004>;
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan4";
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_factory_004>;
+		};
+
+		port@4 {
+			reg = <4>;
+			label = "lan5";
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_factory_004>;
+		};
+
+		port@6 {
+			reg = <6>;
+			label = "cpu";
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&pio {
+	gpio-line-names = 
+			"wps",
+			"reset",
+			"watchdog",
+			"pcie",
+			"modem1",
+			"modem2",
+			"sim1",
+			"sim2",
+			"modem1_status",
+			"red_status",
+			"green_status",
+			"blue_status",
+			"",
+			"",
+			"modem2_status";
+
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <8>;
+			mediatek,pull-up-adv = <0>; /* bias-disable */
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <8>;
+			mediatek,pull-up-adv = <0>; /* bias-disable */
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&xhci {
+	status = "okay";
+};
+
+&wifi {
+	status = "okay";
+	mediatek,mtd-eeprom = <&factory 0x0>;
+};
+
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_004: macaddr@004 {
+		reg = <0x004 0x6>;
+	};
+	macaddr_factory_02a: macaddr@02a {
+		reg = <0x02a 0x6>;
+	};
+};
diff --git a/6.6/target/linux/mediatek/filogic/base-files/etc/board.d/01_leds b/6.6/target/linux/mediatek/filogic/base-files/etc/board.d/01_leds
index 3a4aaa30..63d7323d 100644
--- a/6.6/target/linux/mediatek/filogic/base-files/etc/board.d/01_leds
+++ b/6.6/target/linux/mediatek/filogic/base-files/etc/board.d/01_leds
@@ -6,10 +6,59 @@ board=$(board_name)
 board_config_update
 
 case $board in
+abt,asr3000)
+	ucidef_set_led_netdev "wan" "WAN" "green:wan" "eth1"
+	ucidef_set_led_netdev "wlan2g" "WLAN2G" "green:wlan-2ghz" "phy0-ap0"
+	ucidef_set_led_netdev "wlan5g" "WLAN5G" "green:wlan-5ghz" "phy1-ap0"
+	;;
+confiabits,mt7981)
+	ucidef_set_led_netdev "lan1" "lan1" "blue:lan-1" "lan1" "link tx rx"
+	ucidef_set_led_netdev "lan2" "lan2" "blue:lan-2" "lan2" "link tx rx"
+	ucidef_set_led_netdev "lan3" "lan3" "blue:lan-3" "lan3" "link tx rx"
+	ucidef_set_led_netdev "wan" "wan" "blue:wan" "wan" "link tx rx"
+	;;
+bananapi,bpi-r3-mini)
+	ucidef_set_led_netdev "lan1" "LAN" "mdio-bus:0e:green:lan" "eth0" "link_2500 link_1000 tx rx"
+	ucidef_set_led_netdev "lan2" "LAN" "mdio-bus:0e:yellow:lan" "eth0" "link_2500 link_100 tx rx"
+	ucidef_set_led_netdev "wan1" "WAN" "mdio-bus:0f:green:wan" "eth1" "link_2500 link_1000 tx rx"
+	ucidef_set_led_netdev "wan2" "WAN" "mdio-bus:0f:yellow:wan" "eth1" "link_2500 link_100 tx rx"
+	ucidef_set_led_netdev "wlan2g" "WLAN2G" "blue:wlan-1" "phy0-ap0"
+	ucidef_set_led_netdev "wlan5g" "WLAN5G" "blue:wlan-2" "phy1-ap0"
+	;;
+bananapi,bpi-r4|\
+bananapi,bpi-r4-poe)
+	ucidef_set_led_netdev "wan" "wan" "mt7530-0:00:green:lan" "wan" "link tx rx"
+	ucidef_set_led_netdev "lan1" "lan1" "mt7530-0:01:green:lan" "lan1" "link tx rx"
+	ucidef_set_led_netdev "lan2" "lan2" "mt7530-0:02:green:lan" "lan2" "link tx rx"
+	ucidef_set_led_netdev "lan3" "lan3" "mt7530-0:03:green:lan" "lan3" "link tx rx"
+	;;
+cudy,re3000-v1)
+	ucidef_set_led_netdev "lan" "lan" "green:lan" "eth0" "link tx rx"
+	;;
 cudy,wr3000-v1)
 	ucidef_set_led_netdev "wan" "wan" "blue:wan" "wan"
 	;;
-mercusys,mr90x-v1)
+cudy,wr3000h-v1)
+	ucidef_set_led_netdev "lan1" "lan1" "white:lan-1" "lan1" "link tx rx"
+	ucidef_set_led_netdev "lan2" "lan2" "white:lan-2" "lan2" "link tx rx"
+	ucidef_set_led_netdev "lan3" "lan3" "white:lan-3" "lan3" "link tx rx"
+	ucidef_set_led_netdev "lan4" "lan4" "white:lan-4" "lan4" "link tx rx"
+	ucidef_set_led_netdev "wan" "wan" "white:wan" "wan" "link tx rx"
+	ucidef_set_led_netdev "internet" "internet" "white:wan-online" "wan" "link"
+	;;
+glinet,gl-x3000|\
+glinet,gl-xe3000)
+	ucidef_set_led_default "power" "POWER" "green:power" "1"
+	ucidef_set_led_netdev "wan" "WAN" "green:wan" "eth0"
+	ucidef_set_led_netdev "5g_1" "5G_1" "green:5g:led1" "wwan0"
+	ucidef_set_led_netdev "5g_2" "5G_2" "green:5g:led2" "wwan0"
+	ucidef_set_led_netdev "5g_3" "5G_3" "green:5g:led3" "wwan0"
+	ucidef_set_led_netdev "5g_4" "5G_4" "green:5g:led4" "wwan0"
+	ucidef_set_led_netdev "wlan2g" "WLAN2G" "green:wifi2g" "phy0-ap0"
+	ucidef_set_led_netdev "wlan5g" "WLAN5G" "green:wifi5g" "phy1-ap0"
+	;;
+mercusys,mr90x-v1|\
+mercusys,mr90x-v1-ubi)
 	ucidef_set_led_netdev "lan0" "lan0" "green:lan0" "lan0" "link tx rx"
 	ucidef_set_led_netdev "lan1" "lan2" "green:lan1" "lan1" "link tx rx"
 	ucidef_set_led_netdev "lan2" "lan2" "green:lan2" "lan2" "link tx rx"
@@ -20,6 +69,66 @@ netgear,wax220)
 	ucidef_set_led_netdev "wlan2g" "WLAN2G" "blue:wlan2g" "phy0-ap0"
 	ucidef_set_led_netdev "wlan5g" "WLAN5G" "blue:wlan5g" "phy1-ap0"
 	;;
+nokia,ea0326gmp)
+	ucidef_set_led_netdev "wan" "WAN" "green:wan" "eth1" "link"
+	ucidef_set_led_netdev "lan" "LAN" "green:lan" "br-lan" "link"
+	ucidef_set_led_netdev "wlan" "WLAN" "green:wlan" "phy1-ap0" "link"
+	;;
+nradio,c8-668gl)
+	ucidef_set_led_netdev "wifi" "WIFI" "blue:wlan" "phy1-ap0" "link"
+	ucidef_set_led_netdev "5g" "5G" "blue:indicator-0" "eth1" "link"
+	;;
+openembed,som7981)
+	ucidef_set_led_netdev "lanact" "LANACT" "amber:lan" "eth1" "rx tx"
+	ucidef_set_led_netdev "lanlink" "LANLINK" "green:lan" "eth1" "link"
+	;;
+openwrt,one)
+	ucidef_set_led_netdev "wanact" "WANACT" "mdio-bus:0f:green:wan" "eth0" "rx tx"
+	ucidef_set_led_netdev "wanlink" "WANLINK" "mdio-bus:0f:amber:wan" "eth0" "link"
+	ucidef_set_led_netdev "lanact" "LANACT" "green:lan" "eth1" "rx tx"
+	ucidef_set_led_netdev "lanlink" "LANLINK" "amber:lan" "eth1" "link"
+	;;
+routerich,ax3000|\
+routerich,ax3000-ubootmod)
+	ucidef_set_led_netdev "lan-1" "lan-1" "blue:lan-1" "lan1" "link tx rx"
+	ucidef_set_led_netdev "lan-2" "lan-2" "blue:lan-2" "lan2" "link tx rx"
+	ucidef_set_led_netdev "lan-3" "lan-3" "blue:lan-3" "lan3" "link tx rx"
+	ucidef_set_led_netdev "wan" "wan" "blue:wan" "wan" "link tx rx"
+	ucidef_set_led_netdev "wan-off" "wan-off" "red:wan" "wan" "link"
+	;;
+smartrg,sdg-8733|\
+smartrg,sdg-8734)
+	ucidef_set_led_netdev "lan-1-green" "LAN1" "mdio-bus:08:green:lan" "lan1" "link_2500 link_5000"
+	ucidef_set_led_netdev "lan-1-orange" "LAN1" "mdio-bus:08:orange:lan" "lan1" "link_100 link_1000"
+	ucidef_set_led_netdev "lan-1-white" "LAN1" "mdio-bus:08:white:lan" "lan1" "link_10000"
+	ucidef_set_led_netdev "lan-2-green" "LAN2" "mt7530-0:01:green:lan" "lan2" "link_1000"
+	ucidef_set_led_netdev "lan-2-amber" "LAN2" "mt7530-0:01:amber:lan" "lan2" "link_100 link_10"
+	ucidef_set_led_netdev "lan-3-green" "LAN3" "mt7530-0:02:green:lan" "lan3" "link_1000"
+	ucidef_set_led_netdev "lan-3-amber" "LAN3" "mt7530-0:02:amber:lan" "lan3" "link_100 link_10"
+	ucidef_set_led_netdev "lan-4-green" "LAN4" "mt7530-0:03:green:lan" "lan4" "link_1000"
+	ucidef_set_led_netdev "lan-4-amber" "LAN4" "mt7530-0:03:amber:lan" "lan4" "link_100 link_10"
+	ucidef_set_led_netdev "wan-green" "WAN" "mdio-bus:00:green:wan" "wan" "link_2500 link_5000"
+	ucidef_set_led_netdev "wan-orange" "WAN" "mdio-bus:00:orange:wan" "wan" "link_100 link_1000"
+	ucidef_set_led_netdev "wan-white" "WAN" "mdio-bus:00:white:wan" "wan" "link_10000"
+	;;
+smartrg,sdg-8733a)
+	ucidef_set_led_netdev "lan-green-act" "LAN" "mdio-bus:0f:green:lan" "lan" "link_2500"
+	ucidef_set_led_netdev "lan-amber" "LAN" "amber:lan" "lan" "link_100"
+	ucidef_set_led_netdev "lan-green" "LAN" "green:lan" "lan" "link_1000"
+	ucidef_set_led_netdev "wan-green" "WAN" "mdio-bus:08:green:wan" "wan" "link_2500 link_5000"
+	ucidef_set_led_netdev "wan-orange" "WAN" "mdio-bus:08:orange:wan" "wan" "link_100 link_1000"
+	ucidef_set_led_netdev "wan-white" "WAN" "mdio-bus:08:white:wan" "wan" "link_10000"
+	;;
+tplink,re6000xd)
+	ucidef_set_led_netdev "lan-1" "lan-1" "blue:lan-0" "lan1" "link tx rx"
+	ucidef_set_led_netdev "lan-2" "lan-2" "blue:lan-1" "lan2" "link tx rx"
+	ucidef_set_led_netdev "eth1" "lan-3" "blue:lan-2" "eth1" "link tx rx"
+	;;
+wavlink,wl-wn586x3)
+	ucidef_set_led_netdev "lan-1" "lan-1" "blue:lan-1" "lan1" "link tx rx"
+	ucidef_set_led_netdev "lan-2" "lan-2" "blue:lan-2" "lan2" "link tx rx"
+	ucidef_set_led_netdev "wan" "wan" "blue:wan" "eth1" "link tx rx"
+	;;
 xiaomi,mi-router-wr30u-112m-nmbm|\
 xiaomi,mi-router-wr30u-stock|\
 xiaomi,mi-router-wr30u-ubootmod)
@@ -29,11 +138,29 @@ xiaomi,redmi-router-ax6000-stock|\
 xiaomi,redmi-router-ax6000-ubootmod)
 	ucidef_set_led_netdev "wan" "wan" "rgb:network" "wan"
 	;;
+z8102ax-emmc|\
 z8102ax-128m|\
 z8102ax-64m)
 	ucidef_set_led_netdev "modem1" "modem1" "modem1:status" "wwan0"
 	ucidef_set_led_netdev "modem2" "modem2" "modem2:status" "wwan1"
 	;;
+z8109ax-512m|\
+z8109ax-128m)
+	ucidef_set_led_netdev "modem1" "modem1" "modem1:status" "wwan0"
+	ucidef_set_led_netdev "modem2" "modem2" "modem2:status" "wwan1"
+	ucidef_set_led_netdev "modem3" "modem3" "modem3:status" "wwan2"
+	ucidef_set_led_netdev "modem4" "modem4" "modem4:status" "wwan3"
+	;;
+zbtlink,zbt-z8103ax)
+	ucidef_set_led_netdev "wan" "wan" "green:wan" "eth1" "link tx rx"
+	;;
+zyxel_ex5601-t0-stock|\
+zyxel,ex5601-t0-ubootmod)
+	ucidef_set_led_netdev "lan" "LAN" "green:lan" "eth0" "link tx rx"
+	ucidef_set_led_netdev "wan" "WAN" "green:inet" "eth1" "link tx rx"
+	ucidef_set_led_netdev "wifi-24g" "WIFI-2.4G" "green:wifi24g" "phy0-ap0" "link tx rx"
+	ucidef_set_led_netdev "wifi-5g" "WIFI-5G" "green:wifi5g" "phy1-ap0" "link tx rx"
+	;;
 esac
 
 board_config_flush
diff --git a/6.6/target/linux/mediatek/filogic/base-files/etc/board.d/02_network b/6.6/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
index 985b51ac..41f86afc 100644
--- a/6.6/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
+++ b/6.6/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
@@ -18,30 +18,50 @@ mediatek_setup_interfaces()
 	zbtlink,zbt-z8103ax)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3" eth1
 		;;
-	acer,predator-w6)
+	acer,predator-w6|\
+	acer,predator-w6d)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 game" eth1
 		;;
+	acer,vero-w6m)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3" internet
+		;;
+	arcadyan,mozart)
+		ucidef_set_interfaces_lan_wan "lan0 eth1" eth2
+		;;
 	asus,rt-ax59u|\
 	cetron,ct3003|\
 	confiabits,mt7981|\
 	cudy,wr3000-v1|\
 	jcg,q30-pro|\
+	keenetic,kn-3811|\
 	qihoo,360t7|\
-	routerich,ax3000)
+	routerich,ax3000|\
+	routerich,ax3000-ubootmod|\
+	tenbay,wr3000k)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3" wan
 		;;
 	asus,tuf-ax4200|\
 	jdcloud,re-cp-03|\
 	mediatek,mt7981-rfb|\
 	netcore,n60|\
+	nradio,c8-668gl|\
 	ruijie,rg-x60-pro|\
 	unielec,u7981-01*|\
 	zbtlink,zbt-z8102ax|\
 	z8102ax-128m|\
-	z8102ax-64m)
+	z8102ax-64m|\
+	z8102ax-emmc|\
+	zyxel,ex5601-t0-stock|\
+	zyxel,ex5601-t0-ubootmod)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" eth1
 		;;
-	asus,tuf-ax6000)
+	asus,tuf-ax6000|\
+	glinet,gl-mt6000|\
+	tplink,tl-xdr4288|\
+	tplink,tl-xdr6088|\
+	tplink,tl-xtr8488|\
+	z8109ax-512m|\
+	z8109ax-128m)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4 lan5" eth1
 		;;
 	bananapi,bpi-r3)
@@ -51,13 +71,23 @@ mediatek_setup_interfaces()
 	edgecore,eap111)
 		ucidef_set_interfaces_lan_wan eth0 eth1
 		;;
-	bananapi,bpi-r4|\
+	bananapi,bpi-r4)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 sfp-lan" "wan sfp-wan"
+		;;
 	bananapi,bpi-r4-poe)
-		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 eth1" "wan eth2"
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" "wan sfp-wan"
 		;;
 	comfast,cf-e393ax)
 		ucidef_set_interfaces_lan_wan "lan1" eth1
 		;;
+	cudy,ap3000outdoor-v1|\
+	cudy,ap3000-v1|\
+	cudy,re3000-v1|\
+	netgear,wax220|\
+	ubnt,unifi-6-plus|\
+	zyxel,nwa50ax-pro)
+		ucidef_set_interface_lan "eth0"
+		;;
 	cudy,m3000-v1|\
 	cudy,tr3000-v1|\
 	glinet,gl-mt2500|\
@@ -68,14 +98,16 @@ mediatek_setup_interfaces()
 	openwrt,one)
 		ucidef_set_interfaces_lan_wan eth1 eth0
 		;;
-	dlink,aquila-pro-ai-m30-a1)
+	dlink,aquila-pro-ai-m30-a1|\
+	dlink,aquila-pro-ai-m60-a1)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" internet
 		;;
-	glinet,gl-mt6000|\
-	tplink,tl-xdr4288|\
-	tplink,tl-xdr6088|\
-	tplink,tl-xtr8488)
-		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4 lan5" eth1
+	keenetic,kn-3911|\
+	smartrg,sdg-8622|\
+	smartrg,sdg-8632|\
+	smartrg,sdg-8733a|\
+	yuncore,ax835)
+		ucidef_set_interfaces_lan_wan lan wan
 		;;
 	mediatek,mt7986a-rfb)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4 lan6" "eth1 wan"
@@ -86,21 +118,10 @@ mediatek_setup_interfaces()
 	mediatek,mt7988a-rfb)
 		ucidef_set_interfaces_lan_wan "lan0 lan1 lan2 lan3 eth2" eth1
 		;;
-	mercusys,mr90x-v1)
+	mercusys,mr90x-v1|\
+	mercusys,mr90x-v1-ubi)
 		ucidef_set_interfaces_lan_wan "lan0 lan1 lan2" eth1
 		;;
-	cudy,ap3000outdoor-v1|\
-	cudy,re3000-v1|\
-	netgear,wax220|\
-	ubnt,unifi-6-plus|\
-	zyxel,nwa50ax-pro)
-		ucidef_set_interface_lan "eth0"
-		;;
-	smartrg,sdg-8622|\
-	smartrg,sdg-8632|\
-	yuncore,ax835)
-		ucidef_set_interfaces_lan_wan lan wan
-		;;
 	tplink,tl-xdr6086|\
 	wavlink,wl-wn586x3)
 		ucidef_set_interfaces_lan_wan "lan1 lan2" eth1
@@ -116,10 +137,6 @@ mediatek_setup_interfaces()
 	xiaomi,redmi-router-ax6000-ubootmod)
 		ucidef_set_interfaces_lan_wan "lan2 lan3 lan4" wan
 		;;
-	zyxel,ex5601-t0-stock|\
-	zyxel,ex5601-t0-ubootmod)
-		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" eth1
-		;;
 	*)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" wan
 		;;
@@ -134,6 +151,12 @@ mediatek_setup_macs()
 	local label_mac=""
 
 	case $board in
+	acer,predator-w6|\
+	acer,predator-w6d|\
+	acer,vero-w6m)
+		wan_mac=$(mmc_get_mac_ascii u-boot-env WANMAC)
+		lan_mac=$(mmc_get_mac_ascii u-boot-env LANMAC)
+		;;
 	bananapi,bpi-r3|\
 	bananapi,bpi-r3-mini|\
 	bananapi,bpi-r4)
@@ -153,6 +176,11 @@ mediatek_setup_macs()
 		lan_mac=$(mtd_get_mac_ascii u-boot-env mac)
 		label_mac=$lan_mac
 		;;
+	nradio,c8-668gl)
+		lan_mac=$(mmc_get_mac_ascii bdinfo "fac_mac ")
+		wan_mac=$(macaddr_add "$lan_mac" 2)
+		label_mac=$lan_mac
+		;;
 	qihoo,360t7)
 		lan_mac=$(mtd_get_mac_ascii factory lanMac)
 		wan_mac=$(macaddr_add "$lan_mac" 1)
@@ -163,16 +191,6 @@ mediatek_setup_macs()
 		wan_mac=$label_mac
 		lan_mac=$(macaddr_add "$label_mac" 1)
 		;;
-	smartrg,sdg-8612|\
-	smartrg,sdg-8614|\
-	smartrg,sdg-8622|\
-	smartrg,sdg-8632|\
-	smartrg,sdg-8733|\
-	smartrg,sdg-8734)
-		label_mac=$(mmc_get_mac_ascii mfginfo MFG_MAC)
-		wan_mac=$label_mac
-		lan_mac=$(macaddr_add "$label_mac" 1)
-		;;
 	xiaomi,mi-router-ax3000t|\
 	xiaomi,mi-router-ax3000t-ubootmod|\
 	xiaomi,mi-router-wr30u-stock|\
diff --git a/6.6/target/linux/mediatek/filogic/base-files/etc/board.d/03_gpio_switches b/6.6/target/linux/mediatek/filogic/base-files/etc/board.d/03_gpio_switches
index 51f1e4ba..db3a07f7 100644
--- a/6.6/target/linux/mediatek/filogic/base-files/etc/board.d/03_gpio_switches
+++ b/6.6/target/linux/mediatek/filogic/base-files/etc/board.d/03_gpio_switches
@@ -12,6 +12,7 @@ zbtlink,zbt-z8102ax)
 	ucidef_add_gpio_switch "sim1" "SIM 1" "sim1" "0"
 	ucidef_add_gpio_switch "sim2" "SIM 2" "sim2" "0"
 	;;
+z8102ax-emmc|\
 z8102ax-64m|\
 z8102ax-128m)
 	ucidef_add_gpio_switch "modem1" "Power 1st modem" "modem1" "1"
@@ -20,6 +21,17 @@ z8102ax-128m)
 	ucidef_add_gpio_switch "sim1" "SIM 1" "sim1" "0"
 	ucidef_add_gpio_switch "sim2" "SIM 2" "sim2" "0"
 	;;
+z8109ax-512m|\
+z8109ax-128m)
+	ucidef_add_gpio_switch "modem1" "Power 1st modem" "modem1" "1"
+	ucidef_add_gpio_switch "modem2" "Power 2nd modem" "modem2" "1"
+	ucidef_add_gpio_switch "modem3" "Power 3th modem" "modem3" "1"
+	ucidef_add_gpio_switch "modem4" "Power 4th modem" "modem4" "1"
+	ucidef_add_gpio_switch "sim1" "SIM 1" "sim1" "0"
+	ucidef_add_gpio_switch "sim2" "SIM 2" "sim2" "0"
+	ucidef_add_gpio_switch "sim3" "SIM 3" "sim3" "0"
+	ucidef_add_gpio_switch "sim4" "SIM 4" "sim4" "0"
+	;;
 esac
 
 board_config_flush
diff --git a/6.6/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac b/6.6/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
index 512f5370..4b65ea9d 100644
--- a/6.6/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
+++ b/6.6/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
@@ -116,8 +116,11 @@ case "$board" in
 		;;
 	routerich,ax3000|\
 	zbtlink,zbt-z8102ax|\
+	z8102ax-emmc|\
 	z8102ax-128m|\
 	z8102ax-64m|\
+	z8109ax-512m|\
+	z8109ax-128m|\
 	zbtlink,zbt-z8103ax|\
 	zyxel,ex5601-t0|\
 	zyxel,ex5601-t0-ubootmod)
diff --git a/6.6/target/linux/mediatek/image/filogic.mk b/6.6/target/linux/mediatek/image/filogic.mk
index ef2ab429..145221a8 100644
--- a/6.6/target/linux/mediatek/image/filogic.mk
+++ b/6.6/target/linux/mediatek/image/filogic.mk
@@ -83,6 +83,10 @@ define Build/append-gl-metadata
 	}
 endef
 
+define Build/append-openwrt-one-eeprom
+	dd if=$(STAGING_DIR_IMAGE)/mt7981_eeprom_mt7976_dbdc.bin >> $@
+endef
+
 define Build/zyxel-nwa-fit-filogic
 	$(TOPDIR)/scripts/mkits-zyxel-fit-filogic.sh \
 		$@.its $@ "80 e1 ff ff ff ff ff ff ff ff"
@@ -204,23 +208,23 @@ define Device/smartrg_sdg-8733
 $(call Device/adtran_smartrg)
   DEVICE_MODEL := SDG-8733
   DEVICE_DTS := mt7988a-smartrg-SDG-8733
-  DEVICE_PACKAGES += kmod-mt7996-firmware kmod-phy-aquantia kmod-usb3
+  DEVICE_PACKAGES += kmod-mt7996-firmware kmod-phy-aquantia kmod-usb3 mt7988-wo-firmware
 endef
 TARGET_DEVICES += smartrg_sdg-8733
 
-#define Device/smartrg_sdg-8733a
-#$(call Device/adtran_smartrg)
-#  DEVICE_MODEL := SDG-8733A
-#  DEVICE_DTS := mt7988d-smartrg-SDG-8733A
-#  DEVICE_PACKAGES += mt7988-2p5g-phy-firmware kmod-mt7996-firmware kmod-phy-aquantia
-#endef
-#TARGET_DEVICES += smartrg_sdg-8733a
+define Device/smartrg_sdg-8733a
+$(call Device/adtran_smartrg)
+  DEVICE_MODEL := SDG-8733A
+  DEVICE_DTS := mt7988d-smartrg-SDG-8733A
+  DEVICE_PACKAGES += mt7988-2p5g-phy-firmware kmod-mt7996-233-firmware kmod-phy-aquantia mt7988-wo-firmware
+endef
+TARGET_DEVICES += smartrg_sdg-8733a
 
 define Device/smartrg_sdg-8734
 $(call Device/adtran_smartrg)
   DEVICE_MODEL := SDG-8734
   DEVICE_DTS := mt7988a-smartrg-SDG-8734
-  DEVICE_PACKAGES += kmod-mt7996-firmware kmod-phy-aquantia kmod-sfp kmod-usb3
+  DEVICE_PACKAGES += kmod-mt7996-firmware kmod-phy-aquantia kmod-sfp kmod-usb3 mt7988-wo-firmware
 endef
 TARGET_DEVICES += smartrg_sdg-8734
 
@@ -250,6 +254,30 @@ define Device/asus_tuf-ax4200
 endef
 TARGET_DEVICES += asus_tuf-ax4200
 
+define Device/arcadyan_mozart
+  DEVICE_VENDOR := Arcadyan
+  DEVICE_MODEL := Mozart
+  DEVICE_DTS := mt7988a-arcadyan-mozart
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTC_FLAGS := --pad 4096
+  DEVICE_DTS_LOADADDR := 0x45f00000
+  DEVICE_PACKAGES := kmod-hwmon-pwmfan e2fsprogs f2fsck mkf2fs kmod-mt7996-firmware
+  KERNEL_LOADADDR := 0x46000000
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+        fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  KERNEL_INITRAMFS_SUFFIX := .itb
+  IMAGE_SIZE := $$(shell expr 64 + $$(CONFIG_TARGET_ROOTFS_PARTSIZE))m
+  IMAGES := sysupgrade.itb
+  IMAGE/sysupgrade.itb := append-kernel | fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-with-rootfs | pad-rootfs | append-metadata
+  ARTIFACTS := emmc-preloader.bin emmc-bl31-uboot.fip emmc-gpt.bin
+  ARTIFACT/emmc-gpt.bin := mt798x-gpt emmc
+  ARTIFACT/emmc-preloader.bin	:= mt7988-bl2 emmc-comb
+  ARTIFACT/emmc-bl31-uboot.fip	:= mt7988-bl31-uboot arcadyan_mozart
+  SUPPORTED_DEVICES += arcadyan,mozart
+endef
+TARGET_DEVICES += arcadyan_mozart
+
 define Device/asus_tuf-ax6000
   DEVICE_VENDOR := ASUS
   DEVICE_MODEL := TUF-AX6000
@@ -276,7 +304,7 @@ define Device/bananapi_bpi-r3
 		       mt7986a-bananapi-bpi-r3-respeaker-2mics
   DEVICE_DTS_DIR := $(DTS_DIR)/
   DEVICE_DTS_LOADADDR := 0x43f00000
-  DEVICE_PACKAGES := kmod-hwmon-pwmfan kmod-i2c-gpio kmod-mt7915e kmod-mt7986-firmware kmod-sfp kmod-usb3 \
+  DEVICE_PACKAGES := kmod-hwmon-pwmfan kmod-thermal kmod-i2c-gpio kmod-mt7915e kmod-mt7986-firmware kmod-sfp kmod-usb3 \
 		     e2fsprogs f2fsck mkf2fs mt7986-wo-firmware
   IMAGES := sysupgrade.itb
   KERNEL_LOADADDR := 0x44000000
@@ -306,12 +334,12 @@ define Device/bananapi_bpi-r3
 				   pad-to 52M | mt7986-bl31-uboot bananapi_bpi-r3-emmc |\
 				   pad-to 56M | mt798x-gpt emmc |\
 				$(if $(CONFIG_TARGET_ROOTFS_SQUASHFS),\
-				   pad-to 64M | append-image squashfs-sysupgrade.itb | check-size |\
+				   pad-to 64M | append-image squashfs-sysupgrade.itb |\
 				) \
 				  gzip
-ifeq ($(DUMP),)
-  IMAGE_SIZE := $$(shell expr 64 + $$(CONFIG_TARGET_ROOTFS_PARTSIZE))m
-endif
+#ifeq ($(DUMP),)
+#  IMAGE_SIZE := $$(shell expr 64 + $$(CONFIG_TARGET_ROOTFS_PARTSIZE))m
+#endif
   KERNEL			:= kernel-bin | gzip
   KERNEL_INITRAMFS := kernel-bin | lzma | \
 	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
@@ -329,7 +357,7 @@ define Device/bananapi_bpi-r3-mini
   DEVICE_DTS_CONFIG := config-mt7986a-bananapi-bpi-r3-mini
   DEVICE_DTS_DIR := ../dts
   DEVICE_DTS_LOADADDR := 0x43f00000
-  DEVICE_PACKAGES := kmod-hwmon-pwmfan kmod-mt7915e kmod-mt7986-firmware kmod-phy-airoha-en8811h \
+  DEVICE_PACKAGES := kmod-hwmon-pwmfan kmod-thermal kmod-mt7915e kmod-mt7986-firmware kmod-phy-airoha-en8811h \
 		     kmod-usb3 e2fsprogs f2fsck mkf2fs mt7986-wo-firmware
   KERNEL_LOADADDR := 0x44000000
   KERNEL := kernel-bin | gzip
@@ -341,9 +369,9 @@ define Device/bananapi_bpi-r3-mini
   KERNEL_IN_UBI := 1
   UBOOTENV_IN_UBI := 1
   IMAGES := snand-factory.bin sysupgrade.itb
-ifeq ($(DUMP),)
-  IMAGE_SIZE := $$(shell expr 64 + $$(CONFIG_TARGET_ROOTFS_PARTSIZE))m
-endif
+#ifeq ($(DUMP),)
+#  IMAGE_SIZE := $$(shell expr 64 + $$(CONFIG_TARGET_ROOTFS_PARTSIZE))m
+#endif
   IMAGE/sysupgrade.itb := append-kernel | \
     fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | \
     pad-rootfs | append-metadata
@@ -373,8 +401,8 @@ define Device/bananapi_bpi-r4-common
   DEVICE_DTS_LOADADDR := 0x45f00000
   DEVICE_DTS_OVERLAY:= mt7988a-bananapi-bpi-r4-emmc mt7988a-bananapi-bpi-r4-rtc mt7988a-bananapi-bpi-r4-sd mt7988a-bananapi-bpi-r4-wifi-mt7996a
   DEVICE_DTC_FLAGS := --pad 4096
-  DEVICE_PACKAGES := kmod-hwmon-pwmfan kmod-i2c-mux-pca954x kmod-eeprom-at24 kmod-mt7996-firmware \
-		     kmod-rtc-pcf8563 kmod-sfp kmod-usb3 e2fsprogs f2fsck mkf2fs
+  DEVICE_PACKAGES := kmod-hwmon-pwmfan kmod-thermal kmod-i2c-mux-pca954x kmod-eeprom-at24 kmod-mt7996-firmware kmod-mt7996-233-firmware \
+		     kmod-rtc-pcf8563 kmod-sfp kmod-usb3 e2fsprogs f2fsck mkf2fs mt7988-wo-firmware
   IMAGES := sysupgrade.itb
   KERNEL_LOADADDR := 0x46000000
   KERNEL_INITRAMFS_SUFFIX := -recovery.itb
@@ -398,10 +426,10 @@ define Device/bananapi_bpi-r4-common
 				   pad-to 52M | mt7988-bl31-uboot $$(DEVICE_NAME)-emmc |\
 				   pad-to 56M | mt798x-gpt emmc |\
 				$(if $(CONFIG_TARGET_ROOTFS_SQUASHFS),\
-				   pad-to 64M | append-image squashfs-sysupgrade.itb | check-size |\
+				   pad-to 64M | append-image squashfs-sysupgrade.itb |\
 				) \
 				  gzip
-  IMAGE_SIZE := $$(shell expr 64 + $$(CONFIG_TARGET_ROOTFS_PARTSIZE))m
+#  IMAGE_SIZE := $$(shell expr 64 + $$(CONFIG_TARGET_ROOTFS_PARTSIZE))m
   KERNEL			:= kernel-bin | gzip
   KERNEL_INITRAMFS := kernel-bin | lzma | \
 	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
@@ -1047,10 +1075,6 @@ define Device/openembed_som7981
 endef
 TARGET_DEVICES += openembed_som7981
 
-define Build/append-openwrt-one-eeprom
-        dd if=$(STAGING_DIR_IMAGE)/mt7981_eeprom_mt7976_dbdc.bin >> $@
-endef
-
 define Device/openwrt_one
   DEVICE_VENDOR := OpenWrt
   DEVICE_MODEL := One
@@ -1090,7 +1114,9 @@ define Device/openwrt_one
   UBINIZE_OPTS := -E 5
   BLOCKSIZE := 128k
   PAGESIZE := 2048
-  UBINIZE_PARTS := fip=:$(STAGING_DIR_IMAGE)/mt7981_openwrt_one-snand-u-boot.fip recovery=:$(KDIR)/tmp/openwrt-mediatek-filogic-openwrt_one-initramfs.itb \
+  UBINIZE_PARTS := fip=:$(STAGING_DIR_IMAGE)/mt7981_openwrt_one-snand-u-boot.fip \
+		   $(if $(IB),recovery=:$(STAGING_DIR_IMAGE)/mediatek-filogic-openwrt_one-initramfs.itb,\
+			      recovery=:$(KDIR)/tmp/$$(KERNEL_INITRAMFS_IMAGE)) \
 		   $(if $(wildcard $(TOPDIR)/openwrt-mediatek-filogic-openwrt_one-calibration.itb), calibration=:$(TOPDIR)/openwrt-mediatek-filogic-openwrt_one-calibration.itb)
 endef
 TARGET_DEVICES += openwrt_one
@@ -1404,7 +1430,6 @@ define Device/yuncore_ax835
 endef
 TARGET_DEVICES += yuncore_ax835
 
-
 define Device/zbtlink_zbt-z8102ax
   DEVICE_VENDOR := Zbtlink
   DEVICE_MODEL := ZBT-Z8102AX
@@ -1523,6 +1548,25 @@ define Device/zyxel_nwa50ax-pro
 endef
 TARGET_DEVICES += zyxel_nwa50ax-pro
 
+define Device/z8102ax-emmc
+  DEVICE_VENDOR := ZBT
+  DEVICE_MODEL := Z8102AX
+  DEVICE_DTS := mt7981b-zbt-z8102ax-eMMC
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+  KERNEL_IN_UBI := 1
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+  ARTIFACTS := initramfs-factory.ubi
+  ARTIFACT/initramfs-factory.ubi := append-image-stage initramfs-kernel.bin | ubinize-kernel
+endif
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += z8102ax-emmc
+
+
 define Device/z8102ax
   DEVICE_VENDOR := ZBT
   DEVICE_MODEL := Z8102AX
@@ -1554,4 +1598,37 @@ define Device/z8102ax-128m
   DEVICE_DTS := mt7981b-zbt-z8102ax-128m
   IMAGE_SIZE := 131072k
 endef
-TARGET_DEVICES += z8102ax-128m
\ No newline at end of file
+TARGET_DEVICES += z8102ax-128m
+
+define Device/z8109ax
+  DEVICE_VENDOR := ZBT
+  DEVICE_MODEL := Z8109AX
+#  DEVICE_DTS := mt7981b-zbt-z8102ax
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+  KERNEL_IN_UBI := 1
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+  ARTIFACTS := initramfs-factory.ubi
+  ARTIFACT/initramfs-factory.ubi := append-image-stage initramfs-kernel.bin | ubinize-kernel
+endif
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+
+define Device/z8109ax-512m
+  $(call Device/z8109ax)
+  DEVICE_VARIANT := 512 NAND
+  DEVICE_DTS := mt7981b-zbt-z8109ax-512m
+  IMAGE_SIZE := 524288k
+endef
+TARGET_DEVICES += z8109ax-512m
+
+define Device/z8109ax-128m
+  $(call Device/z8109ax)
+  DEVICE_VARIANT := 128 NAND
+  DEVICE_DTS := mt7981b-zbt-z8109ax-128m
+  IMAGE_SIZE := 131072k
+endef
+TARGET_DEVICES += z8109ax-128m
diff --git a/build.sh b/build.sh
index 0f31aa89..79fb58cb 100755
--- a/build.sh
+++ b/build.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 #
 # Copyright (C) 2017 OVH OverTheBox
-# Copyright (C) 2017-2023 Ycarus (Yannick Chabanois) <ycarus@zugaina.org> for OpenMPTCProuter project
+# Copyright (C) 2017-2024 Ycarus (Yannick Chabanois) <ycarus@zugaina.org> for OpenMPTCProuter project
 #
 # This is free software, licensed under the GNU General Public License v3.
 # See /LICENSE for more information.
@@ -23,7 +23,7 @@ _get_repo() (
 	fi
 	git fetch origin -f
 	git fetch origin --tags -f
-	git checkout -f "origin/$3" -B "build" 2>/dev/null || git checkout "$3" -B "build"
+	git checkout -f "origin/$3" -B "build" 2>/dev/null || git checkout -f "$3" -B "build"
 )
 
 OMR_DIST=${OMR_DIST:-openmptcprouter}
@@ -31,13 +31,16 @@ OMR_HOST=${OMR_HOST:-$(curl -sS ifconfig.co)}
 OMR_PORT=${OMR_PORT:-80}
 OMR_KEEPBIN=${OMR_KEEPBIN:-no}
 OMR_IMG=${OMR_IMG:-yes}
+OMR_LOG=${OMR_LOG:-no}
 #OMR_UEFI=${OMR_UEFI:-yes}
 OMR_PACKAGES=${OMR_PACKAGES:-full}
 OMR_ALL_PACKAGES=${OMR_ALL_PACKAGES:-no}
 OMR_TARGET=${OMR_TARGET:-x86_64}
 OMR_TARGET_CONFIG="config-$OMR_TARGET"
 UPSTREAM=${UPSTREAM:-no}
-SYSLOG=${SYSLOG:-busybox-syslogd}
+#SYSLOG=${SYSLOG:-busybox-syslogd}
+#SYSLOG=${SYSLOG:-syslog-ng}
+SYSLOG=${SYSLOG:-logd}
 OMR_KERNEL=${OMR_KERNEL:-5.4}
 SHORTCUT_FE=${SHORTCUT_FE:-no}
 DISABLE_FAILSAFE=${DISABLE_FAILSAFE:-no}
@@ -53,7 +56,7 @@ CUSTOM_FEED_URL="${CUSTOM_FEED_URL}"
 CUSTOM_FEED_URL_BRANCH="${CUSTOM_FEED_URL_BRANCH:-main}"
 
 OMR_OPENWRT=${OMR_OPENWRT:-default}
-
+OMR_OPENWRT_GIT=${OMR_OPENWRT_GIT:-https://github.com}
 OMR_FORCE_DSA=${OMR_FORCE_DSA:-0}
 
 
@@ -66,39 +69,19 @@ if [ ! -f "$OMR_TARGET_CONFIG" ]; then
 	#exit 1
 fi
 
-if [ "$OMR_TARGET" = "rpi3" ]; then
-	OMR_REAL_TARGET="aarch64_cortex-a53"
-elif [ "$OMR_TARGET" = "rpi4" ]; then
+if [ "$OMR_TARGET" = "rpi4" ]; then
 	OMR_REAL_TARGET="aarch64_cortex-a72"
-elif [ "$OMR_TARGET" = "rpi2" ]; then
-	OMR_REAL_TARGET="arm_cortex-a7_neon-vfpv4"
-elif [ "$OMR_TARGET" = "wrt3200acm" ]; then
+elif [ "$OMR_TARGET" = "wrt3200acm" ] || [ "$OMR_TARGET" = "wrt32x" ]; then
 	OMR_REAL_TARGET="arm_cortex-a9_vfpv3-d16"
-elif [ "$OMR_TARGET" = "wrt32x" ]; then
-	OMR_REAL_TARGET="arm_cortex-a9_vfpv3-d16"
-elif [ "$OMR_TARGET" = "bpi-r1" ]; then
+elif [ "$OMR_TARGET" = "rpi2" ] || [ "$OMR_TARGET" = "bpi-r1" ] || [ "$OMR_TARGET" = "bpi-r2" ] || [ "$OMR_TARGET" = "rutx" ] || [ "$OMR_TARGET" = "rutx12" ] || [ "$OMR_TARGET" = "rutx50" ] || [ "$OMR_TARGET" = "p2w_r619ac" ]; then
 	OMR_REAL_TARGET="arm_cortex-a7_neon-vfpv4"
-elif [ "$OMR_TARGET" = "bpi-r2" ]; then
-	OMR_REAL_TARGET="arm_cortex-a7_neon-vfpv4"
-elif [ "$OMR_TARGET" = "rutx" ]; then
-	OMR_REAL_TARGET="arm_cortex-a7_neon-vfpv4"
-elif [ "$OMR_TARGET" = "rutx12" ]; then
-	OMR_REAL_TARGET="arm_cortex-a7_neon-vfpv4"
-elif [ "$OMR_TARGET" = "rutx50" ]; then
-	OMR_REAL_TARGET="arm_cortex-a7_neon-vfpv4"
-elif [ "$OMR_TARGET" = "bpi-r64" ]; then
-	OMR_REAL_TARGET="aarch64_cortex-a53"
-elif [ "$OMR_TARGET" = "espressobin" ]; then
-	OMR_REAL_TARGET="aarch64_cortex-a53"
-elif [ "$OMR_TARGET" = "z8102ax_128m" ] || [ "$OMR_TARGET" = "z8102ax_648m" ]; then
+elif [ "$OMR_TARGET" = "rpi3" ] || [ "$OMR_TARGET" = "bpi-r3" ] || [ "$OMR_TARGET" = "bpi-r3-mini" ] || [ "$OMR_TARGET" = "bpi-r4" ] || [ "$OMR_TARGET" = "bpi-r4-poe" ] || [ "$OMR_TARGET" = "bpi-r64" ] || [ "$OMR_TARGET" = "espressobin" ] || [ "$OMR_TARGET" = "z8102ax_128m" ] || [ "$OMR_TARGET" = "z8102ax_64m" ] || [ "$OMR_TARGET" = "z8109ax_128m" ] || [ "$OMR_TARGET" = "bpi-r4" ] || [ "$OMR_TARGET" = "bpi-r4-poe" ] || [ "$OMR_TARGET" = "bpi-r3" ] || [ "$OMR_TARGET" = "bpi-r3-mini" ] || [ "$OMR_TARGET" = "espressobin" ] || [ "$OMR_TARGET" = "gl-mt2500" ] || [ "$OMR_TARGET" = "gl-mt6000" ]; then
 	OMR_REAL_TARGET="aarch64_cortex-a53"
 elif [ "$OMR_TARGET" = "x86" ]; then
 	OMR_REAL_TARGET="i386_pentium4"
-elif [ "$OMR_TARGET" = "r2s" ]; then
-	OMR_REAL_TARGET="aarch64_generic"
-elif [ "$OMR_TARGET" = "r4s" ]; then
-	OMR_REAL_TARGET="aarch64_generic"
-elif [ "$OMR_TARGET" = "r5s" ]; then
+elif [ "$OMR_TARGET" = "x86_64" ]; then
+	OMR_REAL_TARGET="x86_64"
+elif [ "$OMR_TARGET" = "r2s" ] || [ "$OMR_TARGET" = "r4s" ] || [ "$OMR_TARGET" = "r5s" ] || [ "$OMR_TARGET" = "armsr64" ]; then
 	OMR_REAL_TARGET="aarch64_generic"
 elif [ "$OMR_TARGET" = "ubnt-erx" ]; then
 	OMR_REAL_TARGET="mipsel_24kc"
@@ -106,48 +89,59 @@ else
 	OMR_REAL_TARGET=${OMR_TARGET}
 fi
 
-#_get_repo source https://github.com/ysurac/openmptcprouter-source "master"
-if [ "$OMR_OPENWRT" = "default" ]; then
-	if [ "$OMR_KERNEL" = "5.4" ]; then
-		# Use OpenWrt 21.02 for 5.4 kernel
-		_get_repo "$OMR_TARGET/${OMR_KERNEL}/source" https://github.com/openwrt/openwrt "170d9e447df0f52882a8b7a61bf940b062b2cacc"
-		_get_repo feeds/${OMR_KERNEL}/packages https://github.com/openwrt/packages "b3a6bb839059546a52df00af3e1aa97dba75de22"
-		_get_repo feeds/${OMR_KERNEL}/luci https://github.com/openwrt/luci "e4c46338b196e486a88b1a75b78e283708c82bc4"
-	elif [ "$OMR_KERNEL" = "6.1" ]; then
-		_get_repo "$OMR_TARGET/${OMR_KERNEL}/source" https://github.com/openwrt/openwrt "acf40c022e3d8949c7bb1f9c5212eb91512ae8a9"
-		_get_repo feeds/${OMR_KERNEL}/packages https://github.com/openwrt/packages "3ee7b46610e9dbd8fd2bba87bd06024cd0d9c08f"
-		_get_repo feeds/${OMR_KERNEL}/luci https://github.com/openwrt/luci "ddda66aa8caa5e929cf7a542a79e2c3ce69eb66c"
-	elif [ "$OMR_KERNEL" = "6.6" ] || [ "$OMR_KERNEL" = "6.10" ] || [ "$OMR_KERNEL" = "6.11" ]; then
-		_get_repo "$OMR_TARGET/${OMR_KERNEL}/source" https://github.com/openwrt/openwrt "c7ba5574f52f25334add66c15190b578ac873739"
-		_get_repo feeds/${OMR_KERNEL}/packages https://github.com/openwrt/packages "1002ba7654b13af4255b0922a941eb6c9e8f4ba3"
-		_get_repo feeds/${OMR_KERNEL}/luci https://github.com/openwrt/luci "80ac1e43650df3c1faf74c622d82d9a7b7a958aa"
+if [ "$ONLY_PREPARE" != "yes" ]; then
+	#_get_repo source https://github.com/ysurac/openmptcprouter-source "master"
+	if [ "$OMR_OPENWRT" = "default" ]; then
+		if [ "$OMR_KERNEL" = "5.4" ]; then
+			# Use OpenWrt 21.02 for 5.4 kernel
+			_get_repo "$OMR_TARGET/${OMR_KERNEL}/source" ${OMR_OPENWRT_GIT}/openwrt/openwrt "170d9e447df0f52882a8b7a61bf940b062b2cacc"
+			_get_repo feeds/${OMR_KERNEL}/packages ${OMR_OPENWRT_GIT}/openwrt/packages "b3a6bb839059546a52df00af3e1aa97dba75de22"
+			_get_repo feeds/${OMR_KERNEL}/luci ${OMR_OPENWRT_GIT}/openwrt/luci "e4c46338b196e486a88b1a75b78e283708c82bc4"
+		elif [ "$OMR_KERNEL" = "6.1" ]; then
+			_get_repo "$OMR_TARGET/${OMR_KERNEL}/source" ${OMR_OPENWRT_GIT}/openwrt/openwrt "acf40c022e3d8949c7bb1f9c5212eb91512ae8a9"
+			_get_repo feeds/${OMR_KERNEL}/packages ${OMR_OPENWRT_GIT}/openwrt/packages "3ee7b46610e9dbd8fd2bba87bd06024cd0d9c08f"
+			_get_repo feeds/${OMR_KERNEL}/luci ${OMR_OPENWRT_GIT}/openwrt/luci "ddda66aa8caa5e929cf7a542a79e2c3ce69eb66c"
+		elif [ "$OMR_KERNEL" = "6.6" ] || [ "$OMR_KERNEL" = "6.10" ] || [ "$OMR_KERNEL" = "6.11" ]; then
+			# Use OpenWRT 24.10 for 6.6 kernel
+			_get_repo "$OMR_TARGET/${OMR_KERNEL}/source" ${OMR_OPENWRT_GIT}/openwrt/openwrt "92e020b50f04535009c91aa708bdb7598f1d9d4a"
+			_get_repo feeds/${OMR_KERNEL}/packages ${OMR_OPENWRT_GIT}/openwrt/packages "de69db6abd833d9826668ab21ec488439ce9523a"
+			_get_repo feeds/${OMR_KERNEL}/luci ${OMR_OPENWRT_GIT}/openwrt/luci "4f7a183b26c2784c5f64937deec9cafa91d0295a"
+			_get_repo feeds/${OMR_KERNEL}/routing ${OMR_OPENWRT_GIT}/openwrt/routing "e87b55c6a642947ad7e24cd5054a637df63d5dbe"
+		elif [ "$OMR_KERNEL" = "6.12" ]; then
+			_get_repo "$OMR_TARGET/${OMR_KERNEL}/source" ${OMR_OPENWRT_GIT}/openwrt/openwrt "f480fa60d3dd23ba753aaba3616799fc8fd1af46"
+			_get_repo feeds/${OMR_KERNEL}/packages ${OMR_OPENWRT_GIT}/openwrt/packages "7c58cd667bb37fd6aec9b4fd625bd6962ec1ed0f"
+			_get_repo feeds/${OMR_KERNEL}/luci ${OMR_OPENWRT_GIT}/openwrt/luci "b3d292bf3d9e8761b307f5496ef7ea5f05433bdd"
+			_get_repo feeds/${OMR_KERNEL}/routing ${OMR_OPENWRT_GIT}/openwrt/routing "4a65e359c301d30b70e448e8c25c6edc9c909be5"
+		fi
+	elif [ "$OMR_OPENWRT" = "coolsnowwolfmix" ]; then
+		_get_repo "$OMR_TARGET/${OMR_KERNEL}/source" ${OMR_OPENWRT_GIT}/coolsnowwolf/lede.git "master"
+		_get_repo feeds/${OMR_KERNEL}/packages ${OMR_OPENWRT_GIT}/openwrt/packages "master"
+		_get_repo feeds/${OMR_KERNEL}/luci ${OMR_OPENWRT_GIT}/openwrt/luci "master"
+	elif [ "$OMR_OPENWRT" = "coolsnowwolf" ]; then
+		_get_repo "$OMR_TARGET/${OMR_KERNEL}/source" ${OMR_OPENWRT_GIT}/coolsnowwolf/lede.git "master"
+		_get_repo feeds/${OMR_KERNEL}/packages ${OMR_OPENWRT_GIT}/coolsnowwolf/packages "master"
+		_get_repo feeds/${OMR_KERNEL}/luci ${OMR_OPENWRT_GIT}/coolsnowwolf/luci "master"
+	elif [ "$OMR_OPENWRT" = "master" ]; then
+		_get_repo "$OMR_TARGET/${OMR_KERNEL}/source" ${OMR_OPENWRT_GIT}/openwrt/openwrt "main"
+		_get_repo feeds/${OMR_KERNEL}/packages ${OMR_OPENWRT_GIT}/openwrt/packages "main"
+		_get_repo feeds/${OMR_KERNEL}/luci ${OMR_OPENWRT_GIT}/openwrt/luci "main"
+		_get_repo feeds/${OMR_KERNEL}/luci ${OMR_OPENWRT_GIT}/openwrt/routing "main"
+	else
+		_get_repo "$OMR_TARGET/${OMR_KERNEL}/source" ${OMR_OPENWRT_GIT}/openwrt/openwrt "${OMR_OPENWRT}"
+		_get_repo feeds/${OMR_KERNEL}/packages ${OMR_OPENWRT_GIT}/openwrt/packages "${OMR_OPENWRT}"
+		_get_repo feeds/${OMR_KERNEL}/luci ${OMR_OPENWRT_GIT}/openwrt/luci "${OMR_OPENWRT}"
+		_get_repo feeds/${OMR_KERNEL}/luci ${OMR_OPENWRT_GIT}/openwrt/routing "${OMR_OPENWRT}"
 	fi
-elif [ "$OMR_OPENWRT" = "coolsnowwolfmix" ]; then
-	_get_repo "$OMR_TARGET/${OMR_KERNEL}/source" https://github.com/coolsnowwolf/lede.git "master"
-	_get_repo feeds/${OMR_KERNEL}/packages https://github.com/openwrt/packages "master"
-	_get_repo feeds/${OMR_KERNEL}/luci https://github.com/openwrt/luci "master"
-elif [ "$OMR_OPENWRT" = "coolsnowwolf" ]; then
-	_get_repo "$OMR_TARGET/${OMR_KERNEL}/source" https://github.com/coolsnowwolf/lede.git "master"
-	_get_repo feeds/${OMR_KERNEL}/packages https://github.com/coolsnowwolf/packages "master"
-	_get_repo feeds/${OMR_KERNEL}/luci https://github.com/coolsnowwolf/luci "master"
-elif [ "$OMR_OPENWRT" = "master" ]; then
-	_get_repo "$OMR_TARGET/${OMR_KERNEL}/source" https://github.com/openwrt/openwrt "main"
-	_get_repo feeds/${OMR_KERNEL}/packages https://github.com/openwrt/packages "main"
-	_get_repo feeds/${OMR_KERNEL}/luci https://github.com/openwrt/luci "main"
-else
-	_get_repo "$OMR_TARGET/${OMR_KERNEL}/source" https://github.com/openwrt/openwrt "${OMR_OPENWRT}"
-	_get_repo feeds/${OMR_KERNEL}/packages https://github.com/openwrt/packages "${OMR_OPENWRT}"
-	_get_repo feeds/${OMR_KERNEL}/luci https://github.com/openwrt/luci "${OMR_OPENWRT}"
 fi
 
 if [ -z "$OMR_FEED" ]; then
 	OMR_FEED=feeds/openmptcprouter
-	_get_repo "$OMR_FEED" "$OMR_FEED_URL" "$OMR_FEED_SRC"
+	[ "$ONLY_PREPARE" != "yes" ] && _get_repo "$OMR_FEED" "$OMR_FEED_URL" "$OMR_FEED_SRC"
 fi
 
 if [ -n "$CUSTOM_FEED_URL" ] && [ -z "$CUSTOM_FEED" ]; then
 	CUSTOM_FEED=feeds/${OMR_KERNEL}/${OMR_DIST}
-	_get_repo "$CUSTOM_FEED" "$CUSTOM_FEED_URL" "$CUSTOM_FEED_URL_BRANCH"
+	[ "$ONLY_PREPARE" != "yes" ] && _get_repo "$CUSTOM_FEED" "$CUSTOM_FEED_URL" "$CUSTOM_FEED_URL_BRANCH"
 fi
 
 if [ -n "$1" ] && [ -f "$OMR_FEED/$1/Makefile" ]; then
@@ -158,6 +152,9 @@ fi
 if [ "$OMR_KEEPBIN" = "no" ]; then 
 	rm -rf "$OMR_TARGET/${OMR_KERNEL}/source/bin"
 fi
+if [ "$ONLY_GET_REPO" = "yes" ]; then
+	exit 0
+fi
 rm -rf "$OMR_TARGET/${OMR_KERNEL}/source/files" "$OMR_TARGET/${OMR_KERNEL}/source/tmp"
 #rm -rf "$OMR_TARGET/${OMR_KERNEL}/source/target/linux/mediatek/patches-4.14"
 #rm -rf "$OMR_TARGET/${OMR_KERNEL}/source/target/linux/mediatek/patches-5.4"
@@ -169,19 +166,22 @@ if [ "${OMR_KERNEL}" = "5.4" ]; then
 fi
 echo "rm -rf $OMR_TARGET/${OMR_KERNEL}/source/package/boot/uboot-mvebu"
 rm -rf "${OMR_TARGET}/${OMR_KERNEL}/source/package/boot/uboot-mvebu"
-[ "${OMR_KERNEL}" = "6.1" ] || [ "${OMR_KERNEL}" = "6.6" ] || [ "${OMR_KERNEL}" = "6.10" ] || [ "${OMR_KERNEL}" = "6.11" ] && {
+[ "${OMR_KERNEL}" = "6.1" ] || [ "${OMR_KERNEL}" = "6.6" ] || [ "${OMR_KERNEL}" = "6.10" ] || [ "${OMR_KERNEL}" = "6.11" ] || [ "${OMR_KERNEL}" = "6.12" ] && {
 	echo "rm -rf $OMR_TARGET/${OMR_KERNEL}/source/package/boot/uboot-ipq40xx"
 	rm -rf "${OMR_TARGET}/${OMR_KERNEL}/source/package/boot/uboot-ipq40xx"
 }
 [ "${OMR_KERNEL}" = "6.1" ] && {
 	rm -rf "${OMR_TARGET}/${OMR_KERNEL}/source/target/linux/bcm27xx/patches-6.1"
 }
-[ "${OMR_KERNEL}" = "6.6" ] && {
-	rm -rf "${OMR_TARGET}/${OMR_KERNEL}/source/package/libs/mbedtls"
-}
+#[ "${OMR_KERNEL}" = "6.6" ] && {
+#	rm -rf "${OMR_TARGET}/${OMR_KERNEL}/source/package/libs/mbedtls"
+#}
+#[ "${OMR_KERNEL}" = "6.12" ] && {
+#	rm -rf "${OMR_TARGET}/${OMR_KERNEL}/source/package/libs/mbedtls"
+#}
 
 # Remove current dwarves directory to replace with fixed package
-rm -rf "${OMR_TARGET}/${OMR_KERNEL}/source/tools/dwarves"
+#rm -rf "${OMR_TARGET}/${OMR_KERNEL}/source/tools/dwarves"
 
 
 [ "${OMR_KERNEL}" = "5.4" ] && rm -rf "$OMR_TARGET/${OMR_KERNEL}/source/tools/firmware-utils"
@@ -227,38 +227,68 @@ if [ -n "$CUSTOM_FEED" ]; then
 	echo "src-link ${OMR_DIST} $(readlink -f ${CUSTOM_FEED})" >> "$OMR_TARGET/${OMR_KERNEL}/source/feeds.conf"
 fi
 
-if [ "$OMR_DIST" = "openmptcprouter" ]; then
-	cat > "$OMR_TARGET/${OMR_KERNEL}/source/package/system/opkg/files/customfeeds.conf" <<-EOF
-	src/gz openwrt_luci http://packages.openmptcprouter.com/${OMR_RELEASE}/${OMR_REAL_TARGET}/luci
-	src/gz openwrt_packages http://packages.openmptcprouter.com/${OMR_RELEASE}/${OMR_REAL_TARGET}/packages
-	src/gz openwrt_base http://packages.openmptcprouter.com/${OMR_RELEASE}/${OMR_REAL_TARGET}/base
-	src/gz openwrt_routing http://packages.openmptcprouter.com/${OMR_RELEASE}/${OMR_REAL_TARGET}/routing
-	src/gz openwrt_telephony http://packages.openmptcprouter.com/${OMR_RELEASE}/${OMR_REAL_TARGET}/telephony
-	EOF
-elif [ -n "$OMR_PACKAGES_URL" ]; then
-	cat > "$OMR_TARGET/${OMR_KERNEL}/source/package/system/opkg/files/customfeeds.conf" <<-EOF
-	src/gz openwrt_luci ${OMR_PACKAGES_URL}/${OMR_RELEASE}/${OMR_REAL_TARGET}/luci
-	src/gz openwrt_packages ${OMR_PACKAGES_URL}/${OMR_RELEASE}/${OMR_REAL_TARGET}/packages
-	src/gz openwrt_base ${OMR_PACKAGES_URL}/${OMR_RELEASE}/${OMR_REAL_TARGET}/base
-	src/gz openwrt_routing ${OMR_PACKAGES_URL}/${OMR_RELEASE}/${OMR_REAL_TARGET}/routing
-	src/gz openwrt_telephony ${OMR_PACKAGES_URL}/${OMR_RELEASE}/${OMR_REAL_TARGET}/telephony
-	EOF
+if [ "$OMR_KERNEL" != "6.12" ]; then
+	if [ "$OMR_DIST" = "openmptcprouter" ]; then
+		cat > "$OMR_TARGET/${OMR_KERNEL}/source/package/system/opkg/files/customfeeds.conf" <<-EOF
+		src/gz openwrt_luci http://packages.openmptcprouter.com/${OMR_RELEASE}/${OMR_REAL_TARGET}/luci
+		src/gz openwrt_packages http://packages.openmptcprouter.com/${OMR_RELEASE}/${OMR_REAL_TARGET}/packages
+		src/gz openwrt_base http://packages.openmptcprouter.com/${OMR_RELEASE}/${OMR_REAL_TARGET}/base
+		src/gz openwrt_routing http://packages.openmptcprouter.com/${OMR_RELEASE}/${OMR_REAL_TARGET}/routing
+		src/gz openwrt_telephony http://packages.openmptcprouter.com/${OMR_RELEASE}/${OMR_REAL_TARGET}/telephony
+		EOF
+	elif [ -n "$OMR_PACKAGES_URL" ]; then
+		cat > "$OMR_TARGET/${OMR_KERNEL}/source/package/system/opkg/files/customfeeds.conf" <<-EOF
+		src/gz openwrt_luci ${OMR_PACKAGES_URL}/${OMR_RELEASE}/${OMR_REAL_TARGET}/luci
+		src/gz openwrt_packages ${OMR_PACKAGES_URL}/${OMR_RELEASE}/${OMR_REAL_TARGET}/packages
+		src/gz openwrt_base ${OMR_PACKAGES_URL}/${OMR_RELEASE}/${OMR_REAL_TARGET}/base
+		src/gz openwrt_routing ${OMR_PACKAGES_URL}/${OMR_RELEASE}/${OMR_REAL_TARGET}/routing
+		src/gz openwrt_telephony ${OMR_PACKAGES_URL}/${OMR_RELEASE}/${OMR_REAL_TARGET}/telephony
+		EOF
+	else
+	#	cat > "$OMR_TARGET/${OMR_KERNEL}/source/package/system/opkg/files/customfeeds.conf" <<-EOF
+	#	src/gz openwrt_luci http://downloads.openwrt.org/snapshots/packages/${OMR_REAL_TARGET}/luci
+	#	src/gz openwrt_packages http://downloads.openwrt.org/snapshots/packages/${OMR_REAL_TARGET}/packages
+	#	src/gz openwrt_base http://downloads.openwrt.org/snapshots/packages/${OMR_REAL_TARGET}/base
+	#	src/gz openwrt_routing http://downloads.openwrt.org/snapshots/packages/${OMR_REAL_TARGET}/routing
+	#	src/gz openwrt_telephony http://downloads.openwrt.org/snapshots/packages/${OMR_REAL_TARGET}/telephony
+	#	EOF
+		# Force use of opkg ipk packages
+		cat > "$OMR_TARGET/${OMR_KERNEL}/source/package/system/opkg/files/customfeeds.conf" <<-EOF
+		src/gz openwrt_luci http://downloads.openwrt.org/releases/packages-24.10/${OMR_REAL_TARGET}/luci
+		src/gz openwrt_packages http://downloads.openwrt.org/releases/packages-24.10/${OMR_REAL_TARGET}/packages
+		src/gz openwrt_base http://downloads.openwrt.org/releases/packages-24.10/${OMR_REAL_TARGET}/base
+		src/gz openwrt_routing http://downloads.openwrt.org/releases/packages-24.10/${OMR_REAL_TARGET}/routing
+		src/gz openwrt_telephony http://downloads.openwrt.org/releases/packages-24.10/${OMR_REAL_TARGET}/telephony
+		EOF
+	fi
 else
-	cat > "$OMR_TARGET/${OMR_KERNEL}/source/package/system/opkg/files/customfeeds.conf" <<-EOF
-	src/gz openwrt_luci http://downloads.openwrt.org/snapshots/packages/${OMR_REAL_TARGET}/luci
-	src/gz openwrt_packages http://downloads.openwrt.org/snapshots/packages/${OMR_REAL_TARGET}/packages
-	src/gz openwrt_base http://downloads.openwrt.org/snapshots/packages/${OMR_REAL_TARGET}/base
-	src/gz openwrt_routing http://downloads.openwrt.org/snapshots/packages/${OMR_REAL_TARGET}/routing
-	src/gz openwrt_telephony http://downloads.openwrt.org/snapshots/packages/${OMR_REAL_TARGET}/telephony
-	EOF
+	if [ "$OMR_DIST" = "openmptcprouter" ]; then
+		cat > "$OMR_TARGET/${OMR_KERNEL}/source/package/system/apk/files/customfeeds.list" <<-EOF
+		http://packages.openmptcprouter.com/${OMR_RELEASE}/${OMR_REAL_TARGET}/luci/packages.adb
+		http://packages.openmptcprouter.com/${OMR_RELEASE}/${OMR_REAL_TARGET}/packages/packages.adb
+		http://packages.openmptcprouter.com/${OMR_RELEASE}/${OMR_REAL_TARGET}/base/packages.adb
+		http://packages.openmptcprouter.com/${OMR_RELEASE}/${OMR_REAL_TARGET}/routing/packages.adb
+		http://packages.openmptcprouter.com/${OMR_RELEASE}/${OMR_REAL_TARGET}/telephony/packages.adb
+		EOF
+	elif [ -n "$OMR_PACKAGES_URL" ]; then
+		cat > "$OMR_TARGET/${OMR_KERNEL}/source/package/system/apk/files/customfeeds.list" <<-EOF
+		${OMR_PACKAGES_URL}/${OMR_RELEASE}/${OMR_REAL_TARGET}/luci/packages.adb
+		${OMR_PACKAGES_URL}/${OMR_RELEASE}/${OMR_REAL_TARGET}/packages/packages.adb
+		${OMR_PACKAGES_URL}/${OMR_RELEASE}/${OMR_REAL_TARGET}/base/packages.adb
+		${OMR_PACKAGES_URL}/${OMR_RELEASE}/${OMR_REAL_TARGET}/routing/packages.adb
+		${OMR_PACKAGES_URL}/${OMR_RELEASE}/${OMR_REAL_TARGET}/telephony/packages.adb
+		EOF
+	else
+		cat > "$OMR_TARGET/${OMR_KERNEL}/source/package/system/apk/files/customfeeds.list" <<-EOF
+		http://downloads.openwrt.org/snapshots/packages/${OMR_REAL_TARGET}/luci/packages.adb
+		http://downloads.openwrt.org/snapshots/packages/${OMR_REAL_TARGET}/packages/packages.adb
+		http://downloads.openwrt.org/snapshots/packages/${OMR_REAL_TARGET}/base/packages.adb
+		http://downloads.openwrt.org/snapshots/packages/${OMR_REAL_TARGET}/routing/packages.adb
+		http://downloads.openwrt.org/snapshots/packages/${OMR_REAL_TARGET}/telephony/packages.adb
+		EOF
+	fi
+
 fi
-#cat > "$OMR_TARGET/${OMR_KERNEL}/source/package/system/opkg/files/customfeeds.conf" <<EOF
-#src/gz openwrt_luci http://downloads.openwrt.org/releases/18.06.0/packages/${OMR_REAL_TARGET}/luci
-#src/gz openwrt_packages http://downloads.openwrt.org/releases/18.06.0/packages/${OMR_REAL_TARGET}/packages
-#src/gz openwrt_base http://downloads.openwrt.org/releases/18.06.0/packages/${OMR_REAL_TARGET}/base
-#src/gz openwrt_routing http://downloads.openwrt.org/releases/18.06.0/packages/${OMR_REAL_TARGET}/routing
-#src/gz openwrt_telephony http://downloads.openwrt.org/releases/18.06.0/packages/${OMR_REAL_TARGET}/telephony
-#EOF
 
 if [ -f $OMR_TARGET_CONFIG ]; then
 	cat "$OMR_TARGET_CONFIG" config -> "$OMR_TARGET/${OMR_KERNEL}/source/.config" <<-EOF
@@ -291,6 +321,10 @@ if [ "$OMR_IMG" = "yes" ] && [ "$OMR_TARGET" = "x86_64" ]; then
 	echo 'CONFIG_VHDX_IMAGES=y' >> "$OMR_TARGET/${OMR_KERNEL}/source/.config"
 fi
 
+if [ "$OMR_LOG" = "yes" ]; then 
+	echo 'CONFIG_BUILD_LOG=y' >> "$OMR_TARGET/${OMR_KERNEL}/source/.config"
+fi
+
 if [ "$DISABLE_FAILSAFE" = "yes" ]; then
 	rm -f "$OMR_TARGET/${OMR_KERNEL}/source/package/base-files/files/lib/preinit/30_failsafe_wait"
 	rm -f "$OMR_TARGET/${OMR_KERNEL}/source/package/base-files/files/lib/preinit/40_run_failsafe_hook"
@@ -308,7 +342,11 @@ if [ "$SYSLOG" = "busybox-syslogd" ]; then
 	echo "CONFIG_BUSYBOX_CONFIG_LOGREAD=y" >> "$OMR_TARGET/${OMR_KERNEL}/source/.config"
 	echo "CONFIG_PACKAGE_syslogd=y" >> "$OMR_TARGET/${OMR_KERNEL}/source/.config"
 elif [ "$SYSLOG" = "syslog-ng" ]; then
+	echo "CONFIG_DEFAULT_syslog-ng=y" >> "$OMR_TARGET/${OMR_KERNEL}/source/.config"
 	echo "CONFIG_PACKAGE_syslog-ng=y" >> "$OMR_TARGET/${OMR_KERNEL}/source/.config"
+elif [ "$SYSLOG" = "logd" ]; then
+	echo "CONFIG_DEFAULT_logd=y" >> "$OMR_TARGET/${OMR_KERNEL}/source/.config"
+	echo "CONFIG_PACKAGE_logd=y" >> "$OMR_TARGET/${OMR_KERNEL}/source/.config"
 fi
 
 if [ "$SHORTCUT_FE" = "yes" ]; then
@@ -327,7 +365,7 @@ if [ "$OMR_KERNEL" != "5.4" ] && [ "$OMR_TARGET" != "x86_64" ] && [ "$OMR_TARGET
 #	echo "# CONFIG_PACKAGE_kmod-r8168 is not set" >> "$OMR_TARGET/${OMR_KERNEL}/source/.config"
 	echo "CONFIG_PACKAGE_kmod-r8168=m" >> "$OMR_TARGET/${OMR_KERNEL}/source/.config"
 fi
-if [ "$OMR_KERNEL" = "6.1" ] || [ "$OMR_KERNEL" = "6.6" ] || [ "$OMR_KERNEL" = "6.10" ] || [ "$OMR_KERNEL" = "6.11" ]; then
+if [ "$OMR_KERNEL" = "6.1" ] || [ "$OMR_KERNEL" = "6.6" ] || [ "$OMR_KERNEL" = "6.10" ] || [ "$OMR_KERNEL" = "6.11" ] || [ "$OMR_KERNEL" = "6.12" ]; then
 	echo "# CONFIG_PACKAGE_kmod-rtl8812au-ct is not set" >> "$OMR_TARGET/${OMR_KERNEL}/source/.config"
 fi
 
@@ -448,7 +486,7 @@ cd "$OMR_TARGET/${OMR_KERNEL}/source"
 #	echo "Done"
 #fi
 
-if [ "$OMR_KERNEL" != "6.6" ] && [ "$OMR_KERNEL" != "6.10" ] && [ "$OMR_KERNEL" != "6.11" ]; then
+if [ "$OMR_KERNEL" != "6.6" ] && [ "$OMR_KERNEL" != "6.10" ] && [ "$OMR_KERNEL" != "6.11" ] && [ "$OMR_KERNEL" != "6.12" ]; then
 	echo "Checking if No check patch is set or not"
 	if ! patch -Rf -N -p1 -s --dry-run < ../../../patches/nocheck.patch; then
 		echo "apply..."
@@ -638,6 +676,11 @@ if [ "$OMR_KERNEL" = "5.4" ]; then
 		NOT_SUPPORTED="1"
 		exit 1
 	fi
+	if ([ "$OMR_TARGET" = "bpi-r3" ] || [ "$OMR_TARGET" = "bpi-r4" ] || [ "$OMR_TARGET" = "bpi-r4-poe" ]); then
+		echo "Sorry but kernel 5.4 is not supported on your arch"
+		NOT_SUPPORTED="1"
+		exit 1
+	fi
 	if ([ "$OMR_TARGET" = "z8102ax_128m" ] || [ "$OMR_TARGET" = "z8102ax_64m" ]); then
 		echo "Sorry but kernel 5.4 is not supported on your arch yet"
 		NOT_SUPPORTED="1"
@@ -869,6 +912,62 @@ if [ "$OMR_KERNEL" = "6.11" ]; then
 	#echo 'CONFIG_KERNEL_GIT_CLONE_URI="https://github.com/multipath-tcp/mptcp_net-next.git"' >> ".config"
 	#echo 'CONFIG_KERNEL_GIT_REF="92590173530711151d50d13b145a9621b5e8d239"' >> ".config"
 fi
+if [ "$OMR_KERNEL" = "6.12" ]; then
+	echo "Set to kernel 6.12 for x86 arch"
+	find target/linux/x86 -type f -name Makefile -exec sed -i 's%KERNEL_PATCHVER:=6.6%KERNEL_PATCHVER:=6.12%g' {} \;
+	echo "Done"
+	echo "Set to kernel 6.12 for mediatek"
+	find target/linux/mediatek -type f -name Makefile -exec sed -i 's%KERNEL_PATCHVER:=6.6%KERNEL_PATCHVER:=6.12%g' {} \;
+	echo "Done"
+	echo "Set to kernel 6.12 for bcm27xx"
+	find target/linux/bcm27xx -type f -name Makefile -exec sed -i 's%KERNEL_PATCHVER:=6.6%KERNEL_PATCHVER:=6.12%g' {} \;
+	echo "Done"
+	echo "Set to kernel 6.12 for bcm27xx"
+	find target/linux/qualcommax -type f -name Makefile -exec sed -i 's%KERNEL_PATCHVER:=6.6%KERNEL_PATCHVER:=6.12%g' {} \;
+	echo "Done"
+	echo "CONFIG_VERSION_CODE=6.12" >> ".config"
+	echo "# CONFIG_PACKAGE_kmod-gpio-button-hotplug is not set" >> ".config"
+	echo "# CONFIG_PACKAGE_kmod-meraki-mx100 is not set" >> ".config"
+	echo "# CONFIG_PACKAGE_kmod-gpio-nct5104d is not set" >> ".config"
+	echo "# CONFIG_PACKAGE_kmod-r8168 is not set" >> ".config"
+	echo "# CONFIG_PACKAGE_kmod-r8125 is not set" >> ".config"
+	echo "# CONFIG_PACKAGE_kmod-r8125-rss is not set" >> ".config"
+	echo "# CONFIG_PACKAGE_kmod-r8126 is not set" >> ".config"
+	echo "# CONFIG_PACKAGE_kmod-r8126-rss is not set" >> ".config"
+	echo "# CONFIG_PACKAGE_kmod-button-hotplug is not set" >> ".config"
+	echo "# CONFIG_PACKAGE_kmod-cryptodev is not set" >> ".config"
+	echo "# CONFIG_PACKAGE_kmod-trelay is not set" >> ".config"
+	echo "# CONFIG_PACKAGE_464xlat is not set" >> ".config"
+	echo "# CONFIG_PACKAGE_kmod-nat46 is not set" >> ".config"
+	echo "# CONFIG_PACKAGE_kmod-ath10k-ct-smallbuffers is not set" >> ".config"
+	echo "CONFIG_BPF_TOOLCHAIN=y" >> ".config"
+	echo "CONFIG_BPF_TOOLCHAIN_HOST=y" >> ".config"
+	echo "CONFIG_KERNEL_BPF_EVENTS=y" >> ".config"
+	echo "CONFIG_KERNEL_DEBUG_INFO=y" >> ".config"
+	echo "CONFIG_KERNEL_DEBUG_INFO_BTF=y" >> ".config"
+	echo "CONFIG_KERNEL_DEBUG_INFO_BTF_MODULES=y" >> ".config"
+	echo "# CONFIG_KERNEL_DEBUG_INFO_REDUCED is not set" >> ".config"
+	echo "CONFIG_KERNEL_MODULE_ALLOW_BTF_MISMATCH=y" >> ".config"
+	echo 'CONFIG_EXTRA_OPTIMIZATION="-fno-caller-saves -fno-plt -Wno-stringop-truncation -Wno-stringop-overread -Wno-calloc-transposed-args"' >> ".config"
+	# Remove for now packages that doesn't compile
+	rm -rf package/kernel/mt76
+	rm -rf package/kernel/rtl8812au-ct
+	# Remove not needed patches
+	rm -f package/kernel/mac80211/patches/build/200-Revert-wifi-iwlwifi-Use-generic-thermal_zone_get_tri.patch
+	rm -f package/kernel/mac80211/patches/build/210-revert-split-op.patch
+	rm -f package/kernel/mac80211/patches/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
+	rm -f package/kernel/mac80211/patches/build/240-backport_genl_split_ops.patch
+	rm -f package/kernel/mac80211/patches/build/250-backport_iwlwifi_thermal.patch
+	rm -f package/kernel/rtl8812au-ct/patches/099-cut-linkid-linux-version-code-conditionals.patch
+	rm -f package/kernel/rtl8812au-ct/patches/100-api_update.patch
+	#echo 'CONFIG_KERNEL_GIT_CLONE_URI="https://github.com/multipath-tcp/mptcp_net-next.git"' >> ".config"
+	#echo 'CONFIG_KERNEL_GIT_REF="92590173530711151d50d13b145a9621b5e8d239"' >> ".config"
+	echo 'CONFIG_PACKAGE_apk-openssl=y' >> ".config"
+	if [ ! -d target/linux/`sed -nE 's/CONFIG_TARGET_([a-z0-9]*)=y/\1/p' ".config" | tr -d "\n"`/patches-6.12 ]; then
+		echo "Sorry but kernel 6.12 is not supported on your arch yet"
+		NOT_SUPPORTED="1"
+	fi
+fi
 
 #rm -rf feeds/packages/libs/libwebp
 cd "../../.."
@@ -876,7 +975,7 @@ rm -rf feeds/${OMR_KERNEL}/luci/modules/luci-mod-network
 
 if [ -d feeds/${OMR_KERNEL}/${OMR_DIST}/luci-mod-status ]; then
 	rm -rf feeds/${OMR_KERNEL}/luci/modules/luci-mod-status
-elif [ "$OMR_KERNEL" = "6.6" ] || [ "$OMR_KERNEL" = "6.10" ] || [ "$OMR_KERNEL" = "6.11" ]; then
+elif [ "$OMR_KERNEL" = "6.6" ] || [ "$OMR_KERNEL" = "6.10" ] || [ "$OMR_KERNEL" = "6.11" ] || [ "$OMR_KERNEL" = "6.12" ]; then
 	cd feeds/${OMR_KERNEL}
 	#if ! patch -Rf -N -p1 -s --dry-run < ../../patches/luci-syslog-6.6.patch; then
 	#	patch -N -p1 -s < ../../patches/luci-syslog-6.6.patch
@@ -893,6 +992,13 @@ else
 	cd -
 fi
 
+cd feeds/${OMR_KERNEL}
+if ! patch -Rf -N -p1 -s --dry-run < ../../patches/luci-unbound-logread.patch; then
+	patch -N -p1 -s < ../../patches/luci-unbound-logread.patch
+fi
+cd -
+
+
 [ -d feeds/${OMR_KERNEL}/${OMR_DIST}/luci-app-statistics ] && rm -rf feeds/${OMR_KERNEL}/luci/applications/luci-app-statistics
 [ -d feeds/${OMR_KERNEL}/${OMR_DIST}/luci-proto-modemmanager ] && rm -rf feeds/${OMR_KERNEL}/luci/protocols/luci-proto-modemmanager
 #if [ -d ${OMR_FEED}/netifd ] && [ "${OMR_KERNEL}" != "5.4" ]; then
@@ -900,9 +1006,13 @@ fi
 #fi
 [ -d ${OMR_FEED}/libgpiod ] && rm -rf feeds/${OMR_KERNEL}/packages/libs/libgpiod
 [ -d ${OMR_FEED}/iperf3 ] && rm -rf feeds/${OMR_KERNEL}/packages/net/iperf3
-[ -d ${OMR_FEED}/golang ] && rm -rf feeds/${OMR_KERNEL}/packages/lang/golang
+[ -d ${OMR_FEED}/golang ] && {
+	rm -rf feeds/${OMR_KERNEL}/packages/lang/golang
+	cp -r ${OMR_FEED}/golang feeds/${OMR_KERNEL}/packages/lang/
+}
 [ -d ${OMR_FEED}/openvpn ] && rm -rf feeds/${OMR_KERNEL}/packages/net/openvpn
 [ -d ${OMR_FEED}/iproute2 ] && rm -rf feeds/${OMR_KERNEL}/packages/network/utils/iproute2
+[ -d ${CUSTOM_FEED}/syslog-ng ] && rm -rf feeds/${OMR_KERNEL}/packages/admin/syslog-ng
 ([ "$OMR_KERNEL" = "6.6" ] || [ "$OMR_KERNEL" = "6.10" ]) && [ -d ${OMR_FEED}/xtables-addons ] && rm -rf feeds/${OMR_KERNEL}/packages/net/xtables-addons
 
 echo "Add Occitan translation support"
@@ -960,10 +1070,10 @@ if [ "$OMR_KERNEL" = "5.4" ]; then
 #	scripts/feeds uninstall rust
 #	scripts/feeds install -p packages rust
 fi
-if [ "$OMR_KERNEL" != "5.4" ] && [ "$OMR_KERNEL" != "6.1" ]; then
-	scripts/feeds uninstall netifd
-	scripts/feeds install netifd
-fi
+#if [ "$OMR_KERNEL" != "5.4" ] && [ "$OMR_KERNEL" != "6.1" ]; then
+#	scripts/feeds uninstall netifd
+#	scripts/feeds install netifd
+#fi
 cp .config.keep .config
 scripts/feeds install kmod-macremapper
 echo "Done"
@@ -972,7 +1082,7 @@ if [ ! -f "../../../$OMR_TARGET_CONFIG" ] || [ "$NOT_SUPPORTED" = "1" ]; then
 	echo "Target $OMR_TARGET not found ! You have to configure and compile your kernel manually."
 	exit 1
 fi
-
+[ "$ONLY_PREPARE" = "yes" ] && exit 0
 echo "Building $OMR_DIST for the target $OMR_TARGET with kernel ${OMR_KERNEL}"
 make defconfig
 make IGNORE_ERRORS=m "$@"
diff --git a/common/package/base-files/files/bin/config_generate b/common/package/base-files/files/bin/config_generate
old mode 100755
new mode 100644
index 1deda8e2..f8885166
--- a/common/package/base-files/files/bin/config_generate
+++ b/common/package/base-files/files/bin/config_generate
@@ -7,25 +7,58 @@ CFG=/etc/board.json
 [ -s $CFG ] || /bin/board_detect || exit 1
 [ -s /etc/config/network -a -s /etc/config/system ] && exit 0
 
+generate_bridge() {
+	local name=$1
+	local macaddr=$2
+	uci -q batch <<-EOF
+		set network.$name=device
+		set network.$name.name=$name
+		set network.$name.type=bridge
+	EOF
+	if [ -n "$macaddr" ]; then
+		uci -q batch <<-EOF
+			set network.$name.macaddr=$macaddr
+		EOF
+	fi
+}
+
+bridge_vlan_id=0
+generate_bridge_vlan() {
+	local name=$1_vlan
+	local device=$2
+	local ports="$3"
+	local vlan="$4"
+	uci -q batch <<-EOF
+		set network.$name=bridge-vlan
+		set network.$name.device='$device'
+		set network.$name.vlan='$vlan'
+		set network.$name.ports='$ports'
+	EOF
+}
+
 generate_static_network() {
 	uci -q batch <<-EOF
 		delete network.loopback
 		set network.loopback='interface'
-		set network.loopback.ifname='lo'
+		set network.loopback.device='lo'
 		set network.loopback.proto='static'
 		set network.loopback.ipaddr='127.0.0.1'
 		set network.loopback.netmask='255.0.0.0'
-		delete network.globals
-		set network.globals='globals'
-		set network.globals.ula_prefix='auto'
 	EOF
+		[ -e /proc/sys/net/ipv6 ] && {
+			uci -q batch <<-EOF
+				delete network.globals
+				set network.globals='globals'
+				set network.globals.ula_prefix='auto'
+			EOF
+		}
 
 	if json_is_a dsl object; then
 		json_select dsl
 			if json_is_a atmbridge object; then
 				json_select atmbridge
-					local vpi vci encaps payload
-					json_get_vars vpi vci encaps payload
+					local vpi vci encaps payload nameprefix
+					json_get_vars vpi vci encaps payload nameprefix
 					uci -q batch <<-EOF
 						delete network.atm
 						set network.atm='atm-bridge'
@@ -33,6 +66,7 @@ generate_static_network() {
 						set network.atm.vci='$vci'
 						set network.atm.encaps='$encaps'
 						set network.atm.payload='$payload'
+						set network.atm.nameprefix='$nameprefix'
 					EOF
 				json_select ..
 			fi
@@ -57,41 +91,70 @@ generate_static_network() {
 
 addr_offset=2
 generate_network() {
-	local ifname macaddr protocol type ipaddr netmask
+	local ports device macaddr protocol type ipaddr netmask vlan
+	local bridge=$2
 
 	json_select network
 		json_select "$1"
-			json_get_vars ifname macaddr protocol ipaddr netmask
+			json_get_vars device macaddr metric protocol ipaddr netmask vlan
+			json_get_values ports ports
 		json_select ..
 	json_select ..
 
-	[ -n "$ifname" ] || return
+	[ -n "$device" -o -n "$ports" ] || return
 
-	case "$1" in
-		# hack (see /etc/board.d/02_network)
-		none) return ;;
-		lan*) proto=${proto:-static} ;;
-		wan*) proto=${proto:-dhcp} ;;
-	esac
+	# Force bridge for "lan" as it may have other devices (e.g. wireless)
+	# bridged
+	[ "$1" = "lan" -a -z "$ports" ] && {
+		ports="$device"
+	}
+
+	[ -n "$ports" -a -z "$bridge" ] && {
+		uci -q batch <<-EOF
+			add network device
+			set network.@device[-1].name='br-$1'
+			set network.@device[-1].type='bridge'
+		EOF
+		for port in $ports; do uci add_list network.@device[-1].ports="$port"; done
+		[ -n "$macaddr" ] && {
+			for port in $ports; do
+				uci -q batch <<-EOF
+					add network device
+					set network.@device[-1].name='$port'
+					set network.@device[-1].macaddr='$macaddr'
+				EOF
+			done
+		}
+		device=br-$1
+		type=
+		macaddr=""
+	}
+
+	[ -n "$bridge" ] && {
+		[ -z "$ports" ] && ports="$device"
+		if [ -z "$vlan" ]; then
+			bridge_vlan_id=$((bridge_vlan_id + 1))
+			vlan=$bridge_vlan_id
+		fi
+		generate_bridge_vlan $1 $bridge "$ports" $vlan
+		device=$bridge.$vlan
+		type=""
+	}
 
 	if [ -n "$macaddr" ]; then
-		type=macvlan # useless, only for legacy
 		uci -q batch <<-EOF
-			delete network.${1}_dev
-			set network.${1}_dev='device'
-			set network.${1}_dev.name='$1'
-			set network.${1}_dev.type='$type'
-			set network.${1}_dev.ifname='$ifname'
-			set network.${1}_dev.macaddr='$macaddr'
+			add network device
+			set network.@device[-1].name='$device'
+			set network.@device[-1].macaddr='$macaddr'
 		EOF
-		ifname=$1
 	fi
 
 	uci -q batch <<-EOF
 		delete network.$1
 		set network.$1='interface'
 		set network.$1.type='$type'
-		set network.$1.ifname='$ifname'
+		set network.$1.device='$device'
+		set network.$1.metric='$metric'
 		set network.$1.proto='none'
 	EOF
 
@@ -109,17 +172,23 @@ generate_network() {
 				set network.$1.proto='static'
 				set network.$1.ipaddr='$ipad'
 				set network.$1.netmask='$netm'
-				set network.$1.ip6assign='60'
 			EOF
+			[ -e /proc/sys/net/ipv6 ] && uci set network.$1.ip6assign='60'
 		;;
 
 		dhcp)
 			# fixup IPv6 slave interface if parent is a bridge
-			[ "$type" = "bridge" ] && ifname="br-$1"
+			[ "$type" = "bridge" ] && device="br-$1"
 
-			uci -q batch <<-EOF
-				set network.$1.proto='dhcp'
-			EOF
+			uci set network.$1.proto='dhcp'
+			[ -e /proc/sys/net/ipv6 ] && {
+				uci -q batch <<-EOF
+					delete network.${1}6
+					set network.${1}6='interface'
+					set network.${1}6.device='$device'
+					set network.${1}6.proto='dhcpv6'
+				EOF
+			}
 		;;
 
 		pppoe)
@@ -127,11 +196,24 @@ generate_network() {
 				set network.$1.proto='pppoe'
 				set network.$1.username='username'
 				set network.$1.password='password'
-				set network.$1.ipv6='1'
-				delete network.${1}6
-				set network.${1}6='interface'
-				set network.${1}6.ifname='@${1}'
-				set network.${1}6.proto='dhcpv6'
+			EOF
+			[ -e /proc/sys/net/ipv6 ] && {
+				uci -q batch <<-EOF
+					set network.$1.ipv6='1'
+					delete network.${1}6
+					set network.${1}6='interface'
+					set network.${1}6.device='@${1}'
+					set network.${1}6.proto='dhcpv6'
+				EOF
+			}
+		;;
+
+		ncm|\
+		qmi|\
+		mbim)
+			uci -q batch <<-EOF
+				set network.$1.proto='${protocol}'
+				set network.$1.pdptype='ipv4'
 			EOF
 		;;
 	esac
@@ -206,7 +288,8 @@ generate_switch() {
 
 	json_select switch
 	json_select "$key"
-	json_get_vars enable reset blinkrate cpu_port
+	json_get_vars enable reset blinkrate cpu_port \
+		ar8xxx_mib_type ar8xxx_mib_poll_interval
 
 	uci -q batch <<-EOF
 		add network switch
@@ -214,6 +297,8 @@ generate_switch() {
 		set network.@switch[-1].reset='$reset'
 		set network.@switch[-1].enable_vlan='$enable'
 		set network.@switch[-1].blinkrate='$blinkrate'
+		set network.@switch[-1].ar8xxx_mib_type='$ar8xxx_mib_type'
+		set network.@switch[-1].ar8xxx_mib_poll_interval='$ar8xxx_mib_poll_interval'
 	EOF
 
 	generate_switch_vlans_ports "$1"
@@ -222,15 +307,15 @@ generate_switch() {
 	json_select ..
 }
 
-
 generate_static_system() {
 	uci -q batch <<-EOF
 		delete system.@system[0]
 		add system system
 		set system.@system[-1].hostname='OpenMPTCProuter'
-		set system.@system[-1].timezone='UTC'
+		set system.@system[-1].timezone='GMT0'
+		set system.@system[-1].zonename='UTC'
 		set system.@system[-1].ttylogin='0'
-		set system.@system[-1].log_size='64'
+		set system.@system[-1].log_size='128'
 		set system.@system[-1].urandom_seed='0'
 
 		delete system.ntp
@@ -250,6 +335,18 @@ generate_static_system() {
 				uci -q set "system.@system[-1].hostname=$hostname"
 			fi
 
+			local compat_version
+			if json_get_var compat_version compat_version; then
+				uci -q set "system.@system[-1].compat_version=$compat_version"
+			else
+				uci -q set "system.@system[-1].compat_version=1.0"
+			fi
+
+			local timezone
+			if json_get_var timezone timezone; then
+				uci -q set "system.@system[-1].timezone=$timezone"
+			fi
+
 			if json_is_a ntpserver array; then
 				local keys key
 				json_get_keys keys ntpserver
@@ -359,11 +456,12 @@ generate_led() {
 		;;
 
 		switch)
-			local port_mask speed_mask
-			json_get_vars port_mask speed_mask
+			local port_mask speed_mask mode
+			json_get_vars port_mask speed_mask mode
 			uci -q batch <<-EOF
 				set system.$cfg.port_mask='$port_mask'
 				set system.$cfg.speed_mask='$speed_mask'
+				set system.$cfg.mode='$mode'
 			EOF
 		;;
 
@@ -411,12 +509,24 @@ generate_gpioswitch() {
 json_init
 json_load "$(cat ${CFG})"
 
+umask 077
+
 if [ ! -s /etc/config/network ]; then
+	bridge_name=""
 	touch /etc/config/network
 	generate_static_network
 
+	json_get_vars bridge
+	[ -n "$bridge" ] && {
+		json_select bridge
+		json_get_vars name macaddr
+		generate_bridge "$name" "$macaddr"
+		json_select ..
+		bridge_name=$name
+	}
+
 	json_get_keys keys network
-	for key in $keys; do generate_network $key; done
+	for key in $keys; do generate_network $key $bridge_name; done
 
 	json_get_keys keys switch
 	for key in $keys; do generate_switch $key; done
diff --git a/common/package/base-files/files/etc/rc.button/reset b/common/package/base-files/files/etc/rc.button/reset
new file mode 100755
index 00000000..7eb23bbb
--- /dev/null
+++ b/common/package/base-files/files/etc/rc.button/reset
@@ -0,0 +1,31 @@
+#!/bin/sh
+
+. /lib/functions.sh
+
+OVERLAY="$( grep ' /overlay ' /proc/mounts )"
+
+case "$ACTION" in
+pressed)
+	[ -z "$OVERLAY" ] && return 0
+
+	return 5
+;;
+timeout)
+	. /etc/diag.sh
+	set_state failsafe
+;;
+released)
+	if [ "$SEEN" -lt 1 ]
+	then
+		echo "REBOOT" > /dev/console
+		sync
+		reboot
+	elif [ "$SEEN" -ge 2 -a -n "$OVERLAY" ]
+	then
+		echo "FACTORY RESET" > /dev/console
+		factoryreset -y && reboot &
+	fi
+;;
+esac
+
+return 0
diff --git a/common/package/base-files/files/sbin/sysupgrade b/common/package/base-files/files/sbin/sysupgrade
old mode 100755
new mode 100644
index 5cf0b2bf..e51ab0b4
--- a/common/package/base-files/files/sbin/sysupgrade
+++ b/common/package/base-files/files/sbin/sysupgrade
@@ -4,26 +4,35 @@
 . /lib/functions/system.sh
 . /usr/share/libubox/jshn.sh
 
-# initialize defaults
+# File-local constants
+CONF_TAR=/tmp/sysupgrade.tgz
+ETCBACKUP_DIR=/etc/backup
+INSTALLED_PACKAGES=${ETCBACKUP_DIR}/installed_packages.txt
+COMMAND=/lib/upgrade/do_stage2
+
+# File-local globals
+SAVE_OVERLAY=0
+SAVE_OVERLAY_PATH=
+SAVE_PARTITIONS=1
+SAVE_INSTALLED_PKGS=0
+SKIP_UNCHANGED=0
+CONF_IMAGE=
+CONF_BACKUP_LIST=0
+CONF_BACKUP=
+CONF_RESTORE=
+NEED_IMAGE=
+HELP=0
+TEST=0
+
+# Globals accessed in other files
 export MTD_ARGS=""
 export MTD_CONFIG_ARGS=""
 export INTERACTIVE=0
 export VERBOSE=1
 export SAVE_CONFIG=1
-export SAVE_OVERLAY=0
-export SAVE_OVERLAY_PATH=
-export SAVE_PARTITIONS=1
-export SAVE_INSTALLED_PKGS=1
-export SKIP_UNCHANGED=0
-export CONF_IMAGE=
-export CONF_BACKUP_LIST=0
-export CONF_BACKUP=
-export CONF_RESTORE=
-export NEED_IMAGE=
-export HELP=0
+export IGNORE_MINOR_COMPAT=0
 export FORCE=0
-export TEST=0
-export UMOUNT_ETCBACKUP_DIR=0
+export CONFFILES=/tmp/sysupgrade.conffiles
 
 # parse options
 while [ -n "$1" ]; do
@@ -32,18 +41,19 @@ while [ -n "$1" ]; do
 		-v) export VERBOSE="$(($VERBOSE + 1))";;
 		-q) export VERBOSE="$(($VERBOSE - 1))";;
 		-n) export SAVE_CONFIG=0;;
-		-c) export SAVE_OVERLAY=1 SAVE_OVERLAY_PATH=/etc;;
-		-o) export SAVE_OVERLAY=1 SAVE_OVERLAY_PATH=/;;
-		-p) export SAVE_PARTITIONS=0;;
-		-k) export SAVE_INSTALLED_PKGS=1;;
-		-u) export SKIP_UNCHANGED=1;;
-		-b|--create-backup) export CONF_BACKUP="$2" NEED_IMAGE=1; shift;;
-		-r|--restore-backup) export CONF_RESTORE="$2" NEED_IMAGE=1; shift;;
-		-l|--list-backup) export CONF_BACKUP_LIST=1;;
-		-f) export CONF_IMAGE="$2"; shift;;
+		-c) SAVE_OVERLAY=1 SAVE_OVERLAY_PATH=/etc;;
+		-o) SAVE_OVERLAY=1 SAVE_OVERLAY_PATH=/;;
+		-p) SAVE_PARTITIONS=0;;
+		-k) SAVE_INSTALLED_PKGS=1;;
+		-u) SKIP_UNCHANGED=1;;
+		-b|--create-backup) CONF_BACKUP="$2" NEED_IMAGE=1; shift;;
+		-r|--restore-backup) CONF_RESTORE="$2" NEED_IMAGE=1; shift;;
+		-l|--list-backup) CONF_BACKUP_LIST=1;;
+		-f) CONF_IMAGE="$2"; shift;;
 		-F|--force) export FORCE=1;;
-		-T|--test) export TEST=1;;
-		-h|--help) export HELP=1; break;;
+		-T|--test) TEST=1;;
+		-h|--help) HELP=1; break;;
+		--ignore-minor-compat-version) export IGNORE_MINOR_COMPAT=1;;
 		-*)
 			echo "Invalid option: $1" >&2
 			exit 1
@@ -53,14 +63,7 @@ while [ -n "$1" ]; do
 	shift;
 done
 
-export CONFFILES=/tmp/sysupgrade.conffiles
-export CONF_TAR=/tmp/sysupgrade.tgz
-export ETCBACKUP_DIR=/etc/backup
-export INSTALLED_PACKAGES=${ETCBACKUP_DIR}/installed_packages.txt
-
-IMAGE="$1"
-
-[ -z "$IMAGE" -a -z "$NEED_IMAGE" -a $CONF_BACKUP_LIST -eq 0 -o $HELP -gt 0 ] && {
+print_help() {
 	cat <<EOF
 Usage: $0 [<upgrade-option>...] <image file or URL>
        $0 [-q] [-i] [-c] [-u] [-o] [-k] <backup-command> <file>
@@ -80,6 +83,8 @@ upgrade-option:
 	             Verify image and config .tar.gz but do not actually flash.
 	-F | --force
 	             Flash image even if image checks fail, this is dangerous!
+	--ignore-minor-compat-version
+		     Flash image even if the minor compat version is incompatible.
 	-q           less verbose
 	-v           more verbose
 	-h | --help  display this help
@@ -98,9 +103,20 @@ backup-command:
 	             sysupgrade -b. Does not create a backup file.
 
 EOF
-	exit 1
 }
 
+IMAGE="$1"
+
+if [ $HELP -gt 0 ]; then
+	print_help
+	exit 0
+fi
+
+if [ -z "$IMAGE" -a -z "$NEED_IMAGE" -a $CONF_BACKUP_LIST -eq 0 ]; then
+	print_help
+	exit 1
+fi
+
 [ -n "$IMAGE" -a -n "$NEED_IMAGE" ] && {
 	cat <<-EOF
 		-b|--create-backup and -r|--restore-backup do not perform a firmware upgrade.
@@ -112,26 +128,22 @@ EOF
 # prevent messages from clobbering the tarball when using stdout
 [ "$CONF_BACKUP" = "-" ] && export VERBOSE=0
 
-missing_lines() {
-	local file1 file2 line
-	file1="$1"
-	file2="$2"
-	oIFS="$IFS"
-	IFS=":"
-	while read line; do
-		set -- $line
-		grep -q "^$1:" "$file2" || echo "$*"
-	done < "$file1"
-	IFS="$oIFS"
-}
 
 list_conffiles() {
-	awk '
-		BEGIN { conffiles = 0 }
-		/^Conffiles:/ { conffiles = 1; next }
-		!/^ / { conffiles = 0; next }
-		conffiles == 1 { print }
-	' /usr/lib/opkg/status
+	if [ -f /usr/lib/opkg/status ]; then
+		awk '
+			BEGIN { conffiles = 0 }
+			/^Conffiles:/ { conffiles = 1; next }
+			!/^ / { conffiles = 0; next }
+			conffiles == 1 { print }
+		' /usr/lib/opkg/status
+	elif [ -d /lib/apk/packages ]; then
+		conffiles=""
+		for file in /lib/apk/packages/*.conffiles_static; do
+			conffiles="$(echo -e "$(cat $file)\n$conffiles")"
+		done
+		echo "$conffiles"
+	fi
 }
 
 list_changed_conffiles() {
@@ -151,7 +163,7 @@ list_static_conffiles() {
 		\( -type f -o -type l \) $filter 2>/dev/null
 }
 
-add_conffiles() {
+build_list_of_backup_config_files() {
 	local file="$1"
 
 	( list_static_conffiles "$find_filter"; list_changed_conffiles ) |
@@ -159,7 +171,7 @@ add_conffiles() {
 	return 0
 }
 
-add_overlayfiles() {
+build_list_of_backup_overlay_files() {
 	local file="$1"
 
 	local packagesfiles=$1.packagesfiles
@@ -211,12 +223,12 @@ add_overlayfiles() {
 
 if [ $SAVE_OVERLAY = 1 ]; then
 	[ ! -d /overlay/upper/etc ] && {
-		echo "Cannot find '/overlay/upper/etc', required for '-c'" >&2
+		echo "Cannot find '/overlay/upper/etc', required for '-c' or '-o'" >&2
 		exit 1
 	}
-	sysupgrade_init_conffiles="add_overlayfiles"
+	sysupgrade_init_conffiles="build_list_of_backup_overlay_files"
 else
-	sysupgrade_init_conffiles="add_conffiles"
+	sysupgrade_init_conffiles="build_list_of_backup_config_files"
 fi
 
 find_filter=""
@@ -230,53 +242,77 @@ fi
 
 include /lib/upgrade
 
-do_save_conffiles() {
+create_backup_archive() {
 	local conf_tar="$1"
+	local disabled
+	local err
 
 	[ "$(rootfs_type)" = "tmpfs" ] && {
 		echo "Cannot save config while running from ramdisk." >&2
 		ask_bool 0 "Abort" && exit
-		rm -f "$conf_tar"
 		return 0
 	}
 	run_hooks "$CONFFILES" $sysupgrade_init_conffiles
 	ask_bool 0 "Edit config file list" && vi "$CONFFILES"
 
-	if [ "$SAVE_INSTALLED_PKGS" -eq 1 ]; then
-		echo "${INSTALLED_PACKAGES}" >> "$CONFFILES"
-		mkdir -p "$ETCBACKUP_DIR"
-		# Avoid touching filesystem on each backup
-		RAMFS="$(mktemp -d -t sysupgrade.XXXXXX)"
-		mkdir -p "$RAMFS/upper" "$RAMFS/work"
-		mount -t overlay overlay -o lowerdir=$ETCBACKUP_DIR,upperdir=$RAMFS/upper,workdir=$RAMFS/work $ETCBACKUP_DIR &&
-			UMOUNT_ETCBACKUP_DIR=1 || {
-				echo "Cannot mount '$ETCBACKUP_DIR' as tmpfs to avoid touching disk while saving the list of installed packages." >&2
-				ask_bool 0 "Abort" && exit
-			}
-
-		# Format: pkg-name<TAB>{rom,overlay,unkown}
-		# rom is used for pkgs in /rom, even if updated later
-		find /usr/lib/opkg/info -name "*.control" \( \
-			\( -exec test -f /rom/{} \; -exec echo {} rom \; \) -o \
-			\( -exec test -f /overlay/upper/{} \; -exec echo {} overlay \; \) -o \
-			\( -exec echo {} unknown \; \) \
-			\) | sed -e 's,.*/,,;s/\.control /\t/' > ${INSTALLED_PACKAGES}
-	fi
+	[ "$conf_tar" != "-" ] || conf_tar=""
 
 	v "Saving config files..."
 	[ "$VERBOSE" -gt 1 ] && TAR_V="v" || TAR_V=""
-	tar c${TAR_V}zf "$conf_tar" -T "$CONFFILES" 2>/dev/null
-	if [ "$?" -ne 0 ]; then
+	sed -i -e 's,^/,,' "$CONFFILES"
+	set -o pipefail
+	{
+		local ret=0
+
+		if [ $ret -eq 0 ]; then
+			for service in /etc/init.d/*; do
+				if ! $service enabled; then
+				disabled="$disabled$service disable\n"
+				fi
+			done
+			disabled="$disabled\nexit 0"
+			tar_print_member "/etc/uci-defaults/10_disable_services" "$(echo -e $disabled)" || ret=1
+		fi
+
+		# Part of archive with installed packages info
+		if [ $ret -eq 0 ]; then
+			if [ "$SAVE_INSTALLED_PKGS" -eq 1 ]; then
+				# Format: pkg-name<TAB>{rom,overlay,unknown}
+				# rom is used for pkgs in /rom, even if updated later
+				if [ -d "/usr/lib/opkg/info" ]; then
+					tar_print_member "$INSTALLED_PACKAGES" "$(find /usr/lib/opkg/info -name "*.control" \( \
+						\( -exec test -f /rom/{} \; -exec echo {} rom \; \) -o \
+						\( -exec test -f /overlay/upper/{} \; -exec echo {} overlay \; \) -o \
+						\( -exec echo {} unknown \; \) \
+						\) | sed -e 's,.*/,,;s/\.control /\t/')" || ret=1
+				elif [ -d "/lib/apk/packages" ]; then
+					tar_print_member "$INSTALLED_PACKAGES" "$(find /lib/apk/packages -name "*.list" \( \
+						\( -exec test -f /rom/{} \; -exec echo {} rom \; \) -o \
+						\( -exec test -f /overlay/upper/{} \; -exec echo {} overlay \; \) -o \
+						\( -exec echo {} unknown \; \) \
+						\) | sed -e 's,.*/,,;s/\.list /\t/')" || ret=1
+				fi
+			fi
+		fi
+
+		# Rest of archive with config files and ending padding
+		if [ $ret -eq 0 ]; then
+			tar c${TAR_V} -C / -T "$CONFFILES" || ret=1
+		fi
+
+		[ $ret -eq 0 ]
+	} | gzip > "${conf_tar:-/proc/self/fd/1}"
+	err=$?
+	set +o pipefail
+
+	if [ "$err" -ne 0 ]; then
 		echo "Failed to create the configuration backup."
-		rm -f "$conf_tar"
-		exit 1
+		[ -f "$conf_tar" ] && rm -f "$conf_tar"
 	fi
 
-	[ "$UMOUNT_ETCBACKUP_DIR" -eq 1 ] && {
-		umount "$ETCBACKUP_DIR"
-		rm -rf "$RAMFS"
-	}
 	rm -f "$CONFFILES"
+
+	return "$err"
 }
 
 if [ $CONF_BACKUP_LIST -eq 1 ]; then
@@ -288,8 +324,8 @@ if [ $CONF_BACKUP_LIST -eq 1 ]; then
 fi
 
 if [ -n "$CONF_BACKUP" ]; then
-	do_save_conffiles "$CONF_BACKUP"
-	exit $?
+	create_backup_archive "$CONF_BACKUP"
+	exit
 fi
 
 if [ -n "$CONF_RESTORE" ]; then
@@ -299,13 +335,12 @@ if [ -n "$CONF_RESTORE" ]; then
 	fi
 
 	[ "$VERBOSE" -gt 1 ] && TAR_V="v" || TAR_V=""
-	cp /etc/passwd /etc/group /etc/shadow /tmp
-	tar -C / -x${TAR_V}zf "$CONF_RESTORE"
-	missing_lines /tmp/passwd /etc/passwd >> /etc/passwd
-	missing_lines /tmp/group /etc/group >> /etc/group
-	missing_lines /tmp/shadow /etc/shadow >> /etc/shadow
-	rm /tmp/passwd /tmp/group /tmp/shadow
-
+	v "Restoring config files..."
+	if [ "$(type -t platform_restore_backup)" == 'platform_restore_backup' ]; then
+		platform_restore_backup "$TAR_V"
+	else
+		tar -C / -x${TAR_V}zf "$CONF_RESTORE"
+	fi
 	exit $?
 fi
 
@@ -363,7 +398,7 @@ if [ -n "$CONF_IMAGE" ]; then
 	get_image "$CONF_IMAGE" "cat" > "$CONF_TAR"
 	export SAVE_CONFIG=1
 elif ask_bool $SAVE_CONFIG "Keep config files over reflash"; then
-	[ $TEST -eq 1 ] || do_save_conffiles "$CONF_TAR"
+	[ $TEST -eq 1 ] || create_backup_archive "$CONF_TAR" || exit
 	export SAVE_CONFIG=1
 else
 	[ $TEST -eq 1 ] || rm -f "$CONF_TAR"
@@ -377,8 +412,6 @@ fi
 install_bin /sbin/upgraded
 v "Commencing upgrade. Closing all shell sessions."
 
-COMMAND='/lib/upgrade/do_stage2'
-
 if [ -n "$FAILSAFE" ]; then
 	printf '%s\x00%s\x00%s' "$RAM_ROOT" "$IMAGE" "$COMMAND" >/tmp/sysupgrade
 	lock -u /tmp/.failsafe
diff --git a/common/package/network/services/dnsmasq/patches/999-remove-nftset-logs.patch b/common/package/network/services/dnsmasq/patches/999-remove-nftset-logs.patch
new file mode 100644
index 00000000..26abc0f4
--- /dev/null
+++ b/common/package/network/services/dnsmasq/patches/999-remove-nftset-logs.patch
@@ -0,0 +1,11 @@
+--- a/src/nftset.c.old	2025-02-17 16:45:48.299989289 +0100
++++ b/src/nftset.c	2025-02-17 16:46:30.243335631 +0100
+@@ -89,7 +89,7 @@
+ 	  strcpy(err_str, err);
+ 	  if ((nl = strchr(err_str, '\n')))
+ 	    *nl = 0;
+-	  my_syslog(LOG_ERR,  "nftset %s %s", setname, err_str);
++	  /* my_syslog(LOG_ERR,  "nftset %s %s", setname, err_str); */
+ 	  free(err_str);
+ 	}
+     }
diff --git a/common/package/system/procd/files/procd.sh b/common/package/system/procd/files/procd.sh
deleted file mode 100644
index e301cf6b..00000000
--- a/common/package/system/procd/files/procd.sh
+++ /dev/null
@@ -1,677 +0,0 @@
-# procd API:
-#
-# procd_open_service(name, [script]):
-#   Initialize a new procd command message containing a service with one or more instances
-#
-# procd_close_service()
-#   Send the command message for the service
-#
-# procd_open_instance([name]):
-#   Add an instance to the service described by the previous procd_open_service call
-#
-# procd_set_param(type, [value...])
-#   Available types:
-#     command: command line (array).
-#     respawn info: array with 3 values $fail_threshold $restart_timeout $max_fail
-#     env: environment variable (passed to the process)
-#     data: arbitrary name/value pairs for detecting config changes (table)
-#     file: configuration files (array)
-#     netdev: bound network device (detects ifindex changes)
-#     limits: resource limits (passed to the process)
-#     user: $username to run service as
-#     group: $groupname to run service as
-#     pidfile: file name to write pid into
-#     stdout: boolean whether to redirect commands stdout to syslog (default: 0)
-#     stderr: boolean whether to redirect commands stderr to syslog (default: 0)
-#     facility: syslog facility used when logging to syslog (default: daemon)
-#
-#   No space separation is done for arrays/tables - use one function argument per command line argument
-#
-# procd_close_instance():
-#   Complete the instance being prepared
-#
-# procd_running(service, [instance]):
-#   Checks if service/instance is currently running
-#
-# procd_kill(service, [instance]):
-#   Kill a service instance (or all instances)
-#
-# procd_send_signal(service, [instance], [signal])
-#   Send a signal to a service instance (or all instances)
-#
-
-. "$IPKG_INSTROOT/usr/share/libubox/jshn.sh"
-
-PROCD_RELOAD_DELAY=1000
-_PROCD_SERVICE=
-
-procd_lock() {
-	local basescript=$(readlink "$initscript")
-	local service_name="$(basename ${basescript:-$initscript})"
-
-	flock -n 1000 &> /dev/null
-	if [ "$?" != "0" ]; then
-		exec 1000>"$IPKG_INSTROOT/var/lock/procd_${service_name}.lock"
-		flock 1000
-		if [ "$?" != "0" ]; then
-			logger "warning: procd flock for $service_name failed"
-		fi
-	fi
-}
-
-_procd_call() {
-	local old_cb
-
-	json_set_namespace procd old_cb
-	"$@"
-	json_set_namespace $old_cb
-}
-
-_procd_wrapper() {
-	procd_lock
-	while [ -n "$1" ]; do
-		eval "$1() { _procd_call _$1 \"\$@\"; }"
-		shift
-	done
-}
-
-_procd_ubus_call() {
-	local cmd="$1"
-
-	[ -n "$PROCD_DEBUG" ] && json_dump >&2
-	ubus -S call service "$cmd" "$(json_dump)"
-	json_cleanup
-}
-
-_procd_open_service() {
-	local name="$1"
-	local script="$2"
-
-	_PROCD_SERVICE="$name"
-	_PROCD_INSTANCE_SEQ=0
-
-	json_init
-	json_add_string name "$name"
-	[ -n "$script" ] && json_add_string script "$script"
-	json_add_object instances
-}
-
-_procd_close_service() {
-	json_close_object
-	_procd_open_trigger
-	service_triggers
-	_procd_close_trigger
-	_procd_open_data
-	service_data
-	_procd_close_data
-	_procd_ubus_call ${1:-set}
-}
-
-_procd_add_array_data() {
-	while [ "$#" -gt 0 ]; do
-		json_add_string "" "$1"
-		shift
-	done
-}
-
-_procd_add_array() {
-	json_add_array "$1"
-	shift
-	_procd_add_array_data "$@"
-	json_close_array
-}
-
-_procd_add_table_data() {
-	while [ -n "$1" ]; do
-		local var="${1%%=*}"
-		local val="${1#*=}"
-		[ "$1" = "$val" ] && val=
-		json_add_string "$var" "$val"
-		shift
-	done
-}
-
-_procd_add_table() {
-	json_add_object "$1"
-	shift
-	_procd_add_table_data "$@"
-	json_close_object
-}
-
-_procd_open_instance() {
-	local name="$1"; shift
-
-	_PROCD_INSTANCE_SEQ="$(($_PROCD_INSTANCE_SEQ + 1))"
-	name="${name:-instance$_PROCD_INSTANCE_SEQ}"
-	json_add_object "$name"
-	[ -n "$TRACE_SYSCALLS" ] && json_add_boolean trace "1"
-}
-
-_procd_open_trigger() {
-	let '_procd_trigger_open = _procd_trigger_open + 1'
-	[ "$_procd_trigger_open" -gt 1 ] && return
-	json_add_array "triggers"
-}
-
-_procd_close_trigger() {
-	let '_procd_trigger_open = _procd_trigger_open - 1'
-	[ "$_procd_trigger_open" -lt 1 ] || return
-	json_close_array
-}
-
-_procd_open_data() {
-	let '_procd_data_open = _procd_data_open + 1'
-	[ "$_procd_data_open" -gt 1 ] && return
-	json_add_object "data"
-}
-
-_procd_close_data() {
-	let '_procd_data_open = _procd_data_open - 1'
-	[ "$_procd_data_open" -lt 1 ] || return
-	json_close_object
-}
-
-_procd_open_validate() {
-	json_select ..
-	json_add_array "validate"
-}
-
-_procd_close_validate() {
-	json_close_array
-	json_select triggers
-}
-
-_procd_add_jail() {
-	json_add_object "jail"
-	json_add_string name "$1"
-
-	shift
-	
-	for a in $@; do
-		case $a in
-		log)	json_add_boolean "log" "1";;
-		ubus)	json_add_boolean "ubus" "1";;
-		procfs)	json_add_boolean "procfs" "1";;
-		sysfs)	json_add_boolean "sysfs" "1";;
-		ronly)	json_add_boolean "ronly" "1";;
-		requirejail)	json_add_boolean "requirejail" "1";;
-		netns)	json_add_boolean "netns" "1";;
-		userns)	json_add_boolean "userns" "1";;
-		cgroupsns)	json_add_boolean "cgroupsns" "1";;
-		esac
-	done
-	json_add_object "mount"
-	json_close_object
-	json_close_object
-}
-
-_procd_add_jail_mount() {
-	local _json_no_warning=1
-
-	json_select "jail"
-	[ $? = 0 ] || return
-	json_select "mount"
-	[ $? = 0 ] || {
-		json_select ..
-		return
-	}
-	for a in $@; do
-		json_add_string "$a" "0"
-	done
-	json_select ..
-	json_select ..
-}
-
-_procd_add_jail_mount_rw() {
-	local _json_no_warning=1
-
-	json_select "jail"
-	[ $? = 0 ] || return
-	json_select "mount"
-	[ $? = 0 ] || {
-		json_select ..
-		return
-	}
-	for a in $@; do
-		json_add_string "$a" "1"
-	done
-	json_select ..
-	json_select ..
-}
-
-_procd_set_param() {
-	local type="$1"; shift
-
-	case "$type" in
-		env|data|limits)
-			_procd_add_table "$type" "$@"
-		;;
-		command|netdev|file|respawn|watch|watchdog)
-			_procd_add_array "$type" "$@"
-		;;
-		error)
-			json_add_array "$type"
-			json_add_string "" "$@"
-			json_close_array
-		;;
-		nice|term_timeout)
-			json_add_int "$type" "$1"
-		;;
-		reload_signal)
-			json_add_int "$type" $(kill -l "$1")
-		;;
-		pidfile|user|group|seccomp|capabilities|facility|\
-		extroot|overlaydir|tmpoverlaysize)
-			json_add_string "$type" "$1"
-		;;
-		stdout|stderr|no_new_privs)
-			json_add_boolean "$type" "$1"
-		;;
-	esac
-}
-
-_procd_add_timeout() {
-	[ "$PROCD_RELOAD_DELAY" -gt 0 ] && json_add_int "" "$PROCD_RELOAD_DELAY"
-	return 0
-}
-
-_procd_add_interface_trigger() {
-	json_add_array
-	_procd_add_array_data "$1"
-	shift
-
-	json_add_array
-	_procd_add_array_data "if"
-
-	json_add_array
-	_procd_add_array_data "eq" "interface" "$1"
-	shift
-	json_close_array
-
-	json_add_array
-	_procd_add_array_data "run_script" "$@"
-	json_close_array
-
-	json_close_array
-	_procd_add_timeout
-	json_close_array
-}
-
-_procd_add_reload_interface_trigger() {
-	local script=$(readlink "$initscript")
-	local name=$(basename ${script:-$initscript})
-
-	_procd_open_trigger
-	_procd_add_interface_trigger "interface.*" $1 /etc/init.d/$name reload
-	_procd_close_trigger
-}
-
-_procd_add_config_trigger() {
-	json_add_array
-	_procd_add_array_data "$1"
-	shift
-
-	json_add_array
-	_procd_add_array_data "if"
-
-	json_add_array
-	_procd_add_array_data "eq" "package" "$1"
-	shift
-	json_close_array
-
-	json_add_array
-	_procd_add_array_data "run_script" "$@"
-	json_close_array
-
-	json_close_array
-	_procd_add_timeout
-	json_close_array
-}
-
-_procd_add_mount_trigger() {
-	json_add_array
-	_procd_add_array_data "$1"
-	local action="$2"
-	local multi=0
-	shift ; shift
-
-	json_add_array
-	_procd_add_array_data "if"
-
-	if [ "$2" ]; then
-		json_add_array
-		_procd_add_array_data "or"
-		multi=1
-	fi
-
-	while [ "$1" ]; do
-		json_add_array
-		_procd_add_array_data "eq" "target" "$1"
-		shift
-		json_close_array
-	done
-
-	[ $multi = 1 ] && json_close_array
-
-	json_add_array
-	_procd_add_array_data "run_script" /etc/init.d/$name $action
-	json_close_array
-
-	json_close_array
-	_procd_add_timeout
-	json_close_array
-}
-
-_procd_add_action_mount_trigger() {
-	local action="$1"
-	shift
-	local mountpoints="$(procd_get_mountpoints "$@")"
-	[ "${mountpoints//[[:space:]]}" ] || return 0
-	local script=$(readlink "$initscript")
-	local name=$(basename ${script:-$initscript})
-
-	_procd_open_trigger
-	_procd_add_mount_trigger mount.add $action "$mountpoints"
-	_procd_close_trigger
-}
-
-procd_get_mountpoints() {
-	(
-		__procd_check_mount() {
-			local cfg="$1"
-			local path="${2%%/}/"
-			local target
-			config_get target "$cfg" target
-			target="${target%%/}/"
-			[ "$path" != "${path##$target}" ] && echo "${target%%/}"
-		}
-		local mpath
-		config_load fstab
-		for mpath in "$@"; do
-			config_foreach __procd_check_mount mount "$mpath"
-		done
-	) | sort -u
-}
-
-_procd_add_restart_mount_trigger() {
-	_procd_add_action_mount_trigger restart "$@"
-}
-
-_procd_add_reload_mount_trigger() {
-	_procd_add_action_mount_trigger reload "$@"
-}
-
-_procd_add_raw_trigger() {
-	json_add_array
-	_procd_add_array_data "$1"
-	shift
-	local timeout=$1
-	shift
-
-	json_add_array
-	json_add_array
-	_procd_add_array_data "run_script" "$@"
-	json_close_array
-	json_close_array
-
-	json_add_int "" "$timeout"
-
-	json_close_array
-}
-
-_procd_add_reload_trigger() {
-	local script=$(readlink "$initscript")
-	local name=$(basename ${script:-$initscript})
-	local file
-
-	_procd_open_trigger
-	for file in "$@"; do
-		_procd_add_config_trigger "config.change" "$file" /etc/init.d/$name reload
-	done
-	_procd_close_trigger
-}
-
-_procd_add_validation() {
-	_procd_open_validate
-	$@
-	_procd_close_validate
-}
-
-_procd_append_param() {
-	local type="$1"; shift
-	local _json_no_warning=1
-
-	json_select "$type"
-	[ $? = 0 ] || {
-		_procd_set_param "$type" "$@"
-		return
-	}
-	case "$type" in
-		env|data|limits)
-			_procd_add_table_data "$@"
-		;;
-		command|netdev|file|respawn|watch|watchdog)
-			_procd_add_array_data "$@"
-		;;
-		error)
-			json_add_string "" "$@"
-		;;
-	esac
-	json_select ..
-}
-
-_procd_close_instance() {
-	local respawn_vals
-	_json_no_warning=1
-	if json_select respawn ; then
-		json_get_values respawn_vals
-		if [ -z "$respawn_vals" ]; then
-			local respawn_threshold=$(uci_get system.@service[0].respawn_threshold)
-			local respawn_timeout=$(uci_get system.@service[0].respawn_timeout)
-			local respawn_retry=$(uci_get system.@service[0].respawn_retry)
-			_procd_add_array_data ${respawn_threshold:-3600} ${respawn_timeout:-5} ${respawn_retry:-5}
-		fi
-		json_select ..
-	fi
-
-	json_close_object
-}
-
-_procd_add_instance() {
-	_procd_open_instance
-	_procd_set_param command "$@"
-	_procd_close_instance
-}
-
-procd_running() {
-	local service="$1"
-	local instance="${2:-*}"
-	[ "$instance" = "*" ] || instance="'$instance'"
-
-	json_init
-	json_add_string name "$service"
-	local running=$(_procd_ubus_call list | jsonfilter -l 1 -e "@['$service'].instances[$instance].running")
-
-	[ "$running" = "true" ]
-}
-
-_procd_kill() {
-	local service="$1"
-	local instance="$2"
-
-	json_init
-	[ -n "$service" ] && json_add_string name "$service"
-	[ -n "$instance" ] && json_add_string instance "$instance"
-	_procd_ubus_call delete
-}
-
-_procd_send_signal() {
-	local service="$1"
-	local instance="$2"
-	local signal="$3"
-
-	case "$signal" in
-		[A-Z]*)	signal="$(kill -l "$signal" 2>/dev/null)" || return 1;;
-	esac
-
-	json_init
-	json_add_string name "$service"
-	[ -n "$instance" -a "$instance" != "*" ] && json_add_string instance "$instance"
-	[ -n "$signal" ] && json_add_int signal "$signal"
-	_procd_ubus_call signal
-}
-
-_procd_status() {
-	local service="$1"
-	local instance="$2"
-	local data state
-	local n_running=0
-	local n_stopped=0
-	local n_total=0
-
-	json_init
-	[ -n "$service" ] && json_add_string name "$service"
-
-	data=$(_procd_ubus_call list | jsonfilter -e '@["'"$service"'"]')
-	[ -z "$data" ] && { echo "inactive"; return 3; }
-
-	data=$(echo "$data" | jsonfilter -e '$.instances')
-	if [ -z "$data" ]; then
-		[ -z "$instance" ] && { echo "active with no instances"; return 0; }
-		data="[]"
-	fi
-
-	[ -n "$instance" ] && instance="\"$instance\"" || instance='*'
-
-	for state in $(jsonfilter -s "$data" -e '$['"$instance"'].running'); do
-		n_total=$((n_total + 1))
-		case "$state" in
-		false) n_stopped=$((n_stopped + 1)) ;;
-		true)  n_running=$((n_running + 1)) ;;
-		esac
-	done
-
-	if [ $n_total -gt 0 ]; then
-		if [ $n_running -gt 0 ] && [ $n_stopped -eq 0 ]; then
-			echo "running"
-			return 0
-		elif [ $n_running -gt 0 ]; then
-			echo "running ($n_running/$n_total)"
-			return 0
-		else
-			echo "not running"
-			return 5
-		fi
-	else
-		echo "unknown instance $instance"
-		return 4
-	fi
-}
-
-procd_open_data() {
-	local name="$1"
-	json_set_namespace procd __procd_old_cb
-	json_add_object data
-}
-
-procd_close_data() {
-	json_close_object
-	json_set_namespace $__procd_old_cb
-}
-
-_procd_set_config_changed() {
-	local package="$1"
-
-	json_init
-	json_add_string type config.change
-	json_add_object data
-	json_add_string package "$package"
-	json_close_object
-
-	ubus -S call service event "$(json_dump)"
-}
-
-procd_add_mdns_service() {
-	local service proto port
-	service=$1; shift
-	proto=$1; shift
-	port=$1; shift
-	json_add_object "${service}_$port"
-	json_add_string "service" "_$service._$proto.local"
-	json_add_int port "$port"
-	[ -n "$1" ] && {
-		json_add_array txt
-		for txt in "$@"; do json_add_string "" "$txt"; done
-		json_select ..
-	}
-	json_select ..
-}
-
-procd_add_mdns() {
-	procd_open_data
-	json_add_object "mdns"
-	procd_add_mdns_service "$@"
-	json_close_object
-	procd_close_data
-}
-
-uci_validate_section()
-{
-	local _package="$1"
-	local _type="$2"
-	local _name="$3"
-	local _result
-	local _error
-	shift; shift; shift
-	_result=$(/sbin/validate_data "$_package" "$_type" "$_name" "$@" 2> /dev/null)
-	_error=$?
-	eval "$_result"
-	[ "$_error" = "0" ] || $(/sbin/validate_data "$_package" "$_type" "$_name" "$@" 1> /dev/null)
-	return $_error
-}
-
-uci_load_validate() {
-	local _package="$1"
-	local _type="$2"
-	local _name="$3"
-	local _function="$4"
-	local _option
-	local _result
-	shift; shift; shift; shift
-	for _option in "$@"; do
-		eval "local ${_option%%:*}"
-	done
-	uci_validate_section "$_package" "$_type" "$_name" "$@"
-	_result=$?
-	[ -n "$_function" ] || return $_result
-	eval "$_function \"\$_name\" \"\$_result\""
-}
-
-_procd_wrapper \
-	procd_open_service \
-	procd_close_service \
-	procd_add_instance \
-	procd_add_raw_trigger \
-	procd_add_config_trigger \
-	procd_add_interface_trigger \
-	procd_add_mount_trigger \
-	procd_add_reload_trigger \
-	procd_add_reload_interface_trigger \
-	procd_add_action_mount_trigger \
-	procd_add_reload_mount_trigger \
-	procd_add_restart_mount_trigger \
-	procd_open_trigger \
-	procd_close_trigger \
-	procd_open_instance \
-	procd_close_instance \
-	procd_open_validate \
-	procd_close_validate \
-	procd_add_jail \
-	procd_add_jail_mount \
-	procd_add_jail_mount_rw \
-	procd_set_param \
-	procd_append_param \
-	procd_add_validation \
-	procd_set_config_changed \
-	procd_kill \
-	procd_send_signal
diff --git a/common/tools/Makefile b/common/tools/Makefile
new file mode 100644
index 00000000..8d4703ca
--- /dev/null
+++ b/common/tools/Makefile
@@ -0,0 +1,231 @@
+#
+# Copyright (C) 2006-2011 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+# Main makefile for the host tools
+#
+curdir:=tools
+
+# subdirectories to descend into
+tools-y :=
+
+ifeq ($(CONFIG_EXTERNAL_TOOLCHAIN),)
+  BUILD_TOOLCHAIN := y
+  ifdef CONFIG_GCC_USE_GRAPHITE
+    BUILD_ISL = y
+  endif
+endif
+ifneq ($(CONFIG_SDK)$(CONFIG_PACKAGE_kmod-b43)$(CONFIG_BRCMSMAC_USE_FW_FROM_WL),)
+  BUILD_B43_TOOLS = y
+endif
+ifneq ($(CONFIG_SDK)$(CONFIG_TARGET_INITRAMFS_COMPRESSION_BZIP2),)
+  BUILD_BZIP2_TOOLS = y
+endif
+ifneq ($(CONFIG_SDK)$(CONFIG_TARGET_INITRAMFS_COMPRESSION_LZ4),)
+  BUILD_LZ4_TOOLS = y
+endif
+ifneq ($(CONFIG_SDK)$(CONFIG_TARGET_INITRAMFS_COMPRESSION_LZO),)
+  BUILD_LZO_TOOLS = y
+endif
+
+tools-y += autoconf
+tools-y += autoconf-archive
+tools-y += automake
+tools-y += bc
+tools-y += bison
+tools-y += cmake
+tools-y += cpio
+tools-y += dosfstools
+tools-y += e2fsprogs
+tools-y += elfutils
+tools-y += expat
+tools-y += fakeroot
+tools-y += findutils
+tools-y += firmware-utils
+tools-y += flex
+tools-y += gengetopt
+tools-y += gnulib
+tools-y += libressl
+tools-y += libtool
+tools-y += lzma
+tools-y += m4
+tools-y += make-ext4fs
+tools-y += meson
+tools-y += missing-macros
+tools-y += mkimage
+tools-y += mklibs
+tools-y += mtd-utils
+tools-y += mtools
+tools-y += ninja
+tools-y += padjffs2
+tools-y += patch-image
+tools-y += patchelf
+tools-y += pkgconf
+tools-y += quilt
+tools-y += squashfs4
+tools-y += sstrip
+tools-y += util-linux
+tools-y += xz
+tools-y += zip
+tools-y += zlib
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS),y) += liblzo
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(BUILD_B43_TOOLS),y) += b43-tools
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(BUILD_BZIP2_TOOLS),y) += bzip2
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(BUILD_ISL),y) += isl
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(BUILD_LZ4_TOOLS),y) += lz4
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(BUILD_LZO_TOOLS),y) += lzop
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(BUILD_TOOLCHAIN),y) += gmp mpc mpfr
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(CONFIG_TARGET_apm821xx)$(CONFIG_TARGET_gemini),y) += genext2fs
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(CONFIG_TARGET_ath79),y) += lzma-old squashfs3-lzma
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(CONFIG_TARGET_mxs),y) += elftosb sdimage
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(CONFIG_TARGET_realtek),y) += 7z
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(CONFIG_TARGET_tegra),y) += cbootimage cbootimage-configs
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(CONFIG_USES_MINOR),y) += yafut
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(CONFIG_USE_SPARSE),y) += sparse
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(CONFIG_USE_LLVM_BUILD),y) += llvm-bpf
+tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(CONFIG_USE_MOLD),y) += mold
+
+# builddir dependencies
+$(curdir)/autoconf/compile := $(curdir)/m4/compile
+$(curdir)/automake/compile := $(curdir)/autoconf/compile $(curdir)/pkgconf/compile $(curdir)/xz/compile
+$(curdir)/b43-tools/compile := $(curdir)/bison/compile
+$(curdir)/bc/compile := $(curdir)/bison/compile $(curdir)/libtool/compile
+$(curdir)/bison/compile := $(curdir)/flex/compile
+$(curdir)/cbootimage/compile += $(curdir)/automake/compile
+$(curdir)/dwarves/compile += $(curdir)/cmake/compile
+$(curdir)/cmake/compile += $(curdir)/libressl/compile $(curdir)/ninja/compile $(curdir)/expat/compile $(curdir)/xz/compile $(curdir)/zlib/compile $(curdir)/zstd/compile
+$(curdir)/dosfstools/compile := $(curdir)/automake/compile
+$(curdir)/e2fsprogs/compile := $(curdir)/libtool/compile $(curdir)/util-linux/compile
+$(curdir)/elfutils/compile := $(curdir)/m4/compile $(curdir)/zlib/compile $(curdir)/gnulib/compile $(curdir)/libtool/compile
+$(curdir)/fakeroot/compile := $(curdir)/libtool/compile
+$(curdir)/findutils/compile := $(curdir)/bison/compile
+$(curdir)/firmware-utils/compile += $(curdir)/cmake/compile
+$(curdir)/flex/compile := $(curdir)/libtool/compile
+$(curdir)/genext2fs/compile := $(curdir)/libtool/compile
+$(curdir)/gengetopt/compile := $(curdir)/libtool/compile
+$(curdir)/gmp/compile := $(curdir)/libtool/compile
+$(curdir)/isl/compile := $(curdir)/gmp/compile
+$(curdir)/liblzo/compile := $(curdir)/cmake/compile
+$(curdir)/libressl/compile := $(curdir)/pkgconf/compile
+$(curdir)/libtool/compile := $(curdir)/automake/compile $(curdir)/gnulib/compile $(curdir)/missing-macros/compile
+$(curdir)/lz4/compile := $(curdir)/meson/compile
+$(curdir)/lzma-old/compile := $(curdir)/zlib/compile
+$(curdir)/lzop/compile := $(curdir)/cmake/compile $(curdir)/liblzo/compile
+$(curdir)/llvm-bpf/compile := $(curdir)/cmake/compile
+$(curdir)/make-ext4fs/compile := $(curdir)/zlib/compile
+$(curdir)/meson/compile := $(curdir)/ninja/compile
+$(curdir)/missing-macros/compile := $(curdir)/autoconf/compile
+$(curdir)/mkimage/compile += $(curdir)/bison/compile $(curdir)/libressl/compile
+$(curdir)/mklibs/compile := $(curdir)/libtool/compile
+$(curdir)/mold/compile := $(curdir)/cmake/compile $(curdir)/zlib/compile $(curdir)/zstd/compile
+$(curdir)/mpc/compile := $(curdir)/mpfr/compile $(curdir)/gmp/compile
+$(curdir)/mpfr/compile := $(curdir)/gmp/compile
+$(curdir)/mtd-utils/compile := $(curdir)/libtool/compile $(curdir)/zlib/compile $(curdir)/util-linux/compile
+$(curdir)/padjffs2/compile := $(curdir)/findutils/compile
+$(curdir)/patchelf/compile := $(curdir)/libtool/compile
+$(curdir)/pkgconf/compile := $(curdir)/meson/compile
+$(curdir)/quilt/compile := $(curdir)/autoconf/compile $(curdir)/findutils/compile
+$(curdir)/sdcc/compile := $(curdir)/bison/compile
+$(curdir)/squashfs3-lzma/compile := $(curdir)/lzma-old/compile
+$(curdir)/squashfs4/compile := $(curdir)/xz/compile $(curdir)/zlib/compile
+$(curdir)/util-linux/compile := $(curdir)/bison/compile $(curdir)/automake/compile
+$(curdir)/yafut/compile := $(curdir)/cmake/compile
+
+ifneq ($(HOST_OS),Linux)
+  $(curdir)/coreutils/compile += $(curdir)/automake/compile $(curdir)/bison/compile $(curdir)/gnulib/compile
+  $(curdir)/squashfs4/compile += $(curdir)/coreutils/compile
+  tools-y += coreutils
+endif
+ifeq ($(HOST_OS),Darwin)
+  tools-y += bash
+else
+  $(curdir)/dwarves/compile += $(curdir)/elfutils/compile
+  tools-$(if $(CONFIG_BUILD_ALL_HOST_TOOLS)$(CONFIG_DWARVES),y) += dwarves
+endif
+
+ifneq ($(CONFIG_CCACHE)$(CONFIG_SDK),)
+$(foreach tool, $(filter-out zstd zlib xz pkgconf patch ninja meson libressl expat cmake,$(tools-y)), $(eval $(curdir)/$(tool)/compile += $(curdir)/ccache/compile))
+tools-y += ccache xxhash
+$(curdir)/xxhash/compile := $(curdir)/cmake/compile
+$(curdir)/ccache/compile := $(curdir)/xxhash/compile
+endif
+
+# in case there is no patch tool on the host we need to make patch tool a
+# dependency for tools which have patches directory
+$(foreach tool, $(tools-y), $(if $(wildcard $(curdir)/$(tool)/patches),$(eval $(curdir)/$(tool)/compile += $(curdir)/patch/compile)))
+
+$(foreach tool, $(filter-out zstd,$(tools-y)), $(eval $(curdir)/$(tool)/compile += $(curdir)/zstd/compile))
+
+# make any tool depend on the following to ensure that archives can be unpacked and patched properly
+tools-core += libdeflate
+tools-core += patch
+tools-core += tar
+tools-core += zstd
+
+$(foreach tool, $(tools-y), $(eval $(curdir)/$(tool)/compile += $(patsubst %,$(curdir)/%/compile,$(tools-core))))
+tools-y += $(tools-core)
+
+# make some core tools depend on sed and flock
+$(curdir)/patch/compile += $(curdir)/sed/compile
+$(curdir)/tar/compile += $(curdir)/sed/compile
+$(curdir)/zstd/compile += $(curdir)/libdeflate/compile
+
+$(curdir)/sed/compile := $(curdir)/flock/compile $(curdir)/zstd/compile
+tools-y += flock sed
+
+$(curdir)/autoremove := 1
+$(curdir)/builddirs := $(tools-y) $(tools-dep) $(tools-)
+$(curdir)/builddirs-default := $(tools-y)
+
+ifdef CHECK_ALL
+$(curdir)/builddirs-check:=$($(curdir)/builddirs)
+$(curdir)/builddirs-download:=$($(curdir)/builddirs)
+endif
+
+ifndef DUMP_TARGET_DB
+define PrepareStaging
+	@for dir in $(1); do ( \
+		$(if $(QUIET),,set -x;) \
+		mkdir -p "$$dir"; \
+		cd "$$dir"; \
+		mkdir -p bin lib stamp usr/include usr/lib; \
+	); done
+endef
+
+$(BIN_DIR):
+	mkdir -p $@
+
+# preparatory work
+$(STAGING_DIR)/.prepared: $(TMP_DIR)/.build
+	$(call PrepareStaging,$(STAGING_DIR))
+	mkdir -p $(BUILD_DIR)/stamp
+	touch $@
+
+$(STAGING_DIR_HOST)/.prepared: $(TMP_DIR)/.build
+	$(call PrepareStaging,$(STAGING_DIR_HOST))
+	mkdir -p $(BUILD_DIR_HOST)/stamp $(STAGING_DIR_HOST)/include/sys
+	$(INSTALL_DATA) $(TOPDIR)/tools/include/*.h $(STAGING_DIR_HOST)/include/
+	$(INSTALL_DATA) $(TOPDIR)/tools/include/sys/*.h $(STAGING_DIR_HOST)/include/sys/
+ifneq ($(HOST_OS),Linux)
+	mkdir -p $(STAGING_DIR_HOST)/include/asm
+	$(INSTALL_DATA) $(TOPDIR)/tools/include/asm/*.h $(STAGING_DIR_HOST)/include/asm/
+endif
+	ln -snf lib $(STAGING_DIR_HOST)/lib64
+	touch $@
+
+endif
+
+$(curdir)//prepare = $(STAGING_DIR)/.prepared $(STAGING_DIR_HOST)/.prepared $(BIN_DIR)
+$(curdir)//compile = $(STAGING_DIR)/.prepared $(STAGING_DIR_HOST)/.prepared $(BIN_DIR)
+
+# prerequisites for the individual targets
+$(curdir)/ := .config prereq
+
+$(curdir)/install: $(curdir)/compile
+
+tools_enabled = $(foreach tool,$(sort $(tools-y) $(tools-)),$(if $(filter $(tool),$(tools-y)),y,n))
+$(eval $(call stampfile,$(curdir),tools,compile,,_$(subst $(space),,$(tools_enabled)),$(STAGING_DIR_HOST)))
+$(eval $(call stampfile,$(curdir),tools,check,$(TMP_DIR)/.build,,$(STAGING_DIR_HOST)))
+$(eval $(call subdir,$(curdir)))
diff --git a/common/tools/dwarves/Makefile b/common/tools/dwarves/Makefile
index f563a02b..c6edc46b 100644
--- a/common/tools/dwarves/Makefile
+++ b/common/tools/dwarves/Makefile
@@ -3,13 +3,17 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dwarves
-PKG_VERSION:=1.27
-PKG_RELEASE:=2
+PKG_VERSION:=1.28
+PKG_RELEASE:=1
+
+PKG_BUILD_PARALLEL:=0
+HOST_BUILD_PARALLEL:=0
+
+CMAKE_INSTALL:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
-PKG_SOURCE_URL:=https://acme.fedorapeople.org/dwarves/
-#PKG_SOURCE_URL:=https://fedorapeople.org/~acme/dwarves/
-PKG_HASH:=ef7f21f1c6016896d03a01f05cab225151f9068e19cc8cddc6e754b2b5cbe279
+PKG_SOURCE_URL:=https://fedorapeople.org/~acme/dwarves/
+PKG_HASH:=826efc0fc9237d3c1e9c01553ea387a8cb46e8dc119ff863889043f4ed54b2ae
 
 PKG_MAINTAINER:=Tony Ambardar <itugrok@yahoo.com>
 PKG_LICENSE:=GPL-2.0-only
diff --git a/common/tools/dwarves/patches/100-reproducible-builds.patch b/common/tools/dwarves/patches/100-reproducible-builds.patch
index 15bddd56..d8cbd114 100644
--- a/common/tools/dwarves/patches/100-reproducible-builds.patch
+++ b/common/tools/dwarves/patches/100-reproducible-builds.patch
@@ -1,6 +1,6 @@
 --- a/pahole.c
 +++ b/pahole.c
-@@ -3723,6 +3723,9 @@ int main(int argc, char *argv[])
+@@ -3681,6 +3681,9 @@ int main(int argc, char *argv[])
  		goto out;
  	}
  
diff --git a/config b/config
index 4f572399..3da5193c 100644
--- a/config
+++ b/config
@@ -290,3 +290,5 @@ CONFIG_KERNEL_NF_CONNTRACK_DESTROY_HOOK=y
 # CONFIG_PACKAGE_wpad-basic-mbedtls is not set
 # CONFIG_PACKAGE_wpad-basic-wolfssl is not set
 CONFIG_PACKAGE_kmod-nft-queue=m
+# CONFIG_PACKAGE_apk-mbedtls is not set
+
diff --git a/config-bpi-r3 b/config-bpi-r3
new file mode 100644
index 00000000..2aa08444
--- /dev/null
+++ b/config-bpi-r3
@@ -0,0 +1,9 @@
+CONFIG_TARGET_mediatek=y
+CONFIG_TARGET_mediatek_filogic=y
+CONFIG_TARGET_mediatek_filogic_DEVICE_bananapi_bpi-r3=y
+CONFIG_KERNEL_ARM64_MODULE_PLTS=y
+CONFIG_KERNEL_TCP_CONG_BBR2=y
+CONFIG_PACKAGE_kmod-mt76=y
+CONFIG_PACKAGE_kmod-thermal=y
+CONFIG_PACKAGE_kmod-hwmon-core=y
+# CONFIG_TARGET_ROOTFS_INITRAMFS is not set
diff --git a/config-bpi-r3-mini b/config-bpi-r3-mini
new file mode 100644
index 00000000..55846120
--- /dev/null
+++ b/config-bpi-r3-mini
@@ -0,0 +1,9 @@
+CONFIG_TARGET_mediatek=y
+CONFIG_TARGET_mediatek_filogic=y
+CONFIG_TARGET_mediatek_filogic_DEVICE_bananapi_bpi-r3-mini=y
+CONFIG_KERNEL_ARM64_MODULE_PLTS=y
+CONFIG_KERNEL_TCP_CONG_BBR2=y
+CONFIG_PACKAGE_kmod-mt76=y
+CONFIG_PACKAGE_kmod-thermal=y
+CONFIG_PACKAGE_kmod-hwmon-core=y
+# CONFIG_TARGET_ROOTFS_INITRAMFS is not set
diff --git a/config-bpi-r4 b/config-bpi-r4
new file mode 100644
index 00000000..9140d5f3
--- /dev/null
+++ b/config-bpi-r4
@@ -0,0 +1,9 @@
+CONFIG_TARGET_mediatek=y
+CONFIG_TARGET_mediatek_filogic=y
+CONFIG_TARGET_mediatek_filogic_DEVICE_bananapi_bpi-r4=y
+CONFIG_KERNEL_ARM64_MODULE_PLTS=y
+CONFIG_KERNEL_TCP_CONG_BBR2=y
+CONFIG_PACKAGE_kmod-mt76=y
+CONFIG_PACKAGE_kmod-thermal=y
+CONFIG_PACKAGE_kmod-hwmon-core=y
+# CONFIG_TARGET_ROOTFS_INITRAMFS is not set
diff --git a/config-bpi-r4-poe b/config-bpi-r4-poe
new file mode 100644
index 00000000..627543b6
--- /dev/null
+++ b/config-bpi-r4-poe
@@ -0,0 +1,9 @@
+CONFIG_TARGET_mediatek=y
+CONFIG_TARGET_mediatek_filogic=y
+CONFIG_TARGET_mediatek_filogic_DEVICE_bananapi_bpi-r4-poe=y
+CONFIG_KERNEL_ARM64_MODULE_PLTS=y
+CONFIG_KERNEL_TCP_CONG_BBR2=y
+CONFIG_PACKAGE_kmod-mt76=y
+CONFIG_PACKAGE_kmod-thermal=y
+CONFIG_PACKAGE_kmod-hwmon-core=y
+# CONFIG_TARGET_ROOTFS_INITRAMFS is not set
diff --git a/config-gl-mt2500 b/config-gl-mt2500
new file mode 100644
index 00000000..7bebb369
--- /dev/null
+++ b/config-gl-mt2500
@@ -0,0 +1,5 @@
+CONFIG_TARGET_mediatek=y
+CONFIG_TARGET_mediatek_filogic=y
+CONFIG_TARGET_mediatek_filogic_DEVICE_glinet_gl-mt2500=y
+CONFIG_KERNEL_ARM64_MODULE_PLTS=y
+CONFIG_KERNEL_TCP_CONG_BBR2=y
diff --git a/config-gl-mt3000 b/config-gl-mt3000
new file mode 100644
index 00000000..7dac2b34
--- /dev/null
+++ b/config-gl-mt3000
@@ -0,0 +1,5 @@
+CONFIG_TARGET_mediatek=y
+CONFIG_TARGET_mediatek_filogic=y
+CONFIG_TARGET_mediatek_filogic_DEVICE_glinet_gl-mt3000=y
+CONFIG_KERNEL_ARM64_MODULE_PLTS=y
+CONFIG_KERNEL_TCP_CONG_BBR2=y
diff --git a/config-gl-mt6000 b/config-gl-mt6000
new file mode 100644
index 00000000..63281bce
--- /dev/null
+++ b/config-gl-mt6000
@@ -0,0 +1,5 @@
+CONFIG_TARGET_mediatek=y
+CONFIG_TARGET_mediatek_filogic=y
+CONFIG_TARGET_mediatek_filogic_DEVICE_glinet_gl-mt6000=y
+CONFIG_KERNEL_ARM64_MODULE_PLTS=y
+CONFIG_KERNEL_TCP_CONG_BBR2=y
diff --git a/config-r2s b/config-r2s
index 78171435..aa762f22 100644
--- a/config-r2s
+++ b/config-r2s
@@ -11,3 +11,4 @@ CONFIG_CRYPTO_SHA2_ARM_CE=y
 CONFIG_CRYPTO_GHASH_ARM_CE=y
 CONFIG_CRYPTO_AES_ARM=y
 CONFIG_CRYPTO_AES_ARM_CE=y
+CONFIG_PACKAGE_kmod-usb-net-rtl8152=y
diff --git a/config-r4s b/config-r4s
index ccb2af0b..f93886e2 100644
--- a/config-r4s
+++ b/config-r4s
@@ -11,3 +11,7 @@ CONFIG_CRYPTO_SHA2_ARM_CE=y
 CONFIG_CRYPTO_GHASH_ARM_CE=y
 CONFIG_CRYPTO_AES_ARM=y
 CONFIG_CRYPTO_AES_ARM_CE=y
+CONFIG_PACKAGE_kmod-r8169=y
+CONFIG_PACKAGE_r8169-firmware=y
+CONFIG_PACKAGE_kmod-phy-realtek=y
+CONFIG_MODULE_DEFAULT_kmod-r8169=y
diff --git a/config-r5c b/config-r5c
new file mode 100644
index 00000000..051997ab
--- /dev/null
+++ b/config-r5c
@@ -0,0 +1,26 @@
+CONFIG_TARGET_rockchip=y
+CONFIG_TARGET_rockchip_armv8=y
+CONFIG_TARGET_rockchip_armv8_DEVICE_friendlyarm_nanopi-r5c=y
+CONFIG_PACKAGE_kmod-6lowpan=y
+CONFIG_KERNEL_ARM64_MODULE_PLTS=y
+CONFIG_KERNEL_TCP_CONG_BBR2=y
+CONFIG_CRYPTO_HW=y
+CONFIG_ARM64_CRYPTO=y
+CONFIG_CRYPTO_SHA1_ARM_CE=y
+CONFIG_CRYPTO_SHA2_ARM_CE=y
+CONFIG_CRYPTO_GHASH_ARM_CE=y
+CONFIG_CRYPTO_AES_ARM=y
+CONFIG_CRYPTO_AES_ARM_CE=y
+CONFIG_PACKAGE_kmod-gpu-lima=y
+CONFIG_PACKAGE_kmod-ath9k-htc=y
+CONFIG_PACKAGE_kmod-mt76x0u=y
+CONFIG_PACKAGE_kmod-mt76x2u=y
+CONFIG_PACKAGE_kmod-r8125=y
+CONFIG_PACKAGE_kmod-rtw88=y
+CONFIG_PACKAGE_kmod-rtl8812au-ct=y
+CONFIG_PACKAGE_rtl8821ce-firmware=y
+CONFIG_PACKAGE_kmod-r8169=y
+CONFIG_PACKAGE_kmod-rtw88-8822ce=y
+CONFIG_PACKAGE_rtl8822ce-firmware=y
+CONFIG_PACKAGE_kmod-phy-realtek=y
+CONFIG_PACKAGE_r8169-firmware=y
diff --git a/config-r5s b/config-r5s
index 122aa851..b1bcb311 100644
--- a/config-r5s
+++ b/config-r5s
@@ -19,3 +19,6 @@ CONFIG_PACKAGE_kmod-r8125=y
 CONFIG_PACKAGE_kmod-rtw88=y
 CONFIG_PACKAGE_kmod-rtl8812au-ct=y
 CONFIG_PACKAGE_rtl8821ce-firmware=y
+CONFIG_PACKAGE_kmod-r8169=y
+CONFIG_PACKAGE_kmod-phy-realtek=y
+CONFIG_PACKAGE_r8169-firmware=y
diff --git a/config-r6s b/config-r6s
new file mode 100644
index 00000000..43112653
--- /dev/null
+++ b/config-r6s
@@ -0,0 +1,25 @@
+CONFIG_TARGET_rockchip=y
+CONFIG_TARGET_rockchip_armv8=y
+CONFIG_TARGET_rockchip_armv8_DEVICE_friendlyarm_nanopi-r6s=y
+CONFIG_PACKAGE_kmod-6lowpan=y
+CONFIG_KERNEL_ARM64_MODULE_PLTS=y
+CONFIG_KERNEL_TCP_CONG_BBR2=y
+CONFIG_CRYPTO_HW=y
+CONFIG_ARM64_CRYPTO=y
+CONFIG_CRYPTO_SHA1_ARM_CE=y
+CONFIG_CRYPTO_SHA2_ARM_CE=y
+CONFIG_CRYPTO_GHASH_ARM_CE=y
+CONFIG_CRYPTO_AES_ARM=y
+CONFIG_CRYPTO_AES_ARM_CE=y
+CONFIG_PACKAGE_kmod-gpu-lima=y
+CONFIG_PACKAGE_kmod-ath9k-htc=y
+CONFIG_PACKAGE_kmod-mt76x0u=y
+CONFIG_PACKAGE_kmod-mt76x2u=y
+CONFIG_PACKAGE_kmod-r8125=y
+CONFIG_PACKAGE_kmod-rtw88=y
+CONFIG_PACKAGE_kmod-rtl8812au-ct=y
+CONFIG_PACKAGE_rtl8821ce-firmware=y
+CONFIG_PACKAGE_kmod-r8169=y
+CONFIG_PACKAGE_kmod-phy-realtek=y
+CONFIG_PACKAGE_r8169-firmware=y
+CONFIG_MODULE_DEFAULT_kmod-r8169=y
diff --git a/config-r7800 b/config-r7800
index 1cecaa90..36b88d68 100644
--- a/config-r7800
+++ b/config-r7800
@@ -19,3 +19,6 @@ CONFIG_KERNEL_GPIO_SYSFS=y
 # CONFIG_KERNEL_KPROBES is not set
 # CONFIG_KERNEL_FTRACE is not set
 # CONFIG_KERNEL_KALLSYMS is not set
+CONFIG_PACKAGE_kmod-switch-ar8xxx=y
+CONFIG_PACKAGE_ath10k-firmware-qca9984-ct=y
+CONFIG_PACKAGE_kmod-ramoops=y
diff --git a/config-z8102ax-emmc b/config-z8102ax-emmc
new file mode 100644
index 00000000..e96a88e8
--- /dev/null
+++ b/config-z8102ax-emmc
@@ -0,0 +1,16 @@
+CONFIG_TARGET_mediatek=y
+CONFIG_TARGET_mediatek_filogic=y
+CONFIG_TARGET_mediatek_filogic_DEVICE_z8102ax-emmc=y
+CONFIG_KERNEL_ARM64_MODULE_PLTS=y
+CONFIG_KERNEL_TCP_CONG_BBR2=y
+CONFIG_PACKAGE_z8102=y
+CONFIG_PACKAGE_kmod-mt76=y
+#CONFIG_TARGET_ROOTFS_PARTSIZE=128
+CONFIG_TARGET_INITRAMFS_COMPRESSION_NONE=y
+# CONFIG_TARGET_INITRAMFS_COMPRESSION_GZIP is not set
+# CONFIG_TARGET_INITRAMFS_COMPRESSION_BZIP2 is not set
+# CONFIG_TARGET_INITRAMFS_COMPRESSION_LZMA is not set
+# CONFIG_TARGET_INITRAMFS_COMPRESSION_LZO is not set
+# CONFIG_TARGET_INITRAMFS_COMPRESSION_LZ4 is not set
+# CONFIG_TARGET_INITRAMFS_COMPRESSION_XZ is not set
+# CONFIG_TARGET_INITRAMFS_COMPRESSION_ZSTD is not set
diff --git a/config-z8109ax_128m b/config-z8109ax_128m
new file mode 100644
index 00000000..fa071beb
--- /dev/null
+++ b/config-z8109ax_128m
@@ -0,0 +1,16 @@
+CONFIG_TARGET_mediatek=y
+CONFIG_TARGET_mediatek_filogic=y
+CONFIG_TARGET_mediatek_filogic_DEVICE_z8109ax-128m=y
+CONFIG_KERNEL_ARM64_MODULE_PLTS=y
+CONFIG_KERNEL_TCP_CONG_BBR2=y
+CONFIG_PACKAGE_z8102=y
+CONFIG_PACKAGE_kmod-mt76=y
+CONFIG_TARGET_ROOTFS_PARTSIZE=128
+CONFIG_TARGET_INITRAMFS_COMPRESSION_NONE=y
+# CONFIG_TARGET_INITRAMFS_COMPRESSION_GZIP is not set
+# CONFIG_TARGET_INITRAMFS_COMPRESSION_BZIP2 is not set
+# CONFIG_TARGET_INITRAMFS_COMPRESSION_LZMA is not set
+# CONFIG_TARGET_INITRAMFS_COMPRESSION_LZO is not set
+# CONFIG_TARGET_INITRAMFS_COMPRESSION_LZ4 is not set
+# CONFIG_TARGET_INITRAMFS_COMPRESSION_XZ is not set
+# CONFIG_TARGET_INITRAMFS_COMPRESSION_ZSTD is not set
diff --git a/config-z8109ax_512m b/config-z8109ax_512m
new file mode 100644
index 00000000..63623ec6
--- /dev/null
+++ b/config-z8109ax_512m
@@ -0,0 +1,16 @@
+CONFIG_TARGET_mediatek=y
+CONFIG_TARGET_mediatek_filogic=y
+CONFIG_TARGET_mediatek_filogic_DEVICE_z8109ax-512m=y
+CONFIG_KERNEL_ARM64_MODULE_PLTS=y
+CONFIG_KERNEL_TCP_CONG_BBR2=y
+CONFIG_PACKAGE_z8102=y
+CONFIG_PACKAGE_kmod-mt76=y
+CONFIG_TARGET_ROOTFS_PARTSIZE=512
+CONFIG_TARGET_INITRAMFS_COMPRESSION_NONE=y
+# CONFIG_TARGET_INITRAMFS_COMPRESSION_GZIP is not set
+# CONFIG_TARGET_INITRAMFS_COMPRESSION_BZIP2 is not set
+# CONFIG_TARGET_INITRAMFS_COMPRESSION_LZMA is not set
+# CONFIG_TARGET_INITRAMFS_COMPRESSION_LZO is not set
+# CONFIG_TARGET_INITRAMFS_COMPRESSION_LZ4 is not set
+# CONFIG_TARGET_INITRAMFS_COMPRESSION_XZ is not set
+# CONFIG_TARGET_INITRAMFS_COMPRESSION_ZSTD is not set
diff --git a/contributors/kawiso.md b/contributors/kawiso.md
new file mode 100644
index 00000000..e9b0fb50
--- /dev/null
+++ b/contributors/kawiso.md
@@ -0,0 +1,9 @@
+2024-11-27
+
+I hereby agree to the terms of the "OpenMPTCProuter Individual Contributor License Agreement", with MD5 checksum bc827a07eb93611d793ddb7c75083c00.
+
+I furthermore declare that I am authorized and able to make this agreement and sign this declaration.
+
+Signed,
+
+Kevin Giesche https://github.com/kawiso
diff --git a/patches/luci-unbound-logread.patch b/patches/luci-unbound-logread.patch
new file mode 100644
index 00000000..6f892e61
--- /dev/null
+++ b/patches/luci-unbound-logread.patch
@@ -0,0 +1,11 @@
+--- a/luci/applications/luci-app-unbound/luasrc/controller/unbound.lua	2024-12-05 17:50:53.928401368 +0100
++++ b/luci/applications/luci-app-unbound/luasrc/controller/unbound.lua	2024-12-05 17:51:23.255945317 +0100
+@@ -110,7 +110,7 @@
+ 
+ 
+ function QuerySysLog()
+-    local lcldata = luci.util.exec("logread -e 'unbound'")
++    local lcldata = luci.util.exec("logread -e 'unbound' || logread | grep 'unbound:'")
+     local lcldesc = luci.i18n.translate(
+         "This shows syslog filtered for events involving Unbound.")
+